diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 16704cd6fcc8..73ff39055e15 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -2,7 +2,7 @@
 # Overview
 #
 # Pattern used to match files follows most of the same rules as used in gitignore files. Order is
-# important; the last matching pattern takes precendence.
+# important; the last matching pattern takes precedence.
 #
 # For more info see:
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
@@ -30,7 +30,6 @@
 # Core Clients (@keycloak/core-clients-maintainers)
 ###################################################################################################
 
-/js/libs/keycloak-js/                                       @keycloak/core-clients-maintainers
 
 ###################################################################################################
 # Cloud Native (@keycloak/cloud-native-maintainers)
@@ -47,7 +46,17 @@
 ###################################################################################################
 
 /themes/                                                    @keycloak/ui-maintainers @keycloak/maintainers
-/js/                                                        @keycloak/ui-maintainers
-/js/**/maven-resources-community/**/messages_*.properties   @keycloak/ui-maintainers @keycloak/maintainers
-/adapters/oidc/js/                                          @keycloak/ui-maintainers
-/rest/admin-ui-ext/                                         @keycloak/ui-maintainers
+/js/                                                        @keycloak/ui-maintainers @keycloak/maintainers
+/js/**/messages_*.properties                                @keycloak/ui-maintainers @keycloak/maintainers
+/adapters/oidc/js/                                          @keycloak/ui-maintainers @keycloak/maintainers
+/rest/admin-ui-ext/                                         @keycloak/ui-maintainers @keycloak/maintainers
+
+###################################################################################################
+# SRE (@keycloak/sre-maintainers)
+###################################################################################################
+
+/model/infinispan/                                          @keycloak/sre-maintainers @keycloak/maintainers
+/tests/clustering/                                          @keycloak/sre-maintainers @keycloak/maintainers
+/test-framework/clustering/                                 @keycloak/sre-maintainers @keycloak/maintainers
+/docs/guides/high-availability/                             @keycloak/sre-maintainers @keycloak/maintainers
+/docs/guides/observability/                                 @keycloak/sre-maintainers @keycloak/maintainers
\ No newline at end of file
diff --git a/.github/actions/archive-surefire-reports/action.yml b/.github/actions/archive-surefire-reports/action.yml
index 91b1c525477a..ddc0acb89d94 100644
--- a/.github/actions/archive-surefire-reports/action.yml
+++ b/.github/actions/archive-surefire-reports/action.yml
@@ -37,7 +37,7 @@ runs:
     - id: upload-surefire-linux
       name: Upload Surefire reports
       if: (!cancelled() && contains(fromJSON(inputs.release-branches), github.ref) && contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name))
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: surefire-${{ inputs.job-id }}
         path: |
diff --git a/.github/actions/build-keycloak/action.yml b/.github/actions/build-keycloak/action.yml
index 0e59b1b0393f..481a1f34537d 100644
--- a/.github/actions/build-keycloak/action.yml
+++ b/.github/actions/build-keycloak/action.yml
@@ -49,7 +49,7 @@ runs:
     - id: upload-keycloak-maven-repository
       name: Upload Keycloak Maven artifacts
       if: inputs.upload-m2-repo == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: m2-keycloak.tzts
         path: m2-keycloak.tzts
@@ -58,7 +58,7 @@ runs:
     - id: upload-keycloak-dist
       name: Upload Keycloak dist
       if: inputs.upload-dist == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: keycloak-dist
         path: quarkus/dist/target/keycloak*.tar.gz
diff --git a/.github/actions/conditional/conditions b/.github/actions/conditional/conditions
index a75129ca99fc..88e1b2b7b6d4 100644
--- a/.github/actions/conditional/conditions
+++ b/.github/actions/conditional/conditions
@@ -3,6 +3,7 @@
 # To test a pattern run '.github/actions/conditional/conditional.sh <remote name> <branch>'
 
 .github/actions/                            ci ci-quarkus ci-store ci-sssd operator js codeql-java codeql-javascript codeql-typescript guides documentation
+.github/fake_fips/                          ci
 .github/scripts/                            ci ci-quarkus ci-sssd
 .github/scripts/ansible/                    ci-store
 .github/scripts/aws/                        ci-store
@@ -35,9 +36,9 @@ docs/documentation/                         documentation
 js/                                         js
 rest/admin-ui-ext/                          js
 services/                                   js
+themes/                                     js
 js/apps/account-ui/                         ci ci-webauthn
 js/libs/ui-shared/                          ci ci-webauthn
-js/libs/keycloak-js/                        ci ci-quarkus
 
 # The sections below contain a sub-set of files existing in the project which are supported languages by CodeQL.
 # See: https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/
diff --git a/.github/actions/cypress-cache/action.yml b/.github/actions/cypress-cache/action.yml
deleted file mode 100644
index 994192cfb0d3..000000000000
--- a/.github/actions/cypress-cache/action.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Cache Cypress
-description: Caches Cypress binary to speed up the build.
-
-runs:
-  using: composite
-  steps:
-    - id: cache-key
-      name: Cache key based on Cypress version
-      shell: bash
-      run: echo "key=cypress-binary-$(jq -r '.devDependencies.cypress' js/apps/admin-ui/package.json)" >> $GITHUB_OUTPUT
-
-    - uses: actions/cache@v4
-      name: Cache Cypress binary
-      with:
-        # See: https://docs.cypress.io/app/references/advanced-installation#Binary-cache
-        path: |
-          ~/.cache/Cypress
-          /AppData/Local/Cypress/Cache
-          ~/Library/Caches/Cypress
-        key: ${{ runner.os }}-${{ steps.cache-key.outputs.key }}
diff --git a/.github/actions/install-chrome/action.yml b/.github/actions/install-chrome/action.yml
new file mode 100644
index 000000000000..c880cddf9345
--- /dev/null
+++ b/.github/actions/install-chrome/action.yml
@@ -0,0 +1,39 @@
+name: Install Chrome browser and driver for Testing
+description: Download and install the compatible Chrome and Chromedriver
+
+inputs:
+  version:
+    description: The version of Chrome and Chromedriver to install. By default none is installed.
+    required: false
+    default: default # E.g. 135.0.7049.84 (fixed version), default (chrome provided by GHA box)
+
+runs:
+  using: composite
+  steps:
+
+    - id: install-chrome
+      name: Install Chrome
+      if: inputs.version != 'default'
+      shell: bash
+      run: |
+        sudo apt-get remove google-chrome-stable
+        wget http://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${{ inputs.version }}-1_amd64.deb -O /tmp/google-chrome-stable.deb --no-verbose
+        sudo apt-get install -y /tmp/google-chrome-stable.deb
+
+    - id: install-chromedriver
+      name: Install Chromedriver
+      if: inputs.version != 'default'
+      shell: bash
+      run: |
+        wget https://storage.googleapis.com/chrome-for-testing-public/${{ inputs.version }}/linux64/chromedriver-linux64.zip -O /tmp/chromedriver.zip --no-verbose
+        unzip -j /tmp/chromedriver.zip -d /tmp
+        sudo mv -f /tmp/chromedriver $CHROMEWEBDRIVER/chromedriver
+        sudo chmod +x $CHROMEWEBDRIVER/chromedriver
+
+    - id: show-version
+      name: Show Version
+      if: inputs.version == 'default'
+      shell: bash
+      run: |
+        google-chrome --version
+        $CHROMEWEBDRIVER/chromedriver --version
diff --git a/.github/actions/integration-test-setup/action.yml b/.github/actions/integration-test-setup/action.yml
index 4ec5a39f9ccf..1a4a15218303 100644
--- a/.github/actions/integration-test-setup/action.yml
+++ b/.github/actions/integration-test-setup/action.yml
@@ -14,6 +14,10 @@ inputs:
 runs:
   using: composite
   steps:
+    - id: update-hosts
+      name: Update /etc/hosts
+      uses: ./.github/actions/update-hosts
+
     - id: setup-java
       name: Setup Java
       uses: ./.github/actions/java-setup
@@ -31,7 +35,7 @@ runs:
 
     - id: download-keycloak
       name: Download Keycloak Maven artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: m2-keycloak.tzts
 
diff --git a/.github/actions/java-setup/action.yml b/.github/actions/java-setup/action.yml
index 4b1013ec9d8c..8f7f43e3c045 100644
--- a/.github/actions/java-setup/action.yml
+++ b/.github/actions/java-setup/action.yml
@@ -16,7 +16,7 @@ runs:
   steps:
     - id: setup-java
       name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
         distribution: ${{ inputs.distribution }}
         java-version: ${{ inputs.java-version }}
diff --git a/.github/actions/maven-cache/action.yml b/.github/actions/maven-cache/action.yml
index fbfbfb2d3a72..f5a9a2873d34 100644
--- a/.github/actions/maven-cache/action.yml
+++ b/.github/actions/maven-cache/action.yml
@@ -19,7 +19,7 @@ runs:
 
     - id: cache-maven-repository
       name: Maven cache
-      uses: actions/cache@v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       if: inputs.create-cache-if-it-doesnt-exist == 'true'
       with:
         # Two asterisks are needed to make the follow-up exclusion work
@@ -31,20 +31,9 @@ runs:
         # Enable cross-os archive use the cache on both Linux and Windows
         enableCrossOsArchive: true
 
-    - shell: powershell
-      name: Link the cached Maven repository to the OS-dependent location
-      if: inputs.create-cache-if-it-doesnt-exist == 'false' && runner.os == 'Windows'
-      # The cache restore in the next step uses the relative path which was valid on Linux and that is part of the archive it downloads.
-      # You'll see that path when you enable debugging for the GitHub workflow on Windows.
-      # On Windows, the .m2 folder is in different location, so move all the contents to the right folder here.
-      # Also, not using the C: drive will speed up the build, see https://github.com/actions/runner-images/issues/8755
-      run: |
-        mkdir -p ../../../.m2/repository
-        cmd /c mklink /d $HOME\.m2\repository D:\.m2\repository
-
     - id: restore-maven-repository
       name: Maven cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       if: inputs.create-cache-if-it-doesnt-exist == 'false'
       with:
         # This needs to repeat the same path pattern as above to find the matching cache
@@ -54,6 +43,15 @@ runs:
         key: ${{ steps.weekly-cache-key.outputs.key }}
         enableCrossOsArchive: true
 
+    - shell: bash
+      name: Copy restored maven repo to home folder in Windows
+      if: (steps.cache-maven-repository.outputs.cache-hit == 'true' || steps.restore-maven-repository.outputs.cache-hit == 'true') && runner.os == 'Windows'
+      run: |
+        if [ -d ../../../.m2/repository ]; then
+          cp -r ../../../.m2/repository ~/.m2
+          rm -r ../../../.m2/repository
+        fi
+
     - id: node-cache
       name: Node cache
       uses: ./.github/actions/node-cache
diff --git a/.github/actions/node-cache/action.yml b/.github/actions/node-cache/action.yml
index 583a9a62c214..6c2421294cc4 100644
--- a/.github/actions/node-cache/action.yml
+++ b/.github/actions/node-cache/action.yml
@@ -12,7 +12,7 @@ runs:
         echo "pnpm=$(cat js/pom.xml | grep '<pnpm.version>' | cut -d '>' -f 2 | cut -d '<' -f 1 | cut -c 1-)" >> $GITHUB_OUTPUT
 
     # Downloading Node.js often fails due to network issues, therefore we cache the artifacts downloaded by the frontend plugin.
-    - uses: actions/cache@v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       id: cache-binaries
       name: Cache Node.js and PNPM binaries
       with:
diff --git a/.github/actions/pnpm-setup/action.yml b/.github/actions/pnpm-setup/action.yml
index 350298a91390..6eb1853a97cf 100644
--- a/.github/actions/pnpm-setup/action.yml
+++ b/.github/actions/pnpm-setup/action.yml
@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
         check-latest: true
@@ -23,17 +23,7 @@ runs:
     - name: PNPM store cache
       uses: ./.github/actions/pnpm-store-cache
 
-    - name: Cypress binary cache
-      uses: ./.github/actions/cypress-cache
-
     - name: Install dependencies
       shell: bash
       run: pnpm install --prefer-offline --frozen-lockfile
       working-directory: js
-
-    # This step is only needed to ensure that the Cypress binary is installed.
-    # If the binary was retrieved from the cache, this step is a no-op.
-    - name: Install Cypress dependencies
-      shell: bash
-      working-directory: js/apps/admin-ui
-      run: pnpm exec cypress install
diff --git a/.github/actions/pnpm-store-cache/action.yml b/.github/actions/pnpm-store-cache/action.yml
index 3929d4824ec8..374cfcac2be2 100644
--- a/.github/actions/pnpm-store-cache/action.yml
+++ b/.github/actions/pnpm-store-cache/action.yml
@@ -9,7 +9,7 @@ runs:
       shell: bash
       run: echo "key=pnpm-store-`date -u "+%Y-%U"`" >> $GITHUB_OUTPUT
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       name: Cache PNPM store
       with:
         # See: https://pnpm.io/npmrc#store-dir
diff --git a/.github/actions/update-hosts/action.yml b/.github/actions/update-hosts/action.yml
new file mode 100644
index 000000000000..d2c7f4289719
--- /dev/null
+++ b/.github/actions/update-hosts/action.yml
@@ -0,0 +1,21 @@
+name: Update /etc/hosts
+description: Update /etc/hosts file to hardcode known nip.io hostnames. This is to avoid test instability due to DNS resolution issues.
+
+runs:
+  using: composite
+  steps:
+
+    - id: update-hosts-linux
+      name: Update /etc/hosts
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        printf "\n\n$(cat .github/actions/update-hosts/nipio-hosts)" | sudo tee -a /etc/hosts
+
+    - id: update-hosts-windows
+      name: Update C:\Windows\System32\drivers\etc\hosts
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        "`n`n" | Add-Content C:\Windows\System32\drivers\etc\hosts
+        Get-Content .github/actions/update-hosts/nipio-hosts | Add-Content C:\Windows\System32\drivers\etc\hosts
\ No newline at end of file
diff --git a/.github/actions/update-hosts/nipio-hosts b/.github/actions/update-hosts/nipio-hosts
new file mode 100644
index 000000000000..d7f1a601cf0f
--- /dev/null
+++ b/.github/actions/update-hosts/nipio-hosts
@@ -0,0 +1,2 @@
+127.0.0.1 localtest.me 127.0.0.1.nip.io admin.127.0.0.1.nip.io localhost-myapp.127.0.0.1.nip.io localhost-sso.127.0.0.1.nip.io realmFrontend.127.0.0.1.nip.io proxy.kc.127.0.0.1.nip.io
+::1 localtest.me 127.0.0.1.nip.io admin.127.0.0.1.nip.io localhost-myapp.127.0.0.1.nip.io localhost-sso.127.0.0.1.nip.io realmFrontend.127.0.0.1.nip.io proxy.kc.127.0.0.1.nip.io
\ No newline at end of file
diff --git a/.github/actions/upload-flaky-tests/action.yml b/.github/actions/upload-flaky-tests/action.yml
index d76580b8e78b..b69de078072e 100644
--- a/.github/actions/upload-flaky-tests/action.yml
+++ b/.github/actions/upload-flaky-tests/action.yml
@@ -47,9 +47,9 @@ runs:
           echo "EOF" >> $GITHUB_OUTPUT
         fi
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: ${{ steps.flaky-tests.outputs.flakes }}
       with:
         name: flaky-tests-${{ github.job }}-${{ join(matrix.*, '-') }}
         path: ${{ steps.flaky-tests.outputs.flakes }}
-        if-no-files-found: error
\ No newline at end of file
+        if-no-files-found: error
diff --git a/.github/actions/upload-heapdumps/action.yml b/.github/actions/upload-heapdumps/action.yml
index 65c2dc54c63f..c305f3d42c05 100644
--- a/.github/actions/upload-heapdumps/action.yml
+++ b/.github/actions/upload-heapdumps/action.yml
@@ -8,7 +8,7 @@ runs:
       name: Upload JVM Heapdumps
       # Windows runners are running into https://github.com/actions/upload-artifact/issues/240
       if: runner.os != 'Windows'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: jvm-heap-dumps
         path: |
diff --git a/.github/fake_fips/fake_fips.c b/.github/fake_fips/fake_fips.c
index 5c0b38c39420..6ea9dda2a777 100644
--- a/.github/fake_fips/fake_fips.c
+++ b/.github/fake_fips/fake_fips.c
@@ -34,7 +34,9 @@ static struct ctl_table crypto_sysctl_table[] = {
 		.mode		= 0444,
 		.proc_handler	= proc_dointvec
 	},
-        {}
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0))
+	{}
+#endif
 };
 static struct ctl_table crypto_dir_table[] = {
 	{
@@ -44,7 +46,9 @@ static struct ctl_table crypto_dir_table[] = {
 		.child          = crypto_sysctl_table
 #endif
 	},
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0))
 	{}
+#endif
 };
 
 static struct ctl_table_header *crypto_sysctls;
diff --git a/.github/mvn-rel-settings.xml b/.github/mvn-rel-settings.xml
deleted file mode 100644
index 79949b291e93..000000000000
--- a/.github/mvn-rel-settings.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
-    <activeProfiles>
-        <activeProfile>keycloak-rel</activeProfile>
-    </activeProfiles>
-    <profiles>
-        <profile>
-            <id>keycloak-rel</id>
-            <repositories>
-                <repository>
-                    <id>${env.MAVEN_ID}</id>
-                    <url>${env.MAVEN_URL}</url>
-                    <snapshots>
-                        <enabled>true</enabled>
-                    </snapshots>
-                    <releases>
-                        <enabled>true</enabled>
-                  </releases>
-                </repository>
-            </repositories>
-        </profile>
-    </profiles>
-    <servers>
-        <server>
-            <id>${env.MAVEN_ID}</id>
-            <username>${env.MAVEN_USERNAME}</username>
-           <password>${env.MAVEN_PASSWORD}</password>
-        </server>
-        <server>
-            <id>gpg.passphrase</id>
-            <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
-        </server>
-    </servers>
-
-</settings>
diff --git a/.github/scripts/aws/rds/aurora_create.sh b/.github/scripts/aws/rds/aurora_create.sh
index 08763f187a56..d24975254b87 100755
--- a/.github/scripts/aws/rds/aurora_create.sh
+++ b/.github/scripts/aws/rds/aurora_create.sh
@@ -116,6 +116,7 @@ aws rds create-db-cluster \
 # For now only two AZs in each region are supported due to the two subnets created above
 for i in $( seq ${AURORA_INSTANCES} ); do
   aws rds create-db-instance \
+    --no-auto-minor-version-upgrade \
     --db-cluster-identifier ${AURORA_CLUSTER} \
     --db-instance-identifier "${AURORA_CLUSTER}-instance-${i}" \
     --db-instance-class ${AURORA_INSTANCE_CLASS} \
diff --git a/.github/scripts/pr-find-issues-test.sh b/.github/scripts/pr-find-issues-test.sh
index 705d8adcc4a7..03de462421b9 100755
--- a/.github/scripts/pr-find-issues-test.sh
+++ b/.github/scripts/pr-find-issues-test.sh
@@ -5,7 +5,7 @@ source ./pr-find-issues.sh
 
 function testParsing() {
     echo -n "$1 -> $2 "
-    if [ $(parse_issues "$1") != "$2" ]; then
+    if [ "$(parse_issues "$1")" != "$2" ]; then
         echo "(failure)"
         return 1
     fi
@@ -22,3 +22,4 @@ trap 'testFailed' ERR
 testParsing "Closes #123" "123"
 testParsing "Fixes #123" "123"
 testParsing "Fixes: #123" "123"
+testParsing "Fixes https://github.com/keycloak/keycloak/issues/123" "123"
\ No newline at end of file
diff --git a/.github/scripts/pr-find-issues.sh b/.github/scripts/pr-find-issues.sh
index c91ccd85dcea..e9bd720ea29b 100755
--- a/.github/scripts/pr-find-issues.sh
+++ b/.github/scripts/pr-find-issues.sh
@@ -8,7 +8,11 @@ if [ "$REPO" == "" ]; then
 fi
 
 function parse_issues() {
-    echo "$1" | grep -i -P -o "(close|closes|closed|resolve|resolves|resolved|fixes|fixed):? #[[:digit:]]*" | cut -d '#' -f 2 | sort -n
+    echo "$1" | \
+      grep -i -P -o "(close|closes|closed|resolve|resolves|resolved|fixes|fixed):? (#|https://github.com/keycloak/keycloak/issues/)[[:digit:]]*" | \
+      sed -e 's|https://github.com/keycloak/keycloak/issues/|#|g' | \
+      sed -e 's|keycloak/keycloak/issues/|#|g' | \
+      cut -d '#' -f 2 | sort -n
 }
 
 if [ "$PR" != "" ]; then
diff --git a/.github/scripts/prepare-quarkus-next.sh b/.github/scripts/prepare-quarkus-next.sh
index 559e56ae00c5..60d6c1acd5d8 100755
--- a/.github/scripts/prepare-quarkus-next.sh
+++ b/.github/scripts/prepare-quarkus-next.sh
@@ -7,7 +7,7 @@ add_repository() {
 
   local id="sonatype-snapshots"
   local name="Sonatype Snapshots"
-  local url="https://s01.oss.sonatype.org/content/repositories/snapshots/"
+  local url="https://central.sonatype.com/repository/maven-snapshots/"
 
   # Decide the tag based on the element
   local tag
diff --git a/.github/scripts/run-fips-it.sh b/.github/scripts/run-fips-it.sh
index 48c46c969448..64b40498568c 100755
--- a/.github/scripts/run-fips-it.sh
+++ b/.github/scripts/run-fips-it.sh
@@ -1,5 +1,6 @@
 #!/bin/bash -x
 
+rm -f /etc/system-fips
 dnf install -y java-21-openjdk-devel
 fips-mode-setup --enable --no-bootcfg
 fips-mode-setup --is-enabled
diff --git a/.github/scripts/run-fips-ut.sh b/.github/scripts/run-fips-ut.sh
index c2ca47405fd4..0ebcb002a236 100755
--- a/.github/scripts/run-fips-ut.sh
+++ b/.github/scripts/run-fips-ut.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+rm -f /etc/system-fips
 dnf install -y java-21-openjdk-devel crypto-policies-scripts
 fips-mode-setup --enable --no-bootcfg
 fips-mode-setup --is-enabled
diff --git a/.github/scripts/version-compatibility.sh b/.github/scripts/version-compatibility.sh
new file mode 100755
index 000000000000..fa42ccf1a9b9
--- /dev/null
+++ b/.github/scripts/version-compatibility.sh
@@ -0,0 +1,25 @@
+#!/bin/bash -e
+
+if [[ "$RUNNER_DEBUG" == "1" ]]; then
+  set -x
+fi
+
+TARGET_BRANCH="$1"
+REPO="${2:-keycloak}"
+ORG="${3:-keycloak}"
+
+if [[ "${TARGET_BRANCH}" != "release/"* ]]; then
+  exit 0
+fi
+
+ALL_RELEASES=$(gh release list \
+  --repo "${ORG}/${REPO}" \
+  --exclude-drafts \
+  --exclude-pre-releases \
+  --json name \
+  --template '{{range .}}{{.name}}{{"\n"}}{{end}}'
+)
+MAJOR_MINOR=${TARGET_BRANCH#"release/"}
+MAJOR_MINOR_RELEASES=$(echo "${ALL_RELEASES}" | grep "${MAJOR_MINOR}")
+
+echo "${MAJOR_MINOR_RELEASES}" | jq -cnR '[inputs] | map({version: .})'
\ No newline at end of file
diff --git a/.github/workflows/aurora-delete.yml b/.github/workflows/aurora-delete.yml
index a2759dda6bc4..34fa4808ff5b 100644
--- a/.github/workflows/aurora-delete.yml
+++ b/.github/workflows/aurora-delete.yml
@@ -12,12 +12,15 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   delete:
     name: Delete Aurora DB
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize AWS client
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 684eae6361bb..78152ad3215c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
@@ -34,9 +37,12 @@ jobs:
       ci-sssd: ${{ steps.conditional.outputs.ci-sssd }}
       ci-webauthn: ${{ steps.conditional.outputs.ci-webauthn }}
       ci-aurora: ${{ steps.auroradb-tests.outputs.run-aurora-tests }}
-
+      ci-compatibility-matrix: ${{ steps.version-compatibility.outputs.matrix }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -52,13 +58,27 @@ jobs:
           fi
           echo "run-aurora-tests=$RUN_AURORADB_TESTS" >> $GITHUB_OUTPUT
 
+      - name: Version Compatibility Matrix
+        id: version-compatibility
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            BRANCH="${{ github.base_ref }}"
+          else
+            BRANCH="${{ github.ref_name }}"
+          fi
+          MATRIX_JSON=$(./.github/scripts/version-compatibility.sh "${BRANCH}")
+          echo "${MATRIX_JSON}"
+          echo "matrix=${MATRIX_JSON}" >> $GITHUB_OUTPUT
+
   build:
     name: Build
     if: needs.conditional.outputs.ci == 'true'
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -73,7 +93,7 @@ jobs:
     needs: build
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: unit-test-setup
         name: Unit test setup
@@ -110,7 +130,7 @@ jobs:
         group: [1, 2, 3, 4, 5, 6]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -145,7 +165,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -186,7 +206,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -231,7 +251,7 @@ jobs:
         os: [ ubuntu-latest, windows-latest ]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # We want to download Keycloak artifacts
       - id: integration-test-setup
@@ -281,9 +301,9 @@ jobs:
       fail-fast: false
     runs-on: ${{ matrix.os }}
     env:
-      MAVEN_OPTS: -Xmx1024m
+      MAVEN_OPTS: -Xmx1536m
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -325,11 +345,11 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
         dist: [temurin]
-        version: [17]
+        version: [17, 24]
       fail-fast: false
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -341,6 +361,9 @@ jobs:
       - name: Prepare Quarkus distribution with current JDK
         run: ./mvnw install -e -pl testsuite/integration-arquillian/servers/auth-server/quarkus
 
+      - name: Run new base tests
+        run: ./mvnw package -f tests/pom.xml -Dtest=JDKTestSuite
+
       - name: Run base tests
         run: |
           TESTS=`testsuite/integration-arquillian/tests/base/testsuites/suite.sh jdk`
@@ -353,7 +376,7 @@ jobs:
 
       - name: Build with JDK
         run:
-          ./mvnw install -e -DskipTests -DskipExamples
+          ./mvnw install -e -DskipTests -DskipExamples -DskipProtoLock=true
 
       - name: Upload JVM Heapdumps
         if: always()
@@ -378,7 +401,7 @@ jobs:
     timeout-minutes: 100
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -414,7 +437,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 150
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -445,7 +468,7 @@ jobs:
 
       - name: EC2 Maven Logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: store-it-mvn-logs
           path: .github/scripts/ansible/files
@@ -461,7 +484,7 @@ jobs:
         variant: [ "clusterless,multi-site" ]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -496,8 +519,11 @@ jobs:
     if: needs.conditional.outputs.ci-aurora == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 150
+    permissions:
+      contents: read
+      actions: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: node-cache
         name: Node cache
@@ -551,7 +577,7 @@ jobs:
           pipx inject ansible-core boto3 botocore
           ./aws_ec2.sh create ${AWS_REGION} ${EC2_CLUSTER_NAME}
           ./keycloak_ec2_installer.sh ${AWS_REGION} ${EC2_CLUSTER_NAME} /tmp/keycloak.zip m2.tar.gz
-          ./mvn_ec2_runner.sh ${AWS_REGION} ${EC2_CLUSTER_NAME} "clean install -B -DskipTests -Pdistribution"
+          ./mvn_ec2_runner.sh ${AWS_REGION} ${EC2_CLUSTER_NAME} "clean install -B -DskipTests -Pdistribution -DskipProtoLock=true"
           ./mvn_ec2_runner.sh ${AWS_REGION} ${EC2_CLUSTER_NAME} "clean install -B -DskipTests -pl testsuite/integration-arquillian/servers/auth-server/quarkus -Pauth-server-quarkus -Pdb-aurora-postgres -Dmaven.build.cache.enabled=true"
 
       - name: Run Aurora migration tests on EC2
@@ -594,7 +620,7 @@ jobs:
 
       - name: EC2 Maven Logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: auroraDB-migration-tests-mvn-logs
           path: .github/scripts/ansible/files
@@ -637,7 +663,7 @@ jobs:
 
       - name: EC2 Maven Logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: aurora-integration-tests-mvn-logs
           path: .github/scripts/ansible/files
@@ -670,7 +696,7 @@ jobs:
         db: [postgres, mysql, oracle, mssql, mariadb]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -678,7 +704,7 @@ jobs:
 
       - name: Run new base tests
         run: |
-          KC_TEST_DATABASE=${{ matrix.db }} KC_TEST_DATABASE_REUSE=true TESTCONTAINERS_REUSE_ENABLE=true ./mvnw test -f tests/pom.xml -Dtest=DatabaseTestSuite
+          KC_TEST_DATABASE=${{ matrix.db }} KC_TEST_DATABASE_REUSE=true TESTCONTAINERS_REUSE_ENABLE=true ./mvnw package -f tests/pom.xml -Dtest=DatabaseTestSuite -Dkeycloak.distribution.start.timeout=360
 
       - name: Database container port
         run: |
@@ -696,6 +722,7 @@ jobs:
             -Ddocker.database.skip=true \
             -Ddocker.database.port=$DATABASE_PORT \
             -Ddocker.container.testdb.ip=localhost \
+            -Dkeycloak.distribution.start.timeout=360 \
             -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
 
       - name: Run cluster JDBC_PING2 UDP smoke test
@@ -750,7 +777,7 @@ jobs:
     if: needs.conditional.outputs.ci-store == 'true'
     timeout-minutes: 75
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -782,9 +809,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 35
     env:
-      MAVEN_OPTS: -Xmx1024m
+      MAVEN_OPTS: -Xmx1536m
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -817,7 +844,11 @@ jobs:
     needs: build
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - id: unit-test-setup
+        name: Unit test setup
+        uses: ./.github/actions/unit-test-setup
 
       - name: Fake fips
         run: |
@@ -825,10 +856,6 @@ jobs:
           make
           sudo insmod fake_fips.ko
 
-      - id: unit-test-setup
-        name: Unit test setup
-        uses: ./.github/actions/unit-test-setup
-
       - name: Run crypto tests
         run: docker run --rm --workdir /github/workspace -v "${{ github.workspace }}":"/github/workspace" -v "$HOME/.m2":"/root/.m2" registry.access.redhat.com/ubi8/ubi:latest .github/scripts/run-fips-ut.sh
 
@@ -852,13 +879,7 @@ jobs:
         mode: [non-strict, strict]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Fake fips
-        run: |
-          cd .github/fake_fips
-          make
-          sudo insmod fake_fips.ko
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -866,6 +887,12 @@ jobs:
         with:
           jdk-version: 21
 
+      - name: Fake fips
+        run: |
+          cd .github/fake_fips
+          make
+          sudo insmod fake_fips.ko
+
       - name: Run base tests
         run: docker run --rm --workdir /github/workspace -e "SUREFIRE_RERUN_FAILING_COUNT" -v "${{ github.workspace }}":"/github/workspace" -v "$HOME/.m2":"/root/.m2" registry.access.redhat.com/ubi8/ubi:latest .github/scripts/run-fips-it.sh ${{ matrix.mode }}
 
@@ -896,12 +923,15 @@ jobs:
         browser: [chrome, firefox]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
         uses: ./.github/actions/integration-test-setup
 
+      - uses: ./.github/actions/install-chrome
+        if: matrix.browser == 'chrome'
+
       - name: Run Forms IT
         run: |
           TESTS=`testsuite/integration-arquillian/tests/base/testsuites/suite.sh forms`
@@ -938,12 +968,15 @@ jobs:
           - firefox
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
         uses: ./.github/actions/integration-test-setup
 
+      - uses: ./.github/actions/install-chrome
+        if: matrix.browser == 'chrome'
+
       - name: Run WebAuthn IT
         run: |
           TESTS=`testsuite/integration-arquillian/tests/base/testsuites/suite.sh webauthn`
@@ -977,7 +1010,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -990,7 +1023,7 @@ jobs:
 
       - id: cache-maven-repository
         name: ipa-data cache
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/ipa-data.tar
           key: ${{ steps.weekly-cache-key.outputs.key }}
@@ -1015,7 +1048,7 @@ jobs:
         database: [postgres, mysql, oracle, mssql, mariadb]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -1057,7 +1090,7 @@ jobs:
     needs: build
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
@@ -1073,14 +1106,49 @@ jobs:
       - build
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: integration-test-setup
         name: Integration test setup
         uses: ./.github/actions/integration-test-setup
 
+        # This step is necessary because test/clustering requires building a new Keycloak image built from tar.gz
+        # file that is not part of m2-keycloak.tzts archive
+      - name: Build tar keycloak-quarkus-dist
+        run: ./mvnw package -pl quarkus/server/,quarkus/dist/
+
       - name: Run tests
-        run: ./mvnw test -f tests/pom.xml
+        run: ./mvnw package -f tests/pom.xml
+
+  mixed-cluster-compatibility-tests:
+    name: Cluster Compatibility Tests
+    if: needs.conditional.outputs.ci-compatibility-matrix != ''
+    runs-on: ubuntu-latest
+    needs:
+      - build
+      - conditional
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.conditional.outputs.ci-compatibility-matrix) }}
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - id: integration-test-setup
+        name: Integration test setup
+        uses: ./.github/actions/integration-test-setup
+
+        # This step is necessary because test/clustering requires building a new Keycloak image built from tar.gz
+        # file that is not part of m2-keycloak.tzts archive
+      - name: Build tar keycloak-quarkus-dist
+        run: ./mvnw package -pl quarkus/server/,quarkus/dist/
+
+      - name: Run tests
+        run: ./mvnw verify -pl tests/clustering
+        env:
+          KC_TEST_SERVER_IMAGES: "quay.io/keycloak/keycloak:${{ matrix.version }},-"
 
   check:
     name: Status Check - Keycloak CI
@@ -1108,9 +1176,10 @@ jobs:
       - external-infinispan-tests
       - test-framework
       - base-new-integration-tests
+      - mixed-cluster-compatibility-tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b51c2bb56208..afbd4e885440 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,8 +22,10 @@ defaults:
   run:
     shell: bash
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   conditional:
     name: Check conditional workflows and jobs
     runs-on: ubuntu-latest
@@ -31,8 +33,11 @@ jobs:
       java: ${{ steps.conditional.outputs.codeql-java }}
       javascript: ${{ steps.conditional.outputs.codeql-javascript }}
       typescript: ${{ steps.conditional.outputs.codeql-typescript }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -43,15 +48,17 @@ jobs:
     name: CodeQL Java
     needs: conditional
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # Required for SARIF upload
     if: needs.conditional.outputs.java == 'true'
     outputs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: java
 
@@ -59,7 +66,7 @@ jobs:
         uses: ./.github/actions/build-keycloak
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           wait-for-processing: true
         env:
@@ -69,22 +76,24 @@ jobs:
     name: CodeQL JavaScript
     needs: conditional
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # Required for SARIF upload
     if: needs.conditional.outputs.javascript == 'true'
     outputs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         env:
           CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"finalize":["--no-run-unnecessary-builds"]}}'
         with:
           languages: javascript
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           wait-for-processing: true
         env:
@@ -94,22 +103,24 @@ jobs:
     name: CodeQL TypeScript
     needs: conditional
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # Required for SARIF upload
     if: needs.conditional.outputs.typescript == 'true'
     outputs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         env:
           CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"finalize":["--no-run-unnecessary-builds"]}}'
         with:
           languages: typescript
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           wait-for-processing: true
         env:
@@ -125,7 +136,7 @@ jobs:
       - typescript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 1843f08d6e7f..58aa4ab1e236 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -21,6 +21,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  
 jobs:
 
   conditional:
@@ -28,8 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       documentation: ${{ steps.conditional.outputs.documentation }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -42,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: setup-java
         name: Setup Java
@@ -60,7 +66,7 @@ jobs:
 
       - id: upload-keycloak-documentation
         name: Upload Keycloak documentation
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: keycloak-documentation
           path: docs/documentation/dist/target/*.zip
@@ -72,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: setup-java
         name: Setup Java
@@ -96,7 +102,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
-          jobs: ${{ toJSON(needs) }}
\ No newline at end of file
+          jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/guides.yml b/.github/workflows/guides.yml
index 720398a37e52..6a521254d6a3 100644
--- a/.github/workflows/guides.yml
+++ b/.github/workflows/guides.yml
@@ -21,6 +21,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
@@ -29,8 +32,11 @@ jobs:
     outputs:
       guides: ${{ steps.conditional.outputs.guides }}
       ci: ${{ steps.conditional.outputs.ci }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -44,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -57,7 +63,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml
index 415fcdab895b..1a60b211986e 100644
--- a/.github/workflows/js-ci.yml
+++ b/.github/workflows/js-ci.yml
@@ -22,14 +22,20 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   conditional:
     name: Check conditional workflows and jobs
     runs-on: ubuntu-latest
     outputs:
       js-ci: ${{ steps.conditional.outputs.js }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -42,7 +48,7 @@ jobs:
     if: needs.conditional.outputs.js-ci == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -52,7 +58,7 @@ jobs:
           mv ./quarkus/dist/target/keycloak-999.0.0-SNAPSHOT.tar.gz ./keycloak-999.0.0-SNAPSHOT.tar.gz
 
       - name: Upload Keycloak dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: keycloak
           path: keycloak-999.0.0-SNAPSHOT.tar.gz
@@ -65,7 +71,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-admin-client"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -83,7 +89,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-ui-shared"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -101,7 +107,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-account-ui"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -119,7 +125,7 @@ jobs:
     env:
       WORKSPACE: keycloak-admin-ui
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -132,9 +138,6 @@ jobs:
       - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} build
         working-directory: js
 
-      - run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} cy:check-types
-        working-directory: js
-
   account-ui-e2e:
     name: Account UI E2E
     needs:
@@ -145,12 +148,12 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-account-ui"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
       - name: Download Keycloak server
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: keycloak
 
@@ -174,7 +177,7 @@ jobs:
         working-directory: js
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: account-ui-playwright-report
@@ -183,7 +186,7 @@ jobs:
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: account-ui-server-log
           path: ~/server.log
@@ -216,26 +219,13 @@ jobs:
       WORKSPACE: keycloak-admin-ui
     strategy:
       matrix:
-        container: [1, 2, 3, 4, 5]
-        browser: [chrome, firefox]
+        browser: [chromium, firefox]
         exclude:
           # Only test with Firefox on scheduled runs
           - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Google Chrome
-        if: matrix.browser == 'chrome'
-        uses: browser-actions/setup-chrome@v1
-        with:
-          chrome-version: stable
-
-      - name: Install Firefox
-        if: matrix.browser == 'firefox'
-        uses: browser-actions/setup-firefox@v1
-        with:
-          firefox-version: latest
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -244,7 +234,7 @@ jobs:
         working-directory: js
 
       - name: Download Keycloak server
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: keycloak
 
@@ -254,45 +244,36 @@ jobs:
       - name: Start Keycloak server
         run: |
           tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
-          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v1,transient-users &> ~/server.log &
+          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v2,transient-users &> ~/server.log &
         env:
           KC_BOOTSTRAP_ADMIN_USERNAME: admin
           KC_BOOTSTRAP_ADMIN_PASSWORD: admin
           KC_BOOTSTRAP_ADMIN_CLIENT_ID: temporary-admin-service
           KC_BOOTSTRAP_ADMIN_CLIENT_SECRET: temporary-admin-service
 
-      - name: Start LDAP server
-        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} cy:ldap-server &
+      - name: Install Playwright browsers
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} exec playwright install --with-deps
+        working-directory: js
+
+      - name: Run Playwright tests
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration --project=${{ matrix.browser }}
         working-directory: js
 
-      - name: Run Cypress
-        uses: cypress-io/github-action@v6
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
         with:
-          install: false
-          browser: ${{ matrix.browser }}
-          wait-on: http://localhost:8080
-          working-directory: js/apps/admin-ui
-        env:
-          SPLIT: ${{ strategy.job-total }}
-          SPLIT_INDEX: ${{ strategy.job-index }}
-          SPLIT_RANDOM_SEED: ${{ needs.generate-test-seed.outputs.seed }}
+          name: admin-ui-playwright-report-${{ matrix.browser }}
+          path: js/apps/admin-ui/playwright-report
+          retention-days: 30
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: admin-ui-server-log-${{ matrix.container }}-${{ matrix.browser }}
+          name: admin-ui-server-log-${{ matrix.browser }}
           path: ~/server.log
 
-      - name: Upload Cypress videos
-        uses: actions/upload-artifact@v4
-        if: always() && github.repository != 'keycloak/keycloak-private'
-        with:
-          name: cypress-videos-${{ matrix.container }}-${{ matrix.browser }}
-          path: js/apps/admin-ui/cypress/videos
-          if-no-files-found: ignore
-          retention-days: 10
-
   check:
     name: Status Check - Keycloak JavaScript CI
     if: always()
@@ -307,7 +288,7 @@ jobs:
       - admin-ui-e2e
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index c06af0ae583e..864874900f54 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -3,16 +3,17 @@ on:
   pull_request_target:
     types: closed
 
+permissions:
+  contents: read
+  
 jobs:
   label:
 
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      issues: write
-
+      issues: write # Required to add labels to Issues
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: .github/scripts
       - name: Add release labels on merge
@@ -26,7 +27,7 @@ jobs:
           
           if [ "$GITHUB_BASE_REF" == "main" ]; then
             LAST_RELEASE="$(gh api /repos/$GITHUB_REPOSITORY/branches --paginate --jq .[].name | grep '^release/' | cut -d '/' -f 2 | sort -n -r | head -n 1)"
-            LAST_MINOR=$(echo $LAST_MINOR | cut -d '.' -f 2)
+            LAST_MINOR=$(echo $LAST_RELEASE | cut -d '.' -f 2)
             NEXT_MAJOR=$(echo $LAST_RELEASE | cut -d '.' -f 1)
             NEXT_MINOR="$(($LAST_MINOR + 1))"
             LABEL="release/$NEXT_MAJOR.$NEXT_MINOR.0"
@@ -40,9 +41,9 @@ jobs:
           fi
           
           echo "Label:      $LABEL"
-          echo "**Label:** [$LABEL](https://github.com/$GITHUB_REPOSITORY/labels/$(echo $LABEL | sed 's|/|%2F|g'))" >> $GITHUB_STEP_SUMMARY
+          echo "**Label:** [$LABEL](https://github.com/$GITHUB_REPOSITORY/labels/$LABEL)" >> $GITHUB_STEP_SUMMARY
           
-          gh api "repos/$GITHUB_REPOSITORY/labels/$(echo $LABEL | sed 's|/|%2F|g')" --silent 2>/dev/null || gh label create -R "$GITHUB_REPOSITORY" "$LABEL" -c "0E8A16"
+          gh api "/repos/$GITHUB_REPOSITORY/labels/$LABEL" --silent 2>/dev/null || gh label create -R "$GITHUB_REPOSITORY" "$LABEL" -c "0E8A16"
           
           echo ""
           echo "" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/operator-ci.yml b/.github/workflows/operator-ci.yml
index 078c4d03000e..0b813498fb34 100644
--- a/.github/workflows/operator-ci.yml
+++ b/.github/workflows/operator-ci.yml
@@ -23,6 +23,9 @@ concurrency:
   group: operator-ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
@@ -30,8 +33,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       operator: ${{ steps.conditional.outputs.operator }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -44,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -52,56 +58,29 @@ jobs:
           upload-m2-repo: false
           upload-dist: true
 
-  test-local:
-    name: Test local
+  test-local-apiserver:
+    name: Test local apiserver
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Set version
-        id: vars
-        run: echo "version_local=0.0.1-${GITHUB_SHA::6}" >> $GITHUB_ENV
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Java
         uses: ./.github/actions/java-setup
 
-      - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.0
-        with:
-          minikube version: ${{ env.MINIKUBE_VERSION }}
-          kubernetes version: ${{ env.KUBERNETES_VERSION }}
-          github token: ${{ secrets.GITHUB_TOKEN }}
-          driver: docker
-          start args: --addons=ingress --memory=${{ env.MINIKUBE_MEMORY }} --cni cilium --cpus=max
-
-      - name: Download keycloak distribution
-        id: download-keycloak-dist
-        uses: actions/download-artifact@v4
-        with:
-          name: keycloak-dist
-          path: quarkus/container
-
-      - name: Build Keycloak Docker images
-        run: |
-          eval $(minikube -p minikube docker-env)
-          (cd quarkus/container && docker build --build-arg KEYCLOAK_DIST=$(ls keycloak-*.tar.gz) . -t keycloak:${{ env.version_local }})
-          (cd operator && ./scripts/build-testing-docker-images.sh ${{ env.version_local }} keycloak custom-keycloak)
-
       - name: Test operator running locally
         run: |
-          ./mvnw install -Poperator -pl :keycloak-operator -am \
-              -Dquarkus.kubernetes.image-pull-policy=IfNotPresent \
-              -Dkc.operator.keycloak.image=keycloak:${{ env.version_local }} \
-              -Dtest.operator.custom.image=custom-keycloak:${{ env.version_local }} \
-              -Dkc.operator.keycloak.image-pull-policy=Never
+          ./mvnw install -Poperator -pl :keycloak-operator -am
 
   test-remote:
     name: Test remote
     runs-on: ubuntu-latest
     needs: [build]
+    strategy:
+          matrix:
+            suite: [slow, fast]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set version
         id: vars
@@ -111,7 +90,7 @@ jobs:
         uses: ./.github/actions/java-setup
 
       - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.0
+        uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d # v2.14.0
         with:
           minikube version: ${{ env.MINIKUBE_VERSION }}
           kubernetes version: ${{ env.KUBERNETES_VERSION }}
@@ -121,7 +100,7 @@ jobs:
 
       - name: Download keycloak distribution
         id: download-keycloak-dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: keycloak-dist
           path: quarkus/container
@@ -134,6 +113,10 @@ jobs:
 
       - name: Test operator running in cluster
         run: |
+          declare -A PARAMS
+          PARAMS["slow"]="-Dkc.quarkus.tests.groups=slow"
+          PARAMS["fast"]='-Dkc.quarkus.tests.groups=!slow'
+          
           eval $(minikube -p minikube docker-env)
           ./mvnw install -Poperator -pl :keycloak-operator -am \
               -Dquarkus.container-image.build=true \
@@ -141,29 +124,29 @@ jobs:
               -Dkc.operator.keycloak.image=keycloak:${{ env.version_remote }} \
               -Dquarkus.kubernetes.env.vars.kc-operator-keycloak-image-pull-policy=Never \
               -Dtest.operator.custom.image=custom-keycloak:${{ env.version_remote }} \
-              --no-transfer-progress -Dtest.operator.deployment=remote
+              --no-transfer-progress -Dtest.operator.deployment=remote ${PARAMS["${{ matrix.suite }}"]}
 
   test-olm:
     name: Test OLM installation
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Java
         uses: ./.github/actions/java-setup
 
       - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.0
+        uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d # v2.14.0
         with:
           minikube version: ${{ env.MINIKUBE_VERSION }}
           kubernetes version: ${{ env.KUBERNETES_VERSION }}
           github token: ${{ secrets.GITHUB_TOKEN }}
           driver: docker
-          start args: --memory=${{ env.MINIKUBE_MEMORY }}
+          start args: --memory=${{ env.MINIKUBE_MEMORY }} --addons=registry --insecure-registry=192.168.49.0/24
 
       - name: Install OPM
-        uses: redhat-actions/openshift-tools-installer@v1
+        uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1.13.1
         with:
           source: github
           opm: 1.21.0
@@ -177,7 +160,7 @@ jobs:
 
       - name: Download keycloak distribution
         id: download-keycloak-dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: keycloak-dist
           path: quarkus/container
@@ -185,8 +168,9 @@ jobs:
       - name: Arrange OLM test installation
         working-directory: operator
         run: |
+          echo "Minikube IP $(minikube ip)"
           eval $(minikube -p minikube docker-env)
-          ./scripts/olm-testing.sh ${GITHUB_SHA::6}
+          REGISTRY=$(minikube ip):5000 ./scripts/olm-testing.sh ${GITHUB_SHA::6}
 
       - name: Deploy an example Keycloak and wait for it to be ready
         working-directory: operator
@@ -233,12 +217,12 @@ jobs:
     needs:
       - conditional
       - build
-      - test-local
+      - test-local-apiserver
       - test-remote
       - test-olm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/quarkus-next.yml b/.github/workflows/quarkus-next.yml
index ec235fbf2216..532e662b83ba 100644
--- a/.github/workflows/quarkus-next.yml
+++ b/.github/workflows/quarkus-next.yml
@@ -14,14 +14,18 @@ concurrency:
   group: quarkus-next-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  
 jobs:
   update-quarkus-next-branch:
     name: Update quarkus-next branch
     if: github.event_name != 'schedule' || github.repository == 'keycloak/keycloak'
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: write # Required to push changes to the repository
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: main
           fetch-depth: 0
@@ -42,6 +46,8 @@ jobs:
   run-matrix-with-quarkus-next:
     name: Run workflow matrix with the quarkus-next branch
     runs-on: ubuntu-latest
+    permissions:
+      actions: write # Required to trigger workflows using gh
     needs:
       - update-quarkus-next-branch
 
diff --git a/.github/workflows/schedule-nightly.yml b/.github/workflows/schedule-nightly.yml
index a3c93a62013b..47f9396bf932 100644
--- a/.github/workflows/schedule-nightly.yml
+++ b/.github/workflows/schedule-nightly.yml
@@ -5,11 +5,15 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   setup:
     if: github.event_name != 'schedule' || github.repository == 'keycloak/keycloak'
     runs-on: ubuntu-latest
+    permissions:
+      actions: write # Required to trigger workflows using gh
     outputs:
       latest-release-branch: ${{ steps.latest-release.outputs.branch }}
     steps:
@@ -24,8 +28,9 @@ jobs:
   run-default-branch:
     name: Run default branch
     runs-on: ubuntu-latest
+    permissions:
+      actions: write # Required to trigger workflows using gh
     needs: setup
-
     strategy:
       matrix:
         workflow:
@@ -47,7 +52,8 @@ jobs:
     name: Run latest release branch
     needs: setup
     runs-on: ubuntu-latest
-
+    permissions:
+      actions: write # Required to trigger workflows using gh
     strategy:
       matrix:
         workflow:
diff --git a/.github/workflows/snyk-analysis.yml b/.github/workflows/snyk-analysis.yml
index 3d484338805e..761b69512325 100644
--- a/.github/workflows/snyk-analysis.yml
+++ b/.github/workflows/snyk-analysis.yml
@@ -10,18 +10,23 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   analysis:
     name: Analysis of Quarkus and Operator
     runs-on: ubuntu-latest
     if: github.repository == 'keycloak/keycloak'
+    permissions:
+      security-events: write # Required for SARIF uploads
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
 
-      - uses: snyk/actions/setup@master
+      - uses: snyk/actions/setup@28606799782bc8e809f4076e9f8293bc4212d05e # master
 
       - name: Check for vulnerabilities in Quarkus
         run: snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=quarkus-report.sarif quarkus/deployment
@@ -30,7 +35,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Upload Quarkus scanner results to GitHub
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         continue-on-error: true
         with:
           sarif_file: quarkus-report.sarif
@@ -45,7 +50,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Upload Operator scanner results to GitHub
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: operator-report.sarif
           category: snyk-operator-report
diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml
index be9559f8bf58..ad8e25b9e3cb 100644
--- a/.github/workflows/trivy-analysis.yml
+++ b/.github/workflows/trivy-analysis.yml
@@ -7,6 +7,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  
 jobs:
 
   analysis:
@@ -17,9 +20,14 @@ jobs:
       matrix:
         container: [keycloak, keycloak-operator]
       fail-fast: false
+    permissions:
+      security-events: write # Required for SARIF uploads
     steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.29.0
+        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
         with:
           image-ref: quay.io/keycloak/${{ matrix.container }}:nightly
           format: sarif
@@ -33,7 +41,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: trivy-results.sarif
           category: ${{ matrix.container }}
diff --git a/.github/workflows/weblate.yml b/.github/workflows/weblate.yml
index 98c5de4c3f6d..ba569f04e72f 100644
--- a/.github/workflows/weblate.yml
+++ b/.github/workflows/weblate.yml
@@ -22,6 +22,9 @@ concurrency:
   group: weblate-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  
 jobs:
   update-weblate:
     name: Trigger Weblate to pull the latest changes
diff --git a/.gitignore b/.gitignore
index 750fb42afd14..b68f39bdeaef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -96,3 +96,4 @@ quarkus/data/*.db
 .java-version
 
 .env
+.env.test
diff --git a/ADOPTERS.md b/ADOPTERS.md
index 04f5a8454cab..00f9e50dd23e 100644
--- a/ADOPTERS.md
+++ b/ADOPTERS.md
@@ -50,6 +50,8 @@ List of organization names below is based on information collected using Keycloa
 * Prodesan
 * Quest Software
 * Research Industrial Software Engineering (RISE)
+* [SICK AG](https://www.sick.com)
+* [SMF](https://www.smf.de)
 * Sportsbet.com.au
 * [Stacklok](https://stacklok.com/)
 * Stack Labs
@@ -61,4 +63,5 @@ List of organization names below is based on information collected using Keycloa
 * TRT9 - Brasil
 * UnitedHealthcare
 * Wayfair LLC
+* [Xata](https://xata.io)
 * ...More individuals
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 173dade71e87..a9aa88dc22ed 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -3,7 +3,6 @@
 * [Alexander Schwartz](https://github.com/ahus1)
 * [Bruno Oliveira da Silva](https://github.com/abstractj)
 * [Marek Posolda](https://github.com/mposolda)
-* [Michal Hajas](https://github.com/mhajas)
 * [Pedro Igor](https://github.com/pedroigor)
 * [Sebastian Schuster](https://github.com/sschu)
 * [Stan Silvert](https://github.com/ssilvert)
@@ -15,5 +14,6 @@
 # Emeritus maintainers
 
 * [Hynek Mlnařík](https://github.com/hmlnarik)
+* [Michal Hajas](https://github.com/mhajas)
 * [Pavel Drozd](https://github.com/pdrozd)
 
diff --git a/README.md b/README.md
index 36998a9327f1..c9856046d433 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,12 @@
 
 ![GitHub Release](https://img.shields.io/github/v/release/keycloak/keycloak?label=latest%20release)
 [![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/6818/badge)](https://bestpractices.coreinfrastructure.org/projects/6818)
+[![CLOMonitor](https://img.shields.io/endpoint?url=https://clomonitor.io/api/projects/cncf/keycloak/badge)](https://clomonitor.io/projects/cncf/keycloak)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/keycloak/keycloak/badge)](https://securityscorecards.dev/viewer/?uri=github.com/keycloak/keycloak)
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/keycloak-operator)](https://artifacthub.io/packages/olm/community-operators/keycloak-operator)
 ![GitHub Repo stars](https://img.shields.io/github/stars/keycloak/keycloak?style=flat)
 ![GitHub commit activity](https://img.shields.io/github/commit-activity/m/keycloak/keycloak)
-[![Translation status](https://hosted.weblate.org/widget/keycloak/svg-badge.svg)](https://hosted.weblate.org/engage/keycloak/)
+[![Translation status](https://hosted.weblate.org/widget/keycloak/svg-badge.svg)](docs/translation.md)
 
 # Open Source Identity and Access Management
 
@@ -18,6 +20,7 @@ Keycloak provides user federation, strong authentication, user management, fine-
 
 * [Documentation](https://www.keycloak.org/documentation.html)
 * [User Mailing List](https://groups.google.com/d/forum/keycloak-user) - Mailing list for help and general questions about Keycloak
+* Join [#keycloak](https://cloud-native.slack.com/archives/C056HC17KK9) for general questions, or [#keycloak-dev](https://cloud-native.slack.com/archives/C056XU905S6) on Slack for design and development discussions, by creating an account at [https://slack.cncf.io/](https://slack.cncf.io/).
 
 
 ## Reporting Security Vulnerabilities
diff --git a/adapters/saml/core/src/main/java/org/keycloak/adapters/saml/rotation/SamlDescriptorPublicKeyLocator.java b/adapters/saml/core/src/main/java/org/keycloak/adapters/saml/rotation/SamlDescriptorPublicKeyLocator.java
index d8f9d7356c33..febaee398da7 100644
--- a/adapters/saml/core/src/main/java/org/keycloak/adapters/saml/rotation/SamlDescriptorPublicKeyLocator.java
+++ b/adapters/saml/core/src/main/java/org/keycloak/adapters/saml/rotation/SamlDescriptorPublicKeyLocator.java
@@ -24,7 +24,6 @@
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
-import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import javax.security.auth.x500.X500Principal;
 import javax.xml.crypto.dsig.keyinfo.KeyInfo;
@@ -34,6 +33,7 @@
 import org.keycloak.adapters.cloned.HttpAdapterUtils;
 import org.keycloak.adapters.cloned.HttpClientAdapterException;
 import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.dom.saml.v2.metadata.KeyTypes;
 import org.keycloak.rotation.KeyLocator;
@@ -179,7 +179,7 @@ private synchronized <T> Key refreshCertificateCacheAndGet(T key, Map<T, Key> ca
                 this.publicKeyCacheByKey.put(new KeyHash(x509certificate.getPublicKey()), x509certificate.getPublicKey());
             } else {
                 final X500Principal principal = x509certificate.getSubjectX500Principal();
-                String name = (principal == null ? "unnamed" : principal.getName()) + "@" + x509certificate.getSerialNumber() + "$" + UUID.randomUUID();
+                String name = (principal == null ? "unnamed" : principal.getName()) + "@" + x509certificate.getSerialNumber() + "$" + SecretGenerator.getInstance().generateSecureID();
                 this.publicKeyCacheByName.put(name, x509certificate.getPublicKey());
                 this.publicKeyCacheByKey.put(new KeyHash(x509certificate.getPublicKey()), x509certificate.getPublicKey());
                 LOG.tracef("Adding certificate %s without a specific key name: %s", name, x509certificate);
diff --git a/authz/client/src/main/java/org/keycloak/authorization/client/ResourceNotFoundException.java b/authz/client/src/main/java/org/keycloak/authorization/client/ResourceNotFoundException.java
new file mode 100644
index 000000000000..c418ba9ac29d
--- /dev/null
+++ b/authz/client/src/main/java/org/keycloak/authorization/client/ResourceNotFoundException.java
@@ -0,0 +1,32 @@
+/*
+ *  Copyright 2016 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package org.keycloak.authorization.client;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class ResourceNotFoundException extends RuntimeException {
+
+    public ResourceNotFoundException(Throwable cause) {
+        super(cause);
+    }
+
+    public ResourceNotFoundException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/authz/client/src/main/java/org/keycloak/authorization/client/util/Throwables.java b/authz/client/src/main/java/org/keycloak/authorization/client/util/Throwables.java
index 016daf28787b..00121f42fcfe 100644
--- a/authz/client/src/main/java/org/keycloak/authorization/client/util/Throwables.java
+++ b/authz/client/src/main/java/org/keycloak/authorization/client/util/Throwables.java
@@ -19,6 +19,7 @@
 import java.util.concurrent.Callable;
 
 import org.keycloak.authorization.client.AuthorizationDeniedException;
+import org.keycloak.authorization.client.ResourceNotFoundException;
 import org.keycloak.authorization.client.representation.TokenIntrospectionResponse;
 
 /**
@@ -85,6 +86,8 @@ public static <V> V retryAndWrapExceptionIfNecessary(Callable<V> callable, Token
                 }
 
                 throw handleWrapException(message, cause);
+            } else if (httpe.getStatusCode() == 400 && new String(httpe.getBytes()).contains("invalid_resource_id")) {
+                throw new ResourceNotFoundException(message, cause);
             }
         }
 
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/aggregated/AggregatePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/aggregated/AggregatePolicyProviderFactory.java
index 476d1823aee5..eb8d07e9f712 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/aggregated/AggregatePolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/aggregated/AggregatePolicyProviderFactory.java
@@ -54,7 +54,7 @@ public PolicyProvider create(AuthorizationProvider authorization) {
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProvider.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProvider.java
index b77fb2f79f93..87680a34a655 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProvider.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProvider.java
@@ -30,11 +30,12 @@ public void evaluate(Evaluation evaluation) {
 
         for (String client : representation.getClients()) {
             ClientModel clientModel = realm.getClientById(client);
-
-            if (context.getAttributes().containsValue("kc.client.id", clientModel.getClientId())) {
-                evaluation.grant();
-                logger.debugf("Client policy %s matched with client %s and was granted", evaluation.getPolicy().getName(), clientModel.getClientId());
-                return;
+            if (clientModel != null) {
+                if (context.getAttributes().containsValue("kc.client.id", clientModel.getClientId())) {
+                    evaluation.grant();
+                    logger.debugf("Client policy %s matched with client %s and was granted", evaluation.getPolicy().getName(), clientModel.getClientId());
+                    return;
+                }
             }
         }
     }
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProviderFactory.java
index bf63e2a82c08..15ada99cd943 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/client/ClientPolicyProviderFactory.java
@@ -108,7 +108,7 @@ public void onExport(Policy policy, PolicyRepresentation representation, Authori
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProvider.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProvider.java
index 91d47e11d7cf..9813acc1252a 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProvider.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProvider.java
@@ -20,22 +20,33 @@
 
 import java.util.List;
 import java.util.function.BiFunction;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.attribute.Attributes;
 import org.keycloak.authorization.attribute.Attributes.Entry;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.models.ClientModel;
 import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceType;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class GroupPolicyProvider implements PolicyProvider {
+public class GroupPolicyProvider implements PolicyProvider, PartialEvaluationPolicyProvider {
 
     private static final Logger logger = Logger.getLogger(GroupPolicyProvider.class);
     private final BiFunction<Policy, AuthorizationProvider, GroupPolicyRepresentation> representationFunction;
@@ -56,6 +67,14 @@ public void evaluate(Evaluation evaluation) {
             groupsClaim = new Entry(policy.getGroupsClaim(), userGroups);
         }
 
+        if (isGranted(realm, policy, groupsClaim)) {
+            evaluation.grant();
+        }
+
+        logger.debugf("Groups policy %s evaluated to %s with identity groups %s", policy.getName(), evaluation.getEffect(), groupsClaim);
+    }
+
+    private boolean isGranted(RealmModel realm, GroupPolicyRepresentation policy, Attributes.Entry groupsClaim) {
         for (GroupPolicyRepresentation.GroupDefinition definition : policy.getGroups()) {
             GroupModel allowedGroup = realm.getGroupById(definition.getId());
 
@@ -69,19 +88,46 @@ public void evaluate(Evaluation evaluation) {
                 if (group.indexOf('/') != -1) {
                     String allowedGroupPath = buildGroupPath(allowedGroup);
                     if (group.equals(allowedGroupPath) || (definition.isExtendChildren() && group.startsWith(allowedGroupPath))) {
-                        evaluation.grant();
-                        return;
+                        return true;
                     }
                 }
 
                 // in case the group from the claim does not represent a path, we just check an exact name match
                 if (group.equals(allowedGroup.getName())) {
-                    evaluation.grant();
-                    return;
+                    return true;
                 }
             }
         }
-        logger.debugf("Groups policy %s evaluated to %s with identity groups %s", policy.getName(), evaluation.getEffect(), groupsClaim);
+
+        return false;
+    }
+
+    @Override
+    public Stream<Policy> getPermissions(KeycloakSession session, ResourceType resourceType, UserModel user) {
+        AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+        RealmModel realm = session.getContext().getRealm();
+        ClientModel adminPermissionsClient = realm.getAdminPermissionsClient();
+        StoreFactory storeFactory = provider.getStoreFactory();
+        ResourceServer resourceServer = storeFactory.getResourceServerStore().findByClient(adminPermissionsClient);
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+        List<String> groupIds = user.getGroupsStream().map(GroupModel::getId).toList();
+
+        return policyStore.findDependentPolicies(resourceServer, resourceType.getType(), GroupPolicyProviderFactory.ID, "groups", groupIds);
+    }
+
+    @Override
+    public boolean evaluate(KeycloakSession session, Policy policy, UserModel subject) {
+        RealmModel realm = session.getContext().getRealm();
+        AuthorizationProvider authorizationProvider = session.getProvider(AuthorizationProvider.class);
+        GroupPolicyRepresentation groupPolicy = representationFunction.apply(policy, authorizationProvider);
+        List<String> userGroups = subject.getGroupsStream().map(ModelToRepresentation::buildGroupPath)
+                .collect(Collectors.toList());
+        return isGranted(realm, groupPolicy, new Entry(groupPolicy.getGroupsClaim(), userGroups));
+    }
+
+    @Override
+    public boolean supports(Policy policy) {
+        return GroupPolicyProviderFactory.ID.equals(policy.getType());
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
index 30fd4f9acb6b..b636ddca2a9c 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
@@ -48,11 +48,13 @@
  */
 public class GroupPolicyProviderFactory implements PolicyProviderFactory<GroupPolicyRepresentation> {
 
+    public static final String ID = "group";
+
     private GroupPolicyProvider provider = new GroupPolicyProvider(this::toRepresentation);
 
     @Override
     public String getId() {
-        return "group";
+        return ID;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/js/JSPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/js/JSPolicyProviderFactory.java
index bc538a1b658a..7a901e7b7db4 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/js/JSPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/js/JSPolicyProviderFactory.java
@@ -39,7 +39,7 @@ public PolicyProvider create(AuthorizationProvider authorization) {
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ResourcePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ResourcePolicyProviderFactory.java
index 77b6ec17ef31..51f45c463320 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ResourcePolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ResourcePolicyProviderFactory.java
@@ -64,7 +64,7 @@ public ResourcePermissionRepresentation toRepresentation(Policy policy, Authoriz
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ScopePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ScopePolicyProviderFactory.java
index 0be56fcfa556..4dc3eb6ccd74 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ScopePolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/permission/ScopePolicyProviderFactory.java
@@ -17,6 +17,7 @@
 package org.keycloak.authorization.policy.provider.permission;
 
 import org.keycloak.Config;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
@@ -33,7 +34,8 @@
  */
 public class ScopePolicyProviderFactory implements PolicyProviderFactory<ScopePermissionRepresentation> {
 
-    private ScopePolicyProvider provider = new ScopePolicyProvider();
+    public static final String ID = "scope";
+    private final ScopePolicyProvider provider = new ScopePolicyProvider();
 
     @Override
     public String getName() {
@@ -52,7 +54,7 @@ public PolicyProvider create(AuthorizationProvider authorization) {
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
@@ -77,9 +79,14 @@ public void onUpdate(Policy policy, ScopePermissionRepresentation representation
         updateResourceType(policy, representation);
     }
 
+    @Override
+    public void onRemove(Policy policy, AuthorizationProvider authorization) {
+        AdminPermissionsSchema.SCHEMA.removeOrphanResources(policy, authorization);
+    }
+
     private void updateResourceType(Policy policy, ScopePermissionRepresentation representation) {
         if (representation != null) {
-            Map<String, String> config = new HashMap(policy.getConfig());
+            Map<String, String> config = new HashMap<>(policy.getConfig());
 
             config.compute("defaultResourceType", (key, value) -> {
                 String resourceType = representation.getResourceType();
@@ -107,6 +114,6 @@ public void close() {
 
     @Override
     public String getId() {
-        return "scope";
+        return ID;
     }
 }
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java
index c73371f7dfbb..4d0342555761 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java
@@ -17,16 +17,23 @@
  */
 package org.keycloak.authorization.policy.provider.role;
 
+import java.util.List;
 import java.util.Set;
 import java.util.function.BiFunction;
+import java.util.stream.Stream;
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.attribute.Attributes.Entry;
 import org.keycloak.authorization.identity.Identity;
+import org.keycloak.authorization.identity.UserModelIdentity;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.StoreFactory;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
@@ -34,12 +41,15 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserProvider;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.idm.authorization.ResourceType;
 import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
 
+import static org.keycloak.models.utils.RoleUtils.getDeepUserRoleMappings;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class RolePolicyProvider implements PolicyProvider {
+public class RolePolicyProvider implements PolicyProvider, PartialEvaluationPolicyProvider {
 
     private final BiFunction<Policy, AuthorizationProvider, RolePolicyRepresentation> representationFunction;
 
@@ -53,11 +63,21 @@ public RolePolicyProvider(BiFunction<Policy, AuthorizationProvider, RolePolicyRe
     public void evaluate(Evaluation evaluation) {
         Policy policy = evaluation.getPolicy();
         RolePolicyRepresentation policyRep = representationFunction.apply(policy, evaluation.getAuthorizationProvider());
-        Set<RolePolicyRepresentation.RoleDefinition> roleIds = policyRep.getRoles();
         AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
         RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
         Identity identity = evaluation.getContext().getIdentity();
 
+        if (isGranted(realm, authorizationProvider, policyRep, identity)) {
+            evaluation.grant();
+        }
+
+        logger.debugf("policy %s evaluated with status %s on identity %s", policy.getName(), evaluation.getEffect(), identity.getId());
+    }
+
+    private boolean isGranted(RealmModel realm, AuthorizationProvider authorizationProvider, RolePolicyRepresentation policyRep, Identity identity) {
+        Set<RolePolicyRepresentation.RoleDefinition> roleIds = policyRep.getRoles();
+        boolean granted = false;
+
         for (RolePolicyRepresentation.RoleDefinition roleDefinition : roleIds) {
             RoleModel role = realm.getRoleById(roleDefinition.getId());
 
@@ -66,14 +86,14 @@ public void evaluate(Evaluation evaluation) {
                 boolean hasRole = hasRole(identity, role, realm, authorizationProvider, isFetchRoles);
 
                 if (!hasRole && roleDefinition.isRequired() != null && roleDefinition.isRequired()) {
-                    evaluation.deny();
-                    return;
+                    return false;
                 } else if (hasRole) {
-                    evaluation.grant();
+                    granted = true;
                 }
             }
         }
-        logger.debugf("policy %s evaluated with status %s on identity %s", policy.getName(), evaluation.getEffect(), identity.getId());
+
+        return granted;
     }
 
     private boolean hasRole(Identity identity, RoleModel role, RealmModel realm, AuthorizationProvider authorizationProvider, boolean fetchRoles) {
@@ -111,4 +131,30 @@ private UserModel getSubject(Identity identity, RealmModel realm, AuthorizationP
     public void close() {
 
     }
+
+    @Override
+    public Stream<Policy> getPermissions(KeycloakSession session, ResourceType resourceType, UserModel subject) {
+        AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+        RealmModel realm = session.getContext().getRealm();
+        ClientModel adminPermissionsClient = realm.getAdminPermissionsClient();
+        StoreFactory storeFactory = provider.getStoreFactory();
+        ResourceServer resourceServer = storeFactory.getResourceServerStore().findByClient(adminPermissionsClient);
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+        List<String> roleIds = getDeepUserRoleMappings(subject).stream().map(RoleModel::getId).toList();
+        Stream<Policy> policies = Stream.of();
+
+        return Stream.concat(policies, policyStore.findDependentPolicies(resourceServer, resourceType.getType(), RolePolicyProviderFactory.ID, "roles", roleIds));
+    }
+
+    @Override
+    public boolean evaluate(KeycloakSession session, Policy policy, UserModel adminUser) {
+        RealmModel realm = session.getContext().getRealm();
+        AuthorizationProvider authorizationProvider = session.getProvider(AuthorizationProvider.class);
+        return isGranted(realm, authorizationProvider, representationFunction.apply(policy, authorizationProvider), new UserModelIdentity(realm, adminUser));
+    }
+
+    @Override
+    public boolean supports(Policy policy) {
+        return RolePolicyProviderFactory.ID.equals(policy.getType());
+    }
 }
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java
index 8b9e3c1c9653..bd66d0b478c2 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java
@@ -42,6 +42,7 @@
 import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 /**
@@ -49,6 +50,7 @@
  */
 public class RolePolicyProviderFactory implements PolicyProviderFactory<RolePolicyRepresentation> {
 
+    public static final String ID = "role";
     private RolePolicyProvider provider = new RolePolicyProvider(this::toRepresentation);
 
     @Override
@@ -192,7 +194,7 @@ public void close() {
 
     @Override
     public String getId() {
-        return "role";
+        return ID;
     }
 
     private Set<RoleDefinition> getRoles(String rawRoles, RealmModel realm) {
@@ -210,6 +212,8 @@ private Set<RoleDefinition> getRoles(String rawRoles, RealmModel realm) {
         return Collections.emptySet();
     }
 
+    public static final Pattern UUID_PATTERN = Pattern.compile("[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}");
+
     private RoleModel getRole(RolePolicyRepresentation.RoleDefinition definition, RealmModel realm) {
         String roleName = definition.getId();
         String clientId = null;
@@ -223,10 +227,13 @@ private RoleModel getRole(RolePolicyRepresentation.RoleDefinition definition, Re
         RoleModel role;
 
         if (clientId == null) {
-            role = realm.getRole(roleName);
+            // if the role name looks like a UUID, it is likely that it is a role ID. Then do this look-up first to avoid hitting the database twice
+            // TODO: In a future version of the auth feature, make this more strict to avoid the double lookup and any ambiguity
+            boolean looksLikeAUuid = UUID_PATTERN.matcher(roleName).matches();
+            role = looksLikeAUuid ? realm.getRoleById(roleName) : realm.getRole(roleName);
 
             if (role == null) {
-                role = realm.getRoleById(roleName);
+                role = !looksLikeAUuid ? realm.getRoleById(roleName) : realm.getRole(roleName);;
             }
         } else {
             ClientModel client = realm.getClientByClientId(clientId);
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/time/TimePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/time/TimePolicyProviderFactory.java
index 90b86ad0289b..e83a0fe269dd 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/time/TimePolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/time/TimePolicyProviderFactory.java
@@ -56,7 +56,7 @@ public PolicyProvider create(AuthorizationProvider authorization) {
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProvider.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProvider.java
index 3ec56cf48d3a..5f75c26afa3b 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProvider.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProvider.java
@@ -18,19 +18,28 @@
 package org.keycloak.authorization.policy.provider.user;
 
 import java.util.function.BiFunction;
+import java.util.stream.Stream;
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
-import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationPolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.authorization.ResourceType;
 import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class UserPolicyProvider implements PolicyProvider {
+public class UserPolicyProvider implements PolicyProvider, PartialEvaluationPolicyProvider {
 
     private static final Logger logger = Logger.getLogger(UserPolicyProvider.class);
 
@@ -42,16 +51,37 @@ public UserPolicyProvider(BiFunction<Policy, AuthorizationProvider, UserPolicyRe
 
     @Override
     public void evaluate(Evaluation evaluation) {
-        EvaluationContext context = evaluation.getContext();
-        UserPolicyRepresentation representation = representationFunction.apply(evaluation.getPolicy(), evaluation.getAuthorizationProvider());
-
-        for (String userId : representation.getUsers()) {
-            if (context.getIdentity().getId().equals(userId)) {
-                evaluation.grant();
-                break;
-            }
+        Policy policy = evaluation.getPolicy();
+
+        if (policy.getConfig().getOrDefault("users", "").contains(evaluation.getContext().getIdentity().getId())) {
+            evaluation.grant();
+        }
+
+        if (logger.isDebugEnabled()) {
+            logger.debugf("User policy %s evaluated to status %s on identity %s with accepted users: %s", evaluation.getPolicy().getName(), evaluation.getEffect(), evaluation.getContext().getIdentity().getId(), policy.getConfig().getOrDefault("users", ""));
         }
-        logger.debugf("User policy %s evaluated to status %s on identity %s with accepted users: %s", evaluation.getPolicy().getName(), evaluation.getEffect(), evaluation.getContext().getIdentity().getId(), representation.getUsers());
+    }
+
+    @Override
+    public Stream<Policy> getPermissions(KeycloakSession session, ResourceType resourceType, UserModel subject) {
+        AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+        RealmModel realm = session.getContext().getRealm();
+        ClientModel adminPermissionsClient = realm.getAdminPermissionsClient();
+        StoreFactory storeFactory = provider.getStoreFactory();
+        ResourceServer resourceServer = storeFactory.getResourceServerStore().findByClient(adminPermissionsClient);
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+
+        return policyStore.findDependentPolicies(resourceServer, resourceType.getType(), UserPolicyProviderFactory.ID, "users", subject.getId());
+    }
+
+    @Override
+    public boolean evaluate(KeycloakSession session, Policy policy, UserModel adminUser) {
+        return policy.getConfig().getOrDefault("users", "").contains(adminUser.getId());
+    }
+
+    @Override
+    public boolean supports(Policy policy) {
+        return UserPolicyProviderFactory.ID.equals(policy.getType());
     }
 
     @Override
diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
index 103587c568c6..42b807d33608 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
@@ -46,6 +46,8 @@
  */
 public class UserPolicyProviderFactory implements PolicyProviderFactory<UserPolicyRepresentation> {
 
+    public static final String ID = "user";
+
     private UserPolicyProvider provider = new UserPolicyProvider(this::toRepresentation);
 
     @Override
@@ -65,7 +67,7 @@ public PolicyProvider create(AuthorizationProvider authorization) {
 
     @Override
     public PolicyProvider create(KeycloakSession session) {
-        return null;
+        return provider;
     }
 
     @Override
@@ -193,6 +195,6 @@ public void close() {
 
     @Override
     public String getId() {
-        return "user";
+        return ID;
     }
 }
diff --git a/boms/pom.xml b/boms/pom.xml
index 4d105b60615e..5a54a03310e9 100644
--- a/boms/pom.xml
+++ b/boms/pom.xml
@@ -45,14 +45,21 @@
     </licenses>
 
     <properties>
-        <jboss.repo.nexusUrl>https://s01.oss.sonatype.org/</jboss.repo.nexusUrl>
-        <jboss.releases.repo.id>jboss-releases-repository</jboss.releases.repo.id>
-        <jboss.releases.repo.name>keycloak</jboss.releases.repo.name>
-        <jboss.releases.repo.url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</jboss.releases.repo.url>
-        <jboss.snapshots.repo.id>jboss-snapshots-repository</jboss.snapshots.repo.id>
-        <jboss.snapshots.repo.url>https://s01.oss.sonatype.org/content/repositories/snapshots/</jboss.snapshots.repo.url>
+        <central.publishing.plugin.version>0.7.0</central.publishing.plugin.version>
+        <nexus3.staging.plugin.version>1.0.7</nexus3.staging.plugin.version>
     </properties>
 
+    <distributionManagement>
+        <repository>
+            <id>keycloak-publish</id>
+            <url>https://central.sonatype.com/</url>
+        </repository>
+        <snapshotRepository>
+            <id>keycloak-publish</id>
+            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+        </snapshotRepository>
+    </distributionManagement>
+
     <modules>
         <module>spi</module>
     </modules>
@@ -105,17 +112,28 @@
                 </plugins>
             </build>
         </profile>
+
         <profile>
-            <id>nexus-staging</id>
+            <id>central-staging</id>
             <build>
                 <plugins>
                     <plugin>
-                        <groupId>org.sonatype.plugins</groupId>
-                        <artifactId>nexus-staging-maven-plugin</artifactId>
+                        <groupId>org.sonatype.central</groupId>
+                        <artifactId>central-publishing-maven-plugin</artifactId>
+                        <version>${central.publishing.plugin.version}</version>
+                        <extensions>true</extensions>
+                        <configuration>
+                            <autoPublish>true</autoPublish>
+                            <checksums>all</checksums>
+                            <deploymentName>keycloak-${project.version}</deploymentName>
+                            <publishingServerId>keycloak-publish</publishingServerId>
+                            <waitUntil>published</waitUntil>
+                        </configuration>
                     </plugin>
                 </plugins>
             </build>
         </profile>
+
         <profile>
             <id>nexus3-staging</id>
             <build>
@@ -123,6 +141,7 @@
                     <plugin>
                         <groupId>org.sonatype.plugins</groupId>
                         <artifactId>nxrm3-maven-plugin</artifactId>
+                        <version>${nexus3.staging.plugin.version}</version>
                         <extensions>true</extensions>
                         <configuration>
                             <serverId>${jboss.releases.repo.id}</serverId>
diff --git a/common/src/main/java/org/keycloak/common/ClientConnection.java b/common/src/main/java/org/keycloak/common/ClientConnection.java
index 3e6c124da8b6..909f14b86ee8 100755
--- a/common/src/main/java/org/keycloak/common/ClientConnection.java
+++ b/common/src/main/java/org/keycloak/common/ClientConnection.java
@@ -26,9 +26,12 @@
 public interface ClientConnection {
 
     /**
-     * @return the address as a string if it is available, otherwise null 
+     * @return the IP address as a string if it is available, otherwise null
      */
     String getRemoteAddr();
+    /**
+     * @return the remote host, which will be an IP address or whatever is provided via proxy headers
+     */
     String getRemoteHost();
     int getRemotePort();
 
diff --git a/common/src/main/java/org/keycloak/common/Profile.java b/common/src/main/java/org/keycloak/common/Profile.java
index 09e0ca6866c0..4eb1a6fa7310 100755
--- a/common/src/main/java/org/keycloak/common/Profile.java
+++ b/common/src/main/java/org/keycloak/common/Profile.java
@@ -55,7 +55,7 @@ public enum Feature {
 
         ADMIN_FINE_GRAINED_AUTHZ("Fine-Grained Admin Permissions", Type.PREVIEW, 1),
 
-        ADMIN_FINE_GRAINED_AUTHZ_V2("Fine-Grained Admin Permissions version 2", Type.EXPERIMENTAL, 2, Feature.AUTHORIZATION),
+        ADMIN_FINE_GRAINED_AUTHZ_V2("Fine-Grained Admin Permissions version 2", Type.DEFAULT, 2, Feature.AUTHORIZATION),
 
         ADMIN_API("Admin API", Type.DEFAULT),
 
@@ -73,7 +73,9 @@ public enum Feature {
 
         SCRIPTS("Write custom authenticators using JavaScript", Type.PREVIEW),
 
-        TOKEN_EXCHANGE("Token Exchange Service", Type.PREVIEW),
+        TOKEN_EXCHANGE("Token Exchange Service", Type.PREVIEW, 1),
+        TOKEN_EXCHANGE_STANDARD_V2("Standard Token Exchange version 2", Type.DEFAULT, 2),
+        TOKEN_EXCHANGE_EXTERNAL_INTERNAL_V2("External to Internal Token Exchange version 2", Type.EXPERIMENTAL, 2),
 
         WEB_AUTHN("W3C Web Authentication (WebAuthn)", Type.DEFAULT),
 
@@ -92,9 +94,9 @@ public enum Feature {
         // Check if kerberos is available in underlying JVM and auto-detect if feature should be enabled or disabled by default based on that
         KERBEROS("Kerberos", Type.DEFAULT, 1, () -> KerberosJdkProvider.getProvider().isKerberosAvailable()),
 
-        RECOVERY_CODES("Recovery codes", Type.PREVIEW),
+        RECOVERY_CODES("Recovery codes", Type.DEFAULT),
 
-        UPDATE_EMAIL("Update Email Action", Type.PREVIEW),
+        UPDATE_EMAIL("Update Email Action", Type.DEFAULT),
 
         FIPS("FIPS 140-2 mode", Type.DISABLED_BY_DEFAULT),
 
@@ -122,14 +124,22 @@ public enum Feature {
 
         ORGANIZATION("Organization support within realms", Type.DEFAULT),
 
-        PASSKEYS("Passkeys", Type.PREVIEW),
+        PASSKEYS("Passkeys", Type.PREVIEW, Feature.WEB_AUTHN),
 
-        CACHE_EMBEDDED_REMOTE_STORE("Support for remote-store in embedded Infinispan caches", Type.EXPERIMENTAL),
+        USER_EVENT_METRICS("Collect metrics based on user events", Type.DEFAULT),
 
-        USER_EVENT_METRICS("Collect metrics based on user events", Type.PREVIEW),
+        IPA_TUURA_FEDERATION("IPA-Tuura user federation provider", Type.EXPERIMENTAL),
 
-        IPA_TUURA_FEDERATION("IPA-Tuura user federation provider", Type.EXPERIMENTAL)
-        ;
+        LOGOUT_ALL_SESSIONS_V1("Logout all sessions logs out only regular sessions", Type.DEPRECATED, 1),
+
+        ROLLING_UPDATES_V1("Rolling Updates", Type.DEFAULT, 1),
+        ROLLING_UPDATES_V2("Rolling Updates for patch releases", Type.PREVIEW, 2),
+
+        /**
+         * @see <a href="https://github.com/keycloak/keycloak/issues/37967">Deprecate for removal the Instagram social broker</a>.
+         */
+        @Deprecated
+        INSTAGRAM_BROKER("Instagram Identity Broker", Type.DEPRECATED, 1);
 
         private final Type type;
         private final String label;
@@ -404,6 +414,13 @@ public static boolean isFeatureEnabled(Feature feature) {
         return getInstance().features.get(feature);
     }
 
+    public static boolean isAnyVersionOfFeatureEnabled(Feature feature) {
+        return isFeatureEnabled(feature) ||
+                getInstance().getEnabledFeatures()
+                .stream()
+                .anyMatch(f -> Objects.equals(f.getUnversionedKey(), feature.getUnversionedKey()));
+    }
+
     public ProfileName getName() {
         return profileName;
     }
@@ -416,6 +433,10 @@ public Set<Feature> getDisabledFeatures() {
         return features.entrySet().stream().filter(e -> !e.getValue()).map(Map.Entry::getKey).collect(Collectors.toSet());
     }
 
+    public Set<Feature> getEnabledFeatures() {
+        return features.entrySet().stream().filter(Map.Entry::getValue).map(Map.Entry::getKey).collect(Collectors.toSet());
+    }
+
     /**
      * @return all features of type "preview" or "preview_disabled_by_default"
      */
diff --git a/common/src/main/java/org/keycloak/common/crypto/CryptoIntegration.java b/common/src/main/java/org/keycloak/common/crypto/CryptoIntegration.java
index c12ea3e552e9..7f9c35bd6e44 100644
--- a/common/src/main/java/org/keycloak/common/crypto/CryptoIntegration.java
+++ b/common/src/main/java/org/keycloak/common/crypto/CryptoIntegration.java
@@ -94,7 +94,7 @@ public static String dumpSecurityProperties() {
     }
 
     public static void setProvider(CryptoProvider provider) {
-        logger.debugf("Using the crypto provider: %s", provider.getClass().getName());
+        logger.debugf("Using the crypto provider: %s", provider != null ? provider.getClass().getName() : "null");
         cryptoProvider = provider;
     }
 }
diff --git a/common/src/main/java/org/keycloak/common/util/DerUtils.java b/common/src/main/java/org/keycloak/common/util/DerUtils.java
index f00e547d5240..5652d5475534 100755
--- a/common/src/main/java/org/keycloak/common/util/DerUtils.java
+++ b/common/src/main/java/org/keycloak/common/util/DerUtils.java
@@ -52,10 +52,7 @@ public static PrivateKey decodePrivateKey(InputStream is)
         dis.readFully(keyBytes);
         dis.close();
 
-        PKCS8EncodedKeySpec spec =
-                new PKCS8EncodedKeySpec(keyBytes);
-        KeyFactory kf =CryptoIntegration.getProvider().getKeyFactory("RSA");
-        return kf.generatePrivate(spec);
+        return decodePrivateKey(keyBytes);
     }
 
     public static PublicKey decodePublicKey(byte[] der) throws NoSuchAlgorithmException, InvalidKeySpecException, NoSuchProviderException {
@@ -79,7 +76,14 @@ public static X509Certificate decodeCertificate(InputStream is) throws Exception
     public static PrivateKey decodePrivateKey(byte[] der) throws NoSuchAlgorithmException, InvalidKeySpecException, NoSuchProviderException {
         PKCS8EncodedKeySpec spec =
                 new PKCS8EncodedKeySpec(der);
-        KeyFactory kf = CryptoIntegration.getProvider().getKeyFactory("RSA");
-        return kf.generatePrivate(spec);
-    }
+        String[] algorithms = { "RSA", "EC" };
+        for (String algorithm : algorithms) {
+            try {
+                return CryptoIntegration.getProvider().getKeyFactory(algorithm).generatePrivate(spec);
+            } catch (InvalidKeySpecException e) {
+                // Ignore and try the next algorithm.
+            }
+        }
+        throw new InvalidKeySpecException("Unable to decode the private key with supported algorithms: " + String.join(", ", algorithms));
+   }
 }
diff --git a/common/src/main/java/org/keycloak/common/util/KeycloakUriBuilder.java b/common/src/main/java/org/keycloak/common/util/KeycloakUriBuilder.java
index b9e56ea0189c..2591d6879c74 100755
--- a/common/src/main/java/org/keycloak/common/util/KeycloakUriBuilder.java
+++ b/common/src/main/java/org/keycloak/common/util/KeycloakUriBuilder.java
@@ -80,7 +80,6 @@ public KeycloakUriBuilder clone() {
     }
 
     private static final Pattern opaqueUri = Pattern.compile("^([^:/?#]+):([^/].*)");
-    private static final Pattern hierarchicalUri = Pattern.compile("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?");
     private static final Pattern hostPortPattern = Pattern.compile("([^/:]+):(\\d+)");
 
     public static boolean compare(String s1, String s2) {
@@ -139,13 +138,41 @@ public KeycloakUriBuilder uriTemplate(String uriTemplate) {
         return uri(uriTemplate, true);
     }
 
-    protected KeycloakUriBuilder parseHierarchicalUri(String uri, Matcher match, boolean template) {
-        boolean scheme = match.group(2) != null;
-        if (scheme) this.scheme = match.group(2);
-        String authority = match.group(4);
+    private String matchesHierarchicalUriPart(Map<String, String> map, String s, String regex, String part) {
+        if (!s.isEmpty()) {
+            Matcher m = Pattern.compile(regex).matcher(s);
+            if (m.find()) {
+                map.put(part, m.group(1));
+                return s.substring(m.end());
+            }
+        }
+        return s;
+    }
+
+    private Map<String,String> matchesHierarchicalUri(final String uri) {
+        // hierarchicalUri regex: ^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?
+        Map<String,String> result = new HashMap<>();
+        // scheme
+        String s = matchesHierarchicalUriPart(result, uri, "^([^:/?#]+):", "scheme");
+        // authority
+        s = matchesHierarchicalUriPart(result, s, "^//([^/?#]*)", "authority");
+        // path
+        s = matchesHierarchicalUriPart(result, s, "^([^?#]*)", "path");
+        // query
+        s = matchesHierarchicalUriPart(result, s, "^\\?([^#]*)", "query");
+        // fragment
+        s = matchesHierarchicalUriPart(result, s, "^#(.*)", "fragment");
+        // if the uri is parsed completely it is a valid uri
+        return s.isEmpty() ? result : null;
+    }
+
+    protected KeycloakUriBuilder parseHierarchicalUri(String uri, Map<String,String> match, boolean template) {
+        boolean scheme = match.get("scheme") != null;
+        if (scheme) this.scheme = match.get("scheme");
+        String authority = match.get("authority");
         if (authority != null) {
             this.authority = null;
-            String host = match.group(4);
+            String host = authority;
             int at = host.indexOf('@');
             if (at > -1) {
                 String user = host.substring(0, at);
@@ -164,14 +191,14 @@ protected KeycloakUriBuilder parseHierarchicalUri(String uri, Matcher match, boo
                 this.host = host;
             }
         }
-        if (match.group(5) != null) {
-            String group = match.group(5);
+        if (match.get("path") != null) {
+            String group = match.get("path");
             if (!scheme && !"".equals(group) && !group.startsWith("/") && group.indexOf(':') > -1)
                 throw new IllegalArgumentException("Illegal uri template: " + uri);
             if (!"".equals(group)) replacePath(group, template);
         }
-        if (match.group(7) != null) replaceQuery(match.group(7), template);
-        if (match.group(9) != null) fragment(match.group(9), template);
+        if (match.get("query") != null) replaceQuery(match.get("query"), template);
+        if (match.get("fragment") != null) fragment(match.get("fragment"), template);
         return this;
     }
 
@@ -193,8 +220,8 @@ public KeycloakUriBuilder uri(String uri, boolean template) throws IllegalArgume
             this.ssp = opaque.group(2);
             return this;
         } else {
-            Matcher match = hierarchicalUri.matcher(uri);
-            if (match.matches()) {
+            Map<String,String> match = matchesHierarchicalUri(uri);
+            if (match != null) {
                 ssp = null;
                 return parseHierarchicalUri(uri, match, template);
             }
diff --git a/common/src/main/java/org/keycloak/common/util/NetworkUtils.java b/common/src/main/java/org/keycloak/common/util/NetworkUtils.java
index 5889556a934c..5aaed8cba7d6 100644
--- a/common/src/main/java/org/keycloak/common/util/NetworkUtils.java
+++ b/common/src/main/java/org/keycloak/common/util/NetworkUtils.java
@@ -417,7 +417,7 @@ private static boolean checkForSolaris() {
         return checkForPresence("os.name", "sun");
     }
 
-    private static boolean checkForWindows() {
+    public static boolean checkForWindows() {
         return checkForPresence("os.name", "win");
     }
 
diff --git a/common/src/main/java/org/keycloak/common/util/PathHelper.java b/common/src/main/java/org/keycloak/common/util/PathHelper.java
index 4e5949d75a0e..1bcffbd9d951 100755
--- a/common/src/main/java/org/keycloak/common/util/PathHelper.java
+++ b/common/src/main/java/org/keycloak/common/util/PathHelper.java
@@ -40,7 +40,7 @@ public class PathHelper
    /**
     * A regex pattern that searches for a URI template parameter in the form of {*}
     */
-   public static final Pattern URI_TEMPLATE_PATTERN = Pattern.compile("(\\{([^}]+)\\})");
+   public static final Pattern URI_TEMPLATE_PATTERN = Pattern.compile("(\\{([^{}]+)\\})");
 
    public static final char openCurlyReplacement = 6;
    public static final char closeCurlyReplacement = 7;
diff --git a/common/src/main/java/org/keycloak/common/util/PemUtils.java b/common/src/main/java/org/keycloak/common/util/PemUtils.java
index 483e7a1d0ecd..fca4be634f09 100755
--- a/common/src/main/java/org/keycloak/common/util/PemUtils.java
+++ b/common/src/main/java/org/keycloak/common/util/PemUtils.java
@@ -23,6 +23,9 @@
 import java.security.PublicKey;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
 
 import org.keycloak.common.crypto.CryptoIntegration;
 
@@ -53,6 +56,20 @@ public static X509Certificate decodeCertificate(String cert) {
         return CryptoIntegration.getProvider().getPemUtils().decodeCertificate(cert);
     }
 
+    /**
+     * Decode one or more X509 Certificates from a PEM string (certificate bundle)
+     *
+     * @param certs
+     * @return
+     * @throws Exception
+     */
+    public static X509Certificate[] decodeCertificates(String certs) {
+        return Arrays.stream(certs.split(END_CERT))
+                .map(String::trim)
+                .filter(pemBlock -> !pemBlock.isEmpty())
+                .map(pemBlock -> PemUtils.decodeCertificate(pemBlock + END_CERT))
+                .toArray(X509Certificate[]::new);
+    }
 
     /**
      * Decode a Public Key from a PEM string
diff --git a/common/src/main/java/org/keycloak/common/util/SecretGenerator.java b/common/src/main/java/org/keycloak/common/util/SecretGenerator.java
index ff73e855eeec..20d8ad82cc93 100644
--- a/common/src/main/java/org/keycloak/common/util/SecretGenerator.java
+++ b/common/src/main/java/org/keycloak/common/util/SecretGenerator.java
@@ -30,6 +30,15 @@ private SecretGenerator() {
     public static SecretGenerator getInstance() {
         return instance;
     }
+    
+    public String generateSecureID() {
+        StringBuilder builder = new StringBuilder(instance.randomBytesHex(16));
+        builder.insert(8, '-');
+        builder.insert(13, '-');
+        builder.insert(18, '-');
+        builder.insert(23, '-');
+        return builder.toString();
+    }
 
     public String randomString() {
         return randomString(SECRET_LENGTH_256_BITS, ALPHANUM);
@@ -56,6 +65,7 @@ public String randomString(int length, char[] symbols) {
 
         return new String(buf);
     }
+
     public byte[] randomBytes() {
         return randomBytes(SECRET_LENGTH_256_BITS);
     }
@@ -70,4 +80,37 @@ public byte[] randomBytes(int length) {
         return buf;
     }
 
+    public String randomBytesHex(int length) {
+        final StringBuilder sb = new StringBuilder();
+        for (byte b : randomBytes(length)) {
+            sb.append(Character.forDigit((b >> 4) & 0xF, 16));
+            sb.append(Character.forDigit((b & 0xF), 16));
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Returns the equivalent length for a destination alphabet to have the same
+     * entropy bits than a byte array random generated.
+     *
+     * @param byteLengthEntropy The desired entropy in bytes
+     * @param dstAlphabetLeng The length of the destination alphabet
+     * @return The equivalent length in destination alphabet to have the same entropy bits
+     */
+    public static int equivalentEntropySize(int byteLengthEntropy, int dstAlphabetLeng) {
+        return equivalentEntropySize(byteLengthEntropy, 256, dstAlphabetLeng);
+    }
+
+    /**
+     * Returns the equivalent length for a destination alphabet to have the same
+     * entropy bits than another source alphabet.
+     *
+     * @param length The length of the string encoded in source alphabet
+     * @param srcAlphabetLength The length of the source alphabet
+     * @param dstAlphabetLeng The length of the destination alphabet
+     * @return The equivalent length (same entropy) in destination alphabet for a string of length in source alphabet
+     */
+    public static int equivalentEntropySize(int length, int srcAlphabetLength, int dstAlphabetLeng) {
+        return (int) Math.ceil(length * ((Math.log(srcAlphabetLength)) / (Math.log(dstAlphabetLeng))));
+    }
 }
diff --git a/common/src/test/java/org/keycloak/common/ProfileTest.java b/common/src/test/java/org/keycloak/common/ProfileTest.java
index a45584a4d5db..d68b4a2d7f0c 100644
--- a/common/src/test/java/org/keycloak/common/ProfileTest.java
+++ b/common/src/test/java/org/keycloak/common/ProfileTest.java
@@ -27,7 +27,7 @@
 
 public class ProfileTest {
 
-    private static final Profile.Feature DEFAULT_FEATURE = Profile.Feature.AUTHORIZATION;
+    private static final Profile.Feature DEFAULT_FEATURE = Profile.Feature.CLIENT_POLICIES;
     private static final Profile.Feature DISABLED_BY_DEFAULT_FEATURE = Profile.Feature.DOCKER;
     private static final Profile.Feature PREVIEW_FEATURE = Profile.Feature.TOKEN_EXCHANGE;
     private static final Profile.Feature EXPERIMENTAL_FEATURE = Profile.Feature.DYNAMIC_SCOPES;
diff --git a/common/src/test/java/org/keycloak/common/crypto/CryptoIntegrationTest.java b/common/src/test/java/org/keycloak/common/crypto/CryptoIntegrationTest.java
new file mode 100644
index 000000000000..170ae1ce3294
--- /dev/null
+++ b/common/src/test/java/org/keycloak/common/crypto/CryptoIntegrationTest.java
@@ -0,0 +1,36 @@
+package org.keycloak.common.crypto;
+
+import static org.junit.Assert.assertNull;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+public class CryptoIntegrationTest {
+    private static CryptoProvider originalProvider;
+
+    @BeforeClass
+    public static void keepOriginalProvider() {
+        CryptoIntegrationTest.originalProvider = getSelectedProvider();
+    }
+
+    // doing our best to avoid any side effects on other tests by restoring the initial state of CryptoIntegration
+    @AfterClass
+    public static void restoreOriginalProvider() {
+        CryptoIntegration.setProvider(originalProvider);
+    }
+
+    @Test
+    public void canSetNullProvider() {
+        CryptoIntegration.setProvider(null);
+        assertNull(getSelectedProvider());
+    }
+
+    private static CryptoProvider getSelectedProvider() {
+        try {
+            return CryptoIntegration.getProvider();
+        } catch (IllegalStateException e) {
+            return null;
+        }
+    }
+}
diff --git a/core/src/main/java/org/keycloak/AbstractOAuthClient.java b/core/src/main/java/org/keycloak/AbstractOAuthClient.java
index 40ada8a3ee6c..ced1f3552c2a 100644
--- a/core/src/main/java/org/keycloak/AbstractOAuthClient.java
+++ b/core/src/main/java/org/keycloak/AbstractOAuthClient.java
@@ -19,9 +19,9 @@
 
 import org.keycloak.common.enums.RelativeUrlsUsed;
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.common.util.SecretGenerator;
 
 import java.util.Map;
-import java.util.UUID;
 import java.util.concurrent.atomic.AtomicLong;
 
 /**
@@ -43,7 +43,7 @@ public class AbstractOAuthClient {
     protected boolean isSecure;
     protected boolean publicClient;
     protected String getStateCode() {
-        return counter.getAndIncrement() + "/" + UUID.randomUUID().toString();
+        return counter.getAndIncrement() + "/" + SecretGenerator.getInstance().generateSecureID();
     }
 
     public String getClientId() {
diff --git a/core/src/main/java/org/keycloak/Config.java b/core/src/main/java/org/keycloak/Config.java
index c7e38fa4b320..538f571a85cb 100755
--- a/core/src/main/java/org/keycloak/Config.java
+++ b/core/src/main/java/org/keycloak/Config.java
@@ -235,6 +235,13 @@ public static interface Scope {
 
         Scope scope(String... scope);
 
+        /**
+         * @deprecated since 26.3.0, to be removed
+         *
+         * <br>Was introduced for testing purposes and was not fully / correctly implements
+         * across Scope implementations
+         */
+        @Deprecated
         Set<String> getPropertyNames();
     }
 }
diff --git a/core/src/main/java/org/keycloak/TokenIdGenerator.java b/core/src/main/java/org/keycloak/TokenIdGenerator.java
index fa085363a966..4320a7f69756 100755
--- a/core/src/main/java/org/keycloak/TokenIdGenerator.java
+++ b/core/src/main/java/org/keycloak/TokenIdGenerator.java
@@ -17,7 +17,8 @@
 
 package org.keycloak;
 
-import java.util.UUID;
+import org.keycloak.common.util.SecretGenerator;
+
 import java.util.concurrent.atomic.AtomicLong;
 
 /**
@@ -28,6 +29,6 @@ public class TokenIdGenerator {
     private static final AtomicLong counter = new AtomicLong();
 
     public static String generateId() {
-        return UUID.randomUUID().toString() + "-" + System.currentTimeMillis();
+        return SecretGenerator.getInstance().generateSecureID() + "-" + System.currentTimeMillis();
     }
 }
diff --git a/core/src/main/java/org/keycloak/TokenVerifier.java b/core/src/main/java/org/keycloak/TokenVerifier.java
index 70112ef89bc7..ac402d19ee08 100755
--- a/core/src/main/java/org/keycloak/TokenVerifier.java
+++ b/core/src/main/java/org/keycloak/TokenVerifier.java
@@ -120,7 +120,7 @@ public boolean test(JsonWebToken t) throws VerificationException {
 
     public static class TokenTypeCheck implements Predicate<JsonWebToken> {
 
-        private static final TokenTypeCheck INSTANCE_DEFAULT_TOKEN_TYPE = new TokenTypeCheck(Arrays.asList(TokenUtil.TOKEN_TYPE_BEARER, TokenUtil.TOKEN_TYPE_DPOP));
+        private static final TokenTypeCheck INSTANCE_DEFAULT_TOKEN_TYPE = new TokenTypeCheck(Arrays.asList(TokenUtil.TOKEN_TYPE_BEARER));
 
         private final List<String> tokenTypes;
 
diff --git a/core/src/main/java/org/keycloak/jose/jwk/JWKParser.java b/core/src/main/java/org/keycloak/jose/jwk/JWKParser.java
index 9cbb0a643a85..e1c9bd651279 100644
--- a/core/src/main/java/org/keycloak/jose/jwk/JWKParser.java
+++ b/core/src/main/java/org/keycloak/jose/jwk/JWKParser.java
@@ -25,6 +25,7 @@
 import java.security.spec.ECPublicKeySpec;
 import java.security.spec.RSAPublicKeySpec;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.common.util.Base64Url;
 import org.keycloak.crypto.KeyType;
@@ -70,10 +71,14 @@ public PublicKey toPublicKey() {
             throw new IllegalStateException("Not possible to convert to the publicKey. The jwk is not set");
         }
         String keyType = jwk.getKeyType();
+
+        // subtypes may store properties differently while representing the same JWK, serializing it to nodes
+        // makes sure there is no difference when creating the keys
+        JsonNode normalizedJwkNode = JsonSerialization.writeValueAsNode(jwk);
         if (KeyType.RSA.equals(keyType)) {
-            return createRSAPublicKey();
+            return createRSAPublicKey(normalizedJwkNode);
         } else if (KeyType.EC.equals(keyType)) {
-            return createECPublicKey();
+            return createECPublicKey(normalizedJwkNode);
         } else if (KeyType.OKP.equals(keyType)) {
             return JWKBuilder.EdEC_UTILS.createOKPPublicKey(jwk);
         } else {
@@ -81,16 +86,13 @@ public PublicKey toPublicKey() {
         }
     }
 
-    protected PublicKey createECPublicKey() {
-        /* Check if jwk.getOtherClaims return an empty map */
-        if (jwk.getOtherClaims().size() == 0) {
-            throw new RuntimeException("JWK Otherclaims map is empty.");
-        }
+    private static PublicKey createECPublicKey(JsonNode jwk) {
+
 
         /* Try retrieving the necessary fields */
-        String crv = (String) jwk.getOtherClaims().get(ECPublicJWK.CRV);
-        String xStr = (String) jwk.getOtherClaims().get(ECPublicJWK.X);
-        String yStr = (String) jwk.getOtherClaims().get(ECPublicJWK.Y);
+        String crv = jwk.path(ECPublicJWK.CRV).asText(null);
+        String xStr = jwk.get(ECPublicJWK.X).asText(null);
+        String yStr = jwk.get(ECPublicJWK.Y).asText(null);
 
         /* Check if the retrieving of necessary fields success */
         if (crv == null || xStr == null || yStr == null) {
@@ -128,9 +130,9 @@ protected PublicKey createECPublicKey() {
         }
     }
 
-    protected PublicKey createRSAPublicKey() {
-        BigInteger modulus = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.MODULUS).toString()));
-        BigInteger publicExponent = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.PUBLIC_EXPONENT).toString()));
+    private static PublicKey createRSAPublicKey(JsonNode jwk) {
+        BigInteger modulus = new BigInteger(1, Base64Url.decode(jwk.path(RSAPublicJWK.MODULUS).asText(null)));
+        BigInteger publicExponent = new BigInteger(1, Base64Url.decode(jwk.path(RSAPublicJWK.PUBLIC_EXPONENT).asText(null)));
 
         try {
             KeyFactory kf = KeyFactory.getInstance("RSA");
diff --git a/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientCredentialsProvider.java b/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientCredentialsProvider.java
index 5d268be8acb7..759842284b23 100644
--- a/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientCredentialsProvider.java
+++ b/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientCredentialsProvider.java
@@ -20,11 +20,11 @@
 import java.security.KeyPair;
 import java.security.PublicKey;
 import java.util.Map;
-import java.util.UUID;
 
 import org.keycloak.OAuth2Constants;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.KeystoreUtil;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.crypto.AsymmetricSignatureSignerContext;
@@ -177,7 +177,7 @@ public String createSignedRequestToken(String clientId, String realmInfoUrl) {
 
     protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
         JsonWebToken reqToken = new JsonWebToken();
-        reqToken.id(UUID.randomUUID().toString());
+        reqToken.id(SecretGenerator.getInstance().generateSecureID());
         reqToken.issuer(clientId);
         reqToken.subject(clientId);
         reqToken.audience(realmInfoUrl);
diff --git a/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientSecretCredentialsProvider.java b/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientSecretCredentialsProvider.java
index a53a6b543bf8..210cb4be5ae1 100644
--- a/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientSecretCredentialsProvider.java
+++ b/core/src/main/java/org/keycloak/protocol/oidc/client/authentication/JWTClientSecretCredentialsProvider.java
@@ -18,13 +18,13 @@
 
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
-import java.util.UUID;
 
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.crypto.JavaAlgorithm;
@@ -126,7 +126,7 @@ protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl)
         // JWT claims is the same as one by private_key_jwt
 
         JsonWebToken reqToken = new JsonWebToken();
-        reqToken.id(UUID.randomUUID().toString());
+        reqToken.id(SecretGenerator.getInstance().generateSecureID());
         reqToken.issuer(clientId);
         reqToken.subject(clientId);
         reqToken.audience(realmInfoUrl);
diff --git a/core/src/main/java/org/keycloak/representations/JsonWebToken.java b/core/src/main/java/org/keycloak/representations/JsonWebToken.java
index a969273fde24..ce1a98fb1e76 100755
--- a/core/src/main/java/org/keycloak/representations/JsonWebToken.java
+++ b/core/src/main/java/org/keycloak/representations/JsonWebToken.java
@@ -41,6 +41,7 @@
  */
 public class JsonWebToken implements Serializable, Token {
     public static final String AZP = "azp";
+    public static final String AUD = "aud";
     public static final String SUBJECT = "sub";
 
     @JsonProperty("jti")
@@ -52,7 +53,7 @@ public class JsonWebToken implements Serializable, Token {
 
     @JsonProperty("iss")
     protected String issuer;
-    @JsonProperty("aud")
+    @JsonProperty(AUD)
     @JsonSerialize(using = StringOrArraySerializer.class)
     @JsonDeserialize(using = StringOrArrayDeserializer.class)
     protected String[] audience;
diff --git a/core/src/main/java/org/keycloak/representations/KeyStoreConfig.java b/core/src/main/java/org/keycloak/representations/KeyStoreConfig.java
index 782669472c33..0364417eb5b8 100644
--- a/core/src/main/java/org/keycloak/representations/KeyStoreConfig.java
+++ b/core/src/main/java/org/keycloak/representations/KeyStoreConfig.java
@@ -29,6 +29,8 @@ public class KeyStoreConfig {
     protected String keyAlias;
     protected String realmAlias;
     protected String format;
+    protected Integer keySize;
+    protected Integer validity;
 
     public Boolean isRealmCertificate() {
         return realmCertificate;
@@ -77,4 +79,20 @@ public String getFormat() {
     public void setFormat(String format) {
         this.format = format;
     }
+    
+    public Integer getKeySize() {
+        return keySize;
+    }
+    
+    public void setKeySize(Integer keySize) {
+        this.keySize = keySize;
+    }
+    
+    public Integer getValidity() {
+        return validity;
+    }
+    
+    public void setValidity(Integer validity) {
+        this.validity = validity;
+    }
 }
diff --git a/core/src/main/java/org/keycloak/representations/account/ConsentScopeRepresentation.java b/core/src/main/java/org/keycloak/representations/account/ConsentScopeRepresentation.java
index a4b6400a1641..31eb0eb60b93 100644
--- a/core/src/main/java/org/keycloak/representations/account/ConsentScopeRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/account/ConsentScopeRepresentation.java
@@ -23,15 +23,15 @@ public class ConsentScopeRepresentation {
 
     private String name;
 
-    private String displayTest;
+    private String displayText;
 
     public ConsentScopeRepresentation() {
     }
 
-    public ConsentScopeRepresentation(String id, String name, String displayTest) {
+    public ConsentScopeRepresentation(String id, String name, String displayText) {
         this.id = id;
         this.name = name;
-        this.displayTest = displayTest;
+        this.displayText = displayText;
     }
 
     public String getId() {
@@ -50,11 +50,27 @@ public void setName(String name) {
         this.name = name;
     }
 
+    public String getDisplayText() {
+        return displayText;
+    }
+
+    public void setDisplayText(String displayText) {
+        this.displayText = displayText;
+    }
+
+    /**
+     * @deprecated Use {@link #getDisplayText()} instead. This method will be removed in KC 27.0.
+     */
+    @Deprecated
     public String getDisplayTest() {
-        return displayTest;
+        return displayText;
     }
 
+    /**
+     * @deprecated Use {@link #setDisplayText(String)} instead. This method will be removed in KC 27.0.
+     */
+    @Deprecated
     public void setDisplayTest(String displayTest) {
-        this.displayTest = displayTest;
+        this.displayText = displayTest;
     }
 }
diff --git a/core/src/main/java/org/keycloak/representations/account/CredentialMetadataRepresentation.java b/core/src/main/java/org/keycloak/representations/account/CredentialMetadataRepresentation.java
index da42b416bc02..594ab0d64a0b 100644
--- a/core/src/main/java/org/keycloak/representations/account/CredentialMetadataRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/account/CredentialMetadataRepresentation.java
@@ -4,9 +4,9 @@
 
 public class CredentialMetadataRepresentation {
 
-    String infoMessage;
-    String warningMessageTitle;
-    String warningMessageDescription;
+    LocalizedMessage infoMessage;
+    LocalizedMessage warningMessageTitle;
+    LocalizedMessage warningMessageDescription;
 
     private CredentialRepresentation credential;
 
@@ -19,27 +19,27 @@ public void setCredential(CredentialRepresentation credential) {
         this.credential = credential;
     }
 
-    public String getInfoMessage() {
+    public LocalizedMessage getInfoMessage() {
         return infoMessage;
     }
 
-    public void setInfoMessage(String infoMessage) {
+    public void setInfoMessage(LocalizedMessage infoMessage) {
         this.infoMessage = infoMessage;
     }
 
-    public String getWarningMessageTitle() {
+    public LocalizedMessage getWarningMessageTitle() {
         return warningMessageTitle;
     }
 
-    public void setWarningMessageTitle(String warningMessageTitle) {
+    public void setWarningMessageTitle(LocalizedMessage warningMessageTitle) {
         this.warningMessageTitle = warningMessageTitle;
     }
 
-    public String getWarningMessageDescription() {
+    public LocalizedMessage getWarningMessageDescription() {
         return warningMessageDescription;
     }
 
-    public void setWarningMessageDescription(String warningMessageDescription) {
+    public void setWarningMessageDescription(LocalizedMessage warningMessageDescription) {
         this.warningMessageDescription = warningMessageDescription;
     }
 }
diff --git a/core/src/main/java/org/keycloak/representations/account/DeviceRepresentation.java b/core/src/main/java/org/keycloak/representations/account/DeviceRepresentation.java
index 9ec8b370d496..903cdba7205e 100644
--- a/core/src/main/java/org/keycloak/representations/account/DeviceRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/account/DeviceRepresentation.java
@@ -57,6 +57,11 @@ public void setId(String id) {
         this.id = id;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
diff --git a/core/src/main/java/org/keycloak/representations/account/LocalizedMessage.java b/core/src/main/java/org/keycloak/representations/account/LocalizedMessage.java
new file mode 100644
index 000000000000..4f95a54e8855
--- /dev/null
+++ b/core/src/main/java/org/keycloak/representations/account/LocalizedMessage.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.representations.account;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class LocalizedMessage {
+
+    private final String key;
+    private final String[] parameters;
+
+    @JsonCreator
+    public LocalizedMessage(@JsonProperty("key") String key, @JsonProperty("parameters") String... parameters) {
+        this.key = key;
+        this.parameters = parameters == null || parameters.length == 0? null : parameters;
+    }
+
+    public String getKey() {
+        return key;
+    }
+
+    public String[] getParameters() {
+        return parameters;
+    }
+}
diff --git a/core/src/main/java/org/keycloak/representations/account/SessionRepresentation.java b/core/src/main/java/org/keycloak/representations/account/SessionRepresentation.java
index 996c85226c74..4b86319d70f6 100644
--- a/core/src/main/java/org/keycloak/representations/account/SessionRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/account/SessionRepresentation.java
@@ -24,6 +24,11 @@ public void setId(String id) {
         this.id = id;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/AbstractUserRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/AbstractUserRepresentation.java
index c4fe9cb7a761..b17c72f360b4 100644
--- a/core/src/main/java/org/keycloak/representations/idm/AbstractUserRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/AbstractUserRepresentation.java
@@ -45,6 +45,7 @@ public abstract class AbstractUserRepresentation {
     @JsonDeserialize(using = StringListMapDeserializer.class)
     protected Map<String, List<String>> attributes;
     private UserProfileMetadata userProfileMetadata;
+    protected Boolean enabled;
 
 
     public String getId() {
@@ -154,4 +155,12 @@ public void setUserProfileMetadata(UserProfileMetadata userProfileMetadata) {
     public UserProfileMetadata getUserProfileMetadata() {
         return userProfileMetadata;
     }
+
+    public Boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(Boolean enabled) {
+        this.enabled = enabled;
+    }
 }
diff --git a/core/src/main/java/org/keycloak/representations/idm/AdminEventRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/AdminEventRepresentation.java
index d6687e8f321c..f015762288b4 100644
--- a/core/src/main/java/org/keycloak/representations/idm/AdminEventRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/AdminEventRepresentation.java
@@ -24,6 +24,7 @@
  */
 public class AdminEventRepresentation {
 
+    private String id;
     private long time;
     private String realmId;
     private AuthDetailsRepresentation authDetails;
@@ -34,6 +35,14 @@ public class AdminEventRepresentation {
     private String error;
     private Map<String, String> details;
 
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
     public long getTime() {
         return time;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/AuthDetailsRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/AuthDetailsRepresentation.java
index 746aa718de8d..b65f5aa05a3e 100644
--- a/core/src/main/java/org/keycloak/representations/idm/AuthDetailsRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/AuthDetailsRepresentation.java
@@ -52,6 +52,11 @@ public void setUserId(String userId) {
         this.userId = userId;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/ClientPolicyConditionRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/ClientPolicyConditionRepresentation.java
index 9e771581cf19..bc86bd022aa3 100644
--- a/core/src/main/java/org/keycloak/representations/idm/ClientPolicyConditionRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/ClientPolicyConditionRepresentation.java
@@ -22,6 +22,8 @@
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.JsonNode;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -32,6 +34,9 @@ public class ClientPolicyConditionRepresentation {
     private String conditionProviderId;
 
     @JsonProperty("configuration")
+    @Schema(type= SchemaType.OBJECT,
+            description = "Configuration settings as a JSON object",
+            additionalProperties = Schema.True.class)
     private JsonNode configuration;
 
     public String getConditionProviderId() {
diff --git a/core/src/main/java/org/keycloak/representations/idm/ClientPolicyExecutorRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/ClientPolicyExecutorRepresentation.java
index a0c2a3fb4f5d..81dbe4887afc 100644
--- a/core/src/main/java/org/keycloak/representations/idm/ClientPolicyExecutorRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/ClientPolicyExecutorRepresentation.java
@@ -22,6 +22,8 @@
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.JsonNode;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -32,6 +34,9 @@ public class ClientPolicyExecutorRepresentation {
     private String executorProviderId;
 
     @JsonProperty("configuration")
+    @Schema(type=SchemaType.OBJECT,
+            description = "Configuration settings as a JSON object",
+            additionalProperties = Schema.True.class)
     private JsonNode configuration;
 
     public String getExecutorProviderId() {
diff --git a/core/src/main/java/org/keycloak/representations/idm/ComponentTypeRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/ComponentTypeRepresentation.java
index 1662fa252223..b141d3d1f707 100644
--- a/core/src/main/java/org/keycloak/representations/idm/ComponentTypeRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/ComponentTypeRepresentation.java
@@ -57,8 +57,9 @@ public void setProperties(List<ConfigPropertyRepresentation> properties) {
     }
 
     /**
-     * Extra information about the component that might come from annotations or interfaces that the component implements
-     * For example, if UserStorageProvider implements ImportSynchronization
+     * Extra information about the component
+     * that might come from annotations or interfaces that the component implements.
+     * For example, if UserStorageProviderFactory implements ImportSynchronization
      *
      * @return
      */
diff --git a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
index 0917196da897..d75b44808295 100755
--- a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
@@ -62,6 +62,7 @@ public class CredentialRepresentation {
     private Integer period;
     @Deprecated
     private MultivaluedHashMap<String, String> config;
+    private String federationLink;
 
     public String getId() {
         return id;
@@ -246,5 +247,11 @@ public boolean equals(Object obj) {
         return true;
     }
 
+    public void setFederationLink(String federationLink) {
+        this.federationLink = federationLink;
+    }
 
+    public String getFederationLink() {
+        return federationLink;
+    }
 }
diff --git a/core/src/main/java/org/keycloak/representations/idm/EventRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/EventRepresentation.java
index 0621b9b040fd..b47337ba03e0 100644
--- a/core/src/main/java/org/keycloak/representations/idm/EventRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/EventRepresentation.java
@@ -24,6 +24,7 @@
  */
 public class EventRepresentation {
 
+    private String id;
     private long time;
     private String type;
     private String realmId;
@@ -34,6 +35,14 @@ public class EventRepresentation {
     private String error;
     private Map<String, String> details;
 
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
     public long getTime() {
         return time;
     }
@@ -82,6 +91,11 @@ public void setSessionId(String sessionId) {
         this.sessionId = sessionId;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
@@ -128,6 +142,7 @@ public boolean equals(Object o) {
     @Override
     public int hashCode() {
         int result = (int) (time ^ (time >>> 32));
+        result = 31 * result + (id != null ? id.hashCode() : 0);
         result = 31 * result + (type != null ? type.hashCode() : 0);
         result = 31 * result + (realmId != null ? realmId.hashCode() : 0);
         result = 31 * result + (clientId != null ? clientId.hashCode() : 0);
diff --git a/core/src/main/java/org/keycloak/representations/idm/GroupRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/GroupRepresentation.java
index d55129a9298b..f811a0b575c1 100755
--- a/core/src/main/java/org/keycloak/representations/idm/GroupRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/GroupRepresentation.java
@@ -34,6 +34,7 @@ public class GroupRepresentation {
     // to identify a group and operate on it in a basic way
     protected String id;
     protected String name;
+    protected String description;
     protected String path;
     protected String parentId;
     protected Long subGroupCount;
@@ -62,6 +63,14 @@ public void setName(String name) {
         this.name = name;
     }
 
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
     public String getPath() {
         return path;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
index 6eaf4f498224..33df4f495b3b 100755
--- a/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
@@ -156,6 +156,7 @@ public class RealmRepresentation {
     protected Boolean webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister;
     protected List<String> webAuthnPolicyPasswordlessAcceptableAaguids;
     protected List<String> webAuthnPolicyPasswordlessExtraOrigins;
+    protected Boolean webAuthnPolicyPasswordlessPasskeysEnabled;
 
     // Client Policies/Profiles
 
@@ -1263,6 +1264,14 @@ public void setWebAuthnPolicyPasswordlessExtraOrigins(List<String> extraOrigins)
         this.webAuthnPolicyPasswordlessExtraOrigins = extraOrigins;
     }
 
+    public Boolean getWebAuthnPolicyPasswordlessPasskeysEnabled(){
+        return webAuthnPolicyPasswordlessPasskeysEnabled;
+    }
+
+    public void setWebAuthnPolicyPasswordlessPasskeysEnabled(Boolean webAuthnPolicyPasswordlessPasskeysEnabled) {
+        this.webAuthnPolicyPasswordlessPasskeysEnabled = webAuthnPolicyPasswordlessPasskeysEnabled;
+    }
+
     // Client Policies/Profiles
 
     @JsonIgnore
diff --git a/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
index 69c1ee06133c..889301b77fc7 100755
--- a/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
@@ -30,7 +30,6 @@ public class UserRepresentation extends AbstractUserRepresentation{
     protected String self; // link
     protected String origin;
     protected Long createdTimestamp;
-    protected Boolean enabled;
     protected Boolean totp;
     protected String federationLink;
     protected String serviceAccountClientId; // For rep, it points to clientId (not DB ID)
@@ -104,14 +103,6 @@ public void setCreatedTimestamp(Long createdTimestamp) {
         this.createdTimestamp = createdTimestamp;
     }
 
-    public Boolean isEnabled() {
-        return enabled;
-    }
-
-    public void setEnabled(Boolean enabled) {
-        this.enabled = enabled;
-    }
-
     @Deprecated
     public Boolean isTotp() {
         return totp;
diff --git a/core/src/main/java/org/keycloak/representations/idm/UserSessionRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/UserSessionRepresentation.java
index 8bada557793a..a9f8679bd9fc 100755
--- a/core/src/main/java/org/keycloak/representations/idm/UserSessionRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/UserSessionRepresentation.java
@@ -59,6 +59,11 @@ public void setUserId(String userId) {
         this.userId = userId;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationRequest.java b/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationRequest.java
index d5663940a765..ee08df650cdb 100644
--- a/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationRequest.java
+++ b/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationRequest.java
@@ -30,6 +30,7 @@ public class PolicyEvaluationRequest {
 
     private Map<String, Map<String, String>> context = new HashMap<>();
     private List<ResourceRepresentation> resources = new LinkedList<>();
+    private String resourceType;
     private String clientId;
     private String userId;
     private List<String> roleIds = new LinkedList<>();
@@ -51,6 +52,14 @@ public void setResources(List<ResourceRepresentation> resources) {
         this.resources = resources;
     }
 
+    public String getResourceType() {
+        return resourceType;
+    }
+
+    public void setResourceType(String resourceType) {
+        this.resourceType = resourceType;
+    }
+
     public String getClientId() {
         return this.clientId;
     }
diff --git a/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationResponse.java b/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationResponse.java
index bfa4c30d115b..b7bbd24c368c 100644
--- a/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationResponse.java
+++ b/core/src/main/java/org/keycloak/representations/idm/authorization/PolicyEvaluationResponse.java
@@ -71,9 +71,10 @@ public static class EvaluationResultRepresentation {
 
         private ResourceRepresentation resource;
         private List<ScopeRepresentation> scopes;
-        private List<PolicyResultRepresentation> policies;
+        private Set<PolicyResultRepresentation> policies;
         private DecisionEffect status;
-        private List<ScopeRepresentation> allowedScopes = new ArrayList<>();
+        private Set<ScopeRepresentation> allowedScopes = new HashSet<>();
+        private Set<ScopeRepresentation> deniedScopes = new HashSet<>();
 
         public void setResource(final ResourceRepresentation resource) {
             this.resource = resource;
@@ -91,11 +92,11 @@ public List<ScopeRepresentation> getScopes() {
             return scopes;
         }
 
-        public void setPolicies(final List<PolicyResultRepresentation> policies) {
+        public void setPolicies(final Set<PolicyResultRepresentation> policies) {
             this.policies = policies;
         }
 
-        public List<PolicyResultRepresentation> getPolicies() {
+        public Set<PolicyResultRepresentation> getPolicies() {
             return policies;
         }
 
@@ -107,13 +108,21 @@ public DecisionEffect getStatus() {
             return status;
         }
 
-        public void setAllowedScopes(List<ScopeRepresentation> allowedScopes) {
+        public void setAllowedScopes(Set<ScopeRepresentation> allowedScopes) {
             this.allowedScopes = allowedScopes;
         }
 
-        public List<ScopeRepresentation> getAllowedScopes() {
+        public Set<ScopeRepresentation> getAllowedScopes() {
             return allowedScopes;
         }
+
+        public void setDeniedScopes(Set<ScopeRepresentation> deniedScopes) {
+            this.deniedScopes = deniedScopes;
+        }
+
+        public Set<ScopeRepresentation> getDeniedScopes() {
+            return deniedScopes;
+        }
     }
 
     public static class PolicyResultRepresentation {
@@ -122,6 +131,7 @@ public static class PolicyResultRepresentation {
         private DecisionEffect status;
         private List<PolicyResultRepresentation> associatedPolicies;
         private Set<String> scopes = new HashSet<>();
+        private String resourceType;
 
         public PolicyRepresentation getPolicy() {
             return policy;
@@ -149,7 +159,7 @@ public void setAssociatedPolicies(final List<PolicyResultRepresentation> associa
 
         @Override
         public int hashCode() {
-            return this.policy.hashCode();
+            return this.policy.getName().hashCode();
         }
 
         @Override
@@ -157,7 +167,7 @@ public boolean equals(Object o) {
             if (this == o) return true;
             if (o == null || getClass() != o.getClass()) return false;
             final PolicyResultRepresentation policy = (PolicyResultRepresentation) o;
-            return this.policy.equals(policy.getPolicy());
+            return this.policy.getName().equals(policy.getPolicy().getName());
         }
 
         public void setScopes(Set<String> scopes) {
@@ -167,5 +177,13 @@ public void setScopes(Set<String> scopes) {
         public Set<String> getScopes() {
             return scopes;
         }
+
+        public void setResourceType(String resourceType) {
+            this.resourceType = resourceType;
+        }
+
+        public String getResourceType() {
+            return resourceType;
+        }
     }
 }
diff --git a/core/src/main/java/org/keycloak/representations/idm/authorization/ResourceType.java b/core/src/main/java/org/keycloak/representations/idm/authorization/ResourceType.java
index 6c6b383fd084..ce48472fb22d 100644
--- a/core/src/main/java/org/keycloak/representations/idm/authorization/ResourceType.java
+++ b/core/src/main/java/org/keycloak/representations/idm/authorization/ResourceType.java
@@ -19,16 +19,30 @@
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import java.util.Collections;
+import java.util.Map;
 import java.util.Set;
 
 public class ResourceType {
+
     private final String type;
     private final Set<String> scopes;
+    private final Map<String, Set<String>> scopeAliases;
+    private final String groupType;
 
     @JsonCreator
     public ResourceType(@JsonProperty("type") String type, @JsonProperty("scopes") Set<String> scopes) {
+        this(type, scopes, Collections.emptyMap());
+    }
+
+    public ResourceType(String type, Set<String> scopes, Map<String, Set<String>> scopeAliases) {
+        this(type, scopes, scopeAliases, null);
+    }
+
+    public ResourceType(String type, Set<String> scopes, Map<String, Set<String>> scopeAliases, String groupType) {
         this.type = type;
         this.scopes = Collections.unmodifiableSet(scopes);
+        this.scopeAliases = scopeAliases;
+        this.groupType = groupType;
     }
 
     public String getType() {
@@ -38,4 +52,12 @@ public String getType() {
     public Set<String> getScopes() {
         return Collections.unmodifiableSet(scopes);
     }
+
+    public Map<String, Set<String>> getScopeAliases() {
+        return Collections.unmodifiableMap(scopeAliases);
+    }
+
+    public String getGroupType() {
+        return groupType;
+    }
 }
diff --git a/core/src/main/java/org/keycloak/representations/info/CpuInfoRepresentation.java b/core/src/main/java/org/keycloak/representations/info/CpuInfoRepresentation.java
new file mode 100644
index 000000000000..7cd43fdd288d
--- /dev/null
+++ b/core/src/main/java/org/keycloak/representations/info/CpuInfoRepresentation.java
@@ -0,0 +1,21 @@
+package org.keycloak.representations.info;
+
+public class CpuInfoRepresentation {
+
+    protected long processorCount;
+
+    public static CpuInfoRepresentation create() {
+        Runtime runtime = Runtime.getRuntime();
+        CpuInfoRepresentation rep = new CpuInfoRepresentation();
+        rep.setProcessorCount(runtime.availableProcessors());
+        return rep;
+    }
+
+    public long getProcessorCount() {
+        return processorCount;
+    }
+
+    public void setProcessorCount(long processorCount) {
+        this.processorCount = processorCount;
+    }
+}
diff --git a/core/src/main/java/org/keycloak/representations/info/ServerInfoRepresentation.java b/core/src/main/java/org/keycloak/representations/info/ServerInfoRepresentation.java
index adb152098dc8..a20bed5d73df 100755
--- a/core/src/main/java/org/keycloak/representations/info/ServerInfoRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/info/ServerInfoRepresentation.java
@@ -31,6 +31,7 @@
 public class ServerInfoRepresentation {
 
     private SystemInfoRepresentation systemInfo;
+    private CpuInfoRepresentation cpuInfo;
     private MemoryInfoRepresentation memoryInfo;
     private ProfileInfoRepresentation profileInfo;
 
@@ -71,6 +72,14 @@ public void setMemoryInfo(MemoryInfoRepresentation memoryInfo) {
         this.memoryInfo = memoryInfo;
     }
 
+    public CpuInfoRepresentation getCpuInfo() {
+        return cpuInfo;
+    }
+
+    public void setCpuInfo(CpuInfoRepresentation cpuInfo) {
+        this.cpuInfo = cpuInfo;
+    }
+
     public ProfileInfoRepresentation getProfileInfo() {
         return profileInfo;
     }
diff --git a/core/src/main/java/org/keycloak/util/JWKSUtils.java b/core/src/main/java/org/keycloak/util/JWKSUtils.java
index c66087a59006..b4e9d0652113 100644
--- a/core/src/main/java/org/keycloak/util/JWKSUtils.java
+++ b/core/src/main/java/org/keycloak/util/JWKSUtils.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.util;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import org.jboss.logging.Logger;
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.crypto.KeyWrapper;
@@ -33,6 +34,7 @@
 
 import java.io.IOException;
 import java.security.PublicKey;
+import java.security.interfaces.ECPublicKey;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -144,20 +146,30 @@ public static String computeThumbprint(JWK key)  {
     }
 
     // TreeMap uses the natural ordering of the keys.
-    // Therefore, it follows the way of hash value calculation for a public key defined by RFC 7678
+    // Therefore, it follows the way of hash value calculation for a public key defined by RFC 7638
     public static String computeThumbprint(JWK key, String hashAlg)  {
-        Map<String, String> members = new TreeMap<>();
-        members.put(JWK.KEY_TYPE, key.getKeyType());
+        String kty = key.getKeyType();
+        String[] requiredMembers = JWK_THUMBPRINT_REQUIRED_MEMBERS.get(kty);
 
-        for (String member : JWK_THUMBPRINT_REQUIRED_MEMBERS.get(key.getKeyType())) {
-            members.put(member, (String) key.getOtherClaims().get(member));
+        // e.g. `oct`, see RFC 7638 Section 3.2
+        if (requiredMembers == null) {
+            throw new UnsupportedOperationException("Unsupported key type: " + kty);
         }
 
+        Map<String, String> members = new TreeMap<>();
+        members.put(JWK.KEY_TYPE, kty);
+
         try {
+            JsonNode node = JsonSerialization.writeValueAsNode(key);
+            for (String member : requiredMembers) {
+                members.put(member, node.get(member).asText());
+            }
+
             byte[] bytes = JsonSerialization.writeValueAsBytes(members);
             byte[] hash = HashUtils.hash(hashAlg, bytes);
             return Base64Url.encode(hash);
         } catch (IOException ex) {
+            logger.debugf(ex, "Failed to compute JWK thumbprint for key '%s'.", key.getKeyId());
             return null;
         }
     }
diff --git a/core/src/main/java/org/keycloak/util/JsonSerialization.java b/core/src/main/java/org/keycloak/util/JsonSerialization.java
index 72945e48b66c..faa0d71c7a17 100755
--- a/core/src/main/java/org/keycloak/util/JsonSerialization.java
+++ b/core/src/main/java/org/keycloak/util/JsonSerialization.java
@@ -70,6 +70,10 @@ public static byte[] writeValueAsBytes(Object obj) throws IOException {
         return mapper.writeValueAsBytes(obj);
     }
 
+    public static JsonNode writeValueAsNode(Object obj) {
+        return mapper.valueToTree(obj);
+    }
+
     public static <T> T readValue(byte[] bytes, Class<T> type) throws IOException {
         return mapper.readValue(bytes, type);
     }
diff --git a/core/src/main/java/org/keycloak/util/TokenUtil.java b/core/src/main/java/org/keycloak/util/TokenUtil.java
index 6b699afd5864..9103c38d3dd3 100644
--- a/core/src/main/java/org/keycloak/util/TokenUtil.java
+++ b/core/src/main/java/org/keycloak/util/TokenUtil.java
@@ -42,6 +42,9 @@ public class TokenUtil {
 
     public static final String TOKEN_TYPE_DPOP = "DPoP";
 
+    // Mentioned in the token-exchange specification https://datatracker.ietf.org/doc/html/rfc8693#name-successful-response
+    public static final String TOKEN_TYPE_NA = "N_A";
+
     // JWT Access Token types from https://datatracker.ietf.org/doc/html/rfc9068#section-2.1
     public static final String TOKEN_TYPE_JWT_ACCESS_TOKEN = "at+jwt";
     public static final String TOKEN_TYPE_JWT_ACCESS_TOKEN_PREFIXED = "application/" + TOKEN_TYPE_JWT_ACCESS_TOKEN;
diff --git a/core/src/test/java/org/keycloak/jose/jwk/JWKTest.java b/core/src/test/java/org/keycloak/jose/jwk/JWKTest.java
index d93d88e3b276..8bfff750c631 100644
--- a/core/src/test/java/org/keycloak/jose/jwk/JWKTest.java
+++ b/core/src/test/java/org/keycloak/jose/jwk/JWKTest.java
@@ -17,18 +17,14 @@
 
 package org.keycloak.jose.jwk;
 
-import java.util.Arrays;
-import java.util.List;
-
 import org.junit.ClassRule;
 import org.junit.Test;
+import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.common.util.Base64Url;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.crypto.JavaAlgorithm;
 import org.keycloak.crypto.KeyType;
-import org.keycloak.crypto.KeyUse;
-import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.rule.CryptoInitRule;
 import org.keycloak.util.JsonSerialization;
 
@@ -42,12 +38,13 @@
 import java.security.cert.X509Certificate;
 import java.security.interfaces.ECPublicKey;
 import java.security.spec.ECGenParameterSpec;
+import java.util.Arrays;
+import java.util.List;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
 import static org.keycloak.common.util.CertificateUtils.generateV1SelfSignedCertificate;
 import static org.keycloak.common.util.CertificateUtils.generateV3Certificate;
 
@@ -229,15 +226,15 @@ public void publicEs256P384() throws Exception {
     }
 
     @Test
-    public void parse() {
+    public void parseRsa() {
         String jwkJson = "{" +
-                "   \"kty\": \"RSA\"," +
-                "   \"alg\": \"RS256\"," +
-                "   \"use\": \"sig\"," +
-                "   \"kid\": \"3121adaa80ace09f89d80899d4a5dc4ce33d0747\"," +
-                "   \"n\": \"soFDjoZ5mQ8XAA7reQAFg90inKAHk0DXMTizo4JuOsgzUbhcplIeZ7ks83hsEjm8mP8lUVaHMPMAHEIp3gu6Xxsg-s73ofx1dtt_Fo7aj8j383MFQGl8-FvixTVobNeGeC0XBBQjN8lEl-lIwOa4ZoERNAShplTej0ntDp7TQm0=\"," +
-                "   \"e\": \"AQAB\"" +
-                "  }";
+                         "   \"kty\": \"RSA\"," +
+                         "   \"alg\": \"RS256\"," +
+                         "   \"use\": \"sig\"," +
+                         "   \"kid\": \"3121adaa80ace09f89d80899d4a5dc4ce33d0747\"," +
+                         "   \"n\": \"soFDjoZ5mQ8XAA7reQAFg90inKAHk0DXMTizo4JuOsgzUbhcplIeZ7ks83hsEjm8mP8lUVaHMPMAHEIp3gu6Xxsg-s73ofx1dtt_Fo7aj8j383MFQGl8-FvixTVobNeGeC0XBBQjN8lEl-lIwOa4ZoERNAShplTej0ntDp7TQm0=\"," +
+                         "   \"e\": \"AQAB\"" +
+                         "  }";
 
         PublicKey key = JWKParser.create().parse(jwkJson).toPublicKey();
         assertEquals("RSA", key.getAlgorithm());
@@ -245,20 +242,41 @@ public void parse() {
     }
 
     @Test
-    public void emptyEcOverclaim() throws Exception {
-        JWKBuilder builder = JWKBuilder.create();
-        KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");
-        KeyPair keyPair = generator.generateKeyPair();
-        JWK jwk = builder.ec(keyPair.getPublic(), KeyUse.ENC);
-        JWKParser parser = new JWKParser(jwk);
-
-        try {
-            parser.toPublicKey();
-        } catch (NullPointerException e) {
-            fail("NullPointerException is thrown: " + e.getMessage());
-        } catch (RuntimeException e) {
-            // Other runtime exception is expected.
-        }
+    public void parseEc() {
+
+        String jwkJson = "{\n" +
+                         "    \"kty\": \"EC\",\n" +
+                         "    \"use\": \"sig\",\n" +
+                         "    \"crv\": \"P-384\",\n" +
+                         "    \"kid\": \"KTGEM0qFeO9VGjTLjmXiE_R_eSBUkU87xmytygI1pFQ\",\n" +
+                         "    \"x\": \"_pYSppQj0JkrXFQdJPOTiktUxy_giDnqc-PEmNShrWrZm8Ol6E5qB3m1kmZJ7HUF\",\n" +
+                         "    \"y\": \"BVlstiJytsgOxrsC1VuNYdx86KKMeJg5WvJhEi-5kMpF2aMHZqbJCcIq0uRdzi7Q\",\n" +
+                         "    \"alg\": \"ES256\"\n" +
+                         "}";
+
+        JWKParser sut = JWKParser.create().parse(jwkJson);
+
+        PublicKey pub = sut.toPublicKey();
+        assertNotNull(pub);
+        assertTrue( pub.getAlgorithm().startsWith("EC"));
+        assertEquals("X.509", pub.getFormat());
+    }
+
+    @Test
+    public void toPublicKey_EC() {
+
+        ECPublicJWK ecJwk = new ECPublicJWK();
+        ecJwk.setKeyType(KeyType.EC);
+        ecJwk.setCrv("P-256");
+        ecJwk.setX("zHXlTZt3yU_oNnLIjgpt-ZaiStrYIzR2oxxq53J0uIs");
+        ecJwk.setY("cOsAvnh6olE8KHWPHmB-pJawRWmTtbChmWtSeWZRJdc");
+
+        JWKParser sut = JWKParser.create(ecJwk);
+
+        PublicKey pub = sut.toPublicKey();
+        assertNotNull(pub);
+        assertTrue(pub.getAlgorithm().startsWith("EC"));
+        assertEquals("X.509", pub.getFormat());
     }
 
     private byte[] sign(byte[] data, String javaAlgorithm, PrivateKey key) throws Exception {
diff --git a/core/src/test/java/org/keycloak/util/JWKSUtilsTest.java b/core/src/test/java/org/keycloak/util/JWKSUtilsTest.java
index 983a391accda..b769a87e0f88 100644
--- a/core/src/test/java/org/keycloak/util/JWKSUtilsTest.java
+++ b/core/src/test/java/org/keycloak/util/JWKSUtilsTest.java
@@ -22,6 +22,7 @@
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.crypto.KeyWrapper;
 import org.keycloak.crypto.PublicKeysWrapper;
+import org.keycloak.jose.jwk.ECPublicJWK;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
 import org.keycloak.rule.CryptoInitRule;
@@ -29,6 +30,7 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThrows;
 
 
 public abstract class JWKSUtilsTest {
@@ -36,6 +38,35 @@ public abstract class JWKSUtilsTest {
     @ClassRule
     public static CryptoInitRule cryptoInitRule = new CryptoInitRule();
 
+    @Test
+    public void publicEcMatches() throws Exception {
+        String keyA = "{" +
+                      "   \"kty\": \"EC\"," +
+                      "   \"use\": \"sig\"," +
+                      "   \"crv\": \"P-384\"," +
+                      "   \"kid\": \"key-a\"," +
+                      "   \"x\": \"KVZ5h_W0-8fXmUrxmyRpO_9vwwI7urXfyxGdxm1hpEuhPj2hhDxivnb2BhNvtC6O\"," +
+                      "   \"y\": \"1J3JVw_zR3uB3biAE7fs3V_4tJy2M1JinzWj9a4je5GSoW6zgGV4bk85OcuyUAhj\"," +
+                      "   \"alg\": \"ES384\"" +
+                      "  }";
+
+        ECPublicJWK ecPublicKey = JsonSerialization.readValue(keyA, ECPublicJWK.class);
+        JWK publicKey = JsonSerialization.readValue(keyA, JWK.class);
+
+        assertEquals(JWKSUtils.computeThumbprint(publicKey), JWKSUtils.computeThumbprint(ecPublicKey));
+    }
+
+    @Test
+    public void unsupportedKeyType() throws Exception {
+        String keyA = "{" +
+                      "   \"kty\": \"OCT\"," +
+                      "   \"use\": \"sig\"" +
+                      "  }";
+
+        JWK publicKey = JsonSerialization.readValue(keyA, JWK.class);
+        assertThrows(UnsupportedOperationException.class, () -> JWKSUtils.computeThumbprint(publicKey));
+    }
+
     @Test
     public void publicRs256() throws Exception {
 
diff --git a/core/src/test/java/org/keycloak/util/PemUtilsTest.java b/core/src/test/java/org/keycloak/util/PemUtilsTest.java
index 5dc4066c44c6..83449a0589a8 100644
--- a/core/src/test/java/org/keycloak/util/PemUtilsTest.java
+++ b/core/src/test/java/org/keycloak/util/PemUtilsTest.java
@@ -12,6 +12,7 @@
 import org.junit.Test;
 import org.keycloak.common.util.CertificateUtils;
 import org.keycloak.common.util.KeyUtils;
+import org.keycloak.common.util.PemException;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.rule.CryptoInitRule;
 
@@ -118,6 +119,50 @@ public void testPrivateKeyInPKCS8Format() {
         String pk = PemUtils.removeBeginEnd(privateKeyPkcs8).replace("\n", "");
         PrivateKey decodedPrivateKey2 = PemUtils.decodePrivateKey(pk);
         Assert.assertEquals(decodedPrivateKey1, decodedPrivateKey2);
+
+        String ecPrivateKeyPkcs8 = "-----BEGIN PRIVATE KEY-----\n" +
+                "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgO1oavi4kqVFc/rxj\n" +
+                "24SJivHXq7buWX58U0tswYikPwyhRANCAASCIp6nVvOk9flbUrMW7JPDmyaXCnDc\n" +
+                "Q2uMfvxVWIJzBuhG6VDoeFPk3yf2EN5t7Q8FU5jPSp6gJz9xbaFYYLL6\n" +
+                "-----END PRIVATE KEY-----";
+
+        PrivateKey decodedEcPrivateKey = PemUtils.decodePrivateKey(ecPrivateKeyPkcs8);
+        Assert.assertEquals("EC", decodedEcPrivateKey.getAlgorithm());
+    }
+
+    @Test
+    public void testDecodeCertificateBundle() {
+        String certBundleEC = "-----BEGIN CERTIFICATE-----\n" +
+                "MIIBUTCB96ADAgECAggYMJVpV/BvyTAKBggqhkjOPQQDAjARMQ8wDQYDVQQDEwZz\n" +
+                "dWItY2EwIBcNMDAwMTAxMDkwMDAwWhgPMjEwMDAxMDEwOTAwMDBaMBUxEzARBgNV\n" +
+                "BAMTCmVuZC1lbnRpdHkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASCIp6nVvOk\n" +
+                "9flbUrMW7JPDmyaXCnDcQ2uMfvxVWIJzBuhG6VDoeFPk3yf2EN5t7Q8FU5jPSp6g\n" +
+                "Jz9xbaFYYLL6ozMwMTAOBgNVHQ8BAf8EBAMCBaAwHwYDVR0jBBgwFoAU3etTPCDC\n" +
+                "f31HxBuYWWjF9ImW4ccwCgYIKoZIzj0EAwIDSQAwRgIhAKpP+HBEvUWEfjdr2qD2\n" +
+                "sw/bVLtW1HnpqVnQm2i/kDp2AiEA6F+kKyMNu+jGKmzj0Pf6v0cj0c+f00bqoJdk\n" +
+                "h+GXGnM=\n" +
+                "-----END CERTIFICATE-----\n" +
+                "-----BEGIN CERTIFICATE-----\n" +
+                "MIIBejCCAR+gAwIBAgIIGDCVaVflNG8wCgYIKoZIzj0EAwIwDTELMAkGA1UEAxMC\n" +
+                "Y2EwIBcNMDAwMTAxMDkwMDAwWhgPMjEwMDAxMDEwOTAwMDBaMBExDzANBgNVBAMT\n" +
+                "BnN1Yi1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABI4bNe/0VXXojhjdh76p\n" +
+                "89esSheOT5WEBVQnJUvDBDSRoxRiFx2BEdPaVn8L4cCbaZIxLsoJusOJadm7Eltc\n" +
+                "h3qjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW\n" +
+                "BBTd61M8IMJ/fUfEG5hZaMX0iZbhxzAfBgNVHSMEGDAWgBQ9q0KnjYuFWTSXf4YM\n" +
+                "Taz6vbNVRTAKBggqhkjOPQQDAgNJADBGAiEA3y9pa2JMhtM898f6NOZhezoHzj1a\n" +
+                "2JQIZRLQbOTjk0wCIQCg9A8414teP9whzRGSxM4eJNExdfHeJBYjDD345EW0vg==\n" +
+                "-----END CERTIFICATE-----";
+
+        X509Certificate[] certs = PemUtils.decodeCertificates(certBundleEC);
+        Assert.assertEquals(2, certs.length);
+        Assert.assertEquals("CN=end-entity", certs[0].getSubjectX500Principal().getName());
+        Assert.assertEquals("CN=sub-ca", certs[1].getSubjectX500Principal().getName());
+
+        String invalidCertBundle = "foo\n";
+        Assert.assertThrows(PemException.class, () -> {
+            PemUtils.decodeCertificates(invalidCertBundle);
+        });
+
     }
 
     private void testPrivateKeyEncodeDecode(String origPrivateKeyPem) {
diff --git a/crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProviderFactory.java b/crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProviderFactory.java
index c625a510bf2d..53a28907e713 100644
--- a/crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProviderFactory.java
+++ b/crypto/default/src/main/java/org/keycloak/crypto/hash/Argon2PasswordHashProviderFactory.java
@@ -30,7 +30,7 @@ public class Argon2PasswordHashProviderFactory implements PasswordHashProviderFa
      * When we run more, this only leads to an increased memory usage and to throttling of the process in containerized environments
      * when a CPU limit is imposed. The throttling would have a negative impact on other concurrent non-hashing activities of Keycloak.
      */
-    private Semaphore cpuCoreSempahore;
+    private Semaphore cpuCoreSemaphore;
 
     private String version;
     private String type;
@@ -41,18 +41,18 @@ public class Argon2PasswordHashProviderFactory implements PasswordHashProviderFa
 
     @Override
     public PasswordHashProvider create(KeycloakSession session) {
-        return new Argon2PasswordHashProvider(version, type, hashLength, memory, iterations, parallelism, cpuCoreSempahore);
+        return new Argon2PasswordHashProvider(version, type, hashLength, memory, iterations, parallelism, cpuCoreSemaphore);
     }
 
     @Override
     public void init(Config.Scope config) {
         version = config.get(VERSION_KEY, Argon2Parameters.DEFAULT_VERSION);
-        type = config.get(VERSION_KEY, Argon2Parameters.DEFAULT_TYPE);
+        type = config.get(TYPE_KEY, Argon2Parameters.DEFAULT_TYPE);
         hashLength = config.getInt(HASH_LENGTH_KEY, Argon2Parameters.DEFAULT_HASH_LENGTH);
         memory = config.getInt(MEMORY_KEY, Argon2Parameters.DEFAULT_MEMORY);
         iterations = config.getInt(ITERATIONS_KEY, Argon2Parameters.DEFAULT_ITERATIONS);
         parallelism = config.getInt(PARALLELISM_KEY, Argon2Parameters.DEFAULT_PARALLELISM);
-        cpuCoreSempahore = new Semaphore(config.getInt(CPU_CORES_KEY, Runtime.getRuntime().availableProcessors()));
+        cpuCoreSemaphore = new Semaphore(config.getInt(CPU_CORES_KEY, Runtime.getRuntime().availableProcessors()));
     }
 
     @Override
@@ -89,7 +89,7 @@ public List<ProviderConfigProperty> getConfigMetadata() {
                 .add();
 
         builder.property()
-                .name(TYPE_KEY)
+                .name(HASH_LENGTH_KEY)
                 .type("int")
                 .helpText("Hash length")
                 .defaultValue(Argon2Parameters.DEFAULT_HASH_LENGTH)
diff --git a/distribution/api-docs-dist/pom.xml b/distribution/api-docs-dist/pom.xml
index 49cef2855b5b..fe2100febe96 100755
--- a/distribution/api-docs-dist/pom.xml
+++ b/distribution/api-docs-dist/pom.xml
@@ -76,6 +76,10 @@
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.infinispan</groupId>
+            <artifactId>infinispan-component-annotations</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/distribution/downloads/src/main/resources/files b/distribution/downloads/src/main/resources/files
index 72c0a1ef161c..219a5b3a84a1 100644
--- a/distribution/downloads/src/main/resources/files
+++ b/distribution/downloads/src/main/resources/files
@@ -4,7 +4,6 @@ mvn:keycloak-api-docs-dist:keycloak-api-docs
 mvn:documentation/keycloak-documentation:keycloak-documentation
 
 npm:js/libs/keycloak-admin-client/target/keycloak-keycloak-admin-client-$$VERSION$$.tgz:keycloak-admin-client-$$VERSION$$.tgz
-npm:js/libs/keycloak-js/target/keycloak-js-$$VERSION$$.tgz:keycloak-js-$$VERSION$$.tgz
 npm:js/libs/ui-shared/target/keycloak-keycloak-ui-shared-$$VERSION$$.tgz:keycloak-ui-shared-$$VERSION$$.tgz
 npm:js/apps/account-ui/target/keycloak-keycloak-account-ui-$$VERSION$$.tgz:keycloak-account-ui-$$VERSION$$.tgz
 npm:js/apps/admin-ui/target/keycloak-keycloak-admin-ui-$$VERSION$$.tgz:keycloak-admin-ui-$$VERSION$$.tgz
diff --git a/distribution/maven-plugins/osv-scanner.toml b/distribution/maven-plugins/osv-scanner.toml
new file mode 100644
index 000000000000..683c17048988
--- /dev/null
+++ b/distribution/maven-plugins/osv-scanner.toml
@@ -0,0 +1,10 @@
+# Ignore false positives for https://securityscorecards.dev/viewer/?uri=github.com/keycloak/keycloak
+
+# Suppress TestNG alert:
+# - TestNG is brought in as a transitive dependency via groovy-testng.
+# - Test dependencies are not included in the server distribution.
+# - The latest groovy-testng version doesn't address the CVE.
+
+[[IgnoredVulns]]
+id = "GHSA-rc2q-x9mf-w3vf"
+reason = "suppressed because TestNG, a transitive dependency from groovy-testng, isn’t included in the server distribution."
diff --git a/distribution/pom.xml b/distribution/pom.xml
index c9feefa493a3..d2b8affb0c08 100755
--- a/distribution/pom.xml
+++ b/distribution/pom.xml
@@ -41,6 +41,7 @@
     </properties>
 
     <modules>
+        <module>saml-adapters</module>
         <module>galleon-feature-packs</module>
         <module>licenses-common</module>
         <module>maven-plugins</module>
diff --git a/distribution/saml-adapters/pom.xml b/distribution/saml-adapters/pom.xml
new file mode 100755
index 000000000000..e0bf923961d4
--- /dev/null
+++ b/distribution/saml-adapters/pom.xml
@@ -0,0 +1,37 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-distribution-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+    </parent>
+
+    <name>SAML Adapters Distribution Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-saml-adapters-distribution-parent</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>wildfly-adapter</module>
+    </modules>
+
+</project>
diff --git a/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml-offline.cli b/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml-offline.cli
new file mode 100755
index 000000000000..75e9390b7072
--- /dev/null
+++ b/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml-offline.cli
@@ -0,0 +1,61 @@
+embed-server --server-config=${server.config:standalone.xml}
+
+if (outcome != success) of /extension=org.keycloak.keycloak-saml-adapter-subsystem:read-resource
+    /extension=org.keycloak.keycloak-saml-adapter-subsystem/:add(module=org.keycloak.keycloak-saml-adapter-subsystem)
+else
+    echo Keycloak SAML Extension already installed
+end-if
+
+if (outcome != success) of /subsystem=keycloak-saml:read-resource
+    /subsystem=keycloak-saml:add
+else
+    echo Keycloak SAML Subsystem already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/custom-realm=KeycloakSAMLRealm:read-resource
+    /subsystem=elytron/custom-realm=KeycloakSAMLRealm:add(class-name=org.keycloak.adapters.saml.elytron.KeycloakSecurityRealm, module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
+else
+    echo Keycloak SAML Realm already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/security-domain=KeycloakDomain:read-resource
+    /subsystem=elytron/security-domain=KeycloakDomain:add(default-realm=KeycloakSAMLRealm,permission-mapper=default-permission-mapper,security-event-listener=local-audit,realms=[{realm=KeycloakSAMLRealm}])
+else
+    echo Keycloak Security Domain already installed. Trying to install Keycloak SAML Realm.
+    /subsystem=elytron/security-domain=KeycloakDomain:list-add(name=realms, value={realm=KeycloakSAMLRealm})
+end-if
+
+if (outcome != success) of /subsystem=elytron/constant-realm-mapper=keycloak-saml-realm-mapper:read-resource
+    /subsystem=elytron/constant-realm-mapper=keycloak-saml-realm-mapper:add(realm-name=KeycloakSAMLRealm)
+else
+    echo Keycloak SAML Realm Mapper already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory:read-resource
+    /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory:add(module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
+else
+    echo Keycloak SAML HTTP Mechanism Factory already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:read-resource
+    /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:add(http-server-mechanism-factories=[keycloak-saml-http-server-mechanism-factory, global])
+else
+    echo Keycloak HTTP Mechanism Factory already installed. Trying to install Keycloak SAML HTTP Mechanism Factory.
+    /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:list-add(name=http-server-mechanism-factories, value=keycloak-saml-http-server-mechanism-factory)
+end-if
+
+if (outcome != success) of /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:read-resource
+    /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:add(security-domain=KeycloakDomain,http-server-mechanism-factory=keycloak-http-server-mechanism-factory,mechanism-configurations=[{mechanism-name=KEYCLOAK-SAML,mechanism-realm-configurations=[{realm-name=KeycloakSAMLCRealm,realm-mapper=keycloak-saml-realm-mapper}]}])
+else
+    echo Keycloak HTTP Authentication Factory already installed. Trying to install Keycloak SAML Mechanism Configuration
+    /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:list-add(name=mechanism-configurations, value={mechanism-name=KEYCLOAK-SAML,mechanism-realm-configurations=[{realm-name=KeycloakSAMLRealm,realm-mapper=keycloak-saml-realm-mapper}]})
+end-if
+
+if (outcome != success) of /subsystem=undertow/application-security-domain=other:read-resource
+    /subsystem=undertow/application-security-domain=other:add(http-authentication-factory=keycloak-http-authentication)
+else
+    batch
+    /subsystem=undertow/application-security-domain=other:undefine-attribute(name=security-domain)
+    /subsystem=undertow/application-security-domain=other:write-attribute(name=http-authentication-factory,value=keycloak-http-authentication)
+    run-batch
+end-if
diff --git a/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml.cli b/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml.cli
new file mode 100755
index 000000000000..dbd1efb73379
--- /dev/null
+++ b/distribution/saml-adapters/shared-cli/adapter-elytron-install-saml.cli
@@ -0,0 +1,59 @@
+if (outcome != success) of /extension=org.keycloak.keycloak-saml-adapter-subsystem:read-resource
+    /extension=org.keycloak.keycloak-saml-adapter-subsystem/:add(module=org.keycloak.keycloak-saml-adapter-subsystem)
+else
+    echo Keycloak SAML Extension already installed
+end-if
+
+if (outcome != success) of /subsystem=keycloak-saml:read-resource
+    /subsystem=keycloak-saml:add
+else
+    echo Keycloak SAML Subsystem already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/custom-realm=KeycloakSAMLRealm:read-resource
+    /subsystem=elytron/custom-realm=KeycloakSAMLRealm:add(class-name=org.keycloak.adapters.saml.elytron.KeycloakSecurityRealm, module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
+else
+    echo Keycloak SAML Realm already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/security-domain=KeycloakDomain:read-resource
+    /subsystem=elytron/security-domain=KeycloakDomain:add(default-realm=KeycloakSAMLRealm,permission-mapper=default-permission-mapper,security-event-listener=local-audit,realms=[{realm=KeycloakSAMLRealm}])
+else
+    echo Keycloak Security Domain already installed. Trying to install Keycloak SAML Realm.
+    /subsystem=elytron/security-domain=KeycloakDomain:list-add(name=realms, value={realm=KeycloakSAMLRealm})
+end-if
+
+if (outcome != success) of /subsystem=elytron/constant-realm-mapper=keycloak-saml-realm-mapper:read-resource
+    /subsystem=elytron/constant-realm-mapper=keycloak-saml-realm-mapper:add(realm-name=KeycloakSAMLRealm)
+else
+    echo Keycloak SAML Realm Mapper already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory:read-resource
+    /subsystem=elytron/service-loader-http-server-mechanism-factory=keycloak-saml-http-server-mechanism-factory:add(module=org.keycloak.keycloak-saml-wildfly-elytron-adapter)
+else
+    echo Keycloak SAML HTTP Mechanism Factory already installed
+end-if
+
+if (outcome != success) of /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:read-resource
+    /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:add(http-server-mechanism-factories=[keycloak-saml-http-server-mechanism-factory, global])
+else
+    echo Keycloak HTTP Mechanism Factory already installed. Trying to install Keycloak SAML HTTP Mechanism Factory.
+    /subsystem=elytron/aggregate-http-server-mechanism-factory=keycloak-http-server-mechanism-factory:list-add(name=http-server-mechanism-factories, value=keycloak-saml-http-server-mechanism-factory)
+end-if
+
+if (outcome != success) of /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:read-resource
+    /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:add(security-domain=KeycloakDomain,http-server-mechanism-factory=keycloak-http-server-mechanism-factory,mechanism-configurations=[{mechanism-name=KEYCLOAK-SAML,mechanism-realm-configurations=[{realm-name=KeycloakSAMLCRealm,realm-mapper=keycloak-saml-realm-mapper}]}])
+else
+    echo Keycloak HTTP Authentication Factory already installed. Trying to install Keycloak SAML Mechanism Configuration
+    /subsystem=elytron/http-authentication-factory=keycloak-http-authentication:list-add(name=mechanism-configurations, value={mechanism-name=KEYCLOAK-SAML,mechanism-realm-configurations=[{realm-name=KeycloakSAMLRealm,realm-mapper=keycloak-saml-realm-mapper}]})
+end-if
+
+if (outcome != success) of /subsystem=undertow/application-security-domain=other:read-resource
+    /subsystem=undertow/application-security-domain=other:add(http-authentication-factory=keycloak-http-authentication)
+else
+    batch
+    /subsystem=undertow/application-security-domain=other:undefine-attribute(name=security-domain)
+    /subsystem=undertow/application-security-domain=other:write-attribute(name=http-authentication-factory,value=keycloak-http-authentication)
+    run-batch
+end-if
diff --git a/distribution/saml-adapters/shared-cli/adapter-install-saml-offline.cli b/distribution/saml-adapters/shared-cli/adapter-install-saml-offline.cli
new file mode 100755
index 000000000000..8c3ca4ca5889
--- /dev/null
+++ b/distribution/saml-adapters/shared-cli/adapter-install-saml-offline.cli
@@ -0,0 +1,3 @@
+embed-server --server-config=${server.config:standalone.xml}
+/extension=org.keycloak.keycloak-saml-adapter-subsystem/:add(module=org.keycloak.keycloak-saml-adapter-subsystem)
+/subsystem=keycloak-saml:add
\ No newline at end of file
diff --git a/distribution/saml-adapters/shared-cli/adapter-install-saml.cli b/distribution/saml-adapters/shared-cli/adapter-install-saml.cli
new file mode 100755
index 000000000000..d1bdfa3ca4df
--- /dev/null
+++ b/distribution/saml-adapters/shared-cli/adapter-install-saml.cli
@@ -0,0 +1,2 @@
+/extension=org.keycloak.keycloak-saml-adapter-subsystem/:add(module=org.keycloak.keycloak-saml-adapter-subsystem)
+/subsystem=keycloak-saml:add
\ No newline at end of file
diff --git a/distribution/saml-adapters/wildfly-adapter/pom.xml b/distribution/saml-adapters/wildfly-adapter/pom.xml
new file mode 100755
index 000000000000..b019240ae075
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/pom.xml
@@ -0,0 +1,38 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../../../pom.xml</relativePath>
+    </parent>
+    <name>Keycloak Wildfly SAML Adapter</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-saml-wildfly-adapter-dist-pom</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>wildfly-modules</module>
+        <module>wildfly-adapter-zip</module>
+    </modules>
+
+</project>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/assembly.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/assembly.xml
new file mode 100755
index 000000000000..feb22b8d3894
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/assembly.xml
@@ -0,0 +1,58 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<assembly>
+    <id>war-dist</id>
+
+    <formats>
+        <format>zip</format>
+        <format>tar.gz</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+
+    <fileSets>
+        <fileSet>
+            <directory>${project.build.directory}/unpacked/modules</directory>
+            <includes>
+                <include>**/**</include>
+            </includes>
+            <outputDirectory>modules</outputDirectory>
+        </fileSet>
+        <fileSet>
+            <directory>${project.build.directory}/unpacked/licenses</directory>
+            <outputDirectory>docs/licenses-keycloak</outputDirectory>
+        </fileSet>
+    </fileSets>
+    <files>
+        <file>
+             <source>../../shared-cli/adapter-install-saml.cli</source>
+             <outputDirectory>bin</outputDirectory>
+        </file>
+        <file>
+             <source>../../shared-cli/adapter-install-saml-offline.cli</source>
+             <outputDirectory>bin</outputDirectory>
+        </file>
+        <file>
+            <source>../../shared-cli/adapter-elytron-install-saml.cli</source>
+            <outputDirectory>bin</outputDirectory>
+        </file>
+        <file>
+            <source>../../shared-cli/adapter-elytron-install-saml-offline.cli</source>
+            <outputDirectory>bin</outputDirectory>
+        </file>
+    </files>
+</assembly>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml
new file mode 100755
index 000000000000..d503885a0fb5
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-adapter-zip/pom.xml
@@ -0,0 +1,93 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+
+    <artifactId>keycloak-saml-wildfly-adapter-dist</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak SAML Wildfly Adapter Distro</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-wildfly-modules</artifactId>
+            <type>zip</type>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>unpack</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>unpack</goal>
+                        </goals>
+                        <configuration>
+                            <artifactItems>
+                                <artifactItem>
+                                    <groupId>org.keycloak</groupId>
+                                    <artifactId>keycloak-saml-wildfly-modules</artifactId>
+                                    <type>zip</type>
+                                    <outputDirectory>${project.build.directory}/unpacked</outputDirectory>
+                                </artifactItem>
+                            </artifactItems>
+                        </configuration>
+                    </execution>
+
+                </executions>
+            </plugin>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assemble</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>assembly.xml</descriptor>
+                            </descriptors>
+                            <outputDirectory>
+                                target
+                            </outputDirectory>
+                            <workDirectory>
+                                target/assembly/work
+                            </workDirectory>
+                            <appendAssemblyId>false</appendAssemblyId>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/assembly.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/assembly.xml
new file mode 100755
index 000000000000..9d38002cfe3d
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/assembly.xml
@@ -0,0 +1,43 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<assembly>
+    <id>dist</id>
+
+    <formats>
+        <format>zip</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+
+    <fileSets>
+        <fileSet>
+            <directory>src/main/resources/licenses/keycloak</directory>
+            <outputDirectory>licenses</outputDirectory>
+            <excludes>
+                <exclude>licenses.xml</exclude>
+            </excludes>
+        </fileSet>
+        <fileSet>
+            <directory>${project.build.directory}/licenses</directory>
+            <outputDirectory>licenses</outputDirectory>
+        </fileSet>
+        <fileSet>
+            <directory>${project.build.directory}/modules</directory>
+            <outputDirectory>modules</outputDirectory>
+        </fileSet>
+    </fileSets>
+</assembly>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/build.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/build.xml
new file mode 100755
index 000000000000..48329548cbf4
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/build.xml
@@ -0,0 +1,94 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project name="module-repository" basedir="." default="all">
+
+    <import file="lib.xml"/>
+
+    <property name="output.dir" value="target"/>
+
+    <target name="all">
+        <!-- copy modules definitions from saml-galleon-feature-pack resources
+             org.keycloak:keycloak-saml-adapter-galleon-pack
+        -->
+        <copy todir="${output.dir}/modules">
+            <fileset dir="../../../galleon-feature-packs/saml-adapter-galleon-pack/src/main/resources/modules"/>
+        </copy>
+        <!-- prepare module.xml files to further processing -->
+        <replaceregexp match="&lt;artifact.*/&gt;" replace="&lt;!-- Insert resources here --&gt;" byline="true">
+            <fileset dir="${output.dir}/modules" includes="**/module.xml"/>
+        </replaceregexp>
+        <antcall target="modules">
+            <param name="mavenized.modules" value="false"/>
+            <param name="output.dir" value="target"/>
+        </antcall>
+    </target>
+
+
+    <target name="modules">
+
+        <!-- server min dependencies -->
+
+        <module-def name="org.keycloak.keycloak-common">
+            <maven-resource group="org.keycloak" artifact="keycloak-common"/>
+        </module-def>
+
+        <!-- subsystems -->
+
+        <module-def name="org.keycloak.keycloak-adapter-spi">
+            <maven-resource group="org.keycloak" artifact="keycloak-adapter-spi"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-core">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-core"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-core-public">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-core-public"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-adapter-api-public">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-adapter-api-public"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-adapter-core">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-adapter-core"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-jboss-adapter-core">
+            <maven-resource group="org.keycloak" artifact="keycloak-jboss-adapter-core"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-wildfly-subsystem">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-wildfly-subsystem"/>
+        </module-def>
+
+        <module-def name="org.keycloak.keycloak-saml-wildfly-elytron-adapter">
+            <maven-resource group="org.keycloak" artifact="keycloak-saml-wildfly-elytron-adapter"/>
+        </module-def>
+
+    </target>
+
+    <target name="clean-target">
+        <delete dir="${output.dir}"/>
+    </target>
+
+    <target name="clean" depends="clean-target">
+        <delete file="maven-ant-tasks.jar"/>
+    </target>
+
+</project>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/lib.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/lib.xml
new file mode 100755
index 000000000000..005acd68eee0
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/lib.xml
@@ -0,0 +1,270 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project name="module-repository-lib">
+
+    <property name="src.dir" value="src"/>
+    <property name="module.repo.src.dir" value="${src.dir}/main/resources/modules"/>
+    <property name="module.xml" value="module.xml"/>
+
+    <taskdef resource="net/sf/antcontrib/antlib.xml"/>
+    <taskdef name="jandex" classname="org.jboss.jandex.JandexAntTask" />
+
+    <macrodef name="module-def">
+        <attribute name="name"/>
+        <attribute name="slot" default="main"/>
+        <element name="resources" implicit="yes" optional="yes"/>
+
+        <sequential>
+            <echo message="Initializing module -> @{name}"/>
+            <property name="module.repo.output.dir" value="${output.dir}/modules/system/add-ons/keycloak"/>
+            <!-- Figure out the correct module path -->
+            <define-module-dir name="@{name}" slot="@{slot}"/>
+
+            <!-- Make the module output director -->
+            <mkdir dir="${module.repo.output.dir}/${current.module.path}"/>
+
+            <!-- Process the resource -->
+            <resources/>
+            
+            <!-- Add keycloak version property to module xml -->
+            <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}"
+                     token="$${project.version}"
+                     value="${project.version}"/>
+            
+            <!-- Some final cleanup -->
+            <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                <replacetoken>
+                    <![CDATA[
+        <!-- Insert resources here -->]]></replacetoken>
+                <replacevalue>
+                </replacevalue>
+            </replace>
+
+        </sequential>
+    </macrodef>
+
+    <macrodef name="bundle-def">
+        <attribute name="name"/>
+        <attribute name="slot" default="main"/>
+        <element name="resources" implicit="yes" optional="yes"/>
+
+        <sequential>
+            <echo message="Initializing bundle -> @{name}"/>
+            <property name="bundle.repo.output.dir" value="${output.dir}/bundles/system/layers/base"/>
+            <!-- Figure out the correct bundle path -->
+            <define-bundle-dir name="@{name}" slot="@{slot}" />
+
+            <!-- Make the bundle output director -->
+            <mkdir dir="${bundle.repo.output.dir}/${current.bundle.path}"/>
+
+            <!-- Process the resource -->
+            <resources/>
+
+        </sequential>
+    </macrodef>
+
+    <macrodef name="maven-bundle" >
+        <attribute name="group"/>
+        <attribute name="artifact"/>
+
+        <sequential>
+            <!-- Copy the jar to the bundle dir -->
+            <property name="bundle.repo.output.dir" value="${output.dir}/bundles/system/layers/base"/>
+            <copy todir="${bundle.repo.output.dir}/${current.bundle.path}" failonerror="true">
+                <fileset file="${@{group}:@{artifact}:jar}"/>
+                <mapper type="flatten" />
+            </copy>
+        </sequential>
+    </macrodef>
+
+    <scriptdef name="define-module-dir" language="javascript" manager="bsf">
+        <attribute name="name"/>
+        <attribute name="slot"/>
+        <![CDATA[
+            name = attributes.get("name");
+            name = name.replace(".", "/");
+            project.setProperty("current.module.path", name + "/" + attributes.get("slot"));
+        ]]>
+    </scriptdef>
+
+    <scriptdef name="define-bundle-dir" language="javascript"  manager="bsf">
+        <attribute name="name"/>
+        <attribute name="slot"/>
+        <![CDATA[
+            name = attributes.get("name");
+            name = name.replace(".", "/");
+            project.setProperty("current.bundle.path", name + "/" + attributes.get("slot"));
+        ]]>
+    </scriptdef>
+
+    <!--
+       Get the version from the parent directory of the jar.  If the parent directory is 'target' this
+       means that the jar is contained in AS build so extract the version from the file name
+    -->
+    <scriptdef name="define-maven-artifact" language="javascript"  manager="bsf">
+        <attribute name="group"/>
+        <attribute name="artifact"/>
+        <attribute name="classifier"/>
+        <attribute name="element"/>
+        <attribute name="path"/>
+        <![CDATA[
+            importClass(Packages.java.io.File);
+            group = attributes.get("group");
+            artifact = attributes.get("artifact");
+            classifier = attributes.get("classifier");
+            element = attributes.get("element");
+            path = attributes.get("path");
+            if(path.indexOf('${') != -1) {
+                throw "Module resource root not found, make sure it is listed in build/pom.xml" + path;
+            }
+            fp = new File(path);
+            version = fp.getParentFile().getName();
+            if (version.equals("target")) {
+               version = fp.getName();
+               version = version.substring(artifact.length() + 1);
+               suffix = ".jar";
+               if (classifier) {
+                  suffix = "-" + classifier + suffix;
+               }
+               version = version.replace(suffix, "");
+            }
+
+            root = "<" + element + " name=\"" + group + ":" + artifact + ":" + version;
+            if (classifier) {
+               root = root + ":" + classifier;
+            }
+            root = root + "\"/>";
+            project.setProperty("current.maven.root", root);
+        ]]>
+    </scriptdef>
+
+    <macrodef name="maven-resource" >
+        <attribute name="group"/>
+        <attribute name="artifact"/>
+        <attribute name="jandex" default="false" />
+
+        <sequential>
+            <if>
+               <equals arg1="${mavenized.modules}" arg2="true"/>
+               <then>
+                <define-maven-artifact group="@{group}" artifact="@{artifact}" element="artifact" path="${@{group}:@{artifact}:jar}"/>
+                <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                    <replacefilter token="&lt;!-- Insert resources here --&gt;" value="${current.maven.root}&#10;        &lt;!-- Insert resources here --&gt;"/>
+                </replace>
+               </then>
+
+            <else>
+            <!-- Copy the jar to the module dir -->
+            <copy todir="${module.repo.output.dir}/${current.module.path}" failonerror="true">
+                <fileset file="${@{group}:@{artifact}:jar}"/>
+                <mapper type="flatten" />
+            </copy>
+
+            <basename file="${@{group}:@{artifact}:jar}" property="resourcename.@{group}.@{artifact}"/>
+            <!-- Generate the Jandex Index -->
+            <jandex run="@{jandex}" newJar="true" >
+                <fileset dir="${module.repo.output.dir}/${current.module.path}" />
+            </jandex>
+            <!-- Update the resource entry in module.xml -->
+            <define-resource-root path="${resourcename.@{group}.@{artifact}}" jandex="@{jandex}"/>
+            <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                <replacefilter token="&lt;!-- Insert resources here --&gt;" value="${current.resource.root}&#10;        &lt;!-- Insert resources here --&gt;"/>
+            </replace>
+            </else>
+            </if>
+        </sequential>
+    </macrodef>
+
+
+
+    <macrodef name="maven-resource-with-classifier" >
+        <attribute name="group"/>
+        <attribute name="artifact"/>
+        <attribute name="classifier"/>
+        <attribute name="jandex" default="false" />
+
+        <sequential>
+            <if>
+            <equals arg1="${mavenized.modules}" arg2="true"/>
+            <then>
+                <define-maven-artifact group="@{group}" artifact="@{artifact}" element="artifact" classifier="@{classifier}" path="${@{group}:@{artifact}:jar:@{classifier}}"/>
+                <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                    <replacefilter token="&lt;!-- Insert resources here --&gt;" value="${current.maven.root}&#10;        &lt;!-- Insert resources here --&gt;"/>
+                </replace>
+            </then>
+            <else>
+            <!-- Copy the jar to the module dir -->
+            <copy todir="${module.repo.output.dir}/${current.module.path}" failonerror="true">
+                <fileset file="${@{group}:@{artifact}:jar:@{classifier}}"/>
+                <!-- http://jira.codehaus.org/browse/MANTRUN-159 -->
+                <mapper type="flatten" />
+            </copy>
+
+            <basename file="${@{group}:@{artifact}:jar:@{classifier}}" property="resourcename.@{group}.@{artifact}.@{classifier}"/>
+
+            <!-- Update the resource entry in module.xml -->
+            <define-resource-root path="${resourcename.@{group}.@{artifact}.@{classifier}}"/>
+            <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                <replacefilter token="&lt;!-- Insert resources here --&gt;" value="${current.resource.root}&#10;        &lt;!-- Insert resources here --&gt;"/>
+            </replace>
+            </else>
+            </if>
+        </sequential>
+    </macrodef>
+
+    <macrodef name="extract-native-jar" >
+        <attribute name="group"/>
+        <attribute name="artifact"/>
+        <sequential>
+            <if>
+            <equals arg1="${mavenized.modules}" arg2="true"/>
+            <then>
+                <define-maven-artifact group="@{group}" artifact="@{artifact}" element="native-artifact" path="${@{group}:@{artifact}:jar}"/>
+                <replace file="${module.repo.output.dir}/${current.module.path}/${module.xml}">
+                    <replacefilter token="&lt;!-- Insert resources here --&gt;" value="${current.maven.root}&#10;        &lt;!-- Insert resources here --&gt;"/>
+                </replace>
+            </then>
+
+            <else>
+            <unzip src="${@{group}:@{artifact}:jar}" dest="${module.repo.output.dir}/${current.module.path}">
+           <patternset>
+               <include name="lib/**"/>
+           </patternset>
+           </unzip>
+           </else>
+           </if>
+        </sequential>
+    </macrodef>
+
+    <scriptdef name="define-resource-root" language="javascript" manager="bsf">
+        <attribute name="path"/>
+        <attribute name="jandex"/>
+        <![CDATA[
+            path = attributes.get("path");
+            root = "<resource-root path=\"" + path + "\"/>";
+            if(path.indexOf('${') != -1) {
+                throw "Module resource root not found, make sure it is listed in build/pom.xml" + path;
+            }
+            if(attributes.get("jandex") == "true" ) {
+                root = root + "\n\t<resource-root path=\"" + path.replace(".jar","-jandex.jar") + "\"/>";
+            }
+            project.setProperty("current.resource.root", root);
+        ]]>
+    </scriptdef>
+
+</project>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml
new file mode 100755
index 000000000000..8d7e26856ae9
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/pom.xml
@@ -0,0 +1,226 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+
+    <artifactId>keycloak-saml-wildfly-modules</artifactId>
+
+    <name>Keycloak SAML Wildfly Modules</name>
+    <packaging>pom</packaging>
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-common</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-adapter-spi</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-adapter-api-public</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-adapter-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-jboss-adapter-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-core-public</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-wildfly-elytron-adapter</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-wildfly-subsystem</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-adapter-galleon-pack</artifactId>
+            <type>zip</type>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <inherited>false</inherited>
+                <executions>
+                    <execution>
+                        <id>build-dist</id>
+                        <goals>
+                            <goal>run</goal>
+                        </goals>
+                        <phase>compile</phase>
+                        <configuration>
+                            <target>
+                                <ant antfile="build.xml" inheritRefs="true">
+                                    <target name="all"/>
+                                </ant>
+                            </target>
+                        </configuration>
+                    </execution>
+                </executions>
+                <dependencies>
+                    <dependency>
+                        <groupId>org.jboss</groupId>
+                        <artifactId>jandex</artifactId>
+                        <version>1.0.3.Final</version>
+                    </dependency>
+                    <dependency>
+                        <groupId>ant-contrib</groupId>
+                        <artifactId>ant-contrib</artifactId>
+                        <version>1.0b3</version>
+                        <exclusions>
+                            <exclusion>
+                                <groupId>ant</groupId>
+                                <artifactId>ant</artifactId>
+                            </exclusion>
+                        </exclusions>
+                    </dependency>
+                    <dependency>
+                        <groupId>org.apache.ant</groupId>
+                        <artifactId>ant-apache-bsf</artifactId>
+                        <version>1.9.3</version>
+                    </dependency>
+                    <dependency>
+                        <groupId>org.apache.bsf</groupId>
+                        <artifactId>bsf-api</artifactId>
+                        <version>3.1</version>
+                    </dependency>
+                    <dependency>
+                        <groupId>rhino</groupId>
+                        <artifactId>js</artifactId>
+                        <version>1.7R2</version>
+                    </dependency>
+                </dependencies>
+            </plugin>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assemble</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>assembly.xml</descriptor>
+                            </descriptors>
+                            <outputDirectory>
+                                target
+                            </outputDirectory>
+                            <workDirectory>
+                                target/assembly/work
+                            </workDirectory>
+                            <appendAssemblyId>false</appendAssemblyId>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.keycloak</groupId>
+                <artifactId>keycloak-distribution-licenses-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/distribution/saml-adapters/wildfly-adapter/wildfly-modules/src/main/resources/licenses/keycloak/licenses.xml b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/src/main/resources/licenses/keycloak/licenses.xml
new file mode 100644
index 000000000000..bac7cdfbcc59
--- /dev/null
+++ b/distribution/saml-adapters/wildfly-adapter/wildfly-modules/src/main/resources/licenses/keycloak/licenses.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<licenseSummary>
+  <dependencies>
+  </dependencies>
+</licenseSummary>
diff --git a/docs/building.md b/docs/building.md
index 11184fae47ac..b40809c2d3b4 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -1,10 +1,16 @@
 ## Building from source
 
-Ensure you have JDK 21 (or newer) and Git installed
+Ensure you have **JDK 17** or **JDK 21** and Git installed
 
     java -version
     git --version
 
+Newer versions of the JDK are not supported. If you have multiple JDK versions
+installed, you can specify which one to use during the build by setting the `JAVA_HOME`
+environment variable (this should be the directory containing `/bin/` or `/jre/`).
+
+    JAVA_HOME=/path/to/jdk-21/ ./mvnw clean install
+
 Instead of using a locally installed Maven, call the Maven wrapper script `mvnw` in the main folder of the project.
 This will use the Maven version which is supported by this project.
 
diff --git a/docs/documentation/authorization_services/images/getting-started/hello-world/authz-settings.png b/docs/documentation/authorization_services/images/getting-started/hello-world/authz-settings.png
index 5214a2fbaa6a..e038eb654f88 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/hello-world/authz-settings.png and b/docs/documentation/authorization_services/images/getting-started/hello-world/authz-settings.png differ
diff --git a/docs/documentation/authorization_services/images/getting-started/hello-world/create-client.png b/docs/documentation/authorization_services/images/getting-started/hello-world/create-client.png
index e59680027c21..df6b80a70fdd 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/hello-world/create-client.png and b/docs/documentation/authorization_services/images/getting-started/hello-world/create-client.png differ
diff --git a/docs/documentation/authorization_services/images/getting-started/hello-world/create-scope.png b/docs/documentation/authorization_services/images/getting-started/hello-world/create-scope.png
index 55147e663fcb..4897878f94d9 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/hello-world/create-scope.png and b/docs/documentation/authorization_services/images/getting-started/hello-world/create-scope.png differ
diff --git a/docs/documentation/authorization_services/images/getting-started/hello-world/create-user.png b/docs/documentation/authorization_services/images/getting-started/hello-world/create-user.png
index 097e65703bbc..ee1e67bbdcc3 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/hello-world/create-user.png and b/docs/documentation/authorization_services/images/getting-started/hello-world/create-user.png differ
diff --git a/docs/documentation/authorization_services/images/getting-started/hello-world/enable-authz.png b/docs/documentation/authorization_services/images/getting-started/hello-world/enable-authz.png
index d7a6e4d39820..e1cce37dfe2c 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/hello-world/enable-authz.png and b/docs/documentation/authorization_services/images/getting-started/hello-world/enable-authz.png differ
diff --git a/docs/documentation/authorization_services/images/getting-started/kc-start-page.png b/docs/documentation/authorization_services/images/getting-started/kc-start-page.png
index e20eb9bdb95d..c4e53d2ec030 100644
Binary files a/docs/documentation/authorization_services/images/getting-started/kc-start-page.png and b/docs/documentation/authorization_services/images/getting-started/kc-start-page.png differ
diff --git a/docs/documentation/authorization_services/images/permission/create-resource.png b/docs/documentation/authorization_services/images/permission/create-resource.png
index e4b1c1d36c4b..487bd61b7c39 100644
Binary files a/docs/documentation/authorization_services/images/permission/create-resource.png and b/docs/documentation/authorization_services/images/permission/create-resource.png differ
diff --git a/docs/documentation/authorization_services/images/permission/create-scope.png b/docs/documentation/authorization_services/images/permission/create-scope.png
index 6ba0c886a36d..1db4839e0140 100644
Binary files a/docs/documentation/authorization_services/images/permission/create-scope.png and b/docs/documentation/authorization_services/images/permission/create-scope.png differ
diff --git a/docs/documentation/authorization_services/images/permission/typed-resource-perm-example.png b/docs/documentation/authorization_services/images/permission/typed-resource-perm-example.png
index 678bc4474789..1e04d4bf1590 100644
Binary files a/docs/documentation/authorization_services/images/permission/typed-resource-perm-example.png and b/docs/documentation/authorization_services/images/permission/typed-resource-perm-example.png differ
diff --git a/docs/documentation/authorization_services/images/permission/view.png b/docs/documentation/authorization_services/images/permission/view.png
index fa4a185c738f..5bdda9026318 100644
Binary files a/docs/documentation/authorization_services/images/permission/view.png and b/docs/documentation/authorization_services/images/permission/view.png differ
diff --git a/docs/documentation/authorization_services/images/policy-evaluation-tool/policy-evaluation-tool.png b/docs/documentation/authorization_services/images/policy-evaluation-tool/policy-evaluation-tool.png
index 079b0cb6b74c..b69bba96c39a 100644
Binary files a/docs/documentation/authorization_services/images/policy-evaluation-tool/policy-evaluation-tool.png and b/docs/documentation/authorization_services/images/policy-evaluation-tool/policy-evaluation-tool.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-aggregated.png b/docs/documentation/authorization_services/images/policy/create-aggregated.png
index b7fe7d050f79..548b5cb65c2a 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-aggregated.png and b/docs/documentation/authorization_services/images/policy/create-aggregated.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-client-scope.png b/docs/documentation/authorization_services/images/policy/create-client-scope.png
index 2412a3e84529..2241699bedcb 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-client-scope.png and b/docs/documentation/authorization_services/images/policy/create-client-scope.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-client.png b/docs/documentation/authorization_services/images/policy/create-client.png
index f16e8c2ca995..27430f80b1e2 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-client.png and b/docs/documentation/authorization_services/images/policy/create-client.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-group-extend-children.png b/docs/documentation/authorization_services/images/policy/create-group-extend-children.png
index 36c1cee1101c..eedd6fee8cfa 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-group-extend-children.png and b/docs/documentation/authorization_services/images/policy/create-group-extend-children.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-group.png b/docs/documentation/authorization_services/images/policy/create-group.png
index 09691f3837ae..461800e428e1 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-group.png and b/docs/documentation/authorization_services/images/policy/create-group.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-regex.png b/docs/documentation/authorization_services/images/policy/create-regex.png
index e9bb82677029..569a0110d0f3 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-regex.png and b/docs/documentation/authorization_services/images/policy/create-regex.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-time.png b/docs/documentation/authorization_services/images/policy/create-time.png
index 3cc3a62794e7..ee8b41338014 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-time.png and b/docs/documentation/authorization_services/images/policy/create-time.png differ
diff --git a/docs/documentation/authorization_services/images/policy/create-user.png b/docs/documentation/authorization_services/images/policy/create-user.png
index 5ece77b8e374..755d8c35bea6 100644
Binary files a/docs/documentation/authorization_services/images/policy/create-user.png and b/docs/documentation/authorization_services/images/policy/create-user.png differ
diff --git a/docs/documentation/authorization_services/images/policy/view.png b/docs/documentation/authorization_services/images/policy/view.png
index 361ff3a25aa7..c39e64264596 100644
Binary files a/docs/documentation/authorization_services/images/policy/view.png and b/docs/documentation/authorization_services/images/policy/view.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/authz-export.png b/docs/documentation/authorization_services/images/resource-server/authz-export.png
index 2ebd4acab182..59876dfdd699 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/authz-export.png and b/docs/documentation/authorization_services/images/resource-server/authz-export.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/authz-settings.png b/docs/documentation/authorization_services/images/resource-server/authz-settings.png
index 23a299057da4..e038eb654f88 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/authz-settings.png and b/docs/documentation/authorization_services/images/resource-server/authz-settings.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/client-create.png b/docs/documentation/authorization_services/images/resource-server/client-create.png
index 4344ac163eda..4c7a315adf1d 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/client-create.png and b/docs/documentation/authorization_services/images/resource-server/client-create.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/client-enable-authz.png b/docs/documentation/authorization_services/images/resource-server/client-enable-authz.png
index 7024f36f490e..1dbc9a35ac87 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/client-enable-authz.png and b/docs/documentation/authorization_services/images/resource-server/client-enable-authz.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/client-list.png b/docs/documentation/authorization_services/images/resource-server/client-list.png
index d92fa79169d4..20613357f366 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/client-list.png and b/docs/documentation/authorization_services/images/resource-server/client-list.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/client-settings.png b/docs/documentation/authorization_services/images/resource-server/client-settings.png
index 9268a982e383..3fd6531b573c 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/client-settings.png and b/docs/documentation/authorization_services/images/resource-server/client-settings.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/default-permission.png b/docs/documentation/authorization_services/images/resource-server/default-permission.png
index f9632a742291..f3424d48cdf7 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/default-permission.png and b/docs/documentation/authorization_services/images/resource-server/default-permission.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/default-policy.png b/docs/documentation/authorization_services/images/resource-server/default-policy.png
index 40f4ed431e4a..ecec90194d71 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/default-policy.png and b/docs/documentation/authorization_services/images/resource-server/default-policy.png differ
diff --git a/docs/documentation/authorization_services/images/resource-server/default-resource.png b/docs/documentation/authorization_services/images/resource-server/default-resource.png
index e9a6a9779ffb..59b789231166 100644
Binary files a/docs/documentation/authorization_services/images/resource-server/default-resource.png and b/docs/documentation/authorization_services/images/resource-server/default-resource.png differ
diff --git a/docs/documentation/authorization_services/images/resource/create.png b/docs/documentation/authorization_services/images/resource/create.png
index 7280ed78f2e2..366da990d62c 100644
Binary files a/docs/documentation/authorization_services/images/resource/create.png and b/docs/documentation/authorization_services/images/resource/create.png differ
diff --git a/docs/documentation/authorization_services/images/resource/view.png b/docs/documentation/authorization_services/images/resource/view.png
index eeee62d9199f..02b8a5f43ff2 100644
Binary files a/docs/documentation/authorization_services/images/resource/view.png and b/docs/documentation/authorization_services/images/resource/view.png differ
diff --git a/docs/documentation/authorization_services/images/service/rs-uma-protection-role.png b/docs/documentation/authorization_services/images/service/rs-uma-protection-role.png
index ef460cd1c8ab..89ef67eccc43 100644
Binary files a/docs/documentation/authorization_services/images/service/rs-uma-protection-role.png and b/docs/documentation/authorization_services/images/service/rs-uma-protection-role.png differ
diff --git a/docs/documentation/authorization_services/topics/getting-started-overview.adoc b/docs/documentation/authorization_services/topics/getting-started-overview.adoc
index 55e04eba6daa..53b831335af4 100644
--- a/docs/documentation/authorization_services/topics/getting-started-overview.adoc
+++ b/docs/documentation/authorization_services/topics/getting-started-overview.adoc
@@ -4,7 +4,7 @@
 For certain applications, you can look at the following resources to quickly
 get started with {project_name} Authorization Services:
 
-* {quickstartRepo_link}/tree/latest/jakarta/servlet-authz-client[Securing a JakartaEE Application in Wildfly]
-* {quickstartRepo_link}/tree/latest/spring/rest-authz-resource-server[Securing a Spring Boot Application]
+* {quickstartRepo_link}/tree/main/jakarta/servlet-authz-client[Securing a JakartaEE Application in Wildfly]
+* {quickstartRepo_link}/tree/main/spring/rest-authz-resource-server[Securing a Spring Boot Application]
 * link:https://quarkus.io/guides/security-keycloak-authorization[Securing Quarkus Applications]
-* *Keycloak Node.js adapter* in the link:{securing_apps_link}[securing apps] section
+* link:https://www.keycloak.org/securing-apps/nodejs-adapter[Keycloak Node.js adapter]
diff --git a/docs/documentation/authorization_services/topics/policy-evaluation-api.adoc b/docs/documentation/authorization_services/topics/policy-evaluation-api.adoc
index 731907861005..cab4c47b99db 100644
--- a/docs/documentation/authorization_services/topics/policy-evaluation-api.adoc
+++ b/docs/documentation/authorization_services/topics/policy-evaluation-api.adoc
@@ -99,11 +99,11 @@ The `EvaluationContext` also gives you access to attributes related to both the
 | String. Format `MM/dd/yyyy hh:mm:ss`
 
 | kc.client.network.ip_address
-| IPv4 address of the client
+| IP address of the client, can be null if a valid IP is not provided.
 | String
 
 | kc.client.network.host
-| Client's host name
+| Client's host name, will be the IP address or whatever is provided by proxy headers
 | String
 
 | kc.client.id
diff --git a/docs/documentation/authorization_services/topics/resource-view.adoc b/docs/documentation/authorization_services/topics/resource-view.adoc
index 3cf8433c86cc..45eec52f9eaf 100644
--- a/docs/documentation/authorization_services/topics/resource-view.adoc
+++ b/docs/documentation/authorization_services/topics/resource-view.adoc
@@ -9,8 +9,8 @@ image:images/resource/view.png[alt="Resources"]
 The resource list provides information about the protected resources, such as:
 
 * Type
-* URIS
 * Owner
+* URIs
 * Associated scopes, if any
 * Associated permissions
 
diff --git a/docs/documentation/release_notes/index.adoc b/docs/documentation/release_notes/index.adoc
index 805b42a52018..7c5a58ebddf2 100644
--- a/docs/documentation/release_notes/index.adoc
+++ b/docs/documentation/release_notes/index.adoc
@@ -13,6 +13,21 @@ include::topics/templates/document-attributes.adoc[]
 :release_header_latest_link: {releasenotes_link_latest}
 include::topics/templates/release-header.adoc[]
 
+== {project_name_full} 26.4.0
+include::topics/26_4_0.adoc[leveloffset=2]
+
+== {project_name_full} 26.3.0
+include::topics/26_3_0.adoc[leveloffset=2]
+
+== {project_name_full} 26.2.0
+include::topics/26_2_0.adoc[leveloffset=2]
+
+== {project_name_full} 26.1.3
+include::topics/26_1_3.adoc[leveloffset=2]
+
+== {project_name_full} 26.1.1
+include::topics/26_1_1.adoc[leveloffset=2]
+
 == {project_name_full} 26.1.0
 include::topics/26_1_0.adoc[leveloffset=2]
 
diff --git a/docs/documentation/release_notes/topics/26_1_0.adoc b/docs/documentation/release_notes/topics/26_1_0.adoc
index cd8172c95f1d..80b00b3043e5 100644
--- a/docs/documentation/release_notes/topics/26_1_0.adoc
+++ b/docs/documentation/release_notes/topics/26_1_0.adoc
@@ -15,7 +15,7 @@ See the https://www.keycloak.org/server/caching[Configuring distributed caches]
 
 = Virtual Threads enabled for Infinispan and JGroups thread pools
 
-Starting from this release, {project_name} automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups  when running on OpenJDK 21.
+Starting from this release, {project_name} automatically enables the virtual thread pool support in both the embedded Infinispan and JGroups when running on OpenJDK 21 for environments with at least 2 CPU cores available.
 This removes the need to configure the JGroups thread pool, the need to align the JGroups thread pool with the HTTP worker thread pool, and reduces the overall memory footprint.
 
 = OpenTelemetry Tracing supported
diff --git a/docs/documentation/release_notes/topics/26_1_1.adoc b/docs/documentation/release_notes/topics/26_1_1.adoc
new file mode 100644
index 000000000000..1bf7ece2bc41
--- /dev/null
+++ b/docs/documentation/release_notes/topics/26_1_1.adoc
@@ -0,0 +1,11 @@
+= New option in X.509 authenticator to abort authentication if CRL is outdated
+
+The X.509 authenticator has a new option `x509-cert-auth-crl-abort-if-non-updated` (*CRL abort if non updated* in the Admin Console) to abort the login if a CRL is configured to validate the certificate and the CRL is not updated in the time specified in the next update field. The new option defaults to `true` in the Admin Console. For more details about the CRL next update field, see link:https://datatracker.ietf.org/doc/html/rfc5280#section-5.1.2.5[RFC5280, Section-5.1.2.5].
+
+The value `false` is maintained for compatibility with the previous behavior. Note that existing configurations will not have the new option and will act as if this option was set to `false`, but the Admin Console will add the default value `true` on edit.
+
+= New option in Send Reset Email to force a login after reset credentials
+
+The `reset-credential-email` (*Send Reset Email*) is the authenticator used in the *reset credentials* flow (*forgot password* feature) for sending the email to the user with the reset credentials token link. This authenticator now has a new option `force-login` (*Force login after reset*). When this option is set to `true`, the authenticator terminates the session and forces a new login.
+
+For more details about this new option, see link:{adminguide_link}#enabling-forgot-password[Enable forgot password].
\ No newline at end of file
diff --git a/docs/documentation/release_notes/topics/26_1_3.adoc b/docs/documentation/release_notes/topics/26_1_3.adoc
new file mode 100644
index 000000000000..c428b5bb8837
--- /dev/null
+++ b/docs/documentation/release_notes/topics/26_1_3.adoc
@@ -0,0 +1,5 @@
+= Send Reset Email force login again for federated users after reset credentials
+
+In <<keycloak-26-1-1, version 26.1.1>> a new configuration option was added to the `reset-credential-email` (*Send Reset Email*) authenticator to allow changing the default behavior after the reset credentials flow. Now the option `force-login` (*Force login after reset*) is adding a third configuration value `only-federated`, which means that the force login is true for federated users and false for the internal database users. The new behavior is now the default. This way all users managed by user federation providers, whose implementation can be not so tightly integrated with {project_name}, are forced to login again after the reset credentials flow to avoid any issue. This change in behavior is due to the secure by default policy.
+
+For more information, see link:{adminguide_link}#enabling-forgot-password[Enable forgot password].
\ No newline at end of file
diff --git a/docs/documentation/release_notes/topics/26_2_0.adoc b/docs/documentation/release_notes/topics/26_2_0.adoc
new file mode 100644
index 000000000000..1dd1f133e774
--- /dev/null
+++ b/docs/documentation/release_notes/topics/26_2_0.adoc
@@ -0,0 +1,173 @@
+= Supported Standard Token Exchange
+
+In this release, we added support for the Standard token exchange! The token exchange feature was in preview for a long time, so we are glad to finally support the standard token exchange.
+For now, this is limited to exchanging the Internal token to internal token compliant with the https://datatracker.ietf.org/doc/html/rfc8693[Token exchange specification]. It does not yet cover use
+cases related to identity brokering or subject impersonation. We hope to support even more token exchange use cases in subsequent releases.
+
+For more details, see the link:{securing_apps_token_exchange_link}#_standard-token-exchange[Standard token exchange].
+
+For information on how to upgrade from the legacy token exchange used in previous {project_name} versions, see the link:{upgradingguide_link}[{upgradingguide_name}].
+
+= Fine-grained admin permissions supported
+
+This release introduces support for a new version of fine-grained admin permissions. Version 2 (V2) provides enhanced flexibility and control over administrative access within realms.
+With this feature, administrators can define permissions for administering users, groups, clients, and roles without relying on broad administrative roles. V2 offers the same level of access control over realm resources as the previous version, with plans to extend its capabilities in future versions. Some key points follow:
+
+* *Centralized Admin Console Management* - New *Permissions* section was introduced to allow management from a single place without having to navigate to different places in the Admin Console.
+* *Improved manageability* - Administrators can more easily search and evaluate permissions when building a permission model for realm resources.
+* *Resource-Specific and Global Permissions* – Permissions can be defined for individual resources (such as specific users or groups),  or entire resource types (such as all users or all groups).
+* *Explicit Operation Scoping* – Permissions are now independent, removing hidden dependencies between operations. Administrators must assign each scope explicitly, making it easier to see what is granted without needing prior knowledge of implicit relationships.
+* *Per-Realm Enablement* – Fine-Grained Admin Permissions can be enabled on a per-realm basis, allowing greater control over adoption and configuration.
+
+For more details, see link:{adminguide_finegrained_link}[{adminguide_finegrained_name}].
+
+For more information about migration, see the link:{upgradingguide_link}[{upgradingguide_name}].
+
+= Guides for metrics and Grafana dashboards
+
+In addition to the list of useful metric names link:{observablitycategory_link}[the Observability guides category] now also contains a guide on how to display these metrics in Grafana.
+link:{grafanadashboards_link}[The guide] contains two dashboards.
+
+* Keycloak troubleshooting dashboard - showing metrics related to service level indicators and troubleshooting.
+* Keycloak capacity planning dashboard - showing metrics related to estimating the load handled by Keycloak.
+
+= Zero-configuration secure cluster communication
+
+For clustering multiple nodes, {project_name} uses distributed caches.
+Starting with this release for all TCP-based transport stacks, the communication between the nodes is encrypted with TLS and secured with automatically generated ephemeral keys and certificates.
+
+This strengthens a secure-by-default setup and minimizes the configuration steps of new setups.
+
+For more information, check the link:https://www.keycloak.org/server/caching#_securing_transport_stacks[Securing Transport Stacks] in the distributed caches guide.
+
+= Rolling updates for optimized and customized images
+
+When using an optimized or customized image, the {project_name} Operator can now perform a rolling update for a new image if the old and the new image contain the same version of {project_name}.
+This is helpful when you want to roll out, for example, an updated theme or provider without downtime.
+
+To use the functionality in the Operator, enable the `Auto` update strategy and the {project_name} Operator will on image change briefly start up the old and the new image to determine if a rolling update without downtime is possible.
+Read the section https://www.keycloak.org/operator/rolling-updates[Managing Rolling Updates] in the {project_name} Operator Advanced Configuration guide for more details on this functionality.
+
+The checks to determine if a rolling update is possible are also available on the {project_name} command line so you can use them in your deployment pipeline. Continue reading in the https://www.keycloak.org/server/update-compatibility[Update Compatibility Tool] guide for more information about the functionality available on the command line.
+
+= Metrics on user activities
+
+Event metrics provide admins an aggregated view of the different user activities in a Keycloak instance.
+For now, only metrics for user events are captured. For example, you can monitor the number of logins, login failures, or token refreshes performed.
+For more information, see Monitoring user activities with event metrics.
+
+While this was a preview feature in 26.1, this is now fully supported in 26.2.
+
+ifeval::[{project_community}==true]
+Many thanks to https://github.com/bohmber[Bernd Bohmann] for the contribution.
+endif::[]
+
+For more information, check the link:https://www.keycloak.org/observability/event-metrics[Monitoring user activities with event metrics] {section}.
+
+= Additional query parameters in Admin Events API
+
+The Admin Events API now supports filtering for events based on Epoc timestamps in addition to the previous
+`yyyy-MM-dd` format. This provides more fine-grained control of the window of events to retrieve.
+
+A `direction` query parameter was also added, allowing controlling the order of returned items as `asc` or
+`desc`. In the past the events where always returned in `desc` order (most recent events first).
+
+Finally, the returned event representations now also include the `id`, which provides a unique identifier for
+an event.
+
+= Logs support ECS format
+
+All available log handlers now support *ECS* (Elastic Common Schema) JSON format.
+It helps to improve {project_name}'s observability story and centralized logging.
+
+For more details, see the https://www.keycloak.org/server/logging[Logging guide].
+
+= New cache for CRLs loaded for the X.509 authenticator
+
+Now the Certificate Revocation Lists (CRL), that are used to validate certificates in the X.509 authenticator, are cached inside a new infinispan cache called `crl`. Caching improves the validation performance and decreases the memory consumption because just one CRL is maintained per source.
+
+Check the `crl-storage` section in the link:https://www.keycloak.org/server/all-provider-config[All provider configuration] {section} to know the options for the new cache provider.
+
+= Operator creates NetworkPolicies to restrict traffic
+
+The {project_name} Operator now creates by default a NetworkPolicy to restrict traffic to internal ports used for {project_name}'s distributed caches.
+
+This strengthens a secure-by-default setup and minimizes the configuration steps of new setups.
+
+You can restrict the access to the management and HTTP endpoints further using the Kubernetes NetworkPolicies rule syntax.
+
+Read more about this in the https://www.keycloak.org/operator/advanced-configuration[Operator Advanced configuration].
+
+= Option to reload trust and key material for the management interface
+
+The `https-management-certificates-reload-period` option can be set to define the reloading period of key store, trust store, and certificate files referenced by `https-management-*` options for the management interface.
+Use -1 to disable reloading. Defaults to `https-certificates-reload-period`, which defaults to 1h (one hour).
+
+For more information, check the link:https://www.keycloak.org/server/management-interface#_tls_support[Configuring the Management Interface] guide.
+
+= Dynamic Authentication Flow selection using Client Policies
+
+Introduced the ability to dynamically select authentication flows based on conditions such as requested scopes, ACR (Authentication Context Class Reference) and others.
+This can be achieved using link:{adminguide_link}#_client_policies[Client Policies] by combining the new `AuthenticationFlowSelectorExecutor` with conditions like the new `ACRCondition`. For more details, see the link:{adminguide_link}#_client-policy-auth-flow[{adminguide_name}].
+
+= JWT Client authentication aligned with the latest OIDC specification
+
+The latest version of the link:https://openid.net/specs/openid-connect-core-1_0-36.html#rfc.section.9[OpenID Connect Core Specification] tightened the rules for
+audience validation in JWT client assertions for the Client Authentication methods `private_key_jwt` and `client_secret_jwt` . {project_name} now enforces by default that there is single audience
+in the JWT token used for client authentication.
+
+For information on the changed audience validation in JWT Client authentication {project_name} versions, see the link:{upgradingguide_link}[{upgradingguide_name}].
+
+ifeval::[{project_community}==true]
+Many thanks to https://github.com/thomasdarimont[Thomas Darimont] for the contribution.
+endif::[]
+
+= Federated credentials are available now when fetching user credentials
+
+Until now, querying user credentials using the User API will not return credentials managed by user storage providers and, as a consequence,
+prevent fetching additional metadata associated with federated credentials like the last time a credential was updated.
+
+In this release, we are adding a new method `getCredentials(RealmModel, UserModel)` to the `org.keycloak.credential.CredentialInputUpdater` interface so that
+user storage providers can return the credentials they manage for a specific user in a realm. By doing this, user storage providers can indicate
+whether the credential is linked to it as well as provide additional metadata so that additional information can be shown when managing users through the administration console.
+
+For LDAP, it should be possible now to see the last time the password was updated based on the standard `pwdChangedTime` attribute or, if
+using Microsoft AD, based on the `pwdLastSet` attribute.
+
+In order to check if a credential is local - managed by {project_name} - or federated, you can check the `federationLink` property available from both
+`CredentialRepresentation` and `CredentialModel` types. If set, the `federationLink` property holds the UUID of the component model associated with a given
+user storage provider.
+
+= Token based authentication for SMTP (XOAUTH2)
+
+The Keycloak outgoing link:{adminguide_email_link}[SMTP mail configuration] now supports token authentication (XOAUTH2).
+Many service providers (Microsoft, Google) are moving towards SMTP OAuth authentication and end the support for basic authentication.
+The token is gathered using Client Credentials Grant.
+
+ifeval::[{project_community}==true]
+Many thanks to https://github.com/srose[Sebastian Rose] for the contribution.
+endif::[]
+
+= New client configuration for access token header type
+
+A new admin setting has been added: Clients -> Advanced -> Fine grain OpenID Connect configuration -> Use "at+jwt" as access token header type
+
+If enabled, access tokens will get header type `at+jwt` in compliance with https://datatracker.ietf.org/doc/html/rfc9068#section-2.1[rfc9068#section-2.1]. Otherwise, the access token header type will be `JWT`.
+
+This setting is turned off by default.
+
+ifeval::[{project_community}==true]
+Many thanks to https://github.com/laurids[Laurids Møller Jepsen] for the contribution.
+endif::[]
+
+ifeval::[{project_community}==true]
+= OpenID for Verifiable Credential Issuance documentation
+
+The OpenID for Verifiable Credential Issuance (OID4VCI) remains an experimental feature in {project_name}, but it received further improvements and especially the link:{adminguide_link}#_oid4vci[The documentation],
+with the steps how to try this feature.
+
+You will find significant development and discussions in the https://github.com/keycloak/kc-sig-fapi[Keycloak OAuth SIG]. Anyone from the Keycloak community is welcome to join and provide the feedback.
+
+Many thanks to all members of the OAuth SIG group for the participation in the development and discussions about this feature. Especially thanks to
+https://github.com/Awambeng[Awambeng Rodrick] and https://github.com/IngridPuppet[Ingrid Kamga].
+endif::[]
diff --git a/docs/documentation/release_notes/topics/26_3_0.adoc b/docs/documentation/release_notes/topics/26_3_0.adoc
new file mode 100644
index 000000000000..4a725e99e73e
--- /dev/null
+++ b/docs/documentation/release_notes/topics/26_3_0.adoc
@@ -0,0 +1,88 @@
+// Release notes should contain only headline-worthy new features,
+// assuming that people who migrate will read the upgrading guide anyway.
+
+This release delivers advancements to optimize your system and improve the experience of users, developers and administrators:
+
+* *Account recovery* with 2FA recovery codes, protecting users from lockout.
+* Simplified experiences for application developers with *streamlined WebAuthn/Passkey registration* and *simplified account linking* to identity providers via application initiated actions.
+* Broader connectivity with the ability to *broker with any OAuth 2.0 compliant authorization server*, and enhanced *trusted email verification* for OpenID Connect providers.
+* *Asynchronous logging* for higher throughput and lower latency, ensuring more efficient deployments.
+* For administrators, *experimental rolling updates for patch releases* mean minimized downtime and smoother upgrades.
+
+Read on to learn more about each new feature, and https://www.keycloak.org/docs/latest/upgrading/index.html[find additional details in the upgrading guide] if you are upgrading from a previous release of {project_name}.
+
+= Recovering your account if you lose your 2FA credentials
+
+When using for example a one-time-password (OTP) generators as a second factor for authenticating users (2FA), a user can get locked out of their account when they, for example, lose their phone that contains the OTP generator.
+To prepare for such a case, the recovery codes feature allows users to print a set of recovery codes as an additional second factor.
+If the recovery codes are then allowed as an alternative 2FA in the login flow, they can be used instead of the OTP generated passwords.
+
+With this release, the recovery codes feature is promoted from preview to a supported feature.
+For newly created realms, the browser flow now includes the Recovery Authentication Code Form as _Disabled_, and it can be switched to _Alternative_ by admins if they want to use this feature.
+
+For more information about this 2FA method, see the link:{adminguide_link}#_recovery-codes[Recovery Codes] chapter in the {adminguide_name}.
+
+= Performance improvements to import, export and migration
+
+The time it takes to run imports, exports or migrations involving a large number of realms has been improved. There is no longer a cumulative performance degradation for each additional realm processed.
+
+= Simplified registration for WebAuthn and Passkeys
+
+Both WebAuthn Register actions (`webauthn-register` and `webauthn-register-passwordless`) which are also used for Passkeys now support a parameter `skip_if_exists` when initiated by the application (AIA).
+
+This should make it more convenient to use the AIA in scenarios where a user has already set up WebAuthn or Passkeys.
+The parameter allows skipping the action if the user already has a credential of that type.
+
+For more information, see the link:{adminguide_link}#_webauthn_aia[Registering WebAuthn credentials using AIA] chapter in the {adminguide_name}.
+
+= Simplified linking of the user account to an identity provider
+
+Client-initiated linking a user account to the identity provider is now based on application-initiated action (AIA) implementation.
+This functionality aligns configuring this functionality and simplifies the error handling the calling of the client application,
+making it more useful for a broader audience.
+
+The custom protocol, which was previously used for client-initiated account linking, is now deprecated.
+
+= Brokering with OAuth v2 compliant authorization servers
+
+In previous releases {project_name} already supported federation with other OpenID Connect and SAML providers, as well as with several Social Providers like GitHub and Google which are based on OAuth 2.0.
+
+The new OAuth 2.0 broker now closes the gap to federate with any OAuth 2.0 provider.
+This then allows you to federate, for example, with Amazon or other providers.
+As this is a generic provider, you will need to specify the different claims and a user info endpoint in the provider's configuration.
+
+For more information, see the link:{adminguide_link}#_identity_broker_oauth[OAuth v2 identity providers] chapter in the {adminguide_name}.
+
+= Trusted email verification when brokering OpenID Connect Providers
+
+Until now, the OpenID Connect broker did not support the standard `email_verified` claim available from the ID Tokens issued by OpenID Connect Providers.
+
+Starting with this release, {project_name} supports this standard claim as defined by the https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims[OpenID Connect Core Specification] for federation.
+
+Whenever users are federated for the first time or re-authenticating and if the *Trust email* setting is enabled, *Sync Mode* is set to `FORCE` and the provider sends the `email_verified` claim, the user account will have their email marked according to the `email_verified` claim.
+If the provider does not send the claim, it defaults to the original behavior and sets the email as verified.
+
+= Asynchronous logging for higher throughput and lower latency
+
+All available log handlers now support asynchronous logging capabilities.
+Asynchronous logging helps deployments that require high throughput and low latency.
+
+For more details on this opt-in feature, see the https://www.keycloak.org/server/logging[Logging guide].
+
+= Rolling updates for patch releases for minimized downtime (preview)
+
+In the previous release, the Keycloak Operator was enhanced to support performing rolling updates of the Keycloak image if both images contain the same version.
+This is useful, for example, when switching to an optimized image, changing a theme or a provider source code.
+
+In this release, we extended this to perform rolling update when the new image contains a future patch release from the same `major.minor` release stream as a preview feature.
+This can reduce the service's downtime even further, as downtime is only needed when upgrading from a different minor or major version.
+
+Read more on how to enable this feature in https://www.keycloak.org/server/update-compatibility#rolling-updates-for-patch-releases[update compatibility command].
+
+= Passkeys integrated in the default username forms
+
+In this release {project_name} integrates *Passkeys* in the default authentications forms. A new switch *Enable Passkeys* is available in the configuration, *Authentication* → *Policies* → *Webauthn Passwordless Policy*, that seamlessly incorporates passkeys support to the realm. With just one click, {project_name} offers conditional and modal user interfaces in the default login forms to allow users to authenticate with a passkey.
+
+The *Passkeys* feature is still in preview. Follow the https://www.keycloak.org/server/features[Enabling and disabling features] {section} to enable it.
+
+For more information, see link:{adminguide_link}#passkeys_server_administration_guide[Passkeys section in the {adminguide_name}].
diff --git a/docs/documentation/release_notes/topics/26_4_0.adoc b/docs/documentation/release_notes/topics/26_4_0.adoc
new file mode 100644
index 000000000000..da03935762cf
--- /dev/null
+++ b/docs/documentation/release_notes/topics/26_4_0.adoc
@@ -0,0 +1,8 @@
+// Release notes should contain only headline-worthy new features,
+// assuming that people who migrate will read the upgrading guide anyway.
+
+Read on to learn more about each new feature, and https://www.keycloak.org/docs/latest/upgrading/index.html[find additional details in the upgrading guide] if you are upgrading from a previous release of {project_name}.
+
+= Option to force management interface to use HTTP.
+
+There's a new option `http-management-scheme` that may be set to `http` to force the management interface to use HTTP rather than inheriting the HTTPS settings of the main interface. 
diff --git a/docs/documentation/release_notes/topics/template.adoc b/docs/documentation/release_notes/topics/template.adoc
new file mode 100644
index 000000000000..d7b239ac2ddf
--- /dev/null
+++ b/docs/documentation/release_notes/topics/template.adoc
@@ -0,0 +1,4 @@
+// Release notes should contain only headline-worthy new features,
+// assuming that people who migrate will read the upgrading guide anyway.
+
+= <TODO>
diff --git a/docs/documentation/server_admin/images/Create-top-level-flow.png b/docs/documentation/server_admin/images/Create-top-level-flow.png
index c3bc2f0be9b3..6e605d09e68c 100644
Binary files a/docs/documentation/server_admin/images/Create-top-level-flow.png and b/docs/documentation/server_admin/images/Create-top-level-flow.png differ
diff --git a/docs/documentation/server_admin/images/New-flow.png b/docs/documentation/server_admin/images/New-flow.png
index 2b1ab2883595..2246fe0ad14d 100644
Binary files a/docs/documentation/server_admin/images/New-flow.png and b/docs/documentation/server_admin/images/New-flow.png differ
diff --git a/docs/documentation/server_admin/images/add-client-oidc.png b/docs/documentation/server_admin/images/add-client-oidc.png
index 8495d76e0af7..b6b77f142608 100644
Binary files a/docs/documentation/server_admin/images/add-client-oidc.png and b/docs/documentation/server_admin/images/add-client-oidc.png differ
diff --git a/docs/documentation/server_admin/images/add-client-saml.png b/docs/documentation/server_admin/images/add-client-saml.png
index 62d903cabd8c..1883c9b5a50d 100644
Binary files a/docs/documentation/server_admin/images/add-client-saml.png and b/docs/documentation/server_admin/images/add-client-saml.png differ
diff --git a/docs/documentation/server_admin/images/add-identity-provider.png b/docs/documentation/server_admin/images/add-identity-provider.png
index 1c9a72b103e7..793dcc86f4d1 100644
Binary files a/docs/documentation/server_admin/images/add-identity-provider.png and b/docs/documentation/server_admin/images/add-identity-provider.png differ
diff --git a/docs/documentation/server_admin/images/add-mapper.png b/docs/documentation/server_admin/images/add-mapper.png
index ac02689ec8ac..6c31a0c4908a 100644
Binary files a/docs/documentation/server_admin/images/add-mapper.png and b/docs/documentation/server_admin/images/add-mapper.png differ
diff --git a/docs/documentation/server_admin/images/add-realm-menu.png b/docs/documentation/server_admin/images/add-realm-menu.png
deleted file mode 100644
index cf8a82cd7354..000000000000
Binary files a/docs/documentation/server_admin/images/add-realm-menu.png and /dev/null differ
diff --git a/docs/documentation/server_admin/images/admin-console.png b/docs/documentation/server_admin/images/admin-console.png
index 69e7a1d47be4..267f7db107a1 100644
Binary files a/docs/documentation/server_admin/images/admin-console.png and b/docs/documentation/server_admin/images/admin-console.png differ
diff --git a/docs/documentation/server_admin/images/audience_mapper.png b/docs/documentation/server_admin/images/audience_mapper.png
index ee4b8cf67e5b..7625d7d7614a 100644
Binary files a/docs/documentation/server_admin/images/audience_mapper.png and b/docs/documentation/server_admin/images/audience_mapper.png differ
diff --git a/docs/documentation/server_admin/images/audience_resolving_evaluate.png b/docs/documentation/server_admin/images/audience_resolving_evaluate.png
new file mode 100644
index 000000000000..4be5084ccee9
Binary files /dev/null and b/docs/documentation/server_admin/images/audience_resolving_evaluate.png differ
diff --git a/docs/documentation/server_admin/images/browser-flow.png b/docs/documentation/server_admin/images/browser-flow.png
index 8ca5bf786b69..53454e4660df 100644
Binary files a/docs/documentation/server_admin/images/browser-flow.png and b/docs/documentation/server_admin/images/browser-flow.png differ
diff --git a/docs/documentation/server_admin/images/brute-force-mixed.png b/docs/documentation/server_admin/images/brute-force-mixed.png
index 3099c5683055..a3c31d37789a 100644
Binary files a/docs/documentation/server_admin/images/brute-force-mixed.png and b/docs/documentation/server_admin/images/brute-force-mixed.png differ
diff --git a/docs/documentation/server_admin/images/brute-force-permanently.png b/docs/documentation/server_admin/images/brute-force-permanently.png
index 6108f736bc25..f77a1018626a 100644
Binary files a/docs/documentation/server_admin/images/brute-force-permanently.png and b/docs/documentation/server_admin/images/brute-force-permanently.png differ
diff --git a/docs/documentation/server_admin/images/brute-force-temporarily.png b/docs/documentation/server_admin/images/brute-force-temporarily.png
index 19f588183f3c..291c1b5bcc16 100644
Binary files a/docs/documentation/server_admin/images/brute-force-temporarily.png and b/docs/documentation/server_admin/images/brute-force-temporarily.png differ
diff --git a/docs/documentation/server_admin/images/brute-force.png b/docs/documentation/server_admin/images/brute-force.png
index 74abfa3cbdcf..c9e2dcd4c7c1 100644
Binary files a/docs/documentation/server_admin/images/brute-force.png and b/docs/documentation/server_admin/images/brute-force.png differ
diff --git a/docs/documentation/server_admin/images/client-credentials-jwt.png b/docs/documentation/server_admin/images/client-credentials-jwt.png
index da328b5fe71b..fc9148614c68 100644
Binary files a/docs/documentation/server_admin/images/client-credentials-jwt.png and b/docs/documentation/server_admin/images/client-credentials-jwt.png differ
diff --git a/docs/documentation/server_admin/images/client-credentials.png b/docs/documentation/server_admin/images/client-credentials.png
index 07fbf857238a..abbeea2450bb 100644
Binary files a/docs/documentation/server_admin/images/client-credentials.png and b/docs/documentation/server_admin/images/client-credentials.png differ
diff --git a/docs/documentation/server_admin/images/client-oidc-keys.png b/docs/documentation/server_admin/images/client-oidc-keys.png
index 4f0cd91b713a..bf9b4c7ad824 100644
Binary files a/docs/documentation/server_admin/images/client-oidc-keys.png and b/docs/documentation/server_admin/images/client-oidc-keys.png differ
diff --git a/docs/documentation/server_admin/images/client-scope.png b/docs/documentation/server_admin/images/client-scope.png
index 74983834b0e4..d71c323d0a6e 100644
Binary files a/docs/documentation/server_admin/images/client-scope.png and b/docs/documentation/server_admin/images/client-scope.png differ
diff --git a/docs/documentation/server_admin/images/client-scopes-evaluate.png b/docs/documentation/server_admin/images/client-scopes-evaluate.png
index 24495a3de315..eacbbc490620 100644
Binary files a/docs/documentation/server_admin/images/client-scopes-evaluate.png and b/docs/documentation/server_admin/images/client-scopes-evaluate.png differ
diff --git a/docs/documentation/server_admin/images/client-scopes-list.png b/docs/documentation/server_admin/images/client-scopes-list.png
index 58cd44011632..026d58d3a2e8 100644
Binary files a/docs/documentation/server_admin/images/client-scopes-list.png and b/docs/documentation/server_admin/images/client-scopes-list.png differ
diff --git a/docs/documentation/server_admin/images/client-scopes-phone.png b/docs/documentation/server_admin/images/client-scopes-phone.png
index 4a315c36ed5c..107e1fc9b3f6 100644
Binary files a/docs/documentation/server_admin/images/client-scopes-phone.png and b/docs/documentation/server_admin/images/client-scopes-phone.png differ
diff --git a/docs/documentation/server_admin/images/client-sessions.png b/docs/documentation/server_admin/images/client-sessions.png
index 5fbfc298f024..f156627c0ebd 100644
Binary files a/docs/documentation/server_admin/images/client-sessions.png and b/docs/documentation/server_admin/images/client-sessions.png differ
diff --git a/docs/documentation/server_admin/images/client-settings-oidc.png b/docs/documentation/server_admin/images/client-settings-oidc.png
index 3319850eb422..ae624a81d683 100644
Binary files a/docs/documentation/server_admin/images/client-settings-oidc.png and b/docs/documentation/server_admin/images/client-settings-oidc.png differ
diff --git a/docs/documentation/server_admin/images/client-settings-saml.png b/docs/documentation/server_admin/images/client-settings-saml.png
index 7309e740c5d0..e010073014e2 100644
Binary files a/docs/documentation/server_admin/images/client-settings-saml.png and b/docs/documentation/server_admin/images/client-settings-saml.png differ
diff --git a/docs/documentation/server_admin/images/create-oidc-client-profile.png b/docs/documentation/server_admin/images/create-oidc-client-profile.png
index f84d3e4ca624..f1443d9beba9 100644
Binary files a/docs/documentation/server_admin/images/create-oidc-client-profile.png and b/docs/documentation/server_admin/images/create-oidc-client-profile.png differ
diff --git a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-condition.png b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-condition.png
index d894fef87406..74f8c7a5209d 100644
Binary files a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-condition.png and b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-condition.png differ
diff --git a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-executor.png b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-executor.png
index d99d1292a8ac..fb2d5524f732 100644
Binary files a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-executor.png and b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-executor.png differ
diff --git a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-policy.png b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-policy.png
index 8673a818779c..f1817b9e8139 100644
Binary files a/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-policy.png and b/docs/documentation/server_admin/images/create-oidc-client-secret-rotation-policy.png differ
diff --git a/docs/documentation/server_admin/images/create-permission.png b/docs/documentation/server_admin/images/create-permission.png
new file mode 100644
index 000000000000..db6ca708fc8f
Binary files /dev/null and b/docs/documentation/server_admin/images/create-permission.png differ
diff --git a/docs/documentation/server_admin/images/default-groups.png b/docs/documentation/server_admin/images/default-groups.png
index 7f7baca6975e..a4530b5b2e56 100644
Binary files a/docs/documentation/server_admin/images/default-groups.png and b/docs/documentation/server_admin/images/default-groups.png differ
diff --git a/docs/documentation/server_admin/images/default-roles.png b/docs/documentation/server_admin/images/default-roles.png
index 7aea18c8d6c7..716fb1e19f6f 100644
Binary files a/docs/documentation/server_admin/images/default-roles.png and b/docs/documentation/server_admin/images/default-roles.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client-assign-user-policy.png b/docs/documentation/server_admin/images/fine-grain-client-assign-user-policy.png
index b8e367c21d97..57f445f0161c 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client-assign-user-policy.png and b/docs/documentation/server_admin/images/fine-grain-client-assign-user-policy.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client-manage-permissions.png b/docs/documentation/server_admin/images/fine-grain-client-manage-permissions.png
index 96238bed439c..6fd94a6b750d 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client-manage-permissions.png and b/docs/documentation/server_admin/images/fine-grain-client-manage-permissions.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-off.png b/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-off.png
index 0caa7040e9c3..3e0174b16b0e 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-off.png and b/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-off.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-on.png b/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-on.png
index 33e12727209f..22c77a988542 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-on.png and b/docs/documentation/server_admin/images/fine-grain-client-permissions-tab-on.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client-user-policy.png b/docs/documentation/server_admin/images/fine-grain-client-user-policy.png
index 3861ea359d1b..cd2e55782362 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client-user-policy.png and b/docs/documentation/server_admin/images/fine-grain-client-user-policy.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-client.png b/docs/documentation/server_admin/images/fine-grain-client.png
index fa9fbbc1ef4c..f6f7b5ecd320 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-client.png and b/docs/documentation/server_admin/images/fine-grain-client.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-enable.png b/docs/documentation/server_admin/images/fine-grain-enable.png
new file mode 100644
index 000000000000..4e0b705d059d
Binary files /dev/null and b/docs/documentation/server_admin/images/fine-grain-enable.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-evaluation.png b/docs/documentation/server_admin/images/fine-grain-evaluation.png
new file mode 100644
index 000000000000..959efa30f861
Binary files /dev/null and b/docs/documentation/server_admin/images/fine-grain-evaluation.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-map-roles-permission.png b/docs/documentation/server_admin/images/fine-grain-map-roles-permission.png
index ea1ca3b84831..75b28802fe41 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-map-roles-permission.png and b/docs/documentation/server_admin/images/fine-grain-map-roles-permission.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-permissions-tab.png b/docs/documentation/server_admin/images/fine-grain-permissions-tab.png
new file mode 100644
index 000000000000..1cce9b58ddfd
Binary files /dev/null and b/docs/documentation/server_admin/images/fine-grain-permissions-tab.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-sales-admin-login.png b/docs/documentation/server_admin/images/fine-grain-sales-admin-login.png
index 0468d7275496..b521f38d4bdb 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-sales-admin-login.png and b/docs/documentation/server_admin/images/fine-grain-sales-admin-login.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-sales-application-roles.png b/docs/documentation/server_admin/images/fine-grain-sales-application-roles.png
index bf7c132bbef9..43cc8fffda3b 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-sales-application-roles.png and b/docs/documentation/server_admin/images/fine-grain-sales-application-roles.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-search.png b/docs/documentation/server_admin/images/fine-grain-search.png
new file mode 100644
index 000000000000..807365c36e88
Binary files /dev/null and b/docs/documentation/server_admin/images/fine-grain-search.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-users-permissions.png b/docs/documentation/server_admin/images/fine-grain-users-permissions.png
index 3a2e1f2e2d50..7aa5dc5ee298 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-users-permissions.png and b/docs/documentation/server_admin/images/fine-grain-users-permissions.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-view-leads-permissions.png b/docs/documentation/server_admin/images/fine-grain-view-leads-permissions.png
index 3364f6514116..93c4f4a9e6be 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-view-leads-permissions.png and b/docs/documentation/server_admin/images/fine-grain-view-leads-permissions.png differ
diff --git a/docs/documentation/server_admin/images/fine-grain-view-leads-role-tab.png b/docs/documentation/server_admin/images/fine-grain-view-leads-role-tab.png
index fa0628ac33ee..b0b0890d2c6c 100644
Binary files a/docs/documentation/server_admin/images/fine-grain-view-leads-role-tab.png and b/docs/documentation/server_admin/images/fine-grain-view-leads-role-tab.png differ
diff --git a/docs/documentation/server_admin/images/full-client-scope.png b/docs/documentation/server_admin/images/full-client-scope.png
index 067058ca9599..d2584c747f78 100644
Binary files a/docs/documentation/server_admin/images/full-client-scope.png and b/docs/documentation/server_admin/images/full-client-scope.png differ
diff --git a/docs/documentation/server_admin/images/group-membership.png b/docs/documentation/server_admin/images/group-membership.png
index 663f82ec5e31..f0131089c8ea 100644
Binary files a/docs/documentation/server_admin/images/group-membership.png and b/docs/documentation/server_admin/images/group-membership.png differ
diff --git a/docs/documentation/server_admin/images/group.png b/docs/documentation/server_admin/images/group.png
index 73b394aa085b..09dd49b08252 100644
Binary files a/docs/documentation/server_admin/images/group.png and b/docs/documentation/server_admin/images/group.png differ
diff --git a/docs/documentation/server_admin/images/groups.png b/docs/documentation/server_admin/images/groups.png
index 966882a685bd..49659c5a76a3 100644
Binary files a/docs/documentation/server_admin/images/groups.png and b/docs/documentation/server_admin/images/groups.png differ
diff --git a/docs/documentation/server_admin/images/identity-provider-mapper.png b/docs/documentation/server_admin/images/identity-provider-mapper.png
index 413d9f7ab994..ab0b39a62936 100644
Binary files a/docs/documentation/server_admin/images/identity-provider-mapper.png and b/docs/documentation/server_admin/images/identity-provider-mapper.png differ
diff --git a/docs/documentation/server_admin/images/identity-provider-mappers.png b/docs/documentation/server_admin/images/identity-provider-mappers.png
index 9d2614d341a1..8236ee35e979 100644
Binary files a/docs/documentation/server_admin/images/identity-provider-mappers.png and b/docs/documentation/server_admin/images/identity-provider-mappers.png differ
diff --git a/docs/documentation/server_admin/images/identity-providers.png b/docs/documentation/server_admin/images/identity-providers.png
index af7d28ef1427..372dcc194111 100644
Binary files a/docs/documentation/server_admin/images/identity-providers.png and b/docs/documentation/server_admin/images/identity-providers.png differ
diff --git a/docs/documentation/server_admin/images/import-client-saml.png b/docs/documentation/server_admin/images/import-client-saml.png
index 49f80ebb9198..86984ec0c230 100644
Binary files a/docs/documentation/server_admin/images/import-client-saml.png and b/docs/documentation/server_admin/images/import-client-saml.png differ
diff --git a/docs/documentation/server_admin/images/initial-welcome-page.png b/docs/documentation/server_admin/images/initial-welcome-page.png
index 4674c5224305..5338f5a7c9c7 100644
Binary files a/docs/documentation/server_admin/images/initial-welcome-page.png and b/docs/documentation/server_admin/images/initial-welcome-page.png differ
diff --git a/docs/documentation/server_admin/images/kerberos-provider.png b/docs/documentation/server_admin/images/kerberos-provider.png
index b352d86f3536..48d588835b4d 100644
Binary files a/docs/documentation/server_admin/images/kerberos-provider.png and b/docs/documentation/server_admin/images/kerberos-provider.png differ
diff --git a/docs/documentation/server_admin/images/login-page.png b/docs/documentation/server_admin/images/login-page.png
index 8f28b18bddd9..1b65ac873df1 100644
Binary files a/docs/documentation/server_admin/images/login-page.png and b/docs/documentation/server_admin/images/login-page.png differ
diff --git a/docs/documentation/server_admin/images/login-tab.png b/docs/documentation/server_admin/images/login-tab.png
index 823643763b02..66ca105e0b3e 100644
Binary files a/docs/documentation/server_admin/images/login-tab.png and b/docs/documentation/server_admin/images/login-tab.png differ
diff --git a/docs/documentation/server_admin/images/mapper-config.png b/docs/documentation/server_admin/images/mapper-config.png
index 5710a10bf49e..4721663ae72e 100644
Binary files a/docs/documentation/server_admin/images/mapper-config.png and b/docs/documentation/server_admin/images/mapper-config.png differ
diff --git a/docs/documentation/server_admin/images/mapper-oidc-client-roles.png b/docs/documentation/server_admin/images/mapper-oidc-client-roles.png
new file mode 100644
index 000000000000..18039bb13a59
Binary files /dev/null and b/docs/documentation/server_admin/images/mapper-oidc-client-roles.png differ
diff --git a/docs/documentation/server_admin/images/mapper-oidc-realm-roles.png b/docs/documentation/server_admin/images/mapper-oidc-realm-roles.png
new file mode 100644
index 000000000000..41e16d521195
Binary files /dev/null and b/docs/documentation/server_admin/images/mapper-oidc-realm-roles.png differ
diff --git a/docs/documentation/server_admin/images/mappers-oidc.png b/docs/documentation/server_admin/images/mappers-oidc.png
index 7f6b9e954841..2118257952ee 100644
Binary files a/docs/documentation/server_admin/images/mappers-oidc.png and b/docs/documentation/server_admin/images/mappers-oidc.png differ
diff --git a/docs/documentation/server_admin/images/oidc-add-identity-provider.png b/docs/documentation/server_admin/images/oidc-add-identity-provider.png
index 27553eaf99dd..7a5719848418 100644
Binary files a/docs/documentation/server_admin/images/oidc-add-identity-provider.png and b/docs/documentation/server_admin/images/oidc-add-identity-provider.png differ
diff --git a/docs/documentation/server_admin/images/oidc-client-secret-rotation-policy.png b/docs/documentation/server_admin/images/oidc-client-secret-rotation-policy.png
index a056c6f75499..1daa54b45682 100644
Binary files a/docs/documentation/server_admin/images/oidc-client-secret-rotation-policy.png and b/docs/documentation/server_admin/images/oidc-client-secret-rotation-policy.png differ
diff --git a/docs/documentation/server_admin/images/organizations-add-org-attrs-in-claim.png b/docs/documentation/server_admin/images/organizations-add-org-attrs-in-claim.png
index c1184f9d5aa1..17bd74e222f3 100644
Binary files a/docs/documentation/server_admin/images/organizations-add-org-attrs-in-claim.png and b/docs/documentation/server_admin/images/organizations-add-org-attrs-in-claim.png differ
diff --git a/docs/documentation/server_admin/images/organizations-browser-flow.png b/docs/documentation/server_admin/images/organizations-browser-flow.png
index 7a9a1625d4a2..afcdba2ebaab 100644
Binary files a/docs/documentation/server_admin/images/organizations-browser-flow.png and b/docs/documentation/server_admin/images/organizations-browser-flow.png differ
diff --git a/docs/documentation/server_admin/images/organizations-create-org.png b/docs/documentation/server_admin/images/organizations-create-org.png
index e5909eabe272..fe5c72034ef0 100644
Binary files a/docs/documentation/server_admin/images/organizations-create-org.png and b/docs/documentation/server_admin/images/organizations-create-org.png differ
diff --git a/docs/documentation/server_admin/images/organizations-edit-identity-provider.png b/docs/documentation/server_admin/images/organizations-edit-identity-provider.png
index 569c770444be..ac7016d335b0 100644
Binary files a/docs/documentation/server_admin/images/organizations-edit-identity-provider.png and b/docs/documentation/server_admin/images/organizations-edit-identity-provider.png differ
diff --git a/docs/documentation/server_admin/images/organizations-enabling-orgs.png b/docs/documentation/server_admin/images/organizations-enabling-orgs.png
index cb7caf53efc8..589ea57fd46f 100644
Binary files a/docs/documentation/server_admin/images/organizations-enabling-orgs.png and b/docs/documentation/server_admin/images/organizations-enabling-orgs.png differ
diff --git a/docs/documentation/server_admin/images/organizations-first-broker-flow.png b/docs/documentation/server_admin/images/organizations-first-broker-flow.png
index ec383087ec5c..3a0a53e4a1c1 100644
Binary files a/docs/documentation/server_admin/images/organizations-first-broker-flow.png and b/docs/documentation/server_admin/images/organizations-first-broker-flow.png differ
diff --git a/docs/documentation/server_admin/images/organizations-identity-providers.png b/docs/documentation/server_admin/images/organizations-identity-providers.png
index 63094944e40c..a1c16f4776b5 100644
Binary files a/docs/documentation/server_admin/images/organizations-identity-providers.png and b/docs/documentation/server_admin/images/organizations-identity-providers.png differ
diff --git a/docs/documentation/server_admin/images/organizations-manage-attributes.png b/docs/documentation/server_admin/images/organizations-manage-attributes.png
index e19e41a88ef8..25f28f5e0fa1 100644
Binary files a/docs/documentation/server_admin/images/organizations-manage-attributes.png and b/docs/documentation/server_admin/images/organizations-manage-attributes.png differ
diff --git a/docs/documentation/server_admin/images/organizations-manage-members.png b/docs/documentation/server_admin/images/organizations-manage-members.png
index 6cd20b21995c..b1088b14aa19 100644
Binary files a/docs/documentation/server_admin/images/organizations-manage-members.png and b/docs/documentation/server_admin/images/organizations-manage-members.png differ
diff --git a/docs/documentation/server_admin/images/organizations-management-screen.png b/docs/documentation/server_admin/images/organizations-management-screen.png
index 6aaf81c45337..fe4fff2c851f 100644
Binary files a/docs/documentation/server_admin/images/organizations-management-screen.png and b/docs/documentation/server_admin/images/organizations-management-screen.png differ
diff --git a/docs/documentation/server_admin/images/otp-policy.png b/docs/documentation/server_admin/images/otp-policy.png
index b61b8a71f842..c285962542b3 100644
Binary files a/docs/documentation/server_admin/images/otp-policy.png and b/docs/documentation/server_admin/images/otp-policy.png differ
diff --git a/docs/documentation/server_admin/images/passkey-conditional-ui-authentication.png b/docs/documentation/server_admin/images/passkey-conditional-ui-authentication.png
deleted file mode 100644
index 41046a819568..000000000000
Binary files a/docs/documentation/server_admin/images/passkey-conditional-ui-authentication.png and /dev/null differ
diff --git a/docs/documentation/server_admin/images/passkey-conditional-ui-autofill.png b/docs/documentation/server_admin/images/passkey-conditional-ui-autofill.png
index 5d488c32bc84..9657ef2c591b 100644
Binary files a/docs/documentation/server_admin/images/passkey-conditional-ui-autofill.png and b/docs/documentation/server_admin/images/passkey-conditional-ui-autofill.png differ
diff --git a/docs/documentation/server_admin/images/passkey-modal-ui.png b/docs/documentation/server_admin/images/passkey-modal-ui.png
new file mode 100644
index 000000000000..0ea058cf73ae
Binary files /dev/null and b/docs/documentation/server_admin/images/passkey-modal-ui.png differ
diff --git a/docs/documentation/server_admin/images/password-policy.png b/docs/documentation/server_admin/images/password-policy.png
index 8936f4f03747..c8e783266717 100644
Binary files a/docs/documentation/server_admin/images/password-policy.png and b/docs/documentation/server_admin/images/password-policy.png differ
diff --git a/docs/documentation/server_admin/images/realm-settings.png b/docs/documentation/server_admin/images/realm-settings.png
new file mode 100644
index 000000000000..9fb87faf43ba
Binary files /dev/null and b/docs/documentation/server_admin/images/realm-settings.png differ
diff --git a/docs/documentation/server_admin/images/recovery-codes-account-console-warn.png b/docs/documentation/server_admin/images/recovery-codes-account-console-warn.png
new file mode 100644
index 000000000000..31fc185b7263
Binary files /dev/null and b/docs/documentation/server_admin/images/recovery-codes-account-console-warn.png differ
diff --git a/docs/documentation/server_admin/images/recovery-codes-browser-flow.png b/docs/documentation/server_admin/images/recovery-codes-browser-flow.png
new file mode 100644
index 000000000000..75261b8bf630
Binary files /dev/null and b/docs/documentation/server_admin/images/recovery-codes-browser-flow.png differ
diff --git a/docs/documentation/server_admin/images/recovery-codes-setup.png b/docs/documentation/server_admin/images/recovery-codes-setup.png
new file mode 100644
index 000000000000..07b1a308938d
Binary files /dev/null and b/docs/documentation/server_admin/images/recovery-codes-setup.png differ
diff --git a/docs/documentation/server_admin/images/reset-credential-email-config.png b/docs/documentation/server_admin/images/reset-credential-email-config.png
new file mode 100644
index 000000000000..be0e6e48a3c5
Binary files /dev/null and b/docs/documentation/server_admin/images/reset-credential-email-config.png differ
diff --git a/docs/documentation/server_admin/images/role.png b/docs/documentation/server_admin/images/role.png
deleted file mode 100644
index fdd4108c92bd..000000000000
Binary files a/docs/documentation/server_admin/images/role.png and /dev/null differ
diff --git a/docs/documentation/server_admin/images/roles.png b/docs/documentation/server_admin/images/roles.png
index 487c09eb3d0c..830d63c28767 100644
Binary files a/docs/documentation/server_admin/images/roles.png and b/docs/documentation/server_admin/images/roles.png differ
diff --git a/docs/documentation/server_admin/images/saml-add-identity-provider.png b/docs/documentation/server_admin/images/saml-add-identity-provider.png
index 895c9a4dcad3..512575c734bc 100644
Binary files a/docs/documentation/server_admin/images/saml-add-identity-provider.png and b/docs/documentation/server_admin/images/saml-add-identity-provider.png differ
diff --git a/docs/documentation/server_admin/images/security-headers.png b/docs/documentation/server_admin/images/security-headers.png
index d5d1abcc2047..278644259d3f 100644
Binary files a/docs/documentation/server_admin/images/security-headers.png and b/docs/documentation/server_admin/images/security-headers.png differ
diff --git a/docs/documentation/server_admin/images/select-policy-type.png b/docs/documentation/server_admin/images/select-policy-type.png
new file mode 100644
index 000000000000..9b43e0478024
Binary files /dev/null and b/docs/documentation/server_admin/images/select-policy-type.png differ
diff --git a/docs/documentation/server_admin/images/select-resource-type.png b/docs/documentation/server_admin/images/select-resource-type.png
new file mode 100644
index 000000000000..14ca9554afcd
Binary files /dev/null and b/docs/documentation/server_admin/images/select-resource-type.png differ
diff --git a/docs/documentation/server_admin/images/sessions.png b/docs/documentation/server_admin/images/sessions.png
index dc1242aa8ba7..1b1b628f5b0d 100644
Binary files a/docs/documentation/server_admin/images/sessions.png and b/docs/documentation/server_admin/images/sessions.png differ
diff --git a/docs/documentation/server_admin/images/user-fed-ldap.png b/docs/documentation/server_admin/images/user-fed-ldap.png
new file mode 100644
index 000000000000..8b36356b9669
Binary files /dev/null and b/docs/documentation/server_admin/images/user-fed-ldap.png differ
diff --git a/docs/documentation/server_admin/images/user-federation.png b/docs/documentation/server_admin/images/user-federation.png
index 48a0a3ed3086..ed36fd5ecd10 100644
Binary files a/docs/documentation/server_admin/images/user-federation.png and b/docs/documentation/server_admin/images/user-federation.png differ
diff --git a/docs/documentation/server_admin/images/user-sessions.png b/docs/documentation/server_admin/images/user-sessions.png
index 51b3b4477e17..b3a3ffcf4172 100644
Binary files a/docs/documentation/server_admin/images/user-sessions.png and b/docs/documentation/server_admin/images/user-sessions.png differ
diff --git a/docs/documentation/server_admin/images/webauthn-browser-flow-conditional-with-OTP.png b/docs/documentation/server_admin/images/webauthn-browser-flow-conditional-with-OTP.png
index f246f1e62ead..1b220d0803d9 100644
Binary files a/docs/documentation/server_admin/images/webauthn-browser-flow-conditional-with-OTP.png and b/docs/documentation/server_admin/images/webauthn-browser-flow-conditional-with-OTP.png differ
diff --git a/docs/documentation/server_admin/images/webauthn-browser-flow-conditional.png b/docs/documentation/server_admin/images/webauthn-browser-flow-conditional.png
index 55907bf6ca12..143809136a02 100644
Binary files a/docs/documentation/server_admin/images/webauthn-browser-flow-conditional.png and b/docs/documentation/server_admin/images/webauthn-browser-flow-conditional.png differ
diff --git a/docs/documentation/server_admin/images/webauthn-browser-flow-required.png b/docs/documentation/server_admin/images/webauthn-browser-flow-required.png
index 9ae672a81643..9019b5c15e5f 100644
Binary files a/docs/documentation/server_admin/images/webauthn-browser-flow-required.png and b/docs/documentation/server_admin/images/webauthn-browser-flow-required.png differ
diff --git a/docs/documentation/server_admin/images/x509-browser-flow.png b/docs/documentation/server_admin/images/x509-browser-flow.png
index c6eaa1c033f9..0e026a37b796 100644
Binary files a/docs/documentation/server_admin/images/x509-browser-flow.png and b/docs/documentation/server_admin/images/x509-browser-flow.png differ
diff --git a/docs/documentation/server_admin/images/x509-client-auth.png b/docs/documentation/server_admin/images/x509-client-auth.png
index 61896fc70096..db509da01323 100644
Binary files a/docs/documentation/server_admin/images/x509-client-auth.png and b/docs/documentation/server_admin/images/x509-client-auth.png differ
diff --git a/docs/documentation/server_admin/topics.adoc b/docs/documentation/server_admin/topics.adoc
index 6909103e7544..2cbd1ccc961d 100644
--- a/docs/documentation/server_admin/topics.adoc
+++ b/docs/documentation/server_admin/topics.adoc
@@ -45,6 +45,7 @@ include::topics/identity-broker/social/paypal.adoc[]
 include::topics/identity-broker/social/stack-overflow.adoc[]
 include::topics/identity-broker/social/twitter.adoc[]
 include::topics/identity-broker/oidc.adoc[]
+include::topics/identity-broker/oauth2.adoc[]
 include::topics/identity-broker/saml.adoc[]
 include::topics/identity-broker/suggested.adoc[]
 include::topics/identity-broker/mappers.adoc[]
@@ -57,11 +58,15 @@ include::topics/sso-protocols.adoc[]
 include::topics/admin-console-permissions.adoc[]
 include::topics/admin-console-permissions/master-realm.adoc[]
 include::topics/admin-console-permissions/per-realm.adoc[]
+include::topics/admin-console-permissions/fine-grain-v2.adoc[]
 ifeval::[{project_community}==true]
 include::topics/admin-console-permissions/fine-grain.adoc[]
 endif::[]
 include::topics/assembly-managing-organizations.adoc[]
 include::topics/assembly-managing-clients.adoc[]
+ifeval::[{project_community}==true]
+include::topics/oid4vci/vc-issuer-configuration.adoc[]
+endif::[]
 include::topics/vault.adoc[]
 include::topics/events.adoc[]
 include::topics/threat.adoc[]
diff --git a/docs/documentation/server_admin/topics/admin-console-permissions.adoc b/docs/documentation/server_admin/topics/admin-console-permissions.adoc
index a9f191e062d4..d24a4f2f8d0a 100644
--- a/docs/documentation/server_admin/topics/admin-console-permissions.adoc
+++ b/docs/documentation/server_admin/topics/admin-console-permissions.adoc
@@ -1,6 +1,6 @@
 [[_admin_permissions]]
 
-== Controlling access to the Admin Console
+== Managing access to realm resources
 
 Each realm created on the {project_name} has a dedicated Admin Console from which that realm can be managed.
 The `master` realm is a special realm that allows admins to manage more than one realm on the system.
diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
new file mode 100644
index 000000000000..ae7ec36dac14
--- /dev/null
+++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
@@ -0,0 +1,471 @@
+[[_fine_grained_permissions]]
+
+=== Delegating realm administration using permissions
+
+You can delegate realm management to other administrators, the realm administrators, using the fine-grained admin permissions
+feature.
+Different from the Role-Based Access Control (RBAC) Mechanism provided through the
+<<_master_realm_access_control, Global and Realm specific roles>>, this feature provides a more fine-grained control over
+how realm resources can be accessed and managed based on a well-defined set of operations that can be performed on them.
+
+By relying on a Policy-Based Access Control, server administrators can define permissions to realm resources such as users,
+groups, and clients, using different policy types, or access control methods, so that a realm administrator is limited to
+access a subset of realm resources and their operations.
+
+The feature provides an alternative to the aforementioned RBAC mechanism, but it does
+not replace it. You are still able to grant administrative roles like `view-users` or `manage-clients` to delegate access
+to realm administrators but doing so will skip the mechanisms provided by this feature.
+
+Enforcing access to realm resources only applies when managing resources through the administration console or the Admin API.
+
+==== Understanding the Realm Resource Types
+
+In a realm, you can manage different types of resources such as users, groups, clients, client scopes, roles, and so on.
+As a realm administrator, you are constantly managing these resources when managing identities and how they authenticate
+and are authorized to access a realm and applications.
+
+This feature provides the necessary mechanisms to enforce access controls when managing realm resources, limited to:
+
+* Users
+* Groups
+* Clients
+* Roles
+
+You can manage permissions for all resources of a given resource type, such as all users in a realm, or
+for a specific realm resource, such as a specific user or set of users in the realm.
+
+==== Understanding the scopes of access
+
+Each realm resource supports a well-defined set of management operations, or scopes, that can be performed on them,
+such as `view`, `manage`, and resource-specific operations such as `view-members`, if you take groups as an example.
+
+When managing permissions, you are selecting a set of one or more scopes from a resource type to allow realm administrators
+to perform specific operations on a resource type. For instance, granting a `view` scope will give access to realm administrators
+to list, search, and view a realm resource. On the other hand, the `manage` scope will allow administrators to perform updates
+and deletes on them.
+
+The scopes are completely independent of each other. If you give access to `manage` a realm resource, that does not mean the
+`view` scope is granted automatically. No transitive dependency exists between scopes. Although this might impact the
+overall user experience when managing permissions because you need to select individual scopes,
+the benefit is that you can more easily identify the permissions that enforce access to a specific scope.
+
+Certain scopes from a resource type have a relationship (not a transitive dependency) to scopes in another resource type.
+This relationship is mainly true when you manage a resource type that represents a group of realm resources, such as realm groups
+and their members.
+
+===== Users Resource Type
+
+The *Users* realm resource type represents the users in a realm. You can manage permissions for users based on the following
+set of scopes:
+
+[cols="30%,50%,20%"]
+|===
+| *Scope*                   | *Description*                                                                                | *Also granted by*
+
+| *view*                    | Defines if a realm administrator can view users. This scope should be set whenever you want  | `view-members`
+                              to make users available from queries.
+| *manage*                  | Defines if a realm administrator can manage users.                                           | `manage-members`
+| *manage-group-membership* | Defines if a realm administrator can assign or unassign users to/from groups.                | None
+| *map-roles*               | Defines if a realm administrator can assign or unassign roles to/from users.                 | None
+| *impersonate*             | Defines if a realm administrator can impersonate other users.                                | `impersonate-members`
+|===
+
+The user resource type has a strong relationship with some of the permissions you can set to groups. Most of the time,
+users are members of groups and granting access to `view-members` or `manage-members` of a group should also allow
+a realm administrator to `view` and `manage` members of that group.
+
+[NOTE]
+====
+This feature does not support enforcing access to federated resource, however, this limitation is being considered
+for future improvement.
+====
+
+===== Groups Resource Type
+
+The *Groups* realm resource type represents the groups in a realm. You can manage permissions for groups based on the following
+set of management operations:
+
+[cols="30%,70%"]
+|===
+| *Operation*                | *Description*
+
+| *view*                    | Defines if a realm administrator can view groups. This scope should be set whenever you want
+                              to make groups available from queries.
+| *manage*                  | Defines if a realm administrator can manage groups.
+| *view-members*            | Defines if a realm administrator can view group members.
+                              This operation applies to any child group in the group hierarchy.
+                              This can be prevented by explicitly denying permission for specific subgroups.
+| *manage-members*          | Defines if a realm administrator can manage group members.
+                              This operation applies to any child group in the group hierarchy.
+                              This can be prevented by explicitly denying permission for specific subgroups.
+| *impersonate-members*     | Defines if a realm administrator can impersonate group members.
+                              This operation applies to any child group in the group hierarchy.
+                              This can be prevented by explicitly denying permission for specific subgroups.
+| *manage-membership*       | Defines if a realm administrator can add or remove members from groups.
+|===
+
+===== Clients Resource Type
+
+The *Clients* realm resource type represents the clients in a realm. You can manage permissions for clients based on the following
+set of management operations:
+
+[cols="30%,70%"]
+|===
+| *Operation*                | *Description*
+
+| *view*                    | Defines if a realm administrator can view clients. This scope should be set whenever you want
+                              to make clients available from queries.
+| *manage*                  | Defines if a realm administrator can manage clients.
+| *map-roles*               | Defines if a realm administrator can assign any role defined by a client to a user.
+| *map-roles-composite*     | Defines if a realm administrator can assign any role defined by a client as a composite to
+                              another role.
+| *map-roles-client-scope*  | Define if a realm administrator can assign any role defined by a client to a client scope.
+|===
+
+The *map-roles* operation does not grant the ability to manage users or assign roles arbitrarily. The administrator must also
+have user role mapping permissions on the user.
+
+===== Roles Resource Type
+
+The *Roles* realm resource type represents the roles in a realm. You can manage permissions for roles based on the following set of management operations:
+
+[cols="30%,70%"]
+|===
+| *Operation*               | *Description*
+
+| *map-role*               | Defines if a realm administrator can assign a role (or multiple roles) to a user.
+| *map-role-composite*     | Defines if a realm administrator can assign a role (or multiple roles) as a composite to another role.
+| *map-role-client-scope*  | Defines if a realm administrator can apply a role (or multiple roles) to a client scope.
+|===
+
+The *map-roles* operation does not grant the ability to manage users or assign roles arbitrarily. The administrator must also
+have user role mapping permissions on the user.
+
+If there is a client resource type permission for the *map-roles*, *map-roles-composite*, or *map-roles-client-scope* scopes,
+it will take precedence over any role resource type permission if the role is a client role.
+
+==== Enabling admin permissions to a realm
+
+To enable fine-grained admin permissions in a realm, follow these steps:
+
+* Log in to the Admin Console.
+* Click *Realm settings*.
+* Enable *Admin Permissions* and click *Save*.
+
+image:images/fine-grain-enable.png[Fine grain enable]
+
+Once enabled, a *Permissions* section appears in the left-side menu of the administration console.
+
+image:images/fine-grain-permissions-tab.png[Fine grain permissions tab]
+
+From this section, you can manage the permissions for realm resources.
+
+[[_managing-permissions]]
+==== Managing Permissions
+
+The *Permissions* tab provides an overview of all active permissions within a realm. From here, administrators can create,
+update, delete, or search for permissions. You can also pre-evaluate the permissions you have created to check
+if they are enforcing access to realm resources as expected.
+For more details, see link:#_managing-permissions[Evaluating Permissions].
+
+To create a permission, click on the `Create permission` button and select the resource type you want to protect.
+
+image:images/select-resource-type.png[Selecting a resource type to protect]
+
+Once you select the resource type, you can now define how access should be enforced for a set of one or more resources of the selected type:
+
+image:images/create-permission.png[Creating a permission]
+
+When managing a permission you can define the following settings:
+
+* *Name*: A unique name for the permission. The name should also not conflict with any policy name
+* *Description*: An optional description to better describe what the permission is about
+* *Authorization scopes*: A set of one or more scopes representing the operations you want to protect for the selected resource type.
+An administrator must have explicit permission assigned for each operation to perform the corresponding action. For example,
+assigning only *manage* without *view* will prevent the user from being visible.
+* *Enforce access to*: Defines if the permission should enforce access to all resources of the selected type or to specific resources in a realm.
+* *Policies*: Defines a set of one or more policies that should be evaluated to grant or deny access to the selected resource(s).
+
+After creating the permission, it will automatically take effect when enforcing access to (all) resources and scopes you selected.
+Keep that fact in mind when creating and updating permissions in production.
+
+===== Defining permissions for viewing realm resources
+
+This feature relies on a partial evaluation mechanism to partially evaluate the permissions that a realm administrator has
+when listing and viewing realm resources. This mechanism will pre-fetch all the permissions set for view-related scopes where the realm administrator
+is referenced either directly or indirectly.
+
+Permissions that grant access to `view` a realm resource of a certain type must use one of the following policies to
+make them available from queries:
+
+* `User`
+* `Group`
+* `Role`
+
+By using any of the policies above, {project_name} can pre-calculate the set of resources that a realm administration can view
+by looking for a direct (if using a user policy) or indirect (if using a role or group policy) reference to the realm administrator.
+Therefore, the partial evaluation mechanism involves decorating queries with access controls that will run at the database level. This capability is mainly important to
+properly allow paginating resources as well as avoid an additional overhead on the server-side when evaluating permissions for each
+realm resource returned by queries.
+
+Partial evaluation and filtering occurs only if the feature is enabled to a realm, and if the user is not granted
+with view-related administrative roles like `view-users` or `view-clients`. For instance, it will not happen for regular server administrators granted
+with the `admin` role.
+
+When querying resources, the partial evaluation mechanism works as follows:
+
+* Resolve all the permissions for a certain resource type that reference the realm administrator
+* Pre-evaluate each permission to check if the realm administrator does or does not have access to the resources associated with the permission
+* Decorate database queries based on the resources granted or denied
+
+As a result, the result set of a query will hold only the realm resources where realm administrators have access to any of the view-related scopes.
+
+===== Searching Permissions
+
+The Admin Console provides several ways to search for permissions, supporting the following capabilities:
+
+* Search for permissions that contain a specific string in their *Name*
+* Search for permissions of a specific resource type, such as *Users*
+* Search for permissions of a specific resource type that apply to a particular resource (such as *Users* resource type for user `myadmin`).
+* Search for permissions of a specific resource type with a given scope (such as *Users* resource type permissions with the *manage* scope).
+* Search for permissions of a specific resource type that apply to a particular resource and have a specific scope (such as *Users* resource
+type permissions with the *manage* scope for user `myadmin`).
+
+.Fine grained permissions search
+image:images/fine-grain-search.png[Fine grained permissions search]
+
+These capabilities allow server administrators to perform queries on their universe of permissions and identify which ones
+are enforcing access to a set of one or more realm resources and their scopes. Combined with the evaluation tool on the
+*Evaluation* tab, they provide a key management tool for managing permissions in a realm. See <<_evaluating-permissions, Evaluating Permissions>>
+for more details.
+
+==== Managing Policies
+
+The *Policies* tab allows administrators to define conditions using different access control methods to determine whether
+a permission should be granted to an administrator attempting to perform operations on a realm resource. When managing permissions,
+you must associate at least a single policy to grant or deny access to a realm resource.
+
+Policies are basically conditions that will evaluate to either a `GRANT` or a `DENY`. Their outcome will decide whether
+a permission should be granted or denied.
+
+A permission is only granted if all its associated policies evaluate to a `GRANT`. Otherwise, the permission is denied
+and a realm administrator will not be able to access the protected resource.
+
+{project_name} provides a set of built-in policies that you can choose from:
+
+image:images/select-policy-type.png[Selecting a policy type]
+
+Once you have a well-defined and stable permission model for your realm, less need exists to create policies. You can instead reuse existing policies to create more permissions.
+
+For more details about each policy type, see link:{authorizationguide_link}#_policy_overview[Managing policies].
+
+[[_evaluating-permissions]]
+==== Evaluating Permissions
+
+The *Evaluation* tab provides a testing environment where administrators can verify that permissions are enforcing access
+as expected. The administrator can see what permissions are involved when enforcing access to a particular resource and what the outcome is.
+
+You need to provide a set of fields in order to run an evaluation:
+
+* `User`, the realm administrator or the subject trying to access a resource
+* `Resource Type`, the resource type you want to evaluate
+* `Resource Selector`, depending on the selected `Resource Type` you will be prompted to select a specific realm resource like a user, group, or client.
+* `Authorization scope`, the scope or the operation you want to evaluate. If not provided, the evaluation will happen for all the scopes of the selected resource type.
+
+.Fine grained permissions evaluation tab
+image:images/fine-grain-evaluation.png[Fine grained permissions evaluation tab]
+
+By clicking the `Evaluate` button, the server will evaluate all the permissions associated with the selected resource and scopes
+just like if the selected `User` were trying to access the resource when using the administration console or the Admin API.
+
+For instance, in the example above you can see that the user `myadmin` can *manage* user `user-1` because a `Allow managing all realm users` permission
+voted to a `PERMIT`, therefore granting access to the `manage` scope. However, all the other scopes were denied.
+
+Combined with the searching capabilities from the *Permissions* tab, you can perform troubleshooting to identify any permission that
+is not behaving as expected.
+
+When evaluating permissions, the following rules apply:
+
+* The outcome from resource-specific permissions have precedence over broader permissions that give access to all resources of a certain type
+* If no permissions exist for a specific resource, access will be granted based on the permission that grants access to all resources of a certain type
+* The outcome from different permissions that enforce access to a specific resource will only grant access if they all permit access to the resource
+
+[[_resolving-conflicting-permissions]]
+===== Resolving conflicting permissions
+
+Permissions can have multiple policies associated with them. As the authorization model evolves, it is common for some policies within a permission or
+even different permissions related to a specific resource to conflict.
+
+The evaluation outcome will be "denied" whenever any permission is evaluated to "DENY." If there are multiple permissions related to the same resource,
+all of them must grant access in order for the outcome to be "granted."
+
+IMPORTANT: Fine-grained admin permissions allow you to set up permissions for individual resources or for the resource type itself (such as all users,
+all groups, and so on.). If a permission or permissions related to a specific resource exist, the "all-resource" permission is *NOT* taken into account
+during evaluation. If no specific permission exists, the fallback is to the "all-resource" permission. This approach helps address scenarios like
+allowing members of the `realm-admins` group to manage members of realm groups, but preventing them from managing members of the `realm-admins` group
+themselves.
+
+[[_realm_access_control]]
+==== Accessing a Realm administration console as a Realm Administrator
+
+Realm administrators can access a dedicated realm-specific administration console that allows them to manage resources within their assigned realm.
+This console is separate from the main {project_name} Admin Console, which is typically used by server administrators.
+
+For more details on dedicated realm administration consoles and available roles, refer to: <<_per_realm_admin_permissions, Dedicated admin consoles>>.
+
+To access the administration console, a realm administrator must have at least one of the following roles assigned, depending on the resources they
+need to administer:
+
+- *query-users* – Required to query realm users.
+- *query-groups* – Required to query realm groups.
+- *query-clients* – Required to query realm clients.
+
+By granting any of these roles to a realm user, they will be able to access the administration console, but only for the
+areas that correspond to roles granted. For instance, if you assign the `query-users` role, the realm administrator
+will only have access to the `Users` section in the administration console. If an administrator is responsible for
+multiple resource types (such as both users and groups), they must have all the corresponding "query-*" roles assigned.
+
+These roles enable basic access to query resources but do not grant permission to view or modify them. To grant or deny access
+to realm resources you need to set up the permissions for any of the operations available from each resource type.
+For more details, see link:#_managing-permissions[Managing Permissions].
+
+===== Roles and Permission relationship
+
+Fine grained permissions are used to grant additional permissions. You cannot override the default behavior of the built-in admin roles.
+If a realm administrator is assigned one or more admin roles, it prevents the permissions from being evaluated. This means that
+if a respective admin role is assigned to a realm administrator, permission evaluation will be bypassed, and access will be granted.
+
+[cols="30%,70%"]
+|===
+| *Admin Role*              | *Description*
+
+| *query-users*            | A realm administrator can see the *Users* section in administration console and can search for users in the realm.
+                             It does not grant the ability to *view* users.
+| *query-groups*           | A realm administrator can see the *Groups* section in administration console and can search for groups in the realm.
+                             It does not grant the ability to *view* groups.
+| *query-clients*          | A realm administrator can see the *Clients* section in administration console and can search for clients in the realm.
+                             It does not grant the ability to *view* clients.
+| *view-users*             | A realm administrator can *view* all users and groups in the realm.
+| *manage-users*           | A realm administrator can *view*, *map-roles*, *manage-group-membership* and *manage* all users in the realm,
+                             as well as *view*, *manage-membership* and *manage* groups in the realm.
+| *impersonation*          | A realm administrator can *impersonate* all users in the realm.
+| *view-clients*           | A realm administrator can *view* all clients in the realm.
+| *manage-clients*         | A realm administrator can *view* and *manage* all clients and client scopes in the realm.
+|===
+
+==== Understanding some common use cases
+
+Consider a situation where an administrator wants to allow a group of administrators to manage all users in the realm except those that
+belong to the administrators group. This example includes a `test` realm and a `test-admins` group.
+
+===== Allowing to manage users by group of administrators
+
+Create user permission permission, allowing to view and manage all users in the realm for members of the `test-admins` group:
+
+* Navigate to the *Permissions* tab in the administration console.
+* Click *Create permission* and choose *Users* resource type.
+* Fill in the name, such as `Disallow managing test-admins`.
+* Choose *view* and *manage* authorization scopes, keep checked *All Users*.
+* Create a condition, which needs to be met to get an access by clicking *Create new policy*.
+* Fill in the name `Allow test-admins`, select *Group* as *Policy type*.
+* Click *Add groups* button and select `test-admins` group, click *Save*.
+* Click *Save* on *Create permission* page.
+
+===== Allowing to manage users by group of admins but not group members
+
+Let's exlude the members of the group itself, so that `test-admins` cannot manage other admins.
+
+* Create new permission by clicking *Create permission*.
+* This time choose *Groups* resource type.
+* Fill in the name, such as `Disallow managing test-admins`.
+* Choose *manage-members* authorization scope.
+* Select *Specific Groups* and choose `test-admins` group.
+* *Create new policy* of type *Group*.
+* Fill the name `Disallow test-admins` and select `test-admins` group.
+* Switch to *Negative Logic* for the policy, *Save* the policy
+* *Save* the permission
+
+=====  Allowing to impersonate users for members of a group with a specific role assigned
+
+- Create a "User Permission" for specific users (or all users) you want to allow impersonation.
+- Create a "Group Policy" allowing access to members of `test-admins`.
+- Create a "Role Policy" allowing access to users assigned the `impersonation-admin` role.
+- Assign both policies to the permission.
+
+===== Blacklisting specific users from being impersonated
+
+- Create a *User Permission* for the specific users you want to prevent from being impersonated.
+- Create any policy that evaluates to deny (such as a user policy with no users selected).
+- Assign the policy to the permission to effectively block impersonation for the selected users.
+
+===== Allowing to view users but not managing them for admins with a defined role assigned
+
+- Create a "User Permission" with the *view* scope for all users.
+- Create a "Role Policy" allowing access to users with specific role assigned.
+- Do _not_ assign the `manage` scope to prevent modification of user details.
+
+===== Allowing to manage users and role assignment for members of a group
+
+- Create a "User Permission" with the *manage*, *map-roles* scopes for all users.
+- Create a "Group Policy" allowing access to members of `test-admins`.
+
+===== Allowing to view and manage members of a group but not members of its subgroups
+
+- Create a "Group Permission" with the *view-members* and *manage-members* scopes for specific group `mygroup`.
+- Assign a "Group Policy" targeting `test-admins` to it.
+- Create another "Group Permission" with the *view-members* and *manage-members* scopes for specific group, select all subgroups of the `mygroup`.
+- Create negative "Group Policy" for `test-admins` and assign it to the "subgroups" permission.
+
+===== Allowing to impersonate members of a specific group
+
+- Create a "Group Permission" with the *impersonate-members* for specific group `mygroup`.
+- Assign a "Group Policy" targeting `mygroup-helpdesk` to it.
+
+==== Performance considerations
+
+When enabling the feature to a realm, there is an additional overhead when realm administrators are managing any of the
+supported resource types. This is mainly true when performing these operations:
+
+* Listing and searching
+* Updating or deleting
+
+The feature introduces additional checks whenever you are listing or managing realm resources in order to enforce access
+based on the permissions you have defined. This is mainly true when querying realm resources due to the additional overhead
+to partially evaluate the permissions for a realm administrator to filter and paginate the results.
+
+Fewer permissions referencing a realm administrator user and most of the resources they can access is better. For instance,
+if you want to delegate access to a realm administrator to manage users, it is better to have those users as members of a group. By doing that,
+you are improving not only the performance when evaluating permissions but also creating a permission model that is easier to manage.
+
+The main impact of access enforcement is when querying realm resources. If a realm administrator is, for instance, referenced
+in thousands of permissions through a user, role, or group policy, the partial evaluation mechanism that happens when querying
+realm resources will query all those permissions from the database. A more concise and optimized model will help to fetch fewer
+permissions but the enough to grant or deny access to realm resources.
+
+For instance, granting access to a realm administrator to view and manage users in a realm is better done with a group permission
+than create individual permissions for each individual user in a realm. As well as make sure the policies associated with a
+permission referencing a realm administrator either by a direct reference (user policy),
+or indirect (role or group policy) reference, do not span multiple (thousands of) permissions, regardless of the resource type.
+
+As an example, suppose you have three users in a realm, and you want to allow `bob`, a realm administrator, to `view` and `manage` them.
+A non-optimal permission model would create three different permissions, for each user, where a user policy grants access to `bob`. Instead,
+you can have a single group permission, or even a single user permission, that groups those three users while still granting access to `bob`
+using the same user policy.
+
+The same is true if you want to give access to more realm administrators to those three users. Instead of creating individual policies,
+you can consider using a group or role policy instead. The permission model is use-case-specific, but these recommendations are important
+to provide not only better manageability but also improve the overall performance of the server when managing realm resources.
+
+In terms of server configuration, depending on the size of your realm and the number of permissions and policies you have, you might consider
+changing the cache configuration to increase the size of the following caches:
+
+* `realms`
+* `users`
+* `authorization`
+
+Consider looking at the server metrics for these caches to find the best value when sizing your deployment.
+
+When filtering resources, the partial evaluation mechanism will eventually rely on `IN` clauses in SQL statements
+to filter the results. Depending on your database, you might have limitations on the number of parameters for the `IN` clause.
+That is the case for old versions of the Oracle database, which has a hard limit to 1000 parameters. To avoid such problems,
+keep in mind the considerations above about the number of permissions that grants or deny access to a single realm administrator.
diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain.adoc
index d7910c362278..0d79a1e2cb91 100644
--- a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain.adoc
+++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain.adoc
@@ -1,10 +1,9 @@
-[[_fine_grain_permissions]]
 
-=== Fine grain admin permissions
+=== Fine grained admin permissions V1
 
-:tech_feature_name: Fine Grain Admin Permissions
-:tech_feature_id: admin-fine-grained-authz
-include::../templates/techpreview.adoc[]
+IMPORTANT: fine-grained admin permissions V1 have been replaced by a <<_fine_grained_permissions, new version>>. 
+Version 1 of the feature is still marked as preview and is available, but it may be deprecated and removed 
+in future. To enable it, start the server with `--features=admin-fine-grained-authz:v1`.
 
 Sometimes roles like `manage-realm` or `manage-users` are too coarse grain and you want to create
 restricted admin accounts that have more fine grain permissions.  {project_name} allows you to define
@@ -298,4 +297,3 @@ manage-membership::
     Policies that decide if an admin can change the membership of the group.  Add or
     remove members from the group.
 
-
diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/master-realm.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/master-realm.adoc
index 3c0b626a8850..4f2374df4f79 100644
--- a/docs/documentation/server_admin/topics/admin-console-permissions/master-realm.adoc
+++ b/docs/documentation/server_admin/topics/admin-console-permissions/master-realm.adoc
@@ -1,9 +1,10 @@
+[[_master_realm_access_control]]
 
 === Master realm access control
 
 The `master` realm in {project_name} is a special realm and treated differently than other realms.
 Users in the {project_name} `master` realm can be granted permission to manage zero or more realms that are deployed on the {project_name} server.
-When a realm is created, {project_name} automatically creates various roles that grant fine-grain permissions to access that new realm.
+When a realm is created, {project_name} automatically creates various roles that grant permissions to access that new realm.
 Access to The Admin Console and Admin REST endpoints can be controlled by mapping these roles to users in the `master` realm.
 It's possible to create multiple superusers,  as well as users that can only manage specific realms.
 
@@ -27,18 +28,24 @@ level of access to manage an individual realm.
 
 The roles available are: 
 
-* view-realm
-* view-users
-* view-clients
-* view-events
-* manage-realm
-* manage-users
 * create-client
+* impersonation
+* manage-authorization
 * manage-clients
-* manage-events            
-* view-identity-providers
+* manage-events
 * manage-identity-providers
-* impersonation
+* manage-realm
+* manage-users
+* query-clients
+* query-groups
+* query-realms
+* query-users
+* view-authorization
+* view-clients
+* view-events
+* view-identity-providers
+* view-realm
+* view-users
 
 Assign the roles you want to your users and they will only be able to use that specific part of the administration console.
 
diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/per-realm.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/per-realm.adoc
index 80a4f5d39998..78131ff55106 100644
--- a/docs/documentation/server_admin/topics/admin-console-permissions/per-realm.adoc
+++ b/docs/documentation/server_admin/topics/admin-console-permissions/per-realm.adoc
@@ -8,18 +8,25 @@ Users within that realm can be granted realm management permissions by assigning
 Each realm has a built-in client called `realm-management`.  You can view this client by going to the
 `Clients` left menu item of your realm.  This client defines client-level roles that specify permissions that can be granted to manage the realm.
 
-* view-realm
-* view-users
-* view-clients
-* view-events
-* manage-realm
-* manage-users
 * create-client
+* impersonation
+* manage-authorization
 * manage-clients
 * manage-events
-* view-identity-providers
 * manage-identity-providers
-* impersonation
+* manage-realm
+* manage-users
+* query-clients
+* query-groups
+* query-realms
+* query-users
+* realm-admin
+* view-authorization
+* view-clients
+* view-events
+* view-identity-providers
+* view-realm
+* view-users
 
 Assign the roles you want to your users and they will only be able to use that specific part of the administration console.
 
diff --git a/docs/documentation/server_admin/topics/authentication/conditions.adoc b/docs/documentation/server_admin/topics/authentication/conditions.adoc
index 14e8cb4de1aa..9090c8ae96fc 100644
--- a/docs/documentation/server_admin/topics/authentication/conditions.adoc
+++ b/docs/documentation/server_admin/topics/authentication/conditions.adoc
@@ -107,19 +107,22 @@ The last thing is defining the property with an error message in the login theme
 deny-role1 = You do not have required role!
 ----
 
+[#twofa-conditional-workflow-examples]
 ==== 2FA conditional workflow examples
 
 The section presents some examples of conditional workflows that integrates 2nd Factor Authentication (2FA) in different ways. The examples copy the default `browser` flow and modify the configuration inside the `forms` sub-flow.
 
 ===== Conditional 2FA sub-flow
 
-The default `browser` flow uses a `Conditional OTP` sub-flow that already gives a 2FA with OTP Form (One Time Password). Following the same idea, different 2FA methods can be integrated with the `Condition - User Configured`.
+The default `browser` flow uses a `Conditional 2FA` sub-flow that already gives 2nd factor Authentication (2FA) with OTP Form (One Time Password). It also provides WebAuthn and Recovery Codes but they are disabled by default. Consistent with this approach, different 2FA methods can be integrated with the `Condition - User Configured`.
 
 .2FA all alternative
 image:images/2fa-example1.png[2FA all alternative]
 
 The `forms` sub-flow contains another `2FA` conditional sub-flow with `Condition - user configured`. Three 2FA steps (OTP, Webauthn and Recovery Codes) are allowed as alternative steps. The user will be able to choose one of the three options, if they are configured for the user. As the sub-flow is conditional, the authentication process will complete successfully if no 2FA credential is configured.
 
+This configuration provides the same behavior as when you configure with the default *browser* flow with both _Disabled_ steps are configured to _Alternative_.
+
 ===== Conditional 2FA sub-flow and deny access
 
 The second example continues the previous one. After the `2FA` sub-flow, another flow `Deny access if no 2FA` is used to check if the previous `2FA` was not executed. In that case (the user has no 2FA credential configured) the access is denied.
diff --git a/docs/documentation/server_admin/topics/authentication/flows.adoc b/docs/documentation/server_admin/topics/authentication/flows.adoc
index 08479f08254c..7dcfe808020b 100644
--- a/docs/documentation/server_admin/topics/authentication/flows.adoc
+++ b/docs/documentation/server_admin/topics/authentication/flows.adoc
@@ -36,32 +36,30 @@ Since this sub-flow is marked as _alternative_, it will not be executed if the *
 
 The first execution is the *Username Password Form*, an authentication type that renders the username and password page. It is marked as _required_, so the user must enter a valid username and password.
 
-The second execution is the *Browser - Conditional OTP* sub-flow. This sub-flow is _conditional_ and executes depending on the result of the *Condition - User Configured* execution. If the result is true, {project_name} loads the executions for this sub-flow and processes them.
+The second execution is the *Browser - Conditional 2FA* sub-flow. This sub-flow is _conditional_ and executes depending on the result of the *Condition - User Configured* execution. If the result is true, {project_name} loads the executions for this sub-flow and processes them.
 
-The next execution is the *Condition - User Configured* authentication. This authentication checks if {project_name} has configured other executions in the flow for the user. The *Browser - Conditional OTP* sub-flow executes only when the user has a configured OTP credential.
+The next execution is the *Condition - User Configured* authentication. This authentication checks if {project_name} has configured other executions in the flow for the user. The *Browser - Conditional 2FA* sub-flow executes only when the user has a configured OTP credential.
 
-The final execution is the *OTP Form*. {project_name} marks this execution as _required_ but it runs only when the user has an OTP credential set up because of the setup in the _conditional_ sub-flow. If not, the user does not see an OTP form.
+The final execution is the *OTP Form*. {project_name} marks this execution as _alternative_, but it runs only when the user has an OTP credential set up because of the setup in the _conditional_ sub-flow. If the OTP credential is not set up, the user does not see an OTP form.
 
-===== Requirement
-A set of radio buttons that control the execution of an action executes.
+The default *browser* flow contains two more executions inside the *Browser - Conditional 2FA*, *WebAuthn Authenticator* and *Recovery Authentication Code Form*. These executions are _Disabled_ by default and they are the other 2FA methods that can be added to the flow. Change the requirement from _Disabled_ to _Alternative_ to make them available if the respective credential has been configured for the user. If the user has configured all alternative credential types, the credential with the highest priority is displayed by default. However, the *Try Another Way* option will appear so that the user has the alternative methods to log in.
 
 [[_execution-requirements]]
-====== Required
+===== Requirement
+A drop-down menu that controls the execution of an action.
 
+Required::
 All _Required_ elements in the flow must be successfully sequentially executed. The flow terminates if a required element fails.
 
-====== Alternative
-
+Alternative::
 Only a single element must successfully execute for the flow to evaluate as successful. Because the _Required_ flow elements are sufficient to mark a flow as successful, any _Alternative_ flow element within a flow containing _Required_ flow elements will not execute.
 
-====== Disabled
-
+Disabled::
 The element does not count to mark a flow as successful.
 
-====== Conditional
-
+Conditional::
 This requirement type is only set on sub-flows.
-
++
 * A _Conditional_ sub-flow contains executions. These executions must evaluate to logical statements.
 * If all executions evaluate as _true_, the _Conditional_ sub-flow acts as _Required_.
 * If any executions evaluate as _false_, the _Conditional_ sub-flow acts as _Disabled_.
@@ -235,6 +233,17 @@ Creating an advanced flow such as this can have side effects. For example, if yo
 * In the *Action* menu, select *Bind flow* and select *Reset credentials flow* from the dropdown and click *Save*
 ====
 
+[[_client-policy-auth-flow]]
+==== Using Client Policies to Select an Authentication Flow
+<<_client_policies, Client Policies>> can be used to dynamically select an Authentication Flow based on specific conditions, such as requesting a particular scope or an ACR (Authentication Context Class Reference) using the `AuthenticationFlowSelectorExecutor` in combination with the condition you prefer.
+
+The `AuthenticationFlowSelectorExecutor` allows you to select an appropriate authentication flow and set the level of authentication to be applied once the selected flow is completed.
+
+A possible configuration involves using the `ACRCondition` in combination with the `AuthenticationFlowSelectorExecutor`. This setup enables you to select an authentication flow based on the requested ACR and have the ACR value included in the token using <<_mapping-acr-to-loa-realm,ACR to LoA Mapping>>.
+
+For more details, see <<_client_policies, Client Policies>>.
+
+
 [[_step-up-flow]]
 ==== Creating a browser login flow with step-up mechanism
 
@@ -388,6 +397,13 @@ not be the desired behavior.
 
 NOTE: A conflict situation may arise when an admin specifies several flows, sets different LoA levels to each, and assigns the flows to different clients. However, the rule is always the same: if a user has a certain level, it needs only have that level to connect to a client. It's up to the admin to make sure that the LoA is coherent.
 
+NOTE: Step-up authentication with Level of Authentication conditions is intended for use cases where each level
+requires all authentication methods from the preceding levels.
+For instance, level X must always include all authentication methods required by level X-1.
+For use cases where a specific level, such as level 3, requires a different authentication method from the previous levels,
+it may be more appropriate to use mapping of ACR to a specific flow.
+For more details, see <<_client-policy-auth-flow, Using Client Policies to Select an Authentication Flow>>.
+
 *Example scenario*
 
 . Max Age is configured as 300 seconds for level 1 condition.
diff --git a/docs/documentation/server_admin/topics/authentication/passkeys.adoc b/docs/documentation/server_admin/topics/authentication/passkeys.adoc
index 0e668ba03f07..b4fd2d125814 100644
--- a/docs/documentation/server_admin/topics/authentication/passkeys.adoc
+++ b/docs/documentation/server_admin/topics/authentication/passkeys.adoc
@@ -4,8 +4,18 @@
 
 {project_name} provides preview support for https://fidoalliance.org/passkeys/[Passkeys]. {project_name} works as a Passkeys Relying Party (RP).
 
-Passkey registration and authentication are realized by the features of xref:webauthn_{context}[WebAuthn].
-Therefore, users of {project_name} can do Passkey registration and authentication by existing xref:webauthn_{context}[WebAuthn registration and authentication].
+Passkey registration and authentication are performed using the same features of xref:webauthn_{context}[WebAuthn]. More specifically *Passkeys* are related to xref:_webauthn_loginless[LoginLess WebAuthn] as they try to avoid any password during login.
+Therefore, users of {project_name} can do Passkey registration and authentication by existing xref:_enabling_organization_[WebAuthn registration and authentication], using the *passwordless* variants. The *Passkeys* feature have been integrated seamlessly in the default authentication forms, so, when activated, both conditional UI and modal UI are available in the forms in which the username input is displayed.
+
+*Passkeys* have been added to the following authenticator implementations:
+
+. *Username Password Form*: The username and password form used by default in {project_name}.
+. *Username Form*: The form in which the username is displayed alone and is typically followed by the password form. This authenticator is used when the username and password fields want to be presented to the user in two different steps. Authenticating using *Passkeys* in the *Username Form* skips the next *Password Form* execution. The *Password Form* implementation checks if the user was already authenticated using a passwordless WebAuthn credential and, if that is the case, no password is requested.
+. *Organization Identity - First Login*: The organization form that is used when the <<_enabling_organization_, organizations>> feature is enabled for the realm. Using *Passkeys* in this step avoids the subsequent execution of the username and password form in the same way than in the previous form.
+
+:tech_feature_name: Passkeys
+:tech_feature_id: passkeys
+include::../templates/techpreview.adoc[]
 
 [NOTE]
 ====
@@ -14,78 +24,37 @@ However, Passkeys operations success depends on the user's environment. Make sur
 ====
 
 [[_passkeys-conditional-ui]]
-==== Passkey Authentication with Conditional UI
+==== Passkey Authentication with Conditional UI or autofill
 
-Passkey Authentication with Conditional UI can authenticate a user with its passkey in the same way as in xref:_webauthn_loginless[LoginLess WebAuthn].
-This authentication shows a user a list of passkeys stored on a device where the user runs a browser.
-Therefore, the user can select one of the passkeys in the list to authenticate them. Compared with xref:_webauthn_loginless[LoginLess WebAuthn], the authentication improves the user's experience of authentication.
+The Conditional User Interface (UI) or autofill is a feature related to passkeys in which the username input (the field in which the username to login is typed) is tagged with a `webauthn` autofill detail token (for example using the attribute `autocomplete="username webauthn"`). When the user clicks in such an input field, the user agent (browser) can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to _try another way_. If the user selects one of the presented passkeys, {project_name} initiates the WebAuthn authentication with that key and avoids any password typing.
+
+Compared with xref:_webauthn_loginless[LoginLess WebAuthn], the authentication improves the user's experience of authentication.
+
+.Passkey Authentication with Conditional UI Autofill using Chrome browser
+image:images/passkey-conditional-ui-autofill.png[Passkey Authentication with Conditional UI Autofill using Chrome browser]
 
 [NOTE]
 ====
 This authentication uses the https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI/[WebAuthn Conditional UI].
 Therefore, this authentication success depends on the user's environment.
-If the environment does not support WebAuthn Conditional UI, this authentication falls back to xref:_webauthn_loginless[LoginLess WebAuthn].
+If the environment does not support WebAuthn Conditional UI, the user should use the direct modal UI or username and password login.
 ====
 
-:tech_feature_name: Passkey Authentication
-:tech_feature_setting: -Dkeycloak.profile.feature.passkeys=enabled
-:tech_feature_id: passkeys
-include::../templates/techpreview.adoc[]
+==== Passkeys Authentication with Modal UI
 
-.Procedure
-===== Setup
+Nevertheless, because conditional UI can sometimes not show all the credentials to the user, the modal UI can always be initiated using the button *Sign in with Passkey*. The Modal User Interface (UI) ensures all passkeys are usable, including the ones stored in hardware tokens or on other devices that cannot be enumerated without user interaction.
 
-Set up Passkey Authentication with Conditional UI as follows:
+.Passkey Authentication with Modal UI using Chrome browser
+image:images/passkey-modal-ui.png[Passkey Authentication with Modal UI using Chrome browser]
 
-. (if not already present) Register a new required action for WebAuthn passwordless support. Use the steps described in <<_webauthn-register, Enable WebAuthn Authenticator Registration>>. Register the `Webauthn Register Passwordless` action.
+==== Setup
 
-. Configure the `WebAuthn Passwordless Policy`. Perform the configuration in the Admin Console, `Authentication` section,  in the tab `Policies` ->  `WebAuthn Passwordless Policy`. Set *User Verification Requirement* to *required* and *Require discoverable credential* to *Yes* when you configure the policy for loginless scenario. Note that since there is no dedicated Loginless policy, it is impossible to mix authentication scenarios with user verification=no/discoverable credential=no and loginless scenarios (user verification=yes/discoverable credential=yes).
+Set up Passkey Authentication for the default forms as follows:
+
+. (If not already done) Check the required action for *WebAuthn Register Passwordless* is enabled. Use the steps described in <<_webauthn-register, Enable WebAuthn Authenticator Registration>>, but using *WebAuthn Register Passwordless* instead of *WebAuthn Register*.
+
+. Configure the *WebAuthn Passwordless Policy* in the same way that is explained in xref:_webauthn_loginless[LoginLess WebAuthn]. Perform the configuration in the Admin Console, `Authentication` section,  in the tab `Policies` →  `WebAuthn Passwordless Policy`. Set *User Verification Requirement* to *required* and *Require discoverable credential* to *Yes* when you configure the policy for passwordless scenario.
 +
 NOTE: Storage capacity is usually very limited on hardware passkeys meaning that you cannot store many discoverable credentials on your passkey. However, this limitation may be mitigated for instance if you use an Android phone backed by a Google account as a passkey device or an iPhone backed by Bitwarden.
-
-. Configure the authentication flow. Create a new authentication flow, add the *Passkeys Conditional UI Authenticator* execution and set the Requirement setting of the execution to *Required*.
 +
-The final configuration of the flow looks similar to this:
-image:images/passkey-conditional-ui-flow.png[Passkey Authentication with Conditional UI flow flow]
-
-. Bind the flow above as a *browser* authentication flow in the realm as described in the <<_webauthn-register, WebAuthn section above>>.
-
-The authentication flow above requires that user must already have passkey credential on his or her account to be able to log in. This requirement means that all users in the realm must have passkeys already set.
-That can be achieved for instance by enabling user registration as described below.
-
-===== Setup of the registration for passkeys conditional UI
-
-. Enable <<con-user-registration_{context}, registration>> for your realm
-
-. In the <<configuring-authentication_{context},authentication flows>> of the realm, select flow *registration* and switch the authenticator *Password validation* to *Disabled*.
-This means that newly registered users will not be required to create the passwords in this example setup. Users must always use passkeys instead of passwords.
-
-. Return to the *Required actions* sub-tab of the tab *Authentication* tab and find the `Webauthn Register Passwordless` action and mark it with *Set as default action*.
-This means that it would be added to all new users after their registration.
-
-The alternative to the registration flow setup is to add the required action `WebAuthn Register Passwordless` to a user who is already known to {project_name}. The user with the required action configured will have to authenticate (with a username/password for example) and will then be prompted to register a passkey to be used for loginless authentication.
-
-[NOTE]
-====
-We plan to improve the usability and allow integration of conditional passkeys with the existing authenticators and forms such as the default username / password form.
-====
-
-[NOTE]
-====
-From https://www.w3.org/TR/webauthn-3/[Web Authn Level 3], *Resident Key* was replaced with *Discoverable Credential*.
-====
-
-If a user's browser supports https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI/[WebAuthn Conditional UI], the following screen is shown.
-
-.Passkey Authentication with Conditional UI
-image:images/passkey-conditional-ui-authentication.png[Passkey Authentication with Conditional UI]
-
-When the user clicks the *Select your passkey* textbox, a list of passkeys stored on a device where the user runs a browse is shown as follows.
-
-.Passkey Authentication with Conditional UI Autofill
-image:images/passkey-conditional-ui-autofill.png[Passkey Authentication with Conditional UI Autofill]
-
-If a user's browser does not support https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI/[WebAuthn Conditional UI], the authentication falls back to the xref:_webauthn_loginless[LoginLess WebAuthn] as follows.
-
-.Passkey Authentication with Conditional UI falling back to LoginLess WebAuthn
-image:images/passkey-conditional-ui-fallback-authentication.png[Passkey Authentication with Conditional UI falling back to LoginLess WebAuthn]
+. In the same policy tab *WebAuthn Passwordless Policy* activate the *Enable Passkeys* option at the bottom. This switch is the one that really enables passkeys (both conditional and modal UI) in the default username forms.
\ No newline at end of file
diff --git a/docs/documentation/server_admin/topics/authentication/password-policies.adoc b/docs/documentation/server_admin/topics/authentication/password-policies.adoc
index 58088c10d98a..5e3589d0ae32 100644
--- a/docs/documentation/server_admin/topics/authentication/password-policies.adoc
+++ b/docs/documentation/server_admin/topics/authentication/password-policies.adoc
@@ -12,7 +12,7 @@ When {project_name} creates a realm, it does not associate password policies wit
 . Enter a value that applies to the policy chosen.
 . Click *Save*.
 +
-Password policy
+.Password policy
 image:images/password-policy.png[Password Policy]
 
 After saving the policy, {project_name} enforces the policy for new users.
@@ -51,7 +51,7 @@ Supported password hashing algorithms are shown in the following table.
 It is highly recommended to use Argon2 when possible as it has significantly less CPU requirements compared to PBKDF2, while
 at the same time being more secure.
 
-The default password hashing algorithm for the server can be configured with `--spi-password-hashing-provider-default=<algorithm>`.
+The default password hashing algorithm for the server can be configured with `--spi-password-hashing--provider-default=<algorithm>`.
 
 To prevent excessive memory and CPU usage, the parallel computation of hashes by Argon2 is by default limited to the number of cores available to the JVM.
 To configure the Argon2 hashing provider, use its provider options.
@@ -118,7 +118,7 @@ The password cannot be the same as the email address of the user.
 ===== Regular expression
 
 Password must match one or more defined Java regular expression patterns.
-See https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html[Java's regular expression documentation] for the syntax of those expressions.
+See https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/util/regex/Pattern.html[Java's regular expression documentation] for the syntax of those expressions.
 
 ===== Expire password
 
@@ -141,14 +141,14 @@ Password must not be in a blacklist file.
 * The value of the blacklist file must be the name of the blacklist file, for example, `100k_passwords.txt`.
 * Blacklist files resolve against `+${kc.home.dir}/data/password-blacklists/+` by default. Customize this path using:
 ** The `keycloak.password.blacklists.path` system property.
-** The `blacklistsPath` property of the `passwordBlacklist` policy SPI configuration. To configure the blacklist folder using the CLI, use `--spi-password-policy-password-blacklist-blacklists-path=/path/to/blacklistsFolder`.
+** The `blacklistsPath` property of the `passwordBlacklist` policy SPI configuration. To configure the blacklist folder using the CLI, use `--spi-password-policy--password-blacklist--blacklists-path=/path/to/blacklistsFolder`.
 
 .A note about False Positives
 
 The current implementation uses a BloomFilter for fast and memory efficient containment checks, such as whether a given password is contained in a blacklist, with the possibility for false positives.
 
 * By default a false positive probability of `0.01%` is used.
-* To change the false positive probability by CLI configuration, use `--spi-password-policy-password-blacklist-false-positive-probability=0.00001`.
+* To change the false positive probability by CLI configuration, use `--spi-password-policy--password-blacklist--false-positive-probability=0.00001`.
 
 [[maximum-authentication-age]]
 ===== Maximum Authentication Age
diff --git a/docs/documentation/server_admin/topics/authentication/recovery-codes.adoc b/docs/documentation/server_admin/topics/authentication/recovery-codes.adoc
index 870e1f6497fa..60a9cb50ea7c 100644
--- a/docs/documentation/server_admin/topics/authentication/recovery-codes.adoc
+++ b/docs/documentation/server_admin/topics/authentication/recovery-codes.adoc
@@ -1,9 +1,53 @@
 [[_recovery-codes]]
 
-=== Recovery Codes (RecoveryCodes)
+=== Recovery Codes
 
-You can configure Recovery codes for two-factor authentication by adding 'Recovery Authentication Code Form' as a two-factor authenticator to your authentication flow. For an example of configuring this authenticator, see xref:webauthn_{context}[WebAuthn].
+The Recovery Codes are a number of sequential one-time passwords (currently 12) auto-generated by {project_name}. The codes can be used as a 2nd Factor Authentication (2FA) by adding the `Recovery Authentication Code Form` authenticator to your authentication flow. When configured in the flow, {project_name} asks the user for the next generated code in order. When the current code is introduced by the user, it is removed and the next code will be required for the next login.
 
-:tech_feature_name: RecoveryCodes
-:tech_feature_id: recovery-codes
-include::../templates/techpreview.adoc[]
+Due to its nature, the Recovery Codes work normally as a backup for another 2FA methods. They can complement the `OTP Form` or the `WebAuthn Authenticator` to give a backing way to log inside {project_name}, for example, if the software or hardware device used for the previous 2FA methods is broken or unavailable.
+
+==== Check Recovery Codes required action is enabled
+
+Check the Recovery Codes action is enabled in {project_name}:
+
+. Click *Authentication* in the menu.
+. Click the *Required Actions* tab.
+. Ensure the *Recovery Authentication Codes* switch *Enabled* is set to *On*.
+
+Toggle the *Default Action* switch to *On* if you want all the new users to register their Recovery Codes credentials in the first login.
+
+==== Configure the Recovery Codes required action
+
+From the *Required Actions* tab of the admin console, you have the option to configure the *Recovery Authentication Codes* required action. So far, there is a configuration option
+*Warning Threshold* available. When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will
+recommend him to setup new set of recovery codes. The warning displayed to the user may look similar to this:
+
+.Recovery Codes Account console warning
+image:images/recovery-codes-account-console-warn.png[Recovery Codes Account console warning]
+
+==== Adding Recovery Codes to the browser flow
+
+The following procedure adds the `Recovery Authentication Code Form` as an alternative way of login in the default *Browser* flow.
+
+. Click *Authentication* in the realm menu.
+. Click the *Browser* flow.
+. Locate the execution *Recovery Authentication Code Form* inside the *Browser - Conditional 2FA* sub-flow.
+. Change the _requirement_ from _Disabled_ to _Alternative_ for that execution.
++
+.Recovery Codes Browser flow
+image:images/recovery-codes-browser-flow.png[Recovery Codes Browser flow]
++
+With this configuration, both 2FA authenticators (`OTP Form` and `Recovery Authentication Code Form`) are alternate ways to log into {project_name}. If the user has configured both credential types, the credential with the highest priority will be displayed by default, but the *Try Another Way* option will appear so that the user has the alternative methods to log in.
+
+You can see more examples of 2FA configurations in <<twofa-conditional-workflow-examples>>.
+
+==== Creating the Recovery Codes credential
+
+Once the Recovery Codes required action is enabled and the credential type is managed in the flow, users can request to create their own codes. The action is just another <<con-required-actions_server_administration_guide,required action>> that can be used in {project_name} (directly called by the user by using the Account Console or assigned by an administrator by using the Admin Console).
+
+The required action, when executed, generates the list of codes and presents it to the user. The action offers to print, download, or copy the list of codes to help the user to store them is a safe place. In order to complete the setup, the checkbox *I have saved these codes somewhere safe* should be previously checked.
+
+.Recovery Authentication Codes setup page
+image:images/recovery-codes-setup.png[Recovery Authentication Codes setup page]
+
+The Recovery Codes can be re-created at any moment.
diff --git a/docs/documentation/server_admin/topics/authentication/webauthn.adoc b/docs/documentation/server_admin/topics/authentication/webauthn.adoc
index 29ea9cb37a0f..e7d5ec8c92f3 100644
--- a/docs/documentation/server_admin/topics/authentication/webauthn.adoc
+++ b/docs/documentation/server_admin/topics/authentication/webauthn.adoc
@@ -19,71 +19,45 @@ WebAuthn's specification uses a `user.id` to map a public key credential to a sp
 The setup procedure of WebAuthn support for 2FA is the following:
 
 [[_webauthn-register]]
-===== Enable WebAuthn authenticator registration
+===== Check WebAuthn authenticator registration is enabled
 
 . Click *Authentication* in the menu.
 . Click the *Required Actions* tab.
-. Toggle the *Webauthn Register* switch to *ON*.
+. Check action *Webauthn Register* switch is set to *ON*.
 
 Toggle the *Default Action* switch to *ON* if you want all new users to be required to register their WebAuthn credentials.
 
 [[_webauthn-authenticator-setup]]
-==== Adding WebAuthn authentication to a browser flow
+==== Enable WebAuthn authentication in the default browser flow
 
 . Click *Authentication* in the menu.
 . Click the *Browser* flow.
-. Select *Duplicate* from the "Action list" to make a copy of the built-in *Browser* flow.
-. Enter "WebAuthn Browser" as the name of the copy.
-. Click *Duplicate*.
-. Click the name to go to the details
-. Click the trash can icon 🗑️ of the "WebAuthn Browser Browser - Conditional OTP" and click *Delete*.
-
-If you require WebAuthn for all users:
-
-. Click *+* menu of the *WebAuthn Browser Forms*.
-. Click *Add step*.
-. Click *WebAuthn Authenticator*.
-. Click *Add*.
-. Select *Required* for the *WebAuthn Authenticator* authentication type to set its requirement to required.
+. Locate the execution *WebAuthn Authenticator* inside the *Browser - Conditional 2FA* sub-flow.
+. Change the _requirement_ from _Disabled_ to _Alternative_ for that execution.
 +
-image:images/webauthn-browser-flow-required.png[Webauthn browser flow required]
-+
-. Click the *Action* menu at the top of the screen.
-. Select *Bind flow* from the drop-down list.
-. Select *Browser* from the drop-down list.
-. Click *Save*.
+.WebAuthn browser flow conditional with OTP
+image:images/webauthn-browser-flow-conditional-with-OTP.png[WebAuthn browser flow conditional with OTP]
 
-[NOTE]
-====
-If a user does not have WebAuthn credentials, the user must register WebAuthn credentials.
-====
+With this configuration, the users can choose between using WebAuthn and OTP for the second factor. As the sub-flow is _conditional_, they are only asked to present a 2FA credential (OTP or WebAuthn) if they have already registered one of the respective credential types. If a user has configured both credential types, the credential with the highest priority will be displayed by default. However, the *Try Another Way* option will appear so that the user has the alternative methods to log in.
 
-Users can log in with WebAuthn if they have a WebAuthn credential registered only. So instead of adding the *WebAuthn Authenticator* execution, you can:
+If you want to substitute OTP for WebAuthn and maintain it as conditional:
 
-.Procedure
-. Click *+* menu of the *WebAuthn Browser Forms* row.
-. Click *Add sub-flow*.
-. Enter "Conditional 2FA" for the _name_ field.
-. Select *Conditional* for the *Conditional 2FA* to set its requirement to conditional.
-. On the *Conditional 2FA* row, click the plus sign + and select *Add condition*.
-. Click *Add condition*.
-. Select *Condition - User Configured*.
-. Click *Add*.
-. Select *Required* for the *Condition - User Configured* to set its requirement to required.
-. Drag and drop *WebAuthn Authenticator* into the *Conditional 2FA* flow
-. Select *Alternative* for the *WebAuthn Authenticator* to set its requirement to alternative.
+. Change _requirement_ in *OTP Form* to _Disabled_.
+. Change _requirement_ in *WebAuthn Authenticator* to _Alternative_.
 +
+.Webauthn browser flow conditional
 image:images/webauthn-browser-flow-conditional.png[Webauthn browser flow conditional]
 
-The user can choose between using WebAuthn and OTP for the second factor:
+If you require WebAuthn for all users and enforce them to configure the credential if not configured:
 
-.Procedure
-. On the *Conditional 2FA* row, click the plus sign + and select *Add step*.
-. Select *OTP Form* from the list.
-. Click *Add*.
-. Select *Alternative* for the *OTP Form* to set its requirement to alternative.
+. Change _requirement_ in *Browser - Conditional 2FA* to _Required_.
+. Change _requirement_ in *OTP Form* to _Disabled_.
+. Change _requirement_ in *WebAuthn Authenticator* to _Required_.
 +
-image:images/webauthn-browser-flow-conditional-with-OTP.png[WebAuthn browser flow conditional with OTP]
+.Webauthn browser flow required
+image:images/webauthn-browser-flow-required.png[Webauthn browser flow required]
+
+You can see more examples of 2FA configurations in <<twofa-conditional-workflow-examples>>.
 
 ==== Authenticate with WebAuthn authenticator
 
@@ -191,6 +165,13 @@ If `WebAuthn Authenticator` is set up as required as shown in the first example,
 
 After successful registration, the user's browser asks the user to enter the text of their WebAuthn authenticator's label.
 
+[[_webauthn_aia]]
+==== Registering WebAuthn credentials using AIA
+
+WebAuthn credentials can also be registered for a user using <<con-aia_{context},Application Initiated Actions (AIA)>>. The actions *Webauthn Register* (`kc_action=webauthn-register`) and *Webauthn Register Passwordless* (`kc_action=webauthn-register-passwordless`) are available for the applications if enabled in the <<proc-setting-default-required-actions_{context}, Required actions tab>>.
+
+Both required actions allow a parameter *skip_if_exists* that allows to skip the AIA execution if the user already has a credential of that type. The `kc_action_status` will be *success* if skipped. For example, adding the option to the common WebAuthn register action is just using the following query parameter `kc_action=webauthn-register:skip_if_exists`.
+
 [[_webauthn_passwordless]]
 ==== Passwordless WebAuthn together with Two-Factor
 
@@ -239,9 +220,9 @@ An administrator typically requires that Passkeys registered by users for the We
 
 Set up WebAuthn Loginless support as follows:
 
-. (if not already present) Register a new required action for WebAuthn passwordless support. Use the steps described in <<_webauthn-register, Enable WebAuthn Authenticator Registration>>. Register the `Webauthn Register Passwordless` action.
+. (If not already done) Check the required action for *WebAuthn Register Passwordless* is enabled. Use the steps described in <<_webauthn-register, Enable WebAuthn Authenticator Registration>>, but using *WebAuthn Register Passwordless* instead of *WebAuthn Register*.
 
-. Configure the `WebAuthn Passwordless Policy`. Perform the configuration in the Admin Console, `Authentication` section,  in the tab `Policies` ->  `WebAuthn Passwordless Policy`. You have to set *User Verification Requirement* to *required* and *Require Discoverable Credential* to *Yes* when you configure the policy for loginless scenario. Note that since there isn't a dedicated Loginless policy it won't be possible to mix authentication scenarios with user verification=no/discoverable credential=no and loginless scenarios (user verification=yes/discoverable credential=yes). Storage capacity is usually very limited on Passkeys meaning that you won't be able to store many discoverable credentials on your Passkey.
+. Configure the `WebAuthn Passwordless Policy`. Perform the configuration in the Admin Console, `Authentication` section,  in the tab `Policies` ->  `WebAuthn Passwordless Policy`. You have to set *User Verification Requirement* to *required* and *Require Discoverable Credential* to *Yes* when you configure the policy for loginless scenario. Storage capacity is usually very limited on Passkeys meaning that you won't be able to store many discoverable credentials on your Passkey.
 
 . Configure the authentication flow. Create a new authentication flow, add the "WebAuthn Passwordless" execution and set the Requirement setting of the execution to *Required*
 
diff --git a/docs/documentation/server_admin/topics/authentication/x509.adoc b/docs/documentation/server_admin/topics/authentication/x509.adoc
index 7ff66fbd68d3..f2a4ae0da14b 100644
--- a/docs/documentation/server_admin/topics/authentication/x509.adoc
+++ b/docs/documentation/server_admin/topics/authentication/x509.adoc
@@ -134,6 +134,9 @@ Use CDP to check the certificate revocation status. Most PKI authorities include
 *CRL file path*::
 The path to a file containing a CRL list. The value must be a path to a valid file if the *CRL Checking Enabled* option is enabled.
 
+*CRL abort if non updated*::
+A CRL conforming to link:https://datatracker.ietf.org/doc/html/rfc5280#section-5.1.2.5[RFC5280] contains a next update field that indicates the date by which the next CRL will be issued. When that time is passed, the CRL is considered outdated and it should be refreshed. If this option is `true`, the authentication will fail if the CRL is outdated (recommended). If the option is set to `false`, the outdated CRL is still used to validate the user certificates.
+
 *OCSP Checking Enabled*::
 Checks the certificate revocation status by using Online Certificate Status Protocol.
 
diff --git a/docs/documentation/server_admin/topics/clients/assembly-client-oidc.adoc b/docs/documentation/server_admin/topics/clients/assembly-client-oidc.adoc
index 223ef48ac583..de58e9920853 100644
--- a/docs/documentation/server_admin/topics/clients/assembly-client-oidc.adoc
+++ b/docs/documentation/server_admin/topics/clients/assembly-client-oidc.adoc
@@ -16,5 +16,6 @@ include::oidc/proc-secret-rotation.adoc[leveloffset=+1]
 
 include::oidc/proc-using-a-service-account.adoc[leveloffset=+1]
 
+include::oidc/con-token-role-mappings.adoc[leveloffset=+1]
 include::oidc/con-audience.adoc[leveloffset=+1]
 
diff --git a/docs/documentation/server_admin/topics/clients/client-policies.adoc b/docs/documentation/server_admin/topics/clients/client-policies.adoc
index 1ae912e22c8e..f5274b854056 100644
--- a/docs/documentation/server_admin/topics/clients/client-policies.adoc
+++ b/docs/documentation/server_admin/topics/clients/client-policies.adoc
@@ -94,6 +94,13 @@ Client Attribute::
 Any Client::
     This condition always evaluates to true. It can be used for example to ensure that all clients in the particular realm are FAPI compliant.
 
+ACR Condition::
+    Applied when an ACR value requested in the authentication request matches the value configured in the condition. For example, it can be used to select an authentication flow based on the requested ACR value. For more details, see the <<_client-policy-auth-flow, related documentation>> and the https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics[official OIDC specification].
+
+Grant Type::
+    Evaluates to true when a specific grant type is used. For example, it can be used in combination with Client Scope to block a token exchange request when a specific client scope is requested.
+
+
 === Executor
 
 An executor specifies what action is executed on a client to which a policy is adopted. The executor executes one or several specified actions. For example,
@@ -143,6 +150,8 @@ One of several purposes for this executor is to realize the security requirement
 * Enforce a valid redirect URI that the OAuth 2.1 specification requires
 * Enforce SAML Redirect binding cannot be used or SAML requests and assertions are signed
 
+Another available executor is the `auth-flow-enforce`, which can be used to enforce an authentication flow during an authentication request. For instance, it can be used to select a flow based on certain conditions, such as a specific scope or an ACR value. For more details, see the <<_client-policy-auth-flow, related documentation>>.
+
 [[_client_policy_profile]]
 === Profile
 
diff --git a/docs/documentation/server_admin/topics/clients/con-client-scopes.adoc b/docs/documentation/server_admin/topics/clients/con-client-scopes.adoc
index 28ff3911eb04..f10082544ccf 100644
--- a/docs/documentation/server_admin/topics/clients/con-client-scopes.adoc
+++ b/docs/documentation/server_admin/topics/clients/con-client-scopes.adoc
@@ -10,7 +10,7 @@ Client scopes also support the OAuth 2 *scope* parameter. Client applications us
 
 include::proc-creating-client-scopes.adoc[]
 
-
+[[_client_scopes_protocol]]
 == Protocol
 When you create a client scope, choose the *Protocol*. Clients linked in the same scope must have the same protocol.
 
@@ -21,7 +21,7 @@ Each realm has a set of pre-defined built-in client scopes in the menu.
 ** *roles*
 +
 This scope is not defined in the OpenID Connect specification and is not added automatically to the *scope* claim in the access token. This scope has mappers, which are used to add the roles of the user to the access token and
-add audiences for clients that have at least one client role. These mappers are described in more detail in the <<_audience_resolve, Audience section>>.
+add audiences for clients that have at least one client role. These mappers are described in more detail in the <<_oidc_token_role_mappings, Token Role mappings section>> and <<_audience_resolve, Audience section>>.
 +
 ** *web-origins*
 +
@@ -60,9 +60,20 @@ Display On Consent Screen::
 Consent Screen Text::
   The text displayed on the consent screen when this client scope is added to a client when consent required defaults to the name of client scope. The value for this text can be customised by specifying a substitution variable with *${var-name}* strings. The customised value is  configured within the property files in your theme. See the  link:{developerguide_link}[{developerguide_name}] for more information on customisation.
 
+== Include in token scope
+
+There is the *Include in token scope* switch on the client scope. If on, the name of this client scope will be added to the access token property scope, and to the Token Response and Token Introspection Endpoint
+response claim `scope`. If off, this client scope will be omitted from the token and from the Token Introspection Endpoint response. As mentioned above, some built-in client scopes have this switch disabled, which means
+that they are not included in the `scope` claim even if they are applied for the particular request.
+
 [[_client_scopes_linking]]
 == Link client scope with the client
-Linking between a client scope and a client is configured in the *Client Scopes* tab of the client. Two ways of linking between client scope and client are available.
+Linking between a client scope and a client is configured in the *Client Scopes* tab of the client. Here is how it looks for the client application `myclient`:
+
+.Client scopes linking to client
+image:images/client-scopes-default.png[]
+
+There are two ways of linking between the client scope and the client.
 
 Default Client Scopes::
 This setting is applicable to the OpenID Connect and SAML clients. Default client scopes are applied when issuing OpenID Connect tokens or SAML assertions for a client. The client will inherit Protocol Mappers and Role Scope Mappings that are defined on the client scope. For the OpenID Connect Protocol, the Mappers and Role Scope Mappings are always applied, regardless of the value used for the scope parameter in the OpenID Connect authorization request.
@@ -80,10 +91,27 @@ scope=openid phone
 
 The scope parameter contains the string, with the scope values divided by spaces. The value *openid* is the meta-value used for all OpenID Connect requests. The token will contain mappers and role scope mappings from the default client scopes *profile* and *email* as well as *phone*, an optional client scope requested by the scope parameter.
 
+[[_client_scopes_dedicated]]
+=== Dedicated client scope
+
+There is a special client scope, which is linked to every client. It is a dedicated client scope, which is always shown as the first client scope when you click on the tab *Client scopes* of the particular client. 
+For example, for client `myclient`, the client scope is shown as `myclient-dedicated`. This client scope represents the protocol mappers and role scope mappings, which are linked directly to the client itself.
+
+It is not possible to unlink the dedicated client scope from a client. Also, it is not possible to link this dedicated client scope to a different client. In other words, the dedicated client scope is useful
+just for protocol mappers and role scope mappings, which are specific to a single client. In case you want to share the same protocol mapper configuration among multiple clients, it is usually useful to create
+a client scope in the realm tab *Client scopes* and then link this shared client scope to every client that should apply this shared configuration.
+
+In the tab *Scope* of the dedicated client scope, you can define role scope mappings applicable to this client. You can also see the switch *Full scope allowed* in this tab.
+The details about this switch are described in <<_role_scope_mappings, this section>> and in <<_oidc_token_role_mappings,this section>>.
+
+NOTE: In the admin REST API and in the internal {project_name} storage, the dedicated client scope does not exist as its protocol mappers and role scope mappings are internally linked to the client itself. The.
+dedicated client scope is in fact just an abstraction for the admin console UI.
+
 [[_client_scopes_evaluate]]
 == Evaluating Client Scopes
 include::proc-evaluating-client-scopes.adoc[]
 
+[[client-scopes-permissions]]
 == Client scopes permissions
 
 When issuing tokens to a user, the client scope applies only if the user is permitted to use it.
@@ -96,16 +124,14 @@ If a user is not permitted to use the client scope, no protocol mappers or role
 include::proc-updating-default-scopes.adoc[]
 
 == Scopes explained
+
+The term _scope_ has multiple meanings within {project_name} and across the OAuth/OIDC specifications. Below is a clarification of the different _scopes_ used in {project_name}:
+
 Client scope::
 Client scopes are entities in {project_name} that are configured at the realm level and can be linked to clients. Client scopes are referenced by their name when a request is sent to the {project_name} authorization endpoint with a corresponding value of the *scope* parameter. See the <<_client_scopes_linking, client scopes linking>> section for more details.
 
 Role scope mapping::
 This is available under the *Scope* tab of a client or client scope. Use *Role scope mapping* to limit the roles that can be used in the access tokens. See the <<_role_scope_mappings, Role Scope Mappings section>> for more details.
 
-ifeval::[{project_community}==true]
-
 Authorization scopes::
 The *Authorization Scope* covers the actions that can be performed in the application. See the link:{authorizationguide_link}[Authorization Services Guide] for more details.
-
-endif::[]
-
diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-advanced-settings.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-advanced-settings.adoc
index fc830e4d9d6a..fd3892c9511e 100644
--- a/docs/documentation/server_admin/topics/clients/oidc/con-advanced-settings.adoc
+++ b/docs/documentation/server_admin/topics/clients/oidc/con-advanced-settings.adoc
@@ -4,7 +4,7 @@
 
 After completing the fields on the *Settings* tab, you can use the other tabs to perform advanced configuration.
 ifeval::[{project_community}==true]
-For example, you can use the *Permissions* and *Roles* tabs to configure fine-grained authentication for administrators. See <<_fine_grain_permissions, Fine grain admin permissions>>.  Also, see the remaining sections in this chapter for other capabilities.
+For example, you can use the *Roles* or *Client scopes* tabs to configure client roles defined for the client or manage client scopes for the client. Also, see the remaining sections in this chapter for other capabilities.
 endif::[]
 
 == Advanced tab
@@ -104,7 +104,7 @@ DPoP binds an access token and a refresh token together with the public part of
 
 This type of token is a holder-of-key token. Unlike bearer tokens, the recipient of a holder-of-key token can verify if the sender of the token is legitimate.
 
-If the client switch `OAuth 2.0 DPoP Bound Access Tokens Enabled` is on, the workflow is:
+If the client switch `Require Demonstrating Proof of Possession (DPoP) header in token requests` is on, the workflow is:
 
 . A token request is sent to the token endpoint in an authorization code flow or hybrid flow.
 . {project_name} requests a DPoP proof.
@@ -113,7 +113,7 @@ If the client switch `OAuth 2.0 DPoP Bound Access Tokens Enabled` is on, the wor
 
 If verification fails, {project_name} rejects the token.
 
-If the switch `OAuth 2.0 DPoP Bound Access Tokens Enabled` is off, the client can still send `DPoP` proof in the token request. In that case, {project_name} will verify DPoP proof
+If the switch `Require Demonstrating Proof of Possession (DPoP) header in token requests` is off, the client can still send `DPoP` proof in the token request. In that case, {project_name} will verify DPoP proof
 and will add the thumbprint to the token. But if the switch is off, DPoP binding is not enforced by the {project_name} server for this client. It is recommended to have this switch
 on if you want to make sure that particular client always uses DPoP binding.
 
diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-audience.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-audience.adoc
index 3d3ac7cc0d04..40799ee6dfbf 100644
--- a/docs/documentation/server_admin/topics/clients/oidc/con-audience.adoc
+++ b/docs/documentation/server_admin/topics/clients/oidc/con-audience.adoc
@@ -2,78 +2,140 @@
 = Audience support
 [role="_abstract"]
 Typically, the environment where {project_name} is deployed consists of a set of _confidential_ or _public_ client applications that use {project_name} for authentication.
+These clients are _frontend clients_, which may directly redirect user to {project_name} to request browser authentication. The particular client would then receive set of tokens after successful authentication.
 
-_Services_ (_Resource Servers_ in the https://datatracker.ietf.org/doc/html/draft-ietf-oauth-mtls-08#section-4.2[OAuth 2 specification]) are also available that serve requests from client applications and provide resources to these applications. These services require an _Access token_ (Bearer token) to be sent to them to authenticate a request. This token is obtained by the frontend application upon login to {project_name}.
+_Services_ (_Resource Servers_ in the https://datatracker.ietf.org/doc/html/draft-ietf-oauth-mtls-08#section-4.2[OAuth 2 specification]) are also available that serve requests from client applications and provide resources to these applications.
+These services require an _Access token_ (Bearer token) to be sent to them from _frontend application_ or from other service to authenticate a request.
 
-In the environment where trust among services is low, you may encounter this scenario:
+The care must be taken to make sure that access tokens have limited privileges and the particular access token cannot be misused by the service to access other third-party services.
+In the environment where trust among services is low, you may encounter this example scenario:
 
-. A frontend client application requires authentication against {project_name}.
+. A frontend client application `frontend-client` requires authentication against {project_name}.
 
 . {project_name} authenticates a user.
 
-. {project_name} issues a token to the application.
+. {project_name} issues a token to the application `frontend-client`.
 
-. The application uses the token to invoke an untrusted service.
+. The `frontend-client` application uses the token to invoke a service `service1`.
 
-. The untrusted service returns the response to the application. However, it keeps the applications token.
+. The `service1` service returns the response to the application. But assume that this service will try to misuse the token and keep it for the further use.
 
-. The untrusted service then invokes a trusted service using the applications token. This results in broken security as the untrusted service misuses the token to access other services on behalf of the client application.
+. The `service1` then invokes another service `service2` using the applications token, which was previously sent to it. The `service2` does not check that token was not supposed to be
+used to invoke it and it will serve the request and return successful response. This results in broken security as the `service1` misused the token to access other services on behalf of the client application `frontend-client`.
 
-This scenario is unlikely in environments with a high level of trust between services but not in environments where trust is low. In some environments, this workflow may be correct as the untrusted service may have to retrieve data from a trusted service to return data to the original client application.
+This scenario is unlikely in environments with a high level of trust between services but not in environments where trust is low.
 
-An unlimited audience is useful when a high level of trust exists between services. Otherwise, the audience should be limited. You can limit the audience and, at the same time, allow untrusted services to retrieve data from trusted services. In this case, ensure that the untrusted service and the trusted service are added as audiences to the token.
+To prevent any misuse of the access token, the access token can contain the claim `aud`, which represents the audience. The claim `aud` should typically represent client ids of all services where the token
+is supposed to be used. In the environments with low trust among services, it is recommended to:
 
-To prevent any misuse of the access token, limit the audience on the token and configure your services to verify the audience on the token. The flow will change as follows:
+* Limit the audience on the token to make sure that access tokens contain just limited amount of audiences.
 
-. A frontend application authenticates against {project_name}.
+* Configure your services to verify the audience on the token.
+
+To prevent `service1` from the example above to misuse the token, the secure variant of the flow may instead look like this:
+
+. A frontend application `frontend-client` authenticates against {project_name}.
 
 . {project_name} authenticates a user.
 
-. {project_name} issues a token to the application. The application knows that it will need to invoke an untrusted service so it places *scope=<untrusted service>* in the authentication request sent to {project_name} (see <<_client_scopes, Client Scopes section>> for more details about the _scope_ parameter).
+. {project_name} issues a token to the `frontend-client` application. The `frontend-client` knows that it will need to invoke `service1` so it places `scope=service1-scope` in the authentication request sent to {project_name}.
+The scope `service1-scope` is a <<_client_scopes,Client scope>>, which may need to be created by administrator. In the <<_audience_setup,sections below>> there are some options how to setup such a client scope.
+The token claim will look like:
 +
-The token issued to the application contains a reference to the untrusted service in its audience (*"audience": [ "<untrusted service>" ]*) which declares that the client uses this access token to invoke the untrusted service.
+[source,json]
+----
+"aud": "service1"
+----
 +
-.The untrusted service serves the request to the client application but also keeps the token.
+This declares that the client can use this access token to invoke the `service1`.
 
-. The untrusted service invokes a trusted service with the token. Invocation is not successful because the trusted service checks the audience on the token and find that its audience is only for the untrusted service. This behavior is expected and security is not broken.
+. The `frontend-client` application uses the token to invoke a service `service1`.
 
-If the client wants to invoke the trusted service later, it must obtain another token by reissuing the SSO login with *scope=<trusted service>*. The returned token will then contain the trusted service as an audience:
+. The `service1` serves the request to the client application `frontend-application`. But assume that this service will try to misuse the token and keep it for the further use.
 
+. The `service1` will then try to invoke a `service2` with the token. Invocation is not successful because the `service2` service checks the audience on the token and find that its audience is only for the `service1`. Hence `service2` will reject the request and will return an error to `service1`. This behavior is expected and security is not broken.
+
+== Ability for the service to call another service
+
+In some environments, it may be desired that the `service1` may have to retrieve additional data from a `service2` to return data to the original client application `frontend-client`. In order to make this
+possible to work, there are few possibilities:
+
+* Make sure that initial access token issued to `frontend-client` will contain both `service1` and `service2` as audiences. Assuming that there are proper client scopes set, the `frontend-client` can possibly use
+the `scope=service1-scope service2-scope` as a value of the `scope` parameter. The issued token would then contain the `aud` claim like:
++
 [source,json]
 ----
-"audience": [ "<trusted service>" ]
+"aud": [ "service1", "service2" ]
 ----
-Use this value to invoke the *<trusted service>*.
++
+Such access token can be used to invoke both `service1` or `service2`. Hence `service1` will be able to successfully use such token to invoke `service2` to retrieve additional data.
 
+* The previous approach with both services in the token audience allows that `service1` is allowed to invoke `service2`. However it means that `frontend-client` can also directly use his access token to invoke `service2`.
+This may not be desired in some cases. You may want `service1` to be able to invoke `service2`, but at the same time, you do not want `frontend-client` to be able to directly invoke `service2`. The solution
+to such scenario might be the use of the link:{securing_apps_token_exchange_link}[Token exchange]. In that case, the initial token would still have only `service1` as an audience.
+However once the token is sent to `service1`, the `service1` may send Token exchange request to exchange the token for another token, which would have `service2` as an audience. Please see
+the link:{securing_apps_token_exchange_link}[{securing_apps_token_exchange_name}] for the details on how to use it.
+
+[[_audience_setup]]
 == Setup
 
 When setting up audience checking:
 
 * Ensure that services are configured to check audience on the access token sent to them. This may be done in a way specific to your client OIDC adapter, which you are using to secure your OIDC client application.
 
-* Ensure that access tokens issued by {project_name} contain all necessary audiences. Audiences can be added using the client roles as described in the <<_audience_resolve, next section>> or hardcoded. See <<_audience_hardcoded, Hardcoded audience>>.
+* Ensure that access tokens issued by {project_name} contain all necessary audiences.
++
+Audiences can be added to the token by two ways:
++
+** Using the client roles as described in the <<_audience_resolve, Audience resolve section>>.
++
+** Hardcoded audience as described in the <<_audience_hardcoded, Hardcoded audience section>>.
 
 [[_audience_resolve]]
-== Automatically add audience
+== Automatically add audience based on client roles
 
-An _Audience Resolve_ protocol mapper is defined in the default client scope _roles_. The mapper checks for clients that have at least one client role available for the current token. The client ID of each client is then added as an audience, which is useful
+An _Audience Resolve_ protocol mapper is defined in the default client scope _roles_. The mapper checks for clients that have at least one client role available for the current token. The client ID of each such client is then added as an audience, which is useful
 if your service clients rely on client roles. Service client could be usually a client without any flows enabled, which may not have any tokens issued directly to itself. It represents an OAuth 2 _Resource Server_.
 
-For example, for a service client and a confidential client,
-you can use the access token issued for the confidential client to invoke the service client REST service. The service client will be automatically added as an audience to the access token issued for the confidential client if the following are true:
+The <<_oidc_token_role_mappings,Token role mappings section>> contains the details about how are client roles added into the token. Please also see the example below.
 
-* The service client has any client roles defined on itself.
+=== Example - token role mappings and audience claim
 
-* Target user has at least one of those client roles assigned.
+Here are the example steps how to use the client roles to make `aud` claim added to the token:
 
-* Confidential client has the role scope mappings for the assigned role.
+. Create a <<proc-creating-oidc-client_{context},OIDC client>> `service1`. It may be possible to disable *Standard flow* or any other flows for this client
+as it is a service client, which may never directly authenticate by itself. The possible exception might be *Standard Token Exchange* switch if needed as described above.
 
-[NOTE]
-====
-If you want to ensure that the audience is not added automatically, do not configure role scope mappings directly on the confidential client. Instead, you can create a dedicated client scope that contains the role scope mappings for the client roles of your dedicated client scope.
+. Go to *Roles* tab of that client and create client role `service1-role`.
 
-Assuming that the client scope is added as an optional client scope to the confidential client, the client roles and the audience will be added to the token if explicitly requested by the *scope=<trusted service>*  parameter.
-====
+. Create user `john` in the same realm and assign him the client role `service1-role` of client `service1` created in the previous step.
+<<proc-assigning-role-mappings_{context},This section>> contains some details on how to do it.
+
+. Create client scope named `service1-scope`. It can be marked with *Include in token scope* as *ON*. See <<_client_scopes,this section>> for the details on how to create and set new client scope.
+
+. Go to the tab *Scope* of the `service1-scope` and add the role `service1-role` of the client `service1` to the <<_role_scope_mappings,Role scope mappings>> of this client scope
+
+. Create another client `frontend-client` in the realm.
+
+. Click to the tab *Client scopes* of this client and select the first dedicated client scope `frontend-client-dedicated` and then go to the tab *Scope* and disable *Full scope allowed* switch
+
+. Go back to the tab *Client scopes* of this client and click *Add client scope* and link the `service1-scope` as *Optional*. See <<_client_scopes_linking, Client Scopes Linking section>> for more details.
+
+. Click the sub-tab *Evaluate* in the *Client scopes* as described in <<_client_scopes_evaluate,this section>>. When filling user `john` and the subtab *Generated access token*, it can be seen that
+there is not any `aud` claim as there are not any client roles in the generated example token. However when adding also the scope `service1-scope` to the *Scope* field, it can be seen that there is client
+role `service1-role` as it is in *Role scope mappings* of the `service1-scope` and also in the role mappings of the user `john`. Due to that the `aud` claim will also contain `service1`.
+
+.Audience resolve example
+image:images/audience_resolving_evaluate.png[]
+
+If you want the `service1` audience to be always applied for the tokens issued to the `frontend-client` client (without using the parameter `scope=service1-scope`), it can be fine to instead do any of these:
+
+* Assign the `service1-scope` as *Default* client scope rather than *Optional*
+
+* Add the role scope mapping of the `service1-role` directly to the <<_client_scopes_dedicated,Dedicated client scope>> of the client. In this case, you will not need the `service1-scope` at all.
+
+Note that since this approach is based on client roles, it also requires that user himself (user `john` in the example above) is a member of some client role of the client `service1`. Otherwise if there
+are not any client roles assigned, the audience `service1` will not be included. If you want audience to be included regardless of client roles, see the <<_audience_hardcoded,Hardcoded audience>> section instead.
 
 [NOTE]
 ====
@@ -91,28 +153,31 @@ You can use any custom value, for example a URL, if you want to use a different
 
 You can add the protocol mapper directly to the frontend client. If the protocol mapper is added directly, the audience will always be added as well.
 
-For more control over the protocol mapper, you can create the protocol mapper on the dedicated client scope, which will be called for example *good-service*.
+For more control over the protocol mapper, you can create the protocol mapper on the dedicated client scope, which will be called for example *service2*.
 
-.Audience protocol mapper
-image:images/audience_mapper.png[]
+Here the example steps for the hardcoded audience
 
-* From the <<_client_installation, Client details tab>> of the *good-service* client, you can generate the adapter configuration and confirm that _verify-token-audience_  is set to *true*. This action forces the adapter to verify the audience if you use this configuration.
+. Create a client `service2`
 
-* You need to ensure that the confidential client is able to request *good-service* as an audience in its tokens.
-+
-On the confidential client:
-+
-. Click the _Client Scopes_ tab.
-. Assign *good-service* as an optional (or default) client scope.
-+
-See <<_client_scopes_linking, Client Scopes Linking section>> for more details.
+. Create a client scope `service2-scope`.
 
-* You can optionally <<_client_scopes_evaluate, Evaluate Client Scopes>> and generate an example access token. *good-service* will be added to the audience of the generated access token if *good-service* is included in the _scope_ parameter, when you assigned it as an optional client scope.
+. In the tab *Mappers* of that client scope, select *Configure a new mapper* and select *Audience*
 
-* In your confidential client application, ensure that the _scope_ parameter is used. The value *good-service* must be included when you want to issue the token for accessing *good-service*.
+. Select *Included Client Audience* as a `service2` and save the mapper
 +
-See:
+.Audience protocol mapper
+image:images/audience_mapper.png[]
 +
-** *Keycloak JavaScript adapter* in the link:{securing_apps_link}[securing apps] section if your application uses the javascript adapter.
+. Link the newly created client scope with some client. For example it can be linked as *Optional* client scope to the client `frontend-client` created in the <<_audience_resolve,previous example>>.
+
+. You can optionally <<_client_scopes_evaluate, Evaluate Client Scopes>> for the client where the client scope was linked (For example `frontend-client`) and generate an example access token.
+The audience `service2` will be added to the audience of the generated access token if `service2-scope` is included in the _scope_ parameter, when you assigned it as an optional client scope.
+
+In your confidential client application, ensure that the _scope_ parameter is used. The value like _scope=service2-scope_ must be included when you want to issue the token for accessing `service2`.
+
+See in the link:{securing_apps_base_link}/javascript-adapter[{project_name} JavaScript adapter] section if your application uses the javascript adapter for how to send the _scope_ parameter with the desired value.
+
+If you prefer to not include `scope` parameter in your requests, you can instead link the `service2-scope` as a *Default* client scope or use the client dedicated scope where you configure this mapper.
+This is useful if you want to always apply the audience for all the authentication request of OIDC client `frontend-client`.
 
-NOTE: Both the _Audience_ and _Audience Resolve_ protocol mappers add the audiences to the access token only, by default. The ID Token typically contains only a single audience, the client ID for which the token was issued, a requirement of the OpenID Connect specification. However, the access token does not necessarily have the client ID, which was the token issued for, unless the audience mappers added it.
+NOTE: Both the _Audience_ and _Audience Resolve_ protocol mappers add the audiences to the access token only, by default. The ID Token typically contains only a single audience, the client ID for which the token was issued, a requirement of the OpenID Connect specification. However, the access token does not necessarily have the client ID, which was the token issued for, unless the _Audience_ mapper added it.
diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc
index 442ce36ea066..571c8bdf3291 100644
--- a/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc
+++ b/docs/documentation/server_admin/topics/clients/oidc/con-basic-settings.adoc
@@ -66,6 +66,8 @@ For client-side clients that perform browser logins. As it is not possible to en
 
 *Service account roles*:: If enabled, this client can authenticate to {project_name} and retrieve access token dedicated to this client. In terms of OAuth2 specification, this enables support of `Client Credentials Grant` for this client.
 
+*Standard Token Exchange*:: If enabled, this client can use the link:{securing_apps_token_exchange_link}#_standard-token-exchange[Standard token exchange].
+
 *Auth 2.0 Device Authorization Grant*:: If enabled, this client can use the OIDC xref:con-oidc-auth-flows_server_administration_guide[Device Authorization Grant].
 
 *OIDC CIBA Grant*:: If enabled, this client can use the OIDC xref:con-oidc-auth-flows_{context}[Client Initiated Backchannel Authentication Grant].
diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-confidential-client-credentials.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-confidential-client-credentials.adoc
index ab28bb5c5923..251a4b18e00d 100644
--- a/docs/documentation/server_admin/topics/clients/oidc/con-confidential-client-credentials.adoc
+++ b/docs/documentation/server_admin/topics/clients/oidc/con-confidential-client-credentials.adoc
@@ -19,6 +19,8 @@ image:images/client-credentials-jwt.png[Signed JWT]
 
 *Signed JWT* is "Signed JSON Web Token".
 
+In this authenticator you can enforce the *Signature algorithm* used by the client (any algorithm is valid by default) and the *Max expiration* allowed for the JWT token (tokens received after this period will not be accepted because they are too old, note that tokens should be issued right before the authentication, 60 seconds by default).
+
 When choosing this credential type you will have to also generate a private key and certificate for the client in the tab `Keys`. The private key will be used to sign the JWT, while the certificate is used by the server to verify the signature.
 
 .Keys tab
@@ -63,6 +65,8 @@ If you select this option, you can use a JWT signed by client secret instead of
 
 The client secret will be used to sign the JWT by the client.
 
+Like in the *Signed JWT* authenticator you can configure the *Signature algorithm* and the *Max expiration* for the JWT token.
+
 *X509 Certificate*
 
 {project_name} will validate if the client uses proper X509 certificate during the TLS Handshake.
diff --git a/docs/documentation/server_admin/topics/clients/oidc/con-token-role-mappings.adoc b/docs/documentation/server_admin/topics/clients/oidc/con-token-role-mappings.adoc
new file mode 100644
index 000000000000..994539cdfb26
--- /dev/null
+++ b/docs/documentation/server_admin/topics/clients/oidc/con-token-role-mappings.adoc
@@ -0,0 +1,80 @@
+[[_oidc_token_role_mappings]]
+= Role mappings in the token
+
+When a user authenticates, there are some roles that are added to the access token. By default, the <<proc-creating-realm-roles_{context},Realm roles>> are added to the access
+token into the `realm_access` claim. The <<con-client-roles_{context},Client roles>> are added by default to the `resource_access` claim.
+
+The roles added to the token are an intersection of:
+
+* Roles, that are <<_oidc_token_role_mappings_user_roles,assigned to the user>>.
+
+* <<_role_scope_mappings,Role scope mappings>> of the roles that the client is permitted to access
+
+[[_oidc_token_role_mappings_user_roles]]
+== Roles assigned to the user
+
+Roles assigned to the user can be defined in the Role mappings as described in <<proc-assigning-role-mappings_{context},this section>>. Few details:
+
+* In case that a user is a member of some <<proc-managing-groups_{context},groups>>, then all the roles of these groups are also applied.
+
+* In case that a role is a <<_composite-roles,composite role>>, the child roles of the composite role are also applied. In the token, the list of the roles is expanded and would contain all the roles.
+
+* In case that the authenticated user is not a normal user, but a <<_service_accounts,Service account>>, which represents a client, then the service account roles are used. The service account roles are defined
+in the tab *Service accounts roles* of the particular client.
+
+== Role protocol mappers
+
+Similarly to other claims, the roles are added to the access token issued for the client by the dedicated <<_protocol-mappers,Protocol mappers>>. There is a <<_client_scopes_protocol,Built-in client scope *roles*>>
+defined in the realm. Since it is a <<proc_updating_client_scopes_{context},Realm default client scope>>, it is defined by default as a <<_client_scopes_linking,Default client scope>> for every realm client.
+You can see this client scope in the admin console by looking at the tab *Client scopes* and then looking for the *roles* client scope. This client scope contains these protocol mappers by default:
+
+* The protocol mapper *realm roles* - This protocol mapper is used to add the realm roles to the token claim. By default, the configuration looks like this:
+
+.Realm roles mapper
+image:images/mapper-oidc-realm-roles.png[]
+
+* The protocol mapper *client roles* - This protocol mapper is used to add the client roles to the token claim. By default, the configuration looks like this:
+
+.Client roles mapper
+image:images/mapper-oidc-client-roles.png[]
+
+* The protocol mapper *audience resolve* - This protocol mapper is used to fill the `aud` claim in the access token based on the applied client roles. The details about this mapper are in the <<_audience_resolve,Audience resolve section>>.
+
+As you can see in the configuration of realm roles and client roles mappers, it is possible to configure:
+
+* If roles are added just to the access token or also to other tokens, like for example the ID token. By default, roles are added to the access token and to the introspection endpoint.
+
+* What are the claims where the roles would be added. By default, the realm roles are added to the `realm_access` claim. So, for example, the claim in the JWT token containing 2 realm roles `role1` and `role2` will look similar to this:
++
+[source,json]
+----
+"realm_access": {
+  "roles": [ "role1", "role2" ]
+}
+----
++
+The client roles are added to the `resource_access` token claim by default. This claim will look like this in the token, which contains
+client roles `manage-account` and `manage-account-links` of client `account` and client role `target-client1-role` of the client `target-client1`:
++
+[source,json]
+----
+"resource_access": {
+  "target-client1": {
+    "roles": [ "target-client1-role" ]
+  },
+  "account": {
+    "roles": [ "manage-account", "manage-account-links" ]
+  }
+}
+----
+
+By adjusting the configuration option *Token claim name* of the role protocol mappers, it is possible to specify that these roles will be added to the token in the configured claim.
+
+If you want to update the role claims just for one specific client (For example, client `foo` expects the realm roles in the claim `my-realm-roles` instead of the claim `realm_access`), then it is
+possible to remove the default client scope *roles* from your client and instead configure the realm/client protocol mapper in the <<_client_scopes_dedicated,dedicated client scope>> of your client.
+
+== Example
+
+The <<_audience_resolve,Audience documentation>> contains a more detailed example, which covers some details about the role mappings and about the audience (Claim `aud`) added to the token. Also, it can be
+useful to try the <<_client_scopes_evaluate,Client scopes evaluation>> to see what are the effective scopes, protocol mappers and role scope mappings used when issuing the token for the particular client
+and how the JWT tokens would look like for the particular combination of user, client, and applied client scopes.
diff --git a/docs/documentation/server_admin/topics/clients/oidc/proc-using-a-service-account.adoc b/docs/documentation/server_admin/topics/clients/oidc/proc-using-a-service-account.adoc
index f78124a02316..0e3dc03225b3 100644
--- a/docs/documentation/server_admin/topics/clients/oidc/proc-using-a-service-account.adoc
+++ b/docs/documentation/server_admin/topics/clients/oidc/proc-using-a-service-account.adoc
@@ -8,16 +8,16 @@ Each OIDC client has a built-in _service account_. Use this _service account_ to
 .Prerequisites
 
 .Procedure
-. Click *Clients* in the menu.  
+. Click *Clients* in the menu.
 . Select your client.
 . Click the *Settings* tab.
 . Toggle <<_access-type, Client authentication>> to *On*.
-. Select *Service accounts roles*.
+. Select *Service accounts roles* checkbox to make sure it is enabled.
 . Click *Save*.
 . Configure your <<_client-credentials, client credentials>>.
-. Click the *Scope* tab.
-. Verify that you have roles or toggle *Full Scope Allowed* to *ON*.
-. Click the *Service Account Roles* tab
+. Click the *Client Scopes* tab, select the dedicated client scope (usually first client scope in the list, more details <<_client_scopes_dedicated,in this section>>) and select *Scope* tab of the client scope.
+. Verify that you have roles or toggle *Full Scope Allowed* to *ON*. Note that this switch is useful only for the development purposes and in the production, it is recommended to disable this switch and properly configure role scopes. The details about this switch are described in <<_role_scope_mappings, this section>> and in <<_oidc_token_role_mappings,this section>>.
+. Click the *Service Account Roles* tab of your client
 . Configure the roles available to this service account for your client.
 
 Roles from access tokens are the intersection of:
@@ -43,6 +43,16 @@ For example, the POST invocation to retrieve a service account can look like thi
     grant_type=client_credentials
 ----
 
+Note that the value of `cHJvZHVjdC1zYS1jbGllbnQ6cGFzc3dvcmQ=` used in the `Authorization` header is Base64 encoded value of clientId and clientSecret
+in the format prescribed by the `Authorization: Basic` header. In this example, the client ID is `product-sa-client` and the client secret was `password` and hence the value was obtained for example
+by this command in the Unix platform:
+[source,bash]
+----
+echo 'product-sa-client:password' | base64
+----
+Instead of using the header `Authorization: Basic`, it is also possible to send the credentials as parameters `client_id` and `client_secret` of the POST request. For other client credentials methods,
+the format of the parameters would be different as described above.
+
 The response would be similar to this https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.3[Access Token Response] from the OAuth 2.0 specification.
 
 [source]
@@ -54,9 +64,10 @@ Cache-Control: no-store
 Pragma: no-cache
 
 {
-    "access_token":"2YotnFZFEjr1zCsicMWpAA",
-    "token_type":"bearer",
-    "expires_in":60
+    "access_token":"eyJhbGciOiJSUzI1NiIs...",
+    "token_type":"Bearer",
+    "expires_in":60,
+    "scope": "email profile"
 }
 ----
 
diff --git a/docs/documentation/server_admin/topics/clients/oidc/service-accounts.adoc b/docs/documentation/server_admin/topics/clients/oidc/service-accounts.adoc
deleted file mode 100644
index 4d1c5e87bfda..000000000000
--- a/docs/documentation/server_admin/topics/clients/oidc/service-accounts.adoc
+++ /dev/null
@@ -1,57 +0,0 @@
-[[_service_accounts]]
-
-==== Service Accounts
-
-Each OIDC client has a built-in _service account_ which allows it to obtain an access token.
-This is covered in the OAuth 2.0 specification under <<_client_credentials_grant,Client Credentials Grant>>.
-To use this feature you must set the <<_access-type, Access Type>> of your client to `confidential`.  When you do this,
-the `Service Accounts Enabled` switch is displayed.  You need to toggle this switch to ON.  Also make sure that you have
-configured your <<_client-credentials, client credentials>>.
-
-To use it you must have registered a valid `confidential` Client and you need to check the switch `Service Accounts Enabled` in {project_name} admin console for this client.
-In tab `Service Account Roles` you can configure the roles available to the service account retrieved on behalf of this client.
-Remember that you must have the roles available in Role Scope Mappings (tab `Scope`) of this client as well, unless you
-have `Full Scope Allowed` on. As in a normal login, roles from access token are the intersection of:
-
-* Role scope mappings of particular client combined with the role scope mappings inherited from linked client scopes
-* Service account roles
-
-The REST URL to invoke on is `{kc_realms_path}/{realm-name}/protocol/openid-connect/token`.
-Invoking on this URL is a POST request and requires you to post the client credentials.
-By default, client credentials are represented by clientId and clientSecret of the client in `Authorization: Basic` header, but you can also authenticate the client with a signed JWT assertion or any other custom mechanism for client authentication.
-You also need to use the parameter `grant_type=client_credentials` as per the OAuth2 specification.
-
-For example the POST invocation to retrieve a service account can look like this:
-
-[source]
-----
-
-    POST {kc_realms_path}/demo/protocol/openid-connect/token
-    Authorization: Basic cHJvZHVjdC1zYS1jbGllbnQ6cGFzc3dvcmQ=
-    Content-Type: application/x-www-form-urlencoded
-
-    grant_type=client_credentials
-----
-The response would be this https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.3[standard JSON document] from the OAuth 2.0 specification.
-
-[source]
-----
-
-HTTP/1.1 200 OK
-Content-Type: application/json;charset=UTF-8
-Cache-Control: no-store
-Pragma: no-cache
-
-{
-    "access_token":"2YotnFZFEjr1zCsicMWpAA",
-    "token_type":"bearer",
-    "expires_in":60
-}
-----
-
-There is the only access token returned by default. There is no refresh token returned and there is also no user session created
-on the {project_name} side upon successful authentication by default. Due to the lack of a refresh token, there is a need to re-authenticate when access token expires,
-however this does not mean any additional overhead on  {project_name} server side due the fact that sessions are not created by default.
-
-Due to this, there is no need for logout, however issued access tokens can be revoked by sending request to the OAuth2 Revocation Endpoint described
-in the <<_oidc-endpoints, OpenID Connect Endpoints>> section.
diff --git a/docs/documentation/server_admin/topics/clients/proc-evaluating-client-scopes.adoc b/docs/documentation/server_admin/topics/clients/proc-evaluating-client-scopes.adoc
index a58e77447dcd..47fa358c438d 100644
--- a/docs/documentation/server_admin/topics/clients/proc-evaluating-client-scopes.adoc
+++ b/docs/documentation/server_admin/topics/clients/proc-evaluating-client-scopes.adoc
@@ -10,12 +10,15 @@ The *Mappers* tab contains the protocol mappers and the *Scope* tab contains the
 
 This will also show you the value of the *scope* parameter. This parameter needs to be sent from the application to the {project_name} OpenID Connect authorization endpoint.
 
-.Evaluating client scopes
-image:images/client-scopes-evaluate.png[]
-
 [NOTE]
 ====
-To send a custom value for a *scope* parameter from your application, see the *Keycloak JavaScript adapter* in the link:{securing_apps_link}[securing apps] section, for javascript adapters.
+If your application uses the {securing_apps_base_link}/javascript-adapter[{project_name} JavaScript adapter], see its section to learn how to send the *scope* parameter with the desired value.
 ====
 
+You can also simulate how the access token, ID token, or UserInfo response issued to this client looks for a particular selected user and for a specific value of the `audience` parameter. Note
+that the `audience` parameter is currently only supported for the token exchange grant. It is recommended to leave it empty when simulating any other grant.
+
+.Evaluating client scopes
+image:images/client-scopes-evaluate.png[]
+
 All examples are generated for the particular user and issued for the particular client, with the specified value of the *scope* parameter. The examples include all of the claims and role mappings used.
diff --git a/docs/documentation/server_admin/topics/clients/proc-updating-default-scopes.adoc b/docs/documentation/server_admin/topics/clients/proc-updating-default-scopes.adoc
index d3cd7a919808..58f62926e7f6 100644
--- a/docs/documentation/server_admin/topics/clients/proc-updating-default-scopes.adoc
+++ b/docs/documentation/server_admin/topics/clients/proc-updating-default-scopes.adoc
@@ -3,15 +3,7 @@
 [role="_abstract"]
 Use *Realm Default Client Scopes* to define sets of client scopes that are automatically linked to newly created clients.
 
-.Procedure
-. Click the *Client Scopes* tab for the client.
-ifeval::[{project_product}==true]
-. Click *Default Client Scopes*.
-endif::[]
-
-From here, select the client scopes that you want to add as *Default Client Scopes* to newly created clients and *Optional Client Scopes*.
-
-.Default client scopes
-image:images/client-scopes-default.png[]
+To see the realm default client scopes, click the *Client Scopes* tab on the left side of the admin console. In the *Assigned type* column, you can specify whether a particular client scope should be added as
+a *Default Client Scope* or an *Optional Client Scope* to newly created clients. See <<_client_scopes_linking, this section>> for details on what _default_ and _optional_ client scopes are.
 
 When a client is created, you can unlink the default client scopes, if needed. This is similar to removing <<_default_roles, Default Roles>>.
diff --git a/docs/documentation/server_admin/topics/events/admin.adoc b/docs/documentation/server_admin/topics/events/admin.adoc
index 73fc84912d86..0461946e3c7d 100644
--- a/docs/documentation/server_admin/topics/events/admin.adoc
+++ b/docs/documentation/server_admin/topics/events/admin.adoc
@@ -35,9 +35,9 @@ You can now view admin events.
 .Admin events
 image:images/admin-events.png[Admin events]
 
-When the `Include Representation` switch is ON, it can lead to storing a lot of information in the database. You can set a maximum length of the representation by using the `--spi-events-store-jpa-max-field-length` argument. This setting is useful if you want to adhere to the underlying storage limitation. For example:
+When the `Include Representation` switch is ON, it can lead to storing a lot of information in the database. You can set a maximum length of the representation by using the `--spi-events-store--jpa--max-field-length` argument. This setting is useful if you want to adhere to the underlying storage limitation. For example:
 
 [source,bash]
 ----
-kc.[sh|bat] --spi-events-store-jpa-max-field-length=2500
+kc.[sh|bat] --spi-events-store--jpa--max-field-length=2500
 ----
\ No newline at end of file
diff --git a/docs/documentation/server_admin/topics/events/login.adoc b/docs/documentation/server_admin/topics/events/login.adoc
index 534842298994..0d6762ed59b5 100644
--- a/docs/documentation/server_admin/topics/events/login.adoc
+++ b/docs/documentation/server_admin/topics/events/login.adoc
@@ -184,7 +184,7 @@ To change the log level used by the Logging Event listener, add the following:
 
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-events-listener-jboss-logging-success-level=info --spi-events-listener-jboss-logging-error-level=error
+bin/kc.[sh|bat] start --spi-events-listener-jboss-logging-success-level=info --spi-events-listener--jboss-logging--error-level=error
 ----
 
 The valid values for log levels are `debug`, `info`, `warn`, `error`, and `fatal`.
@@ -200,6 +200,11 @@ The Email Event Listener sends a message to the user's email address when an eve
 * Update Credential.
 * Remove Credential.
 
+Below are the optional events you can configure:
+
+* User disabled by permanent lockout.
+* User disabled by temporary lockout.
+
 The following conditions need to be met for an email to be sent:
 
 * User has an email address.
@@ -221,10 +226,15 @@ To enable the Email Listener:
 .Event listeners
 image:images/event-listeners.png[Event listeners]
 
-You can exclude events by using the `--spi-events-listener-email-exclude-events` argument. For example:
+You can exclude events by using the `--spi-events-listener--email--exclude-events` argument. For example:
 
 [source,bash]
 ----
-kc.[sh|bat] --spi-events-listener-email-exclude-events=UPDATE_CREDENTIAL,REMOVE_CREDENTIAL
+kc.[sh|bat] --spi-events-listener--email--exclude-events=UPDATE_CREDENTIAL,REMOVE_CREDENTIAL
 ----
 
+To enable optional events, use the following command:
+[source,bash]
+----
+kc.[sh|bat] --spi-events-listener--email--include-events=USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR,USER_DISABLED_BY_PERMANENT_LOCKOUT
+----
diff --git a/docs/documentation/server_admin/topics/identity-broker/configuration.adoc b/docs/documentation/server_admin/topics/identity-broker/configuration.adoc
index c20e05de98f0..fea974e1b62e 100644
--- a/docs/documentation/server_admin/topics/identity-broker/configuration.adoc
+++ b/docs/documentation/server_admin/topics/identity-broker/configuration.adoc
@@ -54,6 +54,10 @@ Although each type of identity provider has its configuration options, all share
 
 |Trust Email
 |When *ON*, {project_name} trusts email addresses from the identity provider. If the realm requires email validation, users that log in from this identity provider do not need to perform the email verification process.
+If the target identity provider supports email verification and advertises this information when returning the user profile information, the email of the federated user will be (un)marked as verified.
+For instance, an OpenID Connect Provider returning a `email_verified` claim in their ID Tokens.
+Note that this setting will set the email as verified when the user is federated for the first time and on subsequent logins
+through the broker if the sync mode is set to `FORCE`.
 
 |GUI Order
 |The sort order of the available identity providers on the login page.
diff --git a/docs/documentation/server_admin/topics/identity-broker/oauth2.adoc b/docs/documentation/server_admin/topics/identity-broker/oauth2.adoc
new file mode 100644
index 000000000000..05b63dc24322
--- /dev/null
+++ b/docs/documentation/server_admin/topics/identity-broker/oauth2.adoc
@@ -0,0 +1,90 @@
+
+[[_identity_broker_oauth]]
+=== OAuth v2 identity providers
+
+{project_name} brokers identity providers based on the OAuth v2 protocol. These identity providers (IDPs) must support the xref:con-oidc-auth-flows_{context}[Authorization Code Flow] defined in the specification to authenticate users and authorize access.
+
+
+.Procedure
+. Click *Identity Providers* in the menu.
+. From the `Add provider` list, select `OAuth v2`.
++
+. Enter your initial configuration options. See <<_general-idp-config, General IDP Configuration>> for more information about configuration options.
++
+.OAuth2 settings
+|===
+|Configuration|Description
+
+|Authorization URL
+|The authorization URL endpoint.
+
+|Token URL
+|The token URL endpoint.
+
+|User Info URL
+|An endpoint from where information about the user will be fetched from. When invoking this endpoint, {project_name} will send
+the request with the access token issued by the identity provider as a bearer token. As a result, it expects the response to be a
+JSON document with the claims that should be used to obtain user profile information like ID, username, email, and first and last names.
+
+|Client Authentication
+|Defines the Client Authentication method {project_name} uses with the Authorization Code Flow. In the case of JWT signed with a private key, {project_name} uses the realm private key. In the other cases, define a client secret. See the https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication[Client Authentication specifications] for more information.
+
+|Client ID
+|A realm acting as an OIDC client to the external IDP. The realm must have an OIDC client ID if you use the Authorization Code Flow to interact with the external IDP.
+
+|Client Secret
+|Client secret from an external <<_vault-administration,vault>>. This secret is necessary if you are using the Authorization Code Flow.
+
+|Client Assertion Signature Algorithm
+|Signature algorithm to create JWT assertion as client authentication.
+In the case of JWT signed with private key or Client secret as jwt, it is required. If no algorithm is specified, the following algorithm is adapted. `RS256` is adapted in the case of JWT signed with private key.  `HS256` is adapted in the case of Client secret as jwt.
+
+|Client Assertion Audience
+|The audience to use for the client assertion. The default value is the IDP's token endpoint URL.
+
+|Default Scopes
+|A space separated list of scopes {project_name} sends with the authentication request.
+
+|Prompt
+|The prompt parameter in the OIDC specification. Through this parameter, you can force re-authentication and other options. See the specification for more details.
+
+|Accepts prompt=none forward from client
+|Specifies if the IDP accepts forwarded authentication requests containing the `prompt=none` query parameter. If a realm receives an auth request with `prompt=none`, the realm checks if the user is currently authenticated and returns a `login_required` error if the user has not logged in. When {project_name} determines a default IDP for the auth request (using the `kc_idp_hint` query parameter or having a default IDP for the realm), you can forward the auth request with `prompt=none` to the default IDP. The default IDP checks the authentication of the user there. Because not all IDPs support requests with `prompt=none`, {project_name} uses this switch to indicate that the default IDP supports the parameter before redirecting the authentication request.
+
+If the user is unauthenticated in the IDP, the client still receives a `login_required` error. If the user is authentic in the IDP, the client can still receive an `interaction_required` error if {project_name} must display authentication pages that require user interaction. This authentication includes required actions (for example, password change), consent screens, and screens set to display by the `first broker login` flow or `post broker login` flow.
+
+|Requires short state parameter
+|This switch needs to be enabled if identity provider does not support long value of the `state` parameter sent in the initial OAuth2 authorization request (EG. more than 100 characters). In this case, {project_name} will try to make shorter `state` parameter and may omit some client data to be sent in the initial request. This may result in the limited functionality in some very corner case scenarios (EG. in case that IDP redirects to {project_name} with the error in the OAuth2 authorization response, {project_name} might need to display error page instead of being able to redirect to the client in case that login session is expired).
+
+|===
+
+After the user authenticates to the identity provider and is redirected back to {project_name}, the broker will fetch the user profile information from the endpoint defined in the `User Info URL` setting. For that,
+{project_name} will invoke that endpoint using the access token issued by the identity provider as a bearer token. Even though the OAuth2 standard supports access tokens using a JWT format, this broker assumes access tokens are opaque and that user profile information should be obtained from a separate endpoint.
+
+In order to map the claims from the JSON document returned by the user profile endpoint, you might want to set the following settings so that they are mapped to user attributes when federating the user:
+
+.User profile claims
+|===
+|Configuration|Description
+
+|ID Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's unique identifier. If not provided, defaults to `sub`.
+
+|Username Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's username. If not provided, defaults to `preferred_username`.
+
+|Email Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's email. If not provided, defaults to `email`.
+
+|Name Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's full name. If not provided, defaults to `name`.
+
+|Given name Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's given name. If not provided, defaults to `given_name`.
+
+|Family name Claim
+|The name of the claim from the JSON document returned by the user profile endpoint representing the user's family name. If not provided, defaults to `family_name`.
+
+|===
+
+You can import all this configuration data by providing a URL or file that points to the Authorization Server Metadata. If you connect to a {project_name} external IDP, you can import the IDP settings from `<root>{kc_realms_path}/{realm-name}/.well-known/openid-configuration`. This link is a JSON document describing metadata about the IDP.
diff --git a/docs/documentation/server_admin/topics/identity-broker/oidc.adoc b/docs/documentation/server_admin/topics/identity-broker/oidc.adoc
index d152e5912bad..439741dc5849 100644
--- a/docs/documentation/server_admin/topics/identity-broker/oidc.adoc
+++ b/docs/documentation/server_admin/topics/identity-broker/oidc.adoc
@@ -63,6 +63,9 @@ In the case of JWT signed with private key or Client secret as jwt, it is requir
 
 If the user is unauthenticated in the IDP, the client still receives a `login_required` error. If the user is authentic in the IDP, the client can still receive an `interaction_required` error if {project_name} must display authentication pages that require user interaction. This authentication includes required actions (for example, password change), consent screens, and screens set to display by the `first broker login` flow or `post broker login` flow.
 
+|Requires short state parameter
+|This switch needs to be enabled if identity provider does not support long value of the `state` parameter sent in the initial OIDC authentication request (EG. more than 100 characters). In this case, {project_name} will try to make shorter `state` parameter and may omit some client data to be sent in the initial request. This may result in the limited functionality in some very corner case scenarios (EG. in case that IDP redirects to {project_name} with the error in the OIDC authentication response, {project_name} might need to display error page instead of being able to redirect to the client in case that login session is expired).
+
 |Validate Signatures
 |Specifies if {project_name} verifies signatures on the external ID Token signed by this IDP. If *ON*, {project_name} must know the public key of the external OIDC IDP. For performance purposes, {project_name} caches the public key of the external OIDC identity provider.
 
@@ -82,4 +85,4 @@ If the user is unauthenticated in the IDP, the client still receives a `login_re
 
 You can import all this configuration data by providing a URL or file that points to OpenID Provider Metadata. If you connect to a {project_name} external IDP, you can import the IDP settings from `<root>{kc_realms_path}/{realm-name}/.well-known/openid-configuration`. This link is a JSON document describing metadata about the IDP.
 
-If you want to use https://datatracker.ietf.org/doc/html/rfc7516[Json Web Encryption (JWE)] ID Tokens or UserInfo responses in the provider, the IDP needs to know the public key to use with {project_name}. The provider uses the <<realm_keys, realm keys>> defined for the different encryption algorithms to decrypt the tokens. {project_name} provides a standard xref:con-server-oidc-uri-endpoints_{context}[JWKS endpoint] which the IDP can use for downloading the keys automatically.
\ No newline at end of file
+If you want to use https://datatracker.ietf.org/doc/html/rfc7516[Json Web Encryption (JWE)] ID Tokens or UserInfo responses in the provider, the IDP needs to know the public key to use with {project_name}. The provider uses the <<realm_keys, realm keys>> defined for the different encryption algorithms to decrypt the tokens. {project_name} provides a standard xref:con-server-oidc-uri-endpoints_{context}[JWKS endpoint] which the IDP can use for downloading the keys automatically.
diff --git a/docs/documentation/server_admin/topics/identity-broker/social/gitlab.adoc b/docs/documentation/server_admin/topics/identity-broker/social/gitlab.adoc
index 25374cf65c12..57bb0fe3bbc9 100644
--- a/docs/documentation/server_admin/topics/identity-broker/social/gitlab.adoc
+++ b/docs/documentation/server_admin/topics/identity-broker/social/gitlab.adoc
@@ -9,7 +9,7 @@
 image:images/gitlab-add-identity-provider.png[Add Identity Provider]
 +
 . Copy the value of *Redirect URI* to your clipboard.
-. In a separate browser tab, https://docs.gitlab.com/ee/integration/oauth_provider.html[add a new GitLab application].
+. In a separate browser tab, https://docs.gitlab.com/integration/oauth_provider/[add a new GitLab application].
 .. Use the *Redirect URI* in your clipboard as the *Redirect URI*.
 .. Note the *Application ID* and *Secret* when you save the application.
 . In {project_name}, paste the value of the `Application ID` into the *Client ID* field.
diff --git a/docs/documentation/server_admin/topics/identity-broker/social/instagram.adoc b/docs/documentation/server_admin/topics/identity-broker/social/instagram.adoc
index 598efa96a69b..ab21a32cb94a 100644
--- a/docs/documentation/server_admin/topics/identity-broker/social/instagram.adoc
+++ b/docs/documentation/server_admin/topics/identity-broker/social/instagram.adoc
@@ -1,6 +1,9 @@
 
 ==== Instagram
 
+IMPORTANT: The Instagram Identity Broker is deprecated for removal. Prefer using the Facebook Identity Broker instead.
+To enable it, start the server with `--features=instagram-broker`.
+
 .Procedure
 . Click *Identity Providers* in the menu.
 . From the *Add provider* list, select *Instagram*.
@@ -25,7 +28,7 @@ image:images/meta-select-app-type.png[Select an app type]
 .Create an app
 image:images/meta-create-app.png[Create an app]
 +
-.. Fill in all required fields. 
+.. Fill in all required fields.
 .. Click *Create app*. Meta then brings you to the dashboard.
 .. In the navigation panel, select *App settings* - *Basic*.
 .. Select *+ Add Platform* at the bottom of the page.
diff --git a/docs/documentation/server_admin/topics/identity-broker/social/openshift.adoc b/docs/documentation/server_admin/topics/identity-broker/social/openshift.adoc
index 1fc37c0bd2ab..37114423f737 100644
--- a/docs/documentation/server_admin/topics/identity-broker/social/openshift.adoc
+++ b/docs/documentation/server_admin/topics/identity-broker/social/openshift.adoc
@@ -5,7 +5,19 @@
 . A {project_name} server configured in order to use the truststore. For more information, see the https://www.keycloak.org/server/keycloak-truststore[Configuring a Truststore] {section}.
 
 .Procedure
-. Click *Identity Providers* in the menu.
+. Locate the Openshift 4 instance's API URL by using this command:
++
+[source,bash,subs=+attributes]
+----
+oc cluster-info
+----
+. Look for the URL in a line that has this format:
++
+[source,bash,subs=+attributes]
+----
+Kubernetes master is running at https://api.<your-openshift-domain>:6443
+----
+. In the Admin Console, click *Identity Providers* in the menu.
 . From the *Add provider* list, select *Openshift v4*.
 . Enter the *Client ID* and *Client Secret* and in the *Base URL* field, enter the API URL of your OpenShift 4 instance. Additionally, you can copy the *Redirect URI* to your clipboard.
 +
diff --git a/docs/documentation/server_admin/topics/login-settings/forgot-password.adoc b/docs/documentation/server_admin/topics/login-settings/forgot-password.adoc
index c41bc808b783..5b37e6e9feca 100644
--- a/docs/documentation/server_admin/topics/login-settings/forgot-password.adoc
+++ b/docs/documentation/server_admin/topics/login-settings/forgot-password.adoc
@@ -27,7 +27,7 @@ image:images/forgot-password-page.png[Forgot Password Page]
 
 The text sent in the email is configurable. See link:{developerguide_link}[{developerguide_name}] for more information.
 
-When users click the email link, {project_name} asks them to update their password, and if they have set up an OTP generator, {project_name} asks them to reconfigure the OTP generator.  Depending on security requirements of your organization, you may not want users to reset their OTP generator through email. 
+When users click the email link, {project_name} asks them to update their password, and if they have set up an OTP generator, {project_name} asks them to reconfigure the OTP generator. For security reasons, the flow forces federated users to login again after the reset credentials and keeps internal database users logged in if the same authentication session (same browser) is used. Depending on the security requirements of your organization, you can change the default behavior.
 
 To change this behavior, perform these steps:
 
@@ -40,6 +40,11 @@ To change this behavior, perform these steps:
 image:images/reset-credentials-flow.png[Reset Credentials Flow]
 +
 If you do not want to reset the OTP, set the `Reset - Conditional OTP` sub-flow requirement to *Disabled*.
++
+.Send Reset Email Configuration
+image:images/reset-credential-email-config.png[Send Reset Email Configuration]
++
+If you want to change default behavior for the force login option, click the *Send Reset Email* settings icon in the flow, define an *Alias*, and select the best *Force login after reset* option for you (`true`, always force re-authentication, `false`, keep the user logged in if the same browser was used, `only-federated`, default value that forces login again only for federated users).
 . Click *Authentication* in the menu.
 . Click the *Required actions* tab.
 . Ensure *Update Password* is enabled.
diff --git a/docs/documentation/server_admin/topics/oid4vci/vc-issuer-configuration.adoc b/docs/documentation/server_admin/topics/oid4vci/vc-issuer-configuration.adoc
new file mode 100644
index 000000000000..de285d885ea4
--- /dev/null
+++ b/docs/documentation/server_admin/topics/oid4vci/vc-issuer-configuration.adoc
@@ -0,0 +1,474 @@
+[[_oid4vci]]
+== Configuring {project_name} as a Verifiable Credential Issuer
+
+[IMPORTANT]
+====
+This is an experimental feature and should not be used in production. Backward compatibility is not guaranteed, and future updates may introduce breaking changes.
+====
+
+{project_name} provides experimental support for https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html[OpenID for Verifiable Credential Issuance].
+
+=== Introduction
+
+This chapter provides step-by-step instructions for configuring {project_name} as a Verifiable Credential Issuer using the OpenID for Verifiable Credential Issuance (OID4VCI) protocol. It outlines the process for setting up a {project_name} instance to securely issue and manage Verifiable Credentials (VCs), supporting decentralized identity solutions.
+
+=== What are Verifiable Credentials (VCs)?
+
+Verifiable Credentials (VCs) are cryptographically signed, tamper-evident data structures that represent claims about an entity, such as a person, organization, or device. They are foundational to decentralized identity systems, allowing secure and privacy-preserving identity verification without reliance on centralized authorities. VCs support advanced features like selective disclosure and zero-knowledge proofs, enhancing user privacy and security.
+
+=== What is OID4VCI?
+
+OpenID for Verifiable Credential Issuance (OID4VCI) is an extension of the OpenID Connect (OIDC) protocol. It defines a standardized, interoperable framework for credential issuers to deliver VCs to holders, who can then present them to verifiers. OID4VCI leverages {project_name}'s existing authentication and authorization capabilities to streamline VC issuance.
+
+=== Scope of This Chapter
+
+This chapter covers the following technical configurations:
+
+- Creating a dedicated realm for VC issuance.
+- Setting up a test user for credential testing.
+- Configuring custom cryptographic keys for signing and encrypting VCs.
+- Defining realm attributes to specify VC metadata.
+- Establishing client scopes and mappers to include user attributes in VCs.
+- Registering a client to handle VC requests.
+- Verifying the configuration using the issuer metadata endpoint.
+
+=== Prerequisites
+
+Ensure the following requirements are met before configuring {project_name} as a Verifiable Credential Issuer:
+
+=== {project_name} Instance
+
+A running {project_name} server with the OID4VCI feature enabled.
+
+To enable the feature, add the following flag to the startup command:
+
+[source,bash]
+----
+--features=oid4vc-vci
+----
+
+Verify activation by checking the server logs for the `OID4VC_VCI` initialization message.
+
+=== Configuring Credential Issuance in Keycloak
+
+In {project_name}, Verifiable Credentials are managed through *ClientScopes*, with each ClientScope representing a single Verifiable Credential type. To enable the issuance of a credential, the corresponding ClientScope must be assigned to an OpenID Connect client - ideally as *optional*.
+
+During the OAuth2 authorization process, the credential-specific scope can be requested by including the ClientScope's name in the `scope` parameter of the authorization request. Once the user has successfully authenticated, the resulting Access Token *MUST* include the requested ClientScope in its `scope` claim. To ensure this, make sure the ClientScope option *Include in token scope* is enabled.
+
+With this Access Token, the Verifiable Credential can be issued at the Credential Endpoint.
+
+=== Authentication
+
+An access token is required to authenticate API requests.
+
+Refer to the following {project_name} documentation sections for detailed steps on:
+
+- <<proc-creating-oidc-client_{context},Creating a Client>>
+- <<_oidc-auth-flows-direct, Obtaining an Access Token>>
+
+=== Configuration Steps
+
+Follow these steps to configure {project_name} as a Verifiable Credential Issuer. Each section is detailed with procedures, explanations, and examples where applicable.
+
+=== Creating a Realm
+
+A realm in {project_name} is a logical container that manages users, clients, roles, and authentication flows.
+For Verifiable Credential (VC) issuance, create a dedicated realm to ensure isolation and maintain a clear separation of functionality.
+
+[NOTE]
+====
+For detailed instructions on creating a realm, refer to the {project_name} documentation:
+<<proc-creating-a-realm_{context},Creating a Realm>>.
+====
+
+=== Creating a User Account
+
+A test user is required to simulate credential issuance and verify the setup.
+
+[NOTE]
+====
+For step-by-step instructions on creating a user, refer to the {project_name} documentation:
+<<assembly-managing-users_{context},Creating a User>>.
+====
+
+Ensure that the user has a valid username, email, and password. If the password should not be reset upon first login, disable the "Temporary" toggle during password configuration.
+
+=== Key Management Configuration
+
+{project_name} uses cryptographic keys for signing and encrypting Verifiable Credentials (VCs). To ensure secure and standards-compliant issuance, configure **ECDSA (ES256) for signing**, **RSA (RS256) for signing**, and **RSA-OAEP for encryption** using a keystore.
+
+[NOTE]
+====
+For a detailed guide on configuring realm keys, refer to the {project_name} documentation:
+<<realm_keys,Managing Realm Keys>>.
+====
+
+==== Configuring Key Providers
+
+To enable cryptographic operations for VC issuance:
+
+- **ECDSA (ES256) Key**: Used for signing VCs with the ES256 algorithm.
+- **RSA (RS256) Key**: Alternative signing mechanism using RS256.
+- **RSA-OAEP Key**: Used for encrypting sensitive data in VCs.
+
+Each key must be registered as a **java-keystore provider** within the **Realm Settings** > **Keys** section, ensuring:
+- The keystore file is correctly specified and securely stored.
+- The appropriate algorithm (ES256, RS256, or RSA-OAEP) is selected.
+- The key is active, enabled, and configured with the correct usage (signing or encryption).
+- Priority values are set to define precedence among keys.
+
+[WARNING]
+====
+Ensure the keystore file is **securely stored** and accessible to the {project_name} server. Use **strong passwords** to protect both the keystore and the private keys.
+====
+
+=== Registering Realm Attributes
+
+Realm attributes define metadata for Verifiable Credentials (VCs), such as **expiration times, supported formats, and scope definitions**. These attributes allow {project_name} to issue VCs with predefined settings.
+
+Since the **{project_name} Admin Console does not support direct attribute creation**, use the **{project_name} Admin REST API** to configure these attributes.
+
+==== Define Realm Attributes
+
+Create a JSON file (e.g., `realm-attributes.json`) with the following content:
+
+[source,json]
+----
+{
+  "realm": "oid4vc-vci",
+  "enabled": true,
+  "attributes": {
+    "preAuthorizedCodeLifespanS": 120
+  }
+}
+----
+
+==== Attribute Breakdown
+
+The attributes section contains issuer-specific metadata:
+- **preAuthorizedCodeLifespanS** – Defines how long pre-authorized codes remain valid (in seconds).
+
+==== Import Realm Attributes
+
+Use the following `curl` command to import the attributes into {project_name}:
+
+[source,bash]
+----
+curl -X PUT "https://localhost:8443/admin/realms/oid4vc-vci" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d @realm-attributes.json
+----
+
+[NOTE]
+====
+- Replace `$ACCESS_TOKEN` with a valid **{project_name} Admin API access token**.
+- **Avoid using `-k` in production**; instead, configure a **trusted TLS certificate**.
+====
+
+=== Create Client Scopes with Mappers
+
+Client scopes define **which user attributes** are included in Verifiable Credentials (VCs). Therefore, they are considered the Verifiable Credential configuration itself. These scopes use **protocol mappers** to map specific claims into VCs and the protocol mappers will also contain the corresponding metadata for claims that is displayed at the Credential Issuer Metadata Endpoint.
+
+You can create the ClientScopes using the {project_name} web Administration Console, but the web Administration Console does not yet support adding metadata configuration. For metadata configuration, you will need to use the Admin REST API.
+
+==== Define a Client Scope with a Mapper
+
+Create a JSON file (e.g., `client-scopes.json`) with the following content:
+
+[source,json]
+----
+{
+  "name": "vc-scope-mapping",
+  "protocol": "oid4vc",
+  "attributes": {
+    "include.in.token.scope": "true",
+    "vc.issuer_did": "did:web:vc.example.com",
+    "vc.credential_configuration_id": "my-credential-configuration-id",
+    "vc.credential_identifier": "my-credential-identifier",
+    "vc.format": "jwt_vc",
+    "vc.expiry_in_seconds": 31536000,
+    "vc.verifiable_credential_type": "my-vct",
+    "vc.supported_credential_types": "credential-type-1,credential-type-2",
+    "vc.credential_contexts": "context-1,context-2",
+    "vc.proof_signing_alg_values_supported": "ES256",
+    "vc.cryptographic_binding_methods_supported": "jwk",
+    "vc.signing_key_id": "key-id-123456",
+    "vc.display": "[{\"name\": \"IdentityCredential\", \"logo\": {\"uri\": \"https://university.example.edu/public/logo.png\", \"alt_text\": \"a square logo of a university\"}, \"locale\": \"en-US\", \"background_color\": \"#12107c\", \"text_color\": \"#FFFFFF\"}]",
+    "vc.sd_jwt.number_of_decoys": "2",
+    "vc.credential_build_config.sd_jwt.visible_claims": "iat,jti,nbf,exp,given_name",
+    "vc.credential_build_config.hash_algorithm": "SHA-256",
+    "vc.credential_build_config.token_jws_type": "JWS",
+    "vc.include_in_metadata": "true"
+  },
+  "protocolMappers": [
+    {
+      "name": "academic_title-mapper-bsk",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-static-claim-mapper",
+      "config": {
+        "claim.name": "academic_title",
+        "staticValue": "N/A"
+      }
+    },
+    {
+      "name": "givenName",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-user-attribute-mapper",
+      "config": {
+        "claim.name": "given_name",
+        "userAttribute": "firstName",
+        "vc.mandatory": "false",
+        "vc.display": "[{\"name\": \"الاسم الشخصي\", \"locale\": \"ar-SA\"}, {\"name\": \"Vorname\", \"locale\": \"de-DE\"}, {\"name\": \"Given Name\", \"locale\": \"en-US\"}, {\"name\": \"Nombre\", \"locale\": \"es-ES\"}, {\"name\": \"نام\", \"locale\": \"fa-IR\"}, {\"name\": \"Etunimi\", \"locale\": \"fi-FI\"}, {\"name\": \"Prénom\", \"locale\": \"fr-FR\"}, {\"name\": \"पहचानी गई नाम\", \"locale\": \"hi-IN\"}, {\"name\": \"Nome\", \"locale\": \"it-IT\"}, {\"name\": \"名\", \"locale\": \"ja-JP\"}, {\"name\": \"Овог нэр\", \"locale\": \"mn-MN\"}, {\"name\": \"Voornaam\", \"locale\": \"nl-NL\"}, {\"name\": \"Nome Próprio\", \"locale\": \"pt-PT\"}, {\"name\": \"Förnamn\", \"locale\": \"sv-SE\"}, {\"name\": \"مسلمان نام\", \"locale\": \"ur-PK\"}]"
+      }
+    }
+  ]
+}
+----
+
+[NOTE]
+====
+This is a **sample configuration**.
+You can define **additional protocol mappers** to support different claim mappings, such as:
+
+- Dynamic attribute values instead of static ones.
+- Mapping multiple attributes per credential type.
+- Alternative supported credential types.
+====
+
+From the example above:
+
+- It is important to set `include.in.token.scope=true`, see <<include.in.token.scope, Attribute table: include.in.token.scope>>.
+- Most of the named attributes above are optional. See below: <<client-scope-attribute-breakdown,Attribute Breakdown>>.
+- You can determine the appropriate `protocolMapper` names by first creating them through the Web Administration Console and then retrieving their definitions via the Admin REST API.
+
+==== Attribute Breakdown - ClientScope [[client-scope-attribute-breakdown]]
+
+[cols="1,1,2", options="header"]
+|===
+| Property
+| Required
+| Description / Default
+
+| `name`
+| required
+| Name of the client scope.
+
+| `protocol`
+| required
+| Protocol used by the client scope. Use `oid4vc` for OpenID for Verifiable Credential Issuance, which is an OAuth2 extension (like `openid-connect`).
+
+| `include.in.token.scope`
+| required
+| [[include.in.token.scope]] This value MUST be `true`. It ensures that the scope’s name is included in the `scope` claim of the issued Access Token.
+
+| `protocolMappers`
+| optional
+| Defines how claims are mapped into the credential and how metadata is exposed via the issuer’s metadata endpoint.
+
+| `vc.issuer_did`
+| optional
+| The Decentralized Identifier (DID) of the issuer. +
+_Default_: `$\{name}`
+
+| `vc.credential_configuration_id`
+| optional
+| The credentials configuration ID. +
+_Default_: `$\{name}+`
+
+| `vc.credential_identifier`
+| optional
+| The credentials identifier. +
+_Default_: `$\{name}+`
+
+| `vc.format`
+| optional
+| Defines the VC format (e.g., `jwt_vc`). +
+_Default_: `vc+sd-jwt`
+
+| `vc.verifiable_credential_type`
+| optional
+| The Verifiable Credential Type (VCT). +
+_Default_: `$\{name}+`
+
+| `vc.supported_credential_types`
+| optional
+| The type values of the Verifiable Credential Type. +
+_Default_: `$\{name}+`
+
+| `vc.credential_contexts`
+| optional
+| The context values of the Verifiable Credential Type. +
+_Default_: `$\{name}+`
+
+| `vc.proof_signing_alg_values_supported`
+| optional
+| Supported signature algorithms for this credential. +
+_Default_: All present keys supporting JWS algorithms in the realm.
+
+| `vc.cryptographic_binding_methods_supported`
+| optional
+| Supported cryptographic methods (if applicable). +
+_Default_: `jwk`
+
+| `vc.signing_key_id`
+| optional
+| The ID of the key to sign this credential. +
+_Default_: _none_
+
+| `vc.display`
+| optional
+| Display information shown in the user's wallet about the issued credential. +
+_Default_: _none_
+
+| `vc.sd_jwt.number_of_decoys`
+| optional
+| Used only with format `vc+sd-jwt`. Number of decoy hashes in the SD-JWT. +
+_Default_: `10`
+
+| `vc.credential_build_config.sd_jwt.visible_claims`
+| optional
+| Used only with format `vc+sd-jwt`. Claims always disclosed in the SD-JWT body. +
+_Default_: `id,iat,nbf,exp,jti`
+
+| `vc.credential_build_config.hash_algorithm`
+| optional
+| Hash algorithm used before signing the credential. +
+_Default_: `SHA-256`
+
+| `vc.credential_build_config.token_jws_type`
+| optional
+| JWT type written into the `typ` header of the token. +
+_Default_: `JWS`
+
+| `vc.expiry_in_s`
+| optional
+| Credential expiration time in seconds. +
+_Default_: `31536000` (one year)
+
+| `vc.include_in_metadata`
+| optional
+| If this claim should be listed in the credentials metadata. +
+_Default_: `true` but depends on the mapper-type. Claims like `jti`, `nbf`, `exp`, etc. are set to `false` by default.
+|===
+
+==== Attribute Breakdown - ProtocolMappers
+
+- **name** – Mapper identifier.
+- **protocol** – Must be `oid4vc` for Verifiable Credentials.
+- **protocolMapper** – Specifies the claim mapping strategy (e.g., `oid4vc-static-claim-mapper`).
+- **config**: contains the protocol-mappers specific attributes.
+
+Most claims are dependent on the `protocolMapper`-value, but there are also commonly used claims available for all ProtocolMappers:
+
+[cols="1,1,2", options="header"]
+|===
+| Property
+| Required
+| Description / Default
+
+| `claim.name`
+| required
+| The name of the attribute that will be added into the Verifiable Credential. +
+_Default_: _none_
+
+| `userAttribute`
+| required
+| The name of the users-attribute that will be used to map the value into the `claim.name` of the Verifiable Credential. +
+_Default_: _none_
+
+| `vc.mandatory`
+| optional
+| If the credential must be issued with this claim. +
+_Default_: `false`
+
+| `vc.display`
+| optional
+| Metadata information that is displayed at the credential-issuer metadata-endpoint. +
+_Default_: _none_
+|===
+
+==== Import the Client Scope
+
+Use the following `curl` command to import the client scope into {project_name}:
+
+[source,bash]
+----
+curl -X POST "https://localhost:8443/admin/realms/oid4vc-vci/client-scopes" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d @client-scopes.json
+----
+
+[NOTE]
+====
+- Replace `$ACCESS_TOKEN` with a valid **{project_name} Admin API access token**.
+- **Avoid using `-k` in production**; instead, configure a **trusted TLS certificate**.
+- If updating an existing scope, use `PUT` instead of `POST`.
+====
+
+=== Create the Client
+
+Set up a client to handle Verifiable Credential (VC) requests and assign the necessary scopes.
+The client does not differ from regular OpenID Connect clients — with one exception: it must have the appropriate **optional ClientScopes** assigned that define the Verifiable Credentials it is allowed to issue.
+
+. Create a JSON file (e.g., `oid4vc-rest-api-client.json`) with the following content:
++
+[source,json]
+----
+{
+  "clientId": "oid4vc-rest-api",
+  "enabled": true,
+  "protocol": "openid-connect",
+  "publicClient": false,
+  "serviceAccountsEnabled": true,
+  "clientAuthenticatorType": "client-secret",
+  "redirectUris": ["http://localhost:8080/*"],
+  "directAccessGrantsEnabled": true,
+  "defaultClientScopes": ["profile"],
+  "optionalClientScopes": ["vc-scope-mapping"],
+  "attributes": {
+    "client.secret.creation.time": "1719785014",
+    "client.introspection.response.allow.jwt.claim.enabled": "false",
+    "login_theme": "keycloak",
+    "post.logout.redirect.uris": "http://localhost:8080"
+  }
+}
+----
++
+- **clientId**: Unique identifier for the client.
+- **optionalClientScopes**: Links the `vc-scope-mapping` scope for VC requests.
+
+. Import the client using the following `curl` command:
++
+[source,bash]
+----
+curl -k -X POST "https://localhost:8443/admin/realms/oid4vc-vci/clients" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d @oid4vc-rest-api-client.json
+----
+
+=== Verify the Configuration
+
+Validate the setup by accessing the **issuer metadata endpoint**:
+
+. Open a browser or use a tool like `curl` to visit:
++
+[source,bash]
+----
+https://localhost:8443/realms/oid4vc-vci/.well-known/openid-credential-issuer
+----
+
+A successful response returns a JSON object containing details such as:
+- **Supported claims**
+- **Credential formats**
+- **Issuer metadata**
+
+=== Conclusion
+
+You have successfully configured **{project_name} as a Verifiable Credential Issuer** using the **OID4VCI protocol**.
+This setup leverages {project_name}'s robust **identity management capabilities** to issue secure, **standards-compliant VCs**.
+
+For a **complete reference implementation**, see the sample project:
+https://github.com/adorsys/{project_name}-ssi-deployment/tree/main[{project_name} SSI Deployment^].
diff --git a/docs/documentation/server_admin/topics/organizations/authenticating-members.adoc b/docs/documentation/server_admin/topics/organizations/authenticating-members.adoc
index 7a273e26d71d..80caa3edaaf6 100644
--- a/docs/documentation/server_admin/topics/organizations/authenticating-members.adoc
+++ b/docs/documentation/server_admin/topics/organizations/authenticating-members.adoc
@@ -106,6 +106,18 @@ Change the *first broker login* flow by following these steps:
 .Organizations first broker flow
 image:images/organizations-first-broker-flow.png[alt="Organizations first broker flow"]
 
-
 You should now be able to authenticate using any identity provider associated with an organization
 and have the user joining the organization as a member as soon as they complete the first browser login flow.
+
+== Configuring how users authenticate
+
+If the flow supports organizations, you can configure some of the steps to change how users authenticate to the realm.
+
+For example, some use cases will require users to authenticate to a realm only if they are a member of any or a specific organization in the realm.
+
+To enable this behavior, you need to enable the `Requires user membership` setting on the `Organization Identity-First Login` execution step by clicking on its settings.
+
+If enabled, and after the user provides the username or email in the identity-first login page, the server will
+try to resolve a organization where the user is a member by looking at any existing membership or based on the semantics of the <<_mapping_organization_claims_,organization>> scope,
+if requested by the client. If not a member of an organization, an error page will be shown.
+
diff --git a/docs/documentation/server_admin/topics/organizations/managing-identity-providers.adoc b/docs/documentation/server_admin/topics/organizations/managing-identity-providers.adoc
index f03caddf8441..103417681284 100644
--- a/docs/documentation/server_admin/topics/organizations/managing-identity-providers.adoc
+++ b/docs/documentation/server_admin/topics/organizations/managing-identity-providers.adoc
@@ -43,14 +43,16 @@ Hide on login page::
 If this identity provider should be hidden in login pages when the user is authenticating in the scope of the organization.
 
 Redirect when email domain matches::
-If members should be automatically redirected to the identity provider when their email domain matches the domain set to the identity provider.
+If members should be automatically redirected to the identity provider when their email domain matches the domain set to the identity provider. If the domain is set to `Any`, members whose email domain matches *any* of the organization domains will be redirected to the identity provider.
+
+If the org is linked with multiple identity providers, the organization authenticator prioritizes the provider that matches the email domain of the user for automatic redirection. If none is found, it tries to locate one whose domain is set to `Any`.
 
 Once linked to an organization, the identity provider can be managed just like any other in a realm by accessing the *Identity Providers* section in the menu. However, the options herein described are only available when managing the identity provider in the scope of an organization. The only exception is the
  *Hide on login page* option that is present here for convenience.
 
 == Editing a linked identity provider
 
-You can edit any of the organization-related settings of a linked identity provider at any time. 
+You can edit any of the organization-related settings of a linked identity provider at any time.
 
 .Procedure
 
diff --git a/docs/documentation/server_admin/topics/organizations/managing-members.adoc b/docs/documentation/server_admin/topics/organizations/managing-members.adoc
index 3b52c6b08354..8fbfea10833a 100644
--- a/docs/documentation/server_admin/topics/organizations/managing-members.adoc
+++ b/docs/documentation/server_admin/topics/organizations/managing-members.adoc
@@ -121,3 +121,9 @@ When removing a member from an organization, remember that the user may or may n
 that user is managed or unmanaged member, respectively.
 
 For more details, see <<_managed_unmanaged_members_,Managed and unmanaged members>>.
+
+== Support for federated members
+
+Users coming from federated providers can also be added as members of an organization. The only exceptions are the users from LDAP providers with *import mode disabled*. Organization members are added to an internal group that is not synchronized with external providers, so even if the LDAP provider has a group mapper with mode LDAP_ONLY it won't be possible for the non-imported users to be added as members of an organization because that membership won't be synced with the LDAP server.
+
+In other words, LDAP users that are not imported can't join an organization because the membership is not stored in the local DB nor in the LDAP server. So if you want to have LDAP users joining organizations, ensure that the import mode of the LDAP provider is enabled.
diff --git a/docs/documentation/server_admin/topics/organizations/mapping-organization-claims.adoc b/docs/documentation/server_admin/topics/organizations/mapping-organization-claims.adoc
index 4dec2ba77c88..0e4f9fa0fe18 100644
--- a/docs/documentation/server_admin/topics/organizations/mapping-organization-claims.adoc
+++ b/docs/documentation/server_admin/topics/organizations/mapping-organization-claims.adoc
@@ -1,5 +1,6 @@
 [id="mapping-organization-claims_{context}"]
 
+[[_mapping_organization_claims_]]
 =  Mapping organization claims
 [role="_abstract"]
 To map organization-specific claims into tokens, a client needs to request the *organization* scope when sending
diff --git a/docs/documentation/server_admin/topics/realms/email.adoc b/docs/documentation/server_admin/topics/realms/email.adoc
index aa94bac7186b..43372b78ebfb 100644
--- a/docs/documentation/server_admin/topics/realms/email.adoc
+++ b/docs/documentation/server_admin/topics/realms/email.adoc
@@ -41,4 +41,93 @@ Encryption::
   Tick one of these checkboxes to support sending emails for recovering usernames and passwords, especially if the SMTP server is on an external network. You will most likely need to change the *Port* to 465, the default port for SSL/TLS.
 
 Authentication::
-  Set this switch to *ON* if your SMTP server requires authentication. When prompted, supply the *Username* and *Password*. The value of the *Password* field can refer a value from an external <<_vault-administration,vault>>.
+  Set this switch to *ON* if your SMTP server requires authentication.
+
+Username::
+  All authentication-mechanisms require a username.
+
+Authentication Type::
+  Choose the kind of authentication: 'password' or 'token'.
+
+Password::
+  Only needed when *Authentication Type* 'password' is selected.
+  Supply the *Password*. The value of the *Password* field can refer a value from an external <<_vault-administration,vault>>.
+
+Auth Token URL::
+  Only needed when *Authentication Type* 'token' is selected.
+  Supply the *Auth Token URL* that is used to fetch a token via client credentials grant.
+
+Auth Token Scope::
+  Only needed when *Authentication Type* 'token' is selected.
+  Supply the *Auth Token Scope* that is used to fetch a token from the *Auth Token URL*.
+
+Auth Token ClientId::
+  Only needed when *Authentication Type* 'token' is selected.
+  Supply the *Auth ClientId* that is used to fetch a token from the *Auth Token URL*.
+
+Auth Token Client Secret::
+  Only needed when *Authentication Type* 'token' is selected.
+  Supply the *Auth Client Secret* that authenticates the client to fetch a token from the *Auth Token URL*. The value of the *Auth Client Secret* field can refer a value from an external <<_vault-administration,vault>>.
+
+ifeval::[{project_community}==true]
+
+== XOAUTH2 email configuration with third-party vendors
+
+The following section contains some hints on how to configure {project_name} email settings to use XOAUTH2 based authentication with some known third-party software SMTP servers.
+
+NOTE: This section has been contributed by the Keycloak community. As the Keycloak core team does not have means to test third-party providers, it is provided as-is. If you find this documentation outdated or incomplete, please contribute to improve it.
+
+=== Configuration for Microsoft Azure and Office365
+
+Microsoft Azure allows 'Client Credentials Grant' using a client secret to gather an access token.
+Microsoft Office365 supports SMTP with XOAUTH2 to authenticate with the gathered token.
+
+Links to relevant Microsoft documentation:
+
+- https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac[Usage of role base access control for applications in exchange online]
+- Settings in https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth[Authenticate an IMAP, POP or SMTP connection using OAuth]
+
+The following method for setting up {project_name} to send email with Azure and Office365 has been verified by a test.
+There might be other variants to achieve the same depending on your environment.
+
+From::
+`<some>@<domain>`
+
+Host::
+`smtp.office365.com`
+
+Port::
+`587`
+
+Encryption::
+Check Start TLS
+
+Username::
+`<some>@<domain>` (might be the same of a different value than the sender value)
+
+Auth Token Url::
+`+https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token+`
++
+Replace TenantID with the id of your Microsoft tenant, usually a UUID, in Azure or just copy the token url from the list of endpoints displayed in the Azure Console.
+
+Auth Token Scope::
+`+https://outlook.office.com/.default+`
+
+Auth Token ClientId::
+`<ApplicationId>`
++
+Replace ApplicationId with the id of your application in Azure, usually a UUID.
+
+Auth Token ClientSecret::
+`<Secret configured>`
+
+=== Configuration for Google Mail
+
+This feature is not yet supported by {project_name}, because Google does not allow client-secrets for the Client Credentials Grant.
+
+=== Configuration for AWS
+
+XOAUTH2 is not supported by the AWS-SMTP service.
+The AWS-service requires the use of a password.
+
+endif::[]
diff --git a/docs/documentation/server_admin/topics/realms/proc-creating-a-realm.adoc b/docs/documentation/server_admin/topics/realms/proc-creating-a-realm.adoc
index 633e4a2c59d6..07fc870acd4d 100644
--- a/docs/documentation/server_admin/topics/realms/proc-creating-a-realm.adoc
+++ b/docs/documentation/server_admin/topics/realms/proc-creating-a-realm.adoc
@@ -11,13 +11,8 @@ realm and only be able to interact with customer-facing apps.
 
 .Procedure
 
-. Click *{project_name}* next to *master realm*, then click *Create Realm*.
-+
-.Add realm menu
-image:images/add-realm-menu.png[Add realm menu]
-
+. In the Admin Console, click *Create Realm* next to *Current realm*.
 . Enter a name for the realm.
-
 . Click *Create*.
 +
 .Create realm
diff --git a/docs/documentation/server_admin/topics/realms/proc-using-admin-console.adoc b/docs/documentation/server_admin/topics/realms/proc-using-admin-console.adoc
index 0c4199c52b62..c2a917f9e040 100644
--- a/docs/documentation/server_admin/topics/realms/proc-using-admin-console.adoc
+++ b/docs/documentation/server_admin/topics/realms/proc-using-admin-console.adoc
@@ -4,30 +4,44 @@ You configure realms and perform most administrative tasks in the {project_name}
 
 .Prerequisites
 
-* You need an administrator account.  See xref:creating-first-admin_{context}[Creating the first administrator].
+To use the Admin Console, you need an administrator account.
+
+* If no administrators exist, see xref:creating-first-admin_{context}[Creating the first administrator].
+* If other administrators exist, ask an administrator to provide an account with privileges to manage realms.
 
 .Procedure
 
 . Go to the URL for the Admin Console.
 +
 For example, for localhost, use this URL: http://localhost:8080{kc_admins_path}/
+
+. Enter the username and password you created on the Welcome Page or through environment variables as described in https://www.keycloak.org/server/configuration#_creating_the_initial_admin_user[Creating the initial admin user].
 +
 .Login page
 image:images/login-page.png[Login page]
-
-. Enter the username and password you created on the Welcome Page or through environment variables as per https://www.keycloak.org/server/configuration#_creating_the_initial_admin_user[Creating the initial admin user] guide.
++
 This action displays the Admin Console.
 +
 .Admin Console
 image:images/admin-console.png[Admin Console]
 
 . Note the menus and other options that you can use:
-+
-* Click the menu labeled *Master* to pick a realm you want to manage or to create a new one.
-+
+
+* Click the *Current realm* to see if other realms are available to be managed.
+
+* Click *Create realm* to create another realm that you can manage.
+
 * Click the top right list to view your account or log out.
+
+. Click *Realm settings* in the menu to see the fields and options for this realm.
++
+Click a question mark *?* icon to show the definition of a field such as *Frontend URL*.
+
 +
-* Hover over a question mark *?* icon to show a tooltip text that describes that field. The image above shows the tooltip in action.
-* Click a question mark *?* icon to show a tooltip text that describes that field. The image above shows the tooltip in action.
+.Realm settings
+image:images/realm-settings.png[Realm settings]
 
-NOTE: Export files from the Admin Console are not suitable for backups or data transfer between servers. Only boot-time exports are suitable for backups or data transfer between servers.
+[NOTE]
+====
+Export files from the Admin Console are not suitable for backups or data transfer between servers. Only boot-time exports are suitable for backups or data transfer between servers.
+====
\ No newline at end of file
diff --git a/docs/documentation/server_admin/topics/realms/themes.adoc b/docs/documentation/server_admin/topics/realms/themes.adoc
index 44a66b170e38..18807dbd626b 100644
--- a/docs/documentation/server_admin/topics/realms/themes.adoc
+++ b/docs/documentation/server_admin/topics/realms/themes.adoc
@@ -5,7 +5,7 @@ For a given realm, you can change the appearance of any UI in {project_name} by
 
 .Procedure
 
-. Click *Realm setting* in the menu.
+. Click *Realm settings* in the menu.
 . Click the *Themes* tab.
 +
 .Themes tab
diff --git a/docs/documentation/server_admin/topics/roles-groups/con-role-scope-mappings.adoc b/docs/documentation/server_admin/topics/roles-groups/con-role-scope-mappings.adoc
index 25be92fb3cb1..6bdb27602b58 100644
--- a/docs/documentation/server_admin/topics/roles-groups/con-role-scope-mappings.adoc
+++ b/docs/documentation/server_admin/topics/roles-groups/con-role-scope-mappings.adoc
@@ -6,7 +6,7 @@
 [role="_abstract"]
 On creation of an OIDC access token or SAML assertion, the user role mappings become claims within the token or assertion.  Applications use these claims to make access decisions on the resources controlled by the application.  {project_name} digitally signs access tokens and applications reuse them to invoke remotely secured REST services.  However, these tokens have an associated risk. An attacker can obtain these tokens and use their permissions to compromise your networks. To prevent this situation, use _Role Scope Mappings_.
 
-_Role Scope Mappings_ limit the roles declared inside an access token.  When a client requests a user authentication, the access token they receive contains only the role mappings that are explicitly specified for the client's scope.  The result is that you limit the permissions of each individual access token instead of giving the client access to all the users permissions.  
+_Role Scope Mappings_ limit the roles declared inside an access token. When a client requests user authentication, the access token it receives contains only the role mappings that are explicitly specified for the client's scope. The result is that the permissions of each individual access token are limited instead of giving the client access to all the user's permissions.
 
 By default, each client gets all the role mappings of the user.
 You can view the role mappings for a client.
@@ -26,3 +26,5 @@ You can also use <<_client_scopes, client scopes>> to define the same role scope
 
 .Partial scope
 image:images/client-scope.png[Partial scope]
+
+See the <<_oidc_token_role_mappings, Token Role mappings section>> for details about the algorithm that adds the roles to the token.
diff --git a/docs/documentation/server_admin/topics/roles-groups/proc-creating-realm-roles.adoc b/docs/documentation/server_admin/topics/roles-groups/proc-creating-realm-roles.adoc
index 2834a017a092..9a73621e6b0c 100644
--- a/docs/documentation/server_admin/topics/roles-groups/proc-creating-realm-roles.adoc
+++ b/docs/documentation/server_admin/topics/roles-groups/proc-creating-realm-roles.adoc
@@ -12,7 +12,4 @@ image:images/roles.png[]
 . Enter a *Description*.
 . Click *Save*.
 
-.Add role
-image:images/role.png[Add role]
-
 The *description* field can be localized by specifying a substitution variable with `$\{var-name}` strings. The localized value is configured to your theme within the themes property files. See the link:{developerguide_link}[{developerguide_name}] for more details.
diff --git a/docs/documentation/server_admin/topics/roles-groups/proc-managing-groups.adoc b/docs/documentation/server_admin/topics/roles-groups/proc-managing-groups.adoc
index 662271fb11e3..7a5867a51be9 100644
--- a/docs/documentation/server_admin/topics/roles-groups/proc-managing-groups.adoc
+++ b/docs/documentation/server_admin/topics/roles-groups/proc-managing-groups.adoc
@@ -14,11 +14,11 @@ If you have a parent group and a child group, and a user that belongs only to th
 
 The hierarchy of a group is sometimes represented using the group path. The path is the complete list of names that represents the hierarchy of a specific group, from top to bottom and separated by slashes `/` (similar to files in a File System). For example a path can be `/top/level1/level2` which means that `top` is a top level group and is parent of `level1`, which in turn is parent of `level2`. This path represents unambiguously the hierarchy for the group `level2`.
 
-Because of historical reasons {project_name}, does not escape slashes in the group name itself. Therefore a group named `level1/group` under `top` uses the path `/top/level1/group`, which is misleading. {project_name} can be started with the option `--spi-group-jpa-escape-slashes-in-group-path` to `true` and then the slashes in the name are escaped with the character `~`. The escape char marks that the slash is part of the name and has no hierarchical meaning. The previous path example would be `/top/level1~/group` when escaped.
+Because of historical reasons {project_name}, does not escape slashes in the group name itself. Therefore a group named `level1/group` under `top` uses the path `/top/level1/group`, which is misleading. {project_name} can be started with the option `--spi-group--jpa--escape-slashes-in-group-path` to `true` and then the slashes in the name are escaped with the character `~`. The escape char marks that the slash is part of the name and has no hierarchical meaning. The previous path example would be `/top/level1~/group` when escaped.
 
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-group-jpa-escape-slashes-in-group-path=true
+bin/kc.[sh|bat] start --spi-group--jpa--escape-slashes-in-group-path=true
 ----
 
 The following example includes a top-level *Sales* group and a child *North America* subgroup.  
diff --git a/docs/documentation/server_admin/topics/sessions.adoc b/docs/documentation/server_admin/topics/sessions.adoc
index dc6c95720423..dfd332528ba0 100644
--- a/docs/documentation/server_admin/topics/sessions.adoc
+++ b/docs/documentation/server_admin/topics/sessions.adoc
@@ -1,4 +1,5 @@
 
+[[managing-user-sessions]]
 == Managing user sessions
 
 When users log into realms, {project_name} maintains a user session for each user and remembers each client visited by the user within the session. Realm administrators can perform multiple actions on each user session:
diff --git a/docs/documentation/server_admin/topics/sessions/offline.adoc b/docs/documentation/server_admin/topics/sessions/offline.adoc
index f023cbb947ac..ab47f7e24bb4 100644
--- a/docs/documentation/server_admin/topics/sessions/offline.adoc
+++ b/docs/documentation/server_admin/topics/sessions/offline.adoc
@@ -24,20 +24,4 @@ Clients can request an offline token by adding the parameter `scope=offline_acce
 
 {project_name} will limit its internal cache for offline user and offline client sessions to 10000 entries by default, which will reduce the overall memory usage for offline sessions.
 Items which are evicted from memory will be loaded on-demand from the database when needed.
-To set different sizes for the caches, edit {project_name}'s cache config file to set a `+<memory max-count="..."/>+` for those caches.
-
-If you disabled feature `persistent-user-sessions`, it is possible to reduce memory requirements using a configuration option that shortens lifespan for imported offline sessions. Such sessions will be evicted from the Infinispan caches after the specified lifespan, but still available in the database. This will lower memory consumption, especially for deployments with a large number of offline sessions.
-
-To specify the lifespan override for offline user sessions, start {project_name} server with the following parameter:
-
-[source,bash]
-----
---spi-user-sessions-infinispan-offline-session-cache-entry-lifespan-override=<lifespan-in-seconds>
-----
-
-Similarly for offline client sessions:
-
-[source,bash]
-----
---spi-user-sessions-infinispan-offline-client-session-cache-entry-lifespan-override=<lifespan-in-seconds>
-----
+See the server configuration guide to change this default.
diff --git a/docs/documentation/server_admin/topics/sso-protocols/con-oidc-auth-flows.adoc b/docs/documentation/server_admin/topics/sso-protocols/con-oidc-auth-flows.adoc
index 5b2978d4db2a..076632f810cf 100644
--- a/docs/documentation/server_admin/topics/sso-protocols/con-oidc-auth-flows.adoc
+++ b/docs/documentation/server_admin/topics/sso-protocols/con-oidc-auth-flows.adoc
@@ -154,7 +154,7 @@ The CIBA grant uses the following two providers.
 
 [source,bash,subs="attributes+"]
 ----
-kc.[sh|bat] start --spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri=https://backend.internal.example.com{kc_base_path}
+kc.[sh|bat] start --spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri=https://backend.internal.example.com{kc_base_path}
 ----
 
 The configurable items and their description follow.
diff --git a/docs/documentation/server_admin/topics/sso-protocols/oidc.adoc b/docs/documentation/server_admin/topics/sso-protocols/oidc.adoc
index 309860596ad8..177b1daf65ce 100644
--- a/docs/documentation/server_admin/topics/sso-protocols/oidc.adoc
+++ b/docs/documentation/server_admin/topics/sso-protocols/oidc.adoc
@@ -157,7 +157,7 @@ The CIBA grant uses the following two providers.
 
 [source,bash,subs="attributes+"]
 ----
-kc.[sh|bat] start --spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri=https://backend.internal.example.com{kc_base_path}
+kc.[sh|bat] start --spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri=https://backend.internal.example.com{kc_base_path}
 ----
 
 The configurable items and their description follow.
diff --git a/docs/documentation/server_admin/topics/threat/auth-sessions-limit.adoc b/docs/documentation/server_admin/topics/threat/auth-sessions-limit.adoc
index c76dc72143f0..a7e1d4621aac 100644
--- a/docs/documentation/server_admin/topics/threat/auth-sessions-limit.adoc
+++ b/docs/documentation/server_admin/topics/threat/auth-sessions-limit.adoc
@@ -25,7 +25,7 @@ The following example shows how to limit the number of active `AuthenticationSes
 
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-authentication-sessions-infinispan-auth-sessions-limit=100
+bin/kc.[sh|bat] start --spi-authentication-sessions--infinispan--auth-sessions-limit=100
 ----
 
 ifeval::[{project_community}==true]
@@ -33,6 +33,6 @@ The equivalent command for the new map storage:
 
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-authentication-sessions-map-auth-sessions-limit=100
+bin/kc.[sh|bat] start --spi-authentication-sessions--map--auth-sessions-limit=100
 ----
 endif::[]
diff --git a/docs/documentation/server_admin/topics/threat/read-only-attributes.adoc b/docs/documentation/server_admin/topics/threat/read-only-attributes.adoc
index ef762efd2598..e6c7de36b32a 100644
--- a/docs/documentation/server_admin/topics/threat/read-only-attributes.adoc
+++ b/docs/documentation/server_admin/topics/threat/read-only-attributes.adoc
@@ -29,11 +29,11 @@ This is the list of the read-only attributes, which are used internally by the {
 
 System administrators have a way to add additional attributes to this list. The configuration is currently available at the server level.
 
-You can add this configuration by using the `spi-user-profile-declarative-user-profile-read-only-attributes` and `spi-user-profile-declarative-user-profile-admin-read-only-attributes` options. For example:
+You can add this configuration by using the `spi-user-profile--declarative-user-profile--read-only-attributes` and `spi-user-profile--declarative-user-profile--admin-read-only-attributes` options. For example:
 
 [source,bash,options="nowrap"]
 ----
-kc.[sh|bat] start --spi-user-profile-declarative-user-profile-read-only-attributes=foo,bar*
+kc.[sh|bat] start --spi-user-profile--declarative-user-profile--read-only-attributes=foo,bar*
 ----
 
 For this example, users and administrators would not be able to update attribute `foo`. Users would not be able to edit any attributes starting with the `bar`.
diff --git a/docs/documentation/server_admin/topics/user-federation.adoc b/docs/documentation/server_admin/topics/user-federation.adoc
index 41d4a1c6b036..baa263f6db1a 100644
--- a/docs/documentation/server_admin/topics/user-federation.adoc
+++ b/docs/documentation/server_admin/topics/user-federation.adoc
@@ -18,7 +18,7 @@ To add a storage provider, perform the following procedure:
 .User federation
 image:images/user-federation.png[User federation]
 +
-. Select the provider type card from the listed cards.
+. Choose to add a *Kerberos* or *LDAP* provider
 +
 {project_name} brings you to that provider's configuration page.
 
diff --git a/docs/documentation/server_admin/topics/user-federation/ldap.adoc b/docs/documentation/server_admin/topics/user-federation/ldap.adoc
index ab0ddb91b6ca..965bc0ba54bd 100644
--- a/docs/documentation/server_admin/topics/user-federation/ldap.adoc
+++ b/docs/documentation/server_admin/topics/user-federation/ldap.adoc
@@ -17,6 +17,9 @@ image:images/user-federation.png[User federation]
 . Click *Add LDAP providers*.
 +
 {project_name} brings you to the LDAP configuration page.
++
+.Add LDAP provider
+image:images/user-fed-ldap.png[User federation]
 
 ==== Storage mode
 
@@ -76,6 +79,14 @@ Toggle this switch to *ON* if you want new users created by {project_name} added
 Allow Kerberos authentication::
 Enable Kerberos/SPNEGO authentication in the realm with user data provisioned from LDAP. For more information, see the <<_kerberos,Kerberos section>>.
 
+Remove invalid users during searches::
+Remove users from the local database if they are not available from the user storage when executing searches. If this is true, users no longer available from their corresponding user storage will be deleted from the local database whenever trying to look up users. If false, then users previously imported from the user storage will be kept in the local database, as read-only and disabled, even if that user is no longer available from the user storage. For example, user was deleted directly from LDAP or the `Users DN` is invalid. Note that this behavior will only happen when the user is not yet cached.
+
+Relative User Creation DN::
+Relative DN from the `Users DN` where new users will be created. This allows users to be created in a sub-DN of the parent `Users DN` when using a `subtree` search scope. For example, if the `Users DN` is set to `ou=people,dc=myorg,dc=com` and the `Relative User Creation DN` is set to `ou=engineering`, users will be fetched from the `Users DN` and all sub-DNs, but new users will be stored in `ou=engineering,ou=people,dc=myorg,dc=com`. In other words, {project_name} concatenates the `Relative User Creation DN` with the `Users DN` (a comma is added automatically when concatenating the DNs) and uses this resulting DN to store users
+
+A similar property is also available in the group and role mappers, allowing groups and roles to be added to a sub-DN of the base DN that is used to search for the groups/roles.
+
 Other options::
 Hover the mouse pointer over the tooltips in the Admin Console to see more details about these options.
 
@@ -148,7 +159,7 @@ User Attribute mappers that map basic {project_name} user attributes, such as us
 
 When {project_name} updates a password, {project_name} sends the password in plain-text format. This action is different from updating the password in the built-in {project_name} database, where {project_name} hashes and salts the password before sending it to the database. For LDAP, {project_name} relies on the LDAP server to hash and salt the password.
 
-By default, LDAP servers such as MSAD, RHDS, or FreeIPA hash and salt passwords. Other LDAP servers such as OpenLDAP or ApacheDS store the passwords in plain-text unless you use the _LDAPv3 Password Modify Extended Operation_ as described in https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3[RFC3062]. Enable the LDAPv3 Password Modify Extended Operation in the LDAP configuration page. See the documentation of your LDAP server for more details.
+By default, LDAP servers such as MSAD, RHDS, or FreeIPA hash and salt passwords. Other LDAP servers such as OpenLDAP store the passwords in plain-text unless you use the _LDAPv3 Password Modify Extended Operation_ as described in https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3[RFC3062]. Enable the LDAPv3 Password Modify Extended Operation in the LDAP configuration page. See the documentation of your LDAP server for more details. https://directory.apache.org/apacheds/advanced-ug/4.1.1.4-ss-password-hash.html[Configure ApacheDS to hash and salt passwords automatically] by enabling the passwordHashing interceptor.
 
 WARNING: Always verify that user passwords are properly hashed and not stored as plaintext by inspecting a changed
 directory entry using `ldapsearch` and base64 decode the `userPassword` attribute value.
diff --git a/docs/documentation/server_admin/topics/users/con-aia.adoc b/docs/documentation/server_admin/topics/users/con-aia.adoc
index 63c60203f09a..b4bc11576bc5 100644
--- a/docs/documentation/server_admin/topics/users/con-aia.adoc
+++ b/docs/documentation/server_admin/topics/users/con-aia.adoc
@@ -45,14 +45,17 @@ by checking the claims like `acr` in the tokens.
 In case the user is already authenticated due to an active SSO session, that user usually does not need to actively re-authenticate. However, if that user actively authenticated longer than five minutes ago,
 the client can  still request re-authentication when some AIA is requested. Exceptions exist from this guideline as follows:
 
+* For every required action it is possible to configure the max age on the required action itself in the <<proc-setting-default-required-actions_{context}, Required actions tab>>.
+ If the policy is not configured, it defaults to five minutes.
+
 * The action `delete_account` will always require the user to actively re-authenticate
 
-* The action `update_password` might require the user to actively re-authenticate according to the configured <<maximum-authentication-age,Maximum Authentication Age Password policy>>.
+* The action `UPDATE_PASSWORD` might require the user to actively re-authenticate according to the configured <<maximum-authentication-age,Maximum Authentication Age Password policy>>.
 In case the policy is not configured, it is also possible to configure it on the required action itself in the <<proc-setting-default-required-actions_{context}, Required actions tab>>
 when configuring the particular required action. If the policy is not configured in any of those places, it defaults to five minutes.
 
 * If you want to use a shorter re-authentication, you can still use a parameter query parameter such as  `max_age` with the specified shorter value or eventually `prompt=login`, which will always require user to
-actively re-authenticate as described in the OIDC specification. Note that using `max_age` for a longer value than the default five minutes (or the one prescribed by password policy) is not supported.
+actively re-authenticate as described in the OIDC specification. Note that using `max_age` for a longer value than the default five minutes (or the one specifically configured for the required action) is not supported.
 The `max_age` can be currently used only to make the value shorter than the default five minutes.
 
 * If <<_step-up-flow,Step-up authentication>> is enabled and the action is to add or delete a credential, authentication is required with the level corresponding
@@ -65,7 +68,7 @@ In the same manner, deleting an existing 2nd-factor credential (`otp` or `webaut
 
 Some AIA can require the parameter to be sent together with the action name. For instance, the `Delete Credential` action can be triggered only by AIA and it requires a parameter to be sent together with the name
 of the action, which points to the ID of the removed credential. So the URL for this example would be `kc_action=delete_credential:ce1008ac-f811-427f-825a-c0b878d1c24b`. In this case, the
-part after the colon character (`ce1008ac-f811-427f-825a-c0b878d1c24b`) contains the ID of the credential of the particular user, which is to be deleted. The `Delete Credential` action 
+part after the colon character (`ce1008ac-f811-427f-825a-c0b878d1c24b`) contains the ID of the credential of the particular user, which is to be deleted. The `Delete Credential` action
 displays the confirmation screen where the user can confirm agreement to delete the credential.
 
 NOTE: The <<_account-service,{project_name} Account Console>> typically uses the `Delete Credential` action when deleting a 2nd-factor credential.  You can check the Account Console for examples if you want
@@ -74,5 +77,6 @@ to use this action directly from your own applications. However, relying on the
 [id="con-aia-available-actions_{context}"]
 == Available actions
 
-To see all available actions, log in to the Admin Console and go to the top right top corner to click `Realm info` -> tab `Provider info` -> Find provider `required-action` .
-But note that this can be further restricted based on what actions are enabled for your realm in the <<proc-setting-default-required-actions_{context}, Required actions tab>>.
+To see all available actions, log in to the Admin Console and select `master` realm. Then go to the right top corner and click on the name of the user -> select `Realm info` -> tab `Provider info`. Then in the table, find SPI `required-action` . In the
+2nd column, there are available providers. Those can be used as values of the `kc_action` parameter (unless parameterized as described above). But note that this can be further restricted based on what actions are enabled for your realm in
+the <<proc-setting-default-required-actions_{context}, Required actions tab>>.
diff --git a/docs/documentation/server_admin/topics/users/proc-enabling-recaptcha.adoc b/docs/documentation/server_admin/topics/users/proc-enabling-recaptcha.adoc
index aa9bbee3c211..12cbc03ac0e9 100644
--- a/docs/documentation/server_admin/topics/users/proc-enabling-recaptcha.adoc
+++ b/docs/documentation/server_admin/topics/users/proc-enabling-recaptcha.adoc
@@ -21,10 +21,10 @@ https://www.google.com/recaptcha/admin/create
 
 . Create a reCAPTCHA and choose between Challenge v2 (visible checkbox) or Score-based, v3 (invisible) to get your reCAPTCHA site key and secret. Note them down for future use in this procedure.
 +
-NOTE: The localhost works by default. You do not have to specify a domain.
+NOTE: localhost domains are not supported by default. If you wish to continue supporting them for development you can add them to the list of supported domains for your site key.
 +
 . Navigate to the {project_name} admin console.
-. Click *Authentication* in the menu. 
+. Click *Authentication* in the menu.
 . Click the *Flows* tab.
 . Select *Registration* from the list.
 . Set the *reCAPTCHA* requirement to *Required*. This enables
@@ -43,8 +43,8 @@ image:images/recaptcha-config.png[]
 +
 NOTE: In {project_name}, websites cannot include a login page dialog in an iframe. This restriction is to prevent clickjacking attacks. You need to change the default HTTP response headers that is set in {project_name}.
 +
-.. Click *Realm Settings* in the menu. 
-.. Click the *Security Defenses* tab.  
+.. Click *Realm Settings* in the menu.
+.. Click the *Security Defenses* tab.
 .. Enter `https://www.google.com` in the field for the *X-Frame-Options* header (or `https//www.recaptcha.net` if you enabled *Use recaptcha.net*).
 .. Enter `https://www.google.com` in the field for the *Content-Security-Policy* header (or `https//www.recaptcha.net` if you enabled *Use recaptcha.net*).
 
@@ -67,7 +67,7 @@ NOTE: The localhost works by default. You do not have to specify a domain.
 NOTE: For better security, click on *edit api key* and add an API restriction to restrict the key to the *reCAPTCHA Enterprise API* only.
 +
 . Navigate to the {project_name} Admin Console.
-. Click *Authentication* in the menu. 
+. Click *Authentication* in the menu.
 . Click the *Flows* tab.
 . Duplicate the "registration" flow.
 . Bind the new flow to the *Registration flow*.
diff --git a/docs/documentation/server_admin/topics/vault.adoc b/docs/documentation/server_admin/topics/vault.adoc
index b6b63404e51d..83e21b06c742 100644
--- a/docs/documentation/server_admin/topics/vault.adoc
+++ b/docs/documentation/server_admin/topics/vault.adoc
@@ -33,7 +33,7 @@ All built-in providers support the configuration of key resolvers. A key resolve
 
 [source,bash]
 ----
-kc.[sh|bat] start --spi-vault-file-key-resolvers=REALM_UNDERSCORE_KEY,KEY_ONLY
+kc.[sh|bat] start --spi-vault--file--key-resolvers=REALM_UNDERSCORE_KEY,KEY_ONLY
 ----
 
 The resolvers run in the same order you declare them in the configuration. For each resolver, {project_name} uses the last entry name the resolver produces, which combines the realm with the vault key to search for the vault's secret. If {project_name} finds a secret, it returns the secret. If not, {project_name} uses the next resolver. This search continues until {project_name} finds a non-empty secret or runs out of resolvers. If {project_name} finds no secret, {project_name} returns an empty secret.
diff --git a/docs/documentation/server_development/images/empty-user-federation-page.png b/docs/documentation/server_development/images/empty-user-federation-page.png
index 5576a174f900..1ff3e73829c9 100644
Binary files a/docs/documentation/server_development/images/empty-user-federation-page.png and b/docs/documentation/server_development/images/empty-user-federation-page.png differ
diff --git a/docs/documentation/server_development/images/storage-provider-created.png b/docs/documentation/server_development/images/storage-provider-created.png
index 7e5757ce8cba..44e93e31d871 100644
Binary files a/docs/documentation/server_development/images/storage-provider-created.png and b/docs/documentation/server_development/images/storage-provider-created.png differ
diff --git a/docs/documentation/server_development/images/user-federation-page.png b/docs/documentation/server_development/images/user-federation-page.png
index 787eb9e08aff..595038863db6 100644
Binary files a/docs/documentation/server_development/images/user-federation-page.png and b/docs/documentation/server_development/images/user-federation-page.png differ
diff --git a/docs/documentation/server_development/topics/auth-spi.adoc b/docs/documentation/server_development/topics/auth-spi.adoc
index 9542a63cdad6..ab74c04ea19b 100644
--- a/docs/documentation/server_development/topics/auth-spi.adoc
+++ b/docs/documentation/server_development/topics/auth-spi.adoc
@@ -66,7 +66,7 @@ Cookie - ALTERNATIVE
 Kerberos - ALTERNATIVE
 Forms subflow - ALTERNATIVE
            Username/Password Form - REQUIRED
-           Conditional OTP subflow - CONDITIONAL
+           Conditional 2FA subflow - CONDITIONAL
                       Condition - User Configured - REQUIRED
                       OTP Form - REQUIRED
 ----
@@ -115,14 +115,14 @@ Let's walk through the steps from when a client first redirects to keycloak to a
   A failureChallenge() means that there is a challenge, but that the flow should log this as an error in the error log.
   This error log can be used to lock accounts or IP Addresses that have had too many login failures.
   If the username and password is valid, the provider associated the UserModel with the AuthenticationSessionModel and returns a status of success().
-. The next execution is a subflow called Conditional OTP. The executions for this subflow are loaded and the same processing logic occurs. Its Requirement is
+. The next execution is a subflow called Conditional 2FA. The executions for this subflow are loaded and the same processing logic occurs. Its Requirement is
   Conditional. This means that the flow will first evaluate all conditional executors that it contains. Conditional executors are authenticators that
   implement `ConditionalAuthenticator`, and must implement the method `boolean matchCondition(AuthenticationFlowContext context)`. A conditional subflow will
   call the `matchCondition` method of all conditional executions it contains, and if all of them evaluate to true, it will act as if it was a required subflow. If
   not, it will act as if it was a disabled subflow. Conditional authenticators are only used for this purpose, and are not used as authenticators.
   This means that even if the conditional authenticator evaluates to "true", then this will not mark a flow or subflow as successful. For example,
   a flow containing only a Conditional subflow with only a conditional authenticator will never allow a user to log in.
-. The first execution of the Conditional OTP subflow is the Condition - User Configured.
+. The first execution of the Conditional 2FA subflow is the Condition - User Configured.
   This provider requires that a user has been associated with the flow.
   This requirement is satisfied because the UsernamePassword provider already associated the user with the flow.
   This provider's `matchCondition` method will evaluate the `configuredFor` method for all other Authenticators in its current subflow. If the subflow contains
@@ -134,7 +134,7 @@ Let's walk through the steps from when a client first redirects to keycloak to a
   Since a user is required for this provider, the provider is also asked if the user is configured to use this provider.
   If user is not configured, then the flow will then set up a required action that the user must perform after authentication is complete.
   For OTP, this means the OTP setup page. If the user is configured, he will be asked to enter his otp code. In our scenario, because of the conditional
-  sub-flow, the user will never see the OTP login page, unless the Conditional OTP subflow is set to Required.
+  sub-flow, the user will never see the OTP login page, unless the Conditional 2FA subflow is set to Required.
 . After the flow is complete, the authentication processor creates a UserSessionModel and associates it with the AuthenticationSessionModel.
   It then checks to see if the user is required to complete any required actions before logging in.
 . First, each required action's evaluateTriggers() method is called.
diff --git a/docs/documentation/server_development/topics/identity-brokering/account-linking.adoc b/docs/documentation/server_development/topics/identity-brokering/account-linking.adoc
index 2db64fb37021..02a629066807 100644
--- a/docs/documentation/server_development/topics/identity-brokering/account-linking.adoc
+++ b/docs/documentation/server_development/topics/identity-brokering/account-linking.adoc
@@ -1,4 +1,5 @@
 
+[_client-initiated-account-linking]
 === Client initiated account linking
 
 Some applications want to integrate with social providers like Facebook, but do not want to provide an option to login via
@@ -13,9 +14,30 @@ back to the server.  The server establishes the link and redirects back to the a
 There are some preconditions that must be met by the client application before it can initiate this protocol:
 
 * The desired identity provider must be configured and enabled for the user's realm in the admin console.
-* The user account must already be logged in as an existing user via the OIDC protocol
 * The user must have an `account.manage-account` or `account.manage-account-links` role mapping.
 * The application must be granted the scope for those roles within its access token
+
+The protocol is realized by the link:{adminguide_link}#con-aia_server_administration_guide[Application-initiated action (AIA)]. If you want the user, who is authenticated in your client application, to link
+to the identity provider, attach the parameter `kc_action` with the value `idp_link:<identity-provider-alias>` to the OIDC authentication URL and redirect the user to this URL. For example,
+to request linking to the identity provider with the alias `my-oidc-provider`, attach the parameter such as:
+
+[source,subs="attributes+"]
+----
+kc_action=idp_link:my-oidc-provider
+----
+
+==== Refreshing external tokens
+
+If you use the external token generated by logging into the provider (such as a Facebook or GitHub token), you can refresh this token by re-initiating the account linking API.
+
+==== Legacy client initiated account linking
+
+WARNING: The legacy client initiated account linking is using a custom protocol that is not based on AIA. If you are use this protocol, consider migrating
+your client application to the AIA based protocol described above because legacy client initiated account linking might be removed in the future {project_name} versions.
+
+In addition to the preconditions above, the legacy client initiated account linking has another precondition:
+
+* The user account must already be logged in as an existing user via the OIDC protocol
 * The application must have access to its access token as it needs information within it to generate the redirect URL.
 
 To initiate the login, the application must fabricate a URL and redirect the user's browser to this URL.  The URL looks like this:
@@ -87,8 +109,3 @@ to the application.  If there is an error condition and the auth server deems it
 [WARNING]
    While this API guarantees that the application initiated the request, it does not completely prevent CSRF attacks for this operation.  The application
    is still responsible for guarding against CSRF attacks target at itself.
-
-==== Refreshing external tokens
-
-If you are using the external token generated by logging into the provider (i.e. a Facebook or GitHub token), you can refresh this token by re-initiating the account linking API.
-
diff --git a/docs/documentation/server_development/topics/providers.adoc b/docs/documentation/server_development/topics/providers.adoc
index 30ccaee75c62..e5d36452021d 100644
--- a/docs/documentation/server_development/topics/providers.adoc
+++ b/docs/documentation/server_development/topics/providers.adoc
@@ -91,7 +91,7 @@ For example, to configure a provider you can set options as follows:
 
 [source,bash]
 ----
-bin/kc.[sh|bat] --spi-theme-selector-my-theme-selector-enabled=true --spi-theme-selector-my-theme-selector-theme=my-theme
+bin/kc.[sh|bat] --spi-theme-selector--my-theme-selector--enabled=true --spi-theme-selector--my-theme-selector--theme=my-theme
 ----
 
 Then you can retrieve the config in the `ProviderFactory` init method:
@@ -122,6 +122,44 @@ public class MyThemeSelectorProvider implements ThemeSelectorProvider {
 }
 ----
 
+The pom.xml file for your SPI requires a `dependencyManagement` section with an import reference to the {project_name} version that is intended for the SPI. In this example, replace the occurrence of `VERSION` with {project_versionMvn}, which is the current version of {project_name}.
+
+[source,xml]
+----
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>org.example</groupId>
+  <artifactId>test-lib</artifactId>
+  <version>1.0-SNAPSHOT</version>
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.keycloak</groupId>
+        <artifactId>keycloak-parent</artifactId>
+        <version>VERSION</version> <!--1-->
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.keycloak</groupId>
+      <artifactId>keycloak-model-jpa</artifactId>
+      <scope>provided</scope>
+    </dependency>
+  </dependencies>
+
+</project>
+----
+<1> Replace `VERSION` with the current version of {project_name}
+
 [[_override_builtin_providers]]
 ==== Override built-in providers
 
@@ -196,7 +234,7 @@ one of them needs to be specified as the default one.
 For example such as:
 [source,bash]
 ----
-bin/kc.[sh|bat] build --spi-hostname-provider=default
+bin/kc.[sh|bat] build --spi-hostname--provider=default
 ----
 
 The value `default` used as the value of `default-provider` must match the ID returned by the `ProviderFactory.getId()` of the particular provider factory implementation.
@@ -224,14 +262,14 @@ After registering new providers or dependencies Keycloak needs to be re-built wi
 
 [NOTE]
 ====
-Provider JARs are not loaded in isolated classloaders, so do not include resources or classes in your provider JARs that conflict with built-in resources or classes. 
-In particular the inclusion of an application.properties file or overriding the commons-lang3 dependency will cause auto-build to fail if the provider JAR is removed. 
+Provider JARs are not loaded in isolated classloaders, so do not include resources or classes in your provider JARs that conflict with built-in resources or classes.
+In particular the inclusion of an application.properties file or overriding the commons-lang3 dependency will cause auto-build to fail if the provider JAR is removed.
 If you have included conflicting classes, you may see a split package warning in the start log for the server. Unfortunately not all built-in lib jars are checked by the split package warning logic,
 so you'll need to check the lib directory JARs before bundling or including a transitive dependency. Should there be a conflict, that can be resolved by removing or repackaging the offending classes.
 
-There is no warning if you have conflicting resource files. You should either ensure that your JAR's resource files have path names that contain something unique to that provider, 
+There is no warning if you have conflicting resource files. You should either ensure that your JAR's resource files have path names that contain something unique to that provider,
 or you can check for the existence of `some.file` in the JAR contents under the `"install root"/lib/lib/main` directory with something like:
- 
+
 [source,bash]
 ----
 find . -type f -name "*.jar" -exec unzip -l {} \; | grep some.file
@@ -245,7 +283,7 @@ If you find that your server will not start due to a `NoSuchFileException` error
 ----
 
 This will force Quarkus to rebuild the classloading related index files. From there you should be able to perform a non-optimized start or build without an exception.
-====    
+====
 
 
 ==== Disabling a provider
@@ -255,7 +293,7 @@ For example to disable the Infinispan user cache provider use:
 
 [source,bash]
 ----
-bin/kc.[sh|bat] build --spi-user-cache-infinispan-enabled=false
+bin/kc.[sh|bat] build --spi-user-cache--infinispan--enabled=false
 ----
 
 [[_script_providers]]
diff --git a/docs/documentation/server_development/topics/themes-react.adoc b/docs/documentation/server_development/topics/themes-react.adoc
index 6e71b3c3d9eb..c922522c473f 100644
--- a/docs/documentation/server_development/topics/themes-react.adoc
+++ b/docs/documentation/server_development/topics/themes-react.adoc
@@ -34,15 +34,15 @@ import { KeycloakProvider } from "@keycloak/keycloak-ui-shared";
       realm: "master",
       clientId: "security-admin-console"
   }}>
-  {/* rest of you application */}
+  {/* rest of your application */}
 </KeycloakProvider>
 ----
 
 === Translating the pages
 
 The pages are translated using the `i18next` library.
-You can set it up as described on their [website](https://react.i18next.com/).
-If you want to use the translations that are provided then you need to add i18next-http-backend to your project and add:
+You can set it up as described on their https://react.i18next.com/[website].
+If you want to use the translations that are provided then you need to add `i18next-fetch-backend` to your project and add:
 
 [source,javascript]
 ----
@@ -51,9 +51,9 @@ backend: {
   parse: (data: string) => {
     const messages = JSON.parse(data);
 
-    const result: Record<string, string> = {};
-    messages.forEach((v) => (result[v.key] = v.value)); //need to convert to record
-    return result;
+    return Object.fromEntries(
+      messages.map(({ key, value }) => [key, value])
+    );
   },
 },
 ----
@@ -61,5 +61,5 @@ backend: {
 === Using the pages
 
 All "pages" are React components that can be used in your application.
-To see what components are available, see the [source](https://github.com/keycloak/keycloak/blob/main/js/apps/account-ui/src/index.ts).
-Or have a look at the [quick start](https://github.com/keycloak/keycloak-quickstarts/tree/main/extension/extend-account-console-node) to see how to use them.
+To see what components are available, see the https://github.com/keycloak/keycloak/blob/main/js/apps/account-ui/src/index.ts[source].
+Or have a look at the https://github.com/keycloak/keycloak-quickstarts/tree/main/extension/extend-account-console-node[quick start] to see how to use them.
diff --git a/docs/documentation/server_development/topics/themes.adoc b/docs/documentation/server_development/topics/themes.adoc
index 41c3d69c15f2..d52feea014bc 100644
--- a/docs/documentation/server_development/topics/themes.adoc
+++ b/docs/documentation/server_development/topics/themes.adoc
@@ -32,13 +32,13 @@ NOTE: To set the theme for the `master` Admin Console you need to set the Admin
 +
 . To see the changes to the Admin Console refresh the page.
 
-. Change the welcome theme by using the `spi-theme-welcome-theme` option.
+. Change the welcome theme by using the `spi-theme--welcome-theme` option.
 
 . For example:
 +
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-theme-welcome-theme=custom-theme
+bin/kc.[sh|bat] start --spi-theme--welcome-theme=custom-theme
 ----
 
 [[_default-themes]]
@@ -74,7 +74,7 @@ restarting {project_name}.
 +
 [source,bash]
 ----
-bin/kc.[sh|bat] start --spi-theme-static-max-age=-1 --spi-theme-cache-themes=false --spi-theme-cache-templates=false
+bin/kc.[sh|bat] start --spi-theme--static-max-age=-1 --spi-theme--cache-themes=false --spi-theme--cache-templates=false
 ----
 
 . Create a directory in the `themes` directory.
@@ -123,11 +123,14 @@ It can be useful for instance if you redeployed custom providers or custom theme
 
 Theme properties are set in the file `<THEME TYPE>/theme.properties` in the theme directory.
 
-* parent - Parent theme to extend
-* import - Import resources from another theme
-* common - Override the common resource path. The default value is `common/keycloak` when not specified. This value would be used as value of suffix of `${url.resourcesCommonPath}`, which is used typically in freemarker templates (prefix of `${url.resoucesCommonPath}` value is theme root uri).
-* styles - Space-separated list of styles to include
-* locales - Comma-separated list of supported locales
+`parent`:: Parent theme to extend
+`import`:: Import resources from another theme
+`common`:: Override the common resource path. The default value is `common/keycloak` when not specified. This value would be used as value of suffix of `${url.resourcesCommonPath}`, which is used typically in freemarker templates (prefix of `${url.resoucesCommonPath}` value is theme root uri).
+`styles`:: Space-separated list of styles to include
+`locales`:: Comma-separated list of supported locales
+`contentHashPattern`:: Regex pattern of a file path in the theme where files have a content hash as part of their file name.
+A content hash is usually an abbreviated hash of the file's contents. The hash will change when the contents of the file have changed, and is usually created using the bundling process of the JavaScript application bundling.
+When the preview feature `rolling-updates:v2` is enabled, this allows for a more seamless rolling upgrade.
 
 There are a list of properties that can be used to change the css class used for certain element types. For a list of these properties look at the theme.properties
 file in the corresponding type of the keycloak theme (`themes/keycloak/<THEME TYPE>/theme.properties`).
@@ -256,7 +259,7 @@ An example for a custom `footer.ftl` may look like this:
         <li><a href="#about">About</a></li>
         <li><a href="#contact">Contact</a></li>
     </ul>
-<div>
+</div>
 </#macro>
 ```
 
diff --git a/docs/documentation/server_development/topics/user-storage.adoc b/docs/documentation/server_development/topics/user-storage.adoc
index 9466e3a009c9..1b8e20eb2568 100644
--- a/docs/documentation/server_development/topics/user-storage.adoc
+++ b/docs/documentation/server_development/topics/user-storage.adoc
@@ -19,10 +19,10 @@ There are two sample projects in link:{quickstartRepo_link}[{quickstartRepo_name
 |===
 |Name |Description
 
-| {quickstartRepo_link}/tree/latest/extension/user-storage-jpa[user-storage-jpa]
+| {quickstartRepo_link}/tree/main/extension/user-storage-jpa[user-storage-jpa]
 | Demonstrates implementing a user storage provider using JPA.
 
-| {quickstartRepo_link}/tree/latest/extension/user-storage-simple[user-storage-simple]
+| {quickstartRepo_link}/tree/main/extension/user-storage-simple[user-storage-simple]
 | Demonstrates implementing a user storage provider using a simple properties file that contains username/password key pairs.
 
 |===
diff --git a/docs/documentation/server_development/topics/user-storage/javaee.adoc b/docs/documentation/server_development/topics/user-storage/javaee.adoc
index 85d03599f4b2..4fb8dc328077 100644
--- a/docs/documentation/server_development/topics/user-storage/javaee.adoc
+++ b/docs/documentation/server_development/topics/user-storage/javaee.adoc
@@ -8,7 +8,7 @@ endif::[]
 
 Therefore, the User Storage Providers cannot be packaged within any Jakarta EE component or make it an EJB as was the case when Keycloak ran over WildFly in previous versions.
 
-Providers implementations are required to be plain java objects which implement the suitable User Storage SPI interfaces, as was explained in the previous sections. They must be packaged and deployed as stated in the Migration Guide. 
+Providers implementations are required to be plain java objects which implement the suitable User Storage SPI interfaces, as was explained in the previous sections. They must be packaged and deployed as stated in the Migration Guide.
 ifeval::[{project_community}==true]
 See https://www.keycloak.org/migration/migrating-to-quarkus#_migrating_custom_providers[Migrating custom providers].
 endif::[]
@@ -18,6 +18,6 @@ endif::[]
 
 You can still implement your custom `UserStorageProvider` class, which is able to integrate an external database by JPA Entity Manager, as shown in this example:
 
-  - {quickstartRepo_link}/tree/latest/extension/user-storage-jpa
+  - {quickstartRepo_link}/tree/main/extension/user-storage-jpa
 
 CDI is not supported.
diff --git a/docs/documentation/server_development/topics/user-storage/simple-example.adoc b/docs/documentation/server_development/topics/user-storage/simple-example.adoc
index aef44706d9f3..aa5c70f16f79 100644
--- a/docs/documentation/server_development/topics/user-storage/simple-example.adoc
+++ b/docs/documentation/server_development/topics/user-storage/simple-example.adoc
@@ -213,7 +213,7 @@ For example, by running the server with the following argument:
 
 [source,bash]
 ----
-kc.[sh|bat] start --spi-storage-readonly-property-file-path=/other-users.properties
+kc.[sh|bat] start --spi-storage--readonly-property-file--path=/other-users.properties
 ----
 
 We can specify the classpath of the user property file instead of hardcoding it. Then you can retrieve the configuration in the `PropertyFileUserStorageProviderFactory.init()`:
diff --git a/docs/documentation/tests/pom.xml b/docs/documentation/tests/pom.xml
index a8d4ec97ce72..f444f03bff9a 100644
--- a/docs/documentation/tests/pom.xml
+++ b/docs/documentation/tests/pom.xml
@@ -8,6 +8,7 @@
             --add-opens=java.base/sun.nio.ch=ALL-UNNAMED
             --add-opens java.base/java.io=ALL-UNNAMED
         </surefire.system.args>
+        <version.jsoup>1.18.3</version.jsoup>
     </properties>
 
     <build>
@@ -129,6 +130,12 @@
             <version>5.0.1</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.jsoup</groupId>
+            <artifactId>jsoup</artifactId>
+            <version>${version.jsoup}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/HttpUtils.java b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/HttpUtils.java
index c643b1d6ea84..60813be6defa 100644
--- a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/HttpUtils.java
+++ b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/HttpUtils.java
@@ -10,6 +10,7 @@
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
 import org.apache.hc.core5.http.ClassicHttpResponse;
 import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpHeaders;
 import org.apache.hc.core5.http.HttpStatus;
 import org.apache.hc.core5.http.ParseException;
 import org.apache.hc.core5.http.io.HttpClientResponseHandler;
@@ -77,6 +78,9 @@ public String handleResponse(ClassicHttpResponse r) throws IOException {
         };
 
         try {
+            // add common headers that are needed by some pages
+            method.addHeader(HttpHeaders.ACCEPT_LANGUAGE, "en-US,en;q=0.9");
+            method.addHeader(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
             client.execute(method, responseHandler);
         } catch (Exception e) {
             response.setError("exception " + e.getMessage());
diff --git a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/LinkUtils.java b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/LinkUtils.java
index 332faa650db0..ed8a576d9e4b 100644
--- a/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/LinkUtils.java
+++ b/docs/documentation/tests/src/test/java/org/keycloak/documentation/test/utils/LinkUtils.java
@@ -1,6 +1,9 @@
 package org.keycloak.documentation.test.utils;
 
 import org.apache.commons.io.FileUtils;
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.jsoup.nodes.Element;
 import org.keycloak.documentation.test.Config;
 import org.keycloak.documentation.test.Guide;
 
@@ -68,15 +71,35 @@ public List<InvalidLink> findInvalidLinks(Guide guide) throws IOException {
                     String anchor = link.contains("#") ? link.split("#")[1] : null;
                     String error = null;
 
-                    HttpUtils.Response response = anchor != null ? http.load(link) : http.isValid(link);
+                    HttpUtils.Response response = http.load(link);
 
                     if (response.getRedirectLocation() != null) {
                         if (!validRedirect(response.getRedirectLocation(), Config.getInstance().getIgnoredLinkRedirects())) {
                             error = "invalid redirect to " + response.getRedirectLocation();
                         }
-                    } else if (response.isSuccess() && anchor != null) {
-                        if (!(response.getContent().contains("id=\"" + anchor + "\"") || response.getContent().contains("name=\"" + anchor + "\"") || response.getContent().contains("href=\"#" + anchor + "\""))) {
-                            error = "invalid anchor " + anchor;
+                    } else if (response.isSuccess()) {
+                        if (response.getContent().contains("http-equiv")) {
+                            // The contains() will scan the document fast, while Jsoup parse will take extra CPU cycles to parse the document.
+                            // Using Jsoup avoid parsing getting false positives from the document's contents.
+                            Document doc = Jsoup.parse(response.getContent());
+                            Element refresh = doc.selectFirst("head > meta[http-equiv=refresh]");
+                            if (refresh != null) {
+                                String content = refresh.attribute("content").getValue();
+                                if (content.contains(";")) {
+                                    String url = content.substring(content.indexOf(";") + 1).trim();
+                                    if (url.startsWith("url=")) {
+                                        url = url.substring("url=".length()).trim();
+                                        if (!validRedirect(url, Config.getInstance().getIgnoredLinkRedirects())) {
+                                            error = "invalid redirect to " + url;
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        if (anchor != null) {
+                            if (!(response.getContent().contains("id=\"" + anchor + "\"") || response.getContent().contains("name=\"" + anchor + "\"") || response.getContent().contains("href=\"#" + anchor + "\""))) {
+                                error = "invalid anchor " + anchor;
+                            }
                         }
                     } else {
                         error = response.getError();
diff --git a/docs/documentation/tests/src/test/resources/ignored-links b/docs/documentation/tests/src/test/resources/ignored-links
index 48f763901109..b77d682d54a1 100644
--- a/docs/documentation/tests/src/test/resources/ignored-links
+++ b/docs/documentation/tests/src/test/resources/ignored-links
@@ -39,7 +39,9 @@ https://stackapps.com/apps/oauth/register
 # Failing because of broken certificate, can likely be restored later.
 https://docs.kantarainitiative.org*
 https://saml.xml.org*
-# To be removed once KC 26.1 has been released
-https://www.keycloak.org/server/logging#_configuring_levels_as_individual_options
-https://www.keycloak.org/observability/*
-https://www.keycloak.org/high-availability/concepts-memory-and-cpu-sizing#_measuring_the_activity_of_a_running_keycloak_instance
\ No newline at end of file
+# To be removed once KC 26.2 has been released
+https://www.keycloak.org/server/caching#_securing_transport_stacks
+https://www.keycloak.org/observability/grafana-dashboards
+https://www.keycloak.org/securing-apps/token-exchange*
+https://www.keycloak.org/operator/rolling-updates
+https://www.keycloak.org/server/update-compatibility#rolling-updates-for-patch-releases
\ No newline at end of file
diff --git a/docs/documentation/topics/templates/document-attributes.adoc b/docs/documentation/topics/templates/document-attributes.adoc
index 7b02f0e4df16..3d503401f975 100644
--- a/docs/documentation/topics/templates/document-attributes.adoc
+++ b/docs/documentation/topics/templates/document-attributes.adoc
@@ -48,12 +48,16 @@
 :adminguide_bruteforce_link: {adminguide_link}#password-guess-brute-force-attacks
 :adminguide_eventlistener_name: Event listener
 :adminguide_eventlistener_link: {adminguide_link}#event-listener
+:adminguide_finegrained_name: fine-grained admin permissions
+:adminguide_finegrained_link: {adminguide_link}#_fine_grained_permissions
 :adminguide_timeouts_name: Timeouts
 :adminguide_timeouts_link: {adminguide_link}#_timeouts
 :adminguide_clearcache_name: Clearing Server Caches
 :adminguide_clearcache_link: {adminguide_link}#_clear-cache
 :apidocs_name: API Documentation
 :apidocs_link: https://www.keycloak.org/docs/{project_version}/api_documentation/
+:adminguide_email_name: Configuring email for a realm
+:adminguide_email_link: {adminguide_link}#_email
 :bootstrapadminrecovery_name: Admin Bootstrap and Recovery
 :bootstrapadminrecovery_link: https://www.keycloak.org/server/bootstrap-admin-recovery
 :client_certificate_lookup_link: https://www.keycloak.org/server/reverseproxy#_enabling_client_certificate_lookup
@@ -70,10 +74,12 @@
 :gettingstarted_name_short: Getting Started
 :gettingstarted_link: https://www.keycloak.org/guides#getting-started
 :gettingstarted_link_latest: https://www.keycloak.org/guides#getting-started
+:grafanadashboards_link: https://www.keycloak.org/observability/grafana-dashboards
 :highavailabilityguide_name: High Availability Guide
 :highavailabilityguide_link: https://www.keycloak.org/guides#high-availability
+:observablitycategory_link: https://www.keycloak.org/guides#observability
 :tracingguide_name: Enabling Tracing
-:tracingguide_link: https://www.keycloak.org/server/tracing
+:tracingguide_link: https://www.keycloak.org/observability/tracing
 :upgradingguide_name: Upgrading Guide
 :upgradingguide_name_short: Upgrading
 :upgradingguide_link: {project_doc_base_url}/upgrading/
@@ -114,9 +120,6 @@
 
 :jdgserver_name: Infinispan
 :jdgserver_version: 9.4.19
-:jdgserver_version_latest: 11.0.9
-:jdgserver_crossdcdocs_link: https://infinispan.org/docs/11.0.x/titles/xsite/xsite.html
-:jdgserver_version_latest: 11.0.8
 
 :subsystem_undertow_xml_urn: urn:jboss:domain:undertow:12.0
 :subsystem_infinispan_xml_urn: urn:jboss:domain:infinispan:12.0
@@ -128,5 +131,8 @@
 :securing_apps_name: Securing applications Guides
 :securing_apps_name_short: Securing applications
 :securing_apps_link: https://www.keycloak.org/guides#securing-apps
-:securing_apps_java_policy_enforcer_link: https://www.keycloak.org/securing-apps/policy-enforcer
+:securing_apps_base_link: https://www.keycloak.org/securing-apps
+:securing_apps_java_policy_enforcer_link: {securing_apps_base_link}/policy-enforcer
 :securing_apps_java_policy_enforcer_name: Java Policy enforcer
+:securing_apps_token_exchange_link: {securing_apps_base_link}/token-exchange
+:securing_apps_token_exchange_name: Token exchange Documentation
diff --git a/docs/documentation/upgrading/topics/changes/changes-19_0_0.adoc b/docs/documentation/upgrading/topics/changes/changes-19_0_0.adoc
index 8396b5225236..7766b6aa084b 100644
--- a/docs/documentation/upgrading/topics/changes/changes-19_0_0.adoc
+++ b/docs/documentation/upgrading/topics/changes/changes-19_0_0.adoc
@@ -61,7 +61,7 @@ Apart from disabling the /q/ endpoints, these are the other improvements made to
 * The `health/ready` endpoint used for readiness probes still checks for a working database connection. Make sure you have not only `health-enabled=true` but also `metrics-enabled=true` set in your configuration, to enable the database check, resulting in an effective readiness probe. It will return HTTP status-code 503 and a status of DOWN when the database connection is not in a healthy state.
 
 Expect more enhancements in this area in the future.
-For more information, see the https://www.keycloak.org/server/health[Health guide]
+For more information, see the https://www.keycloak.org/observability/health[Health guide]
 
 = Changes using GELF / centralized log management
 
diff --git a/docs/documentation/upgrading/topics/changes/changes-21_0_0.adoc b/docs/documentation/upgrading/topics/changes/changes-21_0_0.adoc
index 443849b6248f..7aafb2d0bf30 100644
--- a/docs/documentation/upgrading/topics/changes/changes-21_0_0.adoc
+++ b/docs/documentation/upgrading/topics/changes/changes-21_0_0.adoc
@@ -1,7 +1,7 @@
 = Keycloak uses Micrometer for metrics
 
 Keycloak provides an optional a metrics endpoint which exports metrics in the Prometheus format.
-In this release the implementation to provide this data switched from SmallRye to Micrometer, which is the https://quarkus.io/guides/micrometer/[recommended metrics library for Quarkus].
+In this release the implementation to provide this data switched from SmallRye to Micrometer, which is the https://quarkus.io/guides/telemetry-micrometer[recommended metrics library for Quarkus].
 
 Due to this change, metrics have been renamed.
 The following table shows some examples.
@@ -52,9 +52,9 @@ backward compatibility mode is planned to be removed in Keycloak 24.
 
 = Deprecated methods from user session provider were removed
 
-In Keycloak 13 there was introduced `UserLoginFailureProvider` and some methods from 
-`UserSessionProvider` were moved there. The methods in `UserSessionProvider` were deprecated 
-and now has been removed. Javadoc of these methods contained a corresponding replacement 
+In Keycloak 13 there was introduced `UserLoginFailureProvider` and some methods from
+`UserSessionProvider` were moved there. The methods in `UserSessionProvider` were deprecated
+and now has been removed. Javadoc of these methods contained a corresponding replacement
 (see Javadoc of Keycloak 20 release).
 
 = Custom themes using old admin console won't work
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc b/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
index 28398e4ddf78..996ca2934428 100644
--- a/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
+++ b/docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
@@ -366,7 +366,7 @@ If you are using a bundler like Vite or Webpack nothing changes, you'll have the
 </script>
 ----
 
-You can also opt to use an link:https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script/type/importmap[import map] make the import of the library less verbose:
+You can also opt to use an link:https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script/type/importmap[import map] make the import of the library less verbose:
 
 [source,html]
 ----
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_1_3.adoc b/docs/documentation/upgrading/topics/changes/changes-26_1_3.adoc
new file mode 100644
index 000000000000..218186baa73b
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-26_1_3.adoc
@@ -0,0 +1,11 @@
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== Send Reset Email force login again for federated users after reset credentials
+
+Previously the reset credentials flow (*forgot password* feature) kept the user logged in after the reset credentials if the same authentication session (same browser) was used. For federated user providers this behavior can be a security issue. Imagine a provider implementation that detects the user as *enabled*, performs the password change successfully but the validation of the user password fails for some reason. In this scenario the reset credentials flow allowed a user to be logged in after the successful password change that would have not been allowed to login using the normal browser flow. This scenario is not a common case but should be avoided by default.
+
+For this reason now the authenticator `reset-credential-email` (*Send Reset Email*) has a new configuration option called `force-login` (*Force login after reset*) with values `true` (always force the login), `false` (previous behavior that keeps the user logged in if the same authentication session is used), and `only-federated` (default value that forces federated users to authenticate again and keeps previous behavior for users stored in {project_name}'s internal database).
+
+For more information about changing this option, see link:{adminguide_link}#enabling-forgot-password[Enable forgot password].
\ No newline at end of file
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_2_0.adoc b/docs/documentation/upgrading/topics/changes/changes-26_2_0.adoc
new file mode 100644
index 000000000000..f0bbc83e478f
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-26_2_0.adoc
@@ -0,0 +1,188 @@
+== Breaking changes
+
+Breaking changes are identified as requiring changes from existing users to their configurations.
+
+=== Changes to port behaviour with the `X-Forwarded-Host` header
+
+The `X-Forwarded-Host` header can optionally also contain the port. In previous versions when the port was omitted from the header,
+{project_name} fell back to the actual request port. For example if {project_name} was listening on port 8080 and the request contained
+`X-Forwarded-Host: example.com` header, the resolved URL was `+http://example.com:8080+`.
+
+This is now changed and omitting the port results in removing it from the resolved URL. The resolved URL from the previous example
+would now be `+http://example.com+`.
+
+To mitigate that, either make your reverse proxy include the port in the `X-Forwarded-Host` header or configure it to set
+the `X-Forwarded-Port` header with the desired port.
+
+=== Changes to installing Oracle JDBC driver
+
+The required JAR for the Oracle JDBC driver that needs to be explicitly added to the distribution has changed.
+Instead of providing `ojdbc11` JAR, use `ojdbc17` JAR as stated in the https://www.keycloak.org/server/db#_installing_the_oracle_database_driver[Installing the Oracle Database driver] guide.
+
+=== H2 Credentials
+
+With this version, the default H2 based `dev-file` database changed its credentials. While migrating from an instance using this dev only database is not supported, you may be able to continue to use your existing H2 database if you explicitly provide the old defaults for the database username and password. For example in the `keycloak.conf` specify:
+
+[example]
+====
+db-username=sa
+
+db-password=password
+====
+
+=== JWT Client authentication aligned with the latest OIDC specification
+
+The latest draft version of the link:https://openid.net/specs/openid-connect-core-1_0-36.html#rfc.section.9[OpenID Connect core specification] changed the rules for
+audience validation in JWT client assertions for the Client Authentication methods `private_key_jwt` and `client_secret_jwt`.
+
+Previously, the `aud` claim of a JWT client assertion was loosely defined as `The Audience SHOULD be the URL of the Authorization Server's Token Endpoint`, which did not exclude the usage of other URLs.
+
+The revised OIDC Core specification uses a stricter audience check: `The Audience value MUST be the OP's Issuer Identifier passed as a string, and not a single-element array.`.
+
+We adapted the JWT client authentication authenticators of both `private_key_jwt` and `client_secret_jwt` to allow only a single audience in the token by default. For now, the audience can be
+issuer, token endpoint, introspection endpoint or some other OAuth/OIDC endpoint, which is used by client JWT authentication. However since there is single audience allowed now, it means that it is not possible
+to use other unrelated audience values, which is to make sure that JWT token is really only useful by the {project_name} for client authentication.
+
+This strict audience check can be reverted to the previous more lenient check with a new option of OIDC login protocol SPI. It will be still allowed to use multiple audiences in JWT if server is started with the option:
+
+`--spi-login-protocol-openid-connect-allow-multiple-audiences-for-jwt-client-authentication=true`
+
+Note that this option might be removed in the future. Possibly in {project_name} 27. So it is highly recommended to update your clients to use single audience instead of using this option. It is also
+recommended that your clients use the issuer URL for the audience when sending JWT for client authentication as that is going to be compatible with the future version of OIDC specification.
+
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== `proxy-trusted-addresses` enforced for built-in X509 client certificate lookup providers
+
+Built-in X.509 client certificate lookup providers now reflect the `proxy-trusted-addresses` config option. A certificate provided through the HTTP headers will now be processed only if the proxy is trusted, or `proxy-trusted-addresses` is unset.
+
+=== Zero-configuration secure cluster communication
+
+For clustering multiple nodes, {project_name} uses distributed caches.
+Starting with this release for all TCP-based transport stacks, the communication between the nodes is encrypted with TLS and secured with automatically generated ephemeral keys and certificates.
+
+If you are not using a TCP-based transport stack, it is recommended to migrate to the `jdbc-ping` transport stack to benefit from the simplified configuration and enhanced security.
+
+If you provided your own keystore and truststore to secure the TCP transport stack communication in previous releases, it is now recommended to migrate to the automatically generated ephemeral keys and certificates to benefit from the simplified setup.
+
+If you are using a custom transport stack, this default behavior can be disabled by setting the option `cache-embedded-mtls-enabled` to `false`.
+
+If you are using a service mesh, configure it to allow direct mTLS communication between the {project_name} Pods.
+
+For more information, check the link:https://www.keycloak.org/server/caching#_securing_transport_stacks[Securing Transport Stacks] in the distributed caches guide.
+
+=== Operator creates NetworkPolicies to restrict traffic
+
+The {project_name} Operator now creates by default a NetworkPolicy to restrict traffic to internal ports used for {project_name}'s distributed caches.
+
+This strengthens a secure-by-default setup and minimizes the configuration steps of new setups.
+We expect this to be backwards compatible to existing deployment, so no additional steps are necessary at the time of the upgrade.
+You can return to the previous behavior by disabling the creation of NetworkPolicies in the Keycloak CR.
+
+If your deployment scripts add explicit NetworkPolicies for {project_name}, you should consider removing those and migrate to the new functionality provided in the Keycloak CR as a follow-up to the upgrade.
+
+Read more about this in the https://www.keycloak.org/operator/advanced-configuration[Operator Advanced configuration].
+
+=== Supported standard token exchange
+
+In this release, {project_name} added support for the link:{securing_apps_token_exchange_link}#_standard-token-exchange[Standard token exchange] (Feature `token-exchange-standard:v2`). In the past {project_name} releases,
+{project_name} had only a preview token exchange feature, which is now referred to as link:{securing_apps_token_exchange_link}#_legacy-token-exchange[Legacy token exchange] (Feature `token-exchange:v1`).
+The legacy token exchange is still in preview and it works the same way as in previous releases. If you used the link:{securing_apps_token_exchange_link}#_internal-token-to-internal-token-exchange[internal-internal token exchange],
+consider migrating to the new standard token exchange.
+
+If you prefer to continue using the legacy token exchange, you will find it operates as in previous releases. No need exists to disable the standard token exchange feature. Your clients will use the standard token exchange only if it is enabled on the {project_name} client. However, migration to the standard token exchange is recommended. It is the officially supported method and the priority for enhancements.
+
+Consider the following notes as you plan for migration to the new standard token exchange:
+
+* The feature `token-exchange-standard`, which represents the new Standard token exchange, is enabled by default. It is recommended to
+disable the `token-exchange` feature, which represents the Legacy token exchange, to make sure that requests will be served by the new standard token exchange.
+
+* You can have both the standard and legacy token exchange features enabled, which can be useful if you need to cover standard use cases (internal-internal) together with the other token exchange use cases that are implemented only by legacy token exchange. For instance, link:{securing_apps_token_exchange_link}#_external-token-to-internal-token-exchange[external to internal token exchange] is implemented only by the
+legacy token exchange. In this case, {project_name} serves the standard internal-to-internal requests preferably by the standard token exchange while the other requests are served by the legacy token exchange. The choice of standard or legacy token exchange is determined based on the
+parameters of the particular request. For example, requests containing non-standard parameters such as `requested_issuer` or `requested_subject` are considered legacy.
++
+If you still need legacy token exchange, you also need link:{adminguide_link}#_fine_grained_permissions[Fine-grained admin permissions version 1] enabled (FGAP:v1) because
+link:{adminguide_link}#_fine_grained_permissions[version 2 (FGAP:v2)] does not have support for token exchange permissions. This is on purpose
+because token-exchange is conceptually not really an "admin" permission and therefore token exchange permissions were not added to FGAP:v2.
+
+* Standard token exchange requires enabling a switch on the client as described in the link:{securing_apps_token_exchange_link}#_standard-token-exchange-enable[{securing_apps_token_exchange_name}].
+
+Consider these additional changes in the behavior of the two types of token exchange:
+
+* Fine-grained admin permissions are no longer needed or supported for the standard token exchange.
+
+* The most notable change regarding the behavior of scopes and audiences is that the applied client scopes are based on the client triggering the token exchange request rather than the "target" client specified by the `audience` parameter.
+Support exists for multiple values of the `audience` parameter as mentioned in the specification. The details are described in the link:{securing_apps_token_exchange_link}#_standard-token-exchange-scope[{securing_apps_token_exchange_name}].
+
+* Public clients are no longer allowed to send the token exchange requests. Legacy token exchange allowed public clients to exchange tokens with themselves to downscope the original token. This use case can
+instead be covered by using the refresh token grant, in which the `scope` parameter can be used to downscope the refreshed access token, as mentioned in
+the https://datatracker.ietf.org/doc/html/rfc6749#section-6[OAuth2 specification].
+
+* Exchanging an access token for a SAML assertion is not supported in this release. In other words, using `requested_token_type=urn:ietf:params:oauth:token-type:saml2` is not supported.
+
+* Exchanging an access token for a refresh token is allowed only if it is explicitly enabled on the client as mentioned in the link:{securing_apps_token_exchange_link}#_standard-token-exchange-details[{securing_apps_token_exchange_name}].
+Currently, it is not supported to request offline tokens or exchange a refresh token when the subject token was issued from an offline session. The recommended approach is to exchange for access tokens instead of
+refresh token when possible.
+
+=== Fine-grained admin permissions supported
+
+Starting with this release, {project_name} introduces *fine-grained admin permissions V2*, offering an improved and more flexible authorization model for administrative permissions.
+
+* FGAP:V2 feature is enabled by default.
+* FGAP:V1 feature remains in preview and can be enabled using `--features=admin-fine-grained-authz:v1`. However, V1 may be deprecated and removed in a future releases.
+
+==== Migration from V1 to V2
+
+Due to fundamental changes in the permission model, **automatic migration from V1 to V2 is not available**. To simplify the transition:
+
+* A new `admin-permissions` client is introduced. This client is created when you enable the capability for the realm. The client holds the authorization model for FGAP:V2.
+* The existing FGAP:V1 authorization model remains unchanged within the `realm-management` client.
+* Administrators must _recreate permissions and policies_ using the new model, which can be configured in the updated *Permissions* section of the Admin Console.
+
+==== Key Differences Between FGAP:V1 and FGAP:V2
+
+* Realm-level enablement:
+  ** FGAP:V2 can be enabled for a realm using the new *Admin Permissions* switch in *Realm Settings*.
+* Centralized management:
+  ** The resource-specific *Permissions* tabs (for users, groups, clients, and roles) have been removed.
+  ** A new *Permissions* section provides centralized management for all administrative permissions from a single place in the Admin Console.
+* Explicit operation scoping:
+  ** Transitive dependencies between permissions have been removed.
+  ** Administrators must now explicitly assign each required permission.
+  ** Example: To both view and manage a resource, both *view* and *manage* scopes for a permissions must be assigned separately.
+* Permission model changes:
+  ** The *user-impersonated* user permission has been _removed_.
+  ** The *configure* client permission has been _removed_. With the introduction of explicit operation scoping in V2, the distinction between manage and configure became ambiguous.
+  ** The *user-impersonated* user permission has been _removed_. Instead, you can use the `impersonate-members` scope of the `Groups` resource type to allow or deny impersonation of group members.
+  ** Permissions to `manage-members` of a group do not allow a realm administrator to unassign members from groups. The reason for that is that in V1 this was allowing a member of a group to become
+     a regular realm user, and workaround permissions to create users in a realm. In the future, we will be working to provide additional scopes to allow deleting members from groups.
+* Flexible resource scoping:
+  ** Unlike V1, where permissions were granted either to *a single resource* (for clients, groups, and roles) or *all resources* (for users), V2 introduces greater flexibility.
+  ** Administrators can now define permissions for:
+    *** A *specific resource*
+    *** A *set of selected resources*
+    *** *All resources* of a given type
+    *** This applies to *all resource types*: clients, users,groups, and roles.
+
+=== LDAP provider now can store new users, groups, and roles in a sub-DN of the base DN
+
+When adding new users, groups, or roles, the LDAP provider would always store them in the same base DN configured for the searches. However, in some deployments admins may want to configure a broader DN with `subtree` scope to fetch users (or groups/roles) from multiple sub-DNs, but they don't want new users (or groups/roles) to be stored in this base DN in LDAP. Instead, they would like to chose one of the sub-DNs for that.
+
+It is now possible to control where new users, groups, or roles will be created using the new `Relative User Creation DN` config option in the LDAP provider and also in the LDAP group and role mappers. For more details, check the link:{adminguide_link}#_ldap[LDAP admin guide]
+
+=== Removal of the `X-XSS-Protection` header
+
+Because the https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection[`X-XSS-Protection` header] is no longer supported by any user agents that are supported by Keycloak, it has been removed. This header was a feature of Internet Explorer, Chrome, and Safari that stopped pages from loading when they detected reflected cross-site scripting (XSS) attacks.
+
+We don't expect that this will impact any deployments due to the lack of support in user agents, as well as this feature being supplanted by https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP[Content Security Policy (CSP)].
+
+=== JWT client authentication defines a new max expiration option for the token
+
+When a client is configured to authenticate using the *Signed JWT* or *Signed JWT with Client Secret* type, {project_name} now enforces a maximum expiration for the token. This means that, although the `exp` (expiration) claim in the token may be much later, {project_name} will not accept tokens issued before that max expiration time. The default value is 60 seconds. Note that JWT tokens should be issued right before being sent for authentication. This way, the client has one minute window to send the token for login. Nevertheless this expiration can be tuned using the *Max expiration* configuration option in the client *Credentials* tab (see link:{adminguide_link}#_client-credentials[Confidential client credentials in the {adminguide_name}] for more information).
+
+=== Updates to the `user-profile-commons.ftl` theme template
+The `user-profile-commons.ftl` changed to improve support for localization. See https://github.com/keycloak/keycloak/issues/38029.
+As a result, and if you are extending this template, pages might start displaying a `locale` field. To avoid that, update
+the theme template with the changes aforementioned.
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_3_0.adoc b/docs/documentation/upgrading/topics/changes/changes-26_3_0.adoc
new file mode 100644
index 000000000000..8fe4666ed4b6
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-26_3_0.adoc
@@ -0,0 +1,227 @@
+== Breaking changes
+
+Breaking changes are identified as requiring changes from existing users to their configurations.
+In minor or patch releases, we will only do breaking changes to fix important bugs.
+
+=== Reading information about temporarily locked users
+
+In previous releases there was an inconsistency in the REST endpoint result of getting a user (`+GET /admin/realms/{realm}/users/{user-id}+`) and searching for a user (`+GET /admin/realms/{realm}/users+`). When BruteForce is enabled and a user was temporarily locked out the former endpoint would return `enabled=false` while the latter would return `enabled=true`. If the user was updated and enabled was false due to temporary lockout then the user would be disabled permanently. Both endpoints now return `enabled=true` when a user is temporarily locked out. To check whether a user is temporarily locked out the BruteForceUserResource endpoint should be utilised (`+GET /admin/realms/{realm}/attack-detection/brute-force/users/{userId}+`).
+
+=== User searches through the User API are now respecting the user profile settings
+
+When querying users through the User API, the user representation and their attributes are now taking into account the
+user profile settings defined for the realm.
+
+It might happen that attributes in user representations are no longer available depending on the
+user profile configuration where too much information was returned in the past.
+
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== Different credentials of a user need to have different names
+
+When adding an OTP, WebAuthn or any other 2FA credentials, the name the user assigns to this credential needs to be unique for the given user.
+This allows the user to distinguish between those credentials, and either update or delete them later.
+If a user tries to create a credential with an already existing name, there is an error message and the user is asked to change the name of the new credential.
+
+=== Restrict admin role mappings to server administrators
+
+To enhance security, only users with the `admin` role in the `master` realm (server admins) can assign admin roles. This ensures that critical permissions cannot be delegated by realm-level administrators.
+
+=== Problematic cache configurations ignored
+
+Previous versions of {project_name} warned about problematic configurations, for example, if a wrong number of owners was configured or a cache size was set when it should not have been set when enabling volatile user sessions.
+The docs also stated to update the `cache-ispn.xml` configuration file for volatile user sessions.
+
+The current version will always use safe settings for the number of owners and maximum cache size for the affected user and client session caches, and will log only an INFO message.
+With this behavior, there is no need any more to update the `cache-ispn.xml` configuration file.
+If you previously used a custom `cache-ispn.xml` in order to use volatile user sessions, we recommend reverting those changes and use the standard configuration file.
+
+=== Email verification is now automatically set when using a OpenID Connect broker with `Trust email` is enabled and `Sync Mode` is `FORCE`
+
+Until now, the OpenID Connect broker did not support the standard `email_verified` claim available from the ID Tokens issued by
+OpenID Connect Providers.
+
+In this release, the broker was updated to respect the value from this claim to set the email verification status for the federated (local) user account.
+Whenever users are federated for the first time or re-authenticating, if the `Trust email` setting is enabled and `Sync Mode` is set to `FORCE`,
+the user account will be updated to (un)mark the email as verified.
+If the provider does not send the claim, it defaults to the original behavior and sets the email as verified.
+
+In the future, we might evaluate changing this specific configuration to avoid automatic updates on the email verification
+status on federated user accounts depending on the use cases and the demand from the community.
+
+=== Verify existing account by Email is only executed for the email and username sent by the identity provider
+
+The execution *Verify Existing Account By Email* is one of the alternatives that the *First Login Flow* has to allow a brokering account to be linked to an existing {project_name} user. This step is executed when the user logs in into {project_name} through the broker for the first time, and the identity provider account is already present in {project_name}. The execution sends an email to the current {project_name} address in order to confirm the user controls that account.
+
+Since this release, the *Verify Existing Account By Email* execution is only attempted in the *First Login Flow* if the linking attributes (email and username) sent by the external identity provider are not modified by the user during the review process. This new behavior avoids sending verification emails to an existing {project_name} account that can inadvertently accept the linking.
+
+In case the provider needs to modify the information sent by the identity provider (because emails or usernames are different in the broker), only the other alternative *Verify Existing Account By Re-authentication* is available to link the new account to the existing {project_name} user.
+
+If the data received from the identity provider is mandatory and cannot be modified, then the *Review Profile* step in the *First Login Flow* can be disabled to avoid any user intervention.
+
+For more information, see link:{adminguide_link}#_identity_broker_first_login[the First login flow section of the {adminguide_name}].
+
+=== Signing out from other devices now disabled by default
+
+Previously, when a user updated their credentials, like changing their password or adding another factor like an OTP or Passkey, they had a checkbox *Sign out from other devices* which was checked by default. Since this release, {project_name} displays the checkbox *Sign out from other devices* not checked by default. This checkbox should now be intentionally enabled by the user to logout all the other related sessions associated to the same user.
+
+=== Signing out from other devices logs out offline sessions
+
+Related to the previous point, in previous versions, the *Sign out from other devices* checkbox logged out only regular sessions.
+Starting with this release, it logs out also offline sessions as this is what users would expect to happen given the current screen design.
+
+To revert to the old behavior, enable the deprecated feature `logout-all-sessions:v1`.
+This deprecated feature will be removed in a future version.
+
+=== Updates to the `user-profile-commons.ftl` theme template
+
+The `user-profile-commons.ftl` changed to improve support for localization. See https://github.com/keycloak/keycloak/issues/38029.
+As a result, and if you are extending this template, pages might start displaying a `locale` field. To avoid that, update
+the theme template with the changes aforementioned.
+
+=== Subgroup counts are no longer cached
+
+When returning subgroups of a group, the count of subgroups of each subgroup of a group is no longer cached. With the
+introduction of Fine-Grained Admin Permissions, the result set is filtered at the database level based on any permissions
+defined to a realm so that the count will change accordingly to these permissions.
+
+Instead of caching the count, a query will be executed every time to obtain the expected number of groups an administrator can access.
+
+Most of the time, this change will not impact clients querying the API to fetch the subgroups of a group. However, if not the case,
+a new parameter `subGroupsCount` was introduced to the following endpoints:
+
+* `+/realms/{realm}/groups/{id}/children+`
+* `+/realms/{realm}/groups+`
+
+With this parameter, clients can decide whether the count should be returned to each individual group returned. To not break existing deployments,
+this parameter defaults to `true` so that the count is returned if the parameter is not set.
+
+=== Upgrade procedure changed for the distribution
+
+If you are upgrading {project_name} by downloading the distribution, the upgrade procedure has been changed. Previously it recommended copying over the contents from the `conf/` folder from the old to the new installation.
+The new procedure recommends to re-apply any changes to `cache-ispn.xml` or a custom cache configuration based on the file included in the new version.
+
+This prevents accidentally downgrading functionality, for example, by using an old `cache-ispn.xml` file from a previous version.
+
+=== Default browser flow changes 2FA to include WebAuthn and Recovery Codes
+
+Previously the default *browser* flow had a *Browser - Conditional OTP* conditional sub-flow that enabled One-Time Password (OTP) as a 2nd Factor Authentication (2FA). Starting with this version, the sub-flow is renamed to *Browser - Conditional 2FA*, the *OTP Form* is _Alternative_, and includes two more 2FA methods: *WebAuthn Authenticator* and *Recovery Authentication Code Form*. Both new executions are _Disabled_ by default, but they can be set to _Alternative_ to include them into the flow.
+
+Upgraded realms will not be changed. The updated flow will only be available for new realms. Take this change into consideration if you have automated the realm creation.
+
+=== Syslog counting framing now enabled based on protocol
+
+Syslog messages sent over `tcp` (or `ssl-tcp`) protocol now use counting framing by default, prefixing messages with their size as required by some Syslog servers.
+
+To change this behavior, use the `--log-syslog-counting-framing` option with one of the following values: `protocol-dependent` (default), `true`, or `false`.
+
+== Deprecated features
+
+The following sections provide details on deprecated features.
+
+=== SPI options separating the provider with a single dash
+
+SPI options ending in `-enabled`, `-provider-default`, or `-provider` are treated as build-time options. However, in some instances, this was not correct as a provider could have a configuration property ending in one of those suffixes as well.
+
+To resolve this ambiguity, and any potential ambiguity involving SPI and provider names, a new SPI option format was introduced where the scopes and suffix are separated by `--`(double dash) instead of `-`(dash). The new format then reads as `+spi-<spi-name>--<provider-name>--...+`.
+
+An SPI property ending in `-enabled`, `-provider-default`, or `-provider` should use the new format or else a warning will be emitted. For example `spi-<spi-name>--<provider-name>--enabled` will be recognized as a build-time option without a warning.
+
+For instance, the correct way to reference your custom email template is: `--spi-email-template--mycustomprovider--enabled` (not `--spi-email-template-mycustomprovider-enabled`).
+
+Options using the legacy format and ending in `-enabled`, `-provider-default`, or `-provider` will still be treated as a build-time option, but may not be in future releases.
+
+=== Kubernetes cache stack has been deprecated
+
+The `kubernetes` cache stack has been deprecated and will be removed in a future release. Users should transition to the `jdbc-ping` stack.
+
+Consequently, the Keycloak Operator now uses the `jdbc-ping` cache stack by default.
+
+=== Deprecation of `method RequiredActionProvider.getMaxAuthAge()`
+The method `RequiredActionProvider.getMaxAuthAge()` is deprecated. It is effectively not used now. Please use the method `RequiredActionProvider.getMaxAuthAge(KeycloakSession session)` instead. This is due to enable individual configuration for required actions.
+
+=== Deprecation of `spi-connections-infinispan-quarkus-site-name`
+
+The option `spi-connections-infinispan-quarkus-site-name` is deprecated and no longer used for multi-site setups, and it will be removed in the future.
+Use `spi-cache-embedded-default-site-name` instead in setups when running with embedded distributed caches.
+See the https://www.keycloak.org/server/all-provider-config[All provider configuration] for more details on these options.
+
+=== Deprecated proprietary protocol for client initiated linking to the identity provider account
+
+When you want the user, who is authenticated to your client application, to link his or her account to a specific identity provider, consider using the Application initiated action (AIA) based
+mechanism with the action `idp_link`. The proprietary custom protocol for client initiated account linking is deprecated now and might be removed in the future versions. For more information, see the
+Client initiated account link section of the link:{developerguide_link}[{developerguide_name}].
+
+=== Deprecated for removal the Instagram Identity Broker
+
+In this release, the Instagram Identity Broker is deprecated for removal and is not enabled by default.
+If you are using this broker, it is recommended to use the Facebook Identity Broker instead.
+
+For more details, see
+https://github.com/keycloak/keycloak/issues/37967[Deprecate for removal the Instagram social broker].
+
+If you are using the Instagram Identity Broker and want to re-enable it, you can do it by enabling the `instagram-broker`
+feature using the `features` server option:
+
+[source]
+----
+--features=instagram-broker
+----
+
+It has been a while since discussions started about any activity around the Instagram Identity Broker
+and any objection from the community about deprecating it for removal. For more details, see
+https://github.com/keycloak/keycloak/issues/37967[Deprecate for removal the Instagram social broker].
+
+=== Local admin deprecated for removal
+
+`UrlType.LOCAL_ADMIN` and the corresponding welcome theme variable `localAdminUrl` have been deprecated for eventual removal. The default welcome resource will now simply mention localhost rather than providing a URL when an admin user has yet to be created.
+
+=== Deprecated password policy Recovery Codes Warning Threshold
+
+In relation to supported Recovery codes, we deprecated the password policy `Recovery Codes Warning Threshold`. This password policy might be removed in the future major version of {project_name}.
+This password policy was not related to passwords at all, but was related to recovery codes, and hence using password policy is not appropriate way for the configuration of the threshold. It is
+recommended to use the configuration option *Warning Threshold* of the *Recovery Authentication Codes* required action instead of using password policy. For more details, see the link:{adminguide_link}#_recovery-codes[Recovery codes documentation].
+
+=== Scope.getPropertyNames deprecated for removal
+
+The `org.keycloak.Config.Scope.getPropertyNames` method has been deprecated for removal.
+
+=== Deprecation of the Passkeys Conditional UI Authenticator
+
+The preview feature *Passkeys* recently introduced a new *Passkeys Conditional UI Authenticator* that you can use to integrate the passkey auto-fill or conditional UI feature in your login flow. Passkeys are now being seamlessly integrated into {project_name} inside the default username forms. Therefore, the old authenticator is invalid and it is deprecated in this release. The factory and implementation classes will be removed when *Passkeys* are supported in {project_name}.
+
+== Removed features
+
+The following features have been removed from this release.
+
+=== Removal of `jboss.site.name` and `jboss.node.name`
+
+Both system properties have been used internally within Keycloak and have not been part of the official documentation.
+{project_name} will fail to start if those are present.
+
+Instead, use the command line option `spi-cache-embedded-default-site-name` as `jboss.site.name` replacement, and `spi-cache-embedded-default-node-name` as `jboss.node.name` replacement.
+See the https://www.keycloak.org/server/all-provider-config[All provider configuration] for more details on these options.
+
+=== `KeycloakSessionTask.useExistingSession` method removed
+
+`KeycloakSessionTask.useExistingSession` was only useful to private server logic. Now that this logic has been refined, there is no need for this method.
+
+In previous releases there was a default implementation in the interface returning `false`,Wwe considered it unlikely that it was overwritten in implementations.
+
+=== Usage of remote stores embedded caches is restricted
+
+The experimental feature `cache-embedded-remote-store` was removed in this release and usage of remote stores for embedded caches is now restricted.
+
+Consider one of the following cases and recommended migration steps:
+
+* If you are using remote stores for running {project_name} in multiple data centers especially if they do not have a direct networking connection to allow all {project_name} nodes to form a cluster, follow the link:{highavailabilityguide_link}[{highavailabilityguide_name}] for deploying a multi-site {project_name} setup.
+* If you are using remote stores to keep user sessions available after a {project_name} restart, use the `peristent-user-session` feature which is enabled by default.
+
+[WARNING]
+====
+* {project_name} refuses to start if the `persistent-user-session` feature is disabled and remote store is configured for any of the user session caches.
+
+* With the feature `persistent-user-session` feature enabled, the remote store configuration is ignored and {project_name} will print a warning.
+====
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_3_1.adoc b/docs/documentation/upgrading/topics/changes/changes-26_3_1.adoc
new file mode 100644
index 000000000000..884556ac5cd6
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-26_3_1.adoc
@@ -0,0 +1,8 @@
+// ------------------------ Notable changes ------------------------ //
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== Options for additional datasources marked as preview
+
+In the 26.3.0 release, the newly added options for configuring additional datasources were missing a preview label. This has been now corrected as the work on this feature continues over a few next releases.
diff --git a/docs/documentation/upgrading/topics/changes/changes-26_4_0.adoc b/docs/documentation/upgrading/topics/changes/changes-26_4_0.adoc
new file mode 100644
index 000000000000..54daaf12cb09
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-26_4_0.adoc
@@ -0,0 +1,74 @@
+// ------------------------ Breaking changes ------------------------  //
+== Breaking changes
+
+Breaking changes are identified as requiring changes from existing users to their configurations.
+In minor or patch releases we will only do breaking changes to fix bugs.
+
+=== <TODO>
+
+// ------------------------ Notable changes ------------------------ //
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== Usage of the `exact` request parameter when searching users by attributes
+
+If you are querying users by attributes through the User API where you want to fetch users that match a specific attribute key (regardless the value),
+you should consider setting the `exact` request parameter to `false` when invoking the `+/admin/realms/{realm}/users+` using
+the `GET` method.
+
+For instance, searching for all users with the attribute `myattribute` set should be done as follows:
+
+[source]
+----
+GET /admin/realms/{realm}/users?exact=false&q=myattribute:
+----
+
+The {project_name} Admin Client is also updated with a new method to search users by attribute using the `exact` request parameter.
+
+=== Automatic database connection properties for the PostgreSQL driver
+
+When running PostgreSQL reader and writer instances, {project_name} needs to always connect to the writer instance to do its work.
+
+Starting with this release, and when using the original PostgreSQL driver, {project_name} sets the `targetServerType` property of the PostgreSQL JDBC driver to `primary` to ensure that it always connects to a writable primary instance and never connects to a secondary reader instance in failover or switchover scenarios.
+
+You can override this behavior by setting your own value for `targetServerType` in the DB URL or additional properties.
+
+=== JGroups system properties replaced with CLI options
+
+Until now it was necessary to configure JGroups network addresses and ports using the `+jgroups.bind.*+` and `+jgroups.external_*+`
+system properties. In this release we have introduced the following CLI options to allow these addresses and ports to be
+configured directly via {project_name}: `cache-embedded-network-bind-address`, `cache-embedded-network-bind-port`,
+`cache-embedded-network-external-address`, `cache-embedded-network-external-port`. Configuring ports using the old
+properties will still function as before, but we recommend to change to the CLI options as this may change in the future.
+
+=== Volatile user sessions affecting offline session memory requirements
+
+Starting with this release, {project_name} will cache by default only 10000 entries for offline user and client sessions in memory when volatile user sessions are enabled. This will greatly reduce memory usage.
+
+Use the options `cache-embedded-offline-sessions-max-count` and `cache-embedded-offline-client-sessions-max-count` to change size of the offline session caches.
+
+// ------------------------ Deprecated features ------------------------ //
+== Deprecated features
+
+The following sections provide details on deprecated features.
+
+=== Deprecated `displayTest` field in `ConsentScopeRepresentation`
+
+The `displayTest` field in the `ConsentScopeRepresentation` class returned by the Account REST service has been deprecated due to a typo in its name.
+A new field `displayText` with the correct spelling has been added to replace it. The old field will be removed in {project_name} 27.0.
+The Typescript code `ConsentScopeRepresentation` for the Account Console already contains only the new field.
+
+=== Lifetime of offline session caches
+
+The options `--spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override` and `spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override` are now deprecated for removal.
+
+Instead use the options `cache-embedded-offline-sessions-max-count` and `cache-embedded-offline-client-sessions-max-count` to limit the memory usage if the default of 10000 cache offline user and client sessions does not work in your scenario.
+
+// ------------------------ Removed features ------------------------ //
+== Removed features
+
+The following features have been removed from this release.
+
+=== <TODO>
+
diff --git a/docs/documentation/upgrading/topics/changes/changes-template.adoc b/docs/documentation/upgrading/topics/changes/changes-template.adoc
new file mode 100644
index 000000000000..e75527c9e376
--- /dev/null
+++ b/docs/documentation/upgrading/topics/changes/changes-template.adoc
@@ -0,0 +1,29 @@
+// ------------------------ Breaking changes ------------------------  //
+== Breaking changes
+
+Breaking changes are identified as requiring changes from existing users to their configurations.
+In minor or patch releases we will only do breaking changes to fix bugs.
+
+=== <TODO>
+
+// ------------------------ Notable changes ------------------------ //
+== Notable changes
+
+Notable changes where an internal behavior changed to prevent common misconfigurations, fix bugs or simplify running {project_name}.
+
+=== <TODO>
+
+// ------------------------ Deprecated features ------------------------ //
+== Deprecated features
+
+The following sections provide details on deprecated features.
+
+=== <TODO>
+
+// ------------------------ Removed features ------------------------ //
+== Removed features
+
+The following features have been removed from this release.
+
+=== <TODO>
+
diff --git a/docs/documentation/upgrading/topics/changes/changes.adoc b/docs/documentation/upgrading/topics/changes/changes.adoc
index a64dc4ba60d0..ea7f6ba5d3c3 100644
--- a/docs/documentation/upgrading/topics/changes/changes.adoc
+++ b/docs/documentation/upgrading/topics/changes/changes.adoc
@@ -1,6 +1,22 @@
 [[migration-changes]]
 == Migration Changes
 
+=== Migrating to 26.4.0
+
+include::changes-26_4_0.adoc[leveloffset=2]
+
+=== Migrating to 26.3.0
+
+include::changes-26_3_0.adoc[leveloffset=2]
+
+=== Migrating to 26.2.0
+
+include::changes-26_2_0.adoc[leveloffset=2]
+
+=== Migrating to 26.1.3
+
+include::changes-26_1_3.adoc[leveloffset=2]
+
 === Migrating to 26.1.0
 
 include::changes-26_1_0.adoc[leveloffset=2]
diff --git a/docs/documentation/upgrading/topics/download.adoc b/docs/documentation/upgrading/topics/download.adoc
index 0910855f2293..80ec3b1dfcde 100644
--- a/docs/documentation/upgrading/topics/download.adoc
+++ b/docs/documentation/upgrading/topics/download.adoc
@@ -11,4 +11,8 @@ from the {project_name} website.
 +
 After extracting this file, you should have a directory that is named `{archivebasename}-{project_version}`.
 . Move this directory to the desired location.
-. Copy `conf/`, `providers/` and `themes/` from the previous installation to the new installation.
\ No newline at end of file
+. Copy `providers/` and `themes/` from the previous installation to the new installation.
+. Copy all files except `cache-ispn.xml` from `conf/` from the previous installation to the new installation.
+. If you modified `cache-ispn.xml` or created a custom cache configuration file:
+.. Re-apply your changes based on the `cache-ispn.xml` file shipped with the new installation, and place them in the new installation.
+.. Review the latest {project_name} configuration options for cache sizes and transport stacks if they can be used instead of your modifications as they provide better documentation, additional validations and functionality, and a simpler upgrade experience.
diff --git a/docs/documentation/upgrading/topics/migrate_db.adoc b/docs/documentation/upgrading/topics/migrate_db.adoc
index 4e65d2e6cb40..1b5c342eb614 100644
--- a/docs/documentation/upgrading/topics/migrate_db.adoc
+++ b/docs/documentation/upgrading/topics/migrate_db.adoc
@@ -5,17 +5,27 @@
 {project_name} can automatically migrate the database schema, or you can choose to do it manually. By default the
 database is automatically migrated when you start the new installation for the first time.
 
+[NOTE]
+====
+Before you migrate the database, shut down all {project_name} nodes running the old version of {project_name}.
+====
+
+[NOTE]
+====
+Migration is not supported with the default H2 based `dev-file` database type.
+====
+
 === Automatic relational database migration
 
 To perform an automatic migration, start the server connected to the desired database.  If the database schema has changed for the new server version, the migration starts automatically unless the database has too many records.
 
 For example, creating an index on tables with millions of records can be time-consuming and cause a major service disruption.  Therefore, a threshold of `300000` records exists for automatic migration.  If the number of records exceeds this threshold, the index is not created. Instead, you find a warning in the server logs with the SQL commands that you can apply manually.
 
-To change the threshold, set the `index-creation-threshold` property, value for the default `connections-liquibase` provider:
+To change the threshold, set the `index-creation-threshold` property, value for the `connections-liquibase` provider:
 
 [source,bash]
 ----
-kc.[sh|bat] start --spi-connections-liquibase-default-index-creation-threshold=300000
+kc.[sh|bat] start --spi-connections-liquibase--quarkus--index-creation-threshold=300000
 ----
 
 === Manual relational database migration
@@ -25,18 +35,17 @@ default `connections-jpa` provider:
 
 [source,bash]
 ----
-kc.[sh|bat] start --spi-connections-jpa-quarkus-migration-strategy=manual
+kc.[sh|bat] start --spi-connections-jpa--quarkus--migration-strategy=manual
 ----
 
-When you start the server with this configuration, the server checks if the database needs to be migrated.
-The required changes are written to the `bin/keycloak-database-update.sql` SQL file that you can review and manually run against the database.
+When you start the server with this configuration, the server checks if the database needs to be migrated. If migration is needed, the required changes are written to the `bin/keycloak-database-update.sql` SQL file. You can review and manually run these commands against the database.
 
 To change the path and name of the exported SQL file, set the `migration-export` property for the
 default `connections-jpa` provider:
 
 [source,bash]
 ----
-kc.[sh|bat] start --spi-connections-jpa-quarkus-migration-export=<path>/<file.sql>
+kc.[sh|bat] start --spi-connections-jpa--quarkus--migration-export=<path>/<file.sql>
 ----
 
 For further details on how to apply this file to the database, see the documentation for your relational database.
diff --git a/docs/documentation/upgrading/topics/migrate_themes.adoc b/docs/documentation/upgrading/topics/migrate_themes.adoc
index 869130cf83d6..a700d145e3d0 100644
--- a/docs/documentation/upgrading/topics/migrate_themes.adoc
+++ b/docs/documentation/upgrading/topics/migrate_themes.adoc
@@ -14,9 +14,7 @@ If you created custom themes, those themes must be migrated to the new server. A
 
 === Migrating templates
 
-If you customized any template, review the new version to decide about updating your customized template. If you made minor changes, you could compare the updated template to your customized template. However, if you made many changes, consider comparing the new template to your customized template. This comparison will show you what changes you need to make.
-
-You can use a diff tool to compare the templates. The following screenshot compares the `info.ftl` template from the Login theme and an example custom theme:
+If you customized any template, compare it to the new version of that template. This comparison shows you what changes you need to apply to your customized template. You can use a diff tool to compare the templates. The following screenshot compares the `info.ftl` template from the Login theme and an example custom theme:
 
 .Updated version of a Login theme template versus a custom Login theme template
 image:images/theme-migration-meld-info-1.png[Updated version of a Login theme template versus a custom Login theme template]
diff --git a/docs/documentation/upgrading/topics/upgrade_adapters.adoc b/docs/documentation/upgrading/topics/upgrade_adapters.adoc
index 0a82495c3314..eb1b582bbf11 100644
--- a/docs/documentation/upgrading/topics/upgrade_adapters.adoc
+++ b/docs/documentation/upgrading/topics/upgrade_adapters.adoc
@@ -28,20 +28,24 @@ To upgrade the {appserver_name} adapter, complete the following steps:
 
 [[_upgrade_js_adapter]]
 == Upgrading the JavaScript adapter
-
-To upgrade a JavaScript adapter, install the latest version https://www.npmjs.com/package/keycloak-js[from NPM].
+ifeval::[{project_community}==true]
+To upgrade the JavaScript adapter, install the latest version https://www.npmjs.com/package/keycloak-js[from NPM].
 
 .Procedure
 . `npm install keycloak-js@latest`
+endif::[]
 
+ifeval::[{project_product}==true]
+To upgrade the JavaScript adapter, install the latest version {securing_apps_link}/#javascript-adapter-installation[from NPM]. 
+endif::[]
 
 [[_upgrade_nodejs_adapter]]
 == Upgrading the `Node.js` adapter
 
-To upgrade a `Node.js` adapter that has been copied to your web application, perform the following procedure.
+ifeval::[{project_community}==true]
+To upgrade the `Node.js` adapter, see the {securing_apps_base_link}/nodejs-adapter#_upgrade_nodejs_adapter[`Node.js adapter` documentation].
+endif::[]
 
-.Procedure
-. Download the new adapter archive.
-. Remove the existing `Node.js` adapter directory
-. Unzip the updated file into its place
-. Change the dependency for keycloak-connect in the `package.json` of your application
+ifeval::[{project_product}==true]
+To upgrade the `Node.js` adapter, see the {securing_apps_link}/nodejs-adapter-_upgrade_nodejs_adapter[`Node.js adapter` documentation].
+endif::[]
diff --git a/docs/guides/assembly.xml b/docs/guides/assembly.xml
index 48a321c81a31..e37b98089fa9 100644
--- a/docs/guides/assembly.xml
+++ b/docs/guides/assembly.xml
@@ -7,49 +7,49 @@
     <fileSets>
         <fileSet>
             <directory>${project.build.directory}</directory>
-            <outputDirectory>/</outputDirectory>
+            <outputDirectory/>
             <includes>
                 <include>generated-guides/**</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/server</directory>
-            <outputDirectory>/generated-guides/server/</outputDirectory>
+            <outputDirectory>generated-guides/server/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/getting-started</directory>
-            <outputDirectory>/generated-guides/getting-started/</outputDirectory>
+            <outputDirectory>generated-guides/getting-started/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/operator</directory>
-            <outputDirectory>/generated-guides/operator/</outputDirectory>
+            <outputDirectory>generated-guides/operator/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/observability</directory>
-            <outputDirectory>/generated-guides/observability/</outputDirectory>
+            <outputDirectory>generated-guides/observability/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/high-availability</directory>
-            <outputDirectory>/generated-guides/high-availability/</outputDirectory>
+            <outputDirectory>generated-guides/high-availability/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
         </fileSet>
         <fileSet>
             <directory>${project.basedir}/securing-apps</directory>
-            <outputDirectory>/generated-guides/securing-apps/</outputDirectory>
+            <outputDirectory>generated-guides/securing-apps/</outputDirectory>
             <includes>
                 <include>pinned-guides</include>
             </includes>
diff --git a/docs/guides/attributes.adoc b/docs/guides/attributes.adoc
index 3382ff849d7f..b2d3f85f9ab5 100644
--- a/docs/guides/attributes.adoc
+++ b/docs/guides/attributes.adoc
@@ -29,5 +29,6 @@
 :quickstartRepo_name: Keycloak Quickstarts Repository
 :quickstartRepo_dir: keycloak-quickstarts
 :securing_apps_link: https://www.keycloak.org/guides#securing-apps
+:upgrading_guide_link: {project_doc_base_url}/upgrading/
 :kc_js_path: /js
 :kc_realms_path: /realms
diff --git a/docs/guides/getting-started/getting-started-docker.adoc b/docs/guides/getting-started/getting-started-docker.adoc
index dae6b69bcfe2..89040aafc3f7 100644
--- a/docs/guides/getting-started/getting-started-docker.adoc
+++ b/docs/guides/getting-started/getting-started-docker.adoc
@@ -2,7 +2,7 @@
 
 <@tmpl.guide
 title="Docker"
-summary="Get started with {project_name} on Docker">
+summary="Get started with {project_name} on Docker.">
 
 :containerCommand: docker
 
diff --git a/docs/guides/getting-started/getting-started-kube.adoc b/docs/guides/getting-started/getting-started-kube.adoc
index eefe75d2ce86..727de6f402b2 100644
--- a/docs/guides/getting-started/getting-started-kube.adoc
+++ b/docs/guides/getting-started/getting-started-kube.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Kubernetes"
-summary="Get started with {project_name} on Kubernetes">
+summary="Get started with {project_name} on Kubernetes.">
 
 :links-admin-console: {project_name} Admin Console
 :links-account-console: {project_name} Account Console
@@ -32,7 +32,7 @@ minikube addons enable ingress
 
 The {project_name} QuickStarts repository includes some example files to help deploy {project_name} to Kubernetes.
 
-As a first step, create the {project_name} deployment and service by entering the following command:
+As a first step, create the {project_name} statefulset and service by entering the following command:
 
 [source,bash,subs="attributes+"]
 ----
diff --git a/docs/guides/getting-started/getting-started-openshift.adoc b/docs/guides/getting-started/getting-started-openshift.adoc
index b7e2540d430a..122346ce28e4 100644
--- a/docs/guides/getting-started/getting-started-openshift.adoc
+++ b/docs/guides/getting-started/getting-started-openshift.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="OpenShift"
-summary="Get started with {project_name} on OpenShift">
+summary="Get started with {project_name} on OpenShift.">
 
 :links-admin-console: {project_name} Admin Console
 :links-account-console: {project_name} Account Console
diff --git a/docs/guides/getting-started/getting-started-podman.adoc b/docs/guides/getting-started/getting-started-podman.adoc
index 51d15660759e..305756aae6d5 100644
--- a/docs/guides/getting-started/getting-started-podman.adoc
+++ b/docs/guides/getting-started/getting-started-podman.adoc
@@ -2,7 +2,7 @@
 
 <@tmpl.guide
 title="Podman"
-summary="Get started with {project_name} on Podman">
+summary="Get started with {project_name} on Podman.">
 
 :containerCommand: podman
 
diff --git a/docs/guides/getting-started/getting-started-scaling-and-tuning.adoc b/docs/guides/getting-started/getting-started-scaling-and-tuning.adoc
index 84001d47ad9d..9775dee8e8b7 100644
--- a/docs/guides/getting-started/getting-started-scaling-and-tuning.adoc
+++ b/docs/guides/getting-started/getting-started-scaling-and-tuning.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Scaling"
-summary="Get started with {project_name} scaling and tuning">
+summary="Scale and tune your {project_name} installation.">
 
 After starting {project_name}, consider adapting your instance to the required load using these scaling and tuning guidelines:
 
@@ -47,7 +47,7 @@ If you are not using the Operator, please review the following:
 
 - Your instances need a way to discover each other. For more information, see discovery in <@links.server id="caching" />.
 - This cache is not optimal for clusters that span multiple availability zones, which are also called stretch clusters. For embedded Infinispan cache, work to have all instances in one availability zone. The goal is to avoid unnecessary round-trips in the communication that would amplify in the response times. On Kubernetes, use Pod affinity to enforce this grouping of Pods.
-- This cache does not gracefully handle multiple members joining or leaving concurrently. In particular, members leaving at the same time can lead to data loss. On Kubernetes, you can use a StatefulSet with the default serial handling to ensure Pods are started and stopped sequentially.
+- This cache does not gracefully handle multiple members joining or leaving concurrently. In particular, members leaving at the same time can lead to data loss. On Kubernetes, use a StatefulSet with the default serial handling to ensure Pods are started and stopped sequentially, using a deployment is not supported or recommended.
 
 To avoid losing service availability when a whole site is unavailable, see the high availability guide for more information on a multi-site deployment. See <@links.ha id="introduction" />.
 
@@ -58,6 +58,33 @@ Horizontal autoscaling allows for adding or removing {project_name} instances on
 When using the embedded Infinispan cache cluster, dynamically adding or removing cluster members requires Infinispan to perform a rebalancing of the Infinispan caches, which can get expensive if many entries exist in those caches.
 To minimize this time we limit number of entries in session related caches to 10000 by default. Note, this optimization is possible only if `persistent-user-sessions` feature is not explicitly disabled in your configuration.
 
-On Kubernetes, the Keycloak custom resource is scalable meaning that it can be targeted by the https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/[built-in autoscaler].
+On Kubernetes, the Keycloak custom resource is scalable meaning that it can be targeted by the https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/[built-in autoscaler]. For example to scale on average CPU utilization:
+
+[source,yaml]
+----
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: keycloak-hpa
+  namespace: keycloak-cluster
+spec:
+  scaleTargetRef:
+    apiVersion: k8s.keycloak.org/v2alpha1
+    kind: Keycloak
+    name: keycloak
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 80
+----
+
+NOTE: Scaling on memory is generally not needed with persistent sessions enabled, and should not be needed at all when using remote {jdgserver_name}. If you are using persistent sessions or remote {jdgserver_name} and you experience memory issues, it is best to fully diagnose the problem and revisit the <@links.ha id="concepts-memory-and-cpu-sizing" /> guide. Adjusting the memory request and limit is preferable to horizontal scaling.
+
+Consult the https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/[Kubernetes docs] for additional information, including the usage of https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/#autoscaling-on-multiple-metrics-and-custom-metrics[custom metrics].
 
 </@tmpl.guide>
diff --git a/docs/guides/getting-started/getting-started-zip.adoc b/docs/guides/getting-started/getting-started-zip.adoc
index efd8fa43b71b..b40e610205a8 100644
--- a/docs/guides/getting-started/getting-started-zip.adoc
+++ b/docs/guides/getting-started/getting-started-zip.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="OpenJDK"
-summary="Get started with {project_name} on bare metal">
+summary="Get started with {project_name} on a physical or virtual server.">
 
 :links-local: true
 :links-admin-console: http://localhost:8080/admin[{project_name} Admin Console]
diff --git a/docs/guides/getting-started/templates/first-app.adoc b/docs/guides/getting-started/templates/first-app.adoc
index 17ea9b3fc1cb..eb585b0aaa0d 100644
--- a/docs/guides/getting-started/templates/first-app.adoc
+++ b/docs/guides/getting-started/templates/first-app.adoc
@@ -3,14 +3,15 @@
 To secure the first application, you start by registering the application with your {project_name} instance:
 
 . Open the {links-admin-console}.
-. Click the word *master* in the top-left corner, then click *myrealm*.
+. Click *myrealm* next to *Current realm*.
 . Click *Clients*.
 . Click *Create client*
 . Fill in the form with the following values:
 ** *Client type*: `OpenID Connect`
 ** *Client ID*: `myclient`
 +
-image::add-client-1.png[Add Client]
+.Add client
+image::add-client-1.png[Add client]
 . Click *Next*
 . Confirm that *Standard flow* is enabled.
 . Click *Next*.
@@ -19,7 +20,8 @@ image::add-client-1.png[Add Client]
 * Set *Web origins* to `+https://www.keycloak.org+`
 . Click *Save*.
 
-image::add-client-2.png[Update Client]
+.Update client
+image::add-client-2.png[Update client]
 
 To confirm the client was created successfully, you can use the SPA testing application on the https://www.keycloak.org/app/[Keycloak website].
 
diff --git a/docs/guides/getting-started/templates/realm-config.adoc b/docs/guides/getting-started/templates/realm-config.adoc
index 13544d0bbc05..fd0b5cc65201 100644
--- a/docs/guides/getting-started/templates/realm-config.adoc
+++ b/docs/guides/getting-started/templates/realm-config.adoc
@@ -11,17 +11,18 @@ includes a single realm, called `master`. Use this realm only for managing {proj
 Use these steps to create the first realm.
 
 . Open the {links-admin-console}.
-. Click *{project_name}* next to *master realm*, then click *Create Realm*.
+. Click *Create Realm* next to *Current realm*.
 . Enter `myrealm` in the *Realm name* field.
 . Click *Create*.
 
+.Add realm
 image::add-realm.png[Add realm]
 
 == Create a user
 
 Initially, the realm has no users. Use these steps to create a user:
 
-. Verify that you are still in the *myrealm* realm, which is shown above the word *Manage*.
+. Verify that you are still in the *myrealm* realm, which is next to *Current realm*.
 . Click *Users* in the left-hand menu.
 . Click *Create new user*.
 . Fill in the form with the following values:
@@ -30,6 +31,7 @@ Initially, the realm has no users. Use these steps to create a user:
 ** *Last name*: any last name
 . Click *Create*.
 
+.Create user
 image::add-user.png[Create user]
 
 This user needs a password to log in. To set the initial password:
@@ -38,4 +40,5 @@ This user needs a password to log in. To set the initial password:
 . Fill in the *Set password* form with a password.
 . Toggle *Temporary* to *Off* so that the user does not need to update this password at the first login.
 
+.Set password
 image::set-password.png[Set password]
diff --git a/docs/guides/getting-started/templates/start-keycloak-container.adoc b/docs/guides/getting-started/templates/start-keycloak-container.adoc
index f66392974d0d..87c32f39b72e 100644
--- a/docs/guides/getting-started/templates/start-keycloak-container.adoc
+++ b/docs/guides/getting-started/templates/start-keycloak-container.adoc
@@ -4,7 +4,7 @@ From a terminal, enter the following command to start {project_name}:
 
 [source,bash,subs="attributes+"]
 ----
-{containerCommand} run -p 8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:{version} start-dev
+{containerCommand} run -p 127.0.0.1:8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:{version} start-dev
 ----
 
 This command starts {project_name} exposed on the local port 8080 and creates an initial admin user with the username `admin`
diff --git a/docs/guides/high-availability/bblocks-multi-site.adoc b/docs/guides/high-availability/bblocks-multi-site.adoc
index 6593b98ef962..6d4375e6626b 100644
--- a/docs/guides/high-availability/bblocks-multi-site.adoc
+++ b/docs/guides/high-availability/bblocks-multi-site.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Building blocks multi-site deployments"
-summary="Overview of building blocks, alternatives and not considered options" >
+summary="Learn about building blocks and suggested setups for multi-site deployments." >
 
 The following building blocks are needed to set up a multi-site deployment with synchronous replication.
 
diff --git a/docs/guides/high-availability/concepts-database-connections.adoc b/docs/guides/high-availability/concepts-database-connections.adoc
index afb4aee788bf..e9108ee486ba 100644
--- a/docs/guides/high-availability/concepts-database-connections.adoc
+++ b/docs/guides/high-availability/concepts-database-connections.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Concepts for database connection pools"
-summary="Understand these concepts to avoid resource exhaustion and congestion"
+summary="Understand concepts for avoiding resource exhaustion and congestion."
 tileVisible="false" >
 
 This section is intended when you want to understand considerations and best practices on how to configure database connection pools for {project_name}.
diff --git a/docs/guides/high-availability/concepts-memory-and-cpu-sizing.adoc b/docs/guides/high-availability/concepts-memory-and-cpu-sizing.adoc
index 9708ecc689f6..a897ddc5d80c 100644
--- a/docs/guides/high-availability/concepts-memory-and-cpu-sizing.adoc
+++ b/docs/guides/high-availability/concepts-memory-and-cpu-sizing.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Concepts for sizing CPU and memory resources"
-summary="Understand these concepts to avoid resource exhaustion and congestion"
+summary="Understand concepts for avoiding resource exhaustion and congestion."
 tileVisible="false" >
 
 Use this as a starting point to size a product environment.
@@ -150,7 +150,7 @@ The benefit of this setup is that the number of Pods does not need to scale duri
 
 The following setup was used to retrieve the settings above to run tests of about 10 minutes for different scenarios:
 
-* OpenShift 4.16.x deployed on AWS via ROSA.
+* OpenShift 4.17.x deployed on AWS via ROSA.
 * Machine pool with `c7g.2xlarge` instances.^*^
 * {project_name} deployed with the Operator and 3 pods in a high-availability setup with two sites in active/active mode.
 * OpenShift's reverse proxy runs in the passthrough mode where the TLS connection of the client is terminated at the Pod.
diff --git a/docs/guides/high-availability/concepts-multi-site.adoc b/docs/guides/high-availability/concepts-multi-site.adoc
index d2f463a79ba3..946650d542ef 100644
--- a/docs/guides/high-availability/concepts-multi-site.adoc
+++ b/docs/guides/high-availability/concepts-multi-site.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Concepts for multi-site deployments"
-summary="Understanding a multi-site deployment with synchronous replication" >
+summary="Understand multi-site deployment with synchronous replication." >
 
 This topic describes a highly available multi-site setup and the behavior to expect. It outlines the requirements of the high availability architecture and describes the benefits and tradeoffs.
 
diff --git a/docs/guides/high-availability/concepts-threads.adoc b/docs/guides/high-availability/concepts-threads.adoc
index baaac0932c55..f7c8800e833f 100644
--- a/docs/guides/high-availability/concepts-threads.adoc
+++ b/docs/guides/high-availability/concepts-threads.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Concepts for configuring thread pools"
-summary="Understand these concepts to avoid resource exhaustion and congestion"
+summary="Understand concepts for avoiding resource exhaustion and congestion."
 tileVisible="false" >
 
 
@@ -17,7 +17,7 @@ For a configuration where this is applied, visit <@links.ha id="deploy-keycloak-
 // remove this paragraph once OpenJDK 17 is no longer supported on the server side.
 // https://github.com/keycloak/keycloak/issues/31101
 
-JGroups communications, which is used in single-site setups for the communication between {project_name} nodes, benefits from the use of virtual threads which are available in OpenJDK 21.
+JGroups communications, which is used in single-site setups for the communication between {project_name} nodes, benefits from the use of virtual threads which are available in OpenJDK 21 when at least two cores are available for {project_name}.
 This reduces the memory usage and removes the need to configure thread pool sizes.
 Therefore, the use of OpenJDK 21 is recommended.
 
diff --git a/docs/guides/high-availability/deploy-aurora-multi-az.adoc b/docs/guides/high-availability/deploy-aurora-multi-az.adoc
index ce6545bc412d..e1b782959543 100644
--- a/docs/guides/high-availability/deploy-aurora-multi-az.adoc
+++ b/docs/guides/high-availability/deploy-aurora-multi-az.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Deploy AWS Aurora in multiple availability zones"
-summary="Building block for a database"
+title="Deploying AWS Aurora in multiple availability zones"
+summary="Deploy an AWS Aurora as the database building block in a multi-site deployment."
 tileVisible="false" >
 
 This topic describes how to deploy an Aurora regional deployment of a PostgreSQL instance across multiple availability zones to tolerate one or more availability zone failures in a given AWS region.
diff --git a/docs/guides/high-availability/deploy-aws-accelerator-fencing-lambda.adoc b/docs/guides/high-availability/deploy-aws-accelerator-fencing-lambda.adoc
index aa2d75ea2f83..2b2468ae553d 100644
--- a/docs/guides/high-availability/deploy-aws-accelerator-fencing-lambda.adoc
+++ b/docs/guides/high-availability/deploy-aws-accelerator-fencing-lambda.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Deploy an AWS Lambda to disable a non-responding site"
-summary="Building block for load balancer resilience"
+title="Deploying an AWS Lambda to disable a non-responding site"
+summary="Deploy an AWS Lambda as part of the load-balancer building block in a multi-site deployment."
 tileVisible="false" >
 
 This {section} explains how to resolve split-brain scenarios between two sites in a multi-site deployment.
diff --git a/docs/guides/high-availability/deploy-aws-accelerator-loadbalancer.adoc b/docs/guides/high-availability/deploy-aws-accelerator-loadbalancer.adoc
index 8a6de2269155..41a2539109d9 100644
--- a/docs/guides/high-availability/deploy-aws-accelerator-loadbalancer.adoc
+++ b/docs/guides/high-availability/deploy-aws-accelerator-loadbalancer.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Deploy an AWS Global Accelerator load balancer"
-summary="Building block for a load balancer"
+title="Deploying an AWS Global Accelerator load balancer"
+summary="Deploy an AWS Global Accelerator as the load-balancer building block in a multi-site deployment."
 tileVisible="false" >
 
 This topic describes the procedure required to deploy an AWS Global Accelerator to route traffic between multi-site {project_name} deployments.
diff --git a/docs/guides/high-availability/deploy-infinispan-kubernetes-crossdc.adoc b/docs/guides/high-availability/deploy-infinispan-kubernetes-crossdc.adoc
index 5994c5c2a0d1..15cf8f546631 100644
--- a/docs/guides/high-availability/deploy-infinispan-kubernetes-crossdc.adoc
+++ b/docs/guides/high-availability/deploy-infinispan-kubernetes-crossdc.adoc
@@ -3,8 +3,8 @@
 <#import "/templates/profile.adoc" as profile>
 
 <@tmpl.guide
-title="Deploy {jdgserver_name} for HA with the {jdgserver_name} Operator"
-summary="Building block for an {jdgserver_name} deployment on Kubernetes"
+title="Deploying {jdgserver_name} for HA with the {jdgserver_name} Operator"
+summary="Deploy {jdgserver_name} for high availability in multi availability zones on Kubernetes."
 tileVisible="false"
 includedOptions="cache-remote-*">
 
@@ -304,9 +304,6 @@ include::examples/generated/keycloak-ispn.yaml[tag=keycloak-ispn]
 This is optional and it defaults to `11222`.
 <3> The Secret `name` and `key` with the {jdgserver_name} username credential.
 <4> The Secret `name` and `key` with the {jdgserver_name} password credential.
-<5> The `spi-connections-infinispan-quarkus-site-name` is an arbitrary {jdgserver_name} site name which {project_name} needs for its Infinispan caches deployment when a remote store is used.
-This site-name is related only to the Infinispan caches and does not need to match any value from the external {jdgserver_name} deployment.
-If you are using multiple sites for {project_name} in a cross-DC setup such as <@links.ha id="deploy-infinispan-kubernetes-crossdc" />, the site name must be different in each site.
 
 === Architecture
 
diff --git a/docs/guides/high-availability/deploy-keycloak-kubernetes.adoc b/docs/guides/high-availability/deploy-keycloak-kubernetes.adoc
index acae4135eafa..28b493175a4b 100644
--- a/docs/guides/high-availability/deploy-keycloak-kubernetes.adoc
+++ b/docs/guides/high-availability/deploy-keycloak-kubernetes.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Deploy {project_name} for HA with the {project_name} Operator"
-summary="Building block for a {project_name} deployment"
+title="Deploying {project_name} for HA with the Operator"
+summary="Deploy {project_name} for high availability with the {project_name} Operator as a building block."
 tileVisible="false" >
 
 This guide describes advanced {project_name} configurations for Kubernetes which are load tested and will recover from single Pod failures.
@@ -43,10 +43,7 @@ As most requests will not touch the database due to the {project_name} embedded
 See the <@links.ha id="concepts-database-connections" /> {section} for details.
 <2> Specify the URL to your custom {project_name} image. If your image is optimized, set the `startOptimized` flag to `true`.
 <3> Enable additional features for multi-site support like the loadbalancer probe `/lb-check`.
-<4> XA transactions are not supported by the https://github.com/awslabs/aws-advanced-jdbc-wrapper/releases/[Amazon Web Services JDBC Driver].
-<5> To be able to analyze the system under load, enable the metrics endpoint.
-The disadvantage of the setting is that the metrics will be available at the external {project_name} endpoint, so you must add a filter so that the endpoint is not available from the outside.
-Use a reverse proxy in front of {project_name} to filter out those URLs.
+<4> To be able to analyze the system under load, enable the metrics endpoint.
 
 == Verifying the deployment
 
diff --git a/docs/guides/high-availability/examples/generated/ispn-single.yaml b/docs/guides/high-availability/examples/generated/ispn-single.yaml
index a820756add4e..cd68883c4c7c 100644
--- a/docs/guides/high-availability/examples/generated/ispn-single.yaml
+++ b/docs/guides/high-availability/examples/generated/ispn-single.yaml
@@ -24,6 +24,12 @@ data:
         metrics:
           namesAsTags: true
           histograms: false
+        tracing:
+          enabled: true
+          collector-endpoint: "http://tempo-tempo.monitoring.svc:4318"
+          exporter-protocol: "OTLP"
+          service-name: "infinispan-server"
+          security: false
       server:
         endpoints:
           - securityRealm: default
@@ -305,12 +311,12 @@ spec:
   expose:
     type: Route
   configMapName: "cluster-config"
-  image: quay.io/infinispan/server:15.0.11.Final
-  version: 15.0.4
+  image: quay.io/infinispan/server:15.0.15.Final
+  version: 15.0.15
   configListener:
     enabled: false
   container:
-    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=15000'
+    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dorg.infinispan.threads.virtual=true -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=15000 -Dotel.traces.sampler=parentbased_always_off'
     cpu: 4:2
     memory: 2Gi:1Gi
   logging:
diff --git a/docs/guides/high-availability/examples/generated/ispn-site-a.yaml b/docs/guides/high-availability/examples/generated/ispn-site-a.yaml
index fa331d38a824..7951e9cd2101 100644
--- a/docs/guides/high-availability/examples/generated/ispn-site-a.yaml
+++ b/docs/guides/high-availability/examples/generated/ispn-site-a.yaml
@@ -36,6 +36,12 @@ data:
         metrics:
           namesAsTags: true
           histograms: false
+        tracing:
+          enabled: true
+          collector-endpoint: "http://tempo-tempo.monitoring.svc:4318"
+          exporter-protocol: "OTLP"
+          service-name: "infinispan-server"
+          security: false
       server:
         endpoints:
           - securityRealm: default
@@ -339,12 +345,12 @@ spec:
   expose:
     type: Route
   configMapName: "cluster-config"
-  image: quay.io/infinispan/server:15.0.11.Final
-  version: 15.0.4
+  image: 
+  version: 15.0.15
   configListener:
     enabled: false
   container:
-    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000'
+    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dorg.infinispan.threads.virtual=true -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000 -Dotel.traces.sampler=parentbased_always_off'
   logging:
     categories:
       org.infinispan: info
diff --git a/docs/guides/high-availability/examples/generated/ispn-site-b.yaml b/docs/guides/high-availability/examples/generated/ispn-site-b.yaml
index e730098c1a05..397f5852e25d 100644
--- a/docs/guides/high-availability/examples/generated/ispn-site-b.yaml
+++ b/docs/guides/high-availability/examples/generated/ispn-site-b.yaml
@@ -36,6 +36,12 @@ data:
         metrics:
           namesAsTags: true
           histograms: false
+        tracing:
+          enabled: true
+          collector-endpoint: "http://tempo-tempo.monitoring.svc:4318"
+          exporter-protocol: "OTLP"
+          service-name: "infinispan-server"
+          security: false
       server:
         endpoints:
           - securityRealm: default
@@ -339,12 +345,12 @@ spec:
   expose:
     type: Route
   configMapName: "cluster-config"
-  image: quay.io/infinispan/server:15.0.11.Final
-  version: 15.0.4
+  image: 
+  version: 15.0.15
   configListener:
     enabled: false
   container:
-    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000'
+    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dorg.infinispan.threads.virtual=true -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000 -Dotel.traces.sampler=parentbased_always_off'
     cpu: 4:2
     memory: 2Gi:1Gi
   logging:
diff --git a/docs/guides/high-availability/examples/generated/ispn-volatile.yaml b/docs/guides/high-availability/examples/generated/ispn-volatile.yaml
index d126a78e5875..361dfae06886 100644
--- a/docs/guides/high-availability/examples/generated/ispn-volatile.yaml
+++ b/docs/guides/high-availability/examples/generated/ispn-volatile.yaml
@@ -36,6 +36,12 @@ data:
         metrics:
           namesAsTags: true
           histograms: false
+        tracing:
+          enabled: true
+          collector-endpoint: "http://tempo-tempo.monitoring.svc:4318"
+          exporter-protocol: "OTLP"
+          service-name: "infinispan-server"
+          security: false
       server:
         endpoints:
           - securityRealm: default
@@ -507,12 +513,12 @@ spec:
   expose:
     type: Route
   configMapName: "cluster-config"
-  image: quay.io/infinispan/server:15.0.11.Final
-  version: 15.0.4
+  image: 
+  version: 15.0.15
   configListener:
     enabled: false
   container:
-    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000'
+    extraJvmOpts: '-Dorg.infinispan.openssl=false -Dorg.infinispan.threads.virtual=true -Dinfinispan.cluster.name=ISPN  -Djgroups.xsite.fd.interval=2000 -Djgroups.xsite.fd.timeout=10000 -Dotel.traces.sampler=parentbased_always_off'
     cpu: 4:2
     memory: 2Gi:1Gi
   logging:
diff --git a/docs/guides/high-availability/examples/generated/keycloak-ispn.yaml b/docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
index 6b8f5bf36bb8..7a6e27ed209e 100644
--- a/docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
+++ b/docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
@@ -54,7 +54,7 @@ metadata:
   name: keycloak-providers
   namespace: keycloak
 binaryData:
-  keycloak-benchmark-dataset-0.15-SNAPSHOT.jar: ...
+  keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar: ...
 ---
 # Source: keycloak/templates/postgres/postgres-exporter-configmap.yaml
 apiVersion: v1
@@ -206,7 +206,7 @@ spec:
               value: keycloak
             - name: POSTGRES_DB
               value: keycloak
-          image: postgres:15
+          image: mirror.gcr.io/postgres:15
           volumeMounts:
             # Using volume mount for PostgreSQL's data folder as it is otherwise not writable
             - mountPath: /var/lib/postgresql
@@ -351,7 +351,7 @@ spec:
             - name: SQLPAD_CONNECTIONS__pgdemo__username
               value: keycloak
             - name: SQLPAD_CONNECTIONS__pgdemo__password
-              value: pass
+              value: secret99
             - name: SQLPAD_CONNECTIONS__pgdemo__database
               value: keycloak
             - name: SQLPAD_CONNECTIONS__pgdemo__driver
@@ -362,7 +362,7 @@ spec:
               value: '86400'
             - name: SQLPAD_QUERY_RESULT_MAX_ROWS
               value: '100000'
-          image: sqlpad/sqlpad:6.11.0
+          image: mirror.gcr.io/sqlpad/sqlpad:6.11.0
           imagePullPolicy: Always
           startupProbe:
             httpGet:
@@ -451,14 +451,10 @@ spec:
   startOptimized: false # <2>
   features:
     enabled:
-      - user-event-metrics
       - multi-site # <3>
-  transaction:
-    xaEnabled: false # <4>
   # tag::keycloak-ispn[]
   additionalOptions:
     # end::keycloak-ispn[]
-
     # end::keycloak[]
     - name: http-metrics-histograms-enabled
       value: 'true'
@@ -473,7 +469,7 @@ spec:
     # tag::keycloak[]
     - name: log-console-output
       value: json
-    - name: metrics-enabled # <5>
+    - name: metrics-enabled # <4>
       value: 'true'
     - name: event-metrics-user-enabled
       value: 'true'
@@ -490,10 +486,9 @@ spec:
       secret:
         name: remote-store-secret
         key: password
-    - name: spi-connections-infinispan-quarkus-site-name # <5>
-      value: keycloak
-    # end::keycloak-ispn[]
     - name: db-driver
+      # end::keycloak-ispn[]
+
       value: software.amazon.jdbc.Driver
   http:
     tlsSecret: keycloak-tls-secret
@@ -503,7 +498,7 @@ spec:
     podTemplate:
       metadata:
         annotations:
-          checksum/config: a6e4c8f98e1b1035942cd1121684f817d533021a392be90b5df784f474146350-9bfd430c6539df907f0421bb34c92fb32194d461565bd342f7f96ff5a5408273-<KEYCLOAK_IMAGE_HERE>-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
+          checksum/config: 74d09d74f6547eec9888f07648f5f5be52afa1be1a6231f286cbd368e86e6f19-099f6e0e31165c359aa5534e8dc6e42b603410742f45fefbc62d923ea6cb7e64-<KEYCLOAK_IMAGE_HERE>-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
       spec:
         containers:
           - env:
@@ -520,10 +515,11 @@ spec:
                     name: keycloak-preconfigured-admin
                     key: password
                     optional: false
-              - name: JAVA_OPTS_APPEND # <5>
-                value: ""
+              - name: JAVA_OPTS_APPEND
+                value: >
+                  -Djdk.tracePinnedThreads=full
+
             ports:
-            # end::keycloak[]
             # readinessProbe:
             #   exec:
             #     command:
@@ -534,8 +530,8 @@ spec:
             #       - 'true'
             volumeMounts:
               - name: keycloak-providers
-                mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-0.15-SNAPSHOT.jar
-                subPath: keycloak-benchmark-dataset-0.15-SNAPSHOT.jar
+                mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar
+                subPath: keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar
                 readOnly: true
         volumes:
           - name: keycloak-providers
@@ -552,11 +548,26 @@ spec:
   selector:
     matchLabels:
       app: keycloak
+  # Use pod target labels "as is" without any renaming
+  # podTargetLabels:
+  #   - app
+  # Since at least Keycloak 26.2 and the latest Quarkus 3.19 version, it requires "OpenMetricsText1.0.0" to retrieve exemplars,
+  # as at least some of the other protocols don't support exemplars.
+  scrapeProtocols:
+    - OpenMetricsText1.0.0
   podMetricsEndpoints:
     - port: management
       scheme: https
       tlsConfig:
         insecureSkipVerify: true
+      relabelings:
+        - targetLabel: application
+          # Alternative: hard-coded value
+          # replacement: "keycloak"
+          sourceLabels:
+            - __meta_kubernetes_pod_label_app
+          regex: (.+)
+          replacement: ${1}
 ---
 # Source: keycloak/templates/postgres/postgres-exporter.yaml
 apiVersion: monitoring.coreos.com/v1
diff --git a/docs/guides/high-availability/examples/generated/keycloak.yaml b/docs/guides/high-availability/examples/generated/keycloak.yaml
index 522716939809..1bed3e371a71 100644
--- a/docs/guides/high-availability/examples/generated/keycloak.yaml
+++ b/docs/guides/high-availability/examples/generated/keycloak.yaml
@@ -41,7 +41,7 @@ metadata:
   name: keycloak-providers
   namespace: keycloak
 binaryData:
-  keycloak-benchmark-dataset-0.15-SNAPSHOT.jar: ...
+  keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar: ...
 ---
 # Source: keycloak/templates/postgres/postgres-exporter-configmap.yaml
 apiVersion: v1
@@ -193,7 +193,7 @@ spec:
               value: keycloak
             - name: POSTGRES_DB
               value: keycloak
-          image: postgres:15
+          image: mirror.gcr.io/postgres:15
           volumeMounts:
             # Using volume mount for PostgreSQL's data folder as it is otherwise not writable
             - mountPath: /var/lib/postgresql
@@ -338,7 +338,7 @@ spec:
             - name: SQLPAD_CONNECTIONS__pgdemo__username
               value: keycloak
             - name: SQLPAD_CONNECTIONS__pgdemo__password
-              value: pass
+              value: secret99
             - name: SQLPAD_CONNECTIONS__pgdemo__database
               value: keycloak
             - name: SQLPAD_CONNECTIONS__pgdemo__driver
@@ -349,7 +349,7 @@ spec:
               value: '86400'
             - name: SQLPAD_QUERY_RESULT_MAX_ROWS
               value: '100000'
-          image: sqlpad/sqlpad:6.11.0
+          image: mirror.gcr.io/sqlpad/sqlpad:6.11.0
           imagePullPolicy: Always
           startupProbe:
             httpGet:
@@ -440,14 +440,10 @@ spec:
   startOptimized: false # <2>
   features:
     enabled:
-      - user-event-metrics
       - multi-site # <3>
-  transaction:
-    xaEnabled: false # <4>
   # tag::keycloak-ispn[]
   additionalOptions:
     # end::keycloak-ispn[]
-
     # end::keycloak[]
     - name: http-metrics-histograms-enabled
       value: 'true'
@@ -462,7 +458,7 @@ spec:
     # tag::keycloak[]
     - name: log-console-output
       value: json
-    - name: metrics-enabled # <5>
+    - name: metrics-enabled # <4>
       value: 'true'
     - name: event-metrics-user-enabled
       value: 'true'
@@ -481,8 +477,6 @@ spec:
       secret:
         name: remote-store-secret
         key: password
-    - name: spi-connections-infinispan-quarkus-site-name
-      value: keycloak
     - name: db-driver
       value: software.amazon.jdbc.Driver
   http:
@@ -493,7 +487,7 @@ spec:
     podTemplate:
       metadata:
         annotations:
-          checksum/config: a6e4c8f98e1b1035942cd1121684f817d533021a392be90b5df784f474146350-9af6f9e8393229798cfb789798e36f84e39803616fe3e51b2a38e3ce05830565-<KEYCLOAK_IMAGE_HERE>-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
+          checksum/config: 74d09d74f6547eec9888f07648f5f5be52afa1be1a6231f286cbd368e86e6f19-b9788fd7a0f3ed13e27c33f89e0e1019fc1fb7d445005dada32fab73b68c335b-<KEYCLOAK_IMAGE_HERE>-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
       spec:
         containers:
           - env:
@@ -510,10 +504,11 @@ spec:
                     name: keycloak-preconfigured-admin
                     key: password
                     optional: false
-              - name: JAVA_OPTS_APPEND # <5>
-                value: ""
+              - name: JAVA_OPTS_APPEND
+                value: >
+                  -Djdk.tracePinnedThreads=full
+
             ports:
-            # end::keycloak[]
             # readinessProbe:
             #   exec:
             #     command:
@@ -524,8 +519,8 @@ spec:
             #       - 'true'
             volumeMounts:
               - name: keycloak-providers
-                mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-0.15-SNAPSHOT.jar
-                subPath: keycloak-benchmark-dataset-0.15-SNAPSHOT.jar
+                mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar
+                subPath: keycloak-benchmark-dataset-999.0.0-SNAPSHOT.jar
                 readOnly: true
         volumes:
           - name: keycloak-providers
@@ -542,11 +537,26 @@ spec:
   selector:
     matchLabels:
       app: keycloak
+  # Use pod target labels "as is" without any renaming
+  # podTargetLabels:
+  #   - app
+  # Since at least Keycloak 26.2 and the latest Quarkus 3.19 version, it requires "OpenMetricsText1.0.0" to retrieve exemplars,
+  # as at least some of the other protocols don't support exemplars.
+  scrapeProtocols:
+    - OpenMetricsText1.0.0
   podMetricsEndpoints:
     - port: management
       scheme: https
       tlsConfig:
         insecureSkipVerify: true
+      relabelings:
+        - targetLabel: application
+          # Alternative: hard-coded value
+          # replacement: "keycloak"
+          sourceLabels:
+            - __meta_kubernetes_pod_label_app
+          regex: (.+)
+          replacement: ${1}
 ---
 # Source: keycloak/templates/postgres/postgres-exporter.yaml
 apiVersion: monitoring.coreos.com/v1
diff --git a/docs/guides/high-availability/health-checks-multi-site.adoc b/docs/guides/high-availability/health-checks-multi-site.adoc
index 01deaaf4d561..09b847999052 100644
--- a/docs/guides/high-availability/health-checks-multi-site.adoc
+++ b/docs/guides/high-availability/health-checks-multi-site.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Health checks for multi-site deployments"
-summary="Validating the health of a multi-site deployment" >
+summary="Validate the health of a multi-site deployment." >
 
 When running the <@links.ha id="introduction" /> in a Kubernetes environment,
 you should automate checks to see if everything is up and running as expected.
diff --git a/docs/guides/high-availability/introduction.adoc b/docs/guides/high-availability/introduction.adoc
index 537480879a61..963d8e260625 100644
--- a/docs/guides/high-availability/introduction.adoc
+++ b/docs/guides/high-availability/introduction.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Multi-site deployments"
-summary="Connect multiple {project_name} deployments in different sites to increase the overall availability" >
+summary="Connect multiple {project_name} deployments in different sites to increase the overall availability." >
 
 {project_name} supports deployments that consist of multiple {project_name} instances that connect to each other using its Infinispan caches; load balancers can distribute the load evenly across those instances.
 Those setups are intended for a transparent network on a single site.
@@ -48,10 +48,10 @@ using ROSA HCP.
 ** Each Openshift cluster has all its workers in a single Availability Zone.
 ** OpenShift version
 <@profile.ifProduct>
-4.16 (or later).
+4.17 (or later).
 </@profile.ifProduct>
 <@profile.ifCommunity>
-4.16.
+4.17.
 </@profile.ifCommunity>
 
 * Amazon Aurora PostgreSQL database
diff --git a/docs/guides/high-availability/operate-site-offline.adoc b/docs/guides/high-availability/operate-site-offline.adoc
index 7896548a23b1..36fa9c5724eb 100644
--- a/docs/guides/high-availability/operate-site-offline.adoc
+++ b/docs/guides/high-availability/operate-site-offline.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Take site offline"
-summary="This describes how to take a site offline so that it no longer processes client requests" >
+title="Taking a site offline"
+summary="Take a site offline so that it no longer processes client requests." >
 
 == When to use this procedure
 
diff --git a/docs/guides/high-availability/operate-site-online.adoc b/docs/guides/high-availability/operate-site-online.adoc
index 2e8dfe903c63..4f6304dcffc5 100644
--- a/docs/guides/high-availability/operate-site-online.adoc
+++ b/docs/guides/high-availability/operate-site-online.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Bring site online"
-summary="This guide describes how to bring a site online so that it can process client requests." >
+title="Bringing a site online"
+summary="Bring a site online so that it can process client requests." >
 
 == When to use this procedure
 
diff --git a/docs/guides/high-availability/operate-synchronize.adoc b/docs/guides/high-availability/operate-synchronize.adoc
index b1f416f46248..84db04966a6c 100644
--- a/docs/guides/high-availability/operate-synchronize.adoc
+++ b/docs/guides/high-availability/operate-synchronize.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Synchronize Sites"
-summary="This describes the procedures required to synchronize an offline site with an online site" >
+title="Synchronizing sites"
+summary="Synchronize an offline site with an online site." >
 
 include::partials/infinispan/infinispan-attributes.adoc[]
 
diff --git a/docs/guides/high-availability/partials/aurora/aurora-multiaz-create-procedure.adoc b/docs/guides/high-availability/partials/aurora/aurora-multiaz-create-procedure.adoc
index d1a7b112097c..7f47c0d572b3 100644
--- a/docs/guides/high-availability/partials/aurora/aurora-multiaz-create-procedure.adoc
+++ b/docs/guides/high-availability/partials/aurora/aurora-multiaz-create-procedure.adoc
@@ -306,6 +306,7 @@ The values specified here must be used when configuring the {project_name} datab
 [source,bash]
 ----
   aws rds create-db-instance \
+    --no-auto-minor-version-upgrade \
     --db-cluster-identifier keycloak-aurora \
     --db-instance-identifier "keycloak-aurora-instance-1" \
     --db-instance-class db.t4g.large \
@@ -319,6 +320,7 @@ The values specified here must be used when configuring the {project_name} datab
 [source,bash]
 ----
   aws rds create-db-instance \
+    --no-auto-minor-version-upgrade \
     --db-cluster-identifier keycloak-aurora \
     --db-instance-identifier "keycloak-aurora-instance-2" \
     --db-instance-class db.t4g.large \
diff --git a/docs/guides/high-availability/pinned-guides b/docs/guides/high-availability/pinned-guides
index 01a52a59d989..4883a9fb043c 100644
--- a/docs/guides/high-availability/pinned-guides
+++ b/docs/guides/high-availability/pinned-guides
@@ -1,13 +1,16 @@
 introduction
 concepts-multi-site
 bblocks-multi-site
+concepts-database-connections
+concepts-threads
+concepts-memory-and-cpu-sizing
+concepts-infinispan-cli-batch
 deploy-aurora-multi-az
 deploy-infinispan-kubernetes-crossdc
 deploy-keycloak-kubernetes
-deploy-aws-route53-loadbalancer
-deploy-aws-route53-failover-lambda
-health-checks-multi-site
-operate-failover
-operate-switch-over
-operate-network-partition-recovery
-operate-switch-back
\ No newline at end of file
+deploy-aws-accelerator-loadbalancer
+deploy-aws-accelerator-fencing-lambda
+operate-site-offline
+operate-site-online
+operate-synchronize
+health-checks-multi-site
\ No newline at end of file
diff --git a/docs/guides/images/add-client-1.png b/docs/guides/images/add-client-1.png
index a981b9db36a4..956043d3bd1b 100644
Binary files a/docs/guides/images/add-client-1.png and b/docs/guides/images/add-client-1.png differ
diff --git a/docs/guides/images/add-client-2.png b/docs/guides/images/add-client-2.png
index 2e1274eaf285..2f7fec8b7641 100644
Binary files a/docs/guides/images/add-client-2.png and b/docs/guides/images/add-client-2.png differ
diff --git a/docs/guides/images/add-realm.png b/docs/guides/images/add-realm.png
index eb9a194b0a65..19bf11161667 100644
Binary files a/docs/guides/images/add-realm.png and b/docs/guides/images/add-realm.png differ
diff --git a/docs/guides/images/add-user.png b/docs/guides/images/add-user.png
index 1ca1384a0068..e823c9d774c3 100644
Binary files a/docs/guides/images/add-user.png and b/docs/guides/images/add-user.png differ
diff --git a/docs/guides/images/manual-approval-olm.png b/docs/guides/images/manual-approval-olm.png
new file mode 100644
index 000000000000..5a60b6614ba5
Binary files /dev/null and b/docs/guides/images/manual-approval-olm.png differ
diff --git a/docs/guides/images/observability/exemplar.png b/docs/guides/images/observability/exemplar.png
new file mode 100644
index 000000000000..14f35f65f4c2
Binary files /dev/null and b/docs/guides/images/observability/exemplar.png differ
diff --git a/docs/guides/images/observability/grafana-share-icon.svg b/docs/guides/images/observability/grafana-share-icon.svg
new file mode 100644
index 000000000000..5a96a8a6181d
--- /dev/null
+++ b/docs/guides/images/observability/grafana-share-icon.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Do not edit this file with editors other than diagrams.net -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="28" height="28" class="css-hj6vlq"><path d="M18,14a4,4,0,0,0-3.08,1.48l-5.1-2.35a3.64,3.64,0,0,0,0-2.26l5.1-2.35A4,4,0,1,0,14,6a4.17,4.17,0,0,0,.07.71L8.79,9.14a4,4,0,1,0,0,5.72l5.28,2.43A4.17,4.17,0,0,0,14,18a4,4,0,1,0,4-4ZM18,4a2,2,0,1,1-2,2A2,2,0,0,1,18,4ZM6,14a2,2,0,1,1,2-2A2,2,0,0,1,6,14Zm12,6a2,2,0,1,1,2-2A2,2,0,0,1,18,20Z"></path></svg>
\ No newline at end of file
diff --git a/docs/guides/images/observability/keycloak-capacity-planning-dashboard.png b/docs/guides/images/observability/keycloak-capacity-planning-dashboard.png
new file mode 100644
index 000000000000..38d3e1c61310
Binary files /dev/null and b/docs/guides/images/observability/keycloak-capacity-planning-dashboard.png differ
diff --git a/docs/guides/images/observability/keycloak-troubleshooting-grafana-dashboard.png b/docs/guides/images/observability/keycloak-troubleshooting-grafana-dashboard.png
new file mode 100644
index 000000000000..1341460ea6c2
Binary files /dev/null and b/docs/guides/images/observability/keycloak-troubleshooting-grafana-dashboard.png differ
diff --git a/docs/guides/images/token-exchange-switch-refresh.png b/docs/guides/images/token-exchange-switch-refresh.png
new file mode 100644
index 000000000000..2cdd0f6c7d6a
Binary files /dev/null and b/docs/guides/images/token-exchange-switch-refresh.png differ
diff --git a/docs/guides/images/token-exchange-switch.png b/docs/guides/images/token-exchange-switch.png
new file mode 100644
index 000000000000..e326489b2e3f
Binary files /dev/null and b/docs/guides/images/token-exchange-switch.png differ
diff --git a/docs/guides/images/ui-customization/account-console-with-avatar.png b/docs/guides/images/ui-customization/account-console-with-avatar.png
new file mode 100644
index 000000000000..9b22807101c1
Binary files /dev/null and b/docs/guides/images/ui-customization/account-console-with-avatar.png differ
diff --git a/docs/guides/images/ui-customization/avatar-validation.png b/docs/guides/images/ui-customization/avatar-validation.png
new file mode 100644
index 000000000000..f6e1bfffc063
Binary files /dev/null and b/docs/guides/images/ui-customization/avatar-validation.png differ
diff --git a/docs/guides/images/ui-customization/color-chooser.png b/docs/guides/images/ui-customization/color-chooser.png
new file mode 100644
index 000000000000..da720917a54c
Binary files /dev/null and b/docs/guides/images/ui-customization/color-chooser.png differ
diff --git a/docs/guides/images/ui-customization/custom-account-console.png b/docs/guides/images/ui-customization/custom-account-console.png
new file mode 100644
index 000000000000..d7a1b459f1d0
Binary files /dev/null and b/docs/guides/images/ui-customization/custom-account-console.png differ
diff --git a/docs/guides/images/ui-customization/device-activity-after.png b/docs/guides/images/ui-customization/device-activity-after.png
new file mode 100644
index 000000000000..6f30d91af838
Binary files /dev/null and b/docs/guides/images/ui-customization/device-activity-after.png differ
diff --git a/docs/guides/images/ui-customization/device-activity-before.png b/docs/guides/images/ui-customization/device-activity-before.png
new file mode 100644
index 000000000000..2f87d87ac467
Binary files /dev/null and b/docs/guides/images/ui-customization/device-activity-before.png differ
diff --git a/docs/guides/images/ui-customization/easy-theme-find-color.png b/docs/guides/images/ui-customization/easy-theme-find-color.png
new file mode 100644
index 000000000000..2fca430aef30
Binary files /dev/null and b/docs/guides/images/ui-customization/easy-theme-find-color.png differ
diff --git a/docs/guides/images/ui-customization/empty-user-federation-page.png b/docs/guides/images/ui-customization/empty-user-federation-page.png
new file mode 100644
index 000000000000..5576a174f900
Binary files /dev/null and b/docs/guides/images/ui-customization/empty-user-federation-page.png differ
diff --git a/docs/guides/images/ui-customization/keycloak_logo.png b/docs/guides/images/ui-customization/keycloak_logo.png
new file mode 100644
index 000000000000..4883f5230235
Binary files /dev/null and b/docs/guides/images/ui-customization/keycloak_logo.png differ
diff --git a/docs/guides/images/ui-customization/login-sunrise.png b/docs/guides/images/ui-customization/login-sunrise.png
new file mode 100644
index 000000000000..6879b1f438f0
Binary files /dev/null and b/docs/guides/images/ui-customization/login-sunrise.png differ
diff --git a/docs/guides/images/ui-customization/myPage.png b/docs/guides/images/ui-customization/myPage.png
new file mode 100644
index 000000000000..040ed44758ce
Binary files /dev/null and b/docs/guides/images/ui-customization/myPage.png differ
diff --git a/docs/guides/images/ui-customization/picture-attribute-general-settings.png b/docs/guides/images/ui-customization/picture-attribute-general-settings.png
new file mode 100644
index 000000000000..5e203aab983e
Binary files /dev/null and b/docs/guides/images/ui-customization/picture-attribute-general-settings.png differ
diff --git a/docs/guides/images/ui-customization/quick-theme-overview.png b/docs/guides/images/ui-customization/quick-theme-overview.png
new file mode 100644
index 000000000000..90e67add7462
Binary files /dev/null and b/docs/guides/images/ui-customization/quick-theme-overview.png differ
diff --git a/docs/guides/images/ui-customization/readonly-user-storage-provider-with-config.png b/docs/guides/images/ui-customization/readonly-user-storage-provider-with-config.png
new file mode 100644
index 000000000000..68e71937da0b
Binary files /dev/null and b/docs/guides/images/ui-customization/readonly-user-storage-provider-with-config.png differ
diff --git a/docs/guides/images/ui-customization/simple-quick-theme-changes.png b/docs/guides/images/ui-customization/simple-quick-theme-changes.png
new file mode 100644
index 000000000000..367df066e0e0
Binary files /dev/null and b/docs/guides/images/ui-customization/simple-quick-theme-changes.png differ
diff --git a/docs/guides/images/ui-customization/storage-provider-created.png b/docs/guides/images/ui-customization/storage-provider-created.png
new file mode 100644
index 000000000000..7e5757ce8cba
Binary files /dev/null and b/docs/guides/images/ui-customization/storage-provider-created.png differ
diff --git a/docs/guides/images/ui-customization/user-federation-page.png b/docs/guides/images/ui-customization/user-federation-page.png
new file mode 100644
index 000000000000..787eb9e08aff
Binary files /dev/null and b/docs/guides/images/ui-customization/user-federation-page.png differ
diff --git a/docs/guides/observability/configuration-metrics.adoc b/docs/guides/observability/configuration-metrics.adoc
index c37dbdd2737e..2699d9acd4eb 100644
--- a/docs/guides/observability/configuration-metrics.adoc
+++ b/docs/guides/observability/configuration-metrics.adoc
@@ -4,8 +4,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Enabling {project_name} Metrics"
-summary="Learn how to enable and expose metrics from the server"
+title="Gaining insights with metrics"
+summary="Collect metrics to gain insights about state and activities of a running instance of {project_name}."
 includedOptions="metrics-enabled http-metrics-* cache-metrics-*">
 
 {project_name} has built in support for metrics. This {section} describes how to enable and configure server metrics.
diff --git a/docs/guides/observability/event-metrics.adoc b/docs/guides/observability/event-metrics.adoc
index f6497a232516..3cd82750a4ea 100644
--- a/docs/guides/observability/event-metrics.adoc
+++ b/docs/guides/observability/event-metrics.adoc
@@ -4,12 +4,10 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Enabling {project_name} Event Metrics"
-summary="Learn how to enable and use {project_name} Event Metrics"
-preview="true"
+title="Monitoring user activities with event metrics"
+summary="Event metrics provide an aggregated view of user activities in a {project_name} instance."
 includedOptions="metrics-enabled event-metrics-user-*">
 
-Event metrics can provide admins an overview of the different activities in a {project_name} instance.
 For now, only metrics for user events are captured.
 For example, you can monitor the number of logins, login failures, or token refreshes performed.
 
@@ -21,11 +19,11 @@ If you have multiple instances running in a cluster, you will need to collect th
 
 == Enable event metrics
 
-To start collecting metrics, enable the feature `user-event-metrics`, enable metrics, and enable the metrics for user events.
+To start collecting event metrics, enable metrics and enable the metrics for user events.
 
 The following shows the required startup parameters:
 
-<@kc.start parameters="--features=user-event-metrics --metrics-enabled=true --event-metrics-user-enabled=true ..."/>
+<@kc.start parameters="--metrics-enabled=true --event-metrics-user-enabled=true ..."/>
 
 By default, there is a separate metric for each realm.
 To break down the metric by client and identity provider, you can add those metrics dimension using the configuration option `event-metrics-user-tags`.
diff --git a/docs/guides/observability/exemplars.adoc b/docs/guides/observability/exemplars.adoc
new file mode 100644
index 000000000000..6e700988e0c4
--- /dev/null
+++ b/docs/guides/observability/exemplars.adoc
@@ -0,0 +1,101 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Analyzing outliers and errors with exemplars"
+summary="Use exemplars to connect a metric to a recorded trace to analyze the root cause of errors or latencies.">
+
+Metrics are aggregations over several events, and show you if your system is operating within defined bounds.
+They are great to monitor error rates or tail latencies and to set up alerting or drive performance optimizations.
+Still, the aggregation makes it difficult to find root causes for latencies or errors reported in metrics.
+
+Root causes for errors and latencies can be found by enabling tracing.
+To connect a metric to a recorded trace, there is the concept of https://grafana.com/docs/grafana/latest/fundamentals/exemplars/[exemplars].
+
+Once exemplars are set up, {project_name} reports metrics with their last recorded trace as an exemplar.
+A dashboard tool like Grafana can link the exemplar from a metrics dashboard to a trace view.
+
+Metrics that support exemplars are:
+
+* `http_server_requests_seconds_count` (including histograms) +
+See the {section} <@links.observability id="metrics-for-troubleshooting-http"/> for details on this metric.
+
+* `keycloak_credentials_password_hashing_validations_total` +
+See the {section} <@links.observability id="metrics-for-troubleshooting-keycloak"/>  for details on this metric.
+
+* `keycloak_user_events_total` +
+See the {section} <@links.observability id="metrics-for-troubleshooting-keycloak"/>  for details on this metric.
+
+See below for a screenshot of a heatmap visualization for latencies that is showing an exemplar when hovering over one of the pink indicators.
+
+.Heatmap diagram with exemplar
+image::observability/exemplar.png[]
+
+== Setting up exemplars
+
+To benefit from exemplars, perform the following steps:
+
+. Enable metrics for {project_name} as described in {section} <@links.observability id="configuration-metrics" />.
+
+. Enable tracing for {project_name} as described in {section} <@links.observability id="tracing" />.
+
+. Enable exemplar storage in your monitoring system.
++
+For Prometheus, this is a https://prometheus.io/docs/prometheus/latest/feature_flags/#exemplars-storage[preview feature that you need to enable].
+
+. Scrape the metrics using the `OpenMetricsText1.0.0` protocol, which is not enabled by default in Prometheus.
++
+If you are using `PodMonitors` or similar in a Kubernetes environment, this can be achieved by adding it to the spec of the custom resource:
++
+[source]
+----
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  ...
+spec:
+  scrapeProtocols:
+    - OpenMetricsText1.0.0
+----
+
+. Configure your metrics datasource where to link to for traces.
++
+When using Grafana and Prometheus, this would be setting up a `exemplarTraceIdDestinations` for the Prometheus datasource, which then points to your tracing datasource that is provided by tools like Jaeger or Tempo.
+
+. Enable exemplars in your dashboards.
++
+Enable the *Exemplars* toggle in each query on each dashboard where you want to show exemplars.
+When set up correctly, you will notice little dots or stars in your dashboards that you can click on to view the traces.
+
+[NOTE]
+====
+* If you do not specify the scrape protocol, Prometheus will by default not send it in the content negotiation, and Keycloak will then fall back to the PrometheusText protocol which will not contain the exemplars.
+* If you enabled tracing and metrics, but the request sampling did not record a trace, the exposed metric will not contain any exemplars.
+* If you access the metrics endpoint with your browser, the content negotiation will lead to the format PrometheusText being returned, and you will not see any exemplars.
+====
+
+== Verifying that exemplars work as expected
+
+Perform the following steps to verify that {project_name} is set up correctly for exemplars:
+
+. Follow the instructions to set up metrics and tracing for {project_name}.
+. For test purposes, record all traces by setting the tracing ration to `1.0`.
+See <@links.observability id="tracing" anchor="sampling" /> for recommended sampling settings in production systems.
+. Log in to the Keycloak instance to create some traces.
+. Scrape the metrics with a command similar to the following and search for those metrics that have an exemplar set:
++
+[source]
+----
+$ curl -s http://localhost:9000/metrics \
+-H 'Accept: application/openmetrics-text; version=1.0.0; charset=utf-8' \
+| grep "#.*trace_id"
+----
++
+This should result in an output similar to the following. Note the additional `#` after which the span and trace IDs are added:
++
+[source]
+----
+http_server_requests_seconds_count {...} ... # {span_id="...",trace_id="..."} ...
+----
+
+</@tmpl.guide>
diff --git a/docs/guides/observability/grafana-dashboards.adoc b/docs/guides/observability/grafana-dashboards.adoc
new file mode 100644
index 000000000000..dc7de8e812f6
--- /dev/null
+++ b/docs/guides/observability/grafana-dashboards.adoc
@@ -0,0 +1,102 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Visualizing activities in dashboards"
+summary="Install the {project_name} Grafana dashboards to visualize the metrics that capture the status and activities of your deployment.">
+
+{project_name} provides metrics to observe what is happening inside the deployment.
+To understand how metrics evolve over time, it is helpful to collect and visualize them in graphs.
+
+This guide provides instructions on how to visualize collected {project_name} metrics in a running Grafana instance.
+
+== Prerequisites
+
+* {project_name} metrics are enabled. Follow <@links.observability id="configuration-metrics"/> {section} for more details.
+* Grafana instance is running and {project_name} metrics are collected into a Prometheus instance.
+* For the HTTP request latency heatmaps to work, enable histograms for HTTP metrics by setting `http-metrics-histograms-enabled` to `true`.
+
+== {project_name} Grafana dashboards
+
+Grafana dashboards are distributed in the form of a JSON file that is imported into a Grafana instance.
+JSON definitions of {project_name} Grafana dashboards are available in the https://github.com/keycloak/keycloak-grafana-dashboard[keycloak/keycloak-grafana-dashboard GitHub repository].
+
+Follow these steps to download JSON file definitions.
+
+. Identify the branch from `keycloak-grafana-dashboards` to use from the following table.
++
+
+|===
+|{project_name} version |`keycloak-grafana-dashboards` branch
+
+|>= 26.1
+|`main`
+|===
+
+. Clone the GitHub repository
++
+----
+git clone -b BRANCH_FROM_STEP_1 https://github.com/keycloak/keycloak-grafana-dashboard.git
+----
+. The dashboards are available in the directory `keycloak-grafana-dashboard/dashboards`.
+
+The following sections describe the purpose of each dashboard.
+
+=== {project_name} troubleshooting dashboard
+
+This dashboard is available in the JSON file: `keycloak-troubleshooting-dashboard.json`.
+
+On the top of the dashboard, graphs display the service level indicators as defined in <@links.observability id="keycloak-service-level-indicators"/>.
+This dashboard can be also used while troubleshooting a {project_name} deployment following the <@links.observability id="metrics-for-troubleshooting"/> {section}, for example, when SLI graphs do not show expected results.
+
+.Troubleshooting dashboard
+image::observability/keycloak-troubleshooting-grafana-dashboard.png[Troubleshooting dashboard]
+
+=== Keycloak capacity planning dashboard
+
+This dashboard is available in the JSON file: `keycloak-capacity-planning-dashboard.json`.
+
+This dashboard shows metrics that are important when estimating the load handled by a {project_name} deployment.
+For example, it shows the number of password validations or login flows performed by {project_name}.
+For more detail on these metrics, see the {section} <@links.observability id="metrics-for-troubleshooting-keycloak"/>.
+
+NOTE:  {project_name} event metrics must be enabled for this dashboard to work correctly.  To enable them, see the {section} <@links.observability id="event-metrics"/>.
+
+.Capacity planning dashboard
+image::observability/keycloak-capacity-planning-dashboard.png[Capacity planning dashboard]
+
+== Import a dashboard
+
+. Open the dashboard page from the left Grafana menu.
+. Click *New* and *Import*.
+. Click *Upload dashboard JSON file* and select the JSON file of the dashboard you want to import.
+. Pick your Prometheus datasource.
+. Click *Import*.
+
+== Export a dashboard
+
+Exporting a dashboard to JSON format may be useful. For example, you may want to suggest a change in our dashboard repository.
+
+++++
+<div class="grafana-share-icon">
+<style>
+.grafana-share-icon img {
+    margin-top: 0;
+    margin-bottom: 0;
+}
+</style>
+++++
+. Open a dashboard you would like to export.
+. Click *share* (image:observability/grafana-share-icon.svg[Grafana share icon]) in the top left corner next to the dashboard name.
+. Click the *Export* tab.
+. Enable *Export for sharing externally*.
+. Click either *Save to file* or *View JSON* and *Copy to Clipboard* according to where you want to store the resulting JSON.
+++++
+</div>
+++++
+
+== Further reading
+
+Continue reading on how to connect traces to dashboard in the <@links.observability id="exemplars" /> {section}.
+
+</@tmpl.guide>
diff --git a/docs/guides/observability/health.adoc b/docs/guides/observability/health.adoc
index b53b5436ce0a..87dbeb4e6c81 100644
--- a/docs/guides/observability/health.adoc
+++ b/docs/guides/observability/health.adoc
@@ -4,8 +4,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Enabling {project_name} Health checks"
-summary="Learn how to enable and use {project_name} health checks"
+title="Tracking instance status with health checks"
+summary="Check if an instance has finished its start up and is ready to serve requests by calling its health REST endpoints."
 includedOptions="health-enabled">
 
 {project_name} has built in support for health checks. This {section} describes how to enable and use the {project_name} health checks.
diff --git a/docs/guides/observability/keycloak-service-level-indicators.adoc b/docs/guides/observability/keycloak-service-level-indicators.adoc
index 82331bdf61eb..732a593c8849 100644
--- a/docs/guides/observability/keycloak-service-level-indicators.adoc
+++ b/docs/guides/observability/keycloak-service-level-indicators.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} service level indicators (SLIs)"
-summary="Learn about the Service Level Indicators to monitor your {project_name} deployment's performance"
+title="Monitoring performance with Service Level Indicators"
+summary="Track performance and reliability as perceived by users with Service Level Indicators (SLIs) and Service Level Objectives (SLOs)."
 >
 
 Service Level Indicators (SLIs) and Service Level Objectives (SLOs) are essential components in monitoring and maintaining the performance and reliability of {project_name} in production environments.
@@ -58,12 +58,12 @@ At the same time, if you enter a Service Level Agreement (SLA) with stakeholders
 
 | Latency
 | Response time for authentication related HTTP requests as measured by the server
-| 95% of all authentication related requests should be faster than 250 ms within a 5-minute-range.
+| 95% of all authentication related requests should be faster than 250 ms within 30 days.
 | {project_name} server-side metrics to track latency for specific endpoints along with Response Time Distribution using `http_server_requests_seconds_bucket` and `http_server_requests_seconds_count`.
 
 | Errors
 | Failed authentication requests due to server problems as measured by the server
-| The rate of errors due to server problems for authentication requests should be less than 0.1% within a 5-minute-range.
+| The rate of errors due to server problems for authentication requests should be less than 0.1% within 30 days.
 | Identify server side error by filtering the metric `http_server_requests_seconds_count` on the tag `outcome` for value `SERVER_ERROR`.
 
 |===
@@ -103,7 +103,7 @@ NOTE: In Grafana you can replace value `30d:15s` with `$__range:$__interval` to
 
 === Latency of authentication requests
 
-This Prometheus query calculates the percentage of authentication requests that completed within 0.25 seconds relative to all authentication requests for specific {project_name} endpoints, targeting a particular namespace and pod, over the past 5 minutes.
+This Prometheus query calculates the percentage of authentication requests that completed within 0.25 seconds relative to all authentication requests for specific {project_name} endpoints, targeting a particular namespace and pod, over the past 30 days.
 
 This example requires the {project_name} configuration `http-metrics-slos` to contain value `250` indicating that buckets for requests faster and slower than 250 ms should be recorded.
 Setting `http-metrics-histograms-enabled` to `true` would capture additional buckets which can help with performance troubleshooting.
@@ -116,7 +116,7 @@ sum(
       le="0.25", # <2>
       container="keycloak", # <3>
       namespace="$namespace"}
-    [5m] # <4>
+    [30d] # <4>
   )
 ) without (le,uri,status,outcome,method,pod,instance) # <5>
 /
@@ -126,7 +126,7 @@ sum(
       uri=~"/realms/{realm}/protocol/{protocol}.*|/realms/{realm}/login-actions.*", # <1>
       container="keycloak",
       namespace="$namespace"}
-    [5m] # <3>
+    [30d] # <3>
   )
 ) without (le,uri,status,outcome,method,pod,instance) # <5>
 ----
@@ -136,13 +136,13 @@ sum(
 <4> Time range as specified by the SLO
 <5> Ignore as many labels necessary to create a single sum
 
-NOTE: In Grafana you can replace value `5m` with `$__range` to compute latency SLI in the time range selected for the dashboard.
+NOTE: In Grafana, you can replace value `30d` with `$__range` to compute latency SLI in the time range selected for the dashboard.
 
 === Errors for authentication requests
 
 This Prometheus query calculates the percentage of authentication requests
 that returned a server side error for all authentication requests,
-targeting a particular namespace, over the past 5 minutes.
+targeting a particular namespace, over the past 30 days.
 
 [source,plaintext]
 ----
@@ -153,7 +153,7 @@ sum(
       outcome="SERVER_ERROR", # <2>
       container="keycloak", # <3>
       namespace="$namespace"}
-    [5m] # <4>
+    [30d] # <4>
   )
 ) without (le,uri,status,outcome,method,pod,instance) # <5>
 /
@@ -163,7 +163,7 @@ sum(
       uri=~"/realms/{realm}/protocol/{protocol}.*|/realms/{realm}/login-actions.*", # <1>
       container="keycloak", # <3>
       namespace="$namespace"}
-    [5m] # <4>
+    [30d] # <4>
   )
 ) without (le,uri,status,outcome,method,pod,instance) # <5>
 ----
@@ -173,6 +173,8 @@ sum(
 <4> Time range as specified by the SLO
 <5> Ignore as many labels necessary to create a single sum
 
+NOTE: In Grafana, you can replace value `30d` with `$__range` to compute errors SLI in the time range selected for the dashboard.
+
 == Further Reading
 
 * https://sre.google/sre-book/service-level-objectives/[Google SRE Book on Service Level Objectives]
diff --git a/docs/guides/observability/metrics-for-troubleshooting-clustering-and-network.adoc b/docs/guides/observability/metrics-for-troubleshooting-clustering-and-network.adoc
index 516d005c3cfe..9398ed0c1897 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-clustering-and-network.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-clustering-and-network.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Clustering and network metrics"
-summary="Learn about metrics monitoring communication between {project_name} nodes"
+title="Clustering metrics"
+summary="Use metrics to monitor communication between {project_name} nodes."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-database.adoc b/docs/guides/observability/metrics-for-troubleshooting-database.adoc
index 265a6222dfc4..aad89c176c1f 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-database.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-database.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} Database Metrics"
-summary="Learn about metrics describing {project_name}'s connection to the database"
+title="Database Metrics"
+summary="Use metrics to describe {project_name}'s connection to the database."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-embedded-caches-multi-site.adoc b/docs/guides/observability/metrics-for-troubleshooting-embedded-caches-multi-site.adoc
index fb2ea08be148..b10077f86154 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-embedded-caches-multi-site.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-embedded-caches-multi-site.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Embedded Infinispan metrics for multiple sites deployments"
-summary="Learn about metrics monitoring caching health"
+title="Embedded Infinispan metrics for multi-site deployments"
+summary="Use metrics to monitor caching health."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-embedded-caches.adoc b/docs/guides/observability/metrics-for-troubleshooting-embedded-caches.adoc
index 2f7beba67f61..36824a098bd3 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-embedded-caches.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-embedded-caches.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Embedded Infinispan metrics for single site deployments"
-summary="Learn about metrics monitoring caching health and cluster replication"
+summary="Use metrics to monitor caching health and cluster replication."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-external-infinispan-multi-site.adoc b/docs/guides/observability/metrics-for-troubleshooting-external-infinispan-multi-site.adoc
index 36d1e22260a4..236ca0b59255 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-external-infinispan-multi-site.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-external-infinispan-multi-site.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="External {jdgserver_name} metrics"
-summary="Learn about metrics monitoring external {jdgserver_name} performance"
+summary="Use metrics to monitor external {jdgserver_name} performance."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-http.adoc b/docs/guides/observability/metrics-for-troubleshooting-http.adoc
index a858f531c134..7725ac5652c4 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-http.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-http.adoc
@@ -2,9 +2,10 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} HTTP metrics"
-summary="Learn about metrics for monitoring the {project_name} HTTP requests processing"
+title="HTTP metrics"
+summary="Use metrics to monitor the {project_name} HTTP requests processing."
 tileVisible="false"
+includedOptions="http-metrics-histograms-enabled http-metrics-slos"
 >
 
 <#include "partials/prerequisites-metrics-troubleshooting.adoc" />
@@ -37,6 +38,8 @@ m| http_server_requests_seconds_sum
 | The total duration for all the requests processed.
 |===
 
+You can enable histograms for this metric by setting `http-metrics-histograms-enabled` to `true`, and add additional buckets for service level objectives using the option `http-metrics-slos`.
+
 include::partials/histogram_note_http.adoc[]
 
 === Active requests
diff --git a/docs/guides/observability/metrics-for-troubleshooting-jvm.adoc b/docs/guides/observability/metrics-for-troubleshooting-jvm.adoc
index 17081022ee6e..a2d23d12fef9 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-jvm.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-jvm.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} JVM metrics"
-summary="Learn about key JVM metrics for observing performance of {project_name}"
+title="JVM metrics"
+summary="Use JVM metrics to observe performance of {project_name}."
 tileVisible="false"
 >
 
diff --git a/docs/guides/observability/metrics-for-troubleshooting-keycloak.adoc b/docs/guides/observability/metrics-for-troubleshooting-keycloak.adoc
index f34439960d2f..2fd4b7416af3 100644
--- a/docs/guides/observability/metrics-for-troubleshooting-keycloak.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting-keycloak.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} self-provided metrics"
-summary="Learn about key metrics that {project_name} provides"
+title="Self-provided metrics"
+summary="Learn about the key metrics that {project_name} provides."
 tileVisible="false"
 >
 
@@ -73,7 +73,7 @@ Possible values:
 --
 ====
 
-To configure what tags are available provide a comma-separated list of tag names to the following option `spi-credential-keycloak-password-validations-counter-tags`.
+To configure what tags are available provide a comma-separated list of tag names to the following option `spi-credential--keycloak-password--validations-counter-tags`.
 By default, all tags are enabled.
 
 The snippet below is an example of a response provided by the metric endpoint:
diff --git a/docs/guides/observability/metrics-for-troubleshooting.adoc b/docs/guides/observability/metrics-for-troubleshooting.adoc
index baa8ea0c496e..571627f2f57b 100644
--- a/docs/guides/observability/metrics-for-troubleshooting.adoc
+++ b/docs/guides/observability/metrics-for-troubleshooting.adoc
@@ -2,8 +2,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Metrics for troubleshooting {project_name} deployment"
-summary="Learn about metrics that can indicate where the issue is, for example, when service level objective is not met"
+title="Troubleshooting using metrics"
+summary="Use metrics for troubleshooting errors and performance issues."
 >
 
 For a running {project_name} deployment it is important to understand how the system performs and whether it meets your service level objectives (SLOs).
@@ -39,6 +39,11 @@ Troubleshooting the database itself is out of scope.
 You should always confirm the configuration change by conducting a performance test comparing the metrics in question for the old and the new configuration.
 ====
 
+[NOTE]
+====
+Grafana dashboards for the metrics below can be found in <@links.observability id="grafana-dashboards"/> {section}.
+====
+
 == List of {project_name} key metrics
 
 * <@links.observability id="metrics-for-troubleshooting-keycloak"/>
diff --git a/docs/guides/observability/partials/jgrp_metrics.adoc b/docs/guides/observability/partials/jgrp_metrics.adoc
index 8265b33e8be9..e6a8ed69d273 100644
--- a/docs/guides/observability/partials/jgrp_metrics.adoc
+++ b/docs/guides/observability/partials/jgrp_metrics.adoc
@@ -68,7 +68,7 @@ m| vendor_jgroups_tcp_get_num_bytes_sent
 m| TCP
 .3+| The total number of bytes sent by a node.
 
-m| vendor_jgroups_tunnel_get_num_bytes_sent
+m| vendor_jgroups_udp_get_num_bytes_sent
 m| UDP
 
 m| vendor_jgroups_tunnel_get_num_bytes_sent
diff --git a/docs/guides/observability/pinned-guides b/docs/guides/observability/pinned-guides
index d7b1e17822ee..ad86dfbc9916 100644
--- a/docs/guides/observability/pinned-guides
+++ b/docs/guides/observability/pinned-guides
@@ -3,4 +3,14 @@ configuration-metrics
 event-metrics
 keycloak-service-level-indicators
 metrics-for-troubleshooting
+metrics-for-troubleshooting-keycloak
+metrics-for-troubleshooting-jvm
+metrics-for-troubleshooting-database
+metrics-for-troubleshooting-http
+metrics-for-troubleshooting-clustering-and-network
+metrics-for-troubleshooting-embedded-caches
+metrics-for-troubleshooting-embedded-caches-multi-site
+metrics-for-troubleshooting-external-infinispan-multi-site
 tracing
+grafana-dashboards
+exemplars
diff --git a/docs/guides/observability/tracing.adoc b/docs/guides/observability/tracing.adoc
index ba9817ad5556..bf2dba3706d0 100644
--- a/docs/guides/observability/tracing.adoc
+++ b/docs/guides/observability/tracing.adoc
@@ -4,14 +4,14 @@
 <#import "/templates/links.adoc" as links>
 <#import "/templates/profile.adoc" as profile>
 
-<@tmpl.guide title="Enabling Tracing"
-summary="Learn how to enable distributed tracing in {project_name}"
+<@tmpl.guide title="Root cause analysis with tracing"
+summary="Record information during the request lifecycle with OpenTelementry tracing to identify root cases for latencies and errors in {project_name} and connected systems."
 includedOptions="tracing-* log-*-include-trace">
 
 This {section} explains how you can enable and configure distributed tracing in {project_name} by utilizing https://opentelemetry.io/[OpenTelemetry] (OTel).
 Tracing allows for detailed monitoring of each request's lifecycle, which helps quickly identify and diagnose issues, leading to more efficient debugging and maintenance.
 
-It also provides valuable insights into performance bottlenecks and can help optimize the system's overall efficiency.
+It provides valuable insights into performance bottlenecks and can help optimize the system's overall efficiency and across system boundaries.
 {project_name} uses a supported https://quarkus.io/guides/opentelemetry-tracing[Quarkus OTel extension] that provides smooth integration and exposure of application traces.
 
 == Enable tracing
@@ -122,9 +122,10 @@ For instance, to disable trace info in the `console` log, you can turn it off as
 
 NOTE: When you explicitly override the log format for the particular log handlers, the `*-include-trace` options do not have any effect, and no tracing is included.
 
+[[sampling]]
 == Sampling
 
-Sampler decides whether a trace should be discarded or forwarded, effectively reducing overhead by limiting the number of collected traces sent to the collector.
+The sampler decides whether a trace should be discarded or forwarded, effectively reducing overhead by limiting the number of collected traces sent to the collector.
 It helps manage resource consumption, which leads to avoiding the huge storage costs of tracing every single request and potential performance penalty.
 
 WARNING: For a production-ready environment, sampling should be properly set to minimize infrastructure costs.
@@ -140,11 +141,13 @@ The default sampler for {project_name} is `traceidratio`, which controls the rat
 
 ==== Trace ratio
 The default trace ratio is `1.0`, which means all traces are sampled - sent to the collector.
-The ratio is a floating number in the range `(0,1]`.
+The ratio is a floating number in the range `[0,1]`.
 For instance, when the ratio is `0.1`, only 10% of the traces are sampled.
 
 WARNING: For a production-ready environment, the trace ratio should be a smaller number to prevent the massive cost of trace store infrastructure and avoid performance overhead.
 
+TIP: The ratio can be set to `0.0` to disable sampling entirely _at runtime_.
+
 ==== Rationale
 
 The sampler makes its own sampling decisions based on the current ratio of sampled spans, regardless of the decision made on the parent span,
@@ -176,6 +179,6 @@ You can filter out the required traces in your tracing backend based on their ta
 
 {project_name} Operator automatically sets the `KC_TRACING_SERVICE_NAME` and `KC_TRACING_RESOURCE_ATTRIBUTES` environment variables for each {project_name} container included in pods it manages.
 
-NOTE: The `KC_TRACING_RESOURCE_ATTRIBUTES` variable always contains (if not overridden) the `k8s.namespace.name` attribute representing current namespace.
+NOTE: The `KC_TRACING_RESOURCE_ATTRIBUTES` variable always contains (if not overridden) the `k8s.namespace.name` attribute representing the current namespace.
 
 </@tmpl.guide>
diff --git a/docs/guides/operator/advanced-configuration.adoc b/docs/guides/operator/advanced-configuration.adoc
index a34dbc64ad6d..7c94cc3a36d8 100644
--- a/docs/guides/operator/advanced-configuration.adoc
+++ b/docs/guides/operator/advanced-configuration.adoc
@@ -6,7 +6,7 @@
 
 <@tmpl.guide
 title="Advanced configuration"
-summary="How to tune advanced aspects of the Keycloak CR">
+summary="Tune advanced aspects of the Keycloak CR.">
 
 == Advanced configuration
 This {section} describes how to use Custom Resources (CRs) for advanced configuration of your {project_name} deployment.
@@ -91,11 +91,11 @@ metadata:
 spec:
   ...
   additionalOptions:
-    - name: spi-connections-http-client-default-connection-pool-size
+    - name: spi-connections-http-client--default--connection-pool-size
       secret: # Secret reference
         name: http-client-secret # name of the Secret
         key: poolSize # name of the Key in the Secret
-    - name: spi-email-template-mycustomprovider-enabled
+    - name: spi-email-template--mycustomprovider--enabled
       value: true # plain text value
 ----
 NOTE:  The name format of options defined in this way is identical to the key format of options specified in the configuration file.
@@ -149,6 +149,28 @@ spec:
               secretName: keycloak-additional-secret
 ----
 
+===== Probe Configuration
+
+The Keycloak CR exposes options to set periodSeconds and failureThreshold on each of the three probes (readiness, liveness and startup)
+
+[source,yaml]
+----
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: example-kc
+spec:
+  readinessProbe:
+    periodSeconds: 20
+    failureThreshold: 5
+  livenessProbe:
+    periodSeconds: 20
+    failureThreshold: 5
+  startupProbe:
+    periodSeconds: 20
+    failureThreshold: 5
+----
+
 === Disabling required options
 
 {project_name} and the {project_name} Operator provide the best production-ready experience with security in mind.
@@ -312,9 +334,9 @@ This includes `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` and the `/v
 
 === Admin Bootstrapping
 
-When you create a new instance the Keycloak CR spec.bootstrapAdmin stanza may be used to configure the bootstrap user and/or service account. If you do not specify anything for the spec.bootstrapAdmin, the operator will create a Secret named "metadata.name"-initial-admin with a username temp-admin and a generated password. If you specify a Secret name for bootstrap admin user, then the Secret will need to contain `username` and `password` key value pairs. If you specify a Secret name for bootstrap admin service account, then the Secret will need to contain `client-id` and `client-secret` key value pairs.
+When you create a new instance the Keycloak CR spec.bootstrapAdmin stanza may be used to configure the bootstrap user and/or service account. If you do not specify anything for the spec.bootstrapAdmin, the operator will create a Secret named "metadata.name"-initial-admin with a username temp-admin and a generated password. If you specify a Secret name for the bootstrap admin user, then the Secret will need to contain `username` and `password` key value pairs. If you specify a Secret name for bootstrap admin service account, then the Secret will need to contain `client-id` and `client-secret` key value pairs.
 
-If a master realm has already been created for you cluster, then the spec.boostrapAdmin is effectively ignored. If you need to create a recovery admin account, then you'll need to run the CLI command against a Pod directly.
+If a master realm has already been created for your cluster, then the spec.boostrapAdmin is effectively ignored. If you need to create a recovery admin account, then you'll need to run the CLI command against a Pod directly.
 
 For more information on how to bootstrap a temporary admin user or service account and recover lost admin access, refer to the <@links.server id="bootstrap-admin-recovery"/> guide.
 
@@ -349,14 +371,15 @@ NOTE: The `tracing-jdbc-enabled` is not promoted as a first-class citizen as it
 
 For more details about tracing, see <@links.observability id="tracing" />.
 
-=== Network Policies (Preview)
+=== Network Policies
 
 NetworkPolicies allow you to specify rules for traffic flow within your cluster, and also between Pods and the outside world.
-Your cluster must use a network plugin that supports NetworkPolicy enforcement.
+Your cluster must use a network plugin that supports NetworkPolicy enforcement to restrict the network traffic.
 
-The operator can automatically create a NetworkPolicy to deny access to the clustering port of your {project_name} Pods.
+The operator automatically creates a NetworkPolicy to deny access to the clustering port of your {project_name} Pods.
 The HTTP(S) endpoint is open to traffic from any namespace and the outside world.
-To enable the NetworkPolicy, set `spec.networkPolicy.enabled` in your Keycloak CR, as shown in the example below.
+
+To disable the NetworkPolicy, set `spec.networkPolicy.enabled` in your Keycloak CR, as shown in the example below.
 
 .Keycloak CR with Network Policies enabled
 [source,yaml]
@@ -367,12 +390,12 @@ metadata:
   name: example-kc
 spec:
   networkPolicy:
-    enabled: true
+    enabled: false
 ----
 
-The above example allows traffic from all sources.
+By default, traffic to the HTTP endpoints and the management endpoint is allowed from all sources.
 The Keycloak CR can be extended to include a list of rules for each of the endpoints exposed by {project_name}.
-These rules specify from where (the source) the traffic is allowed and it's possible to communicate with the {project_name} Pods.
+These rules specify from where (the source) the traffic is allowed, and it is possible to communicate with the {project_name} Pods.
 
 .Extended Network Policy configuration
 [source,yaml]
@@ -404,8 +427,8 @@ For a concrete example, let's imagine we have a {project_name} deployment runnin
 Users have to access {project_name} to login, so {project_name} must be accessible from the Internet.
 
 To make this example more interesting, let's assume the {project_name} is monitored too.
-The monitoring is enabled as described in the OpenShift documentation page:
-https://docs.openshift.com/container-platform/4.12/observability/monitoring/enabling-monitoring-for-user-defined-projects.html[enabling Monitoring for user defined projects].
+The monitoring is enabled as described in this OpenShift documentation page:
+https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/monitoring/configuring-user-workload-monitoring#enabling-monitoring-for-user-defined-projects_preparing-to-configure-the-monitoring-stack-uwm[enabling Monitoring for user defined projects].
 
 Based on those requirements, the Keycloak CR would be like this (most parts are omitted, like DB connection and security):
 
@@ -439,4 +462,25 @@ They need to access {project_name} to scrape the available metrics.
 
 Check the https://kubernetes.io/docs/concepts/services-networking/network-policies/[Kubernetes Network Policies documentation] for more information about NetworkPolicies.
 
+=== Parameterizing service labels and annotations
+
+If you need to set custom labels or annotations to keycloak service you can do that through `spec.http.labels` and `spec.http.annotations`
+
+.Custom service labels and annotations
+[source,yaml]
+----
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: example-kc
+spec:
+  http:
+    labels:
+      label1: label-value1
+      label2: label-value2
+    annotations:
+      annotation1: annotation-value1
+      annotation2: annotation-value2
+----
+
 </@tmpl.guide>
diff --git a/docs/guides/operator/basic-deployment.adoc b/docs/guides/operator/basic-deployment.adoc
index e70505da0aa8..9f4802f7c701 100644
--- a/docs/guides/operator/basic-deployment.adoc
+++ b/docs/guides/operator/basic-deployment.adoc
@@ -6,8 +6,7 @@
 
 <@tmpl.guide
 title="Basic {project_name} deployment"
-priority=20
-summary="How to install {project_name} using the Operator">
+summary="Install {project_name} using the Operator.">
 
 == Performing a basic {project_name} deployment
 This {section} describes how to perform a basic {project_name} Deployment on
@@ -100,9 +99,9 @@ When running on OpenShift, with ingress enabled, and with the spec.ingress.class
 The operator will assign a default hostname to the stored version of the CR similar to what would be created by an OpenShift Route without an explicit host - that is ingress-namespace.appsDomain
 If the appsDomain changes, or should you need a different hostname for any reason, then update the Keycloak CR.
 
-NOTE: If you set the `hostname-admin`, or the deprecated `hostname-admin-url`, even if you enable ingress, no ingress will be created specifically for admin access. 
-Admin access via a separate hostname is generally expected to have access restrictions, which are not currently expressible via the Keycloak CR. 
-Also the default ingress does not prevent accessing admin endpoints, so you may not want to enable ingress handling via the Keycloak CR at all when you have a separate hostname for admin endpoints.       
+NOTE: If you set the `hostname-admin`, or the deprecated `hostname-admin-url`, even if you enable ingress, no ingress will be created specifically for admin access.
+Admin access via a separate hostname is generally expected to have access restrictions, which are not currently expressible via the Keycloak CR.
+Also the default ingress does not prevent accessing admin endpoints, so you may not want to enable ingress handling via the Keycloak CR at all when you have a separate hostname for admin endpoints.
 
 ==== TLS Certificate and key
 
@@ -193,7 +192,9 @@ CONDITION: RollingUpdate
 
 === Accessing the {project_name} deployment
 
-The {project_name} deployment is exposed through a basic Ingress and is accessible through the provided hostname.  On installations with multiple default IngressClass instances
+The {project_name} deployment can be exposed through a basic Ingress accessible through the provided hostname.
+
+On installations with multiple default IngressClass instances
 or when running on OpenShift 4.12+ you should provide an ingressClassName by setting `ingress` spec with `className` property to the desired class name:
 
 Edit YAML file `example-kc.yaml`:
@@ -232,7 +233,12 @@ Apply the changes:
 ----
 kubectl apply -f example-kc.yaml
 ----
-You can provide an alternative ingress resource pointing to the service `<keycloak-cr-name>-service`.
+You can then provide an alternative ingress resource pointing to the service `<keycloak-cr-name>-service`. For example, on OpenShift you are not allowed to use wildcard certificates on passthrough Routes with HTTP/2 enabled. A Keycloak CR on OpenShift with TLS enabled using a wildcard certificate with the default IngressClass creates such a Route. In this case, you must disable the built-in ingress with `.spec.ingress.enabled: false`. Access may then be provided by creating a reencrypt Route instead:
+
+[source,yaml]
+----
+$ oc create route reencrypt --service=<keycloak-cr-name>-service --cert=<configured-certificate> --key=<certificate-key> --dest-ca-cert=<ca-certificate> --ca-cert=<ca-certificate> --hostname=<hostname>
+----
 
 For debugging and development purposes, consider directly connecting to the {project_name} service using a port forward. For example, enter this command:
 
@@ -290,4 +296,15 @@ kubectl get secret example-kc-initial-admin -o jsonpath='{.data.password}' | bas
 
 You can use those credentials to access the Admin Console or the Admin REST API.
 
+=== Security Considerations
+
+[WARNING]
+====
+Anyone with the ability to create or edit a Keycloak CR should be a namespace level admin.  
+====
+
+Setting the  Keycloak CR image requires a high degree of trust as whatever image is running will have access to any Secrets used for environement variables.
+
+Similarly the unsupported podTemplate gives the ability to deploy alternative workloads which may be granted the same permissions as the operator itself - which includes the ability to access Secrets in the namespace.
+
 </@tmpl.guide>
diff --git a/docs/guides/operator/customizing-keycloak.adoc b/docs/guides/operator/customizing-keycloak.adoc
index 571af2dae212..968299a54e08 100644
--- a/docs/guides/operator/customizing-keycloak.adoc
+++ b/docs/guides/operator/customizing-keycloak.adoc
@@ -5,7 +5,7 @@
 
 <@tmpl.guide
 title="Using custom {project_name} images"
-summary="How to customize and optimize the {project_name} Container">
+summary="Customize and optimize the {project_name} container.">
 
 == {project_name} custom image with the Operator
 
@@ -22,7 +22,7 @@ To avoid this delay, you can provide a custom image with the augmentation built-
 
 With a custom image, you can also specify the Keycloak _build-time_ configurations and extensions during the build of the container.
 
-WARNING: When using optimized custom image, `health-enabled` and `metrics-enabled` options need to be explicitly set in the Containerfile.
+WARNING: When using the optimized custom image, `health-enabled` and `metrics-enabled` options need to be explicitly set in the Containerfile.
 
 For instructions on how to build such an image, see <@links.server id="containers"/>.
 
@@ -52,7 +52,7 @@ Use the Keycloak CR for any configuration that requires Operator awareness, name
 
 === Non-optimized custom image
 
-While it is considered a best practice use a pre-augmented image, if you want to use a non-optimized custom image or build time properties with an augmented image that is still possible. You just need set the `startOptimized` field to `false` as shown in this example:
+While it is considered a best practice to use a pre-augmented image, if you want to use a non-optimized custom image or build time properties with an augmented image that is still possible. You just need set the `startOptimized` field to `false` as shown in this example:
 
 [source,yaml]
 ----
diff --git a/docs/guides/operator/installation.adoc b/docs/guides/operator/installation.adoc
index 38671af6920f..578073824deb 100644
--- a/docs/guides/operator/installation.adoc
+++ b/docs/guides/operator/installation.adoc
@@ -6,8 +6,7 @@
 
 <@tmpl.guide
 title="{project_name} Operator Installation"
-priority=10
-summary="How to install the {project_name} Operator on Kubernetes and OpenShift">
+summary="Install the {project_name} Operator on Kubernetes and OpenShift.">
 
 == Installing the {project_name} Operator
 This {section} describes how to install the {project_name} Operator in a Kubernetes or OpenShift cluster.
@@ -44,6 +43,58 @@ image::configure-operator.png["Configure {project_name} Operator"]
 
 You may select to either have the Operator watch the namespace where it is installed, or to watch a single namespace of your choosing.
 
+==== Configuring Manual Approval for OLM Upgrades
+
+[WARNING]
+====
+*Important: Automatic OLM Upgrades*
+
+By default, OLM automatically updates the {project_name} Operator when a new version is released. This can cause several significant issues:
+
+* When using the default {project_name} image, the Operator uses a matching image of the corresponding {project_name} version, resulting in *unintended {project_name} upgrades* when the Operator is upgraded
+* *Even when using custom images*, major Operator upgrades can introduce significant compatibility issues with your existing Keycloak CR configuration, potentially requiring manual intervention
+* New fields in Keycloak CR or behavioral changes could impact existing deployments
+* No option to downgrade to the previous {project_name} version due to changes related to database migration
+
+*Recommendation:*
+
+*We strongly recommend using manual approval mode for the Keycloak Operator.* This ensures you can:
+
+1. Review release notes and follow migration changes before approving upgrades
+2. Schedule maintenance windows for upgrades
+3. Test upgrades in a non-production environment first
+4. Back up the database to allow downgrading to the previous {project_name} in case of issues
+====
+
+To prevent automatic upgrades by OLM, set the approval strategy to `Manual` when installing the Operator:
+
+===== Using the OpenShift web console
+
+When installing the Operator, select `Manual` approval in the update approval strategy section:
+
+image::manual-approval-olm.png["Configure manual approval in OLM"]
+
+===== Using the CLI
+
+For command-line installation, create a Subscription with `installPlanApproval: Manual`:
+
+[source,yaml]
+----
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: keycloak-operator
+  namespace: <target-namespace>
+spec:
+  channel: fast
+  name: keycloak-operator
+  source: <catalog-source>
+  sourceNamespace: <catalog-namespace>
+  installPlanApproval: Manual
+----
+
+After installation, any upgrade will require manual approval through the OLM interface or via the CLI.
+
 <@profile.ifCommunity>
 === Installing by using kubectl without Operator Lifecycle Manager
 
@@ -64,7 +115,7 @@ kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resourc
 kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{version}/kubernetes/kubernetes.yml
 ----
 
-The Operator will watch the namespace where it is installed. You may optionally select a namespace with the `-n` option. 
+The Operator will watch the namespace where it is installed. You may optionally select a namespace with the `-n` option.
 </@profile.ifCommunity>
 
 === Installing Multiple Operators
@@ -77,8 +128,8 @@ If you do this please be aware:
 - CRD revisions from newer Operator versions won't introduce breaking changes except for the eventual removal of fields that have been well deprecated. Thus newer CRDs are generally backward compatible.
 - the CRDs installed last will be the ones in use. This applies to OLM installations as well where the Operator version, that is installed as the last, also installs and overrides the CRDs if they exists in the cluster already.
 - older CRDs may not be forwards compatible with new fields used by newer operators. When using OLM it will check if your custom resources are compatible with the CRDs being installed, so the usage of new fields can prevent the simultaneous installation of older operator versions.
-- fields introduced by newer CRDs will not be supported by older Operators. Older Operator will fail to handle CRs that use such new fields with an error deserializing an unrecognized field.
+- fields introduced by newer CRDs will not be supported by older Operators. Older operators will fail to handle CRs that use such new fields with an error deserializing an unrecognized field.
 
-It is therefore recommended in a multiple Operator install scenario that you keep versions aligned as closely as possible to minimize the potential problems with different versions. 
+It is therefore recommended in a multiple Operator install scenario that you keep versions aligned as closely as possible to minimize the potential problems with different versions.
 
 </@tmpl.guide>
diff --git a/docs/guides/operator/realm-import.adoc b/docs/guides/operator/realm-import.adoc
index 553d14539377..11c28eb52ec8 100644
--- a/docs/guides/operator/realm-import.adoc
+++ b/docs/guides/operator/realm-import.adoc
@@ -4,9 +4,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="{project_name} Realm Import"
-priority=30
-summary="How to perform an automated {project_name} Realm Import using the operator">
+title="Automating a realm import"
+summary="Automate a realm import using the operator.">
 
 == Importing a {project_name} Realm
 
@@ -17,6 +16,8 @@ Using the {project_name} Operator, you can perform a realm import for the Keyclo
 * If a Realm with the same name already exists in {project_name}, it will not be overwritten.
 
 * The Realm Import CR only supports creation of new realms and does not update or delete those. Changes to the realm performed directly on {project_name} are not synced back in the CR.
+
+* Once the realm is imported you should delete the Realm Import CR as that will cleanup the associated Kubernetes Job and Pod resources.
 ====
 
 === Creating a Realm Import Custom Resource
@@ -85,10 +86,10 @@ When the import has successfully completed, the output will look like the follow
 ----
 CONDITION: Done
   STATUS: true
-  MESSAGE: 
+  MESSAGE:
 CONDITION: Started
   STATUS: false
-  MESSAGE: 
+  MESSAGE:
 CONDITION: HasErrors
   STATUS: false
   MESSAGE:
@@ -96,7 +97,7 @@ CONDITION: HasErrors
 
 === Placeholders
 
-Imports support placeholders referencing environment variables, see <@links.server id="importExport"/> for more. 
+Imports support placeholders referencing environment variables, see <@links.server id="importExport"/> for more.
 The `KeycloakRealmImport` CR allows you to leverage this functionality via the `spec.placeholders` stanza, for example:
 
 [source,yaml]
@@ -115,7 +116,7 @@ spec:
     ...
 ----
 
-In the above example placeholder replacement will be enabled and an environment variable with key `ENV_KEY` will be created from the Secret `SECRET_NAME`'s value for key `SECRET_KEY`. 
+In the above example placeholder replacement will be enabled and an environment variable with key `ENV_KEY` will be created from the Secret `SECRET_NAME`'s value for key `SECRET_KEY`.
 Currently only Secrets are supported and they must be in the same namespace as the Keycloak CR.
-  
+
 </@tmpl.guide>
diff --git a/docs/guides/operator/rolling-updates.adoc b/docs/guides/operator/rolling-updates.adoc
new file mode 100644
index 000000000000..74f9d9e2c125
--- /dev/null
+++ b/docs/guides/operator/rolling-updates.adoc
@@ -0,0 +1,142 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/kc.adoc" as kc>
+<#import "/templates/options.adoc" as opts>
+<#import "/templates/links.adoc" as links>
+<#import "/templates/profile.adoc" as profile>
+
+<@tmpl.guide
+title="Avoiding downtime with rolling updates"
+summary="Avoid downtime when changing themes, providers, or configurations in optimized images.">
+
+By default, the {project_name} Operator will perform rolling updates on configuration changes without downtime, and recreate updates with downtime when the image name or tag changes.
+
+This {section} describes how to minimize downtimes by configuring the {project_name} Operator to perform rolling updates of {project_name} automatically where possible, and how to override automatic detection for rolling updates.
+
+Use it, for example, to avoid downtimes when rolling out an update to a theme, provider or build time configuration in a custom or optimized image.
+
+== Supported Update Strategies
+
+The Operator supports the following update strategies:
+
+Rolling Updates:: Update the StatefulSet in a rolling fashion, avoiding a downtime when at least two replicas are running.
+
+Recreate Updates:: Scale down the StatefulSet before applying updates, causing temporary downtime.
+
+== Configuring the Update Strategy
+
+Specify the update strategy within the `spec` section of the Keycloak CR YAML definition:
+
+[source,yaml]
+----
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: example-kc
+spec:
+  update:
+    strategy: RecreateOnImageChange|Auto|Explicit # <1>
+    revision: "abc" # <2>
+----
+<1> Set the desired update strategy here.
+
+<2> Revision value for `Explicit` strategy.
+Ignored by the other strategies.
+
+[%autowidth]
+.Possible field values
+|===
+|Value |Downtime? |Description
+
+|`RecreateOnImageChange` (default)
+|On image name or tag change
+|Mimics {project_name} 26.1 or older behavior.
+When the image field changes, the Operator scales down the StatefulSet before applying the new image.
+
+|`Auto`
+|On incompatible changes
+|The {project_name} Operator detects if a rolling or recreate update is possible.
+
+In the current version, {project_name} performs a rolling update if the {project_name} version is the same for the old and the new image.
+Future versions of {project_name} will change that behavior and use additional information from the configuration, the image and the version to determine if a rolling update is possible to reduce downtimes.
+
+|`Explicit`
+|Only the `revision` field changes
+|The {project_name} Operator checks the `spec.update.revision` value.
+If it matches the previous deployment, it performs a rolling update.
+
+|===
+
+=== Understanding `Auto` and `Explicit` Update Strategies
+
+When using the `Auto` update strategy, the {project_name} Operator automatically starts a Job to assess the feasibility of a rolling update.
+Read more about the process in the <@links.server id="update-compatibility"/> {section}.
+This process consumes cluster resources for the time of the check and introduces a slight delay before the StatefulSet update begins.
+
+[WARNING]
+====
+If the Keycloak CR configured a `podTemplate` as part of the `unsupported` configuration parameters, the Keycloak Operator will do its best to use those settings for the started Job. Still it might miss some settings due to the flexibility of the `podTemplate` feature and its unsupported nature.
+
+As a consequence, the Operator might draw the wrong conclusions if a rolling update is possible from changes to the `podTemplate` or information pulled in from Secrets, ConfigMaps or Volumes in the `podTemplate`.
+
+Therefore, if you are using the unsupported `podTemplate`, you may need to use one of the other update strategies.
+====
+
+The `Explicit` update strategy delegates the update decision to the user.
+The `revision` field acts as a user-controlled trigger.
+While the {project_name} Operator does not interpret the `revision` value itself, any change to the Custom Resource (CR) while the `revision` remains unchanged will prompt a rolling update.
+
+Exercise caution when using this with automatic Operator upgrades.
+The Operator Lifecycle Manager (OLM) may upgrade the {project_name} Operator, and if the `Explicit` update strategy is in use, this could lead to unexpected behavior or deployment failures as the Operator would attempt a rolling update when this is actually not supported.
+**If you are using the `Explicit` update strategy, thorough testing in a non-production environment is highly recommended before upgrading.**
+
+=== CR Statuses
+
+The Keycloak CR status of `RecreateUpdateUsed` indicates the update strategy employed during the last update operation.
+The `lastTransitionTime` field indicates when the last update occurred.
+Use this information to observe actions and decisions taken by the Operator.
+
+[%autowidth]
+.Condition statuses
+|===
+|Status |Description
+
+m|Unknown
+|The initial state.
+It means no update has taken place.
+
+m|False
+|The Operator applied the rolling update strategy in the last update.
+
+m|True
+|The Operator applied the recreate update strategy in the last update.
+The `message` field explains why this strategy was chosen.
+
+|===
+
+[[operator-rolling-updates-for-patch-releases]]
+== Rolling updates for patch releases
+
+WARNING: This behavior is currently in an experimental mode, and it is not recommended for use in production.
+
+It is possible to enable automatic rolling updates when upgrading to a newer patch version in the same `+major.minor+` release stream.
+
+To enable this behavior, enable feature `rolling-updates:v2` as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: example-kc
+spec:
+  features:
+  enabled:
+    - rolling-updates:v2
+  update:
+    strategy: Auto
+----
+
+Read more about rolling updates for patch releases in the <@links.server id="update-compatibility" anchor="rolling-updates-for-patch-releases" /> {section}.
+
+</@tmpl.guide>
+
diff --git a/docs/guides/pom.xml b/docs/guides/pom.xml
index dde0fa3350ad..9dbf7330f267 100644
--- a/docs/guides/pom.xml
+++ b/docs/guides/pom.xml
@@ -14,8 +14,9 @@
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
   -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
         <artifactId>keycloak-docs-parent</artifactId>
         <groupId>org.keycloak</groupId>
@@ -28,7 +29,8 @@
     <name>Keycloak Guides</name>
     <artifactId>keycloak-guides</artifactId>
     <description>Keycloak Guides</description>
-    <!-- although this doesn't provide a JAR, this is necessary to call the DocsBuildDebugUtil class from an IDE for debugging -->
+    <!-- although this doesn't provide a JAR, this is necessary to call the DocsBuildDebugUtil class
+    from an IDE for debugging -->
     <packaging>jar</packaging>
 
     <dependencies>
@@ -133,7 +135,7 @@
                         <toc>left</toc>
                         <icons>font</icons>
                         <sectanchors>true</sectanchors>
-                        <idprefix/>
+                        <idprefix />
                         <idseparator>-</idseparator>
                         <docinfo1>true</docinfo1>
                         <imagesdir>../images</imagesdir>
@@ -198,7 +200,8 @@
                         </goals>
                         <configuration>
                             <sourceDirectory>${basedir}/target/generated-guides/getting-started</sourceDirectory>
-                            <outputDirectory>${project.build.directory}/generated-docs/getting-started</outputDirectory>
+                            <outputDirectory>
+                                ${project.build.directory}/generated-docs/getting-started</outputDirectory>
                         </configuration>
                     </execution>
                     <execution>
@@ -209,7 +212,8 @@
                         </goals>
                         <configuration>
                             <sourceDirectory>${basedir}/target/generated-guides/high-availability</sourceDirectory>
-                            <outputDirectory>${project.build.directory}/generated-docs/high-availability</outputDirectory>
+                            <outputDirectory>
+                                ${project.build.directory}/generated-docs/high-availability</outputDirectory>
                         </configuration>
                     </execution>
                     <execution>
@@ -224,6 +228,19 @@
                             <preserveDirectories>true</preserveDirectories>
                         </configuration>
                     </execution>
+                    <execution>
+                        <id>ui-customization-asciidoc-to-html</id>
+                        <phase>generate-resources</phase>
+                        <goals>
+                            <goal>process-asciidoc</goal>
+                        </goals>
+                        <configuration>
+                            <sourceDirectory>${basedir}/target/generated-guides/ui-customization</sourceDirectory>
+                            <outputDirectory>
+                                ${project.build.directory}/generated-docs/ui-customization</outputDirectory>
+                            <preserveDirectories>true</preserveDirectories>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
             <plugin>
@@ -246,4 +263,4 @@
         </plugins>
     </build>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/docs/guides/securing-apps/client-registration-cli.adoc b/docs/guides/securing-apps/client-registration-cli.adoc
index 3913a87e4c6b..92cdd1e164fc 100644
--- a/docs/guides/securing-apps/client-registration-cli.adoc
+++ b/docs/guides/securing-apps/client-registration-cli.adoc
@@ -2,9 +2,9 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Client registration CLI"
+title="Automating client registration with the CLI"
 priority=110
-summary="Automating Client Registration with the CLI">
+summary="Use the CLI to automate client registration.">
 
 The Client Registration CLI is a command-line interface (CLI) tool for application developers to configure new clients in a self-service manner when integrating with {project_name}. It is specifically designed to interact with {project_name} Client Registration REST endpoints.
 
diff --git a/docs/guides/securing-apps/client-registration.adoc b/docs/guides/securing-apps/client-registration.adoc
index 647c81f45135..e881c6fe03d7 100644
--- a/docs/guides/securing-apps/client-registration.adoc
+++ b/docs/guides/securing-apps/client-registration.adoc
@@ -2,9 +2,9 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Client registration service"
+title="Using the client registration service"
 priority=100
-summary="Using the client registration service">
+summary="Use the client registration service.">
 
 In order for an application or service to utilize {project_name} it has to register a client in {project_name}.
 An admin can do this through the admin console (or admin REST endpoints), but clients can also register themselves through the {project_name} client registration service.
diff --git a/docs/guides/securing-apps/docker-registry.adoc b/docs/guides/securing-apps/docker-registry.adoc
index 79a745c9eaf0..af8d15396ea3 100644
--- a/docs/guides/securing-apps/docker-registry.adoc
+++ b/docs/guides/securing-apps/docker-registry.adoc
@@ -2,9 +2,9 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Docker registry"
+title="Configuring a Docker registry"
 priority=90
-summary="Configuring a Docker registry to use {project_name}">
+summary="Configure a Docker registry to use {project_name}.">
 
 NOTE: Docker authentication is disabled by default. To enable see the https://www.keycloak.org/server/features[Enabling and disabling features] {section}.
 
diff --git a/docs/guides/securing-apps/javascript-adapter.adoc b/docs/guides/securing-apps/javascript-adapter.adoc
deleted file mode 100644
index 3ef17e640a8d..000000000000
--- a/docs/guides/securing-apps/javascript-adapter.adoc
+++ /dev/null
@@ -1,558 +0,0 @@
-<#import "/templates/guide.adoc" as tmpl>
-<#import "/templates/links.adoc" as links>
-
-<@tmpl.guide
-title="{project_name} JavaScript adapter"
-priority=30
-summary="Client-side JavaScript library that can be used to secure web applications.">
-
-{project_name} comes with a client-side JavaScript library called `keycloak-js` that can be used to secure web applications. The adapter also comes with built-in support for Cordova applications.
-The adapter uses OpenID Connect protocol under the covers. You can take a look at the <@links.securingapps id="oidc-layers" anchor="_oidc_available_endpoints"/> {section} for the more generic information about OpenID Connect endpoints and capabilities.
-
-== Installation
-
-We recommend that you install the https://www.npmjs.com/package/keycloak-js[`keycloak-js`] package from NPM:
-
-[source,bash]
-----
-npm install keycloak-js
-----
-
-== {project_name} server configuration
-
-One important thing to consider about using client-side applications is that the client has to be a public client as there is no secure way to store client credentials in a client-side application. This consideration makes it very important to make sure the redirect URIs you have configured for the client are correct and as specific as possible.
-
-To use the adapter, create a client for your application in the {project_name} Admin Console. Make the client public by toggling *Client authentication*  to *Off*  on the *Capability config* page.
-
-You also need to configure `Valid Redirect URIs` and `Web Origins`. Be as specific as possible as failing to do so may result in a security vulnerability.
-
-== Using the adapter
-
-The following example shows how to initialize the adapter. Make sure that you replace the options passed to the `Keycloak` constructor with those of the client you have configured.
-
-[source,javascript,subs="attributes+"]
-----
-import Keycloak from 'keycloak-js';
-
-const keycloak = new Keycloak({
-    url: "http://keycloak-server",
-    realm: "my-realm",
-    clientId: "my-app"
-});
-
-try {
-    const authenticated = await keycloak.init();
-    if (authenticated) {
-        console.log('User is authenticated');
-    } else {
-        console.log('User is not authenticated');
-    }
-} catch (error) {
-    console.error('Failed to initialize adapter:', error);
-}
-----
-
-
-
-To authenticate, you call the `login` function. Two options exist to make the adapter automatically authenticate. You can pass `login-required` or `check-sso` to the `init()` function.
-
-* `login-required` authenticates the client if the user is logged in to {project_name} or displays the login page if the user is not logged in.
-* `check-sso` only authenticates the client if the user is already logged in. If the user is not logged in, the browser is redirected back to the application and remains unauthenticated.
-
-You can configure a _silent_ `check-sso` option. With this feature enabled, your browser will not perform a full redirect to the {project_name} server and back to your application, but this action will be performed in a hidden iframe. Therefore, your application resources are only loaded and parsed once by the browser, namely when the application is initialized and not again after the redirect back from {project_name} to your application. This approach is particularly useful in case of SPAs (Single Page Applications).
-
-To enable the _silent_ `check-sso`, you provide a `silentCheckSsoRedirectUri` attribute in the init method. Make sure this URI is a valid endpoint in the application; it must be configured as a valid redirect for the client in the {project_name} Admin Console:
-
-[source,javascript]
-----
-await keycloak.init({
-    onLoad: 'check-sso',
-    silentCheckSsoRedirectUri: `${r"${location.origin}"}/silent-check-sso.html`
-});
-----
-
-The page at the silent check-sso redirect uri is loaded in the iframe after successfully checking your authentication state and retrieving the tokens from the {project_name} server.
-It has no other task than sending the received tokens to the main application and should only look like this:
-
-[source,html,subs="attributes+"]
-----
-<!doctype html>
-<html>
-<body>
-    <script>
-        parent.postMessage(location.href, location.origin);
-    </script>
-<div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
-</html>
-----
-
-Remember that this page must be served by your application at the specified location in `silentCheckSsoRedirectUri` and is _not_ part of the adapter.
-
-WARNING: _Silent_ `check-sso` functionality is limited in some modern browsers. Please see the <<_modern_browsers,Modern Browsers with Tracking Protection Section>>.
-
-To enable `login-required` set `onLoad` to `login-required` and pass to the init method:
-
-[source,javascript]
-----
-await keycloak.init({
-    onLoad: 'login-required'
-});
-----
-
-After the user is authenticated the application can make requests to RESTful services secured by {project_name} by including the bearer token in the
-`Authorization` header. For example:
-
-[source,javascript,subs="attributes+"]
-----
-async function fetchUsers() {
-    const response = await fetch('/api/users', {
-        headers: {
-            accept: 'application/json',
-            authorization: `Bearer ${r"${keycloak.token}"}`
-        }
-    });
-
-    return response.json();
-}
-----
-
-One thing to keep in mind is that the access token by default has a short life expiration so you may need to refresh the access token prior to sending the request. You refresh this token by calling the `updateToken()` method. This method returns a Promise, which makes it easy to invoke the service only if the token was successfully refreshed and displays an error to the user if it was not refreshed. For example:
-
-[source,javascript]
-----
-try {
-    await keycloak.updateToken(30);
-} catch (error) {
-    console.error('Failed to refresh token:', error);
-}
-
-const users = await fetchUsers();
-----
-
-[NOTE]
-====
-Both access and refresh token are stored in memory and are not persisted in any kind of storage. Therefore, these tokens should never be persisted to prevent hijacking attacks.
-====
-
-== Session Status iframe
-
-By default, the adapter creates a hidden iframe that is used to detect if a Single-Sign Out has occurred. This iframe does not require any network traffic. Instead the status is retrieved by looking at a special status cookie. This feature can be disabled by setting `checkLoginIframe: false` in the options passed to the `init()` method.
-
-You should not rely on looking at this cookie directly. Its format can change and it's also associated with the URL of the {project_name} server, not
-your application.
-
-WARNING: Session Status iframe functionality is limited in some modern browsers. Please see <<_modern_browsers,Modern Browsers with Tracking Protection Section>>.
-
-[[_javascript_implicit_flow]]
-== Implicit and hybrid flow
-
-By default, the adapter uses the https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code] flow.
-
-With this flow, the {project_name} server returns an authorization code, not an authentication token, to the application. The JavaScript adapter exchanges the `code` for an access token and a refresh token after the browser is redirected back to the application.
-
-{project_name} also supports the https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth[Implicit] flow where an access token is sent immediately after successful authentication with {project_name}. This flow may have better performance than the standard flow because no additional request exists to exchange the code for tokens, but it has implications when the access token expires.
-
-However, sending the access token in the URL fragment can be a security vulnerability. For example the token could be leaked through web server logs and or
-browser history.
-
-To enable implicit flow, you enable the *Implicit Flow Enabled* flag for the client in the {project_name} Admin Console. You also pass the parameter `flow` with the value `implicit` to `init` method:
-
-[source,javascript]
-----
-await keycloak.init({
-    flow: 'implicit'
-})
-----
-
-Note that only an access token is provided and no refresh token exists. This situation means that once the access token has expired, the application has to redirect to {project_name} again to obtain a new access token.
-
-{project_name} also supports the https://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth[Hybrid] flow.
-
-This flow requires the client to have both the *Standard Flow*  and *Implicit Flow*  enabled in the Admin Console. The {project_name} server then sends both the code and tokens to your application. The access token can be used immediately while the code can be exchanged for access and refresh tokens. Similar to the implicit flow, the hybrid flow is good for performance because the access token is available immediately.
-But, the token is still sent in the URL, and the security vulnerability mentioned earlier may still apply.
-
-One advantage in the Hybrid flow is that the refresh token is made available to the application.
-
-For the Hybrid flow, you need to pass the parameter `flow` with value `hybrid` to the `init` method:
-
-[source,javascript]
-----
-await keycloak.init({
-    flow: 'hybrid'
-});
-----
-
-[#hybrid-apps-with-cordova]
-== Hybrid Apps with Cordova
-
-{project_name} supports hybrid mobile apps developed with https://cordova.apache.org/[Apache Cordova]. The adapter has two modes for this: `cordova` and `cordova-native`:
-
-The default is `cordova`, which the adapter automatically selects if no adapter type has been explicitly configured and `window.cordova` is present. When logging in, it opens an https://cordova.apache.org/docs/en/latest/reference/cordova-plugin-inappbrowser/[InApp Browser] that lets the user interact with {project_name} and afterwards returns to the app by redirecting to `http://localhost`. Because of this behavior, you whitelist this URL as a valid redirect-uri in the client configuration section of the Admin Console.
-
-While this mode is easy to set up, it also has some disadvantages:
-
-* The InApp-Browser is a browser embedded in the app and is not the phone's default browser. Therefore it will have different settings and stored credentials will not be available.
-* The InApp-Browser might also be slower, especially when rendering more complex themes.
-* There are security concerns to consider, before using this mode, such as that it is possible for the app to gain access to the credentials of the user, as it has full control of the browser rendering the login page, so do not allow its use in apps you do not trust.
-
-The alternative mode  is`cordova-native`, which takes a different approach. It opens the login page using the system's browser. After the user has authenticated, the browser redirects back into the application using a special URL. From there, the {project_name} adapter can finish the login by reading the code or token from the URL.
-
-You can activate the native mode by passing the adapter type `cordova-native` to the `init()` method:
-
-[source,javascript]
-----
-await keycloak.init({
-    adapter: 'cordova-native'
-});
-----
-
-This adapter requires two additional plugins:
-
-* https://github.com/google/cordova-plugin-browsertab[cordova-plugin-browsertab]: allows the app to open webpages in the system's browser
-* https://github.com/e-imaxina/cordova-plugin-deeplinks[cordova-plugin-deeplinks]: allow the browser to redirect back to your app by special URLs
-
-The technical details for linking to an app differ on each platform and special setup is needed.
-Please refer to the Android and iOS sections of the https://github.com/e-imaxina/cordova-plugin-deeplinks/blob/master/README.md[deeplinks plugin documentation] for further instructions.
-
-Different kinds of links exist for opening apps:
-
-* custom schemes, such as `myapp://login` or `android-app://com.example.myapp/https/example.com/login`.
-* https://developer.apple.com/documentation/xcode/allowing-apps-and-websites-to-link-to-your-content/[Universal Links (iOS)] / https://developer.android.com/training/app-links/deep-linking[Deep Links (Android)].
-
-While the former are easier to set up and tend to work more reliably, the latter offer extra security because they are unique and only the owner of a domain can register them. Custom-URLs are deprecated on iOS.  For best reliability, we recommend that you use universal links combined with a fallback site that uses a custom-url link.
-
-Furthermore, we recommend the following steps to improve compatibility with the adapter:
-
-* Universal Links on iOS seem to work more reliably with `response-mode` set to `query`
-* To prevent Android from opening a new instance of your app on redirect add the following snippet to `config.xml`:
-
-[source,xml]
-----
-<preference name="AndroidLaunchMode" value="singleTask" />
-----
-
-[#custom-adapters]
-== Custom Adapters
-
-In some situations, you may need to run the adapter in environments that are not supported by default, such as Capacitor. To use the JavasScript client in these environments, you can pass a custom adapter. For example, a third-party library could provide such an adapter to make it possible to reliably run the adapter:
-
-[source,javascript]
-----
-import Keycloak from 'keycloak-js';
-import KeycloakCapacitorAdapter from 'keycloak-capacitor-adapter';
-
-const keycloak = new Keycloak({
-    url: "http://keycloak-server",
-    realm: "my-realm",
-    clientId: "my-app"
-});
-
-await keycloak.init({
-    adapter: KeycloakCapacitorAdapter,
-});
-----
-
-This specific package does not exist, but it gives a pretty good example of how such an adapter could be passed into the client.
-
-It's also possible to make your own adapter, to do so you will have to implement the methods described in the `KeycloakAdapter` interface. For example the following TypeScript code ensures that all the methods are properly implemented:
-
-[source,typescript]
-----
-import Keycloak, { KeycloakAdapter } from 'keycloak-js';
-
-// Implement the 'KeycloakAdapter' interface so that all required methods are guaranteed to be present.
-const MyCustomAdapter: KeycloakAdapter = {
-    async login(options) {
-        // Write your own implementation here.
-    }
-
-    // The other methods go here...
-};
-
-const keycloak = new Keycloak({
-    url: "http://keycloak-server",
-    realm: "my-realm",
-    clientId: "my-app"
-});
-
-await keycloak.init({
-    adapter: MyCustomAdapter,
-});
-----
-
-Naturally you can also do this without TypeScript by omitting the type information, but ensuring implementing the interface properly will then be left entirely up to you.
-
-[[_modern_browsers]]
-== Modern Browsers with Tracking Protection
-In the latest versions of some browsers, various cookies policies are applied to prevent tracking of the users by third parties, such as SameSite in Chrome or completely blocked third-party cookies. Those policies are likely to become more restrictive and adopted by other browsers over time. Eventually cookies in third-party contexts may become completely unsupported and blocked by the browsers. As a result, the affected adapter features might ultimately be deprecated.
-
-The adapter relies on third-party cookies for Session Status iframe, _silent_ `check-sso` and partially also for regular (non-silent) `check-sso`. Those features have limited functionality or are completely disabled based on how restrictive the browser is regarding cookies. The adapter tries to detect this setting and reacts accordingly.
-
-=== Browsers with "SameSite=Lax by Default" Policy
-All features are supported if SSL / TLS connection is configured on the {project_name} side as well as on the application side.  For example, Chrome is affected starting with version 84.
-
-=== Browsers with Blocked Third-Party Cookies
-Session Status iframe is not supported and is automatically disabled if such browser behavior is detected by the adapter. This means the adapter cannot use a session cookie for Single Sign-Out detection and must rely purely on tokens. As a result, when a user logs out in another window, the application using the adapter will not be logged out until the application tries to refresh the Access Token. Therefore, consider setting the Access Token Lifespan to a relatively short time, so that the logout is detected as soon as possible. For more details, see link:{adminguide_link}#_timeouts[Session and Token Timeouts].
-
-_Silent_ `check-sso` is not supported and falls back to regular (non-silent) `check-sso` by default. This behavior can be changed by setting `silentCheckSsoFallback: false` in the options passed to the `init` method. In this case, `check-sso` will be completely disabled if restrictive browser behavior is detected.
-
-Regular `check-sso` is affected as well. Since Session Status iframe is unsupported, an additional redirect to {project_name} has to be made when the adapter is initialized to check the user's login status. This check is different from the standard behavior when the iframe is used to tell whether the user is logged in, and the redirect is performed only when the user is logged out.
-
-An affected browser is for example Safari starting with version 13.1.
-
-== API Reference
-
-=== Constructor
-
-[source,javascript,subs="attributes+"]
-----
-// Recommended way to initialize the adapter.
-new Keycloak({
-    url: "http://keycloak-server",
-    realm: "my-realm",
-    clientId: "my-app"
-});
-
-// Alternatively a string to the path of the `keycloak.json` file.
-// Has some performance implications, as it will load the keycloak.json file from the server.
-// This version might also change in the future and is therefore not recommended.
-new Keycloak("http://keycloak-server/keycloak.json");
-----
-
-=== Properties
-
-authenticated::
-    Is `true` if the user is authenticated, `false` otherwise.
-
-token::
-    The base64 encoded token that can be sent in the `Authorization` header in requests to services.
-
-tokenParsed::
-    The parsed token as a JavaScript object.
-
-subject::
-    The user id.
-
-idToken::
-    The base64 encoded ID token.
-
-idTokenParsed::
-    The parsed id token as a JavaScript object.
-
-realmAccess::
-    The realm roles associated with the token.
-
-resourceAccess::
-    The resource roles associated with the token.
-
-refreshToken::
-    The base64 encoded refresh token that can be used to retrieve a new token.
-
-refreshTokenParsed::
-    The parsed refresh token as a JavaScript object.
-
-timeSkew::
-    The estimated time difference between the browser time and the {project_name} server in seconds. This value is just an estimation, but is accurate
-    enough when determining if a token is expired or not.
-
-responseMode::
-    Response mode passed in init (default value is fragment).
-
-flow::
-    Flow passed in init.
-
-adapter::
-    Allows you to override the way that redirects and other browser-related functions will be handled by the library.
-    Available options:
-    * "default" - the library uses the browser api for redirects (this is the default)
-    * "cordova" - the library will try to use the InAppBrowser cordova plugin to load keycloak login/registration pages (this is used automatically when the library is working in a cordova ecosystem)
-    * "cordova-native" - the library tries to open the login and registration page using the phone's system browser using the BrowserTabs cordova plugin. This requires extra setup for redirecting back to the app (see <<hybrid-apps-with-cordova>>).
-    * "custom" - allows you to implement a custom adapter (only for advanced use cases)
-
-responseType::
-    Response type sent to {project_name} with login requests. This is determined based on the flow value used during initialization, but can be overridden by setting this value.
-
-=== Methods
-
-*init(options)*
-
-Called to initialize the adapter.
-
-Options is an Object, where:
-
-* useNonce - Adds a cryptographic nonce to verify that the authentication response matches the request (default is `true`).
-* onLoad - Specifies an action to do on load. Supported values are `login-required` or `check-sso`.
-* silentCheckSsoRedirectUri - Set the redirect uri for silent authentication check if onLoad is set to 'check-sso'.
-* silentCheckSsoFallback - Enables fall back to regular `check-sso` when _silent_ `check-sso` is not supported by the browser (default is `true`).
-* token - Set an initial value for the token.
-* refreshToken - Set an initial value for the refresh token.
-* idToken - Set an initial value for the id token (only together with token or refreshToken).
-* scope - Set the default scope parameter to the {project_name} login endpoint. Use a space-delimited list of scopes. Those typically
-reference link:{adminguide_link}#_client_scopes[Client scopes] defined on a particular client. Note that the scope `openid` will
-always be added to the list of scopes by the adapter. For example, if you enter the scope options `address phone`, then the request
-to {project_name} will contain the scope parameter `scope=openid address phone`. Note that the default scope specified here is overwritten if the `login()` options specify scope explicitly.
-* timeSkew - Set an initial value for skew between local time and {project_name} server in seconds (only together with token or refreshToken).
-* checkLoginIframe - Set to enable/disable monitoring login state (default is `true`).
-* checkLoginIframeInterval - Set the interval to check login state (default is 5 seconds).
-* responseMode - Set the OpenID Connect response mode send to {project_name} server at login request. Valid values are `query` or `fragment`. Default value is `fragment`, which means that after successful authentication will {project_name} redirect to JavaScript application with OpenID Connect parameters added in URL fragment. This is generally safer and recommended over `query`.
-* flow - Set the OpenID Connect flow. Valid values are `standard`, `implicit` or `hybrid`.
-* enableLogging - Enables logging messages from Keycloak to the console (default is `false`).
-* pkceMethod - The method for Proof Key Code Exchange (https://datatracker.ietf.org/doc/html/rfc7636[PKCE]) to use. Configuring this value enables the PKCE mechanism. Available options:
-    - "S256" - The SHA256 based PKCE method (default)
-    - false - PKCE is disabled.
-* acrValues - Generates the `acr_values` parameter which refers to authentication context class reference and allows clients to declare the required assurance level requirements, e.g. authentication mechanisms. See https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#acr_values[Section 4. acr_values request values and level of assurance in OpenID Connect MODRNA Authentication Profile 1.0].
-* messageReceiveTimeout - Set a timeout in milliseconds for waiting for message responses from the Keycloak server. This is used, for example, when waiting for a message during 3rd party cookies check. The default value is 10000.
-* locale - When onLoad is 'login-required', sets the 'ui_locales' query param in compliance with https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest[section 3.1.2.1 of the OIDC 1.0 specification].
-
-Returns a promise that resolves when initialization completes.
-
-*login(options)*
-
-Redirects to login form, returns a Promise.
-
-Options is an optional Object, where:
-
-* redirectUri - Specifies the uri to redirect to after login.
-* prompt - This parameter allows to slightly customize the login flow on the {project_name} server side.
-For example, enforce displaying the login screen in case of value `login`. Or enforce displaying of consent screen for the value `consent` in case that client has `Consent Required`.
-Finally it is possible use the value `none` to make sure that login screen is not displayed to the user, which is useful just to check SSO for the case when user was already
-authenticated before (This is related to the `onLoad` check with value `check-sso` described above).
-* maxAge - Used just if user is already authenticated. Specifies maximum time since the authentication of user happened. If user is already authenticated for longer time than `maxAge`, the SSO is ignored and he will need to re-authenticate again.
-* loginHint - Used to pre-fill the username/email field on the login form.
-* scope - Override the scope configured in `init` with a different value for this specific login.
-* idpHint - Used to tell {project_name} to skip showing the login page and automatically redirect to the specified identity
-provider instead. More info in the link:{adminguide_link}#_client_suggested_idp[Identity Provider documentation].
-* acr - Contains the information about `acr` claim, which will be sent inside `claims` parameter to the {project_name} server. Typical usage
-is for step-up authentication. Example of use `{ values: ["silver", "gold"], essential: true }`. See OpenID Connect specification
-and link:{adminguide_link}#_step-up-flow[Step-up authentication documentation] for more details.
-* acrValues - Generates the `acr_values` parameter which refers to authentication context class reference and allows clients to declare the required assurance level requirements, e.g. authentication mechanisms. See https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#acr_values[Section 4. acr_values request values and level of assurance in OpenID Connect MODRNA Authentication Profile 1.0].
-* action - If the value is `register`, the user is redirected to the registration page. See link:{adminguide_link}#_registration-rc-client-flows[Registration requested by client section] for more details.
-If the value is `UPDATE_PASSWORD` or another supported required action, the user will be redirected to the reset password page or the other required action page. However, if the user is not authenticated, the user will be sent to the login page and redirected after authentication.
-See link:{adminguide_link}#con-aia_server_administration_guide[Application Initiated Action section] for more details.
-* locale - Sets the 'ui_locales' query param in compliance with https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest[section 3.1.2.1 of the OIDC 1.0 specification].
-* cordovaOptions - Specifies the arguments that are passed to the Cordova in-app-browser (if applicable). Options `hidden` and `location` are not affected by these arguments. All available options are defined at https://cordova.apache.org/docs/en/latest/reference/cordova-plugin-inappbrowser/. Example of use: `{ zoom: "no", hardwareback: "yes" }`;
-
-*createLoginUrl(options)*
-
-Returns a Promise containing the URL to login form.
-
-Options is an optional Object, which supports same options as the function `login` .
-
-*logout(options)*
-
-Redirects to logout.
-
-Options is an Object, where:
-
-* redirectUri - Specifies the uri to redirect to after logout.
-
-*createLogoutUrl(options)*
-
-Returns the URL to log out the user.
-
-Options is an Object, where:
-
-* redirectUri - Specifies the uri to redirect to after logout.
-
-*register(options)*
-
-Redirects to registration form. Shortcut for login with option action = 'register'
-
-Options are same as for the login method but 'action' is set to 'register'
-
-*createRegisterUrl(options)*
-
-Returns a Promise containing the url to registration page. Shortcut for createLoginUrl with option action = 'register'
-
-Options are same as for the createLoginUrl method but 'action' is set to 'register'
-
-*accountManagement()*
-
-Redirects to the Account Console.
-
-*createAccountUrl(options)*
-
-Returns the URL to the Account Console.
-
-Options is an Object, where:
-
-* redirectUri - Specifies the uri to redirect to when redirecting back to the application.
-
-*hasRealmRole(role)*
-
-Returns true if the token has the given realm role.
-
-*hasResourceRole(role, resource)*
-
-Returns true if the token has the given role for the resource (resource is optional, if not specified clientId is used).
-
-*loadUserProfile()*
-
-Loads the users profile.
-
-Returns a promise that resolves with the profile.
-
-For example:
-
-[source,javascript]
-----
-try {
-    const profile = await keycloak.loadUserProfile();
-    console.log('Retrieved user profile:', profile);
-} catch (error) {
-    console.error('Failed to load user profile:', error);
-}
-----
-
-*isTokenExpired(minValidity)*
-
-Returns true if the token has less than minValidity seconds left before it expires (minValidity is optional, if not specified 0 is used).
-
-*updateToken(minValidity)*
-
-If the token expires within minValidity seconds (minValidity is optional, if not specified 5 is used) the token is refreshed.
-If -1 is passed as the minValidity, the token will be forcibly refreshed.
-If the session status iframe is enabled, the session status is also checked.
-
-Returns a promise that resolves with a boolean indicating whether or not the token has been refreshed.
-
-For example:
-
-[source,javascript]
-----
-try {
-    const refreshed = await keycloak.updateToken(5);
-    console.log(refreshed ? 'Token was refreshed' : 'Token is still valid');
-} catch (error) {
-    console.error('Failed to refresh the token:', error);
-}
-----
-
-*clearToken()*
-
-Clear authentication state, including tokens.
-This can be useful if application has detected the session was expired, for example if updating token fails.
-
-Invoking this results in onAuthLogout callback listener being invoked.
-
-=== Callback Events
-
-The adapter supports setting callback listeners for certain events. Keep in mind that these have to be set before the call to the `init()` method.
-
-For example:
-[source,javascript]
-----
-keycloak.onAuthSuccess = () => console.log('Authenticated!');
-----
-
-The available events are:
-
-* *onReady(authenticated)* - Called when the adapter is initialized.
-* *onAuthSuccess* - Called when a user is successfully authenticated.
-* *onAuthError* - Called if there was an error during authentication.
-* *onAuthRefreshSuccess* - Called when the token is refreshed.
-* *onAuthRefreshError* - Called if there was an error while trying to refresh the token.
-* *onAuthLogout* - Called if the user is logged out (will only be called if the session status iframe is enabled, or in Cordova mode).
-* *onTokenExpired* - Called when the access token is expired. If a refresh token is available the token can be refreshed with updateToken, or in cases where it is not (that is, with implicit flow) you can redirect to the login screen to obtain a new access token.
-
-</@tmpl.guide>
diff --git a/docs/guides/securing-apps/mod-auth-mellon.adoc b/docs/guides/securing-apps/mod-auth-mellon.adoc
index a36d8b4a2fd9..7338003802d5 100644
--- a/docs/guides/securing-apps/mod-auth-mellon.adoc
+++ b/docs/guides/securing-apps/mod-auth-mellon.adoc
@@ -2,9 +2,9 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="mod_auth_mellon Apache Module"
+title="Configuring the mod_auth_mellon Apache Module"
 priority=80
-summary="Configuring the mod_auth_mellon Apache module with {project_name}">
+summary="Configure the mod_auth_mellon Apache module with {project_name}.">
 
 The https://github.com/latchset/mod_auth_mellon[mod_auth_mellon] is an authentication module for Apache. If your language/environment supports using Apache HTTPD as a proxy, then you can use mod_auth_mellon to secure your web application with SAML. For more details on this module see the _mod_auth_mellon_ GitHub repo.
 
diff --git a/docs/guides/securing-apps/mod-auth-openidc.adoc b/docs/guides/securing-apps/mod-auth-openidc.adoc
index 8ceb2b660ebe..c1e30cf2b121 100644
--- a/docs/guides/securing-apps/mod-auth-openidc.adoc
+++ b/docs/guides/securing-apps/mod-auth-openidc.adoc
@@ -2,9 +2,9 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="mod_auth_openidc Apache HTTPD Module"
+title="Configuring the mod_auth_openidc Apache HTTPD Module"
 priority=50
-summary="Configuring the mod_auth_openidc Apache module with {project_name}">
+summary="Configure the mod_auth_openidc Apache module with {project_name}.">
 
 
 WARNING: {project_name} does not provide any official support to mod_auth_openidc. The instructions below are best-effort and may not be up-to-date.
diff --git a/docs/guides/securing-apps/nodejs-adapter.adoc b/docs/guides/securing-apps/nodejs-adapter.adoc
deleted file mode 100644
index 0d40b5a1a78e..000000000000
--- a/docs/guides/securing-apps/nodejs-adapter.adoc
+++ /dev/null
@@ -1,381 +0,0 @@
-<#import "/templates/guide.adoc" as tmpl>
-<#import "/templates/links.adoc" as links>
-
-<@tmpl.guide
-title="{project_name} Node.js adapter"
-priority=40
-summary="Node.js adapter to protect server-side JavaScript apps">
-
-{project_name} provides a Node.js adapter built on top of https://github.com/senchalabs/connect[Connect] to protect server-side JavaScript apps - the goal was to be flexible enough to integrate with frameworks like https://expressjs.com/[Express.js].
-The adapter uses OpenID Connect protocol under the covers. You can take a look at the <@links.securingapps id="oidc-layers" anchor="_oidc_available_endpoints"/> {section} for the more generic information about OpenID Connect endpoints and capabilities.
-
-ifeval::[{project_community}==true]
-The library can be downloaded directly from https://www.npmjs.com/package/keycloak-connect[ {project_name} organization] and the source is available at
-https://github.com/keycloak/keycloak-nodejs-connect[GitHub].
-endif::[]
-
-To use the Node.js adapter, first you must create a client for your application in the {project_name} Admin Console. The adapter supports public, confidential, and bearer-only access type. Which one to choose depends on the use-case scenario.
-
-Once the client is created, click *Action* at the top right and choose *Download adapter config*. For *Format, choose *Keycloak OIDC JSON* and click *Download*. The downloaded `keycloak.json` file is at the root folder of your project.
-
-== Installation
-
-Assuming you have already installed https://nodejs.org[Node.js], create a folder for your application:
-
-    mkdir myapp && cd myapp
-
-Use `npm init` command to create a `package.json` for your application. Now add the {project_name} connect adapter in the dependencies list:
-
-ifeval::[{project_community}==true]
-
-[source,json,subs="attributes"]
-----
-    "dependencies": {
-        "keycloak-connect": "{project_versionNpm}"
-    }
-----
-
-endif::[]
-
-ifeval::[{project_product}==true]
-
-[source,json,subs="attributes"]
-----
-    "dependencies": {
-        "keycloak-connect": "file:keycloak-connect-{project_versionNpm}.tgz"
-    }
-----
-
-endif::[]
-
-== Usage
-Instantiate a Keycloak class::
-
-The `Keycloak` class provides a central point for configuration
-and integration with your application.  The simplest creation
-involves no arguments.
-
-In the root directory of your project create a file called `server.js` and add the following code:
-
-[source,javascript]
-----
-    const session = require('express-session');
-    const Keycloak = require('keycloak-connect');
-
-    const memoryStore = new session.MemoryStore();
-    const keycloak = new Keycloak({ store: memoryStore });
-----
-
-Install the `express-session` dependency:
-
-----
-    npm install express-session
-----
-
-To start the `server.js` script, add the following command in the 'scripts' section of the `package.json`:
-
-----
-    "scripts": {
-        "test": "echo \"Error: no test specified\" && exit 1",
-        "start": "node server.js"
-    },
-----
-
-Now we have the ability to run our server with following command:
-
-----
-    npm run start
-----
-
-By default, this will locate a file named `keycloak.json` alongside
-the main executable of your application, in our case on the root folder, to initialize {project_name} specific
-settings such as public key, realm name, various URLs.
-
-In that case a {project_name} deployment is necessary to access {project_name} admin console.
-
-Please visit links on how to deploy a {project_name} admin console with
-https://www.keycloak.org/getting-started/getting-started-podman[Podman] or https://www.keycloak.org/getting-started/getting-started-docker[Docker]
-
-Now we are ready to obtain the `keycloak.json` file by visiting the {project_name} Admin Console -> clients (left sidebar) -> choose your client -> Installation -> Format Option -> Keycloak OIDC JSON -> Download
-
-Paste the downloaded file on the root folder of our project.
-
-Instantiation with this method results in all the reasonable defaults
-being used. As alternative, it's also possible to provide a configuration
-object, rather than the `keycloak.json` file:
-
-[source,javascript,subs="attributes+"]
-----
-    const kcConfig = {
-        clientId: 'myclient',
-        bearerOnly: true,
-        serverUrl: 'http://localhost:8080{kc_base_path}',
-        realm: 'myrealm',
-        realmPublicKey: 'MIIBIjANB...'
-    };
-
-    const keycloak = new Keycloak({ store: memoryStore }, kcConfig);
-----
-
-Applications can also redirect users to their preferred identity provider by using:
-[source,javascript]
-----
-    const keycloak = new Keycloak({ store: memoryStore, idpHint: myIdP }, kcConfig);
-----
-
-Configuring a web session store::
-
-If you want to use web sessions to manage
-server-side state for authentication, you need to initialize the
-`Keycloak(...)` with at least a `store` parameter, passing in the actual
-session store that `express-session` is using.
-[source,javascript]
-----
-    const session = require('express-session');
-    const memoryStore = new session.MemoryStore();
-
-    // Configure session
-    app.use(
-      session({
-        secret: 'mySecret',
-        resave: false,
-        saveUninitialized: true,
-        store: memoryStore,
-      })
-    );
-
-    const keycloak = new Keycloak({ store: memoryStore });
-----
-Passing a custom scope value::
-
-By default, the scope value `openid` is passed as a query parameter to {project_name}'s login URL, but you can add an additional custom value:
-[source,javascript]
-    const keycloak = new Keycloak({ scope: 'offline_access' });
-
-== Installing middleware
-
-Once instantiated, install the middleware into your connect-capable app:
-
-In order to do so, first we have to install Express:
-----
-    npm install express
-----
-
-then require Express in our project as outlined below:
-
-[source,javascript]
-----
-    const express = require('express');
-    const app = express();
-----
-
-
-and configure Keycloak middleware in Express, by adding at the code below:
-
-[source,javascript]
-----
-    app.use( keycloak.middleware() );
-----
-
-Last but not least, let's set up our server to listen for HTTP requests on port 3000 by adding the following code to `main.js`:
-
-[source,javascript]
-----
-    app.listen(3000, function () {
-        console.log('App listening on port 3000');
-    });
-----
-
-== Configuration for proxies
-
-If the application is running behind a proxy that terminates an SSL connection
-Express must be configured per the link:https://expressjs.com/en/guide/behind-proxies.html[express behind proxies] guide.
-Using an incorrect proxy configuration can result in invalid redirect URIs
-being generated.
-
-Example configuration:
-
-[source,javascript]
-----
-    const app = express();
-
-    app.set( 'trust proxy', true );
-
-    app.use( keycloak.middleware() );
-----
-
-== Protecting resources
-
-Simple authentication::
-
-To enforce that a user must be authenticated before accessing a resource,
-simply use a no-argument version of `keycloak.protect()`:
-
-[source,javascript]
-----
-    app.get( '/complain', keycloak.protect(), complaintHandler );
-----
-
-Role-based authorization::
-
-To secure a resource with an application role for the current app:
-
-[source,javascript]
-----
-    app.get( '/special', keycloak.protect('special'), specialHandler );
-----
-
-To secure a resource with an application role for a *different* app:
-
-[source,javascript]
-    app.get( '/extra-special', keycloak.protect('other-app:special'), extraSpecialHandler );
-
-To secure a resource with a realm role:
-
-[source,javascript]
-    app.get( '/admin', keycloak.protect( 'realm:admin' ), adminHandler );
-
-Resource-Based Authorization::
-
-Resource-Based Authorization allows you to protect resources, and their specific methods/actions,**** based on a set of policies defined in Keycloak, thus externalizing authorization from your application. This is achieved by exposing a `keycloak.enforcer` method which you can use to protect resources.*
-
-[source,javascript]
-----
-    app.get('/apis/me', keycloak.enforcer('user:profile'), userProfileHandler);
-----
-
-The `keycloak-enforcer` method operates in two modes, depending on the value of the `response_mode` configuration option.
-
-[source,javascript]
-----
-    app.get('/apis/me', keycloak.enforcer('user:profile', {response_mode: 'token'}), userProfileHandler);
-----
-
-If `response_mode` is set to `token`, permissions are obtained from the server on behalf of the subject represented by the bearer token that was sent to your application. In this case, a new access token is issued by Keycloak with the permissions granted by the server. If the server did not respond with a token with the expected permissions, the request is denied. When using this mode, you should be able to obtain the token from the request as follows:
-
-[source,javascript]
-----
-    app.get('/apis/me', keycloak.enforcer('user:profile', {response_mode: 'token'}), function (req, res) {
-        const token = req.kauth.grant.access_token.content;
-        const permissions = token.authorization ? token.authorization.permissions : undefined;
-
-        // show user profile
-    });
-----
-
-Prefer this mode when your application is using sessions and you want to cache previous decisions from the server, as well automatically handle refresh tokens. This mode is especially useful for applications acting as a client and resource server.
-
-If `response_mode` is set to `permissions` (default mode), the server only returns the list of granted permissions, without issuing a new access token. In addition to not issuing a new token, this method exposes the permissions granted by the server through the `request` as follows:
-
-[source,javascript]
-----
-    app.get('/apis/me', keycloak.enforcer('user:profile', {response_mode: 'permissions'}), function (req, res) {
-        const permissions = req.permissions;
-
-        // show user profile
-    });
-----
-
-Regardless of the `response_mode` in use, the `keycloak.enforcer` method will first try to check the permissions within the bearer token that was sent to your application. If the bearer token already carries the expected permissions, there is no need
-to interact with the server to obtain a decision. This is specially useful when your clients are capable of obtaining access tokens from the server with the expected permissions before accessing a protected resource, so they can use some capabilities provided by Keycloak Authorization Services such as incremental authorization and avoid additional requests to the server when `keycloak.enforcer` is enforcing access to the resource.
-
-By default, the policy enforcer will use the `client_id` defined to the application (for instance, via `keycloak.json`) to
- reference a client in Keycloak that supports Keycloak Authorization Services. In this case, the client can not be public given
- that it is actually a resource server.
-
-If your application is acting as both a public client(frontend) and resource server(backend), you can use the following configuration to reference a different
-client in Keycloak with the policies that you want to enforce:
-
-[source,javascript]
-----
-      keycloak.enforcer('user:profile', {resource_server_id: 'my-apiserver'})
-----
-
-It is recommended to use distinct clients in Keycloak to represent your frontend and backend.
-
-If the application you are protecting is enabled with Keycloak authorization services and you have defined client credentials
- in `keycloak.json`, you can push additional claims to the server and make them available to your policies in order to make decisions.
-For that, you can define a `claims` configuration option which expects a `function` that returns a JSON with the claims you want to push:
-
-[source,javascript]
-----
-      app.get('/protected/resource', keycloak.enforcer(['resource:view', 'resource:write'], {
-          claims: function(request) {
-            return {
-              "http.uri": ["/protected/resource"],
-              "user.agent": // get user agent  from request
-            }
-          }
-        }), function (req, res) {
-          // access granted
-----
-
-For more details about how to configure Keycloak to protected your application resources, please take a look at the link:{authorizationguide_link}[{authorizationguide_name}].
-
-Advanced authorization::
-
-To secure resources based on parts of the URL itself, assuming a role exists
-for each section:
-
-[source,javascript]
-----
-    function protectBySection(token, request) {
-      return token.hasRole( request.params.section );
-    }
-
-    app.get( '/:section/:page', keycloak.protect( protectBySection ), sectionHandler );
-----
-
-Advanced Login Configuration:
-
-By default, all unauthorized requests will be redirected to the {project_name} login page unless your client is bearer-only.
-However, a confidential or public client may host both browsable and API endpoints. To prevent redirects on unauthenticated
-API requests and instead return an HTTP 401, you can override the redirectToLogin function.
-
-For example, this override checks if the URL contains /api/ and disables login redirects:
-
-[source,javascript]
-----
-    Keycloak.prototype.redirectToLogin = function(req) {
-    const apiReqMatcher = /\/api\//i;
-    return !apiReqMatcher.test(req.originalUrl || req.url);
-    };
-----
-
-== Additional URLs
-
-Explicit user-triggered logout::
-
-By default, the middleware catches calls to `/logout` to send the user through a
-{project_name}-centric logout workflow. This can be changed by specifying a `logout`
-configuration parameter to the `middleware()` call:
-
-[source,javascript]
-----
-    app.use( keycloak.middleware( { logout: '/logoff' } ));
-----
-
-When the user-triggered logout is invoked a query parameter `redirect_url` can be passed:
-
-[source]
-----
-https://example.com/logoff?redirect_url=https%3A%2F%2Fexample.com%3A3000%2Flogged%2Fout
-----
-
-This parameter is then used as the redirect url of the OIDC logout endpoint and the user will be redirected to
-`\https://example.com/logged/out`.
-
-{project_name} Admin Callbacks::
-
-Also, the middleware supports callbacks from the {project_name} console to log out a single
-session or all sessions.  By default, these type of admin callbacks occur relative
-to the root URL of `/` but can be changed by providing an `admin` parameter
-to the `middleware()` call:
-[source,javascript]
-    app.use( keycloak.middleware( { admin: '/callbacks' } );
-
-== Complete example
-
-A complete example using the Node.js adapter usage can be found in {quickstartRepo_link}/tree/latest/nodejs/resource-server[Keycloak quickstarts for Node.js]
-
-</@tmpl.guide>
diff --git a/docs/guides/securing-apps/oidc-layers.adoc b/docs/guides/securing-apps/oidc-layers.adoc
index d504a772a2a8..e8fc4f5a6911 100644
--- a/docs/guides/securing-apps/oidc-layers.adoc
+++ b/docs/guides/securing-apps/oidc-layers.adoc
@@ -2,11 +2,11 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Secure applications and services with OpenID Connect"
+title="Securing applications and services with OpenID Connect"
 priority=20
-summary="Using OpenID Connect with Keycloak to secure applications and services">
+summary="Use OpenID Connect with {project_name} to secure applications and services.">
 
-include::partials/oidc/available-endpoints.adoc[]
+<#include "partials/oidc/available-endpoints.adoc" />
 
 include::partials/oidc/supported-grant-types.adoc[]
 
diff --git a/docs/guides/securing-apps/overview.adoc b/docs/guides/securing-apps/overview.adoc
index e54603f91cf0..071c42acc902 100644
--- a/docs/guides/securing-apps/overview.adoc
+++ b/docs/guides/securing-apps/overview.adoc
@@ -4,9 +4,9 @@
 <@tmpl.guide
 title="Planning for securing applications and services"
 priority=10
-summary="Introduction and basic concepts for securing applications">
+summary="Understand basic concepts for securing applications.">
 
-As an OAuth2, OpenID Connect, and SAML compliant server, {project_name} can secure any application and service as long
+As an OAuth2, OpenID Connect and SAML compliant server, {project_name} can secure any application and service as long
 as the technology stack they are using supports any of these protocols. For more details about the security protocols
 supported by {project_name}, consider looking at link:{adminguide_link}#sso-protocols[{adminguide_name}].
 
diff --git a/docs/guides/securing-apps/partials/oidc/available-endpoints.adoc b/docs/guides/securing-apps/partials/oidc/available-endpoints.adoc
index dd551d620e61..a18dc3f260c6 100644
--- a/docs/guides/securing-apps/partials/oidc/available-endpoints.adoc
+++ b/docs/guides/securing-apps/partials/oidc/available-endpoints.adoc
@@ -69,6 +69,8 @@ The endpoint can also be invoked directly by the application. To invoke this end
 
 The certificate endpoint returns the public keys enabled by the realm, encoded as a JSON Web Key (JWK). Depending on the realm settings, one or more keys can be enabled for verifying tokens. For more information, see the link:{adminguide_link}[{adminguide_name}] and the https://datatracker.ietf.org/doc/html/rfc7517[JSON Web Key specification].
 
+For more details, see the https://openid.net/specs/openid-connect-discovery-1_0.html[OpenID Connect Discovery] specification.
+
 [[_token_introspection_endpoint]]
 ==== Introspection endpoint
 ....
diff --git a/docs/guides/securing-apps/partials/oidc/oauth21-support.adoc b/docs/guides/securing-apps/partials/oidc/oauth21-support.adoc
index b4cbc4443baf..3639ab60768d 100644
--- a/docs/guides/securing-apps/partials/oidc/oauth21-support.adoc
+++ b/docs/guides/securing-apps/partials/oidc/oauth21-support.adoc
@@ -3,7 +3,7 @@
 
 {project_name} makes it easier for administrators to make sure that their clients are compliant with these specifications:
 
-* https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10[The OAuth 2.1 Authorization Framework - draft specification]
+* https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13[The OAuth 2.1 Authorization Framework - draft specification]
 
 This compliance means that the {project_name} server will verify the requirements
 for the authorization server, which are mentioned in the specifications. {project_name} adapters do not have any specific support for the OAuth 2.1, hence the required validations on the client (application)
diff --git a/docs/guides/securing-apps/partials/oidc/supported-grant-types.adoc b/docs/guides/securing-apps/partials/oidc/supported-grant-types.adoc
index 9ee9e01f6bf2..b6d086b645a8 100644
--- a/docs/guides/securing-apps/partials/oidc/supported-grant-types.adoc
+++ b/docs/guides/securing-apps/partials/oidc/supported-grant-types.adoc
@@ -28,15 +28,15 @@ browser history. You can somewhat mitigate this problem by using short expiratio
 
 For more details, see the https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth[Implicit Flow] in the OpenID Connect specification.
 
-Per current https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-implicit-grant[OAuth 2.0 Security Best Current Practice], this flow should not be used.
-This flow is removed from the future https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09[OAuth 2.1 specification].
+Per current https://datatracker.ietf.org/doc/html/rfc9700#name-implicit-grant[Best Current Practice for OAuth 2.0 Security (RFC 9700)], this flow SHOULD NOT be used.
+This flow is removed from the future https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13[OAuth 2.1 specification].
 
 [[_resource_owner_password_credentials_flow]]
 === Resource Owner Password Credentials
 
 Resource Owner Password Credentials, referred to as Direct Grant in {project_name}, allows exchanging user credentials for tokens.
-Per current https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-resource-owner-password-cre[OAuth 2.0 Security Best Practices],
-this flow should not be used, preferring alternative methods such as <<Device Authorization Grant>> or <<Authorization code>>.
+Per current https://datatracker.ietf.org/doc/html/rfc9700#name-resource-owner-password-cre[Best Current Practice for OAuth 2.0 Security (RFC 9700)],
+this flow MUST NOT be used, preferring alternative methods such as <<Device Authorization Grant>> or <<Authorization code>>.
 
 The limitations of using this flow include:
 
@@ -56,7 +56,7 @@ Security concerns with this flow include:
 For a client to be permitted to use the Resource Owner Password Credentials grant, the client has to have the `Direct Access Grants Enabled` option enabled.
 
 This flow is not included in OpenID Connect, but is a part of the OAuth 2.0 specification.
-It is removed from the future https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09[OAuth 2.1 specification].
+It is removed from the future https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13[OAuth 2.1 specification].
 
 For more details, see the https://datatracker.ietf.org/doc/html/rfc6749#section-4.3[Resource Owner Password Credentials Grant] chapter in the OAuth 2.0 specification.
 
diff --git a/docs/guides/securing-apps/partials/overview/getting-started.adoc b/docs/guides/securing-apps/partials/overview/getting-started.adoc
index 5435b319dead..dc687aaec99d 100644
--- a/docs/guides/securing-apps/partials/overview/getting-started.adoc
+++ b/docs/guides/securing-apps/partials/overview/getting-started.adoc
@@ -11,15 +11,15 @@ Connect and SAML protocols.
 
 ifeval::[{project_community}==true]
 ==== Java
-* {quickstartRepo_link}/tree/latest/jakarta/servlet-authz-client[Wildfly Elytron OIDC]
-* {quickstartRepo_link}/tree/latest/spring/rest-authz-resource-server[Spring Boot]
+* {quickstartRepo_link}/tree/main/jakarta/servlet-authz-client[Wildfly Elytron OIDC]
+* {quickstartRepo_link}/tree/main/spring/rest-authz-resource-server[Spring Boot]
 endif::[]
 
 ==== JavaScript (client-side)
-* <@links.securingapps id="javascript-adapter"/>
+* https://www.keycloak.org/securing-apps/javascript-adapter[Keycloak JS adapter]
 
 ==== Node.js (server-side)
-* <@links.securingapps id="nodejs-adapter"/>
+* https://www.keycloak.org/securing-apps/nodejs-adapter[Keycloak Node.js adapter]
 
 ifeval::[{project_community}==true]
 ==== C#
diff --git a/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc b/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc
index ebfa1bd6b2ea..7495aeda40b0 100644
--- a/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc
+++ b/docs/guides/securing-apps/saml-galleon-layers-detailed-config.adoc
@@ -5,7 +5,7 @@
 title="{project_name} SAML Galleon feature pack detailed configuration"
 priority=70
 tileVisible="false"
-summary="Detailed list of elements for the `keycloak-saml.xml` configuration file">
+summary="Review this detailed list of elements for the `keycloak-saml.xml` configuration file.">
 
 This {section} contains the detailed list of elements for the `keycloak-saml.xml` configuration file used by the {project_name} SAML Galleon feature pack.
 
diff --git a/docs/guides/securing-apps/saml-galleon-layers.adoc b/docs/guides/securing-apps/saml-galleon-layers.adoc
index 3726b5b55899..4d319c84e8ad 100644
--- a/docs/guides/securing-apps/saml-galleon-layers.adoc
+++ b/docs/guides/securing-apps/saml-galleon-layers.adoc
@@ -4,7 +4,7 @@
 <@tmpl.guide
 title="{project_name} SAML Galleon feature pack for WildFly and EAP"
 priority=60
-summary="Using {project_name} SAML Galleon feature pack to secure applications in WildFly and EAP">
+summary="Using {project_name} SAML Galleon feature pack to secure applications in WildFly and EAP.">
 
 The SAML adapter is distributed as a Galleon feature pack for wildfly 29 or newer. More details about the subject
 in the https://docs.wildfly.org/32/WildFly_Elytron_Security.html#Keycloak_SAML_Integration[WildFly documentation].
diff --git a/docs/guides/securing-apps/token-exchange.adoc b/docs/guides/securing-apps/token-exchange.adoc
index a49dfe81caa0..05eea3086123 100644
--- a/docs/guides/securing-apps/token-exchange.adoc
+++ b/docs/guides/securing-apps/token-exchange.adoc
@@ -2,9 +2,327 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Using token exchange"
+title="Configuring and using token exchange"
 priority=120
-summary="Configuring and using Token exchange with {project_name}">
+summary="Configure and use token exchange for {project_name}.">
+
+Token exchange is the process that allows a client application to exchange one token for another token. In {project_name}, two features implement token exchange:
+
+* <<_standard-token-exchange,Standard token exchange: version 2 (V2)>> - This feature is the fully supported token exchange implementation that is enabled by default once the {project_name} server is started.
+* <<_legacy-token-exchange,Legacy token exchange: version 1 (V1)>> - This preview feature is not enabled by default once {project_name} server is started.
+
+The capabilities of {project_name} for token exchange are as follows:
+
+. A client can exchange an existing {project_name} token created for a specific client for a new token targeted to a different client in the same realm.
+. A client can exchange an existing {project_name} token for an external token, such as a linked Facebook account.
+. A client can exchange an external token for a {project_name} token.
+. A client can impersonate a user.
+
+The standard token exchange supports only use-case (1). The legacy token exchange support the four use-cases, but it is a preview feature. Therefore, the standard token exchange V2 is recommended  since it is supported and will be maintained for the future. The legacy token exchange is useful for last three use cases, but it may not be
+backwards compatible with future {project_name} versions. You can also enable both token exchange features and use them together. For example, you could use both internal-internal exchange
+provided by V2 together with other use cases that are supported by V1. For more details, see this <<_standard-token-exchange-comparison,token exchange comparison>>.
+
+NOTE: If you still need legacy token exchange feature, you also need link:{adminguide_link}#fine-grained-admin-permissions-v1[Fine-grained admin permissions version 1] (FGAP:v1) enabled because
+link:{adminguide_link}#_fine_grained_permissions[version 2 (FGAP:v2)] does not have support for token exchange permissions. This is on purpose because
+token-exchange is conceptually not really an "admin" permission and hence there is no plan to add token exchange permissions to FGAP:v2.
+
+[[_standard-token-exchange]]
+== Standard token exchange
+
+Standard token exchange in {project_name} implements the https://datatracker.ietf.org/doc/html/rfc8693[Token exchange specification]. It allows client application to exchange an existing {project_name} token created
+for a specific client for a new token issued to the client that triggered the token exchange request. Both clients must be in the same realm.
+
+[[_standard-token-exchange-flow]]
+=== Token exchange flow
+
+Consider this typical token exchange flow:
+
+. The user authenticates with the use of the {project_name} SSO to the client application `initial-client`. The token is issued to the `initial-client`.
+. The client `initial-client` may need to use the REST service `requester-client`, which requires authentication. So the `initial-client` sends the access token from step 1 to the `requester-client` with the
+use of the token
+. To serve the request, the `requester-client` may need to call another service `target-client`. However it may be unable to use the token sent to it from `initial-client`. For example:
+* The token has insufficient permissions or scopes.
+* The `target-client` is not specified as the token audience; the token was intended to be used to invoke `requester-client`.
+* The token has to many permissions; therefore, the `requester-client` may not want to share it with the `target-client`.
++
+Any of these situations could be the reason to invoke the token exchange. The `requester-client` may need to send the token exchange request to the {project_name} server and use the original token from step 1 as the
+_subject token_ and exchange it for another token _requested token_.
+. The _requested token_ is returned to `requester-client`. This token can now be sent to the `target-client`.
+. The `target-client` can fulfill the request and return the response to the `requester-client`. The `requester-client` can then follow and return the response to the request from step 2.
+
+Many other use-cases exist for token exchange, but the preceding example is the most typical.
+
+==== Example token exchange request
+
+The following is an example token exchange request of the client `requester-client` in the realm `test`. Note that `subject_token` is the access token issued to the `initial-client`:
+
+[source,bash]
+----
+POST /realms/test/protocol/openid-connect/token
+Authorization: Basic cmVxdWVzdGVyLWNsaWVudDpwYXNzd29yZA==
+Content-Type: application/x-www-form-urlencoded
+Accept: application/json
+
+grant_type=urn:ietf:params:oauth:grant-type:token-exchange&
+subject_token=$SUBJECT_TOKEN&
+subject_token_type=urn:ietf:params:oauth:token-type:access_token&
+requested_token_type=urn:ietf:params:oauth:token-type:access_token
+----
+
+The example token exchange response may look like this:
+
+[source,json]
+----
+{
+  "access_token": "eyJhbGciOiJSUzI1NiIsIn...",
+  "expires_in": 300,
+  "token_type": "Bearer",
+  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
+  "session_state": "287f3c57-32b8-4c0f-8b00-8c7db231d701",
+  "scope": "default-scope1",
+  "refresh_expires_in": 0,
+  "not-before-policy": 0
+}
+----
+
+[[_standard-token-exchange-enable]]
+=== How to enable token exchange
+
+For standard token exchange, `token-exchange-standard:v2` is enabled by default.  However, you also need to enable the *Standard token exchange* switch for
+the client that is supposed to send token exchange requests, such as the `requester-client` from the <<_standard-token-exchange-flow,previous example>>. Note that `requester-client` must be a confidential client.
+Also, as is the case for other grant requests, the token exchange requests must be authenticated by the appropriate link:{adminguide_link}#_client-credentials[client authentication method] that is configured
+for the client.
+
+.Enabling Token Exchange
+image::token-exchange-switch.png[Enabling Token Exchange]
+
+[[_standard-token-exchange-request]]
+=== Request and response parameters
+
+The parameters are aligned with the https://datatracker.ietf.org/doc/html/rfc8693#name-token-exchange-request-and-[Token exchange specification], which are described as follows:
+
+grant_type::
+    _REQUIRED._ The value of the parameter must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+subject_token::
+    _REQUIRED._ A security token that represents the identity of the party on behalf of whom the request is being made.
+
+subject_token_type::
+    _REQUIRED._ This parameter is the type of the token passed in the `subject_token` parameter. This must be `urn:ietf:params:oauth:token-type:access_token` when the standard token exchange is being used
+    because {project_name} does not support other types for the standard token exchange.
+
+requested_token_type::
+    _OPTIONAL._ This parameter represents the type of token that the client wants to exchange for. In this version,  only oauth and OpenID Connect token types are supported. The default value for this
+    is `urn:ietf:params:oauth:token-type:access_token`. Another possible value is `urn:ietf:params:oauth:token-type:id_token` if the ID token issued to `requester-client` is requested. The possible value might
+    be also `urn:ietf:params:oauth:token-type:refresh_token`; in this case, you will receive both an access token and refresh token within the response. However, the refresh token is allowed if the `Allow refresh token in Standard Token Exchange` client configuration option is enabled as specified in the <<_standard-token-exchange-details,standard token exchange>> section.
+
+scope::
+   _OPTIONAL._ This parameter represents the space-delimited set of OAuth and OpenID Connect scopes that the client is requesting. You can use link:{adminguide_link}#_client_scopes[Optional client scopes]
+   of the `requester-client`. For more details, see <<_standard-token-exchange-scope,scopes and audiences>>. Omitting this parameter means that only
+   the link:{adminguide_link}#_client_scopes[Default client scopes] are effectively used.
+
+audience::
+  _OPTIONAL._ Audience specifies `client_id` of the client, which is supposed to be used as the token audience. In <<_standard-token-exchange-flow,the example above>>, it could be `target-client`. Multiple
+  values of this parameter are allowed, which means that you want the token to contain multiple audiences to be used by `requester-client` in multiple different services. For example
+  `audience=target-client1&audience=target-client2` can be used in the request. More details in <<_standard-token-exchange-scope,the section about scopes and audiences>>.
+
+A successful response is returned in the JSON format. It contains similar parameters such as the response from other grants. The following are some token exchange specifics of the more notable parameters:
+
+access_token::
+    The requested access token. Note that if request specified `requested_token_type=urn:ietf:params:oauth:token-type:id_token`, this parameter may actually contain the ID token instead of access token.
+    This behavior is per https://datatracker.ietf.org/doc/html/rfc8693#section-2.2.1[the token exchange specification].
+
+refresh_token::
+    The refresh token. It is included just if `requested_token_type=urn:ietf:params:oauth:token-type:refresh_token` is used and the client has enabled issuing refresh tokens from the token exchange
+
+issued_token_type::
+    The issued requested token type. Same value as `requested_token_type` used in the request.
+
+token_type::
+    Usually `Bearer` if issued token type was access token or refresh token. In case of ID token requested, the value is `N_A`
+
+[[_standard-token-exchange-scope]]
+=== Scopes and audiences
+
+The `scope` parameter in the token exchange request has the same meaning as other grants. This parameter is optional. When it is omitted, the effective client scopes used in the request are
+the link:{adminguide_link}#_client_scopes[Default client scopes] of the `requester-client`. When this parameter is used, the effective client scopes are the default scopes together with
+the link:{adminguide_link}#_client_scopes[Optional client scopes]
+
+By default, the used client scopes will add the audiences to the `aud` claim of the token based on the used client scopes and client roles as specified in the link:{adminguide_link}#audience-support[Audience documentation].
+
+The `audience` parameter can be used for filtering of audiences, so that the `aud` claim will contain only the audiences specified by the `audience` parameter. Similarly the client roles in the token will
+be filtered and the token will have only the client roles of the clients specified by the `audience` parameter.
+
+In addition, the `audience` parameter can be used to potentially filter client scopes as well. It works in a manner that is similar way to link:{adminguide_link}#client-scopes-permissions[Client scope permission for users].
+If the client scope does not contain any client roles (for example, it contains zero roles or it contains only realm roles), no additional filtering occurs for client scopes. However, if the client scope contains any
+client role mappings, it must include some client roles of the clients requested by the `audience` parameter. Composite roles are also included for consideration. If the client scope contains no client
+roles of the clients requested by the `audience`, the client scope will be filtered.
+
+NOTE: The `audience` parameter can be used to filter the audiences that are coming from the used client scopes. However, this parameter will not add more audiences. When the audience parameter is omitted,
+no filtering occurs. As a result, the `audience` parameter is effectively used for "downscoping" the token to make sure that it contains only the requested audiences. However, the `scope` parameter is used
+to add optional client scopes and hence it can be used for "upscoping" and adding more scopes.
+
+==== Examples
+
+Here are some examples to better illustrate the behavior for scopes and audiences.
+
+Assume we have the realm with:
+
+* Client `target-client1` with the client role `target-client1-role`
+
+* Client `target-client2` with the client role `target-client2-role`
+
+* Client `target-client3` with the client role `target-client3-role`
+
+* Client scope `default-scope1`. This client scope has role scope mapping for the client role `target-client1/target-client1-role`
+
+* Client scope `optional-scope2`. This client scope has role scope mapping for the client role `target-client2/target-client2-role`
+
+* Client `requester-client`, which has client scope `default-scope1` added as default client scope and scope `optional-scope2` added as an optional client scope
+
+* Authenticated user, who is member of both `target-client1-role` and `target-client2-role`
+
+The settings above means that using scope `default-scope1` will add the audience `target-client1` to the token and using `optional-scope2` will add the audience `target-client2`. This is because of the
+audience resolving described in the link:{adminguide_link}#_audience_resolve[Audience documentation].
+
+
+===== Example 1
+
+Token exchange request sent with `scope=optional-scope2` and without audience parameter:
+
+There will be no filtering of audience. The scopes and audiences will be resolved as is the case for any other grants as described in the link:{adminguide_link}#_client_scopes[Client scopes] and
+link:{adminguide_link}#_audience_resolve[Audience documentation] sections. The response token will be similar to this (claims not interesting for this example omitted for brevity):
+
+[source,json]
+----
+{
+  "azp": "requester-client",
+  "scope": "default-scope1 optional-scope2",
+  "aud": [ "target-client1", "target-client2" ],
+  "resource_access": {
+	"target-client1": {
+  	  "roles": [ "target-client1-role" ]
+	},
+	"target-client2": {
+  	  "roles": [ "target-client2-role" ]
+	}
+  },
+  ...
+}
+----
+
+===== Example 2
+
+Token exchange request sent with `scope=optional-scope2` and with `audience=target-client2`
+
+Same like previous example, but `target-client1` audience and client roles filtered due audience parameter was included, but only with this `target-client2` client. The client scope `default-scope1` will be
+also filtered due it contains some client roles, but at the same time, it does not contain any client roles of requested audience client `target-client2`. So token would be like:
+
+[source,json]
+----
+{
+  "azp": "requester-client",
+  "scope": "optional-scope2",
+  "aud": [ "target-client2" ],
+  "resource_access": {
+    "target-client2": {
+      "roles": [ "target-client2-role" ]
+    }
+  },
+  ...
+}
+----
+
+===== Example 3
+
+Token exchange request sent with `scope=optional-scope2` and with `audience=target-client2&audience=target-client3`
+
+The `target-client3` is not part of the token audience as user does not have any roles. So in this case, the request will be rejected as some of the requested audiences are not available.
+
+NOTE: As mentioned in the token exchange specification, it is good practice to downscope the token as much as possible and use only the audiences needed. Ideally use a single audience. This strategy increases the probability
+that request will be allowed.
+
+NOTE: If you have a more complex deployment with many various scopes and audiences, it can be challenging to model it in an appropriate way. Consider using the link:{adminguide_link}#_client_scopes_evaluate[Client scopes evaluate tab]
+to test if the token looks as expected for the given user and for the given set of scopes and audiences.
+
+[[_standard-token-exchange-details]]
+=== Token exchange - Additional details
+
+These additional points clarify the behavior of token exchange.
+
+* It is not supported for public clients to send the token exchange requests. The V1 had some very limited support to public clients, when public client can exchange the token to itself with less scopes.
+This use case can be replaced by refresh token grant.
+
+* The `subject_token` sent to the token exchange endpoint must have the requester client set as an audience in the `aud` claim. Otherwise, the request would be rejected. The only exception is, if client
+exchanges his own token, which was issued to it. Exchanging to itself might be useful to downscope/upscope the token or filter unneeded token audiences and so on.
+
+* Consents - If the requester client has *Consent required* enabled, the token exchange is allowed only if the user is already granted consent to all requested scopes
+
+* link:{adminguide_link}#_fine_grain_permissions[Fine-grained admin permissions (FGAP)] are not needed for the standard token exchange. We plan to eventually integrate with FGAP for the future, but that
+integration might be available to all grants. It will not be specific only to token exchange as it was in token exchange V1.
+
+* Integrating token exchange with link:{adminguide_link}#_client_policies[Client policies] is possible. This integration can be useful to address certain use cases. For example, consider the use case to reject the token exchange request if the
+client `requester-client` sends the request with `scope=some-confidential-scope`. In this example, it can be useful to create a client policy condition with combined conditions
+for `client-scope`, `grant-type` and `client-roles`.
+
+* Requesting a refresh token is allowed only if the client has the switch *Allow refresh token in Standard Token Exchange* set to a value other than `No` (the default value). The switch is available in the
+Admin Console in the *Advanced* tab of the OIDC client in the *OpenID Connect Compatibility Modes* section. The other available value of the switch is *Same session*, which means that the refresh token is
+allowed only if the refresh token can use the same user session as the subject token. If that subject token is coming from a link:{adminguide_link}#_transient-session[Transient session] or from an
+link:{adminguide_link}#_offline-access[Offline session], the requesting refresh token will not be allowed. Similarly it will not be allowed to request an offline token (using `scope=offline_access`).
+
+.Enabling refresh token in Token Exchange
+image::token-exchange-switch-refresh.png[Enabling refresh token in Token Exchange]
+
+* Token exchange never creates a new link:{adminguide_link}#managing-user-sessions[user session]. In case that `requested_token_type` is a refresh token, it may eventually create a new client session in the user session
+for the requester client (if the client session was not yet created).
+
+* {project_name} Token exchange does not yet have support for the `resource` parameter.
+
+* The token exchange specification mentions the concepts of https://datatracker.ietf.org/doc/html/rfc8693#name-delegation-vs-impersonation[impersonation and delegation]. {project_name} has support for the
+impersonation use case, but not yet for the delegation use case.
+
+==== Revocation
+
+Assuming that there is a subject token `access-token1` issued to the client `initial-client`, here are some considerations related to token revocation:
+
+* For the case when the `access-token1` was exchanged to the `access-token2` of the client `requester-client`, the revocation of the `access-token1` will not revoke `access-token2`. Supporting of a "revocation chain" for access
+tokens would mean quite an overhead. So considering this,  the administrator must ensure that access tokens are short-lived and are revoked automatically after some time.
+
+* For the case when `access-token1` was exchanged to `refresh-token2` of client `requester-client`, we try to support revocation chain. This means that:
+  ** Revocation of `access-token1` will revoke also `refresh-token2`. Moreover this will remove the client session of the client `requester-client` from the
+     user session and hence all refresh tokens of `requester-client` in this user session will be effectively revoked
+  ** In case that `refresh-token2` and it's related access token was used for the further token exchange to different client, then revocation of `access-token1` will revoke those subsequent token exchanges
+     as well. In other words, the whole "chain" of exchanged tokens is going to be revoked.
+  ** Note that the access token should be valid when the revocation endpoint is invoked. If you do not have a valid access token when the original `access-token1` has expired, you can potentially use another
+     access token issued to same client in the same user session. The exchanged tokens such as `refresh-token2` and others from the "chain" should be revoked.
+
+[[_standard-token-exchange-comparison]]
+=== Comparison of standard token exchange and legacy token exchange
+
+While the preceding sections fully detail standard and legacy token exchange, the following is an overall summary that compares the two token exchange methods.
+
+[cols="3*", options="header"]
+|===
+|Capability |Standard token exchange V2 |Legacy token exchange V1
+s|Internal-internal token exchange | Supported. Implemented as per rfc8693 | Preview support. Loose implementation of rfc8693. It is recommended to use V2 instead
+s|Allowed `subject_token_type`     | Access token type only   | Access token type only for internal-internal, JWT for external-internal scenarios
+s|Allowed `requested_token_type`   | Access token (default), Refresh token, ID token | Access token, Refresh token (default), SAML2 assertion
+s|Behaviour of `scope` parameter   | Aligned with other grants. Scope parameter means requesting optional scopes of the client, which sent the token exchange request  | Scope parameter based on scopes of
+the "target" client specified by audience parameter. Downscoping support only
+s|Behavior of `audience` parameter   | Support for more values as per the specification. Can be used to narrow down the available audiences and keep only the requested audiences. Effectively downscoping the token per
+the required target audience | Support for single audience value. Token effectively issued to the client requested by audience parameter and using scopes of that client
+s|Public clients  | Not available. Downscoping implemented by V1 can be replaced by refresh token grant| Available only to exchange token of the client itself. Effectively downscoping support only
+s|Consents        | Allowed for clients with `Consent required` as long as the user is already granted consent | Not allowed for clients with *Consent required*
+s|Authorization  | Verification that the requester client must be in the audience of the `subject_token`. Integration with client policies. No Fine-grained admin permissions | Based on fine-grained admin permissions version 1
+s|Revocation chain | Not available for access tokens. Available for refresh tokens   | Not available for access nor refresh tokens
+s|Delegation per rfc8693|Not supported yet|Not supported
+s|Resource parameter per rfc8693|Not supported yet|Not supported
+s|Federated token exchange | Not implemented yet | Implemented as a preview
+s|Subject impersonation (including direct naked impersonation)   | Not implemented yet | Implemented as a preview
+|===
+
+[[_legacy-token-exchange]]
+== Legacy token exchange
 
 :tech_feature_name: Token Exchange
 :tech_feature_id: token-exchange
@@ -29,7 +347,7 @@ To use more than the <<_internal-token-to-internal-token-exchange,Internal Token
 For details, see the https://www.keycloak.org/server/features[Enabling and disabling features] {section}.
 ====
 
-== How token exchange works
+=== How token exchange works
 
 In {project_name}, token exchange is the process of using a set of credentials or token to obtain an entirely different token.
 A client may want to invoke on a less trusted application so it may want to downgrade the current token it has.
@@ -57,7 +375,7 @@ Public clients specify their client identifier as a form parameter.  Confidentia
 to pass their client id and secret, Basic Auth, or however your admin has configured the client authentication flow in your
 realm.
 
-=== Form parameters
+==== Form parameters
 
 client_id::
     _REQUIRED MAYBE._  This parameter is required for clients using form parameters for authentication.  If you are using
@@ -97,7 +415,7 @@ scope::
 
 NOTE:   We currently only support OpenID Connect and OAuth exchanges.  Support for SAML based clients and identity providers may be added in the future depending on user demand.
 
-=== Responses from a token exchange request
+==== Responses from a token exchange request
 
 A successful response from an exchange invocation will return the HTTP 200 response code with a content type that
 depends on the `requested-token-type` and `requested_issuer` the client asks for.  OAuth requested token types will return
@@ -140,7 +458,10 @@ For simplicity's sake, let's call a token minted by the current realm as an _int
 an external realm or identity provider as an _external_ token.
 
 [[_internal-token-to-internal-token-exchange]]
-== Internal token to internal token exchange
+=== Internal token to internal token exchange
+
+NOTE: For internal token to internal token exchange, it is recommended to use <<_standard-token-exchange,Standard token exchange>> instead of using the legacy token exchange flow described below.
+Standard token exchange is officially supported.
 
 With an internal token to token exchange you have an existing token minted to a specific client and you want to exchange
 this token for a new one minted for a different target client.  Why would you want to do this?  This generally happens
@@ -150,7 +471,7 @@ need to perform a "permission downgrade" where your app needs to invoke on a les
 to propagate your current access token.
 
 [[_client_to_client_permission]]
-=== Granting permission for the exchange
+==== Granting permission for the exchange
 
 Clients that want to exchange tokens for a different client need to be authorized in the Admin Console.
 You need to define a `token-exchange` fine grain permission in the target client you want permission to exchange to.
@@ -195,7 +516,7 @@ Your client now has permission to invoke.  If you do not do this correctly, you
 try to make an exchange.
 
 [[_internal_internal_making_request]]
-=== Making the request
+==== Making the request
 
 When your client is exchanging an existing token for a token targeting another client, you use the `audience` parameter.
 This parameter must be the client identifier for the target client that you configured in the Admin Console.
@@ -234,7 +555,7 @@ the client making the request to successfully complete the exchange.
 }
 ----
 
-== Internal token to external token exchange
+=== Internal token to external token exchange
 
 You can exchange a realm token for an external token minted by an external identity provider.  This external identity provider
 must be configured within the `Identity Provider` section of the Admin Console.  Currently only OAuth/OpenID Connect based external
@@ -253,7 +574,7 @@ If the account is not linked, the exchange response will contain a link you can
 discussed more in the <<_internal_external_making_request, Making the Request>> section.
 
 [[_grant_permission_external_exchange]]
-=== Granting permission for the exchange
+==== Granting permission for the exchange
 
 Internal to external token exchange requests will be denied with a 403, Forbidden response until you grant permission for the calling client to exchange tokens with the external identity provider.  To grant permission to the client, you go to the identity provider's configuration page to the *Permissions* tab.
 
@@ -293,7 +614,7 @@ image::exchange-idp-apply-policy.png[Apply Client Policy]
 Your client now has permission to invoke.  If you do not do this correctly, you will get a 403 Forbidden response if you try to make an exchange.
 
 [[_internal_external_making_request]]
-=== Making the request
+==== Making the request
 
 When your client is exchanging an existing internal token to an external one, you provide the `requested_issuer` parameter.  The parameter must be the alias of a configured identity provider.
 
@@ -340,7 +661,8 @@ so that the client can perform link:{developerguide_link}[Client Initiated Accou
 providers require linking through browser OAuth protocol.  With the `account-link-url` just add a `redirect_uri`
 query parameter to it and you can forward browsers to perform the link.
 
-== External token to internal token exchange
+[[_external-token-to-internal-token-exchange]]
+=== External token to internal token exchange
 
 You can trust and exchange external tokens minted by external identity providers for internal tokens.  This can be
 used to bridge between realms or just to trust tokens from your social provider.  It works similarly to an identity provider
@@ -359,7 +681,7 @@ These types of changes required a configured identity provider in the Admin Cons
 
 NOTE:  SAML identity providers are not supported at this time.  Twitter tokens cannot be exchanged either.
 
-=== Granting permission for the exchange
+==== Granting permission for the exchange
 
 Before external token exchanges can be done, you grant permission for the calling client to make the exchange.  This
 permission is granted in the same manner as <<_grant_permission_external_exchange, internal to external permission is granted>>.
@@ -368,7 +690,7 @@ If you also provide an `audience` parameter whose value points to a different cl
 must also grant the calling client permission to exchange to the target client specific in the `audience` parameter.  How
 to do this is <<_client_to_client_permission, discussed earlier>> in this section.
 
-=== Making the request
+==== Making the request
 
 The `subject_token_type` must either be `urn:ietf:params:oauth:token-type:access_token` or `urn:ietf:params:oauth:token-type:jwt`.
 If the type is `urn:ietf:params:oauth:token-type:access_token` you specify the `subject_issuer` parameter and it must be the
@@ -411,21 +733,24 @@ an example JSON response you get back from this call.
 ----
 
 
-== Impersonation
+=== Impersonation
 
 For internal and external token exchanges, the client can request on behalf of a user to impersonate a different user.
 For example, you may have an admin application that needs to impersonate a user so that a support engineer can debug
 a problem.
 
+NOTE: The impersonation scenario mentioned here is different from the https://datatracker.ietf.org/doc/html/rfc8693#name-delegation-vs-impersonation[impersonation concept of the token exchange specification].
+The specification does not support impersonating the token subject to different subject. The specification semantics rather means "impersonating the client" instead of "impersonating the user".
+
 
-=== Granting permission for the exchange
+==== Granting permission for the exchange
 
 The user that the subject token represents must have permission to impersonate other users.  See the
 link:{adminguide_link}[{adminguide_name}] on how to enable this permission.  It can be done through a role or through
 fine grain admin permissions.
 
 
-=== Making the request
+==== Making the request
 
 Make the request as described in other chapters except additionally specify the `requested_subject` parameter.  The
 value of this parameter must be a username or user id.
@@ -443,7 +768,7 @@ curl -X POST \
     http://localhost:8080{kc_realms_path}/myrealm/protocol/openid-connect/token
 ----
 
-== Direct Naked Impersonation
+=== Direct Naked Impersonation
 
 You can make an internal token exchange request without providing a `subject_token`.  This is called a direct
 naked impersonation because it places a lot of trust in a client as that client can impersonate any user in the realm.
@@ -454,7 +779,7 @@ is able to authenticate users itself, but not able to obtain a token.
 WARNING: It is very risky to enable direct naked impersonation for a client.  If the client's credentials are ever
          stolen, that client can impersonate any user in the system.
 
-=== Granting permission for the exchange
+==== Granting permission for the exchange
 
 If the `audience` parameter is provided, then the calling client must have permission to exchange to the client.  How
 to set this up is discussed earlier in this chapter.
@@ -504,7 +829,7 @@ try to make this type of exchange.
 NOTE: Public clients are not allowed to do direct naked impersonations.
 
 
-=== Making the request
+==== Making the request
 
 To make the request, simply specify the `requested_subject` parameter.  This must be the username or user id of
 a valid user.  You can also specify an `audience` parameter if you wish.
@@ -519,14 +844,14 @@ curl -X POST \
     http://localhost:8080{kc_realms_path}/myrealm/protocol/openid-connect/token
 ----
 
-== Expand permission model with service accounts
+=== Expand permission model with service accounts
 
 When granting clients permission to exchange, you don't necessarily  manually enable those permissions for each and every client.
 If the client has a service account associated with it, you can use a role to group permissions together and assign exchange permissions
 by assigning a role to the client's service account.  For example, you might define a `naked-exchange` role and any service account that has that
 role can do a naked exchange.
 
-== Exchange vulnerabilities
+=== Exchange vulnerabilities
 
 When you start allowing token exchanges, there are various things you have to both be aware of and careful of.
 
diff --git a/docs/guides/server/all-config.adoc b/docs/guides/server/all-config.adoc
index d105c15b4612..ab1e5f3244bd 100644
--- a/docs/guides/server/all-config.adoc
+++ b/docs/guides/server/all-config.adoc
@@ -3,7 +3,7 @@
 
 <@template.guide
 title="All configuration"
-summary="Complete list of all build options and configuration for {project_name}">
+summary="Review build options and configuration for {project_name}.">
 
 <#list ctx.options.categories as category>
 <#assign categoryOptions=ctx.options.getValues(category)>
diff --git a/docs/guides/server/all-provider-config.adoc b/docs/guides/server/all-provider-config.adoc
index 9f0f86821998..1b8f7fff7541 100644
--- a/docs/guides/server/all-provider-config.adoc
+++ b/docs/guides/server/all-provider-config.adoc
@@ -3,7 +3,7 @@
 
 <@template.guide
 title="All provider configuration"
-summary="Complete list of all the available provider configuration options">
+summary="Review provider configuration options.">
 
 <#list ctx.options.getProviderOptions() as spi, providers>
 == ${spi}
diff --git a/docs/guides/server/bootstrap-admin-recovery.adoc b/docs/guides/server/bootstrap-admin-recovery.adoc
index ddb9f354b2b1..45a8a962c2c6 100644
--- a/docs/guides/server/bootstrap-admin-recovery.adoc
+++ b/docs/guides/server/bootstrap-admin-recovery.adoc
@@ -3,8 +3,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Admin bootstrap and recovery"
-summary="Learn how to bootstrap and recover admin account.">
+title="Bootstrapping and recovering an admin account"
+summary="Bootstrap {project_name} and recover access by creating a temporary admin account.">
 
 == A temporary admin account
 
@@ -31,7 +31,7 @@ Additionally, it is strongly recommended to use the dedicated command with the s
 If you have built an optimized version of {project_name} with the `build` command as outlined in <@links.server id="configuration"/>, use the command line option `--optimized` to have {project_name} skip the build check for a faster startup time.
 When doing this, remove the build time options from the command line and keep only the runtime options.
 
-NOTE: if you do not use `--optimized` keep in mind that an `bootstrap-admin` command will implicitly create or update an optimized image for you - if you are running the command from the same machine as a server instance, this may impact the next start of your server.
+NOTE: if you do not use `--optimized` keep in mind that an `bootstrap-admin` command may implicitly create or update an optimized build for you - if you are running the command from the same machine as a server instance, this may impact the next start of your server.
 
 === Create an admin user
 
diff --git a/docs/guides/server/caching.adoc b/docs/guides/server/caching.adoc
index 3f1df6a761f9..be308a8eeb0e 100644
--- a/docs/guides/server/caching.adoc
+++ b/docs/guides/server/caching.adoc
@@ -5,8 +5,7 @@
 
 <@tmpl.guide
 title="Configuring distributed caches"
-summary="Understand how to configure the caching layer"
-includedOptions="cache cache-*">
+summary="Configure the caching layer to cluster multiple {project_name} instances and to increase performance.">
 
 {project_name} is designed for high availability and multi-node clustered setups.
 The current distributed cache implementation is built on top of https://infinispan.org[Infinispan], a high-performance, distributable in-memory data grid.
@@ -40,6 +39,7 @@ You configure these caches in `conf/cache-ispn.xml`:
 |users|Local|Cache persisted user data
 |authorization|Local|Cache persisted authorization data
 |keys|Local|Cache external public keys
+|crl|Local|Cache for X.509 authenticator CRLs
 |work|Replicated|Propagate invalidation messages across nodes
 |authenticationSessions|Distributed|Caches authentication sessions, created/destroyed/expired during the authentication process
 |sessions|Distributed|Cache persisted user session data
@@ -108,36 +108,41 @@ CPU, memory, and network utilization.
 
 These in-memory caches for user sessions and client sessions are limited to, by default, 10000 entries per node which reduces the overall memory usage of {project_name} for larger installations.
 The internal caches will run with only a single owner for each cache entry.
-Consider trade-off between memory consumption and the database utilization and set different sizes for the caches, edit {project_name}'s cache config file (`conf/cache-ispn.xml`) to set a `+<memory max-count="..."/>+` for those caches.
 
-.Volatile user sessions
+.Offline user sessions
+As an OpenID Connect Provider, the server is capable of authenticating users and issuing offline tokens. When issuing an offline token after successful authentication, the server creates an offline user session and offline client session.
+
+The following caches are used to store offline sessions:
+
+* offlineSessions
+* offlineClientSessions
 
-By default, user sessions are stored in the database and loaded on-demand to the cache.
-It is possible to configure {project_name} to store user sessions in the cache only and minimize the database utilization.
+Like the user and client sessions caches, the offline user and client session caches are limited to 10000 entries per node by default. Items which are evicted from the memory will be loaded on-demand from the database when needed.
+
+.Password brute force detection
+The `loginFailures` distributed cache is used to track data about failed login attempts.
+This cache is needed for the Brute Force Protection feature to work in a multi-node {project_name} setup.
+
+.Action tokens
+Action tokens are used for scenarios when a user needs to confirm an action asynchronously, for example in the emails sent by the forgot password flow.
+The `actionTokens` distributed cache is used to track metadata about action tokens.
+
+=== Volatile user sessions
+
+By default, regular user sessions are stored in the database and loaded on-demand to the cache.
+It is possible to configure {project_name} to store regular user sessions in the cache only and minimize calls to the database.
 
 Since all the sessions in this setup are stored in-memory, there are two side effects related to this:
 
-* Losing sessions on when all {project_name} nodes restart.
+* Losing sessions when all {project_name} nodes restart.
 * Increased memory consumption.
 
+When using volatile user sessions, the cache is the source of truth for user and client sessions.
+{project_name} automatically adjusts the number of entries that can be stored in memory, and increases the number of copies to prevent data loss.
+
 Follow these steps to enable this setup:
 
-1. Since the cache is the only source of truth for user and client sessions, configure caches to not limit the number of entries and to replicate each entry to at least two nodes. To do so, edit {project_name}'s cache config file (`conf/cache-ispn.xml`) for caches `sessions` and `clientSessions` with the following update:
-+
---
-* Remove the `+<memory max-count="..."/>+`
-* Change `owners` attribute of the `distributed-cache` tag to 2 or more
---
-+
-An example of the resulting configuration for the `sessions` cache would look as follows.
-+
-[source,xml]
-----
-<distributed-cache name="sessions" owners="2">
-    <expiration lifespan="-1"/>
-</distributed-cache>
-----
-2. Disable `persistent-user-sessions` feature using the following command:
+1. Disable `persistent-user-sessions` feature using the following command:
 +
 ----
 bin/kc.sh start --features-disabled=persistent-user-sessions ...
@@ -148,27 +153,8 @@ bin/kc.sh start --features-disabled=persistent-user-sessions ...
 Disabling `persistent-user-sessions` is not possible when `multi-site` feature is enabled.
 ====
 
-.Offline user sessions
-As an OpenID Connect Provider, the server is also capable of authenticating users and issuing offline tokens. Similarly to regular user and client sessions,
-when an offline token is issued by the server upon successful authentication, the server also creates an offline user session and an offline client session.
-
-The following caches are used to store offline sessions:
-
-* offlineSessions
-* offlineClientSessions
-
-Similarly to regular user and client sessions caches, also the offline user and client session caches are limited to 10000 entries per node by default. Items which are evicted from the memory will be loaded on-demand from the database when needed.
-Consider trade-off between memory consumption and the database utilization and set different sizes for the caches, edit {project_name}'s cache config file (`conf/cache-ispn.xml`) to set a `+<memory max-count="..."/>+` for those caches.
-
-.Password brute force detection
-The `loginFailures` distributed cache is used to track data about failed login attempts.
-This cache is needed for the Brute Force Protection feature to work in a multi-node {project_name} setup.
-
-.Action tokens
-Action tokens are used for scenarios when a user needs to confirm an action asynchronously, for example in the emails sent by the forgot password flow.
-The `actionTokens` distributed cache is used to track metadata about action tokens.
-
 === Configuring cache maximum size
+
 In order to reduce memory usage, it's possible to place an upper bound on the number of entries which are stored in a given
 cache. To specify an upper bound of on a cache, you must provide the following command line argument
 `--cache-embedded-$\{CACHE_NAME}-max-count=`, with `$\{CACHE_NAME}` replaced with the name of the cache you would like to
@@ -176,16 +162,20 @@ apply the upper bound to. For example, to apply an upper-bound of `1000` to the
 `--cache-embedded-offline-sessions-max-count=1000`. An upper bound can not be defined on the following caches:
 `actionToken`, `authenticationSessions`, `loginFailures`, `work`.
 
+Setting a maximum cache size for `sessions`, `clientSessions`, `offlineSessions` and `offlineClientSessions` is not supported when volatile sessions are enabled.
+
 === Configuring caches for availability
 
 Distributed caches replicate cache entries on a subset of nodes in a cluster and assigns entries to fixed owner nodes.
 
 Each distributed cache, that is a primary source of truth of the data (`authenticationSessions`, `loginFailures` and `actionTokens`) has two owners per default, which means that two nodes have a copy of the specific cache entries.
 Non-owner nodes query the owners of a specific cache to obtain data.
+When one of the owners becomes unavailable, the data is restored from the remaining owner and rebalanced across the remaining nodes.
 When both owner nodes are offline, all data is lost.
 
-The default number of owners is enough to survive 1 node (owner) failure in a cluster setup with at least three nodes. You are free
-to change the number of owners accordingly to better fit into your availability requirements. To change the number of owners, open `conf/cache-ispn.xml` and change the value for `owners=<value>` for the distributed caches to your desired value.
+The default number of two owners is the minimum number is necessary to survive one node (owner) failure or a rolling restart in a cluster setup with at least two nodes.
+A higher number increases the availability of the data, but at the expense of slower writes as more nodes need to be updated.
+Therefore, changing the number of owners for the caches `authenticationSessions`, `loginFailures` and `actionTokens` is not recommended.
 
 === Specify your own cache configuration file
 
@@ -212,7 +202,8 @@ The CLI options `cache-remote-username` and `cache-remote-password` are optional
 If the {jdgserver_name} server has authentication enabled, {project_name} will fail to start.
 
 == Transport stacks
-Transport stacks ensure that distributed cache nodes in a cluster communicate in a reliable fashion.
+
+Transport stacks ensure that {project_name} nodes in a cluster communicate in a reliable fashion.
 {project_name} supports a wide range of transport stacks:
 
 <@opts.expectedValues option="cache-stack"/>
@@ -241,7 +232,7 @@ The following table shows transport stacks that are available using the `--cache
 |===
 |Stack name|Transport protocol|Discovery
 
-|`kubernetes`|TCP|DNS resolution using the JGroups `DNS_PING` protocol. It requires to set `jgroups.dns.query` to the headless service FQDN.
+|`kubernetes` (deprecated) |TCP|DNS resolution using the JGroups `DNS_PING` protocol. It requires to set `jgroups.dns.query` to the headless service FQDN.
 |`tcp` (deprecated)|TCP|IP multicast using the JGroups `MPING` protocol. See below on how to configure a unique `jgroups.mcast_addr` or `jgroups.mcast_port` for each cluster.
 |`udp` (deprecated)|UDP|IP multicast using the JGroups `PING` protocol. See below on how to configure a unique `jgroups.mcast_addr` or `jgroups.mcast_port` for each cluster.
 |===
@@ -251,62 +242,72 @@ By default, {project_name} uses `239.6.7.8` as multicast address for `jgroups.mc
 
 NOTE: Use `-D<property>=<value>` to pass the properties via the `JAVA_OPTS_APPEND` environment variable or in the CLI command.
 
+// Keeping this paragraph in 26.x as stacks like `ec2` where mentioned in the 26.0 docs.
+// Should be removed for 27.0 when `jdbc-ping` is the general purpose default for everyone.
 ====
 *Additional Stacks*
 
 It is recommended to use one of the stacks available above.
 Additional stacks are provided by Infinispan, but it is outside the scope of this guide how to configure them.
-Please refer to {infinispan_embedding_docs}#cluster-transport[Setting up Infinispan cluster transport] for further documentation.
+Please refer to {infinispan_embedding_docs}#cluster-transport[Setting up Infinispan cluster transport] and {infinispan_embedding_docs}#customizing-jgroups-stacks_cluster-transport[Customizing JGroups stacks] for further documentation.
 ====
 
-=== Custom transport stacks
-If none of the available transport stacks are enough for your deployment, you are able to change your cache configuration file
-and define your own transport stack.
+== Securing transport stacks
 
-For more details, see {infinispan_embedding_docs}#customizing-jgroups-stacks_cluster-transport[Customizing JGroups stacks].
+Encryption using TLS is enabled by default for TCP-based transport stacks, which is also the default configuration
+No additional CLI options or modifications of the cache XML are required as long as you are using a TCP-based transport stack.
 
-.defining a custom transport stack
-[source]
+[NOTE]
+====
+If you are using a transport stack based on `UDP` or `TCP_NIO2`, proceed as follows to configure the encryption of the transport stack:
+
+. Set the option `cache-embedded-mtls-enabled` to `false`.
+. Follow the documentation in http://jgroups.org/manual5/index.html#ENCRYPT[JGroups Encryption documentation] and {infinispan_embedding_docs}#secure-cluster-transport[Encrypting cluster transport].
+====
+
+With TLS enabled, {project_name} auto-generates a self-signed RSA 2048 bit certificate to secure the connection and uses TLS 1.3 to secure the communication.
+The keys and the certificate are stored in the database so they are available to all nodes.
+By default, the certificate is valid for 60 days and is rotated at runtime every 30 days.
+Use the option `cache-embedded-mtls-rotation-interval-days` to change this.
+
+=== Running inside a service mesh
+
+When using a service mesh like Istio, you might need to allow a direct mTLS communication between the {project_name} Pods to allow for the mutual authentication to work.
+Otherwise, you might see error messages like `JGRP000006: failed accepting connection from peer SSLSocket` that indicate that a wrong certificate was presented, and the cluster will not form correctly.
+
+You then have the option to allow direct mTLS communication between the {project_name} Pods, or rely on the service mesh transport security to encrypt the communication and to authenticate peers.
+
+To allow direct mTLS communication for {project_name} when using Istio:
+
+* Apply the following configuration to allow direct communication.
++
+[source,yaml]
 ----
-<jgroups>
-    <stack name="my-encrypt-udp" extends="udp">
-    <SSL_KEY_EXCHANGE keystore_name="server.jks"
-        keystore_password="password"
-        stack.combine="INSERT_AFTER"
-        stack.position="VERIFY_SUSPECT2"/>
-        <ASYM_ENCRYPT asym_keylength="2048"
-        asym_algorithm="RSA"
-        change_key_on_coord_leave = "false"
-        change_key_on_leave = "false"
-        use_external_key_exchange = "true"
-        stack.combine="INSERT_BEFORE"
-        stack.position="pbcast.NAKACK2"/>
-    </stack>
-</jgroups>
-
-<cache-container name="keycloak">
-    <transport lock-timeout="60000" stack="my-encrypt-udp"/>
-    ...
-</cache-container>
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: infinispan-allow-nomtls
+spec:
+  selector:
+    matchLabels:
+      app: keycloak # <1>
+  portLevelMtls:
+    "7800": # <2>
+      mode: PERMISSIVE
 ----
+<1> Update the labels to match your {project_name} deployment.
+<2> Port 7800 is the default. Adjust it if you change the data transmission port.
 
-By default, the value set to the `cache-stack` option has precedence over the transport stack you define in the cache configuration file.
-If you are defining a custom stack, make sure the `cache-stack` option is not used for the custom changes to take effect.
+As an alternative, to disable the mTLS communication, and rely on the service mesh to encrypt the traffic:
 
-== Securing cache communication
-The current Infinispan cache implementation should be secured by various security measures such as RBAC, ACLs, and transport stack encryption.
+* Set the option `cache-embedded-mtls-enabled` to `false`.
+* Configure your service mesh to authorize only traffic from other {project_name} Pods for the data transmission port (default: 7800).
 
-JGroups handles all the communication between {project_name} server, and it supports Java SSL sockets for TCP communication.
-{project_name} uses CLI options to configure the TLS communication without having to create a customized JGroups stack or modifying the cache XML file.
+=== Proving your own keys and certificates
 
-To enable TLS, `cache-embedded-mtls-enabled` must be set to `true`.
-It requires a keystore with the certificate to use: `cache-embedded-mtls-key-store-file` sets the path to the keystore, and `cache-embedded-mtls-key-store-password` sets the password to decrypt it.
+Although not recommended for standard setups, if it is essential in a specific setup, you can configure the keystore with the certificate for the transport stack manually. `cache-embedded-mtls-key-store-file` sets the path to the keystore, and `cache-embedded-mtls-key-store-password` sets the password to decrypt it.
 The truststore contains the valid certificates to accept connection from, and it can be configured with `cache-embedded-mtls-trust-store-file` (path to the truststore), and `cache-embedded-mtls-trust-store-password` (password to decrypt it).
-To restrict unauthorized access, use a self-signed certificate for each {project_name} deployment.
-
-For JGroups stacks with `UDP` or `TCP_NIO2`, see the http://jgroups.org/manual5/index.html#ENCRYPT[JGroups Encryption documentation] on how to set up the protocol stack.
-
-For more information about securing cache communication, see the {infinispan_embedding_docs}#secure-cluster-transport[Encrypting cluster transport] documentation.
+To restrict unauthorized access, always use a self-signed certificate for each {project_name} deployment.
 
 == Network Ports
 
@@ -314,21 +315,97 @@ To ensure a healthy {project_name} clustering, some network ports need to be ope
 The table below shows the TCP ports that need to be open for the `jdbc-ping` stack, and a description of the traffic that goes through it.
 
 |===
-|Port |Property | Description
+|Port |Option| Property | Description
 
 m|7800
-m|jgroups.bind.address
+m|cache-embedded-network-bind-port
+m|jgroups.bind.port
 |Unicast data transmission.
 
 m|57800
+m|
 m|jgroups.fd.port-offset
 |Failure detection by protocol `FD_SOCK2`.
 It listens to the abrupt closing of a socket to suspect a {project_name} server failure.
-The `jgroups.fd.port-offset` property defines the offset from the `jgroups.bind.address`.
+The `jgroups.fd.port-offset` property defines the offset from the `cache-embedded-network-bind-port` option or `jgroups.bind.port` property.
+By default, the offset is set to 50000, making the failure detection port 57800.
+
+|===
+
+NOTE: If an option is not available for the port you require, configure it using a system property `-D<property>=<value>`
+in your `JAVA_OPTS_APPEND` environment variable or in your CLI command.
+
+[#network-bind-address]
+== Network bind address
+
+To ensure a healthy {project_name} clustering, the network port must be bound on an interface that is accessible from all other nodes of the cluster.
+
+By default, it picks a site local (non-routable) IP address, for example, from the 192.168.0.0/16 or 10.0.0.0/8 address range.
+
+To override the address, set the option `cache-embedded-network-bind-address=<IP>`.
+
+The following special values are also recognized:
+
+|===
+|Value |Description
+
+m|GLOBAL
+|Picks a global IP address if available.
+If not available, it falls back to `SITE_LOCAL`.
+
+m|SITE_LOCAL
+|Picks a site-local (non-routable) IP address (for example, from the 192.168.0.0 or 10.0.0.0 address ranges).
+This is the default value.
+
+m|LINK_LOCAL
+|Picks a link-local IP address from 169.254.1.0 through 169.254.254.255.
+
+m|NON_LOOPBACK
+|Picks any non-loopback address.
+
+m|LOOPBACK
+|Picks a loopback address (for example, 127.0.0.1).
+
+m|match-interface:<regex>
+|Picks an address that matches a pattern against the interface name.
+For example, `match-interface:tun0` or `match-interface:eth.\*`.
+
+m|match-address:<regex>
+|Picks an address that matches a pattern against the host address.
+For example, `match-address:192.168.\*`.
+
+m|match-host:<regex>
+|Picks an address that matches a pattern against the host name.
+For example, `match-host:linux.\*`.
+
+|===
+
+To set up for IPv6 only and have {project_name} pick the bind address automatically, use the following settings:
+
+[source,bash]
+----
+export JAVA_OPTS_APPEND="-Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true"
+----
+
+For more details about JGroups transport, check the http://jgroups.org/manual5/index.html#Transport[JGroups documentation page] or the {infinispan_embedding_docs}#cluster-transport[Infinispan documentation page].
+
+== Running instances on different networks
+
+If you run {project_name} instances on different networks, for example behind firewalls or in containers, the different instances will not be able to reach each other by their local IP address.
+In such a case, set up a port forwarding rule (sometimes called "`virtual server`") to their local IP address.
+
+When using port forwarding, use the following options so each node correctly advertises its external address to the other nodes:
 
 |===
+|Option | Description
+
+m|cache-embedded-network-external-port
+|Port that other instances in the {project_name} cluster should use to contact this node.
 
-NOTE: Use `-D<property>=<value` to modify the ports above in your `JAVA_OPTS_APPEND` environment variable or in your CLI command.
+m|cache-embedded-network-external-address
+|IP address that other instances in the {project_name} should use to contact this node.
+
+|===
 
 == Exposing metrics from caches
 
@@ -341,4 +418,14 @@ While these metrics provide more insights into the latency distribution, collect
 
 For more details about how to enable metrics, see <@links.observability id="configuration-metrics"/>.
 
+<@opts.printRelevantOptions includedOptions="cache cache-*" excludedOptions="cache-embedded-* cache-remote-*">
+
+=== Embedded Cache
+<@opts.includeOptions includedOptions="cache-embedded-*"/>
+
+=== Remote Cache
+<@opts.includeOptions includedOptions="cache-remote-*"/>
+
+</@opts.printRelevantOptions>
+
 </@tmpl.guide>
diff --git a/docs/guides/server/configuration-production.adoc b/docs/guides/server/configuration-production.adoc
index d2d25aaaa884..4993fad03a1e 100644
--- a/docs/guides/server/configuration-production.adoc
+++ b/docs/guides/server/configuration-production.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring {project_name} for production"
-summary="Learn how to make {project_name} ready for production."
+summary="Prepare {project_name} for use in production."
 includedOptions="">
 
 A {project_name} production environment provides secure authentication and authorization for deployments that range from on-premise deployments that support a few thousand users to deployments that serve millions of users.
@@ -83,4 +83,13 @@ For example, to change the IP stack preference to IPv4, set an environment varia
 export JAVA_OPTS_APPEND="-Djava.net.preferIPv4Stack=true"
 ----
 
+To set up the server for IPv6 only, set an environment variable as follows for the distributed caches to form a cluster:
+
+[source, bash]
+----
+export JAVA_OPTS_APPEND="-Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true"
+----
+
+See <@links.server id="caching" anchor="network-bind-address"/> for more details.
+
 </@tmpl.guide>
diff --git a/docs/guides/server/configuration-provider.adoc b/docs/guides/server/configuration-provider.adoc
index 38cb1bf13d25..211c51730934 100644
--- a/docs/guides/server/configuration-provider.adoc
+++ b/docs/guides/server/configuration-provider.adoc
@@ -5,7 +5,7 @@
 
 <@tmpl.guide
 title="Configuring providers"
-summary="Understand how to configure providers">
+summary="Configure providers for {project_name}.">
 
 The server is built with extensibility in mind and for that it provides a number of Service Provider Interfaces or SPIs, each one
 responsible for providing a specific capability to the server. In this {section}, you are going to understand the core concepts around
@@ -19,6 +19,12 @@ any provider, including those you have implemented to extend the server capabili
 Providers can be configured by using a specific configuration format. The format consists of:
 
 [source]
+----
+spi-<spi-id>--<provider-id>--<property>=<value>
+----
+
+Or if there is no possibility of ambiguity between multiple providers:
+
 ----
 spi-<spi-id>-<provider-id>-<property>=<value>
 ----
@@ -27,7 +33,9 @@ The `<spi-id>` is the name of the SPI you want to configure.
 
 The `<provider-id>` is the id of the provider you want to configure. This is the id set to the corresponding provider factory implementation.
 
-The `<property>` is the actual name of the property you want to set for a given provider.
+The `<property>` is the actual name of the property you want to set for a given provider
+
+NOTE: the property name `enabled` is effectively reserved for enabling / disabling a provider
 
 All those names (for spi, provider, and property) should be in lower case and if the name is in camel-case such as `myKeycloakProvider`, it should include dashes (`-`) before upper-case letters as follows: `my-keycloak-provider`.
 
@@ -35,31 +43,47 @@ Taking the `HttpClientSpi` SPI as an example, the name of the SPI is `connection
 
 [source]
 ----
-spi-connections-http-client-default-connection-pool-size=10
+spi-connections-http-client--default--connection-pool-size=10
 ----
 
-== Setting a provider configuration option
+=== Setting a provider configuration option
 
 Provider configuration options are provided when starting the server. See all support configuration sources and formats for options in <@links.server id="configuration"/>. For example via a command line option:
 
 .Setting the `connection-pool-size` for the `default` provider of the `connections-http-client` SPI
-<@kc.start parameters="--spi-connections-http-client-default-connection-pool-size=10"/>
+<@kc.start parameters="--spi-connections-http-client--default--connection-pool-size=10"/>
+
+== Build time options
 
-== Configuring a single provider for an SPI
+=== Configuring a single provider for an SPI
 
 Depending on the SPI, multiple provider implementations can co-exist but only one of them is going to be used at runtime.
-For these SPIs, a specific provider is the primary implementation that is going to be active and used at runtime.
+For these SPIs, a specific provider is the primary implementation that is going to be active and used at runtime. The format consists of:
+
+[source]
+----
+spi-<spi-id>--provider=<provider-id>
+----
+
+NOTE: `spi-<spi-id>-provider=<provider-id>` may still be used, but the server will not properly detect when reaugmentation is needed.
 
 To configure a provider as the single provider you should run the `build` command as follows:
 
 .Marking the `mycustomprovider` provider as the single provider for the `email-template` SPI
-<@kc.build parameters="--spi-email-template-provider=mycustomprovider"/>
+<@kc.build parameters="--spi-email-template--provider=mycustomprovider"/>
 
-== Configuring a default provider for an SPI
+=== Configuring a default provider for an SPI
 
 Depending on the SPI, multiple provider implementations can co-exist and one is used by default.
 For these SPIs, a specific provider is the default implementation that is going to selected unless a specific provider
-is requested.
+is requested. The format consists of:
+
+[source]
+----
+spi-<spi-id>--provider-default=<provider-id>
+----
+
+NOTE: `spi-<spi-id>-provider-default=<provider-id>` may still be used, but the server will not properly detect when reaugmentation is needed.
 
 The following logic is used to determine the default provider:
 
@@ -70,15 +94,23 @@ The following logic is used to determine the default provider:
 To configure a provider as the default provider you should run the `build` command as follows:
 
 .Marking the `mycustomhash` provider as the default provider for the `password-hashing` SPI
-<@kc.build parameters="--spi-password-hashing-provider-default=mycustomprovider"/>
+<@kc.build parameters="--spi-password-hashing--provider-default=mycustomprovider"/>
 
+=== Enabling and disabling a provider
+
+The format consists of:
+
+[source]
+----
+spi-<spi-id>--<provider-id>--enabled=<boolean>
+----
 
-== Enabling and disabling a provider
+NOTE: `spi-<spi-id>-<provider-id>-enabled=<boolean>` may still be used, but the server will not properly detect when reaugmentation is needed.
 
 To enable or disable a provider you should run the `build` command as follows:
 
 .Enabling a provider
-<@kc.build parameters="--spi-email-template-mycustomprovider-enabled=true"/>
+<@kc.build parameters="--spi-email-template--mycustomprovider--enabled=true"/>
 
 To disable a provider, use the same command and set the `enabled` property to `false`.
 
diff --git a/docs/guides/server/configuration.adoc b/docs/guides/server/configuration.adoc
index f424fdbabf85..150d16134336 100644
--- a/docs/guides/server/configuration.adoc
+++ b/docs/guides/server/configuration.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring {project_name}"
-summary="Understand how to configure and start {project_name}">
+summary="Configure and start {project_name}.">
 
 This {section} explains the configuration methods for {project_name} and how to start and apply the preferred configuration. It includes configuration guidelines for optimizing {project_name} for faster startup and low memory footprint.
 
@@ -85,7 +85,7 @@ db-url-host=mykeycloakdb
 
 Alternatively, see <@links.server id="all-config"/> for all server options.
 
-=== Formats for environment variables
+=== Format for referencing environment variables
 You can use placeholders to resolve an environment specific value from environment variables inside the `keycloak.conf` file by using the `${r"++${ENV_VAR}++"}` syntax:
 
 [source]
@@ -153,8 +153,33 @@ Note that some Quarkus properties are already mapped in the {project_name} confi
 To disable expression evaluation, the `\` character functions as an escape character. In particular, it must be used to escape the usage of `$` characters when they appear to define an expression or are repeated. For example, if you want the configuration value `my$$password`, use `my\$\$password` instead.  Note that the `\` character requires additional escaping or quoting when using most unix shells, or when it appears in properties files.
 For example, bash single quotes preserve the single backslash `--db-password='my\$\$password'`. Also, with bash double quotes, you need an additional backslash `--db-password="my\\$\\$password"`. Similarly in a properties file, backslash characters must also be escaped: `kc.db-password=my\\$\\$password`
 
+.Windows-specific considerations
 When specifying Windows file paths in configuration values, backslashes must also be escaped. For example, if you want to specify the path `C:\path\to\file`, you should write it as `C:\\path\\to\\file`. Alternatively, you can use forward slashes which don't need escaping: `C:/path/to/file`.
 
+When using PowerShell and your values contain special characters like commas, use single quotes around double quotes:
+
+[source, bash]
+----
+.\kc.bat start --log-level='"INFO,org.hibernate:debug"'
+----
+
+PowerShell handles quotes differently. It interprets the quoted string before passing it to the `kc.bat` script, removing the outer quote characters. Therefore, an extra layer of quotes is needed to preserve the value structure. Otherwise, the comma would be interpreted as a delimiter. In Windows CMD, you can use double quotes directly.
+
+=== Formats for environment variable keys with special characters
+
+Non-alphanumeric characters in your configuration key must be converted to `_` in the corresponding environment variable key.
+
+Environment variables are converted back to normal option keys by lower-casing the name and replacing `\_` with `-`. Logging wildcards are the exception as `_` in the category is replaced with `.` instead. Logging categories are commonly class / package names, which are more likely to use `.` rather than `-`.
+
+WARNING: Automatic mapping of the environment variable key to option key may not preserve the intended key 
+
+For example `kc.log-level-package.class_name` will become the environment variable key `KC_LOG_LEVEL_PACKAGE_CLASS_NAME`. That will automatically be mapped to `kc.log-level-package.class.name` because `_` in the logging category will be replaced by `.`. Unfortunately this does not match the intent of `kc.log-level-package.class_name`.
+
+You have a couple of options in this case:
+
+- create an entry in your `keycloak.conf` file that references an environment variable of your choosing. e.g. `kc.log-level-package.class_name=${r"${CLASS_NAME_LEVEL}"}`. See more on referencing environment variables in <<Format for referencing environment variables>>.
+- or in situations where modifying the `keycloak.conf` may not be easy, you can use a pair of environment variables `KC_UNIQUEIFIER=value` and `KCKEY_UNIQUEIFIER=key`, e.g. `KC_MYKEY=debug` and `KCKEY_MYKEY=log-level-package.class_name`, or `KC_LOG_LEVEL_PACKAGE_CLASS_NAME=debug` and `KCKEY_LOG_LEVEL_PACKAGE_CLASS_NAME=log-level-package.class_name` 
+
 == Starting {project_name}
 You can start {project_name} in `development mode` or `production mode`. Each mode offers different defaults for the intended environment.
 
@@ -271,12 +296,12 @@ You can achieve most optimizations to startup and runtime behavior by using the
 Some of the realm capabilities allow administrators to reference system variables such as environment variables and system properties when configuring
 the realm and its components.
 
-By default, {project_name} disallow using system variables but only those explicitly specified through the `spi-admin-allowed-system-variables` configuration
+By default, {project_name} disallow using system variables but only those explicitly specified through the `+spi-admin--allowed-system-variables+` configuration
 option. This option allows you to specify a comma-separated list of keys that will eventually resolve to values from system variables with the same key.
 
 . Start the server and expose a set of system variables to the server runtime
 +
-    <@kc.start parameters="--spi-admin-allowed-system-variables=FOO,BAR"/>
+    <@kc.start parameters="--spi-admin--allowed-system-variables=FOO,BAR"/>
 
 In future releases, this capability will be removed in favor of preventing any usage of system variables in the realm configuration.
 
diff --git a/docs/guides/server/containers.adoc b/docs/guides/server/containers.adoc
index 50db3b86c392..f3e168cf8b88 100644
--- a/docs/guides/server/containers.adoc
+++ b/docs/guides/server/containers.adoc
@@ -6,7 +6,7 @@
 
 <@tmpl.guide
 title="Running {project_name} in a container"
-summary="Learn how to run {project_name} from a container image"
+summary="Run {project_name} from a container image."
 includedOptions="db db-url db-username db-password features hostname https-key-store-file https-key-store-password health-enabled metrics-enabled">
 
 This {section} describes how to optimize and run the {project_name} container image to provide the best experience running a container.
@@ -120,6 +120,28 @@ This approach uses a chroot, `+/mnt/rootfs+`, so that only the packages you spec
 
 WARNING: Some packages have a large tree of dependencies. By installing new RPMs you may unintentionally increase the container's attack surface. Check the list of installed packages carefully.
 
+=== Custom ENTRYPOINT shell scripts
+
+If you use a custom entry point script, start {project_name} with `exec` so it can receive termination signals that are essential for a graceful shutdown.
+
+.Correct approach for an ENTRYPOINT shell script
+[source,bash]
+----
+#!/bin/bash
+
+# (add your custom logic here)
+
+# Run the 'exec' command as the last step of the script.
+# As it replaces the current shell process, no additional shell commands will run after the 'exec' command.
+exec /opt/keycloak/bin/kc.sh start "$@"
+----
+
+[WARNING]
+====
+Without `exec`, the shell script remains PID 1 in the container and blocks signals like `SIGTERM` from reaching {project_name}.
+This prevents a graceful shutdown and can lead to cache inconsistencies or data loss.
+====
+
 === Building the container image
 To build the actual container image, run the following command from the directory containing your Containerfile:
 
@@ -128,6 +150,13 @@ To build the actual container image, run the following command from the director
 podman|docker build . -t mykeycloak
 ----
 
+<@profile.ifProduct>
+[NOTE]
+====
+Podman can be used only for creating or customizing images. Podman is not supported for running {project_name} in production environments.
+====
+</@profile.ifProduct>
+
 === Starting the optimized {project_name} container image
 To start the image, run:
 
@@ -145,6 +174,33 @@ Health check endpoints are available at `https://localhost:9000/health`, `https:
 
 Opening up `https://localhost:9000/metrics` leads to a page containing operational metrics that could be used by your monitoring solution.
 
+=== Known issues with Docker
+
+* If a `RUN dnf install` command seems to be taking an excessive amount of time, then likely your Docker systemd service has the file limit setting `LimitNOFILE` configured incorrectly.
+Either update the service configuration to use a better value, such as 1024000, or directly use `ulimit` in the RUN command:
+
+[source, dockerfile]
+----
+...
+RUN ulimit -n 1024000 && dnf install --installroot ...
+...
+----
+
+* If you are including provider JARs and your container fails a `start --optimized` with a notification that a provider JAR has changed, this is due to Docker truncating
+or otherwise modifying file modification timestamps from what the `build` command recorded to what is seen at runtime.
+  In this case you will need to force the image to use a known timestamp of your choosing with a `touch` command prior to running a `build`:
+
+[source, dockerfile]
+----
+...
+# ADD or copy one or more provider jars
+ADD --chown=keycloak:keycloak --chmod=644 some-jar.jar /opt/keycloak/providers/
+...
+RUN touch -m --date=@1743465600 /opt/keycloak/providers/*
+RUN /opt/keycloak/bin/kc.sh build
+...
+----
+
 == Exposing the container to a different port
 
 By default, the server is listening for `http` and `https` requests using the ports `8080` and `8443`, respectively.
@@ -168,7 +224,7 @@ You use the `start-dev` command:
 
 [source,bash,subs="attributes+"]
 ----
-podman|docker run --name mykeycloak -p 8080:8080 \
+podman|docker run --name mykeycloak -p 127.0.0.1:8080:8080 \
         -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=change_me \
         quay.io/keycloak/keycloak:{containerlabel} \
         start-dev
@@ -187,10 +243,11 @@ For example:
 
 [source,bash,subs="attributes+"]
 ----
-podman|docker run --name mykeycloak -p 8080:8080 \
+podman|docker run --name mykeycloak -p 127.0.0.1:8080:8080 \
         -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=change_me \
         quay.io/keycloak/keycloak:{containerlabel} \
         start \
+        --hostname=localhost --http-enabled=true
         --db=postgres --features=token-exchange \
         --db-url=<JDBC-URL> --db-username=<DB-USER> --db-password=<DB-PASSWORD> \
         --https-key-store-file=<file> --https-key-store-password=<password>
@@ -220,7 +277,7 @@ The {project_name} containers have a directory `/opt/keycloak/data/import`. If y
 
 [source,bash,subs="attributes+"]
 ----
-podman|docker run --name keycloak_unoptimized -p 8080:8080 \
+podman|docker run --name keycloak_unoptimized -p 127.0.0.1:8080:8080 \
         -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=change_me \
         -v /path/to/realm/data:/opt/keycloak/data/import \
         quay.io/keycloak/keycloak:{containerlabel} \
@@ -249,7 +306,7 @@ For example, you can specify the environment variable and memory limit as follow
 
 [source,bash,subs="attributes+"]
 ----
-podman|docker run --name mykeycloak -p 8080:8080 -m 1g \
+podman|docker run --name mykeycloak -p 127.0.0.1:8080:8080 -m 1g \
         -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=change_me \
         -e JAVA_OPTS_KC_HEAP="-XX:MaxHeapFreeRatio=30 -XX:MaxRAMPercentage=65" \
         quay.io/keycloak/keycloak:{containerlabel} \
diff --git a/docs/guides/server/db.adoc b/docs/guides/server/db.adoc
index 51faa046888b..98cd28d85a53 100644
--- a/docs/guides/server/db.adoc
+++ b/docs/guides/server/db.adoc
@@ -6,7 +6,7 @@
 
 <@tmpl.guide
     title="Configuring the database"
-    summary="An overview about how to configure relational databases"
+    summary="Configure a relational database for {project_name} to store user, client, and realm data."
     includedOptions="db db-* transaction-xa-enabled">
 
 This {section} explains how to configure the {project_name} server to store data in a relational database.
@@ -53,15 +53,15 @@ or skip this section if you want to connect to a different database for which th
 
 To install the Oracle Database driver for {project_name}:
 
-. Download the `ojdbc11` and `orai18n` JAR files from one of the following sources:
+. Download the `ojdbc17` and `orai18n` JAR files from one of the following sources:
 
 .. *Zipped JDBC driver and Companion Jars* version ${properties["oracle-jdbc.version"]} from the https://www.oracle.com/database/technologies/appdev/jdbc-downloads.html[Oracle driver download page].
 
-.. Maven Central via `link:++https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc11/${properties["oracle-jdbc.version"]}/ojdbc11-${properties["oracle-jdbc.version"]}.jar++[ojdbc11]` and `link:++https://repo1.maven.org/maven2/com/oracle/database/nls/orai18n/${properties["oracle-jdbc.version"]}/orai18n-${properties["oracle-jdbc.version"]}.jar++[orai18n]`.
+.. Maven Central via `link:++https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc17/${properties["oracle-jdbc.version"]}/ojdbc17-${properties["oracle-jdbc.version"]}.jar++[ojdbc17]` and `link:++https://repo1.maven.org/maven2/com/oracle/database/nls/orai18n/${properties["oracle-jdbc.version"]}/orai18n-${properties["oracle-jdbc.version"]}.jar++[orai18n]`.
 
 .. Installation media recommended by the database vendor for the specific database in use.
 
-. When running the unzipped distribution: Place the `ojdbc11` and `orai18n` JAR files in {project_name}'s `providers` folder
+. When running the unzipped distribution: Place the `ojdbc17` and `orai18n` JAR files in {project_name}'s `providers` folder
 
 . When running containers: Build a custom {project_name} image and add the JARs in the `providers` folder. When building a custom image for the Operator, those images need to be optimized images with all build-time options of {project_name} set.
 +
@@ -70,7 +70,7 @@ A minimal Containerfile to build an image which can be used with the {project_na
 [source,dockerfile,subs="attributes+"]
 ----
 FROM quay.io/keycloak/keycloak:{containerlabel}
-ADD --chown=keycloak:keycloak --chmod=644 https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc11/${properties["oracle-jdbc.version"]}/ojdbc11-${properties["oracle-jdbc.version"]}.jar /opt/keycloak/providers/ojdbc11.jar
+ADD --chown=keycloak:keycloak --chmod=644 https://repo1.maven.org/maven2/com/oracle/database/jdbc/ojdbc17/${properties["oracle-jdbc.version"]}/ojdbc17-${properties["oracle-jdbc.version"]}.jar /opt/keycloak/providers/ojdbc17.jar
 ADD --chown=keycloak:keycloak --chmod=644 https://repo1.maven.org/maven2/com/oracle/database/nls/orai18n/${properties["oracle-jdbc.version"]}/orai18n-${properties["oracle-jdbc.version"]}.jar /opt/keycloak/providers/orai18n.jar
 # Setting the build parameter for the database:
 ENV KC_DB=oracle
@@ -271,6 +271,18 @@ show server_encoding;
 create database keycloak with encoding 'UTF8';
 ----
 
+== Preparing for PostgreSQL
+
+When running PostgreSQL reader and writer instances, {project_name} needs to always connect to the writer instance to do its work.
+When using the original PostgreSQL driver, {project_name} sets the `targetServerType` property of the PostgreSQL JDBC driver to `primary` to ensure that it always connects to a writable primary instance and never connects to a secondary reader instance in failover or switchover scenarios.
+
+You can override this behavior by setting your own value for `targetServerType` in the DB URL or additional properties.
+
+[NOTE]
+====
+The `targetServerType` is only applied automatically to the primary datasource, as requirements might be different for additional datasources.
+====
+
 [[preparing-keycloak-for-amazon-aurora-postgresql]]
 == Preparing for Amazon Aurora PostgreSQL
 
@@ -296,6 +308,8 @@ See the <@links.server id="containers" /> {section} for details on how to build
 `db-url`:: Insert `aws-wrapper` to the regular PostgreSQL JDBC URL resulting in a URL like `+jdbc:aws-wrapper:postgresql://...+`.
 `db-driver`:: Set to `software.amazon.jdbc.Driver` to use the AWS JDBC wrapper.
 
+NOTE: When overriding the `wrapperPlugins` option of the AWS JDBC Driver, always include the `failover` or `failover2` plugin to ensure that {project_name} always connects to the writer instance even in failover or switchover scenarios.
+
 == Preparing for MySQL server
 
 Beginning with MySQL 8.0.30, MySQL supports generated invisible primary keys for any InnoDB table that is created without an explicit primary key (more information https://dev.mysql.com/doc/refman/8.0/en/create-table-gipks.html[here]).
@@ -308,7 +322,7 @@ Because cluster nodes can boot concurrently, they take extra time for database a
 
 The maximum timeout for this lock is 900 seconds. If a node waits on this lock for more than the timeout, the boot fails. The need to change the default value is unlikely, but you can change it by entering this command:
 
-<@kc.start parameters="--spi-dblock-jpa-lock-wait-timeout 900"/>
+<@kc.start parameters="--spi-dblock--jpa--lock-wait-timeout 900"/>
 
 == Using Database Vendors with XA transaction support
 {project_name} uses non-XA transactions and the appropriate database drivers by default.
@@ -330,16 +344,18 @@ NOTE: Enabling XA transactions in a containerized environment does not fully sup
 To setup the JPA migrationStrategy (manual/update/validate) you should setup JPA provider as follows:
 
 .Setting the `migration-strategy` for the `quarkus` provider of the `connections-jpa` SPI
-<@kc.start parameters="--spi-connections-jpa-quarkus-migration-strategy=manual"/>
+<@kc.start parameters="--spi-connections--jpa--quarkus-migration-strategy=manual"/>
 
 If you want to get a SQL file for DB initialization, too, you have to add this additional SPI initializeEmpty (true/false):
 
 .Setting the `initialize-empty` for the `quarkus` provider of the `connections-jpa` SPI
-<@kc.start parameters="--spi-connections-jpa-quarkus-initialize-empty=false"/>
+<@kc.start parameters="--spi-connections--jpa--quarkus-initialize-empty=false"/>
 
 In the same way the migrationExport to point to a specific file and location:
 
 .Setting the `migration-export` for the `quarkus` provider of the `connections-jpa` SPI
-<@kc.start parameters="--spi-connections-jpa-quarkus-migration-export=<path>/<file.sql>"/>
+<@kc.start parameters="--spi-connections--jpa--quarkus-migration-export=<path>/<file.sql>"/>
+
+For more information, check the link:{upgrading_guide_link}#_migrate_db[Migrating the database] documentation.
 
 </@tmpl.guide>
diff --git a/docs/guides/server/directory-structure.adoc b/docs/guides/server/directory-structure.adoc
index 7c6c4006e040..4aa5f26ac2ef 100644
--- a/docs/guides/server/directory-structure.adoc
+++ b/docs/guides/server/directory-structure.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Directory Structure"
-summary="Understand the purpose of the directories under the installation root"
+summary="Understand the purpose of the directories under the installation root."
 includedOptions="">
 
 == Installation Locations
diff --git a/docs/guides/server/enabletls.adoc b/docs/guides/server/enabletls.adoc
index 3286eda3b6aa..875f021733ca 100644
--- a/docs/guides/server/enabletls.adoc
+++ b/docs/guides/server/enabletls.adoc
@@ -1,12 +1,11 @@
 <#import "/templates/guide.adoc" as tmpl>
 <#import "/templates/kc.adoc" as kc>
+<#import "/templates/options.adoc" as opts>
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
 title="Configuring TLS"
-summary="Learn how to configure {project_name}'s https certificates for ingoing and outgoing requests."
-includedOptions="https-* http-enabled"
-excludedOptions="https-trust-store-* https-client-auth https-management-client-auth">
+summary="Configure {project_name}'s https certificates for ingoing and outgoing requests.">
 
 Transport Layer Security (short: TLS) is crucial to exchange data over a secured channel.
 For production environments, you should never expose {project_name} endpoints through HTTP, as sensitive data is at the core of what {project_name} exchanges with other applications.
@@ -64,4 +63,11 @@ To also allow TLSv1.2, use a command such as the following: `kc.sh start --https
 By default {project_name} will reload the certificates, keys, and keystores specified in `+https-*+` options every hour. For environments where your server keys may need frequent rotation, this allows that to happen without a server restart. You may override the default via the `https-certificates-reload-period` option. Interval on which to reload key store, trust store, and certificate files referenced by `+https-*+` options.
 The value may be a java.time.Duration value, an integer number of seconds, or an integer followed by one of the time units [`ms`, `h`, `m`, `s`, `d`]. Must be greater than 30 seconds. Use `-1` to disable.
 
+<@opts.printRelevantOptions includedOptions="https-* http-enabled" excludedOptions="https-trust-store-* https-client-auth https-management-* https-management-client-auth">
+
+=== Management server
+<@opts.includeOptions includedOptions="https-management-*" excludedOptions="https-management-client-auth"/>
+
+</@opts.printRelevantOptions>
+
 </@tmpl.guide>
diff --git a/docs/guides/server/features.adoc b/docs/guides/server/features.adoc
index 5f1029915dbf..94f11b0589d8 100644
--- a/docs/guides/server/features.adoc
+++ b/docs/guides/server/features.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Enabling and disabling features"
-summary="Understand how to configure {project_name} to use optional features"
+summary="Configure {project_name} to use optional features."
 includedOptions="features features-*">
 
 {project_name} has packed some functionality in features, including some disabled features, such as Technology Preview and deprecated features. Other features are enabled by default, but you can disable them if they do not apply to your use of {project_name}.
@@ -24,11 +24,11 @@ To enable all preview features, enter this command:
 
 Enabled feature may be versioned, or unversioned.  If you use a versioned feature name, e.g. feature:v1, that exact feature version will be enabled as long as it still exists in the runtime.  If you instead use an unversioned name, e.g. just feature, the selection of the particular supported feature version may change from release to release according to the following precedence:
 
-1. The highest default supported version
-1. The highest non-default supported version
-1. The highest deprecated version
-1. The highest preview version
-1. The highest experimental version
+. The highest default supported version
+. The highest non-default supported version
+. The highest deprecated version
+. The highest preview version
+. The highest experimental version
 
 == Disabling features
 
@@ -81,7 +81,7 @@ There are no deprecated features in this {project_name} release.
 
 <#macro showFeatures features>
 <#list features as feature>
-[.features-name]#${feature.name}#::
+[.features-name]#${feature.versionedKey}#::
 [.features-description]#${feature.description}#
 </#list>
-</#macro>
\ No newline at end of file
+</#macro>
diff --git a/docs/guides/server/fips.adoc b/docs/guides/server/fips.adoc
index 2427c85d296d..a2504216cbd7 100644
--- a/docs/guides/server/fips.adoc
+++ b/docs/guides/server/fips.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="FIPS 140-2 support"
-summary="How to configure {project_name} server for FIPS compliance"
+summary="Configure {project_name} server for FIPS compliance."
 includedOptions="">
 
 The Federal Information Processing Standard Publication 140-2, (FIPS 140-2), is a U.S. government computer security standard used to approve cryptographic modules. {project_name} supports running in FIPS 140-2 compliant mode. In this case, {project_name} will use only FIPS approved cryptography algorithms for its functionality.
@@ -31,7 +31,7 @@ fips-mode-setup --enable
 == BouncyCastle library
 
 {project_name} internally uses the BouncyCastle library for many cryptography utilities. Please note that the default version of the BouncyCastle library that shipped with {project_name} is not FIPS compliant;
-however,  BouncyCastle also provides a FIPS validated version of its library. The FIPS validated BouncyCastle library cannot be shipped with {project_name} due to license constraints and
+however,  BouncyCastle also provides a FIPS validated version of its library. The FIPS validated BouncyCastle library is not shipped with {project_name} as 
 {project_name} cannot provide official support of it. Therefore, to run in FIPS compliant mode, you need to download BouncyCastle-FIPS bits and add them to the {project_name} distribution.
 When {project_name} executes in fips mode, it will use the BCFIPS bits instead of the default BouncyCastle bits, which achieves FIPS compliance.
 
@@ -118,7 +118,14 @@ Using that option results in stricter security requirements on cryptography and
 NOTE: In strict mode, the default keystore type (as well as default truststore type) is BCFKS. If you want to use a different keystore type
 it is required to use the option `--https-key-store-type` with appropriate type. A similar command might be needed for the truststore as well if you want to use it.
 
-When starting the server, you can check that the startup log contains `KC` provider with the note about `Approved Mode` such as the following:
+When starting the server, you can include TRACE level in the startup command. For example:
+
+[source,bash,subs=+attributes]
+----
+--log-level=INFO,org.keycloak.common.crypto.CryptoIntegration:TRACE
+----
+
+By using TRACE level, you can check that the startup log contains `KC` provider with the note about `Approved Mode` such as the following:
 
 [source]
 ----
@@ -138,14 +145,14 @@ So effectively, you can use an option such as the following when starting the se
 
 [source]
 ----
---spi-password-hashing-pbkdf2-sha512-max-padding-length=14
+--spi-password-hashing--pbkdf2-sha512--max-padding-length=14
 ----
 
 NOTE: Using the option above does not break FIPS compliance. However, note that longer passwords are good practice anyway. For example, passwords auto-generated by modern browsers match this
 requirement as they are longer than 14 characters. If you want to omit the option for max-padding-length, you can set the password policy to your realms to have passwords at least 14 characters long.
 
 NOTE: When you are migrating from {project_name} older than 24, or if you explicitly set the password policy to override the default hashing algorithm, it is possible that some of your users use an older
-algorithm like `pbkdf2-sha256`. In this case, consider adding  the `--spi-password-hashing-pbkdf2-sha256-max-padding-length=14` option to ensure that users having their passwords hashed with
+algorithm like `pbkdf2-sha256`. In this case, consider adding  the `+--spi-password-hashing--pbkdf2-sha256--max-padding-length=14+` option to ensure that users having their passwords hashed with
 the older `pbkdf2-sha256` can log in because their passwords may be shorter than 14 characters.
 
 * RSA keys of 1024 bits do not work (2048 is the minimum). This applies for keys used by the {project_name} realm itself (Realm keys from the `Keys` tab in the admin console), but also client keys and IDP keys
diff --git a/docs/guides/server/hostname.adoc b/docs/guides/server/hostname.adoc
index e214375e0ba1..92be53e57171 100644
--- a/docs/guides/server/hostname.adoc
+++ b/docs/guides/server/hostname.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring the hostname (v2)"
-summary="Learn how to configure the frontend and backchannel endpoints exposed by {project_name}."
+summary="Configure the frontend and backchannel endpoints exposed by {project_name}."
 includedOptions="hostname hostname-* proxy"
 deniedCategories="hostname_v1">
 
@@ -152,7 +152,7 @@ As indicated in the previous sections, URLs can be resolved in several ways: the
 ** `hostname-backchannel-dynamic` must be set to false.
 ** `hostname-strict` must be set to false.
 * If `hostname-admin` is configured, `hostname` must be set to a URL (not just hostname). Otherwise {project_name} would not know what is the correct frontend URL (incl. port etc.) when accessing the Admin Console.
-* If `hostname-backchannel-dynamic` is set to true, `hostname` must be set to a URL (not just hostname). Otherwise {project_name} would not know what is the correct frontend URL (incl. port etc.) when being access via the dynamically resolved bachchannel.
+* If `hostname-backchannel-dynamic` is set to true, `hostname` must be set to a URL (not just hostname). Otherwise {project_name} would not know what is the correct frontend URL (incl. port etc.) when being access via the dynamically resolved backchannel.
 
 Additionally if hostname is configured, then hostname-strict is ignored.
 
diff --git a/docs/guides/server/importExport.adoc b/docs/guides/server/importExport.adoc
index 6d535baed04e..965fde242fc6 100644
--- a/docs/guides/server/importExport.adoc
+++ b/docs/guides/server/importExport.adoc
@@ -3,21 +3,20 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-    title="Importing and Exporting Realms"
-    summary="An overview about how to import and export realms">
+    title="Importing and exporting realms"
+    summary="Import and export realms as JSON files.">
 
 In this {section}, you are going to understand the different approaches for importing and exporting realms using JSON files.
 
 [NOTE]
 ====
-Exporting and importing into single files can produce large files, so if your database contains more than 500 users, export to a directory and not a single file.
-Using a directory performs better as the directory provider uses a separate transaction for each "page" (a file of users).
-The default count of users per file and per transaction is fifty.
-Increasing this to a larger number leads to an exponentially increasing execution time.
-====
+Exporting and importing into single files can produce large files which may run the export / import process out of memory. If your database contains more than 50,000 users, export to a directory and not a single file.
+The default count of users per file and per transaction is fifty, but you may use a much larger value if desired.
+
+The `import` and `export` commands are essentially server launches that exit before bringing up the full server. They are not currently designed to be run from the same machine as a running server instance, which may result in port or other conflicts.
 
-All {project_name} nodes need to be stopped prior to using `kc.[sh|bat] import | export` commands. This ensures that the resulting operations will have no consistency issues with concurrent requests.
-It also ensures that running an import or export command from the same machine as a server instance will not result in port or other conflicts.
+It is recommended that all {project_name} nodes are stopped prior to using the `kc.[sh|bat] export` command. This ensures that the results will have no consistency issues with user or realm modifications during the export.
+====
 
 == Providing options for database connection parameters
 
@@ -31,7 +30,7 @@ As default, {project_name} will re-build automatically for the `export` and `imp
 If you have built an optimized version of {project_name} with the `build` command as outlined in <@links.server id="configuration"/>, use the command line option `--optimized` to have {project_name} skip the build check for a faster startup time.
 When doing this, remove the build time options from the command line and keep only the runtime options.
 
-NOTE: if you do not use `--optimized` keep in mind that an `import` or `export` command will implicitly create or update an optimized image for you - if you are running the command from the same machine as a server instance, this may impact the next start of your server.
+NOTE: if you do not use `--optimized` keep in mind that an `import` or `export` command may implicitly create or update an optimized build for you - if you are running the command from the same machine as a server instance, this may impact the next start of your server.
 
 == Exporting a Realm to a Directory
 
@@ -76,6 +75,12 @@ If you do not specify a specific realm to export, all realms are exported. To ex
 
 <@kc.export parameters="[--dir|--file] <path> --realm my-realm"/>
 
+== Import File Naming Conventions
+
+When you export a realm specific file name conventions are used, which must also be used for importing from a directory or import at startup. The realm file to be imported must be named <realm name>-realm.json. 
+Regular and federated user files associated with a realm must be named <realm-name>-users-<file number>.json and <realm-name>-federated-users-<file number>.json. Failure to use this convention will result in errors or 
+user files not being imported.
+
 == Importing a Realm from a Directory
 
 To import a realm, you can use the `import` command. Your {project_name} server instance must not be started when invoking this command.
diff --git a/docs/guides/server/keycloak-truststore.adoc b/docs/guides/server/keycloak-truststore.adoc
index 2064a3eaaa23..17c16daf8519 100644
--- a/docs/guides/server/keycloak-truststore.adoc
+++ b/docs/guides/server/keycloak-truststore.adoc
@@ -3,7 +3,7 @@
 
 <@tmpl.guide
 title="Configuring trusted certificates"
-summary="How to configure the {project_name} Truststore to communicate through TLS."
+summary="Configure the {project_name} Truststore to communicate through TLS."
 includedOptions="truststore-paths tls-hostname-verifier">
 
 When {project_name} communicates with external services or has an incoming connection through TLS, it has to validate the remote certificate in order to ensure it is connecting to a trusted server. This is necessary in order to prevent man-in-the-middle attacks.
@@ -29,7 +29,7 @@ It is still possible to directly set your own `javax.net.ssl` truststore System
 You may refine how hostnames are verified by TLS connections with the `tls-hostname-verifier` property.
 
 * `DEFAULT` (the default) allows wildcards in subdomain names (e.g. *.foo.com) to match names with the same number of levels (e.g. a.foo.com, but not a.b.foo.com) - with rules and exclusions for public suffixes based upon https://publicsuffix.org/list/
-* `ANY` means that the hostname is not verified.
+* `ANY` means that the hostname is not verified - this mode should not be used in production.
 * `WILDCARD` (deprecated) allows wildcards in subdomain names (e.g. *.foo.com) to match anything, including multiple levels (e.g. a.b.foo.com). Use DEFAULT instead.
 * `STRICT` (deprecated) allows wildcards in subdomain names (e.g. *.foo.com) to match names with the same number of levels (e.g. a.foo.com, but not a.b.foo.com) - with some limited exclusions. Use DEFAULT instead.
 +
diff --git a/docs/guides/server/logging.adoc b/docs/guides/server/logging.adoc
index 76a2df095896..57c396974d7e 100644
--- a/docs/guides/server/logging.adoc
+++ b/docs/guides/server/logging.adoc
@@ -6,8 +6,7 @@
 
 <@tmpl.guide
 title="Configuring logging"
-summary="Learn how to configure Logging"
-includedOptions="log log-*">
+summary="Configure logging for {project_name}.">
 
 {project_name} uses the JBoss Logging framework.
 The following is a high-level overview for the available log handlers with the common parent log handler `root`:
@@ -99,7 +98,7 @@ The available handlers are:
 
 The more specific handler configuration mentioned below will only take effect when the handler is added to this comma-separated list.
 
-== Specify log level for each handler
+=== Specify log level for each handler
 
 The `log-level` property specifies the global root log level and levels for selected categories.
 However, a more fine-grained approach for log levels is necessary to comply with the modern application requirements.
@@ -118,7 +117,7 @@ More information in log handlers settings below.
 Only log levels specified in <<Log levels>> section are accepted, and *must be in lowercase*.
 There is no support for specifying particular categories for log handlers yet.
 
-=== General principle
+==== General principle
 
 It is necessary to understand that setting the log levels for each particular handler *does not override the root level* specified in the `log-level` property.
 Log handlers respect the root log level, which represents the maximal verbosity for the whole logging system.
@@ -128,7 +127,7 @@ Specifically, when an arbitrary log level is defined for the handler, it does no
 In that case, the root `log-level` must also be assessed.
 Log handler levels provide the *restriction for the root log level*, and the default log level for log handlers is `all` - without any restriction.
 
-=== Examples
+==== Examples
 
 .Example: `debug` for file handler, but `info` for console handler:
 <@kc.start parameters="--log=console,file --log-level=debug --log-console-level=info"/>
@@ -146,6 +145,88 @@ The root level must be set to the most verbose required level (`debug` in this c
 
 In order to see the `org.keycloak.events:trace`, the `trace` level must be set for the Syslog handler.
 
+=== Use different JSON format for log handlers
+Every log handler provides the ability to have structured log output in JSON format.
+It can be enabled by properties in the format `log-<handler>-output=json` (where `<handler>` is a log handler).
+
+If you need a different format of the produced JSON, you can leverage the following JSON output formats:
+
+* `default` (default)
+* `ecs`
+
+The `ecs` value refers to the https://www.elastic.co/guide/en/ecs-logging/overview/current/intro.html[ECS] (Elastic Common Schema).
+
+ECS is an open-source, community-driven specification that defines a common set of fields to be used with Elastic solutions.
+The ECS specification is being converged with https://opentelemetry.io/docs/concepts/semantic-conventions/[OpenTelemetry Semantic Conventions] with the goal of creating a single standard maintained by OpenTelemetry.
+
+In order to change the JSON output format, properties in the format `log-<handler>-json-format` (where `<handler>` is a log handler) were introduced:
+
+* `log-console-json-format` - Console log handler
+* `log-file-json-format` - File log handler
+* `log-syslog-json-format` - Syslog log handler
+
+==== Example
+If you want to have JSON logs in *ECS* (Elastic Common Schema) format for the console log handler, you can enter the following command:
+
+<@kc.start parameters="--log-console-output=json --log-console-json-format=ecs"/>
+
+.Example Log Message
+[source,json]
+----
+{"@timestamp":"2025-02-03T14:53:22.539484211+01:00","event.sequence":9608,"log.logger":"io.quarkus","log.level":"INFO","message":"Keycloak 999.0.0-SNAPSHOT on JVM (powered by Quarkus 3.17.8) started in 4.615s. Listening on: http://0.0.0.0:8080","process.thread.name":"main","process.thread.id":1,"mdc":{},"ndc":"","host.hostname":"host-name","process.name":"/usr/lib/jvm/jdk-21.0.3+9/bin/java","process.pid":77561,"data_stream.type":"logs","ecs.version":"1.12.2","service.environment":"prod","service.name":"Keycloak","service.version":"999.0.0-SNAPSHOT"}
+----
+
+=== Asynchronous logging
+{project_name} supports asynchronous logging, which might be useful for deployments requiring **high throughput** and **low latency**.
+Asynchronous logging uses a separate thread to take care of processing all log records.
+The logging handlers are invoked in exactly the same way as with synchronous logging, only done in separate threads.
+You can enable asynchronous logging for all {project_name} log handlers.
+A dedicated thread will be created for every log handler with enabled asynchronous logging.
+
+The underlying mechanism for asynchronous logging uses a queue for processing log records.
+Every new log record is added to the queue and then published to the particular log handler with enabled asynchronous logging.
+Every log handler has a different queue.
+
+If the queue is already full, it blocks the main thread and waits for free space in the queue.
+
+==== When to use asynchronous logging
+
+* You need **lower latencies** for incoming requests
+* You need **higher throughput**
+* You have **small worker thread pool** and want to offload logging to separate threads
+* You want to reduce the impact of **I/O-heavy log handlers**
+* You are logging to **remote destinations** (e.g., network syslog servers) and want to avoid blocking worker threads
+
+WARNING: Be aware that enabling asynchronous logging might bring some **additional memory overhead** due to the additional separate thread and the inner queue.
+In that case, it is not recommended to use it for resource-constrained environments.
+Additionally, unexpected server shutdowns create a risk of **losing log records**.
+
+==== Enable asynchronous logging
+You can enable asynchronous logging globally for all log handlers by using `log-async` property as follows:
+
+<@kc.start parameters="--log-async=true"/>
+
+Or you can enable the asynchronous logging for every specific handler by using properties in the format `log-<handler>-async` (where `<handler>` is a log handler).
+If the property for a specific handler is not set, the value from the parent `log-async` property is used.
+
+You can use these properties as follows:
+
+<@kc.start parameters="--log-console-async=true --log-file-async=true --log-syslog-async=true"/>
+
+* `log-console-async` - Console log handler
+* `log-file-async` - File log handler
+* `log-syslog-async` - Syslog log handler
+
+==== Change queue length
+You can change the size of the queue used for the asynchronous logging.
+The default size is **512** log records in the queue.
+
+You can change the queue length as follows:
+
+<@kc.start parameters="--log-console-async-queue-length=512 --log-file-async-queue-length=512 --log-syslog-async-queue-length=512"/>
+
+These properties are available only when asynchronous logging is enabled for these specific log handlers.
+
 == Console log handler
 The console log handler is enabled by default, providing unstructured log messages for the console.
 
@@ -204,7 +285,7 @@ By default, the console log handler logs plain unstructured data to the console.
 .Example Log Message
 [source, json]
 ----
-{"timestamp":"2022-02-25T10:31:32.452+01:00","sequence":8442,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus","level":"INFO","message":"Keycloak 18.0.0-SNAPSHOT on JVM (powered by Quarkus 2.7.2.Final) started in 3.253s. Listening on: http://0.0.0.0:8080","threadName":"main","threadId":1,"mdc":{},"ndc":"","hostName":"host-name","processName":"QuarkusEntryPoint","processId":36946}
+{"timestamp":"2025-02-03T14:52:20.290353085+01:00","sequence":9605,"loggerClassName":"org.jboss.logging.Logger","loggerName":"io.quarkus","level":"INFO","message":"Keycloak 999.0.0-SNAPSHOT on JVM (powered by Quarkus 3.17.8) started in 4.440s. Listening on: http://0.0.0.0:8080","threadName":"main","threadId":1,"mdc":{},"ndc":"","hostName":"host-name","processName":"/usr/lib/jvm/jdk-21.0.3+9/bin/java","processId":76944}
 ----
 
 When using JSON output, colors are disabled and the format settings set by `--log-console-format` will not apply.
@@ -216,7 +297,7 @@ To use unstructured logging, enter the following command:
 .Example Log Message
 [source]
 ----
-2022-03-02 10:36:50,603 INFO  [io.quarkus] (main) Keycloak 18.0.0-SNAPSHOT on JVM (powered by Quarkus 2.7.2.Final) started in 3.615s. Listening on: http://0.0.0.0:8080
+2025-02-03 14:53:56,653 INFO  [io.quarkus] (main) Keycloak 999.0.0-SNAPSHOT on JVM (powered by Quarkus 3.17.8) started in 4.795s. Listening on: http://0.0.0.0:8080
 ----
 
 === Colors
@@ -308,6 +389,23 @@ To use UDP instead of TCP, add the `--log-syslog-protocol` option as follows:
 
 The available protocols are: `tpc`, `udp`, and `ssl-tcp`.
 
+=== Configuring the Syslog counting framing
+
+By default, Syslog messages sent over TCP or SSL-TCP are prefixed with the message size, as required by certain Syslog receivers.
+This behavior is controlled by the `--log-syslog-counting-framing` option.
+
+To explicitly enable or disable this feature, use the following command:
+
+<@kc.start parameters="--log-syslog-counting-framing=true"/>
+
+You can set the value to one of the following:
+
+* `protocol-dependent` (default) – Enable counting framing only when the `log-syslog-protocol` is `tcp` or `ssl-tcp`.
+* `true` – Always enable counting framing by prefixing messages with their size.
+* `false` – Never use counting framing.
+
+Note that using `protocol-dependent` ensures compatibility with most Syslog servers by enabling the prefix only when required by the protocol.
+
 === Configuring the Syslog log format
 To set the logging format for a logged line, perform these steps:
 
@@ -376,4 +474,17 @@ To use unstructured logging, enter the following command:
 
 As you can see, the timestamp is present twice, so you can amend it correspondingly via the `--log-syslog-format` property.
 
+<@opts.printRelevantOptions includedOptions="log log-*" excludedOptions="log-console-* log-file log-file-* log-syslog-*">
+
+=== Console
+<@opts.includeOptions includedOptions="log-console-*"/>
+
+=== File
+<@opts.includeOptions includedOptions="log-file log-file-*"/>
+
+=== Syslog
+<@opts.includeOptions includedOptions="log-syslog-*"/>
+
+</@opts.printRelevantOptions>
+
 </@tmpl.guide>
diff --git a/docs/guides/server/management-interface.adoc b/docs/guides/server/management-interface.adoc
index 5fd706592fea..8ee7815284c6 100644
--- a/docs/guides/server/management-interface.adoc
+++ b/docs/guides/server/management-interface.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring the Management Interface"
-summary="Learn how to configure {project_name}'s management interface for endpoints like metrics and health checks."
+summary="Configure {project_name}'s management interface for endpoints such as metrics and health checks."
 includedOptions="http-management-* https-management-* legacy-observability-interface">
 
 The management interface allows accessing management endpoints via a different HTTP server than the primary one.
@@ -36,9 +36,11 @@ if you set the CLI option `--http-relative-path=/auth`, these endpoints are acce
 
 === TLS support
 
-When the TLS is set for the default {project_name} server, the management interface will be accessible through HTTPS as well.
+When the TLS is set for the default {project_name} server, by default the management interface will be accessible through HTTPS as well.
 The management interface can run only either on HTTP or HTTPS, not both as for the main server.
 
+NOTE: If you do not want the management interface to use HTTPS, you may set the `http-management-scheme` option to `http`.
+
 Specific {project_name} management interface options with the prefix `https-management-*` were provided for setting different TLS parameters for the management HTTP server. Their function is similar to their counterparts for the main HTTP server, for details see <@links.server id="enabletls" />.
 When these options are not explicitly set, the TLS parameters are inherited from the default HTTP server.
 
diff --git a/docs/guides/server/mutual-tls.adoc b/docs/guides/server/mutual-tls.adoc
index 933e6011ee73..5f3f48296fdd 100644
--- a/docs/guides/server/mutual-tls.adoc
+++ b/docs/guides/server/mutual-tls.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring trusted certificates for mTLS"
-summary="Learn how to configure Mutual TLS to verify clients that are connecting to {project_name}."
+summary="Configure Mutual TLS to verify clients that are connecting to {project_name}."
 includedOptions="https-trust-store-* https-client-auth https-management-client-auth">
 
 In order to properly validate client certificates and enable certain authentication methods like two-way TLS or mTLS, you can set
diff --git a/docs/guides/server/outgoinghttp.adoc b/docs/guides/server/outgoinghttp.adoc
index e68105738af1..f7642c0ce4c3 100644
--- a/docs/guides/server/outgoinghttp.adoc
+++ b/docs/guides/server/outgoinghttp.adoc
@@ -4,7 +4,7 @@
 
 <@tmpl.guide
 title="Configuring outgoing HTTP requests"
-summary="How to configure the client used for outgoing HTTP requests."
+summary="Configure the client used for outgoing HTTP requests."
 includedOptions="truststore-*">
 
 {project_name} often needs to make requests to the applications and services that it secures. {project_name} manages these outgoing connections using an HTTP client. This {section} shows how to configure the client, connection pool, proxy environment settings, timeouts, and more.
@@ -17,7 +17,7 @@ to configure a {project_name} Truststore so that {project_name} is able to perfo
 == Client Configuration Command
 The HTTP client that {project_name} uses for outgoing communication is highly configurable. To configure the {project_name} outgoing HTTP client, enter this command:
 
-<@kc.start parameters="--spi-connections-http-client-default-<configurationoption>=<value>"/>
+<@kc.start parameters="--spi-connections-http-client--default--<configurationoption>=<value>"/>
 
 The following are the command options:
 
@@ -90,7 +90,7 @@ For example, consider the following regex:
 
 You apply a regex-based hostname pattern by entering this command:
 
-<@kc.start parameters="--spi-connections-http-client-default-proxy-mappings=\'.*\\\\.(google|googleapis)\\\\.com;http://www-proxy.acme.com:8080\'"/>
+<@kc.start parameters="--spi-connections-http-client--default--proxy-mappings=\'.*\\\\.(google|googleapis)\\\\.com;http://www-proxy.acme.com:8080\'"/>
 
 The backslash character `\` is escaped again because micro-profile config is used to parse the array of mappings.
 
diff --git a/docs/guides/server/pinned-guides b/docs/guides/server/pinned-guides
index ad50f334494e..da8503aaffb2 100644
--- a/docs/guides/server/pinned-guides
+++ b/docs/guides/server/pinned-guides
@@ -19,4 +19,5 @@ management-interface
 importExport
 vault
 all-config
-all-provider-config
\ No newline at end of file
+all-provider-config
+update-compatibility
\ No newline at end of file
diff --git a/docs/guides/server/reverseproxy.adoc b/docs/guides/server/reverseproxy.adoc
index 4d47306cdece..71978efa1be7 100644
--- a/docs/guides/server/reverseproxy.adoc
+++ b/docs/guides/server/reverseproxy.adoc
@@ -4,8 +4,8 @@
 <#import "/templates/links.adoc" as links>
 
 <@tmpl.guide
-title="Using a reverse proxy"
-summary="Learn how to configure {project_name} together with a reverse proxy, api gateway, or load balancer."
+title="Configuring a reverse proxy"
+summary="Configure {project_name} with a reverse proxy, API gateway, or load balancer."
 includedOptions="proxy-* hostname hostname-admin http-relative-path">
 
 Distributed environments frequently require the use of a reverse proxy. {project_name} offers several options to securely integrate with such environments.
@@ -22,13 +22,13 @@ The port `8443` (or `8080` if HTTP is enabled) is used for the Admin UI, Account
 
 The port `9000` is used for management, which includes endpoints for health checks and metrics as described in the  <@links.server id="management-interface"/> {section}.
 
-You only need to proxy port `8443` (or `8080`) even when you use different host names for frontend/backend and administration as described at <@links.server id="configure-production"/>. You should not proxy port `9000` as health checks and metrics use those ports directly, and you do not want to expose this information to external callers.
+You only need to proxy port `8443` (or `8080`) even when you use different host names for frontend/backend and administration as described at <@links.server id="configuration-production"/>. You should not proxy port `9000` as health checks and metrics use those ports directly, and you do not want to expose this information to external callers.
 
 == Configure the reverse proxy headers
 
 {project_name} will parse the reverse proxy headers based on the `proxy-headers` option which accepts several values:
 
-* By default if the option is not specified, no reverse proxy headers are parsed.
+* By default if the option is not specified, no reverse proxy headers are parsed. This should be used when no proxy is in use or with https passthrough.
 * `forwarded` enables parsing of the `Forwarded` header as per https://www.rfc-editor.org/rfc/rfc7239.html[RFC7239].
 * `xforwarded` enables parsing of non-standard `X-Forwarded-*` headers, such as `X-Forwarded-For`, `X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-Port`.
 
@@ -38,7 +38,7 @@ For example:
 
 <@kc.start parameters="--proxy-headers forwarded"/>
 
-WARNING: If either `forwarded` or `xforwarded` is selected, make sure your reverse proxy properly sets and overwrites the `Forwarded` or `X-Forwarded-*` headers respectively. To set these headers, consult the documentation for your reverse proxy. Misconfiguration will leave {project_name} exposed to security vulnerabilities.
+WARNING: If either `forwarded` or `xforwarded` is selected, make sure your reverse proxy properly sets and overwrites the `Forwarded` or `X-Forwarded-*` headers respectively. To set these headers, consult the documentation for your reverse proxy. Do not use `forwarded` or `xforwarded` with https passthrough. Misconfiguration will leave {project_name} exposed to security vulnerabilities.
 
 Take extra precautions to ensure that the client address is properly set by your reverse proxy via the `Forwarded` or `X-Forwarded-For` headers.
 If this header is incorrectly configured, rogue clients can set this header and trick {project_name} into thinking the client is connected from a different IP address than the actual address. This precaution can be more critical if you do any deny or allow listing of IP addresses.
@@ -84,12 +84,12 @@ From this point, it is beneficial if load balancer forwards all the next request
 
 The sticky session is not mandatory for the cluster setup, however it is good for performance for the reasons mentioned above. You need to configure your loadbalancer to stick over the AUTH_SESSION_ID cookie. The appropriate procedure to make this change depends on your loadbalancer.
 
-If your proxy supports session affinity without processing cookies from backend nodes, you should set the `spi-sticky-session-encoder-infinispan-should-attach-route` option
+If your proxy supports session affinity without processing cookies from backend nodes, you should set the `+spi-sticky-session-encoder--infinispan--should-attach-route+` option
 to `false` in order to avoid attaching the node to cookies and just rely on the reverse proxy capabilities.
 
-<@kc.start parameters="--spi-sticky-session-encoder-infinispan-should-attach-route=false"/>
+<@kc.start parameters="--spi-sticky-session-encoder--infinispan--should-attach-route=false"/>
 
-By default, the `spi-sticky-session-encoder-infinispan-should-attach-route` option value is `true` so that the node name is attached to
+By default, the `+spi-sticky-session-encoder--infinispan--should-attach-route+` option value is `true` so that the node name is attached to
 cookies to indicate to the reverse proxy the node that subsequent requests should be sent to.
 
 == Exposed path recommendations
@@ -146,7 +146,7 @@ For example:
 
 == PROXY Protocol
 
-The `proxy-protocol-enabled` option controls whether the server should use the HA PROXY protocol when serving requests from behind a proxy. When set to true, the remote address returned will be the one from the actual connecting client.
+The `proxy-protocol-enabled` option controls whether the server should use the HA PROXY protocol when serving requests from behind a proxy. When set to true, the remote address returned will be the one from the actual connecting client. The value cannot be `true` when using the `proxy-headers` option.
 
 This is useful when running behind a compatible https passthrough proxy because the request headers cannot be manipulated.
 
@@ -169,10 +169,9 @@ Client certificate lookup via a proxy header for X.509 authentication is conside
   and edge TLS termination.
 * If passthrough is not an option, implement the following security measures:
 ** Configure your network so that {project_name} is isolated and can accept connections only from the proxy.
-** Make sure that the proxy overwrites the header that is configured in `spi-x509cert-lookup-<provider>-ssl-client-cert` option.
-** Keep in mind that any of the `spi-x509cert-*` options don't reflect the `proxy-trusted-addresses` option.
-** Pay extra attention to the `spi-x509cert-lookup-<provider>-trust-proxy-verification` setting. Make sure you enable it only if you can trust your proxy to verify the client certificate.
-   Setting `spi-x509cert-lookup-<provider>-trust-proxy-verification=true` without the proxy verifying the client certificate chain will expose {project_name} to security vulnerability
+** Make sure that the proxy overwrites the header that is configured in `spi-x509cert-lookup--<provider>--ssl-client-cert` option.
+** Pay extra attention to the `spi-x509cert-lookup--<provider>--trust-proxy-verification` setting. Make sure you enable it only if you can trust your proxy to verify the client certificate.
+   Setting `spi-x509cert-lookup--<provider>--trust-proxy-verification=true` without the proxy verifying the client certificate chain will expose {project_name} to security vulnerability
    when a forged client certificate can be used for authentication.
 ====
 
@@ -195,10 +194,10 @@ The server supports some of the most commons TLS termination proxies such as:
 To configure how client certificates are retrieved from the requests you need to:
 
 .Enable the corresponding proxy provider
-<@kc.build parameters="--spi-x509cert-lookup-provider=<provider>"/>
+<@kc.build parameters="--spi-x509cert-lookup--provider=<provider>"/>
 
 .Configure the HTTP headers
-<@kc.start parameters="--spi-x509cert-lookup-<provider>-ssl-client-cert=SSL_CLIENT_CERT --spi-x509cert-lookup-<provider>-ssl-cert-chain-prefix=CERT_CHAIN --spi-x509cert-lookup-<provider>-certificate-chain-length=10"/>
+<@kc.start parameters="--spi-x509cert-lookup--<provider>--ssl-client-cert=SSL_CLIENT_CERT --spi-x509cert-lookup--<provider>--ssl-cert-chain-prefix=CERT_CHAIN --spi-x509cert-lookup--<provider>-certificate-chain-length=10"/>
 
 When configuring the HTTP headers, you need to make sure the values you are using correspond to the name of the headers
 forwarded by the proxy with the client certificate information.
@@ -222,6 +221,9 @@ to load additional certificates from headers `CERT_CHAIN_0` to `CERT_CHAIN_9` if
 
 |trust-proxy-verification
 | Enable trusting NGINX proxy certificate verification, instead of forwarding the certificate to {project_name} and verifying it in {project_name}.
+
+|cert-is-url-encoded
+| Whether the forwarded certificate is url-encoded or not. In NGINX, this corresponds to the `$ssl_client_cert` and `$ssl_client_escaped_cert` variables. This can also be used for the Traefik PassTlsClientCert middleware, as it sends the client certficate unencoded.
 |===
 
 === Configuring the NGINX provider
diff --git a/docs/guides/server/update-compatibility.adoc b/docs/guides/server/update-compatibility.adoc
new file mode 100644
index 000000000000..2913be824455
--- /dev/null
+++ b/docs/guides/server/update-compatibility.adoc
@@ -0,0 +1,179 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/kc.adoc" as kc>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Checking if rolling updates are possible"
+summary="Execute the update compatibility command to check if {project_name} supports a rolling update for a change in your deployment."
+>
+
+Use the update compatibility command to determine if you can update your deployment with a rolling update strategy when enabling or disabling features or changing the {project_name} version, configurations or providers and themes.
+The outcome shows whether a rolling update is possible or if a recreate update is required.
+
+In its current version, it shows that a rolling update is possible when the {project_name} version is the same for the old and the new version.
+Future versions of {project_name} might change that behavior to use additional information from the configuration, the image and the version to determine if a rolling update is possible.
+
+[NOTE]
+====
+In the next iteration of this feature, it is possible to use rolling update strategy also when updating to the following patch release of {project_name}.
+Refer to <<rolling-updates-for-patch-releases>> section for more details.
+====
+
+This is fully scriptable, so your update procedure can use that information to perform a rolling or recreate strategy depending on the change performed.
+It is also GitOps friendly, as it allows storing the metadata of the previous configuration in a file. Use  this file in a CI/CD pipeline with the new configuration to determine if a rolling update is possible or if a recreate update is needed.
+
+If you are using the {project_name} Operator, continue to the <@links.operator id="rolling-updates" /> {section} and the `Auto` strategy for more information.
+
+== Supported update strategies
+
+Rolling Update::
+In this guide, a rolling update is an update that can be performed with zero downtime for your deployment, which consists of at least two nodes.
+Update your {project_name} one by one; shut down one of your old deployment nodes and start a new deployment node.
+Wait until the new node's start-up probe returns success before proceeding to the next {project_name} node. See {section} <@links.observability id="health"/> for details on how to enable and use the start-up probe.
+
+Recreate Update::
+A recreate update is not compatible with zero-downtime and requires downtime to be applied.
+Shut down all nodes of the cluster running the old version before starting the nodes with the new version.
+
+== Determining the update strategy for an updated configuration
+
+To determine if a rolling update is possible:
+
+1. Run the update compatibility command to generate the required metadata with the old configuration.
+2. Check the metadata with the new configuration to determine the update strategy.
+
+NOTE: If you do not use `--optimized` keep in mind that an `update` command may implicitly create or update an optimized build for you - if you are running the command from the same machine as a server instance, this may impact the next start of your server.
+
+[WARNING]
+====
+The `check` command currently offers only a limited functionality. At the moment, it takes into consideration only the version of {project_name} and the embedded Infinispan to determine if a rolling update is possible.
+If those are unchanged, it reports that a rolling update is possible.
+
+The current version does not yet verify configuration changes and assumes all configuration changes are eligible for a rolling update.
+The same applies to changes to custom extensions and themes.
+
+A good use case when to use this is, for example, when you want to do a rolling update when you change the {project_name} theme or your custom extensions, and only want run recreate update when the version of {project_name} changes which does not yet allow a rolling update.
+
+While consumers of these commands should know the limitations that exist today, they should not rely on the internal behavior or the structure of the metadata file.
+Instead, they should rely only on the exit code of the `check` command to benefit from future enhancements on the internal logic to determine when a rolling update is possible.
+====
+
+=== Generating the Metadata
+
+To generate the metadata, execute the following command using the same {project_name} version and configuration options:
+
+.Generate and save the metadata from the current deployment.
+<@kc.updatecompatibility parameters="metadata --file=/path/to/file.json"/>
+
+This command accepts all options used by the `start` command.
+The command displays the metadata, in JSON format, in the console for debugging purposes.
+The `--file` parameter allows you to save the metadata to a file.
+Use this file with the subsequent `check` command.
+
+[WARNING]
+====
+Ensure that all configuration options, whether set via environment variables or CLI arguments, are included when running the above command.
+
+Omitting any configuration options results in incomplete metadata, and could lead to a wrong reported result in the next step.
+====
+
+=== Checking the Metadata
+
+This command checks the metadata generated by the previous command and compares it with the current configuration and {project_name} version.
+If you are updating to a new {project_name} version, this command must be executed with the new version.
+
+.Check the metadata from a previous deployment.
+<@kc.updatecompatibility parameters="check --file=/path/to/file.json"/>
+
+[WARNING]
+====
+* Ensure that all configuration options, whether set via environment variables or CLI arguments, are included when running this command.
+
+* Verify that the correct {project_name} version is used.
+
+Failure to meet these requirements results in an incorrect outcome.
+====
+
+The command prints the result to the console.
+For example, if a rolling update is possible, it displays:
+
+.Rolling Update possible message
+[source,bash]
+----
+[OK] Rolling Update is available.
+----
+
+If no rolling update is possible, the command provides details about the incompatibility:
+
+.Rolling Update not possible message
+[source,bash]
+----
+[keycloak] Rolling Update is not available. 'keycloak.version' is incompatible: 26.2.0 -> 26.2.1 #<1>
+----
+<1> In this example, the Keycloak version `26.2.0` is not compatible with version `26.2.1` and a rolling update is not possible.
+
+[NOTE]
+====
+In the next iteration of this feature, it is possible to use rolling update strategy also when updating to the following patch release of {project_name}.
+Refer to <<rolling-updates-for-patch-releases>> section for more details.
+====
+
+*Command exit code*
+
+Use the command's exit code to determine the update type in your automation pipeline:
+
+|===
+|Exit Code |Description
+
+m|0
+|Rolling Update is possible.
+
+m|1
+|Unexpected error occurred (such as the metadata file is missing or corrupted).
+
+m|2
+|Invalid CLI option.
+
+m|3
+|Rolling Update is not possible.
+The deployment must be shut down before applying the new configuration.
+
+m|4
+|Rolling Update is not possible.
+The feature `rolling-updates` is disabled.
+|===
+
+
+[[rolling-updates-for-patch-releases]]
+== Rolling updates for patch releases
+
+WARNING: This behavior is currently in preview mode, and it is not recommended for use in production.
+
+It is possible to configure the {project_name} compatibility command to allow rolling updates when upgrading to a newer patch version in the same `+major.minor+` release stream.
+
+To enable this behavior for compatibility check command enable feature `rolling-updates:v2` as shown in the following example.
+<@kc.updatecompatibility parameters="check --file=/path/to/file.json --features=rolling-updates:v2"/>
+
+Note there is no change needed when generating metadata using `metadata` command.
+
+Recommended Configuration:
+
+* Enable sticky sessions in your loadbalancer to avoid users bouncing between different versions of {project_name} as this could result in users needing to refresh their Account Console and Admin UI multiple times while the upgrade is progressing.
+
+Supported functionality during rolling updates:
+
+* Users can log in and log out for OpenID Connect clients.
+
+* OpenID Connect clients can perform all operations, for example, refreshing tokens and querying the user info endpoint.
+
+Known limitations:
+
+* If there have been changes to the Account Console or Admin UI in the patch release, and the user opened the Account Console or Admin UI before or during the upgrade, the user might see an error message and be asked to reload the application while navigating in browser during or after the upgrade.
+
+* If the two patch releases of {project_name} use different versions of the embedded Infinispan, no rolling update of {project_name} be performed.
+
+== Further reading
+
+The {project_name} Operator uses the functionality described above to determine if a rolling update is possible. See the <@links.operator id="rolling-updates" /> {section} and the `Auto` strategy for more information.
+
+</@tmpl.guide>
diff --git a/docs/guides/server/vault.adoc b/docs/guides/server/vault.adoc
index 91ea96b47409..1523eacf7a10 100644
--- a/docs/guides/server/vault.adoc
+++ b/docs/guides/server/vault.adoc
@@ -3,8 +3,7 @@
 
 <@tmpl.guide
 title="Using a vault"
-summary="Learn how to use and configure a vault in {project_name}"
-priority=30
+summary="Configure and use a vault in {project_name}."
 includedOptions="vault vault-*">
 
 {project_name} provides two out-of-the-box implementations of the Vault SPI: a plain-text file-based vault and Java KeyStore-based vault.
diff --git a/docs/guides/templates/guide.adoc b/docs/guides/templates/guide.adoc
index 0fb9c840cbc1..95e54aad7c0f 100644
--- a/docs/guides/templates/guide.adoc
+++ b/docs/guides/templates/guide.adoc
@@ -26,8 +26,6 @@ endif::[]
 <#nested>
 
 <#if includedOptions?has_content>
-== Relevant options
-
-<@opts.list options=ctx.options.getOptions(includedOptions, excludedOptions, deniedCategories) anchor=false></@opts.list>
+<@opts.printRelevantOptions includedOptions=includedOptions excludedOptions=excludedOptions deniedCategories=deniedCategories></@>
 </#if>
 </#macro>
diff --git a/docs/guides/templates/kc.adoc b/docs/guides/templates/kc.adoc
index 826dcd1571cd..8db47c0e08de 100644
--- a/docs/guides/templates/kc.adoc
+++ b/docs/guides/templates/kc.adoc
@@ -46,3 +46,10 @@ bin/kc.[sh|bat] import ${parameters}
 bin/kc.[sh|bat] bootstrap-admin ${parameters}
 ----
 </#macro>
+
+<#macro updatecompatibility parameters>
+[source,bash]
+----
+bin/kc.[sh|bat] update-compatibility ${parameters}
+----
+</#macro>
diff --git a/docs/guides/templates/options.adoc b/docs/guides/templates/options.adoc
index d73ccf7ceb28..e53dbd5f768a 100644
--- a/docs/guides/templates/options.adoc
+++ b/docs/guides/templates/options.adoc
@@ -5,6 +5,17 @@
     </#list>
 </#macro>
 
+<#macro includeOptions includedOptions excludedOptions="" deniedCategories="">
+<@list options=ctx.options.getOptions(includedOptions, excludedOptions, deniedCategories) anchor=false></@list>
+</#macro>
+
+<#macro printRelevantOptions includedOptions excludedOptions="" deniedCategories="">
+== Relevant options
+
+<@includeOptions includedOptions=includedOptions excludedOptions=excludedOptions deniedCategories=deniedCategories></@includeOptions>
+<#nested>
+</#macro>
+
 <#macro list options buildIcon=true anchor=true>
 [cols="12a,4",role="options"]
 |===
@@ -12,7 +23,7 @@
 
 <#list options as option>
 |
-[.options-key]#``${option.key}``# <#if buildIcon><#if option.build>[.none]#icon:tools[role=options-build]#</#if></#if>
+[.options-key]#`+${option.key}+`# <#if buildIcon><#if option.build>[.none]#icon:tools[role=options-build]#</#if></#if>
 
 [.options-description]#${option.description}#
 
@@ -20,8 +31,8 @@
 --
 <#if option.descriptionExtended?has_content>[.options-description-extended]#${option.descriptionExtended!}#</#if>
 
-*CLI:* `${option.keyCli}` +
-*Env:* `${option.keyEnv}`
+*CLI:* `+${option.keyCli}+` +
+*Env:* `+${option.keyEnv}+`
 --
 
 <#if option.enabledWhen?has_content>
diff --git a/docs/guides/ui-customization/avatars.adoc b/docs/guides/ui-customization/avatars.adoc
new file mode 100644
index 000000000000..1709323c5a2b
--- /dev/null
+++ b/docs/guides/ui-customization/avatars.adoc
@@ -0,0 +1,29 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Using Avatars"
+priority=50
+summary="Use avatars in the Admin console and Account console.">
+
+Both the admin and account consoles allow use of an avatar to personalize the user experience.  {project_name} supports avatars using the oidc standard `picture` claim.
+
+This `picture` claim should have a URI as its value.  The URI should point to the avatar meant to be displayed in the masthead section of the admin console or account console.
+
+== Setting a picture attribute from the admin console
+The simplest way to allow users to specify the avatar URI is to add a `picture` attribute in User profile.  Just go to the admin console and navigate to the `Realm Settings -> User profile` tab.
+
+Here is an example setup of the `picture` attribute:
+
+image::ui-customization/picture-attribute-general-settings.png[caption="",title="User profile picture attribute setup in admin console"]
+
+== Avatar success
+Here is the result in account console once the URI is saved for the picture attribute:
+
+image::ui-customization/account-console-with-avatar.png[caption="",title="Avatar shown in account console"]
+
+== Important warning
+CAUTION: Allowing users to specify their own URI could lead to security concerns.  An avatar can contain malware. So ensure that images come from a trusted source.  One practical approach is to make sure that the `picture` has a regular expression validator to restrict the URI.
+
+image::ui-customization/avatar-validation.png[caption="",title="RegExp validator for User profile picture attribute"]
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/guides/ui-customization/creating-your-own-console.adoc b/docs/guides/ui-customization/creating-your-own-console.adoc
new file mode 100644
index 000000000000..336595cbcdb9
--- /dev/null
+++ b/docs/guides/ui-customization/creating-your-own-console.adoc
@@ -0,0 +1,200 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Creating your own Console"
+priority=70
+summary="Learn to create your own version of Admin Console or Account Console.">
+
+The Admin Console and Account Console are based on React.
+To create your own version of these consoles, you can use these React based npm packages:
+
+* `@keycloak/keycloak-admin-ui`: This is the base theme for the Admin Console.
+* `@keycloak/keycloak-account-ui`: This is the base theme for the Account Console.
+
+Both packages are available in the public npm repository.
+
+The goal of these packages is to allow the developer to create new React-based consoles that will continue to function properly with new versions of {project_name}.
+
+Additionally, {project_name} provides a tool called `create-keycloak-theme` that helps you get started.  Full documentation for this tool can be found https://github.com/keycloak/keycloak/tree/main/js/apps/create-keycloak-theme[here].
+
+== Getting started
+
+First, we install the `create-keycloak-theme` tool.  Note that we are using `pnpm`, but plain `npm` should work as well.
+[source,bash]
+----
+pnpm install -g create-keycloak-theme
+----
+
+Next, we use the tool to create a full build environment for our new console.  In this example, we create a new Account Console, but everything that follows applies to creation of an Admin Console.  You would just change the `-t` parameter in the following command.
+[source,bash]
+----
+pnpm create keycloak-theme my-theme -t account
+----
+
+Next, we install npm libraries.
+[source,bash]
+----
+cd my-theme
+pnpm install
+----
+
+Now, we start up the development environment, which uses https://vite.dev/guide/[Vite]. This will allow code changes to immediately show up in your browser.
+[source,bash]
+----
+pnpm run dev
+----
+
+Then we start a keycloak server.  It will be automatically downloaded, started, and linked to the development environment.
+[source,bash]
+----
+pnpm run start-keycloak
+----
+
+Now everything is set up and we are ready to start hacking.  To see a customized version of the Account Console, point your browser to http://localhost:8080/realms/master/account.
+
+The user name and password are both `admin`.  Once logged in, you will see the new Account Console rendered:
+
+image::ui-customization/custom-account-console.png[title="Custom Account Console"]
+
+[NOTE]
+If you need to use the Admin Console, go to http://localhost:8080
+
+== Adding a new page
+
+The first thing we want to do is add a new page to our custom Account Console.  You will see that there is already a template for this, `/src/MyPage.tsx`.
+
+image::ui-customization/myPage.png[title="MyPage.tsx"]
+
+There are a few parts of the code to take note of.  First, there is the import statement starting with line 1:
+[source,javascript]
+----
+import {
+  AccountEnvironment,
+  Page,
+  UserRepresentation,
+  getPersonalInfo,
+  savePersonalInfo,
+  useAlerts,
+  useEnvironment,
+  usePromise,
+} from "@keycloak/keycloak-account-ui";
+----
+
+These imports of components and functions are from the aformentioned library `@keycloak/keycloak-account-ui`.  This library will stay up to date with new versions of {project_name}.  Therefore, you can rely on this library across releases and not worry that your version of Account Console will break.
+
+For a full list of the exports from this library, see the https://github.com/keycloak/keycloak/blob/main/js/apps/account-ui/src/index.ts[source code.]
+
+Incidentally, if you are instead creating an Admin Console, see this https://github.com/keycloak/keycloak/blob/main/js/apps/admin-ui/src/index.ts[source code.]
+
+You may notice that there is already a link in the lefthand navigation for `MyPage.tsx`, which shows up as `myPage`.  If you click on that link, you will see `MyPage.tsx` in action.  This was accomplished in the `routes.tsx` file.
+
+For `myPage`, the important parts in `routes.tsx` are as follows:
+[source,javascript]
+----
+import { MyPage } from "./MyPage";
+----
+[source,javascript,subs="specialcharacters,quotes"]
+----
+export const **MyPageRoute**: RouteObject = {
+  path: "myPage",
+  element: <MyPage />,
+};
+
+export const RootRoute: RouteObject = {
+  path: decodeURIComponent(new URL(environment.baseUrl).pathname),
+  element: <App />,
+  errorElement: <>Error</>,
+  children: [
+    PersonalInfoRoute,
+    DeviceActivityRoute,
+    LinkedAccountsRoute,
+    SigningInRoute,
+    ApplicationsRoute,
+    GroupsRoute,
+    ResourcesRoute,
+    **MyPageRoute**,
+  ],
+};
+----
+
+The last thing to notice is that in your development environment, the navigation link to `MyPage.tsx` is rendered as "myPage".  We would rather see this rendered as "My Page".  The good news is that when you do the production build of your custom Account Console, it will be properly rendered.  `myPage` is a localization key that will be resolved to the proper language at runtime.  To see the keys and values for English, look in `\maven-resources\theme\my-account\account\messages\messages_en.properties`.
+
+== Modifying an existing page
+
+You may wish to modify one of the Account Console pages that already exists in {project_name}.  One approach is to simply re-create the entire page yourself using the method in the previous section.
+
+But you may instead wish to start with the source code from the Keycloak project.  If that is your choice, you can find the source code for all the pages in the Keycloak GitHub project https://github.com/keycloak/keycloak/tree/main/js/apps/account-ui/src[here].
+
+As an example, we will use the Device Activity page (`DeviceActivity.tsx`).  Let's assume that we want to remove the details from each device.  We start with a screen that looks like this:
+
+image::ui-customization/device-activity-before.png[title="We want to remove the indicated details from DeviceActivity.tsx"]
+
+We will need to modify the original source code and replace the page found in `@keycloak/keycloak-account-ui`.
+
+First, download DeviceActivity.tsx from https://github.com/keycloak/keycloak/blob/main/js/apps/account-ui/src/account-security/DeviceActivity.tsx[GitHub].
+
+Then remove the details block from template and remove any unused imports.
+
+In addition to this, there are some other changes you will need to make in order to allow your new page to work properly with your custom Account Console.
+
+These imports will now come from the library `@keycloak/keycloak-account-ui`:
+
+[source,javascript,subs="specialcharacters,quotes"]
+----
+import { deleteSession, getDevices } from "../api/methods";
+import {
+  ClientRepresentation,
+  DeviceRepresentation,
+  SessionRepresentation,
+} from "../api/representations";*/
+import { Page } from "../components/page/Page";
+----
+
+Here is the new import statement:
+[source,javascript]
+----
+import {
+  AccountEnvironment,
+  Page,
+  usePromise,
+  DeviceRepresentation,
+  SessionRepresentation,
+  deleteSession,
+  getDevices,
+  useAlerts,
+  useEnvironment, // <---- moved from ui-shared
+} from "@keycloak/keycloak-account-ui";
+----
+
+Note that the `useEnvironment' function is also added to this import.
+
+The last problem to take care of is the PatternFly icons.  These icons are not referenced anywhere else in your project.  So you will need to add this as a dependency.
+
+[source,bash]
+----
+pnpm install @patternfly/react-icons
+----
+
+Finally, we need to change `routes.tsx` in order to replace the old Device Activity page with our new version.  This is just a matter of removing the `DeviceActivity` import from `@keycloak/keycloak-account-ui` and adding an import that points to our new source file:
+
+[source,javascript]
+----
+import { DeviceActivity } from "./DeviceActivity";
+----
+
+Once all this is complete, your new Device Activity page will look like this:
+
+image::ui-customization/device-activity-after.png[title="DeviceActivity.tsx with details removed"]
+
+== Deploying your custom console
+
+The last step is to build and deploy your custom console.  For this, you may need to https://maven.apache.org/[install Maven].  With Maven installed, run:
+
+[source,bash]
+----
+mvn package
+----
+
+If the build is successful, you will see a jar created in the `/target` directory.  This jar can now be deployed to production by copying it to the `/providers` directory of the {project_name} server.
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/guides/ui-customization/index.adoc b/docs/guides/ui-customization/index.adoc
new file mode 100644
index 000000000000..57954bd13407
--- /dev/null
+++ b/docs/guides/ui-customization/index.adoc
@@ -0,0 +1,12 @@
+= Keycloak UI customization guide
+
+include::../attributes.adoc[]
+
+<#list ctx.guides as guide>
+:links_ui_customization_${guide.id}_name: ${guide.title}
+:links_ui_customization_${guide.id}_url: #${guide.id}
+</#list>
+
+<#list ctx.guides as guide>
+include::${guide.template}[leveloffset=+1]
+</#list>
diff --git a/docs/guides/ui-customization/introduction.adoc b/docs/guides/ui-customization/introduction.adoc
new file mode 100644
index 000000000000..837e18d29522
--- /dev/null
+++ b/docs/guides/ui-customization/introduction.adoc
@@ -0,0 +1,14 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Introduction"
+priority=10
+summary="Learn how to customize the user interfaces.">
+
+{project_name} includes user interfaces (UIs) for the login page, Admin Console, and Account Console.  It also has a "welcome" screen used for the first administrator of the Admin Console.
+
+You can customize, extend, and modify these UIs to accommodate many use cases on your production systems.  At a minimum, you will need to change the logos and colors to match your corporate identity.  Also, you may modify the UIs to implement new functionality.
+
+This guide provides all the information needed to customize the {project_name} UIs for your needs.
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/guides/ui-customization/localization.adoc b/docs/guides/ui-customization/localization.adoc
new file mode 100644
index 000000000000..a31c0052cf94
--- /dev/null
+++ b/docs/guides/ui-customization/localization.adoc
@@ -0,0 +1,100 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Localization"
+priority=40
+summary="Learn how to localize strings in the UIs.">
+
+{project_name} supports localized text throughout all user interfaces.
+
+.Prerequisites
+
+* You enable internationalization for a realm in the `Realm settings` section of the Admin Console. See {adminguide_link}#enabling-internationalization[Enabling internationalization].
+
+== Localizing messages in a theme
+
+Text in the templates is loaded from message bundles. When a theme extends another theme, the child theme inherits all messages from the parent's message bundle. You can
+override individual messages by adding `<THEME TYPE>/messages/messages_en.properties` to your theme.
+
+For example, to replace `Username` on the login form with `Your Username` for the `mytheme`, create the file
+`themes/mytheme/login/messages/messages_en.properties` with the following content:
+
+[source]
+----
+usernameOrEmail=Your Username
+----
+
+Within a message, values like `{0}` and `{1}` are replaced with arguments when the message is used. For example {0} in `Log in to {0}` is replaced with the name
+of the realm.
+
+Texts of these message bundles can be overwritten by realm-specific values, which are manageable by the UI and API.
+
+== Adding a language to a theme
+
+.Procedure
+
+. Create the file `<THEME TYPE>/messages/messages_<LOCALE>.properties` in the directory of your theme.
+
+. Add this file to the `locales` property in `<THEME TYPE>/theme.properties`.
+For a language to be available to users in a realm, the login, account, and email theme types must support the language, so you need to add your language for those theme types.
++
+For example, to add Norwegian translations to the `mytheme` theme, create the file `themes/mytheme/login/messages/messages_no.properties` with the
+following content:
++
+[source]
+----
+usernameOrEmail=Brukernavn
+password=Passord
+----
++
+If you omit a translation for messages, those messages appear in English.
+
+. Edit `themes/mytheme/login/theme.properties` and add:
++
+[source]
+----
+locales=en,no
+----
+
+. Make the same changes to the `account` and `email` theme types. To make these changes, create `themes/mytheme/account/messages/messages_no.properties` and
+`themes/mytheme/email/messages/messages_no.properties`. If you leave these files empty, English messages appear.
+
+. Copy `themes/mytheme/login/theme.properties` to `themes/mytheme/account/theme.properties` and `themes/mytheme/email/theme.properties`.
+
+. Add a translation for the language selector by adding a message to the English translation. Add the following to
+`themes/mytheme/account/messages/messages_en.properties` and `themes/mytheme/login/messages/messages_en.properties`:
++
+[source]
+----
+locale_no=Norsk
+----
+
+By default, message properties files should be encoded using UTF-8.
+{project_name} falls back to ISO-8859-1 handling if it cannot read the contents as UTF-8.
+Unicode characters can be escaped as described in Java's documentation for https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/PropertyResourceBundle.html[PropertyResourceBundle].
+Previous versions of {project_name} had support for specifying the encoding in the first line with a comment such as `# encoding: UTF-8`, which is no longer supported.
+
+[role="_additional-resources"]
+.Additional resources
+* For details on how the current locale is selected, see {developerguide_link}#_locale_selector[Locale Selector].
+
+== Overriding localized text for an entire realm
+
+You also have the option to declare translations that take effect for an entire realm.  You specify key/value pairs in the realm settings.  Any key specified in this way overrides the key/value pairs deployed with a theme.
+
+CAUTION: In most cases, using realm overrides is not the recommended way to achieve localization in {project_name}.  Consider carefully if you want every theme in your realm to use a key/value pair declared as a realm override.
+
+.Procedure to add a realm override
+
+. Log into the Admin Console.
+. Select your realm.
+. Click *Realm Settings* from the menu.
+. Click on the *Localization* tab.
+. Click on the *Realm overrides* subtab.
+. Select a language from the option list.
+. Click *Add translation*.
+. Create a key/value pair from the modal dialog.
+
+Notice another subtab called *Effective message bundles*.  This subtab provides a tool to query key/value pairs for a combination of theme, language, and theme type.  You can use this tool to test and make sure your realm overrides took effect.
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/guides/ui-customization/quick-theme.adoc b/docs/guides/ui-customization/quick-theme.adoc
new file mode 100644
index 000000000000..ea00fc66a96a
--- /dev/null
+++ b/docs/guides/ui-customization/quick-theme.adoc
@@ -0,0 +1,63 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Customizing with Quick Theme"
+priority=30
+preview="true"
+summary="Learn how to customize the consoles and login screens with the Quick Theme utility.">
+
+"Quick Theme" is an experimental feature which allows you to quickly and easily create themes with new logos and colors.  Often, this is all you need to facilitate branding and skinning for the Account Console, Admin Console, and login page.
+
+== Enabling Quick Theme
+
+Because the "Quick Theme" feature is experimental, you will need to enable this feature using a feature flag as you start the server.
+
+For example:
+[source,bash]
+----
+bin/kc.[sh|bat] start --features=quick-theme
+----
+
+== Setting logos and colors
+The "Quick Theme" tool is shown below.  The theme you create will extend the default {project_name} theme.  Therefore, when you want to create a new theme with the tool you will start out with the default colors and images.
+
+image::ui-customization/quick-theme-overview.png[title="Quick Theme"]
+
+As shown below, when you change a color or image, you get a preview of how your colors and images will look together for various elements of your theme.  The color options correspond to https://www.patternfly.org/developer-resources/global-css-variables/[PatternFly global CSS variables], which are used by {project_name} to create themes.
+
+image::ui-customization/simple-quick-theme-changes.png[title="Preview after changes"]
+
+[TIP]
+====
+The "Quick Theme" tool uses the default color chooser from your browser. Some color choosers, such as in Chrome, have a handy tool to find a color from something on your screen. Notice the "dropper" icon in the lefthand side of the dialog.
+
+image::ui-customization/color-chooser.png[alt="Color chooser with dropper", title="Color chooser with the dropper tool"]
+
+This "dropper" tool can be used to select your background color to match a color in your logo.
+
+.Find a color with the dropper tool
+image::ui-customization/easy-theme-find-color.png[alt="Find a color with the dropper tool", title="Find a color with the dropper tool"]
+====
+
+When your new theme is complete, click *Download theme JAR* to download a theme JAR that is ready for deployment.
+
+=== Deploying your theme
+Once you have downloaded your theme's archive jar, it's time to deploy and try it out. To deploy the archive to {project_name}, add it to the `providers/` directory of {project_name} and restart the server if it is already running.
+
+CAUTION: For security reasons, never deploy a theme unless you are confident of its origin.  An image can be a possible attack vector.  This issue is the reason that {project_name} does not allow automatic deployment of a theme through the Admin Console.  Only those administrators with file access to your production server should deploy a theme in production.
+
+Another deployment option is to "unjar" the archive into the `themes/` directory.  With this option, you explore the theme and make manual changes.
+
+Many compression utilities or "zip tools" support `jar` files and you can use these to "unjar" the file.  If no such utility is available, you can use the `jar` utility that comes with the java JDK.
+
+[source,bash]
+----
+jar xf quick-theme.jar
+----
+
+=== Trying out your new theme
+Your theme includes the images and colors you provided. They appear throughout the Account Console, Admin Console, and login page.
+
+Once your "Quick Theme" archive jar is deployed, you can fully test it using the procedures shown in the <<themes, Themes chapter>>.  Essentially, you just need to choose your new theme on the Realm settings --> Themes tab.
+</@tmpl.guide>
diff --git a/docs/guides/ui-customization/themes-react.adoc b/docs/guides/ui-customization/themes-react.adoc
new file mode 100644
index 000000000000..c403e42dea5f
--- /dev/null
+++ b/docs/guides/ui-customization/themes-react.adoc
@@ -0,0 +1,69 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Using the npm UI packages"
+priority=80
+summary="Learn how to use UI modules in your own application.">
+
+A final approach to customization is to just take pieces of the Admin Console or Account Console and use it in your own React application.
+
+To fully customize these consoles, you can use the aformentioned React based npm packages.
+Two packages exist:
+
+* `@keycloak/keycloak-admin-ui`: This is the base theme for the Admin Console.
+* `@keycloak/keycloak-account-ui`: This is the base theme for the Account Console.
+Both packages are available in the public npm repository.
+
+== Installing the packages
+
+To install the packages, run the following command:
+
+[source,bash]
+----
+pnpm install @keycloak/keycloak-account-ui
+----
+
+== Using the packages
+
+To use these pages, you add KeycloakProvider in your component hierarchy to choose the client, realm, and URL that you need.
+
+[source,javascript]
+----
+import { KeycloakProvider } from "@keycloak/keycloak-ui-shared";
+
+//...
+
+<KeycloakProvider environment={{
+      serverBaseUrl: "http://localhost:8080",
+      realm: "master",
+      clientId: "security-admin-console"
+  }}>
+  {/* rest of you application */}
+</KeycloakProvider>
+----
+
+== Translating the pages
+
+The pages are translated using the `i18next` library.
+You can set it up as described on the https://react.i18next.com/[react-i18next Website].
+If you want to use the translations that are provided, add i18next-http-backend to your project and add the following:
+
+[source,javascript]
+----
+backend: {
+  loadPath: `http://localhost:8080/resources/master/account/{lng}}`,
+  parse: (data: string) => {
+    const messages = JSON.parse(data);
+
+    const result: Record<string, string> = {};
+    messages.forEach((v) => (result[v.key] = v.value)); //need to convert to record
+    return result;
+  },
+},
+----
+
+== Using the pages
+
+To see how to further integrate the pages, we recommend that you take a look at the output of the tool in the <<creating-your-own-console,Creating your own Console>> chapter.
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/guides/ui-customization/themes.adoc b/docs/guides/ui-customization/themes.adoc
new file mode 100644
index 000000000000..a7cf860db926
--- /dev/null
+++ b/docs/guides/ui-customization/themes.adoc
@@ -0,0 +1,417 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Working with themes"
+priority=20
+summary="Understand how to create and configure themes.">
+
+{project_name} provides theme support for web pages and emails. This allows customizing the look and feel of end-user facing pages so they can be
+integrated with your applications.
+
+image::ui-customization/login-sunrise.png[caption="",title="Login page with sunrise example theme"]
+
+== Theme types
+
+A theme can provide one or more types to customize different aspects of {project_name}. The types available are:
+
+* Account - Account Console
+* Admin - Admin Console
+* Email - Emails
+* Login - Login forms
+* Welcome - Welcome page
+
+== Configuring a theme
+
+All theme types, except welcome, are configured through the Admin Console.
+
+.Procedure
+
+. Log into the Admin Console.
+. Select your realm from the drop-down box in the top left corner.
+. Click *Realm Settings* from the menu.
+. Click the *Themes* tab.
++
+NOTE: To set the theme for the `master` Admin Console you need to set the Admin Console theme for the `master` realm.
++
+. To see the changes to the Admin Console refresh the page.
+
+. Change the welcome theme by using the `spi-theme--welcome-theme` option.
+
+. For example:
++
+[source,bash]
+----
+bin/kc.[sh|bat] start --spi-theme--welcome-theme=custom-theme
+----
+
+[[_default-themes]]
+== Default themes
+
+{project_name} comes bundled with default themes in the JAR file `keycloak-themes-{project_versionMvn}.jar` inside the server distribution.
+The server's root `themes` directory does not contain any themes by default, but it contains a README file with some additional details about the default themes.
+To simplify upgrading, do not edit the bundled themes directly. Instead create your own theme that extends one of the bundled themes.
+
+[[_creating-a-theme]]
+== Creating a theme
+
+A theme consists of:
+
+* HTML templates (https://freemarker.apache.org/[Freemarker Templates])
+* Images
+* Message bundles
+* Stylesheets
+* Scripts
+* Theme properties
+
+Unless you plan to replace every single page you should extend another theme. Most likely you will want to extend some existing theme. Alternatively, if you intend to provide your own implementation of the admin or account console,
+consider extending the `base` theme. The `base` theme consists of a message bundle and therefore such implementation needs to start from scratch, including implementation of the main `index.ftl` Freemarker template, but it can leverage existing translations from the message bundle.
+
+When extending a theme you can override individual resources (templates, stylesheets, etc.). If you decide to override HTML templates bear in mind that you may
+need to update your custom template when upgrading to a new release.
+
+While creating a theme it's a good idea to disable caching as this makes it possible to edit theme resources directly from the `themes` directory without
+restarting {project_name}.
+
+.Procedure
+
+. Run Keycloak with the following options:
++
+[source,bash]
+----
+bin/kc.[sh|bat] start --spi-theme--static-max-age=-1 --spi-theme--cache-themes=false --spi-theme--cache-templates=false
+----
+
+. Create a directory in the `themes` directory.
++
+The name of the directory becomes the name of the theme. For example to
+create a theme called `mytheme` create the directory `themes/mytheme`.
+
+. Inside the theme directory, create a directory for each of the types your theme is going to provide.
++
+For example, to add the login type to the `mytheme` theme, create the directory `themes/mytheme/login`.
+
+. For each type create a file `theme.properties` which allows setting some configuration for the theme.
++
+For example, to configure the theme `themes/mytheme/login` to extend the `base` theme and import some common resources, create the file `themes/mytheme/login/theme.properties` with following contents:
++
+[source]
+----
+parent=base
+import=common/keycloak
+----
++
+You have now created a theme with support for the login type.
+
+. Log into the Admin Console to check out your new theme
+. Select your realm
+. Click *Realm Settings* from the menu.
+. Click on the *Themes* tab.
+. For *Login Theme* select *mytheme* and click *Save*.
+. Open the login page for the realm.
++
+You can do this either by logging in through your application or by opening the Account Console (`/realms/{realm-name}/account`).
+
+. To see the effect of changing the parent theme, set `parent=keycloak` in `theme.properties` and refresh the login page.
+
+[NOTE]
+====
+Be sure to re-enable caching in production as it will significantly impact performance.
+====
+[NOTE]
+====
+If you want to manually delete the content of the themes cache, you can do so by deleting the `data/tmp/kc-gzip-cache` directory of the server distribution.
+It can be useful for instance if you redeployed custom providers or custom themes without disabling themes caching in the previous server executions.
+====
+
+=== Theme properties
+
+Theme properties are set in the file `<THEME TYPE>/theme.properties` in the theme directory.
+
+* parent - Parent theme to extend
+* import - Import resources from another theme
+* common - Override the common resource path. The default value is `common/keycloak` when not specified. This value would be used as value of suffix of ${r"`${url.resourcesCommonPath}`"}, which is used typically in freemarker templates (prefix of ${r"`${url.resoucesCommonPath}`"} value is theme root uri).
+* styles - Space-separated list of styles to include
+* locales - Comma-separated list of supported locales
+
+There are a list of properties that can be used to change the css class used for certain element types. For a list of these properties look at the theme.properties
+file in the corresponding type of the keycloak theme (`themes/keycloak/<THEME TYPE>/theme.properties`).
+
+You can also add your own custom properties and use them from custom templates.
+
+When doing so, you can substitute system properties or environment variables by using these formats:
+
+* ${r"`${some.system.property}`"} - for system properties
+* ${r"`${env.ENV_VAR}`"} - for environment variables.
+
+A default value can also be provided in case the system property or the environment variable is not found with ${r"`${foo\:defaultValue}`"}.
+
+NOTE: If no default value is provided and there's no corresponding system property or environment variable, then nothing is replaced and you end up with the format in your template.
+
+Here's an example of what is possible:
+
+[source,properties]
+----
+javaVersion=${r"${java.version}"}
+
+unixHome=${r"${env.HOME:Unix home not found}"}
+windowsHome=${r"${env.HOMEPATH:Windows home not found}"}
+----
+
+[[_theme_stylesheet]]
+=== Add a stylesheet to a theme
+
+You can add one or more stylesheets to a theme.
+
+.Procedure
+
+. Create a file in the `<THEME TYPE>/resources/css` directory of your theme.
+
+. Add this file to the `styles` property in `theme.properties`.
++
+For example, to add `styles.css` to the `mytheme`, create `themes/mytheme/login/resources/css/styles.css` with the following content:
++
+[source,css]
+----
+.login-pf body {
+    background: DimGrey none;
+}
+----
+
+. Edit `themes/mytheme/login/theme.properties` and add:
++
+[source]
+----
+styles=css/styles.css
+----
+
+. To see the changes, open the login page for your realm.
++
+You will notice that the only styles being applied are those from your custom stylesheet.
+
+. To include the styles from the parent theme, load the styles from that theme. Edit `themes/mytheme/login/theme.properties` and change `styles` to:
++
+[source]
+----
+styles=css/login.css css/styles.css
+----
++
+NOTE: To override styles from the parent stylesheets, ensure that your stylesheet is listed last.
+
+=== Adding a script to a theme
+
+You can add one or more scripts to a theme.
+
+.Procedure
+
+. Create a file in the `<THEME TYPE>/resources/js` directory of your theme.
+
+. Add the file to the `scripts` property in `theme.properties`.
++
+For example, to add `script.js` to the `mytheme`, create `themes/mytheme/login/resources/js/script.js` with the following content:
++
+[source,javascript]
+----
+alert('Hello');
+----
++
+Then edit `themes/mytheme/login/theme.properties` and add:
++
+[source]
+----
+scripts=js/script.js
+----
+
+=== Adding an image to a theme
+
+To make images available to the theme add them to the `<THEME TYPE>/resources/img` directory of your theme. These can be used from within stylesheets or
+directly in HTML templates.
+
+For example to add an image to the `mytheme` copy an image to `themes/mytheme/login/resources/img/image.jpg`.
+
+You can then use this image from within a custom stylesheet with:
+
+[source,css]
+----
+body {
+    background-image: url('../img/image.jpg');
+    background-size: cover;
+}
+----
+
+Or to use directly in HTML templates add the following to a custom HTML template:
+
+[source,html]
+----
+<img src="${r"${url.resourcesPath}"}/img/image.jpg" alt="My image description">
+----
+
+[[_theme_custom_footer]]
+=== Adding a custom footer to a login theme
+
+In order to use a custom footer, create a `footer.ftl` file in your custom login theme with the desired content.
+
+An example for a custom `footer.ftl` may look like this:
+
+[source]
+----
+<#noparse>
+<#macro content>
+<#-- footer at the end of the login box -->
+<div>
+    <ul id="kc-login-footer-links">
+        <li><a href="#home">Home</a></li>
+        <li><a href="#about">About</a></li>
+        <li><a href="#contact">Contact</a></li>
+    </ul>
+</div>
+</#macro>
+</#noparse>
+----
+
+=== Adding an image to an email theme
+
+To make images available to the theme add them to the `<THEME TYPE>/email/resources/img` directory of your theme. These can be used from within directly in HTML templates.
+
+For example to add an image to the `mytheme` copy an image to `themes/mytheme/email/resources/img/logo.jpg`.
+
+To use directly in HTML templates add the following to a custom HTML template:
+
+[source,html]
+----
+<img src="${r"${url.resourcesUrl}"}/img/image.jpg" alt="My image description">
+----
+
+[[custom-identity-providers-icons]]
+=== Adding custom Identity Providers icons
+
+{project_name} supports adding icons for custom Identity providers, which are displayed on the login screen.
+
+.Procedure
+
+. Define icon classes in your login `theme.properties` file (for example, `themes/mytheme/login/theme.properties`) with key pattern `kcLogoIdP-<alias>`.
+
+. For an Identity Provider with an alias `myProvider`, you may add a line to `theme.properties` file of your custom theme. For example:
++
+[source]
+----
+kcLogoIdP-myProvider = fa fa-lock
+----
+
+All icons are available on the official website of PatternFly4.
+Icons for social providers are already defined in `base` login theme properties (`themes/keycloak/login/theme.properties`), where you can inspire yourself.
+
+=== Creating a custom HTML template
+
+{project_name} uses https://freemarker.apache.org/[Apache Freemarker] templates to generate HTML and render pages.
+
+Although it is possible to create custom templates to change completely how pages are rendered, the recommendation is to leverage the built-in
+templates as much as possible. The reasons are:
+
+* During upgrades, you might be forced to update your custom templates to get the latest updates from newer versions
+* link:#_theme_stylesheet[Configuring CSS styles] to your themes allows you to adapt the UI to match your UI design standards and guidelines.
+* link:{adminguide_link}#user-profile[User Profile] allows you to support custom user attributes and configure how they are rendered.
+
+In most cases, you won't need to change templates to adapt {project_name} to your needs, but you can override individual
+templates in your own theme by creating `<THEME TYPE>/<TEMPLATE>.ftl`.
+Admin and account console use a single template `index.ftl` for rendering the application.
+
+For a list of templates in other theme types look at the `theme/base/<THEME_TYPE>` directory in the JAR file at `$KEYCLOAK_HOME/lib/lib/main/org.keycloak.keycloak-themes-<VERSION>.jar`.
+
+.Procedure
+
+. Copy the template from the base theme to your own theme.
+
+. Apply the modifications you need.
++
+For example, to create a custom login form for the `mytheme` theme, copy `themes/base/login/login.ftl` to `themes/mytheme/login` and open it in an editor.
++
+After the first line (`+<#noparse><#import ...></#noparse>+`), add `<h1>HELLO WORLD!</h1>` as shown here:
++
+[source,html]
+----
+<#noparse>
+<#import "template.ftl" as layout>
+<h1>HELLO WORLD!</h1>
+...
+</#noparse>
+----
+
+. Back up the modified template. When upgrading to a new version of {project_name} you may need to update your custom templates to apply changes to the original template if applicable.
+
+[role="_additional-resources"]
+.Additional resources
+* See the https://freemarker.apache.org/docs/index.html[FreeMarker Manual] for details on how to edit templates.
+
+=== Emails
+
+To edit the subject and contents for emails, for example password recovery email, add a message bundle to the `email` type of your theme. There are three messages for each email. One for the subject, one for the plain text body and one for the html body.
+
+To see all emails available take a look at `themes/base/email/messages/messages_en.properties`.
+
+For example to change the password recovery email for the `mytheme` theme create `themes/mytheme/email/messages/messages_en.properties` with the following
+content:
+[source]
+----
+passwordResetSubject=My password recovery
+passwordResetBody=Reset password link: {0}
+passwordResetBodyHtml=<a href="{0}">Reset password</a>
+----
+
+== Deploying themes
+
+Themes can be deployed to {project_name} by copying the theme directory to `themes` or it can be deployed as an archive. During development you can copy the
+theme to the `themes` directory, but in production you may want to consider using an `archive`. An `archive` makes it simpler to have a versioned copy of
+the theme, especially when you have multiple instances of {project_name} for example with clustering.
+
+.Procedure
+
+. To deploy a theme as an archive, create a JAR archive with the theme resources.
+. Add a file `META-INF/keycloak-themes.json` to the
+archive that lists the available themes in the archive as well as what types each theme provides.
++
+For example for the `mytheme` theme create `mytheme.jar` with the contents:
++
+* META-INF/keycloak-themes.json
+* theme/mytheme/login/theme.properties
+* theme/mytheme/login/login.ftl
+* theme/mytheme/login/resources/css/styles.css
+* theme/mytheme/login/resources/img/image.png
+* theme/mytheme/login/messages/messages_en.properties
+* theme/mytheme/email/messages/messages_en.properties
++
+The contents of `META-INF/keycloak-themes.json` in this case would be:
++
+[source,json]
+----
+{
+    "themes": [{
+        "name" : "mytheme",
+        "types": [ "login", "email" ]
+    }]
+}
+----
++
+A single archive can contain multiple themes and each theme can support one or more types.
+
+To deploy the archive to {project_name}, add it to the `providers/` directory of
+{project_name} and restart the server if it is already running.
+
+== Dark Mode
+Dark mode is a feature that changes the color scheme to a dark background with lighter text.  For example, themes based on PatternFly, such as Keycloak's admin console and account console, support dark mode.  But for some themes, dark mode doesn't work well for various reasons.  So Keycloak allows you to disable dark mode from the admin console.
+
+.Procedure to disable dark mode
+
+. Log into the Admin Console.
+. Select your realm.
+. Click *Realm Settings* from the menu.
+. Click on the *Themes* tab.
+. Unselect *Dark mode* and click *Save*.
+
+If enabled, the dark variant of the theme will be applied based on user preference through an operating system setting (e.g. light or dark mode) or a user agent setting. If disabled, only the light variant will be used. This setting only applies to themes that support dark and light variants. On themes that do not support this feature it will have no effect.
+
+[role="_additional-resources"]
+== Additional resources for Themes
+* For more inspiration, see <<_default-themes,Default Themes>> bundled inside {project_name}.
+* {quickstartRepo_link}[{quickstartRepo_name}] - Directory `extension` of the quickstarts repository contains some theme examples, which can be also used as an inspiration.
+</@tmpl.guide>
diff --git a/docs/guides/ui-customization/welcome-theme.adoc b/docs/guides/ui-customization/welcome-theme.adoc
new file mode 100644
index 000000000000..473fddfe6c2d
--- /dev/null
+++ b/docs/guides/ui-customization/welcome-theme.adoc
@@ -0,0 +1,20 @@
+<#import "/templates/guide.adoc" as tmpl>
+<#import "/templates/links.adoc" as links>
+
+<@tmpl.guide
+title="Customizing the Welcome Theme"
+priority=60
+summary="Learn how to customize the welcome theme.">
+
+The welcome theme is the web page that is served when you request the default page from the {project_name} server.  For instance, if your server is deployed on your local machine at port 8080, http://localhost:8080 serves the welcome theme.
+
+By default, the welcome theme is only used to create the initial temporary admin user.  Once that user is created, whenever users navigate to the welcome theme, they are redirected to the Admin Console.  However, this behavior can be changed and the welcome theme can be completely customized or replaced.
+
+Since the welcome theme is not associated with a realm, it cannot be selected in the admin console like other themes.
+
+To change the welcome theme, create and deploy a new welcome theme as described in <<_creating-a-theme,Creating a theme>>.  Then, start the {project_name} server using the `spi-theme--welcome-theme` option.
+[source,bash]
+----
+bin/kc.[sh|bat] start --spi-theme--welcome-theme=custom-theme
+----
+</@tmpl.guide>
\ No newline at end of file
diff --git a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Context.java b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Context.java
index f0211803314f..8c3295e33bf9 100644
--- a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Context.java
+++ b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Context.java
@@ -31,16 +31,30 @@ public Context(File srcDir) throws IOException {
         for (File f : srcDir.listFiles((dir, f) -> f.endsWith(".adoc") && !f.equals("index.adoc"))) {
             Guide guide = parser.parse(f);
 
-            if (guidePriorities != null && guide != null) {
-                Integer priority = guidePriorities.get(guide.getId());
-                guide.setPriority(priority != null ? priority : Integer.MAX_VALUE);
-            }
-
             if (guide != null) {
+                if (guidePriorities != null) {
+                    Integer priority = guidePriorities.get(guide.getId());
+                    if (priority != null) {
+                        if (guide.getPriority() != Integer.MAX_VALUE) {
+                            throw new RuntimeException("Guide is pinned, but has a priority specified: " + f.getName());
+                        }
+                        guidePriorities.remove(guide.getId());
+                        guide.setPriority(priority);
+                    }
+                }
+
+                if (!guide.isTileVisible() && guide.getPriority() == Integer.MAX_VALUE) {
+                    throw new RuntimeException("Invisible tiles should be pinned or have an explicit priority: " + f.getName());
+                }
+
                 guides.add(guide);
             }
         }
 
+        if (guidePriorities != null && !guidePriorities.isEmpty()) {
+            throw new RuntimeException("File 'pinned-guides' contains files that no longer exist or are misspelled: " + guidePriorities.keySet());
+        }
+
         Collections.sort(guides, (o1, o2) -> {
             if (o1.getPriority() == o2.getPriority()) {
                 return o1.getTitle().compareTo(o2.getTitle());
diff --git a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Features.java b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Features.java
index c50e32b2b21c..be1dcaa1342c 100644
--- a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Features.java
+++ b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Features.java
@@ -51,6 +51,10 @@ public String getDescription() {
             return profileFeature.getLabel();
         }
 
+        public String getVersionedKey() {
+            return profileFeature.getVersionedKey();
+        }
+
         private Profile.Feature.Type getType() {
             return profileFeature.getType();
         }
diff --git a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Guide.java b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Guide.java
index 15912b4e064c..5645453beb25 100644
--- a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Guide.java
+++ b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Guide.java
@@ -6,7 +6,8 @@ public class Guide {
     private String id;
     private String title;
     private String summary;
-    private int priority;
+    private int priority = Integer.MAX_VALUE;
+    private boolean tileVisible = true;
 
     public String getTemplate() {
         return template;
@@ -47,4 +48,12 @@ public int getPriority() {
     public void setPriority(int priority) {
         this.priority = priority;
     }
+
+    public boolean isTileVisible() {
+        return tileVisible;
+    }
+
+    public void setTileVisible(boolean tileVisible) {
+        this.tileVisible = tileVisible;
+    }
 }
diff --git a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/GuideParser.java b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/GuideParser.java
index 062e070ae293..baa914233800 100644
--- a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/GuideParser.java
+++ b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/GuideParser.java
@@ -9,8 +9,8 @@
 
 public class GuideParser {
 
-    private Pattern TEMPLATE_IMPORT_PATTERN = Pattern.compile("<#import \"/templates/guide.adoc\" as (?<importName>[^ ]*)>");
-    private Pattern GUIDE_ELEMENT_PATTERN = Pattern.compile("(?<key>priority|title|summary)=(\\\"(?<valueString>[^\\\"]*)\\\"|(?<valueInt>[\\d]*))");
+    private final Pattern TEMPLATE_IMPORT_PATTERN = Pattern.compile("<#import \"/templates/guide.adoc\" as (?<importName>[^ ]*)>");
+    private final Pattern GUIDE_ELEMENT_PATTERN = Pattern.compile("(?<key>priority|title|summary|tileVisible)=(\\\"(?<valueString>[^\\\"]*)\\\"|(?<valueInt>[\\d]*))");
 
     /**
      * Parses a FreeMarker template to retrieve Guide attributes
@@ -26,7 +26,6 @@ public Guide parse(File file) throws IOException {
             if (importElement != null) {
                 Guide guide = new Guide();
                 guide.setTemplate(file.getName());
-                guide.setPriority(999);
 
                 guide.setId(file.getName().replaceAll(".adoc", ""));
 
@@ -79,6 +78,8 @@ private void setAttributes(String importElement, Guide guide) {
                     break;
                 case "priority":
                     guide.setPriority(Integer.parseInt(attributeMatcher.group("valueInt")));
+                case "tileVisible":
+                    guide.setTileVisible(Boolean.parseBoolean(attributeMatcher.group("valueString")));
             }
         }
     }
diff --git a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Options.java b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Options.java
index d699cbbfbc2b..7b19dee199c3 100644
--- a/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Options.java
+++ b/docs/maven-plugin/src/main/java/org/keycloak/guides/maven/Options.java
@@ -1,11 +1,9 @@
 package org.keycloak.guides.maven;
 
-import static org.aesh.readline.terminal.Key.r;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.toDashCase;
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
 
-import org.apache.commons.lang3.ArrayUtils;
 import org.keycloak.config.ConfigSupportLevel;
 import org.keycloak.config.DeprecatedMetadata;
 import org.keycloak.config.OptionCategory;
@@ -14,7 +12,6 @@
 import org.keycloak.provider.ProviderManager;
 import org.keycloak.provider.Spi;
 import org.keycloak.quarkus.runtime.Providers;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 import org.keycloak.utils.StringUtil;
 
@@ -63,6 +60,10 @@ public Options() {
                 .flatMap(Collection::stream)
                 .forEach(option -> option.description = option.description.replaceAll("'([^ ]*)'", "`$1`"));
 
+        ArrayList<String> booleanValues = new ArrayList<>();
+        booleanValues.add("true");
+        booleanValues.add("false");
+
         for (Spi loadSpi : providerManager.loadSpis().stream().sorted(Comparator.comparing(Spi::getName)).toList()) {
             for (ProviderFactory<?> providerFactory : providerManager.load(loadSpi).stream().sorted(Comparator.comparing(ProviderFactory::getId)).toList()) {
                 List<ProviderConfigProperty> configMetadata = providerFactory.getConfigMetadata();
@@ -71,9 +72,11 @@ public Options() {
                     continue;
                 }
 
-                String optionPrefix = NS_KEYCLOAK_PREFIX + String.join(OPTION_PART_SEPARATOR, ArrayUtils.insert(0, new String[] {loadSpi.getName(), providerFactory.getId()}, "spi"));
+                String spiKey = toDashCase(loadSpi.getName());
+                String providerKey = toDashCase(providerFactory.getId());
+                String optionPrefix = NS_KEYCLOAK_PREFIX + "spi" + OPTION_PART_SEPARATOR + spiKey + OPTION_PART_SEPARATOR + OPTION_PART_SEPARATOR + providerKey + OPTION_PART_SEPARATOR + OPTION_PART_SEPARATOR;
                 List<Option> options = configMetadata.stream()
-                        .map(m -> new Option(Configuration.toDashCase(optionPrefix.concat("-") + m.getName()), OptionCategory.GENERAL, false,
+                        .map(m -> new Option(optionPrefix + toDashCase(m.getName()), OptionCategory.GENERAL, false,
                                 m.getType(),
                                 m.getHelpText(),
                                 m.getDefaultValue() == null ? null : m.getDefaultValue().toString(),
@@ -83,9 +86,6 @@ public Options() {
                                 null))
                         .sorted(Comparator.comparing(Option::getKey)).collect(Collectors.toList());
 
-                ArrayList<String> booleanValues = new ArrayList<>();
-                booleanValues.add("true");
-                booleanValues.add("false");
                 options.forEach(option -> {
                     if (option.type.equals("boolean")) {
                         option.expectedValues = booleanValues;
@@ -94,7 +94,7 @@ public Options() {
                 });
 
                 if (!options.isEmpty()) {
-                    providerOptions.computeIfAbsent(toDashCase(loadSpi.getName()), k -> new LinkedHashMap<>()).put(toDashCase(providerFactory.getId()), options);
+                    providerOptions.computeIfAbsent(spiKey, k -> new LinkedHashMap<>()).put(providerKey, options);
                 }
             }
         }
@@ -261,7 +261,9 @@ public boolean isStrictExpectedValues() {
         }
 
         public String getEnabledWhen() {
-            if (StringUtil.isBlank(enabledWhen)) return null;
+            if (StringUtil.isBlank(enabledWhen)) {
+                return null;
+            }
             return enabledWhen;
         }
 
diff --git a/docs/tests.md b/docs/tests.md
index 22b3763602c1..68f33c64e17b 100644
--- a/docs/tests.md
+++ b/docs/tests.md
@@ -112,16 +112,15 @@ To start a test mail server for testing email sending run:
     
 or run org.keycloak.testsuite.MailServer from your favourite IDE!
 
-To configure Keycloak to use the above server add the following system properties:
+To configure Keycloak to use the above server, enter the following values in the realm configuration in the tab **Email**:
+
+| Field | Value             | 
+|-------|-------------------|
+| From  | auto@keycloak.org |
+| Host  | localhost         |
+| Port  | 3025              |
 
-    keycloak.mail.smtp.from=auto@keycloak.org
-    keycloak.mail.smtp.host=localhost
-    keycloak.mail.smtp.port=3025
-    
-For example if using the test utils Keycloak server start it with:
 
-    mvn exec:java -Pkeycloak-server -Dkeycloak.mail.smtp.from=auto@keycloak.org -Dkeycloak.mail.smtp.host=localhost -Dkeycloak.mail.smtp.port=3025
-    
 LDAP server
 -----------
 
diff --git a/docs/translation.md b/docs/translation.md
index 3d7a6a05ad16..992a1098d8e9 100644
--- a/docs/translation.md
+++ b/docs/translation.md
@@ -1,63 +1,137 @@
 # Translation Guidelines
 
-Thank you for your interest in contributing translations to Keycloak! 
+Thank you for your interest in contributing translations to Keycloak!
 This document provides guidelines for contributing translations and getting started with Weblate.
 
 ## Why Translation Matters
 
-Translation enables Keycloak to reach a wider audience by making the platform usable for speakers of various languages. By translating Keycloak, you help improve accessibility and usability for users who may not be proficient in English.
+Translation enables Keycloak to reach a wider audience by making the platform usable for speakers of various languages.
+By translating Keycloak, you help to improve accessibility and usability for users who may not be proficient in English.
 
 ## What to translate
 
-Your contributions can greatly enhance the user experience for non-English speakers.
+Keycloak welcomes translations of its user interfaces and error messages via two distinct ways:
 
-Keycloak welcomes translations of its user interfaces and error messages via Weblate. 
+* GitHub pull requests to `messages_*.properties` files,
 
-There is also a [Keycloak Documentation translation project](https://github.com/openstandia/keycloak-documentation-i18n). 
+OR
 
-## Getting Started with Weblate
+* Web based translation via [Weblate](https://hosted.weblate.org/projects/keycloak/).
 
-Keycloak uses [Weblate](https://hosted.weblate.org/projects/keycloak/), a web-based translation platform, to manage translations of user interfaces and error messages.
-
-Here's how you can get started:
+There is also a [Keycloak Documentation translation project](https://github.com/openstandia/keycloak-documentation-i18n) to translate some parts of the documentation to Japanese.
 
-- Sign Up: Visit Weblate to create an account.
-- Configuration: After signing up, configure your Weblate account settings according to your preferences. Please note that the committer email is set to the login email address by default. You can adjust this in your Weblate profile under Account settings.
-- Join the Keycloak translation team on Weblate to start contributing translations.
-
-### Guidelines and Conventions
+## Guidelines and Conventions
 
 To ensure consistency and quality across translations, please adhere to the following guidelines:
 
 - Use formal or informal language as appropriate for the context.
 - Maintain consistency with existing translations.
 - Translate text accurately, ensuring that the meaning is preserved.
-- Weblate will pushe translations as a pull request to the [Keycloak repository](https://github.com/keycloak/keycloak) at least once a day. A maintainer for that language has the ability to approve or decline that translation.
 
-### Supported translations
+### Handling of single quotes (`'`)
+
+Whenever messages are formatted in the backend, Keycloak uses Java's MessageFormat to replace placeholders. This uses
+single quotes (`'`) as an escape mechanism.
+
+Therefore, use typographic quotes like `‘` and `’` where possible.
+
+To avoid problems, automatic checks ensure the following:
+
+* In all "base" themes, where message keys are evaluated in the backend, no single quote (`'`) must be used standalone as it would not print when used in Java's MessageFormat.
+  For legacy messages, a double single quote (`''`) can be used to print a single quote.
+
+* In all UI themes, where message keys are evaluated in the frontend, a single quote (`'`) must only be used standalone, and a double single (`''`) must not be used.
+
+### Spanish translations
+
+- Use the formal "usted" form instead of the informal "vos or tu" (i.e., avoid tuteo), ensuring a more formal tone.
+
+## Using GitHub pull requests to update translations
+
+Translations via GitHub pull requests are possible for all languages.
+
+While for those languages on Weblate the preferred way is to use Weblate, contributions are still possible via GitHub.
+If you are not familiar with GitHub, and want your language to be added to Weblate, see "Steps to add a new language to
+Weblate"
+
+**Tasks of the translator:**
+
+1. Optional: Create an issue or discussion as outlined in the [contributing docs](../CONTRIBUTING.md).
+2. Update the `messages_*.properties` files for one or more languages.
+3. Commit the changes with sign-off as outlined in the [contributing docs](../CONTRIBUTING.md). If you created an issue in the first step, reference it in the commit.
+4. Create a pull request. If you created an issue in the first step, link it to the issue as described in [contributing docs](../CONTRIBUTING.md).
+5. Find a reviewer that is a native speaker in that language.
+
+**Task of the reviewer:**
 
-Keycloak already supports a lot of translations. 
-While were in the transitioning process towards Weblate, the following translations are available in Weblate:
+1. As a native speaker, review the changes in the pull request. Once you are satisfied with the changes, leave a comment in the pull request that you approve the changes.
 
-- German
-- Dutch
-- Japanese
-- Catalan
-- Spanish
+**Tasks of the maintainer:**
 
-For all other translations, look for the `messages_*.properties` files in the main repository and create a pull request with your translations. 
+1. Once the review from the native speaker is in, check that the changes to the `messages_*.properties` files are syntactically correct.
+2. If there are any translation pull requests created by Weblate, assure to merge them first to avoid conflicts in Weblate which are difficult to resolve.
+3. If the changes are ok, approve the PR and merge it. If there is an existing issue, reference that in the squash-message, otherwise reference the issue of the pull request.
 
-Please note that while we aspire to support more translations in the future, our current focus is on these translations. We rely on volunteers like you to take the initiative in steering the translation efforts for additional translations. If you're interested in contributing translations for a language not listed above, add a comment to the [localization platform discussion](https://github.com/keycloak/keycloak/discussions/9270).
+## Using Weblate to to update translations
 
-If you have any questions or need assistance, feel free to reach out to the language maintainers listed below:
+Keycloak uses [Weblate](https://hosted.weblate.org/projects/keycloak/), a web-based translation platform, to manage translations of user interfaces and error messages.
+
+It allows for notifications when the original string changes, and keeps track of missing translations. It also allows contributors without knowledge of Git to contribute to the translations.
 
-* German: [Robin Meese](https://github.com/robson90)
-* Dutch: [Jon Koops](https://github.com/jonkoops)
-* Japanese: [y-tabata](https://github.com/y-tabata) && [wadahiro](https://github.com/wadahiro)
+The following translations are available in Weblate. If you have any questions or need assistance, feel free to reach out to the language maintainers listed below:
+
+* German: [Robin Meese](https://github.com/robson90) && [Alexander Schwartz](https://github.com/ahus1)
+* Dutch: [janher](https://github.com/janher) && [Erik Jan de wit](https://github.com/edewit)
+* Japanese: [y-tabata](https://github.com/y-tabata) && [wadahiro](https://github.com/wadahiro) && [tnorimat](https://github.com/tnorimat) && [k-tamura](https://github.com/k-tamura)
 * Catalan: [jmallach](https://github.com/jmallach) && [Ecron](https://github.com/Ecron)
 * Spanish: [herver1971](https://github.com/herver1971) && [anthieni](https://github.com/anthieni)
+* Slovenian: [mathmul](https://github.com/mathmul) && [SaraPristovnik](https://github.com/SaraPristovnik)
+* Italian: [GioviQ](https://github.com/GioviQ) && [EdoardoTona](https://github.com/EdoardoTona)
+* Romanian: [edwint88](https://github.com/edwint88) && [liviuroman](https://github.com/liviuroman)
+* Portuguese (Brazil): [rafaelrddc](https://github.com/rafaelrddc) && [felipebz](https://github.com/felipebz) && [julianorodrigox](https://github.com/julianorodrigox)
+* French: [jmorille](https://github.com/jmorille) && [blackholegalaxy](https://github.com/blackholegalaxy)
+
+To add a new language, see the section "Steps to Add a new language to Weblate" below.
+
+**Tasks of the translator:**
+
+1. Sign Up: Visit Weblate to create an account.
+2. Configuration: After signing up, configure your Weblate account settings according to your preferences. 
+   Please note that the committer email is set to the login email address by default. You can adjust this in your Weblate profile under Account settings.
+3. Navigate to [Keycloak on Weblate](https://hosted.weblate.org/projects/keycloak/), confirm the contribution agreement, and start contributing translations.
+4. For all untranslated and not-yet-approved keys you can directly add or update the translation.
+5. For all approved keys you can suggest an alternative translation.
+
+**Tasks of the maintainer:**
+
+Weblate will create automated pull requests based on new or updated translations within 24 hours.
+The goal is to merge those pull requests within 2-3 working days.
+Translations are reviewed in Weblate by language maintainers for their correctness, still maintainers do some minimal checks as outlined below.
 
-### Steps to Add a New Language
+1. Check that the changes to the `messages_*.properties` files are syntactically correct.
+2. Do a spot-check with Google Translate to avoid malicious community translations.
+3. If the changes are ok, approve the PR and merge it. For pull requests created by Weblate there is no referenced GitHub issue, therefore reference the ID of the pull request in the squash-message.
+4. Once the PR is merged, notify the respective language maintainers via a comment in the pull request that there are changes for their languages.
+
+**Tasks of the language maintainers:**
+
+**Goal:** Before a minor or major release that is due every three months, all translations should be in the state approved and all suggested translation should be reviewed.
+A language that misses that goal will be removed from Weblate, and translations will then only be possible via GitHub pull requests afterwards.
+
+1. Review all translations from the community (`state:=translated`) for your language, review them and set them to **Approved**.
+2. Review all translations that have community suggestions (`has:suggestion`) for your language, review them and approve or reject the suggestions.
+3. When notified that translation changes have been merged in a PR, review the translations that originated either from the community of from a co-maintainer of the language in that pull request, and issue any necessary updates via Weblate.
+
+> [!TIP]
+> We recommend language maintainers to set up notifications in Weblate to receive email notifications of outstanding tasks.
+
+All language maintainers are set up in Weblate as reviewers for their language according to Weblate's "Dedicated Reviewers" process.
+
+## Steps to add a new language to Weblate
+
+We rely on volunteers like you to take the initiative in steering the translation efforts for additional translations.
+If you're interested in contributing translations for a language not listed above, join
+the [localization platform discussion](https://github.com/keycloak/keycloak/discussions/9270):
 
 - Check the discussion, if your language is already proposed [discussion thread](https://github.com/keycloak/keycloak/discussions/9270).
 - Each language requires **two volunteers**
@@ -66,7 +140,19 @@ If you have any questions or need assistance, feel free to reach out to the lang
     - enable the specific language
     - invite the two volunteers
     - comment on discussion thread, that the language has been enabled
-- Weblate synchronizes daily, so it may take up to 24 hours after enabling the language before you can start your first translations 
-
-### Translation status
-[![Translation status](https://hosted.weblate.org/widget/keycloak/multi-auto.svg)](https://hosted.weblate.org/engage/keycloak/)
\ No newline at end of file
+- Weblate synchronizes daily, so it may take up to 24 hours after enabling the language before you can start your first translations
+
+## Weblate Translation status
+
+| Language                                                                     | Account UI                                                                                       | Admin UI                                                                                       | Theme base/account                                                                                      | Theme base/admin                                                                                      | Theme base/email                                                                                      | Theme base/login                                                                                      | Overall                                                                                 |
+|------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
+| [German](https://hosted.weblate.org/projects/keycloak/-/de/)                 | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/de/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/de/svg-badge.svg)    |
+| [Dutch](https://hosted.weblate.org/projects/keycloak/-/nl/)                  | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/nl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/nl/svg-badge.svg)    |
+| [Japanese](https://hosted.weblate.org/projects/keycloak/-/ja/)               | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/ja/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/ja/svg-badge.svg)    |
+| [Catalan](https://hosted.weblate.org/projects/keycloak/-/ca/)                | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/ca/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/ca/svg-badge.svg)    |
+| [Spanish](https://hosted.weblate.org/projects/keycloak/-/es/)                | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/es/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/es/svg-badge.svg)    |
+| [Slovenian](https://hosted.weblate.org/projects/keycloak/-/sl/)              | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/sl/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/sl/svg-badge.svg)    |
+| [Italian](https://hosted.weblate.org/projects/keycloak/-/it/)                | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/it/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/it/svg-badge.svg)    |
+| [Romanian](https://hosted.weblate.org/projects/keycloak/-/ro/)               | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/ro/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/ro/svg-badge.svg)    |
+| [Portuguese (Brazil)](https://hosted.weblate.org/projects/keycloak/-/pt_BR/) | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/pt_BR/svg-badge.svg) | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/pt_BR/svg-badge.svg) |
+| [French](https://hosted.weblate.org/projects/keycloak/-/fr/)                 | ![Translation status](https://hosted.weblate.org/widget/keycloak/account-ui/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/admin-ui/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseaccount/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseadmin/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baseemail/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/theme-baselogin/fr/svg-badge.svg)    | ![Translation status](https://hosted.weblate.org/widget/keycloak/-/fr/svg-badge.svg)    |
diff --git a/federation/ipatuura/README.md b/federation/ipatuura/README.md
index 7b9608488967..f9c3c2e88a8d 100644
--- a/federation/ipatuura/README.md
+++ b/federation/ipatuura/README.md
@@ -9,7 +9,7 @@ In this `README` we will explain how to setup the Ipa-Tuura keycloak federation
 In our setup we will be using a Samba AD image to setup a directory service for realm `KEYCLOAK.ORG`:
 
 ```
-$ docker run -d --privileged  --restart=unless-stopped --network=host -e REALM='KEYCLOAK.ORG' -e DOMAIN='KEYCLOAK' -e ADMIN_PASS='Passw0rd' -e DNS_FORWARDER='8.8.8.8' -v dc1_etc:/usr/local/samba/etc -v dc1_private:/usr/local/samba/private -v dc1_var:/usr/local/samba/var --name dc1 --hostname DC1 diegogslomp/samba-ad-d
+$ docker run -d --privileged  --restart=unless-stopped --network=host -e REALM='KEYCLOAK.ORG' -e DOMAIN='KEYCLOAK' -e ADMIN_PASS='Passw0rd' -e DNS_FORWARDER='8.8.8.8' -v dc1_etc:/usr/local/samba/etc -v dc1_private:/usr/local/samba/private -v dc1_var:/usr/local/samba/var --name dc1 --hostname DC1 diegogslomp/samba-ad-dc
 ```
 
 Once the container is running, we need to add an entry to the host's `/etc/hosts` pointing to the AD container:
@@ -172,12 +172,18 @@ The `integrationdomain.json` file looks like this:
    "id_provider": "ad",
    "user_extra_attrs": "mail:mail, sn:sn, givenname:givenname",
    "user_object_classes": "user,organizationalPerson,person,top",
-   "users_dn": "CN=Keycloak,CN=Users,DC=keycloak,DC=org",
+   "users_dn": "CN=Users,DC=keycloak,DC=org",
    "ldap_tls_cacert": "/etc/openldap/certs/cacert.pem",
    "keycloak_hostname": "keycloak.ipa.test"
 }
 ```
 
+Check to verify the integration domain was added with:
+
+```
+$ curl -k -X GET "https://ipa-bridge.keycloak.org/domains/v1/domain/" -H "accept:application/json" -H "X-CSRFToken: x1yU9RGPKs4mJdWIOzEc7wKbwbnJ0B6iTHuW6ja0gdBpEOBVacK1vIhSSYlfsnRw"
+```
+
 ### Important observations:
 1- `"name"` must match the AD domain name (i.e. `keycloak.org`)
 
@@ -187,12 +193,24 @@ The `integrationdomain.json` file looks like this:
 
 4- `"keycloak_hostname"` must resolve to the host running keycloak (see step above to ensure it was added to `/etc/hosts`)
 
+## Setup outgoing certificates
+
+Retrieve the certificate from the bridge and add it to a keystore file.
+
+```
+$ openssl s_client -connect bridge.ipa.test:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /opt/keycloak/bridge.crt
+
+$ keytool -importcert -alias bridge -file /opt/keycloak/bridge.crt -keystore /opt/keycloak/keystore.jks -trustcacerts -storepass redhat -noprompt
+```
+
+The `/opt/keycloak/keystore.jks` keystore file must be copied to the keycloak system or container.
+
 ## Setup the IPA-Tuura user federation in keycloak
 
-First start keycloak with the `ipa-tuura-federation` feature enabled:
+First start keycloak with the `ipa-tuura-federation` feature enabled and truststore arguments:
 
 ```
-$ ./kc.sh start-dev --features=ipa-tuura-federation
+$ ./kc.sh start-dev --features=ipa-tuura-federation --spi-truststore-file-file=/opt/keycloak/keystore.jks --spi-truststore-file-password=redhat --spi-truststore-file-hostname-verification-policy=ANY
 ```
 
 Log into the admin console, go to `User Federation`, then click on `Add new provider` and select `Ipatuura`
diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
index 2840b20b19fa..50be732a4b0e 100755
--- a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
@@ -19,6 +19,7 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.common.Profile;
+import org.keycloak.common.Profile.Feature;
 import org.keycloak.common.constants.KerberosConstants;
 import org.keycloak.credential.CredentialAuthentication;
 import org.keycloak.credential.CredentialInput;
@@ -31,10 +32,12 @@
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserManager;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.storage.ReadOnlyException;
 import org.keycloak.storage.UserStoragePrivateUtil;
@@ -289,7 +292,7 @@ protected UserModel importUserToKeycloak(RealmModel realm, KerberosPrincipal ker
         user.setSingleAttribute(KERBEROS_PRINCIPAL, kerberosPrincipal.toString());
 
         if (kerberosConfig.isUpdateProfileFirstLogin()) {
-            if (Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL)) {
+            if (isUpdateEmailEnabled(realm)) {
                 user.addRequiredAction(UserModel.RequiredAction.UPDATE_EMAIL);
             }
             user.addRequiredAction(UserModel.RequiredAction.UPDATE_PROFILE);
@@ -298,6 +301,16 @@ protected UserModel importUserToKeycloak(RealmModel realm, KerberosPrincipal ker
         return validate(realm, user);
     }
 
+    private static boolean isUpdateEmailEnabled(RealmModel realm) {
+        if (!Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL)) {
+            return false;
+        }
+
+        RequiredActionProviderModel model = realm.getRequiredActionProviderByAlias(RequiredAction.UPDATE_EMAIL.name());
+
+        return model != null && model.isEnabled();
+    }
+
     @Override
     public String toString() {
         return "KerberosFederationProvider - " + model.getName();
diff --git a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesRealmAdminProvider.java b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesRealmAdminProvider.java
index 5cd1058388a3..2399d764f632 100644
--- a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesRealmAdminProvider.java
+++ b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class LdapServerCapabilitiesRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider {
 
diff --git a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesResource.java b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesResource.java
index caadac66e1c3..9e6be154553d 100644
--- a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesResource.java
+++ b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/LdapServerCapabilitiesResource.java
@@ -24,7 +24,7 @@
 import org.keycloak.representations.idm.TestLdapConnectionRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.managers.LDAPServerCapabilitiesManager;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.POST;
diff --git a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionRealmAdminProvider.java b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionRealmAdminProvider.java
index e330cd4a2127..6654df2b45dd 100644
--- a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionRealmAdminProvider.java
+++ b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class TestLdapConnectionRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider {
 
diff --git a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionResource.java b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionResource.java
index d0e52dd0bb0d..ef521fed163d 100644
--- a/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionResource.java
+++ b/federation/ldap/src/main/java/org/keycloak/services/resources/admin/TestLdapConnectionResource.java
@@ -23,7 +23,7 @@
 import org.keycloak.representations.idm.TestLdapConnectionRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.managers.LDAPServerCapabilitiesManager;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.FormParam;
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java
index c9eac258940a..91d5a9a0ca1c 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java
@@ -79,6 +79,15 @@ public String getUsersDn() {
         return usersDn;
     }
 
+    public String getRelativeCreateDn() {
+        String relativeCreateDn = config.getFirst(LDAPConstants.RELATIVE_CREATE_DN);
+        if(relativeCreateDn != null) {
+            relativeCreateDn = relativeCreateDn.trim();
+            return relativeCreateDn.endsWith(",") ? relativeCreateDn : relativeCreateDn + ",";
+        }
+        return "";
+    }
+
     public String getBaseDn() {
         return config.getFirst(LDAPConstants.BASE_DN);
     }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java
index c6b7087c0bfd..19273ba37e22 100755
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java
@@ -45,6 +45,7 @@
 import org.keycloak.credential.CredentialInput;
 import org.keycloak.credential.CredentialInputUpdater;
 import org.keycloak.credential.CredentialInputValidator;
+import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.UserCredentialManager;
 import org.keycloak.federation.kerberos.KerberosPrincipal;
 import org.keycloak.federation.kerberos.impl.KerberosUsernamePasswordAuthenticator;
@@ -101,6 +102,8 @@
 import org.keycloak.userprofile.UserProfileUtil;
 
 import org.keycloak.utils.StreamsUtil;
+import org.keycloak.utils.StringUtil;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -117,6 +120,7 @@ public class LDAPStorageProvider implements UserStorageProvider,
         UserProfileDecorator {
     private static final Logger logger = Logger.getLogger(LDAPStorageProvider.class);
     private static final int DEFAULT_MAX_RESULTS = Integer.MAX_VALUE >> 1;
+    public static final List<String> INTERNAL_ATTRIBUTES = List.of(UserModel.LOCALE);
 
     protected LDAPStorageProviderFactory factory;
     protected KeycloakSession session;
@@ -353,8 +357,11 @@ public boolean removeUser(RealmModel realm, UserModel user) {
 
         LDAPObject ldapObject = loadAndValidateUser(realm, user);
         if (ldapObject == null) {
-            logger.warnf("User '%s' can't be deleted from LDAP as it doesn't exist here", user.getUsername());
-            return false;
+            if (model.isRemoveInvalidUsersEnabled()) {
+                logger.warnf("User '%s' can't be deleted from LDAP as it doesn't exist here", user.getUsername());
+                return false;
+            }
+            return true;
         }
 
         ldapIdentityStore.remove(ldapObject);
@@ -660,15 +667,8 @@ protected UserModel importUserFromLDAP(KeycloakSession session, RealmModel realm
 
     private void doImportUser(final RealmModel realm, final UserModel user, final LDAPObject ldapUser) {
         user.setEnabled(true);
-        realm.getComponentsStream(model.getId(), LDAPStorageMapper.class.getName())
-                .sorted(ldapMappersComparator.sortDesc())
-                .forEachOrdered(mapperModel -> {
-                    if (logger.isTraceEnabled()) {
-                        logger.tracef("Using mapper %s during import user from LDAP", mapperModel);
-                    }
-                    LDAPStorageMapper ldapMapper = mapperManager.getMapper(mapperModel);
-                    ldapMapper.onImportUserFromLDAP(ldapUser, user, realm, true);
-                });
+
+        importUserAttributes(realm, user, ldapUser);
 
         String userDN = ldapUser.getDn().toString();
         if (model.isImportEnabled()) user.setFederationLink(model.getId());
@@ -777,6 +777,7 @@ public UserModel getUserByEmail(RealmModel realm, String email) {
             LDAPUtils.checkUuid(ldapUser, ldapIdentityStore.getConfig());
             // If email attribute mapper is set to "Always Read Value From LDAP" the user may be in Keycloak DB with an old email address
             if (ldapUser.getUuid().equals(user.getFirstAttribute(LDAPConstants.LDAP_ID))) {
+                importUserAttributes(realm, user, ldapUser);
                 return proxy(realm, user, ldapUser, false);
             }
             throw new ModelDuplicateException("User with username '" + ldapUsername + "' already exists in Keycloak. It conflicts with LDAP user with email '" + email + "'");
@@ -1195,9 +1196,54 @@ public List<AttributeMetadata> decorateUserProfile(String providerId, UserProfil
         // 3 - make all attributes read-only for LDAP users in case that LDAP itself is read-only
         if (getEditMode() == EditMode.READ_ONLY) {
             Stream.concat(metadata.getAttributes().stream(), metadatas.stream())
+                    .filter((m) -> !INTERNAL_ATTRIBUTES.contains(m.getName()))
                     .forEach(attrMetadata -> attrMetadata.addWriteCondition(AttributeMetadata.ALWAYS_FALSE));
         }
 
         return metadatas;
     }
+
+    @Override
+    public Stream<CredentialModel> getCredentials(RealmModel realm, UserModel user) {
+        LDAPObject ldapObject = loadLDAPUserByUuid(realm, user.getFirstAttribute(LDAPConstants.LDAP_ID));
+
+        if (ldapObject == null) {
+            LDAPConfig config = getLdapIdentityStore().getConfig();
+            throw new IllegalStateException("LDAP object not found for user with attribute [" + config.getUuidLDAPAttributeName() + "] and value [" + user.getFirstAttribute(LDAPConstants.LDAP_ID) + "]");
+        }
+
+        CredentialModel credential = new CredentialModel();
+
+        credential.setType(PasswordCredentialModel.TYPE);
+        credential.setFederationLink(model.getId());
+        credential.setCreatedDate(getPasswordChangedTime(ldapObject));
+
+        return Stream.of(credential);
+    }
+
+    private long getPasswordChangedTime(LDAPObject ldapObject) {
+        String attributeName = getLdapIdentityStore().getPasswordModificationTimeAttributeName();
+        String value = ldapObject.getAttributeAsString(attributeName);
+
+        if (StringUtil.isBlank(value)) {
+            return -1L;
+        }
+
+        if (LDAPConstants.PWD_LAST_SET.equals(attributeName)) {
+            return (Long.parseLong(value) / 10000L) - 11644473600000L;
+        }
+        return LDAPUtils.generalizedTimeToDate(value).getTime();
+    }
+
+    private void importUserAttributes(RealmModel realm, UserModel user, LDAPObject ldapUser) {
+        realm.getComponentsStream(model.getId(), LDAPStorageMapper.class.getName())
+                .sorted(ldapMappersComparator.sortDesc())
+                .forEachOrdered(mapperModel -> {
+                    if (logger.isTraceEnabled()) {
+                        logger.tracef("Using mapper %s during import user from LDAP", mapperModel);
+                    }
+                    LDAPStorageMapper ldapMapper = mapperManager.getMapper(mapperModel);
+                    ldapMapper.onImportUserFromLDAP(ldapUser, user, realm, true);
+                });
+    }
 }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java
index 87c8fbb6bcb1..a6dacb20d2db 100755
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java
@@ -137,6 +137,9 @@ private static List<ProviderConfigProperty> getConfigProps(ComponentModel parent
                 .property().name(LDAPConstants.USERS_DN)
                 .type(ProviderConfigProperty.STRING_TYPE)
                 .add()
+                .property().name(LDAPConstants.RELATIVE_CREATE_DN)
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add()
                 .property().name(LDAPConstants.AUTH_TYPE)
                 .type(ProviderConfigProperty.STRING_TYPE)
                 .defaultValue("simple")
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPUtils.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPUtils.java
index 5f51340dfe0b..63d7e70abdaa 100755
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPUtils.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPUtils.java
@@ -18,7 +18,9 @@
 package org.keycloak.storage.ldap;
 
 import java.lang.reflect.Method;
+import java.util.Calendar;
 import java.util.Collection;
+import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedList;
@@ -26,6 +28,7 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.TimeZone;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
 
@@ -110,6 +113,12 @@ public static LDAPObject addUserToLDAP(LDAPStorageProvider ldapProvider, RealmMo
                 .collect(Collectors.toSet());
         mandatoryAttrs.add(ldapConfig.getRdnLdapAttribute());
 
+        String passwordModifiedTimeAttributeName = ldapStore.getPasswordModificationTimeAttributeName();
+        String passwordModifiedTime = user.getFirstAttribute(passwordModifiedTimeAttributeName);
+        if (passwordModifiedTime != null) {
+            ldapUser.setSingleAttribute(passwordModifiedTimeAttributeName, passwordModifiedTime);
+        }
+
         ldapUser.executeOnMandatoryAttributesComplete(mandatoryAttrs, ldapObject -> {
             LDAPUtils.computeAndSetDn(ldapConfig, ldapObject);
             ldapStore.add(ldapObject);
@@ -144,6 +153,13 @@ public static LDAPQuery createQueryForUserSearch(LDAPStorageProvider ldapProvide
             ldapQuery.addReturningReadOnlyLdapAttribute(kerberosPrincipalAttr);
         }
 
+        if (config.isActiveDirectory()) {
+            ldapQuery.addReturningLdapAttribute(LDAPConstants.PWD_LAST_SET);
+        } else {
+            // https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy
+            ldapQuery.addReturningLdapAttribute(LDAPConstants.PWD_CHANGED_TIME);
+        }
+
         return ldapQuery;
     }
 
@@ -155,7 +171,7 @@ public static void computeAndSetDn(LDAPConfig config, LDAPObject ldapUser) {
             throw new ModelException("RDN Attribute [" + rdnLdapAttrName + "] is not filled. Filled attributes: " + ldapUser.getAttributes());
         }
 
-        LDAPDn dn = LDAPDn.fromString(config.getUsersDn());
+        LDAPDn dn = LDAPDn.fromString(config.getRelativeCreateDn() + config.getUsersDn());
         dn.addFirst(rdnLdapAttrName, rdnLdapAttrValue);
         ldapUser.setDn(dn);
     }
@@ -300,8 +316,8 @@ public static List<LDAPObject> loadAllLDAPObjects(LDAPQuery ldapQuery, LDAPStora
      * @return
      */
     public static List<LDAPObject> loadAllLDAPObjects(LDAPQuery ldapQuery, LDAPConfig ldapConfig) {
-        boolean pagination = ldapConfig.isPagination();
-        if (pagination) {
+
+        if (ldapConfig.isPagination() && ldapConfig.getBatchSizeForSync() > 0) {
             // For now reuse globally configured batch size in LDAP provider page
             int pageSize = ldapConfig.getBatchSizeForSync();
 
@@ -409,4 +425,49 @@ public static String getDefaultKerberosUserPrincipalAttribute(String vendor) {
 
         return KerberosConstants.KERBEROS_PRINCIPAL_LDAP_ATTRIBUTE_KRB5_PRINCIPAL_NAME;
     }
+
+    /**
+     * Convert Generalized Time as defined in RFC4517 to the Date
+     */
+    static Date generalizedTimeToDate(String generalized) {
+
+        String[] parts = generalized.split("[Z+-]");
+        String[] timeFraction = parts[0].split("[.,]");
+        String time = timeFraction[0];
+
+        Calendar calendar = Calendar.getInstance();
+        calendar.setTimeInMillis(0);
+        calendar.setLenient(false);
+
+        calendar.set(Calendar.YEAR, Integer.parseInt(time.substring(0, 4)));
+        calendar.set(Calendar.MONTH, Integer.parseInt(time.substring(4, 6)) - 1);
+        calendar.set(Calendar.DAY_OF_MONTH, Integer.parseInt(time.substring(6, 8)));
+        calendar.set(Calendar.HOUR_OF_DAY, Integer.parseInt(time.substring(8, 10)));
+        if (time.length() >= 12) calendar.set(Calendar.MINUTE, Integer.parseInt(time.substring(10, 12)));
+        if (time.length() >= 14) calendar.set(Calendar.SECOND, Integer.parseInt(time.substring(12, 14)));
+
+        // fraction
+        if (timeFraction.length >= 2) {
+            double fraction = Double.parseDouble("0." + timeFraction[1]);
+            if (time.length() >= 14) { // fraction of second
+                calendar.set(Calendar.MILLISECOND, (int) Math.round(fraction * 1000));
+            } else if (time.length() >= 12) { // fraction of minute
+                calendar.set(Calendar.SECOND, (int) Math.round(fraction * 60));
+            } else { // fraction of hour
+                calendar.set(Calendar.MINUTE, (int) Math.round(fraction * 60));
+            }
+        }
+
+        // timezone
+        if (generalized.length() > parts[0].length()) {
+            char delimiter = generalized.charAt(parts[0].length());
+            if (delimiter == 'Z') {
+                calendar.setTimeZone(TimeZone.getTimeZone("GMT"));
+            } else {
+                calendar.setTimeZone(TimeZone.getTimeZone("GMT" + delimiter + parts[1]));
+            }
+        }
+
+        return calendar.getTime();
+    }
 }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/ReadonlyLDAPUserModelDelegate.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/ReadonlyLDAPUserModelDelegate.java
index 47c24adc804b..45978e17ac08 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/ReadonlyLDAPUserModelDelegate.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/ReadonlyLDAPUserModelDelegate.java
@@ -17,7 +17,8 @@
 
 package org.keycloak.storage.ldap;
 
-import java.util.Collections;
+import static org.keycloak.storage.ldap.LDAPStorageProvider.INTERNAL_ATTRIBUTES;
+
 import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
@@ -69,13 +70,15 @@ public void setEmail(String email) {
 
     @Override
     public void setSingleAttribute(String name, String value) {
-        if (!Objects.equals(getAttributeStream(name).collect(Collectors.toList()), Collections.singletonList(value))) {
-            throw new ReadOnlyException("Federated storage is not writable");
-        }
+        setAttribute(name, List.of(value));
     }
 
     @Override
     public void setAttribute(String name, List<String> values) {
+        if (INTERNAL_ATTRIBUTES.contains(name)) {
+            super.setAttribute(name, values);
+            return;
+        }
         if (!Objects.equals(getAttributeStream(name).collect(Collectors.toList()), values)) {
             throw new ReadOnlyException("Federated storage is not writable");
         }
@@ -83,6 +86,10 @@ public void setAttribute(String name, List<String> values) {
 
     @Override
     public void removeAttribute(String name) {
+        if (INTERNAL_ATTRIBUTES.contains(name)) {
+            super.removeAttribute(name);
+            return;
+        }
         if (getAttributeStream(name).count() > 0) {
             throw new ReadOnlyException("Federated storage is not writable");
         }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java
index 93f2d6c9c864..f409a9ec026c 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java
@@ -11,7 +11,6 @@
 import javax.naming.AuthenticationException;
 import javax.naming.Context;
 import javax.naming.NamingException;
-import javax.naming.ldap.InitialLdapContext;
 import javax.naming.ldap.LdapContext;
 import javax.naming.ldap.StartTlsRequest;
 import javax.naming.ldap.StartTlsResponse;
@@ -78,7 +77,7 @@ private void createLdapContext() throws NamingException {
                 connProp.put(LDAPConstants.CONNECTION_TRACE_BER, System.err);
             }
 
-            ldapContext = new InitialLdapContext(connProp, null);
+            ldapContext = new SessionBoundInitialLdapContext(session, connProp, null);
             if (ldapConfig.isStartTls()) {
                 SSLSocketFactory sslSocketFactory = null;
                 if (LDAPUtil.shouldUseTruststoreSpi(ldapConfig)) {
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java
index d0016d9f4380..386deda4fb3d 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPIdentityStore.java
@@ -524,6 +524,13 @@ protected BasicAttributes extractAttributesForSaving(LDAPObject ldapObject, bool
                 .map(String::toLowerCase)
                 .collect(Collectors.toSet());
 
+        if (!isCreate) {
+            // for updates, assume the PWD_CHANGED_TIME attribute is an operational attribute and read-only
+            // otherwise, updates will fail when trying to modify the attribute
+            // vendors like AD, support the same type of attribute differently and using a mapper
+            ldapObject.addReadOnlyAttributeName(LDAPConstants.PWD_CHANGED_TIME);
+        }
+
         for (Map.Entry<String, Set<String>> attrEntry : ldapObject.getAttributes().entrySet()) {
             String attrName = attrEntry.getKey();
             Set<String> attrValue = attrEntry.getValue();
@@ -602,4 +609,8 @@ private BasicAttribute createBinaryBasicAttribute(String attrName, Set<String> a
         return attr;
     }
 
+    public String getPasswordModificationTimeAttributeName() {
+        return getConfig().isActiveDirectory() ? LDAPConstants.PWD_LAST_SET : LDAPConstants.PWD_CHANGED_TIME;
+    }
+
 }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/SessionBoundInitialLdapContext.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/SessionBoundInitialLdapContext.java
new file mode 100644
index 000000000000..61025f3c84ba
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/SessionBoundInitialLdapContext.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.ldap.idm.store.ldap;
+
+import org.keycloak.models.KeycloakSession;
+
+import javax.naming.NamingException;
+import javax.naming.ldap.Control;
+import javax.naming.ldap.InitialLdapContext;
+import java.util.Hashtable;
+
+/**
+ * A {@link InitialLdapContext} that binds instances of this class with the {@link KeycloakSession} so that any resource
+ * acquired during the session lifetime is closed when the session is closed.
+ */
+public final class SessionBoundInitialLdapContext extends InitialLdapContext {
+
+    public SessionBoundInitialLdapContext(KeycloakSession session, Hashtable<?, ?> environment, Control[] connCtls) throws NamingException {
+        super(environment, connCtls);
+        session.enlistForClose(() -> {
+                try {
+                    close();
+                } catch (NamingException e) {
+                    failedToCloseLdapContext(e);
+                }
+        });
+    }
+
+    private void failedToCloseLdapContext(NamingException e) {
+        throw new RuntimeException("Failed to close LDAP context", e);
+    }
+}
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/UserAttributeLDAPStorageMapper.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/UserAttributeLDAPStorageMapper.java
index ee5f85fef9bd..6eda0797c4b3 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/UserAttributeLDAPStorageMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/UserAttributeLDAPStorageMapper.java
@@ -164,6 +164,12 @@ protected void checkDuplicateEmail(String userModelAttrName, String email, Realm
             email = KeycloakModelUtils.toLowerCaseSafe(email);
 
             UserModel that = UserStoragePrivateUtil.userLocalStorage(session).getUserByEmail(realm, email);
+
+            if (that != null) {
+                // delete and invalidate the cache for any existing account no longer available from LDAP
+                that = session.users().getUserByEmail(realm, that.getEmail());
+            }
+
             if (that != null && !that.getId().equals(user.getId())) {
                 session.getTransactionManager().setRollbackOnly();
                 String exceptionMessage = String.format("Can't import user '%s' from LDAP because email '%s' already exists in Keycloak. Existing user with this email is '%s'", user.getUsername(), email, that.getUsername());
@@ -282,6 +288,22 @@ public void setEmailVerified(boolean verified) {
                     super.setEmailVerified(verified);
                 }
 
+                @Override
+                public String getUsername() {
+                    if (UserModel.USERNAME.equals(userModelAttrName)) {
+                        return ldapUser.getAttributeAsString(ldapAttrName);
+                    }
+                    return super.getUsername();
+                }
+
+                @Override
+                public String getEmail() {
+                    if (UserModel.EMAIL.equals(userModelAttrName)) {
+                        return ldapUser.getAttributeAsString(ldapAttrName);
+                    }
+                    return super.getEmail();
+                }
+
                 protected boolean setLDAPAttribute(String modelAttrName, Object value) {
                     if (modelAttrName.equalsIgnoreCase(userModelAttrName)) {
                         if (UserAttributeLDAPStorageMapper.logger.isTraceEnabled()) {
@@ -500,11 +522,18 @@ protected void setPropertyOnUserModel(Property<Object> userModelProperty, UserMo
             userModelProperty.setValue(user, null);
         } else {
             Class<Object> clazz = userModelProperty.getJavaClass();
+            Object currentValue = userModelProperty.getValue(user);
 
             if (String.class.equals(clazz)) {
+                if (ldapAttrValue.equals(currentValue)) {
+                    return;
+                }
                 userModelProperty.setValue(user, ldapAttrValue);
             } else if (Boolean.class.equals(clazz) || boolean.class.equals(clazz)) {
                 Boolean boolVal = Boolean.valueOf(ldapAttrValue);
+                if (boolVal.equals(currentValue)) {
+                    return;
+                }
                 userModelProperty.setValue(user, boolVal);
             } else {
                 logger.warnf("Don't know how to set the property '%s' on user '%s' . Value of LDAP attribute is '%s' ", userModelProperty.getName(), user.getUsername(), ldapAttrValue.toString());
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/UserRolesRetrieveStrategy.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/UserRolesRetrieveStrategy.java
index 06f53e15a7d3..dee4b03fe294 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/UserRolesRetrieveStrategy.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/UserRolesRetrieveStrategy.java
@@ -19,6 +19,8 @@
 
 
 import org.keycloak.models.LDAPConstants;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
 import org.keycloak.storage.ldap.LDAPConfig;
 import org.keycloak.storage.ldap.LDAPUtils;
 import org.keycloak.storage.ldap.idm.model.LDAPDn;
@@ -26,9 +28,9 @@
 import org.keycloak.storage.ldap.idm.query.Condition;
 import org.keycloak.storage.ldap.idm.query.internal.LDAPQuery;
 import org.keycloak.storage.ldap.idm.query.internal.LDAPQueryConditionsBuilder;
+import org.keycloak.utils.StreamsUtil;
 
 import java.util.Collections;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
 
@@ -42,6 +44,8 @@ public interface UserRolesRetrieveStrategy {
 
     List<LDAPObject> getLDAPRoleMappings(CommonLDAPGroupMapper roleOrGroupMapper, LDAPObject ldapUser, LDAPConfig ldapConfig);
 
+    List<UserModel> getLDAPRoleMembers(RealmModel realm, CommonLDAPGroupMapper roleOrGroupMapper, LDAPObject ldapRoleOrGroup, int firstResult, int maxResults);
+
     void beforeUserLDAPQuery(CommonLDAPGroupMapper roleOrGroupMapper, LDAPQuery query);
 
 
@@ -67,6 +71,12 @@ public List<LDAPObject> getLDAPRoleMappings(CommonLDAPGroupMapper roleOrGroupMap
             }
         }
 
+        @Override
+        public List<UserModel> getLDAPRoleMembers(RealmModel realm, CommonLDAPGroupMapper roleOrGroupMapper, LDAPObject ldapRoleOrGroup, int firstResult, int maxResults) {
+            MembershipType membershipType = roleOrGroupMapper.getConfig().getMembershipTypeLdapAttribute();
+            return membershipType.getGroupMembers(realm, roleOrGroupMapper, ldapRoleOrGroup, firstResult, maxResults);
+        }
+
         @Override
         public void beforeUserLDAPQuery(CommonLDAPGroupMapper roleOrGroupMapper, LDAPQuery query) {
         }
@@ -78,39 +88,44 @@ protected Condition getMembershipCondition(String membershipAttr, String userMem
     };
 
     /**
-     * Roles of user will be retrieved from "memberOf" attribute of our user
+     * Roles of user will be loaded from LDAP based on "memberOf" attribute of our user
      */
     class GetRolesFromUserMemberOfAttribute implements UserRolesRetrieveStrategy {
 
         @Override
         public List<LDAPObject> getLDAPRoleMappings(CommonLDAPGroupMapper roleOrGroupMapper, LDAPObject ldapUser, LDAPConfig ldapConfig) {
-            String memberOfLdapAttrName = roleOrGroupMapper.getConfig().getMemberOfLdapAttribute();
-
-            Set<String> memberOfValues = ldapUser.getAttributeAsSet(memberOfLdapAttrName);
-            if (memberOfValues == null) {
+            Set<String> memberOfValues = ldapUser.getAttributeAsSet(roleOrGroupMapper.getConfig().getMemberOfLdapAttribute());
+            if (memberOfValues == null || memberOfValues.isEmpty()) {
                 return Collections.emptyList();
             }
 
-            List<LDAPObject> roles = new LinkedList<>();
-            LDAPDn parentDn = LDAPDn.fromString(roleOrGroupMapper.getConfig().getLDAPGroupsDn());
-
-            for (String roleDn : memberOfValues) {
-                LDAPDn roleDN = LDAPDn.fromString(roleDn);
-                if (roleDN.isDescendantOf(parentDn)) {
-                    LDAPObject role = new LDAPObject();
-                    role.setDn(roleDN);
-
-                    LDAPDn.RDN firstRDN = roleDN.getFirstRdn();
-                    String attrKey = roleOrGroupMapper.getConfig().getLDAPGroupNameLdapAttribute();
-                    String attrVal = firstRDN.getAttrValue(attrKey);
-                    if (attrVal != null) {
-                        role.setRdnAttributeName(attrKey);
-                        role.setSingleAttribute(attrKey, attrVal);
-                        roles.add(role);
-                    }
+            try (LDAPQuery ldapQuery = roleOrGroupMapper.createLDAPGroupQuery()) {
+
+                String rdnAttr = roleOrGroupMapper.getConfig().getLDAPGroupNameLdapAttribute();
+                LDAPQueryConditionsBuilder conditionBuilder = new LDAPQueryConditionsBuilder();
+
+                // load only those groups/roles the user is memberOf
+                // we do this by query to apply defined custom filters
+                final Condition[] conditions = memberOfValues.stream()
+                        .map(LDAPDn::fromString)
+                        .filter(roleDN -> roleDN.isDescendantOf(LDAPDn.fromString(roleOrGroupMapper.getConfig().getLDAPGroupsDn())))
+                        .map(roleDN -> conditionBuilder.equal(rdnAttr, roleDN.getFirstRdn().getAttrValue(rdnAttr)))
+                        .toArray(Condition[]::new);
+                if (conditions.length > 0) {
+                    ldapQuery.addWhereCondition(conditionBuilder.orCondition(conditions));
                 }
+
+                return LDAPUtils.loadAllLDAPObjects(ldapQuery, ldapConfig);
             }
-            return roles;
+        }
+
+        @Override
+        public List<UserModel> getLDAPRoleMembers(RealmModel realm, CommonLDAPGroupMapper roleOrGroupMapper, LDAPObject ldapRoleOrGroup, int firstResult, int maxResults) {
+            String memberOfLdapAttrName = roleOrGroupMapper.getConfig().getMemberOfLdapAttribute();
+            String roleOrGroupDn = ldapRoleOrGroup.getDn().toString();
+            return StreamsUtil.paginatedStream(
+                    roleOrGroupMapper.getLdapProvider().searchForUserByUserAttributeStream(realm, memberOfLdapAttrName, roleOrGroupDn), firstResult, maxResults)
+                    .toList();
         }
 
         @Override
@@ -129,6 +144,7 @@ public void beforeUserLDAPQuery(CommonLDAPGroupMapper roleOrGroupMapper, LDAPQue
      */
     class LoadRolesByMemberRecursively extends LoadRolesByMember {
 
+        @Override
         protected Condition getMembershipCondition(String membershipAttr, String userMembership) {
             return new LDAPQueryConditionsBuilder().equal(membershipAttr + LDAPConstants.LDAP_MATCHING_RULE_IN_CHAIN, userMembership);
         }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapper.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapper.java
index 0202ae2a1af8..f0cab4bfa4f8 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapper.java
@@ -127,7 +127,7 @@ public LDAPQuery createGroupQuery(boolean includeMemberAttribute) {
 
     public LDAPObject createLDAPGroup(String groupName, Map<String, Set<String>> additionalAttributes) {
         LDAPObject ldapGroup = LDAPUtils.createLDAPGroup(ldapProvider, groupName, config.getGroupNameLdapAttribute(), config.getGroupObjectClasses(ldapProvider),
-                config.getGroupsDn(), additionalAttributes, config.getMembershipLdapAttribute());
+                config.getRelativeCreateDn() + config.getGroupsDn(), additionalAttributes, config.getMembershipLdapAttribute());
 
         logger.debugf("Creating group [%s] to LDAP with DN [%s]", groupName, ldapGroup.getDn().toString());
         return ldapGroup;
@@ -580,8 +580,9 @@ public List<UserModel> getGroupMembers(RealmModel realm, GroupModel kcGroup, int
             return Collections.emptyList();
         }
 
-        MembershipType membershipType = config.getMembershipTypeLdapAttribute();
-        return membershipType.getGroupMembers(realm, this, ldapGroup, firstResult, maxResults);
+        String strategyKey = config.getUserGroupsRetrieveStrategy();
+        UserRolesRetrieveStrategy strategy = factory.getUserGroupsRetrieveStrategy(strategyKey);
+        return strategy.getLDAPRoleMembers(realm, this, ldapGroup, firstResult, maxResults);
     }
 
     public void addGroupMappingInLDAP(RealmModel realm, GroupModel kcGroup, LDAPObject ldapUser) {
@@ -806,6 +807,9 @@ protected GroupModel getKcGroupsPathGroup(RealmModel realm) {
     }
 
     protected boolean isGroupInGroupPath(RealmModel realm, GroupModel group) {
+        if (group.getType() == GroupModel.Type.ORGANIZATION) {
+            return false; // always skip organization groups as those are internal groups.
+        }
         if (config.isTopLevelGroupsPath()) {
             return true; // any group is in the path of the top level path.
         }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapperFactory.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapperFactory.java
index b4bab3ddb4bd..68549bf1fb7f 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapperFactory.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapperFactory.java
@@ -98,6 +98,11 @@ private static List<ProviderConfigProperty> getProps(ComponentModel parent) {
                 .type(ProviderConfigProperty.STRING_TYPE)
                 .required(true)
                 .add()
+                .property().name(GroupMapperConfig.GROUPS_RELATIVE_CREATE_DN)
+                .label("Relative creation DN")
+                .helpText("LDAP DN where are groups of this tree will be created relative to the 'LDAP Groups DN' ")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add()
                 .property().name(GroupMapperConfig.GROUP_NAME_LDAP_ATTRIBUTE)
                 .label("Group Name LDAP Attribute")
                 .helpText("Name of LDAP attribute, which is used in group objects for name and RDN of group. Usually it will be 'cn' . In this case typical group/role object may have DN like 'cn=Group1,ou=groups,dc=example,dc=org' ")
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupMapperConfig.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupMapperConfig.java
index f5067a53604d..df7a0dc7f267 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupMapperConfig.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupMapperConfig.java
@@ -35,6 +35,7 @@ public class GroupMapperConfig extends CommonLDAPGroupMapperConfig {
 
     // LDAP DN where are groups of this tree saved.
     public static final String GROUPS_DN = "groups.dn";
+    public static final String GROUPS_RELATIVE_CREATE_DN = "groups.relative.create.dn";
 
     // Name of LDAP attribute, which is used in group objects for name and RDN of group. Usually it will be "cn"
     public static final String GROUP_NAME_LDAP_ATTRIBUTE = "group.name.ldap.attribute";
@@ -79,6 +80,15 @@ public String getGroupsDn() {
         return groupsDn;
     }
 
+    public String getRelativeCreateDn() {
+        String relativeCreateDn = mapperModel.getConfig().getFirst(GROUPS_RELATIVE_CREATE_DN);
+        if(relativeCreateDn != null) {
+            relativeCreateDn = relativeCreateDn.trim();
+            return relativeCreateDn.endsWith(",") ? relativeCreateDn : relativeCreateDn + ",";
+        }
+        return "";
+    }
+
     @Override
     public String getLDAPGroupsDn() {
         return getGroupsDn();
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapper.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapper.java
index ace97227c6b6..ffb9decd0596 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapper.java
@@ -266,7 +266,7 @@ protected RoleContainerModel getTargetRoleContainer(RealmModel realm) {
 
     public LDAPObject createLDAPRole(String roleName) {
         LDAPObject ldapRole = LDAPUtils.createLDAPGroup(ldapProvider, roleName, config.getRoleNameLdapAttribute(), config.getRoleObjectClasses(ldapProvider),
-                config.getRolesDn(), Collections.<String, Set<String>>emptyMap(), config.getMembershipLdapAttribute());
+                config.getRelativeCreateDn() + config.getRolesDn(), Collections.<String, Set<String>>emptyMap(), config.getMembershipLdapAttribute());
 
         logger.debugf("Creating role [%s] to LDAP with DN [%s]", roleName, ldapRole.getDn().toString());
         return ldapRole;
@@ -500,7 +500,8 @@ public List<UserModel> getRoleMembers(RealmModel realm, RoleModel role, int firs
             return Collections.emptyList();
         }
 
-        MembershipType membershipType = config.getMembershipTypeLdapAttribute();
-        return membershipType.getGroupMembers(realm, this, ldapGroup, firstResult, maxResults);
+        String strategyKey = config.getUserRolesRetrieveStrategy();
+        UserRolesRetrieveStrategy strategy = factory.getUserRolesRetrieveStrategy(strategyKey);
+        return strategy.getLDAPRoleMembers(realm, this, ldapGroup, firstResult, maxResults);
     }
 }
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapperFactory.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapperFactory.java
index e6c4acba0684..5c706ccf2681 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapperFactory.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapperFactory.java
@@ -96,6 +96,11 @@ private static List<ProviderConfigProperty> getProps(ComponentModel parent) {
                 .type(ProviderConfigProperty.STRING_TYPE)
                 .required(true)
                 .add()
+                .property().name(RoleMapperConfig.ROLES_RELATIVE_CREATE_DN)
+                .label("Relative creation DN")
+                .helpText("LDAP DN where are roles of this tree will be created relative to the 'LDAP Roles DN' ")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add()
                 .property().name(RoleMapperConfig.ROLE_NAME_LDAP_ATTRIBUTE)
                 .label("Role Name LDAP Attribute")
                 .helpText("Name of LDAP attribute, which is used in role objects for name and RDN of role. Usually it will be 'cn' . In this case typical group/role object may have DN like 'cn=role1,ou=finance,dc=example,dc=org' ")
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleMapperConfig.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleMapperConfig.java
index 0dbb87c4d8a7..57317866f95f 100755
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleMapperConfig.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleMapperConfig.java
@@ -32,6 +32,7 @@ public class RoleMapperConfig extends CommonLDAPGroupMapperConfig {
 
     // LDAP DN where are roles of this tree saved.
     public static final String ROLES_DN = "roles.dn";
+    public static final String ROLES_RELATIVE_CREATE_DN = "roles.relative.create.dn";
 
     // Name of LDAP attribute, which is used in role objects for name and RDN of role. Usually it will be "cn"
     public static final String ROLE_NAME_LDAP_ATTRIBUTE = "role.name.ldap.attribute";
@@ -66,6 +67,15 @@ public String getRolesDn() {
         return rolesDn;
     }
 
+    public String getRelativeCreateDn() {
+        String relativeCreateDn = mapperModel.getConfig().getFirst(ROLES_RELATIVE_CREATE_DN);
+        if(relativeCreateDn != null) {
+            relativeCreateDn = relativeCreateDn.trim();
+            return relativeCreateDn.endsWith(",") ? relativeCreateDn : relativeCreateDn + ",";
+        }
+        return "";
+    }
+
     @Override
     public String getLDAPGroupsDn() {
         return getRolesDn();
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java
index 02030c4b643b..99e050a06254 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java
@@ -38,6 +38,7 @@
 
 import java.util.Objects;
 import java.util.Set;
+import java.util.function.Function;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Stream;
@@ -63,6 +64,14 @@ public class MSADUserAccountControlStorageMapper extends AbstractLDAPStorageMapp
     // See https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
     public static final Set<String> PASSWORD_UPDATE_MSAD_ERROR_CODES = Set.of("52D");
 
+    private final Function<LDAPObject, UserAccountControl> GET_USER_ACCOUNT_CONTROL = ldapUser -> {
+        if (ldapUser == null) {
+            return UserAccountControl.empty();
+        }
+        String userAccountControl = ldapUser.getAttributeAsString(LDAPConstants.USER_ACCOUNT_CONTROL);
+        return UserAccountControl.of(userAccountControl);
+    };
+
     public MSADUserAccountControlStorageMapper(ComponentModel mapperModel, LDAPStorageProvider ldapProvider) {
         super(mapperModel, ldapProvider);
         ldapProvider.setUpdater(this);
@@ -211,9 +220,21 @@ protected ModelException processFailedPasswordUpdateException(ModelException e)
     }
 
     protected UserAccountControl getUserAccountControl(LDAPObject ldapUser) {
-        String userAccountControl = ldapUser.getAttributeAsString(LDAPConstants.USER_ACCOUNT_CONTROL);
-        long longValue = userAccountControl == null ? 0 : Long.parseLong(userAccountControl);
-        return new UserAccountControl(longValue);
+        UserAccountControl control = GET_USER_ACCOUNT_CONTROL.apply(ldapUser);
+
+        if (control.isAnySet()) {
+            return control;
+        }
+
+        RealmModel realm = session.getContext().getRealm();
+
+        if (realm == null) {
+            return control;
+        }
+
+        ldapUser = ldapProvider.loadLDAPUserByUuid(realm, ldapUser.getUuid());
+
+        return GET_USER_ACCOUNT_CONTROL.apply(ldapUser);
     }
 
     // Update user in LDAP if "updateInLDAP" is true. Otherwise it is assumed that LDAP update will be called at the end of transaction
@@ -256,18 +277,20 @@ public boolean isEnabled() {
         @Override
         public void setEnabled(boolean enabled) {
             if (UserStorageProvider.EditMode.WRITABLE.equals(ldapProvider.getEditMode())) {
-                MSADUserAccountControlStorageMapper.logger.debugf("Going to propagate enabled=%s for ldapUser '%s' to MSAD", enabled, ldapUser.getDn().toString());
-
                 UserAccountControl control = getUserAccountControl(ldapUser);
-                if (enabled) {
-                    control.remove(UserAccountControl.ACCOUNTDISABLE);
-                } else {
-                    control.add(UserAccountControl.ACCOUNTDISABLE);
-                }
 
-                markUpdatedAttributeInTransaction(LDAPConstants.ENABLED);
+                if (control.isAnySet()) {
+                    MSADUserAccountControlStorageMapper.logger.debugf("Going to propagate enabled=%s for ldapUser '%s' to MSAD", enabled, ldapUser.getDn().toString());
 
-                updateUserAccountControl(false, ldapUser, control);
+                    if (enabled) {
+                        control.remove(UserAccountControl.ACCOUNTDISABLE);
+                    } else {
+                        control.add(UserAccountControl.ACCOUNTDISABLE);
+                    }
+
+                    markUpdatedAttributeInTransaction(LDAPConstants.ENABLED);
+                    updateUserAccountControl(false, ldapUser, control);
+                }
             }
             // Always update DB
             super.setEnabled(enabled);
diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/UserAccountControl.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/UserAccountControl.java
index 6d24f572e553..4cf2674f1035 100644
--- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/UserAccountControl.java
+++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/UserAccountControl.java
@@ -47,9 +47,22 @@ public class UserAccountControl {
     public static final long TRUSTED_TO_AUTH_FOR_DELEGATION = 0x1000000L;
     public static final long PARTIAL_SECRETS_ACCOUNT = 0x04000000L;
 
+    private static final UserAccountControl EMPTY = new UserAccountControl(0);
+
+    public static UserAccountControl empty() {
+        return EMPTY;
+    }
+
+    public static UserAccountControl of(String userAccountControl) {
+        if (userAccountControl == null) {
+            return empty();
+        }
+        return new UserAccountControl(Long.parseLong(userAccountControl));
+    }
+
     private long value;
 
-    public UserAccountControl(long value) {
+    private UserAccountControl(long value) {
         this.value = value;
     }
 
@@ -72,4 +85,8 @@ public void remove(long feature) {
     public long getValue() {
         return value;
     }
+
+    public boolean isAnySet() {
+        return value != 0;
+    }
 }
diff --git a/federation/sssd/src/main/java/org/keycloak/federation/sssd/impl/PAMAuthenticator.java b/federation/sssd/src/main/java/org/keycloak/federation/sssd/impl/PAMAuthenticator.java
index f9822014c084..cc40fb061210 100644
--- a/federation/sssd/src/main/java/org/keycloak/federation/sssd/impl/PAMAuthenticator.java
+++ b/federation/sssd/src/main/java/org/keycloak/federation/sssd/impl/PAMAuthenticator.java
@@ -55,7 +55,9 @@ public UnixUser authenticate() {
             logger.error("Authentication failed", e);
             e.printStackTrace();
         } finally {
-            pam.dispose();
+            if (pam != null) {
+                pam.dispose();
+            }
         }
         return user;
     }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/CreatedResponseUtil.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/CreatedResponseUtil.java
index 1111783965b1..5125e24708c7 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/CreatedResponseUtil.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/CreatedResponseUtil.java
@@ -17,8 +17,11 @@
 package org.keycloak.admin.client;
 
 import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import java.net.URI;
+import java.util.Map;
 
 /**
  * A Utility class that parses the Response object into the underlying ID attribute
@@ -39,9 +42,29 @@ public static String getCreatedId(Response response) throws WebApplicationExcept
         URI location = response.getLocation();
         if (!response.getStatusInfo().equals(Response.Status.CREATED)) {
             Response.StatusType statusInfo = response.getStatusInfo();
-            throw new WebApplicationException("Create method returned status " +
-                    statusInfo.getReasonPhrase() + " (Code: " + statusInfo.getStatusCode() + "); " +
-                    "expected status: Created (201)", response);
+            String contentType = response.getHeaderString(HttpHeaders.CONTENT_TYPE);
+            String errorMessage = "Create method returned status " +
+                                  statusInfo.getReasonPhrase() + " (Code: " + statusInfo.getStatusCode() + "); " +
+                                  "expected status: Created (201).";
+            try {
+                if (matches(MediaType.APPLICATION_JSON_TYPE, MediaType.valueOf(contentType))) {
+                    // try to add actual server error message to the exception message
+                    @SuppressWarnings("raw")
+                    Map responseBody = response.readEntity(Map.class);
+                    if (responseBody != null) {
+                        if (responseBody.containsKey("errorMessage")) {
+                            errorMessage += " ErrorMessage: " + responseBody.get("errorMessage");
+                        }
+                        if (responseBody.containsKey("error")) {
+                            errorMessage += " Error: " + responseBody.get("error");
+                        }
+                    }
+                }
+            } catch(Exception ignored){
+                // ignore if we couldn't parse the response
+            }
+
+            throw new WebApplicationException(errorMessage, response);
         }
         if (location == null) {
             return null;
@@ -49,4 +72,12 @@ public static String getCreatedId(Response response) throws WebApplicationExcept
         String path = location.getPath();
         return path.substring(path.lastIndexOf('/') + 1);
     }
+
+    private static boolean matches(MediaType a, MediaType b) {
+        if (a == null) {
+            return b == null;
+        } else if (b == null) return false;
+
+        return a.getType().equalsIgnoreCase(b.getType()) && a.getSubtype().equalsIgnoreCase(b.getSubtype());
+    }
 }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/Keycloak.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/Keycloak.java
index 3415791e8d0b..32b1f3d74a3d 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/Keycloak.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/Keycloak.java
@@ -101,39 +101,80 @@ private static Client newRestEasyClient(Object customJacksonProvider, SSLContext
     private BearerAuthFilter newAuthFilter() {
         return authToken != null ? new BearerAuthFilter(authToken) : new BearerAuthFilter(tokenManager);
     }
-    
+
+    /**
+     *
+     * Creates the java admin client instance to be used to call admin REST API against Keycloak server.
+     *
+     * @param serverUrl Keycloak server URL
+     * @param realm realm name
+     * @param username username of the admin user to be used.
+     * @param password password of the admin user
+     * @param clientId client ID
+     * @param clientSecret client secret. Could be left null in case that clientId parameter points to the public client, which does not require client authentication
+     * @param sslContext ssl context. Could be left null in case that default SSL context should be used.
+     * @param customJacksonProvider custom Jackson provider. Could be left null in case that Jackson provider will be automatically provided by the admin client. Please see <a href="https://www.keycloak.org/securing-apps/admin-client#_admin_client_compatibility">the documentation</a> for additional details regarding the compatibility
+     * @param disableTrustManager If to disable trust manager for SSL checks. It is false by default. The value true should be used just for the development purposes, but should not be used in production
+     * @param authToken access token to be used to call admin REST API. This can be left null if you want admin client to login the user (based on the parameters username, password, clientId and clientSecret) and manage it's own login session. But in case you already have existing session, you can inject the existing access token with the use of this parameter. In that case, it is recommended to leave the properties username, password, clientId or clientSecret empty
+     * @param scope Custom "scope" parameter to be used. Could be left null in case of default scope should be used. That is sufficient for most of the cases.
+     * @return Java admin client instance
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret, SSLContext sslContext, Object customJacksonProvider, boolean disableTrustManager, String authToken, String scope) {
         return new Keycloak(serverUrl, realm, username, password, clientId, clientSecret, PASSWORD, newRestEasyClient(customJacksonProvider, sslContext, disableTrustManager), authToken, scope);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret, SSLContext sslContext, Object customJacksonProvider, boolean disableTrustManager, String authToken) {
         return new Keycloak(serverUrl, realm, username, password, clientId, clientSecret, PASSWORD, newRestEasyClient(customJacksonProvider, sslContext, disableTrustManager), authToken, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret) {
         return getInstance(serverUrl, realm, username, password, clientId, clientSecret, null, null, false, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret, SSLContext sslContext) {
         return getInstance(serverUrl, realm, username, password, clientId, clientSecret, sslContext, null, false, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, String clientSecret, SSLContext sslContext, Object customJacksonProvider) {
         return getInstance(serverUrl, realm, username, password, clientId, clientSecret, sslContext, customJacksonProvider, false, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId) {
         return getInstance(serverUrl, realm, username, password, clientId, null, null, null, false, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String username, String password, String clientId, SSLContext sslContext) {
         return getInstance(serverUrl, realm, username, password, clientId, null, sslContext, null, false, null);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String clientId, String authToken) {
         return getInstance(serverUrl, realm, null, null, clientId, null, null, null, false, authToken);
     }
 
+    /**
+     * See {@link #getInstance(String, String, String, String, String, String, SSLContext, Object, boolean, String, String)} for the details about the parameters and their default values
+     */
     public static Keycloak getInstance(String serverUrl, String realm, String clientId, String authToken, SSLContext sllSslContext) {
         return getInstance(serverUrl, realm, null, null, clientId, null, sllSslContext, null, false, authToken);
     }
@@ -174,6 +215,14 @@ public <T> T proxy(Class<T> proxyClass, URI absoluteURI) {
     @Override
     public void close() {
         closed = true;
+        if (tokenManager != null) {
+            try {
+                tokenManager.logout();
+            } catch (RuntimeException e) {
+                // do our best closing the session but logout can fail because multiple reasons:
+                // shared jakarta client closed, realm removed or disabled, client removed or disabled,...
+            }
+        }
         client.close();
     }
 
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/KeycloakBuilder.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/KeycloakBuilder.java
index dd0fb0579fee..cfb9f0034049 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/KeycloakBuilder.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/KeycloakBuilder.java
@@ -35,7 +35,10 @@
  *     .password("pass")
  *     .clientId("client")
  *     .clientSecret("secret")
- *     .resteasyClient(new ResteasyClientBuilder().connectionPoolSize(20).build())
+ *     .resteasyClient(new ResteasyClientBuilderImpl()
+ *                 .connectionPoolSize(20)
+ *                 .build()
+ *                 .register(org.keycloak.admin.client.JacksonProvider.class, 100))
  *     .build();
  * </pre>
  * <p>Example usage with grant_type=client_credentials</p>
@@ -105,6 +108,12 @@ public KeycloakBuilder clientSecret(String clientSecret) {
         return this;
     }
 
+    /**
+     * Custom instance of resteasy client. Please see <a href="https://www.keycloak.org/securing-apps/admin-client#_admin_client_compatibility">the documentation</a> for additional details regarding the compatibility
+     *
+     * @param resteasyClient Custom RestEasy client
+     * @return admin client builder
+     */
     public KeycloakBuilder resteasyClient(Client resteasyClient) {
         this.resteasyClient = resteasyClient;
         return this;
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java
index 02e47e6e53bd..4657a9c6327e 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientAttributeCertificateResource.java
@@ -79,7 +79,8 @@ public interface ClientAttributeCertificateResource {
     /**
      * Get a keystore file for the client, containing private key and public certificate
      *
-     * @param config Keystore configuration as JSON
+     * @param config Keystore configuration as JSON. Parameters "keySize" and "validity" of the config are supported since Keycloak 26.3. Key size is 4096 by default and validity is 3 years by default.
+     *               For older versions than Keycloak 26.3, the key size is 2048 and validity is 10 years.
      * @return
      */
     @POST
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientResource.java
index 68c75ffb4b5f..d649d7abbef7 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientResource.java
@@ -165,6 +165,9 @@ public interface ClientResource {
     @Path("/roles")
     RolesResource roles();
 
+    @Path("/evaluate-scopes")
+    ClientScopeEvaluateResource clientScopesEvaluate();
+
     /**
      * Get default client scopes.  Only name and ids are returned.
      *
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientScopeEvaluateResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientScopeEvaluateResource.java
new file mode 100644
index 000000000000..c6a33bdaca27
--- /dev/null
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/ClientScopeEvaluateResource.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.admin.client.resource;
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.QueryParam;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.IDToken;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public interface ClientScopeEvaluateResource {
+
+    /**
+     * Generate example access token
+     *
+     * @param scopeParam Value of the "scope" parameter. Endpoint simulates generating of the access-token as if the "scope" parameter with specified value is used. Could be null.
+     * @param userId User ID
+     * @param audience Value of the "audience" parameter. Endpoint simulates generating of the access-token as if the "audience" parameter with specified value is used. Audience parameter is supported
+     *                 just for some grants (EG. for the token exchange). For most of the grants where "audience" parameter is not supported, it is better to use the value null to simulate generating of the appropriate token.
+     *                 Parameter is supported since Keycloak 26.2.
+     * @return generated access token
+     */
+    @GET
+    @Path("generate-example-access-token")
+    AccessToken generateAccessToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience);
+
+    /**
+     * Generate example ID token
+     *
+     * @param scopeParam Value of the "scope" parameter. Endpoint simulates generating of the ID-token as if the "scope" parameter with specified value is used. Could be null.
+     * @param userId User ID
+     * @param audience Value of the "audience" parameter. Endpoint simulates generating of the access-token as if the "audience" parameter with specified value is used. Audience parameter is supported
+     *                 just for some grants (EG. for the token exchange). For most of the grants where "audience" parameter is not supported, it is better to use the value null to simulate generating of the appropriate token.
+     *                 Parameter is supported since Keycloak 26.2.
+     * @return generated ID token
+     */
+    @GET
+    @Path("generate-example-id-token")
+    IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience);
+
+    /**
+     * Generate example user-info response
+     *
+     * @param scopeParam  Value of the "scope" parameter. Endpoint simulates generating of the user-info as if the "scope" parameter with specified value is used for generating the access-token, which would then be used for the user-info request. Could be null.
+     * @param userId User ID
+     * @return generated user-info
+     */
+    @GET
+    @Path("generate-example-userinfo")
+    Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId);
+
+}
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupResource.java
index 66e331726de9..950487ea82dc 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupResource.java
@@ -100,6 +100,24 @@ public interface GroupResource {
     @Consumes(MediaType.APPLICATION_JSON)
     List<GroupRepresentation> getSubGroups(@QueryParam("first") Integer first, @QueryParam("max") Integer max, @QueryParam("briefRepresentation") Boolean briefRepresentation);
 
+    /**
+     * Get the paginated list of subgroups belonging to this group.
+     *
+     * @param first the position of the first result to be returned.
+     * @param max the maximum number of results that are to be returned.
+     * @param briefRepresentation if {@code true}, each returned subgroup representation will only contain basic information
+     *                           (id, name, path, and parentId). If {@code false}, the complete representations of the subgroups
+     *                            are returned (include role mappings and attributes).
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
+     */
+    @GET
+    @Path("children")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    List<GroupRepresentation> getSubGroups(@QueryParam("first") Integer first, @QueryParam("max") Integer max,
+                                           @QueryParam("briefRepresentation") Boolean briefRepresentation,
+                                           @QueryParam("subGroupsCount") Boolean subGroupsCount);
+
     /**
      * Get the paginated list of subgroups belonging to this group, filtered according to the specified parameters.
      *
@@ -124,6 +142,31 @@ List<GroupRepresentation> getSubGroups(
             @QueryParam("max") Integer max,
             @QueryParam("briefRepresentation") Boolean briefRepresentation);
 
+    /**
+     * Get the paginated list of subgroups belonging to this group, filtered according to the specified parameters.
+     *
+     * @param search a {@code String} representing either an exact group name or a partial name. If empty or {@code null}
+     *              then all subgroups of this group are returned. Parameter available since Keycloak server 25. Will be ignored on older Keycloak versions with the default value null.
+     * @param exact if {@code true}, the subgroups will be searched using exact match for the {@code search} param. If false
+     *              or {@code null}, the method returns all subgroups that partially match the specified name. Parameter available since Keycloak server 25. Will be ignored on older Keycloak versions with the default value null.
+     * @param first the position of the first result to be returned.
+     * @param max the maximum number of results that are to be returned.
+     * @param briefRepresentation if {@code true}, each returned subgroup representation will only contain basic information
+     *                           (id, name, path, and parentId). If {@code false}, the complete representations of the subgroups
+     *                            are returned (including role mappings and attributes).
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
+     */
+    @GET
+    @Path("children")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    List<GroupRepresentation> getSubGroups(
+            @QueryParam("search") String search,
+            @QueryParam("exact") Boolean exact,
+            @QueryParam("first") Integer first,
+            @QueryParam("max") Integer max,
+            @QueryParam("briefRepresentation") Boolean briefRepresentation,
+            @QueryParam("subGroupsCount") Boolean subGroupsCount);
 
     /**
      * Set or create child.  This will just set the parent if it exists.  Create it and set the parent
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupsResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupsResource.java
index 9058d8a0c401..350056d18f4a 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupsResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/GroupsResource.java
@@ -82,6 +82,29 @@ List<GroupRepresentation> groups(@QueryParam("search") String search,
                                      @QueryParam("max") Integer max,
                                      @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation);
 
+    /**
+     * Get groups by pagination params.
+     * @param search A {@code String} representing either an exact or partial group name.
+     * @param exact if {@code true}, the groups will be searched using exact match for the {@code search} param. If false,
+     *      *              the method returns all groups that partially match the specified name.
+     * @param first index of the first element (pagination offset).
+     * @param max the maximum number of results.
+     * @param briefRepresentation if {@code true}, each returned group representation will only contain basic information
+     *                            (id, name, path, and parentId). If {@code false}, the complete representations of the groups
+     *                            are returned (including role mappings and attributes).
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
+     * @return A list containing the slice of all groups.
+     */
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    List<GroupRepresentation> groups(@QueryParam("search") String search,
+                                     @QueryParam("exact") Boolean exact,
+                                     @QueryParam("first") Integer first,
+                                     @QueryParam("max") Integer max,
+                                     @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation,
+                                     @QueryParam("subGroupsCount") @DefaultValue("true") Boolean subGroupsCount);
+
     /**
      * Get groups by pagination params.
      * @param search A {@code String} representing either an exact or partial group name.
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMemberResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMemberResource.java
index f234b131ba18..91a098a0452b 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMemberResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMemberResource.java
@@ -20,9 +20,11 @@
 import java.util.List;
 
 import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import org.keycloak.representations.idm.MemberRepresentation;
@@ -47,4 +49,17 @@ public interface OrganizationMemberResource {
     @GET
     @Produces(MediaType.APPLICATION_JSON)
     List<OrganizationRepresentation> getOrganizations();
+
+    /**
+     * Returns the organizations associated with the user
+     *
+     * @param briefRepresentation if false, return the full representation. Otherwise, only the basic fields are returned. It is true by default. Parameter supported since Keycloak 26.3. It is assumed to be false for the older Keycloak server versions.
+     * @since Keycloak server 26
+     * @return the organizations associated with the user
+     */
+    @Path("organizations")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<OrganizationRepresentation> getOrganizations(
+            @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation);
 }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java
index 657aa69d274d..89e289cce086 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationMembersResource.java
@@ -20,6 +20,8 @@
 import java.util.List;
 
 import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.FormParam;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
@@ -39,6 +41,10 @@ public interface OrganizationMembersResource {
     @Consumes(MediaType.APPLICATION_JSON)
     Response addMember(String userId);
 
+    @Path("{member-id}")
+    @DELETE
+    Response removeMember(@PathParam("member-id") String memberId);
+
     /**
      * Return all members in the organization.
      *
@@ -134,5 +140,7 @@ Response inviteUser(@FormParam("email") String email,
     @Path("{id}/organizations")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    List<OrganizationRepresentation> getOrganizations(@PathParam("id") String id);
+    List<OrganizationRepresentation> getOrganizations(
+            @PathParam("id") String id,
+            @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation);
 }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsMembersResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsMembersResource.java
index f70b1d7eb1e6..a71c0273c83b 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsMembersResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsMembersResource.java
@@ -19,17 +19,40 @@
 
 import java.util.List;
 
+import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import org.keycloak.representations.idm.OrganizationRepresentation;
 
 public interface OrganizationsMembersResource {
 
+    /**
+     * Returns the organizations associated with the user that has the specified id.
+     *
+     * @param id user id
+     * @return Organizations of the user
+     */
     @Path("{id}/organizations")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    List<OrganizationRepresentation> getOrganizations(@PathParam("id") String id);
+    List<OrganizationRepresentation> getOrganizations(
+            @PathParam("id") String id);
+
+    /**
+     * Returns the organizations associated with the user that has the specified id.
+     *
+     * @param id user id
+     * @param briefRepresentation if false, return the full representation. Otherwise, only the basic fields are returned. It is true by default. Parameter supported since Keycloak 26.3. It is assumed to be false for the older Keycloak server versions.
+     * @return Organizations of the user
+     */
+    @Path("{id}/organizations")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<OrganizationRepresentation> getOrganizations(
+            @PathParam("id") String id,
+            @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation);
 }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsResource.java
index 96110fcae1c2..05a72685f2c0 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/OrganizationsResource.java
@@ -18,6 +18,7 @@
 package org.keycloak.admin.client.resource;
 
 import java.util.List;
+import java.util.Map;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
@@ -108,7 +109,7 @@ List<OrganizationRepresentation> search(
      *              the method returns all organizations whose name or (domains) partially match the {@code search} param.
      * @param first the position of the first result to be processed (pagination offset). Ignored if negative or {@code null}.
      * @param max the maximum number of results to be returned. Ignored if negative or {@code null}.
-     * @param briefRepresentation if {@code true} the full representation is to be returned. Otherwise, only the basic fields are returned. The parameter is supported since Keycloak 26.1
+     * @param briefRepresentation if {@code false} the full representation is to be returned. Otherwise, only the basic fields are returned. The parameter is supported since Keycloak 26.1
      * @return a list containing the matched organizations.
      * @since Keycloak 26.1. Use method {@link #search(String, Boolean, Integer, Integer)} for the older versions of the Keycloak server
      */
@@ -150,6 +151,51 @@ List<OrganizationRepresentation> searchByAttribute(
             @QueryParam("max") Integer max
     );
 
+    /**
+     * Counts organizations by search.
+     * @param search text to look for.
+     * @return the number of organizations that match the search.
+     * @since Keycloak 26.3
+     */
+    @GET
+    @Path("count")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    long count(@QueryParam("search") String search);
+
+    /**
+     * Counts organizations by search.
+     * @param search text to look for.
+     * @param exact if {@code true}, the organizations will be searched using exact match for the {@code search} param - i.e.
+     *              either the organization name or one of its domains must match exactly the {@code search} param. If false,
+     *              the method returns all organizations whose name or (domains) partially match the {@code search} param.
+     * @return the number of organizations that match the search.
+     * @since Keycloak 26.3
+     */
+    @GET
+    @Path("count")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    long count(
+            @QueryParam("search") String search,
+            @QueryParam("exact") Boolean exact
+    );
+
+    /**
+     * Counts all organizations that contain attributes matching the specified query.
+     * @param searchQuery a query to search for organization attributes, in the format 'key1:value2 key2:value2'.
+     * @return the number of the organizations that match the attribute query.
+     * @since Keycloak 26.3
+     */
+    @GET
+    @Path("count")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    long countByAttribute(
+            @QueryParam("q") String searchQuery
+    );
+
+
     @Path("members")
     OrganizationsMembersResource members();
 }
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/RealmResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/RealmResource.java
index ccb9d5798bb1..fcf016f0577a 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/RealmResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/RealmResource.java
@@ -126,6 +126,58 @@ List<EventRepresentation> getEvents(@QueryParam("type") List<String> types, @Que
             @QueryParam("ipAddress") String ipAddress, @QueryParam("first") Integer firstResult,
             @QueryParam("max") Integer maxResults);
 
+    /**
+     * Get events
+     *
+     * Returns all events, or filters them based on URL query parameters listed here
+     *
+     * @param types The types of events to return
+     * @param client App or oauth client name
+     * @param user User id
+     * @param ipAddress IP address
+     * @param dateFrom From (inclusive) date (yyyy-MM-dd)
+     * @param dateTo To (inclusive) date (yyyy-MM-dd)
+     * @param firstResult Paging offset
+     * @param maxResults Maximum results size (defaults to 100)
+     * @param direction The direction to sort events by. Available values are "asc" or "desc". The parameter is supported since Keycloak 26.2
+     * @return events
+     * @since Keycloak 26.2. Use method {@link #getEvents(List, String, String, String, String, String, Integer, Integer)} for the older versions of the Keycloak server
+     */
+    @Path("events")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<EventRepresentation> getEvents(@QueryParam("type") List<String> types, @QueryParam("client") String client,
+            @QueryParam("user") String user, @QueryParam("dateFrom") String dateFrom, @QueryParam("dateTo") String dateTo,
+            @QueryParam("ipAddress") String ipAddress, @QueryParam("first") Integer firstResult,
+            @QueryParam("max") Integer maxResults,
+            @QueryParam("direction") String direction);
+
+    /**
+     * Get events
+     *
+     * Returns all events, or filters them based on URL query parameters listed here
+     *
+     * @param types The types of events to return
+     * @param client App or oauth client name
+     * @param user User id
+     * @param ipAddress IP address
+     * @param dateFrom time in Epoch timestamp. The parameter is supported since Keycloak 26.2
+     * @param dateTo time in Epoch timestamp. The parameter is supported since Keycloak 26.2
+     * @param firstResult Paging offset
+     * @param maxResults Maximum results size (defaults to 100)
+     * @param direction The direction to sort events by. Available values are "asc" or "desc". The parameter is supported since Keycloak 26.2
+     * @return events
+     * @since Keycloak 26.2. Use method {@link #getEvents(List, String, String, String, String, String, Integer, Integer)} for the older versions of the Keycloak server
+     */
+    @Path("events")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<EventRepresentation> getEvents(@QueryParam("type") List<String> types, @QueryParam("client") String client,
+            @QueryParam("user") String user, @QueryParam("dateFrom") long dateFrom, @QueryParam("dateTo") long dateTo,
+            @QueryParam("ipAddress") String ipAddress, @QueryParam("first") Integer firstResult,
+            @QueryParam("max") Integer maxResults,
+            @QueryParam("direction") String direction);
+
     @DELETE
     @Path("admin-events")
     void clearAdminEvents();
@@ -153,6 +205,64 @@ List<AdminEventRepresentation> getAdminEvents(@QueryParam("operationTypes") List
             @QueryParam("dateTo") String dateTo, @QueryParam("first") Integer firstResult,
             @QueryParam("max") Integer maxResults);
 
+    /**
+     * Get admin events
+     *
+     * Returns all admin events, or filters events based on URL query parameters listed here
+     *
+     * @param operationTypes operation types
+     * @param authRealm realm, from where the user was authenticated
+     * @param authClient client, which authenticated the event operation
+     * @param authUser user, which did the particular admin event
+     * @param authIpAddress IP address from which the event was done
+     * @param resourcePath resource path
+     * @param resourceTypes resource types
+     * @param dateFrom time in Epoch timestamp. The parameter is supported since Keycloak 26.2
+     * @param dateTo time in Epoch timestamp. The parameter is supported since Keycloak 26.2
+     * @param firstResult Paging offset
+     * @param maxResults Maximum results size (defaults to 100)
+     * @param direction The direction to sort events by. Available values are "asc" or "desc". The parameter is supported since Keycloak 26.2
+     * @return admin events
+     * @since Keycloak 26.2. Use method {@link #getAdminEvents(List, String, String, String, String, String, List, String, String, Integer, Integer)} for the older versions of the Keycloak server
+     */
+    @GET
+    @Path("admin-events")
+    @Produces(MediaType.APPLICATION_JSON)
+    List<AdminEventRepresentation> getAdminEvents(@QueryParam("operationTypes") List<String> operationTypes, @QueryParam("authRealm") String authRealm, @QueryParam("authClient") String authClient,
+            @QueryParam("authUser") String authUser, @QueryParam("authIpAddress") String authIpAddress,
+            @QueryParam("resourcePath") String resourcePath, @QueryParam("resourceTypes") List<String> resourceTypes, @QueryParam("dateFrom") String dateFrom,
+            @QueryParam("dateTo") String dateTo, @QueryParam("first") Integer firstResult,
+            @QueryParam("max") Integer maxResults, @QueryParam("direction") String direction);
+
+    /**
+     * Get admin events
+     *
+     * Returns all admin events, or filters events based on URL query parameters listed here
+     *
+     * @param operationTypes operation types
+     * @param authRealm realm, from where the user was authenticated
+     * @param authClient client, which authenticated the event operation
+     * @param authUser user, which did the particular admin event
+     * @param authIpAddress IP address from which the event was done
+     * @param resourcePath resource path
+     * @param resourceTypes resource types
+     * @param dateFrom From (inclusive) date (yyyy-MM-dd)
+     * @param dateTo To (inclusive) date (yyyy-MM-dd)
+     * @param firstResult Paging offset
+     * @param maxResults Maximum results size (defaults to 100)
+     * @param direction The direction to sort events by. Available values are "asc" or "desc". The parameter is supported since Keycloak 26.2
+     * @return admin events
+     * @since Keycloak 26.2. Use method {@link #getAdminEvents(List, String, String, String, String, String, List, String, String, Integer, Integer)} for the older versions of the Keycloak server
+     */
+    @GET
+    @Path("admin-events")
+    @Produces(MediaType.APPLICATION_JSON)
+    List<AdminEventRepresentation> getAdminEvents(@QueryParam("operationTypes") List<String> operationTypes, @QueryParam("authRealm") String authRealm, @QueryParam("authClient") String authClient,
+            @QueryParam("authUser") String authUser, @QueryParam("authIpAddress") String authIpAddress,
+            @QueryParam("resourcePath") String resourcePath, @QueryParam("resourceTypes") List<String> resourceTypes, @QueryParam("dateFrom") long dateFrom,
+            @QueryParam("dateTo") long dateTo, @QueryParam("first") Integer firstResult,
+            @QueryParam("max") Integer maxResults, @QueryParam("direction") String direction);
+
     @GET
     @Path("events/config")
     @Produces(MediaType.APPLICATION_JSON)
@@ -257,6 +367,14 @@ Response testLDAPConnection(@FormParam("action") String action, @FormParam("conn
     @POST
     void clearKeysCache();
 
+    /**
+     * Clear the crl cache (CRLs loaded for X509 authentication
+     * @since Keycloak 26.2
+     */
+    @Path("clear-crl-cache")
+    @POST
+    void clearCrlCache();
+
     @Path("push-revocation")
     @POST
     @Produces(MediaType.APPLICATION_JSON)
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java
index cf7d6c8ef4e8..75c7dc5027fe 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java
@@ -129,6 +129,16 @@ List<UserRepresentation> searchByAttributes(@QueryParam("first") Integer firstRe
                                                 @QueryParam("briefRepresentation") Boolean briefRepresentation,
                                                 @QueryParam("q") String searchQuery);
 
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    @Consumes(MediaType.APPLICATION_JSON)
+    List<UserRepresentation> searchByAttributes(@QueryParam("first") Integer firstResult,
+                                                @QueryParam("max") Integer maxResults,
+                                                @QueryParam("enabled") Boolean enabled,
+                                                @QueryParam("exact") Boolean exact,
+                                                @QueryParam("briefRepresentation") Boolean briefRepresentation,
+                                                @QueryParam("q") String searchQuery);
+
     @GET
     @Produces(MediaType.APPLICATION_JSON)
     List<UserRepresentation> search(@QueryParam("username") String username, @QueryParam("exact") Boolean exact);
@@ -240,6 +250,29 @@ List<UserRepresentation> search(@QueryParam("search") String search,
       @QueryParam("first") Integer firstResult,
       @QueryParam("max") Integer maxResults);
 
+    /**
+     * Returns the users that can be viewed and match the given filters.
+     *
+     * @param search        arbitrary search string for all the fields below
+     * @param last          last name field of a user
+     * @param first         first name field of a user
+     * @param email         email field of a user
+     * @param emailVerified emailVerified field of a user
+     * @param username      username field of a user
+     * @param enabled       Boolean representing if user is enabled or not
+     * @return the list of users matching the given filters
+     */
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<UserRepresentation> search(@QueryParam("search") String search,
+                  @QueryParam("lastName") String last,
+                  @QueryParam("firstName") String first,
+                  @QueryParam("email") String email,
+                  @QueryParam("emailVerified") Boolean emailVerified,
+                  @QueryParam("username") String username,
+                  @QueryParam("enabled") Boolean enabled,
+                  @QueryParam("q") String searchQuery);
+
     @GET
     @Produces(MediaType.APPLICATION_JSON)
     List<UserRepresentation> list(@QueryParam("first") Integer firstResult,
@@ -338,6 +371,33 @@ Integer count(@QueryParam("search") String search,
                   @QueryParam("enabled") Boolean enabled,
                   @QueryParam("q") String searchQuery);
 
+    /**
+     * Returns the number of users that can be viewed and match the given filters.
+     * If none of the filters is specified this is equivalent to {{@link #count()}}.
+     *
+     * @param search        arbitrary search string for all the fields below
+     * @param last          last name field of a user
+     * @param first         first name field of a user
+     * @param email         email field of a user
+     * @param emailVerified emailVerified field of a user
+     * @param username      username field of a user
+     * @param enabled       Boolean representing if user is enabled or not
+     * @return number of users matching the given filters
+     */
+    @Path("count")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    Integer count(@QueryParam("search") String search,
+                  @QueryParam("lastName") String last,
+                  @QueryParam("firstName") String first,
+                  @QueryParam("email") String email,
+                  @QueryParam("emailVerified") Boolean emailVerified,
+                  @QueryParam("username") String username,
+                  @QueryParam("enabled") Boolean enabled,
+                  @QueryParam("idpAlias") String idpAlias,
+                  @QueryParam("idpUserId") String idpUserId,
+                  @QueryParam("q") String searchQuery);
+
     /**
      * Returns the number of users with the given status for emailVerified.
      * If none of the filters is specified this is equivalent to {{@link #count()}}.
diff --git a/integration/admin-client/src/main/java/org/keycloak/admin/client/token/TokenManager.java b/integration/admin-client/src/main/java/org/keycloak/admin/client/token/TokenManager.java
index 8c4600981440..f18087f07512 100644
--- a/integration/admin-client/src/main/java/org/keycloak/admin/client/token/TokenManager.java
+++ b/integration/admin-client/src/main/java/org/keycloak/admin/client/token/TokenManager.java
@@ -123,7 +123,7 @@ public synchronized AccessTokenResponse refreshToken() {
     }
 
     public synchronized void logout() {
-        if (currentToken.getRefreshToken() == null) {
+        if (currentToken == null || currentToken.getRefreshToken() == null || refreshTokenExpired()) {
             return;
         }
 
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCmd.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCmd.java
index 4479de98479e..3c0bb06aaf42 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCmd.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCmd.java
@@ -28,12 +28,14 @@
  * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
  */
 
-@Command(name = "config", description = "COMMAND [ARGUMENTS]", subcommands = {
+@Command(name = ConfigCmd.NAME, description = "COMMAND [ARGUMENTS]", subcommands = {
         ConfigCredentialsCmd.class,
         ConfigTruststoreCmd.class
 } )
 public class ConfigCmd extends AbstractAuthOptionsCmd {
 
+    public static final String NAME = "config";
+
     @Override
     protected void process() {
 
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCredentialsCmd.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCredentialsCmd.java
index daf57f25d9e9..e988a5f63c08 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCredentialsCmd.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/ConfigCredentialsCmd.java
@@ -33,9 +33,11 @@
 /**
  * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
  */
-@Command(name = "credentials", description = "--server SERVER_URL --realm REALM [ARGUMENTS]")
+@Command(name = ConfigCredentialsCmd.NAME, description = "--server SERVER_URL --realm REALM [ARGUMENTS]")
 public class ConfigCredentialsCmd extends BaseConfigCredentialsCmd {
 
+    static final String NAME = "credentials";
+
     public ConfigCredentialsCmd() {
         super(KcAdmMain.COMMAND_STATE);
     }
@@ -62,4 +64,8 @@ public void process() {
             super.process();
         }
     }
+
+    String getPassword() {
+        return this.password;
+    }
 }
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/KcAdmCmd.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/KcAdmCmd.java
index 3e3cdcfc2934..a5411cc99591 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/KcAdmCmd.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/commands/KcAdmCmd.java
@@ -22,6 +22,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 
+import picocli.CommandLine;
 import picocli.CommandLine.Command;
 
 import static org.keycloak.client.admin.cli.KcAdmMain.CMD;
@@ -51,6 +52,9 @@
 })
 public class KcAdmCmd extends BaseGlobalOptionsCmd {
 
+    @CommandLine.Spec
+    CommandLine.Model.CommandSpec spec;
+
     @Override
     protected boolean nothingToDo() {
         return true;
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/common/Globals.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/common/Globals.java
index 3afda5763a14..71e2d450f365 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/common/Globals.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/common/Globals.java
@@ -44,19 +44,20 @@ public static void main(String [] args, BaseGlobalOptionsCmd rootCommand, String
         CryptoIntegration.init(cl);
 
         System.setProperty(BaseAuthOptionsCmd.DEFAULT_CONFIG_PATH_STRING_KEY, defaultConfigFile);
-        CommandLine cli = createCommandLine(rootCommand, command);
+        CommandLine cli = createCommandLine(rootCommand, command, new PrintWriter(System.err, true));
         int exitCode = cli.execute(args);
         System.exit(exitCode);
     }
 
-    public static CommandLine createCommandLine(BaseGlobalOptionsCmd rootCommand, String command) {
+    public static CommandLine createCommandLine(BaseGlobalOptionsCmd rootCommand, String command, PrintWriter errorWriter) {
         CommandSpec spec = CommandSpec.forAnnotatedObject(rootCommand).name(command);
 
         CommandLine cmd = new CommandLine(spec);
-
+        cmd.setExpandAtFiles(false);
+        cmd.setPosixClusteredShortOptionsAllowed(false);
         cmd.setExecutionExceptionHandler(new ExecutionExceptionHandler());
         cmd.setParameterExceptionHandler(new ShortErrorMessageHandler());
-        cmd.setErr(new PrintWriter(System.err, true));
+        cmd.setErr(errorWriter);
 
         return cmd;
     }
diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/util/AuthUtil.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/util/AuthUtil.java
index 937149cfc0f2..c395c3275773 100644
--- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/util/AuthUtil.java
+++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/cli/util/AuthUtil.java
@@ -19,6 +19,7 @@
 import org.keycloak.client.cli.config.ConfigData;
 import org.keycloak.client.cli.config.RealmConfigData;
 import org.keycloak.common.util.KeystoreUtil;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.jose.jws.JWSBuilder;
 import org.keycloak.representations.AccessTokenResponse;
@@ -30,7 +31,6 @@
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.security.KeyPair;
-import java.util.UUID;
 
 import static java.lang.System.currentTimeMillis;
 import static org.keycloak.client.cli.util.ConfigUtil.checkServerInfo;
@@ -197,7 +197,7 @@ public static String getSignedRequestToken(String keystore, String storePass, St
         KeyPair keypair = KeystoreUtil.loadKeyPairFromKeystore(keystore, storePass, keyPass, alias, keystoreType);
 
         JsonWebToken reqToken = new JsonWebToken();
-        reqToken.id(UUID.randomUUID().toString());
+        reqToken.id(SecretGenerator.getInstance().generateSecureID());
         reqToken.issuer(clientId);
         reqToken.subject(clientId);
         reqToken.audience(realmInfoUrl);
diff --git a/integration/client-cli/admin-cli/src/test/java/org/keycloak/client/admin/cli/commands/KcAdmCliTest.java b/integration/client-cli/admin-cli/src/test/java/org/keycloak/client/admin/cli/commands/KcAdmCliTest.java
new file mode 100644
index 000000000000..39c161c2841b
--- /dev/null
+++ b/integration/client-cli/admin-cli/src/test/java/org/keycloak/client/admin/cli/commands/KcAdmCliTest.java
@@ -0,0 +1,23 @@
+package org.keycloak.client.admin.cli.commands;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.ByteArrayOutputStream;
+import java.io.PrintWriter;
+
+import org.junit.Test;
+import org.keycloak.client.cli.common.Globals;
+
+import picocli.CommandLine;
+
+public class KcAdmCliTest {
+
+    @Test
+    public void testAtFileDisabled() {
+        KcAdmCmd command = new KcAdmCmd();
+        CommandLine cli = Globals.createCommandLine(command, "kcadm", new PrintWriter(new ByteArrayOutputStream()));
+        cli.execute("config", "credentials", "--user", "user", "--password", "@@password", "--server", "server");
+        ConfigCredentialsCmd cmd = command.spec.subcommands().get(ConfigCmd.NAME).getSubcommands().get(ConfigCredentialsCmd.NAME).getCommand();
+        assertEquals("@@password", cmd.getPassword());
+    }
+}
\ No newline at end of file
diff --git a/js/CODING_GUIDELINES.md b/js/CODING_GUIDELINES.md
index 657277263f01..14c2b859d3ed 100644
--- a/js/CODING_GUIDELINES.md
+++ b/js/CODING_GUIDELINES.md
@@ -18,8 +18,35 @@ If you submit a pull request that changes the dependencies, make sure that you a
 
 Since this project relies greatly on [PNPM workspaces](https://pnpm.io/workspaces) it is recommended you familiarize yourself with features such as [`--filter`](https://pnpm.io/filtering).
 
+## Running
+
+We run the UI in dev mode and configure keycloak to proxy the request this can be done by adding `KC_ADMIN_VITE_URL=http://localhost:5174` as environment variable to the startup of keycloak or by using the start script:
+
+```bash
+pnpm --filter keycloak-server start --admin-dev
+```
+
+This script will download the nightly version of keycloak and start it with the added environment variable.
+Afterwards one needs to start the dev server with:
+
+```bash
+pnpm --filter keycloak-admin-ui run dev
+```
+
+Now when viewing the admin ui in the browser this is the local version and any changes made to the ui code base will automatically be reflected no reload needed.
+See [README.md](apps/keycloak-server/README.md) for more information.
+
 ## Code-style
 
+### Frameworks used
+
+We try and keep the use of frameworks to a minium, but we do use a couple:
+  1. [Patternfly](https://www.patternfly.org/) a component library
+  1. [React router](https://reactrouter.com/) for routing
+  1. [React hook form](https://react-hook-form.com/) with so many forms this is to keep state
+  1. [Playwright](https://playwright.dev/) for testing
+
+
 ### Linting
 
 To ensure code-style is consistent between various contributions [ESLint](https://eslint.org/) is used to enforce a common set of guidelines. The [recommended rules](https://eslint.org/docs/latest/rules/) of ESLint are used as a foundation.
@@ -73,10 +100,6 @@ setUser(newUser);
 
 ```
 
-### useReducers
-
-When using reducers make sure you specify the [return type and not use inference](https://react-typescript-cheatsheet.netlify.app/docs/basic/getting-started/hooks#usereducer).
-
 ### useEffect
 
 For useEffect only [return the function or undefined](https://react-typescript-cheatsheet.netlify.app/docs/basic/getting-started/hooks#useeffect).
@@ -229,4 +252,7 @@ switch (titleStatus) {
 ## Resources
 
 - [PatternFly Docs](https://www.patternfly.org/)
+- [React hook form](https://react-hook-form.com/)
 - [Learn React](https://react.dev/learn)
+- [Typescript](https://www.typescriptlang.org/docs/handbook/intro.html)
+- [Playwright](https://playwright.dev/)
diff --git a/js/README.md b/js/README.md
index ae0f43329f57..98efd21ef441 100644
--- a/js/README.md
+++ b/js/README.md
@@ -9,8 +9,8 @@ This directory contains the UIs and related libraries of the Keycloak project wr
     │   ├── admin-ui                   # Admin UI for handling login, registration, administration, and account management
     │   └── keycloak-server            # Keycloak server for local development of UIs
     ├── libs
-    │   ├── keycloak-admin-client      # Keycloak Admin Client library for Keycloak REST API
-    │   └── keycloak-js                # Keycloak JS library for securing HTML5/JavaScript applications
+    │   ├── ui-shared                  # Shared component library between admin and account
+    │   └── keycloak-admin-client      # Keycloak Admin Client library for Keycloak REST API
     ├── ...
 
 ## Data processing
@@ -20,3 +20,7 @@ Red Hat may process information including business contact information and code
 To speed up the build process, the following build flag can be used to disable the processing of these modules:
 
     -Dskip.npm
+
+## Contributing
+
+If you want to contribute please look at the [coding guidelines](CODING_GUIDELINES.md)
\ No newline at end of file
diff --git a/js/apps/account-ui/README.md b/js/apps/account-ui/README.md
index 5048f838dd5f..a82f0abccdb0 100644
--- a/js/apps/account-ui/README.md
+++ b/js/apps/account-ui/README.md
@@ -33,7 +33,7 @@ import { KeycloakProvider } from "@keycloak/keycloak-ui-shared";
 ### Translation
 
 For the translation we use `react-i18next` you can [set it up](https://react.i18next.com/) as described on their website.
-If you want to use the translations that are provided then you need to add `i18next-http-backend` to your project and add:
+If you want to use the translations that are provided then you need to add `i18next-fetch-backend` to your project and add:
 
 ```ts
 
@@ -42,9 +42,9 @@ backend: {
   parse: (data: string) => {
     const messages = JSON.parse(data);
 
-    const result: Record<string, string> = {};
-    messages.forEach((v) => (result[v.key] = v.value));
-    return result;
+    return Object.fromEntries(
+      messages.map(({ key, value }) => [key, value])
+    );
   },
 },
 ```
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ca.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ca.properties
index 42a9d29c3165..fb9245735348 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ca.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ca.properties
@@ -2,7 +2,7 @@
 #Tue Jan 09 09:05:12 CET 2024
 cancel=Cancel·la
 backTo=Torna a {{app}}
-applicationType=Tipus d''aplicació
+applicationType=Tipus d'aplicació
 noGroupsText=No us heu unit a cap grup
 path=Camí
 password=Contrasenya
@@ -11,29 +11,29 @@ lastAccessedOn=Últim accés
 permissions=Permisos
 credentialCreatedAt=<0>Creada</0> el {{date}}.
 error-username-invalid-character=«{{0}}» conté un caràcter no vàlid.
-infoMessage=Fent clic en «Elimina l''accés», eliminareu els permisos concedits a aquesta aplicació. Aquesta aplicació ja no podrà utilitzar la vostra informació.
+infoMessage=Fent clic en «Elimina l'accés», eliminareu els permisos concedits a aquesta aplicació. Aquesta aplicació ja no podrà utilitzar la vostra informació.
 unknownOperatingSystem=Sistema operatiu desconegut
 edit=Edita
-otp-display-name=aplicació d''autenticació
+otp-display-name=Aplicació d'autenticació
 linkedEmpty=No hi ha cap proveïdor enllaçat
 directMembership=Pertinença directa
-error-invalid-length-too-short=L''atribut {0} ha de tindre una llargària mínima de {1}.
-error-number-out-of-range-too-big=L''atribut {0} ha de tindre valor màxim de {2}.
+error-invalid-length-too-short=«{{0}}» ha de tenir una llargària de, com a mínim, {{1}}.
+error-number-out-of-range-too-big=«{{0}}» ha de tenir un valor de, com a màxim, {{2}}.
 updateEmail=Actualitza el correu electrònic
 two-factor=Autenticació de doble factor
 signedInDevicesExplanation=Desconnecteu qualsevol dispositiu que no us siga familiar.
 status=Estat
-error-number-out-of-range-too-small=L''atribut {0} ha de tindre valor mínim de {1}.
-removeModalMessage=Això eliminarà els permisos d''accés actualment concedits a {{name}}. Haureu de tornar a concedir accés si voleu utilitzar aquesta aplicació.
+error-number-out-of-range-too-small=«{{0}}» ha de tenir un valor de, com a mínim, {{1}}.
+removeModalMessage=Això eliminarà els permisos d'accés actualment concedits a {{name}}. Haureu de tornar a concedir accés si voleu utilitzar aquesta aplicació.
 lastName=Cognoms
-invalidEmailMessage=«{{0}}»: l''adreça de correu electrònic no és vàlida.
+invalidEmailMessage=«{{0}}»: l’adreça de correu electrònic no és vàlida.
 clients=Clients
 filterByName=Filtra per nom…
 refreshPage=Refresca la pàgina
-error-user-attribute-required=Especifiqueu l''atribut «{0}».
+error-user-attribute-required=Especifiqueu «{{0}}».
 currentSession=Sessió actual
 error-empty=Especifiqueu el valor de «{{0}}».
-error-invalid-uri-fragment=«{{0}}» és un fragment d''URL invàlid.
+error-invalid-uri-fragment=«{{0}}» és un fragment d’URL invàlid.
 error-invalid-blank=Especifiqueu el valor de «{{0}}».
 missingFirstNameMessage=«{{0}}»: Indiqueu el nom.
 signedOutSession=Desconnectat {{browser}}/{{os}}
@@ -42,24 +42,24 @@ close=Tanca
 email=Correu electrònic
 signOutWarning=Voleu sortir de la sessió?
 signOutAllDevicesWarning=Aquesta acció desconnectarà tots els dispositius que han entrat al vostre compte, inclòs el dispositiu que esteu utilitzant ara mateix.
-unShareSuccess=S''ha deixat de compartir el recurs correctament.
+unShareSuccess=S'ha deixat de compartir el recurs correctament.
 signingIn=Identificació
-stopUsingCred=Voleu deixar d''utilitzar {{name}}?
-error-number-out-of-range=L''atribut {0} ha de ser un número entre {1} i {2}.
+stopUsingCred=Voleu deixar d'utilitzar {{name}}?
+error-number-out-of-range=«{{0}}» ha de ser un número entre {{1}} i {{2}}.
 thirdPartyApp=De tercers
 started=Iniciat
-updateSuccess=S''ha actualitzat el recurs correctament.
+updateSuccess=S'ha actualitzat el recurs correctament.
 unShare=Deixa de compartir-ho tot
-removeAccess=Elimina l''accés
+removeAccess=Elimina l'accés
 removeCred=Elimina {{name}}
 signOutAllDevices=Desconnecta tots els dispositius
-error-invalid-email=L''adreça de correu electrònic no és vàlida.
+error-invalid-email=L'adreça de correu electrònic no és vàlida.
 myResources=Els meus recursos
 linkedAccountsIntroMessage=Gestiona les entrades a través de comptes de tercers.
 groupDescriptionLabel=Visualitzeu els grups als quals esteu associat
 resourceAlreadyShared=El recurs ja està compartit amb aquest usuari.
-error-invalid-length-too-long=L''atribut {0} ha de tindre una llargària màxima de {2}.
-accountUpdatedMessage=S''ha actualitzat el vostre compte.
+error-invalid-length-too-long=«{{0}}» ha de tenir una llargària de, com a màxim, {{2}}.
+accountUpdatedMessage=S'ha actualitzat el vostre compte.
 logo=Logotip
 password-help-text=Entreu introduint la vostra contrasenya.
 deleteAccount=Elimina el compte
@@ -87,42 +87,42 @@ description=Descripció
 update=Actualitza
 signedInDevices=Dispositius identificats
 missingPasswordMessage=«{{0}}»: Indiqueu la contrasenya.
-otp-help-text=Introduïu el codi de verificació de l''aplicació d''autenticació.
-error-invalid-uri-scheme=«{{0}} té un esquema d''URL invàlid.
-error-user-attribute-read-only=El camp {0} és només de lectura.
-error-invalid-date=La data «{0}» no és vàlida.
-missingEmailMessage=«{0}»: Indiqueu una adreça electrònica.
+otp-help-text=Introduïu el codi de verificació de l'aplicació d'autenticació.
+error-invalid-uri-scheme=«{{0}}» té un esquema d’URL invàlid.
+error-user-attribute-read-only=El camp {{0}} és només de lectura.
+error-invalid-date=La data «{{0}}» no és vàlida.
+missingEmailMessage=«{{0}}»: Indiqueu una adreça electrònica.
 applicationsIntroMessage=Feu seguiment i gestioneu els permisos de les aplicacions per a accedir al vostre compte
-error-invalid-length=L''atribut {0} ha de tindre una llargària d''entre {1} i {2}.
-missingLastNameMessage=«{0}»: Indiqueu els vostres cognoms.
-linkedLoginProviders=Proveïdors d''entrada enllaçats
+error-invalid-length=«{{0}}» ha de tenir una llargària d’entre {{1}} i {{2}}.
+missingLastNameMessage=«{{0}}»: Indiqueu els vostres cognoms.
+linkedLoginProviders=Proveïdors d'entrada enllaçats
 inUse=En ús
 client=Client
-error-invalid-uri=L''URL «{0}» no és vàlid.
+error-invalid-uri=L’URL «{{0}}» no és vàlid.
 systemDefined=Definit pel sistema
 internalApp=Internes
-accessGrantedOn=Accés concedit el: 
+accessGrantedOn=Accés concedit el:
 permissionRequests=Peticions de permís
-shareSuccess=S''ha compartit el recurs correctament.
-missingUsernameMessage=«{0}»: Indiqueu el vostre nom d''usuari.
+shareSuccess=S'ha compartit el recurs correctament.
+missingUsernameMessage=«{{0}}»: Indiqueu el vostre nom d’usuari.
 fullName={{givenName}} {{familyName}}
 resources=Recursos
 resourceIntroMessage=Compartiu recursos entre membres del vostre equip
 unLink=Desenllaça el compte
 termsOfService=Condicions del servei
 requestor=Sol·licitant
-shareWith=Comparteix amb 
+shareWith=Comparteix amb
 updateCredAriaLabel=Actualitza la credencial
-error-pattern-no-match=«{0}» no té el format requerit.
+error-pattern-no-match=«{{0}}» no té el format requerit.
 application=Aplicació
-unlinkedLoginProviders=Proveïdors d''entrada no enllaçats
-applicationDetails=Detalls de l''aplicació
-successRemovedMessage={{userLabel}} s''ha eliminat.
+unlinkedLoginProviders=Proveïdors d'entrada no enllaçats
+applicationDetails=Detalls de l'aplicació
+successRemovedMessage={{userLabel}} s'ha eliminat.
 deleteAccountWarning=Això és irreversible. Totes les vostres dades es destruiran permanentment i no seran accessibles.
-error-person-name-invalid-character=«{0}» conté un caràcter no vàlid.
+error-person-name-invalid-character=«{{0}}» conté un caràcter no vàlid.
 user=Usuari
 applications=Aplicacions
-username=Nom d''usuari
+username=Nom d'usuari
 removeConsentSuccess=S'ha eliminat el consentiment amb èxit
 required=Requerit
 deviceActivity=Activitat dels aparells
@@ -171,8 +171,8 @@ webauthn-passwordless-help-text=Utilitzeu la vostra Passkey per a entrar sense c
 passwordless=Sense contrasenya
 recovery-authn-code=Els meus codis d'autenticació de recuperació
 recovery-authn-codes-help-text=Aquests codis es poden utilitzar per a recuperar l'accés al vostre compte en cas que els altres mètodes de 2FA no siguin disponibles.
-recovery-codes-number-used={0} codis de recuperació utilitzats
-recovery-codes-number-remaining={0} codis de recuperació restants
+recovery-codes-number-used={{0}} codis de recuperació utilitzats
+recovery-codes-number-remaining={{0}} codis de recuperació restants
 oid4vci=Credencials verificables
 verifiableCredentialsTitle=Credencials verificables
 verifiableCredentialsDescription=Seleccioneu les credencials a importar a la vostra cartera.
@@ -215,5 +215,6 @@ errorSignOutMessage=No s'ha pogut sortir: {{error}}
 errorRemovedMessage=No s'ha pogut suprimir {{userLabel}} a causa de: {{error}}
 resourceSharedWith_other=El recurs està compartit amb <0>{{username}}</0> i <1>{{other}}</1> altres usuaris
 shareUser=Afegeix usuaris amb qui compartir el recurs
-error-invalid-multivalued-size=L''atribut {{0}} ha de tenir almenys {{1}} i com a mot {{2}} valors.
+error-invalid-multivalued-size=L’atribut {{0}} ha de tenir almenys {{1}} i com a molt {{2}} valors.
 termsAndConditionsDeclined=Cal que accepteu els Termes i Condicions per a continuar
+defaultLocale=Trieu...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_de.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_de.properties
index 0234dca643e1..399e74e09976 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_de.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_de.properties
@@ -148,7 +148,7 @@ systemDefined=Systemdefiniert
 hasAccessTo=Hat Zugriff auf
 internalApp=Intern
 updateError=Konnte die Ressource nicht aktualisieren aufgrund von: {{error}}
-accessGrantedOn=Zugriff gewährt am: 
+accessGrantedOn=Zugriff gewährt am:
 editTheResource=Ressource bearbeiten - {{name}}
 permissionRequests=Berechtigungsanfragen
 shareSuccess=Ressource erfolgreich geteilt.
@@ -164,8 +164,8 @@ termsOfService=Nutzungsbedingungen
 jumpToSection=Zu Abschnitt springen
 linkError=Konnte nicht verknüpft werden aufgrund von: {{error}}
 requestor=Anfragesteller
-shareWith=Teilen mit 
-updateCredAriaLabel=Berechtigungsnachweise aktualisieren
+shareWith=Teilen mit
+updateCredAriaLabel=Zugangsdaten aktualisieren
 error-pattern-no-match='{{0}}' entspricht nicht dem erforderlichen Format.
 application=Anwendung
 unlinkedLoginProviders=Nicht verknüpfte Login-Anbieter
@@ -186,19 +186,19 @@ webauthn-passwordless-display-name=Passkey
 webauthn-passwordless-help-text=Verwenden Sie Ihre Passkey für passwortloses Anmelden.
 passwordless=Passwortlos
 recovery-authn-codes-display-name=Authentifizierungscodes für die Wiederherstellung
-recovery-codes-number-remaining={0} verbleibende Wiederherstellungscodes
-recovery-codes-number-used={0} Wiederherstellungscodes benutzt
+recovery-codes-number-remaining={{0}} verbleibende Wiederherstellungscodes
+recovery-codes-number-used={{0}} Wiederherstellungscodes benutzt
 recovery-codes-generate-new-codes=Generieren Sie neue Wiederherstellungscodes, um den Zugang zu Ihrem Konto sicherzustellen
-error-invalid-multivalued-size=Attribut {0} muss mindestens {1} und höchstens {2} Wert(e) haben.
+error-invalid-multivalued-size=Attribut {{0}} muss mindestens {{1}} und darf höchstens {{2}} Wert(e) haben.
 recovery-authn-code=Meine Authentifizierungscodes für die Wiederherstellung
 recovery-authn-codes-help-text=Diese Codes können verwendet werden, um Ihren Zugang wiederherzustellen, falls Ihre anderen Zwei-Faktor-Mittel nicht verfügbar sind.
 verifiableCredentialsIssuerAlert=War nicht in der Lage, die Ausstellungsinformationen abzurufen.
-verifiableCredentialsConfigAlert=War nicht in der Lage, die Berechtigungsnachweiskonfiguration abzurufen.
-oid4vci=Überprüfbare Berechtigungsnachweise
-verifiableCredentialsTitle=Überprüfbare Berechtigungsnachweise
-verifiableCredentialsDescription=Wählen Sie den Berechtigungsnachweis für den Import in Ihren Wallet.
+verifiableCredentialsConfigAlert=War nicht in der Lage, die Zugangsdatenkonfiguration abzurufen.
+oid4vci=Überprüfbare Zugangsdaten
+verifiableCredentialsTitle=Überprüfbare Zugangsdaten
+verifiableCredentialsDescription=Wählen Sie den Zugangsdaten für den Import in Ihren Wallet.
 verifiableCredentialsOfferAlert=War nicht in der Lage, ein Angebot abzurufen.
-verifiableCredentialsSelectionDefault=Wählen Sie eine Berechtigungsnachweiskonfiguration aus.
+verifiableCredentialsSelectionDefault=Wählen Sie eine Zugangsdatenkonfiguration aus.
 addressScopeConsentText=Adresse
 phoneScopeConsentText=Telefonnummer
 rolesScopeConsentText=Nutzerrollen
@@ -215,3 +215,4 @@ organizationList=Liste der Organisationen
 domains=Domains
 refresh=Aktualisieren
 termsAndConditionsDeclined=Sie müssen die Allgemeinen Geschäftsbedingungen akzeptieren, um fortzufahren
+defaultLocale=Auswählen...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_el.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_el.properties
index eb190dd9d05b..4080b2cc3000 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_el.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_el.properties
@@ -17,20 +17,20 @@ edit=Επεξεργασία
 otp-display-name=εφαρμογή ταυτοποίησης
 linkedEmpty=Κανένας συνδεδεμένος πάροχος
 directMembership=Άμεση συμμετοχή
-error-invalid-length-too-short=Το χαρακτηριστικό {0} πρέπει να έχει ελάχιστο μήκος {1}.
-error-number-out-of-range-too-big=Το χαρακτηριστικό {0} πρέπει να έχει μέγιστη τιμή {2}.
+error-invalid-length-too-short=Το χαρακτηριστικό {{0}} πρέπει να έχει ελάχιστο μήκος {{1}}.
+error-number-out-of-range-too-big=Το χαρακτηριστικό {{0}} πρέπει να έχει μέγιστη τιμή {{2}}.
 updateEmail=Ενημέρωση email
 two-factor=Έλεγχος ταυτότητας δύο-παραγόντων
 signedInDevicesExplanation=Αποσύνδεση από όποια άγνωστη συσκευή.
 status=Κατάσταση
-error-number-out-of-range-too-small=Το χαρακτηριστικό {0} πρέπει να έχει ελάχιστη τιμή {1}.
+error-number-out-of-range-too-small=Το χαρακτηριστικό {{0}} πρέπει να έχει ελάχιστη τιμή {{1}}.
 removeModalMessage=Αυτό θα αφαιρέσει την τρέχουσα άδεια πρόσβαση που δόθηκε για το {{name}}. Θα πρέπει να δώσετε ξανά πρόσβαση αν θέλετε να χρησιμοποιήσετε αυτή την εφαρμογή.
 lastName=Επώνυμο
 invalidEmailMessage=Μη έγκυρη διεύθυνση email.
 clients=Πελάτες
 filterByName=Φιλτράρισμα Ανά Όνομα ...
 refreshPage=Ανανέωση σελίδας
-error-user-attribute-required=Παρακαλώ ορίστε το χαρακτηριστικό {0}.
+error-user-attribute-required=Παρακαλώ ορίστε το χαρακτηριστικό {{0}}.
 currentSession=Τρέχουσα συνεδρία
 error-empty=Παρακαλώ ορίστε τιμή.
 error-invalid-uri-fragment=Μη έγκυρο κομμάτι URL.
@@ -45,7 +45,7 @@ signOutAllDevicesWarning=Αυτή η ενέργεια θα αποσυνδέσε
 unShareSuccess=Επιτυχής διακοπή διαμοιρασμού πόρου.
 signingIn=Σε είσοδο
 stopUsingCred=Διακοπή χρήσης του {{name}};
-error-number-out-of-range=Το χαρακτηριστικό {0} πρέπει να είναι ένας αριθμός μεταξύ {1} και {2}.
+error-number-out-of-range=Το χαρακτηριστικό {{0}} πρέπει να είναι ένας αριθμός μεταξύ {{1}} και {{2}}.
 thirdPartyApp=Τρίτου-μέρους
 started=Ξεκίνησε
 updateSuccess=Ο πόρος ενημερώθηκε επιτυχώς.
@@ -58,7 +58,7 @@ myResources=Οι Πόροι Μου
 linkedAccountsIntroMessage=Διαχείριση των εισόδων μέσω λογαριασμών σε τρίτους.
 groupDescriptionLabel=Εμφάνιση ομάδων με τις οποίες έχετε συσχετισθεί
 resourceAlreadyShared=Ο πόρος ήδη μοιράζεται με αυτό το χρήστη.
-error-invalid-length-too-long=Το χαρακτηριστικό {0} πρέπει να έχει μέγιστο μήκος {2}.
+error-invalid-length-too-long=Το χαρακτηριστικό {{0}} πρέπει να έχει μέγιστο μήκος {{2}}.
 accountUpdatedMessage=Ο λογαριασμός σας έχει ενημερωθεί.
 logo=Λογότυπο
 password-help-text=Συνδεθείτε βάζοντας το κωδικό πρόσβασής σας.
@@ -89,11 +89,11 @@ signedInDevices=Συνδεδεμένες συσκευές
 missingPasswordMessage=Παρακαλώ ορίστε κωδικό πρόσβασης.
 otp-help-text=Εισάγετε ένα κωδικό επιβεβαίωσης από την εφαρμογή ταυτοποίησης.
 error-invalid-uri-scheme=Μη έγκυρο σχήμα URL.
-error-user-attribute-read-only=Το πεδίο {0} είναι μόνο για ανάγνωση.
+error-user-attribute-read-only=Το πεδίο {{0}} είναι μόνο για ανάγνωση.
 error-invalid-date=Μη έγκυρη ημερομηνία.
 missingEmailMessage=Παρακαλώ ορίστε email.
 applicationsIntroMessage=Διαχειριστείτε το δικαίωμα της εφαρμογής σας να έχει πρόσβαση στο λογαριασμό σας
-error-invalid-length=Το χαρακτηριστικό {0} πρέπει να έχει μήκος μεταξύ {1} και {2}.
+error-invalid-length=Το χαρακτηριστικό {{0}} πρέπει να έχει μήκος μεταξύ {{1}} και {{2}}.
 missingLastNameMessage=Παρακαλώ ορίστε επώνυμο.
 linkedLoginProviders=Συνδεδεμένοι πάροχοι εισόδου
 inUse=Σε χρήση
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_es.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_es.properties
index 6d460f92a72d..7008a95fb8f4 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_es.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_es.properties
@@ -72,7 +72,7 @@ done=Listo
 basic-authentication=Autenticación básica
 socialLogin=Inicio de sesión social
 notInUse=No esta en uso
-unShareAllConfirm=¿Estás seguro de que quieres remover completamente todos los recursos?
+unShareAllConfirm=¿Está seguro que quiere remover completamente todos los recursos?
 firstName=Nombre
 name=Nombre
 unknownUser=Anónimo
@@ -101,7 +101,7 @@ client=Cliente
 error-invalid-uri='{{0}}' es una URL inválida.
 systemDefined=Sistema definido
 internalApp=Interna
-accessGrantedOn=Acceso otorgado en: 
+accessGrantedOn=Acceso otorgado en:
 permissionRequests=Solicitudes de permiso
 shareSuccess=Recurso compartido con éxito.
 missingUsernameMessage='{{0}}': Por favor indica tu usuario.
@@ -111,7 +111,7 @@ resourceIntroMessage=Comparta sus recursos entre los miembros del equipo
 unLink=Desvincular cuenta
 termsOfService=Términos de servicio
 requestor=Requirente
-shareWith=Compartir con 
+shareWith=Compartir con
 updateCredAriaLabel=Actualizar credencial
 error-pattern-no-match='{{0}}' no coincide con el formato requerido.
 application=Aplicación
@@ -161,7 +161,7 @@ emptyUserOrganizations=Sin organizaciones
 searchOrganization=Buscar organización
 refresh=Actualizar
 termsAndConditionsDeclined=Debe aceptar los Términos y Condiciones para continuar
-scopeDescriptionHelp=Descripción del ámbito del cliente
+scopeDescriptionHelp=Descripción del client scope
 addMultivaluedLabel=Agregar {{fieldLabel}}
 selectALocale=Seleccionar una configuración regional
 deviceActivity=Actividad del dispositivo
@@ -174,9 +174,9 @@ required=Requerido
 personalInfoDescription=Administra tu información básica
 selectOne=Seleccionar una opción
 groupsListHeader=Encabezado de la lista de grupos
-createFlowHelp=Puedes crear un flujo de nivel superior dentro de este formulario
+createFlowHelp=Puede crear un flujo de nivel superior dentro de este formulario
 emptyUserOrganizationsInstructions=Aún no te has unido a ninguna organización.
-rolesScope=Si no se define una asignación de ámbito de roles, cada usuario tiene permiso para usar este ámbito de cliente. Si se definen asignaciones de ámbito de roles, el usuario debe ser miembro de al menos uno de los roles.
+rolesScope=Si no se ha definido una asignación de ámbito de roles, cada usuario podrá usar este client scope. Si hay asignaciones de ámbito de roles definidas, el usuario debe ser miembro de al menos uno de los roles.
 permissionRequest=Solicitudes de permisos - {{name}}
 unLinkError=No se pudo desvincular debido a: {{error}}
 somethingWentWrong=Algo salió mal
@@ -185,18 +185,18 @@ general=General
 recovery-authn-codes-display-name=Códigos de autenticación de recuperación
 organizationDescription=Ver las organizaciones a las que te uniste
 sharedWithMe=Compartido conmigo
-recovery-codes-number-used={0} códigos de recuperación utilizados
+recovery-codes-number-used={{0}} códigos de recuperación utilizados
 delete=Borrar
 accountSecurity=Seguridad de la cuenta
 updateError=No se pudo actualizar el recurso debido a: {{error}}
-recovery-authn-codes-help-text=Estos códigos se pueden usar para recuperar el acceso en caso de que tus otros métodos de 2FA no estén disponibles.
+recovery-authn-codes-help-text=Estos códigos se pueden usar para recuperar el acceso en caso de que sus otros métodos de 2FA no estén disponibles.
 unShareError=No se pudo dejar de compartir el recurso debido a: {{error}}
 hasAccessTo=Tiene acceso a
 accountUpdatedError=No se pudo actualizar la cuenta debido a errores de validación
 linkError=No se pudo vincular debido a: {{error}}
 groupsListColumnsNames=Nombres de las columnas de la lista de grupos
 clientTypeHelp=El tipo de este recurso. Puede usarse para agrupar diferentes instancias de recursos del mismo tipo.
-recovery-codes-number-remaining={0} códigos de recuperación restantes
+recovery-codes-number-remaining={{0}} códigos de recuperación restantes
 jumpToSection=Saltar a la sección
 organizationList=Lista de organizaciones
 phoneScopeConsentText=Número de teléfono
@@ -213,7 +213,8 @@ domains=Dominios
 accept=Aceptar
 scopesHelp=Los ámbitos asociados con este recurso.
 save=Aceptar
-scopeNameHelp=Nombre del ámbito del cliente. Debe ser único en el realm. El nombre no debe contener espacios, ya que se utiliza como valor del parámetro de ámbito
+scopeNameHelp=Nombre del client scope. Debe ser único en el Realm. No debe contener espacios, ya que se usa como valor del parámetro scope
 resourceSharedWith_zero=Este recurso no está compartido.
 clientDescriptionHelp=Especifique la descripción del cliente. Por ejemplo: 'Mi cliente para hojas de tiempo'. También admite claves para valores localizados. Por ejemplo: ${my_client_description}
-scopeTypeHelp=Ámbitos del cliente, que se agregarán como ámbitos predeterminados a cada cliente creado
+scopeTypeHelp=Los client scopes que se agregarán como ámbitos predeterminados a cada cliente creado
+defaultLocale=Elegir...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fi.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fi.properties
index a9f9e8c494ac..00fb780498c7 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fi.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fi.properties
@@ -5,16 +5,16 @@ backTo=Takaisin {{app}}
 error-invalid-email=Väärä sähköpostiosoite.
 myResources=Minun resurssini
 password=Salasana
-error-invalid-length-too-long=Ominaisuudella {0} täytyy olla maksimipituus {2}.
+error-invalid-length-too-long=Ominaisuudella {{0}} täytyy olla maksimipituus {{2}}.
 accountUpdatedMessage=Käyttäjätiedot päivitetty.
 error-username-invalid-character=Käyttäjänimi sisältää vääriä merkkejä.
 error-invalid-value=Väärä arvo.
 socialLogin=Kirjaudu sosiaalisen median tunnuksilla
-error-invalid-length-too-short=Ominaisuudella {0} täytyy olla minimipituus {1}.
+error-invalid-length-too-short=Ominaisuudella {{0}} täytyy olla minimipituus {{1}}.
 firstName=Etunimi
-error-number-out-of-range-too-big=Ominaisuudella {0} täytyy olla maksimiarvona {2}.
+error-number-out-of-range-too-big=Ominaisuudella {{0}} täytyy olla maksimiarvona {{2}}.
 name=Nimi
-error-number-out-of-range-too-small=Ominaisuudella {0} täytyy olla minimiarvona {1}.
+error-number-out-of-range-too-small=Ominaisuudella {{0}} täytyy olla minimiarvona {{1}}.
 invalidEmailMessage=Virheellinen sähköpostiosoite.
 lastName=Sukunimi
 expires=Vanhenee
@@ -23,13 +23,13 @@ filterByName=Suodata nimen mukaan ...
 error-invalid-number=Väärä numero.
 description=Kuvaus
 missingPasswordMessage=Anna salasana.
-error-user-attribute-required=Ole hyvä ja määritä ominaisuus {0}.
+error-user-attribute-required=Ole hyvä ja määritä ominaisuus {{0}}.
 error-invalid-uri-scheme=Väärä URL\:n malli.
-error-user-attribute-read-only=Kenttä {0} on "vain luku"-tilassa.
+error-user-attribute-read-only=Kenttä {{0}} on "vain luku"-tilassa.
 error-invalid-date=Väärä päivämäärä.
 missingEmailMessage=Anna sähköpostiosoite.
 applicationsIntroMessage=Seuraa ja hallitse sovelluksiasi, joilla on pääsy tilille
-error-invalid-length=Ominaisuudella {0} täytyy olla pituus väliltä {1} ja {2}.
+error-invalid-length=Ominaisuudella {{0}} täytyy olla pituus väliltä {{1}} ja {{2}}.
 error-empty=Ole hyvä ja määritä arvo. 
 missingLastNameMessage=Anna sukunimi.
 error-invalid-uri-fragment=Väärä URL\:n osa.
@@ -40,7 +40,7 @@ share=Jaa
 error-invalid-uri=Väärä URL.
 email=Sähköposti
 permissionRequests=Lupapyynnöt
-error-number-out-of-range=Ominaisuuden {0} täytyy olla numero väliltä {1} ja {2}.
+error-number-out-of-range=Ominaisuuden {{0}} täytyy olla numero väliltä {{1}} ja {{2}}.
 missingUsernameMessage=Anna käyttäjätunnus.
 fullName={{givenName}} {{familyName}}
 resources=Resurssit
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fr.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fr.properties
index 7ccb31d01777..1dbacb3357db 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fr.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_fr.properties
@@ -34,7 +34,7 @@ signedInDevicesExplanation=Déconnectez-vous de tout appareil non familier.
 addMultivaluedLabel=Ajouter {{fieldLabel}}
 status=Statut
 error-number-out-of-range-too-small=« {{0}} » doit avoir une valeur minimale de {{1}}.
-invalidEmailMessage='{{0}}': Adresse de courriel invalide.
+invalidEmailMessage='{{0}}' : Adresse de courriel invalide.
 lastName=Nom de famille
 removeModalMessage=Cela supprimera l'autorisation d'accès actuellement accordée pour {{name}}. Vous devrez de nouveau obtenir les accès si vous souhaitez utiliser cette application.
 clients=Clients
@@ -148,7 +148,7 @@ systemDefined=Défini par le système
 hasAccessTo=A accès à
 internalApp=Interne
 updateError=Impossible de mettre à jour la ressource à cause de \: {{error}}
-accessGrantedOn=Accès autorisé le : 
+accessGrantedOn=Accès autorisé le :
 editTheResource=Éditer la ressource - {{name}}
 permissionRequests=Demandes d'autorisation
 shareSuccess=La ressource a bien été partagée.
@@ -164,7 +164,7 @@ termsOfService=Conditions d'utilisation
 jumpToSection=Sauter à la section
 linkError=Impossible de lier à cause de \: {{error}}
 requestor=Demandeur
-shareWith=Partager avec 
+shareWith=Partager avec
 updateCredAriaLabel=Mettre à jour l'identifiant
 error-pattern-no-match=« {{0}} » ne respecte pas le format requis.
 application=Application
@@ -185,12 +185,12 @@ webauthn-help-text=Utilisez votre clé d'accès pour vous connecter.
 webauthn-passwordless-display-name=Clé d'accès
 webauthn-passwordless-help-text=Utilisez votre clé d'accès pour une connexion sans mot de passe.
 passwordless=Sans mot de passe
-error-invalid-multivalued-size=L'attribut {{0}} doit avoir au moins {{1}} et au plus {{2}} valeur(s).
+error-invalid-multivalued-size=L’attribut {{0}} doit avoir au moins {{1}} et au plus {{2}} valeur(s).
 recovery-authn-code=Mes codes d'authentification de récupération
 recovery-authn-codes-display-name=Codes d'authentification de récupération
 recovery-authn-codes-help-text=Ces codes peuvent être utilisés pour récupérer votre accès au cas où vos autres moyens 2FA ne seraient pas disponibles.
-recovery-codes-number-used={0} codes de récupération utilisés
-recovery-codes-number-remaining={0} codes de récupération restants
+recovery-codes-number-used={{0}} codes de récupération utilisés
+recovery-codes-number-remaining={{0}} codes de récupération restants
 recovery-codes-generate-new-codes=Générez de nouveaux codes pour garantir l'accès à votre compte
 oid4vci=Informations d'identification vérifiables
 verifiableCredentialsTitle=Informations d'identification vérifiables
@@ -215,3 +215,4 @@ organizationList=Liste des organisations
 domains=Domaines
 refresh=Rafraîchir
 termsAndConditionsDeclined=Vous devez accepter les Conditions Générales d'Utilisation pour continuer
+defaultLocale=Choisir...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hr.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hr.properties
index 1b6b64e4f825..3fcbd8a9a9ed 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hr.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hr.properties
@@ -189,8 +189,8 @@ error-invalid-multivalued-size=Atribut {{0}} mora imati najmanje {{1}} i najviš
 recovery-authn-code=Moji kodovi za oporavak autentifikacije
 recovery-authn-codes-display-name=Kodovi za oporavak autentifikacije
 recovery-authn-codes-help-text=Ovi kodovi mogu se koristiti za povrat pristupa u slučaju da vam drugi načini dvofaktorske autentifikacije nisu dostupni.
-recovery-codes-number-used={0} kodova za oporavak korišteno
-recovery-codes-number-remaining={0} kodova za oporavak preostalo
+recovery-codes-number-used={{0}} kodova za oporavak korišteno
+recovery-codes-number-remaining={{0}} kodova za oporavak preostalo
 recovery-codes-generate-new-codes=Generirajte nove kodove kako biste osigurali pristup svom računu
 oid4vci=Provjerljive vjerodajnice
 verifiableCredentialsTitle=Provjerljive vjerodajnice
@@ -214,4 +214,4 @@ searchOrganization=Pretraži organizaciju
 organizationList=Popis organizacija
 domains=Domene
 refresh=Osvježi
-termsAndConditionsDeclined=Morate prihvatiti Uvjete korištenja da biste nastavili
\ No newline at end of file
+termsAndConditionsDeclined=Morate prihvatiti Uvjete korištenja da biste nastavili
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hu.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hu.properties
index 3fc8df3e4c2a..54da1b12f2d4 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hu.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_hu.properties
@@ -18,20 +18,20 @@ otp-display-name=hitelesítő alkalmazás
 selectALocale=Nyelv kiválasztása
 linkedEmpty=Nincsenek összekapcsolt szolgáltatások
 directMembership=Közvetlen tagság
-error-invalid-length-too-short={0} minimális hossza {1} karakter.
-error-number-out-of-range-too-big={0} maximum értéke\: {2}.
+error-invalid-length-too-short={{0}} minimális hossza {{1}} karakter.
+error-number-out-of-range-too-big={{0}} maximum értéke\: {{2}}.
 updateEmail=E-mail cím módosítása
 two-factor=Kétlépcsős azonosítás
 signedInDevicesExplanation=Jelentkezzen ki minden ismeretlen eszközből.
 status=Státusz
-error-number-out-of-range-too-small={0} minimum értéke\: {1}.
+error-number-out-of-range-too-small={{0}} minimum értéke\: {{1}}.
 removeModalMessage=Ezzel törli a(z) {{name}} alkalmazás jelenlegi hozzáféréseit. A hozzáféréseket újra meg kell adni, ha hasznáni szeretné az alkalmazást.
 lastName=Vezetéknév
 invalidEmailMessage=Érvénytelen e-mail cím.
 clients=Kliensek
 filterByName=Név alapú keresés
 refreshPage=Oldal újratöltése
-error-user-attribute-required=Kérem, adja meg a(z) {0} értékét.
+error-user-attribute-required=Kérem, adja meg a(z) {{0}} értékét.
 currentSession=Ez a munkamenet
 error-empty=Kérem, adja meg a mező értékét.
 error-invalid-uri-fragment=Érvénytelen URL fragmens.
@@ -46,7 +46,7 @@ signOutAllDevicesWarning=Ezzel a művelettel kijelentkezik az összes bejelentke
 unShareSuccess=Az erőforrás megosztása megszüntetve
 signingIn=Bejelentkezés
 stopUsingCred=Eltávolítja\: {{name}}?
-error-number-out-of-range={0} értéke {1} és {2} közötti szám kell legyen.
+error-number-out-of-range={{0}} értéke {{1}} és {{2}} közötti szám kell legyen.
 thirdPartyApp=Harmadik fél
 started=Kezdete
 updateSuccess=Az erőforrás módosítva
@@ -59,7 +59,7 @@ myResources=Erőforrásaim
 linkedAccountsIntroMessage=Bejelentkezés kezelése harmadik féltől származó fiókokkal.
 groupDescriptionLabel=Az Önhöz tartozó csoportok megtekintése
 resourceAlreadyShared=Az erőforrás már meg van osztva ezzel a felhasználóval.
-error-invalid-length-too-long={0} maximális hossza {2} karakter.
+error-invalid-length-too-long={{0}} maximális hossza {{2}} karakter.
 accountUpdatedMessage=Felhasználói fiókját módosítottuk.
 logo=Logó
 password-help-text=Bejelentkezés jelszó segítségével.
@@ -90,11 +90,11 @@ signedInDevices=Bejelentkezett eszközök
 missingPasswordMessage=Kérem, adja meg a jelszót.
 otp-help-text=Hitelesítő kód használata alkalmazás segítségével.
 error-invalid-uri-scheme=Érvénytelen URL séma.
-error-user-attribute-read-only=A(z) {0} mező csak olvasható.
+error-user-attribute-read-only=A(z) {{0}} mező csak olvasható.
 error-invalid-date=Érvénytelen dátum.
 missingEmailMessage=Kérem, adja meg az e-mail címet.
 applicationsIntroMessage=Kezelje alkalmazás jogosultságait, hogy hozzáférjen a fiókjához
-error-invalid-length={0} hossza {1} és {2} karakter között kell legyen.
+error-invalid-length={{0}} hossza {{1}} és {{2}} karakter között kell legyen.
 missingLastNameMessage=Kérem, adja meg a vezetéknevet.
 linkedLoginProviders=Összekapcsolt hitelesítő szolgáltatások
 inUse=Használatban
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_it.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_it.properties
index fc7d687def6e..59662a562c80 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_it.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_it.properties
@@ -3,79 +3,79 @@
 cancel=Annulla
 backTo=Torna a {{app}}
 applicationType=Tipo applicazione
-noGroupsText=Non sei iscritto/a a nessun gruppo
+noGroupsText=Non sei inserito/a in nessun gruppo
 path=Percorso
 password=Password
 setUpNew=Impostazione {{name}}
 lastAccessedOn=Ultimo accesso
 permissions=Permessi
-credentialCreatedAt=Creato
-error-username-invalid-character=''{0}'' contiene caratteri non validi.
+credentialCreatedAt=<0>Creato</0> {{date}}.
+error-username-invalid-character='{{0}}' contiene caratteri non validi.
 infoMessage=Cliccando su 'Rimuovi accesso', rimuoverai le autorizzazioni concesse a questa applicazione. Questa applicazione non utilizzerà più le tue informazioni.
 unknownOperatingSystem=Sistema operativo sconosciuto
 edit=Modifica
-otp-display-name=applicazione authenticator
+otp-display-name=Applicazione Authenticator (OTP)
 selectALocale=Seleziona la lingua
 signOut=Esci
 linkedEmpty=Nessun provider collegato
-directMembership=Membri diretti
+directMembership=Appartenenza diretta
 accept=Accetta
-error-invalid-length-too-short=''{0}'' deve avere una lunghezza minima di {1}.
-error-number-out-of-range-too-big=''{0}'' deve avere un valore massimo di {2}.
+error-invalid-length-too-short='{{0}}' deve avere una lunghezza minima di {{1}}.
+error-number-out-of-range-too-big='{{0}}' deve avere un valore massimo di {{2}}.
 updateEmail=Aggiorna email
 two-factor=Autenticazione a due fattori
 signedInDevicesExplanation=Uscire da tutti i dispositivi sconosciuti.
 status=Stato
-error-number-out-of-range-too-small=''{0}'' deve avere un valore minimo di {1}.
-removeModalMessage=Questo rimuoverà l''autorizzazione di accesso attualmente concessa per {{name}}. Dovrai concedere nuovamente l''accesso se vuoi utilizzare questa app.
+error-number-out-of-range-too-small='{{0}}' deve avere un valore minimo di {{1}}.
+removeModalMessage=Questo rimuoverà l’autorizzazione di accesso attualmente concessa per {{name}}. Dovrai concedere nuovamente l’accesso se vuoi utilizzare questa applicazione.
 lastName=Cognome
-invalidEmailMessage=Indirizzo email non valido.
+invalidEmailMessage='{{0}}': indirizzo email non valido.
 clients=Client
 filterByName=Filtra per nome ...
 refreshPage=Aggiornare la pagina
-error-user-attribute-required=Specificare ''{0}''.
+error-user-attribute-required=Specificare '{{0}}'.
 currentSession=Sessione in corso
-error-empty=Specificare il valore di ''{0}''.
-error-invalid-uri-fragment=''{0}'' è un frammento URL non valido.
+error-empty=Specificare il valore di '{{0}}'.
+error-invalid-uri-fragment='{{0}}' è un frammento URL non valido.
 signedOutSession=Disconnesso {{browser}}/{{os}}
-missingFirstNameMessage=Inserisci il nome.
-error-invalid-blank=Specificare il valore di ''{0}''.
+missingFirstNameMessage='{{0}}': inserisci il nome.
+error-invalid-blank=Specificare il valore di '{{0}}'.
 share=Condiviso
 close=Chiudi
 email=Email
 signOutWarning=Chiudere la sessione?
-signOutAllDevicesWarning=Quest''azione eliminerà tutti i dispositivi che hanno effettuato l''accesso all''account, compreso il dispositivo attualmente in uso.
-unShareSuccess=Risorsa non più condivisa con successo.
+signOutAllDevicesWarning=Quest'azione disconnetterà tutti i dispositivi che hanno effettuato l'accesso al tuo utente, compreso il dispositivo attualmente in uso.
+unShareSuccess=La condivisione della risorsa è stata rimossa.
 signingIn=Impostazioni di accesso
 stopUsingCred=Smettere di usare {{name}}?
-error-number-out-of-range=''{0}'' deve essere un numero compreso tra {1} e {2}.
-thirdPartyApp=App di terze parti
+error-number-out-of-range='{{0}}' deve essere un numero compreso tra {{1}} e {{2}}.
+thirdPartyApp=Applicazioni di terze parti
 started=Iniziato
 updateSuccess=Risorsa aggiornata con successo.
-unShare=Non condividere tutto
+unShare=Rimuovi ogni condivisione
 removeAccess=Rimuovi accesso
 removeCred=Rimuovi {{name}}
 signOutAllDevices=Disconnettere tutti i dispositivi
 error-invalid-email=Indirizzo email non valido.
 myResources=Le mie risorse
-linkedAccountsIntroMessage=Gestire gli accessi tramite account di terzi.
+linkedAccountsIntroMessage=Gestire gli accessi tramite utenze di terzi.
 groupDescriptionLabel=Visualizza i gruppi con cui sei associato/a
 resourceAlreadyShared=La risorsa è già condivisa con questo utente.
-error-invalid-length-too-long=''{0}'' deve avere una lunghezza massima di {2}.
-accountUpdatedMessage=Il tuo account è stato aggiornato.
+error-invalid-length-too-long='{{0}}' deve avere una lunghezza massima di {{2}}.
+accountUpdatedMessage=Il tuo utente è stato aggiornato.
 logo=Logo
 password-help-text=Accedere inserendo la password.
-deleteAccount=Elimina account
+deleteAccount=Elimina utente
 add=Aggiungi
-error-invalid-value=''{0}'' ha un valore non valido.
+error-invalid-value='{{0}}' ha un valore non valido.
 ipAddress=Indirizzo IP
 resourceName=Nome della risorsa
 unlinkedEmpty=Nessun provider scollegato
 done=Fatto
 basic-authentication=Autenticazione di base
-socialLogin=Social Login
+socialLogin=Accesso Social
 notInUse=Non in uso
-unShareAllConfirm=ASiete sicuri di voler rimuovere completamente tutte le condivisioni?
+unShareAllConfirm=Siete sicuri di voler rimuovere completamente tutte le condivisioni?
 firstName=Nome
 name=Nome
 unknownUser=Anonimo
@@ -84,44 +84,137 @@ password-display-name=Password
 expires=Scade
 noGroups=Nessun gruppo
 notSetUp={{name}} non è impostato.
-error-invalid-number=''{0}'' non è un numero valido.
-link=Account collegato
+error-invalid-number='{{0}}' non è un numero valido.
+link=Utente collegato
 description=Descrizione
 update=Aggiorna
 signedInDevices=Dispositivi registrati
-missingPasswordMessage=Inserisci la password.
-otp-help-text=Immettere un codice di verifica dall''applicazione Authenticator.
-error-invalid-uri-scheme=''{0}'' ha uno schema URL non valido.
-error-invalid-date=''{0}'' è una data non valida.
-missingEmailMessage=Inserisci l''indirizzo email.
-applicationsIntroMessage=Traccia e gestisci i permessi delle applicazioni nell''accesso al tuo account
-error-invalid-length=''{0}'' deve avere una lunghezza compresa tra {1} e {2}.
-missingLastNameMessage=Inserisci il cognome.
+missingPasswordMessage='{{0}}': inserisci la password.
+otp-help-text=Immettere un codice di verifica dall’applicazione Authenticator.
+error-invalid-uri-scheme='{{0}}' ha uno schema URL non valido.
+error-invalid-date='{{0}}' è una data non valida.
+missingEmailMessage='{{0}}': inserisci l’indirizzo email.
+applicationsIntroMessage=Traccia e gestisci i permessi delle applicazioni nell’accesso al tuo utente
+error-invalid-length='{{0}}' deve avere una lunghezza compresa tra {{1}} e {{2}}.
+missingLastNameMessage='{{0}}': inserisci il cognome.
 linkedLoginProviders=Provider di accesso collegati
 inUse=In uso
 client=Client
-error-invalid-uri=''{0}'' è un URL non valido.
-systemDefined=SSistema definito
+error-invalid-uri='{{0}}' è un URL non valido.
+systemDefined=Sistema definito
 internalApp=Interna
-accessGrantedOn=Accesso concesso il
+accessGrantedOn=Accesso concesso il:
 permissionRequests=Richieste di permesso
 shareSuccess=Risorsa condivisa con successo.
-missingUsernameMessage=Inserisci lo username.
+missingUsernameMessage='{{0}}': inserisci il nome utente.
 fullName={{givenName}} {{familyName}}
 resources=Risorse
 resourceIntroMessage=Condividi le tue risorse tra i membri del team
-unLink=Account scollegato
+unLink=Utente scollegato
 termsOfService=Termini di servizio
 requestor=Richiedente
 shareWith=Condividi con
 updateCredAriaLabel=Aggiorna credenziali
-error-pattern-no-match=''{0}'' non corrisponde al formato richiesto.
+error-pattern-no-match='{{0}}' non corrisponde al formato richiesto.
 application=Applicazione
 unlinkedLoginProviders=Provider di accesso scollegati
-applicationDetails=Dettagli dell''applicazione
+applicationDetails=Dettagli dell’applicazione
 successRemovedMessage={{userLabel}} è stato rimosso.
 deleteAccountWarning=Questa operazione è irreversibile. Tutti i tuoi dati saranno distrutti in modo permanente e non potranno essere recuperati.
-error-person-name-invalid-character=''{0}'' contiene caratteri non validi.
+error-person-name-invalid-character='{{0}}' contiene caratteri non validi.
 user=Utente
 applications=Applicazioni
-username=Username
+username=Nome utente
+usernamePlaceholder=Nome utente o email
+removeConsentSuccess=Consenso rimosso
+required=Richiesto
+deviceActivity=Attività dei dispositivi
+save=Salva
+confirm=Conferma
+scopesHelp=Gli ambiti (scope) associati a questa risorsa.
+addMultivaluedLabel=Aggiungi {{fieldLabel}}
+createFlowHelp=È possibile creare un flusso di livello superiore all'interno di questo modulo
+scopeTypeHelp=Ambiti (scope) client, che verranno aggiunti come ambiti predefiniti a ogni client creato
+avatar=Avatar
+personalInfoDescription=Gestisci le tue informazioni di base
+personalInfo=Informazioni personali
+flowTypeHelp=Che tipo di modulo è
+accountSecurity=Sicurezza dell'utente
+manageAccount=Gestione utente
+shareError=Non è possibile condividere la risorsa a causa di: {{error}}
+somethingWentWrongDescription=Ci dispiace, si è verificato un errore imprevisto.
+shareTheResource=Condividi la risorsa - {{name}}
+choose=Scegli...
+delete=Cancella
+error-user-attribute-read-only=Il campo {{0}} è di sola lettura.
+updateError=Non è possibile modificare la risorsa: {{error}}
+editTheResource=Modifica la risorsa - {{name}}
+aliasHelp=Nome della configurazione
+groups=Gruppi
+resourceSharedWith_other=La risorsa è condivisa con <0>{{username}}</0> e <1>{{other}}</1> atri utenti
+shareUser=Aggiungi utenti con cui condividere la risorsa
+unLinkSuccess=Utenza scollegata con successo
+sharedWithMe=Condiviso con me
+webauthn-help-text=Usa la tua Passkey per accedere.
+webauthn-passwordless-display-name=Passkey
+webauthn-passwordless-help-text=Usa la tua Passkey per l'accesso senza password.
+passwordless=Senza password
+error-invalid-multivalued-size=Il campo {{0}} deve avere almeno {{1}} e al più {{2}} valore/i.
+recovery-codes-number-used={{0}} codici di recupero usati
+recovery-codes-number-remaining={{0}} codici di recupero rimanenti
+recovery-codes-generate-new-codes=Genera nuovi codici per assicurarti l'accesso di emergenza al tuo utente
+oid4vci=Credenziali verificabili
+verifiableCredentialsTitle=Credenziali verificabili
+verifiableCredentialsIssuerAlert=Non è stato possibile ottenere informazioni sull'emittente.
+verifiableCredentialsOfferAlert=Non è stato possibile ottenere un’offerta.
+verifiableCredentialsSelectionDefault=Seleziona la configurazione di una credenziale.
+phoneScopeConsentText=Numero di telefono
+offlineAccessScopeConsentText=Accesso offline
+samlRoleListScopeConsentText=I miei ruoli
+organizations=Organizzazioni
+organizationDescription=Controlla le organizzazioni di cui sei membro
+domains=Domini
+refresh=Ricarica
+clientDescriptionHelp=Inserisci una descrizione per il client. Ad esempio "Il mio client per i fogli di presenza". Supporta anche le chiavi per i valori di traduzioni. Ad esempio: ${my_client_description}
+deny=Rifiuta
+resourceSharedWith_one=La risorsa è condivisa con <0>{{username}}</0>
+resourceSharedWith_zero=Questa risorsa non è condivisa.
+jumpToSection=Vai alla sezione
+verifiableCredentialsConfigAlert=Non è stato possibile ottenere la configurazione della credenziale.
+groupsListColumnsNames=Nomi delle colonne della lista dei gruppi
+errorSignOutMessage=Non è possibile disconnettersi: {{error}}
+linkError=Non è possibile fare il collegamento: {{error}}
+tryAgain=Prova di nuovo
+errorRemovedMessage=Non è possibile rimuovere {{userLabel}}: {{error}}
+webauthn-display-name=Chiave di accesso (Passkey)
+hasAccessTo=Ha accesso a
+recovery-authn-codes-display-name=Codici di recupero
+accountUpdatedError=Non è possibile apportare le modifiche a causa di errori di validazione
+unShareError=Non è possibile togliere la condivisione della risorsa a causa di: {{error}}
+recovery-authn-codes-help-text=Questi codici possono essere utilizzati nel caso l'altro metodo di autenticazione a due fattori non fosse disponibile.
+clientTypeHelp=Tipo di risorsa. Può essere usato per raggruppare risorse diverse dello stesso tipo.
+emptyUserOrganizations=Nessuna organizzazione
+verifiableCredentialsDescription=Seleziona una credenziale per importarla nel tuo portafoglio.
+profileScopeConsentText=Profilo utente
+emailScopeConsentText=Indirizzo email
+addressScopeConsentText=Indirizzo
+rolesScopeConsentText=Ruoli dell'utente
+somethingWentWrong=Qualcosa è andato storto
+emptyUserOrganizationsInstructions=Non sei ancora membro di alcuna organizzazione.
+searchOrganization=Cerca un’organizzazione
+organizationList=Elenco delle organizzazioni
+termsAndConditionsDeclined=Per poter continuare devi accettare i termini e le condizioni
+permissionRequest=Richieste di permesso - {{name}}
+general=Generale
+rolesScope=Se non è stata definita alcuna mappatura dell'ambito (scope) su un ruolo, ogni utente è autorizzato a utilizzare questo ambito client. Se sono state definite mappature dell'ambito su un ruolo, l'utente deve essere membro di almeno uno dei ruoli.
+unLinkError=Non è possibile togliere il collegamento: {{error}}
+recovery-authn-code=I miei codici di recupero
+signingInDescription=Configura le modalità di accesso.
+removeConsentError=Non è possibile rimuovere il consenso a causa di: {{error}}
+linkedAccounts=Utenze collegate
+groupsListHeader=Intestazione lista gruppi
+scopeNameHelp=Nome dell'ambito client. Deve essere univoco nel realm. Il nome non deve contenere caratteri di spazio, poiché viene utilizzato come valore del parametro ambito
+scopeDescriptionHelp=Descrizione dell'ambito del client
+selectOne=Seleziona un'opzione
+privacyPolicy=Politica sulla riservatezza
+defaultLocale=Scegli...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ja.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ja.properties
index 04196f099ff9..3b919dba964e 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ja.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ja.properties
@@ -1,6 +1,6 @@
 #
 #Tue Jan 09 09:05:12 CET 2024
-invalidEmailMessage=無効なメールアドレスです。
+invalidEmailMessage='{{0}}': 無効なメールアドレスです。
 lastName=姓
 backTo={{app}}に戻る
 applicationType=アプリケーションタイプ
@@ -9,18 +9,18 @@ clients=クライアント
 filterByName=名前でフィルタリング...
 description=説明
 myResources=マイリソース
-missingPasswordMessage=パスワードを入力してください。
+missingPasswordMessage='{{0}}': パスワードを指定してください。
 password=パスワード
-missingEmailMessage=Eメールを入力してください。
-applicationsIntroMessage=アカウントへアクセスするためにアプリのパーミッションを追跡して管理する
-missingLastNameMessage=姓を入力してください。
+missingEmailMessage='{{0}}': メールアドレスを指定してください。
+applicationsIntroMessage=アカウントへアクセスするためにアプリケーションのパーミッションを追跡して管理する
+missingLastNameMessage='{{0}}': 姓を指定してください。
 accountUpdatedMessage=アカウントが更新されました。
-missingFirstNameMessage=名を入力してください。
+missingFirstNameMessage='{{0}}': 名を指定してください。
 client=クライアント
 share=共有
-email=Eメール
+email=メールアドレス
 permissionRequests=パーミッションの要求
-missingUsernameMessage=ユーザー名を入力してください。
+missingUsernameMessage='{{0}}': ユーザー名を指定してください。
 fullName={{givenName}} {{familyName}}
 resources=リソース
 started=開始
@@ -52,3 +52,169 @@ required=必須
 delete=削除
 deleteAccount=アカウントの削除
 ipAddress=IPアドレス
+resourceSharedWith_one=リソースは<0>{{username}}</0>と共有されています
+noGroupsText=どのグループにも属していません
+error-username-invalid-character='{{0}}' に無効な文字が含まれています。
+infoMessage=アクセスの削除をクリックすると、このアプリケーションの許可されたパーミッションが削除されます。このアプリケーションはあなたの情報を使用しなくなります。
+scopesHelp=このリソースに関連付けられているスコープ。
+unknownOperatingSystem=不明なオペレーティングシステム
+otp-display-name=オーセンティケーターアプリケーション
+linkedEmpty=リンクされたプロバイダーはありません
+removeConsentSuccess=同意の削除に成功しました。
+setUpNew={{name}}のセットアップ
+lastAccessedOn=最終アクセス
+credentialCreatedAt=<0>作成されました</0> {{date}}。
+directMembership=ダイレクトメンバーシップ
+error-invalid-length-too-short=「{{0}}」の長さは{{1}}以上でなければなりません。
+error-number-out-of-range-too-big=「{{0}}」の最大値は{{2}}でなければなりません。
+two-factor=2要素認証
+resourceSharedWith_zero=このリソースは共有されません。
+signedInDevicesExplanation=不明なデバイスからサインアウトします。
+addMultivaluedLabel={{fieldLabel}}の追加
+error-number-out-of-range-too-small=「{{0}}」の最小値は{{1}}でなければなりません。
+createFlowHelp=この画面でトップレベルのフローを作成できます
+removeModalMessage=これにより現在付与されている{{name}}のアクセス権限が削除されます。このアプリケーションを使用したい場合は再度アクセス権限を付与する必要があります。
+refreshPage=ページの更新
+error-user-attribute-required=「{{0}}」を指定してください。
+currentSession=現在のセッション
+clientDescriptionHelp=クライアントの説明を記します（例: タイムシート用のクライアント）。ローカライズ用のキーもサポートしています。（例: ${my_client_description}）
+error-empty=「{{0}}」の値を指定してください。
+error-invalid-uri-fragment=「{{0}}」は無効なURLフラグメントです。
+error-invalid-blank=「{{0}}」の値を指定してください。
+signedOutSession={{browser}}/{{os}}をサインアウト
+close=クローズ
+signOutWarning=セッションからサインアウトしますか？
+removeConsentError=次の理由により同意を削除できませんでした: {{error}}
+unShareSuccess=リソースの共有が正常に解除されました。
+signingIn=サインイン
+stopUsingCred={{name}}の使用を停止しますか？
+groupsListHeader=グループリストヘッダー
+error-number-out-of-range=「{{0}}」は{{1}}から{{2}}の間の数字である必要があります。
+thirdPartyApp=サードパーティー
+avatar=アバター
+scopeDescriptionHelp=クライアントスコープの説明
+confirm=確認
+updateSuccess=リソースが正常に更新されました。
+selectOne=オプションを選択する
+unShare=すべて共有を解除する
+linkedAccounts=リンクされたアカウント
+personalInfoDescription=基本情報を管理する
+signingInDescription=サインインする方法を設定します。
+unlinkedEmpty=リンクされていないプロバイダーはありません
+done=実行しました
+basic-authentication=ベーシック認証
+notInUse=不使用
+unShareAllConfirm=すべての共有を完全に削除してもよいですか？
+clientTypeHelp=このリソースのタイプ。同じタイプの異なるリソースインスタンスをグループ化するために使用できます。
+unknownUser=匿名
+offlineAccess=オフラインアクセス
+notSetUp={{name}}がセットアップされていません。
+error-invalid-number=「{{0}}」は無効な数値です。
+link=アカウントのリンク
+shareTheResource=リソースの共有 - {{name}}
+update=更新
+choose=選択...
+groupsListColumnsNames=グループリストの列名
+error-invalid-uri-scheme=「{{0}}」には無効なURLスキームがあります。
+error-user-attribute-read-only=フィールド{{0}}は読み取り専用です。
+general=一般
+error-invalid-date=「{{0}}」は無効な日付です。
+accountUpdatedError=検証エラーのためアカウントを更新できませんでした
+error-invalid-length=「{{0}}」の長さは{{1}}から{{2}}まででなければなりません。
+errorSignOutMessage=サインアウトできませんでした: {{error}}
+linkedLoginProviders=リンクされたログインプロバイダー
+inUse=使用中
+systemDefined=システムが定義されました
+hasAccessTo=アクセス可能
+internalApp=内部
+updateError=次の理由によりリソースを更新できませんでした: {{error}}
+accessGrantedOn=アクセスが許可されました:
+editTheResource=リソースを編集 - {{name}}
+shareSuccess=リソースが正常に共有されました。
+aliasHelp=設定の名前
+groups=グループ
+unLink=アカウントのリンクを解除する
+errorRemovedMessage=次の理由により{{userLabel}}を削除できませんでした: {{error}}
+termsOfService=サービス利用規約
+jumpToSection=セクションへジャンプ
+linkError=次の理由によりリンクできませんでした: {{error}}
+updateCredAriaLabel=クレデンシャルの更新
+error-pattern-no-match=「{{0}}」は要求された形式と一致しません。
+unlinkedLoginProviders=リンクを解除されたログインプロバイダー
+applicationDetails={{clientId}}のアプリケーションの詳細
+deleteAccountWarning=これは元に戻せない操作です。すべてのデータは永久に破棄され元に戻せなくなります。
+resourceSharedWith_other=リソースは <0>{{username}}</0>と<1>{{other}}</1>人のユーザーと共有されています。
+error-person-name-invalid-character=「{{0}}」に無効な文字が含まれています。
+shareUser=リソースを共有するユーザーを追加する
+sharedWithMe=自身と共有
+error-invalid-multivalued-size=属性{{0}}には少なくとも{{1}}個、最大{{2}}個の値が必要です。
+recovery-authn-code=リカバリー認証コード
+recovery-authn-codes-display-name=リカバリー認証コード
+recovery-authn-codes-help-text=これらのコードを使用すると、他の二要素認証の手段が利用できない場合にアクセスを回復できます。
+oid4vci=検証可能クレデンシャル
+verifiableCredentialsTitle=検証可能クレデンシャル
+verifiableCredentialsDescription=ウォレットにインポートするクレデンシャルを選択します。
+verifiableCredentialsIssuerAlert=発行者の情報を取得できませんでした。
+verifiableCredentialsConfigAlert=クレデンシャルの設定を取得できませんでした。
+verifiableCredentialsOfferAlert=クレデンシャルオファーを取得できませんでした。
+verifiableCredentialsSelectionDefault=クレデンシャルの設定を選択します。
+profileScopeConsentText=ユーザープロファイル
+emailScopeConsentText=メールアドレス
+addressScopeConsentText=アドレス
+phoneScopeConsentText=電話番号
+offlineAccessScopeConsentText=オフラインアクセス
+samlRoleListScopeConsentText=ロール
+rolesScopeConsentText=ユーザーロール
+organizations=組織
+organizationDescription=参加した組織を表示する
+emptyUserOrganizations=組織がありません
+emptyUserOrganizationsInstructions=まだどの組織にも参加していません。
+searchOrganization=組織の検索
+organizationList=組織の一覧
+domains=ドメイン
+refresh=更新
+recovery-codes-number-used={{0}}個のリカバリコードが使用されました
+recovery-codes-number-remaining=残りのリカバリコードは{{0}}個です
+shareWith=共有する
+privacyPolicy=プライバシーポリシー
+password-display-name=パスワード
+scopeTypeHelp=作成された各クライアントにデフォルトスコープとして追加されるクライアントスコープ
+scopeNameHelp=クライアントスコープの名前。レルム内でユニークでなければなりません。スコープパラメーターの値として使用されるため、名前には空白文字を含めないでください
+rolesScope=ロールスコープマッピングが定義されていない場合、すべてのユーザーはこのクライアントスコープを使用できます。ロールスコープマッピングが定義されている場合、ユーザーは少なくとも1つのロールのメンバーである必要があります。
+webauthn-passwordless-display-name=パスキー
+signedInDevices=サインインしたデバイス
+unLinkSuccess=アカウントのリンク解除に成功しました。
+webauthn-display-name=パスキー
+webauthn-passwordless-help-text=パスワードレスサインインにパスキーを使用します。
+recovery-codes-generate-new-codes=アカウントへのアクセスを確実にするために新しいコードを生成してください
+manageAccount=アカウントの管理
+signOutAllDevicesWarning=この操作により、現在使用しているデバイスを含めアカウントにサインインしているすべてのデバイスがサインアウトされます。
+unLinkError=次の理由によりリンクを解除できませんでした: {{error}}
+noGroups=グループなし
+otp-help-text=オーセンティケーターアプリケーションから取得した確認コードを入力してください。
+error-invalid-uri=「{{0}}」は無効なURLです。
+successRemovedMessage={{userLabel}}は削除されました。
+webauthn-help-text=パスキーを使用してサインインしてください。
+passwordless=パスワードレス
+personalInfo=個人情報
+removeCred={{name}}を削除する
+signOutAllDevices=すべてのデバイスをサインアウトする
+flowTypeHelp=どの種類のフォームかを設定します
+error-invalid-email=メールアドレスが無効です。
+linkedAccountsIntroMessage=サードパーティーのアカウントでログインを管理します。
+accountSecurity=アカウントセキュリティー
+groupDescriptionLabel=関連するグループを表示する
+resourceAlreadyShared=リソースは既にこのユーザーと共有されています。
+error-invalid-length-too-long=「{{0}}」は最大の長さが{{2}}でなければなりません。
+shareError=次の理由によりリソースを共有できませんでした: {{error}}
+logo=ロゴ
+password-help-text=パスワードを入力してサインインします。
+permissionRequest=パーミッションリクエスト - {{name}}
+add=追加
+error-invalid-value=「{{0}}」は無効な値です。
+somethingWentWrong=何らかの問題が発生しました
+somethingWentWrongDescription=残念ながら、予期しないエラーが発生しました。
+tryAgain=再試行してください
+unShareError=次の理由によりリソースの共有を解除できませんでした: {{error}}
+termsAndConditionsDeclined=続行するには利用規約に同意する必要があります
+defaultLocale=選択...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ka.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ka.properties
index 78ca29bdb0f5..dcba69638091 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ka.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ka.properties
@@ -60,7 +60,7 @@ unShareAllConfirm=დარწმუნებული ბრძანდებ
 clientTypeHelp=ამ რესურსის ტიპი. შეიძლება გამოიყენოთ სხვადასხვა იგივე ტიპის რესურსების დასაჯგუფებლად.
 missingPasswordMessage='{{0}}': მიუთითეთ პაროლი.
 error-invalid-uri-scheme='{{0}}'-ის URL-ის სქემა არასწორია.
-error-user-attribute-read-only=ველი ({0}) მხოლოდ-წაკითხვადია.
+error-user-attribute-read-only=ველი ({{0}}) მხოლოდ-წაკითხვადია.
 otp-help-text=შეიყვანეთ გადამოწმების კოდი ავთენტიკატორი აპლიკაციიდან.
 missingLastNameMessage='{{0}}': მიუთითეთ გვარი.
 unLinkError=მოხსნა შეუძლებელია მიზეზით: {{error}}
@@ -68,7 +68,7 @@ applicationsIntroMessage=აპლიკაციების ნახვა, 
 error-invalid-length='{{0}}'-ის სიგრძე უნდა იყოს შუალედიდან {{1}} and {{2}}.
 inUse=გამოიყენება
 hasAccessTo=აქ წვდომა
-accessGrantedOn=წვდომის მინიჭების დრო: 
+accessGrantedOn=წვდომის მინიჭების დრო:
 error-invalid-uri='{{0}}' არასწორი URL-ია.
 missingUsernameMessage='{{0}}': მიუთითეთ თქვენი მომხმარებლის სახელი.
 editTheResource=რესურსის ჩასწორება - {{name}}
@@ -77,7 +77,7 @@ fullName={{givenName}} {{familyName}}
 unLink=ანგარიშის მიბმის მოხსნა
 aliasHelp=კონფიგურაციის სახელი
 errorRemovedMessage={{userLabel}} ვერ წაიშალა მიზეზით: {{error}}
-shareWith=გაზიარება 
+shareWith=გაზიარება ვისთან
 termsOfService=მომსახურების პირობები
 jumpToSection=გადასვლა სექციაზე
 error-pattern-no-match='{{0}}' მოთხოვნილ ფორმატს არ ემთხვევა.
@@ -91,7 +91,7 @@ sharedWithMe=ჩემთან გაზიარებული
 recovery-authn-code=ჩემი აღდგენის ავთენტიკაციის კოდები
 webauthn-help-text=გამოიყენეთ თქვენი Passkey შესასვლელად.
 error-invalid-multivalued-size=ატრიბუტს {{0}} უნდა ჰქონდეს მინიმუმ {{1}} და მაქსიმუმt {{2}} მნიშვნელობა.
-recovery-codes-number-used=გამოყენებულია {0} აღდგენის კოდი
+recovery-codes-number-used=გამოყენებულია {{0}} აღდგენის კოდი
 recovery-authn-codes-help-text=ეს კოდები შეგიძლიათ, თქვენ წვდომის აღსადგენად გამოიყენოთ, თუ 2FA რაღაც მიზეზით ხელმისაწვდომი არაა.
 cancel=გაუქმება
 required=აუცილებელი
@@ -169,7 +169,7 @@ error-person-name-invalid-character='{{0}}' არასწორ სიმბ
 error-invalid-blank=მიუთითეთ '{{0}}'-ის მნიშვნელობა.
 accountUpdatedMessage=თქვენი ანგარიში განახლდა.
 error-invalid-date='{{0}}' არასწორი თარიღია.
-recovery-codes-number-remaining=დარჩენილია {0} აღდგენის კოდი
+recovery-codes-number-remaining=დარჩენილია {{0}} აღდგენის კოდი
 missingFirstNameMessage='{{0}}': მიუთითეთ სახელი.
 resourceSharedWith_one=რესურსი გაზიარებულია მომხმარებელთან <0>{{username}}</0>
 missingEmailMessage='{{0}}': მიუთითეთ ელფოსტა.
@@ -214,3 +214,5 @@ searchOrganization=ორგანიზაციის მოძებნა
 organizationList=ორგანიზაციების ჩამონათვალი
 domains=დომენები
 refresh=განახლება
+termsAndConditionsDeclined=გასაგრძელებლად, წესებს და პირობებს უნდა დაეთანხმოთ
+defaultLocale=არჩევა...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ky.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ky.properties
new file mode 100644
index 000000000000..b6d23aba70e8
--- /dev/null
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ky.properties
@@ -0,0 +1,218 @@
+cancel=Жокко чыгаруу
+applicationType=Тиркеменин түрү
+backTo={{app}} тиркемесине кайтуу
+removeConsentSuccess=Макулдук ийгиликтүү түрдө алынды
+noGroupsText=Сиз эч кандай топко кошулган жоксуз
+required=Талап кылынат
+path=Жол
+password=Менин сыр сөзүм
+setUpNew={{name}} орнотуу
+lastAccessedOn=Акыркы кирүү
+deviceActivity=Куралдын ишмердүүлүгү
+permissions=Уруксаттар
+credentialCreatedAt=<0>Түзүлгөн</0> {{date}}.
+error-username-invalid-character='{{0}}' жараксыз символду камтыйт.
+usernamePlaceholder=Колдонуучу аты же электрондук почта
+infoMessage="Кирүү мүмкүнчүлүгүн алып салуу" баскычын басуу менен, сиз бул тиркемеге берилген уруксаттарды алып саласыз. Бул тиркеме мындан ары сиздин маалыматыңызды колдоно албайт.
+scopesHelp=Бул ресурска байланышкан скоуптар.
+unknownOperatingSystem=Белгисиз операциялык система
+deny=Баш тартуу
+edit=Түзөтүү
+otp-display-name=Аутентификациялоочу тиркеме
+selectALocale=Тилди тандаңыз
+signOut=Чыгуу
+linkedEmpty=Туташтырылган провайдер жок
+directMembership=Түз мүчөлүк
+accept=Кабыл алуу
+error-invalid-length-too-short='{{0}}' минималдуу узундугу {{1}} болушу керек.
+resourceSharedWith_one=Ресурс <0>{{username}}</0> менен бөлүшүлгөн
+error-number-out-of-range-too-big='{{0}}' максималдуу мааниден ашпоосу керек: {{2}}.
+updateEmail=Email жаңыртуу
+two-factor=Эки фактордуу аутентификация
+resourceSharedWith_zero=Бул ресурс эч ким менен бөлүшүлгөн эмес.
+signedInDevicesExplanation=Билбеген түзмөктөрдөн чыгыңыз.
+addMultivaluedLabel={{fieldLabel}} кошуу
+status=Статус
+error-number-out-of-range-too-small='{{0}}' минималдуу мааниден аз болбошу керек: {{1}}.
+invalidEmailMessage='{{0}}'\: Жараксыз электрондук почта дареги.
+lastName=Фамилия
+removeModalMessage=Бул учурдагы уруксат берилген мүмкүнчүлүктү {{name}} үчүн алып салат. Бул тиркемени колдонуу үчүн уруксатты кайра берүү керек болот.
+clients=Клиенттер
+createFlowHelp=Бул жерден жогорку деңгээлдеги агымды түзө аласыз
+filterByName=Атынан издөө...
+refreshPage=Баракты жаңыртуу
+save=Сактоо
+error-user-attribute-required='{{0}}' белгилөө керек.
+currentSession=Учурдагы сессия
+clientDescriptionHelp=Клиенттин сүрөттөмөсүн көрсөтөт. Мисалы: 'TimeSheets үчүн менин клиентим'. Локализацияланган маанилер үчүн ачкычтарды да колдойт. Мисалы\: ${my_client_description}
+scopeTypeHelp=Клиенттик скоуптар, алар ар бир жаңы түзүлгөн клиентке демейки боюнча кошулат
+error-empty='{{0}}' маанисин көрсөтүү керек.
+error-invalid-uri-fragment='{{0}}' жараксыз URL фрагменти.
+error-invalid-blank='{{0}}' маанисин көрсөтүү керек.
+missingFirstNameMessage='{{0}}'\: Атыңызды көрсөтүңүз.
+signedOutSession={{browser}}/{{os}} түзмөгүнөн чыктыңыз
+share=Бөлүшүү
+close=Жабуу
+email=Email
+signOutWarning=Сессиядан чыгууну каалайсызбы?
+removeConsentError=Макулдукту алып салууда ката кетти\: {{error}}
+signOutAllDevicesWarning=Бул аракет сиздин аккаунтка кирген бардык түзмөктөрдөн, анын ичинде учурда колдонуп жаткан түзмөктөн да чыгууга алып келет.
+unShareSuccess=Ресурс ийгиликтүү түрдө бөлүшүүдөн алынды.
+signingIn=Кирүүдө
+stopUsingCred={{name}} колдонууну токтотуу?
+groupsListHeader=Топтордун тизмеси
+error-number-out-of-range='{{0}}' саны {{1}} менен {{2}} ортосунда болушу керек.
+privacyPolicy=Купуялык саясаты
+thirdPartyApp=Үчүнчү тарап
+started=Башталган
+avatar=Аватар
+scopeDescriptionHelp=Клиенттик скоуптун сүрөттөмөсү
+confirm=Тастыктоо
+updateSuccess=Ресурс ийгиликтүү жаңыртылды.
+selectOne=Бир вариант тандаңыз
+unShare=Бөлүшүүнү токтотуу
+linkedAccounts=Туташтырылган аккаунттар
+personalInfoDescription=Негизги маалыматты башкаруу
+removeAccess=Кирүү мүмкүнчүлүгүн алып салуу
+signingInDescription=Кирүү ыкмаларын орнотуу.
+personalInfo=Жеке маалымат
+removeCred={{name}} алып салуу
+signOutAllDevices=Бардык түзмөктөрдөн чыгуу
+scopeNameHelp=Клиенттик скоуптун аталышы. Realm ичинде уникалдуу болушу керек. Аталышта бош орун болбошу керек, анткени ал скоуп параметрине маани катары колдонулат.
+flowTypeHelp=Бул кандай форма экенин көрсөтөт
+error-invalid-email=Жараксыз электрондук почта дареги.
+myResources=Менин ресурстарым
+linkedAccountsIntroMessage=Үчүнчү тарап аккаунттары аркылуу кирүүнү башкаруу.
+accountSecurity=Аккаунттун коопсуздугу
+groupDescriptionLabel=Сиз мүчө болгон топторду көрүү
+manageAccount=Аккаунтту башкаруу
+resourceAlreadyShared=Бул ресурс бул колдонуучу менен мурунтан эле бөлүшүлгөн.
+error-invalid-length-too-long='{{0}}' максималдуу узундугу {{2}} болбошу керек.
+accountUpdatedMessage=Сиздин аккаунт ийгиликтүү жаңыртылды.
+shareError=Ресурсту бөлүшүү мүмкүн болбоду\: {{error}}
+logo=Логотип
+password-help-text=Сыр сөзүңүздү киргизүү менен кириңиз.
+deleteAccount=Аккаунтту өчүрүү
+permissionRequest=Уруксат сурамы - {{name}}
+add=Кошуу
+error-invalid-value='{{0}}' жараксыз маани камтыйт.
+somethingWentWrong=Бир нерсе туура эмес болду
+somethingWentWrongDescription=Кечиресиз, күтүлбөгөн ката кетти.
+tryAgain=Кайра аракет кылыңыз
+rolesScope=Эгер роль скоупуна дал келген белгилөө жок болсо, ар бир колдонуучу бул клиенттик скоупту колдоно алат. Эгер ролдук скоуп белгилөөлөрү бар болсо, анда колдонуучу жок дегенде бир ролдун мүчөсү болушу керек.
+unShareError=Ресурсту бөлүшүүдөн алып салууда ката кетти\: {{error}}
+ipAddress=IP дарек
+resourceName=Ресурс аталышы
+unlinkedEmpty=Туташтырылбаган провайдерлер жок
+done=Аяктады
+basic-authentication=Негизги аутентификация
+socialLogin=Социалдык кирүү
+notInUse=Колдонулбай жатат
+unShareAllConfirm=Бөлүшүүнүн баарын толугу менен алып салууну каалайсызбы?
+firstName=Аты
+name=Аталышы
+clientTypeHelp=Бул ресурстун тиби. Ошол эле типтеги ар кандай ресурстарды топтош үчүн колдонулат.
+unknownUser=Аталышы жок колдонуучу
+offlineAccess=Офлайн кирүү
+password-display-name=Сырсөз
+expires=Мөөнөтү бүтөт
+noGroups=Группалар жок
+notSetUp={{name}} орнотулган эмес.
+error-invalid-number='{{0}}' туура эмес сан.
+link=Аккаунтту байланыштыр
+shareTheResource=Ресурсту бөлүшүү - {{name}}
+description=Сүрөттөмө
+update=Жаңыртуу
+choose=Тандоо...
+signedInDevices=Кирген түзмөктөр
+delete=Өчүрүү
+missingPasswordMessage='{{0}}'\: Сырсөздү киргизиңиз.
+otp-help-text=Аутентификациялык колдонмодон текшерүү кодун киргизиңиз.
+groupsListColumnsNames=Группалар тизмесинин тилкелеринин аттары
+error-invalid-uri-scheme='{{0}}' туура эмес URL схемасы.
+error-user-attribute-read-only={{0}} талаасы жазууга мүмкүн эмес.
+general=Жалпы
+error-invalid-date='{{0}}' туура эмес дата.
+missingEmailMessage='{{0}}'\: Электрондук почтаны көрсөтүңүз.
+accountUpdatedError=Аккаунт жаңыртылбады. Текшерүүдө ката кетти.
+unLinkError=Байланышты үзүү мүмкүн эмес\: {{error}}
+applicationsIntroMessage=Аккаунтуңуз мүмкүнчүлүк алган тиркемелерди көрүү
+error-invalid-length='{{0}}' узундугу {{1}} менен {{2}} аралыгында болушу керек.
+missingLastNameMessage='{{0}}'\: Фамилияңызды көрсөтүңүз.
+errorSignOutMessage=Системадан чыгуу мүмкүн эмес\: {{error}}
+linkedLoginProviders=Байланышкан кирүү кызматтары
+inUse=Колдонууда
+client=Клиент
+error-invalid-uri='{{0}}' туура эмес URL.
+systemDefined=Система аныктаган
+hasAccessTo=Мүмкүнчүлүгү бар
+internalApp=Ички колдонмо
+updateError=Ресурсту жаңыртуу мүмкүн болбоду\: {{error}}
+accessGrantedOn=Мүмкүнчүлүк берилген күнү\:
+editTheResource=Ресурсту түзөтүү - {{name}}
+permissionRequests=Уруксат суранычтары
+shareSuccess=Ресурс ийгиликтүү бөлүшүлдү.
+missingUsernameMessage='{{0}}'\: Колдонуучу атын көрсөтүңүз.
+aliasHelp=Конфигурациянын аты
+fullName={{givenName}} {{familyName}}
+groups=Группалар
+resources=Ресурстар
+resourceIntroMessage=Ресурстарыңызды команда мүчөлөрүңүз менен бөлүшүңүз
+unLink=Аккаунттун байланышын үзүү
+errorRemovedMessage={{userLabel}} өчүрүлбөдү\: {{error}}
+termsOfService=Кызмат көрсөтүү шарттары
+jumpToSection=Бөлүмгө өтүү
+linkError=Байланыштыруу мүмкүн эмес\: {{error}}
+requestor=Сураган тарап
+shareWith=Ким менен бөлүшүү
+updateCredAriaLabel=Ыкманы жаңыртуу
+error-pattern-no-match='{{0}}' талап кылынган форматка туура келбейт.
+application=Колдонмо
+unlinkedLoginProviders=Байланышпаган кирүү кызматтары
+applicationDetails={{clientId}} үчүн колдонмонун чоо-жайы
+successRemovedMessage={{userLabel}} өчүрүлдү.
+deleteAccountWarning=Бул аракет артка кайтарылбайт. Бардык дайындарыңыз биротоло жок болот жана калыбына келтирүүгө мүмкүн болбойт.
+resourceSharedWith_other=Ресурс <0>{{username}}</0> жана дагы <1>{{other}}</1> колдонуучу менен бөлүшүлгөн
+error-person-name-invalid-character='{{0}}' аты жараксыз символдорду камтыйт.
+user=Колдонуучу
+shareUser=Ресурсту бөлүшүү үчүн колдонуучу кошуңуз
+unLinkSuccess=Аккаунт ийгиликтүү ажыратылды
+applications=Колдонмолор
+sharedWithMe=Мени менен бөлүшүлгөн
+username=Колдонуучу аты
+webauthn-display-name=Passkey
+webauthn-help-text=Системага кирүү үчүн Passkey колдонуңуз.
+webauthn-passwordless-display-name=Passkey
+webauthn-passwordless-help-text=Сырсөзсүз кирүү үчүн Passkey колдонуңуз.
+passwordless=Сырсөзсүз
+error-invalid-multivalued-size={{0}} атрибуту жок дегенде {{1}} жана эң көп дегенде {{2}} маани камтышы керек.
+recovery-authn-code=Калыбына келтирүү коддорум
+recovery-authn-codes-display-name=Калыбына келтирүү коддору
+recovery-authn-codes-help-text=Башка эки фактордук ыкмалар жеткиликтүү болбой калганда, бул коддорду аккаунтуңузга кирүү үчүн колдоно аласыз.
+recovery-codes-number-used={{0}} калыбына келтирүү коддору колдонулган
+recovery-codes-number-remaining={{0}} калыбына келтирүү коддору калган
+recovery-codes-generate-new-codes=Жаңы коддорду түзүп, аккаунтка кирүү мүмкүнчүлүгүн сактаңыз
+oid4vci=Ырасталуучу күбөлүктөр
+verifiableCredentialsTitle=Ырасталуучу күбөлүктөр
+verifiableCredentialsDescription=Күбөлүктү капчыкка импорттоо үчүн тандаңыз.
+verifiableCredentialsIssuerAlert=Күбөлүктү чыгарган тарап тууралуу маалымат алынган жок.
+verifiableCredentialsConfigAlert=Күбөлүктүн конфигурациясы жүктөлгөн жок.
+verifiableCredentialsOfferAlert=Сунуш алуу мүмкүн болгон жок.
+verifiableCredentialsSelectionDefault=Күбөлүк конфигурациясын тандаңыз.
+profileScopeConsentText=Колдонуучу профили
+emailScopeConsentText=Электрондук почта дареги
+addressScopeConsentText=Дарек
+phoneScopeConsentText=Телефон номери
+offlineAccessScopeConsentText=Офлайн мүмкүнчүлүк
+samlRoleListScopeConsentText=Менин ролдорум
+rolesScopeConsentText=Колдонуучу ролдору
+organizations=Уюмдар
+organizationDescription=Кошулган уюмдарды көрүү
+emptyUserOrganizations=Уюмдар жок
+emptyUserOrganizationsInstructions=Сиз али бир да уюмга кошула элексиз.
+searchOrganization=Уюм издөө
+organizationList=Уюмдардын тизмеси
+domains=Домендер
+refresh=Жаңыртуу
+termsAndConditionsDeclined=Улантуу үчүн Шарттар менен макул болушуңуз керек
+defaultLocale=Тандоо...
\ No newline at end of file
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_nl.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_nl.properties
index 37691e7ad754..35a13c10fe0b 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_nl.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_nl.properties
@@ -128,7 +128,7 @@ systemDefined=Systeem gedefinieerd
 hasAccessTo=Heeft toegang tot
 internalApp=Intern
 updateError=Kan de resource niet bijwerken vanwege\: {{error}}
-accessGrantedOn=Toegang verleend op\: 
+accessGrantedOn=Toegang verleend op:
 editTheResource=Bewerk de resource - {{name}}
 permissionRequests=Machtigingsverzoeken
 shareSuccess=Resource succesvol gedeeld.
@@ -141,7 +141,7 @@ errorRemovedMessage=Kan {{userLabel}} niet verwijderen vanwege\: {{error}}
 termsOfService=Servicevoorwaarden
 linkError=Kan niet koppelen vanwege\: {{error}}
 requestor=Aanvrager
-shareWith=Delen met 
+shareWith=Delen met
 updateCredAriaLabel=Credential bijwerken
 error-pattern-no-match='{{0}}' komt niet overeen met het vereiste formaat.
 application=Applicatie
@@ -169,7 +169,7 @@ groupsListHeader=Koptekst Groepenlijst
 oid4vci=Verifieerbare gegevens
 recovery-authn-code=Mijn herstelauthenticatiecodes
 recovery-authn-codes-display-name=Herstelauthenticatiecodes
-recovery-codes-number-remaining={0} herstelcodes over
+recovery-codes-number-remaining={{0}} herstelcodes over
 verifiableCredentialsDescription=Selecteer de gegevens om te importeren in je portefeuille.
 verifiableCredentialsTitle=Verifieerbare gegevens
 verifiableCredentialsIssuerAlert=Kon de issuer informatie niet achterhalen.
@@ -189,7 +189,7 @@ webauthn-passwordless-display-name=Passkey
 webauthn-passwordless-help-text=Gebruik passkey om zonder wachtwoord in te loggen.
 passwordless=Wachtwoordloos
 recovery-authn-codes-help-text=Gebruik deze codes om toegang te herstellen als andere 2FA-methoden niet beschikbaar zijn.
-recovery-codes-number-used={0} herstelcodes gebruikt
+recovery-codes-number-used={{0}} herstelcodes gebruikt
 recovery-codes-generate-new-codes=Genereer nieuwe codes om toegang tot je account te waarborgen
 termsAndConditionsDeclined=Accepteer de algemene voorwaarden om verder te gaan
 profileScopeConsentText=Gebruikersprofiel
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pl.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pl.properties
index 9c887a21fe0f..b2d847f2b687 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pl.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pl.properties
@@ -189,8 +189,8 @@ error-invalid-multivalued-size=Atrybut {{0}} musi mieć co najmniej {{1}} i co n
 recovery-authn-code=Moje kody odzyskiwania uwierzytelniania
 recovery-authn-codes-display-name=Kody odzyskiwania uwierzytelniania
 recovery-authn-codes-help-text=Te kody mogą być użyte do odzyskania dostępu, jeśli inne środki 2FA są niedostępne.
-recovery-codes-number-used=Użyto {0} kodów odzyskiwania
-recovery-codes-number-remaining=Pozostało {0} kodów odzyskiwania
+recovery-codes-number-used=Użyto {{0}} kodów odzyskiwania
+recovery-codes-number-remaining=Pozostało {{0}} kodów odzyskiwania
 recovery-codes-generate-new-codes=Wygeneruj nowe kody, aby zapewnić dostęp do swojego konta
 oid4vci=Zweryfikowane poświadczenia
 verifiableCredentialsTitle=Zweryfikowane poświadczenia
@@ -214,4 +214,4 @@ searchOrganization=Szukaj organizacji
 organizationList=Lista organizacji
 domains=Domeny
 refresh=Odśwież
-termsAndConditionsDeclined=Musisz zaakceptować Regulamin, aby kontynuować
\ No newline at end of file
+termsAndConditionsDeclined=Musisz zaakceptować Regulamin, aby kontynuować
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pt_BR.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pt_BR.properties
index 8bb4c311dbdb..14c9d4e6b4ab 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pt_BR.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_pt_BR.properties
@@ -6,30 +6,30 @@ signOutAllDevices=Finalizar Sessão em Todos os Dispositivos
 backTo=Voltar para {{app}}
 applicationType=Tipo de aplicação
 myResources=Meus Recursos
-linkedAccountsIntroMessage=Gerenciar acessos por contas de outras aplicações.
-password=Senha
+linkedAccountsIntroMessage=Gerencie logins por meio de contas de terceiros.
+password=Minha senha
 setUpNew=Configurar {{name}}
 lastAccessedOn=Último acesso em
 resourceAlreadyShared=O recurso já foi compartilhado com este usuário.
 permissions=Permissões
 accountUpdatedMessage=Sua conta foi atualizada.
-credentialCreatedAt=Criada em
+credentialCreatedAt=<0>Criado</0> {{date}}.
 password-help-text=Entre inserindo a sua senha.
 deleteAccount=Apagar Conta
 infoMessage=Ao clicar em 'Remover Acesso', você irá remover as permissões concedidas a esta aplicação. Ela não poderá mais utilizar as suas informações.
 add=Adicionar
 unknownOperatingSystem=Sistema Operacional Desconhecido
 edit=Editar
-otp-display-name=App Autenticador
+otp-display-name=Aplicativo Autenticador
 ipAddress=Endereço IP
 resourceName=Nome do Recurso
-unlinkedEmpty=Nenhum Provedor Não-Conectado
+unlinkedEmpty=Nenhum provedor vinculado
 linkedEmpty=Nenhum Provedor Conectado
 done=Pronto
 basic-authentication=Autenticação Básica
 socialLogin=Login Social
 notInUse=Não utilizado
-unShareAllConfirm=Tem certeza de que quer remover todos os compartilhamentos?
+unShareAllConfirm=Tem certeza de que deseja remover todos os compartilhamentos?
 firstName=Primeiro nome
 two-factor=Autenticação de Dois Fatores
 name=Nome
@@ -38,7 +38,7 @@ unknownUser=Anônimo
 offlineAccess=Acesso Offline
 removeModalMessage=Isto irá remover a permissão atual de acesso concedido para {{name}}. Você precisará repetir o processo de concessão se for utilizar o app novamente.
 lastName=Sobrenome
-invalidEmailMessage=E-mail inválido.
+invalidEmailMessage='{{0}}': Email inválido.
 password-display-name=Senha
 expires=Expira em
 notSetUp={{name}} não está configurada.
@@ -49,14 +49,14 @@ link=Conectar Conta
 description=Descrição
 update=Atualizar
 signedInDevices=Dispositivos autenticados
-missingPasswordMessage=Por favor, informe a senha.
-otp-help-text=Insira o código de verificação do app autenticador.
+missingPasswordMessage='{{0}}': Por favor, informe a senha.
+otp-help-text=Insira o código de verificação do aplicativo autenticador.
 currentSession=Sessão Atual
-missingEmailMessage=Por favor, informe o e-mail.
-applicationsIntroMessage=Acompanhe e gerencie as permissões de app para acesso à sua conta
-missingLastNameMessage=Por favor, informe o sobrenome.
+missingEmailMessage='{{0}}': Por favor, informe o email.
+applicationsIntroMessage=Veja os aplicativos aos quais sua conta tem acesso
+missingLastNameMessage='{{0}}': Por favor, informe o sobrenome.
 linkedLoginProviders=Provedores de Acesso Conectados
-missingFirstNameMessage=Por favor, informe o primeiro nome.
+missingFirstNameMessage='{{0}}': Por favor, informe o primeiro nome.
 signedOutSession=Deslogado {{browser}}/{{os}}
 inUse=Em uso
 client=Cliente
@@ -64,31 +64,157 @@ share=Compartilhar
 systemDefined=Definido pelo Sistema
 close=Fechar
 internalApp=Interna
-email=E-mail
-accessGrantedOn=Acesso concedido em
-signOutWarning=Finalizar todas as sessões?
-unShareSuccess=O recurso foi descompartilhado com sucesso.
-signOutAllDevicesWarning=Esta ação irá finalizar a sessão de todos os dispositivos logados na sua conta, incluindo o dispositivo que está sendo utilizado atualmente.
-signingIn=Entrando na Conta
-permissionRequests=Pedidos de Acesso
+email=Email
+accessGrantedOn=Acesso concedido em:
+signOutWarning=Finalizar sessão?
+unShareSuccess=Recurso descompartilhado com sucesso.
+signOutAllDevicesWarning=Esta ação desconectará todos os dispositivos que fizeram login na sua conta, incluindo o dispositivo atual que você está usando.
+signingIn=Entrando
+permissionRequests=Solicitações de permissão
 shareSuccess=O recurso foi compartilhado com sucesso.
 stopUsingCred=Para de usar {{name}}?
 thirdPartyApp=De Terceiros
-missingUsernameMessage=Por favor, especifique o nome de usuário.
+missingUsernameMessage='{{0}}': Por favor, especifique o nome de usuário.
 fullName={{givenName}} {{familyName}}
 resources=Recursos
-started=Início em
-resourceIntroMessage=Compartilhe seus recursos com membros de equipe
+started=Iniciado
+resourceIntroMessage=Compartilhe seus recursos com membros da equipe
 unLink=Desconectar Conta
-requestor=Requerente
-updateSuccess=O recurso foi atualizado com sucesso.
+requestor=Solicitante
+updateSuccess=Recurso atualizado com sucesso.
 application=Aplicativo
 unShare=Descompartilhar tudo
-unlinkedLoginProviders=Provedores de Acesso Não-Conectados
-applicationDetails=Detalhes da Aplicação
-successRemovedMessage={{userLabel}} removida com sucesso.
+unlinkedLoginProviders=Provedores de login não vinculados
+applicationDetails=Detalhes da Aplicação {{clientId}}
+successRemovedMessage={{userLabel}} removido com sucesso.
 deleteAccountWarning=Esta ação é irreversível. Todos os seus dados serão apagados permanentemente e não poderão ser recuperados.
 removeAccess=Remover Acesso
 user=Usuário
 applications=Aplicativos
 username=Nome de usuário
+removeConsentSuccess=Consentimento removido com sucesso
+noGroupsText=Você não está participando de nenhum grupo
+required=Obrigatório
+path=Caminho
+deviceActivity=Atividade do dispositivo
+error-username-invalid-character='{{0}}' contém caractere inválido.
+usernamePlaceholder=Nome do usuário ou e-mail
+scopesHelp=Os escopos associados com este recurso.
+deny=Negar
+selectALocale=Selecione um local
+signOut=Sair
+accept=Aceitar
+updateEmail=Atualizar email
+status=Status
+error-invalid-blank=Por favor, especifique um valor de '{{0}}'.
+profileScopeConsentText=Perfil de usuário
+phoneScopeConsentText=Número de telefone
+emailScopeConsentText=Email
+addressScopeConsentText=Endereço
+offlineAccessScopeConsentText=Acesso Offline
+termsAndConditionsDeclined=Você precisa aceitar os termos e condições para continuar
+directMembership=Associação direta
+error-invalid-length-too-short='{{0}}' deve ter o tamanho mínimo de {{1}}.
+linkedAccounts=Contas vinculadas
+refresh=Atualizar
+defaultLocale=Selecione...
+error-invalid-email=Endereço de email inválido.
+error-invalid-value='{{0}}' tem valor inválido.
+choose=Selecione...
+delete=Excluir
+updateCredAriaLabel=Atualizar credencial
+resourceSharedWith_one=O recurso está compartilhado com <0>{{username}}</0>
+resourceSharedWith_zero=Esse recurso não é compartilhado.
+save=Salvar
+error-user-attribute-required=Por favor, informe '{{0}}'.
+scopeTypeHelp=Escopos de cliente, que serão adicionados como escopos padrão a cada cliente criado
+error-empty=Por favor, especifique um valor de '{{0}}'.
+error-invalid-uri-fragment='{{0}}' é um fragmento da URL inválido.
+removeConsentError=Não foi possível remover o consentimento devido a: {{error}}
+groupsListHeader=Cabeçalho da lista de grupos
+privacyPolicy=Política de privacidade
+avatar=Avatar
+confirm=Confirmar
+selectOne=Selecione uma opção
+personalInfoDescription=Gerencie suas informações básicas
+signingInDescription=Configure as formas de login.
+personalInfo=Informações pessoais
+flowTypeHelp=Que tipo de formulário é esse
+accountSecurity=Segurança da conta
+groupDescriptionLabel=Visualizar os grupos aos quais você está associado
+manageAccount=Gerenciar conta
+error-invalid-length-too-long='{{0}}' precisa ter um tamanho máximo de {{2}}.
+shareError=Não foi possível compartilhar o recurso devido a: {{error}}
+logo=Logo
+permissionRequest=Solicitações de permissão - {{name}}
+somethingWentWrong=Alguma coisa deu errado
+tryAgain=Tente novamente
+rolesScope=Se não houver mapeamento de escopo de papel definido, cada usuário terá permissão para usar este escopo de cliente. Se houver mapeamentos de escopo de papel definidos, o usuário deve ser membro de pelo menos um dos papéis.
+unShareError=Não foi possível desfazer o compartilhamento do recurso devido a: {{error}}
+clientTypeHelp=O tipo deste recurso. Pode ser usado para agrupar diferentes instâncias de recurso com o mesmo tipo.
+noGroups=Nenhum grupo
+error-invalid-number='{{0}}' é um número inválido.
+shareTheResource=Compartilhar o recurso - {{nome}}
+groupsListColumnsNames=Nomes das colunas da lista de grupos
+error-user-attribute-read-only=O campo {{0}} é somente leitura.
+error-invalid-date='{{0}}' é uma data inválida.
+general=Geral
+unLinkError=Não foi possível desvincular devido a: {{error}}
+errorSignOutMessage=Não foi possível finalizar a sessão: {{error}}
+hasAccessTo=Tem acesso a
+updateError=Não foi possível atualizar o recurso devido a: {{error}}
+editTheResource=Editar o recurso - {{name}}
+aliasHelp=Nome da configuração
+groups=Grupos
+errorRemovedMessage=Não foi possível remover {{userLabel}} devido a: {{error}}
+termsOfService=Termos de serviço
+jumpToSection=Ir para a seção
+linkError=Não foi possível vincular devido a: {{error}}
+shareWith=Compartilhar com
+error-pattern-no-match='{{0}}' não corresponde ao formato exigido.
+resourceSharedWith_other=Recurso compartilhado com <0>{{username}}\\</0> e <1>{{other}}\\</1> outros usuários
+error-person-name-invalid-character='{{0}}' contém caractere inválido.
+unLinkSuccess=Conta desvinculada com sucesso
+sharedWithMe=Compartilhados Comigo
+webauthn-passwordless-display-name=Chave de Segurança
+webauthn-help-text=Use sua chave de segurança para fazer login.
+webauthn-passwordless-help-text=Use sua chave de segurança para fazer login sem senha.
+passwordless=Sem senha
+error-invalid-multivalued-size=O atributo {{0}} deve ter no mínimo {{1}} e no máximo {{2}} valor(es).
+recovery-authn-code=Meus códigos de autenticação de recuperação
+recovery-authn-codes-display-name=Códigos de autenticação de recuperação
+recovery-authn-codes-help-text=Estes códigos podem ser usados para recuperar seu acesso caso seus outros métodos de 2FA não estejam disponíveis.
+recovery-codes-number-used={{0}} códigos de recuperação usados
+recovery-codes-number-remaining={{0}} códigos de recuperação restantes
+recovery-codes-generate-new-codes=Gere novos códigos para garantir acesso à sua conta
+oid4vci=Credenciais Verificáveis
+verifiableCredentialsTitle=Credenciais Verificáveis
+verifiableCredentialsDescription=Selecione a credencial para importar para sua carteira.
+verifiableCredentialsIssuerAlert=Não foi possível obter as informações do emissor.
+verifiableCredentialsConfigAlert=Não foi possível obter a configuração de credencial.
+verifiableCredentialsOfferAlert=Não foi possível obter uma oferta.
+verifiableCredentialsSelectionDefault=Selecione a configuração de credencial.
+organizations=Organizações
+emptyUserOrganizations=Nenhuma organização
+searchOrganization=Buscar por organização
+organizationList=Lista de organizações
+domains=Domínios
+error-number-out-of-range-too-small='{{0}}' precisa ter um valor mínimo de {{1}}.
+scopeNameHelp=Nome do escopo de cliente. Deve ser único no realm. O nome não deve conter espaços, pois é usado como valor do parâmetro de escopo
+createFlowHelp=Você pode criar um fluxo de nível superior dentro deste formulário
+error-invalid-length='{{0}}' precisa ter um tamanho entre {{1}} e {{2}} caracteres.
+webauthn-display-name=Chave de Segurança
+clientDescriptionHelp=Especifica a descrição do cliente. Por exemplo 'Meu cliente para TimeSheets'. Também aceita chaves para valores localizados. Por exemplo: ${meu_cliente_descricao}
+error-number-out-of-range-too-big='{{0}}' precisa ter um valor máximo de {{2}}.
+addMultivaluedLabel=Adicionar {{fieldLabel}}
+error-number-out-of-range='{{0}}' deve ser um número entre {{1}} e {{2}}.
+shareUser=Adicionar usuários para compartilhar seu recurso
+samlRoleListScopeConsentText=Meus Papéis
+organizationDescription=Visualizar as organizações às quais você se juntou
+error-invalid-uri-scheme='{{0}}' tem um esquema de URL inválido.
+scopeDescriptionHelp=Descrição do escopo de cliente
+rolesScopeConsentText=Papéis de usuário
+somethingWentWrongDescription=Desculpe, ocorreu um erro inesperado.
+error-invalid-uri='{{0}}' é uma URL inválida.
+emptyUserOrganizationsInstructions=Você ainda não se juntou a nenhuma organização.
+accountUpdatedError=Não foi possível atualizar a conta devido a erros de validação
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ro.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ro.properties
new file mode 100644
index 000000000000..b3303e075cfe
--- /dev/null
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ro.properties
@@ -0,0 +1,6 @@
+cancel=Renunță
+backTo=Înapoi la {{app}}
+required=Obligatoriu
+path=Cale
+password=Parola mea
+infoMessage=Dacă apeși pe Elimină accesul, vei revoca permisiunile acordate acestei aplicații. Această aplicație nu va mai folosi informațiile tale.
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ru.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ru.properties
index 20c98ed639e8..122f2c01706b 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ru.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_ru.properties
@@ -14,6 +14,7 @@ credentialCreatedAt=<0>Создан</0> {{date}}.
 error-username-invalid-character='{{0}}' содержит недопустимый символ.
 usernamePlaceholder=Имя пользователя или email
 infoMessage=Нажав кнопку Удалить доступ, вы удалите предоставленные разрешения для этого приложения. Это приложение больше не будет использовать вашу информацию.
+scopesHelp=Области, связанные с этим ресурсом.
 unknownOperatingSystem=Неизвестная операционная система
 deny=Запрещено
 edit=Редактировать
@@ -26,37 +27,47 @@ accept=Подтвердить
 error-invalid-length-too-short='{{0}}' должна иметь минимальную длину {{1}}.
 resourceSharedWith_one=Ресурс является общим для <0>{{username}}</0>
 error-number-out-of-range-too-big='{{0}}' должно иметь максимальное значение {{2}}.
+updateEmail=Обновить e-mail
 two-factor=Двухфакторная аутентификация
 resourceSharedWith_zero=Этот ресурс не является общим.
 signedInDevicesExplanation=Выполните выход с незнакомых устройств.
+addMultivaluedLabel=Добавить {{fieldLabel}}
 status=Статус
 error-number-out-of-range-too-small='{{0}}' должно иметь минимальное значение {{1}}.
+invalidEmailMessage='{{0}}': Неверный адрес электронной почты.
 lastName=Фамилия
 removeModalMessage=Это приведет к удалению предоставленного в данный момент разрешения доступа для {{name}}. Вам нужно будет снова предоставить доступ, если вы хотите использовать это приложение.
 clients=Клиенты
+createFlowHelp=Вы можете создать сценарий верхнего уровня в этом
 filterByName=Фильтровать по названию...
 refreshPage=Обновить страницу
 save=Сохранить
 error-user-attribute-required=Пожалуйста, уточните '{{0}}'.
 currentSession=Текущая сессия
+clientDescriptionHelp=Указывает описание клиента. Например, "Мой клиент для расписаний". Поддерживает также ключи для локализованных значений. Например: ${my_client_description}
+scopeTypeHelp=Клиентские области, которые будут добавлены в качестве областей по умолчанию для каждого созданного клиента
 error-empty=Пожалуйста, укажите значение '{{0}}'.
 error-invalid-uri-fragment='{{0}}' является недопустимым фрагментом URL-адреса.
 error-invalid-blank=Пожалуйста, укажите значение '{{0}}'.
+missingFirstNameMessage='{{0}}': Укажите имя.
 signedOutSession=Сессия завершена {{browser}}/{{os}}
 share=Делиться
 close=Закрыть
 email=E-mail
 signOutWarning=Завершить сессию?
-removeConsentError=Не удалось удалить согласия из-за\: {{error}}
+removeConsentError=Не удалось удалить согласия из-за: {{error}}
 signOutAllDevicesWarning=Это действие приведет к выходу из системы всех устройств, которые вошли в вашу учетную запись, включая текущее устройство, которое вы используете.
 unShareSuccess=Ресурс успешно удален из общего доступа.
 signingIn=Вход
 stopUsingCred=Остановить использование {{name}}?
+groupsListHeader=Заголовок списка групп
 error-number-out-of-range='{{0}}' должно быть число в диапазоне от {{1}} до {{2}}.
 privacyPolicy=Политика конфиденциальности
 thirdPartyApp=Внешний
 started=Начата
 avatar=Аватар
+scopeDescriptionHelp=Описание сферы деятельности клиента
+confirm=Подтвердить
 updateSuccess=Ресурс успешно обновлен.
 selectOne=Выберите опцию
 unShare=Не делитесь всем
@@ -64,10 +75,11 @@ linkedAccounts=Связанные учетные записи
 personalInfoDescription=Управление данными о себе
 removeAccess=Удалить доступ
 signingInDescription=Настройте способы входа в систему.
-somethingWentWrongDescription=Извините, произошла непредвиденная ошибка.
 personalInfo=Личная информация
 removeCred=Удалить {{name}}
 signOutAllDevices=Выход на всех устройствах
+scopeNameHelp=Имя клиентской области. Должно быть уникальным в realm. Имя не должно содержать пробелов, так как оно используется как значение параметра области
+flowTypeHelp=Какой это сценарий
 error-invalid-email=Неверный адрес электронной почты.
 myResources=Мои ресурсы
 linkedAccountsIntroMessage=Управляйте входами в систему через сторонние учетные записи.
@@ -75,9 +87,9 @@ accountSecurity=Безопасность
 groupDescriptionLabel=Просмотр групп, в которых вы состоите
 manageAccount=Управление учетной записью
 resourceAlreadyShared=Ресурс уже является общим для этого пользователя.
-accountUpdatedMessage=Ваша учетная запись была обновлена.
 error-invalid-length-too-long='{{0}}' должна иметь максимальную длину {{2}}.
-shareError=Не удалось предоставить общий доступ к ресурсу из-за\: {{error}}
+accountUpdatedMessage=Ваша учетная запись была обновлена.
+shareError=Не удалось предоставить общий доступ к ресурсу из-за: {{error}}
 logo=Logo
 password-help-text=Вход с использованием ввода пароля.
 deleteAccount=Удалить аккаунт
@@ -85,18 +97,22 @@ permissionRequest=Запросы на разрешение - {{name}}
 add=Добавить
 error-invalid-value='{{0}}' имеет недопустимое значение.
 somethingWentWrong=Что-то пошло не так
-unShareError=Не удалось отключить общий доступ к ресурсу из-за\: {{error}}
+somethingWentWrongDescription=Извините, произошла непредвиденная ошибка.
+tryAgain=Попробовать снова
+rolesScope=Если сопоставление области действия ролей не определено, каждому пользователю разрешено использовать эту клиентскую область действия. Если сопоставления области действия ролей определены, пользователь должен быть членом хотя бы одной из ролей.
+unShareError=Не удалось отключить общий доступ к ресурсу из-за: {{error}}
 ipAddress=IP адрес
-tryAgain=Пробовать снова
 resourceName=Имя ресурса
 unlinkedEmpty=Нет несвязанных поставщиков
 done=Выполнено
 basic-authentication=Базовая аутентификация
 socialLogin=Вход в социальную сеть
 notInUse=Не используется
+unShareAllConfirm=Вы уверены, что хотите отменить все общие доступы?
 firstName=Имя
 name=Имя
-unknownUser=Anonymous
+clientTypeHelp=Тип этого ресурса. Может использоваться для группировки различных экземпляров ресурсов с одинаковым типом.
+unknownUser=Анонимный
 offlineAccess=Offline доступ
 password-display-name=Пароль
 expires=Истекает
@@ -110,14 +126,20 @@ update=Обновить
 choose=Выбрать...
 signedInDevices=Выполнен вход на устройствах
 delete=Удалить
+missingPasswordMessage='{{0}}': Укажите пароль.
 otp-help-text=Ввод проверочного кода из приложения аутентификатора.
+groupsListColumnsNames=Имена колонок списка групп
 error-invalid-uri-scheme='{{0}}' имеет недопустимую схему URL-адресов.
+error-user-attribute-read-only=Поле {{0}} доступно только для чтения.
+general=Общий
 error-invalid-date='{{0}}' неверная дата.
+missingEmailMessage='{{0}}': Укажите адрес электронной почты.
 accountUpdatedError=Не удалось обновить учетную запись из-за ошибок проверки
-unLinkError=Не удалось отключить связь из-за\: {{error}}
+unLinkError=Не удалось отключить связь из-за: {{error}}
 applicationsIntroMessage=Отслеживайте разрешения ваших приложений на доступ к вашей учетной записи и управляйте ими
 error-invalid-length='{{0}}' должен иметь длину от {{1}} до {{2}}.
-errorSignOutMessage=Не удалось выйти из системы\: {{error}}
+missingLastNameMessage='{{0}}': Укажите фамилию.
+errorSignOutMessage=Не удалось выйти из системы: {{error}}
 linkedLoginProviders=Связанные поставщики идентификации
 inUse=Используется
 client=Клиент
@@ -125,28 +147,30 @@ error-invalid-uri='{{0}}' является недопустимым URL-адре
 systemDefined=Определенная система
 hasAccessTo=Имеет доступ к
 internalApp=Внутренний
-updateError=Не удалось обновить ресурс из-за\: {{error}}
-accessGrantedOn=Доступ, предоставленный на\: 
+updateError=Не удалось обновить ресурс из-за: {{error}}
+accessGrantedOn=Доступ, предоставленный на:
 editTheResource=Редактировать ресурс - {{name}}
 permissionRequests=Запросы на разрешение
 shareSuccess=Ресурсу успешно предоставлен общий доступ.
+missingUsernameMessage='{{0}}': Укажите имя пользователя.
+aliasHelp=Название конфигурации
 fullName={{givenName}} {{familyName}}
 groups=Группы
 resources=Ресурсы
 resourceIntroMessage=Делитесь своими ресурсами с членами команды
 unLink=Отсоединить учетную запись
-errorRemovedMessage=Не удалось удалить {{userLabel}} из-за\: {{error}}
+errorRemovedMessage=Не удалось удалить {{userLabel}} из-за: {{error}}
 termsOfService=Условия обслуживания
+jumpToSection=Перейти к разделу
 linkError=Не удалось установить связь из-за {{error}}
 requestor=Запрашивающий
-shareWith=Делитесь с 
+shareWith=Поделиться с
 updateCredAriaLabel=Обновить учетные данные
 error-pattern-no-match='{{0}}' не соответствует требуемому формату.
 application=Приложения
 unlinkedLoginProviders=Несвязанные поставщики идентификации
 applicationDetails=Детали приложения
 successRemovedMessage={{userLabel}} был удалён.
-middleName=Отчество
 deleteAccountWarning=Это необратимо. Все ваши данные будут безвозвратно уничтожены.
 resourceSharedWith_other=Ресурс является общим для <0>{{username}}</0> и <1>{{other}}</1> других пользователей
 error-person-name-invalid-character='{{0}}' содержит недопустимый символ.
@@ -156,3 +180,39 @@ unLinkSuccess=Учетная запись успешно отсоединена
 applications=Приложения
 sharedWithMe=Поделился со мной
 username=Имя пользователя
+webauthn-display-name=Ключ доступа
+webauthn-help-text=Для входа используйте свой ключ доступа.
+webauthn-passwordless-display-name=Ключ доступа
+webauthn-passwordless-help-text=Используйте свой ключ доступа для входа без пароля.
+passwordless=Без пароля
+error-invalid-multivalued-size=Атрибут {{0}} должен иметь не менее {{1}} и не более {{2}} значений.
+recovery-authn-code=Мои коды аутентификации восстановления
+recovery-authn-codes-display-name=Восстановление кодов аутентификации
+recovery-authn-codes-help-text=Эти коды можно использовать для восстановления доступа в случае, если другие средства двухфакторной аутентификации недоступны.
+recovery-codes-number-used={{0}} использовано кодов восстановления
+recovery-codes-number-remaining={{0}} оставшихся кодов восстановления
+recovery-codes-generate-new-codes=Сгенерируйте новые коды, чтобы обеспечить доступ к вашей учетной записи
+oid4vci=Проверяемые учетные данные
+verifiableCredentialsTitle=Проверяемые учетные данные
+verifiableCredentialsDescription=Выберите учетные данные для импорта в ваш кошелек.
+verifiableCredentialsIssuerAlert=Не удалось получить информацию об эмитенте.
+verifiableCredentialsConfigAlert=Не удалось получить конфигурацию учетных данных.
+verifiableCredentialsOfferAlert=Не удалось получить предложение.
+verifiableCredentialsSelectionDefault=Выберите конфигурацию учетных данных.
+profileScopeConsentText=Профиль пользователя
+emailScopeConsentText=Адрес электронной почты
+addressScopeConsentText=Адрес
+phoneScopeConsentText=Номер телефона
+offlineAccessScopeConsentText=Оффлайн доступ
+samlRoleListScopeConsentText=Мои роли (SAML)
+rolesScopeConsentText=Роли пользователей
+organizations=Организации
+organizationDescription=Просмотр организаций, к которым вы присоединились
+emptyUserOrganizations=Нет организаций
+emptyUserOrganizationsInstructions=Вы пока не вступили ни в одну организацию.
+searchOrganization=Поиск организации
+organizationList=Список организаций
+domains=Домены
+refresh=Обновить
+termsAndConditionsDeclined=Чтобы продолжить, вам необходимо принять Условия и Положения
+defaultLocale=Выбрать...
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_sl.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_sl.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_sl.properties
@@ -0,0 +1 @@
+
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_th.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_th.properties
index fd21ec5f5516..1d9e6266ebf3 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_th.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_th.properties
@@ -17,20 +17,20 @@ edit=แก้ไข
 otp-display-name=แอปพลิเคชันพิสูจน์ตัวจริง
 linkedEmpty=ไม่มีผู้ให้บริการที่เชื่อมโยง
 directMembership=การเป็นสมาชิกโดยตรง
-error-invalid-length-too-short=ลักษณะประจำ {0} จะต้องมีความยาวขั้นต่ำ {1}
-error-number-out-of-range-too-big=ลักษณะประจำ {0} จะต้องมีค่าสูงสุด {2}
+error-invalid-length-too-short=ลักษณะประจำ {{0}} จะต้องมีความยาวขั้นต่ำ {{1}}
+error-number-out-of-range-too-big=ลักษณะประจำ {{0}} จะต้องมีค่าสูงสุด {{2}}
 updateEmail=อัปเดตอีเมล
 two-factor=การตรวจสอบสิทธิ์แบบสองปัจจัย
 signedInDevicesExplanation=ลงชื่อออกจากอุปกรณ์ที่ไม่คุ้นเคย
 status=สถานะ
-error-number-out-of-range-too-small=ลักษณะประจำ {0} จะต้องมีค่าขั้นต่ำ {1}
+error-number-out-of-range-too-small=ลักษณะประจำ {{0}} จะต้องมีค่าขั้นต่ำ {{1}}
 removeModalMessage=การกระทำนี้จะลบสิทธิ์การเข้าถึงที่ให้ไว้แก่ {{name}} คุณจะต้องอนุญาตการเข้าถึงอีกครั้งหากต้องการใช้แอปพลิเคชันนี้
 lastName=นามสกุล
 invalidEmailMessage=ที่อยู่อีเมลไม่ถูกต้อง
 clients=ไคลเอนต์
 filterByName=กรองตามชื่อ ...
 refreshPage=รีเฟรชหน้า
-error-user-attribute-required=โปรดระบุลักษณะประจำ {0}
+error-user-attribute-required=โปรดระบุลักษณะประจำ {{0}}
 currentSession=เซสชันปัจจุบัน
 error-empty=โปรดระบุค่า
 error-invalid-uri-fragment=fragment URL ไม่ถูกต้อง
@@ -45,7 +45,7 @@ signOutAllDevicesWarning=การกระทำนี้จะลงชื่
 unShareSuccess=ยกเลิกการแบ่งปันทรัพยากรสำเร็จ
 signingIn=ลงชื่อเข้าใช้
 stopUsingCred=หยุดใช้ {{name}} หรือ?
-error-number-out-of-range=ลักษณะประจำ {0} จะต้องเป็นจำนวนระหว่าง {1} และ {2}
+error-number-out-of-range=ลักษณะประจำ {{0}} จะต้องเป็นจำนวนระหว่าง {{1}} และ {{2}}
 thirdPartyApp=บุคคลที่สาม
 started=เริ่มต้น
 updateSuccess=อัปเดตทรัพยากรสำเร็จ
@@ -58,7 +58,7 @@ myResources=ทรัพยากรของฉัน
 linkedAccountsIntroMessage=จัดการการเข้าสู่ระบบผ่านบัญชีของบุคคลที่สาม
 groupDescriptionLabel=ดูกลุ่มที่คุณเชื่อมโยงอยู่
 resourceAlreadyShared=ทรัพยากรถูกแบ่งปันกับผู้ใช้งานนี้อยู่แล้ว
-error-invalid-length-too-long=ลักษณะประจำ {0} จะต้องมีความยาวสูงสุด {2}
+error-invalid-length-too-long=ลักษณะประจำ {{0}} จะต้องมีความยาวสูงสุด {{2}}
 accountUpdatedMessage=ได้อัพเดตบัญชีของคุณแล้ว
 logo=โลโก้
 password-help-text=ลงชื่อเข้าใช้โดยป้อนรหัสผ่านของคุณ
@@ -89,11 +89,11 @@ signedInDevices=อุปกรณ์ที่ลงชื่อเข้าใ
 missingPasswordMessage=โปรดระบุรหัสผ่าน
 otp-help-text=ป้อนรหัสยืนยันจากแอปพลิเคชันพิสูจน์ตัวจริง
 error-invalid-uri-scheme=scheme URL ไม่ถูกต้อง
-error-user-attribute-read-only=เขตข้อมูล {0} เป็นแบบอ่านอย่างเดียว
+error-user-attribute-read-only=เขตข้อมูล {{0}} เป็นแบบอ่านอย่างเดียว
 error-invalid-date=วันที่ไม่ถูกต้อง
 missingEmailMessage=โปรดระบุอีเมล
 applicationsIntroMessage=ติดตามและจัดการการอนุญาตให้แอปพลิเคชันเข้าถึงบัญชีของคุณ
-error-invalid-length=ลักษณะประจำ {0} จะต้องมีความยาวระหว่าง {1} และ {2}
+error-invalid-length=ลักษณะประจำ {{0}} จะต้องมีความยาวระหว่าง {{1}} และ {{2}}
 missingLastNameMessage=โปรดระบุนามสกุล
 linkedLoginProviders=ผู้ให้บริการเข้าสู่ระบบที่เชื่อมโยง
 inUse=กำลังใช้งาน
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_CN.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_CN.properties
index e9c5e987f6ff..d38debcf1126 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_CN.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_CN.properties
@@ -189,6 +189,6 @@ error-invalid-multivalued-size=屬性 {{0}} 必须至少有 {{1}} 且最多 {{2}
 recovery-authn-code=我的恢复验证码
 recovery-authn-codes-display-name=恢复验证码
 recovery-authn-codes-help-text=如果您的其他 2FA 方式不可用，这些验证码可用于重新获得访问权限。
-recovery-codes-number-used={0} 使用的恢复验证码
-recovery-codes-number-remaining={0} 剩余的恢复验证码
+recovery-codes-number-used={{0}} 使用的恢复验证码
+recovery-codes-number-remaining={{0}} 剩余的恢复验证码
 recovery-codes-generate-new-codes=生成新验证码以确保访问您的帐户
diff --git a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_TW.properties b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_TW.properties
index ec4c51c1aec8..54e7d589a48c 100644
--- a/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_TW.properties
+++ b/js/apps/account-ui/maven-resources-community/theme/keycloak.v3/account/messages/messages_zh_TW.properties
@@ -1,19 +1,19 @@
 cancel=取消
 applicationType=應用程式類型
 backTo=回到 {{app}}
-removeConsentSuccess=成功撤回授權
+removeConsentSuccess=成功移除授權
 noGroupsText=您尚未加入任何群組
 required=需要
 path=路徑
 password=我的密碼
 setUpNew=設定 {{name}}
-lastAccessedOn=最後存取
-deviceActivity=登入裝置活動
+lastAccessedOn=最後存取時間
+deviceActivity=已登入裝置
 permissions=權限
-credentialCreatedAt={{date}} <0>建立</0>。
-error-username-invalid-character='{{0}}' 包含了非法字元。
+credentialCreatedAt=<0>建立於</0> {{date}}。
+error-username-invalid-character=「{{0}}」包含了非法字元。
 usernamePlaceholder=使用者名稱或電子信箱
-infoMessage=透過點擊刪除存取權限，您將刪除該應用程式授予的權限。 此應用程式將不再使用您的資訊。
+infoMessage=透過點擊取消授權，您將刪除該應用程式授予的權限。此應用程式將不再能夠存取您的權限。
 scopesHelp=與該資源關聯的範圍。
 unknownOperatingSystem=未知作業系統
 deny=拒絕
@@ -21,50 +21,50 @@ edit=編輯
 otp-display-name=OTP 驗證器名稱
 selectALocale=選擇語言
 signOut=登出
-linkedEmpty=沒有連結的第三方登入
-directMembership=直接的成員
+linkedEmpty=沒有已連結的帳號
+directMembership=直屬成員
 accept=同意
-error-invalid-length-too-short='{{0}}' 的最小長度為 {{1}}。
+error-invalid-length-too-short=「{{0}}」的最小長度為 {{1}}。
 resourceSharedWith_one=資源已共用給 <0>{{username}}</0>
-error-number-out-of-range-too-big='{{0}}' 的最大值為 {{2}}。
+error-number-out-of-range-too-big=「{{0}}」的最大值為 {{2}}。
 updateEmail=更新電子信箱
 two-factor=2FA 驗證
 resourceSharedWith_zero=這個資源未被共享。
-signedInDevicesExplanation=登出所有不明裝置。
+signedInDevicesExplanation=管理已登入裝置、登出不明裝置
 addMultivaluedLabel=添加 {{fieldLabel}}
 status=狀態
-error-number-out-of-range-too-small='{{0}}' 的最小值為 {{1}}。
-invalidEmailMessage='{{0}}'\: 無效的電子信箱。
+error-number-out-of-range-too-small=「{{0}}」的最小值為 {{1}}。
+invalidEmailMessage={{0}}：無效的電子信箱。
 lastName=姓氏
 removeModalMessage=這將刪除目前授予 {{name}} 的存取權限。 如果您想重新使用此應用程序，則需要再次授予存取權限。
 clients=客戶端
-createFlowHelp=你可以在這個表單裡面建立一個流程。
+createFlowHelp=您可以在這個表單裡面建立一個流程
 filterByName=透過名字搜尋...
 refreshPage=重新整理頁面
 save=儲存
-error-user-attribute-required=請提供 '{{0}}'。
-currentSession=目前登入狀態
-clientDescriptionHelp=指定客戶端的描述。 例如「我的時間表客戶端」。 也支援 i18n 鍵值。 例如\: ${my_client_description}
+error-user-attribute-required=請提供「{{0}}」
+currentSession=目前連線裝置
+clientDescriptionHelp=指定客戶端的描述。 例如「我的時間表客戶端」。 也支援 i18n 鍵值。 例如：${my_client_description}
 scopeTypeHelp=客戶端授權範圍，將作為預設範圍給每個新建立的客戶端。
-error-empty=請提供 '{{0}}' 的數值。
-error-invalid-uri-fragment='{{0}}' 是無效的 URL 片段。
-error-invalid-blank=請指定 '{{0}}' 的數值。
-missingFirstNameMessage='{{0}}'\: 請指定名字。
+error-empty=請提供「{{0}}」的數值。
+error-invalid-uri-fragment=「{{0}}」是無效的 URL 片段。
+error-invalid-blank=請指定「{{0}}」的數值。
+missingFirstNameMessage={{0}}：請指定名字。
 signedOutSession=已登出 {{browser}}/{{os}}
 share=分享
 close=關閉
-email=Email
-signOutWarning=登出這個憑證？
-removeConsentError=由於以下原因無法移除同意\: {{error}}
-signOutAllDevicesWarning=此操作將登出所有已登入您帳號的裝置，包括您目前使用的裝置。
+email=電子信箱
+signOutWarning=登出這個裝置？
+removeConsentError=由於以下原因無法移除同意：{{error}}
+signOutAllDevicesWarning=此操作將登出所有已登入的裝置，包括目前的裝置。
 unShareSuccess=資源已成功取消共享。
 signingIn=登入
 stopUsingCred=停止使用 {{name}}？
 groupsListHeader=群組清單標頭
-error-number-out-of-range='{{0}}' 必須是一個在 {{1}} 到 {{2}} 之間的數字。
+error-number-out-of-range=「{{0}}」必須是一個在 {{1}} 到 {{2}} 之間的數字。
 privacyPolicy=隱私權政策
 thirdPartyApp=第三方應用
-started=已開始
+started=開始於
 avatar=使用者頭像
 scopeDescriptionHelp=客戶端授權的描述
 confirm=確認
@@ -73,7 +73,7 @@ selectOne=選取一個選項
 unShare=取消共享全部
 linkedAccounts=已連結的帳號
 personalInfoDescription=管理你的基本資訊
-removeAccess=取消存取權
+removeAccess=取消授權
 signingInDescription=設定登入方式
 somethingWentWrongDescription=很抱歉，發生了未知的錯誤。
 personalInfo=個人資訊
@@ -88,101 +88,131 @@ accountSecurity=帳號安全性
 groupDescriptionLabel=查看與你關聯的全組
 manageAccount=管理帳號
 resourceAlreadyShared=資源已經與此使用者共享。
-error-invalid-length-too-long='{{0}}' 的長度必須小於 {{2}}。
+error-invalid-length-too-long=「{{0}}」的長度必須小於 {{2}}。
 accountUpdatedMessage=您的帳號資訊已更新。
-shareError=由於以下錯誤無法共享資源 \: {{error}}
+shareError=由於以下錯誤無法共享資源 ：{{error}}
 logo=Logo
 password-help-text=透過您的密碼進行登入。
 deleteAccount=刪除帳號
 permissionRequest=權限請求 - {{name}}
 add=新增
-error-invalid-value='{{0}}' 包含錯誤的數值。
+error-invalid-value=「{{0}}」包含錯誤的數值。
 somethingWentWrong=歐喔！有東西壞掉了
 rolesScope=如果未定義角色範圍映射，則允許每個使用者使用此用戶端範圍。 如果定義了角色範圍映射，則使用者必須是至少其中一個角色的成員。
-unShareError=由於以下原因無法取消共享資源\: {{error}}
-ipAddress=IP 地址
+unShareError=由於以下原因無法取消共享資源：{{error}}
+ipAddress=IP 位址
 tryAgain=請重試
 resourceName=資源名稱
 unlinkedEmpty=沒有取消連結的提供者
 done=已完成
-basic-authentication=基本登入
-socialLogin=社群平台登入
+basic-authentication=基本認證
+socialLogin=社群登入
 notInUse=尚未被使用
 unShareAllConfirm=您確定要完全刪除所有共享嗎？
-firstName=名
-name=名
+firstName=名字
+name=應用名稱
 clientTypeHelp=資源的類型。 它可用於將相同類型的不同資源實例分組。
 unknownUser=未知使用者
 offlineAccess=離線存取權
 password-display-name=密碼
-expires=過期
+expires=過期時間
 noGroups=沒有群組
 notSetUp=尚未設定 {{name}}。
-error-invalid-number='{{0}}' 不是一個合法的數字。
+error-invalid-number=「{{0}}」不是一個合法的數字。
 link=連結帳號
 shareTheResource=共享資源 - {{name}}
 description=描述
 update=更新
 choose=請選擇...
-signedInDevices=已登入裝置
+signedInDevices=已登入的裝置
 delete=刪除
-missingPasswordMessage='{{0}}'\: 請設定密碼。
-otp-help-text=輸入來自身份驗證器的驗證碼。
+missingPasswordMessage=「{{0}}」：請設定密碼。
+otp-help-text=輸入 OTP 驗證碼。
 groupsListColumnsNames=群組清單列名稱
-error-invalid-uri-scheme='{{0}}' 包含無效的 URL 協定。
+error-invalid-uri-scheme=「{{0}}」包含無效的 URL 協定。
 error-user-attribute-read-only={{0}} 欄位為唯讀。
-general=一般
-error-invalid-date='{{0}}' 是無效的日期。
-missingEmailMessage='{{0}}'\: 請設定電子信箱。
+general=一般設定
+error-invalid-date=「{{0}}」是無效的日期。
+missingEmailMessage=「{{0}}」：請設定電子信箱。
 accountUpdatedError=由於驗證錯誤而無法更新帳戶
-unLinkError=由於以下原因無法解除連結\: {{error}}
-applicationsIntroMessage=查看您的帳號有權存取的應用程式
-error-invalid-length='{{0}}' 的長度必須在 {{1}} 和 {{2}} 之間。
-missingLastNameMessage='{{0}}'\: 請設定姓氏。
-errorSignOutMessage=由於以下原因無法登出\: {{error}}
-linkedLoginProviders=已經連結的登入提供者
+unLinkError=由於以下原因無法解除連結：{{error}}
+applicationsIntroMessage=查看有權存取您帳號的應用程式
+error-invalid-length=「{{0}}」的長度必須在 {{1}} 和 {{2}} 之間。
+missingLastNameMessage=「{{0}}」：請設定姓氏。
+errorSignOutMessage=由於以下原因無法登出：{{error}}
+linkedLoginProviders=已連結帳號
 inUse=使用中
 client=客戶端
-error-invalid-uri='{{0}}' 是無效的 URL。
+error-invalid-uri=「{{0}}」是無效的 URL。
 systemDefined=系統定義
 hasAccessTo=有權存取
 internalApp=內部應用
-updateError=由於以下原因無法更新資源\: {{error}}
-accessGrantedOn=已給予授權給\: 
+updateError=由於以下原因無法更新資源：{{error}}
+accessGrantedOn=授權授予時間：
 editTheResource=編輯資源 - {{name}}
 permissionRequests=權限請求
 shareSuccess=資源已成功共享。
-missingUsernameMessage='{{0}}'\: 請設定使用者名稱。
+missingUsernameMessage={{0}}：請設定使用者名稱。
 aliasHelp=設定的名字
 fullName={{givenName}} {{familyName}}
 groups=群組
 resources=資源
 resourceIntroMessage=在團隊成員之間分享您的資源
 unLink=取消連結帳號
-errorRemovedMessage=由於以下原因無法移除 {{userLabel}} \: {{error}}
+errorRemovedMessage=由於以下原因無法移除 {{userLabel}} ：{{error}}
 termsOfService=服務條款
-jumpToSection=跳轉到章節
-linkError=由於以下原因無法連結\: {{error}}
+jumpToSection=快速導覽
+linkError=由於以下原因無法連結：{{error}}
 requestor=請求來源
 shareWith=共享給 
 updateCredAriaLabel=更新密碼
-error-pattern-no-match='{{0}}' 不符合設定的格式。
+error-pattern-no-match=「{{0}}」不符合設定的格式。
 application=應用程式
-unlinkedLoginProviders=取消連結登入提供者
+unlinkedLoginProviders=取消連結帳號
 applicationDetails={{clientId}} 應用程式詳細資訊
 successRemovedMessage=已移除 {{userLabel}}。
 deleteAccountWarning=這是不可恢復的。 您的所有資料將永久銷毀且無法恢復。
 resourceSharedWith_other=資源已與 <0>{{username}}</0> 和 <1>{{other}}</1> 個其他使用者共用
-error-person-name-invalid-character='{{0}}' 包含無效字元。
+error-person-name-invalid-character=「{{0}}」包含無效字元。
 user=使用者
 shareUser=新增使用者以共享您的資源
 unLinkSuccess=成功解除帳號連結
 applications=應用程式列表
 sharedWithMe=與我共享
 username=使用者名稱
-webauthn-display-name=通行密碼
-webauthn-help-text=使用你的通行密碼進行登入。
-webauthn-passwordless-display-name=通行密碼
-webauthn-passwordless-help-text=使用你的通尋密碼進行無密碼登入。
+webauthn-display-name=Passkey
+webauthn-help-text=使用您的 Passkey 進行登入。
+webauthn-passwordless-display-name=Passkey
+webauthn-passwordless-help-text=使用您的 Passkey 進行無密碼登入。
 passwordless=無密碼
-error-invalid-multivalued-size=屬性 {{0}} 必須至少有 {{1}} 且最多 {{2}} 個值。
\ No newline at end of file
+error-invalid-multivalued-size=屬性 {{0}} 必須至少有 {{1}} 且最多 {{2}} 個值。
+recovery-authn-code=我的復原驗證碼
+recovery-authn-codes-display-name=復原驗證碼
+recovery-authn-codes-help-text=如果您的其他 2FA 驗證方式無法使用，這些驗證碼可以讓您重新取得存取權限。
+recovery-codes-number-used={{0}} 已使用的復原驗證碼
+recovery-codes-number-remaining={{0}} 剩餘的復原驗證碼
+recovery-codes-generate-new-codes=產生新的驗證碼來確保能存取您的帳號
+oid4vci=可驗證憑證
+verifiableCredentialsTitle=可驗證憑證
+verifiableCredentialsDescription=選擇要存到錢包的憑證。
+verifiableCredentialsIssuerAlert=無法獲取簽發者資訊。
+verifiableCredentialsConfigAlert=無法獲取憑證設定。
+verifiableCredentialsOfferAlert=無法獲取憑證發行要約。
+verifiableCredentialsSelectionDefault=選擇一個憑證設定。
+profileScopeConsentText=使用者個人資料
+emailScopeConsentText=電子信箱地址
+addressScopeConsentText=地址
+phoneScopeConsentText=電話號碼
+offlineAccessScopeConsentText=離線存取
+samlRoleListScopeConsentText=我的角色
+rolesScopeConsentText=使用者角色
+organizations=組織
+organizationDescription=檢視您已加入的組織
+emptyUserOrganizations=沒有組織
+emptyUserOrganizationsInstructions=您尚未加入任何組織。
+searchOrganization=尋找組織
+organizationList=組織清單
+domains=領域
+refresh=重新整理
+termsAndConditionsDeclined=您需要同意使用者條款以繼續
+defaultLocale=選擇...
\ No newline at end of file
diff --git a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/index.ftl b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/index.ftl
index 305537981ab2..f11c4c5e0993 100644
--- a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/index.ftl
+++ b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/index.ftl
@@ -2,7 +2,6 @@
 <html lang="${locale}">
   <head>
     <meta charset="utf-8">
-    <base href="${resourceUrl}/">
     <link rel="icon" type="${properties.favIconType!'image/svg+xml'}" href="${resourceUrl}${properties.favIcon!'/favicon.svg'}">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="color-scheme" content="light${darkMode?then(' dark', '')}">
@@ -123,15 +122,13 @@
       </#list>
     </#if>
   </head>
-  <body>
+  <body data-page-id="account">
     <div id="app">
       <main class="container">
         <div class="keycloak__loading-container">
-          <span class="pf-c-spinner pf-m-xl" role="progressbar" aria-valuetext="Loading&hellip;">
-            <span class="pf-c-spinner__clipper"></span>
-            <span class="pf-c-spinner__lead-ball"></span>
-            <span class="pf-c-spinner__tail-ball"></span>
-          </span>
+          <svg class="pf-v5-c-spinner pf-m-xl" role="progressbar" aria-valuetext="Loading..." viewBox="0 0 100 100" aria-label="Contents">
+            <circle class="pf-v5-c-spinner__path" cx="50" cy="50" r="45" fill="none"></circle>
+          </svg>
           <div>
             <p id="loading-text">Loading the Account Console</p>
           </div>
@@ -157,7 +154,7 @@
           "isRegistrationEmailAsUsername": ${realm.registrationEmailAsUsername?c},
           "isEditUserNameAllowed": ${realm.editUsernameAllowed?c},
           "isInternationalizationEnabled": ${realm.isInternationalizationEnabled()?c},
-          "isLinkedAccountsEnabled": ${realm.identityFederationEnabled?c},
+          "isLinkedAccountsEnabled": ${isLinkedAccountsEnabled?c},
           "isMyResourcesEnabled": ${(realm.userManagedAccessAllowed && isAuthorizationEnabled)?c},
           "isViewOrganizationsEnabled": ${isViewOrganizationsEnabled?c},
           "deleteAccountAllowed": ${deleteAccountAllowed?c},
diff --git a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/messages/messages_en.properties b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/messages/messages_en.properties
index 0f8ba16e2a8c..138e74585557 100644
--- a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/messages/messages_en.properties
+++ b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/messages/messages_en.properties
@@ -148,7 +148,7 @@ systemDefined=System defined
 hasAccessTo=Has access to
 internalApp=Internal
 updateError=Could not update the resource due to\: {{error}}
-accessGrantedOn=Access granted on\: 
+accessGrantedOn=Access granted on\:
 editTheResource=Edit the resource - {{name}}
 permissionRequests=Permission requests
 shareSuccess=Resource successfully shared.
@@ -164,7 +164,7 @@ termsOfService=Terms of service
 jumpToSection=Jump to section
 linkError=Could not link due to\: {{error}}
 requestor=Requestor
-shareWith=Share with 
+shareWith=Share with
 updateCredAriaLabel=Update credential
 error-pattern-no-match='{{0}}' doesn't match required format.
 application=Application
@@ -189,8 +189,8 @@ error-invalid-multivalued-size=Attribute {{0}} must have at least {{1}} and at m
 recovery-authn-code=My recovery authentication codes
 recovery-authn-codes-display-name=Recovery authentication codes
 recovery-authn-codes-help-text=These codes can be used to regain your access in case your other 2FA means are not available.
-recovery-codes-number-used={0} recovery codes used
-recovery-codes-number-remaining={0} recovery codes remaining
+recovery-codes-number-used={{0}} recovery codes used
+recovery-codes-number-remaining={{0}} recovery codes remaining
 recovery-codes-generate-new-codes=Generate new codes to ensure access to your account
 oid4vci=Verifiable Credentials
 verifiableCredentialsTitle=Verifiable Credentials
@@ -214,4 +214,5 @@ searchOrganization=Search for organization
 organizationList=List of organizations
 domains=Domains
 refresh=Refresh
-termsAndConditionsDeclined=You need to accept the Terms and Conditions to continue
\ No newline at end of file
+termsAndConditionsDeclined=You need to accept the Terms and Conditions to continue
+defaultLocale=Choose...
\ No newline at end of file
diff --git a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/theme.properties b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/theme.properties
index 2e80b8fe5b67..b24e3ae5e5b7 100644
--- a/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/theme.properties
+++ b/js/apps/account-ui/maven-resources/theme/keycloak.v3/account/theme.properties
@@ -3,3 +3,4 @@ deprecatedMode=false
 darkMode=true
 
 kcDarkModeClass=pf-v5-theme-dark
+contentHashPattern=assets/.*
\ No newline at end of file
diff --git a/js/apps/account-ui/package.json b/js/apps/account-ui/package.json
index bd2d88d777fb..47ec85966bcd 100644
--- a/js/apps/account-ui/package.json
+++ b/js/apps/account-ui/package.json
@@ -27,30 +27,31 @@
   "dependencies": {
     "@keycloak/keycloak-ui-shared": "workspace:*",
     "@patternfly/patternfly": "^5.4.2",
-    "@patternfly/react-core": "^5.4.10",
+    "@patternfly/react-core": "^5.4.14",
     "@patternfly/react-icons": "^5.4.2",
-    "@patternfly/react-table": "^5.4.13",
-    "i18next": "^24.2.1",
-    "i18next-http-backend": "^3.0.1",
-    "keycloak-js": "workspace:*",
+    "@patternfly/react-table": "^5.4.16",
+    "i18next": "^25.3.1",
+    "i18next-fetch-backend": "^6.0.0",
+    "keycloak-js": "^26.2.0",
     "lodash-es": "^4.17.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "react-hook-form": "^7.54.2",
-    "react-i18next": "^15.4.0",
-    "react-router-dom": "^6.28.1"
+    "react-hook-form": "^7.60.0",
+    "react-i18next": "^15.5.3",
+    "react-router-dom": "^6.30.1"
   },
   "devDependencies": {
     "@keycloak/keycloak-admin-client": "workspace:*",
-    "@playwright/test": "^1.49.1",
+    "@playwright/test": "^1.53.2",
     "@types/lodash-es": "^4.17.12",
-    "@types/react": "^18.3.13",
-    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react-swc": "^3.7.2",
-    "lightningcss": "^1.28.2",
-    "vite": "^6.0.7",
-    "vite-plugin-checker": "^0.8.0",
-    "vite-plugin-dts": "^4.5.0"
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react-swc": "^3.10.2",
+    "cross-env": "^7.0.3",
+    "lightningcss": "^1.30.1",
+    "vite": "^7.0.3",
+    "vite-plugin-checker": "^0.10.0",
+    "vite-plugin-dts": "^4.5.4"
   },
   "wireit": {
     "dev": {
@@ -84,7 +85,7 @@
       ]
     },
     "build-lib": {
-      "command": "LIB=true vite build",
+      "command": "cross-env LIB=true vite build",
       "dependencies": [
         "../../libs/ui-shared:build",
         "../../libs/keycloak-admin-client:build"
diff --git a/js/apps/account-ui/src/account-security/AccountRow.tsx b/js/apps/account-ui/src/account-security/AccountRow.tsx
index a238e3179512..838f07b7d1f8 100644
--- a/js/apps/account-ui/src/account-security/AccountRow.tsx
+++ b/js/apps/account-ui/src/account-security/AccountRow.tsx
@@ -14,7 +14,7 @@ import {
 import { LinkIcon, UnlinkIcon } from "@patternfly/react-icons";
 import { useTranslation } from "react-i18next";
 
-import { linkAccount, unLinkAccount } from "../api/methods";
+import { unLinkAccount } from "../api/methods";
 import { LinkedAccountRepresentation } from "../api/representations";
 import { useAccountAlerts } from "../utils/useAccountAlerts";
 
@@ -31,6 +31,7 @@ export const AccountRow = ({
 }: AccountRowProps) => {
   const { t } = useTranslation();
   const context = useEnvironment();
+  const { login } = context.keycloak;
   const { addAlert, addError } = useAccountAlerts();
 
   const unLink = async (account: LinkedAccountRepresentation) => {
@@ -43,15 +44,6 @@ export const AccountRow = ({
     }
   };
 
-  const link = async (account: LinkedAccountRepresentation) => {
-    try {
-      const { accountLinkUri } = await linkAccount(context, account);
-      location.href = accountLinkUri;
-    } catch (error) {
-      addError("linkError", error);
-    }
-  };
-
   return (
     <DataListItem
       id={`${account.providerAlias}-idp`}
@@ -119,7 +111,11 @@ export const AccountRow = ({
             <Button
               id={`${account.providerAlias}-idp-link`}
               variant="link"
-              onClick={() => link(account)}
+              onClick={async () => {
+                await login({
+                  action: "idp_link:" + account.providerAlias,
+                });
+              }}
             >
               <Icon size="sm">
                 <LinkIcon />
diff --git a/js/apps/account-ui/src/account-security/DeviceActivity.tsx b/js/apps/account-ui/src/account-security/DeviceActivity.tsx
index 3bceb883d9d5..99f0fe5101fe 100644
--- a/js/apps/account-ui/src/account-security/DeviceActivity.tsx
+++ b/js/apps/account-ui/src/account-security/DeviceActivity.tsx
@@ -69,7 +69,7 @@ export const DeviceActivity = () => {
 
   const signOutAll = async () => {
     await deleteSession(context);
-    context.keycloak.logout();
+    await context.keycloak.logout();
   };
 
   const signOutSession = async (
diff --git a/js/apps/account-ui/src/account-security/SigningIn.tsx b/js/apps/account-ui/src/account-security/SigningIn.tsx
index 6652ab3f8128..bc6e82cf399b 100644
--- a/js/apps/account-ui/src/account-security/SigningIn.tsx
+++ b/js/apps/account-ui/src/account-security/SigningIn.tsx
@@ -15,8 +15,12 @@ import {
   SplitItem,
   Title,
 } from "@patternfly/react-core";
-import { EllipsisVIcon } from "@patternfly/react-icons";
-import { CSSProperties, useState } from "react";
+import {
+  EllipsisVIcon,
+  ExclamationTriangleIcon,
+  InfoAltIcon,
+} from "@patternfly/react-icons";
+import { CSSProperties, Fragment, useState } from "react";
 import { Trans, useTranslation } from "react-i18next";
 import { useEnvironment } from "@keycloak/keycloak-ui-shared";
 import { getCredentials } from "../api/methods";
@@ -118,6 +122,57 @@ export const SigningIn = () => {
         </DataListCell>,
       );
     }
+    if (
+      credMetadata.infoMessage ||
+      (credMetadata.warningMessageTitle &&
+        credMetadata.warningMessageDescription)
+    ) {
+      items.push(
+        <DataListCell
+          key={"warning-message" + credential.id}
+          data-testrole="warning-message"
+        >
+          <>
+            {credMetadata.infoMessage && (
+              <p>
+                <InfoAltIcon />{" "}
+                {t(
+                  credMetadata.infoMessage.key,
+                  credMetadata.infoMessage.parameters?.reduce(
+                    (acc, val, idx) => ({ ...acc, [idx]: val }),
+                    {},
+                  ),
+                )}
+              </p>
+            )}
+            {credMetadata.warningMessageTitle &&
+              credMetadata.warningMessageDescription && (
+                <>
+                  <p>
+                    <ExclamationTriangleIcon />{" "}
+                    {t(
+                      credMetadata.warningMessageTitle.key,
+                      credMetadata.warningMessageTitle.parameters?.reduce(
+                        (acc, val, idx) => ({ ...acc, [idx]: val }),
+                        {},
+                      ),
+                    )}
+                  </p>
+                  <p>
+                    {t(
+                      credMetadata.warningMessageDescription.key,
+                      credMetadata.warningMessageDescription.parameters?.reduce(
+                        (acc, val, idx) => ({ ...acc, [idx]: val }),
+                        {},
+                      ),
+                    )}
+                  </p>
+                </>
+              )}
+          </>
+        </DataListCell>,
+      );
+    }
     return items;
   };
 
@@ -139,7 +194,7 @@ export const SigningIn = () => {
           {credentials
             .filter((cred) => cred.category == category)
             .map((container) => (
-              <>
+              <Fragment key={container.type}>
                 <Split className="pf-v5-u-mt-lg pf-v5-u-mb-lg">
                   <SplitItem>
                     <Title
@@ -211,8 +266,8 @@ export const SigningIn = () => {
                                 <Button
                                   variant="danger"
                                   data-testrole="remove"
-                                  onClick={() => {
-                                    login({
+                                  onClick={async () => {
+                                    await login({
                                       action:
                                         "delete_credential:" +
                                         meta.credential.id,
@@ -225,8 +280,10 @@ export const SigningIn = () => {
                               {container.updateAction && (
                                 <Button
                                   variant="secondary"
-                                  onClick={() => {
-                                    login({ action: container.updateAction });
+                                  onClick={async () => {
+                                    await login({
+                                      action: container.updateAction,
+                                    });
                                   }}
                                   data-testrole="update"
                                 >
@@ -240,7 +297,7 @@ export const SigningIn = () => {
                     </DataListItem>
                   ))}
                 </DataList>
-              </>
+              </Fragment>
             ))}
         </PageSection>
       ))}
diff --git a/js/apps/account-ui/src/api/methods.ts b/js/apps/account-ui/src/api/methods.ts
index ef9f6da50994..a47c00c8adf0 100644
--- a/js/apps/account-ui/src/api/methods.ts
+++ b/js/apps/account-ui/src/api/methods.ts
@@ -4,7 +4,6 @@ import {
 } from "@keycloak/keycloak-ui-shared";
 
 import OrganizationRepresentation from "@keycloak/keycloak-admin-client/lib/defs/organizationRepresentation";
-import { joinPath } from "../utils/joinPath";
 import { parseResponse } from "./parse-response";
 import {
   ClientRepresentation,
@@ -143,28 +142,6 @@ export async function unLinkAccount(
   return parseResponse(response);
 }
 
-export async function linkAccount(
-  context: KeycloakContext<BaseEnvironment>,
-  account: LinkedAccountRepresentation,
-) {
-  const redirectUri = encodeURIComponent(
-    joinPath(
-      context.environment.serverBaseUrl,
-      "realms",
-      context.environment.realm,
-      "account",
-    ),
-  );
-  const response = await request(
-    "/linked-accounts/" + account.providerName,
-    context,
-    {
-      searchParams: { providerId: account.providerName, redirectUri },
-    },
-  );
-  return parseResponse<{ accountLinkUri: string }>(response);
-}
-
 export async function getGroups({ signal, context }: CallOptions) {
   const response = await request("/groups", context, {
     signal,
diff --git a/js/apps/account-ui/src/api/representations.ts b/js/apps/account-ui/src/api/representations.ts
index 4c4a8c5621ea..944c0dd49ded 100644
--- a/js/apps/account-ui/src/api/representations.ts
+++ b/js/apps/account-ui/src/api/representations.ts
@@ -31,13 +31,18 @@ export interface ConsentRepresentation {
 export interface ConsentScopeRepresentation {
   id: string;
   name: string;
-  displayTest: string;
+  displayText: string;
+}
+
+export interface CredentialMetadataRepresentationMessage {
+  key: string;
+  parameters?: string[];
 }
 
 export interface CredentialMetadataRepresentation {
-  infoMessage: string;
-  warningMessageTitle: string;
-  warningMessageDescription: string;
+  infoMessage: CredentialMetadataRepresentationMessage;
+  warningMessageTitle: CredentialMetadataRepresentationMessage;
+  warningMessageDescription: CredentialMetadataRepresentationMessage;
   credential: CredentialRepresentation;
 }
 
diff --git a/js/apps/account-ui/src/i18n.ts b/js/apps/account-ui/src/i18n.ts
index 963492a0bee4..ef18afa757a5 100644
--- a/js/apps/account-ui/src/i18n.ts
+++ b/js/apps/account-ui/src/i18n.ts
@@ -1,5 +1,5 @@
 import { LanguageDetectorModule, createInstance } from "i18next";
-import HttpBackend from "i18next-http-backend";
+import FetchBackend from "i18next-fetch-backend";
 import { initReactI18next } from "react-i18next";
 
 import { environment } from "./environment";
@@ -24,6 +24,7 @@ export const keycloakLanguageDetector: LanguageDetectorModule = {
 
 export const i18n = createInstance({
   fallbackLng: DEFAULT_LOCALE,
+  nsSeparator: false,
   interpolation: {
     escapeValue: false,
   },
@@ -32,16 +33,14 @@ export const i18n = createInstance({
       environment.serverBaseUrl,
       `resources/${environment.realm}/account/{{lng}}`,
     ),
-    parse: (data: string) => {
-      const messages = JSON.parse(data);
+    parse(data: string) {
+      const messages: KeyValue[] = JSON.parse(data);
 
-      const result: Record<string, string> = {};
-      messages.forEach((v: KeyValue) => (result[v.key] = v.value));
-      return result;
+      return Object.fromEntries(messages.map(({ key, value }) => [key, value]));
     },
   },
 });
 
-i18n.use(HttpBackend);
+i18n.use(FetchBackend);
 i18n.use(keycloakLanguageDetector);
 i18n.use(initReactI18next);
diff --git a/js/apps/account-ui/src/index.ts b/js/apps/account-ui/src/index.ts
index adee82d589bc..80d689570d87 100644
--- a/js/apps/account-ui/src/index.ts
+++ b/js/apps/account-ui/src/index.ts
@@ -50,7 +50,6 @@ export {
   getPermissionRequests,
   getPersonalInfo,
   getSupportedLocales,
-  linkAccount,
   savePersonalInfo,
   unLinkAccount,
 } from "./api/methods";
diff --git a/js/apps/account-ui/src/oid4vci/Oid4Vci.tsx b/js/apps/account-ui/src/oid4vci/Oid4Vci.tsx
index e51653301465..248e62d9be9d 100644
--- a/js/apps/account-ui/src/oid4vci/Oid4Vci.tsx
+++ b/js/apps/account-ui/src/oid4vci/Oid4Vci.tsx
@@ -51,6 +51,7 @@ export const Oid4Vci = () => {
 
   useEffect(() => {
     if (initialSelected !== selected && credentialsIssuer !== undefined) {
+      // eslint-disable-next-line @typescript-eslint/no-floating-promises
       requestVCOffer(context, selectOptions[selected], credentialsIssuer).then(
         (blob) => {
           const reader = new FileReader();
diff --git a/js/apps/account-ui/src/personal-info/PersonalInfo.tsx b/js/apps/account-ui/src/personal-info/PersonalInfo.tsx
index 3e7e5403ff30..5771c636bcce 100644
--- a/js/apps/account-ui/src/personal-info/PersonalInfo.tsx
+++ b/js/apps/account-ui/src/personal-info/PersonalInfo.tsx
@@ -71,13 +71,14 @@ export const PersonalInfo = () => {
       );
       await savePersonalInfo(context, { ...user, attributes });
       const locale = attributes["locale"]?.toString();
-      if (locale)
-        i18n.changeLanguage(locale, (error) => {
+      if (locale) {
+        await i18n.changeLanguage(locale, (error) => {
           if (error) {
             console.warn("Error(s) loading locale", locale, error);
           }
         });
-      context.keycloak.updateToken();
+      }
+      await context.keycloak.updateToken();
       addAlert(t("accountUpdatedMessage"));
     } catch (error) {
       addAlert(t("accountUpdatedError"), AlertVariant.danger);
@@ -118,11 +119,15 @@ export const PersonalInfo = () => {
             ((key: unknown, params) =>
               t(key as TFuncKey, params as any)) as TFunction
           }
-          renderer={(attribute) =>
-            attribute.name === "email" &&
-            updateEmailFeatureEnabled &&
-            updateEmailActionEnabled &&
-            (!isRegistrationEmailAsUsername || isEditUserNameAllowed) ? (
+          renderer={(attribute) => {
+            const annotations = attribute.annotations
+              ? attribute.annotations
+              : {};
+            return attribute.name === "email" &&
+              updateEmailFeatureEnabled &&
+              updateEmailActionEnabled &&
+              annotations["kc.required.action.supported"] &&
+              (!isRegistrationEmailAsUsername || isEditUserNameAllowed) ? (
               <Button
                 id="update-email-btn"
                 variant="link"
@@ -134,8 +139,8 @@ export const PersonalInfo = () => {
               >
                 {t("updateEmail")}
               </Button>
-            ) : undefined
-          }
+            ) : undefined;
+          }}
         />
         {!allFieldsReadOnly() && (
           <ActionGroup>
diff --git a/js/apps/account-ui/src/resources/PermissionRequest.tsx b/js/apps/account-ui/src/resources/PermissionRequest.tsx
index b0abc738578e..aa3b7a995a2f 100644
--- a/js/apps/account-ui/src/resources/PermissionRequest.tsx
+++ b/js/apps/account-ui/src/resources/PermissionRequest.tsx
@@ -105,15 +105,15 @@ export const PermissionRequest = ({
                 </Td>
                 <Td>
                   <Button
-                    onClick={() => {
-                      approveDeny(shareRequest, true);
+                    onClick={async () => {
+                      await approveDeny(shareRequest, true);
                     }}
                   >
                     {t("accept")}
                   </Button>
                   <Button
-                    onClick={() => {
-                      approveDeny(shareRequest);
+                    onClick={async () => {
+                      await approveDeny(shareRequest);
                     }}
                     className="pf-v5-u-ml-sm"
                     variant="danger"
diff --git a/js/apps/account-ui/src/resources/ShareTheResource.tsx b/js/apps/account-ui/src/resources/ShareTheResource.tsx
index d77aec3d9b29..f352d6483f2c 100644
--- a/js/apps/account-ui/src/resources/ShareTheResource.tsx
+++ b/js/apps/account-ui/src/resources/ShareTheResource.tsx
@@ -177,7 +177,7 @@ export const ShareTheResource = ({
             </InputGroupItem>
           </InputGroup>
           {fields.length > 1 && (
-            <ChipGroup categoryName={t("shareWith")}>
+            <ChipGroup categoryName={t("shareWith") + " "}>
               {fields.map(
                 (field, index) =>
                   index !== fields.length - 1 && (
diff --git a/js/apps/account-ui/src/root/Header.tsx b/js/apps/account-ui/src/root/Header.tsx
index 5a704f5a875d..acc567cc1d13 100644
--- a/js/apps/account-ui/src/root/Header.tsx
+++ b/js/apps/account-ui/src/root/Header.tsx
@@ -51,9 +51,7 @@ export const Header = () => {
       features={{ hasManageAccount: false }}
       brand={{
         href: indexHref,
-        src: brandImage.startsWith("/")
-          ? joinPath(environment.resourceUrl, brandImage)
-          : brandImage,
+        src: joinPath(environment.resourceUrl, brandImage),
         alt: t("logo"),
         className: style.brand,
       }}
diff --git a/js/apps/account-ui/src/root/Root.tsx b/js/apps/account-ui/src/root/Root.tsx
index 27d941f07f46..3546228caccb 100644
--- a/js/apps/account-ui/src/root/Root.tsx
+++ b/js/apps/account-ui/src/root/Root.tsx
@@ -1,4 +1,8 @@
-import { ErrorPage, useEnvironment } from "@keycloak/keycloak-ui-shared";
+import {
+  ErrorPage,
+  useEnvironment,
+  KeycloakContext,
+} from "@keycloak/keycloak-ui-shared";
 import { Page, Spinner } from "@patternfly/react-core";
 import { Suspense, useState } from "react";
 import {
@@ -14,12 +18,21 @@ import { Header } from "./Header";
 import { MenuItem, PageNav } from "./PageNav";
 import { routes } from "../routes";
 
-function mapRoutes(content: MenuItem[]): RouteObject[] {
+function mapRoutes(
+  context: KeycloakContext<Environment>,
+  content: MenuItem[],
+): RouteObject[] {
   return content
     .map((item) => {
       if ("children" in item) {
-        return mapRoutes(item.children);
+        return mapRoutes(context, item.children);
+      }
+
+      // Do not add route disabled via feature flags
+      if (item.isVisible && !context.environment.features[item.isVisible]) {
+        return null;
       }
+
       return {
         ...item,
         element:
@@ -28,6 +41,7 @@ function mapRoutes(content: MenuItem[]): RouteObject[] {
             : undefined,
       };
     })
+    .filter((item) => !!item)
     .flat();
 }
 
@@ -49,7 +63,7 @@ export const Root = () => {
             </Page>
           ),
           errorElement: <ErrorPage />,
-          children: mapRoutes(content),
+          children: mapRoutes(context, content),
         },
       ]);
     },
diff --git a/js/apps/account-ui/src/utils/usePromise.ts b/js/apps/account-ui/src/utils/usePromise.ts
index 50cdae160972..cde96c90a0bb 100644
--- a/js/apps/account-ui/src/utils/usePromise.ts
+++ b/js/apps/account-ui/src/utils/usePromise.ts
@@ -66,7 +66,7 @@ export function usePromise<T>(
       }
     }
 
-    handlePromise();
+    void handlePromise();
 
     // Abort the Promise when the component unmounts, or the dependencies change.
     return () => controller.abort();
diff --git a/js/apps/account-ui/test/account-security/linked-accounts.spec.ts b/js/apps/account-ui/test/account-security/linked-accounts.spec.ts
index 0e71edb4f558..1eae9edf2d51 100644
--- a/js/apps/account-ui/test/account-security/linked-accounts.spec.ts
+++ b/js/apps/account-ui/test/account-security/linked-accounts.spec.ts
@@ -95,7 +95,7 @@ test.describe("Account linking", () => {
 
     // Expect an error shown that the account cannot be unlinked
     await expect(page.getByTestId("last-alert")).toContainText(
-      "You can''t remove last federated identity as you don''t have a password.",
+      "You can not remove last federated identity as you do not have a password.",
     );
   });
 });
@@ -115,12 +115,16 @@ async function updateProfile(
   await page.getByRole("button", { name: "Submit" }).click();
 }
 
-async function loginWithUsernamePassword(page, username, password) {
+async function loginWithUsernamePassword(
+  page: Page,
+  username: string,
+  password: string,
+) {
   await page.getByLabel("Username").fill(username);
   await page.getByLabel("Password", { exact: true }).fill(password);
   await page.getByRole("button", { name: "Sign In" }).click();
 }
 
-async function loginWithIdp(page, idpAlias: string) {
+async function loginWithIdp(page: Page, idpAlias: string) {
   await page.getByRole("link", { name: idpAlias }).click();
 }
diff --git a/js/apps/account-ui/test/account-security/signing-in.spec.ts b/js/apps/account-ui/test/account-security/signing-in.spec.ts
index 81ce20adf301..bee1608577f9 100644
--- a/js/apps/account-ui/test/account-security/signing-in.spec.ts
+++ b/js/apps/account-ui/test/account-security/signing-in.spec.ts
@@ -18,7 +18,7 @@ test.describe("Signing in", () => {
 
     await page.getByTestId("accountSecurity").click();
     await expect(page.getByTestId("account-security/signing-in")).toBeVisible();
-    page.getByTestId("account-security/signing-in").click();
+    await page.getByTestId("account-security/signing-in").click();
 
     await expect(
       page.getByTestId("password/credential-list").getByRole("listitem"),
@@ -54,11 +54,11 @@ test.describe("Signing in 2", () => {
     await login(page, "jdoe", "jdoe", "groups");
 
     const credentials = await getCredentials(jdoeUser!.id!, realm);
-    deleteCredential(jdoeUser!.id!, credentials![0].id!, realm);
+    await deleteCredential(jdoeUser!.id!, credentials![0].id!, realm);
 
     await page.getByTestId("accountSecurity").click();
     await expect(page.getByTestId("account-security/signing-in")).toBeVisible();
-    page.getByTestId("account-security/signing-in").click();
+    await page.getByTestId("account-security/signing-in").click();
 
     await expect(
       page.getByTestId("password/credential-list").getByRole("listitem"),
diff --git a/js/apps/account-ui/test/admin-client.ts b/js/apps/account-ui/test/admin-client.ts
index 047c61717e37..25211fcece57 100644
--- a/js/apps/account-ui/test/admin-client.ts
+++ b/js/apps/account-ui/test/admin-client.ts
@@ -58,7 +58,7 @@ export async function createIdentityProvider(
   idp: IdentityProviderRepresentation,
   realm = DEFAULT_REALM,
 ): Promise<string> {
-  return adminClient.identityProviders.create({ ...idp, realm })["id"];
+  return (await adminClient.identityProviders.create({ ...idp, realm }))["id"];
 }
 
 export async function deleteIdentityProvider(
diff --git a/js/apps/account-ui/test/applications.spec.ts b/js/apps/account-ui/test/applications.spec.ts
index d509e6de1427..6002b2fae450 100644
--- a/js/apps/account-ui/test/applications.spec.ts
+++ b/js/apps/account-ui/test/applications.spec.ts
@@ -62,7 +62,7 @@ test.describe("Applications test", () => {
     await page.goto("/");
     await expect(page).toHaveURL(getAdminUrl());
     await page.waitForURL(getAdminUrl());
-    await expect(page.getByTestId("realmSelector")).toBeVisible();
+    await expect(page.getByTestId("options-toggle")).toBeVisible();
 
     await page.goto(getRootPath());
     await page.waitForURL(getAccountUrl());
diff --git a/js/apps/account-ui/test/personal-info/personal-info.spec.ts b/js/apps/account-ui/test/personal-info/personal-info.spec.ts
index e5fe4db12c9e..824726e5e0b6 100644
--- a/js/apps/account-ui/test/personal-info/personal-info.spec.ts
+++ b/js/apps/account-ui/test/personal-info/personal-info.spec.ts
@@ -80,10 +80,10 @@ test.describe("Personal info with userprofile enabled", () => {
   test("render long list of locales as typeahead", async ({ page }) => {
     await login(page, user, "jdoe", realm);
 
-    await page.locator("#locale").click();
+    await page.locator("#attributes\\.locale").click();
     await page.waitForSelector("text=Italiano");
 
-    await page.locator("#locale").click();
+    await page.locator("#attributes\\.locale").click();
     await page.locator("*:focus").press("Control+A");
     await page.locator("*:focus").pressSequentially("S");
     await expect(page.getByText("Italiano")).toHaveCount(0);
@@ -126,14 +126,14 @@ test.describe("Realm localization", () => {
     );
 
     await login(page, user, "pwd", realm);
-    await page.locator("#locale").click();
+    await page.locator("#attributes\\.locale").click();
     page.getByRole("option").filter({ hasText: "Deutsch" });
     await page.getByRole("option", { name: "English" }).click();
     await page.getByTestId("save").click();
     await page.reload();
 
     expect(
-      page.locator("#locale").filter({ hasText: /^English$/ }),
+      page.locator("#attributes\\.locale").filter({ hasText: /^English$/ }),
     ).toBeDefined();
   });
 });
diff --git a/js/apps/account-ui/test/personal-info/user-profile.json b/js/apps/account-ui/test/personal-info/user-profile.json
index ecf8618d3df8..018fb3c269ee 100644
--- a/js/apps/account-ui/test/personal-info/user-profile.json
+++ b/js/apps/account-ui/test/personal-info/user-profile.json
@@ -4,14 +4,8 @@
       "name": "username",
       "displayName": "${username}",
       "permissions": {
-        "view": [
-          "admin",
-          "user"
-        ],
-        "edit": [
-          "admin",
-          "user"
-        ]
+        "view": ["admin", "user"],
+        "edit": ["admin", "user"]
       },
       "validations": {
         "length": {
@@ -26,19 +20,11 @@
       "name": "email",
       "displayName": "${email}",
       "required": {
-        "roles": [
-          "user"
-        ]
+        "roles": ["user"]
       },
       "permissions": {
-        "view": [
-          "admin",
-          "user"
-        ],
-        "edit": [
-          "admin",
-          "user"
-        ]
+        "view": ["admin", "user"],
+        "edit": ["admin", "user"]
       },
       "validations": {
         "email": {},
@@ -51,19 +37,11 @@
       "name": "firstName",
       "displayName": "${firstName}",
       "required": {
-        "roles": [
-          "user"
-        ]
+        "roles": ["user"]
       },
       "permissions": {
-        "view": [
-          "admin",
-          "user"
-        ],
-        "edit": [
-          "admin",
-          "user"
-        ]
+        "view": ["admin", "user"],
+        "edit": ["admin", "user"]
       },
       "validations": {
         "length": {
@@ -76,19 +54,11 @@
       "name": "lastName",
       "displayName": "${lastName}",
       "required": {
-        "roles": [
-          "user"
-        ]
+        "roles": ["user"]
       },
       "permissions": {
-        "view": [
-          "admin",
-          "user"
-        ],
-        "edit": [
-          "admin",
-          "user"
-        ]
+        "view": ["admin", "user"],
+        "edit": ["admin", "user"]
       },
       "validations": {
         "length": {
@@ -115,12 +85,8 @@
         ]
       },
       "permissions": {
-        "edit": [
-          "user"
-        ],
-        "view": [
-          "user"
-        ]
+        "edit": ["user"],
+        "view": ["user"]
       },
       "annotations": {
         "inputType": "select",
@@ -128,11 +94,7 @@
       },
       "validations": {
         "options": {
-          "options": [
-            "one",
-            "two",
-            "three"
-          ]
+          "options": ["one", "two", "three"]
         }
       }
     },
@@ -154,14 +116,8 @@
         ]
       },
       "permissions": {
-        "edit": [
-          "user",
-          "admin"
-        ],
-        "view": [
-          "user",
-          "admin"
-        ]
+        "edit": ["user", "admin"],
+        "view": ["user", "admin"]
       },
       "annotations": {
         "inputType": "textarea"
@@ -173,9 +129,7 @@
       "name": "email2",
       "displayName": "Alternative email",
       "required": {
-        "roles": [
-          "user"
-        ],
+        "roles": ["user"],
         "scopes": [
           "roles",
           "offline_access",
@@ -204,14 +158,8 @@
         ]
       },
       "permissions": {
-        "edit": [
-          "admin",
-          "user"
-        ],
-        "view": [
-          "admin",
-          "user"
-        ]
+        "edit": ["admin", "user"],
+        "view": ["admin", "user"]
       },
       "annotations": {
         "inputType": "html5-email",
@@ -277,6 +225,7 @@
           "pl": "${locale_pl}",
           "pt": "${locale_pt}",
           "ru": "${locale_ru}",
+          "ky": "${locale_ky}",
           "sk": "${locale_sk}",
           "sv": "${locale_sv}",
           "th": "${locale_th}",
@@ -284,7 +233,7 @@
           "uk": "${locale_uk}",
           "zh": "${locale_zh}",
           "fi": "${locale_fi}"
-       }
+        }
       },
       "permissions": { "view": ["admin", "user"], "edit": ["admin", "user"] },
       "group": "group"
@@ -298,4 +247,4 @@
       "name": "group"
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/js/apps/account-ui/test/realms/verifiable-credentials-realm.json b/js/apps/account-ui/test/realms/verifiable-credentials-realm.json
index ae6f2b03e1e0..b30e18d1b45e 100644
--- a/js/apps/account-ui/test/realms/verifiable-credentials-realm.json
+++ b/js/apps/account-ui/test/realms/verifiable-credentials-realm.json
@@ -95,9 +95,8 @@
             "protocol": "oid4vc",
             "protocolMapper": "oid4vc-target-role-mapper",
             "config": {
-              "subjectProperty": "roles",
-              "clientId": "did:web:test-marketplace.org",
-              "supportedCredentialTypes": "NaturalPersonCredential"
+              "claim.name": "roles",
+              "clientId": "did:web:test-marketplace.org"
             }
           },
           {
@@ -105,9 +104,8 @@
             "protocol": "oid4vc",
             "protocolMapper": "oid4vc-target-role-mapper",
             "config": {
-              "subjectProperty": "roles",
-              "clientId": "did:web:test-marketplace.org",
-              "supportedCredentialTypes": "VerifiableCredential"
+              "claim.name": "roles",
+              "clientId": "did:web:test-marketplace.org"
             }
           },
           {
@@ -115,9 +113,8 @@
             "protocol": "oid4vc",
             "protocolMapper": "oid4vc-user-attribute-mapper",
             "config": {
-              "subjectProperty": "email",
-              "userAttribute": "email",
-              "supportedCredentialTypes": "NaturalPersonCredential"
+              "claim.name": "email",
+              "userAttribute": "email"
             }
           }
         ],
@@ -185,26 +182,13 @@
     "defaultOptionalClientScopes": [
     ],
     "components": {
-      "org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService": [
+      "org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder": [
         {
-          "id": "jwt-signing",
-          "name": "jwt-signing-service",
-          "providerId": "jwt_vc",
+          "id": "sd-jwt-credential-builder",
+          "name": "credential-builder-vc+sd-jwt",
+          "providerId": "vc+sd-jwt",
           "subComponents": {},
-          "config": {
-            "keyId": [
-              "GwZfdu_xA5MYJmIWnrAdvbExMMWGdsqfY2qoqFVhVPM"
-            ],
-            "algorithmType": [
-              "RS256"
-            ],
-            "issuerDid": [
-              "did:web:test.org"
-            ],
-            "tokenType": [
-              "JWT"
-            ]
-          }
+          "config": {}
         }
       ]
     }
diff --git a/js/apps/account-ui/test/referrer.spec.ts b/js/apps/account-ui/test/referrer.spec.ts
index 74db8b0ef330..fd17baa9b6f4 100644
--- a/js/apps/account-ui/test/referrer.spec.ts
+++ b/js/apps/account-ui/test/referrer.spec.ts
@@ -10,7 +10,7 @@ test.describe("Signing in with referrer link", () => {
   }) => {
     const referrer = "security-admin-console";
     const referrerUrl = getAdminUrl();
-    const referrerName = "security admin console";
+    const referrerName = "Security Admin Console";
 
     const queryParams = {
       referrer,
diff --git a/js/apps/admin-ui/CONTRIBUTING.md b/js/apps/admin-ui/CONTRIBUTING.md
index ad7bd56c1679..04e0944900b6 100644
--- a/js/apps/admin-ui/CONTRIBUTING.md
+++ b/js/apps/admin-ui/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Keycloak Admin UI
 
-This project is the next generation of the Keycloak Administration UI. It is written with React and [PatternFly 4](https://www.patternfly.org/v4/) and uses [Vite](https://vitejs.dev/guide/) and [Cypress](https://docs.cypress.io/guides/overview/why-cypress).
+This project is the next generation of the Keycloak Administration UI. It is written with React and [PatternFly 4](https://www.patternfly.org/v4/) and uses [Vite](https://vitejs.dev/guide/) and [Playwright](hhttps://playwright.dev/).
 
 ## Development
 
@@ -34,6 +34,9 @@ Once the process of optimization is done your browser will automatically open yo
 
 You can now start making changes to the source code, and they will be reflected in your browser.
 
+In this mode the messages for translation will come directly from the messages.properties and the realm overrides will be ignored, this makes testing adding messages easier.
+But when you want to see the realm overrides instead, you can add the environment variable `VITE_REALM_OVERRIDES=true` to disable this behavior.
+
 ## Building as a Keycloak theme
 
 If you want to build the application using Maven and produce a JAR that can be installed directly into Keycloak, check out the [Keycloak theme documentation](../../keycloak-theme/README.md).
@@ -46,9 +49,9 @@ Every time you create a commit it should be automatically linted and formatted f
 pnpm lint
 ```
 
-## Integration testing with Cypress
+## Integration testing with Playwright
 
-This repository contains integration tests developed with the [Cypress framework](https://www.cypress.io/).
+This repository contains integration tests developed with the [Playwright framework](https://playwright.dev/).
 
 ### Prerequisites
 
@@ -56,21 +59,10 @@ Ensure the Keycloak and development server are running as [outlined previously](
 
 ### Running the tests
 
-You can run the tests using the interactive graphical user interface using the following command:
-
-```bash
-pnpm cy:open
-```
+You can run the tests using the interactive graphical user [Visual Studio Code plugin](https://marketplace.visualstudio.com/items?itemName=ms-playwright.playwright)
 
 Alternatively the tests can also run headless as follows:
 
 ```
-pnpm cy:run
+pnpm test:integration
 ```
-
-For more information about the Cypress command-line interface consult [the documentation](https://docs.cypress.io/guides/guides/command-line).
-
-### Project Structure
-
-You can find information about the project structure in the [official Cypress documentation](https://docs.cypress.io/guides/core-concepts/writing-and-organizing-tests#Folder-structure).
-Read more about [how to write tests](./cypress/WRITING_TESTS.md)
diff --git a/js/apps/admin-ui/README.md b/js/apps/admin-ui/README.md
index 0333c5034f73..79fc68988fa6 100644
--- a/js/apps/admin-ui/README.md
+++ b/js/apps/admin-ui/README.md
@@ -33,7 +33,7 @@ import { KeycloakProvider } from "@keycloak/keycloak-ui-shared";
 ### Translation
 
 For the translation we use `react-i18next` you can [set it up](https://react.i18next.com/) as described on their website.
-If you want to use the translations that are provided then you need to add `i18next-http-backend` to your project and add:
+If you want to use the translations that are provided then you need to add `i18next-fetch-backend` to your project and add:
 
 ```ts
 
@@ -42,9 +42,9 @@ backend: {
   parse: (data: string) => {
     const messages = JSON.parse(data);
 
-    const result: Record<string, string> = {};
-    messages.forEach((v) => (result[v.key] = v.value));
-    return result;
+    return Object.fromEntries(
+      messages.map(({ key, value }) => [key, value])
+    );
   },
 },
 ```
diff --git a/js/apps/admin-ui/cypress.config.ts b/js/apps/admin-ui/cypress.config.ts
deleted file mode 100644
index bb8452c28eef..000000000000
--- a/js/apps/admin-ui/cypress.config.ts
+++ /dev/null
@@ -1,78 +0,0 @@
-import { defineConfig } from "cypress";
-import cypressSplit from "cypress-split";
-import fs from "node:fs";
-import { isAsyncFunction } from "node:util/types";
-
-const isCI = process.env.CI === "true";
-const retryCount = parseInt(process.env.RETRY_COUNT || "0");
-
-export default defineConfig({
-  video: isCI,
-  projectId: "j4yhox",
-  chromeWebSecurity: false,
-  viewportWidth: 1920,
-  viewportHeight: 1200,
-  defaultCommandTimeout: 30000,
-  numTestsKeptInMemory: 30,
-  experimentalMemoryManagement: true,
-
-  retries: {
-    runMode: retryCount,
-  },
-
-  e2e: {
-    baseUrl: "http://localhost:8080",
-    slowTestThreshold: 30000,
-    specPattern: "cypress/e2e/**/*.{js,jsx,ts,tsx}",
-    setupNodeEvents(on, config) {
-      on("before:browser:launch", (browser, launchOptions) => {
-        if (browser.family === "firefox") {
-          // launchOptions.preferences is a map of preference names to values
-          // login is not working in firefox when testing_localhost_is_secure_when_hijacked is false
-          launchOptions.preferences[
-            "network.proxy.testing_localhost_is_secure_when_hijacked"
-          ] = true;
-        }
-
-        return launchOptions;
-      });
-      // after:spec collides with cypressSplit function below and is overridden there
-
-      function afterSpecRemoveSuccessfulVideos(spec, results) {
-        if (results?.video) {
-          // Do we have failures for any retry attempts?
-          const failures = results.tests.some((test) =>
-            test.attempts.some((attempt) => attempt.state === "failed"),
-          );
-
-          if (!failures) {
-            // delete the video if the spec passed and no tests retried
-            fs.rmSync(results.video, { force: true });
-          }
-        }
-      }
-
-      function chainedOn(event, callback) {
-        if (event === "after:spec") {
-          if (isAsyncFunction(callback)) {
-            on(event, async (spec, results) => {
-              afterSpecRemoveSuccessfulVideos(spec, results);
-              await callback(spec, results);
-            });
-          } else {
-            on(event, (spec, results) => {
-              afterSpecRemoveSuccessfulVideos(spec, results);
-              callback(spec, results);
-            });
-          }
-        } else {
-          on(event, callback);
-        }
-      }
-
-      cypressSplit(chainedOn, config);
-
-      return config;
-    },
-  },
-});
diff --git a/js/apps/admin-ui/cypress/WRITING_TESTS.md b/js/apps/admin-ui/cypress/WRITING_TESTS.md
deleted file mode 100644
index d62adc1fa533..000000000000
--- a/js/apps/admin-ui/cypress/WRITING_TESTS.md
+++ /dev/null
@@ -1,87 +0,0 @@
-## How to write tests
-
-### Create PageObjects for the page screens to reuse the methods
-
-Don't do this:
-```typescript
-cy.findByTestId("rs-keys-tab").click();
-cy.findByTestId("rs-providers-tab").click();
-cy.findAllByTestId("provider-name-link")
-  .contains("test_hmac-generated")
-  .click();
-```
-
-Instead use a page object as it is a lot easier to get the intended functionality of the test:
-```typescript
-realmSettings.goToProvidersTab();
-realmSettings.fillOutForm({ name: "test" }).save();
-```
-
-#### Clean code
-Write locators in the PageObject layer and in object variables when possible to avoid hardcoding.
-Set type of element at the end of the variable name (e.g. saveBtn, nameInput, userDrpDwn…)
-Avoid adding “click” to name methods, methods should be named as an action “goToX”, “openX”, “createX”, etc.
-Consistent naming (e.g goToTab methods, somewhere named goToTab, other goToXTab)
-
-
-### Test structure
-
-We have `keycloakBefore` that will navigate to the main page, control request errors and wait for the load to finish.
-You can then have multiple test or create a new `describe` block to setup some data for your test.
-
-```typescript
-describe("Realm roles test", () => {
-  before(() => {
-    keycloakBefore();
-    loginPage.logIn();
-  });
-
-  beforeEach(() => {
-    sidebarPage.goToRealmRoles();
-  });
-```
-
-Example of `describe` to setup data for that test:
-
-```typescript
-import adminClient from "../support/util/AdminClient";
-
-describe("Edit role details", () => {
-  before(() => {
-    adminClient.createRealmRole({
-      name: editRoleName,
-      description,
-    });
-  });
-
-  after(() => {
-    adminClient.deleteRealmRole(editRoleName);
-  });
-
-  it("Should edit realm role details", () => {
-      // ...
-```
-
-### Waiting for results
-
-Sometimes you will get the following error:
-> Cypress failed because the element has been detached from the DOM
-
-This is because the DOM has been updated in between selectors. You can remedy this by waiting on REST calls. 
-You can see the rest calls in the cypress IDE.
-
-```typescript
-  cy.intercept("/admin/realms/master/").as("search");
-  
-  // ... pressing a button that will perform the search
-  
-  cy.wait(["@search"]); // wait for the call named search
-```
-
-If there were no calls and you still get this error, try using `{force: true}`, but try not to use it everywhere. For example, there could be an unexpected open modal blocking the element, so even the user wouldn’t be able to use that element.
-
-### Some more reading:
-
-* [Moises document](https://docs.google.com/document/d/11sm1IpEvVLHO59JEVmwgNOUD0zoP4YMvInIU4v5iVNk/edit)
-* [Cypress blog do not get too detached](https://www.cypress.io/blog/2020/07/22/do-not-get-too-detached/)
-* [See the clients_test.spec as an example](./cypress/e2e/clients_test.spec.ts)
\ No newline at end of file
diff --git a/js/apps/admin-ui/cypress/e2e/authentication_policies.spec.ts b/js/apps/admin-ui/cypress/e2e/authentication_policies.spec.ts
deleted file mode 100644
index 89028fedd529..000000000000
--- a/js/apps/admin-ui/cypress/e2e/authentication_policies.spec.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import OTPPolicies from "../support/pages/admin-ui/manage/authentication/OTPPolicies";
-import WebAuthnPolicies from "../support/pages/admin-ui/manage/authentication/WebAuthnPolicies";
-
-describe("Policies", () => {
-  const masthead = new Masthead();
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-
-  describe("OTP policies tab", () => {
-    const otpPoliciesPage = new OTPPolicies();
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToAuthentication();
-      otpPoliciesPage.goToTab();
-    });
-
-    it("should change to hotp", () => {
-      otpPoliciesPage.checkSupportedApplications(
-        "FreeOTP",
-        "Google Authenticator",
-        "Microsoft Authenticator",
-      );
-      otpPoliciesPage.setPolicyType("hotp").increaseInitialCounter().save();
-      masthead.checkNotificationMessage("OTP policy successfully updated");
-      otpPoliciesPage.checkSupportedApplications(
-        "FreeOTP",
-        "Google Authenticator",
-      );
-    });
-  });
-
-  describe("Webauthn policies tabs", () => {
-    const webauthnPage = new WebAuthnPolicies();
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToAuthentication();
-    });
-
-    it("should fill webauthn settings", () => {
-      webauthnPage.goToTab();
-      webauthnPage.fillSelects({
-        webAuthnPolicyAttestationConveyancePreference: "Indirect",
-        webAuthnPolicyRequireResidentKey: "Yes",
-        webAuthnPolicyUserVerificationRequirement: "Preferred",
-      });
-      webauthnPage.webAuthnPolicyCreateTimeout(30).save();
-      masthead.checkNotificationMessage(
-        "Updated webauthn policies successfully",
-      );
-    });
-
-    it("should fill webauthn passwordless settings", () => {
-      webauthnPage.goToPasswordlessTab();
-      webauthnPage
-        .fillSelects(
-          {
-            webAuthnPolicyAttestationConveyancePreference: "Indirect",
-            webAuthnPolicyRequireResidentKey: "Yes",
-            webAuthnPolicyUserVerificationRequirement: "Preferred",
-          },
-          true,
-        )
-        .save();
-      masthead.checkNotificationMessage(
-        "Updated webauthn policies successfully",
-      );
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/authentication_policies_ciba.spec.ts b/js/apps/admin-ui/cypress/e2e/authentication_policies_ciba.spec.ts
deleted file mode 100644
index e6f84969c551..000000000000
--- a/js/apps/admin-ui/cypress/e2e/authentication_policies_ciba.spec.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import Form from "../support/forms/Form";
-import FormValidation from "../support/forms/FormValidation";
-import Select from "../support/forms/Select";
-import CIBAPolicyPage from "../support/pages/admin-ui/manage/authentication/CIBAPolicyPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-
-describe("Authentication - Policies - CIBA", () => {
-  const realmName = crypto.randomUUID();
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToAuthentication();
-    CIBAPolicyPage.goToTab();
-  });
-
-  it("displays the initial state", () => {
-    Select.assertSelectedItem(
-      CIBAPolicyPage.getBackchannelTokenDeliveryModeSelect(),
-      "Poll",
-    );
-    CIBAPolicyPage.getExpiresInput().should("have.value", "120");
-    CIBAPolicyPage.getIntervalInput().should("have.value", "5");
-    Form.assertSaveButtonDisabled();
-  });
-
-  it("validates the fields", () => {
-    // Required fields.
-    CIBAPolicyPage.getExpiresInput().clear();
-    CIBAPolicyPage.getIntervalInput().clear();
-
-    FormValidation.assertRequired(CIBAPolicyPage.getExpiresInput());
-    FormValidation.assertRequired(CIBAPolicyPage.getIntervalInput());
-    Form.assertSaveButtonDisabled();
-
-    // Fields with minimum value.
-    CIBAPolicyPage.getExpiresInput().type("9");
-    CIBAPolicyPage.getIntervalInput().type("-1");
-
-    FormValidation.assertMinValue(CIBAPolicyPage.getExpiresInput(), 10);
-    FormValidation.assertMinValue(CIBAPolicyPage.getIntervalInput(), 0);
-    Form.assertSaveButtonDisabled();
-
-    // Fields with maximum value.
-    CIBAPolicyPage.getExpiresInput().clear().type("601");
-    CIBAPolicyPage.getIntervalInput().clear().type("601");
-
-    FormValidation.assertMaxValue(CIBAPolicyPage.getExpiresInput(), 600);
-    FormValidation.assertMaxValue(CIBAPolicyPage.getIntervalInput(), 600);
-    Form.assertSaveButtonDisabled();
-  });
-
-  it("saves the form", () => {
-    // Select new values for fields.
-    Select.selectItem(
-      CIBAPolicyPage.getBackchannelTokenDeliveryModeSelect(),
-      "Ping",
-    );
-    CIBAPolicyPage.getExpiresInput().clear().type("140");
-    CIBAPolicyPage.getIntervalInput().clear().type("20");
-
-    // Save form.
-    Form.clickSaveButton();
-    CIBAPolicyPage.assertSaveSuccess();
-
-    // Assert values are saved.
-    Select.assertSelectedItem(
-      CIBAPolicyPage.getBackchannelTokenDeliveryModeSelect(),
-      "Ping",
-    );
-    CIBAPolicyPage.getExpiresInput().should("have.value", "140");
-    CIBAPolicyPage.getIntervalInput().should("have.value", "20");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/authentication_test.spec.ts b/js/apps/admin-ui/cypress/e2e/authentication_test.spec.ts
deleted file mode 100644
index bb7b5c3cc424..000000000000
--- a/js/apps/admin-ui/cypress/e2e/authentication_test.spec.ts
+++ /dev/null
@@ -1,386 +0,0 @@
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import DuplicateFlowModal from "../support/pages/admin-ui/manage/authentication/DuplicateFlowModal";
-import FlowDetails from "../support/pages/admin-ui/manage/authentication/FlowDetail";
-import RequiredActions from "../support/pages/admin-ui/manage/authentication/RequiredActions";
-import adminClient from "../support/util/AdminClient";
-import PasswordPolicies from "../support/pages/admin-ui/manage/authentication/PasswordPolicies";
-import ModalUtils from "../support/util/ModalUtils";
-import CommonPage from "../support/pages/CommonPage";
-import BindFlowModal from "../support/pages/admin-ui/manage/authentication/BindFlowModal";
-import OTPPolicies from "../support/pages/admin-ui/manage/authentication/OTPPolicies";
-import WebAuthnPolicies from "../support/pages/admin-ui/manage/authentication/WebAuthnPolicies";
-import CIBAPolicyPage from "../support/pages/admin-ui/manage/authentication/CIBAPolicyPage";
-import FlowDiagram from "../support/pages/admin-ui/manage/authentication/FlowDiagram";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const commonPage = new CommonPage();
-const listingPage = new ListingPage();
-const realmName = "test" + crypto.randomUUID();
-
-describe("Authentication test", () => {
-  const detailPage = new FlowDetails();
-  const diagramView = new FlowDiagram();
-  const duplicateFlowModal = new DuplicateFlowModal();
-  const modalUtil = new ModalUtils();
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToAuthentication();
-  });
-
-  it("authentication empty search test", () => {
-    commonPage.tableToolbarUtils().searchItem("", false);
-    commonPage.tableUtils().checkIfExists(true);
-  });
-
-  it("authentication search flow", () => {
-    const itemId = "Browser";
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().checkRowItemExists(itemId);
-  });
-
-  it("should create duplicate of existing flow", () => {
-    listingPage.clickRowDetails("Browser").clickDetailMenu("Duplicate");
-    duplicateFlowModal.fill("Copy of browser");
-
-    masthead.checkNotificationMessage("Flow successfully duplicated");
-    detailPage.flowExists("Copy of browser");
-  });
-
-  it("Should fail duplicate with empty flow name", () => {
-    listingPage.clickRowDetails("Browser").clickDetailMenu("Duplicate");
-    duplicateFlowModal.fill().shouldShowError("Required field");
-    modalUtil.cancelModal();
-  });
-
-  it("Should fail duplicate with duplicated name", () => {
-    listingPage.clickRowDetails("Browser").clickDetailMenu("Duplicate");
-    duplicateFlowModal.fill("browser");
-    masthead.checkNotificationMessage(
-      "Could not duplicate flow: New flow alias name already exists",
-    );
-  });
-
-  it("Should show the details of a flow as a table", () => {
-    listingPage.goToItemDetails("Copy of browser");
-
-    detailPage.executionExists("Cookie");
-  });
-
-  // as of 03/28/24, drag and drop is not working
-  it.skip("Should move kerberos down", () => {
-    listingPage.goToItemDetails("Copy of browser");
-
-    const fromRow = "Kerberos";
-    detailPage.expectPriorityChange(fromRow, () => {
-      detailPage.moveRowTo(
-        fromRow,
-        `[data-testid="Identity Provider Redirector"]`,
-      );
-    });
-  });
-
-  it("Should edit flow details", () => {
-    const name = "Copy of browser";
-    listingPage.goToItemDetails(name);
-    const commonPage = new CommonPage();
-
-    commonPage
-      .actionToolbarUtils()
-      .clickActionToggleButton()
-      .clickDropdownItem("Edit info");
-
-    duplicateFlowModal.fill(name, "Other description");
-    masthead.checkNotificationMessage("Flow successfully updated");
-  });
-
-  it("Should change requirement of cookie", () => {
-    listingPage.goToItemDetails("Copy of browser");
-
-    detailPage.changeRequirement("Cookie", "Required");
-
-    masthead.checkNotificationMessage("Flow successfully updated");
-  });
-
-  it("Should switch to diagram mode", () => {
-    listingPage.goToItemDetails("Copy of browser");
-
-    detailPage.goToDiagram();
-
-    diagramView.exists();
-  });
-
-  it("Should add a execution", () => {
-    listingPage.goToItemDetails("Copy of browser");
-    detailPage.addExecution(
-      "Copy of browser forms",
-      "reset-credentials-choose-user",
-    );
-
-    masthead.checkNotificationMessage("Flow successfully updated");
-    detailPage.executionExists("Choose User");
-  });
-
-  it("should add a condition", () => {
-    listingPage.goToItemDetails("Copy of browser");
-    detailPage.addCondition(
-      "Copy of browser Browser - Conditional OTP",
-      "conditional-user-role",
-    );
-
-    masthead.checkNotificationMessage("Flow successfully updated");
-  });
-
-  it("Should add a sub-flow", () => {
-    const flowName = "SubFlow";
-    listingPage.goToItemDetails("Copy of browser");
-    detailPage.addSubFlow(
-      "Copy of browser Browser - Conditional OTP",
-      flowName,
-    );
-
-    masthead.checkNotificationMessage("Flow successfully updated");
-    detailPage.flowExists(flowName);
-  });
-
-  it("Should remove an execution", () => {
-    listingPage.goToItemDetails("Copy of browser");
-    detailPage.executionExists("Cookie").clickRowDelete("Cookie");
-    modalUtil.confirmModal();
-    detailPage.executionExists("Cookie", false);
-  });
-
-  it("Should set as default in action menu", () => {
-    const bindFlow = new BindFlowModal();
-    listingPage.clickRowDetails("Copy of browser").clickDetailMenu("Bind flow");
-    bindFlow.fill("Direct grant flow").save();
-    masthead.checkNotificationMessage("Flow successfully updated");
-  });
-
-  const flowName = "Empty Flow";
-
-  it("should create flow from scratch", () => {
-    listingPage.goToCreateItem();
-    detailPage.fillCreateForm(
-      flowName,
-      "Some nice description about what this flow does so that we can use it later",
-      "Client flow",
-    );
-    masthead.checkNotificationMessage("Flow created");
-    detailPage.addSubFlowToEmpty(flowName, "EmptySubFlow");
-
-    masthead.checkNotificationMessage("Flow successfully updated");
-
-    detailPage.flowExists(flowName);
-  });
-
-  it("Should delete a flow from action menu", () => {
-    listingPage.clickRowDetails(flowName).clickDetailMenu("Delete");
-    modalUtil.confirmModal();
-    masthead.checkNotificationMessage("Flow successfully deleted");
-  });
-
-  it("add webauthn authentication to browserflow", () => {
-    const flowName = "WebAuthn Browser";
-    listingPage.clickRowDetails("Browser").clickDetailMenu("Duplicate");
-    duplicateFlowModal.fill(flowName);
-
-    detailPage.clickRowDelete("WebAuthn Browser Browser - Conditional OTP");
-    modalUtil.confirmModal();
-
-    commonPage
-      .actionToolbarUtils()
-      .clickActionToggleButton()
-      .clickDropdownItem("Bind flow");
-
-    new BindFlowModal().fill("Direct grant flow").save();
-    masthead.checkNotificationMessage("Flow successfully updated");
-  });
-
-  it("Should display the default browser flow diagram", () => {
-    sidebarPage.goToRealm("master");
-    sidebarPage.goToAuthentication();
-    listingPage.goToItemDetails("browser");
-
-    detailPage.goToDiagram();
-
-    diagramView.exists();
-
-    diagramView.edgesExist([
-      { from: "Start", to: "Cookie" },
-      { from: "Cookie", to: "End" },
-      { from: "Cookie", to: "Identity Provider Redirector" },
-      { from: "Identity Provider Redirector", to: "End" },
-      { from: "Identity Provider Redirector", to: "Username Password Form" },
-      { from: "Username Password Form", to: "Condition - user configured" },
-      { from: "Condition - user configured", to: "OTP Form" },
-      { from: "Condition - user configured", to: "End" },
-      { from: "OTP Form", to: "End" },
-    ]);
-  });
-});
-
-describe("Required actions", () => {
-  const requiredActionsPage = new RequiredActions();
-
-  before(() => adminClient.createRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToAuthentication();
-    requiredActionsPage.goToTab();
-  });
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  it("should enable delete account", () => {
-    const action = "Delete Account";
-    requiredActionsPage.switchAction(action);
-    masthead.checkNotificationMessage("Updated required action successfully");
-    requiredActionsPage.isChecked(action);
-  });
-
-  it("should register an unregistered action", () => {
-    const action = "Verify Profile";
-    requiredActionsPage.isChecked(action).isDefaultEnabled(action);
-    requiredActionsPage.switchAction(action);
-    masthead.checkNotificationMessage("Updated required action successfully");
-    requiredActionsPage.switchAction(action);
-    masthead.checkNotificationMessage("Updated required action successfully");
-    requiredActionsPage.isChecked(action).isDefaultEnabled(action);
-  });
-
-  it("should set action as default", () => {
-    const action = "Configure OTP";
-    requiredActionsPage.setAsDefault(action);
-    masthead.checkNotificationMessage("Updated required action successfully");
-    requiredActionsPage.isDefaultChecked(action);
-  });
-
-  it("should reorder required actions", () => {
-    const action = "Terms and Conditions";
-    requiredActionsPage.moveRowTo(action, "Update Profile");
-    masthead.checkNotificationMessage("Updated required action successfully");
-  });
-});
-
-describe("Password policies tab", () => {
-  const passwordPoliciesPage = new PasswordPolicies();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToAuthentication();
-    passwordPoliciesPage.goToTab();
-  });
-
-  it("should add password policies", () => {
-    passwordPoliciesPage
-      .shouldShowEmptyState()
-      .addPolicy("Not Recently Used")
-      .save();
-    masthead.checkNotificationMessage("Password policies successfully updated");
-  });
-
-  it("should remove password policies", () => {
-    passwordPoliciesPage.removePolicy("remove-passwordHistory").save();
-    masthead.checkNotificationMessage("Password policies successfully updated");
-    passwordPoliciesPage.shouldShowEmptyState();
-  });
-});
-
-describe("Accessibility tests for authentication", () => {
-  const realmName = "a11y-realm";
-  const flowName = "SubFlow";
-  const requiredActionsPage = new RequiredActions();
-  const passwordPoliciesPage = new PasswordPolicies();
-  const otpPoliciesPage = new OTPPolicies();
-  const webAuthnPolicies = new WebAuthnPolicies();
-  const detailPage = new FlowDetails();
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToAuthentication();
-    cy.injectAxe();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ flows sub tab", () => {
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ flows sub tab/ creating flow form", () => {
-    listingPage.goToCreateItem();
-    cy.checkA11y();
-    cy.findByTestId("cancel").click();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ flows sub tab/ creating flow", () => {
-    listingPage.goToCreateItem();
-    detailPage.fillCreateForm(
-      flowName,
-      "Some nice description about what this flow does",
-      "Client flow",
-    );
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ flows sub tab/ creating flow form", () => {
-    listingPage.goToItemDetails("reset credentials");
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ required actions sub tab", () => {
-    requiredActionsPage.goToTab();
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ policies tab/ password policy sub tab", () => {
-    passwordPoliciesPage.goToTab();
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ authentication tab/ policies sub tab/ adding policy", () => {
-    passwordPoliciesPage.goToTab().addPolicy("Not Recently Used");
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ policies tab/ otp policy sub tab", () => {
-    otpPoliciesPage.goToTab();
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ policies tab/ WebAuthn Policies sub tab", () => {
-    webAuthnPolicies.goToTab();
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ policies tab/ WebAuthn Passwordless Policies sub tab", () => {
-    webAuthnPolicies.goToPasswordlessTab();
-    cy.checkA11y();
-  });
-
-  it("Check a11y violations on load/ policies tab/ CIBA Policy sub tab", () => {
-    CIBAPolicyPage.goToTab();
-    cy.checkA11y();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_advanced.spec.ts b/js/apps/admin-ui/cypress/e2e/client_advanced.spec.ts
deleted file mode 100644
index 4a954ab89ff0..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_advanced.spec.ts
+++ /dev/null
@@ -1,149 +0,0 @@
-import ClientDetailsPage from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-import AdvancedTab from "../support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedTab";
-import CreateClientPage from "../support/pages/admin-ui/manage/clients/CreateClientPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import CommonPage from "../support/pages/CommonPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const advancedTab = new AdvancedTab();
-const realmSettings = new RealmSettingsPage();
-const createClientPage = new CreateClientPage();
-const clientDetailsPage = new ClientDetailsPage();
-const commonPage = new CommonPage();
-const loginPage = new LoginPage();
-
-describe("Advanced tab test", () => {
-  const realmName = `clients-realm-${crypto.randomUUID()}`;
-  let client: string;
-
-  before(() => adminClient.createRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    commonPage.sidebar().goToRealm(realmName);
-    commonPage.sidebar().goToClients();
-    client = "client_" + crypto.randomUUID();
-    commonPage.tableToolbarUtils().createClient();
-    createClientPage
-      .selectClientType("OpenID Connect")
-      .fillClientData(client)
-      .continue();
-
-    commonPage.sidebar().waitForPageLoad();
-
-    createClientPage.continue().save();
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Client created successfully");
-    clientDetailsPage.goToAdvancedTab();
-  });
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  it("Clustering", () => {
-    advancedTab.expandClusterNode();
-
-    advancedTab.checkEmptyClusterNode();
-
-    advancedTab.registerNodeManually().fillHost("localhost").saveHost();
-    advancedTab.checkTestClusterAvailability(true);
-    commonPage.masthead().checkNotificationMessage("Node successfully added");
-    advancedTab.deleteClusterNode();
-    commonPage.modalUtils().confirmModal();
-    commonPage.masthead().checkNotificationMessage("Node successfully removed");
-    advancedTab.checkEmptyClusterNode();
-  });
-
-  it("Fine grain OpenID connect configuration", () => {
-    const algorithm = "ES384";
-    advancedTab.selectAccessTokenSignatureAlgorithm(algorithm).saveFineGrain();
-
-    advancedTab.selectAccessTokenSignatureAlgorithm("HS384").revertFineGrain();
-    advancedTab.checkAccessTokenSignatureAlgorithm(algorithm);
-  });
-
-  it("OIDC Compatibility Modes configuration", () => {
-    advancedTab.clickAllCompatibilitySwitch();
-    advancedTab.saveCompatibility();
-    advancedTab.jumpToCompatability();
-    advancedTab.clickExcludeSessionStateSwitch();
-    advancedTab.clickUseRefreshTokenForClientCredentialsGrantSwitch();
-    advancedTab.revertCompatibility();
-  });
-
-  it("Client Offline Session Max", () => {
-    configureOfflineSessionMaxInRealmSettings(true);
-
-    cy.findByTestId("token-lifespan-clientOfflineSessionMax").should("exist");
-
-    configureOfflineSessionMaxInRealmSettings(false);
-
-    cy.findByTestId("token-lifespan-clientOfflineSessionMax").should(
-      "not.exist",
-    );
-
-    function configureOfflineSessionMaxInRealmSettings(enabled: boolean) {
-      commonPage.sidebar().goToRealmSettings();
-      realmSettings.goToSessionsTab();
-      realmSettings.setOfflineSessionMaxSwitch(enabled);
-      realmSettings.saveSessions();
-
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().searchItem(client);
-      commonPage.tableUtils().clickRowItemLink(client);
-      clientDetailsPage.goToAdvancedTab();
-    }
-  });
-
-  it("Advanced settings", () => {
-    advancedTab.jumpToAdvanced();
-
-    advancedTab.clickAdvancedSwitches();
-    advancedTab.jumpToAdvanced();
-    advancedTab.selectKeyForCodeExchangeInput("S256");
-
-    advancedTab.saveAdvanced();
-    advancedTab.jumpToAdvanced();
-    advancedTab.checkAdvancedSwitchesOn();
-    advancedTab.checkKeyForCodeExchangeInput("S256");
-
-    advancedTab.selectKeyForCodeExchangeInput("plain");
-    advancedTab.checkKeyForCodeExchangeInput("plain");
-
-    advancedTab.jumpToAdvanced();
-    advancedTab.clickAdvancedSwitches();
-
-    advancedTab.revertAdvanced();
-    advancedTab.jumpToAdvanced();
-    advancedTab.checkKeyForCodeExchangeInput("S256");
-    //uncomment when revert button reverts all switches
-    //and ACR to LoA Mapping + Default ACR Values
-    //advancedTab.checkAdvancedSwitchesOn();
-  });
-
-  it("Authentication flow override", () => {
-    advancedTab.jumpToAuthFlow();
-    advancedTab.selectBrowserFlowInput("browser");
-    advancedTab.selectDirectGrantInput("docker auth");
-    advancedTab.checkBrowserFlowInput("browser");
-    advancedTab.checkDirectGrantInput("docker auth");
-
-    advancedTab.revertAuthFlowOverride();
-    advancedTab.jumpToAuthFlow();
-    advancedTab.checkBrowserFlowInput("Choose...");
-    advancedTab.checkDirectGrantInput("Choose...");
-    advancedTab.selectBrowserFlowInput("browser");
-    advancedTab.selectDirectGrantInput("docker auth");
-
-    advancedTab.saveAuthFlowOverride();
-    advancedTab.selectBrowserFlowInput("first broker login");
-    advancedTab.selectDirectGrantInput("first broker login");
-    advancedTab.revertAuthFlowOverride();
-    //revert doesn't work after saving.
-    //advancedTab.CheckBrowserFlowInput("browser");
-    //advancedTab.CheckDirectGrantInput("docker auth");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_authorization_test.spec.ts b/js/apps/admin-ui/cypress/e2e/client_authorization_test.spec.ts
deleted file mode 100644
index f9aa30eea09a..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_authorization_test.spec.ts
+++ /dev/null
@@ -1,285 +0,0 @@
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-import LoginPage from "../support/pages/LoginPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import AuthorizationTab from "../support/pages/admin-ui/manage/clients/client_details/tabs/AuthorizationTab";
-import ModalUtils from "../support/util/ModalUtils";
-import ClientDetailsPage from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-import PoliciesTab from "../support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PoliciesTab";
-import PermissionsTab from "../support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PermissionsTab";
-import CreateResourcePage from "../support/pages/admin-ui/manage/clients/client_details/CreateResourcePage";
-
-describe("Client authentication subtab", () => {
-  const loginPage = new LoginPage();
-  const listingPage = new ListingPage();
-  const masthead = new Masthead();
-  const sidebarPage = new SidebarPage();
-  const authenticationTab = new AuthorizationTab();
-  const clientDetailsPage = new ClientDetailsPage();
-  const policiesSubTab = new PoliciesTab();
-  const permissionsSubTab = new PermissionsTab();
-  const clientId = "client-authentication-" + crypto.randomUUID();
-
-  before(() =>
-    adminClient.createClient({
-      protocol: "openid-connect",
-      clientId,
-      publicClient: false,
-      authorizationServicesEnabled: true,
-      serviceAccountsEnabled: true,
-      standardFlowEnabled: true,
-    }),
-  );
-
-  after(() => {
-    adminClient.deleteClient(clientId);
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToClients();
-    listingPage.searchItem(clientId).goToItemDetails(clientId);
-    clientDetailsPage.goToAuthorizationTab();
-  });
-
-  it("Should update the resource server settings", () => {
-    policiesSubTab.setPolicy("DISABLED").formUtils().save();
-    masthead.checkNotificationMessage("Resource successfully updated", true);
-  });
-
-  it("Should create a resource", () => {
-    const resourcesSubtab = authenticationTab.goToResourcesSubTab();
-    listingPage.assertDefaultResource();
-    resourcesSubtab
-      .createResource()
-      .fillResourceForm({
-        name: "Resource",
-        displayName: "The display name",
-        type: "type",
-        uris: ["one", "two"],
-      })
-      .formUtils()
-      .save();
-    masthead.checkNotificationMessage("Resource created successfully", true);
-    sidebarPage.waitForPageLoad();
-    authenticationTab.formUtils().cancel();
-  });
-
-  it("Edit a resource", () => {
-    authenticationTab.goToResourcesSubTab();
-    listingPage.goToItemDetails("Resource");
-
-    new CreateResourcePage()
-      .fillResourceForm({
-        displayName: "updated",
-      })
-      .formUtils()
-      .save();
-
-    masthead.checkNotificationMessage("Resource successfully updated");
-    sidebarPage.waitForPageLoad();
-    authenticationTab.formUtils().cancel();
-  });
-
-  it("Should create a scope", () => {
-    authenticationTab
-      .goToScopesSubTab()
-      .createAuthorizationScope()
-      .fillScopeForm({
-        name: "The scope",
-        displayName: "Display something",
-        iconUri: "res://something",
-      })
-      .formUtils()
-      .save();
-
-    masthead.checkNotificationMessage(
-      "Authorization scope created successfully",
-      true,
-    );
-    authenticationTab.goToScopesSubTab();
-    listingPage.itemExist("The scope");
-  });
-
-  it("Should create a policy", () => {
-    authenticationTab.goToPoliciesSubTab();
-    cy.intercept(
-      "GET",
-      "/admin/realms/master/clients/*/authz/resource-server/policy/regex/*",
-    ).as("get");
-    policiesSubTab
-      .createPolicy("regex")
-      .fillBasePolicyForm({
-        name: "Regex policy",
-        description: "Policy for regex",
-        targetClaim: "I don't know",
-        pattern: ".*?",
-      })
-      .formUtils()
-      .save();
-
-    cy.wait(["@get"]);
-    masthead.checkNotificationMessage("Successfully created the policy", true);
-
-    sidebarPage.waitForPageLoad();
-    authenticationTab.formUtils().cancel();
-  });
-
-  it("Should delete a policy", () => {
-    authenticationTab.goToPoliciesSubTab();
-    listingPage.deleteItem("Regex policy");
-    new ModalUtils().confirmModal();
-
-    masthead.checkNotificationMessage("The Policy successfully deleted", true);
-  });
-
-  it("Should create a client policy", () => {
-    authenticationTab.goToPoliciesSubTab();
-    cy.intercept(
-      "GET",
-      "/admin/realms/master/clients/*/authz/resource-server/policy/client/*",
-    ).as("get");
-    policiesSubTab
-      .createPolicy("client")
-      .fillBasePolicyForm({
-        name: "Client policy",
-        description: "Extra client field",
-      })
-      .inputClient("master-realm")
-      .formUtils()
-      .save();
-    cy.wait(["@get"]);
-    masthead.checkNotificationMessage("Successfully created the policy", true);
-
-    sidebarPage.waitForPageLoad();
-    authenticationTab.formUtils().cancel();
-  });
-
-  it("Should create a permission", () => {
-    authenticationTab.goToPermissionsSubTab();
-
-    permissionsSubTab.createPermission("resource").fillPermissionForm({
-      name: "Permission name",
-      description: "Something describing this permission",
-    });
-    permissionsSubTab.selectResource("Default Resource").formUtils().save();
-    cy.intercept(
-      "/admin/realms/master/clients/*/authz/resource-server/resource?first=0&max=10&permission=false",
-    ).as("load");
-    masthead.checkNotificationMessage(
-      "Successfully created the permission",
-      true,
-    );
-    authenticationTab.formUtils().cancel();
-  });
-
-  it.skip("Should copy auth details", () => {
-    const exportTab = authenticationTab.goToExportSubTab();
-    sidebarPage.waitForPageLoad();
-    exportTab.copy();
-    masthead.checkNotificationMessage("Authorization details copied.", true);
-  });
-
-  it("Should export auth details", () => {
-    const exportTab = authenticationTab.goToExportSubTab();
-    sidebarPage.waitForPageLoad();
-    exportTab.export();
-
-    masthead.checkNotificationMessage(
-      "Successfully exported authorization details.",
-      true,
-    );
-  });
-
-  describe("Client authorization tab access for view-realm-authorization", () => {
-    const clientId = "realm-view-authz-client-" + crypto.randomUUID();
-
-    beforeEach(async () => {
-      const [, testUser] = await Promise.all([
-        adminClient.createRealm("realm-view-authz"),
-        adminClient.createUser({
-          // Create user in master realm
-          username: "test-view-authz-user",
-          enabled: true,
-          credentials: [{ type: "password", value: "password" }],
-        }),
-      ]);
-
-      await Promise.all([
-        adminClient.addClientRoleToUser(
-          testUser.id!,
-          "realm-view-authz-realm",
-          ["view-realm", "view-users", "view-authorization", "view-clients"],
-        ),
-        adminClient.createClient({
-          realm: "realm-view-authz",
-          clientId,
-          authorizationServicesEnabled: true,
-          serviceAccountsEnabled: true,
-          standardFlowEnabled: true,
-        }),
-      ]);
-    });
-
-    after(() =>
-      Promise.all([
-        adminClient.deleteClient(clientId),
-        adminClient.deleteUser("test-view-authz-user"),
-        adminClient.deleteRealm("realm-view-authz"),
-      ]),
-    );
-
-    it("Should view autorization tab", () => {
-      sidebarPage.waitForPageLoad();
-      masthead.signOut();
-
-      sidebarPage.waitForPageLoad();
-      loginPage.logIn("test-view-authz-user", "password");
-      keycloakBefore();
-
-      sidebarPage.waitForPageLoad().goToRealm("realm-view-authz");
-
-      cy.reload();
-
-      sidebarPage.waitForPageLoad().goToClients();
-
-      listingPage
-        .searchItem(clientId, true, "realm-view-authz")
-        .goToItemDetails(clientId);
-      clientDetailsPage.goToAuthorizationTab();
-
-      authenticationTab.goToResourcesSubTab();
-      sidebarPage.waitForPageLoad();
-      listingPage.goToItemDetails("Resource");
-      sidebarPage.waitForPageLoad();
-      cy.go("back");
-
-      authenticationTab.goToScopesSubTab();
-      sidebarPage.waitForPageLoad();
-      authenticationTab.goToPoliciesSubTab();
-      sidebarPage.waitForPageLoad();
-      authenticationTab.goToPermissionsSubTab();
-      sidebarPage.waitForPageLoad();
-      authenticationTab.goToEvaluateSubTab();
-      sidebarPage.waitForPageLoad();
-    });
-  });
-
-  describe("Accessibility tests for client authorization", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClients();
-      listingPage.searchItem(clientId).goToItemDetails(clientId);
-      clientDetailsPage.goToAuthorizationTab();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ client authorization", () => {
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_initial_access.spec.ts b/js/apps/admin-ui/cypress/e2e/client_initial_access.spec.ts
deleted file mode 100644
index c14288c415e8..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_initial_access.spec.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import InitialAccessTokenTab from "../support/pages/admin-ui/manage/clients/tabs/InitialAccessTokenTab";
-import CommonPage from "../support/pages/CommonPage";
-import LoginPage from "../support/pages/LoginPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const commonPage = new CommonPage();
-const loginPage = new LoginPage();
-
-describe("Client initial access tokens", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    commonPage.sidebar().goToClients();
-  });
-
-  it("Initial access token can't be created with 0 days and count", () => {
-    const initialAccessTokenTab = new InitialAccessTokenTab();
-    initialAccessTokenTab
-      .goToInitialAccessTokenTab()
-      .shouldBeEmpty()
-      .goToCreateFromEmptyList()
-      .fillNewTokenData(0, 0)
-      .checkExpirationGreaterThanZeroError()
-      .checkCountValue(1)
-      .checkSaveButtonIsDisabled();
-  });
-
-  it("Initial access token", () => {
-    const initialAccessTokenTab = new InitialAccessTokenTab();
-    initialAccessTokenTab
-      .goToInitialAccessTokenTab()
-      .shouldBeEmpty()
-      .goToCreateFromEmptyList()
-      .fillNewTokenData(1, 3)
-      .save();
-
-    commonPage
-      .modalUtils()
-      .checkModalTitle("Initial access token details")
-      .closeModal();
-
-    commonPage
-      .masthead()
-      .checkNotificationMessage("New initial access token has been created");
-
-    initialAccessTokenTab.shouldNotBeEmpty();
-
-    commonPage.tableToolbarUtils().searchItem("John Doe", false);
-    commonPage.emptyState().checkIfExists(true);
-    commonPage.tableToolbarUtils().searchItem("", false);
-
-    initialAccessTokenTab.getFirstId((id) => {
-      commonPage
-        .tableUtils()
-        .checkRowItemValueByItemName(id, 4, "4")
-        .checkRowItemValueByItemName(id, 5, "4")
-        .checkRowItemExists(id);
-    });
-
-    commonPage.tableToolbarUtils().clickPrimaryButton("Create");
-    initialAccessTokenTab.fillNewTokenData(1, 3).save();
-
-    commonPage.modalUtils().closeModal();
-
-    initialAccessTokenTab.getFirstId((id) => {
-      commonPage.tableUtils().selectRowItemAction(id, "Delete");
-      commonPage.sidebar().waitForPageLoad();
-      commonPage
-        .modalUtils()
-        .checkModalTitle("Delete initial access token?")
-        .confirmModal();
-    });
-
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Initial access token deleted successfully");
-    initialAccessTokenTab.shouldNotBeEmpty();
-
-    initialAccessTokenTab.getFirstId((id) => {
-      commonPage.tableUtils().selectRowItemAction(id, "Delete");
-      commonPage.sidebar().waitForPageLoad();
-      commonPage.modalUtils().confirmModal();
-    });
-    initialAccessTokenTab.shouldBeEmpty();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_registration_policies.spec.ts b/js/apps/admin-ui/cypress/e2e/client_registration_policies.spec.ts
deleted file mode 100644
index 6adbf2199ddf..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_registration_policies.spec.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import { ClientRegistrationPage } from "../support/pages/admin-ui/manage/clients/ClientRegistrationPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const listingPage = new ListingPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const clientRegistrationPage = new ClientRegistrationPage();
-
-describe("Client registration policies tab", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToClients();
-    clientRegistrationPage.goToClientRegistrationTab();
-    sidebarPage.waitForPageLoad();
-  });
-
-  describe("Anonymous client policies subtab", () => {
-    it("check anonymous clients list is not empty", () => {
-      cy.findByTestId("clientRegistration-anonymous")
-        .find("tr")
-        .should("have.length.gt", 0);
-    });
-
-    it("add anonymous client registration policy", () => {
-      clientRegistrationPage
-        .createAnonymousPolicy()
-        .selectRow("max-clients")
-        .fillPolicyForm({
-          name: "newAnonymPolicy1",
-        })
-        .formUtils()
-        .save();
-
-      masthead.checkNotificationMessage(
-        "New client policy created successfully",
-      );
-      clientRegistrationPage.formUtils().cancel();
-      listingPage.itemExist("newAnonymPolicy1");
-    });
-
-    it("edit anonymous client registration policy", () => {
-      const policy = "newAnonymPolicy1";
-      clientRegistrationPage.findAndSelectInAnonymousPoliciesTable(policy);
-      cy.findByTestId("name").clear();
-      clientRegistrationPage
-        .fillPolicyForm({
-          name: "policy2",
-        })
-        .formUtils()
-        .save();
-
-      masthead.checkNotificationMessage("Client policy updated successfully");
-      clientRegistrationPage.formUtils().cancel();
-      listingPage.itemExist("policy2");
-    });
-
-    it("delete anonymous client registration policy", () => {
-      const policy = "policy2";
-      listingPage.deleteItem(policy);
-      cy.findByTestId("confirm").click();
-
-      masthead.checkNotificationMessage(
-        "Client registration policy deleted successfully",
-      );
-    });
-  });
-
-  describe("Authenticated client policies subtab", () => {
-    beforeEach(() => {
-      clientRegistrationPage.goToAuthenticatedSubTab();
-      sidebarPage.waitForPageLoad();
-    });
-
-    it("check authenticated clients list is not empty", () => {
-      cy.findByTestId("clientRegistration-authenticated")
-        .find("tr")
-        .should("have.length.gt", 0);
-    });
-
-    it("add authenticated client registration policy", () => {
-      clientRegistrationPage
-        .createAuthenticatedPolicy()
-        .selectRow("scope")
-        .fillPolicyForm({
-          name: "newAuthPolicy1",
-        })
-        .formUtils()
-        .save();
-
-      masthead.checkNotificationMessage(
-        "New client policy created successfully",
-      );
-      clientRegistrationPage.formUtils().cancel();
-      listingPage.itemExist("newAuthPolicy1");
-    });
-
-    it("edit authenticated client registration policy", () => {
-      const policy = "newAuthPolicy1";
-      clientRegistrationPage.findAndSelectInAuthenticatedPoliciesTable(policy);
-      cy.findByTestId("name").clear();
-      clientRegistrationPage
-        .fillPolicyForm({
-          name: "policy3",
-        })
-        .formUtils()
-        .save();
-
-      masthead.checkNotificationMessage("Client policy updated successfully");
-      clientRegistrationPage.formUtils().cancel();
-      listingPage.itemExist("policy3");
-    });
-
-    it("delete authenticated client registration policy", () => {
-      const policy = "policy3";
-      listingPage.deleteItem(policy);
-      cy.findByTestId("confirm").click();
-
-      masthead.checkNotificationMessage(
-        "Client registration policy deleted successfully",
-      );
-    });
-  });
-});
-
-describe("Accessibility tests for client registration policies", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToClients();
-    clientRegistrationPage.goToClientRegistrationTab();
-    sidebarPage.waitForPageLoad();
-    cy.injectAxe();
-  });
-
-  it("Check a11y violations on load/ client registration policies", () => {
-    cy.checkA11y();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_scope.spec.ts b/js/apps/admin-ui/cypress/e2e/client_scope.spec.ts
deleted file mode 100644
index 26a4ec042fd9..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_scope.spec.ts
+++ /dev/null
@@ -1,309 +0,0 @@
-import ListingPage, {
-  Filter,
-  FilterAssignedType,
-} from "../support/pages/admin-ui/ListingPage";
-import ClientDetailsPage from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-import CommonPage from "../support/pages/CommonPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const clientDetailsPage = new ClientDetailsPage();
-const commonPage = new CommonPage();
-const listingPage = new ListingPage();
-
-describe("Client details - Client scopes subtab", () => {
-  const clientId = "client-scopes-subtab-test";
-  const clientScopeName = "client-scope-test";
-  const clientScopeNameDefaultType = "client-scope-test-default-type";
-  const clientScopeNameOptionalType = "client-scope-test-optional-type";
-  const clientScope = {
-    name: clientScopeName,
-    description: "",
-    protocol: "openid-connect",
-    attributes: {
-      "include.in.token.scope": "true",
-      "display.on.consent.screen": "true",
-      "gui.order": "1",
-      "consent.screen.text": "",
-    },
-  };
-  const msgScopeMappingRemoved = "Scope mapping successfully removed";
-
-  const realmName = `clients-realm-${crypto.randomUUID()}`;
-
-  before(async () => {
-    await adminClient.createRealm(realmName);
-    await adminClient.inRealm(realmName, () =>
-      adminClient.createClient({
-        clientId,
-        protocol: "openid-connect",
-        publicClient: false,
-      }),
-    );
-    for (let i = 0; i < 5; i++) {
-      clientScope.name = clientScopeName + i;
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createClientScope(clientScope),
-      );
-      await adminClient.inRealm(realmName, () =>
-        adminClient.addDefaultClientScopeInClient(
-          clientScopeName + i,
-          clientId,
-        ),
-      );
-    }
-    clientScope.name = clientScopeNameDefaultType;
-    await adminClient.inRealm(realmName, () =>
-      adminClient.createClientScope(clientScope),
-    );
-    clientScope.name = clientScopeNameOptionalType;
-    await adminClient.inRealm(realmName, () =>
-      adminClient.createClientScope(clientScope),
-    );
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    commonPage.sidebar().goToRealm(realmName);
-    commonPage.sidebar().goToClients();
-    commonPage.tableToolbarUtils().searchItem(clientId);
-    cy.intercept(`/admin/realms/${realmName}/clients/*`).as("fetchClient");
-    commonPage.tableUtils().clickRowItemLink(clientId);
-    cy.wait("@fetchClient");
-    clientDetailsPage.goToClientScopesTab();
-  });
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  it("Should list client scopes", () => {
-    commonPage
-      .tableUtils()
-      .checkRowItemsGreaterThan(1)
-      .checkRowItemExists(clientScopeName + 0);
-  });
-
-  it("Should search existing client scope by name", () => {
-    commonPage.tableToolbarUtils().searchItem(clientScopeName + 0, false);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(clientScopeName + 0)
-      .checkRowItemsEqualTo(1);
-  });
-
-  it("Should search non-existent client scope by name", () => {
-    commonPage.tableToolbarUtils().searchItem("non-existent-item", false);
-    commonPage.tableUtils().checkIfExists(false);
-    commonPage.emptyState().checkIfExists(true);
-  });
-
-  it("Should search existing client scope by assigned type", () => {
-    commonPage
-      .tableToolbarUtils()
-      .selectSearchType(Filter.Name, Filter.AssignedType)
-      .selectSecondarySearchType(FilterAssignedType.Default);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(FilterAssignedType.Default)
-      .checkRowItemExists(FilterAssignedType.Optional, false);
-    commonPage
-      .tableToolbarUtils()
-      .selectSecondarySearchType(FilterAssignedType.Optional);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(FilterAssignedType.Default, false)
-      .checkRowItemExists(FilterAssignedType.Optional);
-    commonPage
-      .tableToolbarUtils()
-      .selectSecondarySearchType(FilterAssignedType.AllTypes);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(FilterAssignedType.Default)
-      .checkRowItemExists(FilterAssignedType.Optional);
-  });
-
-  const newItemsWithExpectedAssignedTypes = [
-    [clientScopeNameOptionalType, FilterAssignedType.Optional],
-    [clientScopeNameDefaultType, FilterAssignedType.Default],
-  ];
-  newItemsWithExpectedAssignedTypes.forEach(($type) => {
-    const [itemName, assignedType] = $type;
-    it(`Should add client scope ${itemName} with ${assignedType} assigned type`, () => {
-      commonPage.tableToolbarUtils().addClientScope();
-      commonPage
-        .modalUtils()
-        .checkModalTitle("Add client scopes to " + clientId);
-      commonPage.tableUtils().selectRowItemCheckbox(itemName);
-      commonPage.modalUtils().confirmModalWithItem(assignedType);
-      commonPage.masthead().checkNotificationMessage("Scope mapping updated");
-      commonPage.tableToolbarUtils().searchItem(itemName, false);
-      commonPage
-        .tableUtils()
-        .checkRowItemExists(itemName)
-        .checkRowItemExists(assignedType);
-    });
-  });
-
-  const expectedItemAssignedTypes = [
-    FilterAssignedType.Optional,
-    FilterAssignedType.Default,
-  ];
-  expectedItemAssignedTypes.forEach(($assignedType) => {
-    const itemName = clientScopeName + 0;
-    it(`Should change item ${itemName} AssignedType to ${$assignedType} from search bar`, () => {
-      commonPage.tableToolbarUtils().searchItem(itemName, false);
-      commonPage.tableUtils().selectRowItemCheckbox(itemName);
-      commonPage.tableToolbarUtils().changeTypeTo($assignedType);
-      commonPage.masthead().checkNotificationMessage("Scope mapping updated");
-      commonPage.tableToolbarUtils().searchItem(itemName, false);
-      commonPage.tableUtils().checkRowItemExists($assignedType);
-    });
-  });
-
-  it("Should show items on next page are more than 11", () => {
-    commonPage.sidebar().waitForPageLoad();
-    commonPage.tableToolbarUtils().clickNextPageButton();
-    commonPage.tableUtils().checkRowItemsGreaterThan(1);
-  });
-
-  it("Should remove client scope from item bar", () => {
-    const itemName = clientScopeName + 0;
-    commonPage.tableToolbarUtils().searchItem(itemName, false);
-    commonPage.tableUtils().selectRowItemAction(itemName, "Remove");
-    commonPage.modalUtils().confirmModal();
-    commonPage.masthead().checkNotificationMessage(msgScopeMappingRemoved);
-    commonPage.tableToolbarUtils().searchItem(itemName, false);
-    listingPage.assertNoResults();
-  });
-
-  it("Should remove multiple client scopes from search bar", () => {
-    const itemName1 = clientScopeName + 1;
-    const itemName2 = clientScopeName + 2;
-    cy.intercept(`/admin/realms/${realmName}/client-scopes`).as("load");
-    commonPage.tableToolbarUtils().clickSearchButton();
-    cy.wait("@load");
-    cy.wait(1000);
-    commonPage.tableToolbarUtils().checkActionItemIsEnabled("Remove", false);
-    commonPage.tableToolbarUtils().searchItem(clientScopeName, false);
-    commonPage
-      .tableUtils()
-      .selectRowItemCheckbox(itemName1)
-      .selectRowItemCheckbox(itemName2);
-    cy.intercept(`/admin/realms/${realmName}/client-scopes`).as("load");
-    commonPage.tableToolbarUtils().clickSearchButton();
-    cy.wait("@load");
-    cy.wait(1000);
-    commonPage.tableToolbarUtils().clickActionItem("Remove");
-    commonPage.masthead().checkNotificationMessage(msgScopeMappingRemoved);
-    commonPage.tableToolbarUtils().searchItem(clientScopeName, false);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(itemName1, false)
-      .checkRowItemExists(itemName2, false);
-    commonPage.tableToolbarUtils().clickSearchButton();
-  });
-
-  it("Should show initial items after filtering", () => {
-    commonPage
-      .tableToolbarUtils()
-      .selectSearchType(Filter.Name, Filter.AssignedType)
-      .selectSecondarySearchType(FilterAssignedType.Optional)
-      .selectSearchType(Filter.AssignedType, Filter.Name);
-    commonPage
-      .tableUtils()
-      .checkRowItemExists(FilterAssignedType.Default, false)
-      .checkRowItemExists(FilterAssignedType.Optional);
-  });
-
-  describe("Client scopes evaluate subtab", () => {
-    const clientName = "testClient";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-    });
-
-    before(async () => {
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createClient({
-          protocol: "openid-connect",
-          clientId: clientName,
-          publicClient: false,
-        }),
-      );
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createUser({
-          username: "admin-a",
-          enabled: true,
-        }),
-      );
-    });
-
-    after(async () => {
-      await adminClient.inRealm(realmName, () =>
-        adminClient.deleteClient(clientName),
-      );
-    });
-
-    it("check effective protocol mappers list is not empty and find effective protocol mapper locale", () => {
-      commonPage.tableToolbarUtils().searchItem(clientName);
-      commonPage.tableUtils().clickRowItemLink(clientName);
-
-      clientDetailsPage.goToClientScopesEvaluateTab();
-
-      cy.findByTestId("effective-protocol-mappers")
-        .find("tr")
-        .should("have.length.gt", 0);
-    });
-
-    it("check role scope mappings list list is not empty and find role scope mapping admin", () => {
-      commonPage.tableToolbarUtils().searchItem(clientName);
-      commonPage.tableUtils().clickRowItemLink(clientName);
-
-      clientDetailsPage.goToClientScopesEvaluateTab();
-      clientDetailsPage.goToClientScopesEvaluateEffectiveRoleScopeMappingsTab();
-
-      cy.findByTestId("effective-role-scope-mappings")
-        .find("tr")
-        .should("have.length.gt", 0);
-    });
-
-    it("check generated id token and user info", () => {
-      commonPage.tableToolbarUtils().searchItem(clientName);
-      commonPage.tableUtils().clickRowItemLink(clientName);
-
-      clientDetailsPage.goToClientScopesEvaluateTab();
-      cy.get("div#generatedAccessToken").contains("No generated access token");
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedIdTokenTab();
-      cy.get("div#generatedIdToken").contains("No generated id token");
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedUserInfoTab();
-      cy.get("div#generatedUserInfo").contains("No generated user info");
-
-      cy.get("[data-testid='user'] input").type("admin-a");
-      cy.get(".pf-v5-c-menu__item-text").click();
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedAccessTokenTab();
-      cy.get("div#generatedAccessToken").contains(
-        '"preferred_username": "admin-a"',
-      );
-      cy.get("div#generatedAccessToken").contains('"scope": "');
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedIdTokenTab();
-      cy.get("div#generatedIdToken").contains(
-        '"preferred_username": "admin-a"',
-      );
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedUserInfoTab();
-      cy.get("div#generatedIdToken").contains(
-        '"preferred_username": "admin-a"',
-      );
-      cy.get("div#generatedIdToken").contains('"sid"');
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/client_scopes_test.spec.ts b/js/apps/admin-ui/cypress/e2e/client_scopes_test.spec.ts
deleted file mode 100644
index f28f49c617b2..000000000000
--- a/js/apps/admin-ui/cypress/e2e/client_scopes_test.spec.ts
+++ /dev/null
@@ -1,493 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ListingPage, {
-  Filter,
-  FilterAssignedType,
-  FilterProtocol,
-} from "../support/pages/admin-ui/ListingPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import CreateClientScopePage from "../support/pages/admin-ui/manage/client_scopes/CreateClientScopePage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import RoleMappingTab from "../support/pages/admin-ui/manage/RoleMappingTab";
-import ModalUtils from "../support/util/ModalUtils";
-import adminClient from "../support/util/AdminClient";
-import ClientScopeDetailsPage from "../support/pages/admin-ui/manage/client_scopes/client_scope_details/ClientScopeDetailsPage";
-import CommonPage from "../support/pages/CommonPage";
-import MappersTab from "../support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/MappersTab";
-import MapperDetailsPage, {
-  ClaimJsonType,
-} from "../support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/mappers/MapperDetailsPage";
-import DedicatedScopesMappersTab from "../support/pages/admin-ui/manage/clients/client_details/DedicatedScopesMappersTab";
-import ClientDetailsPage from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-
-let itemId = "client_scope_crud";
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-
-const commonPage = new CommonPage();
-const listingPage = new ListingPage();
-const createClientScopePage = new CreateClientScopePage();
-const modalUtils = new ModalUtils();
-const dedicatedScopesMappersTab = new DedicatedScopesMappersTab();
-const clientDetailsPage = new ClientDetailsPage();
-
-describe("Client Scopes test", () => {
-  const modalMessageDeleteConfirmation =
-    "Are you sure you want to delete this client scope";
-  const notificationMessageDeletionConfirmation =
-    "The client scope has been deleted";
-  const clientScopeName = "client-scope-test";
-  const openIDConnectItemText = "OpenID Connect";
-  const clientScope = {
-    name: clientScopeName,
-    description: "",
-    protocol: "openid-connect",
-    attributes: {
-      "include.in.token.scope": "true",
-      "display.on.consent.screen": "true",
-      "gui.order": "1",
-      "consent.screen.text": "",
-    },
-  };
-
-  before(async () => {
-    for (let i = 0; i < 5; i++) {
-      clientScope.name = clientScopeName + i;
-      await adminClient.createClientScope(clientScope);
-    }
-  });
-
-  after(async () => {
-    for (let i = 0; i < 5; i++) {
-      if (await adminClient.existsClientScope(clientScopeName + i)) {
-        await adminClient.deleteClientScope(clientScopeName + i);
-      }
-    }
-  });
-
-  describe("Client Scope filter list items", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("should filter item by name", () => {
-      const itemName = clientScopeName + 0;
-
-      listingPage
-        .checkEmptySearch()
-        .searchItem(itemName, false)
-        .itemsEqualTo(1)
-        .itemExist(itemName, true);
-    });
-
-    it("should filter items by Assigned type All types", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.AssignedType)
-        .selectSecondaryFilterAssignedType(FilterAssignedType.AllTypes)
-        .itemExist(FilterAssignedType.Default, true)
-        .itemExist(FilterAssignedType.Optional, true)
-        .itemExist(FilterAssignedType.None, true);
-    });
-
-    it("should filter items by Assigned type Default", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.AssignedType)
-        .selectSecondaryFilterAssignedType(FilterAssignedType.Default)
-        .itemExist(FilterAssignedType.Default, true)
-        .itemExist(FilterAssignedType.Optional, false)
-        .itemExist(FilterAssignedType.None, false);
-    });
-
-    it("should filter items by Assigned type Optional", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.AssignedType)
-        .selectSecondaryFilterAssignedType(FilterAssignedType.Optional)
-        .itemExist(FilterAssignedType.Default, false)
-        .itemExist(FilterAssignedType.Optional, true)
-        .itemExist(FilterAssignedType.None, false);
-    });
-
-    it("should filter items by Protocol All", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.Protocol)
-        .selectSecondaryFilterProtocol(FilterProtocol.All);
-      sidebarPage.waitForPageLoad();
-      listingPage
-        .showNextPageTableItems()
-        .itemExist(FilterProtocol.SAML, true)
-        .itemExist(openIDConnectItemText, true); //using FilterProtocol.OpenID will fail, text does not match.
-    });
-
-    it("should filter items by Protocol SAML", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.Protocol)
-        .selectSecondaryFilterProtocol(FilterProtocol.SAML)
-        .itemExist(FilterProtocol.SAML, true)
-        .itemExist(openIDConnectItemText, false); //using FilterProtocol.OpenID will fail, text does not match.
-    });
-
-    it("should filter items by Protocol OpenID", () => {
-      listingPage
-        .selectClientScopeFilter(Filter.Protocol)
-        .selectSecondaryFilterProtocol(FilterProtocol.OpenID)
-        .itemExist(FilterProtocol.SAML, false)
-        .itemExist(openIDConnectItemText, true); //using FilterProtocol.OpenID will fail, text does not match.
-    });
-
-    it("should show items on next page are more than 11", () => {
-      listingPage.showNextPageTableItems();
-      listingPage.itemsGreaterThan(1);
-    });
-  });
-
-  describe("Client Scope modify list items", () => {
-    const itemName = clientScopeName + 0;
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("should modify selected item type to Default from search bar", () => {
-      listingPage
-        .clickItemCheckbox(itemName)
-        .changeTypeToOfSelectedItems(FilterAssignedType.Default);
-      listingPage.itemContainValue(itemName, 2, FilterAssignedType.Default);
-    });
-
-    it("should modify selected item type to Optional from search bar", () => {
-      listingPage
-        .clickItemCheckbox(itemName)
-        .changeTypeToOfSelectedItems(FilterAssignedType.Optional);
-      listingPage.itemContainValue(itemName, 2, FilterAssignedType.Optional);
-    });
-
-    const expectedItemAssignedTypes = [
-      FilterAssignedType.Default,
-      FilterAssignedType.Optional,
-      FilterAssignedType.None,
-    ];
-    expectedItemAssignedTypes.forEach(($assignedType) => {
-      const itemName = clientScopeName + 0;
-      it(`should modify item ${itemName} AssignedType to ${$assignedType} from item bar`, () => {
-        listingPage
-          .searchItem(clientScopeName, false)
-          .clickRowSelectItem(itemName, $assignedType);
-        cy.wait(2000);
-        listingPage.searchItem(itemName, false).itemExist($assignedType);
-      });
-    });
-
-    it("should not allow to modify item AssignedType from search bar when no item selected", () => {
-      const itemName = clientScopeName + 0;
-      listingPage
-        .searchItem(itemName, false)
-        .checkInSearchBarChangeTypeToButtonIsDisabled()
-        .clickSearchBarActionButton()
-        .checkDropdownItemIsDisabled("Delete")
-        .clickItemCheckbox(itemName)
-        .checkInSearchBarChangeTypeToButtonIsDisabled(false)
-        .clickSearchBarActionButton()
-        .checkDropdownItemIsDisabled("Delete", false)
-        .clickItemCheckbox(itemName)
-        .checkInSearchBarChangeTypeToButtonIsDisabled()
-        .clickSearchBarActionButton()
-        .checkDropdownItemIsDisabled("Delete");
-    });
-
-    //TODO: blocked by https://github.com/keycloak/keycloak-admin-ui/issues/1952
-    //it("should export item from item bar", () => {
-
-    //});
-  });
-
-  describe("Client Scope delete list items ", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("should delete item from item bar", () => {
-      listingPage
-        .checkInSearchBarChangeTypeToButtonIsDisabled()
-        .clickItemCheckbox(clientScopeName + 0)
-        .deleteItem(clientScopeName + 0);
-      modalUtils
-        .checkModalMessage(modalMessageDeleteConfirmation)
-        .confirmModal();
-      masthead.checkNotificationMessage(
-        notificationMessageDeletionConfirmation,
-      );
-      listingPage.checkInSearchBarChangeTypeToButtonIsDisabled();
-    });
-
-    it("should delete selected item from search bar", () => {
-      listingPage
-        .checkInSearchBarChangeTypeToButtonIsDisabled()
-        .clickItemCheckbox(clientScopeName + 1)
-        .clickSearchBarActionButton()
-        .clickSearchBarActionItem("Delete");
-      modalUtils
-        .checkModalMessage(modalMessageDeleteConfirmation)
-        .confirmModal();
-      masthead.checkNotificationMessage(
-        notificationMessageDeletionConfirmation,
-      );
-      listingPage.checkInSearchBarChangeTypeToButtonIsDisabled();
-    });
-
-    it("should delete multiple selected items from search bar", () => {
-      listingPage
-        .checkInSearchBarChangeTypeToButtonIsDisabled()
-        .clickItemCheckbox(clientScopeName + 2)
-        .clickItemCheckbox(clientScopeName + 3)
-        .clickItemCheckbox(clientScopeName + 4)
-        .clickSearchBarActionButton()
-        .clickSearchBarActionItem("Delete");
-      modalUtils
-        .checkModalMessage(modalMessageDeleteConfirmation)
-        .confirmModal();
-      masthead.checkNotificationMessage(
-        notificationMessageDeletionConfirmation,
-      );
-      listingPage.checkInSearchBarChangeTypeToButtonIsDisabled();
-    });
-  });
-
-  describe("Client Scope creation", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("should fail creating client scope", () => {
-      sidebarPage.waitForPageLoad();
-      listingPage.goToCreateItem();
-
-      createClientScopePage.save_is_disabled(true);
-      createClientScopePage.fillClientScopeData("address").save();
-
-      masthead.checkNotificationMessage(
-        "Could not create client scope: 'Client Scope address already exists'",
-      );
-
-      createClientScopePage.fillClientScopeData("");
-      createClientScopePage.save_is_disabled(true);
-    });
-
-    it("hides 'consent text' field when 'display consent' switch is disabled", () => {
-      sidebarPage.waitForPageLoad();
-      listingPage.goToCreateItem();
-
-      createClientScopePage
-        .getSwitchDisplayOnConsentScreenInput()
-        .should("be.checked");
-
-      createClientScopePage.getConsentScreenTextInput().should("exist");
-
-      createClientScopePage.switchDisplayOnConsentScreen();
-
-      createClientScopePage
-        .getSwitchDisplayOnConsentScreenInput()
-        .should("not.be.checked");
-
-      createClientScopePage.getConsentScreenTextInput().should("not.exist");
-    });
-
-    it("Client scope CRUD test", () => {
-      itemId += "_" + crypto.randomUUID();
-
-      // Create
-      listingPage.itemExist(itemId, false).goToCreateItem();
-
-      createClientScopePage.fillClientScopeData(itemId).save();
-
-      masthead.checkNotificationMessage("Client scope created");
-
-      sidebarPage.goToClientScopes();
-      sidebarPage.waitForPageLoad();
-
-      // Delete
-      listingPage
-        .searchItem(itemId, false)
-        .itemExist(itemId)
-        .deleteItem(itemId);
-
-      modalUtils
-        .checkModalMessage(modalMessageDeleteConfirmation)
-        .confirmModal();
-
-      masthead.checkNotificationMessage("The client scope has been deleted");
-
-      listingPage.itemExist(itemId, false);
-    });
-  });
-
-  describe("Scope tab test", () => {
-    const scopeTab = new RoleMappingTab("client-scope");
-    const scopeName = "address";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("Assign and unassign role", () => {
-      const role = "admin";
-      const roleType = "roles";
-      listingPage.searchItem(scopeName, false).goToItemDetails(scopeName);
-      scopeTab
-        .goToScopeTab()
-        .assignRole()
-        .changeRoleTypeFilter(roleType)
-        .selectRow(role)
-        .assign();
-      masthead.checkNotificationMessage("Role mapping updated");
-      scopeTab.checkRoles([role]);
-      scopeTab.hideInheritedRoles().selectRow(role).unAssign();
-      modalUtils.checkModalTitle("Remove role?").confirmModal();
-      scopeTab.checkRoles([]);
-    });
-  });
-
-  describe("Mappers tab test", () => {
-    const clientScopeDetailsPage = new ClientScopeDetailsPage();
-    const mappersTab = new MappersTab();
-    const mapperDetailsTab = new MapperDetailsPage();
-    const scopeName = "address";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-    });
-
-    it("CRUD mappers", () => {
-      const predefinedMapperName = "Predefined Mapper test";
-      const predefinedMapper = "Allowed Web Origins";
-      const mappers1 = ["birthdate"];
-      const mappers2 = ["email verified", "email", "family name"];
-
-      listingPage.searchItem(scopeName, false).goToItemDetails(scopeName);
-      clientScopeDetailsPage
-        .goToMappersTab()
-        .addPredefinedMappers(mappers1)
-        .addPredefinedMappers(mappers2);
-
-      listingPage.searchItem(mappers1[0], false).goToItemDetails(mappers1[0]);
-
-      mapperDetailsTab
-        .fillUserAttribute(mappers1[0] + "1")
-        .fillTokenClaimName(mappers1[0] + "2")
-        .changeClaimJsonType(ClaimJsonType.Long);
-
-      commonPage.formUtils().save();
-      commonPage
-        .masthead()
-        .checkNotificationMessage("Mapping successfully updated");
-
-      sidebarPage.goToClientScopes();
-      listingPage.searchItem(scopeName, false).goToItemDetails(scopeName);
-
-      clientScopeDetailsPage.goToMappersTab();
-
-      listingPage.searchItem(mappers1[0], false).goToItemDetails(mappers1[0]);
-
-      mapperDetailsTab
-        .checkUserAttribute(mappers1[0] + "1")
-        .checkTokenClaimName(mappers1[0] + "2")
-        .checkClaimJsonType(ClaimJsonType.Long);
-
-      commonPage.formUtils().cancel();
-
-      mappersTab
-        .removeMappers(mappers1.concat(mappers2))
-        .addMappersByConfiguration(predefinedMapper, predefinedMapperName);
-
-      sidebarPage.goToClientScopes();
-      listingPage.searchItem(scopeName, false).goToItemDetails(scopeName);
-      clientScopeDetailsPage.goToMappersTab();
-
-      commonPage.tableUtils().checkRowItemExists(predefinedMapperName, true);
-
-      mappersTab.removeMappers([predefinedMapperName]);
-    });
-  });
-
-  describe("Accessibility tests for client scopes", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClientScopes();
-      cy.injectAxe();
-    });
-
-    const scopeName = "a11y_" + crypto.randomUUID();
-
-    after(async () => {
-      await adminClient.deleteClientScope(scopeName);
-    });
-
-    it("Check a11y violations on load/ client scopes", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on empty client scope", () => {
-      listingPage.goToCreateItem();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client scope details", () => {
-      const clientScopeDetailsPage = new ClientScopeDetailsPage();
-      const mappersTab = new MappersTab();
-      const predefinedMapperName = "Predefined Mapper test";
-      const predefinedMapper = "Allowed Web Origins";
-      const scopeTab = new RoleMappingTab("client-scope");
-      const role = "admin";
-      const roleType = "roles";
-
-      listingPage.goToCreateItem();
-      createClientScopePage.fillClientScopeData(scopeName).save();
-      cy.checkA11y();
-
-      clientScopeDetailsPage.goToMappersTab();
-      cy.checkA11y();
-
-      dedicatedScopesMappersTab.addPredefinedMapper();
-      cy.checkA11y();
-      clientDetailsPage.modalUtils().table().clickHeaderItem(1, "input");
-      cy.findByTestId("confirm").click();
-      cy.checkA11y();
-
-      mappersTab.addMappersByConfiguration(
-        predefinedMapper,
-        predefinedMapperName,
-      );
-      cy.checkA11y();
-
-      sidebarPage.goToClientScopes();
-      listingPage.searchItem(scopeName, false).goToItemDetails(scopeName);
-      clientScopeDetailsPage.goToScopesTab();
-      cy.checkA11y();
-
-      cy.findByTestId("no-roles-for-this-client-scope-empty-action").click();
-      cy.checkA11y();
-      cy.findByTestId("cancel").click();
-
-      scopeTab
-        .goToScopeTab()
-        .assignRole()
-        .changeRoleTypeFilter(roleType)
-        .selectRow(role)
-        .assign();
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/clients_role.spec.ts b/js/apps/admin-ui/cypress/e2e/clients_role.spec.ts
deleted file mode 100644
index 0c5ba9551da9..000000000000
--- a/js/apps/admin-ui/cypress/e2e/clients_role.spec.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-import AttributesTab from "../support/pages/admin-ui/manage/AttributesTab";
-import ClientRolesTab from "../support/pages/admin-ui/manage/clients/ClientRolesTab";
-import AssociatedRolesPage from "../support/pages/admin-ui/manage/realm_roles/AssociatedRolesPage";
-import createRealmRolePage from "../support/pages/admin-ui/manage/realm_roles/CreateRealmRolePage";
-import CommonPage from "../support/pages/CommonPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const associatedRolesPage = new AssociatedRolesPage();
-const attributesTab = new AttributesTab();
-const commonPage = new CommonPage();
-const loginPage = new LoginPage();
-
-describe("Roles tab test", () => {
-  const realmName = `clients-realm-${crypto.randomUUID()}`;
-  const itemId = `client_crud${crypto.randomUUID()}`;
-
-  const rolesTab = new ClientRolesTab();
-  const client = "client_" + crypto.randomUUID();
-  const createRealmRoleName = `create-realm-${crypto.randomUUID()}`;
-
-  before(async () => {
-    await adminClient.createRealm(realmName);
-    await adminClient.inRealm(realmName, () =>
-      adminClient.createClient({
-        clientId: client,
-        protocol: "openid-connect",
-        publicClient: false,
-      }),
-    );
-    await adminClient.inRealm(realmName, () =>
-      adminClient.createRealmRole({
-        name: createRealmRoleName,
-      }),
-    );
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    commonPage.sidebar().goToRealm(realmName);
-    commonPage.sidebar().goToClients();
-    commonPage.tableToolbarUtils().searchItem(client);
-    commonPage.tableUtils().clickRowItemLink(client);
-    rolesTab.goToRolesTab();
-  });
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  it("Should fail to create client role with empty name", () => {
-    rolesTab.goToCreateRoleFromEmptyState();
-    createRealmRolePage.fillRealmRoleData("").save();
-    createRealmRolePage.checkRealmRoleNameRequiredMessage();
-  });
-
-  it("Should create client role", () => {
-    rolesTab.goToCreateRoleFromEmptyState();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    commonPage.masthead().checkNotificationMessage("Role created", true);
-  });
-
-  it("Should update client role description", () => {
-    const updateDescription = "updated description";
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    createRealmRolePage.updateDescription(updateDescription).save();
-    commonPage
-      .masthead()
-      .checkNotificationMessage("The role has been saved", true);
-    createRealmRolePage.checkDescription(updateDescription);
-  });
-
-  it("Should add attribute to client role", () => {
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    rolesTab.goToAttributesTab();
-    attributesTab
-      .addAttribute("crud_attribute_key", "crud_attribute_value")
-      .save();
-    attributesTab.assertRowItemsEqualTo(1);
-    commonPage
-      .masthead()
-      .checkNotificationMessage("The role has been saved", true);
-  });
-
-  it("Should delete attribute from client role", () => {
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    rolesTab.goToAttributesTab();
-    attributesTab.deleteAttribute(0);
-    attributesTab.assertEmpty();
-    commonPage
-      .masthead()
-      .checkNotificationMessage("The role has been saved", true);
-  });
-
-  it("Should create client role to be deleted", () => {
-    rolesTab.goToCreateRoleFromToolbar();
-    createRealmRolePage.fillRealmRoleData("client_role_to_be_deleted").save();
-    commonPage.masthead().checkNotificationMessage("Role created", true);
-  });
-
-  it("Should fail to create duplicate client role", () => {
-    rolesTab.goToCreateRoleFromToolbar();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    commonPage
-      .masthead()
-      .checkNotificationMessage(
-        `Could not create role: Role with name ${itemId} already exists`,
-        true,
-      );
-  });
-
-  it("Should search existing client role", () => {
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().checkRowItemExists(itemId);
-  });
-
-  it("Should search non-existing role test", () => {
-    commonPage.tableToolbarUtils().searchItem("role_DNE", false);
-    commonPage.emptyState().checkIfExists(true);
-  });
-
-  it("roles empty search test", () => {
-    commonPage.tableToolbarUtils().searchItem("", false);
-    commonPage.tableUtils().checkIfExists(true);
-  });
-
-  it("Add associated roles test", () => {
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().clickRowItemLink(itemId);
-
-    // Add associated realm role
-    associatedRolesPage.addAssociatedRealmRole(createRealmRoleName);
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Associated roles have been added", true);
-
-    // Add associated client role
-    associatedRolesPage.addAssociatedRoleFromSearchBar("manage-account", true);
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Associated roles have been added", true);
-
-    rolesTab.goToAssociatedRolesTab();
-
-    // Add associated client role
-    associatedRolesPage.addAssociatedRoleFromSearchBar("manage-consent", true);
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Associated roles have been added", true);
-  });
-
-  it("Should hide inherited roles test", () => {
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    rolesTab.goToAssociatedRolesTab().hideInheritedRoles();
-  });
-
-  it("Should delete associated roles test", () => {
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    rolesTab.goToAssociatedRolesTab();
-    commonPage
-      .tableUtils()
-      .selectRowItemAction(createRealmRoleName, "Unassign");
-    commonPage.sidebar().waitForPageLoad();
-    commonPage.modalUtils().checkModalTitle("Remove role?").confirmModal();
-    commonPage.sidebar().waitForPageLoad();
-
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Role mapping updated", true);
-
-    commonPage.tableUtils().selectRowItemAction("manage-consent", "Unassign");
-    commonPage.sidebar().waitForPageLoad();
-    commonPage.modalUtils().checkModalTitle("Remove role?").confirmModal();
-  });
-
-  it("Should delete associated role from search bar test", () => {
-    commonPage.tableToolbarUtils().searchItem(itemId, false);
-    commonPage.tableUtils().clickRowItemLink(itemId);
-    commonPage.sidebar().waitForPageLoad();
-    rolesTab.goToAssociatedRolesTab();
-
-    cy.get("td")
-      .contains("manage-account")
-      .parent()
-      .within(() => {
-        cy.get("input").click();
-      });
-
-    associatedRolesPage.removeAssociatedRoles();
-
-    commonPage.sidebar().waitForPageLoad();
-    commonPage.modalUtils().checkModalTitle("Remove role?").confirmModal();
-    commonPage.sidebar().waitForPageLoad();
-
-    commonPage
-      .masthead()
-      .checkNotificationMessage("Role mapping updated", true);
-  });
-
-  it("Should delete client role test", () => {
-    commonPage.tableUtils().selectRowItemAction(itemId, "Delete");
-    commonPage.sidebar().waitForPageLoad();
-    commonPage.modalUtils().checkModalTitle("Delete role?").confirmModal();
-  });
-
-  it("Should delete client role from role details test", () => {
-    commonPage
-      .tableToolbarUtils()
-      .searchItem("client_role_to_be_deleted", false);
-    commonPage.tableUtils().clickRowItemLink("client_role_to_be_deleted");
-    createRealmRolePage.clickActionMenu("Delete this role");
-    commonPage.modalUtils().confirmModal();
-    commonPage
-      .masthead()
-      .checkNotificationMessage("The role has been deleted", true);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/clients_saml_advanced.spec.ts b/js/apps/admin-ui/cypress/e2e/clients_saml_advanced.spec.ts
deleted file mode 100644
index 252d5fa8d135..000000000000
--- a/js/apps/admin-ui/cypress/e2e/clients_saml_advanced.spec.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import { AdvancedSamlTab } from "../support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedSamlTab";
-import ClientDetailsPage from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const listingPage = new ListingPage();
-const advancedTab = new AdvancedSamlTab();
-
-describe("Clients Saml advanced tab", () => {
-  describe("Fine Grain SAML Endpoint Configuration", () => {
-    const clientName = "advanced-tab";
-
-    before(() => {
-      adminClient.createClient({
-        protocol: "saml",
-        clientId: clientName,
-        publicClient: false,
-      });
-    });
-
-    after(() => {
-      adminClient.deleteClient(clientName);
-    });
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClients();
-      listingPage.searchItem(clientName).goToItemDetails(clientName);
-      new ClientDetailsPage().goToAdvancedTab();
-    });
-
-    it("Should Terms of service URL", () => {
-      const termsOfServiceUrl = "http://some.url/terms-of-service.html";
-      advancedTab.termsOfServiceUrl(termsOfServiceUrl).saveFineGrain();
-      masthead.checkNotificationMessage("Client successfully updated");
-
-      advancedTab
-        .termsOfServiceUrl("http://not.saveing.this/")
-        .revertFineGrain();
-      advancedTab.checkTermsOfServiceUrl(termsOfServiceUrl);
-    });
-
-    it("Invalid terms of service URL", () => {
-      advancedTab.termsOfServiceUrl("not a url").saveFineGrain();
-
-      masthead.checkNotificationMessage(
-        "Client could not be updated: invalid_input",
-      );
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/clients_saml_test.spec.ts b/js/apps/admin-ui/cypress/e2e/clients_saml_test.spec.ts
deleted file mode 100644
index 346843b7b9af..000000000000
--- a/js/apps/admin-ui/cypress/e2e/clients_saml_test.spec.ts
+++ /dev/null
@@ -1,192 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ModalUtils from "../support/util/ModalUtils";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import SettingsTab from "../support/pages/admin-ui/manage/clients/client_details/tabs/SettingsTab";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const listingPage = new ListingPage();
-const modalUtils = new ModalUtils();
-
-describe("Clients SAML tests", () => {
-  describe("SAML test", () => {
-    const samlClientName = "saml";
-
-    before(() => {
-      adminClient.createClient({
-        protocol: "saml",
-        clientId: samlClientName,
-        publicClient: false,
-      });
-    });
-
-    after(() => {
-      adminClient.deleteClient(samlClientName);
-    });
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClients();
-      listingPage.searchItem(samlClientName).goToItemDetails(samlClientName);
-    });
-
-    it("should display the saml sections on details screen", () => {
-      cy.get(".pf-v5-c-jump-links__list").should(($ul) => {
-        expect($ul)
-          .to.contain("SAML capabilities")
-          .to.contain("Signature and Encryption");
-      });
-    });
-
-    it("should save force name id format", () => {
-      cy.get(".pf-v5-c-jump-links__list").contains("SAML capabilities").click();
-
-      cy.findByTestId("attributes.saml🍺force🍺post🍺binding").click({
-        force: true,
-      });
-      cy.findByTestId("settings-save").click();
-      masthead.checkNotificationMessage("Client successfully updated");
-    });
-  });
-
-  describe("SAML keys tab", () => {
-    const clientId = "saml-keys";
-
-    before(() => {
-      adminClient.createClient({
-        clientId,
-        protocol: "saml",
-      });
-    });
-
-    after(() => {
-      adminClient.deleteClient(clientId);
-    });
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClients();
-      listingPage.searchItem(clientId).goToItemDetails(clientId);
-      cy.findByTestId("keysTab").click();
-    });
-
-    it("should doesn't disable signature when cancel", () => {
-      cy.findByTestId("clientSignature").click({ force: true });
-
-      modalUtils
-        .checkModalTitle('Disable "Client signature required"')
-        .cancelModal();
-
-      cy.findAllByTestId("certificate").should("have.length", 1);
-    });
-
-    it("should disable client signature", () => {
-      cy.intercept(
-        "admin/realms/master/clients/*/certificates/saml.signing",
-      ).as("load");
-      cy.findByTestId("clientSignature").click({ force: true });
-
-      modalUtils
-        .checkModalTitle('Disable "Client signature required"')
-        .confirmModal();
-
-      masthead.checkNotificationMessage("Client successfully updated");
-      cy.findAllByTestId("certificate").should("have.length", 0);
-    });
-
-    it("should enable Encryption keys config", () => {
-      cy.findByTestId("encryptAssertions").click({ force: true });
-
-      cy.findByTestId("generate").click();
-      masthead.checkNotificationMessage(
-        "New key pair and certificate generated successfully",
-      );
-
-      modalUtils.confirmModal();
-      cy.findAllByTestId("certificate").should("have.length", 1);
-    });
-  });
-
-  describe("SAML settings tab", () => {
-    const clientId = "saml-settings";
-    const settingsTab = new SettingsTab();
-
-    before(() => {
-      adminClient.createClient({
-        clientId,
-        protocol: "saml",
-      });
-    });
-
-    after(() => {
-      adminClient.deleteClient(clientId);
-    });
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToClients();
-      listingPage.searchItem(clientId).goToItemDetails(clientId);
-    });
-
-    it("should check SAML capabilities", () => {
-      cy.get(".pf-v5-c-jump-links__list").contains("SAML capabilities").click();
-
-      settingsTab.assertNameIdFormatDropdown();
-      settingsTab.assertSAMLCapabilitiesSwitches();
-    });
-
-    it("should check signature and encryption", () => {
-      cy.get(".pf-v5-c-jump-links__list")
-        .contains("Signature and Encryption")
-        .click();
-
-      settingsTab.assertSignatureAlgorithmDropdown();
-      settingsTab.assertSignatureKeyNameDropdown();
-      settingsTab.assertCanonicalizationDropdown();
-
-      settingsTab.assertSignatureEncryptionSwitches();
-    });
-
-    it("should check access settings", () => {
-      cy.get(".pf-v5-c-jump-links__list").contains("Access settings").click();
-
-      const validUrl =
-        "http://localhost:8180/realms/master/protocol/" +
-        clientId +
-        "/clients/";
-      const invalidUrlError = "Client could not be updated: invalid_input";
-
-      cy.findByTestId("rootUrl").type("Invalid URL");
-      settingsTab.clickSaveBtn();
-      masthead.checkNotificationMessage(invalidUrlError);
-      cy.findByTestId("rootUrl").clear();
-
-      cy.findByTestId("baseUrl").type("Invalid URL");
-      settingsTab.clickSaveBtn();
-      masthead.checkNotificationMessage(invalidUrlError);
-      cy.findByTestId("baseUrl").clear();
-
-      cy.findByTestId("rootUrl").type(validUrl);
-      cy.findByTestId("baseUrl").type(validUrl);
-      settingsTab.clickSaveBtn();
-      masthead.checkNotificationMessage("Client successfully updated");
-
-      settingsTab.assertAccessSettings();
-    });
-
-    it("should check login settings", () => {
-      cy.get(".pf-v5-c-jump-links__list").contains("Login settings").click();
-
-      settingsTab.assertLoginThemeDropdown();
-      settingsTab.assertLoginSettings();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/clients_test.spec.ts b/js/apps/admin-ui/cypress/e2e/clients_test.spec.ts
deleted file mode 100644
index 5c7b3caf9d2d..000000000000
--- a/js/apps/admin-ui/cypress/e2e/clients_test.spec.ts
+++ /dev/null
@@ -1,616 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import CreateClientPage from "../support/pages/admin-ui/manage/clients/CreateClientPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import RoleMappingTab from "../support/pages/admin-ui/manage/RoleMappingTab";
-import ClientRolesTab from "../support/pages/admin-ui/manage/clients/ClientRolesTab";
-import ClientDetailsPage, {
-  ClientsDetailsTab,
-} from "../support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage";
-import CommonPage from "../support/pages/CommonPage";
-import DedicatedScopesMappersTab from "../support/pages/admin-ui/manage/clients/client_details/DedicatedScopesMappersTab";
-import { ClientRegistrationPage } from "../support/pages/admin-ui/manage/clients/ClientRegistrationPage";
-
-let itemId = "client_crud";
-const loginPage = new LoginPage();
-const createClientPage = new CreateClientPage();
-const clientDetailsPage = new ClientDetailsPage();
-const commonPage = new CommonPage();
-const listingPage = new ListingPage();
-const dedicatedScopesMappersTab = new DedicatedScopesMappersTab();
-
-describe("Clients test", () => {
-  const realmName = `clients-realm-${crypto.randomUUID()}`;
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  describe("Client creation", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-    });
-
-    it("Should cancel creating client", () => {
-      commonPage.tableToolbarUtils().createClient();
-
-      createClientPage.continue().checkClientIdRequiredMessage();
-
-      createClientPage
-        .fillClientData("")
-        .selectClientType("OpenID Connect")
-        .cancel();
-
-      cy.url().should("not.include", "/add-client");
-    });
-
-    it("Should check settings elements", () => {
-      commonPage.tableToolbarUtils().clickPrimaryButton();
-      const clientId = "Test settings";
-
-      createClientPage
-        .fillClientData(clientId)
-        .continue()
-        .checkCapabilityConfigElements()
-        .continue()
-        .save();
-
-      commonPage
-        .masthead()
-        .checkNotificationMessage("Client created successfully");
-      commonPage.sidebar().waitForPageLoad();
-
-      createClientPage
-        .checkCapabilityConfigElements()
-        .checkAccessSettingsElements()
-        .checkLoginSettingsElements()
-        .checkLogoutSettingsElements()
-        .deleteClientFromActionDropdown();
-
-      commonPage.modalUtils().confirmModal();
-      commonPage.tableUtils().checkRowItemExists(clientId, false);
-    });
-
-    it("Should navigate to previous using 'back' button", () => {
-      commonPage.tableToolbarUtils().createClient();
-
-      createClientPage.continue().checkClientIdRequiredMessage();
-
-      createClientPage
-        .fillClientData("test_client")
-        .selectClientType("OpenID Connect")
-        .continue()
-        .back()
-        .checkGeneralSettingsStepActive();
-    });
-
-    it("Should fail creating client", () => {
-      commonPage.tableToolbarUtils().createClient();
-
-      createClientPage.continue().checkClientIdRequiredMessage();
-
-      createClientPage
-        .fillClientData("")
-        .selectClientType("OpenID Connect")
-        .continue()
-        .checkClientIdRequiredMessage();
-
-      createClientPage.fillClientData("account").continue().continue().save();
-
-      // The error should inform about duplicated name/id
-      commonPage
-        .masthead()
-        .checkNotificationMessage(
-          "Could not create client: 'Client account already exists'",
-        );
-    });
-
-    it("Client CRUD test", () => {
-      itemId += "_" + crypto.randomUUID();
-
-      // Create
-      commonPage.tableUtils().checkRowItemExists(itemId, false);
-      commonPage.tableToolbarUtils().clickPrimaryButton();
-      createClientPage.cancel();
-      commonPage.tableUtils().checkRowItemExists(itemId, false);
-      commonPage.tableToolbarUtils().clickPrimaryButton();
-
-      createClientPage
-        .selectClientType("OpenID Connect")
-        .fillClientData(itemId)
-        .continue()
-        .switchClientAuthentication()
-        .clickDirectAccess()
-        .clickImplicitFlow()
-        .clickOAuthDeviceAuthorizationGrant()
-        .clickOidcCibaGrant()
-        .clickServiceAccountRoles()
-        .clickStandardFlow()
-        .continue()
-        .save();
-
-      commonPage
-        .masthead()
-        .checkNotificationMessage("Client created successfully");
-
-      commonPage.sidebar().goToClients();
-
-      commonPage.tableToolbarUtils().searchItem("John Doe", false);
-      commonPage.emptyState().checkIfExists(true);
-      commonPage.tableToolbarUtils().searchItem("");
-      commonPage.tableUtils().checkRowItemExists("account");
-      commonPage.tableToolbarUtils().searchItem(itemId);
-      commonPage.tableUtils().checkRowItemExists(itemId);
-
-      // Delete
-      commonPage.tableUtils().selectRowItemAction(itemId, "Delete");
-      commonPage.sidebar().waitForPageLoad();
-      commonPage
-        .modalUtils()
-        .checkModalTitle(`Delete ${itemId} ?`)
-        .confirmModal();
-      commonPage
-        .masthead()
-        .checkNotificationMessage("The client has been deleted");
-      commonPage.tableUtils().checkRowItemExists(itemId, false);
-    });
-
-    it("Should fail to create imported client with empty ID", () => {
-      commonPage.sidebar().goToClients();
-      cy.findByTestId("importClient").click();
-      cy.findByTestId("clientId").click();
-      cy.findByText("Save").click();
-      cy.findByText("Required field");
-    });
-
-    const identicalClientId = "identical";
-
-    it("Should fail to create client with same ID", () => {
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().createClient();
-
-      createClientPage
-        .fillClientData(identicalClientId)
-        .continue()
-        .continue()
-        .save();
-
-      commonPage.masthead().closeAllAlertMessages();
-      commonPage.sidebar().goToClients();
-      cy.findByTestId("importClient").click();
-      cy.findByTestId("realm-file").selectFile(
-        "cypress/fixtures/partial-import-test-data/import-identical-client.json",
-        {
-          action: "drag-drop",
-        },
-      );
-
-      cy.wait(1000);
-      //cy.findByTestId("realm-file").contains('"clientId": "identical"')
-      cy.findByTestId("clientId").click();
-      cy.findByText("Save").click();
-      commonPage
-        .masthead()
-        .checkNotificationMessage(
-          "Could not import client: Client identical already exists",
-          true,
-        );
-    });
-
-    it("should delete 'identical' client id", () => {
-      commonPage.sidebar().goToClients();
-      cy.wrap(null).then(() =>
-        adminClient.inRealm(realmName, () =>
-          adminClient.deleteClient(identicalClientId),
-        ),
-      );
-    });
-  });
-
-  describe("Service account tab test", () => {
-    const serviceAccountTab = new RoleMappingTab("user");
-    const serviceAccountName = `service-account-client${crypto.randomUUID()}`;
-    const createRealmRoleName = `create-realm-${crypto.randomUUID()}`;
-    const createRealmRoleType = `roles`;
-
-    before(async () => {
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createClient({
-          protocol: "openid-connect",
-          clientId: serviceAccountName,
-          publicClient: false,
-          authorizationServicesEnabled: true,
-          serviceAccountsEnabled: true,
-          standardFlowEnabled: true,
-        }),
-      );
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createRealmRole({
-          name: createRealmRoleName,
-        }),
-      );
-    });
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-    });
-
-    after(async () => {
-      await adminClient.inRealm(realmName, () =>
-        adminClient.deleteClient(serviceAccountName),
-      );
-      await adminClient.inRealm(realmName, () =>
-        adminClient.deleteRealmRole(createRealmRoleName),
-      );
-    });
-
-    it("List", () => {
-      commonPage.tableToolbarUtils().searchItem(serviceAccountName);
-      commonPage.tableUtils().clickRowItemLink(serviceAccountName);
-      serviceAccountTab
-        .goToServiceAccountTab()
-        .checkRoles(["offline_access", "uma_authorization"], false)
-        .checkRoles([`default-roles-${realmName}`, "uma_protection"])
-        .unhideInheritedRoles();
-
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab
-        .checkRoles([
-          `default-roles-${realmName}`,
-          "offline_access",
-          "uma_authorization",
-          "uma_protection",
-        ])
-        .hideInheritedRoles();
-
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab
-        .checkRoles(["offline_access", "uma_authorization"], false)
-        .checkRoles([`default-roles-${realmName}`, "uma_protection"]);
-
-      listingPage
-        .searchItem("testing", false)
-        .checkEmptyList()
-        .searchItem("", false);
-
-      serviceAccountTab
-        .checkRoles(["offline_access", "uma_authorization"], false)
-        .checkRoles([`default-roles-${realmName}`, "uma_protection"]);
-    });
-
-    it("Assign", () => {
-      commonPage.tableUtils().clickRowItemLink(serviceAccountName);
-      serviceAccountTab
-        .goToServiceAccountTab()
-        .assignRole(false)
-        .changeRoleTypeFilter(createRealmRoleType)
-        .selectRow(createRealmRoleName, true)
-        .assign();
-      commonPage.masthead().checkNotificationMessage("Role mapping updated");
-
-      serviceAccountTab.selectRow(createRealmRoleName).unAssign();
-
-      commonPage.sidebar().waitForPageLoad();
-      commonPage.modalUtils().checkModalTitle("Remove role?").confirmModal();
-      commonPage.masthead().checkNotificationMessage("Role mapping updated");
-
-      //cy.intercept(`/admin/realms/${realmName}/users`).as("assignRoles");
-      serviceAccountTab
-        .checkRoles([createRealmRoleName], false)
-        .assignRole(false);
-
-      //cy.wait("@assignRoles");
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab
-        .changeRoleTypeFilter("roles")
-        .selectRow("offline_access", true)
-        .selectRow(createRealmRoleName, true)
-        .assign();
-
-      commonPage.masthead().checkNotificationMessage("Role mapping updated");
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab.unhideInheritedRoles();
-
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab.hideInheritedRoles();
-
-      serviceAccountTab.selectRow("offline_access").unAssign();
-
-      commonPage.modalUtils().confirmModal();
-
-      serviceAccountTab
-        .checkRoles(["admin", "offline_access"], false)
-        .checkRoles([createRealmRoleName]);
-
-      listingPage.clickRowDetails(createRealmRoleName);
-      serviceAccountTab.unAssignFromDropdown();
-
-      commonPage.modalUtils().confirmModal();
-
-      commonPage.sidebar().waitForPageLoad();
-
-      serviceAccountTab.unhideInheritedRoles();
-
-      serviceAccountTab
-        .checkRoles([createRealmRoleName], false)
-        .checkRoles([
-          `default-roles-${realmName}`,
-          "offline_access",
-          "uma_authorization",
-          "uma_protection",
-        ]);
-    });
-  });
-
-  describe("Mapping tab", () => {
-    const mappingClient = "mapping-client";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().searchItem(mappingClient);
-      commonPage.tableUtils().clickRowItemLink(mappingClient);
-    });
-
-    before(() =>
-      adminClient.inRealm(realmName, () =>
-        adminClient.createClient({
-          protocol: "openid-connect",
-          clientId: mappingClient,
-          publicClient: false,
-        }),
-      ),
-    );
-
-    after(() =>
-      adminClient.inRealm(realmName, () =>
-        adminClient.deleteClient(mappingClient),
-      ),
-    );
-
-    it("Add mapping to openid client", () => {
-      clientDetailsPage
-        .goToClientScopesTab()
-        .clickDedicatedScope(mappingClient);
-      dedicatedScopesMappersTab.addPredefinedMapper();
-      clientDetailsPage.modalUtils().table().clickHeaderItem(1, "input");
-      clientDetailsPage.modalUtils().confirmModal();
-      clientDetailsPage
-        .masthead()
-        .checkNotificationMessage("Mapping successfully created");
-    });
-  });
-
-  describe("Keys tab test", () => {
-    const keysName = "keys-client";
-
-    before(
-      async () =>
-        await adminClient.inRealm(realmName, () =>
-          adminClient.createClient({
-            protocol: "openid-connect",
-            clientId: keysName,
-            publicClient: false,
-          }),
-        ),
-    );
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().searchItem(keysName);
-      commonPage.tableUtils().clickRowItemLink(keysName);
-    });
-
-    after(() =>
-      adminClient.inRealm(realmName, () => adminClient.deleteClient(keysName)),
-    );
-
-    it("Generate new keys", () => {
-      const keysTab = clientDetailsPage.goToKeysTab();
-      keysTab.clickGenerate();
-      keysTab.fillGenerateModal("JKS", "keyname", "123", "1234").clickConfirm();
-
-      commonPage
-        .masthead()
-        .checkNotificationMessage(
-          "New key pair and certificate generated successfully",
-        );
-    });
-  });
-
-  describe("Realm client", () => {
-    const clientName = `${realmName}-realm`;
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      // Stay in master realm, do not switch to ${realmName} realm
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().searchItem(clientName);
-      commonPage.tableUtils().clickRowItemLink(clientName);
-    });
-
-    it("Displays the correct tabs", () => {
-      clientDetailsPage.goToSettingsTab();
-      clientDetailsPage
-        .tabUtils()
-        .checkTabExists(ClientsDetailsTab.Settings, true)
-        .checkTabExists(ClientsDetailsTab.Roles, true)
-        .checkTabExists(ClientsDetailsTab.Sessions, true)
-        .checkTabExists(ClientsDetailsTab.Permissions, true)
-        .checkTabExists(ClientsDetailsTab.Advanced, true)
-        .checkNumberOfTabsIsEqual(5);
-    });
-
-    it("Hides the delete action", () => {
-      commonPage
-        .actionToolbarUtils()
-        .clickActionToggleButton()
-        .checkActionItemExists("Delete", false);
-    });
-  });
-
-  describe("Bearer only", () => {
-    const clientId = "bearer-only";
-
-    before(
-      async () =>
-        await adminClient.inRealm(realmName, () =>
-          adminClient.createClient({
-            clientId,
-            protocol: "openid-connect",
-            publicClient: false,
-            bearerOnly: true,
-          }),
-        ),
-    );
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-      cy.intercept(`/admin/realms/${realmName}/clients/*`).as("fetchClient");
-      commonPage.tableToolbarUtils().searchItem(clientId);
-      commonPage.tableUtils().clickRowItemLink(clientId);
-      cy.wait("@fetchClient");
-    });
-
-    after(() =>
-      adminClient.inRealm(realmName, () => adminClient.deleteClient(clientId)),
-    );
-
-    it("Shows an explainer text for bearer only clients", () => {
-      commonPage
-        .actionToolbarUtils()
-        .bearerOnlyExplainerLabelElement.trigger("mouseenter");
-      commonPage
-        .actionToolbarUtils()
-        .bearerOnlyExplainerTooltipElement.should("exist");
-    });
-
-    it("Hides the capability config section", () => {
-      cy.findByTestId("capability-config-form").should("not.exist");
-      cy.findByTestId("jump-link-capability-config").should("not.exist");
-    });
-  });
-
-  describe("Generated home URLs for built-in clients", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-    });
-
-    it("Check account-console Home URL", () => {
-      cy.findByTestId("client-home-url-account-console").contains("/account/");
-    });
-
-    it("Check security-admin-console Home URL", () => {
-      cy.findByTestId("client-home-url-security-admin-console").contains(
-        "/console/",
-      );
-    });
-  });
-
-  describe("Accessibility tests for clients", () => {
-    const clientId = "a11y-client";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      commonPage.sidebar().goToRealm(realmName);
-      commonPage.sidebar().goToClients();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ clients list tab", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on create client page", () => {
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().createClient();
-      createClientPage.fillClientData(clientId);
-      cy.checkA11y();
-
-      createClientPage.continue();
-      cy.checkA11y();
-
-      createClientPage.continue();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client details page", () => {
-      const rolesTab = new ClientRolesTab();
-
-      commonPage.sidebar().goToClients();
-      commonPage.tableToolbarUtils().createClient();
-      createClientPage.fillClientData(clientId).continue().continue().save();
-      cy.checkA11y();
-
-      rolesTab.goToRolesTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesEvaluateTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesEvaluateEffectiveRoleScopeMappingsTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedAccessTokenTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedIdTokenTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToClientScopesEvaluateGeneratedUserInfoTab();
-      cy.checkA11y();
-
-      clientDetailsPage.goToAdvancedTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations in delete dialog", () => {
-      commonPage.tableToolbarUtils().searchItem(clientId, false);
-      commonPage.tableUtils().selectRowItemAction(clientId, "Delete");
-      cy.checkA11y();
-      cy.findAllByTestId("confirm").click();
-    });
-
-    it("Check a11y violations on client registration/ anonymous access policies tab", () => {
-      const clientRegistration = new ClientRegistrationPage();
-      clientRegistration.goToClientRegistrationTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client registration/ authenticated access policies tab", () => {
-      const clientRegistration = new ClientRegistrationPage();
-      clientRegistration.goToClientRegistrationTab();
-      cy.findByTestId("authenticated").click();
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/events_test.spec.ts b/js/apps/admin-ui/cypress/e2e/events_test.spec.ts
deleted file mode 100644
index 40344a2e24cb..000000000000
--- a/js/apps/admin-ui/cypress/e2e/events_test.spec.ts
+++ /dev/null
@@ -1,502 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import UserEventsTab, {
-  UserEventSearchData,
-} from "../support/pages/admin-ui/manage/events/tabs/UserEventsTab";
-import AdminEventsTab from "../support/pages/admin-ui/manage/events/tabs/AdminEventsTab";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import EventsPage, {
-  EventsTab,
-} from "../support/pages/admin-ui/manage/events/EventsPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import adminClient from "../support/util/AdminClient";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const userEventsTab = new UserEventsTab();
-const eventsPage = new EventsPage();
-const adminEventsTab = new AdminEventsTab();
-const realmSettingsPage = new RealmSettingsPage();
-const masthead = new Masthead();
-const listingPage = new ListingPage();
-
-const dateFrom = new Date();
-dateFrom.setDate(dateFrom.getDate() - 100);
-const dateFromFormatted = `${dateFrom.getFullYear()}-${dateFrom.getMonth()}-${dateFrom.getDay()}`;
-const dateTo = new Date();
-dateTo.setDate(dateTo.getDate() + 100);
-const dateToFormatted = `${dateTo.getFullYear()}-${dateTo.getMonth()}-${dateTo.getDay()}`;
-
-describe.skip("Events tests", () => {
-  const eventsTestUser = {
-    eventsTestUserId: "",
-    userRepresentation: {
-      username: "events-test" + crypto.randomUUID(),
-      enabled: true,
-      credentials: [{ value: "events-test" }],
-    },
-  };
-  const eventsTestUserClientId = "admin-cli";
-
-  before(async () => {
-    const result = await adminClient.createUser(
-      eventsTestUser.userRepresentation,
-    );
-    eventsTestUser.eventsTestUserId = result.id!;
-  });
-
-  after(() =>
-    adminClient.deleteUser(eventsTestUser.userRepresentation.username),
-  );
-
-  describe("User events list", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-    });
-
-    it("Show empty when no save events", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToUserEventsSettingsSubTab()
-        .enableSaveEventsSwitch()
-        .save()
-        .clearUserEvents();
-
-      cy.wait(5000);
-
-      sidebarPage.goToEvents();
-      eventsPage.goToUserEventsTab();
-      userEventsTab.assertNoSearchResultsExist(true);
-    });
-
-    it("Expand item to see more information", () => {
-      listingPage.expandRow(0).assertExpandedRowContainText(0, "code_id");
-    });
-  });
-
-  describe("Search user events list", () => {
-    const eventTypes = [
-      "LOGOUT",
-      "CODE_TO_TOKEN",
-      "CODE_TO_TOKEN_ERROR",
-      "LOGIN_ERROR",
-      "LOGIN",
-    ];
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-    });
-
-    it("Check search dropdown display", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToUserEventsSettingsSubTab()
-        .disableSaveEventsSwitch()
-        .save();
-
-      cy.wait(5000);
-
-      masthead.signOut();
-      loginPage.logIn();
-      cy.visit("/");
-
-      sidebarPage.goToEvents();
-      eventsPage.tabUtils().checkIsCurrentTab(EventsTab.UserEvents);
-      userEventsTab.assertSearchUserEventDropdownMenuExist(true);
-    });
-
-    it("Check user events search form fields display", () => {
-      userEventsTab
-        .openSearchUserEventDropdownMenu()
-        .assertUserSearchDropdownMenuHasLabels();
-    });
-
-    it("Check event type dropdown options exist", () => {
-      userEventsTab
-        .openSearchUserEventDropdownMenu()
-        .openEventTypeSelectMenu()
-        .clickEventTypeSelectItem(eventTypes[0])
-        .clickEventTypeSelectItem(eventTypes[1])
-        .clickEventTypeSelectItem(eventTypes[2])
-        .clickEventTypeSelectItem(eventTypes[3])
-        .closeEventTypeSelectMenu();
-    });
-
-    it("Check `search events` button disabled by default", () => {
-      userEventsTab
-        .openSearchUserEventDropdownMenu()
-        .assertSearchEventBtnIsEnabled(false);
-    });
-
-    it("Check user events search and removal work", () => {
-      userEventsTab
-        .searchUserEventByEventType([eventTypes[0]])
-        .assertEventTypeChipGroupItemExist(eventTypes[0], true)
-        .assertEventTypeChipGroupItemExist(eventTypes[1], false)
-        .assertEventTypeChipGroupItemExist(eventTypes[2], false)
-        .assertEventTypeChipGroupItemExist(eventTypes[3], false)
-        .assertNoSearchResultsExist(true)
-        .removeEventTypeChipGroupItem(eventTypes[0])
-        .assertEventTypeChipGroupExist(false);
-    });
-
-    it("Check for no events logged", () => {
-      userEventsTab
-        .searchUserEventByUserId("test")
-        .assertNoSearchResultsExist(true);
-    });
-
-    it("Check `search events` button enabled", () => {
-      userEventsTab
-        .openSearchUserEventDropdownMenu()
-        .assertSearchEventBtnIsEnabled(false)
-        .typeUserId("11111")
-        .assertSearchEventBtnIsEnabled(true);
-    });
-
-    it("Search by user ID", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToUserEventsSettingsSubTab()
-        .enableSaveEventsSwitch()
-        .save();
-      sidebarPage.goToEvents();
-      cy.wrap(null).then(() =>
-        adminClient.loginUser(
-          eventsTestUser.userRepresentation.username,
-          eventsTestUser.userRepresentation.credentials[0].value,
-          eventsTestUserClientId,
-        ),
-      );
-      userEventsTab
-        .searchUserEventByUserId(eventsTestUser.eventsTestUserId)
-        .assertUserIdChipGroupExist(true)
-        .assertEventTypeChipGroupExist(false)
-        .assertClientChipGroupExist(false)
-        .assertDateFromChipGroupExist(false)
-        .assertDateToChipGroupExist(false);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by event type", () => {
-      userEventsTab
-        .searchUserEventByEventType([eventTypes[4]])
-        .assertUserIdChipGroupExist(false)
-        .assertEventTypeChipGroupExist(true)
-        .assertClientChipGroupExist(false)
-        .assertDateFromChipGroupExist(false)
-        .assertDateToChipGroupExist(false);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by client", () => {
-      userEventsTab
-        .searchUserEventByClient(eventsTestUserClientId)
-        .assertUserIdChipGroupExist(false)
-        .assertEventTypeChipGroupExist(false)
-        .assertClientChipGroupExist(true)
-        .assertDateFromChipGroupExist(false)
-        .assertDateToChipGroupExist(false);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by date from", () => {
-      userEventsTab
-        .searchUserEventByDateFrom(dateFromFormatted)
-        .assertUserIdChipGroupExist(false)
-        .assertEventTypeChipGroupExist(false)
-        .assertClientChipGroupExist(false)
-        .assertDateFromChipGroupExist(true)
-        .assertDateToChipGroupExist(false);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by dato to", () => {
-      userEventsTab
-        .searchUserEventByDateTo(dateToFormatted)
-        .assertUserIdChipGroupExist(false)
-        .assertEventTypeChipGroupExist(false)
-        .assertClientChipGroupExist(false)
-        .assertDateFromChipGroupExist(false)
-        .assertDateToChipGroupExist(true);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by Ip Adress to", () => {
-      userEventsTab
-        .assertIpAddressChipGroupExist(true)
-        .assertUserIdChipGroupExist(false)
-        .assertEventTypeChipGroupExist(false)
-        .assertClientChipGroupExist(false)
-        .assertDateFromChipGroupExist(false)
-        .assertDateToChipGroupExist(false);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by all elements", () => {
-      const searchData = new UserEventSearchData();
-      searchData.client = eventsTestUserClientId;
-      searchData.userId = eventsTestUser.eventsTestUserId;
-      searchData.eventType = [eventTypes[4]];
-      searchData.dateFrom = dateFromFormatted;
-      searchData.dateTo = dateToFormatted;
-      userEventsTab
-        .searchUserEvent(searchData)
-        .assertUserIdChipGroupExist(true)
-        .assertEventTypeChipGroupExist(true)
-        .assertClientChipGroupExist(true)
-        .assertDateFromChipGroupExist(true)
-        .assertDateToChipGroupExist(true);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Check `search user events` button enabled", () => {
-      userEventsTab
-        .openSearchUserEventDropdownMenu()
-        .typeIpAddress("11111")
-        .assertSearchEventBtnIsEnabled(true);
-    });
-  });
-
-  describe("Admin events list", () => {
-    const realmName = crypto.randomUUID();
-
-    before(() => adminClient.createRealm(realmName));
-
-    after(() => adminClient.deleteRealm(realmName));
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToRealm(realmName);
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-    });
-
-    it("Show events", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToAdminEventsSettingsSubTab()
-        .enableSaveEvents()
-        .save();
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Show empty when no save events", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToAdminEventsSettingsSubTab()
-        .disableSaveEvents()
-        .save({ waitForRealm: false, waitForConfig: true })
-        .clearAdminEvents();
-
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      adminEventsTab.assertNoSearchResultsExist(true);
-    });
-  });
-
-  describe("Search admin events list", () => {
-    const resourceTypes = ["REALM"];
-    const operationTypes = ["UPDATE"];
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-    });
-
-    it("Search by resource types", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToAdminEventsSettingsSubTab()
-        .enableSaveEvents()
-        .save({ waitForRealm: false, waitForConfig: true });
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      adminEventsTab
-        .searchAdminEventByResourceTypes([resourceTypes[0]])
-        .assertResourceTypesChipGroupExist(true);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by operation types", () => {
-      adminEventsTab
-        .searchAdminEventByOperationTypes([operationTypes[0]])
-        .assertOperationTypesChipGroupExist(true);
-      listingPage.itemsGreaterThan(0);
-    });
-
-    it("Search by resource path", () => {
-      adminEventsTab
-        .searchAdminEventByResourcePath("test")
-        .assertResourcePathChipGroupExist(true);
-    });
-
-    it("Search by realm", () => {
-      adminEventsTab
-        .searchAdminEventByRealm("master")
-        .assertRealmChipGroupExist(true);
-    });
-
-    it("Search by client", () => {
-      adminEventsTab
-        .searchAdminEventByClient("admin-cli")
-        .assertClientChipGroupExist(true);
-    });
-
-    it("Search by user ID", () => {
-      adminEventsTab
-        .searchAdminEventByUser("test")
-        .assertUserChipGroupExist(true);
-    });
-
-    it("Search by IP address", () => {
-      adminEventsTab
-        .searchAdminEventByIpAddress("test")
-        .assertIpAddressChipGroupExist(true);
-    });
-
-    it("Search by date from", () => {
-      adminEventsTab
-        .searchAdminEventByDateTo(dateToFormatted)
-        .assertDateToChipGroupExist(true);
-    });
-
-    it("Search by date to", () => {
-      adminEventsTab
-        .searchAdminEventByDateFrom(dateFromFormatted)
-        .assertDateFromChipGroupExist(true);
-    });
-  });
-
-  describe("Search admin events", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-    });
-
-    it("Check admin events search form fields display", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage
-        .goToEventsTab()
-        .goToAdminEventsSettingsSubTab()
-        .disableSaveEvents()
-        .save({ waitForRealm: false, waitForConfig: true });
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      adminEventsTab
-        .openSearchAdminEventDropdownMenu()
-        .assertAdminSearchDropdownMenuHasLabels();
-    });
-
-    it("Check `search admin events` button disabled by default", () => {
-      adminEventsTab
-        .openSearchAdminEventDropdownMenu()
-        .assertSearchAdminBtnEnabled(false);
-    });
-
-    it("Check admin events search and removal work", () => {
-      sidebarPage.goToEvents();
-      eventsPage
-        .goToAdminEventsTab()
-        .searchAdminEventByResourcePath("events/config")
-        .assertResourcePathChipGroupItemExist("events/config", true)
-        .removeResourcePathChipGroup();
-      listingPage.itemContainValue("UPDATE", 3, "UPDATE");
-    });
-
-    it("Check for no events logged", () => {
-      adminEventsTab
-        .searchAdminEventByResourcePath("events/test")
-        .assertNoSearchResultsExist(true);
-    });
-
-    it("Check `search admin events` button enabled", () => {
-      adminEventsTab
-        .openSearchAdminEventDropdownMenu()
-        .typeIpAddress("11111")
-        .assertSearchAdminBtnEnabled(true);
-    });
-  });
-
-  describe("Check more button opens auth and representation dialogs", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-    });
-
-    it("Check auth dialog opens and is not empty", () => {
-      listingPage.clickRowDetails("UPDATE").clickDetailMenu("Auth");
-      adminEventsTab.assertAuthDialogIsNotEmpty();
-    });
-
-    it("Check representation dialog opens and is not empty", () => {
-      listingPage.clickRowDetails("UPDATE").clickDetailMenu("Representation");
-      adminEventsTab.assertRepresentationDialogIsNotEmpty();
-    });
-  });
-
-  describe("Accessibility tests for events", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToEvents();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ user events tab", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations in user events search form", () => {
-      userEventsTab.openSearchUserEventDropdownMenu();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on admin events tab", () => {
-      eventsPage.goToAdminEventsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations in admin events search form", () => {
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      adminEventsTab.openSearchAdminEventDropdownMenu();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations in Auth dialog", () => {
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      listingPage.clickRowDetails("CREATE").clickDetailMenu("Auth");
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations in Representation dialog", () => {
-      sidebarPage.goToEvents();
-      eventsPage.goToAdminEventsTab();
-      listingPage.clickRowDetails("CREATE").clickDetailMenu("Representation");
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/group_test.spec.ts b/js/apps/admin-ui/cypress/e2e/group_test.spec.ts
deleted file mode 100644
index fb3d21dbe2d7..000000000000
--- a/js/apps/admin-ui/cypress/e2e/group_test.spec.ts
+++ /dev/null
@@ -1,539 +0,0 @@
-import GroupModal from "../support/pages/admin-ui/manage/groups/GroupModal";
-import GroupDetailPage from "../support/pages/admin-ui/manage/groups/group_details/GroupDetailPage";
-import AttributesTab from "../support/pages/admin-ui/manage/AttributesTab";
-import { SearchGroupPage } from "../support/pages/admin-ui/manage/groups/SearchGroupPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import GroupPage from "../support/pages/admin-ui/manage/groups/GroupPage";
-import ChildGroupsTab from "../support/pages/admin-ui/manage/groups/group_details/tabs/ChildGroupsTab";
-import MembersTab from "../support/pages/admin-ui/manage/groups/group_details/tabs/MembersTab";
-import adminClient from "../support/util/AdminClient";
-import { range } from "lodash-es";
-import RoleMappingTab from "../support/pages/admin-ui/manage/RoleMappingTab";
-import CommonPage from "../support/pages/CommonPage";
-
-describe("Group test", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const groupModal = new GroupModal();
-  const searchGroupPage = new SearchGroupPage();
-  const attributesTab = new AttributesTab();
-  const groupPage = new GroupPage();
-  const groupDetailPage = new GroupDetailPage();
-  const childGroupsTab = new ChildGroupsTab();
-  const membersTab = new MembersTab();
-  const commonPage = new CommonPage();
-
-  const groupNamePrefix = "group_";
-  let groupName: string;
-  const groupNames: string[] = [];
-  const predefinedGroups = ["level", "level1", "level2", "level3"];
-  const emptyGroup = "empty-group";
-  let users: { id: string; username: string }[] = [];
-  const username = "test-user";
-
-  const duplicatedGroupErrorMessage = {
-    mainGroup: "Could not create group Top level group named '",
-    childGroup: "Could not create group Sibling group named '",
-  };
-
-  before(async () => {
-    users = await Promise.all(
-      range(5).map((index) => {
-        const user = adminClient
-          .createUser({
-            username: username + index,
-            enabled: true,
-          })
-          .then((user) => {
-            return { id: user.id!, username: username + index };
-          });
-        return user;
-      }),
-    );
-  });
-
-  after(
-    async () =>
-      await Promise.all([
-        adminClient.deleteGroups(),
-        ...range(5).map((index) => adminClient.deleteUser(username + index)),
-      ]),
-  );
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToGroups();
-    groupName = groupNamePrefix + crypto.randomUUID();
-    groupNames.push(groupName);
-  });
-
-  describe("List", () => {
-    it("Create group from empty option", () => {
-      groupPage
-        .assertNoGroupsInThisRealmEmptyStateMessageExist(true)
-        .createGroup(groupName, true)
-        .assertNotificationGroupCreated()
-        .searchGroup(groupName, true)
-        .assertGroupItemExist(groupName, true);
-    });
-
-    it("Create group from search bar", () => {
-      groupPage
-        .assertNoGroupsInThisRealmEmptyStateMessageExist(false)
-        .createGroup(groupName, false)
-        .assertNotificationGroupCreated()
-        .searchGroup(groupName, true)
-        .assertGroupItemExist(groupName, true);
-    });
-
-    it("Fail to create group with empty name", () => {
-      groupPage
-        .assertNoGroupsInThisRealmEmptyStateMessageExist(false)
-        .createGroup(" ", false)
-        .assertNotificationCouldNotCreateGroupWithEmptyName();
-      groupModal.closeModal();
-    });
-
-    it("Fail to create group with duplicated name", () => {
-      groupPage
-        .assertNoGroupsInThisRealmEmptyStateMessageExist(false)
-        .createGroup(groupName, false)
-        .createGroup(groupName, false)
-        .assertNotificationCouldNotCreateGroupWithDuplicatedName(
-          groupName,
-          duplicatedGroupErrorMessage.mainGroup,
-        );
-      groupModal.closeModal();
-      groupPage.searchGroup(groupName).assertGroupItemsEqual(1);
-    });
-
-    it("Empty search", () => {
-      groupPage.searchGroup("   ").assertNoSearchResultsMessageExist(true);
-    });
-
-    it("Search group that exists", () => {
-      groupPage
-        .searchGroup(groupNames[0])
-        .assertGroupItemExist(groupNames[0], true);
-    });
-
-    it("Search group that does not exists", () => {
-      groupPage
-        .searchGroup("not-existent-group")
-        .assertNoSearchResultsMessageExist(true);
-    });
-
-    it("Duplicate group from item bar", () => {
-      groupPage
-        .duplicateGroupItem(groupNames[0])
-        .assertNotificationGroupDuplicated();
-    });
-
-    it("Delete group from item bar", () => {
-      groupPage
-        .searchGroup(groupNames[0], true)
-        .deleteGroupItem(groupNames[0])
-        .assertNotificationGroupDeleted()
-        .searchGroup(groupNames[0], true)
-        .assertNoSearchResultsMessageExist(true);
-    });
-
-    it("Delete group from search bar", () => {
-      groupPage
-        .selectGroupItemCheckbox([groupNames[1]])
-        .deleteSelectedGroups()
-        .assertNotificationGroupDeleted()
-        .searchGroup(groupNames[1])
-        .assertNoSearchResultsMessageExist(true);
-    });
-
-    it("Delete groups from search bar", () => {
-      cy.wrap(null).then(() =>
-        adminClient.createGroup("group_multiple_deletion_test"),
-      );
-      cy.reload();
-      groupPage
-        .selectGroupItemCheckboxAllRows()
-        .deleteSelectedGroups()
-        .assertNotificationGroupsDeleted()
-        .assertNoGroupsInThisRealmEmptyStateMessageExist(true);
-    });
-  });
-
-  describe("Search group under current group", () => {
-    before(async () => {
-      const createdGroups = await adminClient.createSubGroups(predefinedGroups);
-      await Promise.all([
-        range(5).map((index) => {
-          adminClient.addUserToGroup(
-            users[index].id!,
-            createdGroups[index % 3].id,
-          );
-        }),
-      ]);
-    });
-
-    it("Search child group in group", () => {
-      groupPage
-        .goToGroupChildGroupsTab(predefinedGroups[0])
-        .searchGroup(predefinedGroups[1])
-        .assertGroupItemExist(predefinedGroups[1], true);
-    });
-
-    it("Search non existing child group in group", () => {
-      groupPage
-        .goToGroupChildGroupsTab(predefinedGroups[0])
-        .searchGroup("non-existent-sub-group")
-        .assertNoSearchResultsMessageExist(true);
-    });
-
-    it("Empty search in group", () => {
-      groupPage
-        .goToGroupChildGroupsTab(predefinedGroups[0])
-        .searchGroup("   ")
-        .assertNoSearchResultsMessageExist(true);
-    });
-  });
-
-  describe("Group Actions", () => {
-    const groupNameDeleteHeaderAction = "group_test_delete_header_action";
-
-    before(async () => {
-      await adminClient.createGroup(groupNameDeleteHeaderAction);
-    });
-
-    after(async () => {
-      await adminClient.deleteGroups();
-    });
-
-    describe("Search globally", () => {
-      it("Navigate to parent group details", () => {
-        searchGroupPage
-          .searchGroup(predefinedGroups[0])
-          .goToGroupChildGroupsTab(predefinedGroups[0])
-          .assertGroupItemExist(predefinedGroups[1], true);
-      });
-    });
-
-    it("Rename group", () => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      groupDetailPage
-        .renameGroup("new_group_name")
-        .assertNotificationGroupUpdated()
-        .assertHeaderGroupNameEqual("new_group_name")
-        .renameGroup(predefinedGroups[0])
-        .assertNotificationGroupUpdated()
-        .assertHeaderGroupNameEqual(predefinedGroups[0]);
-    });
-
-    it("Delete group from group details", () => {
-      groupPage.goToGroupChildGroupsTab(groupNameDeleteHeaderAction);
-      groupDetailPage
-        .headerActionDeleteGroup()
-        .assertNotificationGroupDeleted()
-        .assertGroupItemExist(groupNameDeleteHeaderAction, false);
-    });
-  });
-
-  describe("Child Groups", () => {
-    before(async () => {
-      await adminClient.createGroup(predefinedGroups[0]);
-    });
-
-    after(async () => {
-      await adminClient.deleteGroups();
-    });
-
-    beforeEach(() => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-    });
-
-    it("Check empty state", () => {
-      childGroupsTab.assertNoGroupsInThisSubGroupEmptyStateMessageExist(true);
-    });
-
-    it("Create group from empty state", () => {
-      childGroupsTab
-        .createGroup(predefinedGroups[1], true)
-        .assertNotificationGroupCreated();
-    });
-
-    it("Create group from search bar", () => {
-      childGroupsTab
-        .createGroup(predefinedGroups[2], false)
-        .assertNotificationGroupCreated();
-    });
-
-    it("Fail to create group with empty name", () => {
-      childGroupsTab
-        .createGroup(" ", false)
-        .assertNotificationCouldNotCreateGroupWithEmptyName();
-    });
-
-    // https://github.com/keycloak/keycloak-admin-ui/issues/2726
-    it("Fail to create group with duplicated name", () => {
-      childGroupsTab
-        .createGroup(predefinedGroups[2], false)
-        .assertNotificationCouldNotCreateGroupWithDuplicatedName(
-          predefinedGroups[2],
-          duplicatedGroupErrorMessage.childGroup,
-        );
-    });
-
-    it("Move group from item bar", () => {
-      childGroupsTab
-        .moveGroupItemAction(predefinedGroups[1], [
-          predefinedGroups[0],
-          predefinedGroups[2],
-        ])
-        .goToGroupChildGroupsTab(predefinedGroups[2])
-        .assertGroupItemExist(predefinedGroups[1], true);
-    });
-
-    it("Search group", () => {
-      childGroupsTab
-        .searchGroup(predefinedGroups[2])
-        .assertGroupItemExist(predefinedGroups[2], true);
-    });
-
-    it("Show child group in groups", () => {
-      childGroupsTab
-        .goToGroupChildGroupsTab(predefinedGroups[2])
-        .goToGroupChildGroupsTab(predefinedGroups[1])
-        .assertNoGroupsInThisSubGroupEmptyStateMessageExist(true);
-    });
-
-    it("Delete group from search bar", () => {
-      childGroupsTab
-        .goToGroupChildGroupsTab(predefinedGroups[2])
-        .selectGroupItemCheckbox([predefinedGroups[1]])
-        .deleteSelectedGroups()
-        .assertNotificationGroupDeleted();
-    });
-
-    it("Delete group from item bar", () => {
-      childGroupsTab
-        .deleteGroupItem(predefinedGroups[2])
-        .assertNotificationGroupDeleted()
-        .assertNoGroupsInThisSubGroupEmptyStateMessageExist(true);
-    });
-  });
-
-  describe("Members", () => {
-    before(async () => {
-      const createdGroups = await adminClient.createSubGroups(predefinedGroups);
-      await Promise.all([
-        range(5).map((index) => {
-          adminClient.addUserToGroup(
-            users[index].id!,
-            createdGroups[index % 3].id,
-          );
-        }),
-        adminClient.createGroup(emptyGroup),
-        adminClient.createUser({ username: "new", enabled: true }),
-      ]);
-    });
-
-    after(() => adminClient.deleteUser("new"));
-
-    beforeEach(() => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      childGroupsTab.goToMembersTab();
-    });
-
-    it("Add member from search bar", () => {
-      membersTab
-        .addMember(["new"], false)
-        .assertNotificationUserAddedToTheGroup(1);
-    });
-
-    it("Show members with sub-group users", () => {
-      membersTab
-        .assertUserItemExist(users[0].username, true)
-        .assertUserItemExist("new", true)
-        .assertUserItemExist(users[3].username, true)
-        .clickCheckboxIncludeSubGroupUsers()
-        .assertUserItemExist("new", true)
-        .assertUserItemExist(users[0].username, true)
-        .assertUserItemExist(users[1].username, true)
-        .assertUserItemExist(users[2].username, true)
-        .assertUserItemExist(users[3].username, true)
-        .assertUserItemExist(users[4].username, true)
-        .goToChildGroupsTab()
-        .goToGroupChildGroupsTab(predefinedGroups[1])
-        .goToMembersTab()
-        .assertUserItemExist(users[1].username, true)
-        .assertUserItemExist(users[4].username, true)
-        .goToChildGroupsTab()
-        .goToGroupChildGroupsTab(predefinedGroups[2])
-        .goToMembersTab()
-        .assertUserItemExist(users[2].username, true);
-    });
-
-    it("Add member from empty state", () => {
-      sidebarPage.goToGroups();
-      groupPage.goToGroupChildGroupsTab(emptyGroup);
-      childGroupsTab.goToMembersTab();
-      membersTab
-        .addMember([users[0].username, users[1].username], true)
-        .assertNotificationUserAddedToTheGroup(2);
-    });
-
-    it("Leave group from search bar", () => {
-      sidebarPage.goToGroups();
-      groupPage.goToGroupChildGroupsTab(emptyGroup);
-      childGroupsTab.goToMembersTab();
-      membersTab
-        .selectUserItemCheckbox([users[0].username])
-        .leaveGroupSelectedUsers()
-        .assertNotificationUserLeftTheGroup(1)
-        .assertUserItemExist(users[0].username, false);
-    });
-
-    it("Leave group from item bar", () => {
-      sidebarPage.goToGroups();
-      groupPage.goToGroupChildGroupsTab(emptyGroup);
-      childGroupsTab.goToMembersTab();
-      membersTab
-        .leaveGroupUserItem(users[1].username)
-        .assertNotificationUserLeftTheGroup(1)
-        .assertNoUsersFoundEmptyStateMessageExist(true);
-    });
-
-    it("Show memberships from item bar", () => {
-      sidebarPage.goToGroups();
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      childGroupsTab.goToMembersTab();
-      membersTab
-        .showGroupMembershipsItem(users[3].username)
-        .assertGroupItemExist(predefinedGroups[0], true)
-        .cancelShowGroupMembershipsModal();
-    });
-  });
-
-  describe("Breadcrumbs", () => {
-    it("Navigate to parent group", () => {
-      groupPage
-        .goToGroupChildGroupsTab(predefinedGroups[0])
-        .goToGroupChildGroupsTab(predefinedGroups[1])
-        .goToGroupChildGroupsTab(predefinedGroups[2])
-        .goToGroupChildGroupsTab(predefinedGroups[3]);
-      cy.reload();
-      groupPage.clickBreadcrumbItem(predefinedGroups[2]);
-      groupDetailPage.assertHeaderGroupNameEqual(predefinedGroups[2]);
-      groupPage.clickBreadcrumbItem(predefinedGroups[1]);
-      groupDetailPage.assertHeaderGroupNameEqual(predefinedGroups[1]);
-      groupPage.clickBreadcrumbItem(predefinedGroups[0]);
-      groupDetailPage.assertHeaderGroupNameEqual(predefinedGroups[0]);
-      groupPage
-        .clickBreadcrumbItem("Groups")
-        .assertGroupItemExist(predefinedGroups[0], true);
-    });
-  });
-
-  describe("Attributes", () => {
-    beforeEach(() => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      groupDetailPage.goToAttributesTab();
-    });
-
-    it("Add attribute", () => {
-      attributesTab.addAttribute("key", "value").save();
-      groupPage.assertNotificationGroupUpdated();
-    });
-
-    it("Remove attribute", () => {
-      attributesTab.deleteAttribute(0);
-      attributesTab.assertEmpty();
-      groupPage.assertNotificationGroupUpdated();
-    });
-
-    it("Revert changes", () => {
-      attributesTab
-        .addAttribute("key", "value")
-        .addAnAttributeButton()
-        .revert()
-        .assertEmpty();
-    });
-  });
-
-  describe("'Move to' function", () => {
-    it("Move group to other group", () => {
-      groupPage
-        .moveGroupItemAction(predefinedGroups[0], [emptyGroup])
-        .goToGroupChildGroupsTab(emptyGroup)
-        .assertGroupItemExist(predefinedGroups[0], true);
-    });
-
-    it("Move group to root", () => {
-      groupPage
-        .goToGroupChildGroupsTab(emptyGroup)
-        .moveGroupItemAction(predefinedGroups[0], ["root"]);
-      sidebarPage.goToGroups();
-      groupPage.assertGroupItemExist(predefinedGroups[0], true);
-    });
-  });
-
-  describe("Role mappings", () => {
-    const roleMappingTab = new RoleMappingTab("group");
-
-    beforeEach(() => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      groupDetailPage.goToRoleMappingTab();
-    });
-
-    it("Check empty state", () => {
-      commonPage.emptyState().checkIfExists(true);
-    });
-
-    it("Assign roles from empty state", () => {
-      roleMappingTab.assignRole();
-      roleMappingTab
-        .changeRoleTypeFilter("roles")
-        .selectRow("default-roles-")
-        .assign();
-    });
-
-    it("Show and search roles", () => {
-      groupDetailPage.checkDefaultRole();
-    });
-
-    it("Check hide inherited roles option", () => {
-      roleMappingTab.unhideInheritedRoles();
-      roleMappingTab.hideInheritedRoles();
-    });
-
-    it("Remove roles", () => {
-      roleMappingTab.selectRow("default-roles");
-      roleMappingTab.unAssign();
-      groupDetailPage.deleteRole();
-    });
-  });
-
-  describe("Permissions", () => {
-    beforeEach(() => {
-      groupPage.goToGroupChildGroupsTab(predefinedGroups[0]);
-      groupDetailPage.goToPermissionsTab();
-    });
-
-    it("enable/disable permissions", () => {
-      groupDetailPage.enablePermissionSwitch();
-    });
-  });
-
-  describe("Accessibility tests for groups", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToGroups();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ groups", () => {
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/i18n_test.spec.ts b/js/apps/admin-ui/cypress/e2e/i18n_test.spec.ts
deleted file mode 100644
index 9d07d96d3bc2..000000000000
--- a/js/apps/admin-ui/cypress/e2e/i18n_test.spec.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-import RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ProviderPage from "../support/pages/admin-ui/manage/providers/ProviderPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-
-const providersPage = new ProviderPage();
-
-const usernameI18nTest = "user_i18n_test";
-let usernameI18nId: string;
-
-let originalMasterRealm: RealmRepresentation;
-
-describe("i18n tests", () => {
-  before(() => {
-    cy.wrap(null).then(async () => {
-      const realm = (await adminClient.getRealm("master"))!;
-      originalMasterRealm = realm;
-      realm.supportedLocales = ["en", "de", "de-CH", "fo"];
-      realm.internationalizationEnabled = true;
-      await adminClient.updateRealm("master", realm);
-
-      const { id: userId } = await adminClient.createUser({
-        username: usernameI18nTest,
-        enabled: true,
-        credentials: [
-          { type: "password", temporary: false, value: usernameI18nTest },
-        ],
-      });
-      usernameI18nId = userId!;
-
-      await adminClient.addRealmRoleToUser(usernameI18nId, "admin");
-    });
-  });
-
-  after(async () => {
-    await adminClient.deleteUser(usernameI18nTest);
-
-    if (originalMasterRealm) {
-      await adminClient.updateRealm("master", originalMasterRealm);
-    }
-  });
-
-  afterEach(async () => {
-    await adminClient.removeAllLocalizationTexts();
-  });
-
-  const realmLocalizationEn = "realmSettings en";
-  const themeLocalizationEn = "Realm settings";
-  const realmLocalizationDe = "realmSettings de";
-  const themeLocalizationDe = "Realm-Einstellungen";
-  const realmLocalizationDeCh = "realmSettings de-CH";
-
-  it("should use THEME localization for fallback (en) when language without theme localization is requested and no realm localization exists", () => {
-    updateUserLocale("fo");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(themeLocalizationEn);
-  });
-
-  it("should use THEME localization for language when language with theme localization is requested and no realm localization exists", () => {
-    updateUserLocale("de");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(themeLocalizationDe);
-  });
-
-  it("should use REALM localization for fallback (en) when language without theme localization is requested and realm localization exists for fallback (en)", () => {
-    addCommonRealmSettingsLocalizationText("en", realmLocalizationEn);
-    updateUserLocale("fo");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(realmLocalizationEn);
-  });
-
-  it("should use THEME localization for language when language with theme localization is requested and realm localization exists for fallback (en) only", () => {
-    addCommonRealmSettingsLocalizationText("en", realmLocalizationEn);
-    updateUserLocale("de");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(themeLocalizationDe);
-  });
-
-  it("should use REALM localization for language when language is requested and realm localization exists for language", () => {
-    addCommonRealmSettingsLocalizationText("de", realmLocalizationDe);
-    updateUserLocale("de");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(realmLocalizationDe);
-  });
-
-  // TODO: currently skipped due to https://github.com/keycloak/keycloak/issues/20412
-  it.skip("should use REALM localization for region when region is requested and realm localization exists for region", () => {
-    addCommonRealmSettingsLocalizationText("de-CH", realmLocalizationDeCh);
-    updateUserLocale("de-CH");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(realmLocalizationDeCh);
-  });
-
-  it("should use REALM localization for language when language is requested and realm localization exists for fallback (en), language, region", () => {
-    addCommonRealmSettingsLocalizationText("en", realmLocalizationEn);
-    addCommonRealmSettingsLocalizationText("de", realmLocalizationDe);
-    addCommonRealmSettingsLocalizationText("de-CH", realmLocalizationDeCh);
-    updateUserLocale("de");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(realmLocalizationDe);
-  });
-
-  it("should use REALM localization for language when region is requested and realm localization exists for fallback (en), language", () => {
-    addCommonRealmSettingsLocalizationText("en", realmLocalizationEn);
-    addCommonRealmSettingsLocalizationText("de", realmLocalizationDe);
-    updateUserLocale("de-CH");
-
-    goToUserFederationPage();
-
-    sidebarPage.checkRealmSettingsLinkContainsText(realmLocalizationDe);
-  });
-
-  it("should apply plurals and interpolation for THEME localization", () => {
-    updateUserLocale("en");
-
-    goToUserFederationPage();
-
-    providersPage.assertCardContainsText("ldap", "Add Ldap providers");
-  });
-
-  it("should apply plurals and interpolation for REALM localization", () => {
-    addLocalization(
-      "en",
-      "addProvider_other",
-      "addProvider_other en: {{provider}}",
-    );
-    updateUserLocale("en");
-
-    goToUserFederationPage();
-
-    providersPage.assertCardContainsText("ldap", "addProvider_other en: Ldap");
-  });
-
-  function goToUserFederationPage() {
-    loginPage.logIn(usernameI18nTest, usernameI18nTest);
-    keycloakBefore();
-    sidebarPage.goToUserFederation();
-  }
-
-  function updateUserLocale(locale: string) {
-    cy.wrap(null).then(() =>
-      adminClient.updateUser(usernameI18nId, {
-        attributes: { locale: locale },
-      }),
-    );
-  }
-
-  function addCommonRealmSettingsLocalizationText(
-    locale: string,
-    value: string,
-  ) {
-    addLocalization(locale, "realmSettings", value);
-  }
-
-  function addLocalization(locale: string, key: string, value: string) {
-    cy.wrap(null).then(() =>
-      adminClient.addLocalizationText(locale, key, value),
-    );
-  }
-});
diff --git a/js/apps/admin-ui/cypress/e2e/identity_providers_oidc_test.spec.ts b/js/apps/admin-ui/cypress/e2e/identity_providers_oidc_test.spec.ts
deleted file mode 100644
index a593a96a1036..000000000000
--- a/js/apps/admin-ui/cypress/e2e/identity_providers_oidc_test.spec.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-import { SERVER_URL } from "../support/constants";
-import LoginPage from "../support/pages/LoginPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import AddMapperPage from "../support/pages/admin-ui/manage/identity_providers/AddMapperPage";
-import CreateProviderPage from "../support/pages/admin-ui/manage/identity_providers/CreateProviderPage";
-import ProviderBaseAdvancedSettingsPage, {
-  ClientAssertionSigningAlg,
-  ClientAuthentication,
-  PromptSelect,
-} from "../support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage";
-import ProviderBaseGeneralSettingsPage from "../support/pages/admin-ui/manage/identity_providers/ProviderBaseGeneralSettingsPage";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-describe("OIDC identity provider test", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const masthead = new Masthead();
-  const listingPage = new ListingPage();
-  const createProviderPage = new CreateProviderPage();
-  const addMapperPage = new AddMapperPage();
-
-  const createSuccessMsg = "Identity provider successfully created";
-  const createMapperSuccessMsg = "Mapper created successfully.";
-
-  const deletePrompt = "Delete provider?";
-  const deleteSuccessMsg = "Provider successfully deleted.";
-
-  const discoveryUrl = `${SERVER_URL}/realms/master/.well-known/openid-configuration`;
-  const authorizationUrl = `${SERVER_URL}/realms/master/protocol/openid-connect/auth`;
-
-  describe("OIDC Identity provider creation", () => {
-    const oidcProviderName = "oidc";
-    const secret = "123";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToIdentityProviders();
-    });
-
-    it("should create an OIDC provider using discovery url", () => {
-      createProviderPage
-        .checkVisible(oidcProviderName)
-        .clickCard(oidcProviderName);
-
-      // createProviderPage.checkAddButtonDisabled();
-
-      createProviderPage
-        .fillDiscoveryUrl(discoveryUrl)
-        .shouldBeSuccessful()
-        .fillDisplayName(oidcProviderName)
-        .fill(oidcProviderName, secret)
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-      createProviderPage.shouldHaveAuthorizationUrl(authorizationUrl);
-    });
-
-    it("should test all settings", () => {
-      const providerBaseGeneralSettingsPage =
-        new ProviderBaseGeneralSettingsPage();
-      const providerBaseAdvancedSettingsPage =
-        new ProviderBaseAdvancedSettingsPage();
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(oidcProviderName);
-      //general settings
-      cy.findByTestId("displayName").click().type("OIDC");
-      cy.findByTestId("jump-link-general-settings").click();
-      providerBaseGeneralSettingsPage.typeDisplayOrder("1");
-      createProviderPage.clickSave();
-      masthead.checkNotificationMessage("Provider successfully updated", true);
-
-      //OIDC Settings and save/revert buttons
-      providerBaseAdvancedSettingsPage.assertOIDCUrl("authorization");
-      providerBaseAdvancedSettingsPage.assertOIDCUrl("token");
-      //OIDC Switches
-      providerBaseAdvancedSettingsPage.assertOIDCSignatureSwitch();
-      providerBaseAdvancedSettingsPage.assertOIDCPKCESwitch();
-      //Client Authentication
-      providerBaseAdvancedSettingsPage.assertOIDCClientAuthentication(
-        ClientAuthentication.basicAuth,
-      );
-      providerBaseAdvancedSettingsPage.assertOIDCClientAuthentication(
-        ClientAuthentication.post,
-      );
-      providerBaseAdvancedSettingsPage.assertOIDCClientAuthentication(
-        ClientAuthentication.jwt,
-      );
-      providerBaseAdvancedSettingsPage.assertOIDCClientAuthentication(
-        ClientAuthentication.jwtPrivKey,
-      );
-      //Client assertion signature algorithm
-      Object.entries(ClientAssertionSigningAlg).forEach(([, value]) => {
-        providerBaseAdvancedSettingsPage.assertOIDCClientAuthSignAlg(value);
-      });
-      //Client assertion audience
-      providerBaseAdvancedSettingsPage.typeClientAssertionAudience(
-        "http://localhost:8180",
-      );
-      providerBaseAdvancedSettingsPage.assertClientAssertionAudienceInputEqual(
-        "http://localhost:8180",
-      );
-      //JWT X509 Headers
-      providerBaseAdvancedSettingsPage.assertOIDCJWTX509HeadersSwitch();
-      //OIDC Advanced Settings
-      providerBaseAdvancedSettingsPage.assertOIDCSettingsAdvancedSwitches();
-      providerBaseAdvancedSettingsPage.selectPromptOption(PromptSelect.none);
-      providerBaseAdvancedSettingsPage.selectPromptOption(PromptSelect.consent);
-      providerBaseAdvancedSettingsPage.selectPromptOption(PromptSelect.login);
-      providerBaseAdvancedSettingsPage.selectPromptOption(PromptSelect.select);
-      providerBaseAdvancedSettingsPage.selectPromptOption(
-        PromptSelect.unspecified,
-      );
-      //Advanced Settings
-      providerBaseAdvancedSettingsPage.assertAdvancedSettings();
-    });
-
-    it("should add OIDC mapper of type Attribute Importer", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(oidcProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.emptyStateAddMapper();
-      addMapperPage.addOIDCAttrImporterMapper("OIDC Attribute Importer");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add OIDC mapper of type Claim To Role", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(oidcProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addOIDCClaimToRoleMapper("OIDC Claim to Role");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should cancel the addition of the OIDC mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(oidcProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.cancelNewMapper();
-      addMapperPage.shouldGoToMappersTab();
-    });
-
-    it("clean up providers", () => {
-      const modalUtils = new ModalUtils();
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(oidcProviderName).deleteItem(oidcProviderName);
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/identity_providers_saml_test.spec.ts b/js/apps/admin-ui/cypress/e2e/identity_providers_saml_test.spec.ts
deleted file mode 100644
index 32b935f5f495..000000000000
--- a/js/apps/admin-ui/cypress/e2e/identity_providers_saml_test.spec.ts
+++ /dev/null
@@ -1,189 +0,0 @@
-import { SERVER_URL } from "../support/constants";
-import LoginPage from "../support/pages/LoginPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import AddMapperPage from "../support/pages/admin-ui/manage/identity_providers/AddMapperPage";
-import CreateProviderPage from "../support/pages/admin-ui/manage/identity_providers/CreateProviderPage";
-import ProviderSAMLSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderSAMLSettings";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-describe("SAML identity provider test", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const masthead = new Masthead();
-  const listingPage = new ListingPage();
-  const createProviderPage = new CreateProviderPage();
-  const addMapperPage = new AddMapperPage();
-
-  const createSuccessMsg = "Identity provider successfully created";
-  const saveSuccessMsg = "Provider successfully updated";
-
-  const createMapperSuccessMsg = "Mapper created successfully.";
-  const saveMapperSuccessMsg = "Mapper saved successfully.";
-
-  const deletePrompt = "Delete provider?";
-  const deleteSuccessMsg = "Provider successfully deleted.";
-
-  const classRefName = "acClassRef-1";
-  const declRefName = "acDeclRef-1";
-
-  const samlDiscoveryUrl = `${SERVER_URL}/realms/master/protocol/saml/descriptor`;
-  const samlDisplayName = "saml";
-
-  describe("SAML identity provider creation", () => {
-    const samlProviderName = "saml";
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToIdentityProviders();
-    });
-
-    it("should create a SAML provider using entity descriptor", () => {
-      createProviderPage
-        .checkVisible(samlProviderName)
-        .clickCard(samlProviderName);
-      // createProviderPage.checkAddButtonDisabled();
-      createProviderPage
-        .fillDisplayName(samlDisplayName)
-        .fillDiscoveryUrl(samlDiscoveryUrl)
-        .shouldBeSuccessful()
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-    });
-
-    it("should add auth constraints to existing SAML provider", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      createProviderPage
-        .fillAuthnContextClassRefs(classRefName)
-        .clickClassRefsAdd()
-        .fillAuthnContextDeclRefs(declRefName)
-        .clickDeclRefsAdd()
-        .clickSave();
-      masthead.checkNotificationMessage(saveSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Advanced Attribute to Role", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.emptyStateAddMapper();
-      addMapperPage.addAdvancedAttrToRoleMapper("SAML mapper");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Username Template Importer", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addUsernameTemplateImporterMapper(
-        "SAML Username Template Importer Mapper",
-      );
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Hardcoded User Session Attribute", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addHardcodedUserSessionAttrMapper(
-        "Hardcoded User Session Attribute",
-      );
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Attribute Importer", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addSAMLAttrImporterMapper("Attribute Importer");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Hardcoded Role", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addHardcodedRoleMapper("Hardcoded Role");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type Hardcoded Attribute", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addHardcodedAttrMapper("Hardcoded Attribute");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add SAML mapper of type SAML Attribute To Role", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.addSAMLAttributeToRoleMapper("SAML Attribute To Role");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should edit Username Template Importer mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      listingPage.goToItemDetails("SAML Username Template Importer Mapper");
-      addMapperPage.editUsernameTemplateImporterMapper();
-      masthead.checkNotificationMessage(saveMapperSuccessMsg, true);
-    });
-
-    it("should edit SAML mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      addMapperPage.goToMappersTab();
-      listingPage.goToItemDetails("SAML mapper");
-      addMapperPage.editSAMLorOIDCMapper();
-      masthead.checkNotificationMessage(saveMapperSuccessMsg, true);
-    });
-
-    it("should edit SAML settings", () => {
-      const providerSAMLSettings = new ProviderSAMLSettings();
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails(samlProviderName);
-      providerSAMLSettings.disableProviderSwitch();
-      sidebarPage.goToIdentityProviders();
-      cy.findByText("Disabled");
-      listingPage.goToItemDetails(samlProviderName);
-      providerSAMLSettings.enableProviderSwitch();
-
-      cy.get(".pf-v5-c-jump-links__list").contains("SAML settings").click();
-      providerSAMLSettings.assertIdAndURLFields();
-      providerSAMLSettings.assertNameIdPolicyFormat();
-      providerSAMLSettings.assertPrincipalType();
-      providerSAMLSettings.assertSAMLSwitches();
-      providerSAMLSettings.assertSignatureAlgorithm();
-      providerSAMLSettings.assertValidateSignatures();
-      providerSAMLSettings.assertTextFields();
-
-      cy.get(".pf-v5-c-jump-links__list")
-        .contains("Requested AuthnContext Constraints")
-        .click();
-      providerSAMLSettings.assertAuthnContext();
-    });
-
-    it("clean up providers", () => {
-      const modalUtils = new ModalUtils();
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(samlProviderName).deleteItem(samlProviderName);
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/identity_providers_test.spec.ts b/js/apps/admin-ui/cypress/e2e/identity_providers_test.spec.ts
deleted file mode 100644
index d7d1679c2e3f..000000000000
--- a/js/apps/admin-ui/cypress/e2e/identity_providers_test.spec.ts
+++ /dev/null
@@ -1,408 +0,0 @@
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-
-import CreateProviderPage from "../support/pages/admin-ui/manage/identity_providers/CreateProviderPage";
-import ModalUtils from "../support/util/ModalUtils";
-import OrderDialog from "../support/pages/admin-ui/manage/identity_providers/OrderDialog";
-import AddMapperPage from "../support/pages/admin-ui/manage/identity_providers/AddMapperPage";
-import ProviderFacebookGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderFacebookGeneralSettings";
-import ProviderBaseGeneralSettingsPage from "../support/pages/admin-ui/manage/identity_providers/ProviderBaseGeneralSettingsPage";
-import ProviderBaseAdvancedSettingsPage from "../support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage";
-import ProviderGithubGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderGithubGeneralSettings";
-import ProviderGoogleGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderGoogleGeneralSettings";
-import ProviderMicrosoftGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderMicrosoftGeneralSettings";
-import ProviderOpenshiftGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderOpenshiftGeneralSettings";
-import ProviderPaypalGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderPaypalGeneralSettings";
-import ProviderStackoverflowGeneralSettings from "../support/pages/admin-ui/manage/identity_providers/social/ProviderStackoverflowGeneralSettings";
-import adminClient from "../support/util/AdminClient";
-import GroupPage from "../support/pages/admin-ui/manage/groups/GroupPage";
-import CommonPage from "../support/pages/CommonPage";
-
-describe("Identity provider test", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const masthead = new Masthead();
-  const listingPage = new ListingPage();
-  const createProviderPage = new CreateProviderPage();
-  const addMapperPage = new AddMapperPage();
-  const groupPage = new GroupPage();
-  const commonPage = new CommonPage();
-
-  const createSuccessMsg = "Identity provider successfully created";
-  const createFailMsg =
-    "Could not create the identity provider: Identity Provider github already exists";
-  const createMapperSuccessMsg = "Mapper created successfully.";
-
-  const changeSuccessMsg =
-    "Successfully changed display order of identity providers";
-  const deletePrompt = "Delete provider?";
-  const deleteSuccessMsg = "Provider successfully deleted.";
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToIdentityProviders();
-  });
-
-  const socialLoginIdentityProvidersWithCustomFiels = {
-    Facebook: new ProviderFacebookGeneralSettings(),
-    Github: new ProviderGithubGeneralSettings(),
-    Google: new ProviderGoogleGeneralSettings(),
-    Microsoft: new ProviderMicrosoftGeneralSettings(),
-    "Openshift-v3": new ProviderOpenshiftGeneralSettings(),
-    "Openshift-v4": new ProviderOpenshiftGeneralSettings(),
-    Paypal: new ProviderPaypalGeneralSettings(),
-    Stackoverflow: new ProviderStackoverflowGeneralSettings(),
-  };
-  function getSocialIdpClassInstance(idpTestName: string) {
-    let instance = new ProviderBaseGeneralSettingsPage();
-    Object.entries(socialLoginIdentityProvidersWithCustomFiels).find(
-      ([key, value]) => {
-        if (key === idpTestName) {
-          instance = value;
-          return true;
-        }
-        return false;
-      },
-    );
-    return instance;
-  }
-
-  describe("Identity provider creation", () => {
-    const identityProviderName = "github";
-
-    describe("Custom fields tests", () => {
-      const socialLoginIdentityProviders = [
-        { testName: "Bitbucket", displayName: "BitBucket", alias: "bitbucket" },
-        { testName: "Facebook", displayName: "Facebook", alias: "facebook" },
-        { testName: "Github", displayName: "GitHub", alias: "github" },
-        { testName: "Gitlab", displayName: "Gitlab", alias: "gitlab" },
-        { testName: "Google", displayName: "Google", alias: "google" },
-        { testName: "Instagram", displayName: "Instagram", alias: "instagram" },
-        {
-          testName: "LinkedIn",
-          displayName: "LinkedIn",
-          alias: "linkedin-openid-connect",
-        },
-        { testName: "Microsoft", displayName: "Microsoft", alias: "microsoft" },
-        {
-          testName: "Openshift-v4",
-          displayName: "Openshift v4",
-          alias: "openshift-v4",
-        },
-        { testName: "Paypal", displayName: "PayPal", alias: "paypal" },
-        {
-          testName: "Stackoverflow",
-          displayName: "StackOverflow",
-          alias: "stackoverflow",
-        },
-        { testName: "Twitter", displayName: "Twitter", alias: "twitter" },
-      ];
-
-      after(async () => {
-        await Promise.all(
-          socialLoginIdentityProviders.map((idp) =>
-            adminClient.deleteIdentityProvider(idp.alias),
-          ),
-        );
-      });
-
-      socialLoginIdentityProviders.forEach(($idp, linkedIdpsCount) => {
-        it(`should create social login provider ${$idp.testName} with custom fields`, () => {
-          if (linkedIdpsCount == 0) {
-            createProviderPage.clickCard($idp.alias);
-          } else {
-            createProviderPage.clickCreateDropdown().clickItem($idp.alias);
-          }
-          const instance = getSocialIdpClassInstance($idp.testName);
-          instance
-            .typeClientId("1")
-            .typeClientId("")
-            .typeClientSecret("1")
-            .typeClientSecret("")
-            .assertRequiredFieldsErrorsExist()
-            .fillData($idp.testName)
-            .clickAdd()
-            .assertNotificationIdpCreated()
-            .assertFilledDataEqual($idp.testName);
-        });
-      });
-    });
-
-    it("should create github provider", () => {
-      createProviderPage.checkGitHubCardVisible().clickGitHubCard();
-
-      createProviderPage.checkAddButtonDisabled();
-      createProviderPage.fill(identityProviderName).checkAddButtonDisabled();
-      createProviderPage.fill(identityProviderName, "123").clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(identityProviderName);
-    });
-
-    it("fail to make duplicate github provider", () => {
-      createProviderPage
-        .clickCreateDropdown()
-        .clickItem("github")
-        .fill("github2", "123")
-        .clickAdd();
-      masthead.checkNotificationMessage(createFailMsg, true);
-    });
-
-    it("should create facebook provider", () => {
-      createProviderPage
-        .clickCreateDropdown()
-        .clickItem("facebook")
-        .fill("facebook", "123")
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-    });
-
-    it("search for existing provider by name", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.searchItem(identityProviderName, false);
-      listingPage.itemExist(identityProviderName, true);
-    });
-
-    it("search for non-existing provider by name", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.searchItem("not-existing-provider", false);
-      groupPage.assertNoSearchResultsMessageExist(true);
-    });
-
-    it("create and delete provider by item details", () => {
-      createProviderPage
-        .clickCreateDropdown()
-        .clickItem("linkedin-openid-connect")
-        .fill("linkedin-openid-connect", "123")
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-
-      commonPage
-        .actionToolbarUtils()
-        .clickActionToggleButton()
-        .clickDropdownItem("Delete");
-
-      const modalUtils = new ModalUtils();
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-
-    it.skip("should change order of providers", () => {
-      const orderDialog = new OrderDialog();
-      const providers = [identityProviderName, "facebook", "bitbucket"];
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist("facebook");
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(identityProviderName);
-
-      createProviderPage
-        .clickCreateDropdown()
-        .clickItem("bitbucket")
-        .fill("bitbucket", "123")
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-
-      cy.wait(2000);
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(identityProviderName);
-
-      orderDialog.openDialog().checkOrder(providers);
-      orderDialog.moveRowTo("facebook", identityProviderName);
-
-      orderDialog.checkOrder(["bitbucket", identityProviderName, "facebook"]);
-
-      orderDialog.clickSave();
-      masthead.checkNotificationMessage(changeSuccessMsg);
-    });
-
-    it("should delete provider", () => {
-      const modalUtils = new ModalUtils();
-      listingPage.deleteItem(identityProviderName);
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-
-    it("should add facebook social mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("facebook");
-      addMapperPage.goToMappersTab();
-      addMapperPage.emptyStateAddMapper();
-      addMapperPage.fillSocialMapper("facebook mapper");
-      // addMapperPage.saveNewMapper();
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should add Social mapper of type Attribute Importer", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("facebook");
-      addMapperPage.goToMappersTab();
-      addMapperPage.addMapper();
-      addMapperPage.fillSocialMapper("facebook attribute importer");
-      masthead.checkNotificationMessage(createMapperSuccessMsg, true);
-    });
-
-    it("should edit facebook mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("facebook");
-      addMapperPage.goToMappersTab();
-      listingPage.goToItemDetails("facebook attribute importer");
-      addMapperPage.editSocialMapper();
-    });
-
-    it("should delete facebook mapper", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("facebook");
-      addMapperPage.goToMappersTab();
-      listingPage.deleteItem("facebook attribute importer");
-      cy.findByTestId("confirm").click();
-    });
-
-    it("clean up providers", () => {
-      const modalUtils = new ModalUtils();
-
-      // TODO: Re-enable this code when the 'should change order of providers' is no longer skipped.
-      // sidebarPage.goToIdentityProviders();
-      // listingPage.itemExist("bitbucket").deleteItem("bitbucket");
-      // modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      // masthead.checkNotificationMessage(deleteSuccessMsg, true);
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist("facebook").deleteItem("facebook");
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-  });
-
-  describe("should check provider details", () => {
-    const identityProviderName = "github";
-    const githubSettings = new ProviderGithubGeneralSettings();
-    const advancedSettings = new ProviderBaseAdvancedSettingsPage();
-
-    it("creating github provider", () => {
-      createProviderPage.checkGitHubCardVisible().clickGitHubCard();
-
-      createProviderPage.checkAddButtonDisabled();
-      createProviderPage
-        .fill(identityProviderName)
-        .fill(identityProviderName, "123")
-        .clickAdd();
-      masthead.checkNotificationMessage(createSuccessMsg, true);
-
-      sidebarPage.goToIdentityProviders();
-      listingPage.itemExist(identityProviderName);
-    });
-
-    it("should check general settings", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("github");
-
-      githubSettings.fillData("github");
-      cy.findByTestId("idp-details-save").click();
-    });
-
-    it("should check input switches and inputs", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("github");
-
-      advancedSettings.typeScopesInput("openid");
-      advancedSettings.assertScopesInputEqual("openid");
-
-      advancedSettings.assertStoreTokensSwitchTurnedOn(false);
-      advancedSettings.assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(
-        false,
-      );
-      advancedSettings.assertDisableUserInfoSwitchTurnedOn(false);
-      advancedSettings.assertTrustEmailSwitchTurnedOn(false);
-      advancedSettings.assertAccountLinkingOnlySwitchTurnedOn(false);
-      advancedSettings.assertHideOnLoginPageSwitchTurnedOn(false);
-
-      advancedSettings.clickStoreTokensSwitch();
-      advancedSettings.clickAcceptsPromptNoneForwardFromClientSwitch();
-      advancedSettings.clickDisableUserInfoSwitch();
-      advancedSettings.clickTrustEmailSwitch();
-      advancedSettings.clickAccountLinkingOnlySwitch();
-      advancedSettings.clickHideOnLoginPageSwitch();
-      advancedSettings.assertDoNotImportUsersSwitchTurnedOn(false);
-      advancedSettings.assertSyncModeShown(true);
-      advancedSettings.clickdoNotStoreUsersSwitch();
-      advancedSettings.assertDoNotImportUsersSwitchTurnedOn(true);
-      advancedSettings.assertSyncModeShown(false);
-      advancedSettings.clickdoNotStoreUsersSwitch();
-      advancedSettings.assertDoNotImportUsersSwitchTurnedOn(false);
-      advancedSettings.assertSyncModeShown(true);
-
-      advancedSettings.clickEssentialClaimSwitch();
-      advancedSettings.typeClaimNameInput("claim-name");
-      advancedSettings.typeClaimValueInput("claim-value");
-
-      advancedSettings.ensureAdvancedSettingsAreVisible();
-      advancedSettings.assertStoreTokensSwitchTurnedOn(true);
-      advancedSettings.assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(
-        true,
-      );
-      advancedSettings.assertDisableUserInfoSwitchTurnedOn(true);
-      advancedSettings.assertTrustEmailSwitchTurnedOn(true);
-      advancedSettings.assertAccountLinkingOnlySwitchTurnedOn(true);
-      advancedSettings.assertHideOnLoginPageSwitchTurnedOn(true);
-      advancedSettings.assertEssentialClaimSwitchTurnedOn(true);
-      advancedSettings.assertClaimInputEqual("claim-name");
-      advancedSettings.assertClaimValueInputEqual("claim-value");
-
-      cy.findByTestId("idp-details-save").click();
-      masthead.checkNotificationMessage("Provider successfully updated");
-    });
-
-    it("should revert and save options", () => {
-      sidebarPage.goToIdentityProviders();
-      listingPage.goToItemDetails("github");
-
-      cy.findByTestId("jump-link-advanced-settings").click();
-      advancedSettings.assertStoreTokensSwitchTurnedOn(true);
-      advancedSettings.assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(
-        true,
-      );
-      advancedSettings.clickStoreTokensSwitch();
-      advancedSettings.clickAcceptsPromptNoneForwardFromClientSwitch();
-      advancedSettings.ensureAdvancedSettingsAreVisible();
-      advancedSettings.assertStoreTokensSwitchTurnedOn(false);
-      advancedSettings.assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(
-        false,
-      );
-      cy.findByTestId("idp-details-revert").click();
-      advancedSettings.assertStoreTokensSwitchTurnedOn(true);
-      advancedSettings.assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(
-        true,
-      );
-    });
-
-    it("should delete providers", () => {
-      const modalUtils = new ModalUtils();
-      sidebarPage.goToIdentityProviders();
-
-      listingPage.itemExist("github").deleteItem("github");
-      modalUtils.checkModalTitle(deletePrompt).confirmModal();
-      masthead.checkNotificationMessage(deleteSuccessMsg, true);
-    });
-  });
-
-  describe("Accessibility tests for identity providers", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToIdentityProviders();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ identity providers", () => {
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/masthead_test.spec.ts b/js/apps/admin-ui/cypress/e2e/masthead_test.spec.ts
deleted file mode 100644
index 112d36622b5b..000000000000
--- a/js/apps/admin-ui/cypress/e2e/masthead_test.spec.ts
+++ /dev/null
@@ -1,139 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const helpLabel = ".pf-v5-c-form__group-label-help";
-
-describe("Masthead tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-  });
-
-  describe("Desktop view", () => {
-    it("Go to account console and back to admin console", () => {
-      sidebarPage.waitForPageLoad();
-      masthead.accountManagement();
-      cy.url().should("contain", "/realms/master/account");
-    });
-
-    it("Sign out reachs to log in screen", () => {
-      sidebarPage.waitForPageLoad();
-      masthead.signOut();
-      sidebarPage.waitForPageLoad();
-      loginPage.isLogInPage();
-    });
-
-    it("Go to realm info", () => {
-      sidebarPage.goToClients();
-      masthead.toggleUsernameDropdown().clickRealmInfo();
-      cy.get(".pf-v5-l-grid").should("contain.text", "Welcome");
-    });
-
-    it("Should go to documentation page", () => {
-      masthead.clickGlobalHelp();
-      masthead
-        .getDocumentationLink()
-        .invoke("attr", "href")
-        .then((href) => {
-          if (!href) return;
-
-          masthead.clickDocumentationLink();
-          cy.origin(href, () => {
-            cy.get("#header").should(
-              "contain.text",
-              "Server Administration Guide",
-            );
-          });
-        });
-    });
-
-    it("Enable/disable help mode in desktop mode", () => {
-      masthead.assertIsDesktopView();
-      cy.findByTestId("infoTab").click();
-      cy.get(helpLabel).should("exist");
-      masthead.toggleGlobalHelp();
-      masthead.clickGlobalHelp();
-      cy.get(helpLabel).should("not.exist");
-      masthead.toggleGlobalHelp();
-      cy.get(helpLabel).should("exist");
-    });
-  });
-
-  describe("Login works for unprivileged users", () => {
-    const realmName = `test-realm-${crypto.randomUUID()}`;
-    const username = `test-user-${crypto.randomUUID()}`;
-
-    before(async () => {
-      await adminClient.createRealm(realmName, { enabled: true });
-
-      await adminClient.inRealm(realmName, () =>
-        adminClient.createUser({
-          username,
-          enabled: true,
-          emailVerified: true,
-          credentials: [{ type: "password", value: "test" }],
-          firstName: "Test",
-          lastName: "User",
-          email: "test@keycloak.org",
-        }),
-      );
-    });
-
-    after(() => adminClient.deleteRealm(realmName));
-
-    it("Login without privileges to see admin console", () => {
-      sidebarPage.waitForPageLoad();
-      masthead.signOut();
-
-      cy.visit(`/admin/${realmName}/console`);
-
-      cy.get('[role="progressbar"]').should("not.exist");
-      cy.get("#username").type(username);
-      cy.get("#password").type("test");
-
-      cy.get("#kc-login").click();
-
-      sidebarPage.waitForPageLoad();
-      masthead.signOut();
-      sidebarPage.waitForPageLoad();
-      loginPage.isLogInPage();
-    });
-  });
-
-  describe("Mobile view", () => {
-    it("Mobile menu is shown when in mobile view", () => {
-      cy.viewport("samsung-s10");
-      masthead.assertIsMobileView();
-    });
-
-    it("Enable/disable help mode in mobile view", () => {
-      cy.viewport("samsung-s10");
-      masthead
-        .assertIsMobileView()
-        .toggleUsernameDropdown()
-        .toggleMobileViewHelp();
-      masthead.toggleMobileViewHelp();
-      cy.findByTestId("helpIcon").should("exist");
-    });
-  });
-
-  describe("Accessibility tests for masthead", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.waitForPageLoad();
-      masthead.accountManagement();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ masthead", () => {
-      cy.checkA11y();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/organization.spec.ts b/js/apps/admin-ui/cypress/e2e/organization.spec.ts
deleted file mode 100644
index e30853e0b529..000000000000
--- a/js/apps/admin-ui/cypress/e2e/organization.spec.ts
+++ /dev/null
@@ -1,148 +0,0 @@
-import Form from "../support/forms/Form";
-import LoginPage from "../support/pages/LoginPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import IdentityProviderTab from "../support/pages/admin-ui/manage/organization/IdentityProviderTab";
-import MembersTab from "../support/pages/admin-ui/manage/organization/MemberTab";
-import OrganizationPage from "../support/pages/admin-ui/manage/organization/OrganizationPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-
-const loginPage = new LoginPage();
-const listingPage = new ListingPage();
-const page = new OrganizationPage();
-const realmSettingsPage = new RealmSettingsPage();
-const sidebarPage = new SidebarPage();
-
-describe.skip("Organization CRUD", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.setSwitch("organizationsEnabled", true);
-    realmSettingsPage.saveGeneral();
-  });
-
-  it("should create new organization", () => {
-    page.goToTab();
-    page.goToCreate();
-    Form.assertSaveButtonDisabled();
-    page.fillCreatePage({ name: "orgName" });
-    Form.assertSaveButtonEnabled();
-    page.fillCreatePage({
-      name: "orgName",
-      domain: ["ame.org", "test.nl"],
-      description: "some description",
-    });
-    Form.clickSaveButton();
-    page.assertSaveSuccess();
-  });
-
-  it("should modify existing organization", () => {
-    cy.wrap(null).then(() =>
-      adminClient.createOrganization({
-        name: "editName",
-        domains: [{ name: "go.org", verified: false }],
-      }),
-    );
-    page.goToTab();
-
-    listingPage.goToItemDetails("editName");
-    const newValue = "newName";
-    page.fillNameField(newValue).should("have.value", newValue);
-    Form.clickSaveButton();
-    page.assertSaveSuccess();
-    page.goToTab();
-    listingPage.itemExist(newValue);
-  });
-
-  it("should delete from list", () => {
-    page.goToTab();
-    listingPage.deleteItem("orgName");
-    page.modalUtils().confirmModal();
-    page.assertDeleteSuccess();
-  });
-
-  it.skip("should delete from details page", () => {
-    page.goToTab();
-    listingPage.goToItemDetails("newName");
-
-    page
-      .actionToolbarUtils()
-      .clickActionToggleButton()
-      .clickDropdownItem("Delete");
-    page.modalUtils().confirmModal();
-
-    page.assertDeleteSuccess();
-  });
-});
-
-describe.skip("Members", () => {
-  const membersTab = new MembersTab();
-
-  before(() => {
-    adminClient.createOrganization({
-      name: "member",
-      domains: [{ name: "o.com", verified: false }],
-    });
-    adminClient.createUser({ username: "realm-user", enabled: true });
-  });
-
-  after(() => {
-    adminClient.deleteOrganization("member");
-    adminClient.deleteUser("realm-user");
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    page.goToTab();
-  });
-
-  it("should add member", () => {
-    listingPage.goToItemDetails("member");
-    membersTab.goToTab();
-    membersTab.clickAddRealmUser();
-    membersTab.modalUtils().assertModalVisible(true);
-    membersTab.modalUtils().table().selectRowItemCheckbox("realm-user");
-    membersTab.modalUtils().add();
-    membersTab.assertMemberAddedSuccess();
-    membersTab.tableUtils().checkRowItemExists("realm-user");
-  });
-});
-
-describe.skip("Identity providers", () => {
-  const idpTab = new IdentityProviderTab();
-  before(() => {
-    adminClient.createOrganization({
-      name: "idp",
-      domains: [{ name: "o.com", verified: false }],
-    });
-    adminClient.createIdentityProvider("BitBucket", "bitbucket");
-  });
-  after(() => {
-    adminClient.deleteOrganization("idp");
-    adminClient.deleteIdentityProvider("bitbucket");
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    page.goToTab();
-  });
-
-  it("should add idp", () => {
-    listingPage.goToItemDetails("idp");
-    idpTab.goToTab();
-    idpTab.emptyState().checkIfExists(true);
-    idpTab.emptyState().clickPrimaryBtn();
-
-    idpTab.fillForm({ name: "bitbucket", domain: "o.com", public: true });
-    idpTab.modalUtils().confirmModal();
-
-    idpTab.assertAddedSuccess();
-
-    idpTab.tableUtils().checkRowItemExists("bitbucket");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/partial_export_test.spec.ts b/js/apps/admin-ui/cypress/e2e/partial_export_test.spec.ts
deleted file mode 100644
index eb0292efaa04..000000000000
--- a/js/apps/admin-ui/cypress/e2e/partial_export_test.spec.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import PartialExportModal from "../support/pages/admin-ui/configure/realm_settings/PartialExportModal";
-import RealmSettings from "../support/pages/admin-ui/configure/realm_settings/RealmSettings";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-describe("Partial realm export", () => {
-  const REALM_NAME = "Partial-export-test-realm";
-
-  before(() => adminClient.createRealm(REALM_NAME));
-
-  after(() => adminClient.deleteRealm(REALM_NAME));
-
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const modal = new PartialExportModal();
-  const realmSettings = new RealmSettings();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(REALM_NAME).goToRealmSettings();
-    realmSettings.clickActionMenu();
-    modal.open();
-  });
-
-  it("Closes the dialog", () => {
-    modal.cancelButton().click();
-    modal.exportButton().should("not.exist");
-  });
-
-  it("Shows a warning message", () => {
-    modal.warningMessage().should("not.exist");
-
-    modal.includeGroupsAndRolesSwitch().click({ force: true });
-    modal.warningMessage().should("exist");
-    modal.includeGroupsAndRolesSwitch().click({ force: true });
-    modal.warningMessage().should("not.exist");
-
-    modal.includeClientsSwitch().click({ force: true });
-    modal.warningMessage().should("exist");
-    modal.includeClientsSwitch().click({ force: true });
-    modal.warningMessage().should("not.exist");
-  });
-
-  it("Exports the realm", () => {
-    modal.includeGroupsAndRolesSwitch().click({ force: true });
-    modal.includeClientsSwitch().click({ force: true });
-    cy.intercept("POST", `/admin/realms/${REALM_NAME}/partial-export*`).as(
-      "export",
-    );
-    modal.exportButton().click();
-    cy.wait("@export");
-
-    cy.readFile(Cypress.config("downloadsFolder") + "/realm-export.json");
-    modal.exportButton().should("not.exist");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/partial_import_test.spec.ts b/js/apps/admin-ui/cypress/e2e/partial_import_test.spec.ts
deleted file mode 100644
index d0e37e5a352c..000000000000
--- a/js/apps/admin-ui/cypress/e2e/partial_import_test.spec.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import PartialImportModal from "../support/pages/admin-ui/configure/realm_settings/PartialImportModal";
-import RealmSettings from "../support/pages/admin-ui/configure/realm_settings/RealmSettings";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-
-describe("Partial import test", () => {
-  const TEST_REALM = "Partial-import-test-realm";
-  const TEST_REALM_2 = "Partial-import-test-realm-2";
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const modal = new PartialImportModal();
-  const realmSettings = new RealmSettings();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(TEST_REALM);
-    sidebarPage.goToRealmSettings();
-    realmSettings.clickActionMenu();
-  });
-
-  before(() =>
-    Promise.all([
-      adminClient.createRealm(TEST_REALM),
-      adminClient.createRealm(TEST_REALM_2),
-    ]),
-  );
-
-  after(async () => {
-    await Promise.all([
-      adminClient.deleteRealm(TEST_REALM),
-      adminClient.deleteRealm(TEST_REALM_2),
-    ]);
-  });
-
-  it("Opens and closes partial import dialog", () => {
-    modal.open();
-    modal.importButton().should("be.disabled");
-    modal.cancelButton().click();
-    modal.importButton().should("not.exist");
-  });
-
-  it("Import button only enabled if JSON has something to import", () => {
-    modal.open();
-    modal.textArea().type("{}", { force: true });
-    modal.importButton().should("be.disabled");
-    modal.cancelButton().click();
-  });
-
-  it("Displays user options after multi-realm import", () => {
-    modal.open();
-    modal.typeResourceFile("multi-realm.json");
-
-    // Import button should be disabled if no checkboxes selected
-    modal.importButton().should("be.disabled");
-    modal.usersCheckbox().click();
-    modal.importButton().should("be.enabled");
-    modal.groupsCheckbox().click();
-    modal.importButton().should("be.enabled");
-    modal.groupsCheckbox().click();
-    modal.usersCheckbox().click();
-    modal.importButton().should("be.disabled");
-
-    // verify resource counts
-    modal.userCount().contains("1 Users");
-    modal.groupCount().contains("1 Groups");
-    modal.clientCount().contains("1 Clients");
-    modal.idpCount().contains("1 Identity providers");
-    modal.realmRolesCount().contains("2 Realm roles");
-    modal.clientRolesCount().contains("1 Client roles");
-
-    // import button should disable when switching realms
-    modal.usersCheckbox().click();
-    modal.importButton().should("be.enabled");
-    modal.selectRealm("realm2");
-    modal.importButton().should("be.disabled");
-
-    modal.clientCount().contains("2 Clients");
-
-    modal.clientsCheckbox().click();
-    modal.importButton().click();
-
-    cy.contains("2 records added");
-    cy.contains("customer-portal");
-    cy.contains("customer-portal2");
-    modal.closeButton().click();
-  });
-
-  it("Displays user options after realmless import and does the import", () => {
-    sidebarPage.goToRealm(TEST_REALM_2);
-    sidebarPage.goToRealmSettings();
-    realmSettings.clickActionMenu();
-    modal.open();
-
-    modal.typeResourceFile("client-only.json");
-
-    modal.realmSelector().should("not.exist");
-
-    modal.clientCount().contains("1 Clients");
-
-    modal.usersCheckbox().should("not.exist");
-    modal.groupsCheckbox().should("not.exist");
-    modal.idpCheckbox().should("not.exist");
-    modal.realmRolesCheckbox().should("not.exist");
-    modal.clientRolesCheckbox().should("not.exist");
-
-    modal.clientsCheckbox().click();
-    modal.importButton().click();
-
-    cy.contains("One record added");
-    cy.contains("customer-portal3");
-    modal.closeButton().click();
-  });
-
-  it("Should clear the input with the button", () => {
-    modal.open();
-
-    //clear button should be disabled if there is nothing in the dialog
-    modal.clearButton().should("be.disabled");
-    modal.textArea().should("have.text", "");
-    modal.textArea().type("{}", { force: true });
-    modal.textArea().should("have.text", "{}");
-    modal.clearButton().should("not.be.disabled");
-    modal.clearButton().click();
-    modal.clickClearConfirmButton();
-    modal.textArea().should("have.text", "");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_roles_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_roles_test.spec.ts
deleted file mode 100644
index a5832fc50498..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_roles_test.spec.ts
+++ /dev/null
@@ -1,332 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import createRealmRolePage from "../support/pages/admin-ui/manage/realm_roles/CreateRealmRolePage";
-import AssociatedRolesPage from "../support/pages/admin-ui/manage/realm_roles/AssociatedRolesPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-import ClientRolesTab from "../support/pages/admin-ui/manage/clients/ClientRolesTab";
-import KeyValueInput from "../support/pages/admin-ui/manage/KeyValueInput";
-
-let itemId = "realm_role_crud";
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const modalUtils = new ModalUtils();
-const sidebarPage = new SidebarPage();
-const listingPage = new ListingPage();
-const associatedRolesPage = new AssociatedRolesPage();
-const rolesTab = new ClientRolesTab();
-
-describe("Realm roles test", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealmRoles();
-  });
-
-  it("should fail creating realm role", () => {
-    listingPage.goToCreateItem();
-    createRealmRolePage.save().checkRealmRoleNameRequiredMessage();
-    createRealmRolePage.fillRealmRoleData("admin").save();
-
-    // The error should inform about duplicated name/id (THIS MESSAGE DOES NOT HAVE QUOTES AS THE OTHERS)
-    masthead.checkNotificationMessage(
-      "Could not create role: Role with name admin already exists",
-      true,
-    );
-  });
-
-  it("shouldn't create a realm role based with only whitespace name", () => {
-    listingPage.goToCreateItem();
-    createRealmRolePage
-      .fillRealmRoleData("  ")
-      .checkRealmRoleNameRequiredMessage();
-  });
-
-  it("Realm role CRUD test", () => {
-    itemId += "_" + crypto.randomUUID();
-
-    // Create
-    listingPage.itemExist(itemId, false).goToCreateItem();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    masthead.checkNotificationMessage("Role created", true);
-    sidebarPage.goToRealmRoles();
-
-    const fetchUrl = "/admin/realms/master/roles?first=0&max=11";
-    cy.intercept(fetchUrl).as("fetch");
-
-    listingPage.deleteItem(itemId);
-
-    cy.wait(["@fetch"]);
-    modalUtils.checkModalTitle("Delete role?").confirmModal();
-    masthead.checkNotificationMessage("The role has been deleted", true);
-
-    listingPage.itemExist(itemId, false);
-
-    itemId = "realm_role_crud";
-  });
-
-  it("should delete role from details action", () => {
-    itemId += "_" + crypto.randomUUID();
-    listingPage.goToCreateItem();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    masthead.checkNotificationMessage("Role created", true);
-    createRealmRolePage.clickActionMenu("Delete this role");
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("The role has been deleted", true);
-    itemId = "realm_role_crud";
-  });
-
-  it("should not be able to delete default role", () => {
-    const defaultRole = "default-roles-master";
-    listingPage.itemExist(defaultRole).deleteItem(defaultRole);
-    masthead.checkNotificationMessage(
-      "You cannot delete a default role.",
-      true,
-    );
-  });
-
-  it("Add associated roles test", () => {
-    itemId += "_" + crypto.randomUUID();
-
-    // Create
-    listingPage.itemExist(itemId, false).goToCreateItem();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    masthead.checkNotificationMessage("Role created", true);
-
-    // Add associated realm role from action dropdown
-    associatedRolesPage.addAssociatedRealmRole("create-realm");
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    // Add associated realm role from search bar
-    associatedRolesPage.addAssociatedRoleFromSearchBar("offline_access");
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    rolesTab.goToAssociatedRolesTab();
-
-    // Add associated client role from search bar
-    associatedRolesPage.addAssociatedRoleFromSearchBar("manage-account", true);
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    rolesTab.goToAssociatedRolesTab();
-
-    // Add associated client role
-    associatedRolesPage.addAssociatedRoleFromSearchBar("manage-consent", true);
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    rolesTab.goToAssociatedRolesTab();
-
-    // Add associated client role
-    associatedRolesPage.addAssociatedRoleFromSearchBar(
-      "manage-account-links",
-      true,
-    );
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-  });
-
-  it("should search existing associated role by name and go to it", () => {
-    listingPage
-      .searchItem("create-realm", false)
-      .itemExist("create-realm")
-      .goToItemDetails("create-realm");
-
-    cy.findByTestId("view-header").should("contain.text", "create-realm");
-    cy.findByTestId("cancel").click();
-  });
-
-  it("should go to default-roles-master link role name and check assign roles table is not empty", () => {
-    listingPage.goToItemDetails("default-roles-master");
-
-    rolesTab.goToDefaultGroupsTab();
-    cy.findByTestId("assigned-roles").find("tr").should("have.length.gt", 0);
-    cy.findByTestId("empty-state").contains("No default groups");
-
-    rolesTab.goToDefaultRolesTab();
-    cy.findByTestId("assigned-roles").find("tr").should("have.length.gt", 0);
-  });
-
-  it("Should search non-existent associated role by name", () => {
-    const itemName = "non-existent-associated-role";
-    listingPage.searchItem(itemName, false);
-    listingPage.assertNoResults();
-  });
-
-  it("Should hide inherited roles test", () => {
-    listingPage.searchItem(itemId, false).goToItemDetails(itemId);
-    rolesTab.goToAssociatedRolesTab();
-    rolesTab.hideInheritedRoles();
-  });
-
-  it("Should fail to remove role when all unchecked from search bar", () => {
-    listingPage.searchItem(itemId, false).goToItemDetails(itemId);
-    rolesTab.goToAssociatedRolesTab();
-    associatedRolesPage.isRemoveAssociatedRolesBtnDisabled();
-  });
-
-  it("Should delete single non-inherited role item", () => {
-    listingPage.searchItem(itemId, false).goToItemDetails(itemId);
-    rolesTab.goToAssociatedRolesTab();
-    listingPage.removeItem("create-realm");
-    sidebarPage.waitForPageLoad();
-    modalUtils.checkModalTitle("Remove role?").confirmModal();
-    sidebarPage.waitForPageLoad();
-
-    masthead.checkNotificationMessage("Role mapping updated", true);
-  });
-
-  it("Should delete all roles from search bar", () => {
-    listingPage.searchItem(itemId, false).goToItemDetails(itemId);
-    sidebarPage.waitForPageLoad();
-    rolesTab.goToAssociatedRolesTab();
-
-    cy.get('input[name="check-all"]').check();
-
-    associatedRolesPage.removeAssociatedRoles();
-
-    sidebarPage.waitForPageLoad();
-    modalUtils.checkModalTitle("Remove role?").confirmModal();
-    sidebarPage.waitForPageLoad();
-
-    masthead.checkNotificationMessage("Role mapping updated", true);
-  });
-
-  it("Should delete associated roles from list test", () => {
-    itemId = "realm_role_crud";
-    itemId += "_" + crypto.randomUUID();
-
-    // Create
-    listingPage.itemExist(itemId, false).goToCreateItem();
-    createRealmRolePage.fillRealmRoleData(itemId).save();
-    masthead.checkNotificationMessage("Role created", true);
-
-    // Add associated realm role from action dropdown
-    associatedRolesPage.addAssociatedRealmRole("create-realm");
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    // Add associated realm role from search bar
-    associatedRolesPage.addAssociatedRoleFromSearchBar("offline_access");
-    masthead.checkNotificationMessage("Associated roles have been added", true);
-
-    rolesTab.goToAssociatedRolesTab();
-
-    // delete associated roles from list
-    listingPage.removeItem("create-realm");
-    sidebarPage.waitForPageLoad();
-    modalUtils.checkModalTitle("Remove role?").confirmModal();
-    sidebarPage.waitForPageLoad();
-
-    masthead.checkNotificationMessage("Role mapping updated", true);
-    listingPage.removeItem("offline_access");
-    sidebarPage.waitForPageLoad();
-    modalUtils.checkModalTitle("Remove role?").confirmModal();
-    sidebarPage.waitForPageLoad();
-
-    masthead.checkNotificationMessage("Role mapping updated", true);
-  });
-
-  describe("edit role details", () => {
-    const editRoleName = "going to edit";
-    const description = "some description";
-    const updateDescription = "updated description";
-
-    before(() =>
-      adminClient.createRealmRole({
-        name: editRoleName,
-        description,
-      }),
-    );
-
-    after(() => adminClient.deleteRealmRole(editRoleName));
-
-    it("should edit realm role details", () => {
-      listingPage.itemExist(editRoleName).goToItemDetails(editRoleName);
-      createRealmRolePage.checkNameDisabled().checkDescription(description);
-      createRealmRolePage.updateDescription(updateDescription).save();
-      masthead.checkNotificationMessage("The role has been saved", true);
-      createRealmRolePage.checkDescription(updateDescription);
-    });
-
-    const keyValue = new KeyValueInput("attributes");
-
-    it("should add attribute", () => {
-      listingPage.itemExist(editRoleName).goToItemDetails(editRoleName);
-
-      createRealmRolePage.goToAttributesTab();
-      keyValue.fillKeyValue({ key: "one", value: "1" }).validateRows(1);
-      keyValue.save();
-      masthead.checkNotificationMessage("The role has been saved", true);
-      keyValue.validateRows(1);
-    });
-
-    it("should add attribute multiple", () => {
-      listingPage.itemExist(editRoleName).goToItemDetails(editRoleName);
-
-      createRealmRolePage.goToAttributesTab();
-      keyValue
-        .fillKeyValue({ key: "two", value: "2" })
-        .fillKeyValue({ key: "three", value: "3" })
-        .save()
-        .validateRows(3);
-    });
-
-    it("should delete attribute", () => {
-      listingPage.itemExist(editRoleName).goToItemDetails(editRoleName);
-      createRealmRolePage.goToAttributesTab();
-
-      keyValue.deleteRow(1).save().validateRows(2);
-    });
-  });
-
-  describe("Accessibility tests for realm roles", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToRealmRoles();
-      cy.injectAxe();
-    });
-
-    const role = "a11y-role";
-    const defaultRolesMaster = "default-roles-master";
-
-    it("Check a11y violations on load/ realm roles", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on default-roles-master default tab and default roles tabs", () => {
-      listingPage.goToItemDetails(defaultRolesMaster);
-      cy.checkA11y();
-
-      rolesTab.goToDefaultGroupsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on empty create role form", () => {
-      rolesTab.goToCreateRoleFromToolbar();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on role details", () => {
-      const permissionSwitch = "permissionSwitch";
-      rolesTab.goToCreateRoleFromToolbar();
-      createRealmRolePage.fillRealmRoleData(role).save();
-      cy.checkA11y();
-
-      rolesTab.goToAttributesTab();
-      cy.checkA11y();
-
-      rolesTab.goToUsersInRoleTab();
-      cy.checkA11y();
-
-      rolesTab.goToPermissionsTab();
-      cy.findByTestId(permissionSwitch).parent().click();
-      cy.checkA11y();
-
-      sidebarPage.goToRealmRoles();
-      listingPage.deleteItem(role);
-      cy.checkA11y();
-      cy.findByTestId("confirm").click();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_client_policies_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_client_policies_test.spec.ts
deleted file mode 100644
index d3aa37a9c2f1..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_client_policies_test.spec.ts
+++ /dev/null
@@ -1,186 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-import ModalUtils from "../support/util/ModalUtils";
-import Masthead from "../support/pages/admin-ui/Masthead";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const modalUtils = new ModalUtils();
-const masthead = new Masthead();
-
-describe("Realm settings client policies tab tests", () => {
-  const realmName = "Realm_" + crypto.randomUUID();
-  const realmSettingsPage = new RealmSettingsPage(realmName);
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage
-      .waitForPageLoad()
-      .goToRealm(realmName)
-      .goToRealmSettings()
-      .waitForPageLoad();
-    realmSettingsPage.goToClientPoliciesTab().goToClientPoliciesList();
-  });
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => {
-    adminClient.deleteRealm(realmName);
-  });
-
-  it("Complete new client form and cancel", () => {
-    realmSettingsPage
-      .checkDisplayPoliciesTab()
-      .createNewClientPolicyFromEmptyState("Test", "Test Description", true)
-      .checkNewClientPolicyForm()
-      .cancelNewClientPolicyCreation()
-      .checkEmptyPolicyList();
-  });
-
-  it("Complete new client form and submit", () => {
-    const url = `/admin/realms/${realmName}/client-policies/policies`;
-    cy.intercept("PUT", url).as("save");
-
-    realmSettingsPage.createNewClientPolicyFromEmptyState(
-      "Test",
-      "Test Description",
-    );
-    masthead.checkNotificationMessage("New policy created");
-    cy.wait("@save");
-  });
-
-  it("Should perform client profile search by profile name", () => {
-    realmSettingsPage.searchClientPolicy("Test");
-  });
-
-  it("Should not have conditions configured by default", () => {
-    realmSettingsPage.shouldNotHaveConditionsConfigured();
-  });
-
-  it("Should cancel adding a new condition to a client profile", () => {
-    realmSettingsPage.shouldCancelAddingCondition();
-  });
-
-  it("Should add a new client-roles condition to a client profile", () => {
-    realmSettingsPage.shouldAddClientRolesCondition();
-  });
-
-  it("Should add a new client-scopes condition to a client profile", () => {
-    realmSettingsPage.shouldAddClientScopesCondition();
-  });
-
-  it("Should edit the client-roles condition of a client profile", () => {
-    realmSettingsPage.shouldEditClientRolesCondition();
-  });
-
-  it("Should edit the client-scopes condition of a client profile", () => {
-    realmSettingsPage.shouldEditClientScopesCondition();
-  });
-
-  it("Should cancel deleting condition from a client profile", () => {
-    realmSettingsPage.deleteClientRolesCondition();
-    sidebarPage.waitForPageLoad();
-    modalUtils
-      .checkModalTitle("Delete condition?")
-      .checkModalMessage(
-        "This action will permanently delete client-roles. This cannot be undone.",
-      )
-      .checkConfirmButtonText("Delete")
-      .cancelButtonContains("Cancel")
-      .cancelModal();
-    realmSettingsPage.checkConditionsListContains("client-roles");
-  });
-
-  it("Should delete client-roles condition from a client profile", () => {
-    realmSettingsPage.deleteClientRolesCondition();
-    sidebarPage.waitForPageLoad();
-    modalUtils.confirmModal();
-    realmSettingsPage.checkConditionsListContains("client-scopes");
-  });
-
-  it("Should delete client-scopes condition from a client profile", () => {
-    realmSettingsPage.shouldDeleteClientScopesCondition();
-  });
-
-  it("Check cancelling the client policy deletion", () => {
-    realmSettingsPage.deleteClientPolicyItemFromTable("Test");
-    modalUtils
-      .checkModalMessage(
-        "This action will permanently delete the policy Test. This cannot be undone.",
-      )
-      .cancelModal();
-    realmSettingsPage.checkElementInList("Test");
-  });
-
-  it("Check deleting the client policy", () => {
-    realmSettingsPage.deleteClientPolicyItemFromTable("Test");
-
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("Client policy deleted");
-    realmSettingsPage.checkEmptyPolicyList();
-  });
-
-  it("Check navigating between Form View and JSON editor", () => {
-    realmSettingsPage.shouldNavigateBetweenFormAndJSONViewPolicies();
-  });
-
-  it("Should not create duplicate client profile", () => {
-    const url = `admin/realms/${realmName}/client-policies/policies`;
-    cy.intercept("PUT", url).as("save");
-
-    realmSettingsPage.createNewClientPolicyFromEmptyState(
-      "Test",
-      "Test Description",
-    );
-    masthead.checkNotificationMessage("New policy created");
-    cy.wait("@save");
-
-    sidebarPage.goToRealmSettings();
-
-    realmSettingsPage.goToClientPoliciesTab().goToClientPoliciesList();
-
-    realmSettingsPage.createNewClientPolicyFromList(
-      "Test",
-      "Test Again Description",
-      true,
-    );
-
-    realmSettingsPage.shouldShowErrorWhenDuplicate();
-    sidebarPage.goToRealmSettings();
-
-    realmSettingsPage
-      .goToClientPoliciesTab()
-      .goToClientPoliciesList()
-      .deleteClientPolicyItemFromTable("Test");
-
-    modalUtils.confirmModal();
-    cy.wait("@save");
-    masthead.checkNotificationMessage("Client policy deleted");
-    realmSettingsPage.checkEmptyPolicyList();
-  });
-
-  it("Check deleting newly created client policy from create view via dropdown", () => {
-    const url = `admin/realms/${realmName}/client-policies/policies`;
-    cy.intercept("PUT", url).as("save");
-    realmSettingsPage.createNewClientPolicyFromEmptyState(
-      "Test again",
-      "Test Again Description",
-    );
-    masthead.checkNotificationMessage("New policy created");
-    sidebarPage.waitForPageLoad();
-    cy.wait("@save");
-    realmSettingsPage.deleteClientPolicyFromDetails();
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("Client policy deleted");
-    sidebarPage.waitForPageLoad();
-    realmSettingsPage.checkEmptyPolicyList();
-  });
-
-  it("Check reloading JSON policies", () => {
-    realmSettingsPage.shouldReloadJSONPolicies();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_client_profiles_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_client_profiles_test.spec.ts
deleted file mode 100644
index 3e9dc5979a8d..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_client_profiles_test.spec.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-import ModalUtils from "../support/util/ModalUtils";
-import Masthead from "../support/pages/admin-ui/Masthead";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const modalUtils = new ModalUtils();
-const masthead = new Masthead();
-
-describe("Realm settings client profiles tab tests", () => {
-  const profileName = "Test";
-  const editedProfileName = "Edit";
-  const realmName = "Realm_" + crypto.randomUUID();
-  const realmSettingsPage = new RealmSettingsPage(realmName);
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.waitForPageLoad().goToRealm(realmName).goToRealmSettings();
-    realmSettingsPage.goToClientPoliciesTab().goToClientProfilesList();
-  });
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  it("Go to client policies profiles tab", () => {
-    realmSettingsPage.shouldDisplayProfilesTab();
-  });
-
-  it("Check new client form is displaying", () => {
-    realmSettingsPage.shouldDisplayNewClientProfileForm();
-  });
-
-  it("Complete new client form and cancel", () => {
-    realmSettingsPage
-      .createClientProfile(profileName, "Test Description")
-      .cancelClientProfileCreation()
-      .checkElementNotInList(profileName);
-  });
-
-  it("Complete new client form and submit", () => {
-    const url = `admin/realms/${realmName}/client-policies/profiles`;
-    cy.intercept("PUT", url).as("save");
-    realmSettingsPage
-      .createClientProfile(profileName, "Test Description")
-      .saveClientProfileCreation();
-    cy.wait("@save");
-    masthead.checkNotificationMessage("New client profile created");
-  });
-
-  it("Should perform client profile search by profile name", () => {
-    realmSettingsPage.searchClientProfile(profileName);
-  });
-
-  it("Should search non-existent client profile", () => {
-    realmSettingsPage.searchNonExistingClientProfile("nonExistentProfile");
-    cy.findByTestId("empty-state").should("be.visible");
-  });
-
-  it("Should navigate to client profile", () => {
-    realmSettingsPage.searchClientProfile(profileName);
-    realmSettingsPage.goToClientProfileByNameLink(profileName);
-    cy.findByTestId("view-header").should("have.text", profileName);
-  });
-
-  it("Check navigating between Form View and JSON editor", () => {
-    realmSettingsPage.shouldNavigateBetweenFormAndJSONView();
-  });
-
-  it("Check saving changed JSON profiles", () => {
-    realmSettingsPage.shouldSaveChangedJSONProfiles();
-    realmSettingsPage.deleteClientPolicyItemFromTable(profileName);
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("Client profile deleted");
-    realmSettingsPage.checkElementNotInList(profileName);
-  });
-
-  it("Should not create duplicate client profile", () => {
-    const url = `admin/realms/${realmName}/client-policies/profiles`;
-    cy.intercept("PUT", url).as("save");
-    realmSettingsPage
-      .createClientProfile(profileName, "Test Description")
-      .saveClientProfileCreation();
-    cy.wait("@save");
-
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.goToClientPoliciesTab().goToClientProfilesList();
-
-    sidebarPage.waitForPageLoad();
-    realmSettingsPage
-      .createClientProfile(profileName, "Test Description")
-      .saveClientProfileCreation();
-    cy.wait("@save");
-    masthead.checkNotificationMessage(
-      "Could not create client profile: 'proposed client profile name duplicated.'",
-    );
-  });
-
-  it("Should edit client profile", () => {
-    realmSettingsPage.shouldEditClientProfile();
-  });
-
-  it("Should check that edited client profile is now listed", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage
-      .goToClientPoliciesTab()
-      .goToClientProfilesList()
-      .shouldCheckEditedClientProfileListed();
-  });
-
-  it("Should show error when client profile left blank", () => {
-    realmSettingsPage.shouldShowErrorWhenNameBlank();
-  });
-
-  it("Should revert back to the previous profile name", () => {
-    realmSettingsPage.shouldReloadClientProfileEdits();
-  });
-
-  it("Should not have executors configured by default", () => {
-    realmSettingsPage.shouldNotHaveExecutorsConfigured();
-  });
-
-  it("Should cancel adding a new executor to a client profile", () => {
-    realmSettingsPage.shouldCancelAddingExecutor();
-  });
-
-  it("Should add a new executor to a client profile", () => {
-    realmSettingsPage.shouldAddExecutor();
-  });
-
-  it("Should cancel deleting executor from a client profile", () => {
-    realmSettingsPage.shouldCancelDeletingExecutor();
-  });
-
-  it("Should cancel editing executor", () => {
-    realmSettingsPage.openProfileDetails(editedProfileName).editExecutor(4000);
-    sidebarPage.waitForPageLoad();
-    realmSettingsPage
-      .cancelEditingExecutor()
-      .checkExecutorNotInList()
-      .editExecutor()
-      .checkAvailablePeriodExecutor(3600);
-  });
-
-  it("Should edit executor", () => {
-    realmSettingsPage
-      .openProfileDetails(editedProfileName)
-      .editExecutor(4000)
-      .saveExecutor();
-    masthead.checkNotificationMessage("Executor updated successfully");
-    realmSettingsPage.editExecutor();
-    // TODO: UNCOMMENT LINE WHEN ISSUE 2037 IS FIXED
-    //.checkAvailablePeriodExecutor(4000);
-  });
-
-  it("Should delete executor from a client profile", () => {
-    realmSettingsPage.shouldDeleteExecutor();
-  });
-
-  it("Check cancelling the client profile deletion", () => {
-    realmSettingsPage.deleteClientPolicyItemFromTable(editedProfileName);
-    modalUtils
-      .checkModalMessage(
-        "This action will permanently delete the profile " +
-          editedProfileName +
-          ". This cannot be undone.",
-      )
-      .cancelModal();
-    realmSettingsPage.checkElementInList(editedProfileName);
-  });
-
-  it("Check deleting the client profile", () => {
-    realmSettingsPage.deleteClientPolicyItemFromTable(editedProfileName);
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("Client profile deleted");
-    sidebarPage.waitForPageLoad();
-    realmSettingsPage.checkElementNotInList(editedProfileName);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_events_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_events_test.spec.ts
deleted file mode 100644
index f8b2b3b93f32..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_events_test.spec.ts
+++ /dev/null
@@ -1,418 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import adminClient from "../support/util/AdminClient";
-import KeysTab from "../support/pages/admin-ui/manage/realm_settings/KeysTab";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const masthead = new Masthead();
-const modalUtils = new ModalUtils();
-const realmSettingsPage = new RealmSettingsPage();
-const keysTab = new KeysTab();
-
-describe("Realm settings events tab tests", () => {
-  const realmName = "Realm_" + crypto.randomUUID();
-  const listingPage = new ListingPage();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-  });
-
-  before(async () => {
-    await adminClient.createRealm(realmName);
-  });
-
-  after(async () => {
-    await adminClient.deleteRealm(realmName);
-  });
-
-  const goToDetails = () => {
-    const keysUrl = `/admin/realms/${realmName}/keys`;
-    cy.intercept(keysUrl).as("keysFetch");
-
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-providers-tab").click();
-    cy.findAllByTestId("provider-name-link")
-      .contains("test_aes-generated")
-      .click();
-
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-providers-tab").click();
-    cy.findAllByTestId("provider-name-link")
-      .contains("test_hmac-generated")
-      .click();
-
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-providers-tab").click();
-    cy.findAllByTestId("provider-name-link").contains("test_rsa").click();
-
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-providers-tab").click();
-    cy.findAllByTestId("provider-name-link")
-      .contains("test_rsa-generated")
-      .click();
-
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-providers-tab").click();
-    cy.findAllByTestId("provider-name-link")
-      .contains("test_rsa-enc-generated")
-      .click();
-
-    cy.wait(["@keysFetch"]);
-
-    return this;
-  };
-
-  const goToKeys = () => {
-    const keysUrl = `/admin/realms/${realmName}/keys`;
-    cy.intercept(keysUrl).as("keysFetch");
-    keysTab.goToKeysTab();
-    cy.findByTestId("rs-keys-list-tab").click();
-    cy.wait(["@keysFetch"]);
-
-    return this;
-  };
-
-  it("Enable user events", () => {
-    cy.intercept("GET", `/admin/realms/${realmName}/events/config`).as("load");
-    sidebarPage.goToRealmSettings();
-    cy.findByTestId("rs-realm-events-tab").click();
-    cy.findByTestId("rs-events-tab").click();
-    cy.wait("@load");
-    realmSettingsPage
-      .toggleSwitch(realmSettingsPage.enableEvents, false)
-      .save(realmSettingsPage.eventsUserSave);
-    masthead.checkNotificationMessage("Successfully saved configuration");
-    realmSettingsPage.clearEvents("user");
-    modalUtils
-      .checkModalMessage(
-        "If you clear all events of this realm, all records will be permanently cleared in the database",
-      )
-      .confirmModal();
-    masthead.checkNotificationMessage("The user events have been cleared");
-    const events = ["Client info", "Client info error"];
-    cy.intercept("GET", `/admin/realms/${realmName}/events/config`).as(
-      "fetchConfig",
-    );
-    realmSettingsPage.addUserEvents(events).clickAdd();
-    masthead.checkNotificationMessage("Successfully saved configuration");
-    cy.wait(["@fetchConfig"]);
-    sidebarPage.waitForPageLoad();
-    cy.wait(1000);
-    for (const event of events) {
-      listingPage.searchItem(event, false).itemExist(event);
-    }
-  });
-
-  it("Go to keys tab", () => {
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-  });
-
-  it("add Providers", () => {
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-
-    cy.findByTestId("rs-providers-tab").click();
-
-    realmSettingsPage.toggleAddProviderDropdown();
-
-    cy.findByTestId("option-aes-generated").click();
-    realmSettingsPage.enterUIDisplayName("test_aes-generated");
-    realmSettingsPage.addProvider();
-
-    realmSettingsPage.toggleAddProviderDropdown();
-
-    cy.findByTestId("option-ecdsa-generated").click();
-    realmSettingsPage.enterUIDisplayName("test_ecdsa-generated");
-    realmSettingsPage.toggleSwitch("active", false);
-    realmSettingsPage.toggleSwitch("ecGenerateCertificate", false);
-    realmSettingsPage.addProvider();
-
-    realmSettingsPage.toggleAddProviderDropdown();
-
-    cy.findByTestId("option-hmac-generated").click();
-    realmSettingsPage.enterUIDisplayName("test_hmac-generated");
-    realmSettingsPage.toggleSwitch("enabled", false);
-    realmSettingsPage.addProvider();
-
-    realmSettingsPage.toggleAddProviderDropdown();
-
-    cy.findByTestId("option-rsa-generated").click();
-    realmSettingsPage.enterUIDisplayName("test_rsa-generated");
-    realmSettingsPage.addProvider();
-
-    realmSettingsPage.toggleAddProviderDropdown();
-
-    cy.findByTestId("option-rsa-enc-generated").click();
-    realmSettingsPage.enterUIDisplayName("test_rsa-enc-generated");
-    realmSettingsPage.addProvider();
-  });
-
-  it("search providers", () => {
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-
-    cy.findByTestId("rs-providers-tab").click();
-
-    // search providers
-    cy.findByTestId("provider-search-input").type("rsa{enter}");
-    listingPage.checkTableLength(4, "kc-draggable-table");
-    cy.findByTestId("provider-search-input").clear().type("{enter}");
-  });
-
-  it("go to details", () => {
-    sidebarPage.goToRealmSettings();
-    goToDetails();
-  });
-
-  it("Test keys", () => {
-    sidebarPage.goToRealmSettings();
-    goToKeys();
-
-    realmSettingsPage.testSelectFilter();
-  });
-
-  it.skip("Should search active keys", () => {
-    sidebarPage.goToRealmSettings();
-    goToKeys();
-
-    realmSettingsPage.switchToActiveFilter();
-    listingPage.searchItem("rs", false);
-    listingPage.checkTableLength(3, "kc-keys-list");
-  });
-
-  it("Should search passive keys", () => {
-    sidebarPage.goToRealmSettings();
-    goToKeys();
-
-    realmSettingsPage.switchToPassiveFilter();
-    listingPage.searchItem("ec", false);
-    listingPage.checkTableLength(1, "kc-keys-list");
-  });
-
-  it("Should search disabled keys", () => {
-    sidebarPage.goToRealmSettings();
-    goToKeys();
-
-    realmSettingsPage.switchToDisabledFilter();
-    listingPage.searchItem("hs", false);
-    listingPage.checkTableLength(1, "kc-keys-list");
-  });
-
-  it("delete provider", () => {
-    sidebarPage.goToRealmSettings();
-
-    keysTab.goToKeysTab();
-
-    cy.findByTestId("rs-providers-tab").click();
-
-    realmSettingsPage.deleteProvider("test_aes-generated");
-  });
-
-  it("list keys", () => {
-    sidebarPage.goToRealmSettings();
-    keysTab.goToKeysTab();
-    realmSettingsPage.checkKeyPublic();
-  });
-
-  it("Realm header settings", () => {
-    sidebarPage.goToRealmSettings();
-    cy.findByTestId("rs-security-defenses-tab").click();
-    cy.findByTestId("browserSecurityHeaders.xFrameOptions").clear();
-    cy.findByTestId("browserSecurityHeaders.xFrameOptions").type("DENY");
-    cy.findByTestId("headers-form-tab-save").should("be.enabled").click();
-
-    masthead.checkNotificationMessage("Realm successfully updated");
-  });
-
-  it("Brute force detection", () => {
-    sidebarPage.goToRealmSettings();
-    cy.findAllByTestId("rs-security-defenses-tab").click();
-    cy.get("#pf-tab-20-bruteForce").click();
-
-    cy.get("#kc-brute-force-mode").click();
-    cy.findByTestId("select-brute-force-mode")
-      .contains("Lockout temporarily")
-      .click();
-    cy.findByTestId("waitIncrementSeconds").type("1");
-    cy.findByTestId("maxFailureWaitSeconds").type("1");
-    cy.findByTestId("maxDeltaTimeSeconds").type("1");
-    cy.findByTestId("minimumQuickLoginWaitSeconds").type("1");
-
-    cy.findByTestId("brute-force-tab-save").should("be.enabled").click();
-    masthead.checkNotificationMessage("Realm successfully updated");
-  });
-
-  it("add session data", () => {
-    sidebarPage.goToRealmSettings();
-
-    cy.findByTestId("rs-sessions-tab").click();
-
-    realmSettingsPage.populateSessionsPage();
-    realmSettingsPage.save("sessions-tab-save");
-
-    masthead.checkNotificationMessage("Realm successfully updated");
-  });
-
-  it("check that sessions data was saved", () => {
-    sidebarPage.goToAuthentication();
-    sidebarPage.goToRealmSettings();
-
-    cy.findByTestId("rs-sessions-tab").click();
-
-    cy.findByTestId(realmSettingsPage.ssoSessionIdleInput).should(
-      "have.value",
-      1,
-    );
-    cy.findByTestId(realmSettingsPage.ssoSessionMaxInput).should(
-      "have.value",
-      2,
-    );
-    cy.findByTestId(realmSettingsPage.ssoSessionIdleRememberMeInput).should(
-      "have.value",
-      3,
-    );
-    cy.findByTestId(realmSettingsPage.ssoSessionMaxRememberMeInput).should(
-      "have.value",
-      4,
-    );
-
-    cy.findByTestId(realmSettingsPage.clientSessionIdleInput).should(
-      "have.value",
-      5,
-    );
-    cy.findByTestId(realmSettingsPage.clientSessionMaxInput).should(
-      "have.value",
-      6,
-    );
-
-    cy.findByTestId(realmSettingsPage.offlineSessionIdleInput).should(
-      "have.value",
-      7,
-    );
-    cy.findByTestId(realmSettingsPage.offlineSessionMaxSwitch).should(
-      "have.value",
-      "on",
-    );
-
-    cy.findByTestId(realmSettingsPage.loginTimeoutInput).should(
-      "have.value",
-      9,
-    );
-    cy.findByTestId(realmSettingsPage.loginActionTimeoutInput).should(
-      "have.value",
-      10,
-    );
-  });
-
-  it("add token data", () => {
-    sidebarPage.goToRealmSettings();
-
-    cy.findByTestId("rs-tokens-tab").click();
-
-    realmSettingsPage.populateTokensPage();
-    realmSettingsPage.save("tokens-tab-save");
-
-    masthead.checkNotificationMessage("Realm successfully updated");
-  });
-
-  it("check that token data was saved", () => {
-    sidebarPage.goToRealmSettings();
-
-    cy.findByTestId("rs-tokens-tab").click();
-
-    cy.findByTestId(realmSettingsPage.accessTokenLifespanInput).should(
-      "have.value",
-      1,
-    );
-    cy.findByTestId(realmSettingsPage.parRequestUriLifespanInput).should(
-      "have.value",
-      2,
-    );
-    cy.findByTestId(realmSettingsPage.accessTokenLifespanImplicitInput).should(
-      "have.value",
-      2,
-    );
-    cy.findByTestId(realmSettingsPage.clientLoginTimeoutInput).should(
-      "have.value",
-      3,
-    );
-    cy.findByTestId(realmSettingsPage.userInitiatedActionLifespanInput).should(
-      "have.value",
-      4,
-    );
-
-    cy.findByTestId(realmSettingsPage.defaultAdminInitatedInput).should(
-      "have.value",
-      5,
-    );
-    cy.findByTestId(realmSettingsPage.emailVerificationInput).should(
-      "have.value",
-      6,
-    );
-
-    cy.findByTestId(realmSettingsPage.idpEmailVerificationInput).should(
-      "have.value",
-      7,
-    );
-    cy.findByTestId(realmSettingsPage.forgotPasswordInput).should(
-      "have.value",
-      8,
-    );
-
-    cy.findByTestId(realmSettingsPage.executeActionsInput).should(
-      "have.value",
-      9,
-    );
-  });
-});
-
-describe("Realm settings events tab tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealmSettings();
-    cy.findByTestId("rs-realm-events-tab").click();
-    cy.findByTestId("rs-event-listeners-tab").click();
-  });
-
-  it("Should display event listeners form", () => {
-    realmSettingsPage.shouldDisplayEventListenersForm();
-  });
-
-  it("Should revert saving event listener", () => {
-    realmSettingsPage.shouldRevertSavingEventListener();
-  });
-
-  it("Should save event listener", () => {
-    realmSettingsPage.shouldSaveEventListener();
-  });
-
-  it("Should remove event from event listener", () => {
-    realmSettingsPage.shouldRemoveEventFromEventListener();
-  });
-
-  it("Should remove all events from event listener and re-save original", () => {
-    realmSettingsPage.shouldRemoveAllEventListeners();
-    realmSettingsPage.shouldReSaveEventListener();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_general_tab_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_general_tab_test.spec.ts
deleted file mode 100644
index 72b4aa63bcb4..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_general_tab_test.spec.ts
+++ /dev/null
@@ -1,184 +0,0 @@
-import { SERVER_URL } from "../support/constants";
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const masthead = new Masthead();
-const realmSettingsPage = new RealmSettingsPage();
-
-describe("Realm settings general tab tests", () => {
-  const realmName = "Realm_" + crypto.randomUUID();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-  });
-
-  before(async () => {
-    await adminClient.createRealm(realmName);
-  });
-
-  after(async () => {
-    await adminClient.deleteRealm(realmName);
-  });
-
-  it("Test all general tab switches", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.toggleSwitch(
-      realmSettingsPage.managedAccessSwitch,
-      false,
-    );
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-    realmSettingsPage.toggleSwitch(
-      realmSettingsPage.managedAccessSwitch,
-      false,
-    );
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Test realm enable/disable switch", () => {
-    sidebarPage.goToRealmSettings();
-
-    // Enable realm
-    realmSettingsPage.toggleSwitch(`${realmName}-switch`);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-    realmSettingsPage.assertSwitch(`${realmName}-switch`, true);
-
-    // Disable realm
-    realmSettingsPage.toggleSwitch(`${realmName}-switch`, false);
-    realmSettingsPage.disableRealm();
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Fail to set Realm ID to empty", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.clearRealmId();
-    realmSettingsPage.saveGeneral();
-    cy.findByTestId("realm-id-error").should("have.text", "Required field");
-  });
-
-  it("Modify Display name", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.fillDisplayName("display_name");
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Check Display name value", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.getDisplayName("display_name");
-  });
-
-  it("Modify front end URL", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.fillFrontendURL("www.example.com");
-
-    // TODO: Fix internal server error 500 when front-end URL is saved
-    // realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    // masthead.checkNotificationMessage("Realm successfully updated", true);
-
-    realmSettingsPage.getFrontendURL("www.example.com");
-    realmSettingsPage.clearFrontendURL();
-  });
-
-  it("Select SSL all requests", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.fillRequireSSL("All requests");
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Verify SSL all requests displays", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.getRequireSSL("All requests");
-  });
-
-  it("Select SSL external requests", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.fillRequireSSL("External requests");
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Verify SSL external requests displays", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.getRequireSSL("External requests");
-  });
-
-  it("Select SSL None", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.fillRequireSSL("None");
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("Verify SSL None displays", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.getRequireSSL("None");
-  });
-
-  it("Check Access Endpoints OpenID Endpoint Configuration link", () => {
-    sidebarPage.goToRealmSettings();
-
-    // Check link exists
-    cy.get("a")
-      .contains("OpenID Endpoint Configuration")
-      .should(
-        "have.attr",
-        "href",
-        `${SERVER_URL}/realms/${realmName}/.well-known/openid-configuration`,
-      )
-      .should("have.attr", "target", "_blank")
-      .should("have.attr", "rel", "noreferrer noopener");
-  });
-
-  it("Access Endpoints OpenID Endpoint Configuration link", () => {
-    sidebarPage.goToRealmSettings();
-    // Check the link is live
-    cy.get("a")
-      .contains("OpenID Endpoint Configuration")
-      .then((link) => {
-        cy.request(link.prop("href")).its("status").should("eq", 200);
-      });
-  });
-
-  it("Check if Access Endpoints SAML 2.0 Identity Provider Metadata link exists", () => {
-    sidebarPage.goToRealmSettings();
-    cy.get("a")
-      .contains("SAML 2.0 Identity Provider Metadata")
-      .should(
-        "have.attr",
-        "href",
-        `${SERVER_URL}/realms/${realmName}/protocol/saml/descriptor`,
-      )
-      .should("have.attr", "target", "_blank")
-      .should("have.attr", "rel", "noreferrer noopener");
-  });
-
-  it("Access Endpoints SAML 2.0 Identity Provider Metadata link", () => {
-    sidebarPage.goToRealmSettings();
-
-    // Check the link is live
-    cy.get("a")
-      .contains("SAML 2.0 Identity Provider Metadata ")
-      .then((link) => {
-        cy.request(link.prop("href")).its("status").should("eq", 200);
-      });
-  });
-
-  it("Verify 'Revert' button works", () => {
-    sidebarPage.goToRealmSettings();
-
-    realmSettingsPage.fillDisplayName("should_be_reverted");
-    realmSettingsPage.revert(realmSettingsPage.generalRevertBtn);
-    realmSettingsPage.getDisplayName("display_name");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_tabs_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_tabs_test.spec.ts
deleted file mode 100644
index 01b43c147bd2..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_tabs_test.spec.ts
+++ /dev/null
@@ -1,437 +0,0 @@
-import FormValidation from "../support/forms/FormValidation";
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import KeysTab from "../support/pages/admin-ui/manage/realm_settings/KeysTab";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import UserRegistration from "../support/pages/admin-ui/manage/realm_settings/UserRegistration";
-import adminClient from "../support/util/AdminClient";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const masthead = new Masthead();
-const realmSettingsPage = new RealmSettingsPage();
-const userRegistration = new UserRegistration();
-const keysTab = new KeysTab();
-const modalUtils = new ModalUtils();
-
-describe("Realm settings tabs tests", () => {
-  const realmName = "Realm_" + crypto.randomUUID();
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-  });
-
-  before(async () => {
-    await adminClient.createRealm(realmName);
-  });
-
-  after(async () => {
-    await adminClient.deleteRealm(realmName);
-  });
-
-  const addBundle = () => {
-    realmSettingsPage.addKeyValuePair("123", "abc");
-
-    return this;
-  };
-
-  it("shows the 'user profile' tab", () => {
-    sidebarPage.goToRealmSettings();
-    cy.findByTestId(realmSettingsPage.userProfileTab).should("exist");
-  });
-
-  // Clicking multiple toggles in succession causes quick re-renderings of the screen
-  // and there will be a noticeable flicker during the test.
-  // Sometimes, this will screw up the test and cause Cypress to hang.
-  // Clicking to another section each time fixes the problem.
-  function reloadRealm() {
-    sidebarPage.goToClientScopes();
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.goToLoginTab();
-  }
-
-  function testToggle(realmSwitch: string, expectedValue: string) {
-    realmSettingsPage.toggleSwitch(realmSwitch);
-    reloadRealm();
-    cy.findByTestId(realmSwitch).should("have.value", expectedValue);
-  }
-
-  it("Go to login tab", () => {
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.goToLoginTab();
-
-    testToggle(realmSettingsPage.userRegSwitch, "on");
-    testToggle(realmSettingsPage.forgotPwdSwitch, "on");
-    testToggle(realmSettingsPage.rememberMeSwitch, "on");
-    testToggle(realmSettingsPage.loginWithEmailSwitch, "off");
-    testToggle(realmSettingsPage.duplicateEmailsSwitch, "on");
-
-    // Check other values
-    cy.findByTestId(realmSettingsPage.emailAsUsernameSwitch).should(
-      "have.value",
-      "off",
-    );
-
-    cy.findByTestId(realmSettingsPage.verifyEmailSwitch).should(
-      "have.value",
-      "off",
-    );
-  });
-
-  it("Go to email tab", () => {
-    // Configure an e-mail address so we can test the connection settings.
-    cy.wrap(null).then(async () => {
-      const adminUser = await adminClient.getAdminUser();
-
-      await adminClient.updateUser(adminUser.id!, {
-        email: "admin@example.com",
-      });
-    });
-
-    sidebarPage.goToRealmSettings();
-    realmSettingsPage.goToEmailTab();
-    //required fields not filled in or not filled properly
-    realmSettingsPage.addSenderEmail("not a valid email");
-    realmSettingsPage.fillFromDisplayName("displayName");
-    realmSettingsPage.fillReplyToEmail("replyTo@email.com");
-    realmSettingsPage.fillPort("10");
-    cy.findByTestId("email-tab-save").click();
-
-    FormValidation.assertMessage(
-      realmSettingsPage.getFromInput(),
-      "You must enter a valid email.",
-    );
-    FormValidation.assertRequired(realmSettingsPage.getHostInput());
-
-    cy.findByTestId("email-tab-revert").click();
-    cy.findByTestId("smtpServer.from").should("be.empty");
-    cy.findByTestId("smtpServer.fromDisplayName").should("be.empty");
-    cy.findByTestId("smtpServer.port").should("be.empty");
-
-    realmSettingsPage.addSenderEmail("example@example.com");
-    realmSettingsPage.toggleCheck(realmSettingsPage.enableSslCheck);
-    realmSettingsPage.toggleCheck(realmSettingsPage.enableStartTlsCheck);
-    realmSettingsPage.fillHostField("localhost");
-
-    cy.findByTestId(realmSettingsPage.testConnectionButton).click();
-
-    masthead.checkNotificationMessage("Error! Failed to send email", true);
-  });
-
-  it("Go to themes tab", () => {
-    sidebarPage.goToRealmSettings();
-    cy.findByTestId("rs-themes-tab").click();
-
-    realmSettingsPage.selectLoginThemeType("keycloak");
-    realmSettingsPage.selectAccountThemeType("keycloak");
-    realmSettingsPage.selectEmailThemeType("base");
-
-    realmSettingsPage.saveThemes();
-  });
-
-  describe("Go to security defenses tab", () => {
-    it("Realm header settings- update single input", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToSecurityDefensesTab();
-      cy.findByTestId("browserSecurityHeaders.xFrameOptions").clear();
-      cy.findByTestId("browserSecurityHeaders.xFrameOptions").type("DENY");
-      realmSettingsPage.saveSecurityDefensesHeaders();
-      masthead.checkNotificationMessage("Realm successfully updated");
-    });
-
-    it("Realm header settings- update all inputs", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToSecurityDefensesTab();
-      cy.findByTestId("browserSecurityHeaders.xFrameOptions").clear();
-      cy.findByTestId("browserSecurityHeaders.xFrameOptions").type(
-        "SAMEORIGIN",
-      );
-      cy.findByTestId("browserSecurityHeaders.contentSecurityPolicy").clear();
-      cy.findByTestId("browserSecurityHeaders.contentSecurityPolicy").type(
-        "default-src 'self'",
-      );
-      cy.findByTestId("browserSecurityHeaders.strictTransportSecurity").clear();
-      cy.findByTestId("browserSecurityHeaders.strictTransportSecurity").type(
-        "max-age=31536000",
-      );
-      cy.findByTestId("browserSecurityHeaders.xContentTypeOptions").clear();
-      cy.findByTestId("browserSecurityHeaders.xContentTypeOptions").type(
-        "nosniff",
-      );
-      cy.findByTestId("browserSecurityHeaders.xRobotsTag").clear();
-      cy.findByTestId("browserSecurityHeaders.xRobotsTag").type("none");
-      cy.findByTestId("browserSecurityHeaders.xXSSProtection").clear();
-      cy.findByTestId("browserSecurityHeaders.xXSSProtection").type(
-        "1; mode=block",
-      );
-      cy.findByTestId("browserSecurityHeaders.strictTransportSecurity").clear();
-      cy.findByTestId("browserSecurityHeaders.strictTransportSecurity").type(
-        "max-age=31537000",
-      );
-      cy.findByTestId("browserSecurityHeaders.referrerPolicy").clear();
-      cy.findByTestId("browserSecurityHeaders.referrerPolicy").type("referrer");
-      realmSettingsPage.saveSecurityDefensesHeaders();
-      masthead.checkNotificationMessage("Realm successfully updated");
-    });
-
-    it("Brute force detection- update values", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToSecurityDefensesTab();
-      realmSettingsPage.goToSecurityDefensesBruteForceTab();
-      cy.get("#kc-brute-force-mode").click();
-      cy.findByTestId("select-brute-force-mode")
-        .contains("Lockout temporarily")
-        .click();
-      cy.findByTestId("waitIncrementSeconds").type("1");
-      cy.findByTestId("maxFailureWaitSeconds").type("1");
-      cy.findByTestId("maxDeltaTimeSeconds").type("1");
-      cy.findByTestId("minimumQuickLoginWaitSeconds").type("1");
-      realmSettingsPage.saveSecurityDefensesBruteForce();
-      masthead.checkNotificationMessage("Realm successfully updated");
-    });
-  });
-
-  describe("Go to localization tab", () => {
-    it("Locales tab - Add locale", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationLocalesSubTab();
-
-      cy.findByTestId("internationalizationEnabled").click({ force: true });
-
-      cy.get(realmSettingsPage.supportedLocalesTypeahead)
-        .click()
-        .get(".pf-v5-c-menu__list-item")
-        .contains("Danish")
-        .click({ force: true });
-      cy.findByTestId("internationalizationEnabled").click({ force: true });
-
-      cy.intercept("GET", `/admin/realms/${realmName}/localization/en*`).as(
-        "load",
-      );
-
-      cy.findByTestId("localization-tab-save").click();
-      cy.wait("@load");
-
-      masthead.checkNotificationMessage("Realm successfully updated");
-    });
-
-    it("Realm Overrides - Add and delete bundle", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationRealmOverridesSubTab();
-
-      addBundle();
-
-      masthead.checkNotificationMessage(
-        "Success! The translation has been added.",
-      );
-
-      cy.findByTestId("editable-rows-table")
-        .contains("td", "123")
-        .should("be.visible");
-
-      cy.get(".pf-v5-c-table__action button").click();
-      cy.contains("button", "Delete").click();
-      cy.findByTestId("confirm").click();
-      masthead.checkNotificationMessage("Successfully removed translation(s).");
-    });
-
-    it("Realm Overrides - Search for and delete bundle", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationRealmOverridesSubTab();
-
-      addBundle();
-
-      cy.get('input[aria-label="Search"]').type("123");
-
-      cy.findByTestId("editable-rows-table")
-        .contains("td", "123")
-        .should("be.visible");
-
-      cy.findByTestId("selectAll").click();
-      cy.get('[data-testid="toolbar-deleteBtn"]').click();
-      cy.findByTestId("delete-selected-TranslationBtn").click();
-      cy.findByTestId("confirm").click();
-      masthead.checkNotificationMessage("Successfully removed translation(s).");
-    });
-
-    it("Realm Overrides - Edit and cancel edit message bundle", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationRealmOverridesSubTab();
-
-      addBundle();
-
-      cy.findByTestId("editTranslationBtn-0").click();
-      cy.findByTestId("editTranslationCancelBtn-0").click();
-
-      cy.findByTestId("editTranslationBtn-0").click();
-      cy.findByTestId("editTranslationValueInput-0")
-        .click()
-        .clear()
-        .type("def");
-      cy.findByTestId("editTranslationAcceptBtn-0").click();
-
-      cy.findByTestId("editable-rows-table")
-        .contains("td", "def")
-        .should("be.visible");
-
-      cy.get(".pf-v5-c-table__action button").click();
-      cy.contains("button", "Delete").click();
-      cy.findByTestId("confirm").click();
-
-      masthead.checkNotificationMessage("Successfully removed translation(s).");
-    });
-
-    it("Effective Message Bundles - Check before search message", () => {
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationEffectiveMessageBundlesSubTab();
-      cy.contains("h1", "Search for effective messages");
-    });
-  });
-
-  describe("Accessibility tests for realm settings", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToRealmSettings();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ realm settings/ general tab", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on login tab", () => {
-      realmSettingsPage.goToLoginTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on email tab", () => {
-      realmSettingsPage.goToEmailTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on themes tab", () => {
-      realmSettingsPage.goToThemesTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on keys tab/ keys list sub tab", () => {
-      keysTab.goToKeysTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on keys tab/ providers sub tab", () => {
-      keysTab.goToProvidersTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on keys tab/ providers sub tab / adding provider", () => {
-      keysTab.goToProvidersTab();
-      cy.findByTestId("addProviderDropdown").click();
-      cy.checkA11y();
-      modalUtils.closeModal();
-    });
-
-    it("Check a11y violations on events tab/ event listeners sub tab", () => {
-      realmSettingsPage.goToEventsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on events tab/ user events settings sub tab", () => {
-      realmSettingsPage.goToEventsTab().goToUserEventsSettingsSubTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on events tab/ admin events settings sub tab", () => {
-      realmSettingsPage.goToEventsTab().goToAdminEventsSettingsSubTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on localization locales sub tab", () => {
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationLocalesSubTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on localization realm overrides sub tab", () => {
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationRealmOverridesSubTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on localization realm overrides sub tab/ adding message bundle", () => {
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationRealmOverridesSubTab();
-      cy.findByTestId("add-translationBtn").click();
-      cy.checkA11y();
-      modalUtils.cancelModal();
-    });
-
-    it("Check a11y violations on localization effective message bundles sub tab", () => {
-      realmSettingsPage.goToLocalizationTab();
-      realmSettingsPage.goToLocalizationEffectiveMessageBundlesSubTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on security defenses tab", () => {
-      realmSettingsPage.goToSecurityDefensesTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on sessions tab", () => {
-      realmSettingsPage.goToSessionsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on tokens tab", () => {
-      realmSettingsPage.goToTokensTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client policies tab/ profiles sub tab", () => {
-      realmSettingsPage.goToClientPoliciesTab().goToClientProfilesList();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client policies tab/ creating profile", () => {
-      realmSettingsPage.goToClientPoliciesTab().goToClientProfilesList();
-      cy.findByTestId("createProfile").click();
-      cy.checkA11y();
-      cy.findByTestId("cancelCreateProfile").click();
-    });
-
-    it("Check a11y violations on client policies tab/ policies sub tab", () => {
-      realmSettingsPage.goToClientPoliciesTab().goToClientPoliciesList();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on client policies tab/ creating policy", () => {
-      realmSettingsPage.goToClientPoliciesTab().goToClientPoliciesList();
-      cy.findByTestId("no-client-policies-empty-action").click();
-      cy.checkA11y();
-      cy.findByTestId("cancelCreatePolicy").click();
-    });
-
-    it("Check a11y violations on user registration tab/ default roles sub tab", () => {
-      userRegistration.goToTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user registration tab/ default roles sub tab/ assigning role", () => {
-      userRegistration.goToTab();
-      cy.findByTestId("assignRole").click();
-      cy.checkA11y();
-      modalUtils.cancelModal();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_settings_user_profile_enabled.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_settings_user_profile_enabled.spec.ts
deleted file mode 100644
index ed237e0de1f7..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_settings_user_profile_enabled.spec.ts
+++ /dev/null
@@ -1,421 +0,0 @@
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import UserProfile from "../support/pages/admin-ui/manage/realm_settings/UserProfile";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import ModalUtils from "../support/util/ModalUtils";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import CreateUserPage from "../support/pages/admin-ui/manage/users/CreateUserPage";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const userProfileTab = new UserProfile();
-const listingPage = new ListingPage();
-const modalUtils = new ModalUtils();
-const masthead = new Masthead();
-const realmSettingsPage = new RealmSettingsPage();
-const createUserPage = new CreateUserPage();
-
-// Selectors
-const getUserProfileTab = () => userProfileTab.goToTab();
-const getAttributesTab = () => userProfileTab.goToAttributesTab();
-const getAttributesGroupTab = () => userProfileTab.goToAttributesGroupTab();
-
-const usernameAttributeName = "username";
-const emailAttributeName = "email";
-
-describe("User profile tabs", () => {
-  const realmName = "Realm_" + crypto.randomUUID();
-  const attributeName = "Test";
-  const attributeDisplayName = "Test display name";
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToRealmSettings();
-  });
-
-  describe("Attributes sub tab tests", () => {
-    it("Goes to create attribute page", () => {
-      getUserProfileTab();
-      getAttributesTab();
-      userProfileTab.clickOnCreateAttributeButton();
-    });
-
-    it("Completes new attribute form and performs cancel", () => {
-      getUserProfileTab();
-      getAttributesTab();
-      userProfileTab
-        .clickOnCreateAttributeButton()
-        .setAttributeNames(attributeName, attributeDisplayName)
-        .cancelAttributeCreation()
-        .checkElementNotInList(attributeName);
-    });
-
-    it("Completes new attribute form and performs submit", () => {
-      getUserProfileTab();
-      getAttributesTab();
-      userProfileTab
-        .clickOnCreateAttributeButton()
-        .setAttributeNames(attributeName, attributeDisplayName)
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-    });
-
-    it("Modifies existing attribute and performs save", () => {
-      const attrName = "ModifyTest";
-      getUserProfileTab();
-      createAttributeDefinition(attrName);
-
-      userProfileTab
-        .selectElementInList(attrName)
-        .editAttribute("Edited display name")
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-    });
-
-    it("Adds and removes validator to/from existing attribute and performs save", () => {
-      getUserProfileTab();
-
-      userProfileTab
-        .selectElementInList(attributeName)
-        .cancelAddingValidator(emailAttributeName);
-      userProfileTab.addValidator(emailAttributeName);
-      cy.get('tbody [data-label="Validator name"]').contains(
-        emailAttributeName,
-      );
-
-      userProfileTab.cancelRemovingValidator();
-      userProfileTab.removeValidator();
-      cy.get(".kc-emptyValidators").contains("No validators.");
-    });
-  });
-
-  describe("Attribute groups sub tab tests", () => {
-    const group = "Test" + crypto.randomUUID();
-
-    before(() => adminClient.addGroupToProfile(realmName, group));
-
-    it("Deletes an attributes group", () => {
-      getUserProfileTab();
-      getAttributesGroupTab();
-      listingPage.deleteItem(group);
-      modalUtils.confirmModal();
-      listingPage.itemExist(group, false);
-    });
-  });
-
-  describe("Check attributes are displayed and editable on user create/edit", () => {
-    it("Checks that not required attribute is not present when user is created with email as username and edit username set to disabled", () => {
-      const attrName = "newAttribute1";
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setNoAttributePermissions(),
-      );
-
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLoginTab();
-      cy.wait(1000);
-      realmSettingsPage
-        .assertSwitch(realmSettingsPage.emailAsUsernameSwitch, false)
-        .assertSwitch(realmSettingsPage.editUsernameSwitch, false);
-
-      // Create user
-      sidebarPage.goToUsers();
-      cy.wait(1000);
-      createUserPage
-        .goToCreateUser()
-        .assertAttributeFieldExists(attrName, false)
-        .setUsername(`testuser7-${crypto.randomUUID()}`)
-        .create()
-        .assertNotificationCreated()
-        .assertAttributeFieldExists(attrName, false);
-
-      sidebarPage.goToRealmSettings();
-      getUserProfileTab();
-      getAttributesTab();
-      listingPage.deleteItem(attrName);
-      modalUtils.confirmModal();
-      masthead.checkNotificationMessage("Attribute deleted");
-    });
-
-    it("Checks that not required attribute is not present when user is created/edited with email as username enabled", () => {
-      const attrName = "newAttribute2";
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setNoAttributePermissions(),
-      );
-
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLoginTab();
-      cy.wait(1000);
-      realmSettingsPage
-        .setSwitch(realmSettingsPage.emailAsUsernameSwitch, true)
-        .assertSwitch(realmSettingsPage.emailAsUsernameSwitch, true)
-        .assertSwitch(realmSettingsPage.editUsernameSwitch, false);
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .setAttributeValue(
-          emailAttributeName,
-          `testuser8-${crypto.randomUUID()}@gmail.com`,
-        )
-        .assertAttributeFieldExists(attrName, false)
-        .create()
-        .assertNotificationCreated();
-
-      // Edit user
-      createUserPage
-        .assertAttributeFieldExists(attrName, false)
-        .setAttributeValue(
-          emailAttributeName,
-          `testuser9-${crypto.randomUUID()}@gmail.com`,
-        )
-        .update()
-        .assertNotificationUpdated();
-
-      deleteAttributeDefinition(attrName);
-    });
-
-    it("Checks that not required attribute with permissions to view/edit is present when user is created", () => {
-      const attrName = "newAttribute3";
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setAllAttributePermissions(),
-      );
-
-      sidebarPage.goToRealmSettings();
-      realmSettingsPage.goToLoginTab();
-      cy.wait(1000);
-      realmSettingsPage
-        .setSwitch(realmSettingsPage.emailAsUsernameSwitch, false)
-        .assertSwitch(realmSettingsPage.emailAsUsernameSwitch, false)
-        .setSwitch(realmSettingsPage.editUsernameSwitch, false)
-        .assertSwitch(realmSettingsPage.editUsernameSwitch, false);
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .assertAttributeFieldExists(attrName, true)
-        .setUsername(`testuser10-${crypto.randomUUID()}`)
-        .create()
-        .assertNotificationCreated()
-        .assertAttributeFieldExists(attrName, true);
-
-      deleteAttributeDefinition(attrName);
-    });
-
-    it("Checks that required attribute with permissions to view/edit is present and required when user is created", () => {
-      const attrName = "newAttribute4";
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setAllAttributePermissions().setAttributeRequired(),
-      );
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .assertAttributeLabel(attrName, attrName)
-        .setUsername(`testuser11-${crypto.randomUUID()}`)
-        .create()
-        .assertValidationErrorRequired(attrName);
-
-      createUserPage
-        .setAttributeValue(attrName, "MyAttribute")
-        .create()
-        .assertNotificationCreated();
-
-      deleteAttributeDefinition(attrName);
-    });
-
-    it("Checks that required attribute with permissions to view/edit is accepted when user is created", () => {
-      const attrName = "newAttribute5";
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setAllAttributePermissions().setAttributeRequired(),
-      );
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .assertAttributeLabel(attrName, attrName)
-        .setUsername(`testuser12-${crypto.randomUUID()}`)
-        .setAttributeValue(attrName, "MyAttribute")
-        .create()
-        .assertNotificationCreated();
-
-      deleteAttributeDefinition(attrName);
-    });
-
-    it("Checks that attribute group is visible when user with existing attribute is created", () => {
-      const group = "personalInfo";
-
-      getUserProfileTab();
-      getAttributesGroupTab()
-        .clickOnCreatesAttributesGroupButton()
-        .createAttributeGroup(group, group)
-        .saveAttributesGroupCreation()
-        .assertNotificationUpdated();
-
-      getAttributesTab();
-      userProfileTab
-        .selectElementInList(usernameAttributeName)
-        .setAttributeGroup(group)
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .assertGroupDisplayName(group, group)
-        .setUsername(`testuser14-${crypto.randomUUID()}`)
-        .create()
-        .assertNotificationCreated();
-
-      sidebarPage.goToRealmSettings();
-      getUserProfileTab();
-      getAttributesTab();
-      userProfileTab
-        .selectElementInList(usernameAttributeName)
-        .resetAttributeGroup()
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-    });
-
-    it("Checks that attribute group is visible when user with a new attribute is created", () => {
-      const group = "contact";
-      const attrName = "address";
-
-      getUserProfileTab();
-      getAttributesGroupTab()
-        .clickOnCreatesAttributesGroupButton()
-        .createAttributeGroup(group, group)
-        .saveAttributesGroupCreation()
-        .assertNotificationUpdated();
-
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer.setAllAttributePermissions(),
-      );
-
-      userProfileTab
-        .selectElementInList(attrName)
-        .setAttributeGroup(group)
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-
-      // Create user
-      sidebarPage.goToUsers();
-      const initialAttrValue = "MyNewAddress1";
-      createUserPage
-        .goToCreateUser()
-        .assertGroupDisplayName(group, group)
-        .assertAttributeLabel(attrName, attrName)
-        .setUsername(`testuser13-${crypto.randomUUID()}`)
-        .setAttributeValue(attrName, initialAttrValue)
-        .create()
-        .assertNotificationCreated()
-        .assertAttributeValue(attrName, initialAttrValue);
-
-      // Edit attribute
-      const newAttrValue = "MyNewAddress2";
-      createUserPage
-        .setAttributeValue(attrName, newAttrValue)
-        .update()
-        .assertNotificationUpdated()
-        .assertAttributeValue(attrName, newAttrValue);
-
-      sidebarPage.goToRealmSettings();
-      getUserProfileTab();
-      getAttributesTab();
-      userProfileTab
-        .selectElementInList(attrName)
-        .resetAttributeGroup()
-        .saveAttributeCreation()
-        .assertNotificationSaved();
-
-      deleteAttributeDefinition(attrName);
-    });
-
-    it("Checks that attribute with select-annotation is displayed and editable when user is created/edited", () => {
-      const userName = `select-test-user-${crypto.randomUUID()}`;
-      const attrName = "select-test-attr";
-      const opt1 = "opt1";
-      const opt2 = "opt2";
-      const supportedOptions = [opt1, opt2];
-
-      getUserProfileTab();
-      createAttributeDefinition(attrName, (attrConfigurer) =>
-        attrConfigurer
-          .setAllAttributePermissions()
-          .clickAddValidator()
-          .selectValidatorType("options")
-          .setListFieldValues("options", supportedOptions)
-          .clickSave(),
-      );
-
-      // Create user
-      sidebarPage.goToUsers();
-      createUserPage
-        .goToCreateUser()
-        .assertAttributeLabel(attrName, attrName)
-        .assertAttributeSelect(attrName, supportedOptions, "Select an option")
-        .setUsername(userName)
-        .setAttributeValueOnSelect(attrName, opt1)
-        .create()
-        .assertNotificationCreated()
-        .assertAttributeLabel(attrName, attrName)
-        .assertAttributeSelect(attrName, supportedOptions, opt1);
-
-      // Edit attribute
-      createUserPage
-        .setAttributeValueOnSelect(attrName, opt2)
-        .update()
-        .assertNotificationUpdated()
-        .assertAttributeLabel(attrName, attrName)
-        .assertAttributeSelect(attrName, supportedOptions, opt2);
-    });
-  });
-
-  function deleteAttributeDefinition(attrName: string) {
-    sidebarPage.goToRealmSettings();
-    getUserProfileTab();
-    getAttributesTab();
-    listingPage.deleteItem(attrName);
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("Attribute deleted");
-  }
-
-  function createAttributeDefinition(
-    attrName: string,
-    attrConfigurer?: (attrConfigurer: UserProfile) => void,
-  ) {
-    userProfileTab
-      .goToAttributesTab()
-      .clickOnCreateAttributeButton()
-      .setAttributeNames(attrName, attrName);
-
-    if (attrConfigurer) {
-      attrConfigurer(userProfileTab);
-    }
-
-    userProfileTab.saveAttributeCreation().assertNotificationSaved();
-  }
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_test.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_test.spec.ts
deleted file mode 100644
index 0a637816ad90..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_test.spec.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import CreateRealmPage from "../support/pages/admin-ui/CreateRealmPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import RealmSettings from "../support/pages/admin-ui/configure/realm_settings/RealmSettings";
-import ModalUtils from "../support/util/ModalUtils";
-import CommonPage from "../support/pages/CommonPage";
-
-const masthead = new Masthead();
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const createRealmPage = new CreateRealmPage();
-const realmSettings = new RealmSettings();
-const modalUtils = new ModalUtils();
-const commonPage = new CommonPage();
-
-const testRealmName = "Test-realm-" + crypto.randomUUID();
-const newRealmName = "New-Test-realm-" + crypto.randomUUID();
-const editedRealmName = "Edited-Test-realm-" + crypto.randomUUID();
-const testDisabledName = "Test-Disabled";
-const specialCharsName = "%22-" + crypto.randomUUID();
-
-describe("Realm tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-  });
-
-  after(() =>
-    Promise.all(
-      [testRealmName, newRealmName, editedRealmName, specialCharsName].map(
-        (realm) => adminClient.deleteRealm(realm),
-      ),
-    ),
-  );
-
-  it("should fail creating duplicated or empty name realm", () => {
-    sidebarPage.goToCreateRealm();
-
-    createRealmPage.createRealm(false).verifyRealmNameFieldInvalid();
-
-    createRealmPage.fillRealmName("master").createRealm();
-
-    masthead.checkNotificationMessage(
-      "Could not create realm Conflict detected. See logs for details",
-    );
-
-    createRealmPage.cancelRealmCreation();
-  });
-
-  it("should create Test realm", () => {
-    sidebarPage.goToCreateRealm();
-
-    // Test and clear resource field
-    createRealmPage.fillCodeEditor();
-    createRealmPage.clearTextField();
-
-    createRealmPage.fillRealmName(testRealmName).createRealm();
-
-    masthead.checkNotificationMessage("Realm created successfully");
-  });
-
-  it("CRUD test of Disabled realm", () => {
-    sidebarPage.goToCreateRealm();
-    sidebarPage.waitForPageLoad();
-
-    createRealmPage.fillRealmName(testDisabledName).createRealm();
-
-    masthead.checkNotificationMessage("Realm created successfully");
-
-    cy.reload();
-    sidebarPage.goToRealm(testDisabledName).goToRealmSettings();
-
-    createRealmPage.disableRealm();
-    modalUtils.confirmModal();
-
-    masthead.checkNotificationMessage("Realm successfully updated");
-
-    sidebarPage.goToRealm(testDisabledName).goToRealmSettings();
-    realmSettings.clickActionMenu();
-    cy.findByText("Delete").click();
-    modalUtils.cancelModal();
-
-    cy.reload();
-    sidebarPage.waitForPageLoad();
-    sidebarPage.goToRealm(testDisabledName).goToRealmSettings();
-    realmSettings.clickActionMenu();
-    cy.findByText("Delete").click();
-    modalUtils.confirmModal();
-    masthead.checkNotificationMessage("The realm has been deleted");
-
-    // Show current realms
-    sidebarPage.realmExists("Test-Disabled", false);
-  });
-
-  it("should create realm from new a realm", () => {
-    sidebarPage.goToCreateRealm();
-    createRealmPage.fillRealmName(newRealmName).createRealm();
-
-    masthead.checkNotificationMessage("Realm created successfully");
-
-    sidebarPage.goToCreateRealm();
-    createRealmPage.fillRealmName(editedRealmName).createRealm();
-
-    masthead.checkNotificationMessage("Realm created successfully");
-
-    // Show current realms
-    sidebarPage.showCurrentRealms(4);
-  });
-
-  it("should change to Test realm", () => {
-    sidebarPage.goToRealm(editedRealmName);
-    sidebarPage.getCurrentRealm().should("eq", editedRealmName);
-
-    sidebarPage
-      .goToRealm(testRealmName)
-      .getCurrentRealm()
-      .should("eq", testRealmName);
-  });
-
-  it("should create realm with special characters", () => {
-    sidebarPage.goToCreateRealm();
-    createRealmPage.fillRealmName(specialCharsName).createRealm();
-
-    sidebarPage.goToRealm(specialCharsName);
-    sidebarPage.goToClients();
-    commonPage.tableUtils().checkRowItemExists("account");
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/realm_user_registration.spec.ts b/js/apps/admin-ui/cypress/e2e/realm_user_registration.spec.ts
deleted file mode 100644
index 7624e9458481..000000000000
--- a/js/apps/admin-ui/cypress/e2e/realm_user_registration.spec.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import ClientRolesTab from "../support/pages/admin-ui/manage/clients/ClientRolesTab";
-import UserRegistration, {
-  GroupPickerDialog,
-} from "../support/pages/admin-ui/manage/realm_settings/UserRegistration";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import adminClient from "../support/util/AdminClient";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import ModalUtils from "../support/util/ModalUtils";
-
-describe("Realm settings - User registration tab", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const modalUtils = new ModalUtils();
-  const masthead = new Masthead();
-
-  const listingPage = new ListingPage();
-  const groupPicker = new GroupPickerDialog();
-  const userRegistration = new UserRegistration();
-  const rolesTab = new ClientRolesTab();
-
-  const groupName = "The default group";
-
-  before(() => adminClient.createGroup(groupName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealmSettings();
-    userRegistration.goToTab();
-  });
-
-  after(() => adminClient.deleteGroups());
-
-  it("Add admin role", () => {
-    const role = "admin";
-    const roleType = "roles";
-    userRegistration.addRole();
-    sidebarPage.waitForPageLoad();
-    userRegistration.changeRoleTypeFilter(roleType).selectRow(role).assign();
-    masthead.checkNotificationMessage("Associated roles have been added");
-    listingPage.searchItem(role, false).itemExist(role);
-
-    sidebarPage.goToRealmRoles();
-    listingPage.goToItemDetails("admin");
-    rolesTab.goToUsersInRoleTab();
-    cy.findByTestId("users-in-role-table").contains("admin");
-  });
-
-  it("Remove admin role", () => {
-    const role = "admin";
-    listingPage.markItemRow(role).removeMarkedItems("Unassign");
-    sidebarPage.waitForPageLoad();
-    modalUtils
-      .checkModalTitle("Remove role?")
-      .checkModalMessage("Are you sure you want to remove this role?")
-      .checkConfirmButtonText("Remove")
-      .confirmModal();
-    masthead.checkNotificationMessage("Role mapping updated");
-  });
-
-  it("Add default group", () => {
-    userRegistration.goToDefaultGroupTab().addDefaultGroup();
-    groupPicker.checkTitle("Add default groups").clickRow(groupName).clickAdd();
-    masthead.checkNotificationMessage("New group added to the default groups");
-    listingPage.itemExist(groupName);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/sessions_test.spec.ts b/js/apps/admin-ui/cypress/e2e/sessions_test.spec.ts
deleted file mode 100644
index c0e98f507ef9..000000000000
--- a/js/apps/admin-ui/cypress/e2e/sessions_test.spec.ts
+++ /dev/null
@@ -1,165 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import SessionsPage from "../support/pages/admin-ui/manage/sessions/SessionsPage";
-import CommonPage from "../support/pages/CommonPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import PageObject from "../support/pages/admin-ui/components/PageObject";
-import adminClient from "../support/util/AdminClient";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const sessionsPage = new SessionsPage();
-const commonPage = new CommonPage();
-const listingPage = new ListingPage();
-const page = new PageObject();
-
-describe("Sessions test", () => {
-  const admin = "admin";
-  const client = "security-admin-console";
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToSessions();
-  });
-
-  describe("Sessions list view", () => {
-    it("check item values", () => {
-      listingPage.searchItem(client, false);
-      commonPage
-        .tableUtils()
-        .checkRowItemExists(admin)
-        .checkRowItemExists(client)
-        .assertRowItemActionExist(admin, "Sign out");
-    });
-
-    it("go to item accessed clients link", () => {
-      listingPage.searchItem(client, false);
-      commonPage.tableUtils().clickRowItemLink(client);
-    });
-  });
-
-  describe("Offline sessions", () => {
-    const clientId = "offline-client-" + crypto.randomUUID();
-    const username = "user-" + crypto.randomUUID();
-
-    beforeEach(async () => {
-      await Promise.all([
-        adminClient.createClient({
-          protocol: "openid-connect",
-          clientId,
-          publicClient: false,
-          directAccessGrantsEnabled: true,
-          clientAuthenticatorType: "client-secret",
-          secret: "secret",
-          standardFlowEnabled: true,
-        }),
-        adminClient.createUser({
-          // Create user in master realm
-          username: username,
-          enabled: true,
-          credentials: [{ type: "password", value: "password" }],
-        }),
-      ]);
-
-      await adminClient.auth({
-        username,
-        password: "password",
-        grantType: "password",
-        clientId,
-        clientSecret: "secret",
-        scopes: ["openid", "offline_access"],
-      });
-    });
-
-    after(() =>
-      Promise.all([
-        adminClient.deleteClient(clientId),
-        adminClient.deleteUser(username),
-      ]),
-    );
-
-    it("check offline token", () => {
-      sidebarPage.waitForPageLoad();
-
-      listingPage.searchItem(clientId, false);
-      sidebarPage.waitForPageLoad();
-
-      // Now check that offline session exists (online one has been logged off above)
-      // and that it is possible to revoke it
-      commonPage
-        .tableUtils()
-        .checkRowItemExists(username)
-        .selectRowItemAction(username, "Revoke");
-    });
-  });
-
-  describe("Search", () => {
-    it("search existing session", () => {
-      listingPage.searchItem(admin, false);
-      listingPage.itemExist(admin, true);
-      page.assertEmptyStateExist(false);
-    });
-
-    it("search non-existant session", () => {
-      listingPage.searchItem("non-existant-session", false);
-      page.assertEmptyStateExist(true);
-    });
-  });
-
-  //TODO seems these tests are not stable on CI
-  describe.skip("revocation", () => {
-    it("Clear revocation notBefore", () => {
-      sessionsPage.clearNotBefore();
-    });
-
-    it("Check if notBefore cleared", () => {
-      sessionsPage.checkNotBeforeCleared();
-    });
-
-    it("Set revocation notBefore", () => {
-      sessionsPage.setToNow();
-    });
-
-    it("Check if notBefore saved", () => {
-      sessionsPage.checkNotBeforeValueExists();
-    });
-
-    it("Push when URI not configured", () => {
-      sessionsPage.pushRevocation();
-      commonPage
-        .masthead()
-        .checkNotificationMessage(
-          "No push sent. No admin URI configured or no registered cluster nodes available",
-        );
-    });
-  });
-
-  describe("Accessibility tests for sessions", () => {
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToSessions();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ sessions", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on revocation dialog", () => {
-      cy.findByTestId("action-dropdown").click();
-      cy.findByTestId("revocation").click();
-      cy.checkA11y();
-      cy.findByTestId("cancel").click();
-    });
-
-    it("Check a11y violations on sign out all active sessions dialog", () => {
-      cy.findByTestId("action-dropdown").click();
-      cy.findByTestId("logout-all").click();
-      cy.checkA11y();
-      cy.findByTestId("cancel").click();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/user_fed_kerberos_test.spec.ts b/js/apps/admin-ui/cypress/e2e/user_fed_kerberos_test.spec.ts
deleted file mode 100644
index 75b3620f0c41..000000000000
--- a/js/apps/admin-ui/cypress/e2e/user_fed_kerberos_test.spec.ts
+++ /dev/null
@@ -1,251 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ProviderPage from "../support/pages/admin-ui/manage/providers/ProviderPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import PriorityDialog from "../support/pages/admin-ui/manage/providers/PriorityDialog";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const providersPage = new ProviderPage();
-const modalUtils = new ModalUtils();
-
-const provider = "kerberos";
-const initCapProvider = provider.charAt(0).toUpperCase() + provider.slice(1);
-
-const kerberosName = "my-kerberos";
-const kerberosRealm = "my-realm";
-const kerberosPrincipal = "my-principal";
-const kerberosKeytab = "my-keytab";
-
-const firstKerberosName = `${kerberosName}-1`;
-const firstKerberosRealm = `${kerberosRealm}-1`;
-const firstKerberosPrincipal = `${kerberosPrincipal}-1`;
-const firstKerberosKeytab = `${kerberosKeytab}-1`;
-
-const secondKerberosName = `${kerberosName}-2`;
-const secondKerberosRealm = `${kerberosRealm}-2`;
-const secondKerberosPrincipal = `${kerberosPrincipal}-2`;
-const secondKerberosKeytab = `${kerberosKeytab}-2`;
-
-const defaultPolicy = "DEFAULT";
-const weeklyPolicy = "EVICT_WEEKLY";
-const dailyPolicy = "EVICT_DAILY";
-const lifespanPolicy = "MAX_LIFESPAN";
-const noCachePolicy = "NO_CACHE";
-
-const defaultKerberosDay = "Sunday";
-const defaultKerberosHour = "00";
-const defaultKerberosMinute = "00";
-const newKerberosDay = "Wednesday";
-const newKerberosHour = "15";
-const newKerberosMinute = "55";
-const maxLifespan = 5;
-
-const addProviderMenu = "Add new provider";
-const createdSuccessMessage = "User federation provider successfully created";
-const savedSuccessMessage = "User federation provider successfully saved";
-const deletedSuccessMessage = "The user federation provider has been deleted.";
-const deleteModalTitle = "Delete user federation provider?";
-const disableModalTitle = "Disable user federation provider?";
-const changeSuccessMsg =
-  "Successfully changed the priority order of user federation providers";
-
-describe("User Fed Kerberos tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should create Kerberos provider from empty state", () => {
-    // if tests don't start at empty state, e.g. user has providers configured locally,
-    // create a new card from the card view instead
-    cy.get("body").then(($body) => {
-      if ($body.find(`[data-testid=kerberos-card]`).length > 0) {
-        providersPage.clickNewCard(provider);
-      } else {
-        providersPage.clickMenuCommand(addProviderMenu, initCapProvider);
-      }
-    });
-    providersPage.fillKerberosRequiredData(
-      firstKerberosName,
-      firstKerberosRealm,
-      firstKerberosPrincipal,
-      firstKerberosKeytab,
-    );
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(createdSuccessMessage);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should enable debug, password authentication, and first login", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.toggleSwitch(providersPage.debugSwitch);
-    providersPage.toggleSwitch(providersPage.passwordAuthSwitch);
-    providersPage.toggleSwitch(providersPage.firstLoginSwitch);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    providersPage.verifyToggle(providersPage.debugSwitch, "on");
-    providersPage.verifyToggle(providersPage.passwordAuthSwitch, "on");
-    providersPage.verifyToggle(providersPage.firstLoginSwitch, "on");
-  });
-
-  it("Should set cache policy to evict_daily", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(dailyPolicy);
-    providersPage.changeCacheTime("hour", newKerberosHour);
-    providersPage.changeCacheTime("minute", newKerberosMinute);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    expect(cy.contains(dailyPolicy).should("exist"));
-    expect(cy.contains(defaultPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to default", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(defaultPolicy);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    expect(cy.contains(defaultPolicy).should("exist"));
-    expect(cy.contains(dailyPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to evict_weekly", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(weeklyPolicy);
-    providersPage.changeCacheTime("day", newKerberosDay);
-    providersPage.changeCacheTime("hour", newKerberosHour);
-    providersPage.changeCacheTime("minute", newKerberosMinute);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    expect(cy.contains(weeklyPolicy).should("exist"));
-    expect(cy.contains(defaultPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to max_lifespan", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(lifespanPolicy);
-    providersPage.fillMaxLifespanData(maxLifespan);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    expect(cy.contains(lifespanPolicy).should("exist"));
-    expect(cy.contains(weeklyPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to no_cache", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(noCachePolicy);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstKerberosName);
-
-    expect(cy.contains(noCachePolicy).should("exist"));
-    expect(cy.contains(lifespanPolicy).should("not.exist"));
-  });
-
-  it("Should edit existing Kerberos provider and cancel", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(weeklyPolicy);
-
-    providersPage.changeCacheTime("day", defaultKerberosDay);
-    providersPage.changeCacheTime("hour", defaultKerberosHour);
-    providersPage.changeCacheTime("minute", defaultKerberosMinute);
-
-    providersPage.cancel(provider);
-
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.selectCacheType(weeklyPolicy);
-
-    providersPage.verifyChangedHourInput(newKerberosHour, defaultKerberosHour);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should disable an existing Kerberos provider", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.disableEnabledSwitch(initCapProvider);
-
-    modalUtils.checkModalTitle(disableModalTitle).confirmModal();
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-
-    expect(cy.contains("Disabled").should("exist"));
-  });
-
-  it("Should enable an existing previously-disabled Kerberos provider", () => {
-    providersPage.clickExistingCard(firstKerberosName);
-    providersPage.enableEnabledSwitch(initCapProvider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    sidebarPage.goToUserFederation();
-    expect(cy.contains("Enabled").should("exist"));
-  });
-
-  it("Should create new Kerberos provider using the New Provider dropdown", () => {
-    providersPage.clickMenuCommand(addProviderMenu, initCapProvider);
-
-    providersPage.fillKerberosRequiredData(
-      secondKerberosName,
-      secondKerberosRealm,
-      secondKerberosPrincipal,
-      secondKerberosKeytab,
-    );
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(createdSuccessMessage);
-    sidebarPage.goToUserFederation();
-  });
-
-  it.skip("Should change the priority order of Kerberos providers", () => {
-    const priorityDialog = new PriorityDialog();
-    const providers = [firstKerberosName, secondKerberosName];
-
-    sidebarPage.goToUserFederation();
-    providersPage.clickMenuCommand(addProviderMenu, initCapProvider);
-
-    sidebarPage.goToUserFederation();
-    priorityDialog.openDialog().checkOrder(providers);
-    priorityDialog.clickSave();
-    masthead.checkNotificationMessage(changeSuccessMsg, true);
-  });
-
-  it("Should delete a Kerberos provider from card view using the card's menu", () => {
-    providersPage.deleteCardFromCard(secondKerberosName);
-    modalUtils.checkModalTitle(deleteModalTitle).confirmModal();
-    masthead.checkNotificationMessage(deletedSuccessMessage);
-  });
-
-  it("Should delete a Kerberos provider using the Settings view's Action menu", () => {
-    providersPage.deleteCardFromMenu(firstKerberosName);
-    modalUtils.checkModalTitle(deleteModalTitle).confirmModal();
-    masthead.checkNotificationMessage(deletedSuccessMessage);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_hardcoded_mapper_test.spec.ts b/js/apps/admin-ui/cypress/e2e/user_fed_ldap_hardcoded_mapper_test.spec.ts
deleted file mode 100644
index c73d27c1d303..000000000000
--- a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_hardcoded_mapper_test.spec.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import GroupModal from "../support/pages/admin-ui/manage/groups/GroupModal";
-import ProviderPage from "../support/pages/admin-ui/manage/providers/ProviderPage";
-import CreateClientPage from "../support/pages/admin-ui/manage/clients/CreateClientPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import GroupPage from "../support/pages/admin-ui/manage/groups/GroupPage";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const listingPage = new ListingPage();
-const groupModal = new GroupModal();
-const createClientPage = new CreateClientPage();
-const groupPage = new GroupPage();
-
-const providersPage = new ProviderPage();
-const modalUtils = new ModalUtils();
-
-const provider = "ldap";
-const allCapProvider = provider.toUpperCase();
-
-const ldapName = "ldap-mappers-testing";
-const ldapVendor = "Active Directory";
-
-// connection and authentication settings
-const connectionUrlValid = "ldap://localhost:3004";
-const bindTypeSimple = "simple";
-const truststoreSpiAlways = "Always";
-const connectionTimeoutTwoSecs = "2000";
-const bindDnCnDc = "cn=user,dc=test";
-const bindCredsValid = "user";
-
-// ldap searching and updating
-const editModeReadOnly = "READ_ONLY";
-const firstUsersDn = "user-dn-1";
-const firstUserLdapAtt = "uid";
-const firstRdnLdapAtt = "uid";
-const firstUuidLdapAtt = "entryUUID";
-const firstUserObjClasses = "inetOrgPerson, organizationalPerson";
-
-const addProviderMenu = "Add new provider";
-const providerCreatedSuccess = "User federation provider successfully created";
-const mapperCreatedSuccess = "Mapping successfully created";
-const providerDeleteSuccess = "The user federation provider has been deleted.";
-const providerDeleteTitle = "Delete user federation provider?";
-const mapperDeletedSuccess = "Mapping successfully deleted";
-const mapperDeleteTitle = "Delete mapping?";
-const groupDeleteTitle = "Delete group?";
-const groupCreatedSuccess = "Group created";
-const groupDeletedSuccess = "Group deleted";
-const clientCreatedSuccess = "Client created successfully";
-const clientDeletedSuccess = "The client has been deleted";
-const roleCreatedSuccess = "Role created";
-const groupName = "aa-uf-mappers-group";
-const clientName = "aa-uf-mappers-client";
-const roleName = "aa-uf-mappers-role";
-
-// mapperType variables
-const hcAttMapper = "hardcoded-attribute-mapper";
-const hcLdapGroupMapper = "hardcoded-ldap-group-mapper";
-const hcLdapAttMapper = "hardcoded-ldap-attribute-mapper";
-const roleLdapMapper = "role-ldap-mapper";
-const hcLdapRoleMapper = "hardcoded-ldap-role-mapper";
-
-// Used by "Delete default mappers" test
-const creationDateMapper = "creation date";
-const emailMapper = "email";
-const lastNameMapper = "last name";
-const modifyDateMapper = "modify date";
-
-describe("User Fed LDAP mapper tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Create LDAP provider from empty state", () => {
-    // if tests don't start at empty state, e.g. user has providers configured locally,
-    // create a new card from the card view instead
-    cy.get("body").then(($body) => {
-      if ($body.find(`[data-testid=ldap-card]`).length > 0) {
-        providersPage.clickNewCard(provider);
-      } else {
-        providersPage.clickMenuCommand(addProviderMenu, allCapProvider);
-      }
-    });
-    providersPage.fillLdapGeneralData(ldapName, ldapVendor);
-    providersPage.fillLdapConnectionData(
-      connectionUrlValid,
-      bindTypeSimple,
-      truststoreSpiAlways,
-      connectionTimeoutTwoSecs,
-      bindDnCnDc,
-      bindCredsValid,
-    );
-    providersPage.toggleSwitch(providersPage.enableStartTls);
-    providersPage.toggleSwitch(providersPage.connectionPooling);
-
-    providersPage.fillLdapSearchingData(
-      editModeReadOnly,
-      firstUsersDn,
-      firstUserLdapAtt,
-      firstRdnLdapAtt,
-      firstUuidLdapAtt,
-      firstUserObjClasses,
-    );
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(providerCreatedSuccess);
-    sidebarPage.goToUserFederation();
-  });
-
-  // create a new group
-  it("Create group", () => {
-    sidebarPage.goToGroups();
-    groupPage.openCreateGroupModal(true);
-    groupModal.setGroupNameInput(groupName).create();
-    masthead.checkNotificationMessage(groupCreatedSuccess);
-  });
-
-  // create a new client and then new role for that client
-  it("Create client and role", () => {
-    sidebarPage.goToClients();
-    listingPage.goToCreateItem();
-    createClientPage
-      .selectClientType("OpenID Connect")
-      .fillClientData(clientName)
-      .continue()
-      .continue()
-      .save();
-
-    masthead.checkNotificationMessage(clientCreatedSuccess);
-
-    providersPage.createRole(roleName);
-    masthead.checkNotificationMessage(roleCreatedSuccess);
-
-    sidebarPage.goToClients();
-    listingPage.searchItem(clientName).itemExist(clientName);
-  });
-
-  // delete four default mappers
-  it("Delete default mappers", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-
-    listingPage.itemExist(creationDateMapper).deleteItem(creationDateMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(creationDateMapper, false);
-
-    listingPage.itemExist(emailMapper).deleteItem(emailMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(emailMapper, false);
-
-    listingPage.itemExist(lastNameMapper).deleteItem(lastNameMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(lastNameMapper, false);
-
-    listingPage.itemExist(modifyDateMapper).deleteItem(modifyDateMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(modifyDateMapper, false);
-  });
-
-  // create one of each hardcoded mapper type
-  it("Create hardcoded attribute mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(hcAttMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(hcAttMapper, true);
-  });
-
-  it("Create hardcoded ldap group mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(hcLdapGroupMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(hcLdapGroupMapper, true);
-  });
-
-  it("Create hardcoded ldap attribute mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(hcLdapAttMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(hcLdapAttMapper, true);
-  });
-
-  it("Create hardcoded ldap role mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(hcLdapRoleMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(hcLdapRoleMapper, true);
-  });
-
-  it("Create role ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(roleLdapMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(roleLdapMapper, true);
-  });
-
-  // *** test cleanup ***
-  it("Cleanup - delete LDAP provider", () => {
-    providersPage.deleteCardFromMenu(ldapName);
-    modalUtils.checkModalTitle(providerDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(providerDeleteSuccess);
-  });
-
-  it("Cleanup - delete group", () => {
-    sidebarPage.goToGroups();
-    listingPage.deleteItem(groupName);
-    modalUtils.checkModalTitle(groupDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(groupDeletedSuccess);
-  });
-
-  it("Cleanup - delete client", () => {
-    sidebarPage.goToClients();
-    listingPage.deleteItem(clientName);
-    modalUtils.checkModalTitle(`Delete ${clientName} ?`).confirmModal();
-    masthead.checkNotificationMessage(clientDeletedSuccess);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_mapper_test.spec.ts b/js/apps/admin-ui/cypress/e2e/user_fed_ldap_mapper_test.spec.ts
deleted file mode 100644
index 737c4323351c..000000000000
--- a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_mapper_test.spec.ts
+++ /dev/null
@@ -1,276 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import ProviderPage from "../support/pages/admin-ui/manage/providers/ProviderPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const listingPage = new ListingPage();
-
-const providersPage = new ProviderPage();
-const modalUtils = new ModalUtils();
-
-const provider = "ldap";
-const allCapProvider = provider.toUpperCase();
-
-const ldapName = "ldap-mappers-testing";
-const ldapVendor = "Active Directory";
-
-// connection and authentication settings
-const connectionUrlValid = "ldap://localhost:3004";
-const bindTypeSimple = "simple";
-const truststoreSpiAlways = "Always";
-const connectionTimeoutTwoSecs = "2000";
-const bindDnCnDc = "cn=user,dc=test";
-const bindCredsValid = "user";
-
-// ldap searching and updating
-const editModeReadOnly = "READ_ONLY";
-const firstUsersDn = "user-dn-1";
-const firstUserLdapAtt = "uid";
-const firstRdnLdapAtt = "uid";
-const firstUuidLdapAtt = "entryUUID";
-const firstUserObjClasses = "inetOrgPerson, organizationalPerson";
-
-const addProviderMenu = "Add new provider";
-const providerCreatedSuccess = "User federation provider successfully created";
-const mapperCreatedSuccess = "Mapping successfully created";
-const mapperUpdatedSuccess = "Mapping successfully updated";
-const providerDeleteSuccess = "The user federation provider has been deleted.";
-const providerDeleteTitle = "Delete user federation provider?";
-const mapperDeletedSuccess = "Mapping successfully deleted";
-const mapperDeleteTitle = "Delete mapping?";
-
-// mapperType variables
-const msadUserAcctMapper = "msad-user-account-control-mapper";
-const msadLdsUserAcctMapper = "msad-lds-user-account-control-mapper";
-const userAttLdapMapper = "user-attribute-ldap-mapper";
-const fullNameLdapMapper = "full-name-ldap-mapper";
-const groupLdapMapper = "group-ldap-mapper";
-const certLdapMapper = "certificate-ldap-mapper";
-
-const mapperNames = [
-  `${msadUserAcctMapper}-test`,
-  `${msadLdsUserAcctMapper}-test`,
-  `${userAttLdapMapper}-test`,
-  `${fullNameLdapMapper}-test`,
-  `${groupLdapMapper}-test`,
-];
-const multiMapperNames = mapperNames.slice(2);
-const singleMapperName = mapperNames.slice(4);
-const uniqueSearchTerm = "group";
-const multipleSearchTerm = "ldap";
-const nonexistingSearchTerm = "redhat";
-
-// Used by "Delete default mappers" test
-const creationDateMapper = "creation date";
-const emailMapper = "email";
-const lastNameMapper = "last name";
-const modifyDateMapper = "modify date";
-const usernameMapper = "username";
-const firstNameMapper = "first name";
-const MsadAccountControlsMapper = "MSAD account controls";
-
-describe("User Fed LDAP mapper tests", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Create LDAP provider from empty state", () => {
-    // if tests don't start at empty state, e.g. user has providers configured locally,
-    // create a new card from the card view instead
-    cy.get("body").then(($body) => {
-      if ($body.find(`[data-testid=ldap-card]`).length > 0) {
-        providersPage.clickNewCard(provider);
-      } else {
-        providersPage.clickMenuCommand(addProviderMenu, allCapProvider);
-      }
-    });
-    providersPage.fillLdapGeneralData(ldapName, ldapVendor);
-    providersPage.fillLdapConnectionData(
-      connectionUrlValid,
-      bindTypeSimple,
-      truststoreSpiAlways,
-      connectionTimeoutTwoSecs,
-      bindDnCnDc,
-      bindCredsValid,
-    );
-    providersPage.toggleSwitch(providersPage.enableStartTls);
-    providersPage.toggleSwitch(providersPage.connectionPooling);
-
-    providersPage.fillLdapSearchingData(
-      editModeReadOnly,
-      firstUsersDn,
-      firstUserLdapAtt,
-      firstRdnLdapAtt,
-      firstUuidLdapAtt,
-      firstUserObjClasses,
-    );
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(providerCreatedSuccess);
-    sidebarPage.goToUserFederation();
-  });
-
-  // delete default mappers
-  it("Delete default mappers", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-
-    listingPage.itemExist(creationDateMapper).deleteItem(creationDateMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(creationDateMapper, false);
-
-    listingPage.itemExist(emailMapper).deleteItem(emailMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(emailMapper, false);
-
-    listingPage.itemExist(lastNameMapper).deleteItem(lastNameMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(lastNameMapper, false);
-
-    listingPage.itemExist(modifyDateMapper).deleteItem(modifyDateMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(modifyDateMapper, false);
-
-    listingPage.itemExist(usernameMapper).deleteItem(usernameMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(usernameMapper, false);
-
-    listingPage.itemExist(firstNameMapper).deleteItem(firstNameMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-    listingPage.itemExist(firstNameMapper, false);
-
-    listingPage
-      .itemExist(MsadAccountControlsMapper)
-      .deleteItem(MsadAccountControlsMapper);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess, true);
-  });
-
-  // mapper CRUD tests
-  // create mapper
-  it("Create certificate ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(certLdapMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(certLdapMapper, true);
-  });
-
-  // update mapper
-  it("Update certificate ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-
-    listingPage.goToItemDetails(`${certLdapMapper}-test`);
-    providersPage.updateMapper(certLdapMapper);
-
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperUpdatedSuccess);
-  });
-
-  // delete mapper
-  it("Delete certificate ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-
-    listingPage.deleteItem(`${certLdapMapper}-test`);
-    modalUtils.checkModalTitle(mapperDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(mapperDeletedSuccess);
-  });
-
-  // create one of each non-hardcoded mapper type except
-  // certificate ldap mapper which was already tested in CRUD section
-  it("Create user account control mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(msadUserAcctMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(msadUserAcctMapper, true);
-  });
-
-  it("Create msad lds user account control mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(msadLdsUserAcctMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(msadLdsUserAcctMapper, true);
-  });
-
-  it("Create user attribute ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(userAttLdapMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(userAttLdapMapper, true);
-  });
-
-  it("Create full name ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(fullNameLdapMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(fullNameLdapMapper, true);
-  });
-
-  it("Create group ldap mapper", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    providersPage.createNewMapper(groupLdapMapper);
-    providersPage.save("ldap-mapper");
-    masthead.checkNotificationMessage(mapperCreatedSuccess);
-    listingPage.itemExist(groupLdapMapper, true);
-  });
-
-  it("Should return one search result for mapper with unique string", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    listingPage.searchItem(uniqueSearchTerm, false);
-    singleMapperName.map((mapperName) => listingPage.itemExist(mapperName));
-  });
-
-  it("Should return multiple search results for mappers that share common string", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    listingPage.searchItem(multipleSearchTerm, false);
-    multiMapperNames.map((mapperName) => listingPage.itemExist(mapperName));
-  });
-
-  it("Should return all mappers in search results when no string is specified", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    listingPage.searchItem("", false);
-    mapperNames.map((mapperName) => listingPage.itemExist(mapperName));
-  });
-
-  it("Should return no search results for string that does not exist in any mappers", () => {
-    providersPage.clickExistingCard(ldapName);
-    providersPage.goToMappers();
-    listingPage.searchItem(nonexistingSearchTerm, false);
-    listingPage.assertNoResults();
-  });
-
-  // *** test cleanup ***
-  it("Cleanup - delete LDAP provider", () => {
-    providersPage.deleteCardFromMenu(ldapName);
-    modalUtils.checkModalTitle(providerDeleteTitle).confirmModal();
-    masthead.checkNotificationMessage(providerDeleteSuccess);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_test.spec.ts b/js/apps/admin-ui/cypress/e2e/user_fed_ldap_test.spec.ts
deleted file mode 100644
index f75932ae6eab..000000000000
--- a/js/apps/admin-ui/cypress/e2e/user_fed_ldap_test.spec.ts
+++ /dev/null
@@ -1,577 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import ProviderPage from "../support/pages/admin-ui/manage/providers/ProviderPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-
-const loginPage = new LoginPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-const providersPage = new ProviderPage();
-const modalUtils = new ModalUtils();
-
-const provider = "ldap";
-const allCapProvider = provider.toUpperCase();
-
-const firstLdapName = "my-ldap";
-const firstLdapVendor = "Active Directory";
-const secondLdapName = `${firstLdapName}-2`;
-const secondLdapVendor = "Other";
-const updatedLdapName = `${firstLdapName}-updated`;
-
-// connection and authentication settings
-const connectionUrlValid = "ldap://localhost:3004";
-const bindTypeSimple = "simple";
-const truststoreSpiAlways = "Always";
-const connectionTimeoutTwoSecs = "2000";
-const bindDnCnDc = "cn=user,dc=test";
-const bindCredsValid = "user";
-
-const connectionUrlInvalid = "ldap://nowhere.com";
-const bindTypeNone = "none";
-const truststoreSpiNever = "Never";
-const bindDnCnOnly = "cn=read-only-admin";
-const bindCredsInvalid = "not-my-password";
-
-// kerberos integration settings
-const kerberosRealm = "FOO.ORG";
-const serverPrincipal = "HTTP/host.foo.org@FOO.ORG";
-const keyTab = "/etc/krb5.keytab";
-
-// ldap synchronization settings
-const batchSize = "100";
-const fullSyncPeriod = "604800";
-const userSyncPeriod = "86400";
-
-// ldap searching and updating
-const editModeReadOnly = "READ_ONLY";
-const editModeWritable = "WRITABLE";
-const editModeUnsynced = "UNSYNCED";
-
-const firstUsersDn = "user-dn-1";
-const firstUserLdapAtt = "uid";
-const firstRdnLdapAtt = "uid";
-const firstUuidLdapAtt = "entryUUID";
-const firstUserObjClasses = "inetOrgPerson, organizationalPerson";
-const firstUserLdapFilter = "(first-filter)";
-const firstReadTimeout = "5000";
-
-const searchScopeOneLevel = "One Level";
-const searchScopeSubtree = "Subtree";
-
-const secondUsersDn = "user-dn-2";
-const secondUserLdapAtt = "cn";
-const secondRdnLdapAtt = "cn";
-const secondUuidLdapAtt = "objectGUID";
-const secondUserObjClasses = "person, organizationalPerson, user";
-const secondUserLdapFilter = "(second-filter)";
-const secondReadTimeout = "5000";
-
-const defaultPolicy = "DEFAULT";
-const weeklyPolicy = "EVICT_WEEKLY";
-const dailyPolicy = "EVICT_DAILY";
-const lifespanPolicy = "MAX_LIFESPAN";
-const noCachePolicy = "NO_CACHE";
-const defaultLdapDay = "Sunday";
-const defaultLdapHour = "00";
-const defaultLdapMinute = "00";
-const newLdapDay = "Wednesday";
-const newLdapHour = "15";
-const newLdapMinute = "55";
-const maxLifespan = 5;
-
-const addProviderMenu = "Add new provider";
-const createdSuccessMessage = "User federation provider successfully created";
-const savedSuccessMessage = "User federation provider successfully saved";
-const deletedSuccessMessage = "The user federation provider has been deleted.";
-const deleteModalTitle = "Delete user federation provider?";
-const disableModalTitle = "Disable user federation provider?";
-const validatePasswordPolicyFailMessage =
-  "User federation provider could not be saved: Validate Password Policy is applicable only with WRITABLE edit mode";
-const userImportingDisabledFailMessage =
-  "User federation provider could not be saved: Can not disable Importing users when LDAP provider mode is UNSYNCED";
-
-const ldapTestSuccessMsg = "Successfully connected to LDAP";
-const ldapTestFailMsg =
-  "Error when trying to connect to LDAP: 'CommunicationError'";
-
-describe("User Federation LDAP tests", () => {
-  const realmName = `ldap-realm-${crypto.randomUUID()}`;
-
-  before(() => adminClient.createRealm(realmName));
-
-  after(() => adminClient.deleteRealm(realmName));
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToRealm(realmName);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should create LDAP provider from empty state", () => {
-    // if tests don't start at empty state, e.g. user has providers configured locally,
-    // create a new card from the card view instead
-    cy.get("body").then(($body) => {
-      if ($body.find(`[data-testid=ldap-card]`).length > 0) {
-        providersPage.clickNewCard(provider);
-      } else {
-        providersPage.clickMenuCommand(addProviderMenu, allCapProvider);
-      }
-    });
-    providersPage.fillLdapGeneralData(firstLdapName, firstLdapVendor);
-    providersPage.fillLdapConnectionData(
-      connectionUrlInvalid,
-      bindTypeSimple,
-      truststoreSpiNever,
-      connectionTimeoutTwoSecs,
-      bindDnCnOnly,
-      bindCredsInvalid,
-    );
-    providersPage.fillLdapSearchingData(
-      editModeReadOnly,
-      firstUsersDn,
-      firstUserLdapAtt,
-      firstRdnLdapAtt,
-      firstUuidLdapAtt,
-      firstUserObjClasses,
-      firstUserLdapFilter,
-      searchScopeOneLevel,
-      firstReadTimeout,
-    );
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(createdSuccessMessage);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should fail updating advanced settings", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.toggleSwitch(providersPage.ldapv3PwSwitch);
-    providersPage.toggleSwitch(providersPage.validatePwPolicySwitch);
-    providersPage.toggleSwitch(providersPage.trustEmailSwitch);
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(validatePasswordPolicyFailMessage);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should update advanced settings", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.toggleSwitch(providersPage.ldapv3PwSwitch);
-    providersPage.toggleSwitch(providersPage.validatePwPolicySwitch);
-    providersPage.toggleSwitch(providersPage.trustEmailSwitch);
-    providersPage.fillLdapSearchingData(
-      editModeWritable,
-      secondUsersDn,
-      secondUserLdapAtt,
-      secondRdnLdapAtt,
-      secondUuidLdapAtt,
-      secondUserObjClasses,
-    );
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.verifyToggle(providersPage.ldapv3PwSwitch, "on");
-    providersPage.verifyToggle(providersPage.validatePwPolicySwitch, "on");
-    providersPage.verifyToggle(providersPage.trustEmailSwitch, "on");
-  });
-
-  it("Should set cache policy to evict_daily", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(dailyPolicy);
-    providersPage.changeCacheTime("hour", newLdapHour);
-    providersPage.changeCacheTime("minute", newLdapMinute);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    expect(cy.contains(dailyPolicy).should("exist"));
-    expect(cy.contains(defaultPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to default", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(defaultPolicy);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    expect(cy.contains(defaultPolicy).should("exist"));
-    expect(cy.contains(dailyPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to evict_weekly", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(weeklyPolicy);
-    providersPage.changeCacheTime("day", newLdapDay);
-    providersPage.changeCacheTime("hour", newLdapHour);
-    providersPage.changeCacheTime("minute", newLdapMinute);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    expect(cy.contains(weeklyPolicy).should("exist"));
-    expect(cy.contains(defaultPolicy).should("not.exist"));
-  });
-
-  it("Update connection and authentication settings and save", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.fillLdapConnectionData(
-      connectionUrlInvalid,
-      bindTypeNone,
-      truststoreSpiNever,
-      connectionTimeoutTwoSecs,
-    );
-    providersPage.toggleSwitch(providersPage.enableStartTls);
-    providersPage.toggleSwitch(providersPage.connectionPooling);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    // now verify
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.verifyTextField(
-      providersPage.connectionUrlInput,
-      connectionUrlInvalid,
-    );
-    providersPage.verifyTextField(
-      providersPage.connectionTimeoutInput,
-      connectionTimeoutTwoSecs,
-    );
-    providersPage.verifySelect(
-      providersPage.truststoreSpiInput,
-      truststoreSpiNever,
-    );
-    providersPage.verifySelect(providersPage.bindTypeInput, bindTypeNone);
-    providersPage.verifyToggle(providersPage.enableStartTls, "on");
-    providersPage.verifyToggle(providersPage.connectionPooling, "on");
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should fail connection and authentication tests", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.testConnection();
-    masthead.checkNotificationMessage(ldapTestFailMsg);
-
-    providersPage.testAuthorization();
-    masthead.checkNotificationMessage(ldapTestFailMsg);
-
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should make changes and pass connection and authentication tests", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.fillLdapConnectionData(
-      connectionUrlValid,
-      bindTypeSimple,
-      truststoreSpiAlways,
-      connectionTimeoutTwoSecs,
-      bindDnCnDc,
-      bindCredsValid,
-    );
-    providersPage.toggleSwitch(providersPage.enableStartTls);
-    providersPage.toggleSwitch(providersPage.connectionPooling);
-
-    providersPage.save(provider);
-
-    providersPage.testConnection();
-    masthead.checkNotificationMessage(ldapTestSuccessMsg);
-
-    providersPage.testAuthorization();
-    masthead.checkNotificationMessage(ldapTestSuccessMsg);
-
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should update Kerberos integration settings and save", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.toggleSwitch(providersPage.allowKerberosAuth);
-    providersPage.toggleSwitch(providersPage.debug);
-    providersPage.toggleSwitch(providersPage.useKerberosForPwAuth);
-
-    providersPage.fillTextField(
-      providersPage.ldapKerberosRealmInput,
-      kerberosRealm,
-    );
-    providersPage.fillTextField(
-      providersPage.ldapServerPrincipalInput,
-      serverPrincipal,
-    );
-    providersPage.fillTextField(providersPage.ldapKeyTabInput, keyTab);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    // now verify
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.verifyTextField(
-      providersPage.ldapKerberosRealmInput,
-      kerberosRealm,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapServerPrincipalInput,
-      serverPrincipal,
-    );
-    providersPage.verifyTextField(providersPage.ldapKeyTabInput, keyTab);
-    providersPage.verifyToggle(providersPage.allowKerberosAuth, "on");
-    providersPage.verifyToggle(providersPage.debug, "on");
-    providersPage.verifyToggle(providersPage.useKerberosForPwAuth, "on");
-
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should update Synchronization settings and save", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.toggleSwitch(providersPage.importUsers);
-    providersPage.toggleSwitch(providersPage.periodicFullSync);
-    providersPage.toggleSwitch(providersPage.periodicUsersSync);
-
-    providersPage.fillTextField(providersPage.ldapBatchSizeInput, batchSize);
-    providersPage.fillTextField(
-      providersPage.ldapFullSyncPeriodInput,
-      fullSyncPeriod,
-    );
-    providersPage.fillTextField(
-      providersPage.ldapUsersSyncPeriodInput,
-      userSyncPeriod,
-    );
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    // now verify
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.verifyTextField(providersPage.ldapBatchSizeInput, batchSize);
-    providersPage.verifyTextField(
-      providersPage.ldapFullSyncPeriodInput,
-      fullSyncPeriod,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUsersSyncPeriodInput,
-      userSyncPeriod,
-    );
-    providersPage.verifyToggle(providersPage.periodicFullSync, "on");
-    providersPage.verifyToggle(providersPage.periodicUsersSync, "on");
-    providersPage.verifyToggle(providersPage.importUsers, "on");
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should update LDAP searching and updating settings and save", () => {
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.fillLdapSearchingData(
-      editModeWritable,
-      secondUsersDn,
-      secondUserLdapAtt,
-      secondRdnLdapAtt,
-      secondUuidLdapAtt,
-      secondUserObjClasses,
-      secondUserLdapFilter,
-      searchScopeSubtree,
-      secondReadTimeout,
-    );
-    providersPage.toggleSwitch(providersPage.ldapPagination);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    // now verify
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.verifySelect(
-      providersPage.ldapEditModeInput,
-      editModeWritable,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUsersDnInput,
-      secondUsersDn,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUserLdapAttInput,
-      secondUserLdapAtt,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapRdnLdapAttInput,
-      secondRdnLdapAtt,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUuidLdapAttInput,
-      secondUuidLdapAtt,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUserObjClassesInput,
-      secondUserObjClasses,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapUserLdapFilter,
-      secondUserLdapFilter,
-    );
-    providersPage.verifySelect(
-      providersPage.ldapSearchScopeInput,
-      searchScopeSubtree,
-    );
-    providersPage.verifyTextField(
-      providersPage.ldapReadTimeout,
-      secondReadTimeout,
-    );
-    providersPage.verifyToggle(providersPage.ldapPagination, "on");
-
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.fillSelect(providersPage.ldapEditModeInput, editModeUnsynced);
-
-    providersPage.toggleSwitch(providersPage.importUsers);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(validatePasswordPolicyFailMessage);
-
-    providersPage.toggleSwitch(providersPage.importUsers);
-    providersPage.toggleSwitch(providersPage.validatePwPolicySwitch);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(userImportingDisabledFailMessage);
-
-    providersPage.toggleSwitch(providersPage.importUsers);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    // now verify
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    providersPage.verifySelect(
-      providersPage.ldapEditModeInput,
-      editModeUnsynced,
-    );
-  });
-
-  it("Should update display name", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.fillLdapGeneralData(updatedLdapName);
-
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(updatedLdapName);
-
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should update existing LDAP provider and cancel", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(weeklyPolicy);
-
-    providersPage.changeCacheTime("day", defaultLdapDay);
-    providersPage.changeCacheTime("hour", defaultLdapHour);
-    providersPage.changeCacheTime("minute", defaultLdapMinute);
-
-    providersPage.cancel(provider);
-
-    providersPage.clickExistingCard(updatedLdapName);
-    providersPage.selectCacheType(weeklyPolicy);
-
-    providersPage.verifyChangedHourInput(newLdapHour, defaultLdapHour);
-
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should set cache policy to max_lifespan", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(lifespanPolicy);
-    providersPage.fillMaxLifespanData(maxLifespan);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    expect(cy.contains(lifespanPolicy).should("exist"));
-    expect(cy.contains(weeklyPolicy).should("not.exist"));
-  });
-
-  it("Should set cache policy to no_cache", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.selectCacheType(noCachePolicy);
-    providersPage.save(provider);
-
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    providersPage.clickExistingCard(firstLdapName);
-
-    expect(cy.contains(noCachePolicy).should("exist"));
-    expect(cy.contains(lifespanPolicy).should("not.exist"));
-  });
-
-  it("Should disable an existing LDAP provider", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.disableEnabledSwitch(allCapProvider);
-    modalUtils.checkModalTitle(disableModalTitle).confirmModal();
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    expect(cy.contains("Disabled").should("exist"));
-  });
-
-  it("Should enable a previously-disabled LDAP provider", () => {
-    providersPage.clickExistingCard(firstLdapName);
-    providersPage.enableEnabledSwitch(allCapProvider);
-    masthead.checkNotificationMessage(savedSuccessMessage);
-    sidebarPage.goToUserFederation();
-    expect(cy.contains("Enabled").should("exist"));
-  });
-
-  it("Should create new LDAP provider using New Provider dropdown", () => {
-    providersPage.clickMenuCommand(addProviderMenu, allCapProvider);
-    providersPage.fillLdapGeneralData(secondLdapName, secondLdapVendor);
-    providersPage.fillLdapConnectionData(
-      connectionUrlValid,
-      bindTypeSimple,
-      truststoreSpiNever,
-      connectionTimeoutTwoSecs,
-      bindDnCnOnly,
-      bindCredsInvalid,
-    );
-    providersPage.fillLdapSearchingData(
-      editModeWritable,
-      secondUsersDn,
-      secondUserLdapAtt,
-      secondRdnLdapAtt,
-      secondUuidLdapAtt,
-      secondUserObjClasses,
-    );
-    providersPage.save(provider);
-    masthead.checkNotificationMessage(createdSuccessMessage);
-    sidebarPage.goToUserFederation();
-  });
-
-  it("Should delete LDAP provider from card view using card menu", () => {
-    providersPage.deleteCardFromCard(secondLdapName);
-    modalUtils.checkModalTitle(deleteModalTitle).confirmModal();
-    masthead.checkNotificationMessage(deletedSuccessMessage);
-  });
-
-  it("Should delete LDAP provider using Settings view Action menu", () => {
-    providersPage.deleteCardFromMenu(firstLdapName);
-    modalUtils.checkModalTitle(deleteModalTitle).confirmModal();
-    masthead.checkNotificationMessage(deletedSuccessMessage);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/user_fed_test.spec.ts b/js/apps/admin-ui/cypress/e2e/user_fed_test.spec.ts
deleted file mode 100644
index ad435bc12ff0..000000000000
--- a/js/apps/admin-ui/cypress/e2e/user_fed_test.spec.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import LoginPage from "../support/pages/LoginPage";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-
-describe("Accessibility tests for user federation", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUserFederation();
-    cy.injectAxe();
-  });
-
-  it("Check a11y violations on load/ user federation", () => {
-    cy.checkA11y();
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/users_attribute_search_test.spec.ts b/js/apps/admin-ui/cypress/e2e/users_attribute_search_test.spec.ts
deleted file mode 100644
index 1fd5bb133a07..000000000000
--- a/js/apps/admin-ui/cypress/e2e/users_attribute_search_test.spec.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import adminClient from "../support/util/AdminClient";
-import {
-  DefaultUserAttribute,
-  UserFilterType,
-} from "../support/pages/admin-ui/manage/users/UsersListingPage";
-import UsersPage from "../support/pages/admin-ui/manage/users/UsersPage";
-
-describe("Query by user attributes", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const usersPage = new UsersPage();
-  const listingPage = usersPage.listing();
-
-  const emailSuffix = "@example.org";
-
-  const user1Username = "user-attrs-1";
-  const user1FirstName = "John";
-  const user1LastName = "Doe";
-  const user1Pwd = "pwd";
-  const user2Username = "user-attrs-2";
-  const user2FirstName = "Jane";
-  const user2LastName = user1LastName;
-
-  before(async () => {
-    await cleanupTestData();
-    const user1 = await adminClient.createUser({
-      username: user1Username,
-      credentials: [
-        {
-          type: "password",
-          value: user1Pwd,
-        },
-      ],
-      email: user1Username + emailSuffix,
-      firstName: user1FirstName,
-      lastName: user1LastName,
-      enabled: true,
-    });
-    const user1Id = user1.id!;
-    await adminClient.addClientRoleToUser(user1Id, "master-realm", [
-      "view-users",
-    ]);
-
-    await adminClient.createUser({
-      username: user2Username,
-      email: user2Username + emailSuffix,
-      firstName: user2FirstName,
-      lastName: user2LastName,
-      enabled: true,
-    });
-  });
-
-  beforeEach(() => {
-    loginPage.logIn(user1Username, user1Pwd);
-    keycloakBefore();
-    sidebarPage.goToUsers();
-  });
-
-  after(async () => {
-    await cleanupTestData();
-  });
-
-  async function cleanupTestData() {
-    await adminClient.deleteUser(user1Username, true);
-    await adminClient.deleteUser(user2Username, true);
-  }
-
-  it("Query with one attribute condition", () => {
-    listingPage
-      .selectUserSearchFilter(UserFilterType.AttributeSearch)
-      .openUserAttributesSearchForm()
-      .addUserAttributeSearchCriteria(
-        DefaultUserAttribute.lastName,
-        user1LastName,
-      )
-      .triggerAttributesSearch()
-      .itemExist(user1Username, true)
-      .itemExist(user2Username, true);
-  });
-
-  it("Query with two attribute conditions", () => {
-    listingPage
-      .selectUserSearchFilter(UserFilterType.AttributeSearch)
-      .openUserAttributesSearchForm()
-      .addUserAttributeSearchCriteria(
-        DefaultUserAttribute.lastName,
-        user1LastName,
-      )
-      .addUserAttributeSearchCriteria(
-        DefaultUserAttribute.firstName,
-        user1FirstName,
-      )
-      .triggerAttributesSearch()
-      .itemExist(user1Username, true)
-      .itemExist(user2Username, false);
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/users_enable_disable.spec.ts b/js/apps/admin-ui/cypress/e2e/users_enable_disable.spec.ts
deleted file mode 100644
index 10b132ab23f4..000000000000
--- a/js/apps/admin-ui/cypress/e2e/users_enable_disable.spec.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import UserRepresentation from "@keycloak/keycloak-admin-client/lib/defs/userRepresentation";
-import LoginPage from "../support/pages/LoginPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import UsersPage from "../support/pages/admin-ui/manage/users/UsersPage";
-import UserDetailsPage from "../support/pages/admin-ui/manage/users/user_details/UserDetailsPage";
-import adminClient from "../support/util/AdminClient";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-
-const loginPage = new LoginPage();
-const sidebarPage = new SidebarPage();
-const usersPage = new UsersPage();
-const userDetailsPage = new UserDetailsPage();
-const masthead = new Masthead();
-const modal = new ModalUtils();
-
-const createUser = (fields: UserRepresentation) =>
-  cy
-    .wrap(null)
-    .then(() =>
-      adminClient.createUser({ username: crypto.randomUUID(), ...fields }),
-    );
-
-const deleteUser = (username: string) =>
-  cy.wrap(null).then(() => adminClient.deleteUser(username));
-
-describe("User enable/disable", () => {
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUsers();
-  });
-
-  it("disables a user", () => {
-    createUser({ enabled: true }).then(({ username }) => {
-      usersPage.goToUserDetailsPage(username!);
-      userDetailsPage.assertEnabled(username!);
-
-      userDetailsPage.toggleEnabled(username!);
-      modal.confirmModal();
-      masthead.checkNotificationMessage("The user has been saved");
-      cy.wait(1000);
-      userDetailsPage.assertDisabled(username!);
-
-      return deleteUser(username!);
-    });
-  });
-
-  it("enables a user", () => {
-    createUser({ enabled: false }).then(({ username }) => {
-      usersPage.goToUserDetailsPage(username!);
-      userDetailsPage.assertDisabled(username!);
-
-      userDetailsPage.toggleEnabled(username!);
-      masthead.checkNotificationMessage("The user has been saved");
-      cy.wait(1000);
-      userDetailsPage.assertEnabled(username!);
-
-      return deleteUser(username!);
-    });
-  });
-
-  // See: https://github.com/keycloak/keycloak/issues/19647
-  it("ensures submitting doesn't reset the enabled state", () => {
-    createUser({ enabled: true }).then(({ username }) => {
-      usersPage.goToUserDetailsPage(username!);
-      userDetailsPage.assertEnabled(username!);
-
-      userDetailsPage.toggleEnabled(username!);
-      modal.confirmModal();
-      masthead.checkNotificationMessage("The user has been saved");
-      cy.wait(1000);
-      userDetailsPage.assertDisabled(username!);
-
-      userDetailsPage.save();
-      masthead.checkNotificationMessage("The user has been saved");
-      cy.wait(1000);
-      userDetailsPage.assertDisabled(username!);
-
-      return deleteUser(username!);
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/e2e/users_test.spec.ts b/js/apps/admin-ui/cypress/e2e/users_test.spec.ts
deleted file mode 100644
index d4b6a2abcad9..000000000000
--- a/js/apps/admin-ui/cypress/e2e/users_test.spec.ts
+++ /dev/null
@@ -1,626 +0,0 @@
-import SidebarPage from "../support/pages/admin-ui/SidebarPage";
-import LoginPage from "../support/pages/LoginPage";
-import RealmSettingsPage from "../support/pages/admin-ui/manage/realm_settings/RealmSettingsPage";
-import CreateUserPage from "../support/pages/admin-ui/manage/users/CreateUserPage";
-import Masthead from "../support/pages/admin-ui/Masthead";
-import ListingPage from "../support/pages/admin-ui/ListingPage";
-import UserDetailsPage from "../support/pages/admin-ui/manage/users/user_details/UserDetailsPage";
-import AttributesTab from "../support/pages/admin-ui/manage/AttributesTab";
-import ModalUtils from "../support/util/ModalUtils";
-import { keycloakBefore } from "../support/util/keycloak_hooks";
-import UserGroupsPage from "../support/pages/admin-ui/manage/users/UserGroupsPage";
-import adminClient from "../support/util/AdminClient";
-import CredentialsPage from "../support/pages/admin-ui/manage/users/CredentialsPage";
-import UsersPage from "../support/pages/admin-ui/manage/users/UsersPage";
-import IdentityProviderLinksTab from "../support/pages/admin-ui/manage/users/user_details/tabs/IdentityProviderLinksTab";
-import RoleMappingTab from "../support/pages/admin-ui/manage/RoleMappingTab";
-import CommonPage from "../support/pages/CommonPage";
-
-let groupName = "group";
-let groupsList: string[] = [];
-
-describe("User creation", () => {
-  const loginPage = new LoginPage();
-  const sidebarPage = new SidebarPage();
-  const realmSettingsPage = new RealmSettingsPage();
-  const createUserPage = new CreateUserPage();
-  const userGroupsPage = new UserGroupsPage();
-  const masthead = new Masthead();
-  const modalUtils = new ModalUtils();
-  const listingPage = new ListingPage();
-  const userDetailsPage = new UserDetailsPage();
-  const credentialsPage = new CredentialsPage();
-  const attributesTab = new AttributesTab(true);
-  const usersPage = new UsersPage();
-  const identityProviderLinksTab = new IdentityProviderLinksTab();
-
-  let itemId = "user_crud";
-  let itemIdWithGroups = "user_with_groups_crud";
-  let itemIdWithCred = "user_crud_cred";
-  const itemCredential = "Password";
-
-  before(async () => {
-    for (let i = 0; i <= 2; i++) {
-      groupName += "_" + crypto.randomUUID();
-      await adminClient.createGroup(groupName);
-      groupsList = [...groupsList, groupName];
-    }
-  });
-
-  beforeEach(() => {
-    loginPage.logIn();
-    keycloakBefore();
-    sidebarPage.goToUsers();
-  });
-
-  after(() => adminClient.deleteGroups());
-
-  it("Go to create User page", () => {
-    createUserPage.goToCreateUser();
-    cy.url().should("include", "users/add-user");
-
-    // Verify Cancel button works
-    createUserPage.cancel();
-    cy.url().should("not.include", "/add-user");
-  });
-
-  it("Create user test", () => {
-    itemId += "_" + crypto.randomUUID();
-    // Create
-    createUserPage.goToCreateUser();
-
-    createUserPage.createUser(itemId);
-
-    createUserPage.create();
-
-    masthead.checkNotificationMessage("The user has been created");
-  });
-
-  it("Should check temporary admin user existence", () => {
-    const commonPage = new CommonPage();
-
-    // check banner visibility first
-    cy.get(".pf-v5-c-banner").should(
-      "contain.text",
-      "You are logged in as a temporary admin user.",
-    );
-
-    commonPage.tableToolbarUtils().searchItem("admin", false);
-    commonPage.tableUtils().checkRowItemExists("admin");
-    commonPage
-      .tableUtils()
-      .checkTemporaryAdminLabelExists("temporary-admin-label");
-  });
-
-  it("Create user with groups test", () => {
-    itemIdWithGroups += crypto.randomUUID();
-    // Add user from search bar
-    createUserPage.goToCreateUser();
-
-    createUserPage.createUser(itemIdWithGroups);
-
-    createUserPage.toggleAddGroupModal();
-
-    const groupsListCopy = groupsList.slice(0, 1);
-
-    groupsListCopy.forEach((element) => {
-      cy.findByTestId(`${element}-check`).click();
-    });
-
-    createUserPage.joinGroups();
-
-    createUserPage.create();
-
-    masthead.checkNotificationMessage("The user has been created");
-  });
-
-  it("Create user with credentials test", () => {
-    itemIdWithCred += "_" + crypto.randomUUID();
-
-    // Add user from search bar
-    createUserPage.goToCreateUser();
-
-    createUserPage.createUser(itemIdWithCred);
-
-    userDetailsPage.fillUserData();
-    createUserPage.create();
-    masthead.checkNotificationMessage("The user has been created");
-    sidebarPage.waitForPageLoad();
-
-    credentialsPage
-      .goToCredentialsTab()
-      .clickEmptyStatePasswordBtn()
-      .fillPasswordForm()
-      .clickConfirmationBtn()
-      .clickSetPasswordBtn();
-  });
-
-  it("Search existing user test", () => {
-    listingPage.searchItem(itemId).itemExist(itemId);
-  });
-
-  it("Search non-existing user test", () => {
-    listingPage.searchItem("user_DNE");
-    listingPage.assertNoResults();
-  });
-
-  it("User details test", () => {
-    sidebarPage.waitForPageLoad();
-    listingPage.searchItem(itemId).itemExist(itemId);
-
-    listingPage.goToItemDetails(itemId);
-
-    userDetailsPage.fillUserData().save();
-
-    masthead.checkNotificationMessage("The user has been saved");
-
-    sidebarPage.waitForPageLoad();
-    sidebarPage.goToUsers();
-    listingPage.searchItem(itemId).itemExist(itemId);
-  });
-
-  it("Select Unmanaged attributes", () => {
-    sidebarPage.goToRealmSettings();
-    sidebarPage.waitForPageLoad();
-    realmSettingsPage.fillUnmanagedAttributes("Enabled");
-    realmSettingsPage.save(realmSettingsPage.generalSaveBtn);
-    masthead.checkNotificationMessage("Realm successfully updated", true);
-  });
-
-  it("User attributes test", () => {
-    listingPage.goToItemDetails(itemId);
-
-    attributesTab
-      .goToAttributesTab()
-      .addAttribute("key_test", "value_test")
-      .save();
-
-    masthead.checkNotificationMessage("The user has been saved");
-
-    attributesTab
-      .addAttribute("LDAP_ID", "value_test")
-      .addAttribute("LDAP_ID", "another_value_test")
-      .addAttribute("c", "d")
-      .save();
-
-    masthead.checkNotificationMessage("The user has not been saved: ");
-
-    cy.get(".pf-v5-c-helper-text__item-text")
-      .filter(':contains("Update of read-only attribute rejected")')
-      .should("have.length", 2);
-
-    cy.reload();
-
-    userDetailsPage.goToDetailsTab();
-    attributesTab
-      .goToAttributesTab()
-      .checkAttribute("key_test", true)
-      .deleteAttribute(0);
-
-    userDetailsPage.goToDetailsTab();
-    attributesTab.goToAttributesTab().checkAttribute("key_test", false);
-  });
-
-  it("User attributes with multiple values test", () => {
-    listingPage.searchItem(itemId).itemExist(itemId);
-    listingPage.goToItemDetails(itemId);
-
-    cy.intercept("PUT", `/admin/realms/master/users/*`).as("save-user");
-
-    const attributeKey = "key-multiple";
-    attributesTab
-      .goToAttributesTab()
-      .addAttribute(attributeKey, "other value")
-      .save();
-
-    masthead.checkNotificationMessage("The user has been saved");
-
-    cy.wait("@save-user").should(({ request, response }) => {
-      expect(response?.statusCode).to.equal(204);
-      expect(request.body.attributes, "response body").deep.contains({
-        "key-multiple": ["other value"],
-      });
-    });
-  });
-
-  it("Add user to groups test", () => {
-    // Go to user groups
-    listingPage.searchItem(itemId).itemExist(itemId);
-    listingPage.goToItemDetails(itemId);
-
-    userGroupsPage.goToGroupsTab();
-    userGroupsPage.toggleAddGroupModal();
-
-    const groupsListCopy = groupsList.slice(0, 3);
-
-    groupsListCopy.forEach((element) => {
-      cy.findByTestId(`${element}-check`).click();
-    });
-
-    userGroupsPage.joinGroups();
-  });
-
-  it("Leave group test", () => {
-    listingPage.searchItem(itemId).itemExist(itemId);
-    listingPage.goToItemDetails(itemId);
-    // Go to user groups
-    userGroupsPage.goToGroupsTab();
-    cy.findByTestId(`leave-${groupsList[0]}`).click();
-    cy.findByTestId("confirm").click({ force: true });
-  });
-
-  it("search and leave group", () => {
-    listingPage.searchItem(itemId).itemExist(itemId);
-    listingPage.goToItemDetails(itemId);
-    userGroupsPage.goToGroupsTab();
-
-    listingPage.searchItem("group");
-    userGroupsPage.leaveGroupButtonDisabled();
-
-    listingPage.clickTableHeaderItemCheckboxAllRows();
-    userGroupsPage.leaveGroupButtonEnabled();
-    userGroupsPage.leaveGroup();
-  });
-
-  it("Go to user consents test", () => {
-    listingPage.searchItem(itemId).itemExist(itemId);
-
-    sidebarPage.waitForPageLoad();
-    listingPage.goToItemDetails(itemId);
-
-    cy.findByTestId("user-consents-tab").click();
-    cy.findByTestId("empty-state").contains("No consents");
-  });
-
-  describe("Identity provider links", () => {
-    const usernameIdpLinksTest = "user_idp_link_test";
-    const identityProviders = [
-      { testName: "Bitbucket", displayName: "BitBucket", alias: "bitbucket" },
-      { testName: "Facebook", displayName: "Facebook", alias: "facebook" },
-      {
-        testName: "Keycloak-oidc",
-        displayName: "Keycloak OpenID Connect",
-        alias: "keycloak-oidc",
-      },
-    ];
-
-    before(async () => {
-      await Promise.all([
-        adminClient.createUser({
-          username: usernameIdpLinksTest,
-          enabled: true,
-        }),
-        identityProviders.forEach((idp) =>
-          adminClient.createIdentityProvider(idp.displayName, idp.alias),
-        ),
-      ]);
-    });
-
-    after(async () => {
-      await adminClient.deleteUser(usernameIdpLinksTest);
-      await Promise.all(
-        identityProviders.map((idp) =>
-          adminClient.deleteIdentityProvider(idp.alias),
-        ),
-      );
-    });
-
-    beforeEach(() => {
-      usersPage.goToUserListTab().goToUserDetailsPage(usernameIdpLinksTest);
-      userDetailsPage.goToIdentityProviderLinksTab();
-    });
-
-    identityProviders.forEach(($idp, linkedIdpsCount) => {
-      it(`Link account to IdP:  ${$idp.testName}`, () => {
-        const availableIdpsCount = identityProviders.length - linkedIdpsCount;
-
-        if (linkedIdpsCount == 0) {
-          identityProviderLinksTab.assertNoIdentityProvidersLinkedMessageExist(
-            true,
-          );
-        }
-        identityProviderLinksTab
-          .assertAvailableIdentityProvidersItemsEqual(availableIdpsCount)
-          .clickLinkAccount($idp.testName)
-          .assertLinkAccountModalTitleEqual($idp.testName)
-          .assertLinkAccountModalIdentityProviderInputEqual($idp.testName)
-          .typeLinkAccountModalUserId("testUserId")
-          .typeLinkAccountModalUsername("testUsername")
-          .clickLinkAccountModalLinkBtn()
-          .assertNotificationIdentityProviderLinked()
-          .assertLinkedIdentityProvidersItemsEqual(linkedIdpsCount + 1)
-          .assertAvailableIdentityProvidersItemsEqual(availableIdpsCount - 1)
-          .assertLinkedIdentityProviderExist($idp.testName, true)
-          .assertAvailableIdentityProviderExist($idp.testName, false);
-        if (availableIdpsCount - 1 == 0) {
-          identityProviderLinksTab.assertNoAvailableIdentityProvidersMessageExist(
-            true,
-          );
-        }
-      });
-    });
-
-    it("Link account to already added IdP fail", () => {
-      cy.wrap(null).then(() =>
-        adminClient.unlinkAccountIdentityProvider(
-          usernameIdpLinksTest,
-          identityProviders[0].displayName,
-        ),
-      );
-
-      sidebarPage.goToUsers();
-      usersPage.goToUserListTab().goToUserDetailsPage(usernameIdpLinksTest);
-      userDetailsPage.goToIdentityProviderLinksTab();
-
-      cy.wrap(null).then(() =>
-        adminClient.linkAccountIdentityProvider(
-          usernameIdpLinksTest,
-          identityProviders[0].displayName,
-        ),
-      );
-
-      identityProviderLinksTab
-        .clickLinkAccount(identityProviders[0].testName)
-        .assertLinkAccountModalTitleEqual(identityProviders[0].testName)
-        .assertLinkAccountModalIdentityProviderInputEqual(
-          identityProviders[0].testName,
-        )
-        .typeLinkAccountModalUserId("testUserId")
-        .typeLinkAccountModalUsername("testUsername")
-        .clickLinkAccountModalLinkBtn()
-        .assertNotificationAlreadyLinkedError();
-      modalUtils.cancelModal();
-    });
-
-    identityProviders.forEach(($idp, availableIdpsCount) => {
-      it(`Unlink account from IdP:  ${$idp.testName}`, () => {
-        const linkedIdpsCount = identityProviders.length - availableIdpsCount;
-
-        if (availableIdpsCount == 0) {
-          identityProviderLinksTab.assertNoAvailableIdentityProvidersMessageExist(
-            true,
-          );
-        }
-        identityProviderLinksTab
-          .assertAvailableIdentityProvidersItemsEqual(availableIdpsCount)
-          .clickUnlinkAccount($idp.testName)
-          .assertUnLinkAccountModalTitleEqual($idp.testName)
-          .clickUnlinkAccountModalUnlinkBtn()
-          .assertNotificationPoviderLinkRemoved()
-          .assertLinkedIdentityProvidersItemsEqual(linkedIdpsCount - 1)
-          .assertAvailableIdentityProvidersItemsEqual(availableIdpsCount + 1)
-          .assertLinkedIdentityProviderExist($idp.testName, false)
-          .assertAvailableIdentityProviderExist($idp.testName, true);
-        if (linkedIdpsCount - 1 == 0) {
-          identityProviderLinksTab.assertNoIdentityProvidersLinkedMessageExist(
-            true,
-          );
-        }
-      });
-    });
-  });
-
-  it("Reset credential of User with empty state", () => {
-    listingPage.goToItemDetails(itemId);
-    credentialsPage
-      .goToCredentialsTab()
-      .clickEmptyStateResetBtn()
-      .fillResetCredentialForm();
-    masthead.checkNotificationMessage(
-      "Failed: Failed to send execute actions email",
-    );
-  });
-
-  it("Reset credential of User with existing credentials", () => {
-    listingPage.goToItemDetails(itemIdWithCred);
-    credentialsPage
-      .goToCredentialsTab()
-      .clickResetBtn()
-      .fillResetCredentialForm();
-
-    masthead.checkNotificationMessage(
-      "Failed: Failed to send execute actions email",
-    );
-  });
-
-  it("Edit credential label", () => {
-    listingPage.goToItemDetails(itemIdWithCred);
-    credentialsPage
-      .goToCredentialsTab()
-      .clickEditCredentialLabelBtn()
-      .fillEditCredentialForm()
-      .clickEditConfirmationBtn();
-
-    masthead.checkNotificationMessage(
-      "The user label has been changed successfully.",
-    );
-  });
-
-  it("Show credential data dialog", () => {
-    listingPage.goToItemDetails(itemIdWithCred);
-    credentialsPage
-      .goToCredentialsTab()
-      .clickShowDataDialogBtn()
-      .clickCloseDataDialogBtn();
-  });
-
-  it("Delete credential", () => {
-    listingPage.goToItemDetails(itemIdWithCred);
-    credentialsPage.goToCredentialsTab();
-
-    cy.wait(2000);
-    cy.get("table")
-      .contains(itemCredential)
-      .parentsUntil("tbody")
-      .find(".pf-v5-c-table__action .pf-v5-c-menu-toggle")
-      .click();
-    cy.get("table").contains("Delete").click();
-    modalUtils.checkModalTitle("Delete credentials?").confirmModal();
-
-    masthead.checkNotificationMessage(
-      "The credentials has been deleted successfully.",
-    );
-  });
-
-  it("Delete user from search bar test", () => {
-    // Delete
-    sidebarPage.waitForPageLoad();
-
-    listingPage.searchItem(itemId).itemExist(itemId);
-    listingPage.deleteItemFromSearchBar(itemId);
-
-    modalUtils.checkModalTitle("Delete user " + itemId + "?").confirmModal();
-
-    masthead.checkNotificationMessage("The user has been deleted");
-    sidebarPage.waitForPageLoad();
-
-    listingPage.itemExist(itemId, false);
-  });
-
-  it("Delete user with groups test", () => {
-    // Delete
-    listingPage.deleteItem(itemIdWithGroups);
-
-    modalUtils
-      .checkModalTitle("Delete user " + itemIdWithGroups + "?")
-      .confirmModal();
-
-    masthead.checkNotificationMessage("The user has been deleted");
-    sidebarPage.waitForPageLoad();
-
-    listingPage.itemExist(itemIdWithGroups, false);
-  });
-
-  it("Delete user with credential test", () => {
-    // Delete
-    listingPage.deleteItem(itemIdWithCred);
-
-    modalUtils
-      .checkModalTitle("Delete user " + itemIdWithCred + "?")
-      .confirmModal();
-
-    masthead.checkNotificationMessage("The user has been deleted");
-    sidebarPage.waitForPageLoad();
-
-    listingPage.itemExist(itemIdWithCred, false);
-  });
-
-  describe("Accessibility tests for users", () => {
-    const a11yUser = "a11y-user";
-    const role = "admin";
-    const roleType = "roles";
-    const roleMappingTab = new RoleMappingTab("");
-
-    beforeEach(() => {
-      loginPage.logIn();
-      keycloakBefore();
-      sidebarPage.goToUsers();
-      cy.injectAxe();
-    });
-
-    it("Check a11y violations on load/ users list", () => {
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on empty create user form", () => {
-      createUserPage.goToCreateUser();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user details tab", () => {
-      createUserPage.goToCreateUser();
-      createUserPage.createUser(a11yUser);
-      userDetailsPage.fillUserData();
-      createUserPage.create();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user credentials tab setting a password", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      credentialsPage.goToCredentialsTab();
-      credentialsPage
-        .clickEmptyStatePasswordBtn()
-        .fillPasswordForm()
-        .clickConfirmationBtn()
-        .clickSetPasswordBtn();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user credentials tab resetting a password", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      credentialsPage.goToCredentialsTab();
-      credentialsPage.clickResetBtn();
-      cy.checkA11y();
-      modalUtils.cancelModal();
-    });
-
-    it("Check a11y violations on user role mapping tab", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      roleMappingTab.goToRoleMappingTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user role mapping tab assigning a role dialog", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      roleMappingTab.goToRoleMappingTab();
-      cy.findByTestId("assignRole").click();
-      cy.checkA11y();
-      roleMappingTab.changeRoleTypeFilter(roleType).selectRow(role).assign();
-    });
-
-    it("Check a11y violations on user groups tab", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userGroupsPage.goToGroupsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user groups tab joining group dialog", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userGroupsPage.goToGroupsTab();
-      cy.findByTestId("no-groups-empty-action").click();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user groups tab joining group", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userGroupsPage.goToGroupsTab();
-      cy.findByTestId("no-groups-empty-action").click();
-      const groupsListCopy = groupsList.slice(0, 1);
-      groupsListCopy.forEach((element) => {
-        cy.findByTestId(`${element}-check`).click();
-      });
-
-      createUserPage.joinGroups();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user consents tab", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userDetailsPage.goToConsentsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user identity provider links tab", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userDetailsPage.goToIdentityProviderLinksTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user sessions tab", () => {
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      userDetailsPage.goToSessionsTab();
-      cy.checkA11y();
-    });
-
-    it("Check a11y violations on user deleting dialog", () => {
-      const commonPage = new CommonPage();
-      usersPage.goToUserListTab().goToUserDetailsPage(a11yUser);
-      commonPage
-        .actionToolbarUtils()
-        .clickActionToggleButton()
-        .clickDropdownItem("Delete");
-      cy.checkA11y();
-      cy.findByTestId("confirm").click();
-    });
-  });
-});
diff --git a/js/apps/admin-ui/cypress/fixtures/ldap/server.json b/js/apps/admin-ui/cypress/fixtures/ldap/server.json
deleted file mode 100644
index 8198a5dffadb..000000000000
--- a/js/apps/admin-ui/cypress/fixtures/ldap/server.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "port": 3004,
-  "searchBase": "dc=test"
-}
\ No newline at end of file
diff --git a/js/apps/admin-ui/cypress/fixtures/ldap/users.json b/js/apps/admin-ui/cypress/fixtures/ldap/users.json
deleted file mode 100644
index a5088e4944a6..000000000000
--- a/js/apps/admin-ui/cypress/fixtures/ldap/users.json
+++ /dev/null
@@ -1,7 +0,0 @@
-[
-  {
-    "dn": "cn=user,dc=test",
-    "objectClass": "person",
-    "cn": "user-login"
-  }
-]
\ No newline at end of file
diff --git a/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/kcexport.json b/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/kcexport.json
deleted file mode 100644
index c66bb12f049f..000000000000
--- a/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/kcexport.json
+++ /dev/null
@@ -1,5254 +0,0 @@
-[ {
-  "id" : "master",
-  "realm" : "master",
-  "notBefore" : 0,
-  "revokeRefreshToken" : false,
-  "accessTokenLifespan" : 60,
-  "ssoSessionIdleTimeout" : 1800,
-  "ssoSessionMaxLifespan" : 36000,
-  "offlineSessionIdleTimeout" : 2592000,
-  "accessCodeLifespan" : 60,
-  "accessCodeLifespanUserAction" : 300,
-  "accessCodeLifespanLogin" : 1800,
-  "enabled" : true,
-  "sslRequired" : "external",
-  "registrationAllowed" : false,
-  "registrationEmailAsUsername" : false,
-  "rememberMe" : false,
-  "verifyEmail" : false,
-  "resetPasswordAllowed" : false,
-  "editUsernameAllowed" : false,
-  "bruteForceProtected" : false,
-  "maxFailureWaitSeconds" : 900,
-  "minimumQuickLoginWaitSeconds" : 60,
-  "waitIncrementSeconds" : 60,
-  "quickLoginCheckMilliSeconds" : 1000,
-  "maxDeltaTimeSeconds" : 43200,
-  "failureFactor" : 30,
-  "privateKey" : "MIIEpAIBAAKCAQEAv5g6gYoRAknG5Ekq2k2WYACyM25mTsaSC3UOUve4Dc8zmfbyUwGShkVsaUmgTy/UiuEHzrJ0U8pWg+xjdXIosyuKR8eEhORtA3kxuMzsSb3F1FFdb8l8vgtVU9waG2Xc0mHUE0P9tRCXUgXp8kCv0zULfmqGvtNkl4oNnbOB6v7w9tYCCxGof5nZXBclSHqOj8H7dy4JxEV0PDNLh70Pc3ey4ZLrXBkeOxetZXwWsnshLghr3XkMNQwSsuMgjeL06E+uoNN9gTdez63Q4UrfRBMKbEepmRq0vmRk1fYVrI6roeqQfi6joZlDgQFE/8bKy1hCe3ZgzU+rF+PyXPU+KwIDAQABAoIBAD7ZNsfrfGzduqqD/dSiguN3Fv2cB19r79hmS46Xx/5vq6OjyBXGfEQjXc6j4jxXmkb8Tk1VaKdbxkl8L5wFGKi9bZziK+xT6harmM3gGtqNr+lXz2iuFYdZvGHH36CBJ5Czmpe/Q+gzSxAS9I0M/yAvVFfhpdXPDj5PgOvsSH/HE+/n7oH/rElWtFuTmby30BLfhTD5QGEtnrLG/Zzblro4XF9wyCgm/ovfl3aBweLYnYKsZOFQu+h8uDylTL/bCyFU5W9zskmFAbTaRZfj3xOYd95LrE+lvu0pvi2L9JowvnDn1lfwPLo5BK6CdaHJLhtsHeWWEV4qmsDApp4lu5ECgYEA5NzEnvREGp3+TLZG62X+1r/t89YnCCK2RtwaoQ/59LGiqGmay6EuKL99BwWLqwYyCuwF5IWYL23tf3HWWh+q+jAK7ZojolXsAMgVCrKQ0aoibaYw8DDJ2m4D5oXeyIlUeyMQwjTE3MxMmevk3x4PRm45qGmkEwSdsmZJiNFdaj0CgYEA1lAuCHIQeWlAsb/847ziBdloPK+AmHpDOpzInXdLmZSdu5FqO2S2oGCYTM0M4FFBDoCTeq0xRmlrTWKQlLx7Jy4cVC6c+RdwrDIuKuxJOXQHrD7FUDg03Kk0CVYXUsfB1ryOIIC7Mj0X5hrfbUkd86Au5nOccbIqWetE63P2mIcCgYEAoVT7ii4ZQEY1+O/ZqKF69vnPjT9evn5xzhvk7bsschEy39OqGnfh6TmrsmJ3ZbV1W3usX77JXE36yQd/moKObdWmLn6lNg+p0Zc6NhNQwWxU3sTz5K4P7Vn2h+/A787XbgJ3EuBOEnQ2X58J9Trke7rCDHWEAyAS5qrylW85keUCgYEAzVcLlCn+IOY5B1ZlbqtGgMY6+pJJi07x5VHdYgqwU9mye8orV/b6iJWkt0lsge04gTWumMcixE0zc3TyBKDG+tZSbFIxMvVDjqmR1KyKyFKlG2MVWPRRqe8xHZTwSe99iUsmfnv5YHxqzp2G38ZDvW8IIOQ6zDEiJP+oDFUSvDcCgYBlo+X4gou44GjeIWSKX0agVa6gi588tp4FALFQ55SomtJKbX1OozeEN+e9zVsL/25c4NDrp61WoaJGixPKhSMGJ0u+snsWaM+2wtGjVoxCUpMLcSXTHzT4YkUK21sU6+Yzdg8PnNVA1JaI4XKtxuKtaMA+VlXlqfQ3ImGZdn6YDw==",
-  "publicKey" : "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv5g6gYoRAknG5Ekq2k2WYACyM25mTsaSC3UOUve4Dc8zmfbyUwGShkVsaUmgTy/UiuEHzrJ0U8pWg+xjdXIosyuKR8eEhORtA3kxuMzsSb3F1FFdb8l8vgtVU9waG2Xc0mHUE0P9tRCXUgXp8kCv0zULfmqGvtNkl4oNnbOB6v7w9tYCCxGof5nZXBclSHqOj8H7dy4JxEV0PDNLh70Pc3ey4ZLrXBkeOxetZXwWsnshLghr3XkMNQwSsuMgjeL06E+uoNN9gTdez63Q4UrfRBMKbEepmRq0vmRk1fYVrI6roeqQfi6joZlDgQFE/8bKy1hCe3ZgzU+rF+PyXPU+KwIDAQAB",
-  "certificate" : "MIICmzCCAYMCBgFQ9+hyuzANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMTUxMTExMTg1NTE3WhcNMjUxMTExMTg1NjU3WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/mDqBihECScbkSSraTZZgALIzbmZOxpILdQ5S97gNzzOZ9vJTAZKGRWxpSaBPL9SK4QfOsnRTylaD7GN1ciizK4pHx4SE5G0DeTG4zOxJvcXUUV1vyXy+C1VT3BobZdzSYdQTQ/21EJdSBenyQK/TNQt+aoa+02SXig2ds4Hq/vD21gILEah/mdlcFyVIeo6Pwft3LgnERXQ8M0uHvQ9zd7LhkutcGR47F61lfBayeyEuCGvdeQw1DBKy4yCN4vToT66g032BN17PrdDhSt9EEwpsR6mZGrS+ZGTV9hWsjquh6pB+LqOhmUOBAUT/xsrLWEJ7dmDNT6sX4/Jc9T4rAgMBAAEwDQYJKoZIhvcNAQELBQADggEBABi3/VA3jKTNNdIfe/Il56Xfdgp/upBjw0er5nb2Jq/JuR4zZWAB3B+1wCO2ofBJZM9psXLd9HL3zvXct3eytisGp9gfRvZ+aL6kanhLdj3pF06NA2lIFkx292alYEDKF56GnCZlnCtF88j1kreXaOdkeUSjWlatVvEikRJUNTijiHLcX9XSBQ8qiDcdLu+DBrEWLmSnDNwWPKnWAz/w4ypVE4RxH3v0KYCDesv887fdWuLZmEyvFcc8sEwH4K7wj1vWUjSqSz+9uv7sqV/adPBMPkUeGeqsHkGu6Wn5JhaYHvrXsza5ZQ9H/X3BNmnp5JZCk17jWwjfiTRx0VtX7rM=",
-  "codeSecret" : "bc4719b1-5c6f-4b55-abe7-11a32dae080c",
-  "roles" : {
-    "realm" : [ {
-      "id" : "9d2638c8-4c62-4c42-90ea-5f3c836d0cc8",
-      "name" : "user",
-      "scopeParamRequired" : false,
-      "composite" : false
-    }, {
-      "id" : "e927db37-b0cc-4f84-be22-faa799666d26",
-      "name" : "offline_access",
-      "description" : "${role_offline-access}",
-      "scopeParamRequired" : true,
-      "composite" : false
-    }, {
-      "id" : "f02fcbcc-5c75-4cab-afc8-157c372a0d76",
-      "name" : "admin",
-      "description" : "${role_admin}",
-      "scopeParamRequired" : false,
-      "composite" : true,
-      "composites" : {
-        "realm" : [ "create-realm" ],
-        "client" : {
-          "mynewrealm-realm" : [ "create-client", "view-events", "manage-events", "view-realm", "view-identity-providers", "view-clients", "manage-realm", "manage-clients", "impersonation", "view-users", "manage-identity-providers", "manage-users" ],
-          "demo-realm" : [ "view-clients", "view-users", "manage-realm", "manage-clients", "impersonation", "view-identity-providers", "manage-events", "manage-identity-providers", "view-realm", "manage-users", "create-client", "view-events" ],
-          "master-realm" : [ "view-clients", "impersonation", "manage-users", "manage-clients", "view-identity-providers", "manage-identity-providers", "view-realm", "manage-realm", "create-client", "view-users", "manage-events", "view-events" ]
-        }
-      }
-    }, {
-      "id" : "2a800219-13dd-4c97-bdee-997bd07969c2",
-      "name" : "noncomposite",
-      "description" : "Non-composite role",
-      "scopeParamRequired" : true,
-      "composite" : false
-    }, {
-      "id" : "08eb0d05-9f8e-4958-822c-1083a90ff52f",
-      "name" : "create-realm",
-      "description" : "${role_create-realm}",
-      "scopeParamRequired" : false,
-      "composite" : false
-    } ],
-    "client" : {
-      "database-service" : [ ],
-      "admin-client" : [ ],
-      "customer-portal-js" : [ ],
-      "security-admin-console" : [ ],
-      "product-sa-client-jwt-auth" : [ ],
-      "demo-realm" : [ {
-        "id" : "4802ec90-93d9-4d5b-b3e9-9185f69e4c49",
-        "name" : "manage-realm",
-        "description" : "${role_manage-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "85b2e5a2-f67a-43fa-a353-8fb899ac91b7",
-        "name" : "manage-identity-providers",
-        "description" : "${role_manage-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "29bf4122-efdd-473b-9282-c2936c649443",
-        "name" : "view-clients",
-        "description" : "${role_view-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "c2f2b7b5-1105-4a53-94fe-b72dc652a2c1",
-        "name" : "view-users",
-        "description" : "${role_view-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "37758fcd-0aed-4a96-81fb-22d4ab99a8a6",
-        "name" : "view-realm",
-        "description" : "${role_view-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "a54fb635-b965-4fe6-87de-c80908146021",
-        "name" : "impersonation",
-        "description" : "${role_impersonation}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "fd5e3cc1-78ba-4006-b716-c79adf103bcd",
-        "name" : "manage-clients",
-        "description" : "${role_manage-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "7186dd05-7ac6-4ad6-9e53-06f0833912d0",
-        "name" : "view-identity-providers",
-        "description" : "${role_view-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "059a454c-955a-4d05-93b3-93f3131889e3",
-        "name" : "manage-users",
-        "description" : "${role_manage-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "afc291f4-eb9a-4e16-9da9-37925f17192e",
-        "name" : "create-client",
-        "description" : "${role_create-client}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "b6a26d5c-0ee9-4852-b81f-24ccdf157efa",
-        "name" : "view-events",
-        "description" : "${role_view-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "2315217d-3266-462f-b02f-6b17778a5b75",
-        "name" : "manage-events",
-        "description" : "${role_manage-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "angular-product" : [ ],
-      "product-sa-client" : [ ],
-      "master-realm" : [ {
-        "id" : "9bee5e34-444f-49d2-a772-7865bead3515",
-        "name" : "view-realm",
-        "description" : "${role_view-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "20154625-4f8a-4787-b050-d8f1ba75950e",
-        "name" : "view-users",
-        "description" : "${role_view-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "18cbc727-544a-479d-9f09-c6f17c8c6b70",
-        "name" : "manage-events",
-        "description" : "${role_manage-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "70e573e9-d1e3-48e2-92f4-e1471303b81a",
-        "name" : "manage-users",
-        "description" : "${role_manage-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "5de4c4ff-bd14-4e02-9407-b719b082b04e",
-        "name" : "view-clients",
-        "description" : "${role_view-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "720bb2f3-a88d-428e-93c8-9b8233caa8e5",
-        "name" : "impersonation",
-        "description" : "${role_impersonation}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "acfc02b9-e18e-4931-ba2b-eb865b6373dc",
-        "name" : "manage-realm",
-        "description" : "${role_manage-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "97d19f5a-382b-4c8e-b67e-f5d396371f87",
-        "name" : "manage-clients",
-        "description" : "${role_manage-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "64649e1a-1d96-4610-a8f0-fbb0f091ca8f",
-        "name" : "view-events",
-        "description" : "${role_view-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "fc732649-6dda-435c-9fae-1fe2f9ad2176",
-        "name" : "view-identity-providers",
-        "description" : "${role_view-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "63ad6d6f-99fc-4048-ade9-06d837655c39",
-        "name" : "create-client",
-        "description" : "${role_create-client}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "5246c662-e043-4a4e-8db8-b9d62a8e7b5b",
-        "name" : "manage-identity-providers",
-        "description" : "${role_manage-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "broker" : [ {
-        "id" : "b80f960c-c4db-4d3d-a76d-bf6de7462909",
-        "name" : "read-token",
-        "description" : "${role_read-token}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "customer-portal-cli" : [ ],
-      "customer-portal" : [ ],
-      "mynewrealm-realm" : [ {
-        "id" : "d6147a85-57ea-4664-ae4c-eca82aa4033b",
-        "name" : "impersonation",
-        "description" : "${role_impersonation}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "b20e77e6-1163-4833-a637-7794244d4f15",
-        "name" : "view-clients",
-        "description" : "${role_view-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "cd1dd572-6bd5-4409-81a8-f4dce75e7600",
-        "name" : "view-events",
-        "description" : "${role_view-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "4d5cd5db-51ae-4d18-86a3-1987222607ee",
-        "name" : "view-users",
-        "description" : "${role_view-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "bf693edd-8a74-45a0-9775-b65357e5398f",
-        "name" : "manage-identity-providers",
-        "description" : "${role_manage-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "eba019b2-14c5-4951-9fd0-4801dbd74cba",
-        "name" : "manage-events",
-        "description" : "${role_manage-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "98d2be44-ebd2-4d93-b348-2aa197ce3538",
-        "name" : "create-client",
-        "description" : "${role_create-client}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "9ce9c2f4-872d-476e-9bf3-975eb0220593",
-        "name" : "manage-realm",
-        "description" : "${role_manage-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "474ce253-d224-443f-b5b2-ad80a226b91a",
-        "name" : "view-realm",
-        "description" : "${role_view-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "7fa87f28-ad3e-4372-b262-f023726d6a5a",
-        "name" : "view-identity-providers",
-        "description" : "${role_view-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "5e289465-611c-4ecc-9256-c88b4e4f61fa",
-        "name" : "manage-users",
-        "description" : "${role_manage-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "cfc28d0b-78b6-49d3-aa01-b0f2f6cea71e",
-        "name" : "manage-clients",
-        "description" : "${role_manage-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "product-portal" : [ ],
-      "account" : [ {
-        "id" : "8dfe4967-259f-453f-9193-a60f845e3396",
-        "name" : "manage-account",
-        "description" : "${role_manage-account}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "e494be2d-f5a7-43e1-924b-97fb75e07a1a",
-        "name" : "view-profile",
-        "description" : "${role_view-profile}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "third-party" : [ ],
-      "offline-access-portal" : [ ]
-    }
-  },
-  "defaultRoles" : [ "offline_access" ],
-  "requiredCredentials" : [ "password" ],
-  "otpPolicyType" : "totp",
-  "otpPolicyAlgorithm" : "HmacSHA1",
-  "otpPolicyInitialCounter" : 0,
-  "otpPolicyDigits" : 6,
-  "otpPolicyLookAheadWindow" : 1,
-  "otpPolicyPeriod" : 30,
-  "users" : [ {
-    "id" : "ccee8213-15b0-4d38-bcb3-209cd563c743",
-    "createdTimestamp" : 1447268217566,
-    "username" : "admin",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "CFazI0ssShxu8szLm2bwLP+N8Dk+5PEspbpwtSgtkFrS7Lvq1XBTusbgJZg8LycST/fhUy7v0TAqPqPFBBU0Sw==",
-      "salt" : "97EXNDYXHkKehzFzXG/Fkg==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access", "admin" ],
-    "clientRoles" : {
-      "account" : [ "manage-account", "view-profile" ]
-    }
-  }, {
-    "id" : "beb49335-bf91-4712-b93b-f338cad7468d",
-    "username" : "bburke@redhat.com",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Bill",
-    "lastName" : "Burke",
-    "email" : "bburke@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "30gHSyQ9IMLJc9vrwJA12OjbisrWPvmiveCzqovMucz4fcE6I10Djzqfec88w0FhEnpps4RVr4vh9mGpIYgiAg==",
-      "salt" : "L3hlszVvFI7lqRCe36aqbQ==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "user", "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  }, {
-    "id" : "79d481e3-6aab-412b-b6aa-00db7954dc89",
-    "username" : "mposolda@redhat.com",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Marek",
-    "lastName" : "Posolda",
-    "email" : "mposolda@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "jzbNz54Ir/XrzcDNoHuySKRCrr7hFXs916jVzKlyIMvg5Cirzt1vP3F88nDkBe3QM2OEV/jvOAZeKFK6XPHcFg==",
-      "salt" : "V66xxpnBgW8mL96W5wkaOg==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "user", "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  }, {
-    "id" : "5af5b260-17f0-42e2-8f26-fa4e009354cf",
-    "username" : "stian",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Stian",
-    "lastName" : "Thorgersen",
-    "email" : "stian@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "v4oc+B7t/743QGFLH+Y3dnSRfjBDJEN7xS/komuwSDC5YKxHPw+V8SoM5OTIQjXAf2fbXr50evNvrPIW9RPg+g==",
-      "salt" : "y9//kWaEfX0dvLwQ6uOBdg==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "user", "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  } ],
-  "scopeMappings" : [ {
-    "client" : "security-admin-console",
-    "roles" : [ "admin" ]
-  } ],
-  "clients" : [ {
-    "id" : "8e05994e-72a2-4c9a-b6c7-56f644a43a4f",
-    "clientId" : "database-service",
-    "adminUrl" : "/database",
-    "baseUrl" : "/database",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "8b62ff99-85b3-4e4e-ad35-5223ca0c0a85",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "a2431032-7607-4a9e-a0c8-94627434eb4d",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ab49a828-f2a3-4d24-8e9b-a54cc762b368",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "cdb61022-c6ca-4bba-baef-5026ecf0a57f",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6a5f83b9-65b8-44cb-bdc8-72b650aa0b0f",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "38df05fb-c4e2-45d0-bab5-b36b6dafb18c",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "38f98204-fced-4a04-bcef-3a41e35ee7f4",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "3f15550f-f7cd-4bf9-a40a-801472b0d9b7",
-    "clientId" : "admin-client",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "29e8215e-786b-4e59-913f-5acfe2cecf9f",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : true,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "6c0d2ecd-72d5-41ef-b376-0e6312f27a05",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "3dc86deb-5316-45fc-9d2f-1cbe15e87492",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e3e0b3ab-fd1f-466c-b409-f880a005b2f7",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "4fd81299-d1fd-4234-a245-60d9c68b1532",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "1a311b3e-8556-4d47-b537-35352ed62506",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8aa953e8-9f79-4f24-b293-1a0fe6a04442",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "bc403281-e651-479e-8130-84ccd37ad4a6",
-    "clientId" : "customer-portal-js",
-    "baseUrl" : "/customer-portal-js",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "77638937-f511-4b72-ae21-4382dfcfd1c2",
-    "redirectUris" : [ "/customer-portal-js/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "d89257ef-2883-4c0b-ab91-7b8b34a186ba",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ceb1fd0c-cf62-435e-bc51-05d4dfa2bc83",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e0d0b086-b9c8-42a0-baf3-58135bc07374",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "3d38e1e2-1218-4fb6-8811-20d420195b48",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "1550b89e-103e-429e-8c94-4fa37ca190a7",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "bda0c751-4647-4311-b941-f7bdc2853e95",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "5cbaa3f5-6b80-42b1-820e-3230e087060b",
-    "clientId" : "security-admin-console",
-    "name" : "${client_security-admin-console}",
-    "baseUrl" : "/auth/admin/master/console/index.html",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "a030f7d0-1d5d-4d4b-b3b0-8a62c95b8de1",
-    "redirectUris" : [ "/auth/admin/master/console/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "fd943e23-e057-4e3f-a42a-d8eabcec48ce",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8c6bace2-dae6-4420-a3e8-e279c91befcc",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "2d95bda0-9d7a-4595-bb31-a15b0599f362",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "bf6ef571-6383-42ac-bbb2-5df1eac7c560",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0b051624-dc37-4452-88a6-937ea748f797",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "14f935dc-0c92-496d-a911-d8f0036e69a3",
-      "name" : "locale",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-attribute-mapper",
-      "consentRequired" : false,
-      "consentText" : "${locale}",
-      "config" : {
-        "user.attribute" : "locale",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "locale",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "2a1b96b1-ee51-467a-8c41-c36386aabbec",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "8ad378b0-4641-4407-a6f6-b6d68f420335",
-    "clientId" : "product-sa-client-jwt-auth",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-jwt",
-    "secret" : "b8fd08bd-fa1e-44fd-a90d-403c81949ef2",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : true,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : {
-      "jwt.credential.certificate" : "MIICnTCCAYUCBgFPPLDaTzANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdjbGllbnQxMB4XDTE1MDgxNzE3MjI0N1oXDTI1MDgxNzE3MjQyN1owEjEQMA4GA1UEAwwHY2xpZW50MTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIUjjgv+V3s96O+Za9002Lp/trtGuHBeaeVL9dFKMKzO2MPqdRmHB4PqNlDdd28Rwf5Xn6iWdFpyUKOnI/yXDLhdcuFpR0sMNK/C9Lt+hSpPFLuzDqgtPgDotlMxiHIWDOZ7g9/gPYNXbNvjv8nSiyqoguoCQiiafW90bPHsiVLdP7ZIUwCcfi1qQm7FhxRJ1NiW5dvUkuCnnWEf0XR+Wzc5eC9EgB0taLFiPsSEIlWMm5xlahYyXkPdNOqZjiRnrTWm5Y4uk8ZcsD/KbPTf/7t7cQXipVaswgjdYi1kK2/zRwOhg1QwWFX/qmvdd+fLxV0R6VqRDhn7Qep2cxwMxLsCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAKE6OA46sf20bz8LZPoiNsqRwBUDkaMGXfnob7s/hJZIIwDEx0IAQ3uKsG7q9wb+aA6s+v7S340zb2k3IxuhFaHaZpAd4CyR5cn1FHylbzoZ7rI/3ASqHDqpljdJaFqPH+m7nZWtyDvtZf+gkZ8OjsndwsSBK1d/jMZPp29qYbl1+XfO7RCp/jDqro/R3saYFaIFiEZPeKn1hUJn6BO48vxH1xspSu9FmlvDOEAOz4AuM58z4zRMP49GcFdCWr1wkonJUHaSptJaQwmBwLFUkCbE5I1ixGMb7mjEud6Y5jhfzJiZMo2U8RfcjNbrN0diZl3jB6LQIwESnhYSghaTjNQ=="
-    },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "aa8d820a-aee2-416f-a224-760622c5a40b",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0a7b32fe-b70e-4c04-8818-b3aa98b5ed09",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "b897d187-147b-4d89-93b5-7990757df443",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6e08a310-1ba7-407c-9d40-bd9c76575c8b",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5b862d4f-bb7a-46dd-a504-91a3481d963f",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "c446d029-6865-464a-8cfa-77f4965f8507",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "bafaa6ac-6744-43db-96f7-dc1017d501d2",
-    "clientId" : "demo-realm",
-    "name" : "demo Realm",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "aad11539-ab30-4055-86b4-6e013c47a798",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "fdf2c87a-0f41-4309-bcbc-5b56f5afedcb",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "dcce2cdc-91e7-4f68-8d28-edd254cc519e",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "60900478-3bc6-449a-af97-7f1f06be3fde",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5f6e2e63-dd59-44bb-aaa3-908125b1e364",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8c82272b-6995-4dca-a63d-2cad8c8aa40d",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8492bd07-2e76-41d7-b0b8-eca7e66f7e5e",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "a1b3689c-53d2-4964-bc51-395afbd6be74",
-    "clientId" : "angular-product",
-    "baseUrl" : "/angular-product/index.html",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "d169d88a-ee90-4c3f-bd71-cb39a4163bed",
-    "redirectUris" : [ "/angular-product/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "5ae72e66-1840-411e-9b5f-a9567377944b",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ab973b0f-084c-424b-a1f6-bb4a434a3196",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "13085615-0774-4048-a618-6646a17ff0ea",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d83166f3-6247-4fb8-81e1-8dce9563ed18",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "67f079b8-8f75-4e95-9fca-1e5d6259147a",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "96b9c867-7b8a-4675-be15-a441a695692f",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "0d1c1818-cf28-4e5d-96b6-457a594122b9",
-    "clientId" : "product-sa-client",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : true,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "3d797492-d90b-4b3e-a325-f23605cb577b",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "09331df8-260e-4581-b922-3a8c8c3ded0e",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e90089b9-a831-45cd-bd7e-c923ca7e2cec",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "7a0bc75a-4890-4a04-9b1f-07032d75b223",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "001ec6cc-7a59-4a04-8e77-5d61092009e1",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "14eaf865-36e9-492f-98aa-ca76f52b6e25",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "737c1d02-5b04-4caa-96ac-12f82b55e3a1",
-    "clientId" : "master-realm",
-    "name" : "master Realm",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "c9e38b12-57cf-47bd-8116-3b69ef3a2110",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "0285f882-61a2-4b98-8f51-2b0f4d230edc",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "b3216963-f3b5-4b1b-b5a1-c291ab15d835",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "4632dca4-a334-4353-826a-3ac8eb517fe5",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "14ade32e-ca83-4c4f-9fd1-8ced257eecf6",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "bf76011c-5d36-4c84-b981-7fcfa3eee76e",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "ea3d84dc-ed8c-4b77-a974-5bdf4c7591fc",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "de89d8d5-e526-457f-a83f-a05a32d2b3c4",
-    "clientId" : "broker",
-    "name" : "${client_broker}",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "64bb4575-8bc4-41f8-95fe-37ccdc7e58b8",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "2315624c-5a12-48c0-92c2-987eaec0a7f1",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6b7b79a6-e852-4008-85b9-6514422a5f73",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "3de1364e-b896-444e-8e67-8c143f9f5af9",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "1ff705e3-1dea-49c6-8671-48bb23599762",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "4f896934-ecc5-491a-876e-1ec8f123dd4b",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "c7f079d7-093d-4ff0-91ec-2eb433a24bc7",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "d38fc352-f9bd-4ee8-a4b1-b1d49121d8de",
-    "clientId" : "customer-portal-cli",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "6f7a911c-46cc-47a4-a475-67584f387556",
-    "redirectUris" : [ "urn:ietf:wg:oauth:2.0:oob", "http://localhost" ],
-    "webOrigins" : [ "http://localhost" ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "77032cf9-8c5e-4c9a-8aa2-c1612586f70d",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "b4f97a2f-bef6-4b28-bd07-376ea4b196ec",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "675fff85-b373-45d4-8465-d76cbf860562",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "bcb3716f-29d2-4904-97a5-6f460026da47",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "2ee67514-cfc1-4002-8e2d-894d208c93a9",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "a36d453e-fee5-4407-b7a8-515509f86e7d",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "a8ad2322-3bfd-4d3d-b555-5d2927b3b43c",
-    "clientId" : "customer-portal",
-    "adminUrl" : "/customer-portal",
-    "baseUrl" : "/customer-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/customer-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "6edd6df4-f175-43d7-a961-981a8517a8b5",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a2a5df10-3b62-44ea-b7de-71974f4c54d6",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "092682ff-d347-4386-b97b-e91cd469db94",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a23b0c07-6b27-4118-8efa-9ab29fbdc75a",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0834e677-ee6b-40b4-aace-9720e0933b1e",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "1c25b331-f020-4786-8786-549ff57ce3b3",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "d2a382cb-fd72-4643-a3b6-f9dbc0da80f4",
-    "clientId" : "mynewrealm-realm",
-    "name" : "mynewrealm Realm",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "50cbe999-4c6f-4424-96cb-fd03919cce1e",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "fd60f8ee-faf7-4d42-b3ee-a1e9b571b195",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "68264dfd-75db-4dd8-8aae-0e470bf851f7",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "960d419d-f616-40f1-ae78-ee10bab1ca00",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "bc703891-d4d9-44de-b909-e168320a1650",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ab9b12a2-fba8-4bd3-93c4-853081b61d7b",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ba4a9642-0a04-49ff-9e82-370c50be52b1",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "c8507822-3793-4f7c-a328-dfe45c125e02",
-    "clientId" : "product-portal",
-    "adminUrl" : "/product-portal",
-    "baseUrl" : "/product-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/product-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "62613797-4231-4c0a-b3ca-c4128cb96922",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "f47d226f-ff60-408d-8eca-2241594b08a0",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e165f967-4267-485d-ae9c-065e35a36246",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "c1711314-d68d-4f0f-bb79-0ba3f88b9a70",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "b204b8d1-f944-4fa7-a436-ff1d7923145e",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "4c996673-4fdd-4d48-91d4-05d584fd7f12",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "bdbdfb4a-64aa-49a7-89bb-d67ec85f272a",
-    "clientId" : "account",
-    "name" : "${client_account}",
-    "baseUrl" : "/auth/realms/master/account",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "5879d256-6b50-4233-85cf-379c699c26a0",
-    "defaultRoles" : [ "view-profile", "manage-account" ],
-    "redirectUris" : [ "/auth/realms/master/account/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "14d427a2-ceff-4b50-a94a-a4474fc4fdb2",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "83a17f83-d98f-4e2e-91b4-b73e4e53186d",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5fba4099-df00-4982-9585-5af1759602ef",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "fc7586dd-8ed3-4656-9be7-c247bba69b85",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "6e9d15d7-1da8-43d4-84e5-725c479edad7",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a890ac50-4553-4238-8356-c22e37d1fa4e",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "826c609d-d32e-4305-832c-2c847222c7c3",
-    "clientId" : "third-party",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/oauth-client/*", "/oauth-client-cdi/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : true,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "a0c8b770-23ef-4d79-b8e9-6b76ff2a6e01",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "eaff4d98-33c5-450f-bbe7-450bfd2ab117",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "594e7a02-4241-434a-9b69-9f2d93d87656",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a83ac8f8-7e01-44df-a5fb-24b939ec31ac",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "fc84619d-935f-4c75-8c31-44ee12448d1e",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "15512f5b-a0c9-4d72-b398-8a5aebec741b",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "d32d12db-d80c-457f-b1b4-bc2a3cd95826",
-    "clientId" : "offline-access-portal",
-    "adminUrl" : "/offline-access-portal",
-    "baseUrl" : "/offline-access-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/offline-access-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : true,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "7787685f-67c8-43b1-b332-48ec497e1d44",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "2f4b623a-d263-4b4a-ae0c-10648791981c",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6b5193e7-06c5-4293-89c0-13c90c3fb7ed",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "41c96cee-e661-4a06-922d-123016085265",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "1d8d553e-dc33-4065-9598-b5decaf0d11c",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8e689c7c-693f-4001-a267-985e9c42aa6b",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  } ],
-  "browserSecurityHeaders" : {
-    "contentSecurityPolicy" : "frame-src 'self'",
-    "xFrameOptions" : "SAMEORIGIN"
-  },
-  "smtpServer" : { },
-  "eventsEnabled" : false,
-  "eventsListeners" : [ "jboss-logging" ],
-  "enabledEventTypes" : [ "SEND_RESET_PASSWORD", "SEND_VERIFY_EMAIL", "EXECUTE_ACTIONS_ERROR", "REMOVE_FEDERATED_IDENTITY", "REMOVE_CREDENTIAL", "UPDATE_TOTP", "REMOVE_TOTP", "REVOKE_GRANT", "LOGIN_ERROR", "CLIENT_LOGIN", "RESET_PASSWORD_ERROR", "CODE_TO_TOKEN_ERROR", "CUSTOM_REQUIRED_ACTION", "UPDATE_EMAIL", "REGISTER_ERROR", "LOGOUT_ERROR", "UPDATE_EMAIL_ERROR", "UPDATE_PROFILE_ERROR", "IMPERSONATE", "LOGIN", "UPDATE_PASSWORD_ERROR", "UPDATE_CREDENTIAL_ERROR", "CLIENT_UPDATE_ERROR", "UPDATE_PROFILE", "REGISTER", "LOGOUT", "FEDERATED_IDENTITY_LINK", "CLIENT_REGISTER_ERROR", "CLIENT_REGISTER", "SEND_VERIFY_EMAIL_ERROR", "UPDATE_CREDENTIAL", "UPDATE_PASSWORD" ,"RESET_PASSWORD", "FEDERATED_IDENTITY_LINK_ERROR", "CLIENT_DELETE", "REMOVE_CREDENTIAL_ERROR", "REMOVE_TOTP_ERROR", "VERIFY_EMAIL_ERROR", "VERIFY_EMAIL", "SEND_RESET_PASSWORD_ERROR", "CLIENT_DELETE_ERROR", "CLIENT_LOGIN_ERROR", "CLIENT_UPDATE", "REMOVE_FEDERATED_IDENTITY_ERROR", "EXECUTE_ACTIONS", "CUSTOM_REQUIRED_ACTION_ERROR", "UPDATE_TOTP_ERROR", "CODE_TO_TOKEN" ],
-  "adminEventsEnabled" : true,
-  "adminEventsDetailsEnabled" : true,
-  "identityProviders" : [ {
-    "alias" : "keycloak-oidc",
-    "internalId" : "721b5dae-5b98-4284-bcd1-f872ce2ac174",
-    "providerId" : "keycloak-oidc",
-    "enabled" : true,
-    "updateProfileFirstLoginMode" : "on",
-    "trustEmail" : false,
-    "storeToken" : false,
-    "addReadTokenRoleOnCreate" : false,
-    "authenticateByDefault" : false,
-    "config" : {
-      "clientSecret" : "foo",
-      "clientId" : "foo",
-      "tokenUrl" : "foo",
-      "authorizationUrl" : "foo"
-    }
-  }, {
-    "alias" : "oidc",
-    "internalId" : "7c8070e6-87d7-42b0-97df-b4cb87bc0c98",
-    "providerId" : "oidc",
-    "enabled" : true,
-    "updateProfileFirstLoginMode" : "on",
-    "trustEmail" : false,
-    "storeToken" : false,
-    "addReadTokenRoleOnCreate" : false,
-    "authenticateByDefault" : false,
-    "config" : {
-      "clientSecret" : "asdf",
-      "clientId" : "asdf",
-      "tokenUrl" : "asdf",
-      "authorizationUrl" : "asdf"
-    }
-  } ],
-  "identityProviderMappers" : [ {
-    "id" : "2bee0286-db3b-4051-ae59-3d56bf8d9f4d",
-    "name" : "asdf",
-    "identityProviderAlias" : "oidc",
-    "identityProviderMapper" : "oidc-user-attribute-idp-mapper",
-    "config" : {
-      "claim" : "fasdf",
-      "user.attribute" : "asdf"
-    }
-  } ],
-  "identityFederationEnabled" : true,
-  "internationalizationEnabled" : false,
-  "supportedLocales" : [ ],
-  "authenticationFlows" : [ {
-    "alias" : "direct grant",
-    "description" : "OpenID Connect Resource Owner Grant",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "direct-grant-validate-username",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "direct-grant-validate-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "direct-grant-validate-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  }, {
-    "alias" : "registration",
-    "description" : "registration flow",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-page-form",
-      "flowAlias" : "registration form",
-      "autheticatorFlow" : true,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    } ]
-  }, {
-    "alias" : "reset credentials",
-    "description" : "Reset credentials for a user if they forgot their password or something",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "reset-credentials-choose-user",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "reset-credential-email",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "reset-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    }, {
-      "authenticator" : "reset-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    } ]
-  }, {
-    "alias" : "browser",
-    "description" : "browser based authentication",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-cookie",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-spnego",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "flowAlias" : "forms",
-      "autheticatorFlow" : true,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  }, {
-    "alias" : "forms",
-    "description" : "Username, password, otp and other auth forms.",
-    "providerId" : "basic-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-username-password-form",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-otp-form",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "clients",
-    "description" : "Base authentication for clients",
-    "providerId" : "client-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "client-secret",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "client-jwt",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "registration form",
-    "description" : "registration form",
-    "providerId" : "form-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-user-creation",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "registration-profile-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    }, {
-      "authenticator" : "registration-password-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 50
-    }, {
-      "authenticator" : "registration-recaptcha-action",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 60
-    } ]
-  } ],
-  "authenticatorConfig" : [ ],
-  "requiredActions" : [ {
-    "alias" : "VERIFY_EMAIL",
-    "name" : "Verify Email",
-    "providerId" : "VERIFY_EMAIL",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "CONFIGURE_TOTP",
-    "name" : "Configure Totp",
-    "providerId" : "CONFIGURE_TOTP",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "UPDATE_PROFILE",
-    "name" : "Update Profile",
-    "providerId" : "UPDATE_PROFILE",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "terms_and_conditions",
-    "name" : "Terms and Conditions",
-    "providerId" : "terms_and_conditions",
-    "enabled" : false,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "UPDATE_PASSWORD",
-    "name" : "Update Password",
-    "providerId" : "UPDATE_PASSWORD",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  } ],
-  "browserFlow" : "browser",
-  "registrationFlow" : "registration",
-  "directGrantFlow" : "direct grant",
-  "resetCredentialsFlow" : "reset credentials",
-  "clientAuthenticationFlow" : "clients"
-}, {
-  "id" : "demo",
-  "realm" : "demo",
-  "notBefore" : 0,
-  "revokeRefreshToken" : false,
-  "accessTokenLifespan" : 60,
-  "ssoSessionIdleTimeout" : 600,
-  "ssoSessionMaxLifespan" : 36000,
-  "offlineSessionIdleTimeout" : 2592000,
-  "accessCodeLifespan" : 60,
-  "accessCodeLifespanUserAction" : 300,
-  "accessCodeLifespanLogin" : 1800,
-  "enabled" : true,
-  "sslRequired" : "external",
-  "registrationAllowed" : false,
-  "registrationEmailAsUsername" : false,
-  "rememberMe" : false,
-  "verifyEmail" : false,
-  "resetPasswordAllowed" : false,
-  "editUsernameAllowed" : false,
-  "bruteForceProtected" : false,
-  "maxFailureWaitSeconds" : 900,
-  "minimumQuickLoginWaitSeconds" : 60,
-  "waitIncrementSeconds" : 60,
-  "quickLoginCheckMilliSeconds" : 1000,
-  "maxDeltaTimeSeconds" : 43200,
-  "failureFactor" : 30,
-  "privateKey" : "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=",
-  "publicKey" : "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
-  "certificate" : "MIIBkTCB+wIGAVD9HwYqMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNVBAMMBGRlbW8wHhcNMTUxMTEyMTkxMzAwWhcNMjUxMTEyMTkxNDQwWjAPMQ0wCwYDVQQDDARkZW1vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAIPmcZ++qAtAEzdrRMtkmyDAtf41R4MSC3+ljYErbFI9mPqnrY2BAzLpusivqxuORBwYetdhFuqAJAluB8K1a6aRadt2u2+z0eGEgkKVtfYs4tDth23lg8WvubmwyJrGfCY5GtHEAl3RuTCkFTSRqbJ9fzD68rhJQPojNxAhABze",
-  "codeSecret" : "b2e0a1a4-94ae-46d4-8d30-9b8ee47627ae",
-  "roles" : {
-    "realm" : [ {
-      "id" : "4c9c285e-ec83-4294-b629-57c22b3916d9",
-      "name" : "offline_access",
-      "description" : "${role_offline-access}",
-      "scopeParamRequired" : true,
-      "composite" : false
-    }, {
-      "id" : "6f916d2f-3dae-4153-b9c0-fc0987fc18e1",
-      "name" : "create-realm",
-      "description" : "${role_create-realm}",
-      "scopeParamRequired" : false,
-      "composite" : false
-    }, {
-      "id" : "d928d12d-5d3c-48a4-b1dc-510d23001963",
-      "name" : "admin",
-      "description" : "Administrator privileges",
-      "scopeParamRequired" : false,
-      "composite" : false
-    }, {
-      "id" : "0301e5bd-7902-4929-9da1-553de7738044",
-      "name" : "user",
-      "description" : "User privileges",
-      "scopeParamRequired" : false,
-      "composite" : false
-    } ],
-    "client" : {
-      "database-service" : [ ],
-      "admin-client" : [ ],
-      "realm-management" : [ {
-        "id" : "3b939f75-d013-4096-8462-48aa39261293",
-        "name" : "create-client",
-        "description" : "${role_create-client}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "08714717-6150-42f3-b360-e3706cea1b4d",
-        "name" : "view-events",
-        "description" : "${role_view-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "b20ee4e9-ba54-48c4-99fe-fc0281b9c230",
-        "name" : "view-realm",
-        "description" : "${role_view-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "264f5da2-4917-47b5-b89a-38b3cdedf851",
-        "name" : "manage-users",
-        "description" : "${role_manage-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "bde13dc7-d843-4fdb-95c2-1ca5826477ac",
-        "name" : "view-identity-providers",
-        "description" : "${role_view-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "6e3455b4-11cc-4d59-89a3-93482cc30b04",
-        "name" : "impersonation",
-        "description" : "${role_impersonation}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "d69ef626-f6a7-4b83-b207-ad3fe380d93e",
-        "name" : "view-clients",
-        "description" : "${role_view-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "04c6b2a0-c47d-445d-90e9-8b98545fdcee",
-        "name" : "view-users",
-        "description" : "${role_view-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "1213edcd-9442-47b3-a06a-3818acd928e5",
-        "name" : "manage-identity-providers",
-        "description" : "${role_manage-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "357a66b3-63e9-49e2-a571-7c1e6c6180dd",
-        "name" : "realm-admin",
-        "description" : "${role_realm-admin}",
-        "scopeParamRequired" : false,
-        "composite" : true,
-        "composites" : {
-          "client" : {
-            "realm-management" : [ "create-client", "view-events", "view-users", "manage-identity-providers", "view-realm", "manage-clients", "manage-users", "view-clients", "view-identity-providers", "impersonation", "manage-events", "manage-realm" ]
-          }
-        }
-      }, {
-        "id" : "b9b695e9-4261-46ec-aca1-da0fd9ed44aa",
-        "name" : "manage-clients",
-        "description" : "${role_manage-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "098a9946-e58a-4a5c-b04e-5d4acfe9f6f1",
-        "name" : "manage-events",
-        "description" : "${role_manage-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "000d9791-8f42-49d7-bbdc-01e6b5a8cc70",
-        "name" : "manage-realm",
-        "description" : "${role_manage-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "customer-portal-js" : [ ],
-      "security-admin-console" : [ ],
-      "product-sa-client-jwt-auth" : [ ],
-      "angular-product" : [ ],
-      "product-sa-client" : [ ],
-      "broker" : [ {
-        "id" : "89c1bae3-b2c9-4e2f-937f-7514923f5e5f",
-        "name" : "read-token",
-        "description" : "${role_read-token}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "customer-portal-cli" : [ ],
-      "customer-portal" : [ ],
-      "product-portal" : [ ],
-      "account" : [ {
-        "id" : "198c3c05-7bff-408f-8ada-95a5481861f9",
-        "name" : "manage-account",
-        "description" : "${role_manage-account}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "2cf786e5-e0bb-4492-bf7d-16688d12e5ff",
-        "name" : "view-profile",
-        "description" : "${role_view-profile}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "offline-access-portal" : [ ],
-      "third-party" : [ {
-        "id" : "59daf30e-3933-4386-b2cd-ced19f3f1ca2",
-        "name" : "myclientrole",
-        "description" : "My client role",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ]
-    }
-  },
-  "defaultRoles" : [ "offline_access" ],
-  "requiredCredentials" : [ "password" ],
-  "otpPolicyType" : "totp",
-  "otpPolicyAlgorithm" : "HmacSHA1",
-  "otpPolicyInitialCounter" : 0,
-  "otpPolicyDigits" : 6,
-  "otpPolicyLookAheadWindow" : 1,
-  "otpPolicyPeriod" : 30,
-  "users" : [ {
-    "id" : "a7aff2b8-f001-47df-9f9f-f3f02d18f6b1",
-    "createdTimestamp" : 1447786264017,
-    "username" : "aaaa",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "credentials" : [ ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account", "view-profile" ]
-    }
-  }, {
-    "id" : "be51490a-8473-4f83-8625-984959210741",
-    "createdTimestamp" : 1447786273233,
-    "username" : "bbbb",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "credentials" : [ ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account", "view-profile" ]
-    }
-  }, {
-    "id" : "9b202a37-2b16-4341-bcc2-c2549586911c",
-    "username" : "bburke@redhat.com",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Bill",
-    "lastName" : "Burke",
-    "email" : "bburke@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "FhdAutJurcyDSxVQma3VNMX2mcfnZ0MN2LToYCLWi3G+fnp793NrQ9xWzGICpsQ+nq1EA6M64o2bil+oh+ezmA==",
-      "salt" : "uBE9SOPCNIEhOdnc8ZXbFQ==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access", "user" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  }, {
-    "id" : "83454480-d38f-410f-8a36-1af1b6be5a19",
-    "createdTimestamp" : 1447786289606,
-    "username" : "cccc",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "credentials" : [ ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access" ],
-    "clientRoles" : {
-      "account" : [ "manage-account", "view-profile" ]
-    }
-  }, {
-    "id" : "999a7fe4-618a-4349-ae0c-96a9c47d34fd",
-    "username" : "mposolda@redhat.com",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Marek",
-    "lastName" : "Posolda",
-    "email" : "mposolda@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "GmPpUa3c+8lX2IvdxktX4NfvVXdPwJKsk6tcGVrUD0s+yAUxsASPBoLbmLOUT59H28qkb7/KnAHLAi2euqcYNg==",
-      "salt" : "eA9HDWvaYqhKVCnfU2wNAg==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access", "user" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  }, {
-    "id" : "fc30bf89-c312-4d4a-9774-55555c938310",
-    "username" : "stian",
-    "enabled" : true,
-    "totp" : false,
-    "emailVerified" : false,
-    "firstName" : "Stian",
-    "lastName" : "Thorgersen",
-    "email" : "stian@redhat.com",
-    "credentials" : [ {
-      "type" : "password",
-      "hashedSaltedValue" : "VAuUKmATwpbkxNCFl1KmMYe9COd1EcpOJbs+C1S/VMjJWjJDG1Ebq4alkNUvTSFcHwtccVvXOw1zbes0QnahdA==",
-      "salt" : "91IXeHc7uNf4j0z7UZwwiw==",
-      "hashIterations" : 1,
-      "counter" : 0,
-      "digits" : 0,
-      "temporary" : false
-    } ],
-    "requiredActions" : [ ],
-    "realmRoles" : [ "offline_access", "user" ],
-    "clientRoles" : {
-      "account" : [ "manage-account" ]
-    }
-  } ],
-  "scopeMappings" : [ {
-    "client" : "offline-access-portal",
-    "roles" : [ "offline_access", "user" ]
-  } ],
-  "clientScopeMappings" : {
-    "realm-management" : [ {
-      "client" : "security-admin-console",
-      "roles" : [ "realm-admin" ]
-    } ]
-  },
-  "clients" : [ {
-    "id" : "f2fdc211-9ab9-4b91-a7ba-077ba63abacb",
-    "clientId" : "database-service",
-    "adminUrl" : "/database",
-    "baseUrl" : "/database",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "c07577a5-421b-441f-99ab-5b3b854146a6",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "5c5d79d8-ee42-43a0-a5f8-869eb9e7240c",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "7270e5cd-383a-462c-864b-c9a62ec09669",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "f9dabb18-b105-4d40-ac16-a6922d692745",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6cbe4afe-5c1a-403f-9bfe-94788586d1ca",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "24500a3a-d6f8-4125-8d87-549322afa2ba",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "952feb28-70a9-4288-8e43-25eaffe06059",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "a9a0369c-3e8e-4c0a-9e9b-44f18d58bbc8",
-    "clientId" : "admin-client",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "5232b41c-8d89-4a37-b467-8c3bf6277f8f",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : true,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "5a210a28-3542-4cc1-afc0-3825911b85be",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "4ecac0b1-a61a-4a91-9540-b2f5b072f650",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e6ee1534-8301-414d-8264-e3ca38d47d9a",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "7dd459f7-c23c-4543-be26-6ba28bba7291",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "38feea4a-d4ea-46e2-8a9d-a312a22b9aac",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "4475e482-d67d-4ebb-a998-3f801bb54557",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "093f1be5-ab06-4a97-8c9b-ffcbe3e4e291",
-    "clientId" : "realm-management",
-    "name" : "${client_realm-management}",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "198e8543-d0f9-4095-a51c-af8ff13c2579",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "349da162-0405-46f1-bfa4-d67b6812af7a",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "7bc4b18e-e2dd-4eea-aad6-5ee807e07fb0",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d529517b-c9cc-4653-b87b-b69e6b1369a2",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "55d60e9b-ce56-44ff-bffe-eefc828a9e5e",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "880e5b27-6eaa-4d13-852e-ef0ff1e5ba85",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "5fd28107-0d3f-486a-9366-2ba8ebd3555d",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "a79cdc99-1ed3-406f-b02d-48b300c58613",
-    "clientId" : "customer-portal-js",
-    "baseUrl" : "/customer-portal-js",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "5bceb81d-118c-4871-b059-6e0323a6b1cb",
-    "redirectUris" : [ "/customer-portal-js/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "d86ab89c-b18a-4179-9765-5b2fe1e091bd",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d19687ce-8f3d-4e5e-a4a4-a4980b97ca6c",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "f3a8f4e0-ee07-4fec-a20c-dbf668b66070",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "01ad03a9-e6bc-4ede-82ed-d359f781c17b",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "bb169ec6-5de3-4824-a148-8f4395aa9a96",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "7e4b9ad5-b679-4942-a12a-0f3fe7829813",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "4e300b13-3a93-40b4-b663-901c3cf08e00",
-    "clientId" : "security-admin-console",
-    "name" : "${client_security-admin-console}",
-    "baseUrl" : "/auth/admin/demo/console/index.html",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "3598448d-6430-486c-b2e7-061690e05042",
-    "redirectUris" : [ "/auth/admin/demo/console/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "a7df97a6-c744-4ed3-b559-efaf52d3cb00",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "7363ee08-8353-4275-9c56-e37dfd1bf5e2",
-      "name" : "locale",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-attribute-mapper",
-      "consentRequired" : false,
-      "consentText" : "${locale}",
-      "config" : {
-        "user.attribute" : "locale",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "locale",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "acd0975e-4722-449e-a73e-73b11ad379a1",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a97100a1-e45a-4cae-b633-7ccd08178ff4",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "ea5684e4-ffa5-40c2-89af-cf17fd97d210",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "a8c7c8fb-1906-4de3-a243-04f6809672a7",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "f12d2cdd-99ee-4344-b9c4-51c92fe89019",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "e5c1c405-8946-4ba7-87b2-ebf95adecf95",
-    "clientId" : "product-sa-client-jwt-auth",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-jwt",
-    "secret" : "9ee8df09-53ad-4c6c-aac3-ef0c56cb712d",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : true,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : {
-      "jwt.credential.certificate" : "MIICnTCCAYUCBgFPPLDaTzANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdjbGllbnQxMB4XDTE1MDgxNzE3MjI0N1oXDTI1MDgxNzE3MjQyN1owEjEQMA4GA1UEAwwHY2xpZW50MTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIUjjgv+V3s96O+Za9002Lp/trtGuHBeaeVL9dFKMKzO2MPqdRmHB4PqNlDdd28Rwf5Xn6iWdFpyUKOnI/yXDLhdcuFpR0sMNK/C9Lt+hSpPFLuzDqgtPgDotlMxiHIWDOZ7g9/gPYNXbNvjv8nSiyqoguoCQiiafW90bPHsiVLdP7ZIUwCcfi1qQm7FhxRJ1NiW5dvUkuCnnWEf0XR+Wzc5eC9EgB0taLFiPsSEIlWMm5xlahYyXkPdNOqZjiRnrTWm5Y4uk8ZcsD/KbPTf/7t7cQXipVaswgjdYi1kK2/zRwOhg1QwWFX/qmvdd+fLxV0R6VqRDhn7Qep2cxwMxLsCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAKE6OA46sf20bz8LZPoiNsqRwBUDkaMGXfnob7s/hJZIIwDEx0IAQ3uKsG7q9wb+aA6s+v7S340zb2k3IxuhFaHaZpAd4CyR5cn1FHylbzoZ7rI/3ASqHDqpljdJaFqPH+m7nZWtyDvtZf+gkZ8OjsndwsSBK1d/jMZPp29qYbl1+XfO7RCp/jDqro/R3saYFaIFiEZPeKn1hUJn6BO48vxH1xspSu9FmlvDOEAOz4AuM58z4zRMP49GcFdCWr1wkonJUHaSptJaQwmBwLFUkCbE5I1ixGMb7mjEud6Y5jhfzJiZMo2U8RfcjNbrN0diZl3jB6LQIwESnhYSghaTjNQ=="
-    },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "44476a5a-5910-41f0-81d0-f4df1bbf2af0",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "893f9ec3-cc96-45c8-a45f-1a0acd5a4b9a",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "5387018a-17b8-4ab5-a321-8b55c4ba8647",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d1859c79-ab34-4cfa-94ca-bddeed297851",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "7b7a51d7-d7e0-4dcd-8484-e9859d5fa936",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "1afe8b40-940a-4b8c-b4e3-e4cb77564a04",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "236116d3-22be-4d91-9a96-baa47abf2b40",
-    "clientId" : "angular-product",
-    "baseUrl" : "/angular-product/index.html",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "8dcdd603-046b-4d9b-aa6c-a2216f08adbd",
-    "redirectUris" : [ "/angular-product/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "dcbfd946-b240-46a7-be7c-cc4805818cb1",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "99ee6cff-9232-4a75-95c4-6758e44eee2e",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e7977843-998c-4c41-9d60-2f2f3c7b4d31",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "c002b2f4-c104-4767-9032-3d676ea95e84",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "8da0d621-c553-4711-b8af-ff701aa00067",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "4ce074ae-0b30-489d-a6e0-250a0e9d09cc",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "dbbf4149-862d-4169-a245-ff1311a5fee4",
-    "clientId" : "product-sa-client",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : true,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "63c63de0-cace-4dcf-b9f3-748bcb30363c",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "90003b43-b9b5-4a99-9a55-cfa3a3f61bd1",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5768ee0f-9ca8-4e25-af4b-20d8168a3353",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "48e4fdb0-366b-4398-9283-6caf200faa1a",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "859d6733-75ce-4a4d-9327-eac92db09dde",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "6581a732-d6c8-4f71-b79a-8a7f65fe029d",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "0373aa1f-2d8e-4dfe-952a-c3630b816052",
-    "clientId" : "broker",
-    "name" : "${client_broker}",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "14a007f3-c33d-4031-a65e-7638ad1b2ddb",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "ceac6e36-c896-46a7-bb34-74c8221ff73e",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "dbc6f757-bef2-4ba2-a9d2-ca31eaea1bf4",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "4ce51699-6cd3-4a28-84f9-5436b790bf34",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "b69a15d2-1278-4383-821f-d30f283d2589",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d758376d-7992-4210-82ef-dda968dbf7c6",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8035b804-1d16-41e6-8d87-3819d8bea996",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "df7f0085-4ad8-4979-b33d-e399cc8eaf49",
-    "clientId" : "customer-portal-cli",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "4db5ba21-d810-42dc-9384-5a8268013d12",
-    "redirectUris" : [ "urn:ietf:wg:oauth:2.0:oob", "http://localhost" ],
-    "webOrigins" : [ "http://localhost" ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "196ca389-1240-4d86-980d-d6fe94224f11",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "cfe9b599-96e4-4063-84b1-de54659b6296",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "f475e915-24b5-4670-a25d-2bd6166a26a5",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0a5eeb46-28a8-4e32-8ffe-84059f824ee4",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "c74425c3-a762-46c6-beb9-1330fb39628c",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "17174fe0-b305-4b75-92f5-1ea0a3f5f7bf",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "faf80527-7ecc-450b-985f-e74f6acccf13",
-    "clientId" : "customer-portal",
-    "adminUrl" : "/customer-portal",
-    "baseUrl" : "/customer-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/customer-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "3be6ab05-39af-4512-9301-78dfd4663427",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5b7bc226-696c-4aa6-9c25-d8911900d555",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "dc5c8901-5fb5-4dff-90aa-6d373e49293c",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "908647d2-97d6-4897-980d-a0653d2c7581",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "76fcd11a-93f6-4f49-8840-3990ba7bd6b5",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "be669592-3cb1-4cc2-98e9-38181f52eb80",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "3a5f2f8b-48ad-470e-aee8-c71744367ef7",
-    "clientId" : "product-portal",
-    "adminUrl" : "/product-portal",
-    "baseUrl" : "/product-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/product-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : true,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "22815b6d-d796-4381-866f-712814759109",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5f837d0b-06d6-4208-a1aa-49d181f65cb8",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "4c26aac4-b1c2-440a-bec9-af87ea8d5f8a",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "2d1cfd33-7bdd-482d-9550-2cee022cd8cf",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8ac85b5f-b149-4db7-b72e-3494ea9a6a2b",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "dce387b1-0805-4f27-bbb0-d6a49294b9f5",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    } ]
-  }, {
-    "id" : "c581706b-5a96-4ad6-8e28-8221bc1ae866",
-    "clientId" : "account",
-    "name" : "${client_account}",
-    "baseUrl" : "/auth/realms/demo/account",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "b1cef9f4-3843-494f-8fab-2aea834f6d21",
-    "defaultRoles" : [ "view-profile", "manage-account" ],
-    "redirectUris" : [ "/auth/realms/demo/account/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "aeb1484c-04f0-4e1f-a73b-05ecf7019ec9",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "9bfc7028-7345-42ee-9f2c-8d92bc96e7d7",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "01d89081-4505-4223-96b0-934530f83ae8",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "bafbfb31-1a00-4527-a07d-5b11bbf3559e",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "c8cdee70-744e-47dc-8ffc-d0b6c7526756",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "1311046e-aa5b-48d8-944f-adeea53e70a5",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "e6e83103-2950-4bdf-8118-981be005aed6",
-    "clientId" : "offline-access-portal",
-    "adminUrl" : "/offline-access-portal",
-    "baseUrl" : "/offline-access-portal",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/offline-access-portal/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : true,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "6f2943c7-a0d1-4439-8cb9-c7d92e016b91",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "1957c63f-1bb8-4069-8b02-226656e957b6",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "3a62f4e1-adb2-4b0e-be0a-46313896a5f7",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "952f391a-9ad8-49ab-81e5-58f0039de196",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "cfb0cc2e-9e51-4df6-b8a5-8ab559cf7f21",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "85c67366-c1af-4257-8839-59e89410e16b",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "ea87a33c-879d-4bc5-93dc-6bb85143387f",
-    "clientId" : "third-party",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "password",
-    "redirectUris" : [ "/oauth-client/*", "/oauth-client-cdi/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : true,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : -1,
-    "protocolMappers" : [ {
-      "id" : "d3053d4b-07aa-4c5d-a43e-414919df06ce",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "c93190fc-8c0d-415c-879b-6f2ab78bbb67",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "201fb55f-f3ca-4ff9-8897-082751585274",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "9b39c00f-fd99-43b0-bd9b-b925e6c311a2",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "68749430-666c-424d-a0a2-17633bdd94d7",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "af9a8820-0d8d-43bc-bbb7-19c404f3b371",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  } ],
-  "browserSecurityHeaders" : {
-    "contentSecurityPolicy" : "frame-src 'self'",
-    "xFrameOptions" : "SAMEORIGIN"
-  },
-  "smtpServer" : { },
-  "eventsEnabled" : false,
-  "eventsListeners" : [ "jboss-logging" ],
-  "enabledEventTypes" : [ "SEND_RESET_PASSWORD", "SEND_VERIFY_EMAIL", "EXECUTE_ACTIONS_ERROR", "REMOVE_FEDERATED_IDENTITY", "REMOVE_CREDENTIAL", "UPDATE_TOTP", "REMOVE_TOTP", "REVOKE_GRANT", "LOGIN_ERROR", "CLIENT_LOGIN", "RESET_PASSWORD_ERROR", "CODE_TO_TOKEN_ERROR", "CUSTOM_REQUIRED_ACTION", "UPDATE_EMAIL", "REGISTER_ERROR", "LOGOUT_ERROR", "UPDATE_EMAIL_ERROR", "UPDATE_PROFILE_ERROR", "IMPERSONATE", "LOGIN", "UPDATE_PASSWORD_ERROR", "UPDATE_CREDENTIAL_ERROR", "CLIENT_UPDATE_ERROR", "UPDATE_PROFILE", "REGISTER", "LOGOUT", "FEDERATED_IDENTITY_LINK", "CLIENT_REGISTER_ERROR", "CLIENT_REGISTER", "SEND_VERIFY_EMAIL_ERROR", "UPDATE_CREDENTIAL", "UPDATE_PASSWORD", "RESET_PASSWORD", "FEDERATED_IDENTITY_LINK_ERROR", "CLIENT_DELETE", "REMOVE_CREDENTIAL_ERROR", "REMOVE_TOTP_ERROR", "VERIFY_EMAIL_ERROR", "VERIFY_EMAIL", "SEND_RESET_PASSWORD_ERROR", "CLIENT_DELETE_ERROR", "CLIENT_LOGIN_ERROR", "CLIENT_UPDATE", "REMOVE_FEDERATED_IDENTITY_ERROR", "EXECUTE_ACTIONS", "CUSTOM_REQUIRED_ACTION_ERROR", "UPDATE_TOTP_ERROR", "CODE_TO_TOKEN" ],
-  "adminEventsEnabled" : true,
-  "adminEventsDetailsEnabled" : true,
-  "identityProviders" : [ {
-    "alias" : "keycloak-oidc",
-    "internalId" : "1cd4f1db-a891-42fc-967f-651b4c5d5ac1",
-    "providerId" : "keycloak-oidc",
-    "enabled" : true,
-    "updateProfileFirstLoginMode" : "on",
-    "trustEmail" : false,
-    "storeToken" : false,
-    "addReadTokenRoleOnCreate" : false,
-    "authenticateByDefault" : false,
-    "config" : {
-      "clientSecret" : "foo",
-      "clientId" : "foo",
-      "tokenUrl" : "foo",
-      "authorizationUrl" : "foo"
-    }
-  }, {
-    "alias" : "oidc",
-    "internalId" : "1b566532-c396-42d0-9d5a-d8b2d374a4e2",
-    "providerId" : "oidc",
-    "enabled" : true,
-    "updateProfileFirstLoginMode" : "on",
-    "trustEmail" : false,
-    "storeToken" : false,
-    "addReadTokenRoleOnCreate" : false,
-    "authenticateByDefault" : false,
-    "config" : {
-      "clientSecret" : "asdf",
-      "clientId" : "asdf",
-      "tokenUrl" : "asdf",
-      "authorizationUrl" : "asdf"
-    }
-  } ],
-  "identityFederationEnabled" : true,
-  "internationalizationEnabled" : false,
-  "supportedLocales" : [ ],
-  "authenticationFlows" : [ {
-    "alias" : "reset credentials",
-    "description" : "Reset credentials for a user if they forgot their password or something",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "reset-credentials-choose-user",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "reset-credential-email",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "reset-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    }, {
-      "authenticator" : "reset-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    } ]
-  }, {
-    "alias" : "clients",
-    "description" : "Base authentication for clients",
-    "providerId" : "client-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "client-secret",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "client-jwt",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "registration",
-    "description" : "registration flow",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-page-form",
-      "flowAlias" : "registration form",
-      "autheticatorFlow" : true,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    } ]
-  }, {
-    "alias" : "registration form",
-    "description" : "registration form",
-    "providerId" : "form-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-user-creation",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "registration-profile-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    }, {
-      "authenticator" : "registration-password-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 50
-    }, {
-      "authenticator" : "registration-recaptcha-action",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 60
-    } ]
-  }, {
-    "alias" : "browser",
-    "description" : "browser based authentication",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-cookie",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-spnego",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "flowAlias" : "forms",
-      "autheticatorFlow" : true,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  }, {
-    "alias" : "forms",
-    "description" : "Username, password, otp and other auth forms.",
-    "providerId" : "basic-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-username-password-form",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-otp-form",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "direct grant",
-    "description" : "OpenID Connect Resource Owner Grant",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "direct-grant-validate-username",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "direct-grant-validate-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "direct-grant-validate-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  } ],
-  "authenticatorConfig" : [ ],
-  "requiredActions" : [ {
-    "alias" : "UPDATE_PROFILE",
-    "name" : "Update Profile",
-    "providerId" : "UPDATE_PROFILE",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "terms_and_conditions",
-    "name" : "Terms and Conditions",
-    "providerId" : "terms_and_conditions",
-    "enabled" : false,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "VERIFY_EMAIL",
-    "name" : "Verify Email",
-    "providerId" : "VERIFY_EMAIL",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "CONFIGURE_TOTP",
-    "name" : "Configure Totp",
-    "providerId" : "CONFIGURE_TOTP",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "UPDATE_PASSWORD",
-    "name" : "Update Password",
-    "providerId" : "UPDATE_PASSWORD",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  } ],
-  "browserFlow" : "browser",
-  "registrationFlow" : "registration",
-  "directGrantFlow" : "direct grant",
-  "resetCredentialsFlow" : "reset credentials",
-  "clientAuthenticationFlow" : "clients"
-}, {
-  "id" : "mynewrealm",
-  "realm" : "mynewrealm",
-  "notBefore" : 0,
-  "revokeRefreshToken" : false,
-  "accessTokenLifespan" : 300,
-  "ssoSessionIdleTimeout" : 1800,
-  "ssoSessionMaxLifespan" : 36000,
-  "offlineSessionIdleTimeout" : 2592000,
-  "accessCodeLifespan" : 60,
-  "accessCodeLifespanUserAction" : 300,
-  "accessCodeLifespanLogin" : 1800,
-  "enabled" : true,
-  "sslRequired" : "external",
-  "registrationAllowed" : false,
-  "registrationEmailAsUsername" : false,
-  "rememberMe" : false,
-  "verifyEmail" : false,
-  "resetPasswordAllowed" : false,
-  "editUsernameAllowed" : false,
-  "bruteForceProtected" : false,
-  "maxFailureWaitSeconds" : 900,
-  "minimumQuickLoginWaitSeconds" : 60,
-  "waitIncrementSeconds" : 60,
-  "quickLoginCheckMilliSeconds" : 1000,
-  "maxDeltaTimeSeconds" : 43200,
-  "failureFactor" : 30,
-  "privateKey" : "MIIEowIBAAKCAQEAipWMs6L7fIFbAwGkVkPN3sw7J3lkvcFP2XyBbWm4uEruNg8Tz6WL8jRLXKiO24xO1Krf5Rdh25JZKpluciXswb6funfdgb5N0IZhiSD/mpYmlZEH5O07yIv7ojq5aVc6ZTVnfj55wRn6t0UO9rrOsjwLasToT1QYKuQBatutkOzmsDn7tjFlncGCoIwbiK3/JNsARKI1Jc4JwwilE6HZSbqSEC5O5+SLeM6b5TQUP6zUAnDDk/Z93q7Yt66XsuOkqu4FaTfdpkQi+RkJKytTbnwZvD8523I14RJTAJvypaiWHyx6c6qlPAeLALhyfeRf3Ge8O/xdFwij63Wpk/EMbQIDAQABAoIBAAbAfIdwBGKvhrihxtjxGsGlH6ivsGnSVkqZV1D2WqqX8/0sROHUBfp588YC7Frj/h88aAYoWnsxKSj7KrdjA6L4351dI6yjkfT75xqgQfPNJvoYg9Lyf/woXc0soUXxmwW9UVqEPrhaxK1TLwR0W4exhzjfeRYMWdUVIMCNDWrHHSWR/ZIpyYWvZVl3PnqpBu8VM7Q60B8bNY2eUZxXuhknLZn4OfM1yqA25SnoRiyJlfObPPjcEoW7Rs9oTqGLowrQAE0ULMUSmwzhhG942/uO356WSZnGvchLIAa1lwbXdN0kqrG8cKALZYrtruQufc1k1WkrLY2TITJocMTYPoECgYEA7jBEm1rXbGZvhHZN1RMGQ33G1N6vql7k05Q+ztl+7VL0xbxF8bBewefJ4MoXyCSHHPE7QsN10ZwI7OMH4lBBoL5+tVZ+ZJC/Mo3IqLmZcoUJPazG0wWbYcmND9h9ww34Xhm+j+pLhlFc1EGfVyXPXM8FnvmjPPFOBlfk0UjMvuECgYEAlPKEo3OJJFAFV6beT0lbmVQqor6o/jxr7MGFBylFwz6Wbybxbi3XlFRdNtUVEzJWV6Si5W0977QcxyK7jRGiXnxYnTII8F18l04qMBlF6n/ehVqaI/bDiqX/57CbcOafU1AcOwAZvXb41nhI/Gg/L3qH+QUMBOhXDlcP/Sa9uw0CgYEA4NQU3mPH9h1W5DzbSOX1Qp2loec0/2clLYXAJ3XrNk7YlxEZIIKvXu7QguufuR6pnqshmepv+tQDJL9EAN5qpDVL2xVyprBumWR15LWUXyGuUFYXMrcXLR2Xlj5ur0AvkXtRgfzRH08LhZsPsa4R5vPOxXm0GOFZGem7JcVG5mECgYBUPZ26/DtSaFe9LUmKukiuPaYniYH22KGJtCHS3Qrx1FIs52+hCxhkchqOSpGy28NtqlXfQJvJGKs2DXTZ4mFc4yMTNRtNJvKyeKjvrzuV12A5N/b55DTQE/baSU6A2k6+Rg7RZ8snF0TBuCI/b45dAgYpVytnEyk5mRAX83NXeQKBgHT1GghcVVIi1A01fLJADUglFQz1pMiccr11NROeRJPb3EDWXEgSClB4hv5pHY9iUtNxYV7s3rhCdfc+uCevH6HZH2ge+7f9HW9xnz6tRg7vLXXyV9IdpLOUyvQQCaxZ7KzOt3aGdN5a4FWDkdVyLgtV5DI9P6765aTbSjDyIOJb",
-  "publicKey" : "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAipWMs6L7fIFbAwGkVkPN3sw7J3lkvcFP2XyBbWm4uEruNg8Tz6WL8jRLXKiO24xO1Krf5Rdh25JZKpluciXswb6funfdgb5N0IZhiSD/mpYmlZEH5O07yIv7ojq5aVc6ZTVnfj55wRn6t0UO9rrOsjwLasToT1QYKuQBatutkOzmsDn7tjFlncGCoIwbiK3/JNsARKI1Jc4JwwilE6HZSbqSEC5O5+SLeM6b5TQUP6zUAnDDk/Z93q7Yt66XsuOkqu4FaTfdpkQi+RkJKytTbnwZvD8523I14RJTAJvypaiWHyx6c6qlPAeLALhyfeRf3Ge8O/xdFwij63Wpk/EMbQIDAQAB",
-  "certificate" : "MIICozCCAYsCBgFRF+OJTTANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApteW5ld3JlYWxtMB4XDTE1MTExNzIzNTc0NloXDTI1MTExNzIzNTkyNlowFTETMBEGA1UEAwwKbXluZXdyZWFsbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIqVjLOi+3yBWwMBpFZDzd7MOyd5ZL3BT9l8gW1puLhK7jYPE8+li/I0S1yojtuMTtSq3+UXYduSWSqZbnIl7MG+n7p33YG+TdCGYYkg/5qWJpWRB+TtO8iL+6I6uWlXOmU1Z34+ecEZ+rdFDva6zrI8C2rE6E9UGCrkAWrbrZDs5rA5+7YxZZ3BgqCMG4it/yTbAESiNSXOCcMIpROh2Um6khAuTufki3jOm+U0FD+s1AJww5P2fd6u2Leul7LjpKruBWk33aZEIvkZCSsrU258Gbw/OdtyNeESUwCb8qWolh8senOqpTwHiwC4cn3kX9xnvDv8XRcIo+t1qZPxDG0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEABKsK6mIwhTAzWoXFzx/h5qhjF90i98KDZ+iGaicmInwDFu3txSnsHwLq48Pm5Ks0D2tVrBqbDEGOtCwNJkrvXEzpqDJVRtWpUUA5W5NHDH1YDRm2teusYCtL6ffmSGbV1YDC0j1puBPKEM9xJIB9fop3332hRynbVzQtFpOSGj9RgBJLt7QqGtCZaVSJ1o5fxbUESVgQ7LSUn4SuOGNYtdF0ftonNxkpQMzEUu2sFcGXgCsnatmEv3hnkgMloFxraka+ahYhB50L0Z/8fC1kKkMFyKO5QNFh3r+b5YA8NPLCWCsAn9Fmryc6q5rHxAhvFemMxUUOjo7tFwKzyf0bhA==",
-  "codeSecret" : "d3dbbfb5-5b6b-4122-9fcb-ff53d62aebfc",
-  "roles" : {
-    "realm" : [ {
-      "id" : "a8e5f6e3-9835-444d-8899-e884490cb1b4",
-      "name" : "offline_access",
-      "description" : "${role_offline-access}",
-      "scopeParamRequired" : true,
-      "composite" : false
-    } ],
-    "client" : {
-      "realm-management" : [ {
-        "id" : "7451f1ae-5cd1-4c8b-8c5f-75f5618321c2",
-        "name" : "view-identity-providers",
-        "description" : "${role_view-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "64d85ad6-3565-45cd-8d56-3e6aa108c345",
-        "name" : "create-client",
-        "description" : "${role_create-client}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "77b6cbf9-44a9-4137-940d-249104598691",
-        "name" : "manage-realm",
-        "description" : "${role_manage-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "db6d4b5e-1eae-4a46-9e67-97c0ec102d0c",
-        "name" : "view-events",
-        "description" : "${role_view-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "b1db57ea-cc1f-4b9b-a200-1e0bb7ffd6c5",
-        "name" : "view-users",
-        "description" : "${role_view-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "822ac2e6-b399-41c6-9681-27472132df54",
-        "name" : "view-realm",
-        "description" : "${role_view-realm}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "9424dffd-57a7-49e6-8cdc-1789e98abed1",
-        "name" : "manage-users",
-        "description" : "${role_manage-users}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "82cae12f-28ce-4749-8e08-4047f7ff7e9d",
-        "name" : "impersonation",
-        "description" : "${role_impersonation}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "0edd1e08-69a5-4597-bc1a-3dee984a3224",
-        "name" : "realm-admin",
-        "description" : "${role_realm-admin}",
-        "scopeParamRequired" : false,
-        "composite" : true,
-        "composites" : {
-          "client" : {
-            "realm-management" : [ "create-client", "view-identity-providers", "manage-realm", "manage-events", "view-clients", "view-users", "view-events", "view-realm", "manage-clients", "manage-users", "impersonation", "manage-identity-providers" ]
-          }
-        }
-      }, {
-        "id" : "fee2975b-bcb1-48ab-a21d-90c0049fc57c",
-        "name" : "manage-identity-providers",
-        "description" : "${role_manage-identity-providers}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "a239851f-f8a9-4be0-bd10-95521c1a951b",
-        "name" : "manage-events",
-        "description" : "${role_manage-events}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "fe01f41a-600e-4e86-a530-b76d822d2ca0",
-        "name" : "view-clients",
-        "description" : "${role_view-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "94072c24-1e70-4010-a146-9f72233c14e0",
-        "name" : "manage-clients",
-        "description" : "${role_manage-clients}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "security-admin-console" : [ ],
-      "broker" : [ {
-        "id" : "96a4a79d-e555-4820-88f0-62640639dc6e",
-        "name" : "read-token",
-        "description" : "${role_read-token}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ],
-      "account" : [ {
-        "id" : "7091dbcd-9239-4f3c-b5a8-49466f004de4",
-        "name" : "view-profile",
-        "description" : "${role_view-profile}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      }, {
-        "id" : "ae422f88-cd9c-4d12-80dd-6ff8230711d8",
-        "name" : "manage-account",
-        "description" : "${role_manage-account}",
-        "scopeParamRequired" : false,
-        "composite" : false
-      } ]
-    }
-  },
-  "defaultRoles" : [ "offline_access" ],
-  "requiredCredentials" : [ "password" ],
-  "otpPolicyType" : "totp",
-  "otpPolicyAlgorithm" : "HmacSHA1",
-  "otpPolicyInitialCounter" : 0,
-  "otpPolicyDigits" : 6,
-  "otpPolicyLookAheadWindow" : 1,
-  "otpPolicyPeriod" : 30,
-  "clientScopeMappings" : {
-    "realm-management" : [ {
-      "client" : "security-admin-console",
-      "roles" : [ "realm-admin" ]
-    } ]
-  },
-  "clients" : [ {
-    "id" : "51f01c15-294a-4f28-935b-b82995e9f90d",
-    "clientId" : "realm-management",
-    "name" : "${client_realm-management}",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "1d30c53d-6ca2-4d06-9736-8a69a7065923",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : true,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "22b5b169-7ab9-4acb-b55c-4b7bd39f3759",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "f18fca13-fd5c-4fda-9111-3b321db2e71b",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "3f8d5e3f-0d5c-4ee9-94e7-8a803cb5a2ae",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "8a521257-f201-47fb-b06f-17986eed4121",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "d0500f07-3d6b-4eb8-a954-2f9da4781854",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "27521786-780e-4611-9091-edc8088aadd2",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "8cdfc36c-7d7e-4594-a25f-4894ef39269e",
-    "clientId" : "security-admin-console",
-    "name" : "${client_security-admin-console}",
-    "baseUrl" : "/auth/admin/mynewrealm/console/index.html",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "b787e86e-2dbb-4f10-b739-a24cc5d77fa5",
-    "redirectUris" : [ "/auth/admin/mynewrealm/console/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : true,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "d6268fe9-8b6c-4387-8bed-700e37d09e58",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "4a761028-ee37-4bb5-b382-8ef084252901",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "c8d53d5f-11d1-488e-a320-d00aace93c80",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0d012254-c633-4d6b-b626-b87848d22cd6",
-      "name" : "locale",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-attribute-mapper",
-      "consentRequired" : false,
-      "consentText" : "${locale}",
-      "config" : {
-        "user.attribute" : "locale",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "locale",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "559f5ed9-7f60-4300-bcf4-bd7cf3209cff",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "aa663b13-70e1-4394-a6e7-59ae369e0a91",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "e0f351ca-2742-4fe1-a352-fa57e141a042",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  }, {
-    "id" : "b10d68a4-175f-4065-a7e1-a3697dfc3dc1",
-    "clientId" : "broker",
-    "name" : "${client_broker}",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "8ed66cb4-c134-4972-ab2b-036a86318783",
-    "redirectUris" : [ ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "c965a94c-3a83-4363-99f3-7057b73e908e",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "cded7603-4742-47d4-a1b9-6a1a2df6194c",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "e062d72d-f6fa-4f5a-a478-a946ad0c4517",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "a447ff4f-cc24-413a-b45a-7894c88b7322",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "f251c7b4-84c9-423d-a2fe-2c4397632889",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "ad02d245-71a7-48d1-b6de-9b1478d47452",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    } ]
-  }, {
-    "id" : "633aca91-83e3-4e63-b4c2-f96f403612ec",
-    "clientId" : "account",
-    "name" : "${client_account}",
-    "baseUrl" : "/auth/realms/mynewrealm/account",
-    "surrogateAuthRequired" : false,
-    "enabled" : true,
-    "clientAuthenticatorType" : "client-secret",
-    "secret" : "f8529b2c-dd3e-4d94-af0f-84cf0d9d6abe",
-    "defaultRoles" : [ "view-profile", "manage-account" ],
-    "redirectUris" : [ "/auth/realms/mynewrealm/account/*" ],
-    "webOrigins" : [ ],
-    "notBefore" : 0,
-    "bearerOnly" : false,
-    "consentRequired" : false,
-    "serviceAccountsEnabled" : false,
-    "directGrantsOnly" : false,
-    "publicClient" : false,
-    "frontchannelLogout" : false,
-    "attributes" : { },
-    "fullScopeAllowed" : false,
-    "nodeReRegistrationTimeout" : 0,
-    "protocolMappers" : [ {
-      "id" : "6eb34932-a782-4bdb-92fc-25c4d9d43cea",
-      "name" : "email",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${email}",
-      "config" : {
-        "user.attribute" : "email",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "email",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "5692f01f-29ae-4bf0-a3ee-5d6fe07ee3c2",
-      "name" : "full name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-full-name-mapper",
-      "consentRequired" : true,
-      "consentText" : "${fullName}",
-      "config" : {
-        "id.token.claim" : "true",
-        "access.token.claim" : "true"
-      }
-    }, {
-      "id" : "c89c87c2-cbdf-44df-bf5c-29ccf10728ef",
-      "name" : "username",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${username}",
-      "config" : {
-        "user.attribute" : "username",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "preferred_username",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "0337493e-7145-4555-936c-a84308017dcf",
-      "name" : "family name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${familyName}",
-      "config" : {
-        "user.attribute" : "lastName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "family_name",
-        "jsonType.label" : "String"
-      }
-    }, {
-      "id" : "9dda80c0-0d15-4b75-a4fd-d261421a28a5",
-      "name" : "role list",
-      "protocol" : "saml",
-      "protocolMapper" : "saml-role-list-mapper",
-      "consentRequired" : false,
-      "config" : {
-        "single" : "false",
-        "attribute.nameformat" : "Basic",
-        "attribute.name" : "Role"
-      }
-    }, {
-      "id" : "940c8402-e4dd-41d9-94e6-6ef5654afd05",
-      "name" : "given name",
-      "protocol" : "openid-connect",
-      "protocolMapper" : "oidc-usermodel-property-mapper",
-      "consentRequired" : true,
-      "consentText" : "${givenName}",
-      "config" : {
-        "user.attribute" : "firstName",
-        "id.token.claim" : "true",
-        "access.token.claim" : "true",
-        "claim.name" : "given_name",
-        "jsonType.label" : "String"
-      }
-    } ]
-  } ],
-  "browserSecurityHeaders" : {
-    "contentSecurityPolicy" : "frame-src 'self'",
-    "xFrameOptions" : "SAMEORIGIN"
-  },
-  "smtpServer" : { },
-  "eventsEnabled" : false,
-  "eventsListeners" : [ "jboss-logging" ],
-  "enabledEventTypes" : [ ],
-  "adminEventsEnabled" : false,
-  "adminEventsDetailsEnabled" : false,
-  "identityFederationEnabled" : false,
-  "internationalizationEnabled" : false,
-  "supportedLocales" : [ ],
-  "authenticationFlows" : [ {
-    "alias" : "clients",
-    "description" : "Base authentication for clients",
-    "providerId" : "client-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "client-secret",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "client-jwt",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "registration form",
-    "description" : "registration form",
-    "providerId" : "form-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-user-creation",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "registration-profile-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    }, {
-      "authenticator" : "registration-password-action",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 50
-    }, {
-      "authenticator" : "registration-recaptcha-action",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 60
-    } ]
-  }, {
-    "alias" : "registration",
-    "description" : "registration flow",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "registration-page-form",
-      "flowAlias" : "registration form",
-      "autheticatorFlow" : true,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    } ]
-  }, {
-    "alias" : "forms",
-    "description" : "Username, password, otp and other auth forms.",
-    "providerId" : "basic-flow",
-    "topLevel" : false,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-username-password-form",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-otp-form",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    } ]
-  }, {
-    "alias" : "browser",
-    "description" : "browser based authentication",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "auth-cookie",
-      "autheticatorFlow" : false,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "auth-spnego",
-      "autheticatorFlow" : false,
-      "requirement" : "DISABLED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "flowAlias" : "forms",
-      "autheticatorFlow" : true,
-      "requirement" : "ALTERNATIVE",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  }, {
-    "alias" : "direct grant",
-    "description" : "OpenID Connect Resource Owner Grant",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "direct-grant-validate-username",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "direct-grant-validate-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "direct-grant-validate-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    } ]
-  }, {
-    "alias" : "reset credentials",
-    "description" : "Reset credentials for a user if they forgot their password or something",
-    "providerId" : "basic-flow",
-    "topLevel" : true,
-    "builtIn" : true,
-    "authenticationExecutions" : [ {
-      "authenticator" : "reset-credentials-choose-user",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 10
-    }, {
-      "authenticator" : "reset-credential-email",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 20
-    }, {
-      "authenticator" : "reset-password",
-      "autheticatorFlow" : false,
-      "requirement" : "REQUIRED",
-      "userSetupAllowed" : false,
-      "priority" : 30
-    }, {
-      "authenticator" : "reset-otp",
-      "autheticatorFlow" : false,
-      "requirement" : "OPTIONAL",
-      "userSetupAllowed" : false,
-      "priority" : 40
-    } ]
-  } ],
-  "authenticatorConfig" : [ ],
-  "requiredActions" : [ {
-    "alias" : "UPDATE_PROFILE",
-    "name" : "Update Profile",
-    "providerId" : "UPDATE_PROFILE",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "UPDATE_PASSWORD",
-    "name" : "Update Password",
-    "providerId" : "UPDATE_PASSWORD",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "terms_and_conditions",
-    "name" : "Terms and Conditions",
-    "providerId" : "terms_and_conditions",
-    "enabled" : false,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "CONFIGURE_TOTP",
-    "name" : "Configure Totp",
-    "providerId" : "CONFIGURE_TOTP",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  }, {
-    "alias" : "VERIFY_EMAIL",
-    "name" : "Verify Email",
-    "providerId" : "VERIFY_EMAIL",
-    "enabled" : true,
-    "defaultAction" : false,
-    "config" : { }
-  } ],
-  "browserFlow" : "browser",
-  "registrationFlow" : "registration",
-  "directGrantFlow" : "direct grant",
-  "resetCredentialsFlow" : "reset credentials",
-  "clientAuthenticationFlow" : "clients"
-} ]
\ No newline at end of file
diff --git a/js/apps/admin-ui/cypress/support/commands.ts b/js/apps/admin-ui/cypress/support/commands.ts
deleted file mode 100644
index 21b7fb62aabc..000000000000
--- a/js/apps/admin-ui/cypress/support/commands.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-// ***********************************************
-// This example commands.js shows you how to
-// create various custom commands and overwrite
-// existing commands.
-//
-// For more comprehensive examples of custom
-// commands please read more here:
-// https://on.cypress.io/custom-commands
-// ***********************************************
-//
-//
-// -- This is a parent command --
-// Cypress.Commands.add("login", (email, password) => { ... })
-//
-//
-// -- This is a child command --
-// Cypress.Commands.add("drag", { prevSubject: 'element'}, (subject, options) => { ... })
-//
-//
-// -- This is a dual command --
-// Cypress.Commands.add("dismiss", { prevSubject: 'optional'}, (subject, options) => { ... })
-//
-//
-// -- This will overwrite an existing command --
-// Cypress.Commands.overwrite("visit", (originalFn, url, options) => { ... })
-
-import "@testing-library/cypress/add-commands";
-import "@4tw/cypress-drag-drop";
-import "cypress-axe";
-
-Cypress.Commands.overwrite("checkA11y", (originalFn, options) => {
-  const mergedOptions = {
-    ...(typeof options === "object" ? options : {}),
-    includedImpacts: ["critical", "serious"],
-  };
-
-  return originalFn(undefined, mergedOptions);
-});
diff --git a/js/apps/admin-ui/cypress/support/constants.ts b/js/apps/admin-ui/cypress/support/constants.ts
deleted file mode 100644
index 74c2fae875ae..000000000000
--- a/js/apps/admin-ui/cypress/support/constants.ts
+++ /dev/null
@@ -1 +0,0 @@
-export const SERVER_URL = "http://localhost:8080";
diff --git a/js/apps/admin-ui/cypress/support/e2e.ts b/js/apps/admin-ui/cypress/support/e2e.ts
deleted file mode 100644
index d076cec9fd36..000000000000
--- a/js/apps/admin-ui/cypress/support/e2e.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-// ***********************************************************
-// This example support/index.js is processed and
-// loaded automatically before your test files.
-//
-// This is a great place to put global configuration and
-// behavior that modifies Cypress.
-//
-// You can change the location of this file or turn off
-// automatically serving support files with the
-// 'supportFile' configuration option.
-//
-// You can read more here:
-// https://on.cypress.io/configuration
-// ***********************************************************
-
-// Import commands.js using ES2015 syntax:
-import "./commands";
-
-// Alternatively you can use CommonJS syntax:
-// require('./commands')
diff --git a/js/apps/admin-ui/cypress/support/forms/Form.ts b/js/apps/admin-ui/cypress/support/forms/Form.ts
deleted file mode 100644
index d96cce34aba7..000000000000
--- a/js/apps/admin-ui/cypress/support/forms/Form.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-export default class Form {
-  static assertSaveButtonEnabled() {
-    this.#getSaveButton().should("be.enabled");
-  }
-
-  static assertSaveButtonDisabled() {
-    this.#getSaveButton().should("be.disabled");
-  }
-
-  static clickSaveButton() {
-    this.#getSaveButton().click();
-  }
-
-  static #getSaveButton() {
-    return cy.findByTestId("save");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/forms/FormValidation.ts b/js/apps/admin-ui/cypress/support/forms/FormValidation.ts
deleted file mode 100644
index b8eec8acdae7..000000000000
--- a/js/apps/admin-ui/cypress/support/forms/FormValidation.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-export default class FormValidation {
-  static assertRequired(chain: Cypress.Chainable<JQuery<HTMLElement>>) {
-    return this.assertMessage(chain, "Required field");
-  }
-
-  static assertMessage(
-    chain: Cypress.Chainable<JQuery<HTMLElement>>,
-    expectedMessage: string,
-  ) {
-    return this.#getHelperText(chain).should("have.text", expectedMessage);
-  }
-
-  static assertMinValue(
-    chain: Cypress.Chainable<JQuery<HTMLElement>>,
-    minValue: number,
-  ) {
-    this.assertMessage(chain, `Must be greater than ${minValue}`);
-  }
-
-  static assertMaxValue(
-    chain: Cypress.Chainable<JQuery<HTMLElement>>,
-    maxValue: number,
-  ) {
-    this.assertMessage(chain, `Must be less than ${maxValue}`);
-  }
-
-  static #getHelperText(chain: Cypress.Chainable<JQuery<HTMLElement>>) {
-    // A regular ID selector doesn't work here so we have to query by attribute.
-    return chain
-      .invoke("attr", "data-testid")
-      .then((id) => cy.get(`[data-testid="${id}-helper"]`));
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/forms/Select.ts b/js/apps/admin-ui/cypress/support/forms/Select.ts
deleted file mode 100644
index 8d7aadae7fc3..000000000000
--- a/js/apps/admin-ui/cypress/support/forms/Select.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-export default class Select {
-  static assertSelectedItem(
-    chain: Cypress.Chainable<JQuery<HTMLElement>>,
-    itemName: string,
-  ) {
-    chain.parent().should("have.text", itemName);
-  }
-
-  static selectItem(
-    chain: Cypress.Chainable<JQuery<HTMLElement>>,
-    itemName: string,
-  ) {
-    chain.click();
-    this.#getSelectMenu(chain).contains(itemName).click();
-  }
-
-  static #getSelectMenu(chain: Cypress.Chainable<JQuery<HTMLElement>>) {
-    return chain.parent().get(".pf-v5-c-menu__list");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/CommonElements.ts b/js/apps/admin-ui/cypress/support/pages/CommonElements.ts
deleted file mode 100644
index 791e7695f3dd..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/CommonElements.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { trim } from "lodash-es";
-
-export default class CommonElements {
-  protected parentSelector;
-  protected primaryBtn;
-  protected secondaryBtn;
-  protected secondaryBtnLink;
-  protected dropdownMenuItem;
-  protected selectMenuItem;
-  protected dropdownToggleBtn;
-  protected dropdownSelectToggleBtn;
-  protected dropdownSelectToggleItem;
-  protected tableKebabBtn;
-
-  constructor(parentSelector = "") {
-    this.parentSelector = trim(parentSelector) + " ";
-    this.primaryBtn = this.parentSelector + ".pf-v5-c-button.pf-m-primary";
-    this.secondaryBtn = this.parentSelector + ".pf-v5-c-button.pf-m-secondary";
-    this.secondaryBtnLink = this.parentSelector + ".pf-v5-c-button.pf-m-link";
-    this.dropdownMenuItem =
-      this.parentSelector + ".pf-v5-c-menu__list .pf-v5-c-menu__item";
-    this.selectMenuItem =
-      this.parentSelector + ".pf-v5-c-menu__list .pf-v5-c-menu__list-item";
-    this.dropdownToggleBtn = this.parentSelector + ".pf-v5-c-menu-toggle";
-    this.tableKebabBtn = this.parentSelector + ".pf-v5-c-menu-toggle";
-    this.dropdownSelectToggleBtn = this.parentSelector + ".pf-v5-c-menu-toggle";
-    this.dropdownSelectToggleItem =
-      this.parentSelector + ".pf-v5-c-menu__list > li";
-  }
-
-  clickPrimaryBtn() {
-    cy.get(this.primaryBtn).click();
-    return this;
-  }
-
-  clickSecondaryBtn(buttonName: string, force = false) {
-    cy.get(this.secondaryBtn).contains(buttonName).click({ force: force });
-    return this;
-  }
-
-  checkIfExists(exist: boolean) {
-    cy.get(this.parentSelector).should((!exist ? "not." : "") + "exist");
-    return this;
-  }
-
-  checkElementIsDisabled(
-    element: Cypress.Chainable<JQuery<HTMLElement>>,
-    disabled: boolean,
-  ) {
-    element.then(($btn) => {
-      if ($btn.hasClass("pf-m-disabled")) {
-        element.should(
-          (!disabled ? "not." : "") + "have.class",
-          "pf-m-disabled",
-        );
-      } else {
-        element.should((!disabled ? "not." : "") + "have.attr", "disabled");
-      }
-    });
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/CommonPage.ts b/js/apps/admin-ui/cypress/support/pages/CommonPage.ts
deleted file mode 100644
index 22b690b280d8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/CommonPage.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import Masthead from "./admin-ui/Masthead";
-import SidebarPage from "./admin-ui/SidebarPage";
-import TabUtils from "./admin-ui/components/TabPage";
-import FormUtils from "./admin-ui/components/FormPage";
-import ModalUtils from "../util/ModalUtils";
-import ActionToolbarUtils from "./admin-ui/components/ActionToolbarPage";
-import TableToolbarUtils from "./admin-ui/components/TableToolbarPage";
-import TableUtils from "./admin-ui/components/TablePage";
-import EmptyStatePage from "./admin-ui/components/EmptyStatePage";
-
-export default class CommonPage {
-  #mastheadPage = new Masthead();
-  #sidebarPage = new SidebarPage();
-  #tabUtilsObj = new TabUtils();
-  #formUtilsObj = new FormUtils();
-  #modalUtilsObj = new ModalUtils();
-  #actionToolbarUtilsObj = new ActionToolbarUtils();
-  #tableUtilsObj = new TableUtils();
-  #tableToolbarUtilsObj = new TableToolbarUtils();
-  #emptyStatePage = new EmptyStatePage();
-
-  masthead() {
-    return this.#mastheadPage;
-  }
-
-  sidebar() {
-    return this.#sidebarPage;
-  }
-
-  tabUtils() {
-    return this.#tabUtilsObj;
-  }
-
-  formUtils() {
-    return this.#formUtilsObj;
-  }
-
-  modalUtils() {
-    return this.#modalUtilsObj;
-  }
-
-  actionToolbarUtils() {
-    return this.#actionToolbarUtilsObj;
-  }
-
-  tableUtils() {
-    return this.#tableUtilsObj;
-  }
-
-  tableToolbarUtils() {
-    return this.#tableToolbarUtilsObj;
-  }
-
-  emptyState() {
-    return this.#emptyStatePage;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/LoginPage.ts b/js/apps/admin-ui/cypress/support/pages/LoginPage.ts
deleted file mode 100644
index ca2e058d155a..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/LoginPage.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-export default class LoginPage {
-  #userNameInput = "#username";
-  #passwordInput = "#password";
-  #submitBtn = "#kc-login";
-
-  #oldLoadContainer = "#loading";
-  #loadContainer = "div.keycloak__loading-container";
-
-  isLogInPage() {
-    cy.get(this.#userNameInput).should("exist");
-    cy.url().should("include", "/auth");
-
-    return this;
-  }
-
-  logIn(userName = "admin", password = "admin") {
-    cy.session(
-      [userName, password],
-      () => {
-        cy.visit("/");
-
-        cy.get('[role="progressbar"]').should("not.exist");
-        cy.get(this.#oldLoadContainer).should("not.exist");
-        cy.get(this.#loadContainer).should("not.exist");
-
-        cy.get(this.#userNameInput).type(userName);
-        cy.get(this.#passwordInput).type(password);
-
-        cy.get(this.#submitBtn).click();
-      },
-      {
-        validate() {
-          cy.get('[role="progressbar"]').should("not.exist");
-        },
-      },
-    );
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/ViewHeaderPage.ts b/js/apps/admin-ui/cypress/support/pages/ViewHeaderPage.ts
deleted file mode 100644
index f4f95876f8f4..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/ViewHeaderPage.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-export default class ListingPage {
-  #actionMenu = "action-dropdown";
-
-  clickAction(action: string) {
-    cy.findByTestId(this.#actionMenu).click().findByTestId(action).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/CreateRealmPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/CreateRealmPage.ts
deleted file mode 100644
index 7e406351b5e8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/CreateRealmPage.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import FormValidation from "../../forms/FormValidation";
-
-export default class CreateRealmPage {
-  #modalClearBtn = "clear-button";
-  #realmNameInput = "realm";
-  #enabledSwitch = ".pf-v5-c-toolbar .pf-v5-c-switch__toggle";
-  #createBtn = '.pf-v5-c-form__group:last-child button[type="submit"]';
-  #cancelBtn = '.pf-v5-c-form__group:last-child button[type="button"]';
-  #codeEditor = ".w-tc-editor-text";
-
-  #getClearBtn() {
-    return cy.findByText("Clear");
-  }
-
-  fillRealmName(realmName: string) {
-    cy.findByTestId(this.#realmNameInput).clear().type(realmName);
-
-    return this;
-  }
-
-  fillCodeEditor() {
-    cy.get(this.#codeEditor).type("clear this field");
-
-    return this;
-  }
-
-  createRealm(wait = true) {
-    if (wait) {
-      cy.intercept("POST", "/admin/realms").as("createRealm");
-      cy.get(this.#createBtn).click();
-      cy.wait("@createRealm");
-    } else {
-      cy.get(this.#createBtn).click();
-    }
-
-    return this;
-  }
-
-  disableRealm() {
-    cy.get(this.#enabledSwitch).click();
-
-    return this;
-  }
-
-  cancelRealmCreation() {
-    cy.get(this.#cancelBtn).click();
-
-    return this;
-  }
-
-  clearTextField() {
-    this.#getClearBtn().click();
-    cy.findByTestId(this.#modalClearBtn).click();
-
-    return this;
-  }
-
-  verifyRealmNameFieldInvalid() {
-    FormValidation.assertRequired(cy.findByTestId(this.#realmNameInput));
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/ListingPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/ListingPage.ts
deleted file mode 100644
index 8e2f2c735bc9..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/ListingPage.ts
+++ /dev/null
@@ -1,487 +0,0 @@
-import CommonElements from "../CommonElements";
-
-export enum Filter {
-  Name = "Name",
-  AssignedType = "Assigned type",
-  Protocol = "Protocol",
-}
-
-export enum FilterAssignedType {
-  AllTypes = "All types",
-  Default = "Default",
-  Optional = "Optional",
-  None = "None",
-}
-
-export enum FilterProtocol {
-  All = "All",
-  SAML = "SAML",
-  OpenID = "OpenID Connect",
-}
-
-export enum FilterSession {
-  AllSessionTypes = "All session types",
-  RegularSSO = "Regular SSO",
-  Offline = "Offline",
-  DirectGrant = "Direct grant",
-  ServiceAccount = "Service account",
-}
-
-export default class ListingPage extends CommonElements {
-  #tableToolbar = "section .pf-v5-c-toolbar";
-  #itemsRows = "table:visible";
-  #deleteUserButton = "delete-user-btn";
-  #emptyListImg = '[role="tabpanel"]:not([hidden]) [data-testid="empty-state"]';
-  #emptyState = "empty-state";
-  #itemRowDrpDwn = ".pf-v5-c-table__action button";
-  #itemRowSelect = "[data-testid='cell-dropdown']";
-  #itemRowSelectItem = ".pf-v5-c-menu__item";
-  #itemCheckbox = ".pf-v5-c-table__check";
-  public exportBtn = '[role="menuitem"]:nth-child(1)';
-  public deleteBtn = '[role="menuitem"]:nth-child(2)';
-  #searchBtn =
-    ".pf-v5-c-page__main .pf-v5-c-toolbar__content-section button.pf-m-control:visible";
-  #listHeaderPrimaryBtn =
-    ".pf-v5-c-page__main .pf-v5-c-toolbar__content-section .pf-m-primary:visible";
-  #listHeaderSecondaryBtn =
-    ".pf-v5-c-page__main .pf-v5-c-toolbar__content-section .pf-m-link";
-  #previousPageBtn =
-    ".pf-v5-c-pagination:not([class*=pf-m-bottom]) button[data-action=previous]";
-  #nextPageBtn =
-    ".pf-v5-c-pagination:not([class*=pf-m-bottom]) button[data-action=next]";
-  public tableRowItem = "tbody tr[data-ouia-component-type]:visible";
-  #table = "table[aria-label]";
-  #filterSessionDropdownButton = ".pf-v5-c-select button:nth-child(1)";
-  #filterDropdownButton = "[data-testid='clientScopeSearchType']";
-  #protocolFilterDropdownButton = "[data-testid='clientScopeSearchProtocol']";
-  #kebabMenu = "[data-testid='kebab']";
-  #dropdownItem = ".pf-v5-c-menu__list-item";
-  #toolbarChangeType = "#change-type-dropdown";
-  #tableNameColumnPrefix = "name-column-";
-  #rowGroup = "table:visible tbody[role='rowgroup']";
-  #tableHeaderCheckboxItemAllRows = "input[aria-label='Select all rows']";
-  #searchBtnInModal =
-    ".pf-v5-c-modal-box .pf-v5-c-toolbar__content-section button.pf-m-control:visible";
-  #menuContent = ".pf-v5-c-menu__content";
-  #menuItemText = ".pf-v5-c-menu__item-text";
-
-  #getSearchInput() {
-    return cy.findAllByTestId("table-search-input").last().find("input");
-  }
-
-  showPreviousPageTableItems() {
-    cy.get(this.#previousPageBtn).first().click();
-
-    return this;
-  }
-
-  showNextPageTableItems() {
-    cy.get("body").then(($body) => {
-      if (!$body.find('[data-testid="' + this.#nextPageBtn + '"]').length) {
-        cy.get(this.#nextPageBtn).scrollIntoView();
-        cy.get(this.#nextPageBtn).click();
-      }
-    });
-
-    return this;
-  }
-
-  goToCreateItem() {
-    cy.get(this.#listHeaderPrimaryBtn).click();
-
-    return this;
-  }
-
-  goToImportItem() {
-    cy.get(this.#listHeaderSecondaryBtn).click();
-
-    return this;
-  }
-
-  searchItem(searchValue: string, wait = true, realm = "master") {
-    if (wait) {
-      const searchUrl = `/admin/realms/${realm}/**/*${searchValue}*`;
-      cy.intercept(searchUrl).as("search");
-    }
-
-    this.#getSearchInput().click({ force: true });
-    this.#getSearchInput().clear();
-    if (searchValue) {
-      this.#getSearchInput().type(searchValue);
-      cy.get(this.#searchBtn).click({ force: true });
-    } else {
-      // TODO: Remove else and move clickSearchButton outside of the if
-      this.#getSearchInput().type("{enter}");
-    }
-
-    if (wait) {
-      cy.wait(["@search"]);
-    }
-
-    return this;
-  }
-
-  searchItemInModal(searchValue: string) {
-    this.#getSearchInput().click({ force: true });
-    this.#getSearchInput().clear();
-    if (searchValue) {
-      this.#getSearchInput().type(searchValue);
-    }
-    cy.get(this.#searchBtnInModal).click({ force: true });
-  }
-
-  checkTableLength(length: number, identifier: string) {
-    cy.get("table")
-      .should("have.class", identifier)
-      .get("tbody")
-      .children()
-      .should("have.length", length);
-  }
-
-  clickSearchBarActionButton() {
-    cy.get(this.#tableToolbar).find(this.#kebabMenu).click();
-
-    return this;
-  }
-
-  clickSearchBarActionItem(itemName: string) {
-    cy.get(this.#tableToolbar)
-      .find(this.#dropdownItem)
-      .contains(itemName)
-      .click();
-
-    return this;
-  }
-
-  clickRowDetails(itemName: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#itemRowDrpDwn)
-      .click({ force: true });
-    return this;
-  }
-
-  markItemRow(itemName: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find('input[name*="checkrow"]')
-      .click();
-    return this;
-  }
-
-  removeMarkedItems(name: string = "Remove") {
-    cy.get(this.#listHeaderSecondaryBtn).contains(name).click();
-    return this;
-  }
-
-  checkRowColumnValue(itemName: string, column: number, value: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find("td:nth-child(" + column + ")")
-      .should("have.text", value);
-    return this;
-  }
-
-  clickDetailMenu(name: string) {
-    cy.get(this.#itemsRows).contains(name).click();
-    return this;
-  }
-
-  clickMenuDelete() {
-    cy.get(this.#menuContent)
-      .find(this.#menuItemText)
-      .contains("Delete")
-      .click({ force: true });
-    return this;
-  }
-
-  clickMenuDuplicate() {
-    cy.get(this.#menuContent)
-      .find(this.#menuItemText)
-      .contains("Duplicate")
-      .click({ force: true });
-    return this;
-  }
-
-  clickItemCheckbox(itemName: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#itemCheckbox)
-      .click();
-    return this;
-  }
-
-  clickTableHeaderItemCheckboxAllRows() {
-    cy.get(this.#tableHeaderCheckboxItemAllRows).click();
-    return this;
-  }
-
-  clickRowSelectButton(itemName: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#itemRowSelect)
-      .click();
-    return this;
-  }
-
-  clickPrimaryButton() {
-    cy.get(this.#listHeaderPrimaryBtn).click();
-
-    return this;
-  }
-
-  clickRowSelectItem(rowItemName: string, selectItemName: string) {
-    this.clickRowSelectButton(rowItemName);
-    cy.get(this.#itemRowSelectItem).contains(selectItemName).click();
-
-    return this;
-  }
-
-  itemExist(itemName: string, exist = true) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .should((!exist ? "not." : "") + "exist");
-
-    return this;
-  }
-
-  goToItemDetails(itemName: string) {
-    cy.get(this.#itemsRows).contains(itemName).click({ force: true });
-
-    return this;
-  }
-
-  checkEmptyList() {
-    cy.get(this.#emptyListImg).should("be.visible");
-
-    return this;
-  }
-
-  deleteItem(itemName: string) {
-    this.clickRowDetails(itemName);
-    this.clickMenuDelete();
-
-    return this;
-  }
-
-  duplicateItem(itemName: string) {
-    this.clickRowDetails(itemName);
-    this.clickMenuDuplicate();
-
-    return this;
-  }
-
-  removeItem(itemName: string) {
-    this.clickRowDetails(itemName);
-    this.clickDetailMenu("Unassign");
-
-    return this;
-  }
-
-  deleteItemFromSearchBar(itemName: string) {
-    this.markItemRow(itemName);
-    cy.findByTestId(this.#deleteUserButton).click();
-
-    return this;
-  }
-
-  exportItem(itemName: string) {
-    this.clickRowDetails(itemName);
-    this.clickDetailMenu("Export");
-
-    return this;
-  }
-
-  checkEmptySearch() {
-    cy.get(this.tableRowItem).its("length").as("initialCount");
-    this.searchItem("", false);
-    cy.get(this.tableRowItem).its("length").as("finalCount");
-
-    cy.get("@initialCount").then((initial) => {
-      cy.get("@finalCount").then((final) => {
-        expect(initial).to.eq(final);
-      });
-    });
-
-    return this;
-  }
-
-  itemsEqualTo(amount: number) {
-    cy.get(this.tableRowItem).its("length").should("be.eq", amount);
-
-    return this;
-  }
-
-  itemsGreaterThan(amount: number) {
-    cy.get(this.tableRowItem).its("length").should("be.gt", amount);
-
-    return this;
-  }
-
-  itemContainValue(itemName: string, colIndex: number, value: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find("td")
-      .eq(colIndex)
-      .should("contain", value);
-
-    return this;
-  }
-
-  selectClientScopeFilter(filter: Filter) {
-    return this.selectFilter("clientScopeSearch", filter);
-  }
-
-  protected selectFilter(searchTypeButtonTestId: string, filterStr: string) {
-    cy.get(`[data-testid='${searchTypeButtonTestId}']`).click();
-    cy.get(this.#dropdownItem).contains(filterStr).click();
-
-    return this;
-  }
-
-  selectSecondaryFilter(itemName: string) {
-    cy.get(this.#filterDropdownButton).click();
-    cy.get(this.#itemRowSelectItem).contains(itemName).click();
-
-    return this;
-  }
-
-  selectSecondaryFilterAssignedType(assignedType: FilterAssignedType) {
-    this.selectSecondaryFilter(assignedType);
-
-    return this;
-  }
-
-  selectSecondaryFilterProtocol(protocol: FilterProtocol) {
-    cy.get(this.#protocolFilterDropdownButton).click();
-    cy.get(this.#itemRowSelectItem).contains(protocol).click();
-
-    return this;
-  }
-
-  selectSecondaryFilterSession(sessionName: FilterSession) {
-    cy.get(this.#filterSessionDropdownButton).click();
-    cy.get(this.#itemRowSelectItem).contains(sessionName);
-
-    return this;
-  }
-
-  changeTypeToOfSelectedItems(assignedType: FilterAssignedType) {
-    cy.intercept("/admin/realms/master/client-scopes").as("load");
-    cy.get(this.#toolbarChangeType).click();
-    cy.get(this.#itemRowSelectItem).contains(assignedType).click();
-    cy.wait("@load");
-    return this;
-  }
-
-  changeTypeToOfItem(assignedType: FilterAssignedType, itemName: string) {
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#toolbarChangeType)
-      .first()
-      .click();
-
-    cy.get(this.#itemsRows)
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#toolbarChangeType)
-      .contains(assignedType)
-      .click();
-
-    return this;
-  }
-
-  checkInSearchBarChangeTypeToButtonIsDisabled(disabled: boolean = true) {
-    let condition = "be.disabled";
-    if (!disabled) {
-      condition = "be.enabled";
-    }
-    cy.get(this.#toolbarChangeType).first().should(condition);
-
-    return this;
-  }
-
-  checkDropdownItemIsDisabled(itemName: string, disabled: boolean = true) {
-    cy.get(this.#dropdownItem)
-      .contains(itemName)
-      .should((disabled ? "" : "not.") + "be.disabled");
-
-    return this;
-  }
-
-  checkTableExists(exists: boolean = true) {
-    let condition = "be.visible";
-    if (!exists) {
-      condition = "not.be.visible";
-    }
-    cy.get(this.#table).should(condition);
-
-    return this;
-  }
-
-  #getResourceLink(name: string) {
-    return cy.findByTestId(this.#tableNameColumnPrefix + name);
-  }
-
-  goToResourceDetails(name: string) {
-    this.#getResourceLink(name).click();
-    return this;
-  }
-
-  assertNoResults() {
-    cy.findByTestId(this.#emptyState).should("exist");
-  }
-
-  assertDefaultResource() {
-    this.assertResource("Default Resource");
-    return this;
-  }
-
-  assertResource(name: string) {
-    this.#getResourceLink(name).should("exist");
-    return this;
-  }
-
-  #getRowGroup(index = 0) {
-    return cy.get(this.#rowGroup).eq(index);
-  }
-
-  expandRow(index = 0) {
-    this.#getRowGroup(index)
-      .find("[class='pf-v5-c-button pf-m-plain'][id*='expandable']")
-      .click();
-    return this;
-  }
-
-  collapseRow(index = 0) {
-    this.#getRowGroup(index)
-      .find(
-        "[class='pf-v5-c-button pf-m-plain pf-m-expanded'][id*='expandable']",
-      )
-      .click();
-    return this;
-  }
-
-  assertExpandedRowContainText(index = 0, text: string) {
-    this.#getRowGroup(index)
-      .find("tr[class='pf-v5-c-table__expandable-row pf-m-expanded']")
-      .should("contain.text", text);
-    return this;
-  }
-
-  assertRowIsExpanded(index = 0, isExpanded: boolean) {
-    this.#getRowGroup(index)
-      .find(
-        "[class='pf-v5-c-button pf-m-plain pf-m-expanded'][id*='expandable']",
-      )
-      .should((!isExpanded ? "not." : "") + "exist");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/Masthead.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/Masthead.ts
deleted file mode 100644
index f63cb038b9c4..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/Masthead.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import CommonElements from "../CommonElements";
-export default class Masthead extends CommonElements {
-  #logoBtn = ".pf-v5-c-page__header-brand-link img";
-  #helpBtn = "#help";
-
-  #userDrpDwn = "#user-dropdown";
-  #userDrpDwnKebab = "#user-dropdown-kebab";
-  #lastAlert = "last-alert";
-  #globalAlerts = "global-alerts";
-  #documentationLink = "#link";
-  #backToAdminConsoleLink = "referrer-link";
-  #userDrpdwnItem = ".pf-v5-c-menu__item";
-
-  #getLastAlert() {
-    return cy.findByTestId(this.#lastAlert);
-  }
-
-  #getAlerts() {
-    return cy.findAllByTestId(this.#globalAlerts);
-  }
-
-  checkIsAdminUI() {
-    cy.get(this.#logoBtn).should("exist");
-    cy.get(this.#userDrpDwn).should("exist");
-
-    return this;
-  }
-
-  setMobileMode(isMobileMode: boolean) {
-    if (isMobileMode) {
-      cy.viewport("iphone-6");
-    } else {
-      cy.viewport(1024, 768);
-    }
-  }
-
-  toggleGlobalHelp() {
-    cy.get(this.#helpBtn).click();
-    cy.get("#enableHelp").click({ force: true });
-  }
-
-  toggleUsernameDropdown() {
-    this.userDropdown().click();
-    return this;
-  }
-
-  toggleMobileViewHelp() {
-    cy.get(this.#userDrpdwnItem).contains("Help").click();
-    return this;
-  }
-
-  clickRealmInfo() {
-    cy.get(this.#userDrpdwnItem).contains("Realm info").click();
-    return this;
-  }
-
-  clickGlobalHelp() {
-    cy.get(this.#helpBtn).click();
-    return this;
-  }
-
-  getDocumentationLink() {
-    return cy.get(this.#documentationLink);
-  }
-
-  clickDocumentationLink() {
-    this.getDocumentationLink()
-      .find("a")
-      .invoke("removeAttr", "target")
-      .click();
-    return this;
-  }
-
-  goToAdminConsole() {
-    cy.findByTestId(this.#backToAdminConsoleLink).click({ force: true });
-    return this;
-  }
-
-  userDropdown() {
-    return cy
-      .document()
-      .then(({ documentElement }) => documentElement.getBoundingClientRect())
-      .then(({ width }) =>
-        cy.get(width < 1024 ? this.#userDrpDwnKebab : this.#userDrpDwn),
-      );
-  }
-
-  signOut() {
-    this.toggleUsernameDropdown();
-    cy.get("#sign-out").click();
-    Cypress.session.clearAllSavedSessions();
-  }
-
-  accountManagement() {
-    this.toggleUsernameDropdown();
-    cy.get("#manage-account").click();
-  }
-
-  checkNotificationMessage(message: string | RegExp, closeNotification = true) {
-    const alertElement = this.#getLastAlert();
-
-    if (typeof message === "string") {
-      alertElement.should(($el) => expect($el).to.contain.text(message));
-    } else {
-      alertElement.should(($el) => expect($el).to.match(message));
-    }
-
-    if (closeNotification) {
-      this.#getLastAlert().find("button").last().click({ force: true });
-    }
-    return this;
-  }
-
-  closeLastAlertMessage() {
-    this.#getLastAlert().find("button").click();
-    return this;
-  }
-
-  closeAllAlertMessages() {
-    this.#getAlerts().find("button").click({
-      force: true,
-      multiple: true,
-    });
-
-    return this;
-  }
-
-  assertIsDesktopView() {
-    cy.get(this.#userDrpDwn).should("be.visible");
-    cy.get(this.#userDrpDwnKebab).should("not.be.visible");
-
-    return this;
-  }
-
-  assertIsMobileView() {
-    cy.get(this.#userDrpDwn).should("not.be.visible");
-    cy.get(this.#userDrpDwnKebab).should("be.visible");
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/SidebarPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/SidebarPage.ts
deleted file mode 100644
index 34cc4a8c0dd5..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/SidebarPage.ts
+++ /dev/null
@@ -1,166 +0,0 @@
-import CommonElements from "../CommonElements";
-
-export default class SidebarPage extends CommonElements {
-  #realmsDrpDwn = "realmSelector";
-  #createRealmBtn = "add-realm";
-
-  #clientsBtn = "#nav-item-clients";
-  #clientScopesBtn = "#nav-item-client-scopes";
-  #realmRolesBtn = "#nav-item-roles";
-  #usersBtn = "#nav-item-users";
-  #groupsBtn = "#nav-item-groups";
-  #sessionsBtn = "#nav-item-sessions";
-  #eventsBtn = "#nav-item-events";
-
-  #realmSettingsBtn = "#nav-item-realm-settings";
-  #authenticationBtn = "#nav-item-authentication";
-  #identityProvidersBtn = "#nav-item-identity-providers";
-  #userFederationBtn = "#nav-item-user-federation";
-
-  realmsElements = '[id="realm-select"] li';
-
-  showCurrentRealms(length: number) {
-    cy.findByTestId(this.#realmsDrpDwn).click();
-    cy.get(this.realmsElements).contains("Loading realms…").should("not.exist");
-    cy.get(this.realmsElements).should(
-      "have.length",
-      length + 1, // account for button
-    );
-    cy.findByTestId(this.#realmsDrpDwn).click({ force: true });
-
-    return this;
-  }
-
-  realmExists(realmName: string, exists = true) {
-    cy.findByTestId(this.#realmsDrpDwn).click();
-    cy.get(this.realmsElements).contains("Loading realms…").should("not.exist");
-    cy.get(this.realmsElements)
-      .contains(realmName)
-      .should((exists ? "" : "not.") + "exist");
-    cy.findByTestId(this.#realmsDrpDwn).click();
-
-    return this;
-  }
-
-  getCurrentRealm() {
-    return cy.findByTestId(this.#realmsDrpDwn).scrollIntoView().invoke("text");
-  }
-
-  goToRealm(realmName: string) {
-    this.waitForPageLoad();
-    cy.intercept("GET", "/admin/realms/master/ui-ext/realms/names/*").as(
-      "getRealms",
-    );
-    cy.findByTestId(this.#realmsDrpDwn).click();
-    cy.get(this.realmsElements).contains("Loading realms…").should("not.exist");
-    cy.get(this.realmsElements).contains(realmName).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToCreateRealm() {
-    this.waitForPageLoad();
-    cy.findByTestId(this.#realmsDrpDwn).click();
-    cy.findByTestId(this.#createRealmBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToClients() {
-    this.waitForPageLoad();
-    cy.get(this.#clientsBtn).click({ force: true });
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToClientScopes() {
-    this.waitForPageLoad();
-    cy.get(this.#clientScopesBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToRealmRoles() {
-    cy.get(this.#realmRolesBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToUsers() {
-    this.waitForPageLoad();
-    cy.get(this.#usersBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToGroups() {
-    this.waitForPageLoad();
-    cy.get(this.#groupsBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToSessions() {
-    this.waitForPageLoad();
-    cy.get(this.#sessionsBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToEvents() {
-    this.waitForPageLoad();
-    cy.get(this.#eventsBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToRealmSettings() {
-    this.waitForPageLoad();
-    cy.get(this.#realmSettingsBtn).click({ force: true });
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToAuthentication() {
-    this.waitForPageLoad();
-    cy.get(this.#authenticationBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToIdentityProviders() {
-    this.waitForPageLoad();
-    cy.get(this.#identityProvidersBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  goToUserFederation() {
-    this.waitForPageLoad();
-    cy.get(this.#userFederationBtn).click();
-    this.waitForPageLoad();
-
-    return this;
-  }
-
-  waitForPageLoad() {
-    cy.get('[role="progressbar"]').should("not.exist");
-    return this;
-  }
-
-  checkRealmSettingsLinkContainsText(expectedText: string) {
-    cy.get(this.#realmSettingsBtn).should("contain", expectedText);
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/ActionToolbarPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/ActionToolbarPage.ts
deleted file mode 100644
index 528cc73deaa0..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/ActionToolbarPage.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import CommonElements from "../../CommonElements";
-
-export default class ActionToolbarPage extends CommonElements {
-  constructor() {
-    super(".pf-v5-l-level.pf-m-gutter");
-  }
-
-  get bearerOnlyExplainerLabelElement() {
-    return cy
-      .get(this.parentSelector)
-      .findByTestId("bearer-only-explainer-label");
-  }
-
-  get bearerOnlyExplainerTooltipElement() {
-    return cy.findByTestId("bearer-only-explainer-tooltip");
-  }
-
-  clickActionToggleButton() {
-    cy.get(this.parentSelector).findByTestId("action-dropdown").click();
-    return this;
-  }
-
-  #getDropdownItem(itemName: string) {
-    return cy.get(this.dropdownMenuItem).contains(itemName);
-  }
-
-  checkActionItemExists(itemName: string, exists: boolean) {
-    const condition = exists ? "exist" : "not.exist";
-    this.#getDropdownItem(itemName).should(condition);
-    return this;
-  }
-
-  clickDropdownItem(itemName: string) {
-    this.#getDropdownItem(itemName).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/EmptyStatePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/EmptyStatePage.ts
deleted file mode 100644
index 71d25d5ce45e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/EmptyStatePage.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import CommonElements from "../../CommonElements";
-
-export default class EmptyStatePage extends CommonElements {
-  constructor() {
-    super(".pf-v5-c-empty-state__content");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/FormPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/FormPage.ts
deleted file mode 100644
index 8419d9fad255..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/FormPage.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import CommonElements from "../../CommonElements";
-
-export default class FormPage extends CommonElements {
-  constructor() {
-    super(".pf-v5-c-form:visible");
-  }
-
-  save() {
-    cy.get(this.primaryBtn).contains("Save").click();
-    return this;
-  }
-
-  add() {
-    cy.get(this.primaryBtn).contains("Add").click();
-    return this;
-  }
-
-  cancel() {
-    cy.get(this.secondaryBtnLink).contains("Cancel").click();
-    return this;
-  }
-
-  revert() {
-    cy.get(this.secondaryBtnLink).contains("Revert").click();
-    return this;
-  }
-
-  checkSaveButtonIsDisabled(disabled: boolean) {
-    this.checkElementIsDisabled(
-      cy.get(this.primaryBtn).contains("Save"),
-      disabled,
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/PageObject.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/PageObject.ts
deleted file mode 100644
index 233d679919b7..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/PageObject.ts
+++ /dev/null
@@ -1,393 +0,0 @@
-export default class PageObject {
-  #selectItemSelectedIcon = ".pf-v5-c-menu-toggle__toggle-icon";
-  #drpDwnMenuList = ".pf-v5-c-menu__list";
-  #drpDwnMenuItem = ".pf-v5-c-menu__item";
-  #drpDwnMenuToggleBtn = ".pf-v5-c-menu-toggle";
-  #selectMenuList = ".pf-v5-c-menu__list";
-  #selectMenuItem = ".pf-v5-c-menu__list-item";
-  #selectMenuToggleBtn = ".pf-v5-c-menu-toggle";
-  #switchInput = ".pf-v5-c-switch__input";
-  #formLabel = ".pf-v5-c-form__label";
-  #chipGroupCloseBtn = ".pf-v5-c-chip-group__close";
-  #chipItem = ".pf-v5-c-chip-group__list-item";
-  #emptyStateDiv = ".pf-v5-c-empty-state:visible";
-  #toolbarActionsButton = ".pf-v5-c-toolbar button[aria-label='Actions']";
-  #breadcrumbItem = ".pf-v5-c-breadcrumb .pf-v5-c-breadcrumb__item";
-
-  genericChipGroupSelector = ".pf-v5-c-chip-group";
-
-  protected assertExist(element: Cypress.Chainable<JQuery>, exist: boolean) {
-    element.should((!exist ? "not." : "") + "exist");
-    return this;
-  }
-
-  protected assertIsVisible(
-    element: Cypress.Chainable<JQuery>,
-    isVisible: boolean,
-  ) {
-    element.should((!isVisible ? "not." : "") + "be.visible");
-    return this;
-  }
-
-  protected assertIsEnabled(
-    element: Cypress.Chainable<JQuery>,
-    isEnabled = true,
-  ) {
-    element.then(($btn) => {
-      if ($btn.hasClass("pf-m-disabled")) {
-        element.should(
-          (isEnabled ? "not." : "") + "have.class",
-          "pf-m-disabled",
-        );
-      } else {
-        element.should((isEnabled ? "not." : "") + "have.attr", "disabled");
-      }
-    });
-    return this;
-  }
-
-  protected assertIsDisabled(element: Cypress.Chainable<JQuery>) {
-    return this.assertIsEnabled(element, false);
-  }
-
-  protected assertHaveText(element: Cypress.Chainable<JQuery>, text: string) {
-    element.should("have.text", text);
-    return this;
-  }
-
-  protected assertHaveValue(element: Cypress.Chainable<JQuery>, value: string) {
-    element.should("have.value", value);
-    return this;
-  }
-
-  protected assertSwitchStateOn(
-    element?: Cypress.Chainable<JQuery>,
-    isOn = true,
-  ) {
-    (element ?? cy.get(this.#switchInput))
-      .parent()
-      .contains(isOn ? "On" : "Off")
-      .should("be.visible");
-    return this;
-  }
-
-  protected assertSwitchStateOff(element?: Cypress.Chainable<JQuery>) {
-    return this.assertSwitchStateOn(element, false);
-  }
-
-  protected assertDropdownMenuIsOpen(
-    isOpen = true,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    this.assertExist(element ?? cy.get(this.#drpDwnMenuList), isOpen);
-    return this;
-  }
-
-  protected assertDropdownMenuIsClosed(element?: Cypress.Chainable<JQuery>) {
-    return this.assertDropdownMenuIsOpen(
-      false,
-      element ?? cy.get(this.#drpDwnMenuList),
-    );
-  }
-
-  protected clickDropdownMenuItem(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    (element ?? cy.get(this.#drpDwnMenuItem).contains(itemName)).click();
-    return this;
-  }
-
-  protected clickDropdownMenuToggleButton(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy
-        .get(this.#drpDwnMenuToggleBtn)
-        .parent()
-        .contains(itemName)
-        .parent()
-        .parent();
-    element.click();
-    return this;
-  }
-
-  protected openDropdownMenu(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy
-        .get(this.#drpDwnMenuToggleBtn)
-        .parent()
-        .contains(itemName)
-        .parent()
-        .parent();
-    this.clickDropdownMenuToggleButton(itemName, element);
-    this.assertDropdownMenuIsOpen(true);
-    return this;
-  }
-
-  protected closeDropdownMenu(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy
-        .get(this.#drpDwnMenuToggleBtn)
-        .parent()
-        .contains(itemName)
-        .parent()
-        .parent();
-    this.clickDropdownMenuToggleButton(itemName, element);
-    this.assertDropdownMenuIsOpen(false);
-    return this;
-  }
-
-  protected assertDropdownMenuItemIsSelected(
-    itemName: string,
-    isSelected: boolean,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element = element ?? cy.get(this.#drpDwnMenuItem);
-    this.assertExist(
-      element.contains(itemName).find(this.#selectItemSelectedIcon),
-      isSelected,
-    );
-    return this;
-  }
-
-  protected assertDropdownMenuHasItems(
-    items: string[],
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    const initialElement = element;
-    for (const item of items) {
-      element = initialElement ?? cy.get(this.#drpDwnMenuList);
-      this.assertExist(element.find(this.#drpDwnMenuItem).contains(item), true);
-    }
-    return this;
-  }
-
-  protected assertDropdownMenuHasLabels(
-    items: string[],
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    const initialElement = element;
-    for (const item of items) {
-      element = initialElement ?? cy.get(this.#drpDwnMenuList);
-      this.assertExist(element.find(this.#formLabel).contains(item), true);
-    }
-    return this;
-  }
-
-  protected assertDropdownMenuItemsEqualTo(
-    number: number,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element = element ?? cy.get(this.#drpDwnMenuList);
-    element.find(this.#drpDwnMenuItem).should(($item) => {
-      expect($item).to.have.length(number);
-    });
-    return this;
-  }
-
-  protected assertSelectMenuIsOpen(
-    isOpen = true,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element = element ?? cy.get(this.#selectMenuList);
-    return this.assertDropdownMenuIsOpen(isOpen, element);
-  }
-
-  protected assertSelectMenuIsClosed(element?: Cypress.Chainable<JQuery>) {
-    element = element ?? cy.get(this.#selectMenuList);
-    return this.assertDropdownMenuIsClosed(element);
-  }
-
-  protected clickSelectMenuItem(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy.get(this.#selectMenuItem).contains(new RegExp(`^${itemName}$`));
-    return this.clickDropdownMenuItem(itemName, element);
-  }
-
-  protected clickSelectMenuToggleButton(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy.get(this.#selectMenuToggleBtn).contains(itemName).parent().parent();
-    return this.clickDropdownMenuToggleButton(itemName, element);
-  }
-
-  protected openSelectMenu(itemName: string, element?: Cypress.Chainable<any>) {
-    element =
-      element ??
-      cy.get(this.#selectMenuToggleBtn).contains(itemName).parent().parent();
-    this.clickDropdownMenuToggleButton(itemName, element);
-    this.assertSelectMenuIsOpen(true);
-    return this;
-  }
-
-  protected closeSelectMenu(
-    itemName: string,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element =
-      element ??
-      cy.get(this.#selectMenuToggleBtn).contains(itemName).parent().parent();
-    this.clickDropdownMenuToggleButton(itemName, element);
-    this.assertSelectMenuIsOpen(false);
-    return this;
-  }
-
-  protected assertSelectMenuItemIsSelected(
-    itemName: string,
-    isSelected: boolean,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element = element ?? cy.get(this.#selectMenuItem);
-    return this.assertDropdownMenuItemIsSelected(itemName, isSelected, element);
-  }
-
-  protected assertSelectMenuHasItems(
-    items: string[],
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    const initialElement = element;
-    for (const item of items) {
-      element = initialElement ?? cy.get(this.#selectMenuList);
-      this.assertExist(element.find(this.#selectMenuItem).contains(item), true);
-    }
-    return this;
-  }
-
-  protected assertSelectMenuItemsEqualTo(
-    number: number,
-    element?: Cypress.Chainable<JQuery>,
-  ) {
-    element = element ?? cy.get(this.#selectMenuList);
-    element.find(this.#selectMenuItem).should(($item) => {
-      expect($item).to.have.length(number);
-    });
-    return this;
-  }
-
-  #getChipGroup(groupSelector: string, groupName: string) {
-    return cy.get(groupSelector).contains(groupName).parent().parent();
-  }
-
-  #getChipGroupWithLabel(groupSelector: string, label: string) {
-    cy.get(groupSelector)
-      .parent()
-      .find(".pf-v5-c-chip-group__label")
-      .contains(label);
-
-    return cy.get(groupSelector);
-  }
-
-  #getChipGroupItem(
-    groupSelector: string,
-    groupName: string,
-    itemName: string,
-  ) {
-    return this.#getChipGroup(groupSelector, groupName)
-      .find(this.#chipItem)
-      .contains(itemName)
-      .parent();
-  }
-
-  protected removeChipGroup(groupSelector: string, groupName: string) {
-    this.#getChipGroup(groupSelector, groupName)
-      .find(this.#chipGroupCloseBtn)
-      .find("button")
-      .click();
-    return this;
-  }
-
-  protected removeChipGroupItem(
-    groupSelector: string,
-    groupName: string,
-    itemName: string,
-  ) {
-    this.#getChipGroupItem(groupSelector, groupName, itemName)
-      .find("button")
-      .click();
-    return this;
-  }
-
-  protected assertChipGroupExist(
-    groupSelector: string,
-    groupName: string,
-    exist: boolean,
-  ) {
-    this.assertExist(cy.contains(groupSelector, groupName), exist);
-    return this;
-  }
-
-  protected clickToolbarAction(itemName: string) {
-    cy.get(this.#toolbarActionsButton).click();
-    this.clickDropdownMenuItem(itemName);
-    return this;
-  }
-
-  protected assertChipGroupItemExist(
-    groupSelector: string,
-    groupName: string,
-    itemName: string,
-    exist: boolean,
-  ) {
-    this.assertExist(
-      this.#getChipGroup(groupSelector, groupName).contains(
-        this.#chipItem,
-        itemName,
-      ),
-      exist,
-    );
-    return this;
-  }
-
-  protected assertLabeledChipGroupItemExist(
-    groupSelector: string,
-    labelName: string,
-    itemName: string,
-    exist: boolean,
-  ) {
-    this.assertExist(
-      this.#getChipGroupWithLabel(groupSelector, labelName).contains(
-        this.#chipItem,
-        itemName,
-      ),
-      exist,
-    );
-    return this;
-  }
-
-  assertEmptyStateExist(exist: boolean) {
-    if (exist) {
-      cy.get(this.#emptyStateDiv).should("exist").should("be.visible");
-    } else {
-      cy.get(this.#emptyStateDiv).should("not.exist");
-    }
-    return this;
-  }
-
-  protected clickBreadcrumbItem(itemName: string) {
-    cy.get(this.#breadcrumbItem).contains(itemName).click();
-    return this;
-  }
-
-  protected waitForPageLoad() {
-    cy.get('[role="progressbar"]').should("not.exist");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TabPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TabPage.ts
deleted file mode 100644
index e0ac2d979ef4..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TabPage.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import CommonElements from "../../CommonElements";
-
-export default class TabPage extends CommonElements {
-  protected tabItemSelector: string;
-  protected tabsList: string;
-
-  constructor() {
-    super(".pf-v5-c-tabs");
-    this.tabItemSelector = ".pf-v5-c-tabs__item";
-    this.tabsList = '[role="tablist"]';
-  }
-
-  #getTab(tabName: string, index: number | undefined = 0) {
-    return cy
-      .get(this.parentSelector)
-      .eq(index)
-      .find(this.tabItemSelector)
-      .contains(tabName);
-  }
-
-  clickTab(tabName: string, index: number | undefined = 0) {
-    this.#getTab(tabName, index).click();
-    this.checkIsCurrentTab(tabName, index);
-    return this;
-  }
-
-  checkIsCurrentTab(tabName: string, index: number | undefined = 0) {
-    this.#getTab(tabName, index).parent().should("have.class", "pf-m-current");
-    return this;
-  }
-
-  checkTabExists(
-    tabName: string,
-    exists: boolean,
-    index: number | undefined = 0,
-  ) {
-    const condition = exists ? "exist" : "not.exist";
-    this.#getTab(tabName, index).should(condition);
-    return this;
-  }
-
-  checkNumberOfTabsIsEqual(number: number) {
-    cy.get(this.tabsList).find("li").should("have.length", number);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TablePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TablePage.ts
deleted file mode 100644
index c4c6f56d7a1b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TablePage.ts
+++ /dev/null
@@ -1,191 +0,0 @@
-import CommonElements from "../../CommonElements";
-
-export default class TablePage extends CommonElements {
-  #tableRowItem: string;
-  #tableRowItemChckBx: string;
-  #tableHeaderRowItem: string;
-  #tableKebabMenu: string;
-  #tableInModal: boolean;
-  static tableSelector = ".pf-v5-c-table";
-
-  constructor(parentElement?: string) {
-    super(parentElement ?? TablePage.tableSelector + ":visible");
-    this.#tableRowItem = this.parentSelector + "tbody tr";
-    this.#tableHeaderRowItem = this.parentSelector + "thead tr";
-    this.#tableRowItemChckBx = ".pf-v5-c-table__check";
-    this.#tableKebabMenu = ".pf-v5-c-menu";
-    this.#tableInModal = false;
-  }
-
-  setTableInModal(value: boolean) {
-    this.#tableInModal = value;
-  }
-
-  selectRowItemCheckbox(itemName: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(this.#tableRowItemChckBx)
-      .click();
-    return this;
-  }
-
-  clickRowItemLink(itemName: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .contains(itemName)
-      .click({ force: true });
-    return this;
-  }
-
-  selectRowItemAction(itemName: string, actionItemName: string) {
-    this.#getRowItemAction(itemName, actionItemName).click();
-    return this;
-  }
-
-  assertRowItemActionExist(itemName: string, actionItemName: string) {
-    this.#getRowItemAction(itemName, actionItemName).should("exist");
-    return this;
-  }
-
-  #getRowItemAction(itemName: string, actionItemName: string) {
-    return cy
-      .get(
-        (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-          this.#tableRowItem,
-      )
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find(".pf-v5-c-table__action .pf-v5-c-menu-toggle")
-      .click()
-      .get(this.#tableKebabMenu)
-      .contains(actionItemName);
-  }
-
-  typeValueToRowItem(row: number, column: number, value: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem +
-        ":nth-child(" +
-        row +
-        ")",
-    )
-      .find("td:nth-child(" + column + ")")
-      .type(value);
-    return this;
-  }
-
-  clickRowItemByIndex(row: number, column: number, appendChildren?: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem +
-        ":nth-child(" +
-        row +
-        ")",
-    )
-      .find("td:nth-child(" + column + ") " + appendChildren)
-      .click();
-    return this;
-  }
-
-  clickRowItemByItemName(
-    itemName: string,
-    column: number,
-    appendChildren?: string,
-  ) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .find("td:nth-child(" + column + ") " + appendChildren)
-      .contains(itemName)
-      .click();
-    return this;
-  }
-
-  clickHeaderItem(column: number, appendChildren?: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableHeaderRowItem,
-    )
-      .find("th:nth-child(" + column + ") " + appendChildren)
-      .click();
-    return this;
-  }
-
-  checkRowItemsEqualTo(amount: number) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .its("length")
-      .should("be.eq", amount);
-    return this;
-  }
-
-  checkRowItemsGreaterThan(amount: number) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .its("length")
-      .should("be.gt", amount);
-    return this;
-  }
-
-  checkRowItemExists(itemName: string, exist = true) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .contains(itemName)
-      .should((!exist ? "not." : "") + "exist");
-    return this;
-  }
-
-  checkTemporaryAdminLabelExists(labelId: string, exist = true) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .find(`#${labelId}`)
-      .should((!exist ? "not." : "") + "exist");
-    return this;
-  }
-
-  checkRowItemValueByItemName(itemName: string, column: number, value: string) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem,
-    )
-      .contains(itemName)
-      .parentsUntil("tbody")
-      .find("td:nth-child(" + column + ")")
-      .should("have.text", value);
-    return this;
-  }
-
-  checkRowItemValueByIndex(
-    row: number,
-    column: number,
-    value: string,
-    appendChildren?: string,
-  ) {
-    cy.get(
-      (this.#tableInModal ? ".pf-v5-c-modal-box.pf-m-md " : "") +
-        this.#tableRowItem +
-        ":nth-child(" +
-        row +
-        ")",
-    )
-      .find("td:nth-child(" + column + ") " + appendChildren)
-      .should("have.text", value)
-      .should("have.value", value);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TableToolbarPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TableToolbarPage.ts
deleted file mode 100644
index 500925ca5289..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/components/TableToolbarPage.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import CommonElements from "../../CommonElements";
-import type { Filter, FilterAssignedType } from "../ListingPage";
-
-export default class TableToolbar extends CommonElements {
-  #searchBtn: string;
-  #searchInput: string;
-  #changeTypeBtn: string;
-  #nextPageBtn: string;
-  #previousPageBtn: string;
-  #searchTypeDropdownBtn: string;
-  #actionToggleBtn: string;
-
-  constructor() {
-    super(".pf-v5-c-toolbar:visible");
-    this.#searchBtn =
-      this.parentSelector + "button[aria-label='Search']:visible";
-    this.#searchInput =
-      this.parentSelector + ".pf-v5-c-text-input-group__text-input:visible";
-    this.#changeTypeBtn = this.parentSelector + "#change-type-dropdown";
-    this.#nextPageBtn = this.parentSelector + "button[data-action=next]";
-    this.#previousPageBtn =
-      this.parentSelector + "button[data-action=previous]";
-    this.#searchTypeDropdownBtn = "[data-testid='clientScopeSearchType']";
-    this.#actionToggleBtn = "[data-testid='kebab']";
-  }
-
-  clickNextPageButton(isUpperButton = true) {
-    if (isUpperButton) {
-      cy.get(this.#nextPageBtn).first().click();
-    } else {
-      cy.get(this.#nextPageBtn).last().click();
-    }
-    return this;
-  }
-
-  clickPreviousPageButton(isUpperButton = true) {
-    if (isUpperButton) {
-      cy.get(this.#previousPageBtn).first().click();
-    } else {
-      cy.get(this.#previousPageBtn).last().click();
-    }
-    return this;
-  }
-
-  clickActionItem(actionItemName: string) {
-    cy.get(this.#actionToggleBtn).click();
-    cy.get(this.dropdownMenuItem).contains(actionItemName).click();
-    return this;
-  }
-
-  clickSearchButton() {
-    cy.get(this.#searchBtn).click({ force: true });
-    return this;
-  }
-
-  clickPrimaryButton(itemName?: string) {
-    if (itemName == undefined) {
-      cy.get(this.primaryBtn).click();
-    } else {
-      cy.get(this.primaryBtn).contains(itemName).click();
-    }
-    return this;
-  }
-
-  clickDropdownMenuItem(itemName: string) {
-    cy.get(this.dropdownMenuItem).contains(itemName).click();
-    return this;
-  }
-
-  searchItem(searchValue: string, wait = true) {
-    if (wait) {
-      const searchUrl = `/admin/realms/*/*${searchValue}*`;
-      cy.intercept(searchUrl).as("search");
-    }
-    cy.get(this.#searchInput).clear();
-    if (searchValue) {
-      cy.get(this.#searchInput).type(searchValue);
-      this.clickSearchButton();
-    } else {
-      // TODO: Remove else and move clickSearchButton outside of the if
-      cy.get(this.#searchInput).type("{enter}");
-    }
-    if (wait) {
-      cy.wait(["@search"]);
-    }
-    return this;
-  }
-
-  selectSearchType(existingName: Filter, itemName: Filter) {
-    cy.contains("button", existingName).click();
-    cy.get(this.dropdownMenuItem).contains(itemName).click();
-    return this;
-  }
-
-  selectSecondarySearchType(itemName: FilterAssignedType) {
-    cy.get(this.#searchTypeDropdownBtn).click();
-    cy.get(this.dropdownSelectToggleItem).contains(itemName).click();
-    return this;
-  }
-
-  changeTypeTo(itemName: FilterAssignedType) {
-    cy.get(this.#changeTypeBtn).click();
-    cy.get(this.dropdownSelectToggleItem).contains(itemName).click();
-    return this;
-  }
-
-  addClientScope() {
-    cy.get(this.primaryBtn).contains("Add client scope").click();
-    return this;
-  }
-
-  createClient() {
-    cy.get(this.primaryBtn).contains("Create client").click();
-    return this;
-  }
-
-  addMapper() {
-    cy.get(this.primaryBtn).contains("Add mapper").click();
-    return this;
-  }
-
-  checkActionItemIsEnabled(actionItemName: string, enabled: boolean) {
-    cy.get(this.#actionToggleBtn).click();
-    cy.get(this.dropdownMenuItem)
-      .contains(actionItemName)
-      .should((!enabled ? "not." : "") + "be.disabled");
-    cy.get(this.#actionToggleBtn).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialExportModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialExportModal.ts
deleted file mode 100644
index 01146aa5259c..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialExportModal.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-export default class PartialExportModal {
-  open() {
-    cy.findByTestId("openPartialExportModal").click();
-  }
-
-  exportButton() {
-    return cy.findByTestId("export-button");
-  }
-
-  cancelButton() {
-    return cy.findByTestId("cancel-button");
-  }
-
-  includeGroupsAndRolesSwitch() {
-    return cy.get("#include-groups-and-roles-check");
-  }
-
-  includeClientsSwitch() {
-    return cy.get("#include-clients-check");
-  }
-
-  warningMessage() {
-    return cy.findByTestId("warning-message");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialImportModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialImportModal.ts
deleted file mode 100644
index ffcc2bbec1b2..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/PartialImportModal.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-export default class GroupModal {
-  #openPartialImport = "openPartialImportModal";
-
-  open() {
-    cy.findByTestId(this.#openPartialImport).click();
-    return this;
-  }
-
-  typeResourceFile = (filename: string) => {
-    cy.get("#partial-import-file-filename").selectFile(
-      "cypress/fixtures/partial-import-test-data/" + filename,
-      { action: "drag-drop" },
-    );
-  };
-
-  textArea() {
-    return cy.get(".w-tc-editor-text");
-  }
-
-  importButton() {
-    return cy.findByTestId("import-button");
-  }
-
-  cancelButton() {
-    return cy.findByTestId("cancel-button");
-  }
-
-  clearButton() {
-    return cy.get("button").contains("Clear");
-  }
-
-  clickClearConfirmButton() {
-    cy.findByTestId("clear-button").click();
-  }
-
-  closeButton() {
-    return cy.findByTestId("close-button");
-  }
-
-  usersCheckbox() {
-    return cy.findByTestId("users-checkbox");
-  }
-
-  clientsCheckbox() {
-    return cy.findByTestId("clients-checkbox");
-  }
-
-  groupsCheckbox() {
-    return cy.findByTestId("groups-checkbox");
-  }
-
-  idpCheckbox() {
-    return cy.findByTestId("identityProviders-checkbox");
-  }
-
-  realmRolesCheckbox() {
-    return cy.findByTestId("realmRoles-checkbox");
-  }
-
-  clientRolesCheckbox() {
-    return cy.findByTestId("clientRoles-checkbox");
-  }
-
-  userCount() {
-    return this.usersCheckbox().get("label");
-  }
-
-  clientCount() {
-    return this.clientsCheckbox().get("label");
-  }
-
-  groupCount() {
-    return this.groupsCheckbox().get("label");
-  }
-
-  idpCount() {
-    return this.idpCheckbox().get("label");
-  }
-
-  realmRolesCount() {
-    return this.realmRolesCheckbox().get("label");
-  }
-
-  clientRolesCount() {
-    return this.clientRolesCheckbox().get("label");
-  }
-
-  realmSelector() {
-    return cy.get("#realm-selector");
-  }
-
-  selectRealm(realm: string) {
-    this.realmSelector().click();
-    cy.findByTestId(realm + "-select-option").click();
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/RealmSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/RealmSettings.ts
deleted file mode 100644
index 02aede458655..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/configure/realm_settings/RealmSettings.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-export default class RealmSettings {
-  #actionDropdown = "action-dropdown";
-
-  clickActionMenu() {
-    cy.findByTestId(this.#actionDropdown).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/AttributesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/AttributesTab.ts
deleted file mode 100644
index 65624b3744bc..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/AttributesTab.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-export default class AttributesTab {
-  #saveAttributeBtn = "attributes-save";
-  #attributesTab = "attributes";
-  #emptyState = "attributes-empty-state";
-  #addAttributeBtn: string;
-  #keyInput: string;
-  #valueInput: string;
-  #removeBtn: string;
-
-  constructor(isForUser = false) {
-    if (isForUser) {
-      this.#addAttributeBtn = "unmanagedAttributes-add-row";
-      this.#keyInput = "unmanagedAttributes-key";
-      this.#valueInput = "unmanagedAttributes-value";
-      this.#removeBtn = "unmanagedAttributes-remove";
-    } else {
-      this.#addAttributeBtn = "attributes-add-row";
-      this.#keyInput = "attributes-key";
-      this.#valueInput = "attributes-value";
-      this.#removeBtn = "attributes-remove";
-    }
-  }
-
-  public goToAttributesTab() {
-    cy.findByTestId(this.#attributesTab).click();
-
-    return this;
-  }
-
-  public addAttribute(key: string, value: string) {
-    this.addAnAttributeButton();
-
-    cy.findAllByTestId(this.#keyInput)
-      .its("length")
-      .then((length) => {
-        this.#keyInputAt(length - 1).type(key, { force: true });
-        this.#valueInputAt(length - 1).type(value, { force: true });
-      });
-
-    return this;
-  }
-
-  public checkAttribute(key: string, exist: boolean) {
-    cy.findByTestId(this.#keyInput).should((exist ? "" : "not.") + "exist");
-
-    if (exist) {
-      cy.findAllByTestId(this.#keyInput).invoke("val").should("eq", key);
-    }
-
-    return this;
-  }
-
-  public save() {
-    cy.findByTestId(this.#saveAttributeBtn).click();
-    return this;
-  }
-
-  public revert() {
-    cy.get(".pf-v5-c-button.pf-m-link").contains("Revert").click();
-    return this;
-  }
-
-  public deleteAttributeButton(row: number) {
-    this.#removeButtonAt(row).click({ force: true });
-    return this;
-  }
-
-  public addAnAttributeButton() {
-    cy.wait(1000);
-    cy.findByTestId(this.#addAttributeBtn).click();
-    return this;
-  }
-
-  public deleteAttribute(rowIndex: number) {
-    this.deleteAttributeButton(rowIndex);
-    this.save();
-
-    return this;
-  }
-
-  public assertEmpty() {
-    cy.findByTestId(this.#emptyState).should("exist");
-  }
-
-  public assertRowItemsEqualTo(amount: number) {
-    cy.findAllByTestId(this.#keyInput).its("length").should("be.eq", amount);
-    return this;
-  }
-
-  #keyInputAt(index: number) {
-    return cy.findAllByTestId(this.#keyInput).eq(index);
-  }
-
-  #valueInputAt(index: number) {
-    return cy.findAllByTestId(this.#valueInput).eq(index);
-  }
-
-  #removeButtonAt(index: number) {
-    return cy.findAllByTestId(this.#removeBtn).eq(index);
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/KeyValueInput.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/KeyValueInput.ts
deleted file mode 100644
index 4a0d15b9e21b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/KeyValueInput.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import type { KeyValueType } from "../../../../../src/components/key-value-form/key-value-convert";
-
-export default class KeyValueInput {
-  #name: string;
-
-  constructor(name: string) {
-    this.#name = name;
-  }
-
-  fillKeyValue({ key, value }: KeyValueType) {
-    cy.findByTestId(`${this.#name}-add-row`).click();
-
-    cy.findAllByTestId(`${this.#name}-key`)
-      .its("length")
-      .then((length) => {
-        this.keyInputAt(length - 1).type(key);
-        this.valueInputAt(length - 1).type(value);
-      });
-
-    return this;
-  }
-
-  deleteRow(index: number) {
-    cy.findAllByTestId(`${this.#name}-remove`).eq(index).click();
-    return this;
-  }
-
-  validateRows(numberOfRows: number) {
-    cy.findAllByTestId(`${this.#name}-key`).should("have.length", numberOfRows);
-    return this;
-  }
-
-  save() {
-    cy.findByTestId("attributes-save").click();
-    return this;
-  }
-
-  keyInputAt(index: number) {
-    return cy.findAllByTestId(`${this.#name}-key`).eq(index);
-  }
-
-  valueInputAt(index: number) {
-    return cy.findAllByTestId(`${this.#name}-value`).eq(index);
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/LegacyKeyValueInput.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/LegacyKeyValueInput.ts
deleted file mode 100644
index 80c500a184c8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/LegacyKeyValueInput.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import type { KeyValueType } from "../../../../../src/components/key-value-form/key-value-convert";
-
-export default class LegacyKeyValueInput {
-  #name: string;
-
-  constructor(name: string) {
-    this.#name = name;
-  }
-
-  fillKeyValue({ key, value }: KeyValueType, index = 0) {
-    cy.findByTestId(`${this.#name}.${index}.key`).clear();
-    cy.findByTestId(`${this.#name}.${index}.key`).type(key);
-    cy.findByTestId(`${this.#name}.${index}.value`).clear();
-    cy.findByTestId(`${this.#name}.${index}.value`).type(value);
-    cy.findByTestId(`${this.#name}-add-row`).click();
-    return this;
-  }
-
-  deleteRow(index: number) {
-    cy.findByTestId(`${this.#name}.${index}.remove`).click();
-    return this;
-  }
-
-  validateRows(numberOfRows: number) {
-    cy.findAllByTestId("row").should("have.length", numberOfRows);
-    return this;
-  }
-
-  save() {
-    cy.findByTestId("save-attributes").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/RoleMappingTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/RoleMappingTab.ts
deleted file mode 100644
index c7b4693291f8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/RoleMappingTab.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-const expect = chai.expect;
-export default class RoleMappingTab {
-  #type = "client";
-  #serviceAccountTab = "serviceAccountTab";
-  #scopeTab = "scopeTab";
-  #assignEmptyRoleBtn = (type: string) =>
-    `no-roles-for-this-${type}-empty-action`;
-  #assignRoleBtn = "assignRole";
-  #unAssignBtn = "unAssignRole";
-  #unAssignDrpDwnBtn = '.pf-v5-c-table__action li button[role="menuitem"]';
-  #assignBtn = "assign";
-  #hideInheritedRolesBtn = "#hideInheritedRoles";
-  #assignedRolesTable = "assigned-roles";
-  #namesColumn = "td:visible";
-  #roleMappingTab = "role-mapping-tab";
-  #filterTypeDropdown = "filter-type-dropdown";
-
-  constructor(type: string) {
-    this.#type = type;
-  }
-
-  goToServiceAccountTab() {
-    cy.findByTestId(this.#serviceAccountTab).click();
-    return this;
-  }
-
-  goToScopeTab() {
-    cy.findByTestId(this.#scopeTab).click();
-    return this;
-  }
-
-  assignRole(notEmpty = true) {
-    cy.findByTestId(
-      notEmpty ? this.#assignEmptyRoleBtn(this.#type) : this.#assignRoleBtn,
-    ).click();
-    return this;
-  }
-
-  assign() {
-    cy.findByTestId(this.#assignBtn).click();
-    return this;
-  }
-
-  unAssign() {
-    cy.findByTestId(this.#unAssignBtn).click();
-    return this;
-  }
-
-  unAssignFromDropdown() {
-    cy.get(this.#unAssignDrpDwnBtn).click();
-    return this;
-  }
-
-  hideInheritedRoles() {
-    cy.get(this.#hideInheritedRolesBtn).check();
-    return this;
-  }
-
-  unhideInheritedRoles() {
-    cy.get(this.#hideInheritedRolesBtn).uncheck({ force: true });
-    return this;
-  }
-
-  changeRoleTypeFilter(filter: string) {
-    // Invert the filter because the testid of the DropdownItem is the current filter
-    const option = filter == "roles" ? "clients" : "roles";
-
-    cy.findByTestId(this.#filterTypeDropdown).click();
-    cy.findByTestId(option).click();
-
-    cy.get('[role="progressbar"]').should("not.exist");
-
-    return this;
-  }
-
-  selectRow(name: string, modal = false) {
-    cy.get(modal ? ".pf-v5-c-modal-box " : "" + this.#namesColumn)
-      .contains(name)
-      .parents("tr")
-      .within(() => {
-        cy.get("input").click();
-      });
-    return this;
-  }
-
-  checkRoles(roleNames: string[], exist = true) {
-    if (roleNames.length) {
-      cy.findByTestId(this.#assignedRolesTable)
-        .get(this.#namesColumn)
-        .should((roles) => {
-          for (let index = 0; index < roleNames.length; index++) {
-            const roleName = roleNames[index];
-
-            if (exist) {
-              expect(roles).to.contain(roleName);
-            } else {
-              expect(roles).not.to.contain(roleName);
-            }
-          }
-        });
-    } else {
-      cy.findByTestId(this.#assignedRolesTable).should("not.exist");
-    }
-    return this;
-  }
-
-  goToRoleMappingTab() {
-    cy.findByTestId(this.#roleMappingTab).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/BindFlowModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/BindFlowModal.ts
deleted file mode 100644
index aa8a67a6b3b4..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/BindFlowModal.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import ModalUtils from "../../../../util/ModalUtils";
-
-export default class BindFlowModal extends ModalUtils {
-  #bindingType = "#chooseBindingType";
-  #dropdownSelectToggleItem = ".pf-v5-c-menu__list > li";
-
-  fill(bindingType: string) {
-    cy.get(this.#bindingType).click();
-    cy.get(this.#dropdownSelectToggleItem).contains(bindingType).click();
-    return this;
-  }
-
-  save() {
-    cy.findAllByTestId("save").click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/CIBAPolicyPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/CIBAPolicyPage.ts
deleted file mode 100644
index 2e24ed4b6ed6..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/CIBAPolicyPage.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import Masthead from "../../Masthead";
-
-const masthead = new Masthead();
-
-export default class CIBAPolicyPage {
-  static goToTab() {
-    cy.findByTestId("policies").click();
-    cy.findByTestId("tab-ciba-policy").click();
-    return this;
-  }
-
-  static getBackchannelTokenDeliveryModeSelect() {
-    return cy.get("#cibaBackchannelTokenDeliveryMode");
-  }
-
-  static getExpiresInput() {
-    return cy.findByTestId("attributes.cibaExpiresIn");
-  }
-
-  static getIntervalInput() {
-    return cy.findByTestId("attributes.cibaInterval");
-  }
-
-  static assertSaveSuccess() {
-    masthead.checkNotificationMessage("CIBA policy successfully updated");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/DuplicateFlowModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/DuplicateFlowModal.ts
deleted file mode 100644
index cdec8feca10b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/DuplicateFlowModal.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-export default class DuplicateFlowModal {
-  #nameInput = "alias";
-  #descriptionInput = "description";
-  #confirmButton = "confirm";
-  #errorText = ".pf-m-error";
-
-  fill(name?: string, description?: string) {
-    cy.findByTestId(this.#nameInput).clear();
-    if (name) {
-      cy.findByTestId(this.#nameInput).type(name);
-      if (description)
-        cy.findByTestId(this.#descriptionInput).type(description);
-    }
-
-    cy.findByTestId(this.#confirmButton).click();
-    return this;
-  }
-
-  shouldShowError(message: string) {
-    cy.get(this.#errorText).invoke("text").should("contain", message);
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDetail.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDetail.ts
deleted file mode 100644
index 39e4854048b4..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDetail.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-import Select from "../../../../forms/Select";
-
-type RequirementType = "Required" | "Alternative" | "Disabled" | "Conditional";
-
-export default class FlowDetails {
-  executionExists(name: string, exist = true) {
-    this.#getExecution(name).should((!exist ? "not." : "") + "exist");
-    return this;
-  }
-
-  flowExists(name: string) {
-    cy.findAllByText(name).should("exist");
-    return this;
-  }
-
-  #getExecution(name: string) {
-    return cy.findByTestId(name);
-  }
-
-  moveRowTo(from: string, to: string) {
-    cy.findAllByTestId(from).drag(to);
-
-    return this;
-  }
-
-  expectPriorityChange(execution: string, callback: () => void) {
-    cy.findAllByTestId(execution).then((rowDetails) => {
-      const executionId = rowDetails.children().attr("data-id");
-      cy.intercept(
-        "POST",
-        `/admin/realms/test*/authentication/executions/${executionId}/lower-priority`,
-      ).as("priority");
-      callback();
-      cy.wait("@priority");
-    });
-  }
-
-  changeRequirement(execution: string, requirement: RequirementType) {
-    this.#getExecution(execution)
-      .parentsUntil(".keycloak__authentication__flow-row")
-      .find(".keycloak__authentication__requirement-dropdown")
-      .click()
-      .parent()
-      .contains(requirement)
-      .click();
-    return this;
-  }
-
-  goToDiagram() {
-    cy.get("#diagramView").click();
-    return this;
-  }
-
-  #clickEditDropdownForFlow(subFlowName: string, option: string) {
-    cy.findByTestId(`${subFlowName}-edit-dropdown`)
-      .click()
-      .parent()
-      .contains(option)
-      .click();
-  }
-
-  addExecution(subFlowName: string, executionTestId: string) {
-    this.#clickEditDropdownForFlow(subFlowName, "Add step");
-
-    cy.get(".pf-v5-c-pagination").should("exist");
-    cy.findByTestId(executionTestId).click();
-    cy.findByTestId("modal-add").click();
-
-    return this;
-  }
-
-  addCondition(subFlowName: string, executionTestId: string) {
-    this.#clickEditDropdownForFlow(subFlowName, "Add condition");
-
-    cy.findByTestId(executionTestId).click();
-    cy.findByTestId("modal-add").click();
-
-    return this;
-  }
-
-  addSubFlow(subFlowName: string, name: string) {
-    this.#clickEditDropdownForFlow(subFlowName, "Add sub-flow");
-    this.#fillSubFlowModal(subFlowName, name);
-
-    return this;
-  }
-
-  clickRowDelete(name: string) {
-    cy.findByTestId(`${name}-delete`).click();
-
-    return this;
-  }
-
-  #fillSubFlowModal(subFlowName: string, name: string) {
-    cy.get(".pf-v5-c-modal-box__title-text").contains(
-      "Add step to " + subFlowName,
-    );
-    cy.findByTestId("name").type(name);
-    cy.findByTestId("modal-add").click();
-  }
-
-  fillCreateForm(
-    name: string,
-    description: string,
-    type: "Basic flow" | "Client flow",
-  ) {
-    cy.findByTestId("alias").type(name);
-    cy.findByTestId("description").type(description);
-    Select.selectItem(cy.get("#providerId"), type);
-    cy.findByTestId("create").click();
-    return this;
-  }
-
-  addSubFlowToEmpty(subFlowName: string, name: string) {
-    cy.findByTestId("addSubFlow").click();
-    this.#fillSubFlowModal(subFlowName, name);
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDiagram.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDiagram.ts
deleted file mode 100644
index 8530f80fed11..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/FlowDiagram.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-type Edge = { from: string; to: string };
-
-export default class FlowDiagram {
-  exists() {
-    cy.get(".react-flow").should("exist");
-  }
-
-  edgesExist(edges: Edge[]) {
-    edges.forEach((edge) => {
-      this.#labelToId(edge.from).then((fromId) => {
-        this.#labelToId(edge.to).then((toId) => {
-          const label = `Edge from ${fromId} to ${toId}`;
-          cy.get(`[aria-label="${label}"]`);
-        });
-      });
-    });
-    return this;
-  }
-
-  #labelToId(label: string) {
-    return cy.findByText(label).then((node) => {
-      const id = node.attr("data-id");
-      if (id) {
-        return cy.wrap(id);
-      }
-      // if data-id does not exist, we're looking at a subflow, which has the data-id
-      // on the grandparent
-      return cy
-        .wrap(node)
-        .parent()
-        .parent()
-        .then((n) => cy.wrap(n.attr("data-id")));
-    });
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/OTPPolicies.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/OTPPolicies.ts
deleted file mode 100644
index d85099a9a161..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/OTPPolicies.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-export default class OTPPolicies {
-  goToTab() {
-    cy.findAllByTestId("policies").click().get("#pf-tab-2-otpPolicy").click();
-    return this;
-  }
-
-  setPolicyType(type: string) {
-    cy.findByTestId(type).click();
-    return this;
-  }
-
-  increaseInitialCounter() {
-    cy.get('#otpPolicyInitialCounter [aria-label="Plus"]').click();
-    return this;
-  }
-
-  checkSupportedApplications(...supportedApplications: string[]) {
-    cy.findByTestId("supportedApplications")
-      .children()
-      .should("have.text", supportedApplications.join(""));
-    return this;
-  }
-
-  save() {
-    cy.findByTestId("save").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/PasswordPolicies.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/PasswordPolicies.ts
deleted file mode 100644
index 26094246d7b2..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/PasswordPolicies.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-export default class PasswordPolicies {
-  goToTab() {
-    cy.findAllByTestId("policies").click();
-    return this;
-  }
-
-  shouldShowEmptyState() {
-    cy.findByTestId("empty-state").should("exist");
-    return this;
-  }
-
-  addPolicy(name: string) {
-    cy.findByTestId("add-policy").click().parent().contains(name).click();
-    return this;
-  }
-
-  removePolicy(name: string) {
-    cy.findByTestId(name).click();
-    return this;
-  }
-
-  save() {
-    cy.findByTestId("save").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/RequiredActions.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/RequiredActions.ts
deleted file mode 100644
index e86da6366a52..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/RequiredActions.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-export default class RequiredActions {
-  #toId(name: string) {
-    return name.replace(/\s/g, "\\ ");
-  }
-
-  #toKey(name: string) {
-    return name.replace(/\s/g, "-");
-  }
-
-  #getEnabledSwitch(name: string) {
-    return `#enable-${this.#toKey(name)}`;
-  }
-  #getDefaultSwitch(name: string) {
-    return `#default-${this.#toKey(name)}`;
-  }
-
-  goToTab() {
-    cy.findByTestId("requiredActions").click();
-  }
-
-  switchAction(name: string) {
-    cy.get(this.#getEnabledSwitch(name)).scrollIntoView();
-    cy.get(this.#getEnabledSwitch(name)).click({ force: true });
-    return this;
-  }
-
-  isChecked(name: string) {
-    cy.get(this.#getEnabledSwitch(name)).should("be.checked");
-    return this;
-  }
-
-  isDefaultEnabled(name: string) {
-    cy.get(this.#getDefaultSwitch(name)).should("be.enabled");
-    return this;
-  }
-
-  setAsDefault(name: string) {
-    cy.get(this.#getDefaultSwitch(name)).click({ force: true });
-    return this;
-  }
-
-  isDefaultChecked(name: string) {
-    cy.get(this.#getEnabledSwitch(name)).should("be.checked");
-    return this;
-  }
-
-  moveRowTo(from: string, to: string) {
-    cy.get("#" + this.#toId(from)).drag("#" + this.#toId(to));
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/WebAuthnPolicies.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/WebAuthnPolicies.ts
deleted file mode 100644
index c334de25e506..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/authentication/WebAuthnPolicies.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-export default class WebAuthnPolicies {
-  webAuthnPolicyCreateTimeout(value: number) {
-    cy.findByTestId("webAuthnPolicyCreateTimeout").clear();
-    cy.findByTestId("webAuthnPolicyCreateTimeout").type(String(value));
-    return this;
-  }
-  goToTab() {
-    cy.findByTestId("policies").click();
-    cy.get("#pf-tab-3-webauthnPolicy").click();
-    return this;
-  }
-
-  goToPasswordlessTab() {
-    cy.findByTestId("policies").click();
-    cy.get("#pf-tab-4-webauthnPasswordlessPolicy").click();
-    return this;
-  }
-
-  fillSelects(data: Record<string, string>, isPasswordLess: boolean = false) {
-    for (const prop of Object.keys(data)) {
-      cy.get(
-        `#${
-          isPasswordLess ? prop.replace("Policy", "PolicyPasswordless") : prop
-        }`,
-      ).click();
-      cy.get(".pf-v5-c-menu__list").contains(data[prop]).click();
-    }
-    return this;
-  }
-
-  save() {
-    cy.findByTestId("save").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/CreateClientScopePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/CreateClientScopePage.ts
deleted file mode 100644
index 70fb92bdd60e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/CreateClientScopePage.ts
+++ /dev/null
@@ -1,115 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-export default class CreateClientScopePage extends CommonPage {
-  settingsTab: string;
-  mappersTab: string;
-  clientScopeNameInput: string;
-  clientScopeNameError: string;
-  clientScopeDescriptionInput: string;
-  clientScopeTypeDrpDwn: string;
-  clientScopeTypeList: string;
-  displayOnConsentInput: string;
-  displayOnConsentSwitch: string;
-  consentScreenTextInput: string;
-  includeInTokenSwitch: string;
-  displayOrderInput: string;
-  saveBtn: string;
-  cancelBtn: string;
-
-  constructor() {
-    super();
-    this.settingsTab = ".pf-v5-c-tabs__item:nth-child(1)";
-    this.mappersTab = ".pf-v5-c-tabs__item:nth-child(2)";
-
-    this.clientScopeNameInput = "name";
-    this.clientScopeNameError = "#name-helper";
-    this.clientScopeDescriptionInput = "description";
-    this.clientScopeTypeDrpDwn = "#kc-protocol";
-    this.clientScopeTypeList = "#kc-protocol + ul";
-    this.displayOnConsentInput = "attributes.display🍺on🍺consent🍺screen";
-    this.displayOnConsentSwitch =
-      '[for="attributes.display🍺on🍺consent🍺screen"] .pf-v5-c-switch__toggle';
-    this.consentScreenTextInput = "attributes.consent🍺screen🍺text";
-    this.includeInTokenSwitch = "#attributes.include🍺in🍺token🍺scope-on";
-    this.displayOrderInput = "attributes.gui🍺order";
-
-    this.saveBtn = '[type="submit"]';
-    this.cancelBtn = '[type="button"]';
-  }
-
-  //#region General Settings
-  fillClientScopeData(
-    name: string,
-    description = "",
-    consentScreenText = "",
-    displayOrder = "",
-  ) {
-    cy.findByTestId(this.clientScopeNameInput).clear();
-
-    if (name) {
-      cy.findByTestId(this.clientScopeNameInput).type(name);
-    }
-
-    if (description) {
-      cy.findByTestId(this.clientScopeDescriptionInput).type(description);
-    }
-
-    if (consentScreenText) {
-      cy.findByTestId(this.consentScreenTextInput).type(consentScreenText);
-    }
-
-    if (displayOrder) {
-      cy.findByTestId(this.displayOrderInput).type(displayOrder);
-    }
-
-    return this;
-  }
-
-  selectClientScopeType(clientScopeType: string) {
-    cy.get(this.clientScopeTypeDrpDwn).click();
-    cy.get(this.clientScopeTypeList).contains(clientScopeType).click();
-
-    return this;
-  }
-
-  getSwitchDisplayOnConsentScreenInput() {
-    return cy.findByTestId(this.displayOnConsentInput);
-  }
-
-  getConsentScreenTextInput() {
-    return cy.findByTestId(this.consentScreenTextInput);
-  }
-
-  switchDisplayOnConsentScreen() {
-    cy.get(this.displayOnConsentSwitch).click();
-
-    return this;
-  }
-
-  switchIncludeInTokenScope() {
-    cy.get(this.includeInTokenSwitch).click();
-
-    return this;
-  }
-  //#endregion
-
-  save() {
-    cy.get(this.saveBtn).click();
-
-    return this;
-  }
-
-  save_is_disabled(value: boolean) {
-    cy.get(this.saveBtn)
-      .invoke("attr", "aria-disabled")
-      .should("eq", value ? "true" : "false");
-
-    return this;
-  }
-
-  cancel() {
-    cy.get(this.cancelBtn).click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/ClientScopeDetailsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/ClientScopeDetailsPage.ts
deleted file mode 100644
index d543f2f6558b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/ClientScopeDetailsPage.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import SettingsTab from "./tabs/SettingsTab";
-import MappersTab from "./tabs/MappersTab";
-import ScopeTab from "./tabs/ScopeTab";
-
-export enum ClientScopeDetailsTab {
-  SettingsTab = "Settings",
-  MappersTab = "Mappers",
-  Scope = "Scope",
-}
-
-export default class ClientScopeDetailsPage extends CommonPage {
-  #settingsTab = new SettingsTab();
-  #scopesTab = new ScopeTab();
-  #mappersTab = new MappersTab();
-
-  goToSettingsTab() {
-    this.tabUtils().clickTab(ClientScopeDetailsTab.SettingsTab);
-    return this.#settingsTab;
-  }
-
-  goToMappersTab() {
-    this.tabUtils().clickTab(ClientScopeDetailsTab.MappersTab);
-    return this.#mappersTab;
-  }
-
-  goToScopesTab() {
-    this.tabUtils().clickTab(ClientScopeDetailsTab.Scope);
-    return this.#scopesTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/MappersTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/MappersTab.ts
deleted file mode 100644
index 055315ada28f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/MappersTab.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-
-export default class MappersTab extends CommonPage {
-  #addMapperBtn = "#mapperAction";
-  #fromPredefinedMappersBtn =
-    'ul[class="pf-v5-c-menu__list"] > li:nth-child(1) button';
-  #byConfigurationBtn =
-    'ul[class="pf-v5-c-menu__list"] > li:nth-child(2) button';
-  #mapperConfigurationList =
-    'ul[aria-label="Add predefined mappers"] > li:not([id=header])';
-
-  #mapperNameInput = "#name";
-
-  addPredefinedMappers(mappersNames: string[]) {
-    cy.get(this.#addMapperBtn).click();
-    cy.get(this.#fromPredefinedMappersBtn).click();
-
-    this.tableUtils().setTableInModal(true);
-    for (const mapperName of mappersNames) {
-      this.tableUtils().selectRowItemCheckbox(mapperName);
-    }
-    this.tableUtils().setTableInModal(false);
-
-    this.modalUtils().confirmModal();
-    this.masthead().checkNotificationMessage("Mapping successfully created");
-    this.sidebar().waitForPageLoad();
-    cy.contains(mappersNames[0]).should("exist");
-
-    for (const mapperName of mappersNames) {
-      this.tableUtils().checkRowItemExists(mapperName, true);
-    }
-
-    return this;
-  }
-
-  addMappersByConfiguration(predefinedMapperName: string, mapperName: string) {
-    cy.get(this.#addMapperBtn).click();
-    cy.get(this.#byConfigurationBtn).click();
-
-    cy.get(this.#mapperConfigurationList)
-      .contains(predefinedMapperName)
-      .click();
-
-    cy.get(this.#mapperNameInput).type(mapperName);
-
-    this.formUtils().save();
-    this.masthead().checkNotificationMessage("Mapping successfully created");
-
-    return this;
-  }
-
-  removeMappers(mappersNames: string[]) {
-    for (const mapperName of mappersNames) {
-      this.tableUtils().checkRowItemExists(mapperName);
-      this.tableUtils().selectRowItemAction(mapperName, "Delete");
-      this.sidebar().waitForPageLoad();
-      this.masthead().checkNotificationMessage("Mapping successfully deleted");
-      this.sidebar().waitForPageLoad();
-      this.tableUtils().checkRowItemExists(mapperName, false);
-    }
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/ScopeTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/ScopeTab.ts
deleted file mode 100644
index 550617ba5f7f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/ScopeTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-
-export default class ScopeTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/SettingsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/SettingsTab.ts
deleted file mode 100644
index 6e3827e0988a..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/SettingsTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import PageObject from "../../../../components/PageObject";
-
-export default class SettingsTab extends PageObject {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/mappers/MapperDetailsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/mappers/MapperDetailsPage.ts
deleted file mode 100644
index 6f4b42a2c251..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/client_scopes/client_scope_details/tabs/mappers/MapperDetailsPage.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export enum ClaimJsonType {
-  String = "String",
-  Long = "long",
-  Int = "int",
-  Boolean = "boolean",
-  Json = "JSON",
-}
-
-export default class MapperDetailsPage extends CommonPage {
-  #userAttributeInput = '[data-testid="config.user🍺attribute"]';
-  #tokenClaimNameInput = '[data-testid="claim.name"]';
-  #claimJsonType = '[id="jsonType.label"]';
-
-  fillUserAttribute(userAttribute: string) {
-    cy.get(this.#userAttributeInput).clear().type(userAttribute);
-
-    return this;
-  }
-
-  checkUserAttribute(userAttribute: string) {
-    cy.get(this.#userAttributeInput).should("have.value", userAttribute);
-
-    return this;
-  }
-
-  fillTokenClaimName(name: string) {
-    cy.get(this.#tokenClaimNameInput).clear().type(name);
-
-    return this;
-  }
-
-  checkTokenClaimName(name: string) {
-    cy.get(this.#tokenClaimNameInput).should("have.value", name);
-
-    return this;
-  }
-
-  changeClaimJsonType(type: string) {
-    cy.get(this.#claimJsonType).click();
-    cy.get(this.#claimJsonType).parent().contains(type).click();
-
-    return this;
-  }
-
-  checkClaimJsonType(type: string) {
-    cy.get(this.#claimJsonType).should("contain", type);
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRegistrationPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRegistrationPage.ts
deleted file mode 100644
index 62c1d5206319..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRegistrationPage.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-export class ClientRegistrationPage extends CommonPage {
-  goToClientRegistrationTab() {
-    this.tabUtils().clickTab("registration");
-    return this;
-  }
-
-  goToAuthenticatedSubTab() {
-    cy.findAllByTestId("authenticated").click();
-    return this;
-  }
-
-  createPolicy() {
-    cy.findAllByTestId("createPolicy").click({ force: true });
-    return this;
-  }
-
-  createAnonymousPolicy() {
-    cy.findByTestId("createPolicy-anonymous").click();
-    return this;
-  }
-
-  createAuthenticatedPolicy() {
-    cy.findByTestId("createPolicy-authenticated").click();
-    return this;
-  }
-
-  findAndSelectInAnonymousPoliciesTable(policy: string) {
-    cy.findByTestId("clientRegistration-anonymous")
-      .find("tr")
-      .contains(policy)
-      .click();
-  }
-
-  findAndSelectInAuthenticatedPoliciesTable(policy: string) {
-    cy.findByTestId("clientRegistration-authenticated")
-      .find("tr")
-      .contains(policy)
-      .click();
-  }
-
-  selectRow(name: string) {
-    cy.findAllByTestId(name).click();
-    return this;
-  }
-
-  fillPolicyForm(props: { name: string }) {
-    cy.findAllByTestId("name").type(props.name);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRolesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRolesTab.ts
deleted file mode 100644
index 5f07c6da5973..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientRolesTab.ts
+++ /dev/null
@@ -1,78 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-enum ClientRolesTabItems {
-  Details = "Details",
-  Attributes = "Attributes",
-  UsersInRole = "Users in role",
-  Permissions = "Permissions",
-}
-
-export default class ClientRolesTab extends CommonPage {
-  #createRoleBtn = "create-role";
-  #createRoleEmptyStateBtn = "no-roles-for-this-client-empty-action";
-  #hideInheritedRolesChkBox = "#hideInheritedRoles";
-  #rolesTab = "rolesTab";
-  #associatedRolesTab = "associatedRolesTab";
-  #defaultRolesTab = "default-roles-tab";
-  #defaultGroupsTab = "default-groups-tab";
-
-  goToDetailsTab() {
-    this.tabUtils().clickTab(ClientRolesTabItems.Details);
-    return this;
-  }
-
-  goToAttributesTab() {
-    this.tabUtils().clickTab(ClientRolesTabItems.Attributes);
-    return this;
-  }
-
-  goToUsersInRoleTab() {
-    this.tabUtils().clickTab(ClientRolesTabItems.UsersInRole);
-    return this;
-  }
-
-  goToPermissionsTab() {
-    this.tabUtils().clickTab(ClientRolesTabItems.Permissions);
-    return this;
-  }
-
-  goToRolesTab() {
-    cy.findByTestId(this.#rolesTab).click();
-    return this;
-  }
-
-  goToAssociatedRolesTab() {
-    cy.findByTestId(this.#associatedRolesTab).click();
-    return this;
-  }
-
-  goToCreateRoleFromToolbar() {
-    cy.findByTestId(this.#createRoleBtn).click();
-    return this;
-  }
-
-  goToCreateRoleFromEmptyState() {
-    cy.findByTestId(this.#createRoleEmptyStateBtn).click();
-    return this;
-  }
-
-  fillClientRoleData() {
-    cy.findByTestId(this.#createRoleBtn).click();
-    return this;
-  }
-
-  hideInheritedRoles() {
-    cy.get(this.#hideInheritedRolesChkBox).check();
-    return this;
-  }
-
-  goToDefaultRolesTab() {
-    cy.findByTestId(this.#defaultRolesTab).click();
-    return this;
-  }
-
-  goToDefaultGroupsTab() {
-    cy.findByTestId(this.#defaultGroupsTab).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientsPage.ts
deleted file mode 100644
index 8d98819e6fb3..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/ClientsPage.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import CommonPage from "../../../CommonPage";
-import ClientsListTab from "./tabs/ClientsListTab";
-import InitialAccessTokenTab from "./tabs/InitialAccessTokenTab";
-
-enum ClientsTab {
-  ClientsList = "Clients list",
-  InitialAccessToken = "Initial access token",
-}
-
-export default class ClientsPage extends CommonPage {
-  #clientsListTab = new ClientsListTab();
-  #initialAccessTokenTab = new InitialAccessTokenTab();
-
-  goToClientsListTab() {
-    this.tabUtils().clickTab(ClientsTab.ClientsList);
-    return this.#clientsListTab;
-  }
-
-  goToInitialAccessTokenTab() {
-    this.tabUtils().clickTab(ClientsTab.InitialAccessToken);
-    return this.#initialAccessTokenTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateClientPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateClientPage.ts
deleted file mode 100644
index 523753b7fbc6..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateClientPage.ts
+++ /dev/null
@@ -1,309 +0,0 @@
-import Select from "../../../../forms/Select";
-import CommonPage from "../../../CommonPage";
-
-export default class CreateClientPage extends CommonPage {
-  #clientTypeDrpDwn = "#protocol";
-  #clientIdInput = "#clientId";
-  #clientIdError = "#clientId + div";
-  #clientNameInput = "#name";
-  #clientDescriptionInput = "#kc-description";
-  #alwaysDisplayInUISwitch =
-    '[for="kc-always-display-in-ui-switch"] .pf-v5-c-switch__toggle';
-  #frontchannelLogoutSwitch =
-    '[for="kc-frontchannelLogout-switch"] .pf-v5-c-switch__toggle';
-
-  #clientAuthenticationSwitch =
-    '[for="kc-authentication-switch"] > .pf-v5-c-switch__toggle';
-  #clientAuthenticationSwitchInput = "#kc-authentication-switch";
-  #clientAuthorizationSwitch =
-    '[for="kc-authorization-switch"] > .pf-v5-c-switch__toggle';
-  #clientAuthorizationSwitchInput = "#kc-authorization-switch";
-  #standardFlowChkBx = "#kc-flow-standard";
-  #directAccessChkBx = "#kc-flow-direct";
-  #implicitFlowChkBx = "#kc-flow-implicit";
-  #oidcCibaGrantChkBx = "#kc-oidc-ciba-grant";
-  #deviceAuthGrantChkBx = "#kc-oauth-device-authorization-grant";
-  #serviceAccountRolesChkBx = "#kc-flow-service-account";
-
-  #rootUrlInput = "rootUrl";
-  #homeUrlInput = "baseUrl";
-  #firstValidRedirectUrlInput = "redirectUris0";
-  #firstWebOriginsInput = "webOrigins0";
-  #adminUrlInput = "adminUrl";
-
-  #loginThemeDrpDwn = "#login_theme";
-  #loginThemeList = 'ul[class="pf-v5-c-menu__list"]';
-  #consentRequiredSwitch = '[for="consentRequired"] .pf-v5-c-switch__toggle';
-  #consentRequiredSwitchInput = "#consentRequired";
-  #displayClientOnScreenSwitch =
-    '[for="attributes.display🍺on🍺consent🍺screen"].pf-v5-c-switch';
-  #displayClientOnScreenSwitchInput =
-    "#attributes\\.display🍺on🍺consent🍺screen";
-  #clientConsentScreenText = "attributes.consent🍺screen🍺text";
-
-  #frontChannelLogoutSwitch =
-    '[for="kc-frontchannelLogout-switch"] > .pf-v5-c-switch__toggle';
-  #frontChannelLogoutSwitchInput = "#kc-frontchannelLogout-switch";
-  #frontChannelLogoutInput = "frontchannelLogoutUrl";
-  #frontChannelLogoutSessionRequiredSwitchInput =
-    "#attributes\\.frontchannel🍺logout🍺session🍺required";
-  #backChannelLogoutInput = "backchannelLogoutUrl";
-  #backChannelLogoutSessionRequiredSwitchInput =
-    "#backchannelLogoutSessionRequired";
-  #backChannelLogoutRevoqueSwitch =
-    '.pf-v5-c-form__group-control [for="backchannelLogoutRevokeOfflineSessions"] > .pf-v5-c-switch__toggle';
-  #backChannelLogoutRevoqueSwitchInput =
-    "#backchannelLogoutRevokeOfflineSessions";
-
-  #actionDrpDwn = "action-dropdown";
-  #deleteClientBtn = "delete-client";
-
-  #saveBtn = "Save";
-  #continueBtn = "Next";
-  #backBtn = "Back";
-  #cancelBtn = "Cancel";
-
-  //#region General Settings
-  selectClientType(clientType: string) {
-    Select.selectItem(cy.get(this.#clientTypeDrpDwn), clientType);
-
-    return this;
-  }
-
-  fillClientData(
-    id: string,
-    name = "",
-    description = "",
-    alwaysDisplay?: boolean,
-    frontchannelLogout?: boolean,
-  ) {
-    cy.get(this.#clientIdInput).clear();
-
-    if (id) {
-      cy.get(this.#clientIdInput).type(id);
-    }
-
-    if (name) {
-      cy.get(this.#clientNameInput).type(name);
-    }
-
-    if (description) {
-      cy.get(this.#clientDescriptionInput).type(description);
-    }
-
-    if (alwaysDisplay) {
-      cy.get(this.#alwaysDisplayInUISwitch).click();
-    }
-
-    if (frontchannelLogout) {
-      cy.get(this.#frontchannelLogoutSwitch).click();
-    }
-
-    return this;
-  }
-
-  changeSwitches(switches: string[]) {
-    for (const uiSwitch of switches) {
-      cy.findByTestId(uiSwitch).check({ force: true });
-    }
-    return this;
-  }
-
-  checkClientIdRequiredMessage() {
-    cy.get(this.#clientIdInput)
-      .parent()
-      .should("have.class", "pf-v5-c-form-control pf-m-error");
-
-    return this;
-  }
-
-  checkGeneralSettingsStepActive() {
-    cy.get(".pf-v5-c-wizard__nav-link")
-      .contains("General settings")
-      .should("have.class", "pf-m-current");
-
-    return this;
-  }
-  //#endregion
-
-  //#region Capability config
-  switchClientAuthentication() {
-    cy.get(this.#clientAuthenticationSwitch).click();
-
-    return this;
-  }
-
-  switchClientAuthorization() {
-    cy.get(this.#clientAuthorizationSwitch).click();
-
-    return this;
-  }
-
-  clickStandardFlow() {
-    cy.get(this.#standardFlowChkBx).click();
-
-    return this;
-  }
-
-  clickDirectAccess() {
-    cy.get(this.#directAccessChkBx).click();
-
-    return this;
-  }
-
-  clickImplicitFlow() {
-    cy.get(this.#implicitFlowChkBx).click();
-
-    return this;
-  }
-
-  clickServiceAccountRoles() {
-    cy.get(this.#serviceAccountRolesChkBx).click();
-
-    return this;
-  }
-
-  clickOAuthDeviceAuthorizationGrant() {
-    cy.get(this.#deviceAuthGrantChkBx).click();
-
-    return this;
-  }
-
-  clickOidcCibaGrant() {
-    cy.get(this.#oidcCibaGrantChkBx).click();
-
-    return this;
-  }
-  //#endregion
-
-  save() {
-    cy.contains("button", this.#saveBtn).click();
-
-    return this;
-  }
-
-  continue() {
-    cy.contains("button", this.#continueBtn).click();
-
-    return this;
-  }
-
-  back() {
-    cy.contains("button", this.#backBtn).click();
-
-    return this;
-  }
-
-  cancel() {
-    cy.contains("button", this.#cancelBtn).click();
-
-    return this;
-  }
-
-  checkCapabilityConfigElements() {
-    cy.get(this.#oidcCibaGrantChkBx).scrollIntoView();
-
-    cy.get(this.#clientAuthenticationSwitchInput).should("not.be.disabled");
-    cy.get(this.#clientAuthorizationSwitchInput).should("be.disabled");
-
-    cy.get(this.#standardFlowChkBx).should("not.be.disabled");
-    cy.get(this.#directAccessChkBx).should("not.be.disabled");
-    cy.get(this.#implicitFlowChkBx).should("not.be.disabled");
-    cy.get(this.#serviceAccountRolesChkBx).should("be.disabled");
-    cy.get(this.#deviceAuthGrantChkBx).should("not.be.disabled");
-    cy.get(this.#oidcCibaGrantChkBx).should("be.disabled");
-
-    cy.get(this.#clientAuthenticationSwitch).click();
-    cy.get(this.#clientAuthorizationSwitchInput).should("not.be.disabled");
-    cy.get(this.#serviceAccountRolesChkBx).should("not.be.disabled");
-    cy.get(this.#oidcCibaGrantChkBx).should("not.be.disabled");
-
-    cy.get(this.#clientAuthorizationSwitch).click();
-    cy.get(this.#serviceAccountRolesChkBx).should("be.disabled");
-    cy.get(this.#oidcCibaGrantChkBx).should("not.be.disabled");
-
-    cy.get(this.#clientAuthorizationSwitch).click();
-    cy.get(this.#serviceAccountRolesChkBx).should("not.be.disabled");
-
-    cy.get(this.#clientAuthenticationSwitch).click();
-    cy.get(this.#serviceAccountRolesChkBx).should("be.disabled");
-    cy.get(this.#oidcCibaGrantChkBx).should("be.disabled");
-
-    return this;
-  }
-
-  checkAccessSettingsElements() {
-    cy.findByTestId(this.#adminUrlInput).scrollIntoView();
-    cy.findByTestId(this.#rootUrlInput).should("not.be.disabled");
-    cy.findByTestId(this.#homeUrlInput).should("not.be.disabled");
-    cy.findByTestId(this.#firstValidRedirectUrlInput).should("not.be.disabled");
-    cy.findByTestId(this.#firstWebOriginsInput).should("not.be.disabled");
-    cy.findByTestId(this.#adminUrlInput).should("not.be.disabled");
-
-    return this;
-  }
-
-  checkLoginSettingsElements() {
-    cy.findByTestId(this.#clientConsentScreenText).scrollIntoView();
-    cy.get(this.#loginThemeDrpDwn).should("not.be.disabled");
-    cy.get(this.#consentRequiredSwitchInput).should("not.be.disabled");
-    cy.get(this.#displayClientOnScreenSwitchInput).should("be.disabled");
-    cy.findByTestId(this.#clientConsentScreenText).should("be.disabled");
-
-    cy.get(this.#loginThemeDrpDwn).click();
-    cy.get(this.#loginThemeList).findByText("base").should("exist");
-    cy.get(this.#loginThemeList).findByText("keycloak").should("exist");
-    cy.get(this.#loginThemeDrpDwn).click();
-
-    cy.get(this.#consentRequiredSwitch).click();
-    cy.get(this.#displayClientOnScreenSwitchInput).should("not.be.disabled");
-    cy.findByTestId(this.#clientConsentScreenText).should("be.disabled");
-
-    cy.get(this.#displayClientOnScreenSwitch).click();
-    cy.findByTestId(this.#clientConsentScreenText).should("not.be.disabled");
-
-    cy.get(this.#displayClientOnScreenSwitch).click();
-    cy.findByTestId(this.#clientConsentScreenText).should("be.disabled");
-    cy.get(this.#consentRequiredSwitch).click();
-    cy.get(this.#displayClientOnScreenSwitchInput).should("be.disabled");
-
-    return this;
-  }
-
-  checkLogoutSettingsElements() {
-    cy.get(this.#frontChannelLogoutSessionRequiredSwitchInput).scrollIntoView();
-    cy.get(this.#frontChannelLogoutSwitchInput).should("not.be.disabled");
-    cy.findByTestId(this.#frontChannelLogoutInput).should("not.be.disabled");
-    cy.get(this.#frontChannelLogoutSessionRequiredSwitchInput).should(
-      "not.be.disabled",
-    );
-    cy.findByTestId(this.#backChannelLogoutInput).should("not.exist");
-    cy.get(this.#backChannelLogoutSessionRequiredSwitchInput).should(
-      "not.exist",
-    );
-    cy.get(this.#backChannelLogoutRevoqueSwitchInput).should("not.exist");
-
-    cy.get(this.#frontChannelLogoutSwitch).click();
-    cy.findByTestId(this.#frontChannelLogoutInput).should("not.exist");
-    cy.get(this.#frontChannelLogoutSessionRequiredSwitchInput).should(
-      "not.exist",
-    );
-    cy.findByTestId(this.#backChannelLogoutInput).should("not.be.disabled");
-    cy.get(this.#backChannelLogoutSessionRequiredSwitchInput).should(
-      "not.be.disabled",
-    );
-    cy.get(this.#backChannelLogoutRevoqueSwitchInput).should("not.be.disabled");
-
-    cy.get(this.#frontChannelLogoutSwitch).click();
-    cy.findByTestId(this.#frontChannelLogoutInput).should("not.be.disabled");
-
-    return this;
-  }
-
-  deleteClientFromActionDropdown() {
-    cy.findAllByTestId(this.#actionDrpDwn).click();
-    cy.findAllByTestId(this.#deleteClientBtn).click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateInitialAccessTokenPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateInitialAccessTokenPage.ts
deleted file mode 100644
index a45479ff8a50..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/CreateInitialAccessTokenPage.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-export default class CreateInitialAccessTokenPage extends CommonPage {
-  #expirationInput = "expiration";
-  #countInput = "count";
-  #countPlusBtn = '[data-testid="count"] [aria-label="Plus"]';
-
-  fillNewTokenData(expiration: number, count: number) {
-    cy.findByTestId(this.#expirationInput).clear().type(expiration.toString());
-    cy.findByTestId(this.#countInput).clear();
-
-    for (let i = 0; i < count; i++) {
-      cy.get(this.#countPlusBtn).click();
-    }
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage.ts
deleted file mode 100644
index 20b38dd73c10..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/ClientDetailsPage.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import AdvancedTab from "./tabs/AdvancedTab";
-import AuthorizationTab from "./tabs/AuthorizationTab";
-import ClientScopesTab from "./tabs/ClientScopesTab";
-import CredentialsTab from "./tabs/CredentialsTab";
-import KeysTab from "./tabs/KeysTab";
-import RolesTab from "./tabs/RolesTab";
-import SettingsTab from "./tabs/SettingsTab";
-
-export enum ClientsDetailsTab {
-  Settings = "Settings",
-  Keys = "Keys",
-  Credentials = "Credentials",
-  Roles = "Roles",
-  Sessions = "Sessions",
-  Permissions = "Permissions",
-  ClientScopes = "Client scopes",
-  Authorization = "Authorization",
-  ServiceAccountsRoles = "Service accounts roles",
-  Advanced = "Advanced",
-  Scope = "Scope",
-  UserEvents = "Events",
-}
-
-export default class ClientDetailsPage extends CommonPage {
-  #settingsTab = new SettingsTab();
-  #keysTab = new KeysTab();
-  #credentialsTab = new CredentialsTab();
-  #rolesTab = new RolesTab();
-  #clientScopesTab = new ClientScopesTab();
-  #authorizationTab = new AuthorizationTab();
-  #advancedTab = new AdvancedTab();
-  #clientScopesSetupTab = "clientScopesSetupTab";
-  #clientScopesEvaluateTab = "clientScopesEvaluateTab";
-  #evaluateEffectiveProtocolMappersTab = "effective-protocol-mappers-tab";
-  #evaluateEffectiveRoleScopeMappingsTab = "effective-role-scope-mappings-tab";
-  #evaluateGeneratedAccessTokenTab = "generated-access-token-tab";
-  #evaluateGeneratedIdTokenTab = "generated-id-token-tab";
-  #evaluateGeneratedUserInfoTab = "generated-user-info-tab";
-
-  goToSettingsTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Settings);
-    return this.#settingsTab;
-  }
-
-  goToKeysTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Keys);
-    return this.#keysTab;
-  }
-
-  goToCredentials() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Credentials);
-    return this.#credentialsTab;
-  }
-
-  goToRolesTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Roles);
-    return this.#rolesTab;
-  }
-
-  goToClientScopesTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.ClientScopes);
-    return this.#clientScopesTab;
-  }
-
-  goToAuthorizationTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Authorization);
-    return this.#authorizationTab;
-  }
-
-  goToAdvancedTab() {
-    this.tabUtils().clickTab(ClientsDetailsTab.Advanced);
-    return this.#advancedTab;
-  }
-
-  goToClientScopesSetupTab() {
-    cy.findByTestId(this.#clientScopesSetupTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateTab() {
-    this.goToClientScopesTab();
-    cy.findByTestId(this.#clientScopesEvaluateTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateEffectiveProtocolMappersTab() {
-    cy.findByTestId(this.#evaluateEffectiveProtocolMappersTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateEffectiveRoleScopeMappingsTab() {
-    cy.findByTestId(this.#evaluateEffectiveRoleScopeMappingsTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateGeneratedAccessTokenTab() {
-    cy.findByTestId(this.#evaluateGeneratedAccessTokenTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateGeneratedIdTokenTab() {
-    cy.findByTestId(this.#evaluateGeneratedIdTokenTab).click();
-    return this;
-  }
-
-  goToClientScopesEvaluateGeneratedUserInfoTab() {
-    cy.findByTestId(this.#evaluateGeneratedUserInfoTab).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateAuthorizationScopePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateAuthorizationScopePage.ts
deleted file mode 100644
index acffbf8b410f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateAuthorizationScopePage.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import type ScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/scopeRepresentation";
-
-export default class CreateAuthorizationScopePage extends CommonPage {
-  fillScopeForm(scope: ScopeRepresentation) {
-    Object.entries(scope).map(([key, value]) => cy.get(`#${key}`).type(value));
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreatePermissionPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreatePermissionPage.ts
deleted file mode 100644
index 7a5949208939..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreatePermissionPage.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import type PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
-
-export default class CreatePermissionPage extends CommonPage {
-  fillPermissionForm(permission: PolicyRepresentation) {
-    Object.entries(permission).map(([key, value]) =>
-      cy.get(`#${key}`).type(value),
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateResourcePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateResourcePage.ts
deleted file mode 100644
index f00d0420c5e6..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/CreateResourcePage.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import type ResourceRepresentation from "@keycloak/keycloak-admin-client/lib/defs/resourceRepresentation";
-
-export default class CreateResourcePage extends CommonPage {
-  fillResourceForm(resource: ResourceRepresentation) {
-    Object.entries(resource).map(([key, value]) => {
-      if (Array.isArray(value)) {
-        for (let index = 0; index < value.length; index++) {
-          const v = value[index];
-          cy.findByTestId(`${key}${index}`).type(v);
-          cy.findByTestId("addValue").click();
-        }
-      } else {
-        cy.get(`#${key}`).type(value);
-      }
-    });
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesMappersTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesMappersTab.ts
deleted file mode 100644
index f7aa7300a76e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesMappersTab.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-
-enum mapperType {
-  FromPredefinedMappers = "From predefined mappers",
-  ByConfiguration = "By configuration",
-}
-
-export default class DedicatedScopesMappersTab extends CommonPage {
-  #addPredefinedMapperEmptyStateBtn = "add-predefined-mapper-empty-action";
-  #configureNewMapperEmptyStateBtn = "configure-a-new-mapper-empty-action";
-
-  addMapperFromPredefinedMappers() {
-    this.emptyState().checkIfExists(false);
-    this.tableToolbarUtils()
-      .addMapper()
-      .clickDropdownMenuItem(mapperType.ByConfiguration);
-    return this;
-  }
-
-  addMapperByConfiguration() {
-    this.emptyState().checkIfExists(false);
-    this.tableToolbarUtils()
-      .addMapper()
-      .clickDropdownMenuItem(mapperType.FromPredefinedMappers);
-    return this;
-  }
-
-  addPredefinedMapper() {
-    this.emptyState().checkIfExists(true);
-    cy.findByTestId(this.#addPredefinedMapperEmptyStateBtn).click();
-    return this;
-  }
-
-  configureNewMapper() {
-    this.emptyState().checkIfExists(true);
-    cy.findByTestId(this.#configureNewMapperEmptyStateBtn).click({
-      force: true,
-    });
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesPage.ts
deleted file mode 100644
index 4ff94c630855..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesPage.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import DedicatedScopesMappersTab from "./DedicatedScopesMappersTab";
-import DedicatedScopesScopeTab from "./DedicatedScopesScopeTab";
-
-export enum DedicatedScopesTab {
-  Mappers = "Mappers",
-  Scope = "Scope",
-}
-
-export default class DedicatedScopesPage extends CommonPage {
-  #mappersTab = new DedicatedScopesMappersTab();
-  #scopeTab = new DedicatedScopesScopeTab();
-
-  goToMappersTab() {
-    this.tabUtils().clickTab(DedicatedScopesTab.Mappers);
-    return this.#mappersTab;
-  }
-
-  goToScopeTab() {
-    this.tabUtils().clickTab(DedicatedScopesTab.Scope);
-    return this.#scopeTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesScopeTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesScopeTab.ts
deleted file mode 100644
index c7a145d7e11a..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/DedicatedScopesScopeTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-
-export default class DedicatedScopesScopeTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedSamlTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedSamlTab.ts
deleted file mode 100644
index e52a16412718..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedSamlTab.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import PageObject from "../../../../components/PageObject";
-
-export class AdvancedSamlTab extends PageObject {
-  #termsOfServiceUrlId = "attributes.tosUri";
-
-  saveFineGrain() {
-    cy.findAllByTestId("fineGrainSave").click();
-  }
-
-  revertFineGrain() {
-    cy.findByTestId("fineGrainRevert").click();
-  }
-
-  termsOfServiceUrl(termsOfServiceUrl: string) {
-    cy.findAllByTestId(this.#termsOfServiceUrlId).clear();
-    cy.findAllByTestId(this.#termsOfServiceUrlId).type(termsOfServiceUrl);
-    return this;
-  }
-
-  checkTermsOfServiceUrl(termsOfServiceUrl: string) {
-    cy.findAllByTestId(this.#termsOfServiceUrlId).should(
-      "have.value",
-      termsOfServiceUrl,
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedTab.ts
deleted file mode 100644
index cb361de9e355..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AdvancedTab.ts
+++ /dev/null
@@ -1,250 +0,0 @@
-import PageObject from "../../../../components/PageObject";
-
-export default class AdvancedTab extends PageObject {
-  #clusterNodesExpandBtn =
-    ".pf-v5-c-expandable-section .pf-v5-c-expandable-section__toggle";
-  #testClusterAvailability = "#testClusterAvailability";
-  #emptyClusterElement = "empty-state";
-  #registerNodeManuallyBtn = "no-nodes-registered-empty-action";
-  #deleteClusterNodeDrpDwn =
-    '[aria-label="Registered cluster nodes"] [aria-label="Kebab toggle"]';
-  #deleteClusterNodeBtn =
-    '[aria-label="Registered cluster nodes"] [role="menu"] [type="button"]';
-  #nodeHostInput = "node";
-  #addNodeConfirmBtn = "#add-node-confirm";
-
-  #accessTokenSignatureAlgorithmInput = "#access🍺token🍺signed🍺response🍺alg";
-  #fineGrainSaveBtn = "#fineGrainSave";
-  #fineGrainRevertBtn = "#fineGrainRevert";
-  #OIDCCompatabilitySaveBtn = "OIDCCompatabilitySave";
-  #OIDCCompatabilityRevertBtn = "OIDCCompatabilityRevert";
-  #OIDCAdvancedSaveBtn = "OIDCAdvancedSave";
-  #OIDCAdvancedRevertBtn = "OIDCAdvancedRevert";
-  #OIDCAuthFlowOverrideSaveBtn = "OIDCAuthFlowOverrideSave";
-  #OIDCAuthFlowOverrideRevertBtn = "OIDCAuthFlowOverrideRevert";
-
-  #excludeSessionStateSwitch =
-    "#excludeSessionStateFromAuthenticationResponse-switch";
-  #useRefreshTokenSwitch = "#useRefreshTokens";
-  #useRefreshTokenForClientCredentialsGrantSwitch =
-    "#useRefreshTokenForClientCredentialsGrant";
-  #useLowerCaseBearerTypeSwitch = "#useLowerCaseBearerType";
-
-  #oAuthMutualSwitch =
-    "attributes.tls🍺client🍺certificate🍺bound🍺access🍺tokens";
-  #keyForCodeExchangeInput = "#keyForCodeExchange";
-  #pushedAuthorizationRequestRequiredSwitch =
-    "attributes.require🍺pushed🍺authorization🍺requests";
-
-  #browserFlowInput = "#browser";
-  #directGrantInput = "#direct_grant";
-
-  #jumpToOIDCCompatabilitySettings =
-    "jump-link-openid-connect-compatibility-modes";
-  #jumpToAdvancedSettings = "jump-link-advanced-settings";
-  #jumpToAuthFlowOverride = "jump-link-authentication-flow-overrides";
-
-  expandClusterNode() {
-    cy.get(this.#clusterNodesExpandBtn).click();
-    return this;
-  }
-
-  checkTestClusterAvailability(active: boolean) {
-    cy.get(this.#testClusterAvailability).should(
-      (active ? "not." : "") + "have.class",
-      "pf-m-disabled",
-    );
-    return this;
-  }
-
-  checkEmptyClusterNode() {
-    cy.findByTestId(this.#emptyClusterElement).should("exist");
-    return this;
-  }
-
-  registerNodeManually() {
-    cy.findByTestId(this.#registerNodeManuallyBtn).click();
-    return this;
-  }
-
-  deleteClusterNode() {
-    cy.get(this.#deleteClusterNodeDrpDwn).click();
-    cy.get(this.#deleteClusterNodeBtn).click();
-    return this;
-  }
-
-  fillHost(host: string) {
-    cy.findByTestId(this.#nodeHostInput).type(host);
-    return this;
-  }
-
-  saveHost() {
-    cy.get(this.#addNodeConfirmBtn).click();
-    return this;
-  }
-
-  selectAccessTokenSignatureAlgorithm(algorithm: string) {
-    cy.get(this.#accessTokenSignatureAlgorithmInput).click();
-    cy.get(".pf-v5-c-menu__list").contains(algorithm).click();
-
-    return this;
-  }
-
-  checkAccessTokenSignatureAlgorithm(algorithm: string) {
-    cy.get(this.#accessTokenSignatureAlgorithmInput).should(
-      "have.text",
-      algorithm,
-    );
-    return this;
-  }
-
-  saveFineGrain() {
-    cy.get(this.#fineGrainSaveBtn).click();
-    return this;
-  }
-
-  revertFineGrain() {
-    cy.get(this.#fineGrainRevertBtn).click();
-    return this;
-  }
-
-  saveCompatibility() {
-    cy.findByTestId(this.#OIDCCompatabilitySaveBtn).click();
-    return this;
-  }
-
-  revertCompatibility() {
-    cy.findByTestId(this.#OIDCCompatabilityRevertBtn).click();
-    cy.findByTestId(this.#jumpToOIDCCompatabilitySettings).click();
-    //uncomment when revert function reverts all switches, rather than just the first one
-    //this.assertSwitchStateOn(cy.get(this.useRefreshTokenForClientCredentialsGrantSwitch));
-    this.assertSwitchStateOn(cy.get(this.#excludeSessionStateSwitch));
-    return this;
-  }
-
-  jumpToCompatability() {
-    cy.findByTestId(this.#jumpToOIDCCompatabilitySettings).click();
-    return this;
-  }
-
-  clickAllCompatibilitySwitch() {
-    cy.get(this.#excludeSessionStateSwitch).parent().click();
-    this.assertSwitchStateOn(cy.get(this.#excludeSessionStateSwitch));
-    cy.get(this.#useRefreshTokenSwitch).parent().click();
-    this.assertSwitchStateOff(cy.get(this.#useRefreshTokenSwitch));
-    cy.get(this.#useRefreshTokenForClientCredentialsGrantSwitch)
-      .parent()
-      .click();
-    this.assertSwitchStateOn(
-      cy.get(this.#useRefreshTokenForClientCredentialsGrantSwitch),
-    );
-    cy.get(this.#useLowerCaseBearerTypeSwitch).parent().click();
-    this.assertSwitchStateOn(cy.get(this.#useLowerCaseBearerTypeSwitch));
-    return this;
-  }
-
-  clickExcludeSessionStateSwitch() {
-    cy.get(this.#excludeSessionStateSwitch).parent().click();
-    this.assertSwitchStateOff(cy.get(this.#excludeSessionStateSwitch));
-  }
-  clickUseRefreshTokenForClientCredentialsGrantSwitch() {
-    cy.get(this.#useRefreshTokenForClientCredentialsGrantSwitch)
-      .parent()
-      .click();
-    this.assertSwitchStateOff(
-      cy.get(this.#useRefreshTokenForClientCredentialsGrantSwitch),
-    );
-  }
-
-  saveAdvanced() {
-    cy.findByTestId(this.#OIDCAdvancedSaveBtn).click();
-    return this;
-  }
-
-  revertAdvanced() {
-    cy.findByTestId(this.#OIDCAdvancedRevertBtn).click();
-    return this;
-  }
-
-  jumpToAdvanced() {
-    cy.findByTestId(this.#jumpToAdvancedSettings).click();
-    return this;
-  }
-
-  clickAdvancedSwitches() {
-    cy.findByTestId(this.#oAuthMutualSwitch).parent().click();
-    cy.findByTestId(this.#pushedAuthorizationRequestRequiredSwitch)
-      .parent()
-      .click();
-    return this;
-  }
-
-  checkAdvancedSwitchesOn() {
-    cy.findByTestId(this.#oAuthMutualSwitch).scrollIntoView();
-    this.assertSwitchStateOn(cy.findByTestId(this.#oAuthMutualSwitch));
-    this.assertSwitchStateOn(
-      cy.findByTestId(this.#pushedAuthorizationRequestRequiredSwitch),
-    );
-    return this;
-  }
-
-  checkAdvancedSwitchesOff() {
-    this.assertSwitchStateOff(cy.findByTestId(this.#oAuthMutualSwitch));
-    this.assertSwitchStateOff(
-      cy.findByTestId(this.#pushedAuthorizationRequestRequiredSwitch),
-    );
-    return this;
-  }
-
-  selectKeyForCodeExchangeInput(input: string) {
-    cy.get(this.#keyForCodeExchangeInput).click();
-    cy.get(this.#keyForCodeExchangeInput)
-      .parent()
-      .get("ul")
-      .contains(input)
-      .click();
-    return this;
-  }
-
-  checkKeyForCodeExchangeInput(input: string) {
-    cy.get(this.#keyForCodeExchangeInput).should("have.text", input);
-    return this;
-  }
-
-  saveAuthFlowOverride() {
-    cy.findByTestId(this.#OIDCAuthFlowOverrideSaveBtn).click();
-    return this;
-  }
-
-  revertAuthFlowOverride() {
-    cy.findByTestId(this.#OIDCAuthFlowOverrideRevertBtn).click();
-    return this;
-  }
-
-  jumpToAuthFlow() {
-    cy.findByTestId(this.#jumpToAuthFlowOverride).click();
-    return this;
-  }
-
-  selectBrowserFlowInput(input: string) {
-    cy.get(this.#browserFlowInput).click();
-    cy.get(this.#browserFlowInput).parent().get("ul").contains(input).click();
-    return this;
-  }
-
-  selectDirectGrantInput(input: string) {
-    cy.get(this.#directGrantInput).click();
-    cy.get(this.#directGrantInput).parent().get("ul").contains(input).click();
-    return this;
-  }
-
-  checkBrowserFlowInput(input: string) {
-    cy.get(this.#browserFlowInput).should("have.text", input);
-    return this;
-  }
-
-  checkDirectGrantInput(input: string) {
-    cy.get(this.#directGrantInput).should("have.text", input);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AuthorizationTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AuthorizationTab.ts
deleted file mode 100644
index 700f14f3c8e8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/AuthorizationTab.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-import SettingsTab from "./authorization_subtabs/SettingsTab";
-import ResourcesTab from "./authorization_subtabs/ResourcesTab";
-import ScopesTab from "./authorization_subtabs/ScopesTab";
-import PoliciesTab from "./authorization_subtabs/PoliciesTab";
-import PermissionsTab from "./authorization_subtabs/PermissionsTab";
-import EvaluateTab from "./authorization_subtabs/EvaluateTab";
-import ExportTab from "./authorization_subtabs/ExportTab";
-
-enum AuthorizationSubTab {
-  Settings = "Settings",
-  Resources = "Resources",
-  Scopes = "Scopes",
-  Policies = "Policies",
-  Permissions = "Permissions",
-  Evaluate = "Evaluate",
-  Export = "Export",
-}
-
-export default class AuthorizationTab extends CommonPage {
-  #settingsSubTab = new SettingsTab();
-  #resourcesSubTab = new ResourcesTab();
-  #scopesSubTab = new ScopesTab();
-  #policiesSubTab = new PoliciesTab();
-  #permissionsSubTab = new PermissionsTab();
-  #evaluateSubTab = new EvaluateTab();
-  #exportSubTab = new ExportTab();
-
-  goToSettingsSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Settings, 1);
-    return this.#settingsSubTab;
-  }
-
-  goToResourcesSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Resources, 1);
-    return this.#resourcesSubTab;
-  }
-
-  goToScopesSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Scopes, 1);
-    return this.#scopesSubTab;
-  }
-
-  goToPoliciesSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Policies, 1);
-    return this.#policiesSubTab;
-  }
-
-  goToPermissionsSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Permissions, 1);
-    return this.#permissionsSubTab;
-  }
-
-  goToEvaluateSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Evaluate, 1);
-    return this.#evaluateSubTab;
-  }
-
-  goToExportSubTab() {
-    this.tabUtils().clickTab(AuthorizationSubTab.Export, 1);
-    return this.#exportSubTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/ClientScopesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/ClientScopesTab.ts
deleted file mode 100644
index f9108b07bfef..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/ClientScopesTab.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-import SetupTab from "./clientscopes_subtabs/SetupTab";
-import EvaluateTab from "./clientscopes_subtabs/EvaluateTab";
-import DedicatedScopesPage from "../DedicatedScopesPage";
-
-export enum ClientScopesSubTab {
-  Setup = "Setup",
-  Evaluate = "Evaluate",
-}
-
-export default class ClientScopesTab extends CommonPage {
-  #setupSubTab = new SetupTab();
-  #evaluateSubTab = new EvaluateTab();
-  #dedicatedScopesPage = new DedicatedScopesPage();
-
-  goToSetupSubTab() {
-    this.tabUtils().clickTab(ClientScopesSubTab.Setup);
-    return this.#setupSubTab;
-  }
-
-  goToEvaluateSubTab() {
-    this.tabUtils().clickTab(ClientScopesSubTab.Evaluate);
-    return this.#evaluateSubTab;
-  }
-
-  clickDedicatedScope(clientId: string) {
-    cy.intercept("/admin/realms/*/clients/*").as("get");
-    cy.findByText(`${clientId}-dedicated`).click();
-    cy.wait("@get");
-    return this.#dedicatedScopesPage;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/CredentialsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/CredentialsTab.ts
deleted file mode 100644
index 348b8c2c9d1b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/CredentialsTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-
-export default class CredentialsTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/KeysTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/KeysTab.ts
deleted file mode 100644
index e252a51d9888..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/KeysTab.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import Select from "../../../../../../forms/Select";
-import CommonPage from "../../../../../CommonPage";
-
-export default class KeysTab extends CommonPage {
-  #generateBtn = "generate";
-  #confirmBtn = "confirm";
-  #useJwksUrl = "useJwksUrl";
-  #keyAlias = "keyAlias";
-  #keyPassword = "keyPassword";
-  #storePassword = "storePassword";
-
-  toggleUseJwksUrl() {
-    cy.findByTestId(this.#useJwksUrl).click({ force: true });
-    return this;
-  }
-
-  clickGenerate() {
-    cy.findByTestId(this.#generateBtn).click();
-    return this;
-  }
-
-  clickConfirm() {
-    cy.findByTestId(this.#confirmBtn).click();
-    return this;
-  }
-
-  fillGenerateModal(
-    archiveFormat: string,
-    keyAlias: string,
-    keyPassword: string,
-    storePassword: string,
-  ) {
-    Select.selectItem(cy.get("#format"), archiveFormat);
-    cy.findByTestId(this.#keyAlias).type(keyAlias);
-    cy.findByTestId(this.#keyPassword).type(keyPassword);
-    cy.findByTestId(this.#storePassword).type(storePassword);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/RolesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/RolesTab.ts
deleted file mode 100644
index a192e1c1b90f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/RolesTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../../CommonPage";
-
-export default class RolesTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/SettingsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/SettingsTab.ts
deleted file mode 100644
index 00f7adbba0fd..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/SettingsTab.ts
+++ /dev/null
@@ -1,239 +0,0 @@
-import PageObject from "../../../../components/PageObject";
-import Masthead from "../../../../Masthead";
-
-export enum NameIdFormat {
-  Username = "username",
-  Email = "email",
-  Transient = "transient",
-  Persistent = "persistent",
-}
-
-const masthead = new Masthead();
-
-export default class SettingsTab extends PageObject {
-  #samlNameIdFormat = "#saml_name_id_format";
-  #forceNameIdFormat = "attributes.saml_force_name_id_format";
-  #forcePostBinding = "attributes.saml🍺force🍺post🍺binding";
-  #forceArtifactBinding = "attributes.saml🍺artifact🍺binding";
-  #includeAuthnStatement = "attributes.saml🍺authnstatement";
-  #includeOneTimeUseCondition = "attributes.saml🍺onetimeuse🍺condition";
-  #optimizeLookup = "attributes.saml🍺server🍺signature🍺keyinfo🍺ext";
-
-  #signDocumentsSwitch = "attributes.saml🍺server🍺signature";
-  #signAssertionsSwitch = "attributes.saml🍺assertion🍺signature";
-  #signatureAlgorithm = "#saml🍺signature🍺algorithm";
-  #signatureKeyName =
-    "#saml🍺server🍺signature🍺keyinfo🍺xmlSigKeyInfoKeyNameTransformer";
-  #canonicalization = "#saml_signature_canonicalization_method";
-
-  #loginTheme = "#login_theme";
-  #consentSwitch = "#consentRequired";
-  #displayClientSwitch = "attributes.display🍺on🍺consent🍺screen";
-  #consentScreenText = "attributes.consent🍺screen🍺text";
-
-  #saveBtn = "settings-save";
-  #revertBtn = "settingsRevert";
-
-  #redirectUris = "redirectUris";
-
-  #idpInitiatedSsoUrlName = "attributes.saml_idp_initiated_sso_url_name";
-  #idpInitiatedSsoRelayState = "attributes.saml_idp_initiated_sso_relay_state";
-  #masterSamlProcessingUrl = "adminUrl";
-
-  public clickSaveBtn() {
-    cy.findByTestId(this.#saveBtn).click();
-    return this;
-  }
-
-  public clickRevertBtn() {
-    cy.findByTestId(this.#revertBtn).click();
-    return this;
-  }
-
-  public selectNameIdFormatDropdown(nameId: NameIdFormat) {
-    cy.get(this.#samlNameIdFormat).click();
-    cy.findByText(nameId).click();
-    return this;
-  }
-
-  public selectSignatureAlgorithmDropdown(sign: string) {
-    cy.get(this.#signatureAlgorithm).click();
-    cy.findByText(sign).click();
-    return this;
-  }
-
-  public selectSignatureKeyNameDropdown(keyName: string) {
-    cy.get(this.#signatureKeyName).click();
-    cy.findByText(keyName).click();
-    return this;
-  }
-
-  public selectCanonicalizationDropdown(canon: string) {
-    cy.get(this.#canonicalization).click();
-    cy.findByText(canon).click();
-  }
-
-  public selectLoginThemeDropdown(theme: string) {
-    cy.get(this.#loginTheme).click();
-    cy.findByText(theme).click();
-  }
-
-  public clickForceNameIdFormatSwitch() {
-    cy.findByTestId(this.#forceNameIdFormat).parent().click();
-    return this;
-  }
-
-  public clickForcePostBindingSwitch() {
-    cy.findByTestId(this.#forcePostBinding).parent().click();
-    return this;
-  }
-
-  public clickForceArtifactBindingSwitch() {
-    cy.findByTestId(this.#forceArtifactBinding).parent().click();
-    return this;
-  }
-
-  public clickIncludeAuthnStatementSwitch() {
-    cy.findByTestId(this.#includeAuthnStatement).parent().click();
-    return this;
-  }
-
-  public clickIncludeOneTimeUseConditionSwitch() {
-    cy.findByTestId(this.#includeOneTimeUseCondition).parent().click();
-    return this;
-  }
-
-  public clickOptimizeLookupSwitch() {
-    cy.findByTestId(this.#optimizeLookup).parent().click();
-    return this;
-  }
-
-  public clickSignDocumentsSwitch() {
-    cy.findByTestId(this.#signDocumentsSwitch).parent().click();
-    return this;
-  }
-
-  public clickSignAssertionsSwitch() {
-    cy.findByTestId(this.#signAssertionsSwitch).parent().click();
-    return this;
-  }
-
-  public clickConsentSwitch() {
-    cy.get(this.#consentSwitch).parent().click();
-    return this;
-  }
-
-  public clickDisplayClientSwitch() {
-    cy.findByTestId(this.#displayClientSwitch).parent().click();
-    return this;
-  }
-
-  public assertNameIdFormatDropdown() {
-    this.selectNameIdFormatDropdown(NameIdFormat.Email);
-    this.selectNameIdFormatDropdown(NameIdFormat.Username);
-    this.selectNameIdFormatDropdown(NameIdFormat.Persistent);
-    this.selectNameIdFormatDropdown(NameIdFormat.Transient);
-    return this;
-  }
-
-  public assertSignatureAlgorithmDropdown() {
-    this.selectSignatureAlgorithmDropdown("RSA_SHA1");
-    this.selectSignatureAlgorithmDropdown("RSA_SHA256");
-    this.selectSignatureAlgorithmDropdown("RSA_SHA256_MGF1");
-    this.selectSignatureAlgorithmDropdown("RSA_SHA512");
-    this.selectSignatureAlgorithmDropdown("RSA_SHA512_MGF1");
-    this.selectSignatureAlgorithmDropdown("DSA_SHA1");
-    return this;
-  }
-
-  public assertSignatureKeyNameDropdown() {
-    this.selectSignatureKeyNameDropdown("KEY_ID");
-    this.selectSignatureKeyNameDropdown("CERT_SUBJECT");
-    this.selectSignatureKeyNameDropdown("NONE");
-    return this;
-  }
-
-  public assertCanonicalizationDropdown() {
-    this.selectCanonicalizationDropdown("EXCLUSIVE_WITH_COMMENTS");
-    this.selectCanonicalizationDropdown("EXCLUSIVE");
-    this.selectCanonicalizationDropdown("INCLUSIVE_WITH_COMMENTS");
-    this.selectCanonicalizationDropdown("INCLUSIVE");
-    return this;
-  }
-
-  public assertLoginThemeDropdown() {
-    this.selectLoginThemeDropdown("base");
-    this.selectLoginThemeDropdown("keycloak");
-    return this;
-  }
-
-  public assertSAMLCapabilitiesSwitches() {
-    this.clickForceNameIdFormatSwitch();
-    this.assertSwitchStateOn(cy.findByTestId(this.#forceNameIdFormat));
-
-    this.clickForcePostBindingSwitch();
-    this.assertSwitchStateOff(cy.findByTestId(this.#forcePostBinding));
-
-    this.clickForceArtifactBindingSwitch();
-    this.assertSwitchStateOn(cy.findByTestId(this.#forceArtifactBinding));
-
-    this.clickIncludeAuthnStatementSwitch();
-    this.assertSwitchStateOff(cy.findByTestId(this.#includeAuthnStatement));
-
-    this.clickIncludeOneTimeUseConditionSwitch();
-    this.assertSwitchStateOn(cy.findByTestId(this.#includeOneTimeUseCondition));
-
-    this.clickOptimizeLookupSwitch();
-    this.assertSwitchStateOn(cy.findByTestId(this.#optimizeLookup));
-    return this;
-  }
-
-  public assertSignatureEncryptionSwitches() {
-    cy.get(this.#signatureAlgorithm).should("exist");
-
-    this.clickSignDocumentsSwitch();
-    this.assertSwitchStateOff(cy.findByTestId(this.#signDocumentsSwitch));
-    cy.get(this.#signatureAlgorithm).should("not.exist");
-
-    this.clickSignAssertionsSwitch();
-    this.assertSwitchStateOn(cy.findByTestId(this.#signAssertionsSwitch));
-    cy.get(this.#signatureAlgorithm).should("exist");
-    return this;
-  }
-
-  public assertLoginSettings() {
-    cy.findByTestId(this.#displayClientSwitch).should("be.disabled");
-    cy.findByTestId(this.#consentScreenText).should("be.disabled");
-    this.clickConsentSwitch();
-    cy.findByTestId(this.#displayClientSwitch).should("not.be.disabled");
-    this.clickDisplayClientSwitch();
-    cy.findByTestId(this.#consentScreenText).should("not.be.disabled");
-    cy.findByTestId(this.#consentScreenText).click();
-    cy.findByTestId(this.#consentScreenText).type("Consent Screen Text");
-    return this;
-  }
-
-  public selectRedirectUriTextField(number: number, text: string) {
-    cy.findByTestId(this.#redirectUris + number)
-      .click()
-      .clear()
-      .type(text);
-    return this;
-  }
-
-  public assertAccessSettings() {
-    const redirectUriError = "Client could not be updated: invalid_input";
-
-    cy.findByTestId(this.#idpInitiatedSsoUrlName).click().type("a");
-    cy.findByTestId(this.#idpInitiatedSsoRelayState).click().type("b");
-    cy.findByTestId(this.#masterSamlProcessingUrl).click().type("c");
-
-    this.selectRedirectUriTextField(0, "Redirect Uri");
-    cy.findByText("Add valid redirect URIs").click();
-    this.selectRedirectUriTextField(1, "Redirect Uri second field");
-    this.clickSaveBtn();
-    masthead.checkNotificationMessage(redirectUriError);
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/EvaluateTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/EvaluateTab.ts
deleted file mode 100644
index dfd3ff93071c..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/EvaluateTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export default class EvaluateTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ExportTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ExportTab.ts
deleted file mode 100644
index bdf8f3a22f13..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ExportTab.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import grantClipboardAccess from "../../../../../../../util/grantClipboardAccess";
-import CommonPage from "../../../../../../CommonPage";
-
-export default class ExportTab extends CommonPage {
-  #exportDownloadBtn = "authorization-export-download";
-  #exportCopyBtn = "authorization-export-copy";
-
-  copy() {
-    grantClipboardAccess();
-    cy.findByTestId(this.#exportCopyBtn).click();
-    return this;
-  }
-
-  export() {
-    cy.findByTestId(this.#exportDownloadBtn).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PermissionsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PermissionsTab.ts
deleted file mode 100644
index 9d527bd0e885..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PermissionsTab.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-import CreatePermissionPage from "../../CreatePermissionPage";
-type PermissionType = "resource" | "scope";
-
-export default class PermissionsTab extends CommonPage {
-  #createPermissionPage = new CreatePermissionPage();
-  #createPermissionDrpDwn = "permissionCreateDropdown";
-  #permissionResourceDrpDwn = "#resources";
-
-  createPermission(type: PermissionType) {
-    cy.findByTestId(this.#createPermissionDrpDwn).click();
-    cy.findByTestId(`create-${type}`).click();
-    return this.#createPermissionPage;
-  }
-
-  selectResource(name: string) {
-    cy.get(this.#permissionResourceDrpDwn)
-      .click()
-      .parent()
-      .parent()
-      .findByText(name)
-      .parent()
-      .click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PoliciesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PoliciesTab.ts
deleted file mode 100644
index 6a5b7d65ff46..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/PoliciesTab.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export default class PoliciesTab extends CommonPage {
-  #emptyPolicyCreateBtn = "no-policies-empty-action";
-  #createPolicyBtn = "createPolicy";
-
-  createPolicy(type: string, first = false) {
-    if (first) {
-      cy.findByTestId(this.#emptyPolicyCreateBtn).click();
-    } else {
-      cy.findByTestId(this.#createPolicyBtn).click();
-    }
-    cy.findByTestId(type).click();
-    return this;
-  }
-
-  fillBasePolicyForm(policy: { [key: string]: string }) {
-    Object.entries(policy).map(([key, value]) =>
-      cy.findByTestId(key).type(value),
-    );
-    return this;
-  }
-
-  setPolicy(policyName: string) {
-    cy.findByTestId(policyName).click();
-    return this;
-  }
-
-  inputClient(clientName: string) {
-    cy.get("#clients").click();
-    cy.get("ul li").contains(clientName).click();
-    cy.get("#clients").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ResourcesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ResourcesTab.ts
deleted file mode 100644
index 466cfbabf3e3..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ResourcesTab.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-import CreateResourcePage from "../../CreateResourcePage";
-
-export default class ResourcesTab extends CommonPage {
-  #createResourcePage = new CreateResourcePage();
-  #createResourceBtn = "createResource";
-
-  createResource() {
-    cy.findByTestId(this.#createResourceBtn).click();
-
-    return this.#createResourcePage;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ScopesTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ScopesTab.ts
deleted file mode 100644
index 88766ff08898..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/ScopesTab.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-import CreateAuthorizationScopePage from "../../CreateAuthorizationScopePage";
-
-export default class ScopesTab extends CommonPage {
-  #createAuthorizationScopePage = new CreateAuthorizationScopePage();
-  #createScopeBtn = "no-authorization-scopes-empty-action";
-
-  createAuthorizationScope() {
-    cy.findByTestId(this.#createScopeBtn).click();
-    return this.#createAuthorizationScopePage;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/SettingsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/SettingsTab.ts
deleted file mode 100644
index 9e5b81876e2d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/authorization_subtabs/SettingsTab.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export default class SettingsTab extends CommonPage {
-  saveSettings() {
-    cy.findByTestId("authenticationSettingsSave").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/EvaluateTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/EvaluateTab.ts
deleted file mode 100644
index dfd3ff93071c..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/EvaluateTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export default class EvaluateTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/SetupTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/SetupTab.ts
deleted file mode 100644
index 981cb72ba87d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/client_details/tabs/clientscopes_subtabs/SetupTab.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import CommonPage from "../../../../../../CommonPage";
-
-export enum SetupTabFilterItem {
-  Name = "Name",
-  AssignedType = "Assigned type",
-}
-
-export enum SetupTabAssignedTypeItem {
-  AllTypes = "All types",
-  Default = "Default",
-  Optional = "Optional",
-}
-
-export default class SetupTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/ClientsListTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/ClientsListTab.ts
deleted file mode 100644
index 3423a24f06d7..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/ClientsListTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-
-export default class ClientsListTab extends CommonPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/InitialAccessTokenTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/InitialAccessTokenTab.ts
deleted file mode 100644
index 59bd4662fb6d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/clients/tabs/InitialAccessTokenTab.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-
-export default class InitialAccessTokenTab extends CommonPage {
-  #initialAccessTokenTab = "initialAccessToken";
-
-  #emptyAction = "no-initial-access-tokens-empty-action";
-
-  #expirationNumberInput = "expiration";
-  #expirationText = ".pf-v5-c-helper-text__item-text";
-  #countInput = "#count input";
-  #countPlusBtn = '#count [aria-label="Plus"]';
-  #saveBtn = "save";
-
-  goToInitialAccessTokenTab() {
-    cy.findByTestId(this.#initialAccessTokenTab).click();
-    return this;
-  }
-
-  shouldBeEmpty() {
-    cy.findByTestId(this.#emptyAction).should("exist");
-    return this;
-  }
-
-  shouldNotBeEmpty() {
-    cy.findByTestId(this.#emptyAction).should("not.exist");
-    return this;
-  }
-
-  getFirstId(callback: (id: string) => void) {
-    cy.get("tbody > tr:first-child > td:first-child")
-      .invoke("text")
-      .then((text) => {
-        callback(text);
-      });
-    return this;
-  }
-
-  goToCreateFromEmptyList() {
-    cy.findByTestId(this.#emptyAction).click();
-    return this;
-  }
-
-  fillNewTokenData(expiration: number, count: number) {
-    cy.findByTestId(this.#expirationNumberInput).clear();
-    cy.findByTestId(this.#expirationNumberInput).type(`${expiration}`);
-    cy.get(this.#countInput).clear();
-
-    for (let i = 0; i < count; i++) {
-      cy.get(this.#countPlusBtn).click();
-    }
-
-    return this;
-  }
-
-  save() {
-    cy.findByTestId(this.#saveBtn).click();
-    return this;
-  }
-
-  checkExpirationGreaterThanZeroError() {
-    cy.get(this.#expirationText).should(
-      "have.text",
-      "Value should should be greater or equal to 1",
-    );
-    return this;
-  }
-
-  checkCountValue(value: number) {
-    cy.get(this.#countInput).should("have.value", value);
-    return this;
-  }
-
-  checkSaveButtonIsDisabled() {
-    cy.findByTestId(this.#saveBtn).should("be.disabled");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/EventsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/EventsPage.ts
deleted file mode 100644
index f0b0d0a6afb0..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/EventsPage.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import CommonPage from "../../../CommonPage";
-import UserEventsTab from "./tabs/UserEventsTab";
-import AdminEventsTab from "./tabs/AdminEventsTab";
-
-export enum EventsTab {
-  UserEvents = "User events",
-  AdminEvents = "Admin events",
-}
-
-export default class EventsPage extends CommonPage {
-  #userEventsTab = new UserEventsTab();
-  #adminEventsTab = new AdminEventsTab();
-
-  goToUserEventsTab() {
-    this.tabUtils().clickTab(EventsTab.UserEvents);
-    return this.#userEventsTab;
-  }
-
-  goToAdminEventsTab() {
-    this.tabUtils().clickTab(EventsTab.AdminEvents);
-    return this.#adminEventsTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/AdminEventsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/AdminEventsTab.ts
deleted file mode 100644
index 6d288bc08e0d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/AdminEventsTab.ts
+++ /dev/null
@@ -1,326 +0,0 @@
-import ModalUtils from "../../../../../util/ModalUtils";
-import EmptyStatePage from "../../../components/EmptyStatePage";
-import PageObject from "../../../components/PageObject";
-
-enum AdminEventsTabSearchFormFieldsLabel {
-  ResourceTypes = "Resource types",
-  OperationTypes = "Operation types",
-  ResourcePath = "Resource path",
-  Realm = "Realm",
-  Client = "Client",
-  User = "User",
-  IpAddress = "IP address",
-  DateFrom = "Date(from)",
-  DateTo = "Date(to)",
-}
-
-export class AdminEventSearchData {
-  resourceTypes?: string[];
-  operationTypes?: string[];
-  resourcePath?: string;
-  realm?: string;
-  client?: string;
-  user?: string;
-  ipAddress?: string;
-  dateFrom?: string;
-  dateTo?: string;
-}
-
-const emptyStatePage = new EmptyStatePage();
-const modalUtils = new ModalUtils();
-
-export default class AdminEventsTab extends PageObject {
-  #searchAdminEventDrpDwnBtn = "dropdown-panel-btn";
-  #searchEventsBtn = "search-events-btn";
-  #operationTypesInputFld =
-    ".pf-v5-c-form-control.pf-v5-c-select__toggle-typeahead";
-  #authAttrDataRow = 'tbody > tr > [data-label="Attribute"]';
-  #authValDataRow = 'tbody > tr > [data-label="Value"]';
-  #refreshBtn = "refresh-btn";
-  #resourcePathInput = "#kc-resourcePath";
-  #realmInput = "#kc-realm";
-  #clientInput = "#kc-client";
-  #userInput = "#kc-user";
-  #ipAddressInput = "#kc-ipAddress";
-  #dateFromInput = "#kc-dateFrom";
-  #dateToInput = "#kc-dateTo";
-
-  public refresh() {
-    cy.findByTestId(this.#refreshBtn).click();
-    return this;
-  }
-
-  public openSearchAdminEventDropdownMenu() {
-    super.openDropdownMenu(
-      "",
-      cy.findByTestId(this.#searchAdminEventDrpDwnBtn),
-    );
-    return this;
-  }
-
-  public assertAdminSearchDropdownMenuHasLabels() {
-    super.assertDropdownMenuHasLabels(
-      Object.values(AdminEventsTabSearchFormFieldsLabel),
-    );
-    return this;
-  }
-
-  public openResourceTypesSelectMenu() {
-    cy.get(this.#operationTypesInputFld).first().click();
-    return this;
-  }
-
-  public closeResourceTypesSelectMenu() {
-    cy.get(this.#operationTypesInputFld).first().click();
-    return this;
-  }
-
-  public openOperationTypesSelectMenu() {
-    cy.get(this.#operationTypesInputFld).last().click();
-    return this;
-  }
-
-  public closeOperationTypesSelectMenu() {
-    cy.get(this.#operationTypesInputFld).last().click();
-    return this;
-  }
-
-  public typeIpAddress(ipAddress: string) {
-    cy.get(this.#ipAddressInput).type(ipAddress);
-    return this;
-  }
-
-  searchAdminEvent(searchData: AdminEventSearchData) {
-    this.openSearchAdminEventDropdownMenu();
-    if (searchData.resourceTypes) {
-      this.openResourceTypesSelectMenu();
-      searchData.resourceTypes.forEach((value) => {
-        super.clickSelectMenuItem(value);
-      });
-      this.closeResourceTypesSelectMenu();
-    }
-    if (searchData.operationTypes) {
-      this.openOperationTypesSelectMenu();
-      searchData.operationTypes.forEach((value) => {
-        super.clickSelectMenuItem(value);
-      });
-      this.closeOperationTypesSelectMenu();
-    }
-    if (searchData.resourcePath) {
-      cy.get(this.#resourcePathInput).type(searchData.resourcePath);
-    }
-    if (searchData.realm) {
-      cy.get(this.#realmInput).type(searchData.realm);
-    }
-    if (searchData.client) {
-      cy.get(this.#clientInput).type(searchData.client);
-    }
-    if (searchData.user) {
-      cy.get(this.#userInput).type(searchData.user);
-    }
-    if (searchData.ipAddress) {
-      cy.get(this.#ipAddressInput).type(searchData.ipAddress);
-    }
-    if (searchData.dateFrom) {
-      cy.get(this.#dateFromInput).type(searchData.dateFrom);
-    }
-    if (searchData.dateTo) {
-      cy.get(this.#dateToInput).type(searchData.dateTo);
-    }
-    cy.findByTestId(this.#searchEventsBtn).click();
-    return this;
-  }
-
-  public assertSearchAdminBtnEnabled(disabled: boolean) {
-    super.assertIsEnabled(cy.findByTestId(this.#searchEventsBtn), disabled);
-    return this;
-  }
-
-  public searchAdminEventByResourceTypes(resourceTypes: string[]) {
-    const searchData = new AdminEventSearchData();
-    searchData.resourceTypes = resourceTypes;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByOperationTypes(operationTypes: string[]) {
-    const searchData = new AdminEventSearchData();
-    searchData.operationTypes = operationTypes;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByResourcePath(resourcePath: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.resourcePath = resourcePath;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByRealm(realm: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.realm = realm;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByClient(client: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.client = client;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByUser(user: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.user = user;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByIpAddress(ipAddress: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.ipAddress = ipAddress;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByDateFrom(dateFrom: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.dateFrom = dateFrom;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public searchAdminEventByDateTo(dateTo: string) {
-    const searchData = new AdminEventSearchData();
-    searchData.dateTo = dateTo;
-    this.searchAdminEvent(searchData);
-    return this;
-  }
-
-  public removeResourcePathChipGroup() {
-    super.removeChipGroup(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.ResourcePath,
-    );
-    return this;
-  }
-
-  public assertResourceTypesChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.ResourceTypes,
-      exist,
-    );
-    return this;
-  }
-
-  public assertOperationTypesChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.OperationTypes,
-      exist,
-    );
-    return this;
-  }
-
-  public assertResourcePathChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.ResourcePath,
-      exist,
-    );
-    return this;
-  }
-
-  public assertResourcePathChipGroupItemExist(
-    itemName: string,
-    exist: boolean,
-  ) {
-    super.assertChipGroupItemExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.ResourcePath,
-      itemName,
-      exist,
-    );
-    return this;
-  }
-
-  public assertRealmChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.Realm,
-      exist,
-    );
-    return this;
-  }
-
-  public assertClientChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.Client,
-      exist,
-    );
-    return this;
-  }
-
-  public assertUserChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.User,
-      exist,
-    );
-    return this;
-  }
-
-  public assertIpAddressChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.IpAddress,
-      exist,
-    );
-    return this;
-  }
-
-  public assertDateFromChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.DateFrom,
-      exist,
-    );
-    return this;
-  }
-
-  public assertDateToChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      AdminEventsTabSearchFormFieldsLabel.DateTo,
-      exist,
-    );
-    return this;
-  }
-
-  public assertAuthDialogIsNotEmpty() {
-    modalUtils
-      .checkModalTitle("Auth")
-      .assertModalMessageContainText("Realm")
-      .assertModalMessageContainText("Client")
-      .assertModalMessageContainText("User")
-      .assertModalMessageContainText("IP address")
-      .assertModalHasElement(this.#authAttrDataRow, true)
-      .assertModalHasElement(this.#authValDataRow, true)
-      .closeModal();
-    return this;
-  }
-
-  public assertRepresentationDialogIsNotEmpty() {
-    modalUtils.checkModalTitle("Representation").closeModal();
-    return this;
-  }
-
-  public assertNoSearchResultsExist(exist: boolean) {
-    emptyStatePage.checkIfExists(exist);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/UserEventsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/UserEventsTab.ts
deleted file mode 100644
index c97070b90eaf..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/events/tabs/UserEventsTab.ts
+++ /dev/null
@@ -1,241 +0,0 @@
-import EmptyStatePage from "../../../components/EmptyStatePage";
-import PageObject from "../../../components/PageObject";
-
-enum UserEventsTabSearchFormFieldsLabel {
-  UserId = "User ID",
-  EventType = "Event type",
-  Client = "Client",
-  DateFrom = "Date(from)",
-  DateTo = "Date(to)",
-  IpAddress = "IP Address",
-}
-
-export class UserEventSearchData {
-  userId?: string;
-  eventType?: string[];
-  client?: string;
-  dateFrom?: string;
-  dateTo?: string;
-  ipAddress?: string;
-}
-
-const emptyStatePage = new EmptyStatePage();
-
-export default class UserEventsTab extends PageObject {
-  #searchUserEventDrpDwnToggle = "dropdown-panel-btn";
-  #searchUserIdInput = "#kc-userId";
-  #searchEventTypeSelectToggle =
-    ".pf-v5-c-select.keycloak__events_search__type_select";
-  #searchClientInput = "#kc-client";
-  #searchDateFromInput = "#kc-dateFrom";
-  #searchDateToInput = "#kc-dateTo";
-  #searchIpAddress = "#kc-ipAddress";
-  #searchEventsBtn = "search-events-btn";
-  #refreshBtn = "refresh-btn";
-
-  public openSearchUserEventDropdownMenu() {
-    super.openDropdownMenu(
-      "",
-      cy.findByTestId(this.#searchUserEventDrpDwnToggle),
-    );
-    return this;
-  }
-
-  public openEventTypeSelectMenu() {
-    super.openSelectMenu("", cy.get(this.#searchEventTypeSelectToggle));
-    return this;
-  }
-
-  public closeEventTypeSelectMenu() {
-    super.closeSelectMenu("", cy.get(this.#searchEventTypeSelectToggle));
-    return this;
-  }
-
-  public clickEventTypeSelectItem(itemName: string) {
-    super.clickSelectMenuItem(itemName);
-    return this;
-  }
-
-  public assertSearchEventBtnIsEnabled(enabled: boolean) {
-    super.assertIsEnabled(cy.findByTestId(this.#searchEventsBtn), enabled);
-    return this;
-  }
-
-  public assertUserSearchDropdownMenuHasLabels() {
-    super.assertDropdownMenuHasLabels(
-      Object.values(UserEventsTabSearchFormFieldsLabel),
-    );
-    return this;
-  }
-
-  public assertSearchUserEventDropdownMenuExist(exist: boolean) {
-    super.assertExist(
-      cy.findByTestId(this.#searchUserEventDrpDwnToggle),
-      exist,
-    );
-    return this;
-  }
-
-  public refresh() {
-    cy.findByTestId(this.#refreshBtn).click();
-    return this;
-  }
-
-  public typeUserId(userId: string) {
-    cy.get(this.#searchUserIdInput).type(userId);
-    return this;
-  }
-
-  public typeIpAddress(ipAddress: string) {
-    cy.get(this.#searchIpAddress).type(ipAddress);
-    return this;
-  }
-
-  public searchUserEvent(searchData: UserEventSearchData) {
-    this.openSearchUserEventDropdownMenu();
-    if (searchData.userId) {
-      this.typeUserId(searchData.userId);
-    }
-    if (searchData.eventType) {
-      this.openEventTypeSelectMenu();
-      searchData.eventType.forEach((value) => {
-        super.clickSelectMenuItem(value);
-      });
-      this.closeEventTypeSelectMenu();
-    }
-    if (searchData.client) {
-      cy.get(this.#searchClientInput).type(searchData.client);
-    }
-    if (searchData.dateFrom) {
-      cy.get(this.#searchDateFromInput).type(searchData.dateFrom);
-    }
-    if (searchData.dateTo) {
-      cy.get(this.#searchDateToInput).type(searchData.dateTo);
-    }
-    if (searchData.ipAddress) {
-      cy.get(this.#searchIpAddress).type(searchData.ipAddress);
-    }
-    cy.findByTestId(this.#searchEventsBtn).click();
-    return this;
-  }
-
-  public searchUserEventByUserId(userId: string) {
-    const searchData = new UserEventSearchData();
-    searchData.userId = userId;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public searchUserEventByEventType(eventType: string[]) {
-    const searchData = new UserEventSearchData();
-    searchData.eventType = eventType;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public searchUserEventByClient(client: string) {
-    const searchData = new UserEventSearchData();
-    searchData.client = client;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public searchUserEventByDateFrom(dateFrom: string) {
-    const searchData = new UserEventSearchData();
-    searchData.dateFrom = dateFrom;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public searchUserEventByDateTo(dateTo: string) {
-    const searchData = new UserEventSearchData();
-    searchData.dateTo = dateTo;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public searchUserEventByIpAddress(ipAddress: string) {
-    const searchData = new UserEventSearchData();
-    searchData.ipAddress = ipAddress;
-    this.searchUserEvent(searchData);
-    return this;
-  }
-
-  public removeEventTypeChipGroupItem(itemName: string) {
-    super.removeChipGroupItem(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.EventType,
-      itemName,
-    );
-    return this;
-  }
-
-  public assertEventTypeChipGroupItemExist(itemName: string, exist: boolean) {
-    super.assertChipGroupItemExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.EventType,
-      itemName,
-      exist,
-    );
-    return this;
-  }
-
-  public assertUserIdChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.UserId,
-      exist,
-    );
-    return this;
-  }
-
-  public assertEventTypeChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.EventType,
-      exist,
-    );
-    return this;
-  }
-
-  public assertClientChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.Client,
-      exist,
-    );
-    return this;
-  }
-
-  public assertDateFromChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.DateFrom,
-      exist,
-    );
-    return this;
-  }
-
-  public assertDateToChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.DateTo,
-      exist,
-    );
-    return this;
-  }
-
-  public assertIpAddressChipGroupExist(exist: boolean) {
-    super.assertChipGroupExist(
-      this.genericChipGroupSelector,
-      UserEventsTabSearchFormFieldsLabel.IpAddress,
-      exist,
-    );
-    return this;
-  }
-
-  public assertNoSearchResultsExist(exist: boolean) {
-    emptyStatePage.checkIfExists(exist);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupModal.ts
deleted file mode 100644
index 4e72ee936600..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupModal.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import ModalUtils from "../../../../util/ModalUtils";
-
-export default class GroupModal extends ModalUtils {
-  #createGroupModalTitle = "Create a group";
-  #groupNameInput = "name";
-  #createGroupBnt = "createGroup";
-  #renameButton = "renameGroup";
-  #duplicateGroup = "duplicateGroup";
-
-  public setGroupNameInput(name: string) {
-    cy.findByTestId(this.#groupNameInput).clear().type(name);
-    return this;
-  }
-
-  public create() {
-    cy.findByTestId(this.#createGroupBnt).click();
-    return this;
-  }
-
-  public rename() {
-    cy.findByTestId(this.#renameButton).click();
-    return this;
-  }
-
-  public duplicate() {
-    cy.findByTestId(this.#duplicateGroup).click();
-    return this;
-  }
-
-  public assertCreateGroupModalVisible(isVisible: boolean) {
-    super
-      .assertModalVisible(isVisible)
-      .assertModalTitleEqual(this.#createGroupModalTitle);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupPage.ts
deleted file mode 100644
index 42c77d85fa8f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/GroupPage.ts
+++ /dev/null
@@ -1,224 +0,0 @@
-import PageObject from "../../components/PageObject";
-import ListingPage from "../../ListingPage";
-import Masthead from "../../Masthead";
-import SidebarPage from "../../SidebarPage";
-import GroupModal from "./GroupModal";
-import MoveGroupModal from "./MoveGroupModal";
-
-const groupModal = new GroupModal();
-const moveGroupModal = new MoveGroupModal();
-const listingPage = new ListingPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-
-export default class GroupPage extends PageObject {
-  protected createGroupEmptyStateBtn = "no-groups-in-this-realm-empty-action";
-  #createGroupBtn = "openCreateGroupModal";
-  protected actionDrpDwnButton = "action-dropdown";
-  #searchField = "[data-testid='group-search']";
-
-  openCreateGroupModal(emptyState: boolean) {
-    if (emptyState) {
-      cy.findByTestId(this.createGroupEmptyStateBtn).click();
-    } else {
-      cy.findByTestId(this.#createGroupBtn).click();
-    }
-    return this;
-  }
-
-  createGroup(groupName: string, emptyState: boolean) {
-    this.openCreateGroupModal(emptyState);
-    groupModal
-      .assertCreateGroupModalVisible(true)
-      .setGroupNameInput(groupName)
-      .create();
-    cy.intercept("POST", "*/admin/realms/master/groups").as("post");
-    return this;
-  }
-
-  public searchGroup(searchValue: string, wait: boolean = false) {
-    this.search(this.#searchField, searchValue, wait);
-
-    return this;
-  }
-
-  protected search(
-    searchField: string,
-    searchValue: string,
-    wait: boolean,
-    exact = true,
-  ) {
-    if (wait) {
-      const searchUrl = `/admin/realms/master/**/*${searchValue}*`;
-      cy.intercept(searchUrl).as("search");
-    }
-
-    if (exact) {
-      cy.findByTestId("exact-search").check();
-    } else {
-      cy.findByTestId("exact-search").uncheck();
-    }
-
-    cy.get(searchField + " input").clear();
-    if (searchValue) {
-      cy.get(searchField + " input").type(searchValue);
-      cy.get(searchField + " button[type='submit']").click({ force: true });
-    } else {
-      // TODO: Remove else and move clickSearchButton outside of the if
-      cy.get(searchField).type("{enter}");
-    }
-
-    if (wait) {
-      cy.wait(["@search"]);
-    }
-  }
-
-  goToGroupChildGroupsTab(groupName: string) {
-    listingPage.goToItemDetails(groupName);
-    cy.intercept("GET", "*/admin/realms/master/groups/*").as("get");
-    sidebarPage.waitForPageLoad();
-    return this;
-  }
-
-  selectGroupItemCheckbox(items: string[]) {
-    for (const item of items) {
-      listingPage.clickItemCheckbox(item);
-    }
-    return this;
-  }
-
-  selectGroupItemCheckboxAllRows() {
-    listingPage.clickTableHeaderItemCheckboxAllRows();
-    return this;
-  }
-
-  deleteSelectedGroups(confirmModal = true) {
-    this.clickToolbarAction("Delete");
-    if (confirmModal) {
-      groupModal.confirmModal();
-    }
-    return this;
-  }
-
-  showDeleteSelectedGroupsDialog() {
-    this.clickToolbarAction("Delete");
-    return this;
-  }
-
-  deleteGroupItem(groupName: string, confirmModal = true) {
-    listingPage.deleteItem(groupName);
-    if (confirmModal) {
-      groupModal.confirmModal();
-    }
-    return this;
-  }
-
-  duplicateGroupItem(groupName: string) {
-    cy.intercept("/admin/realms/master/groups/*").as("fetchGroup");
-    listingPage.duplicateItem(groupName);
-    cy.wait("@fetchGroup");
-    groupModal.confirmDuplicateModal();
-    return this;
-  }
-
-  moveGroupItemAction(groupName: string, destinationGroupName: string[]) {
-    listingPage.clickRowDetails(groupName);
-    listingPage.clickDetailMenu("Move to");
-    moveGroupModal
-      .assertModalVisible(true)
-      .assertModalTitleEqual(`Move ${groupName} to Root`);
-    if (!destinationGroupName.includes("root")) {
-      for (const destination of destinationGroupName) {
-        moveGroupModal
-          .clickRow(destination)
-          .assertModalTitleEqual(`Move ${groupName} to ${destination}`);
-      }
-    }
-    moveGroupModal.clickMove();
-    this.assertNotificationGroupMoved();
-    moveGroupModal.assertModalExist(false);
-    return this;
-  }
-
-  clickBreadcrumbItem(groupName: string) {
-    super.clickBreadcrumbItem(groupName);
-    return this;
-  }
-
-  assertGroupItemExist(groupName: string, exist: boolean) {
-    listingPage.itemExist(groupName, exist);
-    return this;
-  }
-
-  assertNoGroupsInThisRealmEmptyStateMessageExist(exist: boolean) {
-    this.assertEmptyStateExist(exist);
-    return this;
-  }
-
-  assertGroupItemsEqual(number: number) {
-    listingPage.itemsEqualTo(number);
-    return this;
-  }
-
-  assertNoSearchResultsMessageExist(exist: boolean) {
-    if (!exist) {
-      cy.get("keycloak_groups_treeview").should("be.visible");
-    } else {
-      cy.get("keycloak_groups_treeview").should("not.exist");
-    }
-    return this;
-  }
-
-  assertNotificationGroupDeleted() {
-    masthead.checkNotificationMessage("Group deleted");
-    return this;
-  }
-
-  assertNotificationGroupsDeleted() {
-    masthead.checkNotificationMessage("Groups deleted");
-    return this;
-  }
-
-  assertNotificationGroupCreated() {
-    masthead.checkNotificationMessage("Group created");
-    return this;
-  }
-
-  assertNotificationGroupMoved() {
-    masthead.checkNotificationMessage("Group moved");
-    return this;
-  }
-
-  assertNotificationGroupUpdated() {
-    masthead.checkNotificationMessage("Group updated");
-    return this;
-  }
-
-  assertNotificationCouldNotCreateGroupWithEmptyName() {
-    masthead.checkNotificationMessage(
-      "Could not create group Group name is missing",
-    );
-    return this;
-  }
-
-  assertNotificationCouldNotCreateGroupWithDuplicatedName(
-    groupName: string,
-    errorMessage: string,
-  ) {
-    masthead.checkNotificationMessage(
-      errorMessage + groupName + "' already exists.",
-    );
-    return this;
-  }
-
-  assertNotificationGroupDuplicated() {
-    masthead.checkNotificationMessage("Group duplicated");
-    return this;
-  }
-
-  goToGroupActions(groupName: string) {
-    listingPage.clickRowDetails(groupName);
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/MoveGroupModal.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/MoveGroupModal.ts
deleted file mode 100644
index 958d43ee5172..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/MoveGroupModal.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import ModalUtils from "../../../../util/ModalUtils";
-
-export default class MoveGroupModal extends ModalUtils {
-  #moveButton = "moveHere-button";
-  #title = ".pf-v5-c-modal-box__title";
-
-  clickRow(groupName: string) {
-    cy.findByTestId(groupName).click();
-    return this;
-  }
-
-  clickRoot() {
-    cy.get(".pf-v5-c-breadcrumb__item > button").click();
-    return this;
-  }
-
-  checkTitle(title: string) {
-    cy.get(this.#title).should("have.text", title);
-    return this;
-  }
-
-  clickMove() {
-    cy.findByTestId(this.#moveButton).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/SearchGroupPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/SearchGroupPage.ts
deleted file mode 100644
index 476dfcba71ac..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/SearchGroupPage.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import GroupPage from "./GroupPage";
-
-export class SearchGroupPage extends GroupPage {
-  #groupSearchField = "group-search";
-  #searchButton = "[data-testid='group-search'] button[type='submit']";
-
-  public searchGroup(groupName: string) {
-    this.typeSearchInput(groupName);
-    this.clickSearchButton();
-    return this;
-  }
-
-  public searchGlobal(searchValue: string) {
-    this.search("[data-testid='searchForGroups']", searchValue, true);
-
-    return this;
-  }
-
-  public typeSearchInput(value: string) {
-    cy.findByTestId(this.#groupSearchField).type(value);
-    return this;
-  }
-
-  public clickSearchButton() {
-    cy.get(this.#searchButton).click();
-    return this;
-  }
-
-  public checkTerm(searchTerm: string) {
-    cy.get(".pf-v5-c-chip-group")
-      .children()
-      .contains(searchTerm)
-      .should("exist");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/GroupDetailPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/GroupDetailPage.ts
deleted file mode 100644
index f6a03fdc05d5..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/GroupDetailPage.ts
+++ /dev/null
@@ -1,176 +0,0 @@
-import ModalUtils from "../../../../../util/ModalUtils";
-import ListingPage from "../../../ListingPage";
-import GroupPage from "../GroupPage";
-
-const modalUtils = new ModalUtils();
-const listingPage = new ListingPage();
-const groupPage = new GroupPage();
-
-export default class GroupDetailPage extends GroupPage {
-  #groupNamesColumn = '[data-label="Group name"] > a';
-  #memberTab = "members";
-  #childGroupsTab = "groups";
-  #attributesTab = "attributes";
-  #roleMappingTab = "role-mapping-tab";
-  #permissionsTab = "permissionsTab";
-  #memberNameColumn = '[data-testid="members-table"] > tbody > tr';
-  #addMembers = "addMember";
-  #memberUsernameColumn = 'tbody > tr > [data-label="Username"]';
-  #actionDrpDwnItemRenameGroup = "renameGroupAction";
-  #actionDrpDwnItemDeleteGroup = "deleteGroup";
-  #headerGroupName = ".pf-v5-l-level.pf-m-gutter";
-  #renameGroupModalGroupNameInput = "name";
-  #renameGroupModalRenameBtn = "renameGroup";
-  #permissionSwitch = "permissionSwitch";
-
-  public goToChildGroupsTab() {
-    cy.findByTestId(this.#childGroupsTab).click();
-    return this;
-  }
-
-  public goToMembersTab() {
-    cy.findByTestId(this.#memberTab).click();
-    return this;
-  }
-
-  public goToAttributesTab() {
-    cy.findByTestId(this.#attributesTab).click();
-    return this;
-  }
-
-  public goToRoleMappingTab() {
-    cy.findByTestId(this.#roleMappingTab).click();
-    return this;
-  }
-
-  public goToPermissionsTab() {
-    cy.findByTestId(this.#permissionsTab).click();
-    return this;
-  }
-
-  public headerActionRenameGroup() {
-    super.openDropdownMenu("", cy.findByTestId(this.actionDrpDwnButton));
-    super.clickDropdownMenuItem(
-      "",
-      cy.findByTestId(this.#actionDrpDwnItemRenameGroup),
-    );
-    return this;
-  }
-
-  public headerActionDeleteGroup() {
-    super.openDropdownMenu("", cy.findByTestId(this.actionDrpDwnButton));
-    super.clickDropdownMenuItem(
-      "",
-      cy.findByTestId(this.#actionDrpDwnItemDeleteGroup),
-    );
-    modalUtils.confirmModal();
-    return this;
-  }
-
-  public renameGroup(newGroupName: string) {
-    this.headerActionRenameGroup();
-    modalUtils.checkModalTitle("Rename group");
-    cy.findByTestId(this.#renameGroupModalGroupNameInput)
-      .clear()
-      .type(newGroupName);
-    cy.findByTestId(this.#renameGroupModalRenameBtn).click();
-    return this;
-  }
-
-  public deleteGroupHeaderAction() {
-    this.headerActionDeleteGroup();
-    return this;
-  }
-
-  public assertHeaderGroupNameEqual(groupName: string) {
-    cy.get(this.#headerGroupName).find("h1").should("have.text", groupName);
-    return this;
-  }
-
-  checkListSubGroup(subGroups: string[]) {
-    cy.get(this.#groupNamesColumn).should((groups) => {
-      expect(groups).to.have.length(subGroups.length);
-      for (let index = 0; index < subGroups.length; index++) {
-        const subGroup = subGroups[index];
-        expect(groups).to.contain(subGroup);
-      }
-    });
-    return this;
-  }
-
-  clickMembersTab() {
-    cy.findByTestId(this.#memberTab).click();
-    return this;
-  }
-
-  checkListMembers(members: string[]) {
-    cy.get(this.#memberNameColumn).should((member) => {
-      expect(member).to.have.length(members.length);
-      for (let index = 0; index < members.length; index++) {
-        expect(member.eq(index)).to.contain(members[index]);
-      }
-    });
-    return this;
-  }
-
-  checkSelectableMembers(members: string[]) {
-    cy.get(this.#memberUsernameColumn).should((member) => {
-      for (const user of members) {
-        expect(member).to.contain(user);
-      }
-    });
-    return this;
-  }
-
-  selectUsers(users: string[]) {
-    for (const user of users) {
-      cy.get(this.#memberUsernameColumn)
-        .contains(user)
-        .parent()
-        .find("input")
-        .click();
-    }
-    return this;
-  }
-
-  clickAddMembers() {
-    cy.findByTestId(this.#addMembers).click();
-    return this;
-  }
-
-  enablePermissionSwitch() {
-    cy.findByTestId(this.#permissionSwitch).parent().click();
-    this.assertSwitchStateOn(cy.findByTestId(this.#permissionSwitch));
-    cy.findByTestId(this.#permissionSwitch).parent().click();
-    modalUtils
-      .checkModalTitle("Disable permissions?")
-      .checkConfirmButtonText("Confirm")
-      .confirmModal();
-    this.assertSwitchStateOff(cy.findByTestId(this.#permissionSwitch));
-    return this;
-  }
-
-  checkDefaultRole() {
-    listingPage.itemExist("default-roles");
-  }
-
-  createRoleMappingSearch() {
-    listingPage.searchItemInModal("offline_access");
-    listingPage.clickItemCheckbox("offline_access");
-  }
-
-  checkRoles(roleName: string | undefined = "offline_access") {
-    listingPage.itemExist(roleName);
-    listingPage.searchItem(roleName, false);
-    listingPage.itemExist(roleName);
-    listingPage.searchItem("non-existant-role", false);
-    groupPage.assertNoSearchResultsMessageExist(true);
-  }
-
-  deleteRole() {
-    modalUtils
-      .checkModalTitle("Remove role?")
-      .checkConfirmButtonText("Remove")
-      .confirmModal();
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/ChildGroupsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/ChildGroupsTab.ts
deleted file mode 100644
index 03fe45fbd5a3..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/ChildGroupsTab.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import GroupDetailPage from "../GroupDetailPage";
-
-export default class ChildGroupsTab extends GroupDetailPage {
-  protected createGroupEmptyStateBtn =
-    "no-groups-in-this-sub-group-empty-action";
-  protected createSubGroupBtn = "openCreateGroupModal";
-
-  public assertNoGroupsInThisSubGroupEmptyStateMessageExist(exist: boolean) {
-    super.assertEmptyStateExist(exist);
-    return this;
-  }
-
-  public openCreateSubGroupModal(emptyState: boolean) {
-    if (emptyState) {
-      cy.findByTestId(this.createGroupEmptyStateBtn).click();
-    } else {
-      cy.findByTestId(this.createSubGroupBtn).click();
-    }
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/MembersTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/MembersTab.ts
deleted file mode 100644
index e8cec122cbd9..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/MembersTab.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-import ModalUtils from "../../../../../../util/ModalUtils";
-import ListingPage from "../../../../ListingPage";
-import Masthead from "../../../../Masthead";
-import SidebarPage from "../../../../SidebarPage";
-import GroupDetailPage from "../GroupDetailPage";
-
-const modalUtils = new ModalUtils();
-const listingPage = new ListingPage();
-const masthead = new Masthead();
-const sidebarPage = new SidebarPage();
-
-export default class MembersTab extends GroupDetailPage {
-  #addMemberEmptyStateBtn = "no-users-found-empty-action";
-  #addMemberBtn = "addMember";
-  #includeSubGroupsCheck = "includeSubGroupsCheck";
-
-  public openAddMemberModal(emptyState: boolean) {
-    cy.intercept("GET", "*/admin/realms/master/users?first=*").as("get");
-    if (emptyState) {
-      cy.findByTestId(this.#addMemberEmptyStateBtn).click();
-    } else {
-      cy.findByTestId(this.#addMemberBtn).click();
-    }
-    sidebarPage.waitForPageLoad();
-    return this;
-  }
-
-  public addMember(usernames: string[], emptyState: boolean) {
-    this.openAddMemberModal(emptyState);
-    modalUtils.assertModalVisible(true).assertModalTitleEqual("Add member");
-    for (const username of usernames) {
-      listingPage.clickItemCheckbox(username);
-    }
-    modalUtils.add();
-    modalUtils.assertModalExist(false);
-    return this;
-  }
-
-  public selectUserItemCheckbox(items: string[]) {
-    for (const item of items) {
-      listingPage.clickItemCheckbox(item);
-    }
-    return this;
-  }
-
-  public leaveGroupSelectedUsers() {
-    this.clickToolbarAction("Leave");
-    return this;
-  }
-
-  public leaveGroupUserItem(username: string) {
-    listingPage.clickRowDetails(username);
-    listingPage.clickDetailMenu("Leave");
-    return this;
-  }
-
-  public showGroupMembershipsItem(username: string) {
-    listingPage.clickRowDetails(username);
-    listingPage.clickDetailMenu("Show memberships");
-    return this;
-  }
-
-  public cancelShowGroupMembershipsModal() {
-    modalUtils.cancelModal();
-    return this;
-  }
-
-  public clickCheckboxIncludeSubGroupUsers() {
-    cy.findByTestId(this.#includeSubGroupsCheck).click();
-    return this;
-  }
-
-  public assertNotificationUserAddedToTheGroup(amount: number) {
-    masthead.checkNotificationMessage(
-      `${amount} user${amount > 1 ? "s" : ""} added to the group`,
-    );
-    return this;
-  }
-
-  public assertNotificationUserLeftTheGroup(amount: number) {
-    masthead.checkNotificationMessage(
-      `${amount} user${amount > 1 ? "s" : ""} left the group`,
-    );
-    return this;
-  }
-
-  public assertNoUsersFoundEmptyStateMessageExist(exist: boolean) {
-    super.assertEmptyStateExist(exist);
-    return this;
-  }
-
-  public assertUserItemExist(username: string, exist: boolean) {
-    listingPage.itemExist(username, exist);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/PermissionsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/PermissionsTab.ts
deleted file mode 100644
index c7027e53f0c9..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/groups/group_details/tabs/PermissionsTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import GroupDetailPage from "../GroupDetailPage";
-
-export default class PermissionsTab extends GroupDetailPage {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/AddMapperPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/AddMapperPage.ts
deleted file mode 100644
index 7a01dd57bcaa..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/AddMapperPage.ts
+++ /dev/null
@@ -1,364 +0,0 @@
-import Select from "../../../../forms/Select";
-import LegacyKeyValueInput from "../LegacyKeyValueInput";
-
-export default class AddMapperPage {
-  #mappersTab = "mappers-tab";
-  #noMappersAddMapperButton = "no-mappers-empty-action";
-  #idpMapperSelectToggle = "#identityProviderMapper";
-  #idpMapperSelect = "idp-mapper-select";
-  #addMapperButton = "#add-mapper-button";
-
-  #mapperNameInput = "name";
-  #attribute = "config.user🍺attribute";
-  #attributeName = "attribute.name";
-  #attributeFriendlyName = "attribute.friendly.name";
-  #claimInput = "claim";
-  #socialProfileJSONfieldPath = "jsonField";
-  #userAttribute = "config.attribute";
-  #userAttributeName = "config.userAttribute";
-  #userAttributeValue = "attribute.value";
-  #userSessionAttribute = "attribute";
-  #userSessionAttributeValue = "attribute.value";
-  #newMapperSaveButton = "new-mapper-save-button";
-  #newMapperCancelButton = "new-mapper-cancel-button";
-  #mappersUrl = "/oidc/mappers";
-  #regexAttributeValuesSwitch = "are.attribute.values.regex";
-  #syncmodeSelectToggle = "#syncMode";
-  #attributesKeyInput = '[data-testid="config.attributes.0.key"]';
-  #attributesValueInput = '[data-testid="config.attributes.0.value"]';
-  #template = "template";
-  #target = "#target";
-
-  goToMappersTab() {
-    cy.findByTestId(this.#mappersTab).click();
-    return this;
-  }
-
-  emptyStateAddMapper() {
-    cy.findByTestId(this.#noMappersAddMapperButton).click();
-    return this;
-  }
-
-  addMapper() {
-    cy.get(this.#addMapperButton).click();
-    return this;
-  }
-
-  clickCreateDropdown() {
-    cy.contains("Add provider").click();
-    return this;
-  }
-
-  saveNewMapper() {
-    cy.findByTestId(this.#newMapperSaveButton).click();
-    return this;
-  }
-
-  cancelNewMapper() {
-    cy.findByTestId(this.#newMapperCancelButton).click();
-    return this;
-  }
-
-  toggleSwitch(switchName: string) {
-    cy.findByTestId(switchName).click({ force: true });
-
-    return this;
-  }
-
-  typeName(name: string) {
-    cy.findByTestId(this.#mapperNameInput).clear();
-    cy.findByTestId(this.#mapperNameInput).type(name);
-  }
-
-  fillSocialMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Legacy");
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Attribute Importer")
-      .click();
-
-    cy.findByTestId(this.#socialProfileJSONfieldPath).clear();
-    cy.findByTestId(this.#socialProfileJSONfieldPath).type(
-      "social profile JSON field path",
-    );
-
-    cy.findByTestId(this.#userAttributeName).clear();
-
-    cy.findByTestId(this.#userAttributeName).type("user attribute name");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addRoleToMapperForm() {
-    cy.findByTestId("add-roles").click();
-    cy.get("[aria-label='Select row 1']").click();
-    cy.findByTestId("assign").click();
-    return this;
-  }
-
-  addAdvancedAttrToRoleMapper(name: string) {
-    this.typeName(name);
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Advanced Attribute to Role")
-      .click();
-
-    cy.findByTestId("attributes-add-row").click();
-    cy.get(this.#attributesKeyInput).clear();
-    cy.get(this.#attributesKeyInput).type("key");
-
-    cy.get(this.#attributesValueInput).clear();
-    cy.get(this.#attributesValueInput).type("value");
-
-    this.toggleSwitch(this.#regexAttributeValuesSwitch);
-
-    this.addRoleToMapperForm();
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addUsernameTemplateImporterMapper(name: string) {
-    this.typeName(name);
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Username Template Importer")
-      .click();
-
-    cy.findByTestId(this.#template).clear();
-    cy.findByTestId(this.#template).type("Template");
-
-    cy.get(this.#target).click().parent().contains("BROKER_ID").click();
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addHardcodedUserSessionAttrMapper(name: string) {
-    this.typeName(name);
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Hardcoded User Session Attribute")
-      .click();
-
-    cy.findByTestId(this.#userSessionAttribute).clear();
-    cy.findByTestId(this.#userSessionAttribute).type("user session attribute");
-
-    cy.findByTestId(this.#userSessionAttributeValue).clear();
-    cy.findByTestId(this.#userSessionAttributeValue).type(
-      "user session attribute value",
-    );
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addSAMLAttrImporterMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Attribute Importer")
-      .click();
-
-    cy.findByTestId(this.#attributeName).clear();
-    cy.findByTestId(this.#attributeName).type("attribute name");
-
-    cy.findByTestId(this.#attributeFriendlyName).clear();
-    cy.findByTestId(this.#attributeFriendlyName).type(
-      "attribute friendly name",
-    );
-
-    cy.findByTestId(this.#attribute).clear().type("user attribute name");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addOIDCAttrImporterMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Attribute Importer")
-      .click();
-
-    cy.findByTestId(this.#claimInput).clear().type("claim");
-    cy.findByTestId(this.#attribute).clear().type("user attribute name");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addHardcodedRoleMapper(name: string) {
-    this.typeName(name);
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect).contains("Hardcoded Role").click();
-
-    this.addRoleToMapperForm();
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addHardcodedAttrMapper(name: string) {
-    this.typeName(name);
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Hardcoded Attribute")
-      .click();
-
-    cy.findByTestId(this.#userAttribute).clear().type("user session attribute");
-
-    cy.findByTestId(this.#userAttributeValue)
-      .clear()
-      .type("user session attribute value");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addSAMLAttributeToRoleMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("SAML Attribute to Role")
-      .click();
-
-    this.addRoleToMapperForm();
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  editUsernameTemplateImporterMapper() {
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Legacy");
-
-    cy.findByTestId(this.#template).type("_edited");
-
-    cy.get(this.#target).click().parent().contains("BROKER_USERNAME").click();
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  editSocialMapper() {
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.findByTestId(this.#socialProfileJSONfieldPath).clear();
-
-    cy.findByTestId(this.#socialProfileJSONfieldPath).type(
-      "social profile JSON field path edited",
-    );
-
-    cy.findByTestId(this.#userAttributeName).clear();
-
-    cy.findByTestId(this.#userAttributeName).type("user attribute name edited");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  editSAMLorOIDCMapper() {
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#attributesKeyInput).clear();
-    cy.get(this.#attributesKeyInput).type("key_edited");
-
-    cy.get(this.#attributesValueInput).clear();
-    cy.get(this.#attributesValueInput).type("value_edited");
-
-    this.toggleSwitch(this.#regexAttributeValuesSwitch);
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addOIDCAttributeImporterMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect)
-      .contains("Attribute Importer")
-      .click();
-
-    cy.findByTestId(this.#claimInput).clear();
-    cy.findByTestId(this.#claimInput).type("claim");
-
-    cy.findByTestId(this.#userAttributeName).clear();
-    cy.findByTestId(this.#userAttributeName).type("user attribute name");
-
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  addOIDCClaimToRoleMapper(name: string) {
-    this.typeName(name);
-
-    Select.selectItem(cy.get(this.#syncmodeSelectToggle), "Inherit");
-
-    cy.get(this.#idpMapperSelectToggle).click();
-
-    cy.findByTestId(this.#idpMapperSelect).contains("Claim to Role").click();
-
-    cy.findByTestId("claims-add-row").click();
-    const keyValue = new LegacyKeyValueInput("config.claims");
-
-    keyValue.fillKeyValue({ key: "key", value: "value" });
-
-    this.toggleSwitch("are.claim.values.regex");
-
-    this.addRoleToMapperForm();
-    this.saveNewMapper();
-
-    return this;
-  }
-
-  shouldGoToMappersTab() {
-    cy.url().should("include", this.#mappersUrl);
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/CreateProviderPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/CreateProviderPage.ts
deleted file mode 100644
index f87dafcb4bab..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/CreateProviderPage.ts
+++ /dev/null
@@ -1,136 +0,0 @@
-export default class CreateProviderPage {
-  #github = "github";
-  #clientIdField = "config.clientId";
-  #clientIdError = "#config\\.clientSecret-helper";
-  #clientSecretField = "config.clientSecret";
-  #displayName = "displayName";
-  #discoveryEndpoint = "discoveryEndpoint";
-  #authorizationUrl = "config.authorizationUrl";
-  #addButton = "createProvider";
-  #saveButton = "idp-details-save";
-  #ssoServiceUrl = "sso-service-url";
-  #authnContextClassRefs = "classref-field";
-  #authnContextDeclRefs = "declref-field";
-  #addProvider = "Add provider";
-  #addClassRef = "Add AuthnContext ClassRef";
-  #addDeclRef = "Add AuthnContext DeclRef";
-
-  checkVisible(name: string) {
-    cy.findByTestId(`${name}-card`).should("exist");
-    return this;
-  }
-
-  clickCard(name: string) {
-    cy.findByTestId(`${name}-card`).click();
-    return this;
-  }
-
-  clickGitHubCard() {
-    this.clickCard(this.#github);
-    return this;
-  }
-
-  checkGitHubCardVisible() {
-    this.checkVisible(this.#github);
-    return this;
-  }
-
-  checkClientIdRequiredMessage(exist = true) {
-    cy.get(this.#clientIdError).should((!exist ? "not." : "") + "exist");
-
-    return this;
-  }
-
-  checkAddButtonDisabled(disabled = true) {
-    cy.findByTestId(this.#addButton).should(
-      !disabled ? "not." : "" + "be.disabled",
-    );
-    return this;
-  }
-
-  clickAdd() {
-    cy.findByTestId(this.#addButton).click();
-    return this;
-  }
-
-  clickSave() {
-    cy.findByTestId(this.#saveButton).click();
-    return this;
-  }
-
-  clickClassRefsAdd() {
-    cy.contains(this.#addClassRef).click();
-    return this;
-  }
-
-  clickDeclRefsAdd() {
-    cy.contains(this.#addDeclRef).click();
-    return this;
-  }
-
-  clickCreateDropdown() {
-    cy.contains(this.#addProvider).click();
-    return this;
-  }
-
-  clickItem(item: string) {
-    cy.findByTestId(item).click();
-    return this;
-  }
-
-  fill(id: string, secret = "") {
-    cy.findByTestId(this.#clientIdField).clear();
-
-    if (id) {
-      cy.findByTestId(this.#clientIdField).type(id);
-    }
-
-    if (secret) {
-      cy.findByTestId(this.#clientSecretField).type(secret);
-    }
-
-    return this;
-  }
-
-  fillDisplayName(value: string) {
-    cy.findByTestId(this.#displayName).type("x");
-    cy.findByTestId(this.#displayName).clear().type(value).blur();
-    return this;
-  }
-
-  fillDiscoveryUrl(value: string) {
-    cy.findByTestId(this.#discoveryEndpoint).type("x");
-    cy.findByTestId(this.#discoveryEndpoint).clear().type(value).blur();
-    return this;
-  }
-
-  fillAuthnContextClassRefs(value: string) {
-    cy.findByTestId(this.#authnContextClassRefs).type("x");
-    cy.findByTestId(this.#authnContextClassRefs).clear().type(value).blur();
-    return this;
-  }
-
-  fillAuthnContextDeclRefs(value: string) {
-    cy.findByTestId(this.#authnContextDeclRefs).type("x");
-    cy.findByTestId(this.#authnContextDeclRefs).clear().type(value).blur();
-    return this;
-  }
-
-  fillSsoServiceUrl(value: string) {
-    cy.findByTestId(this.#ssoServiceUrl).type("x");
-    cy.findByTestId(this.#ssoServiceUrl).clear().type(value).blur();
-    return this;
-  }
-
-  shouldBeSuccessful() {
-    cy.findByTestId(this.#discoveryEndpoint)
-      .parent()
-      .should("have.class", "pf-m-success");
-    return this;
-  }
-
-  shouldHaveAuthorizationUrl(value: string) {
-    cy.findByTestId(this.#authorizationUrl).should("have.value", value);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/OrderDialog.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/OrderDialog.ts
deleted file mode 100644
index 2de2acdf7e6a..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/OrderDialog.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-const expect = chai.expect;
-
-export default class OrderDialog {
-  #manageDisplayOrder = "manageDisplayOrder";
-  #list = "manageOrderDataList";
-
-  openDialog() {
-    cy.findByTestId(this.#manageDisplayOrder).click({ force: true });
-    return this;
-  }
-
-  moveRowTo(from: string, to: string) {
-    cy.findByTestId(to).as("target");
-    cy.findByTestId(from).drag("@target");
-    return this;
-  }
-
-  clickSave() {
-    cy.get("#modal-confirm").click();
-    return this;
-  }
-
-  checkOrder(providerNames: string[]) {
-    cy.get(`[data-testid=${this.#list}] li`).should((providers) => {
-      expect(providers).to.have.length(providerNames.length);
-      for (let index = 0; index < providerNames.length; index++) {
-        expect(providers.eq(index)).to.contain(providerNames[index]);
-      }
-    });
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage.ts
deleted file mode 100644
index 07694558515d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseAdvancedSettingsPage.ts
+++ /dev/null
@@ -1,507 +0,0 @@
-import PageObject from "../../components/PageObject";
-import Masthead from "../../Masthead";
-
-const masthead = new Masthead();
-
-export enum LoginFlowOption {
-  empty = "First login flow override",
-  none = "None",
-  browser = "browser",
-  directGrant = "direct grant",
-  registration = "registration",
-  resetCredentials = "reset credentials",
-  firstBrokerLogin = "first broker login",
-  dockerAuth = "docker auth",
-  httpChallenge = "http challenge",
-}
-
-export enum SyncModeOption {
-  import = "Import",
-  legacy = "Legacy",
-  force = "Force",
-}
-
-export enum PromptSelect {
-  unspecified = "Unspecified",
-  none = "None",
-  consent = "Consent",
-  login = "Login",
-  select = "Select account",
-}
-
-export enum ClientAuthentication {
-  post = "Client secret sent as post",
-  basicAuth = "Client secret sent as basic auth",
-  jwt = "JWT signed with client secret",
-  jwtPrivKey = "JWT signed with private key",
-}
-
-export enum ClientAssertionSigningAlg {
-  algorithmNotSpecified = "Algorithm not specified",
-  es256 = "ES256",
-  es384 = "ES384",
-  es512 = "ES512",
-  hs256 = "HS256",
-  hs384 = "HS384",
-  hs512 = "HS512",
-  ps256 = "PS256",
-  ps384 = "PS384",
-  ps512 = "PS512",
-  rs256 = "RS256",
-  rs384 = "RS384",
-  rs512 = "RS512",
-}
-
-export default class ProviderBaseGeneralSettingsPage extends PageObject {
-  #scopesInput = "#scopes";
-  #storeTokensSwitch = "#storeTokens";
-  #storedTokensReadable = "#storedTokensReadable";
-  #isAccessTokenJWT = "#isAccessTokenJWT";
-  #acceptsPromptNoneForwardFromClientSwitch = "#acceptsPromptNone";
-  #advancedSettingsToggle = ".pf-v5-c-expandable-section__toggle";
-  #passLoginHintSwitch = "#passLoginHint";
-  #passMaxAgeSwitch = "#passMaxAge";
-  #passCurrentLocaleSwitch = "#passCurrentLocale";
-  #backchannelLogoutSwitch = "#backchannelLogout";
-  #promptSelect = "#prompt";
-  #disableUserInfoSwitch = "#disableUserInfo";
-  #trustEmailSwitch = "#trustEmail";
-  #doNotStoreUsers = "#doNotStoreUsers";
-  #accountLinkingOnlySwitch = "#accountLinkingOnly";
-  #hideOnLoginPageSwitch = "#hideOnLoginPage";
-  #firstLoginFlowSelect = "#firstBrokerLoginFlowAliasOverride";
-  #postLoginFlowSelect = "#postBrokerLoginFlowAlias";
-  #syncModeSelect = "#syncMode";
-  #essentialClaimSwitch = "#filteredByClaim";
-  #claimNameInput = "#kc-claim-filter-name";
-  #claimValueInput = "#kc-claim-filter-value";
-  #addBtn = "createProvider";
-  #saveBtn = "idp-details-save";
-  #revertBtn = "idp-details-revert";
-
-  #validateSignature = "#config\\.validateSignature";
-  #jwksSwitch = "#config\\.useJwksUrl";
-  #jwksUrl = "config.jwksUrl";
-  #pkceSwitch = "#config\\.pkceEnabled";
-  #pkceMethod = "#pkceMethod";
-  #clientAuth = "#clientAuthMethod";
-  #clientAssertionSigningAlg = "#clientAssertionSigningAlg";
-  #clientAssertionAudienceInput = "#clientAssertionAudience";
-  #jwtX509HeadersSwitch = "#jwtX509HeadersEnabled";
-
-  public clickSaveBtn() {
-    cy.findByTestId(this.#saveBtn).click();
-  }
-
-  public clickRevertBtn() {
-    cy.findByTestId(this.#revertBtn).click();
-  }
-
-  public typeScopesInput(text: string) {
-    cy.get(this.#scopesInput).type(text).blur();
-    return this;
-  }
-
-  public ensureAdvancedSettingsAreVisible() {
-    cy.findByTestId("jump-link-general-settings").click();
-    cy.findByTestId("jump-link-advanced-settings").click();
-  }
-
-  public clickStoreTokensSwitch() {
-    cy.get(this.#storeTokensSwitch).parent().click();
-    return this;
-  }
-
-  public clickStoredTokensReadableSwitch() {
-    cy.get(this.#storedTokensReadable).parent().click();
-    return this;
-  }
-
-  public clickIsAccessTokenJWTSwitch() {
-    cy.get(this.#isAccessTokenJWT).parent().click();
-    return this;
-  }
-
-  public clickAcceptsPromptNoneForwardFromClientSwitch() {
-    cy.get(this.#acceptsPromptNoneForwardFromClientSwitch).parent().click();
-    return this;
-  }
-
-  public clickDisableUserInfoSwitch() {
-    cy.get(this.#disableUserInfoSwitch).parent().click();
-    return this;
-  }
-
-  public clickTrustEmailSwitch() {
-    cy.get(this.#trustEmailSwitch).parent().click();
-    return this;
-  }
-
-  public clickAccountLinkingOnlySwitch() {
-    cy.get(this.#accountLinkingOnlySwitch).parent().click();
-    return this;
-  }
-
-  public clickHideOnLoginPageSwitch() {
-    cy.get(this.#hideOnLoginPageSwitch).parent().click();
-    return this;
-  }
-
-  public clickEssentialClaimSwitch() {
-    cy.get(this.#essentialClaimSwitch).parent().click();
-    return this;
-  }
-
-  public clickdoNotStoreUsersSwitch() {
-    cy.get(this.#doNotStoreUsers).parent().click();
-    return this;
-  }
-
-  public typeClaimNameInput(text: string) {
-    cy.get(this.#claimNameInput).type(text).blur();
-    return this;
-  }
-
-  public typeClaimValueInput(text: string) {
-    cy.get(this.#claimValueInput).type(text).blur();
-    return this;
-  }
-
-  public selectFirstLoginFlowOption(loginFlowOption: LoginFlowOption) {
-    cy.get(this.#firstLoginFlowSelect).click();
-    super.clickSelectMenuItem(
-      loginFlowOption,
-      cy.get(".pf-v5-c-menu__list-item").contains(loginFlowOption),
-    );
-    return this;
-  }
-
-  public selectPostLoginFlowOption(loginFlowOption: LoginFlowOption) {
-    cy.get(this.#postLoginFlowSelect).click();
-    super.clickSelectMenuItem(
-      loginFlowOption,
-      cy.get(".pf-v5-c-menu__list-item").contains(loginFlowOption),
-    );
-    return this;
-  }
-
-  public selectClientAssertSignAlg(
-    clientAssertionSigningAlg: ClientAssertionSigningAlg,
-  ) {
-    cy.get(this.#clientAssertionSigningAlg).click();
-    super.clickSelectMenuItem(
-      clientAssertionSigningAlg,
-      cy.get(".pf-v5-c-menu__list-item").contains(clientAssertionSigningAlg),
-    );
-    return this;
-  }
-
-  public typeClientAssertionAudience(text: string) {
-    cy.get(this.#clientAssertionAudienceInput).type(text).blur();
-    return this;
-  }
-
-  public selectSyncModeOption(syncModeOption: SyncModeOption) {
-    cy.get(this.#syncModeSelect).click();
-    super.clickSelectMenuItem(
-      syncModeOption,
-      cy.get(".pf-v5-c-menu__list-item").contains(syncModeOption),
-    );
-    return this;
-  }
-
-  public selectPromptOption(promptOption: PromptSelect) {
-    cy.get(this.#promptSelect).click();
-    super.clickSelectMenuItem(
-      promptOption,
-      cy.get(".pf-v5-c-menu__list-item").contains(promptOption).parent(),
-    );
-    return this;
-  }
-
-  public clickAdd() {
-    cy.findByTestId(this.#addBtn).click();
-    return this;
-  }
-
-  public assertScopesInputEqual(text: string) {
-    cy.get(this.#scopesInput).should("have.value", text).parent();
-    return this;
-  }
-
-  public assertStoreTokensSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.get(this.#storeTokensSwitch), isOn);
-    return this;
-  }
-
-  public assertStoredTokensReadableTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.get(this.#storedTokensReadable).parent(),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertIsAccessTokenJWTTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.get(this.#isAccessTokenJWT).parent(), isOn);
-    return this;
-  }
-
-  public assertAcceptsPromptNoneForwardFromClientSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.get(this.#acceptsPromptNoneForwardFromClientSwitch).parent(),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertDisableUserInfoSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.get(this.#disableUserInfoSwitch).parent(),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertTrustEmailSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.get(this.#trustEmailSwitch).parent(), isOn);
-    return this;
-  }
-
-  public assertAccountLinkingOnlySwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.get(this.#accountLinkingOnlySwitch), isOn);
-    return this;
-  }
-
-  public assertHideOnLoginPageSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.get(this.#hideOnLoginPageSwitch).parent(),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertDoNotImportUsersSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.get(this.#doNotStoreUsers).parent(), isOn);
-    return this;
-  }
-
-  public assertEssentialClaimSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.get(this.#essentialClaimSwitch).parent(),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertClaimInputEqual(text: string) {
-    cy.get(this.#claimNameInput).should("have.value", text).parent();
-    return this;
-  }
-
-  public assertClaimValueInputEqual(text: string) {
-    cy.get(this.#claimValueInput).should("have.value", text).parent();
-    return this;
-  }
-
-  public assertFirstLoginFlowSelectOptionEqual(
-    loginFlowOption: LoginFlowOption,
-  ) {
-    cy.get(this.#firstLoginFlowSelect).should("have.text", loginFlowOption);
-    return this;
-  }
-
-  public assertPostLoginFlowSelectOptionEqual(
-    loginFlowOption: LoginFlowOption,
-  ) {
-    cy.get(this.#postLoginFlowSelect).should("have.text", loginFlowOption);
-    return this;
-  }
-
-  public assertSyncModeSelectOptionEqual(syncModeOption: SyncModeOption) {
-    cy.get(this.#syncModeSelect).should("have.text", syncModeOption);
-    return this;
-  }
-
-  public assertSyncModeShown(isShown: boolean) {
-    cy.get(this.#syncModeSelect).should(isShown ? "exist" : "not.exist");
-    return this;
-  }
-
-  public assertClientAssertSigAlgSelectOptionEqual(
-    clientAssertionSigningAlg: ClientAssertionSigningAlg,
-  ) {
-    cy.get(this.#clientAssertionSigningAlg).should(
-      "have.text",
-      clientAssertionSigningAlg,
-    );
-    return this;
-  }
-
-  public assertClientAssertionAudienceInputEqual(text: string) {
-    cy.get(this.#clientAssertionAudienceInput)
-      .should("have.value", text)
-      .parent();
-    return this;
-  }
-
-  public assertOIDCUrl(url: string) {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    cy.findByTestId(`config.${url}Url`).clear();
-    cy.findByTestId(`config.${url}Url`).type("invalidUrl");
-    this.clickSaveBtn();
-    masthead.checkNotificationMessage(
-      "Could not update the provider The url [" + url + "_url] is malformed",
-      true,
-    );
-    this.clickRevertBtn();
-    //cy.findByTestId(url + "Url").contains
-    //("http://localhost:8180/realms/master/protocol/openid-connect/" + url)
-    return this;
-  }
-
-  public assertOIDCSignatureSwitch() {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    cy.findByTestId(this.#jwksUrl).should("exist");
-    super.assertSwitchStateOn(cy.get(this.#jwksSwitch));
-
-    cy.get(this.#jwksSwitch).parent().click();
-    cy.findByTestId(this.#jwksUrl).should("not.exist");
-    super.assertSwitchStateOff(cy.get(this.#jwksSwitch));
-
-    cy.get(this.#validateSignature).parent().click();
-    cy.findByTestId(this.#jwksUrl).should("not.exist");
-    super.assertSwitchStateOff(cy.get(this.#validateSignature));
-
-    this.clickRevertBtn();
-    cy.findByTestId(this.#jwksUrl).should("exist");
-    return this;
-  }
-
-  public assertOIDCPKCESwitch() {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    super.assertSwitchStateOff(cy.get(this.#pkceSwitch));
-    cy.get(this.#pkceMethod).should("not.exist");
-    cy.get(this.#pkceSwitch).parent().click();
-
-    super.assertSwitchStateOn(cy.get(this.#pkceSwitch));
-    cy.get(this.#pkceMethod).should("exist");
-    return this;
-  }
-
-  public assertOIDCClientAuthentication(option: ClientAuthentication) {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    cy.get(this.#clientAuth)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(option)
-      .click();
-    return this;
-  }
-
-  public assertOIDCClientAuthSignAlg(alg: string) {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    cy.get(this.#clientAssertionSigningAlg)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(alg)
-      .click();
-    return this;
-  }
-
-  public assertOIDCJWTX509HeadersSwitch() {
-    cy.findByTestId("jump-link-openid-connect-settings").click();
-    cy.get(this.#clientAuth)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(ClientAuthentication.post)
-      .click();
-    cy.get(this.#jwtX509HeadersSwitch).should("not.exist");
-    cy.get(this.#clientAuth)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(ClientAuthentication.basicAuth)
-      .click();
-    cy.get(this.#jwtX509HeadersSwitch).should("not.exist");
-    cy.get(this.#clientAuth)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(ClientAuthentication.jwt)
-      .click();
-    cy.get(this.#jwtX509HeadersSwitch).should("not.exist");
-    cy.get(this.#clientAuth)
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(ClientAuthentication.jwtPrivKey)
-      .click();
-    cy.get(this.#jwtX509HeadersSwitch).should("exist");
-
-    super.assertSwitchStateOff(cy.get(this.#jwtX509HeadersSwitch));
-    cy.get(this.#jwtX509HeadersSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#jwtX509HeadersSwitch));
-    return this;
-  }
-
-  public assertOIDCSettingsAdvancedSwitches() {
-    cy.get(this.#advancedSettingsToggle).scrollIntoView().click();
-
-    cy.get(this.#passLoginHintSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#passLoginHintSwitch));
-
-    cy.get(this.#passMaxAgeSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#passMaxAgeSwitch));
-
-    cy.get(this.#passCurrentLocaleSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#passCurrentLocaleSwitch));
-
-    cy.get(this.#backchannelLogoutSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#backchannelLogoutSwitch));
-
-    cy.get(this.#disableUserInfoSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#disableUserInfoSwitch));
-
-    this.clickAcceptsPromptNoneForwardFromClientSwitch();
-    super.assertSwitchStateOn(
-      cy.get(this.#acceptsPromptNoneForwardFromClientSwitch),
-    );
-    return this;
-  }
-
-  public assertAdvancedSettings() {
-    cy.findByTestId("jump-link-advanced-settings").click();
-
-    this.clickStoreTokensSwitch();
-    this.assertStoreTokensSwitchTurnedOn(true);
-    this.clickStoredTokensReadableSwitch();
-    this.assertStoredTokensReadableTurnedOn(true);
-    this.clickIsAccessTokenJWTSwitch();
-    this.assertIsAccessTokenJWTTurnedOn(true);
-    this.clickTrustEmailSwitch();
-    this.assertTrustEmailSwitchTurnedOn(true);
-    this.clickAccountLinkingOnlySwitch();
-    this.assertAccountLinkingOnlySwitchTurnedOn(true);
-    this.clickHideOnLoginPageSwitch();
-    this.assertHideOnLoginPageSwitchTurnedOn(true);
-
-    this.selectFirstLoginFlowOption(LoginFlowOption.browser);
-    this.selectPostLoginFlowOption(LoginFlowOption.directGrant);
-    this.selectSyncModeOption(SyncModeOption.import);
-
-    this.clickRevertBtn();
-    cy.get(this.#advancedSettingsToggle).scrollIntoView().click();
-    this.assertStoreTokensSwitchTurnedOn(false);
-    this.assertStoredTokensReadableTurnedOn(false);
-    this.assertIsAccessTokenJWTTurnedOn(false);
-    this.assertTrustEmailSwitchTurnedOn(false);
-    this.assertAccountLinkingOnlySwitchTurnedOn(false);
-    this.assertHideOnLoginPageSwitchTurnedOn(false);
-
-    this.assertFirstLoginFlowSelectOptionEqual(LoginFlowOption.empty);
-    this.assertPostLoginFlowSelectOptionEqual(LoginFlowOption.none);
-    this.assertSyncModeSelectOptionEqual(SyncModeOption.legacy);
-    this.assertClientAssertSigAlgSelectOptionEqual(
-      ClientAssertionSigningAlg.algorithmNotSpecified,
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseGeneralSettingsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseGeneralSettingsPage.ts
deleted file mode 100644
index 022916b118ec..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/ProviderBaseGeneralSettingsPage.ts
+++ /dev/null
@@ -1,140 +0,0 @@
-import FormValidation from "../../../../forms/FormValidation";
-import PageObject from "../../components/PageObject";
-import Masthead from "../../Masthead";
-
-const masthead = new Masthead();
-
-export default class ProviderBaseGeneralSettingsPage extends PageObject {
-  #redirectUriGroup = ".pf-v5-c-clipboard-copy__group";
-  protected clientIdInput = "config.clientId";
-  protected clientSecretInput = "config.clientSecret";
-  #displayOrderInput = "#kc-display-order";
-  #addBtn = "createProvider";
-  #cancelBtn = "cancel";
-  #requiredFieldErrorMsg = ".pf-v5-c-form__helper-text.pf-m-error";
-  protected requiredFields: string[] = [
-    this.clientIdInput,
-    this.clientSecretInput,
-  ];
-  protected testData = {
-    ClientId: "client",
-    ClientSecret: "client_secret",
-    DisplayOrder: "0",
-  };
-
-  public typeClientId(clientId: string) {
-    if (clientId) {
-      cy.findByTestId(this.clientIdInput).type(clientId);
-    } else {
-      cy.findByTestId(this.clientIdInput).clear();
-    }
-    return this;
-  }
-
-  public typeClientSecret(clientSecret: string) {
-    if (clientSecret) {
-      cy.findByTestId(this.clientSecretInput).type(clientSecret);
-    } else {
-      cy.findByTestId(this.clientSecretInput).clear();
-    }
-    return this;
-  }
-
-  public typeDisplayOrder(displayOrder: string) {
-    cy.get(this.#displayOrderInput).type(displayOrder).blur();
-
-    return this;
-  }
-
-  public clickShowPassword() {
-    cy.findByTestId(this.clientSecretInput).parent().find("button").click();
-    return this;
-  }
-
-  public clickCopyToClipboard() {
-    cy.get(this.#redirectUriGroup).find("button").click();
-    return this;
-  }
-
-  public clickAdd() {
-    cy.findByTestId(this.#addBtn).click();
-    return this;
-  }
-
-  public clickCancel() {
-    cy.findByTestId(this.#cancelBtn).click();
-    return this;
-  }
-
-  public assertRedirectUriInputEqual(value: string) {
-    cy.get(this.#redirectUriGroup).find("input").should("have.value", value);
-    return this;
-  }
-
-  public assertClientIdInputEqual(text: string) {
-    cy.findByTestId(this.clientIdInput).should("have.text", text);
-    return this;
-  }
-
-  public assertClientSecretInputEqual(text: string) {
-    cy.findByTestId(this.clientSecretInput).should("have.text", text);
-    return this;
-  }
-
-  public assertDisplayOrderInputEqual(text: string) {
-    cy.findByTestId(this.clientSecretInput).should("have.text", text);
-    return this;
-  }
-
-  public assertNotificationIdpCreated() {
-    masthead.checkNotificationMessage("Identity provider successfully created");
-    return this;
-  }
-
-  protected assertCommonRequiredFields(requiredFields: string[]) {
-    requiredFields.forEach((elementLocator) => {
-      if (elementLocator.includes("#")) {
-        FormValidation.assertRequired(cy.get(elementLocator));
-      } else {
-        FormValidation.assertRequired(cy.findByTestId(elementLocator));
-      }
-    });
-    return this;
-  }
-
-  public assertRequiredFieldsErrorsExist() {
-    return this.assertCommonRequiredFields(this.requiredFields);
-  }
-
-  protected fillCommonFields(idpName: string) {
-    this.typeClientId(this.testData["ClientId"] + idpName);
-    this.typeClientSecret(this.testData["ClientSecret"] + idpName);
-    this.typeDisplayOrder(this.testData["DisplayOrder"]);
-
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-
-    return this;
-  }
-
-  protected assertCommonFilledDataEqual(idpName: string) {
-    cy.findByTestId(this.clientIdInput).should(
-      "have.value",
-      this.testData["ClientId"] + idpName,
-    );
-    cy.findByTestId(this.clientSecretInput).should("contain.value", "****");
-    cy.get(this.#displayOrderInput).should(
-      "have.value",
-      this.testData["DisplayOrder"],
-    );
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderFacebookGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderFacebookGeneralSettings.ts
deleted file mode 100644
index 8ce90eadc0a3..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderFacebookGeneralSettings.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const additionalUsersProfile_input_test_value =
-  "additionalUsersProfile_input_test_value";
-
-export default class ProviderFacebookGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #additionalUsersProfileFieldsInput = "fetchedFields";
-
-  public typeAdditionalUsersProfileFieldsInput(value: string) {
-    cy.findByTestId(this.#additionalUsersProfileFieldsInput).type(value);
-    cy.findByTestId(this.#additionalUsersProfileFieldsInput).blur();
-    return this;
-  }
-
-  public assertAdditionalUsersProfileFieldsInputEqual(value: string) {
-    cy.findByTestId(this.#additionalUsersProfileFieldsInput).should(
-      "have.value",
-      value,
-    );
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.typeAdditionalUsersProfileFieldsInput(
-      idpName + additionalUsersProfile_input_test_value,
-    );
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertAdditionalUsersProfileFieldsInputEqual(
-      idpName + additionalUsersProfile_input_test_value,
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGithubGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGithubGeneralSettings.ts
deleted file mode 100644
index fc62dd4c5190..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGithubGeneralSettings.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const base_url_input_test_value = "base_url_input_test_value";
-const api_url_input_test_value = "api_url_input_test_value";
-
-export default class ProviderGithubGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #baseUrlInput = "baseUrl";
-  #apiUrlInput = "apiUrl";
-
-  public typeBaseUrlInput(value: string) {
-    cy.findByTestId(this.#baseUrlInput).type(value);
-    cy.findByTestId(this.#baseUrlInput).blur();
-    return this;
-  }
-
-  public typeApiUrlInput(value: string) {
-    cy.findByTestId(this.#apiUrlInput).type(value);
-    cy.findByTestId(this.#apiUrlInput).blur();
-    return this;
-  }
-
-  public assertBaseUrlInputInputEqual(value: string) {
-    cy.findByTestId(this.#baseUrlInput).should("have.value", value);
-    return this;
-  }
-
-  public assertApiUrlInputEqual(value: string) {
-    cy.findByTestId(this.#apiUrlInput).should("have.value", value);
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.typeBaseUrlInput(idpName + base_url_input_test_value);
-    this.typeApiUrlInput(idpName + api_url_input_test_value);
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertBaseUrlInputInputEqual(idpName + base_url_input_test_value);
-    this.assertApiUrlInputEqual(idpName + api_url_input_test_value);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGoogleGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGoogleGeneralSettings.ts
deleted file mode 100644
index 441ed1127ea0..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderGoogleGeneralSettings.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const hosted_domain_input_test_value = "hosted_domain_input_test_value";
-
-export default class ProviderGoogleGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #hostedDomainInput = "hostedDomain";
-  #useUserIpParamSwitch = "userIp";
-  #requestRefreshTokenSwitch = "offlineAccess";
-
-  public typeHostedDomainInput(value: string) {
-    cy.findByTestId(this.#hostedDomainInput).type(value);
-    cy.findByTestId(this.#hostedDomainInput).blur();
-    return this;
-  }
-
-  public clickUseUserIpParamSwitch() {
-    cy.findByTestId(this.#useUserIpParamSwitch).parent().click();
-    return this;
-  }
-
-  public clickRequestRefreshTokenSwitch() {
-    cy.findByTestId(this.#requestRefreshTokenSwitch).parent().click();
-    return this;
-  }
-
-  public assertHostedDomainInputEqual(value: string) {
-    cy.findByTestId(this.#hostedDomainInput).should("have.value", value);
-    return this;
-  }
-
-  public assertUseUserIpParamSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.findByTestId(this.#useUserIpParamSwitch),
-      isOn,
-    );
-    return this;
-  }
-
-  public assertRequestRefreshTokenSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(
-      cy.findByTestId(this.#requestRefreshTokenSwitch),
-      isOn,
-    );
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.typeHostedDomainInput(hosted_domain_input_test_value);
-    this.clickUseUserIpParamSwitch();
-    this.clickRequestRefreshTokenSwitch();
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertHostedDomainInputEqual(hosted_domain_input_test_value);
-    this.assertSwitchStateOn(cy.findByTestId(this.#useUserIpParamSwitch));
-    this.assertSwitchStateOn(cy.findByTestId(this.#requestRefreshTokenSwitch));
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderMicrosoftGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderMicrosoftGeneralSettings.ts
deleted file mode 100644
index 478ce7573d4c..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderMicrosoftGeneralSettings.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const TENANT_ID_VALUE = "12345678-9abc-def0-1234-56789abcdef0";
-
-export default class ProviderMicrosoftGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #tenantIdTestId = "tenantId";
-
-  public typeTenantIdInput(value: string) {
-    cy.findByTestId(this.#tenantIdTestId).type(value).blur();
-    return this;
-  }
-
-  public assertTenantIdInputEqual(value: string) {
-    cy.findByTestId(this.#tenantIdTestId).should("have.value", value);
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.typeTenantIdInput(TENANT_ID_VALUE);
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertTenantIdInputEqual(TENANT_ID_VALUE);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderOpenshiftGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderOpenshiftGeneralSettings.ts
deleted file mode 100644
index 2e49e94c49e1..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderOpenshiftGeneralSettings.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const base_url_input_test_value = "base_url_input_test_value";
-
-export default class ProviderOpenshiftGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #baseUrlInput = "baseUrl";
-
-  constructor() {
-    super();
-  }
-
-  public typeBaseUrlInput(value: string) {
-    cy.findByTestId(this.#baseUrlInput).type(value);
-    cy.findByTestId(this.#baseUrlInput).blur();
-    return this;
-  }
-
-  public assertbaseUrlInputEqual(value: string) {
-    cy.findByTestId(this.#baseUrlInput).should("have.value", value);
-    return this;
-  }
-
-  public assertRequiredFieldsErrorsExist() {
-    return this.assertCommonRequiredFields(this.requiredFields);
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    cy.findByTestId(this.#baseUrlInput).type(
-      idpName + base_url_input_test_value,
-    );
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertbaseUrlInputEqual(idpName + base_url_input_test_value);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderPaypalGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderPaypalGeneralSettings.ts
deleted file mode 100644
index e1eada3d0a0e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderPaypalGeneralSettings.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-export default class ProviderPaypalGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #targetSandboxSwitch = "sandbox";
-
-  public clickTargetSandboxSwitch() {
-    cy.findByTestId(this.#targetSandboxSwitch).parent().click();
-    return this;
-  }
-
-  public assertTargetSandboxSwitchTurnedOn(isOn: boolean) {
-    super.assertSwitchStateOn(cy.findByTestId(this.#targetSandboxSwitch), isOn);
-    return this;
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.clickTargetSandboxSwitch();
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertSwitchStateOn(cy.findByTestId(this.#targetSandboxSwitch));
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderSAMLSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderSAMLSettings.ts
deleted file mode 100644
index e8a9e3f29e33..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderSAMLSettings.ts
+++ /dev/null
@@ -1,231 +0,0 @@
-import Select from "../../../../../forms/Select";
-import PageObject from "../../../components/PageObject";
-import Masthead from "../../../Masthead";
-
-const masthead = new Masthead();
-
-export default class ProviderSAMLSettings extends PageObject {
-  #samlSwitch = "Saml-switch";
-  #modalConfirm = "#modal-confirm";
-  #serviceProviderEntityID = "config.entityId";
-  #identityProviderEntityId = "identityProviderEntityId";
-  #ssoServiceUrl = "config.singleSignOnServiceUrl";
-  #singleLogoutServiceUrl = "config.singleLogoutServiceUrl";
-  #nameIdPolicyFormat = "#nameIDPolicyFormat";
-  #principalType = "#principalType";
-
-  #allowCreate = "config.allowCreate";
-  #httpPostBindingResponse = "config.postBindingResponse";
-  #httpPostBindingAuthnRequest = "config.postBindingAuthnRequest";
-  #httpPostBindingLogout = "config.postBindingLogout";
-  #wantAuthnRequestsSigned = "config.wantAuthnRequestsSigned";
-
-  #signatureAlgorithm = "#signatureAlgorithm";
-  #samlSignatureKeyName = "#xmlSigKeyInfoKeyNameTransformer";
-
-  #wantAssertionsSigned = "config.wantAssertionsSigned";
-  #wantAssertionsEncrypted = "config.wantAssertionsEncrypted";
-  #forceAuthentication = "config.forceAuthn";
-  #validateSignature = "config.validateSignature";
-  #validatingX509Certs = "config.signingCertificate";
-  #signServiceProviderMetadata = "config.signSpMetadata";
-  #passSubject = "config.loginHint";
-  #allowedClockSkew = "#config\\.allowedClockSkew";
-  #attributeConsumingServiceIndex = "#config\\.attributeConsumingServiceIndex";
-  #attributeConsumingServiceName = "config.attributeConsumingServiceName";
-
-  #comparison = "#comparison";
-  #saveBtn = "idp-details-save";
-  #revertBtn = "idp-details-revert";
-
-  public clickSaveBtn() {
-    cy.findByTestId(this.#saveBtn).click();
-  }
-
-  public clickRevertBtn() {
-    cy.findByTestId(this.#revertBtn).click();
-  }
-
-  public enableProviderSwitch() {
-    cy.findByTestId(this.#samlSwitch).parent().click();
-    masthead.checkNotificationMessage("Provider successfully updated");
-  }
-
-  public disableProviderSwitch() {
-    cy.findByTestId(this.#samlSwitch).parent().click();
-    cy.get(this.#modalConfirm).click();
-    masthead.checkNotificationMessage("Provider successfully updated");
-  }
-
-  public typeServiceProviderEntityId(entityId: string) {
-    cy.findByTestId(this.#serviceProviderEntityID)
-      .click()
-      .clear()
-      .type(entityId);
-    return this;
-  }
-
-  public typeIdentityProviderEntityId(entityId: string) {
-    cy.findByTestId(this.#identityProviderEntityId)
-      .click()
-      .clear()
-      .type(entityId);
-    return this;
-  }
-
-  public typeSsoServiceUrl(url: string) {
-    cy.findByTestId(this.#ssoServiceUrl).clear().type(url);
-    return this;
-  }
-
-  public typeSingleLogoutServiceUrl(url: string) {
-    cy.findByTestId(this.#singleLogoutServiceUrl).clear().type(url);
-    return this;
-  }
-
-  public typeX509Certs(cert: string) {
-    cy.findByTestId(this.#validatingX509Certs).clear();
-    cy.findByTestId(this.#validatingX509Certs).type(cert);
-    return this;
-  }
-
-  public selectNamePolicyIdFormat(option: string) {
-    cy.get(this.#nameIdPolicyFormat).scrollIntoView();
-    Select.selectItem(cy.get(this.#nameIdPolicyFormat), option);
-    Select.assertSelectedItem(cy.get(this.#nameIdPolicyFormat), option);
-    return this;
-  }
-
-  public selectPrincipalFormat(option: string) {
-    cy.get(this.#principalType).scrollIntoView();
-    Select.selectItem(cy.get(this.#principalType), option);
-    Select.assertSelectedItem(cy.get(this.#principalType), option);
-    return this;
-  }
-
-  public selectSignatureAlgorithm(algorithm: string) {
-    cy.get(this.#signatureAlgorithm).scrollIntoView();
-    Select.selectItem(cy.get(this.#signatureAlgorithm), algorithm);
-  }
-
-  public selectSAMLSignature(key: string) {
-    cy.get(this.#samlSignatureKeyName).scrollIntoView();
-    Select.selectItem(cy.get(this.#samlSignatureKeyName), key);
-  }
-
-  public selectComparison(comparison: string) {
-    cy.get(this.#comparison).scrollIntoView().click();
-    cy.findByText(comparison).scrollIntoView().click();
-  }
-
-  public assertIdAndURLFields() {
-    const ssoServiceUrlError =
-      "Could not update the provider The url [singleSignOnServiceUrl] is malformed";
-    const singleLogoutServiceUrlError =
-      "Could not update the provider The url [singleLogoutServiceUrl] is malformed";
-    this.typeServiceProviderEntityId("ServiceProviderEntityId");
-    this.typeIdentityProviderEntityId("IdentityProviderEntityId");
-    this.clickSaveBtn();
-
-    this.typeSsoServiceUrl("Not a real URL");
-    this.clickSaveBtn();
-    masthead.checkNotificationMessage(ssoServiceUrlError);
-    this.clickRevertBtn();
-
-    this.typeSingleLogoutServiceUrl("Not a real URL");
-    this.clickSaveBtn();
-    masthead.checkNotificationMessage(singleLogoutServiceUrlError);
-    return this;
-  }
-
-  public assertNameIdPolicyFormat() {
-    this.selectNamePolicyIdFormat("Transient");
-    this.selectNamePolicyIdFormat("Email");
-    this.selectNamePolicyIdFormat("Kerberos");
-    this.selectNamePolicyIdFormat("X.509 Subject Name");
-    this.selectNamePolicyIdFormat("Windows Domain Qualified Name");
-    this.selectNamePolicyIdFormat("Unspecified");
-    this.selectNamePolicyIdFormat("Persistent");
-    return this;
-  }
-
-  public assertSignatureAlgorithm() {
-    cy.findByTestId(this.#wantAuthnRequestsSigned).parent().click();
-    cy.get(this.#signatureAlgorithm).should("not.exist");
-    cy.get(this.#samlSignatureKeyName).should("not.exist");
-    this.clickRevertBtn();
-    cy.get(this.#signatureAlgorithm).should("exist");
-    cy.get(this.#samlSignatureKeyName).should("exist");
-
-    this.selectSignatureAlgorithm("RSA_SHA1");
-    this.selectSignatureAlgorithm("RSA_SHA256");
-    this.selectSignatureAlgorithm("RSA_SHA256_MGF1");
-    this.selectSignatureAlgorithm("RSA_SHA512");
-    this.selectSignatureAlgorithm("RSA_SHA512_MGF1");
-    this.selectSignatureAlgorithm("DSA_SHA1");
-
-    this.selectSAMLSignature("NONE");
-    this.selectSAMLSignature("KEY_ID");
-    this.selectSAMLSignature("CERT_SUBJECT");
-
-    return this;
-  }
-
-  public assertPrincipalType() {
-    this.selectPrincipalFormat("Subject NameID");
-    this.selectPrincipalFormat("Attribute [Name]");
-    this.selectPrincipalFormat("Attribute [Friendly Name]");
-    return this;
-  }
-
-  public assertSAMLSwitches() {
-    cy.findByTestId(this.#allowCreate).parent().click();
-    cy.findByTestId(this.#httpPostBindingResponse).parent().click();
-    cy.findByTestId(this.#httpPostBindingLogout).parent().click();
-    cy.findByTestId(this.#httpPostBindingAuthnRequest).parent().click();
-
-    cy.findByTestId(this.#wantAssertionsSigned).parent().click();
-    cy.findByTestId(this.#wantAssertionsEncrypted).parent().click();
-    cy.findByTestId(this.#forceAuthentication).parent().click();
-
-    cy.findByTestId(this.#signServiceProviderMetadata).parent().click();
-    cy.findByTestId(this.#passSubject).parent().click();
-
-    return this;
-  }
-
-  public assertValidateSignatures() {
-    cy.findByTestId(this.#validateSignature).parent().click();
-    cy.findByTestId(this.#validatingX509Certs).should("not.exist");
-    cy.findByTestId(this.#validateSignature).parent().click();
-    this.typeX509Certs("X509 Certificate");
-    this.clickRevertBtn();
-    cy.findByTestId(this.#validatingX509Certs);
-    this.clickSaveBtn();
-    return this;
-  }
-
-  public assertTextFields() {
-    cy.get(this.#allowedClockSkew)
-      .find("input")
-      .should("have.value", 0)
-      .clear()
-      .type("111");
-
-    cy.get(this.#attributeConsumingServiceIndex)
-      .find("input")
-      .should("have.value", 0)
-      .clear()
-      .type("111");
-
-    cy.findByTestId(this.#attributeConsumingServiceName).click().type("name");
-  }
-
-  public assertAuthnContext() {
-    this.selectComparison("minimum");
-    this.selectComparison("maximum");
-    this.selectComparison("better");
-    this.selectComparison("exact");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderStackoverflowGeneralSettings.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderStackoverflowGeneralSettings.ts
deleted file mode 100644
index fee4b3d769c8..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/identity_providers/social/ProviderStackoverflowGeneralSettings.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import ProviderBaseGeneralSettingsPage from "../ProviderBaseGeneralSettingsPage";
-
-const key_input_test_value = "key_input_test_value";
-
-export default class ProviderStackoverflowGeneralSettings extends ProviderBaseGeneralSettingsPage {
-  #keyInput = "key";
-
-  constructor() {
-    super();
-  }
-
-  public typeKeyInput(value: string) {
-    cy.findByTestId(this.#keyInput).type(value);
-    cy.findByTestId(this.#keyInput).blur();
-    return this;
-  }
-
-  public assertKeyInputEqual(value: string) {
-    cy.findByTestId(this.#keyInput).should("have.value", value);
-    return this;
-  }
-
-  public assertRequiredFieldsErrorsExist() {
-    return this.assertCommonRequiredFields(this.requiredFields);
-  }
-
-  public fillData(idpName: string) {
-    this.fillCommonFields(idpName);
-    this.typeKeyInput(idpName + key_input_test_value);
-    return this;
-  }
-
-  public assertFilledDataEqual(idpName: string) {
-    this.assertCommonFilledDataEqual(idpName);
-    this.assertKeyInputEqual(idpName + key_input_test_value);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/IdentityProviderTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/IdentityProviderTab.ts
deleted file mode 100644
index e793352a31f0..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/IdentityProviderTab.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import Select from "../../../../forms/Select";
-import CommonPage from "../../../CommonPage";
-
-export default class IdentityProviderTab extends CommonPage {
-  goToTab() {
-    cy.findByTestId("identityProvidersTab").click();
-  }
-
-  fillForm(data: { name: string; domain: string; public: boolean }) {
-    Select.selectItem(cy.findByTestId("alias"), data.name);
-    Select.selectItem(cy.get("#kc🍺org🍺domain"), data.domain);
-    if (data.public) {
-      cy.findByAltText("config.kc🍺org🍺broker🍺public").click();
-    }
-  }
-
-  assertAddedSuccess() {
-    this.masthead().checkNotificationMessage(
-      "Identity provider successfully linked to organization",
-    );
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/MemberTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/MemberTab.ts
deleted file mode 100644
index 193d120ef47d..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/MemberTab.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-export default class MembersTab extends CommonPage {
-  goToTab() {
-    cy.findByTestId("membersTab").click();
-  }
-
-  clickAddRealmUser() {
-    cy.findByTestId("add-realm-user-empty-action").click();
-  }
-
-  assertMemberAddedSuccess() {
-    this.masthead().checkNotificationMessage(
-      "1 user added to the organization",
-    );
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/OrganizationPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/OrganizationPage.ts
deleted file mode 100644
index d2a677731cf6..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/organization/OrganizationPage.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-import CommonPage from "../../../CommonPage";
-
-export default class OrganizationPage extends CommonPage {
-  #nameField = "[data-testid='name']";
-
-  goToTab() {
-    cy.get("#nav-item-organizations").click();
-  }
-
-  goToCreate(empty: boolean = true) {
-    cy.findByTestId(
-      empty ? "no-organizations-empty-action" : "addOrganization",
-    ).click();
-  }
-
-  fillCreatePage(values: {
-    name: string;
-    domain?: string[];
-    description?: string;
-  }) {
-    this.fillNameField(values.name);
-    values.domain?.forEach((d, index) => {
-      cy.findByTestId(`domains${index}`).type(d);
-      if (index !== (values.domain?.length || 0) - 1)
-        cy.findByTestId("addValue").click();
-    });
-    if (values.description)
-      cy.findByTestId("description").type(values.description);
-  }
-
-  getNameField() {
-    return cy.get(this.#nameField);
-  }
-
-  fillNameField(name: string) {
-    cy.get(this.#nameField).clear().type(name);
-    return this.getNameField();
-  }
-
-  assertSaveSuccess() {
-    this.masthead().checkNotificationMessage(
-      "Organization successfully saved.",
-    );
-  }
-
-  assertDeleteSuccess() {
-    this.masthead().checkNotificationMessage(
-      "The organization has been deleted",
-    );
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/PriorityDialog.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/PriorityDialog.ts
deleted file mode 100644
index f85114bb52cc..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/PriorityDialog.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-const expect = chai.expect;
-
-export default class PriorityDialog {
-  #managePriorityOrder = "viewHeader-lower-btn";
-  #list = "manageOrderDataList";
-
-  openDialog() {
-    cy.findByTestId(this.#managePriorityOrder).click({ force: true });
-    return this;
-  }
-
-  moveRowTo(from: string, to: string) {
-    cy.findByTestId(to).as("target");
-    cy.findByTestId(from).drag("@target");
-    return this;
-  }
-
-  clickSave() {
-    cy.get("#modal-confirm").click({ force: true });
-    return this;
-  }
-
-  checkOrder(providerNames: string[]) {
-    cy.get(`[data-testid=${this.#list}] li`).should((providers) => {
-      expect(providers).to.have.length(providerNames.length);
-      for (let index = 0; index < providerNames.length; index++) {
-        expect(providers.eq(index)).to.contain(providerNames[index]);
-      }
-    });
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/ProviderPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/ProviderPage.ts
deleted file mode 100644
index 074e1714b303..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/providers/ProviderPage.ts
+++ /dev/null
@@ -1,486 +0,0 @@
-export default class ProviderPage {
-  // KerberosSettingsRequired input values
-  #kerberosNameInput = "name";
-  #kerberosRealmInput = "config.kerberosRealm.0";
-  #kerberosPrincipalInput = "config.serverPrincipal.0";
-  #kerberosKeytabInput = "config.keyTab.0";
-
-  // LdapSettingsGeneral input values
-  #ldapNameInput = "name";
-  #ldapVendorInput = "#kc-vendor";
-
-  // LdapSettingsConnection input values
-  connectionUrlInput = "config.connectionUrl.0";
-  truststoreSpiInput = "#useTruststoreSpi";
-  connectionTimeoutInput = "config.connectionTimeout.0";
-  bindTypeInput = "#kc-bind-type";
-  bindDnInput = "config.bindDn.0";
-  bindCredsInput = "config.bindCredential.0";
-  #testConnectionBtn = "test-connection-button";
-  #testAuthBtn = "test-auth-button";
-
-  // LdapSettingsSearching input values
-  ldapEditModeInput = "#editMode";
-  ldapSearchScopeInput = "#kc-search-scope";
-  ldapPagination = "ui-pagination";
-  ldapUsersDnInput = "config.usersDn.0";
-  ldapUserLdapAttInput = "config.usernameLDAPAttribute.0";
-  ldapRdnLdapAttInput = "config.rdnLDAPAttribute.0";
-  ldapUuidLdapAttInput = "config.uuidLDAPAttribute.0";
-  ldapUserObjClassesInput = "config.userObjectClasses.0";
-  ldapUserLdapFilter = "config.customUserSearchFilter.0";
-  ldapReadTimeout = "config.readTimeout.0";
-
-  // LdapSettingsKerberosIntegration input values
-  ldapKerberosRealmInput = "config.kerberosRealm.0";
-  ldapServerPrincipalInput = "config.serverPrincipal.0";
-  ldapKeyTabInput = "config.keyTab.0";
-  allowKerberosAuth = "allow-kerberos-auth";
-  debug = "debug";
-  useKerberosForPwAuth = "use-kerberos-pw-auth";
-
-  // LdapSettingsSynchronization input values
-  ldapBatchSizeInput = "config.batchSizeForSync.0";
-  ldapFullSyncPeriodInput = "config.fullSyncPeriod.0";
-  ldapUsersSyncPeriodInput = "config.changedSyncPeriod.0";
-  importUsers = "import-users";
-  periodicFullSync = "periodic-full-sync";
-  periodicUsersSync = "periodic-changed-users-sync";
-
-  // SettingsCache input values
-  #cacheDayInput = "#kc-eviction-day";
-  #cacheHourInput = "#kc-eviction-hour";
-  #cacheMinuteInput = "#kc-eviction-minute";
-  #cachePolicyInput = "#kc-cache-policy";
-
-  // Mapper input values
-  #userModelAttInput = "config.user🍺model🍺attribute";
-  #ldapAttInput = "ldap.attribute";
-  #userModelAttNameInput = "config.user🍺model🍺attribute";
-  #attValueInput = "attribute.value";
-  #ldapFullNameAttInput = "ldap.full.name.attribute";
-  #ldapAttNameInput = "ldap.attribute.name";
-  #ldapAttValueInput = "ldap.attribute.value";
-  #groupInput = "group";
-  #ldapGroupsDnInput = "groups.dn";
-  #ldapRolesDnInput = "roles.dn";
-
-  // Mapper types
-  #msadUserAcctMapper = "msad-user-account-control-mapper";
-  #msadLdsUserAcctMapper = "msad-lds-user-account-control-mapper";
-  #userAttLdapMapper = "user-attribute-ldap-mapper";
-  #hcAttMapper = "hardcoded-attribute-mapper";
-  #certLdapMapper = "certificate-ldap-mapper";
-  #fullNameLdapMapper = "full-name-ldap-mapper";
-  #hcLdapAttMapper = "hardcoded-ldap-attribute-mapper";
-  #hcLdapGroupMapper = "hardcoded-ldap-group-mapper";
-  #groupLdapMapper = "group-ldap-mapper";
-  #roleLdapMapper = "role-ldap-mapper";
-  #hcLdapRoleMapper = "hardcoded-ldap-role-mapper";
-
-  #actionDropdown = "action-dropdown";
-  #deleteCmd = "delete-cmd";
-
-  #mappersTab = "ldap-mappers-tab";
-  #rolesTab = "rolesTab";
-  #createRoleBtn = "no-roles-for-this-client-empty-action";
-  #roleSaveBtn = "save";
-  #roleNameField = "name";
-
-  #groupName = "aa-uf-mappers-group";
-  #clientName = "aa-uf-mappers-client";
-
-  #maxLifespan = "kerberos-cache-lifespan";
-
-  // Kerberos settings switch input values
-  debugSwitch = "debug";
-  firstLoginSwitch = "update-first-login";
-  passwordAuthSwitch = "allow-password-authentication";
-
-  // LDAP switch input values
-  enableStartTls = "enable-start-tls";
-  connectionPooling = "connection-pooling";
-
-  // LDAP advanced settings switch input values
-  ldapv3PwSwitch = "ldapv3-password";
-  validatePwPolicySwitch = "password-policy";
-  trustEmailSwitch = "trust-email";
-
-  changeCacheTime(unit: string, time: string) {
-    switch (unit) {
-      case "day":
-        cy.get(this.#cacheDayInput).click();
-        cy.get(this.#cacheDayInput).parent().find("ul").contains(time).click();
-        break;
-      case "hour":
-        cy.get(this.#cacheHourInput).click();
-        cy.get(this.#cacheHourInput).parent().find("ul").contains(time).click();
-        break;
-      case "minute":
-        cy.get(this.#cacheMinuteInput).click();
-        cy.get(this.#cacheMinuteInput)
-          .parent()
-          .find("ul")
-          .contains(time)
-          .click();
-        break;
-      default:
-        console.log("Invalid cache time, must be 'day', 'hour', or 'minute'.");
-        break;
-    }
-    return this;
-  }
-
-  verifyChangedHourInput(expected: string, unexpected: string) {
-    expect(cy.get(this.#cacheHourInput).contains(expected).should("exist"));
-    expect(
-      cy.get(this.#cacheHourInput).contains(unexpected).should("not.exist"),
-    );
-    return this;
-  }
-
-  deleteCardFromCard(card: string) {
-    cy.findByTestId(`${card}-dropdown`).click();
-    cy.findByTestId("card-delete").click();
-    return this;
-  }
-
-  deleteCardFromMenu(card: string) {
-    this.clickExistingCard(card);
-    cy.findByTestId(this.#actionDropdown).click();
-    cy.findByTestId(this.#deleteCmd).click();
-    return this;
-  }
-
-  fillKerberosRequiredData(
-    name: string,
-    realm: string,
-    principal: string,
-    keytab: string,
-  ) {
-    if (name) {
-      cy.findByTestId(this.#kerberosNameInput).clear().type(name);
-    }
-    if (realm) {
-      cy.findByTestId(this.#kerberosRealmInput).clear().type(realm);
-    }
-    if (principal) {
-      cy.findByTestId(this.#kerberosPrincipalInput).clear().type(principal);
-    }
-    if (keytab) {
-      cy.findByTestId(this.#kerberosKeytabInput).clear().type(keytab);
-    }
-    return this;
-  }
-
-  fillMaxLifespanData(lifespan: number) {
-    for (let i = 0; i < lifespan; i++) {
-      cy.findByTestId(this.#maxLifespan).click();
-    }
-    return this;
-  }
-
-  fillSelect(selectField: string, value: string) {
-    cy.get(selectField).click();
-    cy.get(selectField).parent().find("ul").contains(value).click();
-  }
-
-  fillTextField(textField: string, value: string) {
-    cy.findByTestId(textField).type("x");
-    cy.findByTestId(textField).clear().type(value).blur();
-    return this;
-  }
-
-  toggleSwitch(switchName: string) {
-    cy.findByTestId(switchName).click({ force: true });
-    return this;
-  }
-
-  verifyToggle(switchName: string, value: "on" | "off") {
-    cy.findByTestId(switchName).should("have.value", value);
-    return this;
-  }
-
-  verifyTextField(fieldName: string, value: string) {
-    cy.findByTestId(fieldName).should("have.value", value);
-  }
-
-  verifySelect(selectInput: string, value: string) {
-    cy.get(selectInput).should("contain", value);
-  }
-
-  fillLdapGeneralData(name: string, vendor?: string) {
-    cy.findByTestId(this.#ldapNameInput).clear().type(name);
-    if (vendor) {
-      cy.get(this.#ldapVendorInput).click();
-      cy.get(this.#ldapVendorInput)
-        .parent()
-        .find("ul")
-        .contains(vendor)
-        .click();
-    }
-    return this;
-  }
-
-  fillLdapConnectionData(
-    connectionUrl: string,
-    bindType: string,
-    truststoreSpi?: string,
-    connectionTimeout?: string,
-    bindDn?: string,
-    bindCreds?: string,
-  ) {
-    cy.findByTestId(this.connectionUrlInput).clear().type(connectionUrl);
-
-    cy.get(this.bindTypeInput).click();
-    cy.get(this.bindTypeInput).parent().find("ul").contains(bindType).click();
-
-    if (truststoreSpi) {
-      cy.get(this.truststoreSpiInput).click();
-      cy.get(this.truststoreSpiInput)
-        .parent()
-        .find("ul")
-        .contains(truststoreSpi)
-        .click();
-    }
-    if (connectionTimeout) {
-      cy.findByTestId(this.connectionTimeoutInput)
-        .clear()
-        .type(connectionTimeout);
-    }
-    if (bindDn) {
-      cy.findByTestId(this.bindDnInput).clear().type(bindDn);
-    }
-    if (bindCreds) {
-      cy.findByTestId(this.bindCredsInput).clear().type(bindCreds);
-    }
-    return this;
-  }
-
-  fillLdapSearchingData(
-    editMode: string,
-    usersDn: string,
-    userLdapAtt?: string,
-    rdnLdapAtt?: string,
-    uuidLdapAtt?: string,
-    userObjClasses?: string,
-    userLdapFilter?: string,
-    searchScope?: string,
-    readTimeout?: string,
-  ) {
-    cy.get(this.ldapEditModeInput).click();
-    cy.get(this.ldapEditModeInput)
-      .parent()
-      .find("ul")
-      .contains(editMode)
-      .click();
-    cy.findByTestId(this.ldapUsersDnInput).clear().type(usersDn);
-    if (userLdapAtt) {
-      cy.findByTestId(this.ldapUserLdapAttInput).clear().type(userLdapAtt);
-    }
-    if (rdnLdapAtt) {
-      cy.findByTestId(this.ldapRdnLdapAttInput).clear().type(rdnLdapAtt);
-    }
-    if (uuidLdapAtt) {
-      cy.findByTestId(this.ldapUuidLdapAttInput).clear().type(uuidLdapAtt);
-    }
-    if (userObjClasses) {
-      cy.findByTestId(this.ldapUserObjClassesInput)
-        .clear()
-        .type(userObjClasses);
-    }
-    if (userLdapFilter) {
-      cy.findByTestId(this.ldapUserLdapFilter).clear().type(userLdapFilter);
-    }
-    if (searchScope) {
-      cy.get(this.ldapSearchScopeInput).click();
-      cy.get(this.ldapSearchScopeInput)
-        .parent()
-        .find("ul")
-        .contains(searchScope)
-        .click();
-    }
-    if (readTimeout) {
-      cy.findByTestId(this.ldapReadTimeout).clear().type(readTimeout);
-    }
-    return this;
-  }
-
-  selectCacheType(cacheType: string) {
-    cy.get(this.#cachePolicyInput).click();
-    cy.get(this.#cachePolicyInput)
-      .parent()
-      .find("ul")
-      .contains(cacheType)
-      .click();
-    return this;
-  }
-
-  goToMappers() {
-    cy.findByTestId(this.#mappersTab).click();
-  }
-
-  createRole(roleName: string) {
-    cy.findByTestId(this.#rolesTab).click();
-    cy.wait(1000);
-    cy.findByTestId(this.#createRoleBtn).click();
-    cy.wait(1000);
-    cy.findByTestId(this.#roleNameField).clear().type(roleName);
-    cy.wait(1000);
-    cy.findByTestId(this.#roleSaveBtn).click();
-    cy.wait(1000);
-  }
-
-  createNewMapper(mapperType: string) {
-    const userModelAttValue = "middleName";
-    const ldapAttValue = "cn";
-    const ldapDnValue = "ou=groups";
-
-    cy.contains("Add").click();
-    cy.wait(1000);
-
-    cy.get("#kc-providerId").click();
-    cy.get("button").contains(mapperType).click();
-
-    cy.findByTestId("name").clear().type(`${mapperType}-test`);
-
-    switch (mapperType) {
-      case this.#msadUserAcctMapper:
-      case this.#msadLdsUserAcctMapper:
-        break;
-      case this.#userAttLdapMapper:
-      case this.#certLdapMapper:
-        cy.findByTestId(this.#userModelAttInput)
-          .clear()
-          .type(userModelAttValue);
-        cy.findByTestId(this.#ldapAttInput).clear().type(ldapAttValue);
-        break;
-      case this.#hcAttMapper:
-        cy.findByTestId(this.#userModelAttNameInput)
-          .clear()
-          .type(userModelAttValue);
-        cy.findByTestId(this.#attValueInput).clear().type(ldapAttValue);
-        break;
-      case this.#fullNameLdapMapper:
-        cy.findByTestId(this.#ldapFullNameAttInput).clear().type(ldapAttValue);
-        break;
-      case this.#hcLdapAttMapper:
-        cy.findByTestId(this.#ldapAttNameInput).clear().type(userModelAttValue);
-        cy.findByTestId(this.#ldapAttValueInput).clear().type(ldapAttValue);
-        break;
-      case this.#hcLdapGroupMapper:
-        cy.findByTestId(this.#groupInput).clear().type(this.#groupName);
-        break;
-      case this.#groupLdapMapper:
-        cy.findByTestId(this.#ldapGroupsDnInput).clear().type(ldapDnValue);
-        break;
-
-      case this.#roleLdapMapper:
-        cy.findByTestId(this.#ldapRolesDnInput).clear().type(ldapDnValue);
-        cy.get(".pf-v5-c-form__group")
-          .contains("Client ID")
-          .parent()
-          .parent()
-          .find("input")
-          .click();
-        cy.get("button").contains(this.#clientName).click({ force: true });
-        break;
-
-      case this.#hcLdapRoleMapper:
-        cy.findByTestId("add-roles").click();
-        cy.get("[aria-label='Select row 1']").click();
-        cy.findByTestId("assign").click();
-        break;
-      default:
-        console.log("Invalid mapper type.");
-        break;
-    }
-  }
-
-  updateMapper(mapperType: string) {
-    const userModelAttValue = "lastName";
-    const ldapAttValue = "sn";
-
-    switch (mapperType) {
-      case this.#msadUserAcctMapper:
-      case this.#msadLdsUserAcctMapper:
-        break;
-      case this.#userAttLdapMapper:
-      case this.#certLdapMapper:
-        cy.findByTestId(this.#userModelAttInput)
-          .clear()
-          .type(userModelAttValue);
-        cy.findByTestId(this.#ldapAttInput).clear().type(ldapAttValue);
-        break;
-      case this.#hcAttMapper:
-        cy.findByTestId(this.#userModelAttNameInput)
-          .clear()
-          .type(userModelAttValue);
-        cy.findByTestId(this.#attValueInput).clear().type(ldapAttValue);
-        break;
-      case this.#fullNameLdapMapper:
-        cy.findByTestId(this.#ldapFullNameAttInput).clear().type(ldapAttValue);
-        break;
-      case this.#hcLdapAttMapper:
-        cy.findByTestId(this.#ldapAttNameInput).clear().type(userModelAttValue);
-        cy.findByTestId(this.#ldapAttValueInput).clear().type(ldapAttValue);
-        break;
-      default:
-        console.log("Invalid mapper name.");
-        break;
-    }
-  }
-
-  clickExistingCard(cardName: string) {
-    cy.findByTestId("keycloak-card-title").contains(cardName).click();
-    cy.wait(1000);
-    return this;
-  }
-
-  clickMenuCommand(menu: string, command: string) {
-    cy.contains("button", menu).click();
-    cy.contains("li", command).click();
-    return this;
-  }
-
-  clickNewCard(providerType: string) {
-    cy.findByTestId(`${providerType}-card`).click();
-    cy.wait(1000);
-    return this;
-  }
-
-  assertCardContainsText(providerType: string, expectedText: string) {
-    cy.findByTestId(`${providerType}-card`).should("contain", expectedText);
-    return this;
-  }
-
-  disableEnabledSwitch(providerType: string) {
-    cy.get(`#${providerType}-switch`).uncheck({ force: true });
-    return this;
-  }
-
-  enableEnabledSwitch(providerType: string) {
-    cy.get(`#${providerType}-switch`).check({ force: true });
-    return this;
-  }
-
-  save(providerType: string) {
-    cy.findByTestId(`${providerType}-save`).click();
-    return this;
-  }
-
-  cancel(providerType: string) {
-    cy.findByTestId(`${providerType}-cancel`).click();
-    return this;
-  }
-
-  testConnection() {
-    cy.findByTestId(this.#testConnectionBtn).click();
-    return this;
-  }
-
-  testAuthorization() {
-    cy.findByTestId(this.#testAuthBtn).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/AssociatedRolesPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/AssociatedRolesPage.ts
deleted file mode 100644
index 6a40e0874d83..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/AssociatedRolesPage.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-export default class AssociatedRolesPage {
-  #addRoleToolbarButton = "assignRole";
-  #addAssociatedRolesModalButton = "assign";
-  #compositeRoleBadge = "composite-role-badge";
-  #filterTypeDropdown = "filter-type-dropdown";
-  #filterTypeDropdownItem = "clients";
-  #usersPage = "users-page";
-  #removeRolesButton = "unAssignRole";
-  #addRoleTable = '[aria-label="Roles"] td';
-  #associatedRolesTab = "associatedRolesTab";
-  #assignRole = "no-roles-in-this-realm-empty-action";
-
-  addAssociatedRealmRole(roleName: string) {
-    cy.findByTestId(this.#associatedRolesTab).should("exist").click();
-
-    cy.findByTestId(this.#assignRole).click();
-
-    cy.findByTestId(this.#filterTypeDropdown).click();
-
-    cy.findByTestId(this.#filterTypeDropdownItem).click();
-
-    cy.get(this.#addRoleTable)
-      .contains(roleName)
-      .parents("tr")
-      .within(() => {
-        cy.get("input").click();
-      });
-    cy.findByTestId(this.#addAssociatedRolesModalButton).click();
-
-    cy.url().should("include", "/associated-roles");
-
-    cy.findByTestId(this.#compositeRoleBadge).should(
-      "contain.text",
-      "Composite",
-    );
-
-    return this;
-  }
-
-  addAssociatedRoleFromSearchBar(roleName: string, isClientRole?: boolean) {
-    cy.findByTestId(this.#addRoleToolbarButton).click({ force: true });
-
-    if (!isClientRole) {
-      cy.findByTestId(this.#filterTypeDropdown).click();
-      cy.findByTestId(this.#filterTypeDropdownItem).click();
-    }
-
-    cy.findByTestId(".pf-v5-c-spinner__tail-ball").should("not.exist");
-
-    cy.get(this.#addRoleTable)
-      .contains(roleName)
-      .parents("tr")
-      .within(() => {
-        cy.get("input").click();
-      });
-
-    cy.findByTestId(this.#addAssociatedRolesModalButton).click();
-
-    cy.contains("Users in role").click();
-    cy.findByTestId(this.#usersPage).should("exist");
-  }
-
-  addAssociatedClientRole(roleName: string) {
-    cy.findByTestId(this.#addRoleToolbarButton).click();
-
-    cy.findByTestId(".pf-v5-c-spinner__tail-ball").should("not.exist");
-
-    cy.get(this.#addRoleTable)
-      .contains(roleName)
-      .parents("tr")
-      .within(() => {
-        cy.get("input").click();
-      });
-
-    cy.findByTestId(this.#addAssociatedRolesModalButton).click();
-
-    cy.contains("Users in role").click();
-    cy.findByTestId(this.#usersPage).should("exist");
-  }
-
-  removeAssociatedRoles() {
-    cy.findByTestId(this.#removeRolesButton).click();
-    return this;
-  }
-
-  isRemoveAssociatedRolesBtnDisabled() {
-    cy.findByTestId(this.#removeRolesButton).should(
-      "have.class",
-      "pf-m-disabled",
-    );
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/CreateRealmRolePage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/CreateRealmRolePage.ts
deleted file mode 100644
index bc527fd6907e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_roles/CreateRealmRolePage.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-class CreateRealmRolePage {
-  #realmRoleNameInput = "name";
-  #realmRoleNameError = "#name-helper";
-  #realmRoleDescriptionInput = "description";
-  #saveBtn = "save";
-  #cancelBtn = "cancel";
-
-  //#region General Settings
-  fillRealmRoleData(name: string, description = "") {
-    cy.findByTestId(this.#realmRoleNameInput).clear();
-
-    if (name) {
-      cy.findByTestId(this.#realmRoleNameInput).type(name);
-    }
-
-    if (description !== "") {
-      this.updateDescription(description);
-    }
-    return this;
-  }
-
-  checkRealmRoleNameRequiredMessage() {
-    cy.findByTestId(this.#realmRoleNameInput)
-      .parent()
-      .should("have.class", "pf-v5-c-form-control pf-m-error");
-
-    return this;
-  }
-  //#endregion
-
-  clickActionMenu(item: string) {
-    cy.findByTestId("action-dropdown")
-      .click()
-      .parent()
-      .within(() => {
-        cy.findByText(item).click();
-      });
-    return this;
-  }
-
-  checkNameDisabled() {
-    cy.findByTestId(this.#realmRoleNameInput).should(
-      "have.attr",
-      "disabled",
-      "disabled",
-    );
-    return this;
-  }
-
-  checkDescription(description: string) {
-    cy.findByTestId(this.#realmRoleDescriptionInput).should(
-      "have.value",
-      description,
-    );
-    return this;
-  }
-
-  updateDescription(description: string) {
-    cy.findByTestId(this.#realmRoleDescriptionInput).clear();
-    cy.findByTestId(this.#realmRoleDescriptionInput).type(description);
-    return this;
-  }
-
-  save() {
-    cy.findByTestId(this.#saveBtn).click();
-
-    return this;
-  }
-
-  cancel() {
-    cy.findByTestId(this.#cancelBtn).click();
-
-    return this;
-  }
-
-  goToAttributesTab() {
-    cy.findByTestId("attributesTab").click();
-    return this;
-  }
-}
-
-export default new CreateRealmRolePage();
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/KeysTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/KeysTab.ts
deleted file mode 100644
index aa09aa5125bf..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/KeysTab.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-export default class KeysTab {
-  readonly #keysTab = "rs-keys-tab";
-  readonly #providersTab = "rs-providers-tab";
-  readonly #addProviderDropdown = "addProviderDropdown";
-
-  goToKeysTab() {
-    cy.findByTestId(this.#keysTab).click();
-
-    return this;
-  }
-
-  goToProvidersTab() {
-    this.goToKeysTab();
-    cy.findByTestId(this.#providersTab).click();
-
-    return this;
-  }
-
-  addProvider(provider: string) {
-    cy.findByTestId(this.#addProviderDropdown).click();
-    cy.findByTestId(`option-${provider}`).click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/RealmSettingsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/RealmSettingsPage.ts
deleted file mode 100644
index 2ca86fddefaf..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/RealmSettingsPage.ts
+++ /dev/null
@@ -1,1385 +0,0 @@
-import Select from "../../../../forms/Select";
-
-import CommonPage from "../../../CommonPage";
-import ListingPage from "../../ListingPage";
-import RealmSettingsEventsTab from "./tabs/RealmSettingsEventsTab";
-
-enum RealmSettingsTab {
-  Events = "Events",
-}
-
-const expect = chai.expect;
-export default class RealmSettingsPage extends CommonPage {
-  generalSaveBtn = "realmSettingsGeneralTab-save";
-  generalRevertBtn = "realmSettingsGeneralTab-revert";
-  themesSaveBtn = "themes-tab-save";
-  sessionsSaveBtn = "sessions-tab-save";
-  loginTab = "rs-login-tab";
-  emailTab = "rs-email-tab";
-  themesTab = "rs-themes-tab";
-  localizationTab = "rs-localization-tab";
-  securityDefensesTab = "rs-security-defenses-tab";
-  sessionsTab = "rs-sessions-tab";
-  userProfileTab = "rs-user-profile-tab";
-  tokensTab = "rs-tokens-tab";
-  selectLoginTheme = "#kc-login-theme";
-  loginThemeList = "[data-testid='select-loginTheme']";
-  selectAccountTheme = "#kc-account-theme";
-  accountThemeList = "[data-testid='select-accountTheme']";
-  selectAdminTheme = "#kc-admin-ui-theme";
-  adminThemeList = "[data-testid='select-adminTheme']";
-  selectEmailTheme = "#kc-email-theme";
-  emailThemeList = "[data-testid='select-emailTheme']";
-  ssoSessionIdleSelectMenu = "#kc-sso-session-idle-select-menu";
-  ssoSessionIdleSelectMenuList = "#kc-sso-session-idle-select-menu ul";
-  ssoSessionMaxSelectMenu = "#kc-sso-session-max-select-menu";
-  ssoSessionMaxSelectMenuList = "#kc-sso-session-max-select-menu ul";
-
-  ssoSessionMaxRememberMeSelectMenu =
-    "#kc-sso-session-max-remember-me-select-menu";
-  ssoSessionMaxRememberMeSelectMenuList =
-    "#kc-sso-session-max-remember-me-select-menu ul";
-
-  ssoSessionIdleRememberMeSelectMenu =
-    "#kc-sso-session-idle-remember-me-select-menu";
-  ssoSessionIdleRememberMeSelectMenuList =
-    "#kc-sso-session-idle-remember-me-select-menu ul";
-
-  clientSessionIdleSelectMenu = "#kc-client-session-idle-select-menu";
-  clientSessionIdleSelectMenuList = "#kc-client-session-idle-select-menu ul";
-
-  clientSessionMaxSelectMenu = "#kc-client-session-max-select-menu";
-  clientSessionMaxSelectMenuList = "#kc-client-session-max-select-menu ul";
-
-  offlineSessionIdleSelectMenu = "#kc-offline-session-idle-select-menu";
-
-  loginTimeoutSelectMenu = "#kc-login-timeout-select-menu";
-  loginTimeoutSelectMenuList = "#kc-login-timeout-select-menu ul";
-
-  loginActionTimeoutSelectMenu = "#kc-login-action-timeout-select-menu";
-  loginActionTimeoutSelectMenuList = "#kc-login-action-timeout-select-menu ul";
-
-  selectDefaultLocale = "#kc-default-locale";
-  defaultLocaleList = "select-default-locale";
-  supportedLocalesTypeahead = "#supportedLocales";
-  supportedLocalesToggle = "#kc-l-supported-locales";
-  emailSaveBtn = "email-tab-save";
-  managedAccessSwitch = "userManagedAccessAllowed";
-  userRegSwitch = "user-reg-switch";
-  forgotPwdSwitch = "forgot-pw-switch";
-  rememberMeSwitch = "remember-me-switch";
-  emailAsUsernameSwitch = "email-as-username-switch";
-  editUsernameSwitch = "edit-username-switch";
-  loginWithEmailSwitch = "login-with-email-switch";
-  duplicateEmailsSwitch = "duplicate-emails-switch";
-  verifyEmailSwitch = "verify-email-switch";
-  authSwitch = "email-authentication-switch";
-  enableSslCheck = "enable-ssl";
-  enableStartTlsCheck = "enable-start-tls";
-  addProviderDropdown = "addProviderDropdown";
-  activeSwitch = "active";
-  enabledSwitch = "enabled";
-  addProviderButton = "add-provider-button";
-  displayName = "name";
-  enableEvents = "eventsEnabled";
-  eventsUserSave = "save-user";
-  enableAdminEvents = "adminEventsEnabled";
-  eventsAdminSave = "save-admin";
-  eventTypeColumn = "tbody > tr td";
-  filterSelectMenu = ".kc-filter-type-select";
-  passiveKeysOption = "PASSIVE-option";
-  disabledKeysOption = "DISABLED-option";
-  activeKeysOption = "ACTIVE-option";
-  testConnectionButton = "test-connection-button";
-  modalTestConnectionButton = "modal-test-connection-button";
-  emailAddressInput = "email-address-input";
-  addBundleButton = "add-translationBtn";
-  confirmAddTranslation = "add-translation-confirm-button";
-  keyInput = "key";
-  valueInput = "value";
-  deleteAction = "delete-action";
-  modalConfirm = "confirm";
-  ssoSessionIdleInput = "sso-session-idle-input";
-  ssoSessionMaxInput = "sso-session-max-input";
-  ssoSessionIdleRememberMeInput = "sso-session-idle-remember-me-input";
-  ssoSessionMaxRememberMeInput = "sso-session-max-remember-me-input";
-  clientSessionIdleInput = "client-session-idle-input";
-  clientSessionMaxInput = "client-session-max-input";
-  offlineSessionIdleInput = "offline-session-idle-input";
-  offlineSessionMaxSwitch = "offline-session-max-switch";
-  loginTimeoutInput = "login-timeout-input";
-  loginActionTimeoutInput = "login-action-timeout-input";
-  selectDefaultSignatureAlgorithm = "#kc-default-sig-alg";
-  revokeRefreshTokenSwitch = "revoke-refresh-token-switch";
-  accessTokenLifespanInput = "access-token-lifespan-input";
-  accessTokenLifespanImplicitInput = "access-token-lifespan-implicit-input";
-  parRequestUriLifespanInput = "par-request-uri-lifespan-input";
-  clientLoginTimeoutInput = "client-login-timeout-input";
-  offlineSessionMaxInput = "offline-session-max-input";
-  userInitiatedActionLifespanInput = "user-initiated-action-lifespan";
-  defaultAdminInitatedInput = "default-admin-initated-input";
-  emailVerificationInput = "email-verification-input";
-  idpEmailVerificationInput = "idp-email-verification-input";
-  forgotPasswordInput = "forgot-pw-input";
-  executeActionsInput = "execute-actions-input";
-
-  accessTokenLifespanSelectMenu = "#kc-access-token-lifespan-select-menu";
-  accessTokenLifespanSelectMenuList =
-    "#kc-access-token-lifespan-select-menu ul";
-
-  parRequestUriLifespanSelectMenu = "#par-request-uri-lifespan-select-menu";
-  parRequestUriLifespanSelectMenuList =
-    "#par-request-uri-lifespan-select-menu ul";
-
-  accessTokenLifespanImplicitSelectMenu =
-    "#kc-access-token-lifespan-implicit-select-menu";
-  accessTokenLifespanImplicitSelectMenuList =
-    "#kc-access-token-lifespan-implicit-select-menu ul";
-
-  clientLoginTimeoutSelectMenu = "#kc-client-login-timeout-select-menu";
-  clientLoginTimeoutSelectMenuList = "#kc-client-login-timeout-select-menu ul";
-
-  offlineSessionMaxSelectMenu = "#kc-offline-session-max-select-menu";
-  offlineSessionMaxSelectMenuList = "#kc-offline-session-max-select-menu ul";
-
-  userInitiatedActionLifespanSelectMenu =
-    "#kc-user-initiated-action-lifespan-select-menu";
-  userInitiatedActionLifespanSelectMenuList =
-    "#kc-user-initiated-action-lifespan-select-menu ul";
-
-  defaultAdminInitatedInputSelectMenu =
-    "#kc-default-admin-initiated-select-menu";
-  defaultAdminInitatedInputSelectMenuList =
-    "#kc-default-admin-initiated-select-menu";
-
-  emailVerificationSelectMenu = "#kc-email-verification-select-menu";
-  emailVerificationSelectMenuList = "#kc-email-verification-select-menu ul";
-
-  idpEmailVerificationSelectMenu = "#kc-idp-email-verification-select-menu";
-  idpEmailVerificationSelectMenuList =
-    "#kc-idp-email-verification-select-menu ul";
-
-  forgotPasswordSelectMenu = "#kc-forgot-pw-select-menu";
-  forgotPasswordSelectMenuList = "#kc-forgot-pw-select-menu ul";
-
-  executeActionsSelectMenu = "#kc-execute-actions-select-menu";
-  executeActionsSelectMenuList = "#kc-execute-actions-select-menu ul";
-
-  #formViewProfilesView = "formView-profilesView";
-  #jsonEditorProfilesView = "jsonEditor-profilesView";
-  #createProfileBtn = "createProfile";
-  #formViewSelect = "formView-profilesView";
-  #jsonEditorSelect = "jsonEditor-profilesView";
-  #formViewSelectPolicies = "formView-policiesView";
-  #jsonEditorSelectPolicies = "jsonEditor-policiesView";
-  #newClientProfileNameInput = "name";
-  #newClientProfileDescriptionInput = "description";
-  #saveNewClientProfileBtn = "saveCreateProfile";
-  #cancelNewClientProfile = "cancelCreateProfile";
-  #createPolicyEmptyStateBtn = "no-client-policies-empty-action";
-  #createPolicyBtn = "createPolicy";
-  #newClientPolicyNameInput = "name";
-  #newClientPolicyDescriptionInput = "client-policy-description";
-  #saveNewClientPolicyBtn = "saveCreatePolicy";
-  #cancelNewClientPolicyBtn = "cancelCreatePolicy";
-  #alertMessage = ".pf-v5-c-alert__title";
-  #modalDialogTitle = ".pf-v5-c-modal-box__title-text";
-  #modalDialogBodyText = ".pf-v5-c-modal-box__body";
-  #deleteDialogCancelBtn = "#modal-cancel";
-  #jsonEditorSaveBtn = "jsonEditor-saveBtn";
-  #jsonEditorSavePoliciesBtn = "jsonEditor-policies-saveBtn";
-  #jsonEditorReloadBtn = "jsonEditor-reloadBtn";
-  #jsonEditor = ".w-tc-editor-text";
-  #clientPolicyDrpDwn = '[data-testid="action-dropdown"]';
-  #deleteclientPolicyDrpDwn = "deleteClientPolicyDropdown";
-  #clientProfileOne =
-    'a[href*="realm-settings/client-policies/Test/edit-profile"]';
-  #clientProfileTwo =
-    'a[href*="realm-settings/client-policies/Edit/edit-profile"]';
-  #clientPolicy = 'a[href*="realm-settings/client-policies/Test/edit-policy"]';
-  #reloadBtn = "reloadProfile";
-  #addExecutor = "addExecutor";
-  #addExecutorDrpDwn = "#kc-executor";
-  #addExecutorDrpDwnOption = ".pf-v5-c-menu__list";
-  #addExecutorCancelBtn = ".pf-v5-c-form__actions a";
-  #addExecutorSaveBtn = "addExecutor-saveBtn";
-  #availablePeriodExecutorFld = "available-period";
-  #editExecutorBtn =
-    '[aria-label="Executors"] > li > div:first-child [data-testid="editExecutor"]';
-  #executorAvailablePeriodInput = "[data-testid='available-period']";
-
-  #listingPage = new ListingPage();
-  #addCondition = "addCondition";
-  #addConditionDrpDwn = "#provider";
-  #addConditionDrpDwnOption = ".pf-v5-c-menu__list";
-  #addConditionCancelBtn = "addCondition-cancelBtn";
-  #addConditionSaveBtn = "addCondition-saveBtn";
-  #clientRolesConditionLink = "client-roles-condition-link";
-  #clientScopesConditionLink = "client-scopes-condition-link";
-  #eventListenersFormLabel = ".pf-v5-c-form__label-text";
-  #eventListenersDrpDwn = "#eventsListeners";
-  #eventListenersSaveBtn = "saveEventListenerBtn";
-  #eventListenersRevertBtn = "revertEventListenerBtn";
-  #eventListenersInputFld =
-    "#eventsListeners .pf-v5-c-text-input-group__text-input";
-  #eventListenersDrpDwnOption = ".pf-v5-c-menu__list";
-  #eventListenersDrwDwnSelect = "#eventsListeners .pf-v5-c-menu-toggle__button";
-  #eventListenerRemove = ".pf-v5-c-chip__actions";
-  #roleSelect = "config.roles0";
-  #selectScopeButton = "addValue";
-  #deleteClientRolesConditionBtn = "delete-client-roles-condition";
-  #deleteClientScopesConditionBtn = "delete-client-scopes-condition";
-  #fromDisplayName = "smtpServer.fromDisplayName";
-  #replyToEmail = "smtpServer.replyTo";
-  #port = "smtpServer.port";
-
-  #publicKeyBtn = ".kc-keys-list > tbody > tr > td > .button-wrapper > button";
-  #localizationLocalesSubTab = "rs-localization-locales-tab";
-  #localizationRealmOverridesSubTab = "rs-localization-realm-overrides-tab";
-  #localizationEffectiveMessageBundlesSubTab =
-    "rs-localization-effective-message-bundles-tab";
-  #realmSettingsEventsTab = new RealmSettingsEventsTab();
-  #realmId = 'input[aria-label="Copyable input"]';
-  #securityDefensesHeadersSaveBtn = "headers-form-tab-save";
-  #securityDefensesBruteForceSaveBtn = "brute-force-tab-save";
-  #securityDefensesHeadersTab = "security-defenses-headers-tab";
-  #securityDefensesBruteForceTab = "security-defenses-brute-force-tab";
-  #clientProfileLink = 'table[aria-label="Profiles"] tbody a';
-
-  #realmName?: string;
-  constructor(realmName?: string) {
-    super();
-    this.#realmName = realmName;
-  }
-
-  #getRealmDisplayName() {
-    return cy.findByTestId("displayName");
-  }
-
-  #getFrontEndURL() {
-    return cy.findByTestId("attributes.frontendUrl");
-  }
-
-  #getSSLRequired() {
-    return cy.get("#sslRequired");
-  }
-
-  #getUnmanagedAttributes() {
-    return cy.get("#unmanagedAttributePolicy");
-  }
-
-  getFromInput() {
-    return cy.findByTestId("smtpServer.from");
-  }
-
-  getHostInput() {
-    return cy.findByTestId("smtpServer.host");
-  }
-
-  goToEventsTab() {
-    this.tabUtils().clickTab(RealmSettingsTab.Events);
-    return this.#realmSettingsEventsTab;
-  }
-
-  disableRealm() {
-    cy.get(this.#modalDialogTitle).contains("Disable realm?");
-    cy.get(this.#modalDialogBodyText).contains(
-      "User and clients can't access the realm if it's disabled. Are you sure you want to continue?",
-    );
-    cy.findByTestId(this.modalConfirm).click();
-  }
-  selectLoginThemeType(themeType: string) {
-    cy.get(this.selectLoginTheme).click();
-    cy.get(this.loginThemeList).contains(themeType).click();
-
-    return this;
-  }
-
-  selectAccountThemeType(themeType: string) {
-    cy.get(this.selectAccountTheme).click();
-    cy.get(this.accountThemeList).contains(themeType).click();
-    return this;
-  }
-
-  selectAdminThemeType(themeType: string) {
-    cy.get(this.selectAdminTheme).click();
-    cy.get(this.adminThemeList).contains(themeType).click();
-    return this;
-  }
-
-  selectEmailThemeType(themeType: string) {
-    cy.get(this.selectEmailTheme).click();
-    cy.get(this.emailThemeList).contains(themeType).click();
-    return this;
-  }
-
-  fillEmailField(email: string) {
-    cy.findByTestId(this.emailAddressInput).type(email);
-    return this;
-  }
-
-  fillHostField(host: string) {
-    this.getHostInput().clear();
-    this.getHostInput().type(host);
-    return this;
-  }
-
-  getDisplayName(name: string) {
-    this.#getRealmDisplayName().should("have.value", name);
-    return this;
-  }
-
-  getFrontendURL(url: string) {
-    this.#getFrontEndURL().should("have.value", url);
-    return this;
-  }
-
-  getRequireSSL(option: string) {
-    Select.assertSelectedItem(this.#getSSLRequired(), option);
-    return this;
-  }
-
-  getUnmanagedAttributes(option: string) {
-    Select.assertSelectedItem(this.#getUnmanagedAttributes(), option);
-    return this;
-  }
-
-  fillDisplayName(displayName: string) {
-    this.#getRealmDisplayName().clear();
-    this.#getRealmDisplayName().type(displayName);
-  }
-
-  clearRealmId() {
-    cy.get(this.#realmId).clear();
-  }
-
-  fillFromDisplayName(displayName: string) {
-    cy.findByTestId(this.#fromDisplayName).clear().type(displayName);
-  }
-
-  fillReplyToEmail(email: string) {
-    cy.findByTestId(this.#replyToEmail).clear();
-    cy.findByTestId(this.#replyToEmail).type(email);
-  }
-
-  fillPort(port: string) {
-    cy.findByTestId(this.#port).clear();
-    cy.findByTestId(this.#port).type(port);
-  }
-
-  fillFrontendURL(url: string) {
-    this.clearFrontendURL();
-    this.#getFrontEndURL().type(url);
-  }
-
-  clearFrontendURL() {
-    this.#getFrontEndURL().clear();
-  }
-
-  fillRequireSSL(option: string) {
-    Select.selectItem(this.#getSSLRequired(), option);
-  }
-
-  fillUnmanagedAttributes(option: string) {
-    Select.selectItem(this.#getUnmanagedAttributes(), option);
-  }
-
-  setDefaultLocale(locale: string) {
-    cy.get(this.selectDefaultLocale).click();
-    cy.findByTestId(this.defaultLocaleList).contains(locale).click();
-    return this;
-  }
-
-  saveGeneral() {
-    cy.findByTestId(this.generalSaveBtn).click();
-
-    return this;
-  }
-
-  saveThemes() {
-    cy.findByTestId(this.themesSaveBtn).click();
-
-    return this;
-  }
-
-  saveSessions() {
-    cy.findByTestId(this.sessionsSaveBtn).click();
-
-    return this;
-  }
-
-  addSenderEmail(senderEmail: string) {
-    this.getFromInput().clear();
-
-    if (senderEmail) {
-      this.getFromInput().type(senderEmail);
-    }
-
-    return this;
-  }
-
-  testSelectFilter() {
-    cy.get(this.filterSelectMenu).first().click();
-    cy.findByTestId(this.passiveKeysOption).click();
-    cy.get(this.filterSelectMenu).first().click();
-    cy.findByTestId(this.disabledKeysOption).click();
-  }
-
-  deleteProvider(name: string) {
-    this.#listingPage.deleteItem(name);
-    this.modalUtils().checkModalTitle("Delete key provider?").confirmModal();
-
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success. The provider has been deleted.",
-    );
-    return this;
-  }
-
-  checkKeyPublic() {
-    cy.get(this.#publicKeyBtn).contains("Public key").click();
-    this.modalUtils().checkModalTitle("Public key").confirmModal();
-
-    cy.get(this.#publicKeyBtn).contains("Certificate").click();
-    this.modalUtils().checkModalTitle("Certificate").confirmModal();
-  }
-
-  switchToActiveFilter() {
-    cy.get(this.filterSelectMenu).first().click();
-    cy.findByTestId(this.activeKeysOption).click();
-  }
-
-  switchToPassiveFilter() {
-    cy.get(this.filterSelectMenu).first().click();
-    cy.findByTestId(this.passiveKeysOption).click();
-  }
-
-  switchToDisabledFilter() {
-    cy.get(this.filterSelectMenu).first().click();
-    cy.findByTestId(this.disabledKeysOption).click();
-  }
-
-  toggleSwitch(switchName: string, waitFor: boolean | undefined = true) {
-    const loadName = `load-${crypto.randomUUID()}`;
-    if (waitFor) {
-      cy.intercept({ path: "/admin/realms/*", times: 1 }).as(loadName);
-    }
-    cy.findByTestId(switchName).click({ force: true });
-    if (waitFor) {
-      cy.wait(`@${loadName}`);
-    }
-
-    return this;
-  }
-
-  assertSwitch(switchName: string, on: boolean) {
-    cy.findByTestId(switchName).should("have.value", on ? "on" : "off");
-
-    return this;
-  }
-
-  setSwitch(switchName: string, on: boolean) {
-    if (on) {
-      cy.findByTestId(switchName).check({ force: true });
-    } else {
-      cy.findByTestId(switchName).uncheck({ force: true });
-    }
-
-    return this;
-  }
-
-  toggleCheck(switchName: string) {
-    cy.findByTestId(switchName).click();
-
-    return this;
-  }
-
-  toggleAddProviderDropdown() {
-    const keysUrl = `/admin/realms/${this.#realmName}/keys`;
-    cy.intercept(keysUrl).as("keysFetch");
-    cy.findByTestId(this.addProviderDropdown).click();
-
-    return this;
-  }
-
-  addProvider() {
-    cy.findByTestId(this.addProviderButton).click();
-
-    return this;
-  }
-
-  addKeyValuePair(key: string, value: string) {
-    cy.findByTestId(this.addBundleButton).click();
-
-    cy.findByTestId(this.keyInput).type(key);
-    cy.findByTestId(this.valueInput).type(value);
-
-    cy.findByTestId(this.confirmAddTranslation).click({ force: true });
-
-    return this;
-  }
-
-  enterUIDisplayName(name: string) {
-    cy.findByTestId(this.displayName).clear().type(name);
-  }
-
-  save(saveBtn: string) {
-    cy.findByTestId(saveBtn).click();
-
-    return this;
-  }
-
-  revert(revertBtn: string) {
-    cy.findByTestId(revertBtn).click();
-
-    return this;
-  }
-
-  clearEvents(type: "admin" | "user") {
-    cy.findByTestId(`clear-${type}-events`).click();
-
-    return this;
-  }
-
-  addUserEvents(events: string[]) {
-    cy.findByTestId("addTypes").click();
-    for (const event of events) {
-      cy.get(this.eventTypeColumn)
-        .contains(event)
-        .parent()
-        .find("input")
-        .click();
-    }
-    return this;
-  }
-
-  changeTimeUnit(
-    unit: "Minutes" | "Hours" | "Days",
-    inputType: string,
-    listType: string,
-  ) {
-    switch (unit) {
-      case "Minutes":
-        cy.get(inputType).click();
-        cy.get(listType).contains(unit).click();
-        break;
-      case "Hours":
-        cy.get(inputType).click();
-        cy.get(listType).contains(unit).click();
-        break;
-      case "Days":
-        cy.get(inputType).click();
-        cy.get(listType).contains(unit).click();
-        break;
-      default:
-        throw "Invalid unit, must be 'minutes', 'hours', or 'days'.";
-    }
-    return this;
-  }
-
-  populateSessionsPage() {
-    cy.findByTestId(this.ssoSessionIdleInput).clear().type("1");
-    this.changeTimeUnit(
-      "Minutes",
-      this.ssoSessionIdleSelectMenu,
-      this.ssoSessionIdleSelectMenuList,
-    );
-    cy.findByTestId(this.ssoSessionMaxInput).clear().type("2");
-    this.changeTimeUnit(
-      "Hours",
-      this.ssoSessionMaxSelectMenu,
-      this.ssoSessionMaxSelectMenuList,
-    );
-    cy.findByTestId(this.ssoSessionIdleRememberMeInput).clear().type("3");
-    this.changeTimeUnit(
-      "Days",
-      this.ssoSessionIdleRememberMeSelectMenu,
-      this.ssoSessionIdleRememberMeSelectMenuList,
-    );
-    cy.findByTestId(this.ssoSessionMaxRememberMeInput).clear().type("4");
-    this.changeTimeUnit(
-      "Minutes",
-      this.ssoSessionMaxRememberMeSelectMenu,
-      this.ssoSessionMaxRememberMeSelectMenuList,
-    );
-
-    cy.findByTestId(this.clientSessionIdleInput).clear().type("5");
-    this.changeTimeUnit(
-      "Hours",
-      this.clientSessionIdleSelectMenu,
-      this.clientSessionIdleSelectMenuList,
-    );
-    cy.findByTestId(this.clientSessionMaxInput).clear().type("6");
-    this.changeTimeUnit(
-      "Days",
-      this.clientSessionMaxSelectMenu,
-      this.clientSessionMaxSelectMenuList,
-    );
-
-    cy.findByTestId(this.offlineSessionIdleInput).clear().type("7");
-    this.toggleSwitch(this.offlineSessionMaxSwitch, false);
-
-    cy.findByTestId(this.loginTimeoutInput).clear().type("9");
-    this.changeTimeUnit(
-      "Minutes",
-      this.loginTimeoutSelectMenu,
-      this.loginTimeoutSelectMenuList,
-    );
-    cy.findByTestId(this.loginActionTimeoutInput).clear().type("10");
-    this.changeTimeUnit(
-      "Days",
-      this.loginActionTimeoutSelectMenu,
-      this.loginActionTimeoutSelectMenuList,
-    );
-  }
-
-  populateTokensPage() {
-    this.toggleSwitch(this.revokeRefreshTokenSwitch, false);
-
-    cy.findByTestId(this.accessTokenLifespanInput)
-      .focus()
-      .clear({ force: true });
-    cy.findByTestId(this.accessTokenLifespanInput).clear().type("1");
-    this.changeTimeUnit(
-      "Days",
-      this.accessTokenLifespanSelectMenu,
-      this.accessTokenLifespanSelectMenuList,
-    );
-    cy.findByTestId(this.accessTokenLifespanImplicitInput).clear().type("2");
-    this.changeTimeUnit(
-      "Minutes",
-      this.accessTokenLifespanImplicitSelectMenu,
-      this.accessTokenLifespanImplicitSelectMenuList,
-    );
-    cy.findByTestId("par-request-uri-lifespan-input").clear().type("2");
-    this.changeTimeUnit(
-      "Hours",
-      this.parRequestUriLifespanSelectMenu,
-      this.parRequestUriLifespanSelectMenuList,
-    );
-
-    cy.findByTestId(this.clientLoginTimeoutInput).clear().type("3");
-    this.changeTimeUnit(
-      "Hours",
-      this.clientLoginTimeoutSelectMenu,
-      this.clientLoginTimeoutSelectMenuList,
-    );
-
-    cy.findByTestId(this.userInitiatedActionLifespanInput).clear().type("4");
-    this.changeTimeUnit(
-      "Minutes",
-      this.userInitiatedActionLifespanSelectMenu,
-      this.userInitiatedActionLifespanSelectMenuList,
-    );
-
-    cy.findByTestId(this.defaultAdminInitatedInput).clear().type("5");
-    this.changeTimeUnit(
-      "Days",
-      this.defaultAdminInitatedInputSelectMenu,
-      this.defaultAdminInitatedInputSelectMenuList,
-    );
-
-    cy.findByTestId(this.emailVerificationInput).clear().type("6");
-    this.changeTimeUnit(
-      "Days",
-      this.emailVerificationSelectMenu,
-      this.emailVerificationSelectMenuList,
-    );
-
-    cy.findByTestId(this.idpEmailVerificationInput).clear().type("7");
-    this.changeTimeUnit(
-      "Days",
-      this.idpEmailVerificationSelectMenu,
-      this.idpEmailVerificationSelectMenuList,
-    );
-
-    cy.findByTestId(this.forgotPasswordInput).clear().type("8");
-    this.changeTimeUnit(
-      "Days",
-      this.forgotPasswordSelectMenu,
-      this.forgotPasswordSelectMenuList,
-    );
-    cy.findByTestId(this.executeActionsInput).clear().type("9");
-    this.changeTimeUnit(
-      "Days",
-      this.executeActionsSelectMenu,
-      this.executeActionsSelectMenuList,
-    );
-  }
-
-  checkUserEvents(events: string[]) {
-    cy.get(this.eventTypeColumn).should((event) => {
-      for (const user of events) {
-        expect(event).to.contain(user);
-      }
-    });
-    return this;
-  }
-
-  setOfflineSessionMaxSwitch(value: boolean) {
-    this.setSwitch(this.offlineSessionMaxSwitch, value);
-    return this;
-  }
-
-  clickAdd() {
-    cy.findByTestId("addEventTypeConfirm").click();
-    return this;
-  }
-
-  shouldDisplayEventListenersForm() {
-    cy.get(this.#eventListenersFormLabel)
-      .should("be.visible")
-      .contains("Event listeners");
-    cy.get(this.#eventListenersDrpDwn).should("exist");
-    cy.findByTestId(this.#eventListenersSaveBtn).should("exist");
-    cy.findAllByTestId(this.#eventListenersRevertBtn).should("exist");
-  }
-
-  shouldRevertSavingEventListener() {
-    cy.get(this.#eventListenersInputFld).click().type("email");
-    cy.get(this.#eventListenersDrpDwnOption).click();
-    cy.get(this.#eventListenersDrwDwnSelect).click();
-    cy.findByTestId(this.#eventListenersRevertBtn).click();
-    cy.get(this.#eventListenersDrpDwn).should("not.have.text", "email");
-  }
-
-  shouldSaveEventListener() {
-    cy.get(this.#eventListenersInputFld).click().type("email");
-    cy.get(this.#eventListenersDrpDwnOption).click();
-    cy.get(this.#eventListenersDrwDwnSelect).click();
-    cy.findByTestId(this.#eventListenersSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Event listener has been updated.",
-    );
-  }
-
-  shouldRemoveEventFromEventListener() {
-    cy.get(this.#eventListenerRemove).last().click({ force: true });
-    cy.get(this.#eventListenersInputFld).click();
-    cy.findByTestId(this.#eventListenersSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Event listener has been updated.",
-    );
-    cy.get(this.#eventListenersDrpDwn).should("not.have.text", "email");
-  }
-
-  shouldRemoveAllEventListeners() {
-    cy.get(".pf-v5-c-chip__actions").first().click();
-    cy.get(".pf-v5-c-chip__actions").click();
-    cy.findByTestId(this.#eventListenersSaveBtn).click();
-    cy.get(this.#eventListenersDrpDwn).should("not.have.text", "jboss-logging");
-    cy.get(this.#eventListenersDrpDwn).should("not.have.text", "email");
-  }
-
-  shouldReSaveEventListener() {
-    cy.get(this.#eventListenersInputFld).click().type("jboss-logging");
-    cy.get(this.#eventListenersDrpDwnOption).click();
-    cy.get(this.#eventListenersDrwDwnSelect).click();
-    cy.findByTestId(this.#eventListenersSaveBtn).click();
-  }
-
-  shouldDisplayProfilesTab() {
-    cy.findByTestId(this.#createProfileBtn).should("exist");
-    cy.findByTestId(this.#formViewSelect).should("exist");
-    cy.findByTestId(this.#jsonEditorSelect).should("exist");
-    cy.get("table").should("be.visible").contains("td", "Global");
-  }
-
-  shouldDisplayNewClientProfileForm() {
-    cy.findByTestId(this.#createProfileBtn).click();
-    cy.findByTestId(this.#newClientProfileNameInput).should("exist");
-    cy.findByTestId(this.#newClientProfileDescriptionInput).should("exist");
-    cy.findByTestId(this.#saveNewClientProfileBtn).should("exist");
-    cy.findByTestId(this.#cancelNewClientProfile).should("exist");
-  }
-
-  createClientProfile(name: string, description: string) {
-    cy.findByTestId(this.#createProfileBtn).click();
-    cy.findByTestId(this.#newClientProfileNameInput).type(name);
-    cy.findByTestId(this.#newClientProfileDescriptionInput).type(description);
-    return this;
-  }
-
-  saveClientProfileCreation() {
-    cy.findByTestId(this.#saveNewClientProfileBtn).click();
-    return this;
-  }
-
-  cancelClientProfileCreation() {
-    cy.findByTestId(this.#cancelNewClientProfile).click();
-    return this;
-  }
-
-  shouldSearchClientProfile() {
-    new ListingPage().searchItem("Test", false).itemExist("Test");
-    return this;
-  }
-
-  cancelDeleteClientPolicy() {
-    cy.get(this.#deleteDialogCancelBtn)
-      .contains("Cancel")
-      .click({ force: true });
-    cy.get("table").should("be.visible").contains("td", "Test");
-    return this;
-  }
-
-  deleteClientPolicyItemFromTable(name: string) {
-    this.#listingPage.searchItem(name, false);
-    this.#listingPage.clickRowDetails(name).clickDetailMenu("Delete");
-    return this;
-  }
-
-  shouldNavigateBetweenFormAndJSONView() {
-    cy.findByTestId(this.#jsonEditorProfilesView).check();
-    cy.findByTestId(this.#jsonEditorSaveBtn).contains("Save");
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload");
-    cy.findByTestId(this.#formViewProfilesView).check();
-    cy.findByTestId(this.#createProfileBtn).contains("Create client profile");
-  }
-
-  shouldSaveChangedJSONProfiles() {
-    cy.findByTestId(this.#jsonEditorProfilesView).check();
-    cy.get(this.#jsonEditor).type(`{pageup}{del} [{
-      "name": "Test",
-      "description": "Test Description",
-      "executors": [],
-      "global": false
-    }, {downarrow}{end}{backspace}{backspace}`);
-    cy.findByTestId(this.#jsonEditorSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "The client profiles configuration was updated",
-    );
-    cy.findByTestId(this.#formViewProfilesView).check();
-    cy.get("table").should("be.visible").contains("td", "Test");
-  }
-
-  shouldEditClientProfile() {
-    cy.get(this.#clientProfileOne).click();
-    cy.findByTestId(this.#newClientProfileNameInput)
-      .click()
-      .clear()
-      .type("Edit");
-    cy.findByTestId(this.#newClientProfileDescriptionInput)
-      .click()
-      .clear()
-      .type("Edit Description");
-    cy.findByTestId(this.#saveNewClientProfileBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Client profile updated successfully",
-    );
-  }
-
-  shouldCheckEditedClientProfileListed() {
-    cy.get("table").should("be.visible").contains("td", "Edit");
-    cy.get("table").should("not.have.text", "Test");
-  }
-
-  shouldShowErrorWhenNameBlank() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.findByTestId(this.#newClientProfileNameInput).click().clear();
-    cy.get("form").should("not.have.text", "Required field");
-  }
-
-  shouldShowErrorWhenDuplicate() {
-    cy.get("form").should(
-      "not.have.text",
-      "The name must be unique within the realm",
-    );
-  }
-
-  shouldReloadClientProfileEdits() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.findByTestId(this.#newClientProfileNameInput).type("Reloading");
-    cy.findByTestId(this.#reloadBtn).click();
-    cy.findByTestId(this.#newClientProfileNameInput).should(
-      "have.value",
-      "Edit",
-    );
-  }
-
-  shouldNotHaveExecutorsConfigured() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.get('h2[class*="kc-emptyExecutors"]').should(
-      "have.text",
-      "No executors configured",
-    );
-  }
-
-  shouldCancelAddingExecutor() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.findByTestId(this.#addExecutor).click();
-    cy.get(this.#addExecutorDrpDwn).click();
-    cy.get(this.#addExecutorDrpDwnOption)
-      .contains("secure-ciba-signed-authn-req")
-      .click();
-    cy.get(this.#addExecutorCancelBtn).click();
-    cy.get('h2[class*="kc-emptyExecutors"]').should(
-      "have.text",
-      "No executors configured",
-    );
-  }
-
-  shouldAddExecutor() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.findByTestId(this.#addExecutor).click();
-    cy.get(this.#addExecutorDrpDwn).click();
-    cy.get(this.#addExecutorDrpDwnOption)
-      .contains("secure-ciba-signed-authn-req")
-      .click();
-    cy.findByTestId(this.#addExecutorSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success! Executor created successfully",
-    );
-    cy.get('ul[class*="pf-v5-c-data-list"]').should(
-      "have.text",
-      "secure-ciba-signed-authn-req",
-    );
-  }
-
-  shouldCancelDeletingExecutor() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.get('svg[class*="kc-executor-trash-icon"]').click();
-    cy.get(this.#modalDialogTitle).contains("Delete executor?");
-    cy.get(this.#modalDialogBodyText).contains(
-      "The action will permanently delete secure-ciba-signed-authn-req. This cannot be undone.",
-    );
-    cy.findByTestId(this.modalConfirm).contains("Delete");
-    cy.get(this.#deleteDialogCancelBtn).contains("Cancel").click();
-    cy.get('ul[class*="pf-v5-c-data-list"]').should(
-      "have.text",
-      "secure-ciba-signed-authn-req",
-    );
-  }
-
-  openProfileDetails(name: string) {
-    cy.intercept(
-      `/admin/realms/${this.#realmName}/client-policies/profiles*`,
-    ).as("profilesFetch");
-    cy.get(
-      'a[href*="realm-settings/client-policies/' + name + '/edit-profile"]',
-    ).click();
-    cy.wait("@profilesFetch");
-    return this;
-  }
-
-  editExecutor(availablePeriod?: number) {
-    cy.intercept(
-      `/admin/realms/${this.#realmName}/client-policies/profiles*`,
-    ).as("profilesFetch");
-    cy.get(this.#editExecutorBtn).click();
-    cy.wait("@profilesFetch");
-    if (availablePeriod) {
-      cy.get(this.#executorAvailablePeriodInput)
-        .clear()
-        .type(availablePeriod.toString());
-    }
-    return this;
-  }
-
-  saveExecutor() {
-    cy.findByTestId(this.#addExecutorSaveBtn).click();
-    return this;
-  }
-
-  cancelEditingExecutor() {
-    cy.get(this.#addExecutorCancelBtn)
-      .contains("Cancel")
-      .click({ force: true });
-    return this;
-  }
-
-  checkExecutorNotInList() {
-    cy.get('ul[class*="pf-v5-c-data-list"]').should(
-      "have.text",
-      "secure-ciba-signed-authn-req",
-    );
-    return this;
-  }
-
-  checkAvailablePeriodExecutor(value: number) {
-    cy.findByTestId(this.#availablePeriodExecutorFld).should(
-      "have.value",
-      value,
-    );
-    return this;
-  }
-
-  shouldEditExecutor() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.get(this.#editExecutorBtn).click();
-    cy.findByTestId(this.#availablePeriodExecutorFld).clear().type("4000");
-    cy.findByTestId(this.#addExecutorSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Executor updated successfully",
-    );
-  }
-
-  shouldDeleteExecutor() {
-    cy.get(this.#clientProfileTwo).click();
-    cy.get('svg[class*="kc-executor-trash-icon"]').click();
-    cy.get(this.#modalDialogTitle).contains("Delete executor?");
-    cy.get(this.#modalDialogBodyText).contains(
-      "The action will permanently delete secure-ciba-signed-authn-req. This cannot be undone.",
-    );
-    cy.findByTestId(this.modalConfirm).contains("Delete");
-    cy.findByTestId(this.modalConfirm).click();
-    cy.get('h2[class*="kc-emptyExecutors"]').should(
-      "have.text",
-      "No executors configured",
-    );
-  }
-
-  shouldReloadJSONProfiles() {
-    cy.findByTestId(this.#jsonEditorProfilesView).check();
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload").click();
-    cy.findByTestId(this.#jsonEditorSaveBtn).contains("Save");
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload");
-  }
-
-  shouldSaveChangedJSONPolicies() {
-    cy.findByTestId(this.#jsonEditorSelectPolicies).check();
-    cy.findByTestId(this.#jsonEditorReloadBtn).click();
-
-    cy.get(this.#jsonEditor).type(`{pageup}{del} [{
-      "name": "Reload",
-    }, {downarrow}{end}{backspace}{backspace}{backspace}{backspace}`);
-
-    cy.findByTestId(this.#jsonEditorReloadBtn).click();
-
-    cy.get(this.#jsonEditor).type(`{pageup}{del} [{
-      "name": "Test",
-      "description": "Test Description",
-      "enabled": false,
-      "conditions": [],
-      "profiles": [],
-    }, {downarrow}{end}{backspace}{backspace}{backspace}{backspace}`);
-
-    cy.findByTestId(this.#jsonEditorSavePoliciesBtn).click();
-
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "The client policy configuration was updated",
-    );
-    cy.findByTestId(this.#formViewSelectPolicies).check();
-    cy.get("table").should("be.visible").contains("td", "Test");
-  }
-
-  shouldNavigateBetweenFormAndJSONViewPolicies() {
-    cy.findByTestId(this.#jsonEditorSelectPolicies).check();
-    cy.findByTestId(this.#jsonEditorSavePoliciesBtn).contains("Save");
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload");
-    cy.findByTestId(this.#formViewSelectPolicies).check();
-    cy.findByTestId(this.#createPolicyEmptyStateBtn).contains(
-      "Create client policy",
-    );
-  }
-
-  checkDisplayPoliciesTab() {
-    cy.findByTestId(this.#createPolicyEmptyStateBtn).should("exist");
-    cy.findByTestId(this.#formViewSelectPolicies).should("exist");
-    cy.findByTestId(this.#jsonEditorSelectPolicies).should("exist");
-    return this;
-  }
-
-  checkNewClientPolicyForm() {
-    cy.findByTestId(this.#newClientPolicyNameInput).should("exist");
-    cy.findByTestId(this.#newClientPolicyDescriptionInput).should("exist");
-    cy.findByTestId(this.#saveNewClientPolicyBtn).should("exist");
-    cy.findByTestId(this.#cancelNewClientPolicyBtn).should("exist");
-    return this;
-  }
-
-  cancelNewClientPolicyCreation() {
-    cy.findByTestId(this.#cancelNewClientPolicyBtn).click();
-    return this;
-  }
-
-  createNewClientPolicyFromList(
-    name: string,
-    description: string,
-    cancel?: boolean,
-  ) {
-    cy.findByTestId(this.#createPolicyBtn).click();
-    cy.findByTestId(this.#newClientPolicyNameInput).type(name);
-    cy.findByTestId(this.#newClientPolicyDescriptionInput).type(description);
-    if (!cancel) {
-      cy.findByTestId(this.#saveNewClientPolicyBtn).click();
-    }
-    return this;
-  }
-
-  searchClientPolicy(name: string) {
-    new ListingPage().searchItem(name, false).itemExist(name);
-    return this;
-  }
-
-  searchClientProfile(name: string) {
-    new ListingPage().searchItem(name, false).itemExist(name);
-    return this;
-  }
-
-  searchNonExistingClientProfile(name: string) {
-    new ListingPage().searchItem(name, false);
-    return this;
-  }
-
-  shouldNotHaveConditionsConfigured() {
-    cy.get(this.#clientPolicy).click();
-    cy.get('h2[class*="kc-emptyConditions"]').should(
-      "have.text",
-      "No conditions configured",
-    );
-  }
-
-  shouldCancelAddingCondition() {
-    cy.get(this.#clientPolicy).click();
-    cy.findByTestId(this.#addCondition).click();
-    cy.get(this.#addConditionDrpDwn).click();
-    cy.get(this.#addConditionDrpDwnOption).contains("any-client").click();
-    cy.findByTestId(this.#addConditionCancelBtn).click();
-    cy.get('h2[class*="kc-emptyConditions"]').should(
-      "have.text",
-      "No conditions configured",
-    );
-  }
-
-  shouldAddClientRolesCondition() {
-    cy.get(this.#clientPolicy).click();
-    cy.findByTestId(this.#addCondition).click();
-    cy.get(this.#addConditionDrpDwn).click();
-    cy.get(this.#addConditionDrpDwnOption).contains("client-roles").click();
-    cy.findByTestId(this.#roleSelect).clear().type("manage-realm");
-
-    cy.findByTestId(this.#addConditionSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success! Condition created successfully",
-    );
-    cy.get('ul[class*="pf-v5-c-data-list"]').should(
-      "have.text",
-      "client-roles",
-    );
-  }
-
-  addClientScopes() {
-    cy.findByTestId("config.scopes0").clear().type("one");
-    cy.findByTestId(this.#selectScopeButton).click();
-    cy.findByTestId("config.scopes1").clear().type("two");
-    cy.findByTestId(this.#selectScopeButton).click();
-    cy.findByTestId("config.scopes2").clear().type("three");
-  }
-
-  shouldAddClientScopesCondition() {
-    cy.get(this.#clientPolicy).click();
-    cy.findByTestId(this.#addCondition).click();
-    cy.get(this.#addConditionDrpDwn).click();
-    cy.get(this.#addConditionDrpDwnOption).contains("client-scopes").click();
-
-    this.addClientScopes();
-
-    cy.findByTestId(this.#addConditionSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success! Condition created successfully",
-    );
-    cy.get('ul[class*="pf-v5-c-data-list"]').contains("client-scopes");
-  }
-
-  shouldEditClientRolesCondition() {
-    cy.get(this.#clientPolicy).click();
-
-    cy.findByTestId(this.#clientRolesConditionLink).click();
-
-    cy.findByTestId(this.#roleSelect).should("have.value", "manage-realm");
-    cy.findByTestId(this.#roleSelect).clear().type("admin");
-
-    cy.findByTestId(this.#addConditionSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success! Condition updated successfully",
-    );
-  }
-
-  shouldEditClientScopesCondition() {
-    cy.get(this.#clientPolicy).click();
-
-    cy.findByTestId(this.#clientScopesConditionLink).click();
-
-    cy.findByTestId("config.scopes0").clear().type("edit");
-
-    cy.findByTestId(this.#addConditionSaveBtn).click();
-    cy.get(this.#alertMessage).should(
-      "be.visible",
-      "Success! Condition updated successfully",
-    );
-  }
-
-  checkConditionsListContains(name: string) {
-    cy.get('ul[class*="pf-v5-c-data-list"]').contains(name);
-    return this;
-  }
-
-  deleteClientRolesCondition() {
-    cy.get(this.#clientPolicy).click();
-    cy.findByTestId(this.#deleteClientRolesConditionBtn).click();
-    return this;
-  }
-
-  shouldDeleteClientScopesCondition() {
-    cy.get(this.#clientPolicy).click();
-    cy.findByTestId(this.#deleteClientScopesConditionBtn).click();
-    cy.get(this.#modalDialogTitle).contains("Delete condition?");
-    cy.get(this.#modalDialogBodyText).contains(
-      "This action will permanently delete client-scopes. This cannot be undone.",
-    );
-    cy.findByTestId(this.modalConfirm).contains("Delete");
-    cy.findByTestId(this.modalConfirm).click({ force: true });
-    cy.get('h2[class*="kc-emptyConditions"]').should(
-      "have.text",
-      "No conditions configured",
-    );
-  }
-
-  goToClientPoliciesTab() {
-    cy.findByTestId("rs-clientPolicies-tab").click();
-    return this;
-  }
-
-  goToClientPoliciesList() {
-    cy.findByTestId("rs-policies-clientPolicies-tab").click();
-    return this;
-  }
-
-  goToClientProfilesList() {
-    cy.findByTestId("rs-policies-clientProfiles-tab").click();
-    return this;
-  }
-
-  createNewClientPolicyFromEmptyState(
-    name: string,
-    description: string,
-    cancel?: boolean,
-  ) {
-    cy.findByTestId(this.#createPolicyEmptyStateBtn).click();
-    cy.findByTestId(this.#newClientPolicyNameInput).type(name);
-    cy.findByTestId(this.#newClientPolicyDescriptionInput).type(description);
-    if (!cancel) {
-      cy.findByTestId(this.#saveNewClientPolicyBtn).click();
-    }
-    return this;
-  }
-
-  checkEmptyPolicyList() {
-    cy.findByTestId(this.#createPolicyEmptyStateBtn).should("exist");
-    return this;
-  }
-
-  checkElementNotInList(name: string) {
-    cy.get("tbody").should("not.contain.text", name);
-    return this;
-  }
-
-  checkElementInList(name: string) {
-    cy.get("tbody").should("contain.text", name);
-    return this;
-  }
-
-  deleteClientPolicyFromDetails() {
-    cy.get(this.#clientPolicyDrpDwn).click({ force: true });
-    cy.findByTestId(this.#deleteclientPolicyDrpDwn)
-      .find("button")
-      .click({ force: true });
-    return this;
-  }
-
-  checkTextIsNotInTable(text: string) {
-    cy.get("table").should("not.have.text", text);
-    return this;
-  }
-
-  shouldReloadJSONPolicies() {
-    cy.findByTestId(this.#jsonEditorSelectPolicies).check();
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload").click();
-    cy.findByTestId(this.#jsonEditorSavePoliciesBtn).contains("Save");
-    cy.findByTestId(this.#jsonEditorReloadBtn).contains("Reload");
-  }
-
-  goToLoginTab() {
-    cy.findByTestId(this.loginTab).click();
-    return this;
-  }
-
-  goToEmailTab() {
-    cy.findByTestId(this.emailTab).click();
-    return this;
-  }
-
-  goToThemesTab() {
-    cy.findByTestId(this.themesTab).click();
-    return this;
-  }
-
-  goToLocalizationTab() {
-    cy.findByTestId(this.localizationTab).click();
-    return this;
-  }
-
-  goToLocalizationLocalesSubTab() {
-    cy.findByTestId(this.#localizationLocalesSubTab).click();
-    return this;
-  }
-
-  goToLocalizationRealmOverridesSubTab() {
-    cy.findByTestId(this.#localizationRealmOverridesSubTab).click();
-    return this;
-  }
-
-  goToLocalizationEffectiveMessageBundlesSubTab() {
-    cy.findByTestId(this.#localizationEffectiveMessageBundlesSubTab).click();
-    return this;
-  }
-
-  goToSecurityDefensesTab() {
-    cy.findByTestId(this.securityDefensesTab).click();
-    return this;
-  }
-
-  saveSecurityDefensesHeaders() {
-    cy.findByTestId(this.#securityDefensesHeadersSaveBtn).click();
-  }
-
-  saveSecurityDefensesBruteForce() {
-    cy.findByTestId(this.#securityDefensesBruteForceSaveBtn).click();
-  }
-
-  goToSecurityDefensesHeadersTab() {
-    cy.findByTestId(this.#securityDefensesHeadersTab).click();
-    return this;
-  }
-
-  goToSecurityDefensesBruteForceTab() {
-    cy.findByTestId(this.#securityDefensesBruteForceTab).click();
-    return this;
-  }
-
-  goToSessionsTab() {
-    cy.findByTestId(this.sessionsTab).click();
-    return this;
-  }
-
-  goToTokensTab() {
-    cy.findByTestId(this.tokensTab).click();
-    return this;
-  }
-
-  goToClientProfileByNameLink(profileName: string) {
-    cy.get(this.#clientProfileLink).contains(profileName).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserProfile.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserProfile.ts
deleted file mode 100644
index 4f91865a18a6..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserProfile.ts
+++ /dev/null
@@ -1,240 +0,0 @@
-import Masthead from "../../Masthead";
-import ValidatorConfigDialogue from "./ValidatorConfigDialogue";
-
-export default class UserProfile {
-  readonly masthead = new Masthead();
-  readonly validatorConfigDialogue = new ValidatorConfigDialogue(this);
-
-  #userProfileTab = "rs-user-profile-tab";
-  #attributesTab = "attributesTab";
-  #attributesGroupTab = "attributesGroupTab";
-  #jsonEditorTab = "jsonEditorTab";
-  #createAttributeButton = "createAttributeBtn";
-  #actionsDrpDwn = "actions-dropdown";
-  #deleteDrpDwnOption = "deleteDropdownAttributeItem";
-  #editDrpDwnOption = "editDropdownAttributeItem";
-  #cancelNewAttribute = "attribute-cancel";
-  #newAttributeNameInput = "name";
-  #newAttributeDisplayNameInput = "attributes-displayName";
-  #newAttributeEnabledWhen = 'input[name="enabledWhen"]';
-  #newAttributeEmptyValidators = ".kc-emptyValidators";
-  #newAttributeAnnotationBtn = "annotations-add-row";
-  #newAttributeAnnotationKey = "annotations.0.key";
-  #newAttributeAnnotationValue = "annotations.0.value";
-  #validatorsList = "tbody";
-  #saveNewAttributeBtn = "attribute-create";
-  #addValidatorBtn = "addValidator";
-  #removeValidatorBtn = "deleteValidator";
-  #deleteValidatorBtn = "confirm";
-  #cancelRemovingValidatorBtn = "cancel";
-  #newAttributeRequiredField = "input#kc-required.pf-v5-c-switch__input";
-  #newAttributeUserEdit = "user-edit";
-  #newAttributeAdminEdit = "admin-edit";
-  #newAttributeUserView = "user-view";
-  #newAttributeAdminView = "admin-view";
-  #createAttributesGroupButton = "create-attributes-groups-action";
-  #newAttributesGroupNameInput = "name";
-  #newAttributesGroupDisplayNameInput = 'input[name="displayHeader"]';
-  #saveNewAttributesGroupBtn = "saveGroupBtn";
-
-  goToTab() {
-    cy.findByTestId(this.#userProfileTab).click();
-    return this;
-  }
-
-  goToAttributesTab() {
-    cy.findByTestId(this.#attributesTab).click();
-    return this;
-  }
-
-  goToAttributesGroupTab() {
-    cy.findByTestId(this.#attributesGroupTab).click();
-    return this;
-  }
-
-  goToJsonEditorTab() {
-    cy.findByTestId(this.#jsonEditorTab).click();
-    return this;
-  }
-
-  clickOnCreateAttributeButton() {
-    cy.findByTestId(this.#createAttributeButton).click();
-    return this;
-  }
-
-  selectDropdown() {
-    cy.findByTestId(this.#actionsDrpDwn).click();
-    return this;
-  }
-
-  selectDeleteOption() {
-    cy.findByTestId(this.#deleteDrpDwnOption).click();
-    return this;
-  }
-
-  selectEditOption() {
-    cy.findByTestId(this.#editDrpDwnOption).click();
-    return this;
-  }
-
-  cancelAttributeCreation() {
-    cy.findByTestId(this.#cancelNewAttribute).click();
-    return this;
-  }
-
-  setAttributeNames(name: string, displayName: string) {
-    cy.findByTestId(this.#newAttributeNameInput).type(name);
-    cy.findByTestId(this.#newAttributeDisplayNameInput).type(displayName);
-    return this;
-  }
-
-  checkElementNotInList(name: string) {
-    cy.get(this.#validatorsList).should("not.contain.text", name);
-    return this;
-  }
-
-  saveAttributeCreation() {
-    cy.findByTestId(this.#saveNewAttributeBtn).click();
-    return this;
-  }
-
-  setAttributeRequired() {
-    cy.get(this.#newAttributeRequiredField).first().check({ force: true });
-
-    return this;
-  }
-
-  setAllAttributePermissions() {
-    cy.findByTestId(this.#newAttributeUserEdit).first().check({ force: true });
-    cy.findByTestId(this.#newAttributeUserView).first().check({ force: true });
-    cy.findByTestId(this.#newAttributeAdminView).first().check({ force: true });
-
-    return this;
-  }
-
-  setNoAttributePermissions() {
-    cy.findByTestId(this.#newAttributeAdminEdit)
-      .first()
-      .uncheck({ force: true });
-
-    return this;
-  }
-
-  clickOnCreatesAttributesGroupButton() {
-    cy.findByTestId(this.#createAttributesGroupButton).click();
-    return this;
-  }
-
-  createAttributeGroup(name: string, displayName: string) {
-    cy.findByTestId(this.#newAttributesGroupNameInput).type(name);
-    cy.get(this.#newAttributesGroupDisplayNameInput).type(displayName);
-    return this;
-  }
-
-  saveAttributesGroupCreation() {
-    cy.findByTestId(this.#saveNewAttributesGroupBtn).click();
-    return this;
-  }
-
-  selectElementInList(name: string) {
-    cy.get(this.#validatorsList).contains(name).click();
-    return this;
-  }
-
-  setAttributeGroup(group: string) {
-    cy.get("#group").click();
-    cy.get("#group")
-      .parent()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(group)
-      .click();
-
-    return this;
-  }
-
-  resetAttributeGroup() {
-    return this.setAttributeGroup("None");
-  }
-
-  editAttribute(displayName: string) {
-    cy.findByTestId(this.#newAttributeDisplayNameInput)
-      .click()
-      .clear()
-      .type(displayName);
-    cy.get(this.#newAttributeEnabledWhen).first().check();
-    cy.get(this.#newAttributeEmptyValidators).contains("No validators.");
-    cy.findByTestId(this.#newAttributeAnnotationBtn).click();
-    cy.findByTestId(this.#newAttributeAnnotationKey).type("test");
-    cy.findByTestId(this.#newAttributeAnnotationValue).type("123");
-    return this;
-  }
-
-  addValidator(type: string) {
-    this.clickAddValidator().selectValidatorType(type).clickSave();
-
-    return this;
-  }
-
-  removeValidator() {
-    cy.findByTestId(this.#removeValidatorBtn).click();
-    cy.findByTestId(this.#deleteValidatorBtn).click();
-    return this;
-  }
-
-  cancelAddingValidator(type: string) {
-    this.clickAddValidator().selectValidatorType(type).clickCancel();
-
-    return this;
-  }
-
-  clickAddValidator() {
-    cy.findByTestId(this.#addValidatorBtn).click();
-
-    return this.validatorConfigDialogue;
-  }
-
-  cancelRemovingValidator() {
-    cy.findByTestId(this.#removeValidatorBtn).click();
-    cy.findByTestId(this.#cancelRemovingValidatorBtn).click();
-    return this;
-  }
-
-  #textArea() {
-    return cy.get(".w-tc-editor-text");
-  }
-
-  #getText() {
-    return this.#textArea().get(".view-lines");
-  }
-
-  typeJSON(text: string) {
-    this.#textArea().type(text, { force: true });
-    return this;
-  }
-
-  assertNotificationSaved() {
-    this.masthead.checkNotificationMessage(
-      "Success! User Profile configuration has been saved.",
-    );
-
-    return this;
-  }
-
-  assertNotificationUpdated() {
-    this.masthead.checkNotificationMessage(
-      "User profile settings successfully updated.",
-    );
-
-    return this;
-  }
-
-  shouldHaveText(text: string) {
-    this.#getText().should("have.text", text);
-    return this;
-  }
-
-  saveJSON() {
-    cy.findAllByTestId("save").click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserRegistration.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserRegistration.ts
deleted file mode 100644
index d3297ea25afc..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/UserRegistration.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-export default class UserRegistration {
-  #userRegistrationTab = "rs-userRegistration-tab";
-  #defaultGroupTab = "#pf-tab-20-groups";
-  #addRoleBtn = "assignRole";
-  #addDefaultGroupBtn = "no-default-groups-empty-action";
-  #namesColumn = "tbody td:visible";
-  #addBtn = "assign";
-  #filterTypeDropdown = "filter-type-dropdown";
-
-  goToTab() {
-    cy.findByTestId(this.#userRegistrationTab).click({ force: true });
-    return this;
-  }
-
-  goToDefaultGroupTab() {
-    cy.get(this.#defaultGroupTab).click();
-    return this;
-  }
-
-  addRole() {
-    cy.findByTestId(this.#addRoleBtn).click({ force: true });
-    return this;
-  }
-
-  addDefaultGroup() {
-    cy.findByTestId(this.#addDefaultGroupBtn).click();
-    return this;
-  }
-
-  changeRoleTypeFilter(filter: string) {
-    // Invert the filter because the testid is the current selection
-    const option = filter == "roles" ? "clients" : "roles";
-
-    cy.findByTestId(this.#filterTypeDropdown).click();
-    cy.findByTestId(option).click();
-
-    return this;
-  }
-
-  selectRow(name: string) {
-    cy.get(this.#namesColumn)
-      .contains(name)
-      .parents("tr")
-      .within(() => {
-        cy.get("input").click();
-      });
-    return this;
-  }
-
-  assign() {
-    cy.findByTestId(this.#addBtn).click();
-    return this;
-  }
-}
-
-export class GroupPickerDialog {
-  #addButton = "add-button";
-  #title = ".pf-v5-c-modal-box__title";
-
-  clickRow(groupName: string) {
-    cy.findByTestId(groupName).within(() => cy.get("input").click());
-    return this;
-  }
-
-  clickRoot() {
-    cy.get(".pf-v5-c-breadcrumb__item > button").click();
-    return this;
-  }
-
-  checkTitle(title: string) {
-    cy.get(this.#title).should("have.text", title);
-    return this;
-  }
-
-  clickAdd() {
-    cy.findByTestId(this.#addButton).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/ValidatorConfigDialogue.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/ValidatorConfigDialogue.ts
deleted file mode 100644
index 4a692d301c6e..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/ValidatorConfigDialogue.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import UserProfile from "./UserProfile";
-import Select from "../../../../forms/Select";
-
-export default class ValidatorConfigDialogue {
-  readonly #validatorSelector = "#validator";
-  readonly #saveValidatorButton = "save-validator-role-button";
-  readonly #cancelValidatorButton = "cancel-validator-role-button";
-  readonly #addValue = "addValue";
-
-  readonly userProfile: UserProfile;
-
-  constructor(userProfile: UserProfile) {
-    this.userProfile = userProfile;
-  }
-
-  clickSave() {
-    cy.findByTestId(this.#saveValidatorButton).click();
-
-    return this.userProfile;
-  }
-
-  selectValidatorType(type: string) {
-    Select.selectItem(cy.get(this.#validatorSelector), type);
-
-    return this;
-  }
-
-  setListFieldValues(fieldName: string, values: string[]) {
-    for (let i = 0; i < values.length; i++) {
-      if (i != 0) {
-        cy.findByTestId(this.#addValue).click();
-      }
-
-      const testId = `config.options${i}`;
-      cy.findByTestId(testId).clear().type(values[i]);
-    }
-
-    return this;
-  }
-
-  clickCancel() {
-    cy.findByTestId(this.#cancelValidatorButton).click();
-
-    return this.userProfile;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/RealmSettingsEventsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/RealmSettingsEventsTab.ts
deleted file mode 100644
index 1b9df25b3cdf..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/RealmSettingsEventsTab.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import CommonPage from "../../../../CommonPage";
-import AdminEventsSettingsTab from "./realmsettings_events_subtabs/AdminEventsSettingsTab";
-import EventListenersTab from "./realmsettings_events_subtabs/EventListenersTab";
-import UserEventsSettingsTab from "./realmsettings_events_subtabs/UserEventsSettingsTab";
-
-enum RealmSettingsEventsSubTab {
-  EventListeners = "Event listeners",
-  UserEventsSettings = "User events settings",
-  AdminEventsSettings = "Admin events settings",
-}
-
-export default class RealmSettingsEventsTab extends CommonPage {
-  #eventListenersTab = new EventListenersTab();
-  #userEventsSettingsTab = new UserEventsSettingsTab();
-  #adminEventsSettingsTab = new AdminEventsSettingsTab();
-
-  goToEventListenersSubTab() {
-    this.tabUtils().clickTab(RealmSettingsEventsSubTab.EventListeners, 1);
-    return this.#eventListenersTab;
-  }
-
-  goToUserEventsSettingsSubTab() {
-    this.tabUtils().clickTab(RealmSettingsEventsSubTab.UserEventsSettings, 1);
-    return this.#userEventsSettingsTab;
-  }
-
-  goToAdminEventsSettingsSubTab() {
-    this.tabUtils().clickTab(RealmSettingsEventsSubTab.AdminEventsSettings, 1);
-    return this.#adminEventsSettingsTab;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/AdminEventsSettingsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/AdminEventsSettingsTab.ts
deleted file mode 100644
index 6703b63aa93b..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/AdminEventsSettingsTab.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import ModalUtils from "../../../../../../util/ModalUtils";
-import PageObject from "../../../../components/PageObject";
-import Masthead from "../../../../Masthead";
-
-const masthead = new Masthead();
-const modal = new ModalUtils();
-
-export default class AdminEventsSettingsTab extends PageObject {
-  #saveEventsSwitch = "#adminEventsEnabled-switch";
-  #clearAdminEventsBtn = "#clear-admin-events";
-  #saveBtn = "#save-admin";
-
-  clearAdminEvents() {
-    cy.get(this.#clearAdminEventsBtn).click();
-    modal.checkModalTitle("Clear events");
-    cy.intercept("/admin/realms/*/admin-events").as("clearEvents");
-    modal.confirmModal();
-    cy.wait("@clearEvents");
-    masthead.checkNotificationMessage("The admin events have been cleared");
-    return this;
-  }
-
-  disableSaveEvents() {
-    super.assertSwitchStateOn(cy.get(this.#saveEventsSwitch));
-    cy.get(this.#saveEventsSwitch).parent().click();
-    modal.checkModalTitle("Unsave events?");
-    modal.confirmModal();
-    super.assertSwitchStateOff(cy.get(this.#saveEventsSwitch));
-    return this;
-  }
-
-  enableSaveEvents() {
-    super.assertSwitchStateOff(cy.get(this.#saveEventsSwitch));
-    cy.get(this.#saveEventsSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#saveEventsSwitch));
-    return this;
-  }
-
-  save(
-    { waitForRealm, waitForConfig } = {
-      waitForRealm: true,
-      waitForConfig: false,
-    },
-  ) {
-    if (waitForRealm) {
-      cy.intercept("/admin/realms/*").as("saveRealm");
-    }
-
-    if (waitForConfig) {
-      cy.intercept("/admin/realms/*/events/config").as("saveConfig");
-    }
-
-    cy.get(this.#saveBtn).click();
-
-    if (waitForRealm) {
-      cy.wait("@saveRealm");
-    }
-
-    if (waitForConfig) {
-      cy.wait("@saveConfig");
-    }
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/EventListenersTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/EventListenersTab.ts
deleted file mode 100644
index 7ab854fb0a20..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/EventListenersTab.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import PageObject from "../../../../components/PageObject";
-
-export default class EventListenersTab extends PageObject {}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/UserEventsSettingsTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/UserEventsSettingsTab.ts
deleted file mode 100644
index 47ce5e21bdf5..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/realm_settings/tabs/realmsettings_events_subtabs/UserEventsSettingsTab.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import ModalUtils from "../../../../../../util/ModalUtils";
-import PageObject from "../../../../components/PageObject";
-import Masthead from "../../../../Masthead";
-
-const masthead = new Masthead();
-const modal = new ModalUtils();
-
-export default class UserEventsSettingsTab extends PageObject {
-  #saveEventsSwitch = "#eventsEnabled-switch";
-  #clearUserEventsBtn = "#clear-user-events";
-  #saveBtn = "#save-user";
-
-  clearUserEvents() {
-    cy.get(this.#clearUserEventsBtn).click();
-    modal.checkModalTitle("Clear events");
-    modal.confirmModal();
-    masthead.checkNotificationMessage("The user events have been cleared");
-    return this;
-  }
-
-  disableSaveEventsSwitch() {
-    cy.get(this.#saveEventsSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#saveEventsSwitch));
-    this.waitForPageLoad();
-    modal.checkModalTitle("Unsave events?");
-    modal.confirmModal();
-    super.assertSwitchStateOff(cy.get(this.#saveEventsSwitch));
-    return this;
-  }
-
-  enableSaveEventsSwitch() {
-    cy.get(this.#saveEventsSwitch).parent().click();
-    super.assertSwitchStateOn(cy.get(this.#saveEventsSwitch));
-    return this;
-  }
-
-  save() {
-    cy.get(this.#saveBtn).click();
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/sessions/SessionsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/sessions/SessionsPage.ts
deleted file mode 100644
index 31548e21cb52..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/sessions/SessionsPage.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-export default class SessionsPage {
-  #revocationActionItem = "revocation";
-  #setToNowButton = "set-to-now-button";
-  #actionDropdown = "action-dropdown";
-  #clearNotBeforeButton = "clear-not-before-button";
-  #pushButton = "modal-test-connection-button";
-  #notBeforeInput = "not-before-input";
-
-  setToNow() {
-    this.#openRevocationDialog();
-    cy.findByTestId(this.#setToNowButton).click();
-    Cypress.session.clearAllSavedSessions();
-  }
-
-  checkNotBeforeValueExists() {
-    this.#openRevocationDialog();
-    cy.findByTestId(this.#notBeforeInput).should("not.have.value", "None");
-  }
-
-  clearNotBefore() {
-    this.#openRevocationDialog();
-    cy.findByTestId(this.#clearNotBeforeButton).click();
-  }
-
-  checkNotBeforeCleared() {
-    this.#openRevocationDialog();
-    cy.findByTestId(this.#notBeforeInput).should("have.value", "None");
-  }
-
-  pushRevocation() {
-    this.#openRevocationDialog();
-    cy.findByTestId(this.#pushButton).click();
-  }
-
-  #openRevocationDialog() {
-    cy.findByTestId(this.#actionDropdown).click();
-    cy.intercept("/admin/realms/master").as("fetchRealm");
-    cy.findByTestId(this.#revocationActionItem).click();
-    cy.wait("@fetchRealm");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CreateUserPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CreateUserPage.ts
deleted file mode 100644
index df19539f5697..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CreateUserPage.ts
+++ /dev/null
@@ -1,189 +0,0 @@
-import Masthead from "../../Masthead";
-import FormValidation from "../../../../forms/FormValidation";
-import Select from "../../../../forms/Select";
-
-export default class CreateUserPage {
-  readonly masthead = new Masthead();
-  readonly emptyOptionValue = "Choose...";
-
-  usersEmptyState: string;
-  emptyStateCreateUserBtn: string;
-  addUserBtn: string;
-  joinGroupsBtn: string;
-  joinBtn: string;
-  createBtn: string;
-  saveBtn: string;
-  cancelBtn: string;
-
-  constructor() {
-    this.usersEmptyState = "empty-state";
-    this.emptyStateCreateUserBtn = "no-users-found-empty-action";
-    this.addUserBtn = "add-user";
-    this.joinGroupsBtn = "join-groups-button";
-    this.joinBtn = "join-button";
-    this.createBtn = "user-creation-save";
-    this.saveBtn = "user-creation-save";
-    this.cancelBtn = "user-creation-revert";
-  }
-
-  //#region General Settings
-  createUser(username: string) {
-    return this.setUsername(username);
-  }
-
-  goToCreateUser() {
-    cy.get("body").then((body) => {
-      if (body.find(`[data-testid=${this.addUserBtn}]`).length > 0) {
-        cy.findByTestId(this.addUserBtn).click({ force: true });
-      } else {
-        cy.findByTestId(this.emptyStateCreateUserBtn).click({ force: true });
-      }
-    });
-
-    return this;
-  }
-
-  toggleAddGroupModal() {
-    cy.findByTestId(this.joinGroupsBtn).click();
-
-    return this;
-  }
-
-  joinGroups() {
-    cy.findByTestId(this.joinBtn).click();
-
-    return this;
-  }
-
-  create() {
-    cy.findByTestId(this.createBtn).click();
-
-    return this;
-  }
-
-  update() {
-    cy.findByTestId(this.saveBtn).click();
-
-    return this;
-  }
-
-  assertAttributeValue(attrName: string, expectedValue: string) {
-    cy.findByTestId(attrName).should("have.value", expectedValue);
-
-    return this;
-  }
-
-  assertAttributeFieldExists(attrName: string, shouldExist: boolean) {
-    const chainer = shouldExist ? "exist" : "not.exist";
-    cy.findByTestId(attrName).should(chainer);
-
-    return this;
-  }
-
-  assertAttributeSelect(
-    attrName: string,
-    expectedOptionsWithoutEmptyOption: string[],
-    expectedValue: string,
-  ) {
-    Select.assertSelectedItem(
-      this.#getSelectFieldButton(attrName),
-      expectedValue,
-    );
-
-    return this;
-  }
-
-  #getSelectFieldButton(attrName: string) {
-    const attrSelector = `#${attrName}`;
-    return cy.get(attrSelector);
-  }
-
-  #getSelectOptions(attrName: string) {
-    return this.#getSelectFieldButton(attrName)
-      .parent()
-      .find(".pf-v5-c-select__menu-item");
-  }
-
-  #toggleSelectField(
-    attrName: string,
-    toggleCondition?: (currentlyExpanded: boolean) => boolean,
-  ) {
-    return this.#getSelectFieldButton(attrName).then(($selectField) => {
-      const currentlyExpanded = $selectField.attr("aria-expanded") === "true";
-      if (!toggleCondition || toggleCondition(currentlyExpanded)) {
-        cy.wrap($selectField).click();
-      }
-    });
-  }
-
-  assertAttributeLabel(attrName: string, expectedText: string) {
-    cy.get(`.pf-v5-c-form__label[for='${attrName}'] .pf-v5-c-form__label-text`)
-      .contains(expectedText)
-      .should("exist");
-
-    return this;
-  }
-
-  assertValidationErrorRequired(attrName: string) {
-    FormValidation.assertMessage(
-      cy.findByTestId(attrName),
-      `Please specify '${attrName}'.`,
-    );
-
-    return this;
-  }
-
-  assertGroupDisplayName(group: string, expectedDisplayName: string) {
-    cy.get(`h1#${group.toLowerCase()}`).should(
-      "have.text",
-      expectedDisplayName,
-    );
-
-    return this;
-  }
-
-  setAttributeValue(attrName: string, value: string) {
-    cy.findByTestId(attrName).as("attr").clear();
-    cy.get("@attr").type(value);
-
-    return this;
-  }
-
-  setAttributeValueOnSelect(attrName: string, value: string) {
-    Select.selectItem(this.#getSelectFieldButton(attrName), value);
-
-    return this;
-  }
-
-  setUsername(value: string) {
-    this.#getUsernameField().clear();
-
-    if (value) {
-      this.#getUsernameField().type(value);
-    }
-
-    return this;
-  }
-
-  #getUsernameField() {
-    return cy.findByTestId("username");
-  }
-
-  assertNotificationCreated() {
-    this.masthead.checkNotificationMessage("The user has been created");
-
-    return this;
-  }
-
-  assertNotificationUpdated() {
-    this.masthead.checkNotificationMessage("The user has been saved");
-
-    return this;
-  }
-
-  cancel() {
-    cy.findByTestId(this.cancelBtn).click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CredentialsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CredentialsPage.ts
deleted file mode 100644
index 1a1c70da8c2a..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/CredentialsPage.ts
+++ /dev/null
@@ -1,127 +0,0 @@
-export default class CredentialsPage {
-  readonly #credentialsTab = "credentials";
-  readonly #emptyStatePasswordBtn = "no-credentials-empty-action";
-  readonly #emptyStateResetBtn = "credential-reset-empty-action";
-  readonly #resetBtn = "credentialResetBtn";
-  readonly #setPasswordBtn = "confirm";
-  readonly #credentialResetModal = "credential-reset-modal";
-  readonly #resetModalActionsToggleBtn =
-    "[data-testid=credential-reset-modal] #actions";
-
-  readonly #passwordField = "passwordField";
-  readonly #passwordConfirmationField = "passwordConfirmationField";
-  readonly #resetActions = [
-    "Verify Email",
-    "Update Profile",
-    "Configure OTP",
-    "Update Password",
-    "Terms and Conditions",
-  ];
-  readonly #confirmationButton = "confirm";
-  readonly #editLabelBtn = "editUserLabelBtn";
-  readonly #labelField = "userLabelFld";
-  readonly #editConfirmationBtn = "editUserLabelAcceptBtn";
-  readonly #showDataDialogBtn = "showDataBtn";
-  readonly #closeDataDialogBtn = '.pf-v5-c-modal-box [aria-label^="Close"]';
-
-  goToCredentialsTab() {
-    cy.intercept("/admin/realms/*/users/*/credentials").as("load");
-    cy.findByTestId(this.#credentialsTab).click();
-    cy.wait("@load");
-    cy.wait(200);
-
-    return this;
-  }
-  clickEmptyStatePasswordBtn() {
-    cy.findByTestId(this.#emptyStatePasswordBtn).click();
-
-    return this;
-  }
-
-  clickEmptyStateResetBtn() {
-    cy.findByTestId(this.#emptyStateResetBtn).click();
-
-    return this;
-  }
-
-  clickResetBtn() {
-    cy.findByTestId(this.#resetBtn).click();
-
-    return this;
-  }
-
-  clickResetModalActionsToggleBtn() {
-    cy.get(this.#resetModalActionsToggleBtn).click();
-
-    return this;
-  }
-
-  clickResetModalAction(index: number) {
-    cy.get("[data-testid=credential-reset-modal] .pf-v5-c-menu__list")
-      .contains(this.#resetActions[index])
-      .click();
-
-    return this;
-  }
-
-  clickConfirmationBtn() {
-    cy.findByTestId(this.#confirmationButton).click();
-
-    return this;
-  }
-
-  fillPasswordForm() {
-    cy.findByTestId(this.#passwordField).type("test");
-    cy.findByTestId(this.#passwordConfirmationField).type("test");
-
-    return this;
-  }
-
-  fillResetCredentialForm() {
-    cy.findByTestId(this.#credentialResetModal);
-    this.clickResetModalActionsToggleBtn()
-      .clickResetModalAction(2)
-      .clickResetModalAction(3)
-      .clickConfirmationBtn();
-
-    return this;
-  }
-
-  clickSetPasswordBtn() {
-    cy.findByTestId(this.#setPasswordBtn).click();
-
-    return this;
-  }
-
-  clickEditCredentialLabelBtn() {
-    cy.findByTestId(this.#editLabelBtn)
-      .should("be.visible")
-      .click({ force: true });
-
-    return this;
-  }
-
-  fillEditCredentialForm() {
-    cy.findByTestId(this.#labelField).focus().type("test");
-
-    return this;
-  }
-
-  clickEditConfirmationBtn() {
-    cy.findByTestId(this.#editConfirmationBtn).click();
-
-    return this;
-  }
-
-  clickShowDataDialogBtn() {
-    cy.findByTestId(this.#showDataDialogBtn).click();
-
-    return this;
-  }
-
-  clickCloseDataDialogBtn() {
-    cy.get(this.#closeDataDialogBtn).click({ force: true });
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UserGroupsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UserGroupsPage.ts
deleted file mode 100644
index d0ad1dac3631..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UserGroupsPage.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import ModalUtils from "../../../../../support/util/ModalUtils";
-
-const modalUtils = new ModalUtils();
-
-export default class UserGroupsPage {
-  #userGroupsTab = "user-groups-tab";
-  #noGroupsAddGroupButton = "no-groups-empty-action";
-  #addGroupButton = "add-group-button";
-  #joinGroupButton = "join-button";
-  #leaveGroupButton = "leave-group-button";
-
-  goToGroupsTab() {
-    cy.findByTestId(this.#userGroupsTab).click();
-    return this;
-  }
-
-  toggleAddGroupModal() {
-    // This is dumb, but it's what Cypress wants, so we'll do it 🤷
-    // See: https://docs.cypress.io/guides/core-concepts/conditional-testing#Element-existence
-    cy.get("body")
-      .then(($body) => {
-        if (
-          $body.find(`[data-testid="${this.#noGroupsAddGroupButton}"]`).length
-        ) {
-          return this.#noGroupsAddGroupButton;
-        }
-
-        return this.#addGroupButton;
-      })
-      .then((buttonTestId) => {
-        cy.findByTestId(buttonTestId).click({ force: true });
-      });
-
-    return this;
-  }
-
-  joinGroups() {
-    cy.findByTestId(this.#joinGroupButton).click();
-  }
-
-  leaveGroup() {
-    cy.findByTestId(this.#leaveGroupButton).click();
-    modalUtils.confirmModal();
-    return this;
-  }
-
-  leaveGroupButtonDisabled() {
-    cy.findByTestId(this.#leaveGroupButton).should("be.disabled");
-    return this;
-  }
-
-  leaveGroupButtonEnabled() {
-    cy.findByTestId(this.#leaveGroupButton).should("not.be.disabled");
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersListingPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersListingPage.ts
deleted file mode 100644
index c00186aa6d38..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersListingPage.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-import ListingPage from "../../ListingPage";
-import UsersPage from "./UsersPage";
-
-export enum DefaultUserAttribute {
-  username = "Username",
-  email = "Email",
-  firstName = "First name",
-  lastName = "Last name",
-}
-
-export enum UserFilterType {
-  DefaultSearch = "Default search",
-  AttributeSearch = "Attribute search",
-}
-
-export default class UsersListingPage extends ListingPage {
-  #dropdownPanelBtn = "[data-testid='dropdown-panel-btn']";
-  #userAttributeSearchForm = "[data-testid='user-attribute-search-form']";
-  #userAttributeSearchAddFilterBtn =
-    "[data-testid='user-attribute-search-add-filter-button']";
-  #userAttributeSearchBtn = "[data-testid='search-user-attribute-btn']";
-  #usersPage: UsersPage;
-
-  constructor(usersPage: UsersPage) {
-    super();
-    this.#usersPage = usersPage;
-    console.log("this.u1", usersPage);
-    console.log("this.u2", this.#usersPage);
-  }
-
-  selectUserSearchFilter(filter: UserFilterType) {
-    super.selectFilter("user-search-toggle", filter);
-
-    return this;
-  }
-
-  openUserAttributesSearchForm() {
-    cy.get(this.#dropdownPanelBtn).click();
-    cy.get(this.#userAttributeSearchForm).should("be.visible");
-
-    return this;
-  }
-
-  addUserAttributeSearchCriteria(
-    defaultUserAttribute: DefaultUserAttribute,
-    attributeValue: string,
-  ) {
-    return this.addUserAttributeSearchCriteriaCustom(
-      defaultUserAttribute,
-      attributeValue,
-    );
-  }
-
-  addUserAttributeSearchCriteriaCustom(
-    attributeLabel: string,
-    attributeValue: string,
-  ) {
-    cy.get(this.#userAttributeSearchForm)
-      .find(".pf-m-typeahead")
-      .click()
-      .get(".pf-v5-c-menu__list-item")
-      .contains(attributeLabel)
-      .click({ force: true });
-
-    cy.get(this.#userAttributeSearchForm)
-      .find("#value")
-      .clear()
-      .type(attributeValue);
-
-    cy.get(this.#userAttributeSearchForm)
-      .find(this.#userAttributeSearchAddFilterBtn)
-      .click();
-
-    this.#usersPage.assertAttributeSearchChipExists(
-      attributeLabel,
-      attributeValue,
-      true,
-    );
-
-    return this;
-  }
-
-  triggerAttributesSearch() {
-    cy.get(this.#userAttributeSearchBtn).click();
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersPage.ts
deleted file mode 100644
index 6fa691d6df5f..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/UsersPage.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import PageObject from "../../components/PageObject";
-import UsersListingPage from "./UsersListingPage";
-
-export default class UsersPage extends PageObject {
-  #userListTabLink = "listTab";
-  #permissionsTabLink = "permissionsTab";
-  #userAttributeSearchChipsGroup =
-    "[data-testid='user-attribute-search-chips-group']";
-  #usersListingPage = new UsersListingPage(this);
-
-  public goToUserListTab() {
-    cy.findByTestId(this.#userListTabLink).click();
-
-    return this;
-  }
-
-  public listing() {
-    return this.#usersListingPage;
-  }
-
-  public goToPermissionsTab() {
-    cy.findByTestId(this.#permissionsTabLink).click();
-
-    return this;
-  }
-
-  public goToUserDetailsPage(username: string) {
-    this.#usersListingPage.searchItem(username);
-    this.#usersListingPage.goToItemDetails(username);
-
-    return this;
-  }
-
-  public assertAttributeSearchChipExists(
-    attributeLabel: string,
-    attributeValue: string,
-    exists: boolean,
-  ) {
-    super.assertLabeledChipGroupItemExist(
-      this.#userAttributeSearchChipsGroup,
-      attributeLabel,
-      attributeValue,
-      exists,
-    );
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/UserDetailsPage.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/UserDetailsPage.ts
deleted file mode 100644
index 83cd76426987..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/UserDetailsPage.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-import { RequiredActionAlias } from "@keycloak/keycloak-admin-client/lib/defs/requiredActionProviderRepresentation";
-import PageObject from "../../../components/PageObject";
-
-export default class UserDetailsPage extends PageObject {
-  saveBtn: string;
-  cancelBtn: string;
-  emailInput: string;
-  emailValue: () => string;
-  firstNameInput: string;
-  firstNameValue: string;
-  lastNameInput: string;
-  lastNameValue: string;
-  requiredUserActions: RequiredActionAlias[];
-  identityProviderLinksTab: string;
-  detailsTab: string;
-  consentsTab: string;
-  sessionsTab: string;
-
-  constructor() {
-    super();
-    this.saveBtn = "user-creation-save";
-    this.cancelBtn = "cancel-create-user";
-    this.emailInput = "email";
-    this.emailValue = () =>
-      "example" + "_" + crypto.randomUUID() + "@example.com";
-    this.firstNameInput = "firstName";
-    this.firstNameValue = "firstname";
-    this.lastNameInput = "lastName";
-    this.lastNameValue = "lastname";
-    this.requiredUserActions = [RequiredActionAlias.UPDATE_PASSWORD];
-    this.identityProviderLinksTab = "identity-provider-links-tab";
-    this.detailsTab = "user-details-tab";
-    this.consentsTab = "user-consents-tab";
-    this.sessionsTab = "user-sessions-tab";
-  }
-
-  public goToIdentityProviderLinksTab() {
-    cy.intercept("/admin/realms/master/identity-provider/instances").as(
-      "idpInstances",
-    );
-    cy.intercept("/admin/realms/master/users/*/federated-identity").as(
-      "fedIdentity",
-    );
-    cy.findByTestId(this.identityProviderLinksTab).click();
-    cy.wait(["@idpInstances", "@fedIdentity"]);
-
-    return this;
-  }
-
-  fillUserData() {
-    cy.findByTestId(this.emailInput).type(this.emailValue());
-    cy.findByTestId(this.firstNameInput).type(this.firstNameValue);
-    cy.findByTestId(this.lastNameInput).type(this.lastNameValue);
-
-    return this;
-  }
-
-  save() {
-    cy.findByTestId(this.saveBtn).click();
-
-    return this;
-  }
-
-  cancel() {
-    cy.findByTestId(this.cancelBtn).click();
-
-    return this;
-  }
-
-  goToDetailsTab() {
-    cy.findByTestId(this.detailsTab).click();
-    return this;
-  }
-
-  goToConsentsTab() {
-    cy.findByTestId(this.consentsTab).click();
-    return this;
-  }
-
-  goToSessionsTab() {
-    cy.findByTestId(this.sessionsTab).click();
-    return this;
-  }
-
-  toggleEnabled(userName: string) {
-    this.#getEnabledSwitch(userName).click({ force: true });
-  }
-
-  assertEnabled(userName: string) {
-    this.#getEnabledSwitchLabel(userName)
-      .scrollIntoView()
-      .contains("Enabled")
-      .should("be.visible");
-  }
-
-  assertDisabled(userName: string) {
-    this.#getEnabledSwitchLabel(userName)
-      .scrollIntoView()
-      .contains("Disabled")
-      .should("be.visible");
-  }
-
-  #getEnabledSwitch(userName: string) {
-    return cy.findByTestId(`${userName}-switch`);
-  }
-
-  #getEnabledSwitchLabel(userName: string) {
-    return this.#getEnabledSwitch(userName).closest("label");
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/tabs/IdentityProviderLinksTab.ts b/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/tabs/IdentityProviderLinksTab.ts
deleted file mode 100644
index 2cdf5a4e8372..000000000000
--- a/js/apps/admin-ui/cypress/support/pages/admin-ui/manage/users/user_details/tabs/IdentityProviderLinksTab.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-import ModalUtils from "../../../../../../util/ModalUtils";
-import Masthead from "../../../../Masthead";
-
-const modalUtils = new ModalUtils();
-const masthead = new Masthead();
-
-export default class IdentityProviderLinksTab {
-  #linkedProvidersSection = ".kc-linked-idps";
-  #availableProvidersSection = ".kc-available-idps";
-  #linkAccountBtn = ".pf-v5-c-button.pf-m-link";
-  #linkAccountModalIdentityProviderInput = "idpNameInput";
-  #linkAccountModalUserIdInput = "userId";
-  #linkAccountModalUsernameInput = "userName";
-
-  public clickLinkAccount(idpName: string) {
-    cy.get(this.#availableProvidersSection + " tr")
-      .contains(idpName)
-      .parent()
-      .find(this.#linkAccountBtn)
-      .click();
-
-    return this;
-  }
-
-  public clickUnlinkAccount(idpName: string) {
-    cy.get(this.#linkedProvidersSection + " tr")
-      .contains(idpName)
-      .parent()
-      .parent()
-      .find(this.#linkAccountBtn)
-      .click();
-
-    return this;
-  }
-
-  public typeLinkAccountModalUserId(userId: string) {
-    cy.findByTestId(this.#linkAccountModalUserIdInput).type(userId);
-
-    return this;
-  }
-
-  public typeLinkAccountModalUsername(username: string) {
-    cy.findByTestId(this.#linkAccountModalUsernameInput).type(username);
-
-    return this;
-  }
-
-  public clickLinkAccountModalLinkBtn() {
-    modalUtils.confirmModal();
-    return this;
-  }
-
-  public clickUnlinkAccountModalUnlinkBtn() {
-    modalUtils.confirmModal();
-    return this;
-  }
-
-  public assertNoIdentityProvidersLinkedMessageExist(exist: boolean) {
-    cy.get(this.#linkedProvidersSection).should(
-      (exist ? "" : "not.") + "contain.text",
-      "No identity providers linked.",
-    );
-
-    return this;
-  }
-
-  public assertNoAvailableIdentityProvidersMessageExist(exist: boolean) {
-    cy.get(this.#availableProvidersSection).should(
-      (exist ? "" : "not.") + "contain.text",
-      "No available identity providers.",
-    );
-
-    return this;
-  }
-
-  public assertLinkAccountModalTitleEqual(idpName: string) {
-    modalUtils.assertModalTitleEqual(`Link account to ${idpName}`);
-
-    return this;
-  }
-
-  public assertUnLinkAccountModalTitleEqual(idpName: string) {
-    modalUtils.assertModalTitleEqual(`Unlink account from ${idpName}?`);
-
-    return this;
-  }
-
-  public assertLinkAccountModalIdentityProviderInputEqual(idpName: string) {
-    cy.findByTestId(this.#linkAccountModalIdentityProviderInput).should(
-      "have.value",
-      idpName,
-    );
-
-    return this;
-  }
-
-  public assertNotificationIdentityProviderLinked() {
-    masthead.checkNotificationMessage("Identity provider has been linked");
-
-    return this;
-  }
-
-  public assertNotificationAlreadyLinkedError() {
-    masthead.checkNotificationMessage(
-      "Could not link identity provider User is already linked with provider",
-    );
-
-    return this;
-  }
-
-  public assertNotificationPoviderLinkRemoved() {
-    masthead.checkNotificationMessage("The provider link has been removed");
-
-    return this;
-  }
-
-  public assertLinkedIdentityProvidersItemsEqual(count: number) {
-    if (count > 0) {
-      cy.get(this.#linkedProvidersSection + " tbody")
-        .find("tr")
-        .should("have.length", count);
-    } else {
-      cy.get(this.#linkedProvidersSection + " tbody").should("not.exist");
-    }
-
-    return this;
-  }
-
-  public assertAvailableIdentityProvidersItemsEqual(count: number) {
-    if (count > 0) {
-      cy.get(this.#availableProvidersSection + " tbody")
-        .find("tr")
-        .should("have.length", count);
-    } else {
-      cy.get(this.#availableProvidersSection + " tbody").should("not.exist");
-    }
-    return this;
-  }
-
-  public assertLinkedIdentityProviderExist(idpName: string, exist: boolean) {
-    cy.get(this.#linkedProvidersSection).should(
-      (exist ? "" : "not.") + "contain.text",
-      idpName,
-    );
-
-    return this;
-  }
-
-  public assertAvailableIdentityProviderExist(idpName: string, exist: boolean) {
-    cy.get(this.#availableProvidersSection).should(
-      (exist ? "" : "not.") + "contain.text",
-      idpName,
-    );
-
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/util/AdminClient.ts b/js/apps/admin-ui/cypress/support/util/AdminClient.ts
deleted file mode 100644
index 67644f2da64e..000000000000
--- a/js/apps/admin-ui/cypress/support/util/AdminClient.ts
+++ /dev/null
@@ -1,394 +0,0 @@
-import KeycloakAdminClient from "@keycloak/keycloak-admin-client";
-import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
-import type ClientScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientScopeRepresentation";
-import OrganizationRepresentation from "@keycloak/keycloak-admin-client/lib/defs/organizationRepresentation";
-import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
-import type RoleRepresentation from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
-import type { RoleMappingPayload } from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
-import type { UserProfileConfig } from "@keycloak/keycloak-admin-client/lib/defs/userProfileMetadata";
-import type UserRepresentation from "@keycloak/keycloak-admin-client/lib/defs/userRepresentation";
-import { Credentials } from "@keycloak/keycloak-admin-client/lib/utils/auth";
-import { merge } from "lodash-es";
-import { SERVER_URL } from "../constants";
-
-class AdminClient {
-  readonly #client = new KeycloakAdminClient({
-    baseUrl: SERVER_URL,
-    realmName: "master",
-  });
-
-  #login() {
-    return this.inRealm("master", () =>
-      this.#client.auth({
-        username: "admin",
-        password: "admin",
-        grantType: "password",
-        clientId: "admin-cli",
-      }),
-    );
-  }
-
-  async auth(credentials: Credentials) {
-    return this.#client.auth(credentials);
-  }
-
-  async loginUser(username: string, password: string, clientId: string) {
-    return this.#client.auth({
-      username: username,
-      password: password,
-      grantType: "password",
-      clientId: clientId,
-    });
-  }
-
-  async createRealm(realm: string, payload?: RealmRepresentation) {
-    await this.#login();
-    await this.#client.realms.create({ realm, ...payload });
-  }
-
-  async updateRealm(realm: string, payload: RealmRepresentation) {
-    await this.#login();
-    await this.#client.realms.update({ realm }, payload);
-  }
-
-  async getRealm(realm: string) {
-    await this.#login();
-    return await this.#client.realms.findOne({ realm });
-  }
-
-  async deleteRealm(realm: string) {
-    await this.#login();
-    await this.#client.realms.del({ realm });
-  }
-
-  async createClient(
-    client: ClientRepresentation & {
-      realm?: string;
-    },
-  ) {
-    await this.#login();
-    await this.#client.clients.create(client);
-  }
-
-  async deleteClient(clientName: string) {
-    await this.#login();
-    const client = (
-      await this.#client.clients.find({ clientId: clientName })
-    )[0];
-
-    if (client) {
-      await this.#client.clients.del({ id: client.id! });
-    }
-  }
-
-  async getClient(clientName: string) {
-    await this.#login();
-    return (await this.#client.clients.find({ clientId: clientName }))[0];
-  }
-
-  async createGroup(groupName: string) {
-    await this.#login();
-    return await this.#client.groups.create({ name: groupName });
-  }
-
-  async createSubGroups(groups: string[]) {
-    await this.#login();
-    let parentGroup = undefined;
-    const createdGroups = [];
-    for (const group of groups) {
-      if (!parentGroup) {
-        parentGroup = await this.#client.groups.create({ name: group });
-      } else {
-        parentGroup = await this.#client.groups.createChildGroup(
-          { id: parentGroup.id },
-          { name: group },
-        );
-      }
-      createdGroups.push(parentGroup);
-    }
-    return createdGroups;
-  }
-
-  async deleteGroups() {
-    await this.#login();
-    const groups = await this.#client.groups.find();
-    for (const group of groups) {
-      await this.#client.groups.del({ id: group.id! });
-    }
-  }
-
-  async createUser(user: UserRepresentation) {
-    await this.#login();
-
-    const { id } = await this.#client.users.create(user);
-    const createdUser = await this.#client.users.findOne({ id });
-
-    if (!createdUser) {
-      throw new Error(
-        "Unable to create user, created user could not be found.",
-      );
-    }
-
-    return createdUser;
-  }
-
-  async updateUser(id: string, payload: UserRepresentation) {
-    await this.#login();
-    return this.#client.users.update({ id }, payload);
-  }
-
-  async getAdminUser() {
-    await this.#login();
-    const [user] = await this.#client.users.find({ username: "admin" });
-    return user;
-  }
-
-  async addUserToGroup(userId: string, groupId: string) {
-    await this.#login();
-    await this.#client.users.addToGroup({ id: userId, groupId });
-  }
-
-  async createUserInGroup(username: string, groupId: string) {
-    await this.#login();
-    const user = await this.createUser({ username, enabled: true });
-    await this.#client.users.addToGroup({ id: user.id!, groupId });
-  }
-
-  async addRealmRoleToUser(userId: string, roleName: string) {
-    await this.#login();
-
-    const realmRole = await this.#client.roles.findOneByName({
-      name: roleName,
-    });
-
-    await this.#client.users.addRealmRoleMappings({
-      id: userId,
-      roles: [realmRole as RoleMappingPayload],
-    });
-  }
-
-  async addClientRoleToUser(
-    userId: string,
-    clientId: string,
-    roleNames: string[],
-  ) {
-    await this.#login();
-
-    const client = await this.#client.clients.find({ clientId });
-    const clientRoles = await Promise.all(
-      roleNames.map(
-        async (roleName) =>
-          (await this.#client.clients.findRole({
-            id: client[0].id!,
-            roleName: roleName,
-          })) as RoleMappingPayload,
-      ),
-    );
-    await this.#client.users.addClientRoleMappings({
-      id: userId,
-      clientUniqueId: client[0].id!,
-      roles: clientRoles,
-    });
-  }
-
-  async deleteUser(username: string, ignoreNonExisting: boolean = false) {
-    await this.#login();
-    const foundUsers = await this.#client.users.find({ username });
-    if (foundUsers.length == 0) {
-      if (ignoreNonExisting) {
-        return;
-      } else {
-        throw new Error(`User not found: ${username}`);
-      }
-    }
-
-    await this.#client.users.del({ id: foundUsers[0].id! });
-  }
-
-  async createClientScope(scope: ClientScopeRepresentation) {
-    await this.#login();
-    return await this.#client.clientScopes.create(scope);
-  }
-
-  async deleteClientScope(clientScopeName: string) {
-    await this.#login();
-    const clientScope = await this.#client.clientScopes.findOneByName({
-      name: clientScopeName,
-    });
-    return await this.#client.clientScopes.del({ id: clientScope?.id! });
-  }
-
-  async existsClientScope(clientScopeName: string) {
-    await this.#login();
-    return (await this.#client.clientScopes.findOneByName({
-      name: clientScopeName,
-    })) == undefined
-      ? false
-      : true;
-  }
-
-  async addDefaultClientScopeInClient(
-    clientScopeName: string,
-    clientId: string,
-  ) {
-    await this.#login();
-    const scope = await this.#client.clientScopes.findOneByName({
-      name: clientScopeName,
-    });
-    const client = await this.#client.clients.find({ clientId: clientId });
-    return await this.#client.clients.addDefaultClientScope({
-      id: client[0]?.id!,
-      clientScopeId: scope?.id!,
-    });
-  }
-
-  async removeDefaultClientScopeInClient(
-    clientScopeName: string,
-    clientId: string,
-  ) {
-    await this.#login();
-    const scope = await this.#client.clientScopes.findOneByName({
-      name: clientScopeName,
-    });
-    const client = await this.#client.clients.find({ clientId: clientId });
-    return await this.#client.clients.delDefaultClientScope({
-      id: client[0]?.id!,
-      clientScopeId: scope?.id!,
-    });
-  }
-
-  async getUserProfile(realm: string) {
-    await this.#login();
-
-    return await this.#client.users.getProfile({ realm });
-  }
-
-  async updateUserProfile(realm: string, userProfile: UserProfileConfig) {
-    await this.#login();
-
-    await this.#client.users.updateProfile(merge(userProfile, { realm }));
-  }
-
-  async addGroupToProfile(realm: string, groupName: string) {
-    await this.#login();
-
-    const currentProfile = await this.#client.users.getProfile({ realm });
-
-    await this.#client.users.updateProfile({
-      ...currentProfile,
-      realm,
-      ...{ groups: [...currentProfile.groups!, { name: groupName }] },
-    });
-  }
-
-  async createRealmRole(payload: RoleRepresentation) {
-    await this.#login();
-
-    return await this.#client.roles.create(payload);
-  }
-
-  async deleteRealmRole(name: string) {
-    await this.#login();
-    return await this.#client.roles.delByName({ name });
-  }
-
-  async createIdentityProvider(idpDisplayName: string, alias: string) {
-    await this.#login();
-    const identityProviders =
-      (await this.#client.serverInfo.find()).identityProviders || [];
-    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
-    await this.#client.identityProviders.create({
-      providerId: idp?.id!,
-      displayName: idpDisplayName,
-      alias: alias,
-    });
-  }
-
-  async deleteIdentityProvider(idpAlias: string) {
-    await this.#login();
-    await this.#client.identityProviders.del({
-      alias: idpAlias,
-    });
-  }
-
-  async unlinkAccountIdentityProvider(
-    username: string,
-    idpDisplayName: string,
-  ) {
-    await this.#login();
-    const user = await this.#client.users.find({ username });
-    const identityProviders =
-      (await this.#client.serverInfo.find()).identityProviders || [];
-    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
-    await this.#client.users.delFromFederatedIdentity({
-      id: user[0].id!,
-      federatedIdentityId: idp?.id!,
-    });
-  }
-
-  async linkAccountIdentityProvider(username: string, idpDisplayName: string) {
-    await this.#login();
-    const user = await this.#client.users.find({ username });
-    const identityProviders =
-      (await this.#client.serverInfo.find()).identityProviders || [];
-    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
-    const fedIdentity = {
-      identityProvider: idp?.id,
-      userId: "testUserIdApi",
-      userName: "testUserNameApi",
-    };
-    await this.#client.users.addToFederatedIdentity({
-      id: user[0].id!,
-      federatedIdentityId: idp?.id!,
-      federatedIdentity: fedIdentity,
-    });
-  }
-
-  async addLocalizationText(locale: string, key: string, value: string) {
-    await this.#login();
-    await this.#client.realms.addLocalization(
-      { realm: this.#client.realmName, selectedLocale: locale, key: key },
-      value,
-    );
-  }
-
-  async removeAllLocalizationTexts() {
-    await this.#login();
-    const localesWithTexts = await this.#client.realms.getRealmSpecificLocales({
-      realm: this.#client.realmName,
-    });
-    await Promise.all(
-      localesWithTexts.map((locale) =>
-        this.#client.realms.deleteRealmLocalizationTexts({
-          realm: this.#client.realmName,
-          selectedLocale: locale,
-        }),
-      ),
-    );
-  }
-
-  async inRealm<T>(realm: string, fn: () => Promise<T>) {
-    const prevRealm = this.#client.realmName;
-    this.#client.realmName = realm;
-    try {
-      return await fn();
-    } finally {
-      this.#client.realmName = prevRealm;
-    }
-  }
-
-  async createOrganization(org: OrganizationRepresentation) {
-    await this.#login();
-    await this.#client.organizations.create(org);
-  }
-
-  async deleteOrganization(name: string) {
-    await this.#login();
-    const { id } = (await this.#client.organizations.find({ search: name }))[0];
-    await this.#client.organizations.delById({ id: id! });
-  }
-}
-
-const adminClient = new AdminClient();
-
-export default adminClient;
diff --git a/js/apps/admin-ui/cypress/support/util/ModalUtils.ts b/js/apps/admin-ui/cypress/support/util/ModalUtils.ts
deleted file mode 100644
index 133e497e2dd7..000000000000
--- a/js/apps/admin-ui/cypress/support/util/ModalUtils.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-import PageObject from "../pages/admin-ui/components/PageObject";
-import TablePage from "../pages/admin-ui/components/TablePage";
-
-export default class ModalUtils extends PageObject {
-  #modalDiv = ".pf-v5-c-modal-box";
-  #modalTitle = ".pf-v5-c-modal-box .pf-v5-c-modal-box__title-text";
-  #modalMessage = ".pf-v5-c-modal-box .pf-v5-c-modal-box__body";
-  #confirmModalBtn = "confirm";
-  #cancelModalBtn = "cancel";
-  #closeModalBtn = ".pf-v5-c-modal-box .pf-m-plain";
-  #copyToClipboardBtn = '[id*="copy-button"]';
-  #addModalDropdownBtn = "#add-dropdown";
-  #addModalDropdownItem = ".pf-v5-c-modal-box__footer .pf-v5-c-menu__content";
-  #addBtn = "add";
-  #tablePage = new TablePage(TablePage.tableSelector);
-  #confirmDuplicateModalBtn = "duplicateGroup";
-
-  table() {
-    return this.#tablePage;
-  }
-
-  add() {
-    cy.findByTestId(this.#addBtn).click();
-    return this;
-  }
-
-  confirmModal() {
-    cy.findByTestId(this.#confirmModalBtn).click({ force: true });
-
-    return this;
-  }
-
-  confirmDuplicateModal() {
-    cy.findByTestId(this.#confirmDuplicateModalBtn).click();
-
-    return this;
-  }
-
-  checkConfirmButtonText(text: string) {
-    cy.findByTestId(this.#confirmModalBtn).contains(text);
-
-    return this;
-  }
-
-  confirmModalWithItem(itemName: string) {
-    cy.get(this.#addModalDropdownBtn).click();
-    cy.get(this.#addModalDropdownItem).contains(itemName).click();
-
-    return this;
-  }
-
-  cancelModal() {
-    cy.findByTestId(this.#cancelModalBtn).click({ force: true });
-
-    return this;
-  }
-
-  cancelButtonContains(text: string) {
-    cy.findByTestId(this.#cancelModalBtn).contains(text);
-
-    return this;
-  }
-
-  copyToClipboard() {
-    cy.get(this.#copyToClipboardBtn).click();
-
-    return this;
-  }
-
-  closeModal() {
-    cy.get(this.#closeModalBtn).click({ force: true });
-
-    return this;
-  }
-
-  checkModalTitle(title: string) {
-    //deprecated
-    this.assertModalTitleEqual(title);
-    return this;
-  }
-
-  checkModalMessage(message: string) {
-    cy.get(this.#modalMessage).invoke("text").should("eq", message);
-
-    return this;
-  }
-
-  assertModalMessageContainText(text: string) {
-    cy.get(this.#modalMessage).should("contain.text", text);
-    return this;
-  }
-
-  assertModalHasElement(elementSelector: string, exist: boolean) {
-    cy.get(this.#modalDiv)
-      .find(elementSelector)
-      .should((exist ? "" : ".not") + "exist");
-    return this;
-  }
-
-  assertModalVisible(isVisible: boolean) {
-    super.assertIsVisible(cy.get(this.#modalDiv), isVisible);
-    return this;
-  }
-
-  assertModalExist(exist: boolean) {
-    super.assertExist(cy.get(this.#modalDiv), exist);
-    return this;
-  }
-
-  assertModalTitleEqual(text: string) {
-    cy.get(this.#modalTitle).invoke("text").should("eq", text);
-    return this;
-  }
-}
diff --git a/js/apps/admin-ui/cypress/support/util/grantClipboardAccess.ts b/js/apps/admin-ui/cypress/support/util/grantClipboardAccess.ts
deleted file mode 100644
index 86a12a14da5b..000000000000
--- a/js/apps/admin-ui/cypress/support/util/grantClipboardAccess.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-export default function grantClipboardAccess() {
-  // Use the Chrome debugger protocol to grant access to the clipboard.
-  // https://chromedevtools.github.io/devtools-protocol/tot/Browser/#method-grantPermissions
-  cy.wrap(
-    Cypress.automation("remote:debugger:protocol", {
-      command: "Browser.grantPermissions",
-      params: {
-        permissions: ["clipboardReadWrite", "clipboardSanitizedWrite"],
-        origin: window.location.origin,
-      },
-    }),
-  );
-}
diff --git a/js/apps/admin-ui/cypress/support/util/keycloak_hooks.ts b/js/apps/admin-ui/cypress/support/util/keycloak_hooks.ts
deleted file mode 100644
index 75970fe737dc..000000000000
--- a/js/apps/admin-ui/cypress/support/util/keycloak_hooks.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-export const keycloakBefore = () => {
-  /*
-      Prevent unpredictable 401 errors from failing individual tests.
-      These are most often occurring during the login process:
-         GET /admin/serverinfo/
-         GET /admin/master/console/whoami
-    */
-  cy.on("uncaught:exception", (err) => {
-    console.log("-------------------");
-    console.log(err);
-    console.log("--------------------");
-    return false;
-  });
-  cy.visit("");
-  cy.get('[role="progressbar"]').should("not.exist");
-};
diff --git a/js/apps/admin-ui/cypress/tsconfig.json b/js/apps/admin-ui/cypress/tsconfig.json
deleted file mode 100644
index 801e32ca195c..000000000000
--- a/js/apps/admin-ui/cypress/tsconfig.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "extends": "../tsconfig.json",
-  "include": ["**/*", "../src/i18next.d.ts"],
-  "compilerOptions": {
-    "types": [
-      "node",
-      "cypress",
-      "@testing-library/cypress",
-      "@4tw/cypress-drag-drop",
-      "cypress-axe"
-    ],
-    "module": "ES2015",
-    "target": "ES2015",
-    "useDefineForClassFields": false
-  }
-}
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ca.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ca.properties
index 2efb3d76d19e..d2f459bbf097 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ca.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ca.properties
@@ -1,278 +1,275 @@
 storePassword=Contrasenya del magatzem
-logoutServiceRedirectBindingURLHelp=URL d''enllaç SAML de redirecció per a la desconnexió única del client. Pots deixar-ho en blanc si estàs fent servir un enllaç diferent.
+logoutServiceRedirectBindingURLHelp=URL d’enllaç SAML de redirecció per al servei de desconnexió única del client. Podeu deixar-ho en blanc si feu servir un enllaç diferent.
 themes=Temes
 password=Contrasenya
-clientType=''OpenID connect'' permet als clients verificar la identitat de l''usuari final basat en l''autenticació realitzada per un servidor d''autorització. ''SAML'' habilita l''autenticació i autorització d''escenaris basats en web incloent cross-domain i single sign-on (SSO) i utilitza tokens de seguretat que contenen afirmacions per passar informació.
+clientType=Tipus de client
 composite=Compost
-clientSignature=Signatura de Client requerida
-waitIncrementSecondsHelp=Quan s''ha arribat al llindar d''error, quant de temps ha d''estar un usuari bloquejat?
-nodeHost=Host del node
-mapperType=Tipus d''assignador
-quickLoginCheckMilliSeconds=Si ocorren errors de forma concurrent i molt ràpida, bloquejar a l''usuari.
+clientSignature=Signatura de client requerida
+waitIncrementSecondsHelp=Quan s’arriba al llindar de fallida, quant de temps ha d’estar blocat l’usuari?
+nodeHost=Servidor del node
+mapperType=Tipus de mapador
+quickLoginCheckMilliSeconds=Comprovació d’entrada ràpida en mil·lisegons
 edit=Edita
-unspecified=no especificat
-archiveFormat=Format d''Arxiu
+unspecified=No especificat
+archiveFormat=Format del fitxer
 validatorDialogColNames.colName=Nom de rol
-associatedRolesText=Rols Associats
-certificateHelp=Certificat de client per validar els JWT emesos per aquest client i signats amb la clau privada del client del teu magatzem de claus.
+associatedRolesText=Rols associats
+certificateHelp=Certificat de client per a validar els JWT emesos pel client i signats amb la clau privada del client del vostre magatzem de claus.
 credentialType=Tipus
 defaultLocale=Idioma per defecte
-clientIdHelp=L''identificador del client registrat amb el proveïdor d''identitat.
-forcePostBindingHelp=Fer servir sempre POST per a les respostes
-authorizationUrl=URL d''autorització
+clientIdHelp=L’identificador del client registrat amb el proveïdor d’identitat.
+forcePostBindingHelp=Fes servir vinculacions POST per a les respostes.
+authorizationUrl=URL d'autorització
 roleName=Nom de rol
-httpPostBindingAuthnRequestHelp=Indica si AuthnRequest ha de ser enviat usant HTTP-POST. Si no està activat es fa HTTP-REDIRECT.
+httpPostBindingAuthnRequestHelp=Indica si l’AuthnRequest ha de ser enviat usant la vinculació HTTP-POST. Si és fals, s’utilitzarà la vinculació HTTP-REDIRECT.
 securityDefences=Defenses de seguretat
-accessTokenLifespanHelp=Temps màxim abans que un token d''accés expiri. Es recomana que aquest valor sigui curt en relació al temps màxim de SSO
-includeInAccessToken.tooltip=S''hauria d'afegir la identitat reclamada al token d''accés?
-redirectURIHelp=L''URI de redirecció usada per configurar el proveïdor d''identitat.
-idpInitiatedSsoRelayStateHelp=Estat de retransmissió que vols enviar amb una petició SAML quan s''inicia un SSO iniciat per l''IDP
-attestationPreference.none=cap
+accessTokenLifespanHelp=Temps màxim abans que un testimoni d’accés expiri. Es recomana que aquest valor sigui curt amb relació al temps màxim de SSO.
+includeInAccessToken.tooltip=S'hauria d'afegir la declaració al testimoni d'accés?
+redirectURIHelp=L’URI de redirecció usada per a configurar el proveïdor d'identitat.
+idpInitiatedSsoRelayStateHelp=Estat de retransmissió que voleu enviar amb una petició SAML quan es vol fer servir un SSO iniciat per l’IDP.
+attestationPreference.none=Cap
 revocation=Revocació
-clientDescriptionHelp=Indica la descripció del client. Per exemple ''My Client for TimeSheets''. També suporta claus per a valors localitzats. Per exemple: ${my_client_description}
-clientAuthenticator=Client autenticador
-useEntityDescriptor=Importar metadades des d''un descriptor d'entitat remot d''un IDP de SAML
-logoutServiceRedirectBindingURL=URL d''enllaç SAML de redirecció per a la desconnexió
-loginActionTimeout=Temps màxim d''acció en l''inici de sessió
-idpInitiatedSsoRelayState=Estat de retransmissió d''un SSO iniciat per l''IDP
-validatingX509Certs=Validant certificat X509
-masterSamlProcessingUrl=URL principal de processament SAML
+clientDescriptionHelp=Indica la descripció del client. Per exemple «El meu client per a fulls de control de temps». També suporta claus per a valors localitzats. Per exemple: ${my_client_description}.
+clientAuthenticator=Autenticador de client
+useEntityDescriptor=Utilitza el descriptor de l'entitat
+logoutServiceRedirectBindingURL=URL d’enllaç SAML de redirecció per a la desconnexió
+loginActionTimeout=Temps màxim d’acció en l’inici de sessió
+idpInitiatedSsoRelayState=Estat de retransmissió d'un SSO iniciat per l'IDP
+validatingX509Certs=S'està validant certificat X509
+masterSamlProcessingUrl=URL mestre de processament SAML
 key=Clau
-validRedirectURIs=Patró d''URI vàlida per a la qual un navegador pot sol·licitar la redirecció després d''un inici o tancament de sessió completat. Es permeten comodins simples p.ex. ''http\://example.com/*''. També es poden indicar rutes relatives p.ex. ''/my/relative/path/*''. Les rutes relatives generaran un URI de redirecció fent servir el host i port de la petició. Per SAML, s''han de fixar patrons d''URI vàlids si vols confiar en l''URL del servei del consumidor indicada en la petició d''inici de sessió.
-userInfoUrl=URL d''informació d''usuari
-assertionConsumerServicePostBindingURL=Assertion Consumer Service POST Binding URL
-usermodel.clientRoleMapping.clientId.label=ID Client
-identityProviders=Proveïdors d''identitat
-clientId=ID Client
-nameIdPolicyFormat=Format de política NameID
-idpInitiatedSsoUrlName=Nom del fragment de l''URL per referenciar al client quan vols un SSO iniciat per l''IDP. Deixant això buit desactiva els SSO iniciats per l''IDP. L''URL referenciada des del navegador serà\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}
-validatingX509CertsHelp=El certificat en format PEM que ha de fer-se servir per comprovar les signatures.
-importFile=Arxiu d''Importació
-clientLoginTimeoutHelp=Temps màxim que un client té per finalitzar el protocol d''obtenció del token d''accés. Hauria de ser normalment de l''ordre d''1 minut.
-lastAccess=Últim Accés
-ssoSessionIdle=Temps màxim que una sessió pot estar inactiva abans que expiri. Els tokens i sessions de navegador són invalidades quan la sessió expira.
+validRedirectURIs=Patró d'URI vàlid al qual un navegador pot redirigir després d'un inici de sessió satisfactori. Es permeten comodins simples, com ara «https://exemple.com/*». També es poden indicar rutes relatives, p. ex. «/una/ruta/relativa/*». Les rutes relatives ho són a l'URL arrel del client; si l'URL no s'especifica, s'utilitza l'URL arrel del servidor d'autenticació. Per a SAML, definiu patrons d'URI vàlids si voleu confiar en l'URL del servei del consumidor integrat en la petició d'inici de sessió.
+userInfoUrl=URL d’informació d’usuari
+assertionConsumerServicePostBindingURL=URL d’enllaç POST del servei consumidor d'afirmacions
+usermodel.clientRoleMapping.clientId.label=ID del client
+identityProviders=Proveïdors d’identitat
+clientId=ID del client
+nameIdPolicyFormat=Format de la política NameID
+idpInitiatedSsoUrlName=Nom de l’URL d’un SSO iniciat per l’IDP
+importFile=Importa un fitxer
+clientLoginTimeoutHelp=Temps màxim que un client té per a finalitzar el protocol d’obtenció del testimoni d'accés. Normalment hauria de ser 1 minut.
+lastAccess=Últim accés
+ssoSessionIdle=Temps que una sessió pot estar inactiva abans que expiri. Els testimonis i sessions de navegador s'invaliden quan la sessió expira.
 xFrameOptions=X-Frame-Options
-prompts.none=cap
-emailTheme=Tema d''email
+prompts.none=Cap
+emailTheme=Tema de correu electrònic
 times.minutes=Minuts
-nameIdFormatHelp=El format de NameID que es farà servir per al títol
-forcePostBinding=Forçar enllaços POST
-discoveryEndpoint=Importa metadades des d''un descriptor d''un proveïdor d''identitat (IDP) remot.
-registerNodeManually=Registrar node manualment
+nameIdFormatHelp=El format de nom de l'ID que es farà servir per al títol.
+forcePostBinding=Força els enllaços POST
+discoveryEndpoint=Extrem de descobriment
+registerNodeManually=Registra un node manualment
 redirectURI=URI de redirecció
-signDocuments=Signar documents
-tokenUrl=Token URL
-consentRequired=Si està habilitat, els usuaris han de consentir l''accés del client.
+signDocuments=Signa els documents
+tokenUrl=URL del testimoni
+consentRequired=Es requereix consentiment
 notBefore=No abans de
-editUsername=Edita el nom d''usuari
+editUsername=Si s’habilita, el camp de nom d’usuari és editable; altrament, és de només lectura.
 lastRegistration=Últim registre
-requireSsl=Sol·licitar SSL
-samlEntityDescriptor=Et permet carregar metadades d''un proveïdor d''identitat (IDP) extern d''un arxiu de coniguración o descarregar des d''una URL.
-wantAuthnRequestsSigned=Signar AuthnRequests
-usermodel.attr.tooltip=Nom de l''atribut d''usuari emmagatzemat que és el nom de l''atribut dins el map UserModel.attribute.
+requireSsl=Requereix SSL
+samlEntityDescriptor=Descriptor d'entitat SAML
+wantAuthnRequestsSigned=Voleu que els AuthnRequests siguin signats?
+usermodel.attr.tooltip=Nom de l’atribut d’usuari emmagatzemat, que és el nom de l’atribut dins el mapa UserModel.attribute.
 export=Exporta
-generateNewKeys=Generar noves claus
-offlineSessionIdle=Inactivitat de sessió sense connexió
-backchannelLogout=Backchannel Logout
-userRegistrationHelpText=Habilitar/deshabilitar la pàgina de registre. Un enllaç per al registre es mostrarà també a la pàgina d''inici de sessió.
-revokeRefreshToken=Revocar el token d''actualització
-minimumQuickLoginWaitSeconds=Temps mínim entre errors de connexió ràpids
-prompts.login=login
-offlineSessionIdleHelp=Temps màxim inactiu d''una sessió sense connexió abans que expiri. Necessites fer servi un token sense connexió per refrescar almenys una vegada dins d'aquest període, en un altre cas la sessió sense connexió expirarà.
-forceNameIdFormatHelp=Ignorar la petició de subjecte NameID i fer servir la configurada a la consola d''administració.
+generateNewKeys=Genera claus RSA
+offlineSessionIdle=Inactivitat de la sessió fora de línia
+backchannelLogout=Desconnexió de canal posterior
+userRegistrationHelpText=Activa/Desactiva la pàgina de registre. També es mostrarà un enllaç per al registre a la pàgina d'inici de sessió.
+revokeRefreshToken=Revoca el testimoni d’actualització
+minimumQuickLoginWaitSeconds=Espera mínima entre connexions ràpides
+prompts.login=Inici de sessió
+offlineSessionIdleHelp=Temps màxim inactiu d'una sessió sense connexió abans que expiri. Necessiteu fer servir un token sense connexió per a refrescar almenys una vegada dins d'aquest període, altrament la sessió sense connexió expirarà.
+forceNameIdFormatHelp=Ignora el format sol·licitat del subjecte NameID i fes servir el configurat a la consola d'administració.
 realmRoles=Rols de domini
 port=Port
-adminThemeHelp=Selecciona el tema per a la consola d''administració.
-nameIdFormat=Format de NameID
-validRedirectUri=URIs de redirecció vàlides
+adminThemeHelp=Seleccioneu el tema per a la consola d’administració.
+nameIdFormat=Format de l’ID de nom
+validRedirectUri=URI de redirecció vàlids
 clientList=Clients
-userSession.modelNote.label=Nota sessió usuari
-logoutServicePostBindingURL=URL d''enllaç SAML POST per a la desconnexió
-assertionConsumerServicePostBindingURLHelp=SAML POST Binding URL for the client''s assertion consumer service (login responses).  You can leave this blank if you do not have a URL for this binding.
-singleLogoutServiceUrl=URL de servei de desconnexió únic
-userAttribute=Atribut d''usuari
+userSession.modelNote.label=Nota de la sessió d’usuari
+logoutServicePostBindingURL=URL d'enllaç SAML POST per a la desconnexió
+singleLogoutServiceUrl=URL del servei de desconnexió únic
+userAttribute=Atribut d'usuari
 roles=Rols
 description=Descripció
-validateSignatureHelp=Habilitar/deshabilitar la validació de signatures de proveïdors d''identitat (IDP) externs
+validateSignatureHelp=Habilita/inhabilita la validació de signatures de proveïdors d’identitat (IDP) externs.
 clientSignatureHelp=Signarà el client les seves peticions i respostes SAML? I haurien de ser validades?
-title=Sessions
-keyPasswordHelp=Contrasenya per accedir a la clau privada continguda en l''arxiu
-verifyEmail=Verificar email
-frontchannelLogout=Desconnexió en primer pla (Front Channel)
-formatOption=Format
-loginTheme=Tema d''inici de sessió
+title=Autenticació
+keyPasswordHelp=Contrasenya per a la clau privada
+verifyEmail=Verifica el correu electrònic
+frontchannelLogout=Desconnexió del canal frontal
+formatOption=Opció de format
+loginTheme=Tema d'inici de sessió
 provider=Proveïdor
-providerId=ID
+providerId=ID del proveïdor
 titleRoles=Rols de domini
-nodeReRegistrationTimeout=Temps d''espera de re-registre de node
-loginTimeout=Temps màxim de desconnexió
-accessTokenLifespan=Durada del token d''accés
+nodeReRegistrationTimeout=Temps d'espera de re-registre de node
+loginTimeout=Temps màxim de connexió
+accessTokenLifespan=Durada del testimoni d'accés
 setToNow=Fixar a ara
-signAssertionsHelp=Haurien de signar-se les assercions en documents SAML? Aquest ajust no és necessari si el document ja s''està signant.
-validateSignature=Validar signatures
+signAssertionsHelp=Haurien de signar-se les assercions en documents SAML? Aquest ajust no és necessari si el document ja s'està signant.
+validateSignature=Valida les signatures
 headers=Capçaleres
-fineGrainSamlEndpointConfig=Fine Grain SAML Endpoint Configuration
 hours=Hores
-encryptAssertions=Xifrar afirmacions
-keyAliasHelp=Àlies de l''arxiu de la teva clau privada i certificat.
-aliasHelp=L''àlies que identifica de forma única un proveïdor d''identitat, es far servir també per construir la URI de redirecció.
-tokenClaimName.tooltip=Nom del reclam a inserir en el testimoni. Pot ser un nom complet com ''address.street''. En aquest cas, es crearà un objecte JSON niat.
+encryptAssertions=Xifra les afirmacions
+keyAliasHelp=Àlies de la clau privada
+aliasHelp=L’àlies identifica de forma única un proveïdor d’identitat, i es fa servir també per a construir l’URI de redirecció.
+tokenClaimName.tooltip=Nom del reclam a inserir en el testimoni. Pot ser un nom complet com «address.street». En aquest cas, es crearà un objecte JSON niat. Per a prevenir el nidament i emprar el punt literal, escapeu el punt amb una barra invertida (\\.).
 maxFailureWaitSeconds=Espera màxima
-userName=Usuari
+userName=Nom d’usuari
 clientProfileDescription=Descripció
-ssoSessionMax=Temps màxim abans que una sessió expiri. Els tokens i sessions de navegador són invalidats quan una sessió expira.
-protocolMapper=Protocol.
+ssoSessionMax=Temps màxim abans que una sessió expiri. Els testimonis i sessions de navegador són invalidats quan una sessió expira.
+protocolMapper=Protocol...
 times.hours=Hores
-sslType.none=cap
+sslType.none=Cap
 webOrigins=Orígens web
 realm=Domini
-prompt=Prompt
-username=Usuari
-importConfig=Importa metadades des d''un descriptor d''un proveïdor d''identitat (IDP) descarregat.
-bruteForceDetection=Detecció d''atacs per força bruta
-archiveFormatHelp=Format d''arxiu Java keystore o PKCS12
-keyAlias=Àlies de clau
-revokeRefreshTokenHelp=Si està activat els tokens d''actualització només poden usar-se una vegada. En un altre cas els tokens d''actualització no es revoquen quan s''utilitzen i poden ser usat múltiples vegades.
-storedTokensReadableHelp=Habilitar/deshabilitar si els nous usuaris poden llegir els tokens emmagatzemats. Això assigna el rol ''broker.read-token''.
-none=cap
-sslType.all=totes les peticions
+prompt=Indicador
+username=Nom d'usuari
+importConfig=Importa la configuració des d’un fitxer
+bruteForceDetection=Detecció d’atacs per força bruta
+archiveFormatHelp=Format del fitxer de magatzem de claus Java o PKCS12.
+keyAlias=Àlies de la clau
+revokeRefreshTokenHelp=Si està activat, un testimoni d'actualització només es pot usar fins a «Màxima reutilització del testimoni d’actualització» i es revoca quan s’utilitza un testimoni diferent. En un altre cas els tokens d'actualització no es revoquen quan s'utilitzen i poden ser usats múltiples vegades.
+storedTokensReadableHelp=Habilita/Ihabilita si els nous usuaris poden llegir els testimonis emmagatzemats. Això assigna el rol «broker.read-token».
+none=Cap
+sslType.all=Totes les peticions
 type=Tipus
-httpPostBindingResponse=HTTP-POST enllaç de resposta
+httpPostBindingResponse=Resposta de l'enllaç HTTP-POST
 issuer=Emissor
 seconds=Segons
-editUsernameHelp=Si està habilitat, el nom d''usuari és editable, altrament és de només lectura.
+editUsernameHelp=Si està habilitat, el nom d’usuari és editable, altrament és de només lectura.
 id=ID
-accountThemeHelp=Selecciona el tema per a les pàgines de gestió del compte d''usuari.
-fullScopeAllowedHelp=Permet deshabilitar totes les restriccions.
-canonicalizationHelp=Mètode de canonicalització per a les signatures XML
+accountThemeHelp=Seleccioneu el tema per a les pàgines de gestió del compte d’usuari.
+fullScopeAllowedHelp=Us permet deshabilitar totes les restriccions.
+canonicalizationHelp=Mètode de canonicalització per a les signatures XML.
 sessions=Sessions
-includeAuthnStatement=Incloure AuthnStatement
-jsonType.tooltip=El tipus de JSON que hauria de fer-se servir per omplir la petició de JSON en el token. long, int, boolean i String són valors vàlids
-multivalued.tooltip=Indica si l''atribut suporta múltiples valors. Si està habilitat, la llista de tots els valors d''aquest atribut es fixarà com a reclamació. Si està deshabilitat, només el primer valor serà fixat com a reclamació.
-enableStartTLS=Habilitar StartTLS
-enableStartTls=Habilitar StartTLS
-addIdPMapper=Afegeix assignador de proveïdor d''identitat
-trustEmail=Confiar en l''email
+includeAuthnStatement=Inclou l’AuthnStatement
+jsonType.tooltip=El tipus de JSON que hauria de fer-se servir per omplir la petició de JSON en el token. long, int, boolean i String són valors vàlids.
+multivalued.tooltip=Indica si l’atribut suporta múltiples valors. Si és vertader, la llista de tots els valors d’aquest atribut es fixarà com a reclamació. Si és fals, només el primer valor serà fixat com a reclamació
+enableStartTLS=Habilita StartTLS
+enableStartTls=Habilita StartTLS
+addIdPMapper=Afegeix un assignador de proveïdor d'identitat
+trustEmail=Confia en l’adreça electrònica
 jsonType.label=Tipus JSON de reclamació
 fullScopeAllowed=Permet tots els àmbits
 push=Push
-homeURL=URL per defecte per utilitzar quan el servidor d''autorització necessita redirigir o enviar de tornada al client.
-masterSamlProcessingUrlHelp=Si està configurada, aquesta URL es fara servir per a cada enllaç al proveïdor del servei del consumidor d''assercions i serveis de desconnexió únics. Pot ser sobreescrit de forma individual per a cada enllaç i servei en el punt final de configuració fina de SAML.
-usermodel.attr.label=Atribut d''usuari
-claimJsonType=El tipus de JSON que hauria de fer-se servir per omplir la petició de JSON en el token. long, int, boolean i String són valors vàlids
-forceAuthenticationHelp=Indica si el proveïdor d''identitat ha d'autenticar en presentar directament les credencials en lloc de dependre d''un context de seguretat previ.
-testClusterAvailability=Provar disponibilitat del clúster
-forceNameIdFormat=Forçar format NameID
-rememberMeHelpText=Mostra la casella de selecció en la pàgina d''inici de sessió per a permetre a l''usuari estar connectat entre reinicis del navegador fins que la sessió expiri.
-sslType.external=peticions externes
-multiValued=Indica si l''atribut suporta múltiples valors. Si està habilitat, la llista de tots els valors d''aquest atribut es fixarà com a reclamació. Si està deshabilitat, només el primer valor serà fixat com a reclamació.
-addRole=Afegir rol
-ssoServiceUrl=URL de servei de connexió únic (SSO)
+homeURL=URL d’inici
+masterSamlProcessingUrlHelp=Si està configurada, aquest URL es farà servir per a cada enllaç al proveïdor del servei del consumidor d'assercions i serveis de desconnexió únics. Pot ser sobreescrit de forma individual per a cada enllaç i servei en el punt final de configuració fina de SAML.
+usermodel.attr.label=Atribut d’usuari
+claimJsonType=El tipus de JSON que hauria de fer-se servir per omplir la petició de JSON en el testimoni. Els valors vàlids son long, int, boolean, String i JSON.
+forceAuthenticationHelp=Indica si el proveïdor d'identitat ha d'autenticar el presentador directament en lloc de confiar en un context de seguretat previ.
+testClusterAvailability=Comprova la disponibilitat del clúster
+forceNameIdFormat=Força el format del NameID
+rememberMeHelpText=Mostra la casella de selecció en la pàgina d'inici de sessió per a permetre a l'usuari estar connectat entre reinicis del navegador fins que la sessió expiri.
+sslType.external=Sol·licituds externes
+multiValued=Indica si l’atribut és compatible amb valors múltiples. Si és cert, la llista de tots els valors de l’atribut es defineixen com a reclam. Si és fals, només el primer valor es defineix com a reclam.
+addRole=Afegeix un rol
+ssoServiceUrl=URL del servei d’inici de sessió únic (SSO)
 clients=Clients
 clientName=Nom
-userRegistration=Registre d''usuari
-save=Desar
-wantAuthnRequestsSignedHelp=Indica si el proveïdor d''identitat espera rebre signades les AuthnRequest.
-login=login
+userRegistration=Registre d’usuari
+save=Desa
+wantAuthnRequestsSignedHelp=Indica si el proveïdor d’identitat espera una AuthnRequest signada.
+login=Inici de sessió
 enabled=Habilitat
-maxDeltaTimeSeconds=Reinici del comptador d''errors
+maxDeltaTimeSeconds=Temps de reinici després d’una fallada
 keyPassword=Contrasenya de la clau
-backchannelLogoutHelp=Does the external IDP support backchannel logout?
-SSOSessionIdle=Sessions SSO inactives
-ssoServiceUrlHelp=L''URL que s''ha de fer servir per enviar peticions d''autenticació (SAML AuthnRequest).
-trustEmailHelp=Si està habilitat, l''email rebut d''aquest proveïdor no es verificarà encara que la verificació estigui habilitada per al domini.
-supportedLocales=Idiomes suportats
-maxFailureWaitSecondsHelp=Temps màxim que un usuari queda bloquejat.
-issuerHelp=L''identificador de l''emissor per a l''emissor de la resposta. Si no s''indica, no es realitzarà cap validació.
+backchannelLogoutHelp=L’IDP implementa el tancament de sessió per canal posterior?
+SSOSessionIdle=Sessió SSO inactiva
+ssoServiceUrlHelp=L’URL que s’ha de fer servir per a enviar peticions d’autenticació (SAML AuthnRequest).
+trustEmailHelp=Si està habilitat, l’adreça electrònica proporcionada pel proveïdor no es verifica encara que la verificació estigui habilitada per al domini.
+supportedLocales=Llengües compatibles
+maxFailureWaitSecondsHelp=Temps màxim que un usuari romandrà blocat.
+issuerHelp=L'identificador de l'emissor per a l'emissor de la resposta. Si no s'indica, no es realitzarà cap validació.
 titleSessions=Sessions
-clientNameHelp=Indica el nom visible del client. Per exemple ''My Client''. També suporta claus per valors localitzats. Per exemple: ${my_client}
-maxDeltaTimeSecondsHelp=Quan s''ha de reiniciar el comptador d''errors?
-adminURLHelp=URL a la interfície d''administració del client. Fixa aquest valor si el client suporta l''adaptador de REST. Aquesta API REST permet al servidor d''autenticació enviar al client polítiques de revocació i altres tasques administratives. Normalment es fixa a l''URL base del client.
+clientNameHelp=Indica el nom visible del client. Per exemple 'My Client'. També suporta claus per a valors localitzats. Per exemple: ${my_client}.
+maxDeltaTimeSecondsHelp=Quan es restablirà el comptador d’errors?
+adminURLHelp=URL a la interfície d’administració del client. Definiu-lo si el client és compatible amb l’API REST de l’adaptador. Aquesta API REST permet al servidor d’autenticació enviar polítiques de revocació i altres tasques administratives. Normalment, es defineix l’URL base del client.
 contentSecurityPolicy=Content-Security-Policy
 rootUrl=URL arrel
-rootURL=URL arrel afegida a les URL relatives
-storePasswordHelp=Contrasenya per accedir a l''arxiu
-frontchannelLogoutHelp=Quan està activat, la desconnexió requereix una redirecció del navegador cap al client. Quan no està activat, el servidor realitza una invovación de desconnexió en segon pla.
-clientLoginTimeout=Temps màxim d''autenticació
-nodeReRegistrationTimeoutHelp=Indica el màxim interval de temps perquè els nodes del clúster registrats es tornin a registrar. Si el node del clúster no envia una petició de re-registre a Keycloak dins d''aquest interval, serà desregistrat de Keycloak
-logoutServicePostBindingURLHelp=URL d''enllaç SAML POST per a la desconnexió única del client. Pots deixar-ho en blanc si estàs fent servir un enllaç diferent.
-registrationEmailAsUsername=Email com a nom d''usuari
-scopes=Els àmbits que s''enviaran quan es sol·liciti autorització. Pot ser una llista d''àmbits separats per espais. El valor per defecte és ''openid''.
-signDocumentsHelp=Hauria el domini de signar els documents SAML?
-requireSslHelp=És HTTP obligatori? ''cap'' significa que HTTPS no és obligatori per cap direcicón IP de client, ''peticions externes'' indica que localhost i les adreces IP privades poden accedir sense HTTPS, ''totes les peticions'' vol dir que HTTPS és obligatori per a totes les adreces IP.
-userInfoUrlHelp=L''URL d''informació d''usuari. Opcional.
-includeAuthnStatementHelp=Hauria d''incloure''s una declaració especificant el mètode i la marca de temps en la resposta d''inici de sessió?
+rootURL=URL arrel afegit als URL relatius
+storePasswordHelp=Contrasenya per a accedir a l’arxiu en si mateix
+frontchannelLogoutHelp=Quan està activat, la desconnexió requereix una redirecció del navegador cap al client. Quan no està activat, el servidor realitza una invocació de desconnexió en segon pla.
+clientLoginTimeout=Temps màxim d’inici de sessió del client
+nodeReRegistrationTimeoutHelp=Interval per a especificar el màxim de temps perquè els nodes del clúster registrats es tornin a registrar. Si el node del clúster no envia una petició de re-registre a Keycloak dins d'aquest interval, serà desregistrat de Keycloak.
+logoutServicePostBindingURLHelp=URL d’enllaç SAML POST per a la desconnexió única del client. Podeu deixar-ho en blanc si feu servir un enllaç diferent.
+registrationEmailAsUsername=Adreça electrònica com a nom d’usuari
+scopes=Àmbits
+signDocumentsHelp=El domini hauria de signar els documents SAML?
+requireSslHelp=Es requereix HTTPS? «Cap» significa que HTTPS no és obligatori per a cap adreça IP de client. «Sol·licituds externes» indica que localhost i les adreces IP privades poden accedir sense HTTPS. «Totes les peticions» vol dir que HTTPS és obligatori per a totes les adreces IP.
+userInfoUrlHelp=L’URL d’informació d’usuari. Això és opcional.
+includeAuthnStatementHelp=S’hauria d’incloure una declaració especificant el mètode i la marca de temps en les respostes d’inici de sessió?
 kc.realm.name=Domini
-download=Descarrega
+download=Baixa
 protocol=Protocol
-tokenClaimName.label=Nom de reclam del token
-host=Host
+tokenClaimName.label=Nom de reclam del testimoni
+host=Amfitrió
 create=Crea
-clientSecret=Secret de Client
+clientSecret=Secret de client
 from=Des de
-httpPostBindingAuthnRequest=HTTP-POST per AuthnRequest
-includeInAccessToken.label=Afegir al token d''accés
-adminURL=URL d''administració
-settings=Ajustos
-failureFactorHelp=Indica quants errors es permeten abans que es dispari una espera.
+httpPostBindingAuthnRequest=Enllaç HTTP-POST per a l’AuthnRequest
+includeInAccessToken.label=Afegeix al testimoni d’accés
+adminURL=URL d’administració
+settings=Paràmetres
+failureFactorHelp=Nombre d’errors abans que s’activi una espera.
 minutes=Minuts
-storeTokensHelp=Habilitar/deshabilitar si els tokens han de ser emmagatzemats després d''autenticar als usuaris.
-singleLogoutServiceUrlHelp=L''URL que ha de fer-se servir per enviar peticions de desconnexió.
-userSession.modelNote.tooltip=Nom de la nota emmagatzemada en la sessió d''usuari dins del mapa UserSessionModel.note
-clientsClientTypeHelp=''OpenID connect'' permet als clients verificar la identitat de l''usuari final basat en l''autenticació realitzada per un servidor d''autorització. ''SAML'' habilita l''autenticació i autorització d''escenaris basats en web incloent cross-domain i single sign-on (SSO) i utilitza tokens de seguretat que contenen afirmacions per passar informació.
-storeTokens=Emmagatzemar tokens
-includeInIdToken.label=Afegir al token d''ID
-webOriginsHelp=Orígens CORS permesos. Per permetre tots els orígens d''URIs de redirecció vàlides afegeix ''+''. Per permetre tots els orígens afegeix ''*''.
-emailThemeHelp=Selecciona el tema per als correus electrònics que són enviats pel servidor.
+storeTokensHelp=Habilita/inhabilita si s’ha d’emmagatzemar els testimonis després d’autenticar els usuaris.
+singleLogoutServiceUrlHelp=L’URL que s’ha de fer servir per a enviar peticions de desconnexió.
+userSession.modelNote.tooltip=Nom de la nota emmagatzemada en la sessió d'usuari dins del mapa UserSessionModel.note.
+clientsClientTypeHelp=«OpenID Connect» permet als clients verificar la identitat de l'usuari final basant-se en l'autenticació realitzada per un servidor d’autorització. «SAML» habilita l'autenticació i autorització d'escenaris basats en web incloent single sign-on (SSO) de dominis creuats, i utilitza testimonis de seguretat que contenen afirmacions per a passar informació.
+storeTokens=Emmagatzema testimonis
+includeInIdToken.label=Afegeix al testimoni d’ID
+webOriginsHelp=Orígens CORS permesos. Per a permetre tots els orígens d'URI de redirecció vàlids, afegiu «+» (això no inclou el comodí «*»). Per a permetre tots els orígens, afegiu explícitament «*».
+emailThemeHelp=Selecciona un tema per als correus electrònics enviats pel servidor.
 logoutUrl=URL de desconnexió
-canonicalization=Mètode de canonicalització
-storedTokensReadable=Tokens emmagatzemats llegibles
-SSOSessionMax=Temps màxim sessió SSO
-minimumQuickLoginWaitSecondsHelp=Quant de temps s''ha d''esperar després d''un error en un intent ràpid d''identificació
+canonicalization=Mètode de canonització
+storedTokensReadable=Testimonis emmagatzemats llegibles
+SSOSessionMax=Sessió SSO màxima
+minimumQuickLoginWaitSecondsHelp=Quant de temps s’ha d'esperar després d'un error en un intent ràpid d’identificació.
 mappers=Assignadors
-waitIncrementSeconds=Increment d''espera
+waitIncrementSeconds=Increment d’espera
 usermodel.prop.label=Propietat
-name-id-format=Format de NameID
-addNode=Afegir Node
+name-id-format=Format del NameID
+addNode=Afegeix un node
 credentials=Credencials
 certificate=Certificat
-importClient=Importar Client
-selectRole.label=Selecciona rol
-prompts.consent=consentiment
-enableSSL=Habilitar SSL
+importClient=Importa un client
+selectRole.label=Seleccioneu un rol
+prompts.consent=Consentiment
+enableSSL=Habilita SSL
 general=General
-failureFactor=Nombre màxim d''errors d''inici de sessió
-signAssertions=Signar assercions
-adminTheme=Tema de consola d''administració
+failureFactor=Nombre màxim d’errors d’inici de sessió
+signAssertions=Signa les assercions
+adminTheme=Tema de la consola d'administració
 alias=Àlies
-tokens=Tokens
-encryptAssertionsHelp=Haurien de xifrar-se les afirmacions SAML amb la clau pública del client fent servir AES?
-clientSecretHelp=El secret del client registrat amb el proveïdor d''identitat.
-validateSignatures=Habilitar/deshabilitar la validació de signatura en respostes SAML.
+tokens=Testimonis
+encryptAssertionsHelp=S'haurien de xifrar les afirmacions SAML amb la clau pública del client fent servir AES?
+clientSecretHelp=El secret del client registrat amb el proveïdor d'identitat. Aquest camp pot obtenir el seu valor de la caixa forta, utilitzeu el format ${vault.ID}.
+validateSignatures=Habilita/Inhabilita la validació de signatura en respostes SAML.
 on=Activat
-descriptionHelp=Indica la descripció del client. Per exemple ''My Client for TimeSheets''. També suporta claus per a valors localitzats. Per exemple\: ${my_client_description}
-logoutUrlHelp=Punt de tancament de sessió per utilitzar en la desconnexió d''usuaris des d''un proveïdor d''identitat (IDP) extern.
+descriptionHelp=Text d’ajuda per a la descripció del nou flux
+logoutUrlHelp=Punt de tancament de sessió a emprar en la desconnexió d’usuaris des d’un IDP extern.
 times.seconds=Segons
 clear=Neteja
-serviceAccount=Permetre autenticar aquest client contra Keycloak i rebre un token d''accés dedicat per a aquest client.
-assertionConsumerServiceRedirectBindingURL=Assertion Consumer Service Redirect Binding URL
-loginThemeHelp=Selecciona el tema per a les pàgines d''inici de sessió, OTP, permisos, registre i recordatori de contrasenya.
-signatureAlgorithm=L''algorisme de signatura usat per signar els documents.
+serviceAccount=Rols de comptes de servei
+assertionConsumerServiceRedirectBindingURL=URL de vinculació de redirecció del servei consumidor d’afirmacions
+loginThemeHelp=Selecciona un tema per a les pàgines d’inici de sessió, OTP, concessió, registre i recordatori de contrasenya.
+signatureAlgorithm=Algorisme de signatura
 multivalued.label=Valors múltiples
-accountTheme=Tema de compte
-forceAuthentication=Forçar autenticació
-clustering=Clustering
-rememberMe=Mantenir connectat
+accountTheme=Tema del compte
+forceAuthentication=Força l’autenticació
+clustering=Clusterització
+rememberMe=Recorda'm
 category=Categoria
-usermodel.prop.tooltip=Nom del mètode de propietat en la interfície UserModel. Per exemple, un valor de ''email'' faria referència al mètode UserModel.getEmail().
+usermodel.prop.tooltip=Nom del mètode de propietat en la interfície UserModel. Per exemple, un valor «email» faria referència al mètode UserModel.getEmail().
 times.days=Dies
 user=Usuari
-registeredClusterNodes=Registrar nodes de clúster
-selectRole.tooltip=Introdueix el rol a la caixa de text de l''esquerra, o fes clic a aquest botó per navegar i buscar el rol que vols.
+registeredClusterNodes=Nodes de clúster registrats
+selectRole.tooltip=Introduïu el rol a la caixa de text de l’esquerra, o feu clic en aquest botó per a navegar i seleccionar el rol que vulgueu.
 deleteConfirm_other=Esteu segur de voler suprimir aquests grups?
 persistent=Persistent
 cancel=Cancel·la
-userID=ID d'usuari
+userID=ID d’usuari
 anyResource=Qualsevol recurs
 sync-ldap-roles-to-keycloak=Sincronitza els rols LDAP al Keycloak
 createClientPolicy=Crea una política de client
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_de.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_de.properties
index 68987d0377ad..1b6867f74c3d 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_de.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_de.properties
@@ -1,5 +1,5 @@
 general=Allgemein
-realmSettingsExplain=Realm-Einstellungen sind Einstellungen, die die Optionen für Benutzer, Anwendungen, Rollen und Gruppen im aktuellen Realm steuern.
+realmSettingsExplain=Realm-Einstellungen sind Einstellungen, welche die Optionen für Benutzer, Anwendungen, Rollen und Gruppen im aktuellen Realm steuern.
 cancel=Abbrechen
 localization=Internationalisierung
 unlinkUsers=Benutzer entsperren
@@ -69,7 +69,7 @@ deleteGroup=Gruppe löschen
 key=Schlüssel
 validRedirectURIs=Gültiges URI-Muster, zu dem ein Browser nach einer erfolgreichen An- oder Abmeldung umleiten kann. Einfache Platzhalter sind zulässig, z. B. "http://example.com/*". Es kann auch ein relativer Pfad angegeben werden, z. B. /my/relative/path/*. Relative Pfade beziehen sich auf die Root URL des Clients, oder wenn keine angegeben ist, wird die Stamm-URL des Autorisierungsservers verwendet. Für SAML muss man gültige URI-Muster festlegen, wenn man sich auf die in die Anmeldeanforderung eingebettete URL des Verbraucherdienstes verlässt.
 email=Email
-deleteCredentialsConfirm=Sind Sie sicher, dass Sie die Berechtigungsnachweise löschen möchten?
+deleteCredentialsConfirm=Sind Sie sicher, dass Sie die Zugangsdaten löschen möchten?
 searchForUser=Benutzer suchen
 selectAttribute=Wähle Attribut
 endpoints=Endpunkte
@@ -77,12 +77,12 @@ clientId=Client-ID
 supportedLocales=Unterstützte Sprachen
 showPasswordDataValue=Wert
 titleSessions=Sessions
-clientNameHelp=Legt den Anzeigenamen des Clients fest. Zum Beispiel 'My Client'. Unterstützt auch Keys für lokalisierte Werte. Zum Beispiel: ${my_client}
+clientNameHelp=Legt den Anzeigenamen des Clients fest. Zum Beispiel 'My Client'. Unterstützt auch Keys für lokalisierte Werte. Zum Beispiel: ${my_client}.
 lastAccess=Letzter Zugriff
 passwordConfirmation=Passwort bestätigen
 emailVerified=E-Mail verifiziert
 Thursday=Donnerstag
-addAttribute=Attribut hinzufügen
+addAttribute=Attribut {{label}} hinzufügen
 times.minutes=Minuten
 disable=Deaktivieren
 usersExplain=Benutzer in diesem Realm.
@@ -187,7 +187,7 @@ userManagedAccessHelp=Wenn aktiviert können Benutzer ihre Ressourcen und Berech
 unmanagedAttributes=Nicht verwaltete Attribute
 unmanagedAttributesHelpText=Nicht verwaltete Attribute sind Benutzerattribute, die nicht ausdrücklich in der Benutzerprofilkonfiguration definiert sind. Standardmäßig sind nicht verwaltete Attribute "Disabled" und stehen in keinem Kontext zur Verfügung, z. B. bei der Registrierung, im Konto und in der Administrationskonsole. Durch die Einstellung "Enabled" werden nicht verwaltete Attribute vom Server vollständig erkannt und sind über alle Kontexte zugänglich. Dies ist nützlich, wenn Sie mit der Migration eines bestehenden Realms zum deklarativen Benutzerprofil beginnen und noch nicht alle Benutzerattribute in der Benutzerprofilkonfiguration definiert haben. Mit der Einstellung "Only administrators can write" können nicht verwaltete Attribute nur über die Administrationskonsole und die API verwaltet werden. Dies ist nützlich, wenn Sie bereits benutzerdefinierte Attribute definiert haben, die von Benutzern verwaltet werden können, aber unsicher sind, ob Sie andere Attribute hinzufügen sollen, die nur von Administratoren verwaltet werden können. Durch die Einstellung "Only administrators can view" sind nicht verwaltete Attribute schreibgeschützt und nur über die Administrationskonsole und die API verfügbar.
 times.hours=Stunden
-temporaryLocked=Der Benutzer wurde vorübergehend wegen zu vieler ungültiger Loginversuche gesperrt.
+temporaryLocked=Temporär gesperrt
 keyPlaceholder=Schlüssel eingeben
 webOrigins=Web Origins
 resetActions=Zurücksetz-Aktionen
@@ -304,14 +304,14 @@ offlineSessionSettings=Einstellungen für Offline-Sitzungen
 offlineSessionIdle=Offline-Sitzung Leerlaufdauer
 offlineSessionIdleHelp=Zeit, die eine Offline-Sitzung inaktiv sein darf, bevor sie abläuft. Sie müssen das Offline-Token mindestens einmal innerhalb dieses Zeitraums zur Aktualisierung verwenden, andernfalls läuft die Offline-Sitzung ab.
 offlineSessionMaxLimited=Offline-Sitzung Laufzeitbeschränkung
-offlineSessionMaxLimitedHelp=Erlaubt die Beschränkung der maximalen Laufzeit einer Offline-Sitzung
+offlineSessionMaxLimitedHelp=Aktiviert die Beschränkung der maximalen Laufzeit einer Offline-Sitzung
 offlineSessionMax=Offline-Sitzung Maximaldauer
 offlineSessionMaxHelp=Maximale Zeit, bevor eine Offline-Sitzung unabhängig von der Aktivität abläuft.
 loginSettings=Anmeldeeinstellungen
 loginTimeout=Maximaldauer der Anmeldung
-loginTimeoutHelp=Maximale Zeit, die ein Benutzer zum Abschließen einer Anmeldung benötigt. Es wird empfohlen, diese Zeit relativ lang zu wählen, z. B. 30 Minuten oder mehr.
+loginTimeoutHelp=Maximale Zeit, die einem Benutzer zum Abschließen einer Anmeldung zur Verfügung steht. Es wird empfohlen, diese Zeit relativ lang zu wählen, z. B. 30 Minuten oder mehr.
 loginActionTimeout=Maximaldauer eines Anmeldeaktion
-loginActionTimeoutHelp=Maximale Zeit, die ein Benutzer hat, um anmeldebezogene Aktionen wie Passwort aktualisieren oder TOTP konfigurieren abzuschließen. Es wird empfohlen, diesen Wert relativ lang zu wählen, z. B. 5 Minuten oder mehr
+loginActionTimeoutHelp=Maximale Zeit, die ein Benutzer hat, um anmeldebezogene Aktionen wie Passwort aktualisieren oder TOTP konfigurieren abzuschließen. Es wird empfohlen, diesen Wert relativ lang zu wählen, z. B. 5 Minuten oder mehr.
 defaultSigAlg=Standard-Signatur-Algorithmus
 defaultSigAlgHelp=Standardalgorithmus für das Signieren von Token für den Realm
 oAuthDeviceCodeLifespan=OAuth 2.0 Device Code Lebensdauer
@@ -319,9 +319,9 @@ oAuthDeviceCodeLifespanHelp=Maximale Zeit bis zum Ablauf des Gerätecodes und de
 oAuthDevicePollingInterval=OAuth 2.0 Device Abfrageintervall
 oAuthDevicePollingIntervalHelp=Die Mindestzeit in Sekunden, die der Client zwischen Abfrageanforderungen an den Token-Endpunkt warten soll.
 shortVerificationUri=Kurze verification_uri im "Device Authorization flow"
-shortVerificationUriTooltipHelp=Falls festgelegt, wird dieser Wert als verification_uri im "Device Authorization flow" zurückgegeben. Diese Uri muss auf {server-root}/realms/{realm}/device umleiten
+shortVerificationUriTooltipHelp=Falls festgelegt, wird dieser Wert als verification_uri im "Device Authorization flow" zurückgegeben. Diese Uri muss auf {server-root}/realms/{realm}/device umleiten.
 parRequestUriLifespan=Lebensdauer des Request URI für Pushed Authorization Request
-parRequestUriLifespanHelp=Zahl, die die Lebensdauer des Anfrage-URIs angibt.  Der Standardwert ist 1 Minute.
+parRequestUriLifespanHelp=Zahl, welche die Lebensdauer des Anfrage-URIs angibt. Der Standardwert ist 1 Minute.
 revokeRefreshToken=Refresh Token widerrufen
 revokeRefreshTokenHelp=Wenn diese Option aktiviert ist, kann ein Refresh-Token nur bis zur maximalen Wiederverwendung des Refresh-Tokens verwendet werden und wird widerrufen, wenn ein anderer Token verwendet wird. Andernfalls werden Refresh-Tokens bei Verwendung nicht widerrufen und können mehrfach verwendet werden.
 accessTokenLifespan=Access-Token-Lebensdauer
@@ -366,11 +366,11 @@ unAssignRole=Rolle entfernen
 whatIsDefaultGroups=Was ist die Funktion von Standardgruppen?
 noDefaultGroupsInstructions=Mit Standardgruppen können Sie automatisch eine Gruppenzugehörigkeit zuweisen, wenn ein neuer Benutzer erstellt oder während des <1>Identitätsbrokerings</1> importiert wird.
 noDefaultGroups=Keine Standardgruppen definiert
-authenticationExplain=Im Bereich Authentifizierung können Sie verschiedene Arten von Berechtigungsnachweisen konfigurieren und verwalten.
+authenticationExplain=Im Bereich Authentifizierung können Sie verschiedene Arten von Zugangsdaten konfigurieren und verwalten.
 flows=Abläufe
 searchForFlow=Suche nach Ablauf
 createFlow=Ablauf erstellen
-authenticationCreateFlowHelp=Ablauf erstellen
+authenticationCreateFlowHelp=Ablauf erstellen.
 flowName=Ablaufname
 flowType=Ablauftyp
 usedBy=Vewendet von
@@ -429,7 +429,7 @@ guiOrder=Anzeigereihenfolge
 createClientScope=Client-Scope erstellen
 searchForClientScope=Suche nach Client-Scope
 changeTypeTo=Zugeordneten Typ ändern
-clientsExplain=Clients sind Anwendungen und Dienste, die die Authentifizierung eines Benutzers anfordern können.
+clientsExplain=Clients sind Anwendungen und Dienste, welche die Authentifizierung eines Benutzers anfordern können.
 clientsList=Clientliste
 createClient=Client erstellen
 importClient=Client importieren
@@ -457,7 +457,7 @@ totalMemory=Gesamter Speicher
 freeMemory=Freier Speicher
 usedMemory=Verwendeter Speicher
 enabledFeatures=Aktivierte Features
-infoEnabledFeatures=Zeigt aktive Vorschau- und experimentelle Features an.
+infoEnabledFeatures=Zeigt aktivierte Features an.
 disabledFeatures=Deaktivierte Features
 infoDisabledFeatures=Zeigt alle deaktivierten Features an.
 acrToLoAMapping=ACR zu LoA Zuordnungen
@@ -468,12 +468,11 @@ addProvider_other={{provider}} Anbieter hinzufügen
 uiDisplayName=UI-Anzeigename
 uiDisplayNameHelp=Anzeigename des Anbieters für die Verküpfung in der Administrationskonsole
 providerDescription=Anbieterbeschreibung
-xFrameOptionsHelp=Der Standardwert verhindert, dass Seiten von iframes, die nicht von der Website stammen, eingebunden werden <1>Mehr erfahren</1>
-contentSecurityPolicyHelp=Der Standardwert verhindert, dass Seiten von iframes, die nicht von der Website stammen, eingebunden werden <1>Mehr erfahren</1>
+xFrameOptionsHelp=Der Standardwert verhindert, dass Seiten von iframes, die nicht von der Website stammen, eingebunden werden. <1>Mehr erfahren</1>
+contentSecurityPolicyHelp=Der Standardwert verhindert, dass Seiten von iframes, die nicht von der Website stammen, eingebunden werden. <1>Mehr erfahren</1>
 contentSecurityPolicyReportOnlyHelp=Zum Testen von Content Security Policies <1>Mehr erfahren</1>
-xContentTypeOptionsHelp=Der Standardwert verhindert, dass Internet Explorer und Google Chrome eine Antwort abseits des deklarierten Content-Types <1>Erfahren Sie mehr</1> MIME-sniffing
-xRobotsTagHelp=Verhindern, dass Seiten in Suchmaschinen auftauchen <1>Mehr erfahren</1>
-xXSSProtectionHelp=Dieser Header konfiguriert den Cross-Site-Scripting-Filter (XSS) in Ihrem Browser. Mit dem Standardverhalten verhindert der Browser das Rendern der Seite, wenn ein XSS-Angriff erkannt wird. <1>Mehr erfahren</1>
+xContentTypeOptionsHelp=Der Standardwert verhindert, dass Internet Explorer und Google Chrome eine Antwort abseits des deklarierten Content-Types durch MIME-sniffing erkennen. <1>Mehr erfahren</1>
+xRobotsTagHelp=Verhindern, dass Seiten in Suchmaschinen auftauchen, <1>Mehr erfahren</1>
 strictTransportSecurityHelp=Der HTTP-Header Strict-Transport-Security weist die Browser an, immer HTTPS zu verwenden. Sobald ein Browser diesen Header sieht, wird er die Website nur noch über HTTPS für die angegebene Zeit (1 Jahr) bei max-age besuchen, einschließlich der Subdomains. <1>Mehr erfahren</1>
 refreshTokenMaxReuse=Refresh-Token maximale Wiederverwendung
 refreshTokenMaxReuseHelp=Maximale Anzahl der Wiederverwendung eines Refresh-Tokens. Wenn ein anderes Token verwendet wird, erfolgt der Widerruf sofort.
@@ -520,14 +519,14 @@ export=Exportieren
 clientType=Client Typ
 clientTypeHelp=OpenID Connect" ermöglicht es Clients, die Identität des Endbenutzers auf der Grundlage der von einem Autorisierungsserver durchgeführten Authentifizierung zu überprüfen. SAML" ermöglicht webbasierte Authentifizierungs- und Autorisierungsszenarien, einschließlich domänenübergreifendem Single Sign-On (SSO), und verwendet Sicherheitstoken, die Behauptungen zur Weitergabe von Informationen enthalten.
 alwaysDisplayInUI=Immer in der UI anzeigen
-clientDescriptionHelp=Gibt die Beschreibung des Mandanten an. Zum Beispiel 'Mein Client für TimeSheets'. Unterstützt auch Schlüssel für lokalisierte Werte. Zum Beispiel: ${my_client_description}
+clientDescriptionHelp=Gibt die Beschreibung des Mandanten an. Zum Beispiel 'Mein Client für TimeSheets'. Unterstützt auch Schlüssel für lokalisierte Werte. Zum Beispiel: ${my_client_description}.
 alwaysDisplayInUIHelp=Dieser Mandant wird immer in der Konto-Benutzeroberfläche aufgeführt, auch wenn der Benutzer keine aktive Sitzung hat.
 next=Weiter
 back=Zurück
-userLabel=Benutzer-Label
+userLabel=Bezeichnung
 clientAuthentication=Client-Authentifizierung
-authenticationHelp=Hier wird der Typ des OIDC-Clients festgelegt. Wenn er auf ON steht, ist der OIDC-Typ auf vertraulichen Zugriffstyp eingestellt. Wenn er AUS ist, ist er auf öffentlichen Zugriff eingestellt
-authorizationHelp=Aktivieren/Deaktivieren der feinkörnigen Autorisierungsunterstützung für einen Client
+authenticationHelp=Hier wird der Typ des OIDC-Clients festgelegt. Wenn er auf ON steht, ist der OIDC-Typ auf vertraulichen Zugriffstyp eingestellt. Wenn er AUS ist, ist er auf öffentlichen Zugriff eingestellt.
+authorizationHelp=Aktivieren/Deaktivieren der feinkörnigen Autorisierungsunterstützung für einen Client.
 authenticationFlow=Authentifizierungsablauf
 authenticationOverrides=Authentifizierungsablauf Überschreibung
 standardFlowHelp=Dies ermöglicht die standardmäßige OpenID Connect-Redirect-basierte Authentifizierung mit Autorisierungscode. Im Hinblick auf die OpenID Connect- oder OAuth2-Spezifikationen ermöglicht dies die Unterstützung des "Authorization Code Flow" für diesen Client.
@@ -539,7 +538,7 @@ oidcCibaGrantHelp=Dies ermöglicht die Unterstützung von OIDC CIBA Grant, was b
 rootURL=Stamm-URL wird relativen URLs vorangestellt
 homeURLHelp=Standard-URL, die zu verwenden ist, wenn der Autorisierungsserver eine Umleitung oder einen Link zurück zum Client benötigt.
 validRedirectURIsHelp=Gültiges URI-Muster, zu dem ein Browser nach einer erfolgreichen Anmeldung umleiten kann. Einfache Platzhalter sind zulässig, z. B. "http://example.com/*". Es kann auch ein relativer Pfad angegeben werden, z. B. /my/relative/path/*. Relative Pfade sind relativ zur Stamm-URL des Clients, oder wenn keine angegeben ist, wird die Stamm-URL des Autorisierungsservers verwendet. Für SAML müssen Sie gültige URI-Muster festlegen, wenn Sie sich auf die in die Anmeldeanforderung eingebettete URL des Verbraucherdienstes verlassen.
-validPostLogoutRedirectURIsHelp=Gültige Redirect-URIs, zu denen ein Browser nach einer erfolgreichen Abmeldung umleiten kann. Bei einem Wert von "+" oder einem leeren Feld wird die Liste der gültigen Umleitungsuris verwendet. Ein Wert von '-' lässt keine Umleitungsuris nach der Abmeldung zu. Einfache Platzhalter sind zulässig, z. B. "http://example.com/*". Es kann auch ein relativer Pfad angegeben werden, z. B. /my/relative/path/*. Relative Pfade sind relativ zur Stamm-URL des Clients, oder wenn keine angegeben ist, wird die Stamm-URL des Autorisierungsservers verwendet.
+validPostLogoutRedirectURIsHelp=Gültige Redirect-URIs, zu denen ein Browser nach einer erfolgreichen Abmeldung umleiten kann. Bei einem Wert von "+" oder einem leeren Feld wird die Liste der gültigen Umleitungs-URIs verwendet. Ein Wert von '-' lässt keine Umleitungs-URIs nach der Abmeldung zu. Einfache Platzhalter sind zulässig, z. B. "http://example.com/*". Es kann auch ein relativer Pfad angegeben werden, z. B. /my/relative/path/*. Relative Pfade sind relativ zur Stamm-URL des Clients, oder wenn keine angegeben ist, wird die Stamm-URL des Autorisierungsservers verwendet.
 addWebOrigins=Web Origins hinzufügen
 addPostLogoutRedirectUri=Gültige Post-Logout-Redirect-URIs hinzufügen
 addRedirectUri=Gültige Redirect-URIs hinzufügen
@@ -574,19 +573,19 @@ setup=Setup
 evaluate=Auswerten
 searchForProtocol=Suche nach Protokoll-Mapper
 scopeParameter=Scope Parameter
-scopeParameterHelp=Sie können diesen Wert des Scope Parameters kopieren/einfügen und ihn in der ersten OpenID Connect Authentifizierungsanfrage die von diesem Client Adapter gesendet wird verwenden.Standard Client-Scopes und ausgewählte optionale Client-Scopes werden verwendet wenn ein Token für diesen Client ausgestellt wird
+scopeParameterHelp=Sie können diesen Wert des Scope Parameters kopieren und ihn in der ersten OpenID Connect Authentication Request einfügen die von diesem Client Adapter gesendet wird. Standard Client-Scopes und ausgewählte optionale Client-Scopes werden verwendet wenn ein Token für diesen Client ausgestellt wird.
 evaluateExplain=Auf dieser Seite können Sie alle Protokoll-Mapper und Rollen-Scope-Zuordnungen sehen
 userHelp=Wählen Sie optional den Benutzer aus, für den das Beispiel-Zugangs-Token generiert werden soll. Wenn Sie keinen Benutzer auswählen, wird bei der Auswertung kein Beispiel-Zugangs-Token generiert.
 effectiveProtocolMappers=Effektive Protokoll-Mapper
-effectiveProtocolMappersHelp=Enthält alle Standard-Client-Scopes und ausgewählte optionale Scopes. Alle Protokoll-Zuordnungen und Rollen-Scope-Zuordnungen all dieser Client-Scopes werden bei der Erstellung des für Ihren Client ausgestellten Access-Tokens verwendet
+effectiveProtocolMappersHelp=Enthält alle Standard-Client-Scopes und ausgewählte optionale Scopes. Alle Protokoll-Zuordnungen und Rollen-Scope-Zuordnungen all dieser Client-Scopes werden bei der Erstellung des für Ihren Client ausgestellten Access-Tokens verwendet.
 effectiveRoleScopeMappings=Effektive Rollen-Scope-Zuordnungen
-effectiveRoleScopeMappingsHelp=Ausgewählte optionale Client Scopes, welche bei der Ausgabe von Access-Token für diesen Client verwendet werden. Sie können oben sehen, welcher Wert des OAuth Scope Parameters verwendet werden muss, wenn Sie diese optionalen Client Scopes anwenden möchten, wenn die erste OpenID Connect Authentifizierungsanfrage von Ihrem Client Adapter gesendet wird
+effectiveRoleScopeMappingsHelp=Ausgewählte optionale Client Scopes, welche bei der Ausgabe von Access-Token für diesen Client verwendet werden. Sie können oben sehen, welcher Wert des OAuth Scope Parameters verwendet werden muss, wenn Sie diese optionalen Client Scopes anwenden möchten, wenn die erste OpenID Connect Authentifizierungsanfrage von Ihrem Client Adapter gesendet wird.
 generatedAccessToken=Generiertes Access-Token
-generatedAccessTokenHelp=Sehen Sie sich das Beispiel-Access-Token an, das erzeugt und an den Client gesendet wird, wenn der ausgewählte Benutzer authentifiziert ist. Sie können die Claims und Rollen sehen, die das Token auf der Grundlage der effektiven Protokoll-Mapper und Rollen-Scope-Mapper sowie auf der Grundlage der Claims/Rollen, die dem Benutzer selbst zugewiesen sind, enthalten wird
+generatedAccessTokenHelp=Sehen Sie sich das Beispiel-Access-Token an, das erzeugt und an den Client gesendet wird, wenn der ausgewählte Benutzer authentifiziert ist. Sie können die Claims und Rollen sehen, die das Token auf der Grundlage der effektiven Protokoll-Mapper und Rollen-Scope-Mapper sowie auf der Grundlage der Claims und Rollen, die dem Benutzer selbst zugewiesen sind, enthalten wird.
 generatedIdToken=Generiertes ID-Token
-generatedIdTokenHelp=Siehe das Beispiel des ID-Tokens, das generiert und an den Client gesendet wird, wenn der ausgewählte Benutzer authentifiziert ist. Sie können die Claims und Rollen sehen, die das Token auf der Grundlage der effektiven Protokoll-Mapper und Rollen-Scope-Mapper sowie auf der Grundlage der Claims/Rollen, die dem Benutzer selbst zugewiesen sind, enthalten wird
+generatedIdTokenHelp=Siehe das Beispiel des ID-Tokens, das generiert und an den Client gesendet wird, wenn der ausgewählte Benutzer authentifiziert ist. Sie können die Claims und Rollen sehen, die das Token auf der Grundlage der effektiven Protokoll-Mapper und Rollen-Scope-Mapper sowie auf der Grundlage der Claims/Rollen, die dem Benutzer selbst zugewiesen sind, enthalten wird.
 generatedUserInfo=Generierte User-Info
-generatedUserInfoHelp=Siehe das Beispiel Benutzerinformationen, die vom User-Info-Endpunkt bereitgestellt werden
+generatedUserInfoHelp=Siehe Beispiel Benutzerinformationen, die vom User-Info-Endpunkt bereitgestellt werden.
 generatedUserInfoNo=Keine generierten Benutzerinformationen
 generatedUserInfoIsDisabled=Generierte Benutzerinformationen sind deaktiviert, wenn kein Benutzer ausgewählt ist
 generatedIdTokenNo=Keine generiertes ID-Token vorhanden
@@ -613,11 +612,11 @@ emptyAdminEvents=Keine Admin-Ereignisse
 emptyAdminEventsInstructions=In diesem Realm sind keine Admin-Ereignisse vorhanden.
 selectALocale=Sprache wählen
 requiredActionPlaceholder=Benutzeraktion auswählen
-credentialUserLabel=Benutzer-Label
+credentialUserLabel=Bezeichnung
 credentialData=Daten
 showDataBtn=Daten anzeigen
 resetPasswordConfirmation=Passwortbestätigung
-resetPasswordFor=Passwort zurücksetzen für {{username}}
+resetPasswordFor=Passwort für {{username}} setzen
 roleMapping=Rollenzuordnung
 inherent=Geerbt
 noGroups=Keine Gruppen
@@ -638,7 +637,7 @@ started=Gestartet
 userCredentialsHelpText=Mit den Handlern der obersten Ebene können Sie die Priorität der Credentials für den Benutzer ändern, wobei das oberste Credential die höchste Priorität hat.
 clientsClientScopesHelp=Die mit dieser Ressource verbundenen Scopes.
 client=Client
-deleteConfirm_other=Sind Sie sicher, dass Sie diese Gruppen löschen möchten.
+deleteConfirm_other=Sind Sie sicher, dass Sie diese Gruppen löschen möchten?
 permissionsListIntro=Bearbeiten Sie die Berechtigungsliste, indem Sie auf den "Scope-Namen" klicken. Es wird dann auf die Seite mit den Berechtigungsdetails des Clients mit dem Namen <1>{{realm}}</1> umgeleitet.
 generalOptions=Allgemeine Einstellungen
 vendor=Anbieter
@@ -694,19 +693,19 @@ batchSizeHelp=Anzahl der LDAP-Benutzer, die innerhalb einer einzigen Transaktion
 periodicFullSync=Regelmäßige Vollsynchronisation
 periodicFullSyncHelp=Steuert, ob die periodische vollständige Synchronisation von LDAP-Benutzern mit Keycloak aktiviert werden soll oder nicht.
 periodicChangedUsersSync=Regelmäßige Synchronisierung geänderter Benutzer
-periodicChangedUsersSyncHelp=Steuert, ob die periodische Synchronisation von geänderten oder neu angelegten LDAP-Benutzern zu Keycloak aktiviert werden soll oder nicht
+periodicChangedUsersSyncHelp=Steuert, ob die periodische Synchronisation von geänderten oder neu angelegten LDAP-Benutzern zu Keycloak aktiviert werden soll oder nicht.
 kerberosIntegration=Kerberos-Integration
 allowKerberosAuthentication=Kerberos-Authentifizierung erlauben
 allowKerberosAuthenticationHelp=Aktivieren/Deaktivieren der HTTP-Authentifizierung von Benutzern mit SPNEGO/Kerberos-Tokens. Die Daten über authentifizierte Benutzer werden von diesem LDAP-Server bereitgestellt.
 useKerberosForPasswordAuthentication=Kerberos für die Passwortauthentifizierung verwenden
-useKerberosForPasswordAuthenticationHelp=Kerberos-Login-Modul für die Authentifizierung von Benutzername/Passwort gegen Kerberos-Server verwenden anstelle der Authentifizierung gegen LDAP-Server mit Verzeichnisdienst API
+useKerberosForPasswordAuthenticationHelp=Kerberos-Login-Modul für die Authentifizierung von Benutzername/Passwort gegen Kerberos-Server verwenden anstelle der Authentifizierung gegen LDAP-Server mit Verzeichnisdienst API.
 cacheSettings=Caching-Einstellungen
 cachePolicy=Caching-Richtlinien
 cachePolicyHelp=Caching-Richtlinien für diese LDAP-Verbindung. "DEFAULT" entspricht den Standardeinstellungen für den globalen Cache. "EVICT_DAILY" ist eine Tageszeit, zu der der Cache täglich geleert wird. "EVICT_WEEKLY" ist ein Wochentag und eine Uhrzeit, zu der der Cache geleert wird. "MAX_LIFESPAN" ist die Zeit in Millisekunden, die für die Lebensdauer eines Cache-Eintrags gilt.
 enableLdapv3Password=Erweiterten LDAPv3-Kennwortänderungsvorgang aktivieren
 enableLdapv3PasswordHelp=Wenn aktiv, wird die LDAPv3 Password Modify Extended Operation (RFC-3062) verwendet. Die erweiterte Kennwortänderung setzt normalerweise voraus, dass der LDAP-Benutzer bereits ein Kennwort im LDAP-Server hat. Wenn dies also mit "Sync Registrations" verwendet wird, kann es sinnvoll sein, auch "Hardcoded LDAP-Attribute mapper" mit zufällig generiertem Initialpasswort hinzuzufügen.
 validatePasswordPolicy=Kennwortrichtlinie validieren
-validatePasswordPolicyHelp=Legt fest, ob Keycloak das Passwort mit der Realm-Passwortrichtlinien validieren soll, bevor es aktualisiert wird. Für den Fall, dass das Passwort des Benutzers in LDAP gespeichert ist, werden einige Keycloak-Passwortrichtlinien nicht funktionieren (z.B. Not Recently Used, Expire Password, Hashing Iterations, Hashing Algorithm), da Keycloak keine direkte Kontrolle über die Passwortspeicherung hat. Es ist notwendig, Passwortrichtlinien auf der LDAP-Server-Ebene zu aktivieren, wenn Sie diese Passwortrichtlinien nutzen wollen.
+validatePasswordPolicyHelp=Legt fest, ob Keycloak das Passwort mit der Realm-Passwortrichtlinien validieren soll, bevor es aktualisiert wird. Für den Fall, dass das Passwort des Benutzers in LDAP gespeichert ist, werden einige Keycloak-Passwortrichtlinien nicht funktionieren (z. B. Not Recently Used, Expire Password, Hashing Iterations, Hashing Algorithm), da Keycloak keine direkte Kontrolle über die Passwortspeicherung hat. Es ist notwendig, Passwortrichtlinien auf der LDAP-Server-Ebene zu aktivieren, wenn Sie diese Passwortrichtlinien nutzen wollen.
 trustEmail=E-Mail vertrauen
 trustEmailHelp=Wenn diese Option aktiviert ist, wird die von diesem LDAP-Anbieter bereitgestellte E-Mail nicht überprüft, selbst wenn die Überprüfung für den Realm aktiviert ist.
 queryExtensions=Unterstützte Erweiterungen abfragen
@@ -717,7 +716,7 @@ deleteProvider=Anbieter löschen?
 searchForMapper=Suche nach Mapper
 addMapper=Mapper hinzufügen
 mapperType=Mapper-Typ
-mapperTypeHelp=Wird verwendet, um ein einzelnes Attribut eines LDAP-Benutzers auf ein Attribut des UserModels in Keycloak-DB abzubilden.
+mapperTypeHelp=Wird verwendet, um ein einzelnes Attribut eines LDAP-Benutzers auf ein Attribut des UserModels in Keycloak-Datenbank abzubilden.
 userModelAttribute=Benutzermodell-Attribut
 custom=Benutzerdefiniertes Attribut...
 ldapAttribute=LDAP-Attribut
@@ -725,22 +724,22 @@ ldapAttributeHelp=Name des zugeordneten Attributs im LDAP-Objekt, zum Beispiel "
 readOnly=Nur lesen
 readOnlyHelp=Ein schreibgeschütztes Attribut wird aus LDAP in das UserModel importiert, aber es wird nicht zurück in LDAP gespeichert, wenn der Benutzer in Keycloak aktualisiert wird.
 alwaysReadValueFromLdap=Wert immer aus LDAP lesen
-alwaysReadValueFromLdapHelp=Wenn aktiv, dann wird beim Lesen immer das LDAP-Attribut anstatt der Wert aus der Keycloak-DB verwendet.
+alwaysReadValueFromLdapHelp=Wenn aktiv, dann wird beim Lesen immer das LDAP-Attribut anstatt der Wert aus der Keycloak-Datenbank verwendet.
 isMandatoryInLdap=Ist in LDAP erforderlich
-isMandatoryInLdapHelp=Wenn aktiv, ist das Attribut in LDAP erforderlich. Wenn kein Wert in der Keycloak-DB vorhanden ist, wird ein leerer Wert gesetzt, und an LDAP weitergegeben.
+isMandatoryInLdapHelp=Wenn aktiv, ist das Attribut in LDAP erforderlich. Wenn kein Wert in der Keycloak-Datenbank vorhanden ist, wird ein leerer Wert gesetzt, und an LDAP weitergegeben.
 attributeDefaultValue=Attribut-Standardwert
-attributeDefaultValueHelp=Wenn es keinen Wert in Keycloak-DB gibt und das Attribut in LDAP erforderlich ist, dann wird dieser Wert an LDAP weitergegeben.
+attributeDefaultValueHelp=Wenn es keinen Wert in Keycloak-Datenbank gibt und das Attribut in LDAP erforderlich ist, dann wird dieser Wert an LDAP weitergegeben.
 isBinaryAttribute=Ist Binärattribut
 isBinaryAttributeHelp=Sollte für binäre LDAP-Attribute aktiviert werden.
 passwordPolicyHintsEnabled=Passwortrichtlinien-Hinweise aktiviert
 passwordPolicyHintsEnabledHelp=Gilt nur für beschreibbares MS Active Directory (MSAD). Wenn diese Option aktiviert ist, wird beim Aktualisieren des Passworts eines MSAD-Benutzers die LDAP_SERVER_POLICY_HINTS_OID-Erweiterung verwendet, was bedeutet, dass erweiterte MSAD-Passwortrichtlinien wie "Passworthistorie" oder "minimales Passwortalter" angewendet werden. Diese Erweiterung funktioniert nur für MSAD 2008 R2 oder neuer.
 managePriorities=Prioritäten verwalten
 kerberosRealm=Kerberos-Realm
-kerberosRealmHelp=Name des Kerberos-Realms, zum Beispiel: FOO.ORG
+kerberosRealmHelp=Name des Kerberos-Realms, zum Beispiel: FOO.ORG.
 serverPrincipal=Server-Prinzipal
 serverPrincipalHelp=Vollständiger Name des Server-Prinzipals für den HTTP-Dienst einschließlich Server- und Domänenname. Zum Beispiel: HTTP/host.foo.org@FOO.ORG
 keyTab=Key-Tab
-keyTabHelp=Speicherort der Kerberos Key-Tab-Datei, die die Anmeldedaten des Server-Prinzipals enthält, zum Beispiel: /etc/krb5.keytab
+keyTabHelp=Speicherort der Kerberos Key-Tab-Datei, welche die Anmeldedaten des Server-Prinzipals enthält, zum Beispiel: /etc/krb5.keytab
 debug=Debug
 debugHelp=Aktivieren/Deaktivieren der Debug-Protokollierung auf der Standardausgabe für das Krb5LoginModule.
 allowPasswordAuthentication=Passwort-Authentifizierung zulassen
@@ -771,31 +770,29 @@ disableConfirm=Sind Sie sicher, dass Sie '{{name}}' deaktivieren möchten
 secretHasExpired=Secret ist abgelaufen, erzeugen Sie bitte eine neues, indem Sie auf die Schaltfläche "Neu generieren" klicken
 httpPostBindingAuthnRequestHelp=Gibt an, ob die AuthnRequest per HTTP-POST-Bindung gesendet werden muss. Wenn falsch, wird HTTP-REDIRECT-Bindung verwendet.
 eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Federierter Identitätslink-Fehler
-requiredRoles=Fügen Sie bitte mindestens eine Rolle hinzu.
 addLdapWizardTitle=Fügen Sie einen LDAP-Federation Provider hinzu
 eventTypes.CUSTOM_REQUIRED_ACTION.description=Benutzerdefinierte erforderliche Aktion
 userInfoResponseEncryptionContentEncryptionAlgorithm=Benutzerinformation Antwort Verschlüsselung Inhalt Verschlüsselungsalgorithmus
 eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Fehler bei der ersten Anmeldung beim Identity Provider
 passLoginHint=login_hint mitgeben
 emptyClientScopes=Dieser Client hat keine zusätzlichen Client Scopes
-requiredGroups=Bitte fügen Sie mindestens eine Gruppe hinzu.
 policyEnforcementMode=Richtlinien Durchsetzungsmodus
 eventTypes.CLIENT_UPDATE.name=Client aktualisieren
 addMultivaluedLabel={{fieldLabel}} hinzufügen
 notRepeat=Nicht wiederholen
 secretRotated=Secret rotiert
-userCredentialsHelpTextLabel=Berechtigungsnachweishilfetext vom Benutzer
+userCredentialsHelpTextLabel=Zugangsdatenhilfetext vom Benutzer
 role=Rolle
 updateCibaError=Kann die CIBA-Richtlinie nicht aktualisieren: {{error}}
 policyUrl=Richtlinien URL
 passwordPoliciesHelp.regexPattern=Erfordert, dass das Passwort einem oder mehreren definierten Java Regular Expressions entspricht.
-oAuthDPoP=OAuth 2.0 DPoP Bound Access Token aktivieren
+oAuthDPoP=Erzwinge einen DPoP-Header (Demonstrating Proof of Possession) in Token-Anfragen
 invalidRealmName=Realm Name kann keine Sonderzeichen enthalten
 realmNameTitle={{name}} Realm
-credentialsList=Berechtigungsnachweisliste
+credentialsList=Zugangsdatenliste
 contextualAttributesHelp=Beliebiges Attribut, das von einer laufenden Umgebung oder einem Ausführungskontext bereitgestellt wird.
 emptyMappers=Keine Mapper
-artifactBindingUrlHelp=URL, and die die HTTP ARTIFACT-Nachrichten gesendet werden. Sie können diese URL leer lassen, wenn Sie eine andere Bindung verwenden. Dieser Wert sollte festgelegt werden, wenn ARTIFACT-Bindung zusammen mit IdP initiiertem Login erzwungen wird.
+artifactBindingUrlHelp=URL, an die HTTP ARTIFACT-Nachrichten gesendet werden. Sie können diese URL leer lassen, wenn Sie ein anderes Bindung verwenden. Dieser Wert sollte festgelegt werden, wenn ARTIFACT-Bindung zusammen mit IdP initiiertem Login erzwungen wird.
 userId=User ID
 eventTypes.VALIDATE_ACCESS_TOKEN.description=Access Token validieren
 dedicatedScopeExplain=Dies ist ein Client Scope, der die dedizierten Mapper und Scopes enthält
@@ -913,7 +910,7 @@ eventTypes.REVOKE_GRANT_ERROR.description=Fehler bei der Rücknahme der Berechti
 eventTypes.UPDATE_PASSWORD_ERROR.name=Fehler beim Aktualisieren des Passworts
 eventTypes.FEDERATED_IDENTITY_LINK.description=Verbindung zur föderierten Identität
 eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=Fehler beim Senden der E-Mail-Verifikation bei Verknüpfung mit einem Identity Provider
-executeActionsHelp=Spezifiziert ein unabhängiges Zeitlimit um Aktionen auszuführen.
+executeActionsHelp=Unabhängiges Zeitlimit um Aktionen auszuführen
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Benutzer durch vorübergehende Sperre deaktiviert
 eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Token vom Identity Provider abrufen
 eventTypes.REMOVE_TOTP.description=TOTP entfernen
@@ -935,7 +932,7 @@ eventTypes.CUSTOM_REQUIRED_ACTION.name=Benutzerdefinierte erforderliche Aktion
 applyToResourceTypeHelp=Gibt an, ob diese Erlaubnis auf alle Ressourcen mit einem bestimmten Typ angewendet werden sollte. In diesem Fall wird diese Berechtigung für alle Vorkommnisse des genannten Ressourcentyps ausgewertet.
 cibaIntervalHelp=Die Mindestzeit in Sekunden, die das Endgerät (CD) zwischen Abfrageanfragen auf den Tokenendpunkt warten muss. Wenn auf 0 gesetzt, muss das Endgerät 5 als Standardwert gemäß der CIBA-Spezifikation verwenden.
 rolesPermissionsHint=Legt fest, ob feingranulare Berechtigungen für diese Rolle aktiv sein sollen. Wird diese Option deaktiviert, werden alle aktuell vorhandenen feingranularen Berechtigungen gelöscht.
-identityProvidersPermissionsHint=Legt fest, ob feingranulare Berechtigungen für diese Rolle aktiv sein sollen. Wird diese Option deaktiviert, werden alle aktuell vorhandenen feingranularen Berechtigungen gelöscht.
+identityProvidersPermissionsHint=Legt fest, ob feingranulare Berechtigungen für das Management dieser Rolle aktiviert sind. Wird diese Option deaktiviert, werden alle aktuell vorhandenen Berechtigungen gelöscht.
 groupsPermissionsHint=Legt fest, ob feingranulare Berechtigungen für diese Rolle aktiv sein sollen. Wird diese Option deaktiviert, werden alle aktuell vorhandenen feingranularen Berechtigungen gelöscht.
 clientAuthorization=Autorisierung
 path=Pfad
@@ -947,7 +944,6 @@ dayMonth=Tag
 otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
 editProvider=Anbieter bearbeiten
 searchProfile=Profil suchen
-renameGroup=Gruppe umbenennen
 used.DEFAULT=Standard
 sslType.all=Alle Anfragen
 validatorDialogColNames.colDescription=Beschreibung
@@ -1098,13 +1094,13 @@ searchAdminEventsBtn=Admin-Events suchen
 deleteDialogDescription=Sind Sie sicher, dass Sie die Attributgruppe <1>{{group}}</1> dauerhaft löschen möchten?
 deleteNodeBody=Sind Sie sicher, dass Sie den Knoten "{{node}}" dauerhaft löschen möchten
 storedTokensReadableHelp=Aktivieren/deaktivieren, wenn neue Benutzer gespeicherte Tokens lesen dürfen. Dies weißt die Rolle broker.read-token zu.
-authenticationFlowTypeHelp=Um was für eine Art von Formular handelt es sich
+authenticationFlowTypeHelp=Um was für eine Art von Formular handelt es sich?
 flowTypeHelp=Um was für eine Art von Formular es sich handelt
 importResourceSuccess=Die Ressource wurde erfolgreich importiert
 advancedAttributeToRole=Wenn die Attributen existieren und übereinstimmen, erhält der Benutzer die angegebene Realm- oder Client-Rolle.
 deleteConfirmUsers_one=Benutzer {{name}} löschen?
 themeColorInfo=Hier können Sie die Patternfly-Farbvariablen festlegen und eine "Theme Jar"-Datei erstellen, die Sie herunterladen und in ihrem Provider-Ordner ablegen können, um das Theme auf Ihren Realm anzuwenden.
-deleteConfirmUsers_other={{count} Benutzer löschen?
+deleteConfirmUsers_other={{count}} Benutzer löschen?
 root=Wurzel
 inputTypeCols=Spalten Eingabefeld
 authnContextClassRefsHelp=Sortierte Liste von angeforderten AuthnContext ClassRefs.
@@ -1123,18 +1119,18 @@ welcome=Willkommen bei
 importResources=Folgende Einstellungen und Daten werden importiert:
 removeImportedUsersError=Importierte Benutzer konnten nicht entfernt werden: '{{error}}'
 samlEndpointsLabel=SAML 2.0 Dienstanbieter-Metadaten
-otpHashAlgorithmHelp=Welcher Hashalgorithmus soll für die Generierung des OTP verwendet werden.
+otpHashAlgorithmHelp=Verwendeter Hashalgorithmus für die Generierung des OTP
 lessThan=Muss kleiner sein als {{value}}
 operationTypes=Betriebsarten
 createPolicyOfType=Richtlinie {{policyType}} erstellen
 realmRolePrefix=Präfix der Realm-Rolle
 unmanagedAttributePolicy.DISABLED=Deaktiviert
 unmanagedAttributePolicy.ENABLED=Aktiviert
-unmanagedAttributePolicy.ADMIN_VIEW=Nur Administratoren können sehen
+unmanagedAttributePolicy.ADMIN_VIEW=Nur für Administratoren sichtbar
 headers=Kopfzeilen
 used.SPECIFIC_CLIENTS=Ausgewählte Clients
 applyPolicy=Richtlinie anwenden
-supportedApplicationsHelp=Anwendungen, von denen bekannt ist, dass sie mit den aktuellen OTP-Richtlinie funktionieren
+supportedApplicationsHelp=Anwendungen, von denen bekannt ist, dass sie mit den aktuellen OTP-Richtlinie funktionieren.
 addAssociatedRolesError=Rollen konnten nicht zugeordnet werden {{error}}
 allowRemoteResourceManagementHelp=Sollen Ressourcen vom Ressourcenserver aus verwaltet werden? Falls nicht, können Ressourcen nur von diesem Admin UI aus verwaltet werden.
 keystoreHelp=Pfad zu Schlüsseldateien
@@ -1145,11 +1141,11 @@ comparison=Vergleich
 passwordPoliciesHelp.digits=Anzahl der numerischen Ziffern, die im Kennwort erforderlich sind.
 dependentPermission=Abhängige Genehmigung
 disableNonce=Nonce deaktivieren
-permissionDescription=Eine Beschreibung für diese Genehmigung.
-algorithmNotSpecified=Algorithmus nicht angegeben
-jwtX509HeadersEnabled=Hinzufügen von X.509-Kopfzeilen zum JWT
+permissionDescription=Eine Beschreibung für diese Berechtigung.
+algorithmNotSpecified=Algorithmus nicht spezifiziert
+jwtX509HeadersEnabled=Füge X.509-Kopfzeilen zum JWT hinzu
 forbidden_other=Verboten, Berechtigungen erforderlich:
-validateConnectionUrl=Sie müssen eine Verbund-URL eingeben
+validateConnectionUrl=Sie müssen eine Verbindungs-URL eingeben
 passCurrentLocaleHelp=Übergeben Sie das aktuelle Sprachschema als Parameter ui_locales an den Identitätsanbieter.
 roleDeletedSuccess=Die Rolle wurde gelöscht
 maxLifespanHelp=Maximale Lebensdauer des Cache-Eintrags in Millisekunden
@@ -1162,12 +1158,12 @@ filterByClients=Nach Client filtern
 testError=Fehler beim Versuch, eine Verbindung zu LDAP herzustellen: '{{error}}'
 groupObjectClassesHelp=Objektklasse (oder Klassen) des Gruppenobjekts. Sie wird durch Kommata getrennt, wenn mehr Klassen benötigt werden. Bei einer typischen LDAP-Bereitstellung könnte dies "groupOfNames" sein. In Active Directory ist es normalerweise "group".
 flowUsedByDescription=Dieser Ablauf wird vom folgenden {{value}} verwendet
-expireTimeHelp=Legt den Zeitpunkt fest, nach dem die Richtlinie NICHT gewährt werden MUSS. Wird nur gewährt, wenn das aktuelle Datum/die aktuelle Uhrzeit vor diesem Wert liegt oder diesem Wert entspricht.
+expireTimeHelp=Legt den Zeitpunkt fest, nach dem die Richtlinie NICHT gewährt werden DARF. Wird nur gewährt, wenn das aktuelle Datum/die aktuelle Uhrzeit vor diesem Wert liegt oder diesem Wert entspricht.
 representation=Darstellung
 noRolesInstructions-roles=Sie haben in diesem Realm noch keine Rollen erstellt. Erstellen Sie eine Rolle, um loszulegen.
 editIdPMapper=Identitätsanbieter-Zuordnung bearbeiten
-unmanagedAttributePolicy.ADMIN_EDIT=Nur Administratoren können schreiben
-ldapAttributeNameHelp=Name des LDAP-Attributs, das dem neuen Benutzer bei der Registrierung hinzugefügt wird
+unmanagedAttributePolicy.ADMIN_EDIT=Nur für Administratoren bearbeitbar
+ldapAttributeNameHelp=Name des LDAP-Attributs, das dem neuen Benutzer bei der Registrierung hinzugefügt wird.
 createAGroup=Gruppe erstellen
 usersAdded_one={{count}} Benutzer zur Gruppe hinzugefügt
 overrideActionTokens=Aktionstoken überschreiben
@@ -1191,7 +1187,7 @@ copySuccess=Erfolgreich in die Zwischenablage kopiert!
 passwordPoliciesHelp.passwordBlacklist=Verhindert die Verwendung eines Kennworts, das auf der schwarzen Liste steht.
 disableSuccess=Anbieter erfolgreich deaktiviert
 membershipLdapAttribute=LDAP-Attribut der Mitgliedschaft
-roleDeleteConfirmDialog=Diese Aktion löscht die Rolle "{{selectedRoleName}}" dauerhaft und kann nicht rückgängig gemacht werden.
+roleDeleteConfirmDialog=Diese Aktion löscht die Rolle "{{selectedRoleName}}" dauerhaft. Dies kann nicht rückgängig gemacht werden.
 userDeletedSuccess=Der Benutzer wurde gelöscht
 clientDelete={{clientId}} löschen?
 minuteHelp=Definiert die Minute, in der die Richtlinie gewährt werden MUSS. Sie können auch einen Bereich angeben, indem Sie das zweite Feld ausfüllen. In diesem Fall wird die Erlaubnis nur erteilt, wenn die aktuelle Minute zwischen den beiden von Ihnen angegebenen Werten liegt oder diesen entspricht.
@@ -1202,13 +1198,13 @@ columnDisplayName=Anzeigename
 noUsersFoundErrorStorage=Keine Benutzer gefunden, was an einem falsch konfigurierten föderierten Anbieter liegen könnte {{error}}
 addAssociatedRolesSuccess=Zugeordnete Rollen wurden hinzugefügt
 duplicateFlow=Ablauf duplizieren
-addedNodeFail=Konnte keinen Knoten hinzufügen: '{{error}}'
+addedNodeFail=Konnte Knoten nicht hinzufügen: '{{error}}'
 maxLength=Maximale Länge {{length}}
 reorder=Umsortieren
 prompts.unspecified=Unbestimmt
 updateTranslationSuccess=Erfolg! Übersetzung aktualisiert.
 flow.registration=Ablauf der Registrierung
-webAuthnPolicyCreateTimeoutHint=Die Zeitüberschreitung muss zwischen 0 Sekunden und 8 Stunden liegen
+webAuthnPolicyCreateTimeoutHint=Die Ablaufzeit muss zwischen 0 Sekunden und 8 Stunden liegen.
 unlinkUsersSuccess=Die Trennung der Benutzer wurde erfolgreich abgeschlossen.
 removeMappingConfirm_other=Sind Sie sicher, dass Sie die {{count}} Rollen entfernen wollen
 leaveGroupConfirmDialog_other=Sind Sie sicher, dass Sie {{username}} aus den {{count}} ausgewählten Gruppen entfernen wollen?
@@ -1219,11 +1215,11 @@ validatingX509Certs=X509-Zertifikate validieren
 testSuccess=Erfolgreich mit LDAP verbunden
 userInfoUrl=Benutzerinfo-URL
 syncUsersSuccess=Die Synchronisierung der Benutzer wurde erfolgreich abgeschlossen.
-updatedCredentialMoveError=Konfiguration der Benutzeranmeldeinformationen wurde nicht gespeichert: {{error}}
+updatedCredentialMoveError=Konfiguration der Benutzerzugangsdaten wurde nicht gespeichert: {{error}}
 searchForRoles=Rolle nach Namen suchen
 associatedRolesModalTitle=Rollen zu {{name}} hinzufügen
 tableTitle=Attributgruppen
-generateNewKeys=Neue Schlüssel generieren
+generateNewKeys=RSA-Schlüssel generieren
 attributeValue=Attributwert
 mappingUpdatedSuccess=Zuordnung erfolgreich aktualisiert
 deleteConfirmGroup_one=Sind Sie sicher, dass Sie diese Gruppe '{{groupName}}' löschen möchten.
@@ -1266,6 +1262,160 @@ MANAGED=Verwaltet
 downloadThemeJar=Theme-JAR herunterladen
 requiredAction=Erforderliche Aktion
 requiredActionConfig=Konfiguration für {{Name}}
-evictionDayHelp=Wochentag, an dem der Eintrag ungültig wird
+evictionDayHelp=Wochentag, an dem der Eintrag ungültig wird.
 attestationPreference.none=Keine
-otpPolicyPeriodErrorHint=Der Wert muss zwischen 1 Sekunde und 2 Minuten liegen
+otpPolicyPeriodErrorHint=Der Wert muss zwischen 1 Sekunde und 2 Minuten liegen.
+selectUnmanagedAttributePolicy=Richtlinie für nicht verwaltete Attribute auswählen
+policyRolesHelp=Klicken Sie auf 'Rollen hinzufügen', um zu akzeptierte Rollen für diese Richtlinie hinzuzufügen. Wenn Sie das Kontrollkästchen 'Pflichtfeld' für eine Rolle aktivieren, bedeutet dies, dass die ausgewählte Rolle bei der Bewertung der Richtlinie vorhanden sein MUSS, unabhängig von anderen Rollen. Wenn Sie alle relevanten Rollen für die Richtlinie deaktiviert lassen, entspricht dies dem Festlegen der Entscheidungsstrategie 'Zulassen'.
+addressClaim.country.tooltip=Name des Benutzerattributs, das zum Zuordnen zum Sub-Claim 'country' Claim 'address' verwendet wird. Der Standardwert ist 'country'.
+scopeNameHelp=Name des Client Scopes. Muss innerhalb des Realms eindeutig sein. Der Name darf keine Leerzeichen enthalten, da er als Wert im 'scope'-Parameter verwendet wird.
+clientAssertionAudience=Client Assertion Audience
+syncRegistrationsHelp=Sollen neu erstellte Benutzer in LDAP angelegt werden? Die Priorität bestimmt, welcher Anbieter für die Synchronisierung des neuen Benutzers ausgewählt wird. Diese Einstellung wird nur im WRITABLE-Bearbeitungsmodus effektiv angewendet.
+revocationDescription=Auf diese Weise können Sie alle aktiven Session- und Access-Token widerrufen. „Nicht vorher“ bedeutet, dass Sie alle vor dem Datum ausgestellten Token widerrufen können.
+claims=Claims
+samlSignatureKeyNameHelp=Signierte SAML-Dokumente enthalten die Identifikation des Signaturschlüssels im KeyName-Element. Verwenden Sie für Keycloak Gegenseite KEY_ID, für MS ADFS CERT_SUBJECT, für andere verwenden Sie NONE, wenn keine andere Option funktioniert.
+revokeClientScopesTitle=Zustimmung für alle erlaubten Client Scopes widerrufen?
+policyClientHelp=Definiert welche Clients durch diese Richtlinie erlaubt sind.
+resourcesAndScopes=Resourcen und Scopes
+jsonType.tooltip=JSON Datentyp für das Claim im Token. Unterstützte Werte: long, int, boolean, String, JSON.
+accountLinkingOnly=Ausschließlich Benutzerkonto verknüpfen
+anyClient=Die Bedingung trifft auf jeden Client zu.
+clientProfilesHelp=Client-Profile, welche in dieser Richtlinie angewendet werden.
+whoWillAppearPopoverText=Gruppen sind hierarchisch angeordnet. Wähle "Direkte Mitgliedschaft" um nur die Gruppen zu sehen, denen der Nutzer direkt zugeordnet ist. Übergeordnete Gruppen sind dann nicht enthalten.
+allow-default-scopes.label=Standard-Scopes erlauben
+topLevelFlowTypeHelp=Welche Art Flow ist gewünscht? Typ "Client" ist für die Authentifizierung von Applikationen, Typ "Generisch" für Benutzer und andere Fälle.
+scopePermissions.roles.map-role-client-scope-description=Richtlinien die entscheiden, ob ein Administrator diese Rolle auf einen Client Scope eines Clients anwenden darf
+deletedSuccessClientScope=Der Client Scope wurde gelöscht
+notAllowedToDeleteAllClientScopes=Es ist ihnen nicht erlaubt alle Client Scopes zu löschen.
+noSearchResultsInstructions=Klicken Sie auf die Suchleiste, um erneut zu suchen
+revokeClientScopes=Sind sie sicher, dass alle für {{clientId}} erlaubten Client Scopes widerrufen werden sollen?
+loadingRealms=Realms werden geladen…
+multivalued.label=Mehrere Werte
+buildIn=Eingebaut
+roleCreateExplain=Dies ist eine Beschreibung
+scopePermissions.identityProviders.token-exchange-description=Richtlinien, die entscheiden, welche Clients ein Token gegen ein externes Token dieses Identitätsanbieters eintauschen dürfen.
+createAttributeError=Fehler! Benutzerprofildefinition konnte nicht gespeichert werden {{error}}.
+clientPoliciesPoliciesHelpText=Mit Client-Richtlinien können Bedingungen definiert werden, welche festlegen das bestimmte Client-Profile erzwungen werden.
+logoUrl=Logo-URL
+any=Jede
+addTypes=Typen hinzufügen
+credentialResetEmailSuccess=E-Mail wurde an den Benutzer gesendet.
+roleSaveSuccess=Die Rolle wurde gespeichert
+useJwksUrl=JWKS-URL verwenden
+linkAccount=Konto verknüpfen
+addSamlProvider=SAML-Anbieter hinzufügen
+iconColor=Symbolfarbe
+textColor=Textfarbe
+disableConfirmClient=Sind Sie sicher, dass Sie diesen Client deaktivieren möchten?
+tokenLifespan.never=Läuft nie ab
+disablePolicyConfirmTitle=Richtlinie deaktivieren?
+unitLabel=Zeiteinheit auswählen
+defaults=Auf Standardeinstellungen zurücksetzen
+errorColor=Fehlerfarbe
+activeColor=Aktivfarbe
+attestationPreference.direct=Direkt
+evictionMinuteHelp=Minute der Stunde, in der der Eintrag ungültig wird
+webAuthnPolicySignatureAlgorithms=Signaturalgorithmen
+lightTextColor=Helle Textfarbe
+disableConfirmClientTitle=Client deaktivieren?
+primaryColor=Primärfarbe
+secondaryColor=Sekundärfarbe
+backgroundColor=Hintergrundfarbe
+backgroundColorNav=Hintergrundfarbe Navigation
+backgroundColorHeader=Hintergrundfarbe Kopfzeile
+linkColor=Linkfarbe
+backgroundColorAccent=Hintergrundfarbe Akzent
+targetAudience=Zielgruppe
+targetAudiencePlaceHolder=Zielgruppe für den Token-Austausch auswählen
+useLowerCaseBearerType=Nutze Kleinschreibung für den Bearer Type in Token-Antworten
+updateCredentialUserLabelSuccess=Die Bezeichnung wurde erfolgreich geändert.
+userAttributeValueHelp=Fest codierter Wert der verwendet werden soll
+updateCredentialUserLabelError=Fehler bei der Änderung der Bezeichnung: {{error}}
+attributeConsumingServiceNameHelp=Name des Attribute Consuming Service Profil zum Bekanntmachen in der SP Metadaten.
+singleLogoutServiceUrl=Einzelne Logout Service URL
+useRfc9068AccessTokenType=Verwende "at+jwt" als Access Token Header Typ
+permissionPoliciesHelp=Definiert alle Policies, welche auf die Berechtigung angewendet werden müssen.
+newRoleNameHelp=Der neue Rollenname. Das Format für den neuen Namen entspricht, wo im Access Token die Rolle zugeordnet wird. Das heisst, ein neuer Name mit 'myapp.newname' wird die Rolle an dieser Position im Access Token zuordnen. Ein neuer Name mit 'newname' wird die Rolle der Realm Rolle im Token zuordnen.
+scopePermissions.clients.token-exchange-description=Richtlinien, die entscheiden, welchen Clients es erlaubt ist Tokens auszutauschen für ein Token, welches für diesen Client bestimmt ist.
+executorTypeSwitchHelpText=Executor Type Switch Hilfetext
+userInfoResponseEncryptionKeyManagementAlgorithm=Benutzer Info Antwort Verschlüsselungs-Schlüssel Management Algorithmus
+realmCertificateAliasHelp=Realm Zertifikat ist auch im Archiv gespeichert. Das ist der Alias zu diesem.
+exportWarningTitle=Export mit Vorsicht verwenden
+httpPostBindingResponseHelp=Zeigt an, ob auf Anfragen mit HTTP-POST Binding geantwortet werden soll. Wenn deaktiviert, wird HTTP-REDIRECT Binding verwendet.
+artifactBindingResponseHelp=Zeigt an, ob auf Anfragen mit ARTIFACT Binding geantwortet werden soll. Wenn deaktiviert, wird die HTTP-POST Binding Konfiguration verwendet.
+logoutServiceRedirectBindingURL=Abmelde Service Umleitungs Binding URL
+emptyMappersInstructions=Wenn Sie Mappers hinzufügen möchten, bitte klicken Sie die untenstehende Schaltfläche, um vordefinierte Mappers hinzuzufügen oder um neue Mappers zu konfigurieren.
+groupObjectClasses=Gruppen Objekt Klasse
+disableTypeClaimCheck=Deaktiviere die Type Claim Prüfung
+typeHelp=Client Scopes, welche als Standard Scopes zu jedem neu erstellten Client hinzugefügt werden.
+signDocuments=Signiere Dokumente
+onDragFinish=Herumziehen abgeschlossen {{list}}
+confirmClientSecretTitle=Secret für diesen Client neu erstellen?
+kerberosWizardDescription=Text benötigt hier.
+advancedClaimToRole=Wenn ein Claim existiert, gebe dem Benutzer die spezifischen Realm oder Client Rollen.
+directGrant=Direct Grant Flow
+evictionHour=Aufräumungs-Stunde
+authDataDescription=Repräsentiert ein Token, welches Authorisierungs-Informationen beinhaltet als Ergebnis von der Bearbeitung einer Authorisierungs-Anfrage. Überprüfen Sie den `authorization` Claim auf die Berechtigungen, die basierend auf der aktuellen Autorisierungsanfrage erteilt wurden.
+lookAround=Zeitfenster für Prüfung
+cibaBackhannelTokenDeliveryModes.poll=Umfrage
+httpPostBindingLogout=HTTP-POST Binding Logout
+registeredClusterNodes=Registrierte Cluster Nodes
+flow.browser=Browser Flow
+addressClaim.street.tooltip=Name vom Benutzer-Attribute, welches dem 'street_address' Subclaim innerhalb des 'address' Token Claim zugeordnet wird. Standard ist 'street'.
+createTokenHelp=Ein initiales Access Token kann nur für die Erstellung von Clients verwendet werden.
+cibaAuthRequestedUserHintHelp=Der Weg, um den Endbenutzer zu identifizieren, für welchen die Authentifizierung beantragt wird. Aktuell ist nur "login_hint" unterstützt.
+validateServerPrincipal=Sie müssen ein Server Prinzipal eingeben
+addMessageBundle=Fügen Sie ein Nachrichten Paket hinzu
+realmName=Realm Name
+detailsHelp=Das ist die Information über die Details.
+ldapMappersList=LDAP Mappers
+newClientProfileName=Client Profil Name
+updateScopeSuccess=Authorisierungs-Scope erfolgreich aktualisiert
+updateClientPolicySuccess=Client Richtlinien aktualisiert
+protocolTypes.openid-connect=OpenID Connect
+addOpenIdProvider=OpenID Connect Provider hinzufügen
+cibaAuthRequestedUserHint=Authentisierung angefragter Benutzer Hinweis
+validateRealm=Sie müssen ein Realm eingeben
+logoUrlHelp=URL, welche ein Logo für die Client Applikation referenziert
+exportWarningDescription=Wenn es eine grosse Anzahl an Gruppen, Rollen und Clients in der Realm hat, kann die Operation den Server für einen Moment unerreichbar machen.
+sameSession=Selbe Session
+standardTokenExchangeEnabledHelp=Aktiviere Standard Token Exchange V2 für diesen Client.
+removeConfirm_other=Sind Sie sicher, dass Sie diese Gruppen entfernen möchten?
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=Neustart Authentisierungsfehler
+authnContextDeclRefsHelp=Sortierte liste von angefragten AuthnContext DeclRefs.
+hideOnLoginPageHelp=Wenn versteckt, ist das Login mit diesem Provider nur möglich, wenn explizit angefragt, z.B. bei der Verwendung vom 'kc_idp_hint' Parameter.
+noSessionsDescription=Es gibt aktuell keine aktiven Sessions in diesem Realm.
+saveProviderSuccess=Der Provider ist erfolgreich gespeichert worden.
+webAuthnPolicyRequireResidentKeyHelp=Es teilt dem Authenticator mit, ob eine öffentliche Schlüssel-Zugangsberechtigung als auffindbare Zugangsberechtigung erstellt werden soll.
+showRemaining=Zeige ${remaining}
+policyProvider.js=Definiere Bedingungen für deine Berechtigungen durch die Verwendung von JavaScript. Es ist eine der Regel-basierten Policy-Typen, welche von Keycloak unterstützt ist, und Flexibilität beim Schreiben jeglicher Policies basierend auf der Evaluation API ermöglicht.
+friendlyName=Benutzer-lesbarer Name des Attributs für die Suche in Zusicherungen ("Assertions").
+displayOnConsentScreen=Zeige es auf dem Einverständnisdialog an
+policyProvider.user=Definiere Bedingungen für deine Berechtigungen, bei denen ein Gruppe von einem oder mehreren Benutzer berechtigt ist auf ein Objekt zuzugreifen.
+mapper.nameid.format.tooltip=Dieser Mapper wird nur angewendet, wenn das NameID Format vom eingehenden AuthnRequest diesem Wert entspricht.
+orderChangeError=Konnte Anzeigereihenfolge der Identity Provider nicht ändern {{error}}
+assignRolesTo=Weise {{type}} Rollen an {{client}} zu
+secretExpiresOn=Geheimschlüssel läuft am {{time}} ab
+policyProvider.client-scope=Definiere Bedingungen für deine Berechtigungen, bei denen eine Gruppe von einem oder mehreren Client Scopes berechtigt wird auf ein Objekt zuzugreifen.
+searchClientByName=Suche Client anhand Name
+decisionStrategies.CONSENSUS=Konsens
+otpPolicyCodeReusable=Wiederverwendbares Token
+temporaryLockedHelp=Der Benutzer könnte blockiert sein aufgrund mehreren gescheiterten Login-Versuchen.
+dedicatedScopes=Dedizierte Scopes
+deleteClientProfileConfirm=Diese Aktion wird das Profil {{profileName}} dauerhaft löschen. Das kann nicht rückgängig gemacht werden.
+attributeName=Attribut [Name]
+updateError=Konnte den Provider nicht aktualisieren {{error}}
+emptyClientProfilesInstructions=Es gibt keine Profile, selektieren 'Erstelle Client Profil', um ein neues Client Profil zu erstellen
+attributeFriendlyName=Attribut [Benutzer-freundlicher Name]
+clearAllFilters=Setze alle Filter zurück
+noRolesAssociatedInstructions=Um Rollen zu dieser Rolle hinzuzufügen, klicken Sie 'Rolle hinzufügen'.
+mapperSaveSuccess=Mapper erfolgreich gespeichert.
+realmSaveSuccess=Realm erfolgreich aktualisiert
+savePasswordError=Fehler beim Speichern des Passwortes: {{error}}
+emptyAddClientScopes=Keine Client Scopes
+disablePolicyConfirm=Benutzer und Clients können nicht auf die Richtlinien zugreifen, wenn diese deaktiviert sind. Sind Sie sich sicher, dass Sie fortfahren wollen?
+helpDisabled=Hilfe aus
+addClientProfileSuccess=Neues Client Profil hinzugefügt
+deleteResource=Ressource dauerhaft löschen?
+policyDeletedSuccess=Die Richtlinie erfolgreich gelöscht
+clientRolesHelp=Die Bedingung prüft, ob eine der spezifizierten Client Rollen auf dem Client definiert wurde, um herauszufinden, ob die Policy angewendet wird. Diese Bedingung erlaubt dem Client Administrator eine Client Rolle mit einem definierten Namen auf dem Client zu erstellen, um sicherzustellen, dass eine bestimmte Client Policy auf Anfragen von diesem Client angewendet wird.
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties
index 82d4ecf43184..8d4da9f76e39 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_es.properties
@@ -1,5 +1,5 @@
 cancel=Cancelar
-deleteConfirm_other=¿Está seguro de que quiere eliminar estos grupos?
+deleteConfirm_other=¿Está seguro que quiere eliminar estos grupos?
 trusted-hosts.label=Anfitriones de confianza
 deletedSuccess=Proveedor eliminado exitosamente.
 searchAttributes=Atributos de búsqueda
@@ -14,10 +14,9 @@ eventTypes.PERMISSION_TOKEN.name=Token de permiso
 permissionsDisable=¿Deshabilitar permisos?
 eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Error de enlace de identidad federada
 secretHasExpired=El secreto ha expirado, por favor genera uno nuevo haciendo clic en el botón "Regenerar" arriba
-requiredRoles=Por favor, añada al menos un rol.
 addLdapWizardTitle=Añadir proveedor de federación de usuarios LDAP
 wantAssertionsSignedHelp=Indica si este proveedor de servicios espera una Assertion firmada.
-disableConfirm=¿Estás seguro de que deseas deshabilitar '{{name}}'?
+disableConfirm=¿Está seguro que desea deshabilitar '{{name}}'?
 eventTypes.CUSTOM_REQUIRED_ACTION.description=Acción requerida personalizada
 flowName=Nombre del flujo
 userInfoResponseEncryptionContentEncryptionAlgorithm=Algoritmo de encriptación de contenido de encriptación de respuesta de información de usuario
@@ -25,9 +24,8 @@ eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Error de primer inicio de se
 searchByRoleName=Búsqueda por nombre de rol
 credentialType=Tipo
 passLoginHint=Proporcionar login_hint
-openIdConnectCompatibilityModesHelp=Esta sección se utiliza para configurar ajustes para la compatibilidad con versiones de adaptadores más antiguos de OpenID Connect / OAuth 2. Es especialmente útil si su cliente utiliza una versión más antigua del adaptador de Keycloak / RH-SSO.
-emptyClientScopes=Este cliente no tiene ningún alcance de cliente añadido
-requiredGroups=Por favor, añada al menos un grupo.
+openIdConnectCompatibilityModesHelp=Esta sección se utiliza para configurar ajustes de compatibilidad con versiones anteriores de adaptadores OpenID Connect / OAuth 2. Es especialmente útil si tu cliente utiliza una versión más antigua del adaptador de Keycloak / RH-SSO.
+emptyClientScopes=Este cliente no tiene ningún client scope agregado
 httpPostBindingAuthnRequestHelp=Indique si la AuthnRequest debe ser enviada usando la vinculación HTTP-POST. Si es falso, se utilizará la vinculación HTTP-REDIRECT.
 policyEnforcementMode=Modo de cumplimiento de políticas
 eventTypes.CLIENT_UPDATE.name=Actualización de cliente
@@ -47,16 +45,16 @@ policyUrl=URL de política
 clientDescriptionHelp=Especifica la descripción del cliente. Por ejemplo, 'Mi cliente para hojas de tiempo'. Admite claves para valores localizados también. Por ejemplo: ${mi_descripcion_cliente}.
 rolesPermissionsHint=Determina si se activan permisos detallados para gestionar este rol. Desactivarlo eliminará todos los permisos actuales que se hayan configurado.
 passwordPoliciesHelp.regexPattern=Requiere que la contraseña coincida con uno o más patrones de expresiones regulares de Java definidos.
-oAuthDPoP=Tokens de acceso con límite de DPoP de OAuth 2.0 habilitados
+oAuthDPoP=Requiere demostrar prueba de posesión (DPoP) en solicitudes de token
 invalidRealmName=El nombre del realm no puede contener caracteres especiales
 validRedirectURIsHelp=Patrón de URI válido al que un navegador puede redirigir después de un inicio de sesión exitoso. Se permiten comodines simples como 'http://ejemplo.com/*'. También se puede especificar una ruta relativa, como /mi/ruta/relativa/. Las rutas relativas son relativas a la URL raíz del cliente, o si no se especifica ninguna, se utiliza la URL raíz del servidor de autenticación. Para SAML, debe establecer patrones de URI válidos si depende de la URL del servicio consumidor incrustada en la solicitud de inicio de sesión.
-realmNameTitle=Realm {{nombre}}
+realmNameTitle=Realm {{name}}
 subjectNameId=NombreID del sujeto
 credentialsList=Lista de credenciales
 usermodel.clientRoleMapping.clientId.label=ID de cliente
 clientId=ID de cliente
 serviceProviderEntityId=ID de entidad del proveedor de servicios
-internationalizationHelp=Si está habilitado, puedes elegir qué ubicaciones admites para este realm y cuál es la ubicación predeterminada.
+internationalizationHelp=Si está habilitado, puede elegir qué ubicaciones admite para este realm y cuál es la ubicación predeterminada.
 managePriorityOrder=Gestionar el orden de prioridad
 contextualAttributesHelp=Cualquier atributo proporcionado por un entorno en ejecución o contexto de ejecución.
 clientLoginTimeoutHelp=Tiempo máximo que un cliente tiene para completar el protocolo de token de acceso. Normalmente debería ser 1 minuto.
@@ -68,7 +66,7 @@ userId=ID de usuario
 eventTypes.CLIENT_UPDATE_ERROR.description=Error de actualización del cliente
 eventTypes.UPDATE_EMAIL.description=Actualizar correo electrónico
 eventTypes.VALIDATE_ACCESS_TOKEN.description=Validar token de acceso
-dedicatedScopeExplain=Este es un alcance de cliente que incluye los mapeadores y alcance dedicados
+dedicatedScopeExplain=Este es un client scope que incluye los mapeadores dedicados y el scope
 updateOtpError=No se pudo actualizar la política de OTP: {{error}}
 addressClaim.postal_code.label=Nombre de atributo de usuario para el código postal
 defaultRoles=Roles predeterminados
@@ -78,16 +76,16 @@ invalidateRotatedSecret=¿Invalidar clave rotada?
 noDirectUsers=No hay usuarios directos
 whoCanEditHelp=Si está habilitado, los usuarios o administradores pueden ver y editar el atributo. De lo contrario, los usuarios o administradores no tienen acceso para escribir en el atributo.
 eventTypes.LOGIN.name=Inicio de sesión
-addressClaim.country.tooltip=Nombre del atributo de usuario que se utilizará para mapear al subreclamo 'país' dentro del reclamo 'dirección' del token. Por defecto, es 'país'.
+addressClaim.country.tooltip=Nombre del atributo de usuario que se utilizará para asignar a la subafirmación 'country' dentro de la afirmación del token 'address'. Por defecto, 'country'.
 uuidLdapAttribute=Atributo LDAP UUID
-scopeNameHelp=Nombre del alcance de cliente. Debe ser único en el realm. El nombre no debe contener espacios ya que se utiliza como valor del parámetro de alcance.
+scopeNameHelp=Nombre del client scope. Debe ser único en el Realm. El nombre no debe contener espacios, ya que se utiliza como valor del parámetro scope.
 requiredUserActions=Acciones de usuario requeridas
 noConsentsText=Los consentimientos solo se registrarán cuando los usuarios intenten acceder a un cliente que esté configurado para requerir consentimiento. En ese caso, los usuarios recibirán una página de consentimiento que les pedirá otorgar acceso al cliente.
 addStep=Añadir paso
 clientAssertionAudience=Público objetivo de la declaración del cliente
-permissionPoliciesHelp=Especifica todas las políticas que deben aplicarse a los alcances definidos por esta política o permiso.
+permissionPoliciesHelp=Especifica todas las políticas que deben aplicarse al permiso.
 userInitiatedActionLifespanHelp=Tiempo máximo antes de que una acción permitida enviada por un usuario (como un correo electrónico de restablecimiento de contraseña) expire. Se recomienda que este valor sea corto porque se espera que el usuario reaccione rápidamente a la acción autogenerada.
-clearFileExplain=¿Estás seguro de que quieres borrar este archivo?
+clearFileExplain=¿Está seguro que quiere borrar este archivo?
 userModelAttribute=Atributo de modelo de usuario
 eventTypes.LOGOUT_ERROR.name=Error de cierre de sesión
 allowRemoteResourceManagement=Administración remota de recursos
@@ -109,16 +107,16 @@ ldapAttributeHelp=Nombre del atributo mapeado en el objeto LDAP. Por ejemplo, 'c
 assertionLifespan=Vida útil de la afirmación
 export=Exportar
 claimFilterNameHelp=Nombre de la reclamación esencial
-revocationDescription=Esta es una forma de revocar todas las sesiones activas y tokens de acceso. 'No antes' significa que puedes revocar cualquier token emitido antes de la fecha.
+revocationDescription=Esta es una forma de revocar todas las sesiones activas y tokens de acceso. 'No antes' significa que puede revocar cualquier token emitido antes de la fecha.
 eventTypes.CODE_TO_TOKEN_ERROR.description=Error al convertir el código en token
 termsOfServiceUrl=URL de términos de servicio
 requestObject.request_uri\ only=Solo URI de solicitud
 passwordPolicy=Política de contraseña
 backchannelLogout=Cierre de sesión de backchannel
 addressClaim.street.label=Nombre de atributo de usuario para la calle
-rolesScope=Si no se define un mapeo de alcance de rol, a cada usuario se le permite usar este alcance de cliente. Si se definen mapeos de alcance de rol, el usuario debe ser miembro de al menos uno de los roles.
+rolesScope=Si no hay una asignación de scope de roles definida, cada usuario tiene permiso para usar este client scope. Si hay asignaciones de scopes de roles definidas, el usuario debe ser miembro de al menos uno de los roles.
 applyToResourceTypeFlag=Aplicar al tipo de recurso
-offlineSessionIdleHelp=Tiempo que se permite que una sesión sin conexión esté inactiva antes de que expire. Debes usar el token sin conexión para refrescar al menos una vez dentro de este período; de lo contrario, la sesión sin conexión expirará.
+offlineSessionIdleHelp=Tiempo que se permite que una sesión sin conexión esté inactiva antes de que expire. Debe usar el token sin conexión para refrescar al menos una vez dentro de este período; de lo contrario, la sesión sin conexión expirará.
 eventTypes.UPDATE_TOTP.description=Actualizar TOTP
 testError=Error al intentar conectar con LDAP: '{{error}}'
 groupObjectClassesHelp=Clase de objeto (o clases) del objeto de grupo. Se separa por comas si se necesitan más clases. En una implementación típica de LDAP, podría ser 'groupOfNames'. En Active Directory, suele ser 'group'.
@@ -126,8 +124,8 @@ filterByClients=Filtrar por clientes
 claims=Reclamaciones
 createPolicyOfType=Crear política de {{policyType}}
 realmRolePrefix=Prefijo de rol de realm
-flowUsedByDescription=Este flujo es utilizado por el siguiente {{valor}}
-createClientScope=Crear alcance de cliente
+flowUsedByDescription=Este flujo es utilizado por el siguiente {{value}}
+createClientScope=Crear client scope
 includeRepresentation=Incluir representación
 expireTimeHelp=Define el tiempo después del cual la política NO DEBE ser otorgada. Se otorga solo si la fecha/hora actual es anterior o igual a este valor.
 singleLogoutServiceUrl=URL de servicio de cierre de sesión único
@@ -152,14 +150,14 @@ useLowerCaseBearerType=Usar tipo de portador en minúsculas en las respuestas de
 headers=Cabeceras
 ldapAttributeNameHelp=Nombre del atributo LDAP que se agregará al nuevo usuario durante el registro.
 createAGroup=Crear un grupo
-effectiveProtocolMappersHelp=Contiene todos los alcances de cliente predeterminados y los alcances opcionales seleccionados. Se utilizarán todos los mapeadores de protocolo y mapeos de alcance de roles de todos esos alcances de cliente al generar un token de acceso emitido para tu cliente.
+effectiveProtocolMappersHelp=Contiene todos los client scopes predeterminados y los scopes opcionales seleccionados. Todos los mapeadores de protocolo y asignaciones de scope de roles de esos client scopes se utilizarán al generar el token de acceso emitido para su cliente.
 exportSuccess=Realm exportado con éxito.
 scopePermissions.groups.manage-description=Políticas que deciden si un administrador puede gestionar este grupo
 testClusterFail=Falla de verificación de disponibilidad para {{failedNodes}}. Corrige o da de baja los nodos de clúster fallidos e intenta de nuevo
 eventExplain=Los eventos son registros de eventos de usuario y administrador en este realm. Para configurar el seguimiento de estos eventos, ve a <1>Configuraciones de eventos</1>.
 queryExtensions=Extensiones de consulta admitidas
 signingKeysConfig=Configuración de claves de firma
-validateBindDn=Debes ingresar el DN del administrador LDAP
+validateBindDn=Debe ingresar el DN del administrador LDAP
 addedGroupMembership=Se ha añadido la membresía al grupo
 resourceDeletedSuccess=El recurso se ha eliminado correctamente
 userObjectClasses=Clases de objeto de usuario
@@ -170,21 +168,21 @@ signedJWTConfirm=Genera una clave privada y un certificado para el cliente desde
 permit=Permitir
 webOrigins=Orígenes web
 searchAdminEventsBtn=Buscar eventos de administrador
-deleteDialogDescription=¿Estás seguro de que quieres eliminar permanentemente el grupo de atributos <1>{{grupo}}</1>?
+deleteDialogDescription=¿Está seguro que quiere eliminar permanentemente el grupo de atributos <1>{{group}}</1>?
 importResourceSuccess=El recurso se ha importado correctamente
 inputTypeCols=Columnas de entrada
 eventTypes.LOGOUT.description=Cierre de sesión
-deleteNodeBody=¿Estás seguro de que deseas eliminar permanentemente el nodo "{{node}}"?
+deleteNodeBody=¿Está seguro que desea eliminar permanentemente el nodo "{{node}}"?
 lifespan=Expira en
 storedTokensReadableHelp=Activar/desactivar si los usuarios nuevos pueden leer cualquier token almacenado. Esto asigna el rol broker.read-token.
 authenticationFlowTypeHelp=¿Qué tipo de formulario es?
 usersAdded_one={{count}} usuario añadido al grupo
-resourcesAndScopes=Recursos y alcances
+resourcesAndScopes=Recursos y Scopes
 editUsernameHelp=Si está activado, el campo de nombre de usuario es editable; de lo contrario, es de solo lectura.
 eventTypes.UPDATE_CONSENT_ERROR.description=Error al actualizar el consentimiento
-overrideActionTokensHelp=Sobreescribe la configuración predeterminada de tiempo máximo antes de que expire un permiso de acción enviado por un usuario (como un correo electrónico de restablecimiento de contraseña) para una acción específica. Se recomienda que este valor sea corto porque se espera que el usuario reaccione rápidamente a la acción autogenerada.
+overrideActionTokensHelp=Sobreescribe la configuración predeterminada de tiempo máximo antes que expire un permiso de acción enviado por un usuario (como un correo electrónico de restablecimiento de contraseña) para una acción específica. Se recomienda que este valor sea corto porque se espera que el usuario reaccione rápidamente a la acción autogenerada.
 searchByName=Buscar por nombre
-executorTypeSwitchHelpText=Texto de ayuda del interruptor de tipo de ejecutor
+executorTypeSwitchHelpText=Texto de ayuda para cambiar el tipo de ejecutor
 attributeConsumingServiceNameHelp=Nombre del perfil de Servicio de Consumo de Atributos para anunciar en los metadatos del SP.
 overrideActionTokens=Sobreescribir tokens de acción
 deleteGrantsError=Error al eliminar concesiones: {{error}}
@@ -193,7 +191,7 @@ used.SPECIFIC_CLIENTS=Clientes específicos
 freeMemory=Memoria libre
 applyPolicy=Aplicar política
 userFedDeleteConfirm=Si eliminas este proveedor de federación de usuarios, se eliminarán todos los datos asociados.
-directGrantHelp=Selecciona el flujo que quieres usar para la autenticación de concesión directa.
+directGrantHelp=Selecciona el flujo que quiere usar para la autenticación de concesión directa.
 unlockUsersSuccess=Cualquier usuario bloqueado temporalmente ahora está desbloqueado
 jsonType.tooltip=Tipo JSON que se debe utilizar para llenar la reclamación JSON en el token. long, int, boolean, String y JSON son valores válidos.
 emptyPrimaryAction=Añadir mapeador predefinido
@@ -202,12 +200,11 @@ supportedApplicationsHelp=Aplicaciones que se sabe que funcionan con la polític
 enableStartTLS=Habilitar StartTLS
 syncModeOverride=Sobreescribir modo de sincronización
 addAssociatedRolesError=No se pudo asociar roles {{error}}
-removeUserText=¿Quiere quitar {{numSelected}} usuarios? Estos usuarios ya no tendrán permisos del rol {{rol}} ni de los roles asociados a él.
+removeUserText=¿Quiere quitar {{numSelected}} usuarios? Estos usuarios ya no tendrán permisos del rol {{role}} ni de los roles asociados a él.
 diagramView=Vista de diagrama
 removeImportedUsers=¿Eliminar usuarios importados?
-conditionsHelpItem=Elemento de ayuda de condiciones
 accountLinkingOnly=Solo vinculación de cuentas
-clientPoliciesPoliciesHelpText=La política de cliente permite vincular perfiles de cliente con diversas condiciones para especificar cuándo se aplica exactamente el comportamiento especificado por los ejecutores del perfil de cliente en particular.
+clientPoliciesPoliciesHelpText=Las políticas de cliente permiten vincular perfiles de cliente con diversas condiciones para especificar cuándo se aplica el comportamiento definido por los ejecutores de un perfil de cliente en particular.
 anyClient=La condición se satisface con cualquier cliente en cualquier evento.
 editFlow=Editar flujo
 noDefaultGroupsInstructions=Los grupos predeterminados te permiten asignar automáticamente la membresía del grupo cada vez que se crea o importa un nuevo usuario a través del <1>intercambio de identidades</1>. Añade grupos predeterminados para empezar.
@@ -233,7 +230,7 @@ userRegistration=Registro de usuario
 save=Guardar
 helpFileUploadClient=Subir un archivo JSON o XML
 generateSuccess=Nuevo par de claves y certificado generados con éxito
-userAttributeValueHelp=Valor que deseas codificar
+userAttributeValueHelp=Valor que desea codificar
 whoCanViewHelp=Si está habilitado, los usuarios o administradores pueden ver el atributo. De lo contrario, los usuarios o administradores no tienen acceso al atributo.
 eventTypes.IDENTITY_PROVIDER_LOGIN.description=Inicio de sesión del proveedor de identidad
 includeClients=Incluir clientes
@@ -242,35 +239,35 @@ eventTypes.LOGOUT_ERROR.description=Error de cierre de sesión
 clientProfilesHelp=Perfiles de cliente aplicados en esta política.
 deleteClientPolicyError=No se pudo eliminar la política: {{error}}
 selectAttribute=Seleccionar atributo
-resourceAttributeHelp=Los atributos asociados al recurso.
+resourceAttributeHelp=Los atributos asociados con el recurso.
 updateCredentialUserLabelSuccess=La etiqueta de usuario se ha cambiado con éxito.
 product=Producto
 credentialUserLabel=Etiqueta de usuario
 passwordPoliciesHelp.passwordBlacklist=Evita el uso de una contraseña que esté en un archivo de lista negra.
 bindTypeHelp=Tipo del método de autenticación utilizado durante la operación de enlace LDAP. Se usa en la mayoría de las solicitudes enviadas al servidor LDAP. Actualmente, solo están disponibles los mecanismos 'none' (autenticación anónima LDAP) o 'simple' (autenticación de credencial de enlace + contraseña de enlace).
-whoWillAppearPopoverText=Los grupos son jerárquicos. Cuando seleccionas 'Membresía directa', solo ves el grupo hijo al que se unió el usuario. Los grupos ancestrales no están incluidos.
+whoWillAppearPopoverText=Los grupos son jerárquicos. Cuando selecciona 'Membresía directa', solo ve el grupo hijo al que se unió el usuario. Los grupos ancestrales no están incluidos.
 eventTypes.VERIFY_EMAIL.description=Verificar correo electrónico
 eventTypes.REFRESH_TOKEN_ERROR.name=Error de token de actualización
-partialImportHeaderText=La importación parcial te permite importar usuarios, clientes y otros recursos desde un archivo JSON previamente exportado.
+partialImportHeaderText=La importación parcial le permite importar usuarios, clientes y otros recursos desde un archivo JSON previamente exportado.
 disableSuccess=Proveedor desactivado con éxito
-validatingPublicKeyIdHelp=ID explícito de la clave pública de validación dada arriba si es el ID de clave. Déjalo en blanco si la clave de arriba debe usarse siempre, independientemente del ID de clave especificado por el proveedor de identidad externo; establécelo si la clave solo debe usarse para verificar si el ID de clave del proveedor de identidad externo coincide.
+validatingPublicKeyIdHelp=ID explícito de la clave pública de validación dada arriba si es el ID de clave. Déjelo en blanco si la clave de arriba debe usarse siempre, independientemente del ID de clave especificado por el proveedor de identidad externo; establézcalo si la clave solo debe usarse para verificar si el ID de clave del proveedor de identidad externo coincide.
 eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Error al vincular cuenta de proveedor de identidad
 subtree=Subárbol
 userFederation=Federación de usuarios
-effectiveRoleScopeMappingsHelp=Alcances de cliente opcionales seleccionados, que se utilizarán al emitir un token de acceso para este cliente. Puedes ver arriba qué valor del parámetro de alcance de OAuth debe usarse cuando quieras que se apliquen estos alcances de cliente opcionales cuando se envíe la solicitud de autenticación inicial de OpenID Connect desde tu adaptador de cliente.
+effectiveRoleScopeMappingsHelp=Los client scopes opcionales seleccionados, que se usarán al emitir un token de acceso para este cliente. Puede ver arriba qué valor del parámetro OAuth Scope debe usarse cuando quiera aplicar estos client scopes opcionales al enviar la solicitud inicial de autenticación OpenID Connect desde su adaptador de cliente.
 disable=Desactivar
 membershipLdapAttribute=Atributo LDAP de membresía
 availableIdPs=Proveedores de identidad disponibles
 updateClientConditionSuccess=Condición actualizada con éxito.
 attributes=Atributos
-roleDeleteConfirmDialog=Esta acción eliminará permanentemente el rol "{{selectedRoleName}}" y no se puede deshacer.
+roleDeleteConfirmDialog=Esta acción eliminará permanentemente el rol "{{selectedRoleName}}". Esta acción no se puede deshacer.
 clientDelete=¿Eliminar {{clientId}}?
 userDeletedSuccess=El usuario ha sido eliminado
-revokeClientScopesTitle=¿Revocar todos los alcances de cliente otorgados?
+revokeClientScopesTitle=¿Revocar todos los client scopes otorgados?
 contentSecurityPolicyReportOnlyHelp=Para probar las políticas de seguridad de contenido <1>Aprende más</1>
 eventTypes.PERMISSION_TOKEN.description=Token de permiso
-allow-default-scopes.label=Permitir alcances predeterminados
-minuteHelp=Define el minuto en el que la política DEBE ser otorgada. También puedes proporcionar un rango completando el segundo campo. En este caso, el permiso se otorga solo si el minuto actual está entre o es igual a los dos valores que proporcionaste.
+allow-default-scopes.label=Permitir scopes predeterminados
+minuteHelp=Define el minuto en el que la política DEBE ser otorgada. También puede proporcionar un rango completando el segundo campo. En este caso, el permiso se otorga solo si el minuto actual está entre o es igual a los dos valores que proporcionó.
 updateCibaSuccess=Política de CIBA actualizada con éxito
 newRoleNameHelp=El nuevo nombre del rol. El formato del nuevo nombre corresponde a dónde en el token de acceso se asignará el rol. Por ejemplo, un nuevo nombre de 'miapp.nuevonombre' asignará el rol a esa posición en el token de acceso. Un nuevo nombre de 'nuevonombre' asignará el rol a los roles de realm en el token.
 mapperTypeFullNameLdapMapper=mapper completo de nombre de LDAP
@@ -278,12 +275,12 @@ searchUserByAttributeMissingKeyError=Especificar una clave de atributo
 eventTypes.INVALID_SIGNATURE.name=Firma inválida
 topLevelFlowTypeHelp=¿Qué tipo de flujo de nivel superior es? El tipo 'cliente' se utiliza para la autenticación de clientes (aplicaciones) cuando 'genérico' es para usuarios y todo lo demás.
 authDetailsHelp=Exporta y descarga todos los ajustes de recursos para este servidor de recursos.
-policyProvider.regex=Define condiciones de expresiones regulares para tus permisos.
+policyProvider.regex=Define condiciones de expresiones regulares para sus permisos.
 clientImportError=No se pudo importar el cliente: {{error}}
 members=Miembros
 scopePermissions.clients.token-exchange-description=Políticas que deciden qué clientes pueden intercambiar tokens por un token dirigido a este cliente.
 realmCertificateAliasHelp=El certificado del realm también se almacena en el archivo de almacén. Este es el alias para él.
-scopePermissions.roles.map-role-client-scope-description=Políticas que deciden si un administrador puede aplicar este rol al alcance de cliente de un cliente
+scopePermissions.roles.map-role-client-scope-description=Políticas que determinan si un administrador puede aplicar este rol al client scope de un cliente
 createIdentityProviderError=No se pudo crear el proveedor de identidad: {{error}}
 eventTypes.SEND_VERIFY_EMAIL_ERROR.description=Error al enviar correo electrónico de verificación
 deleteClientPolicyConfirm=Esta acción eliminará permanentemente la política {{policyName}}. Esto no se puede deshacer.
@@ -292,7 +289,7 @@ samlKeysExportError=No se pudieron exportar las claves debido a: {{error}}
 webAuthnPolicyCreateTimeout=Tiempo de espera
 comparison=Comparación
 passwordPoliciesHelp.digits=El número de dígitos numéricos requeridos en la cadena de contraseña.
-deletedSuccessClientScope=El alcance de cliente ha sido eliminado
+deletedSuccessClientScope=El client scope ha sido eliminado
 columnDisplayName=Nombre de visualización
 noUsersFoundErrorStorage=No se encontraron usuarios, podría deberse a un proveedor federado mal configurado {{error}}
 lookAround=Ventana de búsqueda
@@ -310,31 +307,31 @@ exportWarningTitle=Exportar con precaución
 emailVerifiedHelp=¿Se ha verificado el correo electrónico del usuario?
 duplicateFlow=Flujo duplicado
 addExecution=Añadir ejecución
-noSearchResultsInstructions=Haz clic en la barra de búsqueda de arriba para buscar grupos
+noSearchResultsInstructions=Haga clic en la barra de búsqueda de arriba para buscar grupos
 addedNodeFail=No se pudo agregar el nodo: '{{error}}'
 groupMembership=Pertenencia a grupo
 maxLength=Longitud máxima {{length}}
 prompts.unspecified=No especificado
-revokeClientScopes=¿Estás seguro de que quieres revocar todos los alcances de cliente otorgados para {{clientId}}?
+revokeClientScopes=¿Está seguro de que quiere revocar todos los client scopes otorgados para {{clientId}}?
 cibaBackhannelTokenDeliveryModes.poll=Encuesta
 policies=Políticas
-parentClientScope=Alcance de cliente principal
+parentClientScope=Client scope principal
 reorder=Reordenar
 allTypes=Todos los tipos
-backchannelLogoutSessionRequired=Se requiere sesión de cierre de sesión de backchannel
+backchannelLogoutSessionRequired=Se requiere una sesión activa para el cierre de sesión por backchannel
 ldapFilter=Filtro LDAP
 eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=Error de solicitud de autorización enviada
 editAttribute=Editar atributo
 webAuthnPolicyRpEntityNameHelp=Nombre del servidor legible por humanos como Relying Party de WebAuthn
 postBrokerLoginFlowAlias=Flujo de inicio de sesión posterior al intercambio
 refreshTokenMaxReuse=Máximo de reutilizaciones del token de actualización
-partialExportHeaderText=La exportación parcial te permite exportar la configuración del realm y otros recursos asociados a un archivo JSON.
-clientScopes=Alcances de cliente
+partialExportHeaderText=La exportación parcial le permite exportar la configuración del realm y otros recursos asociados a un archivo JSON.
+clientScopes=Client scopes
 loadingRealms=Cargando realms…
 eventTypes.SEND_RESET_PASSWORD_ERROR.description=Error al enviar restablecer contraseña
 httpPostBindingLogout=Cierre de sesión de enlace HTTP-POST
 permissionDescription=Una descripción para este permiso.
-policyClientHelp=Especifica qué cliente(s) están permitidos por esta política.
+policyClientHelp=Especifique qué cliente(s) están permitidos por esta política.
 multivalued.label=Multivaluado
 buildIn=Incorporado
 roleCreateExplain=Esta es una descripción
@@ -363,40 +360,40 @@ httpPostBindingResponseHelp=Indica si responder a las solicitudes utilizando el
 mapperTypeHardcodedAttributeMapper=mapeador de atributo codificado
 eventTypes.IMPERSONATE.description=Suplantar
 forbidden_other=Prohibido, se necesitan permisos:
-clientAuthorization=Autorización de cliente
+clientAuthorization=Autorización
 identityProvidersPermissionsHint=Determina si los permisos detallados están habilitados para administrar este rol. Deshabilitarlos eliminará todos los permisos actuales que se hayan configurado.
-removeMappingConfirm_other=¿Estás seguro de que quieres eliminar {{count}} roles
+removeMappingConfirm_other=¿Está seguro que quiere eliminar {{count}} roles
 kerberosWizardDescription=Texto necesario aquí.
 welcome=Bienvenido a
 events=Eventos
 importHelp=Importar un archivo JSON que contenga configuraciones de autorización para este servidor de recursos.
 mapperType=Tipo de mapeador
 importResources=Los siguientes ajustes y datos se importarán:
-validateConnectionUrl=Debes ingresar una URL de conexión
+validateConnectionUrl=Debe ingresar una URL de conexión
 attributeConsumingServiceIndexHelp=Índice del perfil de servicio de consumo de atributos a solicitar durante la autenticación.
 clientSessionSettings=Configuración de sesión de cliente
 cibaAuthRequestedUserHintHelp=La forma de identificar al usuario final para el que se está solicitando la autenticación. Actualmente, solo se admite "login_hint".
-leaveGroupConfirmDialog_other=¿Estás seguro de que quieres quitar a {{username}} de los {{count}} grupos seleccionados?
+leaveGroupConfirmDialog_other=¿Está seguro de que quiere quitar a {{username}} de los {{count}} grupos seleccionados?
 createTokenHelp=Un token de acceso inicial solo se puede usar para crear clientes.
 removeImportedUsersError=No se pudieron eliminar los usuarios importados: '{{error}}'
 eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=Error de código de dispositivo OAuth2 al token
-typeHelp=Alcances de cliente, que se agregarán como alcances predeterminados a cada cliente creado.
+typeHelp=Los client scopes que se agregarán como ámbitos predeterminados a cada cliente creado.
 linkedIdPs=Proveedores de identidad vinculados
 htmlDisplayName=Nombre de visualización HTML
 groupObjectClasses=Clases de objeto de grupo
 requiredActionPlaceholder=Seleccionar acción
 bindCredentials=Credenciales de enlace
 logoutSettings=Configuración de cierre de sesión
-validateServerPrincipal=Debes ingresar un nombre de servidor principal
+validateServerPrincipal=Debe ingresar un nombre de servidor principal
 addMessageBundle=Añadir paquete de mensajes
 realmName=Nombre del realm
 searchEventType=Buscar tipo de evento guardado
-idpInitiatedSsoRelayStateHelp=Estado de retransmisión que deseas enviar con la solicitud SAML cuando quieras hacer SSO iniciado por IDP.
-otpHashAlgorithmHelp=Qué algoritmo de hash se debe utilizar para generar el OTP.
+idpInitiatedSsoRelayStateHelp=Estado de retransmisión que desea enviar con la solicitud SAML cuando quiera hacer SSO iniciado por IDP.
+otpHashAlgorithmHelp=Algoritmo de hash utilizado para generar el OTP
 joinGroup=Unirse a grupo
 eventTypes.REMOVE_TOTP_ERROR.description=Error al eliminar TOTP
 eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Error de token de acción de ejecución
-unlinkAccountConfirm=¿Estás seguro de que quieres desvincular permanentemente esta cuenta de {{provider}}?
+unlinkAccountConfirm=¿Está seguro de que quiere desvincular permanentemente esta cuenta de {{provider}}?
 x509CertificateHelp=Certificado X509 codificado en formato PEM
 samlEndpointsLabel=Metadatos del proveedor de servicios SAML 2.0
 passCurrentLocaleHelp=Pasar la configuración regional actual al proveedor de identidad como un parámetro ui_locales.
@@ -404,14 +401,14 @@ lessThan=Debe ser menor que {{value}}
 webAuthnPolicyRequireResidentKeyHelp=Indica a un autenticador que cree una credencial de clave pública como Resident Key o no.
 logoutServiceRedirectBindingURL=URL de redirección del enlace de cierre de sesión
 createIdentityProviderSuccess=Proveedor de identidad creado con éxito
-emptyMappersInstructions=Si deseas agregar mapeadores, haz clic en el botón de abajo para agregar algunos mapeadores predefinidos o configurar un nuevo mapeador.
+emptyMappersInstructions=Si desea agregar mapeadores, haga clic en el botón de abajo para agregar algunos mapeadores predefinidos o configurar un nuevo mapeador.
 dayMonth=Día
 clientRolesHelp=La condición verifica si uno de los roles de cliente especificados existe en el cliente para determinar si se aplica la política. Esta condición permite, de manera efectiva, que el administrador del cliente cree un rol de cliente con un nombre especificado en el cliente para garantizar que una política específica del cliente se aplique a las solicitudes de dicho cliente. La condición se verifica durante la mayoría de las solicitudes de OpenID Connect (solicitudes de autorización, solicitudes de tokens, solicitudes al punto final de introspección, entre otras).
 validatingX509Certs=Validando certificados X509
 eventTypes.CLIENT_UPDATE.description=Actualización de cliente
 searchInitialAccessToken=Buscar token
 guiOrder=Orden de visualización
-friendlyName=Nombre amigable del atributo a buscar en la afirmación. Puedes dejar esto en blanco y especificar un nombre en su lugar.
+friendlyName=Nombre amigable del atributo a buscar en la afirmación. Puede dejar esto en blanco y especificar un nombre en su lugar.
 testSuccess=Conexión exitosa a LDAP
 userInfoUrl=URL de información de usuario
 displayOnConsentScreen=Mostrar en la pantalla de consentimiento
@@ -433,8 +430,8 @@ serviceAccountHelp=Permite autenticar este cliente ante Keycloak y recuperar un
 urisHelp=Conjunto de URIs protegidas por recurso.
 eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Respuesta del proveedor de identidad
 confirmClientSecretTitle=¿Regenerar secreto para este cliente?
-serverPrincipal=Principal del servidor
-deleteConfirmGroup_one=¿Estás seguro de que quieres eliminar este grupo '{{groupName}}'.
+serverPrincipal=Servidor principal
+deleteConfirmGroup_one=¿Está seguro de que quiere eliminar este grupo '{{groupName}}'.
 signDocuments=Firmar documentos
 noTokens=Sin tokens de acceso inicial
 addMapper=Agregar mapeador
@@ -449,30 +446,30 @@ otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticat
 ldapMappersList=Mapeadores LDAP
 bindDnHelp=DN del administrador LDAP, que será utilizado por Keycloak para acceder al servidor LDAP
 newClientProfileName=Nombre del perfil de cliente
-eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=Error de código de dispositivo OAuth2 al token
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=rror al convertir el código de dispositivo OAuth2 en un token
 eventTypes.TOKEN_EXCHANGE.description=Intercambio de token
 continue=Continuar
 editProvider=Editar proveedor
-included.client.audience.label=Público objetivo del cliente incluido
+included.client.audience.label=Audiencia de cliente incluida
 backchannelLogoutUrlHelp=URL que hará que el cliente cierre sesión cuando se envíe una solicitud de cierre de sesión a este realm (a través de end_session_endpoint). Si se omite, no se enviará ninguna solicitud de cierre de sesión al cliente en este caso.
 updateScopeSuccess=Ámbito de autorización actualizado con éxito
-userInfoResponseEncryptionKeyManagementAlgorithmHelp=Algoritmo JWA utilizado para la gestión de claves en la encriptación de respuestas de punto final de información de usuario. Esta opción es necesaria si deseas respuestas de punto final de información de usuario encriptadas. Si se deja en blanco, las respuestas de punto final de información de usuario no se encriptan.
+userInfoResponseEncryptionKeyManagementAlgorithmHelp=Algoritmo JWA utilizado para la gestión de claves en el cifrado de las respuestas del User Info Endpoint. Esta opción es necesaria si desea respuestas cifradas del User Info Endpoint. Si se deja vacío, las respuestas del User Info Endpoint no se cifran.
 authnContextDeclRefsHelp=Lista ordenada de AuthnContext DeclRefs solicitados.
 inherent=Hereditario
 tableTitle=Grupos de atributos
-generateNewKeys=Generar nuevas claves
+generateNewKeys=Generar claves RSA
 updateClientPolicySuccess=Política de cliente actualizada
 unlock=Desbloquear
-validateRealm=Debes ingresar un realm
+validateRealm=Debe ingresar un realm
 attributeValue=Valor del atributo
 eventTypes.CLIENT_DELETE_ERROR.description=Error al eliminar cliente
-clientScopesHelp=Utiliza los alcances solicitados o asignados de antemano al cliente para determinar si se aplica la política a este cliente. La condición se evalúa durante la solicitud de autorización OpenID Connect y/o la solicitud de token.
+clientScopesHelp=Utiliza los scopes solicitados o asignados previamente al cliente para determinar si la política se aplica a este cliente. La condición se evalúa durante la solicitud de autorización OpenID Connect y/o la solicitud de token.
 revokeRefreshToken=Revocar el token de actualización
 mappingUpdatedSuccess=Mapeo actualizado con éxito
 logoUrlHelp=URL que hace referencia a un logotipo para la aplicación del cliente
 operationTypes=Tipos de operación
 loginWithEmailAllowed=Inicio de sesión con correo electrónico
-expireTime=Hora de expiración
+expireTime=Tiempo de expiración
 requestObject.request\ or\ request_uri=Solicitud o URI de solicitud
 policyProvider.user=Define condiciones para tus permisos donde se permite que un conjunto de uno o más usuarios accedan a un objeto.
 protocolTypes.openid-connect=OpenID Connect
@@ -485,7 +482,7 @@ hideOnLoginPageHelp=Si está oculto, el inicio de sesión con este proveedor sol
 eventTypes.UPDATE_PROFILE.description=Actualizar perfil
 assignRolesTo=Asignar roles a {{client}}
 orderChangeError=No se pudo cambiar el orden de visualización de proveedores de identidad {{error}}
-policyProvider.client-scope=Define condiciones para tus permisos donde se permite que un conjunto de uno o más alcances de cliente accedan a un objeto.
+policyProvider.client-scope=Define condiciones para sus permisos donde se permite a uno o más client scopes acceder a un objeto.
 secretExpiresOn=El secreto expira el {{time}}
 searchClientByName=Buscar cliente por nombre
 loginTimeout=Tiempo de espera de inicio de sesión
@@ -504,11 +501,10 @@ showRemaining=Mostrar ${remaining}
 searchProfile=Buscar perfil
 eventTypes.UPDATE_EMAIL_ERROR.name=Error al actualizar el correo electrónico
 removeConfirm_other=¿Está seguro de que desea eliminar estos grupos?
-renameGroup=Renombrar grupo
 configure=Configurar
 searchScopeHelp=Para un nivel, la búsqueda se aplica solo a los usuarios en los DN especificados por DN de usuario. Para subárbol, la búsqueda se aplica a todo el subárbol. Consulta la documentación LDAP para obtener más detalles.
 jumpToSection=Ir a la sección
-noUsersEmptyStateDescription=Solo los usuarios con este rol asignado directamente aparecerán en esta pestaña. Si necesitas encontrar usuarios asignados a este rol, ve a
+noUsersEmptyStateDescription=Solo los usuarios con este rol asignado directamente aparecerán en esta pestaña. Si necesita encontrar usuarios asignados a este rol, vaya a
 manage=Gestionar
 searchForSession=Buscar sesión
 temporaryLockedHelp=El usuario puede estar bloqueado debido a varios intentos fallidos de inicio de sesión.
@@ -516,7 +512,7 @@ kerberosIntegration=Integración de Kerberos
 useEntityDescriptorHelp=Importar metadatos de un descriptor de entidad SAML de un proveedor remoto.
 decisionStrategies.CONSENSUS=Consenso
 saveProviderSuccess=El proveedor se ha guardado correctamente.
-dedicatedScopes=Alcances dedicados
+dedicatedScopes=Scopes dedicados
 noSessionsDescription=Actualmente no hay sesiones activas en este realm.
 createGroupText=Crear grupo de atributos
 otpPolicyCodeReusable=Token reutilizable
@@ -534,11 +530,11 @@ required=Campo obligatorio
 linkedIdPsText=Los proveedores de identidad que ya están vinculados a esta cuenta de usuario
 lastUpdated=Última actualización
 credentialResetBtn=Restablecimiento de credenciales
-socialProfileJSONFieldPathHelp=Ruta del campo en los datos JSON del perfil de usuario del proveedor social para obtener el valor. Puedes utilizar la notación de punto para anidación y corchetes cuadrados para el índice de matriz. Por ejemplo, 'contact.address[0].country'.
-userModelAttributeHelp=Nombre de la propiedad o atributo UserModel en el que deseas mapear el atributo LDAP. Por ejemplo, 'firstName', 'lastName', 'email', 'street', etc.
+socialProfileJSONFieldPathHelp=Ruta del campo en los datos JSON del perfil de usuario del proveedor social para obtener el valor. Puede utilizar la notación de punto para anidación y corchetes cuadrados para el índice de matriz. Por ejemplo, 'contact.address[0].country'.
+userModelAttributeHelp=Nombre de la propiedad o atributo UserModel en el que desea mapear el atributo LDAP. Por ejemplo, 'firstName', 'lastName', 'email', 'street', etc.
 userList=Lista de usuarios
 eventTypes.RESET_PASSWORD.name=Error al restablecer la contraseña
-exportWarningDescription=Si hay una gran cantidad de grupos, roles o clientes en tu realm, la operación puede hacer que el servidor no responda durante un tiempo.
+exportWarningDescription=Si su realm incluye muchos grupos, roles o clientes, la operación podría hacer que el servidor no responda durante un tiempo.
 importRole=Importar rol
 deleteClientProfileConfirm=Esta acción eliminará permanentemente el perfil {{profileName}}. Esto no se puede deshacer.
 signServiceProviderMetadataHelp=Habilitar/deshabilitar la firma de los metadatos SAML del proveedor.
@@ -546,18 +542,18 @@ oAuthMutual=Tokens de acceso vinculados a certificados de mutuo TLS OAuth 2.0 ha
 keystore=Almacén de claves
 eventTypes.EXECUTE_ACTION_TOKEN.description=Token de acción ejecutado
 eventTypes.CLIENT_INFO.description=Información del cliente
-updateClientProfilesError=El JSON proporcionado es incorrecto: Token inesperado { en JSON
+updateClientProfilesError=No se pudieron actualizar los perfiles del cliente: {{error}}
 canonicalizationHelp=Método de canonización para firmas XML.
 authorizationHelp=Habilitar/Deshabilitar soporte de autorización detallada para un cliente.
 sessions=Sesiones
 mapperCreateSuccess=Mapeador creado con éxito.
 fullSyncPeriodHelp=Periodo para sincronización completa en segundos
 resourceTypeHelp=Especifica que este permiso debe aplicarse a todas las instancias de recurso de un tipo dado.
-encryptionAlgorithmHelp=Algoritmo de encriptación utilizado por el proveedor de identidad SAML para la encriptación de documentos, afirmaciones o IDs SAML. La clave de desencriptación correspondiente para desencriptar partes del documento SAML se elegirá en función de este algoritmo configurado y debe estar disponible en las claves del realm para el uso de encriptación (ENC). Si el algoritmo no está configurado, se permite cualquier algoritmo admitido y la clave de desencriptación se elegirá en función del algoritmo configurado en el documento SAML en sí.
+encryptionAlgorithmHelp=Algoritmo de cifrado utilizado por el IDP SAML para el cifrado de documentos SAML, aserciones o IDs. La clave de descifrado correspondiente, utilizada para descifrar partes de documentos SAML, se elige según este algoritmo configurado y debe estar disponible en las claves del realm para el uso de cifrado (ENC). Si no se configura ningún algoritmo, se permite cualquier algoritmo compatible y la clave de descifrado se elige en función del algoritmo configurado en el documento SAML.
 socialUserAttributeName=Nombre de atributo de usuario para almacenar información.
 priority=Prioridad
 jsonType.label=Tipo JSON de reclamación
-fullScopeAllowed=Se permite el alcance completo
+fullScopeAllowed=Se permite el scope completo
 syncModes.inherit=Heredar
 masterSamlProcessingUrlHelp=Si está configurada, esta URL se utilizará para cada enlace tanto para el Consumidor de Aserciones del SP como para los Servicios de Cierre de Sesión Únicos. Esto se puede anular individualmente para cada enlace y servicio en la Configuración de Punto Final SAML de Grano Fino.
 addedGroupMembershipError=Error al agregar la membresía del grupo: {{error}}
@@ -581,14 +577,14 @@ eventTypes.IDENTITY_PROVIDER_RESPONSE.description=Respuesta del proveedor de ide
 shouldBeANumber=Debe ser un número
 validatorDialogColNames.colDescription=Descripción
 requestObjectEncoding=Algoritmo de encriptación de contenido del objeto de solicitud
-idTokenEncryptionKeyManagementAlgorithmHelp=Algoritmo JWA utilizado para la gestión de claves en la encriptación de tokens de ID. Esta opción es necesaria si deseas tokens de ID encriptados. Si se deja vacío, los tokens de ID solo están firmados, pero no encriptados.
+idTokenEncryptionKeyManagementAlgorithmHelp=Algoritmo JWA utilizado para la gestión de claves en la encriptación de tokens de ID. Esta opción es necesaria si desea tokens de ID encriptados. Si se deja vacío, los tokens de ID solo están firmados, pero no encriptados.
 idpInitiatedSsoUrlNameHelp=Nombre del fragmento de URL para referenciar el cliente cuando quieras realizar una SSO iniciada por el IDP. Dejar esto vacío deshabilitará la SSO iniciada por el IDP. La URL a la que te referirás desde tu navegador será: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}.
 keyPassword=Contraseña de la clave
 attributeFriendlyName=Nombre amigable del atributo
 clearAllFilters=Borrar todos los filtros
 scopePermissions.clients.map-roles-composite-description=Políticas que deciden si un administrador puede aplicar roles definidos por este cliente como un compuesto a otro rol
 roleObjectClassesHelp=Clase de objeto (o clases) del objeto de rol. Se divide por comas si se necesitan más clases. En la implementación LDAP típica, podría ser 'groupOfNames'. En Active Directory suele ser 'group'.
-emptyAddClientScopes=Sin alcances de cliente
+emptyAddClientScopes=No hay client scopes
 changeTypeTo=Cambiar tipo a
 generateKeys=¿Generar claves?
 searchForUser=Buscar usuario
@@ -596,21 +592,21 @@ groupRemove_one=Grupo eliminado
 savePasswordError=Error al guardar la contraseña: {{error}}
 allGroups=Todos los grupos
 deleteNode=¿Eliminar nodo?
-rdnLdapAttributeHelp=Nombre del atributo LDAP que se utiliza como RDN (atributo superior) del DN de usuario típico. Por lo general, es igual que el atributo de Nombre de usuario LDAP, sin embargo, no es obligatorio. Por ejemplo, para Active Directory, es común usar 'cn' como atributo RDN cuando el atributo de nombre de usuario puede ser 'sAMAccountName'.
+rdnLdapAttributeHelp=Nombre del atributo LDAP utilizado como RDN (atributo superior) de un DN típico de usuario. Normalmente es el mismo atributo que el atributo de nombre de usuario en LDAP; sin embargo, no es obligatorio. Por ejemplo, en Active Directory, es común usar 'cn' como atributo RDN cuando el atributo de nombre de usuario podría ser 'sAMAccountName'.
 addAaguids=Agregar AAGUID
 createPolicy=Crear política de cliente
-disablePolicyConfirm=Los usuarios y clientes no pueden acceder a la política si está deshabilitada. ¿Estás seguro de que quieres continuar?
+disablePolicyConfirm=Los usuarios y clientes no pueden acceder a la política si está deshabilitada. ¿Está seguro que quiere continuar?
 useDiscoveryEndpoint=Usar punto de descubrimiento
 clearAdminEvents=Borrar eventos de administrador
 eventTypes.CLIENT_DELETE.name=Eliminar cliente
 clientLoginTimeout=Tiempo de espera de inicio de sesión del cliente
 mapperSaveSuccess=Mapeador guardado con éxito.
-noRolesAssociatedInstructions=Para agregar roles a este rol, presiona el botón 'Agregar rol'
+noRolesAssociatedInstructions=Para agregar roles a este rol, haga click en 'Agregar rol'.
 alwaysDisplayInUIHelp=Listar siempre este cliente en la IU de la cuenta, incluso si el usuario no tiene una sesión activa.
 eventTypes.UPDATE_PASSWORD.name=Actualizar contraseña
 eventTypes.UPDATE_CONSENT.description=Actualizar consentimiento
-realmSaveSuccess=Reino actualizado correctamente
-executorTypeTextHelpText=Tipo de texto de ayuda del tipo de ejecutor
+realmSaveSuccess=Realm actualizado correctamente
+executorTypeTextHelpText=Texto de ayuda para el tipo de ejecutor
 eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Error de inicio de sesión del proveedor de identidad
 readTimeout=Tiempo de espera de lectura
 userInfoResponseEncryptionContentEncryptionAlgorithmHelp=Algoritmo JWA utilizado para la encriptación de contenido en las respuestas del punto de conexión de Información del Usuario. Si se especifica un algoritmo de gestión de clave de encriptación de respuesta de información del usuario, el valor predeterminado para este valor es A128CBC-HS256.
@@ -618,24 +614,24 @@ accessTokenSignatureAlgorithm=Algoritmo de firma del token de acceso
 createUser=Crear usuario
 logoutAllDescription=Si cierras todas las sesiones activas, los sujetos activos en este realm serán cerrados.
 credentialResetEmailError=Fallo: {{error}}
-flow-type.form-flow=Flujo de formulario
+flow-type.form-flow=Formulario
 useKerberosForPasswordAuthenticationHelp=Módulo de inicio de sesión de usuario de Kerberos para autenticar nombre de usuario/contraseña contra el servidor Kerberos en lugar de autenticar contra el servidor LDAP con API de Directorio de Servicio.
 guiOrderHelp=Especificar el orden del proveedor en la interfaz gráfica (como en la página de Consentimiento) como entero.
 signDocumentsHelp=¿Deben firmarse los documentos SAML por el realm?
 resetPassword=Restablecer contraseña
 requireSslHelp=¿Se requiere HTTPS? 'Ninguno' significa que no se requiere HTTPS para ninguna dirección IP de cliente. 'Solicitudes externas' significa que localhost y las direcciones IP privadas pueden acceder sin HTTPS. 'Todas las solicitudes' significa que se requiere HTTPS para todas las direcciones IP.
 policyDeletedSuccess=Política eliminada correctamente
-manageServiceAccountUser=Para administrar detalles y mapeos de grupos, haz clic en el nombre de usuario <1>{{link}}</1>
+manageServiceAccountUser=Para administrar detalles y mapeos de grupos, haga clic en el nombre de usuario <1>{{link}}</1>
 addClientProfileSuccess=Nuevo perfil de cliente agregado
 helpDisabled=Ayuda desactivada
 deleteResource=¿Eliminar recurso permanentemente?
-validRequestURIsHelp=Lista de URIs válidos que se pueden utilizar como valores del parámetro 'request_uri' durante la solicitud de autenticación OpenID Connect. Hay soporte para las mismas capacidades que para los URI de redirección válidos. Por ejemplo, comodines o rutas relativas.
-emptyAddClientScopesInstructions=No quedan alcances de cliente para agregar
-changeTypeIntro={{count}} alcances de cliente seleccionados se cambiarán a
+validRequestURIsHelp=Lista de URI válidos que se pueden usar como valores del parámetro 'request_uri' durante una solicitud de autenticación OpenID Connect. No se admite la misma funcionalidad que para las URI de redirección válidas, como comodines o rutas relativas.
+emptyAddClientScopesInstructions=No quedan client scopes para agregar
+changeTypeIntro={{count}} client scopes seleccionados se cambiarán a
 secretSizeHelp=Tamaño en bytes para el secreto generado
 clientSecret=Secreto del cliente
 inputType=Tipo de entrada
-claimHelp=Nombre del claim a buscar en el token. Puedes referenciar claims anidados utilizando un '.', por ejemplo, 'address.locality'. Para usar un punto (.) literalmente, escápalo con una barra invertida (\\.).
+claimHelp=Nombre del claim a buscar en el token. Puede referenciar claims anidados utilizando un '.', por ejemplo, 'address.locality'. Para usar un punto (.) literalmente, escápelo con una barra invertida (\\.).
 regexClaimValues=Valores de reclamo de expresión regular
 iconUri=URI del ícono
 allowed-protocol-mappers.label=Mapeadores de protocolo permitidos
@@ -650,7 +646,7 @@ created=Creado
 minutes=Minutos
 displayOnClient=Mostrar cliente en pantalla
 certSubject=ASUNTO_CERT
-userCredentialsHelpText=Los manejadores de nivel superior te permiten cambiar la prioridad de la credencial para el usuario, siendo la credencial superior la de mayor prioridad. Los manejadores dentro de un panel expandible te permiten cambiar el orden visual de las credenciales, siendo la credencial superior la que se muestra más a la izquierda.
+userCredentialsHelpText=Los manejadores de nivel superior le permiten cambiar la prioridad de la credencial para el usuario, siendo la credencial superior la de mayor prioridad. Los manejadores dentro de un panel expandible le permiten cambiar el orden visual de las credenciales, siendo la credencial superior la que se muestra más a la izquierda.
 ldapAdvancedSettingsDescription=Esta sección contiene todas las otras opciones para una configuración más detallada del proveedor de almacenamiento LDAP.
 usersDN=DN de usuarios
 secretSize=Tamaño del secreto
@@ -666,7 +662,7 @@ oidcAttributeImporter=Importar reclamo declarado si existe en el ID, token de ac
 requestObject.request\ only=Solo solicitud
 waitIncrementSeconds=Incremento de espera
 requiredForLabel.admins=Solo administradores
-clientScopeSuccess=Mapeo de alcance actualizado
+clientScopeSuccess=Asignación de scopes actualizada
 clientPolicySearch=Buscar política de cliente
 refreshTokens=Actualizar Tokens
 eventTypes.UPDATE_EMAIL_ERROR.description=Error al actualizar el correo electrónico
@@ -683,7 +679,7 @@ anyAlgorithm=Cualquier algoritmo
 enableSSL=Habilitar SSL
 general=General
 failureFactor=Fallos máximos de inicio de sesión
-updateClientPoliciesSuccess=La configuración de las políticas del cliente se actualizó
+updateClientPoliciesSuccess=La configuración de las políticas del cliente se actualizaron
 advancedSettings=Configuraciones avanzadas
 attributeValueHelp=Valor que debe tener el atributo. Si el atributo es una lista, entonces el valor debe estar contenido en la lista.
 eventTypes.FEDERATED_IDENTITY_LINK.description=Enlace de identidad federada
@@ -697,7 +693,7 @@ introduction=Si desea salir de esta página y administrar este realm, haga clic
 clearUserEvents=Borrar eventos de usuario
 descriptionHelp=Texto de ayuda para la descripción del nuevo flujo
 addCustomProvider=Agregar proveedor personalizado
-permissionType=Especifica que esta permisión debe aplicarse a todas las instancias de recursos de un tipo dado.
+permissionType=Especifica que este permiso debe aplicarse a todas las instancias de recursos de un tipo determinado.
 policyEnforcementModes.ENFORCING=Aplicación forzosa
 rowSaveBtnAriaLabel=Guardar ediciones para {{messageBundle}}
 permanentLockout=Bloqueo permanente
@@ -707,7 +703,7 @@ unlockUsersConfirm=Todos los usuarios que están bloqueados temporalmente se des
 clear=Borrar
 idpType.custom=Personalizado
 eventTypes.LOGOUT.name=Cerrar sesión
-deletedErrorClientScope=No se pudo eliminar el alcance del cliente: {{error}}
+deletedErrorClientScope=No se pudo eliminar el client scope: {{error}}
 groupsClaim=Reclamo de grupos
 roleMappingUpdatedError=No se pudo actualizar el mapeo de roles {{error}}
 client-updater-source-groups.label=Grupos
@@ -721,7 +717,7 @@ kc.identity.authc.method=Método de autenticación
 regexAttributeValues=Valores de atributos de expresión regular
 otpTypeHelp=totp es Contraseña de un solo uso basada en el tiempo. 'hotp' es una contraseña de un solo uso basada en el contador en la que el servidor mantiene un contador para hashear en contra.
 setAsDefaultAction=Establecer como acción predeterminada
-keyForCodeExchange=Método de desafío de código de intercambio de clave de prueba
+keyForCodeExchange=Método PKCE
 clientProfiles=Perfiles de cliente
 endpointsHelp=Muestra la configuración del endpoint del proveedor de servicios.
 mapperTypeLdapAttributeMapper=mapeador de atributos LDAP codificado
@@ -729,7 +725,7 @@ unlockAllUsers=Desbloquear todos los usuarios
 noGroupsText=No has añadido a este usuario a ningún grupo. Únete a un grupo para comenzar.
 createClientPolicyError=No se pudo crear la política debido a: {{error}}
 eventTypes.EXECUTE_ACTIONS_ERROR.name=Error al ejecutar acciones
-path=Ruta.
+path=Ruta
 overwritten=Sobrescrito
 mapperNameHelp=Nombre del mapeador
 deleteProviderError=Error al eliminar el proveedor: {{error}}
@@ -747,11 +743,11 @@ unspecified=No especificado
 deleteMappingTitle=¿Eliminar mapeo?
 profile=Perfil
 active=Activo
-generateKeysDescription=Si generas nuevas claves, puedes descargar el almacén de claves con la clave privada automáticamente y guardarlo en el lado de tu cliente. El servidor Keycloak solo guardará el certificado y la clave pública, pero no la clave privada.
+generateKeysDescription=Si genera nuevas claves, puede descargar el almacén de claves con la clave privada automáticamente y guardarlo en el lado de su cliente. El servidor Keycloak solo guardará el certificado y la clave pública, pero no la clave privada.
 addSubFlowTitle=Agregar un sub-flujo
-useTruststoreSpiHelp=Especifica si la conexión LDAP usará el SPI de Truststore con el truststore configurado en las opciones de línea de comandos. 'Always' significa que siempre lo usará. 'Never' significa que no lo usará. Ten en cuenta que incluso si el truststore de Keycloak no está configurado, se usará el cacerts de java por defecto o el certificado especificado por la propiedad 'javax.net.ssl.trustStore'.
+useTruststoreSpiHelp=Especifica si la conexión LDAP usará el SPI de Truststore con el truststore configurado en las opciones de línea de comandos. 'Always' significa que siempre lo usará. 'Never' significa que no lo usará. Tenga en cuenta que incluso si el truststore de Keycloak no está configurado, se usará el cacerts de java por defecto o el certificado especificado por la propiedad 'javax.net.ssl.trustStore'.
 forcePostBindingHelp=Siempre usar el enlace POST para las respuestas.
-executorName=Nombre.
+executorName=Nombre
 VERIFY_EMAIL=Verificar correo electrónico (VERIFY_EMAIL)
 realmCertificateAlias=Alias de certificado de realm
 roleName=Nombre de rol
@@ -759,46 +755,46 @@ addOrigins=Añadir origen
 evictionDayHelp=Día de la semana en que la entrada se volverá inválida.
 actionTokens=Tokens de acción
 permissionResources=Especifica que esta permisión debe aplicarse a una instancia de recurso específica.
-testConnectionHint.withoutEmail=Para probar la conexión, primero debes configurar una dirección de correo electrónico para el usuario actual ({{userName}}).
+testConnectionHint.withoutEmail=Para probar la conexión, primero debe configurar una dirección de correo electrónico para el usuario actual ({{userName}}).
 includeOneTimeUseConditionHelp=¿Debería incluirse una condición de Uso Único en las respuestas de inicio de sesión?
-availableIdPsText=Todos los proveedores de identidad configurados en este realm se listan aquí. Puedes vincular la cuenta de usuario a cualquiera de las cuentas de IdP.
+availableIdPsText=Todos los proveedores de identidad configurados en este realm se listan aquí. Puede vincular la cuenta de usuario a cualquiera de las cuentas de IdP.
 accessTokenLifespanHelp=Tiempo máximo antes de que caduque un token de acceso. Se recomienda que este valor sea corto en relación con el tiempo de espera de SSO.
 editableRowsTable=Tabla de filas editables
 redirectURIHelp=La URI de redirección a utilizar al configurar el proveedor de identidad.
 permissionsEnabled=Permisos habilitados
 saveRealmError=No se pudo crear el realm {{error}}
 attestationPreference.none=Ninguno.
-pairwiseSubAlgorithmSalt.label=Sal.
+pairwiseSubAlgorithmSalt.label=Salt
 addGroupsToGroupPolicy=Agregar grupos a la política de grupos
-deniedScopes=Alcances denegados
+deniedScopes=Scopes denegados
 updateClientProfilesSuccess=La configuración de los perfiles de cliente se actualizó
 flow.docker\ auth=Flujo de autenticación de Docker
 useEntityDescriptor=Usar descriptor de entidad
 loginActionTimeout=Tiempo de espera de acción de inicio de sesión
 windowsDomainQN=Nombre cualificado de dominio de Windows
 deleteClientError=No se pudo eliminar el perfil: {{error}}
-validRedirectURIs=Patrón URI válido al que un navegador puede redirigir después de un inicio de sesión exitoso. Se permiten comodines simples como 'http://ejemplo.com/'. También se pueden especificar rutas relativas como /mi/ruta/relativa/. Las rutas relativas son relativas a la URL raíz del cliente, o si no se especifica ninguna, se usa la URL raíz del servidor de autenticación. Para SAML, debes establecer patrones URI válidos si te estás basando en la URL del servicio consumidor incrustada en la solicitud de inicio de sesión.
+validRedirectURIs=Patrón de URI válido al que un navegador puede redirigir después de un inicio de sesión exitoso. Se permiten comodines simples como 'http://example.com/'. También puede usar una ruta relativa, como /mi/ruta/relativa/. Las rutas relativas son relativas a la URL raíz del cliente; si no se especifica esa URL, se usa la URL raíz del servidor de autenticación. Para SAML, configure patrones de URI válidos si depende de la URL del servicio consumidor incrustada en la solicitud de inicio de sesión.
 UPDATE_PROFILE=Actualizar perfil (UPDATE_PROFILE)
 assertionConsumerServicePostBindingURL=URL de enlace POST del Servicio de Consumidor de Afirmaciones
 removeImported=Eliminar importado
-endpoints=Puntos finales
+endpoints=Endpoints
 roleSaveError=No se pudo guardar el rol: {{error}}
 keySize=Tamaño de la clave
-membershipUserLdapAttributeHelp=Se usa solo si el Tipo de Atributo de Membresía es UID. Es el nombre del atributo LDAP en el usuario, que se utiliza para las asignaciones de membresía. Normalmente será 'uid'. Por ejemplo, si el valor de 'Atributo LDAP de Usuario de Membresía' es 'uid' y el grupo LDAP tiene 'memberUid: john', se espera que ese usuario LDAP en particular tenga el atributo 'uid: john'.
-validatingX509CertsHelp=El certificado en formato PEM que debe usarse para verificar las firmas. Se pueden ingresar múltiples certificados, separados por comas (,).
+membershipUserLdapAttributeHelp=Utilizado solo si el tipo de atributo de membresía es UID. Es el nombre del atributo LDAP del usuario que se utiliza para los mapeos de membresía. Normalmente es 'uid'. Por ejemplo, si el valor del 'Atributo de Usuario para Membresía en LDAP' es 'uid' y el grupo LDAP tiene 'memberUid: john', se espera que el usuario LDAP correspondiente tenga el atributo 'uid: john'.
+validatingX509CertsHelp=Los certificados públicos utilizados por Keycloak para validar las firmas de solicitudes y respuestas SAML del IDP externo cuando la opción 'Usar URL del descriptor de metadatos' está desactivada. Se pueden ingresar varios certificados separados por comas (,). Puede volver a importar certificados desde la URL del descriptor de metadatos haciendo clic en la acción 'Importar claves' en la página del proveedor de identidad. Esta acción descarga los certificados actuales del endpoint de metadatos y los asigna a la configuración en esta misma opción. Haga clic en Guardar para almacenar definitivamente los certificados reimportados.
 samlCapabilityConfig=Configuraciones de capacidad SAML
 accessTokenSignatureAlgorithmHelp=Algoritmo JWA utilizado para firmar tokens de acceso.
 derFormatted=Formato DER
 periodicChangedUsersSyncHelp=Si se debe habilitar o no la sincronización periódica de usuarios LDAP modificados o creados recientemente en Keycloak.
 signatureAlgorithmHelp=El algoritmo de firma a usar para firmar documentos. Ten en cuenta que los algoritmos basados en 'SHA1' están obsoletos y pueden eliminarse en el futuro. Se recomienda usar un algoritmo más seguro en lugar de '*_SHA1'.
-allow-default-scopes.tooltip=Si está activado, los clientes recién registrados podrán tener alcances de cliente mencionados en los alcances de cliente predeterminados del realm o en los alcances de cliente opcionales del realm
+allow-default-scopes.tooltip=Si está activado, los clientes recién registrados podrán tener client scopes mencionados en los client scopes predeterminados del realm o en los client scopes opcionales del realm
 emailVerified=Correo electrónico verificado
 addExecutionHelp=La ejecución puede tener una amplia gama de acciones, desde enviar un correo electrónico de restablecimiento hasta validar un OTP.
 requestObjectRequiredHelp=Especifica si el cliente debe proporcionar un objeto de solicitud con sus solicitudes de autorización, y qué método pueden usar para esto. Si se establece en "no requerido", proporcionar un objeto de solicitud es opcional. En todos los demás casos, proporcionar un objeto de solicitud es obligatorio. Si se establece en "solicitud", el objeto de solicitud debe ser proporcionado por valor. Si se establece en "solicitud_uri", el objeto de solicitud debe ser proporcionado por referencia. Si se establece en "solicitud o solicitud_uri", se puede usar cualquiera de los métodos.
-clientScopesRolesScope=Si no se ha definido un mapeo de alcance de roles, a cada usuario se le permite utilizar este alcance de cliente. Si se han definido mapeos de alcance de roles, el usuario debe ser miembro de al menos uno de los roles.
+clientScopesRolesScope=Si no hay una asignación de ámbito de rol definida, cada usuario tiene permiso para usar este client scope. Si hay asignaciones de ámbito de rol definidas, el usuario debe ser miembro de al menos uno de los roles.
 passwordPoliciesHelp.notUsername=La contraseña no puede coincidir con el nombre de usuario.
 passwordPoliciesHelp.notContainsUsername=La contraseña no puede contener el nombre de usuario.
-removeConfirm_one=¿Estás seguro de que deseas eliminar este grupo?
+removeConfirm_one=¿Está seguro que desea eliminar este grupo?
 createUserProviderSuccess=Proveedor de federación de usuarios creado correctamente
 countHelp=Especifica cuántos clientes se pueden crear usando el token.
 mapperTypeHardcodedLdapGroupMapper=Mapeador de grupo LDAP codificado
@@ -815,7 +811,7 @@ consentRequired=Consentimiento requerido
 selectMethodType.import=Importar
 standardFlow=Flujo estándar
 votedToStatus=votado para {{status}}
-credentialResetConfirmText=¿Estás seguro de que deseas enviar un correo electrónico al usuario?
+credentialResetConfirmText=¿Está seguro de que desea enviar un correo electrónico al usuario?
 clientScopeType.default=Predeterminado
 helpFileUpload=Subir un archivo JSON
 addProvider_one=Agregar proveedor {{provider}}
@@ -827,12 +823,12 @@ flow.reset\ credentials=Flujo de restablecimiento de credenciales
 eventTypes.DELETE_ACCOUNT_ERROR.name=Error al eliminar cuenta
 eventTypes.CLIENT_DELETE_ERROR.name=Error al eliminar cliente
 noRolesInstructions-client=No has creado roles para este cliente. Crea un rol para comenzar.
-test=Prueba.
+test=Prueba
 leaveGroup_one=¿Salir del grupo {{name}}?
 count=Contar
-noPasswordPoliciesInstructions=No has agregado ninguna política de contraseñas a este realm. Agrega una política para comenzar.
+noPasswordPoliciesInstructions=No ha agregado ninguna política de contraseñas a este realm. Agregue una política para comenzar.
 testAuthentication=Probar autenticación
-groupNameLdapAttributeHelp=Nombre del atributo LDAP que se usa en objetos de grupo para el nombre y RDN del grupo. Normalmente será 'cn'. En este caso, un objeto de grupo/rol típico puede tener DN como 'cn=Grupo1,ouu=grupos,dc=ejemplo,dc=org'.
+groupNameLdapAttributeHelp=Nombre del atributo LDAP utilizado en objetos de grupo para el nombre y el RDN del grupo. Normalmente es 'cn'. En este caso, un objeto típico de grupo/rol puede tener un DN como 'cn=Group1,ou=groups,dc=example,dc=org'.
 deleteError=No se pudo eliminar el proveedor {{error}}
 attributeDisplayName=Nombre de visualización del atributo
 pkceEnabled=Usar PKCE
@@ -851,29 +847,29 @@ authorizationSignedResponseAlg=Algoritmo de firma de respuestas de autorización
 mapperTypeFullNameLdapMapperHelp=Se usa para asignar el nombre completo de un usuario desde un atributo único en LDAP (generalmente el atributo 'cn') a los atributos firstName y lastName de UserModel en la base de datos de Keycloak
 includeInUserInfo.label=Añadir a información de usuario
 onDragMove=Arrastrando el ítem {{item}}
-back=Atrás.
-deleteScopeConfirm=Si eliminas este alcance de autorización, algunas permisiones se verán afectadas.
+back=Atrás
+deleteScopeConfirm=Si elimina este scope de autorización, algunos permisos se verán afectados.
 updateOtpSuccess=Política OTP actualizada correctamente
 title=Autenticación
 deleteAttributeError=Atributo no eliminado: {{error}}
-enableClientSignatureRequiredExplain=Si habilitas "Firma del cliente requerida", el adaptador de este cliente se actualizará. Es posible que necesites descargar un nuevo adaptador para este cliente. Debes generar o importar claves para este cliente; de lo contrario, la autenticación no funcionará.
+enableClientSignatureRequiredExplain=Si habilita "Firma del cliente requerida", el adaptador de este cliente se actualizará. Es posible que necesite descargar un nuevo adaptador para este cliente. Debe generar o importar claves para este cliente; de lo contrario, la autenticación no funcionará.
 policiesConfigTypes.formView=Vista de formulario
-residentKey.No=No.
+residentKey.No=No
 nodeReRegistrationTimeout=Tiempo de espera de nuevo registro del nodo
 fineGrainSamlEndpointConfigHelp=Esta sección se utiliza para configurar URLs exactas para el Consumidor de Afirmaciones y el Servicio de Cierre de Sesión Única.
 connectionURL=URL de conexión
 validateCustomUserSearchFilter=El filtro debe estar entre paréntesis, por ejemplo: (filtro)
 accessTokenLifespan=Duración del token de acceso
 loginWithEmailHelpText=Permite a los usuarios iniciar sesión con su dirección de correo electrónico.
-eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Error de vinculación de proveedor de identidad
-deleteMessageBundleSuccess=Se eliminó correctamente el mensaje del paquete
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Vincular cuenta del proveedor de identidad
+deleteMessageBundleSuccess=Mensaje del paquete eliminado correctamente
 retry=Pulsa aquí para actualizar y continuar
 selectAttributes=Seleccionar atributos
 firstBrokerLoginFlowAliasOverrideHelp=Alias del flujo de autenticación, que se activa después del primer inicio de sesión con este proveedor de identidad. El término 'Primer inicio de sesión' significa que actualmente no hay ninguna cuenta de Keycloak vinculada a la cuenta de proveedor de identidad autenticada.
 owner=Propietario
 eventTypes.VERIFY_PROFILE.description=Verificar perfil
-executorAuthenticatorMultiSelectHelpText=Texto de ayuda del selector múltiple del autenticador del ejecutor
-eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Error de vínculo de identidad federada
+executorAuthenticatorMultiSelectHelpText=Texto de ayuda para el seleccionador múltiple del autenticador del ejecutor
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Error al vincular la identidad federada
 eventTypes.EXECUTE_ACTIONS.name=Ejecutar acciones
 encryptAssertions=Cifrar afirmaciones
 disableConfirmTitle=¿Deshabilitar realm?
@@ -883,13 +879,13 @@ addSamlProvider=Agregar proveedor SAML
 permission=Permiso
 saveEventListeners=Guardar oyentes de eventos
 capabilityConfig=Configuración de capacidades
-mapperTypeMsadUserAccountControlManagerHelp=Mapper específico para MSAD. Puede integrar el estado de la cuenta de usuario MSAD en el estado de la cuenta de Keycloak (cuenta habilitada, contraseña caducada, etc.). Utiliza userAccountControl y pwdLastSet de MSAD para eso. Por ejemplo, si pwdLastSet es 0, se solicita al usuario de Keycloak que actualice la contraseña; si userAccountControl es 514 (cuenta desactivada), el usuario de Keycloak también está desactivado, etc. El mapeador también puede manejar el código de excepción de la autenticación de usuario LDAP.
-home=Inicio.
+mapperTypeMsadUserAccountControlManagerHelp=Mapper específico de MSAD. Puede integrar el estado de la cuenta de usuario MSAD en el estado de la cuenta de Keycloak (cuenta habilitada, contraseña caducada, entre otros). Utiliza los atributos userAccountControl y pwdLastSet de MSAD para ese estado. Por ejemplo, si pwdLastSet es 0, se requiere que el usuario de Keycloak actualice su contraseña. En otro ejemplo, si userAccountControl es 514 (cuenta deshabilitada), el usuario de Keycloak también se deshabilita. El mapper también puede manejar el código de excepción de la autenticación de usuario LDAP.
+home=Inicio
 bindFlow=Flujo de enlace
 userAttributeValue=Valor del atributo de usuario
-browserFlowHelp=Selecciona el flujo que deseas usar para la autenticación del navegador.
+browserFlowHelp=Seleccione el flujo que desea usar para la autenticación del navegador.
 tokenLifespan.never=Nunca expira
-notFound=No se pudo encontrar el recurso que estás buscando
+notFound=No se pudo encontrar el recurso que está buscando
 passMaxAge=Edad máxima de la contraseña
 disablePolicyConfirmTitle=¿Desactivar política?
 eventTypes.LOGIN_ERROR.description=Error de inicio de sesión
@@ -902,7 +898,7 @@ emailVerification=Verificación de correo electrónico
 configSaveError=No se pudo guardar la configuración de ejecución: {{error}}
 clientAuthenticatorTypeHelp=Autenticador de cliente utilizado para la autenticación de este cliente contra el servidor Keycloak
 cachePolicyHelp=Política de caché para este proveedor de almacenamiento. 'DEFAULT' son las configuraciones predeterminadas para la caché global. 'EVICT_DAILY' es una hora del día en la que se invalidará la caché todos los días. 'EVICT_WEEKLY' es un día de la semana y una hora en la que se invalidará la caché. 'MAX_LIFESPAN' es el tiempo en milisegundos que será la duración de una entrada de caché.
-eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Error de acción requerida personalizada
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Error en la acción requerida personalizada
 eventTypes.SEND_RESET_PASSWORD.name=Enviar restablecimiento de contraseña
 requiredFor=Requerido para
 scopePermissions.users.map-roles-description=Políticas que deciden si el administrador puede asignar roles a todos los usuarios
@@ -916,7 +912,7 @@ shortVerificationUri=URI de verificación corta en el flujo de Autorización de
 placeholderText=Seleccionar uno
 deleteCredentialsError=Error al eliminar las credenciales de los usuarios: {{error}}
 authDefaultActionTooltip=Si está habilitado, cualquier nuevo usuario tendrá esta acción requerida asignada.
-validateBindCredentials=Debes ingresar la contraseña del administrador LDAP
+validateBindCredentials=Debe ingresar la contraseña del administrador LDAP
 evictionMinuteHelp=Minuto de la hora en el que la entrada se volverá inválida
 includeAuthnStatement=Incluir Declaración de Autenticación
 validatorType=Tipo de validador
@@ -940,9 +936,9 @@ enableLdapv3Password=Habilitar la operación de modificación de contraseña LDA
 status=Estado
 dragInstruction=Clic y arrastrar para cambiar la prioridad
 clients=Clientes
-clientName=Nombre.
+clientName=Nombre
 syncModes.force=Forzar
-deleteMappingConfirm=¿Estás seguro de que deseas eliminar este mapeo?
+deleteMappingConfirm=¿Está seguro de que desea eliminar este mapeo?
 createClientProfileSuccess=Perfil de cliente creado correctamente
 eventTypes.CLIENT_LOGIN_ERROR.description=Error de inicio de sesión del cliente
 explainBearerOnly=Este es un tipo OIDC especial. Este cliente solo permite solicitudes de token de portador y no puede participar en inicios de sesión de navegador.
@@ -951,10 +947,10 @@ allowCreate=Permitir crear
 providerUpdatedError=No se pudo actualizar la política de cliente debido a {{error}}
 usersAddedError=No se pudieron agregar usuarios al grupo: {{error}}
 orderChangeErrorUserFed=No se pudo cambiar el orden de prioridad de los proveedores de federación de usuarios {{error}}
-scopeParameterPlaceholder=Seleccionar parámetros de alcance
+scopeParameterPlaceholder=Seleccionar parámetros de scope
 deleteClientPolicyConfirmTitle=¿Eliminar política?
-validateRdnLdapAttribute=Debes ingresar un atributo RDN de LDAP
-policyUrlHelp=URL que el Cliente Relying Party proporciona al Usuario Final para leer sobre cómo se utilizarán los datos del perfil
+validateRdnLdapAttribute=Debe ingresar un atributo RDN de LDAP
+policyUrlHelp=URL que el Cliente Parte Dependiente proporciona al Usuario Final para informar cómo se utilizarán los datos del perfil
 fromDisplayName=Desde el nombre para mostrar
 affirmative=Afirmativo
 clientRoles=Roles de cliente
@@ -964,7 +960,7 @@ maxFailureWaitSecondsHelp=Tiempo máximo que un usuario estará bloqueado.
 groupsPath=Ruta de grupos
 useRealmRolesMapping=Usar mapeo de roles de realm
 identityProviderEntityId=ID del proveedor de identidad
-userInfoSignedResponseAlgorithm=Algoritmo de respuesta firmada de información de usuario
+userInfoSignedResponseAlgorithm=Algoritmo de firma para la respuesta de información del usuario
 selectGroup=Seleccionar grupo
 scopePermissions.groups.view-members-description=Políticas que deciden si un administrador puede ver los miembros de este grupo
 tableOfGroups=Tabla de grupos
@@ -981,26 +977,26 @@ webAuthnUpdateError=No se pudo actualizar las políticas de WebAuthn debido a {{
 paginationHelp=Si el servidor LDAP admite la paginación
 oAuthMutualHelp=Esto habilita el soporte para Tokens de Acceso de Certificados de Mutual TLS OAuth 2.0, lo que significa que Keycloak vincula un token de acceso y un token de actualización con un certificado X.509 de un cliente solicitante de token intercambiado en TLS mutuo entre el Endpoint de Token de Keycloak y este cliente. Estos tokens pueden tratarse como tokens de Holder-of-Key en lugar de tokens de portador.
 deleteProviderTitle=¿Eliminar proveedor de claves?
-scopes=Alcances
+scopes=Scopes
 accessTokens=Tokens de acceso
 columnName=Nombre.
 flowType=Tipo de flujo
 syncLDAPGroupsSuccessful=Datos sincronizados correctamente {{result}}
-policyEnforcementModes.PERMISSIVE=Permisible
+policyEnforcementModes.PERMISSIVE=Permisivo
 subject=DN de sujeto
-use=Usar.
-defaultAdminInitiated=Vida útil de acción requerida por administrador predeterminada
+use=Usar
+defaultAdminInitiated=Duración predeterminada de acciones iniciadas por el administrador
 chooseAMapperType=Elegir un tipo de mapeador
 startTimeHelp=Define la hora antes de la cual la política NO DEBE otorgarse. Solo se otorga si la fecha/hora actual es posterior o igual a este valor.
 noGroupsInThisRealm=No hay grupos en este realm
 searchUserByAttributeKeyAlreadyInUseError=La clave de atributo ya está en uso
 executorClientAuthenticator=Autenticador de cliente del ejecutor
 addWebOrigins=Agregar orígenes web
-clientScopeExplain=Los alcances de cliente son un conjunto común de mapeadores de protocolos y roles que se comparten entre múltiples clientes.
-attributeNameHelp=Nombre del atributo a buscar en la afirmación. Puedes dejar esto en blanco y especificar un nombre amigable en su lugar.
+clientScopeExplain=Los client scopes son un conjunto común de asignadores de protocolos y roles que se comparten entre múltiples clientes.
+attributeNameHelp=Nombre del atributo a buscar en la afirmación. Puede dejar esto en blanco y especificar un nombre amigable en su lugar.
 linkAccountTitle=Vincular cuenta a {{provider}}
-invalidateRotatedSuccess=Secreto rotado eliminado con éxito
-userSessionAttributeHelp=Nombre del atributo de sesión de usuario que deseas codificar por defecto
+invalidateRotatedSuccess=Se eliminó correctamente el secreto rotado
+userSessionAttributeHelp=Nombre del atributo de sesión de usuario que desea codificar por defecto
 updateSuccessIdentityProvider=Proveedor actualizado correctamente
 host=Anfitrión.
 forbidden_one=Prohibido, se necesita permiso:
@@ -1011,12 +1007,12 @@ kerberosPrincipal=Principal Kerberos
 resourceAttribute=Atributo de recurso
 addressClaim.region.label=Nombre del Atributo de Usuario para Región
 applyToResourceTypeFlagHelp=Indica si este permiso debe aplicarse a todos los recursos con un tipo dado. En este caso, este permiso se evaluará para todas las instancias de un tipo de recurso dado.
-managePriorityInfo=La prioridad es el orden de los proveedores al realizar una búsqueda de usuario. Puedes arrastrar los manipuladores de fila para cambiar las prioridades.
+managePriorityInfo=La prioridad es el orden de los proveedores al realizar una búsqueda de usuario. Puede arrastrar los manipuladores de fila para cambiar las prioridades.
 deletedErrorIdentityProvider=No se pudo eliminar el proveedor {{error}}
-included.custom.audience.tooltip=Esto se usa solo si 'Audiencia de cliente incluida' no está completada. El valor especificado se incluirá en el campo de audiencia (aud) del token. Si ya existen audiencias en el token, el valor especificado solo se agregará a ellas. No anulará las audiencias existentes.
+included.custom.audience.tooltip=Esto se utiliza solo si 'Audiencia del Cliente Incluida' está vacío. El valor especificado se incluye en el campo de audiencia (aud) del token. Si el token ya contiene audiencias, el valor especificado se añade a esas audiencias sin sobrescribirlas.
 includeInIdToken.label=Agregar al token de ID
 steps=Pasos
-tokenDeleteConfirm=¿Estás seguro de que deseas eliminar permanentemente el token de acceso inicial {{id}}?
+tokenDeleteConfirm=¿Está seguro de que desea eliminar permanentemente el token de acceso inicial {{id}}?
 flowCreateError=No se pudo crear el flujo: {{error}}
 readTimeoutHelp=Tiempo de espera de lectura LDAP en milisegundos. Este tiempo de espera se aplica para las operaciones de lectura LDAP.
 registrationAccessTokenHelp=El token de acceso al registro proporciona acceso para los clientes al servicio de registro de clientes.
@@ -1027,36 +1023,36 @@ canonicalization=Método de canonización
 deleteConfirmTitle=¿Eliminar realm?
 includeInAccessTokenResponse.label=Agregar a la respuesta del token de acceso
 SSOSessionMax=Sesión SSO máxima
-clientScope=Ámbito del cliente
+clientScope=Client scope
 inheritedFrom=Heredado de
 clientScopeSearch.name=Nombre
 deleteConditionSuccess=La condición ha sido eliminada
 clientProfile=Detalles del perfil del cliente
 syncAllUsers=Sincronizar todos los usuarios
 allowedClockSkewHelp=Desfase de reloj en segundos que se tolera al validar tokens del proveedor de identidad. El valor predeterminado es cero.
-disableConfirmIdentityProvider=¿Estás seguro de que deseas deshabilitar el proveedor '{{provider}}'?
+disableConfirmIdentityProvider=¿Está seguro de que desea deshabilitar el proveedor '{{provider}}'?
 clientSaveError=El cliente no pudo ser actualizado: {{error}}
 tokenSaveError=No se pudo crear el token de acceso inicial {{error}}
 certificate=Certificado
-deleteConfirmExecutionMessage=¿Estás seguro de que deseas eliminar permanentemente la ejecución "<1>{{name}}</1>"?.
+deleteConfirmExecutionMessage=¿Está seguro que desea eliminar permanentemente la ejecución "<1>{{name}}</1>"?.
 offlineSessionMaxLimitedHelp=Habilitar el tiempo de vida máximo de la sesión offline
 delete=Eliminar
 userGroupsRetrieveStrategyHelp=Especifica cómo recuperar los grupos del usuario. LOAD_GROUPS_BY_MEMBER_ATTRIBUTE significa que los roles del usuario se recuperarán enviando una consulta LDAP para recuperar todos los grupos donde 'member' es nuestro usuario. GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE significa que los grupos del usuario se recuperarán del atributo 'memberOf' de nuestro usuario o desde el otro atributo especificado por 'Member-Of LDAP Attribute'.
-hour=Hora.
+hour=Hora
 connectionTimeoutHelp=Tiempo de espera de conexión LDAP en milisegundos
 repeat=Repetir
 defaultSigAlgHelp=Algoritmo predeterminado utilizado para firmar tokens para el realm
 searchForProtocol=Buscar mapeador de protocolo
 eventTypes.CLIENT_INFO.name=Información del cliente
-eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=OAuth2 código de dispositivo a token
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=Código de dispositivo OAuth2 para token
 eventTypes.UPDATE_TOTP_ERROR.name=Error de actualización de TOTP
-client-updater-source-groups.tooltip=Nombre de los grupos para verificar. La condición se evalúa como verdadera si la entidad que crea/actualiza el cliente es miembro de alguno de los grupos especificados. Los grupos configurados se especifican por su nombre simple, que debe coincidir con el nombre del grupo Keycloak. No se utiliza el soporte para la jerarquía de grupos aquí.
-webAuthnPolicyRpId=ID del Relying Party
+client-updater-source-groups.tooltip=Nombre de los grupos a verificar. La condición se evalúa como verdadera si la entidad que crea o actualiza el cliente es miembro de uno o más de los grupos especificados. Los grupos configurados se especifican por su nombre simple, el cual debe coincidir con el nombre del grupo en Keycloak. Aquí no se admite la jerarquía de grupos.
+webAuthnPolicyRpId=ID de la parte confiable
 ldapRolesDnHelp=DN LDAP donde se guardan los roles de este árbol. Por ejemplo, 'ou=finanzas,dc=ejemplo,dc=org'.
 serviceAccount=Roles de cuentas de servicio
 providerUpdatedSuccess=Política de cliente actualizada correctamente
 assertionConsumerServiceRedirectBindingURL=URL de vinculación de redirección del Servicio Consumidor de Afirmaciones
-createClientScopeError=No se pudo crear el ámbito del cliente: '{{error}}'
+createClientScopeError=No se pudo crear el client scope: '{{error}}'
 deleteRole=Eliminar este rol
 SSOSessionSettings=Configuraciones de sesión SSO
 directAccessHelp=Esto habilita el soporte para Concesiones de Acceso Directo, lo que significa que el cliente tiene acceso al nombre de usuario/contraseña del usuario y lo intercambia directamente con el servidor Keycloak por un token de acceso. En términos de la especificación OAuth2, esto habilita el soporte de 'Resource Owner Password Credentials Grant' para este cliente.
@@ -1068,21 +1064,21 @@ clustering=Clusterización
 createSuccess=Proveedor de identidad creado exitosamente
 mapperAttributeName=Nombre del atributo
 setPassword=Establecer contraseña
-client-updater-source-roles.tooltip=La condición se verifica durante las solicitudes de registro/actualización del cliente y se evalúa como verdadera si la entidad (normalmente usuario) que está creando/actualizando el cliente es miembro del rol especificado. Para hacer referencia al rol de realm, puedes usar el nombre del rol de realm como 'mi_rol_de_realm'. Para hacer referencia al rol de cliente, puedes usar el client_id.nombre_del_rol_por_ejemplo 'mi_cliente.mi_rol_de_cliente' se referirá al rol de cliente 'mi_rol_de_cliente' del cliente 'mi_cliente'.
+client-updater-source-roles.tooltip=La condición se verifica durante la solicitud de registro o actualización del cliente; se evalúa como verdadera si la entidad (generalmente un usuario) que crea o actualiza el cliente es miembro del rol especificado. Para referenciar un rol de reino, puede usar el nombre del rol de reino, como 'mi_rol_reino'. Para referenciar un rol de cliente, puede usar client_id.nombre_del_rol; por ejemplo, 'mi_cliente.mi_rol_cliente' se refiere al rol de cliente 'mi_rol_cliente' del cliente 'mi_cliente'.
 createRole=Crear rol
 clientDeletedSuccess=El cliente ha sido eliminado
 eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Error de respuesta del proveedor de identidad
 editModeLdapHelp=READ_ONLY es un almacén LDAP de solo lectura. WRITABLE significa que los datos se sincronizarán de vuelta a LDAP según sea necesario. UNSYNCED significa que los datos de usuario se importarán, pero no se sincronizarán de vuelta a LDAP.
 enableServiceAccount=Habilitar roles de cuentas de servicio
 signOutAllActiveSessionsQuestion=¿Cerrar todas las sesiones activas?
-addPostLogoutRedirectUri=Agregar URI de redirección posterior al cierre de sesión válidos
+addPostLogoutRedirectUri=Agregar URIs de redirección válidas después del cierre de sesión
 SSOSessionMaxRememberMe=Duración máxima de la sesión SSO con "Recordarme" habilitado
 pkceMethod=Método PKCE
 moveGroupEmptyInstructions=No hay subgrupos, selecciona 'Mover aquí' para mover el grupo seleccionado como un subgrupo de este grupo
 hmacGenerated=hmac-generado
 unlockSuccess=Usuario desbloqueado correctamente
 unlockError=No se pudo desbloquear al usuario debido a {{error}}
-hourHelp=Define la hora en la que la política DEBE ser otorgada. También puedes proporcionar un rango llenando el segundo campo. En este caso, se otorga el permiso solo si la hora actual está entre o es igual a los dos valores que proporcionaste.
+hourHelp=Define la hora en la que la política DEBE ser otorgada. También puede proporcionar un rango llenando el segundo campo. En este caso, se otorga el permiso solo si la hora actual está entre o es igual a los dos valores que proporcionó.
 deleteClientProfileConfirmTitle=¿Eliminar perfil?
 syncLDAPGroupsError=No se pudieron sincronizar los datos debido a {{error}}
 saveSuccess=Proveedor de federación de usuarios guardado exitosamente
@@ -1092,7 +1088,7 @@ testConnection=Probar conexión
 archiveFormat=Formato de archivo
 requestObjectEncryptionHelp=Algoritmo JWE, que el cliente necesita usar al enviar el objeto de solicitud OIDC especificado por los parámetros 'request' o 'request_uri'. Si se establece en 'cualquiera', la encriptación es opcional y se permite cualquier algoritmo.
 importSuccess=Nuevo certificado importado
-attributeConsumingServiceName=Nombre del Servicio Consumidor de Atributos
+attributeConsumingServiceName=Nombre del Servicio de Consumo de Atributos
 invalidJsonError=No se puede guardar el perfil de usuario, la información proporcionada no es un JSON válido: {{error}}
 promptHelp=Especifica si el Servidor de Autorización solicita al Usuario Final una nueva autenticación y consentimiento.
 deleteBtn=Eliminar
@@ -1102,19 +1098,19 @@ aggregate.attrs.label=Agregar valores de atributo
 removedGroupMembershipError=Error al eliminar la membresía del grupo: {{error}}
 allowPasswordAuthenticationHelp=Habilitar/deshabilitar la posibilidad de autenticación de nombre de usuario/contraseña contra la base de datos Kerberos
 deleteExecutorSuccess=¡Éxito! El ejecutor fue eliminado.
-eventTypes.SEND_RESET_PASSWORD_ERROR.name=Error al enviar restablecer contraseña
+eventTypes.SEND_RESET_PASSWORD_ERROR.name=Enviar error de restablecimiento de contraseña
 eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=Primer inicio de sesión del proveedor de identidad
 noRoles-groups=No hay roles para este grupo
 enableSwitchSuccess={{switch}} cambiado exitosamente
 eventTypes.INTROSPECT_TOKEN_ERROR.name=Error al analizar el token
-usernameHelperText=Ingresa el nombre de usuario del usuario para este proveedor de identidad.
-includeInAccessToken.tooltip=¿Debe agregarse la reclamación al token de acceso?
-noScopeCreateHint=Debes crear un alcance de autorización primero.
+usernameHelperText=Ingrese el nombre de usuario del usuario para este proveedor de identidad.
+includeInAccessToken.tooltip=¿Se debe agregar la declaración al token de acceso?
+noScopeCreateHint=Debe crear un scope de autorización primero.
 eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=Error de vinculación de cuenta iniciada por el cliente
-clientScopesCondition=Alcances esperados
+clientScopesCondition=Scopes esperados
 backchannelLogoutSessionRequiredHelp=Especifica si se incluye un Claim de sid (ID de sesión) en el Token de Cierre de Sesión cuando se utiliza la URL de cierre de canal posterior.
 global=Global
-userAttributeHelp=Nombre del atributo de usuario que deseas codificar por defecto
+userAttributeHelp=Nombre del atributo de usuario que desea codificar por defecto
 searchForMapper=Buscar mapeador
 oidcCibaGrantHelp=Esto habilita el soporte para la Concesión OIDC CIBA, lo que significa que el usuario está autenticado a través de algún dispositivo de autenticación externo en lugar del navegador del usuario.
 includeOneTimeUseCondition=Incluir condición de uso único
@@ -1132,7 +1128,7 @@ importParseError=No se pudo analizar el archivo {{error}}
 validTo=Válido hasta
 addMember=Agregar miembro
 eventTypes.CLIENT_INFO_ERROR.name=Error de información del cliente
-scopeParameterHelp=Puede copiar el valor del parámetro scope y pegarlo en la solicitud inicial de autenticación OpenID Connect enviada desde este adaptador de cliente. Los alcances predeterminados del cliente y los alcances opcionales seleccionados se utilizarán al generar el token emitido para este cliente.
+scopeParameterHelp=Puede copiar el valor del parámetro de ámbito y pegarlo en la solicitud de autenticación inicial de OpenID Connect enviada desde este adaptador de cliente. Los client scopes predeterminados y los client scopes opcionales seleccionados se utilizarán al generar el token emitido para este cliente.
 idTokenEncryptionKeyManagementAlgorithm=Algoritmo de gestión de claves de encriptación de token de ID
 authenticatorAttachment.not\ specified=No especificado
 oidcCibaGrant=Concesión OIDC CIBA
@@ -1140,18 +1136,18 @@ displayDescriptionHintHelp=Un texto que se debe usar como descripción emergente
 ssoSessionIdle=Tiempo que se permite que una sesión esté inactiva antes de que expire. Los tokens y las sesiones del navegador se invalidan cuando una sesión ha expirado.
 searchKey=Clave de búsqueda
 deleteClientSuccess=Perfil de cliente eliminado
-emptyClientScopesPrimaryAction=Añadir ámbitos de cliente
-addStepTo=Añadir paso a {{nombre}}
+emptyClientScopesPrimaryAction=Agregar client scopes
+addStepTo=Añadir paso a {{name}}
 eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=Error de authreqid a token
-deleteAttributeConfirm=¿Estás seguro de que deseas eliminar permanentemente el atributo {{nombreDelAtributo}}?
-chooseResources=Elige los recursos que deseas importar
+deleteAttributeConfirm=¿Está seguro de que desea eliminar permanentemente el atributo {{attributeName}}?
+chooseResources=Elija los recursos que desea importar
 selectOne=Seleccionar una opción
 emailTheme=Tema de correo electrónico
 eventTypes.UPDATE_PASSWORD.description=Actualizar contraseña
 policiesConfigTypes.jsonEditor=Editor JSON
 eventConfigSuccessfully=Configuración guardada con éxito
 scopePermissions.users.impersonate-description=Pólizas que deciden si el administrador puede suplantar a otros usuarios
-deleteResourceWarning=Los permisos a continuación se eliminarán cuando ya no sean utilizados por otros recursos\:
+deleteResourceWarning=Los permisos a continuación se eliminarán cuando ya no sean utilizados por otros recursos:
 permissionScopesHelp=Especifica que este permiso debe aplicarse a uno o más ámbitos.
 moveTo=Mover a
 registerNodeManually=Registrar nodo manualmente
@@ -1165,7 +1161,7 @@ emptyBuiltInMappersInstructions=Todos los mapeadores integrados fueron añadidos
 assertionLifespanHelp=Vida útil establecida en las condiciones de la afirmación SAML. Después de ese tiempo, la afirmación será inválida. El atributo "SessionNotOnOrAfter" no se modifica y continúa utilizando el tiempo "SSO Session Max" definido a nivel de realm.
 noTokensInstructions=No has creado ningún token de acceso inicial. Crea un token de acceso inicial haciendo clic en "Crear".
 editUsername=Si está habilitado, el campo de nombre de usuario es editable; de lo contrario, es de solo lectura.
-ldapAttributeValueHelp=Valor del atributo LDAP que se agregará al nuevo usuario durante el registro. Puedes codificar un valor como 'foo', pero también puedes usar algunos tokens especiales. El único token admitido actualmente es '${RANDOM}', que será reemplazado por una cadena generada al azar.
+ldapAttributeValueHelp=Valor del atributo LDAP que se agregará al nuevo usuario durante el registro. Puede codificar un valor como 'foo', pero también puede usar algunos tokens especiales. El único token admitido actualmente es '${RANDOM}', que será reemplazado por una cadena generada al azar.
 lastRegistration=Último registro
 advancedSettingsOpenid-connect=Esta sección se utiliza para configurar ajustes avanzados de este cliente relacionados con el protocolo OpenID Connect
 requireSsl=Requerir SSL
@@ -1183,13 +1179,13 @@ principalAttribute=Atributo principal
 mapperTypeLdapAttributeMapperHelp=Este mapeador es compatible solo si syncRegistrations está habilitado. Los usuarios nuevos registrados en Keycloak se escribirán en el LDAP con el valor codificado de algún atributo especificado.
 userRegistrationHelpText=Habilitar/deshabilitar la página de registro. Un enlace para el registro también aparecerá en la página de inicio de sesión.
 activeHelp=Establece si las llaves se pueden utilizar para firmar
-addMapperExplain=Si deseas un control más detallado, puedes crear un mapeador de protocolo en este cliente
+addMapperExplain=Si desea un control más detallado, puede crear un mapeador de protocolo en este cliente
 realmRoles=Roles de realm
 fineGrainOpenIdConnectConfigurationHelp=Esta sección se utiliza para configurar ajustes avanzados de este cliente relacionados con el protocolo OpenID Connect.
 searchForUserDescription=Este realm puede tener un proveedor federado. Ver todos los usuarios puede hacer que el sistema se vuelva lento, pero se puede hacer buscando "*". Por favor, busca un usuario arriba.
 expirationHelp=Establece la expiración para eventos. Los eventos caducados se eliminan periódicamente de la base de datos.
 webAuthnPolicySignatureAlgorithmsHelp=Qué algoritmos de firma se deben usar para la Asertación de Autenticación.
-setToNowError=¡Error\! No se pudo establecer 'No antes' en la fecha y hora actuales: {{error}}
+setToNowError=¡Error! No se pudo establecer 'No antes' en la fecha y hora actuales: {{error}}
 eventTypes.UNREGISTER_NODE_ERROR.description=Error al anular el registro del nodo
 clientScopeTypes.optional=Opcional
 nameIdFormat=Formato de ID de nombre
@@ -1198,20 +1194,20 @@ validRedirectUri=URIs de redirección válidos
 webauthnIntro=¿Para qué se utiliza este formulario?
 wantAssertionsEncryptedHelp=Indica si este proveedor de servicios espera una Aserción cifrada.
 roleObjectClasses=Clases de objetos de rol
-deleteClientScope_other=Eliminar {{count}} ámbitos de cliente
+deleteClientScope_other=Eliminar {{count}} client scopes
 deleteCredentialsConfirmTitle=¿Eliminar credenciales?
 expires=Caduca
 OVERWRITE=Sobrescribir
-eventTypes.REFRESH_TOKEN.name=Token de actualización
+eventTypes.REFRESH_TOKEN.name=Actualizar token
 userAttribute=Atributo de usuario
 revoke=Revocar
 admin=Administrador
-syncUsersError=No se pudieron sincronizar los usuarios\: '{{error}}'
-generatedAccessTokenHelp=Consulta el ejemplo de token de acceso, que se generará y enviará al cliente cuando el usuario seleccionado sea autenticado. Puedes ver las declaraciones (claims) y roles que el token contendrá, basados en los mapeadores de protocolo efectivos, las asignaciones de alcance de roles, así como en las declaraciones y roles asignados al usuario actual.
-webAuthnPolicyAcceptableAaguidsHelp=La lista de AAGUID de los cuales un autenticador puede ser registrado.
+syncUsersError=No se pudieron sincronizar los usuarios: '{{error}}'
+generatedAccessTokenHelp=Vea el ejemplo de token de acceso, que se generará y enviará al cliente cuando el usuario seleccionado se autentique. Puede ver las reclamaciones y roles que contendrá el token según los asignadores de protocolo efectivos y las asignaciones de scope de roles, así como también según las reclamaciones y roles asignados al usuario actual.
+webAuthnPolicyAcceptableAaguidsHelp=La lista de AAGUIDs permitidos con los que se puede registrar un autenticador. Un AAGUID es un identificador de 128 bits que indica el tipo de autenticador (por ejemplo, su marca y modelo).
 keyPasswordHelp=Contraseña para la clave privada
 frontchannelLogout=Cierre de sesión de canal frontal
-clientUpdaterTrustedHostsTooltip=Lista de hosts de confianza. En caso de que la solicitud de registro/actualización del cliente provenga del host/dominio especificado en esta configuración, la condición se evalúa como verdadera. Puedes utilizar nombres de host o direcciones IP. Si usas un asterisco al principio (por ejemplo, '*.ejemplo.com'), entonces se confiará en todo el dominio ejemplo.com.
+clientUpdaterTrustedHostsTooltip=Lista de hosts confiables. Si una solicitud de registro o actualización de cliente proviene del host o dominio especificado en esta configuración, la condición se evalúa como verdadera. Puede usar nombres de host o direcciones IP. Si utiliza un asterisco al principio (por ejemplo, '*.example.com'), se confiará en todo el dominio example.com.
 titleRoles=Roles de realm
 mapperTypeGroupLdapMapperHelp=Utilizado para mapear mapeos de grupo de grupos de algún DN LDAP a mapeos de grupo de Keycloak
 sectorIdentifierUri.tooltip=Los proveedores que usan valores sub de pares y admiten el Registro de Cliente Dinámico DEBEN utilizar el parámetro sector_identifier_uri. Proporciona una forma para que un grupo de sitios web bajo control administrativo común tenga valores sub de pares consistentes independientemente de los nombres de dominio individuales. También proporciona una forma para que los clientes cambien los dominios redirect_uri sin tener que volver a registrar a todos sus usuarios.
@@ -1223,7 +1219,7 @@ xRobotsTag=X-Robots-Tag
 bindType=Tipo de enlace
 tokenDeleteSuccess=Token de acceso inicial eliminado correctamente
 contextualInfo=Información contextual
-syncModeHelp=Modo de sincronización predeterminado para todos los mapeadores. El modo de sincronización determina cuándo se sincronizarán los datos de usuario utilizando los mapeadores. Los valores posibles son\: 'legacy' para mantener el comportamiento antes de que se introdujera esta opción, 'import' para importar solo al usuario una vez durante el primer inicio de sesión del usuario con este proveedor de identidades, 'force' para actualizar siempre al usuario durante cada inicio de sesión con este proveedor de identidades.
+syncModeHelp=Modo de sincronización predeterminado para todos los mapeadores. El modo de sincronización determina cuándo se sincronizan los datos del usuario utilizando los mapeadores. Existen tres valores posibles: 'legacy' para mantener el comportamiento antes de que se introdujera esta opción, 'import' para importar al usuario solo una vez, específicamente durante el primer inicio de sesión del usuario con este proveedor de identidad, y 'force' para actualizar siempre al usuario en cada inicio de sesión con este proveedor de identidad.
 temporaryPassword=Temporal
 applyPolicyHelp=Especifica todas las políticas que deben aplicarse a los ámbitos definidos por esta política o permiso.
 addKerberosWizardDescription=Texto necesario aquí
@@ -1238,21 +1234,21 @@ eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Recuperar token del proveedor d
 userInfo=Información del usuario
 consentScreenText=Texto de pantalla de consentimiento
 addRoles=Añadir roles
-clientPoliciesProfilesHelpText=El perfil del cliente permite configurar un conjunto de ejecutores que se aplican a varias acciones realizadas con el cliente. Las acciones pueden ser acciones administrativas como crear o actualizar el cliente, o acciones de usuario como autenticarse en el cliente.
+clientPoliciesProfilesHelpText=El Perfil de Cliente permite crear un conjunto de ejecutores que imponen diversas acciones relacionadas con el cliente. Estas acciones pueden ser administrativas, como crear o actualizar un cliente, o acciones de usuario, como autenticarse con el cliente.
 archiveFormatHelp=Formato de archivo de almacén de claves Java o PKCS12.
 xContentTypeOptions=X-Content-Type-Options
-groupsDescription=Un grupo es un conjunto de atributos y asignaciones de roles que se pueden aplicar a un usuario. Puedes crear, editar y eliminar grupos y administrar su organización de padres e hijos.
-addValidatorRole=Añadir validador {{nombreDelValidador}}
+groupsDescription=Un grupo es un conjunto de atributos y asignaciones de roles que se pueden aplicar a un usuario. Puede crear, editar y eliminar grupos y administrar su organización de padres e hijos.
+addValidatorRole=Añadir validador {{validatorName}}
 protocolTypes.all=Todo
 keyAlias=Alias de la clave
 xContentTypeOptionsHelp=El valor predeterminado evita que Internet Explorer y Google Chrome hagan "sniffing" MIME alejado del tipo de contenido declarado. <1>Más información</1>
 privateKeyMask=CLAVE PRIVADA NO CONFIGURADA O CONOCIDA
 signOutAllActiveSessions=Cerrar todas las sesiones activas
-addExecutorSuccess=¡Éxito\! Ejecutor creado correctamente
+addExecutorSuccess=¡Éxito! Ejecutor creado correctamente
 executorTypeSelectHelpText=Texto de ayuda para seleccionar el tipo de ejecutor
 useDiscoveryEndpointHelp=Si esta configuración está habilitada, se utilizará el punto de descubrimiento para obtener la configuración del proveedor. Keycloak puede cargar la configuración desde el punto final y actualizar automáticamente la configuración si el origen tiene alguna actualización.
 eventTypes.USER_INFO_REQUEST_ERROR.name=Error en la solicitud de información del usuario
-createUserProviderError=El proveedor de federación de usuarios no pudo ser creado\: {{error}}
+createUserProviderError=El proveedor de federación de usuarios no pudo ser creado: {{error}}
 learnMore=Más información
 onDragCancel=Arrastre cancelado. La lista no cambia.
 removeUser=Eliminar usuarios
@@ -1262,7 +1258,7 @@ eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=Error al deshabi
 userModelAttributeNameHelp=Nombre del atributo del modelo que se agregará al importar un usuario desde LDAP
 templateHelp=Plantilla a utilizar para formatear el nombre de usuario a importar. Las sustituciones se encierran en ${}. Por ejemplo: '${ALIAS}.${CLAIM.sub}'. ALIAS es el alias del proveedor. CLAIM.<NOMBRE> hace referencia a un reclamo de token de ID o acceso. La sustitución puede convertirse a mayúsculas o minúsculas agregando |uppercase o |lowercase al valor sustituido, por ejemplo '${CLAIM.sub | lowercase}'.
 permissions=Permisos
-emptyExecutionInstructions=Puedes comenzar a definir este flujo agregando un subflujo o una ejecución
+emptyExecutionInstructions=Puede comenzar a definir este flujo agregando un subflujo o una ejecución
 offlineSessionSettings=Configuraciones de sesión sin conexión
 unAssignRole=Desasignar
 deleteScope=¿Eliminar permanentemente el ámbito de autorización?
@@ -1274,40 +1270,40 @@ clientPolicies=Políticas de cliente
 NONE=NINGUNO
 keystorePasswordHelp=Contraseña para el almacén de claves
 clientSettings=Detalles del cliente
-deleteClientPolicyConditionConfirm=Esta acción eliminará permanentemente {{condición}}. Esto no se puede deshacer.
+deleteClientPolicyConditionConfirm=Esta acción eliminará permanentemente {{condition}}. Esto no se puede deshacer.
 selectATheme=Seleccionar un tema
 permissionsList=Lista de permisos
 attributeGroupHelp=Especifica el grupo de perfil de usuario donde se agregará este atributo. Esto permite agrupar varios atributos similares en diferentes partes de la pantalla al crear o actualizar un usuario.
 createRealm=Crear Realm
 eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=Error al validar el token de acceso
-mapperSaveError=Error al guardar el mapeador\: {{error}}
+mapperSaveError=Error al guardar el mapeador: {{error}}
 eventTypes.CLIENT_LOGIN_ERROR.name=Error de inicio de sesión del cliente
 passwordPoliciesHelp.passwordHistory=Evita que se reutilice una contraseña utilizada recientemente.
-displayOnConsentScreenHelp=Si está activado, y este ámbito de cliente se agrega a algún cliente con consentimiento requerido, el texto especificado en 'Texto de la Pantalla de Consentimiento' se mostrará en la pantalla de consentimiento. Si está desactivado, este ámbito de cliente no se mostrará en la pantalla de consentimiento.
+displayOnConsentScreenHelp=Si está activado y este client scope se agrega a algún cliente con consentimiento requerido, el texto especificado en 'Texto de pantalla de consentimiento' se mostrará en la pantalla de consentimiento. Si está desactivado, este client scope no se mostrará en la pantalla de consentimiento.
 requirements.DISABLED=Desactivado
 mapperTypeHardcodedLdapGroupMapperHelp=Los usuarios importados de LDAP se agregarán automáticamente a este grupo configurado.
 titleUsers=Usuarios
 whoWillAppearLinkText=¿Quién aparecerá en esta lista de grupos?
 ldapFullNameAttribute=Atributo de nombre completo LDAP
-createClientError=No se pudo crear el cliente\: '{{error}}'
-deleteConfirmClientScopes=¿Estás seguro de que deseas eliminar este ámbito de cliente?
+createClientError=No se pudo crear el cliente: '{{error}}'
+deleteConfirmClientScopes=¿Está seguro de que desea eliminar este client scope?
 forceAuthenticationHelp=Indica si el proveedor de identidad debe autenticar directamente al presentador en lugar de depender de un contexto de seguridad anterior.
 testClusterAvailability=Probar la disponibilidad del clúster
 reGenerateSigning=Regenerar clave de firma para este cliente
-authorizationEncryptedResponseAlgHelp=Algoritmo JWA utilizado para la gestión de claves al cifrar la respuesta de autorización cuando el modo de respuesta es jwt. Esta opción es necesaria si deseas una respuesta de autorización cifrada. Si se deja vacío, la respuesta de autorización solo se firma, pero no se cifra.
-deleteConfirmGroup_other=¿Estás seguro de que deseas eliminar estos grupos?.
+authorizationEncryptedResponseAlgHelp=Algoritmo JWA utilizado para la gestión de claves al cifrar la respuesta de autorización cuando el modo de respuesta es jwt. Esta opción es necesaria si desea una respuesta de autorización cifrada. Si se deja vacío, la respuesta de autorización solo se firma, pero no se cifra.
+deleteConfirmGroup_other=¿Está seguro de que desea eliminar estos grupos?
 scopePermissions.users.manage-description=Políticas que deciden si un administrador puede gestionar a todos los usuarios en el realm
 defaultACRValuesHelp=Valores predeterminados que se utilizarán como ACR voluntario en caso de que no haya una solicitud de ACR explícita por 'claims' o parámetro 'acr_values' en la solicitud OIDC.
 membershipAttributeType=Tipo de atributo de membresía
 eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Solicitud de autorización enviada
-included.client.audience.tooltip=El ID de cliente del público especificado se incluirá en el campo de audiencia (aud) del token. Si existen audiencias existentes en el token, el valor especificado se agregará a ellas. No anulará las audiencias existentes.
+included.client.audience.tooltip=El ID de cliente del cliente de audiencia especificado se incluirá en el campo de audiencia (aud) del token. Si el token ya incluye audiencias, el valor especificado se añadirá a ellas sin sobrescribir las audiencias existentes.
 searchGroup=Buscar grupo
 allowCreateHelp=Permite que el proveedor de identidad externo cree un nuevo identificador para representar al principal.
 allResults=Todos los resultados
 addressClaim.locality.tooltip=Nombre del atributo de usuario que se utilizará para asignar al subreclamo 'locality' dentro del reclamo 'address' del token. Por defecto, es 'locality'.
-keyForCodeExchangeHelp=Elige qué método de desafío de código para PKCE se utiliza. Si no se especifica, Keycloak no aplica PKCE a un cliente a menos que el cliente envíe una solicitud de autorización con el desafío de código apropiado y el método de intercambio de código.
+keyForCodeExchangeHelp=Elija qué método de desafío de Proof Key for Code Exchange (PKCE) se utilizará. Si no se especifica, Keycloak no aplicará PKCE a un cliente a menos que el cliente envíe una solicitud de autorización con un code challenge y un método de intercambio de código adecuados.
 includeInAccessTokenResponse.tooltip=¿Debería el reclamo ser agregado a la respuesta del token de acceso? Solo debe usarse para datos informativos y no sensibles
-removeMappingConfirm_one=¿Estás seguro de que deseas eliminar este rol?
+removeMappingConfirm_one=¿Está seguro que desea eliminar este rol?
 oidcSettings=Ajustes de OpenID Connect
 otpPolicyDigitsHelp=¿Cuántos dígitos debe tener el OTP?
 clientAuthentications.client_secret_post=Secreto de cliente enviado como publicación
@@ -1317,7 +1313,7 @@ valueError=Se debe proporcionar un valor.
 noConsents=Sin consentimientos
 orderChangeSuccessUserFed=Se ha cambiado con éxito el orden de prioridad de los proveedores de federación de usuarios
 noUsersEmptyStateDescriptionContinued=para encontrarlos. Los usuarios que ya tienen este rol como rol efectivo no se pueden agregar aquí.
-userProviderSaveError=No se pudo guardar el proveedor de federación de usuarios\: {{error}}
+userProviderSaveError=No se pudo guardar el proveedor de federación de usuarios: {{error}}
 executorsHelpText=Ejecutores que se aplicarán a este perfil de cliente
 ldapSearchingAndUpdatingSettings=Configuraciones de búsqueda y actualización de LDAP
 authenticationAliasHelp=Nombre de la configuración
@@ -1326,21 +1322,21 @@ deleteClientPolicyConditionConfirmTitle=¿Eliminar condición?
 initialCounterErrorHint=El valor debe estar entre 1 y 120
 connectionTimeout=Tiempo de conexión agotado
 passLoginHintHelp=Pasar login_hint al proveedor de identidad.
-monthHelp=Define el mes en el que SE DEBE otorgar la política. También puedes proporcionar un rango llenando el segundo campo. En este caso, el permiso se otorga solo si el mes actual está entre o es igual a los dos valores que proporcionaste.
+monthHelp=Define el mes en el que SE DEBE otorgar la política. También puede proporcionar un rango llenando el segundo campo. En este caso, el permiso se otorga solo si el mes actual está entre o es igual a los dos valores que proporcionó.
 eventTypes.CLIENT_LOGIN.description=Inicio de sesión del cliente
 registrationAccessToken=Token de acceso de registro
 headerName=Nombre del encabezado
 issuerHelp=El identificador del emisor para el emisor de la respuesta. Si no se proporciona, no se realizará ninguna validación.
 uiDisplayNameHelp=Nombre de visualización del proveedor al estar vinculado en la IU de administración
 titleSessions=Sesiones
-dedicatedScopeName={{nombreDelCliente}}-dedicado
+dedicatedScopeName={{clientName}}-dedicado
 mapperTypeUserAttributeLdapMapper=mapeador-de-atributo-usuario-ldap
 deleteAttributeConfirmTitle=¿Eliminar atributo?
 importSkipped_zero=No hay registros omitidos.
 rootURL=URL raíz añadida a URLs relativas
 contentSecurityPolicyHelp=El valor predeterminado evita que las páginas sean incluidas por iframes de origen no autorizado. <1>Más información</1>
 policyUsers=Especifica qué usuario(s) están permitidos por esta política.
-logoutServicePostBindingURLHelp=URL de Enlace POST SAML para el servicio de cierre de sesión único del cliente. Puedes dejar esto en blanco si estás usando un enlace diferente.
+logoutServicePostBindingURLHelp=URL de Enlace POST SAML para el servicio de cierre de sesión único del cliente. Puede dejar esto en blanco si está usando un enlace diferente.
 generatedIdTokenNo=No se ha generado un token de ID
 byConfiguration=Por configuración
 usersAdded_other={{count}} usuarios añadidos al grupo
@@ -1349,7 +1345,7 @@ passCurrentLocale=Pasarlo a la configuración local actual
 realmNameField=Nombre del realm
 roleCreated=Rol creado
 socialProfileJSONFieldPath=Ruta de campo JSON de Perfil Social
-noViewRights=No tienes permisos para ver este grupo.
+noViewRights=No tiene permisos para ver este grupo.
 eventTypes.SEND_RESET_PASSWORD.description=Enviar restablecimiento de contraseña
 eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=Vinculación de cuenta iniciada por el cliente
 resourceScopeError=No se pudo eliminar el ámbito de autorización debido a {{error}}
@@ -1357,9 +1353,9 @@ identityInformation=Información de identidad
 usermodel.clientRoleMapping.rolePrefix.label=Prefijo de rol del cliente
 partialImport=Importación parcial
 cibaBackhannelTokenDeliveryModes.ping=Ping
-includeInTokenScopeHelp=Si está activado, el nombre de este alcance de cliente se agregará a la propiedad 'scope' del token de acceso, así como a la respuesta del punto final de inspección de tokens. Si está desactivado, este alcance de cliente se omitirá del token y de la respuesta del punto final de inspección de tokens.
+includeInTokenScopeHelp=Si está activado, el nombre de este client scope se agregará a la propiedad 'scope' del token de acceso, así como a la respuesta del Token Introspection Endpoint. Si está desactivado, este client scope se omitirá del token y de la respuesta del Token Introspection Endpoint.
 savePassword=Guardar contraseña
-signatureKeyNameHelp=Los documentos SAML firmados contienen la identificación de la clave de firma en el elemento KeyName. Para el interlocutor de Keycloak / RH-SSO, usa KEY_ID; para MS AD FS, usa CERT_SUBJECT; para otros, comprueba y usa NONE si ninguna otra opción funciona.
+signatureKeyNameHelp=Los documentos SAML firmados contienen la identificación de la clave de firma en el elemento KeyName. Para el interlocutor de Keycloak / RH-SSO, usa KEY_ID; para MS AD FS, usa CERT_SUBJECT; para otros, compruebe y use NONE si ninguna otra opción funciona.
 sync-keycloak-roles-to-ldap=Sincronizar roles de Keycloak con LDAP
 decisionStrategies.UNANIMOUS=Unánime
 cacheSettingsDescription=Esta sección contiene opciones útiles para almacenar en caché a los usuarios que se cargaron desde este proveedor de almacenamiento de usuarios.
@@ -1371,7 +1367,7 @@ executorsTable=Tabla de Ejecutores
 extendToChildren=Extender a los hijos
 from=Desde
 decisionStrategyHelp=La estrategia de decisión dicta cómo se evalúan los permisos y cómo se obtiene una decisión final. 'Afirmativo' significa que al menos un permiso debe evaluar una decisión positiva para otorgar acceso a un recurso y sus ámbitos. 'Unánime' significa que todos los permisos deben evaluar una decisión positiva para que la decisión final también sea positiva.
-deleteClientPolicyProfileError=No se pudo eliminar el perfil de la política\: {{error}}
+deleteClientPolicyProfileError=No se pudo eliminar el perfil de la política: {{error}}
 greaterThan=Debe ser mayor que {{value}}
 hideOnLoginPage=Ocultar en la página de inicio de sesión
 couldNotCreateGroup=No se pudo crear el grupo {{error}}
@@ -1381,73 +1377,73 @@ conditionsHelp=Condiciones que se evaluarán para determinar si se debe aplicar
 disableProvider=¿Desactivar proveedor?
 eventTypes.UNREGISTER_NODE.name=Dar de baja nodo
 anonymousAccessPoliciesHelp=Estas Políticas se utilizan cuando el Servicio de Registro de Clientes es invocado por una solicitud no autenticada. Esto significa que la solicitud no contiene un Token de Acceso Inicial ni un Token de Acceso.
-clientScopeError=No se pudo actualizar la asignación de alcance {{error}}
-saveRealmSuccess=Reino creado correctamente
+clientScopeError=No se pudo actualizar la asignación de scope {{error}}
+saveRealmSuccess=Realm creado correctamente
 createToken=Crear token de acceso inicial
 clientsClientTypeHelp='OpenID Connect' permite que los clientes verifiquen la identidad del Usuario Final basándose en la autenticación realizada por un Servidor de Autorización. 'SAML' habilita escenarios de autenticación y autorización basados en web, incluido el inicio de sesión único (SSO) entre dominios y utiliza tokens de seguridad que contienen afirmaciones para transmitir información.
-orderChangeSuccess=Cambio de orden de visualización de proveedores de identidad realizado con éxito
-emptyPoliciesInstructions=Si deseas crear una política, haz clic en el botón a continuación para crear la política.
-createScopeSuccess=Alcance de autorización creado correctamente
+orderChangeSuccess=Se ha cambiado correctamente el orden de visualización de los proveedores de identidad
+emptyPoliciesInstructions=Si desea crear una política, haga clic en el botón a continuación para crear la política.
+createScopeSuccess=Scope de autorización creado correctamente
 logoUrl=URL del Logotipo
 accessTokenLifespanImplicitFlowHelp=Tiempo máximo antes de que expire un token de acceso emitido durante el flujo implícito de OpenID Connect. Se recomienda que este valor sea menor que el tiempo de espera de SSO. No hay posibilidad de actualizar el token durante el flujo implícito, por eso hay un tiempo de espera separado diferente al 'Tiempo de Vida del Token de Acceso'.
 noRealmRolesToAssign=No hay roles de realm para asignar
 logoutUrl=URL de cierre de sesión
 regexPatternHelp=Especifica el patrón regex.
 searchForUserEvent=Buscar evento de usuario
-usernameLdapAttributeHelp=Nombre del atributo LDAP, que se asigna como nombre de usuario de Keycloak. Para muchos proveedores de servidores LDAP puede ser 'uid'. Para Active Directory puede ser 'sAMAccountName' o 'cn'. El atributo debe estar completado para todos los registros de usuario LDAP que desees importar de LDAP a Keycloak.
+usernameLdapAttributeHelp=Nombre del atributo LDAP, que se asigna como nombre de usuario de Keycloak. Para muchos proveedores de servidores LDAP puede ser 'uid'. Para Active Directory puede ser 'sAMAccountName' o 'cn'. El atributo debe estar completado para todos los registros de usuario LDAP que desee importar de LDAP a Keycloak.
 federationLink=Enlace de federación
-webAuthnPolicyPasswordlessFormHelp=Política para autenticación sin contraseña de WebAuthn. Esta se usará en la acción requerida 'Registro de Webauthn sin contraseña' y en el autenticador 'Autenticador de WebAuthn sin contraseña'. El uso típico es cuando se utilizará WebAuthn como autenticación de primer factor. Tener tanto 'Política de WebAuthn' como 'Política de WebAuthn sin contraseña' permite utilizar WebAuthn como autenticador de primer y segundo factor en el mismo realm.
-unlinkUsersError=No se pudieron desvincular los usuarios\: '{{error}}'
-roleHelpHelp=Rol para otorgar al usuario. Haz clic en el botón 'Seleccionar Rol' para explorar roles, o simplemente escríbelo en el cuadro de texto. Para hacer referencia a un rol de aplicación, la sintaxis es nombreApp.rolApp, por ejemplo, miApp.miRol.
+webAuthnPolicyPasswordlessFormHelp=Política para la autenticación sin contraseña con WebAuthn. Esta política es utilizada por la acción requerida 'Registrar WebAuthn sin contraseña' y el autenticador 'WebAuthn sin contraseña'. Un caso de uso típico es cuando WebAuthn se utiliza como método de autenticación de primer factor. Tener tanto una 'Política de WebAuthn' como una 'Política de WebAuthn sin contraseña' permite usar WebAuthn como autenticador de primer factor y de segundo factor dentro del mismo reino.
+unlinkUsersError=No se pudieron desvincular los usuarios: '{{error}}'
+roleHelpHelp=Rol para otorgar al usuario. Haga clic en el botón 'Seleccionar Rol' para explorar roles, o simplemente escríbalo en el cuadro de texto. Para hacer referencia a un rol de aplicación, la sintaxis es nombreApp.rolApp, por ejemplo, miApp.miRol.
 storedTokensReadable=Tokens almacenados legibles
 defaultRoleDeleteError=No se puede eliminar un rol predeterminado.
 unknownUser=Usuario desconocido
 userVerify.not\ specified=No especificado
 usermodel.prop.label=Propiedad
-userFedUnlinkUsersConfirm=¿Quieres desvincular a todos los usuarios? Los usuarios sin una contraseña en la base de datos no podrán autenticarse más.
+userFedUnlinkUsersConfirm=¿Quiere desvincular a todos los usuarios? Los usuarios sin una contraseña en la base de datos no podrán autenticarse más.
 searchUserByAttributeDescription=Admite configurar múltiples atributos como filtro de búsqueda configurando diferentes claves o valores. Solo se puede escribir un valor para una clave.
 eventTypes.REMOVE_FEDERATED_IDENTITY.name=Eliminar identidad federada
-membership=Pertenencia
+membership=Membresía
 eventTypes.RESET_PASSWORD.description=Restablecer contraseña
 authenticationOverrides=Sustituciones de flujo de autenticación
-client-scopes-condition.label=Alcances esperados
+client-scopes-condition.label=Scopes esperados
 deleteAttributeSuccess=Atributo eliminado
 artifactResolutionService=Servicio de Resolución de Artefactos
 clientProfilesSubTab=Subpestaña de perfiles de cliente
 selectEncryptionType=Seleccionar tipo de cifrado
 mapperTypeMsadLdsUserAccountControlMapper=Mapeador de control de cuenta de usuario MSAD-LDS
 realmSettingsExplain=Las configuraciones del realm son configuraciones que controlan las opciones para usuarios, aplicaciones, roles y grupos en el realm actual.
-mappingUpdatedError=No se pudo actualizar el mapeado\: '{{error}}'
-manageDisplayOrder=Gestionar el orden de visualización
+mappingUpdatedError=No se pudo actualizar el mapeado: '{{error}}'
+manageDisplayOrder=Administrar el orden de visualización
 exactSearch=Búsqueda exacta
 value=Valor
 filenamePlaceholder=Cargar un archivo PEM o pegar la clave a continuación
-deleteConfirm_one=¿Estás seguro de que quieres eliminar el grupo '{{groupName}}'?.
-scopeDisplayNameHelp=Un nombre único para este alcance. El nombre puede ser utilizado para identificar un alcance de manera única, útil al buscar un alcance específico.
+deleteConfirm_one=¿Está seguro que quiere eliminar el grupo '{{groupName}}'?.
+scopeDisplayNameHelp=Un nombre único para este scope. El nombre puede ser utilizado para identificar un scope de manera única, útil al buscar un scope específico.
 times.seconds=Segundos
-removeMappingTitle=¿Eliminar asignación?
+removeMappingTitle=¿Eliminar rol?
 executorTypeSelectAlgorithm=Seleccionar Algoritmo de Tipo de Ejecutor
 resources=Recursos
 userRolesRetrieveStrategy=Estrategia de recuperación de roles de usuario
 importKey=Importar clave
 events-disable-title=¿Desactivar eventos?
 ellipticCurve=Curva elíptica
-forceArtifactBindingHelp=¿Deben devolverse los mensajes de respuesta al cliente a través del sistema de enlace de ARTIFACTOS de SAML?
+forceArtifactBindingHelp=¿Deben enviarse al cliente los mensajes de respuesta a través del sistema de enlace SAML ARTIFACT?
 forceAuthentication=Forzar autenticación
 connectionPoolingHelp=Determina si Keycloak debe usar agrupación de conexiones para acceder al servidor LDAP. La agrupación de conexiones no puede usarse si StartTLS está habilitado.
 unlink=Desvincular
 groupRemove_other=Grupos eliminados
 claimFilterName=Reclamo esencial
 deletePolicy=¿Eliminar política permanentemente?
-assertionConsumerServiceRedirectBindingURLHelp=URL de Enlace de Redirección SAML para el servicio consumidor de afirmaciones (respuestas de inicio de sesión) del cliente. Puedes dejar esto en blanco si no tienes una URL para este enlace.
+assertionConsumerServiceRedirectBindingURLHelp=URL de Enlace de Redirección SAML para el servicio consumidor de afirmaciones (respuestas de inicio de sesión) del cliente. Puede dejar esto en blanco si no tiene una URL para este enlace.
 searchFor=Buscar rol por nombre
 providers=Añadir proveedores
 writeOnly=Solo escritura
-noRolesInstructions-clientScopes=No has creado roles para este alcance de cliente. Crea un rol para empezar.
-noRolesInstructions-clients=No has creado roles para este alcance de cliente. Crea un rol para empezar.
-removeImportedUsersMessage=¿Realmente quieres eliminar a todos los usuarios importados? La opción "Desvincular usuarios" tiene sentido solo para el Modo de Edición "No sincronizado" y debería haber una advertencia de que los usuarios "desvinculados" sin la contraseña en la base de datos de Keycloak no podrán autenticarse.
+noRolesInstructions-clientScopes=No ha creado ningún rol para este client scope. Cree un rol para comenzar.
+noRolesInstructions-clients=No ha creado ningún rol para este client scope. Cree un rol para comenzar.
+removeImportedUsersMessage=¿Está seguro de que desea eliminar a todos los usuarios importados?
 noGroupsInThisSubGroup=No hay grupos en este subgrupo
-validateUserObjectClasses=Debes ingresar una o más clases de objeto de usuario
+validateUserObjectClasses=Debe ingresar una o más clases de objeto de usuario
 encryptionAlgorithm=Algoritmo de cifrado
 requiredForLabel.users=Solo usuarios
 groupUpdated=Grupo actualizado
@@ -1455,7 +1451,7 @@ hideMetaData=Ocultar metadatos
 customAttribute=Atributo personalizado…
 themes=Temas
 clientType=Tipo de cliente
-addClientScope=Añadir alcance de cliente
+addClientScope=Agregar client scope
 notBeforeSuccess=¡Éxito! "No antes" establecido para el realm
 clientPoliciesSubTab=Subpestaña de políticas de cliente
 quickLoginCheckMilliSecondsHelp=Si ocurre un fallo de manera concurrente y demasiado rápido, se bloqueará al usuario.
@@ -1463,7 +1459,7 @@ unanimous=Unánime
 policy-name=El nombre de esta política.
 syncRegistrations=Sincronizar registros
 eventTypes.REMOVE_TOTP.name=Eliminar TOTP
-clientHelp=Selecciona el cliente que realiza esta solicitud de autorización. Si no se proporciona, las solicitudes de autorización se realizarán en función del cliente en el que te encuentres.
+clientHelp=Seleccione el cliente que realiza esta solicitud de autorización. Si no se proporciona, las solicitudes de autorización se realizarán en función del cliente en el que se encuentre.
 eventTypes.CLIENT_REGISTER_ERROR.name=Error al registrar el cliente
 unlockUsersError=No se pudieron desbloquear todos los usuarios {{error}}
 serviceProviderEntityIdHelp=El ID de Entidad que se utilizará para identificar de manera única a este Proveedor de Servicios SAML.
@@ -1472,21 +1468,21 @@ eventTypes.UPDATE_CONSENT_ERROR.name=Error al actualizar el consentimiento
 noAdminUrlSet=No se envió nada. No se configuró ningún URI de administrador o no hay nodos de clúster registrados disponibles
 authData=Datos de autorización
 realmInfo=Información del realm
-chooseAPolicyType=Elige un tipo de política
+chooseAPolicyType=Elija un tipo de política
 signOut=Cerrar sesión
-deleteExecutorError=No se pudo eliminar el ejecutor\: {{error}}
-userProfileError=No se pudo actualizar la configuración del perfil de usuario\: {{error}}
+deleteExecutorError=No se pudo eliminar el ejecutor: {{error}}
+userProfileError=No se pudo actualizar la configuración del perfil de usuario: {{error}}
 validatorDialogColNames.colName=Nombre de rol
-clientUpdaterSourceRolesTooltip=La condición se verifica durante las solicitudes de registro/actualización del cliente y se evalúa como verdadera si la entidad (generalmente el usuario) que está creando/actualizando el cliente es miembro del rol especificado. Para hacer referencia al rol del realm, puedes usar el nombre del rol del realm como 'mi_rol_de_realm'. Para hacer referencia al rol del cliente, puedes usar el client_id.nombre_del_rol, por ejemplo, 'mi_cliente.mi_rol_de_cliente' hará referencia al rol del cliente 'mi_rol_de_cliente' del cliente 'mi_cliente'.
+clientUpdaterSourceRolesTooltip=La condición se verifica durante las solicitudes de registro o actualización de clientes; se evalúa como verdadera si la entidad (generalmente un usuario) está creando o actualizando un cliente que pertenece al rol especificado. Para hacer referencia a un rol de reino, se puede usar el nombre del rol de reino, como 'mi_rol_reino'. Para hacer referencia a un rol de cliente, se puede usar el formato client_id.nombre_rol; por ejemplo, 'mi_cliente.mi_rol_cliente' hace referencia al rol de cliente 'mi_rol_cliente' del cliente 'mi_cliente'.
 UPDATE_PASSWORD=Actualizar contraseña (ACTUALIZAR_CONTRASEÑA)
 version=Versión
 synchronizationSettings=Configuraciones de sincronización
-certificateHelp=Certificado de cliente para validar JWT emitido por el cliente y firmado por la clave privada del cliente de tu almacén de claves.
-resetPasswordError=Error al restablecer la contraseña\: {{error}}
+certificateHelp=Certificado de cliente para validar JWT emitido por el cliente y firmado por la clave privada del cliente de su almacén de claves.
+resetPasswordError=Error al restablecer la contraseña: {{error}}
 associatedPermissions=Permiso asociado
-encryptionKeysConfigExplain=Si habilitas el "Cifrado de afirmaciones" a continuación, debes configurar las claves de cifrado generando o importando claves, y las afirmaciones SAML se cifrarán con la clave pública del cliente utilizando AES.
+encryptionKeysConfigExplain=Si habilita el "Cifrado de afirmaciones" a continuación, debe configurar las claves de cifrado generando o importando claves, y las afirmaciones SAML se cifrarán con la clave pública del cliente utilizando AES.
 preserveGroupInheritanceHelp=Indica si la herencia de grupos desde LDAP debe propagarse a Keycloak. Si es falso, todos los grupos LDAP se asignarán como grupos de nivel superior planos en Keycloak. De lo contrario, se conservará la herencia de grupos en Keycloak, pero la sincronización de grupos puede fallar si la estructura LDAP contiene recursiones o múltiples grupos padre por grupos hijos.
-createScopeBasedPermission=Crear permiso basado en alcance
+createScopeBasedPermission=Crear permiso basado en scope
 showMore=Mostrar más
 operationType=Tipo de operación
 userInitiatedActionLifespan=Tiempo de vida de la acción iniciada por el usuario
@@ -1494,8 +1490,8 @@ decisionStrategy=Estrategia de decisión
 roleMappingUpdatedSuccess=Mapeo de roles actualizado
 securityDefences=Defensas de seguridad
 realmSettings=Configuraciones del realm
-emptyStateInstructions=Si deseas agregar un grupo de atributos, haz clic en el botón a continuación.
-logoutAllSessionsError=¡Error\! No se pudo cerrar la sesión de todas las sesiones\: {{error}}.
+emptyStateInstructions=Si desea agregar un grupo de atributos, haga clic en el botón a continuación.
+logoutAllSessionsError=¡Error! No se pudo cerrar la sesión de todas las sesiones: {{error}}.
 eventTypes.VERIFY_EMAIL_ERROR.name=Error al verificar el correo electrónico
 partialExport=Exportación parcial
 eventTypes.CLIENT_REGISTER.description=Registro de cliente
@@ -1504,13 +1500,13 @@ decisionStrategies.AFFIRMATIVE=Afirmativa
 helpEnabled=Ayuda activada
 defaultGroupsHelp=Los grupos predeterminados te permiten asignar automáticamente la pertenencia a grupos cada vez que se crea o importa un usuario a través de <1>federación de identidad</1>.
 times.years=Años
-userLdapFilterHelp=Filtro LDAP adicional para filtrar los usuarios buscados. Déjalo vacío si no necesitas un filtro adicional. Asegúrate de que comience con '(' y termine con ')'.
+userLdapFilterHelp=Filtro LDAP adicional para filtrar los usuarios buscados. Déjelo vacío si no necesita un filtro adicional. Asegúrese de que comience con '(' y termine con ')'.
 generatedIdToken=Token de ID generado
 effectiveRoleScopeMappings=Mapeos de ámbito de roles efectivos
 clientAuthenticator=Autenticador de cliente
 importAdded_other={{count}} registros añadidos.
 oAuthDeviceCodeLifespanHelp=Tiempo máximo antes de que caduquen el código de dispositivo y el código de usuario. Este valor debe ser un tiempo de vida lo suficientemente largo para ser utilizable (permitiendo que el usuario recupere su dispositivo secundario, navegue a la URI de verificación, inicie sesión, etc.), pero suficientemente corto para limitar la utilidad de un código obtenido para el phishing.
-dynamicScopeHelp=Si está activado, este alcance se considerará un Alcance Dinámico, que estará compuesto por una porción estática y una variable.
+dynamicScopeHelp=Si está activado, este scope se considerará un Scope Dinámico, que estará compuesto por una porción estática y una variable.
 attributePermissionDescription=Esta sección contiene permisos sobre quién puede editar y quién puede ver el atributo.
 providerDetails=Detalles del proveedor
 groupDeleteError=Error al eliminar el grupo {{error}}
@@ -1519,14 +1515,14 @@ updateFirstLoginHelp=Actualizar perfil en el primer inicio de sesión
 deleteGroup=Eliminar grupo
 eventTypes.VERIFY_EMAIL_ERROR.description=Error al verificar el correo electrónico
 close=Cerrar
-usersDNHelp=DN completo del árbol LDAP donde se encuentran tus usuarios. Este DN es el padre de los usuarios LDAP. Podría ser, por ejemplo, 'ou\=usuarios,dc\=ejemplo,dc\=com' asumiendo que tu usuario típico tendrá un DN como 'uid\='john',ou\=usuarios,dc\=ejemplo,dc\=com'.
+usersDNHelp=DN completo del árbol LDAP donde existen sus usuarios. Este DN es el nodo principal de los usuarios en LDAP. Por ejemplo, podría ser 'ou=users,dc=example,dc=com', asumiendo que un usuario típico tendrá un DN como 'uid='john',ou=users,dc=example,dc=com'.
 addKeycloakOpenIdProvider=Añadir proveedor de conexión abierta Keycloak OpenID
 clientSessionMax=Sesión máxima de cliente
 deleteClientPolicy=Eliminar política de cliente
 authenticatorAttachment.cross-platform=Multiplataforma
 whoCanView=¿Quién puede ver?
 lastAccess=Último acceso
-emptyClientScopesInstructions=Actualmente no hay alcances de cliente vinculados a este cliente. Puedes agregar alcances de cliente existentes a este cliente para compartir mapeadores de protocolo y roles.
+emptyClientScopesInstructions=Actualmente, no hay client scopes vinculados a este cliente. Puede agregar client scopes existentes a este cliente para compartir asignadores de protocolos y roles.
 clientAuthentications.private_key_jwt=JWT firmado con clave privada
 uiDisplayName=Nombre de visualización de interfaz de usuario
 createClientSuccess=Cliente creado con éxito
@@ -1547,20 +1543,20 @@ exportFail=No se pudo exportar el realm: '{{error}}'
 flowTypeHelp=¿Qué tipo de formulario es?
 targetHelp=Campo de destino para el mapeador. LOCAL (predeterminado) significa que los cambios se aplican al nombre de usuario almacenado en la base de datos local al importar al usuario. BROKER_ID y BROKER_USERNAME significa que los cambios se almacenan en el ID o nombre de usuario utilizados para la búsqueda de usuarios federados, respectivamente.
 setPasswordConfirm=¿Establecer contraseña?
-attributeDisplayNameHelp=Nombre de visualización para el atributo. Admite claves para valores localizados. Por ejemplo\: ${profile.attribute.phoneNumber}.
+attributeDisplayNameHelp=Nombre de visualización para el atributo. Admite claves para valores localizados. Por ejemplo: ${profile.attribute.phoneNumber}.
 assignedType=Tipo asignado
-modeHelp=LDAP_ONLY significa que todos los mapeos de grupos de usuarios se recuperan de LDAP y se guardan en LDAP. READ_ONLY es el modo de solo lectura de LDAP donde los mapeos de grupos se recuperan tanto de LDAP como de la base de datos y se fusionan juntos. Las nuevas uniones de grupos no se guardan en LDAP sino en la base de datos. IMPORT es el modo de solo lectura de LDAP donde los mapeos de grupos se recuperan de LDAP justo en el momento en que el usuario se importa de LDAP y luego se guardan en la base de datos local de Keycloak.
+modeHelp=LDAP_ONLY significa que todas las asignaciones de grupos de los usuarios se recuperan desde LDAP y se guardan en LDAP. READ_ONLY es un modo de LDAP de solo lectura donde las asignaciones de grupos se recuperan tanto desde LDAP como desde la base de datos, y se combinan. Nuevas uniones a grupos no se guardan en LDAP, sino en la base de datos. IMPORT es un modo de LDAP de solo lectura donde las asignaciones de grupos se recuperan desde LDAP cuando el usuario es importado desde LDAP, y luego se guardan en la base de datos local de Keycloak.
 identityProvider=Proveedor de identidad
-forgotPasswordHelpText=Mostrar un enlace en la página de inicio de sesión para que el usuario haga clic cuando haya olvidado sus credenciales.
+forgotPasswordHelpText=Mostrar un enlace en la página de inicio de sesión para los usuarios que hayan olvidado sus credenciales.
 identityProviderLinks=Enlaces del proveedor de identidad
-mapperTypeMsadLdsUserAccountControlMapperHelp=Mapeador específico para MSAD LDS. Es capaz de integrar el estado de la cuenta de usuario MSAD LDS en el estado de la cuenta de Keycloak (cuenta habilitada, contraseña caducada, etc.). Utiliza msDS-UserAccountDisabled y si pwdLastSet es 0, se requerirá al usuario de Keycloak que actualice la contraseña, si msDS-UserAccountDisabled es 'TRUE', el usuario de Keycloak también estará deshabilitado, etc. El mapeador también puede manejar el código de excepción de la autenticación de usuario LDAP.
+mapperTypeMsadLdsUserAccountControlMapperHelp=Mapper específico para MSAD LDS. Es capaz de integrar el estado de las cuentas de usuario de MSAD LDS en el estado de las cuentas de Keycloak (cuenta habilitada, contraseña caducada, entre otros). Puede leer los atributos 'msDS-UserAccountDisabled', 'msDS-UserPasswordExpired' y 'pwdLastSet'. Por ejemplo, si 'pwdLastSet' es 0, se requerirá que el usuario de Keycloak actualice la contraseña. En otro ejemplo, si 'msDS-UserAccountDisabled' es 'TRUE', el usuario de Keycloak también será deshabilitado. Este mapper también es capaz de manejar códigos de excepción de la autenticación de usuario en LDAP.
 leave=Dejar
 loginSettings=Configuraciones de inicio de sesión
 deleteMessageBundleError=Error al eliminar el mensaje del conjunto, {{error}}
 finish=Finalizar
 eventTypes.LOGIN_ERROR.name=Error de inicio de sesión
 validations=Validaciones
-updatedRequiredActionError=No se pudo actualizar la acción requerida\: {{error}}
+updatedRequiredActionError=No se pudo actualizar la acción requerida: {{error}}
 createChildGroup=Crear grupo secundario
 x509Certificate=Certificado X509
 addressClaim.formatted.label=Nombre de atributo de usuario para dirección formateada
@@ -1576,22 +1572,22 @@ users=Usuarios
 keyTabHelp=Ubicación del archivo KeyTab de Kerberos que contiene las credenciales del principal del servidor. Por ejemplo, /etc/krb5.keytab
 wantAssertionsEncrypted=Quiero las afirmaciones encriptadas
 noClientPoliciesInstructions=No hay políticas de cliente. Selecciona 'Crear política de cliente' para crear una nueva política de cliente.
-deleteValidatorConfirmMsg=¿Estás seguro de que quieres eliminar permanentemente el validador {{validatorName}}?
+deleteValidatorConfirmMsg=¿Está seguro de que quiere eliminar permanentemente el validador {{validatorName}}?
 uris=URIs
 jwksUrlConfig=Configuraciones de URL JWKS
 forceNameIdFormatHelp=Ignorar el formato de sujeto NameID solicitado y usar el configurado en la interfaz de administración.
-validateKeyTab=Debes ingresar un archivo KeyTab
+validateKeyTab=Debe ingresar un archivo KeyTab
 editUsernameAllowed=Editar nombre de usuario permitido
 searchType.attribute=Búsqueda por atributo
-saveProviderError=Error al guardar el proveedor\: {{error}}
+saveProviderError=Error al guardar el proveedor: {{error}}
 port=Puerto
 searchForPermission=Buscar permiso
-ldapFilterHelp=El filtro LDAP agrega un filtro personalizado adicional a toda la consulta para recuperar grupos LDAP. Déjalo vacío si no necesitas filtrado adicional y deseas recuperar todos los grupos de LDAP. Asegúrate de que el filtro comience con '(' y termine con ')'.
-clientUpdaterSourceGroupsTooltip=Nombre de los grupos a verificar. La condición se evalúa como verdadera si la entidad que crea/actualiza el cliente es miembro de alguno de los grupos especificados. Los grupos configurados se especifican por su nombre simple, que debe coincidir con el nombre del grupo Keycloak. Aquí no se utiliza el soporte para la jerarquía de grupos.
+ldapFilterHelp=El filtro LDAP agrega un filtro personalizado adicional a toda la consulta para recuperar grupos LDAP. Déjelo vacío si no necesita filtrado adicional y desea recuperar todos los grupos de LDAP. Asegúrese que el filtro comience con '(' y termine con ')'.
+clientUpdaterSourceGroupsTooltip=Nombre de los grupos a verificar. La condición se evalúa como verdadera si la entidad que crea o actualiza el cliente es miembro de uno o más de los grupos especificados. Los grupos configurados se especifican por su nombre simple, que debe coincidir con el nombre del grupo en Keycloak. Aquí no se admite la jerarquía de grupos.
 addRequestUri=Agregar URIs de solicitud válidos
 selectACondition=Seleccionar una condición
 ldapAttributeValue=Valor de atributo LDAP
-jwksUrlHelp=URL donde se almacenan las claves del proveedor de identidad en formato JWK. Consulta la especificación JWK para más detalles. Si usas un proveedor de identidad de Keycloak externo, puedes usar una URL como 'http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs' asumiendo que tu Keycloak federado se ejecuta en 'http://broker-keycloak:8180' y su realm es 'test'.
+jwksUrlHelp=URL donde se almacenan las claves del proveedor de identidad en formato JWK. Consulte la especificación JWK para más detalles. Si utiliza un proveedor de identidad Keycloak externo, puede usar una URL como 'http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs', suponiendo que su Keycloak intermediario se ejecuta en 'http://broker-keycloak:8180' y su realm es 'test'.
 eventTypes.CLIENT_DELETE.description=Eliminar cliente
 emptyResources=No hay recursos
 roleHelp=Rol para otorgar al usuario si todos los atributos están presentes. Haz clic en 'Seleccionar rol' para buscar roles o simplemente escríbelo en el cuadro de texto. Para hacer referencia a un rol del cliente, la sintaxis es clientname.clientrole, por ejemplo, myclient.myrole.
@@ -1603,7 +1599,7 @@ displayOrder=Orden de visualización
 registrationAllowed=Registro de usuario permitido
 choose=Elegir...
 appliedByProviders=Aplicado por los siguientes proveedores
-saveEventListenersSuccess=El escucha de eventos ha sido actualizado.
+saveEventListenersSuccess=El oyente de eventos ha sido actualizado.
 eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Vincular cuenta de proveedor de identidad
 eventTypes.TOKEN_EXCHANGE.name=Intercambio de token
 skipped=Omitido
@@ -1611,21 +1607,21 @@ eventTypes.RESTART_AUTHENTICATION.description=Reiniciar autenticación
 scopePermissions.users.manage-group-membership-description=Políticas que deciden si un administrador puede gestionar la membresía de grupo para todos los usuarios en el realm. Esto se usa junto con la política de grupo específica
 loginTheme=Tema de inicio de sesión
 eventTypes.UPDATE_PASSWORD_ERROR.description=Error al actualizar la contraseña
-deleteConfirmRealmSetting=Si eliminas este realm, se eliminarán todos los datos asociados.
-scope=Alcance
-evaluateExplain=Esta página te permite ver todos los mapeadores de protocolo y mapeos de ámbito de roles
+deleteConfirmRealmSetting=Si elimina un realm, se eliminarán todos los datos asociados.
+scope=Scope
+evaluateExplain=Esta página le permite ver todos los mapeadores de protocolo y mapeos de ámbito de roles
 providerCreateError=No se pudo crear la política de cliente debido a {{error}}
 includeRepresentationHelp=Incluir representación JSON para solicitudes de creación y actualización.
-searchForClientScope=Buscar alcance de cliente
+searchForClientScope=Buscar client scope
 removeAttribute=Eliminar atributo
 deleteProviderSuccess=Éxito. El proveedor ha sido eliminado.
 sessionsType.offline=Fuera de línea
-validatorDeletedError=Error al guardar el perfil de usuario\: {{error}}
+validatorDeletedError=Error al guardar el perfil de usuario: {{error}}
 preserveGroupInheritance=Preservar herencia de grupo
-createClientScopeSuccess=Alcance de cliente creado
+createClientScopeSuccess=Client scope creado
 selectOrTypeAKey=Seleccionar o escribir una clave
 resourceDetails=Detalles del recurso
-authorizationScopes=Alcances de autorización
+authorizationScopes=Scopes de autorización
 fromDisplayNameHelp=Nombre amigable para la dirección 'De' (opcional).
 identityProviderEntityIdHelp=El ID de entidad usado para validar el Emisor en las afirmaciones SAML recibidas. Si está vacío, no se realiza ninguna validación de Emisor.
 noRoles-client=Sin roles para este cliente
@@ -1633,12 +1629,12 @@ eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Error al ejecutar el token de acción
 eventTypes.USER_INFO_REQUEST_ERROR.description=Error en la solicitud de información del usuario
 policyRoles=Especifica los roles de cliente permitidos por esta política.
 roleMapping=Mapeo de roles
-accountLinkingOnlyHelp=Si es verdadero, los usuarios no pueden iniciar sesión a través de este proveedor. Solo pueden vincularse a este proveedor. Es útil si no deseas permitir el inicio de sesión desde el proveedor, pero deseas integrarte con un proveedor.
+accountLinkingOnlyHelp=Si es verdadero, los usuarios no pueden iniciar sesión a través de este proveedor. Solo pueden vincularse a este proveedor. Es útil si no desea permitir el inicio de sesión desde el proveedor, pero desea integrarse con un proveedor.
 refreshTokenMaxReuseHelp=Número máximo de veces que un token de actualización puede ser reutilizado. Cuando se utiliza un token diferente, la revocación es inmediata.
 eventTypes.REMOVE_FEDERATED_IDENTITY.description=Eliminar identidad federada
 childGroups=Grupos secundarios
 eventTypes.IDENTITY_PROVIDER_LOGIN.name=Inicio de sesión de proveedor de identidad
-exportAuthDetailsError=Error al exportar detalles de autorización\: {{error}}
+exportAuthDetailsError=Error al exportar detalles de autorización: {{error}}
 clientOfflineSessionIdleHelp=Tiempo permitido para que una sesión de cliente fuera de línea esté inactiva antes de que expire. Los tokens fuera de línea se invalidan cuando expira una sesión de cliente fuera de línea. Esta opción no afecta la sesión global de SSO del usuario. Si no se establece, utiliza el valor de inactividad de la sesión fuera de línea del realm.
 selectGroups=Seleccionar grupos para unirse
 webAuthnPolicyAuthenticatorAttachmentHelp=Comunica a un autenticador un patrón de adjunto aceptable.
@@ -1647,8 +1643,8 @@ mappedGroupAttributes=Atributos de grupo mapeados
 localization=Localización
 importConfig=Importar configuración desde archivo
 replyToDisplayNameHelp=Nombre amigable para la dirección 'Responder a' (opcional).
-webAuthnPolicyRpIdHelp=Este es el ID como parte de la Relying Party de WebAuthn. Debe ser el dominio efectivo del origen.
-signingKeysConfigExplain=Si habilitas "Firma de cliente requerida" abajo, debes configurar las claves de firma generando o importando claves, y el cliente firmará sus solicitudes y respuestas SAML. La firma se validará.
+webAuthnPolicyRpIdHelp=El ID de la Parte Dependiente de WebAuthn (RpID). Debe ser el dominio efectivo del origen, por ejemplo, "company.com" o "auth.company.com".
+signingKeysConfigExplain=Si habilita la opción "Firma del cliente requerida" a continuación, deberá configurar las claves de firma generando o importando claves, y el cliente firmará sus solicitudes y respuestas SAML. La firma será validada.
 newClientProfile=Crear perfil de cliente
 consoleDisplayConnectionUrlHelp=URL de conexión a tu servidor LDAP
 enabledWhen=Habilitado cuando
@@ -1659,12 +1655,12 @@ fullScopeAllowedHelp=Te permite desactivar todas las restricciones.
 eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=Enviar error de vinculación de proveedor de identidad
 otpType=Tipo de OTP
 algorithm=Algoritmo
-grantedScopes=Alcances concedidos
+grantedScopes=Scopes concedidos
 groupNameLdapAttribute=Atributo de nombre de grupo LDAP
-deleteProviderConfirm=¿Estás seguro de que quieres eliminar permanentemente el proveedor de claves {{provider}}?
+deleteProviderConfirm=¿Está seguro que quiere eliminar permanentemente el proveedor de claves {{provider}}?
 removeConfirmTitle_one=¿Eliminar grupo?
 eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=Error de solicitud de autorización enviada
-includeInTokenScope=Incluir en el alcance del token
+includeInTokenScope=Incluir en el token del scope
 eventType=Tipo de evento guardado
 tokenDeleteConfirmTitle=¿Eliminar token de acceso inicial?
 useRefreshTokenForClientCredentialsGrant=Usar tokens de actualización para la concesión de credenciales del cliente
@@ -1674,36 +1670,36 @@ inputTypeStep=Tamaño de paso de entrada
 mapperTypeHelp=Usado para mapear un solo atributo del usuario LDAP a un atributo de UserModel en la base de datos de Keycloak
 importWarning=Los datos y configuraciones importados arriba pueden sobrescribir los datos y configuraciones que ya existen.
 kerberosRequiredSettingsDescription=Esta sección contiene algunas opciones básicas comunes a todos los proveedores de almacenamiento de usuarios.
-resetPasswordFor=Restablecer contraseña para {{username}}
+resetPasswordFor=Establecer contraseña para {{username}}
 duplicateEmailsAllowed=Permitir correos electrónicos duplicados
-deleteEventsConfirm=Si borras todos los eventos de este realm, todos los registros serán eliminados permanentemente de la base de datos
-noGroupsInThisRealmInstructions=No has creado ningún grupo en este realm. Crea un grupo para empezar.
+deleteEventsConfirm=Si borra todos los eventos de este realm, todos los registros serán eliminados permanentemente de la base de datos
+noGroupsInThisRealmInstructions=No ha creado ningún grupo en este realm. Cree un grupo para empezar.
 eventTypes.REMOVE_TOTP_ERROR.name=Error al quitar TOTP
 groupUpdateError=Error al actualizar el grupo {{error}}
 logoutAllSessions=Cerrar todas las sesiones
 membershipUserLdapAttribute=Atributo LDAP de usuario de membresía
-noKeysDescription=No has creado ninguna llave activa
+noKeysDescription=No ha creado ninguna llave activa
 rememberMeHelpText=Mostrar casilla de verificación en la página de inicio de sesión para permitir que el usuario permanezca conectado entre reinicios del navegador hasta que expire la sesión.
 eventTypes.UPDATE_EMAIL.name=Actualizar correo electrónico
-notBeforeHelp=Revocar cualquier token emitido antes de este tiempo para este cliente. Para aplicar la política, debes establecer primero una URL de administrador efectiva en la pestaña de Configuración.
+notBeforeHelp=Revocar cualquier token emitido antes de este tiempo para este cliente. Para aplicar la política, debe establecer primero una URL de administrador efectiva en la pestaña de Configuración.
 protocolTypes.saml=SAML
 idTokenSignatureAlgorithm=Algoritmo de firma del token de ID
-displayHeaderHintHelp=Un nombre amigable para el grupo que debe usarse al renderizar un grupo de atributos en formularios visibles para el usuario. Admite claves para valores localizados también. Por ejemplo\: ${profile.attribute.group.address}.
+displayHeaderHintHelp=Un nombre amigable para el grupo que debe usarse al renderizar un grupo de atributos en formularios visibles para el usuario. Admite claves para valores localizados también. Por ejemplo: ${profile.attribute.group.address}.
 providerInfo=Información del proveedor
 ssoServiceUrl=URL del servicio de inicio de sesión único (SSO)
 inputHelperTextAfter=Texto de ayuda (debajo) del campo de entrada
 appliedByClients=Aplicado por los siguientes clientes
-createFlowHelp=Puedes crear un flujo de nivel superior dentro de este formulario.
+createFlowHelp=Puede crear un flujo de nivel superior dentro de este formulario.
 defaultLocaleHelp=El idioma inicial a usar. Se usa en la pantalla de inicio de sesión y otras pantallas en la interfaz de administración y la interfaz de cuenta.
-deleteConfirmFlowMessage=¿Estás seguro de que quieres eliminar permanentemente el flujo "<1>{{flow}}</1>"?.
+deleteConfirmFlowMessage=¿Está seguro de que quiere eliminar permanentemente el flujo "<1>{{flow}}</1>"?.
 webAuthnPolicyAuthenticatorAttachment=Adjunto del autenticador de políticas de WebAuthn
-logoutServiceSoapBindingUrlHelp=URL de enlace SOAP de SAML para el servicio de cierre de sesión único del cliente. Puedes dejar esto en blanco si estás utilizando un enlace diferente.
+logoutServiceSoapBindingUrlHelp=URL de enlace SOAP de SAML para el servicio de cierre de sesión único del cliente. Puede dejar esto en blanco si está utilizando un enlace diferente.
 kerberos=Kerberos
-noNodesInstructions=No hay nodos registrados, puedes agregar uno manualmente.
+noNodesInstructions=No hay nodos registrados, puede agregar uno manualmente.
 login=Iniciar sesión
 eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=Error al recuperar token del proveedor de identidad
 local=Local
-noGroupsInThisSubGroupInstructions=No has creado ningún grupo en este subgrupo.
+noGroupsInThisSubGroupInstructions=No ha creado ningún grupo en este subgrupo.
 validatorColNames.colName=Nombre del validador
 userVerify.required=Requerido
 searchMembers=Buscar miembros
@@ -1716,12 +1712,12 @@ trustEmailHelp=Si está habilitado, el correo electrónico proporcionado por est
 editModeKerberosHelp=READ_ONLY significa que las actualizaciones de contraseña no están permitidas y el usuario siempre se autentica con la contraseña de Kerberos. UNSYNCED significa que el usuario puede cambiar la contraseña en la base de datos de Keycloak y esta será utilizada en lugar de la contraseña de Kerberos.
 invalidateRotatedSecretExplain=Después de invalidar el secreto rotado, el secreto rotado se eliminará automáticamente
 clientSessionMaxHelp=Tiempo máximo antes de que expire una sesión de cliente. Los tokens se invalidan cuando una sesión expira. Esta opción no afecta la sesión global de SSO del usuario. Si no se establece, utiliza el valor máximo estándar de la sesión de SSO.
-clientScopeDetails=Detalles del alcance del cliente
+clientScopeDetails=Detalles del client scope
 requiredHelp=Establecer el atributo como requerido. Si está habilitado, el atributo debe ser configurado por usuarios y administradores. De lo contrario, el atributo es opcional.
-clientScopeRemoveError=No se pudo quitar el mapeo de alcance {{error}}
+clientScopeRemoveError=No se pudo quitar el mapeo de scope {{error}}
 mapperTypeRoleLdapMapper=mapeador de roles LDAP
 testConnectionHint.withEmail=Al probar la conexión, se enviará un correo electrónico al usuario actual ({{email}}).
-adminURLHelp=URL de la interfaz de administración del cliente. Establécelo si el cliente admite la API REST del adaptador. Esta API REST permite al servidor de autenticación enviar políticas de revocación y otras tareas administrativas. Por lo general, se establece en la URL base del cliente.
+adminURLHelp=URL de la interfaz de administración del cliente. Establézcalo si el cliente admite la API REST del adaptador. Esta API REST permite al servidor de autenticación enviar políticas de revocación y otras tareas administrativas. Por lo general, se establece en la URL base del cliente.
 otpPolicyPeriodHelp=¿Cuántos segundos debe ser válido un token OTP? Por defecto, son 30 segundos.
 otpPolicyCodeReusableHelp=Posibilidad de utilizar el mismo código OTP nuevamente después de una autenticación exitosa.
 parentId=ID del padre
@@ -1737,8 +1733,8 @@ clientScopeSearch.type=Tipo asignado
 scopePermissions.groups.manage-membership-description=Políticas que deciden si un administrador puede agregar o quitar usuarios de este grupo
 resourceType=Tipo de recurso
 copied=Detalles de autorización copiados.
-scopeName=Un nombre único para este alcance. El nombre se puede utilizar para identificar un alcance de manera única, útil al buscar un alcance específico.
-userObjectClassesHelp=Todas los valores del atributo de objeto de clase LDAP para usuarios en LDAP, separados por comas. Por ejemplo\: 'inetOrgPerson, organizationalPerson'. Los usuarios de Keycloak recién creados se escribirán en LDAP con todas esas clases de objetos y los registros de usuario LDAP existentes se encuentran si contienen todas esas clases de objetos.
+scopeName=Un nombre único para este scope. El nombre se puede utilizar para identificar un scope de manera única, útil al buscar un scope específico.
+userObjectClassesHelp=Todas los valores del atributo de objeto de clase LDAP para usuarios en LDAP, separados por comas. Por ejemplo: 'inetOrgPerson, organizationalPerson'. Los usuarios de Keycloak recién creados se escribirán en LDAP con todas esas clases de objetos y los registros de usuario LDAP existentes se encuentran si contienen todas esas clases de objetos.
 userInfoUrlHelp=La URL de información del usuario. Esto es opcional.
 clientProfileSearch=Buscar
 addSavedTypes=Agregar tipos guardados
@@ -1749,7 +1745,7 @@ whoWillAppearPopoverTextUsers=Los grupos son jerárquicos. Cuando seleccionas Me
 mapperCreateError=Error al crear el mapeador: {{error}}
 resetBtn=Reiniciar
 mode=Modo
-kc.realm.name=Reino
+kc.realm.name=Realm
 userFedDisableConfirmTitle=¿Desactivar proveedor de federación de usuarios?
 impersonate=Suplantar
 eventTypes.CLIENT_REGISTER.name=Registro de cliente
@@ -1761,7 +1757,7 @@ always=Siempre
 pkceEnabledHelp=Usar PKCE (Prueba de intercambio de código de clave) para el aprovisionamiento de proveedores de identidad
 settings=Configuraciones
 webAuthnPolicyUserVerificationRequirement=Requisito de verificación de usuario de políticas de WebAuthn
-failureFactorHelp=¿Cuántos fallos antes de que se active la espera?.
+failureFactorHelp=Número de fallos antes de que se active la espera.
 unlinkAccountTitle=Desvincular cuenta de {{provider}}?
 noNodes=No hay nodos registrados
 singleLogoutServiceUrlHelp=La URL que debe utilizarse para enviar solicitudes de cierre de sesión.
@@ -1772,19 +1768,19 @@ noSessions=No hay sesiones
 clipboardCopyError=Error al copiar al portapapeles.
 storeTokens=Almacenar tokens
 usermodel.clientRoleMapping.rolePrefix.tooltip=Un prefijo para cada rol de cliente (opcional).
-deleteConfirmCurrentUser=¿Estás seguro de que quieres eliminar permanentemente este usuario?
+deleteConfirmCurrentUser=¿Está seguro que quiere eliminar permanentemente este usuario?
 eventTypes.CLIENT_REGISTER_ERROR.description=Error al registrar el cliente
-addClientScopesTo=Agregar alcances del cliente a {{clientName}}
+addClientScopesTo=Agregar client scopes a {{clientName}}
 x509=Nombre de sujeto X.509
 showDataBtn=Mostrar datos
-dedicatedScopeDescription=Alcance y mapeadores dedicados para este cliente
+dedicatedScopeDescription=Scope y mapeadores dedicados para este cliente
 Sunday=Domingo
 editMode=Modo de edición
 updatePasswordPolicySuccess=Políticas de contraseña actualizadas con éxito
 passwordHelp=Contraseña SMTP. Este campo puede obtener su valor del almacén, utiliza el formato ${vault.ID}.
-clientUpdaterContext=La condición verifica el contexto en el que se crea/actualiza el cliente para determinar si se aplica la política. Por ejemplo, verifica si el cliente se crea con la API REST de administración o el registro de cliente dinámico OIDC. Y para el último caso, si es un registro de cliente ANÓNIMO o un registro de cliente AUTENTICADO con un token de acceso inicial o un token de acceso de registro, etc.
+clientUpdaterContext=La condición verifica el contexto de cómo se crea o actualiza el cliente para determinar si se aplica la política. Por ejemplo, verifica si el cliente se creó con la API REST de administración o con el registro dinámico de cliente OIDC. En este último caso, verifica si es un registro de cliente ANÓNIMO o un registro de cliente AUTENTICADO con un token de acceso inicial o un token de acceso de registro, entre otros.
 removedGroupMembership=Membresía de grupo eliminada
-deleteScopeWarning=Los permisos a continuación serán eliminados cuando ya no sean utilizados por otros ámbitos de autorización\:
+deleteScopeWarning=Los permisos a continuación serán eliminados cuando ya no sean utilizados por otros ámbitos de autorización:
 compositeRoleOff=Desactivar rol compuesto
 fullSyncPeriod=Período de sincronización completa
 clientsExplain=Los clientes son aplicaciones y servicios que pueden solicitar la autenticación de un usuario.
@@ -1795,7 +1791,7 @@ defaultPasswordLabel=Mi contraseña
 mapperUserAttributeName=Nombre de atributo de usuario
 importClient=Importar cliente
 deleteMapperSuccess=Mapeador eliminado correctamente.
-scopeSaveError=No se pudo persistir el alcance de autorización debido a {{error}}
+scopeSaveError=No se pudo persistir el scopede autorización debido a {{error}}
 used.SPECIFIC_PROVIDERS=Proveedores específicos
 deletedSuccessIdentityProvider=Proveedor eliminado correctamente.
 reload=Recargar
@@ -1806,10 +1802,10 @@ tokens=Tokens
 createFlow=Crear flujo
 encryptAssertionsHelp=¿Deben encriptarse las afirmaciones SAML con la clave pública del cliente usando AES?
 oAuthDPoPHelp=Esto habilita el soporte para la demostración de tokens vinculados a la posesión (DPoP). Los tokens de acceso y de actualización están vinculados a la clave almacenada en el agente de usuario. Para demostrar la posesión de la clave, el agente de usuario debe enviar una prueba firmada junto con el token.
-unsavedChangesConfirm=Tienes cambios sin guardar. ¿Realmente quieres abandonar la página?
+unsavedChangesConfirm=Tiene cambios sin guardar. ¿Realmente quiere abandonar la página?
 disabledOff=Desactivado
 membershipLdapAttributeHelp=Nombre del atributo LDAP en el grupo, que se utiliza para mapeos de membresía. Por lo general, será 'member'. Sin embargo, cuando el 'Tipo de atributo de membresía' es 'UID', entonces 'Atributo LDAP de membresía' podría ser típicamente 'memberUid'.
-usersLeftError=No se pudieron eliminar usuarios del grupo\: {{error}}
+usersLeftError=No se pudieron eliminar usuarios del grupo: {{error}}
 addTypes=Agregar tipos
 pushedAuthorizationRequestRequiredHelp=Parámetro booleano que indica si el servidor de autorización acepta datos de solicitud de autorización solo a través del método de solicitud de autorización empujada.
 requirement=Requisito
@@ -1818,7 +1814,7 @@ minute=Minuto
 useJwksUrl=Usar URL de JWKS
 wantAssertionsSigned=Querer afirmaciones firmadas
 roleSaveSuccess=El rol ha sido guardado
-scopeParameter=Parámetro de alcance
+scopeParameter=Parámetro de scope
 unsigned=Sin firmar
 userGroupsRetrieveStrategy=Estrategia de recuperación de grupos de usuario
 addSubFlow=Agregar subflujo
@@ -1826,28 +1822,28 @@ validatingPublicKeyHelp=La clave pública en formato PEM que debe usarse para ve
 client-uris-must-match.label=Los URI de cliente deben coincidir
 webAuthnPolicyAcceptableAaguids=AAGUIDs aceptables
 noRoles-roles=No hay roles en este realm
-logoutServiceRedirectBindingURLHelp=URL de enlace de redireccionamiento de SAML para el servicio de cierre de sesión único del cliente. Puedes dejar esto en blanco si estás utilizando un enlace diferente.
-deleteMapperConfirm=¿Estás seguro de que quieres eliminar permanentemente el mapeador {{mapper}}?
+logoutServiceRedirectBindingURLHelp=URL de enlace de redireccionamiento de SAML para el servicio de cierre de sesión único del cliente. Puede dejar esto en blanco si está utilizando un enlace diferente.
+deleteMapperConfirm=¿Está seguro que quiere eliminar permanentemente el mapeador {{mapper}}?
 scopePermissions.roles.map-role-description=Políticas que deciden si un administrador puede asignar este rol a un usuario o grupo
 backchannelUrlInvalid=La URL de cierre de sesión de canal posterior no es una URL válida
 eventTypes.LOGIN.description=Inicio de sesión
 impersonateConfirm=¿Suplantar usuario?
-scopePermissions.clients.map-roles-client-scope-description=Políticas que deciden si un administrador puede aplicar roles definidos por este cliente al alcance del cliente de otro cliente
+scopePermissions.clients.map-roles-client-scope-description=Políticas que determinan si un administrador puede aplicar los roles definidos por este cliente al client scope de otro cliente
 accessTokenSuccess=Token de acceso regenerado
 includeInIdToken.tooltip=¿Debería agregarse la afirmación al token de ID?
 validRequestURIs=URIs de solicitud válidos
 allowPasswordAuthentication=Permitir autenticación de contraseña
 federationLinkHelp=UserStorageProvider de donde se importó este usuario almacenado localmente.
-validateUsernameLDAPAttribute=Debes ingresar un atributo de usuario LDAP
-pairwiseSubAlgorithmSalt.tooltip=Sal utilizada al calcular el identificador de sujeto en par. Si se deja en blanco, se generará una sal.
-waitIncrementSecondsHelp=Una vez alcanzado el umbral de fallos, ¿cuánto tiempo debe estar bloqueado el usuario?
+validateUsernameLDAPAttribute=Debe ingresar un atributo de usuario LDAP
+pairwiseSubAlgorithmSalt.tooltip=Salt utilizada al calcular el identificador de sujeto en par. Si se deja en blanco, se generará una salt.
+waitIncrementSecondsHelp=¿Cuánto tiempo debe bloquearse el usuario cuando se alcance el umbral de fallos?
 allowKerberosAuthentication=Permitir autenticación de Kerberos
-addressClaim.formatted.tooltip=Nombre del atributo de usuario, que se utilizará para mapear al subclaim 'formateado' dentro del claim 'dirección'. Por defecto, es 'formateado'.
+addressClaim.formatted.tooltip=Nombre del atributo de usuario que se usará para mapear al subclaim 'formatted' dentro del claim de token 'address'. Por defecto es 'formatted'.
 predefinedMappingDescription=Elegir uno de los mapeos predefinidos de esta tabla
 allowedClockSkew=Desviación de reloj permitida
 privateRSAKey=Llave privada RSA
 createPermission=Crear permiso
-moveToGroup=Mover {{grupo1}} a {{grupo2}}
+moveToGroup=Mover {{group1}} a {{group2}}
 noRealmRoles=No hay roles de realm
 events-disable-confirm=Si se deshabilita "Guardar eventos", los eventos posteriores no se mostrarán en el menú "Eventos"
 reqAuthnConstraints=Restricciones de contexto de autenticación solicitadas
@@ -1856,11 +1852,11 @@ addIdpMapperNameHelp=Nombre del mapeador.
 requirements.ALTERNATIVE=Alternativa
 claimFilterValueHelp=Valor del claim esencial (con soporte regex)
 credentialResetConfirm=Enviar correo electrónico
-permissionsEnabledHelp=Determina si los permisos detallados están habilitados para administrar este rol. Deshabilitarlos eliminará todos los permisos actuales configurados.
-consentScreenTextHelp=Texto que se mostrará en la pantalla de consentimiento cuando este alcance de cliente se agregue a algún cliente con consentimiento requerido. Por defecto, el nombre del alcance del cliente si no está completado.
+permissionsEnabledHelp=Determina si los permisos detallados están habilitados para gestionar este rol. Desactivarlos elimina todos los permisos actuales.
+consentScreenTextHelp=Texto que se mostrará en la pantalla de consentimiento cuando este client scope se agregue a algún cliente con consentimiento requerido. Por defecto, se usará el nombre del client scope si no se completa este campo.
 realmRolesList=Roles de realm
 roleList=Lista de roles
-kerberosRealm=Reino Kerberos
+kerberosRealm=Realm Kerberos
 scopePermissions.groups.manage-members-description=Políticas que deciden si un administrador puede administrar los miembros de este grupo
 consentRequiredHelp=Si está habilitado, los usuarios deben dar su consentimiento para el acceso del cliente.
 flow.direct\ grant=Flujo de concesión directa
@@ -1876,10 +1872,10 @@ downloadAdapterConfig=Descargar configuración del adaptador
 scopePermissions.clients.view-description=Políticas que deciden si un administrador puede ver este cliente
 allowEcpFlow=Permitir flujo ECP
 rsa=RSA
-setPasswordConfirmText=¿Estás seguro de que quieres establecer la contraseña para el usuario {{username}}?
+setPasswordConfirmText=¿Está seguro de que quiere establecer la contraseña para el usuario {{username}}?
 updateErrorIdentityProvider=No se pudo actualizar el proveedor {{error}}
 emptyProfiles=No hay perfiles de cliente configurados
-createClientProfileError=No se pudo crear el perfil del cliente\: '{{error}}'
+createClientProfileError=No se pudo crear el perfil del cliente: '{{error}}'
 usermodel.clientRoleMapping.clientId.tooltip=ID de cliente para mapeos de roles. Solo se agregarán roles de cliente de este cliente al token. Si no se establece esto, se agregarán roles de cliente de todos los clientes al token.
 targetOptions.local=LOCAL
 pkceMethodHelp=Método PKCE para usar
@@ -1887,20 +1883,20 @@ encryption=Cifrado
 addExecutorError=Ejecutor no creado: {{error}}
 scopePermissions.clients.manage-description=Políticas que deciden si un administrador puede administrar este cliente
 vendor=Proveedor
-roleRemoveAssociatedText=Esta acción eliminará {{rol}} de {{nombreRol}}. Todos los roles asociados a {{rol}} también se eliminarán.
+roleRemoveAssociatedText=Esta acción eliminará {{role}} de {{roleName}}. Todos los roles asociados a {{role}} también se eliminarán.
 disabled=Desactivado
 idpInitiatedSsoRelayState=Estado de retransmisión de SSO iniciado por IDP
 attribute=Atributo
-clientScopesConditionTooltip=La lista de alcances de cliente esperados. La condición se evalúa como verdadera si la solicitud de cliente especificada coincide con algunos de los alcances de cliente. También depende si debería ser alcance de cliente predeterminado u opcional según el 'Tipo de alcance' configurado.
+clientScopesConditionTooltip=La lista de client scopes esperados. La condición se evalúa como verdadera si la solicitud del cliente especificado coincide con algunos de los client scopes. También depende de si debe ser un client scope predeterminado u opcional según la propiedad de configuración 'Tipo de Ámbito'.
 timestamp=Fecha de creación
 principalAttributeHelp=Nombre o nombre amigable del atributo utilizado para identificar usuarios externos.
 nameIdPolicyFormat=Formato de política de NameID
 idpInitiatedSsoUrlName=Nombre de URL de SSO iniciado por IDP
 selectMethod=Seleccionar método
-deleteConfirmExecution=¿Eliminar ejecución?
+deleteConfirmExecution=¿Eliminar el flujo {{name}}?
 eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Error al validar el token de acceso
 xFrameOptions=Opciones de X-Frame
-scopeDescriptionHelp=Descripción del alcance del cliente
+scopeDescriptionHelp=Descripción del client scope
 deletedErrorRealmSetting=No se pudo eliminar el realm: {{error}}
 copyInitialAccessToken=Por favor, copie y pegue el token de acceso inicial antes de cerrar, ya que no se puede recuperar más tarde.
 consensus=Consenso
@@ -1919,7 +1915,7 @@ includeInIntrospection.label=Agregar a la introspección del token
 roleImportSuccess=Importación de rol exitosa
 tokenUrl=URL del token
 executionConfig=Configuración de {{name}}
-grantedClientScopes=Alcances de cliente concedidos
+grantedClientScopes=Client scopes otorgados
 keyError=Se debe proporcionar una clave.
 addAnnotationText=Agregar anotación
 helpToggleInfo=Este interruptor habilitará / deshabilitará parte de la información de ayuda en la interfaz de usuario. Incluye cualquier texto de ayuda, enlaces y ventanas emergentes.
@@ -1931,22 +1927,22 @@ allowRegexComparisonHelp=Si está DESACTIVADO, entonces el DN de sujeto del cert
 eventTypes.UPDATE_TOTP_ERROR.description=Error al actualizar TOTP
 titleEvents=Eventos
 signServiceProviderMetadata=Firmar metadatos del proveedor de servicios
-updateClientPoliciesError=El JSON proporcionado es incorrecto\: Token inesperado { en JSON
-acceptsPromptNoneHelp=Esto se utiliza junto con el Autenticador del Proveedor de Identidad o cuando kc_idp_hint apunta a este proveedor de identidad. En caso de que el cliente envíe una solicitud con prompt\=none y el usuario aún no esté autenticado, el error no se devolverá directamente al cliente, sino que la solicitud con prompt\=none se enviará a este proveedor de identidad.
+updateClientPoliciesError=No se pudo actualizar las políticas de cliente: {{error}}
+acceptsPromptNoneHelp=Esto se usa únicamente junto con el autenticador del proveedor de identidad o cuando kc_idp_hint apunta a este proveedor de identidad. Si ese cliente envía una solicitud con prompt=none y el usuario no está autenticado, el error no se devuelve directamente al cliente; la solicitud con prompt=none se reenvía a este proveedor de identidad.
 roleDetails=Detalles del rol
 eventTypes.USER_INFO_REQUEST.name=Solicitud de información del usuario
 clientScopeType.none=Ninguno
 results=Resultados
 userRolesRetrieveStrategyHelp=Especifica cómo recuperar roles de usuario. LOAD_ROLES_BY_MEMBER_ATTRIBUTE significa que los roles del usuario se recuperarán enviando una consulta LDAP para recuperar todos los roles donde 'miembro' sea nuestro usuario. GET_ROLES_FROM_USER_MEMBEROF significa que los roles del usuario se recuperarán del atributo 'memberOf' de nuestro usuario. O de los otros atributos especificados por 'Atributo LDAP de Miembro'. LOAD_ROLES_BY_MEMBER_ATTRIBUTE solo es aplicable en Active Directory y significa que los roles del usuario se recuperarán de manera recursiva con el uso de la extensión LDAP_MATCHING_RULE_IN_CHAIN LDAP.
-roleDeleteError=No se pudo eliminar el rol\: {{error}}
-selectScope=Seleccionar un alcance
+roleDeleteError=No se pudo eliminar el rol: {{error}}
+selectScope=Seleccionar un scope
 attributeDefaultValue=Valor predeterminado del atributo
 eventTypes.UPDATE_PASSWORD_ERROR.name=Error al actualizar contraseña
 addGroups=Agregar grupos
 offlineSessionIdle=Inactividad de sesión sin conexión
 mapperAttributeFriendlyName=Nombre amigable del atributo
 addProvider=Agregar proveedor
-readOnlyHelp=El atributo de solo lectura se importa de LDAP a UserModel, pero no se guarda de nuevo en LDAP cuando se actualiza el usuario en Keycloak.
+readOnlyHelp=Atributo de solo lectura que se importa de LDAP al UserModel, pero no se guarda de nuevo en LDAP cuando el usuario se actualiza en Keycloak.
 resourceDeletedError=No se pudo eliminar el recurso {{error}}
 backchannelLogoutUrl=URL de cierre de sesión de canal posterior
 requestObjectEncodingHelp=Algoritmo JWE, que el cliente necesita usar al cifrar el contenido del objeto de solicitud OIDC especificado por los parámetros 'solicitud' o 'request_uri'. Si se establece en 'cualquiera', se permite cualquier algoritmo.
@@ -1959,7 +1955,7 @@ disabledHelp=Un usuario deshabilitado no puede iniciar sesión.
 eventTypes.UPDATE_PROFILE_ERROR.name=Error al actualizar perfil
 adminThemeHelp=Selecciona un tema para la consola de administración.
 name=Nombre
-deleteConfirmDialog_other=¿Estás seguro de que quieres eliminar permanentemente {{count}} usuarios seleccionados
+deleteConfirmDialog_other=¿Está seguro de que quiere eliminar permanentemente {{count}} usuarios seleccionados?
 targetOptions.brokerUsername=NOMBRE_USUARIO_BROKER
 clientList=Clientes
 eventTypes.REGISTER_ERROR.description=Error al registrar
@@ -1971,16 +1967,16 @@ pagination=Paginación
 changeAuthenticatorConfirm=Si cambias el autenticador a {{clientAuthenticatorType}}, la base de datos de Keycloak se actualizará y es posible que necesites descargar una nueva configuración de adaptador para este cliente.
 import=Importar
 otpHashAlgorithm=Algoritmo de hash OTP
-importFail=Error al importar\: {{error}}
+importFail=Error al importar: {{error}}
 show=Mostrar
 description=Descripción
 alwaysReadValueFromLdap=Siempre leer el valor desde LDAP
 searchUserEventsBtn=Buscar eventos
 addressClaim.postal_code.tooltip=Nombre del atributo de usuario que se utilizará para mapear el subclaim 'código postal' dentro del claim 'dirección' del token. Por defecto, es 'código postal'.
 generatedUserInfoNo=No se generó la información del usuario
-allowed-client-scopes.label=Alcances de cliente permitidos
+allowed-client-scopes.label=Client scopes permitidos
 providerId=ID del Proveedor
-assignedClientScope=Alcance de cliente asignado
+assignedClientScope=Client scope asignado
 savePasswordSuccess=La contraseña se ha establecido con éxito.
 Tuesday=Martes
 idTokenEncryptionContentEncryptionAlgorithm=Algoritmo de cifrado de contenido de encriptación del ID del token
@@ -1991,11 +1987,10 @@ tableView=Vista de tabla
 addClientProfile=Agregar perfil de cliente
 maxFailureWaitSeconds=Espera máxima de falla
 userEventsRegistered=Eventos de usuario registrados
-renameAGroup=Renombrar grupo
 eventConfigError=No se pudo guardar la configuración del evento {{error}}
 confirmAccessTokenTitle=¿Regenerar token de acceso al registro?
 target=Objetivo
-impersonateConfirmDialog=¿Estás seguro de que quieres iniciar sesión como este usuario? Si este usuario está en el mismo realm que tú, tu sesión de inicio de sesión actual se cerrará antes de iniciar sesión como este usuario.
+impersonateConfirmDialog=¿Está seguro de que quiere iniciar sesión como este usuario? Si este usuario está en el mismo realm que usted, su sesión de inicio de sesión actual se cerrará antes de iniciar sesión como este usuario.
 alwaysDisplayInUI=Mostrar siempre en la interfaz de usuario
 protocolMapper=Protocolo...
 requiredSettings=Configuraciones requeridas
@@ -2003,8 +1998,8 @@ oneLevel=Nivel único
 userSaved=El usuario se ha guardado
 useRefreshTokens=Usar tokens de actualización
 standardFlowHelp=Esto habilita la autenticación estándar basada en redirecciones de OpenID Connect con código de autorización. En términos de las especificaciones de OpenID Connect u OAuth2, esto habilita el soporte del 'Flujo de Código de Autorización' para este cliente.
-clientDeleteConfirm=Si eliminas este cliente, se eliminarán todos los datos asociados.
-derFormattedHelp=Activa esto si el certificado está formateado en DER en LDAP y no en formato PEM.
+clientDeleteConfirm=Si elimina este cliente, se eliminarán todos los datos asociados.
+derFormattedHelp=Active esto si el certificado está formateado en DER en LDAP y no en formato PEM.
 eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=Proveedor de identidad posterior al inicio de sesión
 scopePermissions.users.view-description=Políticas que deciden si un administrador puede ver todos los usuarios en el realm
 ldapGeneralOptionsSettingsDescription=Esta sección contiene algunas opciones básicas comunes a todos los proveedores de almacenamiento de usuarios.
@@ -2014,7 +2009,7 @@ notBeforeClearedSuccess=¡Éxito! "No antes" borrado para el realm.
 policySaveError=No se pudo actualizar la política debido a {{error}}
 experimental=Experimental
 idTokenSignatureAlgorithmHelp=Algoritmo JWA utilizado para firmar los tokens ID.
-deleteResourceConfirm=Si eliminas este recurso, algunas permisiones se verán afectadas.
+deleteResourceConfirm=Si elimina este recurso, algunos permisos se verán afectadas.
 httpPostBindingResponse=Respuesta de enlace HTTP-POST
 tokenLifespan.inherited=Hereda de la configuración del realm
 saveEvents=Guardar eventos
@@ -2023,7 +2018,7 @@ policyEnforcementModeHelp=El modo de cumplimiento de la política dicta cómo se
 selectAUser=Seleccionar un usuario
 groupCreated=Grupo creado
 generateError=No se pudo generar un nuevo par de claves y certificado {{error}}
-testClusterSuccess=Verificado con éxito la disponibilidad para\: {{successNodes}}
+testClusterSuccess=Verificado con éxito la disponibilidad para: {{successNodes}}
 whoWillAppearLinkTextRoles=¿Quién aparecerá en esta lista de usuarios?
 attestationPreference.not\ specified=No especificado
 importConfigHelp=Importar metadatos de un descriptor de descubrimiento de IDP descargado.
@@ -2031,32 +2026,31 @@ targetClaim=Atributo de destino
 assignRole=Asignar rol
 accessSettings=Configuraciones de acceso
 updateFlowSuccess=Flujo actualizado con éxito
-xXSSProtectionHelp=Este encabezado configura el filtro contra scripting entre sitios (XSS) en tu navegador. Utilizando el comportamiento predeterminado, el navegador evitará la representación de la página cuando detecte un ataque XSS. <1>Más información</1>
 authenticatedAccessPolicies=Políticas de acceso autenticado
 addExecutor=Agregar ejecutor
 selectIfResourceExists=Si un recurso ya existe, especifica qué se debe hacer
 passwordPoliciesHelp.notEmail=La contraseña no puede coincidir con la dirección de correo electrónico del usuario.
-deleteAttributeGroupError=No se pudo eliminar el grupo de atributos de usuario\: {{error}}
+deleteAttributeGroupError=No se pudo eliminar el grupo de atributos de usuario: {{error}}
 trustEmail=Confianza en el correo electrónico
 credentialReset=Restablecimiento de credenciales
 eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Error en acción requerida personalizada
 deleteValidatorConfirmTitle=¿Eliminar validador?
-claimJsonType=Tipo JSON que se debe usar para poblar el claim json en el token. long, int, boolean, String y JSON son valores válidos.
+claimJsonType=Tipo de JSON que se debe usar para rellenar el claim JSON en el token. Los valores válidos son long, int, boolean, String y JSON.
 kc.client.network.ip_address=Dirección IPv4 del cliente
 signatureAndEncryption=Firma y encriptación
 reset=Restablecer
 hardcodedUserSessionAttribute=Cuando un usuario se importa desde un proveedor, codificar un valor a un atributo de sesión de usuario específico.
 conditionType=Tipo de condición
-multiValued=Indica si el atributo admite múltiples valores. Si es verdadero, la lista de todos los valores de este atributo se establecerá como claim. Si es falso, solo se establecerá el primer valor como claim
+multiValued=Indica si este atributo admite múltiples valores. Si es verdadero, la lista de todos los valores de este atributo se establece como claim. Si es falso, solo se establece el primer valor como claim.
 browse=Navegar
 duplicateEmailsHelpText=Permite que varios usuarios tengan la misma dirección de correo electrónico. Cambiar esta configuración también eliminará la caché del usuario. Se recomienda actualizar manualmente las restricciones de correo electrónico de los usuarios existentes en la base de datos después de desactivar el soporte para direcciones de correo electrónico duplicadas.
 importOverwritten_zero=No se sobrescribieron registros.
 usermodel.realmRoleMapping.rolePrefix.label=Prefijo de rol del realm
 eventTypes.GRANT_CONSENT.name=Conceder consentimiento
-noProvidersLinked=Ningún proveedor de identidad vinculado. Elige uno de la lista a continuación.
-testConnectionSuccess=¡Éxito\! Conexión SMTP exitosa. ¡Se envió el correo electrónico\!
+noProvidersLinked=Ningún proveedor de identidad vinculado. Elija uno de la lista a continuación.
+testConnectionSuccess=¡Éxito! Conexión SMTP exitosa. ¡Se envió el correo electrónico!
 samlSettings=Configuraciones SAML
-userFedDisableConfirm=Si desactivas este proveedor de federación de usuarios, no se considerará para consultas y los usuarios importados estarán deshabilitados y serán de solo lectura hasta que se habilite nuevamente el proveedor.
+userFedDisableConfirm=Si desactiva este proveedor de federación de usuarios, no se considerará para consultas y los usuarios importados estarán deshabilitados y serán de solo lectura hasta que se habilite nuevamente el proveedor.
 userSessionAttribute=Atributo de sesión de usuario
 enabled=Habilitado
 forgotPassword=Olvidé la contraseña
@@ -2065,7 +2059,7 @@ passwordPoliciesHelp.maxLength=El número máximo de caracteres permitidos en la
 passwordPoliciesHelp.maxAuthAge=La edad máxima de una autenticación con la cual se puede cambiar una contraseña sin reautenticación.
 moveGroupError=No se pudo mover el grupo {{error}}
 clientImportSuccess=Cliente importado exitosamente
-dragHelp=Presiona espacio o enter para comenzar a arrastrar, y usa las teclas de flecha para navegar hacia arriba o hacia abajo. Presiona enter para confirmar el arrastre, o cualquier otra tecla para cancelar la operación de arrastre.
+dragHelp=Presione espacio o enter para comenzar a arrastrar, y use las teclas de flecha para navegar hacia arriba o hacia abajo. Presione enter para confirmar el arrastre, o cualquier otra tecla para cancelar la operación de arrastre.
 startTime=Hora de inicio
 logicHelp=La lógica dicta cómo se debe tomar la decisión de la política. Si es 'Positivo', el efecto resultante (permitir o denegar) obtenido durante la evaluación de esta política se usará para tomar una decisión. Si es 'Negativo', se negará el efecto resultante, es decir, un permiso se convierte en una denegación y viceversa.
 allowRegexComparison=Permitir comparación de patrones regex
@@ -2075,7 +2069,7 @@ implicitFlowHelp=Esto habilita el soporte para la autenticación basada en redir
 user-events-cleared-error=No se pudieron borrar los eventos del usuario {{error}}
 eventTypes.IMPERSONATE_ERROR.name=Error de suplantación
 executorType=Tipo de ejecutor
-configureMappingDescription=Elige cualquiera de los mapeos de esta tabla
+configureMappingDescription=Elija cualquiera de los mapeos de esta tabla
 keystorePassword=Contraseña del almacén de claves
 mapperTypeHardcodedLdapRoleMapperHelp=Los usuarios importados de LDAP se agregarán automáticamente a este rol configurado.
 more={{count}} más
@@ -2086,26 +2080,26 @@ realmExplain=Un realm administra un conjunto de usuarios, credenciales, roles y
 inputHelperTextBefore=Texto de ayuda (arriba) del campo de entrada
 webAuthnPolicyExtraOrigins=Orígenes adicionales
 samlSignatureKeyName=Nombre de clave de firma SAML
-validateUsersDn=Debes ingresar el DN de los usuarios
+validateUsersDn=Debe ingresar el DN de los usuarios
 importError=No se pudo importar el certificado {{error}}
 logicType.negative=Negativo
 otpPolicy=Política OTP
-noRolesInstructions-groups=No has creado roles para este grupo. Crea un rol para comenzar.
+noRolesInstructions-groups=No ha creado roles para este grupo. Cree un rol para comenzar.
 cibaBackchannelTokenDeliveryMode=Modo de entrega de token de canal posterior CIBA
 validateAttributeName=La configuración de atributos sin nombre no está permitida.
 eventTypes.RESET_PASSWORD_ERROR.description=Error al restablecer la contraseña
 addUser=Agregar usuario
 eventTypes.REGISTER.description=Registrar
 includeAuthnStatementHelp=¿Debería incluirse una declaración especificando el método y la marca de tiempo en las respuestas de inicio de sesión?
-evaluateError=No se pudo evaluar debido a\: {{error}}
+evaluateError=No se pudo evaluar debido a: {{error}}
 iconUriHelp=Un URI que apunta a un icono.
 eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=Verificar código de usuario OAuth2 de dispositivo
 protocol=Protocolo
 permissionsScopeName=Nombre de ámbito de permisos
-validPostLogoutRedirectURIsHelp=Patrón URI válido al cual un navegador puede redirigir después de un cierre de sesión exitoso. Un valor de '+' o un campo vacío usará la lista de URIs de redirección válidos. Un valor de '-' no permitirá ningún URI de redirección posterior al cierre de sesión. Se permiten comodines simples como 'http\://ejemplo.com/*'. También se pueden especificar rutas relativas como /mi/ruta/relativa/*. Las rutas relativas son relativas a la URL raíz del cliente, o si no se especifica ninguna, se usa la URL raíz del servidor de autenticación.
+validPostLogoutRedirectURIsHelp=Patrón URI válido al que un navegador puede redirigir después de un cierre de sesión exitoso. Un valor de '+' o un campo vacío usa la lista de URIs de redirección válidas. Un valor de '-' no permite redirecciones posteriores al cierre de sesión. Se permiten comodines simples como 'http://example.com/'. También se puede especificar una ruta relativa, como /my/relative/path/. Las rutas relativas son relativas a la URL raíz del cliente; si no se especifica ninguna, se usa la URL raíz del servidor de autenticación.
 manageAccount=Administrar cuenta
 oauthDeviceAuthorizationGrant=Concesión de autorización de dispositivo OAuth 2.0
-copyFlowError=No se pudo duplicar el flujo\: {{error}}
+copyFlowError=No se pudo duplicar el flujo: {{error}}
 roleRemoveAssociatedRoleConfirm=¿Eliminar el rol asociado?
 httpPostBindingAuthnRequest=Vinculación HTTP-POST para la solicitud de autenticación
 includeInAccessToken.label=Agregar al token de acceso
@@ -2121,7 +2115,7 @@ userFederationExplain=La federación de usuarios proporciona acceso a bases de d
 emptyAuthorizationScopes=Sin ámbitos de autorización
 noDefaultGroups=Sin grupos predeterminados
 policyProvider.time=Define condiciones de tiempo para tus permisos.
-updateFlowError=No se pudo actualizar el flujo\: {{error}}
+updateFlowError=No se pudo actualizar el flujo: {{error}}
 valuePlaceholder=Escribe un valor
 usersLeft_other={{count}} usuarios dejaron el grupo
 updateClientContext=Actualizar contexto del cliente
@@ -2131,9 +2125,9 @@ mappers=Mapeadores
 attributeGeneralSettingsDescription=Esta sección contiene algunas configuraciones básicas comunes a todos los atributos.
 name-id-format=Formato de ID de nombre
 deleteRealm=Eliminar realm
-noRoles-clientScopes=Sin roles para este alcance de cliente
-noRoles-clients=Sin roles para este alcance de cliente
-deleteFlowError=No se pudo eliminar el flujo\: {{error}}
+noRoles-clientScopes=No hay roles para este client scope
+noRoles-clients=No hay roles para este client scope
+deleteFlowError=No se pudo eliminar el flujo: {{error}}
 eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Proveedor de identidad posterior al inicio de sesión
 roleImportError=No se pudo importar el rol
 regexAttributeValuesHelp=Si se habilita, los valores de atributo se interpretan como expresiones regulares.
@@ -2141,76 +2135,75 @@ userCreated=El usuario ha sido creado
 residentKey.not\ specified=No especificado
 clientUpdaterSourceHost=La condición verifica el host/dominio de la entidad que intenta crear/actualizar el cliente para determinar si se aplica la política.
 alwaysReadValueFromLdapHelp=Si está activado, durante la lectura del valor del atributo LDAP, se utilizará siempre el valor en lugar del valor de la base de datos de Keycloak.
-usermodel.clientRoleMapping.tokenClaimName.tooltip=Nombre del claim para insertar en el token. Esto puede ser un nombre completamente calificado como 'address.street'. En este caso, se creará un objeto JSON anidado. Para evitar la anidación y usar el punto literalmente, escapa el punto con barra invertida (\\.). Se puede usar el token especial ${client_id} y esto se reemplazará por el ID de cliente real. Un uso de ejemplo es 'resource_access.${client_id}.roles'. Esto es útil especialmente cuando estás agregando roles de todos los clientes (por lo tanto, el interruptor 'ID de cliente' no está configurado) y quieres que los roles del cliente de cada cliente se almacenen por separado.
+usermodel.clientRoleMapping.tokenClaimName.tooltip=Nombre del claim para insertar en el token. Puede ser un nombre completamente calificado como 'address.street'. En este caso, se crea un objeto JSON anidado. Para evitar la anidación y usar el punto literalmente, escápelo con una barra invertida (.). Puede usar el token especial ${client_id}, que será reemplazado por el ID de cliente actual. Un ejemplo de uso es 'resource_access.${client_id}.roles'. Esta opción es especialmente útil cuando agrega roles de todos los clientes, es decir, 'Client ID' está deshabilitado y desea que los roles de cada cliente se almacenen por separado.
 scopePermissions.clients.map-roles-description=Políticas que deciden si un administrador puede mapear roles definidos por este cliente
 signAssertions=Firmar declaraciones
-disableUserInfoHelp=¿Deshabilitar el uso del servicio de Información de Usuario para obtener información adicional del usuario? Por defecto, se utiliza este servicio OIDC.
+disableUserInfoHelp=¿Deshabilitar el uso del servicio de información de usuario para obtener información adicional del usuario? De manera predeterminada, se utiliza este servicio OIDC.
 xFrameOptionsHelp=El valor predeterminado evita que las páginas sean incluidas por iframes no originados. <1>Más información</1>
-copyError=Error al copiar detalles de autorización\: {{error}}
+copyError=Error al copiar detalles de autorización: {{error}}
 validateSignatures=Habilitar/deshabilitar la validación de firmas de respuestas SAML.
 authentication=Autenticación
 eventTypes.DELETE_ACCOUNT.name=Eliminar cuenta
-logoutUrlHelp=Endpoint de finalización de sesión a utilizar para cerrar sesión del usuario desde IDP externo.
-noUserDetails=No hay detalles de usuario
+logoutUrlHelp=Endpoint de cierre de sesión para usar al cerrar la sesión del usuario en el IDP externo.
+noUserDetails=No hay detalles del usuario
 sync-ldap-groups-to-keycloak=Sincronizar grupos LDAP a Keycloak
 attestationPreference.indirect=Indirecto
 frontchannelUrlInvalid=La URL de cierre de sesión de front-channel no es una URL válida
-noCredentialsText=Este usuario no tiene credenciales. Puedes establecer una contraseña para este usuario.
-deletePolicyWarning=Las políticas agregadas a continuación se eliminarán automáticamente\:
+noCredentialsText=Este usuario no tiene credenciales. Puede establecer una contraseña para este usuario.
+deletePolicyWarning=Las políticas agregadas a continuación se eliminarán automáticamente:
 validatingPublicKey=Clave pública de validación
-permissionsListIntro=Edita la lista de permisos haciendo clic en el nombre del ámbito. Luego se redirige a los detalles de permisos del cliente denominado <1>{{realm}}</1>
+permissionsListIntro=Edite la lista de permisos haciendo clic en el nombre del scope. Luego, será redirigido a la página de detalles de permisos del cliente llamado <1>{{realm}}</1>
 deleteClientConditionSuccess=Condición eliminada con éxito.
 signatureAlgorithm=Algoritmo de firma
-deleteConfirmIdentityProvider=¿Estás seguro de que quieres eliminar permanentemente el proveedor '{{provider}}'?
+deleteConfirmIdentityProvider=¿Está seguro que quiere eliminar permanentemente el proveedor '{{provider}}'?
 resetActions=Restablecer acciones
 cibaExpiresInHelp=El tiempo de caducidad del "auth_req_id" en segundos desde que se recibió la solicitud de autenticación.
 eventTypes.CLIENT_INFO_ERROR.description=Error de información del cliente
 batchSize=Tamaño del lote
 user=Usuario
 scopesAsRequested=Los ámbitos son solicitados
-updateErrorClientScope=No se pudo actualizar el ámbito del cliente\: '{{error}}'
+updateErrorClientScope=No se pudo actualizar el client scope: '{{error}}'
 eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=Verificar código de usuario de dispositivo OAuth2
 useKerberosForPasswordAuthentication=Usar Kerberos para autenticación de contraseña
-validateUuidLDAPAttribute=Debes ingresar un atributo LDAP UUID
-client-scopes-condition.tooltip=La lista de ámbitos de cliente esperados. La condición se evalúa como verdadera si la solicitud de cliente especificada coincide con algunos de los ámbitos de cliente. También depende de si debe ser un ámbito de cliente predeterminado u opcional según el 'Tipo de Ámbito' configurado.
+validateUuidLDAPAttribute=Debe ingresar un atributo LDAP UUID
+client-scopes-condition.tooltip=La lista de client scopes esperados. La condición se evalúa como verdadera si la solicitud del cliente especificado coincide con algunos de los client scopes. También depende de si debe ser un client scope predeterminado u opcional según la propiedad de configuración 'Tipo de Ámbito'.
 rootURLHelp=URL raíz añadida a URLs relativas
 anonymousAccessPolicies=Políticas de acceso anónimo
 createResourceBasedPermission=Crear permiso basado en recurso
 searchForRole=Buscar rol
-xXSSProtection=X-XSS-Protection
 debugHelp=Habilitar/deshabilitar el registro de depuración en la salida estándar para Krb5LoginModule.
 validatorColNames.colConfig=Configuración
 createClient=Crear cliente
 inputTypeRows=Filas de tipo de entrada
 eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Primer inicio de sesión del proveedor de identidad
 usedMemory=Memoria utilizada
-validatePasswordPolicyHelp=Determina si Keycloak debe validar la contraseña con la política de contraseña del realm antes de actualizarla. En el caso de que la contraseña del usuario esté guardada en LDAP, algunas políticas de contraseña de Keycloak no funcionarán (No utilizada recientemente, Expirar contraseña, Iteraciones de hash, Algoritmo de hash) debido al hecho de que Keycloak no tiene control directo sobre el almacenamiento de la contraseña. Es necesario habilitar las políticas de contraseña en el nivel del servidor LDAP si quieres aprovechar esas políticas de contraseña.
-quickLoginCheckMilliSeconds=Milisegundos de comprobación de inicio de sesión rápido
+validatePasswordPolicyHelp=Determina si Keycloak debe validar la contraseña con la política de contraseñas del realm antes de actualizarla. Cuando la contraseña del usuario se guarda en LDAP, algunas políticas de contraseña de Keycloak no funcionan: No recientemente usada, Expiración de contraseña, Iteraciones de hash y Algoritmo de hash. Esta situación ocurre porque Keycloak no tiene control directo sobre el almacenamiento de contraseñas. Si desea usar esas políticas, habilite las políticas de contraseñas en el nivel del servidor LDAP.
+quickLoginCheckMilliSeconds=Comprobación rápida de inicio de sesión en milisegundos
 createResourceSuccess=Recurso creado con éxito
 documentation=Documentación
 fullNameLdapReadOnlyHelp=Para Solo lectura, los datos se importan de LDAP a la base de datos de Keycloak, pero no se guardan de vuelta en LDAP cuando el usuario se actualiza en Keycloak.
-roleExplain=Los roles de realm son los roles que defines para usar en el realm actual.
+roleExplain=Los roles de realm son los roles que define para usar en el realm actual.
 whatIsDefaultGroups=¿Cuál es la función de los grupos predeterminados?
 transient=Transitorio
 generalSettings=Configuraciones generales
-addClientProfileError=No se pudo crear el perfil del cliente\: '{{error}}'
+addClientProfileError=No se pudo crear el perfil del cliente: '{{error}}'
 overallResults=Resultados generales
-requiredUserActionsHelp=Requerir una acción cuando el usuario inicia sesión. 'Verificar correo electrónico' envía un correo electrónico al usuario para verificar su dirección de correo electrónico. 'Actualizar perfil' requiere que el usuario ingrese nueva información personal. 'Actualizar contraseña' requiere que el usuario ingrese una nueva contraseña. 'Configurar OTP' requiere la configuración de un generador de contraseñas móviles.
-requestObjectSignatureAlgorithmHelp=Algoritmo JWA que el cliente necesita usar al enviar el objeto de solicitud OIDC especificado por los parámetros 'request' o 'request_uri'. Si se establece en 'any', el objeto de solicitud puede estar firmado por cualquier algoritmo (incluido 'none').
+requiredUserActionsHelp=Requerir una acción cuando el usuario inicia sesión. 'Verificar correo electrónico' envía un correo al usuario para confirmar su dirección. 'Actualizar perfil' solicita nueva información personal. 'Actualizar contraseña' pide una nueva contraseña. 'Configurar OTP' requiere configurar un generador de contraseñas móviles.
+requestObjectSignatureAlgorithmHelp=Algoritmo JWA que el cliente debe usar al enviar un objeto de solicitud OIDC especificado por los parámetros 'request' o 'request_uri'. Si se establece en 'any', el objeto de solicitud puede ser firmado por cualquier algoritmo (incluido 'none').
 ldapKerberosSettingsDescription=Esta sección contiene opciones útiles para la integración de Kerberos. Esto se usa solo cuando el servidor LDAP se usa junto con Kerberos/SPNEGO para la autenticación de usuario.
 deleteEvents=Borrar eventos
 termsOfServiceUrlHelp=URL que el Cliente Relying Party proporciona al Usuario Final para leer acerca de los términos de servicio del Cliente Relying Party
-clientSecretError=No se pudo regenerar el secreto del cliente debido a\: {{error}}
+clientSecretError=No se pudo regenerar el secreto del cliente debido a: {{error}}
 resourcePath=Ruta del recurso
-useJwksUrlHelp=Si el interruptor está activado, las claves públicas del proveedor de identidad se descargarán desde la URL JWKS proporcionada. Esto permite una gran flexibilidad porque las nuevas claves siempre se volverán a descargar cuando el proveedor de identidad genere un nuevo par de claves. Si el interruptor está desactivado, se usará la clave pública (o certificado) de la base de datos de Keycloak, por lo que cuando cambie el par de claves del proveedor de identidad, siempre debes importar la nueva clave a la base de datos de Keycloak también.
+useJwksUrlHelp=Si el interruptor está activado, las claves públicas del proveedor de identidad se descargan desde una URL JWKS dada. Esto brinda gran flexibilidad porque las nuevas claves se descargan nuevamente cuando el proveedor de identidad genera un nuevo par de claves. Si el interruptor está desactivado, se usa una clave pública (o certificado) de la base de datos de Keycloak; por lo tanto, cuando cambia el par de claves del proveedor de identidad, debe importar la nueva clave nuevamente en la base de datos de Keycloak.
 mapperTypeHardcodedAttributeMapperHelp=Este mapeador codificará cualquier atributo de usuario del modelo y alguna propiedad (como emailVerified o enabled) al importar usuarios desde LDAP.
 downloadAdaptorTitle=Descargar configuraciones del adaptador
 client-roles.label=Roles de cliente
 keysFilter.PASSIVE=Claves pasivas
 revocation=Revocación
-scopeTypeHelp=Ámbitos de cliente, que se agregarán como ámbitos predeterminados a cada cliente creado
+scopeTypeHelp=Client scopes, que se agregarán como client scopes predeterminados a cada cliente creado
 search=Buscar
-validateEditMode=Debes seleccionar un modo de edición
+validateEditMode=Debe seleccionar un modo de edición
 copyFlowSuccess=Flujo duplicado con éxito
 cacheSettings=Configuraciones de caché
 searchForClient=Buscar cliente
@@ -2222,9 +2215,9 @@ algorithmHelp=Algoritmo previsto para la clave
 importFile=Importar archivo
 userVerify.discouraged=Desaconsejado
 ldapRolesDn=DN de roles LDAP
-displayOnClientHelp=Aplicable solo si 'Consentimiento requerido' está activado para este cliente. Si este interruptor está desactivado, la pantalla de consentimiento contendrá solo los consentimientos correspondientes a los ámbitos de cliente configurados. Si está activado, también habrá un elemento en la pantalla de consentimiento sobre este cliente en sí.
+displayOnClientHelp=Aplicable solo si 'Consentimiento Requerido' está activado para este cliente. Si este interruptor está desactivado, la pantalla de consentimiento solo contendrá los consentimientos correspondientes a los client scopes configurados. Si está activado, también habrá un ítem en la pantalla de consentimiento sobre este cliente en sí.
 requestObjectRequired=Objeto de solicitud requerido
-protocolHelp=Qué configuración de protocolo SSO está siendo suministrada por este ámbito de cliente
+protocolHelp=Configuración del protocolo SSO proporcionada por este client scope
 prompts.none=Ninguno
 resourcesHelp=Especifica que este permiso debe aplicarse a una instancia de recurso específica.
 passwordConfirmation=Confirmación de contraseña
@@ -2234,24 +2227,24 @@ noRoles=Sin roles para este usuario
 createAttribute=Crear atributo
 Thursday=Jueves
 importOverwritten_one=Un registro sobrescrito.
-tokenDeleteError=No se pudo eliminar el token de acceso inicial\: '{{error}}'
+tokenDeleteError=No se pudo eliminar el token de acceso inicial: '{{error}}'
 eventTypes.REGISTER_NODE_ERROR.name=Error al registrar nodo
 isMandatoryInLdap=Es obligatorio en LDAP
 discoveryEndpoint=Endpoint de descubrimiento
 claimValue=Valor de reclamo
 eventTypes.FEDERATED_IDENTITY_LINK.name=Enlace de identidad federada
-authenticationHelp=Esto define el tipo de cliente OIDC. Cuando está ENCENDIDO, el tipo OIDC se establece como tipo de acceso confidencial. Cuando está APAGADO, se establece como tipo de acceso público.
-deleteClientConditionError=Error al crear la condición\: {{error}}
+authenticationHelp=Este interruptor define el tipo de cliente OIDC. Cuando está activado, el tipo es acceso confidencial. Cuando está desactivado, el tipo es acceso público.
+deleteClientConditionError=Error al crear la condición: {{error}}
 noMappers=Sin mapeadores
 couldNotLinkIdP=No se pudo vincular el proveedor de identidad {{error}}
 otpPolicyPeriod=Período del token OTP
 managePriorities=Gestionar prioridades
 createClientPolicySuccess=Nueva política creada
-frontendUrlHelp=Establece la URL de frontend para el realm. Úsalo en combinación con el proveedor de nombres de host predeterminado para anular la URL base para solicitudes de frontend para un realm específico.
+frontendUrlHelp=Establece la URL de frontend para el realm. Úselo en combinación con el proveedor de nombres de host predeterminado para anular la URL base para solicitudes de frontend para un realm específico.
 used.notInUse=No en uso
 emailSettings=Configuraciones de correo electrónico
 samlEntityDescriptorHelp=Te permite cargar metadatos externos del proveedor de identidad desde un archivo de configuración o descargarlo desde una URL.
-generatedIdTokenHelp=Consulta el ejemplo de ID Token, que se generará y enviará al cliente cuando el usuario seleccionado sea autenticado. Puedes ver los claims y roles que contendrá el token según los mapeos de protocolo efectivos, las asignaciones de alcance de roles, y también según los claims y roles asignados al usuario en cuestión.
+generatedIdTokenHelp=Vea el ejemplo de ID Token, que se generará y enviará al cliente cuando el usuario seleccionado sea autenticado. Puede ver las claims y roles que contendrá el token según los mapeadores de protocolo efectivos y las asignaciones de roles en el scope, así como también según las claims y roles asignados al usuario actual.
 createClientProfile=Crear perfil de cliente
 passwordPoliciesHelp.specialChars=El número de caracteres especiales requeridos en la cadena de contraseña.
 cachePolicy=Política de caché
@@ -2261,12 +2254,12 @@ eventListeners=Escuchadores de eventos
 bindDn=DN de vinculación
 evictionHourHelp=Hora del día en la que la entrada se volverá inválida
 permissionDetails=Detalles de permisos
-clipboardCopyDenied=Tú navegador está bloqueando el acceso al portapapeles.
+clipboardCopyDenied=Sú navegador está bloqueando el acceso al portapapeles.
 Friday=Viernes
 saveProviderListSuccess=La prioridad del proveedor se ha actualizado correctamente.
 copyToClipboard=Copiar al portapapeles
-wantAuthnRequestsSigned=¿Deseas que las solicitudes de autenticación (AuthnRequests) estén firmadas?
-usermodel.attr.tooltip=Nombre del atributo de usuario almacenado que es el nombre de un atributo dentro del mapa de atributos de UserModel.
+wantAuthnRequestsSigned=¿Desea que las solicitudes de autenticación (AuthnRequests) estén firmadas?
+usermodel.attr.tooltip=Nombre del atributo de usuario almacenado, que es el nombre de un atributo dentro del mapa UserModel.attribute.
 clientPoliciesProfiles=Perfiles de Políticas de Cliente
 eventTypes.SEND_VERIFY_EMAIL.name=Enviar correo electrónico de verificación
 requiredForLabel.both=Ambos usuarios y administradores
@@ -2278,23 +2271,23 @@ clientUpdaterSourceRolesHelp=La condición verifica el rol de la entidad que int
 userModelAttributeName=Nombre del atributo del modelo de usuario
 importResourceError=No se pudo importar el recurso debido a {{error}}
 dynamicScope=Ámbito dinámico
-mapperTypeHardcodedLdapRoleMapper=mapeador-de-roles-ldap-incrustado
-validateName=Debes ingresar un nombre
+mapperTypeHardcodedLdapRoleMapper=Mapeador de roles LDAP codificado
+validateName=Debe ingresar un nombre
 flowDetails=Detalles del flujo
 never=Nunca
 includeInIntrospection.tooltip=¿Debería añadirse el reclamo a la introspección del token?
 addressClaim.region.tooltip=Nombre del atributo de usuario que se utilizará para asignar al sub-reclamo 'región' dentro del reclamo 'dirección'. Por defecto, es 'región'.
-IDK-periodicChangedUsersSyncHelp=¿Deben crearse los usuarios recién creados dentro del almacenamiento LDAP? La prioridad afecta qué proveedor se elige para sincronizar el nuevo usuario.
-logoutServiceArtifactBindingUrlHelp=URL de Enlace de ARTIFACTO SAML para el servicio de cierre de sesión único del cliente. Puedes dejar esto en blanco si estás usando un enlace diferente.
+IDK-periodicChangedUsersSyncHelp=¿Deben los usuarios recién creados crearse en el almacén LDAP? La prioridad afecta a qué proveedor se elige para sincronizar al nuevo usuario.
+logoutServiceArtifactBindingUrlHelp=URL de Enlace de ARTIFACTO SAML para el servicio de cierre de sesión único del cliente. Puede dejar esto en blanco si está usando un enlace diferente.
 claimToRole=Si existe un reclamo, otorga al usuario el rol de realm o cliente especificado.
 logoutServicePostBindingURL=URL de Enlace POST del servicio de cierre de sesión
 eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=Error al eliminar la identidad federada
-assertionConsumerServicePostBindingURLHelp=URL de Enlace POST de SAML para el servicio de consumidor de declaración del cliente (respuestas de inicio de sesión). Puedes dejar esto en blanco si no tienes una URL para este enlace.
-createAuthorizationScope=Crear alcance de autorización
+assertionConsumerServicePostBindingURLHelp=URL de Enlace POST de SAML para el servicio de consumidor de declaración del cliente (respuestas de inicio de sesión). Puede dejar esto en blanco si no tiene una URL para este enlace.
+createAuthorizationScope=Crear scope de autorización
 noGroups=Sin grupos
-backchannelLogoutRevokeOfflineSessionsHelp=Especificar si un evento "revoke_offline_access" se incluye en el Token de Cierre de Sesión cuando se usa la URL de Cierre de Sesión de Backchannel. Keycloak revocará las sesiones sin conexión al recibir un Token de Cierre de Sesión con este evento.
+backchannelLogoutRevokeOfflineSessionsHelp=Especifica si se incluye un evento "revoke_offline_access" en el Logout Token cuando se utiliza la URL de Logout Backchannel. Keycloak revocará las sesiones offline al recibir un Logout Token con este evento.
 roleID=ID de Rol
-roleNameLdapAttributeHelp=Nombre del atributo LDAP, que se utiliza en objetos de rol para el nombre y RDN del rol. Por lo general, será 'cn'. En este caso, un objeto de grupo/rol típico puede tener un DN como 'cn\=rol1,ou\=finanzas,dc\=ejemplo,dc\=org'.
+roleNameLdapAttributeHelp=Nombre del atributo LDAP, que se utiliza en objetos de rol para el nombre y RDN del rol. Por lo general, será 'cn'. En este caso, un objeto de grupo/rol típico puede tener un DN como 'cn=rol1,ou=finanzas,dc=ejemplo,dc=org'.
 origin=Origen
 regexPattern=Patrón regex
 filteredByClaim=Verificar reclamo esencial
@@ -2319,14 +2312,14 @@ authorizationSignedResponseAlgHelp=Algoritmo JWA utilizado para firmar tokens de
 associatedRolesRemoved=Se han eliminado los roles asociados
 keyAliasHelp=Alias para la clave privada
 whoWillAppearLinkTextUsers=¿Quién aparecerá en esta lista de grupos?
-tokenClaimName.tooltip=Nombre del reclamo a insertar en el token. Esto puede ser un nombre completamente calificado como 'dirección.calle'. En este caso, se creará un objeto JSON anidado. Para evitar la anidación y usar el punto literalmente, escapa el punto con una barra invertida (\\.).
+tokenClaimName.tooltip=Nombre del claim para insertar en el token. Puede ser un nombre completamente calificado como 'address.street'. En este caso, se crea un objeto JSON anidado. Para evitar la anidación y usar el punto literalmente, escápalo con una barra invertida (\\.).
 userName=Nombre de usuario
 clientProfileDescription=Descripción
 ellipticCurveHelp=Curva elíptica utilizada en ECDSA
 fromPredefinedMapper=De mapeadores predefinidos
 attributesGroup=Grupo de atributos
 ssoSessionMax=Tiempo máximo antes de que una sesión caduque. Los tokens y las sesiones del navegador se invalidan cuando la sesión expira.
-clientDeleteError=No se pudo eliminar el cliente\: {{error}}
+clientDeleteError=No se pudo eliminar el cliente: {{error}}
 optimizeLookup=Optimizar la búsqueda de la clave de firma REDIRECT
 joinGroupsFor=Unir grupos para el usuario {{username}}
 temporaryLocked=Bloqueado temporalmente
@@ -2334,11 +2327,11 @@ setup=Configuración
 unlinkAccount=Desvincular cuenta
 executors=Ejecutores
 eventTypes.CLIENT_UPDATE_ERROR.name=Error de actualización de cliente
-realm=Reino
+realm=Realm
 attributeConsumingServiceIndex=Índice del Servicio de Consumo de Atributos
 prompt=Indicación
 assign=Asignar
-disableConfirmRealm=Los usuarios y clientes no pueden acceder al realm si está deshabilitado. ¿Estás seguro de que quieres continuar?
+disableConfirmRealm=Los usuarios y clientes no pueden acceder al realm si está deshabilitado. ¿Está seguro que quiere continuar?
 showAuthData=Mostrar datos de autorización
 includeInUserInfo.tooltip=¿Debería añadirse el reclamo a la información del usuario?
 select=Seleccionar
@@ -2350,33 +2343,33 @@ nameField=Nombre
 ownerManagedAccessHelp=Si está habilitado, el acceso a este recurso puede ser gestionado por el propietario del recurso.
 useLowerCaseBearerTypeHelp=Si está activado, las respuestas de los tokens se establecerán con el tipo "portador" en minúsculas. Por defecto, el servidor establece el tipo como "Bearer" como se define en el RFC6750.
 addCondition=Añadir condición
-updateSuccessClientScope=Ámbito de cliente actualizado
+updateSuccessClientScope=Client scope actualizado
 connectionAndAuthentication=Conexión y autenticación
 clientScopeType.optional=Opcional
-permissionsDisableConfirm=Si deshabilitas los permisos, todos los permisos en la lista a continuación se eliminarán automáticamente. Además, se eliminarán los recursos y alcances relacionados
+permissionsDisableConfirm=Si deshabilitas los permisos, todos los permisos en la lista a continuación se eliminarán automáticamente. Además, se eliminarán los recursos y scopes relacionados
 eventTypes.REFRESH_TOKEN.description=Token de actualización
 authorization=Autorización
 clientProfilesHelpItem=Elemento de ayuda de perfiles de cliente
 userSessionAttributeValue=Valor de Atributo de Sesión de Usuario
-dayMonthHelp=Define el día del mes en el que DEBE otorgarse la política. También puedes proporcionar un rango llenando el segundo campo. En este caso, el permiso se otorga solo si el día actual del mes está entre o es igual a los dos valores que proporcionaste.
-fullNameLdapWriteOnlyHelp=Para solo escritura, los datos se propagan a LDAP cuando se crea o actualiza un usuario en Keycloak. Pero este mapeador no se usa para propagar datos de LDAP a Keycloak. Esta configuración es útil si configuraste mapeadores de atributos separados de nombre y apellido y quieres usarlos para leer el atributo de LDAP en Keycloak.
-userFedDeleteError=No se pudo eliminar el proveedor de federación de usuarios\: '{{error}}'
+dayMonthHelp=Define el día del mes en el que DEBE otorgarse la política. También puede proporcionar un rango llenando el segundo campo. En este caso, el permiso se otorga solo si el día actual del mes está entre o es igual a los dos valores que proporcionó.
+fullNameLdapWriteOnlyHelp=Para solo escritura, los datos se propagan a LDAP cuando se crea o actualiza un usuario en Keycloak. Pero este mapeador no se usa para propagar datos de LDAP a Keycloak. Esta configuración es útil si configuró mapeadores de atributos separados de nombre y apellido y quiere usarlos para leer el atributo de LDAP en Keycloak.
+userFedDeleteError=No se pudo eliminar el proveedor de federación de usuarios: '{{error}}'
 id=ID
 join=Unirse
 clientUpdaterSourceGroupsHelp=La condición verifica el grupo de la entidad que intenta crear/actualizar el cliente para determinar si se aplica la política.
-idTokenEncryptionContentEncryptionAlgorithmHelp=Algoritmo JWA utilizado para el cifrado de contenido en la cifrado de ID tokens. Esta opción es necesaria solo si deseas tokens de ID cifrados. Si se deja vacío, los ID Tokens solo se firman, pero no se cifran.
-messageBundleDescription=Puedes editar los idiomas admitidos. Si aún no has seleccionado idiomas admitidos, solo puedes editar el idioma inglés.
-saveEventListenersError=Error al guardar el escuchador de eventos\: {{error}}
-scopesHelp=Los alcances que se enviarán al solicitar autorización. Puede ser una lista de alcances separados por espacios. Por defecto es 'openid'.
+idTokenEncryptionContentEncryptionAlgorithmHelp=Algoritmo JWA utilizado para el cifrado de contenido en el cifrado de ID tokens. Esta opción es necesaria solo si desea tokens de ID cifrados. Si se deja vacío, los ID Tokens solo se firman, pero no se cifran.
+messageBundleDescription=Puede editar los idiomas admitidos. Si aún no ha seleccionado idiomas admitidos, solo puede editar el idioma inglés.
+saveEventListenersError=Error al guardar el escuchador de eventos: {{error}}
+scopesHelp=Los scopes que se enviarán al solicitar autorización. Puede ser una lista de scopes separados por espacios. Por defecto es 'openid'.
 multivalued.tooltip=Indica si el atributo admite varios valores. Si es verdadero, la lista de todos los valores de este atributo se establecerá como reclamo. Si es falso, solo se establecerá el primer valor como reclamo
 inputOptionLabelsI18nPrefix=Prefijo de clave de internacionalización
 enabledHelp=Establecer si las claves están habilitadas
 nameHintHelp=Un nombre único para el grupo. Este nombre se utilizará para referirse al grupo al vincular un atributo a un grupo.
 admin-events-cleared-error=No se pudieron borrar los eventos de administrador {{error}}
-usersPermissionsHint=Permisos detallados para gestionar a todos los usuarios en el realm. Puedes definir diferentes políticas para quién tiene permitido gestionar usuarios en el realm.
+usersPermissionsHint=Permisos detallados para gestionar a todos los usuarios en el realm. Puede definir diferentes políticas para quién tiene permitido gestionar usuarios en el realm.
 isBinaryAttribute=Es atributo binario
-clientScopeList=Listas de alcance de cliente
-noValidMetaDataFound=No se encontraron metadatos válidos en esta URL\: '{{error}}'
+clientScopeList=Client scopes
+noValidMetaDataFound=No se encontraron metadatos válidos en esta URL: '{{error}}'
 eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=Error al recuperar el token del proveedor de identidad
 usernameLdapAttribute=Atributo LDAP de nombre de usuario
 updateResourceSuccess=Recurso actualizado con éxito
@@ -2393,23 +2386,22 @@ executorDetails=Detalles del ejecutor
 maxDeltaTimeSeconds=Tiempo de restablecimiento de falla
 backchannelLogoutHelp=¿El proveedor de identidad externo soporta cierre de sesión en backchannel?
 eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=Error al eliminar la identidad federada
-usermodel.realmRoleMapping.rolePrefix.tooltip=Un prefijo para cada Rol del Reino (opcional).
+usermodel.realmRoleMapping.rolePrefix.tooltip=Un prefijo para cada Rol del Realm (opcional).
 exportSamlKeyTitle=Exportar claves SAML
 eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=Error de verificación de código de usuario del dispositivo OAuth2
 eventTypes.EXECUTE_ACTIONS_ERROR.description=Error al ejecutar acciones
 SKIP=Omitir
 eventTypes.INTROSPECT_TOKEN.description=Introspeccionar token
-infoEnabledFeatures=Muestra las características de vista previa y experimentales habilitadas.
+infoEnabledFeatures=Muestra todas las funciones habilitadas.
 displayOrderHelp=Número que define el orden de los proveedores en la interfaz gráfica de usuario (por ejemplo, en la página de inicio de sesión). El número más bajo se aplicará primero.
-deleteCredentialsConfirm=¿Estás seguro de que deseas eliminar las credenciales de estos usuarios?
-requiredClientScope=Por favor, añade al menos un alcance de cliente.
-keysIntro=Si el interruptor "Usar URL de JWKS" está activado, debes completar una URL de JWKS válida. Después de guardar, el administrador puede descargar claves desde la URL de JWKS o las claves se descargarán automáticamente por el servidor Keycloak cuando se vea un KID desconocido durante la autenticación del cliente.
+deleteCredentialsConfirm=¿Está seguro de que desea eliminar las credenciales de estos usuarios?
+keysIntro=Si el interruptor "Usar URL de JWKS" está activado, debe completar una URL de JWKS válida. Después de guardar, el administrador puede descargar claves desde la URL de JWKS o las claves se descargarán automáticamente por el servidor Keycloak cuando se vea un KID desconocido durante la autenticación del cliente.
 logoutServiceArtifactBindingUrl=URL de Enlace ARTIFACTO de Servicio de Cierre de Sesión
 passwordPoliciesHelp.lowerCase=El número de letras minúsculas requeridas en la cadena de contraseña.
 searchForProvider=Buscar proveedor
 ldapSearchingAndUpdatingSettingsDescription=Esta sección contiene opciones relacionadas con la búsqueda del servidor LDAP para los usuarios disponibles.
 sessionsType.regularSSO=SSO regular
-allowed-client-scopes.tooltip=Lista blanca de los alcances de cliente que se pueden utilizar en un cliente recién registrado. El intento de registrar un cliente con algún alcance de cliente que no esté en la lista blanca será rechazado. Por defecto, la lista blanca está vacía o contiene solo los alcances de cliente predeterminados del realm (basado en la propiedad de configuración 'Permitir Alcances Predeterminados')
+allowed-client-scopes.tooltip=Lista blanca de client scopes que se pueden usar en un cliente recién registrado. Se rechazará el intento de registrar un cliente con un client scope que no esté en la lista blanca. Por defecto, la lista blanca está vacía o solo contiene los client scopes predeterminados del realm (según la propiedad de configuración 'Permitir Ámbitos Predeterminados')
 maxDeltaTimeSecondsHelp=¿Cuándo se restablecerá el recuento de fallos?
 executorsHelpItem=Elemento de ayuda de ejecutores
 contentSecurityPolicy=Política de seguridad de contenido
@@ -2418,31 +2410,31 @@ off=Desactivado
 frontchannelLogoutHelp=Cuando es verdadero, el cierre de sesión requiere una redirección del navegador al cliente. Cuando es falso, el servidor realiza una invocación en segundo plano para el cierre de sesión.
 updateSuccess=Proveedor actualizado exitosamente
 hide=Ocultar
-isMandatoryInLdapHelp=Si es verdadero, el atributo es obligatorio en LDAP. Por lo tanto, si no hay un valor en la base de datos de Keycloak, se establecerá el valor vacío para que se propague a LDAP.
+isMandatoryInLdapHelp=Si es verdadero, este atributo es obligatorio en LDAP. Si no existe un valor en la base de datos de Keycloak, el valor vacío se propaga a LDAP.
 client-accesstype.label=Tipo de Acceso del Cliente
 eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Error de proveedor de identidad después del inicio de sesión
 skipCustomizationAndFinish=Omitir personalización y finalizar
 mappingDeletedSuccess=Mapeo eliminado exitosamente
 addIdentityProvider=Añadir proveedor {{provider}}
 flowDescriptionHelp=Texto de ayuda para la descripción del nuevo flujo
-kc.time.date_time=Fecha/Hora (MM/dd/yyyy hh\:mm\:ss)
+kc.time.date_time=Fecha/Hora (MM/dd/yyyy hh:mm:ss)
 principalType=Tipo de Principal
 ignoreMissingGroupsHelp=Ignorar grupos faltantes en la jerarquía de grupos.
 updatedCredentialMoveSuccess=La configuración de credenciales de usuario ha sido guardada
 deleteExecutorProfileConfirmTitle=¿Eliminar ejecutor?
 auth=Autenticación
 accessTokenLifespanImplicitFlow=Tiempo de vida del Token de Acceso para Flujo Implícito
-createAttributeSuccess=¡Éxito\! La configuración del perfil de usuario ha sido guardada.
+createAttributeSuccess=¡Éxito! La configuración del perfil de usuario ha sido guardada.
 annotations=Anotaciones
 confirmAccessTokenBody=Si regeneras el token de acceso de registro, los datos de acceso respecto al servicio de registro de clientes serán actualizados.
 remainingCount=Recuento restante
 eventTypes.INVALID_SIGNATURE.description=Firma inválida
 download=Descargar
-authScopes=Alcances de autenticación
+authScopes=Scope de autenticación
 requiredWhen=Requerido cuando
-updatePasswordPolicyError=No se pudo actualizar las políticas de contraseña\: '{{error}}'
+updatePasswordPolicyError=No se pudo actualizar las políticas de contraseña: '{{error}}'
 max-clients.tooltip=No se permitirá registrar un nuevo cliente si la cantidad de clientes existentes en el realm es igual o mayor al límite configurado.
-uuidLdapAttributeHelp=Nombre del atributo LDAP, que se utiliza como identificador único de objeto (UUID) para objetos en LDAP. Para muchos proveedores de servidores LDAP, es 'entryUUID'; sin embargo, algunos son diferentes. Por ejemplo, para Active Directory debería ser 'objectGUID'. Si tu servidor LDAP no admite la noción de UUID, puedes usar cualquier otro atributo que se suponga que es único entre los usuarios LDAP en el árbol. Por ejemplo, 'uid' o 'entryDN'.
+uuidLdapAttributeHelp=Nombre del atributo LDAP, que se utiliza como identificador único de objeto (UUID) para objetos en LDAP. Para muchos proveedores de servidores LDAP, es 'entryUUID'; sin embargo, algunos son diferentes. Por ejemplo, para Active Directory debería ser 'objectGUID'. Si su servidor LDAP no admite la noción de UUID, puede usar cualquier otro atributo que se suponga que es único entre los usuarios LDAP en el árbol. Por ejemplo, 'uid' o 'entryDN'.
 mappingDetails=Detalles del Mapeo
 top-level-flow-type.client-flow=Flujo de Cliente
 eventTypes.GRANT_CONSENT_ERROR.description=Error de concesión de consentimiento
@@ -2450,10 +2442,10 @@ claim=Reclamo
 hardcodedAttribute=Cuando el usuario es importado desde el proveedor, codifica un valor para un atributo de usuario específico.
 permissionSaveError=No se pudo actualizar el permiso debido a {{error}}
 optimizeLookupHelp=Al firmar documentos SAML en enlace REDIRECT para un SP asegurado por un adaptador Keycloak, ¿debería incluirse el ID de la clave de firma en el mensaje del protocolo SAML en el elemento <Extensions>? Esto optimiza la validación de la firma ya que la parte que valida utiliza una sola clave en lugar de intentar cada clave conocida para la validación.
-deleteClientScope_one=Eliminar alcance de cliente {{name}}
-accessTokenError=No se pudo regenerar el token de acceso debido a\: {{error}}
+deleteClientScope_one=Eliminar client scope {{name}}
+accessTokenError=No se pudo regenerar el token de acceso debido a: {{error}}
 joinGroups=Unirse a Grupos
-scopePermissions.clients.configure-description=Permisos de gestión reducidos para el administrador. No puede establecer alcance, plantilla o mapeadores de protocolo.
+scopePermissions.clients.configure-description=Permisos de administración reducidos para el administrador. No se puede establecer el scope, la plantilla o los mapeadores de protocolo.
 providedBy=Provisto por
 doNotStoreUsers=No almacenar usuarios
 ms=milisegundos
@@ -2463,21 +2455,21 @@ spi=SPI
 emptyValidators=No hay validadores.
 plus=Más
 browserFlow=Flujo de Navegador
-anyScope=Cualquier alcance
+anyScope=Cualquier scope
 enableDisable=Los clientes desactivados no pueden iniciar una sesión o han obtenido tokens de acceso.
 noUsersFound=No se encontraron usuarios
 serverInfo=Información del Servidor
-chooseAPolicyTypeInstructions=Elije un tipo de política de la lista a continuación y luego puedes configurar una nueva política para la autorización. Hay algunos tipos y descripciones.
-emailThemeHelp=Selecciona un tema para los correos electrónicos enviados por el servidor.
-principalTypeHelp=Forma de identificar y rastrear usuarios externos desde la afirmación. El valor predeterminado es utilizando el Subject NameID; alternativamente, puedes configurar un atributo identificativo.
+chooseAPolicyTypeInstructions=Elija un tipo de política de la lista a continuación y luego puede configurar una nueva política para la autorización. Hay algunos tipos y descripciones.
+emailThemeHelp=Seleccione un tema para los correos electrónicos enviados por el servidor.
+principalTypeHelp=Forma de identificar y rastrear usuarios externos desde la afirmación. El valor predeterminado es utilizando el Subject NameID; alternativamente, puede configurar un atributo identificativo.
 Wednesday=Miércoles
 consents=Consentimientos
 authDetails=Detalles de Autenticación
-mappingDeletedError=No se pudo eliminar el mapeo\: '{{error}}'
+mappingDeletedError=No se pudo eliminar el mapeo: '{{error}}'
 minimumQuickLoginWaitSecondsHelp=Cuánto tiempo esperar después de un intento de inicio de sesión rápido fallido.
-mappedGroupAttributesHelp=Lista de nombres de atributos divididos por comas. Esto apunta a la lista de atributos en el grupo LDAP, que se mapearán como atributos de Grupo en Keycloak. Deja esto vacío si no se requiere mapear atributos de grupo adicionales en Keycloak.
+mappedGroupAttributesHelp=Lista de nombres de atributos divididos por comas. Esto apunta a la lista de atributos en el grupo LDAP, que se mapearán como atributos de Grupo en Keycloak. Deje esto vacío si no se requiere mapear atributos de grupo adicionales en Keycloak.
 deleteGrantsSuccess=Concesiones revocadas exitosamente.
-mapperTypeGroupLdapMapper=group-ldap-mapper
+mapperTypeGroupLdapMapper=Mapeador de grupos LDAP
 policyEnforcementModes.DISABLED=Desactivado
 openIdConnectCompatibilityModes=Modos de compatibilidad de OpenID Connect
 no=No
@@ -2498,11 +2490,11 @@ prompts.consent=Consentimiento
 flowNameHelp=Texto de ayuda para el nombre del nuevo flujo
 webAuthnPolicyRpEntityName=Nombre de la entidad de Relying Party
 lastEvaluation=Última Evaluación
-createClientConditionError=Error creando condición\: {{error}}
+createClientConditionError=Error creando condición: {{error}}
 serverPrincipalHelp=Nombre completo del principal del servidor para el servicio HTTP incluyendo el nombre del servidor y el dominio. Por ejemplo, HTTP/host.foo.org@FOO.ORG
 enableStartTlsHelp=Encripta la conexión a LDAP usando STARTTLS, lo que deshabilitará la agrupación de conexiones
-resourceScopeSuccess=El alcance de autorización ha sido eliminado exitosamente
-userIdHelperText=Ingresa el ID único del usuario para este proveedor de identidad.
+resourceScopeSuccess=El scope de autorización ha sido eliminado exitosamente
+userIdHelperText=Ingrese el ID único del usuario para este proveedor de identidad.
 forwardParametersHelp=Parámetros de consulta no estándar de OpenID Connect/OAuth para ser enviados al proveedor de identidad externo desde la solicitud inicial de la aplicación al Punto de autorización. Se pueden introducir múltiples parámetros, separados por coma (,).
 on=Encendido
 changeAuthenticatorConfirmTitle=¿Cambiar a {{clientAuthenticatorType}}?
@@ -2514,11 +2506,11 @@ eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Vinculación de cuenta i
 annotationsText=Anotaciones
 ldapAttributeName=Nombre del atributo LDAP
 acceptsPromptNone=Acepta el reenvío de 'prompt=none' desde el cliente
-loginThemeHelp=Selecciona el tema para las páginas de inicio de sesión, OTP, concesión, registro y olvido de contraseña.
+loginThemeHelp=Seleccione el tema para las páginas de inicio de sesión, OTP, concesión, registro y olvido de contraseña.
 AESKeySizeHelp=Tamaño en bytes para la clave AES generada. El tamaño 16 es para AES-128, el tamaño 24 para AES-192 y el tamaño 32 para AES-256. ADVERTENCIA: No se permiten claves más grandes que 128 en algunas implementaciones de JDK.
 client-accesstype.tooltip=Tipo de Acceso del cliente, para el cual se aplicará la condición. El cliente confidencial tiene autenticación de cliente habilitada cuando el cliente público ha deshabilitado la autenticación de cliente. El tipo Bearer-only es un tipo de cliente obsoleto.
 oneTimePassword=Contraseña de un solo uso
-invalidateRotatedError=No se pudo eliminar el secreto rotado\: {{error}}
+invalidateRotatedError=No se pudo eliminar el secreto rotado: {{error}}
 excludeSessionStateFromAuthenticationResponseHelp=Si está activado, el parámetro 'session_state' no se incluirá en la Respuesta de Autenticación de OpenID Connect. Es útil si el cliente usa un adaptador OIDC/OAuth2 más antiguo que no admite el parámetro 'session_state'.
 useRefreshTokenForClientCredentialsGrantHelp=Si está activado, se creará y agregará un refresh_token a la respuesta del token si se utiliza la concesión client_credentials. La sección 4.4.3 de RFC6749 de OAuth 2.0 establece que no se debe generar un refresh_token cuando se utiliza la concesión client_credentials. Si está desactivado, no se generará ningún refresh_token y se eliminará la sesión de usuario asociada.
 userManagedAccess=Acceso gestionado por el usuario
@@ -2528,24 +2520,24 @@ evictionDay=Día de expulsión
 vendorHelp=Proveedor LDAP
 applyToResourceType=Aplicar al tipo de recurso
 addDefaultGroups=Añadir grupos predeterminados
-selectRole.tooltip=Introduce el rol en el cuadro de texto a la izquierda o haz clic en este botón para buscar y seleccionar el rol que desees.
+selectRole.tooltip=Introduzca el rol en el cuadro de texto a la izquierda o haga clic en este botón para buscar y seleccionar el rol que desee.
 filterGroups=Filtrar grupos
 validPostLogoutRedirectUri=URI de redirección de post cierre de sesión válidos
 authnContextClassRefs=AuthnContext ClassRefs
 deleteCredentialsSuccess=Las credenciales han sido eliminadas correctamente.
 eventTypes.PERMISSION_TOKEN_ERROR.name=Error de token de permiso
 userProfileSuccess=Configuración de perfil de usuario actualizada correctamente.
-attributeDefaultValueHelp=Si no hay un valor en la base de datos de Keycloak y el atributo es obligatorio en LDAP, este valor se propagará a LDAP.
+attributeDefaultValueHelp=Si no existe un valor en la base de datos de Keycloak y el atributo es obligatorio en LDAP, este valor se propaga a LDAP.
 cibaPolicy=Política CIBA
 Saturday=Sábado
 importSkipped_other={{count}} registros omitidos.
-membershipAttributeTypeHelp=DN significa que el grupo LDAP tiene sus miembros declarados en forma de su DN completo. Por ejemplo, 'member: uid=john,ou=users,dc=example,dc=com'. UID significa que el grupo LDAP tiene sus miembros declarados en forma de identificadores de usuario puros. Por ejemplo, 'memberUid: john'.
+membershipAttributeTypeHelp=DN significa que los miembros del grupo LDAP se declaran en su forma completa de DN. Por ejemplo, 'member: uid=john,ou=users,dc=example,dc=com'. UID significa que los miembros del grupo LDAP se declaran en su forma pura de uid de usuario, como 'memberUid: john'.
 unsavedChangesTitle=Cambios no guardados
-emptyResourcesInstructions=Si deseas crear un recurso, haz clic en el botón a continuación.
+emptyResourcesInstructions=Si desea crear un recurso, haga clic en el botón a continuación.
 otpSupportedApplications.totpAppFreeOTPName=FreeOTP
-validPostLogoutRedirectURIs=Patrón URI válido al que un navegador puede redirigir después de un cierre de sesión exitoso. Un valor de '+' o un campo vacío usará la lista de URI de redirección válidos. Un valor de '-' no permitirá ningún URI de redirección después del cierre de sesión. Se permiten comodines simples como 'http\://example.com/*'. También se puede especificar una ruta relativa, por ejemplo, /my/relative/path/*. Las rutas relativas son relativas a la URL raíz del cliente, o si no se especifica ninguna, se utiliza la URL raíz del servidor de autenticación.
+validPostLogoutRedirectURIs=Patrón URI válido al que un navegador puede redirigir después de un cierre de sesión exitoso. Un valor de '+' o un campo vacío usará la lista de URI de redirección válidos. Un valor de '-' no permitirá ningún URI de redirección después del cierre de sesión. Se permiten comodines simples como 'http://example.com/*'. También se puede especificar una ruta relativa, por ejemplo, /my/relative/path/*. Las rutas relativas son relativas a la URL raíz del cliente, o si no se especifica ninguna, se utiliza la URL raíz del servidor de autenticación.
 composite=Compuesto
-recommendedSsoTimeout=Se recomienda que este valor sea más corto que el tiempo de espera de la sesión SSO inactiva\: {{time}}
+recommendedSsoTimeout=Se recomienda que este valor sea más corto que el tiempo de espera de la sesión SSO inactiva: {{time}}
 sessionExplain=Las sesiones son las sesiones de los usuarios en este realm y los clientes a los que acceden dentro de la sesión.
 noSearchResults=No se encontraron resultados de búsqueda
 eventTypes.AUTHREQID_TO_TOKEN.description=Authreqid a token
@@ -2559,13 +2551,13 @@ moveGroupSuccess=Grupo movido
 eventTypes.USER_INFO_REQUEST.description=Solicitud de información de usuario
 userDeletedError=No se pudo eliminar al usuario {{error}}
 edit=Editar
-authorizationScopeDetails=Detalles del alcance de autorización
+authorizationScopeDetails=Detalles del scope de autorización
 ldapGroupsDnHelp=DN LDAP donde se guardan los grupos de este árbol. Por ejemplo, 'ou=groups,dc=example,dc=org'.
 readOnly=Solo lectura
-client-updater-trusted-hosts.tooltip=Lista de hosts que son de confianza. En caso de que la solicitud de registro/actualización del cliente provenga del host/dominio especificado en esta configuración, la condición se evalúa como verdadera. Puedes usar nombres de host o direcciones IP. Si usas un asterisco al principio (por ejemplo, '*.example.com'), entonces todo el dominio example.com será de confianza.
+client-updater-trusted-hosts.tooltip=Lista de hosts que son de confianza. En caso de que la solicitud de registro/actualización del cliente provenga del host/dominio especificado en esta configuración, la condición se evalúa como verdadera. Puede usar nombres de host o direcciones IP. Si usa un asterisco al principio (por ejemplo, '*.example.com'), entonces todo el dominio example.com será de confianza.
 resultDeny=Denegar Resultado
-kc.client.network.host=Anfitrión del Cliente
-noResourceCreateHint=No hay recursos. Por lo tanto, no puedes crear permisos basados en recursos.
+kc.client.network.host=Cliente Anfitrión
+noResourceCreateHint=No hay recursos. Por lo tanto, no puede crear permisos basados en recursos.
 directMembership=Miembro directo
 addExecutionTitle=Añadir una ejecución
 associatedRolesText=Roles asociados
@@ -2580,26 +2572,26 @@ flow-type.basic-flow=Genérico
 oAuthDevicePollingInterval=Intervalo de sondeo de dispositivo OAuth 2.0
 deletedSuccessRealmSetting=El realm ha sido eliminado
 webauthnPasswordlessPolicy=Política de Webauthn sin contraseña
-editUserLabel=Editar Etiqueta de Usuario Botón
+editUserLabel=Botón de edición de etiqueta de usuario
 conditions=Condiciones
 addUri=Añadir URI
 excludeIssuerFromAuthenticationResponse=Excluir Emisor de la Respuesta de Autenticación
 minus=Menos
-groupsHelp=Grupos a los que el usuario pertenece. Para dejar un grupo, selecciónalo y haz clic en Salir.
+groupsHelp=Grupos a los que el usuario pertenece. Para dejar un grupo, selecciónelo y haga clic en Salir.
 includeGroupsAndRoles=Incluir grupos y roles
 groupsPermissionsHint=Determina si los permisos detallados están habilitados para la gestión de este rol. Al deshabilitarlos, se eliminarán todos los permisos actuales que se hayan configurado.
 offlineSessionMaxHelp=Tiempo máximo antes de que una sesión sin conexión caduque independientemente de la actividad.
 resourceSaveError=No se pudo persistir el recurso debido a {{error}}
-clientsClientScopesHelp=Los alcances asociados con este recurso.
-updateCredentialUserLabelError=Error al cambiar la etiqueta de usuario\: {{error}}
+clientsClientScopesHelp=Los scopes asociados con este recurso.
+updateCredentialUserLabelError=Error al cambiar la etiqueta de usuario: {{error}}
 enableHelpMode=Habilitar el modo de ayuda
 clientPoliciesTab=Pestaña de políticas del cliente
 ldapGroupsDn=DN de grupos LDAP
 ldapFullNameAttributeHelp=Nombre del atributo LDAP que contiene el nombre completo del usuario. Normalmente será 'cn'.
-clientRegisterPolicyDeleteConfirm=¿Estás seguro de que quieres eliminar permanentemente la política de registro de cliente {{name}}?
+clientRegisterPolicyDeleteConfirm=¿Está seguro de que quiere eliminar permanentemente la política de registro de cliente {{name}}?
 jsonEditor=Editor JSON
 chooseBindingType=Elegir tipo de enlace
-mappingCreatedError=No se pudo crear el mapeo\: '{{error}}'
+mappingCreatedError=No se pudo crear el mapeo: '{{error}}'
 deleteClientPolicyProfileConfirmTitle=¿Eliminar perfil?
 passwordPoliciesHelp.forceExpiredPasswordChange=Número de días que la contraseña es válida antes de que se requiera una nueva contraseña.
 envelopeFromHelp=Una dirección de correo electrónico utilizada para rebotes (opcional).
@@ -2616,7 +2608,7 @@ importUsers=Importar usuarios
 authenticationFlow=Flujo de autenticación
 leaveGroup_other=¿Salir de grupos?
 deleteClientPolicySuccess=Política del cliente eliminada
-mapperTypeCertificateLdapMapper=mapeador-certificado-ldap
+mapperTypeCertificateLdapMapper=Certificado mapeador ldap
 clientAuthentications.client_secret_basic=Secreto del cliente enviado como autenticación básica
 started=Iniciado
 filteredByClaimHelp=Si es verdadero, los tokens de ID emitidos por el proveedor de identidad deben tener un reclamo específico. De lo contrario, el usuario no puede autenticarse a través de este intermediario.
@@ -2632,22 +2624,22 @@ deleteProvider=¿Eliminar proveedor?
 inputTypeSize=Tamaño de entrada
 createAttributeSubTitle=Crear un nuevo atributo
 eventTypes.CODE_TO_TOKEN_ERROR.name=Error de código a token
-emptyAuthorizationInstructions=Si deseas crear alcances de autorización, haz clic en el botón a continuación para crear el alcance de autorización
-subjectHelp=Una expresión regular para validar el DN de sujeto en el Certificado del Cliente. Usa "(.*?)(?\:$)" para coincidir con todo tipo de expresiones.
+emptyAuthorizationInstructions=Si desea crear scopes de autorización, haga clic en el botón a continuación para crearlo
+subjectHelp=Una expresión regular para validar el DN de sujeto en el Certificado del Cliente. Use "(.*?)(?:$)" para coincidir con todo tipo de expresiones.
 updatePolicySuccess=Política actualizada con éxito
-eventTypes.CUSTOM_REQUIRED_ACTION.name=Acción requerida personalizada
+eventTypes.CUSTOM_REQUIRED_ACTION.name=Requerida acción personalizada
 updateExecutorError=Executor no actualizado: {{error}}
-clientIdHelpHelp=ID de cliente del cliente al que se asignarán los mapeos de roles LDAP. Aplicable solo si 'Usar Mapeo de Roles de Reino' es falso.
+clientIdHelpHelp=ID de cliente del cliente al que se asignarán los mapeos de roles LDAP. Aplicable solo si 'Usar Mapeo de Roles de Realm' es falso.
 createdAt=Creado en
 moveGroupEmpty=No hay subgrupos
-rolesHelp=Selecciona los roles que quieres asociar con el usuario seleccionado.
+rolesHelp=Seleccione los roles que quiere asociar con el usuario seleccionado.
 samlEntityDescriptor=Descriptor de entidad SAML
 passwordPolicyHintsEnabled=Indicaciones de política de contraseñas habilitadas
 enableLdapv3PasswordHelp=Usa la Operación Extendida de Modificación de Contraseña LDAPv3 (RFC-3062). La operación extendida de modificar contraseña normalmente requiere que el usuario LDAP ya tenga una contraseña en el servidor LDAP. Así que cuando se usa esto con 'Sincronizar Registros', puede ser bueno agregar también 'Mapeador de Atributos LDAP Codificado' con una contraseña inicial generada aleatoriamente.
 syncMode=Modo de sincronización
 details=Detalles
 privateRSAKeyHelp=Llave RSA privada codificada en formato PEM
-onDragStart=Comenzó a arrastrarse para el ítem {{item}}
+onDragStart=Se inició el arrastre del elemento {{item}}
 pushedAuthorizationRequestRequired=Se requiere solicitud de autorización enviada
 requirements.REQUIRED=Requerido
 generate=Generar
@@ -2655,7 +2647,7 @@ clientOfflineSessionMaxHelp=Tiempo máximo antes de que expire una sesión sin c
 resetPasswordBtn=Restablecer contraseña
 strictTransportSecurity=Seguridad de Transporte Estricta de HTTP (HSTS)
 editInfo=Editar información
-offlineSessionMaxLimited=Sesión Sin Conexión Máxima Limitada
+offlineSessionMaxLimited=Límite máximo de sesión sin conexión
 providerCreateSuccess=Nueva política de cliente creada con éxito
 disableSigning=Desactivar "{{key}}"
 periodicChangedUsersSync=Sincronización periódica de usuarios modificados
@@ -2666,38 +2658,38 @@ clientAccessType=Usa el tipo de acceso del cliente (confidencial, público, solo
 firstName=Nombre
 emptySecondaryAction=Configurar un nuevo mapeador
 defaultGroupAdded_one=Nuevo grupo añadido a los grupos predeterminados
-unexpectedError=Se produjo un error inesperado\: '{{error}}'
-noRolesInstructions=No has asignado ningún rol a este usuario. Asigna un rol para comenzar.
-authorizationEncryptedResponseEncHelp=Algoritmo JWA utilizado para cifrar el contenido en la respuesta de autorización al encriptar la respuesta cuando el modo de respuesta es jwt. Esta opción es necesaria si quieres una respuesta de autorización cifrada. Si se deja vacío, la respuesta de autorización solo está firmada, pero no está encriptada.
+unexpectedError=Se produjo un error inesperado: '{{error}}'
+noRolesInstructions=No ha asignado ningún rol a este usuario. Asigne un rol para comenzar.
+authorizationEncryptedResponseEncHelp=Algoritmo JWA utilizado para cifrar el contenido en la respuesta de autorización al encriptar la respuesta cuando el modo de respuesta es jwt. Esta opción es necesaria si quiere una respuesta de autorización cifrada. Si se deja vacío, la respuesta de autorización solo está firmada, pero no está encriptada.
 permissionName=El nombre de este permiso.
-postBrokerLoginFlowAliasHelp=Alias del flujo de autenticación, que se activa después de cada inicio de sesión con este proveedor de identidad. Útil si quieres una verificación adicional de cada usuario autenticado con este proveedor de identidad (por ejemplo, OTP). Deja esto en "Ninguno" si no necesitas autenticadores adicionales que se activen después del inicio de sesión con este proveedor de identidad. También ten en cuenta que las implementaciones del autenticador deben asumir que el usuario ya está establecido en ClientSession, ya que el proveedor de identidad ya lo estableció.
+postBrokerLoginFlowAliasHelp=Alias del flujo de autenticación, que se activa después de cada inicio de sesión con este proveedor de identidad. Útil si quiere una verificación adicional de cada usuario autenticado con este proveedor de identidad (por ejemplo, OTP). Deje esto en "Ninguno" si no necesita autenticadores adicionales que se activen después del inicio de sesión con este proveedor de identidad. Tenga en cuenta que las implementaciones del autenticador deben asumir que el usuario ya está establecido en ClientSession, ya que el proveedor de identidad ya lo estableció.
 preview=Vista previa
 eventTypes.UNREGISTER_NODE_ERROR.name=Error de desregistro de nodo
 clientRegisterPolicyDeleteConfirmTitle=¿Eliminar política de registro de cliente?
 groupDetails=Detalles del grupo
 sessionsType.allSessions=Todos los tipos de sesión
-kid=Identificador de clave
+kid=KID (Key ID)
 sessionsType.serviceAccount=Cuenta de servicio
 allowKerberosAuthenticationHelp=Habilitar/deshabilitar la autenticación HTTP de los usuarios con tokens SPNEGO/Kerberos. Los datos de los usuarios autenticados se aprovisionarán desde este servidor LDAP.
 oauthDeviceAuthorizationGrantHelp=Esto habilita el soporte para la Concesión de Autorización de Dispositivo OAuth 2.0, lo que significa que el cliente es una aplicación en un dispositivo que tiene capacidades de entrada limitadas o carece de un navegador adecuado.
 clientSignatureHelp=¿El cliente firmará sus solicitudes y respuestas saml? ¿Y deberían ser validadas?
 importOverwritten_other={{count}} registros sobrescritos.
 requirements.CONDITIONAL=Condicional
-leaveGroupConfirmDialog_one=¿Estás seguro de que quieres eliminar a {{username}} del grupo {{groupname}}?
+leaveGroupConfirmDialog_one=¿Está seguro de que quiere eliminar a {{username}} del grupo {{groupname}}?
 kc.client.user_agent=Cliente/Agente de Usuario
 frontendUrl=URL de Frontend
 permissionDeletedSuccess=Permiso eliminado con éxito
-clientScopeRemoveSuccess=Mapeo de alcance eliminado con éxito
-addClientScopes=Añadir alcances de cliente
+clientScopeRemoveSuccess=Asignación de scope eliminada con éxito
+addClientScopes=Agregar client scopes
 doNotStoreUsersHelp=Cuando está habilitado, los usuarios de este intermediario no se guardan en la base de datos interna.
-deletePolicyConfirm=Si eliminas esta política, algunos permisos o políticas agregadas se verán afectados.
-userCreateError=No se pudo crear el usuario\: {{error}}
+deletePolicyConfirm=Si elimina esta política, algunos permisos o políticas agregadas se verán afectados.
+userCreateError=No se pudo crear el usuario: {{error}}
 user-events-cleared=Los eventos de usuario han sido borrados
 resetPasswordConfirm=¿Restablecer contraseña?
 emailAsUsernameHelpText=Permitir a los usuarios establecer el correo electrónico como nombre de usuario.
 AESKeySize=Tamaño de la clave AES
 fullName={{givenName}} {{familyName}}
-deleteConfirm=¿Estás seguro de que quieres eliminar permanentemente el proveedor '{{provider}}'?
+deleteConfirm=¿Está seguro que quiere eliminar permanentemente el proveedor '{{provider}}'?
 compositesRemovedAlertDescription=Se han eliminado todos los roles asociados
 aliasHelp=El alias identifica de forma única a un proveedor de identidad y también se utiliza para construir el uri de redirección.
 selectRealm=Seleccionar realm
@@ -2709,12 +2701,12 @@ clientsPermissionsHint=Permisos detallados para administradores que quieran admi
 lookAroundHelp=¿Hasta dónde debería mirar el servidor en caso de que el generador de token y el servidor estén fuera de sincronización temporal o sincronización de contador?
 usersLeft_one={{count}} usuario dejó el grupo
 sync-keycloak-groups-to-ldap=Sincronizar grupos de Keycloak a LDAP
-saveError=El proveedor de federación de usuarios no se pudo guardar\: {{error}}
+saveError=El proveedor de federación de usuarios no se pudo guardar: {{error}}
 bruteForceDetection=Detección de fuerza bruta
 loginTimeoutHelp=Tiempo máximo que tiene un usuario para completar un inicio de sesión. Se recomienda que sea relativamente largo, como 30 minutos o más.
 eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2 código de dispositivo a token
 searchGroups=Buscar grupos
-trusted-hosts.tooltip=Lista de Hosts que son confiables y se les permite invocar el Servicio de Registro de Cliente y/o ser usados como valores de URIs de Cliente. Puedes usar nombres de host o direcciones IP. Si usas un asterisco al principio (por ejemplo, '*.example.com' ) entonces todo el dominio example.com será de confianza.
+trusted-hosts.tooltip=Lista de Hosts que son confiables y se les permite invocar el Servicio de Registro de Cliente y/o ser usados como valores de URIs de Cliente. Puede usar nombres de host o direcciones IP. Si usa un asterisco al principio (por ejemplo, '*.example.com' ) entonces todo el dominio example.com será de confianza.
 disableNonceHelp=No enviar el parámetro nonce en la solicitud de autenticación. El parámetro nonce se envía y verifica de forma predeterminada.
 deleteClientProfile=Eliminar este perfil de cliente
 none=Ninguno
@@ -2730,11 +2722,11 @@ keysFilter.ACTIVE=Claves activas
 rsaGenerated=rsa-generada
 krbPrincipalAttributeHelp=Nombre del atributo LDAP que se refiere al principal Kerberos. Esto se utiliza para buscar el usuario LDAP apropiado después de una autenticación exitosa de Kerberos/SPNEGO en Keycloak. Cuando está vacío, se buscará al usuario LDAP basado en el nombre de usuario LDAP correspondiente a la primera parte de su principal Kerberos. Por ejemplo, para el principal 'john@KEYCLOAK.ORG', asumirá que el nombre de usuario LDAP es 'john'.
 client-roles-condition.tooltip=Roles de cliente, que se verificarán durante esta evaluación de condición. La condición se evalúa como verdadera si el cliente tiene al menos un rol de cliente con el nombre de los roles de cliente especificados en la configuración.
-impersonateError=No se pudo suplantar al usuario\: {{error}}
+impersonateError=No se pudo suplantar al usuario: {{error}}
 keyLabel=Clave
 syncChangedUsers=Sincronizar usuarios modificados
 eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=Error de respuesta del proveedor de identidad
-orderDialogIntro=El orden en que se enumeran los proveedores en la página de inicio de sesión o la interfaz de cuenta. Puedes arrastrar las filas para cambiar el orden.
+orderDialogIntro=El orden en que se enumeran los proveedores en la página de inicio de sesión o la interfaz de cuenta. Puede arrastrar las filas para cambiar el orden.
 clientSessionIdle=Sesión de cliente inactiva
 push=Push
 targetClaimHelp=Especifica el reclamo objetivo que la política obtendrá.
@@ -2748,14 +2740,14 @@ FAIL=Falla de importación
 userInfoSignedResponseAlgorithmHelp=Algoritmo JWA utilizado para la respuesta firmada del punto final de la Información del Usuario. Si se establece en 'sin firmar', la respuesta de Información del Usuario no estará firmada y se devolverá en formato application/json.
 lastName=Apellido
 isAccessTokenJWT=El Token de Acceso es JWT
-deleteConfirmDialog_one=¿Estás seguro de que quieres eliminar permanentemente {{count}} usuarios seleccionados
+deleteConfirmDialog_one=¿Está seguro que quiere eliminar permanentemente {{count}} usuarios seleccionados?
 eventTypes.AUTHREQID_TO_TOKEN.name=Authreqid a token
-createError=No se pudo crear el proveedor de identidad\: {{error}}
+createError=No se pudo crear el proveedor de identidad: {{error}}
 excludeIssuerFromAuthenticationResponseHelp=Si está activo, el parámetro 'iss' no se incluirá en la Respuesta de Autenticación de OpenID Connect. Es útil si el cliente utiliza un adaptador más antiguo de OIDC / OAuth2 que no admite el parámetro 'iss'.
 eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=Error de authreqid a token
-deletePermissionConfirm=¿Estás seguro de que quieres eliminar el permiso {{permission}}
+deletePermissionConfirm=¿Está seguro que quiere eliminar el permiso {{permission}}?
 TERMS_AND_CONDITIONS=Términos y Condiciones (TERMS_AND_CONDITIONS)
-artifactResolutionServiceHelp=Servicio de resolución de artefactos SAML para el cliente. Este es el punto final al que Keycloak enviará un mensaje SOAP ArtifactResolve. Puedes dejar esto en blanco si no tienes una URL para este enlace.
+artifactResolutionServiceHelp=Servicio de resolución de artefactos SAML para el cliente. Este es el punto final al que Keycloak enviará un mensaje SOAP ArtifactResolve. Puede dejar esto en blanco si no tiene una URL para este enlace.
 userRoleMappingUpdatedSuccess=Mapeo de roles de usuario actualizado con éxito
 clientUpdaterTrustedHosts=Hosts confiables
 deleteSuccess=Grupo de atributos eliminado.
@@ -2765,7 +2757,7 @@ copy=Copiar
 credentialData=Datos
 clientRolesConditionTooltip=Roles de cliente que se verificarán durante esta evaluación de condición. La condición se evalúa como verdadera si el cliente tiene al menos un rol de cliente con el nombre de los roles de cliente especificados en la configuración.
 invalidateSecret=Invalidar
-emptyPermissionInstructions=Si deseas crear un permiso, haz clic en el botón a continuación para crear un permiso basado en recursos o alcance.
+emptyPermissionInstructions=Si desea crear un permiso, haga clic en el botón a continuación para crear un permiso basado en recursos o scopes.
 webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Evitar registrar el autenticador que ya ha sido registrado.
 memberofLdapAttribute=Atributo LDAP de miembro de
 supportedLocales=Idiomas admitidos
@@ -2774,14 +2766,14 @@ webAuthnPolicyAttestationConveyancePreference=Preferencia de transmisión de acr
 copyOf=Copia de {{name}}
 eventTypes.REMOVE_TOTP.description=Eliminar totp
 evictionMinute=Minuto de expiración
-requiredClient=Por favor, agrega al menos un cliente.
+requiredClient=Por favor, agregue al menos un cliente.
 help=Ayuda
 passSubject=Pasar sujeto
 deleteFlowSuccess=Flujo eliminado con éxito
 nodeReRegistrationTimeoutHelp=Intervalo para especificar el tiempo máximo para que los nodos del clúster de clientes registrados se vuelvan a registrar. Si el nodo del clúster no envía una solicitud de re-registro a Keycloak dentro de este tiempo, se desregistrará de Keycloak.
 rename=Renombrar
 httpPostBindingLogoutHelp=Indica si responder a las solicitudes usando el enlace HTTP-POST. Si es falso, se usará el enlace HTTP-REDIRECT.
-policyProvider.client=Define condiciones para tus permisos donde se permite un conjunto de uno o más clientes para acceder a un objeto.
+policyProvider.client=Define condiciones para sus permisos donde se permite un conjunto de uno o más clientes para acceder a un objeto.
 clientAuthentication=Autenticación del cliente
 validatePasswordPolicy=Validar política de contraseñas
 registrationEmailAsUsername=Correo electrónico como nombre de usuario
@@ -2790,18 +2782,18 @@ createResource=Crear recurso
 data=Datos
 createNewMapper=Crear nuevo mapeador
 mapperTypeMsadUserAccountControlManager=Administrador de msad-user-account-control-mapper
-deleteNodeFail=No se pudo eliminar el nodo\: '{{error}}'
-syncModeOverrideHelp=Sobrescribe el modo de sincronización predeterminado del IDP para este mapeador. Los valores son\: 'legacy' para mantener el comportamiento antes de que se introdujera esta opción, 'import' para importar solo el usuario una vez durante el primer inicio de sesión del usuario con este proveedor de identidad, 'force' para siempre actualizar al usuario durante cada inicio de sesión con este proveedor de identidad y 'inherit' para usar el modo de sincronización definido en el proveedor de identidad para este mapeador.
+deleteNodeFail=No se pudo eliminar el nodo: '{{error}}'
+syncModeOverrideHelp=Sobrescribe el modo de sincronización predeterminado del IDP para este mapeador. Los valores son: 'legacy' para mantener el comportamiento antes de que se introdujera esta opción, 'import' para importar solo el usuario una vez durante el primer inicio de sesión del usuario con este proveedor de identidad, 'force' para siempre actualizar al usuario durante cada inicio de sesión con este proveedor de identidad y 'inherit' para usar el modo de sincronización definido en el proveedor de identidad para este mapeador.
 eventTypes.TOKEN_EXCHANGE_ERROR.description=Error de intercambio de token
 strictTransportSecurityHelp=El encabezado HTTP Strict-Transport-Security indica a los navegadores que siempre usen HTTPS. Una vez que un navegador ve este encabezado, solo visitará el sitio a través de HTTPS durante el tiempo especificado (1 año) en max-age, incluidos los subdominios. <1>Más información</1>
-authenticationExplain=La autenticación es el área donde puedes configurar y gestionar diferentes tipos de credenciales.
-passwordPoliciesHelp.hashIterations=El número de veces que se ha hasheado una contraseña antes de almacenarla o verificarla. Por defecto\: 27.500.
+authenticationExplain=La autenticación es el área donde puede configurar y gestionar diferentes tipos de credenciales.
+passwordPoliciesHelp.hashIterations=El número de veces que una contraseña se somete a hashing antes de su almacenamiento o verificación. Valores predeterminados: 1 si se utiliza Argon2 como algoritmo de hashing; 210,000 si se utiliza PBKDF2-SHA512 como algoritmo de hashing; 600,000 si se utiliza PBKDF2-SHA256 como algoritmo de hashing; 1,300,000 si se utiliza PBKDF2 como algoritmo de hashing.
 dropNonexistingGroupsDuringSync=Eliminar grupos que no existen durante la sincronización
 clientAssertionSigningAlgHelp=Algoritmo de firma para crear la afirmación JWT como autenticación del cliente. En el caso de JWT firmados con clave privada o JWT firmados con secreto de cliente, es necesario. Si no se especifica ningún algoritmo, se adapta el siguiente algoritmo. Se adapta RS256 en el caso de JWT firmado con clave privada. Se adapta HS256 en el caso de JWT firmado con secreto de cliente.
 addProvider_other=Añadir {{provider}} proveedores
 cibaExpiresIn=Expira en
-dynamicScopeFormatHelp=Esta es la expresión regular que el sistema usará para extraer el nombre y la variable del alcance.
-resetPasswordConfirmText=¿Estás seguro de que quieres restablecer la contraseña del usuario {{username}}?
+dynamicScopeFormatHelp=Esta es la expresión regular que el sistema usará para extraer el nombre y la variable del scope.
+resetPasswordConfirmText=¿Está seguro de que quiere restablecer la contraseña del usuario {{username}}?
 create=Crear
 noAvailableIdentityProviders=No hay proveedores de identidad disponibles.
 passSubjectHelp=Durante la fase de inicio de sesión, reenviar un parámetro de consulta login_hint opcional a Subject de SAML AuthnRequest.
@@ -2814,13 +2806,13 @@ filterByRoles=Filtrar por roles de realm
 maxLifespan=Vida máxima
 host-sending-registration-request-must-match.label=El host que envía la solicitud de registro del cliente debe coincidir
 eventTypes.VERIFY_PROFILE_ERROR.description=Error de verificación de perfil
-webOriginsHelp=Orígenes CORS permitidos. Para permitir todos los orígenes de Valid Redirect URIs, agrega '+'. Esto no incluye el comodín '*', sin embargo. Para permitir todos los orígenes, agrega explícitamente '*'.
+webOriginsHelp=Orígenes CORS permitidos. Para permitir todos los orígenes de las URI de redirección válidas, agregue '+'. Sin embargo, esto no incluye el comodín '*'. Para permitir todos los orígenes, agregue explícitamente '*'.
 noSessionsForClient=Actualmente no hay sesiones activas para este cliente.
-profilesConfigType=Configurar a través de\:
+profilesConfigType=Configurar a través de:
 enableHelp=La ayuda está habilitada
 xRobotsTagHelp=Evitar que las páginas aparezcan en los motores de búsqueda. <1>Más información</1>
 client-updater-source-roles.label=Actualización del rol de entidad
-clientRegisterPolicyDeleteError=No se pudo eliminar la política de registro de cliente\: '{{error}}'
+clientRegisterPolicyDeleteError=No se pudo eliminar la política de registro de cliente: '{{error}}'
 resourceFile=Archivo de recurso
 hardcodedRole=Cuando el usuario se importa desde el proveedor, mapear un rol de forma predeterminada para él.
 searchType.default=Búsqueda predeterminada
@@ -2832,17 +2824,17 @@ idpUnlinkSuccess=El enlace del proveedor ha sido eliminado
 providerType=Tipo de proveedor
 clientSessionIdleHelp=Tiempo que se permite que una sesión de cliente esté inactiva antes de que expire. Los tokens se invalidan cuando una sesión de cliente expira. La opción no afecta a la sesión global de SSO de usuario. Si no se establece, utiliza el valor estándar de Sesión SSO Inactiva.
 passwordPoliciesHelp.hashAlgorithm=Aplica un algoritmo de hash a las contraseñas, para que no se almacenen en texto claro.
-scopesSelect=Especifica que este permiso debe aplicarse a uno o más alcances.
+scopesSelect=Especifica que este permiso debe aplicarse a uno o más scopes.
 selectMethodType.generate=Generar
-emailInvalid=Debes introducir un correo electrónico válido.
+emailInvalid=Debe introducir un correo electrónico válido.
 chooseAPolicyProvider=Elegir un proveedor de políticas
 clientAuthenticationHelp=El método de autenticación del cliente (cfr. https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). En caso de JWT firmado con clave privada, se usa la clave privada del realm.
 kerberosRealmHelp=Nombre del realm Kerberos. Por ejemplo, FOO.ORG.
-roleCreateError=No se pudo crear el rol\: {{error}}
+roleCreateError=No se pudo crear el rol: {{error}}
 clientSecretHelp=El secreto del cliente registrado con el proveedor de identidad. Este campo puede obtener su valor desde un almacén, utilizando el formato ${vault.ID}.
 offlineSessionMax=Sesión Offline Máxima
 generatedUserInfoHelp=Consulte el ejemplo de Información de Usuario que será proporcionado por el Punto Final de Información de Usuario.
-dynamicScopeFormat=Formato de alcance dinámico
+dynamicScopeFormat=Formato de scope dinámico
 webAuthnPolicyExtraOriginsHelp=Lista de orígenes adicionales para aplicaciones no web.
 updatePermissionSuccess=Permiso actualizado con éxito
 idpLinkSuccess=El proveedor de identidad ha sido vinculado
@@ -2852,25 +2844,25 @@ referrerPolicy=Política de Referencia
 flow.clients=Flujo de autenticación de cliente
 eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=Error de primer inicio de sesión del proveedor de identidad
 groups=Grupos
-emptyStateText=No hay roles de realm en este realm. Crea un rol de realm para empezar.
+emptyStateText=No hay roles de realm en este realm. Cree un rol de realm para empezar.
 includeSubGroups=Incluir usuarios de subgrupos
-permanentLockoutHelp=Bloquear permanentemente al usuario cuando excede el número máximo de intentos de inicio de sesión.
+permanentLockoutHelp=Configura si un usuario será deshabilitado temporal o permanentemente después de demasiados intentos fallidos de inicio de sesión. El bloqueo permanente puede configurarse para ocurrir después de un número determinado de fallos de inicio de sesión o tras varias deshabilitaciones temporales.
 logicType.positive=Positivo
 associatedPolicy=Política asociada
 accountTheme=Tema de la cuenta
 webAuthnPolicyAvoidSameAuthenticatorRegister=Evitar el registro con el mismo autenticador
 emptyExecutors=No hay ejecutores configurados
-notBeforeNowClear=No antes limpiado para el cliente
+notBeforeNowClear="Not Before" eliminado para el cliente
 selectARole=Seleccionar un rol
 titleAuthentication=Autenticación
 category=Categoría
-startBySearchingAUser=Empieza buscando usuarios
+startBySearchingAUser=Comience buscando usuarios
 times.days=Días
 selectALocale=Seleccionar una configuración regional
 transientUser=Transitorio
 transientUserTooltip=Este usuario no está almacenado en la base de datos de Keycloak. Se construye únicamente a partir de los datos proporcionados por el proveedor de identidad de origen.
-error-empty=Por favor, especifica el valor de '{{0}}'.
-error-invalid-blank=Por favor, especifica el valor de '{{0}}'.
+error-empty=Por favor, especifique el valor de '{{0}}'.
+error-invalid-blank=Por favor, especifique el valor de '{{0}}'.
 error-invalid-date='{{0}}' es una fecha inválida.
 error-invalid-email=Dirección de correo electrónico inválida.
 error-invalid-length-too-long='{{0}}' debe tener una longitud máxima de {{2}}.
@@ -2886,24 +2878,24 @@ error-number-out-of-range-too-small='{{0}}' debe tener un valor mínimo de {{1}}
 error-number-out-of-range='{{0}}' debe ser un número entre {{1}} y {{2}}.
 error-pattern-no-match='{{0}}' no coincide con el formato requerido.
 error-person-name-invalid-character='{{0}}' contiene caracteres inválidos.
-error-user-attribute-required=Por favor, especifica '{{0}}'.
+error-user-attribute-required=Por favor, especifique '{{0}}'.
 error-username-invalid-character='{{0}}' contiene caracteres inválidos.
 error-user-attribute-read-only=El campo {{0}} es de solo lectura.
-missingUsernameMessage='{{0}}': Por favor, especifica el nombre de usuario.
-missingFirstNameMessage='{{0}}': Por favor, especifica el nombre.
+missingUsernameMessage='{{0}}': Por favor, especifique el nombre de usuario.
+missingFirstNameMessage='{{0}}': Por favor, especifique el nombre.
 invalidEmailMessage='{{0}}': Dirección de correo electrónico inválida.
-missingLastNameMessage='{{0}}': Por favor, especifica el apellido.
-missingEmailMessage='{{0}}': Por favor, especifica el correo electrónico.
-missingPasswordMessage='{{0}}': Por favor, especifica la contraseña.
+missingLastNameMessage='{{0}}': Por favor, especifique el apellido.
+missingEmailMessage='{{0}}': Por favor, especifique el correo electrónico.
+missingPasswordMessage='{{0}}': Por favor, especifique la contraseña.
 unmanagedAttributes=Atributos no gestionados
 unmanagedAttributePolicy.DISABLED=Deshabilitado
 unmanagedAttributePolicy.ADMIN_VIEW=Solo los administradores pueden ver
 unmanagedAttributePolicy.ADMIN_EDIT=Solo los administradores pueden escribir
-notAllowedToDeleteAllClientScopes=No tienes permiso para eliminar todos los alcances del cliente.
+notAllowedToDeleteAllClientScopes=No tiene permiso para eliminar todos los client scopes.
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=Usuario deshabilitado por error de bloqueo temporal
 unmanagedAttributePolicy.ENABLED=Habilitado
 policyRolesHelp=Haga clic en 'Agregar roles' para incluir los roles aceptados para esta política. Marcar la casilla de verificación 'campo obligatorio' en un rol indica que el rol seleccionado DEBE estar presente al evaluar la política, independientemente de otros roles. Dejar todos los roles relevantes de la política sin marcar equivale a establecer una estrategia de decisión como 'Afirmativa'.
-unmanagedAttributesHelpText=Los atributos no gestionados son atributos de usuario que no están explícitamente definidos en la configuración del perfil de usuario. Por defecto, los atributos no gestionados están `Deshabilitados` y no están disponibles en ningún contexto, como el registro, la cuenta o la consola de administración. Al establecerlos como `Habilitados`, los atributos no gestionados son plenamente reconocidos por el servidor y accesibles en todos los contextos, lo cual es útil si estás migrando un realm existente al perfil de usuario declarativo y aún no tienes todos los atributos de usuario definidos en la configuración del perfil. Al configurarlos como `Solo los administradores pueden escribir`, los atributos no gestionados pueden ser gestionados únicamente a través de la consola de administración y la API, lo cual es útil si ya has definido algún atributo personalizado que los usuarios pueden gestionar, pero no estás seguro de añadir otros atributos que solo deberían ser gestionados por administradores. Al configurarlos como `Solo los administradores pueden ver`, los atributos no gestionados son de solo lectura y están disponibles únicamente a través de la consola de administración y la API.
+unmanagedAttributesHelpText=Los atributos no gestionados son atributos de usuario que no están explícitamente definidos en la configuración del perfil de usuario. Por defecto, los atributos no gestionados están `Deshabilitados` y no están disponibles en ningún contexto, como el registro, la cuenta o la consola de administración. Al establecerlos como `Habilitados`, los atributos no gestionados son plenamente reconocidos por el servidor y accesibles en todos los contextos, lo cual es útil si está migrando un realm existente al perfil de usuario declarativo y aún no tiene todos los atributos de usuario definidos en la configuración del perfil. Al configurarlos como `Solo los administradores pueden escribir`, los atributos no gestionados pueden ser gestionados únicamente a través de la consola de administración y la API, lo cual es útil si ya ha definido algún atributo personalizado que los usuarios puedan gestionar, pero no está seguro de añadir otros atributos que solo deberían ser gestionados por administradores. Al configurarlos como `Solo los administradores pueden ver`, los atributos no gestionados son de solo lectura y están disponibles únicamente a través de la consola de administración y la API.
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=Usuario deshabilitado por bloqueo temporal
 updateTranslationSuccess=¡Éxito! Traducción actualizada.
 jwtX509HeadersEnabled=Agregar encabezados X.509 al JWT
@@ -2930,7 +2922,7 @@ maxTemporaryLockoutsHelp=Número de bloqueos temporales permitidos antes de que
 bruteForceStrategyHelp=Múltiples significa que el tiempo de espera solo se incrementará cuando el número de fallos sea múltiplo de '{{failureFactor}}'. Lineal significa que cada nuevo fallo, a partir de '{{failureFactor}}', incrementará el tiempo de espera.
 providerIdHelp=ID del proveedor
 disableConfirmClientTitle=¿Deshabilitar cliente?
-disableConfirmClient=¿Estás seguro de que deseas deshabilitar este cliente?
+disableConfirmClient=¿Está seguro que desea deshabilitar este cliente?
 firstBrokerLoginFlowAliasOverride=Sobrescribir flujo de primer inicio de sesión
 noTranslationsInstructions=Agrega una traducción para comenzar.
 frontchannelLogoutSessionRequired=Se requiere sesión de cierre de sesión en canal frontal
@@ -2954,7 +2946,7 @@ importKeysSuccess=Claves reimportadas con éxito. Por favor, guarda el proveedor
 deleteConditionError=Error al eliminar la condición: {{error}}
 save-admin-eventsHelp=Si está habilitado, los eventos de administración se guardan en la base de datos, lo que los hace disponibles en la interfaz de administración (Admin UI).
 invalidJsonClientProfilesError=No se pueden guardar los perfiles del cliente, la información proporcionada no es un JSON válido: {{error}}
-user-clearEventsHelp=¡Éxito! La traducción ha sido añadida.
+user-clearEventsHelp=Elimina todos los eventos de usuario en la base de datos.
 themeColors=Colores del tema
 defaults=Restablecer a los valores predeterminados
 themeColorsLight=Colores del tema [claro]
@@ -2965,7 +2957,7 @@ themeColorsDark=Colores del tema [oscuro]
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=Error: usuario deshabilitado por bloqueo temporal
 invalidJsonClientPoliciesError=No se pueden guardar las políticas del cliente, la información proporcionada no es un JSON válido: {{error}}
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Usuario deshabilitado por bloqueo temporal
-themePreviewInfo=Para previsualizar los colores del tema, el tema actual debe estar configurado en el que deseas previsualizar, por lo que te hemos cambiado automáticamente al que quieres previsualizar.
+themePreviewInfo=Para previsualizar los colores del tema, el tema actual debe estar configurado en el que desea previsualizar, por lo que le hemos cambiado automáticamente al que quiere previsualizar.
 errorColor=Color de Error
 successColor=Color de Acierto
 activeColor=Color de Activado
@@ -2990,7 +2982,7 @@ emptyRealmBasedIdps=No se han configurado proveedores de identidad basados en el
 hideOrganizationLinkedIdps=Ocultar proveedores de identidad vinculados a la organización
 viewCondition=Ver condición
 oid4vcIssuerMetadata=Metadatos de OpenID4VCI Credential Issuer
-enabledWhenTooltip=Especifica cuándo está disponible un atributo. Cuando se usan scopes, el atributo está disponible si al menos uno de los scopes configurados se aplica en la solicitud de inicio de sesión. Tanto los scopes predeterminados como los opcionales de la solicitud actual se evalúan. En los contextos de la consola de administración y la consola de cuenta, los scopes no se evalúan y el atributo siempre está disponible (si no está restringido adicionalmente por permisos).
+enabledWhenTooltip=Especifica cuándo está disponible el atributo. Cuando se utilizan scopes, el atributo está disponible cuando se aplica al menos uno de los scopes configurados en la solicitud de inicio de sesión. Se evalúan tanto los scopes predeterminados como los opcionales de la solicitud actual. En los contextos de la Consola de administración y la Consola de cuentas, no se evalúan los scopes y el atributo siempre está disponible (a menos que esté restringido adicionalmente por permisos).
 addTranslationError=Error al crear la traducción: {{error}}
 artifactBindingResponse=Respuesta de binding de ARTIFACT
 bruteForceModeHelpText=Si está habilitado, especifica qué debería suceder con la cuenta de usuario si se detecta un ataque de fuerza bruta.
@@ -3000,9 +2992,9 @@ artifactResolutionServiceUrlHelp=La URL que debe usarse para obtener afirmacione
 resetAction=Restablecer acción
 admin-clearEventsHelp=Elimina todos los eventos de administración en la base de datos.
 locales=Localizaciones
-realmOverrides=Reinos sobrescritos
+realmOverrides=Realms sobrescritos
 effectiveMessageBundles=Paquetes de mensajes efectivos
-effectiveMessageBundlesHelp=Puedes buscar paquetes de mensajes efectivos basándote en temas, características, idioma y texto libre.
+effectiveMessageBundlesHelp=Puede buscar paquetes de mensajes efectivos basándote en temas, características, idioma y texto libre.
 minimumACRValueHelp=ACR mínimo que será aplicado por Keycloak. Sobrescribe ACRs inferiores solicitados explícitamente mediante 'acr_values' o 'claims', a menos que estén marcados como esenciales.
 client-attributes.label=Atributos del cliente
 targetContextAttributesHelp=Define la evaluación de atributos de contexto (claims) en lugar de atributos de identidad
@@ -3017,14 +3009,14 @@ requiredWhenTooltip=Cuando se usan scopes, el atributo es obligatorio si al meno
 client-attributes-condition.tooltip=Atributos del cliente que serán verificados durante la evaluación de esta condición. La condición se evalúa como verdadera si el cliente tiene todos los atributos de cliente con el nombre y valor especificados en la configuración.
 jwtX509HeadersEnabledHelp=Si está habilitado, el encabezado x5t (huella SHA-1 del certificado X.509) se añadirá al JWT para referenciar el certificado utilizado para firmarlo. De lo contrario, se usará el encabezado kid (ID de clave).
 updateTranslationError=Error al actualizar la traducción: {{error}}
-realmOverridesHelp=Solo puedes editar los idiomas admitidos. Si no has seleccionado un idioma admitido aún, solo puedes editar el idioma inglés.
+realmOverridesHelp=Solo puede editar los idiomas admitidos. Si no ha seleccionado un idioma admitido aún, solo puede editar el idioma inglés.
 deleteAllTranslationsSuccess=Traducción(es) eliminada(s) exitosamente.
 emptyEffectiveMessageBundles=Buscar mensajes efectivos
-emptyEffectiveMessageBundlesInstructions=Puedes buscar los mensajes efectivos que deseas por tema, característica e idioma en la barra de búsqueda de arriba.
+emptyEffectiveMessageBundlesInstructions=Puede buscar los mensajes efectivos que desea por tema, característica e idioma en la barra de búsqueda de arriba.
 themeType=Tipo de tema
 language=Lenguaje
 deleteAllTranslationsError=Error al eliminar traducción(es), {{error}}
-noRealmOverridesSearchResultsInstructions=Haz clic en la barra de búsqueda de arriba para buscar sobrescrituras de realm
+noRealmOverridesSearchResultsInstructions=Haga clic en la barra de búsqueda de arriba para buscar sobrescrituras de realm
 searchForEffectiveMessageBundles=Buscar paquete de mensajes
 hasWords=Contiene palabras
 selectAll=Seleccionar todo
@@ -3053,7 +3045,7 @@ addTranslation=Agregar traducción
 itemDeleteConfirmTitle=¿Eliminar elemento?
 lightweightAccessToken=Usar siempre tokens de acceso ligero
 viewGuides=Ver guías
-realmOverridesDescription=Las sobrescrituras del realm te permiten especificar traducciones que tendrán efecto en todo el realm. Estas traducciones sobrescribirán cualquier traducción especificada por un tema.
+realmOverridesDescription=Las sobrescrituras del realm le permiten especificar traducciones que tendrán efecto en todo el realm. Estas traducciones sobrescribirán cualquier traducción especificada por un tema.
 searchItem=Buscar elemento
 welcomeTo=Bienvenido a {{realmDisplayInfo}}
 loa-condition-level=Nivel de Autenticación (LoA)
@@ -3061,10 +3053,10 @@ noItems=No hay elementos
 loa-max-age.tooltip=Edad máxima en segundos para que este nivel de autenticación sea válido. Si se solicita este nivel en particular y el usuario ya se autenticó con este nivel antes de la cantidad especificada de segundos, no se le pedirá que se vuelva a autenticar. Pero si se autenticó después de la cantidad especificada de segundos, deberá volver a autenticarse con este nivel. Un valor de 0 en la configuración significa que siempre se requiere que el usuario se vuelva a autenticar con este nivel cuando se solicite.
 includeInLightweight.tooltip=¿Debe incluirse la reclamación en el token de acceso ligero?
 itemSaveError=¡Error! No se pudo guardar el elemento: {{error}}
-itemDeleteConfirm=¿Estás seguro de que deseas eliminar permanentemente el elemento?
+itemDeleteConfirm=¿Está seguro de que desea eliminar permanentemente el elemento?
 loa-max-age=Edad Máxima
 authenticatorRefConfig.maxAge.help=La edad máxima en segundos que el valor de referencia del autenticador es válido en una sesión SSO. Cuando se utiliza el asignador de protocolo de Método de Autenticación Referenciado (AMR), el AMR solo se considerará válido y se incluirá en el token si la ejecución del autenticador se completó dentro de la edad máxima especificada.
-noItemsInstructions=No has creado ningún elemento en este realm. Crea un elemento para empezar.
+noItemsInstructions=No ha creado ningún elemento en este realm. Cree un elemento para empezar.
 welcomeTabTitle=Bienvenido
 itemDelete=Eliminar elemento
 authenticatorRefConfig.maxAge.label=Edad Máxima de Referencia del Autenticador
@@ -3072,7 +3064,7 @@ loa-condition-level.tooltip=Nivel de autenticación. Este valor siempre debe ser
 lightweightAccessTokenHelp=Si está activado, siempre se usan tokens de acceso ligeros. Si está desactivado, no se usan por defecto, pero es posible habilitarlos mediante un ejecutor de políticas de cliente.
 createItem=Crear elemento
 supportJwtClaimInIntrospectionResponseHelp=Si está activado, las solicitudes de introspección que utilicen el encabezado 'Accept: application/jwt' también contendrán una reclamación llamada "jwt" con las reclamaciones del resultado de la introspección codificadas como un token de acceso JWT.
-welcomeText=Keycloak proporciona federación de usuarios, autenticación fuerte, gestión de usuarios, autorización detallada y más. Agrega autenticación a aplicaciones y protege servicios con un esfuerzo mínimo. No necesitas preocuparte por almacenar usuarios o autenticar usuarios.
+welcomeText=Keycloak proporciona federación de usuarios, autenticación fuerte, gestión de usuarios, autorización detallada y más. Agrega autenticación a aplicaciones y protege servicios con un esfuerzo mínimo. No necesita preocuparte por almacenar usuarios o autenticar usuarios.
 effectiveMessageBundlesDescription=Un paquete de mensajes efectivo es el conjunto de traducciones para un idioma, tema y tipo de tema determinados. También tiene en cuenta cualquier sobrescritura de realm, que tendrá prioridad.
 selectIdTokenSignatureAlgorithm=Seleccionar algoritmo de firma del token de ID
 selectIdTokenEncryptionKeyManagementAlgorithm=Seleccionar algoritmo de gestión de claves de cifrado del token de ID
@@ -3113,7 +3105,6 @@ selectAccountTheme=Seleccionar tema de cuenta
 userNotSaved=El usuario no ha sido guardado: {{error}}
 supportedLanguagesTableColumnName=Idiomas soportados
 emptyUserEvents=Sin eventos de usuario
-addTranslationsModalSubTitleBolded=Configuración del realm > Localización > Anulaciones del realm.
 selectCachePolicy=Seleccionar política de caché
 spinnerLoading=Cargando
 selectIdTokenEncryptionContentEncryptionAlgorithm=Seleccionar algoritmo de cifrado del contenido del token de ID
@@ -3121,7 +3112,7 @@ selectBindType=Seleccionar tipo de enlace
 translationTableColumnName=Traducción
 addTranslationsDialogRowsTable=Añadir un cuadro de diálogo de traducciones en formato tabla
 addTranslationDialogHelperText=La traducción basada en el idioma por defecto es obligatoria.
-translationError=Por favor, añade traducciones antes de guardar: {{error}}
+translationError=Por favor, añada traducciones antes de guardar: {{error}}
 parRequestUriLifespan=Duración de vida de la URI de solicitud para Solicitudes de Autorización Empujadas
 selectEvictionHour=Seleccionar hora de desalojo
 translationKey=Clave
@@ -3133,7 +3124,7 @@ selectUnmanagedAttributePolicy=Seleccionar política de atributos no gestionados
 searchClientAuthorizationPermission=Buscar permiso
 bruteForceMode.Disabled=Deshabilitado
 senderEnvelopePlaceholder=Dirección de correo del sobre del remitente
-idpAccountEmailVerificationHelp=Especifica un tiempo de espera independiente para la verificación del correo del proveedor de identidad (IdP).
+idpAccountEmailVerificationHelp=Tiempo de espera independiente para la verificación del correo electrónico de la cuenta del IdP
 sendIdTokenOnLogoutHelp=Si el parámetro 'id_token_hint' debe enviarse en las solicitudes de cierre de sesión.
 fetchRoles=Obtener roles
 fetchRolesHelp=Por defecto, solo se usan los roles disponibles en el token enviado con las solicitudes de autorización para verificar si el usuario tiene un rol asignado. Si esta configuración está habilitada, la política ignorará los roles del token y verificará cualquier rol asociado con el usuario en su lugar.
@@ -3145,11 +3136,11 @@ searchForLanguage=Buscar idioma
 replyToEmailPlaceholder=Responder a la dirección de correo
 selectFlowType=Seleccionar tipo de flujo
 bruteForceMode.TemporaryLockout=Bloqueo temporal
-to el atributo. Para eso, asegúrate de usar cualquiera de los validadores integrados para validar correctamente el tamaño y los valores.
+to el atributo. Para eso, asegúrese de usar cualquiera de los validadores integrados para validar correctamente el tamaño y los valores.
 sendClientIdOnLogoutHelp=Si el parámetro 'client_id' debe enviarse en las solicitudes de cierre de sesión.
 noLanguagesInstructions=Añade un idioma en Configuración del realm > Localización > Idiomas para empezar.
-addTranslationsModalSubTitle=Puedes traducir el "{{fieldName}}" según tu configuración regional o tus idiomas preferidos. Además, puedes crear o editar las traducciones del "{{fieldName}}" en
-noLanguagesSearchResultsInstructions=Haz clic en la barra de búsqueda arriba para buscar idiomas
+addTranslationsModalSubTitle=Puede traducir el "{{fieldName}}" según su configuración regional o idiomas preferidos. Además, también puede crear o editar las traducciones de "{{fieldName}}" en las <1>Configuraciones del realm > Localización > Reglas del realm.</1>
+noLanguagesSearchResultsInstructions=Haga clic en la barra de búsqueda arriba para buscar idiomas
 parRequestUriLifespanHelp=Número que representa la duración de vida de la solicitud del URI . El valor por defecto es 1 minuto.
 selectRequestObjectEncoding=Seleccionar codificación del objeto de solicitud
 selectAccessTokenSignatureAlgorithm=Seleccionar algoritmo de firma del token de acceso
@@ -3161,7 +3152,7 @@ selectRequestObjectRequired=Seleccionar objeto de solicitud requerido
 selectAuthorizationSignedResponseAlgorithm=Seleccionar algoritmo de respuesta firmada de autorización
 selectAuthorizationEncryptedResponseEnc=Seleccionar codificación de cifrado de respuesta de autorización
 generatedCodeTextArea=Área de texto para código generado
-selectAuthScopes=Seleccionar alcances de autorización
+selectAuthScopes=Seleccionar scopes de autorización
 selectClients=Seleccionar clientes
 selectAdminTheme=Seleccionar tema de administración
 selectEmailTheme=Seleccionar tema de correo electrónico
@@ -3207,10 +3198,10 @@ linkUpdateError=No se pudo actualizar el vínculo con el proveedor de identidad:
 noResultsFound=No se encontraron resultados
 linkedOrganization=Organización vinculada
 redirectWhenEmailMatches=Redirigir cuando el dominio de correo coincide
-emailVerificationHelp=Especifica un tiempo de espera independiente para la verificación de correo electrónico.
+emailVerificationHelp=Tiempo de espera independiente para la verificación de correo electrónico
 emptyUserOrganizations=No hay organizaciones
-emptyUserOrganizationsInstructions=Aún no hay organizaciones. Por favor, únete a una organización o envía una invitación para unirte a una organización.
-organizationRemoveConfirm_other=¿Estás seguro de que deseas eliminar al usuario de las {{count}} organizaciones seleccionadas?
+emptyUserOrganizationsInstructions=Aún no hay organizaciones. Por favor, únase a una organización o envíe una invitación para unirse a una organización.
+organizationRemoveConfirm_other=¿Está seguro que desea eliminar al usuario de las {{count}} organizaciones seleccionadas?
 organizationName=Nombre de la organización
 userAddedOrganization_one=Organización añadida al usuario
 userInvitedOrganization_one=Invitación enviada al usuario
@@ -3244,7 +3235,7 @@ linkUpdatedSuccessful=El vínculo con el proveedor de identidad se actualizó ex
 organization=Organización
 organizationRemoveError=No se pudo eliminar al usuario de las organizaciones: {{error}}
 identityProviderUnlink=¿Desvincular proveedor de identidad?
-identityProviderUnlinkConfirm=¿Estás seguro de que deseas desvincular este proveedor de identidad?
+identityProviderUnlinkConfirm=¿Está seguro que desea desvincular este proveedor de identidad?
 eventTypes.UPDATE_CREDENTIAL.name=Actualizar credencial
 eventTypes.REMOVE_CREDENTIAL.name=Eliminar credencial
 eventTypes.REMOVE_CREDENTIAL.description=Eliminar credencial
@@ -3266,16 +3257,16 @@ noIdentityProvider=No hay proveedores de identidad en este realm
 selectIdentityProvider=Seleccionar un proveedor de identidad
 searchProvider=Buscar proveedor
 send=Enviar
-forgotPasswordHelp=Especifica un tiempo de espera independiente para la opción de contraseña olvidada.
+forgotPasswordHelp=Tiempo de espera independiente para la recuperación de contraseña
 organizationDelete=¿Eliminar organización?
 organizationSaveError=No se pudo guardar la organización: {{error}}
 orgainzatinoDeleteError=No se pudo eliminar el cliente: {{error}}
 searchOrganization=Buscar organización
-executeActionsHelp=Especifica un tiempo de espera independiente para ejecutar acciones.
+executeActionsHelp=Tiempo de espera independiente para la ejecución de acciones
 shownOnLoginPageHelp=Cuando está marcado, este proveedor de identidad se muestra en la página de inicio de sesión.
 userAddedOrganization_other={{count}} organizaciones añadidas al usuario
 organizationDeleteConfirm=¿Está seguro de que desea eliminar permanentemente esta organización? Si lo hace, se borrarán todos los datos asociados a esta organización.
-organizationRemoveConfirm_one=¿Estás seguro de que deseas eliminar al usuario de la organización seleccionada?
+organizationRemoveConfirm_one=¿Está seguro que desea eliminar al usuario de la organización seleccionada?
 organizationUsersLeftError=No se pudo eliminar usuarios de la organización: {{error}}
 verifiableCredentialsEnabledHelp=Si está habilitado, permite gestionar credenciales verificables en este realm.
 organizationsEnabledHelp=Si está habilitado, permite gestionar organizaciones. De lo contrario, las organizaciones existentes se conservarán, pero no se podrán administrar ni autenticar a sus miembros.
@@ -3288,8 +3279,8 @@ organizationRedirectUrlHelp=Redirige automáticamente al usuario después de com
 organizationDomainHelp=Conjunto de uno o más dominios de internet asociados con la organización. El dominio se utiliza para mapear usuarios a una organización en función del dominio de su correo electrónico y para autenticarlos en el ámbito de la organización.
 organizationAliasHelp=El alias identifica de manera única a una organización utilizando un formato diseñado principalmente para referencia interna, como al emitir reclamaciones relacionadas con la organización en tokens o en un tema personalizado.
 organizationsExplain=Gestione sus organizaciones y miembros.
-noIdentityProviderInstructions=Aún no hay proveedores de identidad en este realm. Si deseas vincular un proveedor de identidad con esta organización, por favor ve a la sección "Proveedores de identidad" en la barra de navegación izquierda y crea uno
-disableConfirmUser=¿Estás seguro de que deseas deshabilitar este usuario?
+noIdentityProviderInstructions=Aún no hay proveedores de identidad en este realm. Si desea vincular un proveedor de identidad con esta organización, por favor vaya a la sección "Proveedores de identidad" en la barra de navegación izquierda y cree uno
+disableConfirmUser=¿Está seguro que desea deshabilitar este usuario?
 duplicateGroupWarning=La duplicación de grupos con un gran número de subgrupos no está soportada. Por favor, asegúrate de que el grupo que intentas duplicar no tenga un gran número de subgrupos.
 logo=Logo
 organizationUsersAddedError=No se pudo añadir usuarios a la organización: {{error}}
@@ -3314,11 +3305,11 @@ clearCacheError=No se pudo limpiar la caché: {{error}}
 UNMANAGED=No gestionado
 downloadThemeJar=Descargar tema JAR
 themeColorInfo=Aquí puede configurar las variables de color de PatternFly y crear un archivo "theme jar" que puede descargar y colocar en su carpeta de proveedores para aplicar el tema a su realm.
-permissionsSubTitle=Los permisos administrativos de nivel detallado permiten asignar derechos de acceso específicos y detallados, controlando qué recursos y acciones se pueden gestionar.
+permissionsSubTitle=Los permisos controlan el acceso a un recurso o a múltiples recursos de un mismo tipo.
 clearCachesTitle=Limpiar cachés
 organizationsMembersListError=No se pudieron obtener los miembros de la organización: {{error}}
 noGroupMembershipsText=Este usuario no es miembro de ningún grupo.
-termsAndConditionsDeclined=Necesitas aceptar los Términos y Condiciones para continuar
+termsAndConditionsDeclined=Necesita aceptar los Términos y Condiciones para continuar
 deleteConfirmUsers_one=¿Eliminar usuario {{name}}?
 keysCache=Caché de claves
 managedMembership=Membresía gestionada
@@ -3327,8 +3318,180 @@ expandRow=Expandir fila
 clearKeysCacheHelp=Limpia todas las entradas de la caché de claves públicas externas. Estas son claves de clientes externos o proveedores de identidad. Esto eliminará todas las entradas de todos los realms.
 clearCacheSuccess=Caché limpiada exitosamente
 somethingWentWrong=Algo salió mal
-darkModeEnabledHelp=Si está habilitado, se aplicará la variante oscura del tema según la preferencia del usuario, basada en la configuración del sistema operativo (e.g., modo claro u oscuro) o en la configuración del agente del usuario. Si está deshabilitado, solo se utilizará la variante clara. Esta configuración solo aplica a temas que soportan variantes clara y oscura; en temas que no soporten esta funcionalidad, no tendrá efecto.
+darkModeEnabledHelp=Si está activado, la variante oscura del tema se aplica según la preferencia del usuario a través de una configuración del sistema operativo (modo claro u oscuro) o una configuración del agente de usuario. Si está desactivado, solo se utiliza la variante clara. Esta configuración se aplica únicamente a los temas que admiten variantes claras y oscuras. Si un tema no admite esta función, esta configuración no tiene efecto.
 savingUserEventsOff=El guardado de eventos de usuario está desactivado
 savingAdminEventsOff=El guardado de eventos de administrador está desactivado
 connectionTrace=Rastreo de conexión
-connectionTraceHelp=Si está habilitado, los paquetes LDAP ASN.1 BER entrantes y salientes se volcarán en el flujo de salida de errores. Ten cuidado al habilitar esta opción en producción, ya que expondrá todos los datos enviados hacia y desde el servidor LDAP. 
+connectionTraceHelp=Si está habilitado, los paquetes LDAP ASN.1 BER entrantes y salientes se volcarán en el flujo de salida de errores. Ten cuidado al habilitar esta opción en producción, ya que expondrá todos los datos enviados hacia y desde el servidor LDAP.
+membershipEvents=Eventos de membresía
+childGroupEvents=Eventos de grupos secundarios
+signatureAlgorithmIdentityProviderMetadata=Algoritmo de firma para los metadatos del IdP SAML
+signatureAlgorithmIdentityProviderMetadataHelp=Algoritmo de firma a utilizar para los metadatos del proveedor de identidad SAML; si no se especifica, los metadatos no se firmarán.
+crlCache=Cache CRL
+clearCrlCacheHelp=Borra todas las entradas de la caché CRL. La caché CRL mejora el rendimiento del autenticador X.509 cuando las Listas de Revocación de Certificados (CRL) están habilitadas. Esta acción eliminará todas las entradas de CRL para todos los realms.
+titlePermissions=Permisos
+permissionsName=Nombre del permiso
+permissionNameHelpText=El nombre del permiso. Este nombre se utiliza para identificar el permiso en la consola de administración.
+allClients=Todos los clientes
+permissionUsersHelpText=Especifica qué usuario(s) están autorizados por este permiso.
+resourceScope=Scope del recurso
+assignedPolicies=Políticas asignadas
+resourceScopeHelpText=Especifica el scope del recurso. Esto se utiliza para determinar el tipo de recurso al que se otorga el permiso.
+chooseAResourceType=Elegir un tipo de recurso
+createPermissionOfType=Este permiso se aplicará al {{resourceType}}
+emptyPermissionsInstructions=No existen permisos en este Realm.
+resourceType.Groups=Controla el acceso a las operaciones que pueden realizarse para los grupos en este Realm
+permissionsAssignedPolicy=Política asignada
+adminPermissionName=Nombre del permiso
+resourceType.Roles=Controla el acceso a las operaciones que pueden realizarse para los roles en este Realm
+resourceType.Clients=Controla el acceso a las operaciones que pueden realizarse para los clientes en este Realm
+resourceType.Users=Controla el acceso a las operaciones que pueden realizarse para los usuarios en este Realm
+specificClients=Clientes específicos
+assignExistingPolicies=Asignar políticas existentes
+policy=Política
+policyType=Tipo de política
+emptyAssignExistingPoliciesInstructions=No hay políticas existentes para asignar
+authorizationScope=Scope de autorización
+unAssignPolicy=Desasignar
+assignedPolicyType.user=Usuario
+authorizationScopeDetailsSubtitle=El scope de autorización define las acciones que pueden realizarse sobre un recurso.
+authorizationScopeDetailsName=Nombre
+authorizationScopeDetailsDescription=Descripción
+allResources=Todos los recursos
+createNewPolicy=Crear nueva política
+noAssignedPolicies=Sin políticas asignadas
+emptyAssignExistingPolicies=No hay políticas existentes
+chooseAResourceTypeInstructions=Elija un tipo de recurso para el cual creará un permiso.
+resourceType.Organizations=Controla el acceso a las operaciones que pueden realizarse para las organizaciones en este Realm
+policyTypeHelpText=Especifica el tipo de política. Esto se utiliza para determinar el tipo de política al que se otorga el permiso.
+noAssignedPoliciesInstructions=No hay políticas asignadas para este permiso
+authorizationScopeDetailsTitle=Detalles del scope de autorización
+resourceType.IdentityProviders=Controla el acceso a las operaciones que pueden realizarse para los proveedores de identidad en este Realm
+assignedPolicyType.allTypes=Todos los tipos
+currentRealm=Realm actual
+currentRealmExplain=Este realm está seleccionado
+viewAll=Ver todos
+recentlyUsed=Usado recientemente
+removeInvalidUsers=Eliminar usuarios inválidos durante las búsquedas
+removeInvalidUsersHelp=Elimina usuarios de la base de datos local si no están disponibles en el almacenamiento de usuarios al ejecutar búsquedas. Si esta opción está activada, los usuarios que ya no estén disponibles en su correspondiente almacenamiento de usuarios serán eliminados de la base de datos local cada vez que se intente buscarlos. Si está desactivada, los usuarios previamente importados desde el almacenamiento de usuarios se conservarán en la base de datos local como de solo lectura y deshabilitados, incluso si ya no están disponibles en el almacenamiento de usuarios. Por ejemplo, si un usuario fue eliminado directamente de LDAP o si el Users DN es inválido. Tenga en cuenta que este comportamiento solo ocurrirá cuando el usuario aún no esté en caché.
+requiredPolicies=Por favor, agregue al menos una política.
+createPermissionPolicy=Crear política
+authorizationScope.Clients.map-roles=Asigna los roles definidos por este cliente a recursos como usuarios y grupos
+authorizationScope.Clients.map-roles-client-scope=Aplica roles definidos por este cliente al client scope de otro cliente
+authorizationScope.Clients.view=Visualiza este cliente
+authorizationScope.Users.manage=Administra a todos los usuarios en el Realm
+authorizationScope.Users.view=Visualiza a todos los usuarios en el Realm
+authorizationScope.Groups.manage=Administra este grupo
+authorizationScope.Groups.manage-members=Administra los miembros del grupo
+authorizationScope.Groups.manage-membership=Agrega o elimina miembros del grupo
+authorizationScope.Clients.token-exchange=Controla qué clientes pueden intercambiar tokens por un token destinado a este cliente
+authorizationScope.Clients.manage=Administra completamente un cliente
+authorizationScope.Groups.view=Visualiza este grupo
+authorizationScope.Users.manage-group-membership=Administra la pertenencia a grupos para todos los usuarios en el Realm (se utiliza junto con una política de grupo)
+authorizationScope.Clients.configure=Realiza la gestión básica de un cliente
+authorizationScope.Users.impersonate=Suplanta a otros usuarios
+authorizationScope.Users.map-roles=Asigna roles para todos los usuarios
+authorizationScope.IdentityProviders.token-exchange=Permite a los clientes intercambiar tokens por tokens emitidos por este proveedor de identidad
+deleteAdminPermissionConfirm=Si elimina el permiso {{ permission }}, los administradores no podrán realizar las acciones sobre los recursos definidos por dicho permiso.
+emptyPermissionPoliciesInstructions=No existen políticas en este Realm.
+noPermissionSearchResultsInstructions=No hay permisos que coincidan con sus filtros.
+authorizationScope.Clients.map-roles-composite=Aplica los roles definidos por este cliente como un compuesto a otro rol
+authorizationScope.Groups.view-members=Visualiza los miembros del grupo
+enforceAccessTo=Aplicar control de acceso
+enforceAccessToHelpText=Especifica el recurso al que se aplica el permiso.
+groupsResources=Grupos
+addSubFlowTo=Agregar subflujo a {{name}}
+addExecutionTo=Agregar ejecución a {{name}}
+addConditionTo=Agregar condición a {{name}}
+standardTokenExchangeEnabled=Standard Token Exchange
+standardTokenExchangeEnabledHelp=Habilitar Standard Token Exchange V2 para este cliente.
+usersResources=Usuarios
+allResourceType=Todos los {{resourceType}}
+specificResourceType=Específico {{resourceType}}
+clientsResources=Clientes
+resourceTypeHelpText=Especifique cuáles {{resourceType}} están permitidos por este permiso. Si se deja en blanco, equivale a seleccionar todos.
+evaluation=Evaluación
+enableRefreshRequestedTokenTypeHelp=Controla si el Standard Token Exchange V2 permite solicitar un refresh token (parámetro "requested_token_type" con el valor "urn:ietf:params:oauth:token-type:refresh_token"). Si esta opción es "No" (predeterminado), el tipo de solicitud de refresh token nunca está permitido y se devuelve un error. Si esta opción es "Misma sesión", el refresh token devuelto debe usar la misma sesión que el token del sujeto, devolviendo un error si esa sesión no está disponible (por ejemplo, si el token del sujeto es transitorio).
+enableRefreshRequestedTokenType=Permitir refresh token en Standard Token Exchange
+permissionEvaluationPreview=Vista previa de evaluación de permisos
+permissionsEvaluationInstructions=Seleccione un usuario para verificar si tiene un acceso específico al recurso indicado. Después de hacer clic en el botón Evaluar a continuación, el resultado se mostrará en el panel derecho.
+permissionEvaluationAlertTitle=El usuario seleccionado no tiene acceso al(los) recurso(s) seleccionado(s)
+noPermissionsEvaluationResults=Sin evaluación
+noPermissionsEvaluationResultsInstructions=Configure la evaluación de permisos en el lado izquierdo
+authScope=Scope de autorización
+authScopeSelectHelp=Seleccione un scope de autorización que se utilizará para consultar permisos desde el servidor.
+resourceTypeSelectHelp=Seleccione un tipo de recurso que se utilizará para consultar permisos desde el servidor.
+grantedScope=Scope concedido:
+deniedScope=Scope denegado:
+evaluatedPolicy={{name}} votó {{status}}
+relativeUserCreateDnHelp=DN relativo desde el 'Users DN' donde se crearán los usuarios. Por ejemplo, esto permite que los usuarios se creen en un DN diferente al 'Users DN' principal cuando se utiliza un scope de búsqueda en subárbol.
+relativeUserCreateDn=DN relativo de creación de usuario
+sameSession=Misma sesión
+favicon=Favicon
+authorizationScope.Roles.map-role-client-scope=Aplica este rol al client scope de un cliente
+authorizationScope.Roles.map-role-composite=Aplica este rol como compuesto a otro rol
+selectUsers=Seleccionar usuario
+authorizationScope.Roles.map-role=Asocia este rol a un usuario o grupo
+selectRole=Seleccionar rol
+selectClient=Seleccionar cliente
+grantedPermissions=Permisos concedidos
+deniedPermissions=Permisos denegados
+eventTypes.INVITE_ORG.name=Invitar usuario a la organización
+disableTypeClaimCheck=Desactivar verificación de tipo de claim
+eventTypes.INVITE_ORG_ERROR.description=Error al invitar a un usuario a la organización
+eventTypes.INVITE_ORG_ERROR.name=Error al invitar a un usuario a la organización
+disableTypeClaimCheckHelp=Desactiva la validación del claim typ en los tokens recibidos del Proveedor de Identidad. Si está off, el claim de tipo se valida (predeterminado).
+eventTypes.INVITE_ORG.description=Error al invitar usuario a la organización
+authenticationTypeTokenAuth=Token
+authTokenUrl=URL del token de autenticación
+authTokenClientId=ClientId del token de autenticación
+authTokenClientSecret=Secreto del cliente del token de autenticación
+enableDebugSMTP=Habilitar depuración SMTP
+authTokenScope=Scope del token de autenticación
+authenticationType=Tipo de autenticación
+authenticationTypeBasicAuth=Contraseña
+tokenTokenUrlHelp=Endpoint de token para la obtención de tokens. Ejemplo en Keycloak: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+authTokenClientIdHelp=El client_id utilizado durante la obtención del token, por ejemplo, mykeycloak-sendmail-client
+authTokenScopeHelp=Los scope(s), separados por espacios, utilizados durante la obtención del token como parámetro scope, por ejemplo, 'basic sendmail'
+useRfc9068AccessTokenTypeHelp=Si está habilitado, los tokens de acceso tendrán el tipo de encabezado "at+jwt" en cumplimiento con RFC9068. De lo contrario, el tipo de encabezado será "JWT".
+useRfc9068AccessTokenType=Usar "at+jwt" como tipo de encabezado del token de acceso
+deleteConfirmRealm_other=¿Eliminar {{count}} realms?
+recentRealms=Realms recientes
+targetAudienceHelp=Configura el público objetivo. Esto es equivalente a usar el parámetro 'audience' en la solicitud de concesión del endpoint de tokens. Tenga en cuenta que el parámetro 'audience' solo está disponible actualmente para la concesión de intercambio de tokens. Para simular cualquier otra concesión o el intercambio de tokens sin el parámetro 'audience', se recomienda dejar este parámetro vacío.
+deleteConfirmRealm_one=¿Eliminar el realm {{name}}?
+targetAudience=Público objetivo
+forbiddenAdminConsole=No tiene permiso. Por favor, contacte a su administrador.
+manageRealms=Administrar realms
+cantDeleteMasterRealm=No se puede eliminar el master realm!
+targetAudiencePlaceHolder=Seleccionar público objetivo para el intercambio de tokens
+signatureMaxExp=Máxima expiración
+signatureMaxExpHelp=Tiempo máximo de expiración permitido para el JWT. Los tokens deben generarse justo antes de la autenticación. Después de este período, se considerarán inválidos por ser demasiado antiguos. Si no se define, el valor predeterminado es de 60 segundos.
+fileNameDialogTitle=Guardar como
+fileName=Nombre de archivo
+uploadGeneratedThemeJar=Cargar el archivo JAR del tema generado
+syncUsersStarted=La sincronización de usuarios ha comenzado.
+editGroup=Editar grupo
+userNameClaim=Claim de nombre de usuario
+userIDClaim=Claim de ID
+emailClaim=Claim de correo electrónico
+fullNameClaim=Claim de nombre completo
+givenNameClaim=Claim de nombre
+familyNameClaim=Claim de apellido
+familyNameClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el apellido del usuario. Si no se proporciona, el valor predeterminado es `family_name`.
+userProfileClaims=Claims del perfil de usuario
+oAuthSettings=Configuración de OAuth2
+userNameClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el nombre de usuario. Si no se proporciona, el valor predeterminado es `preferred_username`.
+addOAuth2Provider=Agregar proveedor OAuth v2
+emailClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el correo electrónico del usuario. Si no se proporciona, el valor predeterminado es `email`.
+userIDClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el identificador único del usuario. Si no se proporciona, el valor predeterminado es `sub`.
+fullNameClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el nombre completo del usuario. Si no se proporciona, el valor predeterminado es `name`.
+givenNameClaimHelp=El nombre del claim del documento JSON devuelto por el endpoint del perfil de usuario que representa el nombre del usuario. Si no se proporciona, el valor predeterminado es `given_name`.
+invalidLocale=La configuración regional seleccionada no es válida
+cpu=CPU
+processorCount=Cantidad de procesadores
+webAuthnPolicyPasskeysEnabled=Habilitar llaves de acceso
+webAuthnPolicyPasskeysEnabledHelp=Habilita la autenticación con llaves de acceso (interfaz condicional) en los formularios de nombre de usuario.
+deprecated=Obsoleto
+validity=Vencimiento del certificado
+validityHelp=Cantidad de años durante los cuales el certificado generado será válido.
+tokenIntrospectionUrl=URL de introspección de token
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties
index 6e64d536fb32..c4a185f6f8ee 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_fr.properties
@@ -1,10 +1,10 @@
 bruteForceDetection=Détection des attaques par force brute
 sslType.all=Toutes les requêtes
 themes=Thèmes
-editUsernameHelp=Si actif, le champ du nom de l''utilisateur est modifiable.
+editUsernameHelp=Si actif, le champ du nom de l'utilisateur est modifiable.
 seconds=Secondes
 password=Mot de passe
-waitIncrementSecondsHelp=Quand le seuil des erreurs est atteint, combien de temps l''utilisateur est-il bloqué ?
+waitIncrementSecondsHelp=Quand le seuil des erreurs est atteint, combien de temps l'utilisateur est-il bloqué ?
 accountThemeHelp=Sélectionnez le thème pour la gestion des comptes.
 events=Évènements
 sessions=Sessions
@@ -14,65 +14,65 @@ enableStartTls=Activer StartTLS
 push=Appuyer
 defaultLocale=Locale par défaut
 htmlDisplayName=Nom d'affichage HTML
-rememberMeHelpText=Affiche une case à cocher sur la page de connexion pour permettre aux utilisateurs de rester connectés entre deux redémarrages de leur navigateur, jusqu''à expiration de la session.
+rememberMeHelpText=Affiche une case à cocher sur la page de connexion pour permettre aux utilisateurs de rester connectés entre deux redémarrages de leur navigateur, jusqu'à expiration de la session.
 sslType.external=Les requêtes externes
 securityDefences=Mesures de sécurité
 realmSettings=Configurations du domaine
 duplicateEmailsHelpText=Autorise plusieurs utilisateurs à avoir la même adresse de courriel. Changer cette configuration va vider le cache. Il est recommandé de mettre à jour manuellement les contraintes sur le courriel dans la base de données après la désactivation du support des doublons.
 clients=Clients
-accessTokenLifespanHelp=Durée maximale avant que le jeton d''accès n''expire. Cette valeur devrait être relativement plus petite que la durée d''inactivité (timeout) du SSO.
-userRegistration=Enregistrement d''utilisateur
-save=Sauver
+accessTokenLifespanHelp=Durée maximale avant que le jeton d'accès n'expire. Cette valeur devrait être relativement plus petite que la durée d'inactivité (timeout) du SSO.
+userRegistration=Enregistrement d'utilisateur
+save=Sauvegarder
 enabled=Actif
 revocation=Révocation
 maxDeltaTimeSeconds=Durée de remise à zéro des erreurs
 SSOSessionIdle=Sessions SSO inactives
-loginActionTimeout=Durée d''inactivité des actions de connexions
+loginActionTimeout=Durée d'inactivité des actions de connexions
 endpoints=Endpoints
 supportedLocales=Locales supportées
 maxFailureWaitSecondsHelp=Durée maximale de blocage du compte utilisateur
-clientLoginTimeoutHelp=Durée maximale qu''a un client pour finir le protocole du jeton d''accès. Devrait être de l''ordre de la minute (1 min).
+clientLoginTimeoutHelp=Durée maximale qu'a un client pour finir le protocole du jeton d'accès. Devrait être de l'ordre de la minute (1 min).
 titleSessions=Sessions
-ssoSessionIdle=Temps d''inactivité autorisé avant expiration de la session. Les jetons et les sessions navigateurs sont invalidées quand la session expire.
+ssoSessionIdle=Temps d'inactivité autorisé avant expiration de la session. Les jetons et les sessions navigateurs sont invalidées quand la session expire.
 xFrameOptions=X-Frame-Options
 maxDeltaTimeSecondsHelp=Quand les erreurs sont-elles remises à zéro ?
 contentSecurityPolicy=Content-Security-Policy
-clientLoginTimeout=Durée d''inactivité de connexion (timeout)
+clientLoginTimeout=Durée d'inactivité de connexion (timeout)
 userFederation=Regroupement Utilisateur
 emailTheme=Thème pour le courriel
 times.minutes=Minutes
-registrationEmailAsUsername=Courriel comme nom d''utilisateur
-requireSslHelp=Niveau d''exigence HTTPS \: ''aucun'' signifie que le HTTPS n''est requis pour aucune adresse IP cliente. ''les requêtes externes'' signifie que localhost et les adresses IP privées peuvent accéder sans HTTPS.  ''toutes les requêtes'' signifie que le protocole HTTPS est obligatoire pour toutes les adresses IP.
+registrationEmailAsUsername=Courriel comme nom d'utilisateur
+requireSslHelp=Niveau d'exigence HTTPS : 'aucun' signifie que le HTTPS n'est requis pour aucune adresse IP cliente. 'les requêtes externes' signifie que localhost et les adresses IP privées peuvent accéder sans HTTPS. 'toutes les requêtes' signifie que le protocole HTTPS est obligatoire pour toutes les adresses IP.
 notBefore=Pas avant
-editUsername=Éditez le nom de l''utilisateur
+editUsername=Éditez le nom de l'utilisateur
 titleEvents=Évènements
 requireSsl=SSL requis
-impersonate=Usurper l''identité
+impersonate=Usurper l'identité
 host=Hôte
 from=De
 add=Ajouter
-failureFactorHelp=Nombre d''erreurs avant de déclencher le temps d''attente.
+failureFactorHelp=Nombre d'erreurs avant de déclencher le temps d'attente.
 minutes=Minutes
-userRegistrationHelpText=Activer/désactiver la page d''enregistrement. Un lien pour l''enregistrement sera visible sur la page de connexion.
-minimumQuickLoginWaitSeconds=Durée minimale d''attente entre deux connexions
+userRegistrationHelpText=Activer/désactiver la page d'enregistrement. Un lien pour l'enregistrement sera visible sur la page de connexion.
+minimumQuickLoginWaitSeconds=Durée minimale d'attente entre deux connexions
 port=Port
-adminThemeHelp=Sélectionnez le thème de la UI d''administration.
+adminThemeHelp=Sélectionnez le thème de la UI d'administration.
 emailThemeHelp=Sélectionnez le thème pour les courriels envoyées par le serveur.
 clientList=Clients
 SSOSessionMax=Maximum de sessions SSO
-minimumQuickLoginWaitSecondsHelp=Durée d''attente demandée après une erreur entre deux connexions.
-waitIncrementSeconds=Temps d''attente
+minimumQuickLoginWaitSecondsHelp=Durée d'attente demandée après une erreur entre deux connexions.
+waitIncrementSeconds=Temps d'attente
 certificate=Certificat
 title=Authentification
 verifyEmail=Vérification du courriel
 enableSSL=Activer SSL/TLS
 general=Général
-failureFactor=Nombre maximal d''erreurs de connexion
+failureFactor=Nombre maximal d'erreurs de connexion
 loginTheme=Thème de connexion
-adminTheme=Thème de la UI d''administration
-accessTokenLifespan=Durée de vie du jeton d''accès
-loginWithEmailHelpText=Autorise l''utilisateur à s''authentifier avec son adresse de courriel.
-loginTimeout=Durée d''inactivité de connexion
+adminTheme=Thème de la UI d'administration
+accessTokenLifespan=Durée de vie du jeton d'accès
+loginWithEmailHelpText=Autorise l'utilisateur à s'authentifier avec son adresse de courriel.
+loginTimeout=Durée d'inactivité de connexion
 tokens=Jetons
 setToNow=Mettre à maintenant
 authentication=Authentification
@@ -80,37 +80,3418 @@ times.seconds=Secondes
 headers=En-têtes
 hours=Heures
 clear=Effacer
-maxFailureWaitSeconds=Durée maximale d''attente
+maxFailureWaitSeconds=Durée maximale d'attente
 configure=Configurer
-userName=Nom de l''utilisateur
-loginThemeHelp=Sélectionnez le thème pour les pages de connexion, de mot de passe à usage unique basé sur le temps, des droits, de l''enregistrement, et du mot passe oublié.
+userName=Nom de l'utilisateur
+loginThemeHelp=Sélectionnez le thème pour les pages de connexion, de mot de passe à usage unique basé sur le temps, des droits, de l'enregistrement, et du mot passe oublié.
 manage=Gérer
-ssoSessionMax=Durée maximale avant que la session n''expire. Les jetons et les sessions navigateurs sont invalidées quand la session expire.
+ssoSessionMax=Durée maximale avant que la session n'expire. Les jetons et les sessions navigateurs sont invalidées quand la session expire.
 accountTheme=Thème du compte
 times.hours=Heures
 rememberMe=Se souvenir de moi
 titleAuthentication=Authentification
 times.days=Jours
-username=Nom de l''utilisateur
+username=Nom de l'utilisateur
 passwordPoliciesHelp.regexPattern=Le mot de passe doit correspondre à une ou plusieurs des expressions régulières Java définies.
 passwordPoliciesHelp.length=Le nombre minimum de caractères requis pour le mot de passe.
-passwordPoliciesHelp.passwordBlacklist=Empêche l''utilisation d''un mot de passe présent dans la liste noire.
+passwordPoliciesHelp.passwordBlacklist=Empêche l'utilisation d'un mot de passe présent dans la liste noire.
 passwordPoliciesHelp.digits=Le nombre de caractères numériques requis dans le mot de passe.
-passwordPoliciesHelp.notUsername=Le mot de passe ne peut pas être identique au nom d''utilisateur.
-passwordPoliciesHelp.notContainsUsername=Le mot de passe ne peut pas contenir le nom d''utilisateur.
-passwordPoliciesHelp.passwordHistory=Empêche un mot de passe récent d''être réutilisé.
-passwordPoliciesHelp.notEmail=Le mot de passe ne peut pas être identique à l''adresse mail de l''utilisateur.
+passwordPoliciesHelp.notUsername=Le mot de passe ne peut pas être identique au nom d'utilisateur.
+passwordPoliciesHelp.notContainsUsername=Le mot de passe ne peut pas contenir le nom d'utilisateur.
+passwordPoliciesHelp.passwordHistory=Empêche un mot de passe récent d'être réutilisé.
+passwordPoliciesHelp.notEmail=Le mot de passe ne peut pas être identique à l'adresse mail de l'utilisateur.
 passwordPoliciesHelp.maxLength=Le nombre maximum de caractères autorisés dans le mot de passe.
-passwordPoliciesHelp.maxAuthAge=L''âge maximum d''une authentification avec laquelle un mot de passe peut être modifié sans réauthentification.
+passwordPoliciesHelp.maxAuthAge=L'âge maximum d'une authentification avec laquelle un mot de passe peut être modifié sans réauthentification.
 passwordPoliciesHelp.specialChars=Le nombre de caractères spéciaux requis dans le mot de passe.
 passwordPoliciesHelp.lowerCase=Le nombre de lettres minuscules requises dans le mot de passe.
-passwordPoliciesHelp.forceExpiredPasswordChange=Le nombre de jours pendant lesquels le mot de passe est valide avant qu''un nouveau mot de passe ne soit requis.
+passwordPoliciesHelp.forceExpiredPasswordChange=Le nombre de jours pendant lesquels le mot de passe est valide avant qu'un nouveau mot de passe ne soit requis.
 passwordPoliciesHelp.upperCase=Le nombre de lettres majuscules requises dans le mot de passe.
-passwordPoliciesHelp.hashIterations=Le nombre de fois qu''un mot de passe est haché avant stockage ou vérification. Le nombre de rondes par défaut selon l'algorithme est : -1 pour Argon2, 210 000 pour pbkdf2-sha512, 600 000 pour pbkdf2-sha256 et 1 300 000 pour pbkdf2.
-passwordPoliciesHelp.hashAlgorithm=Applique un algorithme de hachage aux mots de passe, afin qu''ils ne soient pas stockés en texte clair.
+passwordPoliciesHelp.hashIterations=Le nombre de fois qu'un mot de passe est haché avant stockage ou vérification. Le nombre de rondes par défaut selon l'algorithme est : -1 pour Argon2, 210 000 pour pbkdf2-sha512, 600 000 pour pbkdf2-sha256 et 1 300 000 pour pbkdf2.
+passwordPoliciesHelp.hashAlgorithm=Applique un algorithme de hachage aux mots de passe, afin qu'ils ne soient pas stockés en texte clair.
 trusted-hosts.label=Hôtes de confiance
 deletedSuccess=Fournisseur supprimé avec succès.
 cancel=Annuler
-deleteConfirm_other=Êtes-vous sûr de vouloir supprimer ces groupes.
+deleteConfirm_other=Êtes-vous sûr de vouloir supprimer ces groupes ?
 searchAttributes=Chercher des attributs
 userID=ID de l'utilisateur
+importAdded_zero=Aucun enregistrement ajouté.
+createClientPolicy=Créer une politique client
+clientSignature=Signature du client nécessaire
+sync-ldap-roles-to-keycloak=Synchroniser les rôles LDAP vers Keycloak
+eventTypes.PERMISSION_TOKEN.name=Jeton d'autorisation
+permissionsDisable=Désactiver les autorisations ?
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Erreur sur le lien de fédération d'identités
+addLdapWizardTitle=Ajouter un fournisseur LDAP de fédération d'utilisateurs
+disableConfirm=Êtes-vous sûr de vouloir désactiver '{{name}}'
+eventTypes.CUSTOM_REQUIRED_ACTION.description=Action spécifique nécessaire
+anyResource=Toute ressource
+secretHasExpired=Le secret a expiré. Merci d'en générer un nouveau en cliquant sur le bouton "Régénérer" ci-dessous
+searchByRoleName=Chercher par nom de rôle
+emptyClientScopes=Ce client ne possède aucun périmètre client défini
+eventTypes.CLIENT_UPDATE.name=Mise à jour du client
+addMultivaluedLabel=Ajouter {{fieldLabel}}
+notRepeat=Ne pas répéter
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Erreur de première connexion du fournisseur d'identités
+credentialType=Type
+persistent=Persistant
+ldapAttributeHelp=Name de l'attribut associé à l'objet LDAP. Par exemple 'cn', 'sn', 'mail', 'street', etc.
+validateBindDn=Vous devez entrer le DN de l'administrateur LDAP
+offlineSessionIdleHelp=Durée pendant laquelle une session hors ligne est autorisé à être inactive avant d'expirer. Vous devez utiliser un jeton hors ligne au moment pendant cette période ; sinon la session hors ligne expirera.
+eventTypes.CODE_TO_TOKEN_ERROR.description=Erreur de code du jeton
+passwordPolicy=Politique de mot de passe
+contextualAttributesHelp=N'importe quel attribut fourni par un environnement ou un contexte d'exécution.
+unmanagedAttributePolicy.ADMIN_VIEW=Seul les administrateurs peuvent voir
+dedicatedScopeExplain=Ceci est un périmètre de client qui inclut les correspondances associées et le périmètre
+updateOtpError=Impossible de mettre la politique OTP : {{error}}
+eventTypes.UPDATE_EMAIL.description=Mettre à jour le mail
+addressClaim.postal_code.label=Nom de l'attribut utilisateur pour le code postal
+eventTypes.CLIENT_UPDATE_ERROR.description=Erreur de mise à jour du client
+eventTypes.VALIDATE_ACCESS_TOKEN.description=Valider le jeton d'accès
+samlSignatureKeyNameHelp=Les documents SAML contiennent l'identification de la clé qui a signé dans l'élément KeyName. Pour Keycloak / RH-SSO utilisez KEY_ID, pour MS AD FR utilisez CERT_SUBJECT pour les autres vérifiez et utilisez NONE si aucune autre option ne fonctionne.
+validateSignature=Signatures valides
+unmanagedAttributePolicy.ADMIN_EDIT=Seul les administrateurs peuvent écrire
+useRfc9068AccessTokenType=Utilisez "at+jwt" comme type d'entête du jeton d'accès
+ldapAttributeNameHelp=Nom de l'attribut LDAP qui sera ajouté au nouvel utilisateur pendant l'enregistrement.
+testClusterFail=Impossible de vérifier la disponibilité pour : {{failedNodes}}. Réparez ou supprimez les cluster de nœuds et recommencez
+eventExplain=Les évènements des utilisateurs et des administrateurs sont enregistrés pour ce domaine. Pour configurer le suivi des ces évènements, allez à <1>Configuration des évènements</1>.
+signingKeysConfig=Configuration des clés de signature
+addedGroupMembership=Ajouté au groupe
+signedJWTConfirm=Générer une clé privée et un certificat pour le client depuis l'onglet Clés.
+resourceDeletedSuccess=La ressource a été supprimé avec succès
+userObjectClasses=Classes d'objet utilisateur
+useRefreshTokensHelp=Si activé un refresh_token sera créé et ajouté dans la réponse du token. Sinon aucune refresh_token ne sera généré.
+getStarted=Pour commencer sélectionner un fournisseur dans la liste ci dessous.
+permit=Permettez
+scopePermissions.groups.manage-description=Politiques qui décident si un administrateur peut gérer ce groupe
+webOrigins=Origine web
+removeUserText=Voulez vous supprimer {{numSelected}} utilisateur(s) ? Ces utilisateurs n'auront plus les permissions du rôle {{role}} et les rôles associés avec celui ci.
+removeImportedUsers=Supprimer les utilisateurs importés ?
+generatedAccessTokenIsDisabled=La génération d'un jeton d'accès est désactivé quand aucun utilisateur est sélectionné
+clientDescriptionHelp=Spécifie la description du client. Par exemple 'Mon client pour XX'. Supporte également les clés de traduction. Par exemple : ${my_client_description}.
+policyRolesHelp=Cliquez sur "Ajouter rôles" pour inclure tous les rôles acceptés pour cette politique. Cocher la case 'champ obligatoire' signifie que le rôle sélectionné DOIT être présent lors de l'application de la politique, peu importe les autres rôles. Laisser tous les rôles décochés de la politique est équivalent à mettre la stratégie de décision à 'Affirmatif'.
+wantAssertionsSignedHelp=Indique si le fournisseur de service attend une assertion signée.
+flowName=Nom du flux
+userInfoResponseEncryptionContentEncryptionAlgorithm=Algorithme de chiffrement du contenu pour la réponse des informations utilisateur
+passLoginHint=Transmettre login_hint
+openIdConnectCompatibilityModesHelp=Cette section permet de configurer des paramètres pour la rétro compatibilité avec des versions anciennes d'adaptateurs OpenID Connect / OAuth 2. C'est particulièrement utile si votre client utilise une ancienne d'un adpatateur Keycloak / RH-SSO.
+httpPostBindingAuthnRequestHelp=Indique si la AuthnRequest doit être envoyée en utilisé une requête HTTP-POST. Sinon un HTTP-REDIRECT sera utilisé.
+policyEnforcementMode=Mode d'application des politiques
+secretRotated=Rotation du secret
+userFedDeleteConfirmTitle=Suppression du fournisseur de regroupement d'utilisateur ?
+userCredentialsHelpTextLabel=Texte d'aide pour les identifiants de l'utilisateur
+role=Rôle
+displayName=Nom affiché
+applyToResourceTypeHelp=Spécifie si cette permission doit être appliqué à toutes les ressources avec le type donné. Dans ce cas, cette permission sera appliqué pour toutes les instances du type de ressource donné.
+cibaIntervalHelp=Le temps minimum en secondes que le CD (Consumption Device) doit attendre entre les requêtes de polling de l'interface de jeton. Si mis à 0, le CD doit utiliser 5 comme valeur par défaut selon les spécifications de la CIBA.
+envelopeFrom=Enveloppe de
+eventTypes.UPDATE_TOTP.name=Mise à jour du topt
+updateCibaError=Impossible de mettre à jour la politique de CIBA : {{error}}
+policyUrl=URL de la politique
+rolesPermissionsHint=Détermine si les permissions spécifiques sont activés pour gérer ce rôle. Désactiver ceci supprimera toutes les permissions actuelles qui auraient déjà été paramétrées.
+realmNameTitle=Domaine {{name}}
+subjectNameId=NomID du sujet
+credentialsList=Liste des identifiants
+usermodel.clientRoleMapping.clientId.label=ID du client
+clientId=ID du client
+serviceProviderEntityId=ID du service fournisseur d'entité
+internationalizationHelp=Si activé vous pouvez choisir quelles langues sont supportées pour ce domaine et quelle est la langue par défaut.
+oAuthDPoP=Nécessite l'entête de Demonstrating Proof of Possession (DPoP) dans les requêtes de jeton
+invalidRealmName=Le nom de domaine ne peut pas contenir de caractères spéciaux
+managePriorityOrder=Gérer l'ordre de priorité
+emptyMappers=Pas de correspondance
+artifactBindingUrlHelp=URL à laquelle envoyé les messages ARTEFACTS HTTP. Vous pouvez laisser cela vide si vous utilisez une autre association. Cette valeur doit être définie quand vous voulez forcez ensemble l'association ARTEFACT avec l'Idp de connexion.
+artifactBindingUrl=URL d'association d'artefact
+clientsList=List des clients
+userId=ID de l'utilisateur
+clientScopeTypes.default=Défaut
+invalidateRotatedSecret=Invalider la rotation du secret ?
+defaultRoles=Rôles par défaut
+noDirectUsers=Pas d'utilisateurs direct
+whoCanEditHelp=Si activé, les utilisateurs ou administrateurs peuvent voir et éditer l'attribut. Sinon, ils n'auront pas accès en écriture à l'attribut.
+eventTypes.LOGIN.name=Connexion
+addressClaim.country.tooltip=Name de l'attribut d'utilisateur qui sera utilisé pour associer le sous attribut 'pays' dans l'attribut 'adresse' du jeton. Par défaut 'country'.
+uuidLdapAttribute=attribut UUID LDAP
+scopeNameHelp=Nom du périmètre du client. Doit être unique dans le domaine. Ne doit pas contenir de caractères espace car il est utilisé comme valeur pour le paramètre du périmètre.
+requiredUserActions=Actions utilisateurs nécessaires
+noConsentsText=Le consentement sera uniquement enregistré quand les utilisateurs essaieront d'accéder à un client où le consentement est nécessaire. Dans ce cas, les utilisateurs auront une page qui leur demandera de donner leur consentement au client.
+addStep=Ajouter étapes
+clientAssertionAudience=Audience (URL du point d'extrémité) de l'assertion du client
+permissionPoliciesHelp=Spécifie toutes les politiques qui doivent être appliquées aux permissions.
+userInitiatedActionLifespanHelp=Durée maximale avant expiration d'une action envoyée par un utilisateur (comme par exemple un mail d'oubli de mot de passe). Il est recommandé de mettre cette durée courte car un utilisateur régait rapidement à une action auto-générée.
+clearFileExplain=Etes vous sûr que vous voulez effacer ce fichier ?
+userModelAttribute=Attribut du modèle d'utilisateur
+eventTypes.LOGOUT_ERROR.name=Erreur de déconnexion
+allowRemoteResourceManagement=Gestion des ressources à distance
+syncRegistrationsHelp=Les nouveaux utilisateurs doivent ils être créés avec le magasin LDAP ? La priorité change quel fournisseur est choisi pour synchronisé le nouvel utilisateur. Ce paramètre est appliqué uniquement avec le mode d'édition WRITABLE.
+resetPasswordAllowed=Mot de passe oublié
+emptyExecution=Pas d'étape
+passwordPolicyHintsEnabledHelp=Applicable seulement pour les MSAD accessible en écriture. Si activé mettre à jour les mots de passe des utilisateurs MSAD utilisera l'extension LDAP_SERVER_POLICY_HINTS_OID, ce qui signifie que les politiques de mot de passe de MSAD comme 'historique des mots de passe' ou 'âge minimal du mot de passe' seront appliqués. Cette extension ne fonctionne que pour la version MSAD 2008 R2 ou ultérieure.
+expirationValueNotValid=La valeur doit être égale ou supérieure à 1
+eventTypes.UPDATE_CONSENT.name=Mettre à jour le consentement
+forceArtifactBinding=Forcer l'association de l'artefact
+eventTypes.REFRESH_TOKEN_ERROR.description=Rafraîchir l'erreur du jeton
+eventTypes.IMPERSONATE.name=Impersonnel
+updateFirstLogin=Mettre à jour la première connexion
+columnDisplayDescription=Afficher la description
+flowUsedBy=Utiliser ce flux
+client-updater-trusted-hosts.label=Hôtes de confiance
+updateExecutorSuccess=L'exécuteur a été mise à jour
+assertionLifespan=Durée de vie de l'assertion
+export=Export
+claimFilterNameHelp=Nom de l'attribut essentiel
+revocationDescription=Ceci est un moyen de révoquer toutes les sessions actives et les jetons d'accès. Pas avant signifie que vous révoquer n'importe quel jetons qui a été créés avant la date.
+termsOfServiceUrl=Termes du services d'URL
+requestObject.request_uri\ only=URL de requête seulementt
+backchannelLogout=Déconnexion du canal d'arrière plan
+addressClaim.street.label=Attribut utilisateur pour la rue
+rolesScope=S'il n'y a pas de périmètre de rôles défini chaque utilisateur est autorisé à utiliser ce périmètre de client. Sinon l'utilisateur doit avoir au moins l'un des rôles.
+applyToResourceTypeFlag=Appliquer au type de ressource
+eventTypes.UPDATE_TOTP.description=Mise à jour du topt
+testError=Erreur pendant la connexion LDAP : '{{error}}'
+groupObjectClassesHelp=Classe(s) d'objet du groupe d'objet. Divisé par des virgules sinon plusieurs classes sont spécifiées. Dans un déploiement LDAP classique cela pourrait être 'groupOfNames'. Dans l'Active Direct, c'est souvent 'group'.
+filterByClients=Filtrer par clients
+claims=Attributs
+createPolicyOfType=Créer la politique {{policyType}}
+realmRolePrefix=Préfixe du rôle du domaine
+flowUsedByDescription=Ce flux est utilisé par {{value}}
+createClientScope=Créer périmètre de client
+includeRepresentation=Inclure la réprésentation
+singleLogoutServiceUrl=URL du service de déconnexion simple
+noRolesInstructions-roles=Vous n'avez pas créé de rôles dans ce domaine. Créez un rôle pour commencer.
+editIdPMapper=Modifier les correspondances du fournisseur d'identités
+representation=Représentation
+remove=Supprimer
+userProfile=Profil de l'utilisateur
+unmanagedAttributes=Attributs non gérés
+unmanagedAttributePolicy.ENABLED=Activé
+confirmPasswordDoesNotMatch=Les mots de passe ne sont pas identiques.
+eventTypes.DELETE_ACCOUNT_ERROR.description=Supprimer l'erreur du compte
+provider=Fournisseur
+flows=Flux
+root=Racine
+removeImportedUsersSuccess=Les utilisateurs importés ont été supprimés.
+eventTypes.VERIFY_PROFILE_ERROR.name=Vérifier l'erreur du profil
+signAssertionsHelp=Les assertions dans les documents SAML doivent elles être signées ? Ce paramètre n'est pas nécessaire si le document a déjà été signée.
+authnContextClassRefsHelp=Liste ordonnée des requêtes AuthnContext ClassRefs.
+sessionsType.directGrant=Allocation directe
+createAGroup=Créer un groupe
+effectiveProtocolMappersHelp=Contient tous les périmètres de client par défaut et périmètres optionnels sélectionnés. Toutes les correspondances de protocoles et les correspondances de périmètre de rôle de ces périmètres de client seront utilisés à la génération du jeton d'accès généré pour votre client.
+exportSuccess=Le domaine a été exporté avec succès.
+queryExtensions=Extensions de requête supportées
+searchAdminEventsBtn=Chercher les évènements des administrateurs
+deleteDialogDescription=Etes vous sûr de vouloir supprimer de façons définitive le groupe d'attributs <1>{{group}}</1> ?
+importResourceSuccess=La ressource a été correctement importée
+eventTypes.LOGOUT.description=Déconnexion
+deleteNodeBody=Etes vous sûr de vouloir supprimer définitivement le noeud "{{node}}"
+lifespan=Expire dans
+storedTokensReadableHelp=Activé/désactivé si les nouveaux utilisateurs peuvent lire n'importe quel jeton stocké. Cela attribue au broker le role read-token.
+authenticationFlowTypeHelp=De quelle forme s'agit-il ?
+usersAdded_one={{count}} utilisateurs ajoutés au groupe
+resourcesAndScopes=Périmètres et ressources
+eventTypes.UPDATE_CONSENT_ERROR.description=Mettre à jour les erreurs de consentement
+searchByName=Chercher par nom
+attributeConsumingServiceNameHelp=Nom de profil du service consommant les attributs, à propager dans les métadonnées du fournisseur de services.
+overrideActionTokens=Jetons de surcharge d'action
+deleteGrantsError=Impossible de supprimer les droits : {{error}}
+defaultGroupAdded_other={{count}} groupes ajoutés aux groupes par défaut
+used.SPECIFIC_CLIENTS=Clients spécifiques
+freeMemory=Espace libre
+applyPolicy=Appliquer la politique
+userFedDeleteConfirm=Si vous supprimer ce fournisseur de regroupement d'utilisateurs toutes les données associées seront supprimées.
+directGrantHelp=Sélectionner le flux que vous voulez utiliser pour l'authentification d'accès direct.
+unlockUsersSuccess=Tous les utilisateurs temporairement bloqués sont maintenant débloqués
+emptyPrimaryAction=Ajouter une correspondance prédéfinie
+enableClientSignatureRequired=Activer "Signature du client obligatoire" ?
+supportedApplicationsHelp=Applications connues utilisant la politique actuelle d'OTP.
+syncModeOverride=Surcharge du mode de synchronisation
+addAssociatedRolesError=Impossible d'associer les rôles {{error}}
+diagramView=Vue en diagramme
+accountLinkingOnly=Association de compte uniquement
+anyClient=La condition est satisfaite par n'importe quel client sur n'importe quel évènement.
+editFlow=Flux d'édition
+tokenSaveSuccess=Un nouveau jeton d'accès initial a été créé
+usermodel.attr.label=Attribut d'utilisateur
+eventTypes.REGISTER.name=Enregistrer
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=Utilisateur désactivé par blocage permanent
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=Utilisateur désactivé par erreur de blocage permanent
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=Utilisateur désactivé par blocage temporaire
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=Utilisateur désactivé par erreur de blocage temporaire
+deleteUser=Supprimer l'utilisateur
+addedNodeSuccess=Nœud ajouté avec succès
+eventTypes.INTROSPECT_TOKEN_ERROR.description=Erreur d'introspection de jeton
+syncModes.import=Importer
+realmSaveError=Impossible de mettre le domaine à jour : {{error}}
+allowRemoteResourceManagementHelp=Les ressources doivent elles être gérées à distance par le serveur ? Si non, les ressources pourront être gérées uniquement depuis cette interface Admin.
+addNewProvider=Ajouter un nouveau fournisseur
+keystoreHelp=Chemin vers le fichier des clés
+helpFileUploadClient=Charger un fichier JSON ou XML
+generateSuccess=Nouvelle paire clé/certificat générée avec succès
+userAttributeValueHelp=Valeur que vous voulez harcoder
+whoCanViewHelp=Si activé les utilisateurs et les administrateurs pourront voir l'attribut. Sinon ils n'auront pas accès à l'attribut.
+eventTypes.IDENTITY_PROVIDER_LOGIN.description=Identifiant du fournisseur d'identité
+includeClients=Inclure les clients
+copySuccess=Copié au presse papier !
+eventTypes.LOGOUT_ERROR.description=Erreur de déconnexion
+clientProfilesHelp=Les profils de clients appliqués à cette politique.
+deleteClientPolicyError=Impossible de supprimer la politique : {{error}}
+selectAttribute=Sélectionner l'attribut
+resourceAttributeHelp=Les attributs associés avec la ressource.
+updateCredentialUserLabelSuccess=L'étiquette de l'utilisateur a été mis à jour avec succès.
+product=Produit
+credentialUserLabel=Etiquette de l'utilisateur
+whoWillAppearPopoverText=Les groupes sont hiérarchiques. Quand vous sélectionner l'appartenance direct, vous voyez uniquement le groupe enfant que l'utilisateur a rejoint. Les groupes parents ne sont pas visibles.
+eventTypes.VERIFY_EMAIL.description=Vérifier le mail
+eventTypes.REFRESH_TOKEN_ERROR.name=Erreur du jeton de rafraîchissement
+partialImportHeaderText=L'import partiel vous permets d'importer les utilisateurs, clients et autres ressources d'un fichier JSON précédemment exporté.
+disableSuccess=Fournisseur désactivé avec succès
+subtree=Sous arbre
+effectiveRoleScopeMappingsHelp=Les périmètres optionnels de client sélectionnés qui seront utilisés quand un jeton d'accès sera généré pour ce client. Vous pouvez voir ci dessus quel veleur du paramètre du périmètre OAuth doit être utilisé quand vous voulez appliquer ces périmètres de client optionnels quand la requête initial d'authentification OpenID Connect sera envoyée depuis l'adapteur de votre client.
+disable=Désactivé
+membershipLdapAttribute=Attribut d'appartenance LDAP
+availableIdPs=Fournisseurs d'identité disponibles
+updateClientConditionSuccess=Conditions mise à jour avec succès.
+attributes=Attributs
+roleDeleteConfirmDialog=Cette action va supprimer définitivement le rôle "{{selectedRoleName}}". Aucun retour arrière possible.
+clientDelete=Supprimer {{clientId}} ?
+userDeletedSuccess=L'utilisateur a été supprimé
+revokeClientScopesTitle=Révoquer tous les périmètres de client ?
+contentSecurityPolicyReportOnlyHelp=Pour tester les politiques de sécurité de contenu <1>En savoir plus</1>
+eventTypes.PERMISSION_TOKEN.description=Jeton de permission
+allow-default-scopes.label=Autoriser les périmètres par défaut
+updateCibaSuccess=Politique CIBA mise à jour avec succès
+scopePermissions.clients.token-exchange-description=Politiques qui décident quels clients sont autorisés à échanger des jetons pour jeton est qui ciblé pour ce client.
+bindTypeHelp=Type d'authentification utilisé pendant une opération d'association LDAP. Utilisé dans la plupart des requêtes envoyées au serveur LDAp. Actuellement seulement 'none' (authentification LDAP anonyme) ou 'simple' (association des identifiant + association de l'authentification via mot de passe) sont disponibles.
+scopePermissions.roles.map-role-client-scope-description=Politiques qui décide si un administrateur peut appliquer ce rôle à un périmètre de client d'un client
+requestObject.request\ or\ request_uri=Requête ou URL de requête
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=Erreur OAuth2 du code d'appareil de jeton
+loginWithEmailAllowed=Se connecter avec un mail
+eventTypes.CLIENT_LOGIN.name=Connexion client
+deletedSuccessClientScope=La périmètre de client a été supprimé
+prompts.unspecified=Non spécifié
+revokeClientScopes=Etes vous sûr de vouloir révoquer tous les accès accordés aux périmètres client pour {{clientId}} ?
+showRemaining=Montrer ${remaining}
+createTokenHelp=Un jeton d'accès initial peut seulement être utilisé pour créer des clients.
+updateScopeSuccess=Périmètre d'autorisation mise à jour avec succès
+validateRealm=Vous devez entrer un domaine
+roleDeletedSuccess=Le rôle a été supprimé
+yes=Oui
+advancedClaimToRole=Si tous les attributs existent accordent à l'utilisateur le rôle de domaine ou de client spécifié.
+searchProfile=Chercher profil
+revokeRefreshToken=Révoquer le jeton de rafraîchissement
+updateClientPolicySuccess=Politique client mise à jour
+emptyAddClientScopes=Pas de périmètres client
+eventTypes.CLIENT_DELETE_ERROR.description=Erreur de suppression de client
+mappingUpdatedSuccess=Mise à jour du mapping effectuée avec succès
+logoUrlHelp=URL qui référence un logo pour l'application client
+eventTypes.RESET_PASSWORD.name=Réinitialiser le mot de passe
+exportWarningDescription=Si votre domaine inclut plusieurs groupes, rôles ou client l'opération peut rendre le serveur injoignable pendant quelques temps.
+memory=Mémoire
+idpType.social=Connexion sociale
+krbPrincipalAttribute=Attribut principal Kerberos
+kerberosIntegration=Integration Kerberos
+jumpToSection=Aller à la section
+noUsersEmptyStateDescription=Seulement les utilisateurs avec ce rôle directement assigné apparaîtront sur cet onglet. Si vous trouvez les utilisateurs assignés à ce rôle aller à
+disableSigningExplain=If vous désactiver "{{key}}" la base de données Keycloak sera mise à jour et vous aurez besoin peut être besoin de télécharger un nouvel adapteur pour ce client.
+changeTypeTo=Changer le type à
+savePasswordError=Erreur pendant la sauvegarde du moment de passe : {{error}}
+rdnLdapAttributeHelp=Nom de l'attribut LDAP qui sera utilisé comme RDN (attribut prioritaire) pour utilisateur DN. C'est souvent le même attribut que l'attribut du nom d'utilisateur LDAP ; toutefois ce n'est pas obligatoire. Par exemple, pour l'Active Directory on peut utilise communément 'cn' comme attribut RDN alors que l'attribut du nom d'utilisateur peut être 'sAMAccountName'.
+validRedirectURIsHelp=Schéma d'URI valide vers lequel le navigateur peut rediriger après une connexion réussie. Les jokers sont autorisés comme par exemple 'http://example.com/*'. Un chemin relatif peut aussi être précisé, exemple : /mon/chemin/relatif/*. Ces chemins sont relatifs à l'URL racine du client, si aucune URL racine n'est spécifiée l'URL d'authentification racine du serveur est utilisée. Pour SAML, vous devez mettre un schéma d'URI valide si vous dépendez du service d'URL du consommateur embarqué avec la requête de connexion.
+expireTimeHelp=Définie la durée après laquelle la politique ne DOIT pas être accordé. Accordée seulement si la date/heure actuelle est inférieure ou égale à cette valeur.
+unmanagedAttributePolicy.DISABLED=Désactivé
+useLowerCaseBearerType=Utiliser des caractères minuscules dans les réponses de jeton de type d'accès (bearer type)
+inputTypeCols=Colonnes d'entrée
+overrideActionTokensHelp=Remplace les paramètres par défaut pour la durée maximale avant expiration d'une action utilisateur (comme par exemple le mail de mot de passe oublié). Il est recommandé de mettre une valeur courte car l'utilisateur est supposé réagir rapidement à une action auto-générée.
+jsonType.tooltip=Type JSON qui sera utilisé pour mettre en forme les attributs json dans le jeton. long, int, boolean, String et JSON sont des valeurs valides.
+clientPoliciesPoliciesHelpText=La politique de client permets l'association entre les profils du client avec des conditions variées à spécifiées quand le comportement forcé est spécifié par les exécuteurs d'un profil client spécifique.
+noDefaultGroupsInstructions=Les groupes par défauts vous permette d'automatiquement assigner une appartenance à un groupe quand un nouveau utilisateur est crée ou importé avec <1>identity brokering</1>. Ajouter des groupes par défaut pour commencer.
+webAuthnPolicyUserVerificationRequirementHelp=Communique avec un authentificateur pour savoir s'il faut vérifier un utilisateur.
+authDataDescription=Représente un jeton contenant les données d'autorisation comme résultat du traitement d'une requête d'autorisation. Cette représentation est ce que Keycloak génère quand des clients demande un droit d'accès. Regarder l'attribut `authorization`pour les droits d'accès qui sont accordés dans la requête d'autorisation actuelle.
+changedUsersSyncPeriod=Période de synchronisation des utilisateurs modifiés
+validatingPublicKeyIdHelp=ID explicite de la clé publique validatrice donnée ci dessus. Laisser vide si la clé ci dessus doit toujours être utilisée peu importe l'ID de clé spécifié par le IDP externe, à remplir si la clé doit seulement être utilisée pour vérifier si l'ID de la clé correspond l'IDP externe.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Erreur de d'association du compte de fournisseur d'identité
+minuteHelp=Définie la minute à laquelle la politique doit être accordée. Vous pouvez aussi fournir un intervalle en remplissant le second champ. Dans ce cas les permissions sont accordées seulement si la minute actuelle est dans l'intervalle donnée (bornes inclues).
+newRoleNameHelp=Le nouveau nom du rôle. Le nouveau format de nom correspond à ce qui sera mappé dans le jeton d'accès pour le rôle. Par exemple un nouveau tel que 'myapp.newname' sera mappé au rôle à cette position dans le jeton d'accès. Un nouveau nom 'newname' sera mappé au rôle dans les rôles du domaine dans le jeton.
+searchUserByAttributeMissingKeyError=Spécifie une clé d'attribut
+eventTypes.INVALID_SIGNATURE.name=Signature invalide
+topLevelFlowTypeHelp=De quel type de flux haut niveau s'agit-il ? Le type 'client' est utilisé pour l'authentification de clients (applications) alors que 'generic' est utilisé pour les utilisateurs et tout autre chose.
+authDetailsHelp=Exporter et télécharger toutes les paramètres de ressource pour ce serveur de ressources.
+policyProvider.regex=Définir des conditions sous forme d'expression régulière pour vos permissions.
+clientImportError=Impossible d'importer le client : {{error}}
+members=Membres
+realmCertificateAliasHelp=Le certificat du domaine est stockée en archive également. Ceci est l'alias vers le certificat.
+createIdentityProviderError=Impossible de créer le fournisseur d'identité : {{error}}
+eventTypes.SEND_VERIFY_EMAIL_ERROR.description=Erreur pendant l'envoi du mail de vérification
+deleteClientPolicyConfirm=Cette action va supprimer de manière définitive la politique {{policyName}}. Aucun retour arrière possible.
+cibaAuthRequestedUserHint=Indice pour l'utilisateur lors de la demande d'authentification
+samlKeysExportError=Impossible d'exporter les clés : {{error}}
+webAuthnPolicyCreateTimeout=Timeout
+comparison=Comparaison
+notAllowedToDeleteAllClientScopes=Vous n'êtes pas autorisé à supprimer tous les périmètres de client.
+columnDisplayName=Afficher le nom
+noUsersFoundErrorStorage=Aucun utilisateur trouvé, cela peut être dû à une fournisseur de regroupement mal configuré {{error}}
+lookAround=Regarder autour de la fenêtre
+storeTokensHelp=Activé/Désactivé si les jetons doivent être stockés après l'authentification des utilisateurs.
+revert=Annuler
+dependentPermission=Permission dépendante
+disableTypeClaimCheck=Désactiver la vérification du type d'attribut
+addAssociatedRolesSuccess=Les rôles associés ont été ajoutés
+groupDeleted_one=Groupe supprimé
+userHelp=Sélectionner optionnellement un utilisateur pour lequel le jeton d'accès d'exemple sera généré. Si vous n'avez pas sélectionné d'utilisateur le jeton d'accès d'exemple ne sera pas généré pendant l'évaluation.
+loginScreenCustomization=Personnalisation de l'écran de connexion
+policiesConfigType=Configurer via :
+exportWarningTitle=Exporter avec prudence
+emailVerifiedHelp=Le mail de l'utilisateur a t il été vérifié ?
+duplicateFlow=Flux dupliqué
+addExecution=Ajouter l'exécution
+noSearchResultsInstructions=Cliquez sur la barre de recherche ci dessus pour relancer la recherche
+addedNodeFail=Impossible d'ajouter le nœud : '{{error}}'
+groupMembership=Appartenance au groupe
+maxLength=Taille maximale {{length}}
+clientSessionSettings=Paramètres de session client
+cibaAuthRequestedUserHintHelp=Le moyen d'authentifier l'utilisateur pour lequel la demande d'authentification est faite. Actuellement seul login_hint" est supporté.
+leaveGroupConfirmDialog_other=Etes vous sûr de vouloir supprimer {{username}} des {{count}} groupe(s) sélectionné(s) ?
+removeImportedUsersError=Impossible de supprimer les utilisateurs importés : '{{error}}'
+typeHelp=Périmètres de client qui seront ajouté comme périmètres par défaut pour chaque client créés.
+linkedIdPs=Fournisseurs d'identités associés
+groupObjectClasses=Classes de groupe d'objet
+requiredActionPlaceholder=Sélectionner une action
+bindCredentials=Associer les identifiants
+logoutSettings=Paramètres de déconnexion
+validateServerPrincipal=Vous devez entrer un serveur principal
+addMessageBundle=Ajouter un lot de messages
+realmName=Nom de domaine
+searchEventType=Chercher le type d'évènement sauvegardé
+otpHashAlgorithmHelp=Algorithme de hash utilisé pour générer l'OTP
+joinGroup=Rejoindre le groupe
+eventTypes.REMOVE_TOTP_ERROR.description=Supprimer l'erreur totp
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Exécuter l'erreur d'action de jeton
+unlinkAccountConfirm=Etes vous sûr de vouloir désassocier définitivement ce compte de {{provider}} ?
+x509CertificateHelp=Certificat X509 encodé au format PEM
+samlEndpointsLabel=Meta données de fournisseur de service SAML 2.0
+passCurrentLocaleHelp=Passer la langue actuelle au fournisseur d'identité dans le paramètre ui_locales.
+lessThan=Doit être inférieur à {{value}}
+logoutServiceRedirectBindingURL=URL de redirection du service de déconnexion
+createIdentityProviderSuccess=Fournisseur d'identité créé avec succès
+emptyMappersInstructions=Pour ajouter des mappeurs cliquez sur le bouton ci dessous pour ajouter des mappeurs pré configurés ou pour configurer un nouveau mappeur.
+dayMonth=Jour
+validatingX509Certs=Validation des certifications X509
+eventTypes.CLIENT_UPDATE.description=Mise à jour du client
+searchInitialAccessToken=Chercher le jeton
+guiOrder=Afficher l'ordre
+friendlyName=Nom de l'attribut à chercher pour une assertion. Vous pouvez laisser vide et spécifier un nom à la place.
+testSuccess=Connecté au LDAP avec succès
+userInfoUrl=URL des informations de l'utilisateur
+displayOnConsentScreen=Afficher sur la page de consentement
+noClientPolicies=Pas de politiques client
+defaultAdminInitiatedActionLifespanHelp=Durée d'expiration avant qu'une action générée par un administrateurs soit expirée. Il est recommandé que cette valeur soit longue pour laisser le temps aux administrateurs d'envoyer un mail aux utilisateurs qui sont hors ligne. Le timeout par défaut peut être surchargé immédiatement après généré le token.
+syncUsersSuccess=Synchronisation des utilisateurs terminée avec succès.
+updatedCredentialMoveError=La configuration des identifiants de l'utilisateur n'a pas été sauvegardée : {{error}}
+searchForRoles=Chercher un rôle par nom
+refresh=Rafraîchir
+directGrant=Flux d'accès direct
+maxLifespanHelp=Durée de vie maximale d'une donnée du cache en millisecondes
+associatedRolesModalTitle=Ajouter les rôles à {{name}}
+nameIdFormatHelp=Le format de l'ID du nom utilisé pour le sujet.
+detailsHelp=Ceci sont des informations à propos des détails.
+adminEvents=Evènements administrateurs
+serviceAccountHelp=Vous permet d'authentifier ce client à Keycloak et de récupérer le jeton d'accès dédié à ce client. En termes de spécification OAuth2 ceci active le support de 'Client Credentials Grant' pour ce client.
+standardTokenExchangeEnabledHelp=Active le standard d'exchange de token V2 pour ce client.
+sameSession=Même session
+urisHelp=L'ensemble des URLs protégées par une ressource.
+eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Réponse du fournisseur d'identité
+confirmClientSecretTitle=Regénérer le secret pour ce client ?
+serverPrincipal=Serveur principal
+deleteConfirmGroup_one=Etes vous sûr de vouloir supprimer ce groupe '{{groupName}}'.
+signDocuments=Signer les documents
+noTokens=Pas de jetons d'accès initiaux
+addMapper=Ajouter un mappeur
+webauthnPolicy=Politique Webauthn
+userAttributeName=Name de l'attribut utilisateur pour stocker l'attribut SAML. Utiliser le mail, le nom et le prénom pour mapper ces propriétés pré définies.
+displayDescription=Afficher la description
+eventTypes.DELETE_ACCOUNT.description=Supprimer le compte
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=Erreur de redémarrage de l'authentification
+evictionHour=Heure d'expulsion
+otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+ldapMappersList=Mappeurs LDAP
+bindDnHelp=DN de l'administrateur LDAP qui sera utilisé par Keycloak pour accéder au serveur LDAP
+newClientProfileName=Nom de profil client
+eventTypes.TOKEN_EXCHANGE.description=Echange de jeton
+continue=Continuer
+editProvider=Editer le fournisseur
+included.client.audience.label=Audience client inclue
+authnContextDeclRefsHelp=Liste ordonnée des requêtes AuthnContext DeclRefs.
+inherent=Hérité
+tableTitle=Groupes d'attributs
+generateNewKeys=Générer des clés RSA
+unlock=Débloquer
+attributeValue=Valeur d'attribut
+operationTypes=Types d'opération
+expireTime=Durée d'expiration
+policyProvider.user=Définie les conditions pour vos permissions où un ou plusieurs utilisateurs sont autorisés à accéder à un objet.
+protocolTypes.oid4vc=Open ID pour les identifiants vérifiables
+protocolTypes.openid-connect=OpenID Connect
+addOpenIdProvider=Ajouter un fournisseur OpenID Connect
+mapper.nameid.format.tooltip=Ce mappeur est uniquement appliqué si le format de NameID de la AuthnRequest entrante est égal à cette valeur.
+hideOnLoginPageHelp=Si caché le connexion avec ce fournisseur est possible uniquement si demandé explicitement, en utilisant par exemple le paramètre 'kc_idp_hin'.
+eventTypes.UPDATE_PROFILE.description=Mise à jour du profil
+assignRolesTo=Assigner les rôles {{type}} au client {{client}}
+orderChangeError=Impossible de changer l'ordre d'affichage des fournisseurs d'identité {{error}}
+policyProvider.client-scope=Définie les conditions pour vos permission quand un ou plusieurs périmètres client sont autorisés à accéder à un objet.
+secretExpiresOn=Le secret expire à {{time}}
+searchClientByName=Chercher un client par nom
+attributeName=Attribut [Name]
+updateError=Impossible de mettre à jour le fournisseur {{error}}
+importUsersHelp=Si vrai les utilisateurs LDAP seront importés dans la base de données Keycloak et synchronisés selon les politiques de configuration.
+emptyClientProfilesInstructions=Il n'y a pas de profils, sélectionner 'Créer un profil client' pour créer un nouveau profil client
+eventTypes.RESET_PASSWORD_ERROR.name=Erreur de réinitialisation de mot de passe
+eventTypes.UPDATE_EMAIL_ERROR.name=Erreur de mise à jour de mail
+removeConfirm_other=Etes vous sûr de vouloir supprimer ces groupes ?
+searchForSession=Chercher la session
+temporaryLockedHelp=L'utilisateur sera potentiellement bloqué à cause de plusieurs essais infructueux de connexion.
+useEntityDescriptorHelp=Importer les métadonnées depuis un descripteur d'entité distant IDP SAML.
+decisionStrategies.CONSENSUS=Consensus
+saveProviderSuccess=Le fournisseur a été sauvegardé avec succès.
+dedicatedScopes=Périmètre dédié
+noSessionsDescription=Il n'y a actuellement pas de sessions actives dans ce domaine.
+createGroupText=Créer un groupe d'attribut
+otpPolicyCodeReusable=Jeton réutilisable
+addRedirectUri=Ajouter des URLs de redirection valides
+time=Temps
+used.DEFAULT=Défaut
+authenticationCreateFlowHelp=Créer un flux.
+credentialResetEmailSuccess=Mail envoyé à l'utilisateur.
+discoveryEndpointHelp=Importer les métadonnées depuis un descripteur IDP distant.
+excludeSessionStateFromAuthenticationResponse=Exclure l'état de la session depuis la réponse d'authentification
+required=Champ obligatoire
+linkedIdPsText=Les fournisseurs d'identité déjà liés à ce compte utilisateur
+lastUpdated=Dernière mise à jour
+credentialResetBtn=Réinitialisation des identifiants
+userList=Liste d'utilisateurs
+importRole=Importer le rôle
+deleteClientProfileConfirm=Cette action effacera définitivement le profil {{profileName}}. Aucun retour arrière possible.
+signServiceProviderMetadataHelp=Activer/Désactiver la signature des métadonnées du fournisseur SAML.
+keystore=Magasin de clés
+eventTypes.EXECUTE_ACTION_TOKEN.description=Exécuter le jeton d'action
+eventTypes.CLIENT_INFO.description=Informations client
+updateClientProfilesError=Impossible de mettre à jour les profils du client : {{error}}
+mapperCreateSuccess=Mappeur créé avec succès.
+fullSyncPeriodHelp=Durée de la synchronisation complète en secondes
+resourceTypeHelp=Spécifie que cette permission doit être appliquée à toutes les instances de ressource d'un type donné.
+socialUserAttributeName=Nom de l'attribut utilisateur pour stocker des informations.
+priority=Priorité
+jsonType.label=Attribut du type JSON
+fullScopeAllowed=Périmètre complet autorisé
+syncModes.inherit=Hérité
+addedGroupMembershipError=Erreur pendant l'ajout au groupe : {{error}}
+authenticatorAttachment.platform=Plateforme
+configSaveSuccess=Configuration sauvegardée avec succès
+regenerate=Regénérer
+ignoreMissingGroups=Ignorer les groupes manquants
+showMetaData=Montrer les métadonnées
+webAuthnPolicyAttestationConveyancePreferenceHelp=Communique à un authentificateur les préférences de génération d'une déclaration d'accréditation.
+top-level-flow-type.basic-flow=Flux basique
+groupRemoveError=Erreur à la suppression du groupe {error}
+temporaryPasswordHelpText=Si activé l'utilisateur doit changer son mot de passe à la prochaine connexion
+requestObjectEncryption=Algorithme d'encryption d'objet de requête
+exportAuthDetailsSuccess=Details d'autorisation exportés avec succès.
+wantAuthnRequestsSignedHelp=Indique si le fournisseur d'identité attend une AuthnRequest signée.
+policyCodeHelp=Le code JavaScript donnant les conditions pour cette politique.
+eventTypes.IDENTITY_PROVIDER_RESPONSE.description=Réponse du fournisseur d'identité
+shouldBeANumber=Doit être un nombre
+validatorDialogColNames.colDescription=Description
+requestObjectEncoding=Algorithme d'encryption du contenu d'objet de requête
+keyPassword=Mot de passe de la clé
+attributeFriendlyName=Attribut [Friendly Name]
+clearAllFilters=Supprimer tous les filtres
+scopePermissions.clients.map-roles-composite-description=Politiques qui décident si un administrateur peut appliquer les rôles définis par ce client comme un composé d'un autre rôle
+generateKeys=Générer les clés ?
+searchForUser=Chercher un utilisateur
+groupRemove_one=Groupe supprimé
+allGroups=Tous les groupes
+deleteNode=Supprimer le nœud ?
+addAaguids=Ajouter AAGUID
+createPolicy=Créer une politique client
+disablePolicyConfirm=Les utilisateurs et les client ne pourront pas accéder à cette politique si c'est désactivé. Etes vous sûr de vouloir continuer ?
+enableClientSignatureRequiredExplain=Si vous activez "Signature obligatoire du client" l'adapteur de ce client sera mis à jour. Vous pourriez avoir besoin de télécharger un nouvel adaptateur pour ce client. Vous devez générer ou importer des clés pour ce client sinon l'authentification ne fonctionnera pas.
+requestObjectRequiredHelp=Spécifie si le client a besoin de fournir un objet de requête avec leur requêtes d'autorisation et quelle méthode il peut utiliser pour ça. Si mis à "non nécessaire" fournir un objet de requête est optionnel. Dans tous les autres cas fournir un objet de requête est obligatoire. Si mis à "requête" l'objet de la requête doit être fourni par valeur. Si mis à "URL requête" l'objet de la requête doit être fourni par référence. Si mis à "requête ou URL requête" les deux méthodes peuvent être utilisées.
+flowCreatedSuccess=Flux créé
+createUserProviderSuccess=Fournisseur de regroupement d'utilisateur créé avec succès
+editUSernameHelp=Si activé le nom d'utilisateur est modifiable sinon il est accessible seulement en lecture.
+periodicChangedUsersSyncHelp=Si la synchronisation périodique des utilisateurs LDAP de Keycloak doit être activé ou non.
+signatureAlgorithmHelp=L'algorithme de signature utilisé pour signer des documents. Attention les algorithmes basés sur 'SHA1' sont dépréciés et seront supprimés dans le futur. Il recommandé d'éviter les algorithmes '*_SHA1'.
+allow-default-scopes.tooltip=Si activé les utilisateurs enregistrés seront autorisés à avoir des périmètres clients mentionnés dans les périmètres clients par défaut du domaine ou les périmètres clients optionnels du domaine
+emailVerified=Mail vérifié
+addExecutionHelp=Les exécutions peuvent avoir un large panel d'actions, comme envoyer un email de réinitialisation ou valider un OTP.
+clientScopesRolesScope=S'il n'y a pas de mapping de périmètre de rôle défini chaque utilisateur est autorisé à utiliser ce périmètre client. S'il y a des mappings de périmètre de rôle défini l'utilisateur doit être membre d'au moins l'un des rôles.
+removeConfirm_one=Etes vous sûr de vouloir supprimer ce groupe ?
+countHelp=Spécifie combien de clients peuvent être créés en utilisant ce jeton.
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
+Monday=Lundy
+resetCredentialsSuccess=Le mot de passe a été réinitialisé avec succès.
+added=Ajouté
+authnContextDeclRefs=AuthnContext DeclRefs
+clientAssertionAudienceHelp=L'audience à utiliser pour cette assertion client. La valeur par défaut est l'URL du point de terminaison du jeton IDP.
+externalRoleToRole=Cherche un rôle externe dans un jeton d'accès Keycloak. Si un rôle externe existe donne accès à l'utilisateur au rôle spécifié de client ou de domaine.
+attributeGroup=Groupe d'attribut
+deleteExecutionError=Impossible de supprimer l'exécution : {{error}}
+hideInheritedRoles=Cacher les rôles hérités
+consentRequired=Consentement requis
+selectMethodType.import=Importer
+standardFlow=Flux standard
+votedToStatus=Voté à {{status}}
+credentialResetConfirmText=Etes vous sûr de vouloir envoyer un mail à cet utilisateur ?
+clientScopeType.default=Défaut
+helpFileUpload=Uploader un fichier JSON
+addProvider_one=Ajouter le fournisseur {{provider}}
+clientPoliciesPolicies=Politiques de client
+fineGrainOpenIdConnectConfiguration=Configuration de la granularité fine OpenID Connect
+flow.reset\ credentials=Réinitialiser le flux d'identifiants
+eventTypes.DELETE_ACCOUNT_ERROR.name=Erreur de suppression de compte
+eventTypes.CLIENT_DELETE_ERROR.name=Erreur de suppression de client
+noRolesInstructions-client=Vous n'avez créé aucun rôles pour ce client. Créez un rôle pour commencer.
+test=Test
+leaveGroup_one=Quitter le groupe {{name}} ?
+count=Compter
+noPasswordPoliciesInstructions=Vous n'avez pas ajouté de politiques de mot de passe à ce domaine. Ajouter une politique pour commencer.
+testAuthentication=Authentification de test
+groupNameLdapAttributeHelp=Nom de l'attribut LDAP qui est utilisé dans des objets de groupe pour le nom et pour le RDN du groupe. C'est souvent 'cn'. Dans ce cas un groupe/rôle typique aurait un DN dans ce genre 'cn=Group1,ouu=groups,dc=example,dc=org'.
+deleteError=Impossible de supprimer le fournisseur {{error}}
+attributeDisplayName=Afficher le nom
+pkceEnabled=Utiliser le PKCE
+userProviderSaveSuccess=Fournisseur de regroupement d'utilisateurs sauvegardé avec succès
+expiration=Expiration
+month=Mois
+valueLabel=Valeur
+dropNonexistingGroupsDuringSyncHelp=Si ce booléen est vrai nous garderont seulement les groupes Keycloak qui existent toujours dans le LDAP pendant la synchronisation des groupes du LDAP vers Keycloak. Le reste sera supprimé.
+addKerberosWizardTitle=Ajouter le fournisseur de regroupement d'utilisateurs Kerberos
+noPasswordPolicies=Pas de politique de mot de passe
+resourceTypes=Types de ressource
+deleteConfirmTitle_one=Supprimer le groupe ?
+eventTypes.UPDATE_PROFILE_ERROR.description=Erreur de mise à jour de profil
+webAuthnUpdateSuccess=Mise à jour des politiques WebAuthn effectuée avec succès
+authorizationSignedResponseAlg=Algorithme de signature de réponses d'autorisation
+mapperTypeFullNameLdapMapperHelp=Utilisé pour mapper le nom complet d'un utilisateur depuis in simple attribut LDAT (habituellement l'attribut 'cn') vers les attributs du nom et du prénom du UserModel présent dans la base de données Keycloak
+includeInUserInfo.label=Ajouter aux informations de l'utilisateur
+onDragMove=Déplacer l'élément {{item}}
+back=Retour
+deleteScopeConfirm=Si vous supprimez ce périmètre d'autorisation, certaines permissions seront affectées.
+updateOtpSuccess=Politique OTP mise à jour avec succès
+deleteAttributeError=Attribut non supprimé : {{error}}
+policiesConfigTypes.formView=Vue de formulaire
+residentKey.No=Non
+nodeReRegistrationTimeout=Timeout du nœud de réenregistrement
+fineGrainSamlEndpointConfigHelp=Cette section configure les URLs exactes pour le consommateur d'assertion et le service de déconnexion simple.
+connectionURL=URL de connexion
+validateCustomUserSearchFilter=Le filtre doit être entouré de parenthèses, comme par exemple : (filtre)
+deleteMessageBundleSuccess=Message supprimé du paquet avec succès
+retry=Appuyer ici pour rafraîchir et continuer
+selectAttributes=Sélectionner les attributs
+owner=Propriétaire
+eventTypes.VERIFY_PROFILE.description=Vérifier le profil
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Erreur de lien du regroupement d'identité
+eventTypes.EXECUTE_ACTIONS.name=Exécuter les actions
+encryptAssertions=Assertions d'encryption
+disableConfirmTitle=Désactiver le domaine ?
+disableConfirmClientTitle=Désactiver le client ?
+disableConfirmClient=Etes vous sûr de vouloir désactiver le client ?
+custom=Attribut personnalisé...
+keyTab=Onglet de clé
+addSamlProvider=Ajouter un fournisseur SAML
+permission=Permission
+saveEventListeners=Sauvegarder les écouteurs d'évènements
+capabilityConfig=Configuration de la capabilité
+home=Accueil
+bindFlow=Associer le flux
+userAttributeValue=Valeur de l'attribut d'utilisateur
+browserFlowHelp=Sélectionner le flux que vous voulez utiliser pour l'authentification du navigateur.
+tokenLifespan.never=Expire jamais
+notFound=Impossible de trouver la ressource que vous cherchez
+passMaxAge=Passer max_age
+disablePolicyConfirmTitle=Désactiver la politique ?
+eventTypes.LOGIN_ERROR.description=Erreur de connexion
+linkAccount=Lien vers le compte
+attestationPreference.direct=Direct
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.description=Erreur d'authentification OAuth2 de l'appareil
+unlinkUsers=Désassocier les utilisateurs
+userLdapFilter=Filtre de l'utilisateur LDAP
+emailVerification=Vérification du mail
+configSaveError=Impossible de sauvegarder la configuration : {{error}}
+clientAuthenticatorTypeHelp=Authentificateur Keycloak utilisé pour l'authentification de ce client avec le serveur Keycloak
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Erreur d'action personnalisée requise
+eventTypes.SEND_RESET_PASSWORD.name=Envoyer la réinitialisation du mot de passe
+requiredFor=Nécessaire pour
+scopePermissions.users.map-roles-description=Politiques qui décident si un administrateur peut mapper les rôles pour tous les utilisateurs
+authDefaultActionTooltip=Si activé n'importe quel nouvel utilisateur aura cette action requise d'assigné.
+authenticatedAccessPoliciesHelp=Ces politiques sont utilisées quand le service d'enregistrement de client est invoqué par une requête d'authentification. Cela signifie que la requête contient le jeton d'accès initial ou le jeton Bearer.
+bindCredentialsHelp=Mot de passe de l'administrateur LDAP. Ce champ est capable d'obtenir sa valeur depuis un coffre fort, utilisez le format ${coffrefort.ID}.
+searchForAdminEvent=Chercher un évènement administrateur
+unitLabel=Sélectionner une unité de temps
+webAuthnPolicySignatureAlgorithms=Algorithmes de signature
+eventTypes.GRANT_CONSENT_ERROR.name=Erreur d'accord de consentement
+action=Action
+shortVerificationUri=verification_uri courte dans le flux Device Authorization
+placeholderText=Sélectionner un
+deleteCredentialsError=Erreur pendant la suppression des identifiants des utilisateurs : {{error}}
+validateBindCredentials=Vous devez entrer le mot de passe de l'administrateur LDAP
+evictionMinuteHelp=Minute de l'heure à laquelle l'entrée deviendra valide
+includeAuthnStatement=Inclure AuthnStatement
+validatorType=Type de validateur
+samlAttributeToRole=Si un attribut existe accorde à l'utilisateur le rôle de domaine ou de client spécifié.
+addIdPMapper=Ajouter le mappeur du fournisseur d'identité
+createPermissionSuccess=Permission créée avec succès
+roleAuthentication=Authentification du rôle
+homeURL=URL d'accueil
+eventTypes.REVOKE_GRANT_ERROR.name=Erreur de révocation d'accès
+contentSecurityPolicyReportOnly=Content-Security-Policy-Report-Only
+firstBrokerLoginFlowAlias=Flux de première connexion
+firstBrokerLoginFlowAliasOverride=Surcharge du flux de première connexion
+missingAttributes=Aucun {{label}} n'a été défini pour le moment. Cliquez sur le bouton ci dessous pour ajouter {{label}}. Clé et valeur sont nécessaires pour un paire de clé.
+testConnectionError=Erreur ! {{error}}
+deleteClientPolicyProfileSuccess=Profil supprimé avec succès de la politique.
+reGenerateSigningExplain=Si vous regénérez la clé pour le client la base de données Keycloak sera mise à jour et vous devrez peut être téléchargez un nouveau adaptateur pour ce client.
+evaluate=Evaluer
+status=Statut
+dragInstruction=Cliquez de glissez pour changer la priorité
+clientName=Nom
+syncModes.force=Forcer
+deleteMappingConfirm=Etes vous sûr de vouloir supprimer ce mapping ?
+createClientProfileSuccess=Nouveau profil client créé
+eventTypes.CLIENT_LOGIN_ERROR.description=Erreur de connexion de client
+explainBearerOnly=C'est un type OIDC spécial. Ce client autorise seulement les requêtes du jeton bearer et ne peut pas participer dans les connexions de navigateur.
+noTranslationsInstructions=Ajouter une traduction pour commencer.
+clearFile=Supprimer ce fichier
+allowCreate=Autoriser la création
+providerUpdatedError=Impossible de mettre à jour la politique client à cause de {{error}}
+usersAddedError=Impossible d'ajouter des utilisateurs au groupe : {{error}}
+orderChangeErrorUserFed=Impossible de changer l'ordre de priorité des fournisseurs de regroupement d'utilisateur : {{error}}
+scopeParameterPlaceholder=Sélectionner les paramètres du périmètre
+deleteClientPolicyConfirmTitle=Supprimer la politique ?
+validateRdnLdapAttribute=Vous devez entrer un attribut RDN LDAP
+affirmative=Affirmatif
+backchannelLogoutRevokeOfflineSessions=La déconnexion du canal secondaire révoque les sessions hors ligne
+noRoles-groups=Pas de rôles pour ce groupe
+hmacGenerated=généré-hmac
+archiveFormat=Format d'archive
+unlockSuccess=Utilisateur débloqué avec succès
+hourHelp=Définie l'heure à laquelle la politique DOIT être accordée. Vous pouvez aussi fournir un intervalle en remplissant le second champ. Dans ce cas la permission est accordé seulement si l'heure actuelle dans l'intervalle donnée (bornes inclues).
+enableSwitchSuccess={{switch}} changé avec succès
+deleteExecutorSuccess=Succès ! L'exécuteur a été supprimé.
+clientRoles=Rôles du client
+removeRoles=Supprimer les rôles
+flowNameDescriptionHelp=Texte d'aide pour la description du nom du nouveau flux
+groupsPath=Chemin des groupes
+useRealmRolesMapping=Utiliser le mapping des rôles de domaine
+identityProviderEntityId=ID de l'entité du fournisseur d'identité
+userInfoSignedResponseAlgorithm=Algorithme de signature des réponses des informations utilisateur
+selectGroup=Sélectionner un group
+scopePermissions.groups.view-members-description=Politiques qui décide si un administrateur peut voir les membres de ce groupe
+tableOfGroups=Tableau des groupes
+allowed-protocol-mappers.tooltip=Whitelist des fournisseurs de mappeurs de protocole autorisés. S'il y a une tentative pour enregistrer un client qui contient plusieurs mappeurs de protocole, qui ne sont pas whitelistés, l'enregistrement sera rejété.
+policyProvider.role=Définie les conditions pour les permissions quand un ou plusieurs rôles sont autorisés à accéder à un objet.
+targetOptions.brokerId=BROKER_ID
+eventTypes.VERIFY_PROFILE.name=Vérifier le profil
+useRealmRolesMappingHelp=Si activé les mappings des rôles LDAP seront mappés aux mappings de rôle de domaine dans Keycloak. Sinon ils seront mappés aux mappings de rôle de client.
+forwardParameters=Paramètres de requête transmis
+isAccessTokenJWTHelp=Le jeton d'accès reçu depuis le fournisseur d'identité est un jeton JWT et ses attributs seront accessible pour les mappeurs.
+frontchannelLogoutUrl=URL de déconnexion du canal principal
+frontchannelLogoutSessionRequired=Déconnexion de session du canal principale requise
+frontchannelLogoutSessionRequiredHelp=Spécifie si un paramètre sid (session ID) et iss (issuer) sont inclus dans la requête de déconnexion quand l'URL du canal principal de déconnexion est utilisé.
+testConnectionHint.withoutEmailAction=Configurer l'adresse mail
+webAuthnUpdateError=Impossible de mettre à jour les politiques WebAuthn à cause de {{error}}
+paginationHelp=Si le serveur LDAP supporte la pagination
+deleteProviderTitle=Supprimer le fournisseur de clés ?
+scopes=Périmètres
+accessTokens=Jetons d'accès
+columnName=Nom
+flowType=Type de flux
+syncLDAPGroupsSuccessful=Les données ont été synchronisées avec succès {{result}}
+policyEnforcementModes.PERMISSIVE=Permissif
+subject=DN sujet
+use=Utiliser
+defaultAdminInitiated=Durée de vie par défaut d'une action générée par un administrateur
+chooseAMapperType=Choisir un type de mappeur
+noGroupsInThisRealm=Aucun groupe dans ce domaine
+searchUserByAttributeKeyAlreadyInUseError=La clé d'attribut est déjà utilisée
+addWebOrigins=Ajouter des origines web
+clientScopeExplain=Les périmètres client sont un ensemble de mappeurs de protocoles et de rôles partagés entre plusieurs clients.
+attributeNameHelp=Nom de l'attribut pour chercher dans l'assertion. Vous pouvez laisser ceci vide et spécifier un nom amical à la place.
+upAttributeNameHelp=Le nom de l'attribut d'utilisateur, utilisé pour identifier de manière unique un attribut.
+linkAccountTitle=Lier le compte à {{provider}}
+invalidateRotatedSuccess=La rotation de secret a été supprimée avec succès
+userSessionAttributeHelp=Nom de l'attribut de session utilisateur que vous voulez harcoder
+updateSuccessIdentityProvider=Fournisseur mis à jour avec succès
+reloadKeys=Recharger les clés
+importKeys=Importer les clés
+useMetadataDescriptorUrl=Utiliser l'URL de descripteur de métadonnées
+metadataDescriptorUrl=URL du descripteur de métadonnées
+metadataDescriptorUrlHelp=URL externe où le fournisseur d'identité publie les informations de métadonnées demandées par le client (certificat, clés, autres URLs,...).
+reloadKeysSuccess=Clés rechargées avec succès
+reloadKeysError=Erreur au rechargement des clés. {{error}}
+reloadKeysSuccessButFalse=Le rechargement n'a pas été exécuté, peut être que le temps entre les requêtes était trop court.
+importKeysSuccess=Clés réimportées avec succès. Merci de sauvegarder le fournisseur pour stocker les nouveaux certificats.
+importKeysError=Erreur durant l'import des clés. {{error}}
+importKeysErrorNoSigningCertificate=L'option "singingCertificate" n'est pas définie dans les métadonnées.
+forbidden_one=Interdit, permission autorisée :
+supportedApplications=Applications supportées
+kerberosPrincipal=Principal Kerberos
+resourceAttribute=Attribut de ressource
+addressClaim.region.label=Nom de l'attribut utilisateur pour la région
+applyToResourceTypeFlagHelp=Spécifie si cette permission doit être appliquée à toutes les ressource qui ont un certain type. Dans ce cas cette permission sera évaluée pour toutes les instances d'un type d'une ressource donnée.
+deletedErrorIdentityProvider=Impossible de supprimer le fournisseur {{error}}
+included.custom.audience.tooltip=Ceci est utilisé seulement si 'Audience client inclues' est vide. La valeur spécifiée est inclues dans le champ audience (aud) du jeton. Si le jeton contient déjà des audiences la valeur spécifiée est ajoutée à ces audiences sans les surcharger.
+includeInIdToken.label=Ajouter au token ID
+steps=Etapes
+tokenDeleteConfirm=Etes vous sûr de vouloir supprimer de manière définitive le jeton d'accès initial {{id}}
+flowCreateError=Impossible de créer le flux : {{error}}
+readTimeoutHelp=Timeout de lecture LDAP en millisecondes. Ce timeout s'applique pour les opérations LDAP de lecture.
+registrationAccessTokenHelp=L'enregistrement du jeton d'accès fournit un accès aux client au service d'enregistrement du client.
+host-sending-registration-request-must-match.tooltip=Si activé toutes les requêtes du service d'enregistrement du client sont autorisés, comme si elles avaient été envoyées depuis un nom de domaine de confiance.
+profilesConfigTypes.formView=Vue du formulaire
+validatorDeletedSuccess=Succès ! La configuration du profil utilisateur a été sauvegardé.
+canonicalization=Méthode canonique
+deleteConfirmTitle=Supprimer le domaine ?
+includeInAccessTokenResponse.label=Ajouter à la réponse du jeton d'accès
+clientScope=Périmètre client
+inheritedFrom=Hérité de
+clientScopeSearch.name=Nom
+deleteConditionSuccess=Les conditions ont été supprimées
+deleteConditionError=Impossible de supprimer les conditions : {{error}}
+clientProfile=Détails du profil client
+syncAllUsers=Synchroniser tous les utilisateurs
+disableConfirmIdentityProvider=Etes vous sûr de vouloir désactiver le fournisseur ? '{{provider}}'
+clientSaveError=Impossible de mettre à jour le client : {{error}}
+tokenSaveError=Impossible de créer le jeton d'accès initial : {{error}}
+deleteConfirmExecutionMessage=Etes vous sûr de vouloir supprimer définitivement l'exécution "<1>{{name}}</1>".
+offlineSessionMaxLimitedHelp=Activer la durée de vie maximale de la session hors ligne
+delete=Supprimer
+hour=Heure
+connectionTimeoutHelp=Timeout de connexion LDAP en millisecondes
+repeat=Répéter
+defaultSigAlgHelp=Algorithme par défaut utiliser pour signer les jetons pour le domaine
+save-admin-eventsHelp=Si activé les évènements administrateurs seront sauvegardés dans la base de données, ce qui les rendra disponible dans l'interface Admin.
+policyGroupsHelp=Spécifie quel(s) utilisateur(s) sont autorisé(s) par cette politique.
+searchForProtocol=Chercher un mappeur de protocole
+eventTypes.CLIENT_INFO.name=Information client
+eventTypes.UPDATE_TOTP_ERROR.name=Erreur de mise à jour totp
+ldapRolesDnHelp=LDAP DN où les rôles de cet arbre seront sauvegardés. Par exemple, 'ou=finance,dc=example,dc=org'.
+standardTokenExchangeEnabled=Echange de jeton standard
+enableRefreshRequestedTokenType=Autorise le jeton de rafraîchissement dans l'échange de jeton standard
+providerUpdatedSuccess=Politique client mise à jour avec succès
+createClientScopeError=Impossible de créer le périmètre client : '{{error}}'
+deleteRole=Supprimer ce rôle
+SSOSessionSettings=Paramètres de session SSO
+groupHelp=Groupe pour ajouter l'utilisateurs dedans. Renseignez le chemin complet du groupe. Par exemple : '/root-group/child-group'.
+clientPolicyNameHelp=Afficher le nom de la politique
+addressClaim.country.label=Nom de l'attribut utilisateur pour le pays
+downloadType=informations à propos du type de téléchargement
+clustering=Clustering
+createSuccess=Fournisseur d'identité créé avec succès
+mapperAttributeName=Nom de l'attribut
+setPassword=Saisir le mot de passe
+createRole=Créer le rôle
+clientDeletedSuccess=Le client a été supprimé
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Erreur de réponse du fournisseur d'identité
+editModeLdapHelp=READ_ONLY est une lecture seule du magasin LDAP. WRITABLE veut dire que les données seront synchronisées en retour du LDAP à la demande. UNSYNCED signifie que les données utilisateurs seront importées mais pas synchronisés au LDAP.
+enableServiceAccount=Activer les rôles de compte de service
+signOutAllActiveSessionsQuestion=Déconnecter toutes les sessions actives ?
+addPostLogoutRedirectUri=Ajouter des URLs de redirection après déconnexion valides
+SSOSessionMaxRememberMe=Durée maximale session SSO Se souvenir de moi
+pkceMethod=Méthode PKCE
+noRoles-users=Pas de rôle pour cet utilisateur
+showInheritedRoles=Montrer les rôles hérités
+moveGroupEmptyInstructions=Il n'y a pas de sous groupes, sélectionnez 'Déplacer ici' pour bouger le groupe sélectionné comme un sous groupe de ce groupe
+unlockError=Impossible de débloquer l'utilisateur à cause de {{error}}
+deleteClientProfileConfirmTitle=Supprimer le profil ?
+syncLDAPGroupsError=Les données n'ont pas pu être synchronisées à cause de {{error}}
+saveSuccess=Le fournisseur de regroupement d'utilisateur a été sauvegardé avec succès
+generatedAccessToken=Jeton d'accès généré
+resetPasswordConfirmation=Confirmation du nouveau mot de passe
+testConnection=Test de connexion
+importSuccess=Nouveau certificat importé
+invalidJsonError=Impossible de sauvegarder le profil utlisateur, l'information fournie n'est un JSON valide : {{error}}
+invalidJsonClientProfilesError=Impossible de sauvegarder les profils du client, l'information fournie n'est un JSON valide : {{error}}
+invalidJsonClientPoliciesError=Impossible de sauvegarder les politiques client, l'information fournie n'est un JSON valide : {{error}}
+deleteBtn=Supprimer
+addLdapWizardDescription=Texte nécessaire ici
+aggregate.attrs.label=Agréger les valeurs d'attribut
+removedGroupMembershipError=Erreur à la suppression de l'appartenance au groupe : {{error}}
+allowPasswordAuthenticationHelp=Activer/Désactiver la possibilité de s'authentifier à la base de données Kerberos avec un nom d'utilisateur/mot de passe
+eventTypes.SEND_RESET_PASSWORD_ERROR.name=Erreur d'envoi de la réinitialisation de mot de passe
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=Première connexion au fournisseur d'identité
+eventTypes.INTROSPECT_TOKEN_ERROR.name=Erreur d'introspection de jeton
+usernameHelperText=Entrer le nom d'utilisateur de l'utilisateur pour ce fournisseur d'identité.
+includeInAccessToken.tooltip=L'attribut doit il être ajouté au jeton d'accès ?
+noScopeCreateHint=Vous devez créer un périmètre d'autorisation d'abord.
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=Erreur de liaison de compte initié par le client
+clientScopesCondition=Périmètres attendus
+backchannelLogoutSessionRequiredHelp=Spécifie si un attribut sid (session ID) est inclus dans le jeton de déconnexion quand 'URL de déconnexion du canal secondaire est utilisé.
+global=Global
+userAttributeHelp=Nom de l'attribut utilisateur que vous voulez harcoder
+searchForMapper=Cherche d'un mappeur
+includeOneTimeUseCondition=Inclure les conditions OneTimeUse
+clientUpdaterSourceRoles=Mise à jour du rôle de l'entité
+enableSwitchError=Impossible d'activer / désactiver à cause de {{error}}
+deleteClientPolicyProfileConfirm=Cette action supprimera définitivement {{profileName}} de la politique {{policyName}}. Aucun retour arrière possible.
+deleteExecutorProfileConfirm=L'action va supprimer définitivement {{executorName}}. Aucun retour arrière possible.
+confirmClientSecretBody=Si vous regénérez le secret la base de données Keycloak sera mise à jour et vous devrez télécharger un nouvel adaptateur for ce client.
+keysList=Liste des clés
+generatedUserInfo=Informations utilisateur générées
+clientRegistration=Enregistrement client
+samlIdentityProviderMetadata=Métadonnées du fournisseur d'identité SAML 2.0
+importParseError=Impossible de parser le fichier {{error}}
+validTo=Valide jusqu'à
+addMember=Ajouter un membre
+eventTypes.CLIENT_INFO_ERROR.name=Erreur informations client
+authenticatorAttachment.not\ specified=Non spécifié
+oidcCibaGrant=Droits OIDC CIBA
+displayDescriptionHintHelp=Un texte qui devra être utilisé comme tooltip quand l'utilisateur remplira des formulaires.
+searchKey=Chercher la clé
+deleteClientSuccess=Profil client supprimé
+emptyClientScopesPrimaryAction=Ajouter des périmètres client
+addStepTo=Ajouter un étape à {{name}}
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=Erreur Authreqid to token
+deleteAttributeConfirm=Etes vous sûr de vouloir supprimer définitivement l'attribut {{attributeName}} et leurs traductions correspondantes ?
+chooseResources=Choisissez les ressources que vous voulez importer
+selectOne=Sélectionner une option
+eventTypes.UPDATE_PASSWORD.description=Mettre à jour le mot de passe
+policiesConfigTypes.jsonEditor=Editeur JSON
+eventConfigSuccessfully=Configuration sauvegardé avec succès
+scopePermissions.users.impersonate-description=Politiques qui décident si un administrateur peut usurper l'identité d'autres utilisateurs
+deleteResourceWarning=Les permissions ci dessous seront supprimées quand elles ne seront plus utilisées par aucune autres ressources :
+permissionScopesHelp=Spécifie que cette permission doit être appliqué à un ou plusieurs périmètres.
+moveTo=Déplacer vers
+registerNodeManually=Enregistrer le nœud manuellement
+redirectURI=URL de redirection
+publicKeys=Clés publiques
+publicKey=Clé publique
+emptyEventsInstructions=Il n'y plus de types d'évènements restants à ajouter
+periodicFullSync=Synchronisation périodique complète
+removeConfirmTitle_other=Supprimer les groupes ?
+clientAccesstypeTooltip=Type d'accès du client, pour laquelle la condition sera appliquée.
+emptyBuiltInMappersInstructions=Tous les mappeurs pré-intégrés seront ajoutés à ce client
+noTokensInstructions=Vous n'avez créé aucun jeton d'accès initial. Créez un jeton d'accès initial en cliquant sur "Créer".
+ldapAttributeValueHelp=Valeur de l'attribut LDAP qui sera ajouté au nouvel utilisateur pendant l'enregistrement. Vous pouvez soit harcoder n'importe quelle valeur comme 'foo' mais vous pouvez utilisez quelques jetons spéciaux. Le seul jeton supporté pour le moment est '${RANDOM}' qui sera remplacé par une chaîne de caractères aléatoire.
+lastRegistration=Dernier enregistrement
+advancedSettingsOpenid-connect=Cette section est utilisée pour configurer des paramètres avancés de ce client lié au protocole OpenID Connect
+reevaluate=Ré-évaluer
+clientOfflineSessionMax=Durée maximale session client hors ligne
+eventTypes.SEND_VERIFY_EMAIL.description=Envoyer un mail de vérification
+eventTypes.REVOKE_GRANT_ERROR.description=Erreur révocation de droits
+descriptionLanding=Ceci est la description pour la page d'accueil des regroupement d'utilisation
+moveHere=Déplacer ici
+noKeys=Pas de clés
+batchSizeHelp=Nombre d'utilisateurs LDAP à importer depuis LDAP vers Keycloak en une seule transaction
+createClientConditionSuccess=Condition créée avec succès.
+kerberosKeyTab=Onglet de la clé Kerberos
+principalAttribute=Attribut principal
+mapperTypeLdapAttributeMapperHelp=Ce mappeur est supporté seulement si syncRegistrations est activé. Les nouveaux utilisateurs dans Keycloak seront écrit dans le LDAP avec la valeur hardcodée d'un attribut spécifique.
+activeHelp=Remplir si les clés peuvent être utilisée pour signer
+addMapperExplain=Si vous voulez plus de contrôle à granularité fine vous pouvez créer un mappeur de protocole sur ce client
+realmRoles=Rôles du domaine
+fineGrainOpenIdConnectConfigurationHelp=Cette section est utilisée pour configurer les paramètres avancés liés au protocole OpenID Connect de ce client.
+searchForUserDescription=Ce domaine peut avoir un fournisseur fédéré. Voir tous les utilisateurs pourrait ralentir le système, mais cela peut être réalisé en utilisant "*". Merci de rechercher un utilisateur ci-dessus.
+expirationHelp=Saisir l'expiration pour les évènements. Les évènements expirés sont périodiquement supprimés de la base de données.
+editModeKerberosHelp=READ_ONLY signifie que les mises à jour de mot de passe ne sont pas autorisées et l'utilisateur s'authentifie toujours avec son mot de passe Kerberos. UNSYNCED signifie que l'utilisateur peut changer son mot de passe dans la base de données Keycloak et celui ci sera utilisé à la place du mot de passe Kerberos.
+targetHelp=Champ de destination pour le mappeur. LOCAL (par défaut)signifie que les changements sont appliqués au nom d'utilisateur stocké dans la base de données locale lors de l'import de l'utilisateur. BROKER_ID et BROKER_USERNAME signifie que les changements seront stockés dans l'ID ou le nom d'utilisateur utilisé respectivement pour la recherche du regroupement d'utilisateur.
+signingKeysConfigExplain=Si vous activez la 'Signature client requise' ci dessous vous devez configurer les clés en générant ou important des clés et le client signera ses requêtes et réponses SAML. La signature sera validée.
+enabledWhenTooltip=Spécifie quand l'attribut est disponible. Quand les périmètres sont utilisés, l'attribut est disponible si au moins un des périmètres configurés est appliqué dans la requête de connexion. Les périmètres par défaut et optionnels de la requête courante seront évalués. Dans les contexte de console Admin et de la console Compte les périmètres ne sont pas évalués et l'attribut est toujours visible (si non restreint par les autorisations).
+deleteProviderConfirm=Etes vous sûr de vouloir supprimer définitivement le fournisseur de clé {{provider}} ?
+whoWillAppearPopoverTextUsers=Les groupes sont hiérarchiques, quand vous sélectionner l'appartenance directe vous voyez seulement le groupe enfant que l'utilisateur a rejoint. Les groupes parents ne sont pas inclus.
+events-disable-confirm=Si "Sauvegarder évènements" est désactivé, les évènements suivants ne seront pas affichés dans le menu "Evènements"
+replyTo=Répondre à
+userVerify.discouraged=Découragé
+allowed-client-scopes.tooltip=Whitelist des périmètres client qui peuvent être utilisés pour un nouveau client enregistré. L'ajout d'un client avec des périmètres client qui ne sont pas whitelistés sera rejeté. Par défaut la whitelist est soit vide soit contient juste les périmètre client par défaut du domaine (en fonction de la valeur de la configuration 'Autoriser les périmètres par défaut')
+validPostLogoutRedirectURIs=Schéma d'URL valide vers lequel un navigateur peut rediriger après une déconnexion réussie. Mettre '+' ou un laisser vide signifie que les URLs valides de redirection seront utilisés. Mettre '-' n'autorise aucune URL valide de redirection après déconnexion. Le joker '*' est autorisé comme par exemple dans 'http://example.com/*'. Un chemin relatif peut également être spécifié, exemple : '/my/relative/path/*'. Ces chemins sont relatifs à l'URL racine du client ou si aucune URL racine n'est spécifiée à l'URL racine du serveur d'authentification.
+multivalued.tooltip=Indique si attribue supporte des valeurs multiples. Si activé la liste de toutes les valeurs de cet attribut seront stocké comme attribut. Sinon seulement la première value sera stocké comme attribut
+attributeDefaultValueHelp=Si aucune valeur n'existe dans la base de données Keycloak et si l'attribut est obligatoire dans le LDAP cette valeur sera propagée au LDAP.
+eventTypes.RESTART_AUTHENTICATION.name=Recommence l'authentification
+passMaxAgeHelp=Passer max_age au fournisseur d'identité.
+exportFail=Impossible d'exporter le domaine : '{{error}}'
+flowTypeHelp=De quel formulaire s'agit-il ?
+setPasswordConfirm=Saisir le mot de passe ?
+attributeDisplayNameHelp=Afficher de le nom pour l'attribut. Supporte les clés pour les valeurs traduites également. Par exemple : ${profile.attribute.phoneNumber}. Cliquez sur l'icône 'Route global' pour ajouter les traductions.
+assignedType=Type assigné
+modeHelp=LDAP_ONLY signifie que les tous mappings de groupe d'utilisateurs seront récupérés depuis le LDAP et sauvegardé dans le LDAP. READ_ONLY est un mode en lecture seule du LDAP où les mappings de groupe sont récupérés depuis le LDAP et la base de données et seront fusionnés ensemble. Un nouveau groupe est sauvegardé dans la base de données mais pas dans le LDAP. IMPORT est un mode de lecture seule du LDAP ou les mappings de groupe sont récupérés depuis le LDAP quand l'utilisateur est importé depuis LDAP and sont ensuite sauvegardés dans la base de données locale Keycloak.
+identityProvider=Fournisseur d'identité
+forgotPasswordHelpText=Affiche un lien sur la page de connexion pour les utilisateurs qui ont oublié leurs identifiants.
+identityProviderLinks=Liens de fournisseur d'identité
+leave=Quitter
+eventTypes.LOGIN_ERROR.name=Erreur de connexion
+loginSettings=Paramètres de connexion
+deleteMessageBundleError=Erreur pendant la suppression du message du lot, {{error}}
+finish=Finir
+validations=Validations
+updatedRequiredActionError=Impossible de mettre à jour l'action requise : {{error}}
+createChildGroup=Créer un groupe enfant
+x509Certificate=Certificat X509
+addressClaim.formatted.label=Nom de l'attribut utilisateur pour l'adresse formattée
+metadataOfDiscoveryEndpoint=Point de terminaison des métadonnées de découverte
+createPolicySuccess=Politique créée avec succès
+notVerified=Non vérifiée
+encryptionKeysConfig=Configuration des clés de chiffrage
+updateClientProfileSuccess=Profil client mis à jour avec succès
+openIDEndpointConfiguration=Configuration des points de terminaison OpenID
+oid4vcIssuerMetadata=Métadonnées de l'émetteur des identifiants OpenID4VCI
+prompts.login=Connexion
+users=Utilisateurs
+keyTabHelp=Emplacement du fichier de l'onglet de clés Kerberos contenant les identifiants du serveur principal. Par exemple /etc/krb5.keytab
+wantAssertionsEncrypted=Assertions chiffrées requises
+noClientPoliciesInstructions=Il n'y a pas de politiques client. Sélectionner 'Créer une politique client' pour créer un nouvelle politique client.
+deleteValidatorConfirmMsg=Etes vous sûr que voulez supprimer définitivement supprimer le validateur {{validatorName}} ?
+uris=URLs
+jwksUrlConfig=Configurations JWKS URL
+validateKeyTab=Vous devez entrer un onglet de clé
+editUsernameAllowed=Editer le nom d'utilisateur
+searchType.attribute=Cherche d'attribut
+saveProviderError=Erreur pendant la sauvegarde du fournisseur : {{error}}
+searchForPermission=Chercher pour la permission
+ldapFilterHelp=Le filtre LDAP ajoute un filtre personnalisé additionnel à la requête entière pour récupérer les groupes LDAP. Ne pas remplir si aucun filtre additionnel n'est nécessaire et vous voulez récupérer tous les groupes depuis le LDAP. Sinon assurez-vous que le filtre commence avec '(' et termine avec ')'.
+addRequestUri=Ajouter des URLs de requêtes valides
+selectACondition=Sélectionner une condition
+ldapAttributeValue=Valeur d'attribut LDAP
+eventTypes.CLIENT_DELETE.description=Supprimer le client
+emptyResources=Pas de ressource
+roleHelp=Rôle à accorder à l'utilisateur si tous les attributs sont présents. Cliquez sur 'Sélectionner le rôle' pour naviguer dans les rôles ou écrivez le dans la boîte de texte. Pour référencer un rôle de client, le format est nomclient.roleclient, par exemple monclient.monrole.
+ldapSynchronizationSettingsDescription=Cette section contient des options liées à la synchronisation des utilisateurs depuis le LDAP vers la base de données Keycloak.
+addPredefinedMappers=Ajouter des mappeurs prédéfinis
+updatedRequiredActionSuccess=Action requise mise à jour avec succès
+roles=Rôles
+displayOrder=Afficher l'ordre
+registrationAllowed=Enregistrement d'utilisateur
+choose=Choisir...
+appliedByProviders=Appliqué par les fournisseurs suivants
+saveEventListenersSuccess=Ecouteur d'évènement mis à jour.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Compte de lien du fournisseur d'identité
+eventTypes.TOKEN_EXCHANGE.name=Echange de jeton
+skipped=Passé
+eventTypes.RESTART_AUTHENTICATION.description=Réinitialiser l'authentification
+scopePermissions.users.manage-group-membership-description=Politiques qui décide si un administrateur peut gérer l'appartenance au groupe pour tous les utilisateurs du domaine. Cela est utilisé en conjonction avec une politique de groupe spécifique
+eventTypes.UPDATE_PASSWORD_ERROR.description=Erreur de mise à jour de mot de passe
+deleteConfirmRealmSetting=Si vous supprimez un domaine, toutes les données associées seront supprimées.
+scope=Périmètre
+evaluateExplain=Cette page vous permet de voir tous les mappeurs de protocole et les mappings de périmètre
+providerCreateError=Impossible de créer une politique client à cause de {{error}}
+includeRepresentationHelp=Inclure une représentation JSON pour créer et mettre à jour les requêtes.
+searchForClientScope=Chercher un périmètre client
+removeAttribute=Supprimer l'attribut
+deleteProviderSuccess=Succès. Le fournisseur a été supprimé.
+sessionsType.offline=Hors ligne
+validatorDeletedError=Erreur pendant la sauvegarde du profil utilisateur : {{error}}
+preserveGroupInheritance=Préserver l'héritage de groupe
+createClientScopeSuccess=Périmètre client créé
+selectOrTypeAKey=Sélectionner un type de clé
+resourceDetails=Détails de ressource
+authorizationScopes=Périmètres d'autorisation
+identityProviderEntityIdHelp=L'ID de l'entité est utilisé pour valider l'émetteur pour les assertions SAML reçues. Si vide aucune validateur d'émetteur est faite.
+noRoles-client=Pas de rôle pour ce client
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Erreur du jeton d'exécution d'action
+eventTypes.USER_INFO_REQUEST_ERROR.description=Erreur de requête d'informations d'utilisateur
+policyRoles=Spécifie les rôles client autorisés par cette politique.
+roleMapping=Mapping de rôle
+accountLinkingOnlyHelp=Si vrai les utilisateurs ne peuvent pas se connecter à ce fournisseur. Ils peuvent seulement se lier à ce fournisseur. Ceci est utile si vous ne voulez autoriser la connexion depuis ce fournisseur mais veut intégrer avec un fournisseur.
+refreshTokenMaxReuseHelp=Nombre maximum de fois qu'un jeton de rafraîchissement peut être réutilisé. Quand un jeton différent est utilisé la révocation est immédiate.
+eventTypes.REMOVE_FEDERATED_IDENTITY.description=Supprimer un regroupement d'identité
+childGroups=Groupes enfant
+eventTypes.IDENTITY_PROVIDER_LOGIN.name=Login du fournisseur d'identité
+exportAuthDetailsError=Erreur pendant l'export des détails d'autorisation : {{error}}
+selectGroups=Sélectionner un groupe à rejoindre
+webAuthnPolicyAuthenticatorAttachmentHelp=Communique à un authentificateur un schéma de pièce jointe valide.
+mappedGroupAttributes=Attributs de groupe mappés
+localization=Traduction
+importConfig=Importer la configuration depuis un fichier
+webAuthnPolicyRpIdHelp=La WebAuthn Relying Party ID (RpID). Cela doit être l'origine du domaine effectif, comme 'societe.com' ou 'auth.company.com'.
+newClientProfile=Créer le profil client
+consoleDisplayConnectionUrlHelp=URL de connexion à votre serveur LDAP
+enabledWhen=Activé quand
+clientAssertionSigningAlg=Algorithme de signature de l'assertion client
+homeURLHelp=URL par défaut à utiliser quand le serveur d'authentification a besoin de rediriger vers le client.
+ldapAttribute=Attribut LDAP
+fullScopeAllowedHelp=Vous permet de désactiver toutes les restrictions.
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=Erreur pendant l'envoi du lien du fournisseur d'identité
+otpType=Type OTP
+algorithm=Algorithme
+grantedScopes=Périmètres accordés
+groupNameLdapAttribute=Attribut LDAP pour le nom de groupe
+removeConfirmTitle_one=Supprimer le groupe ?
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=Erreur au moment de transmettre la requête d'autorisation
+includeInTokenScope=Inclure dans le périmètre de jeton
+eventType=Type d'évènement sauvegardé
+tokenDeleteConfirmTitle=Supprimer le jeton d'accès initial ?
+useRefreshTokenForClientCredentialsGrant=Utiliser les jetons de rafraîchissement pour accorder les identifiants client
+userDetails=Détails de l'utilisateur
+sectorIdentifierUri.label=URL de l'identificateur de secteur
+inputTypeStep=Entrer la taille de l'étape
+mapperTypeHelp=Utilisé pour mapper un seul attribut depuis l'utilisateur LDAP vers l'attribut UserModel dans la base de données Keycloak
+importWarning=Les données et paramètres importés ci dessus pourraient écraser les données et paramètres qui existent déjà.
+kerberosRequiredSettingsDescription=Cette section contient quelques options basiques communes à tous les fournisseurs de stockage d'utilisateur.
+resetPasswordFor=Saisir le mot de passe pour {{username}}
+duplicateEmailsAllowed=Dupliquer les mails
+deleteEventsConfirm=Si vous supprimez les évènements de ce domaine tous les enregistrements seront supprimés définitivement de la base de données
+noGroupsInThisRealmInstructions=Vous n'avez créé aucun groupe dans ce domaine. Créer un groupe pour commencer.
+eventTypes.REMOVE_TOTP_ERROR.name=Erreur de suppression totp
+groupUpdateError=Erreur pendant le mise à jour du groupe {{error}}
+logoutAllSessions=Déconnecter toutes les sessions
+membershipUserLdapAttribute=Attribut pour l'appartenance de l'utilisateur LDAP
+noKeysDescription=Vous n'avez créé aucune clé active
+eventTypes.UPDATE_EMAIL.name=Mettre à jour le mail
+notBeforeHelp=Révoquer tous les jetons générés avant ce moment pour ce client. Pour enregistrer la politique vous devriez d'abord saisir une URL administrateur effective dans l'onglet Paramètres d'abord.
+protocolTypes.saml=SAML
+idTokenSignatureAlgorithm=Algorithme de signature du jeton ID
+providerInfo=Informations du fournisseur
+ssoServiceUrl=URL du service Sign-On
+artifactResolutionServiceUrl=URL du service de résolution d'artefacts
+inputHelperTextAfter=Texte d'aide en dessous le champ d'entrée
+appliedByClients=Appliqués par les clients suivants
+createFlowHelp=Vous pouvez créer un flux haut niveau avec ce formulaire.
+defaultLocaleHelp=La langue initiale à utiliser. Elle sera utilisée sur la page de connexion et les autres pages dans la console Admin et la console Compte.
+deleteConfirmFlowMessage=Etes vous sûr de vouloir supprimer définitivement le flux "<1>{{flow}}</1>".
+webAuthnPolicyAuthenticatorAttachment=Pièce jointe de l'authentificateur
+kerberos=Kerberos
+noNodesInstructions=Il n'y aucun nœud enregistré, vous pouvez en ajouter un manuellement.
+login=Connexion
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=Erreur de récupération du jeton du fournisseur d'identité
+local=Local
+noGroupsInThisSubGroupInstructions=Vous n'avez créé aucun groupe dans ce sous groupe.
+validatorColNames.colName=Nom du validateur
+userVerify.required=Requis
+searchMembers=Cherches des membres
+keySizeHelp=Taille des clés générées
+otpSupportedApplications.totpAppGoogleName=Google Authenticator
+clientDeleteConfirmTitle=Supprimer le client ?
+policyDetails=Détails de la politique
+changedUsersSyncHelp=Périodicité de synchronisation pour les utilisateurs LDAP modifiés ou créés en secondes
+trustEmailHelp=Si activé le mail fourni par ce fournisseur n'est pas vérifié même si la vérification est activée pour ce domaine.
+invalidateRotatedSecretExplain=Après avoir invalidé la rotation du secret, le secret retourné sera supprimé automatiquement
+clientSessionMaxHelp=Durée maximale avant expiration d'une session client. Les jetons sont invalidés quand une session expire. L'option n'affecte pas la session SSO de l'utilisateur global. Si non spécifié la durée maximale de session SSO standard est utilisée.
+clientScopeDetails=Détails de périmètre client
+requiredHelp=Saisir l'attribut comme demandé. Si activé, l'attribut doit être renseigner obligatoirement, soit par les utilisateurs ou par les administrateur. Sinon l'attribut est facultatif.
+clientScopeRemoveError=Impossible de supprimer le mapping de périmètre {{error}}
+mapperTypeRoleLdapMapper=role-ldap-mapper
+testConnectionHint.withEmail=En testant la connexion un mail sera envoyé à l'utilisateur actuel ({{email}}).
+adminURLHelp=URL de l'interface administrateur du client. A remplir si le client supporte l'adaptateur API REST. Cette API REST autorise le serveur d'authentification à pousser les politiques de révocation et les autres tâches administratives. Habituellement cette valeur est égale à l'URL de base du client.
+otpPolicyPeriodHelp=Pendant combien de secondes un jeton OTP est valide ? Par défaut 30 secondes.
+otpPolicyCodeReusableHelp=Possibilité d'utiliser le même code OTP encore après une authentification réussie.
+parentId=ID Parent
+storePasswordHelp=Mot de passe pour accéder à l'archive elle même
+directAccess=Validations des accès directs
+userFedDeletedSuccess=Le fournisseur de regroupement d'utilisateur a été supprimé.
+eventTypes.UNREGISTER_NODE.description=Désenregistrer le nœud
+whoWillAppearPopoverTextRoles=Cet onglet associe uniquement les utilisateurs qui sont assignés directement à ce rôle. Pour voir les utilisateurs qui sont assignés à ce rôle par un rôle associé ou par un groupe aller à
+showPassword=Montrer le champ de mot de passe en clair
+logic=Logique
+clientScopeSearch.type=Type assigné
+scopePermissions.groups.manage-membership-description=Politiques qui décident si un administrateur peut ajouter ou supprimer des utilisateurs de ce groupe
+resourceType=Type de ressource
+copied=Détails d'autorisation copiés.
+scopeName=Un nom unique pour ce périmètre. Ce nom peut être utilisé pour identifier de manière unique un périmètre, utile pour la chercher d'un périmètre spécifique.
+userInfoUrlHelp=L'URL des informations utilisateur. Ceci est optionnel.
+clientProfileSearch=Chercher
+addSavedTypes=Ajouter les types sauvegardés
+setPasswordFor=Saisir le mot de passe pour {{username}}
+updateUserLocale=Mettre à jour la langue de l'utilisateur
+mapperCreateError=Erreur à la création du mappeur : {{error}}
+resetBtn=Réinitialiser
+mode=Mode
+kc.realm.name=Realm
+userFedDisableConfirmTitle=Désactiver le fournisseur de regroupement d'utilisateur ?
+eventTypes.CLIENT_REGISTER.name=Registre de client
+mappingTable=Table avec mappeurs prédéfinis
+requestObject.not\ required=Non requis
+adminURL=URL administrateur
+generatedAccessTokenNo=Pas de jeton d'accès généré
+always=Toujours
+pkceEnabledHelp=Utiliser le PKCE (Proof of Key-code exchange) pour le IdP Brokering
+settings=Paramètres
+webAuthnPolicyUserVerificationRequirement=Obligation pour la vérification client
+unlinkAccountTitle=Désassocier le compte de {{provider}} ?
+noNodes=Pas de nœud enregistré
+singleLogoutServiceUrlHelp=L'URL qui doit être utilisé pour envoyer les requêtes de déconnexion.
+authorizationEncryptedResponseAlg=Algorithme de gestion de clé de réponse d'autorisation
+useTruststoreSpi=Utiliser Truststore SPI
+allowEcpFlowHelp=Ce client est autorisé à utiliser le flux ECP pour authentifier les utilisateurs.
+noSessions=Pas de session
+clipboardCopyError=Erreur pendant la copie dans le presse papier.
+storeTokens=Stocker les jetons
+usermodel.clientRoleMapping.rolePrefix.tooltip=Un préfixe qui sera ajouté à chaque nom de rôle client (optionnel).
+deleteConfirmCurrentUser=Etes vous sûr de vouloir supprimer définitivement cet utilisateur ?
+eventTypes.CLIENT_REGISTER_ERROR.description=Erreur d'enregistrement client
+addClientScopesTo=Ajouter les périmètres client à {{clientName}}
+x509=Nom du sujet X.509
+showDataBtn=Montrer les données
+dedicatedScopeDescription=Périmètre et mappeurs dédiés pour ce client
+Sunday=Dimanche
+editMode=Mode d'édition
+updatePasswordPolicySuccess=Politiques de mot de passe mise à jour avec succès
+removedGroupMembership=Appartenance au groupe supprimée
+passwordHelp=Mot de passe SMTP. Ce champ est capable de prendre sa valeur d'un coffre fort, utilisez le format ${coffrefort.ID}.
+deleteScopeWarning=Les permissions ci dessous seront supprimées quand elles ne seront plus utilisées par d'autres périmètres d'autorisation :
+compositeRoleOff=Rôle composite désactivé
+fullSyncPeriod=Période de synchronisation complète
+clientsExplain=Les clients sont des applications et des services pour peuvent demander l'authentification d'un utilisateur.
+addNode=Ajouter nœud
+jwksUrl=URL JWKS
+policy-description=Une description pour cette politique.
+defaultPasswordLabel=Mon mot de passe
+mapperUserAttributeName=Nom de l'attribut utilisateur
+importClient=Importer le client
+deleteMapperSuccess=Mappeur supprimé avec succès.
+scopeSaveError=Impossible de persister le périmètre d'autorisation à cause de {{error}}
+used.SPECIFIC_PROVIDERS=Fournisseurs spécifiques
+deletedSuccessIdentityProvider=Fournisseur supprimé avec succès.
+reload=Recharger
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.name=Erreur de connexion au fournisseur d'identité
+scopePermissions.groups.view-description=Politiques qui décident si un administrateur peut voir ce groupe
+createFlow=Créer le flux
+encryptAssertionsHelp=Les assertions SAML doivent elles être chiffrées avec la clé publique du client en utilisant AES ?
+unsavedChangesConfirm=Vous avez des changements non sauvegardés. Voulez vous vraiment quitter cette page ?
+disabledOff=Désactivé
+membershipLdapAttributeHelp=Nom de l'attribut LDAP qui est utilisé pour les mappings de l'appartenance aux groupes. Généralement 'member'. Toutefois quand 'Type d'attribut d'appartenance' est 'UID' alors 'Attribut LDAP d'appartenance' est souvent 'memberUid'.
+usersLeftError=Impossible de supprimer les utilisateurs du groupe : {{error}}
+addTypes=Ajouter les types
+pushedAuthorizationRequestRequiredHelp=Paramètre booléen qui indique si le serveur d'autorisation accepte les donnes de la requête d'autorisation seulement via la méthode d'envoyer (push) la requête d'autorisation.
+requirement=Exigence
+any=N'importe
+minute=Minute
+useJwksUrl=Utiliser l'URL JWKS
+wantAssertionsSigned=Assertions signées requises
+roleSaveSuccess=Le rôle a été sauvegardé
+scopeParameter=Paramètre de périmètre
+unsigned=Non signé
+userGroupsRetrieveStrategy=Stratégie de récupération des groupes d'utilisateurs
+addSubFlow=Ajouter un sous flux
+validatingPublicKeyHelp=La clé publique au format PEM qui soit être utilisée pour vérifier les signatures IDP externes.
+client-uris-must-match.label=Les URLs du client doivent correspondre
+webAuthnPolicyAcceptableAaguids=AAGUIDs acceptés
+noRoles-roles=Pas de rôles dans ce domaine
+deleteMapperConfirm=Etes vous sûr de vouloir supprimer définitivement ce mappeur {{mappeur}} ?
+scopePermissions.roles.map-role-description=Politiques qui décide si un administrateur peut mapper ce rôle à un utilisateur ou un groupe
+backchannelUrlInvalid=L'URL de déconnexion du canal secondaire n'est pas une URL valide
+eventTypes.LOGIN.description=Connexion
+scopePermissions.clients.map-roles-client-scope-description=Politiques qui décide si un administrateur peut appliquer des rôles définis par ce client au périmètre client d'un autre client
+impersonateConfirm=Usurper l'identité de utilisateur ?
+accessTokenSuccess=Jeton d'accès regénéré
+includeInIdToken.tooltip=L'attribut doit il être ajouté au jeton d'ID ?
+validRequestURIs=URLs de requête valides
+allowPasswordAuthentication=Autorise l'authentification de mot de passe
+validateUsernameLDAPAttribute=Vous devez entrer un attribut LDAP de nom d'utilisateur
+pairwiseSubAlgorithmSalt.tooltip=Sel utilisé pendant le calcul de l'identifiant du sujet par paire. Si vide un sel sera généré.
+allowKerberosAuthentication=Autorise l'authentification Kerberos
+predefinedMappingDescription=Choisissez l'un des mappeurs prédéfinis de cette table
+privateRSAKey=Clé RSA privée
+createPermission=Créer la permission
+moveToGroup=Déplacer {{group1}} vers {{group2}}
+noRealmRoles=Pas de rôles de domaine
+reqAuthnConstraints=Contraintes AuthnContext requêté
+addIdpMapperNameHelp=Nom du mappeur.
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.description=Requête d'autorisation poussé
+requirements.ALTERNATIVE=Alternative
+claimFilterValueHelp=Valeur de l'attribut essentiel (avec le support d'expression régulière)
+credentialResetConfirm=Envoyer mail
+permissionsEnabledHelp=Détermine si les permissions à granularité fine sont activé pour gérer ce rôle. Désactiver ceci supprime toutes les permissions courantes.
+consentScreenTextHelp=Texte qui sera affiché sur la page de consentement quand ce périmètre client sera ajouté à un client qui a le consentement requis. Par défaut égal au périmètre client si non précisé.
+realmRolesList=Rôles du domaine
+roleList=List des rôles
+kerberosRealm=Domaine Kerberos
+scopePermissions.groups.manage-members-description=Politiques qui décident si un administrateur peut gérer les membres de ce groupe
+consentRequiredHelp=Si activé les utilisés devront consentir pour accéder au client.
+flow.direct\ grant=Flux d'accès direct
+eventTypes.EXECUTE_ACTION_TOKEN.name=Exécute un jeton d'action
+groupName=Nom du groupe
+authorizationUrl=URL d'autorisation
+eventTypes.VALIDATE_ACCESS_TOKEN.name=Valider le jeton d'accès
+contextualAttributes=Attribut contextuel
+providerDescription=Description du fournisseur
+downloadAdapterConfig=Télécharger la configuration de l'adaptateur
+scopePermissions.clients.view-description=Politiques qui décident si un administrateur peut voir ce client
+allowEcpFlow=Autoriser le flux ECP
+rsa=rsa
+setPasswordConfirmText=Etes vous sûr de vouloir saisir le mot de passe pour l'utilisateur {{username}} ?
+updateErrorIdentityProvider=Impossible de mettre à jour le fournisseur {{error}}
+emptyProfiles=Pas de profils client configurés
+createClientProfileError=Impossible de créer le profil client : '{{error}}'
+downloadAdaptorTitle=Télécharger les configuration de l'adaptateur
+client-roles.label=Rôles client
+keysFilter.PASSIVE=Clés passives
+scopeTypeHelp=Périmètres client qui seront ajoutés comme périmètres par défaut pour chaque client créé
+search=Chercher
+validateEditMode=Vous devez sélectionner un mode d'édition
+copyFlowSuccess=Flux dupliqué avec succès
+cacheSettings=Paramètres de cache
+client-attributes.label=Attributs client
+searchForClient=Chercher un client
+permissionDeletedError=Impossible de supprimer la permission à cause de {{error}}
+eventTypes.UPDATE_PROFILE.name=Mettre à jour le profil
+realmId=ID du domaine
+eventTypes.PERMISSION_TOKEN_ERROR.description=Erreur du jeton de permission
+algorithmHelp=Algorithme attendu pour la clé
+importFile=Importer le fichier
+ldapRolesDn=DN rôles LDAP
+displayOnClientHelp=Applicable seulement si 'Consentement requis' est activé pour ce client. Si désactivé la page de consentement contiendra seulement les consentements correspondants aux périmètres client configurés. Si activé il y aura également un champ sur la page de consentement pour ce client spécifique.
+requestObjectRequired=Objet de requête requis
+prompts.none=Aucun
+resourcesHelp=Spécifie que cette permission doit être appliquée à une instance d'une ressource spécifique.
+protocolHelp=Configuration du protocole SSO fourni par ce périmètre client
+passwordConfirmation=Confirmation de mot de passe
+aggregate.attrs.tooltip=Indique si les valeurs d'attribut doit être agrégée avec les attributs de groupe. Si un mappeur OpenID Connect est utilisé l'option à choix multiple doit être activé aussi pour avoir toutes les valeurs. Les valeurs dupliquées sont ignorées et l'ordre des valeurs n'est pas garantie avec cette option.
+helpLabel=Plus d'aide pour '{{label}}'
+noRoles=Pas de rôles pour cet utilisateur
+createAttribute=Créer un attribut
+Thursday=Jeudi
+importOverwritten_one=Un enregistrement écrasé.
+tokenDeleteError=Impossible de supprimer le jeton d'accès initial : '{{error}}'
+eventTypes.REGISTER_NODE_ERROR.name=Erreur d'enregistrement de nœud
+isMandatoryInLdap=Est obligatoire en LDAP
+discoveryEndpoint=Point de terminaison de découverte
+claimValue=Valeur d'attribut
+eventTypes.FEDERATED_IDENTITY_LINK.name=Lien de l'identité fédérée
+authenticationHelp=Cet interrupteur défini le type de client OIDC. Si activé le type est en accès confidentiel, sinon il est en accès public.
+deleteClientConditionError=Erreur à la création de la condition : {{error}}
+noMappers=Pas de mappeurs
+couldNotLinkIdP=Impossible d'associer le fournisseur d'identité {{error}}
+otpPolicyPeriod=Durée du jeton OTP
+managePriorities=Gestion des priorités
+createClientPolicySuccess=Nouvelle politique créée
+frontendUrlHelp=Définie l'URL du frontend pour ce domaine. Utilisez ceci en combinaison avec le nom de domaine par défaut du fournisseur pour écraser l'URL de base des requêtes frontend pour un domaine spécifique.
+used.notInUse=Pas en cours d'utilisation
+emailSettings=Paramètres de mail
+samlEntityDescriptorHelp=Vous permet de charger des métadonnées IDP externes depuis un fichier de configuration ou de les télécharger depuis une URL.
+createClientProfile=Créer le profil client
+cachePolicy=Politique de cache
+noCredentials=Pas d'identifiants
+clientOfflineSessionIdle=Durée d'inactivité d'une session client hors ligne
+eventListeners=Ecouteurs d'évènements
+bindDn=Associer DN
+evictionHourHelp=Heure de la journée à laquelle l'entrée deviendra valide
+permissionDetails=Détails de permission
+clipboardCopyDenied=Votre navigateur bloque l'accès au presse papier.
+Friday=Vendredi
+saveProviderListSuccess=Priorité du fournisseur mise à jour avec succès.
+copyToClipboard=Copié au presse papier
+wantAuthnRequestsSigned=AuthnRequests signées requises
+usermodel.attr.tooltip=Nom de l'attribut utilisateur stocké qui le nom d'un attribut dans le map UserModel.attribute.
+requiredForLabel.both=Administrateurs et utilisateurs
+clientPoliciesProfiles=Profils de politiques clients
+eventTypes.SEND_VERIFY_EMAIL.name=Envoyer le mail de vérification
+eventTypes.REGISTER_NODE.name=Enregistrer le nœud
+addToFilter=Ajouter au filtre
+CONFIGURE_TOTP=Configurer OTP (CONFIGURE_TOTP)
+eventTypes.EXECUTE_ACTIONS.description=Exécuter les actions
+clientUpdaterSourceRolesHelp=La condition vérifie le rôle de l'entité qui essaie de créer/mettre un jour un client pour déterminer si la politique est appliquée.
+userModelAttributeName=Nom de l'attribut du modèle utilisateur
+importResourceError=Impossible d'importer la ressource à cause de {{error}}
+dynamicScope=Périmètre dynamique
+mapperTypeHardcodedLdapRoleMapper=hardcoded-ldap-role-mapper
+validateName=Vous devez entrer un nom
+flowDetails=Détails du flux
+never=Jamais
+includeInIntrospection.tooltip=L'attribut doit il être ajoutés à l'introspection de jeton ?
+addressClaim.region.tooltip=Nom l'attribut utilisateur qui sera utilisé pour mapper le sous attribut 'région' dans l'attribut de jeton 'adresse'. Par défaut 'region'.
+IDK-periodicChangedUsersSyncHelp=Les nouveaux utilisateurs doivent ils être créés dans le magasin LDAP ? La priorité affecte quel fournisseur est utilisé pour synchroniser le nouvel utilisateur.
+claimToRole=Si un attribut existe accorde à l'utilisateur le rôle de client ou de domaine spécifié.
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=Erreur pendant la suppression du regroupement d'identité
+logoutServiceArtifactBindingUrlHelp=URL d'association SAML ARTIFACT for le service de déconnexion du client. Vous pouvez laisser ce champ vide si vous utilisez une association différente.
+createAuthorizationScope=Créer un périmètre d'autorisation
+noGroups=Pas de groupes
+backchannelLogoutRevokeOfflineSessionsHelp=Spécifie si un évènement "revoke_offline_access" est inclus dans le jeton de déconnexion quand l'URL du canal secondaire de déconnexion est utilisé. Keycloak révoquera les sessions hors ligne quand un jeton de déconnexion est reçu avec cet évènement.
+roleID=ID rôle
+roleNameLdapAttributeHelp=Nom de l'attribut LDAP qui est utilisé dans les objets de rôle pour le nom le rôle RDN. La plupart du temps 'cn'. Dans ce cas un objet groupe/rôle sera souvent quelque chose comme 'cn=role1,ou=finance,dc=example,dc=org'.
+origin=Origine
+regexPattern=Schéma d'expression régulière
+targetContextAttributes=Attributs de contexte ciblés
+targetContextAttributesHelp=Définie l'évaluation des attributs de contexte à la place des attributs d'identité
+filteredByClaim=Vérifier l'attribut essentiel
+rowCancelBtnAriaLabel=Annuler les éditions pour {{messageBundle}}
+validateSignatureHelp=Active/Désactive la validation de signature pour les signatures IDP externes.
+searchForFlow=Chercher un flux
+addressClaim.locality.label=Nom de l'attribut utilisateur pour la localisation
+formatOption=Option de format
+addAuthnContextClassRef=Ajouter AuthnContext ClassRef
+showPasswordDataName=Nom
+clientScopeTypes.none=Aucun
+whoCanEdit=Qui peut éditer ?
+mappingCreatedSuccess=Mapping créé avec succès
+eventTypes.GRANT_CONSENT.description=Accorder le consentement
+client=Client
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=Erreur authentification d'appareil OAuth2
+implicitFlow=Flux implicite
+authorizationSignedResponseAlgHelp=Algorithme JWA utilisé pour signer les jetons de réponse d'autorisation quand le mode de réponse est JWT.
+associatedRolesRemoved=Les rôles associés ont été supprimés
+keyAliasHelp=Alias pour la clé privée
+whoWillAppearLinkTextUsers=Qui pourra apparaître dans cette liste de groupe ?
+tokenClaimName.tooltip=Nom de l'attribut à insérer dans le jeton. Ceci peut être un nom complètement qualifié comme 'adresse.rue'. Dans ce cas un objet JSON imbriqué est créé. Pour éviter l'imbriquement and utiliser littéralement un point, échapper le point avec un backslash (\\.).
+clientProfileDescription=Description
+ellipticCurveHelp=Courbe elliptique utilisé en ECDSA
+fromPredefinedMapper=Depuis les mappeurs prédéfinis
+attributesGroup=Attributs de groupe
+clientDeleteError=Impossible de supprimer le client : {{error}}
+joinGroupsFor=Rejoindre les groupes pour l'utilisateur {{username}}
+temporaryLocked=Temporairement bloqué
+setup=Configuration
+unlinkAccount=Désassocier le compte
+executors=Exécuteurs
+eventTypes.CLIENT_UPDATE_ERROR.name=Erreur de mise à jour du client
+realm=Domaine
+assign=Assigner
+disableConfirmRealm=Les utilisateurs et client ne pourront plus accéder au domaine s'il est désactivé. Etes vous sûr de vouloir continuer ?
+showAuthData=Montrer les données d'autorisation
+includeInUserInfo.tooltip=L'attribut doit il être ajouté aux informations utilisateur ?
+initialCounter=Compteur initial
+select=Sélectionner
+signature-algorithm=Algorithme JWA que le client doit utilisé pour signer un jeton JWT d'authentification. Si laisser vide le client est autorisé à utiliser n'importe quel algorithme approprié pour l'authentificateur client.
+advanced=Avancé
+revokeRefreshTokenHelp=Si activé un jeton de rafraîchissement peut être utilisé maximum 'Nombre de réutilisation maximum pour un jeton de rafraîchissement' fois et est révoqué quand un jeton différent est utilisé. Sinon les jetons de rafraîchissement ne sont pas révoqués quand ils sont utilisés et peuvent être utilisé plusieurs fois.
+nameField=Nom
+ownerManagedAccessHelp=Si activé l'accès à cette ressource peut être géré par le propriétaire de la ressource.
+useLowerCaseBearerTypeHelp=Si activé les réponses de jeton utiliseront le type 'bearer' en minuscule. Par défaut le serveur le serveur utilise le type "Bearer" comme défini dans la norme RFC6750.
+useRfc9068AccessTokenTypeHelp=Si activé les jetons d'accès auront un type d'entête "at+jwt" pour respecter la norme RFC9068. Sinon le type d'entête sera "JWT".
+addCondition=Ajouter la condition
+updateSuccessClientScope=Périmètre client mis à jour
+connectionAndAuthentication=Connexion & authentification
+clientScopeType.optional=Optionnel
+permissionsDisableConfirm=Si vous désactivez les permissions toutes les permissions de la liste ci dessous seront automatiquement supprimées. De plus les ressources et périmètres qui y sont associées seront aussi supprimés
+eventTypes.REFRESH_TOKEN.description=Jeton de rafraîchissement
+authorization=Autorisation
+clientProfilesHelpItem=Elément d'aide profil client
+userSessionAttributeValue=Valeur d'attribut de la session utilisateur
+dayMonthHelp=Définie le jour du mois auquel la politique DOIT être accordée. Vous pouvez aussi fournir un intervalle en remplissant le second champ. Dans ce cas la permission sera accordé seulement si le jour du mois est dans l'intervalle donné (bornes incluses).
+userFedDeleteError=Impossible de supprimer le fournisseur de regroupement d'utilisateur : '{{error}}'
+id=ID
+join=Rejoindre
+clientUpdaterSourceGroupsHelp=La condition vérifie le groupe d'entités qui essaie de créer/mettre à jour le client pour voir si la politique est appliquée.
+idTokenEncryptionContentEncryptionAlgorithmHelp=Algorithme JWA utilisé pour le chiffrage du contenu dans les jetons ID chiffrés. Cette option est nécessaire seulement si vous voulez chiffrer les jetons ID. Si vide les jetons ID sont juste signés mais pas chiffrés.
+messageBundleDescription=Vous pouvez seulement modifier les langues supportées. Si vous n'avez sélectionné aucune langue supportée pour le moment vous pouvez seulement éditer la traduction anglaise.
+saveEventListenersError=Erreur pendant la sauvegarde d'écouteur d'évènement : {{error}}
+scopesHelp=Les périmètres peuvent être envoyés quand l'autorisation est demandée. Peut être une liste de périmètres séparés par un espace. Par défaut 'openid'.
+inputOptionLabelsI18nPrefix=Préfixe de clé d'internationalision
+nameHintHelp=Un nom unique pour le groupe. Ce nom sera utilisé pour référencer le groupe quand un attribut est associé à un groupe.
+admin-events-cleared-error=Impossible de supprimer les évènements administrateurs {{error}}
+usersPermissionsHint=Permissions à granularité fine pour gérer tous les utilisateurs du domaine. Vous pouvez définir différentes politiques pour ceux qui sont autorisés à gérer les utilisateurs du domaine.
+enabledHelp=Saisir si les clés sont activées
+isBinaryAttribute=Est un attribut binaire
+clientScopeList=Périmètres client
+noValidMetaDataFound=Aucune métadonnées valides trouvées à cette URL : '{{error}}'
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=Erreur de récupération du jeton du fournisseur d'identité
+usernameLdapAttribute=Attribut LDAP pour le nom d'utilisateur
+updateResourceSuccess=Ressource mise à jour avec succès
+displayNameHelp=Nom amical pour les fournisseurs d'identités.
+idpAccountEmailVerification=Vérification du mail de compte IdP
+template=Modèle
+deleteExecutionSuccess=Exécution supprimée avec succès
+deleteConfirmTitle_other=Supprimer les groupes ?
+profilesConfigTypes.jsonEditor=Editeur JSON
+testingConnection=Test de la connexion
+noUsersFoundError=Pas d'utilisateur trouvé à cause de {{error}}
+clientUpdaterSourceGroups=Groupes
+executorDetails=Details d'exécuteur
+backchannelLogoutHelp=Le IDP externe supporte t il la déconnexion de canal secondaire ?
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=Erreur de suppression de regroupement d'identité
+usermodel.realmRoleMapping.rolePrefix.tooltip=Un préfixe qui sera ajouté à chaque nom de rôle de domaine (optionnel).
+exportSamlKeyTitle=Exporter les clés SAML
+eventTypes.EXECUTE_ACTIONS_ERROR.description=Erreur exécutions des actions
+SKIP=Passer
+eventTypes.INTROSPECT_TOKEN.description=Jeton introspection
+infoEnabledFeatures=Montre toutes les fonctionnalités activées.
+displayOrderHelp=Nombre définissant l'ordre des fournisseurs dans l'interface (par exemple sur la page de connexion). Plus le nombre est bas plus le fournisseur est prioritaire.
+deleteCredentialsConfirm=Etes vous sûr de vouloir supprimer les identifiants des utilisateurs ?
+searchForProvider=Chercher un fournisseur
+ldapSearchingAndUpdatingSettingsDescription=Cette section contient des options liées à la recherche de serveur LDAP pour les utilisateurs disponibles.
+sessionsType.regularSSO=SSO régulier
+executorsHelpItem=Elément d'aide pour les exécuteurs
+client-uris-must-match.tooltip=Si activé tous les URLs client (URLs de redirection et autres) sont autorisés seulement si elles correspondent à des hôtes ou domaines de confiance.
+off=Désactivé
+frontchannelLogoutHelp=Quand activé la déconnexion requière un navigateur qui redirige vers le client. Sinon le serveur fait une invocation en arrière plan pour la déconnexion.
+updateSuccess=Fournisseur mis à jour avec succès
+hide=Cacher
+isMandatoryInLdapHelp=Si activé cet attribut est obligatoire en LDAP. Si aucune valeur existe dans la base de données Keycloak la valeur vide est propagée au LDAP.
+client-accesstype.label=Type d'accès client
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Erreur après connexion au fournisseur d'identité
+skipCustomizationAndFinish=Passer la personnalisation et terminer
+mappingDeletedSuccess=Mapping supprimé avec succès
+addIdentityProvider=Ajouter le fournisseur {{provider}}
+kc.time.date_time=Date/Heure (MM/jj/aaaa hh:mm:ss)
+principalType=Type principal
+ignoreMissingGroupsHelp=Ignorer les groupes manquants dans la hiérarchie de groupe.
+updatedCredentialMoveSuccess=Configuration des identifiants de l'utilisateur sauvegardée
+deleteExecutorProfileConfirmTitle=Supprimer l'exécuteur ?
+auth=Authentification
+accessTokenLifespanImplicitFlow=Durée de vie du jeton d'accès pour le flux implicite
+createAttributeSuccess=Succès ! La configuration du profil utilisateur a été sauvegardée.
+annotations=Annotations
+confirmAccessTokenBody=Si vous regénérez l'enregistrement du jeton accès, les données accédées par le service d'enregistrement de client sera mis à jour.
+remainingCount=Nombre restant
+eventTypes.INVALID_SIGNATURE.description=Signature invalide
+download=Télécharger
+authScopes=Périmètres d'autorisation
+requiredWhen=Requis quand
+updatePasswordPolicyError=Impossible de mettre à jour la politique de mot de passe : '{{error}}'
+max-clients.tooltip=Si le nombre de clients existants du domaine est supérieur ou égale à la limite configurée il ne sera plus possible d'enregistrer un nouveau client.
+mappingDetails=Détails du mappeur
+top-level-flow-type.client-flow=Flux du client
+eventTypes.GRANT_CONSENT_ERROR.description=Erreur d'accord de consentement
+claim=Attribut
+hardcodedAttribute=Quand l'utilisateur est importé depuis un fournisseur, harcode une valeur à une valeur à un attribut d'utilisateur.
+permissionSaveError=Impossible de mettre à jour la permission à cause de {{error}}
+deleteClientScope_one=Supprimer le périmètre client {{name}}
+accessTokenError=Impossible de regénérer le jeton d'accès à cause de : {{error}}
+joinGroups=Rejoindre les groupes
+providedBy=Fourni par
+doNotStoreUsers=Ne pas stocker les utilisateurs
+ms=millisecondes
+ipAddress=Adresse IP
+keyID=KEY_ID
+spi=SPI
+emptyValidators=Pas de validateurs.
+plus=Plus
+browserFlow=Flux de navigateur
+anyScope=N'importe quel périmètre
+enableDisable=Les clients désactivés ne peuvent pas initier une connexion ou obtenir un jeton d'accès.
+noUsersFound=Pas d'utilisateurs trouvés
+serverInfo=Informations serveur
+chooseAPolicyTypeInstructions=Choisissez un type de politique depuis la liste ci dessous puis vous pouvez configurer une nouvelle politique pour l'autorisation. Il y a plusieurs types et descriptions.
+Wednesday=Mercredi
+consents=Consentements
+authDetails=Détails d'autorisation
+mappingDeletedError=Impossible de regénérer le mapping : '{{error}}'
+deleteGrantsSuccess=Droits révoqués avec succès.
+mapperTypeGroupLdapMapper=group-ldap-mapper
+policyEnforcementModes.DISABLED=Désactivé
+openIdConnectCompatibilityModes=Modes de compatibilité OpenID Connect
+no=Non
+code=Code
+nameHelp=Texte d'aide pour le nom du nouveau flux
+keys=Clés
+defaultSigAlg=Algorithme de signature par défaut
+signatureKeyName=Nom de la clé de signature SAML
+notBeforeTooltip=L'URL administrateur doit d'abord être saisies dans l'onglet Paramètres.
+resourcesToImport=Ressources à importer
+selectRole.label=Sélectionner un rôle
+isBinaryAttributeHelp=Doit être vrai pour les attributs LDAP binaires.
+whoWillAppearPopoverFooterText=Les utilisateurs qui ont ce rôle comme rôle effectif ne peuvent pas être ajoutés à cet onglet.
+eventTypes.RESTART_AUTHENTICATION_ERROR.name=Erreur de réinitialisation d'authentification
+generatedUserInfoIsDisabled=Les informations utilisateurs générées sont désactivées quand aucun utilisateur n'est sélectionné
+nameHelpHelp=Nom du mappeur
+prompts.consent=Consentement
+flowNameHelp=Texte d'aide pour le nom du nouveau flux
+lastEvaluation=Dernière évaluation
+enableStartTlsHelp=Chiffre la connexion au LDAP en utilisant StartTLS, ce qui désactivera l'interrogation régulière de connexion (pooling)
+createClientConditionError=Erreur à la création de la condition : {{error}}
+resourceScopeSuccess=Périmètre d'autorisation supprimé avec succès
+userIdHelperText=Entrer l'ID unique de l'utilisateur pour ce fournisseur d'identité.
+on=Activé
+changeAuthenticatorConfirmTitle=Changé à {{clientAuthenticatorType}} ?
+eventTypes.OAUTH2_DEVICE_AUTH.name=Authentification de l'appareil OAuth2
+admin-events-cleared=Les évènements administrateurs ont été supprimés
+or=ou
+deleteDialogTitle=Supprimer l'attribut de groupe ?
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Le client a initié l'association du compte
+annotationsText=Annotations
+ldapAttributeName=Nom de l'attribut LDAP
+AESKeySizeHelp=Taille in octets pour la clé générées AES. 16 pour AES-128, 24 pour AES-192 et 32 pour AES-256. ATTENTION : Des clés plus grandes que 128 octets ne sont pas autorisées dans certaines implémentations JDK.
+acceptsPromptNone=Accepte prompt=none transféré depuis le client
+oneTimePassword=Mot de passe à usage unique
+excludeSessionStateFromAuthenticationResponseHelp=Si ceci est activé le paramètre 'session_state' ne sera pas inclus dans la réponse d'authentification OpenID Connect. Ceci est utile si le client utilise un ancien adaptateur OIDC / OAuth2 qui ne supporte pas le paramètre 'session_state'.
+userManagedAccess=Accès gérés par l'utilisateur
+initialAccessToken=Jeton d'accès initial
+rowEditBtnAriaLabel=Editer {{messageBundle}}
+evictionDay=Jour d'expulsion
+vendorHelp=Vendeur LDAP (fournisseur)
+applyToResourceType=Appliquer au type de ressource
+addDefaultGroups=Ajouter aux groupes par défaut
+selectRole.tooltip=Entrez le rôle dans la boîte de texte sur la gauche ou cliquez sur ce bouton pour naviguer et sélectionnez le rôle que vous voulez.
+filterGroups=Filtrer les groupes
+validPostLogoutRedirectUri=URLs de redirection valides après déconnexion
+authnContextClassRefs=AuthnContext ClassRefs
+deleteCredentialsSuccess=Les identifiants ont été supprimés avec succès.
+eventTypes.PERMISSION_TOKEN_ERROR.name=Erreur permission de jeton
+userProfileSuccess=Paramètres de profil utilisateur mis à jour avec succès.
+cibaPolicy=Politique CIBA
+Saturday=Samedi
+importSkipped_other={{count}} enregistrements passés.
+unsavedChangesTitle=Changements non sauvegardés
+emptyResourcesInstructions=Si vous voulez créer une ressource merci de cliquez sur le bouton ci dessous.
+save-user-eventsHelp=Si activé les évènements utilisateurs sont sauvegardés dans la base de données, ce qui rend les évènements disponibles dans l'interface administrateur et de gestion de comptes.
+otpSupportedApplications.totpAppFreeOTPName=FreeOTP
+composite=Composite
+recommendedSsoTimeout=Il est recommandé que cette valeur soit inférieure au temps d'inactivité de la session SSO : {{time}}
+sessionExplain=Les sessions sont les sessions d'utilisateurs de ce domaine et les clients auxquels ils accèdent pendant leur session.
+noSearchResults=Pas de résultats de recherche
+recent=Récent
+executeActions=Exécuter les actions
+advancedAttributeToRole=Si l'ensemble d'attribut existe et correspond, accorde à l'utilisateur le rôle de client ou de domaine spécifié.
+userEventsSettings=Paramètres d'évènements utilisateur
+deny=Refuser
+moveGroupSuccess=Groupe déplacé
+eventTypes.USER_INFO_REQUEST.description=Requête d'informations utilisateur
+userDeletedError=L'utilisateur ne peut pas être supprimé {{error}}
+edit=Editer
+authorizationScopeDetails=Détails du périmètre d'autorisation
+ldapGroupsDnHelp=LDAP DN où les groupes de cet arbre sont sauvegardés. Par exemple 'ou=groups,dc=example,dc=org'.
+readOnly=Lecture seule
+resultDeny=Refus de résultat
+directMembership=Appartenance direct
+kc.client.network.host=Hôte client
+noResourceCreateHint=Il n'y a aucune ressource. Par conséquent vous ne pouvez créer de permissions basées sur des ressources.
+addExecutionTitle=Ajouter une exécution
+associatedRolesText=Rôles associés
+clientIdHelp=L'identifiant client enregistré avec le fournisseur d'identité.
+eventTypes.INVALID_SIGNATURE_ERROR.name=Erreur signature invalide
+clientSecretSuccess=Secret du client regénéré
+oAuthDeviceCodeLifespan=Durée du code d'appareil OAuth 2.0
+ldapConnectionAndAuthorizationSettingsDescription=Cette section contient des options liées à la configuration de la connexion au serveur LDAP. Elle contient également des options liées à l'authentification de la connexion LDAP au serveur LDAP.
+clientSaveSuccess=Client mis à jour avec succès
+ecdsaGenerated=ecdsca-generated
+flow-type.basic-flow=Générique
+deletedSuccessRealmSetting=Le domaine a été supprimé
+webauthnPasswordlessPolicy=Politique WebAuthn sans mot de passe
+editUserLabel=Editer le bouton de l'étiquette utilisateur
+conditions=Conditions
+addUri=Ajouter URL
+minus=Moins
+groupsHelp=Groupes auxquels l'utilisateur appartient. Pour quitter un groupe cliquez le bouton en forme de croix.
+includeGroupsAndRoles=Inclure les groupes et les rôles
+groupsPermissionsHint=Détermine si les permission à granularité fine sont activées pour gérer ce rôle. Le désactiver supprimera toutes les permissions actuelles qui avait été configurées.
+searchForTranslation=Chercher la traduction
+offlineSessionMaxHelp=Temps maximum avant qu'une session hors ligne expire peu importe son activité.
+resourceSaveError=La ressource ne peut pas persister à cause de {{error}}
+updateCredentialUserLabelError=Erreur pendant le changement l'étiquette utilisateur : {{error}}
+enableHelpMode=Active le mode d'aide
+clientPoliciesTab=Onglet des politiques client
+ldapGroupsDn=LDAP groupes DN
+ldapFullNameAttributeHelp=Nom de l'attribut LDAP qui contiendra le nom de l'utilisateur. Généralement 'cn'.
+clientRegisterPolicyDeleteConfirm=Etes vous sûr de vouloir supprimer définitivement l'enregistrement de la politique client {{name}}
+jsonEditor=Editeur JSON
+mappingCreatedError=Impossible de créer le mapping : '{{error}}'
+deleteClientPolicyProfileConfirmTitle=Supprimer le profil ?
+envelopeFromHelp=Une adresse mail utilisée pour les rebonds (optionnel).
+policyDeletedError=Impossible de supprimer la ressource {{error}}
+key=Clé
+email=Mail
+groupDeleted_other=Groupes supprimés
+uploadFile=Uploader un fichier JSON
+loginActionTimeoutHelp=Temps maximal qu'a un utilisateur pour compléter les actions liées à la connexion comme mettre à jour un mot de passer ou configurer un totp. Il est recommandé de mettre une durée assez longue, comme 5 minutes ou plus.
+identityProviders=Fournisseurs d'identité
+importUsers=Importer les utilisateurs
+authenticationFlow=Flux d'authentification
+leaveGroup_other=Quitter les groupes ?
+deleteClientPolicySuccess=Politique client supprimée
+mapperTypeCertificateLdapMapper=certificate-ldap-mapper
+clientAuthentications.client_secret_basic=Secret envoyé comme une authentification basique
+started=Commencé
+filteredByClaimHelp=Si activé les jetons ID générés par le fournisseur d'identité doit avoir un attribut spécifique. Sinon l'utilisateur ne peut pas s'identifier via ce broker.
+mapperTypeCertificateLdapMapperHelp=Utilisé pour mapper un seul attribut qui contient un certificat d'utilisateur DLAP à un attribut du UserModel dans la base de donnée Keycloak
+userManagedAccessHelp=Si activé les utilisateurs sont autorisés à gérer leurs ressources et permissions en utilisant l'interface de gestion de compte.
+confirm=Confirmer
+addAttribute=Ajouter {{label}}
+clientScopeSearch.protocol=Protocole
+initialAccessTokenDetails=Détails du jeton d'accès initial
+noTranslations=Pas de traduction
+deleteProvider=Supprimer le fournisseur ?
+inputTypeSize=Entrer la taille
+createAttributeSubTitle=Créer un nouvel attribut
+emptyAuthorizationInstructions=Si vous créer des périmètres d'autorisation merci de cliquez sur le bouton ci dessous pour créer un périmètre d'autorisation
+updatePolicySuccess=Politique mise à jour avec succès
+eventTypes.CUSTOM_REQUIRED_ACTION.name=Action personnalisée requise
+updateExecutorError=Exécuteur non mis à jour : {{error}}
+clientIdHelpHelp=ID client du client duquel les mappings de rôle LDAP seront mappés. Applicable seulement si 'Utiliser les mappings de rôles de domaine' est désactivé.
+createdAt=Créé at
+moveGroupEmpty=Pas de sous groupes
+rolesHelp=Sélectionner les rôles que vous voulez associez avec l'utilisateur sélectionné.
+samlEntityDescriptor=Descripteur d'entité SAML
+passwordPolicyHintsEnabled=Indice de politique de mot de passe activé
+syncMode=Mode de synchronisation
+details=Détails
+privateRSAKeyHelp=Clé privée RSA encodée au format PEM
+onDragStart=Glissement commencé pour l'élèment
+pushedAuthorizationRequestRequired=Requête d'autorisation requise
+requirements.REQUIRED=Requis
+generate=Générer
+clientOfflineSessionMaxHelp=Durée maximale avant qu'une session client hors ligne expire. Si Durée Max Limité de Session Hors ligne est activé au niveau du domaine les jetons hors ligne sont invalidés quand une session client expire. L'option n'affecte session SSO de l'utilisateur global. Si vide la durée maximale de session hors ligne du domaine est utilisée.
+resetPasswordBtn=Réinitialiser le mot de passe
+editInfo=Editer les informations
+offlineSessionMaxLimited=Durée Max Limitée de Session Horsligne
+providerCreateSuccess=Nouvelle politique client créée avec succès
+disableSigning=Désactiver "{{key}}"
+searchScope=Chercher périmètre
+dateFrom=Date (depuis)
+importAdded_one=Un enregistrement ajouté.
+firstName=Prénom
+emptySecondaryAction=Configurer un nouveau mappeur
+defaultGroupAdded_one=Nouveau groupe ajouté aux groupes par défaut
+unexpectedError=Une erreur imprévue est apparue : '{{error}}'
+noRolesInstructions=Vous n'avez assigné aucun rôle à cet utilisateur. Assignez un rôle pour commencer.
+permissionName=Le nom de cette permission.
+preview=Prévisualisation
+eventTypes.UNREGISTER_NODE_ERROR.name=Erreur désenregistrement du nœud
+clientRegisterPolicyDeleteConfirmTitle=Supprimer la politique d'enregistrement de client ?
+groupDetails=Détails de groupe
+sessionsType.allSessions=Tous les types de session
+kid=Enfant
+sessionsType.serviceAccount=Compte de service
+clientSignatureHelp=Est ce que le client signera ces requêtes et réponses SAML ? Et doivent elles être validées ?
+principalTypeHelp=Moyen d'identifier et de traquer les utilisateurs externes depuis l'assertion. Par défaut on utilise le 'Subject NameID', sinon vous définir à attribut à identifier.
+client-scopes-condition.tooltip=La liste des périmètres client attendus. La condition est considérée comme vraie si la requête client spécifiée correspond à quelques périmètres client. Cela dépend aussi s'il s'agit d'un périmètre client ou optionnel, selon le 'Type périmètre' configuré.
+validateUuidLDAPAttribute=Vous devez entrer un attribut LDAP UUID
+rootURLHelp=URL racine ajoutée au URLs relative
+anonymousAccessPolicies=Politiques d'accès anonyme
+createResourceBasedPermission=Créer une permission de ressource
+searchForRole=Cherche le rôle
+debugHelp=Activer/Désactiver les logs de debug sur la sortie standard pour Krb5LoginModule.
+validatorColNames.colConfig=Configuration
+createClient=Créer un client
+inputTypeRows=Colonnes d'entrées
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Première connexion au fournisseur d'identité
+usedMemory=Mémoire utilisée
+bruteForceModeHelpText=Si activé spécifie ce qui doit arriver au compte utilisateur en cas de détection d'une attaque brute force.
+validatePasswordPolicyHelp=Détermine si Keycloak doit valider le mot de passe avec la politique de mot de passe du domaine avant de le mettre à jour. Quand le mot de passe utilisateur est sauvegardé dans le LDAP certaines politiques de mot de passe n fonctionne pas : Non utilisé récemment, Expiration de mot de passe, Itérations de hash et Algorithme de hachage car Keycloak n'a pas le contrôle direct du stockage de mot de passe. Si vous voulez utilisez ces politiques activez les au niveau du serveur LDAP.
+fullNameLdapReadOnlyHelp=Pour la lecture seule les données sont importées depuis le LDAP vers la base de données Keycloak mais ne sont pas sauvegardées dans le LDAP quand l'utilisateur est modifié sur Keycloak.
+createResourceSuccess=Ressource créée avec succès
+documentation=Documentation
+roleExplain=Les rôles du domaine sont les rôles que vous définissez comme à utiliser dans le domaine courant.
+whatIsDefaultGroups=Quelle est l'utilité des groupes par défaut ?
+generalSettings=Paramètres généraux
+addClientProfileError=Impossible de créer le profil client : '{{error}}'
+overallResults=Résultats globaux
+requiredUserActionsHelp=Requière une action quand l'utilisateur se connecte. 'Vérifier le mail' envoie un mail à l'utilisateur pour vérifier l'adresse mail de l'utilisateur. 'Mettre à jour le profil' demande à l'utilisateur d'entrer de nouvelles informations personnelles. 'Mettre à jour le mot de passe' demande à l'utilisateur d'entrer un nouveau mot de passe. 'Configurer l'OTP' demande à l'utilisateur de mettre en place un générateur de mot de passe sur téléphone.
+ldapKerberosSettingsDescription=Cette section contient des informations utiles pour l'intégration Kerberos. Ceci est utilisé seulement quand le serveur LDAP est utilisé avec l'authentification utilisateur Kerberos/SPNEGO.
+deleteEvents=Supprimer les évènements
+requestObjectSignatureAlgorithmHelp=Algorithme JWA que le client devra utiliser pendant l'envoi d'un objet requête OIDC spécifié par les paramètres 'request'ou 'request_uri'. Si mis à 'Tout', l'objet de la requête peut être signé par n'importe quel algorithme (y compris 'Aucun').
+clientSecretError=Impossible de regénérer le secret client à cause de : {{error}}
+resourcePath=Chemin de la ressource
+mapperTypeHardcodedAttributeMapperHelp=Ce mappeur va hardcoder n'importe quel attribut du modèle utilisateur et quelques propriétés (comme 'emailVerified' ou 'email') quand l'utilisateur est importé depuis le LDPA.
+useJwksUrlHelp=Si activé les clés publiques du fournisseur d'identité sont téléchargées depuis une URL JWKS donnée. Ceci offre une grande flexibilité car les nouvelles clés sont téléchargées de nouveau quand le fournisseur d'identité génère une nouvelle paire de clés. Si désactivé une clé publique (ou une certificat) est utilisé depuis la base de données Keycloak. Par conséquent quand une pair de clé du fournisseur d'identité change vous devez importer de nouveau la nouvelle clé dans la base de donnée Keycloak.
+generatedIdTokenHelp=Voir le jeton ID d'exemple, qui sera généré et envoyé au client quand l'utilisateur sélectionné sera authentifié. Vous pouvez voir les attributs et les rôles que le jeton contiendra en utilisant les mappeurs de protocole actifs et les mappings de périmètre de rôle, ceci montre également les attributs et les rôles assignés à l'utilisateur sélectionné.
+fullNameLdapWriteOnlyHelp=Pour l'écriture seule, les données sont propagées au LDAP quand un utilisateur est créé ou mis à jour sur Keycloak. Mais ce mappeur n'est pas utilisé pour propager en retour les données depuis le LDAP vers Keycloak. Ce paramètre est utile si vous avez configuré séparément les mappeurs d'attributs 'firstName' et 'lastName' et que vous voulez les utiliser pour lire l'attribut depuis le LDAP vers Keycloak.
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=Erreur de code utilisateur de vérification d'appareil OAuth2
+keysIntro=Si "Utiliser URL JWKS" est activé vous devez remplir une URL JWKS valide. Après avoir sauvegardé les administrateurs peuvent téléchargés les clés depuis l'URL JWKS ou les clés seront téléchargées automatiquement par le serveur Keycloak quand un KID inconnu est repéré pendant l'authentification client.
+frontchannelLogoutOIDCHelp=Si activé la déconnexion nécessite que le navigateur envoie la requête à l'URL configurée de déconnexion du canal principal du client comme spécifiée dans les spécifications de déconnexion du canal principal OIDC. Si désactivé le serveur peut faire une déconnexion en arrière plan tant que soit l'URL de déconnexion du canal secondaire est configurée soit l'URL administrateur est configurée.
+flowDescriptionHelp=Texte d'aide pour la description du nouveau flux
+requiredWhenTooltip=Quand des périmètres sont utilisés l'attribut est obligatoire quand au moins l'un des périmètres configurés est appliqué à la requête de connexion. A la fois des périmètres par défaut et optionnel de la requête actuelle sont évalués. Dans les contextes la console administrateur et la console compte, les périmètres ne sont pas évalués et l'attribut n'est pas nécessaire.
+uuidLdapAttributeHelp=Nom de l'attribut LDAP qui sera utilisé comme l'identifiant d'objet unique (UUID) pour les objets dans le LDAP. Pour la plupart des fournisseurs de serveur LDAP c'est 'entryUUID', toutefois certains n'ont pas le même UUID. Par exemple pour l'Active directory ce serait 'objectGUID'. Si votre serveur LDAP ne supporte pas le UUID vous pouvez utiliser n'importe quel autre attribut qui est censé être unique entre les utilisateurs LDAP. Par exemple 'uid' ou 'entryDN'.
+scopePermissions.clients.configure-description=Gestion des permissions réduites pour l'administrateur. Ne peut pas définir un périmètre, modèle ou mappeurs de protocol.
+mappedGroupAttributesHelp=Liste des noms d'attributs séparés par des virgules. Ceci pointe vers la liste des attributs du groupe LDAP qui seront mappés comme attributs du groupe dans Keycloak. Laisser vide si aucun attribut de groupe additionnel n'est nécessaire à mapper dans Keycloak.
+serverPrincipalHelp=Nom complet du serveur principal pour le service HTTP incluant le serveur et le nom de domaine. Par exemple, HTTP/host.foo.org@FOO.ORG
+forwardParametersHelp=Paramètres de requête non standard OpenID Connect/OAuth à transmettre l'IDP externe depuis la requête initiale de l'application vers le point de terminaison d'autorisation. Plusieurs paramètres peuvent être entrés séparés par une virgule (,).
+invalidateRotatedError=Impossible de supprimer la rotation du secret : {{error}}
+client-accesstype.tooltip=Type d'accès du client pour lequel la condition est appliquée. Un client confidentiel active l'authentification client alors qu'un client public désactive l'authentification client. 'Bearer-only' est un type client déprécié.
+useRefreshTokenForClientCredentialsGrantHelp=Si activé un jeton de rafraîchissement sera créé et ajouté à la réponse du jeton si les droits d'accès via identifiants client sont utilisés. Toutefois la OAuth 2.0 RFC6749 Section 4.4.3 précise qu'un jeton de rafraîchissement ne devrait pas être créé dans ce cas. Si désactivé alors aucun je ton de rafraîchissement ne sera généré et la session utilisateur associée sera supprimée.
+membershipAttributeTypeHelp=DN signifie que les membres du groupe LDAP sont déclarés dans la forme complète DN. Par exemple 'member: uid=john,ou=users,dc=example,dc=com'. UID signifie que les membres du groupe LDAP sont déclarés la forme uid pure, comme par exemple 'memberUid: john'.
+eventTypes.AUTHREQID_TO_TOKEN.description=Authreqid vers jeton
+policyProvider.aggregate=Réutiliser les politiques existants pour en construire des plus complexes et garder vos permissions encore plus découplées des politiques qui sont évaluées pendant le traitement des requêtes d'autorisation.
+client-updater-trusted-hosts.tooltip=Liste des hôtes de confiance. Dans le cas où la requête d'enregistrement/de mise à jour vient d'un hôte/domaine spécifiée dans cette configuration la condition s'évalue à vrai. Vous pouvez utiliser des nom de domaine ou des adresses IP. Si vous utilisez le joker '*' au début (par exemple '*.example.com') le domaine complet example.com est de confiance.
+acrToLoAMappingHelp=Définie quelle valeur d'ACR (Authentication Context Class Reference) est mappé à quel LoA (Level of Authentication). L'ACR peut être n'importe quelle valeur alors que le LoA doit être numérique.
+groupsResources=Groupes
+lastName=Nom
+orderDialogIntro=L'ordre dans lequel les fournisseurs sont listés sur la page de connexion ou l'interface Compte. Vous pouvez faire glisser les lignes pour changer l'ordre.
+noMappersInstructions=Il n'y actuellement aucun mappeur pour ce fournisseur d'identité.
+excludeIssuerFromAuthenticationResponseHelp=Si activé le paramètre 'iss' ne sera pas inclus dans la réponse d'authentification OpenID Connect. Utile si le client utilise un ancien adaptateur OIDC/ OAuth2 qui ne supporte pas le paramètre 'iss'.
+usersResources=Utilisateurs
+selectALocale=Sélectionner une langue
+userCredentialsHelpText=Le glisser déposer vous permet de changer la priorité des identifiants pour l'utilisateur, les identifiants le plus en haut ayant la plus haute priorité.
+credentials=Identifiants
+client-updater-source-groups.label=Groupes
+unlockAllUsers=Débloquer tous les utilisateurs
+learnMore=En savoir plus
+passwordDataTitle=Données de mot de passe
+titleUsers=Utilisateurs
+usersExplain=Utilisateurs du domaine actuel.
+addUser=Ajouter un utilisateur
+internationalization=Internationalisation
+emptyClientProfiles=Pas de profils
+memberofLdapAttributeHelp=Utilisé quand 'Stratégie de récupération des rôles utilisateurs' est GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE. Spécifie le nom de l'attribut LDAP qui contient les groupes auxquels appartient l'utilisateur. Généralement ce sera la valeur par défaut 'memberOf'.
+otpPolicyDigits=Nombre de chiffres
+keysFilter.ACTIVE=Clés actives
+rsaGenerated=rsa-generated
+clientRegisterPolicyDeleteSuccess=Politique d'enregistrement par défaut supprimée avec succès
+client-roles-condition.tooltip=Rôles clients qui seront vérifiés pendant l'évaluation de cette condition. La condition s'évalue à vrai si le client à au moins un rôle client avec le nom spécifié dans la configuration des rôles client.
+krbPrincipalAttributeHelp=Nom de l'attribut LDAP qui réfère au principal Kerberos. Utilisé par cherché l'utilisateur LDAP approprié après une authentification Kerberos/SPNEGO réussie à Keycloak. Si vide l'utilisateur LDAP sera cherché un utilisant le nom d'utilisateur LDAP correspondant à son principal Kerberos. Par exemple pour le principal 'john@KEYCLOAK.ORG', il sera supposé que le nom d'utilisateur LDAP est 'john'.
+impersonateError=Impossible d'usurper l'utilisateur : {{error}}
+keyLabel=Clé
+syncChangedUsers=Synchroniser les utilisateurs modifiés
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=Erreur de réponse du fournisseur d'identité
+clientSessionIdle=Temps d'inactivité d'une session client
+targetClaimHelp=Spécifie l'attribut ciblé que la politique va récupérer.
+periodicFullSyncHelp=Si la synchronisation périodique des utilisateurs LDAP vers Keycloak doit être activée ou non
+client-attributes-condition.tooltip=Attributs client qui seront vérifiés pendant l'évaluation de cette condition. La condition est évaluée à vrai si le client a tous les attributs client avec le nom et la valeur des attributs client comme spécifié dans la configuration.
+scopePermissions.users.user-impersonated-description=Politiques qui décident quels utilisateurs peuvent être usurpés. Ces politiques sont appliqués à l'utilisateurs usurpés.
+forceNameIdFormat=Forcer le format du nom ID
+deleteConfirmFlow=Supprimer le flux ?
+addRole=Ajouter le rôle
+FAIL=Import échoué
+userInfoSignedResponseAlgorithmHelp=Algorithme JWA utilisé signé la réponse du point de terminaison des informations utilisateur. Si mis à 'unsigned' la réponse ne sera pas signée et sera retournée dans le format de l'application/json.
+isAccessTokenJWT=Jeton d'accès est JWT
+deleteConfirmDialog_one=Etes vous sûr de vouloir supprimer définitivement {{count}} utilisateur(s) sélectionné(s)
+eventTypes.AUTHREQID_TO_TOKEN.name=Authreqid vers jeton
+createError=Impossible de créer le fournisseur d'identité : {{error}}
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=Erreur Authreqid vers jeton
+deletePermissionConfirm=Etes vous sûr vouloir supprimer définitivement la permission {{permission}} ?
+TERMS_AND_CONDITIONS=Termes et conditions (TERMS_AND_CONDITIONS)
+artifactResolutionServiceHelp=Service de résolution d'artefact SAML pour le client. Ceci est le point de terminaison auquel Keycloak enverra un message SOAP ArtifactResolve. Vous pouvez laisser vide si vous pas d'URL pour cette association.
+userRoleMappingUpdatedSuccess=Mapping de rôle utilisateur mis à jour avec succès
+clientUpdaterTrustedHosts=Hôtes de confiance
+deleteSuccess=Groupe d'attributs supprimé.
+attributesDropdown=Menu déroulant d'attributs
+ssoServiceUrlHelp=L'URL qui doit être utilisée pour l'envoi des requêtes d'authentification (SAML AuthnRequest).
+artifactResolutionServiceUrlHelp=L'URL qui doit être utilisée pour avoir des assertions SAML depuis les artefacts (SAML ArtifactResolve).
+copy=Copier
+credentialData=Données
+clientRolesConditionTooltip=Rôles client qui seront vérifiés pendant l'évaluation de cette condition. La condition est évaluée à vrai si le client à au moins un rôle client avec un nom similaire aux rôles spécifiés dans la configuration.
+searchType.default=Recherche par défaut
+groups=Groupes
+data=Données
+user-events-cleared=Les évènements utilisateurs ont été supprimés
+selectRealm=Sélectionner un domaine
+roleNameLdapAttribute=Nom de l'attribut LDAP pour le rôle
+javaKeystore=java-keystore
+resetPasswordConfirm=Réinitialiser le mot de passe ?
+emailAsUsernameHelpText=Autorise les utilisateurs à mettre le mail comme nom d'utilisateur.
+AESKeySize=Taille de clé AES
+fullName={{givenName}} {{familyName}}
+deleteConfirm=Etes vous sûr de vouloir supprimer de manière définitive le fournisseur '{{provider}}' ?
+compositesRemovedAlertDescription=Tous les rôles associés ont été supprimés
+aliasHelp=L'alias identifie de manière unique un fournisseur d'identité et est aussi utilisé pour construire l'URL de redirection.
+deleteProviderMapper=Supprimer le mappeur ?
+clientsPermissionsHint=Permissions à granularité fine pour les administrateurs qui veulent gérer ce client ou appliquer les rôles définis par ce client.
+updatedUserProfileSuccess=La configuration du profil utilisateur a été sauvegardé
+usersLeft_one={{count}} utilisateur(s) restant(s) dans ce groupe
+sync-keycloak-groups-to-ldap=Synchroniser les groupes Keycloak vers le LDAP
+saveError=Le fournisseur de regroupement d'utilisateur n'a pas pu être sauvegardé : {{error}}
+loginTimeoutHelp=Durée maximum que l'utilisateur a pour se connecter. Il est recommandé de mettre une durée assez longue, comme 30 minutes ou plus.
+searchGroups=Chercher les groupes
+trusted-hosts.tooltip=Liste des hôtes de confiance qui sont autorisés à invoquer le service d'enregistrement de client et/ou utilisés comme valeurs des les URLs client. Vous pouvez utiliser des noms de domaine ou des adresses IP. Si vous utilisez le jeton "*" au début (par exemple '*.example.com') le domaine entier sera considéré de confiance.
+disableTypeClaimCheckHelp=Désactive la validation de l'attribut `typ` des jetons reçus depuis le fournisseur d'identité. Si rempli à `off` l'attribut type est validé (par défaut).
+deleteClientProfile=Supprimer ce profil client
+none=Aucun
+type=Type
+createNewUser=Créer un nouvel utilisateur
+createResource=Créer une ressource
+createNewMapper=Créer un nouveau mappeur
+mapperTypeMsadUserAccountControlManager=msad-user-account-control-mapper
+deleteNodeFail=Impossible de supprimer le nœud : '{{error}}'
+eventTypes.TOKEN_EXCHANGE_ERROR.description=Erreur d'échange de jeton
+authenticationExplain=L'authentification est l'endroit que où vous pouvez configurer et gérer les différents types d'identifiants.
+dropNonexistingGroupsDuringSync=Supprimer les groupes non existants pendant la synchronisation
+jwtX509HeadersEnabledHelp=Si activé l'entête x5t (X.509 Certificate SHA-1 Thumbprint) sera ajouté au JWT pour référencer le certificat utilisé pour le signer. Sinon l'entête kid (Key ID) sera utilisé à la place.
+addProvider_other=Ajouter les fournisseurs {{provider}}
+resetAction=Remettre à zéro les actions
+cibaExpiresIn=Expire dans
+dynamicScopeFormatHelp=Ceci est l'expression régulière que le système utilisera pour extraire la nom du périmètre et la variable.
+updateTranslationError=Erreur pendant la mise à jour de la traduction : {{error}}
+resetPasswordConfirmText=Etes vous sûr de vouloir remettre à zéro le mot de passe pour l'utilisateur {{username}} ?
+create=Créer
+noAvailableIdentityProviders=Pas de fournisseurs d'identité disponibles.
+passSubjectHelp=Pendant la phase de connexion transmets un paramètre optionnel de requête login_hint au sujet SAML AuthnRequest.
+resource=Ressource
+emptyConditions=Pas de conditions configurées
+profiles=Profils
+userSession.modelNote.tooltip=Nom de la note de session utilisateur stockée dans la map UserSessionModel.note.
+filterByRoles=Filtrer par rôles de domaine
+maxLifespan=Durée de vie maximale
+eventTypes.VERIFY_PROFILE_ERROR.description=Erreur vérification de profil
+webOriginsHelp=Les origines CORS autorisées. Pour toutes les origines des URLs de redirection valides ajoutez '+'. Ceci n'inclue toutefois pas le jeton '*'. Pour autoriser explicitement toutes les origines ajoutez '*'.
+noSessionsForClient=Il n'y a actuellement pas de sessions active pour ce client.
+profilesConfigType=Configurer via :
+enableHelp=L'aide est activé
+xRobotsTagHelp=Empêche les pages d'apparaître dans les moteurs de recherche. <1>Learn more</1>
+client-updater-source-roles.label=Mise à jour du rôle d'entité
+clientRegisterPolicyDeleteError=Impossible de supprimer la politique d'enregistrement client : '{{error}}'
+resourceFile=Fichier de ressource
+admin-clearEventsHelp=Supprime tous les évènements administrateurs de la base de données.
+hardcodedRole=Quand un utilisateur est importé depuis un fournisseur, hardcode un mapping de rôle pour lui.
+idpUnlinkSuccess=Le lien du fournisseur a été supprimé
+providerType=Type de fournisseur
+clientSessionIdleHelp=Durée d'inactivité d'une session client avant qu'elle expire. Les jetons sont invalidés quand une session client expire. L'option n'affecte pas ma session globale utilisateur SSO. Si non rempli la durée d'inactivité de session SSO standard est utilisée.
+keysFilter.DISABLED=Clés désactivées
+link=Associer
+defaultGroupAddedError=Erreur pendant l'ajout du/des groupe(s) au groupe par défaut {error}
+eventTypes.INVALID_SIGNATURE_ERROR.description=Erreur signature invalide
+scopesSelect=Spécifié que cette permission doit être appliquée à un ou plusieurs périmètres.
+selectMethodType.generate=Générer
+emailInvalid=Vous devez entrer un mail valide.
+chooseAPolicyProvider=Choisissez un fournisseur de politique
+createUser=Créer un utilisateur
+executorName=Nom
+unAssignRole=Enlever
+name=Nom
+userLabel=Etiquette de l'utilisateur
+assignRole=Assigner des rôles
+unAssignPolicy=Enlever
+authorizationScopeDetailsName=Nom
+createGroup=Créer un groupe
+searchForGroups=Chercher un groupe
+groupsDescription=Un groupe est un ensemble d'attributs et de mappings de rôle qui peuvent être appliqués à un utilisateur. Vous pouvez créer, éditer et supprimer des groupes et gérer leur organisation parent-enfant.
+searchGroup=Chercher un groupe
+exactSearch=Recherche exacte
+transientUserTooltip=Cet utilisateur n'est pas stocké dans la base de données Keycloak. Il est construit uniquement à partir des données fournies par le fournisseur d'identité d'origine.
+emptyEffectiveMessageBundlesInstructions=Vous pouvez chercher pour les messages effectifs que vous voulez par thème, fonctionnalité et langue dans la zone de recherche ci dessus.
+error-invalid-length-too-short='{{0}}' doit avoir une taille maximale de {{1}}.
+selectClients=Sélectionner les clients
+authenticatorRefConfig.value.help=Ajoute un nom de référence personnalisé pour l'authentificateur. Quand cette authentificateur est configuré avec succès via un processus d'authentification, le mappeur de protocole Authentication Method Reference (AMR) utilisera cette valeur pour peupler l'attribut AMR des jetons générés. A noter que le protocole AMR doit être configuré pour le client concerné pour peupler l'attribut AMR.
+loa-max-age.tooltip=Durée maximale de validité en secondes pour ce niveau d'authentification. Si le niveau particulier est demandé et l'utilisateur est déjà authentifié avec ce niveau plus tôt que le temps spécifié en secondes il ne lui sera pas demandé de réauthentifié. Mais s'il s'authentifie plus tard que le temps spécifié en secondes il devra se réauthentifié avec ce niveau de nouveau. Une valeur à 0 dans la configuration signifie que l'utilisateur doit toujours se réauthentifié avec ce niveau peu importe le temps depuis la dernière authentification.
+welcome=Bienvenue sur
+introduction=Si vous voulez quitter cette page et gérer ce domaine, merci de cliquer sur les éléments correspondants dans le menu de navigation à gauche.
+savePassword=Sauvegarder le mot de passe
+realmInfo=Informations du domaine
+signOut=Se déconnecter
+helpToggleInfo=Active / désactive une partie des informations d'aide sur l'interface. Inclus n'importe quel texte d'aide, liens et pop ups.
+manageAccount=Gérer le compte
+flow.clients=Flux d'authentification client
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=Erreur de première connexion au fournisseur d'identité
+emptyStateText=Il n'y a aucun rôles dans ce domaine. Créer un rôle de domaine pour commencer.
+includeSubGroups=Inclure les utilisateurs du sous-groupe
+permanentLockoutHelp=Configurer si un utilisateur est bloqué temporairement ou définitivement après trop de connexions échouées. Le blocage définitif peut être configuré pour arriver après un certain nombre de connexions échouées ou après un certain nombre de blocages temporaires.
+logicType.positive=Positif
+associatedPolicy=Politique associée
+emptyExecutors=Pas d'exécuteurs configurés
+selectARole=Sélectionner un rôle
+category=Catégorie
+startBySearchingAUser=Commencer par chercher des utilisateurs
+error-empty=Merci de spécifier la valeur de '{{0}}'.
+error-invalid-blank=Merci de spécifier la valeur de '{{0}}'.
+error-invalid-date='{{0}}' est une date invalide.
+error-invalid-email=Adresse mail invalide.
+error-invalid-length-too-long='{{0}}' doit avoir une taille maximale de {{2}}.
+error-invalid-length='{{0}}' doit avoir une taille entre {{1}} et {{2}}.
+error-invalid-number='{{0}}' est un nombre invalide.
+error-invalid-uri-fragment='{{0}}' est fragment d'URL invalide.
+error-invalid-uri-scheme='{{0}}' a un schéma d'URL invalide.
+error-invalid-uri='{{0}}' est une URL invalide.
+error-invalid-value='{{0}}' a une valeur invalide.
+error-number-out-of-range-too-big='{{0}}' doit avoir une valeur maximale de {{2}}.
+error-number-out-of-range-too-small='{{0}}' doit avoir une valeur maximale de {{1}}.
+error-number-out-of-range='{{0}}' doit avoir être un nombre entre {{1}} et {{2}}.
+error-pattern-no-match='{{0}}' ne correspond pas au format requis.
+error-person-name-invalid-character='{{0}}' contient des caractères invalides.
+error-user-attribute-required=Merci de spécifier '{{0}}'.
+error-username-invalid-character='{{0}}' contient des caractères invalides.
+error-user-attribute-read-only=Le champ '{{0}}' est en lecture seule.
+missingUsernameMessage='{{0}}' : Merci de spécifier un nom d'utilisateur.
+missingFirstNameMessage='{{0}}' : Merci de spécifier un prénom.
+invalidEmailMessage='{{0}}' : Adresse mail invalide.
+missingLastNameMessage='{{0}}' : Merci de spécifier un nom.
+missingEmailMessage='{{0}}' : Merci de spécifier un mail.
+missingPasswordMessage='{{0}}' : Merci de spécifier un mot de passe.
+updateReadOnlyAttributesRejectedMessage=Mise à jour de l'attribut en lecture seule refusée
+locales=Langues
+realmOverrides=Surcharges du domaine
+realmOverridesHelp=Vous pouvez éditer seulement les langues supportées. Si vous n'avez pas sélectionné de langues supportées vous pouvez éditer seulement la langue anglaise.
+effectiveMessageBundles=Lot de message effectif
+effectiveMessageBundlesHelp=Vous pouvez chercher un lot de message effectif depuis un thème, une fonctionnalité, une langue et un texte libre.
+deleteMessageBundle=Supprimer le lot de message {{key}}
+deleteAllTranslationsSuccess=Traduction(s) supprimée(s) avec succès.
+deleteAllTranslationsError=Erreur pendant la suppression du/des traduction(s), {{error}}
+noRealmOverridesSearchResultsInstructions=Cliquer sur la barre de recherche ci dessous pour chercher les surcharges du domaine
+emptyEffectiveMessageBundles=Chercher des messages effectifs
+searchForEffectiveMessageBundles=Chercher un lot de message
+selectAll=Sélectionner tout
+theme=Thème
+themeType=Type de thème
+language=Langue
+hasWords=Contient les mots
+deleteConfirmTranslationTitle=Supprimer la/les traduction(s) ?
+translationDeleteConfirmDialog=Etes vous sûr de vouloir supprimer définitivement {{count}} traduction(s) sélectionnée(s) ?
+selectTheme=Sélectionner un thème
+selectThemeType=Sélectionner un type de thème
+selectLanguage=Sélectionner une langue
+referralHelp=Spécifie si les références doivent être suivies ou ignorées. Merci de noter qu'activer les références peut ralentir l'authentification car cela autorise le serveur LDAP à décider quels autres serveurs LDAP à utiliser. Ceci peut potentiellement inclure des serveurs non de confiance.
+referral=Références
+authenticatorRefConfig.maxAge.label=Durée maximale de référence authentificateur
+loa-condition-level=Level of Authentication (LoA)
+authenticatorRefConfig.value.label=Référence authentificateur
+authenticatorRefConfig.maxAge.help=La durée maximale en secondes qu'une référence d'authentificateur est valide pour une session SSO. Quand le mappeur de protocole Authentication Method Reference (AMR) est utilisé l'AMR sera seulement considérée valide et peuplera le jeton si l'exécution de l'authentificateur est terminée dans la durée spécifiée.
+loa-condition-level.tooltip=Niveau d'authentification. Cette valeur doit toujours être un entier supérieur ou égal à 0. Les sous flux du flux d'authentification doivent toujours être ordonnés des plus petits niveaux au plus grands.
+loa-max-age=Durée maximale
+includeInLightweight.label=Ajouter au jeton d'accès allégé
+includeInLightweight.tooltip=L'attribut doit il être ajouté au jeton d'accès allégé ?
+lightweightAccessToken=Toujours utiliser le jeton d'accès allégé
+lightweightAccessTokenHelp=Si activé les jetons d'accès allégés sont toujours utilisés. Sinon ils ne sont pas utilisés par défaut mais c'est toujours possible de les activer avec l'exécuteur de la politique client.
+supportJwtClaimInIntrospectionResponse=Supporte l'attribut JWT dans la réponse d'introspection
+supportJwtClaimInIntrospectionResponseHelp=Si activé les requêtes d'introspection utilisant l'entête 'Accept: application/jwt' contiendront également un attribut nommé "jwt" dans les attributs du résultat d'introspection encodé en jeton d'accès JWT.
+welcomeTabTitle=Bienvenue
+welcomeText=Keycloak fournie le regroupement d'utilisateur, une authentification forte, la gestion des utilisateurs, l'autorisation à granularité fine et bien plus. Ajouter l'authentification et l'autorisation et sécuriser des services avec un minimum d'effort. Pas besoin de stocker les utilisateurs ou d'authentifier les utilisateurs.
+welcomeTo=Bienvenue sur {{realmDisplayInfo}}
+customValue=Valeur personnalisée
+realmOverridesDescription=Les surcharges de domaine vous permette de spécifier les traductions qui prendra effet pour le domaine entier. Ces traductions surchargeront n'importe quelle traduction spécifiée par un thème.
+addTranslation=Ajouter une traduction
+viewDocumentation=Réfère à la documentation
+viewGuides=Voir les guides
+joinCommunity=Rejoindre la communauté
+readBlog=Lire le blog
+effectiveMessageBundlesDescription=Un lot de message effectif est un ensemble de traduction pour une langue, thème et type de thèmes donnés. Cela prend en compte également les surcharges de domaine qui seront prioritaires.
+clientsClientScopesHelp=Les périmètres associés avec cette ressource.
+searchItem=Chercher un élément
+createItem=Créer un élément
+itemDelete=Supprimer l'élément
+itemDeleteConfirm=Etes vous sûr de vouloir supprimer définitivement l'élément ?
+itemDeleteConfirmTitle=Supprimer l'élément ?
+itemDeletedSuccess=L'élément a été supprimé
+itemDeleteError=Impossible de supprimer l'élément : {{error}}
+noItems=Il n'y a pas d'éléments
+noItemsInstructions=Vous n'avez créé aucun élément dans ce domaine. Créez un élément pour commencer.
+itemSaveError=Erreur impossible de sauvegarder l'élément ! {{error}}
+itemSaveSuccessful=Sauvegardé avec succès
+realmSelector=Sélecteur de domaine
+editTranslationValue=Editer la valeur de traduction
+selectAccessTokenSignatureAlgorithm=Sélectionner l'algorithme de signature du jeton d'accès
+selectIdTokenSignatureAlgorithm=Sélectionner l'algorithme de signature du jeton ID
+selectIdTokenEncryptionKeyManagementAlgorithm=Sélectionner l'algorithme de chiffrage de clé du jeton ID
+selectIdTokenEncryptionContentEncryptionAlgorithm=Sélectionner l'algorithme de chiffrage du contenu du jeton ID
+selectUserInfoSignedResponseAlgorithm=Sélectionner l'algorithme de signature de la réponse des informations utilisateurs
+selectUserInfoResponseEncryptionKeyManagementAlgorithm=Sélectionner l'algorithme de gestion des clés de chiffrement pour la réponse des informations utilisateurs
+selectRequestObjectSignatureAlgorithm=Sélectionner l'algorithme de signature d'objet de requête
+selectRequestObjectEncryption=Sélectionner le chiffrage d'objet de requête
+selectRequestObjectEncoding=Sélectionner l'encodage d'objet de requête
+selectAuthorizationSignedResponseAlgorithm=Sélectionner l'algorithme de signature de réponse d'autorisation
+selectAuthorizationEncryptedResponseAlg=Sélectionner l'algorithme de réponse chiffrée d'autorisation
+selectAuthorizationEncryptedResponseEnc=Sélectionner l'encodage de réponse chiffrée d'autorisation
+selectAuthScopes=Sélectionner les périmètres d'autorisation
+selectResource=Sélectionner la ressource
+selectLoginTheme=Sélectionner le thème de connexion
+selectAccountTheme=Sélectionner le thème du compte
+selectAdminTheme=Sélectionner le thème administrateur
+selectEmailTheme=Sélectionner le thème mail
+selectFilterType=Sélectionner le type de filtre
+selectUnmanagedAttributePolicy=Sélectionner la politique d'attribut non géré
+selectEventsListeners=Sélectionner les écouteurs d'évènements
+selectCachePolicy=Sélectionner la politique de cache
+selectEvictionDay=Sélectionner le jour d'expulsion
+selectEvictionHour=Sélectionner l'heure d'expulsion
+selectEvictionMinute=Sélectionner la minute d'expulsion
+selectEditMode=Sélectionner le mode d'édition
+emptySelection=Vider la sélection
+readOnlySelection=Sélection en lecture seule
+writableSelection=Sélection en lecture
+unsyncedSelection=Sélection non synchronisée
+selectMapperType=Sélectionner un type de mappeur
+editBtn=Button d'édition
+acceptBtn=Bouton accepter l'édition
+cancelBtn=Bouton annuler l'édition
+chooseBindingType=Choisissez un type d'association
+selectFlowType=Sélectionner un type de flux
+selectClientAssertionSigningAlg=Sélectionner un algorithme de signature de l'assertion client
+resourceDetailsTypeHelp=Le type de la ressource. Peut être utilisé pour grouper des instances de ressource différence avec le même type.
+selectVendor=Sélectionner un fournisseur
+spinnerLoading=Chargement
+enableClientSignatureRequiredModal=Activation de la signature client requise
+selectBindType=Sélectionner le type d'association
+searchClientAuthorizationResource=Chercher une ressource
+searchClientAuthorizationPolicy=Chercher une politique
+searchClientAuthorizationPermission=Chercher une permission
+userNotSaved=L'utilisateur n'a pas été sauvegardé : {{error}}
+kcNumberFormat=Format du nombre
+kcNumberUnFormat=UnFormat du nombre
+tokenExpirationHelp=Saisie l'expiration pour les jetons. Les jetons expirés sont périodiquement effacés de la base de données.
+bruteForceMode.Disabled=Désactivés
+bruteForceMode.PermanentLockout=Bloqué définitivement
+bruteForceMode.TemporaryLockout=Bloqué temporairement
+bruteForceMode.PermanentAfterTemporaryLockout=Bloqué définitivement après un blocage temporaire
+bruteForceMode=Mode de brute force
+error-invalid-multivalued-size=Attribut {{0}} doit avoir au moins {{1}} et au plus {{2}} valeur(s).
+multivalued=Multiples valeurs
+multivaluedHelp=Si cet attribut supporte les valeurs multiples. Ce paramètre est un indication et n'active aucune validation.
+sendIdTokenOnLogout=Envoyer 'id_token_hint' dans les requêtes de déconnexion
+sendIdTokenOnLogoutHelp=Si le paramètre 'id_token_hint' doit être envoyé dans les requêtes de déconnexion.
+sendClientIdOnLogout=Envoyer 'client_id' dans les requêtes de déconnexion
+sendClientIdOnLogoutHelp=Si le paramètre 'client_id' doit être envoyé dans les requêtes de déconnexion.
+addAttributeTranslationBtn=Ajouter le bouton de traduction
+addAttributeTranslationInfo=Ajouter les traductions pour ce champ en utilisant l'icône à côté du champ "{{fieldName}}".
+addAttributeTranslation=Ajouter une traduction for le champ "{{fieldName}}"
+addAttributeDisplayDescriptionTranslation=Ajouter une traduction for la description affichée
+addTranslationsModalTitle=Ajouter des traductions
+translationKey=Clé
+translationsTableHeading=Traductions
+searchForLanguage=Chercher une langue
+supportedLanguagesTableColumnName=Langues supportées
+translationTableColumnName=Traduction
+defaultLanguage=Défaut
+translationValue=Valeur de traduction
+noLanguages=Pas de langue
+noLanguagesInstructions=Ajouter une langue dans Configuration du domaine > Localisation > Langues pour commencer.
+addTranslationDialogHelperText=La traduction basée sur la langue par défaut est obligatoire.
+noLanguagesSearchResultsInstructions=Cliquer sur la barre de recherche ci dessus pour chercher des langues
+addTranslationDialogOkBtn=Ok
+translationError=Merci d'ajouter des traductions avant de sauvegarder : {{error}}
+emptyAdminEvents=Pas d'évènements administrateurs
+emptyAdminEventsInstructions=Il n'y a pas d'évènements administrateurs dans ce domaine.
+emptyUserEvents=Pas d'évènements utilisateurs
+emptyUserEventsInstructions=Il n'y a pas d'évènements utilisateurs dans ce domaine.
+smtpFromPlaceholder=Adresse mail de l'expéditeur
+smtpFromDisplayPlaceholder=Afficher le nom pour l'adresse mail de l'expéditeur
+replyToEmailPlaceholder=Réponde au adresse mail
+uploadGeneratedThemeJar=Uploader le JAR généré du thème
+authorizationScope.Clients.configure=Effectue la gestion basique d'un client
+authorizationScope.Clients.manage=Gère complément un client
+authorizationScope.Users.impersonate=Usurpe d'autres utilisateurs
+authorizationScope.Users.manage=Gère tous les utilisateurs du domaine
+authorizationScope.Users.manage-group-membership=Gère l'appartenance au groupe pour tous les utilisateurs de ce domaine (utilisé en conjonction avec un politique de groupe)
+authorizationScope.Users.view=Voit tous les utilisateurs de ce domaine
+authorizationScope.Groups.manage=Gère ce groupe
+authorizationScope.Groups.manage-members=Gère les membre de groupe
+authorizationScope.Groups.manage-membership=Ajoute ou supprime des membres de groupe
+authorizationScope.Groups.view=Voit ce groupe
+authorizationScope.Groups.view-members=Voit les membre de groupe
+authorizationScope.IdentityProviders.token-exchange=Autorise les clients à échanger les jetons pour des jetons générés par ce fournisseur d'identité
+authorizationScope.Roles.map-role-client-scope=Applique ce rôle au périmètre client d'un client
+authorizationScope.Roles.map-role-composite=Applique ce rôle comme un composé d'un autre groupe
+authorizationScope.Roles.map-role=Map ce rôle à un utilisateur d'un autre groupe
+clientsResources=Clients
+resourceTypeHelpText=Spécifie quels {{resourceType}} sont autorisés par cette permission. Laissé ce champ vide revient à les sélectionner tous.
+evaluation=Evaluation
+noPermissionsEvaluationResultsInstructions=Merci de configurer l'évaluation de la permission sur la gauche
+authScope=Périmètre d'autorisation
+authScopeSelectHelp=Sélectionner un périmètre d'autorisation qui sera utilisé pour requêter les permissions depuis le serveur.
+resourceTypeSelectHelp=Sélectionner un type de ressource qui sera utilisé pour requêter les permissions depuis le serveur.
+authTokenScope=Périmètre Auth jeton
+fileNameDialogTitle=Sauvegardé comme
+fileName=Nom de fichier
+adminPermissionsEnabledHelp=Si activé autorise les permissions administrateur du domaine.
+domains=Domaines
+organizationDomainHelp=Un ensemble d'un ou plusieurs domaines internet associés avec cette organisation. Le domaine est utilisé pour mapper les utilisateurs depuis le domaine de leur mail et pour les authentifier selon le périmètre de l'organisation.
+redirectUrl=URL de redirection
+disableConfirmOrganizationTitle=Désactiver l'organisation ?
+disableConfirmOrganization=Etes vous sûr de vouloir désactiver l'organisation ?
+searchMember=Chercher un membre
+organizationUsersAddedError=Impossible d'ajouter les utilisateurs à l'organisation : {{error}}
+organizationUsersLeft_other={{count}} utilisateur(s) restant(s) dans l'organisation
+inviteSent=L'invitation a été envoyée.
+inviteSentError=Impossible d'envoyer l'invitation : {{error}}
+noIdentityProvider=Pas de fournisseur d'identité dans ce domaine
+linkIdentityProvider=Associer un fournisseur d'identité
+removeConfirmOrganizationTitle=Supprimer l'organisation ?
+organizationRemoveConfirm_other=Etes vous sûr de vouloir supprimer l'utilisateur des {{count}} organisation(s) sélectionnée(s) ?
+organizationRemovedSuccess=Utilisateur supprimé des organisations
+organizationRemoveError=Impossible de supprimer l'utilisateur des organisations : {{error}}
+organizationName=Nom de l'organisation
+userAddedOrganization_one=Organisation ajoutée à l'utilisateur
+userAddedOrganizationError=Impossible d'ajouter les organisations à l'utilisateur : {{error}}
+addOrganizationAttributes.label=Ajouter les attributs d'organisation
+addOrganizationAttributes.help=Si activé les attributs d'organisation seront disponibles pour chaque organisation mappée au jeton.
+addOrganizationId.label=Ajouter l'identifiant de l'organisation
+addOrganizationId.help=Si activé l'identifiant de l'organisation sera disponible pour chaque organisation mappée au jeton.
+verifiableCredentialsEnabled=Identifiants vérifiables
+verifiableCredentialsEnabledHelp=Si activé autorise la gestion des identifiant vérifiables dans ce domaine.
+caseSensitiveOriginalUsernameHelp=Si activé le nom d'utilisateur original du fournisseur d'identité est gardé tel quel quand les utilisateurs sont regroupés. Sinon le nom d'utilisateur depuis le fournisseur est mis en minuscule et pourrait ne pas correspondre à sa valeur origine si elle est sensible à la casse. Ce paramètre affecte seulement le nom d'utilisateur associé avec l'identité regroupée car les noms d'utilisateurs sur le serveur sur toujours en minusucule.
+organizationDelete=Supprimer l'organisation ?
+domain=Domaine
+organizationUsersLeftError=Impossible des supprimer des utilisateurs de l'organisation : {{error}}
+organizationUsersLeft_one=Utilisateur(s) restant(s) dans l'organisation
+emptyIdentityProviderLinkInstructions=Il n'y a pas encore de fournisseur d'identité dans cette organisation. Merci de lier un fournisseur d'identité avec cette organisation.
+linkSuccessful=Fournisseur d'identité lié à cette organisation avec succès
+linkUpdateError=Impossible de mettre à jour le lien du fournisseur d'identité : {{error}}
+noResultsFound=Pas de résultat trouvé
+linkedOrganization=Organisation liée
+organization=Organisation
+send=Envoyer
+redirectWhenEmailMatches=Rediriger quand le domaine de mail correspond
+syncUsersStarted=La synchronisation utilisateur a commencé.
+eventTypes.INVITE_ORG.description=Inviter l'utilisateur à l'organisation
+eventTypes.INVITE_ORG_ERROR.name=Erreur d'invitation de l'utilisateur à l'enregistrement
+organizationsEnabled=Organisations
+adminPermissionsEnabled=Permissions administrateur
+organizations=Organisations
+organizationDetails=Détails de l'organisation
+organizationsList=Organisations
+caseSensitiveOriginalUsername=Nom d'utilisateur sensible à la casse
+organizationsExplain=Gérer vos organisations et membres.
+emptyOrganizations=Pas d'organisations
+emptyOrganizationsInstructions=Il n'y a pas d'organisation actuellement. Merci de créer une organisation et de la gérer.
+searchOrganization=Chercher une organisation
+organizationDeleteConfirm=Etes vous sûr de vouloir supprimer définitivement cette organisation ? Dans ce cas toutes les données de cette organisation seront supprimées.
+organizationDeletedSuccess=L'organisation a été supprimée
+orgainzatinoDeleteError=Impossible de supprimer le client : {{error}}
+createOrganization=Créer une organisation
+organizationAliasHelp=L'alias identifie de manière unique une organisation en utilisant un format qui principalement ciblé pour référence l'organisation en interne. Par exemple lors de la génération d'attributs liés à l'organisation dans les jetons ou dans un thème personnalisé.
+organizationRedirectUrlHelp=Redirige automatiquement l'utilisateur après avoir terminé un enregistrement ou accepté une invitation à l'organisation. Si laissé vide l'utilisateur sera redirigé vers la console Compte par défaut.
+addDomain=Ajouter le domaine
+memberList=Liste de membre
+addRealmUser=Ajouter un utilisateur au domaine
+inviteMember=Inviter un membre
+removeMember=Supprimer un membre
+organizationSaveSuccess=Organisation sauvegardée avec succès.
+organizationSaveError=Impossible de sauvegarder l'organisation : {{error}}
+emptyMembers=Pas de membre
+emptyMembersInstructions=Il n'y a pas de membre pour l'instant. Merci de les ajouter à cette organisation
+organizationUsersAdded_one={{count}} utilisateur(s) ajouté(s) à l'organisation
+organizationUsersAdded_other={{count}} utilisateur(s) ajouté(s) à l'organisation
+unLinkIdentityProvider=Désassocier le fournisseur
+emptyIdentityProviderLink=Pas de fournisseur d'identité dans cette organisation
+searchProvider=Chercher un fournisseur
+selectIdentityProvider=Sélectionner un fournisseur d'identité
+shownOnLoginPage=Affiché sur la page de connexion
+shownOnLoginPageHelp=Si activé ce fournisseur d'identité est affiché sur la page de connexion.
+emptyUserOrganizations=Pas d'organisation
+emptyUserOrganizationsInstructions=Il n'y a pas d'organisation actuellement. Merci de rejoindre une organisation ou d'envoyer une invitation pour rejoindre une organisation.
+joinOrganization=Rejoindre l'organisation
+sendInvite=Envoyer l'invitation
+sendInvitation=Envoyer l'invitation
+organizationRemoveConfirm_one=Etes vous sûr de vouloir supprimer l'utilisateur depuis l'organisation sélectionnée ?
+userAddedOrganization_other={{count}} organisation(s) ajoutée(s) à l'utilisateur
+userInvitedOrganization_one=Invitation envoyée à l'utilisateur
+userInvitedOrganizationError=Impossible d'inviter l'utilisateur aux organisations : {{error}}
+userInvitedOrganization_other={{count}} invitation(s) envoyée(s) aux utilisateurs
+sentInvitation=Invitation envoyée
+loggedInAsTempAdminUser=Vous êtes connecté avec un compte administrateur temporaire. Pour renforcer la sécurité créez un compte administrateur permanent et supprimer le compte temporaire.
+temporaryAdmin=Compte administrateur temporaire. Assurez vous qu'il soit remplacé par un compte administrateur permanent aussi vite que possible.
+temporaryService=Compte de service administrateur temporaire. Assurez vous qu'il soit remplacé par un compte de service administrateur permanent aussi vite que possible.
+identityProviderUnlink=Désassocier le fournisseur d'identité ?
+identityProviderUnlinkConfirm=Etes vous sûr de vouloir désassocier ce fournisseur d'identité ?
+disableConfirmUserTitle=Désactiver l'utilisateur ?
+disableConfirmUser=Etes vous sûr de vouloir désactiver cet utilisateur ?
+eventTypes.UPDATE_CREDENTIAL.name=Mettre à jour l'identifiant
+eventTypes.UPDATE_CREDENTIAL.description=Mettre à jour l'identifiant
+eventTypes.UPDATE_CREDENTIAL_ERROR.name=Erreur mise à jour d'identifiant
+eventTypes.UPDATE_CREDENTIAL_ERROR.description=Erreur mise à jour d'identifiant
+eventTypes.REMOVE_CREDENTIAL.name=Supprimer l'identifiant
+eventTypes.REMOVE_CREDENTIAL.description=Supprimer l'identifiant
+eventTypes.REMOVE_CREDENTIAL_ERROR.name=Erreur suppression d'identifiant
+groupDuplicated=Groupe dupliqué
+duplicateAGroup=Dupliquer le groupe
+couldNotFetchClientRoleMappings=Impossible de récupérer les mappings de rôle du client : {{error}}
+duplicateGroupWarning=La duplication de groupes ayant un nombre important de sous groupes n'est pas supportée. Merci de vérifier que le groupe que vous dupliquez n'a pas un nombre important de sous groupes.
+errorSavingTranslations=Erreur pendant la sauvegarde des traductions : '{{error}}'
+clearCachesTitle=Supprimer les caches
+realmCache=Cache du domaine
+darkModeEnabled=Mode sombre
+showMemberships=Montrer les appartenances
+showMembershipsTitle={{username}} Appartenances de groupe
+noGroupMembershipsText=Cet utilisateur n'est membre d'aucun groupe.
+noGroupMemberships=Pas d'appartenance
+termsAndConditionsDeclined=Vous devez accepter les Conditions et Termes pour continuer
+somethingWentWrong=Quelque chose s'est mal passé
+somethingWentWrongDescription=Désolé, une erreur inattendue s'est produite.
+tryAgain=Réessayer
+userCache=Cache de l'utilisateur
+keysCache=Cache des clés
+crlCache=Cache de CRL
+clearButtonTitle=Supprimer
+clearRealmCacheHelp=Cela supprimer les entrées de tous les domaines.
+clearUserCacheHelp=Cela supprimer les entrées de tous les domaines.
+clearCrlCacheHelp=Supprime toutes les entrées du cache CRL. Le cache CRL améliore la performance de l'authentificateur X.509 quand la Certificate Revocation List (CRL) est activée. Cette action supprimera tous les entrées CRL pour tous les domaines.
+clearCacheSuccess=Cache supprimé avec succès
+clearCacheError=Impossible de supprimer le cache : {{error}}
+expandRow=Etendre la ligne
+membershipType=Type d'appartenance
+managedMembership=Appartenance gérée
+filterByMembershipType=Filtrer par le type d'appartenance
+organizationsMembersListError=Impossible de récupérer les membres de l'organisation : {{error}}
+MANAGED=Géré
+UNMANAGED=Non géré
+deleteConfirmUsers_one=Supprimer l'utilisateur {{name}} ?
+deleteConfirmUsers_other=Supprimer {{count}} utilisateurs ?
+downloadThemeJar=Télécharger le JAR du thème
+themeColorInfo=Ici vous pouvez saisir les variables de couleur patternfly et créer un fichier ".jar du thème" que vous pouvez télécharger et mettre dans le dossier voulu pour appliquer le thème à votre domaine.
+signatureAlgorithmIdentityProviderMetadata=Métadonnées de l'algorithme de signature SAML IdP
+signatureAlgorithmIdentityProviderMetadataHelp=Algorithme de signature à utiliser pour les métadonnées du fournisseur d'identité SAML, si aucun les métadonnées ne sont pas signées.
+connectionTrace=Trace de connexion
+connectionTraceHelp=Si activé les paquets LDAP ASN.1 BER entrants et sortants seront copiés sur la sortie standard d'erreur. Soyez prudent si cette option est activée en production car elle exposera toutes les données vers et depuis le serveur LDAP.
+savingUserEventsOff=Sauvegarde des évènements utilisateurs désactivée
+permissionsAssignedPolicy=Politique assignée
+savingAdminEventsOff=Sauvegarde des évènements administrateur désactivée
+membershipEvents=Evènements d'appartenance
+childGroupEvents=Evènements de groupe enfant
+titlePermissions=Permissions
+emptyPermissionsInstructions=Aucune permission n'existe dans ce domaine.
+permissionsName=Nom de la permission
+chooseAResourceType=Choisissez un type de ressource
+chooseAResourceTypeInstructions=Choisissez un type de ressource pour lequel vous voulez créer une permission.
+resourceScope=Périmètre de ressource
+resourceScopeHelpText=Spécifie le périmètre de la ressource. Ceci est utilisé pour déterminer le type de ressource auquel la permission est accordée.
+allClients=Tous les clients
+specificClients=Clients spécifiques
+allResourceType=Tout {{resourceType}}
+specificResourceType={{resourceType}} spécifique
+assignedPolicies=Politiques assignées
+assignExistingPolicies=Assigner des politiques existantes
+requiredPolicies=Merci d'ajouter au moins une politique.
+createNewPolicy=Créer une nouvelle politique
+policy=Politique
+policyType=Type de politique
+emptyAssignExistingPoliciesInstructions=Il n'y a pas de politiques existantes à assigner
+policyTypeHelpText=Spécifie le type de politique. Ceci est utilisé pour déterminer le type de politique auquel la permission est accordée.
+emptyAssignExistingPolicies=Pas de politique existante
+authorizationScope=Périmètre d'autorisation
+noAssignedPoliciesInstructions=Il n'y a pas de politique assignée pour cette permission
+assignedPolicyType.user=Utilisateur
+authorizationScopeDetailsTitle=Détails du périmètre d'autorisation
+authorizationScopeDetailsSubtitle=Un périmètre d'autorisation définie les actions qui peuvent être réalisées sur une ressource.
+authorizationScopeDetailsDescription=Description
+allResources=Toutes les ressources
+adminPermissionName=Nom de la permission
+noAssignedPolicies=Pas de politique assignée
+assignedPolicyType.allTypes=Tous les types
+currentRealm=Domaine actuel
+recentlyUsed=Utilisé récemment
+viewAll=Voir tout
+currentRealmExplain=Ce domaine est sélectionné
+removeInvalidUsers=Supprimer les utilisateurs invalides pendant les recherches
+enforceAccessToHelpText=Spécifie la ressource à laquelle la permission est appliquée.
+emptyPermissionPoliciesInstructions=Aucune politique n'existe dans ce domaine.
+removeInvalidUsersHelp=Supprimer les utilisateurs de la base de donnée locale s'ils ne sont pas disponibles depuis le stockage de l'utilisateur à l'exécution des recherches. Si activé les utilisateurs plus disponibles depuis leur stockage utilisateur correspondant sera supprimés de la base de données locale quand une recherche d'utilisateur sera effectuée. Si désactivé alors les utilisateurs importés précédemment depuis le stockage utilisateur seront conservés dans la base de données locale en lecture seule et seront désactivés même si cet utilisateur n'est plus disponible depuis le stockage utilisateur. Par exemple un utilisateur qui a été supprimé directement du LDAP ou du `DN utilisateurs` est invalide. Notez que ce comportement arrivera seulement quand l'utilisateur n'est pas encore en cache.
+createPermissionPolicy=Créer une politique
+deleteAdminPermissionConfirm=Si vous supprimez la permission {{ permission }}, les administrateurs ne pourront plus effectuer les actions sur les ressources définies par cette permission.
+noPermissionSearchResultsInstructions=Aucune permission ne correspond à vos filtres.
+authorizationScope.Clients.view=Voit ce client
+targetAudiencePlaceHolder=Sélectionner une audience ciblée pour l'échange de jeton
+addSubFlowTo=Ajouter un sous flux à {{name}}
+addExecutionTo=Ajouter un exécution à {{name}}
+addConditionTo=Ajouter un condition à {{name}}
+targetAudience=Audience ciblée
+permissionEvaluationPreview=Prévisualisation de l'évaluation de la permission
+noPermissionsEvaluationResults=Pas d'évaluation
+deleteConfirmRealm_one=Supprimer le domaine {{name}} ?
+recentRealms=Domaines récents
+manageRealms=Gérer les domaines
+cantDeleteMasterRealm=Vous ne pouvez pas supprimer le domaine master !
+selectRole=Sélectionner un rôle
+selectUsers=Sélectionner un utilisateur
+deniedScope=Périmètre refusé :
+evaluatedPolicy={{name}} a voté {{status}}
+permissionEvaluationAlertTitle=L'utilisateur sélectionné n'a pas accès aux ressources sélectionnées
+deleteConfirmRealm_other=Supprimer {{count}} domaines ?
+authTokenUrl=URL de jeton
+tokenTokenUrlHelp=Point de terminaison pour regrouper les jetons : exemple keycloak : http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+selectClient=Sélectionner un client
+forbiddenAdminConsole=Vous n'avez pas la permission. Merci de contacter votre administrateur.
+grantedPermissions=Permissions accordées
+deniedPermissions=Permissions refusées
+authenticationType=Type d'authentification
+authenticationTypeBasicAuth=Mot de passe
+authenticationTypeTokenAuth=Jeton
+signatureMaxExp=Durée d'expiration maximale
+signatureMaxExpHelp=Durée maximale d'expiration pour le JWT. Les jetons doivent être générés juste avant l'authentification. Après cette période ils seront considérés comme invalides car ils sont trop vieux. Si non défini la valeur par défaut est 60 secondes.
+authTokenClientIdHelp=Le client_id utilisé pendant le regroupement de jetons, exemple : mykeycloak-sendmail-client
+enableDebugSMTP=Active le debug SMTP
+eventTypes.REMOVE_CREDENTIAL_ERROR.description=Erreur suppression d'identifiant
+temporaryPassword=Temporaire
+noCredentialsText=Cet utilisateur n'a pas d'identifiants. Vous pouvez saisir un mot de passe pour cet utilisateur.
+clearKeysCacheHelp=Supprime toutes les entrées du cache de clés publiques externes. Ce sont les clés des fournisseurs d'identités ou clients externes. Cela supprimera toutes les entrées de tous les domaines.
+unlinkError=Impossible de désassocier le fournisseur d'identité de l'organisation : {{error}}
+linkUpdatedSuccessful=Lien du fournisseur d'identité mis à jour avec succès
+redirectWhenEmailMatchesHelp=Redirige automatiquement l'utilisateur vers ce fournisseur d'identité quand le domaine de mail correspond au domaine
+eventTypes.INVITE_ORG_ERROR.description=Erreur d'invitation de l'utilisateur à l'organisation
+organizationsEnabledHelp=Si activé autorise à gérer les organisations. Sinon les organisations existantes sont gardées mais vous pourrez plus les gérer ou authentifier leurs membres.
+noIdentityProviderInstructions=Il n'y a pas encore de fournisseurs d'identité dans ce domaine. Si vous voulez lier un fournisseur d'identité avec cette organisation, merci d'aller à la section "Fournisseurs d'identité" dans la barre de navigation à gauche et de créer un fournisseur d'identité
+linkError=Impossible de lier un fournisseur d'identité à cette organisation : {{error}}
+permissionNameHelpText=Le nom de la permission. Ce nom est utilisé pour identifier la permission dans la console Administrateur.
+unLinkSuccessful=Le fournisseur d'identité a été désassocié
+darkModeEnabledHelp=Si activé la variante sombre du thème est appliquée en se basant sur les préférences utilisateur du système d'exploitation (mode sombre ou clair) ou d'un paramètre d'agent utilisateur. Si désactivé uniquement la variante claire est utilisée. Ce paramètre s'applique uniquement aux thèmes qui supportent les variants sombre et clair. Si un thème ne supporte pas cette fonctionnalité ce paramètre n'a aucun effet.
+authorizationScope.Clients.map-roles-client-scope=Appliques les rôles définis par ce client au périmètre client d'un autre client
+createPermissionOfType=Cette permission sera appliquée à {{resourceType}}
+permissionUsersHelpText=Spécifie quel utilisateur sera autorisé par cette permission.
+authorizationScope.Clients.map-roles-composite=Appliques les rôles définis par ce client comme composé d'un autre rôle
+enforceAccessTo=Forcer l'accès à
+authorizationScope.Clients.token-exchange=Contrôle quels clients peuvent échanger des jetons pour un jeton ciblé par ce client
+authTokenScopeHelp=Le(s) périmètre(s) séparé(s) par un espace utilisé()s pendant le regroupement de jetons comme un paramètre de périmètre, exemple : 'basic sendmail'
+authorizationScope.Users.map-roles=Map les rôles pour tous les utilisateurs
+permissionsEvaluationInstructions=Sélectionner un utilisateur si l'utilisateur a un accès spécifique à la ressource spécifiée. Après avoir cliqué le bouton Evaluation ci dessous le résultat sera affiché dans le panneau de droite.
+grantedScope=Périmètre accordé :
+userInfoResponseEncryptionKeyManagementAlgorithm=Algorithme de gestion de clé de chiffrage de la réponse des informations utilisateur
+parentClientScope=Périmètre client parent
+unmanagedAttributesHelpText=Les attributs non gérés sont des attributs utilisateur non explicitement définis dans la configuration du profil utilisateur. Par défaut les attributs non gérés sont `Désactivés` et ne sont disponibles depuis aucun contexte comme l'enregistrement et les consoles Administrateur et Compte. En mettant les attributs non gérés en `Activés` ils deviennent complètement reconnus par le serveur et accessibles depuis tous les contextes, utile si vous commencez à migrer un domaine existant vers le profil utilisateur déclaratif et vous n'avez pas encore tous les attributs utilisateurs définis dans la configuration du profil utilisateur. En mettant les attributs non gérés en `Seuls les administrateurs peuvent écrire` les attributs non gérés peuvent être gérés seulement depuis la console Administrateur ou par API, utile si vous avez déjà défini un attribut personnalisé que peut être géré par les utilisateurs mais que vous n'êtes pas sûr d'ajouter d'autres attributs qui peuvent être gérés par les administrateurs. En mettant les attributs non gérés en `Seuls les administrateurs peuvent lire` les attributs non gérés sont en lecture seule et sont seulement disponible depuis la console Administrateur ou par API.
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=Jeton de récupération du fournisseur d'identité
+reorder=Réorganiser
+allTypes=Tous les types
+ldapFilter=Filtre LDAP
+executorTypeSwitchHelpText=Texte d'aide pour l'interrupteur de type d'exécuteur
+mapperTypeFullNameLdapMapper=full-name-ldap-mapper
+disableNonce=Désactiver nonce
+cibaBackhannelTokenDeliveryModes.poll=Interroger
+policies=Politiques
+backchannelLogoutSessionRequired=Déconnexion du canal secondaire de la session requise
+addressClaim.street.tooltip=Nom de l'attribut utilisateur qui sera utilisé pour mapper le sous attribut 'street_address' dans l'attribut de jeton 'address'. Par défaut 'street'.
+idpInitiatedSsoRelayStateHelp=Etat de relais que vous voulez envoyer avec la requête SAML quand vous faire un IDP Initiated SSO.
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=Erreur code d'appareil vers jeton OAuth2
+eventTypes.TOKEN_EXCHANGE_ERROR.name=Erreur d'échange de jeton
+webAuthnPolicyRequireResidentKeyHelp=Indique à l'authentificateur s'il doit créer un identifiant de clé publique comme un Discoverable Credential.
+clientRolesHelp=La condition vérifie si l'un des rôles client spécifiés existe sur le client pour déterminer si la politique est appliquée. Cette condition autorise efficacement l'administrateur client à créer un rôle client avec un nom spécifié sur le client pour être sûr que cette politique client particulière sera appliquées au requêtes de cette client. La condition est vérifié durant la plupart des requêtes OpenID Connect (requêtes d'autorisation, requêtes de jetons, requête du point de terminaison d'introspection et ainsi de suite).
+partialExportHeaderText=Un export partiel vous permet d'exporter la configuration du domaine et les autres ressources associées dans un fichier JSON.
+registeredClusterNodes=Nœuds de cluster enregistrés
+backchannelLogoutUrlHelp=URL qui forcera le client à se déconnecter lui même quand une requête de déconnexion est envoyée à ce domaine (via end_session_endpoint). La déconnexion se fait par l'envoi d'un jeton de déconnexion comme spécifié dans les spécifications OIDC de la déconnexion du canal secondaire. Si omis la requête de déconnexion pourra être envoyée à 'URL Administrateur' spécifiée (si configurée) dans le format spécifique des adaptateurs Keycloak/RH-SSO. Si même 'URL Administrateur' n'est pas configurée aucune requête de déconnexion sera envoyée au client.
+httpPostBindingLogout=Déconnexion HTTP-POST
+eventTypes.SEND_RESET_PASSWORD_ERROR.description=Erreur pendant l'envoi de la réinitialisation du mot de passe
+deleteConfirmUsers=Supprimer l'utilisateur ?
+postBrokerLoginFlowAlias=Flux après connexion
+loadingRealms=Chargement des domaines…
+updateTranslationSuccess=Succès ! Traduction mise à jour.
+attributeConsumingServiceIndexHelp=Index du profil Attribute Consuming Service à requêter pendant l'authentification.
+algorithmNotSpecified=Algorithme non spécifié
+flow.firstBrokerLogin=Flux de première connexion à l'intermédiaire
+flow.browser=Flux de navigateur
+validateConnectionUrl=Vous devez entrer une URL de connexion
+userInfoResponseEncryptionKeyManagementAlgorithmHelp=Algorithme JWA utilisé pour la gestion de clé dans le chiffrage des réponses du point de terminaison des informations utilisateurs. Cette option est nécessaire si vous voulez chiffrer les réponses du point de terminaison des informations utilisateurs. Si vide les réponses du point de terminaison des informations utilisateurs ne sont pas chiffrées.
+clientTypeHelp='OpenID Connect' autorise les clients à vérifier l'identité de l'utilisateur final en se basant sur l'authentification faite par le serveur d'autorisation. 'SAML' active l'authentification web et les scénarios d'autorisation incluant le cross-domain single sign-on (SSO) et utilise les jetons de sécurité contenant les assertions pour passer des informations.
+searchScopeHelp=Pour un niveau la recherche s'applique seulement aux utilisateurs des DNs spécifiés dans les DNs utilisateur. Pour un sous arbre la recherche s'applique pour le sous arbre entier. Voir la documentation LDAP pour plus de détails.
+policyDecisionStagey=La stratégie de décision indique comment les politiques associées avec une permission donnée sont évaluées et comment une décision finale est obtenue. 'Affirmatif' signifie qu'au moins une politique doit être évaluée avec une décision positive pour que la décision finale soit aussi positive. 'Unanime' signifie que toutes les politiques doivent rendre une décision positive pour que la décision finale soit positive. 'Consensus' signifie que le nombre de décisions positives doit être supérieur au nombre de décisions négatives. Si le nombre de décisions positives est le même que le nombre de négatives la décision finale sera négative.
+policyProvider.js=Définit les conditions pour vos autorisations en utilisant JavaScript. Ceci est l'un des types de politique basé sur des règles supporté par Keycloak et il offre la flexibilité d'écrire toute politique basée sur l'API d'évaluation.
+noGroupsText=Vous n'avez ajouté cet utilisateur à aucun groupe. Rejoignez un groupe pour commencer.
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.name=Erreur droits d'accès extension OAuth2
+userModelAttributeHelp=Nom de la propriété du UserModel ou de l'attribut auquel vous voulez mapper l'attribut LDAP. Par exemple 'firstName', 'lastName, 'email', 'street' etc.
+encryptionAlgorithmHelp=Algorithme de chiffrage utilisé par le SAML IDP pour chiffrer les documents SAML, les assertions et les identifiants. La clé de déchiffrage correspondante pour déchiffrer les parties du document SAML est choisie en fonction de cet algorithme configuré et doit être disponible dans les clés du domaine pour l'utilisation du chiffrage (ENC). Si aucun algorithme n'est configuré n'importe quel algorithme supporté est autorisé et la clé de déchiffrage est choisie en fonction de l'algorithme configuré dans le document SAML.
+relativeUserCreateDnHelp=Nom de domaine (DN) relatif depuis les 'Utilisateurs DN' jusqu'à l'endroit de création des utilisateurs. Par exemple ceci autorise les utilisateurs à être créés dans d'autre DN que le parent 'Utilisateurs DN' pendant l'utilisation d'un périmètre de recherche de sous-arbre.
+tokenLifespan.expires=Expire dans
+emptyStateMessage=Pas d'attributs de groupe
+useKerberosForPasswordAuthenticationHelp=Utiliser le module de connexion Kerberos pour s'authentifier avec un nom d'utilisateur et un mot de passe au serveur Kerberos à la place de s'authentifier au serveur LDAP avec l'API Directory Service.
+claimHelp=Nom de l'attribut à rechercher dans le jeton. Vous pouvez référencer les attributs imbriqués en utilisant un '.'. Par exemple 'address.locality'. Pour utiliser le point (.) littéralement échapper le avec un backslash (\\.).
+authorizationHelp=Activer/Désactiver le support de l'autorisation à granularité fine pour un client.
+masterSamlProcessingUrlHelp=Si configurée cette URL sera utilisée pour les assertions consommateurs SP et pour les services de déconnexion simple. Ceci peut être surchargé individuellement pour chaque association et service dans la configuration du point de terminaison à granularité fine SAML.
+idTokenEncryptionKeyManagementAlgorithmHelp=Algorithme JWA utilisé pour la gestion des clés dans le chiffrage des jetons ID. Cette option est obligatoire si vous voulez chiffrer les jetons ID. Si laissé vide les jetons ID sont juste signés mais pas chiffrés.
+idpInitiatedSsoUrlNameHelp=Nom du fragment d'URL pour référencer un client quand vous voulez faire un IDP Initiated SSO. Laisser ceci vide désactivera le IDP Initiated SSO. L'URL que vous allez référencer depuis votre navigateur sera : {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}.
+validRequestURIsHelp=Liste des URLs valides qui peuvent être utilisées comme valeurs dans le paramètre 'request_uri' pendant une requête d'authentification OpenID Connect. Aucune fonctionnalité comme celles présentes dans les URLs valides de redirection, comme exemple le joker '*' ou les chemins relatifs n'est supportée ici.
+oidcAttributeImporter=Importer l'attribut déclaré s'il existe un identifiant (ID), un jeton d'accès ou l'ensemble d'attributs retourné par le point de terminaison du profil utilisateur dans l'attribut ou la propriété utilisateur spécifié.
+validRedirectURIs=Schéma d'URL valide vers lequel le navigateur peut rediriger après une connexion réussie. Les jokers sont autorisés comme par exemple 'http://example.com/*'. Un chemin relatif peut aussi être précisé, exemple : /my/relative/path/*. Ces chemins sont relatifs à l'URL racine du client, si aucune URL racine n'est spécifiée l'URL d'authentification racine du serveur est utilisée. Pour SAML vous devez mettre un schéma d'URL valide si vous faîtes confiance sur le service d'URL du consommateur embarqué avec la requête de connexion.
+membershipUserLdapAttributeHelp=Utilisé seulement si le type d'attribut d'appartenance est UID. C'est le nom de l'attribut LDAP de l'utilisateur qui est utilisé pour le mapping de l'appartenance. C'est souvent 'uid'. Par exemple si la valeur de 'L'attribut LDAP appartenance utilisateur' est 'uid' et le groupe LDAP a 'memberUid : john' il est attendu que cet utilisateur particulier LDAP aura l'attribut 'uid : john'.
+mapperTypeMsadUserAccountControlManagerHelp=Mappeur spécifique au MSAD. Ceci peut intégrer l'état du compte utilisateur MSAD dans l'état du compte Keycloak (compte activé, mot de passe expiré et autres). Ceci utilise les attributs userAccountControl et pwdLastSet pour cet état. Par exemple si pwdLastSet est 0 l'utilisateur Keycloak doit mettre à jour son mot de passe. Autre exemple, si userAccountControl est 514 (compte désactivé), l'utilisateur Keycloak est désactivé. La mappeur peut aussi gérer le code d'exception depuis l'authentification utilisateur LDAP.
+oAuthMutualHelp=Ceci active le support pour les jetons d'accès OAuth2 Mutual TLD associés à un certificat, qui signifie que Keycloak associe un jeton d'accès et un jeton de rafraîchissement avec un certificat X.509 d'un jeton requêtant l'échange client dans le Mutual TLS entre le point de terminaison de jeton de Keycloak et ce client. Ces jetons peuvent être traités comme des jetons Holder-of-Key token au lieu de jetons Bearer token.
+attributesHelp=Nom et expression régulière pour les attributs à chercher dans un jeton. Le nom configuré d'un attribut est cherché dans un nom d'attribut SAML et dans les champs du nom d'attribut. Toutes les descriptions d'attributs données doivent être satisfaites pour saisir le rôle. Si un attribut est un tableau alors la valeur doit être contenue dans un tableau. Si un attribut peut être trouvé plusieurs fois alors une seule correspondance suffit.
+shortVerificationUriTooltipHelp=Si saisie cette valeur sera retournée comme verification_uri dans le flux d'autorisation de l'appareil. Cette URL doit rediriger vers {server-root}/realms/{realm}/device.
+client-updater-source-groups.tooltip=Nom des groupes à vérifier. La condition s'évalue à vrai si l'entité qui crée ou met à jour le client est membre d'un ou plusieurs des groupes spécifiés. Les groupes configurés sont spécifiés par leur nom simple qui doit correspondre au nom du groupe Keycloak. Aucun support pour la hiérarchie de groupe est utilisé ici.
+useMetadataDescriptorUrlHelp=Si activé les certificats pour valider les signatures seront téléchargés et cachés depuis l'"URL de descripteur de métadonnées" donnée. L'action "Rechargement de clés" peut être utilisée pour rafraîchir les certificats dans le cache. Si désactivé les certificats depuis l'option "Certificats validants X509" sont utilisés, ils doivent être changés manuellement quand ils sont changés dans le IDP.
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=Code OAuth2 de l'appareil vers jeton
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=Erreur lors de la poussée de la requête d'autorisation
+editAttribute=Editer l'attribut
+webAuthnPolicyRpEntityNameHelp=Nom du serveur lisible pour un humain comme la WebAuthn Relying Party
+refreshTokenMaxReuse=Nombre maximal de réutilisation du jeton de rafraîchissement
+clientScopes=Périmètres client
+permissionDescription=Une description pour cette permission.
+policyClientHelp=Spécifie quel(s) client(s) est/sont autorisé(s) par cette politique.
+multivalued.label=A valeurs multiples
+buildIn=Intégré par défaut
+roleCreateExplain=Ceci est une description
+scopePermissions.identityProviders.token-exchange-description=Politiques qui décident quels client sont autorisés à échanger des jetons pour un jeton externe fourni par ce fournisseur d'identité.
+jwtX509HeadersEnabled=Ajouter l'entête X.509 au JWT
+flow.registration=Flux d'enregistrement
+showLess=Montrer moins
+connectionAndAuthenticationSettings=Paramètres de connexion et d'authentification
+storePassword=Stocker le mot de passe
+defaultGroups=Groupes par défaut
+unlinkUsersSuccess=Désassociation des utilisateurs terminée avec succès.
+webAuthnPolicyCreateTimeoutHint=Le timeout doit être entre 0 seconde et 8 heures.
+addValidator=Ajouter un validateur
+attributeImporter=Importer l'attribut SAML déclarés s'il existe une assertion dans la propriété utilisateur spécifiée ou l'attribut.
+userInfoSettings=Paramètres d'informations utilisateurs
+createAttributeError=Erreur ! La configuration du profil utilisateur n'a pas été sauvegardée {{error}}.
+eventTypes.VERIFY_EMAIL.name=Vérifier le mail
+httpPostBindingResponseHelp=Indique s'il faut répondre aux requêtes en utilisant un HTTP-POST. Sinon un HTTP-REDIRECT sera utilisé.
+artifactBindingResponseHelp=Indique s'il faut répondre aux requêtes en utilisant ARTIFACT. Sinon la configuration pour HTTP-POST sera évaluée.
+mapperTypeHardcodedAttributeMapper=hardcoded-attribute-mapper
+eventTypes.IMPERSONATE.description=Usurper
+forbidden_other=Interdit, permissions requises :
+clientAuthorization=Autorisation
+identityProvidersPermissionsHint=Détermine si les permissions à granularité fine sont activées pour gérer ce tôle. Les désactiver supprimera tous les permissions actuelles qui avait été mises en place.
+removeMappingConfirm_other=Etes vous sûr de vouloir supprimer {{count}} rôles
+kerberosWizardDescription=Texte requis ici.
+importHelp=Importer un fichier JSON contenant les paramètres d'autorisation pour ce serveur de ressource.
+mapperType=Type de mappeur
+importResources=Les paramètres suivants et données seront importés :
+enableRefreshRequestedTokenTypeHelp=Contrôle si le Standard Token Exchange V2 autorise à requêter un jeton de rafraîchissement (paramètre "requested_token_type" mis à la valeur "urn:ietf:params:oauth:token-type:refresh_token"). Si cette option est "Non" (par défaut) le type de requête de jeton de rafraîchissement n'est jamais autorisé et une erreur est retournée. Si cette option est "Même session", le jeton de rafraîchissement retourné est forcé d'utiliser la même session que le sujet du jeton, retournant une erreur si cette session n'est pas disponible (par exemple si le sujet du jeton est transient).
+onDragFinish=Glissement terminé {{list}}
+clientScopesHelp=Ceci utilise les périmètres demandés ou assignés en avance par le client pour déterminer si la politique est appliquée à ce client. La condition est évaluée pendant la requête d'autorisation OpenID Connect et/ou la requête de jeton.
+fineGrainSamlEndpointConfig=Configuration du point de terminaison SAML à granularité fine
+mapperTypeRoleLdapMapperHelp=Utilisé pour mapper les mappings de rôle depuis le LDAP DN vers les mappings de rôle de Keycloak soit des rôles de domaine ou soit des rôles client d'un client particulier.
+socialProfileJSONFieldPathHelp=Chemin du champ Social Provider User Profile dans les données JSON où prendre la valeur. Vous pouvez utiliser des points pour les nœuds enfants et des crochets pour les index de tableau, par exemple 'contact.address[0].country'.
+canonicalizationHelp=Méthode de canonicalisation pour les signatures XML.
+connectionPooling=Interrogation régulière de connexion
+eventTypes.IMPERSONATE_ERROR.description=Erreur d'usurpation
+roleObjectClassesHelp=Classe d'objet (ou classes) de l'objet du rôle. A séparer par des virgules si plusieurs classes sont nécessaires. Dans un déploiement LDAP typique ceci pourrait être 'groupOfNames'. Dans l'Active Directory ceci est souvent 'group'.
+useDiscoveryEndpoint=Utiliser le point de terminaison de découverte
+clearAdminEvents=Supprimer les évènements administrateurs
+eventTypes.CLIENT_DELETE.name=Client supprimé
+mapperSaveSuccess=Mappeur sauvegardé avec succès.
+noRolesAssociatedInstructions=Pour ajouter des rôles à ce rôle cliquez sur 'Ajouter le rôle'.
+alwaysDisplayInUIHelp=Toujours lister ce client dans l'interface Compte, même si cet utilisateur n'a pas une session active.
+eventTypes.UPDATE_PASSWORD.name=Mettre à jour le mot de passe
+eventTypes.UPDATE_CONSENT.description=Mettre à jour le consentement
+realmSaveSuccess=Domaine mis à jour avec succès
+executorTypeTextHelpText=Texte d'aide pour le texte de type d'exécuteur
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Erreur de connexion au fournisseur d'identité
+readTimeout=Timeout de lecture
+userInfoResponseEncryptionContentEncryptionAlgorithmHelp=Algorithme JWA utilisé pour le chiffrage du contenu dans les réponses du point de terminaison des informations utilisateur. Si un algorithme de gestion de clé de chiffrage des réponses des informations utilisateur est spécifié alors la valeur par défaut est A128CBC-HS256.
+accessTokenSignatureAlgorithm=Algorithme de signature du jeton d'accès
+logoutAllDescription=Si vous déconnectez toutes les actives sessions, les sujets actifs dans ce domaine seront déconnectés.
+credentialResetEmailError=Echec : {{error}}
+flow-type.form-flow=Formulaire
+guiOrderHelp=Spécifier l'ordre du fournisseur dans l'interface (comme sur la page de consentement) avec un entier.
+signDocumentsHelp=Les documents SAML doivent ils être signés par le domaine ?
+resetPassword=Réinitialiser le mot de passe
+policyDeletedSuccess=La politique a été supprimé avec succès
+manageServiceAccountUser=Pour gérer les détails et les mappings de groupe cliquez sur le nom d'utilisateur <1>{{link}}</1>
+addClientProfileSuccess=Nouveau profil client ajouté
+helpDisabled=Aide désactivé
+deleteResource=Supprimer la ressource définitivement ?
+emptyAddClientScopesInstructions=Il n'y a plus de périmètres client restants à ajouter
+changeTypeIntro={{count}} périmètres client sélectionnés seront changés vers
+secretSizeHelp=Taille en octets pour le secret généré
+clientSecret=Secret du client
+inputType=Type d'entrée
+iconUri=URL icône
+allowed-protocol-mappers.label=Mappeurs de protocole autorisés
+group=Groupe
+addAssociatedRolesText=Ajouter les rôles associés
+enabledFeatures=Fonctionnalité activées
+groupsClaimHelp=Si défini la politique récupérera les groupes de l'utilisateur depuis l'attribut donné dans un jeton d'accès ou un jeton ID représentant l'identité demandant les permissions. Si non défini les groupes de l'utilisateur sont obtenus depuis la configuration du domaine.
+validatingPublicKeyId=Identifiant de la clé publique validante
+clientAuthentications.client_secret_jwt=JWT signé avec un secret de client
+created=Créé
+displayOnClient=Afficher le client sur l'écran
+certSubject=CERT_SUBJECT
+ldapAdvancedSettingsDescription=Cette section contient tous les autres options pour la configuration à granularité fine du fournisseur de stockage LDAP.
+usersDN=Utilisateurs DN
+relativeUserCreateDn=Création d'utilisateur relative DN
+secretSize=Taille du secret
+included.custom.audience.label=Audience personnalisée incluse
+max-clients.label=Nombre maximal de clients par domaine
+requestObjectSignatureAlgorithm=Algorithme de signature de requête d'objet
+noRolesAssociated=Pas de rôles associés
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.name=Erreur après connexion au fournisseur d'identité
+requestObject.request\ only=Uniquement par requête
+requiredForLabel.admins=Uniquement les administrateurs
+clientScopeSuccess=Mapping de périmètre mis à jour
+clientPolicySearch=Chercher une politique client
+refreshTokens=Rafraîchir les jetons
+eventTypes.UPDATE_EMAIL_ERROR.description=Erreur de mise à jour de mail
+webAuthnPolicyCreateTimeoutHelp=La valeur de timeout pour la création de la clé publique des identifiants de l'utilisateur en secondes. Si mis à 0 cette option de timeout n'est pas adaptée.
+eventTypes.REGISTER_ERROR.name=Erreur d'enregistrement
+priorityHelp=Priorité du fournisseur
+emptyPolicies=Pas de politique
+manageOrderTableAria=Liste des fournisseurs d'identité dans l'ordre listé sur la page de connexion
+disableError=Impossible de désactiver le fournisseur {{error}}
+anyAlgorithm=N'importe quel algorithme
+claimFilterValue=Valeur d'attribut essentiel
+updateClientPoliciesSuccess=La configuration des politiques client a été mise à jour
+advancedSettings=Paramètres avancés
+attributeValueHelp=Valeur que l'attribut doit avoir. Si l'attribut est une liste alors la valeur doit être contenue dans la liste.
+eventTypes.FEDERATED_IDENTITY_LINK.description=Lien du regroupement d'identité
+alias=Alias
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=Erreur d'envoi de lien du fournisseur d'identité
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.name=Surcharge du lien de regroupement d'identité
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.description=Surcharge du lien de regroupement d'identité
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.name=Erreur de surcharge du lien de regroupement d'identité
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.description=Erreur de surcharge du lien de regroupement d'identité
+eventTypes.OAUTH2_EXTENSION_GRANT.name=Droits d'accès extension OAuth2
+eventTypes.OAUTH2_EXTENSION_GRANT.description=Droits d'accès extension OAuth2
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.description=Erreur droits d'accès extension OAuth2
+userEvents=Evènements utilisateur
+inputTypePlaceholder=Placeholder de l'entrée
+otpPolicyPeriodErrorHint=La valeur doit être entre 1 seconde et 2 minutes.
+clearUserEvents=Supprimer les évènements utilisateurs
+descriptionHelp=Texte d'aide pour la description du nouveau flux
+addCustomProvider=Ajouter un fournisseur personnalisé
+permissionType=Spécifie que cette permission doit être appliquée à toutes les instances de ressource d'un type donné.
+policyEnforcementModes.ENFORCING=Forcé
+rowSaveBtnAriaLabel=Sauvegarder les modifications pour {{messageBundle}}
+permanentLockout=Bloqué définitivement
+maxTemporaryLockouts=Nombre maximal de blocages temporaires
+maxTemporaryLockoutsHelp=Le nombre de blocages temporaires autorisés avant qu'un utilisateur soit bloqué définitivement.
+bruteForceStrategy=Stratégie pour augmenter le temps d'attente
+bruteForceStrategyHelp=Multiple signifie que le temps d'attente sera augmenté seulement quand le nombre d'échecs sera un multiple de '{{failureFactor}}'. Linéaire signifie que chaque nouvel échec à partir de '{{failureFactor}}' augmentera le temps d'attente.
+bruteForceStrategy.LINEAR=Linéaire
+bruteForceStrategy.MULTIPLE=Multiple
+debug=Debug
+unlockUsersConfirm=Tous les utilisateurs temporairement bloqués seront débloqués.
+idpType.custom=Personnalisé
+eventTypes.LOGOUT.name=Déconnexion
+deletedErrorClientScope=Impossible de supprimer le périmètre client : {{error}}
+webAuthnPolicyRequireResidentKey=Requière les identifiants découvrables
+groupsClaim=Attribut des groupes
+roleMappingUpdatedError=Impossible de mettre à jour le mapping de rôle {{error}}
+frontchannelLogoutUrlHelp=URL qui causera la déconnexion du client quand une requête de déconnexion est envoyée à ce domaine (via end_session_endpoint). Si non fourni l'URL par défaut est l'URL de base.
+authenticationOverridesHelp=Surcharger les associations de flux d'authentification du domaine.
+requiredActions=Actions requises
+requiredAction=Action requise
+requiredActionConfig=Configuration pour {{name}}
+selectLocales=Sélectionner les langues
+usermodel.prop.tooltip=Nom de la méthode dans l'interface UserModel. Par exemple une valeur comme 'email' référencera la méthode UserModel.getEmail().
+kc.identity.authc.method=Méthode d'authentification
+regexAttributeValues=Valeurs d'expression régulière d'attribut
+setAsDefaultAction=Mettre comme action par défaut
+keyForCodeExchange=Méthode PKCE - Clé de preuve pour le challenge d'échange de code
+clientProfiles=Profils client
+endpointsHelp=Montre la configuration du point de terminaison du fournisseur de service.
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
+createClientPolicyError=Impossible de créer la politique à cause de : {{error}}
+eventTypes.EXECUTE_ACTIONS_ERROR.name=Erreur exécution d'actions
+path=Chemin
+overwritten=Ecrasé
+mapperNameHelp=Nom du mappeur
+keyProviderMapperNameHelp=Affiche le nom du fournisseur si lié dans la console Administrateur.
+providerIdHelp=Identifiant du fournisseur
+deleteProviderError=Erreur pendant la suppression du fournisseur : {{error}}
+supportedLocalesHelp=Les langues à supporter pour ce domaine. L'utilisateur choisit une de ces langues sur l'écran de connexion.
+comparisonHelp=Spécifie la méthode de comparaison utilisée pour évaluer les classes de contexte requêtées ou les déclarations. Par défaut "Exact".
+generatedIdTokenIsDisabled=Le jeton id généré est désactivé quand aucun utilisateur n'est sélectionné
+nodeHost=Hôte du nœud
+eventTypes.REGISTER_NODE_ERROR.description=Erreur enregistrement du nœud
+eventListenersHelpTextHelp=Configure quels auditeurs reçoivent les évènements pour ce domaine.
+acrToLoAMapping=Mapping ACR vers LoA
+advancedSettingsSaml=Cette section est utilisée pour configurer les paramètres avancés de ce client
+resetCredentialsError=Erreur pendant la réinitialisation des identifiants des utilisateurs : {{error}}
+eventTypes.INTROSPECT_TOKEN.name=Introspecter le jeton
+unspecified=Non spécifié
+deleteMappingTitle=Supprimer le mapping ?
+profile=Profil
+active=Actif
+generateKeysDescription=Si vous générez des nouvelles clés vous pouvez télécharger le magasin de clé avec la clé privée automatiquement et les sauvegarder côté client. Le serveur Keycloak sauvegardera seulement le certificat et la clé publique mais pas la clé privée.
+addSubFlowTitle=Ajouter un sous flux
+useTruststoreSpiHelp=Spécifie si la connexion LDAP doit utiliser le Truststore SPI avec le truststore configuré dans les options en ligne de commande. 'Toujours' signifie qu'il devra toujours être utilisé. 'Jamais' signifie qu'il ne l'utilisera jamais. Noter que même si le truststore Keycloak n'est pas configuré le cacert ou certificat ou défaut java spécifié par la propriété 'javax.net.ssl.trustStore' sera utilisé.
+forcePostBindingHelp=Toujours utiliser un POST pour les réponses.
+VERIFY_EMAIL=Vérifier le mail (VERIFY_EMAIL)
+realmCertificateAlias=Alias du certificat de domaine
+roleName=Nom du rôle
+addOrigins=Ajouter l'origine
+evictionDayHelp=Jour de la journée où l'entrée deviendra valide.
+actionTokens=Jetons d'action
+permissionResources=Spécifie que cette permission doit être appliquée à une instance spécifique de ressource.
+testConnectionHint.withoutEmail=Pour tester la connexion vous devez d'abord configurer l'adresse mail pour l'utilisateur actuel ({{userName}}).
+includeOneTimeUseConditionHelp=Une condition OneTimeUse doit elle être incluse dans les réponses de connexion ?
+availableIdPsText=Tous les fournisseurs d'identité configurés dans ce domaine sont listés ici. Vous pouvez lier le compte utilisateur à n'importe lequel des comptes IdP.
+redirectURIHelp=L'URL de redirection à utiliser pour configurer le fournisseur d'identité.
+permissionsEnabled=Permissions activées
+saveRealmError=Impossible de créer le domaine {{error}}
+attestationPreference.none=Aucun
+pairwiseSubAlgorithmSalt.label=Sel
+addGroupsToGroupPolicy=Ajouter les groupes à la politique de groupe
+deniedScopes=Périmètres refusés
+updateClientProfilesSuccess=La configuration des profils client a été mise à jour
+flow.docker\ auth=Flux d'authentification Docker
+useEntityDescriptor=Utiliser le descripteur d'entité
+windowsDomainQN=Nom qualifié du domaine Windows
+deleteClientError=Impossible de supprimer le profil : {{error}}
+UPDATE_PROFILE=Mettre à jour le profil (UPDATE_PROFILE)
+removeImported=Supprimer importé
+roleSaveError=Impossible de sauvegarder le rôle : {{error}}
+keySize=Taille de clé
+samlCapabilityConfig=Capabilités SAML
+accessTokenSignatureAlgorithmHelp=Algorithme JWA utilisé pour signer les jetons d'accès.
+derFormatted=Formatté en DER
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Compte de lien du fournisseur d'identité
+firstBrokerLoginFlowAliasOverrideHelp=Alias pour le flux d'authentification qui est déclenché après la première connexion avec cette fournisseur d'identité. Le terme 'Première connexion' signifie qu'aucun compte Keycloak est actuellement associé avec le compte de fournisseur d'identifié authentifié.
+executorAuthenticatorMultiSelectHelpText=Texte d'aide pour le MultiSelect d'authentificateur d'exécuteur
+cachePolicyHelp=Politique de cache pour ce fournisseur de stockage. 'DEFAULT' correspond aux paramètres par défaut pour le cache global. 'EVICT_DAILY' est un moment de la journée auquel tous les jours le cache sera invalidé. 'EVICT_WEEKLY' est un jour et une heure de la semaine où le cache sera invalidé. 'MAX_LIFESPAN' est le temps en millisecondes qui sera la durée de vie d'une entrée de cache.
+enableLdapv3Password=Activer l'opération étendue de modification de mot de passe LDAPv3
+policyUrlHelp=URL que le client Relying Party fournit à l'utilisateur final pour lire comment les données du profil seront utilisées
+fromDisplayName=Depuis le nom affiché
+startTimeHelp=Définie le temps avant lequel la politique NE DOIT PAS être accordée. Seulement accordée si la date/heure actuelle est supérieure ou égale à cette valeur.
+executorClientAuthenticator=Authentificateur exécuteur client
+managePriorityInfo=La priorité de l'ordre des fournisseurs quand une recherche utilisateur est faite. Vous pouvez glisser déposer les gestionnaires de colonne pour changer les priorités.
+allowedClockSkewHelp=Ticks d'horloge en secondes qui est toléré pendant la validation des jetons des fournisseurs d'identité. La valeur par défaut est 0.
+userGroupsRetrieveStrategyHelp=Spécifie comment récupérer les groupes de l'utilisateur. LOAD_GROUPS_BY_MEMBER_ATTRIBUTE signifie que les rôles de l'utilisateur seront récupérés en envoyant une requête LDAP pour récupérer tous les groupes où 'member' est notre utilisateur. GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE signifie que les groupes de l'utilisateur seront récupérés depuis l'attribut 'memberOf' de notre utilisateur ou depuis un autre attribut spécifié par 'Attribut LDAP Membre De'.
+webAuthnPolicyRpId=ID de la Relying Party
+serviceAccount=Rôles des comptes de service
+directAccessHelp=Ceci active le support pour les droits d'accès directs, ce qui signifie que ce client a accès au nom d'utilisateur/mot de passe d'un utilisateur et les échanger directement avec le serveur Keycloak pour un jeton d'accès. En termes de spécifications OAuth2 ceci active le support 'Resource Owner Password Credentials Grant' pour ce client.
+oidcCibaGrantHelp=Ceci active le support pour les droits OIDC CIBA, ce qui signifie que l'utilisateur est authentifié avec un appareil externe d'authentification à la place du navigateur de l'utilisateur.
+webAuthnPolicySignatureAlgorithmsHelp=Les algorithmes de signature qui doivent être utilisés pour l'assertion d'authentification.
+scopeParameterHelp=Vous pouvez copier la valeur du paramètre de périmètre et la coller dans la requête initiale d'authentification OpenID Connect envoyée dans cet adaptateur de client. Les périmètres client par défaut et ceux optionnels qui sont sélectionnés sera pour la génération du jeton pour ce client.
+nameIdFormat=Format de l'ID du nom
+frontchannelLogout=Déconnexion du canal primaire
+client-updater-source-roles.tooltip=La condition est vérifiée pendant l'enregistrement du client ou la requête de mise à jour ; elle est évaluée à vrai si l'entité (souvent un utilisateur) créant ou modifiant le client possède le rôle spécifié. Pour référencer un rôle de domaine vous pouvez utiliser le rôle de domaine comme 'my_realm-role'. Pour référencer un rôle de client vous pouvez utiliser le format client_id.role_name ; par exemple 'my_client.my_client_role' réfère au rôle de client 'my_client_role' du client 'my_client'.
+clientUpdaterSourceRolesTooltip=La condition est vérifiée pendant l'enregistrement du client ou la requête de mise à jour ; elle est évaluée à vrai si l'entité (souvent un utilisateur) créant ou modifiant le client possède le rôle spécifié. Pour référencer un rôle de domaine vous pouvez utiliser le rôle de domaine comme 'my_realm-role'. Pour référencer un rôle de client vous pouvez utiliser le format client_id.role_name ; par exemple 'my_client.my_client_role' réfère au rôle de client 'my_client_role' du client 'my_client'.
+requestObjectEncryptionHelp=Algorithme JWE qu'un client doit utiliser lors de l'envoi d'un objet de requête OIDC spécifié par les paramètres 'request_uri' ou 'request'. Si mis à 'N'importe' le chiffrage est optionnel et n'importe quel algorithme est utilisé.
+attributeConsumingServiceName=Nom du service de consommation de l'attribut
+promptHelp=Spécifie si le serveur d'autorisation demande à l'utilisateur final de se réauthentifié et de consentir.
+applyPolicyHelp=Spécifie toutes les politiques qui doivent être appliquées aux périmètres définis par cette politique ou permission.
+userAttribute=Attribut utilisateur
+syncUsersError=Impossible de synchroniser les utilisateurs : '{{error}}'
+assertionLifespanHelp=Durée de vie saisie dans les conditions d'assertion SAML. Après cette durée l'assertion sera invalide. L'attribut "SessionNotOnOrAfter" n'est pas modifié et utilise toujours la "Durée maximale de session SSO" définie au niveau du domaine.
+clientUpdaterTrustedHostsTooltip=Liste des hôtes qui sont de confiance. Si l'enregistrement de client ou la requête de mise à jour vient d'un hôte/domaine spécifié dans cette configuration, la condition est évaluée à vrai. Vous pouvez utiliser des noms d'hôtes ou des adresses IP. Si vous utilisez une étoile au début (par exemple '*.example.com'), le nom de domaine entier example.com est considéré comme de confiance.
+deleteClientScope_other=Supprimer {{count}} périmètres client
+generatedAccessTokenHelp=Voir le jeton d'accès d'exemple qui sera généré et envoyé au client quand l'utilisateur sélectionné est authentifié. Vous pouvez voir les attributs et les rôles que le jeton contiendra en fonction des mappeurs de protocole effectifs et des mappings de périmètre de rôle et aussi en fonction des attributs et rôles assignés à l'utilisateur actuel.
+mapperTypeGroupLdapMapperHelp=Utilisé pour mapper les mappings de groupe depuis un LDAP DN vers les mappings de groupe Keycloak
+addTranslationSuccess=Succès ! La traduction a été ajoutée.
+revoke=Révoquer
+admin=Administrateur
+onDragCancel=Glisser déposer annulé. La liste est inchangée.
+sectorIdentifierUri.tooltip=Les fournisseurs qui utilisent des sous valeurs par paires et supportent l'enregistrement dynamique de client DOIVENT utiliser le paramètre sector_identifier_uri. Ceci permet pour un groupe de sites web sous un contrôle administratif commun d'avoir des sous valeurs par paires consistantes indépendamment des noms de domaine individuels. Ceci permet également aux clients de changer les redirect_uri des domaines sans avoir à réenregistrer tous leurs utilisateurs.
+replyToDisplayName=Répondre pour afficher le nom
+removeUser=Supprimer les utilisateurs
+xRobotsTag=Balise X-Robots-Tag
+ldapSearchingAndUpdatingSettings=LDAP recherche et mise à jour
+scopePermissions.users.manage-description=Politiques qui décident si un administrateur peut gérer tous les utilisateurs du domaine
+permissions=Permissions
+syncModeHelp=Mode de synchronisation par défaut pour tous les mappeurs. Le mode de synchronisation détermine quand les données utilisateurs sont synchronisées en utilisant les mappeurs. Trois valeurs possibles existent : 'legacy' pour garder le comportement avant que cette option soit introduite, 'importer' pour importer l'utilisateur seulement une fois, particulièrement pendant la première connexion de l'utilisateur avec ce fournisseur d'identité et 'forcer' pour mettre à jour l'utilisateur à chaque connexion avec ce fournisseur d'identité.
+minimumACRValueHelp=ACR minimum à forcer par Keycloak. Surcharge les ACRs plus faibles demandés explicitement par 'acr_values' ou 'claims' sauf s'ils sont marqués comme essentiels.
+addKerberosWizardDescription=Texte nécessaire ici
+clientPoliciesProfilesHelpText=Un profil client permet de créer un ensemble d'exécuteurs qui force des actions variées qui sont faites avec le client. Les actions peuvent être des actions administrateurs comme créer ou mettre à jour un client ou des actions utilisateurs comme s'authentifier à un client.
+themePreviewInfo=Pour prévisualiser les couleurs du thème le thème actuel doit être celui que vous voulez prévisualiser, nous avons donc automatiquement basculé vers celui que vous voulez prévisualiser.
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.name=Erreur de code utilisateur de vérification d'appareil OAuth2
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.description=Envoyer le lien du fournisseur d'identité
+userInfo=Informations utilisateur
+primaryColor=Couleur primaire
+userProviderSaveError=Le fournisseur de regroupement d'utilisateur ne peut pas être sauvegardé : {{error}}
+protocolTypes.all=Tous
+createUserProviderError=La fournisseur de regroupement d'utilisateur n'a pas été pas créé : {{error}}
+addValidatorRole=Ajouter le validateur {{validatorName}}
+keyAlias=Alias de clé
+signOutAllActiveSessions=Déconnecter toutes les sessions actives
+iconColor=Couleur d'icône
+useDiscoveryEndpointHelp=Si ce paramètre est activé le point de terminaison de découverte sera utilisé pour récupérer la configuration du fournisseur. Keycloak peut charger la configuration depuis le point de terminaison et mettre à jour automatiquement la configuration si la source a eu des modifications.
+ownerManagedAccess=Accès à la gestion des utilisateurs activé
+clientPolicies=Politiques client
+themeColorsDark=Couleurs du thème [dark]
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=Utilisateur désactivé par blocage permanent
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Utilisateur désactivé par blocage temporaire
+templateHelp=Schéma à utiliser pour formatter le nom d'utilisateur à importer. Les substitutions sont entre ${}. Par exemple '${ALIAS}.${CLAIM.sub}'. ALIAS est l'alias du fournisseur. CLAIM.<NAME> référence un identifiant ou un attribut du jeton d'accès. La substitution peut être convertie en majuscule ou en minuscule en ajoutant |uppercase ou |lowercase à la valeur substituée, par exemple '${CLAIM.sub | lowercase}.
+NONE=Aucun
+textColor=Couleur du texte
+selectATheme=Sélectionner un thème
+requirements.DISABLED=Désactivé
+themeColors=Couleurs du thème
+defaults=Remettre par défaut
+backgroundColorAccent=Couleur de fond accent
+keyForCodeExchangeHelp=Choisissez quelle clé de preuve pour l'échange de code (PKCE - Proof Key for Code Exchange) est utilisée. Si non spécifiée, Keycloak n'applique pas PKCE à un client sauf si le client envoie une requête d'autorisation avec un challenge de code et une méthode d'échange de code appropriés.
+attributeGroupHelp=Spécifie le groupe de profil utilisateur où cet attribut sera ajouté. Ceci permet de grouper des attributs similaires variés ensemble sur différentes parties de la page lors de la création ou modification de l'utilisateur.
+reGenerateSigning=Régénérer la clé de signature pour ce client
+deleteConfirmClientScopes=Etes vous sûr de vouloir supprimer ce périmètre client ?
+includeInAccessTokenResponse.tooltip=L'attribut doit il être ajouté à la réponse du jeton d'accès ? Doit être utilisé seulement pour des données informatives et non sensibles
+executorsHelpText=Exécuteurs qui peuvent être appliqués à ce profil client
+defaultACRValuesHelp=Valeurs par défaut à utiliser comme volontaire ACR dans le cas où il n'y a pas d'ACR explicite demandé par les paramètres 'claims' ou 'acr_values' dans la requête OIDC.
+initialCounterErrorHint=La valeur doit être entre 1 et 120
+passLoginHintHelp=Passer login_hint au fournisseur d'identité.
+eventTypes.CLIENT_LOGIN.description=Connexion client
+issuerHelp=L'identifiant de l'émetteur pour l'émetteur de la réponse. Si non fourni aucune validation n'est performée.
+forceAuthenticationHelp=Indique si le fournisseur d'identité doit authentifier le présentateur directement ou plutôt faire confiance à un contexte de sécurité précédent.
+included.client.audience.tooltip=L'ID client de l'audience client spécifiée sera inclus dans le champ audience (aud) du jeton. Si le jeton inclus des audiences la valeur spécifiée y est ajoutée. Cela n'écrasera pas les audiences existantes.
+oidcSettings=Paramètres OpenID Connect
+valueError=Une valeur doit être fournie.
+defaultACRValues=Valeurs par défaut ACR
+passCurrentLocale=Passer la langue actuelle
+minimumACRValue=Valeur minimale ACR
+noConsents=Pas de consentement
+authenticationAliasHelp=Nom de la configuration
+monthHelp=Définie la mois auquel la politique DOIT être accordée. Vous pouvez aussi fournir un intervalle en remplissant le second champ. Dans ce cas la permission est accordée seulement si le mois actuel est dans l'intervalle donnée (bornes inclues).
+connectionTimeout=Timeout de connexion
+policyUsers=Spécifie quel(s) utilisateur(s) est/sont autorisé(s) par cette politique.
+anonymousAccessPoliciesHelp=Ces politiques sont utilisées quand le service d'enregistrement de client est invoqué par une requête non authentifiée. Ceci signifie que la requête ne contient pas de jeton d'accès initial ou de jeton bearer.
+signatureKeyNameHelp=Les documents SAML signés contiennent l'identification de la clé de signature dans l'élément KeyName. Pour Keycloak / les contreparties RH-SSO, utilisez KEY_ID, pour MS AD FS utilisez CERT_SUBJECT, pour les autres vérifications et utilisez NONE si aucune autre option n'a fonctionné.
+tokenClaimName.label=Nom de l'attribut du jeton
+userFedUnlinkUsersConfirmTitle=Désassocier tous les utilisateurs ?
+includeInTokenScopeHelp=Si activé le nom de ce périmètre client sera ajouté à la propriété 'scope' du jeton d'accès ainsi que dans la réponse du point de terminaison de l'introspection du jeton. Si désactivé le périmètre client sera omis du jeton et de la réponse du point de terminaison de l'introspection du jeton.
+decisionStrategyHelp=La stratégie de décision dicte comment les permissions sont évaluées et comment une décision finale est obtenue. 'Affirmatif' signifie qu'au moins une permission doit rendre une décision positive pour donner l'accès à une ressource à ses périmètres. 'Unanime' signifie que toutes les permissions doivent rendre une décision positive pour que la décision finale soit également positive.
+hideOnLoginPage=Cacher sur la page de connexion
+couldNotCreateGroup=Impossible de créer le groupe {{error}}
+rootURL=URL racine ajouté aux URLs relatives
+deleteClientPolicyProfileError=Impossible de supprimer le profil de la politique : {{error}}
+logoutServicePostBindingURLHelp=URL pour les POST SAML pour le service déconnexion simple du client. Vous pouvez laisser ceci vide si vous utilisez autre chose qu'un POST.
+executorsTable=Table d'exécuteurs
+usersAdded_other={{count}} utilisateurs ajoutés au groupe
+groupsPathHelp=Chemin de group Keycloak où les groupes LDAP sont ajoutés. Par exemple si une valeur comme '/Applications/App1' est utilisée alors les groupes LDAP seront disponibles dans Keycloak sous le groupe 'App1' qui est enfant du groupe de plus haut niveau 'Applications'. La valeur par défaut est '/', les groupes seront alors mappés aux groupes Keycloak de plus haut niveau. Le chemin de groupe configuré doit déjà exister dans Keycloak lors de la création de ce mappeur.
+extendToChildren=Etendre à l'enfant
+greaterThan=Doit être supérieur à {{value}}
+defaultRole=Ce rôle sert de conteneur pour à la fois les rôles par défaut de client et de domaine. Il ne peut pas être supprimé.
+editableRowsTable=Table de lignes éditables
+masterSamlProcessingUrl=URL de traitement du maître SAML
+idTokenEncryptionKeyManagementAlgorithm=Algorithme de gestion de clé de chiffrage pour le jeton ID
+setToNowError=Erreur ! Impossible de mettre notBefore à la date et heure actuelles : {{error}}
+eventTypes.UNREGISTER_NODE_ERROR.description=Erreur désenregistrement de nœud
+clientScopeTypes.optional=Optionnel
+eventTypes.SEND_VERIFY_EMAIL_ERROR.name=Erreur envoi de vérification de mail
+validRedirectUri=URLs de redirection valides
+webauthnIntro=Pour quoi est utilisé ce formulaire ?
+wantAssertionsEncryptedHelp=Indique si ce fournisseur de service attend une assertion chiffrée.
+roleObjectClasses=Classes d'objet de rôle
+deleteCredentialsConfirmTitle=Supprimer les identifiants ?
+expires=Expire
+OVERWRITE=Ecraser
+user-clearEventsHelp=Supprime tous les évènements utilisateur de la base de données.
+eventTypes.REFRESH_TOKEN.name=Jeton de rafraîchissement
+keyPasswordHelp=Mot de passe pour la clé privée
+titleRoles=Rôles de domaine
+eventTypes.REVOKE_GRANT.name=Révoquer l'accès
+rdnLdapAttribute=Attribut RDN LDAP
+usedBy=Utilisé par
+bindType=Type d'association
+tokenDeleteSuccess=Jeton d'accès initial supprimé avec succès
+contextualInfo=Information contextuelle
+sslType.none=Aucun
+dateTo=Date (au)
+eventTypes.REVOKE_GRANT.description=Révoquer l'accès
+keyPlaceholder=Taper une clé
+addAuthnContextDeclRef=Ajouter AuthnContext DeclRef
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Jeton de récupération du fournisseur d'identité
+consentScreenText=Texte de la page de consentement
+addRoles=Ajouter les rôles
+archiveFormatHelp=Magasin de clé java ou format d'archive PKCS12.
+xContentTypeOptions=X-Content-Type-Options
+xContentTypeOptionsHelp=La valeur par défaut évite qu'Internet Explorer ou Google Chrome sniffent les MIME d'un réponse d'un type de contenu déclaré. <1>En savoir plus</1>
+privateKeyMask=CLE PRIVEE NON CONFIGUREE OU INCONNUE
+addExecutorSuccess=Succès ! Exécuteur créé avec succès
+executorTypeSelectHelpText=Texte d'aide pour la sélection du type d'exécuteur
+eventTypes.USER_INFO_REQUEST_ERROR.name=Erreur de requête des informations utilisateur
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=Erreur de désactivation de l'utilisateur par blocage permanent
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=Erreur de désactivation de l'utilisateur par blocage temporaire
+userModelAttributeNameHelp=Nom de l'attribut du modèle à ajouter lors de l'import de l'utilisateur depuis le LDAP
+emptyExecutionInstructions=Vous pouvez commencer à définir ce flux en ajoutant un sous flux ou une exécution
+offlineSessionSettings=Paramètres de session hors ligne
+deleteScope=Supprimer définitivement le périmètre d'autorisation ?
+eventTypes.CODE_TO_TOKEN.description=Code vers jeton
+oAuthDevicePollingIntervalHelp=La durée minimale en secondes que le client doit attendre avant deux requêtes d'interrogation du point de terminaison de jetons.
+keystorePasswordHelp=Mot de passe pour le magasin de clé
+clientSettings=Détails de client
+deleteClientPolicyConditionConfirm=Cette action va supprimer définitivement {{condition}}. Aucun retour arrière possible.
+themeColorsLight=Couleurs du thème [light]
+backgroundImage=Image de fond pour la connexion
+favicon=Favicon
+errorColor=Couleur d'erreur
+successColor=Couleur de succès
+activeColor=Couleur active
+primaryColorHover=Couleur primaire hover
+secondaryColor=Couleur secondaire
+linkColor=Couleur des liens
+linkColorHover=Couleur des liens hover
+backgroundColor=Couleur de fond
+backgroundColorNav=Couleur de fond de navigation
+backgroundColorHeader=Couleur de fond d'entête
+lightTextColor=Couleur claire de texte
+inputBackgroundColor=Couleur de fond des entrées
+inputTextColor=Couleur du texte des entrées
+permissionsList=Liste de permissions
+createRealm=Créer un domaine
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=Erreur de validation du jeton d'accès
+mapperSaveError=Erreur sauvegarde du mappeur : {{error}}
+eventTypes.CLIENT_LOGIN_ERROR.name=Erreur de connexion client
+displayOnConsentScreenHelp=Si activé ce périmètre client est ajouté aux clients avec le consentement requis, le texte spécifié par 'Texte page de consentement' sera affiché sur la page de consentement. Si désactivé ce périmètre client ne sera pas affiché sur la page de consentement.
+mapperTypeHardcodedLdapGroupMapperHelp=Les utilisateurs importés depuis le LDAP seront automatiquement ajoutés dans ce groupe configuré.
+whoWillAppearLinkText=Qui apparaîtra dans cette liste de groupes ?
+ldapFullNameAttribute=Attribut nom complet LDAP
+createClientError=Impossible de créer le client : '{{error}}'
+testClusterAvailability=Test de disponibilité de cluster
+authorizationEncryptedResponseAlgHelp=Algorithme JWA utilisé pour la gestion des clés dans le chiffrage de la réponse d'autorisation quand le mode de réponse est jwt. Cette option est obligatoire si vous voulez chiffrer la réponse d'autorisation. Si laissé vide la réponse d'autorisation est seulement signée mais pas chiffrée.
+deleteConfirmGroup_other=Etes vous sûr de vouloir supprimer ces groupes ?
+membershipAttributeType=Type d'attribut d'appartenance
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Requête de poussée d'autorisation
+allowCreateHelp=Autorise le fournisseur d'identité externe à créer un nouvel identifiant pour représenter le principal.
+allResults=Tous les résultats
+addressClaim.locality.tooltip=Nom de l'attribut utilisateur qui sera utilisé pour mapper le sous attribut 'locality' dans l'attribut du jeton 'address'. Par défaut 'locality'.
+removeMappingConfirm_one=Etes vous sûr de vouloir supprimer ce rôle ?
+otpPolicyDigitsHelp=Comment de nombres doit avoir l'OTP ?
+clientAuthentications.client_secret_post=Secret client envoyé comme post
+prompts.select_account=Sélectionner le compte
+orderChangeSuccessUserFed=Ordre de priorité des fournisseurs de regroupement d'utilisateurs changé avec succès
+noUsersEmptyStateDescriptionContinued=pour les trouver. Les utilisateurs qui ont déjà ce rôle comme rôle effectif ne peuvent pas être ajoutés ici.
+deleteClientPolicyConditionConfirmTitle=Supprimer la condition ?
+registrationAccessToken=Enregistrement du jeton d'accès
+headerName=Nom d'entête
+dedicatedScopeName=Dédie à {{clientName}}
+mapperTypeUserAttributeLdapMapper=user-attribute-ldap-mapper
+deleteAttributeConfirmTitle=Supprimer l'attribut ?
+importSkipped_zero=Pas d'enregistrements passés.
+contentSecurityPolicyHelp=La valeur par défaut empêche les pages d'être incluses par des non-origin iframes. <1>En savoir plus</1>
+generatedIdTokenNo=Pas de jeton ID généré
+byConfiguration=Par configuration
+realmNameField=Nom du domaine
+roleCreated=Rôle créé
+socialProfileJSONFieldPath=Chemin JSON du champ profil social
+noViewRights=Vous n'avez pas les droits pour voir ce groupe.
+eventTypes.SEND_RESET_PASSWORD.description=Envoyer la réinitialisation de mot de passe
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=Liaison du compte client initiée
+resourceScopeError=Impossible de supprimer le périmètre d'autorisation à cause de {{error}}
+identityInformation=Information d'identité
+usermodel.clientRoleMapping.rolePrefix.label=Préfixe du rôle client
+partialImport=Import partiel
+cibaBackhannelTokenDeliveryModes.ping=Ping
+noRolesInstructions-users=Vous n'avez assigné aucun rôle à cet utilisateur. Assignez un rôle pour commencer.
+sync-keycloak-roles-to-ldap=Synchroniser les rôles Keycloak au LDAP
+decisionStrategies.UNANIMOUS=Unanime
+cacheSettingsDescription=Cette section contient des options utiles pour mettre des utilisateurs dans le cache qui ont été chargés depuis le fournisseur de stockage de cet utilisateur.
+aesGenerated=aes-generated
+addPolicy=Ajouter une politique
+eventConfigs=Configuration d'évènement
+conditionsHelp=Conditions qui seront évaluées pour déterminer si la politique client doit être appliquée durant une action particulière ou non.
+disableProvider=Désactiver le fournisseur ?
+eventTypes.UNREGISTER_NODE.name=Désenregistrer le nœud
+webAuthnPolicyAcceptableAaguidsHelp=La liste des AAGUIDs autorisés qu'un authentificateur peut enregistrer. Un AAGUID est identifiant de 128 bits indiquant le type d'authentificateur.
+clientScopeError=Impossible de mettre à jour le mapping de périmètre {{error}}
+saveRealmSuccess=Domaine créé avec succès
+createToken=Créer un jeton d'accès initial
+logoUrl=URL du logo
+orderChangeSuccess=Ordre d'affichage des fournisseurs d'identité changé avec succès
+emptyPoliciesInstructions=Si vous voulez créer une politique merci de cliquer sur le bouton ci dessous pour créer une politique.
+clientsClientTypeHelp='OpenID Connect' autorise les clients à vérifier l'identité de l'utilisateur final en fonction de l'authentification performée par un serveur d'autorisation. 'SAML' active l'authentification basée sur le web et les scenarios d'autorisation incluant le cross-domain single sign-on (SSO) et utilise les jetons de sécurité contenant les assertions pour passer l'information.
+createScopeSuccess=Périmètre d'autorisation créé avec succès
+accessTokenLifespanImplicitFlowHelp=Durée maximale avant expiration d'un jeton d'accès généré pendant un flux implicite OpenID Connect. Il est recommandé que cette valeur soit plus courte que le timeout SSO. Il n'y a pas la possibilité de rafraîchir un jeton pendant un flux implicite, c'est pourquoi il y a un timeout différent de la 'Durée de la vie du jeton d'accès'.
+searchForUserEvent=Chercher un évènement utilisateur
+noRealmRolesToAssign=Il n'y a aucun rôle de domaine à assigner
+logoutUrl=URL de déconnexion
+regexPatternHelp=Spécifie l'expression régulière.
+removeImportedUsersMessage=Vous voulez vraiment supprimer tous les utilisateurs importés ?
+hideMetaData=Cacher les métadonnées
+deletePolicy=Supprimer définitivement la politique ?
+artifactResolutionService=Service de résolution d'artifact
+usernameLdapAttributeHelp=Nom de l'attribut LDAP qui est mappé comme nom d'utilisateur Keycloak. Pour la plupart des fournisseurs de serveur LDAP ça peut être 'uid'. Pour l'Active Directory ça peut être 'sAMAccountName' ou 'cn'. L'attribut doit être rempli pour tous les enregistrements utilisateur LDAP que vous voulez importer depuis le LDAP vers Keycloak.
+addClientScope=Ajouter un périmètre client
+connectionPoolingHelp=Détermine si Keycloak doit utiliser l'interrogation régulière de connexion pour accéder au serveur LDAP. L'interrogation régulière de connexion ne peut pas être utilisée si StartTLS est activé.
+encryptionKeysConfigExplain=Si vous activez le "Chiffrage des assertions" ci dessous vous devez configurer les clés de chiffrage en générant ou important des clés et les assertions SAML seront chiffrées avec la clé publique du client en utilisant AES.
+webAuthnPolicyPasswordlessFormHelp=Politique sans mot de passe pour l'authentification WebAuthn. Cette politique est utilisée par l'action obligatoire 'L'enregistrement sans mot de passe WebAuthn' et par l'authentificateur 'Authentificateur sans mot de passe WebAuthn'. Une utilisation typique est lorsque WebAuthn est utilisé comme premier facteur d'authentification. Avoir une 'Politique WebAuthn' et une 'Politique sans mot de passe WebAuthn' permet d'utiliser WebAuthn comme authenticateur premier et second facteur dans le même domaine.
+providers=Ajouter des fournisseurs
+filenamePlaceholder=Uploader un fichier PEM ou coller la clé ci dessous
+authenticationOverrides=Surcharges de flux d'authentification
+membership=Appartenance
+clientProfilesSubTab=Sous onglet de profils client
+emptyRealmBasedIdps=Aucun domaine basé sur des fournisseurs d'identité configuré pour ce domaine.
+value=Valeur
+removeMappingTitle=Supprimer le rôle ?
+unanimous=Unanime
+deleteConfirm_one=Etes vous sûr de vouloir supprimer ce groupe '{{groupName}}'.
+customAttribute=Attribut personnalisé…
+ellipticCurve=Courbe elliptique
+forceArtifactBindingHelp=Les messages de réponse doivent ils être retournés au client par le système d'ARTIFACT SAML ?
+claimFilterName=Attribut essentiel
+searchFor=Chercher un rôle par nom
+policy-name=Le nom de cette politique.
+usermodel.prop.label=Propriété
+realmSettingsExplain=Les paramètres de domaine sont les paramètres qui contrôlent les options pour les utilisateurs, applications, rôles et groupes du domaine actuel.
+defaultRoleDeleteError=Vous ne pouvez pas supprimer un rôle par défaut.
+userVerify.not\ specified=Non spécifié
+deleteAttributeSuccess=Attribut supprimé
+groupUpdated=Groupe mis à jour
+notBeforeSuccess=Succès ! "Not Before" saisi pour ce domaine
+clientPoliciesSubTab=Sous onglet politiques client
+federationLink=Lien du regroupement
+unlinkUsersError=Impossible de désassocier les utilisateurs : '{{error}}'
+roleHelpHelp=Rôle à accorder à l'utilisateur. Cliquez le bouton 'Sélectionner le rôle' pour naviguer dans les rôles ou écrivez le dans la boite de texte. Pour référencer un rôle d'application la syntaxe est appname.approle, par exemple myapp.myrole.
+storedTokensReadable=Jetons stockés lisibles
+unknownUser=Anonyme
+displayHeader=Afficher le nom
+userFedUnlinkUsersConfirm=Voulez vous désassocier tous les utilisateurs ? Tous les utilisateurs sans mot de passe en base de données ne pourront plus s'authentifier.
+eventTypes.REMOVE_FEDERATED_IDENTITY.name=Supprimer l'identité regroupée
+eventTypes.RESET_PASSWORD.description=Réinitialiser le mot de passe
+client-scopes-condition.label=Périmètres attendus
+selectEncryptionType=Sélectionner le type de chiffrage
+mapperTypeMsadLdsUserAccountControlMapper=msad-user-account-control-mapper
+mappingUpdatedError=Impossible de mettre à jour le mapping : '{{error}}'
+manageDisplayOrder=Gérer l'ordre d'affichage
+scopeDisplayNameHelp=Un nom unique pour ce périmètre. Le nom peut être utilisé pour identifier de manière unique un périmètre, utile lors de la requête d'un périmètre spécifique.
+executorTypeSelectAlgorithm=Algorithme de sélection du type d'exécuteur
+resources=Ressources
+userRolesRetrieveStrategy=Stratégie de récupération des rôles utilisateur
+importKey=Importer la clé
+forceAuthentication=Forcer l'authentification
+unlink=Désassocier
+groupRemove_other=Groupes supprimés
+writeOnly=En écriture seule
+noRolesInstructions-clientScopes=Vous n'avez créé aucun rôle pour ce périmètre client. Créer un rôle pour commencer.
+noRolesInstructions-clients=Vous n'avez créé aucun rôle pour ce périmètre client. Créer un rôle pour commencer.
+noGroupsInThisSubGroup=Pas de groupe dans ce sous groupe
+validateUserObjectClasses=Vous devez entrer une ou plusieurs classes d'objet utilisateur
+encryptionAlgorithm=Algorithme de chiffrage
+requiredForLabel.users=Seulement les utilisateurs
+quickLoginCheckMilliSecondsHelp=Si un échec arrive de manière concurrente trop rapidement, bloque l'utilisateur.
+syncRegistrations=Synchroniser les enregistrements
+eventTypes.REMOVE_TOTP.name=Supprimer totp
+clientHelp=Sélectionner le client demandant cette requête d'autorisation. Si non fourni les requêtes d'autorisation seront faites en fonction du client sur lequel vous êtes.
+eventTypes.CLIENT_REGISTER_ERROR.name=Erreur enregistrement client
+unlockUsersError=Impossible de débloquer tous les utilisateurs {{error}}
+serviceProviderEntityIdHelp=L'ID de l'entité qui sera utilisée pour identifier de manière unique ce fournisseur de service SAML.
+disabledFeatures=Fonctionnalités désactivées
+eventTypes.UPDATE_CONSENT_ERROR.name=Erreur mise à jour du consentement
+noAdminUrlSet=Aucune poussée envoyée. Pas d'URL administrateur configurée ou de nœuds de cluster enregistrés disponibles
+authData=Données d'autorisation
+chooseAPolicyType=Choisir un type de politique
+deleteExecutorError=Impossible de supprimer l'exécuteur : {{error}}
+userProfileError=Impossible de mettre à jour les paramètres de profil utilisateur : {{error}}
+validatorDialogColNames.colName=Nom de rôle
+UPDATE_PASSWORD=Mettre à jour le mot de passe (UPDATE_PASSWORD)
+version=Version
+synchronizationSettings=Paramètres de synchronisation
+certificateHelp=Certificat client pour valider le JWT généré par le client et signé par la clé privée du client depuis votre magasin de clé.
+resetPasswordError=Erreur pendant la réinitialisation du mot de passe : {{error}}
+associatedPermissions=Permission associée
+clientType=Type de client
+preserveGroupInheritanceHelp=Flag pour savoir si l'héritage de groupe du LDAP doit être propagé à Keycloak. Si désactivé tous les groupes LDAP seront mappés platement aux groupes de haut niveau dans Keycloak. Sinon l'héritage de groupe est préservé dans Keycloak mais la synchronisation du groupe peut échouer si la structure LDAP contient de la récursion ou plusieurs parents par groupes enfants.
+attributePermissionDescription=Cette section contient les permissions pour qui peut éditer et qui peut voir l'attribut.
+close=Fermer
+userLdapFilterHelp=Filtre LDAP additionnel pour filtrer les utilisateurs recherchés. Laissez ceci vide si vous n'avez pas besoin d'un filtre additionnel. Le filtre doit commencer un '(' et finir par ')'.
+decisionStrategy=Stratégie de décision
+eventTypes.VERIFY_EMAIL_ERROR.description=Erreur vérification de mail
+usersDNHelp=DN complet de l'arbre LDAP où vos utilisateurs existent. Ce DN est le parent des utilisateurs LDAP. Cela pourrait être par exemple 'ou=users,dc=example,dc=com' en partant du principe que votre utilisateur typique aurait un DN comme 'uid='john',ou=users,dc=example,dc=com'.
+deleteClientPolicy=Supprimer la politique client
+editCondition=Editer la condition
+ssoSessionMaxRememberMe=Durée maximale avant expiration d'une session quand l'utilisateur a utilisé l'option Se souvenir de moi. Les jetons et les sessions navigateur sont invalidés quand la session est expirée. Si non saisie la Durée maximale d'un session SSO est utilisée à la place.
+mapperTypeMsadLdsUserAccountControlMapperHelp=Mappeur spécifique au MSAD LDS. Il peut d'intégrer l'état du compte utilisateur MSAD LDS dans l'état du compte Keycloak (compte activé, mot de passe expiré et autres). Il lit les attributs 'msDS-UserAccountDisabled', 'msDS-UserPasswordExpired' et 'pwdLastSet pour ceci. Par exemple si 'pwdLastSet' est 0, l'utilisateur Keycloak doit mettre à jour son mot de passe. Autre exemple, si 'msDS-UserAccountDisabled' est 'TRUE' l'utilisateur Keycloak est également désactivé. Ce mappeur est aussi capable de gérer les codes d'exception de l'authentification utilisateur LDAP.
+clientUpdaterSourceGroupsTooltip=Nom des groupes à vérifier. La condition est évaluée à vrai si l'entité qui crée ou met à jour le client est un membre d'un ou plusieurs des groupes spécifiés. Les groupes configurés sont spécifiés par leur nom, qui doivent correspondre au nom de groupe Keycloak. Aucun support pour la hiérarchie de groupe est utilisé ici.
+jwksUrlHelp=URL où les clés au format JWK du fournisseur d'identité sont stockées. Voir les spécifications JWK pour plus de détails. Si vous utilisez un fournisseur d'identité externe Keycloak vous pouvez utilisez une URL comme 'http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs' en partant du principe que votre Keycloak intermédiaire tourne sur 'http://broker-keycloak:8180' et que son domaine est 'test'.
+fromDisplayNameHelp=Un nom user-friendly pour l'adresse 'De' (optionnel).
+clientOfflineSessionIdleHelp=Durée maximale où une session client hors ligne peut être inactive avant qu'elle n'expire. Les jetons hors ligne sont invalidés quand session client hors ligne expire. L'option n'affecte pas la session globale de l'utilisateur SSO. Si non saisie la durée d'inactivité d'une session hors ligne du domaine est utilisée.
+userInitiatedActionLifespan=Durée de vie des actions initiés par un utilisateur
+clientSessionMax=Durée maximale de session client
+eventTypes.CLIENT_REGISTER.description=Enregistrement de client
+decisionStrategies.AFFIRMATIVE=Affirmatif
+helpEnabled=Aide activé
+times.years=Années
+oAuthDeviceCodeLifespanHelp=Durée maximale d'expiration du code d'appareil et du code utilisateur. Cette valeur doit être suffisamment longue pour être utilisable (permettant à l'utilisateur de récupérer son second appareil, naviguer sur l'URL de vérification etc) mais suffisamment courte pour limiter l'utilisation d'un code obtenu par phishing.
+clientUpdaterContext=La condition vérifie le contexte et comment le client est créé ou mis à jour puis détermine si la politique doit être appliquée. Par exemple elle vérifie si le client est créé via un appel de l'API REST administrateur ou via l'enregistrement de client dynamique OIDC. Pour ce dernier cas elle vérifie si c'est un enregistrement de client ANONYMOUS ou un enregistrement de client AUTHENTICATED avec un jeton d'accès initial ou un enregistrement via un jeton d'accès et ainsi de suite.
+targetOptions.local=LOCAL
+scopePermissions.clients.manage-description=Politiques qui décident si un administrateur peut gérer ce client
+disabled=Désactivé
+eventTypes.CODE_TO_TOKEN.name=Code vers jeton
+showMore=Montrer plus
+operationType=Type d'opération
+roleMappingUpdatedSuccess=Mapping de rôle mis à jour
+emptyStateInstructions=Si vous voulez ajouter un groupe d'attributs cliquez sur le bouton ci dessous.
+logoutAllSessionsError=Erreur ! Impossible de déconnecter toutes les sessions : {{error}}.
+eventTypes.VERIFY_EMAIL_ERROR.name=Erreur de vérification de mail
+partialExport=Export partiel
+generalOptions=Options générales
+defaultGroupsHelp=Les groupes par défaut vous permettent d'assigner automatiquement l'appartenance à des groupes quand un utilisateur est créé ou importé via un <1>intermédiaire d'identité<1>.
+generatedIdToken=Jeton ID généré
+effectiveRoleScopeMappings=Mappings de périmètre de rôle effectif
+clientAuthenticator=Authentificateur client
+importAdded_other={{count}} enregistrements ajoutés.
+dynamicScopeHelp=Si activé ce périmètre sera considéré comme un périmètre dynamique et sera composé d'un partie statique et d'une partie variable.
+providerDetails=Détails du fournisseur
+groupDeleteError=Erreur à la suppression du groupe {{error}}
+editGroupText=Editer le groupe d'attributs
+updateFirstLoginHelp=Mettre à jour le profil à la première connexion
+deleteGroup=Supprimer le groupe
+addKeycloakOpenIdProvider=Ajouter un fournisseur OpenID Connect Keycloak
+authenticatorAttachment.cross-platform=Multi plateforme
+whoCanView=Qui peut voir ?
+lastAccess=Dernier accès
+emptyClientScopesInstructions=Il n'y a actuellement aucun périmètres client liés à ce client. Vous pouvez ajouter des périmètres client existants à ce client pour partager des mappeurs de protocole et des rôles.
+clientAuthentications.private_key_jwt=JWT signé avec un clé privée
+uiDisplayName=Nom d'affichage sur l'interface
+createClientSuccess=Client créé avec succès
+adminEventsSettings=Paramètres des évènements administrateurs
+cibaInterval=Intervalle
+totalMemory=Mémoire totale
+usernameTemplateImporter=Formatter le nom d'utilisateur à importer.
+resourceNameHelp=Un nom unique pour cette ressource. Le nom peut être utilisé pour identifier de manière unique une ressource, utile lors de la requête d'une ressource spécifique.
+disableUserInfo=Désactiver les informations utilisateur
+authorizationEncryptedResponseEnc=Algorithme de chiffrage du contenu de la réponse d'autorisation
+viewCondition=Voir la condition
+forcePostBinding=Forcer un POST
+forceNameIdFormatHelp=Ignore le format du sujet du NameID requêté et utilisé celui configuré dans la console Administrateur.
+replyToDisplayNameHelp=Un nom user-friendly for l'adresse 'Répondre à' (optionnel).
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.description=Erreur liaison de comte client initiée
+oAuthDPoPHelp=Ceci active le support pour le Demonstrating Proof-of-Possession (DPoP) des jetons. Les jetons d'accès et de rafraîchissement sont liés à la clé stockée sur l'agent utilisateur. Pour prouver la possession de la clé l'agent utilisateur doit envoyer une preuve signée avec le jeton.
+logoutServiceRedirectBindingURLHelp=URL de redirection SAML for le service de déconnexion simple du client. Vous pouvez laisser ceci vide si vous utilisez un binding différent.
+federationLinkHelp=UserStorageProvider depuis lequel cet utilisateur stocké localement a été importé.
+addressClaim.formatted.tooltip=Nom de l'attribut utilisateur à utiliser pour mapper le sous attribut 'formatted' dans l'attribut de jeton 'address'. Par défaut 'formatted'.
+allowedClockSkew=Tick d'horloge autorisé
+usermodel.clientRoleMapping.clientId.tooltip=ID client pour les mappings de rôle. Seulement les rôles client de ce client seront ajoutés au jeton. Si non saisi les rôles client de tous les clients seront ajoutés au jeton.
+pkceMethodHelp=Méthode PKCE à utiliser
+encryption=Chiffrage
+vendor=Fournisseur
+roleRemoveAssociatedText=Cette action supprimera {{role}} de {{roleName}}. Tous les rôles associés à {{role}} seront également supprimés.
+idpInitiatedSsoRelayState=Etat de relai du SSO initié IDP
+attribute=Attribut
+clientScopesConditionTooltip=La liste des périmètres client attendus. La condition est évaluée à vrai si la requête client spécifiée correspond à certains des périmètres client. Ceci dépend également s'il s'agit de périmètres client par défaut ou optionnels en fonction du 'Type de périmètre' configuré.
+principalAttributeHelp=Nom ou nom amical de l'attribut utilisé pour identifier les utilisateurs externes.
+nameIdPolicyFormat=Format de la politique NameID
+idpInitiatedSsoUrlName=Nom de l'URL SSO IDP initié
+selectMethod=Sélectionner la méthode
+deleteConfirmExecution=Supprimer le flux {{name}} ?
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Erreur validation du jeton d'accès
+scopeDescriptionHelp=Description du périmètre client
+deletedErrorRealmSetting=Impossible de supprimer le domaine : {{error}}
+copyInitialAccessToken=Merci de copier coller le jeton d'accès initial avant de fermer car il ne pourra pas être récupéré plus tard.
+consensus=Consensus
+scopePermissions.roles.map-role-composite-description=Politique qui décide si un administrateur peut appliquer ce rôle comme un composé d'un autre rôle
+emptyEvents=Rien à ajouter
+residentKey.Yes=Oui
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.name=Envoyer le lien du fournisseur d'identité
+ssoSessionIdleRememberMe=Durée d'inactivité avant expiration d'une session quand l'utilisateur a utilisé l'option Se souvenir de moi. Les jetons et les sessions navigateur sont invalidés quand la session est expirée. Si non saisie la Durée d'inactivité d'une session SSO est utilisée à la place.
+SSOSessionIdleRememberMe=Durée d'inactivité d'une session SSO Se souvenir de moi
+cibaBackchannelTokenDeliveryModeHelp=Spécifie comment le CD (Consumption Device) obtient le résultat de l'authentification et les jetons associés. Ce mode sera utilisé par défaut pour les clients CIBA qui n'ont pas d'autre mode configuré explicitement.
+eventTypes.REGISTER_NODE.description=Enregistrer le nœud
+supported=Supporté
+deleteAttributeText=Supprimer un attribut
+deleteNodeSuccess=Nœud supprimé avec succès
+includeInIntrospection.label=Ajouter à l'introspection du jeton
+roleImportSuccess=Rôle importé avec succès
+tokenUrl=URL jeton
+executionConfig={{name}} configuration
+grantedClientScopes=Périmètres client accordés
+keyError=Une clé doit être fournie.
+addAnnotationText=Ajouter une annotation
+clientProfileName=Nom du profil client
+effectiveProtocolMappers=Mappeurs de protocole effectifs
+userVerify.preferred=Préféré
+syncModes.legacy=Legacy
+addTranslationError=Erreur à la création de la traduction {{error}}
+timestamp=Date de création
+addExecutorError=Exécuteur non créé : {{error}}
+policySaveError=Impossible de mettre à jour la politique : {{error}}
+experimental=Expérimental
+deleteResourceConfirm=Si vous supprimez cette ressource, certaines autorisations seront affectées.
+tokenLifespan.inherited=Hérités à partir des paramètres du domaine
+saveEvents=Enregistrer les événements
+issuer=Demandeur
+selectAUser=Sélectionner un utilisateur
+groupCreated=Groupe créé
+generateError=Impossible de générer une nouvelle partie de clés et un certificat : {{error}}
+newRoleName=Nouveau nom de rôle
+ldapGeneralOptionsSettingsDescription=Cette section contient quelques informations basiques communes à tous les fournisseurs de stockage.
+savePasswordSuccess=Le mot de passe de mot a été mis à jour avec succès.
+description=Description
+searchUserEventsBtn=Chercher des évènements
+generatedUserInfoNo=Pas d'informations utilisateur générées
+allowed-client-scopes.label=Périmètres client autorisés
+addClientProfile=Ajouter un profil client
+eventTypes.OAUTH2_DEVICE_AUTH.description=Authentification appareil OAuth2
+eventTypes.UPDATE_TOTP_ERROR.description=Erreur mise à jour totp
+signServiceProviderMetadata=Signer les métadonnées du fournisseur de service
+updateClientPoliciesError=Impossible de mettre à jour les politiques client : {{error}}
+acceptsPromptNoneHelp=Ceci est utilisé seulement avec l'authentificateur du fournisseur d'identité ou quand kc_idp_hint pointe vers ce fournisseur d'identité. Si ce client envoie une requête avec prompt=none et l'utilisateur n'est pas authentifié l'erreur n'est pas directement retourné au client ; la requête avec pompt=none est transférée à ce fournisseur d'identité.
+roleDetails=Détails du rôle
+eventTypes.USER_INFO_REQUEST.name=Requête informations utilisateur
+clientScopeType.none=Aucun
+results=Résultats
+roleDeleteError=Impossible de supprimer le rôle : {{error}}
+selectScope=Sélectionner un périmètre
+attributeDefaultValue=Valeur par défaut de l'attribut
+eventTypes.UPDATE_PASSWORD_ERROR.name=Erreur mise à jour de mot de passe
+addGroups=Ajouter les groupes
+offlineSessionIdle=Inactivité session hors ligne
+mapperAttributeFriendlyName=Nom amical
+addProvider=Ajouter un fournisseur
+readOnlyHelp=Attribut en lecture seule qui est importé depuis le LDAP vers le UserModel mais qui n'est pas sauvegardé en retour dans le LDAP quand l'utilisateur est mis à jour sur Keycloak.
+resourceDeletedError=Impossible de supprimer la ressource {{error}}
+backchannelLogoutUrl=URL de déconnexion du canal secondaire
+requestObjectEncodingHelp=Algorithme JWE que le client doit utiliser lors du chiffrage du contenu d'un objet de requête OIDC spécifié par les paramètres 'request' ou 'request_uri'. Si mis à 'N'importe' n'importe quel algorithme est utilisé.
+duplicate=Dupliquer
+clientAccesstype=Type d'accès client
+roleDeleteConfirm=Supprimer le rôle ?
+createClientProfileNameHelperText=Le nom doit être unique dans le domaine
+disabledHelp=Un utilisateur désactivé ne peut pas se connecter.
+eventTypes.UPDATE_PROFILE_ERROR.name=Erreur mise à jour du profil
+deleteConfirmDialog_other=Etes vous sûr de vouloir désactiver définitivement {{count}} utilisateurs sélectionnés
+targetOptions.brokerUsername=BROKER_USERNAME
+eventTypes.REGISTER_ERROR.description=Erreur d'enregistrement
+infoDisabledFeatures=Montre toutes les fonctionnalités désactivées.
+userSession.modelNote.label=Note session utilisateur
+next=Suivant
+previous=Précédent
+pagination=Pagination
+changeAuthenticatorConfirm=Si vous changer l'authentificateur à {{clientAuthenticatorType}} la base de données Keycloak sera mise à jour et vous devrez peut être télécharger une nouvelle configuration d'adaptateur pour ce client.
+import=Importer
+otpHashAlgorithm=Algorithme de hash OTP
+importFail=Import échoué : {{error}}
+show=Montrer
+alwaysReadValueFromLdap=Toujours lire la valeur depuis le LDAP
+addressClaim.postal_code.tooltip=Nom de l'attribut utilisateur qui sera utilisé pour mapper le sous attribut 'postal_code' dans l'attribut de jeton 'address'. Par défaut 'postal_code'.
+providerId=ID du fournisseur
+assignedClientScope=Périmètre client assigné
+Tuesday=Mardi
+idTokenEncryptionContentEncryptionAlgorithm=Algorithme de chiffrage du contenu du jeton ID
+emptyInstructions=Changez vos critères de recherche ou ajoutez un utilisateur
+tableView=Vue en tableau
+userEventsRegistered=Evènements utilisateurs enregistrés
+eventConfigError=Impossible de sauvegarder la configuration de l'évènement : {{error}}
+confirmAccessTokenTitle=Régénérer l'enregistrement du jeton d'accès ?
+target=Cible
+impersonateConfirmDialog=Etes vous sûr de vouloir vous connectez en tant que cet utilisateur ? Si cet utilisateur est le même domaine que vous, votre session actuelle sera déconnectez avant que vous vous connectiez en tant que cet utilisateur.
+alwaysDisplayInUI=Toujours afficher dans l'interface
+protocolMapper=Protocole...
+requiredSettings=Paramètres obligatoires
+oneLevel=Un niveau
+userSaved=L'utilisateur a été sauvegardé
+useRefreshTokens=Utiliser les jetons de rafraîchissement
+standardFlowHelp=Ceci active la redirection standard OpenID Connect basée sur l'authentification avec le code d'autorisation. En termes de spécifications OpenID Connect ou OAuth2 ceci active le support de 'Authorization Code Flow' pour ce client.
+clientDeleteConfirm=Si vous supprimez ce client toutes les données associées seront supprimées.
+derFormattedHelp=Activez ceci si le certificat est au format DER dans le LDAP et pas au format PEM.
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=Après connexion au fournisseur d'identité
+notBeforeClearedSuccess=Succès ! "Not Before" supprimé pour ce domaine.
+idTokenSignatureAlgorithmHelp=Algorithme JWA utilisé pour signer les jetons ID.
+memberofLdapAttribute=Attribut LDAP Membre De
+listExplain=Les fournisseurs d'identité sont des réseaux sociaux ou des intermédiaires d'identité qui autorisent les utilisateurs à s'authentifier à Keycloak.
+allowRegexComparisonHelp=Si désactivé le sujet du DN du certificat client donné doit correspondre exactement au DN donné par la propriété 'Sujet DN' comme décrit dans les spécifications RFC8705. Le sujet DN peut être dans les formats RFC4514 ou RFC1779. Si activé le sujet DN du certificat client donné doit correspondre à l'expression régulière spécifiée dans la propriété 'Sujet DN'.
+scopePermissions.users.view-description=Politiques qui décident si un administrateur voir tous les utilisateurs du domaine
+userRolesRetrieveStrategyHelp=Spécifie comment récupérer les rôles d'un utilisateur. LOAD_ROLES_BY_MEMBER_ATTRIBUTE signifie que les rôles de l'utilisateur seront récupérés en envoyant une requête LDAP pour récupérer tous les rôles où 'membre' est notre utilisateur. GET_ROLES_FROM_USER_MEMBEROF signifie que les rôles de l'utilisateur seront récupérés depuis l'attribut 'membreOf' de notre utilisateur ou depuis l'attribut spécifié par 'Attribut LDAP Membre De'. LOAD_ROLES_BY_MEMBER_ATTRIBUTE est applicable seulement pour l'Active Directory et signifie que les rôles de l'utilisateur seront récupérés récursivement avec l'utilisation de l'extension LDAP LDAP_MATCHING_RULE_IN_CHAIN .
+importSkipped_one=Un enregistrement passé.
+whoWillAppearLinkTextRoles=Qui sera affiché dans cette liste d'utilisateurs ?
+attestationPreference.not\ specified=Non défini
+implicitFlowHelp=Ceci active le support pour la redirection OpenID Connect basée sur l'authentification sans code d'autorisation. En termes de spécifications OpenID Connect et OAuth2 ceci active le support du 'Implicit Flow' pour ce client.
+executorType=Type d'exécuteur
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Après connexion au fournisseur d'identité
+sync-ldap-groups-to-keycloak=Synchroniser les groupes LDAP à Keycloak
+cibaExpiresInHelp=La durée d'expiration de la "auth_req_id" en secondes depuis que la requête d'authentification a été reçue.
+xFrameOptionsHelp=La valeur par défaut empêches les pages d'être incluses par des non-origin iframes. <1>En savoir plus</1>
+samlSignatureKeyName=Nom de la clé de signature SAML
+valuePlaceholder=Taper une valeur
+roleImportError=Impossible d'importer le rôle
+policyProvider.group=Définie les conditions pour vos permissions où un ensemble d'un ou plusieurs groupes (et leur hiérarchie) est autorisé à accéder à un objet.
+deletePermission=Supprimer la permission définitivement ?
+policyProvider.time=Définie les conditions de temps pour vos permissions.
+deleteFlowError=Impossible de supprimer le flux : {{error}}
+updateFlowError=Impossible de mettre à jour le flux : {{error}}
+noRoles-clients=Pas de rôles pour ce périmètre client
+configureMappingDescription=Choisissez n'importe lequel des mappings de ce tableau
+validateUsersDn=Vous devez entrer les utilisateurs DN
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.description=Erreur compte de lien du fournisseur d'identité
+deleteValidatorConfirmTitle=Supprimer le validateur ?
+kc.client.network.ip_address=Adresse IPv4 client
+eventTypes.IMPERSONATE_ERROR.name=Erreur d'ursurpation
+permissionsScopeName=Nom du périmètre
+selectUser=Sélectionner un utilisateur duquel l'identité sera utilisée pour requêter les permissions depuis le serveur.
+deleteRealm=Supprimer le domaine
+realmExplain=Un domaine gère un ensemble d'utilisateurs, identifiants, rôles et groupes. Un utilisateur appartient et se connecte à un domaine. Les domaines sont séparés les uns des autres et peuvent gérer et authentifier seulement les utilisateurs qu'ils contrôlent.
+testClusterSuccess=Disponibilité vérifiée avec succès pour : {{successNodes}}
+importConfigHelp=Importer les métadonnées depuis un descripteur de découverte IDP téléchargé.
+targetClaim=Attribut cible
+accessSettings=Paramètres d'accès
+updateFlowSuccess=Flux mis à jour avec succès
+authenticatedAccessPolicies=Politiques d'accès authentifiés
+addExecutor=Ajout l'exécuteur
+selectIfResourceExists=Si une ressource existe déjà , spécifie ce qui doit être fait
+deleteAttributeGroupError=Impossible de supprimer le groupe d'attributs utilisateur : {{error}}
+signatureAndEncryption=Signature et chiffrage
+reset=Réinitialiser
+hardcodedUserSessionAttribute=Quand un utilisateur est importé depuis un fournisseur, harcode une valeur pour un attribut spécifique de session utilisateur.
+clientImportSuccess=Client importé avec succès
+dragHelp=Appuyer sur espace ou entrer pour commencer à glisser et utiliser les flèches directionnelles pour naviguer pour le haut ou vers le bas. Appuyer sur entrer pour déposer ou n'importe quelle autre touche pour annuler le glisser.
+keystorePassword=Mot de passe du magasin de clé
+mapperTypeHardcodedLdapRoleMapperHelp=Les utilisateurs importés depuis le LDAP seront automatiquement ajoutés dans ce rôle configuré.
+more={{count}} de plus
+clientNameHelp=Spécifie le nom affiché pour le client. Par exemple 'My Client'. Supporte les clés de traduction également, par exemple : ${my_client}.
+mappersList=Liste de mappeurs
+rootUrl=URL racine
+importError=Impossible d'importer le certificat {{error}}
+logicType.negative=Négatif
+validateAttributeName=La configuration d'attribut sans nom n'est pas autorisée.
+eventTypes.RESET_PASSWORD_ERROR.description=Erreur réinitialisation de mot de passe
+eventTypes.REGISTER.description=Enregistrement
+iconUriHelp=Une URL pointant vers une icône.
+validPostLogoutRedirectURIsHelp=Schéma d'URL valide vers lequel un navigateur peut rediriger après une déconnexion réussie. Mettre '+' ou un laisser vide signifie que les URLs valides de redirection seront utilisés. Mettre '-' n'autorise aucune URL valide de redirection après déconnexion. Le joker '*' est autorisé comme par exemple dans 'http://example.com/*'. Un chemin relatif peut également être spécifié, exemple : '/my/relative/path/*'. Ces chemins sont relatifs à l'URL racine du client ou si aucune URL racine n'est spécifiée à l'URL racine du serveur d'authentification.
+oauthDeviceAuthorizationGrant=Accord d'autorisation d'appareil OAuth 2.0
+copyFlowError=Impossible de dupliquer le flux : {{error}}
+roleRemoveAssociatedRoleConfirm=Supprimer le rôle associé ?
+includeInAccessToken.label=Ajouter au jeton d'accès
+samlKeysExportSuccess=Clés exportées avec succès
+usersInRole=Utilisations ayant le rôle
+updatedUserProfileError=La configuration du profil utilisateur n'a pas été sauvegardée : {{error}}
+userFederationExplain=Un regroupement d'utilisateur fournit un accès externe aux bases de données et aux répertoires comme le LDAP et l'Active Directory.
+emptyAuthorizationScopes=Pas de périmètre d'autorisation
+noDefaultGroups=Pas de groupe par défaut
+usersLeft_other={{count}} utilisateurs restants dans le groupe
+updateClientContext=Mettre à jour le contexte client
+removeAssociatedRoles=Supprimer les rôles associés
+nameIdPolicyFormatHelp=Spécifie la référence d'URI correspondant à un format d'identifiant de nom.
+mappers=Mappeurs
+name-id-format=Format NameID
+noRoles-clientScopes=Pas de rôles pour ce périmètre client
+clientUpdaterSourceHost=La condition vérifie l'hôte / le domaine de l'entité qui essaie de créer / mettre à jour le client pour déterminer si la politique est appliquée.
+alwaysReadValueFromLdapHelp=Si activé alors la valeur de l'attribut LDAP sera toujours utilisée à la place de la valeur en base de données Keycloak lors de la lecture.
+usermodel.clientRoleMapping.tokenClaimName.tooltip=Nom de l'attribut à insérer dans le jeton. Ceci peut être complétement explicité comme dans 'address.street'. Dans ce cas un objet JSON imbriqué est créé. Pour éviter d'imbriquer et utiliser le point littéralement, échappez le point avec un backslash (\\.). Vous pouvez utiliser le jeton spécial ${client_id} ; il sera remplacé par l'ID du client actuel. Exemple : 'resource_access.${client_id}.roles'. Cette option est particulièrement utile quand vous ajoutez des rôles depuis tous les clients, ce qui signifie que 'Client ID' est désactivé, et que vous voulez stocker les rôles client de chaque client séparément.
+scopePermissions.clients.map-roles-description=Politiques qui décident si un administrateur peut mapper les rôles définis par ce client
+signAssertions=Signer les assertions
+disableUserInfoHelp=Désactive l'utilisation du service informations utilisateur pour récupérer des informations utilisateurs additionnelles ? Par défaut on active ce service OIDC.
+copyError=Erreur pendant la copie des détails d'autorisation : {{error}}
+validateSignatures=Activer/Désactiver la validation de signature des réponses SAML.
+eventTypes.DELETE_ACCOUNT.name=Supprimer le compte
+logoutUrlHelp=Point de terminaison de fin de session à utiliser pour déconnecter un utilisateur du IDP externe.
+noUserDetails=Pas de détails utilisateurs
+attestationPreference.indirect=Indirect
+frontchannelUrlInvalid=L'URL de connexion du canal principal n'est une URL valide
+deletePolicyWarning=Les politiques agrégées ci dessous seront supprimées automatiquement :
+validatingPublicKey=Validation de la clé publique
+permissionsListIntro=Editer la liste de permission en cliquant sur le nom de périmètre. Ceci redirige ensuite sur la page de détails de la permission du client nommé <1>{{realm}}</1>
+deleteClientConditionSuccess=Condition supprimée avec succès.
+signatureAlgorithm=Algorithme de signature
+deleteConfirmIdentityProvider=Etes vous sûr de vouloir supprimer définitivement le fournisseur '{{provider}}' ?
+resetActions=Remettre à zéro les actions
+eventTypes.CLIENT_INFO_ERROR.description=Erreur informations client
+batchSize=Taille du batch
+user=Utilisateur
+scopesAsRequested=Les périmètres sont nécessaires
+updateErrorClientScope=Impossible de mettre à jour le périmètre client : '{{error}}'
+useKerberosForPasswordAuthentication=Utiliser Kerberos pour l'authentification via mot de passe
+resultPermit=Permis par le résultat
+trustEmail=Faire confiance au mail
+cibaBackchannelTokenDeliveryMode=Mode de livraison du jeton du canal secondaire
+userCreated=L'utilisateur a été créé
+emptyPermissions=Pas de permission
+attributeGeneralSettingsDescription=Cette section contient quelques paramètres de bases communs à tous les attributs.
+residentKey.not\ specified=Non spécifié
+credentialReset=Réinitialisation des identifiants
+noSessionsForUser=Il n'y a actuellement pas sessions actives pour cet utilisateur.
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Erreur action personnalisée requise
+claimJsonType=Type JSON qui doit être utilisé pour peupler l'attribut JSON dans le jeton. Les valeurs valides sont long, int, boolean, String, et JSON.
+includeAuthnStatementHelp=Une déclaration contenant la méthode et le timestamp doit elle être incluse dans les réponses de connexion ?
+evaluateError=Impossible d'évaluer à cause de : {{error}}
+inputHelperTextBefore=Texte d'aide (au dessus) du champ d'entrée
+webAuthnPolicyExtraOrigins=Origines extra
+startTime=Heure de début
+logicHelp=La logique dicte comment la décision de politique doit être rendue. Si 'Positif' le résultat (refus ou acceptation) obtenu pendant l'évaluation de cette politique sera utilisé tel quel. Si 'Négatif' le résultat de la politique sera inversé, un refus deviendra une acception et inversement.
+protocol=Protocole
+allowRegexComparison=Autoriser la comparaison avec une expression régulière
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=Code de vérification d'utilisateur d'appareil OAuth2
+regexAttributeValuesHelp=Si activés les valeurs d'attributs sont interprétés comme des expressions régulières.
+user-events-cleared-error=Impossible de supprimer les évènements utilisateurs {{error}}
+otpPolicy=Politique OTP
+noRolesInstructions-groups=Vous n'avez créé aucun rôle pour ce groupe. Créer un rôle pour commencer.
+generatedUserInfoHelp=Voir l'exemple d'informations utilisateur, qui seront fournies par le point de terminaison des informations utilisateur.
+showPasswordDataValue=Valeur
+updatePermissionSuccess=Permission mise à jour avec succès
+webAuthnPolicyAttestationConveyancePreference=Préférence de transport d'attestation
+eventTypes.REMOVE_TOTP.description=Supprimer totp
+idpLinkSuccess=Le fournisseur d'identité a été lié
+webAuthnPolicyExtraOriginsHelp=La liste des extra origines pour les applications non web.
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=Code utilisateur vérification d'appareil OAuth2
+transient=Transient
+logoutServicePostBindingURL=URL service du déconnexion POST
+assertionConsumerServicePostBindingURLHelp=L'URL lié au POST en SAML pour le service de consommation de l'assertion client (réponses de connexion). Vous pouvez laisser ceci vide si n'avez pas d'URL en POST.
+addSubFlowHelp=Les sous flux peuvent être soit générique soit sous forme de formulaire. Le type formulaire est utilisé pour construire un sous flux qui génère un seul flux pour l'utilisateur. Les sous flux sont un type spécial d'exécution dont l'évaluation dépend des évaluations des exécutions qu'ils contiennent.
+excludeIssuerFromAuthenticationResponse=Exclure l'émetteur de la réponse d'authentification
+eventTypes.CODE_TO_TOKEN_ERROR.name=Erreur code vers jeton
+subjectHelp=Une expression régulière pour valider le sujet DN dans le certificat client. Utilisez "(.*?)(?:$)" pour correspondre à tous les types d'expression.
+strictTransportSecurity=HTTP Strict Transport Security (HSTS)
+clientAccessType=Ceci utilise le type d'accès client (confidentiel, public, bearer-only) pour déterminer si la politique est appliquée. La condition est vérifiée durant la plupart des requêtes OpenID Connect (Requêtes d'autorisation, de jeton, d'introspection de jeton etc). Un confidentiel active l'authentification du client alors qu'un type public désactive l'authentification du client. Bearer-only est un type client déprécié.
+authorizationEncryptedResponseEncHelp=Algorithme JWA utilisé pour le chiffrage du contenu de la réponse d'autorisation quand le mode de réponse est jwt. Cette option est requise si vous voulez chiffrer une réponse d'autorisation. Si laissé vide, la réponse d'autorisation est juste signée mais pas chiffrée.
+postBrokerLoginFlowAliasHelp=Alias du flux d'authentification déclenché après chaque connexion avec ce fournisseur d'identité. Utile si vous voulez une vérification additionnelle pour chaque utilisateur authentifié avec ce fournisseur d'identité (par exemple un OTP). Laissez ceci à "Aucun" si vous n'avez besoin d'aucun authentificateur additionnel à déclencher après la connexion à ce fournisseur d'identité. Merci de noter également que les implémentations d'authentificateur doivent partir du principe que l'utilisateur est déjà présent dans ClientSession car le fournisseur d'identité l'a fait.
+oauthDeviceAuthorizationGrantHelp=Ceci active le support de OAuth 2.0 Device Authorization Grant, ce qui signifie que le client est une application sur un appareil qui a des capacités d'entrée limitées ou auquel il manque un navigateur adapté.
+allowKerberosAuthenticationHelp=Activer/Désactiver l'authentification HTTP des utilisateurs avec les jetons SPNEGO/Kerberos. Les données à propos des utilisateurs authentifiés seront fournis par ce serveur LDAP.
+importOverwritten_other={{count}} enregistrements écrasés.
+requirements.CONDITIONAL=Conditionnel
+kc.client.user_agent=Client/Agent utilisateur
+frontendUrl=URL de Frontend
+permissionDeletedSuccess=Permission supprimée avec succès
+clientScopeRemoveSuccess=Mapping de périmètre supprimé avec succès
+addClientScopes=Ajouter des périmètres client
+doNotStoreUsersHelp=Si activé les utilisateurs de cet intermédiaire ne sont pas sauvegardés dans la base de données interne.
+deletePolicyConfirm=Si vous supprimez cette politique certaines permissions ou politiques agrégées seront affectées.
+userCreateError=Impossible de créer l'utilisateur : {{error}}
+lookAroundHelp=Jusqu'ou (périodes d'extra jeton ou nombres) le serveur doit regarder au cas où le générateur de jeton et le serveur sont désynchronisés ?
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2 code d'appareil de jeton
+invalidateSecret=Invalider
+emptyPermissionInstructions=Si vous voulez créer une permission merci de cliquer sur le bouton ci dessous pour créer une permission basée sur une ressource ou sur un périmètre.
+webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Eviter d'enregistrer un authentificateur qui a déjà été enregistré.
+copyOf=Copie de {{name}}
+evictionMinute=Minute d'expulsion
+requiredClient=Merci d'ajouter au moins un client.
+help=Aide
+passSubject=Passer le sujet
+deleteFlowSuccess=Flux supprimé avec succès
+nodeReRegistrationTimeoutHelp=Intervalle pour spécifier la durée maximale avant réenregistrement des nœuds de cluster clients enregistrés. Si un nœud de cluster n'a pas envoyé une requête de réenregistrement à Keycloak dans cette durée il sera désenregistré de Keycloak.
+rename=Renommer
+httpPostBindingLogoutHelp=Indique si faut répondre aux requêtes avec un HTTP-POST. Si désactivé un HTTP-REDIRECT sera utilisé.
+policyProvider.client=Définir les conditions pour vos permissions où un ensemble d'un ou plusieurs clients seront autorisés à accéder à un objet.
+clientAuthentication=Authentification du client
+validatePasswordPolicy=Valider la politique de mot de passe
+syncModeOverrideHelp=Surcharges le mode de synchronisation par défaut du IDP pour ce mappeur. Les valeurs possibles sont : 'legacy' pour garder le comportement avant que cette option soit introduite, 'importer' pour importer seulement une fois l'utilisateur à la première connexion avec ce fournisseur d'identité, 'forcer' pour toujours mettre à jour l'utilisateur à chaque connexion avec ce fournisseur d'identité et 'hérité' pour utiliser le mode de synchronisation défini par le fournisseur d'identité pour ce mappeur.
+strictTransportSecurityHelp=L'entête Strict-Transport-Security HTTP indique au navigateur de toujours utiliser HTTPS. Une fois qu'un navigateur a vu cet entête il visitera uniquement les sites en HTTPS pour la durée spécifiée (1 an) par le max-age, incluant les sous domaines. <1>En savoir plus</1>
+clientAssertionSigningAlgHelp=Algorithme de signature pour créer une assertion JWT comme authentification du client. Dans le cas d'un JWT signé avec une clé privée ou un JWT signé avec le secret du client, ceci n'est pas nécessaire. Si aucun algorithme n'est spécifié l'algorithme suivant est adapté. RS256 est adapté dans le cas d'un JWT signé avec une clé privée. HS256 est adapté dans le cas d'un JWT signé avec le secret du client.
+notBeforeSetToNow=Not Before saisi pour le client
+host-sending-registration-request-must-match.label=La requête d'enregistrement client envoyée par l'hôte doit correspondre
+clientAuthenticationHelp=La méthode d'authentification client (voir https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). Dans le cas d'un JWT signé avec une clé privée la clé privée du domaine est utilisée.
+kerberosRealmHelp=Nom du domaine Kerberos. Par exemple, FOO.ORG.
+roleCreateError=Impossible de créer le rôle : {{error}}
+clientSecretHelp=Le secret client enregistré avec ce fournisseur d'identité. Ce champ est capable d'obtenir sa valeur depuis un coffre fort, utilisez le format {vault.ID}.
+offlineSessionMax=Durée maximale de session hors ligne
+dynamicScopeFormat=Format de périmètre dynamique
+removeAnnotationText=Supprimer l'annotation
+verifyEmailHelpText=Obliger les utilisateurs à vérifier leur adresse mail après la première connexion ou après changement de l'adresse mail.
+referrerPolicy=Politique de référence
+enableLdapv3PasswordHelp=Utiliser la norme LDAPv3 Password Modify Extended Operation (RFC-3062). L'opération de modification étendue de mot de passe nécessite généralement que le mot de passe de l'utilisateur LDAP soit déjà dans le serveur LDAP. Donc quand cette option est utilisée avec 'Synchroniser les enregistrements', il est préférable d'ajouter également 'Mappeur d'attribut LDAP codé en dur' avec un mot de passe initial généré aléatoirement.
+permissionDecisionStrategyHelp=La stratégie de décision indique comment les politiques associées avec une permission donnée sont évaluées et comment une décision finale est obtenue. 'Affirmatif' signifie qu'au moins une politique doit être évaluée avec une décision positive pour que la décision finale soit aussi positive. 'Unanime' signifie que toutes les politiques doivent rendre une décision positive pour que la décision finale soit positive. 'Consensus' signifie que le nombre de décisions positives doit être supérieur au nombre de décisions négatives. Si le nombre de décisions positives est le même que le nombre de négatives la décision finale sera négative.
+periodicChangedUsersSync=Période de synchronisation d'utilisateurs modifiée
+webAuthnPolicyFormHelp=Politique pour l'authentification WebAuthn. Celle ci sera utilisée pour l'action requise 'L'enregistrement WebAuthn' et l'authentificateur 'Authentificateur WebAuthn'. Un cas typique est le cas où WebAuthn sera utilisé pour l'authentification à double facteur.
+regexClaimValues=Expressions régulières sur les valeurs d'attribut
+policyType.hotp=Basé sur un compteur
+uiDisplayNameHelp=Afficher le nom du fournisseur lorsqu'il est lié dans les écrans d'admin
+hideOrganizationLinkedIdps=Masquer les fournisseurs d'identités liés à l'organisation
+events-disable-title=Ne pas enregistrer les événements ?
+createScopeBasedPermission=Créer une autorisation basée sur le périmètre
+conditionType=Type de condition
+eventTypes.GRANT_CONSENT.name=Donner son consentement
+noProvidersLinked=Aucun fournisseur d'identités lié.
+testConnectionSuccess=Succès ! La connexion SMTP a réussie. Le courriel a été envoyé !
+samlSettings=Paramètres SAML
+userSessionAttribute=Attribut de la session utilisateur
+forgotPassword=Mot de passe oublié
+searchUserByAttributeMissingValueError=Renseigner une valeur d'attribut
+moveGroupError=Impossible de déplacer le groupe {{error}}
+policyType.totp=Basé sur le temps
+leaveGroupConfirmDialog_one=Êtes-vous sûr de vouloir supprimer {{username}} du groupe {{groupname}} ?
+displayHeaderHintHelp=Un nom fonctionnel pour le groupe qui sera utilisé pour la mise en page de groupes d'attributs dans les formulaires utilisateurs. Supporte les clés de traduction également. Par exemple : ${profile.attribute.group.address}.
+policyEnforcementModeHelp=La politique d'application dicte comment les politiques sont appliquées lors de l'évaluation des requêtes d'autorisation. 'Appliqué' signifie que les requêtes sont refusées par défaut même quand il n'y a aucune politique associée à une ressource donnée. 'Permissif' signifie que les requêtes sont autorisées même quand il n'y a aucune politique associée à une ressource donnée. 'Désactivé' désactive complètement l'évaluation des politiques et autorise l'accès à n'importe quelle ressource.
+generatedCodeTextArea=Généré le code textarea
+oAuthMutual=Jeton d'accès OAuth 2.0 Mutual TLS Certificate activé
+otpTypeHelp=totp signifie Time-Based One Time Password. 'hotp' est un one time password basé sur un compteur que le serveur utilise pour le hachage.
+assertionConsumerServicePostBindingURL=URL POST du service consommateur d'assertions
+assertionConsumerServiceRedirectBindingURL=URL REDIRECT du service consommateur d'assertions
+searchUserByAttributeDescription=Ceci supporte plusieurs attributs comme filtre de recherche en utilisant différentes clés et valeurs. Une seule valeur par clé peut être saisie.
+assertionConsumerServiceRedirectBindingURLHelp=URL de redirection SAML pour le service consommateur d'assertions du client (réponses de connexion). Vous pouvez laisser ceci vide si n'avez pas d'URL de redirection.
+logoutServiceSoapBindingUrlHelp=URL SOAP SAML pour le service de déconnexion du client. Vous pouvez laisser ceci vide si vous ne l'utilisez pas.
+logoutServiceSoapBindingUrl=URL SOAP pour le service de déconnexion
+userObjectClassesHelp=Toutes les valeurs pour l'attribut LDAP objectClass des utilisateurs dans le LDAP, séparées par des virgules. Par exemple : 'inetOrgPerson, organizationalPerson'. Les utilisateurs Keycloak nouvellement créés seront écrits dans le LDAP avec toutes ces classes d'objet et les enregistrements existants de l'utilisateur LDAP sont trouvés s'ils contiennent toutes ces classes d'objet.
+httpPostBindingResponse=Réponse HTTP-POST
+artifactBindingResponse=Réponse ARTIFACT
+multiValued=Indique si cet attribut supporte des valeurs multiples. Si activé la liste de toutes les valeurs de cet attributs sont saisies en tant qu'attribut. Sinon seule la première valeur est saisie en tant qu'attribut.
+browse=Naviguer
+importOverwritten_zero=Aucun enregistrement écrasé.
+usermodel.realmRoleMapping.rolePrefix.label=Préfixe rôle de domaine
+userFedDisableConfirm=Si vous désactivez ce fournisseur de regroupement utilisateur il ne sera pas considéré pour les requêtes et les utilisateurs importés seront désactivés et accessibles seulement en lecture seule jusqu'à ce que le fournisseur soit activé de nouveau.
+httpPostBindingAuthnRequest=HTTP-POST pour AuthnRequest
+termsOfServiceUrlHelp=URL que le client de l'intermédiaire de confiance fournit à l'utilisateur final pour en savoir plus à propos des termes de service de l'intermédiaire de confiance
+optimizeLookup=Optimiser la recherche de le clé de signature REDIRECT
+attributeConsumingServiceIndex=Index service de consommation de l'attribut
+prompt=Déclencher
+logoutServiceArtifactBindingUrl=URL ARTIFACT service de déconnexion
+optimizeLookupHelp=Lors de la signature de documents SAML en REDIRECT pour un SP qui est sécurisé par un adaptateur Keycloak, l'ID de la clé de signature doit elle être incluse dans le message du protocol SAML dans l'élément <Extensions> ? Ceci optimise la validation de la signature car la partie qui valide utilise une seule clé au lieu d'essayer toutes les clés connues pour la validation.
+webAuthnPolicyRpEntityName=Nom de l'entité de l'intermédiaire de confiance
+oAuthDevicePollingInterval=Intervalle d'interrogation régulière de l'appareil OAuth 2.0
+disableNonceHelp=Ne pas envoyer le paramètre nonce dans la requête d'authentification. Le paramètre nonce est envoyé et vérifié par défaut.
+webAuthnPolicyAvoidSameAuthenticatorRegister=Eviter l'enregistrement du même authentificateur
+notBeforeNowClear=Pas Avant supprimé pour le client
+transientUser=Transient
+termsAndConditionsUserAttribute=Horodatage de l'acception des termes et conditions
+selectUserInfoResponseEncryptionContentEncryptionAlgorithm=Sélectionner l'algorithme de chiffrage du contenu de la réponse des informations utilisateur
+selectRequestObjectRequired=Sélection requise pour l'objet de la requête
+to l'attribut. Pour ça utilisez n'importe lequel des validateurs built-in pour valider correctement la taille et les valeurs.
+avatarImage=Image de l'avatar
+eventTypes.INVITE_ORG.name=Inviter l'utilisateur à l'organisation
+authorizationScope.Clients.map-roles=Mapper les rôles définis par ce client aux ressources comme les utilisateurs et les groupes
+addTranslationsModalSubTitle=Vous pouvez traduire le "{{fieldName}}" en fonction de votre langue ou des langues préférées. De plus vous pouvez également créer ou éditer les traduction de "{{fieldName}}" dans les <1>Configurations du domaine > Localisation > Surcharges de domaine.<1>
+addTranslationsDialogRowsTable=Ajouter une table de lignes de traductions
+fetchRoles=Récupérer les rôles
+fetchRolesHelp=Par défaut seuls les rôles disponibles depuis le jeton envoyé avec les requêtes d'autorisation sont utilisés pour vérifier si l'utilisateur a un rôle. Si activé la politique ignore les rôles du jeton et vérifie n'importe quel rôle associé à l'utilisateur à la place.
+replyToDisplayPlaceholder=Afficher le nom pour l'adresse mail "Répondre à"
+senderEnvelopePlaceholder=Adresse mail de l'expéditeur
+smtpPortPlaceholder=Port SMTP (par défaut à 25)
+loginUsernamePlaceholder=Nom d'utilisateur de connexion
+searchClientRegistration=Chercher une politique
+ownerHelp=Propriétaire de cette ressource.
+parRequestUriLifespan=Durée de vie de l'URL de requête pour la requête d'autorisation poussée
+parRequestUriLifespanHelp=Nombre représentant la durée de vie de l'URL de la requête. La valeur par défaut est 1 minute.
+identityBrokeringLink=Lien intermédiaire d'identités
+importFileHelp=Fichier pour importer une clé
+logo=Logo
+emailVerificationHelp=Timeout indépendant pour la vérification du mail
+idpAccountEmailVerificationHelp=Timeout indépendant pour la vérification du mail du compte IdP
+forgotPasswordHelp=Timeout indépendant pour le mot de passe oublié
+executeActionsHelp=Timeout indépendant pour exécuter les actions
+validatingX509CertsHelp=Les certificats publics utilisés par Keycloak pour valider les signatures des requêtes et réponses SAML depuis un IDP externe quand 'Utiliser l'URL descripteur métadonnées' est activé. Plusieurs certificats peuvent être entrés, séparés par des virgules (,). Vous pouvez réimporter les certificats depuis l'URL descripteur métadonnées en cliquant sur l'action 'Importer clés' sur la page du fournisseur d'identité. Cette action télécharge les certificats actuels sur le point de terminaison des métadonnées et les assigne à la configuration dans cette même option. Cliquer sur 'Sauvegarder' pour stocker définitivement les certificats réimportés.
+permissionsSubTitle=Les permissions contrôlent les accès à une ressource ou à plusieurs ressources du même type.
+resourceType.IdentityProviders=Contrôle l'accès aux opérations qui peuvent être performées pour les fournisseurs d'identité de ce domaine
+resourceType.Organizations=Contrôle l'accès aux opérations qui peuvent être performées pour les organisations de ce domaine
+resourceType.Clients=Contrôle l'accès aux opérations qui peuvent être performées pour les clients de ce domaine
+resourceType.Groups=Contrôle l'accès aux opérations qui peuvent être performées pour les groupes de ce domaine
+resourceType.Users=Contrôle l'accès aux opérations qui peuvent être performées pour les utilisateurs de ce domaine
+resourceType.Roles=Contrôle l'accès aux opérations qui peuvent être performées pour les rôles de ce domaine
+targetAudienceHelp=Configurer l'audience ciblée. Ceci revient au même qu'utiliser le paramètre 'audience' dans la requête du point de terminaison du jeton. Notez que le paramètre 'audience' est disponible uniquement pour l'accord d'échange de jeton à ce moment. Pour simuler n'importe quel autre accord ou pour simuler un accord d'échange de jeton sans le paramètre 'audience' il est recommandé de laisser ce paramètre vide.
+authTokenClientId=Auth Token ClientId
+authTokenClientSecret=Auth Token Client Secret
+oAuthSettings=Paramètres OAuth2
+addOAuth2Provider=Ajouter un fournisseur OAuth v2
+userProfileClaims=Attributs du profil utilisateur
+emailClaim=Attribut du courriel
+emailClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant le courriel de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `email`.
+givenNameClaim=Attribut du nom donné
+fullNameClaim=Attribut du nom
+fullNameClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant le nom complet de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `name`.
+userNameClaim=Attribut du nom d'utilisateur
+userIDClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant l'identifiant unique de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `sub`.
+userIDClaim=Attribut de l'identifiant
+familyNameClaim=Attribut du nom de famille
+givenNameClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant le nom donné de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `given_name`.
+familyNameClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant le nom de famille de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `family_name`.
+userNameClaimHelp=Le nom de l'attribut du document JSON retourné par le point de terminaison du profil utilisateur, représentant le nom d'utilisateur de l'utilisateur. S'il n'est pas fourni, il prend par défaut la valeur `preferred_username`.
+invalidLocale=Paramètres régionaux sélectionnés invalides
+editGroup=Modifier le groupe
+cpu=Processeur
+processorCount=Nombre de cœurs
+webAuthnPolicyPasskeysEnabled=Activer les clés d'accès
+webAuthnPolicyPasskeysEnabledHelp=Activer l'authentification avec des clés d'accès (remplissage automatique au sein de l'écran) dans les formulaires de compte utilisateur.
+deprecated=Obsolète
+validity=Expiration de certificat
+validityHelp=Nombre d'années de validité du certificat généré.
+tokenIntrospectionUrl=URL d'introspection du jeton
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_it.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_it.properties
new file mode 100644
index 000000000000..97918458a508
--- /dev/null
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_it.properties
@@ -0,0 +1,66 @@
+cancel=Annulla
+deleteConfirm_other=Sicuro di voler cancellare questi gruppi?
+trusted-hosts.label=Host fidati
+searchAttributes=Ricerca attributi
+eventTypes.PERMISSION_TOKEN.name=Token di permessi
+permissionsDisable=Disabilita i permessi?
+secretHasExpired=Il segreto è scaduto, si prega di generarne uno nuovo cliccando sul pulsante "Rigenera"
+decisionStrategies.CONSENSUS=Maggioranza
+decisionStrategies.UNANIMOUS=Unanime
+consensus=Maggioranza
+affirmative=Permissiva
+policyRolesHelp=Clicca su "Aggiungi ruoli" per includere i ruoli accettati per questa policy. Spuntando "campo richiesto" su un ruolo indica che il ruolo DEVE essere presente mentre di valuta la policy, indipendentemente dagli altri ruoli. Lasciando tutti i ruoli senza la spunta è equivalente di impostare la strategia di decisione su "Permissiva".
+decisionStrategyHelp=La strategia decisionale stabilisce come vengono valutate le policy associate a un determinato permesso e come si ottiene la decisione finale. "Permissiva" significa che almeno una policy deve essere valutata positivamente affinché anche la decisione finale sia positiva. "Unanime" significa che tutte le policy devono essere valutate positivamente affinché anche la decisione finale sia positiva.
+unanimous=Unanime
+createClientPolicy=Crea una client policy
+userID=ID utente
+importAdded_zero=Nessun record aggiunto.
+clientSignature=Richiesta la firma del client
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Errore di collegamento con la federated identity
+persistent=Persistente
+deletedSuccess=Provider cancellato con successo.
+decisionStrategies.AFFIRMATIVE=Permissiva
+anyResource=Qualsiasi risorsa
+sync-ldap-roles-to-keycloak=Sincronizza i ruoli LDAP con Keycloak
+permissionDecisionStrategyHelp=La strategia decisionale stabilisce come vengono valutate le policy associate a un determinato permesso e come si ottiene la decisione finale. "Permissiva" significa che almeno una policy deve essere valutata positivamente affinché anche la decisione finale sia positiva. "Unanime" significa che tutte le policy devono essere valutate positivamente affinché anche la decisione finale sia positiva. "Maggioranza" significa che il numero di decisioni positive deve essere maggiore del numero di decisioni negative. Se il numero di decisioni positive e negative è uguale, la decisione finale sarà negativa.
+policyDecisionStagey=La strategia decisionale stabilisce come vengono valutate le policy associate a un determinato permesso e come si ottiene la decisione finale. "Permissiva" significa che almeno una policy deve essere valutata positivamente affinché anche la decisione finale sia positiva. "Unanime" significa che tutte le policy devono essere valutate positivamente affinché anche la decisione finale sia positiva. "Maggioranza" significa che il numero di decisioni positive deve essere maggiore del numero di decisioni negative. Se il numero di decisioni positive e negative è uguale, la decisione finale sarà negativa.
+wantAssertionsSignedHelp=Indica se il service provider si aspetta un'assertion firmata.
+eventTypes.CUSTOM_REQUIRED_ACTION.description=Azione richiesta personalizzata
+flowName=Nome del flusso
+addLdapWizardTitle=Aggiungi un provider LDAP
+disableConfirm=Sicuro di voler disabilitare "{{name}}"
+userInfoResponseEncryptionContentEncryptionAlgorithm=Algoritmo di crittografia utilizzato per le risposte dell'endpoint user info
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Errore nel primo accesso dell'identity provider
+searchByRoleName=Cerca usando il nome del ruolo
+passLoginHint=Utilizza login_hint
+emptyClientScopes=Questo client non ha alcun client scope configurato
+policyEnforcementMode=Modalità di applicazione delle policy
+eventTypes.CLIENT_UPDATE.name=Aggiornamento client
+addMultivaluedLabel=Aggiungi {{fieldLabel}}
+secretRotated=Secret rinnovato
+userFedDeleteConfirmTitle=Cancellare lo user federation provider?
+userCredentialsHelpTextLabel=Testo di aiuto per le credenziali dell'utente
+displayName=Nome visualizzato
+envelopeFrom=Contenitore da
+eventTypes.UPDATE_TOTP.name=Aggiornamento totp
+openIdConnectCompatibilityModesHelp=Questa sezione serve a configurare le impostazioni per la retrocompatibilità con gli adattatori OpenID Connect / OAuth 2 più vecchi. È utile soprattutto se il client utilizza una vecchia versione dell'adapter Keycloak / RH-SSO.
+role=Ruolo
+cibaIntervalHelp=Il tempo minimo in secondi che il CD (Consumption Device) deve attendere tra le richieste di polling all'endpoint del token. Se impostato a 0, il CD deve utilizzare 5 come valore predefinito secondo le specifiche CIBA.
+httpPostBindingAuthnRequestHelp=Indica se l'AuthnRequest deve essere inviata utilizzando il binding HTTP-POST. Se falso, verrà utilizzato il binding HTTP-REDIRECT.
+notRepeat=Non ripetere
+credentialType=Tipo
+applyToResourceTypeHelp=Specifica se questa autorizzazione deve essere applicata a tutte le risorse con un determinato tipo. In questo caso, l'autorizzazione sarà valutata per tutte le istanze di un determinato tipo di risorsa.
+validRedirectURIsHelp=URL a cui il browser può reindirizzare dopo un accesso riuscito. Sono ammessi semplici caratteri jolly, come "http://example.com/*". Si possono specificare anche percorsi relativi, come "/my/relative/path/*". I percorsi sono relativi all'URL principale (root) del client o, se non è specificato, all'URL principale del server di autenticazione. Per SAML è necessario impostare almeno un URL valido se si vuole fare affidamento sull'URL ricevuto nella richiesta di accesso.
+updateCibaError=Non è possibile aggiornare la policy CIBA: {{error}}
+policyUrl=URL policy
+clientDescriptionHelp=Specifica una descrizione per il client. Ad esempio 'Sistema di gestione delle presenze'. È supportato l'utilizzo di chiavi di localizzazione. Ad esempio: ${my_client_description}.
+rolesPermissionsHint=Determina se le autorizzazioni dettagliate sono abilitate per la gestione di questo ruolo. La disattivazione cancellerà tutte le autorizzazioni correnti che sono state impostate.
+passwordPoliciesHelp.regexPattern=Richiede che la password corrisponda a uno o più modelli di espressione regolare Java.
+oAuthDPoP=Richiedere l'intestazione Demonstrating Proof of Possession (DPoP) nelle richieste di token
+invalidRealmName=Il nome del realm non può contenere caratteri speciali
+realmNameTitle=Realm {{name}}
+subjectNameId=NameID dell'oggetto
+credentialsList=Lista delle credenziali
+serviceProviderEntityId=ID dell'entity del service provider
+clientId=ID del client
+usermodel.clientRoleMapping.clientId.label=ID del client
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ja.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ja.properties
index ce0eb31685f2..2e60ee1d36b0 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ja.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ja.properties
@@ -1,23 +1,23 @@
 anyResource=任意のリソース
 themes=テーマ
-addClientScope=クライアント・スコープの追加
+addClientScope=クライアントスコープの追加
 clientType=クライアントタイプ
 clientSignature=クライアント署名が必須
 unanimous=Unanimous
-policy-name=このポリシーの名前を設定します。
+policy-name=このポリシーの名前。
 clientHelp=認可リクエストを作成するクライアントを選択してください。提供されない場合は、認可リクエストは今いるページのクライアントで行われることになります。
-disabledFeatures=使用できない機能
-wantAssertionsSignedHelp=このサービス・プロバイダーが署名付きアサーションを要求するかどうかを設定します。
+disabledFeatures=無効な機能
+wantAssertionsSignedHelp=このサービスプロバイダーが署名付きアサーションを要求するかどうかを設定します。
 signOut=サインアウト
 validatorDialogColNames.colName=ロール名
 certificateHelp=クライアントで発行され、キーストアの秘密鍵で署名されたJWTを検証するためのクライアント証明書です。
 credentialType=タイプ
 passLoginHint=login_hintを渡す
 operationType=操作タイプ
-httpPostBindingAuthnRequestHelp=HTTP-POSTバインディングを使用してAuthnRequestを送信するかどうかを設定します。オフの場合は、HTTP-REDIRECTバインディングが使用されます。
+httpPostBindingAuthnRequestHelp=HTTP-POSTバインディングを使用してAuthnRequestを送信するかどうかを設定します。オフの場合はHTTP-REDIRECTバインディングが使用されます。
 userInitiatedActionLifespan=ユーザー起動アクションの有効期間
 decisionStrategy=決定戦略
-policyEnforcementMode=ポリシー施行モード
+policyEnforcementMode=ポリシー強制モード
 securityDefences=セキュリティー防御
 realmSettings=レルムの設定
 partialExport=部分エクスポート
@@ -25,80 +25,80 @@ displayName=表示名
 applyToResourceTypeHelp=このパーミッションが、特定タイプの全リソースに適用されるべきかどうかを指定します。この場合、パーミッションは特定リソースタイプの全インスタンスに対して評価されます。
 envelopeFrom=Envelope From
 clientDescriptionHelp=クライアントの説明を指定します。例えば「タイムシート用のクライアント」です。ローカライズ用のキーもサポートしています。例: ${my_client_description}
-effectiveRoleScopeMappings=有効なロールスコープ・マッピング
-clientAuthenticator=クライアント認証
-updateFirstLoginHelp=初回ログイン時のプロフィール更新
-clientSessionMax=クライアント・セッション最大
+effectiveRoleScopeMappings=有効なロールスコープマッピング
+clientAuthenticator=クライアント認証方法
+updateFirstLoginHelp=初回ログイン時のプロファイル更新
+clientSessionMax=クライアントセッション最大
 usermodel.clientRoleMapping.clientId.label=クライアントID
 clientId=クライアントID
 contextualAttributesHelp=実行環境や実行コンテキストによって提供される任意の属性を設定します。
-clientLoginTimeoutHelp=クライアントがアクセストークン・プロトコルを終了するまでの最大時間。これは通常1分です。
+clientLoginTimeoutHelp=クライアントが受け取った認可コードの有効期間。これは通常1分です。
 lastAccess=最終アクセス
-clientAuthentications.private_key_jwt=秘密鍵で署名されたJWT
-uiDisplayName=コンソール表示名
+clientAuthentications.private_key_jwt=秘密鍵でJWTに署名
+uiDisplayName=UI表示名
 adminEventsSettings=管理イベントの設定
 times.minutes=分
-disableUserInfo=UserInfoの無効
+disableUserInfo=UserInfoの無効化
 addressClaim.postal_code.label=郵便番号のユーザー属性名
-forcePostBinding=POSTバインディングを強制
+forcePostBinding=POSTバインディングの強制
 defaultRoles=デフォルトロール
-clientScopeTypes.default=DEFAULT
+clientScopeTypes.default=デフォルト
 addressClaim.country.tooltip=「address」トークンクレーム内の「country」サブクレームにマップするために使用されるユーザー属性の名前。デフォルトは「country」です。
 uuidLdapAttribute=UUID LDAP属性
-scopeNameHelp=クライアント・スコープの名前。レルム内でユニークでなければなりません。スコープ・パラメーターの値として使用されるため、名前には空白文字を含めないでください
-requiredUserActions=必要なユーザー・アクション
-flowTypeHelp=どの種類のフォームかを設定します。
+scopeNameHelp=クライアントスコープの名前。レルム内でユニークでなければなりません。スコープパラメーターの値として使用されるため、名前には空白文字を含めないでください。
+requiredUserActions=必要なユーザーアクション
+flowTypeHelp=どの種類のフォームか
 allowRemoteResourceManagement=リモートリソース管理
-identityProvider=アイデンティティー・プロバイダー
-identityProviderLinks=アイデンティティー・プロバイダーのリンク
+identityProvider=アイデンティティープロバイダー
+identityProviderLinks=アイデンティティープロバイダーリンク
 leave=外す
 eventTypes.IMPERSONATE.name=代理ログイン
 export=エクスポート
-assertionLifespan=アサーションの有効期限
+assertionLifespan=アサーションの有効期間
 addressClaim.formatted.label=整形された住所のユーザー属性名
 add=追加
 passwordPolicy=パスワードポリシー
-openIDEndpointConfiguration=OpenIDエンドポイントの設定
+openIDEndpointConfiguration=OpenID Connectエンドポイントの設定
 backchannelLogout=バックチャネルログアウト
 addressClaim.street.label=その他住所のユーザー属性名
-prompts.login=login
+prompts.login=ログイン
 users=ユーザー
-offlineSessionIdleHelp=セッションの有効期限が切れるまでのオフライン時間です。この期限内に少なくとも1回はオフライン・トークンを使用してリフレッシュしないと、オフライン・セッションは有効期限切れとなります。
+offlineSessionIdleHelp=セッションの有効期限が切れるまでのオフライン時間です。この期限内に少なくとも1回はオフライントークンを使用してリフレッシュしないと、オフラインセッションは有効期限切れとなります。
 wantAssertionsEncrypted=アサーションの暗号化が必要
-forceNameIdFormatHelp=要求されたNameIDサブジェクト・フォーマットを無視し、管理コンソールで設定された物を使用します。
+forceNameIdFormatHelp=要求されたNameIDサブジェクトフォーマットを無視し、管理コンソールで設定されたものを使用します。
 uris=URI
 port=ポート
 realmRolePrefix=レルムロールのプレフィックス
-jwksUrlHelp=JWK形式のクライアント鍵が格納されているURLを設定します。詳細はJWKの仕様を参照してください。「jwt」クレデンシャルを持つKeycloakクライアント・アダプターを使用している場合は、アプリケーションに「/k_jwks」という接尾辞を付けたURLを使用することができます。例えば、「http\://www.myhost.com/myapp/k_jwks」です。
+jwksUrlHelp=JWK形式のアイデンティティープロバイダーキーが保存されるURL。詳細はJWK仕様を参照してください。外部Keycloakアイデンティティープロバイダーを使用する場合は、ブローカーであるKeycloakが「http://broker-keycloak:8180」で実行されており、レルムが「test」であると仮定すると、「http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs」のようなURLを使用できます。
 includeRepresentation=Representationを含める
-singleLogoutServiceUrl=シングル・ログアウト・サービスのURL
+singleLogoutServiceUrl=シングルログアウトサービスのURL
 roles=ロール
 representation=Representation
 remove=削除
-scopePermissions.users.manage-group-membership-description=管理者がレルム内のすべてのユーザーのグループ・メンバーシップを管理できるかどうかを決定するポリシー。これは、特定のグループポリシーと組み合わせて使用??されます
+scopePermissions.users.manage-group-membership-description=管理者がレルム内のすべてのユーザーのグループメンバーシップを管理できるかどうかを決定するポリシー。これは、特定のグループポリシーと組み合わせて使用されます
 loginTheme=ログインテーマ
 provider=プロバイダー
 flows=フロー
 scope=スコープ
-includeRepresentationHelp=作成または更新リクエストのJSON Representationを含めるかどうかを設定します。
+includeRepresentationHelp=作成または更新リクエストのJSON表現を含めるかどうかを設定します。
 signAssertionsHelp=SAMLドキュメント内のアサーションを署名すべきか設定します。もしドキュメントが既に署名済みの場合は、この設定は不要です。
 validateSignature=署名検証
 headers=ヘッダー
-effectiveProtocolMappersHelp=すべてのデフォルトのクライアント・スコープと選択されたオプションのスコープが含まれます。クライアントに発行されたアクセストークンを生成するときに、すべてのクライアント・スコープのすべてのプロトコル・マッパーとロールスコープのマッピングが使用されます
-fromDisplayNameHelp=差出人のアドレスのユーザー・フレンドリーな名前です（オプション）。
-userObjectClasses=ユーザー・オブジェクト・クラス
-policyRoles=このポリシーで許可されるクライアント・ロールを指定してください。
+effectiveProtocolMappersHelp=すべてのデフォルトのクライアントスコープと選択されたオプションのスコープが含まれます。クライアントに発行されたアクセストークンを生成するときに、すべてのクライアントスコープのすべてのプロトコルマッパーとロールスコープのマッピングが使用されます。
+fromDisplayNameHelp=差出人のアドレスのユーザーフレンドリーな名前（オプション）。
+userObjectClasses=ユーザーオブジェクトクラス
+policyRoles=このポリシーで許可されるクライアントロールを指定してください。
 accountLinkingOnlyHelp=オンの場合、ユーザーはこのプロバイダーからログインできません。このプロバイダーにリンクすることのみできます。これは、プロバイダーからのログインを許可したくないが、プロバイダーと統合したい場合に便利です
-refreshTokenMaxReuseHelp=リフレッシュ・トークンを再利用できる最大回数。別のトークンが使用された場合、即時に無効化されます。
+refreshTokenMaxReuseHelp=リフレッシュトークンを再利用できる回数。別のトークンが使用された場合、即時に無効化されます。
 times.hours=時
 webOrigins=Webオリジン
-webAuthnPolicyAuthenticatorAttachmentHelp=受け入れ可能なアタッチメント・パターンでオーセンティケーターと通信します。
+webAuthnPolicyAuthenticatorAttachmentHelp=受け入れ可能なアタッチメントパターンでオーセンティケーターと通信します。
 username=ユーザー名
 importConfig=ファイルから設定をインポート
-replyToDisplayNameHelp=返信先のアドレスのユーザー・フレンドリーな名前です（オプション）。
+replyToDisplayNameHelp=返信先のアドレスのユーザーフレンドリーな名前（オプション）。
 lifespan=有効期限
-storedTokensReadableHelp=新しいユーザーが格納されたトークンを読み取り可能かどうかの有効/無効設定です。broker.read-tokenロールをアサインします。
-webAuthnPolicyRpIdHelp=これは、WebAuthnリライング・パーティーとしてのIDです。オリジンの有効なドメインでなければなりません。
+storedTokensReadableHelp=新しいユーザーが保存されたトークンの読み取りを可能にするか切り替えます。broker.read-tokenロールをアサインします。
+webAuthnPolicyRpIdHelp=これは、WebAuthnリライングパーティーとしてのIDです。オリジンの有効なドメインでなければなりません。
 authenticationFlowTypeHelp=どの種類のフォームかを設定します。
 editUsernameHelp=有効の場合はユーザー名フィールドが編集可能になり、そうでない場合は読み取り専用になります。
 consoleDisplayConnectionUrlHelp=LDAPサーバーへの接続URL
@@ -106,43 +106,43 @@ clientAssertionSigningAlg=クライアントアサーション署名アルゴリ
 fullScopeAllowedHelp=全ての制限の無効を許可します。
 applyPolicy=ポリシーの適用
 otpType=OTPタイプ
-directGrantHelp=ダイレクト・グラント認証で使用したいフローを選択してください。
+directGrantHelp=ダイレクトグラント認証で使用したいフローを選択してください。
 algorithm=アルゴリズム
 jsonType.tooltip=トークンへのJSONクレームの追加で使用されるJSONタイプを設定します。long、int、boolean、String、JSONが有効な値です。
-enableStartTLS=StartTLSの有効
-syncModeOverride=同期モードのオーバーライド
+enableStartTLS=StartTLSの有効化
+syncModeOverride=同期モードの上書き
 includeInTokenScope=トークンスコープに含める
 eventType=イベントタイプ
-accountLinkingOnly=アカウントのリンクのみ
+accountLinkingOnly=アカウントリンクのみ
 sectorIdentifierUri.label=セクター識別子URI
 usermodel.attr.label=ユーザー属性
 eventTypes.REGISTER.name=登録
-rememberMeHelpText=セッションの有効期限が切れるまではブラウザーの再起動でもログイン状態を保存するチェックボックスをログインページに表示します。
-webAuthnPolicyUserVerificationRequirementHelp=ユーザーを実際に検証することを確認するためにオーセンティケーターと通信します。
+rememberMeHelpText=セッションの有効期限が切れるまでは、ブラウザーを再起動してもログイン状態を保存するチェックボックスがログインページに表示されます。
+webAuthnPolicyUserVerificationRequirementHelp=ユーザー検証を要求するかどうかをオーセンティケーターに伝えます。
 idTokenSignatureAlgorithm=IDトークン署名アルゴリズム
 syncModes.import=インポート
-ssoServiceUrl=シングル・サインオン・サービスのURL
-allowRemoteResourceManagementHelp=リソースは、リソースサーバーによりリモートで管理すべきかどうかを設定します。オフの場合は、リソースはこの管理コンソールだけで管理されます。
-changedUsersSyncPeriod=変更ユーザーの同期周期
-webAuthnPolicyAuthenticatorAttachment=オーセンティケーター・アタッチメント
+ssoServiceUrl=シングルサインオンサービスのURL
+allowRemoteResourceManagementHelp=リソースサーバーによってリソースをリモートで管理すべきかどうかを設定します。オフの場合は、リソースはこの管理コンソールだけで管理されます。
+changedUsersSyncPeriod=変更されたユーザーの同期の周期
+webAuthnPolicyAuthenticatorAttachment=オーセンティケーターアタッチメント
 userRegistration=ユーザー登録
 save=保存
 login=ログイン
-changedUsersSyncHelp=変更または新規作成されたLDAPユーザーの同期周期を秒で設定します。
-trustEmailHelp=有効とした場合は、このレルムでEメールの確認が有効となっている場合でも、このプロバイダーが提供するEメールは確認されなくなります。
+changedUsersSyncHelp=変更または新規作成されたLDAPユーザーの同期周期（秒）
+trustEmailHelp=有効とした場合は、このレルムでメールアドレスの検証が有効となっている場合でも、このプロバイダーが提供するメールは確認されなくなります。
 credentialUserLabel=ユーザーラベル
-adminURLHelp=クライアントの管理インターフェイスのURLを設定します。クライアントがアダプターのREST APIをサポートしている場合に設定してください。このREST APIにより、認証サーバーは無効化ポリシーや他の管理タスクをプッシュすることができます。通常、クライアントのベースURLを設定します。
+adminURLHelp=クライアントの管理インターフェイスのURL。クライアントがアダプターのREST APIをサポートしている場合に設定してください。このREST APIにより、認証サーバーは無効化ポリシーや他の管理タスクをプッシュすることができます。通常、クライアントのベースURLを設定します。
 otpPolicyPeriodHelp=OTPトークンが有効な秒数を設定します。デフォルトは30秒です。
 storePasswordHelp=アーカイブ自身にアクセスするためのパスワード
 userFederation=ユーザーフェデレーション
 directAccess=ダイレクトアクセスグラント
-disable=無効
+disable=無効化
 attributes=属性
 logic=ロジック
 resourceType=リソースタイプ
-minuteHelp=ポリシーが許可される分を定義します。2番目のフィールドに値を入力して範囲を指定することもできます。この場合、現在の分が指定した2つの値の間にあるか、等しい場合のみ許可されます。
-scopeName=このスコープのユニークな名前を設定します。名前はスコープの一意な識別に使用され、特定のスコープを照会する際に使用することができます。
-userInfoUrlHelp=UserInfoのURLを設定します。これはオプションです。
+minuteHelp=ポリシーが許可される時間（分）を指定します。2つ目のフィールドに値を入力することで、範囲指定も可能です。範囲指定した場合、現在の時間が指定範囲内である場合にのみ許可されます。
+scopeName=このスコープの一意な名前。名前はスコープの識別に使用され、特定のスコープを照会する際に使用することができます。
+userInfoUrlHelp=UserInfoエンドポイントのURLを設定します。これはオプションです。
 kc.realm.name=レルム
 impersonate=代理ログイン
 members=メンバー
@@ -150,135 +150,135 @@ scopePermissions.clients.token-exchange-description=このクライアントを
 adminURL=管理URL
 settings=設定
 webAuthnPolicyUserVerificationRequirement=ユーザー検証要件
-failureFactorHelp=検出するまでの失敗回数です。
+failureFactorHelp=検出するまでの失敗回数。
 webAuthnPolicyCreateTimeout=タイムアウト
-storeTokensHelp=ユーザー認証後のトークン格納の有効/無効を設定します。
-singleLogoutServiceUrlHelp=ログアウト・リクエストの送信に使用するURLを設定します。
-useTruststoreSpi=トラストストアSPIを使用
-usermodel.clientRoleMapping.rolePrefix.tooltip=各クライアント・ロールのプレフィックスを設定します（オプション）。
-storeTokens=トークンの格納
-userHelp=必要に応じて、サンプルのアクセストークンを生成するユーザーを選択します。ユーザーを選択しないと、評価中にサンプルのアクセストークンは生成されません
+storeTokensHelp=ユーザー認証後のトークン保存の有効/無効を設定します。
+singleLogoutServiceUrlHelp=ログアウトリクエストの送信先のURLを設定します。
+useTruststoreSpi=トラストストアSPIの使用
+usermodel.clientRoleMapping.rolePrefix.tooltip=各クライアントロールのプレフィックスを設定します（オプション）。
+storeTokens=トークンの保存
+userHelp=必要に応じて、サンプルのアクセストークンを生成するユーザーを選択します。ユーザーを選択しないと、評価中にサンプルのアクセストークンは生成されません。
 Sunday=日
-emailVerifiedHelp=ユーザーのEメールが確認済みかどうかを設定します。
-addExecution=エグゼキューションを追加
+emailVerifiedHelp=ユーザーのメールアドレスが検証済みかどうかを設定します。
+addExecution=エグゼキューションの追加
 editMode=編集モード
 passwordHelp=SMTPパスワード。このフィールドは、ボールトから値を取得できます。${vault.ID}形式を使用します。
-groupMembership=グループ・メンバーシップ
-fullSyncPeriod=フル同期の周期
-addNode=ノードを追加
+groupMembership=グループメンバーシップ
+fullSyncPeriod=完全同期の周期
+addNode=ノードの追加
 jwksUrl=JWKS URL
-policy-description=このポリシーの説明を設定します。
+policy-description=このポリシーの説明。
 policies=ポリシー
-parentClientScope=親クライアント・スコープ
+parentClientScope=親クライアントスコープ
 importClient=クライアントのインポート
 allTypes=すべてのタイプ
 ldapFilter=LDAPフィルター
-webAuthnPolicyRpEntityNameHelp=WebAuthnリライング・パーティーとしての人間が読み取れるサーバー名
+webAuthnPolicyRpEntityNameHelp=WebAuthnリライングパーティーとしての人間が読み取れるサーバー名
 postBrokerLoginFlowAlias=ログイン後のフロー
 tokens=トークン
-refreshTokenMaxReuse=リフレッシュ・トークンの最大再利用回数
+refreshTokenMaxReuse=リフレッシュトークンの最大再利用回数
 encryptAssertionsHelp=SAMLアサーションをクライアントの公開鍵でAESを使い暗号化すべきか設定します。
 clientScopes=クライアントスコープ
-httpPostBindingLogout=HTTP-POSTバインディング・ログアウト
+httpPostBindingLogout=HTTP-POSTバインディングログアウト
 requirement=必要条件
-permissionDescription=このパーミッションの説明を設定します。
+permissionDescription=このパーミッションの説明。
 multivalued.label=マルチバリュー
 minute=分
 useJwksUrl=JWKS URLの使用
 wantAssertionsSigned=アサーションの署名が必要
-algorithmNotSpecified=アルゴリズムの指定なし
-scopeParameter=スコープ・パラメーター
+algorithmNotSpecified=アルゴリズムが指定されていません
+scopeParameter=スコープパラメーター
 rememberMe=ログイン状態の保存
 flow.registration=登録フロー
 webAuthnPolicyAcceptableAaguids=許容可能なAAGUID
 registeredClusterNodes=登録済みクラスターノード
-storePassword=ストアのパスワード
-logoutServiceRedirectBindingURLHelp=シングル・ログアウト・サービスのSAMLRedirectバインディングURLを設定します。異なるBindingを使用している場合は空でよいです。
+storePassword=パスワードの保存
+logoutServiceRedirectBindingURLHelp=シングルログアウトサービスのSAMLリダイレクトバインディングURLを設定します。異なるバインディングを使用している場合は空にします。
 defaultGroups=デフォルトグループ
 flow.browser=ブラウザーフロー
-scopePermissions.clients.map-roles-client-scope-description=管理者がこのクライアントによって定義されたロールを別のクライアントのクライアント・スコープに適用できるかどうかを決定するポリシー
+scopePermissions.clients.map-roles-client-scope-description=管理者がこのクライアントによって定義されたロールを別のクライアントのクライアントスコープに適用できるかどうかを決定するポリシー
 addressClaim.street.tooltip=「address」トークンクレーム内の「street_address」サブクレームにマップするために使用されるユーザー属性の名前。デフォルトは「street」です。
-includeInIdToken.tooltip=クレームをIDトークンに追加すべきかどうかを設定します。
+includeInIdToken.tooltip=クレームをIDトークンに追加すべきかどうか。
 password=パスワード
 httpPostBindingResponseHelp=HTTP-POSTバインディングを使用してリクエストに応答するかどうかを設定します。オフの場合は、HTTP-REDIRECTバインディングが使用されます。
 allowPasswordAuthentication=パスワード認証を許可
 pairwiseSubAlgorithmSalt.tooltip=ペアワイズ対象識別子を計算する際に使用するソルトを設定します。空白のままにするとソルトは生成されます。
 clientAuthorization=認可
-waitIncrementSecondsHelp=失敗回数が閾値に達した場合、どれくらいの時間ユーザーはロックアウトされるか設定します。
+waitIncrementSecondsHelp=失敗回数が閾値に達した場合に、ユーザーがロックアウトされる時間。
 allowKerberosAuthentication=Kerberos認証を許可
 addressClaim.formatted.tooltip=「address」トークンクレーム内の「formatted」サブクレームにマップするために使用されるユーザー属性の名前。デフォルトは「formatted」です。
 allowedClockSkew=許容されるクロックスキュー
 events=イベント
-createPermission=パーミッションを作成
+createPermission=パーミッションの作成
 mapperType=マッパータイプ
 credentialResetConfirm=メールの送信
-permissionsEnabledHelp=このロールを管理するために、きめ細かいパーミッションを有効にするかどうかを決定します。無効にすると、設定されている現在のパーミッションがすべて削除されます。
-consentScreenTextHelp=このクライアント・スコープが同意が必要なクライアントに追加された場合に、同意画面に表示されるテキスト。指定しない場合は、デフォルトでクライアント・スコープの名前になります
+permissionsEnabledHelp=このロールを管理するために、きめ細かいパーミッションを有効にするかどうかを決定します。無効にすると、現在のパーミッションがすべて削除されます。
+consentScreenTextHelp=同意が必要なクライアントにこのクライアントスコープが追加された場合に、同意画面に表示されるテキスト。指定しない場合は、デフォルトでクライアントスコープの名前になります。
 kerberosRealm=Kerberosレルム
-flow.direct\ grant=ダイレクト・グラント・フロー
-typeHelp=作成された各クライアントにデフォルト・スコープとして追加されるクライアント・スコープ
+flow.direct\ grant=ダイレクトグラントフロー
+typeHelp=作成された各クライアントにデフォルトスコープとして追加されるクライアントスコープ。
 htmlDisplayName=HTML表示名
 authorizationUrl=認可URL
 contextualAttributes=コンテキスト属性
 replyTo=返信先
 providerDescription=プロバイダーの説明
 scopePermissions.clients.view-description=管理者がこのクライアントを表示できるかどうかを決定するポリシー
-idpInitiatedSsoRelayStateHelp=IDP Initiated SSOを行う際のSAMLリクエストで送信したいRelayStateを設定します。
-otpHashAlgorithmHelp=OTPを生成するのにどのハッシュ・アルゴリズムを使用するか設定します。
-usermodel.clientRoleMapping.clientId.tooltip=ロールマッピング用のクライアントID。このクライアントのクライアント・ロールだけがトークンに追加されます。これが設定されていない場合は、すべてのクライアントのクライアント・ロールがトークンに追加されます。
-passCurrentLocaleHelp=現在のロケールをui_localesパラメーターとしてアイデンティティー・プロバイダーに渡します。
+idpInitiatedSsoRelayStateHelp=IDP起点のSSOを行う際のSAMLリクエストで送信したいRelayState。
+otpHashAlgorithmHelp=OTPを生成するために使用するハッシュアルゴリズム
+usermodel.clientRoleMapping.clientId.tooltip=ロールマッピング用のクライアントID。このクライアントのクライアントロールだけがトークンに追加されます。これが設定されていない場合は、すべてのクライアントのクライアントロールがトークンに追加されます。
+passCurrentLocaleHelp=現在のロケールをui_localesパラメーターとしてアイデンティティープロバイダーに渡します。
 scopePermissions.clients.manage-description=管理者がこのクライアントを管理できるかどうかを決定するポリシー
 vendor=ベンダー
-webAuthnPolicyRequireResidentKeyHelp=これは、オーセンティケーターに公開鍵クレデンシャルを常駐鍵として作成するかどうかを指示します。
-logoutServiceRedirectBindingURL=ログアウト・サービスのRedirectバインディングURL
-dayMonth=ポリシーが許可される日を定義します。2番目のフィールドに値を入力して範囲を指定することもできます。この場合、現在の日が指定した2つの値の間にあるか、等しい場合のみ許可されます。
+webAuthnPolicyRequireResidentKeyHelp=オーセンティケーターに、公開鍵クレデンシャルを検出可能なクレデンシャルとして作成するかどうかを指示します。
+logoutServiceRedirectBindingURL=ログアウトサービスのリダイレクトバインディングURL
+dayMonth=日
 disabled=無効
 idpInitiatedSsoRelayState=IDP Initiated SSOのRelayState
-validatingX509Certs=検証用のX509証明書
+validatingX509Certs=X509証明書の検証
 guiOrder=表示順
-userInfoUrl=UserInfo URL
+userInfoUrl=ユーザー情報URL
 displayOnConsentScreen=同意画面で表示する
 principalAttributeHelp=外部ユーザーを識別するために使用される属性の名前またはフレンドリー名。
-nameIdPolicyFormat=Name IDポリシー・フォーマット
+nameIdPolicyFormat=NameIDポリシーフォーマット
 idpInitiatedSsoUrlName=IDP-Initiated SSOのURL名
 xFrameOptions=X-Frame-Options
-scopeDescriptionHelp=クライアント・スコープの説明
+scopeDescriptionHelp=クライアントスコープの説明
 directGrant=ダイレクトグラントフロー
-consensus=Consensus
-nameIdFormatHelp=サブジェクトに使用するName IDフォーマットを設定します。
-ssoSessionIdleRememberMe=リメンバーミー・セッションの有効期限が切れるまでのアイドル時間です。セッションが期限切れになると、トークンおよびブラウザー・セッションは無効になります。設定されていない場合は、標準のSSOセッション・アイドル値が使用されます。
+consensus=コンセンサス
+nameIdFormatHelp=サブジェクトに使用するName IDフォーマット。
+ssoSessionIdleRememberMe=ログイン状態保存時のセッションの有効期限が切れるまでのアイドル時間です。セッションが期限切れになると、トークンおよびブラウザーセッションは無効になります。設定されていない場合は、標準のSSOセッションアイドル値が使用されます。
 adminEvents=管理イベント
-SSOSessionIdleRememberMe=SSOセッション・アイドル・リメンバーミー
+SSOSessionIdleRememberMe=ログイン状態保存時のSSOセッションアイドル
 urisHelp=リソースによって保護されているURIのセット。
-serverPrincipal=サーバー・プリンシパル
-signDocuments=ドキュメントを署名する
+serverPrincipal=サーバープリンシパル
+signDocuments=ドキュメントの署名
 tokenUrl=トークンURL
 webauthnPolicy=WebAuthnポリシー
-grantedClientScopes=付与されたクライアント・スコープ
-evictionHour=エビクションの時
-effectiveProtocolMappers=有効なプロトコル・マッパー
+grantedClientScopes=付与されたクライアントスコープ
+evictionHour=エビクションの時間
+effectiveProtocolMappers=有効なプロトコルマッパー
 notBefore=この日時より前
 syncModes.legacy=レガシー
 ldapMappersList=LDAPマッパー
 titleEvents=イベント
 continue=続ける
-acceptsPromptNoneHelp=これは、アイデンティティー・プロバイダー・オーセンティケーターとともに使用されるか、またはkc_idp_hintがこのアイデンティティー・プロバイダーを指す場合に使用されます。クライアントがprompt\=noneでリクエストを送信し、ユーザーがまだ認証されていない場合、エラーは直接クライアントに返されませんが、prompt\=noneのリクエストはこのアイデンティティー・プロバイダーに転送されます。
-included.client.audience.label=含まれるクライアント・オーディエンス
-selectScope=スコープを選択
-generateNewKeys=新しい鍵を生成
-offlineSessionIdle=オフライン・セッション・アイドル
-revokeRefreshToken=リフレッシュ・トークンの無効化
+acceptsPromptNoneHelp=これは、アイデンティティープロバイダーオーセンティケーターとともに使用されるか、またはkc_idp_hintがこのアイデンティティープロバイダーを指す場合に使用されます。クライアントがprompt=noneでリクエストを送信し、ユーザーがまだ認証されていない場合、エラーは直接クライアントに返されませんが、prompt=noneのリクエストはこのアイデンティティープロバイダーに転送されます。
+included.client.audience.label=含まれるクライアントオーディエンス
+selectScope=スコープの選択
+generateNewKeys=RSA鍵の生成
+offlineSessionIdle=オフラインセッションアイドル
+revokeRefreshToken=リフレッシュトークンの無効化
 minimumQuickLoginWaitSeconds=クイックログイン失敗時の最小待機時間
 operationTypes=操作タイプ
 expireTime=有効期限
 adminThemeHelp=管理コンソールのテーマを選択します。
-name=クライアント・スコープの名前。レルム内でユニークでなければなりません。スコープ・パラメーターの値として使用されるため、名前には空白文字を含めないでください
+name=名前
 clientList=クライアント
-userSession.modelNote.label=ユーザー・セッション・ノート
+userSession.modelNote.label=ユーザーセッションノート
 next=次へ
 pagination=ページネーション
 import=インポート
-otpHashAlgorithm=OTPハッシュ・アルゴリズム
+otpHashAlgorithm=OTPハッシュアルゴリズム
 mapper.nameid.format.tooltip=このマッパーは、AuthnRequestのNameIDフォーマットがこの値に等しい場合にのみ適用されます。
 hideOnLoginPageHelp=非表示の場合、明示的に要求されていれば（例えば、「kc_idp_hint」パラメーターを使用していれば）、このプロバイダーによるログインが可能です。
 description=説明
@@ -293,42 +293,42 @@ maxFailureWaitSeconds=最大待機時間
 configure=設定
 manage=管理
 alwaysDisplayInUI=常にコンソールに表示
-kerberosIntegration=Kerberosと統合
+kerberosIntegration=Kerberosとの統合
 protocolMapper=プロトコルです。
 requiredSettings=必要な設定
 time=日時
 scopePermissions.users.view-description=管理者がレルム内のすべてのユーザーを表示できるかどうかを決定するポリシー
 idTokenSignatureAlgorithmHelp=IDトークンの署名に使用されるJWAアルゴリズム。
-sslType.all=全てのリクエスト
-excludeSessionStateFromAuthenticationResponse=認証レスポンスからセッション状態を除外
-httpPostBindingResponse=HTTP-POSTバインディング・レスポンス
+sslType.all=すべてのリクエスト
+excludeSessionStateFromAuthenticationResponse=認証レスポンスからのセッション状態の除外
+httpPostBindingResponse=HTTP-POSTバインディングレスポンス
 saveEvents=イベントの保存
 issuer=発行者（Issuer）
 policyEnforcementModeHelp=ポリシー施行モードは、認可リクエストを評価する際に適用される方法を決定します。「Enforcing」は、与えられたリソースに関連するポリシーが存在しない場合でも、リクエストはデフォルトで拒否されることを意味します。「Permissive」は、与えられたリソースに関連するポリシーが存在しない場合でも、リクエストは許可されることを意味します。「Disabled」は、完全にポリシーの評価を無効にし、任意のリソースへのアクセスを許可します。
 lastUpdated=最終更新日
 credentialResetBtn=クレデンシャルのリセット
-selectAUser=ユーザーを選択
+selectAUser=ユーザーの選択
 eventTypes.RESET_PASSWORD.name=パスワードのリセット
-oAuthMutual=OAuth 2.0相互TLS証明書バインド・アクセストークンが有効
+oAuthMutual=OAuth 2.0相互TLS証明書バインドアクセストークンの有効化
 keystore=キーストア
-canonicalizationHelp=XML署名の正規化方式（Canonicalization Method）を設定します。
+canonicalizationHelp=XML署名の正規化方式。
 sessions=セッション
-fullSyncPeriodHelp=フル同期の周期を秒で設定します。
+fullSyncPeriodHelp=完全同期の周期（秒）。
 priority=優先度
-trustEmail=Eメールを信頼
+trustEmail=メールアドレスを信頼する
 jsonType.label=クレームJSONタイプ
 fullScopeAllowed=フルスコープを許可
 syncModes.inherit=継承
-masterSamlProcessingUrlHelp=設定された場合は、このURLがSPのアサーション・コンシューマーおよびシングル・ログアウト・サービスの両方のBindingに使われます。これは、SAMLエンドポイントの詳細設定にある各Bindingやサービスの設定にて個別に上書きすることができます。
-claimJsonType=トークンへのJSONクレームの追加で使用されるJSONタイプを設定します。long、int、boolean、String、JSONが有効な値です。
-sslType.external=外部リクエスト
+masterSamlProcessingUrlHelp=設定された場合は、このURLがSPのアサーションコンシューマーおよびシングルログアウトサービスの両方のバインディングに使われます。これは、SAMLエンドポイントの詳細設定にある各バインディングやサービスの設定にて個別に上書きすることができます。
+claimJsonType=トークンへのJSONクレームの追加で使用されるJSONタイプを設定します。有効な値は、long、int、boolean、String、JSONです。
+sslType.external=外部からのリクエスト
 multiValued=属性がマルチバリューをサポートしているかどうかを示します。サポートしている場合は、この属性のすべての値リストがクレームとして設定されます。サポートしていない場合は、最初の値だけがクレームとして設定されます。
-webAuthnPolicyAttestationConveyancePreferenceHelp=認証ステートメントを生成する方法の優先権をオーセンティケーターに通知します。
-duplicateEmailsHelpText=複数のユーザーが同じEメールアドレスを持つことを許可します。この設定を変更すると、ユーザーのキャッシュもクリアされます。重複するEメールアドレスのサポートを無効にした後で、データベース内の既存ユーザーのEメールの制約を手動で更新することをお勧めします。
+webAuthnPolicyAttestationConveyancePreferenceHelp=認証ステートメントを生成する方法の優先順位をオーセンティケーターに通知します。
+duplicateEmailsHelpText=複数のユーザーが同じメールアドレスを持つことを許可します。この設定を変更すると、ユーザーのキャッシュも消去されます。重複するメールアドレスのサポートを無効にした後で、データベース内の既存ユーザーのメールの制約を手動で更新することをお勧めします。
 usermodel.realmRoleMapping.rolePrefix.label=レルムロールのプレフィックス
 temporaryPasswordHelpText=有効の場合は、ユーザーは次のログイン時にパスワードの変更が必要となります。
 connectionPooling=接続プーリング
-wantAuthnRequestsSignedHelp=アイデンティティー・プロバイダーが署名付きAuthnRequestを要求するかどうかを設定します。
+wantAuthnRequestsSignedHelp=アイデンティティープロバイダーが署名付きAuthnRequestを要求するかどうかを設定します。
 enabled=有効
 forgotPassword=パスワード忘れ
 idTokenEncryptionKeyManagementAlgorithmHelp=IDトークンの暗号化鍵の管理に使用されるJWAアルゴリズム。このオプションは、暗号化されたIDトークンが必要な場合に必須です。空のままにすると、IDトークンは署名されますが、暗号化されません。
@@ -336,199 +336,198 @@ keyPassword=鍵のパスワード
 scopePermissions.clients.map-roles-composite-description=管理者がこのクライアントによって定義されたロールをコンポジットとして別のロールに適用できるかどうかを決定するポリシー
 startTime=開始時間
 logicHelp=ロジックは、ポリシーの判定方法を決定します。「Positive」の場合は、このポリシーの評価中に得られた結果（許可または拒否）が判定の実行に使用されます。「Negative」の場合は、結果は反転されます。つまり、許可は拒否になり、拒否は許可になります。
-clientNameHelp=クライアントの表示名を指定します。例えば、「My Client」です。ローカライズ用のキーもサポートしています。例: ${my_client}
+clientNameHelp=クライアントの表示名を指定します。例えば、「My Client」です。ローカライズ用のキーもサポートしています。例：${my_client}
 createPolicy=クライアントポリシーの作成
-clearAdminEvents=管理イベントのクリア
+clearAdminEvents=管理イベントの消去
 rootUrl=ルートURL
 clientLoginTimeout=クライアントのログインタイムアウト
-webAuthnPolicyExtraOrigins=エクストラオリジンズ
-alwaysDisplayInUIHelp=ユーザーのアクティブなセッションがない場合でも、このクライアントを常にアカウント・コンソールに一覧表示します。
+webAuthnPolicyExtraOrigins=エクストラオリジン
+alwaysDisplayInUIHelp=ユーザーのアクティブなセッションがない場合でも、このクライアントを常にアカウントコンソールに一覧表示します。
 readTimeout=読み取りタイムアウト
 samlSignatureKeyName=SAML署名鍵名
 accessTokenSignatureAlgorithm=アクセストークン署名アルゴリズム
-logicType.negative=Negative
+logicType.negative=否定的
 otpPolicy=OTPポリシー
 flow-type.form-flow=form
 signDocumentsHelp=SAMLドキュメントをレルムで署名すべきか設定します。
-resetPassword=パスワードをリセット
+resetPassword=パスワードのリセット
 requireSslHelp=HTTPSが必須かどうか。「なし」は、HTTPSがどのIPアドレスのクライアントにも要求されないことを意味します。「外部リクエスト」は、ローカルホストとプライベートIPアドレスのクライアントがHTTPSなしでアクセスできることを意味します。「すべてのリクエスト」は、HTTPSがすべてのIPアドレスのクライアントに要求されることを意味します。
 addUser=ユーザーの追加
-includeAuthnStatementHelp=認証方式とタイムスタンプを含めたステートメントをログイン・レスポンスに含めるべきか設定します。
+includeAuthnStatementHelp=認証方式とタイムスタンプを含めたステートメントをログインレスポンスに含めるべきか。
 protocol=プロトコル
 manageAccount=アカウントの管理
-clientSecret=クライアント・シークレット
+clientSecret=クライアントシークレット
 httpPostBindingAuthnRequest=AuthnRequestのHTTP-POSTバインディング
-includeInAccessToken.label=アクセストークンに追加
+includeInAccessToken.label=アクセストークンへの追加
 iconUri=アイコンURI
 usersInRole=ロールのユーザー
 groupsClaimHelp=定義されている場合、ポリシーは、パーミッションを要求するアイデンティティーを表すアクセストークンまたはIDトークン内の特定のクレームから、ユーザーのグループを取得します。定義されていない場合、ユーザーのグループはレルム設定から取得されます。
 createGroup=グループの作成
-clientAuthentications.client_secret_jwt=JWTでクライアント・シークレット
+clientAuthentications.client_secret_jwt=クライアントシークレットでJWTに署名
 created=作成日
 minutes=分
 usersDN=ユーザーDN
 selectUser=サーバーからパーミッションを検索するためにIDが使用されるユーザーを選択します。
-included.custom.audience.label=含まれるカスタム・オーディエンス
-requestObjectSignatureAlgorithm=リクエスト・オブジェクトの署名アルゴリズム
+included.custom.audience.label=含まれるカスタムオーディエンス
+requestObjectSignatureAlgorithm=リクエストオブジェクトの署名アルゴリズム
 tokenLifespan.expires=有効期限
 mappers=マッパー
 waitIncrementSeconds=連続失敗時の待機時間
-name-id-format=Name IDフォーマット
+name-id-format=NameIDフォーマット
 credentials=クレデンシャル
-webAuthnPolicyCreateTimeoutHelp=ユーザーの公開鍵クレデンシャルの作成に対するタイムアウト値（秒単位）。0に設定すると、このタイムアウト・オプションは適応されません。
+webAuthnPolicyCreateTimeoutHelp=ユーザーの公開鍵クレデンシャルの作成に対するタイムアウト値（秒単位）。0に設定すると、このタイムアウトオプションは適応されません。
 policyType.hotp=カウンターベース
-enableSSL=SSLの有効
+enableSSL=SSLの有効化
 general=一般
 failureFactor=最大ログイン失敗回数
-usermodel.clientRoleMapping.tokenClaimName.tooltip=トークン内に挿入するクレームの名前を設定します。「address.street」のように完全修飾名で設定します。この場合、ネストされたJSONオブジェクトが作成されます。ネスティングを防ぎ、ドットを文字通りに使用するには、ドットをバックスラッシュ（\\.）でエスケープします。特別なトークン${client_id}を使うことができ、これは実際のクライアントIDに置き換えられます。使用例は「resource_access.${client_id}.roles」です。これは、すべてのクライアントからロールを追加する場合（特に「Client ID」スイッチが設定されていない場合）や、各クライアントのクライアント・ロールを別々の場所に保存する場合に、特に便利です。
-signAssertions=アサーションを署名する
+usermodel.clientRoleMapping.tokenClaimName.tooltip=トークン内に挿入するクレームの名前を設定します。「address.street」のように完全修飾名で設定します。この場合、ネストされたJSONオブジェクトが作成されます。ネスティングを防ぎ、ドットを文字通りに使用するには、ドットをバックスラッシュ（\\.）でエスケープします。特別なトークン${client_id}を使うことができ、これは実際のクライアントIDに置き換えられます。使用例は「resource_access.${client_id}.roles」です。これは、すべてのクライアントからロールを追加する場合（特に「クライアントID」スイッチが設定されていない場合）や、各クライアントのクライアントロールを別々の場所に保存する場合に、特に便利です。
+signAssertions=アサーションの署名
 scopePermissions.clients.map-roles-description=管理者がこのクライアントによって定義されたロールをマップできるかどうかを決定するポリシー
-disableUserInfoHelp=追加のユーザー情報を取得するUserInfoサービスの使用を無効にするかどうかを設定します。デフォルトではこのOIDCサービスを使用します。
-adminTheme=管理コンソールテーマ
+disableUserInfoHelp=追加のユーザー情報を取得するユーザー情報サービスの使用を無効にするかどうかを設定します。デフォルトではこのOIDCサービスを使用します。
+adminTheme=管理コンソールのテーマ
 alias=エイリアス
 validateSignatures=SAMLレスポンスの署名検証の有効/無効を設定します。
 authentication=認証
-descriptionHelp=クライアント・スコープの説明
+descriptionHelp=新しいフローの説明のヘルプテキスト
 logoutUrlHelp=外部IDPからユーザーのログアウトに使用するセッション終了エンドポイントを設定します。
 permissionType=このパーミッションが適用されるリソースタイプを指定します。
 policyEnforcementModes.ENFORCING=実施
-permanentLockout=永久ロックアウト
+permanentLockout=永続的なロックアウト
 debug=デバッグ
-webAuthnPolicyRequireResidentKey=常駐鍵が必要
-clear=クリア
+webAuthnPolicyRequireResidentKey=検出可能なクレデンシャルの要求
+clear=消去
 signatureAlgorithm=署名アルゴリズム
 eventTypes.LOGOUT.name=ログアウト
 groupsClaim=グループクレーム
 requiredActions=必須アクション
-authenticationOverridesHelp=レルム認証フロー・バインディングをオーバーライドします。
+authenticationOverridesHelp=レルム認証フローバインディングを上書きします。
 policyDecisionStagey=決定戦略は、ポリシーの評価方法と最終的な判定方法を決定します。「Affirmative」は、最終判定がpositiveとなるためには、少なくとも1つのポリシーがpositiveと評価する必要がある、ということを意味します。「Unanimous」は、全体の判定がpositiveとなるためには、すべてのポリシーがpositiveと評価する必要がある、ということを意味します。「Consensus」は、positiveの数がnegativeの数より多くなければならないことを意味します。positiveとnegativeの数が同じ場合は、最終的な判定はnegativeになります。
-resetActions=リセット・アクション
+resetActions=リセットアクション
 batchSize=バッチサイズ
-usermodel.prop.tooltip=UserModelインターフェイスのプロパティー・メソッドの名前です。例えば、「email」の値はUserModel.getEmail()メソッドを参照しています。
+usermodel.prop.tooltip=UserModelインターフェイスのプロパティーメソッドの名前です。例えば、「email」の値はUserModel.getEmail()メソッドを参照しています。
 user=ユーザー
-otpTypeHelp=「totp」はタイムベースのワンタイム・パスワードです。「hotp」は、サーバーでハッシュに対してカウンターを保持するカウンターベースのワンタイム・パスワードです。
-keyForCodeExchange=Proof Key for Code Exchangeのコードチャレンジ方式
-endpointsHelp=プロトコル・エンドポイントの設定を表示します。
+otpTypeHelp=「totp」は時間ベースのワンタイムパスワードです。「hotp」はサーバーでハッシュ値計算対象としてカウンターを保持するカウンターベースのワンタイムパスワードです。
+keyForCodeExchange=PKCEの方式
+endpointsHelp=サービスプロバイダーのエンドポイントの設定を表示します。
 useKerberosForPasswordAuthentication=パスワード認証にKerberosを使用
-xXSSProtection=X-XSS-Protection
 debugHelp=Krb5LoginModuleの標準出力へのデバッグロギングの有効/無効を設定します。
 validatorColNames.colConfig=設定
 nodeHost=ノードホスト
-quickLoginCheckMilliSeconds=クイックログインチェックのミリ秒
-unspecified=未定義
+quickLoginCheckMilliSeconds=クイックログインチェックの時間（ミリ秒）
+unspecified=未指定
 profile=プロファイル
 active=アクティブ
 forcePostBindingHelp=レスポンスに常にPOSTバインディングを使用します。
 roleName=ロール名
-addOrigins=オリジンを追加
-requiredUserActionsHelp=ユーザーがログインするときに必要なアクションです。「Verify email」は、Eメールアドレスを確認するためのEメールをユーザーに送信します。「Update profile」は、新しい個人情報を入力する必要があります。「Update password」は、ユーザーが新しいパスワードを入力する必要があります。「Configure OTP」は、モバイル・パスワード・ジェネレーターの設定が必要です。
-requestObjectSignatureAlgorithmHelp=クライアントが「request」または「request_uri」パラメーターで指定されたOIDCリクエスト・オブジェクトを送信する際に使用する必要がある、JWAアルゴリズムを設定します。「any」に設定した場合は、リクエスト・オブジェクトは任意のアルゴリズム（「none」を含む）で署名されます。
-deleteEvents=イベントのクリア
-includeOneTimeUseConditionHelp=OneTimeUse条件をログイン・レスポンスに含めるべきか設定します。
-accessTokenLifespanHelp=アクセストークンが有効期限切れとなる最大時間です。この値はSSOタイムアウトと比べて短くすることをお勧めします。
-redirectURIHelp=アイデンティティー・プロバイダーの設定で使用するリダイレクトURIです。
+addOrigins=オリジンの追加
+requiredUserActionsHelp=ユーザーがログインするときに必要なアクションです。「Verify email」は、メールアドレスを確認するためのメールをユーザーに送信します。「Update profile」は、新しい個人情報を入力する必要があります。「Update password」は、ユーザーが新しいパスワードを入力する必要があります。「Configure OTP」は、モバイルパスワードジェネレーターの設定が必要です。
+requestObjectSignatureAlgorithmHelp=クライアントが「request」または「request_uri」パラメーターで指定されたOIDCリクエストオブジェクトを送信する際に使用する必要がある、JWAアルゴリズムを設定します。「any」に設定した場合は、リクエストオブジェクトは任意のアルゴリズム（「none」を含む）で署名されます。
+deleteEvents=イベントの消去
+includeOneTimeUseConditionHelp=OneTimeUse条件をログインレスポンスに含めるべきか設定します。
+accessTokenLifespanHelp=アクセストークンが有効期限切れとなる時間です。この値はSSOタイムアウトと比べて短くすることをお勧めします。
+redirectURIHelp=アイデンティティープロバイダーの設定で使用するリダイレクトURI。
 resourcePath=リソースパス
 permissionsEnabled=パーミッションが有効
-attestationPreference.none=none
-useJwksUrlHelp=有効とした場合は、アイデンティティー・プロバイダーの公開鍵が指定されたJWKS URLからダウンロードされます。アイデンティティー・プロバイダーが新しい鍵ペアを生成する際に、新しい鍵が常に再ダウンロードされるため、柔軟性が大幅に向上します。無効とした場合は、Keycloak DBの公開鍵（または証明書）が使用されるため、アイデンティティー・プロバイダーの鍵ペアが変更された際には、常にKeycloak DBに新しい鍵をインポートする必要があります。
+attestationPreference.none=なし
+useJwksUrlHelp=有効とした場合は、アイデンティティープロバイダーの公開鍵が指定されたJWKS URLからダウンロードされます。アイデンティティープロバイダーが新しい鍵ペアを生成する際に、新しい鍵が常に再ダウンロードされるため、柔軟性が大幅に向上します。無効とした場合は、Keycloak DBの公開鍵（または証明書）が使用されるため、アイデンティティープロバイダーの鍵ペアが変更された際には、常にKeycloak DBに新しい鍵をインポートする必要があります。
 pairwiseSubAlgorithmSalt.label=ソルト
 revocation=無効化
-scopeTypeHelp=作成された各クライアントにデフォルト・スコープとして追加されるクライアント・スコープ
+scopeTypeHelp=作成された各クライアントにデフォルトスコープとして追加されるクライアントスコープ
 useEntityDescriptor=エンティティーディスクリプターを使用する
-loginActionTimeout=ログイン・アクション・タイムアウト
+loginActionTimeout=ログインアクションタイムアウト
 cacheSettings=キャッシュ設定
-validRedirectURIs=ログインまたはログインの成功後にブラウザーがリダイレクト可能とする、有効なURIパターンを設定します。「http\://example.com/*」のような単純なワイルドカードが使用可能です。相対パス、つまり「/my/relative/path/*」も指定可能です。相対パスはクライアントのルートURLを基準とします。または、未指定の場合は認証サーバーのルートURLが使用されます。SAMLでは、ログイン・リクエストに埋め込まれたコンシューマー・サービスのURLに依存している場合は、有効なURIパターンを設定する必要があります。
-removeImported=インポートを削除
-assertionConsumerServicePostBindingURL=アサーション・コンシューマー・サービスのPOSTバインディングURL
+validRedirectURIs=ログインまたはログインの成功後にブラウザーがリダイレクト可能とする、有効なURIパターンを設定します。「http://example.com/*」のような単純なワイルドカードが使用可能です。相対パス、つまり「/my/relative/path/*」も指定可能です。相対パスはクライアントのルートURLを基準とします。または、未指定の場合は認証サーバーのルートURLが使用されます。SAMLでは、ログインリクエストに埋め込まれたコンシューマーサービスのURLに依存している場合は、有効なURIパターンを設定する必要があります。
+removeImported=インポートの削除
+assertionConsumerServicePostBindingURL=アサーションコンシューマーサービスのPOSTバインディングURL
 endpoints=エンドポイント
-validatingX509CertsHelp=署名の確認に使用するPEM形式の証明書を設定します。
-importFile=ファイルをインポート
-protocolHelp=このクライアント・スコープによって提供されているSSOプロトコル設定がどれか
+validatingX509CertsHelp=「メタデータ記述子URLの使用」がオフの場合、Keycloakが外部IdPからのSAMLリクエストとレスポンスの署名を検証するために使用する公開証明書です。複数の証明書をカンマ（,）で区切って入力できます。アイデンティティープロバイダーページの「鍵のインポート」アクションをクリックすると、メタデータ記述子URLから証明書を再インポートできます。このアクションにより、メタデータエンドポイント内の現在の証明書がダウンロードされ、同じオプションで設定に割り当てられます。「保存」をクリックすると、再インポートした証明書が確実に保存されます。
+importFile=ファイルのインポート
+protocolHelp=このクライアントスコープによって提供されているSSOプロトコル設定がどれか
 accessTokenSignatureAlgorithmHelp=アクセストークンの署名に使用されるJWAアルゴリズム。
-requestObjectRequired=リクエスト・オブジェクトが必要
+requestObjectRequired=リクエストオブジェクトが必要
 prompts.none=none
-resourcesHelp=このパーミッションが適用されるリソース・インスタンスを指定します。
+resourcesHelp=このパーミッションが適用されるリソースインスタンスを指定します。
 passwordConfirmation=新しいパスワード（確認）
-emailVerified=Eメールが確認済み
+emailVerified=メールアドレスが検証済み
 aggregate.attrs.tooltip=属性値をグループ属性と集約する必要があるかどうかを示します。OpenID Connectマッパーを使用している場合は、すべての値を取得するためにマルチバリューのオプションも有効にする必要があります。重複した値は破棄され、値の順序はこのオプションでは保証されません。
 Thursday=木
-requestObjectRequiredHelp=クライアントが認可リクエストとともにリクエスト・オブジェクトを提供する必要があるかどうか、およびそのためにどの方法を使用できるかを指定します。「not required」に設定されている場合、リクエスト・オブジェクトの提供はオプションです。それ以外のケースでは、リクエスト・オブジェクトを提供する必要があります。「request」に設定されている場合、リクエスト・オブジェクトは値で提供される必要があります。「request_uri」に設定されている場合、リクエスト・オブジェクトは参照によって提供される必要があります。「requestまたはrequest_uri」に設定されている場合、いずれの方法も使用できます。
+requestObjectRequiredHelp=クライアントが認可リクエストとともにリクエストオブジェクトを提供する必要があるかどうか、およびそのためにどの方法を使用できるかを指定します。「not required」に設定されている場合、リクエストオブジェクトの提供はオプションです。それ以外のケースでは、リクエストオブジェクトを提供する必要があります。「request」に設定されている場合、リクエストオブジェクトは値で提供される必要があります。「request_uri」に設定されている場合、リクエストオブジェクトは参照によって提供される必要があります。「requestまたはrequest_uri」に設定されている場合、いずれの方法も使用できます。
 discoveryEndpoint=ディスカバリーエンドポイント
 countHelp=このトークンを利用してクライアントをいくつ作成可能か指定します。
 otpPolicyPeriod=OTPトークンの期間
 Monday=月
-frontendUrlHelp=レルムのフロントエンドURLを設定します。デフォルトのホスト名プロバイダーと組み合わせて使用し、特定のレルムのフロントエンド・リクエストのベースURLをオーバーライドします。
-cachePolicy=キャッシュ・ポリシー
-consentRequired=同意の必須
+frontendUrlHelp=レルムのフロントエンドURLを設定します。デフォルトのホスト名プロバイダーと組み合わせて使用し、特定のレルムのフロントエンドリクエストのベースURLを上書きします。
+cachePolicy=キャッシュポリシー
+consentRequired=同意の要求
 selectMethodType.import=インポート
 standardFlow=スタンダードフロー
 eventListeners=イベントリスナー
-clientScopeType.default=DEFAULT
+clientScopeType.default=デフォルト
 bindDn=バインドDN
 Friday=金
 wantAuthnRequestsSigned=AuthnRequestの署名が必要
-usermodel.attr.tooltip=格納されるユーザー属性名、UserMode.attributeマップ内の属性名です。
+usermodel.attr.tooltip=保存されるユーザー属性名、UserMode.attributeマップ内の属性名です。
 fineGrainOpenIdConnectConfiguration=OpenID Connectの詳細設定
 count=カウント
 testAuthentication=認証テスト
 month=月
 addressClaim.region.tooltip=「address」トークンクレーム内の「region」サブクレームにマップするために使用されるユーザー属性の名前。デフォルトは「region」です。
 expiration=有効期限
-logoutServicePostBindingURL=ログアウト・サービスのPOSTバインディングURL
-assertionConsumerServicePostBindingURLHelp=アサーション・コンシューマー・サービス（ログイン・レスポンス）のSAML POSTバインディングURLを設定します。このBindingのためのURLがない場合は空でよいです。
+logoutServicePostBindingURL=ログアウトサービスのPOSTバインディングURL
+assertionConsumerServicePostBindingURLHelp=アサーションコンシューマーサービス（ログインレスポンス）のSAML POSTバインディングURLを設定します。このバインディングのためのURLがない場合は空でよいです。
 resourceTypes=リソースタイプ
 includeInUserInfo.label=UserInfoに追加
 back=戻る
-validateSignatureHelp=外部IDPの署名検証の有効/無効を設定します。
+validateSignatureHelp=外部アイデンティティプロバイダーの署名検証の有効/無効を設定します。
 title=認証
-verifyEmail=メールアドレスの検証
+verifyEmail=メールの検証
 addressClaim.locality.label=市区町村のユーザー属性名
-formatOption=フォーマット・オプション
+formatOption=フォーマットオプション
 nodeReRegistrationTimeout=ノード再登録のタイムアウト
-client=client
+client=クライアント
 connectionURL=接続URL
-accessTokenLifespan=アクセストークン生存期間
-loginWithEmailHelpText=ユーザーがEメールアドレスでログインできるようにします。
+accessTokenLifespan=アクセストークンの有効期間
+loginWithEmailHelpText=ユーザーがメールアドレスでログインできるようにします。
 setToNow=現在日時を設定
-firstBrokerLoginFlowAliasOverrideHelp=このアイデンティティー・プロバイダーでの初回ログイン後に起動させる認証フローのエイリアスです。「初回ログイン」という用語は、認証したアイデンティティー・プロバイダー・アカウントに現在関連付けられているKeycloakアカウントがない状態であることを意味します。
+firstBrokerLoginFlowAliasOverrideHelp=このアイデンティティープロバイダーでの初回ログイン後に起動させる認証フローのエイリアス。「初回ログイン」という用語は、認証したアイデンティティープロバイダーアカウントに現在関連付けられているKeycloakアカウントがない状態であることを意味します。
 owner=オーナー
 implicitFlow=インプリシットフロー
-encryptAssertions=アサーションを暗号化する
+encryptAssertions=アサーションの暗号化
 keyAliasHelp=秘密鍵のエイリアス
 tokenClaimName.tooltip=トークン内に挿入するクレームの名前を設定します。「address.street」のように完全修飾名で設定します。この場合、ネストされたJSONオブジェクトが作成されます。ネスティングを防ぎ、ドットを文字通りに使用するには、ドットをバックスラッシュ（\\.）でエスケープします。
 userName=ユーザー名
 clientProfileDescription=説明
-ssoSessionMax=セッションの有効期限が切れるまでの最大時間です。セッションの有効期限が切れると、トークンとブラウザー・セッションは無効化されます。
+ssoSessionMax=セッションが切れるまでの最大時間です。セッションが切れるとトークンとブラウザーセッションは無効化されます。
 optimizeLookup=REDIRECT署名鍵検索の最適化
 browserFlowHelp=ブラウザー認証で使用したいフローを選択してください。
 temporaryLocked=一時的なロック
 setup=セットアップ
 realm=レルム
-prompt=プロンプト（prompt）
-showAuthData=認可データを表示
-includeInUserInfo.tooltip=クレームをUserInfoに追加すべきかどうかを設定します。
-unlinkUsers=ユーザーのリンクを解除する
+prompt=プロンプト
+showAuthData=認可データの表示
+includeInUserInfo.tooltip=クレームをユーザー情報に追加しますか？
+unlinkUsers=ユーザーのリンクの解除
 initialCounter=初期カウンター
-revokeRefreshTokenHelp=有効にすると、リフレッシュ・トークンは「リフレッシュ・トークンの最大再利用回数」までしか使用できず、別のトークンが使用されると無効化されます。無効にすると、リフレッシュ・トークンは使用後に無効化されず、複数回使用できます。
+revokeRefreshTokenHelp=有効にすると、リフレッシュトークンは「リフレッシュトークンの最大再利用回数」までしか使用できず、別のトークンが使用されると無効化されます。無効にすると、リフレッシュトークンは使用後に無効化されず、複数回使用できます。
 ownerManagedAccessHelp=有効にすると、このリソースへのアクセスをリソースオーナーが管理できます。
-authorization=きめ細かい認可のサポートを有効/無効にします。
+authorization=認可
 scopePermissions.users.map-roles-description=管理者がすべてのユーザーのロールをマップできるかどうかを決定するポリシー
-bindCredentialsHelp=LDAP管理者のパスワードを設定します。このフィールドは、ボールトから値を取得できます。${vault.ID}形式を使用します。
+bindCredentialsHelp=LDAP管理者のパスワード。このフィールドは、ボールトから値を取得できます。${vault.ID}形式を使用します。
 webAuthnPolicySignatureAlgorithms=署名アルゴリズム
 action=アクション
 id=ID
 join=参加
-idTokenEncryptionContentEncryptionAlgorithmHelp=IDトークンの暗号化の際に、コンテンツの暗号化に使用されるJWAアルゴリズム。このオプションは、暗号化されたIDトークンが必要な場合にのみ必須です。空のままにすると、IDトークンは署名されますが、暗号化されません。
-scopesHelp=認可リクエストの際に送信されるスコープです。スペース区切りでスコープのリストを設定します。デフォルトは「openid」です。
+idTokenEncryptionContentEncryptionAlgorithmHelp=IDトークンの暗号化に使用されるJWAアルゴリズム。このオプションはIDトークンの暗号化が必要な場合にのみ必須です。空のままにするとIDトークンに署名がされますが暗号化はされません。
+scopesHelp=認可リクエストで送信されるスコープです。スペース区切りでスコープのリストを設定します。デフォルトは「openid」です。
 includeAuthnStatement=AuthnStatementを含める
-multivalued.tooltip=属性がマルチバリューをサポートしているかどうかを示します。サポートしている場合は、この属性のすべての値リストがクレームとして設定されます。サポートしていない場合は、最初の値だけがクレームとして設定されます。
-addIdPMapper=アイデンティティー・プロバイダー・マッパーを追加
+multivalued.tooltip=属性がマルチバリューをサポートしているかどうかを示します。サポートしている場合は、この属性のすべての値のリストがクレームとして設定されます。サポートしていない場合は、最初の値だけがクレームとして設定されます。
+addIdPMapper=アイデンティティープロバイダーマッパーの追加
 enableStartTls=StartTLSの有効
 usersPermissionsHint=レルム内のすべてのユーザーを管理するきめ細かいパーミッション。レルム内のユーザーを管理できるユーザーには、さまざまなポリシーを定義できます。
 homeURL=ホームURL
 contentSecurityPolicyReportOnly=Content-Security-Policy-Report-Only
 firstBrokerLoginFlowAlias=初回ログインフロー
-clientScopeList=クライアント・スコープ
+clientScopeList=クライアントスコープ
 usernameLdapAttribute=ユーザー名のLDAP属性
 evaluate=評価
 status=ステータス
@@ -536,24 +535,24 @@ clients=クライアント
 clientName=名前
 syncModes.force=強制
 maxDeltaTimeSeconds=ログイン失敗回数のリセット時間
-backchannelLogoutHelp=外部IDPがバックチャンネル・ログアウトをサポートするどうかを設定します。
+backchannelLogoutHelp=外部アイデンティティプロバイダーがバックチャネルログアウトをサポートするか。
 usermodel.realmRoleMapping.rolePrefix.tooltip=各レルムロールのプレフィックスを設定します（オプション）。
 fromDisplayName=差出人の表示名
 affirmative=Affirmative
-maxFailureWaitSecondsHelp=ユーザーがロックアウトされる最大待機時間を設定します。
-userInfoSignedResponseAlgorithm=署名付きUserInfoレスポンスのアルゴリズム
-maxDeltaTimeSecondsHelp=いつ失敗回数がリセットされるか設定します。
+maxFailureWaitSecondsHelp=ユーザーがロックアウトされる最大待機時間。
+userInfoSignedResponseAlgorithm=UserInfoレスポンスの署名アルゴリズム
+maxDeltaTimeSecondsHelp=いつ失敗回数がリセットされるか。
 contentSecurityPolicy=Content-Security-Policy
 off=オフ
-frontchannelLogoutHelp=有効の場合は、ログアウトはクライアントへのブラウザー・リダイレクトが必要になります。無効の場合は、サーバーはログアウトのバックグラウンド呼び出しを行います。
-forwardParameters=転送されるクエリー・パラメーター
-oAuthMutualHelp=これにより、OAuth 2.0相互TLS証明書バインド・アクセストークンがサポートされます。つまり、Keycloakは、Keycloakのトークン・エンドポイントとこのクライアントの間で相互TLSにより交換されるクライアントのX.509証明書と、アクセストークンおよびリフレッシュ・トークンをバインドします。これらのトークンは、ベアラートークンの代わりにHolder-of-Keyトークンとして扱うことができます。
+frontchannelLogoutHelp=有効な場合、ログアウトするにはブラウザーをクライアントへリダイレクトさせる必要があります。無効な場合、サーバーはバックグラウンドでログアウト処理を行います。
+forwardParameters=転送されるクエリーパラメーター
+oAuthMutualHelp=これにより、OAuth 2.0相互TLS証明書バインドアクセストークンがサポートされます。つまり、Keycloakは、Keycloakのトークンエンドポイントとこのクライアントの間で相互TLS認証により交換されるクライアントのX.509証明書と、アクセストークンおよびリフレッシュトークンをバインドします。これらのトークンは、ベアラートークンの代わりにHolder-of-Keyトークンとして扱うことができます。
 scopes=スコープ
-principalType=プリンシパル・タイプ
+principalType=プリンシパルタイプ
 flowType=フロータイプ
-policyEnforcementModes.PERMISSIVE=許容
+policyEnforcementModes.PERMISSIVE=パーミッシブ
 auth=認証
-accessTokenLifespanImplicitFlow=インプリシット・フローにおけるアクセストークン生存期間
+accessTokenLifespanImplicitFlow=インプリシットフローにおけるアクセストークンの有効期間
 subject=サブジェクトDN
 defaultAdminInitiated=デフォルトの管理者起動アクションの有効期間
 remainingCount=残りのカウント
@@ -561,16 +560,16 @@ download=ダウンロード
 authScopes=認可スコープ
 host=ホスト
 optimizeLookupHelp=Keycloakアダプターによって保護されたSPのREDIRECTバインディングでSAMLドキュメントに署名する際、署名鍵のIDを<Extensions>要素のSAMLプロトコルメッセージに含める必要があるかどうかを設定します。これにより、検証のために既知のすべてのキーを試行する代わりに単一のキーを使用するため、署名の検証が最適化されます。
-supportedApplications=現在のOTPポリシーで動作することが分かっているアプリケーション
+supportedApplications=サポートされているアプリケーション
 resourceAttribute=リソース属性
 addressClaim.region.label=都道府県のユーザー属性名
 ipAddress=IPアドレス
-included.custom.audience.tooltip=これは「含まれるクライアント・オーディエンス」が入力されていない場合にのみ使用されます。指定された値が、トークンのオーディエンス（aud）フィールドに含まれます。トークンに既存のオーディエンスが存在する場合は、指定された値が単にそれらに追加されます。既存のオーディエンスを上書きすることはありません。
+included.custom.audience.tooltip=「含まれるクライアントオーディエンス」が空の場合のみ使用されます。指定された値はトークンのオーディエンス（aud）フィールドに含まれます。トークンに既にオーディエンスが含まれている場合、指定された値はそれらを上書きせずに追加されます。
 includeInIdToken.label=IDトークンに追加
 browserFlow=ブラウザーフロー
 anyScope=任意のスコープ
 serverInfo=サーバー情報
-emailThemeHelp=サーバーから送信されるEメールのテーマを選択します。
+emailThemeHelp=サーバーから送信されるメールのテーマを選択します。
 principalTypeHelp=アサーションから外部ユーザーを識別し、追跡する方法。デフォルトではSubject NameIDを使用しますが、識別属性を設定することもできます。
 Wednesday=水
 consents=同意
@@ -579,27 +578,27 @@ SSOSessionMax=SSOセッション最大
 minimumQuickLoginWaitSecondsHelp=クイックログイン失敗後にどれくらいの時間待機するか設定します。
 policyEnforcementModes.DISABLED=無効
 code=コード
-allowedClockSkewHelp=アイデンティティー・プロバイダーのトークンの検証時に許容されるクロックスキュー（秒単位）。デフォルト値は0です。
+allowedClockSkewHelp=アイデンティティープロバイダーのトークンの検証時に許容されるクロックスキュー（秒単位）。デフォルト値は0です。
 keys=鍵
 defaultSigAlg=デフォルトの署名アルゴリズム
 signatureKeyName=SAML署名鍵名
 certificate=証明書
 selectRole.label=ロールの選択
-prompts.consent=consent
-webAuthnPolicyRpEntityName=リライング・パーティー・エンティティー名
+prompts.consent=同意
+webAuthnPolicyRpEntityName=リライングパーティーエンティティー名
 hour=時
 connectionTimeoutHelp=LDAP接続タイムアウト（ミリ秒単位）
 defaultSigAlgHelp=このレルムでトークンの署名に使用されるデフォルトのアルゴリズム
 save-admin-eventsHelp=有効の場合は、管理イベントがデータベースに保存され、管理コンソールで使用可能になります。
-forwardParametersHelp=最初のアプリケーションへのリクエストから取得し、外部IDPの認可エンドポイントへ転送されるOpenID Connect/OAuth標準以外のクエリー・パラメーター。複数のパラメーターをカンマ（,）で区切って入力できます。
+forwardParametersHelp=最初のアプリケーションへのリクエストから取得し、外部IDPの認可エンドポイントへ転送されるOpenID Connect/OAuth非標準のクエリーパラメーター。複数のパラメーターをカンマ（,）で区切って入力できます。
 on=オン
-webAuthnPolicyRpId=リライング・パーティー・エンティティーID
+webAuthnPolicyRpId=リライングパーティーエンティティーID
 serviceAccount=サービスアカウントロール
-assertionConsumerServiceRedirectBindingURL=アサーション・コンシューマー・サービスのRedirectバインディングURL
-acceptsPromptNone=クライアントから転送されるprompt\=noneを受け入れる
+assertionConsumerServiceRedirectBindingURL=アサーションコンシューマーサービスのリダイレクトバインディングURL
+acceptsPromptNone=クライアントから転送されるprompt=noneの受け入れ
 loginThemeHelp=ログイン、OTP、グラント、登録、およびパスワード忘れに使用するページのテーマを選択します。
 userManagedAccess=User-Managed Access
-excludeSessionStateFromAuthenticationResponseHelp=これがオンの場合、パラメーター「session_state」はOpenID Connect認証レスポンスに含まれません。クライアントが「session_state」パラメーターをサポートしていない古いOIDC / OAuth2アダプターを使用している場合に便利です。
+excludeSessionStateFromAuthenticationResponseHelp=オンの場合、パラメーター「session_state」はOpenID Connect認証レスポンスに含まれません。クライアントが「session_state」パラメーターをサポートしていない古いOIDC / OAuth2アダプターを使用している場合に便利です。
 initialAccessToken=初期アクセストークン
 evictionDay=エビクションの日
 vendorHelp=LDAPベンダー（プロバイダー）
@@ -609,9 +608,9 @@ applyToResourceType=リソースタイプに適用
 selectRole.tooltip=左側にあるテキストボックスにロールを入力するか、ブラウズして必要なロールを選択するためにこのボタンをクリックしてください。
 setPassword=パスワードを設定
 editModeLdapHelp=READ_ONLYの場合、LDAPストアに読み取り専用でアクセスします。WRITABLEは、必要に応じてデータをLDAPに同期させることを意味します。UNSYNCEDは、ユーザーデータをインポートするが、LDAPに同期しないことを意味します。
-SSOSessionMaxRememberMe=SSOセッション最大リメンバーミー
+SSOSessionMaxRememberMe=ログイン状態保存時のSSOセッション最大
 Saturday=土
-save-user-eventsHelp=有効の場合は、ログインイベントがデータベースに保存され、管理コンソールとアカウント管理で使用することができます。
+save-user-eventsHelp=有効の場合は、ログインイベントがデータベースに保存され、管理コンソールとアカウント管理コンソールで使用することができます。
 composite=複合
 hourHelp=ポリシーが許可される時を定義します。2番目のフィールドに値を入力して範囲を指定することもできます。この場合、現在の時が指定した2つの値の間にあるか、等しい場合のみ許可されます。
 generatedAccessToken=生成されたアクセストークン
@@ -621,34 +620,34 @@ testConnection=接続テスト
 archiveFormat=アーカイブ形式
 associatedRolesText=関連ロール
 defaultLocale=デフォルトロケール
-clientIdHelp=アイデンティティー・プロバイダーで登録されているクライアント識別子を設定します。
+clientIdHelp=アイデンティティープロバイダーに登録されているクライアントの識別子。
 aggregate.attrs.label=属性値の集約
-flow-type.basic-flow=generic
-webauthnPasswordlessPolicy=WebAuthnパスワードレス・ポリシー
-allowPasswordAuthenticationHelp=Kerberosデータベースに対するユーザー名/パスワード認証の有効/無効を設定します。
-includeInAccessToken.tooltip=クレームをアクセストークンに追加すべきかどうかを設定します。
+flow-type.basic-flow=ジェネリック
+webauthnPasswordlessPolicy=WebAuthnパスワードレスポリシー
+allowPasswordAuthenticationHelp=Kerberosデータベースに対するユーザー名/パスワード認証の有効/無効を設定します
+includeInAccessToken.tooltip=クレームをアクセストークンに追加すべきかどうか。
 includeOneTimeUseCondition=OneTimeUse条件を含める
-clientsClientScopesHelp=このリソースに関連付けるスコープを設定します。
-envelopeFromHelp=バウンスに使用されるEメールアドレス（オプション）。
+clientsClientScopesHelp=このリソースに関連付けられたスコープです。
+envelopeFromHelp=バウンスに使用されるメールアドレス（オプション）。
 masterSamlProcessingUrl=SAMLを処理するマスターURL
-samlIdentityProviderMetadata=SAML 2.0アイデンティティー・プロバイダー・メタデータ
+samlIdentityProviderMetadata=SAML 2.0アイデンティティープロバイダーメタデータ
 key=キー
 email=メールアドレス
-identityProviders=アイデンティティー・プロバイダー
+identityProviders=アイデンティティープロバイダー
 importUsers=ユーザーのインポート
-scopeParameterHelp=このスコープ・パラメーターの値をコピー/ペーストし、このクライアント・アダプターから送信された最初のOpenID Connect認証リクエストで使用できます。このクライアントに発行されたトークンを生成するときは、デフォルトのクライアント・スコープと選択されたオプションのクライアント・スコープが使用されます
+scopeParameterHelp=このスコープパラメーターの値をコピー/ペーストし、このクライアントアダプターから送信された最初のOpenID Connect認証リクエストで使用できます。このクライアントに発行されたトークンを生成するときは、デフォルトのクライアントスコープと選択されたオプションのクライアントスコープが使用されます。
 idTokenEncryptionKeyManagementAlgorithm=IDトークン暗号化鍵管理アルゴリズム
-clientAuthentications.client_secret_basic=基本認証で送信されたクライアント・シークレット
-ssoSessionIdle=セッションの有効期限が切れるまでのアイドル時間です。セッションの有効期限が切れると、トークンとブラウザー・セッションは無効化されます。
+clientAuthentications.client_secret_basic=クライアントシークレットをベーシック認証で送信
+ssoSessionIdle=セッションの有効期限が切れるまでのアイドル時間です。セッションの有効期限が切れると、トークンとブラウザーセッションは無効化されます。
 userManagedAccessHelp=有効にすると、ユーザーはアカウント管理コンソールを使用してリソースとパーミッションを管理できます。
 policyType.totp=タイムベース
 emailTheme=メールテーマ
-scopePermissions.users.impersonate-description=管理者が他のユーザーを偽装できるかどうかを決定するポリシー
-registerNodeManually=ノードを手動で登録
+scopePermissions.users.impersonate-description=管理者が他のユーザーに代理ログインできるかどうかを決定するポリシー
+registerNodeManually=手動でのノードの登録
 redirectURI=リダイレクトURI
 publicKeys=公開鍵
-periodicFullSync=定期的なフル同期
-assertionLifespanHelp=SAMLアサーション条件に設定された有効期限。その後、アサーションは無効になります。「SessionNotOnOrAfter」属性は変更されず、レルムレベルで定義された「SSOセッション最大」時間を引き続き使用します。
+periodicFullSync=定期的な完全同期
+assertionLifespanHelp=SAMLアサーション条件に設定された有効期間。その後、アサーションは無効になります。「SessionNotOnOrAfter」属性は変更されず、レルムレベルで定義された「SSOセッション最大時間」を引き続き使用します。
 createdAt=作成日
 editUsername=有効の場合はユーザー名フィールドが編集可能になり、そうでない場合は読み取り専用になります。
 lastRegistration=最終登録
@@ -659,7 +658,7 @@ reevaluate=再評価
 syncMode=同期モード
 details=詳細
 strictTransportSecurity=HTTP Strict Transport Security（HSTS）
-offlineSessionMaxLimited=オフライン・セッション最大制限
+offlineSessionMaxLimited=オフラインセッション最大時間の制限
 periodicChangedUsersSync=定期的な変更ユーザーの同期
 principalAttribute=プリンシパル属性
 searchScope=スコープの検索
@@ -667,145 +666,145 @@ userRegistrationHelpText=登録ページの有効/無効。ログインページ
 realmRoles=レルムロール
 firstName=名
 expirationHelp=イベントの有効期限を設定します。期限切れのイベントはデータベースから定期的に削除されます。
-webAuthnPolicySignatureAlgorithmsHelp=認証アサーションに使用する署名アルゴリズム。
+webAuthnPolicySignatureAlgorithmsHelp=認証アサーションに使用すべき署名アルゴリズム。
 nameIdFormat=Name IDフォーマット
 validRedirectUri=有効なリダイレクトURI
-wantAssertionsEncryptedHelp=このサービス・プロバイダーが暗号化されたアサーションを期待するかどうかを設定します。
+wantAssertionsEncryptedHelp=このサービスプロバイダーが暗号化されたアサーションを期待するかどうかを設定します。
 permissionName=このパーミッションの名前を設定します。
 expires=有効期限
 userAttribute=ユーザー属性
 kid=Kid
 revoke=無効化
-webAuthnPolicyAcceptableAaguidsHelp=登録可能なオーセンティケーターのAAGUIDのリスト。
+webAuthnPolicyAcceptableAaguidsHelp=登録可能なオーセンティケーターのAAGUIDのリスト。AAGUIDは、オーセンティケーターの種類（メーカーやモデルなど）を示す128ビットの識別子です。
 clientSignatureHelp=クライアントがSAMLリクエストとレスポンスを署名するか、そしてそれらを検証すべきどうかか設定します。
-keyPasswordHelp=アーカイブ内の秘密鍵にアクセスするためのパスワード
-frontchannelLogout=フロントチャンネル・ログアウト
+keyPasswordHelp=秘密鍵のパスワード
+frontchannelLogout=フロントチャネルログアウト
 titleRoles=レルムロール
 frontendUrl=フロントエンドURL
-sectorIdentifierUri.tooltip=pairwise sub値を使用し、かつ動的クライアント登録をサポートするプロバイダーは、sector_identifier_uriパラメーターを使用すべきです（SHOULD）。これは、共通の管理下にあるWebサイト群に対し、個々のドメイン名とは独立してparwise sub値の一貫性を保持する方法を提供します。また、クライアントに対し、すべてのユーザーを再登録させることなしにredirect_uriを変更する方法も提供します。
-rdnLdapAttribute=RDN LDAP属性
+sectorIdentifierUri.tooltip=ペアワイズsub値を使用し、かつ動的クライアント登録をサポートするプロバイダーは、sector_identifier_uriパラメーターを使用すべきです（SHOULD）。これは、共通の管理下にあるWebサイト群に対し、個々のドメイン名とは独立してペアワイズsub値の一貫性を保持する方法を提供します。また、クライアントに対し、すべてのユーザーを再登録させることなしにredirect_uriを変更する方法も提供します。
+rdnLdapAttribute=RDNのLDAP属性
 replyToDisplayName=返信先の表示名
 xRobotsTag=X-Robots-Tag
 bindType=バインドタイプ
-aliasHelp=エイリアスは一意にアイデンティティー・プロバイダーを識別するもので、リダイレクトURIの構築にも使用されます。
+aliasHelp=エイリアスは一意にアイデンティティープロバイダーを識別するもので、リダイレクトURIの構築にも使用されます。
 contextualInfo=コンテキスト情報
-syncModeHelp=すべてのマッパーのデフォルトの同期モード。同期モードは、マッパーを使用してユーザーデータを同期するタイミングを決定します。可能な値は次のとおりです。このオプションが導入される前の動作を維持する「レガシー」、このアイデンティティー・プロバイダーを使用したユーザーの初回ログイン時に一度だけユーザーをインポートする「インポート」、このアイデンティティー・プロバイダーでログインするたびにユーザーを常に更新する「強制」。
+syncModeHelp=すべてのマッパーのデフォルトの同期モード。同期モードは、マッパーを使用してユーザーデータを同期するタイミングを決定します。可能な値は次のとおりです。このオプションが導入される前の動作を維持する「レガシー」、このアイデンティティープロバイダーを使用したユーザーの初回ログイン時に一度だけユーザーをインポートする「インポート」、このアイデンティティープロバイダーでログインするたびにユーザーを常に更新する「強制」。
 applyPolicyHelp=このポリシーやパーミッションで定義されたスコープに適用するすべてのポリシーを設定します。
 temporaryPassword=一時的
-sslType.none=none
+sslType.none=無し
 clientsPermissionsHint=このクライアントを管理したり、このクライアントによって定義されたロールを適用したりする管理者のきめ細かいパーミッションです。
 consentScreenText=同意画面のテキスト
 bruteForceDetection=ブルートフォースの検出
-archiveFormatHelp=JavaキーストアまたはPKCS12アーカイブ形式
+archiveFormatHelp=JavaキーストアまたはPKCS12アーカイブ形式。
 xContentTypeOptions=X-Content-Type-Options
 keyAlias=キーエイリアス
-none=none
+none=無し
 type=タイプ
 seconds=秒
 otpPolicyDigits=桁数
-ownerManagedAccess=User-Managed Accessの有効
+ownerManagedAccess=User-Managed Accessの有効化
 permissions=パーミッション
-accountThemeHelp=ユーザー・アカウント管理画面のテーマを選択します。
-displayOnConsentScreenHelp=オンで、同意が必要なクライアントにこのクライアント・スコープが追加された場合、「同意画面のテキスト」で指定されたテキストが同意画面に表示されます。オフの場合、このクライアント・スコープは同意画面に表示されません
+accountThemeHelp=ユーザーアカウント管理コンソールのテーマを選択します。
+displayOnConsentScreenHelp=オンの場合、同意が必要なクライアントにこのクライアントスコープが追加されると、「同意画面のテキスト」で指定されたテキストが同意画面に表示されます。オフの場合、このクライアントスコープは同意画面に表示されません。
 requirements.DISABLED=無効
-clientSessionIdle=クライアント・セッション・アイドル
+clientSessionIdle=クライアントセッションアイドル
 push=プッシュ
 titleUsers=ユーザー
-scopePermissions.users.user-impersonated-description=どのユーザーを偽装するかを決定するポリシー。これらのポリシーは、偽装されているユーザーに適用されます。
-forceAuthenticationHelp=アイデンティティー・プロバイダーが以前のセキュリティー・コンテキストに頼るのではなく、プレゼンターを直接認証すべきかどうかを設定します。
-testClusterAvailability=クラスターの可用性をテスト
-forceNameIdFormat=Name IDフォーマットを強制
+scopePermissions.users.user-impersonated-description=どのユーザーに代理ログインするかを決定するポリシー。これらのポリシーは、代理ログインされたユーザーに適用されます。
+forceAuthenticationHelp=アイデンティティープロバイダーが以前のセキュリティーコンテキストに頼るのではなく、プレゼンターを直接認証すべきかどうかを設定します。
+testClusterAvailability=クラスターの可用性のテスト
+forceNameIdFormat=NameIDフォーマットを強制
 scopePermissions.users.manage-description=管理者がレルム内のすべてのユーザーを管理できるかどうかを決定するポリシー
-included.client.audience.tooltip=指定されたオーディエンス・クライアントのクライアントIDが、トークンのオーディエンス（aud）フィールドに含まれます。トークンに既存のオーディエンスが存在する場合は、指定された値が単にそれらに追加されます。既存のオーディエンスを上書きすることはありません。
+included.client.audience.tooltip=指定されたオーディエンスクライアントのクライアントIDが、トークンのオーディエンス（aud）フィールドに含まれます。トークンに既存のオーディエンスが存在する場合は、指定された値が単にそれらに追加されます。既存のオーディエンスを上書きすることはありません。
 addRole=ロールの追加
 addressClaim.locality.tooltip=「address」トークンクレーム内の「locality」サブクレームにマップするために使用されるユーザー属性の名前。デフォルトは「locality」です。
-keyForCodeExchangeHelp=PKCEのどのコードチャレンジ方式を使用するかを選択します。指定しない場合、Keycloakは、クライアントが適切なコードチャレンジとコード交換の方式で認可リクエストを送信しない限り、クライアントにPKCEを適用しません。
-userInfoSignedResponseAlgorithmHelp=署名付きUserInfoエンドポイントのレスポンスに使用するJWAアルゴリズムを設定します。「unsigned」に設定した場合は、UserInfoレスポンスは署名されず、application/json形式で返されます。
+keyForCodeExchangeHelp=PKCE（Proof Key for Code Exchange）チャレンジ方式を選択します。指定しない場合、Keycloakは、クライアントが適切なコードチャレンジとコード交換の方式で認可リクエストを送信しない限り、クライアントにPKCEを適用しません。
+userInfoSignedResponseAlgorithmHelp=UserInfoエンドポイントのレスポンスへの署名に使用するJWAアルゴリズムを設定します。「unsigned」に設定した場合はUserInfoレスポンスには署名されず、application/json形式で返されます。
 lastName=姓
-otpPolicyDigitsHelp=OTPの桁数を設定します。
-clientAuthentications.client_secret_post=POSTで送信されたクライアント・シークレット
-authenticationAliasHelp=この設定の名前を設定します。
-SSOSessionIdle=SSOセッション・アイドル
-ssoServiceUrlHelp=認証リクエスト（SAML AuthnRequest）の送信に使用するURLを設定します。
+otpPolicyDigitsHelp=OTPを何桁にする必要があるか。
+clientAuthentications.client_secret_post=クライアントシークレットをPOSTで送信
+authenticationAliasHelp=設定の名前
+SSOSessionIdle=SSOセッションアイドル
+ssoServiceUrlHelp=認証リクエスト（SAML AuthnRequest）の送信に使用されるURLです。
 copy=コピー
 credentialData=データ
 connectionTimeout=接続タイムアウト
-passLoginHintHelp=アイデンティティー・プロバイダーにlogin_hintを渡します。
+passLoginHintHelp=アイデンティティープロバイダーにlogin_hintを渡します。
 monthHelp=ポリシーが許可される月を定義します。2番目のフィールドに値を入力して範囲を指定することもできます。この場合、現在の月が指定した2つの値の間にあるか、等しい場合のみ許可されます。
 webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=すでに登録されているオーセンティケーターの登録を避けるかどうかを設定します。
 registrationAccessToken=登録用アクセストークン
 supportedLocales=サポートされるロケール
 showPasswordDataValue=値
-issuerHelp=レスポンス内の発行者の識別子（Issuer Identifier）を設定します。未設定の場合は、検証は実行されません。
+issuerHelp=レスポンス内の発行者の識別子。未設定の場合は、検証は実行されません。
 webAuthnPolicyAttestationConveyancePreference=期待する構成証明伝達
 titleSessions=セッション
-rootURL=相対URLに追加するルートURLを設定します。
+rootURL=相対URLに追加するルートURL
 evictionMinute=エビクションの分
-nodeReRegistrationTimeoutHelp=登録されたクライアントをクラスターノードへ再登録する際の最大時間間隔を設定します。クラスターノードがこの時間内にKeycloakに再登録リクエストを送信しない場合は、Keycloakから登録解除されます。
-logoutServicePostBindingURLHelp=シングル・ログアウト・サービスのSAMLPOSTバインディングURLを設定します。異なるBindingを使用している場合は空でよいです。
+nodeReRegistrationTimeoutHelp=登録されたクライアントをクラスターノードへ再登録する際の最大時間間隔を指定します。クラスターノードがこの時間内にKeycloakに再登録リクエストを送信しない場合は、Keycloakから登録解除されます。
+logoutServicePostBindingURLHelp=シングルログアウトサービスのSAML POSTバインディングURLを設定します。異なるバインディングを使用している場合は空のままにします。
 clientAuthentication=クライアント認証
-validatePasswordPolicy=パスワード・ポリシーの検証
-registrationEmailAsUsername=Eメールをユーザー名とする
+validatePasswordPolicy=パスワードポリシーの検証
+registrationEmailAsUsername=メールアドレスをユーザー名として使用
 passCurrentLocale=現在のロケールを渡す
 webAuthnPolicyFormHelp=WebAuthn認証のポリシー。これは、「WebAuthn Register」必須アクションと「WebAuthn Authenticator」オーセンティケーターで使用されます。一般的な用途は、2要素認証にWebAuthnを使用する場合です。
 identityInformation=アイデンティティー情報
-usermodel.clientRoleMapping.rolePrefix.label=クライアント・ロールのプレフィックス
-syncModeOverrideHelp=このマッパーのIDPのデフォルトの同期モードをオーバーライドします。値は次のとおりです。このオプションが導入される前の動作を維持する「レガシー」、このアイデンティティー・プロバイダーを使用したユーザーの初回ログイン時に一度だけユーザーをインポートする「インポート」、このアイデンティティー・プロバイダーでログインするたびにユーザーを常に更新する「強制」、このマッパーのアイデンティティー・プロバイダーで定義された同期モードを使用する「継承」。
+usermodel.clientRoleMapping.rolePrefix.label=クライアントロールのプレフィックス
+syncModeOverrideHelp=このマッパーのIDPのデフォルトの同期モードを上書きします。値は次のとおりです。このオプションが導入される前の動作を維持する「レガシー」、このアイデンティティープロバイダーを使用したユーザーの初回ログイン時に一度だけユーザーをインポートする「インポート」、このアイデンティティープロバイダーでログインするたびにユーザーを常に更新する「強制」、このマッパーのアイデンティティープロバイダーで定義された同期モードを使用する「継承」。
 partialImport=部分インポート
-includeInTokenScopeHelp=オンの場合、このクライアント・スコープの名前がアクセストークン・プロパティーの「scope」と同様にトークン・イントロスペクション・エンドポイントのレスポンスに追加されます。オフの場合、このクライアント・スコープはトークンとトークン・イントロスペクション・エンドポイントのレスポンスから除外されます。
-signatureKeyNameHelp=署名されたSAML文書には、KeyName要素の署名鍵の識別情報が含まれています。Keycloak / RH-SSOカウンター・パーティーの場合は、KEY_IDを使用し、MS AD FSの場合はCERT_SUBJECTを使用します。他のオプションが動作しない場合はNONEをチェックして使用します。
-clientAssertionSigningAlgHelp=クライアント認証でJWTアサーションを利用するときの署名アルゴリズム。クライアント認証が 秘密鍵で署名されたJWT もしくは JWTでクライアント・シークレット の場合に設定します。アルゴリズムの指定をしなかった場合、 秘密鍵で署名されたJWT ではRS256 JWTでクライアント・シークレット ではHS256のアルゴリズムが使用されます。
+includeInTokenScopeHelp=オンの場合、このクライアントスコープの名前がアクセストークンプロパティーの「scope」と同様にトークンイントロスペクションエンドポイントのレスポンスに追加されます。オフの場合、このクライアントスコープはトークンとトークンイントロスペクションエンドポイントのレスポンスから除外されます。
+signatureKeyNameHelp=署名されたSAML文書には、KeyName要素の署名鍵の識別情報が含まれています。Keycloak / RH-SSOカウンターパーティーの場合は、KEY_IDを使用し、MS AD FSの場合はCERT_SUBJECTを使用します。他のオプションが動作しない場合はNONEをチェックして使用します。
+clientAssertionSigningAlgHelp=クライアント認証でJWTアサーションを利用するときの署名アルゴリズム。クライアント認証が 秘密鍵で署名されたJWT もしくは JWTでクライアントシークレット の場合に設定します。アルゴリズムの指定をしなかった場合、 秘密鍵で署名されたJWT ではRS256 JWTでクライアントシークレット ではHS256のアルゴリズムが使用されます。
 tokenClaimName.label=トークンクレーム名
 create=作成
 from=差出人
 decisionStrategyHelp=決定戦略は、パーミッションの評価方法と最終的な判定の取得方法を決定します。「Affirmative」とは、リソースおよびそのスコープへのアクセスを許可するために、少なくとも1つのパーミッションが肯定的な判定に評価される必要があることを意味します。「Unanimous」とは、最終的な判定も肯定的であるために、すべてのパーミッションが肯定的な判定に評価される必要があることを意味します。
 hideOnLoginPage=ログインページで非表示
 resource=リソース
-userSession.modelNote.tooltip=UserSessionModel.noteマップ内のユーザー・セッション・ノート名です。
-maxLifespan=最大生存期間
-clientsClientTypeHelp=「OpenID Connect」により、クライアントは認可サーバーによって実行される認証に基づいてエンドユーザーのアイデンティティーを検証できます。「SAML」は、クロスドメインのシングル・サインオン（SSO）を含むWebベースの認証および認可のシナリオを可能にし、アサーションを含むセキュリティー・トークンを使用して情報を渡します。
+userSession.modelNote.tooltip=UserSessionModel.noteマップ内のユーザーセッションノート名です。
+maxLifespan=最大有効期間
+clientsClientTypeHelp=「OpenID Connect」により、クライアントは認可サーバーによって実行される認証に基づいてエンドユーザーのアイデンティティーを検証できます。「SAML」は、クロスドメインのシングルサインオン（SSO）を含むWebベースの認証および認可のシナリオを可能にし、アサーションを含むセキュリティートークンを使用して情報を渡します。
 webOriginsHelp=許可されるCORSオリジンを設定します。有効なリダイレクトURIのすべてのオリジンを許可するには「+」を追加してください。ただし、これには「*」ワイルドカードは含まれません。すべてのオリジンを許可するには、明示的に「*」を追加してください。
 logoutUrl=ログアウトURL
-webAuthnPolicyPasswordlessFormHelp=パスワードレスWebAuthn認証のポリシー。これは、「Webauthn Register Passwordless」必須アクションおよび「WebAuthn Passwordless Authenticator」オーセンティケーターによって使用されます。一般的な使用法は、WebAuthnが一要素認証として使用される場合です。「WebAuthnポリシー」と「WebAuthnパスワードレス・ポリシー」の両方を使用すると、WebAuthnを同じレルムの第1要素オーセンティケーターと第2要素オーセンティケーターの両方として使用できます。
-storedTokensReadable=読み取り可能なトークンを格納
+webAuthnPolicyPasswordlessFormHelp=パスワードレスWebAuthn認証のポリシー。これは、「Webauthn Register Passwordless」必須アクションおよび「WebAuthn Passwordless Authenticator」オーセンティケーターによって使用されます。一般的な使用法は、WebAuthnが一要素認証として使用される場合です。「WebAuthnポリシー」と「WebAuthnパスワードレスポリシー」の両方を使用すると、WebAuthnを同じレルムの第1要素オーセンティケーターと第2要素オーセンティケーターの両方として使用できます。
+storedTokensReadable=読み取り可能なトークンを保存
 admin-clearEventsHelp=データベース内のすべての管理イベントを削除します。
 usermodel.prop.label=プロパティー
-authenticationOverrides=認証フローのオーバーライド
-clientSessionIdleHelp=クライアント・セッションが期限切れになるまでアイドル状態にできる時間。トークンは、クライアント・セッションが期限切れになると無効になります。設定しない場合、標準のSSOセッション・アイドルの値が使用されます。
+authenticationOverrides=認証フローの上書き
+clientSessionIdleHelp=クライアントセッションが期限切れになるまでアイドル状態にできる時間。トークンは、クライアントセッションが期限切れになると無効になります。設定しない場合、標準のSSOセッションアイドルの値が使用されます。
 scopesSelect=このパーミッションは1つまたは複数のスコープに適用されるように指定してください。
-clientAuthenticationHelp=クライアント認証方法（参照：https\://openid.net/specs/openid-connect-core-1_0.html\#ClientAuthentication）。秘密鍵で署名されたJWTの場合、レルム秘密鍵が使用されます。
-clientSecretHelp=アイデンティティー・プロバイダーで登録されているクライアント・シークレットを設定します。このフィールドは、ボールトから値を取得できます。${vault.ID}形式を使用します。
+clientAuthenticationHelp=クライアント認証方法（参照: https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication）。秘密鍵で署名されたJWTの場合、レルム秘密鍵が使用されます。
+clientSecretHelp=アイデンティティープロバイダーで登録されているクライアントシークレット。このフィールドは、ボールトから値を取得できます。${vault.ID}の形式を使用します。
 value=値
-offlineSessionMax=オフライン・セッション最大
+offlineSessionMax=オフラインセッション最大時間
 times.seconds=秒
-webAuthnPolicyExtraOriginsHelp=非 Web アプリケーションの追加オリジンのリスト。
+webAuthnPolicyExtraOriginsHelp=非Webアプリケーションの追加オリジンのリスト。
 resources=リソース
-groupsHelp=メンバーであるグループです。グループから外すには、グループを選択して「外す」ボタンをクリックしてください。
+groupsHelp=ユーザーが所属するグループです。グループから外れるにはグループを選択して「外す」ボタンをクリックしてください。
 groups=グループ
-permanentLockoutHelp=最大ログイン失敗回数を超えたときに、ユーザーを永久にロックします。
-logicType.positive=Positive
+permanentLockoutHelp=最大ログイン失敗回数を超えたときに、ユーザーを永続的にロックします。
+logicType.positive=肯定
 accountTheme=アカウントテーマ
-forceAuthentication=認証を強制
-webAuthnPolicyAvoidSameAuthenticatorRegister=オーセンティケーターの重複登録回避
-assertionConsumerServiceRedirectBindingURLHelp=アサーション・コンシューマー・サービス（ログイン・レスポンス）のSAML RedirectバインディングURLを設定します。このBindingのためのURLがない場合は空でよいです。
+forceAuthentication=認証の強制
+webAuthnPolicyAvoidSameAuthenticatorRegister=オーセンティケーターの重複登録の回避
+assertionConsumerServiceRedirectBindingURLHelp=アサーションコンシューマーサービス（ログインレスポンス）のSAMLリダイレクトバインディングURLを設定します。このバインディングのためのURLがない場合は空でよいです。
 selectARole=ロールを選択してください
 titleAuthentication=認証
 category=カテゴリー
 times.days=日
 providers=プロバイダー
 loginWithEmailAllowed=メールアドレスでログイン
-eventListenersHelpTextHelp=どのリスナーがレルムのイベントを受け取るか設定します。
+eventListenersHelpTextHelp=どのリスナーがレルムのイベントを受け取るかを設定します。
 registrationAccessTokenHelp=登録用アクセストークンにより、クライアントはクライアント登録サービスにアクセスできます。
-topLevelFlowTypeHelp=どの種類のトップレベル・フローを作成するか設定します。「client」タイプは、クライアント（アプリケーション）の認証で使用します。「generic」はユーザーと他のすべてで使用します。
+topLevelFlowTypeHelp=どの種類のトップレベルフローを作成するか設定します。「client」タイプは、クライアント（アプリケーション）の認証で使用します。「generic」はユーザーと他のすべてで使用します。
 policyCodeHelp=このポリシーに対する条件を提供するJavaScriptコード。
-addIdpMapperNameHelp=マッパーの名前です。
+addIdpMapperNameHelp=マッパーの名前。
 resourceNameHelp=このリソースの一意な名前。この名前は、リソースを一意に識別するために使用でき、特定のリソースを照会するときに便利です。
-duplicateEmailsAllowed=メールの重複
+duplicateEmailsAllowed=メールアドレスの重複
 policyClientHelp=このポリシーで許可されるクライアントを指定します。
-clientAuthenticatorTypeHelp=Keycloakサーバーに対してこのクライアントの認証に使用するクライアント認証方式を設定します。
+clientAuthenticatorTypeHelp=Keycloakサーバーに対してこのクライアントの認証に使用するクライアント認証方法を設定します。
 policyGroupsHelp=どのユーザーがこのポリシーで許可されるか指定してください。
 internationalizationHelp=有効にすると、このレルムでサポートするロケールとデフォルトのロケールを選択できます。
-realmSettingsExplain=レルム設定は、現在のレルムでユーザー、アプリケーション、ロール、グループのオプションを制御する設定です。
+realmSettingsExplain=レルムの設定画面では、現在のレルムのユーザー、アプリケーション、ロール、グループのオプションを設定します。
 internationalization=国際化
 realmRolesList=レルムロール
 flowName=フロー名
@@ -896,7 +895,7 @@ eventTypes.REGISTER_ERROR.description=登録エラー
 createAttributeSubTitle=新しい属性の作成
 searchGroup=グループの検索
 eventTypes.SEND_VERIFY_EMAIL.description=確認メールの送信
-eventTypes.REFRESH_TOKEN.name=トークンリフレッシュ
+eventTypes.REFRESH_TOKEN.name=リフレッシュトークン
 addSubFlow=サブフローの追加
 addRoles=ロールの追加
 addUri=URIの追加
@@ -936,7 +935,7 @@ selectALocale=ロケールの選択
 selectAdminTheme=アドミンテーマの選択
 selectVendor=ベンダーの選択
 bruteForceMode.Disabled=無効
-VERIFY_EMAIL=メールアドレスの検証 (VERIFY_EMAIL)
+VERIFY_EMAIL=メールアドレスの検証（VERIFY_EMAIL）
 disableConfirmTitle=レルムを無効にしますか？
 permission=パーミッション
 eventTypes.VERIFY_EMAIL_ERROR.name=メールアドレスの検証エラー
@@ -960,12 +959,11 @@ eventTypes.VERIFY_PROFILE.name=プロファイルの検証
 spinnerLoading=ロード中
 searchByRoleName=ロール名で検索
 invalidRealmName=レルム名は特殊文字を含むことが出来ません
-realmNameTitle=レルム {{name}}
+realmNameTitle={{name}} レルム
 subjectNameId=Subject NameID
 userId=ユーザーID
 eventTypes.UPDATE_EMAIL.description=メールアドレスの更新
 eventTypes.VALIDATE_ACCESS_TOKEN.description=アクセストークンの検証
-requiredRoles=最低1つのロールを追加してください。
 exportSuccess=レルムのエクスポートに成功しました。
 resourceDeletedSuccess=リソースの削除に成功しました
 importResourceSuccess=リソースのインポートに成功しました
@@ -991,17 +989,17 @@ saveProviderSuccess=プロバイダーの保存に成功しました。
 userList=ユーザーリスト
 mapperCreateSuccess=マッパーの作成に成功しました。
 configSaveSuccess=設定の保存に成功しました
-clearAllFilters=すべてのフィルターのクリア
+clearAllFilters=すべてのフィルターの消去
 deleteNode=ノードを削除しますか？
 mapperSaveSuccess=マッパーの保存に成功しました。
 eventTypes.CLIENT_DELETE.name=クライアントの削除
-clearUserEvents=ユーザーイベントのクリア
+clearUserEvents=ユーザーイベントの消去
 eventTypes.DELETE_ACCOUNT_ERROR.name=アカウントの削除エラー
 eventTypes.CLIENT_DELETE_ERROR.name=クライアントの削除エラー
 realmInfo=レルムの情報
 realmCache=レルムキャッシュ
-clearButtonTitle=クリア
-clearCachesTitle=キャッシュのクリア
+clearButtonTitle=消去
+clearCachesTitle=キャッシュの消去
 userCache=ユーザーキャッシュ
 keysCache=鍵キャッシュ
 deletedSuccess=プロバイダーの削除に成功しました。
@@ -1036,7 +1034,7 @@ displayOrder=表示順
 supported=サポート
 experimental=試験的
 usedMemory=使用中メモリー
-infoEnabledFeatures=有効なプレビュー機能と試験的な機能を表示します。
+infoEnabledFeatures=有効な機能をすべて表示します。
 enableHelpMode=ヘルプモードの有効化
 resetPasswordBtn=パスワードのリセット
 resetPasswordConfirm=パスワードをリセットしますか？
@@ -1072,7 +1070,7 @@ preview=プレビュー
 bruteForceMode=ブルートフォースモード
 domains=ドメイン
 domain=ドメイン
-loggedInAsTempAdminUser=一時的な管理者ユーザーとしてログインしています。セキュリティーを強化するには、永続的な管理者アカウントを作成し、一時的なアカウントを削除してください。
+loggedInAsTempAdminUser=一時的な管理者ユーザーとしてログインしています。セキュリティーを強化するには永続的な管理者アカウントを作成し一時的なアカウントを削除してください。
 valueLabel=値
 global=グローバル
 addClientScopes=クライアントスコープの追加
@@ -1083,7 +1081,7 @@ addCustomProvider=カスタムプロバイダーの追加
 welcomeText=Keycloakは、ユーザーフェデレーション、強力な認証、ユーザー管理、きめ細かな認可などを提供します。最小限の労力でアプリケーションに認証を追加し、サービスを保護します。アプリケーションでユーザーの保存や認証を行う必要はありません。
 resetPasswordAllowed=パスワード忘れ
 loginScreenCustomization=ログイン画面のカスタマイズ
-acrToLoAMapping=ACRとLoAのマッピング
+acrToLoAMapping=ACRからLoAへのマッピング
 emailSettings=メールアドレスの設定
 savingUserEventsOff=ユーザーイベントの保存がオフになっています
 savingAdminEventsOff=管理イベントの保存がオフになっています
@@ -1099,7 +1097,2401 @@ sessionsType.offline=オフライン
 searchForClient=クライアントの検索
 sessionsType.regularSSO=通常のSSO
 searchForClientScope=クライアントスコープの検索
-started=開始
+started=開始しました
 emptyAdminEvents=管理イベントがありません
 profiles=プロファイル
 noGroupsInThisRealm=このレルムにはグループがありません
+addMultivaluedLabel={{fieldLabel}}の追加
+role=ロール
+eventTypes.UPDATE_TOTP.name=TOTPの更新
+deleteConfirm_other=これらのグループを削除してもよいですか？
+sync-ldap-roles-to-keycloak=LDAPロールをKeycloakに同期させる
+addLdapWizardTitle=LDAPユーザーフェデレーションプロバイダーの追加
+secretHasExpired=シークレットの有効期限が切れているため、上の「再生成」ボタンをクリックして新しいシークレットを作成してください
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=アイデンティティープロバイダーの初回ログインエラー
+managePriorityOrder=優先順位の管理
+emptyMappers=マッパーはありません
+artifactBindingUrlHelp=HTTP ARTIFACTメッセージを送信するURL。別のバインディングを使用している場合は空白のままにすることができます。この値はIdP起点のログインでARTIFACTバインディングを強制する場合に設定する必要があります。
+artifactBindingUrl=アーティファクトバインディングURL
+clientsList=クライアント一覧
+eventTypes.CLIENT_UPDATE_ERROR.description=クライアント更新エラー
+dedicatedScopeExplain=これは専用のマッパーとスコープを含むクライアントスコープです
+updateOtpError=OTPポリシーを更新できませんでした: {{error}}
+clearFileExplain=このファイルを消去してもよいですか？
+userModelAttribute=ユーザーモデル属性
+eventTypes.UPDATE_CONSENT.name=同意の更新
+forceArtifactBinding=アーティファクトバインディングの強制
+ldapAttributeHelp=LDAPオブジェクトにマッピングされた属性の名前。例えばcn、sn、mail、streetなど。
+claimFilterNameHelp=必須クレームの名前
+eventTypes.CODE_TO_TOKEN_ERROR.description=コードとトークンの交換時のエラー
+termsOfServiceUrl=サービスの利用規約のURL
+requestObject.request_uri\ only=リクエストURIのみ
+rolesScope=定義されたロールスコープマッピングがない場合、各ユーザーは、このクライアントスコープを使うことができます。定義されたロールスコープマッピングがある場合、ユーザーは少なくとも1つのロールのメンバーでなければなりません.
+client-updater-trusted-hosts.label=信頼できるホスト
+syncRegistrationsHelp=新しく作成されたユーザーをLDAPストア内に作成する必要があるかどうか。 優先順位は、新しいユーザーを同期するために選択したプロバイダーに影響を与えます。この設定は、書き込み可能な編集モードでのみ有効です。
+userInitiatedActionLifespanHelp=ユーザーが送信するアクション許可（パスワードを忘れたメールなど）が期限切れになるまでの最大時間。ユーザーは自ら開始したアクションに素早く反応すると予想されるため、この値が短くなることが推奨されます。
+editIdPMapper=アイデンティティープロバイダーのマッパーの編集
+unmanagedAttributes=管理されていない属性
+unmanagedAttributePolicy.ADMIN_EDIT=管理者だけが書き込み可能
+unmanagedAttributePolicy.ADMIN_VIEW=管理者だけが参照可能
+passwordPoliciesHelp.length=パスワードの最小文字数。
+removeImportedUsersSuccess=インポートされたユーザーは削除されました。
+authnContextClassRefsHelp=要求されたAuthnContextのClassRefの順序付きリスト。
+useLowerCaseBearerType=トークンレスポンスで小文字のベアラータイプを使用する
+confirmPasswordDoesNotMatch=パスワードとパスワード確認が一致しません。
+unmanagedAttributesHelpText=管理されていない属性は、ユーザープロファイルの設定で明示的に定義されていないユーザー属性です。 デフォルトでは、管理されていない属性は「無効」であり、登録、アカウント、管理コンソールなどの任意のコンテキストから利用できません。「有効」を設定することで、管理されていない属性はサーバーに完全に認識され、すべてのコンテキストからアクセスできるようになります。既存のレルムを宣言型ユーザープロファイルに移行し始めていて、ユーザープロファイルの設定ですべてのユーザー属性がまだ定義されていない場合に役立ちます。「管理者だけが書き込み可能」を設定することで、管理コンソールとAPIだけで管理できない属性は、既にユーザーが管理できる任意のカスタム属性を定義している場合に便利ですが、管理者が管理するべき他の属性を追加することを保証していません「管理者だけが参照可能」を設定することで、管理コンソールとAPIでのみ、管理対象の属性は読み取り専用でのみ利用できます。
+validateBindDn=LDAP管理者のDNを入力する必要があります
+useRefreshTokensHelp=onの場合、refresh_tokenが作成され、トークンレスポンスに追加されます。offの場合、refresh_tokenは作成されません。
+getStarted=開始するには、以下の一覧からプロバイダーを選択します。
+signedJWTConfirm=キータブからクライアント用の秘密鍵と証明書を生成します。
+deleteDialogDescription=属性グループ <1>{{group}}</1>を永続的に削除してもよいですか？
+deleteNodeBody=ノード「{{node}}」を完全に削除してもよいですか？
+disableTypeClaimCheck=タイプクレームチェックの無効化
+overrideActionTokens=アクショントークンの上書き
+deleteGrantsError=グラント削除エラー: {{error}}
+defaultGroupAdded_other=デフォルトグループに{{count}}個のグループを追加しました
+used.SPECIFIC_CLIENTS=特定のクライアント
+userFedDeleteConfirm=このユーザーフェデレーションプロバイダーを削除した場合、関連するすべてのデータが削除されます。
+unlockUsersSuccess=一時的にロックされたユーザーは、ロックを解除されます
+emptyPrimaryAction=事前定義済みのマッパーの追加
+enableClientSignatureRequired=「クライアントの署名が必要」を有効にしますか？
+addAssociatedRolesError=ロールを関連付けできませんでした: {{error}}
+diagramView=ダイアグラム表示
+removeImportedUsers=インポートされたユーザーを削除しますか？
+anyClient=この条件は、すべてのクライアント、すべてのイベントにおいて常に真となります。
+tokenSaveSuccess=新しい初期アクセストークンが作成されました
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=永続的なロックアウトによりユーザーが無効になりました
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=永続的なロックアウトエラーによりユーザーが無効になりました
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=一時的なロックアウトによりユーザーが無効になりました
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=一時的なロックアウトエラーによりユーザーが無効になりました
+eventTypes.INTROSPECT_TOKEN_ERROR.description=トークンイントロスペクションエラー
+realmSaveError=レルムを更新できませんでした: {{error}}
+authDataDescription=認可リクエストの処理結果として生成される、認可データを含むトークンを示します。これは、Keycloakがパーミッションを要求するクライアントに発行するものです。現在の認可リクエストに基づいて付与されたパーミッションは、「authorization」クレームで確認できます。
+generatedAccessTokenIsDisabled=ユーザーが選択されていないときにアクセストークンを生成することは無効になっています。
+userDeletedSuccess=ユーザーが削除されました
+revokeClientScopesTitle=付与されたクライアントスコープをすべて取り消しますか？
+allow-default-scopes.label=デフォルトスコープの許可
+mapperTypeFullNameLdapMapper=full-name-ldap-mapper
+searchUserByAttributeMissingKeyError=属性キーを指定する
+eventTypes.INVALID_SIGNATURE.name=無効な署名
+authDetailsHelp=このリソースサーバーのすべてのリソースの設定をエクスポートし、ダウンロードします。
+policyProvider.regex=パーミッションの正規表現条件を定義します。
+clientImportError=クライアントをインポートできませんでした: {{error}}
+realmCertificateAliasHelp=レルム証明書もアーカイブに保存されます。これはそのエイリアスです。
+createIdentityProviderError=アイデンティティープロバイダーを作成できませんでした: {{error}}
+deleteClientPolicyConfirm=このアクションは、{{policyName}}ポリシーを永続的に削除します。これは元に戻すことができません。
+cibaAuthRequestedUserHint=認証リクエストユーザー特定ヒント
+comparison=比較
+passwordPoliciesHelp.digits=パスワード文字列に必要な数字の数。
+deletedSuccessClientScope=クライアントスコープが削除されました
+columnDisplayName=表示名
+lookAround=許容時間枠
+dependentPermission=依存パーミッション
+disableNonce=nonceの無効化
+clientPoliciesPoliciesHelpText=クライアントポリシーは、クライアントプロファイルと様々な条件を組み合わせることで、特定のクライアントプロファイルのエグゼキューターによって強制される動作を、いつ適用するかを指定できます。
+noDefaultGroupsInstructions=デフォルトグループを使用すると、新規ユーザーの作成時または<1>アイデンティティブローカリング</1>によるインポート時に、グループメンバーシップを自動的に割り当てることができます。開始するには、デフォルトグループを追加してください。
+removeUserText={{numSelected}}人のユーザーを削除しますか？これらのユーザーは、{{role}}ロールおよびその関連ロールのパーミッションを失います。
+attributeConsumingServiceNameHelp=SPメタデータで公開するAttribute Consuming Serviceのプロファイル名。
+supportedApplicationsHelp=現在のOTPポリシーで動作することが分かっているアプリケーション。
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=アイデンティティープロバイダーがトークンを取得した
+notAllowedToDeleteAllClientScopes=すべてのクライアントスコープを削除することはできません。
+noUsersFoundErrorStorage=ユーザーが見つかりませんでした。連携された外部アイデンティティープロバイダーの設定に誤りがある可能性があります: {{error}}
+clientDelete={{clientId}}を削除しますか？
+contentSecurityPolicyReportOnlyHelp=コンテンツセキュリティーポリシーのテストについての詳細は <1>こちら</1>です
+newRoleNameHelp=新しいロールの名前。ロール名の形式によって、アクセストークン内でロールがマッピングされる場所が変わります。「myapp.newname」とすると、アクセストークン内の特定のクライアントアプリケーション領域にロールがマッピングされ、「newname」とすると、トークン内のレルムロールにマッピングされます。
+samlKeysExportError=次の理由で、キーをエクスポートできませんでした: {{error}}
+scopePermissions.roles.map-role-client-scope-description=管理者がクライアントスコープにこのロールを適用できるかどうかを決定するポリシー
+artifactBindingResponseHelp=リクエストへの応答にARTIFACTバインディングを使用するかどうかを指定します。falseに設定した場合、HTTP-POSTバインディングの設定が適用されます。
+eventTypes.IMPERSONATE.description=代理ログイン
+kerberosWizardDescription=ここに説明文を入力してください。
+importResources=次の設定とデータがインポートされます:
+removeImportedUsersError=インポートされたユーザーを削除できませんでした: '{{error}}'
+webAuthnPolicyCreateTimeoutHint=タイムアウトは0秒から8時間の間で設定する必要があります。
+addValidator=バリデーターの追加
+attributeImporter=SAMLアサーションに宣言された属性が存在する場合、指定されたユーザーのプロパティーまたは属性にインポートします。
+forbidden_other=アクセスが拒否されました。必要な権限:
+removeMappingConfirm_other={{count}}個のロールを削除してもよいですか？
+validateConnectionUrl=接続URLを入力する必要があります
+attributeConsumingServiceIndexHelp=認証中にリクエストする属性要求サービスのプロファイルのインデックス。
+clientSessionSettings=クライアントセッションの設定
+mapperTypeHardcodedAttributeMapper=hardcoded-attribute-mapper
+welcome=ようこそ
+createTokenHelp=初期アクセストークンはクライアントを作成するためにのみ使用できます。
+linkedIdPs=リンクされたアイデンティティープロバイダー
+identityProvidersPermissionsHint=このロールの管理において、きめ細かいパーミッション設定を有効にするかどうかを決定します。無効にすると、現在設定されているすべてのパーミッションが削除されます。
+createAttributeError=エラー！ユーザープロファイルの設定が保存されませんでした: {{error}}。
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=OAuth2のデバイスコードとトークンの交換時のエラー
+cibaAuthRequestedUserHintHelp=認証が要求されるエンドユーザーを識別する方法。現在「login_hint」のみがサポートされています。
+importHelp=このリソースサーバーの認可設定を含むJSONファイルをインポートします。
+leaveGroupConfirmDialog_other={{count}}個選択したグループから{{username}}を削除してもよいですか？
+updatedCredentialMoveError=ユーザークレデンシャルの設定が保存されていません: {{error}}
+searchClientByName=名前でクライアントを検索する
+noTokens=初期アクセストークンがありません
+defaultAdminInitiatedActionLifespanHelp=管理者がユーザーに送信するアクションパーミッションの有効期限の最大時間。管理者が現在オフラインのユーザーにメールを送信できるように、この値は長く設定することが推奨されます。デフォルトのタイムアウトは、トークンの発行直前に上書きできます。
+detailsHelp=詳細はこちらを参照してください。
+enableRefreshRequestedTokenTypeHelp=標準トークン交換V2 がリフレッシュトークンを要求できるかどうかを制御します（パラメーター「requested_token_type」の値が「urn:ietf:params:oauth:token-type:refresh_token」に設定されている場合）。このオプションが「No」の場合（デフォルト）、リフレッシュトークンリクエストのタイプは許可されず、エラーが返されます。このオプションが「Same session」の場合、返されるリフレッシュトークンはサブジェクトトークンと同じセッションを使用するように強制され、そのセッションが利用できない場合（例えば、サブジェクトトークンが一時的な場合）はエラーが返されます。
+clientTypeHelp=「OpenID Connect」は、クライアントが認可サーバーによって実行される認証に基づいてエンドユーザーのアイデンティティーを検証できます。「SAML」は、クロスドメインのシングルサインオン（SSO）を含むWebベースの認証および認可のシナリオを可能にし、アサーションを含むセキュリティートークンを使用して情報を渡します。
+updateError=プロバイダーを更新できませんでした {{error}}
+policyProvider.client-scope=オブジェクトへのアクセスを許可する1つ以上のクライアントスコープのセットを使用して、パーミッションの条件を定義します。
+friendlyName=アサーション内で検索する属性のユーザーフレンドリーな名前。空白のままにして、代わりに名前を指定することもできます。
+serviceAccountHelp=このクライアントをKeycloakで認証し、このクライアント専用のアクセストークンを取得できるようにします。つまり、OAuth2の仕様における「クライアントクレデンシャルグラント」のサポートを有効にします。
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=認証再開中のエラー
+onDragFinish=ドラッグが完了しました {{list}}
+bindDnHelp=KeycloakがLDAPサーバーにアクセスするために使用するLDAP管理者のDN
+newClientProfileName=クライアントプロファイル名
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=OAuth2のデバイスコードとトークンの交換時のエラー
+addOpenIdProvider=OpenID Connectプロバイダーの追加
+eventTypes.UPDATE_PROFILE.description=プロファイルの更新
+assignRolesTo={{type}}のロールの{{client}}への割り当て
+policyProvider.js=JavaScriptを使用してパーミッションの条件を定義します。これは、Keycloakがサポートするルールベースのポリシータイプの1つで、評価APIに基づいてポリシーを記述する柔軟性を提供します。
+krbPrincipalAttribute=Kerberosプリンシパル属性
+emptyClientProfilesInstructions=クライアントプロファイルがない場合、「クライアントプロファイルの作成」を選択し、新しいクライアントプロファイルを作成してください
+noSessionsDescription=現在、このレルムでアクティブなセッションはありません。
+otpPolicyCodeReusable=再利用可能なトークン
+addRedirectUri=有効なリダイレクトURIの追加
+exportWarningDescription=レルムに多数のグループ、ロール、またはクライアントが含まれている場合、操作によってはサーバーがしばらく応答しなくなる可能性があります。
+eventTypes.IDENTITY_PROVIDER_RESPONSE.name=アイデンティティープロバイダーのレスポンス
+displayDescription=説明文の表示
+confirmClientSecretTitle=このクライアントのシークレットを再生成しますか？
+userAttributeName=SAML属性を保存するユーザー属性名。メール、姓、名を、これらの事前定義されたユーザープロパティーにマッピングするために使用します。
+orderChangeError=アイデンティティープロバイダーの表示順を変更できませんでした {{error}}
+socialProfileJSONFieldPathHelp=ソーシャルプロバイダーのユーザープロファイルJSONデータから値を取得するフィールドのパス。ネストにはドット記法、配列インデックスには角括弧を使用できます。例: 「contact.address[0].country」。
+sameSession=同じセッション
+standardTokenExchangeEnabledHelp=このクライアントに対して、標準トークン交換V2を有効にします。
+deleteConfirmGroup_one=このグループ '{{groupName}}' を削除してもよいですか。
+secretExpiresOn=シークレットは{{time}}で期限が切れます
+attributeName=属性[Name]
+importUsersHelp=Trueの場合、LDAPユーザーは、Keycloakのデータベースにインポートされ、設定された同期ポリシーによって同期されます。
+yes=はい
+showRemaining=${remaining}の表示
+eventTypes.UPDATE_EMAIL_ERROR.name=メールアドレスの更新エラー
+removeConfirm_other=これらのグループを削除してもよいですか？
+searchScopeHelp=1階層の場合、検索はユーザーDNで指定されたDN内のユーザーにのみ適用されます。サブツリーの場合、検索はサブツリー全体に適用されます。詳細については、LDAPドキュメントを参照してください。
+jumpToSection=セクションへのジャンプ
+noUsersEmptyStateDescription=このロールを直接割り当てたユーザーだけがこのタブの下に表示されます。 このロールに割り当てられたユーザーを見つける必要がある場合は、
+temporaryLockedHelp=ユーザーは、ログインに複数回失敗したため、ロックされている可能性があります。
+useEntityDescriptorHelp=リモートIDPのSAMLエンティティーディスクリプターからメタデータをインポートします。
+decisionStrategies.CONSENSUS=コンセンサス
+mapperTypeRoleLdapMapperHelp=LDAPのDNのロールを、レルムロールまたは特定のクライアントのクライアントロールにマッピングするために使用します。
+disableSigningExplain=「{{key}}」を無効にすると、Keycloakのデータベースが更新され、このクライアントの新しいアダプターをダウンロードする必要があります。
+authenticationCreateFlowHelp=フローを作成します。
+credentialResetEmailSuccess=ユーザーに送信されたメール。
+discoveryEndpointHelp=リモートIDPディスカバリーディスクリプターからメタデータをインポートします。
+required=必須項目
+userModelAttributeHelp=LDAP属性をマップしたいUserModelプロパティーまたは属性の名前。例えば、「firstName」、「lastName」、「email」、「street」など。
+linkedIdPsText=既にこのユーザーアカウントにリンクしているアイデンティティープロバイダー
+dedicatedScopes=専用スコープ
+eventTypes.UPDATE_CONSENT.description=同意の更新
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=アイデンティティープロバイダーログインエラー
+groupRemove_one=グループが削除されました
+validRequestURIsHelp=OpenID Connectの認証リクエストで「request_uri」パラメーターの値として使用できる有効なURIのリスト。有効なリダイレクトURIのような機能（例: ワイルドカードや相対パス）はサポートされていません。
+eventTypes.UPDATE_EMAIL_ERROR.description=メールアドレス更新エラー
+userCredentialsHelpText=トップレベルのハンドラーで、ユーザーのクレデンシャルの優先順位を変更できます。一番上のクレデンシャルが最優先となります。展開可能なパネル内のハンドラーでは、クレデンシャルの表示順序を変更できます。最上位のクレデンシャルが最も左側に表示されます。
+addAaguids=AAGUIDの追加
+useDiscoveryEndpoint=ディスカバリーエンドポイントを使用する
+rdnLdapAttributeHelp=一般的なユーザーDNのRDN（最上位属性）として使用されるLDAP属性の名前。通常、Username LDAP属性と同じ属性ですが、必須ではありません。たとえば、Active Directoryでは、ユーザー名属性が「sAMAccountName」の場合、「cn」をRDN属性として使用するのが一般的です。
+secretSizeHelp=生成されたシークレットのサイズ（バイト単位）
+inputType=入力タイプ
+regexClaimValues=正規表現クレーム値
+displayOnClient=画面上にクライアントを表示する
+certSubject=CERT_SUBJECT
+requestObject.request\ only=リクエストのみ
+oidcAttributeImporter=IDトークン、アクセストークン、またはユーザープロファイルエンドポイントから返されたクレームセットに宣言されたクレームが存在する場合、指定されたユーザープロパティーまたは属性にインポートします。
+requiredForLabel.admins=管理者のみ
+disablePolicyConfirm=ポリシーを無効にすると、ユーザーとクライアントはそのポリシーにアクセスできなくなります。続行してよいですか？
+noRolesAssociatedInstructions=このロールにロールを追加するには、「ロールの追加」をクリックします。
+executorTypeTextHelpText=エグゼキュータータイプのヘルプテキスト
+validatingPublicKeyId=公開鍵IDの検証
+relativeUserCreateDn=相対的なユーザー作成DN
+ldapAdvancedSettingsDescription=このセクションには、LDAPサーバーとの連携を細かく制御するためのオプションが含まれています。
+max-clients.label=レルムあたりの最大クライアント数
+relativeUserCreateDnHelp=ユーザーが作成される「Users DN」からの相対DN。例えば、サブツリー検索スコープを使用する場合、「Users DN」の親とは異なるDNにユーザーを作成できます。
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.name=アイデンティティープロバイダーのログイン後処理エラー
+noRolesAssociated=関連するロールがありません
+clientPolicySearch=クライアントポリシーの検索
+emptyStateMessage=属性グループがありません
+clientScopeSuccess=スコープマッピングが更新されました
+generateKeys=鍵を生成しますか？
+claimHelp=トークン内で検索するクレームの名前。ドット（.）を使用してネストされたクレームを参照できます。例: 'address.locality'。ドットを文字通りに使用するには、バックスラッシュ（\\.）でエスケープします。
+allowed-protocol-mappers.label=許可されたプロトコルマッパー
+group=グループ
+emptyAddClientScopesInstructions=追加するクライアントスコープは残っていません
+changeTypeIntro=選択された{{count}}個のクライアントスコープが変更されます
+addAssociatedRolesText=関連するロールの追加
+secretSize=シークレットのサイズ
+savePasswordError=パスワードの保存に失敗しました: {{error}}
+client-updater-source-groups.label=グループ
+kc.identity.authc.method=認証方法
+keyProviderMapperNameHelp=管理者コンソールでリンクされたときにプロバイダーの名前を表示します。
+maxTemporaryLockoutsHelp=ユーザーが永続的にロックアウトされる前に許可される一時的なロックアウトの回数。
+maxTemporaryLockouts=一時的なロックアウトの最大数
+rowSaveBtnAriaLabel={{messageBundle}}の編集の保存
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
+providerIdHelp=プロバイダーID
+deleteProviderError=プロバイダーの削除中にエラーが発生しました: {{error}}
+otpPolicyPeriodErrorHint=値は1秒～2分の間である必要があります。
+bruteForceStrategyHelp=「倍数」は、失敗回数が「{{failureFactor}}」の倍数である場合にのみ待機時間を増加させます。「線形」は、「{{failureFactor}}」から始まる新しい失敗ごとに待機時間を増加させます。
+setAsDefaultAction=デフォルトアクションとして設定
+overwritten=上書きされました
+path=パス
+mapperNameHelp=マッパーの名前
+bruteForceStrategy=待機時間の増加方式
+unlockUsersConfirm=一時的にロックアウトされたすべてのユーザーのロックが解除されます。
+idpType.custom=カスタム
+deletedErrorClientScope=クライアントスコープを削除できませんでした: {{error}}
+bruteForceStrategy.MULTIPLE=倍数
+clientProfiles=クライアントプロファイル
+frontchannelLogoutUrlHelp=このレルムに（end_session_endpoint経由で）ログアウトリクエストが送信された際に、クライアントが自身をログアウトするためのURL。指定がない場合は、ベースURLがデフォルトになります。
+roleMappingUpdatedError=ロールマッピングを更新できませんでした: {{error}}
+requiredAction=必須アクション
+unlockAllUsers=全てのユーザーのロック解除
+noGroupsText=このユーザーはまだどのグループにも所属していません。開始するにはグループに所属してください。
+eventTypes.EXECUTE_ACTIONS_ERROR.name=アクション実行時のエラー
+supportedLocalesHelp=このレルムがサポートするロケールです。ユーザーはログイン画面でこれらのロケールのいずれかを選択します。
+introduction=このページを離れ、このレルムを管理したい場合は、左側のナビゲーションバーにある対応するメニュー項目をクリックしてください。
+bruteForceStrategy.LINEAR=線形
+requiredActionConfig={{name}}の設定
+createClientPolicyError=次の理由でポリシーを作成できませんでした: {{error}}
+regexAttributeValues=正規表現属性値
+samlCapabilityConfig=SAML機能
+derFormatted=DER形式
+editUSernameHelp=有効にするとユーザー名は編集可能になり、そうでない場合は読み取り専用になります。
+emailVerification=メールアドレスの検証
+configSaveError=設定を保存できませんでした: {{error}}
+unitLabel=時間単位の選択
+eventTypes.GRANT_CONSENT_ERROR.name=同意付与エラー
+shortVerificationUri=デバイス認可フローのverification_uriの短縮化
+authDefaultActionTooltip=有効にすると、新規ユーザーがこのアクションを割り当てる必要があります。
+validateBindCredentials=LDAP管理者のパスワードを入力する必要があります。
+samlAttributeToRole=属性が存在する場合は、ユーザーに指定されたレルムロールやクライアントロールを付与します。
+dragInstruction=クリックしてドラッグすると優先順位が変わります
+noTranslationsInstructions=まず翻訳を追加してください。
+createClientProfileSuccess=新しいクライアントプロファイルが作成されました
+explainBearerOnly=これは特殊なOIDCタイプです。このクライアントはベアラートークンによるリクエストのみを受け付け、ブラウザーを使ったログインはできません。
+scopeParameterPlaceholder=スコープパラメーターの選択
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
+removeConfirm_one=このグループを削除してもよいですか？
+externalRoleToRole=Keycloakのアクセストークン内で外部ロールを探します。外部ロールが存在する場合、ユーザーに指定されたレルムロールまたはクライアントロールを付与します。
+attributeGroup=属性グループ
+flow.reset\ credentials=リセットクレデンシャルズフロー
+addProvider_one={{provider}}プロバイダーの追加
+noPasswordPoliciesInstructions=このレルムに対してパスワードポリシーが一つもありません。まずポリシーを追加してください。
+notFound=探しているリソースを見つけることができませんでした
+userLdapFilter=ユーザーLDAPフィルター
+createPermissionSuccess=パーミッションが正常に作成されました
+providerUpdatedError={{error}}のためクライアントポリシーを更新できませんでした
+clearFile=このファイルを消去する
+allowCreate=作成を許可する
+flowCreatedSuccess=フローが作成されました
+addExecutionHelp=エグゼキューションは、リセットメールの送信からOTPの検証まで、広範囲にわたるアクションを持つことができます。
+periodicChangedUsersSyncHelp=変更または新しく作成したLDAPユーザーのKeycloakへの定期的な同期が有効になっているか否か。
+helpFileUpload=JSONファイルのアップロード
+resetCredentialsSuccess=パスワードが正常にリセットされました。
+votedToStatus={{status}}に投票しました
+credentialResetConfirmText=このユーザーにメールを送信してもよいですか？
+bindFlow=バインドフロー
+mapperTypeMsadUserAccountControlManagerHelp=MSADに特化したマッパーです。MSADのユーザーアカウントの状態（アカウントの有効性、パスワード有効期限切れなど）をKeycloakのアカウントの状態に統合できます。そのために、MSADの属性のuserAccountControlとpwdLastSetを使用します。例えば、pwdLastSetが0の場合、Keycloakユーザーはパスワードの更新を求められます。別の例として、userAccountControlが514（アカウント無効）の場合、Keycloakユーザーも無効化されます。このマッパーは、LDAPユーザー認証からの例外コードも処理できます。
+enableLdapv3Password=LDAPv3のパスワード変更拡張操作の有効化
+attestationPreference.direct=ダイレクト
+cachePolicyHelp=このストレージプロバイダーのキャッシュポリシー。「DEFAULT」はグローバルキャッシュのデフォルト設定を使用します。「EVICT_DAILY」は毎日指定された時刻にキャッシュを無効化します。「EVICT_WEEKLY」は毎週指定された曜日と時刻にキャッシュを無効化します。「MAX_LIFESPAN」はキャッシュエントリーの有効期間をミリ秒単位で指定します。
+deleteCredentialsError=ユーザークレデンシャルの削除中にエラーが発生しました: {{error}}
+disableConfirmClient=このクライアントを無効にしてもよいですか？
+tokenLifespan.never=無期限
+linkAccount=アカウントのリンク
+passMaxAge=max_ageの提供
+disablePolicyConfirmTitle=ポリシーを無効化しますか？
+validatorType=バリデーターのタイプ
+orderChangeErrorUserFed=ユーザーフェデレーションプロバイダーの優先順位を変更できませんでした: {{error}}
+added=追加されました
+authnContextDeclRefs=認証コンテキスト宣言参照
+deleteExecutionError=エグゼキューションを削除できませんでした: {{error}}
+hideInheritedRoles=継承されたロールを非表示にする
+noRolesInstructions-client=このクライアントに対してロールが一つもありません。まずはロールを作成してください。
+test=テスト
+leaveGroup_one={{name}}のグループから離脱しますか？
+custom=カスタム属性...
+userAttributeValue=ユーザー属性値
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.description=OAuth2デバイス認証エラー
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=カスタム必須アクションエラー
+eventTypes.SEND_RESET_PASSWORD.name=リセットパスワードの送信
+requiredFor=必須
+deleteMappingConfirm=このマッピングを削除してもよいですか？
+usersAddedError=ユーザーをグループに追加できませんでした: {{error}}
+evictionMinuteHelp=エントリーが無効になる時間（分）
+clientScopesRolesScope=ロールスコープマッピングが定義されていない場合、すべてのユーザーはこのクライアントスコープを使用できます。ロールスコープマッピングが定義されている場合、ユーザーは少なくとも1つのロールのメンバーである必要があります。
+passwordPoliciesHelp.notUsername=パスワードはユーザー名と同一にできません。
+createUserProviderSuccess=ユーザーフェデレーションプロバイダーが正常に作成されました
+clientAssertionAudienceHelp=クライアントアサーションに使用するオーディエンス。デフォルト値はIDPのトークンエンドポイントURLです。
+keyTab=キータブ
+saveEventListeners=イベントリスナーの保存
+capabilityConfig=機能設定
+home=ホーム
+signatureAlgorithmHelp=ドキュメントに署名するために使用する署名アルゴリズム。「SHA1」ベースのアルゴリズムは非推奨であり、将来的に削除される可能性があります。「*_SHA1」の代わりに、より安全なアルゴリズムを使用することを推奨します。
+placeholderText=1つを選択
+allow-default-scopes.tooltip=オンの場合、新しく登録されたクライアントは、レルムのデフォルトクライアントスコープまたはレルムのオプションクライアントスコープに記載されているクライアントスコープを持つことが許可されます
+clientPoliciesPolicies=クライアントポリシー
+missingAttributes={{label}}はまだ定義されていません。{{label}}を追加するには、下のボタンをクリックしてください。キーペアにはキーと値が必要です。
+testConnectionError=エラー！{{error}}
+passwordPoliciesHelp.notContainsUsername=パスワードにユーザー名を含めることはできません。
+firstBrokerLoginFlowAliasOverride=初回ログインフローの上書き
+reGenerateSigningExplain=クライアントの署名鍵を再作成すると、Keycloakのデータベースが更新されます。このクライアントを使用している場合は、新しいアダプターのダウンロードが必要になることがあります。
+attributesHelp=トークンで検索する属性の名前と（正規表現の）値。設定された属性の名前は、SAML属性名と属性フレンドリー名フィールドで検索されます。ロールを設定するには、指定されたすべての属性の説明を満たす必要があります。属性が配列の場合、値は配列に含まれている必要があります。属性が複数回見つかった場合は、1つの一致で十分です。
+roleAuthentication=ロール認証
+eventTypes.REVOKE_GRANT_ERROR.name=付与無効化エラー
+authenticatedAccessPoliciesHelp=これらのポリシーは、クライアント登録サービスが認証後のリクエストによって呼び出された際に使用されます。これは、リクエストに初期アクセストークンまたはベアラートークンが含まれていることを意味します。
+deleteClientPolicyProfileSuccess=プロファイルはポリシーから正常に削除されました。
+eventTypes.CLIENT_LOGIN_ERROR.description=クライアントログインエラー
+tokenDeleteConfirm=初期アクセストークン{{id}}を完全に削除してもよいですか？
+flowCreateError=フローを作成できませんでした: {{error}}
+steps=ステップ
+applyToResourceTypeFlagHelp=このパーミッションを、指定されたタイプのすべてのリソースに適用するかどうかを指定します。有効にした場合、このパーミッションは、指定されたリソースタイプのすべてのインスタンスに対して評価されます。
+backchannelLogoutRevokeOfflineSessions=バックチャネルログアウト時にオフラインセッションを無効化する
+deletedErrorIdentityProvider=プロバイダーを削除できませんでした。{{error}}
+shortVerificationUriTooltipHelp=設定すると、この値がデバイス認可フローにおいてverification_uriとして返されます。このURIは{server-root}/realms/{realm}/deviceへリダイレクトする必要があります。
+kerberosPrincipal=Kerberosプリンシパル
+host-sending-registration-request-must-match.tooltip=オンの場合、クライアント登録サービスへのすべてのリクエストは、信頼されたホストまたはドメインから送信された場合にのみ許可されます。
+managePriorityInfo=優先順位は、ユーザー検索を行う際のプロバイダーの順序です。行のハンドルをドラッグして優先順位を変更できます。
+readTimeoutHelp=LDAP読み取りタイムアウト時間（ミリ秒）。このタイムアウト時間はLDAPの読み取り操作に適用されます。
+standardTokenExchangeEnabled=標準トークンエクスチェンジ
+enableRefreshRequestedTokenType=標準トークンエクスチェンジにおけるリフレッシュトークンの許可
+providerUpdatedSuccess=クライアントポリシーが正常に更新されました
+createClientScopeError=クライアントスコープを作成できませんでした。{{error}}
+mapperAttributeName=属性名
+pkceMethod=PKCEメソッド
+publicKey=公開鍵
+removeConfirmTitle_other=グループを削除しますか？
+setToNowError=エラー！現在時刻のnotBeforeへの設定に失敗しました: {{error}}
+primaryColorHover=プライマリーカラーホバー
+backgroundColorHeader=背景色ヘッダー
+iconColor=アイコンカラー
+lightTextColor=ライトテキストカラー
+inputBackgroundColor=入力背景色
+inputTextColor=入力テキストカラー
+eventTypes.CLIENT_INFO.name=クライアント情報
+chooseResources=インポートしたいリソースを選択してください。
+selectOne=オプションの選択
+noKeys=鍵がありません
+repeat=繰り返し
+downloadType=ダウンロードの種類についての情報です
+clientDeletedSuccess=クライアントが削除されました。
+addPostLogoutRedirectUri=有効なポストログアウトリダイレクトURIの追加
+deleteClientSuccess=クライアントプロファイルを削除しました
+deleteResourceWarning=以下のパーミッションは、他のリソースで使用されなくなった場合に削除されます。
+descriptionLanding=これはユーザーフェデレーションのランディングページの説明です
+batchSizeHelp=1回のトランザクションでLDAPからKeycloakにインポートされるLDAPユーザーの数
+kerberosKeyTab=Kerberosキータブ
+fineGrainOpenIdConnectConfigurationHelp=このセクションは、OpenID Connectプロトコルに関連するこのクライアントの詳細な設定を行うために使用されます。
+eventTypes.UNREGISTER_NODE_ERROR.description=ノード登録解除エラー
+webauthnIntro=この画面は何に使用されますか？
+syncLDAPGroupsError=次の理由のためデータの同期ができませんでした: {{error}}
+oidcCibaGrant=OIDC CIBAグラント
+ldapRolesDnHelp=このツリーのロールが保存されているLDAPのDN。例: 'ou=finance,dc=example,dc=org'。
+unlockError={{error}}によりユーザーのロック解除ができませんでした。
+unlockSuccess=ユーザーが正常にロック解除されました。
+saveSuccess=ユーザーフェデレーションプロバイダーが正常に保存されました
+searchKey=検索キー
+emptyClientScopesPrimaryAction=クライアントスコープの追加
+moveHere=ここへ移動
+enableServiceAccount=サービスアカウントロールを有効にする
+eventTypes.REVOKE_GRANT_ERROR.description=付与無効化エラー
+OVERWRITE=上書き
+addStepTo={{name}}にステップを追加する
+deleteAttributeConfirm={{attributeName}}属性とそれに対応する翻訳を完全に削除してもよいですか？
+deleteConfirmExecutionMessage=Execution「<1>{{name}}</1>」を完全に削除してもよいですか？
+offlineSessionMaxLimitedHelp=オフラインセッションの最大有効期間を有効にする
+userGroupsRetrieveStrategyHelp=ユーザーのグループを取得する方法を指定します。「LOAD_GROUPS_BY_MEMBER_ATTRIBUTE」は、「member」属性に現在のユーザーが設定されているすべてのグループをLDAPクエリーで検索し、ユーザーのロールを取得します。「GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE」は、ユーザーの「memberOf」属性、または「Member-Of LDAP属性」で指定された別の属性から、ユーザーのグループ情報を取得します。
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=認証リクエストIDからトークンへの変換エラー
+mapperTypeLdapAttributeMapperHelp=このマッパーは、syncRegistrationsが有効な場合にのみサポートされます。Keycloak に登録された新しいユーザーは、指定された属性のハードコードされた値を使用してLDAPに書き込まれます。
+activeHelp=鍵を署名に使用できるかどうかを設定します。
+createClientConditionSuccess=条件が正常に作成されました。
+createSuccess=アイデンティティープロバイダーの作成に成功しました
+SSOSessionSettings=SSOセッションの設定
+eventConfigSuccessfully=設定が正常に保存されました
+moveTo=移動
+emptyEventsInstructions=追加できるイベントタイプはもうありません
+selectATheme=テーマの選択
+permissionsList=パーミッションリスト
+themeColors=テーマカラー
+defaults=デフォルトへのリセット
+themeColorsLight=テーマカラー [light]
+themeColorsDark=テーマカラー [dark]
+themePreviewInfo=テーマの色をプレビューするには、現在のテーマをプレビューしたいテーマに設定する必要があるため、プレビューしたいテーマに自動的に切り替えました。
+errorColor=エラーカラー
+successColor=成功カラー
+activeColor=アクティブカラー
+backgroundColor=背景色
+backgroundColorNav=背景色ナビゲーション
+directAccessHelp=オンにすると、ダイレクトアクセスグラントのサポートが有効になります。これは、クライアントがユーザーのユーザー名/パスワードにアクセスし、それをアクセストークンと引き換えるためにKeycloakサーバーと直接交換できることを意味します。OAuth2の仕様においては、このクライアントに対する「リソースオーナーパスワードクレデンシャルグラント」のサポートを有効にすることに相当します。
+moveGroupEmptyInstructions=サブグループはありません。「ここに移動」を選択すると、選択したグループがこのグループのサブグループとして移動します
+client-updater-source-groups.tooltip=チェックするグループの名前。クライアントを作成または更新するエンティティーが、指定されたグループの1つ以上に所属している場合、条件は真と評価されます。設定されたグループは、Keycloakのグループの単純名と完全に一致する必要があります。ここではグループ階層は考慮されていません。
+favicon=ファビコン
+client-updater-source-roles.tooltip=この条件は、クライアントの登録または更新のリクエストの際にチェックされます。クライアントを作成または更新するエンティティー（通常はユーザー）が、指定されたロールのメンバーである場合にtrueと評価されます。レルムロールを参照するには、「my_realm_role」のようにレルムロール名を使用できます。クライアントロールを参照するには、client_id.role_nameの形式を使用します。例えば、「my_client.my_client_role」は、クライアント「my_client」のクライアントロール「my_client_role」を指します。
+tokenSaveError=初期アクセストークンを作成できませんでした: {{error}}
+deleteRole=このロールを削除
+resetPasswordConfirmation=新しいパスワード（確認）
+noTokensInstructions=初期アクセストークンが作成されていません。「作成」をクリックして初期アクセストークンを作成してください。
+addMapperExplain=きめ細かい制御が必要な場合は、このクライアントでプロトコルマッパーを作成できます
+addTranslationSuccess=成功！翻訳が追加されました。
+linkColor=リンクカラー
+linkColorHover=リンクカラーホバー
+secondaryColor=セカンダリーカラー
+backgroundColorAccent=背景色のアクセント
+ldapAttributeValueHelp=登録時に新しいユーザーに追加されるLDAP属性の値。「foo」のような任意の値をハードコードすることもできますが、特別なトークンを使用することもできます。現在サポートされているトークンは「${RANDOM}」のみで、これはランダムに生成された文字列に置き換えられます。
+roleObjectClasses=ロールオブジェクトクラス
+deleteClientScope_other={{count}}個のクライアントスコープを削除します
+displayDescriptionHintHelp=ユーザー向けのフォームを表示する際に、ツールチップとして使用されるテキスト。
+advancedSettingsOpenid-connect=このセクションは、OpenID Connectプロトコルに関連するこのクライアントの詳細な設定を行うために使用されます。
+user-clearEventsHelp=データベース内のすべてのユーザーイベントを消去します。
+eventTypes.UPDATE_TOTP_ERROR.name=TOTP更新エラー
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=OAuth2のデバイスコードとトークンの変換
+eventTypes.UPDATE_PASSWORD.description=パスワードの更新
+permissionScopesHelp=このパーミッションは、一つ以上のスコープに適用されなければなりません。
+clientOfflineSessionMax=クライアントオフラインセッション最大時間
+searchForUserDescription=このレルムにはフェデレーションプロバイダーが存在する可能性があります。「*」を検索することですべてのユーザーを表示できますが、システムの応答性能が低下する可能性があります。上記のユーザーを検索してください。
+textColor=テキストカラー
+backgroundImage=ログインの背景画像
+primaryColor=プライマリーカラー
+clientPolicyNameHelp=ポリシーの表示名
+groupHelp=ユーザーを追加するグループ。パスを含むグループのフルパスを入力してください。例: /root-group/child-group。
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=アイデンティティープロバイダーの応答エラー
+showInheritedRoles=継承されたロールを表示
+noRoles-users=このユーザーのロールがありません
+hmacGenerated=hmac-generated
+emptyBuiltInMappersInstructions=すべての組み込みマッパーがこのクライアントに追加されました
+clientAccesstypeTooltip=条件が適用されるクライアントのアクセスタイプ。
+admin=管理者
+syncUsersError=ユーザを同期させることはできませんでした: {{error}}
+updateCibaError=CIBAポリシーを更新できませんでした: {{error}}
+policyUrl=ポリシーURL
+passwordPoliciesHelp.regexPattern=パスワードが1つ以上の定義済みJava正規表現パターンと一致する必要があります。
+oAuthDPoP=トークンリクエストに所有証明（DPoP）ヘッダーを要求する
+serviceProviderEntityId=サービスプロバイダーエンティティーID
+permissionPoliciesHelp=パーミッションに適用する必要があるすべてのポリシーを指定します。
+userInfoResponseEncryptionContentEncryptionAlgorithm=UserInfoレスポンスのコンテンツ暗号化アルゴリズム
+eventTypes.CLIENT_UPDATE.name=クライアントの更新
+notRepeat=繰り返さない
+secretRotated=シークレットがローテーションされました
+userFedDeleteConfirmTitle=ユーザーフェデレーションプロバイダーを削除しますか？
+userCredentialsHelpTextLabel=ユーザークレデンシャルのヘルプテキスト
+emptyClientScopes=このクライアントにはクライアントスコープが追加されていません
+rolesPermissionsHint=このロールの管理において、きめ細かいパーミッション設定を有効にするかどうかを決定します。無効にすると、現在設定されているすべてのパーミッションが削除されます。
+whoCanEditHelp=有効にするとユーザーまたは管理者は属性を表示および編集できます。有効にしない場合ユーザーまたは管理者は属性への書き込み権限を持ちません。
+invalidateRotatedSecret=ローテーションされたシークレットを無効にしますか？
+emptyExecution=ステップがありません
+importAdded_zero=レコードは追加されませんでした。
+persistent=永続的
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=連携されたアイデンティティーのリンクエラー
+noDirectUsers=ダイレクトユーザーはいません
+openIdConnectCompatibilityModesHelp=このセクションでは、古いOpenID Connect / OAuth 2アダプターとの後方互換性を確保するための設定を行います。特に、クライアントが古いバージョンのKeycloak / RH-SSOアダプターを使用している場合に便利です。
+cibaIntervalHelp=CD（Consumption Device）がトークンエンドポイントへ送信するポーリングリクエストの最小待機時間（秒単位）。0に設定されている場合、CDはCIBAの仕様に従いデフォルト値として5秒待機する必要があります。
+policyRolesHelp=「ロールの追加」をクリックして、このポリシーに承認済みのロールを追加します。ロールの「必須フィールド」チェックボックスをオンにすると、他のロールに関係なく、選択したロールがポリシーの評価時に必ず存在することを確認します。ポリシーに関連するすべてのロールのチェックを外しておくと、決定戦略が「肯定的」に設定されているのと同じになります。
+disableConfirm=「{{name}}」を無効にしてもよいですか？
+eventTypes.CUSTOM_REQUIRED_ACTION.description=カスタム必須アクション
+validRedirectURIsHelp=ログインまたはログインの成功後にブラウザーがリダイレクト可能とする、有効なURIパターンを設定します。「http://example.com/*」のような単純なワイルドカードが使用可能です。相対パス、つまり「/my/relative/path/*」も指定可能です。相対パスはクライアントのルートURLを基準とします。または、未指定の場合は認証サーバーのルートURLが使用されます。SAMLでは、ログインリクエストに埋め込まれたコンシューマーサービスのURLに依存している場合は、有効なURIパターンを設定する必要があります。
+credentialsList=クレデンシャルリスト
+samlSignatureKeyNameHelp=署名されたSAMLドキュメントには、KeyName要素の署名鍵の識別情報が含まれています。Keycloakカウンターパーティーの場合は、KEY_IDを使用し、MS AD FSの場合はCERT_SUBJECTを使用します。他のオプションが動作しない場合はNONEをチェックして使用します。
+noConsentsText=同意は、ユーザーが同意を必要とするように設定されているクライアントにアクセスしようとした場合にのみ記録されます。その場合、ユーザーにはクライアントへのアクセスを許可するかどうかを求める同意ページが表示されます。
+clientAssertionAudience=クライアントアサーションオーディエンス
+eventTypes.UPDATE_TOTP.description=TOTPの更新
+executorTypeSwitchHelpText=エグゼキュータータイプのスイッチのヘルプテキスト
+helpFileUploadClient=JSONファイルまたはXMLファイルのアップロード
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=アイデンティティープロバイダーリンクアカウントエラー
+addedNodeFail=ノードを追加できませんでした: '{{error}}'
+maxLength=最大長{{length}}
+buildIn=ビルトイン
+roleCreateExplain=これは説明です
+authnContextDeclRefsHelp=要求された認証コンテキスト宣言参照の順序付きリスト。
+validateRealm=レルムを入力する必要があります
+resetCredentialsError=ユーザーのクレデンシャルをリセット中にエラーが発生しました: {{error}}
+evictionDayHelp=エントリーが無効になる曜日。
+actionTokens=アクショントークン
+addGroupsToGroupPolicy=グループポリシーにグループを追加する
+deniedScopes=拒否されるスコープ
+updateClientProfilesSuccess=クライアントプロファイルの設定が更新されました
+flow.docker\ auth=Docker認証フロー
+keySize=鍵のサイズ
+revokeClientScopes={{clientId}}に付与されたすべてのクライアントスコープを取り消してもよいですか？
+cibaBackhannelTokenDeliveryModes.poll=ポーリング
+noSearchResultsInstructions=もう一度検索するには、上の検索バーをクリックしてください
+addMessageBundle=メッセージバンドルの追加
+eventTypes.REMOVE_TOTP_ERROR.description=TOTP削除エラー
+samlEndpointsLabel=SAML 2.0サービスプロバイダーメタデータ
+associatedRolesModalTitle={{name}}にロールを追加する
+maxLifespanHelp=キャッシュエントリーの最大有効期間（ミリ秒）
+expirationValueNotValid=値は1以上である必要があります。
+passwordPolicyHintsEnabledHelp=書き込み可能なMSADにのみ適用されます。オンにすると、MSADユーザーのパスワード更新時にLDAP_SERVER_POLICY_HINTS_OID拡張機能が使用されます。つまり、「パスワード履歴」や「パスワードの最小有効期間」といった高度なMSADパスワードポリシーが適用されます。この拡張機能は、MSAD 2008 R2以降でのみ機能します。
+flowUsedBy=このフローを使用する
+updateFirstLogin=初回ログインの更新
+columnDisplayDescription=説明文の表示
+applyToResourceTypeFlag=リソースタイプへの適用
+groupObjectClassesHelp=グループオブジェクトのオブジェクトクラス（複数可）。クラスが複数必要な場合は、カンマで区切ります。一般的なLDAP環境では「groupOfNames」のように指定します。Active Directoryでは通常「group」です。
+filterByClients=クライアントによるフィルター
+createPolicyOfType={{policyType}}ポリシーの作成
+flowUsedByDescription=このフローは次の{{value}}によって使用されます。
+expireTimeHelp=ポリシーを許可しない日時を定義します。現在日時がこの値より前か、等しい場合にのみ許可されます。
+noRolesInstructions-roles=このレルムにはまだロールが作成されていません。はじめにロールを作成してください。
+ldapAttributeNameHelp=登録時に新しいユーザーに追加されるLDAP属性の名前。
+scopePermissions.groups.manage-description=管理者がこのグループを管理できるかどうかを決定するポリシー
+addedGroupMembership=グループメンバーシップを追加しました
+signingKeysConfig=署名鍵の設定
+permit=許可
+userInfoResponseEncryptionKeyManagementAlgorithm=ユーザー情報レスポンス暗号化鍵管理アルゴリズム
+whoCanViewHelp=有効にすると、ユーザーまたは管理者は属性を表示できます。有効にしない場合は、ユーザーまたは管理者は属性にアクセスできません。
+eventTypes.IDENTITY_PROVIDER_LOGIN.description=アイデンティティープロバイダーログイン
+clientProfilesHelp=このポリシーに適用されたクライアントプロファイル。
+deleteClientPolicyError=ポリシーを削除できませんでした: {{error}}
+selectAttribute=属性の選択
+resourceAttributeHelp=リソースに関連付けられた属性。
+product=プロダクト
+whoWillAppearPopoverText=グループは階層構造になっています。「ダイレクトメンバーシップ」を選択すると、ユーザーが参加している子グループのみが表示されます。祖先グループは表示されません。
+membershipLdapAttribute=メンバーシップLDAP属性
+effectiveRoleScopeMappingsHelp=選択したオプションのクライアントスコープ。このクライアントのアクセストークンを発行する際に使用されます。クライアントアダプターから最初のOpenID Connect認証リクエストが送信される際に、これらのオプションのクライアントスコープを適用するには、上記のOAuthスコープパラメーターの値を使用する必要があります。
+availableIdPs=利用可能なアイデンティティープロバイダー
+updateClientConditionSuccess=条件が正常に更新されました。
+roleDeleteConfirmDialog=この操作により、ロール「{{selectedRoleName}}」が完全に削除されます。元に戻すことはできません。
+addAssociatedRolesSuccess=関連ロールが追加されました
+updateTranslationSuccess=成功！翻訳を更新しました。
+jwtX509HeadersEnabled=JWTにX.509ヘッダーを追加する
+flow.firstBrokerLogin=初回ブローカーログインフロー
+connectionAndAuthenticationSettings=接続と認証の設定
+unlinkAccountConfirm=このアカウントを{{provider}}から永久にリンク解除してもよいですか？
+x509CertificateHelp=PEM形式でエンコードされたX509証明書
+lessThan={{value}}未満である必要があります。
+userInfoResponseEncryptionKeyManagementAlgorithmHelp=ユーザー情報エンドポイントのレスポンスを暗号化する際の鍵管理に使用されるJWAアルゴリズム。このオプションは、ユーザー情報エンドポイントのレスポンスを暗号化する場合に必要です。空のままにした場合、ユーザー情報エンドポイントのレスポンスは暗号化されません。
+inherent=継承
+requestObject.request\ or\ request_uri=リクエストまたはリクエストURI
+policyProvider.user=1 人以上のユーザーのセットがオブジェクトにアクセスできるようにするパーミッションの条件を定義します。
+comparisonHelp=要求されたコンテキストクラスまたはステートメントを評価するために使用する比較方法を指定します。デフォルトは「Exact」です。
+editableRowsTable=編集可能な行テーブル
+saveRealmError=レルムを作成できませんでした: {{error}}
+UPDATE_PROFILE=プロファイルの更新（UPDATE_PROFILE）
+roleSaveError=ロールを保存できませんでした: {{error}}
+reorder=並べ替える
+queryExtensions=サポートされている拡張機能の問い合わせ
+inputTypeCols=入力列
+useRfc9068AccessTokenType=アクセストークンのヘッダータイプとして「at+jwt」を使用する
+resourcesAndScopes=リソースとスコープ
+keystoreHelp=キーファイルへのパス
+subtree=サブツリー
+groupDeleted_one=グループが削除されました
+exportWarningTitle=警告とともにエクスポートが完了しました
+duplicateFlow=重複するフロー
+prompts.unspecified=未指定
+backchannelLogoutSessionRequired=バックチャネルログアウトセッションが必要です
+unlinkUsersSuccess=ユーザーのリンク解除が正常に完了しました。
+groupObjectClasses=グループオブジェクトクラス
+requiredActionPlaceholder=アクションの選択
+searchEventType=保存されたイベントタイプの検索
+eventTypes.CLIENT_UPDATE.description=クライアントの更新
+joinGroup=グループに参加
+unlock=ロックの解除
+protocolTypes.oid4vc=OpenID for Verifiable Credentials
+protocolTypes.openid-connect=OpenID Connect
+importRole=ロールのインポート
+generatedIdTokenIsDisabled=ユーザーが選択されていない場合、生成されたIDトークンは無効になります
+advancedSettingsSaml=このセクションでは、このクライアントの詳細設定を行います
+updateClientPolicySuccess=クライアントポリシーが更新されました
+executorName=名前
+realmCertificateAlias=レルム証明書エイリアス
+deleteClientError=プロファイルを削除できませんでした: {{error}}
+testError=LDAPへの接続中にエラーが発生しました: {{error}}
+bindTypeHelp=LDAPバインド操作中に使用される認証方式のタイプ。LDAPサーバーに送信されるほとんどのリクエストで使用されます。現在利用可能な認証方式は、「none」（匿名LDAP認証）または「simple」（バインドクレデンシャル + バインドパスワード認証）のみです。
+testClusterFail={{failedNodes}}の可用性の検証に失敗しました。失敗したクラスタノードを修正するか登録解除して、もう一度試しください。
+passwordPoliciesHelp.passwordBlacklist=ブラックリストファイルにあるパスワードの使用を禁止します。
+partialImportHeaderText=部分インポートを使用すると、以前にエクスポートされたJSONファイルからユーザー、クライアント、その他のリソースをインポートできます。
+usersAdded_one={{count}}人のユーザーがグループに追加されました。
+validatingPublicKeyIdHelp=上記で指定した検証用公開鍵の鍵IDを明示的に指定します。外部IDPで指定した鍵IDに関係なく、上記の鍵を常に使用する場合は空白のままにし、外部IDPの鍵IDが一致するかどうかを検証するためにのみ使用する場合は設定してください。
+revocationDescription=これは、すべてのアクティブなセッションとアクセストークンを取り消す方法です。「Not before」を選択すると、その日付より前に発行されたトークンをすべて取り消すことができます。
+eventExplain=イベントは、このレルムにおけるユーザーおよび管理者の操作の記録です。これらのイベントの追跡を設定するには、<1>イベント設定</1>に移動してください。
+includeClients=クライアントを含む
+overrideActionTokensHelp=特定のアクションに対して、ユーザーが送信したアクション許可（パスワード忘れのメールなど）の有効期限が切れるまでの最大時間に関するデフォルト設定を上書きします。ユーザーが自分で作成したアクションには迅速に対応すると予想されるため、この値は短く設定することをお勧めします。
+logoutSettings=ログアウト設定
+eventTypes.UPDATE_CONSENT_ERROR.description=同意の更新エラー
+clientScopesHelp=クライアントに事前に要求された、または割り当てられたスコープを使用して、ポリシーがクライアントに適用されるかどうかを判断します。条件は、OpenID Connectの認証リクエストおよび／またはトークンリクエスト中に評価されます。
+searchByName=名前で検索
+loadingRealms=レルムをロードしています…
+eventTypes.SEND_RESET_PASSWORD_ERROR.description=リセットパスワードの送信エラー
+addNewProvider=新規プロバイダーの追加
+userAttributeValueHelp=ハードコードしたい値
+policiesConfigType=以下を介して設定します。
+scopePermissions.identityProviders.token-exchange-description=このアイデンティティープロバイダーによって作成された外部トークンとトークンを交換できるクライアントを決定するポリシー。
+logoUrlHelp=クライアントアプリケーションのロゴを参照するURL
+bindCredentials=バインドクレデンシャル
+emptyMappersInstructions=マッパーを追加する場合は、下のボタンをクリックして定義済みのマッパーを追加するか、新しいマッパーを構成してください。
+clientRolesHelp=この条件は、指定されたクライアントロールのいずれかがクライアントに存在するかどうかを確認し、ポリシーを適用するかどうかを判断します。この条件により、クライアント管理者はクライアントに指定された名前のクライアントロールを作成し、そのクライアントのリクエストに特定のクライアントポリシーを適用することができます。この条件は、ほとんどのOpenID Connectリクエスト（認可リクエスト、トークンリクエスト、イントロスペクションリクエストなど）でチェックされます。
+backchannelLogoutUrlHelp=このレルムに（end_session_endpoint経由で）ログアウトリクエストが送信された際に、クライアントがログアウトするURL。ログアウトは、OIDCバックチャネルログアウトの仕様で指定されているログアウトトークンを送信することで実行されます。省略した場合、ログアウトリクエストはKeycloak/RH-SSOアダプター固有の形式で、指定された「管理URL」（設定されている場合）に送信される可能性があります。「管理URL」が設定されていない場合、ログアウトリクエストはクライアントに送信されません。
+validateServerPrincipal=サーバープリンシパルを入力する必要があります
+advancedClaimToRole=すべてのクレームが存在する場合は、指定されたレルムロールまたはクライアントロールをユーザーに付与します。
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=プッシュされた認可リクエストのエラー
+tableTitle=属性グループ
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=アクショントークン実行時のエラー
+windowsDomainQN=Windowsドメイン修飾名
+permissionResources=このパーミッションが適用されるリソースインスタンスを指定します。
+eventTypes.INTROSPECT_TOKEN.name=トークンイントロスペクション
+generateKeysDescription=新しい鍵を生成する場合、秘密鍵を含むキーストアを自動的にダウンロードしクライアント側に保存できます。Keycloakサーバーは証明書と公開鍵のみを保存し秘密鍵は保存しません。
+membershipUserLdapAttributeHelp=メンバーシップ属性タイプがUIDの場合にのみ使用されます。これは、メンバーシップマッピングに使用されるユーザーのLDAP属性の名前です。通常は「uid」です。例えば、「メンバーシップユーザーLDAP属性」の値が「uid」で、LDAPグループに「memberUid: john」がある場合、そのLDAPユーザーには「uid: john」という属性が付与されると想定されます。
+useTruststoreSpiHelp=LDAP接続でコマンドラインオプションで設定されたトラストストアを使用してトラストストアSPIを使用するかどうかを指定します。「Always」は常に使用することを意味します。「Never」は使用しないことを意味します。Keycloakにトラストストアが設定されていない場合でも、デフォルトのJava CA証明書または「javax.net.ssl.trustStore」プロパティーで指定された証明書が使用されることに注意してください。
+testConnectionHint.withoutEmail=接続をテストするには、まず現在のユーザー({{userName}})の電子メールアドレスを設定する必要があります。
+availableIdPsText=このレルムで設定されているすべてのアイデンティティープロバイダーがここにリストされます。ユーザーアカウントを任意のIdPアカウントにリンクできます。
+partialExportHeaderText=部分エクスポートを使用すると、レルム設定やその他の関連リソースをJSONファイルにエクスポートできます。
+claimFilterValue=必須クレームの値
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=アイデンティティープロバイダーリンクの送信エラー
+eventTypes.FEDERATED_IDENTITY_LINK.description=連携されたアイデンティティーのリンク
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.name=連携されたアイデンティティーのリンクの上書き
+eventTypes.UPDATE_PROFILE_ERROR.description=プロファイルの更新エラー
+allowed-protocol-mappers.tooltip=許可されたプロトコルマッパープロバイダーのホワイトリスト。ホワイトリストに登録されていないプロトコルマッパーを含むクライアントを登録しようとすると、登録リクエストは拒否されます。
+userSessionAttributeHelp=ハードコードするユーザーセッション属性の名前
+webAuthnUpdateSuccess=正常にWebAuthnポリシーが更新されました
+onDragMove=アイテム{{item}}をドラッグしています。
+validateRdnLdapAttribute=RDNのLDAP属性を入力する必要があります。
+clientRoles=クライアントロール
+removeRoles=ロールの削除
+tableOfGroups=グループのテーブル
+policyProvider.role=1つ以上のロールのセットがオブジェクトにアクセスできるようにするパーミッションの条件を定義します。
+webAuthnUpdateError={{error}}のため、WebAuthnポリシーを更新できませんでした。
+targetOptions.brokerId=BROKER_ID
+searchUserByAttributeKeyAlreadyInUseError=属性キーはすでに使用されています
+executorClientAuthenticator=エグゼキュータークライアントオーセンティケーター
+eventTypes.EXECUTE_ACTION_TOKEN.description=アクショントークンの実行
+socialUserAttributeName=情報を保存するユーザー属性の属性名。
+resourceTypeHelp=このパーミッションが適用されるリソースタイプを指定します。
+addedGroupMembershipError=グループメンバーシップの追加中にエラーが発生しました: {{error}}
+exportAuthDetailsSuccess=認可の詳細が正常にエクスポートされました。
+eventTypes.IDENTITY_PROVIDER_RESPONSE.description=アイデンティティープロバイダーのレスポンス
+idpInitiatedSsoUrlNameHelp=IDP起点のSSOを行う際にクライアントを参照するためのURLフラグメント名を設定します。空にするとIDP起点のSSOは無効になります。ブラウザーから参照するURLは「{server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}」になります。
+useKerberosForPasswordAuthenticationHelp=ディレクトリーサービス APIを使用してLDAPサーバーに対して認証する代わりに、Kerberosサーバーに対してユーザー名/パスワードを認証するには、Kerberosログインモジュールを使用します。
+policyDeletedSuccess=ポリシーが正常に削除されました。
+addClientProfileSuccess=新しいクライアントプロファイルが追加されました
+anyAlgorithm=任意のアルゴリズム
+emptyPolicies=ポリシーはありません
+manageOrderTableAria=ログインページに記載されている順序でのアイデンティティープロバイダーのリスト
+disableError=プロバイダーを無効化できませんでした: {{error}}
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.description=連携されたアイデンティティーのリンクの上書きエラー
+eventTypes.OAUTH2_EXTENSION_GRANT.name=OAuth2拡張グラント
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.description=OAuth2拡張グラントエラー
+userProviderSaveSuccess=ユーザーフェデレーションプロバイダーが正常に保存されました
+deleteError=プロバイダーを削除できませんでした: {{error}}
+residentKey.No=いいえ
+deleteAttributeError=属性は削除されませんでした: {{error}}
+policiesConfigTypes.formView=フォーム表示
+selectGroup=グループの選択
+addWebOrigins=Webオリジンの追加
+clientScopeExplain=クライアントスコープは、複数のクライアント間で共有されるプロトコルマッパーとロールの共通セットです。
+attributeNameHelp=アサーション内で検索する属性の名前。空白のままにして、代わりにユーザーフレンドリーな名前を指定することもできます。
+frontchannelLogoutSessionRequired=フロントチャネルログアウトのセッションが必要
+signServiceProviderMetadataHelp=プロバイダーSAMLメタデータの署名を有効/無効にします。
+ignoreMissingGroups=欠落しているグループを無視する
+requestObjectEncoding=リクエストオブジェクトのコンテンツの暗号化アルゴリズム
+shouldBeANumber=数字である必要があります。
+updateClientPoliciesSuccess=クライアントポリシーの設定が更新されました
+advancedSettings=高度な設定
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.name=連携されたアイデンティティーのリンクの上書きエラー
+updateOtpSuccess=OTPポリシーの更新に成功しました
+deleteProviderTitle=キープロバイダーを削除しますか？
+authorizationSignedResponseAlg=認可レスポンス署名アルゴリズム
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=アイデンティティープロバイダーリンクアカウント
+startTimeHelp=ポリシーを許可しない日時を定義します。現在日時がこの値より後か、等しい場合にのみ許可されます。
+deleteMessageBundleSuccess=バンドルからメッセージを正常に削除しました
+chooseAMapperType=マッパーの種類を選択する
+invalidateRotatedSuccess=ローテーションされたシークレットが正常に削除されました
+syncLDAPGroupsSuccessful=データが正常に同期されました: {{result}}
+upAttributeNameHelp=属性を一意に識別するために使用されるユーザー属性の名前。
+updateSuccessIdentityProvider=プロバイダーは正常に更新されました
+reloadKeys=鍵をリロードする
+useMetadataDescriptorUrl=メタデータ記述子URLを使用する
+validateCustomUserSearchFilter=フィルターは括弧で囲む必要があります。例: (filter)
+fineGrainSamlEndpointConfigHelp=このセクションでは、アサーションコンシューマーとシングルログアウトサービスの正確なURLを設定します。
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=連携されたアイデンティティーのリンクエラー
+updateClientProfilesError=クライアント プロファイルを更新できませんでした: {{error}}
+eventTypes.CLIENT_INFO.description=クライアント情報
+authorizationHelp=きめ細かい認可のサポートを有効/無効にします。
+groupRemoveError=グループの削除中にエラーが発生しました: {error}
+top-level-flow-type.basic-flow=基本フロー
+requestObjectEncryption=リクエストオブジェクトの暗号化アルゴリズム
+eventTypes.IMPERSONATE_ERROR.description=代理ログインエラー
+attributeFriendlyName=属性 [フレンドリー名]
+emptyAddClientScopes=クライアントスコープがありません
+changeTypeTo=タイプの変更
+logoutAllDescription=すべてのアクティブなセッションをサインアウトすると、このレルム内のアクティブなサブジェクトもサインアウトされます。
+manageServiceAccountUser=詳細とグループのマッピングを管理するには、ユーザー名 <1>{{link}}></1> をクリックします。
+helpDisabled=ヘルプオフ
+deleteResource=リソースを完全に削除しますか？
+inputTypePlaceholder=入力プレースホルダー
+eventTypes.OAUTH2_EXTENSION_GRANT.description=OAuth2拡張グラント
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.name=OAuth2拡張グラントエラー
+addKerberosWizardTitle=Kerberos ユーザーフェデレーションプロバイダーを追加する
+noPasswordPolicies=パスワードポリシーがありません
+retry=更新して続行するにはここを押してください
+executorAuthenticatorMultiSelectHelpText=エグゼキューターオーセンティケーターの複数選択のヘルプテキスト
+useRealmRolesMappingHelp=trueの場合、LDAPロールマッピングはKeycloakのレルムロールマッピングにマッピングされます。それ以外の場合は、クライアントロールマッピングにマッピングされます。
+testConnectionHint.withoutEmailAction=メールアドレスの設定
+columnName=名前
+use=使用
+importKeys=鍵をインポートする
+priorityHelp=プロバイダーの優先順位
+identityProviderEntityId=アイデンティティープロバイダーエンティティーID
+useRealmRolesMapping=レルムロールマッピングを使用する
+groupsPath=グループパス
+deleteClientProfileConfirm=このアクションは、{{profileName}}プロファイルを永続的に削除します。これは元に戻すことができません。
+deleteScopeConfirm=この認可スコープを削除すると、一部のパーミッションが影響を受けます。
+credentialResetEmailError=失敗: {{error}}
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.description=連携されたアイデンティティーのリンクの上書き
+encryptionAlgorithmHelp=SAML IDPがSAMLドキュメント、アサーション、またはIDの暗号化に使用する暗号化アルゴリズム。SAMLドキュメントの各部分を復号するための対応する復号鍵は、この設定されたアルゴリズムに基づいて選択され、暗号化（ENC）用のレルム鍵で利用可能である必要があります。アルゴリズムが設定されていない場合は、サポートされている任意のアルゴリズムが許可され、SAMLドキュメントで設定されたアルゴリズムに基づいて復号鍵が選択されます。
+dropNonexistingGroupsDuringSyncHelp=このフラグがtrueの場合、LDAPからKeycloakへのグループ同期時に、LDAPにまだ存在するKeycloakグループのみを保持し、残りは削除されます。
+regenerate=再生成
+guiOrderHelp=GUI（同意ページのような）でのプロバイダーの順序を整数で指定します。
+groupNameLdapAttributeHelp=グループオブジェクトでグループ名とRDNを表すために使用されるLDAP属性の名前。通常は「cn」です。この場合、典型的なグループ/ロールオブジェクトのDNは「cn=Group1,ouu=groups,dc=example,dc=org」のようになります。
+userInfoResponseEncryptionContentEncryptionAlgorithmHelp=ユーザー情報レスポンスの暗号化におけるコンテンツ暗号化に使用されるJWAアルゴリズム。ユーザー情報レスポンスの暗号化キー管理アルゴリズムが指定されている場合、この値のデフォルトはA128CBC-HS256です。
+roleObjectClassesHelp=グループオブジェクトのオブジェクトクラス（複数可）。クラスが複数必要な場合は、カンマで区切ります。一般的なLDAP環境では「groupOfNames」のように指定します。Active Directoryでは通常「group」です。
+attributeValueHelp=属性が持つ必要のある値。属性がリストの場合、値はリストに含まれている必要があります。
+attributeDisplayName=表示名
+mapperTypeFullNameLdapMapperHelp=LDAPの単一属性（通常はcn属性）からユーザーのフルネームをKeycloakデータベースのUserModelのfirstName属性とlastName属性にマッピングするために使用されます。
+enableClientSignatureRequiredExplain=「クライアント署名が必要」を有効にすると、このクライアントのアダプターが更新されます。このクライアント用に新しいアダプターをダウンロードする必要がある場合があります。このクライアント用の鍵を生成またはインポートする必要があります。そうしなければ、認証が機能しません。
+policyUrlHelp=プロファイルデータの使用方法について読み込むために、リライングパーティークライアントがエンドユーザーに提供するURL
+flowNameDescriptionHelp=新しいフローの名前の説明のヘルプテキスト
+paginationHelp=LDAPサーバーがページネーションをサポートしているかどうか
+scopePermissions.groups.view-members-description=管理者がこのグループのメンバーを表示できるかどうかを決定するポリシー。
+frontchannelLogoutSessionRequiredHelp=フロントチャネルログアウトURLが使用されるときに、 sid（セッションID）およびiss（発行者）パラメーターがログアウトリクエストに含まれるかどうかを指定します。
+linkAccountTitle=アカウントを{{provider}}にリンクする
+eventTypes.EXECUTE_ACTIONS.name=アクションの実行
+frontchannelLogoutUrl=フロントチャネルログアウトURL
+isAccessTokenJWTHelp=アイデンティティープロバイダーから受信したアクセストークンはJWTであり、そのクレームはマッパーがアクセス可能になります。
+accessTokens=アクセストークン
+importKeysError=鍵のインポート中にエラーが発生しました: {{error}}
+importKeysErrorNoSigningCertificate=「signingCertificate」オプションはメタデータで定義されていません。
+inheritedFrom=継承元
+clientScopeSearch.name=名前
+importSuccess=新しい証明書をインポートしました。
+invalidJsonError=ユーザープロファイルを保存できません。提供された情報は有効なJSONではありません: {{error}}
+invalidJsonClientProfilesError=クライアントプロファイルを保存できません。提供された情報は有効なJSONではありません: {{error}}
+addLdapWizardDescription=ここに説明文を入力してください。
+usernameHelperText=このアイデンティティープロバイダーのユーザーのユーザー名を入力します。
+reloadKeysSuccess=鍵が正常にリロードされました
+reloadKeysSuccessButFalse=リロードは実行されませんでした。リクエスト間の時間が短すぎた可能性があります。
+importKeysSuccess=鍵の再インポートに成功しました。新しい証明書を保存するにはプロバイダーを保存してください。
+validatorDeletedSuccess=成功！ユーザープロファイルの設定が保存されました。
+deleteConditionSuccess=条件は削除されました。
+syncAllUsers=すべてのユーザーの同期
+removedGroupMembershipError=グループメンバーシップの削除中にエラーが発生しました: {{error}}
+eventTypes.SEND_RESET_PASSWORD_ERROR.name=リセットパスワードの送信エラー
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=アイデンティティープロバイダーの初回ログイン
+enableSwitchSuccess={{switch}}が正常に変更されました
+metadataDescriptorUrl=メタデータ記述子URL
+profilesConfigTypes.formView=フォーム表示
+includeInAccessTokenResponse.label=アクセストークンレスポンスに追加
+deleteConditionError=条件の削除に失敗しました: {{error}}
+disableConfirmIdentityProvider=プロバイダー「{{provider}}」を無効にしてもよいですか？
+metadataDescriptorUrlHelp=アイデンティティープロバイダーがクライアントに必要なメタデータ情報（証明書、鍵、その他のURLなど）を公開する外部URL。
+reloadKeysError=鍵の再読み込み中にエラーが発生しました: {{error}}
+useMetadataDescriptorUrlHelp=スイッチがオンの場合、署名を検証するための証明書は、指定された「メタデータ記述子URL」からダウンロードされ、キャッシュされます。「鍵の再読み込み」のアクションを使用すると、キャッシュ内の証明書を更新できます。スイッチがオフの場合、「X509証明書の検証」オプションから取得した証明書が使用されます。これらの証明書は、IDPで変更があった場合は手動で更新する必要があります。
+clientProfile=クライアントプロファイルの詳細
+clientSaveError=クライアントを更新できませんでした: {{error}}
+clientScope=クライアントスコープ
+noRoles-groups=このグループにはロールがありません
+attributeConsumingServiceName=属性消費サービス名
+eventTypes.INTROSPECT_TOKEN_ERROR.name=トークンイントロスペクションエラー
+requestObjectEncryptionHelp=クライアントが「request」または「request_uri」パラメーターで指定されたOIDCリクエストオブジェクトを送信する際に使用するJWEアルゴリズム。「any」に設定した場合、暗号化はオプションとなり、任意のアルゴリズムが許可されます。
+invalidJsonClientPoliciesError=クライアントポリシーを保存できません。提供された情報は有効なJSONではありません: {{error}}
+promptHelp=認可サーバーがエンドユーザーに再認証と同意を求めるかどうかを指定します。
+userModelAttributeNameHelp=LDAPからユーザーをインポートするときに追加されるモデル属性の名前
+groupsDescription=グループとは、ユーザーに適用できる属性とロールマッピングのセットです。グループを作成、編集、削除したり、その子組織と親組織を管理したりできます。
+protocolTypes.all=すべて
+executorTypeSelectHelpText=エグゼキュータータイプ選択ヘルプテキスト
+addExecutorSuccess=エグゼキューターが正常に作成されました
+onDragCancel=ドラッグはキャンセルされました。リストは変更されません。
+removeUser=ユーザーの削除
+templateHelp=インポートするユーザー名のフォーマットに使用するテンプレート。置換は${}で囲みます。例: 「${ALIAS}.${CLAIM.sub}」。ALIASはプロバイダーのエイリアスです。CLAIM.<NAME>はIDまたはアクセストークンのクレームを参照します。置換後の値に|uppercaseまたは|lowercaseを付加することで、大文字または小文字に変換できます。例: 「${CLAIM.sub | lowercase}」。
+privateKeyMask=秘密鍵が設定されていないか不明です
+createUserProviderError=ユーザーフェデレーションプロバイダーを作成できませんでした: {{error}}
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=永続的なロックアウトによって無効にされるユーザー
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=永続的なロックアウトエラーによって無効にされるユーザー
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=一時的なロックアウトエラーによって無効なユーザー
+clientPoliciesProfilesHelpText=クライアントプロファイルを使用すると、クライアントで実行される様々なアクションを実行するエグゼキューターのセットを作成できます。アクションには、クライアントの作成や更新などの管理者アクションや、クライアントへの認証などのユーザーアクションが含まれます。
+eventTypes.USER_INFO_REQUEST_ERROR.name=ユーザー情報リクエストエラー
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=一時的なロックアウトによって無効なユーザー
+xContentTypeOptionsHelp=デフォルト値により、Internet ExplorerとGoogle Chromeは宣言されたコンテンツタイプとは異なる応答をMIMEスニッフィングできなくなります。<1>詳細</1>
+useDiscoveryEndpointHelp=この設定を有効にすると、プロバイダーの設定を取得するためにディスカバリーエンドポイントが使用されます。Keycloakはエンドポイントから設定を読み込み、ソースに更新があれば自動的に設定を更新します。
+addValidatorRole={{validatorName}}バリデーターの追加
+forbidden_one=アクセスが拒否されました。必要なパーミッション:
+deleteExecutorSuccess=エグゼキューターの削除に成功しました。
+backchannelLogoutSessionRequiredHelp=バックチャネルログアウトURLが使用されるときに、ログアウトトークンにsid（セッションID）クレームを含めるかどうかを指定します。
+eventTypes.CLIENT_INFO_ERROR.name=クライアント情報エラー
+deleteExecutorProfileConfirm=この操作により{{executorName}}が完全に削除されます。元に戻すことはできません。
+noScopeCreateHint=まず認可スコープを作成する必要があります。
+confirmClientSecretBody=シークレットを再生成すると、Keycloakデータベースが更新され、このクライアント用の新しいアダプターをダウンロードする必要があります。
+generatedUserInfo=生成されたユーザー情報
+clientUpdaterSourceRoles=エンティティーロールの更新
+keysList=鍵のリスト
+oidcCibaGrantHelp=これにより、OIDCのCIBA Grantのサポートが有効になり、ユーザーはブラウザーではなく、外部の認証デバイスを介して認証されるようになります。
+authenticatorAttachment.not\ specified=指定されていません
+addMember=メンバーの追加
+clientScopesCondition=期待されるスコープ
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=クライアント起点のアカウントリンクエラー
+validTo=有効
+userAttributeHelp=ハードコードするユーザー属性の名前
+searchForMapper=マッパーの検索
+importParseError=ファイルを解析できませんでした: {{error}}
+enableSwitchError={{error}}のため、有効化/無効化できませんでした
+deleteClientPolicyProfileConfirm=この操作により、{{profileName}}がポリシー{{policyName}}から完全に削除されます。元に戻すことはできません。
+error-invalid-email=メールアドレスが無効です。
+addKerberosWizardDescription=ここに説明文を入力してください。
+eventTypes.CODE_TO_TOKEN.description=コードとトークンの交換
+oAuthDevicePollingIntervalHelp=トークンエンドポイントへのポーリングリクエストの間でクライアントが待機する必要がある最小時間（秒）。
+eventTypes.REVOKE_GRANT.description=付与の無効化
+addAuthnContextDeclRef=認証コンテキスト宣言参照の追加
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.description=アイデンティティープロバイダーリンクの送信
+dateTo=終了日付
+mapperTypeGroupLdapMapperHelp=LDAPのDNグループのグループマッピングをKeycloakのグループマッピングにマッピングするために使用されます
+usedBy=次により使用:
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.name=OAuth2デバイス検証ユーザーコードエラー
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=アイデンティティープロバイダーからのトークン取得
+eventTypes.REVOKE_GRANT.name=付与の無効化
+deleteScope=認可スコープを完全に削除しますか？
+userInfo=ユーザー情報
+emptyExecutionInstructions=このフローの定義は、サブフローまたはエグゼキューションを追加することで開始できます。
+offlineSessionSettings=オフラインセッションの設定
+unAssignRole=割り当て解除
+NONE=無し
+keystorePasswordHelp=キーストアのパスワード
+keyPlaceholder=キーをタイプして下さい
+clientSettings=クライアントの詳細
+tokenDeleteSuccess=初期アクセストークンが正常に削除されました。
+clientUpdaterTrustedHostsTooltip=信頼されているホストのリスト。クライアントの登録リクエストまたは更新リクエストがこの設定で指定されたホスト/ドメインから送信された場合、条件は真と評価されます。ホスト名またはIPアドレスを使用できます。*.example.comのように先頭にアスタリスクを使用すると、ドメインexample.com全体が信頼されます。
+passwordDataTitle=パスワードデータ
+generatedAccessTokenHelp=選択されたユーザーが認証されると生成され、クライアントに送信されるアクセストークンの例を表示します。有効なプロトコルマッパーとロールスコープマッピング、そして実際のユーザーに割り当てられたクレームとロールに基づいて、トークンに含まれるクレームとロールを確認できます。
+deleteConfirmGroup_other=これらのグループを削除してよいですか？
+oidcSettings=OpenID Connectの設定
+noConsents=同意がありません
+noUsersEmptyStateDescriptionContinued=このロールを有効なロールとして既に持っているユーザーは、ここに追加できません。
+dedicatedScopeName={{clientName}}専用
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=クライアント起点のアカウントリンク
+savePassword=パスワードの保存
+couldNotCreateGroup=グループを作成できませんでした: {{error}}
+mapperTypeUserAttributeLdapMapper=user-attribute-ldap-mapper
+importSkipped_zero=スキップされたレコードはありません。
+resourceScopeError={{error}}のため、認可スコープを削除できませんでした
+socialProfileJSONFieldPath=ソーシャルプロファイルJSONフィールドパス
+uiDisplayNameHelp=管理UIでリンクされたときのプロバイダーの表示名
+noViewRights=このグループを表示する権限がありません。
+noRolesInstructions-users=このユーザーにはロールが割り当てられていません。まずはロールを割り当ててください。
+extendToChildren=下位を展開する
+greaterThan={{value}}より大きくなければなりません。
+initialCounterErrorHint=値は1から120までの範囲でなければなりません
+valueError=値を指定する必要があります。
+roleCreated=ロールを作成しました
+sync-keycloak-roles-to-ldap=KeycloakのロールをLDAPに同期する
+policyUsers=このポリシーによって許可されるユーザーを指定します。
+cibaBackhannelTokenDeliveryModes.ping=Ping
+decisionStrategies.UNANIMOUS=Unanimous
+aesGenerated=aes-generated
+addPolicy=ポリシーの追加
+deleteClientPolicyProfileError=ポリシーからプロファイルを削除できませんでした: {{error}}
+saveRealmSuccess=レルムが正常に作成されました。
+eventTypes.CLIENT_LOGIN.description=クライアントログイン
+disableProvider=プロバイダーを無効にしますか？
+clientScopeError=スコープマッピングを更新できませんでした: {{error}}
+conditionsHelp=特定のアクションの際にクライアントポリシーを適用するかどうかを決定するために評価される条件。
+anonymousAccessPoliciesHelp=これらのポリシーは、クライアント登録サービスが認証されていないリクエストによって呼び出される際に使用されます。つまり、リクエストには初期アクセストークンもベアラートークンも含まれていません。
+byConfiguration=設定による
+usersAdded_other={{count}}人のユーザーがグループに追加されました。
+contentSecurityPolicyHelp=デフォルト値は、非オリジンのiframeによってページが含まれないようにします。<1>詳細</1>
+generatedIdTokenNo=生成されたIDトークンがありません
+userFedUnlinkUsersConfirmTitle=すべてのユーザーのリンクを解除しますか？
+cacheSettingsDescription=このセクションには、このユーザーストレージプロバイダーから読み込まれたユーザーをキャッシュするのに役立つオプションが含まれています。
+executorsTable=エグゼキューターテーブル
+eventTypes.UNREGISTER_NODE.name=ノードの登録解除
+headerName=ヘッダー名
+eventConfigs=イベントの設定
+minimumACRValue=最小のACR値
+orderChangeSuccessUserFed=ユーザーフェデレーションプロバイダーの優先順位を正常に変更しました
+groupsPathHelp=LDAPグループが追加されるKeycloakグループパス。例えば、「/Applications/App1」の値を使用すると、LDAPグループはKeycloak内で最上位グループ「Applications」の子グループであるグループ「App1」の下で利用可能になります。デフォルト値は「/」であるため、LDAPグループは最上位のKeycloakグループにマッピングされます。このマッパーを作成する際には、設定されたグループパスがKeycloakに既に存在している必要があります。
+defaultRole=このロールは、レルムとクライアントのデフォルトロールの両方のコンテナーとして機能します。削除することはできません。
+orderChangeSuccess=アイデンティティープロバイダーの表示順序を変更しました
+usernameLdapAttributeHelp=Keycloakのユーザー名としてマッピングされるLDAP属性の名前。多くのLDAPサーバーベンダーでは「uid」が使用できます。Active Directoryの場合は「sAMAccountName」または「cn」が使用できます。LDAPからKeycloakにインポートするすべてのLDAPユーザーレコードに対して、この属性を設定する必要があります。
+searchUserByAttributeDescription=異なるキーまたは値を設定することで、複数の属性を検索フィルターとして設定できます。キーごとに入力できる値は1つだけです。
+selectEncryptionType=暗号化の種類の選択
+mapperTypeMsadLdsUserAccountControlMapper=msad-user-account-control-mapper
+scopeDisplayNameHelp=このスコープの一意の名前。この名前はスコープを一意に識別するために使用でき、特定のスコープを要求するときに便利です。
+removeMappingTitle=ロールを削除しますか？
+userRolesRetrieveStrategy=ユーザーロール取得戦略
+events-disable-title=イベントの保存を解除しますか？
+ellipticCurve=楕円曲線
+noRolesInstructions-clientScopes=このクライアントスコープにはロールが作成されていません。まずはロールを作成してください。
+validateUserObjectClasses=1つ以上のユーザーオブジェクトクラスを入力する必要があります
+requiredForLabel.users=ユーザーのみ
+notBeforeSuccess=レルムに「Not before」を設定しました。
+quickLoginCheckMilliSecondsHelp=クイックログイン失敗があまりにも頻繁に発生した場合は、ユーザーをロックアウトします。
+eventTypes.REMOVE_TOTP.name=TOTPの削除
+userFedUnlinkUsersConfirm=すべてのユーザーのリンクを解除しますか？データベースにパスワードがないユーザーは認証できなくなります。
+emptyRealmBasedIdps=このレルムにはレルムベースのアイデンティティープロバイダーが設定されていません。
+emptyPoliciesInstructions=ポリシーを作成する場合は、以下のボタンをクリックしてポリシーを作成してください。
+createScopeSuccess=認可スコープが正常に作成されました
+logoUrl=ロゴURL
+eventTypes.REMOVE_FEDERATED_IDENTITY.name=連携されたアイデンティティーの削除
+membership=メンバーシップ
+manageDisplayOrder=表示順序の管理
+claimFilterName=必須のクレーム
+deletePolicy=ポリシーを完全に削除しますか？
+mappingUpdatedError=マッピングを更新できませんでした: {{error}}
+importKey=鍵のインポート
+exactSearch=完全一致検索
+noRealmRolesToAssign=割り当てるレルムロールがありません
+unknownUser=匿名
+deleteAttributeSuccess=属性を削除しました
+groupRemove_other=グループを削除しました
+artifactResolutionService=アーティファクト解決サービス
+deleteConfirm_one=このグループ「{{groupName}}」を削除してもよいですか？
+hideOrganizationLinkedIdps=組織にリンクされたアイデンティティープロバイダーを非表示にする
+userVerify.not\ specified=指定されていません
+unlink=リンクの解除
+searchFor=ロール名でのロールの検索
+clientPoliciesSubTab=クライアントポリシーサブタブ
+writeOnly=書き込みのみ
+regexPatternHelp=正規表現パターンを指定します。
+noGroupsInThisSubGroup=このサブグループにはグループがありません
+groupUpdated=グループを更新しました。
+filenamePlaceholder=PEMファイルをアップロードするか、以下に鍵を貼り付けてください
+clientProfilesSubTab=クライアントプロファイルサブタブ
+accessTokenLifespanImplicitFlowHelp=OpenID Connectのインプリシットフロー中に発行されたアクセストークンの有効期限までの最大時間です。この値はSSOタイムアウトよりも短く設定することをお勧めします。インプリシットフロー中はトークンを更新できないため、「アクセストークンの有効期限」とは別にタイムアウトが設定されています。
+encryptionAlgorithm=暗号化アルゴリズム
+customAttribute=カスタム属性…
+syncRegistrations=同期登録
+removeImportedUsersMessage=インポートしたすべてのユーザーを削除してもよいですか？
+displayHeader=表示名
+executorTypeSelectAlgorithm=エグゼキュータータイプ選択アルゴリズム
+client-scopes-condition.label=期待されるスコープ
+hideMetaData=メタデータを隠す
+forceArtifactBindingHelp=レスポンスメッセージが、SAMLアーティファクトバインディングシステムを通じてクライアントに返される必要があるか。
+defaultRoleDeleteError=デフォルトロールは削除できません。
+connectionPoolingHelp=KeycloakがLDAPサーバーへのアクセス時に接続プールを使用するかどうかを決定します。StartTLSが有効になっている場合、接続プールは使用できません。
+unlinkUsersError=ユーザーのリンクを解除できませんでした: {{error}}
+noRolesInstructions-clients=このクライアントスコープにはロールが作成されていません。まずはロールを作成してください。
+roleHelpHelp=ユーザーに付与するロール。「ロールを選択」ボタンをクリックしてロールを参照するか、テキストボックスに入力してください。アプリケーションロールを参照する場合の構文は、appname.approle（例: myapp.myrole）です。
+federationLink=フェデレーションリンク
+deleteClientPolicyConditionConfirm=この操作により{{condition}}が完全に削除されます。元に戻すことはできません。
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=アクセストークンの検証エラー
+eventTypes.CLIENT_LOGIN_ERROR.name=クライアントログインエラー
+ldapFullNameAttribute=LDAPフルネーム属性
+createClientError=クライアントを作成できませんでした: {{error}}
+userProviderSaveError=ユーザーフェデレーションプロバイダーを保存できませんでした: {{error}}
+executorsHelpText=このクライアントプロファイルに適用されるエグゼキューター
+unlockUsersError=すべてのユーザーのロックを解除できませんでした: {{error}}
+serviceProviderEntityIdHelp=このSAMLサービスプロバイダーを一意に識別するために使用されるエンティティーID。
+noAdminUrlSet=プッシュが送信されませんでした。管理URIが設定されていないか、登録済みのクラスターノードが利用できません。
+deleteExecutorError=エグゼキューターを削除できませんでした: {{error}}
+UPDATE_PASSWORD=パスワードの更新（UPDATE_PASSWORD）
+decisionStrategies.AFFIRMATIVE=肯定的
+defaultGroupsHelp=デフォルトグループを使用すると、<1>アイデンティティーブローカリング</1> を通じて新しいユーザーが作成またはインポートされるたびに、グループのメンバーシップを自動的に割り当てることができます。
+minimumACRValueHelp=Keycloakによって強制される最小のACR。必須としてマークされていない限り、「acr_values」または「claims」によって明示的に要求されたより低いACRを上書きします。
+resetPasswordError=パスワードのリセット中にエラーが発生しました: {{error}}
+passwordPoliciesHelp.passwordHistory=最近使用したパスワードが再利用されるのを防ぎます。
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=プッシュされた認可リクエスト
+allowCreateHelp=外部アイデンティティープロバイダーがプリンシパルを表す新しい識別子を作成できるようにします。
+prompts.select_account=アカウントの選択
+authData=認可データ
+chooseAPolicyType=ポリシーの種類を選択してください
+synchronizationSettings=同期の設定
+roleMappingUpdatedSuccess=ロールマッピングが更新されました
+logoutAllSessionsError=エラー！すべてのセッションからログアウトできませんでした: {{error}}。
+eventTypes.CLIENT_REGISTER.description=クライアント登録
+reGenerateSigning=このクライアントの署名鍵を再生成する
+membershipAttributeType=メンバーシップ属性タイプ
+ldapSearchingAndUpdatingSettings=LDAPの検索と更新
+deleteClientPolicyConditionConfirmTitle=条件を削除しますか？
+authorizationEncryptedResponseAlgHelp=JWA レスポンスモードがjwtの場合に、認可レスポンスの暗号化における鍵管理に使用されるアルゴリズム。このオプションは、認可レスポンスを暗号化する場合に必要です。空のままにした場合、認可レスポンスには署名がのみされ、暗号化はされません。
+attributeGroupHelp=この属性を追加するユーザープロファイルグループを指定します。これにより、ユーザーの作成または更新時に、画面の異なる部分に複数の類似した属性をグループ化できます。
+clientUpdaterSourceRolesTooltip=この条件は、クライアントの登録リクエストまたは更新リクエストの際にチェックされます。エンティティー（通常はユーザー）が、指定されたロールに属するクライアントを作成または更新している場合、trueと評価されます。レルムロールを参照するには、「my_realm_role」などのレルムロール名を使用できます。クライアントロールを参照するには、「client_id.role_name」を使用できます。たとえば、「my_client.my_client_role」は、クライアント「my_client」のクライアントロール「my_client_role」を参照します。
+encryptionKeysConfigExplain=以下の「暗号化アサーション」を有効にする場合は、暗号化鍵を生成またはインポートして設定する必要があります。SAMLアサーションはAESを使用してクライアントの公開鍵で暗号化されます。
+preserveGroupInheritanceHelp=LDAPのグループ階層構造をKeycloakに伝播するかどうかを指定します。falseの場合、すべてのLDAPグループはKeycloakにおいてフラットなトップレベルグループとしてマッピングされます。falseの場合、グループ階層構造はKeycloakに保持されますが、LDAPのグループ層構造がであったり、1つの子グループが複数の親グループを持つような構造の場合、グループ同期が失敗する可能性があります。
+userProfileError=ユーザープロファイル設定を更新できませんでした: {{error}}
+defaultACRValuesHelp=OIDCリクエストの「claims」または「acr_values」パラメーターによって明示的にACRが要求されていない場合に、任意のACRとして使用されるデフォルト値。
+whoWillAppearLinkText=このグループリストに誰が表示されるか
+emptyStateInstructions=属性グループを追加する場合は、下のボタンをクリックしてください。
+helpEnabled=ヘルプ
+defaultACRValues=デフォルトのACR値
+allResults=すべての結果
+associatedPermissions=関連するパーミッション
+generalOptions=一般的なオプション
+deleteConfirmClientScopes=このクライアントスコープを削除してもよいですか？
+mapperTypeHardcodedLdapGroupMapperHelp=LDAPからインポートされたユーザーは、この設定されたグループに自動的に追加されます。
+mapperSaveError=マッパーの保存中にエラーが発生しました: {{error}}
+includeInAccessTokenResponse.tooltip=アクセストークンレスポンスにクレームを追加すべきか。情報提供目的かつ機密性のないデータにのみ使用すべきか
+removeMappingConfirm_one=このロールを削除してもよいですか？
+createScopeBasedPermission=スコープベースのパーミッションの作成
+cibaInterval=間隔
+x509Certificate=X509証明書
+createPolicySuccess=ポリシーが正常に作成されました
+encryptionKeysConfig=暗号化鍵の設定
+addRequestUri=有効なリクエストURIの追加
+ldapAttributeValue=LDAP属性値
+emptyResources=リソースがありません。
+ldapSynchronizationSettingsDescription=このセクションには、LDAPからKeycloakデータベースへのユーザーの同期に関連するオプションが含まれています。
+importAdded_other={{count}}件のレコードが追加されました。
+editCondition=条件の編集
+attributeDisplayNameHelp=属性の表示名。ローカライズされた値のキーもサポートしています。例: ${profile.attribute.phoneNumber}。翻訳を追加するには、「地球儀」のアイコンをクリックしてください。
+deleteValidatorConfirmMsg=バリデーター{{validatorName}}を完全に削除してもよいですか？
+saveProviderError=プロバイダーの保存中にエラーが発生しました: {{error}}
+createClientSuccess=クライアントが正常に作成されました
+usernameTemplateImporter=インポートするユーザー名をフォーマットします。
+assignedType=割り当てられたタイプ
+validateKeyTab=キータブを入力する必要があります
+preserveGroupInheritance=グループの継承の保持
+createClientScopeSuccess=クライアントスコープが作成されました
+oAuthDeviceCodeLifespanHelp=デバイスコードとユーザーコードの有効期限が切れるまでの最大時間。この値は、ユーザーがセカンダリーデバイスを取得したり、検証URIにアクセスしたり、ログインしたりできるようにするために十分な長さである必要がありますが、フィッシングに使用されたコードの使用を制限するのに十分な短さである必要もあります。
+dynamicScopeHelp=オンの場合、このスコープは静的部分と変数部分から構成される動的スコープと見なされます。
+attributePermissionDescription=このセクションには、属性を編集および表示できるユーザーに対する権限が含まれています。
+providerDetails=プロバイダーの詳細
+authenticatorAttachment.cross-platform=クロスプラットフォーム
+whoCanView=誰が参照できるか
+usersExplain=ユーザーは、現在のレルム内のユーザーです。
+passMaxAgeHelp=max_ageをアイデンティティープロバイダーに渡します。
+ssoSessionMaxRememberMe=ユーザーが「Remember me」オプションを設定している場合、セッションが期限切れになるまでの最大時間です。セッションが期限切れになると、トークンとブラウザーセッションは無効になります。設定されていない場合は、標準のSSOセッション最大値が使用されます。
+setPasswordConfirm=パスワードを設定しますか？
+skipped=スキップ
+selectOrTypeAKey=鍵の選択または入力
+authorizationEncryptedResponseEnc=認可レスポンス暗号化コンテンツ暗号化アルゴリズム
+notVerified=未検証
+oid4vcIssuerMetadata=OpenID4VCIクレデンシャル発行者のメタデータ
+addKeycloakOpenIdProvider=Keycloak OpenID Connectプロバイダーの追加
+validations=バリデーション
+deleteMessageBundleError=バンドルからメッセージを削除中にエラーが発生しました: {{error}}
+jwksUrlConfig=JWKS URLの設定
+eventTypes.CLIENT_DELETE.description=クライアントの削除
+updatedRequiredActionSuccess=必要なアクションが正常に更新されました
+providerCreateError={{error}}のためクライアントポリシーを作成できませんでした
+appliedByProviders=以下のプロバイダーによって適用されています。
+saveEventListenersSuccess=イベントリスナーが更新されました。
+validatorDeletedError=ユーザープロファイルの保存中にエラーが発生しました: {{error}}
+removeAttribute=属性の削除
+resourceDetails=リソースの詳細
+times.years=年
+userLdapFilterHelp=検索対象ユーザーをフィルタリングするための追加のLDAPフィルター。追加のフィルターが不要な場合は空白のままにしてください。フィルター名は「(」で始まり「)」で終わるようにしてください。
+generatedIdToken=生成されたIDトークン
+viewCondition=条件の表示
+searchForPermission=パーミッションの検索
+selectACondition=条件の選択
+deleteProviderSuccess=成功しました。プロバイダーが削除されました。
+authorizationScopes=認可スコープ
+addPredefinedMappers=定義済みのマッパーの追加
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=アイデンティティープロバイダーリンクアカウント
+eventTypes.TOKEN_EXCHANGE.name=トークンエクスチェンジ
+metadataOfDiscoveryEndpoint=ディスカバリーエンドポイントのメタデータ
+searchType.attribute=属性検索
+clientUpdaterSourceGroupsTooltip=チェックするグループの名前。クライアントを作成または更新するエンティティーが、指定されたグループの1つ以上に所属している場合、条件は真と評価されます。設定されたグループは、Keycloakのグループの単純名と完全に一致する必要があります。ここではグループ階層は考慮されていません。
+mapperTypeMsadLdsUserAccountControlMapperHelp=MSADのLDS専用のマッパーです。MSADのLDSユーザーアカウントの状態（アカウントの有効化、パスワードの有効期限切れなど）をKeycloakアカウントの状態と統合できます。このマッパーは、「msDS-UserAccountDisabled」、「msDS-UserPasswordExpired」、「pwdLastSet」属性を読み取ることができます。例えば、「pwdLastSet」が0の場合、Keycloakユーザーはパスワードを更新する必要があります。また、「msDS-UserAccountDisabled」が「TRUE」の場合、Keycloakユーザーも無効化されます。このマッパーは、LDAPユーザー認証からの例外コードも処理できます。
+keyTabHelp=サーバープリンシパルのクレデンシャルを含むKerberosのキータブファイルの場所。例：/etc/krb5.keytab
+modeHelp=LDAP_ONLYは、ユーザーのすべてのグループマッピングがLDAPから取得され、LDAPに保存されることを意味します。READ_ONLYは読み取り専用LDAPモードで、グループマッピングはLDAPとデータベースの両方から取得され、マージされます。新しいグループへの参加はLDAPではなくデータベースに保存されます。IMPORTは読み取り専用LDAPモードで、ユーザーがLDAPからインポートされる際にグループマッピングがLDAPから取得され、ローカルのKeycloakデータベースに保存されます。
+updateClientProfileSuccess=クライアントプロファイルが正常に更新されました
+noClientPoliciesInstructions=クライアントポリシーがありません。新しいクライアントポリシーを作成するには、「クライアントポリシーの作成」を選択してください。
+eventTypes.RESTART_AUTHENTICATION.description=認証の再開
+exportFail=レルムをエクスポートできませんでした: {{error}}
+targetHelp=マッパーの宛先フィールド。LOCAL（デフォルト）は、ユーザーのインポート時にローカルデータベースに保存されているユーザー名に変更が適用されることを意味します。BROKER_IDとBROKER_USERNAMEは、それぞれ連携されるユーザーの検索に使用されるIDまたはユーザー名に変更が保存されることを意味します。
+forgotPasswordHelpText=クレデンシャルを忘れたユーザーのために、ログインページにリンクを表示します。
+loginSettings=ログイン設定
+finish=終了
+ldapFilterHelp=LDAPフィルターは、LDAPグループを取得するためのクエリー全体にカスタムフィルターを追加します。追加のフィルタリングが不要で、LDAPからすべてのグループを取得する場合は、このフィールドを空のままにしてください。それ以外の場合は、フィルターが「(」で始まり「)」で終わるようにしてください。
+deleteConfirmRealmSetting=レルムを削除すると、関連付けられているすべてのデータも削除されます。
+eventTypes.UPDATE_PASSWORD_ERROR.description=パスワードの更新エラー
+roleHelp=すべての属性が揃っている場合にユーザーに付与するロールです。「ロールの選択」をクリックしてロールを参照するか、テキストボックスにロールを入力してください。クライアントロールを参照するには、clientname.clientroleという構文を使用します（例：myclient.myrole）。
+choose=選択...
+updatedRequiredActionError=必要なアクションを更新できませんでした: {{error}}
+evaluateExplain=このページでは、すべてのプロトコルマッパーとロールスコープマッピングを確認できます
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=アクショントークンの実行エラー
+eventTypes.USER_INFO_REQUEST_ERROR.description=ユーザー情報リクエストエラー
+roleMapping=ロールマッピング
+childGroups=子グループ
+emptyClientScopesInstructions=現在、このクライアントにはクライアントスコープがリンクされていません。既存のクライアントスコープをこのクライアントに追加して、プロトコルマッパーとロールを共有できます。
+groupDeleteError=グループの削除中にエラーが発生しました: {{error}}
+usersDNHelp=ユーザーが存在するLDAPツリーの完全なDN。このDNはLDAPユーザーの親DNです。例えば、ユーザーのDNが「uid='john',ou=users,dc=example,dc=com」であると仮定すると、「ou=users,dc=example,dc=com」のようになります。
+identityProviderEntityIdHelp=受信したSAMLアサーションの発行者の検証に使用されるエンティティーID。空の場合、発行者の検証は実行されません。
+noRoles-client=このクライアントにはロールがありません
+selectGroups=参加するグループの選択
+eventTypes.IDENTITY_PROVIDER_LOGIN.name=アイデンティティープロバイダーログイン
+eventTypes.REMOVE_FEDERATED_IDENTITY.description=連携されたアイデンティティーの削除
+mappedGroupAttributes=マッピングされたグループ属性
+exportAuthDetailsError=認可の詳細のエクスポート中にエラーが発生しました: {{error}}
+clientOfflineSessionIdleHelp=クライアントオフラインセッションがアイドル状態のままでいられる時間。この時間を超えると、クライアントオフラインセッションは無効になります。このオプションは、グローバルユーザーのSSOセッションには影響しません。設定されていない場合は、レルムの「オフラインセッションアイドル」の値が使用されます。
+userDetails=ユーザーの詳細
+inputTypeStep=入力ステップサイズ
+useRefreshTokenForClientCredentialsGrant=クライアントクレデンシャルグラントにリフレッシュトークンを使用する
+importWarning=上でインポートしたデータと設定により、既存のデータと設定が上書きされる可能性があります。
+mapperTypeHelp=LDAPユーザーの単一属性をKeycloakデータベースのUserModelの属性にマッピングするために使用されます。
+enabledWhenTooltip=属性がいつ利用可能になるかを指定します。スコープが使用されている場合、ログインリクエストで設定されたスコープの少なくとも1つが適用されると、属性は利用可能になります。現在のリクエストのデフォルトスコープとオプションスコープの両方が評価されます。管理コンソールとアカウントコンソールのコンテキストでは、スコープは評価されず、属性は常に利用可能です（パーミッションによってさらに制限されていない限り）。
+removeConfirmTitle_one=グループを削除しますか？
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=プッシュされた認可リクエストのエラー
+homeURLHelp=認証サーバーがクライアントにリダイレクトまたはリンクバックする必要がある場合に使用するデフォルトのURL。
+ldapAttribute=LDAP属性
+grantedScopes=付与されたスコープ
+deleteProviderConfirm=キープロバイダー{{provider}}を完全に削除してもよいですか？
+groupNameLdapAttribute=グループ名 LDAP属性
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=アイデンティティープロバイダーリンクの送信エラー
+tokenDeleteConfirmTitle=初期アクセストークンを削除しますか？
+signingKeysConfigExplain=以下の「クライアント署名が必要」を有効にする場合、署名鍵を生成またはインポートして設定する必要があります。これにより、クライアントはSAMLのリクエストとレスポンスに署名します。署名は検証されます。
+enabledWhen=有効になる時
+appliedByClients=以下のクライアントにより適用される
+artifactResolutionServiceUrl=アーティファクト解決サービスURL
+keySizeHelp=生成される鍵のサイズ
+kerberosRequiredSettingsDescription=このセクションには、すべてのユーザーストレージプロバイダーに共通するいくつかの基本オプションが含まれています。
+resetPasswordFor={{username}}のパスワードを設定する
+deleteEventsConfirm=このレルムのすべてのイベントを消去すると、データベース内のすべてのレコードが完全に消去されます。
+membershipUserLdapAttribute=メンバーシップユーザーLDAP属性
+groupUpdateError=グループの更新中にエラーが発生しました: {{error}}
+kerberos=Kerberos
+logoutServiceSoapBindingUrlHelp=クライアントのシングルログアウトサービスのSAML SOAPバインディングURL。別のバインディングを使用している場合は、空白のままにすることができます。
+noNodesInstructions=登録されたノードはありません。手動で追加できます。
+local=ローカル
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=アイデンティティープロバイダーからのトークン取得エラー
+noKeysDescription=有効な鍵を作成していません
+deleteConfirmFlowMessage=フロー「<1>{{flow}}</1>」を永久に削除してもよいですか？
+displayHeaderHintHelp=ユーザー向けフォームで属性のグループをレンダリングする際に使用する、ユーザーフレンドリーなグループ名。ローカライズされた値のキーもサポートしています。例：${profile.attribute.group.address}。
+inputHelperTextAfter=入力フィールドのヘルパーテキスト（下）
+defaultLocaleHelp=最初に使用するロケール。管理UIとアカウントUIのログイン画面やその他の画面で使用されます。
+invalidateRotatedSecretExplain=ローテーションされたシークレットを無効にすると、ローテーションされたシークレットは自動的に削除されます。
+noGroupsInThisRealmInstructions=このレルムにグループが作成されていません。まずはグループを作成してください。
+eventTypes.REMOVE_TOTP_ERROR.name=TOTP削除エラー
+notBeforeHelp=このクライアントに対して、この時間より前に発行されたトークンをすべて取り消します。ポリシーをプッシュするには、まず「設定」タブで有効な管理URLを設定する必要があります。
+clientDeleteConfirmTitle=クライアントを削除しますか？
+policyDetails=ポリシーの詳細
+createFlowHelp=この画面内にトップレベルのフローを作成できます。
+noGroupsInThisSubGroupInstructions=このサブグループにはグループが作成されていません。
+validatorColNames.colName=バリデーター名
+editModeKerberosHelp=READ_ONLYはパスワードの更新が許可されず、ユーザーは常にKerberosパスワードで認証することを意味します。UNSYNCEDはユーザーがKeycloakのデータベースでパスワードを変更でき、Kerberosパスワードの代わりにこのパスワードが使用されることを意味します。
+authorizationEncryptedResponseAlg=認可レスポンス暗号鍵管理アルゴリズム
+clientUpdaterContext=この条件は、クライアントがどのように作成または更新されたかという文脈をチェックし、ポリシーを適用するかどうかを判断します。例えば、クライアントが管理REST APIで作成されたか、OIDCの動的クライアント登録で作成されたかをチェックします。後者の場合、匿名クライアント登録か、初期アクセストークンまたは登録アクセストークンを使用した認証済みクライアント登録かなどをチェックします。
+deleteConfirmCurrentUser=このユーザーを完全に削除してもよいですか？
+addClientScopesTo={{clientName}}にクライアントスコープを追加します。
+showDataBtn=データの表示
+dedicatedScopeDescription=このクライアント専用のスコープとマッパー
+clientsExplain=クライアントは、ユーザーの認証を要求できるアプリケーションとサービスです。
+defaultPasswordLabel=マイパスワード
+membershipLdapAttributeHelp=グループのLDAP属性名。メンバーシップマッピングに使用されます。通常は「member」です。ただし、「メンバーシップ属性タイプ」が「UID」の場合、「メンバーシップLDAP属性」は通常「memberUid」になります。
+scopePermissions.roles.map-role-description=管理者がこのロールをユーザーまたはグループにマッピングできるかどうかを決定するポリシー
+accessTokenSuccess=アクセストークンが再生成されました
+mapperUserAttributeName=ユーザー属性名
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.description=クライアント起点のアカウントリンクエラー
+pkceEnabledHelp=IdPブローカリングにPKCE（Proof of Key-code exchange）を使用する
+allowEcpFlowHelp=このクライアントは、ユーザーの認証にECPフローを使用できます。
+disabledOff=オフの無効化
+reload=リロード
+validRequestURIs=有効なリクエストURI
+any=任意
+client-uris-must-match.label=クライアントURIは一致する必要があります
+noRoles-roles=このレルムにはロールがありません。
+backchannelUrlInvalid=バックチャネルログアウトURLは有効なURLではありません。
+impersonateConfirm=ユーザーを偽装しますか？
+noSessions=セッションがありません
+compositeRoleOff=複合ロールがオフになっています
+unsigned=署名なし
+userGroupsRetrieveStrategy=ユーザーグループの検索戦略
+scopePermissions.groups.view-description=管理者がこのグループを参照できるかどうかを決定するポリシー
+deleteMapperConfirm=マッパー{{mapper}}を完全に削除してもよいですか？
+validatingPublicKeyHelp=外部IDPの署名の検証に使用する必要があるPEM形式の公開鍵。
+removedGroupMembership=グループメンバーを削除しました
+x509=X.509サブジェクト名
+unlinkAccountTitle={{provider}}からのアカウントのリンクを解除しますか？
+deleteScopeWarning=以下のパーミッションは、他の認可スコープで使用されなくなると削除されます。
+unsavedChangesConfirm=変更が保存されていません。本当にこのページを離れますか？
+updatePasswordPolicySuccess=パスワードポリシーが正常に更新されました
+deleteMapperSuccess=マッパーは正常に削除されました。
+noNodes=ノードが登録されていません
+clipboardCopyError=クリップボードへのコピー中にエラーが発生しました。
+eventTypes.CLIENT_REGISTER_ERROR.description=クライアント登録エラー
+scopeSaveError={{error}}のため、認可スコープを永続化できませんでした
+used.SPECIFIC_PROVIDERS=特定のプロバイダー
+deletedSuccessIdentityProvider=プロバイダーは正常に削除されました。
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.name=アイデンティティープロバイダーログインエラー
+usersLeftError=グループからユーザーを削除できませんでした: {{error}}
+oAuthDPoPHelp=これにより、DPoP（Demonstrating Proof-of-Possession）にバインドされたトークンのサポートが可能になります。アクセストークンとリフレッシュトークンは、ユーザーエージェントに保存されている鍵にバインドされます。鍵の所有を証明するために、ユーザーエージェントはトークンと共に署名された証明を送信する必要があります。
+roleSaveSuccess=ロールが保存されました
+pushedAuthorizationRequestRequiredHelp=認可サーバーがプッシュされた認可リクエスト方式でのみ認可リクエストデータを受け入れるかどうかを示すブール型パラメーター。
+requiredHelp=必須属性を設定します。有効にした場合、ユーザーと管理者は必ず属性を設定する必要があります。有効にしない場合、属性は任意です。
+mapperTypeRoleLdapMapper=role-ldap-mapper
+clientSessionMaxHelp=クライアントセッションが期限切れになるまでの最大時間。セッションが期限切れになるとトークンは無効になります。このオプションはグローバルユーザーSSOセッションには影響しません。設定されていない場合は、標準のSSOセッション最大値が使用されます。
+testConnectionHint.withEmail=接続をテストすると、現在のユーザーの({{email}})に電子メールが送信されます。
+clientScopeSearch.type=割り当てられたタイプ
+mappingTable=定義済みのマッピングがあるテーブル
+predefinedMappingDescription=この表から定義済みのマッピングを選択します。
+noRealmRoles=レルムロールがありません
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.description=プッシュされた認可リクエスト
+roleList=ロール一覧
+eventTypes.RESTART_AUTHENTICATION.name=認証を再開する
+downloadAdapterConfig=アダプターの設定のダウンロード
+requirements.ALTERNATIVE=代替
+claimFilterValueHelp=必須クレームの値（正規表現サポート付き）
+targetOptions.local=LOCAL
+pkceMethodHelp=使用するPKCEメソッド
+encryption=暗号化
+clientScopesConditionTooltip=想定されるクライアントスコープのリスト。指定されたクライアントリクエストがクライアントスコープの一部と一致する場合、条件はtrueと評価されます。また、設定された「スコープタイプ」に基づいて、デフォルトのクライアントスコープとするか、オプションのクライアントスコープとするかも決定されます。
+deletedErrorRealmSetting=レルムを削除できませんでした: {{error}}
+deleteNodeSuccess=ノードが正常に削除されました
+keyError=鍵を提供する必要があります。
+scopePermissions.roles.map-role-composite-description=管理者がこのロールを複合ロールとして別のロールに適用できるかどうかを決定するポリシー
+residentKey.Yes=はい
+cibaBackchannelTokenDeliveryModeHelp=CD（Consumption Device）が認証結果と関連トークンを取得する方法を指定します。CIBAクライアントでは、他のモードが明示的に設定されていない場合、このモードがデフォルトで使用されます。
+addAnnotationText=アノテーションのを追加
+allowRegexComparisonHelp=OFFの場合、指定されたクライアント証明書のサブジェクトDNは、RFC8705仕様で規定されている「サブジェクトDN」プロパティーで指定されたDNと完全に一致する必要があります。サブジェクトDNは、RFC4514またはRFC1779の形式です。ONの場合、指定されたクライアント証明書のサブジェクトDNは、「サブジェクトDN」プロパティーで指定された正規表現と一致する必要があります。
+updateClientPoliciesError=クライアントポリシーを更新できませんでした: {{error}}
+requestObjectEncodingHelp=「request」または「request_uri」のパラメーターで指定されたOIDCリクエストオブジェクトのコンテンツを暗号化する際に、クライアントが使用するJWEアルゴリズム。「any」に設定すると、任意のアルゴリズムが許可されます。
+confirmAccessTokenTitle=登録アクセストークンを再生成しますか？
+ldapGeneralOptionsSettingsDescription=このセクションには、すべてのユーザーストレージプロバイダーに共通するいくつかの基本オプションが含まれています。
+tokenLifespan.inherited=レルム設定からの継承
+addTranslationError=翻訳の作成中にエラーが発生しました: {{error}}
+addProvider=プロバイダーの追加
+readOnlyHelp=LDAPからUserModelにインポートされるが、Keycloakでユーザーが更新されたときにLDAPに保存されない読み取り専用属性。
+resourceDeletedError=リソースを削除できませんでした: {{error}}
+newRoleName=新しいロール名
+changeAuthenticatorConfirm=オーセンティケーターを{{clientAuthenticatorType}}に変更すると、Keycloakデータベースが更新されるため、このクライアントの新しいアダプターの設定をダウンロードする必要がある場合があります。
+eventTypes.OAUTH2_DEVICE_AUTH.description=OAuth2デバイス認証
+artifactBindingResponse=アーティファクトバインディングレスポンス
+setPasswordConfirmText=ユーザー{{username}}のパスワードを設定してもよいですか？
+setPasswordFor={{username}}のパスワードの設定
+scopePermissions.groups.manage-membership-description=管理者がこのグループにユーザーを追加または削除できるかどうかを決定するポリシー
+eventTypes.UNREGISTER_NODE.description=ノードの登録解除
+signServiceProviderMetadata=サービスプロバイダーメタデータに署名する
+userObjectClassesHelp=LDAPユーザーのLDAPオブジェクトクラス属性のすべての値をカンマで区切って指定します。例：'inetOrgPerson, organizationalPerson'。新しく作成されたKeycloakユーザーは、これらのすべてのオブジェクトクラスとともにLDAPに書き込まれ、既存のLDAPユーザーレコードは、これらのすべてのオブジェクトクラスを含む場合にのみ検索されます。
+importFail=インポート失敗：{{error}}
+backchannelLogoutUrl=バックチャネルログアウトURL
+previous=前へ
+eventTypes.USER_INFO_REQUEST.name=ユーザー情報リクエスト
+createClientProfileNameHelperText=名前はレルム内で一意である必要があります。
+userRolesRetrieveStrategyHelp=ユーザーのロールの取得方法を指定します。LOAD_ROLES_BY_MEMBER_ATTRIBUTEは、LDAPクエリーを送信して、ユーザーが「member」であるすべてのロールを取得することで、ユーザーのロールを取得することを意味します。GET_ROLES_FROM_USER_MEMBEROFは、ユーザーのロールがユーザーの「memberOf」属性から取得されることを意味します。または、「Member-Of LDAP Attribute」で指定された他の属性から取得されます。LOAD_ROLES_BY_MEMBER_ATTRIBUTE は Active Directoryにのみ適用され、LDAP_MATCHING_RULE_IN_CHAIN LDAP拡張機能を使用して、ユーザーのロールが再帰的に取得されることを意味します。
+mapperAttributeFriendlyName=フレンドリーな名前
+eventTypes.CODE_TO_TOKEN.name=コードとトークンの交換
+createClientProfileError=クライアントプロファイルを作成できませんでした: {{error}}
+updateErrorIdentityProvider=プロバイダーを更新できませんでした: {{error}}
+copyInitialAccessToken=初期アクセストークンは後で取得できないため、閉じる前にコピーして貼り付けてください。
+emptyEvents=追加するものはありません
+executionConfig={{name}}の設定
+roleDeleteError=ロールを削除できませんでした: {{error}}
+eventTypes.UPDATE_PASSWORD_ERROR.name=パスワードの更新エラー
+eventTypes.UPDATE_PROFILE_ERROR.name=プロファイル更新エラー
+deleteConfirmDialog_other=選択した{{count}}人のユーザーを完全に削除してもよろしいですか？
+mode=モード
+whoWillAppearPopoverTextUsers=グループは階層構造になっています。「直接メンバーシップ」を選択すると、ユーザーが参加している子グループのみが表示されます。祖先グループは表示されません。
+importSkipped_one=1つのレコードがスキップされました。
+savePasswordSuccess=パスワードが正常に設定されました。
+eventConfigError=イベントの設定を保存できません： {{error}}
+testClusterSuccess={{successNodes}}の可用性が正常に検証されました。
+userSaved=ユーザーが保存されました。
+deleteConfirmExecution=フロー{{name}}を削除しますか？
+roleDetails=ロールの詳細
+targetOptions.brokerUsername=BROKER_USERNAME
+disabledHelp=無効にされたユーザーはログインできません。
+otpPolicyCodeReusableHelp=認証が成功した後、同じOTPコードを再度使用できるようになります。
+logoutServiceSoapBindingUrl=ログアウトサービスSOAPバインディングURL
+generatedAccessTokenNo=アクセストークンが生成されませんでした。
+roleRemoveAssociatedText=この操作により、{{role}}が{{roleName}}から削除されます。{{role}}に関連付けられているすべてのロールも削除されます。
+userLabel=ユーザーラベル
+listExplain=アイデンティティープロバイダーは、ユーザーが Keycloak に対して認証できるようにするソーシャルネットワークまたはアイデンティティーブローカーです。
+duplicate=重複
+clientAccesstype=クライアントアクセスタイプ
+roleDeleteConfirm=このロールを削除しますか？
+moveToGroup={{group1}}を{{group2}}に移動する
+selectMethod=方法を選択してください
+show=表示
+addClientProfile=クライアントプロファイルの追加
+clientDeleteConfirm=このクライアントを削除すると、関連付けられているすべてのデータも削除されます。
+validateUsernameLDAPAttribute=ユーザー名のLDAP属性を入力する必要があります。
+groupName=グループ名
+timestamp=作成日
+results=結果
+tableView=テーブルビュー
+userEventsRegistered=登録されたユーザーイベント
+clientScopeDetails=クライアントスコープの詳細
+userFedDeletedSuccess=ユーザーフェデレーションプロバイダーが削除されました。
+always=常に
+clientProfileName=クライアントプロファイル名
+userVerify.preferred=優先
+privateRSAKey=秘密RSA鍵
+eventTypes.VALIDATE_ACCESS_TOKEN.name=アクセストークンの検証
+roleImportSuccess=ロールのインポートに成功しました
+allowed-client-scopes.label=許可されたクライアントスコープ
+assignedClientScope=割り当てられたクライアントスコープ
+oneLevel=1階層
+notBeforeClearedSuccess=レルムの「Not Before」がクリアされました。
+policySaveError=ポリシーを更新できませんでした: {{error}}
+standardFlowHelp=これにより、認可コードを使用した標準的なOpenID Connectのリダイレクトベースの認証が可能になります。OpenID ConnectまたはOAuth 2の仕様の観点から言えば、このクライアントで「認可コードフロー」のサポートが可能になります。
+parentId=親ID
+rsa=rsa
+clientScopeType.none=なし
+addGroups=グループの追加
+target=対象
+emptyInstructions=検索条件を変更するか、ユーザーを追加する
+clientScopeRemoveError=スコープマッピングを削除できませんでした: {{error}}
+showPassword=パスワードフィールドをクリアテキストで表示する
+copied=認可の詳細がコピーされました。
+addSavedTypes=保存したタイプを追加する
+mapperCreateError=マッパーの作成中にエラーが発生しました: {{error}}
+eventTypes.CLIENT_REGISTER.name=クライアント登録
+userFedDisableConfirmTitle=ユーザーフェデレーションプロバイダーを無効にしますか？
+requestObject.not\ required=不要
+events-disable-confirm=「イベントを保存」が無効になっている場合、それ以降のイベントは「イベント」メニューに表示されません
+scopePermissions.groups.manage-members-description=管理者がこのグループのメンバーを管理できるかどうかを決定するポリシー。
+consentRequiredHelp=有効の場合は、ユーザーはクライアントアクセスに同意する必要があります。
+eventTypes.EXECUTE_ACTION_TOKEN.name=アクショントークンの実行
+allowEcpFlow=ECPフローの許可
+emptyProfiles=クライアントプロファイルが設定されていません。
+attribute=属性
+addExecutorError=エグゼキューターが作成されませんでした: {{error}}
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=アクセストークンの検証エラー
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.name=アイデンティティープロバイダーリンクの送信
+eventTypes.UPDATE_TOTP_ERROR.description=TOTP更新エラー
+attributeDefaultValue=属性のデフォルト値
+alwaysReadValueFromLdap=常にLDAPから値を読み取る
+generatedUserInfoNo=ユーザー情報は生成されませんでした。
+impersonateConfirmDialog=このユーザーとしてログインしてもよろしいですか？このユーザーが同じレルム内に存在する場合、このユーザーとしてログインする前に、現在のログインセッションがログアウトされます。
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=アインデンティティープロバイダーログイン後処理
+groupCreated=グループを作成しました
+generateError=新しい鍵ペアと証明書を生成できませんでした: {{error}}
+federationLinkHelp=このローカルに保存されたユーザーのインポート元であるUserStorageProvider。
+reqAuthnConstraints=要求されたAuthnContextの制約
+deleteAttributeText=属性の削除
+derFormattedHelp=証明書がLDAPのDER形式であり、PEM形式ではない場合にこれを有効にします。
+deleteResourceConfirm=このリソースを削除すると、一部のパーミッションに影響が出ます。
+whoWillAppearPopoverTextRoles=このタブには、このロールに直接割り当てられているユーザーのみが表示されます。関連するロールまたはグループを通じて、このロールが割り当てられているユーザーを確認するには、以下に移動します
+updateFlowSuccess=フローが正常に更新されました
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=カスタム必須アクションエラー
+noSessionsForUser=現在、このユーザーのアクティブなセッションはありません。
+realmExplain=レルムは、ユーザー、クレデンシャル、ロール、およびグループのセットを管理します。ユーザーはレルムに属し、レルムにログインします。レルムは互いに分離されており、制御対象のユーザーのみを管理および認証できます。
+evaluateError=次の理由により評価できませんでした: {{error}}
+roleRemoveAssociatedRoleConfirm=関連付けられているロールを削除しますか？
+samlKeysExportSuccess=鍵のエクスポートに成功しました
+policyProvider.group=1 つ以上のグループ（およびその階層）のセットがオブジェクトにアクセスできるようにするパーミッションの条件を定義します。
+updatedUserProfileError=ユーザープロファイルの設定が保存されていません：{{error}}
+policyProvider.time=パーミッションの時間条件を定義します。
+nameIdPolicyFormatHelp=NameIDフォーマットに対応するURI参照を指定します。
+deleteFlowError=フローを削除できませんでした: {{error}}
+alwaysReadValueFromLdapHelp=オンの場合、LDAP属性の読み取り中に、Keycloakデータベースの値の代わりに常にこの値が使用されます。
+xFrameOptionsHelp=デフォルト値は、非オリジンのiframeによってページが含まれないようにします。<1>詳細</1>
+sync-ldap-groups-to-keycloak=LDAPグループをKeycloakに同期する
+frontchannelUrlInvalid=フロントチャネルログアウトURLは有効なURLではありません。
+validatingPublicKey=公開鍵の検証
+eventTypes.DELETE_ACCOUNT.name=アカウントの削除
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=OAuth2デバイス検証ユーザーコード
+permissionsListIntro=スコープ名をクリックしてパーミッションのリストを編集します。すると、<1>{{realm}}</1>というクライアントのパーミッションの詳細ページにリダイレクトされます。
+client-scopes-condition.tooltip=想定されるクライアントスコープのリスト。指定されたクライアントリクエストがクライアントスコープの一部と一致する場合、条件はtrueと評価されます。また、設定された「スコープタイプ」に基づいて、デフォルトのクライアントスコープとするか、オプションのクライアントスコープとするかも決定されます。
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=アイデンティティープロバイダーの初回ログイン
+whatIsDefaultGroups=デフォルトグループの機能は何であるか。
+roleExplain=レルム ロールは、現在のレルムで使用するために定義するロールです。
+termsOfServiceUrlHelp=リライングパーティークライアントがエンドユーザーに提供する、リライングパーティーの利用規約を読むためのURL。
+noMappers=マッパーはありません。
+passwordPoliciesHelp.specialChars=パスワード文字列に必要な特殊文字の数。
+copyToClipboard=クリップボードにコピー
+validateName=名前を入力してください
+includeInIntrospection.tooltip=クレームをトークンイントロスペクションに追加する必要があるか。
+logoutServiceArtifactBindingUrlHelp=クライアントのシングルログアウトサービスのSAMLアーティファクトバインディングURL。別のバインディングを使用している場合は、空白のままにすることができます。
+noGroups=グループがありません。
+noRoles-clients=このクライアントスコープにはロールがありません。
+residentKey.not\ specified=指定されていません
+mappersList=マッパー一覧
+importError=証明書をインポートできませんでした: {{error}}
+permissionsScopeName=スコープ名
+emptyPermissions=パーミッションがありません
+userCreated=ユーザーが作成されました
+noUserDetails=ユーザーの詳細はありません。
+inputTypeRows=入力行
+mapperTypeHardcodedAttributeMapperHelp=このマッパーは、LDAP からユーザーをインポートするときに、モデルユーザー属性と一部のプロパティー（emailVerified や enabled など）をハードコードします。
+tokenDeleteError=初期アクセストークンを削除できませんでした: {{error}}
+CONFIGURE_TOTP=OTP の設定（CONFIGURE_TOTP）
+whoWillAppearLinkTextRoles=この一覧に表示されるユーザー
+targetClaim=対象のクレーム
+deleteAttributeGroupError=ユーザー属性グループを削除できませんでした: {{error}}
+selectIfResourceExists=リソースがすでに存在する場合は、何をすべきかを指定します。
+passwordPoliciesHelp.notEmail=パスワードはユーザーの電子メール アドレスと同じ値にできません。
+userSessionAttribute=ユーザーセッション属性
+samlSettings=SAML設定
+mapperTypeHardcodedLdapRoleMapperHelp=LDAPからインポートされたユーザーは、この設定されたロールに自動的に追加されます。
+iconUriHelp=アイコンのURI。
+cibaBackchannelTokenDeliveryMode=バックチャネルトークンデリバリーモード
+validateEditMode=編集モードを選択する必要があります
+eventTypes.UPDATE_PROFILE.name=プロファイルの更新
+isMandatoryInLdap=LDAPでは必須
+deleteClientConditionError=条件の作成中にエラーが発生しました：{{error}}
+clientOfflineSessionIdle=クライアントオフラインセッションアイドル
+helpLabel=「{{label}}」の追加のヘルプ
+clientPoliciesProfiles=クライアントポリシープロファイル
+requiredForLabel.both=ユーザーと管理者の両方
+deleteRealm=レルムの削除
+displayOnClientHelp=このクライアントで「同意が必要」がオンになっている場合にのみ適用されます。このスイッチがオフの場合、同意画面には設定されたクライアントスコープに対応する同意情報のみが表示されます。オンの場合、同意画面にはこのクライアント自体に関する項目も表示されます。
+IDK-periodicChangedUsersSyncHelp=新しく作成されたユーザーをLDAP ストア内に作成する必要があるかどうかを指定します。優先順位は、新しいユーザーを同期するためにどのプロバイダーが選択されるかに影響します。
+clientUpdaterSourceRolesHelp=条件は、クライアントを作成/更新しようとするエンティティーのロールをチェックして、ポリシーが適用されるかどうかを判断します。
+authenticationHelp=このスイッチはOIDCクライアントのタイプを定義します。ONの場合、タイプはコンフィデンシャルアクセスです。OFFの場合、タイプはパブリックアクセスです。
+importResourceError={{error}}のためリソースをインポートできませんでした
+regexAttributeValuesHelp=有効にすると、属性値は正規表現として解釈されます。
+allowRegexComparison=正規表現パターンの比較を許可する
+eventTypes.IMPERSONATE_ERROR.name=代理ログインエラー
+valuePlaceholder=値を入力してください
+roleImportError=ロールをインポートできませんでした
+overallResults=全体的な結果
+createClientPolicySuccess=新しいポリシーが作成されました。
+dynamicScope=動的スコープ
+mapperTypeHardcodedLdapRoleMapper=hardcoded-ldap-role-mapper
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=連携されたアイデンティティーの削除エラー
+importOverwritten_zero=上書きされたレコードはありません。
+testConnectionSuccess=SMTP接続に成功しました。電子メールが送信されました。
+noProvidersLinked=アイデンティティープロバイダーがリンクされていません。
+passwordPoliciesHelp.maxAuthAge=再認証なしでパスワードを変更できる認証の最大有効期間。
+resultPermit=結果 - 許可
+deletePermission=パーミッションを永久に削除しますか？
+updateFlowError=フローを更新できませんでした: {{error}}
+updateClientContext=クライアントコンテキストの更新
+removeAssociatedRoles=関連付けられているロールの削除
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=アインデンティティープロバイダーログイン後処理
+scopesAsRequested=スコープが要求されます
+validateUuidLDAPAttribute=UUIDのLDAP属性を入力する必要があります
+createResourceBasedPermission=リソースベースのパーミッションの作成
+ldapRolesDn=LDAPロールDN
+importOverwritten_one=1つのレコードが上書きされました。
+samlEntityDescriptorHelp=外部IDPメタデータを設定ファイルよりロード、またはURLよりダウンロードして設定します。
+never=Never
+noCredentialsText=このユーザーにはクレデンシャルがありません。このユーザーにパスワードを設定できます。
+deletePolicyWarning=以下の集約されたポリシーは自動的に削除されます。
+rootURLHelp=相対URLに追加されたルートURL
+transient=一時的
+downloadAdaptorTitle=アダプター設定のダウンロード
+permissionDeletedError={{error}}のためパーミッションを削除できませんでした
+eventTypes.FEDERATED_IDENTITY_LINK.name=連携されたアイデンティティーのリンク
+more={{count}}件以上
+claimValue=クレーム値
+addExecutor=エグゼキューターの追加
+algorithmHelp=鍵の意図されたアルゴリズム
+searchUserByAttributeMissingValueError=属性値の指定
+passwordPoliciesHelp.maxLength=パスワードに許可される最大文字数。
+ldapKerberosSettingsDescription=このセクションには、Kerberos統合に役立つオプションが含まれています。これは、LDAPサーバーをKerberos/SPNEGOと組み合わせてユーザー認証に使用する場合にのみ使用されます。
+flowDetails=フローの詳細
+attestationPreference.indirect=間接的
+used.notInUse=不使用
+userModelAttributeName=ユーザーモデル属性名
+eventTypes.EXECUTE_ACTIONS.description=アクションの実行
+authenticatedAccessPolicies=認証されたアクセスポリシー
+signatureAndEncryption=署名と暗号化
+reset=リセット
+conditionType=条件のタイプ
+importConfigHelp=ダウンロードしたIDPディスカバリー記述子からメタデータをインポートします。
+moveGroupError=グループを移動できませんでした: {{error}}
+executorType=エグゼキューターのタイプ
+noDefaultGroups=デフォルトグループがありません。
+deleteConfirmIdentityProvider=プロバイダー「{{provider}}」を完全に削除してもよろしいですか？
+eventTypes.CLIENT_INFO_ERROR.description=クライアント情報エラー
+anonymousAccessPolicies=匿名アクセスポリシー
+updateErrorClientScope=クライアントスコープを更新できませんでした: {{error}}
+deleteClientConditionSuccess=条件が正常に削除されました。
+fullNameLdapReadOnlyHelp=読み取り専用の場合、データはLDAPからKeycloakのデータベースにインポートされますが、Keycloakでユーザーが更新されてもLDAPに保存されません。
+generalSettings=一般的な設定
+addClientProfileError=クライアントプロファイルを作成できませんでした：{{error}}
+client-roles.label=クライアントロール
+keysFilter.PASSIVE=パッシブキー
+copyFlowSuccess=フローが正常に複製されました
+noRoles=このユーザーにはロールがありません
+eventTypes.PERMISSION_TOKEN_ERROR.description=パーミッショントークンエラー
+couldNotLinkIdP=アイデンティティープロバイダーをリンクできませんでした：{{error}}
+managePriorities=優先順位を管理する
+noCredentials=クレデンシャルがありません
+evictionHourHelp=エントリーが無効になる時刻
+permissionDetails=パーミッションの詳細
+addToFilter=フィルターへの追加
+assignRole=ロールの割り当て
+accessSettings=アクセス設定
+kc.client.network.ip_address=クライアントIPv4アドレス
+hardcodedUserSessionAttribute=ユーザーがプロバイダーからインポートされるときに、特定のユーザーセッション属性に値をハードコードします。
+eventTypes.GRANT_CONSENT.name=同意の付与
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.description=アイデンティティープロバイダーリンクアカウントエラー
+keystorePassword=キーストアのパスワード
+implicitFlowHelp=これにより、認可コードを使用しないOpenID Connectリダイレクトベースの認証がサポートされます。OpenID ConnectまたはOAuth 2の仕様の観点から言えば、このクライアントで「Implicit Flow」のサポートが有効になります。
+inputHelperTextBefore=入力フィールドのヘルパーテキスト（上）
+validateUsersDn=ユーザーのDNを入力する必要があります
+validateAttributeName=名前のない属性設定は許可されません。
+noRolesInstructions-groups=このグループにはまだロールが作成されていません。まずはロールを作成してください。
+emptyAuthorizationScopes=認可スコープがありません
+userFederationExplain=ユーザーフェデレーションは、LDAPやActive Directoryなどの外部データベースおよびディレクトリーへのアクセスを提供します。
+noRoles-clientScopes=このクライアントスコープにはロールがありません。
+copyError=認可の詳細をコピー中にエラーが発生しました: {{error}}
+client-attributes.label=クライアント属性
+clipboardCopyDenied=ブラウザーがクリップボードへのアクセスをブロックしています。
+saveProviderListSuccess=プロバイダーの優先度が正常に更新されました。
+configureMappingDescription=この表から任意のマッピングを選択してください。
+attributeGeneralSettingsDescription=このセクションには、すべての属性に共通するいくつかの基本設定が含まれています。
+browse=ブラウズ
+clientImportSuccess=クライアントのインポートに成功しました
+userFedDisableConfirm=このユーザーフェデレーションプロバイダーを無効にすると、クエリーでは考慮されなくなり、プロバイダーが再度有効になるまでインポートされたユーザーは無効になり、読み取り専用になります。
+deleteValidatorConfirmTitle=バリデーターを削除しますか？
+validatePasswordPolicyHelp=Keycloakがパスワードを更新する前に、レルムのパスワードポリシーでパスワードを検証するかどうかを指定します。ユーザーのパスワードがLDAPに保存されている場合、一部のKeycloakパスワードポリシー（「最近使用されていない」、「パスワードの有効期限」、「ハッシュ反復」、「ハッシュアルゴリズム」）は機能しません。これは、Keycloakがパスワードストレージを直接制御できないために発生します。これらのポリシーを使用する場合は、LDAPサーバー層でパスワードポリシーを有効にしてください。
+dragHelp=スペースキーまたはEnterキーをクリックしてドラッグを開始し、矢印キーで上下に移動します。ドラッグを確定するにはEnterキーを押します。ドラッグ操作をキャンセルするには、他のキーをクリックします。
+validPostLogoutRedirectURIsHelp=ログアウト成功後にブラウザーがリダイレクトできる有効なURIパターン。「+」または空欄の場合は、有効なリダイレクトURIのリストが使用されます。「-」の場合は、ログアウト後のリダイレクトURIは許可されません。「http://example.com/*」のような単純なワイルドカードを使用できます。「/my/relative/path/*」のような相対パスも指定できます。相対パスはクライアントのルートURLを基準とします。ルートURLが指定されていない場合は、認証サーバーのルートURLが使用されます。
+bruteForceModeHelpText=有効にした場合、ブルートフォース攻撃が検出された場合にユーザーアカウントに対して何が起こるかを指定します。
+createResourceSuccess=リソースが正常に作成されました
+clientSecretError=次の理由によりクライアント シークレットを再生成できませんでした: {{error}}
+cibaExpiresInHelp=認証リクエストを受信してからの「auth_req_id」の有効期限（秒）。
+copyFlowError=フローを複製できませんでした: {{error}}
+oauthDeviceAuthorizationGrant=OAuth 2.0デバイス認可グラント
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=OAuth2デバイス検証ユーザーコード
+attestationPreference.not\ specified=未指定
+claimToRole=クレームが存在する場合は、指定されたレルムロールまたはクライアント ロールをユーザーに付与します。
+usersLeft_other={{count}} がグループを脱退しました
+user-events-cleared-error=ユーザーイベントをクリアできませんでした：{{error}}
+clientUpdaterSourceHost=条件は、クライアントを作成/更新しようとするエンティティーのホスト/ドメインをチェックして、ポリシーが適用されるかどうかを判断します。
+generatedIdTokenHelp=選択されたユーザーが認証されると生成され、クライアントに送信されるIDトークンの例を表示します。有効なプロトコルマッパーとロールスコープマッピング、そして実際のユーザーに割り当てられたクレームとロールに基づいて、トークンに含まれるクレームとロールを確認できます。
+signature-algorithm=JWAアルゴリズム。クライアントが認証のためにJWTに署名する際に使用するアルゴリズムです。空白のままにした場合、クライアントは特定のクライアントオーセンティケーターに適した任意のアルゴリズムを使用できます。
+useLowerCaseBearerTypeHelp=オンの場合、トークンレスポンスには小文字の「bearer」型が設定されます。デフォルトでは、サーバーはRFC6750で定義されている「Bearer」型を設定します。
+useRfc9068AccessTokenTypeHelp=有効にすると、アクセストークンのヘッダータイプはRFC9068に準拠した「at+jwt」になります。有効にしない場合は、「JWT」になります。
+clientUpdaterSourceGroups=グループ
+eventTypes.EXECUTE_ACTIONS_ERROR.description=アクション実行時のエラー
+displayOrderHelp=GUI（ログインページなど）におけるプロバイダーの順序を定義する番号。最も小さい番号が最初に適用されます。
+searchForProvider=プロバイダーの検索
+isMandatoryInLdapHelp=trueの場合、この属性はLDAPで必須です。Keycloakのデータベースに値が存在しない場合は、空の値がLDAPに伝播されます。
+addIdentityProvider={{provider}}プロバイダーの追加
+ignoreMissingGroupsHelp=グループ階層内の欠落しているグループを無視します。
+eventTypes.INVALID_SIGNATURE.description=無効な署名です
+requiredWhen=必要な場合
+scopePermissions.clients.configure-description=管理者の管理権限が制限されています。スコープ、テンプレート、プロトコルマッパーを設定できません。
+chooseAPolicyTypeInstructions=以下の一覧からポリシータイプを1つ選択すると、新しい認可ポリシーを設定できます。いくつかのタイプと説明があります。
+deleteGrantsSuccess=付与が正常に無効化されました。
+annotationsText=アノテーション
+oneTimePassword=ワンタイムパスワード
+invalidateRotatedError=ローテーションされたシークレットを削除できませんでした: {{error}}
+recent=最近
+loginActionTimeoutHelp=パスワードの更新やTOTPの設定など、ログイン関連のアクションを完了するためにユーザーが費やすことができる最大時間。5分以上など、比較的長めに設定することを推奨します。
+authenticationFlow=認証フロー
+emptyAuthorizationInstructions=認可スコープを作成する場合は、以下のボタンをクリックして認可コープを作成してください。
+inputTypeSize=入力サイズ
+updateExecutorError=エグゼキューターが更新されませんでした: {{error}}
+nameField=名前
+moveGroupSuccess=グループを移動しました
+attributesGroup=属性グループ
+clientDeleteError=クライアントを削除できません: {{error}}
+idpAccountEmailVerification=IdPアカウントのメール検証
+deleteExecutionSuccess=エグゼキューションが正常に削除されました
+exportSamlKeyTitle=SAML鍵のエクスポート
+groupDeleted_other=グループを削除しました
+addSubFlowHelp=サブフローは、汎用フローまたはフォームのいずれかです。フォームタイプは、ユーザーに対して単一のフローを生成するサブフローを構築するために使用されます。サブフローは、含まれるエグゼキューションの評価に応じて成功と評価される特別なタイプのエグゼキューションです。
+searchForFlow=フローの検索
+addAuthnContextClassRef=認証コンテキストクラス参照を追加する
+authorizationSignedResponseAlgHelp=レスポンスモードが jwt の場合に、認可レスポンストークンの署名に使用されるJWAアルゴリズム。
+fullNameLdapWriteOnlyHelp=書き込み専用の場合、Keycloakでユーザーが作成または更新されると、データがLDAPに伝播されます。ただし、このマッパーはLDAPからKeycloakへのデータの伝播には使用されません。この設定は、firstNameとlastNameの属性マッパーを別々に設定し、それらを使用してLDAPからKeycloakに属性を読み取りたい場合に便利です。
+userFedDeleteError=ユーザーフェデレーションプロバイダーを削除できませんでした：{{error}}
+allowed-client-scopes.tooltip=新規登録クライアントで使用できるクライアントスコープのホワイトリスト。ホワイトリストに登録されていないクライアントスコープを使用してクライアントを登録しようとすると、拒否されます。デフォルトでは、ホワイトリストは空か、レルムのデフォルトのクライアントスコープのみ（「デフォルトスコープの許可」設定プロパティーに基づきます）で構成されます。
+frontchannelLogoutOIDCHelp=trueの場合、ログアウトするには、OIDCのフロントチャネルログアウトの仕様で指定されているフロントチャネルログアウトURL に、ブラウザーがリクエストを送信させるようにする必要があります。falseの場合、バックチャネルログアウトURLまたは管理URLのいずれかが設定されていれば、サーバーはログアウトのバックグラウンド呼び出しを実行できます。
+skipCustomizationAndFinish=カスタマイズをスキップして終了する
+kc.time.date_time=日付/時刻（MM/dd/yyyy hh:mm:ss）
+authDetails=認可の詳細
+mappedGroupAttributesHelp=属性名をカンマで区切ったリスト。これはLDAPグループの属性リストを指し、Keycloakでグループの属性としてマッピングされます。Keycloakでマッピングする追加のグループ属性がない場合は、このフィールドを空のままにしてください。
+fromPredefinedMapper=定義済みのマッパーから
+ellipticCurveHelp=ECDSAで使用される楕円曲線
+disableConfirmRealm=レルムを無効にすると、ユーザーとクライアントはそのレルムにアクセスできなくなります。続行してもよろしいですか？
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=連携されたアイデンティティーの削除エラー
+SKIP=スキップ
+deleteCredentialsConfirm=これらのユーザーのクレデンシャルを削除してもよいですか？
+keysIntro=「JWKS URLの使用」スイッチがオンになっている場合は、有効な「JWKS URL」を入力する必要があります。保存後、管理者は「JWKS URL」から鍵をダウンロードできます。また、クライアント認証中に不明な「KID」が検出された場合は、Keycloakサーバーによって鍵が自動的にダウンロードされます。
+displayNameHelp=アイデンティティープロバイダーのフレンドリー名。
+eventTypes.OAUTH2_DEVICE_AUTH.name=OAuth2デバイス認証
+isBinaryAttributeHelp=バイナリーLDAP属性の場合はtrueになります。
+generatedUserInfoIsDisabled=ユーザーが選択されていない場合、生成されたユーザー情報は無効になります。
+ldapAttributeName=LDAP属性名
+userIdHelperText=このアイデンティティープロバイダーのユーザーの一意のIDを入力します。
+clientPoliciesTab=クライアントポリシータブ
+permissionDecisionStrategyHelp=決定戦略は、ポリシーの評価方法と最終的な判定方法を決定します。「肯定」は、最終判定が肯定となるためには、少なくとも1つのポリシーが肯定と評価する必要がある、ということを意味します。「すべて肯定」は、全体の判定が肯定となるためには、すべてのポリシーが肯定と評価する必要がある、ということを意味します。「コンセンサス」は、肯定の数が否定の数より多くなければならないことを意味します。肯定と否定の数が同じ場合は、最終的な判定は否定になります。
+clientIdHelpHelp=LDAPロールマッピングがマッピングされるクライアントのクライアントID。「レルムロールマッピングを使用する」がfalseの場合にのみ適用されます。
+requiredWhenTooltip=スコープを使用する場合、ログインリクエストで設定されたスコープの少なくとも1つが適用されていれば、属性は必須です。現在のリクエストのデフォルトスコープとオプションスコープの両方が評価されます。管理コンソールとアカウントコンソールのコンテキストでは、スコープは評価されず、属性も必須ではありません。
+admin-events-cleared=管理者イベントはクリアされました
+AESKeySizeHelp=生成されるAES鍵のサイズ（バイト単位）。AES-128の場合はサイズ16、AES-192の場合はサイズ24、AES-256の場合はサイズ32です。警告: 一部のJDK実装では、128より大きい鍵は許可されません。
+deleteProvider=プロバイダーを削除しますか？
+confirmAccessTokenBody=登録アクセストークンを再生成すると、クライアント登録サービスに関するアクセスデータが更新されます。
+updatePasswordPolicyError=パスワードポリシーを更新できませんでした: {{error}}
+uuidLdapAttributeHelp=LDAP属性の名前。LDAP内のオブジェクトの一意のオブジェクト識別子（UUID）として使用されます。多くのLDAPサーバーベンダーでは「entryUUID」ですが、ベンダーによっては異なる場合もあります。例えば、Active Directoryの場合は「objectGUID」です。LDAPサーバーがUUIDの概念をサポートしていない場合は、ツリー内のLDAPユーザー間で一意であると想定される他の属性を使用できます。例えば、「uid」や「entryDN」などです。
+validPostLogoutRedirectURIs=ログアウト成功後にブラウザーがリダイレクトできる有効なURIパターン。値が「+」または空欄の場合、有効なリダイレクトURIのリストが使用されます。値が「-」の場合、ログアウト後のリダイレクトURIは許可されません。「http://example.com/*」のような単純なワイルドカードを使用できます。「/my/relative/path/*」のような相対パスも指定できます。相対パスはクライアントのルートURLを基準とします。ルートURLが指定されていない場合は、認証サーバーのルートURLが使用されます。
+authorizationScopeDetails=認可スコープの詳細
+readOnly=読み取り専用
+regexPattern=正規表現パターン
+backchannelLogoutRevokeOfflineSessionsHelp=バックチャネルログアウトURLを使用する際に、ログアウトトークンに「revoke_offline_access」イベントを含めるかどうかを指定します。Keycloakは、このイベントを含むログアウトトークンを受信すると、オフラインセッションを無効化します。
+eventTypes.CLIENT_UPDATE_ERROR.name=クライアント更新エラー
+executors=エグゼキューター
+unlinkAccount=アカウントのリンクの解除
+advanced=高度
+connectionAndAuthentication=接続と認証
+updateSuccessClientScope=クライアントスコープが更新されました。
+messageBundleDescription=編集できるのはサポートされているロケールのみです。サポートされているロケールをまだ選択していない場合は、英語ロケールのみ編集できます。
+admin-events-cleared-error=管理イベントをクリアできませんでした: {{error}}
+nameHintHelp=グループの一意な名前。この名前は、属性をグループにバインドするときにグループを参照するために使用されます。
+eventTypes.INTROSPECT_TOKEN.description=トークンイントロスペクション
+passwordPoliciesHelp.lowerCase=パスワード文字列に必要な小文字の数。
+joinGroups=グループに参加
+deleteClientScope_one=クライアントスコープ{{name}}を削除します
+ms=ミリ秒
+mappingDeletedError=マッピングを削除できませんでした：{{error}}
+notBeforeTooltip=まず、設定タブで管理URLを設定する必要があります。
+nameHelpHelp=マッパーの名前
+enableStartTlsHelp=STARTTLSを使用してLDAPへの接続を暗号化し、接続プールを無効にします。
+deleteDialogTitle=属性グループを削除しますか？
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=クライアント起点のアカウントリンク
+or=または
+deny=拒否
+eventTypes.USER_INFO_REQUEST.description=ユーザー情報リクエスト
+updateCredentialUserLabelError=ユーザーラベルの変更中にエラーが発生しました: {{error}}
+passwordPoliciesHelp.forceExpiredPasswordChange=新しいパスワードが必要になるまでのパスワードの有効日数。
+policyDeletedError=リソースを削除できませんでした: {{error}}
+confirm=確認
+template=テンプレート
+roleNameLdapAttributeHelp=ロールオブジェクトでロール名とRDNとして使用されるLDAP属性の名前。通常は「cn」です。この場合、典型的なグループ/ロールオブジェクトのDNは「cn=role1,ou=finance,dc=example,dc=org」のようになります。
+origin=オリジン
+addCondition=条件を追加
+updateSuccess=プロバイダーは正常に更新されました
+mappingDeletedSuccess=マッピングが正常に削除されました
+noUsersFound=ユーザーが見つかりません。
+mapperTypeGroupLdapMapper=group-ldap-mapper
+targetContextAttributes=対象コンテキスト属性
+clientScopeTypes.none=無し
+whoCanEdit=誰が編集できるか
+whoWillAppearLinkTextUsers=このグループ一覧に誰が表示されるか。
+showPasswordDataName=名前
+permissionsDisableConfirm=パーミッションを無効にすると、以下の一覧にあるすべてのパーミッションが自動的に削除されます。さらに、関連するリソースとスコープも削除されます。
+dayMonthHelp=ポリシーが許可される日を定義します。2番目のフィールドに値を入力して範囲を指定することもできます。この場合、現在の日が指定した2つの値の間にあるか、等しい場合のみ許可されます。
+saveEventListenersError=イベントリスナーの保存中にエラーが発生しました：{{error}}
+noValidMetaDataFound=このURLに有効なメタデータが見つかりませんでした: {{error}}
+profilesConfigTypes.jsonEditor=JSONエディター
+noUsersFoundError={{error}}のためユーザーが見つかりませんでした
+logoutServiceArtifactBindingUrl=ログアウトサービスアーティファクトバインディングURL
+deleteExecutorProfileConfirmTitle=エグゼキューターを削除しますか？
+createAttributeSuccess=成功しました。ユーザープロファイルの設定が保存されました。
+eventTypes.GRANT_CONSENT_ERROR.description=同意の付与エラー
+emptyResourcesInstructions=リソースを作成したい場合は、下のボタンをクリックしてください。
+recommendedSsoTimeout=この値は、SSOセッションアイドルタイムアウトよりも短くすることをお勧めします: {{time}}
+policyProvider.aggregate=既存のポリシーを再利用してより複雑なポリシーを構築し、認可リクエストの処理中に評価されるポリシーからパーミッションをさらに切り離します。
+advancedAttributeToRole=属性セットが存在し、一致する場合は、指定されたレルムロールまたはクライアントロールをユーザーに付与します。
+userDeletedError=ユーザーを削除できませんでした: {{error}}
+ldapGroupsDnHelp=このツリーのグループが保存されるLDAP DN。例: 'ou=groups,dc=example,dc=org'。
+ldapGroupsDn=LDAPグループDN
+ldapFullNameAttributeHelp=ユーザーのフルネームを含むLDAP属性の名前。通常は「cn」になります。
+jsonEditor=JSONエディター
+deleteClientPolicyProfileConfirmTitle=プロファイルを削除しますか？
+passwordPoliciesHelp.upperCase=パスワード文字列に必要な大文字の数。
+uploadFile=JSONファイルのアップロード
+deleteClientPolicySuccess=クライアントポリシーを削除しました
+updatePolicySuccess=ポリシーが正常に更新されました
+subjectHelp=クライアント証明書のサブジェクトDNを検証するための正規表現。あらゆる種類の表現に一致させるには、「(.*?)(?:$)」を使用します。
+eventTypes.CUSTOM_REQUIRED_ACTION.name=カスタム必須アクション
+roleID=ロールID
+filteredByClaim=必須クレームの検証
+eventTypes.GRANT_CONSENT.description=同意の付与
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=OAuth2デバイス認証エラー
+clientProfilesHelpItem=クライアントプロファイルのヘルプ項目
+updateResourceSuccess=リソースが正常に更新されました
+enableDisable=無効なクライアントはログインを開始することも、アクセストークンを取得することもできません。
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=OAuth2デバイス検証ユーザーコードエラー
+providedBy=提供
+no=いいえ
+resourceScopeSuccess=認可スコープが正常に削除されました
+client-accesstype.tooltip=条件が適用されるクライアントのアクセスタイプ。パブリッククライアントがクライアント認証を無効にすると、コンフィデンシャルクライアントはクライアント認証を有効にします。「ベアラーのみ」は非推奨のクライアントタイプです。
+sessionExplain=セッションとは、このレルム内のユーザーと、そのユーザーがセッション内でアクセスするクライアントのセッションです。
+noSearchResults=検索結果がありません
+clientRegisterPolicyDeleteConfirm=クライアント登録ポリシー{{name}}を完全に削除してもよいですか？
+addAttribute={{label}}の追加
+hide=隠す
+rowCancelBtnAriaLabel={{messageBundle}}の編集のキャンセル
+associatedRolesRemoved=関連するロールが削除されました
+targetContextAttributesHelp=アイデンティティー属性の代わりにコンテキスト属性（クレーム）の評価を定義します。
+assign=割り当て
+inputOptionLabelsI18nPrefix=国際化キープレフィックス
+acrToLoAMappingHelp=どのACR（認証コンテキストクラス参照）値がどのLoA（認証レベル）にマッピングされるかを定義します。ACRは任意の値を指定できますが、LoAは数値でなければなりません。
+max-clients.tooltip=レルム内の既存のクライアント数が設定された制限と同じかそれより大きい場合、新しいクライアントを登録することはできません。
+mapperTypeCertificateLdapMapper=certificate-ldap-mapper
+leaveGroup_other=グループを脱退しますか？
+mappingCreatedSuccess=マッピングが正常に作成されました
+clientScopeType.optional=任意
+select=選択
+executorDetails=エグゼキューターの詳細
+clientUpdaterSourceGroupsHelp=条件は、クライアントを作成/更新しようとするエンティティーのグループをチェックして、ポリシーが適用されるかどうかを判断します。
+isBinaryAttribute=二値属性であるか
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=アイデンティティープロバイダーのログイン後処理エラー
+permissionSaveError={{error}}のためパーミッションを更新できませんでした。
+doNotStoreUsers=ユーザーを保存しない
+spi=SPI
+emptyValidators=バリデータがありません。
+plus=プラス
+eventTypes.CODE_TO_TOKEN_ERROR.name=コードとトークンの交換時のエラー
+ldapSearchingAndUpdatingSettingsDescription=このセクションには、LDAPサーバーで利用可能なユーザーを検索するためのオプションが含まれています。
+client-accesstype.label=クライアントアクセスタイプ
+executorsHelpItem=エグゼキューターのヘルプ項目
+client-uris-must-match.tooltip=オンの場合、信頼できるホストまたはドメインに一致する場合にのみ、すべてのクライアントURI（リダイレクトURI など）が許可されます。
+nameHelp=新しいフローの名前のヘルプテキスト
+resourcesToImport=インポートするリソース
+changeAuthenticatorConfirmTitle={{clientAuthenticatorType}}に変更しますか？
+userSessionAttributeValue=ユーザーセッション属性値
+joinGroupsFor=ユーザー{{username}}のグループへの参加
+attributeConsumingServiceIndex=属性消費サービスインデックス
+enabledHelp=鍵が有効かどうかを設定します
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=アイデンティティープロバイダーからのトークン取得エラー
+hardcodedAttribute=ユーザーがプロバイダーからインポートされるときに、特定のユーザー属性に値をハードコードします。
+accessTokenError=次の理由によりアクセストークンを再生成できませんでした：{{error}}
+claim=クレーム
+openIdConnectCompatibilityModes=OpenID Connect互換モード
+whoWillAppearPopoverFooterText=このロールを有効なロールとして持つユーザーは、このタブに追加できません。
+eventTypes.RESTART_AUTHENTICATION_ERROR.name=認証再開中のエラー
+flowNameHelp=新しいフローの名前のヘルプテキスト
+serverPrincipalHelp=HTTPサービスのサーバープリンシパルのフルネーム（サーバー名とドメイン名を含む）。例: HTTP/host.foo.org@FOO.ORG
+mapperTypeCertificateLdapMapperHelp=LDAPユーザーの証明書を含む単一の属性をKeycloakのデータベースのUserModel属性にマッピングするために使用します。
+clientScopeSearch.protocol=プロトコル
+filteredByClaimHelp=trueの場合、アイデンティティープロバイダーが発行するIDトークンには特定のクレームが必要です。そうでない場合、ユーザーはこのブローカーを介して認証できません。
+initialAccessTokenDetails=初期アクセストークンの詳細
+noTranslations=翻訳はありません
+moveGroupEmpty=サブグループがありません
+testingConnection=接続テスト
+updatedCredentialMoveSuccess=ユーザークレデンシャルの設定が保存されました。
+flowDescriptionHelp=新しいフローへの説明のヘルプテキスト
+keyID=KEY_ID
+annotations=アノテーション
+importSkipped_other={{count}}件のレコードがスキップされました。
+membershipAttributeTypeHelp=DNは、LDAPグループのメンバーが完全なDN形式で宣言されていることを意味します。例: 'member: uid=john,ou=users,dc=example,dc=com'。UIDは、LDAPグループのメンバーが純粋なユーザーUID形式で宣言されていることを意味します。例: 'memberUid: john'。
+unsavedChangesTitle=保存されていない変更
+lastEvaluation=最終評価
+createClientConditionError=条件の作成中にエラーが発生しました: {{error}}
+mappingCreatedError=マッピングを作成できませんでした：{{error}}
+rowEditBtnAriaLabel={{messageBundle}}を編集する
+authnContextClassRefs=認証コンテキストクラス参照
+eventTypes.PERMISSION_TOKEN_ERROR.name=パーミッショントークンエラー
+noResourceCreateHint=リソースがありません。そのため、リソースベースのパーミッションを作成できません。
+offlineSessionMaxHelp=アクティビティーに関係ない、オフラインセッションの有効期限が切れるまでの最大時間。
+passwordPolicyHintsEnabled=パスワードポリシーのヒントの有効化
+pushedAuthorizationRequestRequired=プッシュされた認可リクエストが必要です。
+editInfo=情報を編集する
+providerCreateSuccess=新しいクライアントポリシーが正常に作成されました。
+editUserLabel=ユーザーラベル編集ボタン
+useRefreshTokenForClientCredentialsGrantHelp=オンの場合、grant_typeにclient_credentialsが指定されると、refresh_tokenパラメーターが作成され、トークンレスポンスに追加されます。RFC6749 OAuth 2.0のセクション4.4.3では、client_credentialが指定される場合はrefresh_tokenパラメーターを生成すべきではないと規定されています。オフの場合、refresh_tokenパラメーターは生成されず、関連付けられたユーザーセッションは削除されます。
+ldapConnectionAndAuthorizationSettingsDescription=このセクションには、LDAPサーバーへの接続設定に関するオプションが含まれています。また、LDAPサーバーへのLDAP接続の認証に関するオプションも含まれています。
+minus=マイナス
+groupsPermissionsHint=このロールの管理において、きめ細かいパーミッション設定を有効にするかどうかを決定します。無効にすると、現在設定されているすべてのパーミッションが削除されます。
+enableLdapv3PasswordHelp=LDAPv3パスワード変更拡張操作（RFC-3062）を使用します。パスワード変更拡張操作では通常、LDAPユーザーがLDAPサーバーに既にパスワードを持っていることが条件となります。そのため、これを「登録同期」と併用する場合は、ランダムに生成された初期パスワードを含む「ハードコードされたLDAP属性マッパー」も追加すると効果的です。
+privateRSAKeyHelp=PEM形式でエンコードされた秘密RSA鍵
+client-updater-trusted-hosts.tooltip=信頼するホストのリスト。クライアントの登録/更新リクエストがこの設定で指定されたホスト/ドメインから送信された場合、条件は真と評価されます。ホスト名またはIPアドレスを使用できます。先頭にアスタリスク（*.example.com）を付けると、ドメインexample.com全体が信頼されます。
+clientOfflineSessionMaxHelp=クライアントのオフラインセッションが期限切れになるまでの最大時間。レルムレベルで「オフラインセッションの最大制限」が有効になっている場合、クライアントのオフラインセッションが期限切れになるとオフライントークンが無効化されます。このオプションはグローバルユーザーSSOセッションには影響しません。設定されていない場合は、レルムの「オフラインセッションの最大制限」値が使用されます。
+clientAccessType=クライアントのアクセスタイプ（confidential、public、bearer-only）に基づいて、ポリシーを適用するかどうかを判断します。この条件は、ほとんどのOpenID Connectリクエスト（認可リクエスト、トークンリクエスト、イントロスペクションリクエストなど）でチェックされます。confidentialタイプのクライアントはクライアント認証を有効にしていますが、publicタイプのクライアントはクライアント認証を無効にしています。bearer-onlyは非推奨のクライアントタイプです。
+top-level-flow-type.client-flow=クライアントフロー
+clientSecretSuccess=クライアントシークレットが再生成されました
+oAuthDeviceCodeLifespan=OAuth 2.0デバイスコードの有効期間
+directMembership=ダイレクトメンバーシップ
+excludeIssuerFromAuthenticationResponse=認証レスポンスからの発行者の除外
+searchForTranslation=翻訳を検索する
+resourceSaveError={{error}}のためリソースを保持できませんでした
+onDragStart=アイテム{{item}}のドラッグを開始しました。
+addExecutionTitle=エグゼキューションの追加
+eventTypes.INVALID_SIGNATURE_ERROR.name=無効な署名エラー
+deletedSuccessRealmSetting=レルムが削除されました
+resultDeny=結果 - 拒否
+importAdded_one=レコードが1件追加されました。
+emptySecondaryAction=新しいマッパーを設定する
+deleteCredentialsSuccess=クレデンシャルは正常に削除されました。
+conditions=条件
+kc.client.network.host=クライアントホスト
+requirements.REQUIRED=必須
+validPostLogoutRedirectUri=有効なログアウト後リダイレクトURI
+oAuthDevicePollingInterval=OAuth 2.0デバイスポーリングインターバル
+mappingDetails=マッパーの詳細
+clientSaveSuccess=クライアントが正常に更新されました
+ecdsaGenerated=ecdsca-generated
+includeGroupsAndRoles=グループとロールを含める
+generate=生成
+userProfileSuccess=ユーザープロファイルの設定が正常に更新されました。
+attributeDefaultValueHelp=Keycloakのデータベースに値が存在せず、属性がLDAPで必須である場合、この値はLDAPに伝播されます。
+cibaPolicy=CIBAポリシー
+dateFrom=日付（開始）
+filterGroups=フィルターグループ
+disableSigning=「{{key}}」を無効にする
+kc.client.user_agent=クライアント/ユーザーエージェント
+javaKeystore=java-keystore
+deleteProviderMapper=マッパーを削除しますか？
+lookAroundHelp=トークンジェネレーターとサーバーが時間同期または回数同期していない場合に備えて、サーバーが許容する必要がある誤差の範囲（トークンの期間または回数）。
+authorizationEncryptedResponseEncHelp=JWAレスポンスモードがjwtの場合、認可レスポンスの暗号化におけるコンテンツ暗号化に使用されるアルゴリズム。このオプションは、認可レスポンスを暗号化する場合に必要です。空のままにした場合、認可レスポンスは署名のみされ、暗号化されません。
+fullName={{givenName}} {{familyName}}
+deletePolicyConfirm=このポリシーを削除すると、一部のパーミッションまたは集約されたポリシーに影響します。
+AESKeySize=AES鍵のサイズ
+postBrokerLoginFlowAliasHelp=このアイデンティティープロバイダーでログインするたびにトリガーされる認証フローのエイリアスです。このアイデンティティープロバイダーで認証された各ユーザーに対して追加の検証（例えばOTP）が必要な場合に便利です。このアイデンティティープロバイダーでのログイン後に追加の認証をトリガーする必要がない場合は、「なし」のままにしてください。また、認証の実装では、ユーザーがアイデンティティープロバイダーによって既に設定されているため、ClientSessionに既に設定されていることを前提とする必要があることに注意してください。
+updatedUserProfileSuccess=ユーザープロファイルの設定が保存されました
+leaveGroupConfirmDialog_one={{username}}をグループ{{groupname}}から削除してもよろしいですか？
+noRolesInstructions=このユーザーにはロールが割り当てられていません。まずはロールを割り当ててください。
+clientRegisterPolicyDeleteConfirmTitle=クライアント登録ポリシーを削除しますか？
+permissionDeletedSuccess=パーミッションを削除しました。
+clientScopeRemoveSuccess=スコープマッピングが正常に削除されました。
+userCreateError=ユーザーを作成できませんでした: {{error}}
+selectRealm=レルムの選択
+sync-keycloak-groups-to-ldap=KeycloakのグループのLDAPへの同期
+deleteConfirm=プロバイダー「{{provider}}」を完全に削除してもよいですか？
+compositesRemovedAlertDescription=関連するすべてのロールが削除されました
+allowKerberosAuthenticationHelp=SPNEGO/Kerberosトークンを使用したユーザーのHTTP認証を有効/無効にします。認証されたユーザーに関するデータは、このLDAPサーバーからプロビジョニングされます。
+importOverwritten_other={{count}}件のレコードが上書きされました。
+doNotStoreUsersHelp=有効にすると、このブローカーのユーザーは内部データベースに保存されません。
+eventTypes.UNREGISTER_NODE_ERROR.name=ノード登録解除エラー
+oauthDeviceAuthorizationGrantHelp=これにより、OAuth 2.0デバイス認可付与のサポートが有効になります。つまり、クライアントは、入力機能が制限されているか、適切なブラウザーがないデバイス上のアプリケーションになります。
+groupDetails=グループの詳細
+roleNameLdapAttribute=ロール名のLDAP属性
+unexpectedError=予期しないエラーが発生しました：{{error}}
+requirements.CONDITIONAL=条件付き
+defaultGroupAdded_one=デフォルトグループに新しいグループが追加されました。
+user-events-cleared=ユーザーイベントはクリアされました
+usersLeft_one={{count}}人がグループを脱隊しました。
+emailAsUsernameHelpText=ユーザーが電子メールをユーザー名として設定できるようにします。
+saveError=ユーザーフェデレーションプロバイダーを保存できませんでした: {{error}}
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2のデバイスコードとトークンの交換
+impersonateError=ユーザーになりすますことができませんでした: {{error}}
+periodicFullSyncHelp=LDAPユーザーとKeycloakの定期的な完全同期を有効にするかどうか
+createError=アイデンティティープロバイダーを作成できません: {{error}}
+artifactResolutionServiceHelp=クライアントのSAMLアーティファクト解決サービス。これは、KeycloakがSOAP ArtifactResolveメッセージを送信するエンドポイントです。このバインディングのURLがない場合は、空白のままにすることができます。
+invalidateSecret=無効化
+notBeforeSetToNow=クライアントに「以前」を設定
+emptyConditions=条件が設定されていません。
+filterByRoles=レルムロールでフィルタリングする
+strictTransportSecurityHelp=Strict-Transport-Security HTTPヘッダーは、ブラウザーに常にHTTPSを使用するよう指示します。ブラウザーがこのヘッダーを認識すると、max-ageで指定された期間（1年間）の間、サブドメインを含め、サイトへのアクセスはHTTPSのみになります。<1>詳細はこちら</1>
+loginTimeoutHelp=ユーザーがログインを完了するまでの最大時間。30分以上など、比較的長めに設定することを推奨します。
+trusted-hosts.tooltip=信頼され、クライアント登録サービスの呼び出しやクライアントURIの値としての使用が許可されているホストのリストです。ホスト名またはIPアドレスを使用できます。先頭にアスタリスク（*）を付けると（例：「*.example.com」）、ドメインexample.com全体が信頼されます。
+disableTypeClaimCheckHelp=アイデンティティープロバイダーから受信したトークンの「typ」クレームの検証を無効にします。「off」の場合、typeクレームは検証されます（デフォルト）。
+passSubjectHelp=ログインフェーズ中に、オプションのlogin_hintクエリーパラメーターをSAML認証リクエストのSubjectに転送します。
+rsaGenerated=rsa-generated
+memberofLdapAttributeHelp=「ユーザーロール取得戦略」がGET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTEの場合にのみ使用されます。LDAPユーザーのLDAP属性名を指定します。この属性には、ユーザーが所属するグループが含まれます。通常はデフォルトの「memberOf」になります。
+krbPrincipalAttributeHelp=Kerberosプリンシパルを参照するLDAP属性の名前。KeycloakでKerberos/SPNEGO認証が成功した後、適切なLDAPユーザーを検索するために使用されます。この属性が空の場合、LDAPユーザーはKerberosプリンシパルの最初の部分に対応するLDAPユーザー名に基づいて検索されます。例えば、プリンシパルが「john@KEYCLOAK.ORG」の場合、LDAPユーザー名は「john」であると想定されます。
+deleteFlowSuccess=フローが正常に削除されました。
+passwordPoliciesHelp.hashIterations=パスワードを保存または検証する前にハッシュする回数。デフォルト：ハッシュアルゴリズムとしてargon2を使用する場合は-1、ハッシュアルゴリズムとしてpbkdf2-sha512を使用する場合は210,000、ハッシュアルゴリズムとしてpbkdf2-sha256を使用する場合は600,000、ハッシュアルゴリズムとしてpbkdf2を使用する場合は1,300,000です。
+idpUnlinkSuccess=プロバイダーのリンクは削除されました
+providerType=プロバイダーの種類
+disableNonceHelp=認証リクエストでnonceパラメーターを送信しないでください。nonceパラメーターはデフォルトで送信され、検証されます。
+deleteClientProfile=このクライアントプロファイルを削除します
+emptyClientProfiles=プロファイルがありません
+clientRegisterPolicyDeleteSuccess=クライアント登録ポリシーが正常に削除されました。
+keysFilter.ACTIVE=アクティブな鍵
+artifactResolutionServiceUrlHelp=アーティファクトからSAMLアサーションを取得するために使用する必要があるURL（SAMLのArtifactResolve）。
+deleteSuccess=属性グループが削除されました。
+clientRolesConditionTooltip=この条件評価中にチェックされるクライアントロール。クライアントに、設定で指定されたクライアントロールと同じ名前のクライアントロールが少なくとも1つある場合、条件はtrueと評価されます。
+policyProvider.client=1 つ以上のクライアントのセットがオブジェクトにアクセスできるようにするパーミッションの条件を定義します。
+mapperTypeMsadUserAccountControlManager=msad-user-account-control-mapper
+deleteNodeFail=ノードを削除できませんでした：{{error}}
+host-sending-registration-request-must-match.label=クライアント登録リクエストを送信するホストが一致する必要があります。
+emailInvalid=有効なメールアドレスを入力してください。
+deleteConfirmDialog_one=選択した{{count}}件のユーザーを完全に削除してもよいですか？
+rename=名前を変更する
+profilesConfigType=次の方法で設定します：
+keyLabel=鍵
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=アイデンティティープロバイダーのレスポンスエラー
+FAIL=インポート失敗
+noMappersInstructions=現在、このアイデンティティープロバイダーのマッパーは存在しません。
+attributesDropdown=属性ドロップダウン
+selectMethodType.generate=生成
+syncChangedUsers=変更されたユーザーの同期
+client-roles-condition.tooltip=この条件の評価中にチェックされるクライアントロール。クライアントに、設定で指定されたクライアントロールと同じ名前のクライアントロールが少なくとも1つある場合、条件はtrueと評価されます。
+TERMS_AND_CONDITIONS=利用規約（TERMS_AND_CONDITIONS）
+userRoleMappingUpdatedSuccess=ユーザーロールのマッピングが正常に更新されました
+memberofLdapAttribute=メンバーLDAP属性
+copyOf={{name}}のコピー
+eventTypes.REMOVE_TOTP.description=TOTPの削除
+authenticationExplain=認証は、さまざまなクレデンシャルの種類を設定および管理できる領域です。
+dropNonexistingGroupsDuringSync=同期中に存在しないグループを削除する
+deletePermissionConfirm=パーミッション{{permission}}を削除してもよいですか？
+clientUpdaterTrustedHosts=信頼できるホスト
+excludeIssuerFromAuthenticationResponseHelp=オンの場合、OpenID Connect認証レスポンスにパラメーター「iss」が含まれません。クライアントが「iss」パラメーターをサポートしていない古いOIDC / OAuth2アダプターを使用している場合に便利です。
+emptyPermissionInstructions=パーミッションを作成する場合は、以下のボタンをクリックして、リソースベースまたはスコープベースのパーミッションを作成してください。
+requiredClient=少なくとも1つのクライアントを追加してください。
+help=ヘルプ
+passwordPoliciesHelp.hashAlgorithm=パスワードにはハッシュアルゴリズムを適用するため、パスワードはプレーンテキストで保存されません。
+chooseAPolicyProvider=ポリシープロバイダーの選択
+searchGroups=グループの検索
+httpPostBindingLogoutHelp=HTTP-POSTバインディングを使用してリクエストに応答するかどうかを設定します。オフの場合は、HTTP-REDIRECTバインディングが使用されます。
+orderDialogIntro=ログインページまたはアカウントUIに表示されるプロバイダーの順序。行ハンドルをドラッグして順序を変更できます。
+targetClaimHelp=ポリシーが取得する対象のクレームを指定します。
+client-attributes-condition.tooltip=この条件の評価中にチェックされるクライアント属性。クライアントが、設定で指定されたクライアント属性と同じ名前と値を持つすべてのクライアント属性を持っている場合、条件はtrueと評価されます。
+isAccessTokenJWT=アクセストークンはJWTです
+noSessionsForClient=現在、このクライアントのアクティブなセッションはありません。
+enableHelp=ヘルプを有効にする
+cibaExpiresIn=有効期限
+noAvailableIdentityProviders=利用可能なアイデンティティープロバイダーがありません。
+searchType.default=デフォルト検索
+eventTypes.INVALID_SIGNATURE_ERROR.description=無効な署名エラー
+includeSubGroups=サブグループのユーザーを含める
+error-invalid-blank=「{{0}}」の値を指定してください。
+error-invalid-uri-fragment=「{{0}}」は無効なURLフラグメントです。
+error-invalid-uri-scheme=「{{0}}」のURLスキームは無効です。
+error-number-out-of-range-too-big=「{{0}}」の最大値は{{2}}でなければなりません。
+error-user-attribute-required=「{{0}}」を指定してください。
+error-username-invalid-character=「{{0}}」に無効な文字が含まれています。
+effectiveMessageBundlesHelp=テーマ、機能、言語、フリーテキストに基づいて効果的なメッセージバンドルを検索できます。
+emptyEffectiveMessageBundles=効果的なメッセージの検索
+missingFirstNameMessage=「{{0}}」: 名を指定してください。
+missingEmailMessage=「{{0}}」: メールアドレスを指定してください。
+deleteConfirmTranslationTitle=翻訳を削除しますか？
+selectThemeType=テーマタイプの選択
+authenticatorRefConfig.maxAge.label=オーセンティケーター参照の最大有効期間
+lightweightAccessToken=常に軽量アクセストークンを使用する
+itemDeleteConfirmTitle=項目を削除しますか？
+itemDeletedSuccess=項目が削除されました
+emptySelection=空の選択
+editBtn=編集ボタン
+acceptBtn=編集ボタンの承認
+bruteForceMode.TemporaryLockout=一時的にロックアウト
+multivalued=マルチバリュー
+to 属性。サイズと値を適切に検証するには、組み込みのバリデーターのいずれかを使用してください。
+sendClientIdOnLogoutHelp=ログアウトリクエストで「client_id」パラメーターを送信するかどうか。
+defaultLanguage=デフォルト
+translationValue=翻訳値
+addTranslationDialogHelperText=デフォルトの言語に基づいた翻訳が必要です。
+translationError=保存する前に翻訳を追加してください: {{error}}
+senderEnvelopePlaceholder=送信者のエンベロープメールアドレス
+smtpPortPlaceholder=SMTPポート (デフォルトは 25)
+loginUsernamePlaceholder=ログインユーザー名
+identityBrokeringLink=アイデンティティーブローカーリンク
+importFileHelp=鍵をインポートするファイル
+logo=ロゴ
+eventTypes.INVITE_ORG.description=組織へのユーザーの招待
+eventTypes.INVITE_ORG_ERROR.name=組織へのユーザー招待時のエラー
+error-invalid-value=「{{0}}」は無効な値です。
+loa-condition-level=認証レベル（LoA）
+eventTypes.INVITE_ORG.name=組織へのユーザーの招待
+eventTypes.INVITE_ORG_ERROR.description=組織へのユーザー招待時のエラー
+missingLastNameMessage=「'{{0}}」: 姓を指定してください。
+includeInLightweight.tooltip=軽量アクセストークンにクレームを追加する必要があるか
+termsAndConditionsUserAttribute=利用規約の承諾タイムスタンプ
+supportJwtClaimInIntrospectionResponseHelp=オンの場合、「Accept: application/jwt」ヘッダーを使用するイントロスペクションリクエストには、JWTのアクセストークンとしてエンコードされたイントロスペクションの結果を含む「jwt」という名前のクレームも含まれます。
+chooseBindingType=バインドの種類を選択してください。
+kcNumberFormat=数値のフォーマット
+bruteForceMode.PermanentLockout=永久にロックアウト
+translationTableColumnName=翻訳
+translationsTableHeading=翻訳
+noLanguages=言語はありません
+addTranslationDialogOkBtn=OK
+supportedLanguagesTableColumnName=サポートされている言語
+noLanguagesInstructions=開始するには、レルム設定 > ローカリゼーション > ロケール で言語を追加します。
+smtpFromPlaceholder=送信者のメールアドレス
+replyToDisplayPlaceholder=「返信先」メールアドレスの表示名
+emptyStateText=このレルムにはレルムロールがありません。まずはレルムロールを作成してください。
+emptyExecutors=エグゼキューターが設定されていません
+error-invalid-length-too-long=「{{0}}」は最大の長さが{{2}}でなければなりません。
+error-invalid-uri=「{{0}}」は無効なURLです。
+selectTheme=テーマの選択
+selectLanguage=言語の選択
+error-number-out-of-range-too-small=「{{0}}」の最小値は{{1}}でなければなりません。
+error-number-out-of-range=「{{0}}」は{{1}}から{{2}}までの数字である必要があります。
+realmOverridesHelp=編集できるのはサポートされているロケールのみです。サポートされているロケールをまだ選択していない場合は、英語ロケールのみ編集できます。
+searchForEffectiveMessageBundles=メッセージバンドルの検索
+translationDeleteConfirmDialog=選択した{{count}}件の翻訳を完全に削除してもよいですか？
+missingPasswordMessage=「{{0}}」: パスワードを指定してください。
+resourceFile=リソースファイル
+hardcodedRole=ユーザーがプロバイダーからインポートされるときに、そのユーザーに対するロールマッピングをハードコードします。
+invalidEmailMessage=「{{0}}」: 無効なメールアドレスです。
+error-empty=「{{0}}」の値を指定してください。
+transientUserTooltip=このユーザーはKeycloakのデータベースに保存されません。元のアイデンティティープロバイダーから提供されたデータのみから構築されます。
+loa-max-age.tooltip=この認証レベルが有効となる最大秒数です。特定の認証レベルが要求され、ユーザーが指定秒数より前に既にこのレベルで認証されている場合、再認証は求められません。ただし、指定秒数より後に認証されている場合は、再度このレベルで認証する必要があります。設定値0は、このレベルが要求されるたびに、ユーザーは必ずこのレベルで再認証を求められます。
+cancelBtn=編集ボタンのキャンセル
+itemDeleteConfirm=この項目を完全に削除してもよいですか？
+createItem=項目の作成
+avatarImage=アバター画像
+tokenExpirationHelp=トークンの有効期限を設定します。有効期限が切れたトークンは定期的にデータベースから削除されます。
+fetchRoles=ロールの取得
+bruteForceMode.PermanentAfterTemporaryLockout=一時的なロックアウト後に永久にロックアウト
+authenticatorRefConfig.maxAge.help=SSOセッションにおけるオーセンティケーター参照値の最大有効期間（秒数）。Authentication Method Reference （AMR）プロトコルマッパーを使用する場合、オーセンティケーターの実行が指定された最大有効期間内に完了した場合にのみ、AMRは有効とみなされ、トークンに設定されます。
+smtpFromDisplayPlaceholder=送信者のメールアドレスの表示名
+addTranslationsModalSubTitle=ロケールまたは優先言語に基づいて「{{fieldName}}」を翻訳できます。また、「{{fieldName}}」の翻訳は、<1>レルム設定 > ローカリゼーション > レルムオーバーライド</1>で作成または編集できます。
+resetPasswordConfirmText=ユーザー{{username}}のパスワードをリセットしてもよろしいですか？
+updateTranslationError=翻訳の更新中にエラーが発生しました：{{error}}
+link=リンク
+defaultGroupAddedError=デフォルトグループへのグループの追加中にエラーが発生しました: {error}
+keysFilter.DISABLED=無効な鍵
+roleCreateError=ロールを作成できませんでした: {{error}}
+flow.clients=クライアント認証フロー
+effectiveMessageBundles=効果的なメッセージバンドル
+deleteMessageBundle=メッセージバンドルの{{key}}を削除します
+emptyEffectiveMessageBundlesInstructions=上記の検索ボックスでは、テーマ、機能、言語別に、必要な効果的なメッセージを検索できます。
+authenticatorRefConfig.value.label=オーセンティケーター参照
+referralHelp=LDAPリファラルに従うか無視するかを指定します。リファラルを有効にすると、LDAPサーバーが他のどのLDAPサーバーを使用するか決定するため、認証に時間がかかる可能性があることに注意してください。これには信頼できないサーバーが含まれる可能性があります。
+supportJwtClaimInIntrospectionResponse=イントロスペクションレスポンスでJWTクレームをサポート
+selectBindType=バインドの種類を選択する
+kcNumberUnFormat=数値のフォーマット解除
+sendIdTokenOnLogoutHelp=ログアウトリクエストで「id_token_hint」パラメーターを送信するかどうか。
+addAttributeDisplayDescriptionTranslation=表示説明の翻訳を追加する
+noLanguagesSearchResultsInstructions=上の検索バーをクリックして言語を検索してください
+addTranslationsDialogRowsTable=翻訳ダイアログの行テーブルを追加する
+parRequestUriLifespan=プッシュされた認可リクエストのリクエストURIの有効期間
+searchClientRegistration=ポリシーの検索
+dynamicScopeFormat=動的スコープ形式
+selectAll=すべてを選択
+xRobotsTagHelp=ページが検索エンジンに表示されないようにします。<1>詳細</1>
+clientRegisterPolicyDeleteError=クライアント登録ポリシーを削除できませんでした：{{error}}
+deleteAllTranslationsSuccess=翻訳が正常に削除されました。
+themeType=テーマタイプ
+addTranslation=翻訳の追加
+sendClientIdOnLogout=ログアウトリクエストで「client_id」を送信する
+replyToEmailPlaceholder=メールアドレスに返信
+client-updater-source-roles.label=エンティティーロールの更新
+generatedUserInfoHelp=ユーザー情報エンドポイントによって提供されるユーザー情報の例を参照してください。
+verifyEmailHelpText=最初のログイン後、またはアドレスの変更を送信した後、ユーザーに電子メール アドレスの確認を求めます。
+referrerPolicy=リファラーポリシー
+error-pattern-no-match=「{{0}}」は必要な形式と一致しません。
+error-person-name-invalid-character=「{{0}}」に無効な文字が含まれています。
+updateReadOnlyAttributesRejectedMessage=読み取り専用属性の更新が拒否されました。
+realmOverrides=レルムの上書き
+noRealmOverridesSearchResultsInstructions=上の検索バーをクリックして、レルムの上書きを検索します。
+referral=参照
+customValue=カスタム値
+realmOverridesDescription=レルムのオーバーライドを使用すると、レルム全体に適用される翻訳を指定できます。これらの翻訳は、テーマで指定された翻訳をオーバーライドします。
+itemDelete=項目の削除
+noItems=項目がありません
+noItemsInstructions=このレルムにはまだ項目が作成されていません。開始するには項目を作成してください。
+writableSelection=書き込み可能な選択
+readOnlySelection=読み取り専用の選択
+enableClientSignatureRequiredModal=「クライアントの署名が必要」を有効にする
+jwtX509HeadersEnabledHelp=有効にすると、署名に使用された証明書を参照するために、JWTにx5t（X.509証明書SHA-1サムプリント）ヘッダーが追加されます。有効にしない場合は、代わりにkid（キーID）ヘッダーが使用されます。
+error-invalid-multivalued-size=属性{{0}}には少なくとも{{1}}個、最大{{2}}個の値が必要です。
+idpLinkSuccess=アイデンティティープロバイダーがリンクされました
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=アイデンティティープロバイダーの初回ログインエラー
+associatedPolicy=関連するポリシー
+notBeforeNowClear=クライアントに対して「以前」をクリアしました。
+startBySearchingAUser=ユーザーの検索から始める
+error-invalid-length-too-short=「{{0}}」は最小の長さは{{1}}でなければなりません。
+searchItem=項目の検索
+lightweightAccessTokenHelp=オンの場合、軽量アクセストークンが常に使用されます。オフの場合、デフォルトでは使用されませんが、クライアントポリシーエグゼキューターを使用して有効化することは可能です。
+fetchRolesHelp=デフォルトでは、認可リクエストで送信されたトークンに含まれるロールのみが、ユーザーにロールが付与されているかどうかの確認に使用されます。この設定を有効にすると、ポリシーはトークン内のロールを無視し、代わりにユーザーに関連付けられたロールを確認します。
+ownerHelp=このリソースの所有者。
+parRequestUriLifespanHelp=リクエストURIの有効期間を表す数値。デフォルト値は1分です。
+kerberosRealmHelp=Kerberosレルムの名前。例：FOO.ORG。
+missingUsernameMessage=「{{0}}」: ユーザー名を指定してください。
+error-user-attribute-read-only=フィールド{{0}}は読み取り専用です。
+language=言語
+hasWords=語句を含む
+loa-condition-level.tooltip=認証レベル。この値は常に0以上の整数である必要があります。認証フロー内のサブフローは、常に最下位レベルから上位レベルの順に並べる必要があります。
+selectMapperType=マッパーの種類を選択する
+unsyncedSelection=同期されていない選択
+resourceDetailsTypeHelp=このリソースのタイプ。同じタイプの異なるリソースインスタンスをグループ化するために使用できます。
+addAttributeTranslation=「{{fieldName}}」フィールドの翻訳を追加する
+translationKey=キー
+sendIdTokenOnLogout=ログアウトリクエストで「id_token_hint」を送信する
+deleteAllTranslationsError=翻訳の削除中にエラーが発生しました: {{error}}
+multivaluedHelp=この属性がマルチバリューをサポートする場合に設定します。この設定はインジケーターであり、検証を有効にするものではありません。
+resetAction=リセットアクション
+dynamicScopeFormatHelp=これは、システムがスコープ名と変数を抽出するために使用する正規表現です。
+removeAnnotationText=アノテーションの削除
+updatePermissionSuccess=パーミッションの更新に成功しました
+transientUser=一時的
+error-invalid-date=「{{0}}」は無効な日付です。
+error-invalid-length=「{{0}}」の長さは{{1}}から{{2}}まででなければなりません。
+error-invalid-number=「{{0}}」は無効な数値です。
+loa-max-age=最大時間
+effectiveMessageBundlesDescription=効果的なメッセージバンドルとは、特定の言語、テーマ、テーマタイプに対応する翻訳のセットです。また、レルムのオーバーライドも考慮されます（オーバーライドが優先されます）。
+itemDeleteError=項目を削除できませんでした: {{error}}
+selectClientAssertionSigningAlg=クライアントアサーション署名アルゴリズムを選択する
+searchClientAuthorizationPermission=パーミッションを検索する
+userNotSaved=ユーザーは保存されていません: {{error}}
+addAttributeTranslationBtn=翻訳ボタンの追加
+addAttributeTranslationInfo=「{{fieldName}}」フィールドの横にあるアイコンを使用して、このフィールドの翻訳を追加します。
+addTranslationsModalTitle=翻訳を追加する
+searchForLanguage=言語を検索する
+theme=テーマ
+itemSaveSuccessful=保存に成功しました。
+editTranslationValue=翻訳値を編集する
+selectRequestObjectRequired=必要なリクエストオブジェクトの選択
+selectAuthorizationEncryptedResponseAlg=認可暗号化レスポンスアルゴリズムの選択
+selectAuthorizationEncryptedResponseEnc=認可暗号化レスポンスエンコーディングの選択
+selectUserInfoSignedResponseAlgorithm=ユーザー情報署名レスポンスアルゴリズムを選択する
+generatedCodeTextArea=生成されたコードテキストエリア
+selectEmailTheme=メールテーマの選択
+selectEvictionMinute=キャッシュ追い出し時刻（分）の選択
+organizationAliasHelp=エイリアスは、主に組織内部で参照することを目的とした形式を用いて、組織を一意に識別します。例えば、組織関連のクレームをトークンに含める場合や、カスタムテーマ内で使用する場合などです。
+organizationUsersLeftError=組織からユーザーを削除できませんでした: {{error}}
+organizationUsersLeft_one=ユーザーが組織から脱退しました
+noIdentityProvider=このレルムにはアイデンティティープロバイダーがありません
+adminPermissionsEnabled=管理者パーミッション
+verifiableCredentialsEnabled=検証可能なクレデンシャル
+adminPermissionsEnabledHelp=有効にすると、レルム内の管理者パーミッションを管理できるようになります。
+selectAuthorizationSignedResponseAlgorithm=認可署名付きレスポンスアルゴリズムの選択
+emptyOrganizations=組織がありません
+memberList=メンバー一覧
+removeMember=メンバーの削除
+disableConfirmOrganization=この組織を無効にしてもよいですか？
+unLinkIdentityProvider=プロバイダーのリンクの解除
+organizationDomainHelp=組織に関連付けられた1つ以上のインターネットドメインのセット。ドメインは、ユーザーのメールドメインに基づいてユーザーを組織にマッピングし、組織の範囲内でユーザーを認証するために使用されます。
+linkIdentityProvider=アイデンティティープロバイダーのリンク
+itemSaveError=エラーのため項目を保存できませんでした：{{error}}
+authenticatorRefConfig.value.help=オーセンティケーターのカスタム参照名を追加します。認証フロー中にこのオーセンティケーターが正常に完了すると、Authentication Method Reference（AMR）プロトコルマッパーはこの値を使用して、生成されたトークンのamrクレームに値を設定します。amrクレームに値を設定するには、指定されたクライアントにAMRプロトコルが設定されている必要があります。
+organizationRedirectUrlHelp=登録完了後、または組織への招待を承諾した後に、ユーザーを自動的にリダイレクトします。空欄のままにした場合、ユーザーはデフォルトでアカウントコンソールにリダイレクトされます。
+caseSensitiveOriginalUsernameHelp=有効にすると、ユーザーを連携する際に、アイデンティティープロバイダーから取得した元のユーザー名がそのまま保持されます。無効にすると、アイデンティティープロバイダーから取得したユーザー名は小文字に変換されるため、大文字と小文字が区別される元のユーザー名と一致しない可能性があります。この設定は、サーバー上のユーザー名は常に小文字であるため、連携されたアイデンティティーに関連付けられたユーザー名にのみ影響します。
+organizationSaveError=組織を保存できませんでした: {{error}}
+noIdentityProviderInstructions=このレルムにはまだアイデンティティープロバイダーがありません。この組織にアイデンティティープロバイダーをリンクしたい場合は、左側のナビゲーションバーの「アイデンティティープロバイダー」のセクションに移動してアイデンティティープロバイダーを作成してください。
+selectEvictionHour=キャッシュ追い出し時刻（時間）の選択
+emptyIdentityProviderLink=この組織のアイデンティティープロバイダーがありません
+organizationDetails=組織の詳細
+realmSelector=レルムセレクター
+selectIdTokenEncryptionKeyManagementAlgorithm=IDトークン暗号化鍵管理アルゴリズムを選択する
+inviteSentError=招待状を送信できませんでした: {{error}}
+selectEditMode=編集モードの選択
+organizationUsersAdded_other={{count}}人のユーザーが組織に追加されました
+inviteSent=招待状が送信されました。
+selectIdTokenEncryptionContentEncryptionAlgorithm=IDトークン暗号化コンテンツ暗号化アルゴリズムを選択する
+selectRequestObjectEncryption=リクエストオブジェクトの暗号化の選択
+selectAuthScopes=認可スコープの選択
+selectUnmanagedAttributePolicy=管理されていない属性ポリシーの選択
+selectEvictionDay=キャッシュ追い出し日の選択
+verifiableCredentialsEnabledHelp=有効にすると、このレルムで検証可能なクレデンシャルを管理できるようになります。
+organizationsExplain=組織とメンバーを管理します。
+organizationsEnabledHelp=有効にすると、組織の管理が可能になります。無効にすると、既存の組織は維持されますが、管理やメンバーの認証はできなくなります。
+selectUserInfoResponseEncryptionContentEncryptionAlgorithm=ユーザー情報レスポンス暗号化コンテンツ暗号化アルゴリズムを選択する
+selectUserInfoResponseEncryptionKeyManagementAlgorithm=ユーザー情報レスポンス暗号化鍵管理アルゴリズムを選択する
+selectRequestObjectEncoding=リクエストオブジェクトのエンコーディングの選択
+organizationUsersLeft_other={{count}}件のユーザーが組織から脱退しました
+emptyMembers=メンバーがいません
+disableConfirmOrganizationTitle=組織を無効にしますか？
+addRealmUser=レルムユーザーの追加
+selectRequestObjectSignatureAlgorithm=リクエストオブジェクトの署名アルゴリズムを選択する
+selectAccessTokenSignatureAlgorithm=アクセストークンの署名アルゴリズムを選択する
+orgainzatinoDeleteError=クライアントを削除できません: {{error}}
+redirectUrl=リダイレクトURL
+organizationDelete=組織を削除しますか？
+caseSensitiveOriginalUsername=大文字と小文字を区別するユーザー名
+emptyOrganizationsInstructions=まだ組織がありません。組織を作成して管理してください。
+searchOrganization=組織の検索
+organizationDeleteConfirm=この組織を完全に削除してもよいですか？削除すると、この組織のすべてのデータが削除されます。
+organizationDeletedSuccess=組織は削除されました。
+emptyMembersInstructions=まだメンバーがいません。この組織にメンバーを追加してください
+organizationUsersAdded_one={{count}}件のユーザーが組織に追加されました
+organizationUsersAddedError=組織にユーザーを追加できませんでした: {{error}}
+send=送信
+organizationRemoveError=組織からユーザーを削除できませんでした: {{error}}
+eventTypes.UPDATE_CREDENTIAL.name=クレデンシャルの更新
+adminPermissionName=パーミッション名
+noAssignedPoliciesInstructions=このパーミッションには割り当てられたポリシーがありません。
+emptyAssignExistingPolicies=既存のポリシーはありません
+redirectWhenEmailMatches=メールドメインが一致したらリダイレクトする
+userAddedOrganization_other={{count}}個の組織がユーザーに追加されました
+duplicateGroupWarning=多数のサブグループを持つグループの複製はサポートされていません。複製するグループに多数のサブグループが含まれていないことを確認してください。
+removeInvalidUsers=検索中に無効なユーザーを削除する
+couldNotFetchClientRoleMappings=クライアントロールのマッピングを取得できませんでした: {{error}}
+enforceAccessToHelpText=パーミッションが適用されるリソースを指定します。
+viewAll=すべて表示
+titlePermissions=パーミッション
+emptyPermissionsInstructions=このレルムにはパーミッションが存在しません。
+permissionsName=パーミッション名
+createPermissionOfType=このパーミッションは{{resourceType}}に適用されます。
+resourceScopeHelpText=リソースのスコープを指定します。これは、パーミッションが付与されるリソースの種類を決定するために使用されます。
+allClients=すべてのクライアント
+assignedPolicies=割り当てられたポリシー
+assignExistingPolicies=既存のポリシーの割り当て
+policy=ポリシー
+policyTypeHelpText=ポリシーの種類を指定します。これは、パーミッションが付与されるポリシーの種類を決定するために使用されます。
+authorizationScopeDetailsTitle=認可スコープの詳細
+authorizationScopeDetailsDescription=説明
+allResources=すべてのリソース
+userAddedOrganization_one=ユーザーに組織が追加されました。
+eventTypes.UPDATE_CREDENTIAL_ERROR.description=クレデンシャルの更新エラー
+linkUpdatedSuccessful=アイデンティティープロバイダーのリンクが正常に更新されました
+idpAccountEmailVerificationHelp=IdPアカウントのメール検証の独立したタイムアウト
+executeActionsHelp=アクション実行の独立したタイムアウト
+eventTypes.REMOVE_CREDENTIAL.name=クレデンシャルの削除
+groupDuplicated=グループが複製されました
+duplicateAGroup=グループの複製
+permissionUsersHelpText=このパーミッションによって許可されるユーザーを指定します。
+requiredPolicies=最低1つのポリシーを追加してください。
+permissionNameHelpText=パーミッションの名前。この名前は管理コンソールでパーミッションを識別するために使用されます。
+noAssignedPolicies=割り当てられたポリシーはありません。
+assignedPolicyType.allTypes=すべてのタイプ
+unlinkError=組織からアイデンティティープロバイダーのリンクを解除できませんでした: {{error}}
+eventTypes.REMOVE_CREDENTIAL.description=クレデンシャルの削除
+eventTypes.REMOVE_CREDENTIAL_ERROR.name=クレデンシャルの削除エラー
+eventTypes.REMOVE_CREDENTIAL_ERROR.description=クレデンシャルの削除エラー
+darkModeEnabledHelp=有効にすると、オペレーティングシステムの設定（ライトモードまたはダークモード）またはユーザーエージェントの設定に基づいて、テーマのダークバージョンが適用されます。無効にすると、ライトバージョンのみが使用されます。この設定は、ダークバージョンとライトバージョンの両方をサポートするテーマにのみ適用されます。テーマがこの機能をサポートしていない場合、この設定は効果がありません。
+noGroupMembershipsText=このユーザーはどのグループにも属していません。
+noGroupMemberships=メンバーシップがありません
+somethingWentWrongDescription=残念ながら、予期しないエラーが発生しました。
+specificClients=特定のクライアント
+specificResourceType=特定の{{resourceType}}
+emptyAssignExistingPoliciesInstructions=割り当てる既存のポリシーはありません。
+authorizationScope=認可スコープ
+recentlyUsed=最近使用された
+currentRealm=現在のレルム
+currentRealmExplain=このレルムが選択されています。
+forgotPasswordHelp=パスワードを忘れた場合の独立したタイムアウト
+removeConfirmOrganizationTitle=組織を削除しますか？
+disableConfirmUser=このユーザーを無効にしてもよいですか？
+somethingWentWrong=何らかの問題が発生しました
+policyType=ポリシータイプ
+enforceAccessTo=アクセスを強制する
+authorizationScopeDetailsSubtitle=認可スコープは、リソースに対して実行できるアクションを定義します。
+showMemberships=メンバーシップの表示
+childGroupEvents=子グループイベント
+emptyUserOrganizationsInstructions=まだ組織がありません。組織に参加するか、組織への招待を送信してください。
+joinOrganization=組織への参加
+tryAgain=再試行してください
+eventTypes.UPDATE_CREDENTIAL_ERROR.name=クレデンシャルの更新エラー
+createNewPolicy=新しいポリシーの作成
+linkUpdateError=アイデンティティープロバイダーのリンクを更新できませんでした: {{error}}
+linkedOrganization=リンクされた組織
+organization=組織
+redirectWhenEmailMatchesHelp=メールドメインがドメインと一致する場合、ユーザーをこのアイデンティティープロバイダーに自動的にリダイレクトします。
+emailVerificationHelp=メール検証の独立したタイムアウト
+sendInvitation=招待状の送信
+sendInvite=招待状の送信
+organizationRemoveConfirm_one=選択した組織からユーザーを削除してもよいですか？
+termsAndConditionsDeclined=続行するには利用規約に同意する必要があります
+signatureAlgorithmIdentityProviderMetadata=署名アルゴリズムSAML IdPメタデータ
+connectionTrace=接続トレース
+signatureAlgorithmIdentityProviderMetadataHelp=SAMLアイデンティティープロバイダーのメタデータに使用する署名アルゴリズム。署名アルゴリズムがない場合、メタデータは署名されません。
+resourceScope=リソーススコープ
+allResourceType=すべての{{resourceType}}
+membershipEvents=メンバーシップイベント
+unAssignPolicy=割り当て解除
+authorizationScopeDetailsName=名前
+assignedPolicyType.user=ユーザー
+connectionTraceHelp=有効にすると、受信および送信のLDAP ASN.1 BERパケットがエラー出力ストリームにダンプされます。このオプションを本番環境で有効にする場合は、LDAPサーバーとの間で送受信されるすべてのデータが公開されるため、注意してください。
+organizationName=組織名
+userAddedOrganizationError=ユーザーに組織を追加できませんでした: {{error}}
+showMembershipsTitle={{username}}グループメンバーシップ
+createPermissionPolicy=ポリシーを作成する
+emptyPermissionPoliciesInstructions=このレルムにはポリシーは存在しません。
+noPermissionSearchResultsInstructions=フィルターに一致するパーミッションはありませんでした。
+organizationRemovedSuccess=ユーザーが組織から削除されました
+noResultsFound=結果が見つかりません
+permissionsSubTitle=パーミッションは、1つのリソースまたは1種類の複数のリソースへのアクセスを制御します。
+organizationRemoveConfirm_other={{count}}件の選択した組織からユーザーを削除してもよいですか？
+targetAudience=対象のオーディエンス
+grantedScope=付与されるスコープは次の通りです。
+forbiddenAdminConsole=パーミッションがありません。管理者にお問い合わせください。
+authenticationType=認証タイプ
+authenticationTypeBasicAuth=パスワード
+authenticationTypeTokenAuth=トークン
+authTokenScope=認証トークンスコープ
+authTokenClientSecret=認証トークンクライアントシークレット
+addSubFlowTo={{name}}にサブフローを追加する
+selectUsers=ユーザーの選択
+permissionsAssignedPolicy=割り当てられたポリシー
+authTokenClientId=認証トークンクライアントID
+signatureMaxExp=最大有効期限
+resourceTypeSelectHelp=サーバーからパーミッションを照会するために使用するリソースのタイプを選択します。
+deniedScope=拒否されたスコープは次の通りです。
+authTokenUrl=認証トークンURL
+authTokenScopeHelp=スコープはスペースで区切られ、トークン収集時にscopeパラメーターとして使用されます（例：「basic sendmail」）
+authTokenClientIdHelp=トークン収集中に使用されるclient_id（例: mykeycloak-sendmail-client）
+chooseAResourceType=リソースの種類を選択してください
+tokenTokenUrlHelp=トークンを収集するためのトークンエンドポイント: Keycloakの例: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+enableDebugSMTP=SMTPのデバッグの有効化
+authScopeSelectHelp=サーバーからパーミッションを照会するために使用する認可スコープを選択します。
+permissionEvaluationAlertTitle=選択されたユーザーには選択されたリソースへのアクセス権がありません
+uploadGeneratedThemeJar=生成されたテーマのJARファイルのアップロード
+signatureMaxExpHelp=JWTの最大有効期限。トークンは認証直前に生成する必要があります。この期間を過ぎると、古すぎるため無効とみなされます。未定義の場合、デフォルト値は60秒です。
+groupsResources=グループ
+resourceTypeHelpText=このパーミッションで許可する{{resourceType}}指定します。空白のままにすると、すべて選択したのと同じになります。
+evaluation=評価
+addExecutionTo={{name}}にエグゼキューションを追加する
+selectRole=ロールの選択
+evaluatedPolicy={{name}}が{{status}}に投票しました
+addConditionTo={{name}}への条件の追加
+deleteConfirmUsers_other={{count}}件のユーザーを削除しますか？
+deleteConfirmUsers_one=ユーザー{{name}}を削除しますか？
+themeColorInfo=ここで、PatternFlyのカラー変数を設定し、「テーマ jar」ファイルを作成できます。このファイルをダウンロードしてprovidersフォルダーに配置し、テーマをレルムに適用できます。
+UNMANAGED=管理されていない
+downloadThemeJar=テーマのJARファイルのダウンロード
+syncUsersStarted=ユーザーの同期が開始されました。
+deleteConfirmRealm_one=レルム{{name}}を削除しますか？
+deleteConfirmRealm_other={{count}}個のレルムを削除しますか？
+recentRealms=最近使用されたレルム
+manageRealms=レルムの管理
+cantDeleteMasterRealm=マスターレルムを削除することはできません。
+selectClient=クライアントの選択
+grantedPermissions=許可されたパーミッション
+fileNameDialogTitle=次のものとして保存
+fileName=ファイル名
+deniedPermissions=拒否されたパーミッション
+targetAudiencePlaceHolder=トークン交換の対象となるオーディエンスを選択します。
+authorizationScope.Groups.view-members=グループメンバーの表示
+chooseAResourceTypeInstructions=パーミッションを作成するリソースの種類を選択します。
+resourceType.Clients=このレルム内のクライアントに対して実行できる操作へのアクセスを制御します。
+resourceType.Organizations=このレルム内の組織に対して実行できる操作へのアクセスを制御します。
+resourceType.Roles=このレルムのロールに対して実行できる操作へのアクセスを制御します。
+resourceType.Users=このレルムのユーザーに対して実行できる操作へのアクセスを制御します。
+removeInvalidUsersHelp=検索実行時にユーザーストレージからユーザーを利用できない場合、ローカルデータベースからユーザーを削除します。これがtrueの場合、対応するユーザーストレージから利用できなくなったユーザーは、ユーザー検索時にローカルデータベースから削除されます。falseの場合、以前ユーザーストレージからインポートされたユーザーは、そのユーザーがユーザーストレージから利用できなくなっても、読み取り専用かつ無効化された状態でローカルデータベースに保持されます。例えば、ユーザーがLDAPから直接削除された場合や、「ユーザーDN」が無効である場合などです。この動作は、ユーザーがまだキャッシュされていない場合にのみ発生することに注意してください。
+targetAudienceHelp=対象のオーディエンスを設定します。これは、トークンエンドポイントの付与リクエストで「audience」パラメーターを使用する場合と同じです。「audience」パラメーターは、現時点ではトークン交換グラントでのみ使用できます。他のグラントをシミュレートする場合、または「audience」パラメーターなしでトークン交換グラントをシミュレートする場合は、このパラメータをー空のままにしておくことをお勧めします。
+authorizationScope.Roles.map-role-client-scope=このロールをクライアントのクライアントスコープに適用します。
+authorizationScope.Roles.map-role=このロールをユーザーまたはグループにマッピングします。
+authorizationScope.Roles.map-role-composite=このロールを複合ロールとして別のロールに適用します。
+usersResources=ユーザー
+clientsResources=クライアント
+resourceType.IdentityProviders=このレルム内のアイデンティティープロバイダーに対して実行できる操作へのアクセスを制御します。
+authorizationScope.Groups.view=このグループの表示
+permissionsEvaluationInstructions=特定のリソースに対するアクセス権があるかどうかを確認するには、ユーザーを選択してください。下の「評価」ボタンをクリックすると、右側のパネルに結果が表示されます。
+permissionEvaluationPreview=パーミッション評価のプレビュー
+noPermissionsEvaluationResults=評価がありません
+noPermissionsEvaluationResultsInstructions=左側でパーミッション評価を設定してください
+authScope=認可スコープ
+authorizationScope.IdentityProviders.token-exchange=クライアントがこのアイデンティティープロバイダーによって発行されたトークンとトークンを交換できるようにします。
+resourceType.Groups=このレルム内のグループに対して実行できる操作へのアクセスを制御します。
+authorizationScope.Groups.manage=このグループの管理
+authorizationScope.Clients.configure=クライアントの基本的な管理を実行します。
+authorizationScope.Clients.manage=クライアントの完全な管理
+authorizationScope.Clients.map-roles=このクライアントによって定義されたロールをユーザーやグループなどのリソースにマップします。
+authorizationScope.Clients.map-roles-client-scope=このクライアントによって定義されたロールを別のクライアントのクライアントスコープに適用します。
+authorizationScope.Clients.map-roles-composite=このクライアントによって定義されたロールを複合ロールとして別のロールに適用します。
+authorizationScope.Clients.token-exchange=このクライアントをターゲットとしたトークンをどのクライアントが交換できるかを制御します。
+deleteAdminPermissionConfirm=パーミッション{{ permission }}を削除すると、管理者はそのパーミッションによって定義されたリソースに対してアクションを実行できなくなります。
+authorizationScope.Clients.view=このクライアントの表示
+authorizationScope.Users.impersonate=他のユーザーへのなりすまし
+authorizationScope.Users.manage=レルム内のすべてのユーザーを管理します。
+authorizationScope.Users.manage-group-membership=レルム内のすべてのユーザーのグループメンバーシップを管理します（グループポリシーと組み合わせて使用）。
+authorizationScope.Users.map-roles=すべてのユーザーに対するロールのマップ
+authorizationScope.Users.view=レルム内のすべてのユーザーの表示
+authorizationScope.Groups.manage-members=グループメンバーの管理
+authorizationScope.Groups.manage-membership=グループメンバーの追加または削除
+shownOnLoginPage=ログインページに表示されます
+linkSuccessful=アイデンティティープロバイダーが組織に正常にリンクされました
+errorSavingTranslations=翻訳の保存中にエラーが発生しました: {{error}}
+searchProvider=プロバイダーの検索
+crlCache=CRLキャッシュ
+userVerify.discouraged=非推奨
+selectIdentityProvider=アイデンティティープロバイダーを選択してください
+expandRow=行の展開
+addOrganizationId.label=組織IDの追加
+temporaryService=一時的な管理者サービスアカウント。できるだけ早く、永続的な管理者サービスアカウントに置き換えてください。
+addOrganizationAttributes.label=組織属性の追加
+managedMembership=管理されたメンバーシップ
+clearUserCacheHelp=これにより、すべてのレルムのエントリーがクリアされます。
+temporaryAdmin=一時的な管理者ユーザーアカウント。できるだけ早く、永続的な管理者ユーザーアカウントに置き換えてください。
+userInvitedOrganization_one=ユーザーに招待状を送信しました
+sentInvitation=招待状の送信
+emptyIdentityProviderLinkInstructions=この組織にはまだアイデンティティープロバイダーがありません。この組織にアイデンティティープロバイダーをリンクしてください。
+disableConfirmUserTitle=ユーザーを無効にしますか？
+clearRealmCacheHelp=これにより、すべてのレルムのエントリーがクリアされます。
+clearKeysCacheHelp=外部公開鍵のキャッシュからすべてのエントリーをクリアします。これらは外部クライアントまたはアイデンティティープロバイダーの鍵です。これにより、すべてのレルムのすべてのエントリーがクリアされます。
+addOrganizationAttributes.help=有効にすると、トークンにマップされた各組織で組織属性が使用できるようになります。
+eventTypes.AUTHREQID_TO_TOKEN.description=認可リクエストIDとトークンの交換
+passSubject=サブジェクトの受け渡し
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=認可リクエストIDとトークンの交換
+addOrganizationId.help=有効にすると、トークンにマップされた組織ごとに組織IDが使用できるようになります。
+identityProviderUnlink=アイデンティティープロバイダーのリンクを解除しますか？
+shownOnLoginPageHelp=チェックすると、このアイデンティティープロバイダーがログイン ページに表示されます。
+linkError=アイデンティティープロバイダーを組織にリンクできませんでした: {{error}}
+membershipType=メンバーシップタイプ
+clearCacheSuccess=キャッシュが正常にクリアされました
+MANAGED=管理されている
+clearCrlCacheHelp=CRLキャッシュからすべてのエントリーをクリアします。CRLキャッシュは、証明書失効リスト（CRL）が有効な場合にX.509オーセンティケーターの性能を向上させます。このアクションは、すべてのレルムのCRLエントリーをすべてクリアします。
+clearCacheError=キャッシュをクリアできませんでした: {{error}}
+eventTypes.AUTHREQID_TO_TOKEN.name=認可リクエストIDとトークンの交換
+selectIdTokenSignatureAlgorithm=IDトークン署名アルゴリズムを選択する
+userInvitedOrganization_other=ユーザーへの{{count}}件の招待状が送信されました。
+userInvitedOrganizationError=ユーザーを組織に招待できませんでした: {{error}}
+unLinkSuccessful=アイデンティティープロバイダーのリンクが解除されました
+filterByMembershipType=メンバーシップタイプでのフィルタリング
+organizationsMembersListError=組織のメンバーを取得できませんでした: {{error}}
+identityProviderUnlinkConfirm=このアイデンティティープロバイダーのリンクを解除してもよろしいですか？
+editGroup=グループを編集する
+deprecated=非推奨
+webAuthnPolicyPasskeysEnabled=パスキーの有効化
+webAuthnPolicyPasskeysEnabledHelp=ユーザー名画面でパスキー（条件付きUI）認証を有効にします。
+givenNameClaim=名クレーム
+familyNameClaim=姓クレーム
+oAuthSettings=OAuth 2の設定
+addOAuth2Provider=OAuth v2プロバイダーの追加
+userIDClaim=IDクレーム
+givenNameClaimHelp=ユーザープロファイルエンドポイントから返されるJSONドキュメントに含まれる、ユーザーの名を表すクレーム名。省略時のデフォルトは「given_name」です。
+userNameClaim=ユーザー名クレーム
+fullNameClaimHelp=ユーザープロファイルエンドポイントから返されるJSONドキュメントに含まれる、ユーザーのフルネームを表すクレーム名。省略時のデフォルトは「name」です。
+familyNameClaimHelp=ユーザープロファイルエンドポイントから返されるJSONドキュメントに含まれる、ユーザーの姓を表すクレーム名。省略時のデフォルトは「family_name」です。
+userProfileClaims=ユーザープロファイルクレーム
+cpu=CPU
+processorCount=プロセッサー数
+invalidLocale=無効なロケールが選択されました。
+userIDClaimHelp=ユーザープロファイルエンドポイントが返すJSONドキュメントに含まれる、ユーザーの一意な識別子を表すクレームの名前。省略時のデフォルトは「sub」です。
+fullNameClaim=名前クレーム
+userNameClaimHelp=ユーザープロファイルエンドポイントが返すJSONドキュメントに含まれる、ユーザー名を表すクレームの名前。省略時のデフォルトは「preferred_username」です。
+emailClaim=Eメールクレーム
+emailClaimHelp=ユーザープロファイルエンドポイントが返すJSONドキュメントに含まれる、ユーザーのメールアドレスを表すクレームの名前。省略時のデフォルトは「email」です。
+validity=証明書の有効期限
+validityHelp=生成された証明書の有効期間（年数）。
+tokenIntrospectionUrl=トークンイントロスペクションURL
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ka.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ka.properties
index 52c7149bace8..7e3330c28747 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ka.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ka.properties
@@ -41,9 +41,9 @@ active=აქტიური
 profile=პროფილი
 executorName=სახელი
 credentials=ავტორიზაციის დეტალები
-mapperTypeLdapAttributeMapper=ჩაშენებული-ldap-ის-ატრიბუტის-ამსახველი
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
 selectMethodType.import=შემოტანა
-mapperTypeHardcodedLdapGroupMapper=ჩაშენებული-ldap-ის-ჯგუფის-ამსახველი
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
 added=დამატებულია
 test=შემოწმება
 valueLabel=მნიშვნელობა
@@ -70,7 +70,7 @@ username=მომხმარებლის სახელი
 eventTypes.IMPERSONATE.name=განსახიერება
 claims=მოთხოვნები
 representation=რეპრეზენტაცია
-cibaBackhannelTokenDeliveryModes.poll=პოლი
+cibaBackhannelTokenDeliveryModes.poll=გამოკითხვა
 eventTypes.IMPERSONATE.description=განსახიერება
 refresh=განახლება
 continue=გაგრძელება
@@ -321,7 +321,6 @@ target=სამიზნე
 browse=პოვნა
 mappers=ამსახველები
 user=მომხმარებელი
-xXSSProtection=X-XSS-Protection
 Thursday=ხუთშაბათი
 annotations=ანოტაციები
 ms=მილიწამი
@@ -361,7 +360,7 @@ refreshTokens=კოდების განახლება
 trusted-hosts.label=სანდო ჰოსტები
 searchAttributes=ძებნის ატრიბუტები
 userID=მომხმარებლის ID
-deleteConfirm_other=მართლა გნებავთ ამ ჯგუფების წაშლა.
+deleteConfirm_other=მართლა გნებავთ ამ ჯგუფების წაშლა?
 deletedSuccess=მომწოდებელი წარმატებით წაიშალა.
 anyResource=ნებისმიერი რესურსი
 importAdded_zero=ჩანაწერები არ დამატებულა.
@@ -372,7 +371,6 @@ eventTypes.PERMISSION_TOKEN.name=წვდომის კოდი
 permissionsDisable=გავთიშო წვდომები?
 eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=ფედერაციული იდენტიფიკატორის ბმულის შეცდომა
 secretHasExpired=საიდუმლოს ვადა ამოიწურა. დააგენერირეთ ახალი, ზემორე ღილაკით 'თავიდან გენერაცია'
-requiredRoles=დაამატეთ ერთი როლი მაინც.
 flowName=დინების სახელი
 addLdapWizardTitle=LDAP მომხმარებლის ფედერაციის მომწოდებლის დამატება
 wantAssertionsSignedHelp=მიუთითებს, მოელის თუ არა ეს სერვისის მომწოდებელი ხელმოწერილ დამტკიცებას.
@@ -480,12 +478,11 @@ attributeName=ატრიბუტი [სახელი]
 idpType.social=სოციალური ქსელით შესვლა
 showRemaining=${remaining}-ის ჩვენება
 searchProfile=პროფილის ძებნა
-renameGroup=ჯგუფის სახელის გადარქმევა
 searchForSession=სესიის ძებნა
 kerberosIntegration=Kerberos-თან ინტეგრაცია
 dedicatedScopes=გამოყოფილი შუალედები
 otpPolicyCodeReusable=თავიდან გამოყენებადი კოდი
-authenticationCreateFlowHelp=დინების შექმნა
+authenticationCreateFlowHelp=დინების შექმნა.
 sslType.all=ყველა მოთხოვნა
 required=აუცილებელი ველი
 lastUpdated=ბოლო განახლება
@@ -629,3 +626,724 @@ passMaxAge=პაროლის მაქს. _ასაკი
 removeImported=შემოტანილების წაშლა
 validatorType=ვალიდატორის ტიპი
 organization=ორგანიზაცია
+createRole=როლის შექმნა
+archiveFormat=არქივის ფორმატი
+keysList=გასაღებების სია
+clearButtonTitle=გასუფთავება
+clientScope=კლიენტის შუალედი
+inheritedFrom=მემკვირდრეობით ვისგან
+pkceMethod=PKCE მეთოდი
+titlePermissions=წვდომები
+unAssignPolicy=მინიჭების გაუქმება
+authorizationScopeDetailsName=სახელი
+bruteForceStrategy.MULTIPLE=ერთზე მეტი
+policy=პოლიტიკა
+testConnection=კავშირის შემოწმება
+defaultLocale=ნაგულისხმევი ენა
+authorizationScopeDetailsDescription=აღწერა
+assignedPolicyType.user=მომხმარებელი
+MANAGED=მართულია
+UNMANAGED=უმართავია
+bruteForceStrategy.LINEAR=წრფივი
+deleteClientProfileConfirmTitle=წავშალო პროფილი?
+clientRegistration=კლიენტის რეგისტრაცია
+error-invalid-multivalued-size=ატრიბუტს {{0}} უნდა ჰქონდეს მინიმუმ {{1}} და მაქსიმუმt {{2}} მნიშვნელობა.
+authenticatorAttachment.not\ specified=მითითებული არაა
+realmRoles=რეალმის როლები
+deleteCredentialsConfirmTitle=წავშალო ავტორიზაციის დეტალები?
+searchKey=ძების გასაღები
+lastRegistration=ბოლო რეგისტრაცია
+titleRoles=რეალმის როლები
+usedBy=გამოიყენება ვის მიერ
+includeAuthnStatement=AuthnStatement-ის ჩამა
+clientScopesCondition=მოსალოდნელი დიაპაზონები
+addMember=წევრის დამატება
+moveTo=გადატანა სად
+subject=სუბიექტის DN
+validTo=მოქმედია თარიღამდე
+eventTypes.UPDATE_PASSWORD.description=პაროლის განახლება
+policiesConfigTypes.jsonEditor=JSON-ის რედაქტორი
+deniedScopes=აკრძალული დიაპაზონები
+userAttribute=მომხმარებლის ატრიბუტი
+emailTheme=ელფოსტის თემა
+removeConfirmTitle_other=წავშალო ჯგუფები?
+requireSsl=SSL-ის მოთხოვნა
+moveHere=აქ გადმოტანა
+principalAttribute=პრინციპალის ატრიბუტი
+eventTypes.REFRESH_TOKEN.name=ტოკენის განახლება
+bindType=მიბმის ტიპი
+evaluation=შეფასება
+groupsResources=ჯგუფები
+noKeys=გასაღებების გარეშე
+clientsResources=კლიენტები
+usersResources=მომხმარებლები
+eventTypes.INTROSPECT_TOKEN.name=ტოკენის ინტროსპექცია
+consentRequired=თანხმობა აუცილებელია
+capabilityConfig=შესაძლებლობის მორგება
+redirectURI=გადამისამართების URI
+publicKeys=საჯარო გასაღებები
+eventTypes.REVOKE_GRANT.name=მინიჭების გაუქმება
+encryptAssertions=დამტკიცებების დაშიფვრა
+bindFlow=მიბმის დინება
+requiredFor=აუცილებელია რისთვის
+keystorePassword=გასაღებების საცავის პაროლი
+usedMemory=გამოყენებული მეხსიერება
+inputTypeRows=შეყვანის მწკრივები
+generalSettings=ზოგადი პარამეტრები
+overallResults=საბოლოო შედეგები
+realmId=რეალმის ID
+discoveryEndpoint=აღმოჩენის ბოლოწერტილი
+managePriorities=პრიორიტეტების მართვა
+cachePolicy=კეშის პოლიტიკა
+permissionDetails=წვდომის დეტალები
+roleID=როლის ID
+regexPattern=რეგგამოსის ნიმუში
+temporaryLocked=დროებით დაბლოკილია
+eventTypes.REFRESH_TOKEN.description=ტოკენის განახლება
+profilesConfigTypes.jsonEditor=JSON-ის რედაქტორი
+userManagedAccess=მომხმარებლის მიერ მართული წვდომა
+authnContextClassRefs=AuthnContext ClassRefs
+eventTypes.REVOKE_GRANT.description=მინიჭების გაუქმება
+userInfo=მომხმარებლის ინფორმაცია
+eventConfigs=მოვლენის კონფიგურაციები
+hideMetaData=მეტამონაცემების დამალვა
+synchronizationSettings=სინქრონიზაციის მოვლენა
+authenticatorAttachment.cross-platform=პლატფორმათაშორისი
+lastAccess=ბოლო წვდომა
+x509Certificate=X509 სერტიფიკატი
+registrationAllowed=მომხმარებლის რეგისტრაცია
+anyScope=ნებისმიერი დიაპაზონი
+addPolicy=პოლიტიკის დამატება
+executorsTable=შემსრულებლების ცხრილი
+disableProvider=გავთიშო პროვაიდერი?
+logoutUrl=გასვლის ბმული
+federationLink=ფედერაციის ბმული
+helpEnabled=დახმარება ჩართულია
+searchType.attribute=ატრიბუტის ძებნა
+resourceDetails=რესურსის დეტალები
+otpType=OTP-ის ტიპი
+grantedScopes=ნებადართული დიაპაზონები
+clientScopeSearch.type=მინიჭებული ტიპი
+resourceType=რესურსის ტიპი
+showDataBtn=მონაცემების ჩვენება
+editMode=ჩასწორების რეჟიმი
+disabledOff=გათიშულია
+roleList=როლების სია
+tableView=ცხრილის ხედი
+trustEmail=სანდო ელფოსტა
+addExecutor=გამშვების დამატება
+manageAccount=ანგარიშის მართვა
+resourcePath=რესურსის ბილიკი
+eventTypes.UPDATE_PROFILE.name=პროფილის განახლება
+verifyEmail=ელფოსტის გადამოწმება
+unlinkAccount=ანგარიშის მიბმის მოხსნა
+remainingCount=დარჩენილების რაოდენობა
+selectRole.label=აირჩიეთ როლი
+addSubFlow=ქვედინების დამატება
+keyAlias=გასაღების ფსევდონიმი
+deleteClientPolicyConditionConfirmTitle=წავშალო პირობა?
+realmNameField=რეალმის სახელი
+tokenUrl=ტოკენის ბმული
+addGroups=ჯგუფების დამატება
+mapperAttributeFriendlyName=მეგობრული სახელი
+conditionType=პირობის ტიპი
+forgotPassword=პაროლი დამავიწყდა
+eventTypes.IMPERSONATE_ERROR.name=განსახიერების შეცდომა
+mappersList=ამსახველების სია
+rootUrl=ძირითადი URL
+signAssertions=მტკიცების ხელმოწერა
+eventTypes.DELETE_ACCOUNT.name=ანგარიშის წაშლა
+signatureAlgorithm=ხელმოწერის ალგორითმი
+searchForRole=როლის ძებნა
+cacheSettings=კეშის პარამეტრები
+importFile=ფაილის შემოტანა
+emailSettings=ელფოსტის მორგება
+eventTypes.INTROSPECT_TOKEN.description=ტოკენის ინტროსპექცია
+eventTypes.INVALID_SIGNATURE.description=არასწორი ხელმოწერა
+noCredentials=ავტორიზაციის დეტალების გარეშე
+operationType=ოპერაციის ტიპი
+securityDefences=უსაფრთხოების დაცვები
+notVerified=გადაუმოწმებელია
+importClient=კლიენტის შემოტანა
+eventTypes.EXECUTE_ACTIONS.description=ქმედებების შესრულება
+attributesGroup=ატრიბუტების ჯგუფი
+addCondition=პირობის დამატება
+principalType=პრინციპალის ტიპი
+addRoles=როლების დამატება
+connectionTimeout=კავშირის მოლოდინის ვადა ამოიწურა
+duplicateEmailsAllowed=გამეორებული ელფოსტა
+validatorColNames.colName=დამდასტურებლის სახელი
+scopeParameter=დიაპაზონის პარამეტრი
+maxFailureWaitSeconds=მაქს. მოლოდინი
+passwordDataTitle=პაროლის მონაცემები
+userVerify.not\ specified=მითითებული არაა
+setPasswordConfirm=დავაყენო პაროლი?
+eventTypes.REGISTER_NODE.description=კვანძის რეგისტრაცია
+otpPolicy=OTP-ის პოლიტიკა
+emptyPermissions=წვდომების გარეშე
+permissionsList=წვდომების ჩამონათვალი
+deleteAttributeConfirmTitle=წავშალო ატრიბუტი?
+savePassword=პაროლის შენახვა
+client-scopes-condition.label=მოსალოდნელი დიაპაზონები
+customAttribute=მორგებული ატრიბუტი…
+showMore=მეტის ჩვენება
+eventTypes.RESTART_AUTHENTICATION.description=ავთენტიკაციის თავიდან დაწყება
+roleMapping=როლის ასახვა
+ldapAttribute=LDAP ატრიბუტი
+policyDetails=პოლიტიკის დეტალები
+eventTypes.RESTART_AUTHENTICATION.name=ავთენტიკაციის თავიდან დაწყება
+roleDeleteConfirm=წავშალო როლი?
+requiredSettings=აუცილებელი პარამეტრები
+saveEvents=მოვლენების შენახვა
+groupCreated=ჯგუფი შეიქმნა
+deleteConfirmTitle_other=წავშალო ჯგუფები?
+ipAddress=IP მისამართი
+rowEditBtnAriaLabel={{messageBundle}}-ის ჩასწორება
+noSessions=სესიების გარეშე
+roleDetails=როლის დეტალები
+more=კიდევ {{count}}
+cibaPolicy=CIBA-ის პოლიტიკა
+byConfiguration=კონფიგურაციის მიერ
+encryptionAlgorithm=დაშიფვრის ალგორითმი
+eventTypes.CLIENT_DELETE.description=კლიენტის წაშლა
+loginTheme=შესვლის თემა
+removeConfirmTitle_one=წავშალო ჯგუფი?
+deleteEvents=მოვლენების გასუფთავება
+directMembership=პირდაპირი წევრობა
+eventTypes.REGISTER_NODE.name=კვანძის რეგისტრაცია
+eventTypes.GRANT_CONSENT.description=თანხმობის მინიჭება
+executorDetails=გამშვების დეტალები
+filterGroups=ჯგუფების გაფილტვრა
+unsavedChangesTitle=შეუნახავი ცვლილებები
+executeActions=ქმედებების შესრულება
+eventTypes.CLIENT_LOGIN.description=კლიენტის შესვლა
+headerName=თავსართის სახელი
+groupRemove_other=ჯგუფები წაიშალა
+groupUpdated=ჯგუფი განახლდა
+syncRegistrations=რეგისტრაციების სინქრონიზაცია
+associatedPermissions=ასოცირებული წვდომა
+userDetails=მომხმარებლის დეტალები
+jwksUrl=JWKS URL
+selectMethod=აირჩიეთ მეთოდი
+contextualInfo=კონტექსტური ინფორმაცია
+learnMore=გაიგეთ მეტი
+removeUser=მომხმარებლების წაშლა
+clientSettings=კლიენტის დეტალები
+createRealm=რეალმის შექმნა
+searchGroup=ჯგუფის ძებნა
+prompts.select_account=აირჩიეთ ანგარიში
+noConsents=თანხმობების გარეშე
+partialExport=ნაწილობრივი გატანა
+editCondition=პირობის ჩასწორება
+displayOrder=ჩვენების მიმდევრობა
+disabledFeatures=გათიშული თვისებები
+signOut=გასვლა
+identityProvider=იდენტიფიკატორის პროვაიდერი
+loginSettings=შესვლის პარამეტრები
+eventTypes.LOGIN_ERROR.name=შესვლის შეცდომა
+roleCreated=როლი შეიქმნა
+eventTypes.TOKEN_EXCHANGE.name=ტოკენის მიმოცვლა
+childGroups=შვილი ჯგუფები
+eventTypes.UPDATE_EMAIL.name=ელფოსტის განახლება
+requestObject.not\ required=აუცილებელი არაა
+storeTokens=ტოკენების დამახსოვრება
+defaultPasswordLabel=ჩემი პაროლი
+createPermission=წვდომის შექმნა
+realmRolesList=რეალმის როლები
+kerberosRealm=Kerberos-ის რეალმი
+groupName=ჯგუფის სახელი
+authorizationUrl=ავტორიზაციის ბმული
+contextualAttributes=კონტექსტური ატრიბუტები
+replyTo=პასუხი
+providerDescription=პროვაიდერის აღწერა
+assignRole=როლის მინიჭება
+accessSettings=წვდომის მორგება
+credentialReset=ავტორიზაციის დეტალების ჩამოყრა
+startTime=დაწყების დრო
+noGroups=ჯგუფების გარეშე
+browserFlow=ბრაუზერი დინება
+lastEvaluation=ბოლო შეფასება
+kc.client.network.host=კლიენტის ჰოსტი
+clientPolicies=კლიენტის პოლიტიკები
+allResults=ყველა შედეგი
+logoUrl=ლოგoს ბმული
+eventTypes.RESET_PASSWORD.description=პაროლის ჩამოყრა
+removeMappingTitle=წავშალო როლი?
+providers=პროვაიდერების დამატება
+writeOnly=მხოლოდ ჩაწერა
+requiredForLabel.users=მხოლოდ მომხმარებლები
+clientType=კლიენტის ტიპი
+authData=ავტორიზაციის მონაცემები
+realmInfo=რეალმის ინფორმაცია
+validatorDialogColNames.colName=როლის სახელი
+decisionStrategy=გადაწყვეტილების სტრატეგია
+realmSettings=რეალმის მორგება
+eventTypes.CLIENT_REGISTER.description=კლიენტის რეგისტრაცია
+clientAuthenticator=კლიენტის ავთენტიკატორი
+providerDetails=პროვაიდერის დეტალები
+deleteGroup=ჯგუფის წაშლა
+viewCondition=პირობის ნახვა
+editUsernameAllowed=მომხმარებლის სახელის ჩასწორება
+removeAttribute=ატრიბუტის წაშლა
+authorizationScopes=ავტორიზაციის დიაპაზონები
+enabledWhen=ჩართულია, როცა
+eventTypes.UNREGISTER_NODE.description=კვანძის რეგისტრაციის მოხსნა
+adminURL=ადმინის ბმული
+addNode=კვანძის დამატება
+used.SPECIFIC_PROVIDERS=მითითებული პროვაიდერები
+createFlow=დინების შექმნა
+impersonateConfirm=განვასახიერო მომხმარებელი?
+credentialResetConfirm=ელფოსტის გაგზავნა
+timestamp=შექმნის თარიღი
+eventTypes.REGISTER_ERROR.description=რეგისტრაციის შეცდომა
+searchUserEventsBtn=მოვლენების ძებნა
+oneLevel=ერთი დონე
+samlSettings=SAML-ის მორგება
+addUser=მომხმარებლის დამატება
+deleteRealm=რეალმის წაშლა
+residentKey.not\ specified=მითითებული არაა
+resetActions=ქმედებების ჩამოყრა
+createClient=კლიენტის შექმნა
+passwordConfirmation=პაროლის დადასტურება
+noMappers=ამსახველების გარეშე
+eventListeners=მოვლენის მსმენელები
+bindDn=DN-ზე მიბმა
+flowDetails=დინების დეტალები
+formatOption=ფორმატის პარამეტრი
+authScopes=ავტორიზაციის დიაპაზონები
+joinGroups=ჯგუფში გაწევრება
+providedBy=მოწოდებულია
+emptyValidators=დამდასტურებლების გარეშე.
+moveGroupSuccess=ჯგუფი გადატანილია
+readOnly=მხოლოდ წაკითხვადი
+providerInfo=პროვაიდერის ინფორმაცია
+addProvider=პროვაიდერის დამატება
+assignedType=მინიჭებული ტიპი
+initialCounter=საწყისი ამთვლელი
+eventTypes.CLIENT_REGISTER.name=კლიენტის რეგისტრაცია
+addTypes=ტიპების დამატება
+providerId=პროვაიდერის ID
+oneTimePassword=ერთჯერადი პაროლი
+emptyResources=რესურსების გარეშე
+searchMembers=წევრების ძებნა
+attestationPreference.not\ specified=მითითებული არაა
+keysFilter.PASSIVE=პასიური გასაღებები
+dynamicScope=დინამიკური დიაპაზონი
+clientScopeList=კლიენტის შუალედები
+testingConnection=კავშირის შემოწმება
+sessionsType.regularSSO=ჩვეულებრივი SSO
+deleteExecutorProfileConfirmTitle=წავშალო შემსრულებელი?
+requiredWhen=აუცილებელია, როცა
+mappingDetails=ამსახავის დეტალები
+top-level-flow-type.client-flow=კლიენტის დინება
+serverInfo=სერვერის ინფორმაცია
+authDetails=ავტორიზაციის დეტალები
+events-disable-title=გავაუქმო მოვლენების შენახვა?
+ellipticCurve=ელიპტიკური მრუდი
+totalMemory=მეხსიერება სულ
+webAuthnPolicyAuthenticatorAttachment=ავთენტიკატორის მიმაგრება
+otpSupportedApplications.totpAppGoogleName=Google Authenticator
+clientDeleteConfirmTitle=წავშალო კლიენტი?
+parentId=მშობლის ID
+executionConfig={{name}}-ის მორგება
+userLabel=მომხმარებლის ჭდე
+executorType=გამშვების ტიპი
+batchSize=პაკეტის ზომა
+client-roles.label=კლიენტის როლები
+createAttribute=ატრიბუტის შექმნა
+identityInformation=იდენტიფიკატორის ინფორმაცია
+partialImport=ნაწილობრივი შემოტანა
+eventTypes.UNREGISTER_NODE.name=კვანძის რეგისტრაციის გაუქმება
+deleteAttributeSuccess=ატრიბუტი წაიშალა
+exactSearch=ზუსტი ძებნა
+eventTypes.REMOVE_TOTP.name=TOTP-ის წაშლა
+importKey=გასაღების შემოტანა
+forceAuthentication=ნაძალადევი ავთენტიკაცია
+generalOptions=ზოგადი პარამეტრები
+webAuthnPolicyAcceptableAaguids=მისაღები AAGUID-ები
+addAnnotationText=ანოტაციის დამატება
+importUsers=მომხმარებლების შემოტანა
+groupDeleted_other=ჯგუფები წაიშალა
+inputTypeSize=შეყვანის ზომა
+syncMode=სინქრონიზაციის რეჟიმი
+searchScope=დიაპაზონის ძებნა
+resetPasswordBtn=პაროლის ჩამოყრა
+FAIL=შემოტანა ჩავარდა
+clientUpdaterTrustedHosts=სანდო ჰოსტები
+attributesDropdown=ატრიბუტების ჩამოსაშლელი მენიუ
+eventTypes.REMOVE_TOTP.description=TOTP-ის მოცილება
+cibaExpiresIn=ვადა
+addAttribute={{label}}-ის დამატება
+selectRealm=რეალმის არჩევა
+frontendUrl=წინაბოლოს URL
+deleteProviderMapper=წავშალო ამსახველი?
+authenticationFlow=ავთენტიკაციის დინება
+deleteProvider=წავშალო პროვაიდერი?
+sessionsType.serviceAccount=სერვისის ანგარიში
+searchGroups=ჯგუფების ძებნა
+profilesConfigType=კონფიგურაცია გავლით:
+resourceFile=რესურსის ფაილი
+resetPasswordConfirm=ჩამოვყარო პაროლი?
+maxLifespan=მაქს. სიცოცხლის ხანგრძლივობა
+jsonEditor=JSON-ის რედაქტორი
+identityProviders=იდენტიფიკატორის მომწოდებლები
+createdAt=შექმნის დრო
+groupDetails=ჯგუფის დეტალები
+addUri=URI-ის დამატება
+searchType.default=ნაგულისხმევი ძებნა
+createResource=რესურსის შექმნა
+editInfo=ინფორმაციის ჩასწორება
+firstName=სახელი
+deleteConfirmFlow=წავშალო დინება?
+resetAction=ქმედების ჩამოყრა
+associatedRolesText=ასოცირებული როლები
+deleteClientPolicyProfileConfirmTitle=წავშალო პროფილი?
+lastName=გვარი
+noTranslations=თარგმანების გარეშე
+supportedLocales=მხარდაჭერილი ენები
+fullName={{givenName}} {{familyName}}
+policyType.totp=დროზე დაყრდნობით
+keysFilter.DISABLED=გათიშული გასაღებები
+kc.client.user_agent=კლიენტის/მომხმარებლის აგენტი
+addRole=როლის დამატება
+clientAuthentication=კლიენტის ავთენტიკაცია
+leaveGroup_other=გავიდე ჯგფუფებიდან?
+disableSigning="{{key}}"-ის გათიშვა
+emptyClientProfiles=პროფილების გარეშე
+keysFilter.ACTIVE=აქტიური გასაღებები
+realmOverrides=რეალმი გადაფარავს
+kcNumberUnFormat=რიცხვის დაფორმატების გაუქმება
+searchClientAuthorizationPolicy=პოლიტიკის ძებნა
+searchClientAuthorizationPermission=წვდომის ძებნა
+createItem=ელემენტის შექმნა
+selectAll=ყველას მონიშვნა
+accountTheme=ანგარიშის თემა
+hasWords=აქვს სიტყვები
+selectTheme=აირჩიეთ თემა
+selectVendor=აირჩიეთ მომწოდებელი
+itemDeleteConfirmTitle=წავშალო ელემენტი?
+customValue=მორგებული მნიშვნელობა
+realmSelector=რეალმის ამრჩევი
+selectResource=აირჩიეთ რესურსი
+selectClients=აირჩიეთ კლიენტები
+selectLanguage=აირჩიეთ ენა
+themeType=თემის ტიპი
+editBtn=ჩასწორების ღილაკი
+deleteConfirmTranslationTitle=წავშალო თარგმანები?
+searchItem=ელემენტის ძებნა
+writableSelection=ჩაწერადი მონიშნული
+viewGuides=სახელმძღვანელოების ნახვა
+readBlog=ბლოგის წაკითხვა
+addTranslation=თარგმანის დამატება
+emptySelection=ცარიელი მონიშნული
+unsyncedSelection=დაუსინქრონიზებელი მონიშნული
+kcNumberFormat=რიცხვის დაფორმატება
+associatedPolicy=ასოცირებული პოლიტიკა
+joinCommunity=საზოგადოებაში გაწევრება
+bruteForceMode.PermanentLockout=სამუდამოდ დაბლოკვა
+itemDelete=ელემენტის წაშლა
+itemSaveSuccessful=შენახვა წარმატებულია
+searchClientAuthorizationResource=რესურსის ძებნა
+removeAnnotationText=ანოტაციის წაშლა
+verifiableCredentialsEnabled=გადამოწმებადი ავტორიზაციის დეტალები
+organizationDetails=ორგანიზაციის დეტალები
+loginUsernamePlaceholder=შესვლის მომხმარებლის სახელი
+linkedOrganization=მიბმული ორგანიზაცია
+organizationName=ორგანიზაციის სახელი
+resourceScope=რესურსის დიაპაზონი
+adminPermissionName=წვდომის სახელი
+client-attributes.label=კლიენტის ატრიბუტები
+noDirectUsers=პირდაპირი მომხმარებლების გარეშე
+uuidLdapAttribute=UUID LDAP ატრიბუტი
+addTranslationsModalTitle=თარგმანების დამატება
+avatarImage=ავატარის გამოსახულება
+sendInvitation=მოსაწვევის გაგზავნა
+currentRealm=მიმდინარე რეალმი
+recentlyUsed=ახლახან გამოყენებული
+viewAll=ყველას ნახვა
+unLinkIdentityProvider=პროვაიდერის მიბმის გაუქმება
+permissionsName=წვდომის სახელი
+permissionsAssignedPolicy=მინიჭებული პოლიტიკა
+allClients=ყველა კლიენტი
+assignedPolicies=მინიჭებული პოლიტიკები
+policyType=პოლიტიკის ტიპი
+allResources=ყველა რესურსი
+policyEnforcementMode=პოლიტიკის გატარების რეჟიმი
+managePriorityOrder=პრიორიტეტების მიმდევრობის მართვა
+eventTypes.CLIENT_UPDATE_ERROR.description=კლიენტის განახლების შეცდომა
+requiredUserActions=აუცილებელი მომხმარებლის ქმედებები
+userModelAttribute=მომხმარებლის მოდელის ატრიბუტი
+allowRemoteResourceManagement=დაშორებული რესურსების მართვა
+supportedLanguagesTableColumnName=მხარდაჭერილი ენები
+fetchRoles=როლების გამოთხოვა
+eventTypes.REMOVE_CREDENTIAL.name=ავტორიზაციის დეტალების წაშლა
+userCache=მომხმარებლის კეში
+redirectUrl=გადამისამართების URL
+emptyMembers=წევრების გარეშე
+membershipEvents=წევრობის მოვლენები
+displayDescription=აღწერის ჩვენება
+displayHeader=საჩვენებელი სახელი
+searchMember=წევრის ძებნა
+showMemberships=წევრობის ჩვენება
+noGroupMemberships=წევრობების გარეშე
+providerType=პროვაიდერის ტიპი
+themeColors=თემის ფერები
+errorColor=შეცდომის ფერი
+successColor=წარმატების ფერი
+activeColor=აქტიური ფერი
+primaryColor=ძირითადი ფერი
+secondaryColor=მეორადი ფერი
+linkColor=ბმულის ფერი
+backgroundColor=ფონის ფერი
+iconColor=ხატულას ფერი
+textColor=ტექსტის ფერი
+translationValue=თარგმანის მნიშვნელობა
+noLanguages=ენების გარეშე
+joinOrganization=ორგანიზაციაში გაწევრება
+eventTypes.UPDATE_CREDENTIAL.name=ავტორიზაციის დეტალების განახლება
+disableConfirmUserTitle=გავთიშო მომხმარებელი?
+eventTypes.UPDATE_CREDENTIAL.description=ავტორაიზაციის დეტალების განახლება
+darkModeEnabled=მუქი რეჟიმი
+clearCachesTitle=კეშების გასუფთავება
+realmCache=რეალმის კეში
+createOrganization=ორგანიზაციის შექმნა
+addDomain=დომენის დამატება
+disableConfirmOrganizationTitle=გავთიშო ორგანიზაცია?
+inviteMember=წევრის მოწვევა
+removeMember=წევრის წაშლა
+removeConfirmOrganizationTitle=წავშალო ორგანიზაცია?
+sentInvitation=მოსაწვევის გაგზავნა
+connectionTrace=კავშირის ტრეისი
+loa-max-age=მაქს. ასაკი
+groupDuplicated=გამეორებულების დაჯგუფება
+assignedPolicyType.allTypes=ყველა ტიპი
+adminPermissionsEnabled=ადმინის წვდომები
+specificClients=სპეციფიკური კლიენტები
+allResourceType=ყველა {{resourceType}}
+authorizationScope=ავტორიზაციის დიაპაზონი
+requiredAction=აუცილებელი ქმედება
+publicKey=საჯარო გასაღები
+bruteForceMode.TemporaryLockout=დროებით დაბლოკვა
+eventTypes.REMOVE_CREDENTIAL.description=ავტორიზაციის დეტალების წაშლა
+tryAgain=კიდევ სცადეთ
+keysCache=გასაღებების კეში
+managedMembership=მართული წევრობა
+specificResourceType=სპეციფიკური {{resourceType}}
+createPermissionPolicy=პოლიტიკის შექმნა
+crlCache=CRL კეში
+emptyUserOrganizations=ორგანიზაციის გარეშე
+expandRow=მწკრივის გაშლა
+duplicateAGroup=ჯგუფის დუბლირება
+caseSensitiveOriginalUsername=რეგისტრზე დამოკიდებული მომხმარებლის სახელი
+emptyOrganizations=ორგანიზაციების გარეშე
+organizationDelete=წავშალო ორგანიზაცია?
+memberList=წევრების სია
+sendInvite=მოსაწვევის გაგზავნა
+membershipType=წევრობის ტიპი
+favicon=Favicon
+authenticatorRefConfig.value.label=ავთენტიკატორის მომართვა
+deniedScope=აკრძალული დიაპაზონი:
+authenticationTypeTokenAuth=ტოკენი
+authenticationType=ავთენტიკაციის ტიპი
+authenticationTypeBasicAuth=პაროლი
+referrerPolicy=მომმართველის პოლიტიკა
+notBefore=არა თარიღამდე
+grantedPermissions=მინიჭებული წვდომები
+grantedScope=მინიჭებული დიაპაზონი:
+selectUsers=აირჩიეთ მომხმარებელი
+selectRole=აირჩიეთ როლი
+sameSession=იგივე სესია
+authScope=ავტორიზაციის დიაპაზონი
+manageRealms=რეალმების მართვა
+selectClient=აირჩიეთ კლიენტი
+recentRealms=უახლესი რეალმები
+targetAudience=სამიზნე აუდიენცია
+deniedPermissions=აკრძალული წვდომები
+requestObject.request_uri\ only=მხოლოდ URI-ის გამოთხოვა
+searchByName=სახელით ძებნა
+eventTypes.REFRESH_TOKEN_ERROR.description=ტოკენის განახლების შეცდომა
+filterByClients=გაფილტვრა კლიენტებით
+realmRolePrefix=რეალმის როლის პრეფიქსი
+createPolicyOfType={{policyType}} პოლიტიკის შექმნა
+eventTypes.DELETE_ACCOUNT_ERROR.description=ანგარისის წაშლის შეცდომა
+eventTypes.VERIFY_PROFILE_ERROR.name=პროფილის გადამოწმების შეცდომა
+eventTypes.VALIDATE_ACCESS_TOKEN.description=წვდომის ტოკენის გადამოწმება
+updateFirstLogin=პირველი შესვლის განახლება
+createAGroup=ჯგუფის შექმნა
+exportSuccess=რეალმის გატანა წარმატებულია.
+signingKeysConfig=ხელმოწერის გასაღებების მორგება
+searchAdminEventsBtn=ადმინის მოვლენების ძებნა
+removeImportedUsers=წავშალო შემოტანილი მომხმარებლები?
+fileNameDialogTitle=შენახვა, როგორც
+fileName=ფაილის სახელი
+eventTypes.REFRESH_TOKEN_ERROR.name=ტოკენის განახლების შეცდომა
+clientDelete=წავშალო {{clientId}} ?
+addedNodeSuccess=კვანძი წარმატებით დაემატა
+loginScreenCustomization=შესვლის ეკრანის მორგება
+algorithmNotSpecified=ალგორითმი მითითებული არაა
+queryExtensions=მხარდაჭერილი გაფართოებების გამოთხოვა
+disableSuccess=პროვაიდერი წარმატებით გამოირთო
+updateClientConditionSuccess=პირობა წარმატებით განახლდა.
+userObjectClasses=მომხმარებლის ობიექტის კლასები
+addNewProvider=ახალი პროვაიდერის დამატება
+availableIdPs=ხელმისაწვდომი იდენტიფიკატორის პროვაიდერები
+userInfoSettings=მომხმარებლის ინფორმაციის პარამეტრები
+maxLength=მაქს. სიგრძეა {{length}}
+eventTypes.TOKEN_EXCHANGE_ERROR.name=ტოკენების გაცვლის შეცდომა
+evictionMinute=გამოსახლების წუთი
+noPermissionsEvaluationResults=შეფასების გარეშე
+signatureMaxExp=მაქს. ვადა
+groupsClaim=ჯგუფის ატრიბუტები
+claimValue=ატრიბუტის მნისვნელობა
+targetClaim=სამიზნე ატრიბუტები
+webAuthnPolicyExtraOrigins=დამატებითი საწყისები
+claimFilterName=ძირითადი ატრიბუტები
+deleteValidatorConfirmTitle=წავშალო ვალიდატორი?
+eventTypes.GRANT_CONSENT.name=დათანხმების მინიჭება
+artifactBindingUrl=არტეფაქტის მიმაგრების URL
+implicitFlow=აშკარა დინება
+evictionDay=გამოსახლების დღე
+editGroup=ჯგუფის ჩასწორება
+jsonType.label=JSON-ის ტიპის გამოთხოვა
+fullScopeAllowed=მთლიანი დიაპაზონი დაშვებულია
+registeredClusterNodes=დარეგისტრირებული კლასტერის კვანძები
+eventTypes.DELETE_ACCOUNT_ERROR.name=ანგარიშის წაშლის შეცდომა
+noPasswordPolicies=პაროლის პოლიტიკების გარეშე
+nodeReRegistrationTimeout=კვანძის თავიდან რეგისტრაციის მოლოდინის ვადა ამოიწურა
+enableSwitchSuccess={{switch}} წარმატებით შეიცვალა
+roleObjectClasses=როლის ობიექტის კლასები
+addLdapWizardDescription=აქ ტესტია საჭირო
+deleteClientSuccess=კლიენტის პროფილი წაიშალა
+resourcesAndScopes=რესურსები და დიაპაზონები
+membershipLdapAttribute=წევრობის LDAP ატრიბუტი
+allow-default-scopes.label=ნაგულისხმევი დიაპაზონების დაშვება
+exportWarningTitle=გაიტანეთ ყურადღებით
+parentClientScope=მშობელი კლიენტის დიაპაზონი
+postBrokerLoginFlowAlias=შესვლის შემდგომი დინება
+updateTranslationSuccess=წარმატებულია! თარგმანი განახლდა.
+forbidden_other=აკრძალულია. საჭიროა წვდომები:
+eventTypes.IDENTITY_PROVIDER_RESPONSE.name=იდენტიფიკატორის მომწოდებლის პასუხი
+eventTypes.CLIENT_DELETE_ERROR.description=კლიენტის წაშლის შეცდომა
+jumpToSection=გადასვლა სექციაზე
+clearAdminEvents=ადმინის მოვლენების გასუფთავება
+clearUserEvents=მომხმარებლის მოვლენების გასუფთავება
+eventTypes.REGISTER_NODE_ERROR.description=კვანძის რეგისტრაციის შეცდომა
+addSubFlowTitle=ქვედინების დამატება
+eventTypes.SEND_RESET_PASSWORD.name=პაროლის ჩამოყრის გაგზავნა
+testConnectionHint.withoutEmailAction=ელფოსტის მისამართის მორგება
+eventTypes.UNREGISTER_NODE_ERROR.description=კვანძის რეგისტრაციის გაუქმების შეცდომა
+addKerberosWizardDescription=აქ ტესტია საჭირო
+eventTypes.UPDATE_TOTP_ERROR.name=TOTP-ის განახლების შეცდომა
+resetPasswordConfirmation=ახალი პაროლის დადასტურება
+htmlDisplayName=HTML საჩვენებელი სახელი
+newClientProfileName=კლიენტის პროფილის სახელი
+generateNewKeys=RSA გასაღებების გენერაცია
+attributeFriendlyName=ატრიბუტი [მეგობრული სახელი]
+createPolicy=კლიენტის პოლიტიკის შექმნა
+failureFactor=მაქს. შესვლის ჩავარდნები
+addCustomProvider=მორგებული მომწოდებლის დამატება
+eventTypes.EXECUTE_ACTIONS_ERROR.name=ქმედებების შესრულების შეცდომა
+oAuthSettings=OAuth2-ის მორგება
+emailClaim=ელფოსტის გამოთხოვა
+fullNameClaim=სახელის გამოთხოვა
+userNameClaim=მომხმარებლის სახელის გამოთხოვა
+directGrant=პირდაპირი მინიჭების დინება
+noClientPolicies=კლიენტის პოლიტიკების გარეშე
+userIDClaim=ID-ის გამოთხოვა
+createClientScope=კლიენტის დიაპაზონის შექმნა
+clientSessionSettings=კლიენტის სესიის მორგება
+kerberosWizardDescription=აქ ტექსტია საჭირო.
+onDragFinish=გადათრევა დასრულდა {{list}}
+updateClientPolicySuccess=კლიენტის პოლიტიკა განახლდა
+eventTypes.IDENTITY_PROVIDER_RESPONSE.description=იდენტიფიკატორის მომწოდებლის პასუხი
+clientLoginTimeout=კლიენტის შესვლის მოლოდინის ვადა ამოიწურა
+clientPolicySearch=კლიენტის პოლიტიკის ძებნა
+editableRowsTable=ჩაწორებად-მწკრივებიანი ცხრილი
+deleteRole=ამ როლის წაშლა
+keyPlaceholder=აკრიფეთ გასაღები
+updateExecutorSuccess=შემსრულებელი წარმატებით განახლდა
+syncModeOverride=სინქრონიზაციის რეჟიმის გადაფარვა
+validatingX509Certs=X509 სერტიფიკატების ვალიდაცია
+userInfoUrl=მომხმარებლის ინფორმაციის URL
+krbPrincipalAttribute=Kerberos-ის პრინციპალის ატრიბუტი
+useDiscoveryEndpoint=აღმოჩენის ბოლოწერტილის გამოყენება
+realmSaveSuccess=რეალმი წარმატებით განახლდა
+eventTypes.CLIENT_LOGIN_ERROR.description=კლიენტის შესვლის შეცდომა
+reloadKeysSuccess=გასაღებები წარმატებით ჩაიტვირთა თავიდან
+forbidden_one=აკრძალულია. საჭიროა წვდომები:
+showInheritedRoles=მემკვირდრეობითი როლების ჩვენება
+eventConfigSuccessfully=კონფიგურაციის შენახვა წარმატებულია
+userLdapFilter=მომხმარებლის LDAP ფილტრი
+deleteProviderTitle=წავშალო გასაღების მომწოდებელი?
+importSuccess=ახალი სერტიფიკატი შემოტანილია
+addedGroupMembership=ჯგუდის წევრობა დაემატა
+overrideActionTokens=ქმედების ტოკენების გადაფარვა
+eventTypes.IDENTITY_PROVIDER_LOGIN.description=შესვლა იდენტიფიკატორის მომწოდებელზე
+linkedIdPs=მიბმული იდენტიფიკატორის მომწოდებლები
+addMessageBundle=შეტყობინებების ნაკრების დამატება
+eventTypes.REMOVE_TOTP_ERROR.description=TOTP-ის წაშლის შეცდომა
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=ავთენტიკაციის თავიდან დაწყების შეცდომა
+loginWithEmailAllowed=შესვლა ელფოსტით
+eventTypes.RESET_PASSWORD_ERROR.name=პაროლის ჩამოყრის შეცდომა
+eventTypes.UPDATE_EMAIL_ERROR.name=ელფოსტის განახლების შეცდომა
+clearAllFilters=ყველა ფილტრის გასუფთავება
+changeTypeTo=ტიპის შეცვლა მნიშვნელობაზე
+flow.reset\ credentials=ავტორიზაციის დეტალების დინების ჩამოყრა
+unlockSuccess=მომხმარებელი წარმატებით განიბლოკა
+selectOne=აირჩიეთ პარამეტრი
+createClientConditionSuccess=პირობა წარმატებით შეიქმნა.
+scopeParameterPlaceholder=აირჩიეთ დიაპაზონის პარამეტრები
+SSOSessionMax=SSO სესიები მაქს
+SSOSessionSettings=SSO-ის სესიის მორგება
+searchForAdminEvent=ადმინის მოვლენის ძებნა
+validRedirectUri=სწორი გადამისამართების URI-ები
+createGroupText=ატრიბუტების ჯგუფის შექმნა
+ignoreMissingGroups=ნაკლული ჯგუფების იგნორი
+emptyAddClientScopes=კლიენტის დიაპაზონების გარეშე
+deleteResource=წავშალო რესურსი სამუდამოდ?
+loginActionTimeout=შესვლის ქმედების მოლოდინის ვადა ამოიწურა
+accessTokenLifespan=წვდომის ტოკენის სიცოცხლის ხანგრძლივობა
+addSamlProvider=SAML მომწოდებლის დამატება
+tableOfGroups=ჯგუფების ცხრილი
+serviceAccount=სერვისის ანგარიშის როლები
+generatedUserInfo=გენერირებული მომხმარებლის ინფორმაცია
+emptyClientScopesPrimaryAction=კლიენტის დიაპაზონების დამატება
+realmCertificateAlias=რეალმის სერტიფიკატის ფსევდონიმი
+noRolesAssociated=ასოცირებული როლების გარეშე
+eventTypes.UPDATE_EMAIL_ERROR.description=ელფოსტის განახლების შეცდომა
+claimFilterValue=ძირითადი გამოთხოვის მნიშვნელობა
+leaveGroup_one=დატოვებთ ჯგუფს {{name}}?
+clearFile=ამ ფაილის გასუფთავება
+executorClientAuthenticator=შემსრულებლის კლიენტის ავთენტიკატორი
+syncAllUsers=ყველა მომხმარებლის სინქრონიზაცია
+generatedAccessToken=გენერირებული წვდომის ტოკენი
+eventTypes.SEND_VERIFY_EMAIL.description=გადამოწმების ელფოსტის გაგზავნა
+eventTypes.CLIENT_INFO_ERROR.name=კლიენტის ინფორმაციის შეცდომა
+addAssociatedRolesText=ასოცირებული როლების დამატება
+eventTypes.CLIENT_DELETE_ERROR.name=კლიენტის წაშლის შეცდომა
+fromDisplayName=საჩვენებელი სახელიდან
+registerNodeManually=კვანძის ხელით რეგისტრაცია
+periodicFullSync=პერიოდული სრული სინქრონიზაცია
+rdnLdapAttribute=RDN LDAP ატრიბუტი
+included.client.audience.label=ჩასმული კლიენტის აუდიენცია
+emptyStateMessage=ატრიბუტის ჯგუფების გარეშე
+regexAttributeValues=რეგგამოსის ატრიბუტის მნიშვნელობები
+unlockAllUsers=ყველა მომხმარებლის განბლოკვა
+hideInheritedRoles=მემკვირდრეობითი როლების დამალვა
+clientPoliciesPolicies=კლიენტის პოლიტიკების პოლიტიკა
+eventTypes.UPDATE_PROFILE_ERROR.description=პროფილის განახლების შეცდომა
+includeInUserInfo.label=დამატება მომხმარებლის ინფორმაციისთვის
+nameIdFormat=სახელისა და ID-ის ფორმატი
+userAttributeValue=მომხმარებლის ატრიბუტის მნიშვნელობა
+firstBrokerLoginFlowAlias=პირველი შესვლის დინება
+updateSuccessIdentityProvider=მომწოდებელი წარმატებით განახლდა
+metadataDescriptorUrl=მეტამონაცემების აღწერის URL
+clientProfile=კლიენტის პროფილის დეტალები
+keyForCodeExchange=PKCE მეთოდი
+cpu=CPU
+processorCount=პროცესორების როდენობა
+deprecated=მოძველებულია
+passSubject=სუბიექტის გადაცემა
+webAuthnPolicyPasskeysEnabled=საკვანძო გასაღებების ჩართვა
+validity=სერტიფიკატის ვადა
+forceArtifactBinding=არტეფაქტების ნაძალადევი მიბმა
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ky.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ky.properties
new file mode 100644
index 000000000000..99a41626cc96
--- /dev/null
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ky.properties
@@ -0,0 +1,3498 @@
+cancel=Жокко чыгаруу
+deleteConfirm_other=Бул топторду чын эле өчүргүңүз келеби?
+trusted-hosts.label=Ишенимдүү хосттор
+deletedSuccess=Провайдер ийгиликтүү өчүрүлдү.
+searchAttributes=Атрибуттарды издөө
+userID=Колдонуучу ID
+anyResource=Каалаган ресурс
+importAdded_zero=Жазуулар кошулган жок.
+createClientPolicy=Клиент саясатын түзүү
+clientSignature=Клиенттин колтамгасы талап кылынат
+persistent=Туруктуу
+sync-ldap-roles-to-keycloak=LDAP ролдорун Keycloak менен шайкештештирүү
+eventTypes.PERMISSION_TOKEN.name=Уруксат белгиси
+permissionsDisable=Уруксаттарды өчүрөсүзбү?
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Федерацияланган идентификация байланышынын катачылыгы
+secretHasExpired=Сырсөз мөөнөтү бүттү, жогорудагы "Кайра түзүү" баскычын басып жаңысын түзүңүз
+policyRolesHelp='Ролдорду кошуу' баскычын басып, бул саясат үчүн уруксат берилген ролдорду тандаңыз. Эгер белгиленген ролдо 'талап кылынат' белгиси коюлса, анда бул ролдун болушу саясатты баалоодо зарыл деп эсептелет. Эгер эч бир роль белгиленбесе, бул 'Ырастоочу' чечим стратегиясына барабар.
+addLdapWizardTitle=LDAP колдонуучусун федерациялык провайдер катары кошуу
+wantAssertionsSignedHelp=Бул кызмат көрсөтүүчү Assertion'дардын кол коюлган болушун күтүп жатабы?
+disableConfirm='{{name}}' өчүрүлсүнбү?
+eventTypes.CUSTOM_REQUIRED_ACTION.description=Ыңгайлаштырылган талап кылынган аракет
+flowName=Агымдын аталышы
+userInfoResponseEncryptionContentEncryptionAlgorithm=Колдонуучу маалыматынын жоопторун шифрлөөнүн мазмун алгоритми
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Идентификация провайдери аркылуу биринчи кирүүдө ката
+searchByRoleName=Ролдун аталышы боюнча издөө
+credentialType=Тип
+passLoginHint=login_hint өткөрүү
+openIdConnectCompatibilityModesHelp=Бул бөлүм эски OpenID Connect / OAuth 2 адаптерлери менен артка шайкештик үчүн колдонулат. Эгер клиент эски Keycloak / RH-SSO адаптерин колдонуп жатса, бул пайдалуу.
+emptyClientScopes=Бул клиентке кошулган эч бир кардар чөйрөсү жок
+httpPostBindingAuthnRequestHelp=AuthnRequest HTTP-POST байланышы аркылуу жөнөтүлүшү керекпи. Эгер жок болсо, HTTP-REDIRECT байланышы колдонулат.
+policyEnforcementMode=Саясатты аткаруу режими
+eventTypes.CLIENT_UPDATE.name=Клиентти жаңыртуу
+addMultivaluedLabel={{fieldLabel}} кошуу
+notRepeat=Кайталанбайт
+secretRotated=Сырсөз жаңыртылды
+userFedDeleteConfirmTitle=Колдонуучу федерация провайдерин өчүрөсүзбү?
+userCredentialsHelpTextLabel=Колдонуучунун Күбөлөндүрүү Мээлей тексти
+role=Роль
+displayName=Көрсөтүлө турган аталыш
+applyToResourceTypeHelp=Бул уруксат белгилүү бир ресурстун түрүнө колдонулушу керекпи. Бул учурда, уруксат ошол түрдөгү бардык ресурстар үчүн бааланат.
+cibaIntervalHelp=CD (Иштетүүчү түзмөк) токен пунктуна суроо жөнөтүүдөн мурун күтүшү керек болгон минималдуу убакыт (секунд менен). Эгер 0 коюлса, CIBA спецификациясына ылайык, демейки 5 секунд колдонулат.
+envelopeFrom=Envelope From
+eventTypes.UPDATE_TOTP.name=TOTP жаңыртуу
+updateCibaError=CIBA саясатын жаңыртуу мүмкүн болбоду: {{error}}
+policyUrl=Саясаттын URL дареги
+clientDescriptionHelp=Клиенттин сүрөттөмөсүн көрсөтөт. Мисалы: 'TimeSheets үчүн менин клиентим'. Локалдаштырылган маанилер үчүн ачкычтарды колдойт. Мисалы: ${my_client_description}.
+rolesPermissionsHint=Бул ролду башкаруу үчүн майда-чүйдө уруксаттар иштетилген-иштетилбегенин аныктайт. Өчүрүлгөн учурда, мурда орнотулган бардык уруксаттар өчүрүлөт.
+passwordPoliciesHelp.regexPattern=Сырсөз бир же бир нече белгиленген Java регулярдык туюнтма үлгүлөрүнө туура келиши керек.
+oAuthDPoP=Белгилер суроосунда DPoP (Далилдөө башы) заголовогун талап кылуу
+invalidRealmName=Realm аталышында атайын белгилер болбошу керек
+validRedirectURIsHelp=Кирүүдөн кийин браузерге багытталганга жарактуу URI үлгүсү. 'http\://example.com/*' сыяктуу жөнөкөй wildcards уруксат берилет. /my/relative/path/* сыяктуу салыштырмалуу жолдор да көрсөтүлүшү мүмкүн. Салыштырмалуу жол клиенттин негизги URL дарегине салыштырмалуу болот, эгерде ал көрсөтүлбөсө, анда auth сервердин негизги URL колдонулат. Эгер SAML колдонулса, кирүү суроосу менен кошо берилген керектөөчү кызмат URL дарегине ишенсеңиз, анда жарактуу URI үлгүлөрүн көрсөтүшүңүз керек.
+realmNameTitle={{name}} realm
+subjectNameId=Теманын NameID'си
+credentialsList=Күбөлөндүрмө тизмеси
+usermodel.clientRoleMapping.clientId.label=Клиент ID
+clientId=Клиент ID
+serviceProviderEntityId=Кызмат көрсөтүүчү тараптын Entity ID'си
+internationalizationHelp=Эгер иштетилсе, бул realm үчүн кайсы тилдерди колдой турганыңызды жана кайсы тил демейки болоорун тандай аласыз.
+managePriorityOrder=Приоритет тартибин башкаруу
+contextualAttributesHelp=Иштеп жаткан чөйрө же аткаруу контекстинен берилген каалаган атрибут.
+clientLoginTimeoutHelp=Клиентке жетүү белгиси протоколун бүтүрүү үчүн берилген максималдуу убакыт. Бул адатта 1 мүнөт болушу керек.
+emptyMappers=Mapper'лер жок
+artifactBindingUrlHelp=HTTP ARTIFACT билдирүүлөрүн жөнөтүүчү URL. Эгер башка байланыш ыкмасын колдонуп жатсаңыз, бул талааны бош калтырсаңыз болот. Эгер IdP демилгеси менен кирүүдө ARTIFACT байланышын мажбурлап жатсаңыз, анда бул маанини белгилешиңиз керек.
+artifactBindingUrl=Artifact байланыш URL
+clientsList=Клиенттердин тизмеси
+userId=Колдонуучу ID
+eventTypes.CLIENT_UPDATE_ERROR.description=Клиентти жаңыртуу катачылыгы
+eventTypes.UPDATE_EMAIL.description=Электрондук почтаны жаңыртуу
+eventTypes.VALIDATE_ACCESS_TOKEN.description=Access token'ду текшерүү
+dedicatedScopeExplain=Бул – арналган mapper'лерди жана scope'ту камтыган клиент scope
+updateOtpError=OTP саясатын жаңыртуу мүмкүн болгон жок\: {{error}}
+addressClaim.postal_code.label=Почта индекси үчүн колдонуучунун атрибутунун аты
+defaultRoles=Демейки ролдор
+samlSignatureKeyNameHelp=Кол коюлган SAML документтери KeyName элементи аркылуу кол коюу ачкычын аныктайт. Эгер Keycloak / RH-SSO колдонулса, KEY_ID колдонуңуз, MS AD FS үчүн CERT_SUBJECT, башкалар үчүн текшерип көрүп, башкасы иштебесе NONE колдонуңуз.
+clientScopeTypes.default=Демейки
+invalidateRotatedSecret=Алмаштырылган сырды жараксыз кылууну каалайсызбы?
+noDirectUsers=Түз колдонуучулар жок
+whoCanEditHelp=Эгер иштетилсе, колдонуучулар же администраторлор бул атрибутту көрө жана түзөтө алышат. Болбосо, жазууга уруксат берилбейт.
+eventTypes.LOGIN.name=Кирүү
+addressClaim.country.tooltip=Колдонуучу атрибутунун аталышы, ал 'address' токенинин ичинде 'country' субталапка чагылдырылат. Демейки мааниси 'country'.
+uuidLdapAttribute=UUID LDAP атрибуту
+scopeNameHelp=Клиент scope'тун аты. Realm ичинде уникалдуу болушу керек. Атта боштук болбошу керек, анткени ал scope параметри катары колдонулат.
+requiredUserActions=Талап кылынган колдонуучу аракеттери
+noConsentsText=Макулдуктар колдонуучу макулдукту талап кылган клиентке кирүүгө аракет кылганда гана жазылат. Андай учурда колдонуучуга клиентке уруксат берүү өтүнүчү менен макулдук барагы көрсөтүлөт.
+addStep=Кадам кошуу
+clientAssertionAudience=Клиенттин ыйгарым укуктар аудиториясы
+permissionPoliciesHelp=Бул уруксатка колдонулушу керек болгон бардык саясаттарды аныктайт.
+userInitiatedActionLifespanHelp=Колдонуучу тарабынан жиберилген аракетке (мисалы, сырсөздү унуттуңуз деген кат) чейинки максималдуу убакыт. Бул убакыт кыска болушу сунушталат, анткени колдонуучу мындай аракетке тез жооп берет деп күтүлөт.
+clearFileExplain=Бул файлды тазалоону каалап жатканыңызга ишенесизби?
+userModelAttribute=Колдонуучу модели атрибуту
+eventTypes.LOGOUT_ERROR.name=Чыгуу катачылыгы
+allowRemoteResourceManagement=Алыстан ресурстарды башкарууга уруксат берүү
+syncRegistrationsHelp=Жаңы түзүлгөн колдонуучулар LDAP сактагычта да түзүлүшү керекпи? Приоритет кайсы провайдер жаңы колдонуучуну шайкештештирүү үчүн тандаларын аныктайт. Бул жөндөө WRITABLE түзөтүү режими менен гана иштейт.
+resetPasswordAllowed=Сырсөздү унуттуңуз
+emptyExecution=Кадамдар жок
+passwordPolicyHintsEnabledHelp=Бул жөндөө MSAD жазууга уруксат берилген учурларда колдонулат. Ишке киргизилсе, MSAD колдонуучусунун сырсөзү LDAP_SERVER_POLICY_HINTS_OID кеңейтүүсү аркылуу жаңыртылат. Бул менен 'сырсөз тарыхы' же 'минималдуу сырсөз узактыгы' сыяктуу өркүндөтүлгөн саясаттар колдонулат. Бул кеңейтүү MSAD 2008 R2 же андан кийинки версиялар менен иштейт.
+expirationValueNotValid=Маани 1 же андан жогору болушу керек
+eventTypes.UPDATE_CONSENT.name=Макулдукту жаңыртуу
+forceArtifactBinding=Artifact binding'ди мажбурлоо
+eventTypes.REFRESH_TOKEN_ERROR.description=Белгини жаңыртуу катачылыгы
+eventTypes.IMPERSONATE.name=Башканы көрсөтүп иштөө
+updateFirstLogin=Биринчи кирүүнү жаңыртуу
+columnDisplayDescription=Түшүндүрмө көрсөтүү
+flowUsedBy=Бул агымды колдонуу
+client-updater-trusted-hosts.label=Ишенимдүү хосттор
+updateExecutorSuccess=Ишке киргизүүчү ийгиликтүү жаңыртылды
+ldapAttributeHelp=LDAP объектинин карталанган атрибутунун аты. Мисалы: 'cn', 'sn', 'mail', 'street' ж.б.
+assertionLifespan=Күтүлүүчү жашоо мөөнөтү
+export=Экспорттоо
+claimFilterNameHelp=Мыйзамдуу талаптын аты
+revocationDescription=Бул бардык активдүү сессияларды жана жеткиликтүү токендерди жокко чыгаруу жолу. 'Not before' - белгиленген күндөн мурун берилген токендерди жокко чыгарууга мүмкүндүк берет.
+eventTypes.CODE_TO_TOKEN_ERROR.description=Кодду токенге айлантуу катачылыгы
+termsOfServiceUrl=Кызмат көрсөтүү шарттарынын URL дареги
+requestObject.request_uri\ only=Тилкөө URL гана
+passwordPolicy=Сырсөз саясаты
+backchannelLogout=Арткы канал аркылуу чыгуу
+addressClaim.street.label=Көчө атрибутунун аты
+rolesScope=Эгер ролдун масштабы аныкталбаса, ар бир колдонуучу бул клиент масштабына мүмкүнчүлүк алат. Ролдун масштабы аныкталса, колдонуучу кеминде бир ролдун мүчөсү болушу керек.
+applyToResourceTypeFlag=Ресурстун түрүнө колдонуу
+offlineSessionIdleHelp=Оффлайн сессиянын токтоо убактысы, андан кийин мөөнөтү бүтөт. Бул аралыкта жоктоң токенин жок дегенде бир жолу жаңыртуу керек; анткени оффлайн сессия бүтөт.
+eventTypes.UPDATE_TOTP.description=TOTP жаңыртуу
+testError=LDAP менен туташууга аракет кылганда ката пайда болду: '{{error}}'
+groupObjectClassesHelp=Топ объектинин класс(тар). Көп болсо, үтүктөр менен бөлүнөт. Мисалы, LDAP үчүн 'groupOfNames'. Active Directoryде адатта 'group'.
+filterByClients=Клиенттер боюнча сүзүү
+claims=Талаптар
+createPolicyOfType={{policyType}} саясатын түзүү
+realmRolePrefix=Realm ролунун префикси
+flowUsedByDescription=Бул агым төмөнкү {{value}} тарабынан колдонулат
+createClientScope=Клиент масштабы түзүү
+includeRepresentation=Жашоо мүмкүнчүлүгүн камты
+expireTimeHelp=Саясаттын жарактуулук мөөнөтү бүтө турган убакытты аныктайт. Учурунда же анын алдында гана уруксат берилет.
+singleLogoutServiceUrl=Бирдиктүү чыгуу кызматынын URL дареги
+noRolesInstructions-roles=Бул realmде ролдор түзүлгөн эмес. Баштоо үчүн рол түзүңүз.
+editIdPMapper=Identity Provider Mapperди түзөтүү
+representation=Жашоо мүмкүнчүлүгү
+remove=Өчүрүү
+userProfile=Колдонуучу профили
+unmanagedAttributes=Башкарылбаган атрибуттар
+unmanagedAttributesHelpText=Башкарылбаган атрибуттар - колдонуучу профилинин конфигурациясында ачык белгиленбеген атрибуттар. \
+Демейки боюнча, башкарылбаган атрибуттар `Өчүрүлгөн` болуп эсептелет жана каттоодон, аккаунттон, башкаруу консолунан жеткиликтүү эмес. \
+`Иштетилген` кылсаңыз, сервер аларды толук тааныйт жана бардык контексттерде жеткиликтүү болот. Бул эски realmди декларативдүү колдонуучу профилине которууну баштаганда пайдалуу. \
+`Факультативдүү администрациянын жазуусу` орнотулса, атрибуттарды жөн гана администраторлор гана башкарса болот, колдонуучулардын башкаруусундагы кээ бир өзгөчөлүктөрдү сактап калуу үчүн ылайыктуу. \
+`Факультативдүү администрациянын көрүүсү` орнотулса, атрибуттар окууга гана жеткиликтүү болуп, башкаруу консолу жана API аркылуу гана көрүлөт.
+unmanagedAttributePolicy.DISABLED=Өчүрүлгөн
+unmanagedAttributePolicy.ENABLED=Иштетилген
+unmanagedAttributePolicy.ADMIN_VIEW=Факультативдүү администрация гана көрө алат
+unmanagedAttributePolicy.ADMIN_EDIT=Факультативдүү администрация гана жаза алат
+confirmPasswordDoesNotMatch=Сырсөз менен ырастоо дал келбейт.
+eventTypes.DELETE_ACCOUNT_ERROR.description=Аккаунтту өчүрүү катачылыгы
+provider=Провайдер
+flows=Агымдар
+passwordPoliciesHelp.length=Сырсөз үчүн минималдуу символдордун саны.
+root=Тамыр
+removeImportedUsersSuccess=Импорттолгон колдонуучулар өчүрүлдү.
+eventTypes.VERIFY_PROFILE_ERROR.name=Профилди текшерүү катачылыгы
+signAssertionsHelp=SAML документтериндеги күтүлүүлөр кол коюлушу керекпи? Эгер документтер мурунтан кол коюлган болсо, бул орнотуу керек эмес.
+authnContextClassRefsHelp=Суроолгон AuthnContext ClassRefs тизмеси (тартиптүү).
+sessionsType.directGrant=Түздөн-түз ыйгарым укук берүү
+validateSignature=Кол тамгаларды текшерүү
+useLowerCaseBearerType=Токен жоопторунда кичине тамгалардагы bearer түрүн колдонуу
+useRfc9068AccessTokenType=Кирүү токенинин башында "at+jwt" түрүн колдонуу
+headers=Баштар
+ldapAttributeNameHelp=Каттоо учурунда жаңы колдонуучуга кошулган LDAP атрибутунун аты.
+createAGroup=Топ түзүү
+effectiveProtocolMappersHelp=Бардык демейки клиент масштабдарын жана тандалган кошумча масштабдарды камтыйт. Бул масштабдардагы бардык протокол карталагычтар жана ролдун масштабдары колдонуучуга берилген жеткиликтүү токенди түзүүдө колдонулат.
+exportSuccess=Realm ийгиликтүү экспорттолду.
+scopePermissions.groups.manage-description=Администратор бул топту башкарууга укугу бар-жогун аныктаган саясаттар
+testClusterFail=Текшерилген жеткиликтүүлүк ишке ашпады: {{failedNodes}}. Ката топтук түйүндөрдү оңдоңуз же каттоодон алып таштаңыз жана кайра аракет кылыңыз
+eventExplain=Иш-чаралар - бул колдонуучу жана администратор иш-чараларынын жазуулары. Бул иш-чараларды көзөмөлдөө үчүн <1>Иш-чараларды жөндөө</1> бөлүмүнө кириңиз.
+queryExtensions=Суроо колдоого алынган кеңейтүүлөр
+signingKeysConfig=Кол коюу ачкычтарынын конфигурациясы
+validateBindDn=LDAP администраторунун DN киргизилиши керек
+addedGroupMembership=Топко мүчөлүк кошулду
+resourceDeletedSuccess=Ресурс ийгиликтүү өчүрүлдү
+userObjectClasses=Колдонуучу объектинин класстары
+useRefreshTokensHelp=Эгер күйгүзүлгөн болсо, refresh_token түзүлүп токен жоопуна кошулат. Өчүрүлгөн болсо refresh_token түзүлбөйт.
+getStarted=Баштоо үчүн төмөнкү тизмеден провайдерди тандаңыз.
+times.hours=Сааттар
+signedJWTConfirm=Ачкычтар бөлүмүнөн кардар үчүн жеке ачкыч жана сертификат түзүңүз.
+permit=Рухсат берүү
+webOrigins=Веб келип чыгуучулар
+searchAdminEventsBtn=Администратор иш-чараларын издөө
+deleteDialogDescription=Сиз <1>{{group}}</1> атрибуттар тобун туруктуу өчүргүңүз келеби?
+importResourceSuccess=Ресурс ийгиликтүү импорттолду
+inputTypeCols=Киргизүү багыттары
+eventTypes.LOGOUT.description=Чыгуу
+deleteNodeBody=Сиз "{{node}}" түйүнүн туруктуу өчүргүңүз келеби?
+lifespan=Жарактуулук мөөнөтү
+storedTokensReadableHelp=Жаңы колдонуучулар сакталган токендерди окууга укуктуу же укуксуз болушу үчүн күйгүзүңүз/өчүрүңүз. Бул broker.read-token ролун дайындайт.
+authenticationFlowTypeHelp=Бул кандай форма?
+usersAdded_one={{count}} колдонуучу топко кошулду
+resourcesAndScopes=Ресурстар жана масштабдар
+editUsernameHelp=Эгер күйгүзүлгөн болсо, колдонуучунун аты түзөтүлөт, болбосо окуу үчүн гана.
+eventTypes.UPDATE_CONSENT_ERROR.description=Макулдашууну жаңыртуу катачылыгы
+overrideActionTokensHelp=Колдонуучу жиберген уруксаттын (мисалы, сырсөздү унутуу электрондук почтасы) мөөнөтүн белгилүү бир иш-чара үчүн көзөмөлдөөчү демейки параметрлерди алмаштыруу. Бул маанинин кичине болушу сунушталат, анткени колдонуучунун ыктыярдуу иш-аракетке тез жооп берүүсү күтүлөт.
+searchByName=Аты боюнча издөө
+executorTypeSwitchHelpText=Ишке киргизүүчү түрүн которуу боюнча жардам
+attributeConsumingServiceNameHelp=SP метадаанасында жарнамалоочу Атрибутту колдоочу кызматтын профилинин аты.
+overrideActionTokens=Иш-аракет токендерин алмаштыруу
+deleteGrantsError=Рухсаттарды өчүрүүдө ката пайда болду: {{error}}
+defaultGroupAdded_other={{count}} топ демейки топторго кошулду
+used.SPECIFIC_CLIENTS=Белгиленген кардарлар
+freeMemory=Бош жер
+applyPolicy=Саясатты колдонуу
+userFedDeleteConfirm=Эгер сиз бул колдонуучу федерация провайдерин өчүрсөңүз, бардык тиешелүү маалыматтар жок кылынат.
+directGrantHelp=Түз жеткирүү аутентификациясы үчүн колдонмо агымын тандаңыз.
+unlockUsersSuccess=Убакыттуу кулпуланган колдонуучулардын баары бошотулду
+jsonType.tooltip=Токенде json доосу үчүн колдонулуучу JSON тиби. long, int, boolean, String жана JSON жарактуу маанилер.
+emptyPrimaryAction=Алдын ала аныкталган карталагычты кошуу
+enableClientSignatureRequired=«Кардардын кол коюусу талап кылынат» күйгүзүлсүнбү?
+supportedApplicationsHelp=Азыркы OTP саясаты менен иштейт деп белгилүү колдонмолор.
+enableStartTLS=StartTLS күйгүзүү
+syncModeOverride=Синхрондоштуруу режими боюнча көзөмөлдөө
+addAssociatedRolesError=Ролдорду байланыштыруу мүмкүн болбоду: {{error}}
+removeUserText={{numSelected}} колдонуучуну өчүргүңүз келеби? Бул колдонуучулар {{role}} ролунун жана ага байланыштуу ролдордун уруксаты болбойт.
+diagramView=Диаграмма көрүнүшү
+removeImportedUsers=Импорттолгон колдонуучуларды өчүрүүбү?
+accountLinkingOnly=Тек гана эсепти байланыштыруу
+clientPoliciesPoliciesHelp=Кардар саясаты кардар профилдерин ар кандай шарттар менен байланыштырып, белгилүү бир кардар профилинин аткаруучулары тарабынан иш жүзүнө ашырылган жөндөмдүүлүктү аныктоого мүмкүнчүлүк берет.
+anyClient=Шарт ар кандай окуяда ар кандай кардарга туура келет.
+editFlow=Агымды түзөтүү
+noDefaultGroupsInstructions=Демейки топтор жаңы колдонуучу түзүлгөндө же <1>идентификация брокерлиги</1> аркылуу импорттолгон сайын автоматтык түрдө топ мүчөлүгүн берүүгө мүмкүндүк берет. Баштоо үчүн демейки топторду кошуңуз.
+tokenSaveSuccess=Жаңы баштапкы жеткиликтүү токен түзүлдү
+usermodel.attr.label=Колдонуучу атрибуту
+eventTypes.REGISTER.name=Катталуу
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=Колдонуучу туруктуу кулпулоо менен өчүрүлгөн
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=Колдонуучуну туруктуу кулпулоо катачылыгы
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=Колдонуучу убактылуу кулпулоо менен өчүрүлгөн
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=Колдонуучуну убактылуу кулпулоо катачылыгы
+deleteUser=Колдонуучуну өчүрүү
+addedNodeSuccess=Түйүн ийгиликтүү кошулду
+eventTypes.INTROSPECT_TOKEN_ERROR.description=Токенди текшерүү катасы
+webAuthnPolicyUserVerificationRequirementHelp=Аутентификаторго колдонуучуну текшерүү керекпи же жокпу билдирет.
+syncModes.import=Импорт
+realmSaveError=Realm жаңыртууда ката пайда болду: {{error}}
+authDataDescription=Бул авторизация суроосунун жыйынтыгында берилген авторизация маалыматтарын камтыган токенди билдирет. Бул Keycloak кардарларга уруксат сураганда берген негизги билдирүү. Азыркы авторизация суроосу боюнча берилген уруксаттарды `authorization` доосунан текшериңиз.
+allowRemoteResourceManagementHelp=Ресурстарды ресурстар сервери алыстан башкаруусу керекпи? Эгер жок болсо, ресурстарды гана бул Админ UI аркылуу башкарса болот.
+generatedAccessTokenIsDisabled=Колдонуучу тандалбаса, түзүлгөн жеткиликтүү токен өчүрүлөт
+addNewProvider=Жаңы провайдерди кошуу
+userInfoResponseEncryptionKeyManagementAlgorithm=Колдонуучу маалыматтарын жооп шифрлөөнүн ачкыч башкаруу алгоритми
+changedUsersSyncPeriod=Өзгөртүлгөн колдонуучуларды синхрондоштуруу мезгили
+keystoreHelp=Ачкычтар файлынын жолу
+userRegistration=Колдонуучу каттоо
+save=Сактоо
+helpFileUploadClient=JSON же XML файлды жүктөө
+generateSuccess=Жаңы ачкыч жупту жана сертификатты ийгиликтүү түздү
+userAttributeValueHelp=Ката жазууну каалаган маанисиңиз
+whoCanViewHelp=Күйгүзүлгөндө, колдонуучулар же администраторлор атрибутту көрө алышат. Болбосо, аларга атрибутка кирүү уруксат берилбейт.
+eventTypes.IDENTITY_PROVIDER_LOGIN.description=Аутентификация провайдери аркылуу кирүү
+includeClients=Кардарларды кошуу
+copySuccess=Көчүрүлдү!
+eventTypes.LOGOUT_ERROR.description=Чыгуу катасы
+clientProfilesHelp=Бул саясатка колдонулган кардар профилдери.
+deleteClientPolicyError=Саясатты өчүрүү мүмкүн болбоду: {{error}}
+selectAttribute=Атрибутту тандаңыз
+resourceAttributeHelp=Ресурска байланышкан атрибуттар.
+updateCredentialUserLabelSuccess=Колдонуучу белгиси ийгиликтүү өзгөртүлдү.
+product=Продукт
+credentialUserLabel=Колдонуучу белгиси
+passwordPoliciesHelp.passwordBlacklist=Кара тизмеде болгон сырсөздү колдонууга тыюу салат.
+bindTypeHelp=LDAP байланыштыруу учурунда колдонулган аутентификация ыкмасынын түрү. LDAP серверине жөнөтүлгөн суроолордо колдонулат. Азырынча 'none' (анонимдүү LDAP аутентификациясы) же 'simple' (колдонмо аутентификация + сырсөз) механизмдери бар.
+whoWillAppearPopoverText=Топтор иерархиялык түзүлөт. Эгер түз мүчөлүктү тандасаңыз, анда колдонуучу кошулган балдар тобун гана көрөсүз. Бүткүл ата-топтор киргизилбейт.
+eventTypes.VERIFY_EMAIL.description=Электрондук почтаны текшерүү
+eventTypes.REFRESH_TOKEN_ERROR.name=Жаңылоо токени катасы
+partialImportHeaderText=Жарым-жартылай импорт колдонуучуларды, кардарларды жана башка ресурстарды мурун экспорттолгон JSON файлдан импорттоого мүмкүндүк берет.
+disableSuccess=Провайдер ийгиликтүү өчүрүлдү
+validatingPublicKeyIdHelp=Жогоруда көрсөтүлгөн текшерүүчү ачык ачкычтын IDси. Бош калтырсаңыз, жогорудагы ачкыч ар дайым колдонулат, тышкы IDP берген ачкыч IDге карабай; эгерде ачкыч ID тышкы IDP менен дал келсе гана колдонулушу керек болсо, бул талааны толтуруңуз.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Аутентификация провайдери аккаунт байланышы катасы
+subtree=Төмөнкү дарак
+userFederation=Колдонуучу федерациясы
+effectiveRoleScopeMappingsHelp=Тандалган кошумча кардар аймактары, бул кардар үчүн жеткиликтүү токен чыгарууда колдонулат. Жогоруда OAuth аймак параметринин кайсы мааниси колдонулушу керектиги көрсөтүлгөн.
+disable=Өчүрүү
+membershipLdapAttribute=Мүчөлүк LDAP атрибуту
+availableIdPs=Колдонулуучу аутентификация провайдерлери
+updateClientConditionSuccess=Шарт ийгиликтүү жаңыртылды.
+attributes=Атрибуттар
+roleDeleteConfirmDialog=Бул аракет {{selectedRoleName}} ролун толук өчүрөт. Бул кайра калыбына келтирилбейт.
+clientDelete= {{clientId}} кардарын өчүрүүбү?
+userDeletedSuccess=Колдонуучу өчүрүлдү
+revokeClientScopesTitle=Бардык берилген кардар аймактарын жокко чыгаруу?
+contentSecurityPolicyReportOnlyHelp=Контент коопсуздук саясатын текшерүү үчүн <1>Көбүрөк билүү</1>
+eventTypes.PERMISSION_TOKEN.description=Уруксат токени
+allow-default-scopes.label=Демейки аймактарды уруксат берүү
+minuteHelp=Саясат берилиши керек болгон мүнөттү аныктайт. Экинчи талааны толтурсаңыз, диапазон аныкталат. Мындай учурда уруксат учурдагы мүнөт эки маанинин арасында же ага барабар болгондо гана берилет.
+updateCibaSuccess=CIBA саясаты ийгиликтүү жаңыртылды
+newRoleNameHelp=Жаңы рольдун аталышы. Жаңы аталыш жеткиликтүү токендеги роль кайсы жерде картага түшөрүн көрсөтөт. Мисалы, 'myapp.newname' жаңы аталышы ролду жеткиликтүү токендеги ошол позицияга картага түшүрөт. 'newname' болсо рольду realm ролдоруна картага түшүрөт.
+mapperTypeFullNameLdapMapper=толук-ат-ldap-карталагыч
+searchUserByAttributeMissingKeyError=Атрибуттун ачкычын көрсөтүңүз
+eventTypes.INVALID_SIGNATURE.name=Кол коюу жараксыз
+topLevelFlowTypeHelp=Кайсы деңгээлдеги агым экенин аныктаңыз. 'client' түрү кардарларды (колдонмолорду) аутентификациялоодо колдонулат, generic түрү колдонуучуларга жана башка бардык учурларга.
+authDetailsHelp=Бул ресурс сервер үчүн бардык ресурстарды экспорттоо жана жүктөө.
+policyProvider.regex=Уруксаттарыңыз үчүн regex шарттарын аныктаңыз.
+clientImportError=Кардарды импорттоо мүмкүн болбоду: {{error}}
+members=Мүчөлөр
+scopePermissions.clients.token-exchange-description=Бул саясаттар кайсы кардарлар токен алмашуусуна уруксат алаарын аныктайт, ал токен бул кардарга багытталган.
+realmCertificateAliasHelp=Realm сертификаты архивде да сакталат. Бул анын алиасы.
+scopePermissions.roles.map-role-client-scope-description=Бул саясаттар администратордун бул ролду кардардын кардар аймагына колдонуу укугун аныктайт.
+createIdentityProviderError=Аутентификация провайдерин түзүү мүмкүн болбоду: {{error}}
+eventTypes.SEND_VERIFY_EMAIL_ERROR.description=Текшерүү электрондук почтасын жөнөтүү катасы
+deleteClientPolicyConfirm=Бул аракет {{policyName}} саясатын толук өчүрөт. Бул кайра калыбына келтирилбейт.
+cibaAuthRequestedUserHint=CIBA аутентификация суралган колдонуучу
+samlKeysExportError=Ачкычтарды экспорттоо мүмкүн болбоду: {{error}}
+webAuthnPolicyCreateTimeout=Убакыт чыкты
+comparison=Салыштыруу
+passwordPoliciesHelp.digits=Сырсөздө талап кылынган сандык символдордун саны.
+deletedSuccessClientScope=Кардар аймагы ийгиликтүү өчүрүлдү
+notAllowedToDeleteAllClientScopes=Бардык кардар аймактарын өчүрүүгө уруксат жок.
+columnDisplayName=Көрсөтүү аталышы
+noUsersFoundErrorStorage=Колдонуучулар табылган жок, мүмкүн федерацияланган провайдер туура эмес конфигурацияланган: {{error}}
+lookAround=Жанынан карап чыгуу
+storeTokensHelp=Токендер колдонуучуларды аутентификациялаган соң сакталуусу керекпи же жокпу күйгүзүү/өчүрүү.
+revert=Кайтаруу
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=Аутентификация провайдери токенди алуу
+dependentPermission=Тутумдук уруксат
+disableNonce=Nonce'ту өчүрүү
+disableTypeClaimCheck=Түрдүн талабынын текшерүүсүн өчүрүү
+addAssociatedRolesSuccess=Тийиштүү ролдор кошулду
+groupDeleted_one=Топ өчүрүлдү
+userHelp=Мисал катары жеткиликтүү токенди түзүү үчүн колдонуучуну тандасаңыз болот. Эгерде колдонуучу тандалбаса, мисал токен түзүлбөйт.
+loginScreenCustomization=Кирүү экранын ыңгайлаштыруу
+policiesConfigType=Конфигурациялоо жолу\:
+exportWarningTitle=Экспорт кылууда этият болуңуз
+emailVerifiedHelp=Колдонуучунун электрондук почтасы текшерилгенби?
+duplicateFlow=Агымдын көчүрмөсү
+addExecution=Аткарууну кошуу
+noSearchResultsInstructions=Жогорудагы издөө тилкесине кайра издөөнү баштаңыз
+addedNodeFail=Түйүндү кошуу мүмкүн болбоду\: '{{error}}'
+groupMembership=Топтун мүчөлүгү
+maxLength=Максималдуу узундук {{length}}
+prompts.unspecified=Белгиленбеген
+revokeClientScopes=Бардык берилген кардар аймактарын {{clientId}} үчүн жокко чыгаргыңыз келеби?
+cibaBackhannelTokenDeliveryModes.poll=Сурамжылоо
+policies=Саясаттар
+parentClientScope=Ата-энеси кардар аймагы
+reorder=Тезимди өзгөртүү
+allTypes=Бардык түрлөр
+backchannelLogoutSessionRequired=Backchannel чыгуу сессиясы талап кылынат
+ldapFilter=LDAP фильтри
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=Суранычты ыйгаруу катасы
+editAttribute=Атрибутту түзөтүү
+webAuthnPolicyRpEntityNameHelp=WebAuthn ишенимдүү тарап үчүн адам окуган сервердин аты
+postBrokerLoginFlowAlias=Кирүүдөн кийинки агым
+refreshTokenMaxReuse=Жаңылоо токенин максималдуу колдонуу саны
+partialExportHeaderText=Жарым-жартылай экспорт realm конфигурациясын жана байланышкан ресурстарды JSON файлга экспорттоого мүмкүндүк берет.
+clientScopes=Кардар аймактары
+loadingRealms=Realmдер жүктөлүүдө…
+eventTypes.SEND_RESET_PASSWORD_ERROR.description=Сырсөздү калыбына келтирүү катасын жөнөтүү
+httpPostBindingLogout=HTTP-POST байланышы аркылуу чыгуу
+updateTranslationSuccess=Ийгиликтүү\! Текст жаңыртылды.
+permissionDescription=Бул уруксаттын сүрөттөлүшү.
+policyClientHelp=Бул саясат кайсы кардарларга уруксат берет.
+multivalued.label=Көп маанилүү
+buildIn=Ички
+roleCreateExplain=Бул сүрөттөмө
+scopePermissions.identityProviders.token-exchange-description=Бул саясаттар кайсы кардарлар бул аутентификация провайдери тарабынан берилген тышкы токен үчүн токен алмашуусуна уруксат алаарын аныктайт.
+algorithmNotSpecified=Алгоритм көрсөтүлгөн жок
+jwtX509HeadersEnabled=JWTге X.509 баштарын кошуу
+rememberMe=Мени эстеп калуу
+flow.registration=Каттоо агымы
+flow.firstBrokerLogin=Биринчи брокер кирүү агымы
+showLess=Аз көрсөтүү
+registeredClusterNodes=Катталган кластердик түйүндөр
+connectionAndAuthenticationSettings=Туташуу жана аутентификациялоо жөндөөлөрү
+deleteConfirmUsers=Колдонуучуну өчүрүүбү?
+storePassword=Сырсөздү сактоо
+defaultGroups=Демейки топтор
+eventTypes.TOKEN_EXCHANGE_ERROR.name=Токен алмашуу катасы
+flow.browser=Браузер агымы
+unlinkUsersSuccess=Колдонуучулардын байланышын үзүү ийгиликтүү аяктады.
+addressClaim.street.tooltip='address' токен ичиндеги 'street_address' подталабына карта үчүн колдонулган колдонуучу атрибутунун аталышы. Адатта 'street'.
+webAuthnPolicyCreateTimeoutHint=Убакыт 0 секунддан 8 саатка чейин болушу керек.
+addValidator=Текшерүүчү кошуу
+attributeImporter=SAML атрибуту бар болсо аны көрсөтүлгөн колдонуучу касиетине же атрибутуна импорттоо.
+userInfoSettings=Колдонуучу маалыматынын жөндөөлөрү
+createAttributeError=Ката\! Колдонуучу профилинин конфигурациясы сакталган жок {{error}}.
+password=Сырсөз
+eventTypes.VERIFY_EMAIL.name=Электрондук почтаны тастыктоо
+httpPostBindingResponseHelp=Суранычтарга HTTP-POST байланышы аркылуу жооп берүүнү көрсөтөт. Эгер туура эмес болсо, HTTP-REDIRECT байланышы колдонулат.
+artifactBindingResponseHelp=Суранычтарга ARTIFACT байланышы аркылуу жооп берүүнү көрсөтөт. Эгер туура эмес болсо, HTTP-POST байланышынын конфигурациясы колдонулат.
+mapperTypeHardcodedAttributeMapper=тууралап коюлган-атрибут-маппер
+eventTypes.IMPERSONATE.description=Адамдын атынан аракет кылуу
+forbidden_other=Тыйылган, уруксаттар керек\:
+clientAuthorization=Ырастоо
+identityProvidersPermissionsHint=Бул рольду башкаруу үчүн майда уруксаттар күйгүзүлгөнбү аныктоо. Өчүрүү учурдагы бардык уруксаттарды өчүрөт.
+removeMappingConfirm_other=Чын эле {{count}} ролду алып салгыңыз келеби
+kerberosWizardDescription=Бул жерде текст керек.
+welcome=Кош келиңиз
+events=Иш-чаралар
+importHelp=Бул ресурстар серверине уруксат жөндөөлөрү бар JSON файлын импорттоо.
+mapperType=Маапердин түрү
+importResources=Төмөнкү жөндөөлөр жана маалыматтар импорттолот\:
+validateConnectionUrl=Туташуу URL дарегин киргизишиңиз керек
+attributeConsumingServiceIndexHelp=Аутентификация учурунда суралышы керек болгон Атрибут Калыптоо Кызмат профилинин индекси.
+clientSessionSettings=Кардар сессиясынын жөндөөлөрү
+cibaAuthRequestedUserHintHelp=Аутентификация суралып жаткан акыркы колдонуучуну аныктоо жолу. Азырынча "login_hint" гана колдонот.
+leaveGroupConfirmDialog_other=Чын эле {{username}} адамды {{count}} тандалган топтон чыгаргыңыз келеби?
+createTokenHelp=Баштапкы жетүү токенин кардарларды түзүү үчүн гана колдонсо болот.
+removeImportedUsersError=Импорттолгон колдонуучуларды алып салуу мүмкүн болбоду\: '{{error}}'
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=OAuth2 түзмөк коду токенге айландырууда ката
+typeHelp=Кардарлар түзүлгөндө аларга демейки кардар аймактары кошулат.
+linkedIdPs=Байланышкан аутентификация провайдерлери
+htmlDisplayName=HTML көрсөтүлгөн аталыш
+groupObjectClasses=Топтун объект класслары
+requiredActionPlaceholder=Аракетти тандаңыз
+bindCredentials=Креденциалдарды байлоо
+logoutSettings=Чыгуу жөндөөлөрү
+validateServerPrincipal=Сервер башчысын киргизишиңиз керек
+addMessageBundle=Кабарлар пакетин кошуу
+realmName=Realm аталышы
+searchEventType=Сакталган иш-чара түрүн издөңүз
+idpInitiatedSsoRelayStateHelp=SAML сурамы менен жөнөтүлө турган Relay абалы (IDP Башталган SSO үчүн).
+otpHashAlgorithmHelp=OTP түзүү үчүн колдонулган хеш алгоритми
+joinGroup=Топко кошулуу
+eventTypes.REMOVE_TOTP_ERROR.description=TOTP алып салууда ката
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Аракет токенин аткарууда ката
+unlinkAccountConfirm=Бул аккаунтту {{provider}} менен туруктуу ажыратып салгыңыз келеби?
+x509CertificateHelp=X509 сертификаты PEM форматында коддолгон
+samlEndpointsLabel=SAML 2.0 Кызмат Провайдер Метадатасы
+passCurrentLocaleHelp=Учурдагы тилди identity providerге ui_locales параметри катары өткөрүү.
+lessThan=Бул {{value}} ден аз болушу керек
+webAuthnPolicyRequireResidentKeyHelp=Аутентификаторго коомдук ачкычты Discoverable Credential катары түзүү керекпи деп билдирет.
+logoutServiceRedirectBindingURL=Чыгуу кызматын багыттоо URL
+createIdentityProviderSuccess=Аутентификация провайдери ийгиликтүү түзүлдү
+emptyMappersInstructions=Эгерде мааперлерди кошкуңуз келсе, төмөнкү баскычты басып алдын ала түзүлгөн мааперлерди же жаңы мааперди конфигурациялоону баштаңыз.
+dayMonth=Күн
+clientRolesHelp=Бул шарт саясат колдонулушу үчүн кардарда белгиленген кардар ролдорунун бар экенин текшерет. Бул кардар администраторуна белгилүү бир аталыштагы кардар ролун түзүүгө мүмкүндүк берет, ошондо саясат ушул кардардын сурамдарына колдонулат. Бул шарт көпчүлүк OpenID Connect сурамдары учурунда текшерилет (Ырастоо, токен, жана башкалар).
+validatingX509Certs=X509 сертификаттарын текшерүү
+eventTypes.CLIENT_UPDATE.description=Кардарды жаңылоо
+searchInitialAccessToken=Баштапкы жетүү токенин издөө
+guiOrder=Көрсөтүү тартиби
+friendlyName=Ыңгайлуу издөөгө атрибуттун аталышы. Бош калтыра аласыз же аталышты көрсөтсөңүз болот.
+testSuccess=LDAPке ийгиликтүү туташуу болду
+userInfoUrl=Колдонуучу маалыматы URL
+displayOnConsentScreen=Макулдук экранда көрсөтүү
+noClientPolicies=Кардар саясаты жок
+defaultAdminInitiatedActionLifespanHelp=Администратор тарабынан колдонуучуга жиберилген уруксаттын мөөнөтү. Мөөнөт узун болушу сунушталат, анткени администраторлор оффлайн болгон колдонуучуларга электрондук кат жибере алат. Демейки мөөнөт токен чыгаруудан мурун өзгөртүлүшү мүмкүн.
+syncUsersSuccess=Колдонуучулар синхрондолду
+updatedCredentialMoveError=Колдонуучу Credential жөндөөлөрү сакталган жок: {{error}}
+searchForRoles=Ролду аты боюнча издөө
+refresh=Жаңыртуу
+roleDeletedSuccess=Роль өчүрүлдү
+advancedClaimToRole=Эгер бардык талаптар аткарылса, колдонуучуга белгиленген realm же client ролу берилет.
+directGrant=Түз берилиш агымы
+maxLifespanHelp=Кэш жазмасынын максималдуу өмүрү миллисекунд менен
+associatedRolesModalTitle={{name}} үчүн ролдорду кошуу
+nameIdFormatHelp=Subject үчүн колдонулуучу аты ID формат
+detailsHelp=Бул деталдар тууралуу маалымат
+adminEvents=Администратордун окуялары
+serviceAccountHelp=Бул клиентти Keycloak'ко аутентификациялоо жана ага арналган жеткиликтүү токенди алуу мүмкүнчүлүгүн берет. OAuth2 спецификациясы боюнча бул 'Клиент Credentials Grant' колдоосу
+standardTokenExchangeEnabledHelp=Бул клиент үчүн Стандарттык Токен алмашууну V2 күйгүзүү
+enableRefreshRequestedTokenTypeHelp=Стандарттык Токен алмашуу V2де refresh token суралышы мүмкүнчүлүгүн көзөмөлдөйт. Эгер "Жок" болсо (демейки), refresh token суранышы тыюу салынат жана ката кайтарылат. Эгер "Бир эле сессия" болсо, кайтарылган refresh token subject токендин сессиясы менен дал келет, ал сессия жок болсо ката кайтарылат.
+sameSession=Бир эле сессия
+urisHelp=Ресурсту коргогон URIлердин жыйнагы
+eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Идентификация провайдеринин жооптору
+confirmClientSecretTitle=Бул клиент үчүн сырсөздү кайра түзгүңүз келеби?
+serverPrincipal=Сервердин башчысы
+deleteConfirmGroup_one=Бул топту өчүрүүүңүзгө ишенесизби '{{groupName}}'?
+signDocuments=Документтерге кол коюу
+noTokens=Баштапкы жеткиликтүү токендер жок
+addMapper=Маппер кошуу
+webauthnPolicy=Webauthn саясаты
+userAttributeName=User атрибутунун аты SAML атрибутун сактоо үчүн. email, lastName, firstName колдонсо болот
+displayDescription=Сүрөттөө көрсөтүү
+eventTypes.DELETE_ACCOUNT.description=Аккаунт өчүрүү
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=Аутентификацияны кайра баштоодо ката
+evictionHour=Чыгарып жиберүү сааты
+onDragFinish=Жөнөтүү аяктады {{list}}
+otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+ldapMappersList=LDAP Мапперлери
+bindDnHelp=LDAP администратору DN, Keycloakтун LDAP серверине кирүүсү үчүн колдонулат
+newClientProfileName=Клиент профилинин аты
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=OAuth2 device code токенге айландырууда ката
+eventTypes.TOKEN_EXCHANGE.description=Токен алмашуу
+continue=Улантуу
+editProvider=Провайдерди түзөтүү
+included.client.audience.label=Кошулган клиент аудиториясы
+backchannelLogoutUrlHelp=Бул URL аркылуу realmге logout сурамы жөнөтүлгөндө клиент өзү өчүрүлөт. Logout OIDC Backchannel logout спецификациясына ылайык токен менен ишке ашат. Эгер бул URL жок болсо, logout сурамы 'Админ URL' аркылуу жөнөтүлүшү мүмкүн. Админ URL да жок болсо, logout сурамы жиберилбейт.
+updateScopeSuccess=Авторизация чөйрөсү ийгиликтүү жаңыртылды
+userInfoResponseEncryptionKeyManagementAlgorithmHelp=User Info Endpoint жоопторун шифрлөөнүн ачкыч башкаруу алгоритми. Эгер бош болсо, жооптор шифрленбейт.
+authnContextDeclRefsHelp=Талап кылынган AuthnContext DeclRefs тизмеси
+inherent=Мурас катары алынган
+tableTitle=Атрибут топтору
+generateNewKeys=Жаңы ачкычтар түзүү
+updateClientPolicySuccess=Клиент саясаты ийгиликтүү жаңыртылды
+unlock=Ачуу
+validateRealm=Realmди киргизишиңиз керек
+attributeValue=Атрибуттун мааниси
+eventTypes.CLIENT_DELETE_ERROR.description=Клиент өчүрүүдө ката
+clientScopesHelp=Бул шарт саясаты кайсы клиенттерге тиешелүү экенин аныктоо үчүн колдонуучу клиенттин алдын ала сураган же берилген чөйрөлөрүн колдонуп бааланат. Бул шарт OpenID Connect ырастоо жана токен сурамдарында колдонулат.
+revokeRefreshToken=Refresh токенди жок кылуу
+mappingUpdatedSuccess=Маапер ийгиликтүү жаңыртылды
+logoUrlHelp=Клиент тиркемесинин логотибинин URL дареги
+operationTypes=Иштөө түрлөрү
+loginWithEmailAllowed=Email менен кирүүгө уруксат
+expireTime=Мөөнөтү бүткөн убакыт
+requestObject.request\ or\ request_uri=Сурам же Request URI
+policyProvider.user=Саясаттын шарттарын аныктоо, кайсы колдонуучуларга объектке кирүүгө уруксат берилет
+protocolTypes.oid4vc=OpenID үчүн Ырасталган Credentials
+protocolTypes.openid-connect=OpenID Connect
+clientTypeHelp='OpenID Connect' Клиенттерге Аутентификация серверинин аткарган аутентификациясы менен колдонуучунун инсанын тастыктоого мүмкүнчүлүк берет. 'SAML' веб-аутентификация жана уруксат берүү сценарийлерин, анын ичинде домен аралык Single Sign-On (SSO) колдонот жана коопсуздук токендери аркылуу билдирүүлөрдү өткөрөт.
+addOpenIdProvider=OpenID Connect провайдерин кошуу
+memory=Жадоо
+cpu=Процессор
+processorCount=Процессорлордун саны
+eventTypes.CLIENT_LOGIN.name=Клиент кирүүсү
+mapper.nameid.format.tooltip=Бул мапперди колдонуу үчүн келген AuthnRequestтин NameID форматы ушул мааниге тең болушу керек.
+hideOnLoginPageHelp=Эгер жашырылса, бул провайдер менен кирүү жалгыз 'kc_idp_hint' параметрин колдонуудан кийин гана мүмкүн.
+eventTypes.UPDATE_PROFILE.description=Профилди жаңыртуу
+assignRolesTo={{client}} үчүн {{type}} ролдорун дайындаңыз
+orderChangeError=Идентификатор провайдерлеринин көрсөтүү тартибин өзгөртүү мүмкүн болгон жок {{error}}
+policyProvider.client-scope=Сиздин уруксаттар үчүн шарттарды аныктаңыз, кайсы бир же бир нече клиент чөйрөсүнө объектке жетүүгө уруксат берилет.
+secretExpiresOn=Сырсөз мөөнөтү бүткөн убакыт {{time}}
+searchClientByName=Клиентти аты боюнча издөө
+loginTimeout=Кирүү убактысы бүткөн
+attributeName=Атрибут [Аты]
+updateError=Провайдерди жаңыртуу мүмкүн болгон жок {{error}}
+importUsersHelp=Эгер туура болсо, LDAP колдонуучулары Keycloak базасына импорттолот жана конфигурацияланган синхрондоштуруу саясаты боюнча синхрондолот.
+emptyClientProfilesInstructions=Профильдер жок, жаңы профиль түзүү үчүн 'Клиент профилин түзүү' тандаңыз
+policyProvider.js=Уруксаттар үчүн шарттарды JavaScript менен аныктаңыз. Бул Keycloak колдогон эрежеге негизделген саясаттын түрү болуп, баардык саясаттарды Evaluation API аркылуу жазууга мүмкүнчүлүк берет.
+idpType.social=Социалдык кирүү
+krbPrincipalAttribute=Kerberos негизги атрибуту
+fineGrainSamlEndpointConfig=Так настройкаланган SAML Endpoint конфигурациясы
+hours=Сааттар
+eventTypes.RESET_PASSWORD_ERROR.name=Сырсөздү калыбына келтирүү катасы
+yes=Ооба
+showRemaining=Көрсөтүү ${remaining}
+searchProfile=Профилди издөө
+eventTypes.UPDATE_EMAIL_ERROR.name=Email жаңыртуу катасы
+removeConfirm_other=Бул топторду өчүрүү үчүн ишенесизби?
+configure=Конфигурациялоо
+searchScopeHelp=Бир деңгээл үчүн издөө User DNs тарабынан көрсөтүлгөн DNлердеги колдонуучуларга гана тиешелүү. Толук дарак үчүн издөө бүт даракка колдонулат. Толугураак маалымат үчүн LDAP документтерин караңыз.
+jumpToSection=Бөлүмгө секирүү
+noUsersEmptyStateDescription=Бул өтмөктө түздөн-түз ушул роль берилген колдонуучулар гана көрсөтүлөт. Эгер бул роль берилген колдонуучуларды табуу керек болсо, барыңыз
+manage=Башкаруу
+searchForSession=Сессия издөө
+temporaryLockedHelp=Колдонуучу көп жолу кирүүдө ката кетиргендиктен убактылуу бөгөттөлүшү мүмкүн.
+kerberosIntegration=Kerberos интеграциясы
+useEntityDescriptorHelp=Сырткы IDP SAML Entity Descriptorдон метадеректерди импорттоо
+decisionStrategies.CONSENSUS=Макулдашуу
+saveProviderSuccess=Провайдер ийгиликтүү сакталды.
+dedicatedScopes=Арналган чөйрөлөр
+noSessionsDescription=Бул realmде учурда активдүү сессиялар жок.
+createGroupText=Атрибуттар тобун түзүү
+otpPolicyCodeReusable=Кайра колдонулуучу токен
+addRedirectUri=Жарактуу Redirect URIлерди кошуу
+time=Убакыт
+disableSigningExplain=Эгер "{{key}}" өчүрүлсө, Keycloak базасы жаңыртылат жана сизге бул клиент үчүн жаңы адаптерди жүктөө керек болушу мүмкүн.
+mapperTypeRoleLdapMapperHelp=LDAP DNден алынган роль карталарын Keycloak realm же белгилүү бир клиенттин ролдоруна карталоо үчүн колдонулат.
+used.DEFAULT=Демейки
+authenticationCreateFlowHelp=Агымды түзүү
+credentialResetEmailSuccess=Колдонуучуга email жөнөтүлдү.
+sslType.all=Бардык сурамдар
+discoveryEndpointHelp=Сырткы IDP discovery descriptorдон метадеректерди импорттоо
+excludeSessionStateFromAuthenticationResponse=Аутентификация жооптон сессия абалын чыгаруу
+required=Мажбурий талаа
+linkedIdPsText=Бул колдонуучу аккаунтуна буга чейин туташтырылган идентификация провайдерлери
+lastUpdated=Акыркы жаңыртуу
+credentialResetBtn=Уруксатнаманы калыбына келтирүү
+socialProfileJSONFieldPathHelp=Социалдык провайдердин User Profile JSON ичиндеги талаа жолу. Көлөмдүү жана массив индексин чекит жана квадрат коскоктор менен көрсөтүңүз. Мисалы 'contact.address[0].country'.
+userModelAttributeHelp=LDAP атрибутун карталоо үчүн UserModel мүнөзүн же атрибуттун атын жазыңыз. Мисалы 'firstName', 'lastName', 'email', 'street' ж.б.
+userList=Колдонуучулар тизмеси
+eventTypes.RESET_PASSWORD.name=Сырсөздү калыбына келтирүү
+exportWarningDescription=Эгер realmде көптөгөн топтор, ролдор же клиенттер бар болсо, операция сервердин убактылуу жооп бербей калышына себеп болушу мүмкүн.
+importRole=Роль импорттоо
+deleteClientProfileConfirm=Бул операция {{profileName}} профилин толугу менен өчүрөт. Кайтарууга мүмкүн эмес.
+signServiceProviderMetadataHelp=Провайдердин SAML метадеректеринин кол тамгасын күйгүзүү/өчүрүү.
+oAuthMutual=OAuth 2.0 Өз ара TLS сертификаты менен жеткиликтүү токендер күйгүзүлгөн
+keystore=Кийстор
+eventTypes.EXECUTE_ACTION_TOKEN.description=Аракет токенин аткаруу
+eventTypes.CLIENT_INFO.description=Клиент маалыматы
+updateClientProfilesError=Клиент профилдерин жаңыртуу мүмкүн болгон жок\: {{error}}
+canonicalizationHelp=XML колтамгалары үчүн Каноникализация ыкмасы
+authorizationHelp=Клиент үчүн так башкарылган уруксаттарды күйгүзүү/өчүрүү
+sessions=Сессиялар
+mapperCreateSuccess=Маппер ийгиликтүү түзүлдү.
+fullSyncPeriodHelp=Толук синхрондоштуруу убактысы секундда
+resourceTypeHelp=Бул уруксат белгиленген түрдөгү бардык ресурс экземплярларына колдонулушу керек.
+encryptionAlgorithmHelp=SAML документтерин, ассерцияларын же IDлерин шифрлөөнү колдонгон алгоритм. Дешифровка ачкычы бул алгоритмге ылайык тандалып, realm ачкычтарында болушу керек. Эгер алгоритм белгиленбесе, колдоого алынган каалаган алгоритм колдонулат жана ачкыч SAML документиндеги алгоритм боюнча тандалат.
+socialUserAttributeName=Маалыматты сактоо үчүн колдонуучу атрибутунун аты
+priority=Проритет
+jsonType.label=Талаптын JSON түрү
+fullScopeAllowed=Толук чөйрөгө уруксат берилген
+syncModes.inherit=Мураска алуу
+masterSamlProcessingUrlHelp=Эгер конфигурацияланган болсо, бул URL SP Assertion Consumer жана Single Logout Services үчүн колдонулат. Ар бир binding жана кызмат үчүн жеке өзгөртүлүшү мүмкүн.
+addedGroupMembershipError=Топко мүчөлүктү кошууда ката: {{error}}
+authenticatorAttachment.platform=Платформа
+configSaveSuccess=Конфигурация ийгиликтүү сакталды
+regenerate=Кайра түзүү
+ignoreMissingGroups=Жок болгон топторду эске албоо
+sslType.external=Сырттан келген сурамдар
+showMetaData=Метадеректерди көрсөтүү
+webAuthnPolicyAttestationConveyancePreferenceHelp=Аутентификаторго аттестация билдирүүсүн кантип түзүү керектиги жөнүндө артыкчылыкты билдирет.
+top-level-flow-type.basic-flow=Негизги агым
+groupRemoveError=Топту өчүрүүдө ката {error}
+temporaryPasswordHelpText=Эгер күйгүзүлгөн болсо, колдонуучу кийинки кирүүдө сырсөзүн алмаштырыш керек
+requestObjectEncryption=Request объектинин шифрлөө алгоритми
+exportAuthDetailsSuccess=Уруксат маалыматтары ийгиликтүү экспорттолду.
+connectionPooling=Тиркеме байланыш пулду колдонуу
+wantAuthnRequestsSignedHelp=Идентификация провайдери кол коюлган AuthnRequestти күтөтбү дегенди билдирет.
+policyCodeHelp=Бул саясат үчүн шарттарды берүүчү JavaScript коду.
+eventTypes.IMPERSONATE_ERROR.description=Адамдын атынан кирүү катасы
+eventTypes.IDENTITY_PROVIDER_RESPONSE.description=Идентификация провайдеринин жообу
+shouldBeANumber=Сан болушу керек
+validatorDialogColNames.colDescription=Түшүндүрмө
+requestObjectEncoding=Request объектинин мазмунун шифрлөө алгоритми
+idTokenEncryptionKeyManagementAlgorithmHelp=ID токендерин шифрлөөдө ачкыч башкаруу үчүн колдонулган JWA алгоритми. Эгер бош калса, ID токендер кол коюлат, бирок шифрленбейт.
+idpInitiatedSsoUrlNameHelp=IDP башталган SSO үчүн кардарга шилтеме кылуу URL бөлүгү. Бош калтыруу IDP башталган SSOну өчүрөт. Сиз браузерден төмөнкү URLди колдоносуз\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}.
+keyPassword=Ачкычтын сырсөzü
+attributeFriendlyName=Атрибут [Ырчы аталышы]
+clearAllFilters=Бардык фильтрлерди тазалоо
+scopePermissions.clients.map-roles-composite-description=Администратордун бул кардар тарабынан аныкталган ролдорду башка рольго композиттик рол катары колдонуу укуктарын аныктаган саясаттар
+roleObjectClassesHelp=Роль объектинин объект классы(сы). Бир нече болсо, үтүктөр менен бөлүнөт. Мисалы, LDAPта 'groupOfNames' болушу мүмкүн. Active Directoryде көп учурда 'group'.
+emptyAddClientScopes=Кардар чөйрөлөрү жок
+changeTypeTo=Түрүн өзгөртүү
+generateKeys=Ачкычтарды түзүү?
+searchForUser=Колдонуучуну издөө
+groupRemove_one=Топ өчүрүлдү
+savePasswordError=Сырсөздү сактоодо ката\: {{error}}
+allGroups=Бардык топтор
+deleteNode=Түйүнү өчүрүүбү?
+rdnLdapAttributeHelp=Колдонуучунун DNнин RDN (жогорку атрибуту) катары колдонулган LDAP атрибутунун аты. Көп учурда Username LDAP атрибуту менен бирдей болот, бирок талап кылынбайт. Мисалы, Active Directoryде RDN катары 'cn' колдонулат, ал эми Username 'sAMAccountName' болушу мүмкүн.
+addAaguids=AAGUID кошуу
+createPolicy=Кардар саясатын түзүү
+disablePolicyConfirm=Саясат өчүрүлгөндө колдонуучулар жана кардарлар ага кире алышпайт. Улантууга ишенесизби?
+useDiscoveryEndpoint=Discovery Endpointти колдонуу
+clearAdminEvents=Администратордун окуяларын тазалоо
+eventTypes.CLIENT_DELETE.name=Кардарды өчүрүү
+clientLoginTimeout=Кардар кирүү убактысы бүткөн
+mapperSaveSuccess=Маппер ийгиликтүү сакталды.
+noRolesAssociatedInstructions=Бул рольго роль кошуу үчүн 'Роль кошуу' баскычын басыңыз.
+alwaysDisplayInUIHelp=Колдонуучу активдүү сессияда болбосо да, бул кардарды Account UIде дайыма көрсөтүү.
+eventTypes.UPDATE_PASSWORD.name=Сырсөздү жаңыртуу
+eventTypes.UPDATE_CONSENT.description=Макулдукту жаңыртуу
+realmSaveSuccess=Realm ийгиликтүү жаңыртылды
+executorTypeTextHelpText=Executor Type текст жардам
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Идентификация провайдеринин кирүү катасы
+readTimeout=Окуу убактысы бүткөн
+userInfoResponseEncryptionContentEncryptionAlgorithmHelp=User Info Endpoint жоопторун шифрлөөдө мазмун шифрлөө үчүн колдонулган JWA алгоритми. Эгер User Info жооп шифрлөө ачкыч башкаруу алгоритми көрсөтүлсө, бул маанинин демейки баасы A128CBC-HS256.
+accessTokenSignatureAlgorithm=Access токенинин колтамга алгоритми
+createUser=Колдонуучу түзүү
+logoutAllDescription=Бардык активдүү сессиялардан чыгып, realmдеги бардык активдүү субъекттер чыгып калат.
+credentialResetEmailError=Ийгиликсиз болду\: {{error}}
+flow-type.form-flow=Форма
+useKerberosForPasswordAuthenticationHelp=Пайдалануучунун аты/сырсөзүн Kerberos серверине текшерүү үчүн Kerberos кирүү модулун колдонуу, LDAP серверине Directory Service API аркылуу эмес.
+guiOrderHelp=GUIде провайдердин ордун (мисалы Consent барагында) бүтүн сан менен белгилөө.
+signDocumentsHelp=SAML документтерин realm кол коюшу керекпи?
+resetPassword=Сырсөздү калыбына келтирүү
+requireSslHelp=HTTPS керекпи? 'Жок' HTTPSди эч кандай кардар IP дареги үчүн талап кылбайт. 'Сырттан келген сурамдар' дегенде localhost жана жеке IP даректер HTTPSсиз кире алат. 'Бардык сурамдар' бардык IP даректер үчүн HTTPS керек.
+policyDeletedSuccess=Саясат ийгиликтүү өчүрүлдү
+manageServiceAccountUser=Толук маалымат жана топ карталарын башкаруу үчүн колдонуучунун атын басыңыз <1>{{link}}</1>
+addClientProfileSuccess=Жаңы кардар профили кошулду
+helpDisabled=Жардам өчүрүлгөн
+deleteResource=Ресурсту түбөлүк өчүрүүбү?
+validRequestURIsHelp=OpenID Connect аутентификация суроосунда 'request_uri' параметринин мааниси катары колдонулуучу жарактуу URIлердин тизмеси. Valid Redirect URI сыяктуу кеңири мүмкүнчүлүктөр жок. Мисалы, wildcards же салыштырмалуу жолдор колдоого алынбайт.
+emptyAddClientScopesInstructions=Кошулуучу кардар чөйрөлөрү жок
+changeTypeIntro={{count}} тандалган кардар чөйрөлөрүнүн түрү өзгөртүлөт
+secretSizeHelp=Жасалган сырсөздүн байттагы өлчөмү
+clientSecret=Кардардын сырсөзү
+inputType=Киргизүү түрү
+claimHelp=Токенден издөө үчүн талаптын аталышы. Сиз '.' менен иерархиялык талаптарды көрсөтө аласыз, мисалы, 'address.locality'. Накта '.' колдонуу үчүн аны кайтарма белгиси (\\.) менен качыңыз.
+regexClaimValues=Талаптардын регулярдык выражениелери
+iconUri=Иконка URI
+allowed-protocol-mappers.label=Рухсат берилген протокол мапперлери
+group=Топ
+addAssociatedRolesText=Тиешелүү ролдорду кошуу
+enabledFeatures=Иштетилген мүмкүнчүлүктөр
+groupsClaimHelp=Эгер аныкталса, саясат колдонуучунун топторун уруксат сураган идентификацияны билдирген кирүү же ID токенинен алат. Эгер аныкталбаса, топтор realm конфигурациясынан алынып келинет.
+createGroup=Топ түзүү
+validatingPublicKeyId=Жарандык ачкычтын идентификаторун текшерүү
+clientAuthentications.client_secret_jwt=Кардардын сырсөzü менен кол коюлган JWT
+created=Түзүлгөн
+minutes=Минута
+displayOnClient=Кардар экранында көрсөтүү
+certSubject=CERT_SUBJECT
+userCredentialsHelpText=Жогорку деңгээлдеги иштетүүчүлөр колдонуучунун сырсөздөрүнүн артыкчылыгын өзгөртүүгө мүмкүндүк берет, эң жогорку артыкчылыкка ээ сырсөз эң жогору турат. Бир панелдеги иштетүүчүлөр сырсөздөрдүн визуалдык ордун өзгөртүүгө мүмкүндүк берет, эң жогорку сол жакта көрсөтүлөт.
+ldapAdvancedSettingsDescription=Бул бөлүм LDAP сактагыч провайдерин көбүрөөк майда жөндөөлөрү үчүн башка параметрлерди камтыйт.
+usersDN=Колдонуучулардын DN
+relativeUserCreateDn=Колдонуучуну түзүүнүн салыштырмалуу DNи
+relativeUserCreateDnHelp='Колдонуучулардын DN'ден салыштырмалуу DN, колдонуучулар ушул жерде түзүлөт. Мисалы, бул аркылуу колдонуучулар 'Колдонуучулардын DN'дин мурунку DNинен башка жерге түзүлө алышат, эгер издөө кеңейтилишин колдонсоңуз.
+secretSize=Сырсөздүн өлчөмү
+included.custom.audience.label=Кошулган Ыңгайлаштырылган Аудитория
+max-clients.label=Realm боюнча Максималдуу Кардарлар саны
+requestObjectSignatureAlgorithm=Request объектинин колтамга алгоритми
+searchForGroups=Топторду издөө
+noRolesAssociated=Тиешелүү ролдор жок
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.name=Идентификация провайдеринин кирүүдөн кийин ката
+emptyStateMessage=Атрибуттар тобу жок
+tokenLifespan.expires=Жарактуулук мөөнөтү аяктайт
+oidcAttributeImporter=Эгер ID, кирүү токени же колдонуучу профилинин талаптарынын топтомунда көрсөтүлгөн болсо, декларацияланган талапты колдонуучунун мүнөздөмөсүнө же атрибутуна импорттоо.
+requestObject.request\ only=Жалгыз суроо
+waitIncrementSeconds=Күтүү көбөйүшү (секунд)
+requiredForLabel.admins=Жалгыз администраторлор үчүн
+clientScopeSuccess=Чөйрө карталаштырылды
+clientPolicySearch=Кардар саясатын издөө
+refreshTokens=Токендерди жаңылоо
+eventTypes.UPDATE_EMAIL_ERROR.description=Электрондук почтаны жаңыртуу катасы
+credentials=Креденциалдар
+webAuthnPolicyCreateTimeoutHelp=Колдонуучунун жарандык ачкыч креденциалын түзүү үчүн күтүү убактысы (секундда). Эгер 0го коюлса, бул күтүү параметри колдонулбайт.
+policyType.hotp=Санакка негизделген
+claimFilterValue=Маанилүү талаптын мааниси
+eventTypes.REGISTER_ERROR.name=Катталуу катасы
+priorityHelp=Провайдердин артыкчылыгы
+emptyPolicies=Саясаттар жок
+manageOrderTableAria=Кирүү барагындагы идентификация провайдерлеринин тизмеси
+disableError=Провайдерди өчүрүү мүмкүн болгон жок {{error}}
+anyAlgorithm=Кандай болбосун алгоритм
+enableSSL=SSLди күйгүзүү
+general=Жалпы
+failureFactor=Максималдуу кирүү каталары
+updateClientPoliciesSuccess=Кардар саясатынын конфигурациясы жаңыртылды
+advancedSettings=Кеңейтилген жөндөөлөр
+attributeValueHelp=Атрибут бул маанини алышы керек. Эгер атрибут тизмеде болсо, анда мааниси тизмеде болушу шарт.
+eventTypes.FEDERATED_IDENTITY_LINK.description=Бириктирилген идентификация шилтемеси
+adminTheme=Админ темасы
+alias=Алиас
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=Идентификация провайдери шилтемесин жөнөтүү катасы
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.name=Бириктирилген идентификация шилтемесин алмаштыруу
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.description=Бириктирилген идентификация шилтемесин алмаштыруу
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.name=Бириктирилген идентификация шилтемесин алмаштыруу катасы
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.description=Бириктирилген идентификация шилтемесин алмаштыруу катасы
+eventTypes.OAUTH2_EXTENSION_GRANT.name=OAuth2 кеңейтилген уруксат
+eventTypes.OAUTH2_EXTENSION_GRANT.description=OAuth2 кеңейтилген уруксат
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.name=OAuth2 кеңейтилген уруксат катасы
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.description=OAuth2 кеңейтилген уруксат катасы
+userEvents=Колдонуучу окуялары
+inputTypePlaceholder=Киргизүү орун басары
+otpPolicyPeriodErrorHint=Мааниси 1 секунддан 2 мүнөткө чейин болушу керек.
+introduction=Эгер бул баракчадан чыгып, ушул realmди башкаргыңыз келсе, сол жактагы навигация менюсунда тиешелүү пункттарды чыкылдатыңыз.
+clearUserEvents=Колдонуучу окуяларын тазалоо
+descriptionHelp=Жаңы агымдын сүрөттөмөсү үчүн жардам тексти
+addCustomProvider=Ыңгайлаштырылган провайдерди кошуу
+permissionType=Бул уруксат белгиленген түрдүн бардык ресурстарында колдонулушу керек экенин билдирет.
+policyEnforcementModes.ENFORCING=Мажбурлоо
+rowSaveBtnAriaLabel=Редакцияларды сактоо {{messageBundle}} үчүн
+permanentLockout=Туруктуу блоктоо
+maxTemporaryLockouts=Максималдуу убактылуу блоктоолор
+maxTemporaryLockoutsHelp=Колдонуучу туруктуу блоктолушу үчүн уруксат берилген убактылуу блоктоолордун саны.
+bruteForceStrategy=Күтүү убактысын көбөйтүү стратегиясы
+bruteForceStrategyHelp=«Көп эселенүүчү» стратегиясы күтүүнү {{failureFactor}} каталардын көбөйүшү болгондо гана көбөйтөт. «Түз сызык» стратегиясы {{failureFactor}}ден баштап ар бир жаңы ката күтүүнү көбөйтөт.
+bruteForceStrategy.LINEAR=Түз сызык
+bruteForceStrategy.MULTIPLE=Көп эселенүүчү
+debug=Текшерүү
+webAuthnPolicyRequireResidentKey=Ачык табылуучу креденциал талап кылуу
+unlockUsersConfirm=Бардык убактылуу блоктолгон колдонуучулар ачылат.
+clear=Тазалоо
+idpType.custom=Ыңгайлаштырылган
+eventTypes.LOGOUT.name=Чыгуу
+deletedErrorClientScope=Кардардын чөйрөсүн өчүрүү мүмкүн болгон жок\: {{error}}
+groupsClaim=Топтордун талабы
+roleMappingUpdatedError=Ролду карталоону жаңыртуу мүмкүн болгон жок {{error}}
+client-updater-source-groups.label=Топтор
+frontchannelLogoutUrlHelp=Бул realmге logout суранычы жөнөтүлгөндө кардар өзү чыгарылып салынуучу URL. Эгер көрсөтүлбөсө, негизги URL колдонулат.
+authenticationOverridesHelp=Realm аутентификация агымдарын алмаштыруу.
+requiredActions=Милдеттүү аракеттер
+requiredAction=Милдеттүү аракет
+requiredActionConfig=Конфигурация {{name}} үчүн
+selectLocales=Тилди тандаңыз
+policyDecisionStagey=Үнөмдүү стратегия уруксат менен байланышкан саясаттар кандай бааланарын жана акыркы чечим кандай алынарын көрсөтөт. 'Affirmative' эң аз бир саясат оң чечим чыгышы керек дегенди билдирет. 'Unanimous' бардык саясаттар оң чечим чыгышы керек. 'Consensus' оң чечимдер саны терс чечимдерден көп болушу керек. Эгер тең болсо, акыркы чечим терс болот.
+usermodel.prop.tooltip=UserModel интерфейсиндеги мүнөздөмө методунун аты. Мисалы, 'email' UserModel.getEmail() методуна шилтеме кылат.
+kc.identity.authc.method=Аутентификация ыкмасы
+regexAttributeValues=Регулярдык выражение атрибут маанилери
+otpTypeHelp=totp — убакытка негизделген бир жолу колдонулуучу сырсөз. hotp — эсептөөчүгө негизделген бир жолу колдонулуучу сырсөз, сервер эсептөөчүнү сактайт.
+setAsDefaultAction=Стандарттык аракет катары коюу
+keyForCodeExchange=PKCE ыкмасы
+clientProfiles=Кардар профилдери
+endpointsHelp=Кызмат көрсөтүүчү акыркы чекиттердин конфигурациясын көрсөтөт.
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
+unlockAllUsers=Бардык колдонуучуларды ачуу
+noGroupsText=Бул колдонуучу кайсы бир топко кошулган эмес. Баштоо үчүн топко кошулуңуз.
+createClientPolicyError=Саясат түзүү мүмкүн болгон жок\: {{error}}
+eventTypes.EXECUTE_ACTIONS_ERROR.name=Аракеттерди аткарууда ката
+path=Жол
+overwritten=Жаңыртылган
+mapperNameHelp=Маппердин аты
+keyProviderMapperNameHelp=Админ консолунда провайдердин көрүнүүчү аты
+providerIdHelp=Провайдердин ID
+deleteProviderError=Провайдерди өчүрүүдө ката: {{error}}
+supportedLocalesHelp=Бул realmде колдоого алынган тилдер. Колдонуучу кирүү экранында бир тилди тандайт.
+comparisonHelp=Суралган контекст класстарын же билдирүүлөрдү баалоо үчүн салыштыруу ыкмасын көрсөтөт. Стандарттык «Так» болуп саналат.
+generatedIdTokenIsDisabled=Колдонуучу тандалбаса, түзүлгөн id токен өчүрүлөт
+nodeHost=Түйүндүн хосту
+eventTypes.REGISTER_NODE_ERROR.description=Түйүндү каттоо катасы
+eventListenersHelpTextHelp=Бул realm үчүн окуяларды кабыл алуучу угармандарды конфигурациялоо.
+acrToLoAMapping=ACRден LoAга карта
+advancedSettingsSaml=Бул бөлүм кардардын кеңейтилген SAML жөндөөлөрүн конфигурациялоо үчүн колдонулат
+resetCredentialsError=Колдонуучулардын сырсөздөрүн кайра орнотуу катасы\: {{error}}
+eventTypes.INTROSPECT_TOKEN.name=Токенди текшерүү
+unspecified=Белгисиз
+deleteMappingTitle=Карталаны өчүрүүбү?
+profile=Профиль
+active=Иштеп жаткан
+generateKeysDescription=Эгер жаңы ачкычтарды түзсөңүз, жеке ачкыч менен кийсторду автоматтык түрдө жүктөп алып сактоого болот. Keycloak сервер сертификат жана жалпы ачкычты гана сактайт, жеке ачкычты сактабайт.
+addSubFlowTitle=Суб-ағым кошуу
+useTruststoreSpiHelp=LDAP байланышы командалык саптагы Truststore менен колдонулушу керекпи деп көрсөтөт. 'Ар дайым' дайыма колдонулат. 'Эч качан' колдонулбайт. Эгер Keycloak truststore конфигурацияланбаса, кадимки java cacerts же 'javax.net.ssl.trustStore' мүнөздөмөсү колдонулат.
+forcePostBindingHelp=Жооптор үчүн дайыма POST байланышын колдонуу.
+executorName=Аты
+VERIFY_EMAIL=Электрондук почтаны ырастоо (VERIFY_EMAIL)
+realmCertificateAlias=Realm сертификат алиасы
+roleName=Ролдун аты
+addOrigins=Чыгуу булактарын кошуу
+evictionDayHelp=Киргизүү жараксыз боло турган аптаның күнү
+actionTokens=Аракет токендери
+permissionResources=Бул уруксат белгиленген ресурска колдонулат.
+testConnectionHint.withoutEmail=Байланышты текшерүү үчүн колдонуучунун электрондук почтасы ({{userName}}) жөндөлүшү керек.
+includeOneTimeUseConditionHelp=Кирүү жоопторунда OneTimeUse шарты болушу керекпи?
+availableIdPsText=Бул realmге конфигурацияланган бардык идентификация провайдерлери. Колдонуучу каалаган IdP аккаунтуна шилтеме кошо алат.
+accessTokenLifespanHelp=Кирүү токени жарактуулугу максималдуу убактысы. Бул маанини SSO тайм-аутуна караганда кыска кылуу сунушталат.
+editableRowsTable=Редакциялоого мүмкүн болгон катарлар таблицасы
+redirectURIHelp=Идентификация провайдерин жөндөөдө колдонулуучу кайра багыттоочу URI.
+permissionsEnabled=Уруксаттар иштетилген
+saveRealmError=Realm түзүү мүмкүн болгон жок {{error}}
+attestationPreference.none=Жок
+pairwiseSubAlgorithmSalt.label=Туз
+addGroupsToGroupPolicy=Топ саясатына топторду кошуу
+deniedScopes=Тыйылган чөйрөлөр
+updateClientProfilesSuccess=Кардар профилдеринин конфигурациясы жаңыртылды
+flow.docker\ auth=Docker аутентификация агымы
+useEntityDescriptor=Сущность descriptor колдонуу
+loginActionTimeout=Кирүү аракетинин убакыт чеги
+windowsDomainQN=Windows домендин толук аты
+deleteClientError=Профилди өчүрүү мүмкүн болгон жок\: {{error}}
+validRedirectURIs=Жакшыраак кирүүдөн кийин браузер кайра багыттай ала турган URI үлгүсү. Мисалы, жөнөкөй жапкычтар колдонууга уруксат берилет: 'http\://example.com/*'. Ошондой эле салыштырмалуу жолдор колдонсо болот, мисалы /my/relative/path/*. Салыштырмалуу жолдор кардардын негизги URLине карай түзүлөт; эгер ал көрсөтүлбөсө, аутентификация серверинин негизги URLи колдонулат. SAML үчүн, валиддүү URI үлгүлөрүн киргизүү сунушталат.
+UPDATE_PROFILE=Профилди жаңыртуу (UPDATE_PROFILE)
+assertionConsumerServicePostBindingURL=Assertion Consumer Service POST Binding URL
+removeImported=Импорттолгонду өчүрүү
+endpoints=Акыркы чекиттер
+roleSaveError=Ролду сактоо мүмкүн болгон жок\: {{error}}
+keySize=Ачкычтын өлчөмү
+membershipUserLdapAttributeHelp=Функциясы UID болгон учурларда гана колдонулат. Бул колдонуучунун LDAP атрибутунун аты, ал мүчөлүк карталоо үчүн колдонулат. Көбүнчө 'uid' болот. Мисалы, эгер 'Membership User LDAP Attribute' мааниси 'uid' болсо жана LDAP тобунда 'memberUid\: john' бар болсо, бул LDAP колдонуучусу 'uid\: john' атрибутуна ээ болушу күтүлөт.
+samlCapabilityConfig=SAML мүмкүнчүлүктөрү
+accessTokenSignatureAlgorithmHelp=Кирүү токендерине кол коюуда колдонулган JWA алгоритми.
+derFormatted=DER форматталган
+periodicChangedUsersSyncHelp=Өзгөргөн же жаңы түзүлгөн LDAP колдонуучуларын Keycloakка мезгил-мезгили менен синхрондоштуруу иштетилиши керекпи же жокпу.
+signatureAlgorithmHelp=Документтерге кол коюуда колдонулуучу колтамга алгоритми. 'SHA1' негизиндеги алгоритмдер эскирген жана келечекте алынып салынат. Көбүрөөк коопсуз алгоритмди колдонуу сунушталат, '*_SHA1'дин ордуна.
+allow-default-scopes.tooltip=Эгер күйгүзүлгөн болсо, жаңы катталган кардарларга realmдин негизги же кошумча кардар чөйрөлөрүнө уруксат берилет.
+emailVerified=Электрондук почта ырасталган
+addExecutionHelp=Аракеттер ар түрдүү болушу мүмкүн, мисалы, сырсөздү калыбына келтирүү катын жөнөтүү же OTPны текшерүү.
+requestObjectRequiredHelp=Кардар уруксат суроолору үчүн сураныч объектин берүү керекпи жана кайсы методду колдонсо болоору жөнүндө. "not required" болсо, берүү милдеттүү эмес. Башка учурда бардыгы милдеттүү. "request" болсо, объектти түздөн-түз берүү керек. "request_uri" болсо, шилтемесин берүү керек. "request or request_uri" болсо, эки ыкма тең болот.
+clientScopesRolesScope=Эгер рол чөйрөсү карталаштырылбаса, ар бир колдонуучу бул чөйрөнү колдонууга уруксаттуу. Эгер рол чөйрөсү карталаштырылса, колдонуучу ролдордун бирине кириши керек.
+passwordPoliciesHelp.notUsername=Сырсөз колдонуучунун аты менен дал келе албайт.
+passwordPoliciesHelp.notContainsUsername=Сырсөз колдонуучунун атын камтыбайт.
+removeConfirm_one=Бул топту чындап өчүрүңүзбү?
+createUserProviderSuccess=Колдонуучу федерация провайдери ийгиликтүү түзүлдү
+countHelp=Токен менен канча кардар түзүлө алары көрсөтүлөт.
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
+Monday=Дүйшөмбү
+resetCredentialsSuccess=Сырсөз ийгиликтүү калыбына келтирилди.
+added=Кошулду
+authnContextDeclRefs=AuthnContext DeclRefs
+clientAssertionAudienceHelp=Кардардын ассершин колдонуу үчүн аудитория. Демейки мааниси — IDPнин токен соңку чекити URLи.
+externalRoleToRole=Keycloak кирүү токенинде тышкы ролду издейт. Эгер тышкы роль бар болсо, колдонуучуга көрсөтүлгөн realm же кардар ролун берет.
+attributeGroup=Атрибуттар тобу
+deleteExecutionError=Аткарууну өчүрүү мүмкүн болгон жок\: {{error}}
+hideInheritedRoles=Мураска алынган ролдорду жашыруу
+consentRequired=Макулдуктун кереги бар
+selectMethodType.import=Импорттоо
+standardFlow=Стандарт агымы
+votedToStatus={{status}} үчүн добуш берди
+credentialResetConfirmText=Бул колдонуучуга электрондук кат жөнөткүңүз келеби?
+clientScopeType.default=Демейки
+helpFileUpload=JSON файлын жүктөө
+addProvider_one={{provider}} провайдерин кошуу
+clientPoliciesPolicies=Кардар саясаттары
+editUSernameHelp=Эгер күйгүзүлгөн болсо, колдонуучунун аты түзөтүлөт, болбосо — окуу гана.
+flowCreatedSuccess=Агым түзүлдү
+fineGrainOpenIdConnectConfiguration=OpenID Connectтин майда конфигурациясы
+flow.reset\ credentials=Креденциалдарды калыбына келтирүү агымы
+eventTypes.DELETE_ACCOUNT_ERROR.name=Аккаунтту өчүрүү катасы
+eventTypes.CLIENT_DELETE_ERROR.name=Кардарды өчүрүү катасы
+noRolesInstructions-client=Бул кардар үчүн ролдор түзүлгөн эмес. Баштоо үчүн роль түзүңүз.
+test=Сынап көрүү
+leaveGroup_one={{name}} тобун таштап чыгуу?
+count=Саны
+noPasswordPoliciesInstructions=Бул realmге сырсөз саясаты кошулган эмес. Баштоо үчүн саясат кошуңуз.
+testAuthentication=Аутентификацияны сыноо
+groupNameLdapAttributeHelp=Топ объекттериндеги аты жана RDN үчүн колдонулган LDAP атрибутунун аты. Көбүнчө 'cn'. Мисалы, DN: 'cn\=Group1,ouu\=groups,dc\=example,dc\=org'.
+deleteError=Провайдерди өчүрүү мүмкүн болгон жок {{error}}
+attributeDisplayName=Көрсөтүлүүчү аталыш
+pkceEnabled=PKCE колдонуу
+userProviderSaveSuccess=Колдонуучу федерация провайдери ийгиликтүү сакталды
+month=Ай
+valueLabel=Мааниси
+dropNonexistingGroupsDuringSyncHelp=Эгер бул белгилөө чын болсо, LDAPдан Keycloakка топторду синхрондоштурууда Keycloakто дагы деле бар топтор гана калат. Калгандары өчүрүлөт.
+expiration=Жарактуулук мөөнөтү
+addKerberosWizardTitle=Kerberos колдонуучу федерация провайдерин кошуу
+noPasswordPolicies=Сырсөз саясаты жок
+resourceTypes=Ресурстардын түрлөрү
+deleteConfirmTitle_one=Тобун өчүрүүбү?
+eventTypes.UPDATE_PROFILE_ERROR.description=Профилди жаңыртуу катасы
+webAuthnUpdateSuccess=WebAuthn саясаттары ийгиликтүү жаңыртылды
+authorizationSignedResponseAlg=Авторизация жооп колтамгасы алгоритми
+mapperTypeFullNameLdapMapperHelp=LDAPтагы бир атрибуттан (адатта 'cn') колдонуучунун толук атын UserModelдогу firstName жана lastNameге карталоо үчүн колдонулат.
+includeInUserInfo.label=userinfoго кошуу
+onDragMove=Элементти сүйрөө {{item}}
+back=Артка
+deleteScopeConfirm=Бул уруксат чөйрөсүн өчүрсөңүз, айрым уруксаттарга таасир этет.
+updateOtpSuccess=OTP саясаты ийгиликтүү жаңыртылды
+title=Аутентификация
+deleteAttributeError=Атрибут өчүрүлбөдү: {{error}}
+enableClientSignatureRequiredExplain=«Кардардын колтамгасы талап кылынат» күйгүзүлсө, бул кардардын адаптери жаңыртылат. Кардар үчүн жаңы адаптерди жүктөө керек болушу мүмкүн. Кардар үчүн ачкычтарды түзүү же импорттоо зарыл, ансыз аутентификация иштебейт.
+policiesConfigTypes.formView=Форма көрүнүшү
+residentKey.No=Жок
+nodeReRegistrationTimeout=Түйүндүн кайра катталуу убакыт чеги
+fineGrainSamlEndpointConfigHelp=Assertion Consumer жана Single Logout кызматтарынын так URLдерин конфигурациялоо.
+connectionURL=Байланыш URLи
+validateCustomUserSearchFilter=Фильтр болушу керек, мисалы\: (filter)
+accessTokenLifespan=Кирүү токенинин жарактуулук мөөнөтү
+loginWithEmailHelp=Колдонуучуларга электрондук почта менен кирүүгө уруксат берүү
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Идентификация провайдерин аккаунт менен байланыштырууда ката
+deleteMessageBundleSuccess=Билдирме топтомдон ийгиликтүү өчүрүлдү
+retry=Жаңыртуу жана улантуу үчүн бул жерди басыңыз
+selectAttributes=Атрибуттарды тандаңыз
+firstBrokerLoginFlowAliasOverrideHelp=Бул идентификация провайдери менен биринчи кирүүдө чакырылуучу аутентификация агымынын псевдоними. «Биринчи кирүү» Keycloak аккаунту бул IdP аккаунтуна байланыштуу эмес дегенди билдирет.
+owner=Ээси
+eventTypes.VERIFY_PROFILE.description=Профилди текшерүү
+executorAuthenticatorMultiSelectHelpText=Аткаруучу аутентификатор мультиселект жардам тексти
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Федерацияланган идентификация байланыш катасы
+eventTypes.EXECUTE_ACTIONS.name=Аракеттерди аткаруу
+encryptAssertions=Ассерцияларды шифрлөө
+disableConfirmTitle=Realmди өчүрүүбү?
+disableConfirmClientTitle=Кардарды өчүрүүбү?
+disableConfirmClient=Бул кардарды өчүрүүнү чындап каалайсызбы?
+custom=Ыңгайлаштырылган атрибут...
+keyTab=Ачкыч табулатурасы
+addSamlProvider=SAML провайдерин кошуу
+permission=Уруксат
+saveEventListeners=Окуя угармандарын сактоо
+capabilityConfig=Мүмкүнчүлүк конфигурациясы
+mapperTypeMsadUserAccountControlManagerHelp=MSADке тиешелүү маппер. MSAD колдонуучу аккаунтунун абалын (аккаунт күйгүзүлгөн, сырсөздүн мөөнөтү өткөн ж.б.) Keycloak аккаунтуна интеграциялай алат. MSADнин userAccountControl жана pwdLastSet атрибуттарын колдонуп, мисалы, pwdLastSet 0 болсо, сырсөздү жаңыртуу талап кылынат. userAccountControl 514 болсо, аккаунт өчүрүлгөн болуп эсептелет. Ошондой эле LDAP колдонуучу аутентификациясынын Ausnahme кодун кармай алат.
+home=Башкы бет
+bindFlow=Байлоо агымы
+userAttributeValue=Колдонуучунун атрибутунун мааниси
+browserFlowHelp=Браузер аутентификациясы үчүн колдонулуучу агымды тандаңыз.
+tokenLifespan.never=Чечилбейт
+notFound=Издеп жаткан ресурсту табуу мүмкүн болгон жок
+passMaxAge=Pass max_age
+disablePolicyConfirmTitle=Саясатты өчүрүүбү?
+eventTypes.LOGIN_ERROR.description=Кирүү катасы
+linkAccount=Аккаунтту туташтыруу
+attestationPreference.direct=Түздөн-түз
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.description=OAuth2 түзмөк аутентификация катасы
+unlinkUsers=Колдонуучуларды ажыратуу
+userLdapFilter=Колдонуучу LDAP фильтри
+emailVerification=Электрондук почтаны тастыктоо
+configSaveError=Конфигурацияны сактоо мүмкүн болгон жок\: {{error}}
+clientAuthenticatorTypeHelp=Бул кардарды Keycloak серверине аутентификациялоо үчүн колдонулуучу кардар аутентификатору
+cachePolicyHelp=Бул сактоо провайдери үчүн кэш саясаты. 'DEFAULT' — глобалдык кэштин демейки баалуулугу. 'EVICT_DAILY' — күн сайын белгиленген убакта кэш тазаланат. 'EVICT_WEEKLY' — апта күнү жана убакытта кэш тазаланат. 'MAX_LIFESPAN' — кэш жазмасынын узактыгы миллисекунд менен.
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Колдонуучуга талап кылынган атайын аракет катасы
+eventTypes.SEND_RESET_PASSWORD.name=Сырсөздү калыбына келтирүү электрондук катын жөнөтүү
+requiredFor=Керек
+scopePermissions.users.map-roles-description=Администратор бардык колдонуучуларга ролдорду карталоону чечкен саясаттар
+bindCredentialsHelp=LDAP администраторуңуздун сырсөзү. Бул талаа маанисин vaultтан алса болот, формат: ${vault.ID}.
+searchForAdminEvent=Админдик окуяны издөө
+unitLabel=Убакыт бирдигин тандаңыз
+webAuthnPolicySignatureAlgorithms=Колтамга алгоритмдери
+eventTypes.GRANT_CONSENT_ERROR.name=Макулдукту берүү катасы
+action=Аракет
+shortVerificationUri=Кыска verification_uri түзмөк аутентификация агымында
+placeholderText=Бирөө тандаңыз
+deleteCredentialsError=Колдонуучу креденциалдарын өчүрүүдө ката болду\: {{error}}
+authDefaultActionTooltip=Эгер күйгүзүлгөн болсо, жаңы колдонуучуга бул талап кылынган аракет автоматтык түрдө берилет.
+validateBindCredentials=LDAP администраторуңуздун сырсөзүн киргизишиңиз керек
+evictionMinuteHelp=Сааттын кайсы мүнөтүндө жазма жараксыз болот
+includeAuthnStatement=AuthnStatement камтуу
+validatorType=Текшерүүчү түрү
+attributesHelp=Токенде издөө үчүн атрибуттун аты жана (regex) мааниси. Конфигурацияланган атрибуттун аты SAML атрибутунун аты жана достук аты талааларында изделет. Ар бир атрибуттун талаптары аткарылышы керек роль ыйгаруу үчүн. Эгер атрибут массив болсо, мааниси массивде болушу керек. Бир нече жолу табылса, бир дал келүү жетиштүү.
+samlAttributeToRole=Эгер атрибут бар болсо, колдонуучуга көрсөтүлгөн realm же кардар ролун бер.
+enableStartTls=StartTLSти күйгүзүү
+addIdPMapper=Идентификация провайдеринин мапперин кошуу
+createPermissionSuccess=Уруксат ийгиликтүү түзүлдү
+roleAuthentication=Роль аркылуу аутентификация
+homeURL=Башкы URL
+eventTypes.REVOKE_GRANT_ERROR.name=Уруксатты жокко чыгаруу катасы
+contentSecurityPolicyReportOnly=Content-Security-Policy-Report-Only
+firstBrokerLoginFlowAlias=Биринчи кирүү агымы
+firstBrokerLoginFlowAliasOverride=Биринчи кирүү агымын алмаштыруу
+missingAttributes={{label}} дагы аныкталган жок. {{label}} кошуу үчүн төмөнкү баскычты басыңыз, ачкыч жана маани талап кылынат.
+testConnectionError=Ката\! {{error}}
+authenticatedAccessPoliciesHelp=Бул саясаттар аутентификацияланган суроо-талап үчүн Клиентти каттоо кызматы чакырылса колдонулат. Баштапкы кирүү токени же Bearer токен камтылышы керек.
+deleteClientPolicyProfileSuccess=Профиль саясаттан ийгиликтүү өчүрүлдү.
+reGenerateSigningExplain=Эгер кардар үчүн колтамга ачкычын кайра түзсөңүз, Keycloak базасы жаңыртылат жана бул кардар үчүн жаңы адаптерди жүктөп алуу керек болушу мүмкүн.
+evaluate=Баалоо
+enableLdapv3Password=LDAPv3 сырсөзүн өзгөртүү кеңейтилген операциясын күйгүзүү
+status=Абалы
+dragInstruction=Приоритетти өзгөртүү үчүн чыкылдатып сүйрөңүз
+clients=Кардарлар
+clientName=Аты
+syncModes.force=Мажбурлоо
+deleteMappingConfirm=Бул картаны өчүрүүнү чындап каалайсызбы?
+createClientProfileSuccess=Жаңы кардар профили түзүлдү
+eventTypes.CLIENT_LOGIN_ERROR.description=Кардардын кирүү катасы
+explainBearerOnly=Бул атайын OIDC түрү. Бул кардар фурсат токен суроо-талаптарын гана кабыл алат, браузер аркылуу кирүү мүмкүн эмес.
+noTranslationsInstructions=Баштоо үчүн котормо кошуңуз.
+clearFile=Бул файлды тазалоо
+allowCreate=Түзүүгө уруксат берүү
+providerUpdatedError=Кардар саясатын жаңыртуу мүмкүн болгон жок {{error}}
+usersAddedError=Топко колдонуучуларды кошуу мүмкүн болгон жок\: {{error}}
+orderChangeErrorUserFed=Колдонуучу федерация провайдерлеринин артыкчылык тартибин өзгөртүү мүмкүн болгон жок {{error}}
+scopeParameterPlaceholder=Scope параметрлерин тандаңыз
+deleteClientPolicyConfirmTitle=Саясатты өчүрүүбү?
+validateRdnLdapAttribute=RDN LDAP атрибутун киргизишиңиз керек
+policyUrlHelp=Профилдин маалыматтары кантип колдонулары тууралуу маалымат алуу үчүн Relying Party Client колдонуучуга берчү URL
+fromDisplayName=Көрсөтүүчү атынан
+affirmative=Ооба
+clientRoles=Кардар ролдору
+removeRoles=Ролдорду алып салуу
+flowNameDescriptionHelp=Жаңы агымдын аталыш жана сүрөттөмөсү үчүн жардам тексти
+maxFailureWaitSecondsHelp=Колдонуучу кулпуланганга чейин максималдуу убакыт.
+groupsPath=Топтордун жолу
+useRealmRolesMapping=Realm ролдорун карталоону колдонуу
+identityProviderEntityId=Идентификация провайдеринин Entity ID
+userInfoSignedResponseAlgorithm=Колтамгаланган userinfo жооп алгоритми
+selectGroup=Топту тандаңыз
+scopePermissions.groups.view-members-description=Администратор бул топтун мүчөлөрүн көрө алат деген саясаттар
+tableOfGroups=Топтор таблицасы
+allowed-protocol-mappers.tooltip=Рухсат берилген протокол маппер провайдерлеринин ак тизмеси. Кардар каттоо аракетинде уруксат берилбеген мапперлер болсо, суроо-талап четке кагылат.
+policyProvider.role=Уруксаттарды аныктоо үчүн шарттарды белгилеңиз, анда бир же бир нече роль объектке жетүү укугуна ээ болот.
+targetOptions.brokerId=BROKER_ID
+eventTypes.VERIFY_PROFILE.name=Профилди текшерүү
+useRealmRolesMappingHelp=Чын болсо, LDAP ролдор Keycloakдо realm ролдорго карталанат, болбосо кардар ролдорго.
+forwardParameters=Жөнөтүлгөн суроо параметрлери
+isAccessTokenJWTHelp=Идентификация провайдеринен алынган Access Token JWT түрүндө жана анын дооматтарына мапперлер жеткиликтүү болот.
+frontchannelLogoutUrl=Front-channel logout URL
+frontchannelLogoutSessionRequired=Front-channel logout сессиясы талап кылынат
+frontchannelLogoutSessionRequiredHelp=Front-channel logout URL колдонулганда Logout суроо-талапта sid (сессия ID) жана iss (чыгаруучу) параметрлери камтылышы керекпи дегенди көрсөтөт.
+testConnectionHint.withoutEmailAction=Электрондук почта дарегин орнотуңуз
+webAuthnUpdateError=WebAuthn саясатын жаңыртуу мүмкүн болгон жок {{error}}
+paginationHelp=LDAP серверинин беттешти колдой тургандыгы
+oAuthMutualHelp=Бул OAuth 2.0 Mutual TLS Certificate Bound Access Tokens колдоосун жандырган, бул жерде Keycloak Access Token жана Refresh Token X.509 сертификаты менен бекемделет. Муну Holder-of-Key токен катары колдонсо болот.
+deleteProviderTitle=Ачкыч провайдерин өчүрүүбү?
+scopes=Чектөөлөр
+accessTokens=Access токендери
+columnName=Аты
+flowType=Агым түрү
+syncLDAPGroupsSuccessful=Маалымат ийгиликтүү синхрондолду {{result}}
+policyEnforcementModes.PERMISSIVE=Жумшак
+subject=Субъект DN
+use=Колдонуу
+defaultAdminInitiated=Админ тарабынан башталган аракеттин кадимки узактыгы
+chooseAMapperType=Маппер түрүн тандаңыз
+startTimeHelp=Саясаттын берилүүгө тийиш эмес убактысын аныктайт. Азыркы дата/саат ушул мааниден кийин же барабар болгондо гана берилет.
+noGroupsInThisRealm=Бул реалмде топтор жок
+searchUserByAttributeKeyAlreadyInUseError=Атрибут ачкычы буга чейин колдонулууда
+executorClientAuthenticator=Аткаруучу Клиент Аутентификатору
+addWebOrigins=Веб баштоочторду кошуу
+clientScopeExplain=Клиенттин чектери – бул көп клиенттер менен бөлүшүлгөн протокол мапперлер жана ролдордун жалпы топтому.
+attributeNameHelp=Тастыктамада издөө үчүн атрибуттун аты. Бош калтырсаңыз болот жана ордуна достук атын көрсөтсөңүз болот.
+upAttributeNameHelp=Колдонуучу атрибутунун аты, атрибутту уникалдуу идентификациялоо үчүн колдонулат.
+linkAccountTitle=Аккаунтту {{provider}} менен байланыштыр
+invalidateRotatedSuccess=Айланган сырсөз ийгиликтүү алынган
+userSessionAttributeHelp=Колдонуучу сессиясынын атрибутунун атын бекитүү
+updateSuccessIdentityProvider=Провайдер ийгиликтүү жаңыртылды
+reloadKeys=Ключторду кайра жүктөө
+importKeys=Ключторду импорттоо
+useMetadataDescriptorUrl=Метадата сүрөттөмөсү URLди колдонуу
+useMetadataDescriptorUrlHelp=Эгер күйгүзүлсө, кол коюуларды текшерүү үчүн сертификаттар “Метадата сүрөттөмөсү URLсинен” жүктөлүп, кэшке алынат. “Ключторду кайра жүктөө” аракетин колдонуп кэшди жаңырта аласыз. Эгер өчүрүлсө, кол коюуну текшерүү үчүн сертификаттар кол менен жаңыртылышы керек.
+metadataDescriptorUrl=Метадата сүрөттөмөсү URL
+metadataDescriptorUrlHelp=Тышкы URL, кайда Identity Provider клиент үчүн керектүү метадата (сертификаттар, ключтор, башка URLдер...) жарыялайт.
+reloadKeysSuccess=Ключтор ийгиликтүү кайра жүктөлдү
+reloadKeysError=Ключторду кайра жүктөөдө ката чыкты. {{error}}
+reloadKeysSuccessButFalse=Кайра жүктөө аткарылган жок, мүмкүн сурамдар арасындагы убакыт өтө кыска болгон.
+importKeysSuccess=Ключтор ийгиликтүү импорттолду. Жаңы сертификаттарды сактоо үчүн провайдерди сактаңыз.
+importKeysError=Ключторду импорттоо ката болду. {{error}}
+importKeysErrorNoSigningCertificate=Метадатада "signingCertificate" параметри аныкталган эмес.
+host=Хост
+forbidden_one=Тыйылган, уруксат керек\:
+backchannelLogoutRevokeOfflineSessions=Арткы канал аркылуу чыгарууда оффлайн сессияларды жок кылуу
+supportedApplications=Колдоого алынган тиркемелер
+shortVerificationUriTooltipHelp=Эгер белгиленсе, бул маани Device Authorization агымында verification_uri катары кайтарылат. Бул URI {server-root}/realms/{realm}/device дарегине багыттоосу керек.
+kerberosPrincipal=Kerberos негизги аты
+resourceAttribute=Ресурстук атрибут
+addressClaim.region.label=Регион үчүн колдонуучу атрибутунун аты
+applyToResourceTypeFlagHelp=Бул уруксат бардык ушул типтеги ресурстарга колдонулушу керекпи дегенди көрсөтөт. Бул учурда, уруксат бардык ушул ресурстук типтин мисалдарына карата бааланат.
+managePriorityInfo=Приоритет – колдонуучу издөөнүн учурунда провайдерлердин тартиби. Саптардын жанындагы туткаларды басып, тартипти өзгөртө аласыз.
+deletedErrorIdentityProvider=Провайдерди өчүрүү мүмкүн болбой калды {{error}}
+included.custom.audience.tooltip=Бул 'Кошулган Клиент Аудиториясы' бош болгондо гана колдонулат. Белгиленген маани токендеги аудитория (aud) талаасына кошулат. Эгер токенде аудиториялар болсо, жаңы маани аларга кошулат, ордун алмаштырбай.
+includeInIdToken.label=ID токенге кошуу
+steps=Кадамдар
+tokenDeleteConfirm=Баштапкы жеткиликтүүлүк токенин {{id}} түбөлүк өчүргүңүз келет бекени?
+flowCreateError=Агымды түзүү мүмкүн болбой калды\: {{error}}
+readTimeoutHelp=LDAP окуу убакыт чеги миллисекунддарда. Бул убакыт LDAP окуу операцияларына тиешелүү.
+registrationAccessTokenHelp=Клиенттерге каттоо кызматына жеткиликтүүлүк берүүчү каттоо жеткиликтүүлүк токени.
+host-sending-registration-request-must-match.tooltip=Эгер күйгүзүлгөн болсо, Клиент каттоо кызматына келген сурамдар тек гана ишенимдүү хост же доменден жөнөтүлгөн болсо гана кабыл алынышат.
+profilesConfigTypes.formView=Форма көрүнүшү
+validatorDeletedSuccess=Ийгилик\! Колдонуучу профилинин конфигурациясы сакталды.
+canonicalization=Канонизациялоо методу
+deleteConfirmTitle=Realmди өчүрүү керекпи?
+includeInAccessTokenResponse.label=Жеткиликтүүлүк токенинин жообуна кошуу
+SSOSessionMax=SSO сессиясынын максималдуу узактыгы
+clientScope=Клиент чеги
+inheritedFrom=Мураска алынган
+clientScopeSearch.name=Аты
+deleteConditionSuccess=Шарт ийгиликтүү өчүрүлдү
+deleteConditionError=Шартты өчүрүү мүмкүн болбой калды\: {{error}}
+clientProfile=Клиент профилинин деталдары
+syncAllUsers=Бардык колдонуучуларды синхрондоштуруу
+allowedClockSkewHelp=Идентификация провайдер токендерин текшерүүдө уруксат берилген сааттык айырма (секунддарда). Адегенде 0 болуп саналат.
+disableConfirmIdentityProvider=“{{provider}}” провайдерин өчүрүүгө ишенесизби?
+clientSaveError=Клиентти жаңыртуу мүмкүн болбой калды\: {{error}}
+tokenSaveError=Баштапкы жеткиликтүүлүк токенин түзүү мүмкүн болбой калды {{error}}
+certificate=Сертификат
+deleteConfirmExecutionMessage="<1>{{name}}</1>" аткарууну түбөлүк өчүргүңүз келет бекени?
+offlineSessionMaxLimitedHelp=Оффлайн сессиясынын максималдуу узактыгын күйгүзүү
+delete=Өчүрүү
+userGroupsRetrieveStrategyHelp=Колдонуучунун топторун алуу ыкмасы. LOAD_GROUPS_BY_MEMBER_ATTRIBUTE – ролдорду колдонуучуну камтыган топторду издөө аркылуу алат. GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE – ролдорду 'memberOf' атрибутунан же башка көрсөтүлгөн атрибуттан алат.
+hour=Саат
+connectionTimeoutHelp=LDAP туташуунун убакыт чеги миллисекунддарда
+repeat=Кайталоо
+defaultSigAlgHelp=Realm үчүн токендерге кол коюу үчүн колдонулган адегенде алгоритм
+save-admin-eventsHelp=Эгер күйгүзүлгөн болсо, админ иш-чаралары базага жазылат жана Админ UIге жеткиликтүү болот.
+policyGroupsHelp=Бул саясатка уруксат берилген колдонуучу(лар)ды көрсөтөт.
+searchForProtocol=Протокол мапперин издөө
+eventTypes.CLIENT_INFO.name=Клиент маалыматы
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=OAuth2 түзмөк коду токенге айлантуу
+eventTypes.UPDATE_TOTP_ERROR.name=TOTP жаңыртуу ката
+client-updater-source-groups.tooltip=Бул шарт клиент каттоо же жаңыртуу сурамында текшерилет; шарт туура болсо, өтүнмөнү жараткан же жаңырткан субъект көрсөтүлгөн топтун мүчөсү болот. Топтордун жөнөкөй аталышы колдонулат, топ иерархиясы колдонулбайт.
+webAuthnPolicyRpId=Жоопкер тараптын IDси
+ldapRolesDnHelp=LDAP DN, кайда ролдор сакталат. Мисалы: 'ou\=finance,dc\=example,dc\=org'.
+serviceAccount=Кызматтык эсеп ролдору
+standardTokenExchangeEnabled=Стандарттык токен алмашуу күйгүзүлгөн
+enableRefreshRequestedTokenType=Стандарттык токен алмашууда жаңылоо токенин колдонууга уруксат берүү
+providerUpdatedSuccess=Клиент саясаты ийгиликтүү жаңыртылды
+assertionConsumerServiceRedirectBindingURL=Тастыктоо кабыл алуучу кызматтын Redirect Binding URL
+createClientScopeError=Клиент чегин түзүү мүмкүн болбой калды\: '{{error}}'
+deleteRole=Бул ролду өчүрүү
+SSOSessionSettings=SSO сессиянын жөндөөлөрү
+directAccessHelp=Бул түз жеткиликтүүлүк гранттарын колдоону күйгүзөт, башкача айтканда, клиент колдонуучунун колдонуучу аты/сырсөзүн түздөн-түз алмаштыруу үчүн колдоно алат. OAuth2 спецификациясына ылайык, Resource Owner Password Credentials Grant колдоосу.
+groupHelp=Колдонуучуну кошуу үчүн топ. Топтун толук жолун толтуруңуз, мисалы\: '/root-group/child-group'.
+clientPolicyNameHelp=Саясаттын көрсөтүлгөн аты
+addressClaim.country.label=Өлкө үчүн колдонуучу атрибутунун аты
+downloadType=Бул жүктөө түрү тууралуу маалымат
+clustering=Кластеризациялоо
+createSuccess=Identity provider ийгиликтүү түзүлдү
+mapperAttributeName=Атрибуттун аты
+setPassword=Сырсөз коюу
+client-updater-source-roles.tooltip=Бул шарт клиент каттоо же жаңыртуу сурамында текшерилет; шарт туура болсо, субъект көрсөтүлгөн ролдун мүчөсү болот. Realm ролун 'my_realm_role' сыяктуу ысым менен, клиент ролун 'client_id.role_name' сыяктуу ысым менен көрсөтсө болот. Мисалы, 'my_client.my_client_role' 'my_client' клиентиндеги 'my_client_role' ролун билдирет.
+createRole=Рол түзүү
+clientDeletedSuccess=Клиент өчүрүлдү
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Identity provider жооп ката
+editModeLdapHelp=READ_ONLY – окуу үчүн гана LDAP. WRITABLE – өзгөртүүлөр кереги болсо LDAPке жүктөлөт. UNSYNCED – маалымат импорттолот, бирок LDAPке жүктөлбөйт.
+enableServiceAccount=Кызматтык эсеп ролдорун күйгүзүү
+signOutAllActiveSessionsQuestion=Бардык активдүү сессиялардан чыгуу?
+addPostLogoutRedirectUri=Жарактуу чыгуу багыттоочу URIлерди кошуу
+SSOSessionMaxRememberMe=SSO сессиянын максималдуу узактыгы "Эсимде сактоо" менен
+pkceMethod=PKCE ыкмасы
+noRoles-users=Колдонуучунун ролдору жок
+showInheritedRoles=Мураска алынган ролдорду көрсөтүү
+moveGroupEmptyInstructions=Подтоптор жок, тандалган топту ушул топтун подптопу кылуу үчүн 'Move here' тандаңыз
+hmacGenerated=HMAC менен түзүлгөн
+unlockSuccess=Колдонуучу ийгиликтүү ачылды
+unlockError=Колдонуучуну ачууда ката болду {{error}}
+hourHelp=Саясаттын берилиши керек болгон саатты аныктайт. Эки талаа толтурулса, уруксат азыркы саат ошол аралыктын ичинде болгондо гана берилет.
+deleteClientProfileConfirmTitle=Профилди өчүрүү керекпи?
+syncLDAPGroupsError=Маалымат синхрондолгон жок {{error}} себебинен
+saveSuccess=Колдонуучу федерация провайдери ийгиликтүү сакталды
+generatedAccessToken=Түзүлгөн жеткиликтүүлүк токени
+resetPasswordConfirmation=Жаңы сырсөздү тастыктоо
+testConnection=Туташууну текшерүү
+archiveFormat=Архив форматы
+requestObjectEncryptionHelp=OIDC сурам объектин шифрлөө үчүн колдонулуучу JWE алгоритми. 'any' болсо, шифрлөө милдеттүү эмес, каалаган алгоритм колдонулушу мүмкүн.
+importSuccess=Жаңы сертификат импорттолду
+attributeConsumingServiceName=Атрибуттарды колдонгон кызматтын аты
+invalidJsonError=Колдонуучу профилин сактоо мүмкүн болбой калды, берилген маалымат жараксыз JSON: {{error}}
+invalidJsonClientProfilesError=Клиент профилдерин сактоо мүмкүн болбой калды, берилген маалымат жараксыз JSON: {{error}}
+invalidJsonClientPoliciesError=Клиент саясатын сактоо мүмкүн болбой калды, берилген маалымат жараксыз JSON: {{error}}
+promptHelp=Авторизация сервери колдонуучудан кайра аутентификация жана макулдукту сурайбы.
+deleteBtn=Өчүрүү
+defaultLocale=Таңдалган тил
+addLdapWizardDescription=Бул жерде текст керек
+aggregate.attrs.label=Атрибуттардын жыйындысы
+removedGroupMembershipError=Топтон чыгарууда ката: {{error}}
+allowPasswordAuthenticationHelp=Kerberos базасына колдонуучу аты/пароль менен аутентификациялоону күйгүзүү/өчүрүү
+deleteExecutorSuccess=Ийгиликтүү\! Аткаруучу өчүрүлдү.
+eventTypes.SEND_RESET_PASSWORD_ERROR.name=Калпыс паролду жөнөтүү катасы
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=Идентификатор провайдеринин биринчи кирүүсү
+noRoles-groups=Бул топто ролдор жок
+enableSwitchSuccess={{switch}} ийгиликтүү өзгөртүлдү
+eventTypes.INTROSPECT_TOKEN_ERROR.name=Токенди текшерүү катасы
+usernameHelperText=Бул идентификатордун колдонуучусунун атын киргизиңиз.
+includeInAccessToken.tooltip=Бул талап кирүү токенине кошулушу керекпи?
+noScopeCreateHint=Алгач уруксат берүү аймагын түзүшүңүз керек.
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=Клиент башталган эсептерди байланыштыруу катасы
+clientScopesCondition=Күтүлгөн уруксаттар
+backchannelLogoutSessionRequiredHelp=Backchannel Logout URL колдонулганда, Logout Token ичинде sid (сессия ID) талап кылынатбы, аны көрсөтүү.
+global=Жалпы
+userAttributeHelp=Сиз ката жазгыңыз келген колдонуучу атрибутунун аты
+searchForMapper=Картачыны издөө
+oidcCibaGrantHelp=Бул OIDC CIBA Grantти колдоону иштетет, бул колдонуучу браузер ордуна сырттан түзүлгөн аутентификация түзмөгү аркылуу аутентификацияланат дегенди билдирет.
+includeOneTimeUseCondition=Бир жолу колдонулуучу шартты кошуу
+clientUpdaterSourceRoles=Субъекттин ролдорун жаңылоо
+enableSwitchError={{error}} себептүү күйгүзүү/өчүрүү мүмкүн болбоду
+deleteClientPolicyProfileConfirm=Бул аракет {{policyName}} саясатынын {{profileName}} профилин түбөлүк өчүрөт. Муну кайтарууга болбойт.
+deleteExecutorProfileConfirm=Бул аракет {{executorName}} аткаруучуну түбөлүк өчүрөт. Муну кайтарууга болбойт.
+confirmClientSecretBody=Эгер сырды кайра жаратуу болсо, Keycloak маалымат базасы жаңыланып, бул клиент үчүн жаңы адаптерди жүктөп алышыңыз керек болот.
+keysList=Ачкычтар тизмеси
+generatedUserInfo=Жасалган колдонуучу маалыматтары
+clientRegistration=Клиентти каттоо
+masterSamlProcessingUrl=Негизги SAML иштетүү URL
+samlIdentityProviderMetadata=SAML 2.0 идентификатору провайдер метадайындары
+importParseError=Файлды талдоо мүмкүн болбоду: {{error}}
+validTo=Жарактуу мөөнөтү
+addMember=Мүчө кошуу
+eventTypes.CLIENT_INFO_ERROR.name=Клиент маалыматы катасы
+scopeParameterHelp=Сиз уруксат параметринин маанисин көчүрүп, бул клиент адаптеринен жөнөтүлгөн OpenID Connect баштапкы аутентификация суроосуна чаптай аласыз. Токен түзүүдө стандарттуу жана тандаган кошумча уруксаттар колдонулат.
+idTokenEncryptionKeyManagementAlgorithm=ID токенин шифрлөө ачкыч башкаруу алгоритми
+authenticatorAttachment.not\ specified=Көрсөтүлгөн эмес
+oidcCibaGrant=OIDC CIBA уруксаты
+displayDescriptionHintHelp=Колдонуучуга көрсөтүлгөн формаларды көрсөтүүдө колдонулуучу кеңеш тексти.
+ssoSessionIdle=Сессия токтоо учурунда уруксат берилген убакыт. Сессиянын мөөнөтү бүткөндө токендер жана браузер сессиялары жараксыз болот.
+searchKey=Издөө ачкычы
+deleteClientSuccess=Клиент профили өчүрүлдү
+emptyClientScopesPrimaryAction=Клиент уруксаттарын кошуу
+addStepTo= {{name}} кошумча кадам кошуу
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=Authreqidден токенге ката
+deleteAttributeConfirm=Сиз чындыгында {{attributeName}} атрибутун жана анын котормолорун түбөлүк өчүргүңүз келеби?
+chooseResources=Импорттоо үчүн ресурстарды тандаңыз
+selectOne=Бир вариантты тандаңыз
+emailTheme=Электрондук почта темасы
+eventTypes.UPDATE_PASSWORD.description=Паролду жаңыртуу
+policiesConfigTypes.jsonEditor=JSON редактору
+eventConfigSuccessfully=Конфигурация ийгиликтүү сакталды
+scopePermissions.users.impersonate-description=Администратордун башка колдонуучуну заматта аткаруусуна уруксат берүү саясаты
+deleteResourceWarning=Төмөнкү уруксаттар башка ресурстар колдонбогондо алып салынат\:
+permissionScopesHelp=Бул уруксат бир же бир нече уруксат аймагына колдонулушу керектигин билдирет.
+moveTo=Көчүрүү
+registerNodeManually=Тор түйүнүн кол менен каттоо
+redirectURI=Багыттоо URI
+publicKeys=Жария ачкычтар
+publicKey=Жария ачкыч
+emptyEventsInstructions=Кошо турган башка окуя түрү жок
+periodicFullSync=Дайыма толук синхрондоштуруу
+removeConfirmTitle_other=Топторду алып салуу?
+clientAccesstypeTooltip=Бул шарт колдонулчу клиенттин кирүү түрү.
+emptyBuiltInMappersInstructions=Бардык орнотулган картачылар бул клиентке кошулду
+assertionLifespanHelp=SAML доомат шарттарында белгиленген жашоо узактыгы. Ошондон кийин доомат жараксыз болот. "SessionNotOnOrAfter" атрибуту өзгөртүлбөйт жана домендик деңгээлдеги "SSO сессиянын максималдуу убактысы" колдонулат.
+noTokensInstructions=Сизде азырынча эч кандай баштапкы жеткиликтүүлүк токендери жок. Баштапкы жеткиликтүүлүк токенин түзүү үчүн "Түзүү" баскычын басыңыз.
+editUsername=Эгер күйгүзүлгөн болсо, колдонуучу аты талаасы өзгөртүлө алат, болбосо окуу режиминде.
+ldapAttributeValueHelp=Катталууда жаңы колдонуучуга кошула турган LDAP атрибутунун мааниси. Сиз 'foo' сыяктуу каалаган маанини түздөн-түз киргизсеңиз болот, ошондой эле атайын токендерди колдонсоңуз болот. Азырынча колдоого алынган токен '${RANDOM}', ал кокустан түзүлгөн сап менен алмаштырылат.
+lastRegistration=Акыркы каттоо
+advancedSettingsOpenid-connect=Бул бөлүм бул клиенттин OpenID Connect протоколу боюнча кеңейтилген жөндөөлөрүн түзөт
+requireSsl=SSL талап кылуу
+reevaluate=Кайра баалоо
+clientOfflineSessionMax=Клиенттин оффлайн сессиясынын максималдуу убактысы
+eventTypes.SEND_VERIFY_EMAIL.description=Тастыктоо электрондук почтасын жөнөтүү
+eventTypes.REVOKE_GRANT_ERROR.description=Берилген уруксатты токтотуу катасы
+descriptionLanding=Колдонуучу федерациясынын башкы барагы үчүн баяндама
+moveHere=Бул жакка көчүрүү
+noKeys=Ачкычтар жок
+batchSizeHelp=Бир транзакцияда LDAPтен Keycloakке импорттолчу LDAP колдонуучуларынын саны
+createClientConditionSuccess=Шарт ийгиликтүү түзүлдү.
+kerberosKeyTab=Kerberos ачкыч таблицасы
+principalAttribute=Негизги атрибут
+mapperTypeLdapAttributeMapperHelp=Бул картачы syncRegistrations күйгүзүлгөн учурда гана колдоого алынат. Keycloakке жаңы катталган колдонуучулар белгилүү бир атрибуттун катуу коддолгон мааниси менен LDAPке жазылат.
+userRegistrationHelpText=Каттоо барагын күйгүзүү/өчүрүү. Каттоо шилтемеси кирүү барагында да көрсөтүлөт.
+activeHelp=Ачкычтарды кол коюу үчүн колдонууга болот деп белгилөө
+addMapperExplain=Көбүрөөк настройка керек болсо, ушул клиентте протокол картачыны түзсөңүз болот
+realmRoles=Домендин ролдору
+fineGrainOpenIdConnectConfigurationHelp=Бул бөлүм бул клиенттин OpenID Connect протоколуна байланыштуу кеңейтилген жөндөөлөрүн түзүү үчүн колдонулат.
+searchForUserDescription=Бул доменде федеративдүү провайдер болушу мүмкүн. Бардык колдонуучуларды карап чыгуу системаны жайлатышы ыктымал, бирок "*" издеп жасаса болот. Жогоруда колдонуучуну издеңиз.
+expirationHelp=Окуялардын мөөнөтүн белгилейт. Мөөнөтү өткөн окуялар мезгил-мезгили менен базадан өчүрүлөт.
+webAuthnPolicySignatureAlgorithmsHelp=Аутентификация дооматында колдонулуучу кол коюу алгоритмдери.
+setToNowError=Ката\! notBefore учурдагы дата жана убакытка орнотууда ката: {{error}}
+eventTypes.UNREGISTER_NODE_ERROR.description=Түйүндү каттабоо катасы
+clientScopeTypes.optional=Милдеттүү эмес
+nameIdFormat=Аты ID форматы
+eventTypes.SEND_VERIFY_EMAIL_ERROR.name=Тастыктоо почтасын жөнөтүү катасы
+addTranslationSuccess=Ийгиликтүү\! Котормо кошулду.
+validRedirectUri=Жарактуу багыттоочу URIлер
+webauthnIntro=Бул форма эмне үчүн колдонулат?
+wantAssertionsEncryptedHelp=Бул кызмат көрсөтүүчү шифрленген Доомат күтөт экенин билдирет.
+roleObjectClasses=Рол объект класстары
+deleteClientScope_other= {{count}} клиент уруксатын өчүрүү
+deleteCredentialsConfirmTitle=Креденциалдарды өчүрүүбү?
+expires=Жарактуулук мөөнөтү
+OVERWRITE=Жаңыртуу
+user-clearEventsHelp=Колдонуучунун бардык окуяларын базадан өчүрүү.
+eventTypes.REFRESH_TOKEN.name=Жаңылоо токени
+userAttribute=Колдонуучу атрибуту
+revoke=Токтотуу
+admin=Админ
+syncUsersError=Колдонуучуларды синхрондоштуруу мүмкүн болбоду\: '{{error}}'
+generatedAccessTokenHelp=Тандалган колдонуучу аутентификацияланганда түзүлүп, клиентке жөнөтүлүүчү мисал токенди караңыз. Токен протокол картачылары жана роль уруксаттары боюнча дооматтар жана ролдор менен толукталат, ошондой эле колдонуучуга берилген ролдор менен дооматтарга негизделет.
+webAuthnPolicyAcceptableAaguidsHelp=Аутентификатор катталуучу уруксат берилген AAGUIDдер тизмеси. AAGUID - бул аутентификатордун түрүн (мисалы, өндүрүүчүсү жана модели) көрсөтүүчү 128-бит идентификатор.
+keyPasswordHelp=Жеке ачкыч үчүн сырсөз
+frontchannelLogout=Фронтканалдан чыгуүү
+clientUpdaterTrustedHostsTooltip=Бул тизмедеги хосттор ишенимдүү деп эсептелет. Эгер клиентти каттоо же жаңылоо суранычы ушул конфигурациядагы хост/доменден келсе, шарт туура болот. Хост аттары же IP даректери колдонсо болот. Башында '*' (мисалы '*.example.com') колдонулса, толук example.com домени ишенимдүү болуп эсептелет.
+titleRoles=Домен ролдору
+mapperTypeGroupLdapMapperHelp=LDAP DNден алынган топторду Keycloak топторуна карталоо үчүн колдонулат
+sectorIdentifierUri.tooltip=Парылык sub маанилерин колдонгон жана Динамикалык Клиент Каттоо колдогон провайдерлер sector_identifier_uri параметрин колдонушу керек. Бул администратордук контролдо турган веб-сайттар тобунун парылык sub маанилерин домен аттарынан көзкарандысыз туруктуу кылууга мүмкүндүк берет. Ошондой эле Клиенттерге redirect_uri домендерин кайра каттабастан өзгөртүүгө мүмкүнчүлүк берет.
+eventTypes.REVOKE_GRANT.name=Берилген уруксатты токтотуу
+rdnLdapAttribute=RDN LDAP атрибуту
+usedBy=Колдонгон
+replyToDisplayName=Жооп берүүнүн көргөзүлүүчү аты
+xRobotsTag=X-Robots-Tag
+bindType=Байлоо түрү
+tokenDeleteSuccess=Баштапкы жеткиликтүүлүк токени ийгиликтүү өчүрүлдү
+contextualInfo=Контексттик маалымат
+syncModeHelp=Бардык картачылар үчүн демейки синхрондоштуруу режими. Синхрондоштуруу режими колдонуучу маалыматын качан картачылар аркылуу синхрондоштурууну аныктайт. Үч мүмкүн мааниси бар\: 'legacy' — бул опция киргизилгенге чейинки жүрүм-турумду сактоо, 'import' — колдонуучуну бир жолу, тактап айтканда, биринчи жолу ушул идентификатор менен киргенде импорттоо, жана 'force' — ар бир кирүүдө колдонуучуну жаңыртуу.
+temporaryPassword=Убактылуу
+applyPolicyHelp=Бул саясат же уруксат аркылуу аныкталган уруксаттарга бардык саясаттар колдонулат.
+addKerberosWizardDescription=Бул жерде текст керек
+sslType.none=Жок
+dateTo=Дата (кийинкиге)
+eventTypes.REVOKE_GRANT.description=Берилген уруксатты токтотуу
+keyPlaceholder=Ачкычты териңиз
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.name=OAuth2 түзмөктүн колдонуучу кодун текшерүү катасы
+addAuthnContextDeclRef=AuthnContext DeclRef кошуу
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.description=Идентификатор провайдердин шилтемесин жөнөтүү
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Идентификатор провайдер токенин алуу
+userInfo=Колдонуучу маалыматы
+consentScreenText=Макулдук экран тексти
+addRoles=Ролдорду кошуу
+clientPoliciesProfilesHelp=Клиент профили ар кандай аткаруучуларды түзүүгө мүмкүндүк берет, алар клиент менен болгон ар кандай аракеттерди көзөмөлдөйт. Адатта, бул административдик аракеттер (мисалы, клиент түзүү же жаңыртуу) же колдонуучу аракеттери (мисалы, клиентке аутентификациялоо) болушу мүмкүн.
+archiveFormatHelp=Java keystore же PKCS12 архив форматы.
+xContentTypeOptions=X-Content-Type-Options
+groupsDescription=Топ - бул колдонуучуга колдонулуучу атрибуттар жана роль карталарынын жыйындысы. Топторду түзсөңүз, өзгөртсөңүз жана өчүрсөңүз болот, ошондой эле алардын бала-ата уюмдарын башкарсаңыз болот.
+addValidatorRole= {{validatorName}} валидаторун кошуу
+protocolTypes.all=Бардыгы
+keyAlias=Ачкыч псевдоними
+xContentTypeOptionsHelp=Демейки мааниси Internet Explorer жана Google Chrome браузерлерин MIME түрүн туура эмес аныктоодон сактайт. <1>Толугураак билүү</1>
+privateKeyMask=ЖЕКЕ АЧКЫЧ ТҮЗҮЛБӨГӨН ЖЕ БИЛИНБЕЙТ
+signOutAllActiveSessions=Бардык активдүү сессиялардан чыгууну аткаруу
+addExecutorSuccess=Ийгиликтүү\! Аткаруучу түзүлдү
+executorTypeSelectHelpText=Аткаруучу түрүн тандоо боюнча жардам тексти
+useDiscoveryEndpointHelp=Бул параметр күйгүзүлгөн болсо, провайдердин конфигурациясын алуу үчүн discovery endpoint колдонулат. Keycloak конфигурацияны ошол endpointтен жүктөйт жана булакта жаңыртуулар болсо автоматтык жаңыртат.
+eventTypes.USER_INFO_REQUEST_ERROR.name=Колдонуучу маалымат суранышы катасы
+createUserProviderError=Колдонуучу федерация провайдерин түзүү мүмкүн болбоду\: {{error}}
+learnMore=Толугураак билүү
+onDragCancel=Тартууну жокко чыгаруу. Тизмек өзгөргөн жок.
+removeUser=Колдонуучуларды өчүрүү
+ownerManagedAccess=Колдонуучу тарабынан башкарылуучу жеткиликтүүлүк күйгүзүлгөн
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=Колдонуучу туруктуу бөгөттөө менен өчүрүлдү
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=Колдонуучу туруктуу бөгөттөө катасы менен өчүрүлдү
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Колдонуучу убактылуу бөгөттөө менен өчүрүлдү
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=Колдонуучу убактылуу бөгөттөө катасы менен өчүрүлдү
+userModelAttributeNameHelp=LDAPтен колдонуучуну импорттоо учурунда кошулуучу модель атрибутунун аты
+templateHelp=Импорттолчу колдонуучу атын форматтоо үчүн колдонулуучу шаблон. Алмаштыруулар ${} ичинде болот. Мисалы\: '${ALIAS}.${CLAIM.sub}'. ALIAS — провайдердин псевдоними. CLAIM.<NAME> — ID же Access токен дооматка шилтеме. Алмаштырууну |uppercase же |lowercase кошуу менен жогорулатууга же төмөндөтүүгө болот, мисалы, '${CLAIM.sub | lowercase}'.
+permissions=Уруксаттар
+emptyExecutionInstructions=Бул агымды субагым же аткаруу кошуу менен аныктай аласыз
+offlineSessionSettings=Офлайн сессия жөндөөлөрү
+unAssignRole=Ролду өчүрүү
+deleteScope=Pермaненттүү авторизация масштабы өчүрүлөтбү?
+eventTypes.CODE_TO_TOKEN.description=Коддон токенге
+oAuthDevicePollingIntervalHelp=Клиент токен endpointке суроо узатканда минималдуу күтүүлүү убактысы (секунд менен).
+passwordDataTitle=Сырсөз маалыматы
+accountThemeHelp=Колдонуучу эсеп башкаруу консолу үчүн тема тандаңыз.
+clientPolicies=Клиент саясаты
+NONE=NONE
+keystorePasswordHelp=Keystore үчүн сырсөз
+clientSettings=Клиент маалыматы
+deleteClientPolicyConditionConfirm=Бул аракет {{condition}} дайыма өчүрөт. Бул калыбына келтирилбейт.
+selectATheme=Теманы тандаңыз
+themeColors=Тема түстөрү
+defaults=Туруктуу жөндөөлөргө кайтаруу
+themeColorsLight=Тема түстөрү [жарык]
+themeColorsDark=Тема түстөрү [караңгы]
+themePreviewInfo=Тема түстөрүн алдын ала карап чыгуу үчүн учурдагы тема сиз карагыңыз келген темага автоматтык түрдө которулду.
+backgroundImage=Кирүү фону сүрөтү
+favicon=Favicon
+errorColor=Ката түсү
+successColor=Ийгилик түсү
+activeColor=Активдүү түс
+primaryColor=Негизги түс
+primaryColorHover=Негизги түс (курсор үстүндө)
+secondaryColor=Кошумча түс
+linkColor=Шилтеме түсү
+linkColorHover=Шилтеме түсү (курсор үстүндө)
+backgroundColorAccent=Фон түсүнүн акценти
+backgroundColor=Фон түсү
+backgroundColorNav=Навигация фону түсү
+backgroundColorHeader=Башкы бет фону түсү
+iconColor=Иконка түсү
+textColor=Мәтин түсү
+lightTextColor=Жарык текст түсү
+inputBackgroundColor=Кирүү талаасынын фону түсү
+inputTextColor=Кирүү талаасынын текст түсү
+permissionsList=Уруксаттар тизмеси
+attributeGroupHelp=Бул атрибут кайсы колдонуучу профили тобуна кошуларын көрсөтөт. Бул экранда атрибуттарды топтоо үчүн колдонулат.
+createRealm=Домен түзүү
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=Жеткиликтүүлүк токенин текшерүү катасы
+mapperSaveError=Картачыны сактоо катасы\: {{error}}
+eventTypes.CLIENT_LOGIN_ERROR.name=Клиент кирүү катасы
+passwordPoliciesHelp.passwordHistory=Жакында колдонулган сырсөздү кайра колдонууга бөгөт коюу.
+displayOnConsentScreenHelp=Эгер күйгүзүлгөн болсо жана бул клиент масштабы уруксат талап кылынган клиентке кошулса, 'Макулдук экраны тексти' көрсөтүлөт. Эгер өчүрүлгөн болсо, бул масштаб макулдук экранында көрүнбөйт.
+requirements.DISABLED=Өчүрүлгөн
+mapperTypeHardcodedLdapGroupMapperHelp=LDAPтен импорттолгон колдонуучулар автоматтык түрдө ушул топко кошулат.
+titleUsers=Колдонуучулар
+whoWillAppearLinkText=Бул топтун тизмесинде кимдер көрсөтүлөт?
+ldapFullNameAttribute=LDAP толук аты атрибуту
+createClientError=Клиент түзүлө алган жок\: '{{error}}'
+deleteConfirmClientScopes=Бул клиент масштабын өчүргүңүз келет беле?
+forceAuthenticationHelp=Идентификатор провайдери мурунку коопсуздук контекстине таянбастан түздөн-түз тастыктоо керекпи.
+testClusterAvailability=Кластердин жеткиликтүүлүгүн текшерүү
+reGenerateSigning=Бул клиент үчүн кол коюу ачкычын кайра түзүү
+authorizationEncryptedResponseAlgHelp=JWT жооп режими үчүн уруксат жооп шифрлөөнү башкарууда колдонулган JWA алгоритми. Эгер бош калса, жооп кол коюлат, бирок шифрленбейт.
+deleteConfirmGroup_other=Бул топторду өчүргүңүз келет беле?
+scopePermissions.users.manage-description=Администратордун домендеги бардык колдонуучуларды башкаруусун аныктоочу саясаттар
+defaultACRValuesHelp=OIDC суроосунда 'claims' же 'acr_values' параметрлеринде так көрсөтүлбөгөн учурда колдонулуучу демейки ыктыярдуу ACR маанилери.
+minimumACRValueHelp=Keycloak тарабынан иштелип чыккан минималдуу ACR. Бул параметр 'acr_values' же 'claims' аркылуу белгиленген төмөнкү ACR маанилерин басат, эгер алар маанилүү катары белгиленбесе.
+membershipAttributeType=Мүчөлүк атрибут түрү
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Иттелген уруксат суроосу
+included.client.audience.tooltip=Белгиленген аудиториялык клиенттин Client IDси токендин аудитория (aud) талаасына кошулат. Токен аудиториялар тизмесине ээ болсо, бул мааниси аларга кошулат. Мурдагы аудиторияларды алмаштырбайт.
+searchGroup=Топту издөө
+allowCreateHelp=Сырткы идентификатор провайдерине негизги идентификаторду түзүүгө уруксат берүү.
+allResults=Бардык натыйжалар
+addressClaim.locality.tooltip=Колдонуучу атрибутунун аталышы, ал 'address' токен дооматындагы 'locality' субдооматы менен карталат. Демейки мааниси 'locality'.
+keyForCodeExchangeHelp=Proof Key for Code Exchange (PKCE) ыкмасын тандаңыз. Эгер көрсөтүлбөсө, Keycloak авторизация суроосунда туура код чакырыгы менен код алмашуу ыкмасы жок болсо, PKCE колдонбойт.
+includeInAccessTokenResponse.tooltip=Доомат жеткиликтүүлүк токенине кошулушу керекпи? Бул чын гана маалымат берүүчү, сырдуу эмес маалыматтар үчүн колдонулушу керек.
+removeMappingConfirm_one=Бул ролду өчүргүңүз келет беле?
+oidcSettings=OpenID Connect жөндөөлөрү
+oAuthSettings=OAuth2 жөндөөлөрү
+otpPolicyDigitsHelp=OTP канча сандык болуусу керек?
+clientAuthentications.client_secret_post=Клиент сырсөзү POST жолу менен жөнөтүлөт
+prompts.select_account=Каттоо эсебин тандаңыз
+defaultACRValues=Демейки ACR маанилери
+minimumACRValue=Минималдуу ACR мааниси
+valueError=Мааниси берилиши керек.
+noConsents=Макулдуктар жок
+orderChangeSuccessUserFed=Колдонуучу федерация провайдерлеринин артыкчылык тартибин ийгиликтүү өзгөрттү
+noUsersEmptyStateDescriptionContinued=аларды табуу үчүн. Бул ролду натыйжалуу рол катары мурунтан алган колдонуучулар бул жерге кошулбайт.
+userProviderSaveError=Колдонуучу федерация провайдерин сактоодо ката болду\: {{error}}
+executorsHelpText=Бул кардар профилине колдонулуучу аткаруучулар
+ldapSearchingAndUpdatingSettings=LDAP издөө жана жаңылоо
+authenticationAliasHelp=Конфигурациянын аталышы
+SSOSessionIdle=SSO сессиясы бош абалда
+deleteClientPolicyConditionConfirmTitle=Шарт өчүрүлсүнбү?
+initialCounterErrorHint=Мааниси 1 менен 120 ортосунда болушу керек
+connectionTimeout=Туташуу мөөнөтү бүттү
+passLoginHintHelp=Кирүү подсказкасын идентификация провайдерине өткөрүп берүү
+monthHelp=Саясатка кайсы айда уруксат берилерин көрсөтөт. Экинчи талааны толтуруп диапазон да көрсөтсө болот. Бул учурда уруксат учурдагы ай сиз берген эки маанинин ортосунда же барабар болгондо гана берилет.
+eventTypes.CLIENT_LOGIN.description=Клиент кирүүсү
+registrationAccessToken=Каттоо жеткиликтүүлүк токени
+headerName=Тема аталышы
+issuerHelp=Жооп берүүчүнүн чыгарган идентификатору. Эгер көрсөтүлбөсө, текшерүү жүргүзүлбөйт.
+uiDisplayNameHelp=Админ UIда байланышкан учурда провайдердин көрсөтүлүүчү аты
+titleSessions=Сессиялар
+dedicatedScopeName={{clientName}}-арналган
+mapperTypeUserAttributeLdapMapper=колдонуучу-атрибут-ldap-картачы
+deleteAttributeConfirmTitle=Атрибут өчүрүлсүнбү?
+importSkipped_zero=Өткөрүлбөгөн жазуулар жок.
+rootURL=Салыштырмалуу URLдарга кошулган түп URL
+contentSecurityPolicyHelp=Демейки мааниси башка домендердин iframeдерин тосот. <1>Толугураак билүү</1>
+policyUsers=Бул саясатка уруксат берилген колдонуучуларды көрсөтөт.
+logoutServicePostBindingURLHelp=SAML POST байланышы URLи кардардын жалгыз чыгуусу үчүн. Башка байланышты колдонсоңуз бош калтырыңыз.
+generatedIdTokenNo=Жасалган id токен жок
+byConfiguration=Конфигурация боюнча
+usersAdded_other={{count}} колдонуучу топко кошулду
+userFedUnlinkUsersConfirmTitle=Бардык колдонуучуларды байланыштан ажыратасызбы?
+passCurrentLocale=Азыркы тилди өткөрүү
+realmNameField=Домен аталышы
+roleCreated=Роль түзүлдү
+socialProfileJSONFieldPath=Социалдык профиль JSON талаасынын жолу
+noViewRights=Бул топту көрүүгө уруксат жок
+eventTypes.SEND_RESET_PASSWORD.description=Сырсөздү калыбына келтирүү жөнөтүү
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=Кардар баштаган аккаунтту байланыштыруу
+resourceScopeError=Уруксат масштабын өчүрүү мүмкүн болбоду\: {{error}}
+identityInformation=Түндүк маалыматы
+usermodel.clientRoleMapping.rolePrefix.label=Кардар ролунун префикси
+partialImport=Жарым-жартылай импорт
+cibaBackhannelTokenDeliveryModes.ping=Ping
+includeInTokenScopeHelp=Күйгүзүлгөндө, бул кардар масштабынын аты жеткиликтүүлүк токенинин 'scope' касиетине жана Token Introspection Endpoint жообуна кошулат. Өчүрүлгөндө, токенден жана Introspection жообунан алынып салынат.
+savePassword=Сырсөздү сактоо
+noRolesInstructions-users=Бул колдонуучуга рол берилген эмес. Баштоо үчүн роль таандаңыз.
+signatureKeyNameHelp=Кол коюлган SAML документтеринде кол коюу ачкычтын идентификатору KeyName элементинде көрсөтүлөт. Keycloak / RH-SSO үчүн KEY_ID, MS AD FS үчүн CERT_SUBJECT, башка үчүн NONE колдонсоңуз болот.
+sync-keycloak-roles-to-ldap=Keycloak ролдорун LDAPге синхрондоштуруу
+decisionStrategies.UNANIMOUS=Бир добуштуу макулдук
+cacheSettingsDescription=Бул бөлүм колдонуучуларды кэштөө үчүн пайдалуу параметрлерди камтыйт, алар колдонуучу сактагыч провайдеринен жүктөлгөн.
+groupsPathHelp=Keycloakтогу топтун жолун көрсөтөт, анда LDAP топтору кошулат. Мисалы '/Applications/App1' болсо, LDAP топтор Keycloakтогу 'Applications' топтун ичинде 'App1' подгруппасында болот. Демейки '/' болсо, LDAP топтор түз Keycloak топтору менен байланышат. Бул жол Keycloakта буга чейин бар болушу керек.
+aesGenerated=aes-жасалган
+addPolicy=Саясат кошуу
+tokenClaimName.label=Токен доомат аталышы
+executorsTable=Аткаруучулар таблицасы
+extendToChildren=Балдарга кеңейтүү
+from=Башынан
+decisionStrategyHelp=Чечим стратегиясы уруксаттарды кандай баалаш керектигин жана акыркы чечимди кандай алуу керектигин көрсөтөт. 'Affirmative' - ресурска жана анын масштабдарына жеткиликтүүлүк үчүн кеминде бир уруксат оң болушу керек. 'Unanimous' - бардык уруксаттар оң чечим кабыл алышы керек.
+deleteClientPolicyProfileError=Саясаттан профильди өчүрүү мүмкүн болбоду\: {{error}}
+greaterThan=Мааниси {{value}} дан чоң болушу керек
+hideOnLoginPage=Кирүү бетинде жашыруу
+couldNotCreateGroup=Топ түзүү мүмкүн болбоду {{error}}
+defaultRole=Бул роль домен жана кардар демейки ролдорун камтыйт. Ал өчүрүлбөйт.
+eventConfigs=Иш-чара конфигурациялары
+conditionsHelp=Бул шарттар белгилүү аракет учурунда кардар саясаты колдонулушу керектигин аныктайт.
+disableProvider=Провайдерди өчүрүүбү?
+eventTypes.UNREGISTER_NODE.name=Түйүндү каттоодон чыгарып салуу
+anonymousAccessPoliciesHelp=Бул саясаттар кардар каттоо кызматы аутентификациясыз чакырылганда колдонулат. Баштапкы жеткиликтүүлүк токени же Bearer токени жок суроолор.
+clientScopeError=Масштаб картасын жаңылоо мүмкүн болбоду {{error}}
+saveRealmSuccess=Домен ийгиликтүү түзүлдү
+createToken=Баштапкы жеткиликтүүлүк токенин түзүү
+clientsClientTypeHelp='OpenID Connect' кардарларга Авторизация Сервери тарабынан жүргүзүлгөн аутентификациянын негизинде Колдонуучунун өздүгүн текшерүүгө мүмкүндүк берет.'SAML' веб-негизиндеги аутентификация жана уруксат берүү сценарийлерин, анын ичинде чек арасыз жалгыз кирүүнү (SSO) колдойт жана дооматтарды өткөрүү үчүн коопсуздук токендерин колдонот.
+orderChangeSuccess=Идентификация провайдерлеринин көрсөтүү тартиби ийгиликтүү өзгөртүлдү
+emptyPoliciesInstructions=Саясат түзгүңүз келсе, төмөндөгү баскычты басыңыз.
+createScopeSuccess=Уруксат масштабы ийгиликтүү түзүлдү
+logoUrl=Логотип URLи
+accessTokenLifespanImplicitFlowHelp=OpenID Connectтин Implicit Flowдо берилген жеткиликтүүлүк токенинин жарактуулук мөөнөтүнүн максималдуу убактысы. Бул SSO мөөнөтүнөн кыска болушу сунушталат. Implicit Flowдо токенди жаңыртуу мүмкүн эмес, ошондуктан өзүнчө мөөнөт бар.
+noRealmRolesToAssign=Тапшырылчу домен ролдору жок
+logoutUrl=Чыгуу URLи
+regexPatternHelp=Регулярдык өрнөктүн мисалы.
+searchForUserEvent=Колдонуучу издөө иш-чарасы
+usernameLdapAttributeHelp=LDAP атрибутунун аты, ал Keycloak колдонуучу аты катары карталат. Көп LDAP серверлеринде бул 'uid' болушу мүмкүн. Active Directoryде 'sAMAccountName' же 'cn' болушу мүмкүн. LDAPтен Keycloakке импорттоо үчүн бардык колдонуучу жазууларда толтурулушу керек.
+federationLink=Федерация шилтемеси
+webAuthnPolicyPasswordlessFormHelp=Паролсуз WebAuthn аутентификация саясаты. Бул саясат 'Webauthn Register Passwordless' талап кылынган аракетте жана 'WebAuthn Passwordless Authenticator' аутентификатордо колдонулат. Негизги колдонуу WebAuthn биринчи фактор катары колдонулган учурда. 'WebAuthn Policy' жана 'WebAuthn Passwordless Policy' эки саясатын бир доменде колдонууга мүмкүндүк берет.
+unlinkUsersError=Колдонуучуларды ажыратууда ката болду\: '{{error}}'
+roleHelpHelp=Колдонуучу ролун ыйгаруу. Ролду издөөгө 'Роль тандаңыз' баскычын басыңыз же текстке кол менен териңиз. Приложение ролун көрсөтүү үчүн синтаксис appname.approle, мисалы myapp.myrole.
+storedTokensReadable=Сакталган токендер окула алат
+defaultRoleDeleteError=Демейки роль өчүрүлбөйт.
+unknownUser=Аноним
+displayHeader=Көрсөтүлүүчү аталыш
+userVerify.not\ specified=Көрсөтүлбөгөн
+usermodel.prop.label=Мүнөздөмө
+userFedUnlinkUsersConfirm=Бардык колдонуучуларды ажыраткыңыз келеби? Маалымат базасында сырсөзү жок колдонуучулар аутентификация боло албай калат.
+searchUserByAttributeDescription=Бир нече атрибутту издөө фильтри катары коюуга колдоо бар, ар башка ачкычтар же маанилер аркылуу. Бир ачкычка бир гана маанини терүүгө болот.
+eventTypes.REMOVE_FEDERATED_IDENTITY.name=Федерацияланган иденттүүлүктү өчүрүү
+membership=Мүчөлүк
+eventTypes.RESET_PASSWORD.description=Сырсөздү калыбына келтирүү
+authenticationOverrides=Аутентификация агымын алмаштыруу
+client-scopes-condition.label=Күтүлгөн Scope’тор
+deleteAttributeSuccess=Атрибут өчүрүлдү
+artifactResolutionService=Артефакт чечүү кызматы
+clientProfilesSubTab=Кардардын профиль субтапы
+selectEncryptionType=Шифрлөө түрүн тандаңыз
+mapperTypeMsadLdsUserAccountControlMapper=msad-user-account-control-mapper
+realmSettingsExplain=Реалм орнотуулары - учурдагы реалмдеги колдонуучулар, тиркемелер, ролдор жана топтор боюнча параметрлерди көзөмөлдөгөн орнотуулар.
+mappingUpdatedError=Карталаштыруу жаңыртылбай калды\: '{{error}}'
+manageDisplayOrder=Көрсөтүү тартибин башкаруу
+emptyRealmBasedIdps=Бул реалм үчүн реалмге негизделген аутентификация провайдерлери жок.
+hideOrganizationLinkedIdps=Уюмга байланышкан аутентификация провайдерлерин жашыруу
+exactSearch=Так издөө
+value=Мааниси
+filenamePlaceholder=PEM файлын жүктөп салыңыз же ачкычты төмөнгө чаптаңыз
+deleteConfirm_one=Бул '{{groupName}}' тобун өчүргүңүз келеби?
+scopeDisplayNameHelp=Бул scope үчүн уникалдуу ат. Бул ат scope’ту уникалдуу аныктоодо колдонулат, белгилүү scope’ту издегенде пайдалуу.
+times.seconds=Секунд
+removeMappingTitle=Ролду алып салуу?
+executorTypeSelectAlgorithm=Аткаруучу түрү тандоо алгоритми
+resources=Ресурстар
+userRolesRetrieveStrategy=Колдонуучу ролдорун алуу стратегиясы
+importKey=Ачкычты импорттоо
+events-disable-title=Иш-чараларды сактабаганыңызга ишенесизби?
+ellipticCurve=Эллиптикалык ийри сызык
+forceArtifactBindingHelp=Жооптор SAML ARTIFACT байлап системасы аркылуу кардарга кайтарылышы керекпи?
+forceAuthentication=Аутентификацияны күчтөндүрүү
+connectionPoolingHelp=Keycloak LDAP серверине туташуу үчүн connection pooling колдонушу керекпи аныктайт. StartTLS күйгүзүлгөндө connection pooling колдонулбайт.
+unlink=Байланышты өчүрүү
+groupRemove_other=Топтор өчүрүлдү
+claimFilterName=Негизги талап
+deletePolicy=Саясатты толугу менен өчүрүүбү?
+assertionConsumerServiceRedirectBindingURLHelp=SAML Redirect Binding URL кардардын талапты кабыл алуу кызматы үчүн (күйгүзүү жооптору). Эгер URL жок болсо бош калтырсаңыз болот.
+searchFor=Ролду аты менен издөө
+providers=Провайдерлерди кошуу
+writeOnly=Жазуу гана
+noRolesInstructions-clientScopes=Бул кардар scope үчүн ролдор түзүлгөн жок. Баштоо үчүн роль түзүңүз.
+noRolesInstructions-clients=Бул кардар scope үчүн ролдор түзүлгөн жок. Баштоо үчүн роль түзүңүз.
+removeImportedUsersMessage=Импорттолгон бардык колдонуучуларды өчүргүңүз келеби?
+noGroupsInThisSubGroup=Бул субтопто топтор жок
+validateUserObjectClasses=Бир же бир нече колдонуучу объект класстарын киргизишиңиз керек
+encryptionAlgorithm=Шифрлөө алгоритми
+requiredForLabel.users=Жөн гана колдонуучулар
+groupUpdated=Топ жаңыртылды
+hideMetaData=Метадеректерди жашыруу
+customAttribute=Ыңгайлаштырылган атрибут…
+themes=Тема
+clientType=Кардардын түрү
+addClientScope=Кардардын scope’сун кошуу
+notBeforeSuccess=Ийгилик\! Реалм үчүн "Not before" орнотулду
+clientPoliciesSubTab=Кардардын саясат субтапы
+quickLoginCheckMilliSecondsHelp=Эгер мүчүлүштүк өтө тез катталса, колдонуучуну блоктоо.
+unanimous=Бир добуштан
+policy-name=Бул саясаттын аты.
+syncRegistrations=Каттоолорду синхрондоштуруу
+eventTypes.REMOVE_TOTP.name=TOTP өчүрүү
+clientHelp=Бул уруксат суранычын жасап жаткан кардарды тандаңыз. Эгер берилбесе, уруксат суранычтары сиз турган кардарга ылайык жүргүзүлөт.
+eventTypes.CLIENT_REGISTER_ERROR.name=Кардарды каттоо ката
+unlockUsersError=Бардык колдонуучуларды ачуу мүмкүн болгон жок {{error}}
+serviceProviderEntityIdHelp=Бул SAML Service Provider уникалдуу аныктоочу Entity ID.
+disabledFeatures=Өчүрүлгөн функциялар
+eventTypes.UPDATE_CONSENT_ERROR.name=Келишим жаңылоо ката
+noAdminUrlSet=Пуш жөнөтүлгөн жок. Админ URI орнотулбаган же катталган кластер түйүндөр жок
+authData=Уруксат берүү маалыматтары
+realmInfo=Реалм жөнүндө маалымат
+chooseAPolicyType=Саясат түрүн тандаңыз
+signOut=Чыгуу
+deleteExecutorError=Аткаруучуну өчүрүү мүмкүн болгон жок\: {{error}}
+userProfileError=Колдонуучу профилинин жөндөөлөрүн жаңылоо мүмкүн болгон жок\: {{error}}
+validatorDialogColNames.colName=Ролдун аты
+clientUpdaterSourceRolesTooltip=Бул шарт кардардын катталуу же жаңыртуу суроолорунда текшерилет; эгерде ал субъект (адатта колдонуучу) белгиленген рольго тиешелүү кардарды түзсө же жаңыртса, шарт чын болот. Реалм ролду көрсөтүү үчүн 'my_realm_role' сыяктуу аталышты колдонсо болот. Клиент ролду көрсөтүү үчүн client_id.role_name форматындагы аталышты колдонсо болот; мисалы, 'my_client.my_client_role' 'my_client' кардарынын 'my_client_role' ролун билдирет.
+UPDATE_PASSWORD=Сырсөздү жаңыртуу (UPDATE_PASSWORD)
+version=Версия
+synchronizationSettings=Синхрондоштуруу жөндөөлөрү
+certificateHelp=Кардардын сертификаты, кардардын чыгарган JWT токенин текшерүү жана ачкычты сактоочу жайдагы жеке ачкыч менен кол коюу үчүн.
+resetPasswordError=Сырсөздү калыбына келтирүүдө ката пайда болду\: {{error}}
+associatedPermissions=Тийиштүү уруксаттар
+encryptionKeysConfigExplain=Эгер төмөндөгү "Шифрлөө билдирүүлөрүн" күйгүзсөңүз, анда шифрлөө ачкычтарын түзүп же импорттоого туура келет, андан соң SAML билдирүүлөрү AES менен кардардын ачык ачкычы аркылуу шифрленет.
+preserveGroupInheritanceHelp=LDAP топ мурастоосун Keycloak'го өткөрүү параметри. Эгер жалган болсо, анда бардык LDAP топтор Keycloak'до жалпак жогорку деңгээлдеги топтор катары карталат. Болбосо топ мурастоо сакталат, бирок LDAP структурасында кайталануулар же бир топто бир нече ата-эне топтор бар болсо топтун синхронизациясы ката кетириши мүмкүн.
+createScopeBasedPermission=Scope негизиндеги уруксат түзүү
+showMore=Көбүрөөк көрсөтүү
+operationType=Операциянын түрү
+userInitiatedActionLifespan=Колдонуучу баштаган аракеттин жашоо мөөнөтү
+decisionStrategy=Чечим кабыл алуу стратегиясы
+roleMappingUpdatedSuccess=Рол карталаштыруусу жаңыртылды
+securityDefences=Коопсуздук коргоолору
+realmSettings=Реалм орнотуулары
+emptyStateInstructions=Эгер атрибуттар тобун кошууну кааласаңыз, төмөндөгү баскычты басыңыз.
+logoutAllSessionsError=Ката\! Бардык сессиялардан чыгуу мүмкүн болгон жок\: {{error}}.
+eventTypes.VERIFY_EMAIL_ERROR.name=Электрондук почтаны текшерүү ката
+partialExport=Жарым-жартылай экспорт
+eventTypes.CLIENT_REGISTER.description=Кардардын катталуусу
+generalOptions=Жалпы параметрлер
+decisionStrategies.AFFIRMATIVE=Макулдук
+helpEnabled=Жардам күйгүзүлгөн
+defaultGroupsHelp=Тандалган топтор жаңы колдонуучу түзүлгөндө же импорттолгондо автоматтык түрдө топ мүчөлүгүн берүүгө мүмкүндүк берет <1>identity brokering</1>.
+times.years=Жылдар
+userLdapFilterHelp=Изделген колдонуучуларды чыпкалоо үчүн кошумча LDAP фильтри. Эгер кереги жок болсо, бош калтырыңыз. Фильтр '(' менен башталып ')' менен бүтүшү керек.
+generatedIdToken=Жасалган ID токен
+effectiveRoleScopeMappings=Иштөөчү роль-	scope карталаштыруулары
+clientAuthenticator=Кардардын аутентификатору
+importAdded_other={{count}} жазуулар кошулду.
+oAuthDeviceCodeLifespanHelp=Курал коду жана колдонуучу коду иштен чыгып калмайынча максималдуу убакыт. Бул убакыт жетиштүү узун болушу керек, колдонуучу экинчи түзмөгүн алып келип, текшерүү дарегине кирип, кирүүсүнө мүмкүндүк берүү үчүн, бирок фишинг үчүн алынган коддун иштөө мөөнөтүн чектөө үчүн жетиштүү кыска.
+dynamicScopeHelp=Күйгүзүлгөн болсо, бул scope статикалык жана өзгөрмө бөлүктөн турган динамикалык scope катары каралат.
+attributePermissionDescription=Бул бөлүмдө атрибутту ким түзөт жана ким көрө алат уруксаттары камтылган.
+providerDetails=Провайдердин деталдары
+groupDeleteError=Топту өчүрүүдө ката пайда болду {{error}}
+editGroupText=Атрибуттар тобун түзөтүү
+updateFirstLoginHelp=Биринчи кирүүдө профильди жаңыртуу
+deleteGroup=Топту өчүрүү
+eventTypes.VERIFY_EMAIL_ERROR.description=Электрондук почтаны текшерүү ката
+close=Жабуу
+usersDNHelp=Колдонуучуларыңыз жайгашкан LDAP дарагынын толук DN. Бул DN LDAP колдонуучуларынын ата-энеси болуп саналат. Мисалы, 'ou\=users,dc\=example,dc\=com' болушу мүмкүн, ал эми сиздин орточо колдонуучу 'uid\='john',ou\=users,dc\=example,dc\=com' сыяктуу DNге ээ болот.
+addKeycloakOpenIdProvider=Keycloak OpenID Connect провайдерин кошуу
+addOAuth2Provider=OAuth v2 провайдерин кошуу
+clientSessionMax=Кардардын сессиясынын максималдуу узактыгы
+deleteClientPolicy=Кардар саясатын өчүрүү
+authenticatorAttachment.cross-platform=Платформа аралык
+whoCanView=Ким көрө алат?
+lastAccess=Акыркы кирүү
+emptyClientScopesInstructions=Бул кардарга азырынча эч кандай кардар scope’тору байланыштырылган жок. Протокол мапперлери жана ролдор менен бөлүшүү үчүн бар scope’торду ушул кардарга кошсоңуз болот.
+clientAuthentications.private_key_jwt=Жеке ачкыч менен кол коюлган JWT
+uiDisplayName=UI көрсөтүүчү аталыш
+createClientSuccess=Кардар ийгиликтүү түзүлдү
+adminEventsSettings=Админ иш-чараларынын жөндөөлөрү
+cibaInterval=Интервал
+totalMemory=Жалпы эс тутум
+usernameTemplateImporter=Импорттоо үчүн колдонуучу атын форматтоо.
+resourceNameHelp=Бул ресурс үчүн уникалдуу аталыш. Ресурсту так аныктоо үчүн колдонулат, белгилүү ресурс үчүн суроо салууда пайдалуу.
+times.minutes=Мүнөттөр
+disableUserInfo=Колдонуучу маалыматын өчүрүү
+authorizationEncryptedResponseEnc=Уруксат берүү жоопторун шифрлөө мазмунун шифрлөө алгоритми
+editCondition=Шартты түзөтүү
+viewCondition=Шартты көрүү
+ssoSessionMaxRememberMe=Колдонуучу "эсимде сакта" параметрин орнотсо, сессиянын иштен чыгуусуна чейинки максималдуу убакыт. Сессия аяктагандан кийин токендер жана браузер сессиялары жараксыз болот. Орнотулбаса стандарттуу SSO Session Max колдонулат.
+forcePostBinding=POST байламына мажбурлоо
+usersExplain=Колдонуучулар - учурдагы реалмдеги колдонуучулар.
+passMaxAgeHelp=Identity providerге max_age бериңиз.
+exportFail=Реалм экспорттолбой калды\: '{{error}}'
+flowTypeHelp=Бул кандай форма
+targetHelp=Маппер үчүн багыт талаа. LOCAL (стандарт) - колдонуучу импорттолот кезде жергиликтүү базада сакталган колдонуучу атына өзгөрүүлөр колдонулат. BROKER_ID жана BROKER_USERNAME федерация колдонуучусун издөөнү колдонгон ID же колдонуучу атына өзгөрүүлөр сакталат.
+setPasswordConfirm=Сырсөздү орнотосузбу?
+attributeDisplayNameHelp=Атрибуттун көрсөтүлүүчү аты. Локалдаштырылган маанилер үчүн ачкычтарды колдойт. Мисалы\: ${profile.attribute.phoneNumber}. Терезенин "Globe Route" иконкасын басып котормолорду кошсоңуз болот.
+assignedType=Белгиленген түрү
+modeHelp=LDAP_ONLY - колдонуучулардын бардык топ карталаштыруулары LDAPдан алынат жана LDAPда сакталат. READ_ONLY - окуу режими, топ карталаштыруулар LDAPдан жана базадан алынат жана биригет. Жаңы топко кошулуштар LDAPга сакталбайт, базага сакталат. IMPORT - окуу режими, колдонуучу LDAPдан импорттолгондо топ карталаштыруулар алынат жана жергиликтүү Keycloak базасына сакталат.
+identityProvider=Identity провайдер
+forgotPasswordHelpText=Кирүү барагында сырсөзүн унуткан колдонуучулар үчүн шилтемени көрсөтүү.
+identityProviderLinks=Identity провайдер шилтемелери
+mapperTypeMsadLdsUserAccountControlMapperHelp=MSAD LDSге атайын маппер. MSAD LDS колдонуучу аккаунтунун абалын Keycloak аккаунт абалына интеграциялай алат (аккаунт иштетилген, сырсөздүн мөөнөтү бүттү ж.б.). 'msDS-UserAccountDisabled', 'msDS-UserPasswordExpired' жана 'pwdLastSet' атрибуттарын окуй алат. Мисалы, эгер 'pwdLastSet' 0 болсо, колдонуучу сырсөзүн жаңыртууга милдеттүү. Башка мисалда, эгер 'msDS-UserAccountDisabled' 'TRUE' болсо, колдонуучу өчүрүлгөн. Ошондой эле LDAP колдонуучу аутентификациясынан келген ката коддорун иштей алат.
+leave=Чыгуу
+loginSettings=Кирүү жөндөөлөрү
+deleteMessageBundleError=Билдирмени топтон өчүрүүдө ката, {{error}}
+finish=Аяктоо
+eventTypes.LOGIN_ERROR.name=Кирүүдө ката
+validations=Текшерүүлөр
+updatedRequiredActionError=Милдеттүү аракетти жаңылоо мүмкүн болбой калды\: {{error}}
+createChildGroup=Балалык топ түзүү
+x509Certificate=X509 Сертификат
+addressClaim.formatted.label=Форматталган дарек үчүн колдонуучу атрибуту
+metadataOfDiscoveryEndpoint=Дискавери аяктоочунун метадареттери
+add=Кошуу
+createPolicySuccess=Саясат ийгиликтүү түзүлдү
+notVerified=Текшерилген эмес
+encryptionKeysConfig=Шифрлөө ачкычтарынын конфигурациясы
+updateClientProfileSuccess=Кардардын профили ийгиликтүү жаңыланды
+openIDEndpointConfiguration=OpenID аяктоочунун конфигурациясы
+oid4vcIssuerMetadata=OpenID4VCI Креденциал берүүчү метадареттери
+prompts.login=Кирүү
+users=Колдонуучулар
+keyTabHelp=Server принцибинен керектүү күбөлүктөр камтылган Kerberos KeyTab файлынын жери. Мисалы, /etc/krb5.keytab
+wantAssertionsEncrypted=Талаптарды шифрлөөнү каалайм
+noClientPoliciesInstructions=Кардар саясаттары жок. Жаңы кардар саясатын түзүү үчүн 'Create client policy' тандаңыз.
+deleteValidatorConfirmMsg=Validator {{validatorName}} толугу менен өчүрүлө турганына ишенесизби?
+uris=URI’лер
+jwksUrlConfig=JWKS URL конфигурациялары
+forceNameIdFormatHelp=Суралган NameID субъект форматын өткөрбөй коюп, Админ UIда орнотулган форматын колдонуу.
+validateKeyTab=KeyTab киргизишиңиз керек
+editUsernameAllowed=Колдонуучу атын түзөтүү уруксат берилген
+searchType.attribute=Атрибут боюнча издөө
+saveProviderError=Провайдерди сактоодо ката\: {{error}}
+port=Порт
+searchForPermission=Уруксат издөө
+ldapFilterHelp=LDAP Фильтри - LDAP топторду алуу үчүн кошумча ыңгайлаштырылган чыпка кошот. Кереги жок болсо бош калтырыңыз жана бардык топтор алынат. Болбосо, фильтр '(' менен башталып, ')' менен бүтүшү керек.
+clientUpdaterSourceGroupsTooltip=Текшерүү үчүн топтордун аттары. Эгерде кардарды түзгөн же жаңырткандын бирөө белгиленген топтордун мүчөсү болсо, шарт туура болот. Тандалган топтордун жөнөкөй аттары берилет жана Keycloak топтун атына дал келиши керек. Топ иерархиясы колдоого алынбайт.
+addRequestUri=Жарактуу суроо URI’лерин кошуу
+selectACondition=Шартты тандаңыз
+ldapAttributeValue=LDAP атрибутунун мааниси
+jwksUrlHelp=JWK форматындагы identity provider ачкычтары сакталган URL. Толугураак маалымат JWK спецификациясында бар. Эгер сырттан алынган Keycloak identity provider колдонсоңуз, мисалы, 'http\://broker-keycloak\:8180/realms/test/protocol/openid-connect/certs' URL колдонсо болот. Бул жерде broker-keycloak Keycloak брокеринин хосту жана test - реалм.
+eventTypes.CLIENT_DELETE.description=Кардарды өчүрүү
+emptyResources=Ресурстар жок
+roleHelp=Бардык атрибуттар бар болсо колдонуучуга берилүүчү роль. Ролдорду көрүү үчүн 'Select Role' баскычын басыңыз же түз эле текстке жазыңыз. Клиент ролу үчүн clientname.clientrole форматында көрсөтүңүз; мисалы, myclient.myrole.
+ldapSynchronizationSettingsDescription=Бул бөлүмдө LDAPдан Keycloak базасына колдонуучуларды синхрондоштуруу жөндөлүштөрү камтылган.
+addPredefinedMappers=Альфа мапперлерди кошуу
+updatedRequiredActionSuccess=Милдеттүү аракет ийгиликтүү жаңыланды
+roles=Ролдор
+displayOrder=Көрсөтүү тартиби
+registrationAllowed=Колдонуучуларды каттоого уруксат берүү
+choose=Тандаңыз...
+appliedByProviders=Төмөнкү провайдерлер тарабынан колдонулат
+saveEventListenersSuccess=Иш-чара угуучу жаңыртылды.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Identity провайдер аккаунт байланышы
+eventTypes.TOKEN_EXCHANGE.name=Токен алмашуу
+skipped=Өткөрүлдү
+eventTypes.RESTART_AUTHENTICATION.description=Аутентификацияны кайра баштоо
+scopePermissions.users.manage-group-membership-description=Бул саясаттар реалмдеги бардык колдонуучулардын топ мүчөлүгүн админ башкаруусуна уруксат берет. Белгиленген топ саясаты менен бирге колдонулат.
+loginTheme=Кирүү темасы
+eventTypes.UPDATE_PASSWORD_ERROR.description=Сырсөздү жаңыртуу ката
+deleteConfirmRealmSetting=Реалмди өчүргөндө бардык байланышкан маалыматтар да өчүрүлөт.
+scope=Scope
+evaluateExplain=Бул барак протокол мапперлерин жана роль чөйрө карталарын көрүүгө мүмкүнчүлүк берет
+providerCreateError=Клиент саясатын түзүү мүмкүн болгон жок: {{error}}
+includeRepresentationHelp=Жаратуу жана жаңыртуу сурамдары үчүн JSON көрсөтүүнү кошуу
+searchForClientScope=Клиент чөйрөсүн издөө
+removeAttribute=Атрибутту алып салуу
+deleteProviderSuccess=Ийгилик. Провайдер өчүрүлдү.
+sessionsType.offline=Оффлайн
+validatorDeletedError=Колдонуучу профилин сактоодо ката: {{error}}
+preserveGroupInheritance=Топтун мурастарын сактоо
+createClientScopeSuccess=Клиент чөйрөсү түзүлдү
+selectOrTypeAKey=Тандоо же ачкычты терүү
+resourceDetails=Ресурстун маалыматтары
+authorizationScopes=Авторизация чөйрөлөрү
+fromDisplayNameHelp='From' дареги үчүн колдонуучуга ыңгайлуу аталыш (ишке кирбейт)
+identityProviderEntityIdHelp=SAML билдирүүлөрү үчүн Issuer'ди текшерүүдө колдонулуучу Entity ID. Эгер бош болсо, Issuer текшерүүсү жүргүзүлбөйт.
+noRoles-client=Бул клиент үчүн роль жок
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Иш-аракет токенинин катачылыгы
+eventTypes.USER_INFO_REQUEST_ERROR.description=Колдонуучу маалыматын сурамдоодо ката
+policyRoles=Бул саясат менен уруксат берилген клиент ролдору
+roleMapping=Роль карталоо
+accountLinkingOnlyHelp=Эгер чын болсо, колдонуучулар бул провайдер аркылуу кире албайт. Алар болгону бул провайдерге байланыштырса болот. Бул провайдер аркылуу кирүүгө уруксат бербөө жана интеграциялоо үчүн пайдалуу.
+refreshTokenMaxReuseHelp=Refresh токенин максималдуу колдонуу саны. Эгер башка токен колдонулса, жоюу дароо жүргүзүлөт.
+eventTypes.REMOVE_FEDERATED_IDENTITY.description=Биригген идентификацияны алып салуу
+childGroups=Балдар топтору
+eventTypes.IDENTITY_PROVIDER_LOGIN.name=Идентификация провайдерине кирүү
+exportAuthDetailsError=Авторизация маалыматтарын экспорттоодо ката: {{error}}
+clientOfflineSessionIdleHelp=Клиенттин оффлайн сессиясы иштебей турган максималдуу убакыт. Оффлайн токендер сессиянын мөөнөтү бүтөөрү менен жараксыз болот. Бул параметр глобалдык SSO сессиясына таасир этпейт. Орнотулбаса, realm'дин Offline Session Idle мааниси колдонулат.
+selectGroups=Кошулчу топторду тандоо
+webAuthnPolicyAuthenticatorAttachmentHelp=Аутентификаторго ылайыктуу тиркөө үлгүсүн билдирет.
+username=Колдонуучу аты
+mappedGroupAttributes=Карталанган топ атрибуттары
+localization=Локализация
+importConfig=Файлдан конфигурацияны импорттоо
+replyToDisplayNameHelp='Reply-To' дареги үчүн колдонуучуга ыңгайлуу аталыш (ишке кирбейт)
+webAuthnPolicyRpIdHelp=WebAuthn Тарабынын ID (RpID). Бул иштөөчү домен болушу керек, мисалы 'company.com' же 'auth.company.com'.
+signingKeysConfigExplain=Эгер төмөндөгү "Клиент колу талап кылынат" параметрин иштетсеңиз, кол коюу ачкычтарын жаратуу же импорттоо керек, андан кийин клиент SAML сурамдарын жана жоопторун кол коёт. Кол коюу текшерилет.
+newClientProfile=Жаңы клиент профили түзүү
+consoleDisplayConnectionUrlHelp=LDAP сервериңиздин байланышуучу URL
+enabledWhen=Иштетилет кайсы учурда
+enabledWhenTooltip=Атрибут качан жеткиликтүү экенин аныктайт. Чөйрөлөр колдонулганда, атрибут колдонуучунун кирүү сурамында кеминде бир чөйрө колдонулганда жеткиликтүү болот. Баштапкы жана кошумча чөйрөлөр бааланат. Админ жана Аккаунт консолунда чөйрөлөр эске алынбайт, атрибут дайыма жеткиликтүү.
+clientAssertionSigningAlg=Клиент кол коюу алгоритми
+homeURLHelp=Аутентификация сервери кайтып келүү же багыттоо үчүн колдонгон стандарттык URL.
+ldapAttribute=LDAP атрибуту
+fullScopeAllowedHelp=Бардык чектөөлөрдү өчүрүүгө мүмкүнчүлүк берет
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=Идентификация провайдерине шилтеме жөнөтүүдө ката
+otpType=OTP түрү
+algorithm=Алгоритм
+grantedScopes=Берилген чөйрөлөр
+groupNameLdapAttribute=Топтун аталышы үчүн LDAP атрибуту
+deleteProviderConfirm={{provider}} ачкыч провайдерин түбөлүк өчүрүүгө ишенесизби?
+removeConfirmTitle_one=Топту алып салуу?
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=Пушталган авторизация сурамында ката
+includeInTokenScope=Токен чөйрөсүнө кошуу
+eventType=Сакталган окуя түрү
+tokenDeleteConfirmTitle=Баштапкы жеткиликтүү токенди өчүрүү?
+useRefreshTokenForClientCredentialsGrant=Клиент күбөлүктөрүн берүүдө refresh токен колдонуу
+userDetails=Колдонуучу маалыматы
+sectorIdentifierUri.label=Сектор идентификатору URI
+inputTypeStep=Кириш кадамынын өлчөмү
+mapperTypeHelp=LDAP колдонуучунун бир атрибутун Keycloak базасында UserModel атрибутуна карталоо үчүн колдонулат
+importWarning=Жогоруда импорттолгон маалыматтар жана жөндөөлөр мурунтан бар маалыматтарды өчүрүп жибериши мүмкүн.
+kerberosRequiredSettingsDescription=Бул бөлүм бардык колдонуучу сактоочу провайдерлер үчүн жалпы негизги параметрлерди камтыйт.
+resetPasswordFor={{username}} үчүн сырсөздү коюу
+duplicateEmailsAllowed=Кайталанган электрондук почталарга уруксат берүү
+deleteEventsConfirm=Эгер ушул realm'деги бардык окуяларды тазаласаңыз, базадагы бардык жазуулар толугу менен өчүрүлөт
+noGroupsInThisRealmInstructions=Бул realm'де топ түзүлбөгөн. Баштоо үчүн топ түзүңүз.
+eventTypes.REMOVE_TOTP_ERROR.name=TOTP алып салууда ката
+groupUpdateError=Топту жаңыртууда ката: {{error}}
+logoutAllSessions=Бардык сессиялардан чыгуу
+membershipUserLdapAttribute=Мүчөлүк колдонуучунун LDAP атрибуту
+noKeysDescription=Сизде активдүү ачкычтар жок
+rememberMeHelpText=Колдонуучу браузерди кайра ачканда кирген бойдон калуу үчүн логин баракчасында "Эсиңде сакта" кутучасын көрсөтүү
+eventTypes.UPDATE_EMAIL.name=Электрондук почтаны жаңыртуу
+notBeforeHelp=Бул убакыттан мурун берилген токендерди жокко чыгаруу. Саясатты күчөтүү үчүн, мурун Админ Консолунда натыйжалуу URL орнотулушу керек.
+protocolTypes.saml=SAML
+idTokenSignatureAlgorithm=ID токен кол коюу алгоритми
+displayHeaderHintHelp=Колдонуучу формаларында атрибуттар тобун көрсөтүү үчүн колдонулуучу топтун ыңгайлуу аталышы. Локалдаштырылган маанилердин ачкычтарын да колдойт. Мисалы: ${profile.attribute.group.address}.
+providerInfo=Провайдер маалыматы
+ssoServiceUrl=Бирдиктүү кирүү кызматы URL
+artifactResolutionServiceUrl=Артефакт чечүү кызматы URL
+inputHelperTextAfter=Кириш талаасынын астындагы жардам тексти
+appliedByClients=Төмөнкү клиенттер тарабынан колдонулат
+createFlowHelp=Бул формада жогорку деңгээлдеги агымды түзө аласыз.
+defaultLocaleHelp=Баштапкы тил. Кирүү экранында жана Админ UI менен Аккаунт UI башка экрандарында колдонулат.
+deleteConfirmFlowMessage="{{flow}}" агымын түбөлүк өчүрүүгө ишенесизби?
+webAuthnPolicyAuthenticatorAttachment=Аутентификатор тиркемеси
+logoutServiceSoapBindingUrlHelp=SAML SOAP Байланыш URL. Эгер башка байланышты колдонуп жатсаңыз, бош калтырыңыз.
+kerberos=Kerberos
+noNodesInstructions=Тиркелген узелдер жок, бирин кол менен кошсо болот.
+login=Кирүү
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=Идентификация провайдеринен токенди алуу ката
+local=Жергиликтүү
+noGroupsInThisSubGroupInstructions=Бул чакан топто топ түзүлгөн эмес.
+validatorColNames.colName=Валидатордун аты
+userVerify.required=Милдеттүү
+searchMembers=Мүчөлөрдү издөө
+keySizeHelp=Жаратуучу ачкычтын өлчөмү
+otpSupportedApplications.totpAppGoogleName=Google Authenticator
+clientDeleteConfirmTitle=Клиентти өчүрүү?
+policyDetails=Саясаттын деталдары
+changedUsersSyncHelp=Өзгөртүлгөн же жаңы түзүлгөн LDAP колдонуучуларын синхрондоштуруунун убактысы (секунддарда)
+trustEmailHelp=Эгер иштетилсе, бул провайдер тарабынан берилген электрондук почта realm'де текшерилбей калат.
+editModeKerberosHelp=READ_ONLY - сырсөз жаңыртууга тыюу салынат жана колдонуучу ар дайым Kerberos сырсөзү менен аутентификацияланат. UNSYNCED - колдонуучу Keycloak базасында сырсөздү өзгөртө алат жана ал Kerberos сырсөзүнөн артыкчылык алат.
+invalidateRotatedSecretExplain=Айландырылган сырсөз жараксыз болгондон кийин автоматтык түрдө алынып салынат
+clientSessionMaxHelp=Клиент сессиясынын мөөнөтү бүткөнгө чейин максималдуу убакыт. Сессия бүткөндө токендер жараксыз болот. Бул параметр глобалдык SSO сессиясына таасир этпейт. Орнотулбаса, стандарттык SSO Session Max мааниси колдонулат.
+clientScopeDetails=Клиент чөйрөсүнүн деталдары
+requiredHelp=Атрибутту милдеттүү кылуу. Эгер иштетилсе, колдонуучулар жана администраторлор аны коюшу керек. Болбосо, атрибут ыктыярдуу.
+clientScopeRemoveError=Чөйрөнү алып салуу мүмкүн болбоду: {{error}}
+mapperTypeRoleLdapMapper=роль-ldap-маппер
+testConnectionHint.withEmail=Туташуу тесттөөдө учурдагы колдонуучуга электрондук почта жөнөтүлөт ({{email}}).
+adminURLHelp=Клиенттин админ интерфейсинин URL. Эгер клиент REST API адаптерин колдосо, орнотулат. Бул REST API аутентификация серверине жоюу саясатын жана башка админ тапшырмаларды жөнөтүүгө мүмкүндүк берет. Көп учурда бул клиенттин негизги URL болуп эсептелет.
+otpPolicyPeriodHelp=OTP токен канча секундга жарактуу? Стандарттуу 30 секунд.
+otpPolicyCodeReusableHelp=Ийгиликтүү аутентификациядан кийин бир эле OTP кодун кайра колдонууга мүмкүнчүлүк.
+parentId=Ата-энеси ID
+storePasswordHelp=Архивге кирүү үчүн сырсөз
+directAccess=Түз жеткиликтүүлүк уруксаттары
+logoutServiceSoapBindingUrl=Чыгуу кызмат SOAP Байланыш URL
+userFedDeletedSuccess=Колдонуучу федерация провайдери өчүрүлдү.
+eventTypes.UNREGISTER_NODE.description=Узелди каттоодон чыгаруу
+whoWillAppearPopoverTextRoles=Бул бөлүккө түздөн-түз ушул роль берилген колдонуучулар гана көрсөтүлөт. Бул роль топ аркылуу же байланыштуу роль катары берилген колдонуучуларды көрүү үчүн
+showPassword=Сырсөздү ачык көрсөтүү
+logic=Логика
+clientScopeSearch.type=Белгиленген түрү
+scopePermissions.groups.manage-membership-description=Администратордун бул топко колдонуучуларды кошуу же алып салуусун чечкен саясаты
+resourceType=Ресурс түрү
+copied=Авторизация маалыматтары көчүрүлдү
+scopeName=Чөйрөнүн уникалдуу аты. Бул аталыш чөйрөнү өзгөчө аныктоо үчүн колдонулат, мисалы, конкреттүү чөйрөнү сураганда.
+userObjectClassesHelp=LDAP колдонуучулардын objectClass атрибутунун бардык маанилери, бирдей бөлүүчү менен. Мисалы: 'inetOrgPerson, organizationalPerson'. Жаңы түзүлгөн Keycloak колдонуучулар бардык ушул класстар менен LDAP'га жазылат, жана бар колдонуучу жазуулар ошол класстарды камтыса табылат.
+userInfoUrlHelp=Колдонуучу маалыматы URL. Бул ыктыярдуу.
+clientProfileSearch=Издөө
+addSavedTypes=Сакталган түрлөрдү кошуу
+setPasswordFor=Сырсөздү коюу {{username}} үчүн
+eventTypes.CODE_TO_TOKEN.name=Коддон токенге
+updateUserLocale=Колдонуучунун тил настройкасын жаңыртуу
+whoWillAppearPopoverTextUsers=Топтор иерархиялуу. Түз мүчөлүк тандаганда, колдонуучу кошулган гана балдар топ көрсөтүлөт. Атасы топтор кошулбайт.
+mapperCreateError=Мапперди түзүүдө ката: {{error}}
+resetBtn=Кайра орнотуу
+mode=Режим
+kc.realm.name=Realm
+userFedDisableConfirmTitle=Колдонуучу федерация провайдерин өчүргүңүз келет беле?
+impersonate=Ат менен кирүү
+eventTypes.CLIENT_REGISTER.name=Клиент каттоо
+mappingTable=Буюрланган маппинг таблицасы
+requestObject.not\ required=Милдеттүү эмес
+adminURL=Админ URL
+generatedAccessTokenNo=Жаралган жеткиликтүү токен жок
+always=Ар дайым
+pkceEnabledHelp=IdP брокеринг үчүн PKCE (Proof of Key-code exchange) колдонуу
+settings=Жөндөөлөр
+webAuthnPolicyUserVerificationRequirement=Колдонуучуну тастыктоо талаптары
+failureFactorHelp=Токтоодон мурун каталардын саны.
+unlinkAccountTitle={{provider}} аккаунтун ажыратасызбы?
+noNodes=Катталган узелдер жок
+singleLogoutServiceUrlHelp=Чыгуу сурамдарын жөнөтүү үчүн колдонулуучу URL.
+authorizationEncryptedResponseAlg=Авторизация жоопту шифрлөө ачкычын башкаруу алгоритми
+useTruststoreSpi=Truststore SPI колдонуу
+allowEcpFlowHelp=Бул клиентке колдонуучуларды аутентификациялоо үчүн ECP агымын колдонууга уруксат берилет.
+noSessions=Сессиялар жок
+clipboardCopyError=Буферге көчүрүүдө ката чыкты.
+storeTokens=Токендерди сактоо
+usermodel.clientRoleMapping.rolePrefix.tooltip=Ар бир Клиент Ролунун атына кошулат (ыктыярдуу).
+deleteConfirmCurrentUser=Бул колдонуучуну түбөлүк өчүргүңүз келерин тастыктаңызбы?
+eventTypes.CLIENT_REGISTER_ERROR.description=Клиент каттоо ката
+addClientScopesTo=Клиент чөйрөлөрүн {{clientName}} кошуу
+x509=X.509 Субъект аталышы
+showDataBtn=Маалыматты көрсөтүү
+dedicatedScopeDescription=Бул клиент үчүн атайын чөйрө жана мапперлер
+Sunday=Жекшемби
+editMode=Редакциялоо режими
+updatePasswordPolicySuccess=Сырсөз саясаты ийгиликтүү жаңыртылды
+passwordHelp=SMTP сырсөзү. Бул талаа маани сактагычтан алынышы мүмкүн, ${vault.ID} форматында колдонсо болот.
+clientUpdaterContext=Шарт клиент кантип түзүлгөн же жаңыртылганын карап, саясаттын колдонулушун аныктайт. Мисалы, админ REST API аркылуу түзүлгөн же OIDC динамикалык клиент каттоосу аркылуу. Экинчисинде, анонимдик же аутентификацияланган каттоосу текшерилет.
+removedGroupMembership=Топ мүчөлүгү өчүрүлдү
+deleteScopeWarning=Төмөнкү уруксаттар башка авторизация чөйрөлөрү колдонбосо жоюлат:
+compositeRoleOff=Кошумча роль өчүрүлдү
+fullSyncPeriod=Толук синхрондоштуруу мөөнөтү
+clientsExplain=Клиенттер — бул колдонуучунун аутентификациясын сураган тиркемелер жана кызматтар.
+addNode=Узел кошуу
+jwksUrl=JWKS URL
+policy-description=Бул саясат үчүн сүрөттөө.
+defaultPasswordLabel=Менин сырсөзүм
+mapperUserAttributeName=Колдонуучу атрибутунун аты
+importClient=Клиентти импорттоо
+deleteMapperSuccess=Маппер ийгиликтүү өчүрүлдү
+scopeSaveError=Авторизация чөйрөсүн сактоо мүмкүн болбоду: {{error}}
+used.SPECIFIC_PROVIDERS=Белгилүү провайдерлер
+deletedSuccessIdentityProvider=Провайдер ийгиликтүү өчүрүлдү
+reload=Жаңылоо
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.description=Клиенттин баштаган аккаунт байланыштыруу ката
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.name=Идентификация провайдерине кирүү ката
+scopePermissions.groups.view-description=Админдин бул топту көрүү укугун аныктайт
+tokens=Токендер
+createFlow=Агымды түзүү
+encryptAssertionsHelp=SAML ырастамалар AES колдонуп, клиенттин ачык ачкычына шифрлениши керекпи?
+oAuthDPoPHelp=Токендерге ээликти далилдөө (DPoP) үчүн колдоону иштетет. Кирүү жана жаңылоо токендер колдонуучу агентиндеги ачкыч менен байланыштуу. Ачкыч ээлигин далилдөө үчүн, колдонуучу агент токен менен бирге кол коюлган далилди жөнөтүшү керек.
+unsavedChangesConfirm=Сизде сакталбаган өзгөртүүлөр бар. Баракты таштап кетүүнү каалайсызбы?
+disabledOff=Өчүрүлгөн
+membershipLdapAttributeHelp=Топтогу мүчөлүк карталарын колдонгон LDAP атрибутунун аты. Көбүнчө 'member'. Бирок 'Membership Attribute Type' 'UID' болсо, 'Membership LDAP Attribute' көбүнчө 'memberUid' болот.
+usersLeftError=Топтон колдонуучуларды алып салуу мүмкүн болбоду: {{error}}
+addTypes=Түрлөрдү кошуу
+pushedAuthorizationRequestRequiredHelp=Авторизация сервери пушталган авторизация сурам методун гана кабыл алатбы деген маанилүү параметр.
+requirement=Талап
+any=Кайсы гана болбосун
+minute=Мүнөт
+useJwksUrl=JWKS URL колдонуу
+wantAssertionsSigned=Ырастамаларды кол коюуну каалоо
+roleSaveSuccess=Роль сакталды
+scopeParameter=Чөйрө параметри
+unsigned=Кол коюлбаган
+userGroupsRetrieveStrategy=Колдонуучу топторун алуу стратегиясы
+addSubFlow=Кошумча агым кошуу
+validatingPublicKeyHelp=Сырткы IDP кол коюуларын текшерүү үчүн PEM форматындагы ачык ачкыч.
+client-uris-must-match.label=Клиент URI’лери дал келүүсү керек
+webAuthnPolicyAcceptableAaguids=Макулдукту алган AAGUID’дер
+noRoles-roles=Бул realm’де роль жок
+logoutServiceRedirectBindingURLHelp=Клиенттин бирдиктүү чыгуу кызматы үчүн SAML Redirect Binding URL. Башка байлап жаткан болсоңуз, бош калтырыңыз.
+deleteMapperConfirm=Маппер {{mapper}} өчүрүлүшүн каалайсызбы?
+scopePermissions.roles.map-role-description=Админдин бул рольду колдонуучуга же топко карталоо укугун аныктайт
+backchannelUrlInvalid=Backchannel чыгуу URL жараксыз
+eventTypes.LOGIN.description=Кирүү
+impersonateConfirm=Колдонуучу атынан кирүүгө макулсузбу?
+scopePermissions.clients.map-roles-client-scope-description=Админдин бул клиент тарабынан аныкталган ролдорду башка клиенттин чөйрөсүнө колдонуу укугун аныктайт
+accessTokenSuccess=Жеткиликтүү токен кайра түзүлдү
+includeInIdToken.tooltip=Даават ID токенге кошулушу керекпи?
+validRequestURIs=Жарактуу сурам URL’дери
+allowPasswordAuthentication=Сырсөз аркылуу аутентификациялоого уруксат берүү
+federationLinkHelp=Бул жергиликтүү сакталган колдонуучу кайсы UserStorageProvider’ден импорттолгон.
+validateUsernameLDAPAttribute=Колдонуучу аты LDAP атрибутун киргизиши керек
+pairwiseSubAlgorithmSalt.tooltip=Жуптуу субъек идентификаторун эсептөөдө колдонулган туз. Бош калса, туз автоматтык жаралат.
+waitIncrementSecondsHelp=Каталар лимитине жеткенде колдонуучу канча убакытка бөгөлүшү керек?
+allowKerberosAuthentication=Kerberos аутентификациясына уруксат берүү
+addressClaim.formatted.tooltip='address' токендеги 'formatted' субдааватка карталоо үчүн колдонуучу атрибутунун аты. Баштапкы мааниси 'formatted'.
+predefinedMappingDescription=Бул таблицадан алдын-ала белгиленген маппингдерди тандаңыз
+allowedClockSkew=Рухсат берилген саат айырмасы
+privateRSAKey=Жашыруун RSA ачкычы
+createPermission=Уруксат түзүү
+moveToGroup={{group1}} топтон {{group2}} топко жылдыруу
+noRealmRoles=Realm ролдору жок
+events-disable-confirm="Сактоо окуялары" өчүрүлсө, кийинки окуялар "Окуялар" менюсунда көрсөтүлбөйт
+reqAuthnConstraints=Суралган AuthnContext чектөөлөрү
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.description=Жиберилген авторизация сурамы
+addIdpMapperNameHelp=Маппердин аты.
+requirements.ALTERNATIVE=Альтернативдүү
+claimFilterValueHelp=Маанилүү дааваттын мааниси (regex колдоосу менен)
+credentialResetConfirm=Электрондук почта жөнөтүү
+permissionsEnabledHelp=Бул рольду башкаруу үчүн ж細риктүү уруксаттар иштетилген же жок экенин аныктайт. Өчүрүү учурдагы бардык уруксаттарды өчүрөт.
+consentScreenTextHelp=Бул клиент чөйрөсү колдонуучунун макулдугу талап кылынган клиентке кошулганда макулдук экранда көрсөтүлө турган текст. Эгер толтурулбаса, клиент чөйрөсүнүн аты колдонулат.
+realmRolesList=Realm ролдору
+roleList=Ролдордун тизмеси
+kerberosRealm=Kerberos realm
+scopePermissions.groups.manage-members-description=Админдин бул топтун мүчөлөрүн башкарууга укугу бар-жогун аныктайт
+consentRequiredHelp=Иштетилсе, колдонуучуларга клиентке кирүүгө макулдук берүү керек.
+flow.direct\ grant=Түз берилүү агымы
+eventTypes.EXECUTE_ACTION_TOKEN.name=Иш чара токенин аткаруу
+groupName=Топтун аты
+eventTypes.RESTART_AUTHENTICATION.name=Аутентификацияны кайра баштоо
+authorizationUrl=Авторизация URL
+eventTypes.VALIDATE_ACCESS_TOKEN.name=Жеткиликтүү токенди текшерүү
+contextualAttributes=Контексттик атрибуттар
+replyTo=Жооп берүүчү
+providerDescription=Провайдер сүрөттөлүшү
+downloadAdapterConfig=Адаптер конфигурациясын жүктөө
+scopePermissions.clients.view-description=Админдин бул клиентти көрүүгө укугу бар-жогун аныктайт
+allowEcpFlow=ECP агымына уруксат берүү
+rsa=rsa
+setPasswordConfirmText=Колдонуучу {{username}} үчүн сырсөздү коюуга ишенесизби?
+updateErrorIdentityProvider=Провайдерди жаңылоо мүмкүн болбоду: {{error}}
+emptyProfiles=Клиент профилдери конфигурацияланган жок
+createClientProfileError=Клиент профили түзүлүшү мүмкүн болбоду\: '{{error}}'
+usermodel.clientRoleMapping.clientId.tooltip=Роль карталоо үчүн клиент ID. Токенге ушул клиенттин гана ролдору кошулат. Эгер бош болсо, бардык клиенттердин ролдору кошулат.
+targetOptions.local=ЖЕРГИЛИКТҮҮ
+addTranslationError=Тилге которуу катасы, {{error}}
+pkceMethodHelp=Колдонулуучу PKCE ыкмасы
+encryption=Шифрлөө
+addExecutorError=Ишке киргизүүчү түзүлбөдү: {{error}}
+scopePermissions.clients.manage-description=Админдин бул клиентти башкарууга укугу бар-жогун аныктайт
+vendor=Жеткирүүчү
+roleRemoveAssociatedText=Бул аракет {{role}} ролун {{roleName}} ролунан алып салат. {{role}} менен байланышы бар бардык ролдор да өчүрүлөт.
+disabled=Өчүрүлгөн
+idpInitiatedSsoRelayState=IDP баштаган SSO Relay абалы
+attribute=Атрибут
+clientScopesConditionTooltip=Күтүлгөн клиент чөйрөлөрүнүн тизмеси. Шарт белгиленген клиент сурамы клиент чөйрөлөрүнүн бирине дал келсе чын болот. Ошондой эле "Scope Type" конфигурациясына жараша демейки же ыктыярдуу чөйрө болушуна көз каранды.
+timestamp=Түзүлгөн дата
+principalAttributeHelp=Сырткы колдонуучуларды аныктоо үчүн колдонулган атрибуттун аты же достук аты.
+nameIdPolicyFormat=NameID саясатынын форматы
+idpInitiatedSsoUrlName=IDP баштаган SSO URL аталышы
+selectMethod=Ыкманы тандоо
+deleteConfirmExecution=Агымды {{name}} өчүрүү керекпи?
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Жеткиликтүү токенди текшерүү ката
+xFrameOptions=X-Frame-Options
+scopeDescriptionHelp=Клиент чөйрөсүнүн сүрөттөлүшү
+deletedErrorRealmSetting=Realm өчүрүлүшү мүмкүн болбоду: {{error}}
+copyInitialAccessToken=Баштапкы жеткиликтүү токенди көчүрүп сактаңыз, анткени ал кийинкиде алынбайт.
+consensus=Макулдашуу
+scopePermissions.roles.map-role-composite-description=Админдин бул ролду кошумча роль катары башка рольго колдонууга укугу бар-жогун аныктайт
+emptyEvents=Кошулуучу эч нерсе жок
+residentKey.Yes=Ооба
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.name=Идентификация провайдеринин шилтемесин жөнөтүү
+ssoSessionIdleRememberMe=“Эсимде сактоо” сессиясы канча убакыт тынч абалда болушу мүмкүн. Сессия аяктагандан кийин токендер жана браузер сессиялары жараксыз болот. Орнотулбаса, стандарттуу SSO сессиянын тынч абалы колдонулат.
+SSOSessionIdleRememberMe=SSO сессиясынын тынч абалы “Эсимде сактоо”
+cibaBackchannelTokenDeliveryModeHelp=CD (Колдонуучү түзмөк) аутентификациянын жыйынтыгын жана байланышкан токендерди кантип алат. Бул режим CIBA клиенттери үчүн демейки болот, башка режим так көрсөтүлбөсө.
+eventTypes.REGISTER_NODE.description=Узел каттоо
+supported=Колдоого алынат
+deprecated=Эскирген
+deleteAttributeText=Атрибутту өчүрүү
+deleteNodeSuccess=Узел ийгиликтүү өчүрүлдү
+includeInIntrospection.label=Токенди текшерүүгө кошуу
+roleImportSuccess=Роль ийгиликтүү импорттолду
+tokenUrl=Токен URL
+executionConfig={{name}} конфигурациясы
+grantedClientScopes=Берилген клиент чөйрөлөрү
+keyError=Ачкыч берилиши керек.
+addAnnotationText=Аннотация кошуу
+helpToggleInfo=Бул которгуч UIдеги жардам маалыматтарын күйгүзөт же өчүрөт. Бардык жардам тексттери, шилтемелер жана поповерлер кирет.
+clientProfileName=Клиент профилинин аты
+effectiveProtocolMappers=Иштеп жаткан протокол мапперлери
+userVerify.preferred=Таңдалган
+syncModes.legacy=Эски режим
+allowRegexComparisonHelp=ӨЧҮРҮЛСӨ, берилген клиент сертификатынын Subject DN толугу менен 'Subject DN' атрибутундагы мааниге дал келиши керек (RFC8705 спецификациясы боюнча). Subject DN RFC4514 же RFC1779 форматында болушу мүмкүн. КҮЙҮҮЛСӨ, Subject DN 'Subject DN' атрибутундагы regexке дал келиши керек.
+eventTypes.UPDATE_TOTP_ERROR.description=TOTP жаңылоо ката
+titleEvents=Окуялар
+signServiceProviderMetadata=Кызмат провайдеринин метаданын кол коюусу
+updateClientPoliciesError=Клиент саясатын жаңылоодо ката: {{error}}
+acceptsPromptNoneHelp=Бул Identity Provider Authenticator менен же kc_idp_hint ушул провайдерге көрсөткөн учурда гана колдонулат. Эгер клиент prompt=none менен сурам жиберсе жана колдонуучу аутентификацияланган эмес болсо, ката түз кайтарылбайт; сурам ушул провайдерге жиберилет.
+roleDetails=Рольдун маалыматтары
+eventTypes.USER_INFO_REQUEST.name=Колдонуучу маалымат сурамы
+clientScopeType.none=Жок
+results=Натыйжалар
+userRolesRetrieveStrategyHelp=Колдонуучунун ролдорун алуу ыкмасын көрсөтүңүз. LOAD_ROLES_BY_MEMBER_ATTRIBUTE — ролдор LDAP суранычы аркылуу алынып, 'member' катары колдонуучу колдонулат. GET_ROLES_FROM_USER_MEMBEROF — ролдор 'memberOf' атрибутунан же 'Member-Of LDAP Attribute' аркылуу алынышы мүмкүн. LOAD_ROLES_BY_MEMBER_ATTRIBUTE Active Directoryде гана колдонулат жана ролдор LDAP_MATCHING_RULE_IN_CHAIN кеңейтүүсү менен кайталанма алынат.
+roleDeleteError=Роль өчүрүлүшү мүмкүн болбоду: {{error}}
+selectScope=Чөйрөнү тандоо
+attributeDefaultValue=Атрибуттун демейки мааниси
+eventTypes.UPDATE_PASSWORD_ERROR.name=Сырсөздү жаңылоо ката
+addGroups=Топторду кошуу
+offlineSessionIdle=Офлайн сессия тынч абалы
+mapperAttributeFriendlyName=Достук аталыш
+addProvider=Провайдер кошуу
+readOnlyHelp=LDAPтен UserModelге импорттолгон окууга гана атрибут, бирок Keycloakто колдонуучу жаңылангандан кийин сакталбайт.
+resourceDeletedError=Ресурсту өчүрүү мүмкүн болбоду: {{error}}
+backchannelLogoutUrl=Backchannel чыгуу URL
+requestObjectEncodingHelp=OIDC сурам объектин шифрлөөнүн JWE алгоритми. 'any' болсо, каалаган алгоритм уруксат берилет.
+minimumQuickLoginWaitSeconds=Минималдуу тез кирүү күтүү убактысы
+duplicate=Кайталанма
+clientAccesstype=Клиент кирүү түрү
+roleDeleteConfirm=Роль өчүрүү керекпи?
+createClientProfileNameHelperText=Аты realm ичинде уникалдуу болушу керек
+disabledHelp=Өчүрүлгөн колдонуучу кире албайт.
+eventTypes.UPDATE_PROFILE_ERROR.name=Профилди жаңылоо ката
+adminThemeHelp=Башкаруу консолу үчүн тема тандоо.
+name=Аты
+deleteConfirmDialog_other=Чыныгы ынануу менен {{count}} тандалган колдонуучуну өчүрүү керекпи?
+targetOptions.brokerUsername=BROKER_USERNAME
+clientList=Клиенттер
+eventTypes.REGISTER_ERROR.description=Каттоо ката
+infoDisabledFeatures=Бардык өчүрүлгөн функциялар көрсөтүлөт.
+userSession.modelNote.label=Колдонуучу сессия эскертмеси
+next=Кийинки
+previous=Мурунку
+userLabel=Колдонуучу белгиси
+pagination=Барактоо
+changeAuthenticatorConfirm=Аутентификаторду {{clientAuthenticatorType}}ге алмаштырсаңыз, Keycloak маалымат базасы жаңыланат жана жаңы адаптер конфигурациясын жүктөө керек болушу мүмкүн.
+import=Импорттоо
+otpHashAlgorithm=OTP хеш алгоритми
+importFail=Импорттоодо ката: {{error}}
+show=Көрсөтүү
+description=Сүрөттөлүш
+alwaysReadValueFromLdap=Маанини дайыма LDAPтен окуу
+searchUserEventsBtn=Окуяларды издөө
+addressClaim.postal_code.tooltip=Колдонуучунун атрибутунун аты, ал 'address' токенинин ичиндеги 'postal_code' субдааватына карталанат. Демейки мааниси 'postal_code'.
+generatedUserInfoNo=Колдонуучу маалыматы түзүлгөн жок
+allowed-client-scopes.label=Ыйгарылган Клиент Чөйрөлөрү
+providerId=Провайдердин IDси
+assignedClientScope=Ыйгарылган клиент чөйрөсү
+savePasswordSuccess=Сырсөз ийгиликтүү коюлду.
+Tuesday=Шейшемби
+idTokenEncryptionContentEncryptionAlgorithm=ID токен шифрлөөнүн мазмун шифрлөө алгоритми
+newRoleName=Жаңы рольдун аты
+listExplain=Аутентификация провайдерлери социалдык тармактар же ID брокерлери болуп, колдонуучуларга Keycloakко кирүүгө мүмкүндүк берет.
+emptyInstructions=Издөө критерийлерин өзгөртүңүз же колдонуучуну кошуңуз
+tableView=Таблица көрүнүшү
+addClientProfile=Клиент профилин кошуу
+maxFailureWaitSeconds=Макс күтүү убактысы
+userEventsRegistered=Колдонуучу окуялары катталган
+editGroup=Топту түзөтүү
+eventConfigError=Окуя конфигурациясын сактоо мүмкүн болбоду\: {{error}}
+confirmAccessTokenTitle=Каттоо жеткиликтүү токенин кайра жаратуу керекпи?
+target=Мақсат
+impersonateConfirmDialog=Бул колдонуучу катары кирүү керектигин чын эле каалайсызбы? Эгер колдонуучу сиздин realmде болсо, учурдагы сессияңыз чыгат.
+alwaysDisplayInUI=UIда дайыма көрсөтүү
+protocolMapper=Протокол маппери...
+requiredSettings=Талап кылынган жөндөөлөр
+oneLevel=Бир деңгээл
+userSaved=Колдонуучу сакталды
+useRefreshTokens=Жаңылоо токендерин колдонуу
+standardFlowHelp=Бул клиент үчүн OpenID Connect стандарттык багыттоочу авторизация код агымын күйгүзөт. OpenID Connect жана OAuth2 спецификацияларына ылайык, 'Authorization Code Flow' колдоосу иштейт.
+clientDeleteConfirm=Эгер ушул клиентти өчүрсөңүз, бардык байланышкан маалыматтар да өчүрүлөт.
+derFormattedHelp=Бул сертификат LDAPте DER форматында, PEM форматында эмес болсо күйгүзүңүз.
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=Идентификация провайдеринин кирүүдөн кийинки иши
+scopePermissions.users.view-description=Админге realmдеги бардык колдонуучуларды көрүү укугун чечкен саясаттар
+ldapGeneralOptionsSettingsDescription=Бул бөлүмдө бардык колдонуучу сактагыч провайдерлер үчүн негизги параметрлер бар.
+importSkipped_one=Бир жазуу өткөрүлдү.
+eventTypes.OAUTH2_DEVICE_AUTH.description=OAuth2 түзмөк аутентификациясы
+notBeforeClearedSuccess=Ийгиликтүү\! "Not Before" тазаланды.
+policySaveError=Саясатты жаңылоо мүмкүн болбоду: {{error}}
+experimental=Эксперименталдык
+idTokenSignatureAlgorithmHelp=ID токендерин кол коюу үчүн JWA алгоритми.
+deleteResourceConfirm=Бул ресурсту өчүрсөңүз, айрым уруксаттарга таасир тийет.
+httpPostBindingResponse=HTTP-POST байланышынын жоопу
+artifactBindingResponse=ARTIFACT байланышынын жоопу
+tokenLifespan.inherited=Realm жөндөөлөрүнөн мураска алынган
+saveEvents=Окуяларды сактоо
+issuer=Ишке киргизүүчү
+policyEnforcementModeHelp=Саясаттарды ишке ашыруу режими уруксат сурамдарын баалоодо саясаттар кандай колдонуларын аныктайт. 'Enforcing' — саясат жок болсо да сурамдар негизинен баш тартылат. 'Permissive' — саясат жок болсо да уруксат берилет. 'Disabled' — саясаттарды толугу менен өчүрөт.
+selectAUser=Колдонуучуну тандаңыз
+groupCreated=Топ түзүлдү
+generateError=Жаңы ачкыч жана сертификат түзүү мүмкүн болбоду: {{error}}
+testClusterSuccess=Текшерүү ийгиликтүү: {{successNodes}}
+whoWillAppearLinkTextRoles=Бул колдонуучу тизмесине кимдер чыгат?
+attestationPreference.not\ specified=Көрсөтүлгөн эмес
+importConfigHelp=IDP ачылыш сүрөттөмөсүн импорттоо.
+targetClaim=Мақсаттуу даават
+assignRole=Роль ыйгаруу
+accessSettings=Жеткиликтүүлүк жөндөөлөрү
+updateFlowSuccess=Агым ийгиликтүү жаңыланды
+authenticatedAccessPolicies=Аутентификацияланган жеткиликтүүлүк саясаттары
+addExecutor=Ишке киргизүүчүнү кошуу
+selectIfResourceExists=Эгер ресурс бар болсо, эмне кылуу керектигин белгилеңиз
+passwordPoliciesHelp.notEmail=Сырсөз колдонуучунун электрондук почтасына дал келбеши керек.
+deleteAttributeGroupError=Колдонуучу атрибуттар тобун өчүрүү мүмкүн болбоду: {{error}}
+trustEmail=Электрондук почтага ишенүү
+credentialReset=Креденциалдарды калыбына келтирүү
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Колдонмо талап кылынган аракет ката
+deleteValidatorConfirmTitle=Текшергичти өчүрүү керекпи?
+claimJsonType=Токендеги JSON дааватты толтуруу үчүн JSON түрү. Жарамдуу маанилер: long, int, boolean, String, JSON.
+kc.client.network.ip_address=Клиент IPv4 дареги
+signatureAndEncryption=Кол коюу жана шифрлөө
+reset=Калыбына келтирүү
+hardcodedUserSessionAttribute=Провайдерден импорттолгон колдонуучу үчүн сессия атрибутуна бекем маани коюу.
+conditionType=Шарттын түрү
+multiValued=Бул атрибут көп маанилүү болорун көрсөтөт. Ооба болсо, бардык маанилер тизмеси даават катары коюлат. Жок болсо, биринчи гана мааниси коюлат.
+browse=Кароо
+duplicateEmailsHelpText=Бир нече колдонуучуга бир эле электрондук почта берүүгө уруксат берүү. Бул өзгөртүү колдонуучунун кэштерин тазалайт. Электрондук почталардын чектөөлөрүн кол менен жаңыртуу сунушталат.
+importOverwritten_zero=Жазуу жок
+usermodel.realmRoleMapping.rolePrefix.label=Realm Роль префикси
+eventTypes.GRANT_CONSENT.name=Макулдукту берүү
+noProvidersLinked=Провайдерлер байланыштырылган жок.
+testConnectionSuccess=Ийгиликтүү\! SMTP байланышы ийгиликтүү. Почта жөнөтүлдү\!
+samlSettings=SAML жөндөөлөрү
+userFedDisableConfirm=Эгер колдонуучу федерация провайдерин өчүрсөңүз, ал суранычтар үчүн эсептелбейт, импорттолгон колдонуучулар өчүрүлүп окууга гана болот.
+userSessionAttribute=Колдонуучу сессиясынын атрибуту
+enabled=Иштеп жатат
+forgotPassword=Сырсөздү унуттуңузбу
+searchUserByAttributeMissingValueError=Атрибуттун маанисин көрсөтүңүз
+passwordPoliciesHelp.maxLength=Сырсөздүн максималдуу узундугу.
+passwordPoliciesHelp.maxAuthAge=Сырсөздү кайрадан алмаштыруу үчүн максималдуу аутентификация жашы.
+moveGroupError=Топту жылдырууда ката болду: {{error}}
+clientImportSuccess=Клиент ийгиликтүү импорттолду
+dragHelp=Тартууну баштоо үчүн боштук же Enter басыңыз, жана жебелер менен жогору же ылдый жүрүңүз. Тартууну бекитүү үчүн Enter басыңыз, же жокко чыгаруу үчүн башка баскыч.
+startTime=Баштоо убактысы
+logicHelp=Саясат чечимин чыгаруу логикасын аныктайт. Эгер 'Positive' болсо, бул саясат баалоодон алынган натыйжа колдонулат. Эгер 'Negative' болсо, натыйжа тескерисинче өзгөртүлөт.
+allowRegexComparison=Regex шаблонун салыштырууга уруксат берүү
+noSessionsForUser=Бул колдонуучу үчүн учурда активдүү сессия жок.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.description=Идентификация провайдеринин аккаунтун байланыштыруу ката
+implicitFlowHelp=Бул клиент үчүн OpenID Connect авторизация кодсуз агымды колдоону иштетет.
+user-events-cleared-error=Колдонуучу окуяларын тазалоо мүмкүн болбоду: {{error}}
+eventTypes.IMPERSONATE_ERROR.name=Кимдир бирөө катары кирүү ката
+executorType=Ишке киргизүүчүнүн түрү
+configureMappingDescription=Бул таблицадан каалаган маппингди тандаңыз
+keystorePassword=Ачкыч сактагычтын сырсөзү
+mapperTypeHardcodedLdapRoleMapperHelp=LDAPтен импорттолгон колдонуучулар бул рольго автоматтык түрдө кошулат.
+more={{count}} дагы
+clientNameHelp=Клиенттин дисплей аты. Мисалы 'Менин Клиентим'. Ошондой эле локализацияланган маанилер үчүн ачкычтар колдонот, мисалы\: ${my_client}.
+mappersList=Мапперлер тизмеси
+rootUrl=Негизги URL
+realmExplain=Realm колдонуучуларды, креденциалдарды, ролдорду жана топторду башкаруу үчүн. Колдонуучу realmге кирет жана ошол жерде аутентификацияланат. Realmдер бири-биринен бөлүнгөн.
+inputHelperTextBefore=Киргизүү талаасынын жогору жагындагы жардам тексти
+webAuthnPolicyExtraOrigins=Кошумча булагы
+webAuthnPolicyPasskeysEnabled=Passkeyлерди иштетүү
+samlSignatureKeyName=SAML кол коюу ачкычтын аты
+validateUsersDn=Колдонуучулардын DNин киргизишиңиз керек
+importError=Сертификатты импорттоо мүмкүн болбоду: {{error}}
+logicType.negative=Тескери
+otpPolicy=OTP саясаты
+noRolesInstructions-groups=Бул топ үчүн ролдор түзүлбөгөн. Баштоо үчүн роль түзүңүз.
+cibaBackchannelTokenDeliveryMode=Backchannel токен жеткирүү режими
+validateAttributeName=Атрибуттун аты жок конфигурацияга уруксат жок.
+eventTypes.RESET_PASSWORD_ERROR.description=Сырсөздү калыбына келтирүү ката
+addUser=Колдонуучу кошуу
+eventTypes.REGISTER.description=Каттоо
+includeAuthnStatementHelp=Кирүү жоопторунда ыкма жана убакыт белгисин көрсөтүүчү билдирүү камтылышы керекпи?
+evaluateError=Баалоону жүргүзүү мүмкүн болбой калды\: {{error}}
+iconUriHelp=Иконкага шилтеме (URI).
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=OAuth2 түзмөк колдонуучу кодун тастыктоо
+protocol=Протокол
+permissionsScopeName=Масштаб-аты
+validPostLogoutRedirectURIsHelp=Ийгиликтүү чыгуу болгон соң браузер кайсы URIге багытталышы мүмкүн деген туура URI шаблону. '+' же бош талаа берилсе, туура багыттоо URIлеринин тизмеси колдонулат. '-' болсо, эч кандай чыгуудан кийинки багыттоолор уруксат берилбейт. Жөнөкөй шаблондорду колдонсо болот, мисалы 'http\://example.com/*'. Ошондой эле салыштырмалуу жол көрсөтүлүшү мүмкүн, мисалы /my/relative/path/*. Салыштырмалуу жолдор кардар тамыр URLге карай эсептелет; эгер көрсөтүлбөсө, авторизация серверинин тамыр URLи колдонулат.
+manageAccount=Каттоо эсебин башкаруу
+oauthDeviceAuthorizationGrant=OAuth 2.0 түзмөк уруксат берүү бекити
+copyFlowError=Агымды көчүрүү мүмкүн болбой калды\: {{error}}
+roleRemoveAssociatedRoleConfirm=Тийиштүү рольду өчүрүүбү?
+httpPostBindingAuthnRequest=AuthnRequest үчүн HTTP-POST байланышы
+includeInAccessToken.label=Кирүү токенине кошуу
+samlKeysExportSuccess=Ключтор ийгиликтүү экспорттолду
+usersInRole=Рольдогу колдонуучулар
+policyProvider.group=Уруксаттарды аныктоо үчүн бир же бир нече топтордун (жана алардын иерархияларынын) объекке кирүүсүнө уруксат берүү шарттарын аныктаңыз.
+updatedUserProfileError=Колдонуучу профилинин конфигурациясы сакталбай калды: {{error}}
+emptyPermissions=Уруксаттар жок
+deletePermission=Уруксатты толук өчүрүүбү?
+selectUser=Серверден уруксаттарды сурап алуу үчүн колдонулуучу колдонуучуну тандаңыз.
+resultPermit=Натыйжа - уруксат берүү
+userFederationExplain=Колдонуучу федерациясы LDAP жана Active Directory сыяктуу тышкы базаларга жана каталогдорго кирүүгө мүмкүнчүлүк берет.
+emptyAuthorizationScopes=Уруксат берүү масштабдары жок
+noDefaultGroups=Стандарттуу топтор жок
+policyProvider.time=Уруксаттар үчүн убакыт шарттарын аныктаңыз.
+updateFlowError=Агымды жаңыртуу мүмкүн болбой калды\: {{error}}
+valuePlaceholder=Маанини киргизиңиз
+usersLeft_other={{count}} колдонуучу топтон чыкты
+updateClientContext=Кардар контекстин жаңыртуу
+removeAssociatedRoles=Тийиштүү ролдорду өчүрүү
+nameIdPolicyFormatHelp=Аты аныктоочу форматка туура келген URI шилтемесин көрсөтөт.
+mappers=Карталаштыручулар
+attributeGeneralSettingsDescription=Бул бөлүмдө бардык атрибуттарга тиешелүү негизги жөндөөлөр камтылган.
+name-id-format=Аты аныктоочу формат
+deleteRealm=Реалмди өчүрүү
+noRoles-clientScopes=Бул кардардын масштабы үчүн ролдор жок
+noRoles-clients=Бул кардардын масштабы үчүн ролдор жок
+deleteFlowError=Агымды өчүрүү мүмкүн болбой калды\: {{error}}
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Кирүүдөн кийин иденттүүлүк камсыздоочу
+roleImportError=Рольду импорттоо мүмкүн болбой калды
+regexAttributeValuesHelp=Эгер күйгүзүлсө, атрибуттардын маанилери жөнөкөй текст эмес, регулярдык өрнөк катары талданат.
+userCreated=Колдонуучу түзүлдү
+residentKey.not\ specified=Көрсөтүлгөн эмес
+clientUpdaterSourceHost=Шарт кардарды түзүүгө же жаңыртууга аракет кылган тараптын домени/хостун текшерет, саясаттын колдонулушуна карата.
+alwaysReadValueFromLdapHelp=Күйгүзүлсө, LDAP атрибутунун мааниси дайыма Keycloak базасынан эмес, окуудан алынат.
+usermodel.clientRoleMapping.tokenClaimName.tooltip=Токенге кошулуучу талаптын аты. Мисалы 'address.street' сыяктуу толук квалификацияланган аталыш болушу мүмкүн. Бул учурда ички JSON объекти түзүлөт. Нүктөнү чыныгы символ катары колдонуу үчүн нүктөнү '\\.' менен качырыңыз. Сиз атайын ${client_id} токенин колдонсоңуз болот; ал чыныгы кардардын ID менен алмаштырылат. Мисалы 'resource_access.${client_id}.roles'. Бул өзгөчөлүк бардык кардарлардын ролдорун кошкондо пайдалуу.
+scopePermissions.clients.map-roles-description=Бул кардардын ролдорун администратор маптай алабы деген саясаттар
+signAssertions=Тастыктоолорду кол коюу
+disableUserInfoHelp=Колдонуучу маалыматын алуу кызматын өчүрүү (OIDC User Info)? Адегенде күйгүзүлгөн.
+xFrameOptionsHelp=Демейки мааниси башка домендердеги iframe'лердин баракчаларды кошуусун токтотот. <1>Кененирээк билүү</1>
+copyError=Уруксат маалыматтарын көчүрүүдө ката болду\: {{error}}
+validateSignatures= SAML жооптордун кол коюуларын текшерүүнү күйгүзүү/өчүрүү.
+authentication=Аутентификация
+eventTypes.DELETE_ACCOUNT.name=Каттоо эсебин өчүрүү
+logoutUrlHelp=Колдонуучуну тышкы IDPден чыгарып салуу үчүн сессияны бүтүрүү дареги.
+noUserDetails=Колдонуучу тууралуу маалымат жок
+sync-ldap-groups-to-keycloak=LDAP топторун Keycloak менен синхрондоштуруу
+attestationPreference.indirect=Жанама
+frontchannelUrlInvalid=Фронт-канал чыгуу дареги жараксыз
+noCredentialsText=Бул колдонуучунун эч кандай кирүү маалыматы жок. Сиз бул колдонуучуга сырсөз орното аласыз.
+deletePolicyWarning=Төмөнкү топтолгон саясаттар автоматтык түрдө өчүрүлөт\:
+validatingPublicKey=Жариялык ключ текшерилүүдө
+permissionsListIntro=Уруксат тизмесин өзгөртүү үчүн масштаб-аты басыңыз. Андан кийин <1>{{realm}}</1> аттуу кардардын уруксат деталдары барагына багытталат.
+deleteClientConditionSuccess=Шарт ийгиликтүү өчүрүлдү.
+signatureAlgorithm=Кол коюу алгоритми
+deleteConfirmIdentityProvider=‘{{provider}}’ камсыздоочусун толук өчүрүүгө ишенесизби?
+resetActions=Аракеттерди баштапкы абалга келтирүү
+cibaExpiresInHelp="auth_req_id" мөөнөтү секунддарда, аутентификация сурамынан кийин эсептелет.
+eventTypes.CLIENT_INFO_ERROR.description=Кардардын маалымат катасы
+batchSize=Пакеттин көлөмү
+user=Колдонуучу
+scopesAsRequested=Масштабдар сурангандай
+updateErrorClientScope=Кардардын масшабын жаңыртуу мүмкүн болбой калды\: '{{error}}'
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=OAuth2 түзмөк колдонуучу кодун тастыктоо
+useKerberosForPasswordAuthentication=Сырсөздү аутентификациялоо үчүн Kerberos колдонуу
+validateUuidLDAPAttribute=UUID түрүндөгү LDAP атрибутун киргизишиңиз керек
+client-scopes-condition.tooltip=Күтүлгөн кардардын масштабдарынын тизмеси. Шарт белгиленген кардардын масшабына туура келсе чын болот. Ошондой эле 'Scope Type' аркылуу стандарттуу же ыктыярдуу масштаб экени көз каранды.
+rootURLHelp=Салыштырмалуу URLдерге кошулган түп URL
+anonymousAccessPolicies=Атсыз кирүү саясаттары
+createResourceBasedPermission=Ресурс негизиндеги уруксат түзүү
+searchForRole=Роль издөө
+debugHelp=Krb5LoginModule үчүн стандарттык чыгарууларга дебагты күйгүзүү/өчүрүү.
+validatorColNames.colConfig=Конфигурация
+createClient=Кардар түзүү
+inputTypeRows=Киргизүү саптары
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Иденттүүлүк камсыздоочунун биринчи кирүүсү
+usedMemory=Колдонулган эс тутум
+validatePasswordPolicyHelp=Keycloak сырсөздү жаңыртуудан мурун реалм сырсөз саясатын текшериши керекпи. LDAPда сырсөз сакталарда айрым саясаттар иштебейт: Not Recently Used, Expire Password, Hashing Iterations, Hashing Algorithm. Себеби Keycloak сырсөздү түздөн-түз башкара албайт. Эгер ушул саясаттарды колдонгуңуз келсе, LDAP серверде күйгүзүңүз.
+bruteForceModeHelpText=Күйгүзүлгөндө, брутфорс кол салуу аныкталганда колдонуучу аккаунтуна эмне болорун аныктаңыз.
+quickLoginCheckMilliSeconds=Ыкчам кирүү текшерүү миллисекундда
+createResourceSuccess=Ресурс ийгиликтүү түзүлдү
+documentation=Документация
+fullNameLdapReadOnlyHelp=Окуу үчүн гана, маалымат LDAPдан Keycloak базасына импорттолуп, Keycloakдо колдонуучу жаңыртылса LDAPга сакталбайт.
+roleExplain=Реалм ролдору учурдагы реалм үчүн колдонуу үчүн аныкталат.
+whatIsDefaultGroups=Стандарттуу топтордун функциясы эмне?
+transient=Убактылуу
+generalSettings=Жалпы жөндөөлөр
+addClientProfileError=Кардардын профилин түзүү мүмкүн болбой калды\: '{{error}}'
+overallResults=Жалпы натыйжалар
+requiredUserActionsHelp=Колдонуучу киргенде милдеттүү аракеттер. ‘Verify email’ — электрондук почтаны тастыктоо. ‘Update profile’ — жеке маалыматты жаңыртуу. ‘Update password’ — сырсөздү жаңылоо. ‘Configure OTP’ — мобилдик пароль генераторун орнотуу.
+requestObjectSignatureAlgorithmHelp=Кардар OIDC сурамындагы Request объектти кол коюу үчүн JWA алгоритми. ‘any’ болсо, каалаган алгоритм колдонулат (анын ичинде ‘none’).
+ldapKerberosSettingsDescription=Kerberos интеграциясы үчүн пайдалуу опциялар. Факты LDAP сервер Kerberos/SPNEGO менен колдонулаганда.
+deleteEvents=Иш-чараларды тазалоо
+termsOfServiceUrlHelp=Relying Party кардары колдонуучу үчүн кызмат шарттарын окуй турган URL
+clientSecretError=Кардардын сыр сөзүн кайра түзүү мүмкүн болбой калды\: {{error}}
+resourcePath=Ресурс жолу
+useJwksUrlHelp=Күйгүзүлгөндө, коомдук ключ JWKS URLден жүктөлөт. Натыйжа ийкемдүү, себеби жаңы ключ түзүлгөндө кайра жүктөлөт. Күйгүзүлбөсө, Keycloak базасынан алынат; демек жаңы ключ өзгөргөндө аны кайра импорттоо керек.
+mapperTypeHardcodedAttributeMapperHelp=Бул карталаштыруучу LDAPдан колдонуучуну импорттоодо каалаган колдонуучу атрибутун жана кээ бир касиеттерди (мисалы emailVerified же enabled) катуу белгилейт.
+downloadAdaptorTitle=Адаптер конфигурацияларын жүктөө
+client-roles.label=Кардардын ролдору
+keysFilter.PASSIVE=Пассивдик ключтор
+revocation=Жоюу
+scopeTypeHelp=Кардар масштабы, ар бир түзүлгөн кардарга демейки масштаб катары кошулат
+search=Издөө
+validateEditMode=Редактор режимин тандашыңыз керек
+copyFlowSuccess=Агым ийгиликтүү көчүрүлдү
+cacheSettings=Кэш жөндөөлөрү
+client-attributes.label=Клиенттин атрибуттары
+searchForClient=Клиентти издөө
+permissionDeletedError={{error}} себебинен уруксатты өчүрүү мүмкүн болбой калды
+eventTypes.UPDATE_PROFILE.name=Профилди жаңыртуу
+realmId=Realm ID
+eventTypes.PERMISSION_TOKEN_ERROR.description=Уруксат токенинин катасы
+algorithmHelp=Күч үчүн болжолдонгон алгоритм
+importFile=Файлды импорттоо
+userVerify.discouraged=Жактырылбайт
+ldapRolesDn=LDAP ролдорунун DN
+displayOnClientHelp=Бул клиент үчүн 'Макулдук талап кылынат' күйгүзүлгөн учурда гана колдонулат. Күйгүзүлбөсө, макулдук экраны жөн гана конфигурацияланган клиент чектөөлөрүнүн макулдуктарын камтыйт. Күйгүзүлгөндө, макулдук экранына бул клиент боюнча бир элемент да кошулат.
+requestObjectRequired=Суроо объекти талап кылынат
+protocolHelp=Бул клиент чектөөсү аркылуу берилген SSO протоколунун конфигурациясы
+prompts.none=Жок
+resourcesHelp=Бул уруксат белгиленген ресурска колдонулушу керектигин көрсөтөт.
+passwordConfirmation=Паролду ырастоо
+aggregate.attrs.tooltip=Атрибуттун маанилери топтун атрибуттары менен бириктирилеби дегенди билдирет. OpenID Connect карталагыч колдонулса, көптөгөн маанилерди алуу үчүн көп маанилүү параметр да күйгүзүлүшү керек. Кайталоо маанилери жокко чыгарылат жана бул опция менен маанилердин тартиби кепилденбейт.
+helpLabel='{{label}}' үчүн көбүрөөк жардам
+noRoles=Бул колдонуучунун ролдору жок
+createAttribute=Атрибут түзүү
+Thursday=Бейшемби
+importOverwritten_one=Бир жазуу үстүнөн жазылды.
+tokenDeleteError=Баштапкы жеткиликтүүлүк токенин өчүрүү мүмкүн болбой калды: '{{error}}'
+eventTypes.REGISTER_NODE_ERROR.name=Түйүндү каттоо катасы
+isMandatoryInLdap=LDAPте милдеттүү
+discoveryEndpoint=Ачыктоо чекити
+claimValue=Талаптын мааниси
+eventTypes.FEDERATED_IDENTITY_LINK.name=Федерацияланган инсандык байланыш
+authenticationHelp=Бул күйгүзгүч OIDC кардар түрүн аныктайт. Күйгүзүлгөндө, түрү сырдуу жеткиликтүүлүк. Өчүрүлгөндө, түрү коомдук жеткиликтүүлүк.
+deleteClientConditionError=Шарт түзүүдө каталык: {{error}}
+noMappers=Карталагычтар жок
+couldNotLinkIdP=Инсандык провайдерди байланыштыруу мүмкүн болбой калды: {{error}}
+otpPolicyPeriod=OTP Токендин мөөнөтү
+managePriorities=Приоритеттерди башкаруу
+createClientPolicySuccess=Жаңы саясат түзүлдү
+frontendUrlHelp=Realm үчүн алдыңкы URLди орнотуу. Негизги хосттун провайдери менен бирге колдонулат, айрым realm үчүн алдыңкы сурамдардын негизги URLин алмаштыруу үчүн.
+used.notInUse=Колдонулбайт
+emailSettings=Электрондук почта жөндөөлөрү
+samlEntityDescriptorHelp=Сырттан IDP метадатасын конфигурация файлынан жүктөөгө же URLден алуу мүмкүнчүлүгүн берет.
+generatedIdTokenHelp=Тандалган колдонуучу аутентификацияланганда түзүлүп, кардарга жөнөтүлө турган ID токендин мисалын караңыз. Сиз протокол карталагычтар жана ролдорго негизделген талаптар менен ролдорду көрө аласыз.
+createClientProfile=Кардар профили түзүү
+passwordPoliciesHelp.specialChars=Паролдо талап кылынган атайын белгилердин саны.
+cachePolicy=Кэш саясаты
+noCredentials=Креденциалдар жок
+clientOfflineSessionIdle=Кардардын оффлайн сессиясы бош турган убакыт
+eventListeners=Иш-чара угуучулар
+bindDn=Bind DN
+evictionHourHelp=Жазуу жараксыз боло турган саат
+permissionDetails=Уруксаттын деталдары
+clipboardCopyDenied=Браузер сиздин буферге кирүү мүмкүнчүлүгүңүздү бөгөттөдү.
+Friday=Жума
+saveProviderListSuccess=Провайдердин артыкчылыгы ийгиликтүү жаңыртылды.
+copyToClipboard=Буферге көчүрүү
+wantAuthnRequestsSigned=AuthnRequest кол коюусун каалайсызбы
+usermodel.attr.tooltip=UserModel.attribute картасында сакталган колдонуучу атрибутунун аты.
+clientPoliciesProfiles=Кардар саясаты профилдери
+eventTypes.SEND_VERIFY_EMAIL.name=Тастыктоочу электрондук почтаны жөнөтүү
+requiredForLabel.both=Колдонуучулар жана админдер экөө тең
+eventTypes.REGISTER_NODE.name=Түйүндү каттоо
+addToFilter=Фильтрге кошуу
+CONFIGURE_TOTP=OTP орнотуу (CONFIGURE_TOTP)
+eventTypes.EXECUTE_ACTIONS.description=Иш-аракеттерди аткаруу
+clientUpdaterSourceRolesHelp=Кардарды түзүү/жаңыртуу аракетин жасаган субъекттин ролун текшерет, саясаттын колдонулушун аныктайт.
+userModelAttributeName=Колдонуучу моделинин атрибутунун аты
+importResourceError=Ресурсту {{error}} себебинен импорттоо мүмкүн болбой калды
+dynamicScope=Динамикалык чектөө
+mapperTypeHardcodedLdapRoleMapper=түздөн-түз белгиленген LDAP рол карталагычы
+validateName=Атын киргизишиңиз керек
+flowDetails=Агымдын деталдары
+never=Эч качан
+includeInIntrospection.tooltip=Талап токендин терең текшерүүсүнө кошулушу керекпи?
+addressClaim.region.tooltip='address' токен талапындагы 'region' субталапка туура келген колдонуучу атрибутунун аты. Адатта 'region'.
+IDK-periodicChangedUsersSyncHelp=Жаңы түзүлгөн колдонуучулар LDAP дүкөнүндө түзүлүшү керекпи? Приоритет кайсы провайдерди тандоого таасир этет.
+logoutServiceArtifactBindingUrlHelp=Кардардын бирдиктүү чыгуу кызмат үчүн SAML ARTIFACT Binding URL. Эгер башка байланууну колдонсоңуз, бош калтыра аласыз.
+claimToRole=Эгер талап бар болсо, колдонуучуга белгиленген realm же кардар ролун берүү.
+logoutServicePostBindingURL=Чыгуу кызматы POST байлануу URL
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=Федерацияланган инсандыкты алып салуу катасы
+assertionConsumerServicePostBindingURLHelp=Кардардын дооматты кабыл алуучу кызматы үчүн SAML POST байлануу URL. Эгер URL жок болсо, бош калтыра аласыз.
+createAuthorizationScope=Авторизация чектөөсүн түзүү
+noGroups=Топтор жок
+backchannelLogoutRevokeOfflineSessionsHelp=Backchannel Logout URL колдонулганда Logout Token ичинде "revoke_offline_access" иш-чарасы барбы дегенди аныктайт. Keycloak Logout Token алганда оффлайн сессияларды жок кылат.
+roleID=Ролдун IDси
+roleNameLdapAttributeHelp=Рол объектилеринде ат жана RDN үчүн колдонулган LDAP атрибутунун аты. Адатта 'cn'. Бул учурда топ/рол объект DNсы 'cn\=role1,ou\=finance,dc\=example,dc\=org' сыяктуу болушу мүмкүн.
+origin=Кайсы жерден
+regexPattern=Регулярдык өрнөк
+targetContextAttributes=Максаттуу контекст атрибуттары
+targetContextAttributesHelp=Идентификация атрибуттарынын ордуна контекст атрибуттары (талаптар) бааланат
+filteredByClaim=Негизги талапты текшерүү
+rowCancelBtnAriaLabel={{messageBundle}} үчүн түзөтүүлөрдү жокко чыгаруу
+validateSignatureHelp=Сырткы IDP кол тамгаларын текшерүүнү күйгүзүү/өчүрүү.
+searchForFlow=Агымды издөө
+verifyEmail=Электрондук почтаны тастыктоо
+addressClaim.locality.label=Жергиликтүүлүк үчүн колдонуучу атрибутунун аты
+formatOption=Формат параметри
+addAuthnContextClassRef=AuthnContext ClassRef кошуу
+showPasswordDataName=Аты
+clientScopeTypes.none=Жок
+whoCanEdit=Ким түзөтө алат?
+mappingCreatedSuccess=Карталашуу ийгиликтүү түзүлдү
+eventTypes.GRANT_CONSENT.description=Макулдук берүү
+client=Кардар
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=OAuth2 түзмөкө аутентификация ката
+addSubFlowHelp=Под-ағындар жалпы же форма түрүндө болушу мүмкүн. Форма түрү колдонуучу үчүн бир ағын түзүүчү под-ағынды куруу үчүн колдонулат. Под-ағындар — бул аткаруунун атайын түрү, алар камтыган аткаруулардын жыйынтыгына жараша ийгиликтүү деп эсептелет.
+implicitFlow=Жашыруун ағын
+authorizationSignedResponseAlgHelp=Жауап режими jwt болгондо авторизация жооп токендерин кол коюу үчүн колдонулган JWA алгоритми.
+associatedRolesRemoved=Тийиштүү ролдор алынган
+keyAliasHelp=Жеке ачкыч үчүн алиас
+whoWillAppearLinkTextUsers=Бул топ тизмесинде кимдер көрүнөт?
+tokenClaimName.tooltip=Токенге киргизүү үчүн талаптын аты. Бул толук квалификацияланган аталыш болушу мүмкүн, мисалы 'address.street'. Бул учурда иерархияланган JSON объекти түзүлөт. Иерархиядан качуу жана чекитти түз колдонуу үчүн, чекитти тилке (\\.) менен качырыңыз.
+userName=Колдонуучу аты
+clientProfileDescription=Түшүндүрмө
+ellipticCurveHelp=ECDSAда колдонулган эллиптик ийрилик
+fromPredefinedMapper=Мурда белгиленген мапперлерден
+attributesGroup=Атрибуттар тобу
+ssoSessionMax=Сессиянын аяктаганга чейинки максималдуу убактысы. Сессия аяктаганда, токендер жана браузер сессиялары жараксыз болот.
+clientDeleteError=Кардарды өчүрүү мүмкүн болгон жок\: {{error}}
+optimizeLookup=REDIRECT кол коюу ачкычын издөө оптималдаштыруу
+joinGroupsFor=Колдонуучу {{username}} үчүн топторго кошулуу
+temporaryLocked=Убактылуу кулпуланган
+setup=Орнотуу
+unlinkAccount=Каттоо эсебин ажыратуу
+executors=Аткаруучулар
+eventTypes.CLIENT_UPDATE_ERROR.name=Кардарды жаңыртуу ката
+realm=Realm
+attributeConsumingServiceIndex=Атрибуттарды керектөөчү сервис индекси
+prompt=Суроо
+assign=Белгилөө
+disableConfirmRealm=Эгерде realm өчүрүлсө, колдонуучулар жана кардарлар ага кире албайт. Улантууну каалайсызбы?
+showAuthData=Авторизация маалыматын көрсөтүү
+includeInUserInfo.tooltip=Талап колдонуучу маалыматына кошулушу керекпи?
+select=Тандоо
+signature-algorithm=JWTни аутентификация үчүн кол коюуда кардар колдонууга тийиш болгон JWA алгоритми. Бош калтырылса, кардар каалаган ылайыктуу алгоритмди колдонууга уруксат берилет.
+advanced=Кеңейтилген
+initialCounter=Баштапкы санагыч
+revokeRefreshTokenHelp=Эгер иштетилсе, жаңыртуу токенди 'Refresh Token Max Reuse' өлчөмүнө чейин гана колдонсо болот жана башка токен колдонулганда ал жок кылынат. Болбосо, жаңыртуу токендери колдонулганда жок кылынбайт жана бир нече жолу колдонулушу мүмкүн.
+nameField=Аты
+ownerManagedAccessHelp=Эгер иштетилсе, бул ресурска кирүү ресурстун ээсинин көзөмөлүндө болот.
+useLowerCaseBearerTypeHelp=Эгер бул жандырылса, токен жоопторунда "bearer" типи кичине тамгалар менен берилет. Демейки боюнча сервер RFC6750 боюнча "Bearer" деп коюлат.
+useRfc9068AccessTokenTypeHelp=Эгер иштетилсе, кирүү токендери RFC9068ге ылайык "at+jwt" баштык типин алышат. Болбосо, баштык "JWT" болот.
+addCondition=Шарт кошуу
+updateSuccessClientScope=Кардар масштабы жаңыртылды
+connectionAndAuthentication=Туташуу & Аутентификация
+clientScopeType.optional=Кошумча
+permissionsDisableConfirm=Эгер уруксаттарды өчүрсөңүз, төмөндөгү бардык уруксаттар автоматтык түрдө өчүрүлөт. Андан тышкары, байланышкан ресурстар жана масштабдар да өчүрүлөт.
+eventTypes.REFRESH_TOKEN.description=Жаңыртуу токени
+authorization=Авторизация
+clientProfilesHelpItem=Кардар профилдери боюнча жардам элемент
+userSessionAttributeValue=Колдонуучу сессиясынын атрибутунун мааниси
+dayMonthHelp=Саясаттын берилиши керек болгон айдын күнүн аныктайт. Экинчи талааны толтуруп диапазон көрсөтсөңүз болот. Бул учурда уруксат учурдагы айдын күнү берилип жаткан эки маанинин ортосунда же эквиваленттүү болгондо гана берилет.
+fullNameLdapWriteOnlyHelp=Write-only үчүн, маалымат Keycloakто колдонуучу түзүлгөндө же жаңыланганда LDAPга жайылтылат. Бирок бул маппер маалыматты LDAPтан Keycloakка кайра өткөрүү үчүн колдонулбайт. Бул параметр, эгер сиз жеке firstName жана lastName атрибут мапперлерин түзгөн болсоңуз, LDAPдан Keycloakка окуу үчүн пайдалуу.
+userFedDeleteError=Колдонуучу федерация провайдерин өчүрүү мүмкүн болгон жок\: '{{error}}'
+id=ID
+join=Кошулуу
+clientUpdaterSourceGroupsHelp=Шарт кардарды түзүү/жаңыртуу аракетин жасаган субъекттин тобун текшерет, саясаттын колдонулушун аныктоо үчүн.
+idTokenEncryptionContentEncryptionAlgorithmHelp=ID токендерди шифрлөө үчүн колдонулган мазмун шифрлөө JWA алгоритми. Бул параметр шифрленген ID токендер керек болгондо гана колдонулат. Эгер бош болсо, ID токендер кол коюлат, бирок шифрленбейт.
+messageBundleDescription=Сиз колдоого алынган локалдарды гана түзөтө аласыз. Эгерде колдоого алынган локалдарды тандаган жок болсоңуз, анда англис тилин гана түзөтө аласыз.
+saveEventListenersError=Окуя уккучун сактоо катасы\: {{error}}
+scopesHelp=Авторизация суроодо жөнөтүлүүчү масштабдар. Бул мейкиндик менен бөлүнгөн масштабдардын тизмеси болушу мүмкүн. Демейки боюнча 'openid'.
+multivalued.tooltip=Атрибут бир нече маанини колдойт бекенин көрсөтөт. Эгер чын болсо, бул атрибуттун бардык маанилери талап катары берилет. Эгер жок болсо, биринчи гана мааниси талапка киргизилет.
+inputOptionLabelsI18nPrefix=Калкымалы тил ачкычынын префикси
+enabledHelp=Ачкычтар иштетилген болсо белгиленет
+nameHintHelp=Топтун уникалдуу аты. Бул ат топко атрибутту байлаганда колдонулат.
+admin-events-cleared-error=Админ окуяларын тазалоо мүмкүн болгон жок {{error}}
+usersPermissionsHint=Реалмдеги бардык колдонуучуларды башкаруу үчүн жакшы аныкталган уруксаттар. Колдонуучуларды башкарууга ким уруксаттуу экенин ар кандай саясат менен аныктай аласыз.
+isBinaryAttribute=Бул бинардык атрибутпу
+clientScopeList=Кардар масштабдары
+noValidMetaDataFound=Бул URL боюнча жарактуу метадата табылган жок\: '{{error}}'
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=Identity провайдер токенди алуу катасы
+usernameLdapAttribute=Колдонуучу аты LDAP атрибуту
+updateResourceSuccess=Ресурс ийгиликтүү жаңыртылды
+displayNameHelp=Identity провайдерлер үчүн достук ат
+idpAccountEmailVerification=IdP каттоо эсеби электрондук почтаны текшерүү
+template=Шаблон
+deleteExecutionSuccess=Аткаруу ийгиликтүү өчүрүлдү
+deleteConfirmTitle_other=Топторду өчүрүү?
+profilesConfigTypes.jsonEditor=JSON редактору
+testingConnection=Туташуу текшерилүүдө
+noUsersFoundError=Колдонуучулар табылган жок\: {{error}}
+clientUpdaterSourceGroups=Топтор
+executorDetails=Аткаруучу жөнүндө маалымат
+maxDeltaTimeSeconds=Ката саноону калыбына келтирүү убактысы
+backchannelLogoutHelp=Сырттан келген IDP арткы канал аркылуу чыгуу колдойбу?
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=Федерацияланган инсанды алып салуу катасы
+usermodel.realmRoleMapping.rolePrefix.tooltip=Ар бир Realm ролунун атынан мурун коюлган префикс (милдеттүү эмес).
+exportSamlKeyTitle=SAML ачкычтарын экспорттоо
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=OAuth2 түзмөктүн колдонуучу кодун текшерүү катасы
+eventTypes.EXECUTE_ACTIONS_ERROR.description=Аткаруу аракеттери катасы
+SKIP=Өткөрүп жиберүү
+eventTypes.INTROSPECT_TOKEN.description=Токенди талдоо
+infoEnabledFeatures=Бардык иштетилген функцияларды көрсөтөт.
+displayOrderHelp=GUIдеги провайдерлердин көрсөтүү тартибин аныктоочу сан (мисалы, Кирүү бетинде). Эң төмөнкү сан биринчи колдонулат.
+deleteCredentialsConfirm=Бул колдонуучулардын күбөлүктөрүн өчүрүүгө ишенесизби?
+keysIntro=Эгер "JWKS URL колдонуу" жандырылган болсо, жарактуу JWKS URLди толтуруңуз. Сактагандан кийин, администратор JWKS URLден ачкычтарды жүктөп алса болот же Keycloak сервери белгисиз KID кездешкенде ачкычтарды автоматтык түрдө жүктөйт.
+logoutServiceArtifactBindingUrl=Чыгуу кызмат ARTIFACT байланыштыруу URL
+passwordPoliciesHelp.lowerCase=Сырсөздө талап кылынган кичине тамгалардын саны.
+searchForProvider=Провайдерди издөө
+ldapSearchingAndUpdatingSettingsDescription=Бул бөлүмдө LDAP сервериндеги колдонуучуларды издөөгө байланыштуу параметрлер бар.
+sessionsType.regularSSO=Нормалдуу SSO
+allowed-client-scopes.tooltip=Жаңы катталган кардарда колдонууга уруксат берилген кардар масштабдарынын ак тизмеси. Ак тизмеде жок масштабдарды колдонуп кардарды каттоо токтотулат. Демейки боюнча, ак тизмеде же болбосо Realm боюнча стандарттуу кардар масштабдары бар.
+maxDeltaTimeSecondsHelp=Качан ката саноосу калыбына келтирилет?
+executorsHelpItem=Аткаруучулар боюнча жардам элемент
+contentSecurityPolicy=Контентти коопсуздук саясаты
+client-uris-must-match.tooltip=Жандырылган болсо, бардык Кардардын URIлары (жөнөтүү URIлары жана башкалар) ишенимдүү доменге дал келиши керек.
+off=Өчүрүү
+frontchannelLogoutHelp=Чын болсо, чыгуу браузер аркылуу кардарга багытталат. Жок болсо, сервер чыгуу үчүн фондук чакыруу жасайт.
+frontchannelLogoutOIDCHelp=Чын болсо, чыгуу браузер аркылуу кардарга OIDC Front-channel чыгуу спецификациясына ылайык жиберилет. Жок болсо, сервер чыгуу үчүн фондук чакыруу жасайт, эгер Backchannel-logout же Админ URL конфигурацияланган болсо.
+updateSuccess=Провайдер ийгиликтүү жаңыртылды
+hide=Жашыруу
+isMandatoryInLdapHelp=Чын болсо, бул атрибут LDAPта милдеттүү. Эгер Keycloak базасында мааниси жок болсо, бош мааниси LDAPга өткөрүлөт.
+client-accesstype.label=Кардарга жетүү түрү
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Identity провайдер кирүүдөн кийин ката
+skipCustomizationAndFinish=Жекелештирүүнү өткөрүп жиберүү жана аяктоо
+mappingDeletedSuccess=Карта өчүрүлдү
+addIdentityProvider=Провайдерди кошуу {{provider}}
+flowDescriptionHelp=Жаңы ағындын сүрөттөмөсү боюнча жардам тексти
+kc.time.date_time=Дата/Убакыт (MM/dd/yyyy hh\:mm\:ss)
+principalType=Принципал түрү
+ignoreMissingGroupsHelp=Топ иерархиясында жок топторду жокко чыгаруу.
+updatedCredentialMoveSuccess=Колдонуучу күбөлүктөрү конфигурациясы сакталды
+deleteExecutorProfileConfirmTitle=Аткаруучуну өчүрүү?
+auth=Auth
+accessTokenLifespanImplicitFlow=Имплицит агым үчүн Access Token өмүрүнүн узактыгы
+createAttributeSuccess=Ийгилик\! Колдонуучу профилинин конфигурациясы сакталды.
+annotations=Анотациялар
+confirmAccessTokenBody=Каттоо Access Token кайра түзүлсө, кардар каттоо кызматына тиешелүү кирүү маалыматтары жаңыртылат.
+remainingCount=Калган саны
+eventTypes.INVALID_SIGNATURE.description=Жарамсыз колтамга
+download=Жүктөө
+authScopes=Авторизация скоуптору
+requiredWhen=Талап кылынат качан
+requiredWhenTooltip=Скоуптор колдонулганда, атрибут талап кылынат эгер каттоодо жок дегенде бир конфигурацияланган скоуп колдонулса. Учурдагы суроо үчүн да, админ жана аккаунт консолунда скоуптор каралбайт жана атрибут талап кылынбайт.
+updatePasswordPolicyError=Сырсөз саясатын жаңыртуу мүмкүн болгон жок\: '{{error}}'
+max-clients.tooltip=Реалмдеги кардарлардын саны белгиленген чектен көп же тең болсо, жаңы кардарды каттоо мүмкүн эмес.
+uuidLdapAttributeHelp=LDAP атрибутунун аты, ал уникалдуу объект идентификатору (UUID) катары колдонулат. Көп LDAP серверлеринде бул 'entryUUID', бирок Active Directory үчүн 'objectGUID' болушу мүмкүн. Эгер сервер UUID түшүнүгүн колдобосо, башка уникалдуу атрибуттарды колдонсо болот, мисалы 'uid' же 'entryDN'.
+mappingDetails=Mapper деталдары
+top-level-flow-type.client-flow=Кардар агымы
+eventTypes.GRANT_CONSENT_ERROR.description=Макулдук берүүдө ката кетти
+claim=Талап
+hardcodedAttribute=Провайдерден импорттолгондо, белгилүү бир колдонуучу атрибутуна бекитилген маани берилет.
+permissionSaveError=Ыктымал {{error}} себептүү уруксат жаңыртуу мүмкүн болгон жок
+optimizeLookupHelp=SAML документтерин REDIRECT байламы менен имзалоодо, Keycloak адаптерине коопсуз кардар үчүн, имза ачкычынын ID маалыматын <Extensions> элементине киргизүү керекпи? Бул имзанын текшерүүсүн оптималдаштырат, анткени текшерүүчү тарап бир ачкычты гана колдонот.
+deleteClientScope_one=Кардардын скоупун өчүрүү {{name}}
+accessTokenError=Access Token кайра түзүү мүмкүн болгон жок\: {{error}}
+joinGroups=Топторго кошулуу
+scopePermissions.clients.configure-description=Администратордун башкаруу укуктары чектелген. Скоуп, шаблон же протокол мапперлерин орнотууга болбойт.
+providedBy=Провайдер тарабынан берилген
+doNotStoreUsers=Колдонуучуларды сактоого болбойт
+ms=миллисекундалар
+ipAddress=IP дарек
+keyID=КЫЛЫП_ИД
+spi=SPI
+emptyValidators=Текшерүүчү жок.
+plus=Кошумча
+browserFlow=Браузер агымы
+anyScope=Кайсы болбосо скоуп
+enableDisable=Өчүрүлгөн кардарлар кирүү баштай албайт же Access Token ала албайт.
+noUsersFound=Колдонуучу табылган жок
+serverInfo=Сервер тууралуу маалымат
+chooseAPolicyTypeInstructions=Төмөнкү тизмеден саясат түрүн тандаңыз жана жаңы саясатты конфигурациялаңыз. Түрлөрү жана сүрөттөмөсү бар.
+emailThemeHelp=Сервер тарабынан жөнөтүлгөн почталар үчүн теманы тандаңыз.
+principalTypeHelp=Тышкы колдонуучуларды аныктоонун жана көзөмөлдөөнүн жолу. Адегенде Subject NameID колдонулат, альтернатива катары идентификатор атрибуту коюлушу мүмкүн.
+Wednesday=Шаршемби
+consents=Макулдуктар
+authDetails=Авторизациянын деталдары
+mappingDeletedError=Маппингди өчүрүү мүмкүн болгон жок\: '{{error}}'
+minimumQuickLoginWaitSecondsHelp=Ыкчам кирүү ката болгондон кийин канча убакыт күтүү керек.
+mappedGroupAttributesHelp=Атрибуттардын аттарын үтүктөр менен бөлүнгөн тизмеси. LDAP топтун атрибуттары Keycloakтогу Топтун атрибуттары катары маппинг кылынат. Эгер кошумча атрибуттар керек эмес болсо бош калтырыңыз.
+deleteGrantsSuccess=Рұксаттар ийгиликтүү жок кылынды.
+mapperTypeGroupLdapMapper=group-ldap-mapper
+policyEnforcementModes.DISABLED=Өчүрүлгөн
+openIdConnectCompatibilityModes=OpenID Connect шайкештик режимдери
+no=Жок
+code=Код
+nameHelp=Жаңы агымдын аталышы үчүн жардам тексти
+keys=Ачкычтар
+defaultSigAlg=Тандалган колтамга алгоритми
+signatureKeyName=SAML колтамга ачкычынын аты
+notBeforeTooltip=Админ URL Админ панелиндеги Параметрлерден орнотулушу керек.
+resourcesToImport=Импорттоого ресурстар
+selectRole.label=Рөлдү тандаңыз
+isBinaryAttributeHelp=Бул бинардык LDAP атрибуту болушу керек.
+whoWillAppearPopoverFooterText=Бул ролго ээ колдонуучулар бул өтмөктө кошула албайт.
+eventTypes.RESTART_AUTHENTICATION_ERROR.name=Авторизацияны кайра баштоо катасы
+generatedUserInfoIsDisabled=Колдонуучу тандалбаса, түзүлгөн маалымат өчүрүлгөн
+nameHelpHelp=Mapperдин аты
+prompts.consent=Макулдук алуу
+flowNameHelp=Жаңы агымдын аталышы үчүн жардам тексти
+webAuthnPolicyRpEntityName=Релайинг тараптын объектинин аты
+lastEvaluation=Акыркы баалоо
+createClientConditionError=Шарт түзүүдө ката\: {{error}}
+serverPrincipalHelp=HTTP кызматынын сервер жана домен аталышы менен толук аты. Мисалы, HTTP/host.foo.org@FOO.ORG
+enableStartTlsHelp=STARTTLS аркылуу LDAP байланышын шифрлөө, бул байланышты топтоону өчүрөт
+resourceScopeSuccess=Авторизация скоуп ийгиликтүү өчүрүлдү
+userIdHelperText=Бул идентификация провайдери үчүн колдонуучунун уникалдуу IDсин киргизиңиз.
+forwardParametersHelp=Баштапкы тиркемеден Авторизация Endpointке өткөрүлүүчү OpenID Connect/OAuth стандартынан тыш параметрлер. Бир нече параметрлер үтүк менен бөлүнөт (,).
+on=Иштетилген
+changeAuthenticatorConfirmTitle={{clientAuthenticatorType}} түрүнө өзгөртүү?
+eventTypes.OAUTH2_DEVICE_AUTH.name=OAuth2 түзмөк менен аутентификациялоо
+admin-events-cleared=Админ окуялары тазаланды
+or=же
+deleteDialogTitle=Атрибут топту өчүрүү?
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Кардар тарабынан башталган аккаунтту байланыштыру
+annotationsText=Анотациялар
+ldapAttributeName=LDAP атрибутунун аты
+acceptsPromptNone=Кардардан prompt=none кабарын кабыл алат
+loginThemeHelp=Кирүү, OTP, уруксат берүү, каттоо жана сырсөздү унутуу беттери үчүн теманы тандаңыз.
+AESKeySizeHelp=Жасалган AES ачкычынын байттагы өлчөмү. 16 – AES-128, 24 – AES-192, 32 – AES-256. ЭСКЕРТҮҮ: Кээ бир JDKлер 128ден чоң ачкычтарды колдобойт.
+client-accesstype.tooltip=Кардардын жетүү түрү, шарт кайсыга колдонулат. Конфиденциалдуу кардар аутентификацияны иштеткен, коомдук кардар өчүргөн. Bearer-only эскирген кардар түрү.
+oneTimePassword=Бир жолку сырсөз
+invalidateRotatedError=Айлантылган сырды өчүрүү мүмкүн болгон жок\: {{error}}
+excludeSessionStateFromAuthenticationResponseHelp=Иштетилсе, 'session_state' параметри OpenID Connect авторизация жооптон чыгарылат. Бул эски OIDC/OAuth2 адаптерин колдонгондо пайдалуу.
+useRefreshTokenForClientCredentialsGrantHelp=Иштетилсе, client_credentials гранты колдонулганда refresh_token түзүлөт жана токен жоопко кошулат. Эгер өчүрүлсө, refresh_token түзүлбөйт жана колдонуучунун сессиясы жок кылынат.
+userManagedAccess=Колдонуучу тарабынан башкарылган жетүү
+initialAccessToken=Баштапкы жетүү токени
+rowEditBtnAriaLabel={{messageBundle}} түзөтүү
+evictionDay=Чыгару күнү
+vendorHelp=LDAP провайдери
+applyToResourceType=Ресурстук түргө колдонуу
+addDefaultGroups=Адистештирилген топторду кошуу
+selectRole.tooltip=Сол жактагы текст кутучасына роль атын киргизиңиз же бул баскычты басып издеп тандаңыз.
+filterGroups=Топторду фильтрлөө
+validPostLogoutRedirectUri=Чыгуудан кийинки жарактуу багыттоо URIлери
+authnContextClassRefs=Авторизациянын контекст класстарынын шилтемелери
+deleteCredentialsSuccess=Креденциалдар ийгиликтүү өчүрүлдү.
+eventTypes.PERMISSION_TOKEN_ERROR.name=Рухсат токен катасы
+userProfileSuccess=Колдонуучу профилинин жөндөөлөрү ийгиликтүү жаңыртылды.
+attributeDefaultValueHelp=Эгер Keycloak маалымат базасында мааниси жок болсо жана атрибут LDAPта милдеттүү болсо, бул мааниси LDAPка жайылтылат.
+cibaPolicy=CIBA саясаты
+Saturday=Ишемби
+importSkipped_other={{count}} жазуулар өткөрүлүп берилди.
+membershipAttributeTypeHelp=DN деген топтун мүчөлөрү толук DN формасында көрсөтүлгөн дегенди билдирет. Мисалы, 'member: uid=john,ou=users,dc=example,dc=com'. UID болсо топтун мүчөлөрү жөн гана uid формасында көрсөтүлөт, мисалы 'memberUid: john'.
+unsavedChangesTitle=Сакталбаган өзгөртүүлөр
+emptyResourcesInstructions=Ресурсту түзгүңүз келсе, төмөнкү баскычты басыңыз.
+save-user-eventsHelp=Иштетилсе, колдонуучу окуялары маалымат базасына жазылат, бул админ жана аккаунт башкаруу UIларына жеткиликтүү кылат.
+otpSupportedApplications.totpAppFreeOTPName=FreeOTP
+validPostLogoutRedirectURIs=Жарактуу URI үлгүлөрү, браузер ийгиликтүү чыгууда багыттай алат. '+' же бош болсо жарактуу URIлер колдонулат. '-' болсо эч кандай багыттоо уруксат берилбейт. Жөнөкөй шаблондор уруксат кылынат, мисалы 'http://example.com/*'. Салыштырмалуу жолдор да мүмкүн, мисалы /my/relative/path/*. Салыштырмалуу жолдор кардардын тамыр URLине же эгер жок болсо авторизация серверинин тамыр URLине тиешелүү.
+composite=Кошулган
+recommendedSsoTimeout=Бул маанини SSO сессиясынын токтоосунан кыска болуусу сунушталат\: {{time}}
+sessionExplain=Сессиялар бул реалмдеги колдонуучулардын сессиялары жана алар сессия ичинде кирген кардарлар.
+noSearchResults=Издөө жыйынтыгы жок
+eventTypes.AUTHREQID_TO_TOKEN.description=Authreqid токенге айландыруу
+recent=Жакында болгон
+executeActions=Иш-аракеттерди аткаруу
+policyProvider.aggregate=Мурунку саясатарды кайра колдонуп, татаал саясатарды түзүңүз жана уруксаттарыңызды авторизация сурамдарынын иштешинен бөлүп туруңуз.
+advancedAttributeToRole=Атрибуттар топтому бар болсо жана дал келсе, колдонуучуга көрсөтүлгөн реалм же кардар ролун бериңиз.
+userEventsSettings=Колдонуучу окуяларынын жөндөөлөрү
+deny=Тыштоо
+moveGroupSuccess=Топ жылдырылды
+eventTypes.USER_INFO_REQUEST.description=Колдонуучу маалымат суранычы
+userDeletedError=Колдонуучу өчүрүлө алган жок {{error}}
+edit=Түзөтүү
+authorizationScopeDetails=Авторизация скоупунун деталдары
+ldapGroupsDnHelp=LDAP DN, кайда бул дарактагы топтор сакталат. Мисалы 'ou=groups,dc=example,dc=org'.
+readOnly=Окуу үчүн гана
+client-updater-trusted-hosts.tooltip=Ишенимдүү болгон Хосттордун тизмеси. Эгерде кардарды каттоо/жаңыртуу өтүнүчү бул конфигурацияда көрсөтүлгөн хост/доменнен келсе, шарт туура деп бааланат. Хост аттарын же IP даректерди колдонсо болот. Эгер башында жылдызчаны колдонсоңуз (мисалы, '*.example.com'), анда example.com домени толугу менен ишенимдүү болот.
+resultDeny=Натыйжа-Чекитүү
+kc.client.network.host=Кардардын хосту
+noResourceCreateHint=Ресурстар жок. Ошондуктан ресурс негизиндеги уруксаттарды түзө албайсыз.
+directMembership=Түз мүчөлүк
+addExecutionTitle=Ишке киргизүү кошуу
+associatedRolesText=Тийиштүү ролдор
+clientIdHelp=Тууралуу берүүчүдө катталган кардардын идентификатору.
+eventTypes.INVALID_SIGNATURE_ERROR.name=Кол тамга туура эмес катасы
+clientSecretSuccess=Кардардын сыр сөзү кайра түзүлдү
+oAuthDeviceCodeLifespan=OAuth 2.0 түзмөк коду жашоо мөөнөтү
+ldapConnectionAndAuthorizationSettingsDescription=Бул бөлүм LDAP серверине туташуу конфигурациясына байланыштуу параметрлерди камтыйт. Ошондой эле LDAP туташуусунун аутентификациясына байланыштуу параметрлерди камтыйт.
+clientSaveSuccess=Кардар ийгиликтүү жаңыртылды
+ecdsaGenerated=ecdsca-тартипте түзүлгөн
+flow-type.basic-flow=Жалпы
+oAuthDevicePollingInterval=OAuth 2.0 түзмөк сурам интервали
+deletedSuccessRealmSetting=Реалм өчүрүлдү
+webauthnPasswordlessPolicy=Webauthn сыр сөзсүз саясат
+editUserLabel=Колдонуучу этикеткасын түзөтүү баскычы
+conditions=Шарттар
+addUri=URI кошуу
+excludeIssuerFromAuthenticationResponse=Аутентификация жооптон чыгарганды алып салуу
+minus=Минус
+groupsHelp=Колдонуучу мүчө болгон топтор. Топтон чыгуу үчүн крест баскычын басыңыз.
+includeGroupsAndRoles=Топтор менен ролдорду камтуу
+groupsPermissionsHint=Бул роль боюнча ичкерки уруксаттар активдештирилген же жок экенин аныктайт. Өчүрүү учурда орнотулган уруксаттар жок кылынат.
+searchForTranslation=Текст издөө
+offlineSessionMaxHelp=Офлайн сессиянын жарактуулук мөөнөтү, активдүүлүктөн көз карандысыз.
+resourceSaveError=Ресурсту сактоо мүмкүн болбой калды: {{error}}
+updateCredentialUserLabelError=Колдонуучу этикеткасын өзгөртүүдө ката\: {{error}}
+enableHelpMode=Жардам режимин күйгүзүү
+clientPoliciesTab=Кардардын саясаттары
+ldapGroupsDn=LDAP топторунун DN
+ldapFullNameAttributeHelp=Колдонуучунун толук аты сакталган LDAP атрибутунун аты. Көп учурда 'cn'.
+clientRegisterPolicyDeleteConfirm=Кардардын каттоо саясатын толугу менен өчүргүңүз келеби {{name}}?
+jsonEditor=JSON редактору
+mappingCreatedError=Картаны түзүү мүмкүн болбой калды\: '{{error}}'
+deleteClientPolicyProfileConfirmTitle=Профилди өчүрүүбү?
+passwordPoliciesHelp.forceExpiredPasswordChange=Сыр сөз канча күн жарактуу экенин жана жаңы сыр сөз талап кылынарын көрсөтөт.
+envelopeFromHelp=Кайтарылуулар үчүн колдонулган электрондук почта дареги (кала берсе).
+passwordPoliciesHelp.upperCase=Сыр сөздө талап кылынган чоң тамгалардын саны.
+policyDeletedError=Ресурсту өчүрүү мүмкүн болбой калды {{error}}
+key=Түйүн
+email=Электрондук почта
+groupDeleted_other=Топтор өчүрүлдү
+acrToLoAMappingHelp=ACR (Authentication Context Class Reference) кайсы LoA (Аутентификация деңгээли) менен дал келет аны аныктаңыз. ACR каалаган маани болушу мүмкүн, ал эми LoA сандык болушу керек.
+uploadFile=JSON файлын жүктөө
+loginActionTimeoutHelp=Колдонуучу сыр сөздү жаңылоо же TOTP орнотуу сыяктуу кирүү аракеттерин бүтүрүү үчүн берилген максималдуу убакыт. Бул 5 мүнөттөн узун болгону жакшы.
+identityProviders=Идентификация берүүчүлөр
+importUsers=Колдонуучуларды импорттоо
+authenticationFlow=Аутентификация агымы
+leaveGroup_other=Топтон чыгуу?
+deleteClientPolicySuccess=Кардардын саясаты өчүрүлдү
+mapperTypeCertificateLdapMapper=Сертификат LDAP картачы
+clientAuthentications.client_secret_basic=Кардардын сыр сөзү негизги аутентификация катары жөнөтүлдү
+started=Башталды
+filteredByClaimHelp=Чын болсо, идентификация берүүчү тарабынан берилген ID токен белгилүү бир талапты камтышы керек. Болбосо колдонуучу бул брокер аркылуу аутентификация кыла албайт.
+mapperTypeCertificateLdapMapperHelp=LDAP колдонуучудан сертификатты камтыган бир атрибутту Keycloak базасындагы UserModel атрибутуна карта үчүн колдонулат
+permissionDecisionStrategyHelp=Уруксаттар боюнча саясаттар кантип бааланары жана акыркы чечим кантип чыгарылары аныкталат. 'Affirmative' — эң аз бир саясат оң чечим берип, жалпы чечим оң болот. 'Unanimous' — бардык саясаттар оң чечим бериши керек. 'Consensus' — оң жана терс чечимдердин саны салыштырмалуу; эгер тең болсо, терс чечим чыгат.
+userManagedAccessHelp=Иштетилсе, колдонуучулар өз ресурстары менен уруксаттарын Каттоо башкаруу UI аркылуу башкарса болот.
+confirm=Жана
+policyType.totp=Убакытка негизделген
+addAttribute=Кошуу {{label}}
+clientScopeSearch.protocol=Протокол
+initialAccessTokenDetails=Баштапкы жеткиликтүүлүк токенинин маалыматы
+noTranslations=Терме жок
+deleteProvider=Жабдуучуну өчүрүүбү?
+inputTypeSize=Киргизүү өлчөмү
+createAttributeSubTitle=Жаңы атрибут түзүү
+eventTypes.CODE_TO_TOKEN_ERROR.name=Коддон токенге ката
+emptyAuthorizationInstructions=Авторизация аянтчаларын түзгүңүз келсе, төмөнкү баскычты басыңыз
+subjectHelp=Кардардын сертификатындагы Subject DN текшерүү үчүн жөнөкөй регулярдык өрнөк. Бардык өрнөктөргө ылайыкташ үчүн "(.*?)(?\:$)" колдонуңуз.
+updatePolicySuccess=Саясат ийгиликтүү жаңыртылды
+eventTypes.CUSTOM_REQUIRED_ACTION.name=Ыңгайлаштырылган милдеттүү аракет
+updateExecutorError=Аткаруучу жаңыртылган жок: {{error}}
+clientIdHelpHelp=LDAP роль карталарын кайсы кардарга карта коюу керектиги. 'Realm ролдорун колдонуу' өчүк болсо гана колдонулат.
+createdAt=Түзүлгөн убактысы
+moveGroupEmpty=Топтор жок
+rolesHelp=Тандалган колдонуучуга байланыштыруучу ролдорду тандаңыз.
+samlEntityDescriptor=SAML субектинин сүрөттөлүшү
+passwordPolicyHintsEnabled=Сыр сөз саясаты боюнча кеңештер активдештирилди
+enableLdapv3PasswordHelp=LDAPv3 сыр сөздү өзгөртүү кеңейтилген операциясын (RFC-3062) колдонуу. Бул операция үчүн LDAP колдонуучуда сыр сөз болушу керек. 'Sync Registrations' менен колдонулганда, баштапкы сыр сөз менен 'Hardcoded LDAP атрибут картачы' кошуу жакшы.
+syncMode=Синхрондоштуруу режими
+details=Толугураак
+privateRSAKeyHelp=PEM форматында коддолгон жеке RSA ачкычы
+onDragStart= {{item}} үчүн сүйрөө башталды
+pushedAuthorizationRequestRequired=Түлүктүрүлгөн авторизация сурамы талап кылынат
+requirements.REQUIRED=Талап кылынат
+generate=Түзүү
+clientOfflineSessionMaxHelp=Кардардын офлайн сессиясынын жарактуулук мөөнөтү. Эгер офлайн сессиянын максималдуу чеги реалм деңгээлинде активдештирилсе, офлайн токендер сессия бүткөндө жараксыз болот. Бул параметр жалпы колдонуучунун SSO сессиясына таасир этпейт. Эгер орнотулбаса, реалмдин офлайн сессиянын максималдуу убактысы колдонулат.
+resetPasswordBtn=Сыр сөздү калыбына келтирүү
+strictTransportSecurity=HTTP Катуу Транспорт Коопсуздугу (HSTS)
+editInfo=Маалыматты түзөтүү
+offlineSessionMaxLimited=Офлайн сессиянын максималдуу чеги
+providerCreateSuccess=Жаңы кардардын саясаты ийгиликтүү түзүлдү
+disableSigning= "{{key}}" кол тамгалоону өчүрүү
+periodicChangedUsersSync=Колдонуучулардын өзгөрүүлөрүн периоддук синхрондоштуруу
+searchScope=Издөө аянты
+dateFrom=Күндөн баштап
+importAdded_one=Бир жазуу кошулду.
+clientAccessType=Бул саясат кардардын кирүү түрүнө (конфиденциалдуу, ачык, гана токен үчүн) жарактуу экенин аныктайт. Бул шарт көп OpenID Connect сурамдарында текшерилет (Авторизация, токен, интроспекция ж.б.). Конфиденциалдуу кардар аутентификацияны талап кылат, ачык - жок. "Bearer-only" кардар түрү эскирген.
+firstName=Аты
+emptySecondaryAction=Жаңы мапперди конфигурациялоо
+defaultGroupAdded_one=Жаңы группа демейки группаларга кошулду
+unexpectedError=Күтүлбөгөн ката пайда болду\: '{{error}}'
+noRolesInstructions=Бул колдонуучуга эч кандай ролдор дайындалган эмес. Баштоо үчүн роль дайынданыз.
+authorizationEncryptedResponseEncHelp=Авторизация жоопторун шифрлөө үчүн колдонулган JWA алгоритми, жооп режими jwt болгондо. Эгер шифрленген жооп керек болсо, бул параметрди толтуруңуз. Эгер бош калса, жооп кол коюлган, бирок шифрленбеген болот.
+permissionName=Бул уруксаттын аталышы.
+postBrokerLoginFlowAliasHelp=Бул жеке провайдер менен киргенден кийин ишке киргизилген аутентификация агымынын псевдоними. Мисалы, кошумча текшерүү (OTP) үчүн. Эгер кошумча аутентификатор керек эмес болсо, "None" коюңуз.
+preview=Алдын ала көрүү
+eventTypes.UNREGISTER_NODE_ERROR.name=Түйүндү каттоодон чыгаруу ката
+clientRegisterPolicyDeleteConfirmTitle=Клиент каттоосу саясатын жок кылуу?
+groupDetails=Группанын маалыматы
+sessionsType.allSessions=Бардык сессия түрлөрү
+kid=Kid
+sessionsType.serviceAccount=Кызматтык аккаунт
+allowKerberosAuthenticationHelp=SPNEGO/Kerberos токендери менен HTTP аутентификациясын күйгүзүү/өчүрүү. Аутентификацияланган колдонуучулардын маалыматтары LDAP серверинен алынат.
+oauthDeviceAuthorizationGrantHelp=OAuth 2.0 Device Authorization Grant колдоосун иштетет, бул клиент чектелген киргизүү мүмкүнчүлүктөрү бар түзмөктөгү тиркеме экенин билдирет.
+clientSignatureHelp=Клиент өзүнүн SAML суроолоруна жана жоопторуна кол коёт беле? Алар текшерилиши керекпи?
+importOverwritten_other={{count}} жазуу жаңыртылды.
+requirements.CONDITIONAL=Шарттуу
+leaveGroupConfirmDialog_one={{username}} топтон чыгарылгыңыз келеби: {{groupname}}?
+kc.client.user_agent=Клиент/Колдонуучу Агент
+frontendUrl=Frontend URL
+permissionDeletedSuccess=Уруксат ийгиликтүү жок кылынды
+clientScopeRemoveSuccess=Скоуп ийгиликтүү өчүрүлдү
+addClientScopes=Клиент скоупторун кошуу
+doNotStoreUsersHelp=Эгер күйгүзүлгөн болсо, бул брокерден колдонуучулар ички базага сакталбайт.
+deletePolicyConfirm=Бул саясатын өчүрсөңүз, айрым уруксаттар же бириктирилген саясаттар таасир этет.
+userCreateError=Колдонуучу түзүлө алган жок\: {{error}}
+user-events-cleared=Колдонуучу окуялары тазаланды
+resetPasswordConfirm=Паролду кайра коюу?
+emailAsUsernameHelpText=Колдонуучуларга почтаны логин катары колдонууга уруксат берүү.
+AESKeySize=AES ачкычтын өлчөмү
+fullName={{givenName}} {{familyName}}  # (Орундала турган)
+deleteConfirm='{{provider}}' провайдерин түбөлүк жок кылууга ишенесизби?
+compositesRemovedAlertDescription=Бардык байланышкан ролдор өчүрүлдү
+aliasHelp=Провайдердин уникалдуу аталышы, жана redirect URI түзүүдө колдонулат.
+selectRealm=Realm тандаңыз
+roleNameLdapAttribute=LDAP ролдун атрибуту
+javaKeystore=java-keystore
+updatedUserProfileSuccess=Колдонуучу профили сакталды
+deleteProviderMapper=Мапперди жок кылуу?
+clientsPermissionsHint=Бул клиентти башкарууну же ролдорду колдонууга уруксат берүүчү тармактык уруксаттар.
+lookAroundHelp=Токен генератору менен сервердин убакыт же эсеп синхронизациясы туура эмес болсо, канча мейкиндикти карайт?
+usersLeft_one={{count}} колдонуучу топтон чыкты
+sync-keycloak-groups-to-ldap=Keycloak группаларын LDAP менен синхрондоштуруу
+saveError=Колдонуучу федерация провайдери сакталбай калды\: {{error}}
+bruteForceDetection=Кырсык аракеттерди аныктоо
+loginTimeoutHelp=Колдонуучу кирүүнү аяктоо үчүн максималдуу убакыт. 30 мүнөт же андан көп болуусу сунушталат.
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2 түзмөк коду токенге айландыруу
+searchGroups=Группаларды издөө
+trusted-hosts.tooltip=Ишеничтүү коноктордун тизмеси, алар Клиент каттоо кызматын чакыра алышат же Клиент URI үчүн колдонулушу мүмкүн. Жана хост аталышын же IP дарегин колдонсо болот. Эгер башында '*' болсо (мисалы '*.example.com'), анда толук example.com домени ишенимдүү болот.
+disableNonceHelp=Аутентификация сурамында nonce параметрин жибербеңиз. Бул параметр демейки боюнча жиберилип, текшерилет.
+disableTypeClaimCheckHelp=Токендердеги `typ` талабынын текшерүүсүн өчүрүү. Эгер өчүрүлбөсө, текшерүү жүргүзүлөт (демейки).
+deleteClientProfile=Клиент профилин жок кылуу
+none=Жок
+type=Түрү
+createNewUser=Жаңы колдонуучу түзүү
+emptyClientProfiles=Профилдер жок
+internationalization=Көп тилдүүлүк
+seconds=Секунд
+memberofLdapAttributeHelp=Эгер 'User Roles Retrieve Strategy' GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE болсо гана колдонулат. LDAP колдонуучунун атрибутунун аты, анын ичинде колдонуучу мүчө болгон группалар көрсөтүлөт. Адатта 'memberOf'.
+clientRegisterPolicyDeleteSuccess=Клиент каттоо саясаты ийгиликтүү жок кылынды
+otpPolicyDigits=Сандар саны
+keysFilter.ACTIVE=Активдүү ачкычтар
+rsaGenerated=rsa-generated
+krbPrincipalAttributeHelp=Kerberos башчысы үчүн LDAP атрибутунун аты. Бул Keycloakто SPNEGO/Kerberos аутентификациясынан кийин туура LDAP колдонуучуну табуу үчүн колдонулат. Эгер бош болсо, анда ал Kerberos башчысынын биринчи бөлүгүнө жараша LDAP колдонуучуну табат. Мисалы, principal 'john@KEYCLOAK.ORG' болсо, LDAP колдонуучу аты 'john' деп кабыл алынат.
+client-roles-condition.tooltip=Бул шарттын баа берүүсү учурунда текшерилчү клиент ролдору. Эгер клиент белгиленген ролдордун кеминде бирине ээ болсо, шарт туура болот.
+impersonateError=Колдонуучуну туурап ката кетти\: {{error}}
+keyLabel=Ачкыч
+syncChangedUsers=Өзгөртүлгөн колдонуучуларды синхрондоштуруу
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=Идентификация провайдеринин жооп катасы
+orderDialogIntro=Провайдерлердин кирүү же Аккаунт UIдагы тизмектеги тартиби. Сиз катарларды сүйрөп тартибин өзгөртө аласыз.
+clientSessionIdle=Клиент сессиясынын тыныгуу абалы
+push=Жиберүү
+targetClaimHelp=Саясат тартылган максаттуу талапты көрсөтөт.
+periodicFullSyncHelp=LDAP колдонуучуларынын Keycloakка периоддук толук синхронизациясын күйгүзүү же өчүрүү.
+client-attributes-condition.tooltip=Бул шарт баа берүүдө текшерилүүчү клиент атрибуттары. Эгер клиент конфигурацияда көрсөтүлгөн бардык атрибуттарга ээ болсо, шарт туура болот.
+scopePermissions.users.user-impersonated-description=Кимдерди туурап (имперсоналдап) болушу мүмкүн экенин аныктаган саясаттар. Бул саясаттар туурап жаткан колдонуучуга колдонулат.
+forceNameIdFormat=Name ID форматты күч менен колдонуу
+noMappersInstructions=Азыркы учурда бул жеке провайдер үчүн мапперлер жок.
+deleteConfirmFlow=Агымды жок кылуу?
+addRole=Роль кошуу
+FAIL=Импорттоо ийгиликсиз аяктады
+userInfoSignedResponseAlgorithmHelp=Кол коюлган User Info Endpoint жооп үчүн JWA алгоритми. 'unsigned' болсо, жооп кол коюлбайт жана application/json форматында болот.
+lastName=Фамилия
+isAccessTokenJWT=Access Token JWT форматында
+deleteConfirmDialog_one=Тандаган {{count}} колдонуучуну түбөлүк жок кылууга ишенесизби?
+eventTypes.AUTHREQID_TO_TOKEN.name=Authreqid токенге айлантуу
+createError=Идентификация провайдерин түзүү мүмкүн болбоду\: {{error}}
+excludeIssuerFromAuthenticationResponseHelp=Күйгүзүлгөндө, OpenID Connect аутентификация жооптон 'iss' параметри алынбайт. Эски OIDC/OAuth2 адаптерлерин колдонуучулар үчүн пайдалуу.
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=Authreqid токенге айлантуу катасы
+deletePermissionConfirm=Уруксат {{permission}} жок кылууга ишенесизби?
+TERMS_AND_CONDITIONS=Шарттар жана эрежелер (TERMS_AND_CONDITIONS)
+artifactResolutionServiceHelp=Клиент үчүн SAML Artifact чечүү кызматы. Бул Keycloak SOAP ArtifactResolve билдирүүсүн жиберген нукта. Эгер URL жок болсо, бош калтырыңыз.
+userRoleMappingUpdatedSuccess=Колдонуучу роль картасы ийгиликтүү жаңыртылды
+clientUpdaterTrustedHosts=Ишенимдүү коноктор
+deleteSuccess=Атрибуттар тобу өчүрүлдү.
+attributesDropdown=Атрибуттар тизмеси
+ssoServiceUrlHelp=Аутентификация сурамдарын жөнөтүү үчүн колдонулуучу URL (SAML AuthnRequest).
+artifactResolutionServiceUrlHelp=SAML артефакттардан ишеним каты алуу үчүн колдонулуучу URL (SAML ArtifactResolve).
+copy=Көчүрүү
+credentialData=Маалыматтар
+clientRolesConditionTooltip=Бул шарт баа берүүдө текшерилүүчү клиент ролдору. Эгер клиент конфигурацияда көрсөтүлгөн кеминде бир роль болсо, шарт туура болот.
+invalidateSecret=Купуя сөздү жараксыз кылуу
+emptyPermissionInstructions=Эгер уруксат түзгүңүз келсе, төмөнкү баскычты басып ресурс же скоуп негизинде уруксат түзүңүз.
+webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Мурда катталган аутентификаторду кайра каттоодон сактануу.
+memberofLdapAttribute=Member-of LDAP атрибуту
+supportedLocales=Колдоого алынган тилдер
+invalidLocale=Туура эмес тил тандалды
+showPasswordDataValue=Маани
+webAuthnPolicyAttestationConveyancePreference=Attestation берүү артыкчылыгы
+copyOf=Көчүрмөсү {{name}}
+eventTypes.REMOVE_TOTP.description=TOTP өчүрүү
+evictionMinute=Чыгарып салуу мүнөтү
+requiredClient=Ийкемдүү жок болсо, кеминде бир клиентти кошуңуз.
+help=Жардам
+passSubject=Теманы өткөрүү
+deleteFlowSuccess=Агым ийгиликтүү жок кылынды
+nodeReRegistrationTimeoutHelp=Катталган клиенттердин түйүндөрүнүн кайра катталуу үчүн максималдуу убакыт. Бул убакыттан кийин кайра катталбаса, түйүн Keycloakтон өчүрүлөт.
+rename=Аты өзгөртүү
+httpPostBindingLogoutHelp=Суранычтарга HTTP-POST байланышы менен жооп берүү. Эгер жок болсо, HTTP-REDIRECT колдонулат.
+policyProvider.client=Уруксаттар үчүн шарттарды аныктоо, бир же бир нече клиент объектке кирүүгө уруксат алат.
+clientAuthentication=Клиент аутентификациясы
+validatePasswordPolicy=Пароль саясатын текшерүү
+registrationEmailAsUsername=Почта дареги логин катары колдонуу
+webAuthnPolicyFormHelp=WebAuthn аутентификация саясаты. Бул 'WebAuthn каттоо' талап кылынган аракетте жана 'WebAuthn аутентификаторунда' колдонулат. Көбүнчө эки факторлуу аутентификация үчүн колдонулат.
+createResource=Ресурсту түзүү
+data=Маалыматтар
+createNewMapper=Жаңы маппер түзүү
+mapperTypeMsadUserAccountControlManager=msad-user-account-control-mapper
+deleteNodeFail=Түйүндү жок кылуу мүмкүн болбоду\: '{{error}}'
+syncModeOverrideHelp=Бул маппер үчүн IDP синхрондоштуруу режими демейкиден өзгөртүлөт. Мүмкүн болгон маанилер: 'legacy', 'import', 'force', 'inherit'.
+eventTypes.TOKEN_EXCHANGE_ERROR.description=Токен алмашуу ката
+strictTransportSecurityHelp=Strict-Transport-Security HTTP башчысы браузерлерге ар дайым HTTPS колдонууну айтат. Бул башчы көрүлгөндөн кийин браузер сайтка HTTPS аркылуу гана кирет (максималдуу убакыт 1 жыл).
+authenticationExplain=Аутентификация — бул ар кандай түрдөгү маалымдамаларды конфигурациялоо жана башкаруу бөлүгү.
+passwordPoliciesHelp.hashIterations=Пароль сактоо же текшерүү алдында канча жолу хэштелет. Демейки: argon2 үчүн -1; pbkdf2-sha512 үчүн 210,000; pbkdf2-sha256 үчүн 600,000; pbkdf2 үчүн 1,300,000.
+dropNonexistingGroupsDuringSync=Синхрондоштурууда жок топторду түшүрүү
+clientAssertionSigningAlgHelp=Клиент аутентификациясы үчүн JWT арызын түзүүчү кол коюу алгоритми. Эгер кол коюлса, керек. Эгер көрсөтүлбөсө, кол коюу түрүнө жараша RS256 же HS256 колдонулат.
+jwtX509HeadersEnabledHelp=Күйгүзүлгөндө, x5t (X.509 сертификат SHA-1 изи) башчысы JWTге кошулат. Болбосо, kid (Ачкыч ID) башчысы колдонулат.
+addProvider_other={{provider}} провайдерлерин кошуу
+resetAction=Аракетти кайра баштоо
+cibaExpiresIn=Жарактуулук мөөнөтү
+dynamicScopeFormatHelp=Системанын скоуп атын жана өзгөрмө бөлүгүн алуу үчүн колдонулган регулярдык өрнөк.
+updateTranslationError=Терминди жаңыртуу катасы: {{error}}
+resetPasswordConfirmText={{username}} колдонуучунун паролун кайра коюуга ишенесизби?
+create=Түзүү
+noAvailableIdentityProviders=Колдонууга жарамдуу идентификация провайдерлери жок.
+passSubjectHelp=Кирүү учурунда SAML AuthnRequest темасына кошумча login_hint параметрин жиберүү.
+notBeforeSetToNow=Not Before учурдагы убакытка коюлду
+notBefore=Not Before
+setToNow=Азыркы убакытка коюу
+resource=Ресурс
+emptyConditions=Шарттар жок
+profiles=Профилдер
+userSession.modelNote.tooltip=UserSessionModel.note картада сакталган колдонуучу сессиясы тууралуу жазуу.
+filterByRoles=Realm ролдор менен сүзүү
+maxLifespan=Максималдуу жашоо убактысы
+host-sending-registration-request-must-match.label=Каттоо суроосун жиберген хост дал келиши керек
+eventTypes.VERIFY_PROFILE_ERROR.description=Профилди текшерүү катасы
+webOriginsHelp=CORS уруксат берилген баштар. Бардык жарактуу Redirect URI баштарын уруксат берүү үчүн '+' кошуңуз. '*' кошулбайт.
+noSessionsForClient=Бул клиент үчүн активдүү сессиялар жок.
+profilesConfigType=Төмөнкү жолдор менен конфигурациялоо:
+enableHelp=Жардам күйгүзүлгөн
+xRobotsTagHelp=Баракчалар издөө системаларында көрсөтүлбөшү үчүн. <1>Кененирээк</1>
+client-updater-source-roles.label=Рол жаңыртуучу субъект
+clientRegisterPolicyDeleteError=Клиент каттоо саясатын жок кылуу мүмкүн болбоду\: '{{error}}'
+resourceFile=Ресурс файлы
+admin-clearEventsHelp=Маалымат базасынан бардык админ окуяларын жок кылуу.
+hardcodedRole=Провайдерден импорттолгон колдонуучу үчүн катуу коддолгон роль картасы.
+searchType.default=Демейки издөө
+keysFilter.DISABLED=Өчүрүлгөн ачкычтар
+link=Link
+defaultGroupAddedError=Тууралоочу топко топ(тор) кошууда ката чыкты {error}
+eventTypes.INVALID_SIGNATURE_ERROR.description=Кол коюунун жараксыздыгы катасы
+idpUnlinkSuccess=Провайдер байланышы өчүрүлдү
+providerType=Провайдер түрү
+clientSessionIdleHelp=Клиент сессиясынын токтоп турууга уруксат берилген убактысы. Сессия аяктагандан кийин токендер жараксыз болот. Бул опция глобалдуу колдонуучу SSO сессиясына таасир этпейт. Эгер орнотулбаса, стандарттык SSO Idle мааниси колдонулат.
+passwordPoliciesHelp.hashAlgorithm=Паролдорду таза текстте сактабаш үчүн хэш алгоритмин колдонуу.
+scopesSelect=Бул уруксат бир же бир нече скоопко тиешелүү болушу керектигин көрсөтөт.
+selectMethodType.generate=Жаратуу
+emailInvalid=Туура электрондук почта киргизишиңиз керек.
+chooseAPolicyProvider=Саясат провайдерин тандаңыз
+clientAuthenticationHelp=Клиент аутентификация ыкмасы (https\://openid.net/specs/openid-connect-core-1_0.html\#ClientAuthentication шилтемесин караңыз). Жеке ачкыч менен кол коюлган JWT учурда, realm жеке ачкычы колдонулат.
+kerberosRealmHelp=Kerberos realmинин аталышы. Мисалы, FOO.ORG.
+roleCreateError=Роль түзүү мүмкүн болбоду\: {{error}}
+clientSecretHelp=Идентификация провайдери менен катталган клиент сыр сөзү. Бул талаа маанини vaultтан алса болот, ${vault.ID} форматында.
+offlineSessionMax=Максималдуу оффлайн сессия
+generatedUserInfoHelp=User Info Endpoint аркылуу берилүүчү User Info мисалын караңыз.
+dynamicScopeFormat=Динамикалык скооп форматы
+webAuthnPolicyExtraOriginsHelp=Веб эмес колдонмолор үчүн кошумча баштардын тизмеси.
+webAuthnPolicyPasskeysEnabledHelp=Колдонуучу формаларында passkey (шарттуу UI) аутентификациясын күйгүзүү.
+updatePermissionSuccess=Уруксат ийгиликтүү жаңыртылды
+idpLinkSuccess=Идентификация провайдери байланыштырылды
+removeAnnotationText=Аннотацияны алып салуу
+verifyEmailHelpText=Колдонуучудан электрондук почтасын биринчи киргенден кийин же дарек өзгөргөндө тастыктоону талап кылуу.
+referrerPolicy=Жөнөтүүчү саясат
+flow.clients=Клиент аутентификация агымы
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=Идентификация провайдеринин биринчи кирүү ката
+groups=Топтор
+emptyStateText=Бул realmде ролдор жок. Баштоо үчүн realm рол түзүңүз.
+includeSubGroups=Топтун ичиндеги топтордун колдонуучуларын кошуу
+permanentLockoutHelp=Кирүүдө көп ката болгондо колдонуучу убактылуу же туруктуу өчүрүлүшүн жөндөө. Туруктуу блоктоо белгилүү бир ката же убактылуу блоктоо санынан кийин болот.
+logicType.positive=Оң
+associatedPolicy=Тиешелүү саясат
+accountTheme=Аккаунт темасы
+webAuthnPolicyAvoidSameAuthenticatorRegister=Бирдей аутентификаторду каттоодон сактануу
+emptyExecutors=Исполнителдер орнотулган эмес
+notBeforeNowClear=Клиент үчүн Not Before өчүрүлдү
+selectARole=Роль тандаңыз
+titleAuthentication=Аутентификация
+category=Категория
+startBySearchingAUser=Колдонуучуларды издөөнү баштаңыз
+times.days=Күндөр
+selectALocale=Тилди тандаңыз
+transientUser=Убактылуу колдонуучу
+transientUserTooltip=Бул колдонуучу Keycloak маалымат базасында сакталбайт. Ал баштапкы идентификация провайдеринен келген маалыматтардан түзүлгөн.
+error-empty='{{0}}' маанисин көрсөтүңүз.
+error-invalid-blank='{{0}}' мааниси туура эмес.
+error-invalid-date='{{0}}' жараксыз дата.
+error-invalid-email=Электрондук почта дареги туура эмес.
+error-invalid-length-too-long='{{0}}' узундугу {{2}} дан көп болбошу керек.
+error-invalid-length-too-short='{{0}}' узундугу {{1}} дан кем болбошу керек.
+error-invalid-length='{{0}}' узундугу {{1}} менен {{2}} ортосунда болушу керек.
+error-invalid-number='{{0}}' жараксыз сан.
+error-invalid-uri-fragment='{{0}}' жараксыз URL бөлүгү.
+error-invalid-uri-scheme='{{0}}' жараксыз URL схемасы.
+error-invalid-uri='{{0}}' жараксыз URL.
+error-invalid-value='{{0}}' жараксыз мааниси бар.
+error-number-out-of-range-too-big='{{0}}' максималдуу мааниси {{2}} болушу керек.
+error-number-out-of-range-too-small='{{0}}' минималдуу мааниси {{1}} болушу керек.
+error-number-out-of-range='{{0}}' мааниси {{1}} менен {{2}} ортосундагы сан болушу керек.
+error-pattern-no-match='{{0}}' талап кылынган форматка дал келбейт.
+error-person-name-invalid-character='{{0}}' жараксыз символду камтыйт.
+error-user-attribute-required='{{0}}' көрсөтүлүшү керек.
+error-username-invalid-character='{{0}}' жараксыз символду камтыйт.
+error-user-attribute-read-only='{{0}}' талаасы окуу гана.
+missingUsernameMessage='{{0}}': Колдонуучу атын көрсөтүңүз.
+missingFirstNameMessage='{{0}}': Атын көрсөтүңүз.
+invalidEmailMessage='{{0}}': Электрондук почта дареги туура эмес.
+missingLastNameMessage='{{0}}': Фамилиясын көрсөтүңүз.
+missingEmailMessage='{{0}}': Электрондук почтасын көрсөтүңүз.
+missingPasswordMessage='{{0}}': Паролду көрсөтүңүз.
+updateReadOnlyAttributesRejectedMessage=Окуу гана атрибутту жаңыртуу кабыл алынган жок
+locales=Тилдер
+realmOverrides=Realm боюнча өзгөртүүлөр
+realmOverridesHelp=Сиз колдоого алынган тилдерди гана түзөтө аласыз. Эгер колдоого алынган тил тандабасаңыз, англис тилин гана түзөтө аласыз.
+effectiveMessageBundles=Иштеп жаткан билдирүү топтомдору
+effectiveMessageBundlesHelp=Темалар, функциялар, тил жана эркин текст боюнча натыйжалуу билдирүү топтомдорун издөөгө болот.
+deleteMessageBundle=Билдирүү топтомун жок кылуу {{key}}
+deleteAllTranslationsSuccess=Тил котормолору ийгиликтүү өчүрүлдү.
+deleteAllTranslationsError=Тил котормолорун өчүрүүдө ката чыкты, {{error}}
+noRealmOverridesSearchResultsInstructions=Realm боюнча өзгөртүүлөрдү издөө үчүн жогорудагы издөө тилкесин басыңыз
+emptyEffectiveMessageBundles=Иштеп жаткан билдирүүлөрдү издеңиз
+emptyEffectiveMessageBundlesInstructions=Жогорудагы издөө талаасына тема, функция жана тил боюнча керектүү билдирүүлөрдү издей аласыз.
+searchForEffectiveMessageBundles=Билдирүү топтомун издөө
+selectAll=Баарын тандаңыз
+theme=Тема
+themeType=Тема түрү
+language=Тил
+hasWords=Сөздөр бар
+deleteConfirmTranslationTitle=Тил котормолорун жок кылуу?
+translationDeleteConfirmDialog=Тандалган {{count}} котормону түбөлүк өчүргүңүз келеби?
+selectTheme=Теманы тандаңыз
+selectThemeType=Тема түрүн тандаңыз
+selectLanguage=Тилди тандаңыз
+referral=Жөнөтмө (Referral)
+referralHelp=LDAP жөнөтмөлөрдү ээрчүү же жокко чыгаруу. Жөнөтмөлөрдү күйгүзүү аутентификацияны жайлатышы мүмкүн, себеби LDAP сервери кайсы башка LDAP серверлерди колдонуш керектигин чечет. Мындай серверлер ишенимсиз болушу мүмкүн.
+authenticatorRefConfig.value.help=Аутентификатор үчүн өзгөчө шилтеме атын кошуңуз. Бул аутентификатор ийгиликтүү өтсө, Authentication Method Reference (AMR) протокол маппери токендердеги amr талабынын маанисин толтурат. AMR протоколу берилген клиент үчүн жөндөөлөрдө болушу керек.
+authenticatorRefConfig.value.label=Аутентификатор шилтемеси
+authenticatorRefConfig.maxAge.help=SSO сессиясында аутентификатор шилтемесинин максималдуу жарактуулук убактысы (секунддарда). AMR протокол маппери колдонулганда, токендеги AMR талаасы гана белгиленген максималдуу убакыт ичинде аткарылган аутентификатордун аткарылышын чагылдырган учурда жарактуу болот.
+authenticatorRefConfig.maxAge.label=Аутентификатор шилтемесинин максималдуу жашы
+loa-condition-level=Аутентификация деңгээли (LoA)
+loa-condition-level.tooltip=Аутентификация деңгээли. Мурун ар дайым 0 же андан чоң бүтүн сан болушу керек. Аутентификация агымындагы субагымдар төмөн деңгээлден жогору деңгээлге чейинки тартипте болушу керек.
+loa-max-age=Максималдуу жашы
+loa-max-age.tooltip=Бул деңгээлдеги аутентификациянын жарактуулук узактыгы секунддарда. Эгер бул деңгээл талап кылынса жана колдонуучу буга чейин белгиленген убакыттан кыска убакыт мурун ушул деңгээлде аутентификациядан өткөн болсо, кайрадан суралбайт. Бирок эгер белгиленген убакыттан узак убакыт мурун өтсө, кайра аутентификациядан өтүшү керек. 0 деген мааниси - ар дайым кайрадан аутентификация талап кылынат.
+includeInLightweight.label=Lightweight Access Tokenго кошуу
+includeInLightweight.tooltip=Талап lightweight access tokenго кошулушу керекпи?
+lightweightAccessToken=Ар дайым lightweight access token колдонуу
+lightweightAccessTokenHelp=Өчүрүлгөн болсо lightweight токендер колдонулбайт, күйгүзүлгөн болсо дайыма колдонулат. Күйгүзүлбөгөн учурда, клиент саясат аткаруучусу менен күйгүзүүгө болот.
+supportJwtClaimInIntrospectionResponse=Introspection жообунда JWT талабы колдоо
+supportJwtClaimInIntrospectionResponseHelp=Өчүрүлбөгөн болсо, 'Accept: application/jwt' баштуу introspection сурамдары JWT формасында "jwt" талабы менен introspection жыйынтыктары токен катары кайтарылат.
+welcomeTabTitle=Кош келиңиз
+welcomeTo=Кош келиңиз {{realmDisplayInfo}} 
+welcomeText=Keycloak колдонуучу федерациясын, күчтүү аутентификацияны, колдонуучуларды башкарууну, майда уруксаттарды жана башкаларды камсыз кылат. Колдонмолорго аутентификация кошуп, кызматтарды аз күч менен коопсуздоңуз. Колдонуучуларды сактоо же аутентификациялоо менен алек болуунун кереги жок.
+viewDocumentation=Документацияга кайрылуу
+viewGuides=Көрсөтмөлөрдү көрүү
+joinCommunity=Жамаатка кошулуңуз
+readBlog=Блогду окуу
+customValue=Ыңгайлаштырылган мааниси
+termsAndConditionsUserAttribute=Шарттар жана эрежелер кабыл алынган убакыт белгиси
+realmOverridesDescription=Realm боюнча өзгөртүүлөр бүт realm үчүн күчкө кирген котормолорду көрсөтүүгө мүмкүнчүлүк берет. Бул котормолор темадагы котормолордон жогору турат.
+addTranslation=Котормо кошуу
+effectiveMessageBundlesDescription=Иштеп жаткан билдирүү топтому - бул белгилүү тил, тема жана тема түрү үчүн котормолордун топтому. Ошондой эле, ар дайым күчтүү Realm боюнча өзгөртүүлөрдү эске алат.
+clientsClientScopesHelp=Бул ресурска байланышкан скооптор.
+searchItem=Издөө нерсеси
+createItem=Нерсе түзүү
+itemDelete=Нерсени жок кылуу
+itemDeleteConfirm=Нерсени түбөлүк жок кылуу менен макулсузбу?
+itemDeleteConfirmTitle=Нерсени жок кылуу?
+itemDeletedSuccess=Нерсе өчүрүлдү
+itemDeleteError=Нерсени өчүрүү мүмкүн болбоду: {{error}}
+noItems=Нерселер жок
+noItemsInstructions=Бул realmде сиз нерсе түзгөн жоксуз. Баштоо үчүн нерсе түзүңүз.
+itemSaveError=Нерсени сактоо мүмкүн болбоду! {{error}}
+itemSaveSuccessful=Ийгиликтүү сакталды
+realmSelector=Realm тандгыч
+editTranslationValue=Котормо маанисин түзөтүү
+selectAccessTokenSignatureAlgorithm=Access токен кол коюу алгоритмин тандаңыз
+selectIdTokenSignatureAlgorithm=Id токен кол коюу алгоритмин тандаңыз
+selectIdTokenEncryptionKeyManagementAlgorithm=Id токен шифрлөө ачкычын башкаруу алгоритмин тандаңыз
+selectIdTokenEncryptionContentEncryptionAlgorithm=Id токен шифрлөө мазмунун шифрлөө алгоритмин тандаңыз
+selectUserInfoSignedResponseAlgorithm=User info кол коюлган жооп алгоритмин тандаңыз
+selectUserInfoResponseEncryptionKeyManagementAlgorithm=User info жооп шифрлөө ачкычын башкаруу алгоритмин тандаңыз
+selectUserInfoResponseEncryptionContentEncryptionAlgorithm=User info жооп мазмунун шифрлөө алгоритмин тандаңыз
+selectRequestObjectSignatureAlgorithm=Сурам объектисинин кол коюу алгоритмин тандаңыз
+selectRequestObjectEncryption=Сурам объектисин шифрлөө
+selectRequestObjectEncoding=Сурам объектисин коддоо
+selectRequestObjectRequired=Сурам объектинин болушу талап кылынат
+selectAuthorizationSignedResponseAlgorithm=Уруксат берилген кол коюлган жооп алгоритмин тандаңыз
+selectAuthorizationEncryptedResponseAlg=Уруксат берилген шифрленген жооп алгоритмин тандаңыз
+selectAuthorizationEncryptedResponseEnc=Уруксат берилген шифрленген жооп мазмунун шифрлөө алгоритмин тандаңыз
+generatedCodeTextArea=Жаратылган код текст аянты
+selectAuthScopes=Уруксат берүү скоопторун тандаңыз
+selectResource=Ресурсту тандаңыз
+selectClients=Клиенттерди тандаңыз
+selectLoginTheme=Кирүү темасын тандаңыз
+selectAccountTheme=Аккаунт темасын тандаңыз
+selectAdminTheme=Админ темасын тандаңыз
+selectEmailTheme=Электрондук почта темасын тандаңыз
+selectFilterType=Фильтр түрүн тандаңыз
+selectUnmanagedAttributePolicy=Башкарылбаган атрибут саясатын тандаңыз
+selectEventsListeners=Окуя уккучуларын тандаңыз
+selectCachePolicy=Кэш саясатын тандаңыз
+selectEvictionDay=Жеткирилүү күнүн тандаңыз
+selectEvictionHour=Жеткирилүү саатын тандаңыз
+selectEvictionMinute=Жеткирилүү мүнөтүн тандаңыз
+selectEditMode=Түзөтүү режимин тандаңыз
+emptySelection=Тандоо бош
+readOnlySelection=Окуу гана тандоо
+writableSelection=Жазуу мүмкүнчүлүгү бар тандоо
+unsyncedSelection=Синхрондоштурулбаган тандоо
+selectMapperType=Маппер түрүн тандаңыз
+editBtn=Түзөтүү баскычы
+acceptBtn=Түзөтүүнү кабыл алуу баскычы
+cancelBtn=Түзөтүүнү жокко чыгаруу баскычы
+chooseBindingType=Байланыш түрүн тандаңыз
+selectFlowType=Агым түрүн тандаңыз
+selectClientAssertionSigningAlg=Клиент көрсөтмөсү кол коюу алгоритмин тандаңыз
+resourceDetailsTypeHelp=Бул ресурстун түрү. Бул ресурстардын бирдей түрүндөгү инстанциялар тобун түзүү үчүн колдонулушу мүмкүн.
+selectVendor=Сатучуну тандаңыз
+spinnerLoading=Жүктөлүүдө
+enableClientSignatureRequiredModal=Кардар кол тамгасын талап кылууну иштетүү
+selectBindType=Байлоо түрүн тандаңыз
+searchClientAuthorizationResource=Ресурсту издөө
+searchClientAuthorizationPolicy=Саясатты издөө
+searchClientAuthorizationPermission=Ыкчамды издөө
+userNotSaved=Колдонуучу сакталган жок\: {{error}}
+kcNumberFormat=Сан форматы
+kcNumberUnFormat=Санды ажыратуу
+tokenExpirationHelp=Токендердин жарактуулук мөөнөтүн белгилейт. Жарактуулугу өткөн токендер мезгил-мезгили менен маалымат базасынан өчүрүлөт.
+bruteForceMode.Disabled=Өчүрүлгөн
+bruteForceMode.PermanentLockout=Туруктуу бөгөттөө
+bruteForceMode.TemporaryLockout=Убактылуу бөгөттөө
+bruteForceMode.PermanentAfterTemporaryLockout=Убактылуу бөгөттөн кийин туруктуу бөгөттөө
+bruteForceMode=Күчтүү чабуул режими
+error-invalid-multivalued-size=Атрибут {{0}} үчүн жок дегенде {{1}} жана көп дегенде {{2}} маани болушу керек.
+multivalued=Көп маани
+multivaluedHelp=Бул атрибут бир нече маанига ээ болушу мүмкүн. Бул параметр индикатор болуп саналат жана эч кандай текшерүүнү иштетпейт.
+to the attribute. For that, make sure to use any of the built-in validators to properly validate the size and the values.
+sendIdTokenOnLogout=Чыгуу сурамдарында 'id_token_hint' жөнөтүү
+sendIdTokenOnLogoutHelp='id_token_hint' параметрин чыгуу сурамдарында жөнөтүү керекпи.
+sendClientIdOnLogout=Чыгуу сурамдарында 'client_id' жөнөтүү
+sendClientIdOnLogoutHelp='client_id' параметрин чыгуу сурамдарында жөнөтүү керекпи.
+addAttributeTranslationBtn=Терминди которуу баскычы
+addAttributeTranslationInfo="{{fieldName}}" талаасынын жанындагы иконка аркылуу ушул талаага котормолорду кошуңуз.
+addAttributeTranslation="{{fieldName}}" талаасына котормо кошуу
+addAttributeDisplayDescriptionTranslation=Көрсөтмө текстине котормо кошуу
+addTranslationsModalTitle=Котормолорду кошуу
+addTranslationsModalSubTitle="{{fieldName}}" тил же преференциялык тилдер боюнча которсоңуз болот. Ошондой эле, <1>Realm settings > Localization > Realm overrides</1> бөлүмүндө түзөтө же түзсөңүз болот.
+translationKey=Тил ачкычы
+translationsTableHeading=Котормолор
+searchForLanguage=Тилди издөө
+supportedLanguagesTableColumnName=Колдоого алынган тилдер
+translationTableColumnName=Котормо
+defaultLanguage=Негизги
+translationValue=Котормо мааниси
+noLanguages=Тил жок
+noLanguagesInstructions=Баштоо үчүн Realm settings > Localization > Locales бөлүмүнө тил кошуңуз.
+addTranslationsDialogRowsTable=Котормолорду кошуу терезесиндеги катарлар таблицасы
+addTranslationDialogHelperText=Негизги тил боюнча котормо талап кылынат.
+noLanguagesSearchResultsInstructions=Жогорудагы издөө тилкесине тилин жазыңыз
+addTranslationDialogOkBtn=Ок
+translationError=Сактоодон мурун котормолорду кошуңуз: {{error}}
+fetchRoles=Ролдорду алуу
+fetchRolesHelp=Адаты боюнча, авторизациялык сурамдарда жөнөтүлгөн токендеги ролдор гана колдонуучунун ролу катары каралат. Эгер бул параметр иштетилсе, саясат токендеги ролдорду эске албай, колдонуучуга байланыштуу бардык ролдорду текшерет.
+emptyAdminEvents=Админ окуялары жок
+emptyAdminEventsInstructions=Бул realmде админ окуялары жок.
+emptyUserEvents=Колдонуучу окуялары жок
+emptyUserEventsInstructions=Бул realmде колдонуучу окуялары жок.
+smtpFromPlaceholder=Жөнөтүүчү электрондук почта дареги
+smtpFromDisplayPlaceholder=Жөнөтүүчү почта дареги үчүн көрсөтүүчү ат
+replyToEmailPlaceholder=Жооп берүүчү электрондук почта дареги
+replyToDisplayPlaceholder="жооп берүүчү" электрондук почта дареги үчүн көрсөтүүчү ат
+senderEnvelopePlaceholder=Жөнөтүүчү конверт электрондук почта дареги
+smtpPortPlaceholder=SMTP порту (адатта 25)
+loginUsernamePlaceholder=Кирүүчү колдонуучу аты
+ownerHelp=Бул ресурс үчүн ээси.
+parRequestUriLifespan=Жөнөтүлгөн уруксат сурамынын URI жашоо мөөнөтү
+parRequestUriLifespanHelp=URI жашоо мөөнөтүн билдирген сан. Адаты боюнча 1 мүнөт.
+identityBrokeringLink=Идентификация аркылуу брокердик шилтеме
+searchClientRegistration=Саясатты издөө
+importFileHelp=Түйүндү импорттоо үчүн файл
+logo=Логотип
+avatarImage=Аватар сүрөтү
+eventTypes.INVITE_ORG.name=Уюмга колдонуучуну чакыруу
+eventTypes.INVITE_ORG.description=Уюмга колдонуучуну чакыруу
+eventTypes.INVITE_ORG_ERROR.name=Уюмга чакыруу катасы
+eventTypes.INVITE_ORG_ERROR.description=Уюмга чакыруу учурунда каталар
+organizationsEnabled=Уюмдар
+organizationsEnabledHelp=Иштетилсе, уюмдарды башкарууга мүмкүнчүлүк берет. Болбосо, мурдагы уюмдар сакталып калат, бирок аларды башкарууга же мүчөлөрүн аутентификациялоого мүмкүнчүлүк болбойт.
+adminPermissionsEnabled=Админ уруктары
+adminPermissionsEnabledHelp=Иштетилсе, realmде админ уруктарын башкарууга мүмкүнчүлүк берет.
+verifiableCredentialsEnabled=Тастыкталган күбөлүктөр
+verifiableCredentialsEnabledHelp=Иштетилсе, бул realmде тастыкталган күбөлүктөрдү башкарууга мүмкүнчүлүк берет.
+organizations=Уюмдар
+organizationDetails=Уюмдун маалыматы
+organizationsList=Уюмдардын тизмеси
+caseSensitiveOriginalUsername=Баш тамгаларына сезгич колдонуучу аты
+caseSensitiveOriginalUsernameHelp=Иштетилсе, идентификация провайдеринен келген колдонуучу аты өзгөрүүсүз сакталат. Болбосо, колдонуучу аты кичинекей тамгаларга өзгөртүлөт жана баш тамгаларга сезгич болгондо оригинал менен дал келбеши мүмкүн. Бул жөндөөнүн таасири федерацияланган идентификациядагы колдонуучу атына гана тиешелүү, сервердеги колдонуучу аттары ар дайым кичинекей тамгаларда сакталат.
+organizationsExplain=Уюмдарыңызды жана мүчөлөрүңүздү башкаруу.
+emptyOrganizations=Уюмдар жок
+emptyOrganizationsInstructions=Азырынча уюм жок. Уюм түзүп, аны башкарууңузду суранабыз.
+searchOrganization=Уюмду издөө
+domains=Домендер
+organizationDelete=Уюмду өчүрүүбү?
+organizationDeleteConfirm=Бул уюмду туруктуу өчүргүңүз келгенине ынанасызбы? Эгер макул болсоңуз, уюмдун бардык маалыматы өчүрүлөт.
+organizationDeletedSuccess=Уюм ийгиликтүү өчүрүлдү
+orgainzatinoDeleteError=Клиентти өчүрүү мүмкүн болбой калды\: {{error}}
+createOrganization=Уюм түзүү
+domain=Домен
+organizationDomainHelp=Уюмга тиешелүү бир же бир нече интернет домендеринин жыйындысы. Домен колдонуучуларды алардын электрондук почта домендери боюнча уюмга автоматтык түрдө таанууга жана аутентификациялоого колдонулат.
+addDomain=Домен кошуу
+organizationAliasHelp=Уюмду ички колдонуу үчүн уникалдуу аныктоочу алиас. Мисалы, уюмга тиешелүү талаптарды токендерге кошуу же атайын тема колдонууда.
+organizationRedirectUrlHelp=Каттоо же чакыруу кабыл алынгандан кийин колдонуучуну автоматтык түрдө башка баракчага багыттоо. Эгер бош калса, колдонуучу демейки боюнча аккаунт консолуна багытталат.
+redirectUrl=Багыттоо URL
+disableConfirmOrganizationTitle=Уюмду өчүрүүбү?
+disableConfirmOrganization=Бул уюмду өчүргүңүз келгенине ынанасызбы?
+memberList=Мүчөлөрдүн тизмеси
+searchMember=Мүчөнү издөө
+addRealmUser=Realm колдонуучусун кошуу
+inviteMember=Мүчөнү чакыруу
+removeMember=Мүчөнү чыгаруу
+organizationSaveSuccess=Уюм ийгиликтүү сакталды.
+organizationSaveError=Уюмду сактоо мүмкүн болбой калды\: {{error}}
+emptyMembers=Мүчөлөр жок
+emptyMembersInstructions=Азырынча мүчөлөр жок. Бул уюмга мүчөлөрдү кошуңуз.
+organizationUsersAdded_one={{count}} колдонуучу уюмга кошулду
+organizationUsersAddedError=Колдонуучуларды уюмга кошуу мүмкүн болбой калды\: {{error}}
+organizationUsersAdded_other={{count}} колдонуучулар уюмга кошулду
+organizationUsersLeftError=Колдонуучуларды уюмдан чыгаруу мүмкүн болбой калды\: {{error}}
+organizationUsersLeft_one=Колдонуучу уюмдан чыкты
+organizationUsersLeft_other={{count}} колдонуучу уюмдан чыкты
+inviteSent=Чакыруу жөнөтүлдү.
+inviteSentError=Чакыруу жөнөтүү мүмкүн болбой калды\: {{error}}
+noIdentityProvider=Бул realmде идентификация провайдерлери жок
+noIdentityProviderInstructions=Бул realmде азырынча идентификация провайдерлери жок. Эгер бул уюм менен идентификация провайдерин байланыштыруу керек болсо, сол жактагы менюдан "Identity providers" бөлүмүнө өтүп, провайдер түзүңүз.
+linkIdentityProvider=Идентификация провайдерин байланыштыруу
+unLinkIdentityProvider=Провайдердин байланышын үзүү
+emptyIdentityProviderLink=Бул уюмда идентификация провайдери жок
+emptyIdentityProviderLinkInstructions=Бул уюмда азырынча идентификация провайдери жок. Уюмга провайдерди байланыштырыңыз.
+searchProvider=Провайдерди издөө
+selectIdentityProvider=Идентификация провайдерин тандаңыз
+shownOnLoginPage=Кирүү бетинде көрсөтүү
+shownOnLoginPageHelp=Белгиленсе, бул идентификация провайдери кирүү бетинде көрсөтүлөт.
+linkSuccessful=Идентификация провайдери уюмга ийгиликтүү байланыштырылды
+linkError=Идентификация провайдерин уюмга байланыштырууда ката\: {{error}}
+unLinkSuccessful=Идентификация провайдеринин байланышы үзүлдү
+unlinkError=Идентификация провайдеринин байланышын үзүү мүмкүн болбой калды\: {{error}}
+linkUpdatedSuccessful=Идентификация провайдеринин байланышы ийгиликтүү жаңыланды
+linkUpdateError=Идентификация провайдеринин байланышын жаңылоо мүмкүн болбой калды\: {{error}}
+noResultsFound=Натыйжалар табылган жок
+linkedOrganization=Байланышкан уюм
+organization=Уюм
+send=Жөнөтүү
+redirectWhenEmailMatches=Электрондук почта домени дал келгенде багыттоо
+redirectWhenEmailMatchesHelp=Электрондук почта домени дал келгенде колдонуучуну автоматтык түрдө ушул идентификация провайдерине багыттоо
+emailVerificationHelp=Электрондук почтаны текшерүү үчүн өз алдынча убакыт чеги
+idpAccountEmailVerificationHelp=Идентификация провайдери аккаунтун текшерүү үчүн өз алдынча убакыт чеги
+forgotPasswordHelp=Паролду унуткан учурда өз алдынча убакыт чеги
+executeActionsHelp=Иш-аракеттерди аткаруу үчүн өз алдынча убакыт чеги
+validatingX509CertsHelp=Keycloak сырттан келген SAML сурамдарынын жана жоопторунун кол тамгаларын текшерүү үчүн колдонулган коомдук сертификаттар. "Use metadata descriptor URL" өчүрүлгөн учурда колдонулат. Бир нече сертификатты үтүк менен бөлүп киргизсе болот. Сертификаттарды кайра импорттоо үчүн идентификация провайдеринин барагында "Import Keys" аракетин колдонуңуз. Бул учурда метадайынкыдагы сертификаттар кайра жүктөлүп, ушул параметрге кошулат. Өзгөртүүлөрдү сактоо үчүн "Save" баскычын басыңыз.
+emptyUserOrganizations=Уюмдар жок
+emptyUserOrganizationsInstructions=Азырынча уюм жок. Уюмга кошулуңуз же чакыруу жөнөтүңүз.
+joinOrganization=Уюмга кошулуу
+sendInvite=Чакыруу жөнөтүү
+sendInvitation=Чакыруу жөнөтүү
+removeConfirmOrganizationTitle=Уюмду чыгаруубузбу?
+organizationRemoveConfirm_one=Тандалган уюмдан колдонуучуну чыгарууга ынанасызбы?
+organizationRemoveConfirm_other=Тандалган {{count}} уюмдан колдонуучуну чыгарууга ынанасызбы?
+organizationRemovedSuccess=Колдонуучу уюмдардан чыгарылды
+organizationRemoveError=Колдонуучуну уюмдардан чыгаруу мүмкүн болбой калды\: {{error}}
+organizationName=Уюмдун аты
+userAddedOrganization_one=Колдонуучуга уюм кошулду
+userAddedOrganizationError=Колдонуучуга уюмдарды кошуу мүмкүн болбой калды\: {{error}}
+userAddedOrganization_other={{count}} уюм колдонуучуга кошулду
+userInvitedOrganization_one=Колдонуучуга чакыруу жөнөтүлдү
+userInvitedOrganizationError=Колдонуучуну уюмдарга чакыруу мүмкүн болбой калды\: {{error}}
+userInvitedOrganization_other={{count}} чакыруу колдонуучуларга жөнөтүлдү
+sentInvitation=Чакыруу жөнөтүлдү
+loggedInAsTempAdminUser=Сиз убактылуу админ катары кирдиңиз. Коопсуздукту күчөтүү үчүн туруктуу админ аккаунтун түзүп, убактылуу аккаунтту өчүрүңүз.
+temporaryAdmin=Убактылуу админ колдонуучу аккаунту. Мүмкүн болушунча тез арада туруктуу админ аккаунту менен алмаштырыңыз.
+temporaryService=Убактылуу админ кызмат аккаунту. Мүмкүн болушунча тез арада туруктуу админ кызмат аккаунту менен алмаштырыңыз.
+addOrganizationAttributes.label=Уюм атрибуттарын кошуу
+addOrganizationAttributes.help=Иштетилсе, уюм атрибуттары токен менен байланыштырылган ар бир уюм үчүн жеткиликтүү болот.
+addOrganizationId.label=Уюм идентификаторун кошуу
+addOrganizationId.help=Иштетилсе, уюм идентификатору токен менен байланыштырылган ар бир уюм үчүн жеткиликтүү болот.
+identityProviderUnlink=Идентификация провайдеринин байланышын үзүүбү?
+identityProviderUnlinkConfirm=Бул идентификация провайдеринин байланышын үзгүңүз келгенине ынанасызбы?
+disableConfirmUserTitle=Колдонуучуну өчүрүүбү?
+disableConfirmUser=Бул колдонуучуну өчүргүңүз келгенине ынанасызбы?
+eventTypes.UPDATE_CREDENTIAL.name=Кубаттуулукту жаңылоо
+eventTypes.UPDATE_CREDENTIAL.description=Кубаттуулукту жаңылоо
+eventTypes.UPDATE_CREDENTIAL_ERROR.name=Кубаттуулукту жаңылоо катасы
+eventTypes.UPDATE_CREDENTIAL_ERROR.description=Кубаттуулукту жаңылоо катасы
+eventTypes.REMOVE_CREDENTIAL.name=Кубаттуулукту алып салуу
+eventTypes.REMOVE_CREDENTIAL.description=Кубаттуулукту алып салуу
+eventTypes.REMOVE_CREDENTIAL_ERROR.name=Кубаттуулукту алып салуу катасы
+eventTypes.REMOVE_CREDENTIAL_ERROR.description=Кубаттуулукту алып салуу катасы
+groupDuplicated=Топ кайталанды
+duplicateAGroup=Топту кайталоо
+couldNotFetchClientRoleMappings=Клиенттин роль карталарын алуу мүмкүн болбой калды\: {{error}}
+duplicateGroupWarning=Көп сандагы субтоптору бар топторду кайталоо колдоого алынбайт. Кайталанып жаткан топтун көп санда субтоптору жок экенине ынаныңыз.
+darkModeEnabled=Караңгы режим
+darkModeEnabledHelp=Иштетилсе, тема колдонуучунун ОС орнотууларындагы (жарык же караңгы режим) же браузер орнотууларындагы тандап алынган ыкмага жараша караңгы вариантта көрсөтүлөт. Өчүрүлгөндө, гана жарык вариант колдонулат. Бул жөндөө караңгы жана жарык варианттарды колдогон темаларга гана тиешелүү. Эгер тема мындай мүмкүнчүлүккө ээ болбосо, бул жөндөөнүн эч кандай таасири жок.
+showMemberships=Мүчөлүктөрдү көрсөтүү
+showMembershipsTitle={{username}} Топ мүчөлүктөрү
+noGroupMembershipsText=Бул колдонуучу эч кандай топтун мүчөсү эмес.
+noGroupMemberships=Мүчөлүк жок
+termsAndConditionsDeclined=Улантуу үчүн Колдонуучунун макулдугун кабыл алыңыз
+somethingWentWrong=Ката кетти
+somethingWentWrongDescription=Кечиресиз, күтүүсүз ката болду.
+tryAgain=Кайра аракет кылыңыз
+errorSavingTranslations=Котормолорду сактоо ката\: '{{error}}'
+clearCachesTitle=Кэштерди тазалоо
+realmCache=Realm кэши
+userCache=Колдонуучу кэши
+keysCache=Ачкычтар кэши
+crlCache=CRL кэши
+clearButtonTitle=Тазалоо
+clearRealmCacheHelp=Бул бардык realmдер үчүн жазууларды тазалайт.
+clearUserCacheHelp=Бул бардык realmдер үчүн жазууларды тазалайт.
+clearKeysCacheHelp=Тышкы коомдук ачкычтардын кэшиндеги бардык жазууларды тазалайт. Бул тышкы кардарлар же идентификация провайдерлеринин ачкычтары. Бул бардык realmдер үчүн жазууларды тазалайт.
+clearCrlCacheHelp=CRL кэшиндеги бардык жазууларды тазалайт. CRL кэши X.509 аутентификаторунун иштөөсүн жакшыртат. Бул аракет бардык realmдер үчүн CRL жазууларын тазалайт.
+clearCacheSuccess=Кэш ийгиликтүү тазаланды
+clearCacheError=Кэшти тазалоо мүмкүн болбой калды\: {{error}}
+expandRow=Катардын деталдарын көрсөтүү
+membershipType=Мүчөлүк түрү
+managedMembership=Башкарылган мүчөлүк
+filterByMembershipType=Мүчөлүк түрү боюнча фильтр
+organizationsMembersListError=Уюм мүчөлөрүн алуу мүмкүн болбой калды\: {{error}}
+MANAGED=Башкарылган
+UNMANAGED=Башкарылбаган
+deleteConfirmUsers_one=Колдонуучу {{name}} өчүрүлсүнбү?
+deleteConfirmUsers_other={{count}} колдонуучу өчүрүлсүнбү?
+downloadThemeJar=Тема JAR файлын жүктөп алуу
+uploadGeneratedThemeJar=Жасалган тема JAR файлын жүктөө
+themeColorInfo=Бул жерде сиз patternfly түс өзгөрмөлөрүн орнотуп, "theme jar" файлын түзө аласыз. Бул файлды жүктөп алып, providers папкаңызга коюп, теманы realmге колдонсоңуз болот.
+permissionsSubTitle=Рұқсаттар бир түрдөгү ресурс же ресурстарга кирүүгө көзөмөл кылат.
+signatureAlgorithmIdentityProviderMetadata=Кол тамга алгоритми SAML IdP метадайынкысы
+signatureAlgorithmIdentityProviderMetadataHelp=Эгер кол тамга алгоритми белгиленбесе, метадайынкы кол тамгаланбайт.
+connectionTrace=Байланыш трассасы
+connectionTraceHelp=Иштетилсе, кирүүчү жана чыгуучу LDAP ASN.1 BER пакеттеринин баары ката чыгаруу агымына чыгарылат. Продакшнда бул мүмкүнчүлүктү колдонууда сак болуңуз, себеби бардык LDAP серверге жана серверден жөнөтүлгөн маалыматтар көрүнүп калат.
+savingUserEventsOff=Колдонуучу окуяларын сактоо өчүрүлгөн
+savingAdminEventsOff=Админ окуяларын сактоо өчүрүлгөн
+membershipEvents=Мүчөлүк окуялары
+childGroupEvents=Балалык топ окуялары
+titlePermissions=Рұқсаттар
+emptyPermissionsInstructions=Бул realmде рұқсаттар жок.
+permissionsName=Рұқсаттын аты
+permissionsAssignedPolicy=Тапшырылган саясат
+chooseAResourceType=Ресурс түрүн тандаңыз
+chooseAResourceTypeInstructions=Рұқсат түзүү үчүн ресурс түрүн тандаңыз.
+resourceType.Clients=Бул realmдеги кардарлар үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+resourceType.Groups=Бул realmдеги топтор үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+resourceType.IdentityProviders=Бул realmдеги идентификация провайдерлер үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+resourceType.Organizations=Бул realmдеги уюмдар үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+resourceType.Roles=Бул realmдеги ролдор үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+resourceType.Users=Бул realmдеги колдонуучулар үчүн жүргүзүлө турган операцияларга кирүү көзөмөлү
+createPermissionOfType=Бул рұқсат {{resourceType}} түрүнө колдонулат
+permissionUsersHelpText=Бул рұқсатка уруксат берилген колдонуучуларды көрсөтөт.
+permissionNameHelpText=Рұқсаттын аты. Админ консолунда бул ат менен таанылат.
+resourceScope=Ресурстун көлөмү
+resourceScopeHelpText=Ресурстун көлөмүн аныктайт. Бул рұқсат берилген ресурс түрүн аныктоо үчүн колдонулат.
+allClients=Бардык кардарлар
+specificClients=Белгилүү кардарлар
+allResourceType=Бардык {{resourceType}}
+specificResourceType=Белгилүү {{resourceType}}
+assignedPolicies=Тапшырылган саясаттар
+assignExistingPolicies=Бар саясаттарды тапшыруу
+requiredPolicies=Азырынча бир саясат кошуңуз.
+createNewPolicy=Жаңы саясат түзүү
+policy=Саясат
+policyType=Саясаттын түрү
+policyTypeHelpText=Бул рұқсат берилген саясаттын түрүн аныктайт.
+emptyAssignExistingPolicies=Саясаттар жок
+emptyAssignExistingPoliciesInstructions=Тапшырууга саясаттар жок
+authorizationScope=Авторизация көлөмү
+adminPermissionName=Рұқсаттын аты
+noAssignedPolicies=Тапшырылган саясаттар жок
+noAssignedPoliciesInstructions=Бул рұқсатка саясаттар тапшырылган эмес
+unAssignPolicy=Тапшыруудан алып салуу
+assignedPolicyType.allTypes=Бардык түрлөрү
+assignedPolicyType.user=Колдонуучу
+authorizationScopeDetailsTitle=Авторизация көлөмүнүн деталдары
+authorizationScopeDetailsSubtitle=Авторизация көлөмү ресурска жасала турган аракеттерди аныктайт.
+authorizationScopeDetailsName=Аты
+authorizationScopeDetailsDescription=Сүрөттөмө
+allResources=Бардык ресурстар
+currentRealm=Азыркы realm
+recentlyUsed=Жакында колдонулган
+viewAll=Бардыгын көрүү
+currentRealmExplain=Бул realm тандалган
+removeInvalidUsers=Издөөдө жараксыз колдонуучуларды өчүрүү
+removeInvalidUsersHelp=Колдонуучунун сактоочу базасында колдонуучу табылбаса, аларды өчүрөт. Эгер туура болсо, колдонуучуну издөөдө аларга байланыштуу колдонуучу сактоочу база менен шайкеш эмес болсо өчүрүлөт. Жок болсо, колдонуучу сактоочу базада окуу гана режиминде жана өчүрүлгөн бойдон калат. Мисалы, колдонуучу түздөн-түз LDAPтан өчүрүлгөн же `Users DN` жараксыз. Бул процесс колдонуучу кэштелбеген учурда гана иштейт.
+createPermissionPolicy=Саясат түзүү
+enforceAccessTo=Кирүүнү жүзөгө ашыруу
+enforceAccessToHelpText=Бул рұқсат кайсы ресурс үчүн колдонуларын көрсөтөт.
+emptyPermissionPoliciesInstructions=Бул realmде саясаттар жок.
+noPermissionSearchResultsInstructions=Сиздин фильтрлерге ылайыктуу рұқсаттар табылган жок.
+deleteAdminPermissionConfirm=Эгер сиз {{ permission }} рұқсаттын өчүрсөңүз, админдер ошол рұқсат менен аныкталган ресурстарга аракет кыла алышпайт.
+authorizationScope.Clients.configure=Кардарды негизги башкарууну жүзөгө ашырат
+authorizationScope.Clients.manage=Кардарды толук башкаруу
+authorizationScope.Clients.map-roles=Бул кардар аныктаган ролдорду колдонуучулар жана топтор сыяктуу ресурстарга таап берет
+authorizationScope.Clients.map-roles-client-scope=Бул кардар аныктаган ролдорду башка кардардын кардар көлөмүнө колдонуу
+authorizationScope.Clients.map-roles-composite=Бул кардар аныктаган ролдорду башка роль катары колдонуу
+authorizationScope.Clients.token-exchange=Бул кардарга багытталган токен үчүн кайсы кардарлар токен алмаштыра аларын көзөмөлдөйт
+authorizationScope.Clients.view=Бул кардарды көрүү
+authorizationScope.Users.impersonate=Башка колдонуучулар катары аракет кылуу
+authorizationScope.Users.manage=Realmдеги бардык колдонуучуларды башкаруу
+authorizationScope.Users.manage-group-membership=Бардык колдонуучулардын топ мүчөлүктөрүн башкаруу (топ саясаты менен колдонулат)
+authorizationScope.Users.map-roles=Бардык колдонуучулар үчүн ролдорду таап берүү
+authorizationScope.Users.view=Realmдеги бардык колдонуучуларды көрүү
+authorizationScope.Groups.manage=Бул топту башкаруу
+authorizationScope.Groups.manage-members=Топ мүчөлөрүн башкаруу
+authorizationScope.Groups.manage-membership=Топко мүчөлөрдү кошуу же чыгаруу
+authorizationScope.Groups.view=Бул топту көрүү
+authorizationScope.Groups.view-members=Топ мүчөлөрүн көрүү
+authorizationScope.IdentityProviders.token-exchange=Кардарларга ушул идентификация провайдери чыгарган токендер үчүн токен алмашууга уруксат берет
+authorizationScope.Roles.map-role-client-scope=Бул ролду кардардын кардар көлөмүнө колдонуу
+authorizationScope.Roles.map-role-composite=Бул ролду башка роль катары колдонуу
+authorizationScope.Roles.map-role=Бул ролду колдонуучу же топко таап берүү
+usersResources=Колдонуучулар
+clientsResources=Кардарлар
+groupsResources=Топтор
+resourceTypeHelpText=Бул рұқсатка кайсы {{resourceType}} уруксат берилгенин көрсөтөт. Эгер бош калса, бардык тандагандай болот.
+evaluation=Баалоо
+addSubFlowTo={{name}} аталышына суб-ағын кошуу
+addExecutionTo={{name}} аталышына аткарууну кошуу
+addConditionTo={{name}} аталышына шарт кошуу
+targetAudience=Максаттуу аудитория
+targetAudienceHelp=Максаттуу аудиторияны конфигурациялоо. Бул токен алмашуу укугу суралган учурдагы 'audience' параметри сыяктуу болот. Учурда 'audience' параметри болгону токен-алмашуу укугу үчүн жеткиликтүү. Башка укууларды же 'audience' параметрисиз токен-алмашууну симуляциялоо үчүн, бул параметрди бош калтырууну сунуштайбыз.
+targetAudiencePlaceHolder=Токен алмашуу үчүн максаттуу аудиторияны тандаңыз
+permissionsEvaluationInstructions=Колдонуучуну тандап, анын белгилүү ресурска уруксатын текшериңиз. Төмөндөгү Баалоо баскычын чыкылдаткандан кийин жыйынтык оң жактагы панелде көрсөтүлөт.
+permissionEvaluationPreview=Рұқсат баалоонун алдын ала көрүү
+noPermissionsEvaluationResults=Баалоо жок
+noPermissionsEvaluationResultsInstructions=Рұқсат баалоону сол жактан орнотуңуз
+authScope=Авторизация көлөмү
+authScopeSelectHelp=Серверден рұқсаттарды суроо үчүн авторизация көлөмүн тандаңыз.
+resourceTypeSelectHelp=Серверден рұқсаттарды суроо үчүн ресурс түрүн тандаңыз.
+grantedScope=Берилген көлөм:
+deniedScope=Тыйылган көлөм:
+evaluatedPolicy={{name}} {{status}} деген добуш берди
+permissionEvaluationAlertTitle=Тандалган колдонуучунун тандалган ресурска кирүүсү жок
+deleteConfirmRealm_one=Realm {{name}} өчүрүлсүнбү?
+deleteConfirmRealm_other={{count}} realm өчүрүлсүнбү?
+recentRealms=Жакында колдонулган realmдер
+manageRealms=Realmдерди башкаруу
+cantDeleteMasterRealm=Сиз мастер realmди өчүрө албайсыз!
+selectRole=Роль тандаңыз
+selectUsers=Колдонуучуну тандаңыз
+selectClient=Кардарды тандаңыз
+forbiddenAdminConsole=Сизде уруксат жок. Администратор менен байланышыңыз.
+grantedPermissions=Берилген уруксаттар
+deniedPermissions=Тыйылган уруксаттар
+authenticationType=Аутентификация түрү
+authenticationTypeBasicAuth=Сырсөз
+authenticationTypeTokenAuth=Токен
+authTokenUrl=Аутентификация токен URL
+tokenTokenUrlHelp=Токен алуу үчүн чекит: keycloak мисалы: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+authTokenScope=Аутентификация токен көлөмү
+authTokenScopeHelp=Токен алуу учурунда колдонулуучу, боштук менен бөлүнгөн көлөмдөр, мисалы 'basic sendmail'
+authTokenClientId=Аутентификация токен кардар ID
+authTokenClientIdHelp=Токен алуу учурунда колдонулуучу client_id, мисалы mykeycloak-sendmail-client
+authTokenClientSecret=Аутентификация токен кардар сырсөзү
+enableDebugSMTP=SMTP отладкасын күйгүзүү
+signatureMaxExp=Максималдуу мөөнөтү
+signatureMaxExpHelp=JWT үчүн уруксат берилген максималдуу мөөнөт. Токендер аутентификациядан мурун түзүлүшү керек. Мөөнөтү өтсө, токен жараксыз болот. Эгер аныкталбаса, демейки маани 60 секунд.
+fileNameDialogTitle=Файлды сактоо катары
+fileName=Файл аты
+syncUsersStarted=Колдонуучулар синхрондолуу башталды.
+userProfileClaims=Колдонуучу профилинин талаптары
+userIDClaim=ID талабы
+userIDClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги уникалдуу идентификаторду көрсөтүүчү талаптын аты. Эгер берилбесе, `sub` мааниси колдонулат.
+userNameClaim=Колдонуучу аты талабы
+userNameClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги колдонуучу атын көрсөтүүчү талаптын аты. Эгер берилбесе, `preferred_username` колдонулат.
+emailClaim=Электрондук почта талабы
+emailClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги электрондук почтаны көрсөтүүчү талаптын аты. Эгер берилбесе, `email` колдонулат.
+fullNameClaim=Толук аты талабы
+fullNameClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги толук атын көрсөтүүчү талаптын аты. Эгер берилбесе, `name` колдонулат.
+givenNameClaim=Берилген аты талабы
+givenNameClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги берилген атын көрсөтүүчү талаптын аты. Эгер берилбесе, `given_name` колдонулат.
+familyNameClaim=Фамилия талабы
+familyNameClaimHelp=Колдонуучу профилин кайтарган JSON документиндеги фамилиясын көрсөтүүчү талаптын аты. Эгер берилбесе, `family_name` колдонулат.
\ No newline at end of file
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_nl.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_nl.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_nl.properties
@@ -0,0 +1 @@
+
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pl.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pl.properties
index b27e193de26f..ff99060bce63 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pl.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pl.properties
@@ -216,7 +216,6 @@ addAssociatedRolesError=Nie udało się powiązać ról {{error}}
 removeUserText=Czy chcesz usunąć {{numSelected}} użytkowników? Ci użytkownicy nie będą już mieli uprawnień roli {{role}} i powiązanych z nią ról.
 diagramView=Widok diagramu
 removeImportedUsers=Usunąć zaimportowanych użytkowników?
-conditionsHelpItem=Element pomocy warunków
 accountLinkingOnly=Tylko łączenie kont
 clientPoliciesPoliciesHelpText=Polityka klienta pozwala powiązać profile klientów z różnymi warunkami, aby określić, kiedy dokładnie jest wymuszane zachowanie określone przez wykonawców danego profilu klienta.
 anyClient=Warunek jest spełniony przez dowolnego klienta na dowolnym wydarzeniu.
@@ -2133,7 +2132,6 @@ targetClaim=Roszczenie docelowe
 assignRole=Przypisz rolę
 accessSettings=Ustawienia dostępu
 updateFlowSuccess=Zaktualizowano przepływ pomyślnie
-xXSSProtectionHelp=Ten nagłówek konfiguruje filtr przeciwdziałania atakom typu Cross-Site Scripting (XSS) w przeglądarce. Korzystając z zachowania domyślnego, przeglądarka będzie zapobiegać renderowaniu strony, gdy zostanie wykryty atak XSS. <1>Dowiedz się więcej</1>
 authenticatedAccessPolicies=Polityki dostępu uwierzytelnionego
 addExecutor=Dodaj wykonawcę
 selectIfResourceExists=Jeśli zasób już istnieje, określ, co należy zrobić
@@ -2279,7 +2277,6 @@ rootURLHelp=Adres URL główny dołączany do adresów URL względnych
 anonymousAccessPolicies=Polityki dostępu anonimowego
 createResourceBasedPermission=Utwórz uprawnienia oparte na zasobach
 searchForRole=Wyszukaj rolę
-xXSSProtection=X-XSS-Protection
 debugHelp=Włącz / wyłącz debugowanie do standardowego wyjścia dla Krb5LoginModule.
 validatorColNames.colConfig=Konfiguracja
 createClient=Utwórz klienta
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pt_BR.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pt_BR.properties
index 21dde6647784..631a9bc58b30 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pt_BR.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_pt_BR.properties
@@ -1,486 +1,477 @@
-otpTypeHelp=totp is Time-Based One Time Password. 'hotp' is a counter base one time password in which the server keeps a counter to hash against.
+otpTypeHelp=totp é Senha de Uso Único Baseada no Tempo. 'hotp' é uma senha de uso único baseada em contador, na qual o servidor mantém um contador para gerar o hash correspondente.
 useKerberosForPasswordAuthentication=Utilizar Kerberos para autenticação via senha
 anyResource=Qualquer recurso
 themes=Temas
-addClientScope=Adicionar modelo de cliente
-clientType='OpenID connect' permite aos Clientes verificarem a identidade do usuário final baseado na autenticação realizada por um servidor de Autorização. 'SAML' permite cenários de autenticação e autorização web-based incluindo cross-domain single sign-on (SSO) e utiliza tokens de segurança contendo assertions para trafegar informações.
-clientSignature=Assinatura do cliente requerida
+addClientScope=Adicionar escopo de cliente
+clientType=Tipo do cliente
+clientSignature=Assinatura do cliente obrigatória
 unanimous=Unânime
-policy-name=The name of this policy.
-clientHelp=Select the client making this authorization request. If not provided, authorization requests would be done based on the client you are in.
+policy-name=O nome dessa política.
+clientHelp=Selecione o cliente que está fazendo esta solicitação de autorização. Se não for informado, as solicitações de autorização serão feitas com base no cliente em que você está.
 debugHelp=Habilita/Desabilita log de nível debug para a saída padrão para Krb5LoginModule.
 validatorColNames.colConfig=Configuração
-nodeHost=Host
-quickLoginCheckMilliSeconds=Se uma falha ocorre concorrentemente neste período, travar a conta do usuário.
+nodeHost=Host do nó
+quickLoginCheckMilliSeconds=Verificação de login rápido em milissegundos
 unspecified=Não especificado
-signOut=Sign Out
-validatorDialogColNames.colName=Nome do Role
+signOut=Sair
+validatorDialogColNames.colName=Nome do papel
 credentialType=Tipo
 certificateHelp=Certificado do cliente para validar JWT emitidos pelo cliente e assinados pela chave privada do cliente da sua keystore.
 forcePostBindingHelp=Sempre utilizar POST para respostas.
-roleName=Nome do Role
+roleName=Nome do papel
 operationType=Tipo de operação
 httpPostBindingAuthnRequestHelp=Indica se o AuthnRequest deve ser enviado utilizando HTTP-POST. Se falso, HTTP-REDIRECT será utilizado.
 policyEnforcementMode=Modo de execução da política
 decisionStrategy=Estratégia de decisão
-requiredUserActionsHelp=Require an action when the user logs in. 'Verify email' sends an email to the user to verify their email address. 'Update profile' requires user to enter in new personal information. 'Update password' requires user to enter in a new password. 'Configure OTP' requires setup of a mobile password generator.
-securityDefences=Defesas
-realmSettings=Configurações do Realm
+requiredUserActionsHelp=Exigir uma ação quando o usuário fizer login. 'Verificar e-mail' envia um e-mail para o usuário confirmar seu endereço de e-mail. 'Atualizar perfil' exige que o usuário insira novas informações pessoais. 'Atualizar senha' exige que o usuário defina uma nova senha. 'Configurar código de uso único' exige a configuração de um gerador de senhas móvel.
+securityDefences=Defesas de segurança
+realmSettings=Configurações do realm
 deleteEvents=Limpar eventos
-accessTokenLifespanHelp=Tempo máximo antes que um token de acesso expire. Recomenda-se que este valor seja menor em relação ao tempo de inativação do inativação do SSO.
-redirectURIHelp=A url de redirecionamento para usar quando da configuração do provedor de identidade.
-resourcePath=Path do recurso
-applyToResourceTypeHelp=Specifies if this permission would be applied to all resources with a given type. In this case, this permission will be evaluated for all instances of a given resource type.
+accessTokenLifespanHelp=Tempo máximo antes do token de acesso expirar. Recomenda-se que esse valor seja curto em relação ao tempo limite do SSO.
+redirectURIHelp=A URI de redirecionamento a ser usada ao configurar o provedor de identidade.
+resourcePath=Caminho do recurso
+applyToResourceTypeHelp=Especifica se essa permissão será aplicada a todos os recursos de um determinado tipo. Nesse caso, a permissão será avaliada para todas as instâncias desse tipo de recurso.
 attestationPreference.none=Nenhum
 revocation=Revogação
-clientDescriptionHelp=Especifica a descrição do cliente. Por exemplo 'Meu cliente para TimeSheets'. Também aceita chaves para valores localizados. Por exemplo\: ${meu_cliente_descricao}
+clientDescriptionHelp=Especifica a descrição do cliente. Por exemplo 'Meu cliente para TimeSheets'. Também aceita chaves para valores localizados. Por exemplo: ${meu_cliente_descricao}.
 clientAuthenticator=Autenticador do cliente
-useEntityDescriptor=Importar metadata de um descritor de entidade IDP SAML remoto.
+useEntityDescriptor=Usar descritor de entidade
 loginActionTimeout=Tempo limite da ação de Login
 updateFirstLoginHelp=Atualizar o perfil no primeiro login
-validRedirectURIs=Padrão de URI válido para onde um navegador pode redirecionar depois de um login bem-sucedido ou sair. Wildcards simples são permitidos, por exemplo 'http\://example.com/*'. Caminhos relativos podem ser especificados também, ex\: /my/relative/path/*. Caminhos relativos são relativos à URL raiz do cliente, ou se nenhum for especificado a URL raiz do servidor é usado. Para SAML, é necessário definir padrões de URI válidos se você está contando com a URL do serviço consumidor incorporada com a solicitação de login.
-assertionConsumerServicePostBindingURL=URL para conexão post para o serviço consumidor de Assertions
+validRedirectURIs=Padrão de URI válido para onde um navegador pode redirecionar depois de um login bem-sucedido ou sair. Wildcards simples são permitidos, por exemplo 'http://example.com/*'. Caminhos relativos podem ser especificados também, ex: /my/relative/path/*. Caminhos relativos são relativos à URL raiz do cliente, ou se nenhum for especificado a URL raiz do servidor é usado. Para SAML, é necessário definir padrões de URI válidos se você está contando com a URL do serviço consumidor incorporada com a solicitação de login.
+assertionConsumerServicePostBindingURL=URL do Binding POST do Assertion Consumer Service
 usermodel.clientRoleMapping.clientId.label=ID do cliente
 endpoints=Endpoints
 clientId=ID do cliente
-validatingX509CertsHelp=O certificado em formato PEM que deve ser usado para verificar assinaturas.
-contextualAttributesHelp=Any attribute provided by a running environment or execution context.
+validatingX509CertsHelp=Os certificados públicos usados pelo Keycloak para validar as assinaturas das requisições e respostas SAML do provedor de identidade externo quando a opção Usar URL do descritor de metadata está DESATIVADA. Vários certificados podem ser inseridos, separados por vírgulas (,). Você pode reimportar os certificados da URL do descritor de metadata clicando na ação Importar Chaves na página do provedor de identidade. Essa ação baixa os certificados atuais do endpoint de metadata e os atribui a esta configuração. Clique em Salvar para armazenar definitivamente os certificados reimportados.
+contextualAttributesHelp=Qualquer atributo fornecido por um ambiente em execução ou contexto de execução.
 importFile=Importar arquivo
 clientLoginTimeoutHelp=Tempo máximo que um cliente tem para finalizar o procolo do token de acesso. Normalmente deve ser 1 minuto.
 lastAccess=Último acesso
-protocolHelp=Qual configuração de protocolo SSO será provida por este modelo de cliente.
-uiDisplayName=Nome de exibição no UI
+protocolHelp=Configuração do protocolo SSO fornecida por este escopo de cliente
+uiDisplayName=Nome de exibição na interface do usuário
 prompts.none=Nenhum
-resourcesHelp=Specifies that this permission must be applied to a specific resource instance.
-adminEventsSettings=Configuração de eventos de administração
-emailVerified=E-mail verificado
+resourcesHelp=Especifica que esta permissão deve ser aplicada a uma instância específica de recurso.
+adminEventsSettings=Configuração de eventos administrativos
+emailVerified=Email verificado
 passwordConfirmation=Confirmação de senha
 times.minutes=Minutos
 forcePostBinding=Forçar Binding via POST
-defaultRoles=Roles padrão
-discoveryEndpoint=Importar metadata de um descritor de descoberta remoto do IDP.
-countHelp=Especifica quantos clientes podem ser criados usando o token
+defaultRoles=Papéis padrão
+discoveryEndpoint=Endpoint de descoberta
+countHelp=Especifica quantos clientes podem ser criados usando o token.
 otpPolicyPeriod=Período de token OTP
 uuidLdapAttribute=Atributo LDAP para UUID
-topLevelFlowType=What kind of top level flow is it? Type 'client' is used for authentication of clients (applications) when generic is for users and everything else
-scopeNameHelp=Nome do modelo de cliente. Deve ser único neste Realm.
+scopeNameHelp=Nome do escopo de cliente. Deve ser único no realm. O nome não deve conter espaços, pois é usado como valor do parâmetro de escopo.
 requiredUserActions=Ações necessárias do usuário
-flowTypeHelp=What kind of form is it
-consentRequired=Se habilitado os usuários devem consentir com o acesso ao cliente.
+flowTypeHelp=Que tipo de formulário é esse
+consentRequired=Consentimento necessário
 allowRemoteResourceManagement=Administração remota de recursos
-standardFlow=Isto habilita a autenticação baseada em redirecionamento com código de autorização padrão do OpenID Connect. Em termos de especificações OpenID Connect ou OAuth2, isto habilita suporte ao 'Fluxo de Código de Autorização' para este cliente.
+standardFlow=Fluxo padrão
 identityProvider=Provedor de identificação
-eventListeners=Listeners de eventos
-bindDn=Bind DN
-identityProviderLinks=Links de provedores de identificação.
+eventListeners=Ouvintes de eventos
+bindDn=DN de associação
+identityProviderLinks=Links de provedores de identidade
 leave=Sair
-eventTypes.IMPERSONATE.name=Personificar
+eventTypes.IMPERSONATE.name=Assumir a identidade
 wantAuthnRequestsSigned=Esperar AuthnRequests assinados
-usermodel.attr.tooltip=Nome do atributo do usuário que é uma chave de atributo no mapa UserModel.attribute.
+usermodel.attr.tooltip=Nome do atributo de usuário armazenado, que corresponde ao nome de um atributo dentro do mapa UserModel.attribute.
 export=Exportar
 add=Adicionar
 passwordPolicy=Política de senha
-backchannelLogout=Backchannel Logout
+backchannelLogout=Logout de Backchannel
 count=Quantidade
 testAuthentication=Testar autenticação
 prompts.login=Login
 users=Usuários
-offlineSessionIdleHelp=Tempo que uma sessão offline pode ficar inativa antes de expirar. Você precisa utilizar um token de atualização offline pelo menos uma vez neste período, caso contrário a sessão offline será expirada.
-uris=An URI that can also be used to uniquely identify this resource.
-forceNameIdFormatHelp=Ignora o NameID de assunto solicitado e utiliza o configurado no UI de administração.
+offlineSessionIdleHelp=Tempo permitido para uma sessão offline ficar ociosa antes de expirar. É necessário usar o token offline para renovar a sessão pelo menos uma vez dentro desse período; caso contrário, a sessão offline expirará.
+uris=URIs
+forceNameIdFormatHelp=Ignorar o formato solicitado do NameID do sujeito e usar o configurado na interface administrativa.
 port=Porta
 expiration=Duração
-realmRolePrefix=Prefixo do Realm Role
+realmRolePrefix=Prefixo do perfil do realm
 logoutServicePostBindingURL=URL de conexão POST para o serviço de logout
 includeRepresentation=Incluir representação
-assertionConsumerServicePostBindingURLHelp=URL de ligação SAML via post para as asserções de consumidor de serviços do cliente (respostas de login). Você pode deixar este campo em branco se você não tiver uma URL para esta ligação.
+assertionConsumerServicePostBindingURLHelp=URL de associação SAML via post para as asserções de assertion consumer service (respostas de login). Você pode deixar este campo em branco se você não tiver uma URL para esta associação.
 singleLogoutServiceUrl=URL de serviço de Single Logout
-roles=Roles
+roles=Papéis
 includeInUserInfo.label=Adicionar à informação do usuário
 back=Voltar
 validateSignatureHelp=Habilita/Desabilita a validação de assinatura de IDP externo.
-policyCode=The JavaScript code providing the conditions for this policy.
 title=Autenticação
-verifyEmail=Verificar e-mail
+verifyEmail=Verificar email
 representation=Representação
-remove=Remover
+remove=Excluir
 formatOption=Formato
 loginTheme=Tema de login
 provider=Provedor
 flows=Fluxos
 scope=Escopo
 nodeReRegistrationTimeout=Tempo limite para re-registro de nó
-client=cliente
-includeRepresentationHelp=Include JSON representation for create and update requests.
+client=Cliente
+includeRepresentationHelp=Incluir a representação JSON para solicitações de criação e atualização.
 connectionURL=URL de conexão
 accessTokenLifespan=Duração do Token de Acesso
 setToNow=Definir como agora
-signAssertionsHelp=Devem as asserções dentro dos documentos SAML serem assinadas? Esta configuração não é necessária se o documento já está sendo assinado.
-firstBrokerLoginFlowAliasOverrideHelp=Alias do fluxo de autenticação que será invocado depois do primeiro login com este provedor de identificação. O termo 'Primeiro Login' significa que ainda não existe uma conta no Keycloak ligada a esta conta autenticada neste provedor.
+signAssertionsHelp=Asserções dentro dos documentos SAML devem ser assinadas? Esta configuração não é necessária se o documento já estiver assinado.
+firstBrokerLoginFlowAliasOverrideHelp=Apelido do fluxo de autenticação, que é acionado após o primeiro login com este provedor de identidade. O termo 'Primeiro Login' significa que nenhuma conta Keycloak está atualmente vinculada à conta autenticada do provedor de identidade.
 owner=Proprietário
 validateSignature=Validar assinaturas
-implicitFlow=Isto habilita suporte a autenticação baseada em redirecionamento sem código de autorização. Em tempos de especificações OpenID Connect ou OAuth2, isto habilita suporte do 'Fluxo Implícito' para este cliente.
+implicitFlow=Fluxo implícito
 headers=Cabeçalhos
-encryptAssertions=Encriptar Assertions
-keyAliasHelp=Alias do arquivo para sua chave privada e certificado.
-tokenClaimName.tooltip=Nome do claim para inserir no token. Pode ser um nome completo (fully qualified) como 'address.street'. Neste caso, um objeto json aninhado será criado.
+encryptAssertions=Encriptar asserções
+keyAliasHelp=Apelido para a chave privada
+tokenClaimName.tooltip=Nome do claim a ser inserido no token. Pode ser um nome totalmente qualificado, como 'address.street'. Nesse caso, um objeto JSON aninhado é criado. Para evitar o aninhamento e usar o ponto literalmente, escape o ponto com uma barra invertida (\\.).
 userName=Usuário
 clientProfileDescription=Descrição
 userObjectClasses=Classes do objeto User
 ssoSessionMax=Tempo máximo antes que uma sessão seja expirada. Tokens e sessões de navegador são invalidados quando uma sessão é expirada.
-policyRoles=Especifica quais role(s) do *cliente* são permitidos por esta política.
+policyRoles=Especifica quais papéis de cliente são permitidos por esta política.
 times.hours=Horas
-browserFlowHelp=Select the flow you want to use for browser authentication.
-temporaryLocked=The user may have been locked due to failing to login too many times.
-webOrigins=Permitir origens CORS. Para permitir todas as URIs de redirecionamento de origem válidas adicionar '+'. Para permitir todas as origens adicionar '*'.
+browserFlowHelp=Selecione o fluxo que deseja usar para autenticação via navegador.
+temporaryLocked=Bloqueado temporariamente
+webOrigins=Origens Web
 realm=Realm
 prompt=Prompt
 username=Usuário
 showAuthData=Exibir dados da autorização
-importConfig=Importar metadata fr um descritor de descoberta baixado do IDP.
+importConfig=Importar configuração do arquivo
 includeInUserInfo.tooltip=O claim deve ser adicionado à informação do usuário?
 initialCounter=Contador inicial
-revokeRefreshTokenHelp=Se habilitado os tokens de atualização podem ser utilizados somente uma vez. Caso contrário os tokens de atualização não são revogados quando utilizados e podem ser utilizados várias vezes.
-storedTokensReadableHelp=Habilita/desabilita se novos usuários podem ler quaisquer tokens salvo. Isto irá adicionar o role broker.read-token.
-authenticationFlowTypeHelp=What kind of form is it
-authorization=Enable/Disable fine-grained authorization support for a client
+revokeRefreshTokenHelp=Se habilitado, um token de atualização só poderá ser usado até o limite definido em "Reutilização Máxima do Token de Atualização" e será revogado quando um token diferente for utilizado. Caso contrário, os tokens de atualização não são revogados ao serem usados e podem ser reutilizados múltiplas vezes.
+storedTokensReadableHelp=Habilita/desabilita se novos usuários podem ler quaisquer tokens salvo. Isto irá adicionar o papel broker.read-token.
+authenticationFlowTypeHelp=Que tipo de formulário é esse?
+authorization=Autorização
 editUsernameHelp=Se habilitado, o campo nome de usuário é editável, senão será apenas leitura.
 consoleDisplayConnectionUrlHelp=Conexão URL para o seu servidor LDAP
-bindCredentialsHelp=Senha do administrador do LDAP
+bindCredentialsHelp=Senha do administrador LDAP. Este campo pode obter seu valor a partir do cofre, usando o formato ${vault.ID}.
 action=Ações
 join=Participar
 id=ID
-fullScopeAllowedHelp=Permite a você desabilitar todas as restrições.
+fullScopeAllowedHelp=Permite você a desabilitar todas as restrições.
 applyPolicy=Aplicar política
-otpType=Tipo OTP
-directGrantHelp=Select the flow you want to use for direct grant authentication.
-scopesHelp=Os escopos que serão enviados ao solicitar autorização. Pode ser uma lista de escopos separadas por espaço. Valor padrão é 'openid'.
+otpType=Tipo de OTP
+directGrantHelp=Selecione o fluxo que deseja usar para autenticação por concessão direta.
+scopesHelp=Os escopos que serão enviados ao solicitar autorização. Pode ser uma lista de escopos separadas por espaço. O valor padrão é 'openid'.
 includeAuthnStatement=Incluir AuthnStatement
-jsonType.tooltip=Tipo JSON que deve ser utilizado para popular o claim json no token. Os valores válidos são Long, int boolean e String.
-multivalued.tooltip=Indica se um atributo suporta múltiplos valores. Se verdadeiro, então a lista de todos os valores desse atributo será definida como o claim. Se falso, então apenas o primeiro valor será utilizado.
+jsonType.tooltip=Tipo JSON que deve ser usado para preencher a claim JSON no token. Valores válidos: long, int, boolean, String e JSON.
+multivalued.tooltip=Indica se o atributo suporta múltiplos valores. Se verdadeiro, a lista com todos os valores desse atributo será definida como claim. Se falso, apenas o primeiro valor será definido como claim
 enableStartTLS=Habilitar StartTLS
 enableStartTls=Habilitar StartTLS
-addIdPMapper=Adicionar mapeamento de provedor de identificação
-eventType=Tipo de evento
-homeURL=URL padrão para utilizar quando o servidor de autenticação necessita redirecionar ou linkar para o cliente.
+addIdPMapper=Adicionar mapeador de provedor de identidade
+eventType=Tipo de evento salvo
+homeURL=URL inicial
 firstBrokerLoginFlowAlias=Fluxo do primeiro login
 usermodel.attr.label=Atributo do usuário
 eventTypes.REGISTER.name=Registro
-rememberMeHelpText=Exibe um checkbox na página de login para permitir ao usuário continuar logado entre restarts do browser até que a sessão expire.
-usernameLdapAttribute=Atributo LDAP para Username
+rememberMeHelpText=Exibir caixa de seleção na página de login para permitir que a pessoa permaneça conectada entre reinicializações do navegador até que a sessão expire.
+usernameLdapAttribute=Atributo LDAP para o nome de usuário
 evaluate=Avaliar
 ssoServiceUrl=URL de serviço do Single Sign On
-allowRemoteResourceManagementHelp=Should resources be managed remotely by the resource server? If false, resources can only be managed from this Admin UI.
+allowRemoteResourceManagementHelp=Os recursos devem ser gerenciados remotamente pelo servidor de recursos? Se falso, os recursos só poderão ser gerenciados a partir desta interface administrativa.
 clients=Clientes
-changedUsersSyncPeriod=Período
+changedUsersSyncPeriod=Período de sincronização de usuários alterados
 clientName=Nome
 userRegistration=Cadastro de usuário
 save=Salvar
 login=Login
-maxDeltaTimeSeconds=Tempo para zerar falhas
-backchannelLogoutHelp=O IDP externo suporta logou via backchannel?
-usermodel.realmRoleMapping.rolePrefix.tooltip=Um prefixo para cada Realm Role (opcional).
+maxDeltaTimeSeconds=Tempo de redefinição de falhas
+backchannelLogoutHelp=O provedor de identidade externo (IDP) suporta logout por canal de backchannel?
+usermodel.realmRoleMapping.rolePrefix.tooltip=Um prefixo que será adicionado antes de cada nome de papel de realm (opcional).
 affirmative=Afirmativa
-changedUsersSyncHelp=Intervalo para sincronização dos usuários alterados ou novos do LDAP em segundos.
-trustEmailHelp=Se habilitado então o e-mail provido por este provedor não será verificado mesmo que a verificação esteja habilitada para este realm.
-maxFailureWaitSecondsHelp=Tempo máximo que um usuário deverá aguardar após uma falha de quick login.
-maxDeltaTimeSecondsHelp=Quando o contador de falhas será resetado?
-adminURLHelp=URL para a inteface administrativa do cliente. Defina este valor se o cliente suporta a API do adaptador REST. Esta API rest permite que o servidor de autenticação envie políticas de revogação e outras tarefas administrativas. Geralmente este valor é definido apontando para a URL base do cliente.
-otpPolicyPeriodHelp=How many seconds should an OTP token be valid? Defaults to 30 seconds.
+changedUsersSyncHelp=Intervalo para sincronização dos usuários alterados ou novos do LDAP em segundos
+trustEmailHelp=Se ativado, o email fornecido por este provedor não será verificado, mesmo que a verificação esteja habilitada para o realm.
+maxFailureWaitSecondsHelp=Tempo máximo em que um usuário ficará bloqueado.
+maxDeltaTimeSecondsHelp=Quando o contador de falhas será redefinido?
+adminURLHelp=URL da interface administrativa do cliente. Configure este campo se o cliente suportar a API REST do adaptador. Essa API REST permite que o servidor de autenticação envie políticas de revogação e realize outras tarefas administrativas. Normalmente, este valor é a URL base do cliente.
+otpPolicyPeriodHelp=Por quantos segundos um token OTP deve ser válido? O padrão é 30 segundos.
 contentSecurityPolicy=Content-Security-Policy
-storePasswordHelp=Senha para acessar o arquivo em si.
-frontchannelLogoutHelp=Quando marcado, o logout requer um redirecionamento do browser para o cliente. Caso contrário o servidor executo uma invocação em background para o logout.
+storePasswordHelp=Senha para acessar o arquivo em si
+frontchannelLogoutHelp=Quando verdadeiro, o logout requer um redirecionamento do navegador para o cliente. Quando falso, o servidor realiza uma invocação em segundo plano para o logout.
 userFederation=Federação de usuários
-directAccess=Habilita o suporte para concessões de acesso direto (Direct Access Grants), o que significa que o cliente tem acesso ao nome de usuário/senha e negocia diretamente com o servidor Keycloak pelo token de acesso. Em termos de especificações OAuth2, habilita suporte de "Resource Owner Password Credentials Grant" para este cliente.
+directAccess=Concessões de acesso direto
 attributes=Atributos
 logic=Lógica
 scopes=Escopos
 resourceType=Tipo de recurso
-flowType=Flow Type
+flowType=Tipo de fluxo
 policyEnforcementModes.PERMISSIVE=Permissiva
 auth=Autenticação
-accessTokenLifespanImplicitFlow=Duração do token de acesso para fluxos Implícitos
-scopeName=An unique name for this scope. The name can be used to uniquely identify a scope, useful when querying for a specific scope.
-userInfoUrlHelp=A Url de informações de usuário. Opcional.
+accessTokenLifespanImplicitFlow=Duração do token de acesso para fluxo Implícito
+scopeName=Um nome único para este escopo. O nome pode ser usado para identificar exclusivamente um escopo, útil ao consultar um escopo específico.
+userInfoUrlHelp=A URL de informações de usuário. Opcional.
 remainingCount=Quantidade restante
 kc.realm.name=Realm
 download=Download
-authScopes=Autorização de escopos
-impersonate=Personificar
+authScopes=Escopos de autorização
+impersonate=Assumir a identidade
 members=Membros
 host=Host
-registration-access-token=O token de acesso para registro provê acesso aos cliente para o serviço de registro cliente.
-adminURL=URL do administrador
+adminURL=URL de administração
 settings=Configurações
-failureFactorHelp=Quantas falhas de login antes que a espera seja habilitada.
+failureFactorHelp=Número de falhas antes de acionar a espera.
 storeTokensHelp=Habilita/desabilita se os tokens deve ser guardados depois de autenticar os usuários.
-singleLogoutServiceUrlHelp=A Url que deve ser utilizada para enviar solicitações de logout.
+singleLogoutServiceUrlHelp=A URL que deve ser utilizada para enviar solicitações de logout.
 ipAddress=Endereço IP
 useTruststoreSpi=Utilizar Truststore SPI
-storeTokens=Salvar Tokens
-usermodel.clientRoleMapping.rolePrefix.tooltip=Um prefixo para cada role do cliente (opcional)
+storeTokens=Salvar tokens
+usermodel.clientRoleMapping.rolePrefix.tooltip=Um prefixo que será adicionado antes de cada nome de Papel de Cliente (opcional).
 includeInIdToken.label=Adicionar ao token de ID
-browserFlow=Fluxo de browser
+browserFlow=Fluxo de navegador
 anyScope=Qualquer escopo
 serverInfo=Informação do servidor
-emailThemeHelp=Selecione o tema para os e-mail que são enviados pelo servidor.
-emailVerifiedHelp=Has the user's email been verified?
+emailThemeHelp=Selecione o tema para os email que são enviados pelo servidor.
+emailVerifiedHelp=O email do usuário foi verificado?
 addExecution=Adicionar execução
 editMode=Modo de edição
 consents=Consentimentos
-canonicalization=Método de Canonicalization
+canonicalization=Método de Canonicalização
 SSOSessionMax=Sessão SSO Máxima
 groupMembership=Grupos associados
-minimumQuickLoginWaitSecondsHelp=Quanto tempo aguardar após uma falha de quick login.
+minimumQuickLoginWaitSecondsHelp=Por quanto tempo esperar após uma falha rápida de login.
 code=Código
-fullSyncPeriod=Período
+fullSyncPeriod=Período de sincronização completa
 addNode=Adicionar nó
-policy-description=A description for this policy.
+policy-description=Uma descrição para essa política.
 policies=Políticas
 certificate=Certificado
 importClient=Importar cliente
-selectRole.label=Selecione o Role
+selectRole.label=Selecione o papel
 allTypes=Todos os tipos
 prompts.consent=Consentimento
 ldapFilter=Filtro do LDAP
 postBrokerLoginFlowAlias=Fluxo pós login
 tokens=Tokens
-save-admin-eventsHelp=If enabled admin events are saved to the database which makes events available to the Admin UI.
-encryptAssertionsHelp=Devem as asserções SAML serem encriptadas com a chave pública do cliente usando AES?
-policyGroups=Specifies which user(s) are allowed by this policy.
-serviceAccount=Permite autenticar este cliente no Keycloak e recuperar tokens de acesso dedicados para este cliente. Em termos da especificações OAuth2, habilita suporte para 'Client Credentials Grants' para este cliente.
+save-admin-eventsHelp=Se ativado, eventos administrativos são salvos no banco de dados, tornando-os disponíveis na interface administrativa.
+encryptAssertionsHelp=As asserções SAML devem ser criptografadas com a chave pública do cliente usando AES?
+serviceAccount=Papéis de contas de serviço
 requirement=Condição
-assertionConsumerServiceRedirectBindingURL=URL para conexão de redirecionamento do serviço consumidor de Assertions
-loginThemeHelp=Selecione o tema para páginas de login, OTP, grant, cadastro e recuperar senha.
-permissionDescription=A description for this permission.
+assertionConsumerServiceRedirectBindingURL=URL do Binding Redirect do Assertion Consumer Service
+loginThemeHelp=Selecione o tema para as páginas de login, OTP, autorização, registro e recuperação de senha.
+permissionDescription=Uma descrição para essa permissão.
 multivalued.label=Múltiplos valores
 initialAccessToken=Token de acesso inicial
-vendorHelp=LDAP vendor (provedor)
+vendorHelp=Fornecedor (provedor) LDAP
 applyToResourceType=Aplicar ao tipo de recurso
-rememberMe=Lembrar me
+rememberMe=Mantenha-me conectado
 flow.registration=Fluxo de registro
 registeredClusterNodes=Nós de cluster registrados
-selectRole.tooltip=Entre com o role na caixa à esquerda, ou clique neste botão para navegar e selecionar o role desejado.
+selectRole.tooltip=Digite o papel na caixa de texto à esquerda ou clique neste botão para procurar e selecionar o papel desejado.
 storePassword=Salvar senha
-logoutServiceRedirectBindingURLHelp=URL de ligação SAML de redirecionamento  para o serviço de logout único do cliente. Voce pode deixar este campo em branco s e estiver usando uma ligação diferente.
-defaultGroups=Grupos Padrão
-flow.browser=Fluxo de browser
-editModeLdapHelp=READ_ONLY é um LDAP somente leitura. WRITABLE significa que os dados serão sicronizados de volta para o LDAP on demand. UNSYNCED significa que os dados do usuário serão importados, mas não sicronizados de volta para o LDAP.
+logoutServiceRedirectBindingURLHelp=URL do Binding Redirect SAML para o serviço de logout único do cliente. Você pode deixar em branco se estiver usando um binding diferente.
+defaultGroups=Grupos padrão
+flow.browser=Fluxo de navegador
+editModeLdapHelp=READ\\_ONLY é um armazenamento LDAP somente leitura. WRITABLE significa que os dados serão sincronizados de volta para o LDAP sob demanda. UNSYNCED significa que os dados do usuário serão importados, mas não sincronizados de volta para o LDAP.
 includeInIdToken.tooltip=O claim deve ser adicionado ao token de ID?
-save-user-eventsHelp=If enabled login events are saved to the database which makes events available to the Admin and Account management UIs.
+save-user-eventsHelp=Se ativado, eventos do usuário são salvos no banco de dados, tornando-os disponíveis nas interfaces de administração e gerenciamento de conta.
 password=Senha
-allowPasswordAuthentication=Permitir autenticação via senha
+allowPasswordAuthentication=Permitir autenticação com senha
 composite=Composto
 clientAuthorization=Autorização
-waitIncrementSecondsHelp=Quando a quantidade de falhas for alcançada, quanto tempo o usuário deve aguardar antes de tentar novamente?
+waitIncrementSecondsHelp=Quando o limite de falhas for atingido, por quanto tempo o usuário deve ficar bloqueado?
 allowKerberosAuthentication=Permitir autenticação Kerberos
 events=Eventos
 createPermission=Criar permissão
-mapperType=Tipo de mapeamento
+mapperType=Tipo de mapeador
 testConnection=Testar conexão
 edit=Editar
 archiveFormat=Formato do arquivo
-credentialResetConfirm=Enviar e-mail
+credentialResetConfirm=Enviar email
 kerberosRealm=Realm do Kerberos
-flow.direct\ grant=Fluxo de Direct Grant
-associatedRolesText=Roles associados
-defaultLocale=Local padrão
-clientIdHelp=O identificador do cliente registrado com o provedor de identificação.
-typeHelp=The type of this resource. It can be used to group different resource instances with the same type.
+flow.direct\ grant=Fluxo de concessão direta
+associatedRolesText=Papéis associados
+defaultLocale=Linguagem padrão
+clientIdHelp=O identificador do cliente registrado junto ao provedor de identidade.
+typeHelp=Escopos de cliente que serão adicionados como escopos padrão a cada cliente criado.
 htmlDisplayName=Nome de exibição HTML
 authorizationUrl=URL de autorização
-flow-type.basic-flow=genérico
+flow-type.basic-flow=Genérico
 contextualAttributes=Atributos contextuais
 allowPasswordAuthenticationHelp=Habilita/Desabilita a possibilidade de autenticação via usuário/senha contra o banco Kerberos
 includeInAccessToken.tooltip=O claim deve ser adicionado ao token de acesso?
-idpInitiatedSsoRelayStateHelp=O estado de Relay que você deseja enviar com um pedido SAML quando você deseja realizar SSO iniciado por IDP.
-otpHashAlgorithmHelp=What hashing algorithm should be used to generate the OTP.
-usermodel.clientRoleMapping.clientId.tooltip=ID do cliente para mapeamentos de roles
-clientsClientScopesHelp=The scopes associated with this resource.
+idpInitiatedSsoRelayStateHelp=O estado de relay que você deseja enviar com um pedido SAML quando você deseja realizar SSO iniciado por IDP.
+otpHashAlgorithmHelp=Algoritmo de hash usado para gerar o código de uso único
+usermodel.clientRoleMapping.clientId.tooltip=ID do cliente para mapeamento de papéis. Apenas os papéis de cliente deste cliente serão adicionados ao token. Se não estiver definido, os papéis de todos os clientes serão adicionados ao token.
+clientsClientScopesHelp=Os escopos associados a este recurso.
 vendor=Vendor
-logoutServiceRedirectBindingURL=URL de conexão para o redirecionamento do serviço de logout
+logoutServiceRedirectBindingURL=URL de Binding Redirect do Serviço de Logout
 idpInitiatedSsoRelayState=Estado de relay para SSO iniciado via IDP
-validatingX509Certs=Validar certificados X509
+validatingX509Certs=Validando certificados X509
 masterSamlProcessingUrl=URL de processamento SAML principal
 key=Chave
-email=E-mail
+email=Email
 userInfoUrl=URL de informações do usuário
-identityProviders=Provedores de identificação
+identityProviders=Provedores de identidade
 nameIdPolicyFormat=Política de formato NameID
-idpInitiatedSsoUrlName=Nome do fragmento URL para referenciar o cliente quando você deseja um SSO iniciado por IDP. Deixar este campo vazio irá desabilitar SSO iniciado por IDP. A URL que você irá referenciar do seu browser será\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}
+idpInitiatedSsoUrlName=Nome da URL para SSO iniciado pelo IDP
 ssoSessionIdle=Tempo que uma sessão pode ficar inativa antes de expirar. Tokens e sessões de navegador são invalidados quando uma sessão é expirada.
 xFrameOptions=X-Frame-Options
-scopeDescriptionHelp=Descrição do modelo de cliente.
-directGrant=Fluxo de Direct Grant
-consensus=Consensual
+scopeDescriptionHelp=Descrição do escopo de cliente
+directGrant=Fluxo de concessão direta
+consensus=Consenso
 policyType.totp=Baseado em tempo
-emailTheme=Tema de e-mail
+emailTheme=Tema de email
 nameIdFormatHelp=O formato de Name ID para utilizar como assunto.
-adminEvents=Eventos de adminstração
+adminEvents=Eventos administrativos
 registerNodeManually=Registrar nó manualmente
 serverPrincipal=Principal do servidor
 redirectURI=URI de redirecionamento
 signDocuments=Assinar documentos
-periodicFullSync=Syncronização completa periódica
+periodicFullSync=Sincronização completa periódica
 tokenUrl=URL do Token
 notBefore=Não antes de
 createdAt=Criado em
-editUsername=Editar nome de usuário
+editUsername=Se habilitado, o campo nome de usuário é editável, senão será apenas leitura.
 titleEvents=Eventos
 lastRegistration=Último registro
-rolesHelp=Select the roles you want to associate with the selected user.
-requireSsl=SSL requerido
-samlEntityDescriptor=Permite que vocÊ carregue metadata de IDP externos de um arquivo de configuração ou baixando a partir de uma URL.
+rolesHelp=Selecione os perfis que deseja associar ao usuário selecionado.
+requireSsl=Exige SSL
+samlEntityDescriptor=Descritor de entidade SAML
 reevaluate=Re-avaliar
-addIdpMapperName=Nome do mapeamento
 continue=Continuar
 details=Detalhes
 selectScope=Selecione um escopo
-generateNewKeys=Gerar novas chaves
+generateNewKeys=Gerar chaves RSA
 offlineSessionIdle=Sessão Offline Inativa
 periodicChangedUsersSync=Sincronização periódica de usuários alterados
 searchScope=Escopo de pesquisa
 userRegistrationHelpText=Habilita/desabilita a página de cadastro. Um link para a página de cadastro também será exibido na tela de login.
 revokeRefreshToken=Revogar Token de Atualização
-resourceName=An unique name for this resource. The name can be used to uniquely identify a resource, useful when querying for a specific resource.
-minimumQuickLoginWaitSeconds=Espera mínima após Quick Login
+minimumQuickLoginWaitSeconds=Tempo mínimo de espera após falha de login rápido
 operationTypes=Tipos de operações
-realmRoles=Roles do Realm
+realmRoles=Papéis de realm
 firstName=Primeiro nome
-expireTime=Defines the time after which the policy MUST NOT be granted. Only granted if current date/time is before or equal to this value.
-expirationHelp=Sets the expiration for events. Expired events are periodically deleted from the database.
-nameIdFormat=Formato do NameID
-adminThemeHelp=Selecione o tema para o UI de administração.
-name=Nome do modelo de cliente. Deve ser único neste Realm.
+expireTime=Tempo de expiração
+expirationHelp=Define o tempo de expiração dos eventos. Eventos expirados são excluídos periodicamente do banco de dados.
+nameIdFormat=Formato do Name ID
+adminThemeHelp=Selecione o tema para o console administrativo.
+name=Nome
 validRedirectUri=URIs de redirecionamento válidas
 clientList=Clientes
 userSession.modelNote.label=Nota da sessão de usuário
-permissionName=The name of this permission.
+permissionName=O nome desta permissão.
 expires=Expira em
 pagination=Paginação
-import=Import a JSON file containing authorization settings for this resource server.
+import=Importar
 otpHashAlgorithm=Algoritmo de hash OTP
 userAttribute=Atributo do usuário
 description=Descrição
 revoke=Revogar
-eventListenersHelpText=Configure what listeners receive events for the realm.
-clientSignatureHelp=O cliente irá assinar os pedidos e respostas saml? E eles devem ser validados?
-keyPasswordHelp=Senha para acessar a chave privada no certificado.
-frontchannelLogout=Front Channel Logout
-providerId=ID
-titleRoles=Roles do Realm
+clientSignatureHelp=O cliente assinará suas requisições e respostas SAML? E elas devem ser validadas?
+keyPasswordHelp=Senha para a chave privada
+frontchannelLogout=Logout via front channel
+providerId=ID do provedor
+titleRoles=Papéis de realm
 loginTimeout=Tempo máximo do Login
 rdnLdapAttribute=Atributo LDAP para RDN
-fineGrainSamlEndpointConfig=Configuração de endpoint para configuração fina do SAML
+fineGrainSamlEndpointConfig=Configuração Detalhada de Endpoint SAML
 hours=Horas
-bindType=Tipo de autenticação
-aliasHelp=O alias é o identificador único de um provedor de identidade e também é utilizado para construir a uri de redirecionamento.
+bindType=Tipo de associação
+aliasHelp=O alias identifica exclusivamente um provedor de identidade e também é usado para construir a URI de redirecionamento.
 maxFailureWaitSeconds=Espera máxima
 configure=Configuração
 contextualInfo=Informação contextual
 manage=Administração
 temporaryPassword=Temporária
-applyPolicyHelp=Specifies all the policies that must be applied to the scopes defined by this policy or permission.
+applyPolicyHelp=Especifica todas as políticas que devem ser aplicadas aos escopos definidos por esta política ou permissão.
 kerberosIntegration=Integração com Kerberos
 protocolMapper=Protocolo...
 requiredSettings=Configurações obrigatórias
 sslType.none=Nenhum
 time=Tempo
-bruteForceDetection=Detecção de ataque de Força Bruta
+bruteForceDetection=Detecção de ataque de força bruta
 archiveFormatHelp=Keystore Java ou arquivo em formato PKCS12.
 xContentTypeOptions=X-Content-Type-Options
 keyAlias=Alias da chave
-prefix=Um prefixo para cada Realm Role (opcional).
 none=Nenhum
-sslType.all=todas requisições
+sslType.all=Todas requisições
 type=Tipo
 httpPostBindingResponse=Responder com HTTP-POST
 saveEvents=Salvar eventos
 issuer=Emissor
-policyEnforcementModeHelp=The policy enforcement mode dictates how policies are enforced when evaluating authorization requests. 'Enforcing' means requests are denied by default even when there is no policy associated with a given resource. 'Permissive' means requests are allowed even when there is no policy associated with a given resource. 'Disabled' completely disables the evaluation of policies and allow access to any resource.
+policyEnforcementModeHelp=O modo de aplicação de políticas determina como as políticas são aplicadas ao avaliar solicitações de autorização. "Obrigatório" significa que as solicitações são negadas por padrão, mesmo quando não há política associada ao recurso. "Permissivo" significa que as solicitações são permitidas mesmo sem uma política associada. "Desativado" desativa completamente a avaliação de políticas e permite acesso a qualquer recurso.
 seconds=Segundos
 selectAUser=Selecione um usuário
-eventTypes.RESET_PASSWORD.name=Reiniciar senha
+eventTypes.RESET_PASSWORD.name=Redefinir senha
 otpPolicyDigits=Quantidade de dígitos
 permissions=Permissões
 accountThemeHelp=Selecione o tema para as páginas de administração de conta do usuário.
-canonicalizationHelp=Canonicalization Method para assinaturas XML.
+canonicalizationHelp=Método de Canonicalização para assinaturas XML.
 sessions=Sessões
-fullSyncPeriodHelp=Intervalo para a sincronização completa em segundos.
+fullSyncPeriodHelp=Intervalo para a sincronização completa em segundos
 priority=Prioridade
-trustEmail=Confiar no e-mail recebido
+trustEmail=Confiar no email
 jsonType.label=Tipo JSON do Claim
-fullScopeAllowed=Permitir Escopo completo
+fullScopeAllowed=Permitir escopo completo
 push=Enviar
 titleUsers=Usuários
-masterSamlProcessingUrlHelp=Se configurado, esta URL será utilizada para todos os bindings do "SP's Assertion Consumer" e "Single Logout Services". Ela pode ser sobreescriva idnvidualmente para cada ligação e serviço na Configuração Detalhada do Endpoint SAML.
-claimJsonType=Tipo JSON que deve ser utilizado para popular o claim json no token. Os valores válidos são Long, int boolean e String.
+masterSamlProcessingUrlHelp=Se configurada, esta URL será usada para cada binding Assertion Consumer e Single Logout Services do provededor de serviço (SP). Pode ser sobrescrita individualmente para cada binding e serviço na Configuração Detalhada de Endpoint SAML.
+claimJsonType=Tipo JSON que deve ser usado para preencher a claim JSON no token. Valores válidos: long, int, boolean, String e JSON.
 forceAuthenticationHelp=Indica se um provedor de identificação deve autenticar o apresentador diretamente ao invés de confiar em um contexto de segurança anterior.
 testClusterAvailability=Testar disponibilidade do cluster
 forceNameIdFormat=Forçar formato do NameID
-sslType.external=requisições externas
-multiValued=Indica se um atributo suporta múltiplos valores. Se verdadeiro, então a lista de todos os valores desse atributo será definida como o claim. Se falso, então apenas o primeiro valor será utilizado.
-addRole=Adicionar Role
+sslType.external=Requisições externas
+multiValued=Indica se esse atributo suporta múltiplos valores. Se verdadeiro, a lista com todos os valores desse atributo será definida como declaração. Se falso, apenas o primeiro valor será definido como declaração.
+addRole=Adicionar papel
 lastName=Sobrenome
-usermodel.realmRoleMapping.rolePrefix.label=Prefixo do Realm Role
-temporaryPasswordHelpText=If enabled user is required to change password on next login
-otpPolicyDigitsHelp=How many digits should the OTP have?
+usermodel.realmRoleMapping.rolePrefix.label=Prefixo do Papel de Realm
+temporaryPasswordHelpText=Se ativado, o usuário deverá alterar a senha no próximo login
+otpPolicyDigitsHelp=Quantos dígitos o OTP deve ter?
 connectionPooling=Pooling de conexões
-wantAuthnRequestsSignedHelp=Indicate se um provedor de identificação deve experar um AuthnRequest assinado.
+wantAuthnRequestsSignedHelp=Indica se o provedor de identidade espera um AuthnRequest assinado.
 enabled=Habilitado
-authenticationAliasHelp=Name of the configuration
+authenticationAliasHelp=Nome da configuração
 keyPassword=Senha da chave
 SSOSessionIdle=Sessão SSO inativa
-ssoServiceUrlHelp=A Url que deve ser utilizada para enviar solicitações de autenticação (SAML AuthnRequest).
-startTime=Defines the time before which the policy MUST NOT be granted. Only granted if current date/time is after or equal to this value.
-logicHelp=The logic dictates how the policy decision should be made. If 'Positive', the resulting effect (permit or deny) obtained during the evaluation of this policy will be used to perform a decision. If 'Negative', the resulting effect will be negated, in other words, a permit becomes a deny and vice-versa.
+ssoServiceUrlHelp=A URL que deve ser utilizada para enviar solicitações de autenticação (SAML AuthnRequest).
+startTime=Hora de início
+logicHelp=A lógica determina como a decisão da política deve ser tomada. Se for 'Positiva', o efeito resultante (permitir ou negar) obtido durante a avaliação desta política será usado para tomar a decisão. Se for 'Negativa', o efeito resultante será invertido, ou seja, um permitir se torna negar e vice-versa.
 copy=Copiar
-supportedLocales=Locais disponíveis
+supportedLocales=Linguagens disponíveis
 registrationAccessToken=Token de acesso para registro
 showPasswordDataValue=Valor
 issuerHelp=O identificador de emissor para o emissor da resposta. Se não for provido nenhuma validação será realizada.
 titleSessions=Sessões
-clientNameHelp=Especifica o nome de exibição do cliente. Por exemplo 'Meu Cliente'. Também aceita chaves para valores localizados. Por exemplo\: ${meu_cliente}
-createPolicy=Criar política
+clientNameHelp=Especifica o nome de exibição do cliente. Por exemplo 'Meu Cliente'. Também aceita chaves para valores localizados. Por exemplo: ${meu_cliente}.
+createPolicy=Criar política de cliente
 clearAdminEvents=Limpar eventos administrativos
 rootURL=URL raiz adicionada à URLs relativas
 clientLoginTimeout=Tempo limite para login do Cliente
-nodeReRegistrationTimeoutHelp=Intervalo para especificar o tempo máximo para nós clientes de cluster registrados se re-registrarem. Se os nós do cluster não enviarem solicitações de re-registro dentro deste intervalo eles serão deregistrados do Keycloak.
+nodeReRegistrationTimeoutHelp=Intervalo que especifica o tempo máximo para os nós de cluster dos clientes registrados se re-registrarem. Se um nó de cluster não enviar uma solicitação de re-registro ao Keycloak dentro desse período, ele será removido do registro no Keycloak.
 clientAuthentication=Autenticação do cliente
 registrationEmailAsUsername=Email como nome de usuário
 logicType.negative=Negativa
-otpPolicy=Política OTP
-flow-type.form-flow=formulário
-signDocumentsHelp=Devem os documentos SAML serem assinados pelo realm?
-resetPassword=Reiniciar senha
-requireSslHelp=É necessário SSL? 'Nunca' significa que HTTPS não é requerido para nenhum endereço IP cliente. 'Requisições externas' significa que localhost e IPs privados podem acessar sem HTTPS. 'Todas requisições' significa que HTTPS é requerido para todos os endereços IPs.
+otpPolicy=Política de OTP
+flow-type.form-flow=Formulário
+signDocumentsHelp=Os documentos SAML devem ser assinados pelo realm?
+resetPassword=Redefinir senha
+requireSslHelp=O HTTPS é obrigatório? 'Nenhum' significa que o HTTPS não é obrigatório para nenhum endereço IP de cliente. 'Requisições externas' significa que localhost e endereços IP privados podem acessar sem HTTPS. 'Todas as requisições' significa que o HTTPS é obrigatório para todos os endereços IP.
 identityInformation=Informação de identidade
 addUser=Adicionar usuário
-usermodel.clientRoleMapping.rolePrefix.label=Prefixo para o role de Cliente
+usermodel.clientRoleMapping.rolePrefix.label=Prefixo para o papel de cliente
 partialImport=Importação parcial
-includeAuthnStatementHelp=Deve ser adicionado um statement especificando o método e timestamp nas respostas de login?
-client-authenticator-type=Autenticador de Cliente usado para autenticar este cliente ao servidor Keycloak
+includeAuthnStatementHelp=Deve ser incluída uma declaração especificando o método e o carimbo de data/hora nas respostas de login?
 protocol=Protocolo
-manageAccount=Administrar a conta
-tokenClaimName.label=Nome do Token Claim
+manageAccount=Gerenciar conta
+tokenClaimName.label=Nome da Claim do Token
 create=Criar
 clientSecret=Secret do Cliente
 from=Remetente
 httpPostBindingAuthnRequest=Utilizar HTTP-POST binding para AuthnRequest
 includeInAccessToken.label=Adicionar ao token de acesso
 iconUri=URI do ícone
-usersInRole=Usuários no role
+usersInRole=Usuários no papel
 createGroup=Criar grupo
 resource=Recurso
 minutes=Minutos
 userSession.modelNote.tooltip=Nome da nota de sessão do usuário salva no mapa UserSessionModel.note.
-usersDN=Users DN
-clientsClientTypeHelp='OpenID connect' permite aos Clientes verificarem a identidade do usuário final baseado na autenticação realizada por um servidor de Autorização. 'SAML' permite cenários de autenticação e autorização web-based incluindo cross-domain single sign-on (SSO) e utiliza tokens de segurança contendo assertions para trafegar informações.
-selectUser=Select an user whose identity is going to be used to query permissions from the server.
+usersDN=DN de usuários
+clientsClientTypeHelp='OpenID Connect' permite que os Clientes verifiquem a identidade da Pessoa Final com base na autenticação realizada por um Servidor de Autorização. 'SAML' possibilita cenários de autenticação e autorização web, incluindo login único (SSO) entre domínios, e usa tokens de segurança contendo asserções para transmitir informações.
+selectUser=Selecione um usuário cuja identidade será usada para consultar permissões no servidor.
 logoutUrl=URL de logout
 storedTokensReadable=Leitura de tokens salvos
-admin-clearEventsHelp=Deletes all admin events in the database.
-mappers=Mapeamentos
+admin-clearEventsHelp=Exclui todos os eventos administrativos no banco de dados.
+mappers=Mapeadores
 waitIncrementSeconds=Incremento de Espera
 usermodel.prop.label=Propriedade
 name-id-format=Formato do NameID
@@ -488,38 +479,605 @@ credentials=Credenciais
 policyType.hotp=Baseado em contador
 enableSSL=Habilitar SSL
 general=Geral
-failureFactor=Falhas de login
-signAssertions=Assinar assertions
-scopesSelect=Define que esta permissões deve ser aplicada para um ou mais escopos.
-adminTheme=Tema para UI de administração
+failureFactor=Máximo de falhas de login
+signAssertions=Assinar asserções
+scopesSelect=Especifica que esta permissão deve ser aplicada a um ou mais escopos.
+adminTheme=Tema administrativo
 alias=Alias
 value=Valor
-clientSecretHelp=A senha do cliente registrado junto ao provedor de identificação.
+clientSecretHelp=O segredo do cliente registrado junto ao provedor de identidade. Este campo pode obter seu valor do cofre, use o formato ${vault.ID}.
 validateSignatures=Habilita/Desabilita validação de assinaturas de respostas SAML.
 authentication=Autenticação
-descriptionHelp=Descrição do modelo de cliente.
-logoutUrlHelp='End session endpoint' para utilizar para realizar logour dos usuários do IDP externo.
+descriptionHelp=Texto de ajuda para a descrição do novo fluxo
+logoutUrlHelp=Endpoint de encerramento de sessão a ser usado para desconectar o usuário do provedor de identidade externo.
 times.seconds=Segundos
-permissionType=Specifies that this permission must be applied to all resources instances of a given type.
+permissionType=Especifica que esta permissão deve ser aplicada a todas as instâncias de recursos de um determinado tipo.
 policyEnforcementModes.ENFORCING=Restritiva
 debug=Debug
 clear=Limpar
 resources=Recursos
 groups=Grupos
 logicType.positive=Positiva
-signatureAlgorithm=O algoritmo de assinatura a ser utilizado para assinar documentos.
-eventTypes.LOGOUT.name=Logout
-accountTheme=Tema para conta
-requiredActions=Ações requeridas
+signatureAlgorithm=Algoritmo de assinatura
+eventTypes.LOGOUT.name=Sair
+accountTheme=Tema da conta
+requiredActions=Ações obrigatórias
 forceAuthentication=Forçar autenticação
-assertionConsumerServiceRedirectBindingURLHelp=URL de ligação SAML de redirecionamento para as asserções de consumidor de serviços do cliente (respostas de login). Você pode deixar este campo em branco se você não tiver uma URL para esta ligação.
-policyDecisionStagey=The decision strategy dictates how the policies associated with a given policy are evaluated and how a final decision is obtained. 'Affirmative' means that at least one policy must evaluate to a positive decision in order to the overall decision be also positive. 'Unanimous' means that all policies must evaluate to a positive decision in order to the overall decision be also positive. 'Consensus' means that the number of positive decisions must be greater than the number of negative decisions. If the number of positive and negative is the same, the final decision will be negative.
-resetActions=Ações para reiniciar
-selectARole=Selecione um role
+assertionConsumerServiceRedirectBindingURLHelp=URL do Binding Redirect SAML para o serviço consumidor de asserções do cliente (respostas de login). Você pode deixar este campo em branco se não tiver uma URL para esse binding.
+policyDecisionStagey=A estratégia de decisão determina como as políticas associadas a uma determinada permissão são avaliadas e como uma decisão final é obtida. 'Afirmativa' significa que pelo menos uma política deve resultar em decisão positiva para que a decisão final também seja positiva. 'Unânime' significa que todas as políticas devem resultar em decisão positiva para que a decisão final também seja positiva. 'Consenso' significa que o número de decisões positivas deve ser maior que o número de decisões negativas. Se o número de positivas e negativas for igual, a decisão final será negativa.
+resetActions=Redefinir Ações
+selectARole=Selecione um papel
 titleAuthentication=Autenticação
 category=Categoria
 batchSize=Tamanho do lote
-usermodel.prop.tooltip=Nome do método da propriedade na interface UserModel. Por exemplo, o valor 'email' iria referenciar o método UserModel.getEmail() .
+usermodel.prop.tooltip=Nome do método da propriedade na interface UserModel. Por exemplo, um valor 'email' referenciaria o método UserModel.getEmail().
 user=Usuário
 times.days=Dias
-providers=Provedores
+providers=Provedores adicionados
+directMembership=Associação direta
+error-invalid-length-too-short='{{0}}' deve ter o tamanho mínimo de {{1}}.
+cancel=Cancelar
+deleteConfirm_other=Tem certeza que deseja excluir estes grupos?
+deletedSuccess=Provedor excluído com sucesso.
+searchAttributes=Buscar atributos
+userID=ID do usuário
+importAdded_zero=Nenhum registro incluído.
+sync-ldap-roles-to-keycloak=Sincronizar papéis do LDAP para o Keycloak
+eventTypes.PERMISSION_TOKEN.name=Token de permissão
+permissionsDisable=Desabilitar permissões?
+secretHasExpired=Segredo expirado, gere um novo clicando no botão "Gerar Novamente" acima
+disableConfirm=Tem certeza de que deseja desativar '{{name}}'
+trusted-hosts.label=Hosts Confiáveis
+createClientPolicy=Criar política de cliente
+persistent=Persistente
+eventTypes.VERIFY_EMAIL.name=Verificar email
+eventTypes.VERIFY_EMAIL.description=Verificar email
+refreshTokenMaxReuseHelp=Número máximo de vezes que um token de atualização pode ser reutilizado. Quando um token diferente for utilizado, a revogação ocorre imediatamente.
+eventTypes.LOGOUT.description=Sair
+clientScopeTypes.default=Padrão
+authenticatorAttachment.platform=Plataforma
+dayMonth=Dia
+residentKey.Yes=Sim
+yes=Sim
+test=Teste
+active=Ativo
+quickLoginCheckMilliSecondsHelp=Se uma falha ocorrer rapidamente de forma concorrente, bloqueie o usuário.
+resetPasswordBtn=Redefinir senha
+Monday=Segunda-feira
+added=Adicionado
+month=Mês
+valueLabel=Valor
+directAccessHelp=Isso habilita o suporte a Concessões de Acesso Direto, o que significa que o cliente tem acesso ao nome de usuário e senha da pessoa e os troca diretamente com o servidor Keycloak por um token de acesso. Em termos da especificação OAuth2, isso habilita o suporte ao 'Resource Owner Password Credentials Grant' para este cliente.
+realmRolesList=Papéis de realm
+authorizationScopeDetailsDescription=Descrição
+authorizationScopeDetailsName=Nome
+alwaysDisplayInUI=Sempre exibir na interface do usuário
+profile=Perfil
+permission=Permissão
+eventTypes.LOGIN.description=Login
+product=Produto
+mapperTypeFullNameLdapMapper=full-name-ldap-mapper
+refreshTokenMaxReuse=Reutilização Máxima do Token de Atualização
+prompts.unspecified=Não especificado
+cibaBackhannelTokenDeliveryModes.poll=Consulta
+buildIn=Integrado
+serviceAccountHelp=Permite autenticar este cliente no Keycloak e obter um token de acesso dedicado a ele. Segundo a especificação OAuth2, isso habilita o suporte ao 'Client Credentials Grant' para este cliente.
+inherent=Herdado
+unlock=Desbloquear
+regenerate=Regerar
+validatorDialogColNames.colDescription=Descrição
+created=Criado
+certSubject=CERT_SUBJECT
+bruteForceStrategy.MULTIPLE=Múltiplo
+clientScopeType.default=Padrão
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
+home=Início
+contentSecurityPolicyReportOnly=Content-Security-Policy-Report-Only
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Erro ao vincular identidade federada
+policyRolesHelp=Clique em "Adicionar papéis" para incluir os papéis aceitos por esta política. Marcar a caixa de seleção "campo obrigatório" em um papel indica que o papel selecionado DEVE estar presente durante a avaliação da política, independentemente das outras funções. Deixar todas os papéis relevantes da política desmarcados é equivalente a definir uma estratégia de decisão como "Afirmativa".
+addLdapWizardTitle=Adicionar provedor de federação de usuários LDAP
+role=Papel
+eventTypes.LOGIN.name=Login
+claims=Claims
+sessionsType.directGrant=Concessão direta
+permit=Permitir
+syncModes.import=Importar
+subtree=Subárvore
+disable=Desativar
+webAuthnPolicyCreateTimeout=Tempo de espera
+comparison=Comparação
+revert=Reverter
+reorder=Reordenar
+mapperTypeHardcodedAttributeMapper=hardcoded-attribute-mapper
+eventTypes.IMPERSONATE.description=Personificar
+refresh=Atualizar
+memory=Memória
+decisionStrategies.CONSENSUS=Consenso
+used.DEFAULT=Padrão
+keystore=Keystore
+syncModes.inherit=Herdado
+group=Grupo
+bruteForceStrategy.LINEAR=Linear
+idpType.custom=Personalizado
+client-updater-source-groups.label=Grupos
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
+path=Caminho
+overwritten=Sobrescrito
+executorName=Nome
+pairwiseSubAlgorithmSalt.label=Salt
+selectMethodType.import=Importar
+residentKey.No=Não
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Erro ao vincular identidade federada
+eventTypes.EXECUTE_ACTIONS.name=Executar ações
+attestationPreference.direct=Direto
+status=Status
+syncModes.force=Forçar
+targetOptions.brokerId=BROKER_ID
+columnName=Nome
+use=Usar
+steps=Etapas
+clientScopeSearch.name=Nome
+eventTypes.RESET_PASSWORD.description=Redefinir senha
+useRefreshTokenForClientCredentialsGrant=Usar tokens de atualização para concessão de credenciais do cliente
+eventTypes.EXECUTE_ACTIONS.description=Executar ações
+showPasswordDataName=Nome
+nameField=Nome
+no=Não
+executeActions=Executar ações
+defaultLanguage=Padrão
+noRoles-client=Nenhum papel para esse cliente
+permissionDecisionStrategyHelp=A estratégia de decisão determina como as políticas associadas a uma determinada permissão são avaliadas e como uma decisão final é obtida. 'Afirmativa' significa que pelo menos uma política deve resultar em decisão positiva para que a decisão final também seja positiva. 'Unânime' significa que todas as políticas devem resultar em decisão positiva para que a decisão final também seja positiva. 'Consenso' significa que o número de decisões positivas deve ser maior que o número de decisões negativas. Se o número de positivas e negativas for igual, a decisão final será negativa.
+Tuesday=Terça-feira
+eventTypes.REGISTER.description=Registro
+transient=Transiente
+clientScopeTypes.none=Nenhum
+requirements.REQUIRED=Obrigatório
+eventTypes.REMOVE_CREDENTIAL.name=Remover credencial
+eventTypes.REMOVE_CREDENTIAL.description=Remover credencial
+aesGenerated=aes-generated
+mapperTypeMsadLdsUserAccountControlMapper=msad-user-account-control-mapper
+decisionStrategies.AFFIRMATIVE=Afirmativa
+resetBtn=Redefinir
+Sunday=Domingo
+reload=Atualizar
+any=Qualquer
+duplicate=Duplicado
+experimental=Experimental
+backchannelLogoutRevokeOfflineSessionsHelp=Especifica se um evento "revoke_offline_access" será incluído no token de logout quando a URL de logout de backchannel for usada. O Keycloak irá revogar sessões offline ao receber um token de logout com esse evento.
+bruteForceMode.Disabled=Desabilitado
+clientScopeType.none=Nenhum
+skipped=Omitidos
+decisionStrategies.UNANIMOUS=Unânime
+clientsList=Lista de clientes
+eventTypes.VALIDATE_ACCESS_TOKEN.description=Validar token de acesso
+cibaBackhannelTokenDeliveryModes.ping=Ping
+inputTypeStep=Tamanho da etapa de entrada
+managePriorityOrder=Gerenciar ordem de prioridade
+clientAssertionAudience=Audiência da asserção do cliente
+userInfoResponseEncryptionContentEncryptionAlgorithm=Algoritmo de criptografia de conteúdo da resposta de informações do usuário
+addressClaim.postal_code.label=Nome do atributo do usuário para código postal
+userVerify.preferred=Preferido
+noDirectUsers=Sem usuários diretos
+samlSignatureKeyNameHelp=Documentos SAML assinados contêm a identificação da chave de assinatura no elemento KeyName. Para Keycloak / RH-SSO, use KEY_ID; para MS AD FS, use CERT_SUBJECT; para outros, verifique e use NONE se nenhuma outra opção funcionar.
+artifactBindingUrlHelp=URL para enviar as mensagens HTTP ARTIFACT. Você pode deixar em branco se estiver usando um binding diferente. Este valor deve ser configurado ao forçar o binding ARTIFACT junto com login iniciado pelo IdP.
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Erro no primeiro login do provedor de identidade
+validRedirectURIsHelp=Padrão de URI válido para o navegador redirecionar após um login bem-sucedido. Coringas simples são permitidos, como 'http://example.com/*'. Caminho relativo também pode ser especificado, como /meu/caminho/relativo/*. Caminhos relativos são relativos à URL raiz do cliente, ou, se nenhuma for especificada, usa-se a URL raiz do servidor de autenticação. Para SAML, é necessário definir padrões de URI válidos se você depender da URL do serviço consumidor embutida na requisição de login.
+updateOtpError=Não foi possível atualizar a política de OTP {{error}}
+serviceProviderEntityId=ID da entidade do provedor de serviço
+internationalizationHelp=Se habilitado, você pode escolher quais localidades suporta para este realm e qual é a localidade padrão.
+emptyMappers=Sem mapeadores
+artifactBindingUrl=URL de binding do Artifact
+dedicatedScopeExplain=Este é um escopo de cliente que inclui os mapeadores e escopo dedicados
+backchannelLogoutUrlHelp=URL que fará com que o cliente se deslogue automaticamente quando uma requisição de logout for enviada para este realm (via end_session_endpoint). O logout é feito enviando um token de logout conforme especificado na especificação de logout de backchannel do OIDC. Se omitido, a requisição de logout pode ser enviada para a 'URL de administração' especificada (se configurada) no formato específico dos adaptadores do Keycloak/RH-SSO. Se nem mesmo a 'URL de administração' estiver configurada, nenhuma requisição de logout será enviada ao cliente.
+error-invalid-value='{{0}}' tem valor inválido.
+backchannelLogoutRevokeOfflineSessions=Revogar sessões offline no logout de backchannel
+clustering=Clusterização
+addStepTo=Adicionada etapa em {{name}}
+clientScopeTypes.optional=Opcional
+OVERWRITE=Sobrescrever
+admin=Administrador
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=Usuário desativado por bloqueio permanente
+times.years=Anos
+close=Fechar
+sessionsType.offline=Offline
+kerberos=Kerberos
+mapperTypeRoleLdapMapper=role-ldap-mapper
+rsa=rsa
+encryption=Criptografia
+syncModes.legacy=Legado
+previous=Anterior
+browse=Navegar
+permissionsScopeName=Nome do escopo
+resultPermit=Resultado-Permitido
+attestationPreference.indirect=Indireta
+search=Pesquisa
+eventTypes.UPDATE_CREDENTIAL.description=Atualizar credencial
+eventTypes.UPDATE_CREDENTIAL.name=Atualizar credencial
+unAssignPolicy=Desatribuir
+userVerify.required=Obrigatório
+backchannelUrlInvalid=URL de logout de backchannel não é uma URL válida
+targetOptions.local=LOCAL
+next=Próximo
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=Usuário desativado por bloqueio permanente
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=Usuário desativado por erro de bloqueio permanente
+columnDisplayName=Nome de exibição
+repeat=Repetir
+NONE=NENHUM
+requirements.DISABLED=Desabilitado
+localization=Localização
+protocolTypes.saml=SAML
+mode=Modo
+minute=Minuto
+unsigned=Não assinado
+requirements.ALTERNATIVE=Alternativa
+supported=Suportado
+targetOptions.brokerUsername=BROKER_USERNAME
+backchannelLogoutUrl=URL de logout de backchannel
+wantAssertionsSignedHelp=Indica se este provedor de serviço espera uma Asserção assinada.
+eventTypes.CUSTOM_REQUIRED_ACTION.description=Ação obrigatória personalizada
+flowName=Nome do fluxo
+searchByRoleName=Pesquisar por nome do papel
+passLoginHint=Passar login_hint
+openIdConnectCompatibilityModesHelp=Esta seção é usada para configurar as definições de compatibilidade com versões anteriores dos adaptadores OpenID Connect / OAuth 2. É especialmente útil se seu cliente utilizar uma versão antiga do adaptador do Keycloak / RH-SSO.
+emptyClientScopes=Este cliente não possui nenhum escopo de cliente adicionado
+eventTypes.CLIENT_UPDATE.name=Atualização de cliente
+addMultivaluedLabel=Adicionar {{fieldLabel}}
+notRepeat=Não repetir
+secretRotated=Secret rotacionado
+displayName=Nome de exibição
+userFedDeleteConfirmTitle=Excluir provedor de federação de usuário?
+userCredentialsHelpTextLabel=Texto de Ajuda das Credenciais do Usuário
+cibaIntervalHelp=O tempo mínimo em segundos que o dispositivo de consumo (CD) deve aguardar entre requisições de polling ao endpoint de token. Se definido como 0, o CD deve usar 5 como valor padrão conforme a especificação CIBA.
+envelopeFrom=Remetente do envelope
+policyUrl=URL da política
+eventTypes.UPDATE_TOTP.name=Atualizar totp
+updateCibaError=Não foi possível atualizar a política CIBA: {{error}}
+rolesPermissionsHint=Determina se permissões granulares estão habilitadas para gerenciar este papel. Desabilitar apagará todas as permissões atuais configuradas.
+passwordPoliciesHelp.regexPattern=Exige que a senha corresponda a um ou mais padrões de expressão regular Java definidos.
+oAuthDPoP=Exigir cabeçalho Demonstrando Prova de Posse (DPoP) em requisições de token
+invalidRealmName=O nome do realm não pode conter caracteres especiais
+realmNameTitle=Realm {{name}}
+subjectNameId=Assunto NameID
+credentialsList=Lista de Credenciais
+userId=ID do usuário
+eventTypes.CLIENT_UPDATE_ERROR.description=Erro ao atualizar cliente
+eventTypes.UPDATE_EMAIL.description=Atualizar email
+invalidateRotatedSecret=Invalidar secret rotacionado?
+whoCanEditHelp=Se habilitado, usuários ou administradores podem visualizar e editar o atributo. Caso contrário, usuários ou administradores não têm acesso para alterar o atributo.
+addressClaim.country.tooltip=Nome do atributo do usuário, que será usado para mapear para o subclaim 'country' dentro do claim 'address' do token. O padrão é 'country'.
+noConsentsText=Os consentimentos serão registrados apenas quando usuários tentarem acessar um cliente configurado para exigir consentimento. Nesse caso, os usuários receberão uma página de consentimento que solicita a autorização de acesso ao cliente.
+addStep=Adicionar etapa
+emptyExecution=Nenhuma etapa
+unmanagedAttributePolicy.DISABLED=Desabilitado
+unmanagedAttributePolicy.ENABLED=Habilitado
+root=Raiz
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=Usuário desativado por erro de bloqueio temporário
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=Usuário desativado por bloqueio temporário
+backchannelLogoutSessionRequired=Sessão de logout de backchannel obrigatória
+attributeDisplayName=Nome de exibição
+delete=Excluir
+hour=Hora
+hmacGenerated=hmac-generated
+deleteBtn=Excluir
+backchannelLogoutSessionRequiredHelp=Especifica se um claim sid (ID da sessão) será incluído no token de logout quando a URL de logout de backchannel for usada.
+global=Global
+xRobotsTag=X-Robots-Tag
+dateTo=Data(até)
+protocolTypes.all=Todos
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=Usuário desativado por erro de bloqueio permanente
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Usuário desativado por bloqueio temporário
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=Usuário desativado por erro de bloqueio temporário
+unAssignRole=Desatribuir
+favicon=Favicon
+dedicatedScopeName={{clientName}}-dedicated
+mapperTypeUserAttributeLdapMapper=user-attribute-ldap-mapper
+unknownUser=Anônimo
+displayHeader=Nome de exibição
+membership=Associação
+unlink=Desvincular
+version=Versão
+cibaInterval=Intervalo
+finish=Finalizar
+validations=Validações
+choose=Selecione...
+algorithm=Algoritmo
+local=Local
+clientProfileSearch=Pesquisa
+always=Sempre
+disabled=Desabilitado
+attribute=Atributo
+results=Resultados
+show=Exibir
+target=Alvo
+reset=Redefinir
+cibaBackchannelTokenDeliveryMode=Modo de Entrega de Token de Backchannel
+documentation=Documentação
+frontchannelLogoutOIDCHelp=Quando verdadeiro, o logout requer que um navegador envie a requisição para o cliente na URL de logout de frontchannel configurada, conforme especificado na especificação de logout de frontchannel do OIDC. Quando falso, o servidor pode realizar uma chamada em segundo plano para o logout, desde que a URL de logout de backchannel ou a URL de administração estejam configuradas.
+policyEnforcementModes.DISABLED=Desabilitado
+error-invalid-email=Endereço de email inválido.
+deprecated=Obsoleto
+mapperTypeHardcodedLdapRoleMapper=hardcoded-ldap-role-mapper
+never=Nunca
+annotations=Anotações
+on=Ligado
+annotationsText=Anotações
+requirements.CONDITIONAL=Condicional
+rsaGenerated=rsa-generated
+keyLabel=Chave
+clientUpdaterTrustedHosts=Hosts Confiáveis
+credentialData=Dados
+data=Dados
+profiles=Perfis
+error-invalid-uri-fragment='{{0}}' é um fragmento da URL inválido.
+error-invalid-number='{{0}}' é um número inválido.
+error-number-out-of-range-too-big='{{0}}' precisa ter um valor máximo de {{2}}.
+error-number-out-of-range-too-small='{{0}}' precisa ter um valor mínimo de {{1}}.
+error-invalid-uri='{{0}}' é uma URL inválida.
+error-person-name-invalid-character='{{0}}' contém caractere inválido.
+error-username-invalid-character='{{0}}' contém caractere inválido.
+referral=Indicação
+welcomeTabTitle=Bem-vindo
+domain=Domínio
+clearButtonTitle=Limpar
+executors=Executores
+deny=Negar
+clientScopeSearch.protocol=Protocolo
+generate=Gerar
+spinnerLoading=Carregando
+titlePermissions=Permissões
+error-invalid-length-too-long='{{0}}' precisa ter um tamanho máximo de {{2}}.
+resourceDetailsTypeHelp=O tipo deste recurso. Pode ser usado para agrupar diferentes instâncias de recurso com o mesmo tipo.
+domains=Domínios
+UNMANAGED=Não gerenciado
+eventTypes.UPDATE_CONSENT.description=Atualizar consentimento
+realmSaveSuccess=Realm atualizado com sucesso
+selectOne=Selecione uma opção
+createFlowHelp=Você pode criar um fluxo de nível superior dentro deste formulário.
+updateErrorIdentityProvider=Não foi possível atualizar o provedor {{error}}
+forgotPassword=Esqueci a senha
+scopeTypeHelp=Escopos de cliente, que serão adicionados como escopos padrão a cada cliente criado
+Thursday=Quinta-feira
+Friday=Sexta-feira
+noGroups=Nenhum grupo
+origin=Origem
+clientScopeType.optional=Opcional
+clientUpdaterSourceGroups=Grupos
+off=Desligado
+or=ou
+otpSupportedApplications.totpAppFreeOTPName=FreeOTP
+mapperTypeCertificateLdapMapper=certificate-ldap-mapper
+started=Iniciado
+preview=Pré-visualização
+help=Ajuda
+mapperTypeMsadUserAccountControlManager=msad-user-account-control-mapper
+language=Linguagem
+translationKey=Chave
+verifiableCredentialsEnabled=Credenciais Verificáveis
+authenticationTypeTokenAuth=Token
+policy=Política
+assignedPolicyType.user=Usuário
+cpu=CPU
+selectMethodType.generate=Gerar
+template=Modelo
+keys=Chaves
+Saturday=Sábado
+transientUser=Transiente
+multivalued=Múltiplos valores
+translationsTableHeading=Traduções
+organization=Organização
+displayDescription=Descrição de exibição
+clientScopesRolesScope=Se não houver mapeamento de escopo de papel definido, cada usuário terá permissão para usar este escopo de cliente. Se houver mapeamentos de escopo de papel definidos, o usuário deve ser membro de pelo menos um dos papéis.
+error-number-out-of-range='{{0}}' deve ser um número entre {{1}} e {{2}}.
+emptyUserOrganizations=Nenhuma organização
+linkError=Não foi possível vincular provedor à organização devido a: {{error}}
+send=Enviar
+somethingWentWrongDescription=Desculpe, ocorreu um erro inesperado.
+somethingWentWrong=Alguma coisa deu errado
+tryAgain=Tente novamente
+MANAGED=Gerenciado
+usersResources=Usuários
+groupsResources=Grupos
+evaluation=Avaliação
+authenticationTypeBasicAuth=Senha
+permissionPoliciesHelp=Especifica todas as políticas que devem ser aplicadas à permissão.
+userInitiatedActionLifespanHelp=Tempo máximo antes que uma ação solicitada por um usuário (como um email de recuperação de senha) expire. Este valor é recomendado ser curto, pois espera-se que o usuário aja rapidamente a uma ação criada por ele mesmo.
+clearFileExplain=Tem certeza de que deseja limpar este arquivo?
+userModelAttribute=Atributo de modelo de usuário
+eventTypes.LOGOUT_ERROR.name=Erro de logout
+passwordPolicyHintsEnabledHelp=Aplicável apenas para MSAD com permissão de gravação. Se ativado, a atualização da senha do usuário MSAD usará a extensão LDAP_SERVER_POLICY_HINTS_OID, o que significa que políticas avançadas de senha do MSAD, como 'histórico de senhas' ou 'idade mínima da senha', serão aplicadas. Esta extensão funciona apenas para MSAD 2008 R2 ou mais recente.
+resetPasswordAllowed=Esqueci a senha
+expirationValueNotValid=Valor precisa ser maior que ou igual a 1
+eventTypes.UPDATE_CONSENT.name=Atualizar consentimento
+forceArtifactBinding=Forçar binding de artefato
+columnDisplayDescription=Descrição de exibição
+client-updater-trusted-hosts.label=Hosts confiáveis
+rolesScope=Se não houver mapeamento de escopo de papel definido, cada usuário terá permissão para usar este escopo de cliente. Se houver mapeamentos de escopo de papel definidos, o usuário deve ser membro de pelo menos um dos papéis.
+eventTypes.UPDATE_TOTP.description=Atualizar totp
+userProfile=Perfil de usuário
+eventTypes.LOGOUT_ERROR.description=Erro de logout
+eventTypes.REFRESH_TOKEN_ERROR.name=Erro de token de atualização
+clientTypeHelp='OpenID Connect' permite que os Clientes verifiquem a identidade da Pessoa Final com base na autenticação realizada por um Servidor de Autorização. 'SAML' possibilita cenários de autenticação e autorização web, incluindo login único (SSO) entre domínios, e usa tokens de segurança contendo asserções para transmitir informações.
+updateError=Não foi possível atualizar o provedor {{error}}
+jumpToSection=Ir para a seção
+emailVerification=Verificação de email
+eventTypes.UPDATE_EMAIL.name=Atualizar email
+otpSupportedApplications.totpAppGoogleName=Google Authenticator
+userVerify.discouraged=Desencorajado
+setup=Configuração
+assign=Atribuir
+select=Selecionar
+advanced=Avançado
+hide=Esconder
+claim=Claim
+ms=milisegundos
+plus=Mais
+keyID=KEY_ID
+spi=SPI
+Wednesday=Quarta-feira
+mapperTypeGroupLdapMapper=group-ldap-mapper
+recent=Recente
+resultDeny=Resultado-Negado
+ecdsaGenerated=ecdsca-generated
+conditions=Condições
+minus=Menos
+confirm=Confirmar
+dateFrom=Data(de)
+javaKeystore=java-keystore
+internationalization=Internacionalização
+invalidateSecret=Invalidar
+rename=Renomear
+link=Vincular
+error-empty=Por favor, especifique um valor de '{{0}}'.
+error-invalid-blank=Por favor, especifique um valor de '{{0}}'.
+error-invalid-date='{{0}}' é uma data inválida.
+error-invalid-length='{{0}}' precisa ter um tamanho entre {{1}} e {{2}} caracteres.
+error-user-attribute-required=Por favor, informe '{{0}}'.
+locales=Localidades
+theme=Tema
+addTranslationDialogOkBtn=Ok
+organizationsEnabled=Organizações
+organizations=Organizações
+organizationsList=Organizações
+searchOrganization=Buscar por organização
+emptyOrganizations=Nenhuma organização
+error-invalid-uri-scheme='{{0}}' tem um esquema de URL inválido.
+logo=Logo
+error-user-attribute-read-only=O campo {{0}} é somente leitura.
+unlinkError=Não foi possível desvincular provedor de identidade da organização: {{error}}
+error-pattern-no-match='{{0}}' não corresponde ao formato exigido.
+error-invalid-multivalued-size=O atributo {{0}} deve ter no mínimo {{1}} e no máximo {{2}} valor(es).
+emptyUserOrganizationsInstructions=Ainda não há nenhuma organização. Por favor, junte-se a uma organização ou envie um convite para participar de uma organização.
+otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+syncRegistrationsHelp=Novos usuários devem ser criados dentro do armazenamento LDAP? A prioridade afeta qual provedor será escolhido para sincronizar o novo usuário. Esta configuração é aplicada efetivamente apenas com o modo de edição GRAVÁVEL.
+eventTypes.REFRESH_TOKEN_ERROR.description=Erro de token de atualização
+SKIP=Pular
+translationTableColumnName=Tradução
+clientsResources=Clientes
+assertionLifespan=Tempo de vida da asserção
+cibaExpiresIn=Expira em
+profilesConfigType=Configurar via:
+tokenLifespan.expires=Expira em
+clientScopeList=Escopos de cliente
+kid=Kid
+credentialUserLabel=Rótulo de usuário
+eventTypes.INVALID_SIGNATURE.name=Assinatura inválida
+dependentPermission=Permissão dependente
+disableNonce=Desabilitar nonce
+duplicateFlow=Duplicar fluxo
+editAttribute=Editar atributo
+clientScopes=Escopos de cliente
+loadingRealms=Carregando realms…
+requiredActionPlaceholder=Selecionar ação
+searchInitialAccessToken=Pesquisar token
+guiOrder=Ordem de exibição
+realmNameField=Nome do realm
+specificClients=Clientes específicos
+unmanagedAttributes=Atributos não gerenciados
+inputTypeCols=Colunas de entrada
+lifespan=Expira em
+used.SPECIFIC_CLIENTS=Clientes específicos
+freeMemory=Memória livre
+diagramView=Visão de diagrama
+editFlow=Editar fluxo
+deleteUser=Excluir usuário
+includeClients=Incluir clientes
+eventTypes.PERMISSION_TOKEN.description=Token de permissão
+policiesConfigType=Configurar via:
+groupDeleted_one=Grupo excluído
+showLess=Exibir menos
+addValidator=Adicionar validador
+welcome=Bem-vindo ao
+bindCredentials=Vincular credenciais
+logoutSettings=Configurações de logout
+realmName=Nome do realm
+joinGroup=Entrar no grupo
+eventTypes.CLIENT_UPDATE.description=Atualização de cliente
+displayOrder=Ordem de exibição
+eventTypes.INVALID_SIGNATURE.description=Assinatura inválida
+deleteConfirmUsers=Excluir usuário?
+selectAttribute=Selecionar atributo
+clientsExplain=Clientes são aplicações e serviços que podem solicitar a autenticação de um usuário.
+learnMore=Saiba mais
+realmSettingsExplain=As configurações do realm são definições que controlam as opções para usuários, aplicações, papéis e grupos no realm atual.
+userFederationExplain=A federação de usuários fornece acesso a bancos de dados e diretórios externos, como LDAP e Active Directory.
+roleExplain=Papéis de realm são os papéis que você define para uso no realm atual.
+authenticationExplain=Autenticação é a área onde você pode configurar e gerenciar diferentes tipos de credenciais.
+currentRealm=Realm atual
+manageRealms=Gerenciar realms
+deleteConfirmRealm_other=Exclur {{count}} realms?
+createRealm=Criar realm
+providerInfo=Informações de provedores
+eventExplain=Eventos são registros de eventos de usuários e eventos administrativos neste realm. Para configurar o rastreamento desses eventos, vá para <1>Configurações de eventos</1>.
+saveRealmError=Não foi possível criar realm {{error}}
+clientRegistration=Registro de cliente
+groupsDescription=Um grupo é um conjunto de atributos e mapeamentos de papéis que podem ser aplicados a um usuário. Você pode criar, editar e excluir grupos, além de gerenciar sua organização pai-filho.
+sessionExplain=Sessões são as sessões dos usuários neste realm e os clientes que eles acessam dentro da sessão.
+listExplain=Provedores de identidade são redes sociais ou intermediários de identidade que permitem que usuários se autentiquem no Keycloak.
+usersExplain=Usuários são os usuários do realm atual.
+clientScopeExplain=Escopos de cliente são um conjunto comum de mapeadores de protocolo e papéis que são compartilhados entre vários clientes.
+setAsDefaultAction=Definir como ação padrão
+welcomeText=O Keycloak fornece federação de usuários, autenticação forte, gerenciamento de usuários, autorização com controle refinado e muito mais. Adicione autenticação a aplicações e proteja serviços com o mínimo de esforço. Não é necessário lidar com armazenamento ou autenticação de usuários.
+viewDocumentation=Consulte a documentação
+clearCachesTitle=Limpar caches
+welcomeTo=Bem-vindo ao {{realmDisplayInfo}}
+viewGuides=Ver guias
+realmInfo=Informações do realm
+readBlog=Leia o blog
+joinCommunity=Participar da comunidade
+loggedInAsTempAdminUser=Você está conectado como um usuário administrador temporário. Para reforçar a segurança, crie uma conta de administrador permanente e exclua a temporária.
+updateFirstLogin=Atualizar primeiro login
+flowUsedBy=Uso deste fluxo
+updateExecutorSuccess=Executor atualizado com sucesso
+ldapAttributeHelp=Nome do atributo mapeado no objeto LDAP. Por exemplo: 'cn', 'sn', 'mail', 'street', etc.
+claimFilterNameHelp=Nome do claim essencial
+revocationDescription=Esta é uma forma de revogar todas as sessões ativas e tokens de acesso. "Não antes de" significa que você pode revogar qualquer token emitido antes da data especificada.
+eventTypes.CODE_TO_TOKEN_ERROR.description=Erro de código para token
+eventTypes.CODE_TO_TOKEN_ERROR.name=Erro de código para token
+termsOfServiceUrl=URL dos termos de serviço
+requestObject.request_uri\ only=Apenas URI de request
+addressClaim.street.label=Nome do Atributo de Usuário para Logradouro
+applyToResourceTypeFlag=Aplicar ao tipo de recurso
+testError=Erro ao tentar conectar no LDAP: '{{error}}'
+groupObjectClassesHelp=Classe (ou classes) do objeto de grupo. Separe com vírgulas se forem necessárias várias classes. Em uma implantação LDAP típica, pode ser 'groupOfNames'. No Active Directory, geralmente é 'group'.
+filterByClients=Filtrar por clientes
+createPolicyOfType=Criar política {{policyType}}
+flowUsedByDescription=Este fluxo é usado pelo seguinte {{value}}
+createClientScope=Criar escopo de cliente
+expireTimeHelp=Define o horário após o qual a política NÃO DEVE ser concedida. Só será concedida se a data/hora atual for anterior ou igual a esse valor.
+noRolesInstructions-roles=Você não criou nenhum papel neste realm. Crie um papel para começar.
+editIdPMapper=Editar Mapeador de Provedor de Identidade
+unmanagedAttributesHelpText=Atributos não gerenciados são atributos de usuário que não estão explicitamente definidos na configuração do perfil de usuário. Por padrão, os atributos não gerenciados estão como `Desativado` e não ficam disponíveis em nenhum contexto, como registro, conta e console de administração. Ao definir como `Ativado`, os atributos não gerenciados são totalmente reconhecidos pelo servidor e acessíveis em todos os contextos, útil ao migrar um realm existente para o perfil de usuário declarativo sem ter ainda todos os atributos definidos na configuração. Ao definir como `Somente administradores podem escrever`, os atributos não gerenciados podem ser gerenciados apenas pelo console de administração e API, útil quando há atributos personalizados que usuários podem alterar, mas deseja-se restringir novos atributos apenas aos administradores. Ao definir como `Somente administradores podem visualizar`, os atributos não gerenciados são somente leitura e acessíveis apenas pelo console de administração e API.
+unmanagedAttributePolicy.ADMIN_VIEW=Somente administradores podem visualizar
+unmanagedAttributePolicy.ADMIN_EDIT=Somente administradores podem escrever
+confirmPasswordDoesNotMatch=Senha e confirmação não correspondem.
+eventTypes.DELETE_ACCOUNT_ERROR.description=Erro ao excluir conta
+passwordPoliciesHelp.length=O número mínimo de caracteres exigidos para a senha.
+removeImportedUsersSuccess=Usuários importados foram removidos.
+eventTypes.VERIFY_PROFILE_ERROR.name=Erro ao verificar perfil
+authnContextClassRefsHelp=Lista ordenada de AuthnContext ClassRefs solicitados.
+useLowerCaseBearerType=Usar o tipo bearer em letras minúsculas nas respostas de token
+useRfc9068AccessTokenType=Usa "at+jwt" como tipo de cabeçalho de token de acesso
+ldapAttributeNameHelp=Nome do atributo LDAP que será adicionado ao novo usuário durante o registro.
+createAGroup=Criar um grupo
+effectiveProtocolMappersHelp=Contém todos os escopos de cliente padrão e os escopos opcionais selecionados. Todos os mapeadores de protocolo e mapeamentos de escopo de papéis desses escopos de cliente serão utilizados ao gerar o token de acesso emitido para seu cliente.
+exportSuccess=Realm exportado com sucesso.
+scopePermissions.groups.manage-description=Políticas que decidem se um administrador pode gerenciar esse grupo
+testClusterFail=Falha ao verificar a disponibilidade de: {{failedNodes}}. Corrija ou desregistre os nós com falha no cluster e tente novamente
+queryExtensions=Consultar Extensões Suportadas
+signingKeysConfig=Configuração das chaves de assinatura
+validateBindDn=Você precisa informar o DN do administrador do LDAP
+addedGroupMembership=Associação a grupo adicionada
+resourceDeletedSuccess=O recurso excluído com sucesso
+useRefreshTokensHelp=Se esta opção estiver ativada, um refresh_token será criado e adicionado à resposta do token. Se estiver desativada, nenhum refresh_token será gerado.
+getStarted=Para começar, selecione um provedor da lista abaixo.
+signedJWTConfirm=Gere uma chave privada e um certificado para o cliente na aba Chaves.
+searchAdminEventsBtn=Pesquisar eventos administrativos
+deleteDialogDescription=Tem certeza de que deseja excluir permanentemente o grupo de atributos <1>{{group}}</1>?
+importResourceSuccess=O recurso foi importado com sucesso
+deleteNodeBody=Tem certeza de que deseja excluir permanentemente o nó "{{node}}"
+usersAdded_one={{count}} usuário(s) adicionado(s) ao grupo
+resourcesAndScopes=Recursos e Escopos
+eventTypes.UPDATE_CONSENT_ERROR.description=Erro ao atualizar consentimento
+eventTypes.UPDATE_CONSENT_ERROR.name=Erro ao atualizar consentimento
+overrideActionTokensHelp=Substitui as configurações padrão de tempo máximo antes que uma ação permitida enviada por um usuário (como um e-mail de recuperação de senha) expire, para uma ação específica. Este valor é recomendado ser curto, pois espera-se que o usuário aja rapidamente a uma ação criada por ele mesmo.
+searchByName=Pesquisar por nome
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ro.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ro.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ro.properties
@@ -0,0 +1 @@
+
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ru.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ru.properties
index f158df370d0b..eda9d942d12e 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ru.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_ru.properties
@@ -1,612 +1,3497 @@
-otpTypeHelp=totp является Временным одноразовым паролем. 'hotp' основанный на счетчике одноразовый пароль в котором сервер хранит счетчик хеша.
-duplicateEmails=Дублирующиеся E-mail
-useKerberosForPasswordAuthentication=Использовать Kerberos для аутентификации по паролю
+cancel=Отмена
+deleteConfirm_other=Вы уверены, что хотите удалить эти группы?
+trusted-hosts.label=Доверенные Хосты
+deletedSuccess=Поставщик успешно удален.
+searchAttributes=Атрибуты поиска
+userID=ID пользователя
 anyResource=Любой ресурс
-themes=Темы
-addClientScope=Добавить шаблон клиента
-clientType='OpenID connect' разрешает клиентам проверить личность конечного пользователя, основанного на  выполнении аутентификации на Сервере Авторизации.'SAML' включает веб-сценарии аутентификации и авторизации, включая кроссдоменные центры единого управления доступом (SSO) и использующие токены безопасности, содержащие заявления на передачу информации.
+importAdded_zero=Записи не добавлены.
+createClientPolicy=Создать клиентскую политику
 clientSignature=Подпись клиента обязательна
-unanimous=Единогласная
-policy-name=Название этой политики.
-clientHelp=Выберите клиента, осуществляющего авторизационный запрос. Если не задан, авторизационные запросы будут основаны на том клиенте, в котором вы находитесь.
-debugHelp=Включить/выключить отладочные логи в стандартный вывод для Krb5LoginModule.
-validatorColNames.colConfig=Конфигурация
-disabledFeatures=Отключенные функции сервера
-nodeHost=Хост узла
-quickLoginCheckMilliSeconds=Если попытки аутентификации происходят слишком часто, то пользователя необходимо заблокировать.
-unspecified=неопределенный
-signOut=Выход
-active=Активные
-validatorDialogColNames.colName=Наименование роли
+persistent=Постоянный
+sync-ldap-roles-to-keycloak=Синхронизировать роли LDAP с Keycloak
+eventTypes.PERMISSION_TOKEN.name=Токен разрешения
+permissionsDisable=Отключить разрешения?
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Ошибка ссылки на федеративную идентификацию
+secretHasExpired=Срок действия секретного ключа истек, пожалуйста, создайте новый, нажав кнопку "Регенерировать" выше
+policyRolesHelp=Нажмите "Добавить роли", чтобы включить принятые роли для этой политики. Отметка флажка "обязательное поле" для роли означает, что выбранная роль ДОЛЖНА присутствовать при оценке политики, независимо от других ролей. Если не отмечать все соответствующие роли для политики, это эквивалентно установке стратегии принятия решения "Утвердительно".
+addLdapWizardTitle=Добавить поставщика федерации пользователей LDAP
+wantAssertionsSignedHelp=Указывает, ожидает ли данный поставщик услуг подписанное утверждение.
+disableConfirm=Вы уверены, что хотите отключить '{{name}}'
+eventTypes.CUSTOM_REQUIRED_ACTION.description=Пользовательское требуемое действие
+flowName=Название сценария
+userInfoResponseEncryptionContentEncryptionAlgorithm=Алгоритм шифрования содержимого ответа информации пользователя
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Ошибка первого входа в систему поставщика удостоверений
+searchByRoleName=Поиск по названию роли
 credentialType=Тип
-certificateHelp=Клиентский сертификат для валидации JWT, выпущенный клиентом и подписанный клиентским приватным ключом из Вашего хранилища ключей.
-forcePostBindingHelp=Всегда использовать POST Binding для ответов.
-roleName=Наименование роли
-operationType=Тип операции
+passLoginHint=Передайте login_hint
+openIdConnectCompatibilityModesHelp=Этот раздел используется для настройки параметров обратной совместимости со старыми адаптерами OpenID Connect / OAuth 2. Это особенно полезно, если ваш клиент использует старую версию адаптера Keycloak / RH-SSO.
+emptyClientScopes=У этого клиента нет добавленных клиентских областей
 httpPostBindingAuthnRequestHelp=Указывает, должны ли AuthnRequest быть посланы, используя привязку HTTP-POST. Если нет, то будет использован HTTP-REDIRECT.
 policyEnforcementMode=Режим применения политик
-decisionStrategy=Стратегия решения
-requestObjectSignatureAlgorithmHelp=JWA алгоритм, который необходим клиенту для использования во время отсылки OIDC запроса объекта, специфицированного по 'request' или 'request_uri' параметрам. Если установлено в 'any', то объект запроса будет подписан любым алгоритмом (включая 'none' ).
-requiredUserActionsHelp=Требует действий от пользователя когда он входит. 'Подтвердить E-mail' высылает письмо пользователю для подтверждения его E-mail. 'Обновить профиль' требует от пользователя ввести новую персональную информацию. 'Обновить пароль' требует от пользователя ввести новый пароль. 'Настроить OTP' требует установить мобильное приложение генерации паролей.
-securityDefences=Защита безопасности
-realmSettings=Настройки Realm
-deleteEvents=Очистить события
-includeOneTimeUseConditionHelp=Должно ли условие одноразового использования быть включено в ответе на вход?
-accessTokenLifespanHelp=Максимальное время действия токена доступа. Значение рекомендуется устанавливать как можно ближе к таймауту SSO.
-redirectURIHelp=Этот uri перенаправления используется в том случае, если сконфигурирован поставщик идентификации.
-displayName=Дружелюбное имя для провайдеров идентификации.
-resourcePath=Путь к ресурсу
-applyToResourceTypeHelp=Определяет, будет ли это разрешение будет применено ко всем ресурсам с данным типом. В этом случае это разрешение будет вычисляться для всех экземпляров с заданным типом ресурса.
-attestationPreference.none=нет
-useJwksUrlHelp=Если включено, то публичные ключи поставщиков идентификации будет скачаны с заданного JWKS URL. Это дает дополнительную гибкость, так как новые ключи скачиваются каждый раз когда поставщик идентификации создает новую пару. Если выключено, то будут использованы публичные ключи (или сертификат) из базы данных Keycloak, и в случае изменений пары на поставщике идентификации вам будет необходимо каждый раз импортировать новые ключи в базу данных Keycloak.
-pairwiseSubAlgorithmSalt.label=Соль
-revocation=Отзыв
-clientDescriptionHelp=Задает описание клиента. Например 'Мой клиент для табеля учета времени'. Поддерживает ключи для локализованных значений. Например\: ${my_client_description}
-clientAuthenticator=Проверка подлинности клиента
-useEntityDescriptor=Импортировать метаданные из удаленного дескриптора сущностей IDP SAML.
-loginActionTimeout=Таймаут действий по входу
-updateFirstLoginHelp=Обновить профиль при первом входе
-validRedirectURIs=Валидирует паттерн URI, на который может быть перенаправлен браузер после успешного входа или выхода. Разрешены простые ссылки, напр. 'http\://example.com/*'. Также допускается использовать относительный путь, напр. '/my/relative/path/*'. Относительные пути необходимо указывать относительно корневого URL клиента, или, если он не специфицирован, корневого URL сервера авторизации. Для SAML Вы должны задать валидный паттерн URI, если Вы полагаетесь на URL сервиса потребителя, внедренного в запрос авторизации.
-assertionConsumerServicePostBindingURL=Привязка URL POST-запроса для сервиса подтверждения потребителей
-removeImported=Удалить импортированных
+eventTypes.CLIENT_UPDATE.name=Обновление клиента
+addMultivaluedLabel=Добавить {{fieldLabel}}
+notRepeat=Не повторять
+secretRotated=Секретный ключ обновлен
+userFedDeleteConfirmTitle=Удалить поставщика федерации пользователей?
+userCredentialsHelpTextLabel=Текст справки по учетным данным пользователя
+role=Роль
+displayName=Имя для провайдеров идентификации
+applyToResourceTypeHelp=Определяет, будет ли это разрешение применено ко всем ресурсам с данным типом. В этом случае это разрешение будет вычисляться для всех экземпляров с заданным типом ресурса.
+cibaIntervalHelp=Мин. время в секундах, которое CD (Consumption Device) должно ждать между запросами опроса к точке доступа токена. Если установлено значение 0, CD должно использовать 5 в качестве значения по умолчанию согласно спецификации CIBA.
+envelopeFrom=Обратный адрес
+eventTypes.UPDATE_TOTP.name=Обновление TOTP
+updateCibaError=Не удалось обновить политику CIBA: {{error}}
+policyUrl=URL-адрес политики
+clientDescriptionHelp=Задает описание клиента. Например 'Мой клиент для табеля учета времени'. Поддерживает ключи для локализованных значений. Например\: ${my_client_description}.
+rolesPermissionsHint=Определяет, включены ли детальные разрешения для управления этой ролью. Отключение удалит все текущие разрешения, которые были настроены.
+passwordPoliciesHelp.regexPattern=Требуется, чтобы пароль соответствовал одному или нескольким определенным шаблонам регулярных выражений Java.
+oAuthDPoP=Требовать заголовок "Подтверждение владения" (Demonstrating Proof of Possession - DPoP) в запросах токенов
+invalidRealmName=Имя realm не может содержать специальные символы
+validRedirectURIsHelp=Допустимый шаблон URI, на который браузер может перенаправить после успешного входа в систему. Разрешены простые подстановочные знаки, такие как 'http://example.com/*'. Также можно указать относительный путь, например /my/relative/path/*. Относительные пути указываются относительно корневого URL клиента, или, если ничего не указано, используется корневой URL сервера аутентификации. Для SAML необходимо задать допустимые шаблоны URI, если вы полагаетесь на URL-адрес службы потребителя, встроенный в запрос на вход в систему.
+realmNameTitle={{name}} realm
+subjectNameId=NameID субьекта
+credentialsList=Список полномочий
 usermodel.clientRoleMapping.clientId.label=ID клиента
-endpoints=Конечные точки
 clientId=ID клиента
-validatingX509CertsHelp=Сертификат в формате PEM, который должен быть использован для проверки подписи.
+serviceProviderEntityId=Идентификатор поставщика услуг
+internationalizationHelp=Если эта функция включена, вы можете выбрать, какие локали вы поддерживаете для этого realm и какая локаль будет использоваться по умолчанию.
+managePriorityOrder=Управление приоритетным порядком
 contextualAttributesHelp=Любой аттрибут определяется запущенным окружением или контекстом исполнения.
-importFile=Импортировать файл
-clientLoginTimeoutHelp=Максимальное время клиента для завершения протокола access token. Обычно устанавливается равным 1-ой минуте.
-protocolHelp=Какая конфигурация протокола SSO будет поддержана шаблоном клиента
-lastAccess=Последний доступ
-uiDisplayName=Наименование в консоли
-prompts.none=нет
-resourcesHelp=Определяет, что это разрешение должно быть применено к конкретному экземпляру ресурсов.
-adminEventsSettings=Настройки событий администратора
-passwordConfirmation=Подтверждение пароля
-emailVerified=Подтверждение E-mail
-Thursday=Четверг
-times.minutes=минут
-disableUserInfo=Отключить информацию о пользователе
+clientLoginTimeoutHelp=Макс. время клиента для завершения протокола access token. Обычно устанавливается равным 1-ой минуте.
+emptyMappers=Преобразователи отсутствуют
+artifactBindingUrlHelp=URL для отправки сообщений HTTP ARTIFACT. Вы можете оставить это поле пустым, если используете другую привязку. Это значение должно быть установлено при принудительной привязке ARTIFACT вместе с инициированным IdP входом.
+artifactBindingUrl=URL-адрес привязки артефакта
+clientsList=Список клиентов
+userId=ID пользователя
+eventTypes.CLIENT_UPDATE_ERROR.description=Ошибка обновления клиента
+eventTypes.UPDATE_EMAIL.description=Обновить электронную почту
+eventTypes.VALIDATE_ACCESS_TOKEN.description=Проверить токен доступа
+dedicatedScopeExplain=Это клиентская область, которая включает в себя выделенные преобразователи и область действия
+updateOtpError=Не удалось обновить политику OTP: {{error}}
 addressClaim.postal_code.label=Имя пользовательского атрибута, обозначающего Почтовый индекс
-forcePostBinding=Принудительно использовать POST Binding
 defaultRoles=Роли по умолчанию
-discoveryEndpoint=Импорт метаданных из дескриптора развертывания удаленного поставщика идентификации.
-countHelp=Определяет, как много клиентов может быть создано с помощью этого токена
-otpPolicyPeriod=Период токена OTP
-addressClaim.country.tooltip=Имя пользовательского атрибута, которое будет использоватлься для сопоставления атрибута 'country' внутри атрибута 'address' токена. По умолчанию 'country' .
+samlSignatureKeyNameHelp=Подписанные документы SAML содержат идентификацию ключа подписи в элементе KeyName. Для контрагента Keycloak / RH-SSO используйте KEY_ID, для MS AD FS используйте CERT_SUBJECT, для других проверьте и используйте NONE, если ни один другой вариант не работает.
+clientScopeTypes.default=По умолчанию
+invalidateRotatedSecret=Аннулировать обновленный секретный ключ?
+noDirectUsers=Нет прямых пользователей
+whoCanEditHelp=Если включено, пользователи или администраторы могут просматривать и редактировать атрибут. В противном случае пользователи или администраторы не имеют доступа для записи в атрибут.
+eventTypes.LOGIN.name=Авторизоваться
+addressClaim.country.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления сабклейма 'country' внутри 'address' токен клейма. По умолчанию 'country'.
 uuidLdapAttribute=Атрибут UUID в LDAP
-topLevelFlowType=Какой это тип сценария верхнего уровня? Тип "клиент" используется для аутентификации клиентов (приложений), когда "общий" для пользователей и всего остального
-scopeNameHelp=Наименование шаблона клиента. Должно быть уникально для realm
-Monday=Понедельник
+scopeNameHelp=Имя client scope. Должно быть уникально для realm. Имя не должно содержать пробелов, так как оно используется как значение scope параметра.
 requiredUserActions=Требуемые действия от пользователя
-flowTypeHelp=Какого типа эта форма
-consentRequired=Если включено, пользователи должны дать согласие на доступ клиентскому приложению.
+noConsentsText=Согласия будут регистрироваться только тогда, когда пользователи попытаются получить доступ к клиенту, настроенному на утверждение согласия. В этом случае пользователи получат страницу согласия, на которой их попросят предоставить доступ к клиенту.
+addStep=Добавить шаг
+clientAssertionAudience=Audience для утверждения клиента
+permissionPoliciesHelp=Указывает все политики, которые должны применяться к разрешению.
+userInitiatedActionLifespanHelp=Макс. время до истечения срока действия разрешения на действие, отправленного пользователем (например, сообщение о забытом пароле). Рекомендуется, чтобы это значение было коротким, поскольку ожидается, что пользователь быстро отреагирует на самостоятельно созданное действие.
+clearFileExplain=Вы уверены, что хотите очистить этот файл?
+userModelAttribute=Атрибут модели пользователя
+eventTypes.LOGOUT_ERROR.name=Ошибка выхода из системы
 allowRemoteResourceManagement=Удаленное управление ресурсами
-standardFlow=Включает стандартное OpenID Connect перенаправление, основанное на аутентификации с кодом авторизации. В терминах OpenID Connect или OAuth2 спецификаций включает 'Authorization Code Flow' для этого клиента.
-identityProvider=Поставщик идентификации
-eventListeners=Слушатели событий
-bindDn=Сопоставление DN
-Friday=Пятница
-identityProviderLinks=Ссылки поставщика идентификации
-leave=Покинуть
+syncRegistrationsHelp=Должны ли новые пользователи создаваться в хранилище LDAP? Приоритет влияет на то, какой поставщик выбирается для синхронизации нового пользователя. Эта настройка эффективно применяется только в режиме редактирования WRITABLE.
+resetPasswordAllowed=Забыли пароль
+emptyExecution=Никаких шагов
+passwordPolicyHintsEnabledHelp=Применимо только для MSAD с возможностью записи. Если включено, то обновление пароля пользователя MSAD будет использовать расширение LDAP_SERVER_POLICY_HINTS_OID, что означает, что будут применены расширенные политики паролей MSAD, такие как "история паролей" или "минимальный срок действия пароля". Это расширение работает только для MSAD 2008 R2 или более поздних версий.
+expirationValueNotValid=Значение должно быть больше или равно 1
+eventTypes.UPDATE_CONSENT.name=Обновление согласия
+forceArtifactBinding=Силовое связывание артефактов
+eventTypes.REFRESH_TOKEN_ERROR.description=Ошибка обновления токена
 eventTypes.IMPERSONATE.name=Имперсонировать
-wantAuthnRequestsSigned=Ожидание подписи AuthnRequests
-usermodel.attr.tooltip=Имя сохраненного атрибута пользователя, которое является именем атрибута, согласованным с UserModel.attribute.
+updateFirstLogin=Обновить первый вход
+columnDisplayDescription=Показать описание
+flowUsedBy=Использование этого сценария
+client-updater-trusted-hosts.label=Надежные хосты
+updateExecutorSuccess=Исполнитель успешно обновлен
+ldapAttributeHelp=Имя сопоставленного атрибута на объекте LDAP. Например, 'cn', 'sn', 'mail', 'street' и т. д.
+assertionLifespan=Продолжительность жизни утверждения
 export=Экспорт
-fineGrainOpenIdConnectConfiguration=Тонкая настройка конфигурации OpenID Connect
-addressClaim.formatted.label=Имя пользовательсокого атрибута, обозначающего Формитированный адрес
-add=Добавить
+claimFilterNameHelp=Название основного клейма
+revocationDescription=Это способ отозвать все активные сессии и токены доступа. Не раньше означает, что вы можете отозвать любые токены, выпущенные до даты.
+eventTypes.CODE_TO_TOKEN_ERROR.description=Ошибка кода токена
+termsOfServiceUrl=URL-адрес условий обслуживания
+requestObject.request_uri\ only=Запросить только URI
 passwordPolicy=Политики пароля
-backchannelLogout=Backchannel Logout
+backchannelLogout=Выход через back-channel
 addressClaim.street.label=Имя пользовательского атрибута, обозначающего Улицу
-count=Счетчик
-testAuthentication=Проверка аутентификации
-prompts.login=вход
-users=Пользователи
+rolesScope=Если сопоставление области действия ролей не определено, каждому пользователю разрешено использовать эту клиентскую область действия. Если сопоставления области действия ролей определены, пользователь должен быть членом хотя бы одной из ролей.
+applyToResourceTypeFlag=Применить к типу ресурса
 offlineSessionIdleHelp=Допустимое время бездействия оффлайн сессии. Вам необходимо использовать оффлайн токен для обновления хотя бы раз за этот период, иначе сессия истечет.
-uris=URI, который также может быть использован для уникальной идентификации этого ресурса.
-forceNameIdFormatHelp=Игнорирует запрошенный формат заголовка NameID и использует сконфигурированный через консоль администратора.
-month=Месяц
-addressClaim.region.tooltip=Имя пользовательского атрибута, которое  будет использоваться для сопоставления атрибута 'region' внутри атрибута 'address' токена. По умолчанию 'region' .
-port=Порт
-expiration=Истечение
-realmRolePrefix=Префикс ролей Realm
-logoutServicePostBindingURL=URL для выхода из сервиса в привязанном POST-методе
-jwksUrlHelp=URL, где клиентские ключи хранятся в формате JWK. Для дополнительных деталей смотрите спецификацию JWK. Если Вы будете использовать адаптер клиента keycloak с учетными записями "jwt", то Вы можете использовать URL вашего приложения с суффиксом '/k_jwks'. Например 'http\://www.myhost.com/myapp/k_jwks' .
+eventTypes.UPDATE_TOTP.description=Обновление TOTP
+testError=Ошибка при попытке подключения к LDAP: '{{error}}'
+groupObjectClassesHelp=Класс объекта (или классы) объекта группы. Разделяется запятыми, если требуется больше классов. В типичном развертывании LDAP это может быть "groupOfNames". В Active Directory это обычно "group".
+filterByClients=Фильтр по клиентам
+claims=Утверждения
+createPolicyOfType=Создать политику {{policyType}}
+realmRolePrefix=Префикс ролей realm
+flowUsedByDescription=Этот сценарий используется следующим {{value}}
+createClientScope=Создать область действия клиента
 includeRepresentation=Включить представление
-assertionConsumerServicePostBindingURLHelp=URL-адрес SAML POST запроса для клиентских сервисов подтверждения потребителей (запросы входа). Вы можете оставить это поле пустым, если не имеете URL для осуществления такой приввязки.
-resourceTypes=Типы ресурсов
+expireTimeHelp=Определяет время, после которого политика НЕ ДОЛЖНА быть предоставлена. Предоставляется только если текущая дата/время раньше или равны этому значению.
 singleLogoutServiceUrl=Адреса сервиса единого выхода
-roles=Роли
-includeInUserInfo.label=Добавить в информацию о пользователе
-back=Назад
-validateSignatureHelp=Включить/выключить проверку подписей внешних поставщиков идентификации.
-policyCode=Код JavaScript, предоставляющий условия для этой политики.
-title=Аутентификация
-verifyEmail=Подтверждение E-mail
+noRolesInstructions-roles=Вы не создали ни одной роли в этом realm'е. Создайте роль, чтобы начать.
+editIdPMapper=Изменить сопоставление поставщиков удостоверений
 representation=Представление
 remove=Удалить
-addressClaim.locality.label=Имя пользовательского атрибута, обозначающего Местонахождение
-formatOption=Формат
-loginTheme=Тема страницы входа
+userProfile=Профиль пользователя
+unmanagedAttributes=Неуправляемые атрибуты
+unmanagedAttributesHelpText=Неуправляемые атрибуты — это атрибуты пользователя, которые явно не определены в конфигурации профиля пользователя. По умолчанию неуправляемые атрибуты "Отключены" и недоступны из любого контекста, например регистрации, учетной записи и консоли администрирования. При установке значения "Включено" неуправляемые атрибуты полностью распознаются сервером и доступны во всех контекстах. Это полезно, если вы начинаете перенос существующей области в декларативный профиль пользователя и у вас еще не определены все атрибуты пользователя в конфигурации профиля пользователя. Если установить "Запись разрешена только администраторам", неуправляемыми атрибутами можно будет управлять только через консоль администрирования и API. Это полезно, если вы уже определили какой-либо настраиваемый атрибут, которым могут управлять пользователи, но не уверены в необходимости добавления других атрибутов, которыми должны управлять только администраторы. Если установить "Просмотр разрешен только администраторам", неуправляемые атрибуты будут доступны только для чтения и только через консоль администрирования и API.
+unmanagedAttributePolicy.DISABLED=Отключено
+unmanagedAttributePolicy.ENABLED=Включено
+unmanagedAttributePolicy.ADMIN_VIEW=Только администраторы могут просматривать
+unmanagedAttributePolicy.ADMIN_EDIT=Только администраторы могут писать
+confirmPasswordDoesNotMatch=Пароли не совпадают.
+eventTypes.DELETE_ACCOUNT_ERROR.description=Ошибка удаления учетной записи
 provider=Поставщик
 flows=Сценарии
-scope=Область
-nodeReRegistrationTimeout=Таймаут узла перерегистрации
-client=клиент
-includeRepresentationHelp=Включить JSON представление для запросов на создание и обновление.
-connectionURL=URL соединения
-loginWithEmailHelpText=Разрешает пользователям входить с помощью E-mail.
-accessTokenLifespan=Продолжительность жизни токена доступа
-setToNow=Установить на сейчас
+passwordPoliciesHelp.length=Мин. количество символов, необходимое для пароля.
+root=Основной
+removeImportedUsersSuccess=Импортированные пользователи были удалены.
+eventTypes.VERIFY_PROFILE_ERROR.name=Ошибка проверки профиля
 signAssertionsHelp=Должны ли утверждения внутри SAML документов быть подписаны? Устанавливает отсутствие необходимости подписывать уже подписанные документы.
-firstBrokerLoginFlowAliasOverrideHelp=Синоним сценария аутентификации, который срабатывает после первого входа с этого поставщика идентификации. Термин 'First Login' означает, что еще не существует учетной записи Keycloak связанной с аутентифицированной учетной записью поставщика идентификации.
-owner=Владелец
+authnContextClassRefsHelp=Упорядоченный список запрошенных AuthnContext ClassRefs.
+sessionsType.directGrant=Прямой доступ
 validateSignature=Проверка подписей
-implicitFlow=Включает поддержку OpenID Connect перенаправления, основанного на аутентификации без кода авторизации. В терминах OpenID Connect или OAuth2 спецификаций включает поддержку 'Implicit Flow' для этого клиента.
+useLowerCaseBearerType=Используйте тип носителя строчными буквами в ответах токенов
+useRfc9068AccessTokenType=Используйте "at+jwt" в качестве типа заголовка токена доступа
 headers=Заголовки
-encryptAssertions=Зашифровка утверждений
-keyAliasHelp=Синоним архива для Вашего приватного ключа и сертификата.
-tokenClaimName.tooltip=Имя переменной при добавлении ее в токен. Может быть полное имя, например 'address.street'. В таком случае будет создан вложенный json объект.
-userName=Имя пользователя
-clientProfileDescription=Описание
+ldapAttributeNameHelp=Имя атрибута LDAP, который будет добавлен новому пользователю при регистрации.
+createAGroup=Создать группу
+effectiveProtocolMappersHelp=Содержит все клиентские области по умолчанию и выбранные необязательные области. Все сопоставления протоколов и сопоставления областей ролей всех этих клиентских областей будут использоваться при генерации токена доступа, выпущенного для вашего клиента.
+exportSuccess=Realm успешно экспортирован.
+scopePermissions.groups.manage-description=Политики, которые определяют, может ли администратор управлять этой группой
+testClusterFail=Не удалось проверить доступность для: {{failedNodes}}. Исправьте или отмените регистрацию неисправных узлов кластера и попробуйте снова
+eventExplain=События — это записи событий пользователя и администратора в этой области. Чтобы настроить отслеживание этих событий, перейдите в <1>Конфигурации событий</1>.
+queryExtensions=Запрос поддерживаемых расширений
+signingKeysConfig=Конфигурация ключей подписи
+validateBindDn=Вам необходимо ввести DN администратора LDAP
+addedGroupMembership=Добавлено членство в группе
+resourceDeletedSuccess=Ресурс успешно удален
 userObjectClasses=Классы объектов пользователя
-ssoSessionMax=Максимальное время до того, как истечет сессия. По истечении этого времени токены и браузерные сессии становятся невалидными.
-policyRoles=Задайте роли клиента, допущенные этой политикой.
-accountLinkingOnlyHelp=Если установлено, то пользователи не смогут войти через этого провайдера.  Только устанавливает связь к этому провайдеру. Используется, если вы не хотите разрешать вход через этого провайдера, но хотите с этим провайдером иметь интеграцию.
-optimizeLookup=Оптимизация REDIRECT поиска подписанного ключа
+useRefreshTokensHelp=Если это включено, refresh_token будет создан и добавлен в ответ токена. Если это выключено, refresh_token не будет сгенерирован.
+getStarted=Для начала выберите поставщика из списка ниже.
 times.hours=часов
-browserFlowHelp=Выберите сценарий, который вы хотите использовать для аутентификации через браузер.
-temporaryLocked=Пользователь может быть заблокирован в случае многократных неудачных попыток входа.
+signedJWTConfirm=Сгенерируйте закрытый ключ и сертификат для клиента на вкладке "Ключи".
+permit=Разрешать
 webOrigins=Web источники
-realm=Realm
-prompt=Подсказка
-username=Имя пользователя
-showAuthData=Показать авторизационные данные
-importConfig=Импорт метаданных со скачанного дескриптора развертывания удаленного поставщика идентификации.
-includeInUserInfo.tooltip=Должно ли требование быть добавлено в информацию о пользователе?
-unlinkUsers=Отвязать пользователей
-initialCounter=Начальное значение счетчика
-revokeRefreshTokenHelp=Если включено, то токены обновления могут быть использованы один раз. Иначе токен отзываться не будет и может использоваться многократно.
+searchAdminEventsBtn=Поиск событий администратора
+deleteDialogDescription=Вы уверены, что хотите навсегда удалить группу атрибутов <1>{{group}}</1> ?
+importResourceSuccess=Ресурс был успешно импортирован
+inputTypeCols=Входные столбцы
+eventTypes.LOGOUT.description=Выйти
+deleteNodeBody=Вы уверены, что хотите окончательно удалить узел "{{node}}"
+lifespan=Истекает через
 storedTokensReadableHelp=Включено/выключено чтение новыми пользователями любых сохраненных токенов. Это назначается ролью broker.read-token.
-authenticationFlowTypeHelp=Какого типа эта форма
-authorization=Включить/Выключить тонко-настраиваемую поддержку авторизации для клиента
+authenticationFlowTypeHelp=Какого типа эта форма?
+usersAdded_one={{count}} пользователь добавлен в группу
+resourcesAndScopes=Ресурсы и области применения
 editUsernameHelp=Если включено,то имя пользователя можно будет отредактировать, иначе оно будет доступным только для чтения.
-consoleDisplayConnectionUrlHelp=URL соединения с вашим сервером LDAP
-bindCredentialsHelp=Пароль администратора LDAP
-action=Действие
-id=ID
-join=Присоединиться
-fullScopeAllowedHelp=Отключает все ограничения.
+eventTypes.UPDATE_CONSENT_ERROR.description=Ошибка согласия на обновление
+overrideActionTokensHelp=Переопределить настройки по умолчанию макс. времени до истечения срока действия разрешения на действие, отправленного пользователем (например, сообщение о забытом пароле), для определенного действия. Рекомендуется, чтобы это значение было коротким, поскольку ожидается, что пользователь быстро отреагирует на самостоятельно созданное действие.
+searchByName=Поиск по имени
+executorTypeSwitchHelpText=Текст справки переключателя типа исполнителя
+attributeConsumingServiceNameHelp=Имя профиля службы потребления атрибутов для рекламы в метаданных SP.
+overrideActionTokens=Переопределение токенов действий
+deleteGrantsError=Ошибка удаления доступов: {{error}}
+defaultGroupAdded_other=Добавлено {{count}} групп в группы по умолчанию
+used.SPECIFIC_CLIENTS=Конкретные клиенты
+freeMemory=Свободная память
 applyPolicy=Применить политику
-otpType=Тип одноразового пароля OTP
+userFedDeleteConfirm=Если вы удалите этого поставщика федерации пользователей, все связанные с ним данные будут удалены.
 directGrantHelp=Выберите сценарий, который вы хотите использоваться для аутентификации direct grant.
-scopesHelp=Области, которые будут посланы после запроса авторизации. Это может быть список областей, разделенных пробелом. По умолчанию 'openid'.
-includeAuthnStatement=Включать Аутентификационные Заявки
-jsonType.tooltip=Тип переменной в JSON, который должен использоваться при добавлении ее в токен. Допустимые значения long, int, boolean, и String.
-multivalued.tooltip=Отображается, если атрибут поддерживает несколько значений. Если включен, то список всех значений будет претендовать на этот атрибут. В противном случае выбираться будет только первое значение
+unlockUsersSuccess=Все временно заблокированные пользователи теперь разблокированы
+jsonType.tooltip=Тип переменной в JSON клейм, который должен использоваться при добавлении ее в токен. Допустимые значения long, int, boolean, и String.
+emptyPrimaryAction=Добавить предопределенное сопоставление
+enableClientSignatureRequired=Включить "Требуется подпись клиента"?
+supportedApplicationsHelp=Приложения, которые, как известно, работают с текущей политикой OTP.
 enableStartTLS=Включить StartTLS
-enableStartTls=Включить StartTLS
-addIdPMapper=Добавить сопоставление поставщика учетных записей
-eventType=Тип события
+syncModeOverride=Переопределение режима синхронизации
+addAssociatedRolesError=Не удалось связать роли {{error}}
+removeUserText=Хотите удалить {{numSelected}} пользователей? Эти пользователи больше не будут иметь разрешений роли {{role}} и связанных с ней ролей.
+diagramView=Вид диаграммы
+removeImportedUsers=Удалить импортированных пользователей?
 accountLinkingOnly=Только связывание учетной записи
-sectorIdentifierUri.label=Сектор идентификации URI
-homeURL=Используемый URL по умолчанию. Используется в случае, если серверу требуется перенаправление или обратная ссылка на клиента.
-firstBrokerLoginFlowAlias=Сценарий первого входа
+clientPoliciesPoliciesHelpText=Политика клиента позволяет связывать клиентские профили с различными условиями, чтобы указать, когда принудительное поведение задается исполнителями конкретного клиентского профиля.
+anyClient=Условие выполняется любым клиентом на любом событии.
+editFlow=Редактировать сценарий
+noDefaultGroupsInstructions=Группы по умолчанию позволяют автоматически назначать членство в группе всякий раз, когда создается или импортируется новый пользователь в ходе <1>посредничества по идентификации.</1>. Добавьте группы по умолчанию, чтобы начать.
+tokenSaveSuccess=Создан новый начальный токен доступа
 usermodel.attr.label=Атрибут пользователя
 eventTypes.REGISTER.name=Регистрация
-rememberMeHelpText=Показать чекбокс на странице входа, чтобы разрешить пользователю запомнить вход в учетную запись в случае если браузерная сессия устареет.
-usernameLdapAttribute=Атрибут Username в LDAP
-evaluate=Оценка
-status=Статус
-ssoServiceUrl=Адрес сервиса единой точки входа
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=Пользователь отключен постоянной блокировкой
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=Пользователь отключен из-за постоянной ошибки блокировки
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=Пользователь отключен из-за временной блокировки
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=Пользователь отключен из-за ошибки временной блокировки
+deleteUser=Удалить пользователя
+addedNodeSuccess=Узел успешно добавлен
+eventTypes.INTROSPECT_TOKEN_ERROR.description=Ошибка интроспекции токена
+webAuthnPolicyUserVerificationRequirementHelp=Сообщает аутентификатору, требуется ли проверка пользователя.
+syncModes.import=Импорт (Import)
+realmSaveError=Не удалось обновить realm: {{error}}
+authDataDescription=Представляет токен, несущий данные авторизации в результате обработки запроса авторизации. Это представление в основном то, что Keycloak выдает клиентам, запрашивающим разрешение. Проверьте клейм `authorization` на предмет разрешений, которые были предоставлены на основе текущего запроса авторизации.
 allowRemoteResourceManagementHelp=Должны ли ресурсы управляться удаленно сервером ресурсов? Если нет, то ресурсы могут управляться только через консоль администратора.
-clients=Клиенты
+generatedAccessTokenIsDisabled=Сгенерированный токен доступа отключается, если не выбран ни один пользователь
+addNewProvider=Добавить нового провайдера
+userInfoResponseEncryptionKeyManagementAlgorithm=Алгоритм управления ключами шифрования ответа на информацию пользователя
 changedUsersSyncPeriod=Период синхронизации измененных пользователей
-clientName=Имя
+keystoreHelp=Путь к файлу ключей
 userRegistration=Самостоятельная регистрация пользователей
 save=Сохранить
-login=вход
-maxDeltaTimeSeconds=Время сброса неудачных попыток
-backchannelLogoutHelp=Поддерживает ли внешний IDP backchannel logout?
-usermodel.realmRoleMapping.rolePrefix.tooltip=Префикс для каждой роли Realm (опционально).
-affirmative=Утвердительная
-changedUsersSyncHelp=Период для синхронизации измененных или вновь созданных пользователей LDAP в секундах
-trustEmailHelp=Если включено, то E-mail, предоставленный этим поставщиком не будет подтвержденным даже если подтверждение включено для realm.
-maxFailureWaitSecondsHelp=Максимальное время, на которое пользователь будет заблокирован.
-userInfoSignedResponseAlgorithm=Алгоритм подписи ответа информации о пользователе
-maxDeltaTimeSecondsHelp=Через какое время счетчик неудачных попыток будет сброшен?
-adminURLHelp=URL для доступа к интерфейсу администратора в заданном клиенте. Необходимо установить, если клиент поддерживает адаптер REST API. Это REST API разрешает серверу авторизации слать политики отзыва и прочие административные задачи. Обычно устанавливается значение, соответствующее базовому URL клиента.
-otpPolicyPeriodHelp=Сколько секунд токен OTP должен быть действителен? По умолчанию 30 секунд.
-contentSecurityPolicy=Content-Security-Policy
-storePasswordHelp=Пароль для доступа в сам архив
-frontchannelLogoutHelp=Когда правила, выход требует перенаправить браузер на клиента. Если ложь, сервер выполняет фоновый режим для выхода из системы.
+helpFileUploadClient=Загрузите файл JSON или XML
+generateSuccess=Новая пара ключей и сертификат успешно сгенерированы
+userAttributeValueHelp=Значение, которое вы хотите жестко закодировать
+whoCanViewHelp=Если включено, пользователи или администраторы могут просматривать атрибут. В противном случае пользователи или администраторы не имеют доступа к атрибуту.
+eventTypes.IDENTITY_PROVIDER_LOGIN.description=Вход в систему поставщика удостоверений
+includeClients=Включить клиентов
+copySuccess=Успешно скопировано в буфер обмена!
+eventTypes.LOGOUT_ERROR.description=Ошибка выхода из системы
+clientProfilesHelp=Профили клиентов, применяемые к данной политике.
+deleteClientPolicyError=Не удалось удалить политику: {{error}}
+selectAttribute=Выберите атрибут
+resourceAttributeHelp=Атрибуты, связанные с ресурсом.
+updateCredentialUserLabelSuccess=Метка пользователя успешно изменена.
+product=Продукт
+credentialUserLabel=Метка пользователя
+passwordPoliciesHelp.passwordBlacklist=Предотвращает использование пароля, находящегося в файле черного списка.
+bindTypeHelp=Тип метода аутентификации, используемого во время операции привязки LDAP. Используется в большинстве запросов, отправляемых на сервер LDAP. В настоящее время доступны только механизмы "none" (анонимная аутентификация LDAP) или "simple" (аутентификация по учетным данным привязки + по паролю привязки).
+whoWillAppearPopoverText=Группы иерархичны. При выборе прямого членства вы видите только дочернюю группу, к которой присоединился пользователь. Родительские группы не включены.
+eventTypes.VERIFY_EMAIL.description=Подтвердить адрес электронной почты
+eventTypes.REFRESH_TOKEN_ERROR.name=Ошибка обновления токена
+partialImportHeaderText=Частичный импорт позволяет импортировать пользователей, клиентов и другие ресурсы из ранее экспортированного файла JSON.
+disableSuccess=Провайдер успешно отключен
+validatingPublicKeyIdHelp=Явный идентификатор проверочного открытого ключа, указанного выше, если идентификатор ключа. Оставьте пустым, если указанный выше ключ должен использоваться всегда, независимо от идентификатора ключа, указанного внешним IDP; установите его, если ключ должен использоваться только для проверки соответствия идентификатора ключа от внешнего IDP.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Ошибка учетной записи привязки поставщика удостоверений
+subtree=Поддерево
 userFederation=Федерация пользователей
-directAccess=Включает поддержку Direct Access Grants, которая означает, что клиент имеет доступ к имени пользователя и пароля и обменивает их напрямую с сервером Keycloak на токен доступа. В терминах OAuth2 спецификации означает поддержку 'Resource Owner Password Credentials Grant' для этого клиента.
-disable=Отключено
+effectiveRoleScopeMappingsHelp=Выбранные необязательные клиентские области, которые будут использоваться при выдаче токена доступа для этого клиента. Выше вы можете увидеть, какое значение параметра OAuth Scope необходимо использовать, когда вы хотите, чтобы эти необязательные клиентские области применялись при отправке начального запроса аутентификации OpenID Connect с вашего клиентского адаптера.
+disable=Отключить
+membershipLdapAttribute=Атрибут LDAP членства
+availableIdPs=Доступные поставщики удостоверений
+updateClientConditionSuccess=Состояние успешно обновлено.
 attributes=Атрибуты
-logic=Логика
-scopes=Области
-principalType=Тип идентификации
-resourceType=Тип ресурса
-flowType=Тип сценария
+roleDeleteConfirmDialog=Это действие навсегда удалит роль "{{selectedRoleName}}". Это действие нельзя отменить.
+clientDelete=Удалить {{clientId}} ?
+userDeletedSuccess=Пользователь был удален
+revokeClientScopesTitle=Отозвать все предоставленные клиентские области?
+contentSecurityPolicyReportOnlyHelp=Для тестирования политик безопасности контента <1>Узнать больше</1>
+eventTypes.PERMISSION_TOKEN.description=Токен разрешения
+allow-default-scopes.label=Разрешить области действия по умолчанию
 minuteHelp=Определяет минуту, в которую политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущая минута равна или находится между заданными значениями.
-policyEnforcementModes.PERMISSIVE=Разрешающая
-auth=Аутентификация
-accessTokenLifespanImplicitFlow=Продолжительность жизни токена доступа для Implicit Flow
-scopeName=Уникальное имя для области. Имя может быть использовано для уникальной идентификации области, используется при запросах конкретных областей.
-userInfoUrlHelp=Url информации о пользователе. Это поле опционально.
-remainingCount=Счетчик остатка
-kc.realm.name=Realm
-download=Скачать
-authScopes=Области авторизации
-impersonate=Имперсонировать
+updateCibaSuccess=Политика CIBA успешно обновлена
+newRoleNameHelp=Новое имя роли. Новый формат имени соответствует тому, где в токене доступа будет сопоставлена роль. Таким образом, новое имя 'myapp.newname' сопоставит роль с этой позицией в токене доступа. Новое имя 'newname' сопоставит роль с ролями realm в токене.
+mapperTypeFullNameLdapMapper=full-name-ldap-mapper
+searchUserByAttributeMissingKeyError=Укажите ключ атрибута
+eventTypes.INVALID_SIGNATURE.name=Недействительная подпись
+topLevelFlowTypeHelp=Какой это тип сценария верхнего уровня? Тип "клиент" используется для аутентификации клиентов (приложений), тогда как "generic" — для пользователей и всего остального.
+authDetailsHelp=Экспортируйте и загрузите все настройки ресурсов для этого сервера ресурсов.
+policyProvider.regex=Определите условия регулярных выражений для ваших разрешений.
+clientImportError=Не удалось импортировать клиента: {{error}}
 members=Члены
-host=Сервер
-optimizeLookupHelp=При подписи SAML документов при REDIRECT сопоставлении с SP, который обеспечивается безопасностью адаптера Keycloak, должен ли включать ID подписанного ключа в сообщение по протоколу SAML в <Extensions> элемент? Это оптимизирует валидацию сигнатуры, где в качестве проверки используется один ключ вместо попытки проверки каждого ключа во время валидации.
-registration-access-token=Токен доступа к регистрации обеспечивает доступ для клиентов к сервису регистрации клиентов.
-adminURL=URL администрирования приложения
-settings=Настройки
-failureFactorHelp=Количество неудачных попыток входа до блокировки пользователя.
-addressClaim.region.label=Имя пользовательского атрибута, обозначающего Регион
+scopePermissions.clients.token-exchange-description=Политики, которые определяют, каким клиентам разрешено обменивать токены на токен, предназначенный для этого клиента.
+realmCertificateAliasHelp=Сертификат Realm также хранится в архиве. Это его псевдоним.
+scopePermissions.roles.map-role-client-scope-description=Политики, которые определяют, может ли администратор применять эту роль к области действия клиента
+createIdentityProviderError=Не удалось создать поставщика удостоверений: {{error}}
+eventTypes.SEND_VERIFY_EMAIL_ERROR.description=Ошибка отправки письма подтверждения
+deleteClientPolicyConfirm=Это действие навсегда удалит политику {{policyName}}. Это не может быть отменено.
+cibaAuthRequestedUserHint=Подсказка пользователя, запрошенная аутентификация
+samlKeysExportError=Не удалось экспортировать ключи из-за: {{error}}
+webAuthnPolicyCreateTimeout=Тайм-аут
+comparison=Сравнение
+passwordPoliciesHelp.digits=Количество цифр, необходимое в строке пароля.
+deletedSuccessClientScope=Область действия клиента удалена
+notAllowedToDeleteAllClientScopes=Вам не разрешено удалять все клиентские области.
+columnDisplayName=Отображаемое имя
+noUsersFoundErrorStorage=Пользователи не найдены, возможно, это связано с неправильно настроенным федеративным провайдером {{error}}
+lookAround=Окно поиска
 storeTokensHelp=Включено/выключено хранение токенов после аутентификации пользователя.
-singleLogoutServiceUrlHelp=Url, который должен быть использован для отправленных запросов на выход.
-ipAddress=IP адрес
-useTruststoreSpi=Использование доверенных сертификатов SPI
-storeTokens=Хранение токенов
-usermodel.clientRoleMapping.rolePrefix.tooltip=Префикс для каждой роли клиента (опционально).
-includeInIdToken.label=Добавить в токен ID
-browserFlow=Сценарий браузера
-anyScope=Любая область
-serverInfo=Информация о сервере
-Sunday=Воскресенье
-emailThemeHelp=Выберите тему для E-mail, которые будут отсылаться с сервера.
-principalTypeHelp=Определяет, каким образом Keycloak идентифицирует внешних пользователей по SAML-сообщению. По умолчанию идентификация происходит по Subject NameID, в качестве альтернативы можно использовать атрибут-идентификатор.
-Wednesday=Среда
+revert=Вернуть
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=Поставщик удостоверений извлекает токен
+dependentPermission=Зависимое разрешение
+disableNonce=Отключить одноразовый номер
+disableTypeClaimCheck=Отключить проверку типа клейма
+addAssociatedRolesSuccess=Добавлены ассоциированные роли
+groupDeleted_one=Группа удалена
+userHelp=При желании выберите пользователя, для которого будет сгенерирован пример токена доступа. Если вы не выберете пользователя, пример токена доступа не будет сгенерирован во время оценки.
+loginScreenCustomization=Настройка экрана входа
+policiesConfigType=Настроить через:
+exportWarningTitle=Экспортируйте с осторожностью
 emailVerifiedHelp=Должен ли пользователь подтверждать свой E-mail?
+duplicateFlow=Дублировать сценарий
 addExecution=Добавить исполнение
-editMode=Режим редактирования
-consents=Согласия
-canonicalization=Метод канонизации
-SSOSessionMax=Ограничение сессии SSO
+noSearchResultsInstructions=Нажмите на строку поиска выше, чтобы повторить поиск
+addedNodeFail=Не удалось добавить узел: '{{error}}'
 groupMembership=Членство в группах
-minimumQuickLoginWaitSecondsHelp=Как долго ждать после неудачной попытки быстрого входа.
-code=Код
-fullSyncPeriod=Период полной синхронизации
-addNode=Добавить узел
-jwksUrl=JWKS URL
-policy-description=Описание этой политики.
-keys=Ключи
+maxLength=Макс. длина {{length}}
+prompts.unspecified=Не указано
+revokeClientScopes=Вы уверены, что хотите отозвать все предоставленные клиентские области для {{clientId}}?
+cibaBackhannelTokenDeliveryModes.poll=Опрос
 policies=Политики
-signatureKeyName=Наименование ключа сигнатуры SAML
-certificate=Сертификат
-importClient=Импортировать клиента
-selectRole.label=Выберите роль
+parentClientScope=Область действия родительского клиента
+reorder=Изменить порядок
 allTypes=Все типы
-prompts.consent=согласие
+backchannelLogoutSessionRequired=Требуется выход из сесии back-channel
 ldapFilter=LDAP фильтр
-hour=Час
-connectionTimeoutHelp=Таймаут соединения с LDAP в миллисекундах
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=Ошибка запроса на авторизацию
+editAttribute=Изменить атрибут
+webAuthnPolicyRpEntityNameHelp=Удобочитаемое имя сервера как WebAuthn Relying Party
 postBrokerLoginFlowAlias=Сценарий после входа
-tokens=Токены
-save-admin-eventsHelp=Если включено, то события администратора будет сохранены в базу данных, что сделает их доступными через консоль администратора.
-encryptAssertionsHelp=Должны ли SAML утверждения быть зашифрованы публичным ключом клиента, используя AES?
-policyGroups=Задайте, какие пользователи допущены этой политикой.
-on=Вкл
+refreshTokenMaxReuse=Макс. повторное использование токена обновления
+partialExportHeaderText=Частичный экспорт позволяет экспортировать конфигурацию realm и другие связанные ресурсы в файл JSON.
+clientScopes=Области применения клиента
+loadingRealms=Загрузка realm'ов…
+eventTypes.SEND_RESET_PASSWORD_ERROR.description=Отправить сброс пароля ошибка
 httpPostBindingLogout=Привязывание HTTP-POST для выхода
-serviceAccount=Разрешает Вам аутентифицировать этого клиента в Keycloak и получить токен доступа специально для этого клиента. В терминах OAuth2 спецификации включает поддержку 'Client Credentials Grant' для этого клиента.
-requirement=Требования
-assertionConsumerServiceRedirectBindingURL=Привязка URL-адреса переадресации для сервиса подтверждения потребителей
-loginThemeHelp=Выберите тему для страниц входа, временного одноразового пароля (OTP), выдачи разрешений, регистрации и восстановления пароля.
+updateTranslationSuccess=Успешно! Перевод обновлен.
 permissionDescription=Описание этого разрешения.
+policyClientHelp=Указывает, какие клиенты разрешены этой политикой.
 multivalued.label=Несколько значений
-minute=Минута
-useJwksUrl=Использовать JWKS URL
-initialAccessToken=Токен первичного доступа
-vendorHelp=LDAP поставщик (провайдер)
-addressClaim.country.label=Имя пользовательского атрибута, обозначающего Страна
-clustering=Кластеризация
-applyToResourceType=Применить к типу ресурса
+buildIn=Встроенный
+roleCreateExplain=Это некоторое описание
+scopePermissions.identityProviders.token-exchange-description=Политики, определяющие, каким клиентам разрешено обменивать токены на внешний токен, выпущенный данным поставщиком удостоверений.
+algorithmNotSpecified=Алгоритм не указан
+jwtX509HeadersEnabled=Добавить заголовки X.509 в JWT
 rememberMe=Запомнить меня
 flow.registration=Сценарий регистрации
+flow.firstBrokerLogin=Процесс входа в систему первого брокера
+showLess=Показать меньше
 registeredClusterNodes=Зарегистрированные узлы кластера
-selectRole.tooltip=Введите роль в текстовом поле слева, или нажмите на кнопку, чтобы выбрать желаемую роль.
+connectionAndAuthenticationSettings=Настройки подключения и аутентификации
+deleteConfirmUsers=Удалить пользователя?
 storePassword=Пароль хранилища
-logoutServiceRedirectBindingURLHelp=SAML переадресует на привязанный URL для единой точки выхода из сервиса для клиентов. Если Вы используете другие привязки, то можете остаавить это поле пустым.
 defaultGroups=Группы по умолчанию
+eventTypes.TOKEN_EXCHANGE_ERROR.name=Ошибка обмена токеном
 flow.browser=Сценарий браузера
-editModeLdapHelp=READ_ONLY означает доступ только на чтение из LDAP. WRITABLE означает, что данные будут обратно синхронизированы в LDAP по заявке. UNSYNCED означает, что данные пользователя будут импортированы, но не синхронизированы обратно в LDAP.
-addressClaim.street.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'street_address' внутри атрибута 'address' токена. По умолчанию 'street' .
-Saturday=Суббота
-includeInIdToken.tooltip=Должно ли значение быть добавлено в токен ID?
-save-user-eventsHelp=Если включено, то события будут сохранены в базу данных, что сделает их доступными администратору и консоли управления учетной записью.
+unlinkUsersSuccess=Отключение пользователей завершено успешно.
+addressClaim.street.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'street_address' внутри атрибута 'address' токен клейма. По умолчанию 'street'.
+webAuthnPolicyCreateTimeoutHint=Время ожидания должно быть от 0 секунд до 8 часов.
+addValidator=Добавить валидатор
+attributeImporter=Импортировать объявленный атрибут SAML, если он существует в утверждении, в указанное свойство или атрибут пользователя.
+userInfoSettings=Настройки информации пользователя
+createAttributeError=Ошибка! Конфигурация профиля пользователя не сохранена {{error}}.
 password=Пароль
-httpPostBindingResponseHelp=Указывает, необходоимо ли отвечать на завпросы, используя привязку HTTP-POST. Если не задано, то будет использован HTTP-REDIRECT.
-allowPasswordAuthentication=Разрешить аутентификацию по паролю
-composite=Составная
-hourHelp=Определяет час, в который политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущий час равен или находится между заданными значениями.
-pairwiseSubAlgorithmSalt.tooltip=Соль, используемая для вычисления парного субъекта идентификатора. Если поле не заполнено, то соль будет сгенерирована.
+eventTypes.VERIFY_EMAIL.name=Подтвердить адрес электронной почты
+httpPostBindingResponseHelp=Указывает, необходимо ли отвечать на запросы, используя привязку HTTP-POST. Если не задано, то будет использован HTTP-REDIRECT.
+artifactBindingResponseHelp=Указывает, следует ли отвечать на запросы с использованием привязки ARTIFACT. Если false, будет оцениваться конфигурация привязки HTTP-POST.
+mapperTypeHardcodedAttributeMapper=hardcoded-attribute-mapper
+eventTypes.IMPERSONATE.description=Выдавать себя за другого
+forbidden_other=Запрещено, требуются разрешения:
 clientAuthorization=Авторизация
-waitIncrementSecondsHelp=Если порог ошибок превышен, сколько времени пользователь будет заблокирован?
-allowKerberosAuthentication=Разрешить аутентификацию Kerberos
-addressClaim.formatted.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'formatted' внутри атрибута 'address' токена. По умолчанию 'formatted' .
-createPermission=Создать полномочия
+identityProvidersPermissionsHint=Определяет, включены ли детальные разрешения для управления этой ролью. Отключение удалит все текущие разрешения, которые были настроены.
+removeMappingConfirm_other=Вы уверены, что хотите удалить {{count}} ролей
+kerberosWizardDescription=Здесь нужен текст.
+welcome=Добро пожаловать в
 events=События
+importHelp=Импортируйте JSON-файл, содержащий настройки авторизации для этого сервера ресурсов.
 mapperType=Тип сопоставления
-edit=Редактировать
-testConnection=Тест соединения
-archiveFormat=Формат архивации
-credentialResetConfirm=Послать письмо
-kerberosRealm=Kerberos Realm
-flow.direct\ grant=Сценарий Direct Grant Flow
-associatedRolesText=Ассоциированные роли
-defaultLocale=Язык по умолчанию
-clientIdHelp=Идентификатор клиента, зарегистрированный с помощью поставщика идентификации.
+importResources=Будут импортированы следующие настройки и данные:
+validateConnectionUrl=Вам необходимо ввести URL-адрес подключения
+attributeConsumingServiceIndexHelp=Индекс профиля службы потребления атрибутов для запроса во время аутентификации.
+clientSessionSettings=Настройки сессии клиента
+cibaAuthRequestedUserHintHelp=Способ идентификации конечного пользователя, для которого запрашивается аутентификация. В настоящее время поддерживается только "login_hint".
+leaveGroupConfirmDialog_other=Вы уверены, что хотите удалить {{username}} из {{count}} выбранных групп?
+createTokenHelp=Первоначальный токен доступа можно использовать только для создания клиентов.
+removeImportedUsersError=Не удалось удалить импортированных пользователей: '{{error}}'
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=Ошибка кода устройства OAuth2 для токена
 typeHelp=Тип этого ресурса. Может быть использовано для группировки различных экземпляров ресурса с тем же типом.
+linkedIdPs=Поставщики связанных удостоверений
 htmlDisplayName=Отображаемое название в HTML
-authorizationUrl=URL авторизации
-flow-type.basic-flow=общий
-contextualAttributes=Контекстные аттрибуты
-allowPasswordAuthenticationHelp=Включить/выключить возможность аутентификации по имени/пароля вопреки базе данных Kerberos
-includeInAccessToken.tooltip=Должно ли значение быть добавлено в токен доступа?
-idpInitiatedSsoRelayStateHelp=Передать состояние, которое вы хотите послать вместе с SAML запросом, которым хотите проиницировать SSO поставщиком идентификации.
-otpHashAlgorithmHelp=Какой алгоритм хеширования должен быть использован для генерации OTP.
-usermodel.clientRoleMapping.clientId.tooltip=ID клиента для сопоставления ролей
-includeOneTimeUseCondition=Включить условие одноразового использования
-clientsClientScopesHelp=Области, ассоциироваанные с этим ресурсом.
-vendor=Поставщик
+groupObjectClasses=Группировать классы объектов
+requiredActionPlaceholder=Выберите действие
+bindCredentials=Привязать учетные данные
+logoutSettings=Настройки выхода
+validateServerPrincipal=Вам необходимо ввести принципала сервера
+addMessageBundle=Добавить пакет сообщений
+realmName=Имя realm'а
+searchEventType=Поиск сохраненного типа события
+idpInitiatedSsoRelayStateHelp=Передать состояние, которое вы хотите послать вместе с SAML запросом, которым хотите проинициировать SSO поставщиком идентификации.
+otpHashAlgorithmHelp=Алгоритм хеширования, используемый для генерации OTP
+joinGroup=Присоединиться к группе
+eventTypes.REMOVE_TOTP_ERROR.description=Удалить ошибку TOTP
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Ошибка токена выполнения действия
+unlinkAccountConfirm=Вы уверены, что хотите навсегда отвязать эту учетную запись от {{provider}}?
+x509CertificateHelp=Сертификат X509, закодированный в формате PEM
+samlEndpointsLabel=Метаданные поставщика услуг SAML 2.0
+passCurrentLocaleHelp=Передайте текущую локаль поставщику удостоверений в качестве параметра ui_locales.
+lessThan=Должно быть меньше {{value}}
+webAuthnPolicyRequireResidentKeyHelp=Он сообщает аутентификатору, следует ли создавать учетные данные открытого ключа в качестве обнаруживаемых учетных данных.
 logoutServiceRedirectBindingURL=URL переадресации для выхода из сервиса
+createIdentityProviderSuccess=Поставщик удостоверений успешно создан
+emptyMappersInstructions=Если вы хотите добавить сопоставления, нажмите кнопку ниже, чтобы добавить несколько предопределенных сопоставлений или настроить новое сопоставление.
 dayMonth=Определяет день месяца, в который политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущий день месяца равен или находится между заданными значениями.
-idpInitiatedSsoRelayState=Передача состояния SSO инициирующим поставщиком идентификации
+clientRolesHelp=Условие проверяет, существует ли одна из указанных клиентских ролей на клиенте, чтобы определить, применяется ли политика. Это условие фактически позволяет администратору клиента создать клиентскую роль с указанным именем на клиенте, чтобы убедиться, что определенная клиентская политика будет применена к запросам этого клиента. Условие проверяется во время большинства запросов OpenID Connect (запросы авторизации, запросы токенов, запросы точки доступа интроспекции и т. д.).
 validatingX509Certs=Проверка X509 сертификатов
-masterSamlProcessingUrl=Основной URL обработчика SAML
-key=Ключ
-email=E-mail
+eventTypes.CLIENT_UPDATE.description=Обновление клиента
+searchInitialAccessToken=Поиск токена
+guiOrder=Порядок отображения
+friendlyName=Дружественное имя атрибута для поиска в утверждении. Вы можете оставить это поле пустым и указать вместо него имя.
+testSuccess=Успешно подключено к LDAP
 userInfoUrl=URL информации о пользователе
-identityProviders=Поставщики идентификации
-importUsers=Импортировать пользователей
-principalAttributeHelp=Имя (Name) или "дружественное имя" (Friendly Name) атрибута, идентифицирующего внешних пользователей.
-nameIdPolicyFormat=Формат политики NameID
-idpInitiatedSsoUrlName=Имя URL фрагмента, обозначающего клиента, если вы хотите, чтобы SSO был проинициирован поставщиком идентификации. Оставьте это поле пустым, чтобы отключить инициирование SSO с помощью поставщика идентификации. URL для ссылки вашего браузера может быть в следующем виде\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}
-ssoSessionIdle=Допустимое время бездействия сессии. По истечении этого времени токены и браузерные сессии становятся невалидными.
-xFrameOptions=X-Frame-Options
-scopeDescriptionHelp=Описание шаблона клиента
+displayOnConsentScreen=Отображение на экране согласия
+noClientPolicies=Нет клиентской политики
+defaultAdminInitiatedActionLifespanHelp=Макс. время до истечения срока действия разрешения на действие, отправленного пользователю администратором. Рекомендуется, чтобы это значение было большим, чтобы администраторы могли отправлять электронные письма пользователям, которые в данный момент находятся в автономном режиме. Тайм-аут по умолчанию можно переопределить непосредственно перед выдачей токена.
+syncUsersSuccess=Синхронизация пользователей успешно завершена.
+updatedCredentialMoveError=Конфигурация учетных данных пользователя не сохранена: {{error}}
+searchForRoles=Поиск роли по имени
+refresh=Обновить
+roleDeletedSuccess=Роль удалена
+advancedClaimToRole=Если все клеймы существуют, предоставьте пользователю указанный realm или роль клиента.
 directGrant=Сценарий Direct Grant Flow
-consensus=Консенсусная
-policyType.totp=Основан на времени
-emailTheme=Тема для E-mail
-nameIdFormatHelp=Наименование формата ID для использования в теме.
+maxLifespanHelp=Макс. срок службы записи кэша в миллисекундах
+associatedRolesModalTitle=Добавить роли в {{name}}
+nameIdFormatHelp=Имя формата ID для использования в теме.
+detailsHelp=Это информация о деталях.
 adminEvents=События администратора
-registerNodeManually=Зарегистрировать узел вручную
+serviceAccountHelp=Позволяет вам аутентифицировать этого клиента в Keycloak и получить токен доступа, выделенный для этого клиента. В терминах спецификации OAuth2 это включает поддержку 'Client Credentials Grant' для этого клиента.
+standardTokenExchangeEnabledHelp=Включить стандартный обмен токенами V2 для этого клиента.
+enableRefreshRequestedTokenTypeHelp=Контролирует, позволяет ли стандартный обмен токенами V2 запрашивать токен обновления (параметр "requested_token_type" установлен в значение "urn:ietf:params:oauth:token-type:refresh_token"). Если этот параметр равен "No" (по умолчанию), тип запроса токена обновления никогда не разрешается и возвращается ошибка. Если этот параметр равен "Same session", возвращаемый токен обновления принудительно использует та же сессия, что и токен субъекта, возвращая ошибку, если эта сессия недоступна (например, если токен субъекта является временным).
+sameSession=Та же сессия
+urisHelp=Набор URI, защищенных ресурсом.
+eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Ответ поставщика удостоверений
+confirmClientSecretTitle=Восстановить секретный ключ для этого клиента?
 serverPrincipal=Основной сервер
-redirectURI=URI перенаправления
+deleteConfirmGroup_one=Вы уверены, что хотите удалить эту группу "{{groupName}}".
 signDocuments=Подпись документов
-publicKeys=Публичные ключи
-periodicFullSync=Периодическая полная синхронизация
-tokenUrl=URL токена
-notBefore=Не ранее чем
+noTokens=Нет начальных токенов доступа
+addMapper=Добавить сопоставление
+webauthnPolicy=Политика веб-аутентификации
+userAttributeName=Имя атрибута пользователя для хранения атрибута SAML. Используйте email, lastName и firstName для сопоставления с этими предопределенными свойствами пользователя.
+displayDescription=Показать описание
+eventTypes.DELETE_ACCOUNT.description=Удалить аккаунт
+eventTypes.RESTART_AUTHENTICATION_ERROR.description=Ошибка аутентификации при перезапуске
+evictionHour=Час очистки
+onDragFinish=Перемещение завершено {{list}}
+otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Аутентификатор
 ldapMappersList=Сопоставления LDAP
-createdAt=Создан
-editUsername=Редактируемое имя пользователя
-titleEvents=События
-lastRegistration=Последняя регистрация
-rolesHelp=Выберите роли, которые вы хотите связать с выбранным пользователем.
-requireSsl=Требует SSL
-samlEntityDescriptor=Позволяет вам загрузить метаданные внешнего IDP из файла конфигурации или скачать его из URL.
-reevaluate=Переоценить
-addIdpMapperName=Наименование сопоставления.
+bindDnHelp=DN администратора LDAP, который будет использоваться Keycloak для доступа к серверу LDAP
+newClientProfileName=Имя профиля клиента
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=Ошибка кода устройства OAuth2 для токена
+eventTypes.TOKEN_EXCHANGE.description=Обмен токенами
 continue=Продолжить
-details=Детали
-selectScope=Выберите область
-generateNewKeys=Сгенерировать новые ключи
-offlineSessionIdle=Таймаут оффлайн сессии
-periodicChangedUsersSync=Периодическая синхронизация изменений пользователей
-principalAttribute=Атрибут-идентификатор
-searchScope=Поиск области
-userRegistrationHelpText=Включить/выключить страницу регистрации. Ссылка для регистрации будет также показана на странице входа.
+editProvider=Изменить поставщика
+included.client.audience.label=Включенная клиентская аудитория
+backchannelLogoutUrlHelp=URL, который заставит клиента выйти из системы при отправке запроса на выход в этот realm (через end_session_endpoint). Выход из системы осуществляется путем отправки токена выхода, как указано в спецификации выхода из системы OIDC back-channel. Если этот параметр опущен, запрос на выход из системы может быть отправлен на указанный "URL администратора" (если настроен) в формате, специфичном для адаптеров Keycloak/RH-SSO. Если даже "URL администратора" не настроен, клиенту не будет отправлен запрос на выход из системы.
+updateScopeSuccess=Область авторизации успешно обновлена
+userInfoResponseEncryptionKeyManagementAlgorithmHelp=Алгоритм JWA, используемый для управления ключами при шифровании ответов User Info Endpoint. Этот параметр необходим, если вы хотите зашифровать ответы User Info Endpoint. Если оставить пустым, ответы User Info Endpoint не будут зашифрованы.
+authnContextDeclRefsHelp=Упорядоченный список запрошенных AuthnContext DeclRefs.
+inherent=Унаследованный
+tableTitle=Группы атрибутов
+generateNewKeys=Сгенерировать новые RSA ключи
+updateClientPolicySuccess=Обновлена клиентская политика
+unlock=Разблокировать
+validateRealm=Вы должны войти в realm
+attributeValue=Значение атрибута
+eventTypes.CLIENT_DELETE_ERROR.description=Ошибка удаления клиента
+clientScopesHelp=Он использует области действия, запрошенные или назначенные заранее клиенту, чтобы определить, применяется ли политика к этому клиенту. Условие оценивается во время запроса авторизации OpenID Connect и/или запроса токена.
 revokeRefreshToken=Одноразовые токены обновления
-resourceName=Уникальное имя для этого ресурса. Имя может быть использовано для уникальной идентификации ресурса, используется при запросах конкретных ресурсов.
-minimumQuickLoginWaitSeconds=Минимальное ожидание быстрого входа
+mappingUpdatedSuccess=Сопоставление успешно обновлен
+logoUrlHelp=URL-адрес, ссылающийся на логотип клиентского приложения
 operationTypes=Типы операций
-realmRoles=Роли Realm
-firstName=Имя
-expireTime=Определяет время, после которого политика НЕ ДОЛЖНА быть разрешена. Разрешено только если текущее время/дата менеьше или равны заданному значению.
-expirationHelp=Установить срок истечения для событий. Истекшие события периодически удаляются из базы данных.
-nameIdFormat=Наименование формата ID
-adminThemeHelp=Выберите тему для консоли администратора.
-name=Наименование шаблона клиента. Должно быть уникально для realm
-validRedirectUri=Валидация URI перенаправления
-clientList=Клиенты
-userSession.modelNote.label=Заметка сессии пользователя
-permissionName=Имя этого разрешения.
-expires=Истекает
-pagination=Постраничный вывод
-import=Импорт JSON файла, содержащего авторизационные настройки для этого сервера ресурсов.
-otpHashAlgorithm=Алгоритм хеша OTP
+loginWithEmailAllowed=Войти с помощью электронной почты
+expireTime=Определяет время, после которого политика НЕ ДОЛЖНА быть разрешена. Разрешено только если текущее время/дата меньше или равны заданному значению
+requestObject.request\ or\ request_uri=Запрос или URI запроса
+policyProvider.user=Определите условия для ваших разрешений, при которых группе из одного или нескольких пользователей разрешен доступ к объекту.
+protocolTypes.oid4vc=OpenID для проверяемых учетных данных
+protocolTypes.openid-connect=OpenID-подключение
+clientTypeHelp="OpenID Connect" позволяет клиентам проверять личность конечного пользователя на основе аутентификации, выполняемой сервером авторизации. "SAML" позволяет использовать веб-сценарии аутентификации и авторизации, включая кросс-доменный единый вход (SSO), и использует токены безопасности, содержащие утверждения, для передачи информации.
+addOpenIdProvider=Добавить провайдера OpenID Connect
+memory=Память
+cpu=Процессор
+processorCount=Количество процессоров
+eventTypes.CLIENT_LOGIN.name=Вход для клиента
+mapper.nameid.format.tooltip=Это сопоставление применяется только в том случае, если формат NameID входящего AuthnRequest равен этому значению.
 hideOnLoginPageHelp=Если скрыто, то вход с этим провайдером возможен только при явном вызове, например при использовании параметра 'kc_idp_hint'.
-userAttribute=Атрибут пользователя
-kid=KID
-description=Описание
-revoke=Отобрать
-eventListenersHelpText=Настройка слушателей, получающих события для realm.
-addressClaim.postal_code.tooltip=Имя пользоватеслького атрибута, котоое будет использоваться для сопоставления атрибута 'postal_code' внутри атрибута 'address' токена. По умолчанию 'postal_code' .
-clientSignatureHelp=Будет ли клиент подписывать свои saml запросы и ответы? И должны ли они быть провалидированы?
-keyPasswordHelp=Пароль для доступа к приватного ключу в архиве
-frontchannelLogout=Выход с переднего канала
-policyClient=Задайте, какие клиенты допущеный этой политикой.
-providerId=ID
-titleRoles=Роли Realm
-sectorIdentifierUri.tooltip=Провайдеры, использующие пары вспомогательных значений и поддерживающие динамическую регистрацию клиентов ДОЛЖНЫ использовать sector_identified_uri параметр. Это обеспечивает способ для группы сайтов под общим административным контролем, чтобы иметь последовательные попарные значения независимо от индивидуальных доменных имен. Это также обеспечивает способ для клиентов для изменения redirect_uri доменов, не имещющих возможности перерегистрации всех своих пользователей.
-Tuesday=Вторник
+eventTypes.UPDATE_PROFILE.description=Обновить профиль
+assignRolesTo=Назначить {{type}} роли {{client}}
+orderChangeError=Не удалось изменить порядок отображения поставщиков удостоверений {{error}}
+policyProvider.client-scope=Определите условия для ваших разрешений, при которых набору из одной или нескольких клиентских областей разрешен доступ к объекту.
+secretExpiresOn=Секретный ключ истекает {{time}}
+searchClientByName=Поиск клиента по имени
 loginTimeout=Таймаут входа
-rdnLdapAttribute=Атрибут RDN в LDAP
-fineGrainSamlEndpointConfig=Тонкая настройка конфигурации конечных точек доступа SAML
+attributeName=Атрибут [Имя]
+updateError=Не удалось обновить провайдера {{error}}
+importUsersHelp=Если задано значение true, пользователи LDAP будут импортированы в базу данных Keycloak и синхронизированы с помощью настроенных политик синхронизации.
+emptyClientProfilesInstructions=Нет профилей, выберите "Создать профиль клиента", чтобы создать новый профиль клиента
+policyProvider.js=Определите условия для ваших разрешений с помощью JavaScript. Это один из типов политик на основе правил, поддерживаемых Keycloak, и он обеспечивает гибкость для написания любой политики на основе API оценки.
+idpType.social=Вход через соц. сети
+krbPrincipalAttribute=Главный атрибут Kerberos
+fineGrainSamlEndpointConfig=Тонкая настройка конфигурации точек доступа SAML
 hours=часов
-bindType=Тип аутентификации
-aliasHelp=Синоним уникально идентифицирует поставщика идентификации, а также используется для построения адреса переадресации.
-maxFailureWaitSeconds=Максимальное ожидание
+eventTypes.RESET_PASSWORD_ERROR.name=Ошибка сброса пароля
+yes=Да
+showRemaining=Показать ${remaining}
+searchProfile=Поиск профиля
+eventTypes.UPDATE_EMAIL_ERROR.name=Ошибка обновления электронной почты
+removeConfirm_other=Вы уверены, что хотите удалить эти группы?
 configure=Конфигурация
-contextualInfo=Контекстная информация
+searchScopeHelp=Для одного уровня поиск применяется только к пользователям в DN, указанных User DN. Для поддерева поиск применяется ко всему поддереву. Подробнее см. в документации LDAP.
+jumpToSection=Перейти к разделу
+noUsersEmptyStateDescription=Только пользователи с этой ролью, назначенной напрямую, будут отображаться на этой вкладке. Если вам нужно найти пользователей, назначенных на эту роль, перейдите на
 manage=Управление
-temporaryPassword=Временный
-applyPolicyHelp=Определяем все политики, которые должны быть применены к областям, определенным этой политикой или разрешением.
+searchForSession=Поиск сессии
+temporaryLockedHelp=Пользователь может быть заблокирован из-за нескольких неудачных попыток входа в систему.
 kerberosIntegration=Интеграция с Kerberos
-protocolMapper=Протокол...
-requiredSettings=Требуемые настройки
-sslType.none=нет
+useEntityDescriptorHelp=Импорт метаданных из удаленного дескриптора сущности IDP SAML.
+decisionStrategies.CONSENSUS=Консенсус
+saveProviderSuccess=Поставщик успешно сохранен.
+dedicatedScopes=Выделенные области
+noSessionsDescription=В настоящее время в этом realm нет активных сессий.
+createGroupText=Создать группу атрибутов
+otpPolicyCodeReusable=Многоразовый токен
+addRedirectUri=Добавьте допустимые URI перенаправления
 time=Время
-bruteForceDetection=Определение Brute Force
-archiveFormatHelp=Формат архивации Java keystore или PKCS12.
-xContentTypeOptions=X-Content-Type-Options
-keyAlias=Синоним ключа
-prefix=Префикс для каждой роли Realm (опционально).
-none=нет
+disableSigningExplain=Если вы отключите "{{key}}", база данных Keycloak будет обновлена, и вам может потребоваться загрузить новый адаптер для этого клиента.
+mapperTypeRoleLdapMapperHelp=Используется для сопоставления ролей из некоторых LDAP DN с сопоставлениями ролей Keycloak либо ролей realm, либо клиентских ролей конкретного клиента.
+used.DEFAULT=По умолчанию
+authenticationCreateFlowHelp=Создайте сценарий.
+credentialResetEmailSuccess=Письмо отправлено пользователю.
 sslType.all=все запросы
-type=Тип
-httpPostBindingResponse=Привязанный ответ HTTP-POST
-saveEvents=Сохранять события
-issuer=Эмитент
-policyEnforcementModeHelp=Режим применения политик диктует, каким образом политики применяются при оценке запросов на авторизацию. «Обязывающая» означает, что запросы запрещены по умолчанию, даже если нет никакой политики, связанной с данным ресурсом. "Разрешающая" означает, что запросы разрешены даже если не существует политика, связанная с данным ресурсом. 'Отключено' полностью отключает оценку политики и позволяет получить доступ к любому ресурсу.
+discoveryEndpointHelp=Импорт метаданных из удаленного дескриптора обнаружения IDP.
+excludeSessionStateFromAuthenticationResponse=Исключить состояние сессии из ответа аутентификации
+required=Обязательное поле
+linkedIdPsText=Поставщики удостоверений, которые уже связаны с этой учетной записью пользователя
 lastUpdated=Обновлено
 credentialResetBtn=Сброс учетных данных
-selectAUser=Выберите пользователя
-seconds=секунд
+socialProfileJSONFieldPathHelp=Путь поля в данных JSON профиля пользователя социального поставщика, из которого нужно получить значение. Можно использовать точечную нотацию для вложенности и квадратные скобки для индекса массива. Например, 'contact.address[0].country'.
+userModelAttributeHelp=Имя свойства или атрибута UserModel, с которым вы хотите сопоставить атрибут LDAP. Например, "firstName", "lastName", "email", "street" и т. д.
+userList=Список пользователей
 eventTypes.RESET_PASSWORD.name=Сброс пароля
-otpPolicyDigits=Количество цифр
-permissions=Разрешения
+exportWarningDescription=Если в вашем realm много групп, ролей или клиентов, операция может привести к тому, что сервер на некоторое время перестанет отвечать.
+importRole=Импортировать роль
+deleteClientProfileConfirm=Это действие навсегда удалит профиль {{profileName}}. Это не может быть отменено.
+signServiceProviderMetadataHelp=Включить/отключить подпись метаданных SAML поставщика.
+oAuthMutual=Включены токены доступа, привязанные к сертификату OAuth 2.0 Mutual TLS
 keystore=Хранилище ключей
-accountThemeHelp=Выберите тему для управления учетной записью пользователя.
+eventTypes.EXECUTE_ACTION_TOKEN.description=Выполнить токен действия
+eventTypes.CLIENT_INFO.description=Информация о клиенте
+updateClientProfilesError=Не удалось обновить профили клиентов: {{error}}
 canonicalizationHelp=Метод канонизации для XML сигнатур.
+authorizationHelp=Включить/отключить поддержку детальной авторизации для клиента.
 sessions=Сессии
+mapperCreateSuccess=Сопоставление успешно создано.
 fullSyncPeriodHelp=Период для полной синхронизации в секундах
+resourceTypeHelp=Указывает, что это разрешение должно применяться ко всем экземплярам ресурсов данного типа.
+encryptionAlgorithmHelp=Алгоритм шифрования, который используется SAML IDP для шифрования документов SAML, утверждений или идентификаторов. Соответствующий ключ дешифрования для дешифрования частей документа SAML выбирается на основе этого настроенного алгоритма и должен быть доступен в ключах realm для использования шифрования (ENC). Если алгоритм не настроен, разрешен любой поддерживаемый алгоритм, а ключ дешифрования выбирается на основе алгоритма, настроенного в документе SAML.
+socialUserAttributeName=Имя атрибута пользователя для хранения информации.
 priority=Приоритет
-trustEmail=Подтверждение E-mail
 jsonType.label=Тип переменной JSON
 fullScopeAllowed=Полный доступ к областям
-push=Разослать
-titleUsers=Пользователи
-masterSamlProcessingUrlHelp=Если URL сконфигурирован, то он будет каждый раз для связывания SP's Assertion Consumer и Single Logout Services. Может быть переопределен индивидуально для связывания каждого сервиса в тонкой настройке конфигурации конечных точек доступа SAML.
-claimJsonType=Тип переменной в JSON, который должен использоваться при добавлении ее в токен. Допустимые значения long, int, boolean, и String.
-forceAuthenticationHelp=Указывает, должен ли поставщик идентификации аутентифицировать ведущего напрямую, а не использовать предыдущий контекст безопасности.
-testClusterAvailability=Протестировать доступность кластера
-forceNameIdFormat=Принудительно использовать формат ID
+syncModes.inherit=Наследовать (Inherit)
+masterSamlProcessingUrlHelp=Если URL сконфигурирован, то он будет использован каждый раз для связывания SP's Assertion Consumer и Single Logout Services. Может быть переопределен индивидуально для связывания каждого сервиса в тонкой настройке конфигурации точек доступа SAML.
+addedGroupMembershipError=Ошибка добавления членства в группе: {{error}}
+authenticatorAttachment.platform=Платформа
+configSaveSuccess=Конфигурация успешно сохранена
+regenerate=Регенерировать
+ignoreMissingGroups=Игнорировать отсутствующие группы
 sslType.external=внешние запросы
-multiValued=Отображается, если атрибут поддерживает несколько значений. Если включен, то список всех значений будет претендовать на этот атрибут. В противном случае выбираться будет только первое значение
-addRole=Добавить роль
-addressClaim.locality.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'locality' внутри атрибута 'address' токена. По умолчанию 'locality' .
-userInfoSignedResponseAlgorithmHelp=JWA алгоритм используется для подписи ответа ресурса информации о пользователе. Если установлено в 'unsigned', то ответ инофрмации о пользователе не будет подписан и будет возвращен в формате application/json.
-lastName=Фамилия
-duplicateEmailsHelpText=Разрешает разным пользователям иметь один и тот же E-mail. Изменение этой настройки также очистит пользовательский кэш. После выключения поддержки дублирующихся email рекомендуется вручную почистить в базе данных ограничения по E-mail существующим пользователям.
-usermodel.realmRoleMapping.rolePrefix.label=Префикс ролей Realm
+showMetaData=Показать метаданные
+webAuthnPolicyAttestationConveyancePreferenceHelp=Сообщает аутентификатору предпочтения относительно способа формирования заявления об аттестации.
+top-level-flow-type.basic-flow=Основной сценарий
+groupRemoveError=Ошибка удаления группы {error}
 temporaryPasswordHelpText=Если включено, пользователю необходимо сменить пароль при следующем входе
-otpPolicyDigitsHelp=Сколько цифр должен иметь OTP?
+requestObjectEncryption=Алгоритм шифрования объекта запроса
+exportAuthDetailsSuccess=Данные авторизации успешно экспортированы.
 connectionPooling=Пул соединений
 wantAuthnRequestsSignedHelp=Указывает, ожидает ли поставщик идентификации подписанных AuthnRequest.
-enabled=Включено
-authenticationAliasHelp=Наименование конфигурации
+policyCodeHelp=Код JavaScript, обеспечивающий условия для этой политики.
+eventTypes.IMPERSONATE_ERROR.description=Ошибка имперсонации
+eventTypes.IDENTITY_PROVIDER_RESPONSE.description=Ответ поставщика удостоверений
+shouldBeANumber=Должно быть число
+validatorDialogColNames.colDescription=Описание
+requestObjectEncoding=Алгоритм шифрования содержимого объекта запроса
+idTokenEncryptionKeyManagementAlgorithmHelp=Алгоритм JWA, используемый для управления ключами при шифровании токенов ID. Этот параметр необходим, если вам нужны зашифрованные токены ID. Если оставить пустым, токены ID будут просто подписаны, но не зашифрованы.
+idpInitiatedSsoUrlNameHelp=Имя фрагмента URL для ссылки на клиента, когда вы хотите выполнить IDP Initiated SSO. Если оставить это поле пустым, IDP Initiated SSO будет отключен. URL, на который вы будете ссылаться из своего браузера, будет: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}.
 keyPassword=Пароль для ключа
-SSOSessionIdle=Таймаут сессии SSO
-ssoServiceUrlHelp=Url, который должен быть использован для отправленных запросов на аутентификацию (SAML AuthnRequest).
-startTime=Определете время, до наступления которого политика НЕ ДОЛЖНА быть разрешена. Разрешено только если текущее время/дата больше или равны заданному значению.
-logicHelp=Логика диктует, как политика должна применяться. Если 'Позитивная', результирующий эффект (разрешение или запрещение) полученный в ходе оценки этой политики будет использован для выполнения решения. Если 'Негативная', результирующий эффект будет отрицательным, другими словами, разрешение становится запрещением и наоборот.
-copy=Копировать
-connectionTimeout=Таймаут соединения
-monthHelp=Определяет месяц, в который политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущий месяц равен или находится между заданными значениями.
-registrationAccessToken=Токен доступа к регистрации
-supportedLocales=Поддерживаемые языки
-showPasswordDataValue=Значение
-issuerHelp=Идентификатор эмитента для эмитента ответа. Если не предоставлен, проверка не будет выполняться.
-titleSessions=Сессии
-clientNameHelp=Задает отображаемое название клиента. Например 'My Client'. Поддерживает ключи для локализованных значений. Например\\\: ${my_client}
+attributeFriendlyName=Атрибут [Дружественное имя]
+clearAllFilters=Очистить все фильтры
+scopePermissions.clients.map-roles-composite-description=Политики, которые определяют, может ли администратор применять роли, определенные этим клиентом как составные, к другой роли
+roleObjectClassesHelp=Класс объекта (или классы) объекта роли. Разделяется запятыми, если требуется больше классов. В типичном развертывании LDAP это может быть "groupOfNames". В Active Directory это обычно "group".
+emptyAddClientScopes=Нет клиентских областей
+changeTypeTo=Изменить тип на
+generateKeys=Сгенерировать ключи?
+searchForUser=Поиск пользователя
+groupRemove_one=Группа удалена
+savePasswordError=Ошибка сохранения пароля: {{error}}
+allGroups=Все группы
+deleteNode=Удалить узел?
+rdnLdapAttributeHelp=Имя атрибута LDAP, который используется как RDN (верхний атрибут) типичного DN пользователя. Обычно это тот же атрибут, что и атрибут LDAP Username; однако он не является обязательным. Например, в Active Directory обычно используют 'cn' в качестве атрибута RDN, когда атрибут имени пользователя может быть 'sAMAccountName'.
+addAaguids=Добавить AAGUID
 createPolicy=Создать политику
+disablePolicyConfirm=Пользователи и клиенты не могут получить доступ к политике, если она отключена. Вы уверены, что хотите продолжить?
+useDiscoveryEndpoint=Использовать точку доступа обнаружения
 clearAdminEvents=Очистить события администратора
-rootURL=Корневой URL добавляется к относительным URL
-rootUrl=Корневой URL
+eventTypes.CLIENT_DELETE.name=Удалить клиент
 clientLoginTimeout=Таймаут авторизации клиента
-nodeReRegistrationTimeoutHelp=Интервал, означающий максимальное время для узлов кластера зарегистрированных клиентов для их перерегистрации. Если узел кластера не может послать запрос перерегистрации в Keycloak за указанное время, то он будет разрегистрирован из Keycloak
-logoutServicePostBindingURLHelp=SAML POST связанный URL для клиентского сервиса единого выхода. Если Вы используете другие привязки, то можете оставить это поле пустым.
+mapperSaveSuccess=Сопоставление успешно сохранено.
+noRolesAssociatedInstructions=Чтобы добавить роли к этой роли, нажмите "Добавить роль".
+alwaysDisplayInUIHelp=Всегда отображать этого клиента в пользовательском интерфейсе учетной записи, даже если у пользователя нет активной сессии.
+eventTypes.UPDATE_PASSWORD.name=Обновить пароль
+eventTypes.UPDATE_CONSENT.description=Обновление согласия
+realmSaveSuccess=Realm успешно обновлен
+executorTypeTextHelpText=Ошибка входа через провайдера идентификации
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Ошибка входа в систему поставщика удостоверений
 readTimeout=Таймаут чтения
-samlSignatureKeyName=Наименование ключа сигнатуры SAML
-clientAuthentication=Аутентификация клиента
-registrationEmailAsUsername=E-mail как имя пользователя
-logicType.negative=Негитивная
-otpPolicy=Политики OTP
-flow-type.form-flow=форма
+userInfoResponseEncryptionContentEncryptionAlgorithmHelp=Алгоритм JWA, используемый для шифрования содержимого при шифровании ответов точки доступа информации пользователя. Если указан алгоритм управления ключами шифрования ответа информации пользователя, то значение по умолчанию для этого значения — A128CBC-HS256.
+accessTokenSignatureAlgorithm=Алгоритм подписи токена доступа
+createUser=Создать пользователя
+logoutAllDescription=Если вы выйдете из всех активных сессий, активные субъекты в этом realm также будут выведены из сессии.
+credentialResetEmailError=Не удалось: {{error}}
+flow-type.form-flow=Форма
+useKerberosForPasswordAuthenticationHelp=Используйте модуль входа Kerberos для аутентификации имени пользователя и пароля на сервере Kerberos вместо аутентификации на сервере LDAP с API службы каталогов.
+guiOrderHelp=Укажите порядок поставщика в графическом интерфейсе (например, на странице согласия) в виде целого числа.
 signDocumentsHelp=Должны ли SAML документы быть подписаны в realm?
 resetPassword=Сброс пароля
-requireSslHelp=Требуется ли HTTPS? 'нет' означает, что HTTPS не требуется для клиентов с любым IP адресом. 'Внешние запросы' означает, что localhost и внутренние IP адреса могут получить доступ без HTTPS. 'Все запросы' означает, что HTTPS требуется вне зависимости от IP адреса.
-identityInformation=Идентичность данных
-addUser=Добавить пользователя
-usermodel.clientRoleMapping.rolePrefix.label=Префикс ролей клиента
-partialImport=Частичный импорт
-includeAuthnStatementHelp=Должны ли заявки на методы и временные метки быть включены в ответе на вход?
-client-authenticator-type=Проверка подлинности клиента используется для аутентификации этого клиента вместо сервера Keycloak
-signatureKeyNameHelp=Подписанные SAML документы содержат идентификаторы ключей подписи в элементе KeyName. Для Keycloak / RH-SSO контрагентов, используйте KEY_ID, для MS AD FS используйте CERT_SUBJECT, для остальных установите и используйте NONE если другие опции не работают.
-loginWithEmail=Вход по E-mail
-protocol=Протокол
-manageAccount=Управление учетной записью
-tokenClaimName.label=Имя переменной в токене
-create=Создать
-clientSecret=Секрет клиента
-from=От
-httpPostBindingAuthnRequest=Привязывание HTTP-POST для AuthnRequest
-includeInAccessToken.label=Добавить в токен доступа
+requireSslHelp=Требуется ли HTTPS? 'Нет' означает, что HTTPS не требуется для клиентов с любым IP адресом. 'Внешние запросы' означает, что localhost и внутренние IP адреса могут получить доступ без HTTPS. 'Все запросы' означает, что HTTPS требуется вне зависимости от IP адреса.
+policyDeletedSuccess=Политика успешно удалена
+manageServiceAccountUser=Для управления подробными и групповыми сопоставлениями щелкните имя пользователя <1>{{link}}</1>
+addClientProfileSuccess=Добавлен новый профиль клиента
+helpDisabled=Помощь отключена
+deleteResource=Удалить ресурс навсегда?
+validRequestURIsHelp=Список допустимых URI, которые можно использовать в качестве значений параметра 'request_uri' во время запроса аутентификации OpenID Connect. Не поддерживаются те же возможности, что и для допустимых URI перенаправления. Например, подстановочные знаки или относительные пути.
+emptyAddClientScopesInstructions=Не осталось клиентских областей для добавления
+changeTypeIntro={{count}} выбранных клиентских областей будут изменены на
+secretSizeHelp=Размер в байтах для сгенерированного секретного ключа
+clientSecret=Секретный ключ клиента
+inputType=Тип ввода
+claimHelp=Имя клейма для поиска в токене. Вы можете ссылаться на вложенные клеймы, используя '.', например, 'address.locality'. Чтобы использовать точку (.) буквально, экранируйте ее обратной косой чертой (\\.).
+regexClaimValues=Значения клеймов Regex
 iconUri=Иконка URI
-hideOnLoginPage=Скрыть на странице входа
+allowed-protocol-mappers.label=Разрешенные преобразователи протоколов
+group=Группа
+addAssociatedRolesText=Добавить связанные роли
+enabledFeatures=Включенные функции
+groupsClaimHelp=Если определено, политика будет извлекать группы пользователей из указанного клейма в токене доступа или токене идентификатора, представляющем личность, запрашивающую разрешения. Если не определено, группы пользователей будут получены из конфигурации вашем realm.
 createGroup=Создать группу
-resource=Ресурс
+validatingPublicKeyId=Проверка идентификатора открытого ключа
+clientAuthentications.client_secret_jwt=JWT подписан с клиентским секретным ключом
 created=Создано
 minutes=минут
-userSession.modelNote.tooltip=Наименование процедуры заметки сессии пользователя согласованным с UserSessionModel.note.
+displayOnClient=Отображение клиента на экране
+certSubject=CERT_SUBJECT
+userCredentialsHelpText=Обработчики верхнего уровня позволяют вам изменять приоритет учетных данных для пользователя, самые верхние учетные данные имеют наивысший приоритет. Обработчики в пределах одной расширяемой панели позволяют вам изменять визуальный порядок учетных данных, самые верхние учетные данные будут отображаться самыми левыми.
+ldapAdvancedSettingsDescription=В этом разделе содержатся все остальные параметры для более детальной настройки поставщика хранилища LDAP.
 usersDN=Пользователи DN
-clientsClientTypeHelp='OpenID connect' разрешает клиентам проверить личность конечного пользователя, основанного на  выполнении аутентификации на Сервере Авторизации.'SAML' включает веб-сценарии аутентификации и авторизации, включая кроссдоменные центры единого управления доступом (SSO) и использующие токены безопасности, содержащие заявления на передачу информации.
-selectUser=Выберите пользователя, идентификационные данные которого будут использованы для запроса разрешений с сервера.
-webOriginsHelp=Разрешает CORS источникам. Чтобы разрешить всем источники с допустимыми URI-адресами переадресации, добавьте '+'. Чтобы разрешить все источники, добавьте '*'.
+relativeUserCreateDn=Относительное DN создания пользователя
+relativeUserCreateDnHelp=Относительное DN от 'Users DN' до того места, где будут созданы пользователи. Например, это позволяет создавать пользователей в других DN, нежели родительский 'Users DN' при использовании области поиска поддерева.
+secretSize=Размер секретного ключа
+included.custom.audience.label=Включена индивидуальная аудитория
+max-clients.label=Макс. количество клиентов на realm
 requestObjectSignatureAlgorithm=Алгоритм сигнатуры объекта запроса
-logoutUrl=URL выхода
-storedTokensReadable=Сохраненные токены доступны на чтение
-admin-clearEventsHelp=Удалить все события администратора из базы данных.
-mappers=Сопоставления
+searchForGroups=Поиск группы
+noRolesAssociated=Нет связанных ролей
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.name=Ошибка поставщика удостоверений после входа в систему
+emptyStateMessage=Нет групп атрибутов
+tokenLifespan.expires=Истекает через
+oidcAttributeImporter=Импортируйте заявленный клейм, если он существует в идентификаторе, токене доступа или наборе клеймов, возвращаемом точкой доступа профиля пользователя, в указанное свойство или атрибут пользователя.
+requestObject.request\ only=Только запрос
 waitIncrementSeconds=Порог ожидания
-usermodel.prop.label=Свойство
-name-id-format=Наименование формата ID
+requiredForLabel.admins=Только администраторы
+clientScopeSuccess=Обновлено отображение области действия
+clientPolicySearch=Политика поиска клиента
+refreshTokens=Обновить токены
+eventTypes.UPDATE_EMAIL_ERROR.description=Ошибка обновления электронной почты
 credentials=Учетные данные
-policyType.hotp=Основан на счетчике
+webAuthnPolicyCreateTimeoutHelp=Значение тайм-аута для создания учетных данных открытого ключа пользователя в секундах. Если установлено значение 0, этот параметр тайм-аута не адаптируется.
+policyType.hotp=На основании счетчика
+claimFilterValue=Значение обязательного клейма
+eventTypes.REGISTER_ERROR.name=Ошибка регистрации
+priorityHelp=Приоритет поставщика
+emptyPolicies=Нет политики
+manageOrderTableAria=Список поставщиков удостоверений в порядке, указанном на странице входа
+disableError=Не удалось отключить провайдер {{error}}
+anyAlgorithm=Любой алгоритм
 enableSSL=Включить SSL
 general=Главная
-failureFactor=Максимальное количество неудачных попыток входа
-signAssertions=Sign Assertions
-scopesSelect=Определяет, что разрешение должно быть применено к одной или нескольким областям.
-disableUserInfoHelp=Отключить использование сервиса информации о пользователе, чтобы получить дополнительную информацию о пользователе?  По умолчанию используется сервис OIDC.
+failureFactor=Макс. количество неудачных попыток входа
+updateClientPoliciesSuccess=Конфигурация политик клиента была обновлена
+advancedSettings=Расширенные настройки
+attributeValueHelp=Значение, которое должен иметь атрибут. Если атрибут является списком, то значение должно содержаться в списке.
+eventTypes.FEDERATED_IDENTITY_LINK.description=Федеративная ссылка на идентификацию
 adminTheme=Тема консоли администратора
-alias=Синоним
-value=Значение
-clientSecretHelp=Секрет клиента, зарегистрированный с помощью поставщика идентификации.
-validateSignatures=Включает/выключает проверку подписи ответов от SAML.
-authentication=Аутентификация
+alias=Псевдоним
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=Ошибка отправки ссылки поставщика удостоверений
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.name=Переопределение ссылки федеративной идентификации
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.description=Переопределение ссылки федеративной идентификации
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.name=Ошибка переопределения ссылки федеративной идентификации
+eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.description=Ошибка переопределения ссылки федеративной идентификации
+eventTypes.OAUTH2_EXTENSION_GRANT.name=Предоставление разрешения на расширение OAuth2
+eventTypes.OAUTH2_EXTENSION_GRANT.description=Предоставление разрешения на расширение OAuth2
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.name=Ошибка предоставления расширения OAuth2
+eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.description=Ошибка предоставления расширения OAuth2
+userEvents=Пользовательские события
+inputTypePlaceholder=Заполнитель ввода
+otpPolicyPeriodErrorHint=Значение должно быть от 1 секунды до 2 минут.
+introduction=Если вы хотите покинуть эту страницу и управлять этим realm, щелкните соответствующие пункты меню на левой навигационной панели.
+clearUserEvents=Очистить пользовательские события
 descriptionHelp=Описание шаблона клиента
-logoutUrlHelp=Конечная точка окончания сессии, используемая для выхода пользователя из внешнего IDP.
-times.seconds=секунд
+addCustomProvider=Добавить собственного поставщика
 permissionType=Определяет, что это разрешение должно быть применено ко всем экземплярам ресурсов заданного типа.
 policyEnforcementModes.ENFORCING=Обязывающая
+rowSaveBtnAriaLabel=Сохранить изменения для {{messageBundle}}
+permanentLockout=Постоянная блокировка
+maxTemporaryLockouts=Макс. временные блокировки
+maxTemporaryLockoutsHelp=Количество разрешенных временных блокировок, прежде чем пользователь будет заблокирован навсегда.
+bruteForceStrategy=Стратегия увеличения времени ожидания
+bruteForceStrategyHelp=Множественное означает, что время ожидания будет увеличено только тогда, когда количество отказов кратно '{{failureFactor}}'. Линейное означает, что каждый новый отказ, начиная с '{{failureFactor}}', увеличит время ожидания.
+bruteForceStrategy.LINEAR=Линейный
+bruteForceStrategy.MULTIPLE=Несколько
 debug=Отладчик
+webAuthnPolicyRequireResidentKey=Требовать обнаруживаемые учетные данные
+unlockUsersConfirm=Все временно заблокированные пользователи будут разблокированы.
 clear=Очистить
-resources=Ресурсы
-groups=Группы
-logicType.positive=Позитивная
-signatureAlgorithm=Алгоритм, используемый для подписи документов.
+idpType.custom=Пользовательский
 eventTypes.LOGOUT.name=Выход
-accountTheme=Тема учетной записи
+deletedErrorClientScope=Не удалось удалить область клиента: {{error}}
+groupsClaim=Клейм групп
+roleMappingUpdatedError=Не удалось обновить сопоставление ролей {{error}}
+client-updater-source-groups.label=Группы
+frontchannelLogoutUrlHelp=URL, который заставит клиента выйти из системы, когда запрос на выход отправляется в этот realm (через end_session_endpoint). Если не указано, по умолчанию используется базовый URL.
+authenticationOverridesHelp=Переопределить привязки сценария аутентификации realm.
 requiredActions=Требуемые действия
+requiredAction=Требуемые действия
+requiredActionConfig=Конфигурация для {{name}}
+selectLocales=Выберите локали
+policyDecisionStagey=Стратегия решения диктует как политики связаны с заданными разрешениями и как формируется окончательное решение. 'Утвердительная' означает, что, по крайней мере, одна политика должна дать положительную оценку для того, чтобы окончательное решение также было положительным. 'Единогласная' означает что все политики должны дать положительную оценку для того, чтобы окончательная оценка также была положительной. 'Консенсус' означает, что количество положительных решений должно превышать количество отрицательных решений. Если количество положительных и отрицательных решений совпадает, окончательное решение будет отрицательным.
+usermodel.prop.tooltip=Имя свойства метода в интерфейсе UserModel. Для примера, значение 'email' будет ссылкой на метод UserModel.getEmail().
+kc.identity.authc.method=Метод аутентификации
+regexAttributeValues=Значения атрибутов регулярных выражений
+otpTypeHelp=TOTP является Временным одноразовым паролем. 'HOTP' основанный на счетчике одноразовый пароль в котором сервер хранит счетчик хеша.
+setAsDefaultAction=Установить как действие по умолчанию
+keyForCodeExchange=Метод PKCE (Proof Key for Code Exchange)
+clientProfiles=Профили клиентов
+endpointsHelp=Показывает конфигурацию точки доступа поставщика услуг.
+mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
+unlockAllUsers=Разблокировать всех пользователей
+noGroupsText=Вы не добавили этого пользователя ни в одну группу. Присоединитесь к группе, чтобы начать.
+createClientPolicyError=Не удалось создать политику из-за: {{error}}
+eventTypes.EXECUTE_ACTIONS_ERROR.name=Ошибка выполнения действий
+path=Путь
+overwritten=Перезаписано
+mapperNameHelp=Имя преобразователя
+keyProviderMapperNameHelp=Отображение имени провайдера при подключении в консоли администратора.
+providerIdHelp=Идентификатор провайдера
+deleteProviderError=Ошибка удаления провайдера: {{error}}
+supportedLocalesHelp=Локали для поддержки этого realm. Пользователь выбирает одну из этих локалей на экране входа.
+comparisonHelp=Указывает метод сравнения, используемый для оценки запрошенных классов контекста или операторов. Значение по умолчанию — "Exact".
+generatedIdTokenIsDisabled=Сгенерированный идентификатор токенов отключается, если не выбран ни один пользователь
+nodeHost=Хост узла
+eventTypes.REGISTER_NODE_ERROR.description=Ошибка регистра узла
+eventListenersHelpTextHelp=Настройте, какие слушатели будут получать события для realm.
+acrToLoAMapping=Сопоставление ACR с LoA
+advancedSettingsSaml=Этот раздел используется для настройки дополнительных параметров этого клиента
+resetCredentialsError=Ошибка сброса учетных данных пользователя: {{error}}
+eventTypes.INTROSPECT_TOKEN.name=Интроспекция токена интроспекции
+unspecified=Неопределенный
+deleteMappingTitle=Удалить сопоставление?
+profile=Профиль
+active=Активные
+generateKeysDescription=Если вы генерируете новые ключи, вы можете автоматически загрузить хранилище ключей с закрытым ключом и сохранить его на стороне клиента. Сервер Keycloak сохранит только сертификат и открытый ключ, но не закрытый ключ.
+addSubFlowTitle=Добавить подсценарий
+useTruststoreSpiHelp=Указывает, будет ли соединение LDAP использовать Truststore SPI с truststore, настроенным в параметрах командной строки. "Always" означает, что он будет использоваться всегда. "Never" означает, что он не будет использоваться. Обратите внимание, что даже если truststore Keycloak не настроен, будут использоваться java cacerts или сертификат по умолчанию, заданный свойством "javax.net.ssl.trustStore".
+forcePostBindingHelp=Всегда использовать POST Binding для ответов.
+executorName=Имя
+VERIFY_EMAIL=Подтвердить адрес электронной почты (VERIFY_EMAIL)
+realmCertificateAlias=Псевдоним сертификата realm
+roleName=Имя роли
+addOrigins=Добавить происхождение
+evictionDayHelp=День недели, в который запись станет недействительной.
+actionTokens=Токены действия
+permissionResources=Указывает, что это разрешение должно быть применено к определенному экземпляру ресурса.
+testConnectionHint.withoutEmail=Чтобы проверить соединение, необходимо сначала настроить адрес электронной почты для текущего пользователя ({{userName}}).
+includeOneTimeUseConditionHelp=Должно ли условие одноразового использования быть включено в ответе на вход?
+availableIdPsText=Все настроенные поставщики удостоверений в этом realm перечислены здесь. Вы можете связать учетную запись пользователя с любой учетной записью IdP.
+accessTokenLifespanHelp=Макс. время действия токена доступа. Значение рекомендуется устанавливать как можно ближе к таймауту SSO.
+editableRowsTable=Редактируемая таблица строк
+redirectURIHelp=Этот uri перенаправления используется в том случае, если сконфигурирован поставщик идентификации.
+permissionsEnabled=Разрешения включены
+saveRealmError=Не удалось создать realm {{error}}
+attestationPreference.none=Нет
+pairwiseSubAlgorithmSalt.label=Соль
+addGroupsToGroupPolicy=Добавить группы в групповую политику
+deniedScopes=Запрещенные области
+updateClientProfilesSuccess=Обновлена конфигурация клиентских профилей
+flow.docker\ auth=Процесс аутентификации Docker
+useEntityDescriptor=Импортировать метаданные из удаленного дескриптора сущностей IDP SAML
+loginActionTimeout=Таймаут действий по входу
+windowsDomainQN=Полное имя домена Windows
+deleteClientError=Не удалось удалить профиль: {{error}}
+validRedirectURIs=Валидирует паттерн URI, на который может быть перенаправлен браузер после успешного входа или выхода. Разрешены простые ссылки, напр. 'http\://example.com/*'. Также допускается использовать относительный путь, напр. '/my/relative/path/*'. Относительные пути необходимо указывать относительно корневого URL клиента, или, если он не специфицирован, корневого URL сервера авторизации. Для SAML Вы должны задать валидный паттерн URI, если Вы полагаетесь на URL сервиса потребителя, внедренного в запрос авторизации.
+UPDATE_PROFILE=Обновить профиль (UPDATE_PROFILE)
+assertionConsumerServicePostBindingURL=Привязка URL POST-запроса для сервиса подтверждения потребителей
+removeImported=Удалить импортированных
+endpoints=Точки доступа
+roleSaveError=Не удалось сохранить роль: {{error}}
+keySize=Размер ключа
+membershipUserLdapAttributeHelp=Используется только если тип атрибута членства — UID. Это имя атрибута LDAP для пользователя, которое используется для сопоставления членства. Обычно это "uid". Например, если значение "Атрибута членства пользователя LDAP" равно "uid", а группа LDAP имеет "memberUid: john", ожидается, что конкретный пользователь LDAP будет иметь атрибут "uid: john".
+samlCapabilityConfig=Возможности SAML
+accessTokenSignatureAlgorithmHelp=Алгоритм JWA, используемый для подписи токенов доступа.
+derFormatted=В формате DER
+periodicChangedUsersSyncHelp=Следует ли включать периодическую синхронизацию измененных или вновь созданных пользователей LDAP с Keycloak.
+signatureAlgorithmHelp=Алгоритм подписи, используемый для подписания документов. Обратите внимание, что алгоритмы на основе 'SHA1' устарели и могут быть удалены в будущем. Рекомендуется придерживаться более безопасного алгоритма вместо '*_SHA1'.
+allow-default-scopes.tooltip=Если включено, то вновь зарегистрированным клиентам будет разрешено иметь клиентский realm, указанные в клиентских realm по умолчанию или в дополнительных клиентских областях realm
+emailVerified=Подтверждение E-mail
+addExecutionHelp=Выполнение может иметь широкий спектр действий: от отправки электронного письма для сброса пароля до проверки одноразового пароля.
+requestObjectRequiredHelp=Указывает, должен ли клиент предоставлять объект запроса с запросами авторизации, и какой метод он может использовать для этого. Если установлено значение "не требуется", предоставление объекта запроса необязательно. Во всех остальных случаях предоставление объекта запроса является обязательным. Если установлено значение "request", объект запроса должен быть предоставлен по значению. Если установлено значение "request_uri", объект запроса должен быть предоставлен по ссылке. Если установлено значение "request или request_uri", можно использовать любой из методов.
+clientScopesRolesScope=Если сопоставление области действия ролей не определено, каждому пользователю разрешено использовать эту клиентскую область действия. Если сопоставления области действия ролей определены, пользователь должен быть членом хотя бы одной из ролей.
+passwordPoliciesHelp.notUsername=Пароль не может совпадать с именем пользователя.
+passwordPoliciesHelp.notContainsUsername=Пароль не может содержать имя пользователя.
+removeConfirm_one=Вы уверены, что хотите удалить эту группу?
+createUserProviderSuccess=Поставщик федерации пользователей успешно создан
+countHelp=Определяет, как много клиентов может быть создано с помощью этого токена.
+mapperTypeHardcodedLdapGroupMapper=hardcoded-ldap-group-mapper
+Monday=Понедельник
+resetCredentialsSuccess=Пароль успешно сброшен.
+added=Добавлен
+authnContextDeclRefs=AuthnContext DeclRefs
+clientAssertionAudienceHelp=Аудитория для использования в утверждении клиента. Значение по умолчанию — URL точки доступа токена IDP.
+externalRoleToRole=Ищет внешнюю роль в токене доступа keycloak. Если внешняя роль существует, предоставить пользователю указанную роль realm или клиента.
+attributeGroup=Группа атрибутов
+deleteExecutionError=Не удалось удалить выполнение: {{error}}
+hideInheritedRoles=Скрыть унаследованные роли
+consentRequired=Если включено, пользователи должны дать согласие на доступ клиентскому приложению
+selectMethodType.import=Импорт
+standardFlow=Включает стандартное OpenID Connect перенаправление, основанное на аутентификации с кодом авторизации. В терминах OpenID Connect или OAuth2 спецификаций включает 'Authorization Code Flow' для этого клиента
+votedToStatus=проголосовали за {{status}}
+credentialResetConfirmText=Вы уверены, что хотите отправить электронное письмо этому пользователю?
+clientScopeType.default=По умолчанию
+helpFileUpload=Загрузить файл JSON
+addProvider_one=Добавить поставщика {{provider}}
+clientPoliciesPolicies=Политика клиентов
+editUSernameHelp=Если этот параметр включен, имя пользователя можно редактировать, в противном случае оно доступно только для чтения.
+flowCreatedSuccess=сценарий создан
+fineGrainOpenIdConnectConfiguration=Тонкая настройка конфигурации OpenID Connect
+flow.reset\ credentials=Сброс сценария учетных данных
+eventTypes.DELETE_ACCOUNT_ERROR.name=Ошибка удаления учетной записи
+eventTypes.CLIENT_DELETE_ERROR.name=Ошибка удаления клиента
+noRolesInstructions-client=Вы не создали ни одной роли для этого клиента. Создайте роль, чтобы начать.
+test=Тест
+leaveGroup_one=Покинуть группу {{name}}?
+count=Счетчик
+noPasswordPoliciesInstructions=Вы не добавили никаких политик паролей в этот realm. Добавьте политику, чтобы начать.
+testAuthentication=Проверка аутентификации
+groupNameLdapAttributeHelp=Имя атрибута LDAP, который используется в объектах группы для имени и RDN группы. Обычно это 'cn'. В этом случае типичный объект группы/роли может иметь DN, например 'cn=Group1,ouu=groups,dc=example,dc=org'.
+deleteError=Не удалось удалить провайдера {{error}}
+attributeDisplayName=Отображаемое имя
+pkceEnabled=Использовать PKCE
+userProviderSaveSuccess=Поставщик федерации пользователей успешно сохранен
+month=Месяц
+valueLabel=Значение
+dropNonexistingGroupsDuringSyncHelp=Если этот флаг установлен, то при синхронизации групп из LDAP в Keycloak мы сохраним только те группы Keycloak, которые все еще существуют в LDAP. Остальные будут удалены.
+expiration=Истечение
+addKerberosWizardTitle=Добавить поставщика федерации пользователей Kerberos
+noPasswordPolicies=Нет политики паролей
+resourceTypes=Типы ресурсов
+deleteConfirmTitle_one=Удалить группу?
+eventTypes.UPDATE_PROFILE_ERROR.description=Ошибка обновления профиля
+webAuthnUpdateSuccess=Обновление политик webauthn прошло успешно
+authorizationSignedResponseAlg=Алгоритм подписи ответа авторизации
+mapperTypeFullNameLdapMapperHelp=Используется для сопоставления полного имени пользователя из одного атрибута в LDAP (обычно атрибута "cn") с атрибутами firstName и lastName UserModel в базе данных Keycloak
+includeInUserInfo.label=Добавить в информацию о пользователе
+onDragMove=Перемещение элемента {{item}}
+back=Назад
+deleteScopeConfirm=Если вы удалите эту область авторизации, будут затронуты некоторые разрешения.
+updateOtpSuccess=Политика OTP успешно обновлена
+title=Аутентификация
+deleteAttributeError=Атрибут не удален: {{error}}
+enableClientSignatureRequiredExplain=Если вы включите "Требуется подпись клиента", адаптер этого клиента будет обновлен. Вам может потребоваться загрузить новый адаптер для этого клиента. Вам необходимо сгенерировать или импортировать ключи для этого клиента, иначе аутентификация не будет работать.
+policiesConfigTypes.formView=Вид формы
+residentKey.No=Нет
+nodeReRegistrationTimeout=Таймаут узла перерегистрации
+fineGrainSamlEndpointConfigHelp=В этом разделе настраиваются точные URL-адреса для Assertion Consumer и Single Logout Service.
+connectionURL=URL соединения
+validateCustomUserSearchFilter=Фильтр должен быть заключен в скобки, например: (фильтр)
+accessTokenLifespan=Продолжительность жизни токена доступа
+loginWithEmailHelpText=Разрешает пользователям входить с помощью E-mail.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Учетная запись поставщика удостоверений
+deleteMessageBundleSuccess=Сообщение успешно удалено из пакета
+retry=Нажмите здесь, чтобы обновить и продолжить
+selectAttributes=Выберите атрибуты
+firstBrokerLoginFlowAliasOverrideHelp=Псевдоним сценария аутентификации, который срабатывает после первого входа с этого поставщика идентификации. Термин 'First Login' означает, что еще не существует учетной записи Keycloak связанной с аутентифицированной учетной записью поставщика идентификации.
+owner=Владелец
+eventTypes.VERIFY_PROFILE.description=Проверить профиль
+executorAuthenticatorMultiSelectHelpText=Текст справки по аутентификатору исполнителя MultiSelect
+eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Ошибка ссылки на федеративную идентификацию
+eventTypes.EXECUTE_ACTIONS.name=Выполнить действия
+encryptAssertions=Зашифровать утверждения
+disableConfirmTitle=Отключить realm?
+disableConfirmClientTitle=Отключить клиент?
+disableConfirmClient=Вы уверены, что хотите отключить этот клиент?
+custom=Пользовательский атрибут...
+keyTab=Вкладка "Ключ"
+addSamlProvider=Добавить поставщика SAML
+permission=Разрешение
+saveEventListeners=Сохранить слушатели событий
+capabilityConfig=Конфигурация возможностей
+mapperTypeMsadUserAccountControlManagerHelp=Сопоставление, специфичное для MSAD. Оно может интегрировать состояние учетной записи пользователя MSAD в состояние учетной записи Keycloak (учетная запись включена, пароль просрочен и другие). Оно использует атрибуты MSAD userAccountControl и pwdLastSet для этого состояния. Например, если pwdLastSet равен 0, пользователь Keycloak должен обновить пароль. В другом примере, если userAccountControl равен 514 (отключенная учетная запись), пользователь Keycloak также отключен. Сопоставление также может обрабатывать код исключения из аутентификации пользователя LDAP.
+home=Главная
+bindFlow=Связать сценарий
+userAttributeValue=Значение атрибута пользователя
+browserFlowHelp=Выберите сценарий, который вы хотите использовать для аутентификации через браузер.
+tokenLifespan.never=Никогда не истекает
+notFound=Не удалось найти ресурс, который вы ищете
+passMaxAge=Передать max_age
+disablePolicyConfirmTitle=Отключить политику?
+eventTypes.LOGIN_ERROR.description=Ошибка входа
+linkAccount=Связать аккаунт
+attestationPreference.direct=Прямая
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.description=Ошибка аутентификации устройства OAuth2
+unlinkUsers=Отвязать пользователей
+userLdapFilter=Фильтр LDAP пользователя
+emailVerification=Проверка электронной почты
+configSaveError=Не удалось сохранить конфигурацию: {{error}}
+clientAuthenticatorTypeHelp=Аутентификатор клиента, используемый для аутентификации этого клиента на сервере Keycloak
+cachePolicyHelp=Политика кэширования для этого поставщика хранилища. "DEFAULT" — это настройки по умолчанию для глобального кэша. "EVICT_DAILY" — это время суток каждый день, когда кэш будет аннулирован. "EVICT_WEEKLY" — это день недели и время, когда кэш будет аннулирован. "MAX_LIFESPAN" — это время в миллисекундах, которое будет сроком действия записи кэша.
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Ошибка требуемого пользовательского действия
+eventTypes.SEND_RESET_PASSWORD.name=Отправить сброс пароля
+requiredFor=Требуется для
+scopePermissions.users.map-roles-description=Политики, которые определяют, может ли администратор сопоставлять роли для всех пользователей
+bindCredentialsHelp=Пароль администратора LDAP. Это поле может получить свое значение из хранилища, используйте формат ${vault.ID}.
+searchForAdminEvent=Поиск события администратора
+unitLabel=Выберите единицу времени
+webAuthnPolicySignatureAlgorithms=Алгоритмы подписи
+eventTypes.GRANT_CONSENT_ERROR.name=Ошибка предоставления согласия
+action=Действие
+shortVerificationUri=Короткий verification_uri в сценарии авторизации устройства
+placeholderText=Выберите один из
+deleteCredentialsError=Ошибка удаления учетных данных пользователя: {{error}}
+authDefaultActionTooltip=Если эта функция включена, любому новому пользователю будет назначено это обязательное действие.
+validateBindCredentials=Вам необходимо ввести пароль администратора LDAP
+evictionMinuteHelp=Минута часа, когда запись станет недействительной
+includeAuthnStatement=Включать Аутентификационные Заявки
+validatorType=Тип валидатора
+attributesHelp=Имя и (регулярное выражение) значение атрибутов для поиска в токене. Настроенное имя атрибута ищется в полях имени атрибута SAML и дружественного имени атрибута. Каждое заданное описание атрибута должно быть выполнено для установки роли. Если атрибут является массивом, то значение должно содержаться в массиве. Если атрибут может быть найден несколько раз, то достаточно одного совпадения.
+samlAttributeToRole=Если атрибут существует, предоставьте пользователю указанный realm или роль клиента.
+enableStartTls=Включить StartTLS
+addIdPMapper=Добавить сопоставление поставщика учетных записей
+createPermissionSuccess=Разрешение создано успешно
+roleAuthentication=Ролевая аутентификация
+homeURL=Используемый URL по умолчанию. Используется в случае, если серверу требуется перенаправление или обратная ссылка на клиента
+eventTypes.REVOKE_GRANT_ERROR.name=Ошибка отмены доступа
+contentSecurityPolicyReportOnly=Только отчет о политике безопасности контента
+firstBrokerLoginFlowAlias=Сценарий первого входа
+firstBrokerLoginFlowAliasOverride=Переопределение первого сценария входа в систему
+missingAttributes=Пока не определено ни одного {{label}}. Нажмите кнопку ниже, чтобы добавить {{label}}, для пары ключей требуются ключ и значение.
+testConnectionError=Ошибка! {{error}}
+authenticatedAccessPoliciesHelp=Эти политики используются, когда служба регистрации клиентов вызывается аутентифицированным запросом. Это означает, что запрос содержит токен начального доступа или токен носителя.
+deleteClientPolicyProfileSuccess=Профиль успешно удален из политики.
+reGenerateSigningExplain=Если вы повторно сгенерируете ключ подписи для клиента, база данных Keycloak будет обновлена, и вам может потребоваться загрузить новый адаптер для этого клиента.
+evaluate=Оценить
+enableLdapv3Password=Включить расширенную операцию изменения пароля LDAPv3
+status=Статус
+dragInstruction=Нажмите и переместите, чтобы изменить приоритет
+clients=Клиенты
+clientName=Имя
+syncModes.force=Сила (Force)
+deleteMappingConfirm=Вы уверены, что хотите удалить это сопоставление?
+createClientProfileSuccess=Создан новый профиль клиента
+eventTypes.CLIENT_LOGIN_ERROR.description=Ошибка входа клиента
+explainBearerOnly=Это особый тип OIDC. Этот клиент допускает только запросы токенов на предъявителя и не может участвовать в входах в браузер.
+noTranslationsInstructions=Добавьте перевод, чтобы начать.
+clearFile=Очистить этот файл
+allowCreate=Разрешить создание
+providerUpdatedError=Не удалось обновить политику клиента из-за {{error}}
+usersAddedError=Не удалось добавить пользователей в группу: {{error}}
+orderChangeErrorUserFed=Не удалось изменить приоритетный порядок поставщиков федерации пользователей {{error}}
+scopeParameterPlaceholder=Выберите параметры области действия
+deleteClientPolicyConfirmTitle=Удалить политику?
+validateRdnLdapAttribute=Вам необходимо ввести атрибут RDN LDAP
+policyUrlHelp=URL-адрес, который клиент проверяющей стороны предоставляет конечному пользователю для прочтения информации о том, как будут использоваться данные профиля
+fromDisplayName=Из отображаемого имени
+affirmative=Утвердительная
+clientRoles=Роли клиентов
+removeRoles=Удалить роли
+flowNameDescriptionHelp=Текст справки для описания имени нового сценария
+maxFailureWaitSecondsHelp=Макс. время, на которое пользователь будет заблокирован.
+groupsPath=Путь групп
+useRealmRolesMapping=Использовать сопоставление ролей realm
+identityProviderEntityId=Идентификатор сущности поставщика удостоверений
+userInfoSignedResponseAlgorithm=Алгоритм подписи ответа информации о пользователе
+selectGroup=Выбрать группу
+scopePermissions.groups.view-members-description=Политики, которые определяют, может ли администратор просматривать членов этой группы
+tableOfGroups=Таблица групп
+allowed-protocol-mappers.tooltip=Белый список разрешенных поставщиков преобразователей протоколов. Если будет предпринята попытка зарегистрировать клиента, который содержит несколько сопоставлений протоколов, которые не были внесены в белый список, запрос на регистрацию будет отклонен.
+policyProvider.role=Определите условия для ваших разрешений, при которых набору из одной или нескольких ролей разрешен доступ к объекту.
+targetOptions.brokerId=BROKER_ID
+eventTypes.VERIFY_PROFILE.name=Проверить профиль
+useRealmRolesMappingHelp=Если истинно, то сопоставления ролей LDAP будут сопоставлены с сопоставлениями ролей realm в Keycloak. В противном случае они будут сопоставлены с сопоставлениями ролей клиента.
+forwardParameters=Пересланные параметры запроса
+isAccessTokenJWTHelp=Токен доступа, полученный от поставщика удостоверений, представляет собой JWT, и его клеймы будут доступны для сопоставлений.
+frontchannelLogoutUrl=URL выхода из front-channel
+frontchannelLogoutSessionRequired=Требуется выход из сессии на front-channel
+frontchannelLogoutSessionRequiredHelp=Указание того, включаются ли параметры sid (идентификатор сессии) и iss (эмитент) в запрос на выход из системы при использовании URL-адреса выхода из системы на front-channel.
+testConnectionHint.withoutEmailAction=Настроить адрес электронной почты
+webAuthnUpdateError=Не удалось обновить политики веб-аутентификации из-за {{error}}
+paginationHelp=Поддерживает ли сервер LDAP пагинацию
+oAuthMutualHelp=Это обеспечивает поддержку токенов доступа с привязкой к сертификату OAuth 2.0 Mutual TLS, что означает, что Keycloak связывает токен доступа и токен обновления с сертификатом X.509 клиента, запрашивающего токен, которым обмениваются в Mutual TLS между точкой доступа токена keycloak и этим клиентом. Эти токены можно рассматривать как токены Holder-of-Key, а не токены предъявителя.
+deleteProviderTitle=Удалить поставщика ключей?
+scopes=Области
+accessTokens=Токены доступа
+columnName=Имя
+flowType=Тип сценария
+syncLDAPGroupsSuccessful=Данные успешно синхронизированы {{result}}
+policyEnforcementModes.PERMISSIVE=Разрешающая
+subject=Тема DN
+use=Использовать
+defaultAdminInitiated=Срок действия действия, инициированного администратором по умолчанию
+chooseAMapperType=Выберите тип сопоставления
+startTimeHelp=Определяет время, до которого политика НЕ ДОЛЖНА быть предоставлена. Предоставляется только если текущая дата/время после или равны этому значению.
+noGroupsInThisRealm=Нет групп в этом realm
+searchUserByAttributeKeyAlreadyInUseError=Ключ атрибута уже используется
+executorClientAuthenticator=Аутентификатор клиента-исполнителя
+addWebOrigins=Добавить веб-источники
+clientScopeExplain=Клиентские области представляют собой общий набор сопоставлений протоколов и ролей, которые совместно используются несколькими клиентами.
+attributeNameHelp=Имя атрибута для поиска в утверждении. Вы можете оставить это поле пустым и указать вместо него понятное имя.
+upAttributeNameHelp=Имя атрибута пользователя, используемое для уникальной идентификации атрибута.
+linkAccountTitle=Привязать аккаунт к {{provider}}
+invalidateRotatedSuccess=Обновленный секретный ключ успешно удален
+userSessionAttributeHelp=Имя атрибута сессии пользователя, который вы хотите жестко закодировать
+updateSuccessIdentityProvider=Провайдер успешно обновлен
+reloadKeys=Перезагрузить ключи
+importKeys=Импорт ключей
+useMetadataDescriptorUrl=Использовать URL-адрес дескриптора метаданных
+useMetadataDescriptorUrlHelp=Если переключатель включен, сертификаты для проверки подписей будут загружены и кэшированы из указанного "URL-адреса дескриптора метаданных". Действие "Перезагрузить ключи" можно использовать для обновления сертификатов в кэше. Если переключатель выключен, используются сертификаты из опции "Проверка сертификатов X509", их необходимо вручную обновлять при изменении в IDP.
+metadataDescriptorUrl=URL-адрес дескриптора метаданных
+metadataDescriptorUrlHelp=Внешний URL-адрес, на котором поставщик удостоверений публикует метаданные, необходимые клиенту (сертификаты, ключи, другие URL-адреса,...).
+reloadKeysSuccess=Ключи успешно перезагружены
+reloadKeysError=Ошибка перезагрузки ключей. {{error}}
+reloadKeysSuccessButFalse=Перезагрузка не была выполнена, возможно, время между запросами было слишком коротким.
+importKeysSuccess=Ключи успешно импортированы повторно. Пожалуйста, сохраните поставщика для хранения новых сертификатов.
+importKeysError=Ошибка импорта ключей. {{error}}
+importKeysErrorNoSigningCertificate=Параметр "signingCertificate" не определен в метаданных.
+host=Сервер
+forbidden_one=Запрещено, требуется разрешение:
+backchannelLogoutRevokeOfflineSessions=Выход из back-channel отменяет автономные сессии
+supportedApplications=Поддерживаемые приложения
+shortVerificationUriTooltipHelp=Если установлено, это значение будет возвращено как verification_uri в сценарии авторизации устройства. Этот uri необходимо перенаправить на {server-root}/realms/{realm}/device.
+kerberosPrincipal=Принципал Kerberos
+resourceAttribute=Атрибут ресурса
+addressClaim.region.label=Имя пользовательского атрибута, обозначающего Регион
+applyToResourceTypeFlagHelp=Указывает, должно ли это разрешение применяться ко всем ресурсам с данным типом. В этом случае это разрешение будет оцениваться для всех экземпляров данного типа ресурса.
+managePriorityInfo=Приоритет — это порядок поставщиков при выполнении поиска пользователя. Вы можете перемещать обработчики строк, чтобы изменить приоритеты.
+deletedErrorIdentityProvider=Не удалось удалить провайдера {{error}}
+included.custom.audience.tooltip=Используется только если "Включенная аудитория клиента" пуста. Указанное значение включается в поле аудитории (aud) токена. Если токен уже содержит аудитории, указанное значение добавляется к этим аудиториям, не переопределяя их.
+includeInIdToken.label=Добавить в токен ID
+steps=Шаги
+tokenDeleteConfirm=Вы уверены, что хотите навсегда удалить исходный токен доступа {{id}}
+flowCreateError=Не удалось создать сценарий: {{error}}
+readTimeoutHelp=Тайм-аут чтения LDAP в миллисекундах. Этот тайм-аут применяется к операциям чтения LDAP.
+registrationAccessTokenHelp=Токен доступа к регистрации обеспечивает доступ клиентов к службе регистрации клиентов.
+host-sending-registration-request-must-match.tooltip=Если эта опция включена, любой запрос к службе регистрации клиентов разрешен, только если он был отправлен с какого-либо доверенного хоста или домена.
+profilesConfigTypes.formView=Вид формы
+validatorDeletedSuccess=Успешно! Конфигурация профиля пользователя сохранена.
+canonicalization=Метод канонизации
+deleteConfirmTitle=Удалить realm?
+includeInAccessTokenResponse.label=Добавить в ответ на токен доступа
+SSOSessionMax=Ограничение сессии SSO
+clientScope=Область действия клиента
+inheritedFrom=Унаследовано от
+clientScopeSearch.name=Имя
+deleteConditionSuccess=Условие было удалено
+deleteConditionError=Не удалось удалить условие: {{error}}
+clientProfile=Данные профиля клиента
+syncAllUsers=Синхронизировать всех пользователей
+allowedClockSkewHelp=Смещение часов в секундах, допустимое при проверке токенов поставщика удостоверений. Значение по умолчанию — ноль.
+disableConfirmIdentityProvider=Вы уверены, что хотите отключить провайдера '{{provider}}'
+clientSaveError=Клиент не может быть обновлен: {{error}}
+tokenSaveError=Не удалось создать начальный токен доступа {{error}}
+certificate=Сертификат
+deleteConfirmExecutionMessage=Вы уверены, что хотите окончательно удалить выполнение "<1>{{name}}</1> ".
+offlineSessionMaxLimitedHelp=Включить макс. время автономной сессии
+delete=Удалить
+userGroupsRetrieveStrategyHelp=Укажите, как извлекать группы пользователя. LOAD_GROUPS_BY_MEMBER_ATTRIBUTE означает, что роли пользователя будут извлечены путем отправки запроса LDAP для извлечения всех групп, где "member" — наш пользователь. GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE означает, что группы пользователя будут извлечены из атрибута "memberOf" нашего пользователя или из другого атрибута, указанного в "Атрибуте LDAP Member-Of".
+hour=Час
+connectionTimeoutHelp=Таймаут соединения с LDAP в миллисекундах
+repeat=Повторить
+defaultSigAlgHelp=Алгоритм по умолчанию, используемый для подписи токенов для realm
+save-admin-eventsHelp=Если включено, то события администратора будет сохранены в базу данных, что сделает их доступными через консоль администратора.
+policyGroupsHelp=Указывает, каким пользователям разрешена данная политика.
+searchForProtocol=Поиск протокола сопоставления
+eventTypes.CLIENT_INFO.name=Информация о клиенте
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=Код устройства OAuth2 для токена
+eventTypes.UPDATE_TOTP_ERROR.name=Ошибка обновления TOTP
+client-updater-source-groups.tooltip=Имя проверяемых групп. Условие оценивается как истинное, если сущность, которая создает или обновляет клиента, является членом одной или нескольких указанных групп. Настроенные группы указываются по их простому имени, которое должно совпадать с именем группы Keycloak. Здесь не используется поддержка иерархии групп.
+webAuthnPolicyRpId=Идентификатор проверяющей стороны
+ldapRolesDnHelp=LDAP DN, где сохраняются роли этого дерева. Например, 'ou=finance,dc=example,dc=org'.
+serviceAccount=Разрешает Вам аутентифицировать этого клиента в Keycloak и получить токен доступа специально для этого клиента. В терминах OAuth2 спецификации включает поддержку 'Client Credentials Grant' для этого клиента
+standardTokenExchangeEnabled=Стандартный обмен токенами
+enableRefreshRequestedTokenType=Разрешить обновление токена в стандартной бирже токенов
+providerUpdatedSuccess=Клиентская политика успешно обновлена
+assertionConsumerServiceRedirectBindingURL=Привязка URL-адреса переадресации для сервиса подтверждения потребителей
+createClientScopeError=Не удалось создать область клиента: '{{error}}'
+deleteRole=Удалить эту роль
+SSOSessionSettings=Настройки сессии единого входа
+directAccessHelp=Это включает поддержку Direct Access Grants, что означает, что клиент имеет доступ к имени пользователя/паролю пользователя и обменивается ими напрямую с сервером Keycloak для токена доступа. В терминах спецификации OAuth2 это включает поддержку 'Resource Owner Password Credentials Grant' для этого клиента.
+groupHelp=Группа, в которую нужно добавить пользователя. Заполните полный путь к группе, включая path. Например: '/root-group/child-group'.
+clientPolicyNameHelp=Отображаемое имя политики
+addressClaim.country.label=Имя пользовательского атрибута, обозначающего Страна
+downloadType=это информация о типе загрузки
+clustering=Кластеризация
+createSuccess=Поставщик удостоверений успешно создан
+mapperAttributeName=Имя атрибута
+setPassword=Установить пароль
+client-updater-source-roles.tooltip=Условие проверяется во время регистрации клиента или запроса на обновление; оно оценивается как истинное, если сущность (обычно пользователь), создающая или обновляющая клиента, является членом указанной роли. Для ссылки на роль realm можно использовать имя роли realm, например, 'my_realm_role'. Для ссылки на роль клиента можно использовать client_id.role_name; например, 'my_client.my_client_role' ссылается на роль клиента 'my_client_role' клиента 'my_client'.
+createRole=Создать роль
+clientDeletedSuccess=Клиент был удален
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Ошибка ответа поставщика удостоверений
+editModeLdapHelp=READ_ONLY означает доступ только на чтение из LDAP. WRITABLE означает, что данные будут обратно синхронизированы в LDAP по заявке. UNSYNCED означает, что данные пользователя будут импортированы, но не синхронизированы обратно в LDAP.
+enableServiceAccount=Включить роли учетной записи службы
+signOutAllActiveSessionsQuestion=Выйти из всех активных сессий?
+addPostLogoutRedirectUri=Добавьте допустимые URI перенаправления после выхода из системы
+SSOSessionMaxRememberMe=Макс. длительность SSO при "Запомнить меня"
+pkceMethod=Метод PKCE
+noRoles-users=Нет ролей для этого пользователя
+showInheritedRoles=Показать унаследованные роли
+moveGroupEmptyInstructions=Подгрупп нет, выберите "Переместить сюда", чтобы переместить выбранную группу как подгруппу этой группы
+hmacGenerated=hmac-сгенерированный
+unlockSuccess=Пользователь успешно разблокирован
+unlockError=Не удалось разблокировать пользователя из-за {{error}}
+hourHelp=Определяет час, в который политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущий час равен или находится между заданными значениями.
+deleteClientProfileConfirmTitle=Удалить профиль?
+syncLDAPGroupsError=Данные не удалось синхронизировать из-за {{error}}
+saveSuccess=Поставщик федерации пользователей успешно сохранен
+generatedAccessToken=Сгенерированный токен доступа
+resetPasswordConfirmation=Подтверждение нового пароля
+testConnection=Тест соединения
+archiveFormat=Формат архивации
+requestObjectEncryptionHelp=Алгоритм JWE, который клиент должен использовать при отправке объекта запроса OIDC, указанного параметрами 'request' или 'request_uri'. Если установлено значение 'any', шифрование необязательно и разрешен любой алгоритм.
+importSuccess=Импортирован новый сертификат
+attributeConsumingServiceName=Имя службы потребления атрибутов
+invalidJsonError=Невозможно сохранить профиль пользователя, предоставленная информация недействительна JSON: {{error}}
+invalidJsonClientProfilesError=Невозможно сохранить профили клиентов, предоставленная информация недействительна JSON: {{error}}
+invalidJsonClientPoliciesError=Невозможно сохранить клиентские политики, предоставленная информация недействительна JSON: {{error}}
+promptHelp=Указывает, будет ли сервер авторизации запрашивать у конечного пользователя повторную аутентификацию и согласие.
+deleteBtn=Удалить
+defaultLocale=Язык по умолчанию
+addLdapWizardDescription=Здесь нужен текст
+aggregate.attrs.label=Агрегированные значения атрибутов
+removedGroupMembershipError=Ошибка удаления членства в группе: {{error}}
+allowPasswordAuthenticationHelp=Включить/выключить возможность аутентификации по имени/паролю вопреки базе данных Kerberos
+deleteExecutorSuccess=Успешно! Исполнитель удален.
+eventTypes.SEND_RESET_PASSWORD_ERROR.name=Ошибка отправки письма для сброса пароля
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=Первый вход в систему поставщика удостоверений
+noRoles-groups=Нет ролей для этой группы
+enableSwitchSuccess={{switch}} успешно изменен
+eventTypes.INTROSPECT_TOKEN_ERROR.name=Ошибка интроспекции токена
+usernameHelperText=Введите имя пользователя для этого поставщика удостоверений.
+includeInAccessToken.tooltip=Должен ли клейм быть добавлен в токен доступа?
+noScopeCreateHint=Сначала вам необходимо создать область авторизации.
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=Ошибка привязки учетной записи, инициированная клиентом
+clientScopesCondition=Ожидаемые области применения
+backchannelLogoutSessionRequiredHelp=Указание того, включен ли клейм sid (идентификатор сессии) в токен выхода из системы при использовании URL-адреса выхода из системы back-channel.
+global=Глобальный
+userAttributeHelp=Имя атрибута пользователя, который вы хотите жестко задать
+searchForMapper=Поиск сопоставления
+oidcCibaGrantHelp=Это обеспечивает поддержку доступа OIDC CIBA, что означает, что пользователь аутентифицируется через внешнее устройство аутентификации, а не через браузер пользователя.
+includeOneTimeUseCondition=Включить условие одноразового использования
+clientUpdaterSourceRoles=Обновление роли сущности
+enableSwitchError=Не удалось включить/отключить из-за {{error}}
+deleteClientPolicyProfileConfirm=Это действие навсегда удалит {{profileName}} из политики {{policyName}}. Это не может быть отменено.
+deleteExecutorProfileConfirm=Действие навсегда удалит {{executorName}}. Это не может быть отменено.
+confirmClientSecretBody=Если вы повторно сгенерируете секретный ключ, база данных Keycloak будет обновлена, и вам потребуется загрузить новый адаптер для этого клиента.
+keysList=Список ключей
+generatedUserInfo=Сгенерированная информация о пользователе
+clientRegistration=Регистрация клиента
+masterSamlProcessingUrl=Основной URL обработчика SAML
+samlIdentityProviderMetadata=Метаданные поставщика удостоверений SAML 2.0
+importParseError=Не удалось проанализировать файл {{error}}
+validTo=Действительно для
+addMember=Добавить участника
+eventTypes.CLIENT_INFO_ERROR.name=Ошибка информации о клиенте
+scopeParameterHelp=Вы можете скопировать значение параметра области и вставить его в начальный запрос аутентификации OpenID Connect, отправленный с этого клиентского адаптера. Клиентские области по умолчанию и выбранные необязательные клиентские области будут использоваться при генерации токена, выпущенного для этого клиента.
+idTokenEncryptionKeyManagementAlgorithm=Алгоритм управления ключами шифрования токена ID
+authenticatorAttachment.not\ specified=Не указан
+oidcCibaGrant=Доступ OIDC CIBA
+displayDescriptionHintHelp=Текст, который следует использовать в качестве подсказки при отображении форм, доступных пользователю.
+ssoSessionIdle=Допустимое время бездействия сессии. По истечении этого времени токены и браузерные сессии становятся невалидными.
+searchKey=Поиск ключа
+deleteClientSuccess=Профиль клиента удален
+emptyClientScopesPrimaryAction=Добавить клиентские области
+addStepTo=Добавить шаг к {{name}}
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=Ошибка обмена Authreqid на токен
+deleteAttributeConfirm=Вы уверены, что хотите навсегда удалить атрибут {{attributeName}} и соответствующие ему переводы?
+chooseResources=Выберите ресурсы, которые вы хотите импортировать
+selectOne=Выберите вариант
+emailTheme=Тема для E-mail
+eventTypes.UPDATE_PASSWORD.description=Обновить пароль
+policiesConfigTypes.jsonEditor=JSON-редактор
+eventConfigSuccessfully=Конфигурация успешно сохранена
+scopePermissions.users.impersonate-description=Политики, определяющие, может ли администратор выдавать себя за других пользователей
+deleteResourceWarning=Разрешения, указанные ниже, будут удалены, когда они больше не будут использоваться другими ресурсами:
+permissionScopesHelp=Указывает, что это разрешение должно быть применено к одной или нескольким областям.
+moveTo=Перейти к
+registerNodeManually=Зарегистрировать узел вручную
+redirectURI=URI перенаправления
+publicKeys=Публичные ключи
+publicKey=Открытый ключ
+emptyEventsInstructions=Больше не осталось типов событий для добавления
+periodicFullSync=Периодическая полная синхронизация
+removeConfirmTitle_other=Удалить группы?
+clientAccesstypeTooltip=Тип доступа клиента, к которому будет применено условие.
+emptyBuiltInMappersInstructions=Все встроенные сопоставления были добавлены в этот клиент
+assertionLifespanHelp=Срок службы, установленный в условиях утверждения SAML. По истечении этого времени утверждение будет недействительным. Атрибут "SessionNotOnOrAfter" не изменяется и продолжает использовать время "SSO Session Max", определенное на уровне realm.
+noTokensInstructions=Вы не создали ни одного начального токена доступа. Создайте начальный токен доступа, нажав "Создать".
+editUsername=Если включено, имя пользователя можно редактировать, иначе - только для чтения.
+ldapAttributeValueHelp=Значение атрибута LDAP, которое будет добавлено новому пользователю во время регистрации. Вы можете либо жестко закодировать любое значение, например 'foo', либо использовать некоторые специальные токены. В настоящее время поддерживается только токен '${RANDOM}', который будет заменен на некоторую случайно сгенерированную строку.
+lastRegistration=Последняя регистрация
+advancedSettingsOpenid-connect=Этот раздел используется для настройки дополнительных параметров этого клиента, связанных с протоколом OpenID Connect
+requireSsl=Требует SSL
+reevaluate=Перепроверить
+clientOfflineSessionMax=Макс. офлайн-сессия клиента
+eventTypes.SEND_VERIFY_EMAIL.description=Ошибка отправки письма для подтверждения
+eventTypes.REVOKE_GRANT_ERROR.description=Ошибка отмены доступа
+descriptionLanding=Это описание целевой страницы федерации пользователей
+moveHere=Перейти сюда
+noKeys=Нет ключей
+batchSizeHelp=Количество пользователей LDAP, импортируемых из LDAP в Keycloak в рамках одной транзакции
+createClientConditionSuccess=Условие успешно создано.
+kerberosKeyTab=Вкладка "Ключ Kerberos"
+principalAttribute=Атрибут-идентификатор
+mapperTypeLdapAttributeMapperHelp=Это сопоставление поддерживается только если включен syncRegistrations. Новые пользователи, зарегистрированные в Keycloak, будут записаны в LDAP с жестко закодированным значением некоторого указанного атрибута.
+userRegistrationHelpText=Включить/выключить страницу регистрации. Ссылка для регистрации будет также показана на странице входа.
+activeHelp=Установите, можно ли использовать ключи для подписи
+addMapperExplain=Если вам нужен более детальный контроль, вы можете создать на этом клиенте средство сопоставления протоколов
+realmRoles=Роли realm
+fineGrainOpenIdConnectConfigurationHelp=Этот раздел используется для настройки дополнительных параметров данного клиента, связанных с протоколом OpenID Connect.
+searchForUserDescription=Этот realm может иметь федеративного провайдера. Просмотр всех пользователей может замедлить работу системы, но это можно сделать, выполнив поиск по "*". Пожалуйста, найдите пользователя выше.
+expirationHelp=Установить срок истечения для событий. Истекшие события периодически удаляются из базы данных.
+webAuthnPolicySignatureAlgorithmsHelp=Алгоритмы подписи, которые следует использовать для подтверждения аутентификации.
+setToNowError=Ошибка! Не удалось установить notBefore на текущую дату и время: {{error}}
+eventTypes.UNREGISTER_NODE_ERROR.description=Ошибка отмены регистрации узла
+clientScopeTypes.optional=Необязательный
+nameIdFormat=Формат Name ID
+eventTypes.SEND_VERIFY_EMAIL_ERROR.name=Ошибка отправки письма для подтверждения
+addTranslationSuccess=Успешно! Перевод добавлен.
+validRedirectUri=Валидация URI перенаправления
+webauthnIntro=Для чего используется эта форма?
+wantAssertionsEncryptedHelp=Указывает, ожидает ли данный поставщик услуг зашифрованное утверждение.
+roleObjectClasses=Классы объектов ролей
+deleteClientScope_other=Удалить {{count}} клиентских областей
+deleteCredentialsConfirmTitle=Удалить учетные данные?
+expires=Истекает
+OVERWRITE=Перезаписать
+user-clearEventsHelp=Удаляет все пользовательские события в базе данных.
+eventTypes.REFRESH_TOKEN.name=Обновить токен
+userAttribute=Атрибут пользователя
+revoke=Отозвать
+admin=Админ
+syncUsersError=Не удалось синхронизировать пользователей: '{{error}}'
+generatedAccessTokenHelp=Посмотрите пример токена доступа, который будет сгенерирован и отправлен клиенту при аутентификации выбранного пользователя. Вы можете увидеть клеймы и роли, которые будет содержать токен, на основе эффективных сопоставлений протоколов и сопоставлений областей ролей, а также на основе клеймов и ролей, назначенных фактическому пользователю.
+webAuthnPolicyAcceptableAaguidsHelp=Список разрешенных AAGUID, аутентификатор которых может быть зарегистрирован. AAGUID — это 128-битный идентификатор, указывающий тип аутентификатора (например, марку и модель).
+keyPasswordHelp=Пароль для доступа к приватного ключу в архиве
+frontchannelLogout=Выход с front-channel
+clientUpdaterTrustedHostsTooltip=Список хостов, которым доверяют. Если запрос на регистрацию или обновление клиента поступает с хоста/домена, указанного в этой конфигурации, условие оценивается как истинное. Вы можете использовать имена хостов или IP-адреса. Если вы используете звездочку в начале (например, '*.example.com'), весь домен example.com является доверенным.
+titleRoles=Роли realm
+mapperTypeGroupLdapMapperHelp=Используется для сопоставления групповых сопоставлений групп из некоторых LDAP DN с сопоставлениями групп Keycloak
+sectorIdentifierUri.tooltip=Провайдеры, использующие пары вспомогательных значений и поддерживающие динамическую регистрацию клиентов ДОЛЖНЫ использовать sector_identified_uri параметр. Это обеспечивает способ для группы сайтов под общим административным контролем, чтобы иметь последовательные попарные значения независимо от индивидуальных доменных имен. Это также обеспечивает способ для клиентов для изменения redirect_uri доменов, не имещющих возможности перерегистрации всех своих пользователей.
+eventTypes.REVOKE_GRANT.name=Отозвать доступ
+rdnLdapAttribute=Атрибут RDN в LDAP
+usedBy=Используется
+replyToDisplayName=Ответить на отображаемое имя
+xRobotsTag=X-Robots-Tag
+bindType=Тип аутентификации
+tokenDeleteSuccess=Первоначальный токен доступа успешно удален
+contextualInfo=Контекстная информация
+syncModeHelp=Режим синхронизации по умолчанию для всех сопоставлений. Режим синхронизации определяет, когда данные пользователя синхронизируются с помощью сопоставлений. Существует три возможных значения: "legacy" для сохранения поведения до введения этой опции, "import" для импорта пользователя только один раз, а именно во время первого входа пользователя с этим поставщиком удостоверений, и "force" для всегда обновлять пользователя при каждом входе с этим поставщиком удостоверений.
+temporaryPassword=Временный
+applyPolicyHelp=Определяем все политики, которые должны быть применены к областям, определенным этой политикой или разрешением.
+addKerberosWizardDescription=Здесь нужен текст
+sslType.none=Нет
+dateTo=Дата(включительно)
+eventTypes.REVOKE_GRANT.description=Отозвать доступ
+keyPlaceholder=Введите ключ
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.name=В контексте Keycloak это название события ошибки при проверке пользовательского кода в OAuth2 Device Flow
+addAuthnContextDeclRef=Добавить AuthnContext DeclRef
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.description=Отправить ссылку поставщика удостоверений
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Поставщик удостоверений извлекает токен
+userInfo=Информация о пользователе
+consentScreenText=Текст экрана согласия
+addRoles=Добавить роли
+clientPoliciesProfilesHelpText=Профиль клиента позволяет создавать набор исполнителей, которые обеспечивают выполнение различных действий, выполняемых с клиентом. Действия могут быть действиями администратора, такими как создание или обновление клиента, или действиями пользователя, такими как аутентификация для клиента.
+archiveFormatHelp=Формат архивации Java keystore или PKCS12.
+xContentTypeOptions=X-Content-Type-Options
+groupsDescription=Группа — это набор атрибутов и сопоставлений ролей, которые можно применить к пользователю. Вы можете создавать, редактировать и удалять группы и управлять их дочерне-родительской организацией.
+addValidatorRole=Добавить валидатор {{validatorName}}
+protocolTypes.all=Все
+keyAlias=Псевдоним ключа
+xContentTypeOptionsHelp=Значение по умолчанию не позволяет Internet Explorer и Google Chrome отслеживать MIME-ответы вне объявленного типа контента. <1>Узнать больше</1>
+privateKeyMask=ЧАСТНЫЙ КЛЮЧ НЕ УСТАНОВЛЕН ИЛИ НЕ ИЗВЕСТЕН
+signOutAllActiveSessions=Выйти из всех активных сессий
+addExecutorSuccess=Успешно! Исполнитель создан успешно
+executorTypeSelectHelpText=Справка по выбору типа исполнителя
+useDiscoveryEndpointHelp=Если этот параметр включен, точка доступа обнаружения будет использоваться для получения конфигурации поставщика. Keycloak может загрузить конфигурацию из точки доступа и автоматически обновить конфигурацию, если у источника есть какие-либо обновления.
+eventTypes.USER_INFO_REQUEST_ERROR.name=Ошибка запроса информации о пользователе
+createUserProviderError=Не удалось создать поставщика федерации пользователей: {{error}}
+learnMore=Узнать больше
+onDragCancel=Перемещение отменено. Список не изменился.
+removeUser=Удалить пользователей
+ownerManagedAccess=Включен управляемый пользователем доступ
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=Пользователь отключен постоянной блокировкой
+eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=Пользователь отключен из-за постоянной ошибки блокировки
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=Пользователь отключен из-за временной блокировки
+eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=Пользователь отключен из-за ошибки временной блокировки
+userModelAttributeNameHelp=Имя атрибута модели, который будет добавлен при импорте пользователя из LDAP
+templateHelp=Шаблон для форматирования имени пользователя для импорта. Подстановки заключаются в ${}. Например: '${ALIAS}.${CLAIM.sub}'. ALIAS — псевдоним поставщика. CLAIM.<NAME> ссылается на идентификатор или токен клейм. Подстановку можно преобразовать в верхний или нижний регистр, добавив |верхний регистр или |нижний регистр к заменяемому значению, например, '${CLAIM.sub | lowercase}.
+permissions=Разрешения
+emptyExecutionInstructions=Вы можете начать определять этот сценарий, добавив подсценарий или выполнение
+offlineSessionSettings=Настройки офлайн-сессии
+unAssignRole=Отменить назначение
+deleteScope=Удалить область авторизации навсегда?
+eventTypes.CODE_TO_TOKEN.description=Код для токена
+oAuthDevicePollingIntervalHelp=Мин. время в секундах, которое клиент должен ждать между запросами опроса точки доступа токена.
+passwordDataTitle=Данные пароля
+accountThemeHelp=Выберите тему для управления учетной записью пользователя.
+clientPolicies=Политика в отношении клиентов
+NONE=НИКТО
+keystorePasswordHelp=Пароль для хранилища ключей
+clientSettings=Данные клиента
+deleteClientPolicyConditionConfirm=Это действие навсегда удалит {{condition}}. Это не может быть отменено.
+selectATheme=Выберите тему
+themeColors=Цвета темы
+defaults=Сброс к настройкам по умолчанию
+themeColorsLight=Цвета темы [светлые]
+themeColorsDark=Цвета темы [темные]
+themePreviewInfo=Для предварительного просмотра цветов темы необходимо установить текущую тему, которую вы хотите просмотреть, поэтому мы автоматически переключили вас на ту, которую вы хотите посмотреть.
+backgroundImage=Фоновое изображение входа
+favicon=Иконка сайта
+errorColor=Цвет ошибки
+successColor=Цвет успеха
+activeColor=Активный цвет
+primaryColor=Основной цвет
+primaryColorHover=Основной цвет при наведении
+secondaryColor=Вторичный цвет
+linkColor=Цвет ссылки
+linkColorHover=Цвет ссылки при наведении
+backgroundColorAccent=Цветовой акцент фона
+backgroundColor=Цвет фона
+backgroundColorNav=Цвет фона навигации
+backgroundColorHeader=Цвет фона заголовка
+iconColor=Цвет значка
+textColor=Цвет текста
+lightTextColor=Светлый цвет текста
+inputBackgroundColor=Введите цвет фона
+inputTextColor=Цвет входного текста
+permissionsList=Список разрешений
+attributeGroupHelp=Указывает группу профиля пользователя, в которую будет добавлен этот атрибут. Это позволяет группировать различные похожие атрибуты вместе на разных частях экрана при создании или обновлении пользователя.
+createRealm=Создать realm
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=Ошибка проверки токена доступа
+mapperSaveError=Ошибка сохранения карты: {{error}}
+eventTypes.CLIENT_LOGIN_ERROR.name=Ошибка входа клиента
+passwordPoliciesHelp.passwordHistory=Предотвращает повторное использование недавно использованного пароля.
+displayOnConsentScreenHelp=Если включено, и эта клиентская область добавлена к какому-либо клиенту с требуемым согласием, текст, указанный в 'Текст экрана согласия', будет отображаться на экране согласия. Если выключено, эта клиентская область не будет отображаться на экране согласия.
+requirements.DISABLED=Отключено
+mapperTypeHardcodedLdapGroupMapperHelp=Пользователи, импортированные из LDAP, будут автоматически добавлены в эту настроенную группу.
+titleUsers=Пользователи
+whoWillAppearLinkText=Кто появится в этом групповом списке?
+ldapFullNameAttribute=Атрибут полного имени LDAP
+createClientError=Не удалось создать клиента: '{{error}}'
+deleteConfirmClientScopes=Вы уверены, что хотите удалить эту клиентскую область?
+forceAuthenticationHelp=Указывает, должен ли поставщик идентификации аутентифицировать ведущего напрямую, а не использовать предыдущий контекст безопасности.
+testClusterAvailability=Протестировать доступность кластера
+reGenerateSigning=Повторно сгенерировать ключ подписи для этого клиента
+authorizationEncryptedResponseAlgHelp=Алгоритм JWA, используемый для управления ключами при шифровании ответа авторизации, когда режим ответа — jwt. Этот параметр необходим, если вам нужен зашифрованный ответ авторизации. Если оставить пустым, ответ авторизации будет просто подписан, но не зашифрован.
+deleteConfirmGroup_other=Вы уверены, что хотите удалить эти группы?
+scopePermissions.users.manage-description=Политики, которые определяют, может ли администратор управлять всеми пользователями в realm
+defaultACRValuesHelp=Значения по умолчанию, которые будут использоваться в качестве добровольного ACR в случае, если в запросе OIDC нет явного ACR, запрошенного параметром "claims" или "acr_values".
+minimumACRValueHelp=Мин. ACR, который должен быть обеспечен Keycloak. Переопределяет более низкие ACR, явно запрошенные 'acr_values' или 'claims', если они не помечены как существенные.
+membershipAttributeType=Тип атрибута членства
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Запрос на авторизацию отправлен
+included.client.audience.tooltip=Идентификатор клиента указанной аудитории будет включен в поле аудитории (aud) токена. Если токен включает аудитории, указанное значение добавляется к ним. Оно не будет перезаписывать существующие аудитории.
+searchGroup=Поиск группы
+allowCreateHelp=Разрешить внешнему поставщику удостоверений создать новый идентификатор, представляющий принципала.
+allResults=Все результаты
+addressClaim.locality.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'locality' внутри атрибута 'address' токен клейма. По умолчанию 'locality'.
+keyForCodeExchangeHelp=Выберите, какой метод проверки ключа для обмена кодами (PKCE) используется. Если не указано иное, Keycloak не применяет PKCE к клиенту, если только клиент не отправит запрос на авторизацию с соответствующим методом проверки кода и обмена кодами.
+includeInAccessTokenResponse.tooltip=Нужно ли добавлять клейм в ответ на токен доступа? Следует использовать только для информативных и неконфиденциальных данных
+removeMappingConfirm_one=Вы уверены, что хотите удалить эту роль?
+oidcSettings=Настройки OpenID Connect
+oAuthSettings=Настройки OAuth2
+otpPolicyDigitsHelp=Сколько цифр должен иметь OTP?
+clientAuthentications.client_secret_post=Секретный ключ клиента отправлен по почте
+prompts.select_account=Выберите аккаунт
+defaultACRValues=Значения ACR по умолчанию
+minimumACRValue=Мин. значение ACR
+valueError=Необходимо указать значение.
+noConsents=Нет согласия
+orderChangeSuccessUserFed=Успешно изменен порядок приоритетов поставщиков федерации пользователей
+noUsersEmptyStateDescriptionContinued=чтобы найти их. Пользователи, у которых уже есть эта роль как эффективная роль, не могут быть добавлены сюда.
+userProviderSaveError=Не удалось сохранить поставщика федерации пользователей: {{error}}
+executorsHelpText=Исполнители, которые будут применяться для данного профиля клиента
+ldapSearchingAndUpdatingSettings=Поиск и обновление LDAP
+authenticationAliasHelp=Имя конфигурации
+SSOSessionIdle=Таймаут сессии SSO
+deleteClientPolicyConditionConfirmTitle=Удалить условие?
+initialCounterErrorHint=Значение должно быть от 1 до 120
+connectionTimeout=Таймаут соединения
+passLoginHintHelp=Передайте login_hint поставщику удостоверений.
+monthHelp=Определяет месяц, в который политика ДОЛЖНА быть разрешена. Вы также можете определить диапазон, заполнив второе поле. В этом случае разрешение выдается только если текущий месяц равен или находится между заданными значениями.
+eventTypes.CLIENT_LOGIN.description=Вход для клиента
+registrationAccessToken=Токен доступа к регистрации
+headerName=имя заголовка
+issuerHelp=Идентификатор эмитента для эмитента ответа. Если не предоставлен, проверка не будет выполняться.
+uiDisplayNameHelp=Отображение имени поставщика при ссылке в интерфейсе администратора
+titleSessions=Сессии
+dedicatedScopeName={{clientName}}-dedicated
+mapperTypeUserAttributeLdapMapper=user-attribute-ldap-mapper
+deleteAttributeConfirmTitle=Удалить атрибут?
+importSkipped_zero=Пропущенных записей нет.
+rootURL=Корневой URL добавляется к относительным URL
+contentSecurityPolicyHelp=Значение по умолчанию предотвращает включение страниц в неоригинальные iframe. <1>Узнать больше</1>
+policyUsers=Указывает, каким пользователям разрешена данная политика.
+logoutServicePostBindingURLHelp=SAML POST связанный URL для клиентского сервиса единого выхода. Если Вы используете другие привязки, то можете оставить это поле пустым.
+generatedIdTokenNo=Нет сгенерированного идентификатора токена
+byConfiguration=По конфигурации
+usersAdded_other={{count}} пользователей добавлено в группу
+userFedUnlinkUsersConfirmTitle=Отменить привязку всех пользователей?
+passCurrentLocale=Пропустить текущую локаль
+realmNameField=Имя realm
+roleCreated=Роль создана
+socialProfileJSONFieldPath=Путь поля JSON социального профиля
+noViewRights=У вас нет прав на просмотр этой группы.
+eventTypes.SEND_RESET_PASSWORD.description=Отправить сброс пароля
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=Клиент инициировал привязку аккаунта
+resourceScopeError=Не удалось удалить область авторизации из-за {{error}}
+identityInformation=Идентичность данных
+usermodel.clientRoleMapping.rolePrefix.label=Префикс ролей клиента
+partialImport=Частичный импорт
+cibaBackhannelTokenDeliveryModes.ping=Пинг
+includeInTokenScopeHelp=Если включено, имя этой клиентской области будет добавлено в свойство токена доступа 'scope', а также в ответ Token Introspection Endpoint. Если выключено, эта клиентская область будет исключена из токена и из ответа Token Introspection Endpoint.
+savePassword=Сохранить пароль
+noRolesInstructions-users=Вы не назначили ни одной роли этому пользователю. Назначьте роль, чтобы начать.
+signatureKeyNameHelp=Подписанные SAML документы содержат идентификаторы ключей подписи в элементе KeyName. Для Keycloak / RH-SSO контрагентов, используйте KEY_ID, для MS AD FS используйте CERT_SUBJECT, для остальных установите и используйте NONE если другие опции не работают.
+sync-keycloak-roles-to-ldap=Синхронизировать роли Keycloak с LDAP
+decisionStrategies.UNANIMOUS=Единогласно
+cacheSettingsDescription=В этом разделе содержатся параметры, полезные для кэширования пользователей, которые были загружены из этого поставщика хранилища пользователей.
+groupsPathHelp=Путь группы Keycloak, в который добавляются группы LDAP. Например, если используется значение '/Applications/App1', то группы LDAP будут доступны в Keycloak в группе 'App1', которая является дочерней для группы верхнего уровня 'Applications'. Значение по умолчанию - '/', поэтому группы LDAP будут сопоставлены с группами Keycloak на верхнем уровне. Настроенный путь группы должен уже существовать в Keycloak при создании этого сопоставления.
+aesGenerated=aes-сгенерированный
+addPolicy=Добавить политику
+tokenClaimName.label=Имя переменной в токен клейме
+executorsTable=Таблица исполнителей
+extendToChildren=Распространить на дочерние
+from=От
+decisionStrategyHelp=Стратегия принятия решений определяет, как оцениваются разрешения и как принимается окончательное решение. "Утвердительное" означает, что по крайней мере одно разрешение должно оцениваться как положительное решение, чтобы предоставить доступ к ресурсу и его областям. "Единогласно" означает, что все разрешения должны оцениваться как положительное решение, чтобы окончательное решение также было положительным.
+deleteClientPolicyProfileError=Не удалось удалить профиль из политики: {{error}}
+greaterThan=Должно быть больше {{value}}
+hideOnLoginPage=Скрыть на странице входа
+couldNotCreateGroup=Не удалось создать группу {{error}}
+defaultRole=Эта роль служит контейнером для ролей по умолчанию как realm, так и клиента. Ее нельзя удалить.
+eventConfigs=Конфигурация событий
+conditionsHelp=Условия, которые будут оцениваться для определения того, следует ли применять политику клиента во время конкретного действия или нет.
+disableProvider=Отключить провайдер?
+eventTypes.UNREGISTER_NODE.name=Отменить регистрацию узла
+anonymousAccessPoliciesHelp=Эти политики используются, когда служба регистрации клиентов вызывается неаутентифицированным запросом. Это означает, что запрос не содержит ни Initial Access Token, ни Bearer Token.
+clientScopeError=Не удалось обновить сопоставление областей {{error}}
+saveRealmSuccess=Realm успешно создан
+createToken=Создать начальный токен доступа
+clientsClientTypeHelp='OpenID connect' разрешает клиентам проверить личность конечного пользователя, основанного на выполнении аутентификации на Сервере Авторизации. 'SAML' включает веб-сценарии аутентификации и авторизации, включая кроссдоменные центры единого управления доступом (SSO) и использующие токены безопасности, содержащие заявления на передачу информации.
+orderChangeSuccess=Успешно изменен порядок отображения поставщиков удостоверений
+emptyPoliciesInstructions=Если вы хотите создать политику, нажмите кнопку ниже, чтобы создать политику.
+createScopeSuccess=Область авторизации успешно создана
+logoUrl=URL-адрес логотипа
+accessTokenLifespanImplicitFlowHelp=Макс. время до истечения срока действия токена доступа, выданного во время неявного сценария OpenID Connect. Рекомендуется, чтобы это значение было короче тайм-аута SSO. Во время неявного сценария нет возможности обновить токен, поэтому существует отдельный тайм-аут, отличный от "Срока службы токена доступа".
+noRealmRolesToAssign=Нет ролей в realm, которые можно назначить
+logoutUrl=URL выхода
+regexPatternHelp=Задает шаблон регулярного выражения.
+searchForUserEvent=Поиск события пользователя
+usernameLdapAttributeHelp=Имя атрибута LDAP, которое отображается как имя пользователя Keycloak. Для многих поставщиков серверов LDAP это может быть "uid". Для Active Directory это может быть "sAMAccountName" или "cn". Атрибут должен быть заполнен для всех записей пользователей LDAP, которые вы хотите импортировать из LDAP в Keycloak.
+federationLink=Федеративная ссылка
+webAuthnPolicyPasswordlessFormHelp=Политика для аутентификации WebAuthn без пароля. Эта политика используется обязательным действием "Webauthn Register Passwordless" и аутентификатором "WebAuthn Passwordless Authenticator". Типичное использование — когда WebAuthn используется в качестве аутентификации первого фактора. Наличие как "WebAuthn Policy", так и "WebAuthn Passwordless Policy" позволяет использовать WebAuthn как аутентификатор первого и второго фактора в одном и том же realm.
+unlinkUsersError=Не удалось отменить связь пользователей: '{{error}}'
+roleHelpHelp=Роль, которую нужно предоставить пользователю. Нажмите кнопку "Выбрать роль", чтобы просмотреть роли, или просто введите ее в текстовое поле. Для ссылки на роль приложения синтаксис — appname.approle, т. е. myapp.myrole.
+storedTokensReadable=Сохраненные токены доступны на чтение
+defaultRoleDeleteError=Вы не можете удалить роль по умолчанию.
+unknownUser=Анонимный
+displayHeader=Отображаемое имя
+userVerify.not\ specified=Не указано
+usermodel.prop.label=Свойство
+userFedUnlinkUsersConfirm=Хотите отменить привязку всех пользователей? Любые пользователи без пароля в базе данных больше не смогут пройти аутентификацию.
+searchUserByAttributeDescription=Поддерживает установку нескольких атрибутов в качестве фильтра поиска путем установки различных ключей или значений. Для ключа можно ввести только одно значение.
+eventTypes.REMOVE_FEDERATED_IDENTITY.name=Удалить федеративную идентификацию
+membership=Членство
+eventTypes.RESET_PASSWORD.description=Сбросить пароль
+authenticationOverrides=Переопределение сценария аутентификации
+client-scopes-condition.label=Ожидаемые области применения
+deleteAttributeSuccess=Атрибут удален
+artifactResolutionService=Служба разрешения артефактов
+clientProfilesSubTab=Подвкладка "Профили клиентов"
+selectEncryptionType=Выберите тип шифрования
+mapperTypeMsadLdsUserAccountControlMapper=msad-user-account-control-mapper
+realmSettingsExplain=Настройки realm — это настройки, которые управляют параметрами пользователей, приложений, ролей и групп в текущем realm.
+mappingUpdatedError=Не удалось обновить сопоставление: '{{error}}'
+manageDisplayOrder=Управление порядком отображения
+emptyRealmBasedIdps=Для этого realm не настроены поставщики удостоверений на основе realm.
+hideOrganizationLinkedIdps=Скрыть поставщиков удостоверений, связанных с организацией
+exactSearch=Точный поиск
+value=Значение
+filenamePlaceholder=Загрузите PEM-файл или вставьте ключ ниже
+deleteConfirm_one=Вы уверены, что хотите удалить эту группу '{{groupName}}'.
+scopeDisplayNameHelp=Уникальное имя для этой области. Имя может использоваться для уникальной идентификации области, полезно при запросе определенной области.
+times.seconds=секунд
+removeMappingTitle=Удалить роль?
+executorTypeSelectAlgorithm=Алгоритм выбора типа исполнителя
+resources=Ресурсы
+userRolesRetrieveStrategy=Стратегия извлечения ролей пользователя
+importKey=Импортировать ключ
+events-disable-title=Удалить сохраненные события?
+ellipticCurve=Эллиптическая кривая
+forceArtifactBindingHelp=Должны ли ответные сообщения возвращаться клиенту через систему привязки SAML ARTIFACT?
 forceAuthentication=Принудительная аутентификация
+connectionPoolingHelp=Определяет, должен ли Keycloak использовать пул подключений для доступа к серверу LDAP. Пул подключений не может использоваться, если включен StartTLS.
+unlink=Отвязать
+groupRemove_other=Группы удалены
+claimFilterName=Основной клейм
+deletePolicy=Удалить политику навсегда?
 assertionConsumerServiceRedirectBindingURLHelp=SAML переадресация на привязанный URL для клиентского сервиса подтверждения потребителей (запросы входа). Вы можете оставить это поле пустым, если вы не имеете URL для осуществления такой привязки.
-policyDecisionStagey=Стратегия решения диктует как политики связаны с заданными разрешениями и как формируется окончательное решение. 'Утвердительная' означает, что, по крайней мере, одна политика должна дать положительную оценку для того, чтобы окончательное решение также было положительным. 'Единогласная' означает что все политики должны дать положительную оценку для того, чтобы окончательная оценка также была положительной. 'Консенсусная' означает, что количество положительных решений должно превышать количество отрицательных решений. Если количество положительных и отрицательных решений совпадает, окончательное решение будет отрицательным.
+searchFor=Поиск роли по имени
+providers=Добавить поставщиков
+writeOnly=Только запись
+noRolesInstructions-clientScopes=Вы не создали ни одной роли для этого клиентского диапазона. Создайте роль, чтобы начать.
+noRolesInstructions-clients=Вы не создали ни одной роли для этого клиентского диапазона. Создайте роль, чтобы начать.
+removeImportedUsersMessage=Вы действительно хотите удалить всех импортированных пользователей?
+noGroupsInThisSubGroup=В этой подгруппе нет групп
+validateUserObjectClasses=Вам необходимо ввести один или несколько классов объектов пользователя
+encryptionAlgorithm=Алгоритм шифрования
+requiredForLabel.users=Только пользователи
+groupUpdated=Группа обновлена
+hideMetaData=Скрыть метаданные
+customAttribute=Пользовательский атрибут…
+themes=Темы
+clientType='OpenID connect' разрешает клиентам проверить личность конечного пользователя, основанного на выполнении аутентификации на Сервере Авторизации. 'SAML' включает веб-сценарии аутентификации и авторизации, включая кроссдоменные центры единого управления доступом (SSO) и использующие токены безопасности, содержащие заявления на передачу информации
+addClientScope=Добавить шаблон клиента
+notBeforeSuccess=Успешно! "Не раньше" установлено для realm
+clientPoliciesSubTab=Подвкладка "Политики клиента"
+quickLoginCheckMilliSecondsHelp=Если сбой происходит одновременно и слишком быстро, заблокируйте пользователя.
+unanimous=Единогласно
+policy-name=Название этой политики.
+syncRegistrations=Синхронизация регистраций
+eventTypes.REMOVE_TOTP.name=Удалить TOTP
+clientHelp=Выберите клиента, осуществляющего авторизационный запрос. Если не задан, авторизационные запросы будут основаны на том клиенте, в котором вы находитесь.
+eventTypes.CLIENT_REGISTER_ERROR.name=Ошибка регистрации клиента
+unlockUsersError=Не удалось разблокировать всех пользователей {{error}}
+serviceProviderEntityIdHelp=Идентификатор сущности, который будет использоваться для уникальной идентификации этого поставщика услуг SAML.
+disabledFeatures=Отключенные функции сервера
+eventTypes.UPDATE_CONSENT_ERROR.name=Ошибка согласия на обновление
+noAdminUrlSet=Push-уведомление не отправлено. Не настроен URI администратора или нет доступных зарегистрированных узлов кластера
+authData=Данные авторизации
+realmInfo=Информация о realm
+chooseAPolicyType=Выберите тип политики
+signOut=Выход
+deleteExecutorError=Не удалось удалить исполнителя: {{error}}
+userProfileError=Не удалось обновить настройки профиля пользователя: {{error}}
+validatorDialogColNames.colName=Имя роли
+clientUpdaterSourceRolesTooltip=Условие проверяется во время регистрации клиента или запросов на обновление; оно оценивается как истинное, если сущность (обычно пользователь) создает или обновляет клиента, принадлежащего указанной роли. Для ссылки на роль realm можно использовать имя роли realm, например, 'my_realm_role'. Для ссылки на роль клиента можно использовать client_id.role_name; например, 'my_client.my_client_role' ссылается на роль клиента 'my_client_role' клиента 'my_client'.
+UPDATE_PASSWORD=Обновить пароль (UPDATE_PASSWORD)
+version=Версия
+synchronizationSettings=Настройки синхронизации
+certificateHelp=Клиентский сертификат для валидации JWT, выпущенный клиентом и подписанный клиентским приватным ключом из Вашего хранилища ключей.
+resetPasswordError=Ошибка сброса пароля: {{error}}
+associatedPermissions=Связанное разрешение
+encryptionKeysConfigExplain=Если вы включите "Утверждения шифрования" ниже, вам необходимо настроить ключи шифрования, сгенерировав или импортировав ключи, а утверждения SAML будут зашифрованы открытым ключом клиента с использованием AES.
+preserveGroupInheritanceHelp=Отметьте, следует ли распространять групповое наследование из LDAP на Keycloak. Если false, то все группы LDAP будут отображены как плоские группы верхнего уровня в Keycloak. В противном случае групповое наследование сохраняется в Keycloak, но синхронизация групп может завершиться неудачей, если структура LDAP содержит рекурсии или несколько родительских групп на дочерние группы.
+createScopeBasedPermission=Создать разрешение на основе области действия
+showMore=Показать больше
+operationType=Тип операции
+userInitiatedActionLifespan=Продолжительность действия, инициированного пользователем
+decisionStrategy=Стратегия решения
+roleMappingUpdatedSuccess=Обновлено сопоставление ролей
+securityDefences=Защита безопасности
+realmSettings=Настройки realm
+emptyStateInstructions=Если вы хотите добавить группу атрибутов, нажмите кнопку ниже.
+logoutAllSessionsError=Ошибка! Не удалось выйти из всех сессий: {{error}}.
+eventTypes.VERIFY_EMAIL_ERROR.name=Ошибка проверки электронной почты
+partialExport=Частичный экспорт
+eventTypes.CLIENT_REGISTER.description=Реестр клиентов
+generalOptions=Общие параметры
+decisionStrategies.AFFIRMATIVE=Утвердительный
+helpEnabled=Помощь с
+defaultGroupsHelp=Группы по умолчанию позволяют автоматически назначать членство в группах всякий раз, когда создается или импортируется новый пользователь через <1>посредника по идентификации.</1>.
+times.years=Годы
+userLdapFilterHelp=Дополнительный фильтр LDAP для фильтрации искомых пользователей. Оставьте это поле пустым, если вам не нужен дополнительный фильтр. Убедитесь, что он начинается с '(' и заканчивается на ')'.
+generatedIdToken=Сгенерированный идентификатор токена
+effectiveRoleScopeMappings=Эффективное сопоставление областей действия ролей
+clientAuthenticator=Проверка подлинности клиента
+importAdded_other=Добавлено {{count}} записей.
+oAuthDeviceCodeLifespanHelp=Макс. время до истечения срока действия кода устройства и кода пользователя. Это значение должно быть достаточно длительным, чтобы его можно было использовать (позволяя пользователю извлечь свое вторичное устройство, перейти к URI проверки, войти и т. д.), но должно быть достаточно коротким, чтобы ограничить возможность использования кода, полученного для фишинга.
+dynamicScopeHelp=Если включено, эта область будет считаться динамической областью, которая будет состоять из статической и переменной части.
+attributePermissionDescription=В этом разделе содержатся разрешения на редактирование и просмотр атрибута.
+providerDetails=Данные поставщика
+groupDeleteError=Ошибка удаления группы {{error}}
+editGroupText=Изменить группу атрибутов
+updateFirstLoginHelp=Обновить профиль при первом входе
+deleteGroup=Удалить группу
+eventTypes.VERIFY_EMAIL_ERROR.description=Ошибка проверки электронной почты
+close=Закрыть
+usersDNHelp=Полное DN дерева LDAP, в котором находятся ваши пользователи. Это DN является родителем пользователей LDAP. Например, это может быть 'ou=users,dc=example,dc=com', предполагая, что ваш типичный пользователь будет иметь DN, например 'uid='john',ou=users,dc=example,dc=com'.
+addKeycloakOpenIdProvider=Добавить поставщика Keycloak OpenID Connect
+addOAuth2Provider=Добавить провайдера OAuth v2
+clientSessionMax=Макс. сессия клиента
+deleteClientPolicy=Удалить политику клиента
+authenticatorAttachment.cross-platform=Кроссплатформенность
+whoCanView=Кто может просматривать?
+lastAccess=Последний доступ
+emptyClientScopesInstructions=В настоящее время нет клиентских областей, связанных с этим клиентом. Вы можете добавить существующие клиентские области к этому клиенту, чтобы совместно использовать сопоставления протоколов и роли.
+clientAuthentications.private_key_jwt=JWT подписан закрытым ключом
+uiDisplayName=Имя в консоли
+createClientSuccess=Клиент создан успешно
+adminEventsSettings=Настройки событий администратора
+cibaInterval=Интервал
+totalMemory=Общая память
+usernameTemplateImporter=Отформатируйте имя пользователя для импорта.
+resourceNameHelp=Уникальное имя для этого ресурса. Имя может использоваться для уникальной идентификации ресурса, полезно при запросе определенного ресурса.
+times.minutes=минут
+disableUserInfo=Отключить информацию о пользователе
+authorizationEncryptedResponseEnc=Алгоритм шифрования содержимого ответа авторизации
+editCondition=Изменить условие
+viewCondition=Посмотреть состояние
+ssoSessionMaxRememberMe=Макс. время до истечения сессии, когда пользователь установил опцию "запомнить меня". Токены и сессии браузера становятся недействительными, когда сессия истекает. Если не установлено, используется стандартное значение SSO Session Max.
+forcePostBinding=Принудительно использовать POST Binding
+usersExplain=Пользователи — это пользователи в текущем realm.
+passMaxAgeHelp=Передайте max_age поставщику удостоверений.
+exportFail=Не удалось экспортировать realm: '{{error}}'
+flowTypeHelp=Какого типа эта форма
+targetHelp=Поле назначения для сопоставления. LOCAL (по умолчанию) означает, что изменения применяются к имени пользователя, сохраненному в локальной базе данных при импорте пользователя. BROKER_ID и BROKER_USERNAME означают, что изменения сохраняются в идентификаторе или имени пользователя, используемых для поиска пользователя федерации, соответственно.
+setPasswordConfirm=Установить пароль?
+attributeDisplayNameHelp=Отображаемое имя атрибута. Поддерживает также ключи для локализованных значений. Например: ${profile.attribute.phoneNumber}. Нажмите на значок "Globe Route", чтобы добавить переводы.
+assignedType=Назначенный тип
+modeHelp=LDAP_ONLY означает, что все сопоставления групп пользователей извлекаются из LDAP и сохраняются в LDAP. READ_ONLY — это режим LDAP только для чтения, в котором сопоставления групп извлекаются как из LDAP, так и из базы данных, и объединяются вместе. Новые присоединения к группам сохраняются не в LDAP, а в базе данных. IMPORT — это режим LDAP только для чтения, в котором сопоставления групп извлекаются из LDAP, когда пользователь импортируется из LDAP, а затем сохраняются в локальной базе данных Keycloak.
+identityProvider=Поставщик идентификации
+forgotPasswordHelpText=Показать ссылку на странице входа для пользователей, которые забыли свои учетные данные.
+identityProviderLinks=Ссылки поставщика идентификации
+mapperTypeMsadLdsUserAccountControlMapperHelp=Специфичное для MSAD LDS сопоставление. Он способен интегрировать состояние учетной записи пользователя MSAD LDS в состояние учетной записи Keycloak (учетная запись включена, пароль просрочен и другие). Он способен считывать атрибуты 'msDS-UserAccountDisabled', 'msDS-UserPasswordExpired' и 'pwdLastSet' для этого. Например, если 'pwdLastSet' равен 0, пользователь Keycloak должен обновить пароль. В другом примере, если 'msDS-UserAccountDisabled' равен 'TRUE', пользователь Keycloak также отключен. Это сопоставление также способно обрабатывать коды исключений из аутентификации пользователя LDAP.
+leave=Покинуть
+loginSettings=Настройки входа
+deleteMessageBundleError=Ошибка удаления сообщения из пакета, {{error}}
+finish=Завершить
+eventTypes.LOGIN_ERROR.name=Ошибка входа
+validations=Проверки
+updatedRequiredActionError=Не удалось обновить требуемое действие: {{error}}
+createChildGroup=Создать дочернюю группу
+x509Certificate=Сертификат X509
+addressClaim.formatted.label=Имя пользовательсокого атрибута, обозначающего Формитированный адрес
+metadataOfDiscoveryEndpoint=Метаданные точки доступа обнаружения
+add=Добавить
+createPolicySuccess=Политика успешно создана
+notVerified=Не проверено
+encryptionKeysConfig=Конфигурация ключей шифрования
+updateClientProfileSuccess=Профиль клиента успешно обновлен
+openIDEndpointConfiguration=Конфигурация точки доступа OpenID
+oid4vcIssuerMetadata=Метаданные издателя учетных данных OpenID4VCI
+prompts.login=вход
+users=Пользователи
+keyTabHelp=Расположение файла Kerberos KeyTab, содержащего учетные данные принципала сервера. Например, /etc/krb5.keytab
+wantAssertionsEncrypted=Хотите, чтобы утверждения были зашифрованы
+noClientPoliciesInstructions=Нет клиентских политик. Выберите "Создать клиентскую политику", чтобы создать новую клиентскую политику.
+deleteValidatorConfirmMsg=Вы уверены, что хотите навсегда удалить валидатор {{validatorName}}?
+uris=URI, который также может быть использован для уникальной идентификации этого ресурса.
+jwksUrlConfig=Конфигурации URL JWKS
+forceNameIdFormatHelp=Игнорирует запрошенный формат заголовка NameID и использует сконфигурированный через консоль администратора.
+validateKeyTab=Вам необходимо ввести ключевую вкладку
+editUsernameAllowed=Изменить имя пользователя
+searchType.attribute=Поиск по атрибутам
+saveProviderError=Ошибка сохранения поставщика: {{error}}
+port=Порт
+searchForPermission=Поиск разрешения
+ldapFilterHelp=Фильтр LDAP добавляет дополнительный пользовательский фильтр ко всему запросу для извлечения групп LDAP. Оставьте это поле пустым, если дополнительная фильтрация не требуется и вы хотите извлечь все группы из LDAP. В противном случае убедитесь, что фильтр начинается с '(' и заканчивается на ')'.
+clientUpdaterSourceGroupsTooltip=Имя групп для проверки. Условие оценивается как истинное, если сущность, которая создает или обновляет клиента, является членом одной или нескольких указанных групп. Настроенные группы указываются по их простому имени, которое должно совпадать с именем группы Keycloak. Здесь не используется поддержка иерархии групп.
+addRequestUri=Добавьте допустимые URI запроса
+selectACondition=Выберите условие
+ldapAttributeValue=Значение атрибута LDAP
+jwksUrlHelp=URL, где хранятся ключи поставщика удостоверений в формате JWK. Более подробную информацию см. в спецификации JWK. Если вы используете внешнего поставщика удостоверений Keycloak, вы можете использовать URL, например 'http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs', предполагая, что ваш брокерский Keycloak работает на 'http://broker-keycloak:8180' и его realm — 'test'.
+eventTypes.CLIENT_DELETE.description=Удалить клиент
+emptyResources=Нет ресурсов
+roleHelp=Роль, которую следует предоставить пользователю, если присутствуют все атрибуты. Нажмите "Выбрать роль", чтобы просмотреть роли, или просто введите ее в текстовое поле. Для ссылки на роль клиента синтаксис будет clientname.clientrole, например, myclient.myrole.
+ldapSynchronizationSettingsDescription=В этом разделе содержатся параметры, связанные с синхронизацией пользователей из LDAP в базу данных Keycloak.
+addPredefinedMappers=Добавить предопределенные сопоставления
+updatedRequiredActionSuccess=Обновлено требуемое действие успешно
+roles=Роли
+displayOrder=Порядок отображения
+registrationAllowed=Регистрация пользователя
+choose=Выбрать...
+appliedByProviders=Применяется следующими поставщиками
+saveEventListenersSuccess=Слушатель событий обновлен.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Учетная запись поставщика удостоверений
+eventTypes.TOKEN_EXCHANGE.name=Обмен токенами
+skipped=Пропущено
+eventTypes.RESTART_AUTHENTICATION.description=Перезапустить аутентификацию
+scopePermissions.users.manage-group-membership-description=Политики, которые решают, может ли администратор управлять членством в группе для всех пользователей в realm. Это используется в сочетании с определенной групповой политикой
+loginTheme=Тема страницы входа
+eventTypes.UPDATE_PASSWORD_ERROR.description=Ошибка обновления пароля
+deleteConfirmRealmSetting=Если вы удалите realm, все связанные с ней данные будут удалены.
+scope=Область
+evaluateExplain=На этой странице вы можете увидеть все сопоставления протоколов и сопоставления областей ролей
+providerCreateError=Не удалось создать клиентскую политику из-за {{error}}
+includeRepresentationHelp=Включить JSON представление для запросов на создание и обновление.
+searchForClientScope=Поиск клиентской области
+removeAttribute=Удалить атрибут
+deleteProviderSuccess=Успешно. Поставщик удален.
+sessionsType.offline=Оффлайн
+validatorDeletedError=Ошибка сохранения профиля пользователя: {{error}}
+preserveGroupInheritance=Сохранить групповое наследование
+createClientScopeSuccess=Область действия клиента создана
+selectOrTypeAKey=Выберите или введите ключ
+resourceDetails=Подробности ресурса
+authorizationScopes=Области действия авторизации
+fromDisplayNameHelp=Удобное для пользователя имя для адреса "От" (необязательно).
+identityProviderEntityIdHelp=Идентификатор сущности, используемый для проверки эмитента для полученных утверждений SAML. Если пусто, проверка эмитента не выполняется.
+noRoles-client=Нет ролей для этого клиента
+eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Ошибка токена выполнения действия
+eventTypes.USER_INFO_REQUEST_ERROR.description=Ошибка запроса информации о пользователе
+policyRoles=Задайте роли клиента, допущенные этой политикой.
+roleMapping=Сопоставление ролей
+accountLinkingOnlyHelp=Если установлено, то пользователи не смогут войти через этого провайдера. Они смогут только устанавливать связь к этому провайдеру. Используется, если вы не хотите разрешать вход через этого провайдера, но хотите интегрироваться с ним.
+refreshTokenMaxReuseHelp=Макс. количество раз, когда может быть повторно использован токен обновления. При использовании другого токена отзыв происходит немедленно.
+eventTypes.REMOVE_FEDERATED_IDENTITY.description=Удалить федеративную идентификацию
+childGroups=Дочерние группы
+eventTypes.IDENTITY_PROVIDER_LOGIN.name=Вход в систему поставщика удостоверений
+exportAuthDetailsError=Ошибка экспорта данных авторизации: {{error}}
+clientOfflineSessionIdleHelp=Время, в течение которого клиентская автономная сессия может простаивать до его истечения. Автономные токены становятся недействительными, когда клиентская автономная сессия истекает. Параметр не влияет на глобальную сессию SSO пользователя. Если не задано, он использует значение автономной сессии realm.
+selectGroups=Выберите группы, к которым хотите присоединиться
+webAuthnPolicyAuthenticatorAttachmentHelp=Сообщает аутентификатору приемлемый шаблон вложения.
+username=Имя пользователя
+mappedGroupAttributes=Сопоставленные атрибуты группы
+localization=Локализация
+importConfig=Импорт метаданных со скачанного дескриптора развертывания удаленного поставщика идентификации
+replyToDisplayNameHelp=Удобное для пользователя имя для адреса "Ответить" (необязательно).
+webAuthnPolicyRpIdHelp=Идентификатор проверяющей стороны WebAuthn (RpID). Это должен быть эффективный домен источника, например, "company.com" или "auth.company.com".
+signingKeysConfigExplain=Если вы включите "Требуется подпись клиента" ниже, вы должны настроить ключи подписи, сгенерировав или импортировав ключи, и клиент подпишет свои запросы и ответы saml. Подпись будет проверена.
+newClientProfile=Создать профиль клиента
+consoleDisplayConnectionUrlHelp=URL соединения с вашим сервером LDAP
+enabledWhen=Включено, когда
+enabledWhenTooltip=Указывает, когда атрибут доступен. При использовании областей действия атрибут доступен, когда в запросе на вход применяется хотя бы одна из настроенных областей действия. Оцениваются как области действия по умолчанию, так и необязательные области действия текущего запроса. В контекстах консоли администратора и консоли учетной записи области действия не оцениваются, а атрибут всегда доступен (если не ограничен разрешениями).
+clientAssertionSigningAlg=Алгоритм подписи клиентского утверждения
+homeURLHelp=URL-адрес по умолчанию, используемый, когда серверу аутентификации необходимо выполнить перенаправление или обратную ссылку на клиента.
+ldapAttribute=Атрибут LDAP
+fullScopeAllowedHelp=Отключает все ограничения.
+eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=Ошибка отправки ссылки поставщика удостоверений
+otpType=Тип одноразового пароля OTP
+algorithm=Алгоритм
+grantedScopes=Предоставленные области
+groupNameLdapAttribute=Имя группы Атрибут LDAP
+deleteProviderConfirm=Вы уверены, что хотите навсегда удалить поставщика ключей {{provider}}?
+removeConfirmTitle_one=Удалить группу?
+eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=Ошибка запроса на авторизацию
+includeInTokenScope=Включить в область действия токена
+eventType=Тип события
+tokenDeleteConfirmTitle=Удалить начальный токен доступа?
+useRefreshTokenForClientCredentialsGrant=Использовать токены обновления для предоставления клиентских учетных данных
+userDetails=Данные пользователя
+sectorIdentifierUri.label=Сектор идентификации URI
+inputTypeStep=Размер входного шага
+mapperTypeHelp=Используется для сопоставления одного атрибута пользователя LDAP с атрибутом UserModel в базе данных Keycloak
+importWarning=Импортированные выше данные и настройки могут перезаписать уже существующие данные и настройки.
+kerberosRequiredSettingsDescription=В этом разделе содержится несколько основных параметров, общих для всех поставщиков пользовательских хранилищ.
+resetPasswordFor=Установить пароль для {{username}}
+duplicateEmailsAllowed=Дублирующиеся электронные письма
+deleteEventsConfirm=Если вы очистите все события этом realm, все записи будут навсегда удалены из базы данных
+noGroupsInThisRealmInstructions=Вы не создали ни одной группы в этом realm. Создайте группу, чтобы начать.
+eventTypes.REMOVE_TOTP_ERROR.name=Удалить ошибку TOTP
+groupUpdateError=Ошибка обновления группы {{error}}
+logoutAllSessions=Выйти из всех сессий
+membershipUserLdapAttribute=Атрибут LDAP пользователя членства
+noKeysDescription=Вы не создали ни одного активного ключа
+rememberMeHelpText=Показать чекбокс на странице входа, чтобы разрешить пользователю запомнить вход в учетную запись в случае если браузерная сессия устареет.
+eventTypes.UPDATE_EMAIL.name=Обновить электронную почту
+notBeforeHelp=Отозвать все токены, выпущенные до этого времени для этого клиента. Чтобы применить политику, сначала следует задать эффективный URL-адрес администратора на вкладке "Настройки".
+protocolTypes.saml=SAML
+idTokenSignatureAlgorithm=Алгоритм подписи токена ID
+displayHeaderHintHelp=Удобное для пользователя имя для группы, которое следует использовать при отображении группы атрибутов в формах, доступных пользователю. Поддерживает также ключи для локализованных значений. Например: ${profile.attribute.group.address}.
+providerInfo=Информация о поставщике
+ssoServiceUrl=Адрес сервиса единой точки входа
+artifactResolutionServiceUrl=URL-адрес службы разрешения артефактов
+inputHelperTextAfter=Вспомогательный текст (под) полем ввода
+appliedByClients=Применено следующими клиентами
+createFlowHelp=В этой форме вы можете создать сценарий верхнего уровня.
+defaultLocaleHelp=Первоначальная локаль для использования. Используется на экране входа в систему и других экранах в Admin UI и Account UI.
+deleteConfirmFlowMessage=Вы уверены, что хотите окончательно удалить сценарий "<1>{{flow}}</1>".
+webAuthnPolicyAuthenticatorAttachment=Приложение-аутентификатор
+logoutServiceSoapBindingUrlHelp=URL привязки SAML SOAP для службы единого выхода клиента. Вы можете оставить это поле пустым, если используете другую привязку.
+kerberos=Kerberos
+noNodesInstructions=Нет зарегистрированных узлов, вы можете добавить один вручную.
+login=вход
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=Ошибка извлечения токена поставщиком удостоверений
+local=Локальный
+noGroupsInThisSubGroupInstructions=Вы не создали ни одной группы в этой подгруппе.
+validatorColNames.colName=Имя валидатора
+userVerify.required=Обязательно
+searchMembers=Поиск участников
+keySizeHelp=Размер сгенерированных ключей
+otpSupportedApplications.totpAppGoogleName=Google Аутентификатор
+clientDeleteConfirmTitle=Удалить клиента?
+policyDetails=Подробности политики
+changedUsersSyncHelp=Период для синхронизации измененных или вновь созданных пользователей LDAP в секундах
+trustEmailHelp=Если включено, то E-mail, предоставленный этим поставщиком не будет подтвержденным даже если подтверждение включено для realm.
+editModeKerberosHelp=READ_ONLY означает, что обновления пароля не разрешены, и пользователь всегда проходит аутентификацию с паролем Kerberos. UNSYNCED означает, что пользователь может изменить пароль в базе данных Keycloak, и этот пароль будет использоваться вместо пароля Kerberos.
+invalidateRotatedSecretExplain=После аннулирования обновленного секретного ключа, обновленный секретный ключ будет автоматически удален
+clientSessionMaxHelp=Макс. время до истечения сессии клиента. Токены становятся недействительными, когда сессия истекает. Параметр не влияет на глобальная сессия SSO пользователя. Если не задано, используется стандартное значение максимальной сессии SSO.
+clientScopeDetails=Подробности сферы деятельности клиента
+requiredHelp=Установите атрибут как обязательный. Если включено, атрибут должен быть установлен пользователями и администраторами. В противном случае атрибут необязателен.
+clientScopeRemoveError=Не удалось удалить сопоставление области действия {{error}}
+mapperTypeRoleLdapMapper=role-ldap-mapper
+testConnectionHint.withEmail=При проверке соединения текущему пользователю будет отправлено электронное письмо ({{email}}).
+adminURLHelp=URL для доступа к интерфейсу администратора в заданном клиенте. Необходимо установить, если клиент поддерживает адаптер REST API. Это REST API разрешает серверу авторизации слать политики отзыва и прочие административные задачи. Обычно устанавливается значение, соответствующее базовому URL клиента.
+otpPolicyPeriodHelp=Сколько секунд токен OTP должен быть действителен? По умолчанию 30 секунд.
+otpPolicyCodeReusableHelp=Возможность повторного использования того же OTP-кода после успешной аутентификации.
+parentId=Родительский идентификатор
+storePasswordHelp=Пароль для доступа в архив
+directAccess=Включает поддержку Direct Access Grants, которая означает, что клиент имеет доступ к имени пользователя и пароля и обменивает их напрямую с сервером Keycloak на токен доступа. В терминах OAuth2 спецификации означает поддержку 'Resource Owner Password Credentials Grant' для этого клиента
+logoutServiceSoapBindingUrl=URL-адрес привязки SOAP-службы выхода из системы
+userFedDeletedSuccess=Поставщик федерации пользователей был удален.
+eventTypes.UNREGISTER_NODE.description=Отменить регистрацию узла
+whoWillAppearPopoverTextRoles=На этой вкладке отображаются только пользователи, которым эта роль назначена напрямую. Чтобы увидеть пользователей, которым эта роль назначена как связанная роль или через группу, перейдите на
+showPassword=Показать поле пароля открытым текстом
+logic=Логика
+clientScopeSearch.type=Назначенный тип
+scopePermissions.groups.manage-membership-description=Политики, которые определяют, может ли администратор добавлять или удалять пользователей из этой группы
+resourceType=Тип ресурса
+copied=Данные авторизации скопированы.
+scopeName=Уникальное имя для области. Имя может быть использовано для уникальной идентификации области, используется при запросах конкретных областей.
+userObjectClassesHelp=Все значения атрибута LDAP objectClass для пользователей в LDAP, разделенные запятыми. Например: 'inetOrgPerson, organizationalPerson'. Вновь созданные пользователи Keycloak будут записаны в LDAP со всеми этими классами объектов, а существующие записи пользователей LDAP будут найдены только в том случае, если они содержат все эти классы объектов.
+userInfoUrlHelp=Url информации о пользователе. Это поле опционально.
+clientProfileSearch=Поиск
+addSavedTypes=Добавить сохраненные типы
+setPasswordFor=Установить пароль для {{username}}
+eventTypes.CODE_TO_TOKEN.name=Код для токена
+updateUserLocale=Обновить локаль пользователя
+whoWillAppearPopoverTextUsers=Группы иерархичны. При выборе прямого членства вы видите только дочернюю группу, к которой присоединился пользователь. Родительские группы не включены.
+mapperCreateError=Ошибка создания сопоставления: {{error}}
+resetBtn=Сбросить
+mode=Режим
+kc.realm.name=Realm
+userFedDisableConfirmTitle=Отключить поставщика федерации пользователей?
+impersonate=Имперсонировать
+eventTypes.CLIENT_REGISTER.name=Реестр клиентов
+mappingTable=Таблица с предопределенным отображением
+requestObject.not\ required=Не требуется
+adminURL=URL администрирования приложения
+generatedAccessTokenNo=Токен доступа не сгенерирован
+always=Всегда
+pkceEnabledHelp=Используйте PKCE (подтверждение обмена ключом-кодом) для посредничества IdP
+settings=Настройки
+webAuthnPolicyUserVerificationRequirement=Требование проверки пользователя
+failureFactorHelp=Количество неудачных попыток входа до блокировки пользователя.
+unlinkAccountTitle=Отвязать аккаунт от {{provider}}?
+noNodes=Нет зарегистрированных узлов
+singleLogoutServiceUrlHelp=Url, который должен быть использован для отправленных запросов на выход.
+authorizationEncryptedResponseAlg=Алгоритм управления ключами шифрования ответа авторизации
+useTruststoreSpi=Использование доверенных сертификатов SPI
+allowEcpFlowHelp=Этому клиенту разрешено использовать сценарий ECP для аутентификации пользователей.
+noSessions=Нет сессий
+clipboardCopyError=Ошибка копирования в буфер обмена.
+storeTokens=Хранение токенов
+usermodel.clientRoleMapping.rolePrefix.tooltip=Префикс для каждой роли клиента (опционально).
+deleteConfirmCurrentUser=Вы уверены, что хотите навсегда удалить этого пользователя?
+eventTypes.CLIENT_REGISTER_ERROR.description=Ошибка регистрации клиента
+addClientScopesTo=Добавить клиентские области в {{clientName}}
+x509=Имя субъекта X.509
+showDataBtn=Показать данные
+dedicatedScopeDescription=Специализированные области и сопоставления для этого клиента
+Sunday=Воскресенье
+editMode=Режим редактирования
+updatePasswordPolicySuccess=Политики паролей успешно обновлены
+passwordHelp=Пароль SMTP. Это поле может получить свое значение из хранилища, используйте формат ${vault.ID}.
+clientUpdaterContext=Условие проверяет контекст того, как клиент создается или обновляется, чтобы определить, применяется ли политика. Например, оно проверяет, создан ли клиент с помощью административного REST API или динамической регистрации клиента OIDC. В последнем случае оно проверяет, является ли это АНОНИМНОЙ регистрацией клиента или АУТЕНТИФИКИРОВАННОЙ регистрацией клиента с помощью начального токена доступа или токена доступа регистрации и т. д.
+removedGroupMembership=Членство в группе удалено
+deleteScopeWarning=Разрешения, указанные ниже, будут удалены, когда они больше не будут использоваться другими областями авторизации:
+compositeRoleOff=Композитная роль отключена
+fullSyncPeriod=Период полной синхронизации
+clientsExplain=Клиенты — это приложения и службы, которые могут запрашивать аутентификацию пользователя.
+addNode=Добавить узел
+jwksUrl=JWKS URL
+policy-description=Описание этой политики.
+defaultPasswordLabel=Мой пароль
+mapperUserAttributeName=Имя атрибута пользователя
+importClient=Импортировать клиента
+deleteMapperSuccess=Сопоставление успешно удалено.
+scopeSaveError=Не удалось сохранить область авторизации из-за {{error}}
+used.SPECIFIC_PROVIDERS=Конкретные поставщики
+deletedSuccessIdentityProvider=Поставщик успешно удален.
+reload=Перезагрузить
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.description=Ошибка привязки учетной записи, инициированная клиентом
+eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.name=Ошибка входа в систему поставщика удостоверений
+scopePermissions.groups.view-description=Политики, которые определяют, может ли администратор просматривать эту группу
+tokens=Токены
+createFlow=Создать сценарий
+encryptAssertionsHelp=Должны ли SAML утверждения быть зашифрованы публичным ключом клиента, используя AES?
+oAuthDPoPHelp=Это обеспечивает поддержку привязанных токенов Demonstrating Proof-of-Possession (DPoP). Токены доступа и обновления привязаны к ключу, хранящемуся в пользовательском агенте. Чтобы доказать владение ключом, пользовательский агент должен отправить подписанное доказательство вместе с токеном.
+unsavedChangesConfirm=У вас есть несохраненные изменения. Вы действительно хотите покинуть страницу?
+disabledOff=Отключение выключено
+membershipLdapAttributeHelp=Имя атрибута LDAP в группе, который используется для сопоставления членства. Обычно это будет "member". Однако, когда "Тип атрибута членства" — "UID", то "Атрибут LDAP членства" обычно может быть "memberUid".
+usersLeftError=Не удалось удалить пользователей из группы: {{error}}
+addTypes=Добавить типы
+pushedAuthorizationRequestRequiredHelp=Логический параметр, указывающий, принимает ли сервер авторизации данные запроса авторизации только с помощью метода push-запроса авторизации.
+requirement=Требования
+any=Любой
+minute=Минута
+useJwksUrl=Использовать JWKS URL
+wantAssertionsSigned=Хочу, чтобы утверждения были подписаны
+roleSaveSuccess=Роль сохранена
+scopeParameter=Параметр области действия
+unsigned=Неподписанный
+userGroupsRetrieveStrategy=Группы пользователей извлекают стратегию
+addSubFlow=Добавить подсценарий
+validatingPublicKeyHelp=Открытый ключ в формате PEM, который необходимо использовать для проверки внешних подписей IDP.
+client-uris-must-match.label=Клиентские URI должны совпадать
+webAuthnPolicyAcceptableAaguids=Допустимые AAGUID
+noRoles-roles=Нет ролей в этом realm
+logoutServiceRedirectBindingURLHelp=SAML переадресует на привязанный URL для единой точки выхода из сервиса для клиентов. Если Вы используете другие привязки, то можете оставить это поле пустым.
+deleteMapperConfirm=Вы уверены, что хотите навсегда удалить сопоставление {{mapper}}?
+scopePermissions.roles.map-role-description=Политики, которые определяют, может ли администратор сопоставить эту роль пользователю или группе
+backchannelUrlInvalid=URL-адрес выхода из back-channel не является допустимым URL-адресом
+eventTypes.LOGIN.description=Авторизоваться
+impersonateConfirm=Выдать себя за пользователя?
+scopePermissions.clients.map-roles-client-scope-description=Политики, которые решают, может ли администратор применять роли, определенные этим клиентом, к области действия другого клиента
+accessTokenSuccess=Токен доступа восстановлен
+includeInIdToken.tooltip=Должен ли клейм быть добавлен в токен ID?
+validRequestURIs=Действительные URI запроса
+allowPasswordAuthentication=Разрешить аутентификацию по паролю
+federationLinkHelp=UserStorageProvider, из которого был импортирован этот локально сохраненный пользователь.
+validateUsernameLDAPAttribute=Вам необходимо ввести атрибут LDAP имени пользователя
+pairwiseSubAlgorithmSalt.tooltip=Соль, используемая для вычисления парного субъекта идентификатора. Если поле не заполнено, то соль будет сгенерирована.
+waitIncrementSecondsHelp=Если порог ошибок превышен, сколько времени пользователь будет заблокирован?
+allowKerberosAuthentication=Разрешить аутентификацию Kerberos
+addressClaim.formatted.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'formatted' внутри атрибута 'address' токен клейма. По умолчанию 'formatted'.
+predefinedMappingDescription=Выберите любое из предопределенных сопоставлений из этой таблицы
+allowedClockSkew=Допустимая погрешность хода часов
+privateRSAKey=Закрытый ключ RSA
+createPermission=Создать полномочия
+moveToGroup=Переместить {{group1}} в {{group2}}
+noRealmRoles=Нет ролей в realm
+events-disable-confirm=Если "Сохранить события" отключено, последующие события не будут отображаться в меню "События"
+reqAuthnConstraints=Запрошенные ограничения AuthnContext
+eventTypes.PUSHED_AUTHORIZATION_REQUEST.description=Запрос на авторизацию отправлен
+addIdpMapperNameHelp=Имя сопоставления.
+requirements.ALTERNATIVE=Альтернатива
+claimFilterValueHelp=Значение основного клейма (с поддержкой регулярных выражений)
+credentialResetConfirm=Послать письмо
+permissionsEnabledHelp=Определяет, включены ли детальные разрешения для управления этой ролью. Отключение удаляет все текущие разрешения.
+consentScreenTextHelp=Текст, который будет показан на экране согласия, когда эта клиентская область добавляется к какому-либо клиенту с требуемым согласием. По умолчанию используется имя клиентской области, если оно не заполнено.
+realmRolesList=Роли в realm
+roleList=Список ролей
+kerberosRealm=Kerberos Realm
+scopePermissions.groups.manage-members-description=Политики, которые определяют, может ли администратор управлять членами этой группы
+consentRequiredHelp=Если эта функция включена, пользователи должны дать согласие на клиентский доступ.
+flow.direct\ grant=Сценарий Direct Grant Flow
+eventTypes.EXECUTE_ACTION_TOKEN.name=Выполнить токен действия
+groupName=Название группы
+eventTypes.RESTART_AUTHENTICATION.name=Перезапустить аутентификацию
+authorizationUrl=URL авторизации
+eventTypes.VALIDATE_ACCESS_TOKEN.name=Проверить токен доступа
+contextualAttributes=Контекстные аттрибуты
+replyTo=Ответить на
+providerDescription=Описание поставщика
+downloadAdapterConfig=Загрузить конфигурацию адаптера
+scopePermissions.clients.view-description=Политики, которые определяют, может ли администратор просматривать этого клиента
+allowEcpFlow=Разрешить сценарий ECP
+rsa=RSA
+setPasswordConfirmText=Вы уверены, что хотите установить пароль для пользователя {{username}}?
+updateErrorIdentityProvider=Не удалось обновить провайдера {{error}}
+emptyProfiles=Профили клиентов не настроены
+createClientProfileError=Не удалось создать профиль клиента: '{{error}}'
+usermodel.clientRoleMapping.clientId.tooltip=ID клиента для сопоставления ролей. В токен будут добавлены только клиентские роли этого клиента. Если не установлено, в токен будут добавлены клиентские роли всех клиентов.
+targetOptions.local=ЛОКАЛЬНЫЙ
+addTranslationError=Ошибка создания перевода, {{error}}
+pkceMethodHelp=Метод PKCE для использования
+encryption=Шифрование
+addExecutorError=Исполнитель не создан: {{error}}
+scopePermissions.clients.manage-description=Политики, которые определяют, может ли администратор управлять этим клиентом
+vendor=Поставщик
+roleRemoveAssociatedText=Это действие удалит {{role}} из {{roleName}}. Все связанные роли {{role}} также будут удалены.
+disabled=Отключено
+idpInitiatedSsoRelayState=Передача состояния SSO инициирующим поставщиком идентификации
+attribute=Атрибут
+clientScopesConditionTooltip=Список ожидаемых клиентских областей. Условие оценивается как истинное, если указанный клиентский запрос соответствует некоторым клиентским областям. Это также зависит от того, должна ли это быть область клиента по умолчанию или необязательная область на основе настроенного 'Типа области'.
+timestamp=Дата создания
+principalAttributeHelp=Имя (Name) или "дружественное имя" (Friendly Name) атрибута, идентифицирующего внешних пользователей.
+nameIdPolicyFormat=Формат политики NameID
+idpInitiatedSsoUrlName=Имя URL фрагмента, обозначающего клиента, если вы хотите, чтобы SSO был проинициирован поставщиком идентификации. Оставьте это поле пустым, чтобы отключить инициирование SSO с помощью поставщика идентификации. URL для ссылки вашего браузера может быть в следующем виде\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}
+selectMethod=Выберите метод
+deleteConfirmExecution=Удалить сценарий {{name}}?
+eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Ошибка проверки токена доступа
+xFrameOptions=X-Frame-Options
+scopeDescriptionHelp=Описание шаблона клиента
+deletedErrorRealmSetting=Не удалось удалить realm: {{error}}
+copyInitialAccessToken=Пожалуйста, скопируйте и вставьте первоначальный токен доступа перед закрытием, так как его невозможно будет восстановить позже.
+consensus=Консенсус
+scopePermissions.roles.map-role-composite-description=Политики, которые определяют, может ли администратор применять эту роль как составную часть другой роли
+emptyEvents=Добавить нечего
+residentKey.Yes=Да
+eventTypes.SEND_IDENTITY_PROVIDER_LINK.name=Отправить ссылку поставщика удостоверений
+ssoSessionIdleRememberMe=Время, в течение которого сессия "Запомнить меня" может простаивать до ее истечения. Токены и сессии браузера становятся недействительными, когда сессия истекает. Если не установлено, используется стандартное значение простоя сессии SSO.
+SSOSessionIdleRememberMe=Сеанс SSO в режиме ожидания Запомнить меня
+eventTypes.REGISTER_NODE.description=Зарегистрировать узел
+supported=Поддерживается
+deleteAttributeText=Удалить атрибут
+deleteNodeSuccess=Узел успешно удален
+includeInIntrospection.label=Добавить к интроспекции токена
+roleImportSuccess=Импорт роли успешен
+tokenUrl=URL токена
+executionConfig={{name}} конфигурация
+grantedClientScopes=Предоставленные клиентские области
+keyError=Необходимо предоставить ключ.
+addAnnotationText=Добавить аннотацию
+helpToggleInfo=Этот переключатель включит/отключит часть справочной информации в пользовательском интерфейсе. Включает любой текст справки, ссылки и всплывающие окна.
+clientProfileName=Имя профиля клиента
+effectiveProtocolMappers=Эффективные сопоставления протоколов
+userVerify.preferred=Предпочтительно
+syncModes.legacy=Устаревший (Legacy)
+allowRegexComparisonHelp=Если OFF, то Subject DN из данного клиентского сертификата должен точно соответствовать заданному DN из свойства 'Subject DN', как описано в спецификации RFC8705. Subject DN может быть в формате RFC4514 или RFC1779. Если ON, то Subject DN из данного клиентского сертификата должен соответствовать регулярному выражению, указанному свойством 'Subject DN'.
+eventTypes.UPDATE_TOTP_ERROR.description=Ошибка обновления TOTP
+titleEvents=События
+signServiceProviderMetadata=Метаданные поставщика услуг подписи
+updateClientPoliciesError=Не удалось обновить клиентские политики: {{error}}
+acceptsPromptNoneHelp=Используется только вместе с аутентификатором поставщика удостоверений или когда kc_idp_hint указывает на этого поставщика удостоверений. Если этот клиент отправляет запрос с prompt=none и пользователь не аутентифицирован, ошибка не возвращается напрямую клиенту; запрос с prompt=none пересылается этому поставщику удостоверений.
+roleDetails=Подробности роли
+eventTypes.USER_INFO_REQUEST.name=Запрос информации о пользователе
+clientScopeType.none=Нет
+results=Результаты
+userRolesRetrieveStrategyHelp=Укажите, как извлекать роли пользователя. LOAD_ROLES_BY_MEMBER_ATTRIBUTE означает, что роли пользователя будут извлечены путем отправки запроса LDAP для извлечения всех ролей, где "member" — наш пользователь. GET_ROLES_FROM_USER_MEMBEROF означает, что роли пользователя будут извлечены из атрибута "memberOf" нашего пользователя. Или из других атрибутов, указанных в "Атрибуте LDAP Member-Of". LOAD_ROLES_BY_MEMBER_ATTRIBUTE применим только в Active Directory и означает, что роли пользователя будут извлечены рекурсивно с использованием расширения LDAP LDAP_MATCHING_RULE_IN_CHAIN.
+roleDeleteError=Не удалось удалить роль: {{error}}
+selectScope=Выберите область
+attributeDefaultValue=Значение атрибута по умолчанию
+eventTypes.UPDATE_PASSWORD_ERROR.name=Ошибка обновления пароля
+addGroups=Добавить группы
+offlineSessionIdle=Таймаут оффлайн сессии
+mapperAttributeFriendlyName=Дружелюбное имя
+addProvider=Добавить провайдера
+readOnlyHelp=Атрибут "только для чтения", который импортируется из LDAP в UserModel, но не сохраняется обратно в LDAP при обновлении пользователя в Keycloak.
+resourceDeletedError=Не удалось удалить ресурс {{error}}
+backchannelLogoutUrl=URL выхода из back-channel
+requestObjectEncodingHelp=Алгоритм JWE, который клиент должен использовать при шифровании содержимого объекта запроса OIDC, указанного параметрами 'request' или 'request_uri'. Если установлено значение 'any', разрешен любой алгоритм.
+minimumQuickLoginWaitSeconds=Мин. ожидание быстрого входа
+duplicate=Дубликат
+clientAccesstype=Тип клиентского доступа
+roleDeleteConfirm=Удалить роль?
+createClientProfileNameHelperText=Имя должно быть уникальным в пределах realm
+disabledHelp=Отключенный пользователь не может войти в систему.
+eventTypes.UPDATE_PROFILE_ERROR.name=Ошибка обновления профиля
+adminThemeHelp=Выберите тему для консоли администратора.
+name=Имя шаблона клиента. Должно быть уникально для realm
+deleteConfirmDialog_other=Вы уверены, что хотите навсегда удалить {{count}} выбранных пользователей
+targetOptions.brokerUsername=BROKER_USERNAME
+clientList=Клиенты
+eventTypes.REGISTER_ERROR.description=Ошибка регистрации
+infoDisabledFeatures=Показывает все отключенные функции.
+userSession.modelNote.label=Заметка сессии пользователя
+next=Следующий
+previous=Предыдущий
+userLabel=Метка пользователя
+pagination=Постраничный вывод
+changeAuthenticatorConfirm=Если вы измените аутентификатор на {{clientAuthenticatorType}}, база данных Keycloak будет обновлена, и вам может потребоваться загрузить новую конфигурацию адаптера для этого клиента.
+import=Импорт JSON файла, содержащего авторизационные настройки для этого сервера ресурсов
+otpHashAlgorithm=Алгоритм хеша OTP
+importFail=Импорт не удался: {{error}}
+show=Показать
+description=Описание
+alwaysReadValueFromLdap=Всегда считывать значение из LDAP
+searchUserEventsBtn=Поиск событий
+addressClaim.postal_code.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'postal_code' внутри атрибута 'address' токен клейма. По умолчанию 'postal_code'.
+generatedUserInfoNo=Информация о пользователе не сгенерирована
+allowed-client-scopes.label=Разрешенные клиентские области
+providerId=ID провайдера
+assignedClientScope=Назначенная клиентская область
+savePasswordSuccess=Пароль успешно установлен.
+Tuesday=Вторник
+idTokenEncryptionContentEncryptionAlgorithm=Алгоритм шифрования содержимого идентификатора токена
+newRoleName=Новое название роли
+listExplain=Поставщики удостоверений — это социальные сети или брокеры удостоверений, которые позволяют пользователям проходить аутентификацию в Keycloak.
+emptyInstructions=Измените критерии поиска или добавьте пользователя
+tableView=Вид таблицы
+addClientProfile=Добавить профиль клиента
+maxFailureWaitSeconds=Макс. ожидание
+userEventsRegistered=Зарегистрировано пользовательских событий
+editGroup=Редактировать группу
+eventConfigError=Не удалось сохранить конфигурацию события: {{error}}
+confirmAccessTokenTitle=Повторно сгенерировать токен доступа к регистрации?
+target=Цель
+impersonateConfirmDialog=Вы уверены, что хотите войти как этот пользователь? Если этот пользователь находится в том же realm, что и вы, ваш текущая сессия входа будет завершен до того, как вы войдете как этот пользователь.
+alwaysDisplayInUI=Всегда отображать в пользовательском интерфейсе
+protocolMapper=Протокол...
+requiredSettings=Требуемые настройки
+oneLevel=Один уровень
+userSaved=Пользователь был сохранен
+useRefreshTokens=Используйте токены обновления
+standardFlowHelp=Это включает стандартную аутентификацию на основе перенаправления OpenID Connect с кодом авторизации. В терминах спецификаций OpenID Connect или OAuth2 это включает поддержку "Authorization Code Flow" для этого клиента.
+clientDeleteConfirm=Если вы удалите этого клиента, все связанные с ним данные будут удалены.
+derFormattedHelp=Активируйте этот параметр, если сертификат имеет формат DER в LDAP, а не формат PEM.
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=Поставщик удостоверений после входа в систему
+scopePermissions.users.view-description=Политики, которые определяют, может ли администратор просматривать всех пользователей в realm
+ldapGeneralOptionsSettingsDescription=В этом разделе содержится несколько основных параметров, общих для всех поставщиков пользовательских хранилищ.
+importSkipped_one=Одна запись пропущена.
+eventTypes.OAUTH2_DEVICE_AUTH.description=Аутентификация устройства OAuth2
+notBeforeClearedSuccess=Успешно! "Не раньше" очищено для realm.
+policySaveError=Не удалось обновить политику: {{error}}
+experimental=Экспериментальный
+idTokenSignatureAlgorithmHelp=Алгоритм JWA, используемый для подписи идентификационных токенов.
+deleteResourceConfirm=Если вы удалите этот ресурс, некоторые разрешения будут затронуты.
+httpPostBindingResponse=Привязанный ответ HTTP-POST
+artifactBindingResponse=Ответ на связывание ARTIFACT
+tokenLifespan.inherited=Наследует из настроек realm
+saveEvents=Сохранять события
+issuer=Эмитент
+policyEnforcementModeHelp=Режим применения политик диктует, каким образом политики применяются при оценке запросов на авторизацию. "Обязательный" означает, что запросы запрещены по умолчанию, даже если нет никакой политики, связанной с данным ресурсом. "Разрешающая" означает, что запросы разрешены даже если не существует политика, связанная с данным ресурсом. 'Отключено' полностью отключает оценку политики и позволяет получить доступ к любому ресурсу.
+selectAUser=Выберите пользователя
+groupCreated=Группа создана
+generateError=Не удалось сгенерировать новую пару ключей и сертификат {{error}}
+testClusterSuccess=Успешно проверена доступность для: {{successNodes}}
+whoWillAppearLinkTextRoles=Кто появится в этом списке пользователей?
+attestationPreference.not\ specified=Не указана
+importConfigHelp=Импортируйте метаданные из загруженного дескриптора обнаружения IDP.
+targetClaim=Целевой клейм
+assignRole=Назначить роль
+accessSettings=Настройки доступа
+updateFlowSuccess=Сценарий успешно обновлен
+authenticatedAccessPolicies=Политики аутентифицированного доступа
+addExecutor=Добавить исполнителя
+selectIfResourceExists=Если ресурс уже существует, укажите, что нужно сделать
+passwordPoliciesHelp.notEmail=Пароль не может совпадать с адресом электронной почты пользователя.
+deleteAttributeGroupError=Не удалось удалить группу атрибутов пользователя: {{error}}
+trustEmail=Подтверждение E-mail
+credentialReset=Сброс учетных данных
+eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Ошибка требуемого пользовательского действия
+deleteValidatorConfirmTitle=Удалить валидатор?
+claimJsonType=Тип переменной в JSON клейм, который должен использоваться при добавлении ее в токен. Допустимые значения long, int, boolean, и String.
+kc.client.network.ip_address=IPv4-адрес клиента
+signatureAndEncryption=Подпись и шифрование
+reset=Сбросить
+hardcodedUserSessionAttribute=При импорте пользователя от провайдера жестко задайте значение для определенного атрибута сессии пользователя.
+conditionType=Тип состояния
+multiValued=Отображается, если атрибут поддерживает несколько значений. Если включен, то список всех значений этого атрибута будет установлен как клейм. В противном случае только первое значение будет установленно как клейм.
+browse=Смотреть
+duplicateEmailsHelpText=Разрешает разным пользователям иметь один и тот же E-mail. Изменение этой настройки также очистит пользовательский кэш. После выключения поддержки дублирующихся email рекомендуется вручную почистить в базе данных ограничения по E-mail существующим пользователям.
+importOverwritten_zero=Никакие записи не перезаписаны.
+usermodel.realmRoleMapping.rolePrefix.label=Префикс ролей Realm
+eventTypes.GRANT_CONSENT.name=Дать согласие
+noProvidersLinked=Поставщики удостоверений не подключены.
+testConnectionSuccess=Успешно! SMTP-подключение успешно. Письмо отправлено!
+samlSettings=Настройки SAML
+userFedDisableConfirm=Если вы отключите этого поставщика федерации пользователей, он не будет учитываться при запросах, а импортированные пользователи будут отключены и доступны только для чтения до тех пор, пока поставщик не будет снова включен.
+userSessionAttribute=Атрибут сессии пользователя
+enabled=Включено
+forgotPassword=Забыли пароль
+searchUserByAttributeMissingValueError=Укажите значение атрибута
+passwordPoliciesHelp.maxLength=Макс. допустимое количество символов в пароле.
+passwordPoliciesHelp.maxAuthAge=Макс. возраст аутентификации, при котором пароль может быть изменен без повторной аутентификации.
+moveGroupError=Не удалось переместить группу {{error}}
+clientImportSuccess=Клиент успешно импортирован
+dragHelp=Нажмите пробел или ввод, чтобы начать перемещение, и используйте клавиши со стрелками для перемещения вверх или вниз. Нажмите ввод, чтобы подтвердить перемещение, или любую другую клавишу, чтобы отменить операцию перемещения.
+startTime=Определяет время, до наступления которого политика НЕ ДОЛЖНА быть разрешена. Разрешено только если текущее время/дата больше или равны заданному значению
+logicHelp=Логика диктует, как политика должна применяться. Если 'Позитивная', результирующий эффект (разрешение или запрещение) полученный в ходе оценки этой политики будет использован для выполнения решения. Если 'Негативная', результирующий эффект будет отрицательным, другими словами, разрешение становится запрещением и наоборот.
+allowRegexComparison=Разрешить сравнение шаблонов регулярных выражений
+noSessionsForUser=В настоящее время для этого пользователя нет активных сессий.
+eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.description=Ошибка учетной записи привязки поставщика удостоверений
+implicitFlowHelp=Это включает поддержку аутентификации на основе перенаправления OpenID Connect без кода авторизации. В терминах спецификаций OpenID Connect или OAuth2 это включает поддержку "Implicit Flow" для этого клиента.
+user-events-cleared-error=Не удалось очистить пользовательские события {{error}}
+eventTypes.IMPERSONATE_ERROR.name=Ошибка имперсонации
+executorType=Тип исполнителя
+configureMappingDescription=Выберите любое из сопоставлений из этой таблицы
+keystorePassword=Пароль хранилища ключей
+mapperTypeHardcodedLdapRoleMapperHelp=Пользователи, импортированные из LDAP, будут автоматически добавлены в эту настроенную роль.
+more={{count}} больше
+clientNameHelp=Задает отображаемое название клиента. Например 'Мой клиент'. Поддерживает ключи для локализованных значений. Например\: ${my_client}.
+mappersList=Список сопоставлений
+rootUrl=Корневой URL
+realmExplain=Realm управляет набором пользователей, учетных данных, ролей и групп. Пользователь принадлежит к realm и входит в нее. Realm'ы изолированы друг от друга и могут управлять и аутентифицировать только тех пользователей, которых они контролируют.
+inputHelperTextBefore=Вспомогательный текст (над) полем ввода
+webAuthnPolicyExtraOrigins=Дополнительные источники
+webAuthnPolicyPasskeysEnabled=Включить пароли
+samlSignatureKeyName=Имя ключа сигнатуры SAML
+validateUsersDn=Вы должны ввести DN пользователя
+importError=Не удалось импортировать сертификат {{error}}
+logicType.negative=Негативная
+otpPolicy=Политики OTP
+noRolesInstructions-groups=Вы не создали ни одной роли для этой группы. Создайте роль, чтобы начать.
+validateAttributeName=Конфигурация атрибута без имени не допускается.
+eventTypes.RESET_PASSWORD_ERROR.description=Ошибка сброса пароля
+addUser=Добавить пользователя
+eventTypes.REGISTER.description=Зарегистрироваться
+includeAuthnStatementHelp=Должны ли заявки на методы и временные метки быть включены в ответе на вход?
+evaluateError=Не удалось оценить из-за: {{error}}
+iconUriHelp=URI, указывающий на иконку.
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=Код пользователя для проверки устройства OAuth2
+protocol=Протокол
+permissionsScopeName=Область-имя
+validPostLogoutRedirectURIsHelp=Допустимый шаблон URI, на который браузер может перенаправить после успешного выхода из системы. Значение "+" или пустое поле использует список допустимых URI перенаправления. Значение "-" не разрешает никаких URI перенаправления после выхода из системы. Разрешены простые подстановочные знаки, такие как "http://example.com/*". Также можно указать относительный путь, например /my/relative/path/*. Относительные пути относятся к корневому URL клиента; если ничего не указано, используется корневой URL сервера аутентификации.
+manageAccount=Управление учетной записью
+oauthDeviceAuthorizationGrant=Предоставление авторизации устройства OAuth 2.0
+copyFlowError=Не удалось продублировать сценарий: {{error}}
+roleRemoveAssociatedRoleConfirm=Удалить связанную роль?
+httpPostBindingAuthnRequest=Привязывание HTTP-POST для AuthnRequest
+includeInAccessToken.label=Добавить в токен доступа
+samlKeysExportSuccess=Ключи успешно экспортированы
+usersInRole=Пользователи в роли
+policyProvider.group=Определите условия для ваших разрешений, при которых набору из одной или нескольких групп (и их иерархий) разрешен доступ к объекту.
+updatedUserProfileError=Конфигурация профиля пользователя не сохранена: {{error}}
+emptyPermissions=Нет разрешений
+deletePermission=Удалить разрешение навсегда?
+selectUser=Выберите пользователя, идентификационные данные которого будут использованы для запроса разрешений с сервера.
+resultPermit=Результат-Разрешение
+userFederationExplain=Федерация пользователей обеспечивает доступ к внешним базам данных и каталогам, таким как LDAP и Active Directory.
+emptyAuthorizationScopes=Нет областей авторизации
+noDefaultGroups=Нет групп по умолчанию
+policyProvider.time=Определите временные условия для ваших разрешений.
+updateFlowError=Не удалось обновить сценарий: {{error}}
+valuePlaceholder=Введите значение
+usersLeft_other={{count}} пользователей покинули группу
+updateClientContext=Обновление клиентского контекста
+removeAssociatedRoles=Удалить связанные роли
+nameIdPolicyFormatHelp=Указывает ссылку URI, соответствующую формату идентификатора имени.
+mappers=Сопоставления
+attributeGeneralSettingsDescription=В этом разделе содержится несколько основных настроек, общих для всех атрибутов.
+name-id-format=Имя формата ID
+deleteRealm=Удалить realm
+noRoles-clientScopes=Нет ролей для этой клиентской области
+noRoles-clients=Нет ролей для этой клиентской области
+deleteFlowError=Не удалось удалить сценарий: {{error}}
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Поставщик удостоверений после входа в систему
+roleImportError=Не удалось импортировать роль
+regexAttributeValuesHelp=Если этот параметр включен, значения атрибутов интерпретируются как регулярные выражения.
+userCreated=Пользователь был создан
+residentKey.not\ specified=Не указан
+clientUpdaterSourceHost=Условие проверяет хост/домен сущности, которая пытается создать/обновить клиента, чтобы определить, применяется ли политика.
+alwaysReadValueFromLdapHelp=Если включено, то при чтении значения атрибута LDAP всегда будет использоваться значение из базы данных Keycloak.
+usermodel.clientRoleMapping.tokenClaimName.tooltip=Имя клейма для вставки в токен. Это может быть полное имя, например 'address.street'. В этом случае создается вложенный объект JSON. Чтобы предотвратить вложение и использовать точку буквально, экранируйте точку обратной косой чертой (\\.). Вы можете использовать специальный токен ${client_id}; он будет заменен фактическим идентификатором клиента. Пример использования — "resource_access.${client_id}.roles". Этот параметр особенно полезен, когда вы добавляете роли от всех клиентов, то есть "Client ID" отключен, и вы хотите, чтобы роли клиента для каждого клиента хранились отдельно.
+scopePermissions.clients.map-roles-description=Политики, которые определяют, может ли администратор сопоставлять роли, определенные этим клиентом
+signAssertions=Sign Assertions
+disableUserInfoHelp=Отключить использование сервиса информации о пользователе, чтобы получить дополнительную информацию о пользователе? По умолчанию используется сервис OIDC.
+xFrameOptionsHelp=Значение по умолчанию предотвращает включение страниц в неоригинальные iframe. <1>Узнать больше</1>
+copyError=Ошибка копирования данных авторизации: {{error}}
+validateSignatures=Включает/выключает проверку подписи ответов от SAML.
+authentication=Аутентификация
+eventTypes.DELETE_ACCOUNT.name=Удалить аккаунт
+logoutUrlHelp=Точка доступа окончания сессии, используемая для выхода пользователя из внешнего IDP.
+noUserDetails=Нет данных о пользователе
+sync-ldap-groups-to-keycloak=Синхронизация групп LDAP с Keycloak
+attestationPreference.indirect=Косвенная
+frontchannelUrlInvalid=URL-адрес выхода из фронтального канала не является допустимым URL-адресом
+noCredentialsText=У этого пользователя нет учетных данных. Вы можете установить пароль для этого пользователя.
+deletePolicyWarning=Указанные ниже агрегированные политики будут удалены автоматически:
+validatingPublicKey=Проверка открытого ключа
+permissionsListIntro=Отредактируйте список разрешений, щелкнув имя области. Затем он перенаправляет на страницу сведений о разрешениях клиента с именем <1>{{realm}}</1>
+deleteClientConditionSuccess=Состояние успешно удалено.
+signatureAlgorithm=Алгоритм, используемый для подписи документов
+deleteConfirmIdentityProvider=Вы уверены, что хотите навсегда удалить поставщика '{{provider}}'?
 resetActions=Действия сброса
+cibaExpiresInHelp=Время истечения срока действия "auth_req_id" в секундах с момента получения запроса на аутентификацию.
+eventTypes.CLIENT_INFO_ERROR.description=Ошибка информации о клиенте
+batchSize=Размер пакета
+user=Пользователь
+scopesAsRequested=Запрошены области
+updateErrorClientScope=Не удалось обновить область действия клиента: '{{error}}'
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=Код пользователя для проверки устройства OAuth2
+useKerberosForPasswordAuthentication=Использовать Kerberos для аутентификации по паролю
+validateUuidLDAPAttribute=Необходимо ввести атрибут UUID LDAP
+client-scopes-condition.tooltip=Список ожидаемых клиентских областей. Условие оценивается как истинное, если указанный клиентский запрос соответствует некоторым клиентским областям. Это также зависит от того, должна ли это быть область клиента по умолчанию или необязательная область на основе настроенного 'Типа области'.
+rootURLHelp=Корневой URL-адрес, добавленный к относительным URL-адресам
+anonymousAccessPolicies=Политики анонимного доступа
+createResourceBasedPermission=Создать разрешение на основе ресурсов
+searchForRole=Поиск роли
+debugHelp=Включить/выключить отладочные логи в стандартный вывод для Krb5LoginModule.
+validatorColNames.colConfig=Конфигурация
+createClient=Создать клиента
+inputTypeRows=Входные строки
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Первый вход в систему поставщика удостоверений
+usedMemory=Использованная память
+validatePasswordPolicyHelp=Определяет, должен ли Keycloak проверять пароль с помощью политики паролей realm перед его обновлением. Когда пароль пользователя сохраняется в LDAP, некоторые политики паролей Keycloak не работают: Not Recently Used, Expire Password, Hashing Iterations и Hashing Algorithm. Эта ситуация возникает из-за того, что Keycloak не имеет прямого контроля над хранилищем паролей. Если вы хотите использовать эти политики, включите политики паролей на уровне сервера LDAP.
+bruteForceModeHelpText=Если включено, укажите, что должно произойти с учетной записью пользователя в случае обнаружения атаки методом подбора пароля.
+quickLoginCheckMilliSeconds=Если попытки аутентификации происходят слишком часто, то пользователя необходимо заблокировать
+createResourceSuccess=Ресурс создан успешно
+documentation=Документация
+fullNameLdapReadOnlyHelp=Для режима "Только чтение" данные импортируются из LDAP в базу данных Keycloak, но не сохраняются обратно в LDAP при обновлении пользователя в Keycloak.
+roleExplain=Роли realm — это роли, которые вы определяете для использования в текущем realm.
+whatIsDefaultGroups=Какая функция у групп по умолчанию?
+transient=Временный
+generalSettings=Общие настройки
+addClientProfileError=Не удалось создать профиль клиента: '{{error}}'
+overallResults=Общие результаты
+requiredUserActionsHelp=Требует действий от пользователя когда он входит. 'Подтвердить E-mail' высылает письмо пользователю для подтверждения его E-mail. 'Обновить профиль' требует от пользователя ввести новую персональную информацию. 'Обновить пароль' требует от пользователя ввести новый пароль. 'Настроить OTP' требует установить мобильное приложение генерации паролей.
+requestObjectSignatureAlgorithmHelp=JWA алгоритм, который необходим клиенту для использования во время отсылки OIDC запроса объекта, специфицированного по 'request' или 'request_uri' параметрам. Если установлено в 'any', то объект запроса будет подписан любым алгоритмом (включая 'none' ).
+ldapKerberosSettingsDescription=Этот раздел содержит полезные параметры для интеграции Kerberos. Используется только тогда, когда сервер LDAP используется вместе с Kerberos/SPNEGO для аутентификации пользователя.
+deleteEvents=Удалить события
+termsOfServiceUrlHelp=URL-адрес, который Клиент Проверяющей Стороны предоставляет Конечному Пользователю для ознакомления с условиями обслуживания Проверяющей Стороны
+clientSecretError=Не удалось восстановить секретный ключ клиента из-за: {{error}}
+resourcePath=Путь к ресурсу
+useJwksUrlHelp=Если включено, то публичные ключи поставщиков идентификации будет скачаны с заданного JWKS URL. Это дает дополнительную гибкость, так как новые ключи скачиваются каждый раз когда поставщик идентификации создает новую пару. Если выключено, то будут использованы публичные ключи (или сертификат) из базы данных Keycloak, и в случае изменений пары на поставщике идентификации вам будет необходимо каждый раз импортировать новые ключи в базу данных Keycloak.
+mapperTypeHardcodedAttributeMapperHelp=Это сопоставление жестко закодирует любой атрибут пользователя модели и некоторые свойства (например, emailVerified или enabled) при импорте пользователя из LDAP.
+downloadAdaptorTitle=Загрузить конфигурации адаптера
+client-roles.label=Роли клиента
+keysFilter.PASSIVE=Пассивные ключи
+revocation=Отзыв
+scopeTypeHelp=Клиентские области, которые будут добавлены в качестве областей по умолчанию для каждого созданного клиента
+search=Поиск
+validateEditMode=Вам необходимо выбрать режим редактирования
+copyFlowSuccess=Сценарий успешно продублирован
+cacheSettings=Настройки кэша
+client-attributes.label=Атрибуты клиента
+searchForClient=Поиск клиента
+permissionDeletedError=Не удалось удалить разрешение из-за {{error}}
+eventTypes.UPDATE_PROFILE.name=Обновить профиль
+realmId=ID realm
+eventTypes.PERMISSION_TOKEN_ERROR.description=Ошибка токена разрешения
+algorithmHelp=Предполагаемый алгоритм для ключа
+importFile=Импортировать файл
+userVerify.discouraged=Не рекомендуется
+ldapRolesDn=LDAP роли DN
+displayOnClientHelp=Применимо только если для этого клиента включено "Требуется согласие". Если этот переключатель выключен, экран согласия будет содержать только согласия, соответствующие настроенным клиентским областям. Если включено, на экране согласия будет также один элемент об этом самом клиенте.
+requestObjectRequired=Требуется объект запроса
+protocolHelp=Какая конфигурация протокола SSO будет поддержана шаблоном клиента
+prompts.none=нет
+resourcesHelp=Определяет, что это разрешение должно быть применено к конкретному экземпляру ресурсов.
+passwordConfirmation=Подтверждение пароля
+aggregate.attrs.tooltip=Указывает, следует ли объединять значения атрибутов с атрибутами группы. При использовании OpenID Connect mapper необходимо также включить многозначный параметр, чтобы получить все значения. Дублированные значения отбрасываются, а порядок значений не гарантируется с помощью этого параметра.
+helpLabel=Дополнительная помощь для '{{label}}'
+noRoles=Нет ролей для этого пользователя
+createAttribute=Создать атрибут
+Thursday=Четверг
+importOverwritten_one=Одна запись перезаписана.
+tokenDeleteError=Не удалось удалить начальный токен доступа: '{{error}}'
+eventTypes.REGISTER_NODE_ERROR.name=Ошибка регистра узла
+isMandatoryInLdap=Обязательно в LDAP
+discoveryEndpoint=Импорт метаданных из дескриптора развертывания удаленного поставщика идентификации
+claimValue=Значение клейма
+eventTypes.FEDERATED_IDENTITY_LINK.name=Федеративная ссылка на идентификацию
+authenticationHelp=Этот переключатель определяет тип клиента OIDC. Когда он включен, тип — конфиденциальный доступ. Когда он выключен, тип — публичный доступ.
+deleteClientConditionError=Ошибка создания условия: {{error}}
+noMappers=Нет сопоставлений
+couldNotLinkIdP=Не удалось связать поставщика удостоверений {{error}}
+otpPolicyPeriod=Период токена OTP
+managePriorities=Управляйте приоритетами
+createClientPolicySuccess=Создана новая политика
+frontendUrlHelp=Установите URL-адрес интерфейса для realm. Используйте в сочетании с поставщиком имени хоста по умолчанию, чтобы переопределить базовый URL-адрес для запросов интерфейса для определенного realm.
+used.notInUse=Не используется
+emailSettings=Настройки электронной почты
+samlEntityDescriptorHelp=Позволяет загружать внешние метаданные IDP из файла конфигурации или загружать их по URL-адресу.
+generatedIdTokenHelp=См. пример токена ID, который будет сгенерирован и отправлен клиенту при аутентификации выбранного пользователя. Вы можете увидеть клеймы и роли, которые будет содержать токен, на основе эффективных сопоставление протоколов и сопоставление областей ролей, а также на основе клеймов и ролей, назначенных фактическому пользователю.
+createClientProfile=Создать профиль клиента
+passwordPoliciesHelp.specialChars=Количество специальных символов, необходимых в строке пароля.
+cachePolicy=Политика кэширования
+noCredentials=Нет учетных данных
+clientOfflineSessionIdle=Клиентская автономная сессия в режиме ожидания
+eventListeners=Слушатели событий
+bindDn=Сопоставление DN
+evictionHourHelp=Час дня, когда запись станет недействительной
+permissionDetails=Подробности разрешения
+clipboardCopyDenied=Ваш браузер блокирует доступ к буферу обмена.
+Friday=Пятница
+saveProviderListSuccess=Приоритет провайдера успешно обновлен.
+copyToClipboard=Копировать в буфер обмена
+wantAuthnRequestsSigned=Ожидание подписи AuthnRequests
+usermodel.attr.tooltip=Имя сохраненного атрибута пользователя, которое является именем атрибута, согласованным с UserModel.attribute.
+clientPoliciesProfiles=Профили клиентских политик
+eventTypes.SEND_VERIFY_EMAIL.name=Отправить подтверждение по электронной почте
+requiredForLabel.both=И пользователи, и администраторы
+eventTypes.REGISTER_NODE.name=Зарегистрировать узел
+addToFilter=Добавить в фильтр
+CONFIGURE_TOTP=Настроить OTP (CONFIGURE_TOTP)
+eventTypes.EXECUTE_ACTIONS.description=Выполнить действия
+clientUpdaterSourceRolesHelp=Условие проверяет роль сущности, которая пытается создать/обновить клиента, чтобы определить, применяется ли политика.
+userModelAttributeName=Имя атрибута модели пользователя
+importResourceError=Не удалось импортировать ресурс из-за {{error}}
+dynamicScope=Динамическая область
+mapperTypeHardcodedLdapRoleMapper=hardcoded-ldap-role-mapper
+validateName=Вы должны ввести имя
+flowDetails=Подробности сценария
+never=Никогда
+includeInIntrospection.tooltip=Следует ли добавить этот клейм к интроспекции токена?
+addressClaim.region.tooltip=Имя пользовательского атрибута, которое будет использоваться для сопоставления атрибута 'region' внутри атрибута 'address' токен клейма. По умолчанию 'region'.
+IDK-periodicChangedUsersSyncHelp=Должны ли новые пользователи создаваться в хранилище LDAP? Приоритет влияет на то, какой поставщик будет выбран для синхронизации нового пользователя.
+logoutServiceArtifactBindingUrlHelp=SAML ARTIFACT URL привязки для службы единого выхода клиента. Вы можете оставить это поле пустым, если используете другую привязку.
+claimToRole=Если клейм существует, предоставьте пользователю указанный realm или роль клиента.
+logoutServicePostBindingURL=URL для выхода из сервиса в привязанном POST-методе
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=Удалить ошибку федеративной идентификации
+assertionConsumerServicePostBindingURLHelp=URL-адрес SAML POST запроса для клиентских сервисов подтверждения потребителей (запросы входа). Вы можете оставить это поле пустым, если не имеете URL для осуществления такой приввязки.
+createAuthorizationScope=Создать область авторизации
+noGroups=Нет групп
+backchannelLogoutRevokeOfflineSessionsHelp=Указание того, включено ли событие "revoke_offline_access" в токен выхода из системы при использовании URL-адреса выхода из системы back-channel. Keycloak отменит офлайн-сессии при получении токена выхода из системы с этим событием.
+roleID=Идентификатор роли
+roleNameLdapAttributeHelp=Имя атрибута LDAP, который используется в объектах ролей для имени и RDN роли. Обычно это будет 'cn'. В этом случае типичный объект группы/роли может иметь DN, например 'cn=role1,ou=finance,dc=example,dc=org'.
+origin=Источник
+regexPattern=Регулярный шаблон выражения
+targetContextAttributes=Атрибуты целевого контекста
+targetContextAttributesHelp=Определяет оценку атрибутов контекста (клеймов) вместо атрибутов идентичности
+filteredByClaim=Проверить существенный клейм
+rowCancelBtnAriaLabel=Отменить изменения для {{messageBundle}}
+validateSignatureHelp=Включить/выключить проверку подписей внешних поставщиков идентификации.
+searchForFlow=Поиск сценария
+verifyEmail=Подтверждение E-mail
+addressClaim.locality.label=Имя пользовательского атрибута, обозначающего Местонахождение
+formatOption=Формат
+addAuthnContextClassRef=Добавить AuthnContext ClassRef
+showPasswordDataName=Имя
+clientScopeTypes.none=Никто
+whoCanEdit=Кто может редактировать?
+mappingCreatedSuccess=Сопоставление успешно создано
+eventTypes.GRANT_CONSENT.description=Дать согласие
+client=клиент
+eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=Ошибка аутентификации устройства OAuth2
+addSubFlowHelp=Подсценарии могут быть как общими, так и формальными. Тип формы используется для построения подсценария, который генерирует один сценарий для пользователя. Подсценарии — это особый тип выполнения, который оценивается как успешный в зависимости от того, как оцениваются содержащиеся в них выполнения.
+implicitFlow=Включает поддержку OpenID Connect перенаправления, основанного на аутентификации без кода авторизации. В терминах OpenID Connect или OAuth2 спецификаций включает поддержку 'Implicit Flow' для этого клиента
+authorizationSignedResponseAlgHelp=Алгоритм JWA, используемый для подписи токенов ответа авторизации, когда режим ответа — jwt.
+associatedRolesRemoved=Связанные роли были удалены
+keyAliasHelp=Псевдоним архива для Вашего приватного ключа и сертификата
+whoWillAppearLinkTextUsers=Кто появится в этом групповом списке?
+tokenClaimName.tooltip=Имя клейма при добавлении его в токен. Может быть полное имя, например 'address.street'. В таком случае будет создан вложенный json объект. Чтобы предотвратить вложение и использовать точку буквально, экранируйте точку обратной косой чертой (\\.).
+userName=Имя пользователя
+clientProfileDescription=Описание
+ellipticCurveHelp=Эллиптическая кривая, используемая в ECDSA
+fromPredefinedMapper=Из предопределенных сопоставлений
+attributesGroup=Группа атрибутов
+ssoSessionMax=Макс. время до того, как истечет сессия. По истечении этого времени токены и браузерные сессии становятся невалидными.
+clientDeleteError=Не удалось удалить клиента: {{error}}
+optimizeLookup=Оптимизация REDIRECT поиска подписанного ключа
+joinGroupsFor=Присоединяйтесь к группам для пользователя {{username}}
+temporaryLocked=Пользователь может быть заблокирован в случае многократных неудачных попыток входа
+setup=Настроить
+unlinkAccount=Отключить учетную запись
+executors=Исполнители
+eventTypes.CLIENT_UPDATE_ERROR.name=Ошибка обновления клиента
+realm=Realm
+attributeConsumingServiceIndex=Индекс потребления атрибутов
+prompt=Подсказка
+assign=Назначить
+disableConfirmRealm=Пользователи и клиенты не могут получить доступ к realm, если она отключена. Вы уверены, что хотите продолжить?
+showAuthData=Показать авторизационные данные
+includeInUserInfo.tooltip=Должен ли клейм быть добавлен в информацию о пользователе?
+select=Выбрать
+signature-algorithm=Алгоритм JWA, который клиент должен использовать при подписании JWT для аутентификации. Если оставить пустым, клиенту разрешается использовать любой подходящий алгоритм для конкретного аутентификатора клиента.
+advanced=Продвинутый
+initialCounter=Начальное значение счетчика
+revokeRefreshTokenHelp=Если включено, то токены обновления могут быть использованы один раз. Иначе токен отзываться не будет и может использоваться многократно.
+nameField=Имя
+ownerManagedAccessHelp=Если эта функция включена, доступ к этому ресурсу может контролироваться владельцем ресурса.
+useLowerCaseBearerTypeHelp=Если это включено, ответы токенов будут установлены с типом "bearer" в нижнем регистре. По умолчанию сервер устанавливает тип как "Bearer", как определено RFC6750.
+useRfc9068AccessTokenTypeHelp=Если включено, токены доступа получат тип заголовка "at+jwt" в соответствии с RFC9068. В противном случае тип заголовка будет "JWT".
+addCondition=Добавить условие
+updateSuccessClientScope=Обновлена область действия клиента
+connectionAndAuthentication=Подключение и аутентификация
+clientScopeType.optional=Необязательная
+permissionsDisableConfirm=Если вы отключите разрешения, все разрешения в списке ниже будут удалены автоматически. Кроме того, будут удалены связанные ресурсы и области действия
+eventTypes.REFRESH_TOKEN.description=Обновить токен
+authorization=Включить/Выключить тонко-настраиваемую поддержку авторизации для клиента
+clientProfilesHelpItem=Справочная информация по профилям клиентов
+userSessionAttributeValue=Значение атрибута сессии пользователя
+dayMonthHelp=Определяет день месяца, когда политика ДОЛЖНА быть предоставлена. Вы также можете указать диапазон, заполнив второе поле. В этом случае разрешение предоставляется только в том случае, если текущий день месяца находится между двумя указанными вами значениями или равен им.
+fullNameLdapWriteOnlyHelp=Для Write-only данные распространяются на LDAP, когда пользователь создается или обновляется в Keycloak. Но это сопоставление не используется для распространения данных из LDAP обратно в Keycloak. Этот параметр полезен, если вы настроили отдельные преобразователи атрибутов firstName и lastName и хотите использовать их для чтения атрибута из LDAP в Keycloak.
+userFedDeleteError=Не удалось удалить поставщика федерации пользователей: '{{error}}'
+id=ID
+join=Присоединиться
+clientUpdaterSourceGroupsHelp=Условие проверяет группу сущности, которая пытается создать/обновить клиента, чтобы определить, применяется ли политика.
+idTokenEncryptionContentEncryptionAlgorithmHelp=Алгоритм JWA, используемый для шифрования контента при шифровании токенов ID. Эта опция нужна только в том случае, если вам нужны зашифрованные токены ID. Если оставить пустым, токены ID будут просто подписаны, но не зашифрованы.
+messageBundleDescription=Вы можете редактировать только поддерживаемые локали. Если вы еще не выбрали поддерживаемые локали, вы можете редактировать только английскую локаль.
+saveEventListenersError=Ошибка сохранения слушателя событий: {{error}}
+scopesHelp=Области, которые будут посланы после запроса авторизации. Это может быть список областей, разделенных пробелом. По умолчанию 'openid'.
+multivalued.tooltip=Отображается, если атрибут поддерживает несколько значений. Если включен, то список всех значений будет установлен как клейм. В противном случае только первое значение будет установлено как клейм
+inputOptionLabelsI18nPrefix=Префикс ключа интернационализации
+enabledHelp=Установите, включены ли ключи
+nameHintHelp=Уникальное имя группы. Это имя будет использоваться для ссылки на группу при привязке атрибута к группе.
+admin-events-cleared-error=Не удалось очистить события администратора {{error}}
+usersPermissionsHint=Тонкие разрешения для управления всеми пользователями в realm. Вы можете определить различные политики для того, кому разрешено управлять пользователями в realm.
+isBinaryAttribute=Является ли двоичным атрибутом
+clientScopeList=Области применения клиента
+noValidMetaDataFound=По этому URL-адресу не найдены допустимые метаданные: '{{error}}'
+eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=Ошибка извлечения токена поставщиком удостоверений
+usernameLdapAttribute=Атрибут Username в LDAP
+updateResourceSuccess=Ресурс успешно обновлен
+displayNameHelp=Дружественное имя для поставщиков удостоверений.
+idpAccountEmailVerification=Проверка электронной почты учетной записи IdP
+template=Шаблон
+deleteExecutionSuccess=Исполнение успешно удалено
+deleteConfirmTitle_other=Удалить группы?
+profilesConfigTypes.jsonEditor=JSON-редактор
+testingConnection=Тестирование соединения
+noUsersFoundError=Пользователи не найдены из-за {{error}}
+clientUpdaterSourceGroups=Группы
+executorDetails=Данные об исполнителе
+maxDeltaTimeSeconds=Время сброса неудачных попыток
+backchannelLogoutHelp=Поддерживает ли внешний IDP back-channel logout?
+eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=Удалить ошибку федеративной идентификации
+usermodel.realmRoleMapping.rolePrefix.tooltip=Префикс для каждой роли Realm (опционально).
+exportSamlKeyTitle=Экспорт ключей SAML
+eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=Ошибка кода пользователя проверки устройства OAuth2
+eventTypes.EXECUTE_ACTIONS_ERROR.description=Ошибка выполнения действий
+SKIP=Пропустить
+eventTypes.INTROSPECT_TOKEN.description=Интроспекция токена
+infoEnabledFeatures=Показывает все включенные функции.
+displayOrderHelp=Число, определяющее порядок поставщиков в GUI (например, на странице входа). Сначала будет применен наименьший номер.
+deleteCredentialsConfirm=Вы уверены, что хотите удалить учетные данные этих пользователей?
+keysIntro=Если включено "Использовать переключатель URL JWKS", вам необходимо заполнить действительный URL JWKS. После сохранения администратор может загрузить ключи с URL JWKS, или ключи будут автоматически загружены сервером Keycloak, когда во время аутентификации клиента будет обнаружен неизвестный KID.
+logoutServiceArtifactBindingUrl=Служба выхода из системы ARTIFACT Привязка URL
+passwordPoliciesHelp.lowerCase=Количество строчных букв, необходимое в строке пароля.
+searchForProvider=Поиск поставщика
+ldapSearchingAndUpdatingSettingsDescription=В этом разделе содержатся параметры, связанные с поиском доступных пользователей на сервере LDAP.
+sessionsType.regularSSO=Регулярный единый вход
+allowed-client-scopes.tooltip=Белый список клиентских realm, которые могут быть использованы для вновь зарегистрированного клиента. Попытка зарегистрировать клиента с какой-либо клиентской областью, которая не внесена в белый список, будет отклонена. По умолчанию белый список либо пуст, либо содержит только клиентские области по умолчанию (на основе свойства конфигурации "Разрешить области по умолчанию")
+maxDeltaTimeSecondsHelp=Через какое время счетчик неудачных попыток будет сброшен?
+executorsHelpItem=Справка для исполнителей
+contentSecurityPolicy=Политика безопасности контента (Content-Security-Policy)
+client-uris-must-match.tooltip=Если этот параметр включен, все клиентские URIs (URI перенаправления и другие) разрешены, только если они соответствуют какому-либо доверенному хосту или домену.
+off=Выключенный
+frontchannelLogoutHelp=Когда истинно, выход требует перенаправить браузер на клиента. Если ложь, сервер выполняет фоновый режим для выхода из системы.
+frontchannelLogoutOIDCHelp=Если истинно, выход из системы требует, чтобы браузер отправил запрос клиенту на настроенный URL выхода из front-channel, как указано в спецификации выхода из front-channel OIDC. Если false, сервер может выполнить фоновый вызов для выхода из системы, пока настроен URL back-channel-logout или URL администратора.
+updateSuccess=Провайдер успешно обновлен
+hide=Скрыть
+isMandatoryInLdapHelp=Если истинно, этот атрибут является обязательным в LDAP. Если в базе данных Keycloak нет значения, пустое значение распространяется в LDAP.
+client-accesstype.label=Тип клиентского доступа
+eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Ошибка поставщика удостоверений после входа в систему
+skipCustomizationAndFinish=Пропустить настройку и завершить
+mappingDeletedSuccess=Сопоставление успешно удалено
+addIdentityProvider=Добавить поставщика {{provider}}
+flowDescriptionHelp=Справочный текст для описания нового сценария
+kc.time.date_time=Дата/Время (ММ/дд/гггг чч:мм:сс)
+principalType=Тип идентификации
+ignoreMissingGroupsHelp=Игнорировать отсутствующие группы в иерархии групп.
+updatedCredentialMoveSuccess=Конфигурация учетных данных пользователя сохранена
+deleteExecutorProfileConfirmTitle=Удалить исполнителя?
+auth=Аутентификация
+accessTokenLifespanImplicitFlow=Продолжительность жизни токена доступа для Implicit Flow
+createAttributeSuccess=Успешно! Конфигурация профиля пользователя сохранена.
+annotations=Аннотации
+confirmAccessTokenBody=Если вы повторно сгенерируете токен доступа к регистрации, данные о доступе к услуге регистрации клиентов будут обновлены.
+remainingCount=Осталось
+eventTypes.INVALID_SIGNATURE.description=Недействительная подпись
+download=Скачать
+authScopes=Области авторизации
+requiredWhen=Требуется, когда
+requiredWhenTooltip=При использовании областей действия атрибут требуется, когда в запросе на вход применяется хотя бы одна из настроенных областей действия. Оцениваются как области действия по умолчанию, так и необязательные области действия текущего запроса. В контекстах консоли администратора и консоли учетной записи области действия не оцениваются, а атрибут не требуется.
+updatePasswordPolicyError=Не удалось обновить политики паролей: '{{error}}'
+max-clients.tooltip=Регистрация нового клиента не будет разрешена, если количество существующих клиентов в realm равно или превышает настроенный лимит.
+uuidLdapAttributeHelp=Имя атрибута LDAP, который используется как уникальный идентификатор объекта (UUID) для объектов в LDAP. Для многих поставщиков серверов LDAP это "entryUUID"; однако некоторые отличаются. Например, для Active Directory это должно быть "objectGUID". Если ваш сервер LDAP не поддерживает понятие UUID, вы можете использовать любой другой атрибут, который должен быть уникальным среди пользователей LDAP в дереве. Например, "uid" или "entryDN".
+mappingDetails=Подробности сопоставления
+top-level-flow-type.client-flow=Сценарий клиентов
+eventTypes.GRANT_CONSENT_ERROR.description=Ошибка предоставления согласия
+claim=Клейм
+hardcodedAttribute=При импорте пользователя от провайдера жестко задайте значение для определенного атрибута пользователя.
+permissionSaveError=Не удалось обновить разрешение из-за {{error}}
+optimizeLookupHelp=При подписи SAML документов при REDIRECT сопоставлении с SP, который обеспечивается безопасностью адаптера Keycloak, должен ли включать ID подписанного ключа в сообщение по протоколу SAML в <Extensions> элемент? Это оптимизирует валидацию сигнатуры, где в качестве проверки используется один ключ вместо попытки проверки каждого ключа во время валидации.
+deleteClientScope_one=Удалить область клиента {{name}}
+accessTokenError=Не удалось повторно сгенерировать токен доступа из-за: {{error}}
+joinGroups=Присоединиться к группам
+scopePermissions.clients.configure-description=Сокращенные права на управление для администратора. Невозможно задать область действия, шаблон или сопоставления протоколов.
+providedBy=Предоставлено
+doNotStoreUsers=Не хранить пользователей
+ms=миллисекунды
+ipAddress=IP адрес
+keyID=ИД_КЛЮЧА
+spi=SPI
+emptyValidators=Никаких валидаторов.
+plus=Плюс
+browserFlow=Сценарий браузера
+anyScope=Любая область
+enableDisable=Отключенные клиенты не могут инициировать вход в систему или получать токены доступа.
+noUsersFound=Пользователи не найдены
+serverInfo=Информация о сервере
+chooseAPolicyTypeInstructions=Выберите один тип политики из списка ниже, а затем вы сможете настроить новую политику для авторизации. Есть несколько типов и описание.
+emailThemeHelp=Выберите тему для E-mail, которые будут отсылаться с сервера.
+principalTypeHelp=Определяет, каким образом Keycloak идентифицирует внешних пользователей по SAML-сообщению. По умолчанию идентификация происходит по Subject NameID, в качестве альтернативы можно использовать атрибут-идентификатор.
+Wednesday=Среда
+consents=Согласия
+authDetails=Подробности авторизации
+mappingDeletedError=Не удалось удалить сопоставление: '{{error}}'
+minimumQuickLoginWaitSecondsHelp=Как долго ждать после неудачной попытки быстрого входа.
+mappedGroupAttributesHelp=Список имен атрибутов, разделенных запятыми. Это указывает на список атрибутов в группе LDAP, которые будут сопоставлены как атрибуты группы в Keycloak. Оставьте это поле пустым, если не требуется сопоставление дополнительных атрибутов группы в Keycloak.
+deleteGrantsSuccess=Доступы успешно отозваны.
+mapperTypeGroupLdapMapper=group-ldap-mapper
+policyEnforcementModes.DISABLED=Отключено
+openIdConnectCompatibilityModes=Режимы совместимости OpenID Connect
+no=Нет
+code=Код
+nameHelp=Текст справки для названия нового сценария
+keys=Ключи
+defaultSigAlg=Алгоритм подписи по умолчанию
+signatureKeyName=Имя ключа сигнатуры SAML
+notBeforeTooltip=Сначала необходимо задать URL-адрес администратора на вкладке "Настройки".
+resourcesToImport=Ресурсы для импорта
+selectRole.label=Выберите роль
+isBinaryAttributeHelp=Должно быть верно для двоичных атрибутов LDAP.
+whoWillAppearPopoverFooterText=Пользователи, у которых эта роль является эффективной, не могут быть добавлены на эту вкладку.
+eventTypes.RESTART_AUTHENTICATION_ERROR.name=Ошибка аутентификации при перезапуске
+generatedUserInfoIsDisabled=Сгенерированная информация о пользователе отключается, если пользователь не выбран
+nameHelpHelp=Имя сопоставления
+prompts.consent=согласие
+flowNameHelp=Текст справки для названия нового сценария
+webAuthnPolicyRpEntityName=Название организации проверяющей стороны
+lastEvaluation=Последняя оценка
+createClientConditionError=Ошибка создания условия: {{error}}
+serverPrincipalHelp=Полное имя принципала сервера для HTTP-сервиса, включая имя сервера и домена. Например, HTTP/host.foo.org@FOO.ORG
+enableStartTlsHelp=Шифрует соединение с LDAP с помощью STARTTLS, что отключает пул соединений
+resourceScopeSuccess=Область авторизации успешно удалена
+userIdHelperText=Введите уникальный идентификатор пользователя для этого поставщика удостоверений.
+forwardParametersHelp=Параметры запроса Non OpenID Connect/OAuth, которые необходимо переслать внешнему IDP из первоначального запроса приложения в точку доступа авторизации. Можно ввести несколько параметров, разделенных запятой (,).
+on=Вкл
+changeAuthenticatorConfirmTitle=Изменить на {{clientAuthenticatorType}}?
+eventTypes.OAUTH2_DEVICE_AUTH.name=Аутентификация устройства OAuth2
+admin-events-cleared=События администратора были очищены
+or=или
+deleteDialogTitle=Удалить группу атрибутов?
+eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Клиент инициировал привязку аккаунта
+annotationsText=Аннотации
+ldapAttributeName=Имя атрибута LDAP
+acceptsPromptNone=Принимает приглашение=нет переслать от клиента
+loginThemeHelp=Выберите тему для страниц входа, временного одноразового пароля (OTP), выдачи разрешений, регистрации и восстановления пароля.
+AESKeySizeHelp=Размер в байтах для сгенерированного ключа AES. Размер 16 для AES-128, размер 24 для AES-192 и размер 32 для AES-256. WARN: Ключи большего размера, чем 128, не допускаются в некоторых реализациях JDK.
+client-accesstype.tooltip=Тип доступа клиента, для которого будет применено условие. Конфиденциальный клиент включил аутентификацию клиента, когда публичный клиент отключил аутентификацию клиента. Bearer-only — устаревший тип клиента.
+oneTimePassword=Одноразовый пароль
+invalidateRotatedError=Не удалось удалить обновленный секретный ключ: {{error}}
+excludeSessionStateFromAuthenticationResponseHelp=Если этот параметр включен, параметр 'session_state' не будет включен в ответ аутентификации OpenID Connect. Это полезно, если клиент использует старый адаптер OIDC / OAuth2, который не поддерживает параметр 'session_state'.
+useRefreshTokenForClientCredentialsGrantHelp=Если этот параметр включен, refresh_token будет создан и добавлен в ответ токена, если используется доступ client_credentials. В разделе 4.4.3 OAuth 2.0 RFC6749 указано, что refresh_token не должен генерироваться при использовании доступа client_credentials. Если этот параметр выключен, refresh_token не будет генерироваться, а связанная сессия пользователя будет удален.
+userManagedAccess=Доступ, управляемый пользователем
+initialAccessToken=Токен первичного доступа
+rowEditBtnAriaLabel=Редактировать {{messageBundle}}
+evictionDay=День очистки
+vendorHelp=LDAP поставщик (провайдер)
+applyToResourceType=Применить к типу ресурса
+addDefaultGroups=Добавить группы по умолчанию
+selectRole.tooltip=Введите роль в текстовом поле слева, или нажмите на кнопку, чтобы выбрать желаемую роль.
+filterGroups=Фильтровать группы
+validPostLogoutRedirectUri=Допустимые URI перенаправления после выхода из системы
+authnContextClassRefs=Классы AuthnContextRefs
+deleteCredentialsSuccess=Учетные данные успешно удалены.
+eventTypes.PERMISSION_TOKEN_ERROR.name=Ошибка токена разрешения
+userProfileSuccess=Настройки профиля пользователя успешно обновлены.
+attributeDefaultValueHelp=Если в базе данных Keycloak нет значения, а атрибут является обязательным в LDAP, это значение распространяется в LDAP.
+cibaPolicy=Политика CIBA
+Saturday=Суббота
+importSkipped_other=Пропущено {{count}} записей.
+membershipAttributeTypeHelp=DN означает, что члены группы LDAP объявляются в полной форме DN. Например, 'member: uid=john,ou=users,dc=example,dc=com'. UID означает, что члены группы LDAP объявляются в форме чистого uid пользователя, например, 'memberUid: john'.
+unsavedChangesTitle=Несохраненные изменения
+emptyResourcesInstructions=Если вы хотите создать ресурс, нажмите кнопку ниже.
+save-user-eventsHelp=Если включено, то события будут сохранены в базу данных, что сделает их доступными администратору и консоли управления учетной записью.
+otpSupportedApplications.totpAppFreeOTPName=FreeOTP
+validPostLogoutRedirectURIs=Допустимый шаблон URI, на который браузер может перенаправить после успешного выхода из системы. Значение "+" или пустое поле будет использовать список допустимых URI перенаправления. Значение "-" не разрешит никаких URI перенаправления после выхода из системы. Разрешены простые подстановочные знаки, такие как "http://example.com/*". Также можно указать относительный путь, например /my/relative/path/*. Относительные пути указываются относительно корневого URL-адреса клиента, или, если ничего не указано, используется корневой URL-адрес сервера аутентификации.
+composite=Составной
+recommendedSsoTimeout=Рекомендуется, чтобы это значение было короче времени простоя сессии SSO: {{time}}
+sessionExplain=Сессии — это сессии пользователей в этом realm и клиентов, к которым они получают доступ в рамках сессии.
+noSearchResults=Нет результатов поиска
+eventTypes.AUTHREQID_TO_TOKEN.description=Authreqid для токена
+recent=Недавний
+executeActions=Выполнять действия
+policyProvider.aggregate=Повторно используйте существующие политики для создания более сложных и еще больше отделите свои разрешения от политик, которые оцениваются во время обработки запросов на авторизацию.
+advancedAttributeToRole=Если набор атрибутов существует и может быть сопоставлен, предоставьте пользователю указанный realm или роль клиента.
+userEventsSettings=Настройки пользовательских событий
+deny=Отклонить
+moveGroupSuccess=Группа перемещена
+eventTypes.USER_INFO_REQUEST.description=Запрос информации о пользователе
+userDeletedError=Не удалось удалить пользователя {{error}}
+edit=Редактировать
+authorizationScopeDetails=Подробности области действия авторизации
+ldapGroupsDnHelp=LDAP DN, где сохраняются группы этого дерева. Например, 'ou=groups,dc=example,dc=org'.
+readOnly=Только для чтения
+client-updater-trusted-hosts.tooltip=Список хостов, которым доверяют. В случае, если запрос на регистрацию/обновление клиента поступает с хоста/домена, указанного в этой конфигурации, условие оценивается как истинное. Вы можете использовать имена хостов или IP-адреса. Если вы используете звездочку в начале (например, '*.example.com' ), то весь домен example.com будет доверенным.
+resultDeny=Результат-Отклонить
+kc.client.network.host=Клиент Хост
+noResourceCreateHint=Ресурсов нет. Поэтому вы не можете создавать разрешения на основе ресурсов.
+directMembership=Прямое членство
+addExecutionTitle=Добавить выполнение
+associatedRolesText=Ассоциированные роли
+clientIdHelp=Идентификатор клиента, зарегистрированный с помощью поставщика идентификации.
+eventTypes.INVALID_SIGNATURE_ERROR.name=Ошибка неверной подписи
+clientSecretSuccess=Секретный ключ клиента восстановлен
+oAuthDeviceCodeLifespan=Срок действия кода устройства OAuth 2.0
+ldapConnectionAndAuthorizationSettingsDescription=В этом разделе содержатся параметры, связанные с настройкой подключения к серверу LDAP. Также в нем содержатся параметры, связанные с аутентификацией подключения LDAP к серверу LDAP.
+clientSaveSuccess=Клиент успешно обновлен
+ecdsaGenerated=ecdsca-сгенерированный
+flow-type.basic-flow=Общий
+oAuthDevicePollingInterval=Интервал опроса устройства OAuth 2.0
+deletedSuccessRealmSetting=Realm был удален
+webauthnPasswordlessPolicy=Политика Webauthn без пароля
+editUserLabel=Кнопка "Изменить метку пользователя"
+conditions=Условия
+addUri=Добавить URI
+excludeIssuerFromAuthenticationResponse=Исключить эмитента из ответа аутентификации
+minus=Минус
+groupsHelp=Группы, в которых пользователь имеет членство. Чтобы покинуть группу, нажмите кнопку с крестиком.
+includeGroupsAndRoles=Включить группы и роли
+groupsPermissionsHint=Определяет, включены ли детальные разрешения для управления этой ролью. Отключение удалит все текущие разрешения, которые были настроены.
+searchForTranslation=Поиск перевода
+offlineSessionMaxHelp=Макс. время до истечения автономной сессии независимо от активности.
+resourceSaveError=Не удалось сохранить ресурс из-за {{error}}
+updateCredentialUserLabelError=Ошибка изменения метки пользователя: {{error}}
+enableHelpMode=Включить режим помощи
+clientPoliciesTab=Вкладка "Политики клиента"
+ldapGroupsDn=LDAP-группы DN
+ldapFullNameAttributeHelp=Имя атрибута LDAP, который содержит полное имя пользователя. Обычно это будет 'cn'.
+clientRegisterPolicyDeleteConfirm=Вы уверены, что хотите навсегда удалить политику регистрации клиентов {{name}}
+jsonEditor=JSON-редактор
+mappingCreatedError=Не удалось создать сопоставление: '{{error}}'
+deleteClientPolicyProfileConfirmTitle=Удалить профиль?
+passwordPoliciesHelp.forceExpiredPasswordChange=Количество дней, в течение которых пароль действителен, прежде чем потребуется новый пароль.
+envelopeFromHelp=Адрес электронной почты, используемый для уведомлений о недоставке (необязательно).
+passwordPoliciesHelp.upperCase=Количество заглавных букв, необходимое в строке пароля.
+policyDeletedError=Не удалось удалить ресурс {{error}}
+key=Ключ
+email=E-mail
+groupDeleted_other=Группы удалены
+acrToLoAMappingHelp=Определите, какое значение ACR (Authentication Context Class Reference) сопоставляется с каким LoA (Level of Authentication). ACR может иметь любое значение, тогда как LoA должен быть числовым.
+uploadFile=Загрузить JSON-файл
+loginActionTimeoutHelp=Макс. время, которое пользователь имеет для выполнения действий, связанных с входом в систему, таких как обновление пароля или настройка TOTP. Рекомендуется, чтобы это было относительно долго, например, 5 минут или больше.
+identityProviders=Поставщики идентификации
+importUsers=Импортировать пользователей
+authenticationFlow=Сценарий аутентификации
+leaveGroup_other=Покинуть группы?
+deleteClientPolicySuccess=Клиентская политика удалена
+mapperTypeCertificateLdapMapper=certificate-ldap-mapper
+clientAuthentications.client_secret_basic=Секретный ключ клиента отправлен как базовая аутентификация
+started=Запущен
+filteredByClaimHelp=Если истинно, ID-токены, выпущенные поставщиком удостоверений, должны иметь определенный клейм. В противном случае пользователь не сможет пройти аутентификацию через этого брокера.
+mapperTypeCertificateLdapMapperHelp=Используется для сопоставления одного атрибута, содержащего сертификат пользователя LDAP, с атрибутом UserModel в базе данных Keycloak
+permissionDecisionStrategyHelp=Стратегия принятия решений определяет, как оцениваются политики, связанные с данным разрешением, и как принимается окончательное решение. "Утвердительный" означает, что по крайней мере одна политика должна дать положительное решение, чтобы окончательное решение также было положительным. "Единогласный" означает, что все политики должны дать положительное решение, чтобы окончательное решение также было положительным. "Консенсус" означает, что количество положительных решений должно быть больше количества отрицательных решений. Если количество положительных и отрицательных решений одинаково, окончательное решение будет отрицательным.
+userManagedAccessHelp=Если эта функция включена, пользователи могут управлять своими ресурсами и разрешениями с помощью пользовательского интерфейса управления учетными записями.
+confirm=Подтвердить
+policyType.totp=Основан на времени
+addAttribute=Добавить {{label}}
+clientScopeSearch.protocol=Протокол
+initialAccessTokenDetails=Начальные данные токена доступа
+noTranslations=Переводов нет
+deleteProvider=Удалить провайдера?
+inputTypeSize=Размер входного сигнала
+createAttributeSubTitle=Создать новый атрибут
+eventTypes.CODE_TO_TOKEN_ERROR.name=Ошибка кода токена
+emptyAuthorizationInstructions=Если вы хотите создать области авторизации, нажмите кнопку ниже, чтобы создать область авторизации
+subjectHelp=Регулярное выражение для проверки DN субъекта в сертификате клиента. Используйте "(.*?)(?:$)" для сопоставления всех видов выражений.
+updatePolicySuccess=Политика успешно обновлена
+eventTypes.CUSTOM_REQUIRED_ACTION.name=Пользовательское требуемое действие
+updateExecutorError=Исполнитель не обновлен: {{error}}
+clientIdHelpHelp=Идентификатор клиента, которому будут сопоставлены сопоставления ролей LDAP. Применимо только если "Использовать сопоставление ролей realm" имеет значение false.
+createdAt=Создан
+moveGroupEmpty=Нет подгрупп
+rolesHelp=Выберите роли, которые вы хотите связать с выбранным пользователем.
+samlEntityDescriptor=Дескриптор сущности SAML
+passwordPolicyHintsEnabled=Подсказки для политики паролей включены
+enableLdapv3PasswordHelp=Используйте расширенную операцию изменения пароля LDAPv3 (RFC-3062). Расширенная операция изменения пароля обычно требует, чтобы у пользователя LDAP уже был пароль на сервере LDAP. Поэтому, когда это используется с "Синхронными регистрациями", может быть полезно добавить также "Жестко закодированное сопоставление атрибутов LDAP" со случайно сгенерированным начальным паролем.
+syncMode=Режим синхронизации
+details=Детали
+privateRSAKeyHelp=Закрытый ключ RSA, закодированный в формате PEM
+onDragStart=Началось перемещение для элемента {{item}}
+pushedAuthorizationRequestRequired=Требуется отправленный запрос авторизации
+requirements.REQUIRED=Обязательно
+generate=Генерировать
+clientOfflineSessionMaxHelp=Макс. время до истечения сессии клиента в автономном режиме. Если на уровне realm включен параметр Offline Session Max Limited, токены в автономном режиме становятся недействительными, когда сессия клиента в автономном режиме истекает. Параметр не влияет на глобальная сессия пользователя SSO. Если не задано, используется значение Offline Session Max из realm.
+resetPasswordBtn=Сбросить пароль
+strictTransportSecurity=Строгая безопасность транспорта HTTP (HSTS)
+editInfo=Изменить информацию
+offlineSessionMaxLimited=Макс. количество сессий в автономном режиме ограничено
+providerCreateSuccess=Новая клиентская политика успешно создана
+disableSigning=Отключить "{{key}}"
+periodicChangedUsersSync=Периодическая синхронизация изменений пользователей
+searchScope=Поиск области
+dateFrom=Дата(от)
+importAdded_one=Добавлена одна запись.
+clientAccessType=Он использует тип доступа клиента (конфиденциальный, публичный, только для носителя) для определения того, применяется ли политика. Условие проверяется во время большинства запросов OpenID Connect (запросы авторизации, запросы токенов, запросы точки доступа интроспекции и т. д.). Конфиденциальный клиент включил аутентификацию клиента, когда публичный клиент отключил аутентификацию клиента. Только для носителя — устаревший тип клиента.
+firstName=Имя
+emptySecondaryAction=Настройте новое сопоставление
+defaultGroupAdded_one=Новая группа добавлена к группам по умолчанию
+unexpectedError=Произошла непредвиденная ошибка: '{{error}}'
+noRolesInstructions=Вы не назначили ни одной роли этому пользователю. Назначьте роль, чтобы начать.
+authorizationEncryptedResponseEncHelp=Алгоритм JWA, используемый для шифрования содержимого при шифровании ответа авторизации, когда режим ответа — jwt. Этот параметр необходим, если вам нужен зашифрованный ответ авторизации. Если оставить пустым, ответ авторизации будет просто подписан, но не зашифрован.
+permissionName=Имя этого разрешения.
+postBrokerLoginFlowAliasHelp=Псевдоним сценария аутентификации, который запускается после каждого входа с этим поставщиком удостоверений. Полезно, если вы хотите дополнительную проверку каждого пользователя, аутентифицированного с этим поставщиком удостоверений (например, OTP). Оставьте значение "None", если вам не нужно, чтобы какие-либо дополнительные аутентификаторы запускались после входа с этим поставщиком удостоверений. Также обратите внимание, что реализации аутентификаторов должны предполагать, что пользователь уже установлен в ClientSession, поскольку поставщик удостоверений уже установил его.
+preview=Предварительный просмотр
+eventTypes.UNREGISTER_NODE_ERROR.name=Ошибка отмены регистрации узла
+clientRegisterPolicyDeleteConfirmTitle=Удалить политику регистрации клиентов?
+groupDetails=Подробности группы
+sessionsType.allSessions=Все типы сессий
+kid=KID
+sessionsType.serviceAccount=Учетная запись службы
+allowKerberosAuthenticationHelp=Включить/выключить HTTP-аутентификацию пользователей с токенами SPNEGO/Kerberos. Данные об аутентифицированных пользователях будут предоставлены с этого сервера LDAP.
+oauthDeviceAuthorizationGrantHelp=Это обеспечивает поддержку предоставления авторизации устройства OAuth 2.0, что означает, что клиент — это приложение на устройстве, которое имеет ограниченные возможности ввода или не имеет подходящего браузера.
+clientSignatureHelp=Будет ли клиент подписывать свои saml запросы и ответы? И должны ли они быть провалидированы?
+importOverwritten_other={{count}} записей перезаписано.
+requirements.CONDITIONAL=Условно
+leaveGroupConfirmDialog_one=Вы уверены, что хотите удалить {{username}} из группы {{groupname}}?
+kc.client.user_agent=Клиент/Пользовательский агент
+frontendUrl=URL-адрес интерфейса
+permissionDeletedSuccess=Разрешение успешно удалено
+clientScopeRemoveSuccess=Отображение области действия успешно удалено
+addClientScopes=Добавить клиентские области
+doNotStoreUsersHelp=При включении пользователи этого брокера не сохраняются во внутренней базе данных.
+deletePolicyConfirm=Если вы удалите эту политику, это повлияет на некоторые разрешения или агрегированные политики.
+userCreateError=Не удалось создать пользователя: {{error}}
+user-events-cleared=Пользовательские события были очищены
+resetPasswordConfirm=Сбросить пароль?
+emailAsUsernameHelpText=Разрешить пользователям устанавливать адрес электронной почты в качестве имени пользователя.
+AESKeySize=Размер ключа AES
+fullName={{givenName}} {{familyName}}
+deleteConfirm=Вы уверены, что хотите навсегда удалить поставщика '{{provider}}'?
+compositesRemovedAlertDescription=Все связанные роли были удалены
+aliasHelp=Псевдоним уникально идентифицирует поставщика идентификации, а также используется для построения адреса переадресации.
+selectRealm=Выберите realm
+roleNameLdapAttribute=Имя роли Атрибут LDAP
+javaKeystore=java-хранилище ключей
+updatedUserProfileSuccess=Конфигурация профиля пользователя сохранена
+deleteProviderMapper=Удалить сопоставление?
+clientsPermissionsHint=Детализированные разрешения для администраторов, которые хотят управлять этим клиентом или применять роли, определенные этим клиентом.
+lookAroundHelp=Насколько далеко (дополнительные периоды или счетчики токенов) должен заглядывать сервер на случай, если генератор токенов и сервер не синхронизированы по времени или счетчикам?
+usersLeft_one={{count}} пользователь покинул группу
+sync-keycloak-groups-to-ldap=Синхронизация групп Keycloak с LDAP
+saveError=Не удалось сохранить поставщика федерации пользователей: {{error}}
+bruteForceDetection=Обнаружение перебора пароля
+loginTimeoutHelp=Макс. время, которое пользователь имеет для завершения входа. Рекомендуется, чтобы оно было относительно долгим, например, 30 минут или больше.
+eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=Код устройства OAuth2 для токена
+searchGroups=Поиск групп
+trusted-hosts.tooltip=Список хостов, которым доверяют и которым разрешено вызывать службу регистрации клиентов и/или использоваться в качестве значений клиентских URI. Вы можете использовать имена хостов или IP-адреса. Если вы используете звездочку в начале (например, '*.example.com'), то весь домен example.com будет доверенным.
+disableNonceHelp=Не отправляйте параметр nonce в запросе аутентификации. Параметр nonce отправляется и проверяется по умолчанию.
+disableTypeClaimCheckHelp=Отключает проверку клейм `typ` токенов, полученных от поставщика удостоверений. Если это `off`, клейм типа проверяется (по умолчанию).
+deleteClientProfile=Удалить этот профиль клиента
+none=нет
+type=Тип
+createNewUser=Создать нового пользователя
+emptyClientProfiles=Нет профилей
+internationalization=Интернационализация
+seconds=секунд
+memberofLdapAttributeHelp=Используется только когда "User Roles Retrieve Strategy" — GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE. Он указывает имя атрибута LDAP для пользователя LDAP, который содержит группы, членом которых является пользователь. Обычно это будет значение по умолчанию "memberOf".
+clientRegisterPolicyDeleteSuccess=Политика регистрации клиентов успешно удалена
+otpPolicyDigits=Количество цифр
+keysFilter.ACTIVE=Активные ключи
+rsaGenerated=rsa-сгенерированный
+krbPrincipalAttributeHelp=Имя атрибута LDAP, который ссылается на принципала Kerberos. Используется для поиска соответствующего пользователя LDAP после успешной аутентификации Kerberos/SPNEGO в Keycloak. Если это поле пустое, пользователь LDAP будет искаться на основе имени пользователя LDAP, соответствующего первой части его принципала Kerberos. Например, для принципала 'john@KEYCLOAK.ORG' будет предполагаться, что имя пользователя LDAP — 'john'.
+client-roles-condition.tooltip=Роли клиента, которые будут проверены во время оценки этого условия. Условие оценивается как истинное, если у клиента есть хотя бы одна роль клиента с именем, как у ролей клиента, указанных в конфигурации.
+impersonateError=Не удалось выдать себя за пользователя: {{error}}
+keyLabel=Ключ
+syncChangedUsers=Синхронизировать измененных пользователей
+eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=Ошибка ответа поставщика удостоверений
+orderDialogIntro=Порядок, в котором поставщики перечислены на странице входа или в пользовательском интерфейсе учетной записи. Вы можете перемещать маркеры строк, чтобы изменить порядок.
+clientSessionIdle=Клиентская сессия в режиме ожидания
+push=Разослать
+targetClaimHelp=Указывает целевой клейм, которое будет получено политикой.
+periodicFullSyncHelp=Следует ли включать периодическую полную синхронизацию пользователей LDAP с Keycloak
+client-attributes-condition.tooltip=Атрибуты клиента, которые будут проверяться во время оценки этого условия. Условие оценивается как истинное, если у клиента есть все атрибуты клиента с именем и значением, как атрибуты клиента, указанные в конфигурации.
+scopePermissions.users.user-impersonated-description=Политики, которые решают, какие пользователи могут быть выданы за другого человека. Эти политики применяются к пользователю, который выдается за другого человека.
+forceNameIdFormat=Принудительно использовать формат ID
+noMappersInstructions=В настоящее время для этого поставщика удостоверений нет сопоставлений.
+deleteConfirmFlow=Удалить сценарий?
+addRole=Добавить роль
+FAIL=Импорт не удался
+userInfoSignedResponseAlgorithmHelp=JWA алгоритм используется для подписи ответа ресурса информации о пользователе. Если установлено в 'unsigned', то ответ инофрмации о пользователе не будет подписан и будет возвращен в формате application/json.
+lastName=Фамилия
+isAccessTokenJWT=Токен доступа — JWT
+deleteConfirmDialog_one=Вы уверены, что хотите навсегда удалить {{count}} выбранного пользователя
+eventTypes.AUTHREQID_TO_TOKEN.name=Authreqid для токена
+createError=Не удалось создать поставщика удостоверений: {{error}}
+excludeIssuerFromAuthenticationResponseHelp=Если этот параметр включен, параметр 'iss' не будет включен в ответ аутентификации OpenID Connect. Это полезно, если клиент использует старый адаптер OIDC / OAuth2, который не поддерживает параметр 'iss'.
+eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=Ошибка Authreqid для токена
+deletePermissionConfirm=Вы уверены, что хотите удалить разрешение {{permission}}
+TERMS_AND_CONDITIONS=Условия и положения (TERMS_AND_CONDITIONS)
+artifactResolutionServiceHelp=Служба разрешения артефактов SAML для клиента. Это точка доступа, на которую Keycloak отправит сообщение SOAP ArtifactResolve. Вы можете оставить это поле пустым, если у вас нет URL для этой привязки.
+userRoleMappingUpdatedSuccess=Сопоставление ролей пользователей успешно обновлено
+clientUpdaterTrustedHosts=Доверенные Хосты
+deleteSuccess=Группа атрибутов удалена.
+attributesDropdown=Раскрывающийся список атрибутов
+ssoServiceUrlHelp=Url, который должен быть использован для отправленных запросов на аутентификацию (SAML AuthnRequest).
+artifactResolutionServiceUrlHelp=URL-адрес, который необходимо использовать для получения утверждений SAML из артефактов (SAML ArtifactResolve).
+copy=Копировать
+credentialData=Данные
+clientRolesConditionTooltip=Роли клиента, которые будут проверены во время оценки этого условия. Условие оценивается как истинное, если у клиента есть хотя бы одна роль клиента с именем, как у ролей клиента, указанных в конфигурации.
+invalidateSecret=Аннулировать
+emptyPermissionInstructions=Если вы хотите создать разрешение, нажмите кнопку ниже, чтобы создать разрешение на основе ресурсов или области действия.
+webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Избегайте регистрации аутентификатора, который уже зарегистрирован.
+memberofLdapAttribute=Атрибут членства в LDAP
+supportedLocales=Поддерживаемые языки
+invalidLocale=Выбран неверный регион
+showPasswordDataValue=Значение
+webAuthnPolicyAttestationConveyancePreference=Предпочтение при передаче удостоверения
+copyOf=Копия {{name}}
+eventTypes.REMOVE_TOTP.description=Удалить TOTP
+evictionMinute=Минута очистки
+requiredClient=Пожалуйста, добавьте хотя бы одного клиента.
+help=Помощь
+passSubject=Передать субьект
+deleteFlowSuccess=Сценарий успешно удален
+nodeReRegistrationTimeoutHelp=Интервал, означающий максимальное время для узлов кластера зарегистрированных клиентов для их перерегистрации. Если узел кластера не может послать запрос перерегистрации в Keycloak за указанное время, то он будет разрегистрирован из Keycloak.
+rename=Переименовать
+httpPostBindingLogoutHelp=Указывает, следует ли отвечать на запросы с использованием привязки HTTP-POST. Если false, будет использоваться привязка HTTP-REDIRECT.
+policyProvider.client=Определите условия для ваших разрешений, при которых группе из одного или нескольких клиентов разрешен доступ к объекту.
+clientAuthentication=Аутентификация клиента
+validatePasswordPolicy=Проверить политику паролей
+registrationEmailAsUsername=E-mail как имя пользователя
+webAuthnPolicyFormHelp=Политика для аутентификации WebAuthn. Эта политика будет использоваться требуемым действием 'WebAuthn Register' и аутентификатором 'WebAuthn Authenticator'. Типичное использование — когда WebAuthn будет использоваться для двухфакторной аутентификации.
+createResource=Создать ресурс
+data=Данные
+createNewMapper=Создать новое сопоставление
+mapperTypeMsadUserAccountControlManager=msad-user-account-control-mapper
+deleteNodeFail=Не удалось удалить узел: '{{error}}'
+syncModeOverrideHelp=Переопределяет режим синхронизации IDP по умолчанию для этого сопоставления. Значения: 'legacy' для сохранения поведения до введения этой опции, 'import' для импорта пользователя только один раз при первом входе пользователя с этим поставщиком удостоверений, 'force' для постоянного обновления пользователя при каждом входе с этим поставщиком удостоверений и 'inherit' для использования режима синхронизации, определенного в поставщике удостоверений для этого сопоставления.
+eventTypes.TOKEN_EXCHANGE_ERROR.description=Ошибка обмена токеном
+strictTransportSecurityHelp=Заголовок HTTP Strict-Transport-Security сообщает браузерам всегда использовать HTTPS. Как только браузер увидит этот заголовок, он будет посещать сайт только по HTTPS в течение указанного времени (1 год) в max-age, включая поддомены. <1>Узнать больше</1>
+authenticationExplain=Аутентификация — это область, где вы можете настраивать и управлять различными типами учетных данных.
+passwordPoliciesHelp.hashIterations=Количество раз, которое пароляь хэшируется перед сохранением или проверкой. По умолчанию: -1 в случае, если в качестве алгоритма хэширования используется argon2; 210 000 в случае, если в качестве алгоритма хэширования используется pbkdf2-sha512; 600 000, если в качестве алгоритма хэширования используется алгоритм pbkdf2-sha256; 1,300,000, если в качестве алгоритма хэширования используется алгоритм pbkdf2.
+dropNonexistingGroupsDuringSync=Удалять несуществующие группы во время синхронизации
+clientAssertionSigningAlgHelp=Алгоритм подписи для создания утверждения JWT в качестве аутентификации клиента. В случае JWT, подписанного с помощью закрытого ключа, или JWT, подписанного с помощью секретного ключа клиента, он обязателен. Если алгоритм не указан, адаптируется следующий алгоритм. RS256 адаптируется в случае JWT, подписанного с помощью закрытого ключа. HS256 адаптируется в случае JWT, подписанного с помощью секретного ключа клиента.
+jwtX509HeadersEnabledHelp=Если включено, заголовок x5t (X.509 Certificate SHA-1 Thumbprint) будет добавлен в JWT для ссылки на сертификат, используемый для его подписи. В противном случае вместо этого будет использоваться заголовок kid (Key ID).
+addProvider_other=Добавить {{provider}} поставщиков
+resetAction=Сброс действия
+cibaExpiresIn=Истекает через
+dynamicScopeFormatHelp=Это регулярное выражение, которое система будет использовать для извлечения имени области действия и переменной.
+updateTranslationError=Ошибка обновления перевода: {{error}}
+resetPasswordConfirmText=Вы уверены, что хотите сбросить пароль для пользователя {{username}}?
+create=Создать
+noAvailableIdentityProviders=Нет доступных поставщиков удостоверений.
+passSubjectHelp=На этапе входа в систему перенаправьте необязательный параметр запроса login_hint в тему SAML AuthnRequest.
+notBeforeSetToNow=Не раньше, чем установлено для клиента
+notBefore=Не ранее чем
+setToNow=Установить на сейчас
+resource=Ресурс
+emptyConditions=Условия не настроены
+profiles=Профили
+userSession.modelNote.tooltip=Имя процедуры заметки сессии пользователя согласованным с UserSessionModel.note.
+filterByRoles=Фильтр по ролям realm
+maxLifespan=Макс. продолжительность жизни
+host-sending-registration-request-must-match.label=Хост, отправляющий запрос на регистрацию клиента, должен совпадать
+eventTypes.VERIFY_PROFILE_ERROR.description=Ошибка проверки профиля
+webOriginsHelp=Разрешает CORS источникам. Чтобы разрешить всем источники с допустимыми URI-адресами переадресации, добавьте '+'. Чтобы разрешить все источники, добавьте '*'.
+noSessionsForClient=В настоящее время для этого клиента нет активных сессий.
+profilesConfigType=Настроить через:
+enableHelp=Помощь включена
+xRobotsTagHelp=Предотвратить появление страниц в поисковых системах. <1>Узнать больше</1>
+client-updater-source-roles.label=Обновление роли сущности
+clientRegisterPolicyDeleteError=Не удалось удалить политику регистрации клиента: '{{error}}'
+resourceFile=Файл ресурсов
+admin-clearEventsHelp=Удалить все события администратора из базы данных.
+hardcodedRole=При импорте пользователя от провайдера жестко запрограммируйте сопоставление ролей для него.
+searchType.default=Поиск по умолчанию
+keysFilter.DISABLED=Отключенные ключи
+link=Связь
+defaultGroupAddedError=Ошибка добавления группы(групп) в группу по умолчанию {error}
+eventTypes.INVALID_SIGNATURE_ERROR.description=Ошибка неверной подписи
+idpUnlinkSuccess=Ссылка на провайдера удалена
+providerType=Тип провайдера
+clientSessionIdleHelp=Время, в течение которого сессия клиента может простаивать до его истечения. Токены становятся недействительными, когда сессия клиента истекает. Параметр не влияет на глобальная сессия SSO пользователя. Если не задано, используется стандартное значение простоя сессии SSO.
+passwordPoliciesHelp.hashAlgorithm=Применяет алгоритм хеширования к паролям, поэтому они не хранятся в открытом виде.
+scopesSelect=Определяет, что разрешение должно быть применено к одной или нескольким областям.
+selectMethodType.generate=Генерировать
+emailInvalid=Вам необходимо ввести действительный адрес электронной почты.
+chooseAPolicyProvider=Выберите поставщика полиса
+clientAuthenticationHelp=Метод аутентификации клиента (см. https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). В случае JWT, подписанного закрытым ключом, используется закрытый ключ realm.
+kerberosRealmHelp=Имя realm kerberos. Например, FOO.ORG.
+roleCreateError=Не удалось создать роль: {{error}}
+clientSecretHelp=Секретный ключ клиента, зарегистрированный с помощью поставщика идентификации.
+offlineSessionMax=Макс. количество сессий в автономном режиме
+generatedUserInfoHelp=См. пример информации о пользователе, которая будет предоставлена точкой доступа информации о пользователе.
+dynamicScopeFormat=Формат динамической области действия
+webAuthnPolicyExtraOriginsHelp=Список дополнительных источников для не веб-приложений.
+webAuthnPolicyPasskeysEnabledHelp=Включить аутентификацию с помощью паролей (условный пользовательский интерфейс) в формах ввода имени пользователя.
+updatePermissionSuccess=Разрешение успешно обновлено
+idpLinkSuccess=Поставщик удостоверений был связан
+removeAnnotationText=Удалить аннотацию
+verifyEmailHelpText=Требовать от пользователя подтверждения адреса электронной почты после первого входа в систему или после отправки изменений адреса.
+referrerPolicy=Политика реферера
+flow.clients=Процесс аутентификации клиента
+eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=Ошибка первого входа в систему поставщика удостоверений
+groups=Группы
+emptyStateText=В этом realm нет ролей realm. Создайте роль realm, чтобы начать.
+includeSubGroups=Включить пользователей подгруппы
+permanentLockoutHelp=Настраивает, будет ли пользователь временно или постоянно отключен после слишком большого количества неудачных попыток входа. Постоянную блокировку можно настроить так, чтобы она происходила после нескольких неудачных попыток входа или после нескольких временных блокировок.
+logicType.positive=Позитивная
+associatedPolicy=Сопутствующая политика
+accountTheme=Тема учетной записи
+webAuthnPolicyAvoidSameAuthenticatorRegister=Избегайте регистрации одного и того же аутентификатора
+emptyExecutors=Исполнители не настроены
+notBeforeNowClear=Не ранее, чем разрешено для клиента
 selectARole=Выберите роль
 titleAuthentication=Аутентификация
 category=Категория
-batchSize=Размер пачки
-usermodel.prop.tooltip=Имя свойства метода в интерфейсе UserModel. Для примера, значение 'email' будет ссылкой на метод UserModel.getEmail().
-user=Пользователь
+startBySearchingAUser=Начните с поиска пользователей
 times.days=дней
-providers=Поставщики
+selectALocale=Выберите локаль
+transientUser=Временный
+transientUserTooltip=Этот пользователь не хранится в базе данных Keycloak. Он создан исключительно на основе данных, предоставленных исходным поставщиком удостоверений.
+error-empty=Укажите значение '{{0}}'.
+error-invalid-blank=Укажите значение '{{0}}'.
+error-invalid-date="{{0}}" — недопустимая дата.
+error-invalid-email=Неверный адрес электронной почты.
+error-invalid-length-too-long="{{0}}" должен иметь максимальную длину {{2}}.
+error-invalid-length-too-short="{{0}}" должен иметь минимальную длину {{1}}.
+error-invalid-length="{{0}}" должен иметь длину от {{1}} до {{2}}.
+error-invalid-number='{{0}}' — недопустимое число.
+error-invalid-uri-fragment="{{0}}" — недопустимый фрагмент URL.
+error-invalid-uri-scheme="{{0}}" имеет недопустимую схему URL.
+error-invalid-uri='{{0}}' — недействительный URL.
+error-invalid-value='{{0}}' имеет недопустимое значение.
+error-number-out-of-range-too-big="{{0}}" должно иметь максимальное значение {{2}}.
+error-number-out-of-range-too-small='{{0}}' должно иметь минимальное значение {{1}}.
+error-number-out-of-range='{{0}}' должно быть числом от {{1}} до {{2}}.
+error-pattern-no-match="{{0}}" не соответствует требуемому формату.
+error-person-name-invalid-character='{{0}}' содержит недопустимый символ.
+error-user-attribute-required=Пожалуйста, укажите '{{0}}'.
+error-username-invalid-character='{{0}}' содержит недопустимый символ.
+error-user-attribute-read-only=Поле {{0}} доступно только для чтения.
+missingUsernameMessage='{{0}}': Укажите имя пользователя.
+missingFirstNameMessage='{{0}}': Укажите имя.
+invalidEmailMessage='{{0}}': Неверный адрес электронной почты.
+missingLastNameMessage='{{0}}': Укажите фамилию.
+missingEmailMessage='{{0}}': Укажите адрес электронной почты.
+missingPasswordMessage='{{0}}': Укажите пароль.
+updateReadOnlyAttributesRejectedMessage=Обновление атрибута "только для чтения" отклонено
+locales=Локали
+realmOverrides=Переопределение realm
+realmOverridesHelp=Вы можете редактировать только поддерживаемые локали. Если вы еще не выбрали поддерживаемую локаль, вы можете редактировать только английскую локаль.
+effectiveMessageBundles=Эффективные пакеты сообщений
+effectiveMessageBundlesHelp=Вы можете искать эффективные пакеты сообщений по темам, функциям, языку и свободному тексту.
+deleteMessageBundle=Удалить пакет сообщений {{key}}
+deleteAllTranslationsSuccess=Перевод(ы) успешно удалены.
+deleteAllTranslationsError=Ошибка удаления перевода(ов), {{error}}
+noRealmOverridesSearchResultsInstructions=Нажмите на строку поиска выше, чтобы найти переопределения realm
+emptyEffectiveMessageBundles=Поиск эффективных сообщений
+emptyEffectiveMessageBundlesInstructions=Вы можете искать нужные вам эффективные сообщения по теме, функции и языку в строке поиска выше.
+searchForEffectiveMessageBundles=Поиск пакета сообщений
+selectAll=Выбрать все
+theme=Тема
+themeType=Тип темы
+language=Язык
+hasWords=Имеет слова
+deleteConfirmTranslationTitle=Удалить перевод(ы)?
+translationDeleteConfirmDialog=Вы уверены, что хотите навсегда удалить {{count}} выбранных переводов?
+selectTheme=Выберите тему
+selectThemeType=Выберите тип темы
+selectLanguage=Выберите язык
+referral=Реферрер
+referralHelp=Указывает, следует ли следовать или игнорировать ссылки LDAP. Обратите внимание, что включение ссылок может замедлить аутентификацию, поскольку позволяет серверу LDAP решать, какие другие серверы LDAP использовать. Это может потенциально включать ненадежные серверы.
+authenticatorRefConfig.value.help=Добавьте пользовательское имя ссылки для аутентификатора. Когда этот аутентификатор успешно завершен во время сценария аутентификации, сопоставление протокола Authentication Method Reference (AMR) будет использовать это значение для заполнения клейма amr сгенерированных токенов. Обратите внимание, что протокол AMR должен быть настроен для данного клиента для заполнения клейма AMR.
+authenticatorRefConfig.value.label=Ссылка на аутентификатор
+authenticatorRefConfig.maxAge.help=Макс. возраст в секундах, в течение которого значение ссылки аутентификатора действительно в сессии SSO. При использовании сопоставления протокола Authentication Method Reference (AMR) AMR будет считаться действительным и заполняться в токене только в том случае, если выполнение аутентификатора было завершено в течение указанного максимального возраста.
+authenticatorRefConfig.maxAge.label=Макс. возраст ссылки аутентификатора
+loa-condition-level=Уровень аутентификации (LoA)
+loa-condition-level.tooltip=Уровень аутентификации. Это значение всегда должно быть целым числом, большим или равным 0. Подсценарии в сценарии аутентификации всегда должны быть упорядочены от низших уровней к более высоким.
+loa-max-age=Макс. возраст
+loa-max-age.tooltip=Макс. возраст в секундах для этого уровня аутентификации, чтобы быть действительным. Если запрашивается определенный уровень, и пользователь уже прошел аутентификацию с этим уровнем ранее, чем указанное количество секунд назад, ему не будет предложено пройти повторную аутентификацию. Но если он прошел аутентификацию позднее, чем указанное количество секунд назад, ему нужно будет пройти повторную аутентификацию с этим уровнем снова. Значение 0 в конфигурации означает, что пользователю всегда требуется проходить повторную аутентификацию с этим уровнем всякий раз, когда этот уровень запрашивается.
+includeInLightweight.label=Добавить к облегченному токену доступа
+includeInLightweight.tooltip=Следует ли добавлять клейм к облегченному токену доступа?
+lightweightAccessToken=Всегда используйте легкий токен доступа
+lightweightAccessTokenHelp=Если он включен, всегда используются легкие токены доступа. Если он выключен, они не используются по умолчанию, но их все еще можно включить с помощью client policy executor.
+supportJwtClaimInIntrospectionResponse=Поддержка JWT клейма в ответе интроспекции
+supportJwtClaimInIntrospectionResponseHelp=Если он включен, запросы на интроспекцию, использующие заголовок "Accept: application/jwt", также будут содержать клейм с именем "jwt" с клеймом результата интроспекции, закодированными как токен доступа JWT.
+welcomeTabTitle=Добро пожаловать
+welcomeTo=Добро пожаловать в {{realmDisplayInfo}}
+welcomeText=Keycloak обеспечивает федерацию пользователей, строгую аутентификацию, управление пользователями, детальную авторизацию и многое другое. Добавьте аутентификацию в приложения и безопасные сервисы с минимальными усилиями. Не нужно заниматься хранением пользователей или аутентификацией пользователей.
+viewDocumentation=См. документацию
+viewGuides=Посмотреть руководства
+joinCommunity=Присоединяйтесь к сообществу
+readBlog=Читать блог
+customValue=Пользовательское значение
+termsAndConditionsUserAttribute=Принятые положения и условия, временная метка
+realmOverridesDescription=Переопределения realm позволяют вам указать переводы, которые будут действовать для всего realm. Эти переводы переопределят любой перевод, указанный темой.
+addTranslation=Добавить перевод
+effectiveMessageBundlesDescription=Эффективный пакет сообщений — это набор переводов для заданного языка, темы и типа темы. Он также учитывает любые переопределения realm, которые будут иметь приоритет.
+clientsClientScopesHelp=Области, ассоциироваанные с этим ресурсом.
+searchItem=Поиск элемента
+createItem=Создать элемент
+itemDelete=Удалить элемент
+itemDeleteConfirm=Вы уверены, что хотите навсегда удалить элемент?
+itemDeleteConfirmTitle=Удалить элемент?
+itemDeletedSuccess=Элемент был удален
+itemDeleteError=Не удалось удалить элемент: {{error}}
+noItems=Нет элементов
+noItemsInstructions=Вы не создали ни одного элемента в этом realm. Создайте элемент, чтобы начать.
+itemSaveError=Ошибка: не удалось сохранить элемент! {{error}}
+itemSaveSuccessful=Сохранено успешно
+realmSelector=Селектор realm
+editTranslationValue=Изменить значение перевода
+selectAccessTokenSignatureAlgorithm=Выберите алгоритм подписи токена доступа
+selectIdTokenSignatureAlgorithm=Выберите алгоритм подписи токена Id
+selectIdTokenEncryptionKeyManagementAlgorithm=Выберите алгоритм управления ключами шифрования токена Id
+selectIdTokenEncryptionContentEncryptionAlgorithm=Выберите алгоритм шифрования содержимого токена идентификатора
+selectUserInfoSignedResponseAlgorithm=Выберите алгоритм ответа с подписью информации пользователя
+selectUserInfoResponseEncryptionKeyManagementAlgorithm=Выберите алгоритм управления ключами шифрования ответа на информацию о пользователе
+selectUserInfoResponseEncryptionContentEncryptionAlgorithm=Выберите алгоритм шифрования содержимого ответа информации пользователя
+selectRequestObjectSignatureAlgorithm=Выберите алгоритм подписи объекта запроса
+selectRequestObjectEncryption=Выберите запрос на шифрование объекта
+selectRequestObjectEncoding=Выберите кодировку объекта запроса
+selectRequestObjectRequired=Выберите требуемый объект запроса
+selectAuthorizationSignedResponseAlgorithm=Выберите алгоритм ответа с подписью авторизации
+selectAuthorizationEncryptedResponseAlg=Выберите алгоритм зашифрованного ответа авторизации
+selectAuthorizationEncryptedResponseEnc=Выберите зашифрованный ответ авторизации enc
+generatedCodeTextArea=Сгенерированный код текстовой области
+selectAuthScopes=Выберите области авторизации
+selectResource=Выберите ресурс
+selectClients=Выбрать клиентов
+selectLoginTheme=Выберите тему входа
+selectAccountTheme=Выберите тему аккаунта
+selectAdminTheme=Выберите тему администратора
+selectEmailTheme=Выберите тему письма
+selectFilterType=Выберите тип фильтра
+selectUnmanagedAttributePolicy=Выберите политику неуправляемых атрибутов
+selectEventsListeners=Выберите слушателей событий
+selectCachePolicy=Выберите политику кэширования
+selectEvictionDay=Выберите день очистки
+selectEvictionHour=Выберите час очистки
+selectEvictionMinute=Выберите минуту очистки
+selectEditMode=Выберите режим редактирования
+emptySelection=Пустой выбор
+readOnlySelection=Только для чтения
+writableSelection=Выбор для записи
+unsyncedSelection=Несинхронизированный выбор
+selectMapperType=Выберите тип сопоставления
+editBtn=Кнопка "Изменить"
+acceptBtn=Кнопка "Принять редактирование"
+cancelBtn=Кнопка отмены редактирования
+chooseBindingType=Выберите тип переплета
+selectFlowType=Выберите тип сценария
+selectClientAssertionSigningAlg=Выберите алгоритм подписи клиентского утверждения
+resourceDetailsTypeHelp=Тип этого ресурса. Может использоваться для группировки различных экземпляров ресурсов с одинаковым типом.
+selectVendor=Выбрать поставщика
+spinnerLoading=Загрузка
+enableClientSignatureRequiredModal=Требуется включить подпись клиента
+selectBindType=Выберите тип привязки
+searchClientAuthorizationResource=Поиск ресурса
+searchClientAuthorizationPolicy=Политика поиска
+searchClientAuthorizationPermission=Разрешение на поиск
+userNotSaved=Пользователь не был сохранен: {{error}}
+kcNumberFormat=Формат числа
+kcNumberUnFormat=Номер неформатирован
+tokenExpirationHelp=Устанавливает срок действия токенов. Просроченные токены периодически удаляются из базы данных.
+bruteForceMode.Disabled=Отключено
+bruteForceMode.PermanentLockout=Блокировка навсегда
+bruteForceMode.TemporaryLockout=Временная блокировка
+bruteForceMode.PermanentAfterTemporaryLockout=Постоянная блокировка после временной блокировки
+bruteForceMode=Режим защиты от перебора
+error-invalid-multivalued-size=Атрибут {{0}} должен иметь не менее {{1}} и не более {{2}} значений.
+multivalued=Многозначный
+multivaluedHelp=Если этот атрибут поддерживает несколько значений. Эта настройка является индикатором и не включает какую-либо проверку.
+sendIdTokenOnLogout=Отправлять "id_token_hint" в запросах на выход из системы
+sendIdTokenOnLogoutHelp=Следует ли отправлять параметр "id_token_hint" в запросах на выход из системы.
+sendClientIdOnLogout=Отправлять "client_id" в запросах на выход из системы
+sendClientIdOnLogoutHelp=Следует ли отправлять параметр "client_id" в запросах на выход из системы.
+addAttributeTranslationBtn=Добавить кнопку перевода
+addAttributeTranslationInfo=Добавьте переводы для этого поля, используя значок рядом с полем "{{fieldName}}".
+addAttributeTranslation=Добавить перевод для поля "{{fieldName}}"
+addAttributeDisplayDescriptionTranslation=Добавить перевод для описания дисплея
+addTranslationsModalTitle=Добавить переводы
+addTranslationsModalSubTitle=Вы можете перевести "{{fieldName}}" на основе вашей локали или предпочитаемых языков. Кроме того, вы также можете создавать или редактировать переводы "{{fieldName}}" в <1>Настройки realm > Локализация > Переопределения realm.</1>
+translationKey=Ключ
+translationsTableHeading=Переводы
+searchForLanguage=Поиск языка
+supportedLanguagesTableColumnName=Поддерживаемые языки
+translationTableColumnName=Перевод
+defaultLanguage=По умолчанию
+translationValue=Значение перевода
+noLanguages=Нет языков
+noLanguagesInstructions=Чтобы начать, добавьте язык в настройках Realm > Локализация > Локали.
+addTranslationsDialogRowsTable=Добавить таблицу строк диалога переводов
+addTranslationDialogHelperText=Требуется перевод на язык по умолчанию.
+noLanguagesSearchResultsInstructions=Нажмите на строку поиска выше, чтобы выполнить поиск по языкам
+addTranslationDialogOkBtn=Хорошо
+translationError=Пожалуйста, добавьте переводы перед сохранением: {{error}}
+fetchRoles=Извлечь роли
+fetchRolesHelp=По умолчанию для проверки того, предоставлена ли пользователю роль, используются только роли, доступные из токена, отправленного с запросами на авторизацию. Если этот параметр включен, политика будет игнорировать роли из токена и вместо этого проверять любую роль, связанную с пользователем.
+emptyAdminEvents=Нет административных событий
+emptyAdminEventsInstructions=В этом realm нет административных событий.
+emptyUserEvents=Нет пользовательских событий
+emptyUserEventsInstructions=В этом realm нет пользовательских событий.
+smtpFromPlaceholder=Адрес электронной почты отправителя
+smtpFromDisplayPlaceholder=Отображаемое имя для адреса электронной почты отправителя
+replyToEmailPlaceholder=Ответить на адрес электронной почты
+replyToDisplayPlaceholder=Отображаемое имя для адреса электронной почты "ответить"
+senderEnvelopePlaceholder=Адрес электронной почты отправителя конверта
+smtpPortPlaceholder=Порт SMTP (по умолчанию 25)
+loginUsernamePlaceholder=Имя пользователя для входа
+ownerHelp=Владелец этого ресурса.
+parRequestUriLifespan=Время жизни URI запроса для отправленного запроса авторизации
+parRequestUriLifespanHelp=Число, представляющее время жизни URI запроса. Значение по умолчанию — 1 минута.
+identityBrokeringLink=Ссылка на брокерскую идентификацию
+searchClientRegistration=Поиск политики
+importFileHelp=Файл для импорта ключа
+logo=Логотип
+avatarImage=Изображение аватара
+eventTypes.INVITE_ORG.name=Пригласить пользователя в организацию
+eventTypes.INVITE_ORG.description=Пригласить пользователя в организацию
+eventTypes.INVITE_ORG_ERROR.name=Ошибка приглашения пользователя в организацию
+eventTypes.INVITE_ORG_ERROR.description=Ошибка приглашения пользователя в организацию
+organizationsEnabled=Организации
+organizationsEnabledHelp=Если включено, позволяет управлять организациями. В противном случае существующие организации сохраняются, но вы больше не сможете ими управлять или аутентифицировать их участников.
+adminPermissionsEnabled=Разрешения администратора
+adminPermissionsEnabledHelp=Если включено, позволяет управлять правами администратора в realm.
+verifiableCredentialsEnabled=Проверяемые учетные данные
+verifiableCredentialsEnabledHelp=Если этот параметр включен, он позволяет управлять проверяемыми учетными данными в этом realm.
+organizations=Организации
+organizationDetails=Подробности организации
+organizationsList=Организации
+caseSensitiveOriginalUsername=Имя пользователя чувствительно к регистру
+caseSensitiveOriginalUsernameHelp=Если включено, исходное имя пользователя от поставщика удостоверений сохраняется как есть при объединении пользователей. В противном случае имя пользователя от поставщика удостоверений будет в нижнем регистре и может не совпадать с исходным значением, если оно чувствительно к регистру. Этот параметр влияет только на имя пользователя, связанное с объединенным удостоверением, поскольку имена пользователей на сервере всегда в нижнем регистре.
+organizationsExplain=Управляйте своими организациями и участниками.
+emptyOrganizations=Нет организаций
+emptyOrganizationsInstructions=Пока нет организации. Создайте организацию и управляйте ею.
+searchOrganization=Поиск организации
+domains=Домены
+organizationDelete=Удалить организацию?
+organizationDeleteConfirm=Вы уверены, что хотите навсегда удалить эту организацию? Если да, то все данные этой организации будут удалены.
+organizationDeletedSuccess=Организация была удалена
+orgainzatinoDeleteError=Не удалось удалить клиента: {{error}}
+createOrganization=Создать организацию
+domain=Домен
+organizationDomainHelp=Набор из одного или нескольких интернет-доменов, связанных с организацией. Домен используется для сопоставления пользователей с организацией на основе их домена электронной почты и для их соответствующей аутентификации в рамках организации.
+addDomain=Добавить домен
+organizationAliasHelp=Псевдоним однозначно идентифицирует организацию, используя формат, который в основном предназначен для внутреннего обозначения организации. Например, при выдаче клеймов, связанных с организацией, в токены или в пользовательской теме.
+organizationRedirectUrlHelp=Автоматически перенаправлять пользователя после завершения регистрации или принятия приглашения в организацию. Если оставить пустым, пользователь будет перенаправлен в консоль учетной записи по умолчанию.
+redirectUrl=URL-адрес перенаправления
+disableConfirmOrganizationTitle=Отключить организацию?
+disableConfirmOrganization=Вы уверены, что хотите отключить эту организацию?
+memberList=Список участников
+searchMember=Поиск участника
+addRealmUser=Добавить пользователя realm
+inviteMember=Пригласить участника
+removeMember=Удалить участника
+organizationSaveSuccess=Организация успешно сохранена.
+organizationSaveError=Не удалось сохранить организацию: {{error}}
+emptyMembers=Нет участников
+emptyMembersInstructions=Пока нет участников. Пожалуйста, добавьте их в эту организацию
+organizationUsersAdded_one={{count}} пользователь добавлен в организацию
+organizationUsersAddedError=Не удалось добавить пользователей в организацию: {{error}}
+organizationUsersAdded_other={{count}} пользователей добавлено в организацию
+organizationUsersLeftError=Не удалось удалить пользователей из организации: {{error}}
+organizationUsersLeft_one=Пользователь покинул организацию
+organizationUsersLeft_other={{count}} пользователей покинули организацию
+inviteSent=Приглашение отправлено.
+inviteSentError=Не удалось отправить приглашение: {{error}}
+noIdentityProvider=В этом realm нет поставщиков удостоверений
+noIdentityProviderInstructions=В этом realm пока нет поставщиков удостоверений. Если вы хотите связать поставщика удостоверений с этой организацией, перейдите в раздел "Поставщики удостоверений" на левой панели навигации и создайте поставщика удостоверений
+linkIdentityProvider=Поставщик идентификации ссылок
+unLinkIdentityProvider=Отключить провайдера
+emptyIdentityProviderLink=В этой организации нет поставщика удостоверений
+emptyIdentityProviderLinkInstructions=В этой организации пока нет поставщика удостоверений. Пожалуйста, свяжите поставщика удостоверений с этой организацией.
+searchProvider=Поиск поставщика
+selectIdentityProvider=Выберите поставщика удостоверений
+shownOnLoginPage=Показано на странице входа
+shownOnLoginPageHelp=Если этот флажок установлен, этот поставщик удостоверений отображается на странице входа.
+linkSuccessful=Поставщик удостоверений успешно связан с организацией
+linkError=Не удалось связать поставщика удостоверений с организацией: {{error}}
+unLinkSuccessful=Поставщик удостоверений был отключен
+unlinkError=Не удалось отвязать поставщика удостоверений от организации: {{error}}
+linkUpdatedSuccessful=Ссылка на поставщика удостоверений успешно обновлена
+linkUpdateError=Не удалось обновить ссылку на поставщика удостоверений: {{error}}
+noResultsFound=Результаты не найдены
+linkedOrganization=Связанная организация
+organization=Организация
+send=Отправить
+redirectWhenEmailMatches=Перенаправление при совпадении домена электронной почты
+redirectWhenEmailMatchesHelp=Автоматически перенаправлять пользователя к этому поставщику удостоверений, если домен электронной почты совпадает с доменом
+emailVerificationHelp=Независимый тайм-аут для проверки электронной почты
+idpAccountEmailVerificationHelp=Независимый тайм-аут для проверки электронной почты учетной записи IdP
+forgotPasswordHelp=Независимый тайм-аут для забытого пароля
+executeActionsHelp=Независимый тайм-аут для выполнения действий
+validatingX509CertsHelp=Сертификат в формате PEM, который должен быть использован для проверки подписи.
+emptyUserOrganizations=Нет организаций
+emptyUserOrganizationsInstructions=Пока нет организации. Пожалуйста, присоединитесь к организации или отправьте приглашение присоединиться к организации.
+joinOrganization=Присоединяйтесь к организации
+sendInvite=Отправить приглашение
+sendInvitation=Отправить приглашение
+removeConfirmOrganizationTitle=Удалить организацию?
+organizationRemoveConfirm_one=Вы уверены, что хотите удалить пользователя из выбранной организации?
+organizationRemoveConfirm_other=Вы уверены, что хотите удалить пользователя из {{count}} выбранных организаций?
+organizationRemovedSuccess=Пользователь удален из организаций
+organizationRemoveError=Не удалось удалить пользователя из организаций: {{error}}
+organizationName=Название организации
+userAddedOrganization_one=Организация добавлена к пользователю
+userAddedOrganizationError=Не удалось добавить организации к пользователю: {{error}}
+userAddedOrganization_other={{count}} организаций добавлено к пользователю
+userInvitedOrganization_one=Приглашение пользователю отправлено
+userInvitedOrganizationError=Не удалось пригласить пользователя в организации: {{error}}
+userInvitedOrganization_other={{count}} приглашений пользователям отправлено
+sentInvitation=Приглашение отправлено
+loggedInAsTempAdminUser=Вы вошли в систему как временный администратор. Чтобы усилить безопасность, создайте постоянную учетную запись администратора и удалите временную.
+temporaryAdmin=Временная учетная запись администратора. Убедитесь, что она заменена постоянной учетной записью администратора как можно скорее.
+temporaryService=Временная учетная запись администратора службы. Убедитесь, что она заменена постоянной учетной записью администратора службы как можно скорее.
+addOrganizationAttributes.label=Добавить атрибуты организации
+addOrganizationAttributes.help=Если эта функция включена, атрибуты организации будут доступны для каждой организации, сопоставленной с токеном.
+addOrganizationId.label=Добавить идентификатор организации
+addOrganizationId.help=Если эта функция включена, идентификатор организации будет доступен для каждой организации, сопоставленной с токеном.
+identityProviderUnlink=Отключить поставщика удостоверений?
+identityProviderUnlinkConfirm=Вы уверены, что хотите отключить этого поставщика удостоверений?
+disableConfirmUserTitle=Отключить пользователя?
+disableConfirmUser=Вы уверены, что хотите отключить этого пользователя?
+eventTypes.UPDATE_CREDENTIAL.name=Обновить учетные данные
+eventTypes.UPDATE_CREDENTIAL.description=Обновить учетные данные
+eventTypes.UPDATE_CREDENTIAL_ERROR.name=Ошибка обновления учетных данных
+eventTypes.UPDATE_CREDENTIAL_ERROR.description=Ошибка обновления учетных данных
+eventTypes.REMOVE_CREDENTIAL.name=Удалить учетные данные
+eventTypes.REMOVE_CREDENTIAL.description=Удалить учетные данные
+eventTypes.REMOVE_CREDENTIAL_ERROR.name=Удалить ошибку учетных данных
+eventTypes.REMOVE_CREDENTIAL_ERROR.description=Удалить ошибку учетных данных
+groupDuplicated=Группа дублируется
+duplicateAGroup=Дублирующая группа
+couldNotFetchClientRoleMappings=Не удалось получить сопоставления ролей клиента: {{error}}
+duplicateGroupWarning=Дублирование групп с большим количеством подгрупп не поддерживается. Убедитесь, что дублируемая группа не имеет большого количества подгрупп.
+darkModeEnabled=Темный режим
+darkModeEnabledHelp=Если включено, то темный вариант темы применяется на основе предпочтений пользователя через настройку операционной системы (светлый или темный режим) или настройку агента пользователя. Если отключено, то используется только светлый вариант. Этот параметр применяется только к темам, которые поддерживают темные и светлые варианты. Если тема не поддерживает эту функцию, этот параметр не имеет никакого эффекта.
+showMemberships=Показать членство
+showMembershipsTitle={{username}} Членство в группах
+noGroupMembershipsText=Этот пользователь не является членом ни одной группы.
+noGroupMemberships=Нет членства
+termsAndConditionsDeclined=Чтобы продолжить, вам необходимо принять Условия и положения
+somethingWentWrong=Что-то пошло не так
+somethingWentWrongDescription=Извините, произошла непредвиденная ошибка.
+tryAgain=Попробуйте еще раз
+errorSavingTranslations=Ошибка сохранения переводов: '{{error}}'
+clearCachesTitle=Очистить кэши
+realmCache=Кэш realm
+userCache=Кэш пользователя
+keysCache=Кэш ключей
+crlCache=Кэш CRL
+clearButtonTitle=Очистить
+clearRealmCacheHelp=Это очистит записи для всех realm.
+clearUserCacheHelp=Это очистит записи для всех realm.
+clearKeysCacheHelp=Очищает все записи из кэша внешних открытых ключей. Это ключи внешних клиентов или поставщиков удостоверений. Это очистит все записи для всех realm.
+clearCrlCacheHelp=Очищает все записи из кэша CRL. Кэш CRL повышает производительность аутентификатора X.509, когда включены списки отзыва сертификатов (CRL). Это действие очистит все записи CRL для всех realm.
+clearCacheSuccess=Кэш успешно очищен
+clearCacheError=Не удалось очистить кэш: {{error}}
+expandRow=Развернуть строку
+membershipType=Тип членства
+managedMembership=Управляемое членство
+filterByMembershipType=Фильтр по типу членства
+organizationsMembersListError=Не удалось получить членов организации: {{error}}
+MANAGED=Управляемый
+UNMANAGED=Неуправляемый
+deleteConfirmUsers_one=Удалить пользователя {{name}}?
+deleteConfirmUsers_other=Удалить {{count}} пользователей?
+downloadThemeJar=Скачать тему JAR
+uploadGeneratedThemeJar=Загрузить созданную тему JAR
+themeColorInfo=Здесь вы можете задать переменные цвета patternfly и создать файл "jar темы", который вы можете загрузить и поместить в папку поставщика, чтобы применить тему к своему realm.
+permissionsSubTitle=Разрешения контролируют доступ к ресурсу или нескольким ресурсам одного типа.
+signatureAlgorithmIdentityProviderMetadata=Алгоритм подписи SAML метаданные IdP
+signatureAlgorithmIdentityProviderMetadataHelp=Алгоритм подписи, используемый для метаданных поставщика удостоверений SAML. Если таковой отсутствует, метаданные не подписываются.
+connectionTrace=Трассировка соединения
+connectionTraceHelp=Если включено, входящие и исходящие пакеты LDAP ASN.1 BER будут сбрасываться в поток вывода ошибок. Будьте осторожны при включении этой опции в производстве, так как она раскроет все данные, отправленные на сервер LDAP и с него.
+savingUserEventsOff=Сохранение пользовательских событий отключено
+savingAdminEventsOff=Сохранение событий администратора отключено
+membershipEvents=События для членов
+childGroupEvents=Дочерние групповые события
+titlePermissions=Разрешения
+emptyPermissionsInstructions=В этом realm не существует разрешений.
+permissionsName=Имя разрешения
+permissionsAssignedPolicy=Назначенная политика
+chooseAResourceType=Выберите тип ресурса
+chooseAResourceTypeInstructions=Выберите тип ресурса, для которого вы создадите разрешение.
+resourceType.Clients=Управляет доступом к операциям, которые могут быть выполнены для клиентов в этом realm
+resourceType.Groups=Управляет доступом к операциям, которые могут быть выполнены для групп в этом realm
+resourceType.IdentityProviders=Управляет доступом к операциям, которые могут быть выполнены для поставщиков удостоверений в этом realm
+resourceType.Organizations=Контролирует доступ к операциям, которые могут быть выполнены для организаций в этом realm
+resourceType.Roles=Управляет доступом к операциям, которые могут быть выполнены для ролей в этом realm
+resourceType.Users=Управляет доступом к операциям, которые могут выполняться пользователями в этом realm
+createPermissionOfType=Это разрешение будет применено к {{resourceType}}
+permissionUsersHelpText=Указывает, каким пользователям разрешено это разрешение.
+permissionNameHelpText=Имя разрешения. Это имя используется для идентификации разрешения в консоли администратора.
+resourceScope=Область применения ресурса
+resourceScopeHelpText=Указывает область действия ресурса. Используется для определения типа ресурса, которому предоставляется разрешение.
+allClients=Все клиенты
+specificClients=Конкретные клиенты
+allResourceType=Все {{resourceType}}
+specificResourceType=Конкретный {{resourceType}}
+assignedPolicies=Назначенные политики
+assignExistingPolicies=Назначить существующие политики
+requiredPolicies=Пожалуйста, добавьте хотя бы одну политику.
+createNewPolicy=Создать новую политику
+policy=Политика
+policyType=Тип политики
+policyTypeHelpText=Указывает тип политики. Используется для определения типа политики, которой предоставляется разрешение.
+emptyAssignExistingPolicies=Нет существующих политик
+emptyAssignExistingPoliciesInstructions=Нет существующих политик для назначения
+authorizationScope=Область действия авторизации
+adminPermissionName=Имя разрешения
+noAssignedPolicies=Нет назначенных политик
+noAssignedPoliciesInstructions=Для этого разрешения не назначены политики
+unAssignPolicy=Отменить назначение
+assignedPolicyType.allTypes=Все типы
+assignedPolicyType.user=Пользователь
+authorizationScopeDetailsTitle=Подробности области действия авторизации
+authorizationScopeDetailsSubtitle=Область авторизации определяет действия, которые можно выполнять над ресурсом.
+authorizationScopeDetailsName=Имя
+authorizationScopeDetailsDescription=Описание
+allResources=Все ресурсы
+currentRealm=Текущий realm
+recentlyUsed=Недавно использовано
+viewAll=Просмотреть все
+currentRealmExplain=Этот realm выбран
+removeInvalidUsers=Удалить недействительных пользователей во время поиска
+removeInvalidUsersHelp=Удалять пользователей из локальной базы данных, если они недоступны из хранилища пользователей при выполнении поиска. Если это правда, то пользователи, которые больше не доступны из соответствующего хранилища пользователей, будут удаляться из локальной базы данных при каждой попытке поиска пользователей. Если ложь, то пользователи, ранее импортированные из хранилища пользователей, будут храниться в локальной базе данных как доступные только для чтения и отключенные, даже если этот пользователь больше не доступен из хранилища пользователей. Например, пользователь был удален напрямую из LDAP или `Users DN` недействителен. Обратите внимание, что это поведение будет происходить только в том случае, если пользователь еще не кэширован.
+createPermissionPolicy=Создать политику
+enforceAccessTo=Обеспечить доступ к
+enforceAccessToHelpText=Указывает ресурс, к которому применяется разрешение.
+emptyPermissionPoliciesInstructions=В этом realm не существует никакой политики.
+noPermissionSearchResultsInstructions=Нет разрешений, соответствующих вашим фильтрам.
+deleteAdminPermissionConfirm=Если удалить разрешение {{ permission }}, администраторы не смогут выполнять действия с ресурсами, которые были определены разрешением.
+authorizationScope.Clients.configure=Осуществляет базовое управление клиентом
+authorizationScope.Clients.manage=Полностью управляет клиентом
+authorizationScope.Clients.map-roles=Сопоставьте роли, определенные этим клиентом, с ресурсами, такими как пользователи и группы
+authorizationScope.Clients.map-roles-client-scope=Применяет роли, определенные этим клиентом, к области действия другого клиента
+authorizationScope.Clients.map-roles-composite=Применяет роли, определенные этим клиентом как составные, к другой роли
+authorizationScope.Clients.token-exchange=Контролирует, какие клиенты могут обменять токены на токен, предназначенный для этого клиента
+authorizationScope.Clients.view=Просмотры этого клиента
+authorizationScope.Users.impersonate=Выдает себя за других пользователей
+authorizationScope.Users.manage=Управляет всеми пользователями в realm
+authorizationScope.Users.manage-group-membership=Управляет членством в группе для всех пользователей в realm (используется совместно с групповой политикой)
+authorizationScope.Users.map-roles=Карты ролей для всех пользователей
+authorizationScope.Users.view=Просмотр всех пользователей в realm
+authorizationScope.Groups.manage=Управляет этой группой
+authorizationScope.Groups.manage-members=Управляет членами группы
+authorizationScope.Groups.manage-membership=Добавляет или удаляет участников группы
+authorizationScope.Groups.view=Просмотры этой группы
+authorizationScope.Groups.view-members=Просмотры участников группы
+authorizationScope.IdentityProviders.token-exchange=Позволяет клиентам обменивать токены на токены, выпущенные этим поставщиком удостоверений
+authorizationScope.Roles.map-role-client-scope=Применяет эту роль к области действия клиента
+authorizationScope.Roles.map-role-composite=Применяет эту роль как составную к другой роли
+authorizationScope.Roles.map-role=Сопоставляет эту роль с пользователем или группой
+usersResources=Пользователи
+clientsResources=Клиенты
+groupsResources=Группы
+resourceTypeHelpText=Указывает, какие {{resourceType}} разрешены этим разрешением. Если оставить пустым, это то же самое, что выбрать все.
+evaluation=Оценка
+addSubFlowTo=Добавить подсценарий к {{name}}
+addExecutionTo=Добавить исполнение к {{name}}
+addConditionTo=Добавить условие к {{name}}
+targetAudience=Целевая аудитория
+targetAudienceHelp=Настройте целевую аудиторию. Это будет то же самое, что использовать параметр 'audience' в запросе на предоставление токена точки доступа. Обратите внимание, что параметр 'audience' доступен только для предоставления токена-обмена в данный момент. Чтобы смоделировать любой другой доступ или смоделировать предоставление токена-обмена без параметра 'audience', рекомендуется оставить этот параметр пустым.
+targetAudiencePlaceHolder=Выберите целевую аудиторию для обмена токенами
+permissionsEvaluationInstructions=Выберите пользователя, чтобы проверить, имеет ли пользователь определенный доступ к указанному ресурсу. После нажатия кнопки "Оценить" ниже результат будет отображен на правой панели.
+permissionEvaluationPreview=Предварительный просмотр оценки разрешения
+noPermissionsEvaluationResults=Нет оценки
+noPermissionsEvaluationResultsInstructions=Пожалуйста, настройте оценку разрешений слева
+authScope=Область действия авторизации
+authScopeSelectHelp=Выберите область авторизации, которая будет использоваться для запроса разрешений с сервера.
+resourceTypeSelectHelp=Выберите тип ресурса, который будет использоваться для запроса разрешений с сервера.
+grantedScope=Предоставленная область применения:
+deniedScope=Отказано в области применения:
+evaluatedPolicy={{name}} проголосовал за {{status}}
+permissionEvaluationAlertTitle=Выбранный пользователь не имеет доступа к выбранному ресурсу(ам)
+deleteConfirmRealm_one=Удалить realm {{name}}?
+deleteConfirmRealm_other=Удалить {{count}} realm?
+recentRealms=Недавний realm
+manageRealms=Управление realm
+cantDeleteMasterRealm=Вы не можете удалить главный realm!
+selectRole=Выберите роль
+selectUsers=Выберите пользователя
+selectClient=Выбрать клиента
+forbiddenAdminConsole=У вас нет разрешения. Обратитесь к администратору.
+grantedPermissions=Предоставленные разрешения
+deniedPermissions=Отказано в разрешениях
+authenticationType=Тип аутентификации
+authenticationTypeBasicAuth=Пароль
+authenticationTypeTokenAuth=Токен
+authTokenUrl=URL-адрес токена аутентификации
+tokenTokenUrlHelp=Точка доступа токена для сбора токенов: пример keycloak: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+authTokenScope=Область действия токена аутентификации
+authTokenScopeHelp=Область(ы), разделенные пробелами, используемые во время сбора токенов в качестве параметра области, например, "basic sendmail"
+authTokenClientId=Токен аутентификации ClientId
+authTokenClientIdHelp=client_id, используемый во время сбора токенов, например mykeycloak-sendmail-client
+authTokenClientSecret=Секретный ключ клиента токена аутентификации
+enableDebugSMTP=Включить отладку SMTP
+signatureMaxExp=Макс. срок действия
+signatureMaxExpHelp=Макс. допустимый срок действия JWT. Токены должны быть сгенерированы непосредственно перед аутентификацией. По истечении этого срока они будут считаться недействительными, поскольку они слишком старые. Если не определено, значение по умолчанию составляет 60 секунд.
+fileNameDialogTitle=Сохранить как
+fileName=Имя файла
+syncUsersStarted=Синхронизация пользователей началась.
+userProfileClaims=Клеймы о профиле пользователя
+userIDClaim=Клейм ID
+userIDClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющего уникальный идентификатор пользователя. Если не указано, по умолчанию `sub`.
+userNameClaim=Клейм имени пользователя
+userNameClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющей имя пользователя. Если не указано, по умолчанию используется `preferred_username`.
+emailClaim=Клейм электронной почты
+emailClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющей адрес электронной почты пользователя. Если не указано, по умолчанию `email`.
+fullNameClaim=Клейм имени
+fullNameClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющее полное имя пользователя. Если не указано, по умолчанию `name`.
+givenNameClaim=Клейм имени
+givenNameClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющей данное имя пользователя. Если не указано, по умолчанию `given_name`.
+familyNameClaim=Клейм фамилии
+familyNameClaimHelp=Имя клейма из документа JSON, возвращаемого точкой доступа профиля пользователя, представляющей фамилию пользователя. Если не указано, по умолчанию `family_name`.
+validity=Истечение срока действия сертификата
+validityHelp=Количество лет, в течение которых действителен сгенерированный сертификат.
+cibaBackchannelTokenDeliveryModeHelp=Указывает, как CD (Consumption Device) получает результат аутентификации и связанные токены. Этот режим будет использоваться по умолчанию для клиентов CIBA, у которых явно не установлен другой режим.
+deprecated=Устаревший
+cibaBackchannelTokenDeliveryMode=Способ доставки токенов через back-channel
+to атрибут. Для этого обязательно используйте любой из встроенных валидаторов для правильной проверки размера и значений.
+tokenIntrospectionUrl=URL интроспекции токена
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_sl.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_sl.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_sl.properties
@@ -0,0 +1 @@
+
diff --git a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_CN.properties b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_CN.properties
index f7283a5a87f6..73377ed587fb 100644
--- a/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_CN.properties
+++ b/js/apps/admin-ui/maven-resources-community/theme/keycloak.v2/admin/messages/messages_zh_CN.properties
@@ -198,7 +198,6 @@ removeUserText=是否要移除{{numSelected}}个用户？这些用户将不再
 diagramView=图表视图
 密码策略.digits=密码字符串中要求的数字的位数。
 removeImportedUsers=移除导入的用户？
-conditionsHelpItem=条件帮助项
 accountLinkingOnly=仅账户链接
 clientPoliciesPoliciesHelpText=客户端策略允许将客户端配置文件与各种条件绑定，以指定何时执行特定客户端配置文件中的执行器所规定的行为。
 anyClient=任何客户端在任何事件中都满足该条件。
@@ -1252,7 +1251,7 @@ onDragCancel=已取消拖动。列表未更改。
 removeUser=移除用户
 ownerManagedAccess=启用用户管理访问
 userModelAttributeNameHelp=从 LDAP 导入用户时要添加的模型属性的名称
-templateHelp=用于格式化要导入的用户名的模板。替换包含在 ${} 中。例如：'${ALIAS}.${CLAIM.sub}'。ALIAS 是供应商别名。CLAIM.<NAME > 引用 ID 或访问令牌声明。可以通过将 |uppercase 或 |lowercase 附加到替换值来将替换转换为大写或小写，例如“${CLAIM.sub | lowercase}”。
+templateHelp=用于格式化要导入的用户名的模板。替换包含在 ${} 中。例如：'${ALIAS}.${CLAIM.sub}'。ALIAS 是供应商别名。CLAIM.<NAME> 引用 ID 或访问令牌声明。可以通过将 |uppercase 或 |lowercase 附加到替换值来将替换转换为大写或小写，例如“${CLAIM.sub | lowercase}”。
 permissions=权限
 emptyExecutionInstructions=您可以通过添加子流程或执行器来开始定义此流程
 offlineSessionSettings=离线会话设置
@@ -2011,7 +2010,6 @@ targetClaim=目标声明
 assignRole=分配角色
 accessSettings=访问设置
 updateFlowSuccess=流程更新成功
-xXSSProtectionHelp=此标头在您的浏览器中配置跨站点脚本 (XSS) 过滤器。使用默认行为，浏览器将在检测到 XSS 攻击时阻止呈现页面。<1>了解更多</1>
 authenticatedAccessPolicies=经过身份验证的访问策略
 addExecutor=添加执行器
 selectIfResourceExists=如果资源已存在，请指定应采取的操作
@@ -2150,7 +2148,6 @@ client-scopes-condition.tooltip=预期的客户端范围列表。如果指定的
 anonymousAccessPolicies=匿名访问策略
 createResourceBasedPermission=创建基于资源的权限
 searchForRole=搜索角色
-xXSSProtection=X-XSS-保护
 debugHelp=为 Krb5LoginModule 启用/禁用调试日志记录到标准输出。
 validatorColNames.colConfig=设置
 createClient=创建客户端
diff --git a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/index.ftl b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/index.ftl
index 61246769d2dd..72eab2f5204f 100644
--- a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/index.ftl
+++ b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/index.ftl
@@ -2,7 +2,6 @@
 <html lang="en">
   <head>
     <meta charset="utf-8">
-    <base href="${resourceUrl}/">
     <link rel="icon" type="${properties.favIconType!'image/svg+xml'}" href="${resourceUrl}${properties.favIcon!'/favicon.svg'}">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="color-scheme" content="light${darkMode?then(' dark', '')}">
@@ -123,15 +122,13 @@
       </#list>
     </#if>
   </head>
-  <body>
+  <body data-page-id="admin">
     <div id="app">
       <main class="container">
         <div class="keycloak__loading-container">
-          <span class="pf-c-spinner pf-m-xl" role="progressbar" aria-valuetext="Loading&hellip;">
-            <span class="pf-c-spinner__clipper"></span>
-            <span class="pf-c-spinner__lead-ball"></span>
-            <span class="pf-c-spinner__tail-ball"></span>
-          </span>
+          <svg class="pf-v5-c-spinner pf-m-xl" role="progressbar" aria-valuetext="Loading..." viewBox="0 0 100 100" aria-label="Contents">
+            <circle class="pf-v5-c-spinner__path" cx="50" cy="50" r="45" fill="none"></circle>
+          </svg>
           <div>
             <p id="loading-text">Loading the Administration Console</p>
           </div>
diff --git a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
index b1223d2fed3b..261207a2df90 100644
--- a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
+++ b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
@@ -1,5 +1,5 @@
 cancel=Cancel
-deleteConfirm_other=Are you sure you want to delete these groups.
+deleteConfirm_other=Are you sure you want to delete these groups?
 trusted-hosts.label=Trusted Hosts
 deletedSuccess=Provider successfully deleted.
 searchAttributes=Search attributes
@@ -14,7 +14,6 @@ eventTypes.PERMISSION_TOKEN.name=Permission token
 permissionsDisable=Disable permissions?
 eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Federated identity link error
 secretHasExpired=Secret has expired, please generate a new one by clicking the "Regenerate" button above
-requiredRoles=Please add at least one role.
 policyRolesHelp=Click on 'Add roles' to include accepted roles for this policy. Checking the 'required field' checkbox on a role indicates that the selected role MUST be present while evaluating policy, regardless of other roles. Leaving all relevant roles for the policy unchecked is the equivalent of setting a decision strategy of 'Affirmative'.
 addLdapWizardTitle=Add LDAP user federation provider
 wantAssertionsSignedHelp=Indicates whether this service provider expects a signed Assertion.
@@ -26,9 +25,8 @@ eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Identity provider first logi
 searchByRoleName=Search by role name
 credentialType=Type
 passLoginHint=Pass login_hint
-openIdConnectCompatibilityModesHelp=This section is used to configure settings for backward compatibility with older OpenID Connect / OAuth 2 adaptors. It's useful especially if your client uses older version of Keycloak / RH-SSO adapter.
+openIdConnectCompatibilityModesHelp=This section is used to configure settings for backward compatibility with older OpenID Connect / OAuth 2 adaptors. It is useful especially if your client uses an older version of Keycloak / RH-SSO adapter.
 emptyClientScopes=This client doesn't have any added client scopes
-requiredGroups=Please add at least one group.
 httpPostBindingAuthnRequestHelp=Indicates whether the AuthnRequest must be sent using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
 policyEnforcementMode=Policy enforcement mode
 eventTypes.CLIENT_UPDATE.name=Client update
@@ -46,9 +44,9 @@ eventTypes.UPDATE_TOTP.name=Update totp
 updateCibaError=Could not update CIBA policy\: {{error}}
 policyUrl=Policy URL
 clientDescriptionHelp=Specifies description of the client. For example 'My Client for TimeSheets'. Supports keys for localized values as well. For example\: ${my_client_description}.
-rolesPermissionsHint=Determines if fine grained permissions are enabled for managing this role.  Disabling will delete all current permissions that have been set up.
+rolesPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
 passwordPoliciesHelp.regexPattern=Requires that the password matches one or more defined Java regular expression patterns.
-oAuthDPoP=OAuth 2.0 DPoP Bound Access Tokens Enabled
+oAuthDPoP=Require Demonstrating Proof of Possession (DPoP) header in token requests
 invalidRealmName=Realm name can't contain special characters
 validRedirectURIsHelp=Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed such as 'http\://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
 realmNameTitle={{name}} realm
@@ -79,24 +77,24 @@ invalidateRotatedSecret=Invalidate rotated secret?
 noDirectUsers=No direct users
 whoCanEditHelp=If enabled, users or administrators can view and edit the attribute. Otherwise, users or administrators don't have access to write to the attribute.
 eventTypes.LOGIN.name=Login
-addressClaim.country.tooltip=Name of User Attribute, which will be used to map to 'country' subclaim inside 'address' token claim. Defaults to 'country' .
+addressClaim.country.tooltip=Name of User Attribute, which will be used to map to 'country' subclaim inside 'address' token claim. Defaults to 'country'.
 uuidLdapAttribute=UUID LDAP attribute
 scopeNameHelp=Name of the client scope. Must be unique in the realm. Name should not contain space characters as it is used as value of scope parameter.
 requiredUserActions=Required user actions
 noConsentsText=The consents will only be recorded when users try to access a client that is configured to require consent. In that case, users will get a consent page which asks them to grant access to the client.
 addStep=Add step
 clientAssertionAudience=Client assertion audience
-permissionPoliciesHelp=Specifies all the policies that must be applied to the scopes defined by this policy or permission.
-userInitiatedActionLifespanHelp=Maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired. This value is recommended to be short because it's expected that the user would react to self-created action quickly.
+permissionPoliciesHelp=Specifies all the policies that must be applied to the permission.
+userInitiatedActionLifespanHelp=Maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired. This value is recommended to be short because it is expected that the user would react to a self-created action quickly.
 clearFileExplain=Are you sure you want to clear this file?
 userModelAttribute=User model attribute
 eventTypes.LOGOUT_ERROR.name=Logout error
 allowRemoteResourceManagement=Remote resource management
-syncRegistrationsHelp=Should newly created users be created within LDAP store? Priority effects which provider is chosen to sync the new user. This setting is effectively appplied only with WRITABLE edit mode.
+syncRegistrationsHelp=Should newly created users be created within the LDAP store? Priority affects which provider is chosen to sync the new user. This setting is effectively applied only with WRITABLE edit mode.
 resetPasswordAllowed=Forgot password
 emptyExecution=No steps
 passwordPolicyHintsEnabledHelp=Applicable just for writable MSAD. If on, then updating password of MSAD user will use LDAP_SERVER_POLICY_HINTS_OID extension, which means that advanced MSAD password policies like 'password history' or 'minimal password age' will be applied. This extension works just for MSAD 2008 R2 or newer.
-expirationValueNotValid=Value should should be greater or equal to 1
+expirationValueNotValid=Value should be greater than or equal to 1
 eventTypes.UPDATE_CONSENT.name=Update consent
 forceArtifactBinding=Force artifact binding
 eventTypes.REFRESH_TOKEN_ERROR.description=Refresh token error
@@ -122,7 +120,7 @@ applyToResourceTypeFlag=Apply to resource type
 offlineSessionIdleHelp=Time an offline session is allowed to be idle before it expires. You need to use offline token to refresh at least once within this period; otherwise offline session will expire.
 eventTypes.UPDATE_TOTP.description=Update totp
 testError=Error when trying to connect to LDAP\: '{{error}}'
-groupObjectClassesHelp=Object class (or classes) of the group object. It's divided by commas if more classes needed. In typical LDAP deployment it could be 'groupOfNames'. In Active Directory it's usually 'group'.
+groupObjectClassesHelp=Object class (or classes) of the group object. It is divided by commas if more classes are needed. In a typical LDAP deployment, it could be 'groupOfNames'. In Active Directory, it is usually 'group'.
 filterByClients=Filter by clients
 claims=Claims
 createPolicyOfType=Create {{policyType}} policy
@@ -130,7 +128,7 @@ realmRolePrefix=Realm role prefix
 flowUsedByDescription=This flow is used by the following {{value}}
 createClientScope=Create client scope
 includeRepresentation=Include representation
-expireTimeHelp=Defines the time after which the policy MUST NOT be granted. Only granted if current date/time is before or equal to this value.
+expireTimeHelp=Defines the time after which the policy MUST NOT be granted. Only granted if the current date/time is before or equal to this value.
 singleLogoutServiceUrl=Single logout service URL
 noRolesInstructions-roles=You haven't created any roles in this realm. Create a role to get started.
 editIdPMapper=Edit Identity Provider Mapper
@@ -147,7 +145,7 @@ unmanagedAttributePolicy.DISABLED=Disabled
 unmanagedAttributePolicy.ENABLED=Enabled
 unmanagedAttributePolicy.ADMIN_VIEW=Only administrators can view
 unmanagedAttributePolicy.ADMIN_EDIT=Only administrators can write
-confirmPasswordDoesNotMatch=Password and confirmation does not match.
+confirmPasswordDoesNotMatch=Password and confirmation do not match.
 eventTypes.DELETE_ACCOUNT_ERROR.description=Delete account error
 provider=Provider
 flows=Flows
@@ -160,6 +158,7 @@ authnContextClassRefsHelp=Ordered list of requested AuthnContext ClassRefs.
 sessionsType.directGrant=Direct grant
 validateSignature=Validate Signatures
 useLowerCaseBearerType=Use lower-case bearer type in token responses
+useRfc9068AccessTokenType=Use "at+jwt" as access token header type
 headers=Headers
 ldapAttributeNameHelp=Name of the LDAP attribute, which will be added to the new user during registration.
 createAGroup=Create a group
@@ -193,7 +192,7 @@ usersAdded_one={{count}} user added to the group
 resourcesAndScopes=Resources and Scopes
 editUsernameHelp=If enabled, the username field is editable, readonly otherwise.
 eventTypes.UPDATE_CONSENT_ERROR.description=Update consent error
-overrideActionTokensHelp=Override default settings of maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired for specific action. This value is recommended to be short because it's expected that the user would react to self-created action quickly.
+overrideActionTokensHelp=Override default settings of maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired for a specific action. This value is recommended to be short because it is expected that the user would react to a self-created action quickly.
 searchByName=Search by name
 executorTypeSwitchHelpText=Executor Type Switch Help Text
 attributeConsumingServiceNameHelp=Name of the Attribute Consuming Service profile to advertise in the SP metadata.
@@ -216,9 +215,8 @@ addAssociatedRolesError=Could not associate roles {{error}}
 removeUserText=Do you want to remove {{numSelected}} users? These users will no longer have permissions of the role {{role}} and the associated roles of it.
 diagramView=Diagram view
 removeImportedUsers=Remove imported users?
-conditionsHelpItem=Conditions help item
 accountLinkingOnly=Account linking only
-clientPoliciesPoliciesHelpText=Client Policy allows to bind client profiles with various conditions to specify when exactly is enforced behavior specified by executors of the particular client profile.
+clientPoliciesPoliciesHelpText=Client Policy allows binding client profiles with various conditions to specify when enforced behavior is specified by executors of the particular client profile.
 anyClient=The condition is satisfied by any client on any event.
 editFlow=Edit flow
 noDefaultGroupsInstructions=Default groups allow you to automatically assign group membership whenever any new user is created or imported throughout <1>identity brokering</1>. Add default groups to get started.
@@ -255,7 +253,7 @@ eventTypes.LOGOUT_ERROR.description=Logout error
 clientProfilesHelp=Client profiles applied on this policy.
 deleteClientPolicyError=Could not delete policy\: {{error}}
 selectAttribute=Select attribute
-resourceAttributeHelp=The attributes associated wth the resource.
+resourceAttributeHelp=The attributes associated with the resource.
 updateCredentialUserLabelSuccess=The user label has been changed successfully.
 product=Product
 credentialUserLabel=User Label
@@ -264,7 +262,7 @@ bindTypeHelp=Type of the authentication method used during LDAP bind operation.
 whoWillAppearPopoverText=Groups are hierarchical. When you select Direct Membership, you see only the child group that the user joined. Ancestor groups are not included.
 eventTypes.VERIFY_EMAIL.description=Verify email
 eventTypes.REFRESH_TOKEN_ERROR.name=Refresh token error
-partialImportHeaderText=Partial import allows you to import users, clients, and other resources from a previously exported json file.
+partialImportHeaderText=Partial import allows you to import users, clients, and other resources from a previously exported JSON file.
 disableSuccess=Provider successfully disabled
 validatingPublicKeyIdHelp=Explicit ID of the validating public key given above if the key ID. Leave blank if the key above should be used always, regardless of key ID specified by external IDP; set it if the key should only be used for verifying if the key ID from external IDP matches.
 eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Identity provider link account error
@@ -276,16 +274,16 @@ membershipLdapAttribute=Membership LDAP attribute
 availableIdPs=Available identity providers
 updateClientConditionSuccess=Condition updated successfully.
 attributes=Attributes
-roleDeleteConfirmDialog=This action will permanently delete the role "{{selectedRoleName}}" and cannot be undone.
+roleDeleteConfirmDialog=This action will permanently delete the role "{{selectedRoleName}}". This cannot be undone.
 clientDelete=Delete {{clientId}} ?
 userDeletedSuccess=The user has been deleted
 revokeClientScopesTitle=Revoke all granted client scopes?
 contentSecurityPolicyReportOnlyHelp=For testing Content Security Policies <1>Learn more</1>
 eventTypes.PERMISSION_TOKEN.description=Permission token
 allow-default-scopes.label=Allow Default Scopes
-minuteHelp=Defines the minute when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if current minute is between or equal to the two values you provided.
+minuteHelp=Defines the minute when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if the current minute is between or equal to the two values you provided.
 updateCibaSuccess=CIBA policy successfully updated
-newRoleNameHelp=The new role name.  The new name format corresponds to where in the access token the role will be mapped to.  So, a new name of 'myapp.newname' will map the role to that position in the access token.  A new name of 'newname' will map the role to the realm roles in the token.
+newRoleNameHelp=The new role name. The new name format corresponds to where in the access token the role will be mapped to. So, a new name of 'myapp.newname' will map the role to that position in the access token. A new name of 'newname' will map the role to the realm roles in the token.
 mapperTypeFullNameLdapMapper=full-name-ldap-mapper
 searchUserByAttributeMissingKeyError=Specify an attribute key
 eventTypes.INVALID_SIGNATURE.name=Invalid signature
@@ -315,6 +313,7 @@ revert=Revert
 eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=Identity provider retrieve token
 dependentPermission=Dependent permission
 disableNonce=Disable nonce
+disableTypeClaimCheck=Disable type claim check
 addAssociatedRolesSuccess=Associated roles have been added
 groupDeleted_one=Group deleted
 userHelp=Optionally select user, for whom the example access token will be generated. If you do not select a user, example access token will not be generated during evaluation.
@@ -342,7 +341,7 @@ editAttribute=Edit attribute
 webAuthnPolicyRpEntityNameHelp=Human-readable server name as WebAuthn Relying Party
 postBrokerLoginFlowAlias=Post login flow
 refreshTokenMaxReuse=Refresh Token Max Reuse
-partialExportHeaderText=Partial export allows you to export realm configuration, and other associated resources into a json file.
+partialExportHeaderText=Partial export allows you to export realm configuration and other associated resources into a JSON file.
 clientScopes=Client scopes
 loadingRealms=Loading realms…
 eventTypes.SEND_RESET_PASSWORD_ERROR.description=Send reset password error
@@ -368,7 +367,7 @@ defaultGroups=Default groups
 eventTypes.TOKEN_EXCHANGE_ERROR.name=Token exchange error
 flow.browser=Browser flow
 unlinkUsersSuccess=Unlink of users finished successfully.
-addressClaim.street.tooltip=Name of User Attribute, which will be used to map to 'street_address' subclaim inside 'address' token claim. Defaults to 'street' .
+addressClaim.street.tooltip=Name of User Attribute, which will be used to map to 'street_address' subclaim inside 'address' token claim. Defaults to 'street'.
 webAuthnPolicyCreateTimeoutHint=Timeout needs to be between 0 seconds and 8 hours.
 addValidator=Add validator
 attributeImporter=Import declared SAML attribute if it exists in assertion into the specified user property or attribute.
@@ -382,7 +381,7 @@ mapperTypeHardcodedAttributeMapper=hardcoded-attribute-mapper
 eventTypes.IMPERSONATE.description=Impersonate
 forbidden_other=Forbidden, permissions needed\:
 clientAuthorization=Authorization
-identityProvidersPermissionsHint=Determines if fine grained permissions are enabled for managing this role.  Disabling will delete all current permissions that have been set up.
+identityProvidersPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
 removeMappingConfirm_other=Are you sure you want to remove {{count}} roles
 kerberosWizardDescription=Text needed here.
 welcome=Welcome to
@@ -410,14 +409,14 @@ addMessageBundle=Add message bundle
 realmName=Realm name
 searchEventType=Search saved event type
 idpInitiatedSsoRelayStateHelp=Relay state you want to send with SAML request when you want to do IDP Initiated SSO.
-otpHashAlgorithmHelp=What hashing algorithm should be used to generate the OTP.
+otpHashAlgorithmHelp=Hashing algorithm used to generate the OTP
 joinGroup=Join Group
 eventTypes.REMOVE_TOTP_ERROR.description=Remove totp error
 eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Execute action token error
 unlinkAccountConfirm=Are you sure you want to permanently unlink this account from {{provider}}?
 x509CertificateHelp=X509 Certificate encoded in PEM format
 samlEndpointsLabel=SAML 2.0 Service Provider Metadata
-passCurrentLocaleHelp=Pass the current locale to the identity provider as a ui_locales parameter.
+passCurrentLocaleHelp=Pass the current locale to the identity provider as an ui_locales parameter.
 lessThan=Must be less than {{value}}
 webAuthnPolicyRequireResidentKeyHelp=It tells an authenticator whether to create a public key credential as a Discoverable Credential.
 logoutServiceRedirectBindingURL=Logout Service Redirect Binding URL
@@ -432,6 +431,7 @@ guiOrder=Display Order
 friendlyName=Friendly name of attribute to search for in assertion. You can leave this blank and specify a name instead.
 testSuccess=Successfully connected to LDAP
 userInfoUrl=User Info URL
+tokenIntrospectionUrl=Token Introspection URL
 displayOnConsentScreen=Display on consent screen
 noClientPolicies=No client policies
 defaultAdminInitiatedActionLifespanHelp=Maximum time before an action permit sent to a user by administrator is expired. This value is recommended to be long to allow administrators to send e-mails for users that are currently offline. The default timeout can be overridden immediately before issuing the token.
@@ -448,6 +448,9 @@ nameIdFormatHelp=The name ID format to use for the subject.
 detailsHelp=This is information about the details.
 adminEvents=Admin events
 serviceAccountHelp=Allows you to authenticate this client to Keycloak and retrieve access token dedicated to this client. In terms of OAuth2 specification, this enables support of 'Client Credentials Grant' for this client.
+standardTokenExchangeEnabledHelp=Enable Standard Token Exchange V2 for this client.
+enableRefreshRequestedTokenTypeHelp=Controls if the Standard Token Exchange V2 allows to request a refresh token (parameter "requested_token_type" set to value "urn:ietf:params:oauth:token-type:refresh_token"). If this option is "No" (default), the refresh token request type is never allowed and an error is returned. If this option is "Same session", the returned refresh token is enforced to use the same session as the subject token, returning an error if that session is not available (for example if the subject token is transient).
+sameSession=Same session
 urisHelp=Set of URIs which are protected by resource.
 eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Identity provider response
 confirmClientSecretTitle=Regenerate secret for this client?
@@ -478,7 +481,7 @@ userInfoResponseEncryptionKeyManagementAlgorithmHelp=JWA Algorithm used for key
 authnContextDeclRefsHelp=Ordered list of requested AuthnContext DeclRefs.
 inherent=Inherited
 tableTitle=Attributes groups
-generateNewKeys=Generate new keys
+generateNewKeys=Generate RSA keys
 updateClientPolicySuccess=Client policy updated
 unlock=Unlock
 validateRealm=You must enter a realm
@@ -498,11 +501,13 @@ protocolTypes.openid-connect=OpenID Connect
 clientTypeHelp='OpenID Connect' allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server.'SAML' enables web-based authentication and authorization scenarios including cross-domain single sign-on (SSO) and uses security tokens containing assertions to pass information.
 addOpenIdProvider=Add OpenID Connect provider
 memory=Memory
+cpu=CPU
+processorCount=Processor Count
 eventTypes.CLIENT_LOGIN.name=Client login
 mapper.nameid.format.tooltip=This mapper is applied only if the NameID format of the incoming AuthnRequest is equal to this value.
 hideOnLoginPageHelp=If hidden, login with this provider is possible only if requested explicitly, for example using the 'kc_idp_hint' parameter.
 eventTypes.UPDATE_PROFILE.description=Update profile
-assignRolesTo=Assign roles to {{client}}
+assignRolesTo=Assign {{type}} roles to {{client}}
 orderChangeError=Could not change display order of identity providers {{error}}
 policyProvider.client-scope=Define conditions for your permissions where a set of one or more client scopes is permitted to access an object.
 secretExpiresOn=Secret expires on {{time}}
@@ -510,7 +515,7 @@ searchClientByName=Search client by name
 loginTimeout=Login timeout
 attributeName=Attribute [Name]
 updateError=Could not update the provider {{error}}
-importUsersHelp=If true, LDAP users will be imported into the Keycloak DB and synced by the configured sync policies.
+importUsersHelp=If true, LDAP users will be imported into the Keycloak database and synced by the configured sync policies.
 emptyClientProfilesInstructions=There are no profiles, select 'Create client profile' to create a new client profile
 policyProvider.js=Define conditions for your permissions using JavaScript. It is one of the rule-based policy types supported by Keycloak, and provides flexibility to write any policy based on the Evaluation API.
 idpType.social=Social login
@@ -523,7 +528,6 @@ showRemaining=Show ${remaining}
 searchProfile=Search profile
 eventTypes.UPDATE_EMAIL_ERROR.name=Update email error
 removeConfirm_other=Are you sure you want to remove these groups?
-renameGroup=Rename group
 configure=Configure
 searchScopeHelp=For one level, the search applies only for users in the DNs specified by User DNs. For subtree, the search applies to the whole subtree. See LDAP documentation for more details.
 jumpToSection=Jump to section
@@ -542,7 +546,7 @@ otpPolicyCodeReusable=Reusable token
 addRedirectUri=Add valid redirect URIs
 time=Time
 disableSigningExplain=If you disable "{{key}}", the Keycloak database will be updated and you may need to download a new adapter for this client.
-mapperTypeRoleLdapMapperHelp=Used to map role mappings of roles from some LDAP DN to Keycloak role mappings of either realm roles or client roles of particular client.
+mapperTypeRoleLdapMapperHelp=Used to map role mappings of roles from some LDAP DN to Keycloak role mappings of either realm roles or client roles of a particular client.
 used.DEFAULT=Default
 authenticationCreateFlowHelp=Create flow.
 credentialResetEmailSuccess=Email sent to user.
@@ -557,7 +561,7 @@ socialProfileJSONFieldPathHelp=Path of field in Social Provider User Profile JSO
 userModelAttributeHelp=Name of the UserModel property or attribute you want to map the LDAP attribute into. For example 'firstName', 'lastName, 'email', 'street' etc.
 userList=User list
 eventTypes.RESET_PASSWORD.name=Reset password
-exportWarningDescription=If there is a great number of groups, roles or clients in your realm, the operation may make server unresponsive for a while.
+exportWarningDescription=If your realm includes many groups, roles, or clients, the operation may make the server unresponsive for a while.
 importRole=Import role
 deleteClientProfileConfirm=This action will permanently delete the profile {{profileName}}. This cannot be undone.
 signServiceProviderMetadataHelp=Enable/disable signature of the provider SAML metadata.
@@ -572,7 +576,7 @@ sessions=Sessions
 mapperCreateSuccess=Mapper created successfully.
 fullSyncPeriodHelp=Period for full synchronization in seconds
 resourceTypeHelp=Specifies that this permission must be applied to all resource instances of a given type.
-encryptionAlgorithmHelp=Encryption algorithm, which is used by SAML IDP for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and should be available in realm keys for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself.
+encryptionAlgorithmHelp=Encryption algorithm, which is used by the SAML IDP for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypting SAML document parts is chosen based on this configured algorithm and should be available in realm keys for the encryption (ENC) usage. If no algorithm is configured, any supported algorithm is allowed and the decryption key is chosen based on the algorithm configured in the SAML document.
 socialUserAttributeName=User attribute name to store information.
 priority=Priority
 jsonType.label=Claim JSON Type
@@ -589,7 +593,7 @@ showMetaData=Show metadata
 webAuthnPolicyAttestationConveyancePreferenceHelp=Communicates to an authenticator the preference of how to generate an attestation statement.
 top-level-flow-type.basic-flow=Basic flow
 groupRemoveError=Error removing group {error}
-temporaryPasswordHelpText=If enabled, the user must change the password on next login
+temporaryPasswordHelpText=If enabled, the user must change the password on the next login
 requestObjectEncryption=Request object encryption algorithm
 exportAuthDetailsSuccess=Successfully exported authorization details.
 connectionPooling=Connection pooling
@@ -606,7 +610,7 @@ keyPassword=Key password
 attributeFriendlyName=Attribute [Friendly Name]
 clearAllFilters=Clear all filters
 scopePermissions.clients.map-roles-composite-description=Policies that decide if an administrator can apply roles defined by this client as a composite to another role
-roleObjectClassesHelp=Object class (or classes) of the role object. It's divided by commas if more classes are needed. In typical LDAP deployment it could be 'groupOfNames'. In Active Directory it's usually 'group'.
+roleObjectClassesHelp=Object class (or classes) of the role object. It is divided by commas if more classes are needed. In a typical LDAP deployment, it could be 'groupOfNames'. In Active Directory, it is usually 'group'.
 emptyAddClientScopes=No client scopes
 changeTypeTo=Change type to
 generateKeys=Generate keys?
@@ -615,16 +619,16 @@ groupRemove_one=Group removed
 savePasswordError=Error saving password\: {{error}}
 allGroups=All groups
 deleteNode=Delete node?
-rdnLdapAttributeHelp=Name of the LDAP attribute, which is used as RDN (top attribute) of typical user DN. Usually it's the same as the Username LDAP attribute, however it is not required. For example for Active directory, it is common to use 'cn' as RDN attribute when username attribute might be 'sAMAccountName'.
+rdnLdapAttributeHelp=Name of the LDAP attribute, which is used as the RDN (top attribute) of a typical user DN. It is typically the same attribute as the Username LDAP attribute; however, it is not required. For example, in Active directory, it is common to use 'cn' as the RDN attribute when the username attribute might be 'sAMAccountName'.
 addAaguids=Add AAGUID
 createPolicy=Create client policy
-disablePolicyConfirm=Users and clients can't access the policy if it's disabled. Are you sure you want to continue?
+disablePolicyConfirm=Users and clients cannot access the policy if it is disabled. Are you sure you want to continue?
 useDiscoveryEndpoint=Use discovery endpoint
 clearAdminEvents=Clear admin events
 eventTypes.CLIENT_DELETE.name=Client delete
 clientLoginTimeout=Client Login Timeout
 mapperSaveSuccess=Mapper saved successfully.
-noRolesAssociatedInstructions=To add roles to this role press the 'Add role' button
+noRolesAssociatedInstructions=To add roles to this role, click 'Add role'.
 alwaysDisplayInUIHelp=Always list this client in the Account UI, even if the user does not have an active session.
 eventTypes.UPDATE_PASSWORD.name=Update password
 eventTypes.UPDATE_CONSENT.description=Update consent
@@ -648,7 +652,7 @@ manageServiceAccountUser=To manage detail and group mappings, click on the usern
 addClientProfileSuccess=New client profile added
 helpDisabled=Help off
 deleteResource=Permanently delete resource?
-validRequestURIsHelp=List of valid URIs, which can be used as values of 'request_uri' parameter during OpenID Connect authentication request. There is support for the same capabilities like for Valid Redirect URIs. For example wildcards or relative paths.
+validRequestURIsHelp=List of valid URIs that can be used as values of the 'request_uri' parameter during an OpenID Connect authentication request. No support exists for the same capabilities as for Valid Redirect URIs. For example, wildcards or relative paths.
 emptyAddClientScopesInstructions=There are no client scopes left to add
 changeTypeIntro={{count}} selected client scopes will be changed to
 secretSizeHelp=Size in bytes for the generated secret
@@ -672,6 +676,8 @@ certSubject=CERT_SUBJECT
 userCredentialsHelpText=The top level handlers allow you to shift the priority of the credential for the user, the topmost credential having the highest priority. The handlers within one expandable panel allow you to change the visual order of the credentials, the topmost credential will show at the most left.
 ldapAdvancedSettingsDescription=This section contains all the other options for more fine-grained configuration of the LDAP storage provider.
 usersDN=Users DN
+relativeUserCreateDn=Relative user creation DN
+relativeUserCreateDnHelp=Relative DN from the 'Users DN' to where users will be created. For example, this allows users to be created in other DN than the parent 'Users DN' when using a subtree search scope.
 secretSize=Secret size
 included.custom.audience.label=Included Custom Audience
 max-clients.label=Max Clients Per Realm
@@ -756,13 +762,13 @@ kc.identity.authc.method=Authentication Method
 regexAttributeValues=Regex Attribute Values
 otpTypeHelp=totp is Time-Based One Time Password. 'hotp' is a counter base one time password in which the server keeps a counter to hash against.
 setAsDefaultAction=Set as default action
-keyForCodeExchange=Proof Key for Code Exchange Code Challenge Method
+keyForCodeExchange=PKCE Method
 clientProfiles=Client profiles
 endpointsHelp=Shows the configuration of the Service Provider endpoint.
 mapperTypeLdapAttributeMapper=hardcoded-ldap-attribute-mapper
 unlockAllUsers=Unlock all users
 noGroupsText=You haven't added this user to any groups. Join a group to get started.
-createClientPolicyError=Could not  create policy due to\: {{error}}
+createClientPolicyError=Could not create policy due to\: {{error}}
 eventTypes.EXECUTE_ACTIONS_ERROR.name=Execute actions error
 path=Path
 overwritten=Overwritten
@@ -814,14 +820,16 @@ useEntityDescriptor=Use entity descriptor
 loginActionTimeout=Login action timeout
 windowsDomainQN=Windows Domain Qualified Name
 deleteClientError=Could not delete profile\: {{error}}
-validRedirectURIs=Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed such as 'http\://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
+validRedirectURIs=Valid URI pattern that a browser can redirect to after a successful login. Simple wildcards are allowed such as 'http\://example.com/*'. Also, you can use a relative path, such as /my/relative/path/*. Relative paths are relative to the client root URL; if that URL is not specified, the auth server root URL is used. For SAML, set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
 UPDATE_PROFILE=Update Profile (UPDATE_PROFILE)
 assertionConsumerServicePostBindingURL=Assertion Consumer Service POST Binding URL
 removeImported=Remove imported
 endpoints=Endpoints
 roleSaveError=Could not save role\: {{error}}
 keySize=Key size
-membershipUserLdapAttributeHelp=Used just if Membership Attribute Type is UID. It is the name of the LDAP attribute on user, which is used for membership mappings. Usually it will be 'uid'. For example if the value of 'Membership User LDAP Attribute' is 'uid' and  LDAP group has 'memberUid\: john', then it is expected that particular LDAP user will have attribute 'uid\: john'.
+validity=Certificate expiration
+validityHelp=Number of years the generated certificate is valid for.
+membershipUserLdapAttributeHelp=Used only if the Membership Attribute Type is UID. It is the name of the LDAP attribute on the user, which is used for membership mappings. It is typically 'uid'. For example, if the value of 'Membership User LDAP Attribute' is 'uid' and the LDAP group has 'memberUid\: john', it is expected that particular LDAP user will have the attribute 'uid\: john'.
 samlCapabilityConfig=SAML capabilities
 accessTokenSignatureAlgorithmHelp=JWA algorithm used for signing access tokens.
 derFormatted=DER formatted
@@ -833,7 +841,7 @@ addExecutionHelp=Execution can have a wide range of actions, from sending a rese
 requestObjectRequiredHelp=Specifies if the client needs to provide a request object with their authorization requests, and what method they can use for this. If set to "not required", providing a request object is optional. In all other cases, providing a request object is mandatory. If set to "request", the request object must be provided by value. If set to "request_uri", the request object must be provided by reference. If set to "request or request_uri", either method can be used.
 clientScopesRolesScope=If there is no role scope mapping defined, each user is permitted to use this client scope. If there are role scope mappings defined, the user must be a member of at least one of the roles.
 passwordPoliciesHelp.notUsername=The password cannot match the username.
-passwordPoliciesHelp.notContainsUsername=The password cannot contains the username.
+passwordPoliciesHelp.notContainsUsername=The password cannot contain the username.
 removeConfirm_one=Are you sure you want to remove this group?
 createUserProviderSuccess=User federation provider successfully created
 countHelp=Specifies how many clients can be created using the token.
@@ -850,8 +858,8 @@ hideInheritedRoles=Hide inherited roles
 consentRequired=Consent required
 selectMethodType.import=Import
 standardFlow=Standard flow
-votedToStatus=\ voted to {{status}}
-credentialResetConfirmText=Are you sure you want to send email to user
+votedToStatus=voted to {{status}}
+credentialResetConfirmText=Are you sure you want to email this user?
 clientScopeType.default=Default
 helpFileUpload=Upload a JSON file
 addProvider_one=Add {{provider}} provider
@@ -868,7 +876,7 @@ leaveGroup_one=Leave group {{name}}?
 count=Count
 noPasswordPoliciesInstructions=You haven't added any password policies to this realm. Add a policy to get started.
 testAuthentication=Test authentication
-groupNameLdapAttributeHelp=Name of LDAP attribute, which is used in group objects for name and RDN of group. Usually it will be 'cn'. In this case typical group/role object may have DN like 'cn\=Group1,ouu\=groups,dc\=example,dc\=org'.
+groupNameLdapAttributeHelp=Name of LDAP attribute that is used in group objects for the name and RDN of group. It is typically 'cn'. In this case, a typical group/role object may have DN such as 'cn\=Group1,ouu\=groups,dc\=example,dc\=org'.
 deleteError=Could not delete the provider {{error}}
 attributeDisplayName=Display name
 pkceEnabled=Use PKCE
@@ -905,7 +913,7 @@ eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Identity provider link account
 deleteMessageBundleSuccess=Successfully removed the message from the bundle
 retry=Press here to refresh and continue
 selectAttributes=Select attributes
-firstBrokerLoginFlowAliasOverrideHelp=Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means that no Keycloak account is currently linked to the authenticated identity provider account.
+firstBrokerLoginFlowAliasOverrideHelp=Alias of authentication flow, which is triggered after the first login with this identity provider. The term 'First Login' means that no Keycloak account is currently linked to the authenticated identity provider account.
 owner=Owner
 eventTypes.VERIFY_PROFILE.description=Verify profile
 executorAuthenticatorMultiSelectHelpText=Executor Authenticator MultiSelect Help Text
@@ -921,7 +929,7 @@ addSamlProvider=Add SAML provider
 permission=Permission
 saveEventListeners=Save Event Listeners
 capabilityConfig=Capability config
-mapperTypeMsadUserAccountControlManagerHelp=Mapper specific to MSAD. It's able to integrate the MSAD user account state into Keycloak account state (account enabled, password is expired etc). It's using userAccountControl and pwdLastSet MSAD attributes for that. For example if pwdLastSet is 0, the Keycloak user is required to update the password; if userAccountControl is 514 (disabled account) the Keycloak user is disabled as well etc. Mapper is also able to handle the exception code from LDAP user authentication.
+mapperTypeMsadUserAccountControlManagerHelp=Mapper specific to MSAD. It can integrate the MSAD user account state into the Keycloak account state (account enabled, password is expired, and others). It is using userAccountControl and pwdLastSet MSAD attributes for that state. For example, if pwdLastSet is 0, the Keycloak user is required to update the password. In another example, if userAccountControl is 514 (disabled account), the Keycloak user is disabled as well. The mapper can also handle the exception code from LDAP user authentication.
 home=Home
 bindFlow=Bind flow
 userAttributeValue=User Attribute Value
@@ -1021,7 +1029,7 @@ frontchannelLogoutSessionRequiredHelp=Specifying whether a sid (session ID) and
 testConnectionHint.withoutEmailAction=Configure e-mail address
 webAuthnUpdateError=Could not update webauthn policies due to {{error}}
 paginationHelp=Whether the LDAP server supports pagination
-oAuthMutualHelp=This enables support for OAuth 2.0 Mutual TLS Certificate Bound Access Tokens, which means that keycloak bind an access token and a refresh token with a X.509 certificate of a token requesting client exchanged in mutual TLS between keycloak's Token Endpoint and this client. These tokens can be treated as Holder-of-Key tokens instead of bearer tokens.
+oAuthMutualHelp=This enables support for OAuth 2.0 Mutual TLS Certificate Bound Access Tokens, which means that Keycloak binds an access token and a refresh token with an X.509 certificate of a token requesting client exchanged in mutual TLS between keycloak's Token Endpoint and this client. These tokens can be treated as Holder-of-Key tokens instead of bearer tokens.
 deleteProviderTitle=Delete key provider?
 scopes=Scopes
 accessTokens=Access tokens
@@ -1033,7 +1041,7 @@ subject=Subject DN
 use=Use
 defaultAdminInitiated=Default Admin-Initiated Action Lifespan
 chooseAMapperType=Choose a mapper type
-startTimeHelp=Defines the time before which the policy MUST NOT be granted. Only granted if current date/time is after or equal to this value.
+startTimeHelp=Defines the time before which the policy MUST NOT be granted. Only granted if the current date/time is after or equal to this value.
 noGroupsInThisRealm=No groups in this realm
 searchUserByAttributeKeyAlreadyInUseError=Attribute key already in use
 executorClientAuthenticator=Executor Client Authenticator
@@ -1068,7 +1076,7 @@ addressClaim.region.label=User Attribute Name for Region
 applyToResourceTypeFlagHelp=Specifies if this permission should be applied to all resources with a given type. In this case, this permission will be evaluated for all instances of a given resource type.
 managePriorityInfo=Priority is the order of providers when doing a user lookup. You can drag the row handlers to change the priorities.
 deletedErrorIdentityProvider=Could not delete the provider {{error}}
-included.custom.audience.tooltip=This is used just if 'Included Client Audience' is not filled. The specified value will be included in audience (aud) field of the token. If there are existing audiences in the token, the specified value is just added to them. It won't override existing audiences.
+included.custom.audience.tooltip=This is used only if 'Included Client Audience' is empty. The specified value is included in the audience (aud) field of the token. If the token already contains audiences, the specified value is added to those audiences, without overriding them.
 includeInIdToken.label=Add to ID token
 steps=Steps
 tokenDeleteConfirm=Are you sure you want to permanently delete the initial access token {{id}}
@@ -1108,10 +1116,12 @@ searchForProtocol=Search protocol mapper
 eventTypes.CLIENT_INFO.name=Client info
 eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=OAuth2 device code to token
 eventTypes.UPDATE_TOTP_ERROR.name=Update totp error
-client-updater-source-groups.tooltip=Name of groups to check. Condition evaluates to true if the entity, who creates/updates client is member of some of the specified groups. Configured groups are specified by their simple name, which must match to the name of the Keycloak group. No support for group hierarchy is used here.
+client-updater-source-groups.tooltip=Name of groups to check. The condition evaluates to true if the entity who creates or updates the client is a member of one or more of the specified groups. Configured groups are specified by their simple name, which must match the name of the Keycloak group. No support for group hierarchy is used here.
 webAuthnPolicyRpId=Relying party ID
 ldapRolesDnHelp=LDAP DN where roles of this tree are saved. For example, 'ou\=finance,dc\=example,dc\=org'.
 serviceAccount=Service accounts roles
+standardTokenExchangeEnabled=Standard Token Exchange
+enableRefreshRequestedTokenType=Allow refresh token in Standard Token Exchange
 providerUpdatedSuccess=Client policy updated successfully
 assertionConsumerServiceRedirectBindingURL=Assertion Consumer Service Redirect Binding URL
 createClientScopeError=Could not create client scope\: '{{error}}'
@@ -1126,7 +1136,7 @@ clustering=Clustering
 createSuccess=Identity provider successfully created
 mapperAttributeName=Attribute Name
 setPassword=Set password
-client-updater-source-roles.tooltip=The condition is checked during client registration/update requests and it evaluates to true if the entity (usually user), who is creating/updating client is member of the specified role. For reference the realm role, you can use the realm role name like 'my_realm_role' . For reference client role, you can use the client_id.role_name for example 'my_client.my_client_role' will refer to client role 'my_client_role' of client 'my_client'.
+client-updater-source-roles.tooltip=The condition is checked during client registration or update request; it evaluates to true if the entity (usually a user) is creating or updating client is a member of the specified role. To reference the realm role, you can use the realm role name such as 'my_realm_role'. To reference the client role, you can use the client_id.role_name; for example, 'my_client.my_client_role' refers to the client role 'my_client_role' of the client 'my_client'.
 createRole=Create role
 clientDeletedSuccess=The client has been deleted
 eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Identity provider response error
@@ -1142,7 +1152,7 @@ moveGroupEmptyInstructions=There are no sub groups, select 'Move here' to move t
 hmacGenerated=hmac-generated
 unlockSuccess=User successfully unlocked
 unlockError=Could not unlock user due to {{error}}
-hourHelp=Defines the hour when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if current hour is between or equal to the two values you provided.
+hourHelp=Defines the hour when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if the current hour is between or equal to the two values you provided.
 deleteClientProfileConfirmTitle=Delete profile?
 syncLDAPGroupsError=Data could not be synced due {{error}}
 saveSuccess=User federation provider successfully saved
@@ -1150,7 +1160,7 @@ generatedAccessToken=Generated access token
 resetPasswordConfirmation=New password confirmation
 testConnection=Test connection
 archiveFormat=Archive format
-requestObjectEncryptionHelp=JWE algorithm, which client needs to use when sending OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', encryption is optional and any algorithm is allowed.
+requestObjectEncryptionHelp=JWE algorithm, which a client needs to use when sending an OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', encryption is optional and any algorithm is allowed.
 importSuccess=New certificate imported
 attributeConsumingServiceName=Attribute Consuming Service Name
 invalidJsonError=Unable to save user profile, the provided information is not valid JSON: {{error}}
@@ -1184,7 +1194,7 @@ clientUpdaterSourceRoles=Updating entity role
 enableSwitchError=Could not enable / disable due to {{error}}
 deleteClientPolicyProfileConfirm=This action will permanently delete {{profileName}} from the policy {{policyName}}. This cannot be undone.
 deleteExecutorProfileConfirm=The action will permanently delete {{executorName}}. This cannot be undone.
-confirmClientSecretBody=If you regenerate secret, the Keycloak database will be updated and you will need to download a new adapter for this client.
+confirmClientSecretBody=If you regenerate the secret, the Keycloak database will be updated and you will need to download a new adapter for this client.
 keysList=Keys list
 generatedUserInfo=Generated user info
 clientRegistration=Client registration
@@ -1244,7 +1254,7 @@ createClientConditionSuccess=Condition created successfully.
 kerberosKeyTab=Kerberos Key Tab
 principalAttribute=Principal attribute
 mapperTypeLdapAttributeMapperHelp=This mapper is supported just if syncRegistrations is enabled. New users registered in Keycloak will be written to the LDAP with the hardcoded value of some specified attribute.
-userRegistrationHelpText=Enable/disable the registration page. A link for registration will show on login page too.
+userRegistrationHelpText=Enable/disable the registration page. A link for registration will show on the login page too.
 activeHelp=Set if the keys can be used for signing
 addMapperExplain=If you want more fine-grain control, you can create protocol mapper on this client
 realmRoles=Realm roles
@@ -1276,7 +1286,7 @@ generatedAccessTokenHelp=See the example access token, which will be generated a
 webAuthnPolicyAcceptableAaguidsHelp=The list of allowed AAGUIDs of which an authenticator can be registered. An AAGUID is a 128-bit identifier indicating the authenticator's type (e.g., make and model).
 keyPasswordHelp=Password for the private key
 frontchannelLogout=Front channel logout
-clientUpdaterTrustedHostsTooltip=List of Hosts, which are trusted. In case that client registration/update request comes from the host/domain specified in this configuration, condition evaluates to true. You can use hostnames or IP addresses. If you use star at the beginning (for example '*.example.com' ) then whole domain example.com will be trusted.
+clientUpdaterTrustedHostsTooltip=List of Hosts, which are trusted. If that client registration or update request comes from the host/domain specified in this configuration, the condition evaluates to true. You can use hostnames or IP addresses. If you use star at the beginning (for example '*.example.com'), the whole domain example.com is trusted.
 titleRoles=Realm roles
 mapperTypeGroupLdapMapperHelp=Used to map group mappings of groups from some LDAP DN to Keycloak group mappings
 sectorIdentifierUri.tooltip=Providers that use pairwise sub values and support Dynamic Client Registration SHOULD use the sector_identifier_uri parameter. It provides a way for a group of websites under common administrative control to have consistent pairwise sub values independent of the individual domain names. It also provides a way for Clients to change redirect_uri domains without having to reregister all their users.
@@ -1288,7 +1298,7 @@ xRobotsTag=X-Robots-Tag
 bindType=Bind type
 tokenDeleteSuccess=Initial access token deleted successfully
 contextualInfo=Contextual Information
-syncModeHelp=Default sync mode for all mappers. The sync mode determines when user data will be synced using the mappers. Possible values are\: 'legacy' to keep the behaviour before this option was introduced, 'import' to only import the user once during first login of the user with this identity provider, 'force' to always update the user during every login with this identity provider.
+syncModeHelp=Default sync mode for all mappers. The sync mode determines when user data is synced using the mappers. Three possible values exist\: 'legacy' to keep the behavior before this option was introduced, 'import' to import the user only once, specifically during the first login of the user with this identity provider, and force' to always update the user at every login with this identity provider.
 temporaryPassword=Temporary
 applyPolicyHelp=Specifies all the policies that must be applied to the scopes defined by this policy or permission.
 addKerberosWizardDescription=Text needed here
@@ -1303,7 +1313,7 @@ eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Identity provider retrieve toke
 userInfo=User info
 consentScreenText=Consent screen text
 addRoles=Add roles
-clientPoliciesProfilesHelpText=Client Profile allows to setup set of executors, which are enforced for various actions done with the client. Actions can be admin actions like creating or updating client, or user actions like authentication to the client.
+clientPoliciesProfilesHelpText=Client Profile allows creating a set of executors that enforce various actions that are done with the client. Actions can be admin actions such as creating or updating a client or user actions such as authentication to the client.
 archiveFormatHelp=Java keystore or PKCS12 archive format.
 xContentTypeOptions=X-Content-Type-Options
 groupsDescription=A group is a set of attributes and role mappings that can be applied to a user. You can create, edit, and delete groups and manage their child-parent organization.
@@ -1327,7 +1337,7 @@ eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=User disabled by
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=User disabled by temporary lockout
 eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=User disabled by temporary lockout error
 userModelAttributeNameHelp=Name of the model attribute to be added when importing user from LDAP
-templateHelp=Template to use to format the username to import.  Substitutions are enclosed in ${}.  For example\: '${ALIAS}.${CLAIM.sub}'.  ALIAS is the provider alias.  CLAIM.<NAME> references an ID or Access token claim. The substitution can be converted to upper or lower case by appending |uppercase or |lowercase to the substituted value, for example, '${CLAIM.sub | lowercase}.
+templateHelp=Template to use to format the username to import. Substitutions are enclosed in ${}. For example\: '${ALIAS}.${CLAIM.sub}'. ALIAS is the provider alias. CLAIM.<NAME> references an ID or Access token claim. The substitution can be converted to upper or lower case by appending |uppercase or |lowercase to the substituted value, for example, '${CLAIM.sub | lowercase}.
 permissions=Permissions
 emptyExecutionInstructions=You can start defining this flow by adding a sub-flow or an execution
 offlineSessionSettings=Offline session settings
@@ -1349,6 +1359,7 @@ themeColorsLight=Theme colors [light]
 themeColorsDark=Theme colors [dark]
 themePreviewInfo=In order to preview the theme colors, the current themen needs to be set to the one you want to preview, so we have automatically switched you to the one you want to preview.
 backgroundImage=Login background image
+favicon=Favicon
 errorColor=Error color
 successColor=Success color
 activeColor=Active color
@@ -1380,26 +1391,27 @@ titleUsers=Users
 whoWillAppearLinkText=Who will appear in this group list?
 ldapFullNameAttribute=LDAP full name attribute
 createClientError=Could not create client\: '{{error}}'
-deleteConfirmClientScopes=Are you sure you want to delete this client scope
+deleteConfirmClientScopes=Are you sure you want to delete this client scope?
 forceAuthenticationHelp=Indicates whether the identity provider must authenticate the presenter directly rather than rely on a previous security context.
 testClusterAvailability=Test cluster availability
 reGenerateSigning=Regenerate signing key for this client
 authorizationEncryptedResponseAlgHelp=JWA Algorithm used for key management in encrypting the authorization response when the response mode is jwt. This option is needed if you want encrypted authorization response. If left empty, the authorization response is just signed, but not encrypted.
-deleteConfirmGroup_other=Are you sure you want to delete these groups.
+deleteConfirmGroup_other=Are you sure you want to delete these groups?
 scopePermissions.users.manage-description=Policies that decide if an administrator can manage all users in the realm
 defaultACRValuesHelp=Default values to be used as voluntary ACR in case that there is no explicit ACR requested by 'claims' or 'acr_values' parameter in the OIDC request.
 minimumACRValueHelp=Minimum ACR to be enforced by Keycloak. Overrides lower ACRs explicitly requested by 'acr_values' or 'claims', unless they are marked as essential.
 membershipAttributeType=Membership attribute type
 eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Pushed authorization request
-included.client.audience.tooltip=The Client ID of the specified audience client will be included in audience (aud) field of the token. If there are existing audiences in the token, the specified value is just added to them. It won't override existing audiences.
+included.client.audience.tooltip=The Client ID of the specified audience client will be included in the audience (aud) field of the token. If the token includes audiences, the specified value is added to them. It will not override existing audiences.
 searchGroup=Search group
 allowCreateHelp=Allow the external identity provider to create a new identifier to represent the principal.
 allResults=All results
-addressClaim.locality.tooltip=Name of User Attribute, which will be used to map to 'locality' subclaim inside 'address' token claim. Defaults to 'locality' .
-keyForCodeExchangeHelp=Choose which code challenge method for PKCE is used. If not specified, keycloak does not applies PKCE to a client unless the client sends an authorization request with appropriate code challenge and code exchange method.
+addressClaim.locality.tooltip=Name of User Attribute, which will be used to map to the 'locality' subclaim inside the 'address' token claim. Defaults to 'locality'.
+keyForCodeExchangeHelp=Choose which Proof Key for Code Exchange (PKCE) challenge method is used. If not specified, Keycloak does not apply PKCE to a client unless the client sends an authorization request with an appropriate code challenge and code exchange method.
 includeInAccessTokenResponse.tooltip=Should the claim be added to the access token response? Should only be used for informative and non-sensitive data
 removeMappingConfirm_one=Are you sure you want to remove this role?
 oidcSettings=OpenID Connect settings
+oAuthSettings=OAuth2 settings
 otpPolicyDigitsHelp=How many digits should the OTP have?
 clientAuthentications.client_secret_post=Client secret sent as post
 prompts.select_account=Select account
@@ -1489,7 +1501,7 @@ regexPatternHelp=Specifies the regex pattern.
 searchForUserEvent=Search user event
 usernameLdapAttributeHelp=Name of the LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it can be 'uid'. For Active directory it can be 'sAMAccountName' or 'cn'. The attribute should be filled for all LDAP user records you want to import from LDAP to Keycloak.
 federationLink=Federation link
-webAuthnPolicyPasswordlessFormHelp=Policy for passwordless WebAuthn authentication. This one will be used by 'Webauthn Register Passwordless' required action and 'WebAuthn Passwordless Authenticator' authenticator. Typical usage is, when WebAuthn will be used as first-factor authentication. Having both 'WebAuthn Policy' and 'WebAuthn Passwordless Policy' allows to use WebAuthn as both first factor and second factor authenticator in the same realm.
+webAuthnPolicyPasswordlessFormHelp=Policy for passwordless WebAuthn authentication. This policy is used by the 'Webauthn Register Passwordless' required action and 'WebAuthn Passwordless Authenticator' authenticator. A typical usage is when WebAuthn is used as first-factor authentication. Having both 'WebAuthn Policy' and 'WebAuthn Passwordless Policy' allows using WebAuthn as both first factor and second factor authenticator in the same realm.
 unlinkUsersError=Could not unlink users\: '{{error}}'
 roleHelpHelp=Role to grant to user. Click 'Select Role' button to browse roles, or just type it in the textbox. To reference an application role the syntax is appname.approle, i.e. myapp.myrole.
 storedTokensReadable=Stored tokens readable
@@ -1541,7 +1553,7 @@ providers=Add providers
 writeOnly=Write only
 noRolesInstructions-clientScopes=You haven't created any roles for this client scope. Create a role to get started.
 noRolesInstructions-clients=You haven't created any roles for this client scope. Create a role to get started.
-removeImportedUsersMessage=Do you really want to remove all imported users? The option "Unlink users" makes sense just for the Edit Mode "Unsynced" and there should be a warning that "unlinked" users without the password in Keycloak database won't be able to authenticate.
+removeImportedUsersMessage=Do you really want to remove all imported users?
 noGroupsInThisSubGroup=No groups in this sub group
 validateUserObjectClasses=You must enter one or more user object classes
 encryptionAlgorithm=Encryption Algorithm
@@ -1573,7 +1585,7 @@ signOut=Sign out
 deleteExecutorError=Could not delete executor\: {{error}}
 userProfileError=Could not update user profile settings\: {{error}}
 validatorDialogColNames.colName=Role name
-clientUpdaterSourceRolesTooltip=The condition is checked during client registration/update requests and it evaluates to true if the entity (usually user), who is creating/updating client is member of the specified role. For reference the realm role, you can use the realm role name like 'my_realm_role' . For reference client role, you can use the client_id.role_name for example 'my_client.my_client_role' will refer to client role 'my_client_role' of client 'my_client'.
+clientUpdaterSourceRolesTooltip=The condition is checked during client registration or update requests; it evaluates to true if the entity (usually a user) is creating or updating a client that belongs to the specified role. To reference the realm role, you can use a realm role name such as 'my_realm_role'. To reference a client role, you can use the client_id.role_name; for example, 'my_client.my_client_role' refers to the client role 'my_client_role' of client 'my_client'.
 UPDATE_PASSWORD=Update password (UPDATE_PASSWORD)
 version=Version
 synchronizationSettings=Synchronization settings
@@ -1615,8 +1627,9 @@ updateFirstLoginHelp=Update profile on first login
 deleteGroup=Delete group
 eventTypes.VERIFY_EMAIL_ERROR.description=Verify email error
 close=Close
-usersDNHelp=Full DN of LDAP tree where your users are. This DN is the parent of LDAP users. It could be for example 'ou\=users,dc\=example,dc\=com' assuming that your typical user will have DN like 'uid\='john',ou\=users,dc\=example,dc\=com'.
+usersDNHelp=Full DN of the LDAP tree where your users exist. This DN is the parent of LDAP users. It could be for example 'ou\=users,dc\=example,dc\=com' assuming that your typical user will have a DN such as 'uid\='john',ou\=users,dc\=example,dc\=com'.
 addKeycloakOpenIdProvider=Add Keycloak OpenID Connect provider
+addOAuth2Provider=Add OAuth v2 provider
 clientSessionMax=Client Session Max
 deleteClientPolicy=Delete client policy
 authenticatorAttachment.cross-platform=Cross platform
@@ -1642,15 +1655,15 @@ usersExplain=Users are the users in the current realm.
 passMaxAgeHelp=Pass max_age to identity provider.
 exportFail=Could not export realm\: '{{error}}'
 flowTypeHelp=What kind of form is it
-targetHelp=Destination field for the mapper. LOCAL (default) means that the changes are applied to the username stored in local database upon user import. BROKER_ID and BROKER_USERNAME means that the changes are stored into the ID or username used for federation user lookup, respectively.
+targetHelp=Destination field for the mapper. LOCAL (default) means that the changes are applied to the username stored in the local database upon user import. BROKER_ID and BROKER_USERNAME means that the changes are stored into the ID or username used for federation user lookup, respectively.
 setPasswordConfirm=Set password?
 attributeDisplayNameHelp=Display name for the attribute. Supports keys for localized values as well. For example\: ${profile.attribute.phoneNumber}. Hit the 'Globe Route' icon to add translations.
 assignedType=Assigned type
-modeHelp=LDAP_ONLY means that all group mappings of users are retrieved from LDAP and saved into LDAP. READ_ONLY is Read-only LDAP mode where group mappings are retrieved from both LDAP and DB and merged together. New group joins are not saved to LDAP but to DB. IMPORT is Read-only LDAP mode where group mappings are retrieved from LDAP just at the time when user is imported from LDAP and then they are saved to local keycloak DB.
+modeHelp=LDAP_ONLY means that all group mappings of users are retrieved from LDAP and saved into LDAP. READ_ONLY is Read-only LDAP mode where group mappings are retrieved from both LDAP and the database and they are merged together. New group joins are not saved to LDAP but to the database. IMPORT is Read-only LDAP mode where group mappings are retrieved from LDAP when the user is imported from LDAP and then they are saved to the local Keycloak database.
 identityProvider=Identity provider
-forgotPasswordHelpText=Show a link on login page for user to click when they have forgotten their credentials.
+forgotPasswordHelpText=Show a link on the login page for users who have forgotten their credentials.
 identityProviderLinks=Identity provider links
-mapperTypeMsadLdsUserAccountControlMapperHelp=Mapper specific to MSAD LDS. It's able to integrate the MSAD LDS user account state into Keycloak account state (account enabled, password is expired etc). It's using msDS-UserAccountDisabled and pwdLastSet is 0, the Keycloak user is required to update password, if msDS-UserAccountDisabled is 'TRUE' the Keycloak user is disabled as well etc. Mapper is also able to handle exception code from LDAP user authentication.
+mapperTypeMsadLdsUserAccountControlMapperHelp=Mapper specific to MSAD LDS. It is able to integrate the MSAD LDS user account state into the Keycloak account state (account enabled, password is expired, and others). It is able to read the 'msDS-UserAccountDisabled', 'msDS-UserPasswordExpired' and 'pwdLastSet' attributes for that. For example, if 'pwdLastSet' is 0, the Keycloak user is required to update the password. In another example, if 'msDS-UserAccountDisabled' is 'TRUE', the Keycloak user is disabled as well. This mapper is also able to handle exception codes from the LDAP user authentication.
 leave=Leave
 loginSettings=Login settings
 deleteMessageBundleError=Error removing the message from the bundle, {{error}}
@@ -1671,7 +1684,7 @@ openIDEndpointConfiguration=OpenID Endpoint Configuration
 oid4vcIssuerMetadata=OpenID4VCI Credential Issuer Metadata
 prompts.login=Login
 users=Users
-keyTabHelp=Location of Kerberos KeyTab file containing the credentials of server principal. For example, /etc/krb5.keytab
+keyTabHelp=Location of the Kerberos KeyTab file containing the credentials of the server principal. For example, /etc/krb5.keytab
 wantAssertionsEncrypted=Want Assertions encrypted
 noClientPoliciesInstructions=There are no client policies. Select 'Create client policy' to create a new client policy.
 deleteValidatorConfirmMsg=Are you sure you want to permanently delete the validator {{validatorName}}?
@@ -1685,11 +1698,11 @@ saveProviderError=Error saving provider\: {{error}}
 port=Port
 searchForPermission=Search for permission
 ldapFilterHelp=LDAP Filter adds an additional custom filter to the whole query for retrieve LDAP groups. Leave this empty if no additional filtering is needed and you want to retrieve all groups from LDAP. Otherwise make sure that filter starts with '(' and ends with ')'.
-clientUpdaterSourceGroupsTooltip=Name of groups to check. Condition evaluates to true if the entity, who creates/updates client is member of some of the specified groups. Configured groups are specified by their simple name, which must match to the name of the Keycloak group. No support for group hierarchy is used here.
+clientUpdaterSourceGroupsTooltip=Name of groups to check. The condition evaluates to true if the entity, who creates or updates client, is a member of one or more of the specified groups. The configured groups are specified by their simple name, which must match the name of the Keycloak group. No support for group hierarchy is used here.
 addRequestUri=Add valid request URIs
 selectACondition=Select a condition
 ldapAttributeValue=LDAP attribute value
-jwksUrlHelp=URL where identity provider keys in JWK format are stored. See JWK specification for more details. If you use external Keycloak identity provider, you can use URL like 'http\://broker-keycloak\:8180/realms/test/protocol/openid-connect/certs' assuming your brokered Keycloak is running on 'http\://broker-keycloak\:8180' and its realm is 'test' .
+jwksUrlHelp=URL where identity provider keys in JWK format are stored. See the JWK specification for more details. If you use an external Keycloak identity provider, you can use a URL such as 'http\://broker-keycloak\:8180/realms/test/protocol/openid-connect/certs' assuming your brokered Keycloak is running on 'http\://broker-keycloak\:8180' and its realm is 'test'.
 eventTypes.CLIENT_DELETE.description=Client delete
 emptyResources=No resources
 roleHelp=Role to grant to user if all attributes are present. Click 'Select Role' to browse roles, or just type it in the text box. To reference a client role, the syntax is clientname.clientrole, for example, myclient.myrole.
@@ -1706,10 +1719,10 @@ eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Identity provider link acc
 eventTypes.TOKEN_EXCHANGE.name=Token exchange
 skipped=Skipped
 eventTypes.RESTART_AUTHENTICATION.description=Restart authentication
-scopePermissions.users.manage-group-membership-description=Policies that decide if an administrator can manage group membership for all users in the realm.  This is used in conjunction with specific group policy
+scopePermissions.users.manage-group-membership-description=Policies that decide if an administrator can manage group membership for all users in the realm. This is used in conjunction with specific group policy
 loginTheme=Login theme
 eventTypes.UPDATE_PASSWORD_ERROR.description=Update password error
-deleteConfirmRealmSetting=If you delete this realm, all associated data will be removed.
+deleteConfirmRealmSetting=If you delete a realm, all associated data will be removed.
 scope=Scope
 evaluateExplain=This page allows you to see all protocol mappers and role scope mappings
 providerCreateError=Could not create client policy due to {{error}}
@@ -1731,7 +1744,7 @@ eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Execute action token error
 eventTypes.USER_INFO_REQUEST_ERROR.description=User info request error
 policyRoles=Specifies the client roles allowed by this policy.
 roleMapping=Role mapping
-accountLinkingOnlyHelp=If true, users cannot log in through this provider.  They can only link to this provider.  This is useful if you don't want to allow login from the provider, but want to integrate with a provider.
+accountLinkingOnlyHelp=If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't want to allow login from the provider, but want to integrate with a provider.
 refreshTokenMaxReuseHelp=Maximum number of times a refresh token can be reused. When a different token is used, revocation is immediate.
 eventTypes.REMOVE_FEDERATED_IDENTITY.description=Remove federated identity
 childGroups=Child groups
@@ -1750,7 +1763,7 @@ signingKeysConfigExplain=If you enable the "Client signature required" below, yo
 newClientProfile=Create client profile
 consoleDisplayConnectionUrlHelp=Connection URL to your LDAP server
 enabledWhen=Enabled when
-enabledWhenTooltip=Specifies when attribute is available. When scopes are used, attribute is available when at least one of configured scopes is applied in the login request. Both default and optional scopes of current request are evaluated. In the admin console and account console contexts, scopes are not evaluated and attribute is always available (if not further restricted by permissions).
+enabledWhenTooltip=Specifies when the attribute is available. When scopes are used, the attribute is available when at least one of the configured scopes is applied in the login request. Both default and optional scopes of the current request are evaluated. In the Admin Console and Account Console contexts, scopes are not evaluated and the attribute is always available (if not further restricted by permissions).
 clientAssertionSigningAlg=Client assertion signature algorithm
 homeURLHelp=Default URL to use when the auth server needs to redirect or link back to the client.
 ldapAttribute=LDAP attribute
@@ -1773,7 +1786,7 @@ inputTypeStep=Input step size
 mapperTypeHelp=Used to map single attribute from LDAP user to attribute of UserModel in Keycloak database
 importWarning=The data and settings imported above may overwrite the data and settings that already exist.
 kerberosRequiredSettingsDescription=This section contains a few basic options common to all user storage providers.
-resetPasswordFor=Reset password for {{username}}
+resetPasswordFor=Set password for {{username}}
 duplicateEmailsAllowed=Duplicate emails
 deleteEventsConfirm=If you clear all events of this realm, all records will be permanently cleared in the database
 noGroupsInThisRealmInstructions=You haven't created any groups in this realm. Create a group to get started.
@@ -1782,7 +1795,7 @@ groupUpdateError=Error updating group {{error}}
 logoutAllSessions=Logout all sessions
 membershipUserLdapAttribute=Membership user LDAP attribute
 noKeysDescription=You haven't created any active keys
-rememberMeHelpText=Show checkbox on login page to allow user to remain logged in between browser restarts until session expires.
+rememberMeHelpText=Show checkbox on the login page to allow the user to remain logged in between browser restarts until the session expires.
 eventTypes.UPDATE_EMAIL.name=Update email
 notBeforeHelp=Revoke any tokens issued before this time for this client. To push the policy, you should set an effective admin URL in the Settings tab first.
 protocolTypes.saml=SAML
@@ -1861,7 +1874,7 @@ always=Always
 pkceEnabledHelp=Use PKCE (Proof of Key-code exchange) for IdP Brokering
 settings=Settings
 webAuthnPolicyUserVerificationRequirement=User verification requirement
-failureFactorHelp=How many failures before wait is triggered.
+failureFactorHelp=Number of failures before wait is triggered.
 unlinkAccountTitle=Unlink account from {{provider}}?
 noNodes=No nodes registered
 singleLogoutServiceUrlHelp=The Url that must be used to send logout requests.
@@ -1872,7 +1885,7 @@ noSessions=No sessions
 clipboardCopyError=Error copying to clipboard.
 storeTokens=Store tokens
 usermodel.clientRoleMapping.rolePrefix.tooltip=A prefix which will be prepended to each Client Role name (optional).
-deleteConfirmCurrentUser=Are you sure you want to permanently delete this user
+deleteConfirmCurrentUser=Are you sure you want to permanently delete this user?
 eventTypes.CLIENT_REGISTER_ERROR.description=Client register error
 addClientScopesTo=Add client scopes to {{clientName}}
 x509=X.509 Subject Name
@@ -1882,7 +1895,7 @@ Sunday=Sunday
 editMode=Edit mode
 updatePasswordPolicySuccess=Password policies successfully updated
 passwordHelp=SMTP password. This field is able to obtain its value from vault, use ${vault.ID} format.
-clientUpdaterContext=The condition checks the context how is client created/updated to determine whether the policy is applied. For example it checks if client is created with admin REST API or OIDC dynamic client registration. And for the letter case if it is ANONYMOUS client registration or AUTHENTICATED client registration with Initial access token or Registration access token and so on.
+clientUpdaterContext=The condition checks the context of how the client is created or updated to determine whether the policy is applied. For example, it checks if the client is created with admin REST API or OIDC dynamic client registration. For the latter case, it checks if it is an ANONYMOUS client registration or an AUTHENTICATED client registration with Initial access token or Registration access token and so on.
 removedGroupMembership=Removed group membership
 deleteScopeWarning=The permissions below will be removed when they are no longer used by other authorization scopes\:
 compositeRoleOff=Composite role turned off
@@ -1940,9 +1953,9 @@ allowPasswordAuthentication=Allow password authentication
 federationLinkHelp=UserStorageProvider this locally stored user was imported from.
 validateUsernameLDAPAttribute=You must enter a username LDAP attribute
 pairwiseSubAlgorithmSalt.tooltip=Salt used when calculating the pairwise subject identifier. If left blank, a salt will be generated.
-waitIncrementSecondsHelp=When failure threshold has been met, how much time should the user be locked out?
+waitIncrementSecondsHelp=When the failure threshold is met, how long should the user be locked out?
 allowKerberosAuthentication=Allow Kerberos authentication
-addressClaim.formatted.tooltip=Name of User Attribute, which will be used to map to 'formatted' subclaim inside 'address' token claim. Defaults to 'formatted' .
+addressClaim.formatted.tooltip=Name of the User Attribute to use for mapping to the 'formatted' subclaim inside the 'address' token claim. Defaults to 'formatted'.
 predefinedMappingDescription=Choose any of the predefined mappings from this table
 allowedClockSkew=Allowed clock skew
 privateRSAKey=Private RSA Key
@@ -1956,7 +1969,7 @@ addIdpMapperNameHelp=Name of the mapper.
 requirements.ALTERNATIVE=Alternative
 claimFilterValueHelp=Value of the essential claim (with regex support)
 credentialResetConfirm=Send Email
-permissionsEnabledHelp=Determines if fine grained permissions are enabled for managing this role.  Disabling will delete all current permissions that have been set up.
+permissionsEnabledHelp=Determines if fine grained permissions are enabled for managing this role. Disabling deletes all current permissions.
 consentScreenTextHelp=Text that will be shown on the consent screen when this client scope is added to some client with consent required. Defaults to name of client scope if it is not filled.
 realmRolesList=Realm roles
 roleList=Role list
@@ -1998,7 +2011,7 @@ principalAttributeHelp=Name or Friendly Name of the attribute used to identify e
 nameIdPolicyFormat=NameID policy format
 idpInitiatedSsoUrlName=IDP-Initiated SSO URL name
 selectMethod=Select method
-deleteConfirmExecution=Delete execution?
+deleteConfirmExecution=Delete flow {{name}}?
 eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Validate access token error
 xFrameOptions=X-Frame-Options
 scopeDescriptionHelp=Description of the client scope
@@ -2014,6 +2027,7 @@ SSOSessionIdleRememberMe=SSO Session Idle Remember Me
 cibaBackchannelTokenDeliveryModeHelp=Specifies how the CD (Consumption Device) gets the authentication result and related tokens. This mode will be used by default for the CIBA clients, which do not have other mode explicitly set.
 eventTypes.REGISTER_NODE.description=Register node
 supported=Supported
+deprecated=Deprecated
 deleteAttributeText=Delete an attribute
 deleteNodeSuccess=Node successfully removed
 includeInIntrospection.label=Add to token introspection
@@ -2033,7 +2047,8 @@ eventTypes.UPDATE_TOTP_ERROR.description=Update totp error
 titleEvents=Events
 signServiceProviderMetadata=Sign service provider metadata
 updateClientPoliciesError=Could not update client policies\: {{error}}
-acceptsPromptNoneHelp=This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt\=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt\=none will be forwarded to this identity provider.
+acceptsPromptNoneHelp=This is used only together with the Identity Provider Authenticator or when kc_idp_hint points to this identity provider. If that client sends a request with prompt\=none and the user is not authenticated, the error is not directly returned to the client; the request with prompt\=none is forwarded to this identity provider.
+requiresShortStateParameterHelp=This switch needs to be enabled if identity provider does not support long value of the 'state' parameter sent in the initial OIDC/OAuth2 authentication request (EG. more than 100 characters). In this case, Keycloak will try to make shorter 'state' parameter and may omit some client data to be sent in the initial request. This may result in the limited functionality in some very corner case scenarios (EG. in case that IDP redirects to Keycloak with the error in the OIDC authentication response, Keycloak might need to display error page instead of being able to redirect to the client in case that login session is expired).
 roleDetails=Role details
 eventTypes.USER_INFO_REQUEST.name=User info request
 clientScopeType.none=None
@@ -2047,10 +2062,10 @@ addGroups=Add groups
 offlineSessionIdle=Offline Session Idle
 mapperAttributeFriendlyName=Friendly name
 addProvider=Add provider
-readOnlyHelp=Read-only attribute is imported from LDAP to UserModel, but it's not saved back to LDAP when user is updated in Keycloak.
+readOnlyHelp=Read-only attribute that is imported from LDAP to UserModel but is not saved back to LDAP when the user is updated in Keycloak.
 resourceDeletedError=Could not remove the resource {{error}}
 backchannelLogoutUrl=Backchannel logout URL
-requestObjectEncodingHelp=JWE algorithm, which client needs to use when encrypting the content of the OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', any algorithm is allowed.
+requestObjectEncodingHelp=JWE algorithm, which the client needs to use when encrypting the content of the OIDC request object specified by the 'request' or 'request_uri' parameters. If set to 'any', any algorithm is allowed.
 minimumQuickLoginWaitSeconds=Minimum quick login wait
 duplicate=Duplicate
 clientAccesstype=Client Access Type
@@ -2078,7 +2093,7 @@ show=Show
 description=Description
 alwaysReadValueFromLdap=Always read value from LDAP
 searchUserEventsBtn=Search events
-addressClaim.postal_code.tooltip=Name of User Attribute, which will be used to map to 'postal_code' subclaim inside 'address' token claim. Defaults to 'postal_code' .
+addressClaim.postal_code.tooltip=Name of User Attribute, which will be used to map to the 'postal_code' subclaim inside the 'address' token claim. Defaults to 'postal_code'.
 generatedUserInfoNo=No generated user info
 allowed-client-scopes.label=Allowed Client Scopes
 providerId=Provider ID
@@ -2093,7 +2108,7 @@ tableView=Table view
 addClientProfile=Add client profile
 maxFailureWaitSeconds=Max wait
 userEventsRegistered=User events registered
-renameAGroup=Rename group
+editGroup=Edit group
 eventConfigError=Could not save event configuration\: {{error}}
 confirmAccessTokenTitle=Regenerate registration access token?
 target=Target
@@ -2125,7 +2140,7 @@ issuer=Issuer
 policyEnforcementModeHelp=The policy enforcement mode dictates how policies are enforced when evaluating authorization requests. 'Enforcing' means requests are denied by default even when there is no policy associated with a given resource. 'Permissive' means requests are allowed even when there is no policy associated with a given resource. 'Disabled' completely disables the evaluation of policies and allows access to any resource.
 selectAUser=Select a user
 groupCreated=Group created
-generateError=Could not generate new key pair and certificate {{error}}
+generateError=Could not generate a new key pair and certificate {{error}}
 testClusterSuccess=Successfully verified availability for\: {{successNodes}}
 whoWillAppearLinkTextRoles=Who will appear in this user list?
 attestationPreference.not\ specified=Not specified
@@ -2134,7 +2149,6 @@ targetClaim=Target claim
 assignRole=Assign role
 accessSettings=Access settings
 updateFlowSuccess=Flow successfully updated
-xXSSProtectionHelp=This header configures the Cross-site scripting (XSS) filter in your browser. Using the default behaviour, the browser will prevent rendering of the page when a XSS attack is detected. <1>Learn more</1>
 authenticatedAccessPolicies=Authenticated access polices
 addExecutor=Add executor
 selectIfResourceExists=If a resource already exists, specify what should be done
@@ -2144,13 +2158,13 @@ trustEmail=Trust Email
 credentialReset=Credentials Reset
 eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Custom required action error
 deleteValidatorConfirmTitle=Delete validator?
-claimJsonType=JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values.
+claimJsonType=JSON type that should be used to populate the JSON claim in the token. Valid values are long, int, boolean, String, and JSON.
 kc.client.network.ip_address=Client IPv4 Address
 signatureAndEncryption=Signature and Encryption
 reset=Reset
 hardcodedUserSessionAttribute=When a user is imported from a provider, hardcode a value to a specific user session attribute.
 conditionType=Condition type
-multiValued=Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim
+multiValued=Indicates if this attribute supports multiple values. If true, the list of all values of this attribute are set as claim. If false, only the first value is set as claim.
 browse=Browse
 duplicateEmailsHelpText=Allow multiple users to have the same email address. Changing this setting will also clear the user's cache. It is recommended to manually update email constraints of existing users in the database after switching off support for duplicate email addresses.
 importOverwritten_zero=No records overwritten.
@@ -2188,6 +2202,7 @@ rootUrl=Root URL
 realmExplain=A realm manages a set of users, credentials, roles, and groups. A user belongs to and logs into a realm. Realms are isolated from one another and can only manage and authenticate the users that they control.
 inputHelperTextBefore=Helper text (above) the input field
 webAuthnPolicyExtraOrigins=Extra Origins
+webAuthnPolicyPasskeysEnabled=Enable Passkeys
 samlSignatureKeyName=SAML signature key name
 validateUsersDn=You must enter users DN
 importError=Could not import certificate {{error}}
@@ -2195,7 +2210,7 @@ logicType.negative=Negative
 otpPolicy=OTP Policy
 noRolesInstructions-groups=You haven't created any roles for this group. Create a role to get started.
 cibaBackchannelTokenDeliveryMode=Backchannel Token Delivery Mode
-validateAttributeName=Attribute configuration without name is not allowed.
+validateAttributeName=Attribute configuration without a name is not allowed.
 eventTypes.RESET_PASSWORD_ERROR.description=Reset password error
 addUser=Add user
 eventTypes.REGISTER.description=Register
@@ -2205,7 +2220,7 @@ iconUriHelp=A URI pointing to an icon.
 eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=OAuth2 device verify user code
 protocol=Protocol
 permissionsScopeName=Scope-name
-validPostLogoutRedirectURIsHelp=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' or an empty field will use the list of valid redirect uris. A value of '-' will not allow any post logout redirect uris. Simple wildcards are allowed such as 'http\://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used.
+validPostLogoutRedirectURIsHelp=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' or an empty field uses the list of valid redirect URIs. A value of '-' does not allow any post logout redirect URIs. Simple wildcards are allowed such as 'http\://example.com/*'. A relative path can be specified too, such as /my/relative/path/*. Relative paths are relative to the client root URL; if none is specified, the auth server root URL is used.
 manageAccount=Manage account
 oauthDeviceAuthorizationGrant=OAuth 2.0 Device Authorization Grant
 copyFlowError=Could not duplicate flow\: {{error}}
@@ -2239,21 +2254,21 @@ noRoles-clients=No roles for this client scope
 deleteFlowError=Could not delete flow\: {{error}}
 eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Identity provider post login
 roleImportError=Could not import role
-regexAttributeValuesHelp=If enabled attribute values are interpreted as regular expressions.
+regexAttributeValuesHelp=If enabled, attribute values are interpreted as regular expressions.
 userCreated=The user has been created
 residentKey.not\ specified=Not specified
 clientUpdaterSourceHost=The condition checks the host/domain of the entity who tries to create/update the client to determine whether the policy is applied.
-alwaysReadValueFromLdapHelp=If on, then during reading of the LDAP attribute value will always used instead of the value from Keycloak DB.
-usermodel.clientRoleMapping.tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name like 'address.street'. In this case, a nested json object will be created. To prevent nesting and use dot literally, escape the dot with backslash (\\.). The special token ${client_id} can be used and this will be replaced by the actual client ID. Example usage is 'resource_access.${client_id}.roles'. This is useful especially when you are adding roles from all the clients (Hence 'Client ID' switch is unset) and you want client roles of each client stored separately.
+alwaysReadValueFromLdapHelp=If on, then during reading of the LDAP attribute value will always be used instead of the value from Keycloak database.
+usermodel.clientRoleMapping.tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and to use the dot literally, escape the dot with a backslash (\\.). You can use the special token ${client_id}; it will be replaced by the actual client ID. An example usage is 'resource_access.${client_id}.roles'. This option is especially useful when you add roles from all the clients, meaning 'Client ID' is disabled, and you want client roles of each client stored separately.
 scopePermissions.clients.map-roles-description=Policies that decide if an administrator can map roles defined by this client
 signAssertions=Sign assertions
-disableUserInfoHelp=Disable usage of User Info service to obtain additional user information?  Default is to use this OIDC service.
+disableUserInfoHelp=Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
 xFrameOptionsHelp=Default value prevents pages from being included by non-origin iframes. <1>Learn more</1>
 copyError=Error copying authorization details\: {{error}}
 validateSignatures=Enable/disable signature validation of SAML responses.
 authentication=Authentication
 eventTypes.DELETE_ACCOUNT.name=Delete account
-logoutUrlHelp=End session endpoint to use to logout user from external IDP.
+logoutUrlHelp=End session endpoint to use to log out the user from the external IDP.
 noUserDetails=No user details
 sync-ldap-groups-to-keycloak=Sync LDAP groups to Keycloak
 attestationPreference.indirect=Indirect
@@ -2280,33 +2295,32 @@ rootURLHelp=Root URL appended to relative URLs
 anonymousAccessPolicies=Anonymous access polices
 createResourceBasedPermission=Create resource-based permission
 searchForRole=Search role
-xXSSProtection=X-XSS-Protection
 debugHelp=Enable/disable debug logging to standard output for Krb5LoginModule.
 validatorColNames.colConfig=Config
 createClient=Create client
 inputTypeRows=Input rows
 eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Identity provider first login
 usedMemory=Used memory
-validatePasswordPolicyHelp=Determines if Keycloak should validate the password with the realm password policy before updating it. For the case when user's password is saved in LDAP, some Keycloak password policies will not work (Not Recently Used, Expire Password, Hashing Iterations, Hashing Algorithm) due the fact that Keycloak does not have direct control over the password storage. It is needed to enable password policies at the LDAP server layer if you want to leverage those password policies.
+validatePasswordPolicyHelp=Determines if Keycloak should validate the password with the realm password policy before updating it. When the user's password is saved in LDAP, some Keycloak password policies do not work: Not Recently Used, Expire Password, Hashing Iterations, and Hashing Algorithm. This situation occurs because Keycloak does not have direct control over the password storage. if you want to use those policies, enable password policies at the LDAP server layer.
 bruteForceModeHelpText=If enabled, specify what should happen to the user account if a brute force attack is detected.
 quickLoginCheckMilliSeconds=Quick login check milliseconds
 createResourceSuccess=Resource created successfully
 documentation=Documentation
-fullNameLdapReadOnlyHelp=For Read-only, data is imported from LDAP to Keycloak DB, but it's not saved back to LDAP when the user is updated in Keycloak.
+fullNameLdapReadOnlyHelp=For Read-only, data is imported from LDAP to the Keycloak database, but it is not saved back to LDAP when the user is updated in Keycloak.
 roleExplain=Realm roles are the roles that you define for use in the current realm.
 whatIsDefaultGroups=What is the function of default groups?
 transient=Transient
 generalSettings=General settings
 addClientProfileError=Could not create client profile\: '{{error}}'
 overallResults=Overall Results
-requiredUserActionsHelp=Require an action when the user logs in. 'Verify email' sends an email to the user to verify their email address. 'Update profile' requires user to enter in new personal information. 'Update password' requires user to enter in a new password. 'Configure OTP' requires setup of a mobile password generator.
-requestObjectSignatureAlgorithmHelp=JWA algorithm, which client needs to use when sending OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', Request object can be signed by any algorithm (including 'none' ).
+requiredUserActionsHelp=Require an action when the user logs in. 'Verify email' sends an email to the user to verify that user's email address. 'Update profile' requires the user to enter new personal information. 'Update password' requires the user to enter a new password. 'Configure OTP' requires setup of a mobile password generator.
+requestObjectSignatureAlgorithmHelp=JWA algorithm, which the client needs to use when sending an OIDC request object specified by the 'request' or 'request_uri' parameters. If set to 'any', the Request object can be signed by any algorithm (including 'none').
 ldapKerberosSettingsDescription=This section contains options useful for the Kerberos integration. This is used only when the LDAP server is used together with Kerberos/SPNEGO for user authentication.
 deleteEvents=Clear events
 termsOfServiceUrlHelp=URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service
 clientSecretError=Could not regenerate client secret due to\: {{error}}
 resourcePath=Resource path
-useJwksUrlHelp=If the switch is on, identity provider public keys will be downloaded from given JWKS URL. This allows great flexibility because new keys will be always re-downloaded again when identity provider generates new keypair. If the switch is off, public key (or certificate) from the Keycloak DB is used, so when the identity provider keypair changes, you always need to import the new key to the Keycloak DB as well.
+useJwksUrlHelp=If the switch is ON, identity provider public keys are downloaded from a given JWKS URL. The result is great flexibility because new keys are downloaded again when the identity provider generates a new keypair. If the switch is OFF, a public key (or certificate) from the Keycloak database is used; therefore, when the identity provider keypair changes, you again need to import the new key to the Keycloak database.
 mapperTypeHardcodedAttributeMapperHelp=This mapper will hardcode any model user attribute and some property (like emailVerified or enabled) when importing user from LDAP.
 downloadAdaptorTitle=Download adaptor configs
 client-roles.label=Client Roles
@@ -2329,7 +2343,7 @@ userVerify.discouraged=Discouraged
 ldapRolesDn=LDAP roles DN
 displayOnClientHelp=Applicable only if 'Consent Required' is on for this client. If this switch is off, the consent screen will contain just the consents corresponding to configured client scopes. If on, there will be also one item on the consent screen about this client itself.
 requestObjectRequired=Request object required
-protocolHelp=Which SSO protocol configuration is being supplied by this client scope
+protocolHelp=SSO protocol configuration supplied by this client scope
 prompts.none=None
 resourcesHelp=Specifies that this permission must be applied to a specific resource instance.
 passwordConfirmation=Password confirmation
@@ -2345,7 +2359,7 @@ isMandatoryInLdap=Is mandatory in LDAP
 discoveryEndpoint=Discovery endpoint
 claimValue=Claim Value
 eventTypes.FEDERATED_IDENTITY_LINK.name=Federated identity link
-authenticationHelp=This defines the type of the OIDC client. When it's ON, the OIDC type is set to confidential access type. When it's OFF, it is set to public access type.
+authenticationHelp=This switch defines the type of OIDC client. When it is ON, the type is confidential access. When it is OFF, the type is public access.
 deleteClientConditionError=Error creating condition\: {{error}}
 noMappers=No Mappers
 couldNotLinkIdP=Could not link identity provider {{error}}
@@ -2388,7 +2402,7 @@ validateName=You must enter a name
 flowDetails=Flow details
 never=Never
 includeInIntrospection.tooltip=Should the claim be added to the token introspection?
-addressClaim.region.tooltip=Name of User Attribute, which will be used to map to 'region' subclaim inside 'address' token claim. Defaults to 'region' .
+addressClaim.region.tooltip=Name of User Attribute, which will be used to map to 'region' subclaim inside 'address' token claim. Defaults to 'region'.
 IDK-periodicChangedUsersSyncHelp=Should newly created users be created within LDAP store? Priority affects which provider is chosen to sync the new user.
 logoutServiceArtifactBindingUrlHelp=SAML ARTIFACT Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.
 claimToRole=If a claim exists, grant the user the specified realm or client role.
@@ -2425,7 +2439,7 @@ authorizationSignedResponseAlgHelp=JWA algorithm used for signing authorization
 associatedRolesRemoved=Associated roles have been removed
 keyAliasHelp=Alias for the private key
 whoWillAppearLinkTextUsers=Who will appear in this group list?
-tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name like 'address.street'. In this case, a nested json object will be created. To prevent nesting and use dot literally, escape the dot with backslash (\\.).
+tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\\.).
 userName=Username
 clientProfileDescription=Description
 ellipticCurveHelp=Elliptic curve used in ECDSA
@@ -2444,17 +2458,18 @@ realm=Realm
 attributeConsumingServiceIndex=Attribute Consuming Service Index
 prompt=Prompt
 assign=Assign
-disableConfirmRealm=User and clients can't access the realm if it's disabled. Are you sure you want to continue?
+disableConfirmRealm=Users and clients cannot access the realm if it is disabled. Are you sure you want to continue?
 showAuthData=Show authorization data
 includeInUserInfo.tooltip=Should the claim be added to the userinfo?
 select=Select
 signature-algorithm=JWA algorithm, which the client needs to use when signing a JWT for authentication. If left blank, the client is allowed to use any appropriate algorithm for the particular client authenticator.
 advanced=Advanced
 initialCounter=Initial counter
-revokeRefreshTokenHelp=If enabled a refresh token can only be used up to 'Refresh Token Max Reuse' and is revoked when a different token is used. Otherwise refresh tokens are not revoked when used and can be used multiple times.
+revokeRefreshTokenHelp=If enabled, a refresh token can only be used up to 'Refresh Token Max Reuse' and it is revoked when a different token is used. Otherwise, refresh tokens are not revoked when used and can be used multiple times.
 nameField=Name
-ownerManagedAccessHelp=If enabled, the access to this resource can be managed by the resource owner.
+ownerManagedAccessHelp=If enabled, access to this resource can be managed by the resource owner.
 useLowerCaseBearerTypeHelp=If this is on, token responses will be set the with the type "bearer" in lower-case. By default, the server sets the type as "Bearer" as defined by RFC6750.
+useRfc9068AccessTokenTypeHelp=If enabled, access tokens will get header type "at+jwt" in compliance with RFC9068. Otherwise, the header type will be "JWT".
 addCondition=Add condition
 updateSuccessClientScope=Client scope updated
 connectionAndAuthentication=Connection & Authentication
@@ -2479,7 +2494,7 @@ inputOptionLabelsI18nPrefix=Internationalization key prefix
 enabledHelp=Set if the keys are enabled
 nameHintHelp=A unique name for the group. This name will be used to reference the group when binding an attribute to a group.
 admin-events-cleared-error=Could not clear the admin events {{error}}
-usersPermissionsHint=Fine grained permissions for managing all users in realm.  You can define different policies for who is allowed to manage users in the realm.
+usersPermissionsHint=Fine grained permissions for managing all users in realm. You can define different policies for who is allowed to manage users in the realm.
 isBinaryAttribute=Is binary attribute
 clientScopeList=Client scopes
 noValidMetaDataFound=No valid metadata was found at this URL\: '{{error}}'
@@ -2505,10 +2520,9 @@ eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=OAuth2 device verify
 eventTypes.EXECUTE_ACTIONS_ERROR.description=Execute actions error
 SKIP=Skip
 eventTypes.INTROSPECT_TOKEN.description=Introspect token
-infoEnabledFeatures=Shows enabled preview and experimental features.
+infoEnabledFeatures=Shows all enabled features.
 displayOrderHelp=Number defining the order of the providers in GUI (for example, on the Login page). The lowest number will be applied first.
 deleteCredentialsConfirm=Are you sure you want to delete these users credentials?
-requiredClientScope=Please add at least one client scope.
 keysIntro=If "Use JWKS URL switch" is on, you need to fill a valid JWKS URL. After saving, admin can download keys from the JWKS URL or keys will be downloaded automatically by Keycloak server when an unknown KID is seen during client authentication.
 logoutServiceArtifactBindingUrl=Logout Service ARTIFACT Binding URL
 passwordPoliciesHelp.lowerCase=The number of lowercase letters required in the password string.
@@ -2525,7 +2539,7 @@ frontchannelLogoutHelp=When true, logout requires a browser redirect to client.
 frontchannelLogoutOIDCHelp=When true, logout requires a browser to send the request to the client to configured Front-channel logout URL as specified in the OIDC Front-channel logout specification. When false, server can perform a background invocation for logout as long as either the Backchannel-logout URL is configured or Admin URL is configured.
 updateSuccess=Provider successfully updated
 hide=Hide
-isMandatoryInLdapHelp=If true, attribute is mandatory in LDAP. Hence if there is no value in Keycloak DB, the empty value will be set to be propagated to LDAP.
+isMandatoryInLdapHelp=If true, this attribute is mandatory in LDAP. If no value exists in the Keycloak database, the empty value is propagated to LDAP.
 client-accesstype.label=Client Access Type
 eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Identity provider post login error
 skipCustomizationAndFinish=Skip customization and finish
@@ -2622,6 +2636,7 @@ eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Client initiated account
 annotationsText=Annotations
 ldapAttributeName=LDAP attribute name
 acceptsPromptNone=Accepts prompt\=none forward from client
+requiresShortStateParameter=Requires short state parameter
 loginThemeHelp=Select theme for login, OTP, grant, registration and forgot password pages.
 AESKeySizeHelp=Size in bytes for the generated AES key. Size 16 is for AES-128, Size 24 for AES-192, and Size 32 for AES-256. WARN\: Bigger keys than 128 are not allowed on some JDK implementations.
 client-accesstype.tooltip=Access Type of the client, for which the condition will be applied. Confidential client has enabled client authentication when public client has disabled client authentication. Bearer-only is a deprecated client type.
@@ -2643,11 +2658,11 @@ authnContextClassRefs=AuthnContext ClassRefs
 deleteCredentialsSuccess=The credentials has been deleted successfully.
 eventTypes.PERMISSION_TOKEN_ERROR.name=Permission token error
 userProfileSuccess=User profile settings successfully updated.
-attributeDefaultValueHelp=If there is no value in Keycloak DB and attribute is mandatory in LDAP, this value will be propagated to LDAP.
+attributeDefaultValueHelp=If no value exists in the Keycloak database and the attribute is mandatory in LDAP, this value is propagated to LDAP.
 cibaPolicy=CIBA Policy
 Saturday=Saturday
 importSkipped_other={{count}} records skipped.
-membershipAttributeTypeHelp=DN means that LDAP group has it's members declared in form of their full DN. For example 'member\: uid\=john,ou\=users,dc\=example,dc\=com'. UID means that LDAP group has it's members declared in form of pure user uids. For example 'memberUid\: john'.
+membershipAttributeTypeHelp=DN means that the LDAP group members are declared in their full DN form. For example, 'member\: uid\=john,ou\=users,dc\=example,dc\=com'. UID means that the LDAP group members are declared in pure user uid form, such as 'memberUid\: john'.
 unsavedChangesTitle=Unsaved changes
 emptyResourcesInstructions=If you want to create a resource, please click the button below.
 save-user-eventsHelp=If enabled, user events are saved to the database, which makes events available to the admin and account management UIs.
@@ -2696,7 +2711,7 @@ excludeIssuerFromAuthenticationResponse=Exclude Issuer From Authentication Respo
 minus=Minus
 groupsHelp=Groups where the user has membership. To leave a group, click the cross button.
 includeGroupsAndRoles=Include groups and roles
-groupsPermissionsHint=Determines if fine grained permissions are enabled for managing this role.  Disabling will delete all current permissions that have been set up.
+groupsPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
 searchForTranslation=Search for translation
 offlineSessionMaxHelp=Max time before an offline session is expired regardless of activity.
 resourceSaveError=Could not persist resource due to {{error}}
@@ -2825,6 +2840,7 @@ eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2 device code to token
 searchGroups=Search groups
 trusted-hosts.tooltip=List of Hosts, which are trusted and are allowed to invoke Client Registration Service and/or be used as values of Client URIs. You can use hostnames or IP addresses. If you use star at the beginning (for example '*.example.com' ) then whole domain example.com will be trusted.
 disableNonceHelp=Do not send the nonce parameter in the authentication request. The nonce parameter is sent and verified by default.
+disableTypeClaimCheckHelp=Disables the validation of the `typ` claim of tokens received from the Identity Provider. If this is `off` the type claim is validated (default).
 deleteClientProfile=Delete this client profile
 none=None
 type=Type
@@ -2849,7 +2865,7 @@ push=Push
 targetClaimHelp=Specifies the target claim which the policy will fetch.
 periodicFullSyncHelp=Whether periodic full synchronization of LDAP users to Keycloak should be enabled or not
 client-attributes-condition.tooltip=Client attributes, that will be checked during this condition evaluation. Condition evaluates to true if the client has all client attributes with the name and value as the client attributes specified in the configuration.
-scopePermissions.users.user-impersonated-description=Policies that decide which users can be impersonated.  These policies are applied to the user being impersonated.
+scopePermissions.users.user-impersonated-description=Policies that decide which users can be impersonated. These policies are applied to the user being impersonated.
 forceNameIdFormat=Force name ID format
 noMappersInstructions=There are currently no mappers for this identity provider.
 deleteConfirmFlow=Delete flow?
@@ -2880,6 +2896,7 @@ emptyPermissionInstructions=If you want to create a permission, please click the
 webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Avoid registering an authenticator that has already been registered.
 memberofLdapAttribute=Member-of LDAP attribute
 supportedLocales=Supported locales
+invalidLocale=Invalid locale selected
 showPasswordDataValue=Value
 webAuthnPolicyAttestationConveyancePreference=Attestation conveyance preference
 copyOf=Copy of {{name}}
@@ -2961,6 +2978,7 @@ offlineSessionMax=Offline Session Max
 generatedUserInfoHelp=See the example User Info, which will be provided by the User Info Endpoint.
 dynamicScopeFormat=Dynamic scope format
 webAuthnPolicyExtraOriginsHelp=The list of extra origins for non-web applications.
+webAuthnPolicyPasskeysEnabledHelp=Enable passkeys (conditional UI) authentication in the username forms.
 updatePermissionSuccess=Successfully updated the permission
 idpLinkSuccess=Identity provider has been linked
 removeAnnotationText=Remove annotation
@@ -3060,21 +3078,21 @@ joinCommunity=Join community
 readBlog=Read blog
 customValue=Custom value
 termsAndConditionsUserAttribute=Terms and conditions accepted timestamp
-realmOverridesDescription= Realm overrides allow you to specify translations that will take effect for the entire realm. These translations will override any translation specified by a theme.
+realmOverridesDescription=Realm overrides allow you to specify translations that will take effect for the entire realm. These translations will override any translation specified by a theme.
 addTranslation=Add translation
 effectiveMessageBundlesDescription=An effective message bundle is the set of translations for a given language, theme, and theme type. It also takes into account any realm overrides, which will take precedence.
 clientsClientScopesHelp=The scopes associated with this resource.
 searchItem=Search item
 createItem=Create item
 itemDelete=Delete item
-itemDeleteConfirm=Are you sure you want to permanently delete the item
+itemDeleteConfirm=Are you sure you want to permanently delete the item?
 itemDeleteConfirmTitle=Delete item?
 itemDeletedSuccess=The item has been deleted
 itemDeleteError=Could not delete item: {{error}}
 noItems=There are no items
-noItemsInstructions=You haven't created any items in this realm. Create a item to get started.
+noItemsInstructions=You have not created any items in this realm. Create an item to get started.
 itemSaveError=Error could not save item\! {{error}}
-itemSaveSuccessful=Sucessful saved
+itemSaveSuccessful=Saved successfully
 realmSelector=Realm selector
 editTranslationValue=Edit translation value
 selectAccessTokenSignatureAlgorithm=Select access token signature algorithm
@@ -3093,7 +3111,7 @@ selectAuthorizationEncryptedResponseAlg=Select authorization encrypted response
 selectAuthorizationEncryptedResponseEnc=Select authorization encrypted response enc
 generatedCodeTextArea=Generated code textarea
 selectAuthScopes=Select authorization scopes
-selectResource= Select resource
+selectResource=Select resource
 selectClients=Select clients
 selectLoginTheme=Select login theme
 selectAccountTheme=Select account theme
@@ -3148,8 +3166,7 @@ addAttributeTranslationInfo=Add translations for this field using the icon next
 addAttributeTranslation=Add translation for the "{{fieldName}}" field
 addAttributeDisplayDescriptionTranslation=Add translation for the display description
 addTranslationsModalTitle=Add translations
-addTranslationsModalSubTitle=You are able to translate the "{{fieldName}}" based on your locale or preferred languages. In addition, you are also able to create or edit the "{{fieldName}}" translations in the
-addTranslationsModalSubTitleBolded=Realm settings > Localization > Realm overrides.
+addTranslationsModalSubTitle=You are able to translate the "{{fieldName}}" based on your locale or preferred languages. In addition, you are also able to create or edit the "{{fieldName}}" translations in the <1>Realm settings > Localization > Realm overrides.</1>
 translationKey=Key
 translationsTableHeading=Translations
 searchForLanguage=Search for language
@@ -3179,12 +3196,16 @@ smtpPortPlaceholder=SMTP port (defaults to 25)
 loginUsernamePlaceholder=Login username
 ownerHelp=Owner for this resource.
 parRequestUriLifespan=Lifetime of the Request URI for Pushed Authorization Request
-parRequestUriLifespanHelp=Number that represents the lifetime of the request URI.  The default value is 1 minute.
+parRequestUriLifespanHelp=Number that represents the lifetime of the request URI. The default value is 1 minute.
 identityBrokeringLink=Identity brokering link
 searchClientRegistration=Search for policy
 importFileHelp=File to import a key
 logo=Logo
 avatarImage=Avatar image
+eventTypes.INVITE_ORG.name=Invite user to organization
+eventTypes.INVITE_ORG.description=Invite user to organization
+eventTypes.INVITE_ORG_ERROR.name=Invite user to organization error
+eventTypes.INVITE_ORG_ERROR.description=Invite user to organization error
 organizationsEnabled=Organizations
 organizationsEnabledHelp=If enabled, allows managing organizations. Otherwise, existing organizations are still kept but you will not be able to manage them anymore or authenticate their members.
 adminPermissionsEnabled=Admin Permissions
@@ -3230,7 +3251,7 @@ organizationUsersLeftError=Could not remove users from the organization\: {{erro
 organizationUsersLeft_one=User left the organization
 organizationUsersLeft_other={{count}} users left the organization
 inviteSent=Invitation has been sent.
-inviteSentError=Could not sent invitation\: {{error}}
+inviteSentError=Could not send invitation\: {{error}}
 noIdentityProvider=No identity providers in this realm
 noIdentityProviderInstructions=There are no identity providers yet in this realm. If you want to link an identity provider with this organization, please go to the "Identity providers" section in the left navigation bar and create an identity provider
 linkIdentityProvider=Link identity provider
@@ -3246,18 +3267,18 @@ linkError=Could not link identity provider to organization\: {{error}}
 unLinkSuccessful=Identity provider has been unlinked
 unlinkError=Could not unlink identity provider from organization\: {{error}}
 linkUpdatedSuccessful=Identity provider link successfully updated
-linkUpdateError=Could not update link to identity provider\: {{error}}
+linkUpdateError=Could not update the link to the identity provider\: {{error}}
 noResultsFound=No results found
 linkedOrganization=Linked organization
 organization=Organization
 send=Send
 redirectWhenEmailMatches=Redirect when email domain matches
 redirectWhenEmailMatchesHelp=Automatically redirect the user to this identity provider when the email domain matches the domain
-emailVerificationHelp=Specifies independent timeout for email verification.
-idpAccountEmailVerificationHelp=Specifies independent timeout for IdP account email verification.
-forgotPasswordHelp=Specifies independent timeout for forgot password.
-executeActionsHelp=Specifies independent timeout for execute actions.
-validatingX509CertsHelp=The public certificates Keycloak uses to validate the signatures of SAML requests and responses from the external IDP when Use metadata descriptor URL is OFF. Multiple certificates can be entered separated by comma (,). The certificates can be re-imported from the Metadata descriptor URL clicking the Import Keys action in the identity provider page. The action downloads the current certificates in the metadata endpoint and assigns them to the config in this same option. You need to click Save to definitely store the re-imported certificates.
+emailVerificationHelp=Independent timeout for email verification
+idpAccountEmailVerificationHelp=Independent timeout for IdP account email verification
+forgotPasswordHelp=Independent timeout for forgot password
+executeActionsHelp=Independent timeout for execute actions
+validatingX509CertsHelp=The public certificates used by Keycloak to validate the signatures of SAML requests and responses from the external IDP when the Use metadata descriptor URL is OFF. Multiple certificates can be entered separated by commas (,). You can reimport certificates from the Metadata descriptor URL by clicking the Import Keys action on the identity provider page. This action downloads the current certificates in the metadata endpoint and assigns them to the config in this same option. Click Save to definitely store the re-imported certificates.
 emptyUserOrganizations=No organizations
 emptyUserOrganizationsInstructions=There is no organization yet. Please join an organization or send an invitation to join an organization.
 joinOrganization=Join organization
@@ -3300,7 +3321,7 @@ duplicateAGroup=Duplicate group
 couldNotFetchClientRoleMappings=Could not fetch client role mappings\: {{error}}
 duplicateGroupWarning=Duplication of groups with a large number of subgroups is not supported. Please ensure that the group you are duplicating does not have a large number of subgroups.
 darkModeEnabled=Dark mode
-darkModeEnabledHelp=If enabled the dark variant of the theme will be applied based on user preference through an operating system setting (e.g. light or dark mode) or a user agent setting, if disabled only the light variant will be used. This setting only applies to themes that support dark and light variants, on themes that do not support this feature it will have no effect.
+darkModeEnabledHelp=If enabled, the dark variant of the theme is applied based on user preference through an operating system setting (light or dark mode) or a user agent setting. If disabled, only the light variant is used. This setting applies only to themes that support dark and light variants. If a theme does not support this feature, this setting has no effect.
 showMemberships=Show memberships
 showMembershipsTitle={{username}} Group Memberships
 noGroupMembershipsText=This user is not a member of any groups.
@@ -3314,10 +3335,12 @@ clearCachesTitle=Clear Caches
 realmCache=Realm Cache
 userCache=User Cache
 keysCache=Keys Cache
+crlCache=CRL Cache
 clearButtonTitle=Clear
 clearRealmCacheHelp=This will clear entries for all realms.
 clearUserCacheHelp=This will clear entries for all realms.
 clearKeysCacheHelp=Clears all entries from the cache of external public keys. These are keys of external clients or identity providers. This will clear all entries for all realms.
+clearCrlCacheHelp=Clears all entries from the CRL cache. The CRL cache improves the performance of the X.509 authenticator when Certificate Revocation List (CRL) are enabled. This action will clear all the CRL entries for all the realms.
 clearCacheSuccess=Cache cleared successfully
 clearCacheError=Could not clear cache\: {{error}}
 expandRow=Expand row
@@ -3330,11 +3353,157 @@ UNMANAGED=Unmanaged
 deleteConfirmUsers_one=Delete user {{name}}?
 deleteConfirmUsers_other=Delete {{count}} users?
 downloadThemeJar=Download theme JAR
+uploadGeneratedThemeJar=Upload generated theme JAR
 themeColorInfo=Here you can set the patternfly color variables and create a "theme jar" file that you can download and put in your providers folder to apply the theme to your realm.
-permissionsSubTitle=Fine-grained admin permissions allow assigning detailed, specific access rights, controlling which resources and actions can be managed.
+permissionsSubTitle=Permissions control access to a resource or multiple resources of one type.
+signatureAlgorithmIdentityProviderMetadata=Signature algorithm SAML IdP metadata
+signatureAlgorithmIdentityProviderMetadataHelp=Signature algorithm to use for the SAML identity provider metadata, if none the metadata is not signed.
 connectionTrace=Connection trace
-connectionTraceHelp=If enabled, incoming and outgoing LDAP ASN.1 BER packets will be dumped to the error output stream. Be careful when enabling this option in production as it will expose all data sent to and from the LDAP server. 
+connectionTraceHelp=If enabled, incoming and outgoing LDAP ASN.1 BER packets will be dumped to the error output stream. Be careful when enabling this option in production as it will expose all data sent to and from the LDAP server.
 savingUserEventsOff=Saving user events turned off
 savingAdminEventsOff=Saving admin events turned off
 membershipEvents=Membership events
 childGroupEvents=Child group events
+titlePermissions=Permissions
+emptyPermissionsInstructions=No permissions exist in this realm.
+permissionsName=Permission name
+permissionsAssignedPolicy=Assigned policy
+chooseAResourceType=Choose a resource type
+chooseAResourceTypeInstructions=Choose a resource type for which you will create a permission.
+resourceType.Clients=Controls access to operations that can be performed for clients in this realm
+resourceType.Groups=Controls access to operations that can be performed for groups in this realm
+resourceType.IdentityProviders=Controls access to operations that can be performed for identity providers in this realm
+resourceType.Organizations=Controls access to operations that can be performed for organizations in this realm
+resourceType.Roles=Controls access to operations that can be performed for roles in this realm
+resourceType.Users=Controls access to operations that can be performed for users in this realm
+createPermissionOfType=This permission will be applied to the {{resourceType}}
+permissionUsersHelpText=Specifies which user(s) are allowed by this permission.
+permissionNameHelpText=The name of the permission. This name is used to identify the permission in the admin console.
+resourceScope=Resource scope
+resourceScopeHelpText=Specifies the scope of the resource. This is used to determine the type of resource that the permission is granted to.
+allClients=All clients
+specificClients=Specific clients
+allResourceType=All {{resourceType}}
+specificResourceType=Specific {{resourceType}}
+assignedPolicies=Assigned policies
+assignExistingPolicies=Assign existing policies
+requiredPolicies=Please add at least one policy.
+createNewPolicy=Create new policy
+policy=Policy
+policyType=Policy type
+policyTypeHelpText=Specifies the type of policy. This is used to determine the type of policy that the permission is granted to.
+emptyAssignExistingPolicies=No existing policies
+emptyAssignExistingPoliciesInstructions=There are no existing policies to assign
+authorizationScope=Authorization scope
+adminPermissionName=Permission name
+noAssignedPolicies=No assigned policies
+noAssignedPoliciesInstructions=There are no assigned policies for this permission
+unAssignPolicy=Unassign
+assignedPolicyType.allTypes=All types
+assignedPolicyType.user=User
+authorizationScopeDetailsTitle=Authorization scope details
+authorizationScopeDetailsSubtitle=Authorization scope defines the actions that can be performed on a resource.
+authorizationScopeDetailsName=Name
+authorizationScopeDetailsDescription=Description
+allResources=All resources
+currentRealm=Current realm
+recentlyUsed=Recently used
+viewAll=View all
+currentRealmExplain=This realm is selected
+removeInvalidUsers=Remove invalid users during searches
+removeInvalidUsersHelp=Remove users from the local database if they are not available from the user storage when executing searches. If this is true, users no longer available from their corresponding user storage will be deleted from the local database whenever trying to look up users. If false, then users previously imported from the user storage will be kept in the local database, as read-only and disabled, even if that user is no longer available from the user storage. For example, user was deleted directly from LDAP or the `Users DN` is invalid. Note that this behavior will only happen when the user is not yet cached.
+createPermissionPolicy=Create policy
+enforceAccessTo=Enforce access to
+enforceAccessToHelpText=Specifies the resource that the permission is applied to.
+emptyPermissionPoliciesInstructions=No policies exist in this realm.
+noPermissionSearchResultsInstructions=No permissions matched your filters.
+deleteAdminPermissionConfirm=If you delete permission {{ permission }}, administrators cannot perform the actions on resources that were defined by the permission.
+authorizationScope.Clients.configure=Performs basic management of a client
+authorizationScope.Clients.manage=Fully manages a client
+authorizationScope.Clients.map-roles=Map roles defined by this client to resources such as users and groups
+authorizationScope.Clients.map-roles-client-scope=Applies roles defined by this client to the client scope of another client
+authorizationScope.Clients.map-roles-composite=Applies roles defined by this client as a composite to another role
+authorizationScope.Clients.token-exchange=Controls which clients can exchange tokens for a token that is targeted to this client
+authorizationScope.Clients.view=Views this client
+authorizationScope.Users.impersonate=Impersonates other users
+authorizationScope.Users.manage=Manages all users in the realm
+authorizationScope.Users.manage-group-membership=Manages group membership for all users in the realm (used in conjunction with a group policy)
+authorizationScope.Users.map-roles=Maps roles for all users
+authorizationScope.Users.view=Views all users in the realm
+authorizationScope.Groups.manage=Manages this group
+authorizationScope.Groups.manage-members=Manages group members
+authorizationScope.Groups.manage-membership=Adds or removes group members
+authorizationScope.Groups.view=Views this group
+authorizationScope.Groups.view-members=Views group members
+authorizationScope.IdentityProviders.token-exchange=Allows clients to exchange tokens for tokens issued by this identity provider
+authorizationScope.Roles.map-role-client-scope=Applies this role to the client scope of a client
+authorizationScope.Roles.map-role-composite=Applies this role as a composite to another role
+authorizationScope.Roles.map-role=Maps this role to a user or group
+usersResources=Users
+clientsResources=Clients
+groupsResources=Groups
+resourceTypeHelpText=Specifies which {{resourceType}} are allowed by this permission. If left blank, it is the same as selecting all.
+evaluation=Evaluation
+addSubFlowTo=Add sub-flow to {{name}}
+addExecutionTo=Add execution to {{name}}
+addConditionTo=Add condition to {{name}}
+targetAudience=Target audience
+targetAudienceHelp=Configure target audience. This will be the same as using the parameter 'audience' in the token endpoint grant request. Note that the 'audience' parameter is available just for the token-exchange grant at this moment. To simulate any other grant or to simulate token-exchange grant without 'audience' parameter, it is recommended to leave this parameter empty.
+targetAudiencePlaceHolder=Select target audience for token exchange
+permissionsEvaluationInstructions=Select a user to check if the user has a specific access to the specified resource. After clicking the Evaluate button below, the result will be displayed on the right panel.
+permissionEvaluationPreview=Permission evaluation preview
+noPermissionsEvaluationResults=No evaluation
+noPermissionsEvaluationResultsInstructions=Please setup the permission evaluation in the left side
+authScope=Authorization scope
+authScopeSelectHelp=Select an authorization scope that is going to be used to query permissions from the server.
+resourceTypeSelectHelp=Select a resource type that is going to be used to query permissions from the server.
+grantedScope=Granted scope:
+deniedScope=Denied scope:
+evaluatedPolicy={{name}} voted to {{status}}
+permissionEvaluationAlertTitle=The selected user does not have access to the selected resource(s)
+deleteConfirmRealm_one=Delete realm {{name}}?
+deleteConfirmRealm_other=Delete {{count}} realms?
+recentRealms=Recent realms
+manageRealms=Manage realms
+cantDeleteMasterRealm=You can not delete the master realm!
+selectRole=Select role
+selectUsers=Select user
+selectClient=Select client
+forbiddenAdminConsole=You do not have permission. Please contact your administrator.
+grantedPermissions=Granted Permissions
+deniedPermissions=Denied Permissions
+authenticationType=Authentication Type
+authenticationTypeBasicAuth=Password
+authenticationTypeTokenAuth=Token
+authTokenUrl=Auth Token URL
+tokenTokenUrlHelp=Token endpoint for gathering tokens: keycloak example: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
+authTokenScope=Auth Token Scope
+authTokenScopeHelp=The scope(s) separated by blanks, used during token gathering as scope parameter, e.g. 'basic sendmail'
+authTokenClientId=Auth Token ClientId
+authTokenClientIdHelp=The client_id used during token gathering, e.g. mykeycloak-sendmail-client
+authTokenClientSecret=Auth Token Client Secret
+enableDebugSMTP=Enable Debug SMTP
+signatureMaxExp=Max expiration
+signatureMaxExpHelp=Maximum expiration allowed for the JWT. Tokens need to be generated right before authentication. After this period will be considered invalid because they are too old. If undefined the default value is 60 seconds.
+fileNameDialogTitle=Save as
+fileName=File name
+syncUsersStarted=User sync has started.
+userProfileClaims=User profile claims
+userIDClaim=ID Claim
+userIDClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's unique identifier. If not provided, defaults to `sub`.
+userNameClaim=Username Claim
+userNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's username. If not provided, defaults to `preferred_username`.
+emailClaim=Email Claim
+emailClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's email. If not provided, defaults to `email`.
+fullNameClaim=Name Claim
+fullNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's full name. If not provided, defaults to `name`.
+givenNameClaim=Given name Claim
+givenNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's given name. If not provided, defaults to `given_name`.
+familyNameClaim=Family name Claim
+familyNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's family name. If not provided, defaults to `family_name`.
+openIdVerifiableCredentials=OpenID for Verifiable Credentials
+openIdVerifiableCredentialsHelp=This section is used to configure settings related to OpenID for Verifiable Credential Issuance (OID4VCI).
+oid4vciEnabled=Enable OID4VCI
+oid4vciEnabledHelp=Enable this option to allow the client to request verifiable credentials from Keycloak's OID4VCI credential endpoint.
+noAccessPolicies=No access policies
+noAccessPoliciesInstructions=There haven't been configured any access policies yet. Click the button below to configure the first policy.
\ No newline at end of file
diff --git a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/theme.properties b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/theme.properties
index 42faf1768b5e..a5a8f3a3982a 100644
--- a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/theme.properties
+++ b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/theme.properties
@@ -2,3 +2,4 @@ parent=base
 darkMode=true
 
 kcDarkModeClass=pf-v5-theme-dark
+contentHashPattern=assets/.*
\ No newline at end of file
diff --git a/js/apps/admin-ui/package.json b/js/apps/admin-ui/package.json
index 29ef81192432..35b5da7703dd 100644
--- a/js/apps/admin-ui/package.json
+++ b/js/apps/admin-ui/package.json
@@ -23,10 +23,7 @@
     "preview": "wireit",
     "lint": "wireit",
     "test": "wireit",
-    "cy:open": "cypress open --e2e --browser chrome",
-    "cy:run": "cypress run --browser chrome",
-    "cy:check-types": "wireit",
-    "cy:ldap-server": "ldap-server-mock --conf=./cypress/fixtures/ldap/server.json --database=./cypress/fixtures/ldap/users.json"
+    "test:integration": "playwright test"
   },
   "wireit": {
     "dev": {
@@ -60,7 +57,7 @@
       ]
     },
     "build-lib": {
-      "command": "LIB=true vite build",
+      "command": "cross-env LIB=true vite build",
       "dependencies": [
         "../../libs/ui-shared:build",
         "../../libs/keycloak-admin-client:build"
@@ -79,63 +76,56 @@
         "../../libs/ui-shared:build",
         "../../libs/keycloak-admin-client:build"
       ]
-    },
-    "cy:check-types": {
-      "command": "tsc --project cypress/tsconfig.json",
-      "dependencies": [
-        "../../libs/keycloak-admin-client:build"
-      ]
     }
   },
   "dependencies": {
+    "@dagrejs/dagre": "^1.1.5",
     "@keycloak/keycloak-admin-client": "workspace:*",
     "@keycloak/keycloak-ui-shared": "workspace:*",
     "@patternfly/patternfly": "^5.4.2",
-    "@patternfly/react-core": "^5.4.10",
+    "@patternfly/react-core": "^5.4.14",
     "@patternfly/react-icons": "^5.4.2",
     "@patternfly/react-styles": "^5.4.1",
-    "@patternfly/react-table": "^5.4.13",
-    "@uiw/react-textarea-code-editor": "^3.1.0",
+    "@patternfly/react-table": "^5.4.16",
+    "@uiw/react-textarea-code-editor": "^3.1.1",
     "admin-ui": "file:",
-    "dagre": "^0.8.5",
     "file-saver": "^2.0.5",
     "flat": "^6.0.1",
-    "i18next": "^24.2.1",
-    "i18next-http-backend": "^3.0.1",
+    "i18next": "^25.3.1",
+    "i18next-fetch-backend": "^6.0.0",
     "jszip": "^3.10.1",
-    "keycloak-js": "workspace:*",
+    "keycloak-js": "^26.2.0",
     "lodash-es": "^4.17.21",
     "p-debounce": "^4.0.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "react-hook-form": "^7.54.2",
-    "react-i18next": "^15.4.0",
-    "react-router-dom": "^6.28.1",
+    "react-hook-form": "^7.60.0",
+    "react-i18next": "^15.5.3",
+    "react-router-dom": "^6.30.1",
     "reactflow": "^11.11.4",
     "use-react-router-breadcrumbs": "^4.0.1"
   },
   "devDependencies": {
-    "@4tw/cypress-drag-drop": "^2.2.5",
-    "@testing-library/cypress": "^10.0.2",
+    "@axe-core/playwright": "^4.10.2",
+    "@playwright/test": "^1.53.2",
     "@testing-library/dom": "^10.4.0",
     "@testing-library/jest-dom": "^6.6.3",
-    "@testing-library/react": "^16.1.0",
-    "@types/dagre": "^0.7.52",
+    "@testing-library/react": "^16.3.0",
+    "@types/dagre": "^0.7.53",
     "@types/file-saver": "^2.0.7",
     "@types/lodash-es": "^4.17.12",
-    "@types/react": "^18.3.13",
-    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react-swc": "^3.7.2",
-    "cypress": "^13.17.0",
-    "cypress-axe": "^1.5.0",
-    "cypress-split": "^1.24.7",
-    "jsdom": "^26.0.0",
-    "ldap-server-mock": "^6.0.1",
-    "lightningcss": "^1.28.2",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react-swc": "^3.10.2",
+    "cross-env": "^7.0.3",
+    "jsdom": "^26.1.0",
+    "lightningcss": "^1.30.1",
+    "properties-file": "^3.5.12",
     "ts-node": "^10.9.2",
-    "vite": "^6.0.7",
-    "vite-plugin-checker": "^0.8.0",
-    "vite-plugin-dts": "^4.5.0",
-    "vitest": "^2.1.8"
+    "uuid": "^11.1.0",
+    "vite": "^7.0.3",
+    "vite-plugin-checker": "^0.10.0",
+    "vite-plugin-dts": "^4.5.4",
+    "vitest": "^3.2.4"
   }
 }
diff --git a/js/apps/admin-ui/playwright.config.ts b/js/apps/admin-ui/playwright.config.ts
new file mode 100644
index 000000000000..019306d1d1b3
--- /dev/null
+++ b/js/apps/admin-ui/playwright.config.ts
@@ -0,0 +1,39 @@
+import { defineConfig, devices } from "@playwright/test";
+
+const retryCount = parseInt(process.env.RETRY_COUNT || "0");
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  testDir: "./test",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: retryCount,
+  workers: 1,
+  timeout: 60 * 1000,
+  reporter: process.env.CI ? [["github"], ["html"]] : "list",
+
+  use: {
+    baseURL: "http://localhost:8080",
+    trace: "on-first-retry",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "chromium",
+      use: {
+        ...devices["Desktop Chrome"],
+        viewport: { width: 1920, height: 1200 },
+      },
+    },
+    {
+      name: "firefox",
+      use: {
+        ...devices["Desktop Firefox"],
+        viewport: { width: 1920, height: 1200 },
+      },
+    },
+  ],
+});
diff --git a/js/apps/admin-ui/src/App.tsx b/js/apps/admin-ui/src/App.tsx
index 2cc4278d17f5..3c8f80d94ee3 100644
--- a/js/apps/admin-ui/src/App.tsx
+++ b/js/apps/admin-ui/src/App.tsx
@@ -3,7 +3,7 @@ import {
   mainPageContentId,
   useEnvironment,
 } from "@keycloak/keycloak-ui-shared";
-import { Page } from "@patternfly/react-core";
+import { Flex, FlexItem, Page } from "@patternfly/react-core";
 import { PropsWithChildren, Suspense, useEffect, useState } from "react";
 import { Outlet } from "react-router-dom";
 
@@ -25,8 +25,9 @@ import { WhoAmIContextProvider } from "./context/whoami/WhoAmI";
 import type { Environment } from "./environment";
 import { SubGroups } from "./groups/SubGroupsContext";
 import { AuthWall } from "./root/AuthWall";
+import { Banners } from "./Banners";
 
-const AppContexts = ({ children }: PropsWithChildren) => (
+export const AppContexts = ({ children }: PropsWithChildren) => (
   <ErrorBoundaryProvider>
     <ServerInfoProvider>
       <RealmContextProvider>
@@ -58,21 +59,33 @@ export const App = () => {
   return (
     <AdminClientContext.Provider value={{ keycloak, adminClient }}>
       <AppContexts>
-        <Page
-          header={<Header />}
-          isManagedSidebar
-          sidebar={<PageNav />}
-          breadcrumb={<PageBreadCrumbs />}
-          mainContainerId={mainPageContentId}
+        <Flex
+          direction={{ default: "column" }}
+          flexWrap={{ default: "nowrap" }}
+          spaceItems={{ default: "spaceItemsNone" }}
+          style={{ height: "100%" }}
         >
-          <ErrorBoundaryFallback fallback={ErrorRenderer}>
-            <Suspense fallback={<KeycloakSpinner />}>
-              <AuthWall>
-                <Outlet />
-              </AuthWall>
-            </Suspense>
-          </ErrorBoundaryFallback>
-        </Page>
+          <FlexItem>
+            <Banners />
+          </FlexItem>
+          <FlexItem grow={{ default: "grow" }} style={{ minHeight: 0 }}>
+            <Page
+              header={<Header />}
+              isManagedSidebar
+              sidebar={<PageNav />}
+              breadcrumb={<PageBreadCrumbs />}
+              mainContainerId={mainPageContentId}
+            >
+              <ErrorBoundaryFallback fallback={ErrorRenderer}>
+                <Suspense fallback={<KeycloakSpinner />}>
+                  <AuthWall>
+                    <Outlet />
+                  </AuthWall>
+                </Suspense>
+              </ErrorBoundaryFallback>
+            </Page>
+          </FlexItem>
+        </Flex>
       </AppContexts>
     </AdminClientContext.Provider>
   );
diff --git a/js/apps/admin-ui/src/PageHeader.tsx b/js/apps/admin-ui/src/PageHeader.tsx
index d5270b7b8737..aa4cc09563b5 100644
--- a/js/apps/admin-ui/src/PageHeader.tsx
+++ b/js/apps/admin-ui/src/PageHeader.tsx
@@ -1,30 +1,16 @@
-import { useEnvironment, useHelp } from "@keycloak/keycloak-ui-shared";
 import {
-  Avatar,
-  Divider,
-  Dropdown,
-  DropdownItem,
-  DropdownList,
-  Masthead,
-  MastheadBrand,
-  MastheadContent,
-  MastheadToggle,
-  MenuToggle,
-  PageToggleButton,
-  Toolbar,
-  ToolbarContent,
-  ToolbarItem,
-} from "@patternfly/react-core";
-import { BarsIcon, EllipsisVIcon, HelpIcon } from "@patternfly/react-icons";
-import { useState } from "react";
+  KeycloakMasthead,
+  useEnvironment,
+  useHelp,
+} from "@keycloak/keycloak-ui-shared";
+import { DropdownItem, ToolbarItem } from "@patternfly/react-core";
+import { HelpIcon } from "@patternfly/react-icons";
 import { useTranslation } from "react-i18next";
 import { Link, useHref } from "react-router-dom";
-import { Banners } from "./Banners";
 import { PageHeaderClearCachesModal } from "./PageHeaderClearCachesModal";
 import { HelpHeader } from "./components/help-enabler/HelpHeader";
 import { useAccess } from "./context/access/Access";
 import { useRealm } from "./context/realm-context/RealmContext";
-import { useWhoAmI } from "./context/whoami/WhoAmI";
 import { toDashboard } from "./dashboard/routes/Dashboard";
 import { usePreviewLogo } from "./realm-settings/themes/LogoContext";
 import { joinPath } from "./utils/joinPath";
@@ -45,20 +31,6 @@ const ManageAccountDropdownItem = () => {
   );
 };
 
-const SignOutDropdownItem = () => {
-  const { keycloak } = useEnvironment();
-  const { t } = useTranslation();
-  return (
-    <DropdownItem
-      id="sign-out"
-      key="sign out"
-      onClick={() => keycloak.logout({ redirectUri: "" })}
-    >
-      {t("signOut")}
-    </DropdownItem>
-  );
-};
-
 const ServerInfoDropdownItem = () => {
   const { realm } = useRealm();
   const { t } = useTranslation();
@@ -108,8 +80,6 @@ const kebabDropdownItems = (isMasterRealm: boolean, isManager: boolean) => [
     ? [<ClearCachesDropdownItem key="Clear Caches" />]
     : []),
   <HelpDropdownItem key="kebab Help" />,
-  <Divider component="li" key="kebab sign out separator" />,
-  <SignOutDropdownItem key="kebab Sign out" />,
 ];
 
 const userDropdownItems = (isMasterRealm: boolean, isManager: boolean) => [
@@ -118,148 +88,51 @@ const userDropdownItems = (isMasterRealm: boolean, isManager: boolean) => [
   ...(isMasterRealm && isManager
     ? [<ClearCachesDropdownItem key="Clear Caches" />]
     : []),
-  <Divider component="li" key="sign out separator" />,
-  <SignOutDropdownItem key="Sign out" />,
 ];
 
-const KebabDropdown = () => {
-  const [isDropdownOpen, setDropdownOpen] = useState(false);
-  const { realm } = useRealm();
-  const { hasAccess } = useAccess();
-
-  const isMasterRealm = realm === "master";
-  const isManager = hasAccess("manage-realm");
-
-  return (
-    <Dropdown
-      isPlain
-      onOpenChange={(isOpen) => setDropdownOpen(isOpen)}
-      toggle={(ref) => (
-        <MenuToggle
-          id="user-dropdown-kebab"
-          ref={ref}
-          variant="plain"
-          onClick={() => setDropdownOpen(!isDropdownOpen)}
-          isExpanded={isDropdownOpen}
-        >
-          <EllipsisVIcon />
-        </MenuToggle>
-      )}
-      isOpen={isDropdownOpen}
-    >
-      <DropdownList>
-        {kebabDropdownItems(isMasterRealm, isManager)}
-      </DropdownList>
-    </Dropdown>
-  );
-};
-
-const UserDropdown = () => {
-  const { whoAmI } = useWhoAmI();
-  const [isDropdownOpen, setDropdownOpen] = useState(false);
-  const { realm } = useRealm();
-  const { hasAccess } = useAccess();
-
-  const isMasterRealm = realm === "master";
-  const isManager = hasAccess("manage-realm");
-
-  return (
-    <Dropdown
-      isPlain
-      isOpen={isDropdownOpen}
-      onOpenChange={(isOpen) => setDropdownOpen(isOpen)}
-      toggle={(ref) => (
-        <MenuToggle
-          id="user-dropdown"
-          ref={ref}
-          onClick={() => setDropdownOpen(!isDropdownOpen)}
-        >
-          {whoAmI.getDisplayName()}
-        </MenuToggle>
-      )}
-    >
-      <DropdownList>{userDropdownItems(isMasterRealm, isManager)}</DropdownList>
-    </Dropdown>
-  );
-};
-
 export const Header = () => {
   const { environment, keycloak } = useEnvironment();
   const { t } = useTranslation();
   const { realm } = useRealm();
+  const { hasAccess } = useAccess();
+
   const contextLogo = usePreviewLogo();
   const customLogo = contextLogo?.logo;
 
-  const picture = keycloak.tokenParsed?.picture;
+  const isMasterRealm = realm === "master";
+  const isManager = hasAccess("manage-realm");
+
   const logo = customLogo || environment.logo || "/logo.svg";
   const url = useHref(toDashboard({ realm }));
   const logoUrl = environment.logoUrl ? environment.logoUrl : url;
 
   return (
-    <>
-      <Banners />
-      <Masthead>
-        <MastheadToggle>
-          <PageToggleButton variant="plain" aria-label={t("navigation")}>
-            <BarsIcon />
-          </PageToggleButton>
-        </MastheadToggle>
-        <MastheadBrand href={logoUrl}>
-          <img
-            src={
-              logo.startsWith("/")
-                ? joinPath(environment.resourceUrl, logo)
-                : logo
-            }
-            id="masthead-logo"
-            alt={t("logo")}
-            aria-label={t("logo")}
-            className="keycloak__pageheader_brand"
-          />
-        </MastheadBrand>
-        <MastheadContent>
-          <Toolbar>
-            <ToolbarContent>
-              <ToolbarItem
-                align={{ default: "alignRight" }}
-                visibility={{
-                  default: "hidden",
-                  md: "visible",
-                }} /** the settings and help icon buttons are only visible on desktop sizes and replaced by a kebab dropdown for other sizes */
-              >
-                <HelpHeader />
-              </ToolbarItem>
-              <ToolbarItem
-                align={{ default: "alignLeft" }}
-                visibility={{
-                  md: "hidden",
-                }} /** this kebab dropdown replaces the icon buttons and is hidden for desktop sizes */
-              >
-                <KebabDropdown />
-              </ToolbarItem>
-              <ToolbarItem
-                visibility={{
-                  default: "hidden",
-                  md: "visible",
-                }} /** this user dropdown is hidden on mobile sizes */
-              >
-                <UserDropdown />
-              </ToolbarItem>
-              <ToolbarItem
-                variant="overflow-menu"
-                align={{ default: "alignRight" }}
-                className="pf-v5-u-m-0-on-lg"
-              >
-                <Avatar
-                  src={picture || environment.resourceUrl + "/img_avatar.svg"}
-                  alt={t("avatarImage")}
-                  aria-label={t("avatarImage")}
-                />
-              </ToolbarItem>
-            </ToolbarContent>
-          </Toolbar>
-        </MastheadContent>
-      </Masthead>
-    </>
+    <KeycloakMasthead
+      data-testid="page-header"
+      keycloak={keycloak}
+      features={{ hasManageAccount: false }}
+      brand={{
+        href: logoUrl,
+        src: logo.startsWith("/")
+          ? joinPath(environment.resourceUrl, logo)
+          : logo,
+        alt: t("logo"),
+        className: "keycloak__pageheader_brand",
+      }}
+      dropdownItems={userDropdownItems(isMasterRealm, isManager)}
+      kebabDropdownItems={kebabDropdownItems(isMasterRealm, isManager)}
+      toolbarItems={[
+        <ToolbarItem
+          key="help"
+          align={{ default: "alignRight" }}
+          visibility={{
+            default: "hidden",
+            md: "visible",
+          }} /** the settings and help icon buttons are only visible on desktop sizes and replaced by a kebab dropdown for other sizes */
+        >
+          <HelpHeader />
+        </ToolbarItem>,
+      ]}
+    />
   );
 };
diff --git a/js/apps/admin-ui/src/PageHeaderClearCachesModal.tsx b/js/apps/admin-ui/src/PageHeaderClearCachesModal.tsx
index fdfbd7ba004a..9e3ac079cbb0 100644
--- a/js/apps/admin-ui/src/PageHeaderClearCachesModal.tsx
+++ b/js/apps/admin-ui/src/PageHeaderClearCachesModal.tsx
@@ -37,6 +37,7 @@ export const PageHeaderClearCachesModal = ({
   const clearRealmCache = clearCache(adminClient.cache.clearRealmCache);
   const clearUserCache = clearCache(adminClient.cache.clearUserCache);
   const clearKeysCache = clearCache(adminClient.cache.clearKeysCache);
+  const clearCrlCache = clearCache(adminClient.cache.clearCrlCache);
 
   return (
     <Modal
@@ -95,6 +96,22 @@ export const PageHeaderClearCachesModal = ({
             </FlexItem>
           </Flex>
         </ListItem>
+        <ListItem>
+          <Flex justifyContent={{ default: "justifyContentSpaceBetween" }}>
+            <FlexItem>
+              {t("crlCache")}{" "}
+              <HelpItem
+                helpText={t("clearCrlCacheHelp")}
+                fieldLabelId="clearCrlCacheHelp"
+              />
+            </FlexItem>
+            <FlexItem>
+              <Button onClick={() => clearCrlCache(realmName)}>
+                {t("clearButtonTitle")}
+              </Button>
+            </FlexItem>
+          </Flex>
+        </ListItem>
       </List>
     </Modal>
   );
diff --git a/js/apps/admin-ui/src/PageNav.tsx b/js/apps/admin-ui/src/PageNav.tsx
index 738a56433248..ba783f273a10 100644
--- a/js/apps/admin-ui/src/PageNav.tsx
+++ b/js/apps/admin-ui/src/PageNav.tsx
@@ -1,27 +1,29 @@
+import { label, useEnvironment } from "@keycloak/keycloak-ui-shared";
 import {
-  Divider,
+  Label,
   Nav,
   NavGroup,
-  NavItem,
-  NavList,
   PageSidebar,
   PageSidebarBody,
 } from "@patternfly/react-core";
 import { FormEvent } from "react";
 import { useTranslation } from "react-i18next";
-import { NavLink, useMatch, useNavigate } from "react-router-dom";
-import { RealmSelector } from "./components/realm-selector/RealmSelector";
+import { NavLink, useNavigate } from "react-router-dom";
 import { useAccess } from "./context/access/Access";
 import { useRealm } from "./context/realm-context/RealmContext";
 import { useServerInfo } from "./context/server-info/ServerInfoProvider";
+import { Environment } from "./environment";
 import { toPage } from "./page/routes";
-import { AddRealmRoute } from "./realm/routes/AddRealm";
 import { routes } from "./routes";
 import useIsFeatureEnabled, { Feature } from "./utils/useIsFeatureEnabled";
 
 import "./page-nav.css";
 
-type LeftNavProps = { title: string; path: string; id?: string };
+type LeftNavProps = {
+  title: string;
+  path: string;
+  id?: string;
+};
 
 const LeftNav = ({ title, path, id }: LeftNavProps) => {
   const { t } = useTranslation();
@@ -40,13 +42,15 @@ const LeftNav = ({ title, path, id }: LeftNavProps) => {
       : hasAccess(route.handle.access));
 
   if (!accessAllowed) {
-    return null;
+    return undefined;
   }
 
+  const name = "nav-item" + path.replace("/", "-");
   return (
     <li>
       <NavLink
-        id={"nav-item" + path.replace("/", "-")}
+        id={name}
+        data-testid={name}
         to={`/${encodedRealm}${path}`}
         className={({ isActive }) =>
           `pf-v5-c-nav__link${isActive ? " pf-m-current" : ""}`
@@ -60,13 +64,14 @@ const LeftNav = ({ title, path, id }: LeftNavProps) => {
 
 export const PageNav = () => {
   const { t } = useTranslation();
+  const { environment } = useEnvironment<Environment>();
   const { hasSomeAccess } = useAccess();
   const { componentTypes } = useServerInfo();
   const isFeatureEnabled = useIsFeatureEnabled();
   const pages =
     componentTypes?.["org.keycloak.services.ui.extend.UiPageProvider"];
   const navigate = useNavigate();
-  const { realmRepresentation } = useRealm();
+  const { realm, realmRepresentation } = useRealm();
 
   type SelectedItem = {
     groupId: number | string;
@@ -94,19 +99,27 @@ export const PageNav = () => {
     "view-identity-providers",
   );
 
-  const isOnAddRealm = !!useMatch(AddRealmRoute.path);
+  const showManageRealm = environment.masterRealm === environment.realm;
 
   return (
     <PageSidebar className="keycloak__page_nav__nav">
       <PageSidebarBody>
         <Nav onSelect={(_event, item) => onSelect(item as SelectedItem)}>
-          <NavList>
-            <NavItem className="keycloak__page_nav__nav_item__realm-selector">
-              <RealmSelector />
-            </NavItem>
-          </NavList>
-          <Divider />
-          {showManage && !isOnAddRealm && (
+          <h2
+            className="pf-v5-c-nav__section-title"
+            style={{ wordWrap: "break-word" }}
+          >
+            <span data-testid="currentRealm">
+              {label(t, realmRepresentation?.displayName, realm)}
+            </span>{" "}
+            <Label color="blue">{t("currentRealm")}</Label>
+          </h2>
+          {showManageRealm && (
+            <NavGroup>
+              <LeftNav title={t("manageRealms")} path="/realms" />
+            </NavGroup>
+          )}
+          {showManage && (
             <NavGroup aria-label={t("manage")} title={t("manage")}>
               {isFeatureEnabled(Feature.Organizations) &&
                 realmRepresentation?.organizationsEnabled && (
@@ -122,16 +135,16 @@ export const PageNav = () => {
             </NavGroup>
           )}
 
-          {showConfigure && !isOnAddRealm && (
+          {showConfigure && (
             <NavGroup aria-label={t("configure")} title={t("configure")}>
               <LeftNav title="realmSettings" path="/realm-settings" />
               <LeftNav title="authentication" path="/authentication" />
-              <LeftNav title="identityProviders" path="/identity-providers" />
-              <LeftNav title="userFederation" path="/user-federation" />
               {isFeatureEnabled(Feature.AdminFineGrainedAuthzV2) &&
                 realmRepresentation?.adminPermissionsEnabled && (
                   <LeftNav title="permissions" path="/permissions" />
                 )}
+              <LeftNav title="identityProviders" path="/identity-providers" />
+              <LeftNav title="userFederation" path="/user-federation" />
               {isFeatureEnabled(Feature.DeclarativeUI) &&
                 pages?.map((p) => (
                   <LeftNav
diff --git a/js/apps/admin-ui/src/authentication/FlowDetails.tsx b/js/apps/admin-ui/src/authentication/FlowDetails.tsx
index c03f1c344434..8928d59caad0 100644
--- a/js/apps/admin-ui/src/authentication/FlowDetails.tsx
+++ b/js/apps/admin-ui/src/authentication/FlowDetails.tsx
@@ -6,7 +6,6 @@ import {
   AlertVariant,
   Button,
   ButtonVariant,
-  DataList,
   DragDrop,
   DropdownItem,
   Droppable,
@@ -19,6 +18,7 @@ import {
   ToolbarItem,
 } from "@patternfly/react-core";
 import { DomainIcon, TableIcon } from "@patternfly/react-icons";
+import { Table, Tbody } from "@patternfly/react-table";
 import { useState } from "react";
 import { Trans, useTranslation } from "react-i18next";
 import { useNavigate, useParams } from "react-router-dom";
@@ -32,6 +32,7 @@ import { BuildInLabel } from "./BuildInLabel";
 import { DuplicateFlowModal } from "./DuplicateFlowModal";
 import { EditFlowModal } from "./EditFlowModal";
 import { EmptyExecutionState } from "./EmptyExecutionState";
+import { AuthenticationProviderContextProvider } from "./components/AuthenticationProviderContext";
 import { FlowDiagram } from "./components/FlowDiagram";
 import { FlowHeader } from "./components/FlowHeader";
 import { FlowRow } from "./components/FlowRow";
@@ -222,7 +223,9 @@ export default function FlowDetails() {
   };
 
   const [toggleDeleteDialog, DeleteConfirm] = useConfirmDialog({
-    titleKey: "deleteConfirmExecution",
+    titleKey: t("deleteConfirmExecution", {
+      name: selectedExecution?.displayName,
+    }),
     children: (
       <Trans i18nKey="deleteConfirmExecutionMessage">
         {" "}
@@ -293,6 +296,10 @@ export default function FlowDetails() {
           >
             {t("editInfo")}
           </DropdownItem>,
+        ]
+      : []),
+    ...(!builtIn && !usedBy
+      ? [
           <DropdownItem
             data-testid="delete-flow"
             key="delete"
@@ -305,7 +312,7 @@ export default function FlowDetails() {
   ];
 
   return (
-    <>
+    <AuthenticationProviderContextProvider>
       {bindFlowOpen && (
         <BindFlowDialog
           flowAlias={flow?.alias!}
@@ -386,7 +393,7 @@ export default function FlowDetails() {
                     variant="secondary"
                     onClick={() => setShowAddExecutionDialog(true)}
                   >
-                    {t("addStep")}
+                    {t("addExecution")}
                   </Button>
                 </ToolbarItem>
                 <ToolbarItem>
@@ -427,7 +434,7 @@ export default function FlowDetails() {
                     const [removed] = order.splice(source.index, 1);
                     order.splice(dest.index, 0, removed);
                     const change = executionList.getChange(dragged, order);
-                    executeChange(dragged, change);
+                    void executeChange(dragged, change);
                     return true;
                   } else {
                     setLiveText(t("onDragCancel"));
@@ -436,33 +443,34 @@ export default function FlowDetails() {
                 }}
               >
                 <Droppable hasNoWrapper>
-                  <DataList aria-label={t("flows")}>
+                  <Table aria-label={t("flows")} isTreeTable>
                     <FlowHeader />
                     <>
                       {executionList.expandableList.map((execution) => (
-                        <FlowRow
-                          builtIn={!!builtIn}
-                          key={execution.id}
-                          execution={execution}
-                          onRowClick={(execution) => {
-                            execution.isCollapsed = !execution.isCollapsed;
-                            setExecutionList(executionList.clone());
-                          }}
-                          onRowChange={update}
-                          onAddExecution={(execution, type) =>
-                            addExecution(execution.displayName!, type)
-                          }
-                          onAddFlow={(execution, flow) =>
-                            addFlow(execution.displayName!, flow)
-                          }
-                          onDelete={(execution) => {
-                            setSelectedExecution(execution);
-                            toggleDeleteDialog();
-                          }}
-                        />
+                        <Tbody draggable key={execution.id}>
+                          <FlowRow
+                            builtIn={!!builtIn}
+                            execution={execution}
+                            onRowClick={(execution) => {
+                              execution.isCollapsed = !execution.isCollapsed;
+                              setExecutionList(executionList.clone());
+                            }}
+                            onRowChange={update}
+                            onAddExecution={(execution, type) =>
+                              addExecution(execution.displayName!, type)
+                            }
+                            onAddFlow={(execution, flow) =>
+                              addFlow(execution.displayName!, flow)
+                            }
+                            onDelete={(execution) => {
+                              setSelectedExecution(execution);
+                              toggleDeleteDialog();
+                            }}
+                          />
+                        </Tbody>
                       ))}
                     </>
-                  </DataList>
+                  </Table>
                 </Droppable>
               </DragDrop>
             )}
@@ -474,9 +482,9 @@ export default function FlowDetails() {
                     type={
                       flow.providerId === "client-flow" ? "client" : "basic"
                     }
-                    onSelect={(type) => {
+                    onSelect={async (type) => {
                       if (type) {
-                        addExecution(flow.alias!, type);
+                        await addExecution(flow.alias!, type);
                       }
                       setShowAddExecutionDialog(false);
                     }}
@@ -486,8 +494,8 @@ export default function FlowDetails() {
                   <AddSubFlowModal
                     name={flow.alias!}
                     onCancel={() => setShowSubFlowDialog(false)}
-                    onConfirm={(newFlow) => {
-                      addFlow(flow.alias!, newFlow);
+                    onConfirm={async (newFlow) => {
+                      await addFlow(flow.alias!, newFlow);
                       setShowSubFlowDialog(false);
                     }}
                   />
@@ -511,6 +519,6 @@ export default function FlowDetails() {
             />
           ))}
       </PageSection>
-    </>
+    </AuthenticationProviderContextProvider>
   );
 }
diff --git a/js/apps/admin-ui/src/authentication/RequiredActions.tsx b/js/apps/admin-ui/src/authentication/RequiredActions.tsx
index 48e4f528d744..4cea3c47b356 100644
--- a/js/apps/admin-ui/src/authentication/RequiredActions.tsx
+++ b/js/apps/admin-ui/src/authentication/RequiredActions.tsx
@@ -160,7 +160,7 @@ export const RequiredActions = () => {
           if (!dragged.alias) return;
 
           const times = newIndex - oldIndex;
-          executeMove(dragged, times);
+          await executeMove(dragged, times);
         }}
         columns={[
           {
@@ -177,8 +177,8 @@ export const RequiredActions = () => {
                 label={t("on")}
                 labelOff={t("off")}
                 isChecked={row.enabled}
-                onChange={() => {
-                  updateAction(row.data, "enabled");
+                onChange={async () => {
+                  await updateAction(row.data, "enabled");
                 }}
                 aria-label={row.name}
               />
@@ -196,8 +196,8 @@ export const RequiredActions = () => {
                 isDisabled={!row.enabled}
                 labelOff={!row.enabled ? t("disabledOff") : t("off")}
                 isChecked={row.defaultAction}
-                onChange={() => {
-                  updateAction(row.data, "defaultAction");
+                onChange={async () => {
+                  await updateAction(row.data, "defaultAction");
                 }}
                 aria-label={row.name}
               />
diff --git a/js/apps/admin-ui/src/authentication/components/AddFlowDropdown.tsx b/js/apps/admin-ui/src/authentication/components/AddFlowDropdown.tsx
index e727687fc712..3aba6c5492a1 100644
--- a/js/apps/admin-ui/src/authentication/components/AddFlowDropdown.tsx
+++ b/js/apps/admin-ui/src/authentication/components/AddFlowDropdown.tsx
@@ -75,7 +75,7 @@ export const AddFlowDropdown = ({
                 setType(providerId === "form-flow" ? "form" : "basic")
               }
             >
-              {t("addStep")}
+              {t("addExecution")}
             </DropdownItem>
             <DropdownItem
               key="addCondition"
diff --git a/js/apps/admin-ui/src/authentication/components/AuthenticationProviderContext.tsx b/js/apps/admin-ui/src/authentication/components/AuthenticationProviderContext.tsx
new file mode 100644
index 000000000000..e54abdedab6a
--- /dev/null
+++ b/js/apps/admin-ui/src/authentication/components/AuthenticationProviderContext.tsx
@@ -0,0 +1,40 @@
+import { AuthenticationProviderRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/authenticatorConfigRepresentation";
+import {
+  createNamedContext,
+  useFetch,
+  useRequiredContext,
+} from "@keycloak/keycloak-ui-shared";
+import { PropsWithChildren, useState } from "react";
+import { useAdminClient } from "../../admin-client";
+
+export const AuthenticationProviderContext = createNamedContext<
+  { providers?: AuthenticationProviderRepresentation[] } | undefined
+>("AuthenticationProviderContext", undefined);
+
+export const AuthenticationProviderContextProvider = ({
+  children,
+}: PropsWithChildren) => {
+  const { adminClient } = useAdminClient();
+  const [providers, setProviders] =
+    useState<AuthenticationProviderRepresentation[]>();
+
+  useFetch(
+    async () =>
+      Promise.all([
+        adminClient.authenticationManagement.getClientAuthenticatorProviders(),
+        adminClient.authenticationManagement.getFormActionProviders(),
+        adminClient.authenticationManagement.getAuthenticatorProviders(),
+      ]),
+    (providers) => setProviders(providers.flat()),
+    [],
+  );
+
+  return (
+    <AuthenticationProviderContext.Provider value={{ providers }}>
+      {children}
+    </AuthenticationProviderContext.Provider>
+  );
+};
+
+export const useAuthenticationProvider = () =>
+  useRequiredContext(AuthenticationProviderContext);
diff --git a/js/apps/admin-ui/src/authentication/components/FlowHeader.tsx b/js/apps/admin-ui/src/authentication/components/FlowHeader.tsx
index 15b4493ab5e6..8fa3529ef4eb 100644
--- a/js/apps/admin-ui/src/authentication/components/FlowHeader.tsx
+++ b/js/apps/admin-ui/src/authentication/components/FlowHeader.tsx
@@ -1,34 +1,26 @@
+import { DataListDragButton } from "@patternfly/react-core";
+import { Th, Tr } from "@patternfly/react-table";
 import { useTranslation } from "react-i18next";
-import {
-  DataListItem,
-  DataListItemRow,
-  DataListDragButton,
-  DataListItemCells,
-  DataListCell,
-} from "@patternfly/react-core";
 
 import "./flow-header.css";
 
 export const FlowHeader = () => {
   const { t } = useTranslation();
   return (
-    <DataListItem aria-labelledby="headerName" id="header">
-      <DataListItemRow>
+    <Tr aria-labelledby="headerName" id="header">
+      <Th>
         <DataListDragButton
           className="keycloak__authentication__header-drag-button"
           aria-label={t("disabled")}
         />
-        <DataListItemCells
-          className="keycloak__authentication__header"
-          dataListCells={[
-            <DataListCell key="step" id="headerName">
-              {t("steps")}
-            </DataListCell>,
-            <DataListCell key="requirement">{t("requirement")}</DataListCell>,
-            <DataListCell key="config"></DataListCell>,
-          ]}
-        />
-      </DataListItemRow>
-    </DataListItem>
+        <Th screenReaderText={t("expandRow")} />
+      </Th>
+      <Th>{t("steps")}</Th>
+      <Th>{t("requirement")}</Th>
+      <Th screenReaderText={t("config")}></Th>
+      <Th screenReaderText={t("config")}></Th>
+      <Th screenReaderText={t("config")}></Th>
+      <Th screenReaderText={t("config")}></Th>
+    </Tr>
   );
 };
diff --git a/js/apps/admin-ui/src/authentication/components/FlowRow.tsx b/js/apps/admin-ui/src/authentication/components/FlowRow.tsx
index 69850399ac65..9e4bdae6d0d4 100644
--- a/js/apps/admin-ui/src/authentication/components/FlowRow.tsx
+++ b/js/apps/admin-ui/src/authentication/components/FlowRow.tsx
@@ -1,19 +1,7 @@
 import type { AuthenticationProviderRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/authenticatorConfigRepresentation";
-import {
-  Button,
-  DataListCell,
-  DataListControl,
-  DataListDragButton,
-  DataListItem,
-  DataListItemCells,
-  DataListItemRow,
-  DataListToggle,
-  Draggable,
-  Text,
-  TextVariants,
-  Tooltip,
-} from "@patternfly/react-core";
+import { Button, Draggable, Tooltip } from "@patternfly/react-core";
 import { TrashIcon } from "@patternfly/react-icons";
+import { Td, TreeRowWrapper } from "@patternfly/react-table";
 import { useTranslation } from "react-i18next";
 import type { ExpandableExecution } from "../execution-model";
 import { AddFlowDropdown } from "./AddFlowDropdown";
@@ -38,6 +26,21 @@ type FlowRowProps = {
   onDelete: (execution: ExpandableExecution) => void;
 };
 
+export type FlowType = "flow" | "condition" | "execution" | "step";
+
+const convertToType = (execution: ExpandableExecution): FlowType => {
+  if (execution.authenticationFlow) {
+    return "flow";
+  }
+  if (execution.displayName!.startsWith("Condition -")) {
+    return "condition";
+  }
+  if (execution.level === 0) {
+    return "execution";
+  }
+  return "step";
+};
+
 export const FlowRow = ({
   builtIn,
   execution,
@@ -50,90 +53,85 @@ export const FlowRow = ({
   const { t } = useTranslation();
   const hasSubList = !!execution.executionList?.length;
 
+  const treeRow = {
+    onCollapse: () => onRowClick(execution),
+    props: {
+      isExpanded: !execution.isCollapsed,
+      isDetailsExpanded: !execution.isCollapsed,
+      "aria-level": execution.level! + 1,
+      "aria-labelledby": execution.id,
+      "aria-setsize": hasSubList ? execution.executionList!.length : 0,
+    },
+  };
+
   return (
     <>
       <Draggable key={`draggable-${execution.id}`} hasNoWrapper>
-        <DataListItem
-          className="keycloak__authentication__flow-item"
-          id={execution.id}
-          isExpanded={!execution.isCollapsed}
-          aria-labelledby={`title-id-${execution.id}`}
+        <TreeRowWrapper
+          row={{ props: treeRow.props }}
+          className="keycloak__authentication__flow-row"
         >
-          <DataListItemRow
-            className="keycloak__authentication__flow-row"
-            aria-level={execution.level! + 1}
-            role="heading"
-            aria-labelledby={execution.id}
-          >
-            <DataListControl>
-              <DataListDragButton aria-label={t("dragHelp")} />
-            </DataListControl>
-            {hasSubList && (
-              <DataListToggle
-                onClick={() => onRowClick(execution)}
-                isExpanded={!execution.isCollapsed}
-                id={`toggle1-${execution.id}`}
-                aria-controls={execution.executionList![0].id}
-              />
-            )}
-            <DataListItemCells
-              dataListCells={[
-                <DataListCell key={`${execution.id}-name`}>
-                  {!execution.authenticationFlow && (
-                    <FlowTitle
-                      id={execution.id}
-                      key={execution.id}
-                      alias={execution.alias!}
-                      title={execution.displayName!}
-                    />
-                  )}
-                  {execution.authenticationFlow && (
-                    <>
-                      {execution.displayName} <br />{" "}
-                      <Text component={TextVariants.small}>
-                        {execution.alias} {execution.description}
-                      </Text>
-                    </>
-                  )}
-                </DataListCell>,
-                <DataListCell key={`${execution.id}-requirement`}>
-                  <FlowRequirementDropdown
-                    flow={execution}
-                    onChange={onRowChange}
-                  />
-                </DataListCell>,
-                <DataListCell key={`${execution.id}-config`}>
-                  <ExecutionConfigModal execution={execution} />
-                  {execution.authenticationFlow && !builtIn && (
-                    <>
-                      <AddFlowDropdown
-                        execution={execution}
-                        onAddExecution={onAddExecution}
-                        onAddFlow={onAddFlow}
-                      />
-                      <EditFlow
-                        execution={execution}
-                        onRowChange={onRowChange}
-                      />
-                    </>
-                  )}
-                  {!builtIn && (
-                    <Tooltip content={t("delete")}>
-                      <Button
-                        variant="plain"
-                        data-testid={`${execution.displayName}-delete`}
-                        aria-label={t("delete")}
-                        onClick={() => onDelete(execution)}
-                      >
-                        <TrashIcon />
-                      </Button>
-                    </Tooltip>
-                  )}
-                </DataListCell>,
-              ]}
+          <Td
+            draggableRow={{
+              id: execution.id!,
+            }}
+          />
+          <Td treeRow={treeRow}>
+            <FlowTitle
+              id={execution.id}
+              type={convertToType(execution)}
+              key={execution.id}
+              subtitle={
+                (execution.authenticationFlow
+                  ? execution.description
+                  : execution.alias) || ""
+              }
+              providerId={execution.providerId!}
+              title={execution.displayName!}
             />
-          </DataListItemRow>
-        </DataListItem>
+          </Td>
+          <Td>
+            <FlowRequirementDropdown flow={execution} onChange={onRowChange} />
+          </Td>
+          {(!execution.authenticationFlow || builtIn) && (
+            <>
+              <Td isActionCell />
+              <Td isActionCell />
+            </>
+          )}
+          <Td isActionCell>
+            <ExecutionConfigModal execution={execution} />
+          </Td>
+
+          {execution.authenticationFlow && !builtIn && (
+            <>
+              <Td isActionCell>
+                <AddFlowDropdown
+                  execution={execution}
+                  onAddExecution={onAddExecution}
+                  onAddFlow={onAddFlow}
+                />
+              </Td>
+              <Td isActionCell>
+                <EditFlow execution={execution} onRowChange={onRowChange} />
+              </Td>
+            </>
+          )}
+          <Td isActionCell>
+            {!builtIn && (
+              <Tooltip content={t("delete")}>
+                <Button
+                  variant="plain"
+                  data-testid={`${execution.displayName}-delete`}
+                  aria-label={t("delete")}
+                  onClick={() => onDelete(execution)}
+                >
+                  <TrashIcon />
+                </Button>
+              </Tooltip>
+            )}
+          </Td>
+        </TreeRowWrapper>
       </Draggable>
       {!execution.isCollapsed &&
         hasSubList &&
diff --git a/js/apps/admin-ui/src/authentication/components/FlowTitle.tsx b/js/apps/admin-ui/src/authentication/components/FlowTitle.tsx
index e5243c8aa39f..3011a7034507 100644
--- a/js/apps/admin-ui/src/authentication/components/FlowTitle.tsx
+++ b/js/apps/admin-ui/src/authentication/components/FlowTitle.tsx
@@ -1,24 +1,73 @@
-import { Card, CardBody, Text, TextVariants } from "@patternfly/react-core";
-
-import "./flow-title.css";
+import { HelpItem } from "@keycloak/keycloak-ui-shared";
+import { Label } from "@patternfly/react-core";
+import {
+  CodeBranchIcon,
+  MapMarkerIcon,
+  ProcessAutomationIcon,
+  TaskIcon,
+} from "@patternfly/react-icons";
+import { useTranslation } from "react-i18next";
+import { useAuthenticationProvider } from "./AuthenticationProviderContext";
+import { FlowType } from "./FlowRow";
 
 type FlowTitleProps = {
   id?: string;
+  type: FlowType;
   title: string;
-  alias: string;
+  subtitle: string;
+  providerId?: string;
+};
+
+const FlowIcon = ({ type }: { type: FlowType }) => {
+  switch (type) {
+    case "condition":
+      return <TaskIcon />;
+    case "flow":
+      return <CodeBranchIcon />;
+    case "execution":
+      return <ProcessAutomationIcon />;
+    case "step":
+      return <MapMarkerIcon />;
+    default:
+      return undefined;
+  }
 };
 
-export const FlowTitle = ({ id, title, alias }: FlowTitleProps) => {
+function mapTypeToColor(type: FlowType) {
+  switch (type) {
+    case "condition":
+      return "purple";
+    case "flow":
+      return "green";
+    case "execution":
+      return "blue";
+    case "step":
+      return "cyan";
+    default:
+      return "grey";
+  }
+}
+
+export const FlowTitle = ({
+  id,
+  type,
+  title,
+  subtitle,
+  providerId,
+}: FlowTitleProps) => {
+  const { t } = useTranslation();
+  const { providers } = useAuthenticationProvider();
+  const helpText =
+    providers?.find((p) => p.id === providerId)?.description || subtitle;
   return (
-    <Card
-      data-testid={title}
-      className="keycloak__authentication__title"
-      isFlat
-    >
-      <CardBody data-id={id} id={`title-id-${id}`}>
-        {title} <br />
-        <Text component={TextVariants.small}>{alias}</Text>
-      </CardBody>
-    </Card>
+    <div data-testid={title}>
+      <span data-id={id} id={`title-id-${id}`}>
+        <Label icon={<FlowIcon type={type} />} color={mapTypeToColor(type)}>
+          {t(type)}
+        </Label>{" "}
+        {title}{" "}
+        {helpText && <HelpItem helpText={helpText} fieldLabelId={id!} />}
+      </span>
+    </div>
   );
 };
diff --git a/js/apps/admin-ui/src/authentication/components/diagram/auto-layout.ts b/js/apps/admin-ui/src/authentication/components/diagram/auto-layout.ts
index 6a144d675b24..28fcdf214de8 100644
--- a/js/apps/admin-ui/src/authentication/components/diagram/auto-layout.ts
+++ b/js/apps/admin-ui/src/authentication/components/diagram/auto-layout.ts
@@ -1,4 +1,4 @@
-import { graphlib, layout } from "dagre";
+import { graphlib, layout } from "@dagrejs/dagre";
 import { Edge, Node, Position } from "reactflow";
 
 const dagreGraph = new graphlib.Graph();
diff --git a/js/apps/admin-ui/src/authentication/components/flow-row.css b/js/apps/admin-ui/src/authentication/components/flow-row.css
index 83f87b9da6ff..6a3418f1d8ed 100644
--- a/js/apps/admin-ui/src/authentication/components/flow-row.css
+++ b/js/apps/admin-ui/src/authentication/components/flow-row.css
@@ -1,55 +1,3 @@
-.keycloak__authentication__flow-item:before {
-  width: 0;
-}
-
-.keycloak__authentication__flow-row[aria-level="1"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 2
-  );
-}
-
-.keycloak__authentication__flow-row[aria-level="2"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 3
-  );
-}
-.keycloak__authentication__flow-row[aria-level="3"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 4
-  );
-}
-.keycloak__authentication__flow-row[aria-level="4"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 5
-  );
-}
-.keycloak__authentication__flow-row[aria-level="5"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 6
-  );
-}
-.keycloak__authentication__flow-row[aria-level="6"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 7
-  );
-}
-.keycloak__authentication__flow-row[aria-level="7"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 8
-  );
-}
-.keycloak__authentication__flow-row[aria-level="8"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 9
-  );
-}
-.keycloak__authentication__flow-row[aria-level="9"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 10
-  );
-}
-.keycloak__authentication__flow-row[aria-level="10"] {
-  padding-left: calc(
-    var(--pf-v5-global--spacer--lg) * 11
-  );
+.pf-v5-c-table__tr:hover {
+  background-color: var(--pf-v5-global--BackgroundColor--200);
 }
diff --git a/js/apps/admin-ui/src/authentication/components/flow-title.css b/js/apps/admin-ui/src/authentication/components/flow-title.css
deleted file mode 100644
index abdc270314cc..000000000000
--- a/js/apps/admin-ui/src/authentication/components/flow-title.css
+++ /dev/null
@@ -1,9 +0,0 @@
-.keycloak__authentication__title {
-  width: fit-content;
-  width: -moz-fit-content;
-}
-
-.keycloak__authentication__title .pf-v5-c-card__body {
-  padding-bottom: var(--pf-v5-global--spacer--sm);
-  padding-top: var(--pf-v5-global--spacer--sm);
-}
diff --git a/js/apps/admin-ui/src/authentication/components/modals/AddStepModal.tsx b/js/apps/admin-ui/src/authentication/components/modals/AddStepModal.tsx
index 819eb704c9b0..28f0b6afd47c 100644
--- a/js/apps/admin-ui/src/authentication/components/modals/AddStepModal.tsx
+++ b/js/apps/admin-ui/src/authentication/components/modals/AddStepModal.tsx
@@ -105,7 +105,11 @@ export const AddStepModal = ({ name, type, onSelect }: AddStepModalProps) => {
     <Modal
       variant={ModalVariant.medium}
       isOpen={true}
-      title={t("addStepTo", { name })}
+      title={
+        type == "condition"
+          ? t("addConditionTo", { name })
+          : t("addExecutionTo", { name })
+      }
       onClose={() => onSelect()}
       actions={[
         <Button
diff --git a/js/apps/admin-ui/src/authentication/components/modals/AddSubFlowModal.tsx b/js/apps/admin-ui/src/authentication/components/modals/AddSubFlowModal.tsx
index 5c7884530fbe..be4c13ffcb2a 100644
--- a/js/apps/admin-ui/src/authentication/components/modals/AddSubFlowModal.tsx
+++ b/js/apps/admin-ui/src/authentication/components/modals/AddSubFlowModal.tsx
@@ -58,7 +58,7 @@ export const AddSubFlowModal = ({
   return (
     <Modal
       variant={ModalVariant.medium}
-      title={t("addStepTo", { name })}
+      title={t("addSubFlowTo", { name })}
       onClose={onCancel}
       actions={[
         <Button
diff --git a/js/apps/admin-ui/src/authentication/policies/OtpPolicy.tsx b/js/apps/admin-ui/src/authentication/policies/OtpPolicy.tsx
index 8eb48dd0baa0..6084c4692eee 100644
--- a/js/apps/admin-ui/src/authentication/policies/OtpPolicy.tsx
+++ b/js/apps/admin-ui/src/authentication/policies/OtpPolicy.tsx
@@ -1,4 +1,11 @@
 import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
+import {
+  HelpItem,
+  NumberControl,
+  SelectControl,
+  SwitchControl,
+  useAlerts,
+} from "@keycloak/keycloak-ui-shared";
 import {
   ActionGroup,
   AlertVariant,
@@ -10,17 +17,10 @@ import {
   PageSection,
   Radio,
 } from "@patternfly/react-core";
-import { useEffect, useMemo } from "react";
+import { useMemo } from "react";
 import { Controller, FormProvider, useForm, useWatch } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import {
-  HelpItem,
-  NumberControl,
-  SelectControl,
-  SwitchControl,
-} from "@keycloak/keycloak-ui-shared";
 import { useAdminClient } from "../../admin-client";
-import { useAlerts } from "@keycloak/keycloak-ui-shared";
 import { FormAccess } from "../../components/form/FormAccess";
 import { TimeSelectorControl } from "../../components/time-selector/TimeSelectorControl";
 import { useRealm } from "../../context/realm-context/RealmContext";
@@ -46,7 +46,19 @@ export const OtpPolicy = ({ realm, realmUpdated }: OtpPolicyProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const form = useForm<FormFields>({ mode: "onChange", defaultValues: realm });
+  const form = useForm<FormFields>({
+    mode: "onChange",
+    defaultValues: {
+      otpPolicyType: realm.otpPolicyType ?? POLICY_TYPES[0],
+      otpPolicyAlgorithm:
+        realm.otpPolicyAlgorithm ?? `Hmac${OTP_HASH_ALGORITHMS[0]}`,
+      otpPolicyDigits: realm.otpPolicyDigits ?? NUMBER_OF_DIGITS[0],
+      otpPolicyLookAheadWindow: realm.otpPolicyLookAheadWindow ?? 1,
+      otpPolicyPeriod: realm.otpPolicyPeriod ?? 30,
+      otpPolicyInitialCounter: realm.otpPolicyInitialCounter ?? 30,
+      otpPolicyCodeReusable: realm.otpPolicyCodeReusable ?? false,
+    },
+  });
   const {
     control,
     reset,
@@ -57,16 +69,10 @@ export const OtpPolicy = ({ realm, realmUpdated }: OtpPolicyProps) => {
   const { addAlert, addError } = useAlerts();
   const localeSort = useLocaleSort();
 
-  const otpType = useWatch({
-    name: "otpPolicyType",
-    control,
-    defaultValue: POLICY_TYPES[0],
-  });
+  const otpType = useWatch({ name: "otpPolicyType", control });
 
   const setupForm = (formValues: FormFields) => reset(formValues);
 
-  useEffect(() => setupForm(realm), []);
-
   const supportedApplications = useMemo(() => {
     const labels = (realm.otpSupportedApplications ?? []).map((key) =>
       t(`otpSupportedApplications.${key}`),
@@ -110,16 +116,16 @@ export const OtpPolicy = ({ realm, realmUpdated }: OtpPolicyProps) => {
               data-testid="otpPolicyType"
               defaultValue={POLICY_TYPES[0]}
               control={control}
-              render={({ field }) => (
+              render={({ field: { value, onChange } }) => (
                 <>
                   {POLICY_TYPES.map((type) => (
                     <Radio
                       key={type}
                       id={type}
                       data-testid={type}
-                      isChecked={field.value === type}
+                      isChecked={value === type}
                       name="otpPolicyType"
-                      onChange={() => field.onChange(type)}
+                      onChange={() => onChange(type)}
                       label={t(`policyType.${type}`)}
                       className="keycloak__otp_policies_authentication__policy-type"
                     />
diff --git a/js/apps/admin-ui/src/authentication/policies/PasswordPolicy.tsx b/js/apps/admin-ui/src/authentication/policies/PasswordPolicy.tsx
index e801ec32b8d4..58534433b749 100644
--- a/js/apps/admin-ui/src/authentication/policies/PasswordPolicy.tsx
+++ b/js/apps/admin-ui/src/authentication/policies/PasswordPolicy.tsx
@@ -97,7 +97,7 @@ export const PasswordPolicy = ({
   const { passwordPolicies } = useServerInfo();
 
   const { addAlert, addError } = useAlerts();
-  const { realm: realmName } = useRealm();
+  const { realm: realmName, refresh } = useRealm();
 
   const [rows, setRows] = useState<PasswordPolicyTypeRepresentation[]>([]);
   const onSelect = (row: PasswordPolicyTypeRepresentation) => {
@@ -135,6 +135,7 @@ export const PasswordPolicy = ({
       await adminClient.realms.update({ realm: realmName }, updatedRealm);
       realmUpdated(updatedRealm);
       setupForm(updatedRealm);
+      refresh();
       addAlert(t("updatePasswordPolicySuccess"), AlertVariant.success);
     } catch (error: any) {
       addError("updatePasswordPolicyError", error);
diff --git a/js/apps/admin-ui/src/authentication/policies/Policies.tsx b/js/apps/admin-ui/src/authentication/policies/Policies.tsx
index 5a72bfabd893..8850abd0ec6b 100644
--- a/js/apps/admin-ui/src/authentication/policies/Policies.tsx
+++ b/js/apps/admin-ui/src/authentication/policies/Policies.tsx
@@ -1,9 +1,6 @@
-import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
-import { useFetch } from "@keycloak/keycloak-ui-shared";
 import { Tab, Tabs, TabTitleText } from "@patternfly/react-core";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { useAdminClient } from "../../admin-client";
 import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { useRealm } from "../../context/realm-context/RealmContext";
 import { CibaPolicy } from "./CibaPolicy";
@@ -12,26 +9,9 @@ import { PasswordPolicy } from "./PasswordPolicy";
 import { WebauthnPolicy } from "./WebauthnPolicy";
 
 export const Policies = () => {
-  const { adminClient } = useAdminClient();
-
   const { t } = useTranslation();
   const [subTab, setSubTab] = useState(1);
-  const { realm: realmName } = useRealm();
-  const [realm, setRealm] = useState<RealmRepresentation>();
-
-  useFetch(
-    async () => {
-      const realm = await adminClient.realms.findOne({ realm: realmName });
-      if (!realm) {
-        throw new Error(t("notFound"));
-      }
-      return realm;
-    },
-    (realm) => {
-      setRealm(realm);
-    },
-    [],
-  );
+  const { realmRepresentation: realm, refresh } = useRealm();
 
   if (!realm) {
     return <KeycloakSpinner />;
@@ -46,38 +26,42 @@ export const Policies = () => {
     >
       <Tab
         id="passwordPolicy"
+        data-testid="passwordPolicy"
         eventKey={1}
         title={<TabTitleText>{t("passwordPolicy")}</TabTitleText>}
       >
-        <PasswordPolicy realm={realm} realmUpdated={setRealm} />
+        <PasswordPolicy realm={realm} realmUpdated={refresh} />
       </Tab>
       <Tab
         id="otpPolicy"
+        data-testid="otpPolicy"
         eventKey={2}
         title={<TabTitleText>{t("otpPolicy")}</TabTitleText>}
       >
-        <OtpPolicy realm={realm} realmUpdated={setRealm} />
+        <OtpPolicy realm={realm} realmUpdated={refresh} />
       </Tab>
       <Tab
         id="webauthnPolicy"
+        data-testid="webauthnPolicy"
         eventKey={3}
         title={<TabTitleText>{t("webauthnPolicy")}</TabTitleText>}
       >
-        <WebauthnPolicy realm={realm} realmUpdated={setRealm} />
+        <WebauthnPolicy realm={realm} realmUpdated={refresh} />
       </Tab>
       <Tab
         id="webauthnPasswordlessPolicy"
+        data-testid="webauthnPasswordlessPolicy"
         eventKey={4}
         title={<TabTitleText>{t("webauthnPasswordlessPolicy")}</TabTitleText>}
       >
-        <WebauthnPolicy realm={realm} realmUpdated={setRealm} isPasswordLess />
+        <WebauthnPolicy realm={realm} realmUpdated={refresh} isPasswordLess />
       </Tab>
       <Tab
         data-testid="tab-ciba-policy"
         eventKey={5}
         title={<TabTitleText>{t("cibaPolicy")}</TabTitleText>}
       >
-        <CibaPolicy realm={realm} realmUpdated={setRealm} />
+        <CibaPolicy realm={realm} realmUpdated={refresh} />
       </Tab>
     </Tabs>
   );
diff --git a/js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx b/js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx
index 9407811c1209..e7d1d7610737 100644
--- a/js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx
+++ b/js/apps/admin-ui/src/authentication/policies/WebauthnPolicy.tsx
@@ -27,6 +27,7 @@ import { MultiLineInput } from "../../components/multi-line-input/MultiLineInput
 import { TimeSelectorControl } from "../../components/time-selector/TimeSelectorControl";
 import { useRealm } from "../../context/realm-context/RealmContext";
 import { convertFormValuesToObject, convertToFormValues } from "../../util";
+import useIsFeatureEnabled, { Feature } from "../../utils/useIsFeatureEnabled";
 
 import { useAdminClient } from "../../admin-client";
 import "./webauthn-policy.css";
@@ -141,6 +142,8 @@ export const WebauthnPolicy = ({
     }
   };
 
+  const isFeatureEnabled = useIsFeatureEnabled();
+
   return (
     <PageSection variant="light">
       {enabled && (
@@ -261,6 +264,15 @@ export const WebauthnPolicy = ({
               addButtonLabel="addOrigins"
             />
           </FormGroup>
+          {isPasswordLess && isFeatureEnabled(Feature.Passkeys) && (
+            <SwitchControl
+              name={`${namePrefix}PasskeysEnabled`}
+              label={t("webAuthnPolicyPasskeysEnabled")}
+              labelIcon={t("webAuthnPolicyPasskeysEnabledHelp")}
+              labelOn={t("on")}
+              labelOff={t("off")}
+            />
+          )}
         </FormProvider>
 
         <ActionGroup>
diff --git a/js/apps/admin-ui/src/client-scopes/EditClientScope.tsx b/js/apps/admin-ui/src/client-scopes/EditClientScope.tsx
index 6810c44e9268..7d6cc37137dc 100644
--- a/js/apps/admin-ui/src/client-scopes/EditClientScope.tsx
+++ b/js/apps/admin-ui/src/client-scopes/EditClientScope.tsx
@@ -2,7 +2,12 @@ import ClientScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/
 import type ProtocolMapperRepresentation from "@keycloak/keycloak-admin-client/lib/defs/protocolMapperRepresentation";
 import type { RoleMappingPayload } from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
 import type { ProtocolMapperTypeRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/serverInfoRepesentation";
-import { useAlerts, useFetch, useHelp } from "@keycloak/keycloak-ui-shared";
+import {
+  KeycloakSpinner,
+  useAlerts,
+  useFetch,
+  useHelp,
+} from "@keycloak/keycloak-ui-shared";
 import {
   Alert,
   AlertVariant,
@@ -23,7 +28,6 @@ import {
   changeScope,
 } from "../components/client-scope/ClientScopeTypes";
 import { useConfirmDialog } from "../components/confirm-dialog/ConfirmDialog";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { RoleMapping, Row } from "../components/role-mapping/RoleMapping";
 import {
   RoutableTabs,
@@ -35,11 +39,7 @@ import { convertFormValuesToObject } from "../util";
 import { useParams } from "../utils/useParams";
 import { MapperList } from "./details/MapperList";
 import { ScopeForm } from "./details/ScopeForm";
-import {
-  ClientScopeParams,
-  ClientScopeTab,
-  toClientScope,
-} from "./routes/ClientScope";
+import { ClientScopeParams, toClientScope } from "./routes/ClientScope";
 import { toClientScopes } from "./routes/ClientScopes";
 import { toMapper } from "./routes/Mapper";
 import { useAccess } from "../context/access/Access";
@@ -99,19 +99,14 @@ export default function EditClientScope() {
     return hasOptionalScope ? ClientScope.optional : AllClientScopes.none;
   }
 
-  const useTab = (tab: ClientScopeTab) =>
-    useRoutableTab(
-      toClientScope({
-        realm,
-        id,
-        tab,
-      }),
-    );
-
-  const settingsTab = useTab("settings");
-  const mappersTab = useTab("mappers");
-  const scopeTab = useTab("scope");
-  const eventsTab = useTab("events");
+  const settingsTab = useRoutableTab(
+    toClientScope({ realm, id, tab: "settings" }),
+  );
+  const mappersTab = useRoutableTab(
+    toClientScope({ realm, id, tab: "mappers" }),
+  );
+  const scopeTab = useRoutableTab(toClientScope({ realm, id, tab: "scope" }));
+  const eventsTab = useRoutableTab(toClientScope({ realm, id, tab: "events" }));
 
   const onSubmit = async (formData: ClientScopeDefaultOptionalType) => {
     const clientScope = convertFormValuesToObject({
@@ -239,7 +234,7 @@ export default function EditClientScope() {
       />
 
       <PageSection variant="light" className="pf-v5-u-p-0">
-        <RoutableTabs isBox>
+        <RoutableTabs isBox mountOnEnter unmountOnExit>
           <Tab
             id="settings"
             data-testid="settings"
diff --git a/js/apps/admin-ui/src/client-scopes/details/MappingDetails.tsx b/js/apps/admin-ui/src/client-scopes/details/MappingDetails.tsx
index 4a99d21bc4e8..6775c1a109f4 100644
--- a/js/apps/admin-ui/src/client-scopes/details/MappingDetails.tsx
+++ b/js/apps/admin-ui/src/client-scopes/details/MappingDetails.tsx
@@ -224,10 +224,11 @@ export default function MappingDetails() {
               stringify
             />
             <ActionGroup>
-              <Button variant="primary" type="submit">
+              <Button variant="primary" type="submit" data-testid="save">
                 {t("save")}
               </Button>
               <Button
+                data-testid="cancel"
                 variant="link"
                 component={(props) => <Link {...props} to={toDetails()} />}
               >
diff --git a/js/apps/admin-ui/src/client-scopes/details/ScopeForm.tsx b/js/apps/admin-ui/src/client-scopes/details/ScopeForm.tsx
index cba540ab2372..f7fb3b44f0e2 100644
--- a/js/apps/admin-ui/src/client-scopes/details/ScopeForm.tsx
+++ b/js/apps/admin-ui/src/client-scopes/details/ScopeForm.tsx
@@ -186,6 +186,7 @@ export const ScopeForm = ({ clientScope, save }: ScopeFormProps) => {
         />
         <ActionGroup>
           <FormSubmitButton
+            data-testid="save"
             formState={formState}
             disabled={!isDirty || !isValid}
           >
diff --git a/js/apps/admin-ui/src/clients/AdvancedTab.tsx b/js/apps/admin-ui/src/clients/AdvancedTab.tsx
index 9bed9ff8677e..2cc53bd736b8 100644
--- a/js/apps/admin-ui/src/clients/AdvancedTab.tsx
+++ b/js/apps/admin-ui/src/clients/AdvancedTab.tsx
@@ -14,6 +14,11 @@ import { ClusteringPanel } from "./advanced/ClusteringPanel";
 import { FineGrainOpenIdConnect } from "./advanced/FineGrainOpenIdConnect";
 import { FineGrainSamlEndpointConfig } from "./advanced/FineGrainSamlEndpointConfig";
 import { OpenIdConnectCompatibilityModes } from "./advanced/OpenIdConnectCompatibilityModes";
+import { OpenIdVerifiableCredentials } from "./advanced/OpenIdVerifiableCredentials";
+import useIsFeatureEnabled, { Feature } from "../utils/useIsFeatureEnabled";
+
+const PROTOCOL_OIDC = "openid-connect";
+const PROTOCOL_OID4VC = "oid4vc";
 
 export const parseResult = (
   result: GlobalRequestResult,
@@ -50,7 +55,7 @@ export type AdvancedProps = {
 
 export const AdvancedTab = ({ save, client }: AdvancedProps) => {
   const { t } = useTranslation();
-  const openIdConnect = "openid-connect";
+  const isFeatureEnabled = useIsFeatureEnabled();
 
   const { setValue } = useFormContext();
   const {
@@ -81,7 +86,7 @@ export const AdvancedTab = ({ save, client }: AdvancedProps) => {
           },
           {
             title: t("fineGrainOpenIdConnectConfiguration"),
-            isHidden: protocol !== openIdConnect,
+            isHidden: protocol !== PROTOCOL_OIDC,
             panel: (
               <>
                 <Text className="pf-v5-u-pb-lg">
@@ -95,6 +100,7 @@ export const AdvancedTab = ({ save, client }: AdvancedProps) => {
                       "policyUri",
                       "tosUri",
                       "access.token.signed.response.alg",
+                      "access.token.header.type.rfc9068",
                       "id.token.signed.response.alg",
                       "id.token.encrypted.response.alg",
                       "id.token.encrypted.response.enc",
@@ -117,7 +123,7 @@ export const AdvancedTab = ({ save, client }: AdvancedProps) => {
           },
           {
             title: t("openIdConnectCompatibilityModes"),
-            isHidden: protocol !== openIdConnect,
+            isHidden: protocol !== PROTOCOL_OIDC,
             panel: (
               <>
                 <Text className="pf-v5-u-pb-lg">
@@ -139,7 +145,7 @@ export const AdvancedTab = ({ save, client }: AdvancedProps) => {
           },
           {
             title: t("fineGrainSamlEndpointConfig"),
-            isHidden: protocol === openIdConnect,
+            isHidden: protocol === PROTOCOL_OIDC,
             panel: (
               <>
                 <Text className="pf-v5-u-pb-lg">
@@ -179,14 +185,43 @@ export const AdvancedTab = ({ save, client }: AdvancedProps) => {
                     resetFields([
                       "saml.assertion.lifespan",
                       "access.token.lifespan",
+                      "session.idle.timeout",
+                      "client.session.max.lifespan",
+                      "client.offline.session.idle.timeout",
+                      "client.offline.session.max.lifespan",
+                      "dpop.bound.access.tokens",
                       "tls.client.certificate.bound.access.tokens",
+                      "require.pushed.authorization.requests",
+                      "client.use.lightweight.access.token.enabled",
+                      "client.introspection.response.allow.jwt.claim.enabled",
                       "pkce.code.challenge.method",
+                      "acr.loa.map",
+                      "default.acr.values",
+                      "minimum.acr.value",
                     ]);
                   }}
                 />
               </>
             ),
           },
+          {
+            title: t("openIdVerifiableCredentials"),
+            isHidden:
+              (protocol !== PROTOCOL_OIDC && protocol !== PROTOCOL_OID4VC) ||
+              !isFeatureEnabled(Feature.OpenId4VCI),
+            panel: (
+              <>
+                <Text className="pf-v5-u-pb-lg">
+                  {t("openIdVerifiableCredentialsHelp")}
+                </Text>
+                <OpenIdVerifiableCredentials
+                  client={client}
+                  save={save}
+                  reset={() => resetFields(["oid4vci.enabled"])}
+                />
+              </>
+            ),
+          },
           {
             title: t("authenticationOverrides"),
             panel: (
diff --git a/js/apps/admin-ui/src/clients/ClientDetails.tsx b/js/apps/admin-ui/src/clients/ClientDetails.tsx
index 8b492fc6b63f..926ffb1cdb95 100644
--- a/js/apps/admin-ui/src/clients/ClientDetails.tsx
+++ b/js/apps/admin-ui/src/clients/ClientDetails.tsx
@@ -194,7 +194,7 @@ export default function ClientDetails() {
 
   const { t } = useTranslation();
   const { addAlert, addError } = useAlerts();
-  const { realm, realmRepresentation } = useRealm();
+  const { realm } = useRealm();
   const { hasAccess } = useAccess();
   const isFeatureEnabled = useIsFeatureEnabled();
 
@@ -215,6 +215,7 @@ export default function ClientDetails() {
   const form = useForm<FormFields>();
   const { clientId } = useParams<ClientParams>();
   const [key, setKey] = useState(0);
+  const refresh = () => setKey(key + 1);
 
   const isAdminPermissionsClient = useIsAdminPermissionsClient(clientId);
 
@@ -310,7 +311,6 @@ export default function ClientDetails() {
   });
 
   const setupForm = (client: ClientRepresentation) => {
-    form.reset({ ...client });
     convertToFormValues(client, form.setValue);
     if (client.attributes?.["acr.loa.map"]) {
       form.setValue(
@@ -321,6 +321,8 @@ export default function ClientDetails() {
         ),
       );
     }
+    // reset dirty as for reason it is not resetting
+    form.reset(form.getValues(), { keepDirty: false });
   };
 
   useFetch(
@@ -464,6 +466,7 @@ export default function ClientDetails() {
                   <Keys
                     clientId={clientId}
                     save={save}
+                    refresh={refresh}
                     hasConfigureAccess={client.access?.configure}
                   />
                 )}
@@ -486,7 +489,7 @@ export default function ClientDetails() {
                     key={key}
                     client={client}
                     save={save}
-                    refresh={() => setKey(key + 1)}
+                    refresh={refresh}
                   />
                 </Tab>
               )}
@@ -525,6 +528,8 @@ export default function ClientDetails() {
                     clientId,
                     tab: "setup",
                   })}
+                  mountOnEnter
+                  unmountOnExit
                 >
                   <Tab
                     id="setup"
@@ -683,37 +688,31 @@ export default function ClientDetails() {
             >
               <AdvancedTab save={save} client={client} />
             </Tab>
-            {hasAccess("view-events") &&
-              (realmRepresentation?.adminEventsEnabled ||
-                realmRepresentation?.eventsEnabled) && (
-                <Tab
-                  data-testid="events-tab"
-                  title={<TabTitleText>{t("events")}</TabTitleText>}
-                  {...eventsTab}
+            {hasAccess("view-events") && (
+              <Tab
+                data-testid="events-tab"
+                title={<TabTitleText>{t("events")}</TabTitleText>}
+                {...eventsTab}
+              >
+                <Tabs
+                  activeKey={activeEventsTab}
+                  onSelect={(_, key) => setActiveEventsTab(key as string)}
                 >
-                  <Tabs
-                    activeKey={activeEventsTab}
-                    onSelect={(_, key) => setActiveEventsTab(key as string)}
+                  <Tab
+                    eventKey="userEvents"
+                    title={<TabTitleText>{t("userEvents")}</TabTitleText>}
                   >
-                    {realmRepresentation?.eventsEnabled && (
-                      <Tab
-                        eventKey="userEvents"
-                        title={<TabTitleText>{t("userEvents")}</TabTitleText>}
-                      >
-                        <UserEvents client={client.clientId} />
-                      </Tab>
-                    )}
-                    {realmRepresentation?.adminEventsEnabled && (
-                      <Tab
-                        eventKey="adminEvents"
-                        title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
-                      >
-                        <AdminEvents resourcePath={`clients/${client.id}`} />
-                      </Tab>
-                    )}
-                  </Tabs>
-                </Tab>
-              )}
+                    <UserEvents client={client.clientId} />
+                  </Tab>
+                  <Tab
+                    eventKey="adminEvents"
+                    title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
+                  >
+                    <AdminEvents resourcePath={`clients/${client.id}`} />
+                  </Tab>
+                </Tabs>
+              </Tab>
+            )}
           </RoutableTabs>
         </FormProvider>
       </PageSection>
diff --git a/js/apps/admin-ui/src/clients/ClientSessions.tsx b/js/apps/admin-ui/src/clients/ClientSessions.tsx
index 654074ff3c47..46ca7ef57688 100644
--- a/js/apps/admin-ui/src/clients/ClientSessions.tsx
+++ b/js/apps/admin-ui/src/clients/ClientSessions.tsx
@@ -3,7 +3,7 @@ import type UserSessionRepresentation from "@keycloak/keycloak-admin-client/lib/
 import { PageSection } from "@patternfly/react-core";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../admin-client";
-import type { LoaderFunction } from "@keycloak/keycloak-ui-shared";
+import { fetchAdminUI } from "../context/auth/admin-ui-endpoint";
 import SessionsTable from "../sessions/SessionsTable";
 
 type ClientSessionsProps = {
@@ -15,27 +15,18 @@ export const ClientSessions = ({ client }: ClientSessionsProps) => {
 
   const { t } = useTranslation();
 
-  const loader: LoaderFunction<UserSessionRepresentation> = async () => {
-    const mapSessionsToType =
-      (type: string) => (sessions: UserSessionRepresentation[]) =>
-        sessions.map((session) => ({
-          type,
-          ...session,
-        }));
-
-    const allSessions = await Promise.all([
-      adminClient.clients
-        .listSessions({ id: client.id! })
-        .then(mapSessionsToType(t("sessionsType.regularSSO"))),
-      adminClient.clients
-        .listOfflineSessions({
-          id: client.id!,
-        })
-        .then(mapSessionsToType(t("sessionsType.offline"))),
-    ]);
-
-    return allSessions.flat();
-  };
+  const loader = async (first?: number, max?: number, search?: string) =>
+    fetchAdminUI<UserSessionRepresentation[]>(
+      adminClient,
+      "ui-ext/sessions/client",
+      {
+        first: `${first}`,
+        max: `${max}`,
+        type: "ALL",
+        clientId: client.id!,
+        search: search || "",
+      },
+    );
 
   return (
     <PageSection variant="light" className="pf-v5-u-p-0">
diff --git a/js/apps/admin-ui/src/clients/ClientsSection.tsx b/js/apps/admin-ui/src/clients/ClientsSection.tsx
index 9bbbfed7b660..c1737a0e5b44 100644
--- a/js/apps/admin-ui/src/clients/ClientsSection.tsx
+++ b/js/apps/admin-ui/src/clients/ClientsSection.tsx
@@ -113,6 +113,7 @@ const ToolbarItems = () => {
     <>
       <ToolbarItem>
         <Button
+          data-testid="createClient"
           component={(props) => <Link {...props} to={toAddClient({ realm })} />}
         >
           {t("createClient")}
@@ -194,6 +195,7 @@ export default function ClientsSection() {
       <PageSection variant="light" className="pf-v5-u-p-0">
         <RoutableTabs
           mountOnEnter
+          unmountOnExit
           isBox
           defaultLocation={toClients({
             realm,
diff --git a/js/apps/admin-ui/src/clients/add/CapabilityConfig.tsx b/js/apps/admin-ui/src/clients/add/CapabilityConfig.tsx
index d636fb6fdf31..536b2fc131ab 100644
--- a/js/apps/admin-ui/src/clients/add/CapabilityConfig.tsx
+++ b/js/apps/admin-ui/src/clients/add/CapabilityConfig.tsx
@@ -1,16 +1,16 @@
 import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import { HelpItem, SelectControl } from "@keycloak/keycloak-ui-shared";
 import {
   Checkbox,
   FormGroup,
   Grid,
   GridItem,
   InputGroup,
-  Switch,
   InputGroupItem,
+  Switch,
 } from "@patternfly/react-core";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import { DefaultSwitchControl } from "../../components/SwitchControl";
 import { FormAccess } from "../../components/form/FormAccess";
 import { convertAttributeNameToForm } from "../../util";
@@ -61,7 +61,7 @@ export const CapabilityConfig = ({
               render={({ field }) => (
                 <Switch
                   data-testid="authentication"
-                  id="kc-authentication-switch"
+                  id="kc-authentication"
                   label={t("on")}
                   labelOff={t("off")}
                   isChecked={!field.value}
@@ -76,6 +76,12 @@ export const CapabilityConfig = ({
                         ),
                         false,
                       );
+                      setValue(
+                        convertAttributeNameToForm<FormFields>(
+                          "attributes.standard.token.exchange.enabled",
+                        ),
+                        false,
+                      );
                     }
                   }}
                   aria-label={t("clientAuthentication")}
@@ -152,7 +158,7 @@ export const CapabilityConfig = ({
               <GridItem lg={8} sm={6}>
                 <Controller
                   name="directAccessGrantsEnabled"
-                  defaultValue={true}
+                  defaultValue={false}
                   control={control}
                   render={({ field }) => (
                     <InputGroup>
@@ -234,6 +240,41 @@ export const CapabilityConfig = ({
                   )}
                 />
               </GridItem>
+              {isFeatureEnabled(Feature.StandardTokenExchangeV2) && (
+                <GridItem lg={8} sm={6}>
+                  <Controller
+                    name={convertAttributeNameToForm<
+                      Required<ClientRepresentation["attributes"]>
+                    >("attributes.standard.token.exchange.enabled")}
+                    defaultValue={false}
+                    control={control}
+                    render={({ field }) => (
+                      <InputGroup>
+                        <InputGroupItem>
+                          <Checkbox
+                            data-testid="standard-token-exchange-enabled"
+                            label={t("standardTokenExchangeEnabled")}
+                            id="kc-standard-token-exchange-enabled"
+                            name="standard-token-exchange-enabled"
+                            isChecked={
+                              field.value.toString() === "true" &&
+                              !clientAuthentication
+                            }
+                            onChange={field.onChange}
+                            isDisabled={clientAuthentication}
+                          />
+                        </InputGroupItem>
+                        <InputGroupItem>
+                          <HelpItem
+                            helpText={t("standardTokenExchangeEnabledHelp")}
+                            fieldLabelId="standardTokenExchangeEnabled"
+                          />
+                        </InputGroupItem>
+                      </InputGroup>
+                    )}
+                  />
+                </GridItem>
+              )}
               {isFeatureEnabled(Feature.DeviceFlow) && (
                 <GridItem lg={8} sm={6}>
                   <Controller
@@ -297,6 +338,20 @@ export const CapabilityConfig = ({
               </GridItem>
             </Grid>
           </FormGroup>
+          <SelectControl
+            id="keyForCodeExchange"
+            label={t("keyForCodeExchange")}
+            labelIcon={t("keyForCodeExchangeHelp")}
+            controller={{ defaultValue: "" }}
+            name={convertAttributeNameToForm<FormFields>(
+              "attributes.pkce.code.challenge.method",
+            )}
+            options={[
+              { key: "", value: t("choose") },
+              { key: "S256", value: "S256" },
+              { key: "plain", value: "plain" },
+            ]}
+          />
         </>
       )}
       {protocol === "saml" && (
diff --git a/js/apps/admin-ui/src/clients/add/NewClientForm.tsx b/js/apps/admin-ui/src/clients/add/NewClientForm.tsx
index d918c62db0df..866c0c77632b 100644
--- a/js/apps/admin-ui/src/clients/add/NewClientForm.tsx
+++ b/js/apps/admin-ui/src/clients/add/NewClientForm.tsx
@@ -68,7 +68,7 @@ export default function NewClientForm() {
       authorizationServicesEnabled: false,
       serviceAccountsEnabled: false,
       implicitFlowEnabled: false,
-      directAccessGrantsEnabled: true,
+      directAccessGrantsEnabled: false,
       standardFlowEnabled: true,
       frontchannelLogout: true,
       attributes: {
diff --git a/js/apps/admin-ui/src/clients/add/SamlSignature.tsx b/js/apps/admin-ui/src/clients/add/SamlSignature.tsx
index 0e0dfcbe6fb3..9d047188867b 100644
--- a/js/apps/admin-ui/src/clients/add/SamlSignature.tsx
+++ b/js/apps/admin-ui/src/clients/add/SamlSignature.tsx
@@ -6,7 +6,7 @@ import { convertAttributeNameToForm } from "../../util";
 import { FormFields } from "../ClientDetails";
 import { Toggle } from "./SamlConfig";
 
-const SIGNATURE_ALGORITHMS = [
+export const SIGNATURE_ALGORITHMS = [
   "RSA_SHA1",
   "RSA_SHA256",
   "RSA_SHA256_MGF1",
diff --git a/js/apps/admin-ui/src/clients/advanced/AdvancedSettings.tsx b/js/apps/admin-ui/src/clients/advanced/AdvancedSettings.tsx
index 04ce773d4a6a..fa83d269b51b 100644
--- a/js/apps/admin-ui/src/clients/advanced/AdvancedSettings.tsx
+++ b/js/apps/admin-ui/src/clients/advanced/AdvancedSettings.tsx
@@ -1,14 +1,5 @@
 import { HelpItem, TextControl } from "@keycloak/keycloak-ui-shared";
-import {
-  ActionGroup,
-  Button,
-  FormGroup,
-  MenuToggle,
-  Select,
-  SelectList,
-  SelectOption,
-} from "@patternfly/react-core";
-import { useState } from "react";
+import { ActionGroup, Button, FormGroup } from "@patternfly/react-core";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { DefaultSwitchControl } from "../../components/SwitchControl";
@@ -36,7 +27,6 @@ export const AdvancedSettings = ({
   hasConfigureAccess,
 }: AdvancedSettingsProps) => {
   const { t } = useTranslation();
-  const [open, setOpen] = useState(false);
 
   const { realmRepresentation: realm } = useRealm();
 
@@ -144,54 +134,6 @@ export const AdvancedSettings = ({
               stringify
             />
           )}
-          <FormGroup
-            label={t("keyForCodeExchange")}
-            fieldId="keyForCodeExchange"
-            hasNoPaddingTop
-            labelIcon={
-              <HelpItem
-                helpText={t("keyForCodeExchangeHelp")}
-                fieldLabelId="keyForCodeExchange"
-              />
-            }
-          >
-            <Controller
-              name={convertAttributeNameToForm<FormFields>(
-                "attributes.pkce.code.challenge.method",
-              )}
-              defaultValue=""
-              control={control}
-              render={({ field }) => (
-                <Select
-                  toggle={(ref) => (
-                    <MenuToggle
-                      id="keyForCodeExchange"
-                      ref={ref}
-                      onClick={() => setOpen(!open)}
-                      isExpanded={open}
-                    >
-                      {[field.value || t("choose")]}
-                    </MenuToggle>
-                  )}
-                  isOpen={open}
-                  onOpenChange={(isOpen) => setOpen(isOpen)}
-                  onSelect={(_, value) => {
-                    field.onChange(value);
-                    setOpen(false);
-                  }}
-                  selected={field.value}
-                >
-                  <SelectList>
-                    {["", "S256", "plain"].map((v) => (
-                      <SelectOption key={v} value={v}>
-                        {v || t("choose")}
-                      </SelectOption>
-                    ))}
-                  </SelectList>
-                </Select>
-              )}
-            />
-          </FormGroup>
           <DefaultSwitchControl
             name={convertAttributeNameToForm<FormFields>(
               "attributes.require.pushed.authorization.requests",
diff --git a/js/apps/admin-ui/src/clients/advanced/ClusteringPanel.tsx b/js/apps/admin-ui/src/clients/advanced/ClusteringPanel.tsx
index fbca5632a9f5..56edf8cad9d5 100644
--- a/js/apps/admin-ui/src/clients/advanced/ClusteringPanel.tsx
+++ b/js/apps/admin-ui/src/clients/advanced/ClusteringPanel.tsx
@@ -138,6 +138,7 @@ export const ClusteringPanel = ({
                 <ToolbarItem>
                   <Button
                     id="testClusterAvailability"
+                    data-testid="test-cluster-availability"
                     onClick={testCluster}
                     variant={ButtonVariant.secondary}
                     isDisabled={Object.keys(nodes).length === 0}
@@ -148,6 +149,7 @@ export const ClusteringPanel = ({
                 <ToolbarItem>
                   <Button
                     id="registerNodeManually"
+                    data-testid="registerNodeManually"
                     onClick={() => setAddNodeOpen(true)}
                     variant={ButtonVariant.tertiary}
                   >
diff --git a/js/apps/admin-ui/src/clients/advanced/FineGrainOpenIdConnect.tsx b/js/apps/admin-ui/src/clients/advanced/FineGrainOpenIdConnect.tsx
index bec7d14b81a4..c77584ed0e6d 100644
--- a/js/apps/admin-ui/src/clients/advanced/FineGrainOpenIdConnect.tsx
+++ b/js/apps/admin-ui/src/clients/advanced/FineGrainOpenIdConnect.tsx
@@ -1,5 +1,5 @@
 import { ProviderRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/serverInfoRepesentation";
-import { ActionGroup, Button, FormGroup } from "@patternfly/react-core";
+import { ActionGroup, Button, FormGroup, Switch } from "@patternfly/react-core";
 import { useTranslation } from "react-i18next";
 import { HelpItem, SelectControl } from "@keycloak/keycloak-ui-shared";
 import { FormAccess } from "../../components/form/FormAccess";
@@ -8,6 +8,7 @@ import { useServerInfo } from "../../context/server-info/ServerInfoProvider";
 import { convertAttributeNameToForm, sortProviders } from "../../util";
 import { FormFields } from "../ClientDetails";
 import { ApplicationUrls } from "./ApplicationUrls";
+import { Controller, useFormContext } from "react-hook-form";
 
 type FineGrainOpenIdConnectProps = {
   save: () => void;
@@ -21,6 +22,7 @@ export const FineGrainOpenIdConnect = ({
   hasConfigureAccess,
 }: FineGrainOpenIdConnectProps) => {
   const { t } = useTranslation();
+  const { control } = useFormContext();
   const providers = useServerInfo().providers;
   const clientSignatureProviders = providers?.clientSignature.providers;
   const contentEncryptionProviders = providers?.contentencryption.providers;
@@ -63,6 +65,35 @@ export const FineGrainOpenIdConnect = ({
         }}
         options={prependEmpty(clientSignatureProviders!)}
       />
+      <FormGroup
+        label={t("useRfc9068AccessTokenType")}
+        fieldId="useRfc9068AccessTokenType"
+        hasNoPaddingTop
+        labelIcon={
+          <HelpItem
+            helpText={t("useRfc9068AccessTokenTypeHelp")}
+            fieldLabelId="useRfc9068AccessTokenType"
+          />
+        }
+      >
+        <Controller
+          name={convertAttributeNameToForm<FormFields>(
+            "attributes.access.token.header.type.rfc9068",
+          )}
+          defaultValue="false"
+          control={control}
+          render={({ field }) => (
+            <Switch
+              id="useRfc9068AccessTokenType"
+              label={t("on")}
+              labelOff={t("off")}
+              isChecked={field.value === "true"}
+              onChange={(_event, value) => field.onChange(value.toString())}
+              aria-label={t("useRfc9068AccessTokenType")}
+            />
+          )}
+        />
+      </FormGroup>
       <SelectControl
         name={convertAttributeNameToForm<FormFields>(
           "attributes.id.token.signed.response.alg",
@@ -138,7 +169,7 @@ export const FineGrainOpenIdConnect = ({
         label={t("requestObjectSignatureAlgorithm")}
         labelIcon={t("requestObjectSignatureAlgorithmHelp")}
         controller={{
-          defaultValue: "",
+          defaultValue: "any",
         }}
         options={[
           { key: "any", value: t("any") },
@@ -152,7 +183,7 @@ export const FineGrainOpenIdConnect = ({
         label={t("requestObjectEncryption")}
         labelIcon={t("requestObjectEncryptionHelp")}
         controller={{
-          defaultValue: "",
+          defaultValue: "any",
         }}
         options={prependAny(cekManagementProviders!)}
       />
@@ -163,7 +194,7 @@ export const FineGrainOpenIdConnect = ({
         label={t("requestObjectEncoding")}
         labelIcon={t("requestObjectEncodingHelp")}
         controller={{
-          defaultValue: "",
+          defaultValue: "any",
         }}
         options={prependAny(contentEncryptionProviders!)}
       />
@@ -174,7 +205,7 @@ export const FineGrainOpenIdConnect = ({
         label={t("requestObjectRequired")}
         labelIcon={t("requestObjectRequiredHelp")}
         controller={{
-          defaultValue: "",
+          defaultValue: "not required",
         }}
         options={[
           "not required",
@@ -237,10 +268,20 @@ export const FineGrainOpenIdConnect = ({
         options={prependEmpty(contentEncryptionProviders!)}
       />
       <ActionGroup>
-        <Button variant="secondary" id="fineGrainSave" onClick={save}>
+        <Button
+          variant="secondary"
+          id="fineGrainSave"
+          data-testid="fineGrainSave"
+          onClick={save}
+        >
           {t("save")}
         </Button>
-        <Button id="fineGrainRevert" variant="link" onClick={reset}>
+        <Button
+          id="fineGrainRevert"
+          data-testid="fineGrainRevert"
+          variant="link"
+          onClick={reset}
+        >
           {t("revert")}
         </Button>
       </ActionGroup>
diff --git a/js/apps/admin-ui/src/clients/advanced/OpenIdConnectCompatibilityModes.tsx b/js/apps/admin-ui/src/clients/advanced/OpenIdConnectCompatibilityModes.tsx
index e6e5d6efd6cf..e868c0b97e06 100644
--- a/js/apps/admin-ui/src/clients/advanced/OpenIdConnectCompatibilityModes.tsx
+++ b/js/apps/admin-ui/src/clients/advanced/OpenIdConnectCompatibilityModes.tsx
@@ -3,9 +3,10 @@ import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 
 import { FormAccess } from "../../components/form/FormAccess";
-import { HelpItem } from "@keycloak/keycloak-ui-shared";
+import { HelpItem, SelectControl } from "@keycloak/keycloak-ui-shared";
 import { convertAttributeNameToForm } from "../../util";
 import { FormFields } from "../ClientDetails";
+import useIsFeatureEnabled, { Feature } from "../../utils/useIsFeatureEnabled";
 
 type OpenIdConnectCompatibilityModesProps = {
   save: () => void;
@@ -19,7 +20,17 @@ export const OpenIdConnectCompatibilityModes = ({
   hasConfigureAccess,
 }: OpenIdConnectCompatibilityModesProps) => {
   const { t } = useTranslation();
-  const { control } = useFormContext();
+  const { control, watch } = useFormContext();
+  const isFeatureEnabled = useIsFeatureEnabled();
+  const tokenExchangeEnabled = watch(
+    convertAttributeNameToForm<FormFields>(
+      "attributes.standard.token.exchange.enabled",
+    ),
+  );
+  const useRefreshTokens = watch(
+    convertAttributeNameToForm<FormFields>("attributes.use.refresh.tokens"),
+    "true",
+  );
   return (
     <FormAccess
       role="manage-clients"
@@ -171,6 +182,28 @@ export const OpenIdConnectCompatibilityModes = ({
           )}
         />
       </FormGroup>
+
+      {isFeatureEnabled(Feature.StandardTokenExchangeV2) && (
+        <SelectControl
+          name={convertAttributeNameToForm<FormFields>(
+            "attributes.standard.token.exchange.enableRefreshRequestedTokenType",
+          )}
+          label={t("enableRefreshRequestedTokenType")}
+          labelIcon={t("enableRefreshRequestedTokenTypeHelp")}
+          controller={{
+            defaultValue: "",
+          }}
+          isDisabled={
+            tokenExchangeEnabled?.toString() !== "true" ||
+            useRefreshTokens?.toString() !== "true"
+          }
+          options={[
+            { key: "", value: t("choose") },
+            { key: "NO", value: t("no") },
+            { key: "SAME_SESSION", value: t("sameSession") },
+          ]}
+        />
+      )}
       <ActionGroup>
         <Button
           variant="secondary"
diff --git a/js/apps/admin-ui/src/clients/advanced/OpenIdVerifiableCredentials.tsx b/js/apps/admin-ui/src/clients/advanced/OpenIdVerifiableCredentials.tsx
new file mode 100644
index 000000000000..ae8b71489e40
--- /dev/null
+++ b/js/apps/admin-ui/src/clients/advanced/OpenIdVerifiableCredentials.tsx
@@ -0,0 +1,51 @@
+import { Button, ActionGroup } from "@patternfly/react-core";
+import { useTranslation } from "react-i18next";
+import { FormAccess } from "../../components/form/FormAccess";
+import { convertAttributeNameToForm } from "../../util";
+import { FormFields, SaveOptions } from "../ClientDetails";
+import ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import { DefaultSwitchControl } from "../../components/SwitchControl";
+
+type OpenIdVerifiableCredentialsProps = {
+  client: ClientRepresentation;
+  save: (options?: SaveOptions) => void;
+  reset: () => void;
+};
+
+export const OpenIdVerifiableCredentials = ({
+  save,
+  reset,
+}: OpenIdVerifiableCredentialsProps) => {
+  const { t } = useTranslation();
+
+  return (
+    <FormAccess role="manage-clients" isHorizontal>
+      <DefaultSwitchControl
+        name={convertAttributeNameToForm<FormFields>(
+          "attributes.oid4vci.enabled",
+        )}
+        label={t("oid4vciEnabled")}
+        labelIcon={t("oid4vciEnabledHelp")}
+        stringify
+      />
+      <ActionGroup>
+        <Button
+          variant="secondary"
+          id="oid4vciSave"
+          data-testid="oid4vciSave"
+          onClick={() => save()}
+        >
+          {t("save")}
+        </Button>
+        <Button
+          id="oid4vciRevert"
+          data-testid="oid4vciRevert"
+          variant="link"
+          onClick={reset}
+        >
+          {t("revert")}
+        </Button>
+      </ActionGroup>
+    </FormAccess>
+  );
+};
diff --git a/js/apps/admin-ui/src/clients/authorization/AuthorizationEvaluateResourcePolicies.tsx b/js/apps/admin-ui/src/clients/authorization/AuthorizationEvaluateResourcePolicies.tsx
index a0b6c8e54138..9913b79b033c 100644
--- a/js/apps/admin-ui/src/clients/authorization/AuthorizationEvaluateResourcePolicies.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/AuthorizationEvaluateResourcePolicies.tsx
@@ -97,8 +97,7 @@ export const AuthorizationEvaluateResourcePolicies = ({
                           })}
                         >
                           {item.policy?.name}
-                        </Link>
-
+                        </Link>{" "}
                         {t("votedToStatus", {
                           status: capitalize(item.status as string),
                         })}
diff --git a/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx b/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
index e6f359fd727e..3f1e5ef39dc1 100644
--- a/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/AuthorizationExport.tsx
@@ -1,6 +1,6 @@
 import type ResourceServerRepresentation from "@keycloak/keycloak-admin-client/lib/defs/resourceServerRepresentation";
 import {
-  TextAreaControl,
+  KeycloakSpinner,
   useAlerts,
   useFetch,
 } from "@keycloak/keycloak-ui-shared";
@@ -10,12 +10,12 @@ import {
   Button,
   PageSection,
 } from "@patternfly/react-core";
+import CodeEditor from "@uiw/react-textarea-code-editor";
 import { saveAs } from "file-saver";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
 import { FormAccess } from "../../components/form/FormAccess";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { prettyPrintJSON } from "../../util";
 import { useParams } from "../../utils/useParams";
 import type { ClientParams } from "../routes/Client";
@@ -69,14 +69,13 @@ export const AuthorizationExport = () => {
         role="manage-authorization"
         className="pf-v5-u-mt-lg"
       >
-        <TextAreaControl
-          name="authDetails"
-          label={t("authDetails")}
-          labelIcon={t("authDetailsHelp")}
-          resizeOrientation="vertical"
-          defaultValue={code!}
+        <CodeEditor
+          data-testid="authorization-export-code-editor"
+          value={code!}
+          language="json"
           readOnly
           rows={10}
+          style={{ height: "30rem", overflow: "scroll" }}
         />
         <ActionGroup>
           <Button
diff --git a/js/apps/admin-ui/src/clients/authorization/Policies.tsx b/js/apps/admin-ui/src/clients/authorization/Policies.tsx
index 5169d26e90ba..eba235589272 100644
--- a/js/apps/admin-ui/src/clients/authorization/Policies.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/Policies.tsx
@@ -39,6 +39,9 @@ import { DetailDescriptionLink } from "./DetailDescription";
 import { MoreLabel } from "./MoreLabel";
 import { NewPolicyDialog } from "./NewPolicyDialog";
 import { SearchDropdown, SearchForm } from "./SearchDropdown";
+import { useIsAdminPermissionsClient } from "../../utils/useIsAdminPermissionsClient";
+import { toCreatePermissionPolicy } from "../../permissions-configuration/routes/NewPermissionPolicy";
+import { toPermissionPolicyDetails } from "../../permissions-configuration/routes/PermissionPolicyDetails";
 
 type PoliciesProps = {
   clientId: string;
@@ -87,6 +90,7 @@ export const AuthorizationPolicies = ({
   const [first, setFirst] = useState(0);
   const [search, setSearch] = useState<SearchForm>({});
   const [newDialog, toggleDialog] = useToggle();
+  const isAdminPermissionsClient = useIsAdminPermissionsClient(clientId);
 
   useFetch(
     async () => {
@@ -181,13 +185,22 @@ export const AuthorizationPolicies = ({
               policyProviders={policyProviders}
               onSelect={(p) =>
                 navigate(
-                  toCreatePolicy({ id: clientId, realm, policyType: p.type! }),
+                  isAdminPermissionsClient
+                    ? toCreatePermissionPolicy({
+                        realm,
+                        permissionClientId: clientId,
+                        policyType: p.type!,
+                      })
+                    : toCreatePolicy({
+                        id: clientId,
+                        realm,
+                        policyType: p.type!,
+                      }),
                 )
               }
               toggleDialog={toggleDialog}
             />
           )}
-
           <PaginatingTableToolbar
             count={policies.length}
             first={first}
@@ -211,10 +224,14 @@ export const AuthorizationPolicies = ({
                 <ToolbarItem>
                   <Button
                     data-testid="createPolicy"
-                    onClick={toggleDialog}
+                    onClick={() => {
+                      toggleDialog();
+                    }}
                     isDisabled={isDisabled}
                   >
-                    {t("createPolicy")}
+                    {isAdminPermissionsClient
+                      ? t("createPermissionPolicy")
+                      : t("createPolicy")}
                   </Button>
                 </ToolbarItem>
               </>
@@ -250,16 +267,29 @@ export const AuthorizationPolicies = ({
                         }}
                       />
                       <Td data-testid={`name-column-${policy.name}`}>
-                        <Link
-                          to={toPolicyDetails({
-                            realm,
-                            id: clientId,
-                            policyType: policy.type!,
-                            policyId: policy.id!,
-                          })}
-                        >
-                          {policy.name}
-                        </Link>
+                        {isAdminPermissionsClient ? (
+                          <Link
+                            to={toPermissionPolicyDetails({
+                              realm,
+                              permissionClientId: clientId,
+                              policyId: policy.id!,
+                              policyType: policy.type!,
+                            })}
+                          >
+                            {policy.name}
+                          </Link>
+                        ) : (
+                          <Link
+                            to={toPolicyDetails({
+                              realm,
+                              id: clientId,
+                              policyType: policy.type!,
+                              policyId: policy.id!,
+                            })}
+                          >
+                            {policy.name}
+                          </Link>
+                        )}
                       </Td>
                       <Td>{toUpperCase(policy.type!)}</Td>
                       <Td>
@@ -289,7 +319,7 @@ export const AuthorizationPolicies = ({
                       <Td />
                       <Td colSpan={3 + (isDisabled ? 0 : 1)}>
                         <ExpandableRowContent>
-                          {policy.isExpanded && (
+                          {policy.isExpanded && !isAdminPermissionsClient && (
                             <DescriptionList
                               isHorizontal
                               className="keycloak_resource_details"
@@ -309,6 +339,20 @@ export const AuthorizationPolicies = ({
                               />
                             </DescriptionList>
                           )}
+                          {policy.isExpanded && isAdminPermissionsClient && (
+                            <>
+                              <Th>{t("dependentPermission")}</Th>
+                              {policy.dependentPolicies!.map(
+                                (dependentPolicy, index) => (
+                                  <Td key={index}>
+                                    <span style={{ marginLeft: "8px" }}>
+                                      {dependentPolicy.name}
+                                    </span>
+                                  </Td>
+                                ),
+                              )}
+                            </>
+                          )}
                         </ExpandableRowContent>
                       </Td>
                     </Tr>
@@ -336,7 +380,17 @@ export const AuthorizationPolicies = ({
               )}
               onSelect={(p) =>
                 navigate(
-                  toCreatePolicy({ id: clientId, realm, policyType: p.type! }),
+                  isAdminPermissionsClient
+                    ? toCreatePermissionPolicy({
+                        realm,
+                        permissionClientId: clientId,
+                        policyType: p.type!,
+                      })
+                    : toCreatePolicy({
+                        id: clientId,
+                        realm,
+                        policyType: p.type!,
+                      }),
                 )
               }
               toggleDialog={toggleDialog}
@@ -344,10 +398,18 @@ export const AuthorizationPolicies = ({
           )}
           <ListEmptyState
             message={t("emptyPolicies")}
-            instructions={t("emptyPoliciesInstructions")}
+            instructions={
+              isAdminPermissionsClient
+                ? t("emptyPermissionPoliciesInstructions")
+                : t("emptyPoliciesInstructions")
+            }
             isDisabled={isDisabled}
-            primaryActionText={t("createPolicy")}
-            onPrimaryAction={toggleDialog}
+            primaryActionText={
+              isAdminPermissionsClient
+                ? t("createPermissionPolicy")
+                : t("createPolicy")
+            }
+            onPrimaryAction={() => toggleDialog()}
           />
         </>
       )}
diff --git a/js/apps/admin-ui/src/clients/authorization/ResourcesPolicySelect.tsx b/js/apps/admin-ui/src/clients/authorization/ResourcesPolicySelect.tsx
index 2b00d5758ce5..995eea027166 100644
--- a/js/apps/admin-ui/src/clients/authorization/ResourcesPolicySelect.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/ResourcesPolicySelect.tsx
@@ -23,6 +23,7 @@ import {
   Controller,
   ControllerRenderProps,
   useFormContext,
+  useWatch,
 } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { Link, useNavigate } from "react-router-dom";
@@ -34,6 +35,7 @@ import { toCreatePolicy } from "../routes/NewPolicy";
 import { toPolicyDetails } from "../routes/PolicyDetails";
 import { toResourceDetails } from "../routes/Resource";
 import { NewPolicyDialog } from "./NewPolicyDialog";
+import { useIsAdminPermissionsClient } from "../../utils/useIsAdminPermissionsClient";
 
 type Type = "resources" | "policies";
 
@@ -99,9 +101,17 @@ export const ResourcesPolicySelect = ({
     useState<PolicyProviderRepresentation[]>();
   const [onUnsavedChangesConfirm, setOnUnsavedChangesConfirm] =
     useState<() => void>();
+  const isAdminPermissionsClient = useIsAdminPermissionsClient(clientId);
+  const [selected, setSelected] = useState<Policies[]>([]);
 
   const functions = typeMapping[name];
 
+  const value = useWatch({
+    control,
+    name: name!,
+    defaultValue: preSelected ? [preSelected] : [],
+  });
+
   const convert = (
     p: PolicyRepresentation | ResourceRepresentation,
   ): Policies => ({
@@ -154,6 +164,28 @@ export const ResourcesPolicySelect = ({
     [search],
   );
 
+  useFetch(
+    async () => {
+      if (name === "resources")
+        return await Promise.all(
+          (value || []).map((id) =>
+            adminClient.clients.getResource({ id: clientId, resourceId: id }),
+          ),
+        );
+      return await Promise.all(
+        (value || []).map(async (id) =>
+          adminClient.clients.findOnePolicy({
+            id: clientId,
+            type: "",
+            policyId: id,
+          }),
+        ),
+      );
+    },
+    (result: any[]) => setSelected(result.map((r) => convert(r))),
+    [value],
+  );
+
   const [toggleUnsavedChangesDialog, UnsavedChangesConfirm] = useConfirmDialog({
     titleKey: t("unsavedChangesTitle"),
     messageKey: t("unsavedChangesConfirm"),
@@ -188,36 +220,32 @@ export const ResourcesPolicySelect = ({
   ) => {
     return (
       <ChipGroup>
-        {field.value?.map((permissionId) => {
-          const item = items.find(
-            (permission) => permission.id === permissionId,
-          );
-
-          if (!item) return;
-
-          const route = to(item);
-          return (
-            <Chip
-              key={item.id}
-              onClick={() => {
-                field.onChange(field.value?.filter((id) => id !== item.id));
-              }}
-            >
+        {selected?.map((item) => (
+          <Chip
+            key={item.id}
+            onClick={() => {
+              field.onChange(field.value?.filter((id) => id !== item.id) || []);
+              setSelected(selected?.filter((p) => p.id !== item.id) || []);
+            }}
+          >
+            {!isAdminPermissionsClient ? (
               <Link
-                to={route}
+                to={to(item)}
                 onClick={(event) => {
                   if (isDirty) {
                     event.preventDefault();
-                    setOnUnsavedChangesConfirm(() => () => navigate(route));
+                    setOnUnsavedChangesConfirm(() => () => navigate(to(item)));
                     toggleUnsavedChangesDialog();
                   }
                 }}
               >
                 {item.name}
               </Link>
-            </Chip>
-          );
-        })}
+            ) : (
+              item.name
+            )}
+          </Chip>
+        ))}
       </ChipGroup>
     );
   };
@@ -254,7 +282,11 @@ export const ResourcesPolicySelect = ({
               field.onChange([]);
               setSearch("");
             }}
-            selections={field.value}
+            selections={
+              variant === SelectVariant.typeaheadMulti
+                ? field.value
+                : items.find((i) => i.id === field.value?.[0])?.name
+            }
             onSelect={(selectedValue) => {
               const option = selectedValue.toString();
               if (variant === SelectVariant.typeaheadMulti) {
@@ -276,7 +308,7 @@ export const ResourcesPolicySelect = ({
             typeAheadAriaLabel={t(name)}
             chipGroupComponent={toChipGroupItems(field)}
             footer={
-              name === "policies" ? (
+              name === "policies" && !isAdminPermissionsClient ? (
                 <Button
                   variant="link"
                   isInline
diff --git a/js/apps/admin-ui/src/clients/authorization/ScopePicker.tsx b/js/apps/admin-ui/src/clients/authorization/ScopePicker.tsx
index 109b2ff08731..22f504da8a5c 100644
--- a/js/apps/admin-ui/src/clients/authorization/ScopePicker.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/ScopePicker.tsx
@@ -1,5 +1,6 @@
 import type ScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/scopeRepresentation";
 import {
+  FormErrorText,
   HelpItem,
   KeycloakSelect,
   SelectVariant,
@@ -11,21 +12,32 @@ import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
 import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
+import { useIsAdminPermissionsClient } from "../../utils/useIsAdminPermissionsClient";
 
 type Scope = {
   id: string;
   name: string;
 };
 
-export const ScopePicker = ({ clientId }: { clientId: string }) => {
-  const { adminClient } = useAdminClient();
+type ScopePickerProps = {
+  clientId: string;
+  resourceTypeScopes?: string[];
+};
 
+export const ScopePicker = ({
+  clientId,
+  resourceTypeScopes,
+}: ScopePickerProps) => {
+  const { adminClient } = useAdminClient();
   const { t } = useTranslation();
-  const { control } = useFormContext();
-
+  const {
+    control,
+    formState: { errors },
+  } = useFormContext();
   const [open, setOpen] = useState(false);
   const [scopes, setScopes] = useState<ScopeRepresentation[]>();
   const [search, setSearch] = useState("");
+  const isAdminPermissionsClient = useIsAdminPermissionsClient(clientId);
 
   useFetch(
     () => {
@@ -42,14 +54,20 @@ export const ScopePicker = ({ clientId }: { clientId: string }) => {
     [search],
   );
 
-  const renderScopes = (scopes: ScopeRepresentation[]) =>
-    scopes.map((option) => (
-      <SelectOption key={option.id} value={option}>
-        {option.name}
+  const renderScopes = (scopes: ScopeRepresentation[] | string[]) =>
+    scopes.map((option, index) => (
+      <SelectOption key={index} value={option}>
+        {typeof option === "string" ? option : option.name}
       </SelectOption>
     ));
 
-  if (!scopes) return <KeycloakSpinner />;
+  if (!scopes && !resourceTypeScopes) return <KeycloakSpinner />;
+
+  const allScopes =
+    isAdminPermissionsClient && resourceTypeScopes
+      ? resourceTypeScopes
+      : scopes?.map((scope) => scope.name!);
+
   return (
     <FormGroup
       label={t("authorizationScopes")}
@@ -57,48 +75,58 @@ export const ScopePicker = ({ clientId }: { clientId: string }) => {
         <HelpItem helpText={t("clientScopesHelp")} fieldLabelId="scopes" />
       }
       fieldId="scopes"
+      isRequired={isAdminPermissionsClient}
     >
       <Controller
         name="scopes"
         defaultValue={[]}
         control={control}
-        render={({ field }) => (
-          <KeycloakSelect
-            toggleId="scopes"
-            variant={SelectVariant.typeaheadMulti}
-            chipGroupProps={{
-              numChips: 3,
-              expandedText: t("hide"),
-              collapsedText: t("showRemaining"),
-            }}
-            onToggle={(val) => setOpen(val)}
-            isOpen={open}
-            selections={field.value.map((o: Scope) => o.name)}
-            onFilter={(value) => {
-              setSearch(value);
-              return renderScopes(scopes);
-            }}
-            onSelect={(selectedValue) => {
-              const option =
-                typeof selectedValue === "string"
-                  ? selectedValue
-                  : (selectedValue as Scope).name;
-              const changedValue = field.value.find(
-                (o: Scope) => o.name === option,
-              )
-                ? field.value.filter((item: Scope) => item.name !== option)
-                : [...field.value, selectedValue];
-              field.onChange(changedValue);
-            }}
-            onClear={() => {
-              setSearch("");
-              field.onChange([]);
-            }}
-            typeAheadAriaLabel={t("authorizationScopes")}
-          >
-            {renderScopes(scopes)}
-          </KeycloakSelect>
-        )}
+        rules={isAdminPermissionsClient ? { required: t("requiredField") } : {}}
+        render={({ field }) => {
+          const selectedValues = field.value.map((o: Scope) => o.name);
+          return (
+            <>
+              <KeycloakSelect
+                toggleId="scopes"
+                variant={SelectVariant.typeaheadMulti}
+                chipGroupProps={{
+                  numChips: 3,
+                  expandedText: t("hide"),
+                  collapsedText: t("showRemaining"),
+                }}
+                onToggle={(val) => setOpen(val)}
+                isOpen={open}
+                selections={selectedValues}
+                onFilter={(value) => {
+                  setSearch(value);
+                  return renderScopes(allScopes || []);
+                }}
+                onSelect={(selectedValue) => {
+                  const option =
+                    typeof selectedValue === "string"
+                      ? selectedValue
+                      : (selectedValue as Scope).name;
+                  const changedValue = field.value.find(
+                    (o: Scope) => o.name === option,
+                  )
+                    ? field.value.filter((item: Scope) => item.name !== option)
+                    : [...field.value, { name: option }];
+                  field.onChange(changedValue);
+                }}
+                onClear={() => {
+                  setSearch("");
+                  field.onChange([]);
+                }}
+                typeAheadAriaLabel={t("authorizationScopes")}
+              >
+                {renderScopes(allScopes || [])}
+              </KeycloakSelect>
+              {isAdminPermissionsClient && errors.scopes && (
+                <FormErrorText message={t("required")} />
+              )}
+            </>
+          );
+        }}
       />
     </FormGroup>
   );
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/Aggregate.tsx b/js/apps/admin-ui/src/clients/authorization/policy/Aggregate.tsx
index 5edd2b168b53..bb7386455cf8 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/Aggregate.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/Aggregate.tsx
@@ -1,15 +1,16 @@
 import { FormGroup } from "@patternfly/react-core";
 import { useTranslation } from "react-i18next";
-
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import { useParams } from "../../../utils/useParams";
 import type { PolicyDetailsParams } from "../../routes/PolicyDetails";
 import { DecisionStrategySelect } from "../DecisionStrategySelect";
 import { ResourcesPolicySelect } from "../ResourcesPolicySelect";
+import { NewPermissionPolicyDetailsParams } from "../../../permissions-configuration/routes/NewPermissionPolicy";
 
 export const Aggregate = () => {
   const { t } = useTranslation();
   const { id } = useParams<PolicyDetailsParams>();
+  const { permissionClientId } = useParams<NewPermissionPolicyDetailsParams>();
 
   return (
     <>
@@ -20,7 +21,10 @@ export const Aggregate = () => {
           <HelpItem helpText={t("applyPolicyHelp")} fieldLabelId="policies" />
         }
       >
-        <ResourcesPolicySelect name="policies" clientId={id} />
+        <ResourcesPolicySelect
+          name="policies"
+          clientId={permissionClientId || id}
+        />
       </FormGroup>
       <DecisionStrategySelect helpLabel="policyDecisionStagey" />
     </>
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/Client.tsx b/js/apps/admin-ui/src/clients/authorization/policy/Client.tsx
index 9180d891558e..91143fe3dff3 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/Client.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/Client.tsx
@@ -12,6 +12,7 @@ export const Client = () => {
       required
       defaultValue={[]}
       variant="typeaheadMulti"
+      clientKey="id"
     />
   );
 };
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/ClientScope.tsx b/js/apps/admin-ui/src/clients/authorization/policy/ClientScope.tsx
index b542793e3be2..70c637c98705 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/ClientScope.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/ClientScope.tsx
@@ -1,9 +1,5 @@
 import type ClientScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientScopeRepresentation";
-import {
-  FormErrorText,
-  HelpItem,
-  useFetch,
-} from "@keycloak/keycloak-ui-shared";
+import { HelpItem, useFetch } from "@keycloak/keycloak-ui-shared";
 import { Button, Checkbox, FormGroup } from "@patternfly/react-core";
 import { MinusCircleIcon } from "@patternfly/react-icons";
 import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
@@ -23,12 +19,7 @@ export const ClientScope = () => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const {
-    control,
-    getValues,
-    setValue,
-    formState: { errors },
-  } = useFormContext<{
+  const { control, getValues, setValue } = useFormContext<{
     clientScopes: RequiredIdValue[];
   }>();
 
@@ -42,11 +33,10 @@ export const ClientScope = () => {
 
   useFetch(
     () => adminClient.clientScopes.find(),
-    (scopes) => {
+    (scopes = []) => {
+      const clientScopes = getValues("clientScopes") || [];
       setSelectedScopes(
-        getValues("clientScopes").map(
-          (s) => scopes.find((c) => c.id === s.id)!,
-        ),
+        clientScopes.map((s) => scopes.find((c) => c.id === s.id)!),
       );
       setScopes(localeSort(scopes, mapByKey("name")));
     },
@@ -63,16 +53,11 @@ export const ClientScope = () => {
         />
       }
       fieldId="clientScopes"
-      isRequired
     >
       <Controller
         name="clientScopes"
         control={control}
         defaultValue={[]}
-        rules={{
-          validate: (value: RequiredIdValue[]) =>
-            value.filter((c) => c.id).length > 0,
-        }}
         render={({ field }) => (
           <>
             {open && (
@@ -163,9 +148,6 @@ export const ClientScope = () => {
           </Tbody>
         </Table>
       )}
-      {errors.clientScopes && (
-        <FormErrorText message={t("requiredClientScope")} />
-      )}
     </FormGroup>
   );
 };
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/Group.tsx b/js/apps/admin-ui/src/clients/authorization/policy/Group.tsx
index 152c7509b35e..0e680c0229b1 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/Group.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/Group.tsx
@@ -1,10 +1,5 @@
 import type GroupRepresentation from "@keycloak/keycloak-admin-client/lib/defs/groupRepresentation";
-import {
-  FormErrorText,
-  HelpItem,
-  TextControl,
-  useFetch,
-} from "@keycloak/keycloak-ui-shared";
+import { HelpItem, TextControl, useFetch } from "@keycloak/keycloak-ui-shared";
 import { Button, Checkbox, FormGroup } from "@patternfly/react-core";
 import { MinusCircleIcon } from "@patternfly/react-icons";
 import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
@@ -28,12 +23,7 @@ export const Group = () => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const {
-    control,
-    getValues,
-    setValue,
-    formState: { errors },
-  } = useFormContext<GroupForm>();
+  const { control, getValues, setValue } = useFormContext<GroupForm>();
   const values = getValues("groups");
 
   const [open, setOpen] = useState(false);
@@ -69,16 +59,11 @@ export const Group = () => {
           <HelpItem helpText={t("policyGroupsHelp")} fieldLabelId="groups" />
         }
         fieldId="groups"
-        isRequired
       >
         <Controller
           name="groups"
           control={control}
           defaultValue={[]}
-          rules={{
-            validate: (value?: GroupValue[]) =>
-              value && value.filter(({ id }) => id).length > 0,
-          }}
           render={({ field }) => (
             <>
               {open && (
@@ -164,7 +149,6 @@ export const Group = () => {
             </Tbody>
           </Table>
         )}
-        {errors.groups && <FormErrorText message={t("requiredGroups")} />}
       </FormGroup>
     </>
   );
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/JavaScript.tsx b/js/apps/admin-ui/src/clients/authorization/policy/JavaScript.tsx
index 19cd22658d7a..f5d5fcad9440 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/JavaScript.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/JavaScript.tsx
@@ -1,8 +1,8 @@
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import { FormGroup } from "@patternfly/react-core";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
+import CodeEditor from "../../../components/form/CodeEditor";
 
 export const JavaScript = () => {
   const { t } = useTranslation();
@@ -27,8 +27,8 @@ export const JavaScript = () => {
             data-testid="code"
             readOnly
             value={field.value}
-            style={{ height: "600px", overflow: "scroll" }}
             language="js"
+            height={600}
           />
         )}
       />
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/LogicSelector.tsx b/js/apps/admin-ui/src/clients/authorization/policy/LogicSelector.tsx
index eba348449047..f5411e747436 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/LogicSelector.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/LogicSelector.tsx
@@ -7,7 +7,7 @@ import { HelpItem } from "@keycloak/keycloak-ui-shared";
 const LOGIC_TYPES = ["POSITIVE", "NEGATIVE"] as const;
 
 type LogicSelectorProps = {
-  isDisabled: boolean;
+  isDisabled?: boolean;
 };
 
 export const LogicSelector = ({ isDisabled }: LogicSelectorProps) => {
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/NameDescription.tsx b/js/apps/admin-ui/src/clients/authorization/policy/NameDescription.tsx
index 19ffed7799fa..3e77bf619ab8 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/NameDescription.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/NameDescription.tsx
@@ -1,18 +1,25 @@
 import { useTranslation } from "react-i18next";
 import { TextAreaControl, TextControl } from "@keycloak/keycloak-ui-shared";
+import { useIsAdminPermissionsClient } from "../../../utils/useIsAdminPermissionsClient";
 
 type NameDescriptionProps = {
-  isDisabled: boolean;
+  isDisabled?: boolean;
+  clientId?: string;
 };
 
-export const NameDescription = ({ isDisabled }: NameDescriptionProps) => {
+export const NameDescription = ({
+  isDisabled,
+  clientId,
+}: NameDescriptionProps) => {
   const { t } = useTranslation();
+  const isAdminPermissionsClient = useIsAdminPermissionsClient(clientId!);
 
   return (
     <>
       <TextControl
         name="name"
         label={t("name")}
+        labelIcon={isAdminPermissionsClient ? t("permissionNameHelpText") : ""}
         rules={{ required: t("required") }}
         isDisabled={isDisabled}
       />
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/PolicyDetails.tsx b/js/apps/admin-ui/src/clients/authorization/policy/PolicyDetails.tsx
index 84b5e0dd2289..77cdfe471bf6 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/PolicyDetails.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/PolicyDetails.tsx
@@ -23,6 +23,10 @@ import {
   PolicyDetailsParams,
   toPolicyDetails,
 } from "../../routes/PolicyDetails";
+import { useIsAdminPermissionsClient } from "../../../utils/useIsAdminPermissionsClient";
+import { toPermissionsConfigurationTabs } from "../../../permissions-configuration/routes/PermissionsConfigurationTabs";
+import { NewPermissionPolicyDetailsParams } from "../../../permissions-configuration/routes/NewPermissionPolicy";
+import { toPermissionPolicyDetails } from "../../../permissions-configuration/routes/PermissionPolicyDetails";
 import { Aggregate } from "./Aggregate";
 import { Client } from "./Client";
 import { ClientScope, RequiredIdValue } from "./ClientScope";
@@ -61,29 +65,29 @@ export const isValidComponentType = (value: string) => value in COMPONENTS;
 
 export default function PolicyDetails() {
   const { adminClient } = useAdminClient();
-
   const { t } = useTranslation();
   const { id, realm, policyId, policyType } = useParams<PolicyDetailsParams>();
+  const { permissionClientId } = useParams<NewPermissionPolicyDetailsParams>();
   const navigate = useNavigate();
   const form = useForm();
   const { reset, handleSubmit } = form;
-
   const { addAlert, addError } = useAlerts();
-
   const [policy, setPolicy] = useState<PolicyRepresentation>();
   const isDisabled = policyType === "js";
+  const isAdminPermissionsClient =
+    useIsAdminPermissionsClient(permissionClientId);
 
   useFetch(
     async () => {
       if (policyId) {
         const result = await Promise.all([
           adminClient.clients.findOnePolicy({
-            id,
-            type: policyType,
+            id: permissionClientId ?? id,
+            type: policyType!,
             policyId,
           }) as PolicyRepresentation | undefined,
           adminClient.clients.getAssociatedPolicies({
-            id,
+            id: permissionClientId ?? id,
             permissionId: policyId,
           }),
         ]);
@@ -103,34 +107,40 @@ export default function PolicyDetails() {
       reset({ ...policy, policies });
       setPolicy(policy);
     },
-    [id, policyType, policyId],
+    [permissionClientId, id, policyType, policyId],
   );
 
-  const onSubmit = async (policy: Policy) => {
-    // remove entries that only have the boolean set and no id
+  const onSubmitPolicy = async (policy: Policy) => {
     policy.groups = policy.groups?.filter((g) => g.id);
     policy.clientScopes = policy.clientScopes?.filter((c) => c.id);
     policy.roles = policy.roles
       ?.filter((r) => r.id)
       .map((r) => ({ ...r, required: r.required || false }));
 
+    const clientId = isAdminPermissionsClient ? permissionClientId : id;
+    const navigateTo = isAdminPermissionsClient
+      ? toPermissionPolicyDetails
+      : toPolicyDetails;
+
     try {
       if (policyId) {
         await adminClient.clients.updatePolicy(
-          { id, type: policyType, policyId },
+          { id: clientId!, type: policyType!, policyId },
           policy,
         );
       } else {
         const result = await adminClient.clients.createPolicy(
-          { id, type: policyType },
+          { id: clientId!, type: policyType! },
           policy,
         );
+
         navigate(
-          toPolicyDetails({
-            realm,
-            id,
-            policyType,
+          navigateTo({
+            realm: realm!,
+            id: clientId!,
+            permissionClientId: clientId!,
             policyId: result.id!,
+            policyType: result.type!,
           }),
         );
       }
@@ -150,11 +160,19 @@ export default function PolicyDetails() {
     onConfirm: async () => {
       try {
         await adminClient.clients.delPolicy({
-          id,
+          id: isAdminPermissionsClient ? permissionClientId : id,
           policyId,
         });
         addAlert(t("policyDeletedSuccess"), AlertVariant.success);
-        navigate(toAuthorizationTab({ realm, clientId: id, tab: "policies" }));
+        navigate(
+          isAdminPermissionsClient
+            ? toPermissionsConfigurationTabs({
+                realm: realm!,
+                permissionClientId,
+                tab: "policies",
+              })
+            : toAuthorizationTab({ realm, clientId: id, tab: "policies" }),
+        );
       } catch (error) {
         addError("policyDeletedError", error);
       }
@@ -197,7 +215,7 @@ export default function PolicyDetails() {
       <PageSection variant="light">
         <FormAccess
           isHorizontal
-          onSubmit={handleSubmit(onSubmit)}
+          onSubmit={handleSubmit((policy) => onSubmitPolicy(policy))}
           role="anyone" // if you get this far it means you have access
         >
           <FormProvider {...form}>
@@ -223,11 +241,19 @@ export default function PolicyDetails() {
                 component={(props) => (
                   <Link
                     {...props}
-                    to={toAuthorizationTab({
-                      realm,
-                      clientId: id,
-                      tab: "policies",
-                    })}
+                    to={
+                      isAdminPermissionsClient
+                        ? toPermissionsConfigurationTabs({
+                            realm: realm!,
+                            permissionClientId,
+                            tab: "policies",
+                          })
+                        : toAuthorizationTab({
+                            realm,
+                            clientId: id,
+                            tab: "policies",
+                          })
+                    }
                   />
                 )}
               >
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/Role.tsx b/js/apps/admin-ui/src/clients/authorization/policy/Role.tsx
index 6412b7065c2b..d5afa79a6fb6 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/Role.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/Role.tsx
@@ -1,8 +1,4 @@
-import {
-  FormErrorText,
-  HelpItem,
-  useFetch,
-} from "@keycloak/keycloak-ui-shared";
+import { HelpItem, useFetch } from "@keycloak/keycloak-ui-shared";
 import { Button, Checkbox, FormGroup } from "@patternfly/react-core";
 import { MinusCircleIcon } from "@patternfly/react-icons";
 import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
@@ -11,7 +7,11 @@ import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../../admin-client";
 import { DefaultSwitchControl } from "../../../components/SwitchControl";
-import { AddRoleMappingModal } from "../../../components/role-mapping/AddRoleMappingModal";
+import {
+  AddRoleButton,
+  AddRoleMappingModal,
+  FilterType,
+} from "../../../components/role-mapping/AddRoleMappingModal";
 import { Row, ServiceRole } from "../../../components/role-mapping/RoleMapping";
 import type { RequiredIdValue } from "./ClientScope";
 
@@ -19,18 +19,15 @@ export const Role = () => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const {
-    control,
-    getValues,
-    setValue,
-    formState: { errors },
-  } = useFormContext<{
+  const { control, getValues, setValue } = useFormContext<{
     roles?: RequiredIdValue[];
     fetchRoles?: boolean;
   }>();
   const values = getValues("roles");
 
   const [open, setOpen] = useState(false);
+  const [filterType, setFilterType] = useState<FilterType>("clients");
+
   const [selectedRoles, setSelectedRoles] = useState<Row[]>([]);
 
   useFetch(
@@ -64,22 +61,19 @@ export const Role = () => {
           <HelpItem helpText={t("policyRolesHelp")} fieldLabelId="roles" />
         }
         fieldId="roles"
-        isRequired
       >
         <Controller
           name="roles"
           control={control}
           defaultValue={[]}
-          rules={{
-            validate: (value?: RequiredIdValue[]) =>
-              value && value.filter((c) => c.id).length > 0,
-          }}
           render={({ field }) => (
             <>
               {open && (
                 <AddRoleMappingModal
                   id="role"
                   type="roles"
+                  title={t("assignRole")}
+                  filterType={filterType}
                   onAssign={(rows) => {
                     field.onChange([
                       ...(field.value || []),
@@ -91,18 +85,16 @@ export const Role = () => {
                   onClose={() => {
                     setOpen(false);
                   }}
-                  isLDAPmapper
                 />
               )}
-              <Button
+              <AddRoleButton
                 data-testid="select-role-button"
                 variant="secondary"
-                onClick={() => {
+                onFilerTypeChange={(type) => {
+                  setFilterType(type);
                   setOpen(true);
                 }}
-              >
-                {t("addRoles")}
-              </Button>
+              />
             </>
           )}
         />
@@ -159,7 +151,6 @@ export const Role = () => {
             </Tbody>
           </Table>
         )}
-        {errors.roles && <FormErrorText message={t("requiredRoles")} />}
       </FormGroup>
       <DefaultSwitchControl
         name="fetchRoles"
diff --git a/js/apps/admin-ui/src/clients/authorization/policy/User.tsx b/js/apps/admin-ui/src/clients/authorization/policy/User.tsx
index db654e064ab9..133a9114beb0 100644
--- a/js/apps/admin-ui/src/clients/authorization/policy/User.tsx
+++ b/js/apps/admin-ui/src/clients/authorization/policy/User.tsx
@@ -10,7 +10,6 @@ export const User = () => {
       helpText={t("policyUsers")}
       defaultValue={[]}
       variant="typeaheadMulti"
-      isRequired
     />
   );
 };
diff --git a/js/apps/admin-ui/src/clients/credentials/Credentials.tsx b/js/apps/admin-ui/src/clients/credentials/Credentials.tsx
index c6407aac5270..76479a4e7b9e 100644
--- a/js/apps/admin-ui/src/clients/credentials/Credentials.tsx
+++ b/js/apps/admin-ui/src/clients/credentials/Credentials.tsx
@@ -184,7 +184,10 @@ export const Credentials = ({ client, save, refresh }: CredentialsProps) => {
             {clientAuthenticatorType === "client-x509" && <X509 />}
             {providerProperties && (
               <Form>
-                <DynamicComponents properties={providerProperties} />
+                <DynamicComponents
+                  properties={providerProperties}
+                  convertToName={(name) => `attributes.${name}`}
+                />
               </Form>
             )}
             <ActionGroup>
diff --git a/js/apps/admin-ui/src/clients/credentials/SignedJWT.tsx b/js/apps/admin-ui/src/clients/credentials/SignedJWT.tsx
index 7f2c023d9bfb..63ba6160177b 100644
--- a/js/apps/admin-ui/src/clients/credentials/SignedJWT.tsx
+++ b/js/apps/admin-ui/src/clients/credentials/SignedJWT.tsx
@@ -1,8 +1,12 @@
 import { useTranslation } from "react-i18next";
+import { Controller, useFormContext } from "react-hook-form";
 import { SelectControl } from "@keycloak/keycloak-ui-shared";
 import { useServerInfo } from "../../context/server-info/ServerInfoProvider";
 import { convertAttributeNameToForm } from "../../util";
 import { FormFields } from "../ClientDetails";
+import { TimeSelector } from "../../components/time-selector/TimeSelector";
+import { FormGroup } from "@patternfly/react-core";
+import { HelpItem } from "@keycloak/keycloak-ui-shared";
 
 type SignedJWTProps = {
   clientAuthenticatorType: string;
@@ -16,23 +20,53 @@ export const SignedJWT = ({ clientAuthenticatorType }: SignedJWTProps) => {
       : (cryptoInfo?.clientSignatureSymmetricAlgorithms ?? []);
 
   const { t } = useTranslation();
+  const { control } = useFormContext<FormFields>();
 
   return (
-    <SelectControl
-      name={convertAttributeNameToForm<FormFields>(
-        "attributes.token.endpoint.auth.signing.alg",
-      )}
-      label={t("signatureAlgorithm")}
-      labelIcon={t("signatureAlgorithmHelp")}
-      controller={{
-        defaultValue: "",
-      }}
-      isScrollable
-      maxMenuHeight="200px"
-      options={[
-        { key: "", value: t("anyAlgorithm") },
-        ...providers.map((option) => ({ key: option, value: option })),
-      ]}
-    />
+    <>
+      <SelectControl
+        name={convertAttributeNameToForm<FormFields>(
+          "attributes.token.endpoint.auth.signing.alg",
+        )}
+        label={t("signatureAlgorithm")}
+        labelIcon={t("signatureAlgorithmHelp")}
+        controller={{
+          defaultValue: "",
+        }}
+        isScrollable
+        maxMenuHeight="200px"
+        options={[
+          { key: "", value: t("anyAlgorithm") },
+          ...providers.map((option) => ({ key: option, value: option })),
+        ]}
+      />
+      <FormGroup
+        label={t("signatureMaxExp")}
+        fieldId="signatureMaxExp"
+        className="pf-v5-u-my-md"
+        labelIcon={
+          <HelpItem
+            helpText={t("signatureMaxExpHelp")}
+            fieldLabelId="signatureMaxExp"
+          />
+        }
+      >
+        <Controller
+          name={convertAttributeNameToForm<FormFields>(
+            "attributes.token.endpoint.auth.signing.max.exp",
+          )}
+          defaultValue=""
+          control={control}
+          render={({ field }) => (
+            <TimeSelector
+              value={field.value!}
+              onChange={field.onChange}
+              units={["second", "minute"]}
+              min="1"
+            />
+          )}
+        />
+      </FormGroup>
+    </>
   );
 };
diff --git a/js/apps/admin-ui/src/clients/credentials/X509.tsx b/js/apps/admin-ui/src/clients/credentials/X509.tsx
index a80e21180bac..c72f08f2812d 100644
--- a/js/apps/admin-ui/src/clients/credentials/X509.tsx
+++ b/js/apps/admin-ui/src/clients/credentials/X509.tsx
@@ -14,6 +14,7 @@ export const X509 = () => {
         )}
         label={t("allowRegexComparison")}
         labelIcon={t("allowRegexComparisonHelp")}
+        stringify
       />
       <TextControl
         name={convertAttributeNameToForm("attributes.x509.subjectdn")}
diff --git a/js/apps/admin-ui/src/clients/initial-access/AccessTokenDialog.tsx b/js/apps/admin-ui/src/clients/initial-access/AccessTokenDialog.tsx
index a172ed0f5bdc..ee6a146b07a1 100644
--- a/js/apps/admin-ui/src/clients/initial-access/AccessTokenDialog.tsx
+++ b/js/apps/admin-ui/src/clients/initial-access/AccessTokenDialog.tsx
@@ -34,7 +34,11 @@ export const AccessTokenDialog = ({
       />
       <Form className="pf-v5-u-mt-md">
         <FormGroup label={t("initialAccessToken")} fieldId="initialAccessToken">
-          <ClipboardCopy id="initialAccessToken" isReadOnly>
+          <ClipboardCopy
+            id="initialAccessToken"
+            data-testid="initialAccessToken"
+            isReadOnly
+          >
             {token}
           </ClipboardCopy>
         </FormGroup>
diff --git a/js/apps/admin-ui/src/clients/keys/GenerateKeyDialog.tsx b/js/apps/admin-ui/src/clients/keys/GenerateKeyDialog.tsx
index 0260ee41363c..d6a1bed848aa 100644
--- a/js/apps/admin-ui/src/clients/keys/GenerateKeyDialog.tsx
+++ b/js/apps/admin-ui/src/clients/keys/GenerateKeyDialog.tsx
@@ -1,23 +1,20 @@
 import type KeyStoreConfig from "@keycloak/keycloak-admin-client/lib/defs/keystoreConfig";
-import { HelpItem, SelectControl } from "@keycloak/keycloak-ui-shared";
+import {
+  HelpItem,
+  NumberControl,
+  SelectControl,
+  FileUploadControl,
+} from "@keycloak/keycloak-ui-shared";
 import {
   Button,
   ButtonVariant,
-  FileUpload,
   Form,
-  FormGroup,
   Modal,
   ModalVariant,
   Text,
   TextContent,
 } from "@patternfly/react-core";
-import { useState } from "react";
-import {
-  Controller,
-  FormProvider,
-  useForm,
-  useFormContext,
-} from "react-hook-form";
+import { FormProvider, useForm, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useServerInfo } from "../../context/server-info/ServerInfoProvider";
 import { StoreSettings } from "./StoreSettings";
@@ -55,9 +52,7 @@ export const KeyForm = ({
 }: KeyFormProps) => {
   const { t } = useTranslation();
 
-  const [filename, setFilename] = useState<string>();
-
-  const { control, watch } = useFormContext<FormFields>();
+  const { watch } = useFormContext<FormFields>();
   const format = watch("format");
 
   const { cryptoInfo } = useServerInfo();
@@ -65,6 +60,7 @@ export const KeyForm = ({
     ...(cryptoInfo?.supportedKeystoreTypes ?? []),
     ...(hasPem ? [CERT_PEM] : []),
   ];
+  const keySizes = ["4096", "3072", "2048"];
 
   return (
     <Form className="pf-v5-u-pt-lg">
@@ -79,7 +75,7 @@ export const KeyForm = ({
         options={supportedKeystoreTypes}
       />
       {useFile && (
-        <FormGroup
+        <FileUploadControl
           label={t("importFile")}
           labelIcon={
             <HelpItem
@@ -87,30 +83,39 @@ export const KeyForm = ({
               fieldLabelId="importFile"
             />
           }
-          fieldId="importFile"
-        >
-          <Controller
-            name="file"
-            defaultValue=""
-            control={control}
-            render={({ field }) => (
-              <FileUpload
-                id="importFile"
-                value={field.value}
-                filename={filename}
-                browseButtonText={t("browse")}
-                onTextChange={(value) => {
-                  field.onChange(value);
-                }}
-                onFileInputChange={(_, file) => setFilename(file.name)}
-              />
-            )}
-          />
-        </FormGroup>
+          rules={{
+            required: t("required"),
+          }}
+          name="file"
+          id="importFile"
+        />
       )}
       {format !== CERT_PEM && (
         <StoreSettings hidePassword={useFile} isSaml={isSaml} />
       )}
+      {!useFile && (
+        <>
+          <SelectControl
+            name="keySize"
+            label={t("keySize")}
+            labelIcon={t("keySizeHelp")}
+            controller={{
+              defaultValue: keySizes[0],
+            }}
+            menuAppendTo="parent"
+            options={keySizes}
+          />
+          <NumberControl
+            name="validity"
+            label={t("validity")}
+            labelIcon={t("validityHelp")}
+            controller={{
+              defaultValue: 3,
+              rules: { required: t("required"), min: 1, max: 10 },
+            }}
+          />
+        </>
+      )}
     </Form>
   );
 };
@@ -143,8 +148,8 @@ export const GenerateKeyDialog = ({
           key="confirm"
           data-testid="confirm"
           isDisabled={!isValid}
-          onClick={() => {
-            handleSubmit((config) => {
+          onClick={async () => {
+            await handleSubmit((config) => {
               save(config);
               toggleDialog();
             })();
diff --git a/js/apps/admin-ui/src/clients/keys/ImportKeyDialog.tsx b/js/apps/admin-ui/src/clients/keys/ImportKeyDialog.tsx
index 028d4ac58070..75869c5d8da0 100644
--- a/js/apps/admin-ui/src/clients/keys/ImportKeyDialog.tsx
+++ b/js/apps/admin-ui/src/clients/keys/ImportKeyDialog.tsx
@@ -1,16 +1,14 @@
-import { SelectControl } from "@keycloak/keycloak-ui-shared";
+import { SelectControl, FileUploadControl } from "@keycloak/keycloak-ui-shared";
 import {
   Button,
   ButtonVariant,
-  FileUpload,
   Form,
-  FormGroup,
   Modal,
   ModalVariant,
   Text,
   TextContent,
 } from "@patternfly/react-core";
-import { Controller, FormProvider, useForm, useWatch } from "react-hook-form";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useServerInfo } from "../../context/server-info/ServerInfoProvider";
 import { StoreSettings } from "./StoreSettings";
@@ -24,7 +22,7 @@ export type ImportFile = {
   keystoreFormat: string;
   keyAlias: string;
   storePassword: string;
-  file: { value?: string; filename: string };
+  file: File | string;
 };
 
 export const ImportKeyDialog = ({
@@ -60,8 +58,8 @@ export const ImportKeyDialog = ({
           id="modal-confirm"
           data-testid="confirm"
           key="confirm"
-          onClick={() => {
-            handleSubmit((importFile) => {
+          onClick={async () => {
+            await handleSubmit((importFile) => {
               save(importFile);
               toggleDialog();
             })();
@@ -74,9 +72,7 @@ export const ImportKeyDialog = ({
           data-testid="cancel"
           key="cancel"
           variant={ButtonVariant.link}
-          onClick={() => {
-            toggleDialog();
-          }}
+          onClick={toggleDialog}
         >
           {t("cancel")}
         </Button>,
@@ -96,27 +92,15 @@ export const ImportKeyDialog = ({
             }}
             options={formats}
           />
+          <FileUploadControl
+            label={t("importFile")}
+            id="importFile"
+            name="file"
+            rules={{
+              required: t("required"),
+            }}
+          />
           {baseFormats.includes(format) && <StoreSettings hidePassword />}
-          <FormGroup label={t("importFile")} fieldId="importFile">
-            <Controller
-              name="file"
-              control={control}
-              defaultValue={{ filename: "" }}
-              render={({ field }) => (
-                <FileUpload
-                  id="importFile"
-                  value={field.value.value}
-                  filename={field.value.filename}
-                  onTextChange={(value) =>
-                    field.onChange({ ...field.value, value })
-                  }
-                  onFileInputChange={(_, file) =>
-                    field.onChange({ ...field.value, filename: file.name })
-                  }
-                />
-              )}
-            />
-          </FormGroup>
         </FormProvider>
       </Form>
     </Modal>
diff --git a/js/apps/admin-ui/src/clients/keys/Keys.tsx b/js/apps/admin-ui/src/clients/keys/Keys.tsx
index f6cf1b5aa3b2..4d56f07b3300 100644
--- a/js/apps/admin-ui/src/clients/keys/Keys.tsx
+++ b/js/apps/admin-ui/src/clients/keys/Keys.tsx
@@ -29,13 +29,19 @@ import { ImportFile, ImportKeyDialog } from "./ImportKeyDialog";
 
 type KeysProps = {
   save: () => void;
+  refresh: () => void;
   clientId: string;
   hasConfigureAccess?: boolean;
 };
 
 const attr = "jwt.credential";
 
-export const Keys = ({ clientId, save, hasConfigureAccess }: KeysProps) => {
+export const Keys = ({
+  clientId,
+  save,
+  refresh: refreshParent,
+  hasConfigureAccess,
+}: KeysProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
@@ -51,7 +57,10 @@ export const Keys = ({ clientId, save, hasConfigureAccess }: KeysProps) => {
     useToggle();
   const [openImportKeys, toggleOpenImportKeys, setOpenImportKeys] = useToggle();
   const [key, setKey] = useState(0);
-  const refresh = () => setKey(key + 1);
+  const refresh = () => {
+    setKey(key + 1);
+    refreshParent();
+  };
 
   const useJwksUrl = useWatch({
     control,
@@ -94,8 +103,7 @@ export const Keys = ({ clientId, save, hasConfigureAccess }: KeysProps) => {
         formData.append(key, value);
       }
 
-      formData.append("file", file.value!);
-
+      formData.append("file", file);
       await adminClient.clients.uploadCertificate(
         { id: clientId, attr },
         formData,
diff --git a/js/apps/admin-ui/src/clients/keys/SamlImportKeyDialog.tsx b/js/apps/admin-ui/src/clients/keys/SamlImportKeyDialog.tsx
index d441f28d42fd..9bc983238097 100644
--- a/js/apps/admin-ui/src/clients/keys/SamlImportKeyDialog.tsx
+++ b/js/apps/admin-ui/src/clients/keys/SamlImportKeyDialog.tsx
@@ -1,8 +1,8 @@
+import { useAlerts } from "@keycloak/keycloak-ui-shared";
 import { AlertVariant } from "@patternfly/react-core";
-import { FormProvider, useFormContext } from "react-hook-form";
+import { FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
-import { useAlerts } from "@keycloak/keycloak-ui-shared";
 import { ConfirmDialogModal } from "../../components/confirm-dialog/ConfirmDialog";
 import { KeyForm } from "./GenerateKeyDialog";
 import type { KeyTypes } from "./SamlKeys";
@@ -12,27 +12,33 @@ type SamlImportKeyDialogProps = {
   id: string;
   attr: KeyTypes;
   onClose: () => void;
+  onImported: () => void;
 };
 
 export const SamlImportKeyDialog = ({
   id,
   attr,
   onClose,
+  onImported,
 }: SamlImportKeyDialogProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const form = useFormContext<SamlKeysDialogForm>();
-  const { handleSubmit } = form;
+  const form = useForm<SamlKeysDialogForm>();
+  const {
+    handleSubmit,
+    formState: { isValid },
+  } = form;
 
   const { addAlert, addError } = useAlerts();
 
-  const submit = (form: SamlKeysDialogForm) => {
-    submitForm(adminClient, form, id, attr, (error) => {
+  const submit = async (form: SamlKeysDialogForm) => {
+    await submitForm(adminClient, form, id, attr, (error) => {
       if (error) {
         addError("importError", error);
       } else {
         addAlert(t("importSuccess"), AlertVariant.success);
+        onImported();
       }
     });
   };
@@ -43,9 +49,9 @@ export const SamlImportKeyDialog = ({
       toggleDialog={onClose}
       continueButtonLabel="import"
       titleKey="importKey"
-      onConfirm={() => {
-        handleSubmit(submit)();
-        onClose();
+      confirmButtonDisabled={!isValid}
+      onConfirm={async () => {
+        await handleSubmit(submit)();
       }}
     >
       <FormProvider {...form}>
diff --git a/js/apps/admin-ui/src/clients/keys/SamlKeys.tsx b/js/apps/admin-ui/src/clients/keys/SamlKeys.tsx
index 5d0bb4ec614f..1868db9535ae 100644
--- a/js/apps/admin-ui/src/clients/keys/SamlKeys.tsx
+++ b/js/apps/admin-ui/src/clients/keys/SamlKeys.tsx
@@ -224,8 +224,8 @@ export const SamlKeys = ({ clientId, save }: SamlKeysProps) => {
     messageKey: "reGenerateSigningExplain",
     continueButtonLabel: "yes",
     cancelButtonLabel: "no",
-    onConfirm: () => {
-      generate(selectedType!);
+    onConfirm: async () => {
+      await generate(selectedType!);
     },
   });
 
@@ -255,6 +255,7 @@ export const SamlKeys = ({ clientId, save }: SamlKeysProps) => {
               id={clientId}
               attr={attr}
               onClose={() => setImportOpen(undefined)}
+              onImported={() => setRefresh(refresh + 1)}
             />
           )}
           <KeySection
diff --git a/js/apps/admin-ui/src/clients/keys/SamlKeysDialog.tsx b/js/apps/admin-ui/src/clients/keys/SamlKeysDialog.tsx
index 06dcf41a01b6..8b2cbd4557ce 100644
--- a/js/apps/admin-ui/src/clients/keys/SamlKeysDialog.tsx
+++ b/js/apps/admin-ui/src/clients/keys/SamlKeysDialog.tsx
@@ -84,8 +84,8 @@ export const SamlKeysDialog = ({
 
   const { addAlert, addError } = useAlerts();
 
-  const submit = (form: SamlKeysDialogForm) => {
-    submitForm(adminClient, form, id, attr, (error) => {
+  const submit = async (form: SamlKeysDialogForm) => {
+    await submitForm(adminClient, form, id, attr, (error) => {
       if (error) {
         addError("importError", error);
       } else {
@@ -133,9 +133,9 @@ export const SamlKeysDialog = ({
           data-testid="confirm"
           variant="primary"
           isDisabled={!isValid && !keys}
-          onClick={() => {
+          onClick={async () => {
             if (type) {
-              handleSubmit(submit)();
+              await handleSubmit(submit)();
             }
             onClose();
           }}
@@ -209,7 +209,7 @@ export const SamlKeysDialog = ({
             </FormGroup>
           )}
         </Form>
-        {type && <KeyForm useFile />}
+        {type && <KeyForm useFile hasPem />}
       </FormProvider>
     </Modal>
   );
diff --git a/js/apps/admin-ui/src/clients/registration/ClientRegistration.tsx b/js/apps/admin-ui/src/clients/registration/ClientRegistration.tsx
index 2ec9639f9d98..d67169f56f5b 100644
--- a/js/apps/admin-ui/src/clients/registration/ClientRegistration.tsx
+++ b/js/apps/admin-ui/src/clients/registration/ClientRegistration.tsx
@@ -26,6 +26,7 @@ export const ClientRegistration = () => {
     <RoutableTabs
       defaultLocation={toClientRegistration({ realm, subTab: "anonymous" })}
       mountOnEnter
+      unmountOnExit
     >
       <Tab
         data-testid="anonymous"
diff --git a/js/apps/admin-ui/src/clients/registration/ClientRegistrationList.tsx b/js/apps/admin-ui/src/clients/registration/ClientRegistrationList.tsx
index 8c178d241472..8b1597de9570 100644
--- a/js/apps/admin-ui/src/clients/registration/ClientRegistrationList.tsx
+++ b/js/apps/admin-ui/src/clients/registration/ClientRegistrationList.tsx
@@ -1,5 +1,9 @@
 import ComponentRepresentation from "@keycloak/keycloak-admin-client/lib/defs/componentRepresentation";
-import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
+import {
+  ListEmptyState,
+  useAlerts,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
 import { Button, ButtonVariant, ToolbarItem } from "@patternfly/react-core";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -134,6 +138,14 @@ export const ClientRegistrationList = ({
             displayKey: "providerId",
           },
         ]}
+        emptyState={
+          <ListEmptyState
+            message={t("noAccessPolicies")}
+            instructions={t("noAccessPoliciesInstructions")}
+            primaryActionText={t("createPolicy")}
+            onPrimaryAction={toggleAddDialog}
+          />
+        }
       />
     </>
   );
diff --git a/js/apps/admin-ui/src/clients/registration/DetailProvider.tsx b/js/apps/admin-ui/src/clients/registration/DetailProvider.tsx
index 6e29fedf2dd5..fd7eab4474ac 100644
--- a/js/apps/admin-ui/src/clients/registration/DetailProvider.tsx
+++ b/js/apps/admin-ui/src/clients/registration/DetailProvider.tsx
@@ -148,6 +148,7 @@ export default function DetailProvider() {
                 {t("save")}
               </Button>
               <Button
+                data-testid="cancel"
                 variant="link"
                 component={(props) => (
                   <Link
diff --git a/js/apps/admin-ui/src/clients/routes/PermissionConfigurationDetails.tsx b/js/apps/admin-ui/src/clients/routes/PermissionConfigurationDetails.tsx
new file mode 100644
index 000000000000..e94f7d7d5f7c
--- /dev/null
+++ b/js/apps/admin-ui/src/clients/routes/PermissionConfigurationDetails.tsx
@@ -0,0 +1,41 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionConfigurationDetailParams = {
+  realm: string;
+  id: string;
+  permissionId: string;
+  permissionType: string;
+};
+
+const PermissionConfigurationDetails = lazy(
+  () =>
+    import(
+      "../../permissions-configuration/permission-configuration/PermissionConfigurationDetails"
+    ),
+);
+
+export const PermissionConfigurationDetailRoute: AppRouteObject = {
+  path: "/:realm/clients/:id/permissions/permission/:permissionId/:permissionType",
+  element: <PermissionConfigurationDetails />,
+  breadcrumb: (t) => t("permissionDetails"),
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny(
+        "manage-clients",
+        "view-authorization",
+        "manage-authorization",
+      ),
+  },
+};
+
+export const toPermissionConfigurationDetails = (
+  params: PermissionConfigurationDetailParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(
+    PermissionConfigurationDetailRoute.path,
+    params,
+  ),
+});
diff --git a/js/apps/admin-ui/src/clients/scopes/AddScopeDialog.tsx b/js/apps/admin-ui/src/clients/scopes/AddScopeDialog.tsx
index 4cba0aaa4206..b204382cb088 100644
--- a/js/apps/admin-ui/src/clients/scopes/AddScopeDialog.tsx
+++ b/js/apps/admin-ui/src/clients/scopes/AddScopeDialog.tsx
@@ -180,6 +180,7 @@ export const AddScopeDialog = ({
                     onClick={() => setAddToggle(!addToggle)}
                     variant="primary"
                     id="add-dropdown"
+                    data-testid="add-dropdown"
                     statusIcon={<CaretUpIcon />}
                   >
                     {t("add")}
diff --git a/js/apps/admin-ui/src/clients/scopes/EvaluateScopes.tsx b/js/apps/admin-ui/src/clients/scopes/EvaluateScopes.tsx
index bbef6e0f15b5..883194a5053d 100644
--- a/js/apps/admin-ui/src/clients/scopes/EvaluateScopes.tsx
+++ b/js/apps/admin-ui/src/clients/scopes/EvaluateScopes.tsx
@@ -32,6 +32,7 @@ import { useEffect, useRef, useState } from "react";
 import { FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
+import { ClientSelect } from "../../components/client/ClientSelect";
 import { UserSelect } from "../../components/users/UserSelect";
 import { useAccess } from "../../context/access/Access";
 import { useRealm } from "../../context/realm-context/RealmContext";
@@ -150,6 +151,8 @@ export const EvaluateScopes = ({ clientId, protocol }: EvaluateScopesProps) => {
   const tabContent5 = useRef(null);
 
   const form = useForm();
+  const { watch } = form;
+  const selectedAudience: string[] = watch("targetAudience");
 
   const { hasAccess } = useAccess();
   const hasViewUsers = hasAccess("view-users");
@@ -200,13 +203,17 @@ export const EvaluateScopes = ({ clientId, protocol }: EvaluateScopesProps) => {
     async () => {
       const scope = selected.join(" ");
       const user = form.getValues("user");
-      if (!user) return [];
+      if (user.length === 0) {
+        return [];
+      }
+      const audience = selectedAudience.join(" ");
 
       return await Promise.all([
         adminClient.clients.evaluateGenerateAccessToken({
           id: clientId,
           userId: user[0],
           scope,
+          audience,
         }),
         adminClient.clients.evaluateGenerateUserInfo({
           id: clientId,
@@ -225,7 +232,7 @@ export const EvaluateScopes = ({ clientId, protocol }: EvaluateScopesProps) => {
       setUserInfo(prettyPrintJSON(userInfo));
       setIdToken(prettyPrintJSON(idToken));
     },
-    [form.getValues("user"), selected],
+    [form.getValues("user"), selected, selectedAudience],
   );
 
   return (
@@ -297,6 +304,16 @@ export const EvaluateScopes = ({ clientId, protocol }: EvaluateScopesProps) => {
               />
             </FormProvider>
           )}
+          <FormProvider {...form}>
+            <ClientSelect
+              name="targetAudience"
+              label={t("targetAudience")}
+              helpText={t("targetAudienceHelp")}
+              defaultValue={[]}
+              variant="typeaheadMulti"
+              placeholderText={t("targetAudiencePlaceHolder")}
+            />
+          </FormProvider>
         </Form>
       </PageSection>
 
diff --git a/js/apps/admin-ui/src/components/client/ClientSelect.tsx b/js/apps/admin-ui/src/components/client/ClientSelect.tsx
index 7296d82c83b7..16267d08570c 100644
--- a/js/apps/admin-ui/src/components/client/ClientSelect.tsx
+++ b/js/apps/admin-ui/src/components/client/ClientSelect.tsx
@@ -2,6 +2,7 @@ import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/
 import type { ClientQuery } from "@keycloak/keycloak-admin-client/lib/resources/clients";
 import {
   SelectControl,
+  SelectControlOption,
   SelectVariant,
   useFetch,
 } from "@keycloak/keycloak-ui-shared";
@@ -9,8 +10,16 @@ import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
 import type { ComponentProps } from "../dynamic/components";
+import { PermissionsConfigurationTabsParams } from "../../permissions-configuration/routes/PermissionsConfigurationTabs";
+import { useParams } from "react-router-dom";
+import { useFormContext, useWatch } from "react-hook-form";
 
-type ClientSelectProps = ComponentProps & { variant?: `${SelectVariant}` };
+type ClientSelectProps = Omit<ComponentProps, "convertToName"> & {
+  variant?: `${SelectVariant}`;
+  isRequired?: boolean;
+  clientKey?: keyof ClientRepresentation;
+  placeholderText?: string;
+};
 
 export const ClientSelect = ({
   name,
@@ -18,15 +27,34 @@ export const ClientSelect = ({
   helpText,
   defaultValue,
   isDisabled = false,
-  required = false,
+  isRequired,
   variant = "typeahead",
+  clientKey = "clientId",
+  placeholderText,
 }: ClientSelectProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
 
   const [clients, setClients] = useState<ClientRepresentation[]>([]);
+  const [selectedClients, setSelectedClients] =
+    useState<SelectControlOption[]>();
   const [search, setSearch] = useState("");
+  const { tab } = useParams<PermissionsConfigurationTabsParams>();
+
+  const { control } = useFormContext();
+  const value = useWatch({
+    control,
+    name: name!,
+    defaultValue: defaultValue || "",
+  });
+
+  const getValue = (): string[] => {
+    if (typeof value === "string") {
+      return [value];
+    }
+    return value || [];
+  };
 
   useFetch(
     () => {
@@ -43,16 +71,40 @@ export const ClientSelect = ({
     [search],
   );
 
+  useFetch(
+    () => {
+      const values = getValue().map(async (clientId) => {
+        if (clientKey === "clientId") {
+          return (await adminClient.clients.find({ clientId }))[0];
+        } else {
+          return adminClient.clients.findOne({ id: clientId });
+        }
+      });
+      return Promise.all(values);
+    },
+    (clients) => {
+      setSelectedClients(
+        clients
+          .filter((client) => !!client)
+          .map((client) => ({
+            key: client[clientKey] as string,
+            value: client.clientId!,
+          })),
+      );
+    },
+    [],
+  );
+
   return (
     <SelectControl
       name={name!}
-      label={t(label!)}
-      labelIcon={t(helpText!)}
+      label={tab !== "evaluation" ? t(label!) : t("client")}
+      labelIcon={tab !== "evaluation" ? t(helpText!) : t("selectClient")}
       controller={{
         defaultValue: defaultValue || "",
         rules: {
           required: {
-            value: required,
+            value: isRequired || false,
             message: t("required"),
           },
         },
@@ -60,7 +112,12 @@ export const ClientSelect = ({
       onFilter={(value) => setSearch(value)}
       variant={variant}
       isDisabled={isDisabled}
-      options={clients.map(({ clientId }) => clientId!)}
+      selectedOptions={selectedClients}
+      options={clients.map((client) => ({
+        key: client[clientKey] as string,
+        value: client.clientId!,
+      }))}
+      placeholderText={placeholderText}
     />
   );
 };
diff --git a/js/apps/admin-ui/src/components/dropdown-panel/dropdown-panel.css b/js/apps/admin-ui/src/components/dropdown-panel/dropdown-panel.css
index 67dc48b53def..9f8ec5911859 100644
--- a/js/apps/admin-ui/src/components/dropdown-panel/dropdown-panel.css
+++ b/js/apps/admin-ui/src/components/dropdown-panel/dropdown-panel.css
@@ -37,7 +37,7 @@
 }
 
 @media (prefers-color-scheme: dark) {
-  .kc-dropdown-panel-content {
+  .pf-v5-theme-dark .kc-dropdown-panel-content {
     background-color: var(--pf-v5-global--BackgroundColor--300);
   }
-}
+}
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/components/dynamic/BooleanComponent.tsx b/js/apps/admin-ui/src/components/dynamic/BooleanComponent.tsx
index 63ae06f6bde7..eac236235496 100644
--- a/js/apps/admin-ui/src/components/dynamic/BooleanComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/BooleanComponent.tsx
@@ -4,7 +4,6 @@ import { useTranslation } from "react-i18next";
 
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import type { ComponentProps } from "./components";
-import { convertToName } from "./DynamicComponents";
 
 export const BooleanComponent = ({
   name,
@@ -13,6 +12,7 @@ export const BooleanComponent = ({
   isDisabled = false,
   defaultValue,
   isNew = true,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext();
diff --git a/js/apps/admin-ui/src/components/dynamic/ClientSelectComponent.tsx b/js/apps/admin-ui/src/components/dynamic/ClientSelectComponent.tsx
index 742ce4bf76d9..6b7b3cdd613f 100644
--- a/js/apps/admin-ui/src/components/dynamic/ClientSelectComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/ClientSelectComponent.tsx
@@ -1,7 +1,6 @@
 import type { ComponentProps } from "./components";
 import { ClientSelect } from "../client/ClientSelect";
-import { convertToName } from "./DynamicComponents";
 
 export const ClientSelectComponent = (props: ComponentProps) => (
-  <ClientSelect {...props} name={convertToName(props.name!)} />
+  <ClientSelect {...props} name={props.convertToName(props.name!)} />
 );
diff --git a/js/apps/admin-ui/src/components/dynamic/DynamicComponents.tsx b/js/apps/admin-ui/src/components/dynamic/DynamicComponents.tsx
index 06a837b55ab7..557f672faa03 100644
--- a/js/apps/admin-ui/src/components/dynamic/DynamicComponents.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/DynamicComponents.tsx
@@ -7,9 +7,11 @@ type DynamicComponentProps = {
   properties: ConfigPropertyRepresentation[];
   stringify?: boolean;
   isNew?: boolean;
+  convertToName?: (name: string) => string;
 };
 
 export const DynamicComponents = ({
+  convertToName: convert,
   properties,
   ...rest
 }: DynamicComponentProps) => (
@@ -18,7 +20,14 @@ export const DynamicComponents = ({
       const componentType = property.type!;
       if (isValidComponentType(componentType)) {
         const Component = COMPONENTS[componentType];
-        return <Component key={property.name} {...property} {...rest} />;
+        return (
+          <Component
+            key={property.name}
+            {...property}
+            {...rest}
+            convertToName={convert || convertToName}
+          />
+        );
       } else {
         console.warn(`There is no editor registered for ${componentType}`);
       }
diff --git a/js/apps/admin-ui/src/components/dynamic/FileComponent.tsx b/js/apps/admin-ui/src/components/dynamic/FileComponent.tsx
index d251eb29eb40..2ffaaa7990fc 100644
--- a/js/apps/admin-ui/src/components/dynamic/FileComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/FileComponent.tsx
@@ -4,7 +4,6 @@ import { useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import type { ComponentProps } from "./components";
-import { convertToName } from "./DynamicComponents";
 
 export const FileComponent = ({
   name,
@@ -13,6 +12,7 @@ export const FileComponent = ({
   defaultValue,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext();
@@ -49,6 +49,9 @@ export const FileComponent = ({
             onTextChange={(value) => {
               field.onChange(value);
             }}
+            onDataChange={(_, value) => {
+              field.onChange(value);
+            }}
           />
         )}
       />
diff --git a/js/apps/admin-ui/src/components/dynamic/GroupComponent.tsx b/js/apps/admin-ui/src/components/dynamic/GroupComponent.tsx
index d436f1107a95..1e61070b132f 100644
--- a/js/apps/admin-ui/src/components/dynamic/GroupComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/GroupComponent.tsx
@@ -14,13 +14,13 @@ import { useTranslation } from "react-i18next";
 import { GroupPickerDialog } from "../group/GroupPickerDialog";
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import type { ComponentProps } from "./components";
-import { convertToName } from "./DynamicComponents";
 
 export const GroupComponent = ({
   name,
   label,
   helpText,
   required,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const [open, setOpen] = useState(false);
diff --git a/js/apps/admin-ui/src/components/dynamic/IntComponent.tsx b/js/apps/admin-ui/src/components/dynamic/IntComponent.tsx
index eed671478519..d2719e4e762d 100644
--- a/js/apps/admin-ui/src/components/dynamic/IntComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/IntComponent.tsx
@@ -1,13 +1,12 @@
-import { useTranslation } from "react-i18next";
 import { TextControl } from "@keycloak/keycloak-ui-shared";
-
-import { convertToName } from "./DynamicComponents";
+import { useTranslation } from "react-i18next";
 import { NumberComponentProps } from "./components";
 
 export const IntComponent = ({
   name,
   label,
   helpText,
+  convertToName,
   ...props
 }: NumberComponentProps) => {
   const { t } = useTranslation();
diff --git a/js/apps/admin-ui/src/components/dynamic/ListComponent.tsx b/js/apps/admin-ui/src/components/dynamic/ListComponent.tsx
index 0ad5cbbbce02..37758c49d815 100644
--- a/js/apps/admin-ui/src/components/dynamic/ListComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/ListComponent.tsx
@@ -7,7 +7,6 @@ import { FormGroup, SelectOption } from "@patternfly/react-core";
 import { useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 export const ListComponent = ({
@@ -18,6 +17,7 @@ export const ListComponent = ({
   options,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext();
diff --git a/js/apps/admin-ui/src/components/dynamic/MapComponent.tsx b/js/apps/admin-ui/src/components/dynamic/MapComponent.tsx
index f4c5bb098976..3a9f35526ba3 100644
--- a/js/apps/admin-ui/src/components/dynamic/MapComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/MapComponent.tsx
@@ -15,9 +15,7 @@ import { MinusCircleIcon, PlusCircleIcon } from "@patternfly/react-icons";
 import { useEffect, useState } from "react";
 import { useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-
 import { KeyValueType } from "../key-value-form/key-value-convert";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 type IdKeyValueType = KeyValueType & {
@@ -30,6 +28,8 @@ export const MapComponent = ({
   helpText,
   required,
   isDisabled,
+  defaultValue,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
 
@@ -39,7 +39,9 @@ export const MapComponent = ({
 
   useEffect(() => {
     register(fieldName);
-    const values: KeyValueType[] = JSON.parse(getValues(fieldName) || "[]");
+    const values: KeyValueType[] = JSON.parse(
+      getValues(fieldName) || defaultValue || "[]",
+    );
     setMap(values.map((value) => ({ ...value, id: generateId() })));
   }, []);
 
diff --git a/js/apps/admin-ui/src/components/dynamic/MultivaluedListComponent.tsx b/js/apps/admin-ui/src/components/dynamic/MultivaluedListComponent.tsx
index c9e97a9a3447..91f363d79b10 100644
--- a/js/apps/admin-ui/src/components/dynamic/MultivaluedListComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/MultivaluedListComponent.tsx
@@ -7,7 +7,6 @@ import { FormGroup, SelectOption } from "@patternfly/react-core";
 import { useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 function stringToMultiline(value?: string): string[] {
@@ -27,6 +26,7 @@ export const MultiValuedListComponent = ({
   isDisabled = false,
   stringify,
   required,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext();
diff --git a/js/apps/admin-ui/src/components/dynamic/MultivaluedStringComponent.tsx b/js/apps/admin-ui/src/components/dynamic/MultivaluedStringComponent.tsx
index 1d8d1a5e1623..4ee6b405cf32 100644
--- a/js/apps/admin-ui/src/components/dynamic/MultivaluedStringComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/MultivaluedStringComponent.tsx
@@ -1,10 +1,8 @@
-import { useTranslation } from "react-i18next";
-import { FormGroup } from "@patternfly/react-core";
-
-import type { ComponentProps } from "./components";
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
+import { FormGroup } from "@patternfly/react-core";
+import { useTranslation } from "react-i18next";
 import { MultiLineInput } from "../multi-line-input/MultiLineInput";
-import { convertToName } from "./DynamicComponents";
+import type { ComponentProps } from "./components";
 
 function convertDefaultValue(formValue?: any): string[] {
   return formValue && Array.isArray(formValue) ? formValue : [formValue];
@@ -18,6 +16,7 @@ export const MultiValuedStringComponent = ({
   stringify,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const fieldName = convertToName(name!);
diff --git a/js/apps/admin-ui/src/components/dynamic/NumberComponent.tsx b/js/apps/admin-ui/src/components/dynamic/NumberComponent.tsx
index 5256833d55c8..97283917648c 100644
--- a/js/apps/admin-ui/src/components/dynamic/NumberComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/NumberComponent.tsx
@@ -1,13 +1,12 @@
-import { useTranslation } from "react-i18next";
 import { TextControl } from "@keycloak/keycloak-ui-shared";
-
-import { convertToName } from "./DynamicComponents";
+import { useTranslation } from "react-i18next";
 import { NumberComponentProps } from "./components";
 
 export const NumberComponent = ({
   name,
   label,
   helpText,
+  convertToName,
   ...props
 }: NumberComponentProps) => {
   const { t } = useTranslation();
diff --git a/js/apps/admin-ui/src/components/dynamic/PasswordComponent.tsx b/js/apps/admin-ui/src/components/dynamic/PasswordComponent.tsx
index 39b887e9bd3d..1b02a1c3d57b 100644
--- a/js/apps/admin-ui/src/components/dynamic/PasswordComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/PasswordComponent.tsx
@@ -1,6 +1,5 @@
 import { useTranslation } from "react-i18next";
 import { PasswordControl } from "@keycloak/keycloak-ui-shared";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 export const PasswordComponent = ({
@@ -10,6 +9,7 @@ export const PasswordComponent = ({
   defaultValue,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
 
diff --git a/js/apps/admin-ui/src/components/dynamic/RoleComponent.tsx b/js/apps/admin-ui/src/components/dynamic/RoleComponent.tsx
index 4f17e5320610..51cd17c2f2ad 100644
--- a/js/apps/admin-ui/src/components/dynamic/RoleComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/RoleComponent.tsx
@@ -1,18 +1,15 @@
-import {
-  Button,
-  Chip,
-  FormGroup,
-  Split,
-  SplitItem,
-} from "@patternfly/react-core";
+import { FormErrorText, HelpItem } from "@keycloak/keycloak-ui-shared";
+import { Chip, FormGroup, Split, SplitItem } from "@patternfly/react-core";
+import { useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-
 import useToggle from "../../utils/useToggle";
-import { FormErrorText, HelpItem } from "@keycloak/keycloak-ui-shared";
-import { AddRoleMappingModal } from "../role-mapping/AddRoleMappingModal";
+import {
+  AddRoleButton,
+  AddRoleMappingModal,
+  FilterType,
+} from "../role-mapping/AddRoleMappingModal";
 import { Row, ServiceRole } from "../role-mapping/RoleMapping";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 const parseValue = (value: any) =>
@@ -30,10 +27,13 @@ export const RoleComponent = ({
   defaultValue,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
 
   const [openModal, toggleModal] = useToggle();
+  const [filterType, setFilterType] = useState<FilterType>("clients");
+
   const {
     control,
     formState: { errors },
@@ -58,6 +58,7 @@ export const RoleComponent = ({
               <AddRoleMappingModal
                 id="id"
                 type="roles"
+                filterType={filterType}
                 name={name}
                 onAssign={(rows) => field.onChange(parseRow(rows[0]))}
                 onClose={toggleModal}
@@ -76,14 +77,16 @@ export const RoleComponent = ({
               </SplitItem>
             )}
             <SplitItem>
-              <Button
-                onClick={toggleModal}
+              <AddRoleButton
+                label="selectRole.label"
+                onFilerTypeChange={(type) => {
+                  setFilterType(type);
+                  toggleModal();
+                }}
                 variant="secondary"
                 data-testid="add-roles"
-                disabled={isDisabled}
-              >
-                {t("selectRole.label")}
-              </Button>
+                isDisabled={isDisabled}
+              />
             </SplitItem>
           </Split>
         )}
diff --git a/js/apps/admin-ui/src/components/dynamic/ScriptComponent.tsx b/js/apps/admin-ui/src/components/dynamic/ScriptComponent.tsx
index e4cdcc514158..c498d2cde0e1 100644
--- a/js/apps/admin-ui/src/components/dynamic/ScriptComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/ScriptComponent.tsx
@@ -1,10 +1,9 @@
 import { HelpItem } from "@keycloak/keycloak-ui-shared";
 import { FormGroup } from "@patternfly/react-core";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
+import CodeEditor from "../form/CodeEditor";
 import type { ComponentProps } from "./components";
-import { convertToName } from "./DynamicComponents";
 
 export const ScriptComponent = ({
   name,
@@ -13,6 +12,7 @@ export const ScriptComponent = ({
   defaultValue,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext();
@@ -40,8 +40,8 @@ export const ScriptComponent = ({
             readOnly={isDisabled}
             onChange={field.onChange}
             value={Array.isArray(field.value) ? field.value[0] : field.value}
-            style={{ height: "600px", overflow: "scroll" }}
             language="js"
+            height={600}
           />
         )}
       />
diff --git a/js/apps/admin-ui/src/components/dynamic/StringComponent.tsx b/js/apps/admin-ui/src/components/dynamic/StringComponent.tsx
index 56d55e84d0e2..74e4bdb5bd70 100644
--- a/js/apps/admin-ui/src/components/dynamic/StringComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/StringComponent.tsx
@@ -1,12 +1,12 @@
 import { TextControl } from "@keycloak/keycloak-ui-shared";
 import { useTranslation } from "react-i18next";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 export const StringComponent = ({
   name,
   label,
   helpText,
+  convertToName,
   ...props
 }: ComponentProps) => {
   const { t } = useTranslation();
diff --git a/js/apps/admin-ui/src/components/dynamic/TextComponent.tsx b/js/apps/admin-ui/src/components/dynamic/TextComponent.tsx
index ab2948c25564..8226c714d0ab 100644
--- a/js/apps/admin-ui/src/components/dynamic/TextComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/TextComponent.tsx
@@ -1,9 +1,7 @@
 import { FormGroup } from "@patternfly/react-core";
 import { useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-
 import { KeycloakTextArea, HelpItem } from "@keycloak/keycloak-ui-shared";
-import { convertToName } from "./DynamicComponents";
 import type { ComponentProps } from "./components";
 
 export const TextComponent = ({
@@ -13,6 +11,7 @@ export const TextComponent = ({
   defaultValue,
   required,
   isDisabled = false,
+  convertToName,
 }: ComponentProps) => {
   const { t } = useTranslation();
   const { register } = useFormContext();
diff --git a/js/apps/admin-ui/src/components/dynamic/UserProfileAttributeListComponent.tsx b/js/apps/admin-ui/src/components/dynamic/UserProfileAttributeListComponent.tsx
index 90139451dc27..54bccf1bdb1c 100644
--- a/js/apps/admin-ui/src/components/dynamic/UserProfileAttributeListComponent.tsx
+++ b/js/apps/admin-ui/src/components/dynamic/UserProfileAttributeListComponent.tsx
@@ -9,8 +9,7 @@ import { useState } from "react";
 import { useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
-import { KeySelect } from "../key-value-form/KeySelect";
-import { convertToName } from "./DynamicComponents";
+import { KeySelect } from "../../realm-settings/user-profile/attribute/KeySelect";
 import type { ComponentProps } from "./components";
 
 export const UserProfileAttributeListComponent = ({
@@ -18,6 +17,7 @@ export const UserProfileAttributeListComponent = ({
   label,
   helpText,
   required = false,
+  convertToName,
 }: ComponentProps) => {
   const { adminClient } = useAdminClient();
 
@@ -40,12 +40,18 @@ export const UserProfileAttributeListComponent = ({
 
     return config.attributes.map((option) => ({
       key: option.name!,
-      label: option.name!,
+      value: option.name!,
     }));
   };
 
   if (!config) return null;
 
+  const getError = () => {
+    return convertedName
+      .split(".")
+      .reduce((record: any, key) => record?.[key], errors);
+  };
+
   return (
     <FormGroup
       label={t(label!)}
@@ -58,7 +64,7 @@ export const UserProfileAttributeListComponent = ({
         rules={required ? { required: true } : {}}
         selectItems={convert(config)}
       />
-      {errors[convertedName!] && <FormErrorText message={t("required")} />}
+      {getError() && <FormErrorText message={t("required")} />}
     </FormGroup>
   );
 };
diff --git a/js/apps/admin-ui/src/components/dynamic/components.ts b/js/apps/admin-ui/src/components/dynamic/components.ts
index 918923bf3bc2..7e13bfd1f168 100644
--- a/js/apps/admin-ui/src/components/dynamic/components.ts
+++ b/js/apps/admin-ui/src/components/dynamic/components.ts
@@ -23,6 +23,7 @@ export type ComponentProps = Omit<ConfigPropertyRepresentation, "type"> & {
   isDisabled?: boolean;
   isNew?: boolean;
   stringify?: boolean;
+  convertToName: (name: string) => string;
 };
 
 export type NumberComponentProps = ComponentProps & {
diff --git a/js/apps/admin-ui/src/components/error/ErrorRenderer.tsx b/js/apps/admin-ui/src/components/error/ErrorRenderer.tsx
index 601fd1aa20cd..7866d98ee5a9 100644
--- a/js/apps/admin-ui/src/components/error/ErrorRenderer.tsx
+++ b/js/apps/admin-ui/src/components/error/ErrorRenderer.tsx
@@ -1,7 +1,5 @@
-import {
-  useErrorBoundary,
-  type FallbackProps,
-} from "@keycloak/keycloak-ui-shared";
+import { NetworkError } from "@keycloak/keycloak-admin-client";
+import { type FallbackProps } from "@keycloak/keycloak-ui-shared";
 import {
   Alert,
   AlertActionCloseButton,
@@ -13,30 +11,30 @@ import { useTranslation } from "react-i18next";
 
 export const ErrorRenderer = ({ error }: FallbackProps) => {
   const { t } = useTranslation();
-  const { showBoundary } = useErrorBoundary();
 
   const reset = () => {
     window.location.href = window.location.origin + window.location.pathname;
   };
 
+  let message;
+  if (error instanceof NetworkError && error.response.status === 403) {
+    message = t("forbiddenAdminConsole");
+  } else {
+    message = error.message;
+  }
   return (
     <PageSection>
       <Alert
         isInline
         variant={AlertVariant.danger}
-        title={error.message}
+        title={message}
         actionClose={
           <AlertActionCloseButton title={error.message} onClose={reset} />
         }
         actionLinks={
-          <>
-            <AlertActionLink onClick={() => showBoundary()}>
-              {t("retry")}
-            </AlertActionLink>
-            <AlertActionLink onClick={() => (location.href = "/")}>
-              {t("home")}
-            </AlertActionLink>
-          </>
+          <AlertActionLink onClick={() => location.reload()}>
+            {t("reload")}
+          </AlertActionLink>
         }
       ></Alert>
     </PageSection>
diff --git a/js/apps/admin-ui/src/components/form/CodeEditor.tsx b/js/apps/admin-ui/src/components/form/CodeEditor.tsx
new file mode 100644
index 000000000000..138e09c1e53d
--- /dev/null
+++ b/js/apps/admin-ui/src/components/form/CodeEditor.tsx
@@ -0,0 +1,29 @@
+import CodeEditorComponent from "@uiw/react-textarea-code-editor";
+
+type CodeEditorProps = {
+  id?: string;
+  "aria-label"?: string;
+  "data-testid"?: string;
+  value?: string;
+  onChange?: (value: string) => void;
+  language?: string;
+  readOnly?: boolean;
+  /* The height of the editor in pixels */
+  height?: number;
+};
+
+const CodeEditor = ({ onChange, height = 128, ...rest }: CodeEditorProps) => (
+  <div style={{ height: `${height}px`, overflow: "auto" }}>
+    <CodeEditorComponent
+      padding={15}
+      minHeight={height}
+      style={{
+        font: "var(--pf-global--FontFamily--monospace)",
+      }}
+      onChange={(event) => onChange?.(event.target.value)}
+      {...rest}
+    />
+  </div>
+);
+
+export default CodeEditor;
diff --git a/js/apps/admin-ui/src/components/group/GroupPickerDialog.tsx b/js/apps/admin-ui/src/components/group/GroupPickerDialog.tsx
index 0a8c480c0ce4..1836dac8b099 100644
--- a/js/apps/admin-ui/src/components/group/GroupPickerDialog.tsx
+++ b/js/apps/admin-ui/src/components/group/GroupPickerDialog.tsx
@@ -242,7 +242,8 @@ export const GroupPickerDialog = ({
                 />
               ))
             : groups
-                ?.map((g) => deepGroup(g))
+                ?.map((g) => deepGroup([g]))
+                .flat()
                 .map((g) => (
                   <GroupRow
                     key={g.id}
@@ -274,14 +275,16 @@ export const GroupPickerDialog = ({
   );
 };
 
-const deepGroup = (group: GroupRepresentation): GroupRepresentation => {
-  let result = group;
-  if (group.subGroups?.length === 1) {
-    result = deepGroup(group.subGroups[0]);
+function deepGroup(groups: GroupRepresentation[]) {
+  const flattened: GroupRepresentation[] = [];
+  for (const group of groups) {
+    flattened.push(group);
+    if (group.subGroups && group.subGroups.length > 0) {
+      flattened.push(...deepGroup(group.subGroups));
+    }
   }
-
-  return result;
-};
+  return flattened;
+}
 
 type GroupRowProps = {
   group: SelectableGroup;
diff --git a/js/apps/admin-ui/src/components/help-enabler/HelpHeader.tsx b/js/apps/admin-ui/src/components/help-enabler/HelpHeader.tsx
index cd53695e5bf2..4e1dfe3ebc2d 100644
--- a/js/apps/admin-ui/src/components/help-enabler/HelpHeader.tsx
+++ b/js/apps/admin-ui/src/components/help-enabler/HelpHeader.tsx
@@ -25,6 +25,7 @@ export const HelpHeader = () => {
   const dropdownItems = [
     <DropdownItem key="link" id="link">
       <FormattedLink
+        data-testId="documentation-link"
         href={helpUrls.documentationUrl}
         title={t("documentation")}
       />
@@ -60,6 +61,7 @@ export const HelpHeader = () => {
           onClick={() => setOpen(!open)}
           aria-label="Help"
           id="help"
+          data-testid="help-toggle"
         >
           <HelpIcon />
         </MenuToggle>
diff --git a/js/apps/admin-ui/src/components/json-file-upload/FileUploadForm.tsx b/js/apps/admin-ui/src/components/json-file-upload/FileUploadForm.tsx
index 84e185c04741..fc9c22ca7fa1 100644
--- a/js/apps/admin-ui/src/components/json-file-upload/FileUploadForm.tsx
+++ b/js/apps/admin-ui/src/components/json-file-upload/FileUploadForm.tsx
@@ -10,7 +10,6 @@ import {
   Modal,
   ModalVariant,
 } from "@patternfly/react-core";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import {
   ChangeEvent,
   DragEvent as ReactDragEvent,
@@ -18,6 +17,7 @@ import {
   useState,
 } from "react";
 import { useTranslation } from "react-i18next";
+import CodeEditor from "../form/CodeEditor";
 
 type FileUploadType = {
   value: string;
@@ -155,8 +155,7 @@ export const FileUploadForm = ({
                 aria-label="File content"
                 value={fileUpload.value}
                 language={language}
-                style={{ height: "128px", overflow: "scroll" }}
-                onChange={(value) => handleTextOrDataChange(value.target.value)}
+                onChange={(value) => handleTextOrDataChange(value)}
                 readOnly={!rest.allowEditingUploadedText}
               />
             )}
diff --git a/js/apps/admin-ui/src/components/key-value-form/AttributeForm.css b/js/apps/admin-ui/src/components/key-value-form/AttributeForm.css
new file mode 100644
index 000000000000..97c8d4fc54b2
--- /dev/null
+++ b/js/apps/admin-ui/src/components/key-value-form/AttributeForm.css
@@ -0,0 +1,4 @@
+.pf-v5-c-tab-content.kc-attributes-tab {
+    padding-left: var(--pf-v5-global--spacer--xl);
+    padding-top: var(--pf-v5-global--spacer--lg);
+}
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/components/key-value-form/AttributeForm.tsx b/js/apps/admin-ui/src/components/key-value-form/AttributeForm.tsx
index 891c1935b19b..74db359ed63d 100644
--- a/js/apps/admin-ui/src/components/key-value-form/AttributeForm.tsx
+++ b/js/apps/admin-ui/src/components/key-value-form/AttributeForm.tsx
@@ -6,6 +6,8 @@ import type { KeyValueType } from "./key-value-convert";
 import { KeyValueInput } from "./KeyValueInput";
 import { FixedButtonsGroup } from "../form/FixedButtonGroup";
 
+import "./AttributeForm.css";
+
 export type AttributeForm = Omit<RoleRepresentation, "attributes"> & {
   attributes?: KeyValueType[];
 };
diff --git a/js/apps/admin-ui/src/components/key-value-form/KeyValueInput.tsx b/js/apps/admin-ui/src/components/key-value-form/KeyValueInput.tsx
index 8d8ed2d4c4ed..72db6982a10f 100644
--- a/js/apps/admin-ui/src/components/key-value-form/KeyValueInput.tsx
+++ b/js/apps/admin-ui/src/components/key-value-form/KeyValueInput.tsx
@@ -12,7 +12,7 @@ import {
   TextInput,
 } from "@patternfly/react-core";
 import { MinusCircleIcon, PlusCircleIcon } from "@patternfly/react-icons";
-import { Fragment } from "react";
+import { Fragment, FunctionComponent, PropsWithChildren } from "react";
 import {
   FieldValues,
   useFieldArray,
@@ -21,27 +21,34 @@ import {
 } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 
-import { KeySelect } from "./KeySelect";
-import { ValueSelect } from "./ValueSelect";
-
 export type DefaultValue = {
   key: string;
   values?: string[];
   label: string;
 };
 
-type KeyValueInputProps = {
+type Field = {
+  name: string;
+};
+
+type ValueField = Field & {
+  keyValue: string;
+};
+
+type KeyValueInputProps = PropsWithChildren & {
   name: string;
   label?: string;
-  defaultKeyValue?: DefaultValue[];
   isDisabled?: boolean;
+  KeyComponent?: FunctionComponent<Field>;
+  ValueComponent?: FunctionComponent<ValueField>;
 };
 
 export const KeyValueInput = ({
   name,
   label = "attributes",
-  defaultKeyValue,
   isDisabled = false,
+  KeyComponent,
+  ValueComponent,
 }: KeyValueInputProps) => {
   const { t } = useTranslation();
   const {
@@ -51,7 +58,6 @@ export const KeyValueInput = ({
   } = useFormContext();
 
   const { fields, append, remove } = useFieldArray({
-    shouldUnregister: true,
     control,
     name,
   });
@@ -81,12 +87,8 @@ export const KeyValueInput = ({
           return (
             <Fragment key={attribute.id}>
               <GridItem span={5}>
-                {defaultKeyValue ? (
-                  <KeySelect
-                    name={`${name}.${index}.key`}
-                    selectItems={defaultKeyValue}
-                    rules={{ required: true }}
-                  />
+                {KeyComponent ? (
+                  <KeyComponent name={`${name}.${index}.key`} />
                 ) : (
                   <TextInput
                     placeholder={t("keyPlaceholder")}
@@ -107,12 +109,10 @@ export const KeyValueInput = ({
                 )}
               </GridItem>
               <GridItem span={5}>
-                {defaultKeyValue ? (
-                  <ValueSelect
+                {ValueComponent ? (
+                  <ValueComponent
                     name={`${name}.${index}.value`}
                     keyValue={values[index]?.key}
-                    selectItems={defaultKeyValue}
-                    rules={{ required: true }}
                   />
                 ) : (
                   <TextInput
diff --git a/js/apps/admin-ui/src/components/key-value-form/ValueSelect.tsx b/js/apps/admin-ui/src/components/key-value-form/ValueSelect.tsx
deleted file mode 100644
index 6908e0c1fb31..000000000000
--- a/js/apps/admin-ui/src/components/key-value-form/ValueSelect.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { KeycloakSelect } from "@keycloak/keycloak-ui-shared";
-import { SelectOption, TextInput } from "@patternfly/react-core";
-import { useMemo, useState } from "react";
-import { UseControllerProps, useController } from "react-hook-form";
-import { useTranslation } from "react-i18next";
-import { DefaultValue } from "./KeyValueInput";
-
-type ValueSelectProps = UseControllerProps & {
-  selectItems: DefaultValue[];
-  keyValue: string;
-};
-
-export const ValueSelect = ({
-  selectItems,
-  keyValue,
-  ...rest
-}: ValueSelectProps) => {
-  const { t } = useTranslation();
-  const { field } = useController(rest);
-  const [open, setOpen] = useState(false);
-
-  const defaultItem = useMemo(
-    () => selectItems.find((v) => v.key === keyValue),
-    [selectItems, keyValue],
-  );
-
-  return defaultItem?.values ? (
-    <KeycloakSelect
-      onToggle={(isOpen) => setOpen(isOpen)}
-      isOpen={open}
-      onSelect={(value) => {
-        field.onChange(value);
-        setOpen(false);
-      }}
-      selections={field.value ? [field.value] : t("choose")}
-      placeholderText={t("valuePlaceholder")}
-    >
-      {defaultItem.values.map((item) => (
-        <SelectOption key={item} value={item}>
-          {item}
-        </SelectOption>
-      ))}
-    </KeycloakSelect>
-  ) : (
-    <TextInput
-      aria-label={t("customValue")}
-      data-testid={rest.name}
-      {...field}
-    />
-  );
-};
diff --git a/js/apps/admin-ui/src/components/multi-line-input/MultiLineInput.tsx b/js/apps/admin-ui/src/components/multi-line-input/MultiLineInput.tsx
index 18044fd6b932..2f0ebf9e32d1 100644
--- a/js/apps/admin-ui/src/components/multi-line-input/MultiLineInput.tsx
+++ b/js/apps/admin-ui/src/components/multi-line-input/MultiLineInput.tsx
@@ -127,7 +127,7 @@ export const MultiLineInput = ({
               onClick={append}
               tabIndex={-1}
               aria-label={t("add")}
-              data-testid="addValue"
+              data-testid={`${name}-addValue`}
               isDisabled={!value || isDisabled}
             >
               <PlusCircleIcon /> {t(addButtonLabel || "add")}
diff --git a/js/apps/admin-ui/src/components/realm-selector/RealmSelector.tsx b/js/apps/admin-ui/src/components/realm-selector/RealmSelector.tsx
deleted file mode 100644
index 27255ada2d15..000000000000
--- a/js/apps/admin-ui/src/components/realm-selector/RealmSelector.tsx
+++ /dev/null
@@ -1,265 +0,0 @@
-import { NetworkError } from "@keycloak/keycloak-admin-client";
-import { label, useFetch } from "@keycloak/keycloak-ui-shared";
-import {
-  Button,
-  Divider,
-  Dropdown,
-  DropdownGroup,
-  DropdownItem,
-  DropdownList,
-  Label,
-  MenuToggle,
-  SearchInput,
-  Spinner,
-  Split,
-  SplitItem,
-  Stack,
-  StackItem,
-} from "@patternfly/react-core";
-import {
-  AngleLeftIcon,
-  AngleRightIcon,
-  CheckIcon,
-} from "@patternfly/react-icons";
-import { debounce } from "lodash-es";
-import { Fragment, useCallback, useMemo, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Link, useNavigate } from "react-router-dom";
-import { useAdminClient } from "../../admin-client";
-import { useRecentRealms } from "../../context/RecentRealms";
-import { fetchAdminUI } from "../../context/auth/admin-ui-endpoint";
-import { useRealm } from "../../context/realm-context/RealmContext";
-import { useWhoAmI } from "../../context/whoami/WhoAmI";
-import { toDashboard } from "../../dashboard/routes/Dashboard";
-import { toAddRealm } from "../../realm/routes/AddRealm";
-
-import "./realm-selector.css";
-
-const MAX_RESULTS = 10;
-
-type AddRealmProps = {
-  onClick: () => void;
-};
-
-const AddRealm = ({ onClick }: AddRealmProps) => {
-  const { realm } = useRealm();
-  const { t } = useTranslation();
-
-  return (
-    <Button
-      data-testid="add-realm"
-      component={(props) => <Link {...props} to={toAddRealm({ realm })} />}
-      onClick={onClick}
-      isBlock
-    >
-      {t("createRealm")}
-    </Button>
-  );
-};
-
-type RealmTextProps = {
-  name: string;
-  displayName?: string;
-  showIsRecent?: boolean;
-};
-
-const RealmText = ({ name, displayName, showIsRecent }: RealmTextProps) => {
-  const { realm } = useRealm();
-  const { t } = useTranslation();
-
-  return (
-    <Split>
-      <SplitItem isFilled>
-        <Stack>
-          {displayName ? (
-            <StackItem className="pf-v5-u-font-weight-bold" isFilled>
-              {label(t, displayName)}
-            </StackItem>
-          ) : null}
-          <StackItem isFilled>{name}</StackItem>
-        </Stack>
-      </SplitItem>
-      <SplitItem>{name === realm && <CheckIcon />}</SplitItem>
-      {showIsRecent ? (
-        <SplitItem>
-          <Label>{t("recent")}</Label>
-        </SplitItem>
-      ) : null}
-    </Split>
-  );
-};
-
-type RealmNameRepresentation = {
-  name: string;
-  displayName?: string;
-};
-
-export const RealmSelector = () => {
-  const { realm } = useRealm();
-  const { adminClient } = useAdminClient();
-  const { whoAmI } = useWhoAmI();
-  const [open, setOpen] = useState(false);
-  const [realms, setRealms] = useState<RealmNameRepresentation[]>([]);
-  const { t } = useTranslation();
-  const recentRealms = useRecentRealms();
-  const navigate = useNavigate();
-
-  const [search, setSearch] = useState("");
-  const [first, setFirst] = useState(0);
-
-  const debounceFn = useCallback(
-    debounce((value: string) => {
-      setFirst(0);
-      setSearch(value);
-    }, 300),
-    [],
-  );
-
-  useFetch(
-    async () => {
-      try {
-        return await fetchAdminUI<RealmNameRepresentation[]>(
-          adminClient,
-          "ui-ext/realms/names",
-          { first: `${first}`, max: `${MAX_RESULTS + 1}`, search },
-        );
-      } catch (error) {
-        if (error instanceof NetworkError && error.response.status < 500) {
-          return [];
-        }
-
-        throw error;
-      }
-    },
-    setRealms,
-    [open, first, search],
-  );
-
-  const sortedRealms = useMemo(
-    () => [
-      ...(first === 0 && !search
-        ? (recentRealms || []).map((name) => ({ name }))
-        : []),
-      ...realms.filter((r) => !(recentRealms || []).includes(r.name)),
-    ],
-    [recentRealms, realms, first, search],
-  );
-
-  const realmDisplayName = useMemo(
-    () => realms.find((r) => r.name === realm)?.displayName,
-    [realm, realms],
-  );
-
-  return (
-    <Dropdown
-      id="realm-select"
-      className="keycloak__realm_selector__dropdown"
-      isOpen={open}
-      onOpenChange={(isOpen) => setOpen(isOpen)}
-      toggle={(ref) => (
-        <MenuToggle
-          ref={ref}
-          data-testid="realmSelector"
-          onClick={() => {
-            setOpen(!open);
-          }}
-          isFullWidth
-        >
-          <Stack className="keycloak__realm_selector__dropdown">
-            {realmDisplayName ? (
-              <StackItem className="pf-v5-u-font-weight-bold" isFilled>
-                {label(t, realmDisplayName)}
-              </StackItem>
-            ) : null}
-            <StackItem isFilled>{realm}</StackItem>
-          </Stack>
-        </MenuToggle>
-      )}
-    >
-      <DropdownList>
-        {(realms.length > 5 || search || first !== 0) && (
-          <>
-            <DropdownGroup>
-              <DropdownList>
-                <SearchInput
-                  value={search}
-                  onChange={(_, value) => debounceFn(value)}
-                  onClear={() => setSearch("")}
-                />
-              </DropdownList>
-            </DropdownGroup>
-            <Divider component="li" />
-          </>
-        )}
-        {(realms.length !== 0
-          ? [
-              first !== 0 ? (
-                <DropdownItem
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    setFirst(first - MAX_RESULTS);
-                  }}
-                >
-                  <AngleLeftIcon /> {t("previous")}
-                </DropdownItem>
-              ) : (
-                []
-              ),
-              ...sortedRealms.map((realm) => (
-                <DropdownItem
-                  key={realm.name}
-                  onClick={() => {
-                    navigate(toDashboard({ realm: realm.name }));
-                    setOpen(false);
-                    setSearch("");
-                  }}
-                >
-                  <RealmText
-                    {...realm}
-                    showIsRecent={
-                      realms.length > 5 && recentRealms?.includes(realm.name)
-                    }
-                  />
-                </DropdownItem>
-              )),
-              realms.length > MAX_RESULTS ? (
-                <DropdownItem
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    setFirst(first + MAX_RESULTS);
-                  }}
-                >
-                  <AngleRightIcon />
-                  {t("next")}
-                </DropdownItem>
-              ) : (
-                []
-              ),
-            ]
-          : !search
-            ? [
-                <DropdownItem key="loader">
-                  <Spinner size="sm" /> {t("loadingRealms")}
-                </DropdownItem>,
-              ]
-            : [
-                <DropdownItem key="no-results">
-                  {t("noResultsFound")}
-                </DropdownItem>,
-              ]
-        ).concat([
-          <Fragment key="add-realm">
-            {whoAmI.canCreateRealm() && (
-              <>
-                <Divider key="divider" />
-                <DropdownItem key="add" component="div">
-                  <AddRealm onClick={() => setOpen(false)} />
-                </DropdownItem>
-              </>
-            )}
-          </Fragment>,
-        ])}
-      </DropdownList>
-    </Dropdown>
-  );
-};
diff --git a/js/apps/admin-ui/src/components/realm-selector/realm-selector.css b/js/apps/admin-ui/src/components/realm-selector/realm-selector.css
deleted file mode 100644
index 3528ae4b7632..000000000000
--- a/js/apps/admin-ui/src/components/realm-selector/realm-selector.css
+++ /dev/null
@@ -1,21 +0,0 @@
-.keycloak__realm_selector__dropdown .pf-m-fill {
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.keycloak__realm_selector__dropdown .pf-v5-c-menu__list {
-  min-width: 0;
-  width: 15.125rem;
-
-}
-
-.pf-v5-c-nav__item.keycloak__page_nav__nav_item__realm-selector {
-  margin-top: var(--pf-v5-c-nav__link--PaddingTop);
-  padding-right: var(--pf-v5-c-nav__link--PaddingRight);
-  margin-bottom: var(--pf-v5-c-nav__link--PaddingBottom);
-  padding-left: var(--pf-v5-c-nav__link--PaddingLeft);
-}
-
-.keycloak__realm_selector__dropdown {
-  text-align: left;
-}
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/components/role-mapping/AddRoleMappingModal.tsx b/js/apps/admin-ui/src/components/role-mapping/AddRoleMappingModal.tsx
index bcc56e82688b..daf0680363e1 100644
--- a/js/apps/admin-ui/src/components/role-mapping/AddRoleMappingModal.tsx
+++ b/js/apps/admin-ui/src/components/role-mapping/AddRoleMappingModal.tsx
@@ -8,12 +8,11 @@ import {
   Dropdown,
   DropdownItem,
   DropdownList,
+  DropdownProps,
   MenuToggle,
   Modal,
   ModalVariant,
-  ToolbarItem,
 } from "@patternfly/react-core";
-import { FilterIcon } from "@patternfly/react-icons";
 import { cellWidth, TableText } from "@patternfly/react-table";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -21,21 +20,24 @@ import { useAdminClient } from "../../admin-client";
 import { useAccess } from "../../context/access/Access";
 import { translationFormatter } from "../../utils/translationFormatter";
 import useLocaleSort from "../../utils/useLocaleSort";
-import { ResourcesKey, Row, ServiceRole } from "./RoleMapping";
+import useToggle from "../../utils/useToggle";
+import { ResourcesKey, Row } from "./RoleMapping";
 import { getAvailableRoles } from "./queries";
 import { getAvailableClientRoles } from "./resource";
 
 type AddRoleMappingModalProps = {
   id: string;
   type: ResourcesKey;
+  filterType: FilterType;
   name?: string;
   isRadio?: boolean;
   onAssign: (rows: Row[]) => void;
   onClose: () => void;
-  isLDAPmapper?: boolean;
+  title?: string;
+  actionLabel?: string;
 };
 
-type FilterType = "roles" | "clients";
+export type FilterType = "roles" | "clients";
 
 const RoleDescription = ({ role }: { role: RoleRepresentation }) => {
   const { t } = useTranslation();
@@ -46,27 +48,87 @@ const RoleDescription = ({ role }: { role: RoleRepresentation }) => {
   );
 };
 
+type AddRoleButtonProps = Omit<
+  DropdownProps,
+  "children" | "toggle" | "isOpen" | "onOpenChange"
+> & {
+  label?: string;
+  variant?: "default" | "plain" | "primary" | "plainText" | "secondary";
+  isDisabled?: boolean;
+  onFilerTypeChange: (type: FilterType) => void;
+};
+
+export const AddRoleButton = ({
+  label,
+  variant,
+  isDisabled,
+  onFilerTypeChange,
+  ...rest
+}: AddRoleButtonProps) => {
+  const { t } = useTranslation();
+  const [open, toggle] = useToggle();
+
+  const { hasAccess } = useAccess();
+  const canViewRealmRoles = hasAccess("view-realm") || hasAccess("query-users");
+
+  return (
+    <Dropdown
+      onOpenChange={toggle}
+      toggle={(ref) => (
+        <MenuToggle
+          ref={ref}
+          onClick={toggle}
+          variant={variant || "primary"}
+          isDisabled={isDisabled}
+          data-testid="add-role-mapping-button"
+        >
+          {t(label || "assignRole")}
+        </MenuToggle>
+      )}
+      isOpen={open}
+      {...rest}
+    >
+      <DropdownList>
+        <DropdownItem
+          data-testid="client-role"
+          component="button"
+          onClick={() => {
+            onFilerTypeChange("clients");
+          }}
+        >
+          {t("clientRoles")}
+        </DropdownItem>
+        {canViewRealmRoles && (
+          <DropdownItem
+            data-testid="roles-role"
+            component="button"
+            onClick={() => {
+              onFilerTypeChange("roles");
+            }}
+          >
+            {t("realmRoles")}
+          </DropdownItem>
+        )}
+      </DropdownList>
+    </Dropdown>
+  );
+};
+
 export const AddRoleMappingModal = ({
   id,
   name,
   type,
-  isRadio = false,
-  isLDAPmapper,
+  isRadio,
+  filterType,
   onAssign,
   onClose,
+  title,
+  actionLabel,
 }: AddRoleMappingModalProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
-  const { hasAccess } = useAccess();
-  const canViewRealmRoles = hasAccess("view-realm") || hasAccess("query-users");
-
-  const [searchToggle, setSearchToggle] = useState(false);
-
-  const [filterType, setFilterType] = useState<FilterType>("clients");
   const [selectedRows, setSelectedRows] = useState<Row[]>([]);
-  const [key, setKey] = useState(0);
-  const refresh = () => setKey(key + 1);
 
   const localeSort = useLocaleSort();
   const compareRow = ({ role: { name } }: Row) => name?.toUpperCase();
@@ -118,11 +180,36 @@ export const AddRoleMappingModal = ({
     );
   };
 
+  const columns = [
+    {
+      name: "role.name",
+      displayKey: "name",
+      transforms: [cellWidth(30)],
+    },
+    {
+      name: "client.clientId",
+      displayKey: "clientId",
+    },
+    {
+      name: "role.description",
+      displayKey: "description",
+      cellRenderer: RoleDescription,
+    },
+  ];
+
+  if (filterType === "roles") {
+    columns.splice(1, 1);
+  }
+
   return (
     <Modal
       variant={ModalVariant.large}
       title={
-        isLDAPmapper ? t("assignRole") : t("assignRolesTo", { client: name })
+        title ||
+        t("assignRolesTo", {
+          type: filterType === "roles" ? t("realm") : t("client"),
+          client: name,
+        })
       }
       isOpen
       onClose={onClose}
@@ -137,7 +224,7 @@ export const AddRoleMappingModal = ({
             onClose();
           }}
         >
-          {t("assign")}
+          {actionLabel || t("assign")}
         </Button>,
         <Button
           data-testid="cancel"
@@ -150,74 +237,20 @@ export const AddRoleMappingModal = ({
       ]}
     >
       <KeycloakDataTable
-        key={key}
         onSelect={(rows) => setSelectedRows([...rows])}
-        searchPlaceholderKey="searchByRoleName"
-        isPaginated={!(filterType === "roles" && type !== "roles")}
-        searchTypeComponent={
-          canViewRealmRoles && (
-            <ToolbarItem>
-              <Dropdown
-                onOpenChange={(isOpen) => setSearchToggle(isOpen)}
-                onSelect={() => {
-                  setFilterType(filterType === "roles" ? "clients" : "roles");
-                  setSearchToggle(false);
-                  refresh();
-                }}
-                toggle={(ref) => (
-                  <MenuToggle
-                    data-testid="filter-type-dropdown"
-                    ref={ref}
-                    onClick={() => setSearchToggle(!searchToggle)}
-                    icon={<FilterIcon />}
-                  >
-                    {filterType === "roles"
-                      ? t("filterByRoles")
-                      : t("filterByClients")}
-                  </MenuToggle>
-                )}
-                isOpen={searchToggle}
-              >
-                <DropdownList>
-                  <DropdownItem key="filter-type" data-testid={filterType}>
-                    {filterType === "roles"
-                      ? t("filterByClients")
-                      : t("filterByRoles")}
-                  </DropdownItem>
-                </DropdownList>
-              </Dropdown>
-            </ToolbarItem>
-          )
+        searchPlaceholderKey={
+          filterType === "roles" ? "searchByRoleName" : "search"
         }
+        isPaginated={!(filterType === "roles" && type !== "roles")}
         canSelectAll
         isRadio={isRadio}
         loader={filterType === "roles" ? loader : clientRolesLoader}
-        ariaLabelKey="roles"
-        columns={[
-          {
-            name: "name",
-            cellRenderer: ServiceRole,
-            transforms: [cellWidth(20)],
-          },
-          {
-            name: "role.description",
-            displayKey: "description",
-            cellRenderer: RoleDescription,
-          },
-        ]}
+        ariaLabelKey="associatedRolesText"
+        columns={columns}
         emptyState={
           <ListEmptyState
             message={t("noRoles")}
             instructions={t("noRealmRolesToAssign")}
-            secondaryActions={[
-              {
-                text: t("filterByRoles"),
-                onClick: () => {
-                  setFilterType("roles");
-                  refresh();
-                },
-              },
-            ]}
           />
         }
       />
diff --git a/js/apps/admin-ui/src/components/role-mapping/RoleMapping.tsx b/js/apps/admin-ui/src/components/role-mapping/RoleMapping.tsx
index f11932aa828e..49b5c25e51af 100644
--- a/js/apps/admin-ui/src/components/role-mapping/RoleMapping.tsx
+++ b/js/apps/admin-ui/src/components/role-mapping/RoleMapping.tsx
@@ -19,7 +19,11 @@ import { translationFormatter } from "../../utils/translationFormatter";
 import { useConfirmDialog } from "../confirm-dialog/ConfirmDialog";
 import { ListEmptyState } from "@keycloak/keycloak-ui-shared";
 import { Action, KeycloakDataTable } from "@keycloak/keycloak-ui-shared";
-import { AddRoleMappingModal } from "./AddRoleMappingModal";
+import {
+  AddRoleButton,
+  AddRoleMappingModal,
+  FilterType,
+} from "./AddRoleMappingModal";
 import { deleteMapping, getEffectiveRoles, getMapping } from "./queries";
 import { getEffectiveClientRoles } from "./resource";
 
@@ -99,6 +103,7 @@ export const RoleMapping = ({
 
   const [hide, setHide] = useState(true);
   const [showAssign, setShowAssign] = useState(false);
+  const [filterType, setFilterType] = useState<FilterType>("clients");
   const [selected, setSelected] = useState<Row[]>([]);
 
   const assignRoles = async (rows: Row[]) => {
@@ -143,14 +148,6 @@ export const RoleMapping = ({
       )
       .flat();
 
-    const test = [
-      ...mapRoles(
-        [...clientMapping, ...realmRolesMapping],
-        [...effectiveClientRoles, ...effectiveRoles],
-        hide,
-      ),
-    ];
-    console.log(test);
     return [
       ...mapRoles(
         [...clientMapping, ...realmRolesMapping],
@@ -187,6 +184,7 @@ export const RoleMapping = ({
         <AddRoleMappingModal
           id={id}
           type={type}
+          filterType={filterType}
           name={name}
           onAssign={assignRoles}
           onClose={() => setShowAssign(false)}
@@ -200,7 +198,7 @@ export const RoleMapping = ({
         canSelectAll
         onSelect={(rows) => setSelected(rows)}
         searchPlaceholderKey="searchByName"
-        ariaLabelKey="clientScopeList"
+        ariaLabelKey="roleList"
         isRowDisabled={(value) =>
           (value.role as CompositeRole).isInherited || false
         }
@@ -221,12 +219,12 @@ export const RoleMapping = ({
             {isManager && (
               <>
                 <ToolbarItem>
-                  <Button
-                    data-testid="assignRole"
-                    onClick={() => setShowAssign(true)}
-                  >
-                    {t("assignRole")}
-                  </Button>
+                  <AddRoleButton
+                    onFilerTypeChange={(type) => {
+                      setFilterType(type);
+                      setShowAssign(true);
+                    }}
+                  />
                 </ToolbarItem>
                 <ToolbarItem>
                   <Button
@@ -278,8 +276,6 @@ export const RoleMapping = ({
           <ListEmptyState
             message={t(`noRoles-${type}`)}
             instructions={t(`noRolesInstructions-${type}`)}
-            primaryActionText={t("assignRole")}
-            onPrimaryAction={() => setShowAssign(true)}
             secondaryActions={[
               {
                 text: t("showInheritedRoles"),
@@ -289,7 +285,14 @@ export const RoleMapping = ({
                 },
               },
             ]}
-          />
+          >
+            <AddRoleButton
+              onFilerTypeChange={(type) => {
+                setFilterType(type);
+                setShowAssign(true);
+              }}
+            />
+          </ListEmptyState>
         }
       />
     </>
diff --git a/js/apps/admin-ui/src/components/roles-list/RolesList.css b/js/apps/admin-ui/src/components/roles-list/RolesList.css
index 8cf181227287..84d5e252abf4 100644
--- a/js/apps/admin-ui/src/components/roles-list/RolesList.css
+++ b/js/apps/admin-ui/src/components/roles-list/RolesList.css
@@ -34,9 +34,4 @@
 button#default-role-help-icon.pf-v5-c-form__group-label-help {
   margin-left: var(--pf-v5-global--spacer--xs);
   vertical-align: middle;
-}
-
-.pf-v5-c-tab-content.kc-attributes-tab {
-  padding-left: var(--pf-v5-global--spacer--xl);
-  padding-top: var(--pf-v5-global--spacer--lg);
-}
+}
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/components/roles-list/RolesList.tsx b/js/apps/admin-ui/src/components/roles-list/RolesList.tsx
index 065a2664eb08..0a851ca8d85f 100644
--- a/js/apps/admin-ui/src/components/roles-list/RolesList.tsx
+++ b/js/apps/admin-ui/src/components/roles-list/RolesList.tsx
@@ -25,10 +25,9 @@ type RoleDetailLinkProps = RoleRepresentation & {
 const RoleDetailLink = ({
   defaultRoleName,
   toDetail,
-  messageBundle,
   ...role
 }: RoleDetailLinkProps) => {
-  const { t } = useTranslation(messageBundle);
+  const { t } = useTranslation();
   const { realm } = useRealm();
   const { hasAccess, hasSomeAccess } = useAccess();
   const canViewUserRegistration =
@@ -44,11 +43,8 @@ const RoleDetailLink = ({
         </Link>
       ) : (
         <span>{role.name}</span>
-      )}
-      <HelpItem
-        helpText={t(`${messageBundle}:defaultRole`)}
-        fieldLabelId="defaultRole"
-      />
+      )}{" "}
+      <HelpItem helpText={t("defaultRole")} fieldLabelId="defaultRole" />
     </>
   );
 };
diff --git a/js/apps/admin-ui/src/components/routable-tabs/RoutableTabs.tsx b/js/apps/admin-ui/src/components/routable-tabs/RoutableTabs.tsx
index 00f899959080..8a2987826d91 100644
--- a/js/apps/admin-ui/src/components/routable-tabs/RoutableTabs.tsx
+++ b/js/apps/admin-ui/src/components/routable-tabs/RoutableTabs.tsx
@@ -93,6 +93,8 @@ export const RoutableTabs = ({
         xl: "insetLg",
         "2xl": "inset2xl",
       }}
+      unmountOnExit
+      mountOnEnter
       {...otherProps}
     >
       {children as any}
diff --git a/js/apps/admin-ui/src/components/time-selector/TimeSelectorControl.tsx b/js/apps/admin-ui/src/components/time-selector/TimeSelectorControl.tsx
index 48cd1b6a8cc0..3d38fedb2fc1 100644
--- a/js/apps/admin-ui/src/components/time-selector/TimeSelectorControl.tsx
+++ b/js/apps/admin-ui/src/components/time-selector/TimeSelectorControl.tsx
@@ -71,7 +71,12 @@ export const TimeSelectorControl = <
           />
         )}
       />
-      {error && <FormErrorText message={error.message as string} />}
+      {error && (
+        <FormErrorText
+          data-testid={`${name}-helper`}
+          message={error.message as string}
+        />
+      )}
     </FormGroup>
   );
 };
diff --git a/js/apps/admin-ui/src/components/users/UserDataTable.tsx b/js/apps/admin-ui/src/components/users/UserDataTable.tsx
index cdf4b3fefd5e..d139f220651b 100644
--- a/js/apps/admin-ui/src/components/users/UserDataTable.tsx
+++ b/js/apps/admin-ui/src/components/users/UserDataTable.tsx
@@ -65,7 +65,7 @@ const UserDetailLink = (user: BruteUser) => {
         {user.username}
         <StatusRow user={user} />
       </Link>
-      {user.attributes?.["is_temporary_admin"][0] === "true" && (
+      {user.attributes?.["is_temporary_admin"]?.[0] === "true" && (
         <Tooltip content={t("temporaryAdmin")}>
           <WarningTriangleIcon
             className="pf-v5-u-ml-sm"
@@ -126,7 +126,7 @@ export function UserDataTable() {
   const [searchType, setSearchType] = useState<SearchType>("default");
   const [searchDropdownOpen, setSearchDropdownOpen] = useState(false);
   const [activeFilters, setActiveFilters] = useState<UserFilter>({
-    exact: false,
+    exact: true,
     userAttribute: [],
   });
   const [profile, setProfile] = useState<UserProfileConfig>({});
@@ -170,9 +170,7 @@ export function UserDataTable() {
       params.search = searchParam;
     }
 
-    if (activeFilters.exact) {
-      params.exact = true;
-    }
+    params.exact = activeFilters.exact;
 
     if (!listUsers && !(params.search || params.q)) {
       return [];
@@ -240,7 +238,7 @@ export function UserDataTable() {
   const listUsers = !uiRealmInfo.userProfileProvidersEnabled;
 
   const clearAllFilters = () => {
-    setActiveFilters({ exact: false, userAttribute: [] });
+    setActiveFilters({ exact: true, userAttribute: [] });
     setSearchUser("");
     setQuery("");
     refresh();
@@ -384,20 +382,16 @@ export function UserDataTable() {
         }
         toolbarItem={toolbar()}
         subToolbar={subtoolbar()}
-        actionResolver={(rowData: IRowData) => {
-          const user: UserRepresentation = rowData.data;
-          if (!user.access?.manage) return [];
-
-          return [
-            {
-              title: t("delete"),
-              onClick: () => {
-                setSelectedRows([user]);
-                toggleDeleteDialog();
-              },
+        actionResolver={(rowData: IRowData) => [
+          {
+            title: t("delete"),
+            onClick: () => {
+              setSelectedRows([rowData.data]);
+              toggleDeleteDialog();
             },
-          ];
-        }}
+          },
+        ]}
+        isRowDisabled={(user: UserRepresentation) => !user.access?.manage}
         columns={[
           {
             name: "username",
diff --git a/js/apps/admin-ui/src/components/users/UserDataTableAttributeSearchForm.tsx b/js/apps/admin-ui/src/components/users/UserDataTableAttributeSearchForm.tsx
index f6ea29f3365b..a7249aaa270f 100644
--- a/js/apps/admin-ui/src/components/users/UserDataTableAttributeSearchForm.tsx
+++ b/js/apps/admin-ui/src/components/users/UserDataTableAttributeSearchForm.tsx
@@ -1,8 +1,8 @@
 import type { UserProfileConfig } from "@keycloak/keycloak-admin-client/lib/defs/userProfileMetadata";
 import {
   KeycloakSelect,
-  SelectVariant,
   label,
+  SelectVariant,
   useAlerts,
 } from "@keycloak/keycloak-ui-shared";
 import {
@@ -22,7 +22,7 @@ import {
 } from "@patternfly/react-core";
 import { CheckIcon } from "@patternfly/react-icons";
 import { ReactNode, useState } from "react";
-import { Controller, useForm } from "react-hook-form";
+import { useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { Form } from "react-router-dom";
 import { UserAttribute, UserFilter } from "./UserDataTable";
@@ -62,7 +62,6 @@ export function UserDataTableAttributeSearchForm({
     setValue,
     setError,
     clearErrors,
-    control,
   } = useForm<UserFilterForm>({
     mode: "onChange",
     defaultValues,
@@ -115,10 +114,10 @@ export function UserDataTableAttributeSearchForm({
   const addToFilter = () => {
     if (isAttributeValid()) {
       setActiveFilters({
-        exact: getValues().exact,
+        ...activeFilters,
         userAttribute: [...activeFilters.userAttribute, { ...getValues() }],
       });
-      reset({ exact: getValues().exact });
+      reset(defaultValues);
     } else {
       if (errors.name?.message) {
         addAlert(errors.name.message, AlertVariant.danger);
@@ -134,7 +133,7 @@ export function UserDataTableAttributeSearchForm({
     const filtered = [...activeFilters.userAttribute].filter(
       (chip) => chip.name !== chip.name,
     );
-    setActiveFilters({ exact: getValues().exact, userAttribute: filtered });
+    setActiveFilters({ ...activeFilters, userAttribute: filtered });
   };
 
   const createAttributeKeyInputField = () => {
@@ -252,19 +251,17 @@ export function UserDataTableAttributeSearchForm({
       {createAttributeSearchChips()}
 
       <div className="pf-v5-u-pt-lg">
-        <Controller
-          name="exact"
-          defaultValue={false}
-          control={control}
-          render={({ field }) => (
-            <Checkbox
-              id="exact"
-              data-testid="exact"
-              label={t("exactSearch")}
-              isChecked={field.value}
-              onChange={field.onChange}
-            />
-          )}
+        <Checkbox
+          id="exact"
+          data-testid="exact"
+          label={t("exactSearch")}
+          isChecked={activeFilters.exact}
+          onChange={(_, value) => {
+            setActiveFilters({
+              ...activeFilters,
+              exact: value,
+            });
+          }}
         />
       </div>
       <ActionGroup className="user-attribute-search-form-action-group">
diff --git a/js/apps/admin-ui/src/components/users/UserSelect.tsx b/js/apps/admin-ui/src/components/users/UserSelect.tsx
index 692ba1b72ff5..f1cf99f29d21 100644
--- a/js/apps/admin-ui/src/components/users/UserSelect.tsx
+++ b/js/apps/admin-ui/src/components/users/UserSelect.tsx
@@ -1,5 +1,4 @@
 import type UserRepresentation from "@keycloak/keycloak-admin-client/lib/defs/userRepresentation";
-import type { UserQuery } from "@keycloak/keycloak-admin-client/lib/resources/users";
 import {
   FormErrorText,
   HelpItem,
@@ -20,7 +19,7 @@ import {
 } from "@patternfly/react-core";
 import { TimesIcon } from "@patternfly/react-icons";
 import { debounce } from "lodash-es";
-import { useCallback, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../../admin-client";
@@ -29,7 +28,7 @@ import type { ComponentProps } from "../dynamic/components";
 
 type UserSelectVariant = "typeaheadMulti" | "typeahead";
 
-type UserSelectProps = ComponentProps & {
+type UserSelectProps = Omit<ComponentProps, "convertToName"> & {
   variant?: UserSelectVariant;
   isRequired?: boolean;
 };
@@ -53,52 +52,73 @@ export const UserSelect = ({
   const values: string[] | undefined = getValues(name!);
 
   const [open, toggleOpen, setOpen] = useToggle();
-  const [users, setUsers] = useState<(UserRepresentation | undefined)[]>([]);
+  const [selectedUsers, setSelectedUsers] = useState<UserRepresentation[]>([]);
+  const [searchedUsers, setSearchedUsers] = useState<UserRepresentation[]>([]);
   const [inputValue, setInputValue] = useState("");
   const [search, setSearch] = useState("");
   const textInputRef = useRef<HTMLInputElement>();
 
-  const debounceFn = useCallback(debounce(setSearch, 1000), []);
+  const debounceFn = useCallback(debounce(setSearch, 500), []);
 
   useFetch(
-    () => {
-      const params: UserQuery = {
-        max: 20,
-      };
-
-      if (search) {
-        params.username = search;
+    async () => {
+      if (!values) {
+        return [];
       }
 
-      if (values?.length && !search) {
-        return Promise.all(
-          values.map((id: string) => adminClient.users.findOne({ id })),
-        );
+      const foundUsers = await Promise.all(
+        values.map((id) => adminClient.users.findOne({ id })),
+      );
+
+      return foundUsers.filter((user) => user !== undefined);
+    },
+    (users) => {
+      setSelectedUsers(users);
+      if (variant !== "typeaheadMulti") {
+        setInputValue(users[0]?.username || "");
       }
-      return adminClient.users.find(params);
     },
-    setUsers,
+    [values],
+  );
+
+  useFetch(
+    async () =>
+      adminClient.users.find({
+        username: search,
+        max: 20,
+      }),
+    setSearchedUsers,
     [search],
   );
 
-  const convert = (clients: (UserRepresentation | undefined)[]) =>
-    clients
-      .filter((c) => c !== undefined)
-      .map((option) => (
-        <SelectOption
-          key={option!.id}
-          value={option!.id}
-          selected={values?.includes(option!.id!)}
-        >
-          {option!.username}
-        </SelectOption>
-      ));
+  useEffect(() => {
+    if (!values || values.length === 0) {
+      setSelectedUsers([]);
+      setInputValue("");
+    }
+  }, [values]);
+
+  const users = useMemo(
+    () => [...selectedUsers, ...searchedUsers],
+    [selectedUsers, searchedUsers],
+  );
+
+  const convert = (users: UserRepresentation[]) =>
+    users.map((option) => (
+      <SelectOption
+        key={option.id}
+        value={option.id}
+        selected={values?.includes(option.id!)}
+      >
+        {option.username}
+      </SelectOption>
+    ));
 
   return (
     <FormGroup
       label={t(label!)}
       isRequired={isRequired}
-      labelIcon={<HelpItem helpText={helpText!} fieldLabelId={label!} />}
+      labelIcon={<HelpItem helpText={helpText!} fieldLabelId={t(label!)} />}
       fieldId={name!}
     >
       <Controller
@@ -218,7 +238,7 @@ export const UserSelect = ({
             }}
             aria-label={t(name!)}
           >
-            <SelectList>{convert(users)}</SelectList>
+            <SelectList>{convert(searchedUsers)}</SelectList>
           </Select>
         )}
       />
diff --git a/js/apps/admin-ui/src/components/view-header/ViewHeader.tsx b/js/apps/admin-ui/src/components/view-header/ViewHeader.tsx
index a72c0edb62e7..d4b259cd5389 100644
--- a/js/apps/admin-ui/src/components/view-header/ViewHeader.tsx
+++ b/js/apps/admin-ui/src/components/view-header/ViewHeader.tsx
@@ -124,7 +124,7 @@ export const ViewHeader = ({
             <Toolbar className="pf-v5-u-p-0">
               <ToolbarContent>
                 {onToggle && (
-                  <ToolbarItem>
+                  <ToolbarItem alignSelf="center">
                     <Switch
                       id={`${toKey(titleKey)}-switch`}
                       data-testid={`${titleKey}-switch`}
diff --git a/js/apps/admin-ui/src/context/RecentRealms.tsx b/js/apps/admin-ui/src/context/RecentRealms.tsx
index dba35609009c..cafa7446109d 100644
--- a/js/apps/admin-ui/src/context/RecentRealms.tsx
+++ b/js/apps/admin-ui/src/context/RecentRealms.tsx
@@ -1,53 +1,82 @@
-import { PropsWithChildren } from "react";
-
+import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
 import {
   createNamedContext,
   useFetch,
   useRequiredContext,
   useStoredState,
 } from "@keycloak/keycloak-ui-shared";
+import { PropsWithChildren, useEffect } from "react";
 import { useAdminClient } from "../admin-client";
 import { useRealm } from "./realm-context/RealmContext";
+import { fetchAdminUI } from "./auth/admin-ui-endpoint";
+
+const MAX_REALMS = 3;
 
-const MAX_REALMS = 4;
+export const RecentRealmsContext = createNamedContext<
+  RealmNameRepresentation[] | undefined
+>("RecentRealmsContext", undefined);
+
+export type RealmNameRepresentation = {
+  name: string;
+  displayName?: string;
+};
 
-export const RecentRealmsContext = createNamedContext<string[] | undefined>(
-  "RecentRealmsContext",
-  undefined,
-);
+function convertRealmToNameRepresentation(
+  realm?: RealmRepresentation,
+): RealmNameRepresentation {
+  return { name: realm?.realm || "", displayName: realm?.displayName || "" };
+}
 
 export const RecentRealmsProvider = ({ children }: PropsWithChildren) => {
-  const { realm } = useRealm();
+  const { realmRepresentation: realm } = useRealm();
   const { adminClient } = useAdminClient();
 
   const [storedRealms, setStoredRealms] = useStoredState(
     localStorage,
     "recentRealms",
-    [realm],
+    [{ name: "" }] as RealmNameRepresentation[],
   );
 
   useFetch(
-    () => {
-      return Promise.all(
-        [...new Set([realm, ...storedRealms])].map(async (realm) => {
+    () =>
+      Promise.all(
+        storedRealms.map(async (r) => {
+          if (!r.name) {
+            return undefined;
+          }
           try {
-            const response = await adminClient.realms.findOne({ realm });
-            if (response) {
-              return response.realm;
-            }
-          } catch {
+            return (
+              await fetchAdminUI<RealmNameRepresentation[]>(
+                adminClient,
+                "ui-ext/realms/names",
+                { search: r.name },
+              )
+            )[0];
+          } catch (error) {
+            console.info("recent realm not found", error);
             return undefined;
           }
         }),
-      );
-    },
-    (realms) => {
-      const newRealms = realms.filter((r) => r) as string[];
-      setStoredRealms(newRealms.slice(0, MAX_REALMS));
-    },
-    [realm],
+      ),
+    (realms) => setStoredRealms(realms.filter((r) => !!r)),
+    [realm?.realm === "master"],
   );
 
+  useEffect(() => {
+    if (
+      storedRealms.map((r) => r.name).includes(realm?.realm || "") ||
+      !realm
+    ) {
+      return;
+    }
+    setStoredRealms(
+      [
+        convertRealmToNameRepresentation(realm),
+        ...storedRealms.filter((r) => r.name !== ""),
+      ].slice(0, MAX_REALMS),
+    );
+  }, [realm]);
+
   return (
     <RecentRealmsContext.Provider value={storedRealms}>
       {children}
diff --git a/js/apps/admin-ui/src/context/realm-context/RealmContext.tsx b/js/apps/admin-ui/src/context/realm-context/RealmContext.tsx
index 755d7bfc5036..af6b2a80181f 100644
--- a/js/apps/admin-ui/src/context/realm-context/RealmContext.tsx
+++ b/js/apps/admin-ui/src/context/realm-context/RealmContext.tsx
@@ -6,10 +6,9 @@ import {
   useRequiredContext,
 } from "@keycloak/keycloak-ui-shared";
 import { PropsWithChildren, useEffect, useState } from "react";
-import { useMatch } from "react-router-dom";
 import { useAdminClient } from "../../admin-client";
-import { DashboardRouteWithRealm } from "../../dashboard/routes/Dashboard";
 import { i18n } from "../../i18n/i18n";
+import { useHash } from "./useHash";
 
 type RealmContextType = {
   realm: string;
@@ -30,16 +29,12 @@ export const RealmContextProvider = ({ children }: PropsWithChildren) => {
   const [realmRepresentation, setRealmRepresentation] =
     useState<RealmRepresentation>();
 
-  const routeMatch = useMatch({
-    path: DashboardRouteWithRealm.path,
-    end: false,
-  });
-
-  const realm = routeMatch?.params.realm ?? environment.realm;
+  const locationRealm = useHash();
+  const realm = locationRealm?.split("/")[1] ?? environment.realm;
 
   // Configure admin client to use selected realm when it changes.
   useEffect(() => {
-    (async () => {
+    void (async () => {
       adminClient.setConfig({ realmName: realm });
       const namespace = encodeURIComponent(realm);
       await i18n.loadNamespaces(namespace);
diff --git a/js/apps/admin-ui/src/context/realm-context/useHash.tsx b/js/apps/admin-ui/src/context/realm-context/useHash.tsx
new file mode 100644
index 000000000000..87b2820f82e1
--- /dev/null
+++ b/js/apps/admin-ui/src/context/realm-context/useHash.tsx
@@ -0,0 +1,19 @@
+import { useEffect, useState } from "react";
+
+export const useHash = () => {
+  const [hash, setHash] = useState(location.hash);
+
+  useEffect(() => {
+    const orgPushState = window.history.pushState;
+    window.history.pushState = new Proxy(window.history.pushState, {
+      apply: (func, target, args) => {
+        setHash(args[2].substring(1));
+        return Reflect.apply(func, target, args);
+      },
+    });
+    return () => {
+      window.history.pushState = orgPushState;
+    };
+  }, []);
+  return decodeURIComponent(hash);
+};
diff --git a/js/apps/admin-ui/src/context/whoami/WhoAmI.tsx b/js/apps/admin-ui/src/context/whoami/WhoAmI.tsx
index f6b287f046da..f437585fb4ac 100644
--- a/js/apps/admin-ui/src/context/whoami/WhoAmI.tsx
+++ b/js/apps/admin-ui/src/context/whoami/WhoAmI.tsx
@@ -33,7 +33,7 @@ export class WhoAmI {
   constructor(me?: WhoAmIRepresentation) {
     this.#me = me;
     if (this.#me?.locale) {
-      i18n.changeLanguage(this.#me.locale, (error) => {
+      void i18n.changeLanguage(this.#me.locale, (error) => {
         if (error) {
           console.warn("Error(s) loading locale", this.#me?.locale, error);
         }
@@ -106,14 +106,34 @@ export const WhoAmIContextProvider = ({ children }: PropsWithChildren) => {
   const [key, setKey] = useState(0);
 
   useFetch(
-    () =>
-      adminClient.whoAmI.find({
-        realm: environment.realm,
-        currentRealm: realm!,
-      }),
+    async () => {
+      try {
+        return await adminClient.whoAmI.find({
+          realm: environment.realm,
+          currentRealm: realm!,
+        });
+      } catch (error) {
+        console.warn("Error fetching whoami", error);
+      }
+      return Promise.resolve(undefined);
+    },
     (me) => {
-      const whoAmI = new WhoAmI(me);
-      setWhoAmI(whoAmI);
+      if (me === undefined) {
+        setWhoAmI(
+          new WhoAmI({
+            userId: "",
+            realm: environment.realm,
+            displayName: "",
+            locale: "en",
+            temporary: false,
+            createRealm: false,
+            realm_access: {},
+          }),
+        );
+      } else {
+        const whoAmI = new WhoAmI(me);
+        setWhoAmI(whoAmI);
+      }
     },
     [key, realm],
   );
diff --git a/js/apps/admin-ui/src/dashboard/Dashboard.tsx b/js/apps/admin-ui/src/dashboard/Dashboard.tsx
index 34b870b4749d..c891a74232a3 100644
--- a/js/apps/admin-ui/src/dashboard/Dashboard.tsx
+++ b/js/apps/admin-ui/src/dashboard/Dashboard.tsx
@@ -86,9 +86,18 @@ const FeatureItem = ({ feature }: FeatureItemProps) => {
       {feature.type === FeatureType.Preview && (
         <Label color="blue">{t("preview")}</Label>
       )}
+      {feature.type === FeatureType.PreviewDisabledByDefault && (
+        <Label color="blue">{t("preview")}</Label>
+      )}
       {feature.type === FeatureType.Default && (
         <Label color="green">{t("supported")}</Label>
       )}
+      {feature.type === FeatureType.DisabledByDefault && (
+        <Label color="green">{t("supported")}</Label>
+      )}
+      {feature.type === FeatureType.Deprecated && (
+        <Label color="grey">{t("deprecated")}</Label>
+      )}
     </ListItem>
   );
 };
@@ -159,6 +168,7 @@ const Dashboard = () => {
               <div className="pf-v5-l-grid pf-v5-u-ml-lg">
                 <div className="pf-v5-l-grid__item pf-m-12-col">
                   <Title
+                    data-testid="welcomeTitle"
                     className="pf-v5-u-font-weight-bold"
                     headingLevel="h2"
                     size="3xl"
@@ -238,6 +248,19 @@ const Dashboard = () => {
                         </DescriptionListGroup>
                       </DescriptionList>
                     </CardBody>
+                    <CardTitle>{t("cpu")}</CardTitle>
+                    <CardBody>
+                      <DescriptionList>
+                        <DescriptionListGroup>
+                          <DescriptionListTerm>
+                            {t("processorCount")}
+                          </DescriptionListTerm>
+                          <DescriptionListDescription>
+                            {serverInfo.cpuInfo?.processorCount}
+                          </DescriptionListDescription>
+                        </DescriptionListGroup>
+                      </DescriptionList>
+                    </CardBody>
                     <CardTitle>{t("memory")}</CardTitle>
                     <CardBody>
                       <DescriptionList>
diff --git a/js/apps/admin-ui/src/events/AdminEvents.tsx b/js/apps/admin-ui/src/events/AdminEvents.tsx
index a5ea28c92ad0..d7345d46ca93 100644
--- a/js/apps/admin-ui/src/events/AdminEvents.tsx
+++ b/js/apps/admin-ui/src/events/AdminEvents.tsx
@@ -36,19 +36,19 @@ import {
   Tr,
   cellWidth,
 } from "@patternfly/react-table";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import { pickBy } from "lodash-es";
 import { PropsWithChildren, useMemo, useState } from "react";
 import { Controller, FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useAdminClient } from "../admin-client";
+import { EventsBanners } from "../Banners";
 import DropdownPanel from "../components/dropdown-panel/DropdownPanel";
+import CodeEditor from "../components/form/CodeEditor";
 import { useRealm } from "../context/realm-context/RealmContext";
 import { useServerInfo } from "../context/server-info/ServerInfoProvider";
 import { prettyPrintJSON } from "../util";
 import useFormatDate, { FORMAT_DATE_AND_TIME } from "../utils/useFormatDate";
 import { CellResourceLinkRenderer } from "./ResourceLinks";
-import { EventsBanners } from "../Banners";
 
 import "./events.css";
 
@@ -178,9 +178,9 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
 
   function loader(first?: number, max?: number) {
     return adminClient.realms.findAdminEvents({
+      resourcePath,
       // The admin client wants 'dateFrom' and 'dateTo' to be Date objects, however it cannot actually handle them so we need to cast to any.
       ...(activeFilters as any),
-      resourcePath,
       realm,
       first,
       max,
@@ -225,6 +225,10 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
       (value) => value !== "" || (Array.isArray(value) && value.length > 0),
     );
 
+    if (resourcePath) {
+      delete newFilters.resourcePath;
+    }
+
     setActiveFilters(newFilters);
     setKey(key + 1);
   }
@@ -279,12 +283,7 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
           data-testid="representation-dialog"
           onClose={() => setRepresentationEvent(undefined)}
         >
-          <CodeEditor
-            readOnly
-            value={code}
-            language="json"
-            style={{ height: "8rem", overflow: "scroll" }}
-          />
+          <CodeEditor readOnly value={code} language="json" />
         </DisplayDialog>
       )}
       {!adminEventsEnabled && <EventsBanners type="adminEvents" />}
@@ -345,7 +344,9 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
                             onSelect={(selectedValue) => {
                               const option = selectedValue.toString();
                               const changedValue = field.value.includes(option)
-                                ? field.value.filter((item) => item !== option)
+                                ? field.value.filter(
+                                    (item: string) => item !== option,
+                                  )
                                 : [...field.value, option];
 
                               field.onChange(changedValue);
@@ -357,14 +358,14 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
                             aria-labelledby={"resourceTypes"}
                             chipGroupComponent={
                               <ChipGroup>
-                                {field.value.map((chip) => (
+                                {field.value.map((chip: string) => (
                                   <Chip
                                     key={chip}
                                     onClick={(resource) => {
                                       resource.stopPropagation();
                                       field.onChange(
                                         field.value.filter(
-                                          (val) => val !== chip,
+                                          (val: string) => val !== chip,
                                         ),
                                       );
                                     }}
@@ -410,7 +411,9 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
                             onSelect={(selectedValue) => {
                               const option = selectedValue.toString();
                               const changedValue = field.value.includes(option)
-                                ? field.value.filter((item) => item !== option)
+                                ? field.value.filter(
+                                    (item: string) => item !== option,
+                                  )
                                 : [...field.value, option];
 
                               field.onChange(changedValue);
@@ -422,14 +425,14 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
                             aria-labelledby={"operationTypes"}
                             chipGroupComponent={
                               <ChipGroup>
-                                {field.value.map((chip) => (
+                                {field.value.map((chip: string) => (
                                   <Chip
                                     key={chip}
                                     onClick={(operation) => {
                                       operation.stopPropagation();
                                       field.onChange(
                                         field.value.filter(
-                                          (val) => val !== chip,
+                                          (val: string) => val !== chip,
                                         ),
                                       );
                                     }}
@@ -602,6 +605,8 @@ export const AdminEvents = ({ resourcePath }: AdminEventsProps) => {
           <ListEmptyState
             message={t("emptyAdminEvents")}
             instructions={t("emptyAdminEventsInstructions")}
+            primaryActionText={t("refresh")}
+            onPrimaryAction={() => setKey(key + 1)}
           />
         }
         isSearching={Object.keys(activeFilters).length > 0}
diff --git a/js/apps/admin-ui/src/events/UserEvents.tsx b/js/apps/admin-ui/src/events/UserEvents.tsx
index 7f84cc3a0594..eddfa934f1b1 100644
--- a/js/apps/admin-ui/src/events/UserEvents.tsx
+++ b/js/apps/admin-ui/src/events/UserEvents.tsx
@@ -34,12 +34,12 @@ import { Controller, FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { Link } from "react-router-dom";
 import { useAdminClient } from "../admin-client";
+import { EventsBanners } from "../Banners";
 import DropdownPanel from "../components/dropdown-panel/DropdownPanel";
 import { useRealm } from "../context/realm-context/RealmContext";
 import { toUser } from "../user/routes/User";
 import useFormatDate, { FORMAT_DATE_AND_TIME } from "../utils/useFormatDate";
 import useLocaleSort from "../utils/useLocaleSort";
-import { EventsBanners } from "../Banners";
 
 import "./events.css";
 
@@ -287,7 +287,9 @@ export const UserEvents = ({ user, client }: UserEventsProps) => {
                         onSelect={(selectedValue) => {
                           const option = selectedValue.toString() as EventType;
                           const changedValue = field.value.includes(option)
-                            ? field.value.filter((item) => item !== option)
+                            ? field.value.filter(
+                                (item: string) => item !== option,
+                              )
                             : [...field.value, option];
 
                           field.onChange(changedValue);
@@ -299,13 +301,15 @@ export const UserEvents = ({ user, client }: UserEventsProps) => {
                         aria-labelledby={"eventType"}
                         chipGroupComponent={
                           <ChipGroup>
-                            {field.value.map((chip) => (
+                            {field.value.map((chip: string) => (
                               <Chip
                                 key={chip}
                                 onClick={(event) => {
                                   event.stopPropagation();
                                   field.onChange(
-                                    field.value.filter((val) => val !== chip),
+                                    field.value.filter(
+                                      (val: string) => val !== chip,
+                                    ),
                                   );
                                 }}
                               >
@@ -493,6 +497,8 @@ export const UserEvents = ({ user, client }: UserEventsProps) => {
           <ListEmptyState
             message={t("emptyUserEvents")}
             instructions={t("emptyUserEventsInstructions")}
+            primaryActionText={t("refresh")}
+            onPrimaryAction={() => setKey(key + 1)}
           />
         }
         isSearching={Object.keys(activeFilters).length > 0}
diff --git a/js/apps/admin-ui/src/groups/GroupTable.tsx b/js/apps/admin-ui/src/groups/GroupTable.tsx
index ac0f071d79d4..77127a07a871 100644
--- a/js/apps/admin-ui/src/groups/GroupTable.tsx
+++ b/js/apps/admin-ui/src/groups/GroupTable.tsx
@@ -136,6 +136,9 @@ export const GroupTable = ({ refresh: viewRefresh }: GroupTableProps) => {
                 value={search}
                 onChange={(_, value) => {
                   setSearch(value);
+                  if (value === "") {
+                    refresh();
+                  }
                 }}
                 onSearch={refresh}
                 onClear={() => {
@@ -156,7 +159,7 @@ export const GroupTable = ({ refresh: viewRefresh }: GroupTableProps) => {
             ? []
             : [
                 {
-                  title: t("rename"),
+                  title: t("edit"),
                   onRowClick: async (group) => {
                     setRename(group);
                     return false;
diff --git a/js/apps/admin-ui/src/groups/GroupsModal.tsx b/js/apps/admin-ui/src/groups/GroupsModal.tsx
index 0ee602e0d84f..00a266ea3374 100644
--- a/js/apps/admin-ui/src/groups/GroupsModal.tsx
+++ b/js/apps/admin-ui/src/groups/GroupsModal.tsx
@@ -1,4 +1,10 @@
 import type GroupRepresentation from "@keycloak/keycloak-admin-client/lib/defs/groupRepresentation";
+import {
+  FormSubmitButton,
+  TextControl,
+  useAlerts,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
 import {
   Alert,
   AlertVariant,
@@ -8,16 +14,11 @@ import {
   Modal,
   ModalVariant,
 } from "@patternfly/react-core";
+import { useState } from "react";
 import { FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import {
-  FormSubmitButton,
-  TextControl,
-  useFetch,
-} from "@keycloak/keycloak-ui-shared";
 import { useAdminClient } from "../admin-client";
-import { useAlerts } from "@keycloak/keycloak-ui-shared";
-import { useState } from "react";
+import useIsFeatureEnabled, { Feature } from "../utils/useIsFeatureEnabled";
 
 type GroupsModalProps = {
   id?: string;
@@ -48,11 +49,15 @@ export const GroupsModal = ({
   const { adminClient } = useAdminClient();
   const { t } = useTranslation();
   const { addAlert, addError } = useAlerts();
+  const isFeatureEnabled = useIsFeatureEnabled();
   const [duplicateGroupDetails, setDuplicateGroupDetails] =
     useState<GroupRepresentation | null>(null);
 
   const form = useForm({
-    defaultValues: { name: "" },
+    defaultValues: {
+      name: rename?.name || "",
+      description: rename?.description || "",
+    },
   });
   const { handleSubmit, formState } = form;
 
@@ -132,15 +137,17 @@ export const GroupsModal = ({
         });
       }
 
-      const permissions = await adminClient.groups.listPermissions({
-        id: sourceGroup.id!,
-      });
+      if (isFeatureEnabled(Feature.AdminFineGrainedAuthz)) {
+        const permissions = await adminClient.groups.listPermissions({
+          id: sourceGroup.id!,
+        });
 
-      if (permissions) {
-        await adminClient.groups.updatePermission(
-          { id: createdGroup.id },
-          permissions,
-        );
+        if (permissions) {
+          await adminClient.groups.updatePermission(
+            { id: createdGroup.id },
+            permissions,
+          );
+        }
       }
 
       const realmRoles = await adminClient.groups.listRealmRoleMappings({
@@ -231,13 +238,13 @@ export const GroupsModal = ({
       } else if (rename) {
         await adminClient.groups.update(
           { id },
-          { ...rename, name: group.name },
+          { ...rename, name: group.name, description: group.description },
         );
       } else {
         await adminClient.groups.updateChildGroup({ id }, group);
       }
 
-      refresh(rename ? { ...rename, name: group.name } : undefined);
+      refresh(rename ? { ...rename, ...group } : undefined);
       handleModalToggle();
       addAlert(
         t(
@@ -259,12 +266,12 @@ export const GroupsModal = ({
       variant={ModalVariant.small}
       title={
         rename
-          ? t("renameAGroup")
+          ? t("editGroup")
           : duplicateId
             ? t("duplicateAGroup")
             : t("createAGroup")
       }
-      isOpen={true}
+      isOpen
       onClose={handleModalToggle}
       actions={[
         <FormSubmitButton
@@ -275,7 +282,7 @@ export const GroupsModal = ({
           allowInvalid
           allowNonDirty
         >
-          {t(rename ? "rename" : duplicateId ? "duplicate" : "create")}
+          {t(rename ? "edit" : duplicateId ? "duplicate" : "create")}
         </FormSubmitButton>,
         <Button
           id="modal-cancel"
@@ -304,6 +311,7 @@ export const GroupsModal = ({
             rules={{ required: t("required") }}
             autoFocus
           />
+          <TextControl name="description" label={t("description")} />
         </Form>
       </FormProvider>
     </Modal>
diff --git a/js/apps/admin-ui/src/groups/GroupsSection.tsx b/js/apps/admin-ui/src/groups/GroupsSection.tsx
index d4a542ba67d2..fbe47de09856 100644
--- a/js/apps/admin-ui/src/groups/GroupsSection.tsx
+++ b/js/apps/admin-ui/src/groups/GroupsSection.tsx
@@ -25,6 +25,7 @@ import { PermissionsTab } from "../components/permission-tab/PermissionTab";
 import { ViewHeader } from "../components/view-header/ViewHeader";
 import { useAccess } from "../context/access/Access";
 import { useRealm } from "../context/realm-context/RealmContext";
+import { AdminEvents } from "../events/AdminEvents";
 import helpUrls from "../help-urls";
 import useIsFeatureEnabled, { Feature } from "../utils/useIsFeatureEnabled";
 import useToggle from "../utils/useToggle";
@@ -40,7 +41,6 @@ import { getId, getLastId } from "./groupIdUtils";
 import { toGroups } from "./routes/Groups";
 
 import "./GroupsSection.css";
-import { AdminEvents } from "../events/AdminEvents";
 
 export default function GroupsSection() {
   const { adminClient } = useAdminClient();
@@ -49,7 +49,7 @@ export default function GroupsSection() {
   const [activeTab, setActiveTab] = useState(0);
 
   const { subGroups, setSubGroups, currentGroup } = useSubGroups();
-  const { realm, realmRepresentation } = useRealm();
+  const { realm } = useRealm();
 
   const [rename, setRename] = useState<GroupRepresentation>();
   const [deleteOpen, toggleDeleteOpen] = useToggle();
@@ -169,7 +169,7 @@ export default function GroupsSection() {
                           key="renameGroup"
                           onClick={() => setRename(currentGroup())}
                         >
-                          {t("renameGroup")}
+                          {t("edit")}
                         </DropdownItem>,
                         <DropdownItem
                           data-testid="deleteGroup"
@@ -182,6 +182,9 @@ export default function GroupsSection() {
                     : undefined
                 }
               />
+              <PageSection className="pf-v5-u-pt-0">
+                {currentGroup()?.description}
+              </PageSection>
               {subGroups.length > 0 && (
                 <Tabs
                   inset={{
@@ -213,7 +216,7 @@ export default function GroupsSection() {
                     </Tab>
                   )}
                   <Tab
-                    data-testid="attributes"
+                    data-testid="attributesTab"
                     eventKey={2}
                     title={<TabTitleText>{t("attributes")}</TabTitleText>}
                   >
@@ -237,54 +240,43 @@ export default function GroupsSection() {
                       <PermissionsTab id={id} type="groups" />
                     </Tab>
                   )}
-                  {realmRepresentation?.adminEventsEnabled &&
-                    hasAccess("view-events") && (
-                      <Tab
-                        eventKey={5}
-                        data-testid="admin-events-tab"
-                        title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
+                  {hasAccess("view-events") && (
+                    <Tab
+                      eventKey={5}
+                      data-testid="admin-events-tab"
+                      title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
+                    >
+                      <Tabs
+                        activeKey={activeEventsTab}
+                        onSelect={(_, key) => setActiveEventsTab(key as string)}
                       >
-                        <Tabs
-                          activeKey={activeEventsTab}
-                          onSelect={(_, key) =>
-                            setActiveEventsTab(key as string)
+                        <Tab
+                          eventKey="adminEvents"
+                          title={
+                            <TabTitleText>{t("adminEvents")}</TabTitleText>
+                          }
+                        >
+                          <AdminEvents resourcePath={`groups/${id}`} />
+                        </Tab>
+                        <Tab
+                          eventKey="membershipEvents"
+                          title={
+                            <TabTitleText>{t("membershipEvents")}</TabTitleText>
+                          }
+                        >
+                          <AdminEvents resourcePath={`users/*/groups/${id}`} />
+                        </Tab>
+                        <Tab
+                          eventKey="childGroupEvents"
+                          title={
+                            <TabTitleText>{t("childGroupEvents")}</TabTitleText>
                           }
                         >
-                          <Tab
-                            eventKey="adminEvents"
-                            title={
-                              <TabTitleText>{t("adminEvents")}</TabTitleText>
-                            }
-                          >
-                            <AdminEvents resourcePath={`groups/${id}`} />
-                          </Tab>
-                          <Tab
-                            eventKey="membershipEvents"
-                            title={
-                              <TabTitleText>
-                                {t("membershipEvents")}
-                              </TabTitleText>
-                            }
-                          >
-                            <AdminEvents
-                              resourcePath={`users/*/groups/${id}`}
-                            />
-                          </Tab>
-                          <Tab
-                            eventKey="childGroupEvents"
-                            title={
-                              <TabTitleText>
-                                {t("childGroupEvents")}
-                              </TabTitleText>
-                            }
-                          >
-                            <AdminEvents
-                              resourcePath={`groups/${id}/children`}
-                            />
-                          </Tab>
-                        </Tabs>
-                      </Tab>
-                    )}
+                          <AdminEvents resourcePath={`groups/${id}/children`} />
+                        </Tab>
+                      </Tabs>
+                    </Tab>
+                  )}
                 </Tabs>
               )}
               {subGroups.length === 0 && <GroupTable refresh={refresh} />}
diff --git a/js/apps/admin-ui/src/groups/Members.tsx b/js/apps/admin-ui/src/groups/Members.tsx
index 6c387b2e6f22..31d1207da7e6 100644
--- a/js/apps/admin-ui/src/groups/Members.tsx
+++ b/js/apps/admin-ui/src/groups/Members.tsx
@@ -206,6 +206,7 @@ export const Members = () => {
                   onOpenChange={(isOpen) => setIsKebabOpen(isOpen)}
                   toggle={(ref) => (
                     <MenuToggle
+                      data-testid="kebab"
                       ref={ref}
                       variant="plain"
                       onClick={() => setIsKebabOpen(!isKebabOpen)}
diff --git a/js/apps/admin-ui/src/groups/components/GroupToolbar.tsx b/js/apps/admin-ui/src/groups/components/GroupToolbar.tsx
index 568dbfd48625..763ee7ad05d9 100644
--- a/js/apps/admin-ui/src/groups/components/GroupToolbar.tsx
+++ b/js/apps/admin-ui/src/groups/components/GroupToolbar.tsx
@@ -48,6 +48,7 @@ export const GroupToolbar = ({
           onOpenChange={toggleKebab}
           toggle={(ref) => (
             <MenuToggle
+              data-testid="kebab"
               ref={ref}
               isExpanded={openKebab}
               onClick={toggleKebab}
diff --git a/js/apps/admin-ui/src/groups/components/GroupTree.tsx b/js/apps/admin-ui/src/groups/components/GroupTree.tsx
index f36e59b217c8..cdb7fd582367 100644
--- a/js/apps/admin-ui/src/groups/components/GroupTree.tsx
+++ b/js/apps/admin-ui/src/groups/components/GroupTree.tsx
@@ -125,7 +125,7 @@ const GroupTreeContextMenu = ({
       >
         <DropdownList>
           <DropdownItem key="rename" onClick={toggleRenameOpen}>
-            {t("rename")}
+            {t("edit")}
           </DropdownItem>
           <DropdownItem key="move" onClick={toggleMoveOpen}>
             {t("moveTo")}
diff --git a/js/apps/admin-ui/src/i18n/i18n.ts b/js/apps/admin-ui/src/i18n/i18n.ts
index ba95391f22c2..4ef8afc58713 100644
--- a/js/apps/admin-ui/src/i18n/i18n.ts
+++ b/js/apps/admin-ui/src/i18n/i18n.ts
@@ -1,18 +1,23 @@
 import { createInstance } from "i18next";
-import HttpBackend from "i18next-http-backend";
+import type { i18n as i18nType } from "i18next";
+import FetchBackend from "i18next-fetch-backend";
 import { initReactI18next } from "react-i18next";
 
 import { environment } from "../environment";
 import { joinPath } from "../utils/joinPath";
 
+// @ts-ignore imported by rollup plugin
+import code from "message-bundle";
+
 type KeyValue = { key: string; value: string };
 
 export const DEFAULT_LOCALE = "en";
 export const KEY_SEPARATOR = ".";
 
-export const i18n = createInstance({
+export const i18n: i18nType = createInstance({
   fallbackLng: DEFAULT_LOCALE,
   keySeparator: KEY_SEPARATOR,
+  nsSeparator: false,
   interpolation: {
     escapeValue: false,
   },
@@ -24,14 +29,17 @@ export const i18n = createInstance({
       `resources/{{ns}}/admin/{{lng}}`,
     ),
     parse: (data: string) => {
-      const messages = JSON.parse(data);
-
-      const result: Record<string, string> = {};
-      messages.forEach((v: KeyValue) => (result[v.key] = v.value));
-      return result;
+      if (
+        process.env.NODE_ENV === "development" &&
+        import.meta.env.VITE_REALM_OVERRIDES === undefined
+      ) {
+        return code;
+      }
+      const messages: KeyValue[] = JSON.parse(data);
+      return Object.fromEntries(messages.map(({ key, value }) => [key, value]));
     },
   },
 });
 
-i18n.use(HttpBackend);
+i18n.use(FetchBackend);
 i18n.use(initReactI18next);
diff --git a/js/apps/admin-ui/src/identity-providers/IdentityProvidersSection.tsx b/js/apps/admin-ui/src/identity-providers/IdentityProvidersSection.tsx
index ca62a0e73834..d48baad55dcd 100644
--- a/js/apps/admin-ui/src/identity-providers/IdentityProvidersSection.tsx
+++ b/js/apps/admin-ui/src/identity-providers/IdentityProvidersSection.tsx
@@ -135,7 +135,7 @@ export default function IdentityProvidersSection() {
       params.search = search;
     }
     const providers = await adminClient.identityProviders.find(params);
-    return sortBy(providers, "alias");
+    return providers;
   };
 
   const navigateToCreate = (providerId: string) =>
diff --git a/js/apps/admin-ui/src/identity-providers/add/AddMapperForm.tsx b/js/apps/admin-ui/src/identity-providers/add/AddMapperForm.tsx
index 8dace817b0b1..7d6682422020 100644
--- a/js/apps/admin-ui/src/identity-providers/add/AddMapperForm.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/AddMapperForm.tsx
@@ -91,7 +91,7 @@ export const AddMapperForm = ({
               {mapperTypes.map((option) => (
                 <SelectOption
                   selected={option === field.value}
-                  datatest-id={option.id}
+                  data-testid={option.id}
                   key={option.name}
                   value={option}
                 >
diff --git a/js/apps/admin-ui/src/identity-providers/add/AddOAuth2.tsx b/js/apps/admin-ui/src/identity-providers/add/AddOAuth2.tsx
new file mode 100644
index 000000000000..ac710a7d71e6
--- /dev/null
+++ b/js/apps/admin-ui/src/identity-providers/add/AddOAuth2.tsx
@@ -0,0 +1,105 @@
+import type IdentityProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/identityProviderRepresentation";
+import {
+  ActionGroup,
+  AlertVariant,
+  Button,
+  PageSection,
+} from "@patternfly/react-core";
+import { FormProvider, useForm } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { Link, useNavigate } from "react-router-dom";
+import { useAdminClient } from "../../admin-client";
+import { useAlerts } from "@keycloak/keycloak-ui-shared";
+import { FormAccess } from "../../components/form/FormAccess";
+import { ViewHeader } from "../../components/view-header/ViewHeader";
+import { useRealm } from "../../context/realm-context/RealmContext";
+import { toIdentityProvider } from "../routes/IdentityProvider";
+import { toIdentityProviders } from "../routes/IdentityProviders";
+import { OIDCAuthentication } from "./OIDCAuthentication";
+import { OIDCGeneralSettings } from "./OIDCGeneralSettings";
+import { OpenIdConnectSettings } from "./OpenIdConnectSettings";
+import { UserProfileClaimsSettings } from "./OAuth2UserProfileClaimsSettings";
+
+type DiscoveryIdentity = IdentityProviderRepresentation & {
+  discoveryEndpoint?: string;
+};
+
+export default function AddOpenIdConnect() {
+  const { adminClient } = useAdminClient();
+
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const id = `oauth2`;
+
+  const form = useForm<IdentityProviderRepresentation>({
+    defaultValues: { alias: id },
+    mode: "onChange",
+  });
+  const {
+    handleSubmit,
+    formState: { isDirty },
+  } = form;
+
+  const { addAlert, addError } = useAlerts();
+  const { realm } = useRealm();
+
+  const onSubmit = async (provider: DiscoveryIdentity) => {
+    delete provider.discoveryEndpoint;
+    try {
+      await adminClient.identityProviders.create({
+        ...provider,
+        providerId: id,
+      });
+      addAlert(t("createIdentityProviderSuccess"), AlertVariant.success);
+      navigate(
+        toIdentityProvider({
+          realm,
+          providerId: id,
+          alias: provider.alias!,
+          tab: "settings",
+        }),
+      );
+    } catch (error) {
+      addError("createIdentityProviderError", error);
+    }
+  };
+
+  return (
+    <>
+      <ViewHeader titleKey={t("addOAuth2Provider")} />
+      <PageSection variant="light">
+        <FormProvider {...form}>
+          <FormAccess
+            role="manage-identity-providers"
+            isHorizontal
+            onSubmit={handleSubmit(onSubmit)}
+          >
+            <OIDCGeneralSettings />
+            <OpenIdConnectSettings isOIDC={false} />
+            <OIDCAuthentication />
+            <UserProfileClaimsSettings />
+            <ActionGroup>
+              <Button
+                isDisabled={!isDirty}
+                variant="primary"
+                type="submit"
+                data-testid="createProvider"
+              >
+                {t("add")}
+              </Button>
+              <Button
+                variant="link"
+                data-testid="cancel"
+                component={(props) => (
+                  <Link {...props} to={toIdentityProviders({ realm })} />
+                )}
+              >
+                {t("cancel")}
+              </Button>
+            </ActionGroup>
+          </FormAccess>
+        </FormProvider>
+      </PageSection>
+    </>
+  );
+}
diff --git a/js/apps/admin-ui/src/identity-providers/add/AddOpenIdConnect.tsx b/js/apps/admin-ui/src/identity-providers/add/AddOpenIdConnect.tsx
index 5d1c0922f83e..a8872336af8d 100644
--- a/js/apps/admin-ui/src/identity-providers/add/AddOpenIdConnect.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/AddOpenIdConnect.tsx
@@ -80,7 +80,7 @@ export default function AddOpenIdConnect() {
             onSubmit={handleSubmit(onSubmit)}
           >
             <OIDCGeneralSettings />
-            <OpenIdConnectSettings />
+            <OpenIdConnectSettings isOIDC />
             <OIDCAuthentication />
             <ActionGroup>
               <Button
diff --git a/js/apps/admin-ui/src/identity-providers/add/AdvancedSettings.tsx b/js/apps/admin-ui/src/identity-providers/add/AdvancedSettings.tsx
index 484fd820f1db..29306af088dd 100644
--- a/js/apps/admin-ui/src/identity-providers/add/AdvancedSettings.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/AdvancedSettings.tsx
@@ -95,9 +95,17 @@ const LoginFlow = ({
 };
 
 const SYNC_MODES = ["IMPORT", "LEGACY", "FORCE"];
-type AdvancedSettingsProps = { isOIDC: boolean; isSAML: boolean };
+type AdvancedSettingsProps = {
+  isOIDC: boolean;
+  isSAML: boolean;
+  isOAuth2: boolean;
+};
 
-export const AdvancedSettings = ({ isOIDC, isSAML }: AdvancedSettingsProps) => {
+export const AdvancedSettings = ({
+  isOIDC,
+  isSAML,
+  isOAuth2,
+}: AdvancedSettingsProps) => {
   const { t } = useTranslation();
   const {
     control,
@@ -121,18 +129,18 @@ export const AdvancedSettings = ({ isOIDC, isSAML }: AdvancedSettingsProps) => {
   const syncModeAvailable = transientUsers === "false";
   return (
     <>
-      {!isOIDC && !isSAML && (
+      {!isOIDC && !isSAML && !isOAuth2 && (
         <TextField field="config.defaultScope" label="scopes" />
       )}
       <SwitchField field="storeToken" label="storeTokens" fieldType="boolean" />
-      {(isSAML || isOIDC) && (
+      {(isSAML || isOIDC || isOAuth2) && (
         <SwitchField
           field="addReadTokenRoleOnCreate"
           label="storedTokensReadable"
           fieldType="boolean"
         />
       )}
-      {!isOIDC && !isSAML && (
+      {!isOIDC && !isSAML && !isOAuth2 && (
         <>
           <SwitchField
             field="config.acceptsPromptNoneForwardFromClient"
@@ -156,7 +164,7 @@ export const AdvancedSettings = ({ isOIDC, isSAML }: AdvancedSettingsProps) => {
         fieldType="boolean"
       />
 
-      {(!isSAML || isOIDC) && (
+      {((!isSAML && !isOAuth2) || isOIDC) && (
         <FormGroupField label="filteredByClaim">
           <Controller
             name="config.filteredByClaim"
diff --git a/js/apps/admin-ui/src/identity-providers/add/DetailSettings.tsx b/js/apps/admin-ui/src/identity-providers/add/DetailSettings.tsx
index 4f4b0bdc4d54..413f898f1304 100644
--- a/js/apps/admin-ui/src/identity-providers/add/DetailSettings.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/DetailSettings.tsx
@@ -60,12 +60,14 @@ import { AdvancedSettings } from "./AdvancedSettings";
 import { DescriptorSettings } from "./DescriptorSettings";
 import { DiscoverySettings } from "./DiscoverySettings";
 import { ExtendedNonDiscoverySettings } from "./ExtendedNonDiscoverySettings";
+import { ExtendedOAuth2Settings } from "./ExtendedOAuth2Settings";
 import { GeneralSettings } from "./GeneralSettings";
 import { OIDCAuthentication } from "./OIDCAuthentication";
 import { OIDCGeneralSettings } from "./OIDCGeneralSettings";
 import { ReqAuthnConstraints } from "./ReqAuthnConstraintsSettings";
 import { SamlGeneralSettings } from "./SamlGeneralSettings";
 import { AdminEvents } from "../../events/AdminEvents";
+import { UserProfileClaimsSettings } from "./OAuth2UserProfileClaimsSettings";
 
 type HeaderProps = {
   onChange: (value: boolean) => void;
@@ -409,7 +411,8 @@ export default function DetailSettings() {
 
   const isOIDC = provider.providerId!.includes("oidc");
   const isSAML = provider.providerId!.includes("saml");
-  const isSocial = !isOIDC && !isSAML;
+  const isOAuth2 = provider.providerId!.includes("oauth2");
+  const isSocial = !isOIDC && !isSAML && !isOAuth2;
 
   const loader = async () => {
     const [loaderMappers, loaderMapperTypes] = await Promise.all([
@@ -446,7 +449,7 @@ export default function DetailSettings() {
           onSubmit={handleSubmit(save)}
         >
           {isSocial && <GeneralSettings create={false} id={providerId} />}
-          {isOIDC && <OIDCGeneralSettings />}
+          {(isOIDC || isOAuth2) && <OIDCGeneralSettings />}
           {isSAML && <SamlGeneralSettings isAliasReadonly />}
           {providerInfo && (
             <DynamicComponents stringify properties={providerInfo.properties} />
@@ -459,7 +462,7 @@ export default function DetailSettings() {
       isHidden: !isOIDC,
       panel: (
         <>
-          <DiscoverySettings readOnly={false} />
+          <DiscoverySettings readOnly={false} isOIDC={isOIDC} />
           <Form isHorizontal className="pf-v5-u-py-lg">
             <Divider />
             <OIDCAuthentication create={false} />
@@ -468,6 +471,21 @@ export default function DetailSettings() {
         </>
       ),
     },
+    {
+      title: t("oAuthSettings"),
+      isHidden: !isOAuth2,
+      panel: (
+        <>
+          <DiscoverySettings readOnly={false} isOIDC={isOIDC} />
+          <Form isHorizontal className="pf-v5-u-py-lg">
+            <Divider />
+            <OIDCAuthentication create={false} />
+          </Form>
+          <UserProfileClaimsSettings />
+          <ExtendedOAuth2Settings />
+        </>
+      ),
+    },
     {
       title: t("samlSettings"),
       isHidden: !isSAML,
@@ -494,7 +512,11 @@ export default function DetailSettings() {
           isHorizontal
           onSubmit={handleSubmit(save)}
         >
-          <AdvancedSettings isOIDC={isOIDC!} isSAML={isSAML!} />
+          <AdvancedSettings
+            isOIDC={isOIDC!}
+            isSAML={isSAML!}
+            isOAuth2={isOAuth2!}
+          />
 
           <FixedButtonsGroup name="idp-details" isSubmit reset={reset} />
         </FormAccess>
diff --git a/js/apps/admin-ui/src/identity-providers/add/DiscoverySettings.tsx b/js/apps/admin-ui/src/identity-providers/add/DiscoverySettings.tsx
index 24a7c61bfc43..c90975d1ffc8 100644
--- a/js/apps/admin-ui/src/identity-providers/add/DiscoverySettings.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/DiscoverySettings.tsx
@@ -16,9 +16,10 @@ const PKCE_METHODS = ["plain", "S256"] as const;
 
 type DiscoverySettingsProps = {
   readOnly: boolean;
+  isOIDC: boolean;
 };
 
-const Fields = ({ readOnly }: DiscoverySettingsProps) => {
+const Fields = ({ readOnly, isOIDC }: DiscoverySettingsProps) => {
   const { t } = useTranslation();
   const { control } = useFormContext<IdentityProviderRepresentation>();
 
@@ -55,52 +56,69 @@ const Fields = ({ readOnly }: DiscoverySettingsProps) => {
           required: t("required"),
         }}
       />
-      <TextControl
-        name="config.logoutUrl"
-        label={t("logoutUrl")}
-        readOnly={readOnly}
-      />
+      {isOIDC && (
+        <TextControl
+          name="config.logoutUrl"
+          label={t("logoutUrl")}
+          readOnly={readOnly}
+        />
+      )}
       <TextControl
         name="config.userInfoUrl"
         label={t("userInfoUrl")}
         readOnly={readOnly}
+        rules={{
+          required: isOIDC ? "" : t("required"),
+        }}
       />
       <TextControl
-        name="config.issuer"
-        label={t("issuer")}
+        name="config.tokenIntrospectionUrl"
+        label={t("tokenIntrospectionUrl")}
+        type="url"
         readOnly={readOnly}
       />
-      <DefaultSwitchControl
-        name="config.validateSignature"
-        label={t("validateSignature")}
-        isDisabled={readOnly}
-        stringify
-      />
-      {validateSignature === "true" && (
+      {isOIDC && (
+        <TextControl
+          name="config.issuer"
+          label={t("issuer")}
+          readOnly={readOnly}
+        />
+      )}
+      {isOIDC && (
         <>
           <DefaultSwitchControl
-            name="config.useJwksUrl"
-            label={t("useJwksUrl")}
+            name="config.validateSignature"
+            label={t("validateSignature")}
             isDisabled={readOnly}
             stringify
           />
-          {useJwks === "true" ? (
-            <TextAreaControl
-              name="config.jwksUrl"
-              label={t("jwksUrl")}
-              readOnly={readOnly}
-            />
-          ) : (
+          {validateSignature === "true" && (
             <>
-              <TextAreaControl
-                name="config.publicKeySignatureVerifier"
-                label={t("validatingPublicKey")}
-              />
-              <TextControl
-                name="config.publicKeySignatureVerifierKeyId"
-                label={t("validatingPublicKeyId")}
-                readOnly={readOnly}
+              <DefaultSwitchControl
+                name="config.useJwksUrl"
+                label={t("useJwksUrl")}
+                isDisabled={readOnly}
+                stringify
               />
+              {useJwks === "true" ? (
+                <TextAreaControl
+                  name="config.jwksUrl"
+                  label={t("jwksUrl")}
+                  readOnly={readOnly}
+                />
+              ) : (
+                <>
+                  <TextAreaControl
+                    name="config.publicKeySignatureVerifier"
+                    label={t("validatingPublicKey")}
+                  />
+                  <TextControl
+                    name="config.publicKeySignatureVerifierKeyId"
+                    label={t("validatingPublicKeyId")}
+                    readOnly={readOnly}
+                  />
+                </>
+              )}
             </>
           )}
         </>
@@ -129,7 +147,10 @@ const Fields = ({ readOnly }: DiscoverySettingsProps) => {
   );
 };
 
-export const DiscoverySettings = ({ readOnly }: DiscoverySettingsProps) => {
+export const DiscoverySettings = ({
+  readOnly,
+  isOIDC,
+}: DiscoverySettingsProps) => {
   const { t } = useTranslation();
   const [isExpanded, setIsExpanded] = useState(false);
 
@@ -142,10 +163,10 @@ export const DiscoverySettings = ({ readOnly }: DiscoverySettingsProps) => {
           onToggle={() => setIsExpanded(!isExpanded)}
           isExpanded={isExpanded}
         >
-          <Fields readOnly={readOnly} />
+          <Fields readOnly={readOnly} isOIDC={isOIDC} />
         </ExpandableSection>
       )}
-      {!readOnly && <Fields readOnly={readOnly} />}
+      {!readOnly && <Fields readOnly={readOnly} isOIDC={isOIDC} />}
     </>
   );
 };
diff --git a/js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx b/js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx
index d6a6f765bbb9..80473eb16f3b 100644
--- a/js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/ExtendedNonDiscoverySettings.tsx
@@ -57,6 +57,10 @@ export const ExtendedNonDiscoverySettings = () => {
         />
         <SwitchField field="config.disableUserInfo" label="disableUserInfo" />
         <SwitchField field="config.disableNonce" label="disableNonce" />
+        <SwitchField
+          field="config.disableTypeClaimCheck"
+          label="disableTypeClaimCheck"
+        />
         <TextField field="config.defaultScope" label="scopes" />
         <FormGroupField label="prompt">
           <Controller
@@ -93,6 +97,10 @@ export const ExtendedNonDiscoverySettings = () => {
           field="config.acceptsPromptNoneForwardFromClient"
           label="acceptsPromptNone"
         />
+        <SwitchField
+          field="config.requiresShortStateParameter"
+          label="requiresShortStateParameter"
+        />
         <FormGroup
           label={t("allowedClockSkew")}
           labelIcon={
diff --git a/js/apps/admin-ui/src/identity-providers/add/ExtendedOAuth2Settings.tsx b/js/apps/admin-ui/src/identity-providers/add/ExtendedOAuth2Settings.tsx
new file mode 100644
index 000000000000..2fbdcb3e8ced
--- /dev/null
+++ b/js/apps/admin-ui/src/identity-providers/add/ExtendedOAuth2Settings.tsx
@@ -0,0 +1,51 @@
+import { NumberControl, SelectControl } from "@keycloak/keycloak-ui-shared";
+import { ExpandableSection, Form } from "@patternfly/react-core";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { SwitchField } from "../component/SwitchField";
+import { TextField } from "../component/TextField";
+
+export const ExtendedOAuth2Settings = () => {
+  const { t } = useTranslation();
+
+  const [isExpanded, setIsExpanded] = useState(false);
+
+  return (
+    <ExpandableSection
+      toggleText={t("advanced")}
+      onToggle={() => setIsExpanded(!isExpanded)}
+      isExpanded={isExpanded}
+    >
+      <Form isHorizontal>
+        <TextField field="config.defaultScope" label="scopes" />
+        <SelectControl
+          name="config.prompt"
+          label={t("prompt")}
+          options={[
+            { key: t("prompts.unspecified"), value: "" },
+            { key: t("prompts.none"), value: "none" },
+            { key: t("prompts.consent"), value: "consent" },
+            { key: t("prompts.login"), value: "login" },
+            { key: t("prompts.select_account"), value: "select_account" },
+          ]}
+          controller={{ defaultValue: "" }}
+        />
+        <SwitchField
+          field="config.acceptsPromptNoneForwardFromClient"
+          label="acceptsPromptNone"
+        />
+        <SwitchField
+          field="config.requiresShortStateParameter"
+          label="requiresShortStateParameter"
+        />
+        <NumberControl
+          name="config.allowedClockSkew"
+          label={t("allowedClockSkew")}
+          labelIcon={t("allowedClockSkewHelp")}
+          controller={{ defaultValue: 0, rules: { min: 0 } }}
+        />
+        <TextField field="config.forwardParameters" label="forwardParameters" />
+      </Form>
+    </ExpandableSection>
+  );
+};
diff --git a/js/apps/admin-ui/src/identity-providers/add/OAuth2UserProfileClaimsSettings.tsx b/js/apps/admin-ui/src/identity-providers/add/OAuth2UserProfileClaimsSettings.tsx
new file mode 100644
index 000000000000..f0bf07a9e836
--- /dev/null
+++ b/js/apps/admin-ui/src/identity-providers/add/OAuth2UserProfileClaimsSettings.tsx
@@ -0,0 +1,60 @@
+import { useTranslation } from "react-i18next";
+import { TextControl } from "@keycloak/keycloak-ui-shared";
+import { Form, Title } from "@patternfly/react-core";
+
+export const UserProfileClaimsSettings = () => {
+  const { t } = useTranslation();
+
+  return (
+    <Form isHorizontal className="pf-v5-u-py-lg">
+      <Title headingLevel="h2" size="xl" className="kc-form-panel__title">
+        {t("userProfileClaims")}
+      </Title>
+      <TextControl
+        name="config.userIDClaim"
+        label={t("userIDClaim")}
+        labelIcon={t("userIDClaimHelp")}
+        rules={{
+          required: t("required"),
+        }}
+        defaultValue={"sub"}
+      />
+      <TextControl
+        name="config.userNameClaim"
+        label={t("userNameClaim")}
+        labelIcon={t("userNameClaimHelp")}
+        rules={{
+          required: t("required"),
+        }}
+        defaultValue={"preferred_username"}
+      />
+      <TextControl
+        name="config.emailClaim"
+        label={t("emailClaim")}
+        labelIcon={t("emailClaimHelp")}
+        rules={{
+          required: t("required"),
+        }}
+        defaultValue={"email"}
+      />
+      <TextControl
+        name="config.fullNameClaim"
+        label={t("fullNameClaim")}
+        labelIcon={t("fullNameClaimHelp")}
+        defaultValue={"name"}
+      />
+      <TextControl
+        name="config.givenNameClaim"
+        label={t("givenNameClaim")}
+        labelIcon={t("givenNameClaimHelp")}
+        defaultValue={"given_name"}
+      />
+      <TextControl
+        name="config.familyNameClaim"
+        label={t("familyNameClaim")}
+        labelIcon={t("familyNameClaimHelp")}
+        defaultValue={"family_name"}
+      />
+    </Form>
+  );
+};
diff --git a/js/apps/admin-ui/src/identity-providers/add/OpenIdConnectSettings.tsx b/js/apps/admin-ui/src/identity-providers/add/OpenIdConnectSettings.tsx
index a3412183eebf..e3d815e56e5d 100644
--- a/js/apps/admin-ui/src/identity-providers/add/OpenIdConnectSettings.tsx
+++ b/js/apps/admin-ui/src/identity-providers/add/OpenIdConnectSettings.tsx
@@ -7,7 +7,13 @@ import { JsonFileUpload } from "../../components/json-file-upload/JsonFileUpload
 import { DiscoveryEndpointField } from "../component/DiscoveryEndpointField";
 import { DiscoverySettings } from "./DiscoverySettings";
 
-export const OpenIdConnectSettings = () => {
+type OpenIdConnectSettingsProps = {
+  isOIDC: boolean;
+};
+
+export const OpenIdConnectSettings = ({
+  isOIDC,
+}: OpenIdConnectSettingsProps) => {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
@@ -49,7 +55,7 @@ export const OpenIdConnectSettings = () => {
   return (
     <>
       <Title headingLevel="h2" size="xl" className="kc-form-panel__title">
-        {t("oidcSettings")}
+        {isOIDC ? t("oidcSettings") : t("oAuthSettings")}
       </Title>
 
       <DiscoveryEndpointField
@@ -81,7 +87,9 @@ export const OpenIdConnectSettings = () => {
           </FormGroup>
         }
       >
-        {(readonly) => <DiscoverySettings readOnly={readonly} />}
+        {(readonly) => (
+          <DiscoverySettings readOnly={readonly} isOIDC={isOIDC} />
+        )}
       </DiscoveryEndpointField>
     </>
   );
diff --git a/js/apps/admin-ui/src/identity-providers/component/DiscoveryEndpointField.tsx b/js/apps/admin-ui/src/identity-providers/component/DiscoveryEndpointField.tsx
index f81918dfa4a1..a8d225e924f5 100644
--- a/js/apps/admin-ui/src/identity-providers/component/DiscoveryEndpointField.tsx
+++ b/js/apps/admin-ui/src/identity-providers/component/DiscoveryEndpointField.tsx
@@ -85,35 +85,44 @@ export const DiscoveryEndpointField = ({
         />
       </FormGroup>
       {discovery && (
-        <TextControl
-          name="discoveryEndpoint"
-          label={t(
-            id === "oidc" ? "discoveryEndpoint" : "samlEntityDescriptor",
-          )}
-          labelIcon={t(
-            id === "oidc"
-              ? "discoveryEndpointHelp"
-              : "samlEntityDescriptorHelp",
-          )}
-          type="url"
-          placeholder={
-            id === "oidc"
-              ? "https://hostname/realms/master/.well-known/openid-configuration"
-              : ""
-          }
-          validated={
-            errors.discoveryError || errors.discoveryEndpoint
+        <>
+          <div style={{ display: "none" }} data-testid="playwright-result">
+            {errors.discoveryError || errors.discoveryEndpoint
               ? "error"
               : !discoveryResult
                 ? "default"
-                : "success"
-          }
-          customIcon={discovering ? <Spinner isInline /> : undefined}
-          rules={{
-            required: t("required"),
-            validate: (value: string) => discoverDebounced(value),
-          }}
-        />
+                : "success"}
+          </div>
+          <TextControl
+            name="discoveryEndpoint"
+            label={t(
+              id === "oidc" ? "discoveryEndpoint" : "samlEntityDescriptor",
+            )}
+            labelIcon={t(
+              id === "oidc"
+                ? "discoveryEndpointHelp"
+                : "samlEntityDescriptorHelp",
+            )}
+            type="url"
+            placeholder={
+              id === "oidc"
+                ? "https://hostname/realms/master/.well-known/openid-configuration"
+                : ""
+            }
+            validated={
+              errors.discoveryError || errors.discoveryEndpoint
+                ? "error"
+                : !discoveryResult
+                  ? "default"
+                  : "success"
+            }
+            customIcon={discovering ? <Spinner isInline /> : undefined}
+            rules={{
+              required: t("required"),
+              validate: (value: string) => discoverDebounced(value),
+            }}
+          />
+        </>
       )}
       {!discovery && fileUpload}
       {discovery && !errors.discoveryError && children(true)}
diff --git a/js/apps/admin-ui/src/identity-providers/routes.ts b/js/apps/admin-ui/src/identity-providers/routes.ts
index 6ff67d1483d2..04fc1440eaf6 100644
--- a/js/apps/admin-ui/src/identity-providers/routes.ts
+++ b/js/apps/admin-ui/src/identity-providers/routes.ts
@@ -7,6 +7,7 @@ import { IdentityProvidersRoute } from "./routes/IdentityProviders";
 import { IdentityProviderAddMapperRoute } from "./routes/AddMapper";
 import { IdentityProviderEditMapperRoute } from "./routes/EditMapper";
 import { IdentityProviderCreateRoute } from "./routes/IdentityProviderCreate";
+import { IdentityProviderOAuth2Route } from "./routes/IdentityProviderOAuth2";
 
 const routes: AppRouteObject[] = [
   IdentityProviderAddMapperRoute,
@@ -17,6 +18,7 @@ const routes: AppRouteObject[] = [
   IdentityProviderKeycloakOidcRoute,
   IdentityProviderCreateRoute,
   IdentityProviderRoute,
+  IdentityProviderOAuth2Route,
 ];
 
 export default routes;
diff --git a/js/apps/admin-ui/src/identity-providers/routes/IdentityProviderOAuth2.tsx b/js/apps/admin-ui/src/identity-providers/routes/IdentityProviderOAuth2.tsx
new file mode 100644
index 000000000000..e0f904a35d3d
--- /dev/null
+++ b/js/apps/admin-ui/src/identity-providers/routes/IdentityProviderOAuth2.tsx
@@ -0,0 +1,13 @@
+import { lazy } from "react";
+import type { AppRouteObject } from "../../routes";
+
+const AddOAuth2 = lazy(() => import("../add/AddOAuth2"));
+
+export const IdentityProviderOAuth2Route: AppRouteObject = {
+  path: "/:realm/identity-providers/oauth2/add",
+  element: <AddOAuth2 />,
+  breadcrumb: (t) => t("addOAuth2Provider"),
+  handle: {
+    access: "manage-identity-providers",
+  },
+};
diff --git a/js/apps/admin-ui/src/index.css b/js/apps/admin-ui/src/index.css
index 43e5a394703c..7006bf4265b8 100644
--- a/js/apps/admin-ui/src/index.css
+++ b/js/apps/admin-ui/src/index.css
@@ -31,19 +31,6 @@ input[type="checkbox"] {
   width: fit-content;
 }
 
-div.pf-v5-c-page {
-  grid-column-start: banners;
-  grid-template-rows: max-content max-content 1fr;
-  grid-template-areas:
-    "banners banners"
-    "header header"
-    "nav main";
-}
-
-.pf-v5-c-page__sidebar {
-  grid-row-start: 3;
-}
-
 div.w-tc-editor {
   font-family: 'ui-monospace,SFMono-Regular,SF Mono,Consolas,Liberation Mono,Menlo,monospace';
 }
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/index.ts b/js/apps/admin-ui/src/index.ts
index 80fe639a5b6f..1a26e0c0e477 100644
--- a/js/apps/admin-ui/src/index.ts
+++ b/js/apps/admin-ui/src/index.ts
@@ -104,14 +104,13 @@ export { HelpHeader } from "./components/help-enabler/HelpHeader";
 export { FileUploadForm } from "./components/json-file-upload/FileUploadForm";
 export { JsonFileUpload } from "./components/json-file-upload/JsonFileUpload";
 export { AttributesForm } from "./components/key-value-form/AttributeForm";
-export { KeySelect } from "./components/key-value-form/KeySelect";
+export { KeySelect } from "./realm-settings/user-profile/attribute/KeySelect";
 export { KeyValueInput } from "./components/key-value-form/KeyValueInput";
-export { ValueSelect } from "./components/key-value-form/ValueSelect";
+export { ValueSelect } from "./realm-settings/user-profile/attribute/ValueSelect";
 export { ClickableCard } from "./components/keycloak-card/ClickableCard";
 export { KeycloakCard } from "./components/keycloak-card/KeycloakCard";
 export { MultiLineInput } from "./components/multi-line-input/MultiLineInput";
 export { PermissionsTab } from "./components/permission-tab/PermissionTab";
-export { RealmSelector } from "./components/realm-selector/RealmSelector";
 export { RoleForm } from "./components/role-form/RoleForm";
 export { AddRoleMappingModal } from "./components/role-mapping/AddRoleMappingModal";
 export { RoleMapping } from "./components/role-mapping/RoleMapping";
@@ -126,7 +125,7 @@ export { UserDataTableToolbarItems } from "./components/users/UserDataTableToolb
 export { ViewHeader } from "./components/view-header/ViewHeader";
 export { WizardSectionHeader } from "./components/wizard-section-header/WizardSectionHeader";
 export { DefaultSwitchControl } from "./components/SwitchControl";
-export { useAccess, AccessContext } from "./context/access/Access";
+export { useAccess, AccessContextProvider } from "./context/access/Access";
 export { fetchAdminUI } from "./context/auth/admin-ui-endpoint";
 export {
   useRealm,
@@ -314,4 +313,5 @@ export { App as AdminUi } from "./App";
 export type { Environment as AccountEnvironment } from "./environment";
 export { KeycloakProvider, useEnvironment } from "@keycloak/keycloak-ui-shared";
 export { AdminClientContext, initAdminClient } from "./admin-client";
-export * as PermissionsSection from "./permissions/PermissionsSection";
+export { AppContexts } from "./App";
+export * as PermissionsConfigurationSection from "./permissions-configuration/PermissionsConfigurationSection";
diff --git a/js/apps/admin-ui/src/organizations/IdentityProviderSelect.tsx b/js/apps/admin-ui/src/organizations/IdentityProviderSelect.tsx
index 0f0320d069e6..ec1801eeb501 100644
--- a/js/apps/admin-ui/src/organizations/IdentityProviderSelect.tsx
+++ b/js/apps/admin-ui/src/organizations/IdentityProviderSelect.tsx
@@ -28,7 +28,7 @@ import { ComponentProps } from "../components/dynamic/components";
 import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import useToggle from "../utils/useToggle";
 
-type IdentityProviderSelectProps = ComponentProps & {
+type IdentityProviderSelectProps = Omit<ComponentProps, "convertToName"> & {
   variant?: "typeaheadMulti" | "typeahead";
   isRequired?: boolean;
 };
diff --git a/js/apps/admin-ui/src/organizations/LinkIdentityProviderModal.tsx b/js/apps/admin-ui/src/organizations/LinkIdentityProviderModal.tsx
index 287480ffd3c5..10aad8600de3 100644
--- a/js/apps/admin-ui/src/organizations/LinkIdentityProviderModal.tsx
+++ b/js/apps/admin-ui/src/organizations/LinkIdentityProviderModal.tsx
@@ -76,7 +76,7 @@ export const LinkIdentityProviderModal = ({
         ...foundIdentityProvider.config,
         ...config,
       };
-      foundIdentityProvider.hideOnLogin = data.hideOnLogin;
+      foundIdentityProvider.hideOnLogin = data.hideOnLogin ?? true;
       await adminClient.identityProviders.update(
         { alias: data.alias[0] },
         foundIdentityProvider,
@@ -140,6 +140,7 @@ export const LinkIdentityProviderModal = ({
             controller={{ defaultValue: "" }}
             options={[
               { key: "", value: t("none") },
+              { key: "ANY", value: t("any") },
               ...getValues("domains")!.map((d) => ({ key: d, value: d })),
             ]}
             menuAppendTo="parent"
diff --git a/js/apps/admin-ui/src/organizations/OrganizationsSection.tsx b/js/apps/admin-ui/src/organizations/OrganizationsSection.tsx
index a183221cdd39..1809e3ada1c9 100644
--- a/js/apps/admin-ui/src/organizations/OrganizationsSection.tsx
+++ b/js/apps/admin-ui/src/organizations/OrganizationsSection.tsx
@@ -78,6 +78,7 @@ export default function OrganizationSection() {
           )}
           key={key}
           loader={loader}
+          searchPlaceholderKey="searchOrganization"
           isPaginated
           toolbarItem={
             <ToolbarItem>
diff --git a/js/apps/admin-ui/src/page-nav.css b/js/apps/admin-ui/src/page-nav.css
index 0c3e8df4b369..66359dfbb942 100644
--- a/js/apps/admin-ui/src/page-nav.css
+++ b/js/apps/admin-ui/src/page-nav.css
@@ -2,4 +2,5 @@
 .keycloak__page_nav__nav {
   --pf-v5-c-page__sidebar--Transition: all 50ms cubic-bezier(.42, 0, .58, 1);
   overflow: inherit;
+  overflow-y: auto;
 }
\ No newline at end of file
diff --git a/js/apps/admin-ui/src/permissions-configuration/PermissionsConfigurationSection.tsx b/js/apps/admin-ui/src/permissions-configuration/PermissionsConfigurationSection.tsx
new file mode 100644
index 000000000000..38583c8a1eb9
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/PermissionsConfigurationSection.tsx
@@ -0,0 +1,209 @@
+import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
+import {
+  AlertVariant,
+  PageSection,
+  Tab,
+  TabTitleText,
+} from "@patternfly/react-core";
+import { useState } from "react";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../admin-client";
+import { AuthorizationPolicies } from "../clients/authorization/Policies";
+import { FormFields, SaveOptions } from "../clients/ClientDetails";
+import { ConfirmDialogModal } from "../components/confirm-dialog/ConfirmDialog";
+import {
+  RoutableTabs,
+  useRoutableTab,
+} from "../components/routable-tabs/RoutableTabs";
+import { ViewHeader } from "../components/view-header/ViewHeader";
+import { useAccess } from "../context/access/Access";
+import { useRealm } from "../context/realm-context/RealmContext";
+import { toPermissionsConfigurationTabs } from "../permissions-configuration/routes/PermissionsConfigurationTabs";
+import { convertFormValuesToObject, convertToFormValues } from "../util";
+import useToggle from "../utils/useToggle";
+import { PermissionsConfigurationTab } from "./permission-configuration/PermissionsConfigurationTab";
+import { PermissionsEvaluationTab } from "./permission-evaluation/PermissionsEvaluationTab";
+
+export default function PermissionsConfigurationSection() {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const { realm } = useRealm();
+  const { hasAccess } = useAccess();
+  const { addAlert, addError } = useAlerts();
+  const [adminPermissionsClient, setAdminPermissionsClient] = useState<
+    ClientRepresentation | undefined
+  >();
+  const [changeAuthenticatorOpen, toggleChangeAuthenticatorOpen] = useToggle();
+  const form = useForm<FormFields>();
+  const { realmRepresentation } = useRealm();
+
+  const clientAuthenticatorType = useWatch({
+    control: form.control,
+    name: "clientAuthenticatorType",
+    defaultValue: "client-secret",
+  });
+
+  const hasManageAuthorization = hasAccess("manage-authorization");
+  const hasViewUsers = hasAccess("view-users");
+  const permissionsResourcesTab = useRoutableTab(
+    toPermissionsConfigurationTabs({
+      realm,
+      permissionClientId: realmRepresentation?.adminPermissionsClient?.id!,
+      tab: "permissions",
+    }),
+  );
+  const permissionsPoliciesTab = useRoutableTab(
+    toPermissionsConfigurationTabs({
+      realm,
+      permissionClientId: realmRepresentation?.adminPermissionsClient?.id!,
+      tab: "policies",
+    }),
+  );
+  const permissionsEvaluateTab = useRoutableTab(
+    toPermissionsConfigurationTabs({
+      realm,
+      permissionClientId: realmRepresentation?.adminPermissionsClient?.id!,
+      tab: "evaluation",
+    }),
+  );
+
+  useFetch(
+    async () => {
+      const clients = await adminClient.clients.find({
+        clientId: "admin-permissions",
+      });
+      return clients[0];
+    },
+    (adminPermissionsClient) => {
+      setAdminPermissionsClient(adminPermissionsClient!);
+    },
+    [],
+  );
+
+  const setupForm = (client: ClientRepresentation) => {
+    form.reset({ ...client });
+    convertToFormValues(client, form.setValue);
+  };
+
+  const save = async (
+    { confirmed = false, messageKey = "clientSaveSuccess" }: SaveOptions = {
+      confirmed: false,
+      messageKey: "clientSaveSuccess",
+    },
+  ) => {
+    if (!(await form.trigger())) {
+      return;
+    }
+
+    if (
+      !adminPermissionsClient?.publicClient &&
+      adminPermissionsClient?.clientAuthenticatorType !==
+        clientAuthenticatorType &&
+      !confirmed
+    ) {
+      toggleChangeAuthenticatorOpen();
+      return;
+    }
+
+    const values = convertFormValuesToObject(form.getValues());
+
+    const submittedClient =
+      convertFormValuesToObject<ClientRepresentation>(values);
+
+    try {
+      const newClient: ClientRepresentation = {
+        ...adminPermissionsClient,
+        ...submittedClient,
+      };
+
+      newClient.clientId = newClient.clientId?.trim();
+
+      await adminClient.clients.update(
+        { id: adminPermissionsClient!.clientId! },
+        newClient,
+      );
+      setupForm(newClient);
+      setAdminPermissionsClient(newClient);
+      addAlert(t(messageKey), AlertVariant.success);
+    } catch (error) {
+      addError("clientSaveError", error);
+    }
+  };
+
+  return (
+    adminPermissionsClient && (
+      <>
+        <ConfirmDialogModal
+          continueButtonLabel="yes"
+          cancelButtonLabel="no"
+          titleKey={t("changeAuthenticatorConfirmTitle", {
+            clientAuthenticatorType: clientAuthenticatorType,
+          })}
+          open={changeAuthenticatorOpen}
+          toggleDialog={toggleChangeAuthenticatorOpen}
+          onConfirm={() => save({ confirmed: true })}
+        >
+          <>
+            {t("changeAuthenticatorConfirm", {
+              clientAuthenticatorType: clientAuthenticatorType,
+            })}
+          </>
+        </ConfirmDialogModal>
+        <PageSection variant="light" className="pf-v5-u-p-0">
+          <FormProvider {...form}>
+            <ViewHeader
+              titleKey={t("permissions")}
+              subKey={t("permissionsSubTitle")}
+            />
+            <RoutableTabs
+              mountOnEnter
+              unmountOnExit
+              defaultLocation={toPermissionsConfigurationTabs({
+                realm,
+                permissionClientId: adminPermissionsClient.id!,
+                tab: "permissions",
+              })}
+            >
+              <Tab
+                id="resources"
+                data-testid="permissionsResources"
+                title={<TabTitleText>{t("permissions")}</TabTitleText>}
+                {...permissionsResourcesTab}
+              >
+                <PermissionsConfigurationTab
+                  clientId={adminPermissionsClient.id!}
+                />
+              </Tab>
+              <Tab
+                id="policies"
+                data-testid="permissionsPolicies"
+                title={<TabTitleText>{t("policies")}</TabTitleText>}
+                {...permissionsPoliciesTab}
+              >
+                <AuthorizationPolicies
+                  clientId={adminPermissionsClient.id!}
+                  isDisabled={!hasManageAuthorization}
+                />
+              </Tab>
+              {hasViewUsers && (
+                <Tab
+                  id="evaluation"
+                  data-testid="permissionsEvaluation"
+                  title={<TabTitleText>{t("evaluation")}</TabTitleText>}
+                  {...permissionsEvaluateTab}
+                >
+                  <PermissionsEvaluationTab
+                    client={adminPermissionsClient}
+                    save={save}
+                  />
+                </Tab>
+              )}
+            </RoutableTabs>
+          </FormProvider>
+        </PageSection>
+      </>
+    )
+  );
+}
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AssignedPolicies.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AssignedPolicies.tsx
new file mode 100644
index 000000000000..7d4e6fbd7837
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AssignedPolicies.tsx
@@ -0,0 +1,274 @@
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import {
+  Action,
+  FormErrorText,
+  HelpItem,
+  KeycloakDataTable,
+  ListEmptyState,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
+import {
+  Button,
+  Dropdown,
+  DropdownItem,
+  DropdownList,
+  FormGroup,
+  MenuToggle,
+} from "@patternfly/react-core";
+import { useState } from "react";
+import { Controller, useFormContext } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../../admin-client";
+import { NewPermissionPolicyDialog } from "./NewPermissionPolicyDialog";
+import PolicyProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyProviderRepresentation";
+import { ExistingPoliciesDialog } from "./ExistingPoliciesDialog";
+import { CaretDownIcon, FilterIcon } from "@patternfly/react-icons";
+import { capitalize, sortBy } from "lodash-es";
+import useToggle from "../../utils/useToggle";
+import { IRowData } from "@patternfly/react-table";
+
+type AssignedPoliciesProps = {
+  permissionClientId: string;
+  providers: PolicyProviderRepresentation[];
+  policies: PolicyRepresentation[] | undefined;
+  resourceType: string;
+};
+
+type AssignedPolicyForm = {
+  policies?: { id: string; type?: string }[];
+};
+
+export const AssignedPolicies = ({
+  permissionClientId,
+  providers,
+  policies,
+  resourceType,
+}: AssignedPoliciesProps) => {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const {
+    control,
+    getValues,
+    setValue,
+    trigger,
+    formState: { errors },
+  } = useFormContext<AssignedPolicyForm>();
+  const values = getValues("policies");
+  const [existingPoliciesOpen, setExistingPoliciesOpen] = useState(false);
+  const [newPolicyOpen, setNewPolicyOpen] = useState(false);
+  const [selectedPolicies, setSelectedPolicies] = useState<
+    PolicyRepresentation[]
+  >([]);
+  const [filterType, setFilterType] = useState<string | undefined>(undefined);
+  const [isFilterTypeDropdownOpen, toggleIsFilterTypeDropdownOpen] =
+    useToggle();
+
+  useFetch(
+    () => {
+      if (values && values.length > 0)
+        return Promise.all(
+          values.map((p) =>
+            adminClient.clients.findOnePolicy({
+              id: permissionClientId,
+              type: p.type!,
+              policyId: p.id,
+            }),
+          ),
+        );
+      return Promise.resolve([]);
+    },
+    (policies) => {
+      const filteredPolicy = policies.filter((p) => p) as [];
+      setSelectedPolicies(filteredPolicy);
+    },
+    [policies],
+  );
+
+  const sortedProviders = sortBy(
+    providers
+      ? providers
+          .filter((p) => p.type !== "resource" && p.type !== "scope")
+          .map((provider) => provider.name)
+      : [],
+  );
+
+  const assign = async (policies: { policy: PolicyRepresentation }[]) => {
+    const assignedPolicies = policies.map(({ policy }) => ({
+      id: policy.id!,
+    }));
+
+    setValue("policies", [
+      ...(getValues("policies") || []),
+      ...assignedPolicies,
+    ]);
+    await trigger("policies");
+    setSelectedPolicies([
+      ...selectedPolicies,
+      ...policies.map(({ policy }) => policy),
+    ]);
+  };
+
+  const unAssign = (policy: PolicyRepresentation) => {
+    const updatedPolicies = selectedPolicies.filter(
+      (selectedPolicy) => selectedPolicy.id !== policy.id,
+    );
+    setSelectedPolicies(updatedPolicies);
+    setValue(
+      "policies",
+      updatedPolicies.map((policy) => ({
+        id: policy.id!,
+        name: policy.name!,
+        type: policy.type!,
+        description: policy.description!,
+      })),
+    );
+  };
+
+  const filteredPolicies = filterType
+    ? selectedPolicies.filter(
+        (policy) => capitalize(policy.type) === filterType,
+      )
+    : selectedPolicies;
+
+  return (
+    <FormGroup
+      label={t("policies")}
+      labelIcon={
+        <HelpItem
+          helpText={t("permissionPoliciesHelp")}
+          fieldLabelId="policies"
+        />
+      }
+      fieldId="policies"
+      isRequired
+    >
+      <Controller
+        name="policies"
+        control={control}
+        defaultValue={[]}
+        rules={{
+          validate: (value?: { id: string }[]) => {
+            if (!value || value.length === 0) return false;
+            return value.every(({ id }) => id && id.trim().length > 0);
+          },
+        }}
+        render={() => (
+          <>
+            {existingPoliciesOpen && (
+              <ExistingPoliciesDialog
+                permissionClientId={permissionClientId}
+                open={existingPoliciesOpen}
+                toggleDialog={() =>
+                  setExistingPoliciesOpen(!existingPoliciesOpen)
+                }
+                onAssign={assign}
+              />
+            )}
+            {newPolicyOpen && (
+              <NewPermissionPolicyDialog
+                toggleDialog={() => setNewPolicyOpen(!newPolicyOpen)}
+                permissionClientId={permissionClientId}
+                providers={providers!}
+                policies={policies!}
+                resourceType={resourceType}
+                onAssign={async (newPolicy) => {
+                  await assign([{ policy: newPolicy }]);
+                }}
+              />
+            )}
+            <Button
+              data-testid="select-assignedPolicy-button"
+              variant="secondary"
+              onClick={() => {
+                setExistingPoliciesOpen(true);
+              }}
+            >
+              {t("assignExistingPolicies")}
+            </Button>
+            <Button
+              data-testid="select-createNewPolicy-button"
+              className="pf-v5-u-ml-md"
+              variant="secondary"
+              onClick={() => {
+                setNewPolicyOpen(true);
+              }}
+            >
+              {t("createNewPolicy")}
+            </Button>
+          </>
+        )}
+      />
+      {selectedPolicies.length > 0 && (
+        <KeycloakDataTable
+          loader={filteredPolicies}
+          ariaLabelKey={t("policies")}
+          searchPlaceholderKey={t("searchClientAuthorizationPolicy")}
+          isSearching={true}
+          searchTypeComponent={
+            <Dropdown
+              onSelect={(event, value) => {
+                setFilterType(value as string | undefined);
+                toggleIsFilterTypeDropdownOpen();
+              }}
+              onOpenChange={toggleIsFilterTypeDropdownOpen}
+              toggle={(ref) => (
+                <MenuToggle
+                  ref={ref}
+                  data-testid="filter-type-dropdown-existingPolicies"
+                  id="toggle-id-10"
+                  onClick={toggleIsFilterTypeDropdownOpen}
+                  icon={<FilterIcon />}
+                  statusIcon={<CaretDownIcon />}
+                >
+                  {filterType ? capitalize(filterType) : t("allTypes")}
+                </MenuToggle>
+              )}
+              isOpen={isFilterTypeDropdownOpen}
+            >
+              <DropdownList>
+                <DropdownItem
+                  data-testid="filter-type-dropdown-existingPolicies-all"
+                  key="all"
+                  onClick={() => setFilterType(undefined)}
+                >
+                  {t("allTypes")}
+                </DropdownItem>
+                {sortedProviders.map((name) => (
+                  <DropdownItem
+                    data-testid={`filter-type-dropdown-existingPolicies-${name}`}
+                    key={name}
+                    onClick={() => setFilterType(name)}
+                  >
+                    {name}
+                  </DropdownItem>
+                ))}
+              </DropdownList>
+            </Dropdown>
+          }
+          actionResolver={(rowData: IRowData) => [
+            {
+              title: t("unAssignPolicy"),
+              onClick: () => unAssign(rowData.data as PolicyRepresentation),
+            } as Action<PolicyRepresentation>,
+          ]}
+          columns={[
+            { name: "name", displayKey: t("name") },
+            {
+              name: "type",
+              displayKey: t("type"),
+              cellFormatters: [(value) => capitalize(String(value || ""))],
+            },
+            { name: "description", displayKey: t("description") },
+          ]}
+          emptyState={
+            <ListEmptyState
+              message={t("emptyAssignExistingPolicies")}
+              instructions={t("emptyAssignExistingPoliciesInstructions")}
+            />
+          }
+        />
+      )}
+      {errors.policies && <FormErrorText message={t("requiredPolicies")} />}
+    </FormGroup>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AuthorizationScopesDetails.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AuthorizationScopesDetails.tsx
new file mode 100644
index 000000000000..74f7971dcf24
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/AuthorizationScopesDetails.tsx
@@ -0,0 +1,71 @@
+import { useTranslation } from "react-i18next";
+import { capitalize } from "lodash-es";
+import {
+  Label,
+  LabelGroup,
+  Popover,
+  Text,
+  TextContent,
+  TextList,
+  TextListItem,
+  TextListItemVariants,
+  TextListVariants,
+} from "@patternfly/react-core";
+
+type AuthorizationScopesDetailsProps = {
+  row: {
+    resourceType: string;
+    associatedScopes?: { name: string }[];
+  };
+};
+
+export const AuthorizationScopesDetails = ({
+  row,
+}: AuthorizationScopesDetailsProps) => {
+  const { t } = useTranslation();
+
+  const associatedScopes = row.associatedScopes || [];
+
+  return (
+    <LabelGroup>
+      {associatedScopes.map((scope, index) => (
+        <Popover
+          key={index}
+          aria-label={`Authorization scope popover for ${scope.name}`}
+          position="top"
+          hasAutoWidth
+          bodyContent={
+            <TextContent>
+              <Text className="pf-v5-u-font-size-md pf-v5-u-font-weight-bold">
+                {t("authorizationScopeDetailsTitle")}
+              </Text>
+              <Text className="pf-v5-u-font-size-sm">
+                {t("authorizationScopeDetailsSubtitle")}
+              </Text>
+              <TextList
+                component={TextListVariants.dl}
+                className="pf-v5-u-font-size-sm"
+              >
+                <TextListItem component={TextListItemVariants.dt}>
+                  {t("authorizationScopeDetailsName")}
+                </TextListItem>
+                <TextListItem component={TextListItemVariants.dd}>
+                  {capitalize(scope.name)}
+                </TextListItem>
+                <TextListItem component={TextListItemVariants.dt}>
+                  {t("authorizationScopeDetailsDescription")}
+                </TextListItem>
+                <TextListItem component={TextListItemVariants.dd}>
+                  {" "}
+                  {t(`authorizationScope.${row.resourceType}.${scope.name}`)}
+                </TextListItem>
+              </TextList>
+            </TextContent>
+          }
+        >
+          <Label color="blue">{capitalize(scope.name)}</Label>
+        </Popover>
+      ))}
+    </LabelGroup>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/ExistingPoliciesDialog.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/ExistingPoliciesDialog.tsx
new file mode 100644
index 000000000000..721956de424b
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/ExistingPoliciesDialog.tsx
@@ -0,0 +1,184 @@
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import { PolicyQuery } from "@keycloak/keycloak-admin-client/lib/resources/clients";
+import {
+  KeycloakDataTable,
+  ListEmptyState,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
+import {
+  Button,
+  ButtonVariant,
+  Dropdown,
+  DropdownItem,
+  DropdownList,
+  MenuToggle,
+  Modal,
+  ModalVariant,
+} from "@patternfly/react-core";
+import { CaretDownIcon, FilterIcon } from "@patternfly/react-icons";
+import { sortBy } from "lodash-es";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../../admin-client";
+import { capitalizeFirstLetterFormatter } from "../../util";
+import useToggle from "../../utils/useToggle";
+
+export type ExistingPoliciesDialogProps = {
+  toggleDialog: () => void;
+  onAssign: (policies: { policy: PolicyRepresentation }[]) => void;
+  open: boolean;
+  permissionClientId: string;
+};
+
+export const ExistingPoliciesDialog = ({
+  toggleDialog,
+  onAssign,
+  open,
+  permissionClientId,
+}: ExistingPoliciesDialogProps) => {
+  const { t } = useTranslation();
+  const { adminClient } = useAdminClient();
+  const [rows, setRows] = useState<PolicyRepresentation[]>([]);
+  const [filterType, setFilterType] = useState<string | undefined>(undefined);
+  const [isFilterTypeDropdownOpen, toggleIsFilterTypeDropdownOpen] =
+    useToggle();
+  const [providers, setProviders] = useState<string[]>([]);
+
+  useFetch(
+    () =>
+      adminClient.clients.listPolicyProviders({
+        id: permissionClientId!,
+      }),
+    (providers) => {
+      const formattedProviders = providers
+        .filter((p) => p.type !== "resource" && p.type !== "scope")
+        .map((provider) => provider.name)
+        .filter((name) => name !== undefined);
+      setProviders(sortBy(formattedProviders));
+    },
+    [permissionClientId],
+  );
+
+  const loader = async (first?: number, max?: number, search?: string) => {
+    const params: PolicyQuery = {
+      id: permissionClientId!,
+      permission: "false",
+      first,
+      max,
+    };
+
+    if (search) {
+      params.name = search;
+    }
+
+    if (filterType) {
+      params.type = filterType;
+    }
+
+    return (await adminClient.clients.listPolicies(params)) || [];
+  };
+
+  return (
+    <Modal
+      variant={ModalVariant.medium}
+      title={t("assignExistingPolicies")}
+      isOpen={open}
+      onClose={toggleDialog}
+      actions={[
+        <>
+          <Button
+            id="modal-assignExistingPolicies"
+            data-testid="confirm"
+            key="assign"
+            variant={ButtonVariant.primary}
+            onClick={() => {
+              const selectedPolicies = rows.map((policy) => ({ policy }));
+              onAssign(selectedPolicies);
+              toggleDialog();
+            }}
+            isDisabled={rows.length === 0}
+          >
+            {t("assign")}
+          </Button>
+          <Button
+            id="modal-cancelExistingPolicies"
+            data-testid="cancel"
+            key="cancel"
+            variant={ButtonVariant.link}
+            onClick={() => {
+              setRows([]);
+              toggleDialog();
+            }}
+          >
+            {t("cancel")}
+          </Button>
+        </>,
+      ]}
+    >
+      <KeycloakDataTable
+        key={filterType}
+        loader={loader}
+        ariaLabelKey={t("chooseAPolicyType")}
+        searchPlaceholderKey={t("searchClientAuthorizationPolicy")}
+        isSearching={true}
+        searchTypeComponent={
+          <Dropdown
+            onSelect={(_, value) => {
+              setFilterType(value as string | undefined);
+              toggleIsFilterTypeDropdownOpen();
+            }}
+            onOpenChange={toggleIsFilterTypeDropdownOpen}
+            toggle={(ref) => (
+              <MenuToggle
+                ref={ref}
+                data-testid="filter-type-dropdown-existingPolicies"
+                id="toggle-id-10"
+                onClick={toggleIsFilterTypeDropdownOpen}
+                icon={<FilterIcon />}
+                statusIcon={<CaretDownIcon />}
+              >
+                {filterType ? filterType : t("allTypes")}
+              </MenuToggle>
+            )}
+            isOpen={isFilterTypeDropdownOpen}
+          >
+            <DropdownList>
+              <DropdownItem
+                data-testid="filter-type-dropdown-existingPolicies-all"
+                key="all"
+                onClick={() => setFilterType(undefined)}
+              >
+                {t("allTypes")}
+              </DropdownItem>
+              {providers.map((name) => (
+                <DropdownItem
+                  data-testid={`filter-type-dropdown-existingPolicies-${name}`}
+                  key={name}
+                  onClick={() => setFilterType(name)}
+                >
+                  {name}
+                </DropdownItem>
+              ))}
+            </DropdownList>
+          </Dropdown>
+        }
+        canSelectAll
+        onSelect={(selectedRows) => setRows(selectedRows)}
+        columns={[
+          { name: "name" },
+          {
+            name: "type",
+            cellFormatters: [capitalizeFirstLetterFormatter()],
+          },
+          { name: "description" },
+        ]}
+        emptyState={
+          <ListEmptyState
+            message={t("emptyAssignExistingPolicies")}
+            instructions={t("emptyAssignExistingPoliciesInstructions")}
+          />
+        }
+      />
+    </Modal>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionConfigurationDialog.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionConfigurationDialog.tsx
new file mode 100644
index 000000000000..b4197fe83b89
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionConfigurationDialog.tsx
@@ -0,0 +1,74 @@
+import { ResourceTypesRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/resourceServerRepresentation";
+import { useTranslation } from "react-i18next";
+import {
+  Modal,
+  ModalVariant,
+  TextContent,
+  Text,
+  TextVariants,
+  Alert,
+} from "@patternfly/react-core";
+import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
+
+type NewPermissionConfigurationDialogProps = {
+  resourceTypes?: ResourceTypesRepresentation[];
+  toggleDialog: () => void;
+  onSelect: (resourceType: ResourceTypesRepresentation) => void;
+};
+
+export const NewPermissionConfigurationDialog = ({
+  resourceTypes,
+  onSelect,
+  toggleDialog,
+}: NewPermissionConfigurationDialogProps) => {
+  const { t } = useTranslation();
+
+  return (
+    <Modal
+      aria-label={t("createPermission")}
+      variant={ModalVariant.medium}
+      header={
+        <TextContent>
+          <Text component={TextVariants.h1}>{t("chooseAResourceType")}</Text>
+          <Alert
+            variant="info"
+            isInline
+            title={t("chooseAResourceTypeInstructions")}
+            component="p"
+          />
+        </TextContent>
+      }
+      isOpen
+      onClose={toggleDialog}
+    >
+      <Table aria-label={t("permissions")} variant="compact">
+        <Thead>
+          <Tr>
+            <Th>{t("resourceType")}</Th>
+            <Th>{t("description")}</Th>
+          </Tr>
+        </Thead>
+        <Tbody>
+          {Object.keys(resourceTypes || {}).map((key: any) => {
+            const resourceType = resourceTypes![key];
+            return (
+              <Tr
+                key={resourceType.type}
+                data-testid={resourceType.type}
+                onRowClick={() => {
+                  onSelect(resourceType);
+                }}
+                isClickable
+              >
+                <Td>{resourceType.type}</Td>
+                <Td style={{ textWrap: "wrap" }}>
+                  {t(`resourceType.${resourceType.type}`)}
+                </Td>
+              </Tr>
+            );
+          })}
+        </Tbody>
+      </Table>
+    </Modal>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionPolicyDialog.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionPolicyDialog.tsx
new file mode 100644
index 000000000000..401415e1fbf3
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/NewPermissionPolicyDialog.tsx
@@ -0,0 +1,234 @@
+import PolicyRepresentation, {
+  DecisionStrategy,
+  Logic,
+} from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import PolicyProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyProviderRepresentation";
+import { useTranslation } from "react-i18next";
+import {
+  Modal,
+  ModalVariant,
+  TextContent,
+  Text,
+  TextVariants,
+  ActionGroup,
+  Button,
+  Form,
+  ButtonVariant,
+  AlertVariant,
+} from "@patternfly/react-core";
+import {
+  SelectControl,
+  TextControl,
+  useAlerts,
+} from "@keycloak/keycloak-ui-shared";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
+import { useAdminClient } from "../../admin-client";
+import { useRealm } from "../../context/realm-context/RealmContext";
+import { Client } from "../../clients/authorization/policy/Client";
+import { User } from "../../clients/authorization/policy/User";
+import {
+  ClientScope,
+  RequiredIdValue,
+} from "../../clients/authorization/policy/ClientScope";
+import { Group, GroupValue } from "../../clients/authorization/policy/Group";
+import { Regex } from "../../clients/authorization/policy/Regex";
+import { Role } from "../../clients/authorization/policy/Role";
+import { Time } from "../../clients/authorization/policy/Time";
+import { JavaScript } from "../../clients/authorization/policy/JavaScript";
+import { LogicSelector } from "../../clients/authorization/policy/LogicSelector";
+import { Aggregate } from "../../clients/authorization/policy/Aggregate";
+import { capitalize } from "lodash-es";
+import { useEffect, type JSX } from "react";
+
+type Policy = Omit<PolicyRepresentation, "roles"> & {
+  groups?: GroupValue[];
+  clientScopes?: RequiredIdValue[];
+  roles?: RequiredIdValue[];
+  clients?: [];
+};
+
+type ComponentsProps = {
+  isPermissionClient?: boolean;
+  permissionClientId: string;
+};
+
+const defaultValues: Policy = {
+  name: "",
+  description: "",
+  type: "group",
+  policies: [],
+  decisionStrategy: DecisionStrategy.UNANIMOUS,
+  logic: Logic.POSITIVE,
+};
+
+const COMPONENTS: {
+  [index: string]: ({
+    isPermissionClient,
+    permissionClientId,
+  }: ComponentsProps) => JSX.Element;
+} = {
+  aggregate: Aggregate,
+  client: Client,
+  user: User,
+  "client-scope": ClientScope,
+  group: Group,
+  regex: Regex,
+  role: Role,
+  time: Time,
+  js: JavaScript,
+  default: Group,
+} as const;
+
+export const isValidComponentType = (value: string) => value in COMPONENTS;
+
+type NewPermissionConfigurationDialogProps = {
+  permissionClientId: string;
+  providers: PolicyProviderRepresentation[];
+  policies: PolicyRepresentation[];
+  resourceType: string;
+  toggleDialog: () => void;
+  onAssign: (newPolicy: PolicyRepresentation) => void;
+};
+
+export const NewPermissionPolicyDialog = ({
+  permissionClientId,
+  providers,
+  policies,
+  toggleDialog,
+  onAssign,
+}: NewPermissionConfigurationDialogProps) => {
+  const { adminClient } = useAdminClient();
+  const { realmRepresentation } = useRealm();
+  const { t } = useTranslation();
+  const form = useForm<Policy>({
+    mode: "onChange",
+    defaultValues,
+  });
+  const { addAlert, addError } = useAlerts();
+  const { handleSubmit, reset } = form;
+  const isPermissionClient = realmRepresentation?.adminPermissionsEnabled;
+
+  const policyTypeSelector = useWatch({
+    control: form.control,
+    name: "type",
+  });
+
+  function getComponentType() {
+    if (policyTypeSelector && isValidComponentType(policyTypeSelector)) {
+      return COMPONENTS[policyTypeSelector];
+    }
+    return COMPONENTS["default"];
+  }
+
+  const ComponentType = getComponentType();
+
+  useEffect(() => {
+    if (policyTypeSelector) {
+      const { name, description, decisionStrategy, logic } = form.getValues();
+
+      reset({
+        type: policyTypeSelector,
+        name,
+        description,
+        decisionStrategy,
+        logic,
+      });
+    }
+  }, [policyTypeSelector, reset, form]);
+
+  const save = async (policy: Policy) => {
+    const { groups, roles, policies, clients, ...rest } = policy;
+
+    const cleanedPolicy = {
+      ...rest,
+      ...(groups && groups.length > 0 && { groups }),
+      ...(roles && roles.length > 0 && { roles }),
+      ...(policies && policies.length > 0 && { policies }),
+      ...(clients && clients.length > 0 && { clients }),
+      ...(rest.type === "group" &&
+        (!groups || groups.length === 0) && { groups: [] }),
+      ...(rest.type === "client" &&
+        (!clients || clients.length === 0) && { clients: [] }),
+    };
+
+    try {
+      const createdPolicy = await adminClient.clients.createPolicy(
+        { id: permissionClientId, type: policyTypeSelector! },
+        cleanedPolicy,
+      );
+
+      onAssign(createdPolicy);
+      toggleDialog();
+      addAlert(t("createPolicySuccess"), AlertVariant.success);
+    } catch (error) {
+      addError("policySaveError", error);
+    }
+  };
+
+  return (
+    <Modal
+      aria-label={t("createPermissionPolicy")}
+      variant={ModalVariant.medium}
+      header={
+        <TextContent>
+          <Text component={TextVariants.h1}>{t("createPermissionPolicy")}</Text>
+        </TextContent>
+      }
+      isOpen
+      onClose={toggleDialog}
+    >
+      <Form
+        id="createPermissionPolicy-form"
+        onSubmit={async (e) => {
+          e.stopPropagation();
+          await handleSubmit(save)(e);
+        }}
+        isHorizontal
+      >
+        <FormProvider {...form}>
+          <TextControl
+            name="name"
+            label={t("name")}
+            rules={{ required: t("required") }}
+          />
+          <TextControl name="description" label={t("description")} />
+          {providers && providers.length > 0 && (
+            <SelectControl
+              name="type"
+              label={t("policyType")}
+              labelIcon={t("policyTypeHelpText")}
+              options={providers.map((provider) => ({
+                key: provider.type!,
+                value: capitalize(provider.type!),
+              }))}
+              controller={{ defaultValue: "" }}
+            />
+          )}
+          <ComponentType
+            isPermissionClient={isPermissionClient}
+            permissionClientId={permissionClientId}
+          />
+          <LogicSelector />
+        </FormProvider>
+        <ActionGroup>
+          <div className="pf-v5-u-mt-md">
+            <Button
+              variant={ButtonVariant.primary}
+              className="pf-v5-u-mr-md"
+              type="submit"
+              data-testid="save"
+              isDisabled={
+                policies?.length === 0 && policyTypeSelector === "aggregate"
+              }
+            >
+              {t("save")}
+            </Button>
+            <Button variant="link" data-testid="cancel" onClick={toggleDialog}>
+              {t("cancel")}
+            </Button>
+          </div>
+        </ActionGroup>
+      </Form>
+    </Modal>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionConfigurationDetails.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionConfigurationDetails.tsx
new file mode 100644
index 000000000000..cc00fb0f927d
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionConfigurationDetails.tsx
@@ -0,0 +1,292 @@
+import PolicyProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyProviderRepresentation";
+import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
+import {
+  ActionGroup,
+  AlertVariant,
+  Button,
+  ButtonVariant,
+  DropdownItem,
+  PageSection,
+} from "@patternfly/react-core";
+import { useMemo, useState } from "react";
+import { FormProvider, useForm } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { Link, useNavigate } from "react-router-dom";
+import { useAdminClient } from "../../admin-client";
+import { useConfirmDialog } from "../../components/confirm-dialog/ConfirmDialog";
+import { FormAccess } from "../../components/form/FormAccess";
+import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
+import { ViewHeader } from "../../components/view-header/ViewHeader";
+import { useParams } from "../../utils/useParams";
+import {
+  PermissionConfigurationDetailsParams,
+  toPermissionConfigurationDetails,
+} from "../routes/PermissionConfigurationDetails";
+import { toPermissionsConfigurationTabs } from "../routes/PermissionsConfigurationTabs";
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import { AssignedPolicies } from "./AssignedPolicies";
+import { ScopePicker } from "../../clients/authorization/ScopePicker";
+import { ResourceType } from "../resource-types/ResourceType";
+import { sortBy } from "lodash-es";
+import { NameDescription } from "../../clients/authorization/policy/NameDescription";
+import useSortedResourceTypes from "../../utils/useSortedResourceTypes";
+
+export default function PermissionConfigurationDetails() {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const { realm, permissionClientId, permissionId, resourceType } =
+    useParams<PermissionConfigurationDetailsParams>();
+  const navigate = useNavigate();
+  const form = useForm();
+  const { handleSubmit, reset } = form;
+  const { addAlert, addError } = useAlerts();
+  const [permission, setPermission] = useState<PolicyRepresentation>();
+  const [providers, setProviders] = useState<PolicyProviderRepresentation[]>();
+  const [policies, setPolicies] = useState<PolicyRepresentation[]>();
+  const resourceTypes = useSortedResourceTypes({
+    clientId: permissionClientId,
+  });
+
+  const resourceTypeScopes = useMemo(
+    () =>
+      resourceTypes
+        .filter(({ type }) => type === resourceType)
+        .flatMap(({ scopes = [] }) => scopes)
+        .map((scope) => scope || ""),
+    [resourceTypes, resourceType],
+  );
+
+  useFetch(
+    async () => {
+      if (!permissionClientId) {
+        return {};
+      }
+
+      const [providers, policies] = await Promise.all([
+        adminClient.clients.listPolicyProviders({ id: permissionClientId }),
+        adminClient.clients.listPolicies({
+          id: permissionClientId,
+          permission: "false",
+        }),
+      ]);
+
+      return { providers, policies };
+    },
+    ({ providers, policies }) => {
+      const filteredProviders = providers?.filter(
+        (p) => p.type !== "resource" && p.type !== "scope",
+      );
+
+      setProviders(
+        sortBy(
+          filteredProviders,
+          (provider: PolicyProviderRepresentation) => provider.type,
+        ),
+      );
+      setPolicies(policies || []);
+    },
+    [permissionClientId],
+  );
+
+  useFetch(
+    async () => {
+      if (!permissionId) {
+        return {};
+      }
+      const [permission, resources, policies, scopes] = await Promise.all([
+        adminClient.clients.findOnePermission({
+          id: permissionClientId,
+          type: "scope",
+          permissionId,
+        }),
+        adminClient.clients.getAssociatedResources({
+          id: permissionClientId,
+          permissionId,
+        }),
+        adminClient.clients.getAssociatedPolicies({
+          id: permissionClientId,
+          permissionId,
+        }),
+        adminClient.clients.getAssociatedScopes({
+          id: permissionClientId,
+          permissionId,
+        }),
+      ]);
+
+      if (!permission) {
+        throw new Error(t("notFound"));
+      }
+
+      return {
+        permission,
+        resources,
+        policies,
+        scopes,
+      };
+    },
+    ({ permission, resources, policies, scopes }) => {
+      const resourceIds = resources?.map((resource) => resource.name!) || [];
+      const policyIds = policies?.map((policy) => policy.id!) || [];
+      const scopeNames = scopes?.map((scope) => scope.name) || [];
+
+      reset({
+        ...permission,
+        resources: resourceIds!,
+        policies,
+        scopes,
+      });
+
+      setPermission({
+        ...permission,
+        resources: resourceIds!,
+        policies: policyIds,
+        scopes: scopeNames,
+      });
+    },
+    [permissionClientId, permissionId],
+  );
+
+  const save = async (permission: PolicyRepresentation) => {
+    try {
+      const newPermission = {
+        ...permission,
+        policies: permission.policies?.map((policy: any) => policy.id),
+        scopes: permission.scopes?.map((scope: any) => scope.name),
+        resourceType: resourceType,
+      };
+
+      if (permissionId) {
+        await adminClient.clients.updatePermission(
+          { id: permissionClientId, type: "scope", permissionId },
+          newPermission,
+        );
+      } else {
+        const result = await adminClient.clients.createPermission(
+          { id: permissionClientId, type: "scope" },
+          newPermission,
+        );
+        setPermission(result);
+        navigate(
+          toPermissionConfigurationDetails({
+            realm,
+            permissionClientId: permissionClientId,
+            permissionId: result.id!,
+            resourceType,
+          }),
+        );
+      }
+
+      addAlert(
+        t(permissionId ? "updatePermissionSuccess" : "createPermissionSuccess"),
+        AlertVariant.success,
+      );
+    } catch (error) {
+      addError("permissionSaveError", error);
+    }
+  };
+
+  const [toggleDeleteDialog, DeleteConfirm] = useConfirmDialog({
+    titleKey: "deletePermission",
+    messageKey: t("deleteAdminPermissionConfirm", {
+      permission: permission?.name,
+    }),
+    continueButtonVariant: ButtonVariant.danger,
+    continueButtonLabel: "confirm",
+    onConfirm: async () => {
+      try {
+        await adminClient.clients.delPermission({
+          id: permissionClientId!,
+          type: "scope",
+          permissionId: permissionId,
+        });
+        addAlert(t("permissionDeletedSuccess"), AlertVariant.success);
+        navigate(
+          toPermissionsConfigurationTabs({
+            realm,
+            permissionClientId,
+            tab: "permissions",
+          }),
+        );
+      } catch (error) {
+        addError("permissionDeletedError", error);
+      }
+    },
+  });
+
+  if (!permission) {
+    return <KeycloakSpinner />;
+  }
+
+  return (
+    <>
+      <DeleteConfirm />
+      <ViewHeader
+        titleKey={permissionId ? permission?.name! : t("createPermission")}
+        subKey={
+          permissionId
+            ? permission?.description!
+            : t("createPermissionOfType", { resourceType })
+        }
+        dropdownItems={
+          permissionId
+            ? [
+                <DropdownItem
+                  key="delete"
+                  data-testid="delete-permission"
+                  onClick={() => toggleDeleteDialog()}
+                >
+                  {t("delete")}
+                </DropdownItem>,
+              ]
+            : undefined
+        }
+      />
+      <PageSection variant="light">
+        <FormAccess isHorizontal onSubmit={handleSubmit(save)} role="anyone">
+          <FormProvider {...form}>
+            <NameDescription clientId={permissionClientId} />
+            <ScopePicker
+              clientId={permissionClientId}
+              resourceTypeScopes={resourceTypeScopes ?? []}
+            />
+            <ResourceType resourceType={resourceType} />
+            <AssignedPolicies
+              permissionClientId={permissionClientId}
+              providers={providers!}
+              policies={policies!}
+              resourceType={resourceType}
+            />
+          </FormProvider>
+          <ActionGroup>
+            <div className="pf-v5-u-mt-md">
+              <Button
+                variant={ButtonVariant.primary}
+                className="pf-v5-u-mr-md"
+                type="submit"
+                data-testid="save"
+              >
+                {t("save")}
+              </Button>
+              <Button
+                variant="link"
+                data-testid="cancel"
+                component={(props) => (
+                  <Link
+                    {...props}
+                    to={toPermissionsConfigurationTabs({
+                      realm,
+                      permissionClientId,
+                      tab: "permissions",
+                    })}
+                  />
+                )}
+              >
+                {t("cancel")}
+              </Button>
+            </div>
+          </ActionGroup>
+        </FormAccess>
+      </PageSection>
+    </>
+  );
+}
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionsConfigurationTab.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionsConfigurationTab.tsx
new file mode 100644
index 000000000000..dea4a8d621ae
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-configuration/PermissionsConfigurationTab.tsx
@@ -0,0 +1,359 @@
+import type PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import ResourceRepresentation from "@keycloak/keycloak-admin-client/lib/defs/resourceRepresentation";
+import ScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/scopeRepresentation";
+import {
+  KeycloakSpinner,
+  ListEmptyState,
+  PaginatingTableToolbar,
+  useAlerts,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
+import {
+  AlertVariant,
+  Button,
+  ButtonVariant,
+  PageSection,
+  ToolbarItem,
+} from "@patternfly/react-core";
+import {
+  ExpandableRowContent,
+  Table,
+  Tbody,
+  Td,
+  Th,
+  Thead,
+  Tr,
+} from "@patternfly/react-table";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Link, useNavigate } from "react-router-dom";
+import { useAdminClient } from "../../admin-client";
+import { useConfirmDialog } from "../../components/confirm-dialog/ConfirmDialog";
+import { useRealm } from "../../context/realm-context/RealmContext";
+import useSortedResourceTypes from "../../utils/useSortedResourceTypes";
+import useToggle from "../../utils/useToggle";
+import { AuthorizationScopesDetails } from "../permission-configuration/AuthorizationScopesDetails";
+import { SearchDropdown, SearchForm } from "../resource-types/SearchDropdown";
+import { toCreatePermissionConfiguration } from "../routes/NewPermissionConfiguration";
+import { toPermissionConfigurationDetails } from "../routes/PermissionConfigurationDetails";
+import { NewPermissionConfigurationDialog } from "./NewPermissionConfigurationDialog";
+
+type PermissionsConfigurationProps = {
+  clientId: string;
+};
+
+type ExpandablePolicyRepresentation = PolicyRepresentation & {
+  policies?: PolicyRepresentation[];
+  resources?: ResourceRepresentation[];
+  scopes?: ScopeRepresentation[];
+  isExpanded: boolean;
+};
+
+export const PermissionsConfigurationTab = ({
+  clientId,
+}: PermissionsConfigurationProps) => {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const { addAlert, addError } = useAlerts();
+  const { realm } = useRealm();
+  const [permissions, setPermissions] =
+    useState<ExpandablePolicyRepresentation[]>();
+  const [selectedPermission, setSelectedPermission] =
+    useState<PolicyRepresentation>();
+  const [search, setSearch] = useState<SearchForm>({});
+  const [key, setKey] = useState(0);
+  const refresh = () => setKey(key + 1);
+  const [max, setMax] = useState(10);
+  const [first, setFirst] = useState(0);
+  const [newDialog, toggleDialog] = useToggle();
+  const resourceTypes = useSortedResourceTypes({ clientId });
+
+  useFetch(
+    async () => {
+      const permissions = await adminClient.clients.listPermissionScope({
+        first,
+        max: max + 1,
+        id: clientId,
+        ...search,
+      });
+
+      const processedPermissions = await Promise.all(
+        (permissions || []).map(async (permission) => {
+          const policies = await adminClient.clients.getAssociatedPolicies({
+            id: clientId,
+            permissionId: permission.id!,
+          });
+
+          const scopes = await adminClient.clients.getAssociatedScopes({
+            id: clientId,
+            permissionId: permission.id!,
+          });
+
+          const resources = await adminClient.clients.getAssociatedResources({
+            id: clientId,
+            permissionId: permission.id!,
+          });
+
+          return {
+            ...permission,
+            policies,
+            scopes,
+            resources,
+            isExpanded: false,
+          };
+        }),
+      );
+
+      return processedPermissions;
+    },
+    (permissions) => {
+      setPermissions(permissions as any[]);
+    },
+    [key, search, first, max],
+  );
+
+  const [toggleDeleteDialog, DeleteConfirm] = useConfirmDialog({
+    titleKey: "deletePermission",
+    messageKey: t("deleteAdminPermissionConfirm", {
+      permission: selectedPermission?.name,
+    }),
+    continueButtonVariant: ButtonVariant.danger,
+    continueButtonLabel: "confirm",
+    onConfirm: async () => {
+      try {
+        await adminClient.clients.delPermission({
+          id: clientId,
+          type: selectedPermission?.type!,
+          permissionId: selectedPermission?.id!,
+        });
+        addAlert(t("permissionDeletedSuccess"), AlertVariant.success);
+        refresh();
+      } catch (error) {
+        addError("permissionDeletedError", error);
+      }
+    },
+  });
+
+  if (!permissions) {
+    return <KeycloakSpinner />;
+  }
+
+  const noData = permissions.length === 0;
+  const searching = Object.keys(search).length !== 0;
+  return (
+    <PageSection variant="light" className="pf-v5-u-p-0">
+      <DeleteConfirm />
+      {(!noData || searching) && (
+        <>
+          {newDialog && (
+            <NewPermissionConfigurationDialog
+              resourceTypes={resourceTypes}
+              onSelect={(resourceType) =>
+                navigate(
+                  toCreatePermissionConfiguration({
+                    realm,
+                    permissionClientId: clientId,
+                    resourceType: resourceType.type!,
+                  }),
+                )
+              }
+              toggleDialog={toggleDialog}
+            />
+          )}
+          <PaginatingTableToolbar
+            count={permissions.length}
+            first={first}
+            max={max}
+            onNextClick={setFirst}
+            onPreviousClick={setFirst}
+            onPerPageSelect={(first, max) => {
+              setFirst(first);
+              setMax(max);
+            }}
+            toolbarItem={
+              <>
+                <ToolbarItem>
+                  <SearchDropdown
+                    types={resourceTypes}
+                    search={search}
+                    onSearch={setSearch}
+                  />
+                </ToolbarItem>
+                <ToolbarItem>
+                  <Button
+                    data-testid="createScopeBasedPermissionBtn"
+                    key="confirm"
+                    variant="primary"
+                    onSelect={(resourceType) =>
+                      navigate(
+                        toCreatePermissionConfiguration({
+                          realm,
+                          permissionClientId: clientId,
+                          resourceType: resourceType.type!,
+                        }),
+                      )
+                    }
+                    onClick={toggleDialog}
+                  >
+                    {t("createPermission")}
+                  </Button>
+                </ToolbarItem>
+              </>
+            }
+          >
+            {!noData && (
+              <Table aria-label={t("permissions")} variant="compact">
+                <Thead>
+                  <Tr>
+                    <Th aria-hidden="true" />
+                    <Th>{t("adminPermissionName")}</Th>
+                    <Th>{t("resourceType")}</Th>
+                    <Th>{t("authorizationScopes")}</Th>
+                    <Th>{t("description")}</Th>
+                    <Th aria-hidden="true" />
+                  </Tr>
+                </Thead>
+                {permissions.map((permission, rowIndex) => (
+                  <Tbody key={permission.id} isExpanded={permission.isExpanded}>
+                    <Tr>
+                      <Td
+                        expand={{
+                          rowIndex,
+                          isExpanded: permission.isExpanded,
+                          onToggle: (_, rowIndex) => {
+                            const rows = permissions.map((p, index) =>
+                              index === rowIndex
+                                ? { ...p, isExpanded: !p.isExpanded }
+                                : p,
+                            );
+                            setPermissions(rows);
+                          },
+                        }}
+                      />
+                      <Td data-testid={`name-column-${permission.name}`}>
+                        <Link
+                          to={toPermissionConfigurationDetails({
+                            realm,
+                            permissionClientId: clientId,
+                            permissionId: permission.id!,
+                            resourceType: permission.resourceType!,
+                          })}
+                        >
+                          {permission.name}
+                        </Link>
+                      </Td>
+                      <Td>{permission.resourceType}</Td>
+                      <Td>
+                        <AuthorizationScopesDetails
+                          row={{
+                            resourceType: permission.resourceType || "",
+                            associatedScopes: permission.scopes?.map(
+                              (scope: ScopeRepresentation) => ({
+                                name: scope.name || "",
+                              }),
+                            ),
+                          }}
+                        />
+                      </Td>
+                      <Td>{permission.description || "—"}</Td>
+                      <Td
+                        actions={{
+                          items: [
+                            {
+                              title: t("delete"),
+                              onClick: async () => {
+                                setSelectedPermission(permission);
+                                toggleDeleteDialog();
+                              },
+                            },
+                          ],
+                        }}
+                      ></Td>
+                    </Tr>
+                    <Tr
+                      key={`child-${permission.id}`}
+                      isExpanded={permission.isExpanded}
+                    >
+                      <Td />
+                      <Td colSpan={5}>
+                        <ExpandableRowContent>
+                          {permission.isExpanded && (
+                            <>
+                              <Th>{t("resources")}</Th>
+                              {permission.resources &&
+                              permission.resources?.length > 0 ? (
+                                permission.resources!.map(
+                                  (resource: ResourceRepresentation, index) => (
+                                    <Td key={index}>
+                                      <span style={{ marginLeft: "8px" }}>
+                                        {resource.displayName || resource.name}
+                                      </span>
+                                    </Td>
+                                  ),
+                                )
+                              ) : (
+                                <Td>
+                                  <span style={{ marginLeft: "8px" }}>
+                                    {t("allResources")}
+                                  </span>
+                                </Td>
+                              )}
+                              <br />
+                              <Th>{t("assignedPolicies")}</Th>
+                              {permission.policies!.map(
+                                (policy: PolicyRepresentation, index) => (
+                                  <Td key={index}>
+                                    <span style={{ marginLeft: "8px" }}>
+                                      {policy.name}
+                                    </span>
+                                  </Td>
+                                ),
+                              )}
+                            </>
+                          )}
+                        </ExpandableRowContent>
+                      </Td>
+                    </Tr>
+                  </Tbody>
+                ))}
+              </Table>
+            )}
+          </PaginatingTableToolbar>
+        </>
+      )}
+      {noData && !searching && (
+        <>
+          {newDialog && (
+            <NewPermissionConfigurationDialog
+              resourceTypes={resourceTypes}
+              onSelect={(resourceType) =>
+                navigate(
+                  toCreatePermissionConfiguration({
+                    realm,
+                    permissionClientId: clientId,
+                    resourceType: resourceType.type!,
+                  }),
+                )
+              }
+              toggleDialog={toggleDialog}
+            />
+          )}
+          <ListEmptyState
+            message={t("emptyPermissions")}
+            instructions={t("emptyPermissionsInstructions")}
+            primaryActionText={t("createPermission")}
+            onPrimaryAction={toggleDialog}
+          />
+        </>
+      )}
+      {noData && searching && (
+        <ListEmptyState
+          isSearchVariant
+          message={t("noSearchResults")}
+          instructions={t("noPermissionSearchResultsInstructions")}
+        />
+      )}
+    </PageSection>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionEvaluationResult.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionEvaluationResult.tsx
new file mode 100644
index 000000000000..9ce14f13b81f
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionEvaluationResult.tsx
@@ -0,0 +1,94 @@
+import PolicyEvaluationResponse from "@keycloak/keycloak-admin-client/lib/defs/policyEvaluationResponse";
+import { useMemo } from "react";
+import { Alert, List, ListItem, Text } from "@patternfly/react-core";
+import { useTranslation } from "react-i18next";
+import { sortBy } from "lodash-es";
+
+type PermissionEvaluationResultProps = {
+  evaluateResult: PolicyEvaluationResponse;
+};
+
+export const PermissionEvaluationResult = ({
+  evaluateResult,
+}: PermissionEvaluationResultProps) => {
+  const { t } = useTranslation();
+  const evaluatedResults = evaluateResult?.results || [];
+  const evaluatedResult = evaluatedResults[0] || {};
+  const alertTitle =
+    evaluatedResult?.resource?.name ?? t("permissionEvaluationAlertTitle");
+  const alertVariant =
+    evaluateResult?.status === "PERMIT" ? "success" : "warning";
+
+  const evaluatedAllowedScopes = useMemo(
+    () => sortBy(evaluatedResult?.allowedScopes || [], "name"),
+    [evaluatedResult],
+  );
+  const evaluatedDeniedScopes = useMemo(
+    () => sortBy(evaluatedResult?.deniedScopes || [], "name"),
+    [evaluatedResult],
+  );
+  const evaluatedPolicies = useMemo(
+    () => sortBy(evaluatedResult?.policies || [], "name"),
+    [evaluatedResult],
+  );
+
+  const evaluatedPermission = function (title: string, status: string) {
+    const permissions = evaluatedPolicies.filter((p) => p.status === status);
+
+    if (permissions.length == 0) {
+      return;
+    }
+
+    return (
+      <>
+        <Text className="pf-v5-u-pt-sm">
+          <strong>{t(title)}</strong>:
+        </Text>
+        <List className="pf-v5-u-mt-sm">
+          {permissions.map((p) => (
+            <ListItem key={p.policy?.id}>
+              {t("evaluatedPolicy", {
+                name: p.policy?.name,
+                status: p.status,
+              })}
+            </ListItem>
+          ))}
+        </List>
+      </>
+    );
+  };
+
+  return (
+    <Alert isInline variant={alertVariant} title={alertTitle} component="h6">
+      {evaluatedAllowedScopes.length > 0 && (
+        <>
+          <Text>
+            <b>{t("grantedScope")}</b>
+          </Text>
+          <List className="pf-v5-u-mt-sm">
+            {evaluatedAllowedScopes.map((scope) => (
+              <ListItem key={scope.id}>{scope.name}</ListItem>
+            ))}
+          </List>
+        </>
+      )}
+
+      {evaluatedDeniedScopes.length > 0 && (
+        <>
+          <Text className="pf-v5-u-pt-sm">
+            <strong>{t("deniedScope")}</strong>
+          </Text>
+
+          <List className="pf-v5-u-mt-sm">
+            {evaluatedDeniedScopes.map((scope) => (
+              <ListItem key={scope.id}>{scope.name}</ListItem>
+            ))}
+          </List>
+        </>
+      )}
+
+      {evaluatedPermission("grantedPermissions", "PERMIT")}
+      {evaluatedPermission("deniedPermissions", "DENY")}
+    </Alert>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionsEvaluationTab.tsx b/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionsEvaluationTab.tsx
new file mode 100644
index 000000000000..408d016bd0b8
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/permission-evaluation/PermissionsEvaluationTab.tsx
@@ -0,0 +1,266 @@
+import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import type EvaluationResultRepresentation from "@keycloak/keycloak-admin-client/lib/defs/evaluationResultRepresentation";
+import PolicyEvaluationResponse from "@keycloak/keycloak-admin-client/lib/defs/policyEvaluationResponse";
+import type ResourceEvaluation from "@keycloak/keycloak-admin-client/lib/defs/resourceEvaluation";
+import {
+  ListEmptyState,
+  SelectControl,
+  useAlerts,
+} from "@keycloak/keycloak-ui-shared";
+import {
+  ActionGroup,
+  Alert,
+  AlertActionCloseButton,
+  Button,
+  PageSection,
+  Panel,
+  PanelHeader,
+  PanelMainBody,
+  Split,
+  SplitItem,
+  Title,
+} from "@patternfly/react-core";
+import { BellIcon } from "@patternfly/react-icons";
+import { useMemo, useState } from "react";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../../admin-client";
+import { FormAccess } from "../../components/form/FormAccess";
+import { UserSelect } from "../../components/users/UserSelect";
+import { useAccess } from "../../context/access/Access";
+import { useRealm } from "../../context/realm-context/RealmContext";
+import { ForbiddenSection } from "../../ForbiddenSection";
+import useSortedResourceTypes from "../../utils/useSortedResourceTypes";
+import { PermissionEvaluationResult } from "./PermissionEvaluationResult";
+import { COMPONENTS } from "../resource-types/ResourceType";
+
+interface EvaluateFormInputs
+  extends Omit<ResourceEvaluation, "context" | "resources"> {
+  authScopes: string[];
+  user: string[];
+  clients: string[];
+  groups: string[];
+  users: string[];
+  roles: string[];
+  resourceType?: string;
+}
+
+type Props = {
+  client: ClientRepresentation;
+  save: () => void;
+} & EvaluationResultRepresentation;
+
+export const PermissionsEvaluationTab = (props: Props) => {
+  const { hasAccess } = useAccess();
+
+  if (!hasAccess("view-users")) {
+    return <ForbiddenSection permissionNeeded="view-users" />;
+  }
+
+  return <PermissionEvaluateContent {...props} />;
+};
+
+const PermissionEvaluateContent = ({ client }: Props) => {
+  const { t } = useTranslation();
+  const { adminClient } = useAdminClient();
+  const realm = useRealm();
+  const { addError } = useAlerts();
+  const form = useForm<EvaluateFormInputs>({
+    mode: "onChange",
+    defaultValues: {
+      user: [],
+      resourceType: "",
+      authScopes: [],
+    },
+  });
+  const { control, getValues, reset, trigger } = form;
+  const [evaluateResult, setEvaluateResult] =
+    useState<PolicyEvaluationResponse>();
+  const [isAlertOpened, setIsAlertOpened] = useState(true);
+  const [isEvaluated, setIsEvaluated] = useState(false);
+  const resourceTypes = useSortedResourceTypes({ clientId: client.id! });
+
+  const selectedResourceType = useWatch({
+    control: control,
+    name: "resourceType",
+    defaultValue: "",
+  });
+
+  const authScopes = useMemo(() => {
+    const resource = resourceTypes.find((r) => r.type === selectedResourceType);
+    return resource?.scopes || [];
+  }, [selectedResourceType, resourceTypes]);
+
+  const ResourceTypeComponent =
+    COMPONENTS[selectedResourceType?.toLowerCase() || ""];
+
+  const evaluate = async () => {
+    if (!(await trigger())) {
+      return;
+    }
+
+    const formValues = getValues();
+    const getSingleValue = (source: string | string[]) => {
+      return Array.isArray(source) ? source?.[0] : source;
+    };
+
+    const getResourceName = (resourceType: string) => {
+      switch (resourceType) {
+        case "Groups":
+          return getSingleValue(formValues.groups);
+        case "Users":
+          return getSingleValue(formValues.users);
+        case "Clients":
+          return getSingleValue(formValues.clients);
+        case "Roles":
+          return getSingleValue(formValues.roles);
+        default:
+          return undefined;
+      }
+    };
+
+    const resourceName = getResourceName(formValues.resourceType!);
+
+    const resEval: ResourceEvaluation = {
+      roleIds: formValues.roleIds ?? [],
+      userId: formValues.user![0],
+      resourceType: formValues.resourceType,
+      resources: [
+        {
+          name: resourceName,
+          scopes: formValues.authScopes!.map((scope) => ({ name: scope })),
+        },
+      ],
+      entitlements: false,
+      context: {
+        attributes: {},
+      },
+    };
+
+    try {
+      const evaluation = await adminClient.clients.evaluateResource(
+        { id: client.id!, realm: realm.realm },
+        resEval,
+      );
+
+      setEvaluateResult(evaluation);
+      setIsEvaluated(true);
+    } catch (error) {
+      addError("evaluateError", error);
+    }
+  };
+
+  return (
+    <PageSection>
+      <Split hasGutter>
+        <SplitItem>
+          <FormProvider {...form}>
+            <Panel>
+              <PanelMainBody style={{ width: "50rem" }}>
+                <FormAccess isHorizontal role="view-clients">
+                  {isAlertOpened && (
+                    <Alert
+                      variant="info"
+                      isInline
+                      title={t("permissionsEvaluationInstructions")}
+                      component="p"
+                      actionClose={
+                        <AlertActionCloseButton
+                          onClose={() => setIsAlertOpened(false)}
+                        />
+                      }
+                    />
+                  )}
+                  <UserSelect
+                    name="user"
+                    label={t("user")}
+                    helpText={t("selectUser")}
+                    defaultValue={[]}
+                    variant="typeahead"
+                    isRequired
+                  />
+                  <SelectControl
+                    name="resourceType"
+                    label={t("resourceType")}
+                    labelIcon={t("resourceTypeSelectHelp")}
+                    variant="single"
+                    controller={{
+                      defaultValue: resourceTypes.length
+                        ? resourceTypes[0]?.type
+                        : "",
+                      rules: { required: true },
+                    }}
+                    options={resourceTypes.map((resource) => resource.type!)}
+                  />
+                  {ResourceTypeComponent && (
+                    <ResourceTypeComponent
+                      name={selectedResourceType?.toLowerCase()}
+                      label={t(`${selectedResourceType}`)}
+                      helpText={t(`select${selectedResourceType}`)}
+                      defaultValue={[]}
+                      variant="typeahead"
+                      isRequired
+                      isRadio
+                    />
+                  )}
+                  <SelectControl
+                    name="authScopes"
+                    label={t("authScope")}
+                    labelIcon={t("authScopeSelectHelp")}
+                    controller={{ defaultValue: [] }}
+                    variant="single"
+                    options={authScopes}
+                  />
+                </FormAccess>
+              </PanelMainBody>
+            </Panel>
+            <ActionGroup>
+              <Button
+                data-testid="permission-eval"
+                id="permission-eval"
+                className="pf-v5-u-mr-md"
+                isDisabled={!form.formState.isValid}
+                onClick={() => evaluate()}
+              >
+                {t("evaluate")}
+              </Button>
+              <Button
+                data-testid="permission-eval-revert"
+                id="permission-eval-revert"
+                className="pf-v5-u-mr-md"
+                variant="link"
+                onClick={() => {
+                  reset();
+                  setEvaluateResult({});
+                  setIsEvaluated(false);
+                }}
+              >
+                {t("revert")}
+              </Button>
+            </ActionGroup>
+          </FormProvider>
+        </SplitItem>
+        <SplitItem>
+          <Panel>
+            <PanelHeader>
+              <Title headingLevel="h1" size="md">
+                {t("permissionEvaluationPreview")}
+              </Title>
+            </PanelHeader>
+            <PanelMainBody>
+              {!isEvaluated ? (
+                <ListEmptyState
+                  icon={BellIcon}
+                  message={t("noPermissionsEvaluationResults")}
+                  instructions={t("noPermissionsEvaluationResultsInstructions")}
+                />
+              ) : (
+                <PermissionEvaluationResult evaluateResult={evaluateResult!} />
+              )}
+            </PanelMainBody>
+          </Panel>
+        </SplitItem>
+      </Split>
+    </PageSection>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/resource-types/ClientSelectComponent.tsx b/js/apps/admin-ui/src/permissions-configuration/resource-types/ClientSelectComponent.tsx
new file mode 100644
index 000000000000..b8249b5ea376
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/resource-types/ClientSelectComponent.tsx
@@ -0,0 +1,6 @@
+import { ClientSelect } from "../../components/client/ClientSelect";
+import { ComponentProps } from "../../components/dynamic/components";
+
+export const ClientSelectComponent = (props: ComponentProps) => (
+  <ClientSelect {...props} clientKey="id" />
+);
diff --git a/js/apps/admin-ui/src/permissions-configuration/resource-types/GroupSelect.tsx b/js/apps/admin-ui/src/permissions-configuration/resource-types/GroupSelect.tsx
new file mode 100644
index 000000000000..0b8a15f9eccc
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/resource-types/GroupSelect.tsx
@@ -0,0 +1,156 @@
+import GroupRepresentation from "@keycloak/keycloak-admin-client/lib/defs/groupRepresentation";
+import {
+  FormErrorText,
+  HelpItem,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
+import { Button, FormGroup } from "@patternfly/react-core";
+import { MinusCircleIcon } from "@patternfly/react-icons";
+import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
+import { useState } from "react";
+import { Controller, useFormContext } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../../admin-client";
+import type { ComponentProps } from "../../components/dynamic/components";
+import { GroupPickerDialog } from "../../components/group/GroupPickerDialog";
+
+type GroupSelectProps = Omit<ComponentProps, "convertToName"> & {
+  variant?: "typeahead" | "typeaheadMulti";
+  isRequired?: boolean;
+};
+
+const convertGroups = (groups: GroupRepresentation[]): string[] =>
+  groups.map(({ id }) => id!);
+
+export const GroupSelect = ({
+  name,
+  label,
+  helpText,
+  defaultValue,
+  isDisabled = false,
+  isRequired,
+  variant = "typeaheadMulti",
+}: GroupSelectProps) => {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const {
+    control,
+    setValue,
+    getValues,
+    formState: { errors },
+  } = useFormContext();
+  const values: string[] = getValues(name!);
+  const [open, setOpen] = useState(false);
+  const [groups, setGroups] = useState<GroupRepresentation[]>([]);
+
+  useFetch(
+    () => {
+      if (values && values.length > 0) {
+        return Promise.all(
+          (values as string[]).map((id) => adminClient.groups.findOne({ id })),
+        );
+      }
+      return Promise.resolve([]);
+    },
+    (groups) => {
+      setGroups(groups.flat().filter((g) => g) as GroupRepresentation[]);
+    },
+    [],
+  );
+
+  const selectOne = variant === "typeahead";
+
+  return (
+    <FormGroup
+      label={t(label!)}
+      labelIcon={<HelpItem helpText={t(helpText!)} fieldLabelId="groups" />}
+      fieldId="groups"
+      isRequired={isRequired}
+    >
+      <Controller
+        name={name!}
+        control={control}
+        defaultValue={defaultValue}
+        rules={{
+          validate: (value?: string[]) =>
+            !isRequired || (value && value.length > 0),
+        }}
+        render={({ field }) => (
+          <>
+            {open && (
+              <GroupPickerDialog
+                type={selectOne ? "selectOne" : "selectMany"}
+                text={{
+                  title: "addGroupsToGroupPolicy",
+                  ok: "add",
+                }}
+                onConfirm={(selectGroup) => {
+                  if (selectOne) {
+                    field.onChange(convertGroups(selectGroup || []));
+                    setGroups(selectGroup || []);
+                  } else {
+                    field.onChange([
+                      ...(field.value || []),
+                      ...convertGroups(selectGroup || []),
+                    ]);
+                    setGroups([...groups, ...(selectGroup || [])]);
+                  }
+                  setOpen(false);
+                }}
+                onClose={() => {
+                  setOpen(false);
+                }}
+                filterGroups={groups}
+              />
+            )}
+            <Button
+              data-testid="select-group-button"
+              isDisabled={isDisabled}
+              variant="secondary"
+              onClick={() => {
+                setOpen(true);
+              }}
+            >
+              {t("addGroups")}
+            </Button>
+          </>
+        )}
+      />
+      {groups.length > 0 && (
+        <Table variant="compact">
+          <Thead>
+            <Tr>
+              <Th>{t("groups")}</Th>
+              <Th aria-hidden="true" />
+            </Tr>
+          </Thead>
+          <Tbody>
+            {groups.map((group) => (
+              <Tr key={group.id}>
+                <Td>{group.path}</Td>
+                <Td>
+                  <Button
+                    variant="link"
+                    className="keycloak__client-authorization__policy-row-remove"
+                    icon={<MinusCircleIcon />}
+                    onClick={() => {
+                      setValue(name!, [
+                        ...convertGroups(
+                          (groups || []).filter(({ id }) => id !== group.id),
+                        ),
+                      ]);
+                      setGroups([
+                        ...groups.filter(({ id }) => id !== group.id),
+                      ]);
+                    }}
+                  />
+                </Td>
+              </Tr>
+            ))}
+          </Tbody>
+        </Table>
+      )}
+      {errors[name!] && <FormErrorText message={t("requiredGroups")} />}
+    </FormGroup>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/resource-types/ResourceType.tsx b/js/apps/admin-ui/src/permissions-configuration/resource-types/ResourceType.tsx
new file mode 100644
index 000000000000..4d88d11cb537
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/resource-types/ResourceType.tsx
@@ -0,0 +1,105 @@
+import { useTranslation } from "react-i18next";
+import { FormGroup, Radio } from "@patternfly/react-core";
+import { HelpItem } from "@keycloak/keycloak-ui-shared";
+import { useFormContext } from "react-hook-form";
+import { useState, type JSX } from "react";
+import { GroupSelect } from "./GroupSelect";
+import { UserSelect } from "../../components/users/UserSelect";
+import { RoleSelect } from "./RoleSelect";
+import { ClientSelectComponent } from "./ClientSelectComponent";
+
+type ResourceTypeProps = {
+  withEnforceAccessTo?: boolean;
+  resourceType: string;
+};
+
+export const COMPONENTS: {
+  [index: string]: (props: any) => JSX.Element;
+} = {
+  users: UserSelect,
+  clients: ClientSelectComponent,
+  groups: GroupSelect,
+  roles: RoleSelect,
+} as const;
+
+export const isValidComponentType = (value: string) => value in COMPONENTS;
+
+export const ResourceType = ({
+  resourceType,
+  withEnforceAccessTo = true,
+}: ResourceTypeProps) => {
+  const { t } = useTranslation();
+  const form = useFormContext();
+  const resourceIds: string[] = form.getValues("resources");
+  const normalizedResourceType = resourceType.toLowerCase();
+
+  const [isSpecificResources, setIsSpecificResources] = useState(
+    resourceIds?.some((id) => id !== resourceType) || !withEnforceAccessTo,
+  );
+
+  function getComponentType() {
+    if (isValidComponentType(normalizedResourceType)) {
+      return COMPONENTS[normalizedResourceType];
+    }
+    return null;
+  }
+
+  const ComponentType = getComponentType();
+
+  return (
+    <>
+      {withEnforceAccessTo && (
+        <FormGroup
+          label={t("enforceAccessTo")}
+          labelIcon={
+            <HelpItem
+              helpText={t("enforceAccessToHelpText")}
+              fieldLabelId="enforce-access-to"
+            />
+          }
+          fieldId="EnforceAccessTo"
+          hasNoPaddingTop
+          isRequired
+        >
+          <Radio
+            id="allResources"
+            data-testid="allResources"
+            isChecked={!isSpecificResources}
+            name="EnforceAccessTo"
+            label={t(`allResourceType`, { resourceType })}
+            onChange={() => {
+              setIsSpecificResources(false);
+              form.setValue("resources", []);
+            }}
+            className="pf-v5-u-mb-md"
+          />
+          <Radio
+            id="specificResources"
+            data-testid="specificResources"
+            isChecked={isSpecificResources}
+            name="EnforceAccessTo"
+            label={t(`specificResourceType`, { resourceType })}
+            onChange={() => {
+              setIsSpecificResources(true);
+              form.setValue("resources", []);
+            }}
+            className="pf-v5-u-mb-md"
+          />
+        </FormGroup>
+      )}
+      {isSpecificResources && ComponentType && (
+        <ComponentType
+          name={withEnforceAccessTo ? "resources" : "resource"}
+          label={`${normalizedResourceType}Resources`}
+          helpText={t("resourceTypeHelpText", {
+            resourceType: normalizedResourceType,
+          })}
+          defaultValue={[]}
+          variant={withEnforceAccessTo ? "typeaheadMulti" : "typeahead"}
+          isRequired={withEnforceAccessTo}
+          isRadio={!withEnforceAccessTo}
+        />
+      )}
+    </>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/resource-types/RoleSelect.tsx b/js/apps/admin-ui/src/permissions-configuration/resource-types/RoleSelect.tsx
new file mode 100644
index 000000000000..656ceb7f24b3
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/resource-types/RoleSelect.tsx
@@ -0,0 +1,140 @@
+import {
+  FormErrorText,
+  HelpItem,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
+import { Button, FormGroup } from "@patternfly/react-core";
+import { MinusCircleIcon } from "@patternfly/react-icons";
+import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
+import { useState } from "react";
+import { useFormContext } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import { useAdminClient } from "../../admin-client";
+import {
+  AddRoleButton,
+  AddRoleMappingModal,
+  FilterType,
+} from "../../components/role-mapping/AddRoleMappingModal";
+import { Row, ServiceRole } from "../../components/role-mapping/RoleMapping";
+
+type RoleSelectorProps = {
+  name: string;
+  isRadio?: boolean;
+};
+
+export const RoleSelect = ({ name, isRadio = false }: RoleSelectorProps) => {
+  const { adminClient } = useAdminClient();
+  const { t } = useTranslation();
+  const {
+    getValues,
+    setValue,
+    formState: { errors },
+  } = useFormContext<{ [key: string]: string[] }>();
+  const values = getValues(name) || [];
+  const [isModalOpen, setIsModalOpen] = useState(false);
+  const [selectedRoles, setSelectedRoles] = useState<Row[]>([]);
+  const [filterType, setFilterType] = useState<FilterType>("clients");
+
+  useFetch(
+    async () => {
+      if (values.length > 0) {
+        const roles = await Promise.all(
+          values.map((id) => adminClient.roles.findOneById({ id })),
+        );
+        return Promise.all(
+          roles.map(async (role) => ({
+            role: role!,
+            client: role!.clientRole
+              ? await adminClient.clients.findOne({ id: role?.containerId! })
+              : undefined,
+          })),
+        );
+      }
+      return [];
+    },
+    setSelectedRoles,
+    [],
+  );
+
+  return (
+    <FormGroup
+      label={isRadio ? t("role") : t("roles")}
+      labelIcon={
+        <HelpItem
+          helpText={isRadio ? t("selectRole") : t("policyRolesHelp")}
+          fieldLabelId="roles"
+        />
+      }
+      fieldId={name}
+      isRequired
+    >
+      {isModalOpen && (
+        <AddRoleMappingModal
+          id="role"
+          type="roles"
+          title={t("selectRole")}
+          actionLabel={t("select")}
+          isRadio={isRadio}
+          onAssign={(rows) => {
+            setValue(name, [
+              ...(!isRadio ? values : []),
+              ...rows
+                .filter((row) => row.role.id !== undefined)
+                .map((row) => row.role.id!),
+            ]);
+
+            setSelectedRoles(isRadio ? rows : [...selectedRoles, ...rows]);
+            setIsModalOpen(false);
+          }}
+          onClose={() => setIsModalOpen(false)}
+          filterType={filterType}
+        />
+      )}
+      <AddRoleButton
+        label={isRadio ? t("selectRole") : t("addRoles")}
+        data-testid="select-role-button"
+        variant="secondary"
+        onFilerTypeChange={(type) => {
+          setFilterType(type);
+          setIsModalOpen(true);
+        }}
+      />
+      {selectedRoles.length > 0 && (
+        <Table variant="compact">
+          <Thead>
+            <Tr>
+              <Th>{t("roles")}</Th>
+              <Th aria-hidden="true" />
+            </Tr>
+          </Thead>
+          <Tbody>
+            {selectedRoles.map((row) => (
+              <Tr key={row.role.id}>
+                <Td>
+                  <ServiceRole role={row.role} client={row.client} />
+                </Td>
+                <Td>
+                  <Button
+                    variant="link"
+                    className="keycloak__client-authorization__policy-row-remove"
+                    icon={<MinusCircleIcon />}
+                    onClick={() => {
+                      setValue(
+                        name,
+                        values.filter((id) => id !== row.role.id),
+                      );
+                      setSelectedRoles(
+                        selectedRoles.filter((s) => s.role.id !== row.role.id),
+                      );
+                    }}
+                  />
+                </Td>
+              </Tr>
+            ))}
+          </Tbody>
+        </Table>
+      )}
+      {errors[name] && <FormErrorText message={t("requiredRoles")} />}
+    </FormGroup>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/resource-types/SearchDropdown.tsx b/js/apps/admin-ui/src/permissions-configuration/resource-types/SearchDropdown.tsx
new file mode 100644
index 000000000000..dcbad0ebef46
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/resource-types/SearchDropdown.tsx
@@ -0,0 +1,166 @@
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import UserRepresentation from "@keycloak/keycloak-admin-client/lib/defs/userRepresentation";
+import { SelectControl, TextControl } from "@keycloak/keycloak-ui-shared";
+import {
+  ActionGroup,
+  Button,
+  Dropdown,
+  Form,
+  MenuToggle,
+} from "@patternfly/react-core";
+import { useEffect, useRef, useState } from "react";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+import useToggle from "../../utils/useToggle";
+import { ResourceType } from "./ResourceType";
+
+export type SearchForm = {
+  name?: string;
+  resources?: string;
+  scope?: string;
+  type?: string;
+  uri?: string;
+  owner?: string;
+  resourceType?: string;
+};
+
+type SearchDropdownProps = {
+  resources?: UserRepresentation[];
+  types: PolicyRepresentation[];
+  search: SearchForm;
+  onSearch: (form: SearchForm) => void;
+  resourceType?: string;
+};
+
+export const SearchDropdown = ({
+  types,
+  search,
+  onSearch,
+}: SearchDropdownProps) => {
+  const { t } = useTranslation();
+  const form = useForm<SearchForm>({
+    mode: "onChange",
+    defaultValues: search,
+  });
+
+  const {
+    reset,
+    formState: { isDirty },
+    handleSubmit,
+  } = form;
+
+  const [open, toggle] = useToggle();
+  const [resourceScopes, setResourceScopes] = useState<string[]>([]);
+  const selectedType = useWatch({
+    control: form.control,
+    name: "resourceType",
+    defaultValue: "",
+  });
+  const [key, setKey] = useState(0);
+  const ref = useRef("clients");
+
+  const submit = (form: SearchForm) => {
+    toggle();
+    onSearch(form);
+  };
+
+  useEffect(() => {
+    const type = types?.find((item) => item.type === selectedType);
+    setResourceScopes(type?.scopes || []);
+  }, [selectedType, types]);
+
+  useEffect(() => {
+    reset(search);
+    setKey((prevKey) => prevKey + 1);
+  }, [search]);
+
+  return (
+    <Dropdown
+      toggle={(ref) => (
+        <MenuToggle
+          data-testid="searchdropdown_dorpdown"
+          ref={ref}
+          onClick={toggle}
+          className="keycloak__client_authentication__searchdropdown"
+        >
+          {t("searchClientAuthorizationPermission")}
+        </MenuToggle>
+      )}
+      isOpen={open}
+    >
+      <FormProvider {...form}>
+        <Form
+          key={key}
+          isHorizontal
+          className="keycloak__client_authentication__searchdropdown_form"
+          onSubmit={handleSubmit(submit)}
+        >
+          <TextControl name="name" label={t("name")} />
+          <SelectControl
+            name="resourceType"
+            label={t("type")}
+            controller={{
+              defaultValue: "",
+            }}
+            options={[
+              { key: "", value: t("choose") },
+              ...types.map(({ type, name }) => ({
+                key: type!,
+                value: name! || type!,
+              })),
+            ]}
+            onSelect={(value, onChange) => {
+              if (ref.current !== value) {
+                ref.current = value as string;
+                form.setValue("resources", undefined);
+              }
+              onChange(value);
+            }}
+          />
+          {selectedType !== "" && (
+            <>
+              <ResourceType
+                resourceType={selectedType || "clients"}
+                withEnforceAccessTo={false}
+              />
+              <SelectControl
+                name={"scope"}
+                label={t("authorizationScope")}
+                controller={{
+                  defaultValue: "",
+                }}
+                options={[
+                  ...(resourceScopes || []).map((resourceScope) => ({
+                    key: resourceScope!,
+                    value: resourceScope!,
+                  })),
+                ]}
+              />
+            </>
+          )}
+
+          <ActionGroup>
+            <Button
+              variant="primary"
+              type="submit"
+              data-testid="search-btn"
+              isDisabled={!isDirty}
+            >
+              {t("search")}
+            </Button>
+            <Button
+              variant="link"
+              data-testid="revert-btn"
+              onClick={() => {
+                reset({});
+                onSearch({});
+              }}
+            >
+              {t("clear")}
+            </Button>
+          </ActionGroup>
+        </Form>
+      </FormProvider>
+    </Dropdown>
+  );
+};
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes.ts b/js/apps/admin-ui/src/permissions-configuration/routes.ts
new file mode 100644
index 000000000000..237604d06ebc
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes.ts
@@ -0,0 +1,20 @@
+import type { AppRouteObject } from "../routes";
+import { NewPermissionConfigurationRoute } from "./routes/NewPermissionConfiguration";
+import { NewPermissionPolicyRoute } from "./routes/NewPermissionPolicy";
+import { PermissionConfigurationDetailRoute } from "./routes/PermissionConfigurationDetails";
+import { PermissionPolicyDetailsRoute } from "./routes/PermissionPolicyDetails";
+import { PermissionsConfigurationRoute } from "./routes/PermissionsConfiguration";
+import { PermissionsConfigurationTabsRoute } from "./routes/PermissionsConfigurationTabs";
+import { PermissionsPoliciesRoute } from "./routes/PermissionsPolicies";
+
+const routes: AppRouteObject[] = [
+  NewPermissionConfigurationRoute,
+  PermissionConfigurationDetailRoute,
+  PermissionsConfigurationRoute,
+  PermissionsConfigurationTabsRoute,
+  PermissionsPoliciesRoute,
+  NewPermissionPolicyRoute,
+  PermissionPolicyDetailsRoute,
+];
+
+export default routes;
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionConfiguration.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionConfiguration.tsx
new file mode 100644
index 000000000000..8e6629cf6d14
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionConfiguration.tsx
@@ -0,0 +1,30 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type NewPermissionConfigurationParams = {
+  realm: string;
+  permissionClientId: string;
+  resourceType: string;
+};
+
+const PermissionConfigurationDetails = lazy(
+  () => import("../permission-configuration/PermissionConfigurationDetails"),
+);
+
+export const NewPermissionConfigurationRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/permission/new/:resourceType",
+  element: <PermissionConfigurationDetails />,
+  breadcrumb: (t) => t("createPermission"),
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny("manage-clients", "manage-authorization"),
+  },
+};
+
+export const toCreatePermissionConfiguration = (
+  params: NewPermissionConfigurationParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(NewPermissionConfigurationRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionPolicy.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionPolicy.tsx
new file mode 100644
index 000000000000..c3df3e487605
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/NewPermissionPolicy.tsx
@@ -0,0 +1,30 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type NewPermissionPolicyDetailsParams = {
+  realm: string;
+  permissionClientId: string;
+  policyType: string;
+};
+
+const NewPermissionPolicyDetails = lazy(
+  () => import("../../clients/authorization/policy/PolicyDetails"),
+);
+
+export const NewPermissionPolicyRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/policies/new/:policyType",
+  element: <NewPermissionPolicyDetails />,
+  breadcrumb: (t) => t("createPermissionPolicy"),
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny("manage-clients", "manage-authorization"),
+  },
+};
+
+export const toCreatePermissionPolicy = (
+  params: NewPermissionPolicyDetailsParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(NewPermissionPolicyRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/PermissionConfigurationDetails.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionConfigurationDetails.tsx
new file mode 100644
index 000000000000..9b8e732df7c0
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionConfigurationDetails.tsx
@@ -0,0 +1,41 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionConfigurationDetailsParams = {
+  realm: string;
+  permissionClientId: string;
+  permissionId: string;
+  resourceType: string;
+};
+
+const PermissionConfigurationDetails = lazy(
+  () =>
+    import(
+      "../../permissions-configuration/permission-configuration/PermissionConfigurationDetails"
+    ),
+);
+
+export const PermissionConfigurationDetailRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/permission/:permissionId/:resourceType",
+  element: <PermissionConfigurationDetails />,
+  breadcrumb: (t) => t("permissionDetails"),
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny(
+        "manage-clients",
+        "view-authorization",
+        "manage-authorization",
+      ),
+  },
+};
+
+export const toPermissionConfigurationDetails = (
+  params: PermissionConfigurationDetailsParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(
+    PermissionConfigurationDetailRoute.path,
+    params,
+  ),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/PermissionPolicyDetails.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionPolicyDetails.tsx
new file mode 100644
index 000000000000..db12bc2ddc39
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionPolicyDetails.tsx
@@ -0,0 +1,35 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionPolicyDetailsParams = {
+  realm: string;
+  permissionClientId: string;
+  policyId: string;
+  policyType: string;
+};
+
+const PermissionPolicyDetails = lazy(
+  () => import("../../clients/authorization/policy/PolicyDetails"),
+);
+
+export const PermissionPolicyDetailsRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/policies/:policyId/:policyType",
+  element: <PermissionPolicyDetails />,
+  breadcrumb: (t) => t("policyDetails"),
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny(
+        "manage-clients",
+        "view-authorization",
+        "manage-authorization",
+      ),
+  },
+};
+
+export const toPermissionPolicyDetails = (
+  params: PermissionPolicyDetailsParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(PermissionPolicyDetailsRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfiguration.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfiguration.tsx
new file mode 100644
index 000000000000..278bb6ba780b
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfiguration.tsx
@@ -0,0 +1,25 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionsConfigurationParams = { realm: string };
+
+const PermissionsConfigurationSection = lazy(
+  () => import("../PermissionsConfigurationSection"),
+);
+
+export const PermissionsConfigurationRoute: AppRouteObject = {
+  path: "/:realm/permissions",
+  element: <PermissionsConfigurationSection />,
+  breadcrumb: (t) => t("titlePermissions"),
+  handle: {
+    access: ["view-realm", "view-clients", "view-users"],
+  },
+};
+
+export const toPermissionsConfiguration = (
+  params: PermissionsConfigurationParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(PermissionsConfigurationRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfigurationTabs.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfigurationTabs.tsx
new file mode 100644
index 000000000000..5fb3a864a047
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsConfigurationTabs.tsx
@@ -0,0 +1,34 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionsConfigurationTabs =
+  | "permissions"
+  | "policies"
+  | "evaluation";
+
+export type PermissionsConfigurationTabsParams = {
+  realm: string;
+  permissionClientId: string;
+  tab: PermissionsConfigurationTabs;
+};
+
+const PermissionsConfigurationSection = lazy(
+  () => import("../PermissionsConfigurationSection"),
+);
+
+export const PermissionsConfigurationTabsRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/:tab",
+  element: <PermissionsConfigurationSection />,
+  handle: {
+    access: (accessChecker) =>
+      accessChecker.hasAny("view-realm", "view-clients", "view-users"),
+  },
+};
+
+export const toPermissionsConfigurationTabs = (
+  params: PermissionsConfigurationTabsParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(PermissionsConfigurationTabsRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsPolicies.tsx b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsPolicies.tsx
new file mode 100644
index 000000000000..96f45ec16105
--- /dev/null
+++ b/js/apps/admin-ui/src/permissions-configuration/routes/PermissionsPolicies.tsx
@@ -0,0 +1,28 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../../utils/generateEncodedPath";
+import type { AppRouteObject } from "../../routes";
+
+export type PermissionsPoliciesParams = {
+  realm: string;
+  permissionClientId: string;
+};
+
+const PermissionsPoliciesSection = lazy(
+  () => import("../PermissionsConfigurationSection"),
+);
+
+export const PermissionsPoliciesRoute: AppRouteObject = {
+  path: "/:realm/permissions/:permissionClientId/policies",
+  element: <PermissionsPoliciesSection />,
+  breadcrumb: (t) => t("policies"),
+  handle: {
+    access: ["view-realm", "view-clients", "view-users"],
+  },
+};
+
+export const toPermissionsPolicies = (
+  params: PermissionsPoliciesParams,
+): Partial<Path> => ({
+  pathname: generateEncodedPath(PermissionsPoliciesRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/permissions/PermissionsSection.tsx b/js/apps/admin-ui/src/permissions/PermissionsSection.tsx
deleted file mode 100644
index 44ee5fad90db..000000000000
--- a/js/apps/admin-ui/src/permissions/PermissionsSection.tsx
+++ /dev/null
@@ -1,223 +0,0 @@
-import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
-import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
-import { useState } from "react";
-import { useAdminClient } from "../admin-client";
-import { ViewHeader } from "../components/view-header/ViewHeader";
-import {
-  RoutableTabs,
-  useRoutableTab,
-} from "../components/routable-tabs/RoutableTabs";
-import {
-  PermissionsTabs,
-  toPermissionsTabs,
-} from "../permissions/routes/PermissionsTabs";
-import {
-  AlertVariant,
-  PageSection,
-  Tab,
-  TabTitleText,
-} from "@patternfly/react-core";
-import { AuthorizationResources } from "../clients/authorization/Resources";
-import { AuthorizationPolicies } from "../clients/authorization/Policies";
-import { AuthorizationEvaluate } from "../clients/authorization/AuthorizationEvaluate";
-import { useRealm } from "../context/realm-context/RealmContext";
-import { useAccess } from "../context/access/Access";
-import { useTranslation } from "react-i18next";
-import { FormProvider, useForm, useWatch } from "react-hook-form";
-import { FormFields, SaveOptions } from "../clients/ClientDetails";
-import {
-  convertAttributeNameToForm,
-  convertFormValuesToObject,
-  convertToFormValues,
-} from "../util";
-import { ConfirmDialogModal } from "../components/confirm-dialog/ConfirmDialog";
-import { KeyValueType } from "../components/key-value-form/key-value-convert";
-import useToggle from "../utils/useToggle";
-
-export default function PermissionsSection() {
-  const { adminClient } = useAdminClient();
-  const { t } = useTranslation();
-  const { realm } = useRealm();
-  const { hasAccess } = useAccess();
-  const { addAlert, addError } = useAlerts();
-  const [adminPermissionsClient, setAdminPermissionsClient] = useState<
-    ClientRepresentation | undefined
-  >();
-  const [changeAuthenticatorOpen, toggleChangeAuthenticatorOpen] = useToggle();
-  const form = useForm<FormFields>();
-
-  const usePermissionsTabs = (tab: PermissionsTabs) =>
-    useRoutableTab(
-      toPermissionsTabs({
-        realm,
-        tab,
-      }),
-    );
-
-  const clientAuthenticatorType = useWatch({
-    control: form.control,
-    name: "clientAuthenticatorType",
-    defaultValue: "client-secret",
-  });
-
-  const hasManageAuthorization = hasAccess("manage-authorization");
-  const hasViewUsers = hasAccess("view-users");
-  const permissionsResourcesTab = usePermissionsTabs("resources");
-  const permissionsPoliciesTab = usePermissionsTabs("policies");
-  const permissionsEvaluateTab = usePermissionsTabs("evaluate");
-
-  useFetch(
-    async () => {
-      const clients = await adminClient.clients.find();
-      return clients;
-    },
-    (clients) => {
-      const adminPermissionsClient = clients.find(
-        (client) => client.clientId === "admin-permissions",
-      );
-      setAdminPermissionsClient(adminPermissionsClient!);
-    },
-    [],
-  );
-
-  const setupForm = (client: ClientRepresentation) => {
-    form.reset({ ...client });
-    convertToFormValues(client, form.setValue);
-    if (client.attributes?.["acr.loa.map"]) {
-      form.setValue(
-        convertAttributeNameToForm("attributes.acr.loa.map"),
-        // @ts-ignore
-        Object.entries(JSON.parse(client.attributes["acr.loa.map"])).flatMap(
-          ([key, value]) => ({ key, value }),
-        ),
-      );
-    }
-  };
-
-  const save = async (
-    { confirmed = false, messageKey = "clientSaveSuccess" }: SaveOptions = {
-      confirmed: false,
-      messageKey: "clientSaveSuccess",
-    },
-  ) => {
-    if (!(await form.trigger())) {
-      return;
-    }
-
-    if (
-      !adminPermissionsClient?.publicClient &&
-      adminPermissionsClient?.clientAuthenticatorType !==
-        clientAuthenticatorType &&
-      !confirmed
-    ) {
-      toggleChangeAuthenticatorOpen();
-      return;
-    }
-
-    const values = convertFormValuesToObject(form.getValues());
-
-    const submittedClient =
-      convertFormValuesToObject<ClientRepresentation>(values);
-
-    if (submittedClient.attributes?.["acr.loa.map"]) {
-      submittedClient.attributes["acr.loa.map"] = JSON.stringify(
-        Object.fromEntries(
-          (submittedClient.attributes["acr.loa.map"] as KeyValueType[])
-            .filter(({ key }) => key !== "")
-            .map(({ key, value }) => [key, value]),
-        ),
-      );
-    }
-
-    try {
-      const newClient: ClientRepresentation = {
-        ...adminPermissionsClient,
-        ...submittedClient,
-      };
-
-      newClient.clientId = newClient.clientId?.trim();
-
-      await adminClient.clients.update(
-        { id: adminPermissionsClient!.clientId! },
-        newClient,
-      );
-      setupForm(newClient);
-      setAdminPermissionsClient(newClient);
-      addAlert(t(messageKey), AlertVariant.success);
-    } catch (error) {
-      addError("clientSaveError", error);
-    }
-  };
-
-  return (
-    adminPermissionsClient && (
-      <>
-        <ConfirmDialogModal
-          continueButtonLabel="yes"
-          cancelButtonLabel="no"
-          titleKey={t("changeAuthenticatorConfirmTitle", {
-            clientAuthenticatorType: clientAuthenticatorType,
-          })}
-          open={changeAuthenticatorOpen}
-          toggleDialog={toggleChangeAuthenticatorOpen}
-          onConfirm={() => save({ confirmed: true })}
-        >
-          <>
-            {t("changeAuthenticatorConfirm", {
-              clientAuthenticatorType: clientAuthenticatorType,
-            })}
-          </>
-        </ConfirmDialogModal>
-        <PageSection variant="light" className="pf-v5-u-p-0">
-          <FormProvider {...form}>
-            <ViewHeader
-              titleKey={t("permissions")}
-              subKey={t("permissionsSubTitle")}
-            />
-            <RoutableTabs
-              mountOnEnter
-              unmountOnExit
-              defaultLocation={toPermissionsTabs({
-                realm,
-                tab: "resources",
-              })}
-            >
-              <Tab
-                id="resources"
-                data-testid="permissionsResources"
-                title={<TabTitleText>{t("resources")}</TabTitleText>}
-                {...permissionsResourcesTab}
-              >
-                <AuthorizationResources clientId={adminPermissionsClient.id!} />
-              </Tab>
-              <Tab
-                id="policies"
-                data-testid="permissionsPolicies"
-                title={<TabTitleText>{t("policies")}</TabTitleText>}
-                {...permissionsPoliciesTab}
-              >
-                <AuthorizationPolicies
-                  clientId={adminPermissionsClient.id!}
-                  isDisabled={!hasManageAuthorization}
-                />
-              </Tab>
-              {hasViewUsers && (
-                <Tab
-                  id="evaluate"
-                  data-testid="permissionsEvaluate"
-                  title={<TabTitleText>{t("evaluate")}</TabTitleText>}
-                  {...permissionsEvaluateTab}
-                >
-                  <AuthorizationEvaluate
-                    client={adminPermissionsClient}
-                    save={save}
-                  />
-                </Tab>
-              )}
-            </RoutableTabs>
-          </FormProvider>
-        </PageSection>
-      </>
-    )
-  );
-}
diff --git a/js/apps/admin-ui/src/permissions/routes.ts b/js/apps/admin-ui/src/permissions/routes.ts
deleted file mode 100644
index 4c713caff379..000000000000
--- a/js/apps/admin-ui/src/permissions/routes.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import type { AppRouteObject } from "../routes";
-import { PermissionsRoute } from "./routes/Permissions";
-import { PermissionsTabsRoute } from "./routes/PermissionsTabs";
-
-const routes: AppRouteObject[] = [PermissionsRoute, PermissionsTabsRoute];
-
-export default routes;
diff --git a/js/apps/admin-ui/src/permissions/routes/Permissions.tsx b/js/apps/admin-ui/src/permissions/routes/Permissions.tsx
deleted file mode 100644
index 67af3b624fff..000000000000
--- a/js/apps/admin-ui/src/permissions/routes/Permissions.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { lazy } from "react";
-import type { Path } from "react-router-dom";
-import { generateEncodedPath } from "../../utils/generateEncodedPath";
-import type { AppRouteObject } from "../../routes";
-
-export type PermissionsParams = { realm: string };
-
-const PermissionsSection = lazy(() => import("../PermissionsSection"));
-
-export const PermissionsRoute: AppRouteObject = {
-  path: "/:realm/permissions",
-  element: <PermissionsSection />,
-  breadcrumb: (t) => t("titlePermissions"),
-  handle: {
-    access: ["view-realm", "view-clients", "view-users"],
-  },
-};
-
-export const toPermissions = (params: PermissionsParams): Partial<Path> => ({
-  pathname: generateEncodedPath(PermissionsRoute.path, params),
-});
diff --git a/js/apps/admin-ui/src/permissions/routes/PermissionsTabs.tsx b/js/apps/admin-ui/src/permissions/routes/PermissionsTabs.tsx
deleted file mode 100644
index ac1c0aabff33..000000000000
--- a/js/apps/admin-ui/src/permissions/routes/PermissionsTabs.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { lazy } from "react";
-import type { Path } from "react-router-dom";
-import { generateEncodedPath } from "../../utils/generateEncodedPath";
-import type { AppRouteObject } from "../../routes";
-
-export type PermissionsTabs = "resources" | "policies" | "evaluate";
-
-export type PermissionsTabsParams = {
-  realm: string;
-  tab: PermissionsTabs;
-};
-
-const PermissionsSection = lazy(() => import("../PermissionsSection"));
-
-export const PermissionsTabsRoute: AppRouteObject = {
-  path: "/:realm/permissions/:tab",
-  element: <PermissionsSection />,
-  handle: {
-    access: (accessChecker) =>
-      accessChecker.hasAny("view-realm", "view-clients", "view-users"),
-  },
-};
-
-export const toPermissionsTabs = (
-  params: PermissionsTabsParams,
-): Partial<Path> => ({
-  pathname: generateEncodedPath(PermissionsTabsRoute.path, params),
-});
diff --git a/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx b/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
index f107e106376b..d9ad10da9703 100644
--- a/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
+++ b/js/apps/admin-ui/src/realm-roles/RealmRoleTabs.tsx
@@ -1,5 +1,9 @@
 import type RoleRepresentation from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
-import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
+import {
+  KeycloakSpinner,
+  useAlerts,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
 import {
   AlertVariant,
   ButtonVariant,
@@ -35,10 +39,8 @@ import {
   arrayToKeyValue,
   keyValueToArray,
 } from "../components/key-value-form/key-value-convert";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { PermissionsTab } from "../components/permission-tab/PermissionTab";
 import { RoleForm } from "../components/role-form/RoleForm";
-import { AddRoleMappingModal } from "../components/role-mapping/AddRoleMappingModal";
 import { RoleMapping } from "../components/role-mapping/RoleMapping";
 import {
   RoutableTabs,
@@ -47,12 +49,12 @@ import {
 import { ViewHeader } from "../components/view-header/ViewHeader";
 import { useAccess } from "../context/access/Access";
 import { useRealm } from "../context/realm-context/RealmContext";
+import { AdminEvents } from "../events/AdminEvents";
 import useIsFeatureEnabled, { Feature } from "../utils/useIsFeatureEnabled";
 import { useParams } from "../utils/useParams";
 import { UsersInRoleTab } from "./UsersInRoleTab";
 import { RealmRoleRoute, RealmRoleTab, toRealmRole } from "./routes/RealmRole";
 import { toRealmRoles } from "./routes/RealmRoles";
-import { AdminEvents } from "../events/AdminEvents";
 
 export default function RealmRoleTabs() {
   const { adminClient } = useAdminClient();
@@ -82,7 +84,6 @@ export default function RealmRoleTabs() {
 
   const [canManageClientRole, setCanManageClientRole] = useState(false);
 
-  const [open, setOpen] = useState(false);
   const convert = (role: RoleRepresentation) => {
     const { attributes, ...rest } = role;
     return {
@@ -190,15 +191,12 @@ export default function RealmRoleTabs() {
     throw new Error("Route could not be determined.");
   };
 
-  const useTab = (tab: RealmRoleTab | ClientRoleTab) =>
-    useRoutableTab(toTab(tab));
-
-  const detailsTab = useTab("details");
-  const associatedRolesTab = useTab("associated-roles");
-  const attributesTab = useTab("attributes");
-  const usersInRoleTab = useTab("users-in-role");
-  const permissionsTab = useTab("permissions");
-  const eventsTab = useTab("events");
+  const detailsTab = useRoutableTab(toTab("details"));
+  const associatedRolesTab = useRoutableTab(toTab("associated-roles"));
+  const attributesTab = useRoutableTab(toTab("attributes"));
+  const usersInRoleTab = useRoutableTab(toTab("users-in-role"));
+  const permissionsTab = useRoutableTab(toTab("permissions"));
+  const eventsTab = useRoutableTab(toTab("events"));
 
   const [toggleDeleteDialog, DeleteConfirm] = useConfirmDialog({
     titleKey: "roleDeleteConfirm",
@@ -249,15 +247,6 @@ export default function RealmRoleTabs() {
   return (
     <>
       <DeleteConfirm />
-      {open && (
-        <AddRoleMappingModal
-          id={id}
-          type="roles"
-          name={roleName}
-          onAssign={(rows) => addComposites(rows.map((r) => r.role))}
-          onClose={() => setOpen(false)}
-        />
-      )}
       <ViewHeader
         titleKey={roleName!}
         badges={[
@@ -332,6 +321,7 @@ export default function RealmRoleTabs() {
             )}
             {!isDefaultRole(roleName) && (
               <Tab
+                data-testid="usersInRoleTab"
                 title={<TabTitleText>{t("usersInRole")}</TabTitleText>}
                 {...usersInRoleTab}
               >
@@ -347,7 +337,7 @@ export default function RealmRoleTabs() {
                   <PermissionsTab id={id} type="roles" />
                 </Tab>
               )}
-            {realm?.adminEventsEnabled && hasAccess("view-events") && (
+            {hasAccess("view-events") && (
               <Tab
                 data-testid="admin-events-tab"
                 title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
diff --git a/js/apps/admin-ui/src/realm-settings/AddClientProfileModal.tsx b/js/apps/admin-ui/src/realm-settings/AddClientProfileModal.tsx
index b8c24d756579..984f60a5dd2d 100644
--- a/js/apps/admin-ui/src/realm-settings/AddClientProfileModal.tsx
+++ b/js/apps/admin-ui/src/realm-settings/AddClientProfileModal.tsx
@@ -46,6 +46,7 @@ export const AddClientProfileModal = (props: AddClientProfileModalProps) => {
     (allProfiles) => {
       const globalProfiles = allProfiles.globalProfiles?.map(
         (globalProfiles) => ({
+          id: globalProfiles.name,
           ...globalProfiles,
           global: true,
         }),
diff --git a/js/apps/admin-ui/src/realm-settings/ClientProfileForm.tsx b/js/apps/admin-ui/src/realm-settings/ClientProfileForm.tsx
index d67160d06b68..2adc8715e155 100644
--- a/js/apps/admin-ui/src/realm-settings/ClientProfileForm.tsx
+++ b/js/apps/admin-ui/src/realm-settings/ClientProfileForm.tsx
@@ -362,13 +362,13 @@ export default function ClientProfileForm() {
                                         />
                                         {!isGlobalProfile && (
                                           <Button
+                                            data-testid={`deleteExecutor-${type.id}`}
                                             variant="link"
                                             isInline
                                             icon={
                                               <TrashIcon
                                                 key={`executorType-trash-icon-${type.id}`}
                                                 className="kc-executor-trash-icon"
-                                                data-testid="deleteExecutor"
                                               />
                                             }
                                             onClick={() => {
diff --git a/js/apps/admin-ui/src/realm-settings/DefaultGroupsTab.tsx b/js/apps/admin-ui/src/realm-settings/DefaultGroupsTab.tsx
index 2a2f6dc3691d..7a9dfec22b47 100644
--- a/js/apps/admin-ui/src/realm-settings/DefaultGroupsTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/DefaultGroupsTab.tsx
@@ -128,8 +128,8 @@ export const DefaultsGroupsTab = () => {
             title: "addDefaultGroups",
             ok: "add",
           }}
-          onConfirm={(groups) => {
-            addGroups(groups || []);
+          onConfirm={async (groups) => {
+            await addGroups(groups || []);
             toggleGroupPicker();
           }}
           onClose={toggleGroupPicker}
diff --git a/js/apps/admin-ui/src/realm-settings/EmailTab.tsx b/js/apps/admin-ui/src/realm-settings/EmailTab.tsx
index 1add5d6db005..5b7ea35d137e 100644
--- a/js/apps/admin-ui/src/realm-settings/EmailTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/EmailTab.tsx
@@ -7,6 +7,7 @@ import {
   AlertVariant,
   Button,
   Checkbox,
+  Radio,
   FormGroup,
   PageSection,
 } from "@patternfly/react-core";
@@ -57,7 +58,13 @@ export const RealmSettingsEmailTab = ({
   const authenticationEnabled = useWatch({
     control,
     name: "smtpServer.auth",
-    defaultValue: "",
+    defaultValue: realm.smtpServer?.auth || "false",
+  });
+
+  const authType = useWatch({
+    control,
+    name: "smtpServer.authType",
+    defaultValue: realm.smtpServer?.authType || "basic",
   });
 
   const testConnection = async () => {
@@ -202,6 +209,7 @@ export const RealmSettingsEmailTab = ({
             <SwitchControl
               name="smtpServer.auth"
               label={t("authentication")}
+              data-testid="smtpServer.auth"
               defaultValue=""
               labelOn={t("enabled")}
               labelOff={t("disabled")}
@@ -217,16 +225,97 @@ export const RealmSettingsEmailTab = ({
                     required: t("required"),
                   }}
                 />
-                <PasswordControl
-                  name="smtpServer.password"
-                  label={t("password")}
-                  labelIcon={t("passwordHelp")}
-                  rules={{
-                    required: t("required"),
-                  }}
-                />
+                <FormGroup label={t("authenticationType")} fieldId="authType">
+                  <Controller
+                    name="smtpServer.authType"
+                    control={control}
+                    defaultValue="basic"
+                    render={({ field }) => (
+                      <>
+                        <Radio
+                          id="basicAuth"
+                          name="smtpServer.authType"
+                          data-testid="smtpServer.authType.basic"
+                          label={t("authenticationTypeBasicAuth")}
+                          value="basic"
+                          isChecked={field.value === "basic"}
+                          onChange={() => field.onChange("basic")}
+                        />
+                        <Radio
+                          id="tokenAuth"
+                          name="smtpServer.authType"
+                          data-testid="smtpServer.authType.token"
+                          label={t("authenticationTypeTokenAuth")}
+                          value="token"
+                          isChecked={field.value === "token"}
+                          onChange={() => field.onChange("token")}
+                        />
+                      </>
+                    )}
+                  />
+                </FormGroup>
+                {authType === "basic" && (
+                  <PasswordControl
+                    name="smtpServer.password"
+                    label={t("password")}
+                    labelIcon={t("passwordHelp")}
+                    rules={{
+                      required: t("required"),
+                    }}
+                  />
+                )}
+                {authType === "token" && (
+                  <>
+                    <TextControl
+                      name="smtpServer.authTokenUrl"
+                      label={t("authTokenUrl")}
+                      helperText={t("tokenTokenUrlHelp")}
+                      rules={{
+                        required: t("required"),
+                      }}
+                    />
+                    <TextControl
+                      name="smtpServer.authTokenScope"
+                      label={t("authTokenScope")}
+                      helperText={t("authTokenScopeHelp")}
+                      rules={{
+                        required: t("required"),
+                      }}
+                    />
+                    <TextControl
+                      name="smtpServer.authTokenClientId"
+                      label={t("authTokenClientId")}
+                      helperText={t("authTokenClientIdHelp")}
+                      rules={{
+                        required: t("required"),
+                      }}
+                    />
+                    <PasswordControl
+                      name="smtpServer.authTokenClientSecret"
+                      label={t("authTokenClientSecret")}
+                      labelIcon={t("authTokenClientSecretHelp")}
+                      rules={{
+                        required: t("required"),
+                      }}
+                    />
+                  </>
+                )}
               </>
             )}
+            <Controller
+              name="smtpServer.debug"
+              control={control}
+              defaultValue="false"
+              render={({ field }) => (
+                <Checkbox
+                  id="kc-enable-debug"
+                  data-testid="enable-debug"
+                  label={t("enableDebugSMTP")}
+                  isChecked={field.value === "true"}
+                  onChange={(_event, value) => field.onChange("" + value)}
+                />
+              )}
+            />
             {currentUser && (
               <FormGroup id="descriptionTestConnection">
                 {currentUser.email ? (
diff --git a/js/apps/admin-ui/src/realm-settings/ExecutorForm.tsx b/js/apps/admin-ui/src/realm-settings/ExecutorForm.tsx
index 9b4f44c42ea9..e0d20d229c7b 100644
--- a/js/apps/admin-ui/src/realm-settings/ExecutorForm.tsx
+++ b/js/apps/admin-ui/src/realm-settings/ExecutorForm.tsx
@@ -211,6 +211,7 @@ export default function ExecutorForm() {
                 >
                   {executorTypes?.map((option) => (
                     <SelectOption
+                      data-testid={option.id}
                       selected={option.id === field.value}
                       key={option.id}
                       value={option.id}
diff --git a/js/apps/admin-ui/src/realm-settings/GeneralTab.tsx b/js/apps/admin-ui/src/realm-settings/GeneralTab.tsx
index e1595b79612d..56365a3f3b50 100644
--- a/js/apps/admin-ui/src/realm-settings/GeneralTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/GeneralTab.tsx
@@ -36,6 +36,7 @@ import {
 } from "../util";
 import useIsFeatureEnabled, { Feature } from "../utils/useIsFeatureEnabled";
 import { UIRealmRepresentation } from "./RealmSettingsTabs";
+import { SIGNATURE_ALGORITHMS } from "../clients/add/SamlSignature";
 
 type RealmSettingsGeneralTabProps = {
   realm: UIRealmRepresentation;
@@ -256,6 +257,20 @@ function RealmSettingsGeneralTabForm({
               value: t(`unmanagedAttributePolicy.${policy}`),
             }))}
           />
+          <SelectControl
+            name={convertAttributeNameToForm<FormFields>(
+              "attributes.saml.signature.algorithm",
+            )}
+            label={t("signatureAlgorithmIdentityProviderMetadata")}
+            labelIcon={t("signatureAlgorithmIdentityProviderMetadataHelp")}
+            controller={{
+              defaultValue: "",
+            }}
+            options={[
+              { key: "", value: t("choose") },
+              ...SIGNATURE_ALGORITHMS.map((v) => ({ key: v, value: v })),
+            ]}
+          />
           <FormGroup
             label={t("endpoints")}
             labelIcon={
diff --git a/js/apps/admin-ui/src/realm-settings/LoginTab.tsx b/js/apps/admin-ui/src/realm-settings/LoginTab.tsx
index 72ab8e26ed34..8a6f1ea6c0c8 100644
--- a/js/apps/admin-ui/src/realm-settings/LoginTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/LoginTab.tsx
@@ -71,8 +71,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.registrationAllowed}
-              onChange={(_event, value) => {
-                updateSwitchValue({ registrationAllowed: value });
+              onChange={async (_event, value) => {
+                await updateSwitchValue({ registrationAllowed: value });
               }}
               aria-label={t("registrationAllowed")}
             />
@@ -96,8 +96,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.resetPasswordAllowed}
-              onChange={(_event, value) => {
-                updateSwitchValue({ resetPasswordAllowed: value });
+              onChange={async (_event, value) => {
+                await updateSwitchValue({ resetPasswordAllowed: value });
               }}
               aria-label={t("resetPasswordAllowed")}
             />
@@ -120,8 +120,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.rememberMe}
-              onChange={(_event, value) => {
-                updateSwitchValue({ rememberMe: value });
+              onChange={async (_event, value) => {
+                await updateSwitchValue({ rememberMe: value });
               }}
               aria-label={t("rememberMe")}
             />
@@ -148,8 +148,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.registrationEmailAsUsername}
-              onChange={(_event, value) => {
-                updateSwitchValue([
+              onChange={async (_event, value) => {
+                await updateSwitchValue([
                   {
                     registrationEmailAsUsername: value,
                   },
@@ -179,8 +179,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.loginWithEmailAllowed}
-              onChange={(_event, value) => {
-                updateSwitchValue([
+              onChange={async (_event, value) => {
+                await updateSwitchValue([
                   {
                     loginWithEmailAllowed: value,
                   },
@@ -207,8 +207,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.duplicateEmailsAllowed}
-              onChange={(_event, value) => {
-                updateSwitchValue({
+              onChange={async (_event, value) => {
+                await updateSwitchValue({
                   duplicateEmailsAllowed: value,
                 });
               }}
@@ -237,8 +237,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.verifyEmail}
-              onChange={(_event, value) => {
-                updateSwitchValue({ verifyEmail: value });
+              onChange={async (_event, value) => {
+                await updateSwitchValue({ verifyEmail: value });
               }}
               aria-label={t("verifyEmail")}
             />
@@ -268,8 +268,8 @@ export const RealmSettingsLoginTab = ({
               label={t("on")}
               labelOff={t("off")}
               isChecked={realm.editUsernameAllowed}
-              onChange={(_event, value) => {
-                updateSwitchValue({ editUsernameAllowed: value });
+              onChange={async (_event, value) => {
+                await updateSwitchValue({ editUsernameAllowed: value });
               }}
               aria-label={t("editUsernameAllowed")}
             />
diff --git a/js/apps/admin-ui/src/realm-settings/NewClientPolicy.tsx b/js/apps/admin-ui/src/realm-settings/NewClientPolicy.tsx
index 02a2c32289f4..18acfef079fe 100644
--- a/js/apps/admin-ui/src/realm-settings/NewClientPolicy.tsx
+++ b/js/apps/admin-ui/src/realm-settings/NewClientPolicy.tsx
@@ -386,9 +386,9 @@ export default function NewClientPolicy() {
     titleKey: "disablePolicyConfirmTitle",
     messageKey: "disablePolicyConfirm",
     continueButtonLabel: "disable",
-    onConfirm: () => {
+    onConfirm: async () => {
       form.setValue("enabled", !form.getValues().enabled);
-      save();
+      await save();
     },
   });
 
@@ -401,8 +401,8 @@ export default function NewClientPolicy() {
       <DeleteConditionConfirm />
       <DeleteProfileConfirm />
       <AddClientProfileModal
-        onConfirm={(profiles: ClientProfileRepresentation[]) => {
-          addProfiles(profiles.map((item) => item.name!));
+        onConfirm={async (profiles: ClientProfileRepresentation[]) => {
+          await addProfiles(profiles.map((item) => item.name!));
         }}
         allProfiles={policyProfiles}
         open={profilesModalOpen}
@@ -452,12 +452,12 @@ export default function NewClientPolicy() {
               }
               isReadOnly={isGlobalPolicy}
               isEnabled={field.value}
-              onToggle={(value) => {
+              onToggle={async (value) => {
                 if (!value) {
                   toggleDisableDialog();
                 } else {
                   field.onChange(value);
-                  save();
+                  await save();
                 }
               }}
             />
@@ -632,6 +632,7 @@ export default function NewClientPolicy() {
                   <>
                     <Divider />
                     <Text
+                      data-testid="no-conditions"
                       className="kc-emptyConditions"
                       component={TextVariants.h2}
                     >
diff --git a/js/apps/admin-ui/src/realm-settings/NewClientPolicyCondition.tsx b/js/apps/admin-ui/src/realm-settings/NewClientPolicyCondition.tsx
index 5d831593b2b3..b27b16db5f4a 100644
--- a/js/apps/admin-ui/src/realm-settings/NewClientPolicyCondition.tsx
+++ b/js/apps/admin-ui/src/realm-settings/NewClientPolicyCondition.tsx
@@ -248,6 +248,7 @@ export default function NewClientPolicyCondition() {
                 >
                   {conditionTypes?.map((condition) => (
                     <SelectOption
+                      data-testid={condition.id}
                       selected={condition.id === field.value}
                       description={t(
                         camelCase(condition.id.replace(/-/g, " ")),
diff --git a/js/apps/admin-ui/src/realm-settings/PartialExport.tsx b/js/apps/admin-ui/src/realm-settings/PartialExport.tsx
index 943526d54818..2b6769c23e98 100644
--- a/js/apps/admin-ui/src/realm-settings/PartialExport.tsx
+++ b/js/apps/admin-ui/src/realm-settings/PartialExport.tsx
@@ -77,7 +77,7 @@ export const PartialExportDialog = ({
       actions={[
         <Button
           key="export"
-          data-testid="export-button"
+          data-testid="confirm"
           isDisabled={isExporting}
           onClick={exportRealm}
         >
@@ -85,7 +85,7 @@ export const PartialExportDialog = ({
         </Button>,
         <Button
           key="cancel"
-          data-testid="cancel-button"
+          data-testid="cancel"
           variant={ButtonVariant.link}
           onClick={onClose}
         >
diff --git a/js/apps/admin-ui/src/realm-settings/PartialImport.tsx b/js/apps/admin-ui/src/realm-settings/PartialImport.tsx
index c2799768c490..dcf76922b982 100644
--- a/js/apps/admin-ui/src/realm-settings/PartialImport.tsx
+++ b/js/apps/admin-ui/src/realm-settings/PartialImport.tsx
@@ -284,18 +284,18 @@ export const PartialImportDialog = (props: PartialImportProps) => {
         actions={[
           <Button
             id="modal-import"
-            data-testid="import-button"
+            data-testid="confirm"
             key="import"
             isDisabled={!isAnyResourceChecked}
-            onClick={() => {
-              doImport();
+            onClick={async () => {
+              await doImport();
             }}
           >
             {t("import")}
           </Button>,
           <Button
             id="modal-cancel"
-            data-testid="cancel-button"
+            data-testid="cancel"
             key="cancel"
             variant={ButtonVariant.link}
             onClick={() => {
diff --git a/js/apps/admin-ui/src/realm-settings/PoliciesTab.tsx b/js/apps/admin-ui/src/realm-settings/PoliciesTab.tsx
index 9fad2c049527..0695a3738c37 100644
--- a/js/apps/admin-ui/src/realm-settings/PoliciesTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/PoliciesTab.tsx
@@ -2,10 +2,11 @@ import type ClientPolicyRepresentation from "@keycloak/keycloak-admin-client/lib
 import {
   Action,
   KeycloakDataTable,
+  KeycloakSpinner,
+  ListEmptyState,
   useAlerts,
   useFetch,
 } from "@keycloak/keycloak-ui-shared";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import {
   AlertVariant,
   Button,
@@ -26,8 +27,7 @@ import { useTranslation } from "react-i18next";
 import { Link, useNavigate } from "react-router-dom";
 import { useAdminClient } from "../admin-client";
 import { useConfirmDialog } from "../components/confirm-dialog/ConfirmDialog";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
-import { ListEmptyState } from "@keycloak/keycloak-ui-shared";
+import CodeEditor from "../components/form/CodeEditor";
 import { useRealm } from "../context/realm-context/RealmContext";
 import { prettyPrintJSON } from "../util";
 import { translationFormatter } from "../utils/translationFormatter";
@@ -272,9 +272,9 @@ export const PoliciesTab = () => {
                   clientPolicy={clientPolicy}
                   form={form}
                   saveStatus={saveStatus}
-                  onConfirm={() => {
+                  onConfirm={async () => {
                     form.setValue(clientPolicy.name!, false);
-                    saveStatus();
+                    await saveStatus();
                   }}
                 />
               ),
@@ -291,8 +291,8 @@ export const PoliciesTab = () => {
             <CodeEditor
               value={code}
               language="json"
-              style={{ height: "30rem", overflow: "scroll" }}
-              onChange={(event) => setCode(event.target.value)}
+              onChange={(value) => setCode(value)}
+              height={480}
             />
           </div>
           <div className="pf-v5-u-mt-md">
diff --git a/js/apps/admin-ui/src/realm-settings/ProfilesTab.tsx b/js/apps/admin-ui/src/realm-settings/ProfilesTab.tsx
index 3f391b050c4d..28ab1ab41eeb 100644
--- a/js/apps/admin-ui/src/realm-settings/ProfilesTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/ProfilesTab.tsx
@@ -2,10 +2,11 @@ import type ClientProfileRepresentation from "@keycloak/keycloak-admin-client/li
 import {
   Action,
   KeycloakDataTable,
+  KeycloakSpinner,
+  ListEmptyState,
   useAlerts,
   useFetch,
 } from "@keycloak/keycloak-ui-shared";
-import CodeEditor from "@uiw/react-textarea-code-editor";
 import {
   ActionGroup,
   AlertVariant,
@@ -27,8 +28,7 @@ import { useTranslation } from "react-i18next";
 import { Link } from "react-router-dom";
 import { useAdminClient } from "../admin-client";
 import { useConfirmDialog } from "../components/confirm-dialog/ConfirmDialog";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
-import { ListEmptyState } from "@keycloak/keycloak-ui-shared";
+import CodeEditor from "../components/form/CodeEditor";
 import { useRealm } from "../context/realm-context/RealmContext";
 import { prettyPrintJSON } from "../util";
 import { toAddClientProfile } from "./routes/AddClientProfile";
@@ -254,8 +254,8 @@ export default function ProfilesTab() {
             <CodeEditor
               value={code}
               language="json"
-              style={{ height: "30rem", overflow: "scroll" }}
-              onChange={(event) => setCode(event.target.value ?? "")}
+              onChange={(value) => setCode(value ?? "")}
+              height={480}
             />
           </div>
           <ActionGroup>
diff --git a/js/apps/admin-ui/src/realm-settings/RealmSettingsTabs.tsx b/js/apps/admin-ui/src/realm-settings/RealmSettingsTabs.tsx
index 1d2ac5dfd131..06f438089497 100644
--- a/js/apps/admin-ui/src/realm-settings/RealmSettingsTabs.tsx
+++ b/js/apps/admin-ui/src/realm-settings/RealmSettingsTabs.tsx
@@ -218,7 +218,7 @@ export const RealmSettingsTabs = () => {
         return [];
       }
     };
-    fetchLocalizationTexts();
+    void fetchLocalizationTexts();
   }, [setValue, realm]);
 
   const save = async (r: UIRealmRepresentation) => {
diff --git a/js/apps/admin-ui/src/realm-settings/event-config/EventConfigForm.tsx b/js/apps/admin-ui/src/realm-settings/event-config/EventConfigForm.tsx
index 38d0b8730be3..11f3ce69a33b 100644
--- a/js/apps/admin-ui/src/realm-settings/event-config/EventConfigForm.tsx
+++ b/js/apps/admin-ui/src/realm-settings/event-config/EventConfigForm.tsx
@@ -81,28 +81,24 @@ export const EventConfigForm = ({
           )}
         />
       </FormGroup>
+      {type === "admin" && (
+        <DefaultSwitchControl
+          name="adminEventsDetailsEnabled"
+          label={t("includeRepresentation")}
+          labelIcon={t("includeRepresentationHelp")}
+        />
+      )}
       {eventsEnabled && (
-        <>
-          {type === "admin" && (
-            <DefaultSwitchControl
-              name="adminEventsDetailsEnabled"
-              label={t("includeRepresentation")}
-              labelIcon={t("includeRepresentationHelp")}
-            />
-          )}
-          <TimeSelectorControl
-            name={
-              type === "user" ? "eventsExpiration" : "adminEventsExpiration"
-            }
-            label={t("expiration")}
-            labelIcon={t("expirationHelp")}
-            defaultValue=""
-            units={["minute", "hour", "day"]}
-            controller={{
-              defaultValue: "",
-            }}
-          />
-        </>
+        <TimeSelectorControl
+          name={type === "user" ? "eventsExpiration" : "adminEventsExpiration"}
+          label={t("expiration")}
+          labelIcon={t("expirationHelp")}
+          defaultValue=""
+          units={["minute", "hour", "day"]}
+          controller={{
+            defaultValue: "",
+          }}
+        />
       )}
       <ActionGroup>
         <Button
diff --git a/js/apps/admin-ui/src/realm-settings/event-config/EventsTab.tsx b/js/apps/admin-ui/src/realm-settings/event-config/EventsTab.tsx
index 0d3e4edd2c02..ffb410c0a0a0 100644
--- a/js/apps/admin-ui/src/realm-settings/event-config/EventsTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/event-config/EventsTab.tsx
@@ -149,6 +149,15 @@ export const EventsTab = ({ realm }: EventsTabProps) => {
     refresh();
   };
 
+  const removeEvents = async (eventTypes: EventType[] = []) => {
+    const values = eventTypes.map((type) => type.id);
+    const enabledEventTypes = events?.enabledEventTypes?.filter(
+      (e) => !values.includes(e),
+    );
+    await addEvents(enabledEventTypes);
+    setEvents({ ...events, enabledEventTypes });
+  };
+
   return (
     <>
       <DeleteConfirm />
@@ -202,13 +211,8 @@ export const EventsTab = ({ realm }: EventsTabProps) => {
               key={tableKey}
               addTypes={() => setAddEventType(true)}
               eventTypes={events?.enabledEventTypes || []}
-              onDelete={(value) => {
-                const enabledEventTypes = events?.enabledEventTypes?.filter(
-                  (e) => e !== value.id,
-                );
-                addEvents(enabledEventTypes);
-                setEvents({ ...events, enabledEventTypes });
-              }}
+              onDelete={(value) => removeEvents([value])}
+              onDeleteAll={removeEvents}
             />
           </PageSection>
         </Tab>
diff --git a/js/apps/admin-ui/src/realm-settings/event-config/EventsTypeTable.tsx b/js/apps/admin-ui/src/realm-settings/event-config/EventsTypeTable.tsx
index 6a599e6b90d3..3162c033f247 100644
--- a/js/apps/admin-ui/src/realm-settings/event-config/EventsTypeTable.tsx
+++ b/js/apps/admin-ui/src/realm-settings/event-config/EventsTypeTable.tsx
@@ -1,7 +1,11 @@
+import {
+  Action,
+  KeycloakDataTable,
+  ListEmptyState,
+} from "@keycloak/keycloak-ui-shared";
 import { Button, ToolbarItem } from "@patternfly/react-core";
+import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { ListEmptyState } from "@keycloak/keycloak-ui-shared";
-import { Action, KeycloakDataTable } from "@keycloak/keycloak-ui-shared";
 import { translationFormatter } from "../../utils/translationFormatter";
 
 export type EventType = {
@@ -14,6 +18,7 @@ type EventsTypeTableProps = {
   addTypes?: () => void;
   onSelect?: (value: EventType[]) => void;
   onDelete?: (value: EventType) => void;
+  onDeleteAll?: (value: EventType[]) => void;
 };
 
 export function EventsTypeTable({
@@ -22,8 +27,10 @@ export function EventsTypeTable({
   addTypes,
   onSelect,
   onDelete,
+  onDeleteAll,
 }: EventsTypeTableProps) {
   const { t } = useTranslation();
+  const [selectedTypes, setSelectedTypes] = useState<EventType[]>([]);
 
   const data = eventTypes.map((type) => ({
     id: type,
@@ -35,16 +42,30 @@ export function EventsTypeTable({
       ariaLabelKey={ariaLabelKey}
       searchPlaceholderKey="searchEventType"
       loader={data}
-      onSelect={onSelect ? onSelect : undefined}
-      canSelectAll={!!onSelect}
+      onSelect={onSelect ? onSelect : setSelectedTypes}
+      canSelectAll
       toolbarItem={
-        addTypes && (
-          <ToolbarItem>
-            <Button id="addTypes" onClick={addTypes} data-testid="addTypes">
-              {t("addSavedTypes")}
-            </Button>
-          </ToolbarItem>
-        )
+        <>
+          {addTypes && (
+            <ToolbarItem>
+              <Button id="addTypes" onClick={addTypes} data-testid="addTypes">
+                {t("addSavedTypes")}
+              </Button>
+            </ToolbarItem>
+          )}
+          {onDeleteAll && (
+            <ToolbarItem>
+              <Button
+                onClick={() => onDeleteAll(selectedTypes)}
+                data-testid="removeAll"
+                variant="secondary"
+                isDisabled={selectedTypes.length === 0}
+              >
+                {t("remove")}
+              </Button>
+            </ToolbarItem>
+          )}
+        </>
       }
       actions={
         !onDelete
diff --git a/js/apps/admin-ui/src/realm-settings/localization/EffectiveMessageBundles.tsx b/js/apps/admin-ui/src/realm-settings/localization/EffectiveMessageBundles.tsx
index e31e9eba222a..a41dc2b7d0c0 100644
--- a/js/apps/admin-ui/src/realm-settings/localization/EffectiveMessageBundles.tsx
+++ b/js/apps/admin-ui/src/realm-settings/localization/EffectiveMessageBundles.tsx
@@ -445,13 +445,13 @@ export const EffectiveMessageBundles = ({
                         }}
                       />
                       <ChipGroup>
-                        {field.value.map((word, index) => (
+                        {field.value.map((word: string, index: number) => (
                           <Chip
                             key={index}
                             onClick={(e) => {
                               e.stopPropagation();
                               const newWords = field.value.filter(
-                                (_, i) => i !== index,
+                                (_: string, i: number) => i !== index,
                               );
                               field.onChange(newWords);
                             }}
diff --git a/js/apps/admin-ui/src/realm-settings/localization/LocalizationTab.tsx b/js/apps/admin-ui/src/realm-settings/localization/LocalizationTab.tsx
index e5f768d00892..6b0d29dc1b17 100644
--- a/js/apps/admin-ui/src/realm-settings/localization/LocalizationTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/localization/LocalizationTab.tsx
@@ -98,8 +98,15 @@ export const LocalizationTab = ({
                   name="supportedLocales"
                   isScrollable
                   label={t("supportedLocales")}
+                  labelIcon={t("supportedLocalesHelp")}
                   controller={{
                     defaultValue: defaultSupportedLocales,
+                    rules: {
+                      required: t("required"),
+                      validate: (value: string[]) =>
+                        value.every((v) => allLocales.includes(v)) ||
+                        t("invalidLocale"),
+                    },
                   }}
                   variant="typeaheadMulti"
                   placeholderText={t("selectLocales")}
@@ -111,8 +118,14 @@ export const LocalizationTab = ({
                 <SelectControl
                   name="defaultLocale"
                   label={t("defaultLocale")}
+                  labelIcon={t("defaultLocaleHelp")}
                   controller={{
                     defaultValue: DEFAULT_LOCALE,
+                    rules: {
+                      required: t("required"),
+                      validate: (value: string) =>
+                        watchSupportedLocales?.includes(value) || t("required"),
+                    },
                   }}
                   data-testid="select-default-locale"
                   options={watchSupportedLocales!.map((l) => ({
diff --git a/js/apps/admin-ui/src/realm-settings/localization/RealmOverrides.tsx b/js/apps/admin-ui/src/realm-settings/localization/RealmOverrides.tsx
index 4bedd0cd0cbe..afbc3f13e0c6 100644
--- a/js/apps/admin-ui/src/realm-settings/localization/RealmOverrides.tsx
+++ b/js/apps/admin-ui/src/realm-settings/localization/RealmOverrides.tsx
@@ -147,7 +147,7 @@ export const RealmOverrides = ({
       }
     };
 
-    fetchLocalizationTexts().then((translations) => {
+    void fetchLocalizationTexts().then((translations) => {
       const updatedRows: IRow[] = translations.map(
         (translation): IRow => ({
           rowEditBtnAriaLabel: () =>
@@ -221,7 +221,7 @@ export const RealmOverrides = ({
       refreshTable();
       translationForm.setValue("key", "");
       translationForm.setValue("value", "");
-      i18n.reloadResources();
+      await i18n.reloadResources();
 
       addAlert(t("addTranslationSuccess"), AlertVariant.success);
     } catch (error) {
@@ -321,7 +321,7 @@ export const RealmOverrides = ({
         },
         value,
       );
-      i18n.reloadResources();
+      await i18n.reloadResources();
 
       addAlert(t("updateTranslationSuccess"), AlertVariant.success);
       setTableRows(newRows);
@@ -341,8 +341,8 @@ export const RealmOverrides = ({
       {addTranslationModalOpen && (
         <AddTranslationModal
           handleModalToggle={handleModalToggle}
-          save={(pair: any) => {
-            addKeyValue(pair);
+          save={async (pair: any) => {
+            await addKeyValue(pair);
             handleModalToggle();
           }}
           form={translationForm}
@@ -517,8 +517,8 @@ export const RealmOverrides = ({
                     <Form
                       isHorizontal
                       className="kc-form-translationValue"
-                      onSubmit={handleSubmit(() => {
-                        onSubmit(formValue, rowIndex);
+                      onSubmit={handleSubmit(async () => {
+                        await onSubmit(formValue, rowIndex);
                       })}
                     >
                       <FormGroup
diff --git a/js/apps/admin-ui/src/realm-settings/security-defences/BruteForceDetection.tsx b/js/apps/admin-ui/src/realm-settings/security-defences/BruteForceDetection.tsx
index 4737437a1d6f..dfea1d10e82b 100644
--- a/js/apps/admin-ui/src/realm-settings/security-defences/BruteForceDetection.tsx
+++ b/js/apps/admin-ui/src/realm-settings/security-defences/BruteForceDetection.tsx
@@ -140,7 +140,7 @@ export const BruteForceDetection = ({
               labelIcon={t("failureFactorHelp")}
               controller={{
                 defaultValue: 0,
-                rules: { required: t("required") },
+                rules: { required: t("required"), min: 0 },
               }}
             />
             {bruteForceMode ===
@@ -151,6 +151,7 @@ export const BruteForceDetection = ({
                 labelIcon={t("maxTemporaryLockoutsHelp")}
                 controller={{
                   defaultValue: 0,
+                  rules: { min: 0 },
                 }}
               />
             )}
@@ -161,16 +162,18 @@ export const BruteForceDetection = ({
                 <SelectControl
                   name="bruteForceStrategy"
                   label={t("bruteForceStrategy")}
-                  labelIcon={t("bruteForceStrategyHelp")}
+                  labelIcon={t("bruteForceStrategyHelp", {
+                    failureFactor: form.getValues("failureFactor"),
+                  })}
                   controller={{ defaultValue: "" }}
                   options={bruteForceStrategyTypes.map((key) => ({
                     key,
                     value: t(`bruteForceStrategy.${key}`),
                   }))}
                 />
-                <Time name="waitIncrementSeconds" />
-                <Time name="maxFailureWaitSeconds" />
-                <Time name="maxDeltaTimeSeconds" />
+                <Time name="waitIncrementSeconds" min={0} />
+                <Time name="maxFailureWaitSeconds" min={0} />
+                <Time name="maxDeltaTimeSeconds" min={0} />
               </>
             )}
             <NumberControl
@@ -179,9 +182,10 @@ export const BruteForceDetection = ({
               labelIcon={t("quickLoginCheckMilliSecondsHelp")}
               controller={{
                 defaultValue: 0,
+                rules: { min: 0 },
               }}
             />
-            <Time name="minimumQuickLoginWaitSeconds" />
+            <Time name="minimumQuickLoginWaitSeconds" min={0} />
           </>
         )}
 
diff --git a/js/apps/admin-ui/src/realm-settings/security-defences/HeadersForm.tsx b/js/apps/admin-ui/src/realm-settings/security-defences/HeadersForm.tsx
index e9c8f397514b..0fc4d0c999b4 100644
--- a/js/apps/admin-ui/src/realm-settings/security-defences/HeadersForm.tsx
+++ b/js/apps/admin-ui/src/realm-settings/security-defences/HeadersForm.tsx
@@ -48,10 +48,6 @@ export const HeadersForm = ({ realm, save }: HeadersFormProps) => {
         fieldName="browserSecurityHeaders.xRobotsTag"
         url="https://developers.google.com/search/docs/advanced/robots/robots_meta_tag"
       />
-      <HelpLinkTextInput
-        fieldName="browserSecurityHeaders.xXSSProtection"
-        url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection"
-      />
       <HelpLinkTextInput
         fieldName="browserSecurityHeaders.strictTransportSecurity"
         url="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security"
diff --git a/js/apps/admin-ui/src/realm-settings/security-defences/Time.tsx b/js/apps/admin-ui/src/realm-settings/security-defences/Time.tsx
index 429408f8d9e3..aaea6a7de017 100644
--- a/js/apps/admin-ui/src/realm-settings/security-defences/Time.tsx
+++ b/js/apps/admin-ui/src/realm-settings/security-defences/Time.tsx
@@ -6,9 +6,11 @@ import { TimeSelectorControl } from "../../components/time-selector/TimeSelector
 export const Time = ({
   name,
   style,
+  min,
 }: {
   name: string;
   style?: CSSProperties;
+  min?: number;
 }) => {
   const { t } = useTranslation();
   return (
@@ -17,9 +19,10 @@ export const Time = ({
       style={style}
       label={t(name)}
       labelIcon={t(`${name}Help`)}
+      min={min}
       controller={{
         defaultValue: "",
-        rules: { required: t("required") },
+        rules: { required: t("required"), min: min },
       }}
     />
   );
diff --git a/js/apps/admin-ui/src/realm-settings/themes/FileNameDialog.tsx b/js/apps/admin-ui/src/realm-settings/themes/FileNameDialog.tsx
new file mode 100644
index 000000000000..d42988c9fbd0
--- /dev/null
+++ b/js/apps/admin-ui/src/realm-settings/themes/FileNameDialog.tsx
@@ -0,0 +1,39 @@
+import { TextControl } from "@keycloak/keycloak-ui-shared";
+import { Form } from "@patternfly/react-core";
+import { ConfirmDialogModal } from "../../components/confirm-dialog/ConfirmDialog";
+import { useTranslation } from "react-i18next";
+import { FormProvider, useForm } from "react-hook-form";
+
+type FileNameDialogProps = {
+  onSave: (fileName: string) => void;
+  onClose: () => void;
+};
+
+type FormValues = {
+  fileName: string;
+};
+export const FileNameDialog = ({ onSave, onClose }: FileNameDialogProps) => {
+  const { t } = useTranslation();
+  const form = useForm<FormValues>();
+  const { handleSubmit } = form;
+
+  const save = ({ fileName }: FormValues) => onSave(fileName);
+  return (
+    <ConfirmDialogModal
+      titleKey="fileNameDialogTitle"
+      open
+      toggleDialog={onClose}
+      onConfirm={() => handleSubmit(save)()}
+    >
+      <Form isHorizontal onSubmit={handleSubmit(save)}>
+        <FormProvider {...form}>
+          <TextControl
+            name="fileName"
+            label={t("fileName")}
+            defaultValue="quick-theme.jar"
+          />
+        </FormProvider>
+      </Form>
+    </ConfirmDialogModal>
+  );
+};
diff --git a/js/apps/admin-ui/src/realm-settings/themes/ImageUpload.tsx b/js/apps/admin-ui/src/realm-settings/themes/ImageUpload.tsx
index 8ae72908abf1..c47c4b31eff5 100644
--- a/js/apps/admin-ui/src/realm-settings/themes/ImageUpload.tsx
+++ b/js/apps/admin-ui/src/realm-settings/themes/ImageUpload.tsx
@@ -1,6 +1,6 @@
 import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { FileUpload } from "@patternfly/react-core";
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 
 type ImageUploadProps = {
@@ -13,7 +13,7 @@ export const ImageUpload = ({ name, onChange }: ImageUploadProps) => {
   const [file, setFile] = useState<File>();
   const [isLoading, setIsLoading] = useState(false);
 
-  const { control } = useFormContext();
+  const { control, watch } = useFormContext();
 
   const fileToDataUri = (file: File) =>
     new Promise<string>((resolve) => {
@@ -25,12 +25,23 @@ export const ImageUpload = ({ name, onChange }: ImageUploadProps) => {
     });
 
   if (file) {
-    fileToDataUri(file).then((dataUri) => {
+    void fileToDataUri(file).then((dataUri) => {
       setDataUri(dataUri);
       onChange?.(dataUri);
     });
   }
 
+  const loadedFile = watch(name);
+  useEffect(() => {
+    (() => {
+      if (loadedFile) {
+        void fileToDataUri(loadedFile).then((dataUri) => {
+          setDataUri(dataUri);
+        });
+      }
+    })();
+  }, [loadedFile]);
+
   return (
     <Controller
       name={name}
diff --git a/js/apps/admin-ui/src/realm-settings/themes/ThemeColors.tsx b/js/apps/admin-ui/src/realm-settings/themes/ThemeColors.tsx
index 6cdec6ff1f18..f362c5562766 100644
--- a/js/apps/admin-ui/src/realm-settings/themes/ThemeColors.tsx
+++ b/js/apps/admin-ui/src/realm-settings/themes/ThemeColors.tsx
@@ -2,7 +2,6 @@ import RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmR
 import { TextControl } from "@keycloak/keycloak-ui-shared";
 import {
   Alert,
-  Button,
   Flex,
   FlexItem,
   FormGroup,
@@ -23,11 +22,14 @@ import {
 import { useTranslation } from "react-i18next";
 import { FixedButtonsGroup } from "../../components/form/FixedButtonGroup";
 import { FormAccess } from "../../components/form/FormAccess";
+import useToggle from "../../utils/useToggle";
+import { FileNameDialog } from "./FileNameDialog";
 import { ImageUpload } from "./ImageUpload";
 import { usePreviewLogo } from "./LogoContext";
 import { darkTheme, lightTheme } from "./PatternflyVars";
 import { PreviewWindow } from "./PreviewWindow";
 import { ThemeRealmRepresentation } from "./ThemesTab";
+import { UploadJar } from "./UploadJar";
 
 type ThemeType = "light" | "dark";
 
@@ -81,6 +83,7 @@ export const ThemeColors = ({ realm, save, theme }: ThemeColorsProps) => {
   const { handleSubmit, watch } = form;
   const style = watch();
   const contextLogo = usePreviewLogo();
+  const [open, toggle, setOpen] = useToggle();
 
   const mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
   const mapping = useMemo(
@@ -101,20 +104,24 @@ export const ThemeColors = ({ realm, save, theme }: ThemeColorsProps) => {
   };
 
   const setupForm = () => {
-    const values = JSON.parse(realm.attributes?.style || "{}");
-    if (values[theme]) {
-      form.reset(values);
-    } else {
-      reset();
-    }
+    reset();
+  };
+
+  const upload = (values: ThemeRealmRepresentation) => {
+    form.setValue("bgimage", values.bgimage);
+    form.setValue("favicon", values.favicon);
+    form.setValue("logo", values.logo);
+    form.reset(values);
   };
 
   const convert = (values: Record<string, File | string>) => {
     const styles = JSON.parse(realm.attributes?.style || "{}");
     save({
       ...realm,
+      favicon: values.favicon as File,
       logo: values.logo as File,
       bgimage: values.bgimage as File,
+      fileName: values.name as string,
       attributes: {
         ...realm.attributes,
         style: JSON.stringify({
@@ -134,51 +141,63 @@ export const ThemeColors = ({ realm, save, theme }: ThemeColorsProps) => {
   }, [realm]);
 
   return (
-    <PageSection variant="light">
-      <TextContent className="pf-v5-u-mb-lg">
-        <Text>{t("themeColorInfo")}</Text>
-      </TextContent>
-      {mediaQuery.matches && theme === "light" && (
-        <Alert variant="info" isInline title={t("themePreviewInfo")} />
+    <>
+      {open && (
+        <FileNameDialog
+          onSave={async (name) => {
+            await handleSubmit((data) => convert({ ...data, name }))();
+            setOpen(false);
+          }}
+          onClose={toggle}
+        />
       )}
-      <Flex className="pf-v5-u-pt-lg">
-        <FlexItem>
-          <FormAccess isHorizontal role="manage-realm">
-            <FormProvider {...form}>
-              <FormGroup label={t("logo")}>
-                <ImageUpload
-                  name="logo"
-                  onChange={(logo) => contextLogo?.setLogo(logo)}
-                />
-              </FormGroup>
-              <FormGroup label={t("backgroundImage")}>
-                <ImageUpload name="bgimage" />
-              </FormGroup>
-              {mapping.map((m) => (
-                <ColorControl
-                  key={m.name}
-                  color={m.defaultValue!}
-                  name={`${theme}.${m.variable!}`}
-                  label={m.name}
-                />
-              ))}
-            </FormProvider>
-          </FormAccess>
-        </FlexItem>
-        <FlexItem grow={{ default: "grow" }} style={{ zIndex: 0 }}>
-          <PreviewWindow cssVars={style?.[theme] || {}} />
-        </FlexItem>
-      </Flex>
-      <FixedButtonsGroup
-        name="colors"
-        saveText={t("downloadThemeJar")}
-        save={handleSubmit(convert)}
-        reset={setupForm}
-      >
-        <Button type="button" variant="link" onClick={reset}>
-          {t("defaults")}
-        </Button>
-      </FixedButtonsGroup>
-    </PageSection>
+      <PageSection variant="light">
+        <TextContent className="pf-v5-u-mb-lg">
+          <Text>{t("themeColorInfo")}</Text>
+        </TextContent>
+        {mediaQuery.matches && theme === "light" && (
+          <Alert variant="info" isInline title={t("themePreviewInfo")} />
+        )}
+        <Flex className="pf-v5-u-pt-lg">
+          <FlexItem>
+            <FormAccess isHorizontal role="manage-realm">
+              <FormProvider {...form}>
+                <FormGroup label={t("favicon")}>
+                  <ImageUpload name="favicon" />
+                </FormGroup>
+                <FormGroup label={t("logo")}>
+                  <ImageUpload
+                    name="logo"
+                    onChange={(logo) => contextLogo?.setLogo(logo)}
+                  />
+                </FormGroup>
+                <FormGroup label={t("backgroundImage")}>
+                  <ImageUpload name="bgimage" />
+                </FormGroup>
+                {mapping.map((m) => (
+                  <ColorControl
+                    key={m.name}
+                    color={m.defaultValue!}
+                    name={`${theme}.${m.variable!}`}
+                    label={m.name}
+                  />
+                ))}
+              </FormProvider>
+            </FormAccess>
+          </FlexItem>
+          <FlexItem grow={{ default: "grow" }} style={{ zIndex: 0 }}>
+            <PreviewWindow cssVars={style?.[theme] || {}} />
+          </FlexItem>
+        </Flex>
+        <FixedButtonsGroup
+          name="colors"
+          saveText={t("downloadThemeJar")}
+          save={toggle}
+          reset={setupForm}
+        >
+          <UploadJar onUpload={upload} />
+        </FixedButtonsGroup>
+      </PageSection>
+    </>
   );
 };
diff --git a/js/apps/admin-ui/src/realm-settings/themes/ThemesTab.tsx b/js/apps/admin-ui/src/realm-settings/themes/ThemesTab.tsx
index 5c56728539be..76f5185f8ca8 100644
--- a/js/apps/admin-ui/src/realm-settings/themes/ThemesTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/themes/ThemesTab.tsx
@@ -21,6 +21,8 @@ type ThemesTabProps = {
 };
 
 export type ThemeRealmRepresentation = RealmRepresentation & {
+  fileName?: string;
+  favicon?: File;
   logo?: File;
   bgimage?: File;
 };
@@ -35,14 +37,16 @@ export default function ThemesTab({ realm, save }: ThemesTabProps) {
     const zip = new JSZip();
 
     const styles = JSON.parse(realm.attributes?.style ?? "{}");
-
-    const { logo, bgimage, ...rest } = realm;
+    const { favicon, logo, bgimage, fileName } = realm;
 
     const logoName =
       "img/logo" + logo?.name?.substring(logo?.name?.lastIndexOf("."));
     const bgimageName =
       "img/bgimage" + bgimage?.name?.substring(bgimage?.name?.lastIndexOf("."));
 
+    if (favicon) {
+      zip.file(`theme/quick-theme/common/resources/img/favicon.ico`, favicon);
+    }
     if (logo) {
       zip.file(`theme/quick-theme/common/resources/${logoName}`, logo);
     }
@@ -56,7 +60,7 @@ export default function ThemesTab({ realm, save }: ThemesTabProps) {
 parent=keycloak.v2
 import=common/quick-theme
 
-logo=${logoName}
+${logo ? "logo=" + logoName : ""}
 styles=css/theme-styles.css
 `,
     );
@@ -67,7 +71,7 @@ styles=css/theme-styles.css
 parent=keycloak.v3
 import=common/quick-theme
 
-logo=${logoName}
+${logo ? "logo=" + logoName : ""}
 styles=css/theme-styles.css
 `,
     );
@@ -92,6 +96,20 @@ styles=css/login.css css/theme-styles.css
 }`,
     );
 
+    zip.file(
+      "theme-settings.json",
+      JSON.stringify({
+        ...styles,
+        logo: logo ? `theme/quick-theme/common/resources/${logoName}` : "",
+        bgimage: bgimage
+          ? `theme/quick-theme/common/resources/${bgimageName}`
+          : "",
+        favicon: favicon
+          ? "theme/quick-theme/common/resources/img/favicon.ico"
+          : "",
+      }),
+    );
+
     const toCss = (obj?: object) =>
       Object.entries(obj || {})
         .map(([key, value]) => `--pf-v5-global--${key}: ${value};`)
@@ -116,22 +134,11 @@ styles=css/login.css css/theme-styles.css
       }
       `,
     );
-    save({
-      ...rest,
-      attributes: {
-        ...rest.attributes,
-        style: JSON.stringify({
-          ...styles,
-          logo: logoName,
-          bgimage: bgimageName,
-        }),
-      },
-    });
-    zip.generateAsync({ type: "blob" }).then((content) => {
+    await zip.generateAsync({ type: "blob" }).then((content) => {
       const url = URL.createObjectURL(content);
       const a = document.createElement("a");
       a.href = url;
-      a.download = "quick-theme.jar";
+      a.download = fileName || "quick-theme.jar";
       a.click();
       URL.revokeObjectURL(url);
     });
diff --git a/js/apps/admin-ui/src/realm-settings/themes/UploadJar.tsx b/js/apps/admin-ui/src/realm-settings/themes/UploadJar.tsx
new file mode 100644
index 000000000000..2b06e6ef35eb
--- /dev/null
+++ b/js/apps/admin-ui/src/realm-settings/themes/UploadJar.tsx
@@ -0,0 +1,54 @@
+import { Button } from "@patternfly/react-core";
+import JSZip from "jszip";
+import { ChangeEvent } from "react";
+import { useTranslation } from "react-i18next";
+import { ThemeRealmRepresentation } from "./ThemesTab";
+
+type UploadJarProps = {
+  onUpload: (theme: ThemeRealmRepresentation) => void;
+};
+
+export const UploadJar = ({ onUpload }: UploadJarProps) => {
+  const { t } = useTranslation();
+
+  const triggerUpload = () => {
+    const input = document.getElementById("jarUpload") as HTMLInputElement;
+    if (input) {
+      input.click();
+    }
+  };
+
+  const handleAcceptedFiles = async (files: ChangeEvent<HTMLInputElement>) => {
+    const file = files.target.files?.[0];
+    if (!file) {
+      return;
+    }
+
+    const jsZip = new JSZip();
+    const zipFile = await jsZip.loadAsync(file);
+    const themeFile = await zipFile
+      .file("theme-settings.json")
+      ?.async("string");
+
+    const theme = JSON.parse(themeFile || "{}");
+    theme.bgimage = await zipFile.file(theme.bgimage)?.async("blob");
+    theme.favicon = await zipFile.file(theme.favicon)?.async("blob");
+    theme.logo = await zipFile.file(theme.logo)?.async("blob");
+    onUpload(theme);
+  };
+
+  return (
+    <>
+      <input
+        id="jarUpload"
+        type="file"
+        accept=".jar"
+        style={{ display: "none" }}
+        onChange={(acceptedFiles) => handleAcceptedFiles(acceptedFiles)}
+      />
+      <Button variant="secondary" onClick={triggerUpload}>
+        {t("uploadGeneratedThemeJar")}
+      </Button>
+    </>
+  );
+};
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/AttributesGroupTab.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/AttributesGroupTab.tsx
index 92ce3b46019f..48d017efc94a 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/AttributesGroupTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/AttributesGroupTab.tsx
@@ -104,7 +104,7 @@ export const AttributesGroupTab = ({
           }),
         );
 
-        save(
+        await save(
           { ...config, groups },
           {
             successMessageKey: "deleteSuccess",
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/AttributesTab.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/AttributesTab.tsx
index 9b10490fd12e..097432497416 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/AttributesTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/AttributesTab.tsx
@@ -102,7 +102,7 @@ export const AttributesTab = ({ setTableData }: AttributesTabProps) => {
           (attribute) => attribute.name !== attributeToDelete,
         );
 
-        save(
+        await save(
           { ...config, attributes: updatedAttributes, groups: config.groups },
           {
             successMessageKey: "deleteAttributeSuccess",
@@ -139,7 +139,7 @@ export const AttributesTab = ({ setTableData }: AttributesTabProps) => {
     attributes.splice(fromIndex, 1);
     attributes.splice(newIndex, 0, movedAttribute);
 
-    save(
+    await save(
       { attributes, groups },
       {
         successMessageKey: "updatedUserProfileSuccess",
@@ -228,7 +228,7 @@ export const AttributesTab = ({ setTableData }: AttributesTabProps) => {
           const dragged = attributes[oldIndex];
           if (!dragged.name) return;
 
-          executeMove(dragged, newIndex);
+          await executeMove(dragged, newIndex);
         }}
         actions={[
           {
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/JsonEditorTab.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/JsonEditorTab.tsx
index d23d0cc0a282..3cd08f73306d 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/JsonEditorTab.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/JsonEditorTab.tsx
@@ -1,6 +1,6 @@
 import { useAlerts } from "@keycloak/keycloak-ui-shared";
 import { ActionGroup, Button, Form, PageSection } from "@patternfly/react-core";
-import CodeEditor from "@uiw/react-textarea-code-editor";
+import CodeEditor from "../../components/form/CodeEditor";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { prettyPrintJSON } from "../../util";
@@ -36,8 +36,8 @@ export const JsonEditorTab = () => {
       <CodeEditor
         language="json"
         value={code}
-        style={{ height: "30rem", overflow: "scroll" }}
-        onChange={(event) => setCode(event.target.value ?? "")}
+        onChange={(value) => setCode(value ?? "")}
+        height={480}
       />
       <Form>
         <ActionGroup>
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AddTranslationsDialog.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AddTranslationsDialog.tsx
index c8e6da350aab..572d2b401e7c 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AddTranslationsDialog.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AddTranslationsDialog.tsx
@@ -21,7 +21,7 @@ import { SearchIcon } from "@patternfly/react-icons";
 import { Table, Tbody, Td, Th, Thead, Tr } from "@patternfly/react-table";
 import { useState } from "react";
 import { useFormContext } from "react-hook-form";
-import { useTranslation } from "react-i18next";
+import { Trans, useTranslation } from "react-i18next";
 import { useAdminClient } from "../../../admin-client";
 import { useRealm } from "../../../context/realm-context/RealmContext";
 import { useWhoAmI } from "../../../context/whoami/WhoAmI";
@@ -30,15 +30,19 @@ import useLocale from "../../../utils/useLocale";
 import { Translation, TranslationForm } from "./TranslatableField";
 
 type AddTranslationsDialogProps = {
+  orgKey: string;
   translationKey: string;
   fieldName: string;
   toggleDialog: () => void;
+  predefinedAttributes?: string[];
 };
 
 export const AddTranslationsDialog = ({
+  orgKey,
   translationKey,
   fieldName,
   toggleDialog,
+  predefinedAttributes,
 }: AddTranslationsDialogProps) => {
   const { adminClient } = useAdminClient();
   const { t } = useTranslation();
@@ -62,7 +66,12 @@ export const AddTranslationsDialog = ({
     translation[translationKey].forEach((translation, rowIndex) => {
       const valueKey = `${prefix}.${rowIndex}.value`;
       setValue(`${prefix}.${rowIndex}.locale`, translation.locale || "");
-      setValue(valueKey, getValues(valueKey) || translation.value);
+      setValue(
+        valueKey,
+        getValues(valueKey) ||
+          translation.value ||
+          (t(orgKey) !== orgKey ? t(orgKey) : ""),
+      );
     });
   };
 
@@ -132,12 +141,13 @@ export const AddTranslationsDialog = ({
         spaceItems={{ default: "spaceItemsNone" }}
       >
         <FlexItem>
-          <TextContent>
-            <Text component={TextVariants.p}>
-              {t("addTranslationsModalSubTitle", { fieldName })}
-              <strong>{t("addTranslationsModalSubTitleBolded")}</strong>
-            </Text>
-          </TextContent>
+          <Trans
+            i18nKey="addTranslationsModalTitle"
+            values={{ fieldName: t(fieldName) }}
+          >
+            You are able to translate the fieldName based on your locale or
+            <strong>location</strong>
+          </Trans>
         </FlexItem>
         <FlexItem>
           <Form id="add-translation" data-testid="addTranslationForm">
@@ -147,7 +157,11 @@ export const AddTranslationsDialog = ({
                 label={t("translationKey")}
                 data-testid="translation-key"
                 isDisabled
-                value={translationKey}
+                value={
+                  predefinedAttributes?.includes(orgKey)
+                    ? `\${${orgKey}}`
+                    : `\${${translationKey}}`
+                }
               />
             </FormGroup>
             <FlexItem>
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeAnnotations.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeAnnotations.tsx
index ac5fc5ed6f2e..bccab24f4be3 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeAnnotations.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeAnnotations.tsx
@@ -1,13 +1,16 @@
+import { FormGroup, Grid, GridItem, TextInput } from "@patternfly/react-core";
+import { useFormContext } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import { FormGroup, Grid, GridItem } from "@patternfly/react-core";
-
 import { FormAccess } from "../../../components/form/FormAccess";
 import { KeyValueInput } from "../../../components/key-value-form/KeyValueInput";
+import { KeySelect } from "./KeySelect";
+import { ValueSelect } from "./ValueSelect";
 
 import "../../realm-settings-section.css";
 
 export const AttributeAnnotations = () => {
   const { t } = useTranslation();
+  const { register } = useFormContext();
 
   return (
     <FormAccess role="manage-realm" isHorizontal>
@@ -22,70 +25,90 @@ export const AttributeAnnotations = () => {
             <KeyValueInput
               name="annotations"
               label={t("annotations")}
-              defaultKeyValue={[
-                {
-                  key: "inputType",
-                  label: t("inputType"),
-                  values: [
-                    "text",
-                    "textarea",
-                    "select",
-                    "select-radiobuttons",
-                    "multiselect",
-                    "multiselect-checkboxes",
-                    "html5-email",
-                    "html5-tel",
-                    "html5-url",
-                    "html5-number",
-                    "html5-range",
-                    "html5-datetime-local",
-                    "html5-date",
-                    "html5-month",
-                    "html5-week",
-                    "html5-time",
-                  ],
-                },
-                {
-                  key: "inputHelperTextBefore",
-                  label: t("inputHelperTextBefore"),
-                },
-                {
-                  key: "inputHelperTextAfter",
-                  label: t("inputHelperTextAfter"),
-                },
-                {
-                  key: "inputOptionLabelsI18nPrefix",
-                  label: t("inputOptionLabelsI18nPrefix"),
-                },
-                {
-                  key: "inputTypePlaceholder",
-                  label: t("inputTypePlaceholder"),
-                },
-                {
-                  key: "inputTypeSize",
-                  label: t("inputTypeSize"),
-                },
-                {
-                  key: "inputTypeCols",
-                  label: t("inputTypeCols"),
-                },
-                {
-                  key: "inputTypeRows",
-                  label: t("inputTypeRows"),
-                },
-                {
-                  key: "inputTypeStep",
-                  label: t("inputTypeStep"),
-                },
-                {
-                  key: "kcNumberFormat",
-                  label: t("kcNumberFormat"),
-                },
-                {
-                  key: "kcNumberUnFormat",
-                  label: t("kcNumberUnFormat"),
-                },
-              ]}
+              KeyComponent={(props) => (
+                <KeySelect
+                  {...props}
+                  selectItems={[
+                    {
+                      key: "inputType",
+                      value: t("inputType"),
+                    },
+                    {
+                      key: "inputHelperTextBefore",
+                      value: t("inputHelperTextBefore"),
+                    },
+                    {
+                      key: "inputHelperTextAfter",
+                      value: t("inputHelperTextAfter"),
+                    },
+                    {
+                      key: "inputOptionLabelsI18nPrefix",
+                      value: t("inputOptionLabelsI18nPrefix"),
+                    },
+                    {
+                      key: "inputTypePlaceholder",
+                      value: t("inputTypePlaceholder"),
+                    },
+                    {
+                      key: "inputTypeSize",
+                      value: t("inputTypeSize"),
+                    },
+                    {
+                      key: "inputTypeCols",
+                      value: t("inputTypeCols"),
+                    },
+                    {
+                      key: "inputTypeRows",
+                      value: t("inputTypeRows"),
+                    },
+                    {
+                      key: "inputTypeStep",
+                      value: t("inputTypeStep"),
+                    },
+                    {
+                      key: "kcNumberFormat",
+                      value: t("kcNumberFormat"),
+                    },
+                    {
+                      key: "kcNumberUnFormat",
+                      value: t("kcNumberUnFormat"),
+                    },
+                  ]}
+                />
+              )}
+              ValueComponent={(props) =>
+                props.keyValue === "inputType" ? (
+                  <ValueSelect
+                    selectItems={[
+                      "text",
+                      "textarea",
+                      "select",
+                      "select-radiobuttons",
+                      "multiselect",
+                      "multiselect-checkboxes",
+                      "html5-email",
+                      "html5-tel",
+                      "html5-url",
+                      "html5-number",
+                      "html5-range",
+                      "html5-datetime-local",
+                      "html5-date",
+                      "html5-month",
+                      "html5-week",
+                      "html5-time",
+                    ]}
+                    rules={{ required: true }}
+                    {...props}
+                  />
+                ) : (
+                  <TextInput
+                    aria-label={t("customValue")}
+                    data-testid={props.name}
+                    {...props}
+                    {...register(props.name)}
+                  />
+                )
+              }
             />
           </GridItem>
         </Grid>
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeGeneralSettings.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeGeneralSettings.tsx
index ed6dc752d8cf..9e911330a5d6 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeGeneralSettings.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/AttributeGeneralSettings.tsx
@@ -34,6 +34,7 @@ import { AttributeParams } from "../../routes/Attribute";
 import { TranslatableField } from "./TranslatableField";
 
 import "../../realm-settings-section.css";
+import useLocaleSort, { mapByKey } from "../../../utils/useLocaleSort";
 
 const REQUIRED_FOR = [
   { label: "requiredForLabel.both", value: ["admin", "user"] },
@@ -50,6 +51,10 @@ export const AttributeGeneralSettings = () => {
   const [config, setConfig] = useState<UserProfileConfig>();
   const [selectEnabledWhenOpen, setSelectEnabledWhenOpen] = useState(false);
   const [selectRequiredForOpen, setSelectRequiredForOpen] = useState(false);
+
+  const [enabledWhenSearch, setEnableWhenSearch] = useState("");
+  const localeSort = useLocaleSort();
+
   const { attributeName } = useParams<AttributeParams>();
   const editMode = attributeName ? true : false;
 
@@ -84,6 +89,17 @@ export const AttributeGeneralSettings = () => {
     form.setValue("hasRequiredScopes", hasRequiredScopes);
   }
 
+  const items = () =>
+    localeSort(clientScopes, mapByKey("name"))
+      .filter(
+        (s) => enabledWhenSearch === "" || s.name?.includes(enabledWhenSearch),
+      )
+      .map((option) => (
+        <SelectOption key={option.name} value={option.name}>
+          {option.name}
+        </SelectOption>
+      ));
+
   return (
     <FormProvider {...form}>
       <FormAccess role="manage-realm" isHorizontal>
@@ -110,6 +126,12 @@ export const AttributeGeneralSettings = () => {
             attributeName="name"
             prefix="profile.attributes"
             fieldName="displayName"
+            predefinedAttributes={[
+              "username",
+              "email",
+              "firstName",
+              "lastName",
+            ]}
           />
         </FormGroup>
         <DefaultSwitchControl
@@ -175,6 +197,10 @@ export const AttributeGeneralSettings = () => {
                     <KeycloakSelect
                       data-testid="enabled-when-scope-field"
                       variant={SelectVariant.typeaheadMulti}
+                      onFilter={(value) => {
+                        setEnableWhenSearch(value);
+                        return items();
+                      }}
                       typeAheadAriaLabel="Select"
                       chipGroupProps={{
                         numChips: 3,
@@ -204,11 +230,7 @@ export const AttributeGeneralSettings = () => {
                       isOpen={selectEnabledWhenOpen}
                       aria-labelledby={"scope"}
                     >
-                      {clientScopes.map((option) => (
-                        <SelectOption key={option.name} value={option.name}>
-                          {option.name}
-                        </SelectOption>
-                      ))}
+                      {items()}
                     </KeycloakSelect>
                   )}
                 />
diff --git a/js/apps/admin-ui/src/components/key-value-form/KeySelect.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/KeySelect.tsx
similarity index 88%
rename from js/apps/admin-ui/src/components/key-value-form/KeySelect.tsx
rename to js/apps/admin-ui/src/realm-settings/user-profile/attribute/KeySelect.tsx
index 349dc3a37d5f..96546a9966a0 100644
--- a/js/apps/admin-ui/src/components/key-value-form/KeySelect.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/KeySelect.tsx
@@ -1,4 +1,7 @@
-import { KeycloakSelect } from "@keycloak/keycloak-ui-shared";
+import {
+  KeycloakSelect,
+  SelectControlOption,
+} from "@keycloak/keycloak-ui-shared";
 import {
   Grid,
   GridItem,
@@ -8,11 +11,10 @@ import {
 import { useState } from "react";
 import { UseControllerProps, useController } from "react-hook-form";
 import { useTranslation } from "react-i18next";
-import useToggle from "../../utils/useToggle";
-import { DefaultValue } from "./KeyValueInput";
+import useToggle from "../../../utils/useToggle";
 
 type KeySelectProp = UseControllerProps & {
-  selectItems: DefaultValue[];
+  selectItems: SelectControlOption[];
 };
 
 export const KeySelect = ({ selectItems, ...rest }: KeySelectProp) => {
@@ -44,7 +46,7 @@ export const KeySelect = ({ selectItems, ...rest }: KeySelectProp) => {
             </SelectOption>,
             ...selectItems.map((item) => (
               <SelectOption key={item.key} value={item.key}>
-                {item.label}
+                {item.value}
               </SelectOption>
             )),
           ]}
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/TranslatableField.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/TranslatableField.tsx
index b71e3dea922e..bc1f577aff6e 100644
--- a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/TranslatableField.tsx
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/TranslatableField.tsx
@@ -1,4 +1,5 @@
 import KeycloakAdminClient from "@keycloak/keycloak-admin-client";
+import RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
 import { FormErrorText } from "@keycloak/keycloak-ui-shared";
 import {
   Alert,
@@ -9,9 +10,10 @@ import {
   TextInput,
 } from "@patternfly/react-core";
 import { GlobeRouteIcon } from "@patternfly/react-icons";
-import { useEffect, useRef } from "react";
+import { TFunction } from "i18next";
+import { useEffect } from "react";
 import { useFormContext, useWatch } from "react-hook-form";
-import { useTranslation } from "react-i18next";
+import { Trans, useTranslation } from "react-i18next";
 import { useRealm } from "../../../context/realm-context/RealmContext";
 import { i18n } from "../../../i18n/i18n";
 import { beerify, debeerify } from "../../../util";
@@ -65,17 +67,30 @@ type TranslatableFieldProps = {
   attributeName: string;
   prefix: string;
   fieldName: string;
+  predefinedAttributes?: string[];
 };
 
+function hasTranslation(value: string, t: TFunction) {
+  return t(value) === value && value !== "";
+}
+
+function isTranslationRequired(
+  value: string,
+  t: TFunction,
+  realm?: RealmRepresentation,
+) {
+  return realm?.internationalizationEnabled && hasTranslation(value, t);
+}
+
 export const TranslatableField = ({
   attributeName,
   prefix,
   fieldName,
+  predefinedAttributes,
 }: TranslatableFieldProps) => {
   const { t } = useTranslation();
   const { realmRepresentation: realm } = useRealm();
-  const { register, control, setValue, setError, getFieldState, clearErrors } =
-    useFormContext();
+  const { register, control, getFieldState, setValue } = useFormContext();
   const [open, toggle] = useToggle();
 
   const value = useWatch({ control, name: attributeName });
@@ -84,37 +99,30 @@ export const TranslatableField = ({
   const translationPrefix = `translation.${beerify(key)}`;
   const requiredTranslationName = `${translationPrefix}.0.value`;
 
-  const requiredTranslationValue = useWatch({
-    control,
-    name: requiredTranslationName,
-  });
-
-  const ref = useRef(requiredTranslationName);
-
   useEffect(() => {
-    if (realm?.internationalizationEnabled) {
-      clearErrors(ref.current);
-      if (!requiredTranslationValue && t(key) === key) {
-        setError(requiredTranslationName, {
-          message: t("required"),
-        });
-      }
-      ref.current = requiredTranslationName;
-
-      if (value !== "") {
-        setValue(fieldName, `\${${prefix}.${value}}`);
-      } else {
-        setValue(fieldName, "");
-      }
+    if (predefinedAttributes?.includes(value)) {
+      return;
+    }
+    if (realm?.internationalizationEnabled && value) {
+      setValue(fieldName, `\${${prefix}.${value}}`);
     }
-  }, [value, requiredTranslationValue]);
+  }, [value]);
 
   return (
     <>
+      {isTranslationRequired(value, t, realm) && (
+        <input
+          type="hidden"
+          data-testid="requiredTranslationName"
+          {...register(requiredTranslationName, { required: t("required") })}
+        />
+      )}
       {open && (
         <AddTranslationsDialog
+          orgKey={value}
           translationKey={`${prefix}.${value}`}
           fieldName={fieldName}
+          predefinedAttributes={predefinedAttributes}
           toggleDialog={toggle}
         />
       )}
@@ -146,11 +154,17 @@ export const TranslatableField = ({
             variant="info"
             isInline
             isPlain
-            title={t("addTranslationsModalSubTitle", {
-              fieldName: t(fieldName),
-            })}
+            title={
+              <Trans
+                i18nKey="addTranslationsModalSubTitle"
+                values={{ fieldName: t(fieldName) }}
+              >
+                You are able to translate the fieldName based on your locale or
+                <strong>location</strong>
+              </Trans>
+            }
           />
-          {getFieldState(`${translationPrefix}.0.value`).error && (
+          {getFieldState(requiredTranslationName).error && (
             <FormErrorText message={t("required")} />
           )}
         </FormHelperText>
diff --git a/js/apps/admin-ui/src/realm-settings/user-profile/attribute/ValueSelect.tsx b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/ValueSelect.tsx
new file mode 100644
index 000000000000..8a8d896e0912
--- /dev/null
+++ b/js/apps/admin-ui/src/realm-settings/user-profile/attribute/ValueSelect.tsx
@@ -0,0 +1,34 @@
+import { KeycloakSelect } from "@keycloak/keycloak-ui-shared";
+import { SelectOption } from "@patternfly/react-core";
+import { useState } from "react";
+import { UseControllerProps, useController } from "react-hook-form";
+import { useTranslation } from "react-i18next";
+
+type ValueSelectProps = UseControllerProps & {
+  selectItems: string[];
+};
+
+export const ValueSelect = ({ selectItems, ...rest }: ValueSelectProps) => {
+  const { t } = useTranslation();
+  const { field } = useController(rest);
+  const [open, setOpen] = useState(false);
+
+  return (
+    <KeycloakSelect
+      onToggle={(isOpen) => setOpen(isOpen)}
+      isOpen={open}
+      onSelect={(value) => {
+        field.onChange(value);
+        setOpen(false);
+      }}
+      selections={field.value ? [field.value] : t("choose")}
+      placeholderText={t("valuePlaceholder")}
+    >
+      {selectItems.map((item) => (
+        <SelectOption key={item} value={item}>
+          {item}
+        </SelectOption>
+      ))}
+    </KeycloakSelect>
+  );
+};
diff --git a/js/apps/admin-ui/src/realm/RealmRoutes.tsx b/js/apps/admin-ui/src/realm/RealmRoutes.tsx
new file mode 100644
index 000000000000..7ab415fedd46
--- /dev/null
+++ b/js/apps/admin-ui/src/realm/RealmRoutes.tsx
@@ -0,0 +1,21 @@
+import { lazy } from "react";
+import type { Path } from "react-router-dom";
+import { generateEncodedPath } from "../utils/generateEncodedPath";
+import type { AppRouteObject } from "../routes";
+
+export type RealmParams = { realm: string };
+
+const RealmSection = lazy(() => import("./RealmSection"));
+
+export const RealmRoute: AppRouteObject = {
+  path: "/:realm/realms",
+  element: <RealmSection />,
+  breadcrumb: (t) => t("realms"),
+  handle: {
+    access: "anyone",
+  },
+};
+
+export const toRealm = (params: RealmParams): Partial<Path> => ({
+  pathname: generateEncodedPath(RealmRoute.path, params),
+});
diff --git a/js/apps/admin-ui/src/realm/RealmSection.tsx b/js/apps/admin-ui/src/realm/RealmSection.tsx
new file mode 100644
index 000000000000..1ae465c1b646
--- /dev/null
+++ b/js/apps/admin-ui/src/realm/RealmSection.tsx
@@ -0,0 +1,260 @@
+import { NetworkError } from "@keycloak/keycloak-admin-client";
+import { KeycloakDataTable, useAlerts } from "@keycloak/keycloak-ui-shared";
+import {
+  AlertVariant,
+  Badge,
+  Button,
+  Dropdown,
+  DropdownItem,
+  DropdownList,
+  MenuToggle,
+  PageSection,
+  Popover,
+  ToolbarItem,
+} from "@patternfly/react-core";
+import { EllipsisVIcon } from "@patternfly/react-icons";
+import { cellWidth } from "@patternfly/react-table";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Link, useNavigate } from "react-router-dom";
+import { useAdminClient } from "../admin-client";
+import { useConfirmDialog } from "../components/confirm-dialog/ConfirmDialog";
+import { ViewHeader } from "../components/view-header/ViewHeader";
+import { fetchAdminUI } from "../context/auth/admin-ui-endpoint";
+import { useRealm } from "../context/realm-context/RealmContext";
+import { useRecentRealms } from "../context/RecentRealms";
+import { useWhoAmI } from "../context/whoami/WhoAmI";
+import { translationFormatter } from "../utils/translationFormatter";
+import NewRealmForm from "./add/NewRealmForm";
+import { toRealm } from "./RealmRoutes";
+import { toDashboard } from "../dashboard/routes/Dashboard";
+
+export type RealmNameRepresentation = {
+  name: string;
+  displayName?: string;
+};
+
+const RecentRealmsDropdown = () => {
+  const { t } = useTranslation();
+  const [open, setOpen] = useState(false);
+  const recentRealms = useRecentRealms();
+
+  if (recentRealms.length < 3) return null;
+  return (
+    <Dropdown
+      shouldFocusToggleOnSelect
+      onOpenChange={(isOpen) => setOpen(isOpen)}
+      toggle={(ref) => (
+        <MenuToggle
+          data-testid="kebab"
+          aria-label="Kebab toggle"
+          ref={ref}
+          onClick={() => setOpen(!open)}
+        >
+          {t("recentRealms")}
+        </MenuToggle>
+      )}
+      isOpen={open}
+    >
+      <DropdownList>
+        {recentRealms.map(({ name }) => (
+          <DropdownItem
+            key="server info"
+            component={(props) => (
+              <Link {...props} to={toDashboard({ realm: name })} />
+            )}
+          >
+            {name}
+          </DropdownItem>
+        ))}
+      </DropdownList>
+    </Dropdown>
+  );
+};
+
+type KebabDropdownProps = {
+  onClick: () => void;
+  isDisabled?: boolean;
+};
+
+const KebabDropdown = ({ onClick, isDisabled }: KebabDropdownProps) => {
+  const { t } = useTranslation();
+  const [open, setOpen] = useState(false);
+  return (
+    <Dropdown
+      shouldFocusToggleOnSelect
+      onOpenChange={(isOpen) => setOpen(isOpen)}
+      toggle={(ref) => (
+        <MenuToggle
+          data-testid="kebab"
+          aria-label="Kebab toggle"
+          ref={ref}
+          onClick={() => setOpen(!open)}
+          variant="plain"
+          isDisabled={isDisabled}
+        >
+          <EllipsisVIcon />
+        </MenuToggle>
+      )}
+      isOpen={open}
+    >
+      <DropdownList>
+        <DropdownItem
+          data-testid="delete"
+          onClick={() => {
+            setOpen(false);
+            onClick();
+          }}
+        >
+          {t("delete")}
+        </DropdownItem>
+      </DropdownList>
+    </Dropdown>
+  );
+};
+
+type RealmRow = RealmNameRepresentation & { id: string };
+
+export default function RealmSection() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const { whoAmI } = useWhoAmI();
+  const { realm } = useRealm();
+  const { adminClient } = useAdminClient();
+  const { addAlert, addError } = useAlerts();
+
+  const [selected, setSelected] = useState<RealmRow[]>([]);
+  const [openNewRealm, setOpenNewRealm] = useState(false);
+  const [key, setKey] = useState(0);
+  const refresh = () => setKey(key + 1);
+
+  const loader = async (first?: number, max?: number, search?: string) => {
+    try {
+      const result = await fetchAdminUI<RealmNameRepresentation[]>(
+        adminClient,
+        "ui-ext/realms/names",
+        { first: `${first}`, max: `${max}`, search: search || "" },
+      );
+      return result.map((r) => ({ ...r, id: r.name }));
+    } catch (error) {
+      if (error instanceof NetworkError && error.response.status < 500) {
+        return [];
+      }
+
+      throw error;
+    }
+  };
+
+  const [toggleDeleteDialog, DeleteConfirm] = useConfirmDialog({
+    titleKey: t("deleteConfirmRealm", {
+      count: selected.length,
+      name: selected[0]?.name,
+    }),
+    messageKey: "deleteConfirmRealmSetting",
+    continueButtonLabel: "delete",
+    onConfirm: async () => {
+      try {
+        if (selected.filter(({ name }) => name === "master").length > 0) {
+          addAlert(t("cantDeleteMasterRealm"), AlertVariant.warning);
+        }
+        const filtered = selected.filter(({ name }) => name !== "master");
+        if (filtered.length === 0) return;
+        await Promise.all(
+          filtered.map(({ name: realmName }) =>
+            adminClient.realms.del({ realm: realmName }),
+          ),
+        );
+        addAlert(t("deletedSuccessRealmSetting"));
+        if (selected.filter(({ name }) => name === realm).length > 0) {
+          navigate(toRealm({ realm: "master" }));
+        }
+        refresh();
+        setSelected([]);
+      } catch (error) {
+        addError("deleteError", error);
+      }
+    },
+  });
+
+  return (
+    <>
+      <DeleteConfirm />
+      {openNewRealm && (
+        <NewRealmForm
+          onClose={() => {
+            setOpenNewRealm(false);
+            refresh();
+          }}
+        />
+      )}
+      <ViewHeader titleKey="manageRealms" divider={false} />
+      <PageSection variant="light" className="pf-v5-u-p-0">
+        <KeycloakDataTable
+          key={key}
+          loader={loader}
+          isPaginated
+          onSelect={setSelected}
+          canSelectAll
+          ariaLabelKey="selectRealm"
+          searchPlaceholderKey="search"
+          actions={[
+            {
+              title: t("delete"),
+              onRowClick: (selected) => {
+                setSelected([selected]);
+                toggleDeleteDialog();
+              },
+            },
+          ]}
+          toolbarItem={
+            <>
+              <ToolbarItem>
+                {whoAmI.canCreateRealm() && (
+                  <Button
+                    onClick={() => setOpenNewRealm(true)}
+                    data-testid="add-realm"
+                  >
+                    {t("createRealm")}
+                  </Button>
+                )}
+              </ToolbarItem>
+              <ToolbarItem>
+                <RecentRealmsDropdown />
+              </ToolbarItem>
+              <ToolbarItem>
+                <KebabDropdown
+                  onClick={toggleDeleteDialog}
+                  isDisabled={selected.length === 0}
+                />
+              </ToolbarItem>
+            </>
+          }
+          columns={[
+            {
+              name: "name",
+              transforms: [cellWidth(20)],
+              cellRenderer: ({ name }) =>
+                name !== realm ? (
+                  <Link to={toDashboard({ realm: name })}>{name}</Link>
+                ) : (
+                  <Popover
+                    bodyContent={t("currentRealmExplain")}
+                    triggerAction="hover"
+                  >
+                    <>
+                      {name} <Badge isRead>{t("currentRealm")}</Badge>
+                    </>
+                  </Popover>
+                ),
+            },
+            {
+              name: "displayName",
+              transforms: [cellWidth(80)],
+              cellFormatters: [translationFormatter(t)],
+            },
+          ]}
+        />
+      </PageSection>
+    </>
+  );
+}
diff --git a/js/apps/admin-ui/src/realm/add/NewRealmForm.tsx b/js/apps/admin-ui/src/realm/add/NewRealmForm.tsx
index 5e56903579a8..154860373cc0 100644
--- a/js/apps/admin-ui/src/realm/add/NewRealmForm.tsx
+++ b/js/apps/admin-ui/src/realm/add/NewRealmForm.tsx
@@ -1,21 +1,27 @@
 import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
-import { ActionGroup, Button, PageSection } from "@patternfly/react-core";
+import {
+  FormSubmitButton,
+  TextControl,
+  useAlerts,
+} from "@keycloak/keycloak-ui-shared";
+import { Button, Modal } from "@patternfly/react-core";
 import { useState } from "react";
 import { FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
-import { FormSubmitButton, TextControl } from "@keycloak/keycloak-ui-shared";
 import { useAdminClient } from "../../admin-client";
-import { DefaultSwitchControl } from "../../components/SwitchControl";
-import { useAlerts } from "@keycloak/keycloak-ui-shared";
 import { FormAccess } from "../../components/form/FormAccess";
 import { JsonFileUpload } from "../../components/json-file-upload/JsonFileUpload";
-import { ViewHeader } from "../../components/view-header/ViewHeader";
+import { DefaultSwitchControl } from "../../components/SwitchControl";
 import { useWhoAmI } from "../../context/whoami/WhoAmI";
-import { toDashboard } from "../../dashboard/routes/Dashboard";
 import { convertFormValuesToObject, convertToFormValues } from "../../util";
+import { toRealm } from "../RealmRoutes";
+
+type NewRealmFormProps = {
+  onClose: () => void;
+};
 
-export default function NewRealmForm() {
+export default function NewRealmForm({ onClose }: NewRealmFormProps) {
   const { adminClient } = useAdminClient();
 
   const { t } = useTranslation();
@@ -45,53 +51,66 @@ export default function NewRealmForm() {
       addAlert(t("saveRealmSuccess"));
 
       refresh();
-      navigate(toDashboard({ realm: fields.realm }));
+      onClose();
+      navigate(toRealm({ realm: fields.realm! }));
     } catch (error) {
       addError("saveRealmError", error);
     }
   };
 
   return (
-    <>
-      <ViewHeader titleKey="createRealm" subKey="realmExplain" />
-      <PageSection variant="light">
-        <FormProvider {...form}>
-          <FormAccess
-            isHorizontal
-            onSubmit={handleSubmit(save)}
-            role="view-realm"
-            isReadOnly={!whoAmI.canCreateRealm()}
-          >
-            <JsonFileUpload
-              id="kc-realm-filename"
-              allowEditingUploadedText
-              onChange={handleFileChange}
-            />
-            <TextControl
-              name="realm"
-              label={t("realmNameField")}
-              rules={{ required: t("required") }}
-            />
-            <DefaultSwitchControl
-              name="enabled"
-              label={t("enabled")}
-              defaultValue={true}
-            />
-            <ActionGroup>
-              <FormSubmitButton
-                formState={formState}
-                allowInvalid
-                allowNonDirty
-              >
-                {t("create")}
-              </FormSubmitButton>
-              <Button variant="link" onClick={() => navigate(-1)}>
-                {t("cancel")}
-              </Button>
-            </ActionGroup>
-          </FormAccess>
-        </FormProvider>
-      </PageSection>
-    </>
+    <Modal
+      variant="medium"
+      title={t("createRealm")}
+      description={t("realmExplain")}
+      onClose={onClose}
+      isOpen
+      actions={[
+        <FormSubmitButton
+          form="realm-form"
+          data-testid="create"
+          formState={formState}
+          allowInvalid
+          allowNonDirty
+          key="confirm"
+        >
+          {t("create")}
+        </FormSubmitButton>,
+        <Button
+          variant="link"
+          onClick={onClose}
+          key={"cancel"}
+          data-testid="cancel"
+        >
+          {t("cancel")}
+        </Button>,
+      ]}
+    >
+      <FormProvider {...form}>
+        <FormAccess
+          id="realm-form"
+          isHorizontal
+          onSubmit={handleSubmit(save)}
+          role="view-realm"
+          isReadOnly={!whoAmI.canCreateRealm()}
+        >
+          <JsonFileUpload
+            id="kc-realm-filename"
+            allowEditingUploadedText
+            onChange={handleFileChange}
+          />
+          <TextControl
+            name="realm"
+            label={t("realmNameField")}
+            rules={{ required: t("required") }}
+          />
+          <DefaultSwitchControl
+            name="enabled"
+            label={t("enabled")}
+            defaultValue={true}
+          />
+        </FormAccess>
+      </FormProvider>
+    </Modal>
   );
 }
diff --git a/js/apps/admin-ui/src/realm/routes.ts b/js/apps/admin-ui/src/realm/routes.ts
index d342100df6a6..0ebe1ddb93c9 100644
--- a/js/apps/admin-ui/src/realm/routes.ts
+++ b/js/apps/admin-ui/src/realm/routes.ts
@@ -1,6 +1,6 @@
 import type { AppRouteObject } from "../routes";
-import { AddRealmRoute } from "./routes/AddRealm";
+import { RealmRoute } from "./RealmRoutes";
 
-const routes: AppRouteObject[] = [AddRealmRoute];
+const routes: AppRouteObject[] = [RealmRoute];
 
 export default routes;
diff --git a/js/apps/admin-ui/src/realm/routes/AddRealm.tsx b/js/apps/admin-ui/src/realm/routes/AddRealm.tsx
deleted file mode 100644
index 6c3fe30c5f13..000000000000
--- a/js/apps/admin-ui/src/realm/routes/AddRealm.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { lazy } from "react";
-import type { Path } from "react-router-dom";
-import { generateEncodedPath } from "../../utils/generateEncodedPath";
-import type { AppRouteObject } from "../../routes";
-
-export type AddRealmParams = { realm: string };
-
-const NewRealmForm = lazy(() => import("../add/NewRealmForm"));
-
-export const AddRealmRoute: AppRouteObject = {
-  path: "/:realm/add-realm",
-  element: <NewRealmForm />,
-  breadcrumb: (t) => t("createRealm"),
-  handle: {
-    access: "view-realm",
-  },
-};
-
-export const toAddRealm = (params: AddRealmParams): Partial<Path> => ({
-  pathname: generateEncodedPath(AddRealmRoute.path, params),
-});
diff --git a/js/apps/admin-ui/src/routes.tsx b/js/apps/admin-ui/src/routes.tsx
index bf8763cd793a..737c9d0e9784 100644
--- a/js/apps/admin-ui/src/routes.tsx
+++ b/js/apps/admin-ui/src/routes.tsx
@@ -13,13 +13,13 @@ import groupsRoutes from "./groups/routes";
 import identityProviders from "./identity-providers/routes";
 import organizationRoutes from "./organizations/routes";
 import pageRoutes from "./page/routes";
+import permissionsConfigurationRoute from "./permissions-configuration/routes";
 import realmRoleRoutes from "./realm-roles/routes";
 import realmSettingRoutes from "./realm-settings/routes";
 import realmRoutes from "./realm/routes";
 import sessionRoutes from "./sessions/routes";
 import userFederationRoutes from "./user-federation/routes";
 import userRoutes from "./user/routes";
-import permissionsRoute from "./permissions/routes";
 
 export type AppRouteObjectHandle = {
   access: AccessType | AccessType[];
@@ -51,7 +51,7 @@ export const routes: AppRouteObject[] = [
   ...realmSettingRoutes,
   ...sessionRoutes,
   ...userFederationRoutes,
-  ...permissionsRoute,
+  ...permissionsConfigurationRoute,
   ...userRoutes,
   ...groupsRoutes,
   ...dashboardRoutes,
diff --git a/js/apps/admin-ui/src/sessions/RevocationModal.tsx b/js/apps/admin-ui/src/sessions/RevocationModal.tsx
index f3e69e30db8d..fc7846e4a3e8 100644
--- a/js/apps/admin-ui/src/sessions/RevocationModal.tsx
+++ b/js/apps/admin-ui/src/sessions/RevocationModal.tsx
@@ -114,8 +114,8 @@ export const RevocationModal = ({
           data-testid="set-to-now-button"
           key="set-to-now"
           variant="tertiary"
-          onClick={() => {
-            setToNow();
+          onClick={async () => {
+            await setToNow();
             handleModalToggle();
           }}
           form="revocation-modal-form"
@@ -126,8 +126,8 @@ export const RevocationModal = ({
           data-testid="clear-not-before-button"
           key="clear"
           variant="tertiary"
-          onClick={() => {
-            clearNotBefore();
+          onClick={async () => {
+            await clearNotBefore();
             handleModalToggle();
           }}
           form="revocation-modal-form"
@@ -138,8 +138,8 @@ export const RevocationModal = ({
           data-testid="modal-test-connection-button"
           key="push"
           variant="secondary"
-          onClick={() => {
-            push();
+          onClick={async () => {
+            await push();
             handleModalToggle();
           }}
           form="revocation-modal-form"
diff --git a/js/apps/admin-ui/src/sessions/SessionsTable.tsx b/js/apps/admin-ui/src/sessions/SessionsTable.tsx
index 39c892916ee2..1312e6cb0172 100644
--- a/js/apps/admin-ui/src/sessions/SessionsTable.tsx
+++ b/js/apps/admin-ui/src/sessions/SessionsTable.tsx
@@ -238,6 +238,8 @@ export default function SessionsTable({
             hasIcon
             icon={CubesIcon}
             message={t("noSessions")}
+            primaryActionText={t("refresh")}
+            onPrimaryAction={refresh}
             instructions={
               emptyInstructions ? emptyInstructions : t("noSessionsDescription")
             }
diff --git a/js/apps/admin-ui/src/user-federation/UserFederationLdapSettings.tsx b/js/apps/admin-ui/src/user-federation/UserFederationLdapSettings.tsx
index aaddb4ed803c..2bb175dc435c 100644
--- a/js/apps/admin-ui/src/user-federation/UserFederationLdapSettings.tsx
+++ b/js/apps/admin-ui/src/user-federation/UserFederationLdapSettings.tsx
@@ -1,5 +1,9 @@
 import type ComponentRepresentation from "@keycloak/keycloak-admin-client/lib/defs/componentRepresentation";
-import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
+import {
+  KeycloakSpinner,
+  useAlerts,
+  useFetch,
+} from "@keycloak/keycloak-ui-shared";
 import {
   AlertVariant,
   PageSection,
@@ -11,7 +15,6 @@ import { FormProvider, useForm } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { useParams } from "react-router-dom";
 import { useAdminClient } from "../admin-client";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import {
   RoutableTabs,
   useRoutableTab,
@@ -25,7 +28,6 @@ import {
 import { LdapMapperList } from "./ldap/mappers/LdapMapperList";
 import {
   UserFederationLdapParams,
-  UserFederationLdapTab,
   toUserFederationLdap,
 } from "./routes/UserFederationLdap";
 import { toUserFederationLdapMapper } from "./routes/UserFederationLdapMapper";
@@ -57,13 +59,15 @@ export default function UserFederationLdapSettings() {
     [id, refreshCount],
   );
 
-  const useTab = (tab: UserFederationLdapTab) =>
-    useRoutableTab(toUserFederationLdap({ realm, id: id!, tab }));
-
-  const settingsTab = useTab("settings");
-  const mappersTab = useTab("mappers");
+  const settingsTab = useRoutableTab(
+    toUserFederationLdap({ realm, id: id!, tab: "settings" }),
+  );
+  const mappersTab = useRoutableTab(
+    toUserFederationLdap({ realm, id: id!, tab: "mappers" }),
+  );
 
   const setupForm = (component: ComponentRepresentation) => {
+    form.reset({});
     form.reset(component);
     form.setValue(
       "config.periodicChangedUsersSync",
diff --git a/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSearching.tsx b/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSearching.tsx
index ccf2b26cba00..b5c6645e198f 100644
--- a/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSearching.tsx
+++ b/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSearching.tsx
@@ -41,7 +41,10 @@ export const LdapSettingsSearching = ({
           controller={{
             defaultValue: "",
             rules: {
-              required: t("validateEditMode"),
+              required: {
+                value: true,
+                message: t("validateEditMode"),
+              },
             },
           }}
           options={["", "READ_ONLY", "WRITABLE", "UNSYNCED"]}
@@ -54,6 +57,11 @@ export const LdapSettingsSearching = ({
             required: t("validateUsersDn"),
           }}
         />
+        <TextControl
+          name="config.relativeCreateDn.0"
+          label={t("relativeUserCreateDn")}
+          labelIcon={t("relativeUserCreateDnHelp")}
+        />
         <TextControl
           name="config.usernameLDAPAttribute.0"
           label={t("usernameLdapAttribute")}
diff --git a/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSynchronization.tsx b/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSynchronization.tsx
index 516680e484dc..42ef42d6293c 100644
--- a/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSynchronization.tsx
+++ b/js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSynchronization.tsx
@@ -175,6 +175,35 @@ export const LdapSettingsSynchronization = ({
             defaultValue={86400}
           />
         )}
+        <FormGroup
+          label={t("removeInvalidUsers")}
+          labelIcon={
+            <HelpItem
+              helpText={t("removeInvalidUsersHelp")}
+              fieldLabelId="removeInvalidUsers"
+            />
+          }
+          fieldId="kc-remove-invalid-users"
+          hasNoPaddingTop
+        >
+          <Controller
+            name="config.removeInvalidUsersEnabled"
+            defaultValue={["true"]}
+            control={form.control}
+            render={({ field }) => (
+              <Switch
+                id="kc-remove-invalid-users"
+                data-testid="remove-invalid-users"
+                isDisabled={false}
+                onChange={(_event, value) => field.onChange([`${value}`])}
+                isChecked={field.value[0] === "true"}
+                label={t("on")}
+                labelOff={t("off")}
+                aria-label={t("removeInvalidUsers")}
+              />
+            )}
+          />
+        </FormGroup>
       </FormAccess>
     </FormProvider>
   );
diff --git a/js/apps/admin-ui/src/user-federation/ldap/mappers/LdapMapperDetails.tsx b/js/apps/admin-ui/src/user-federation/ldap/mappers/LdapMapperDetails.tsx
index ab6e5330889a..3670518d229b 100644
--- a/js/apps/admin-ui/src/user-federation/ldap/mappers/LdapMapperDetails.tsx
+++ b/js/apps/admin-ui/src/user-federation/ldap/mappers/LdapMapperDetails.tsx
@@ -4,6 +4,7 @@ import { DirectionType } from "@keycloak/keycloak-admin-client/lib/resources/use
 import {
   HelpItem,
   KeycloakSelect,
+  KeycloakSpinner,
   SelectVariant,
   TextControl,
   useAlerts,
@@ -26,11 +27,10 @@ import { useNavigate } from "react-router-dom";
 import { useAdminClient } from "../../../admin-client";
 import { useConfirmDialog } from "../../../components/confirm-dialog/ConfirmDialog";
 import {
-  DynamicComponents,
   convertToName,
+  DynamicComponents,
 } from "../../../components/dynamic/DynamicComponents";
 import { FormAccess } from "../../../components/form/FormAccess";
-import { KeycloakSpinner } from "@keycloak/keycloak-ui-shared";
 import { ViewHeader } from "../../../components/view-header/ViewHeader";
 import { useRealm } from "../../../context/realm-context/RealmContext";
 import { convertFormValuesToObject, convertToFormValues } from "../../../util";
@@ -52,6 +52,7 @@ export default function LdapMapperDetails() {
   const { addAlert, addError } = useAlerts();
 
   const [isMapperDropdownOpen, setIsMapperDropdownOpen] = useState(false);
+  const [mapperTypeFilter, setMapperTypeFilter] = useState("");
   const [key, setKey] = useState(0);
   const refresh = () => setKey(key + 1);
 
@@ -164,12 +165,22 @@ export default function LdapMapperDetails() {
     name: "providerId",
   });
 
+  const selectItems = () =>
+    (components || [])
+      .filter((c) => c.id.includes(mapperTypeFilter))
+      .map((c) => (
+        <SelectOption key={c.id} value={c.id}>
+          {c.id}
+        </SelectOption>
+      ));
+
   if (!components) {
     return <KeycloakSpinner />;
   }
 
   const isNew = mapperId === "new";
   const mapper = components.find((c) => c.id === mapperType);
+
   return (
     <>
       <DeleteConfirm />
@@ -197,8 +208,8 @@ export default function LdapMapperDetails() {
                   ? [
                       <DropdownItem
                         key="ldapSync"
-                        onClick={() => {
-                          sync("keycloakToFed");
+                        onClick={async () => {
+                          await sync("keycloakToFed");
                         }}
                       >
                         {t(mapper.metadata.keycloakToFedSyncMessage)}
@@ -268,10 +279,12 @@ export default function LdapMapperDetails() {
                     <KeycloakSelect
                       toggleId="kc-providerId"
                       typeAheadAriaLabel={t("mapperType")}
-                      onToggle={() =>
-                        setIsMapperDropdownOpen(!isMapperDropdownOpen)
-                      }
+                      onToggle={setIsMapperDropdownOpen}
                       isOpen={isMapperDropdownOpen}
+                      onFilter={(search) => {
+                        setMapperTypeFilter(search);
+                        return selectItems();
+                      }}
                       onSelect={(value) => {
                         setupForm({
                           providerId: value as string,
@@ -285,17 +298,12 @@ export default function LdapMapperDetails() {
                               ]) || [],
                           ),
                         });
-                        setIsMapperDropdownOpen(false);
                       }}
                       selections={field.value}
                       variant={SelectVariant.typeahead}
                       aria-label={t("selectMapperType")}
                     >
-                      {components.map((c) => (
-                        <SelectOption key={c.id} value={c.id}>
-                          {c.id}
-                        </SelectOption>
-                      ))}
+                      {selectItems()}
                     </KeycloakSelect>
                   )}
                 ></Controller>
diff --git a/js/apps/admin-ui/src/user-federation/shared/ExtendedHeader.tsx b/js/apps/admin-ui/src/user-federation/shared/ExtendedHeader.tsx
index f4f5e6837ae0..afb7db70ceca 100644
--- a/js/apps/admin-ui/src/user-federation/shared/ExtendedHeader.tsx
+++ b/js/apps/admin-ui/src/user-federation/shared/ExtendedHeader.tsx
@@ -45,12 +45,7 @@ export const ExtendedHeader = ({
     messageKey: t("removeImportedUsersMessage"),
     continueButtonLabel: "remove",
     onConfirm: async () => {
-      try {
-        removeImportedUsers();
-        addAlert(t("removeImportedUsersSuccess"), AlertVariant.success);
-      } catch (error) {
-        addError("removeImportedUsersError", error);
-      }
+      await removeImportedUsers();
     },
   });
 
@@ -58,8 +53,8 @@ export const ExtendedHeader = ({
     try {
       if (id) {
         await adminClient.userStorageProvider.removeImportedUsers({ id });
+        addAlert(t("removeImportedUsersSuccess"), AlertVariant.success);
       }
-      addAlert(t("removeImportedUsersSuccess"), AlertVariant.success);
     } catch (error) {
       addError("removeImportedUsersError", error);
     }
@@ -68,6 +63,7 @@ export const ExtendedHeader = ({
   const syncChangedUsers = async () => {
     try {
       if (id) {
+        addAlert(t("syncUsersStarted"), AlertVariant.info);
         const response = await adminClient.userStorageProvider.sync({
           id: id,
           action: "triggerChangedUsersSync",
@@ -90,6 +86,7 @@ export const ExtendedHeader = ({
   const syncAllUsers = async () => {
     try {
       if (id) {
+        addAlert(t("syncUsersStarted"), AlertVariant.info);
         const response = await adminClient.userStorageProvider.sync({
           id: id,
           action: "triggerFullSync",
diff --git a/js/apps/admin-ui/src/user-federation/shared/SettingsCache.tsx b/js/apps/admin-ui/src/user-federation/shared/SettingsCache.tsx
index 69151086ca1a..84a6433a939e 100644
--- a/js/apps/admin-ui/src/user-federation/shared/SettingsCache.tsx
+++ b/js/apps/admin-ui/src/user-federation/shared/SettingsCache.tsx
@@ -1,16 +1,13 @@
 import {
-  HelpItem,
-  KeycloakSelect,
+  NumberControl,
   SelectControl,
-  SelectVariant,
+  SelectControlOption,
 } from "@keycloak/keycloak-ui-shared";
-import { FormGroup, NumberInput, SelectOption } from "@patternfly/react-core";
 import { isEqual } from "lodash-es";
-import { Controller, UseFormReturn, useWatch } from "react-hook-form";
+import { UseFormReturn, useWatch } from "react-hook-form";
 import { useTranslation } from "react-i18next";
 import { FormAccess } from "../../components/form/FormAccess";
 import { WizardSectionHeader } from "../../components/wizard-section-header/WizardSectionHeader";
-import useToggle from "../../utils/useToggle";
 
 export type SettingsCacheProps = {
   form: UseFormReturn;
@@ -22,102 +19,52 @@ export type SettingsCacheProps = {
 const CacheFields = ({ form }: { form: UseFormReturn }) => {
   const { t } = useTranslation();
 
-  const [isCachePolicyOpen, toggleCachePolicy] = useToggle();
-  const [isEvictionHourOpen, toggleEvictionHour] = useToggle();
-  const [isEvictionMinuteOpen, toggleEvictionMinute] = useToggle();
-
   const cachePolicyType = useWatch({
     control: form.control,
     name: "config.cachePolicy",
   });
 
-  const hourOptions = [
-    <SelectOption key={0} value={[`0`]}>
-      {[`00`]}
-    </SelectOption>,
-  ];
+  const hourOptions: SelectControlOption[] = [];
   let hourDisplay = "";
-  for (let index = 1; index < 24; index++) {
+  for (let index = 0; index < 24; index++) {
     if (index < 10) {
       hourDisplay = `0${index}`;
     } else {
       hourDisplay = `${index}`;
     }
-    hourOptions.push(
-      <SelectOption key={index} value={[`${index}`]}>
-        {hourDisplay}
-      </SelectOption>,
-    );
+    hourOptions.push({ key: `${index}`, value: hourDisplay });
   }
 
-  const minuteOptions = [
-    <SelectOption key={0} value={[`0`]}>
-      {[`00`]}
-    </SelectOption>,
-  ];
+  const minuteOptions: SelectControlOption[] = [];
   let minuteDisplay = "";
-  for (let index = 1; index < 60; index++) {
+  for (let index = 0; index < 60; index++) {
     if (index < 10) {
       minuteDisplay = `0${index}`;
     } else {
       minuteDisplay = `${index}`;
     }
-    minuteOptions.push(
-      <SelectOption key={index} value={[`${index}`]}>
-        {minuteDisplay}
-      </SelectOption>,
-    );
+    minuteOptions.push({ key: `${index}`, value: minuteDisplay });
   }
 
   return (
     <>
-      <FormGroup
+      <SelectControl
+        id="kc-cache-policy"
+        name="config.cachePolicy"
         label={t("cachePolicy")}
-        labelIcon={
-          <HelpItem
-            helpText={t("cachePolicyHelp")}
-            fieldLabelId="cachePolicy"
-          />
-        }
-        fieldId="kc-cache-policy"
-      >
-        <Controller
-          name="config.cachePolicy"
-          defaultValue={["DEFAULT"]}
-          control={form.control}
-          render={({ field }) => (
-            <KeycloakSelect
-              toggleId="kc-cache-policy"
-              onToggle={toggleCachePolicy}
-              isOpen={isCachePolicyOpen}
-              onSelect={(value) => {
-                field.onChange(value as string);
-                toggleCachePolicy();
-              }}
-              selections={field.value}
-              variant={SelectVariant.single}
-              data-testid="kerberos-cache-policy"
-              aria-label={t("selectCachePolicy")}
-            >
-              <SelectOption key={0} value={["DEFAULT"]}>
-                DEFAULT
-              </SelectOption>
-              <SelectOption key={1} value={["EVICT_DAILY"]}>
-                EVICT_DAILY
-              </SelectOption>
-              <SelectOption key={2} value={["EVICT_WEEKLY"]}>
-                EVICT_WEEKLY
-              </SelectOption>
-              <SelectOption key={3} value={["MAX_LIFESPAN"]}>
-                MAX_LIFESPAN
-              </SelectOption>
-              <SelectOption key={4} value={["NO_CACHE"]}>
-                NO_CACHE
-              </SelectOption>
-            </KeycloakSelect>
-          )}
-        />
-      </FormGroup>
+        labelIcon={t("cachePolicyHelp")}
+        controller={{
+          defaultValue: ["DEFAULT"],
+        }}
+        aria-label={t("selectCacheType")}
+        options={[
+          "DEFAULT",
+          "EVICT_DAILY",
+          "EVICT_WEEKLY",
+          "MAX_LIFESPAN",
+          "NO_CACHE",
+        ]}
+      />
       {isEqual(cachePolicyType, ["EVICT_WEEKLY"]) ? (
         <SelectControl
           id="kc-eviction-day"
@@ -142,113 +89,39 @@ const CacheFields = ({ form }: { form: UseFormReturn }) => {
       {isEqual(cachePolicyType, ["EVICT_DAILY"]) ||
       isEqual(cachePolicyType, ["EVICT_WEEKLY"]) ? (
         <>
-          <FormGroup
+          <SelectControl
+            id="kc-eviction-hour"
+            name="config.evictionHour"
             label={t("evictionHour")}
-            labelIcon={
-              <HelpItem
-                helpText={t("evictionHourHelp")}
-                fieldLabelId="evictionHour"
-              />
-            }
-            isRequired
-            fieldId="kc-eviction-hour"
-          >
-            <Controller
-              name="config.evictionHour"
-              defaultValue={["0"]}
-              control={form.control}
-              render={({ field }) => (
-                <KeycloakSelect
-                  toggleId="kc-eviction-hour"
-                  onToggle={toggleEvictionHour}
-                  isOpen={isEvictionHourOpen}
-                  onSelect={(value) => {
-                    field.onChange(value as string);
-                    toggleEvictionHour();
-                  }}
-                  selections={field.value}
-                  variant={SelectVariant.single}
-                  aria-label={t("selectEvictionHour")}
-                >
-                  {hourOptions}
-                </KeycloakSelect>
-              )}
-            />
-          </FormGroup>
-          <FormGroup
+            labelIcon={t("evictionHourHelp")}
+            controller={{
+              defaultValue: ["0"],
+            }}
+            aria-label={t("selectEvictionHour")}
+            options={hourOptions}
+          />
+          <SelectControl
+            id="kc-eviction-minute"
+            name="config.evictionMinute"
             label={t("evictionMinute")}
-            labelIcon={
-              <HelpItem
-                helpText={t("evictionMinuteHelp")}
-                fieldLabelId="evictionMinute"
-              />
-            }
-            isRequired
-            fieldId="kc-eviction-minute"
-          >
-            <Controller
-              name="config.evictionMinute"
-              defaultValue={["0"]}
-              control={form.control}
-              render={({ field }) => (
-                <KeycloakSelect
-                  toggleId="kc-eviction-minute"
-                  onToggle={toggleEvictionMinute}
-                  isOpen={isEvictionMinuteOpen}
-                  onSelect={(value) => {
-                    field.onChange(value as string);
-                    toggleEvictionMinute();
-                  }}
-                  selections={field.value}
-                  variant={SelectVariant.single}
-                  aria-label={t("selectEvictionMinute")}
-                >
-                  {minuteOptions}
-                </KeycloakSelect>
-              )}
-            />
-          </FormGroup>
+            labelIcon={t("evictionMinuteHelp")}
+            controller={{
+              defaultValue: ["0"],
+            }}
+            aria-label={t("selectEvictionMinute")}
+            options={minuteOptions}
+          />
         </>
       ) : null}
       {isEqual(cachePolicyType, ["MAX_LIFESPAN"]) ? (
-        <FormGroup
+        <NumberControl
+          data-testid="kerberos-cache-lifespan"
+          name="config.maxLifespan[0]"
           label={t("maxLifespan")}
-          labelIcon={
-            <HelpItem
-              helpText={t("maxLifespanHelp")}
-              fieldLabelId="maxLifespan"
-            />
-          }
-          fieldId="kc-max-lifespan"
-        >
-          <Controller
-            name="config.maxLifespan[0]"
-            defaultValue={0}
-            control={form.control}
-            render={({ field }) => {
-              const MIN_VALUE = 0;
-              const setValue = (newValue: number) =>
-                field.onChange(Math.max(newValue, MIN_VALUE));
-
-              return (
-                <NumberInput
-                  id="kc-max-lifespan"
-                  data-testid="kerberos-cache-lifespan"
-                  value={field.value}
-                  min={MIN_VALUE}
-                  unit={t("ms")}
-                  type="text"
-                  onPlus={() => field.onChange(Number(field.value) + 1)}
-                  onMinus={() => field.onChange(Number(field.value) - 1)}
-                  onChange={(event) => {
-                    const newValue = Number(event.currentTarget.value);
-                    setValue(!isNaN(newValue) ? newValue : 0);
-                  }}
-                />
-              );
-            }}
-          />
-        </FormGroup>
+          labelIcon={t("maxLifespanHelp")}
+          unit={t("ms")}
+          controller={{ defaultValue: 0, rules: { min: 0 } }}
+        />
       ) : null}
     </>
   );
diff --git a/js/apps/admin-ui/src/user/CreateUser.tsx b/js/apps/admin-ui/src/user/CreateUser.tsx
index ec459df37a30..fc56eecfb525 100644
--- a/js/apps/admin-ui/src/user/CreateUser.tsx
+++ b/js/apps/admin-ui/src/user/CreateUser.tsx
@@ -41,7 +41,6 @@ export default function CreateUser() {
         throw new Error(t("notFound"));
       }
 
-      form.setValue("attributes.locale", realm?.defaultLocale || "");
       setUserProfileMetadata(userProfileMetadata);
     },
     [],
diff --git a/js/apps/admin-ui/src/user/EditUser.tsx b/js/apps/admin-ui/src/user/EditUser.tsx
index b6e7c8daa68b..50d4b8e73118 100644
--- a/js/apps/admin-ui/src/user/EditUser.tsx
+++ b/js/apps/admin-ui/src/user/EditUser.tsx
@@ -230,8 +230,8 @@ export default function EditUser() {
     titleKey: "disableConfirmUserTitle",
     messageKey: "disableConfirmUser",
     continueButtonLabel: "disable",
-    onConfirm: () => {
-      save({
+    onConfirm: async () => {
+      await save({
         ...toUserFormFields(user!),
         enabled: false,
       });
@@ -326,11 +326,11 @@ export default function EditUser() {
             {t("delete")}
           </DropdownItem>,
         ]}
-        onToggle={(value) => {
+        onToggle={async (value) => {
           if (!value) {
             toggleDisableDialog();
           } else {
-            save({
+            await save({
               ...toUserFormFields(user),
               enabled: value,
             });
@@ -366,7 +366,7 @@ export default function EditUser() {
               </Tab>
               {isUnmanagedAttributesEnabled && (
                 <Tab
-                  data-testid="attributes"
+                  data-testid="attributesTab"
                   title={<TabTitleText>{t("attributes")}</TabTitleText>}
                   {...attributesTab}
                 >
@@ -430,38 +430,31 @@ export default function EditUser() {
               >
                 <UserSessions />
               </Tab>
-              {hasAccess("view-events") &&
-                (realm?.adminEventsEnabled || realm?.eventsEnabled) && (
-                  <Tab
-                    data-testid="events-tab"
-                    title={<TabTitleText>{t("events")}</TabTitleText>}
-                    {...eventsTab}
+              {hasAccess("view-events") && (
+                <Tab
+                  data-testid="events-tab"
+                  title={<TabTitleText>{t("events")}</TabTitleText>}
+                  {...eventsTab}
+                >
+                  <Tabs
+                    activeKey={activeEventsTab}
+                    onSelect={(_, key) => setActiveEventsTab(key as string)}
                   >
-                    <Tabs
-                      activeKey={activeEventsTab}
-                      onSelect={(_, key) => setActiveEventsTab(key as string)}
+                    <Tab
+                      eventKey="userEvents"
+                      title={<TabTitleText>{t("userEvents")}</TabTitleText>}
                     >
-                      {realm.eventsEnabled && (
-                        <Tab
-                          eventKey="userEvents"
-                          title={<TabTitleText>{t("userEvents")}</TabTitleText>}
-                        >
-                          <UserEvents user={user.id} />
-                        </Tab>
-                      )}
-                      {realm.adminEventsEnabled && (
-                        <Tab
-                          eventKey="adminEvents"
-                          title={
-                            <TabTitleText>{t("adminEvents")}</TabTitleText>
-                          }
-                        >
-                          <AdminEvents resourcePath={`users/${user.id}`} />
-                        </Tab>
-                      )}
-                    </Tabs>
-                  </Tab>
-                )}
+                      <UserEvents user={user.id} />
+                    </Tab>
+                    <Tab
+                      eventKey="adminEvents"
+                      title={<TabTitleText>{t("adminEvents")}</TabTitleText>}
+                    >
+                      <AdminEvents resourcePath={`users/${user.id}`} />
+                    </Tab>
+                  </Tabs>
+                </Tab>
+              )}
             </RoutableTabs>
           </FormProvider>
         </UserProfileProvider>
diff --git a/js/apps/admin-ui/src/user/UserCredentials.tsx b/js/apps/admin-ui/src/user/UserCredentials.tsx
index 0417fcb8271f..ae5693c6a170 100644
--- a/js/apps/admin-ui/src/user/UserCredentials.tsx
+++ b/js/apps/admin-ui/src/user/UserCredentials.tsx
@@ -29,6 +29,7 @@ import { CredentialRow } from "./user-credentials/CredentialRow";
 import { InlineLabelEdit } from "./user-credentials/InlineLabelEdit";
 import { ResetCredentialDialog } from "./user-credentials/ResetCredentialDialog";
 import { ResetPasswordDialog } from "./user-credentials/ResetPasswordDialog";
+import useFormatDate from "../utils/useFormatDate";
 
 import "./user-credentials.css";
 
@@ -99,6 +100,7 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
   const { t } = useTranslation();
   const { addAlert, addError } = useAlerts();
   const [key, setKey] = useState(0);
+  const formatDate = useFormatDate();
   const refresh = () => setKey(key + 1);
   const [isOpen, setIsOpen] = useState(false);
   const [openCredentialReset, setOpenCredentialReset] = useState(false);
@@ -122,8 +124,18 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
   });
 
   useFetch(
-    () => adminClient.users.getCredentials({ id: user.id! }),
+    () => {
+      if (user.enabled) {
+        return adminClient.users.getCredentials({ id: user.id! });
+      }
+      return Promise.resolve([]);
+    },
     (credentials) => {
+      credentials = [
+        ...credentials.filter((c: CredentialRepresentation) => {
+          return c.federationLink === undefined;
+        }),
+      ];
       setUserCredentials(credentials);
 
       const groupedCredentials = credentials.reduce((r, a) => {
@@ -146,10 +158,6 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
     [key],
   );
 
-  const passwordTypeFinder = userCredentials.find(
-    (credential) => credential.type === "password",
-  );
-
   const toggleModal = () => setIsOpen(!isOpen);
 
   const toggleCredentialsResetModal = () => {
@@ -255,9 +263,9 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
     );
   };
 
-  const onDrop = (evt: ReactDragEvent) => {
+  const onDrop = async (evt: ReactDragEvent) => {
     if (isValidDrop(evt)) {
-      onDragFinish(state.draggedItemId, state.tempItemOrder);
+      await onDragFinish(state.draggedItemId, state.tempItemOrder);
     } else {
       onDragCancel();
     }
@@ -353,12 +361,26 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
   };
 
   const useFederatedCredentials = user.federationLink;
-  const [credentialTypes, setCredentialTypes] = useState<string[]>([]);
+  const [credentialTypes, setCredentialTypes] = useState<
+    CredentialRepresentation[]
+  >([]);
 
   useFetch(
-    () => adminClient.users.getUserStorageCredentialTypes({ id: user.id! }),
-    setCredentialTypes,
-    [],
+    () => {
+      if (user.enabled) {
+        return adminClient.users.getCredentials({ id: user.id! });
+      }
+      return Promise.resolve([]);
+    },
+    (credentials) => {
+      credentials = [
+        ...credentials.filter((c: CredentialRepresentation) => {
+          return c.federationLink !== undefined;
+        }),
+      ];
+      setCredentialTypes(credentials);
+    },
+    [key],
   );
 
   if (!credentialTypes) {
@@ -400,22 +422,26 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
           {t("credentialResetBtn")}
         </Button>
       )}
-      {userCredentials.length !== 0 && passwordTypeFinder === undefined && (
-        <>
-          <Button
-            className="kc-setPasswordBtn-tbl"
-            data-testid="setPasswordBtn-table"
-            variant="primary"
-            form="userCredentials-form"
-            onClick={() => {
-              setIsOpen(true);
-            }}
-          >
-            {t("setPassword")}
-          </Button>
-          <Divider />
-        </>
-      )}
+      {userCredentials.length !== 0 &&
+        !userCredentials.find((credential) => credential.type === "password") &&
+        !credentialTypes.find(
+          (credential) => credential.type === "password",
+        ) && (
+          <>
+            <Button
+              className="kc-setPasswordBtn-tbl"
+              data-testid="setPasswordBtn-table"
+              variant="primary"
+              form="userCredentials-form"
+              onClick={() => {
+                setIsOpen(true);
+              }}
+            >
+              {t("setPassword")}
+            </Button>
+            <Divider />
+          </>
+        )}
       {groupedUserCredentials.length !== 0 && (
         <PageSection variant={PageSectionVariants.light}>
           <Table variant={"compact"}>
@@ -554,19 +580,21 @@ export const UserCredentials = ({ user, setUser }: UserCredentialsProps) => {
               <Tr>
                 <Th>{t("type")}</Th>
                 <Th>{t("providedBy")}</Th>
+                <Th>{t("createdAt")}</Th>
                 <Th aria-hidden="true" />
               </Tr>
             </Thead>
             <Tbody>
               {credentialTypes.map((credential) => (
-                <Tr key={credential}>
+                <Tr key={credential.type}>
                   <Td>
-                    <b>{credential}</b>
+                    <b>{credential.type}</b>
                   </Td>
                   <Td>
                     <FederatedUserLink user={user} />
                   </Td>
-                  {credential === "password" && (
+                  <Td>{formatDate(new Date(credential.createdDate!))}</Td>
+                  {credential.type === "password" && (
                     <Td modifier="fitContent">
                       <Button variant="secondary" onClick={toggleModal}>
                         {t("setPassword")}
diff --git a/js/apps/admin-ui/src/user/UserForm.tsx b/js/apps/admin-ui/src/user/UserForm.tsx
index 231d150120a3..421ea27d2e38 100644
--- a/js/apps/admin-ui/src/user/UserForm.tsx
+++ b/js/apps/admin-ui/src/user/UserForm.tsx
@@ -168,11 +168,11 @@ export const UserForm = ({
               ok: "join",
             }}
             canBrowse={isManager}
-            onConfirm={(groups) => {
+            onConfirm={async (groups) => {
               if (user?.id) {
-                addGroups(groups || []);
+                await addGroups(groups || []);
               } else {
-                addChips(groups || []);
+                await addChips(groups || []);
               }
 
               setOpen(false);
@@ -305,8 +305,8 @@ export const UserForm = ({
             <Switch
               data-testid="user-locked-switch"
               id="temporaryLocked"
-              onChange={(_event, value) => {
-                unLockUser();
+              onChange={async (_event, value) => {
+                await unLockUser();
                 setLocked(value);
               }}
               isChecked={locked}
diff --git a/js/apps/admin-ui/src/user/UserIdentityProviderLinks.tsx b/js/apps/admin-ui/src/user/UserIdentityProviderLinks.tsx
index d116e9f66534..022aff836c8b 100644
--- a/js/apps/admin-ui/src/user/UserIdentityProviderLinks.tsx
+++ b/js/apps/admin-ui/src/user/UserIdentityProviderLinks.tsx
@@ -1,5 +1,6 @@
 import type FederatedIdentityRepresentation from "@keycloak/keycloak-admin-client/lib/defs/federatedIdentityRepresentation";
 import type IdentityProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/identityProviderRepresentation";
+import type { IdentityProvidersQuery } from "@keycloak/keycloak-admin-client/lib/resources/identityProviders";
 import {
   AlertVariant,
   Button,
@@ -8,6 +9,7 @@ import {
   PageSection,
   Text,
   TextContent,
+  Spinner,
 } from "@patternfly/react-core";
 import { cellWidth } from "@patternfly/react-table";
 import { capitalize } from "lodash-es";
@@ -16,7 +18,7 @@ import { useTranslation } from "react-i18next";
 import { Link } from "react-router-dom";
 import { FormPanel } from "@keycloak/keycloak-ui-shared";
 import { useAdminClient } from "../admin-client";
-import { useAlerts } from "@keycloak/keycloak-ui-shared";
+import { useAlerts, useFetch } from "@keycloak/keycloak-ui-shared";
 import { useConfirmDialog } from "../components/confirm-dialog/ConfirmDialog";
 import { KeycloakDataTable } from "@keycloak/keycloak-ui-shared";
 import { useRealm } from "../context/realm-context/RealmContext";
@@ -34,11 +36,11 @@ export const UserIdentityProviderLinks = ({
   userId,
 }: UserIdentityProviderLinksProps) => {
   const { adminClient } = useAdminClient();
-
   const [key, setKey] = useState(0);
+  const [linkedNames, setLinkedNames] = useState<string[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
   const [federatedId, setFederatedId] = useState("");
   const [isLinkIdPModalOpen, setIsLinkIdPModalOpen] = useState(false);
-
   const { realm } = useRealm();
   const { addAlert, addError } = useAlerts();
   const { t } = useTranslation();
@@ -49,7 +51,21 @@ export const UserIdentityProviderLinks = ({
     "view-identity-providers",
   );
 
-  const refresh = () => setKey(new Date().getTime());
+  useFetch(
+    () => adminClient.users.listFederatedIdentities({ id: userId }),
+    (linkedIdentities) => {
+      setLinkedNames(
+        linkedIdentities.map((identity) => identity.identityProvider!),
+      );
+      setIsLoading(false);
+    },
+    [userId, key],
+  );
+
+  const refresh = () => {
+    setKey(new Date().getTime());
+    setIsLoading(true);
+  };
 
   type WithProviderId = FederatedIdentityRepresentation & {
     providerId: string;
@@ -74,22 +90,24 @@ export const UserIdentityProviderLinks = ({
     return allFedIds;
   };
 
-  const getAvailableIdPs = async () => {
-    return adminClient.identityProviders.find();
-  };
-
   const linkedIdPsLoader = async () => {
     return getFederatedIdentities();
   };
 
-  const availableIdPsLoader = async () => {
-    const linkedNames = (await getFederatedIdentities()).map(
-      (x) => x.identityProvider,
-    );
-
-    return (await getAvailableIdPs())?.filter(
-      (item) => !linkedNames.includes(item.alias),
-    )!;
+  const availableIdPsLoader = async (
+    first?: number,
+    max?: number,
+    search?: string,
+  ) => {
+    const params: IdentityProvidersQuery = {
+      first: first!,
+      max: max!,
+      realmOnly: false,
+    };
+    if (search) {
+      params.search = search;
+    }
+    return await adminClient.identityProviders.find(params);
   };
 
   const [toggleUnlinkDialog, UnlinkConfirm] = useConfirmDialog({
@@ -176,6 +194,8 @@ export const UserIdentityProviderLinks = ({
   };
 
   const linkRenderer = (idp: IdentityProviderRepresentation) => {
+    if (linkedNames.includes(idp.alias!)) return <span />;
+
     return (
       <Button
         variant="link"
@@ -197,7 +217,6 @@ export const UserIdentityProviderLinks = ({
         cellRenderer: idpLinkRenderer,
         transforms: [cellWidth(20)],
       },
-
       {
         name: "userId",
         displayKey: "userID",
@@ -267,36 +286,41 @@ export const UserIdentityProviderLinks = ({
                 {t("availableIdPsText")}
               </Text>
             </TextContent>
-            <KeycloakDataTable
-              loader={availableIdPsLoader}
-              key={key}
-              isPaginated={false}
-              ariaLabelKey="LinkedIdPs"
-              className="kc-linked-IdPs-table"
-              columns={[
-                {
-                  name: "alias",
-                  displayKey: "name",
-                  cellFormatters: [emptyFormatter(), upperCaseFormatter()],
-                  transforms: [cellWidth(20)],
-                },
-                {
-                  name: "type",
-                  displayKey: "type",
-                  cellRenderer: badgeRenderer2,
-                  transforms: [cellWidth(60)],
-                },
-                {
-                  name: "",
-                  cellRenderer: linkRenderer,
-                },
-              ]}
-              emptyState={
-                <TextContent className="kc-no-providers-text">
-                  <Text>{t("noAvailableIdentityProviders")}</Text>
-                </TextContent>
-              }
-            />
+            {isLoading ? (
+              <Spinner />
+            ) : (
+              <KeycloakDataTable
+                loader={availableIdPsLoader}
+                key={key}
+                isPaginated
+                searchPlaceholderKey="searchForProvider"
+                ariaLabelKey="LinkedIdPs"
+                className="kc-linked-IdPs-table"
+                columns={[
+                  {
+                    name: "alias",
+                    displayKey: "name",
+                    cellFormatters: [emptyFormatter(), upperCaseFormatter()],
+                    transforms: [cellWidth(20)],
+                  },
+                  {
+                    name: "type",
+                    displayKey: "type",
+                    cellRenderer: badgeRenderer2,
+                    transforms: [cellWidth(60)],
+                  },
+                  {
+                    name: "",
+                    cellRenderer: linkRenderer,
+                  },
+                ]}
+                emptyState={
+                  <TextContent className="kc-no-providers-text">
+                    <Text>{t("noAvailableIdentityProviders")}</Text>
+                  </TextContent>
+                }
+              />
+            )}
           </FormPanel>
         )}
       </PageSection>
diff --git a/js/apps/admin-ui/src/user/user-credentials/CredentialDataDialog.tsx b/js/apps/admin-ui/src/user/user-credentials/CredentialDataDialog.tsx
index 08d8990924b6..c3606accb7e8 100644
--- a/js/apps/admin-ui/src/user/user-credentials/CredentialDataDialog.tsx
+++ b/js/apps/admin-ui/src/user/user-credentials/CredentialDataDialog.tsx
@@ -11,11 +11,13 @@ import {
 } from "@patternfly/react-table";
 
 type CredentialDataDialogProps = {
+  title: string;
   credentialData: [string, string][];
   onClose: () => void;
 };
 
 export const CredentialDataDialog = ({
+  title,
   credentialData,
   onClose,
 }: CredentialDataDialogProps) => {
@@ -23,13 +25,13 @@ export const CredentialDataDialog = ({
   return (
     <Modal
       variant={ModalVariant.medium}
-      title={t("passwordDataTitle")}
+      title={title}
       data-testid="passwordDataDialog"
       isOpen
       onClose={onClose}
     >
       <Table
-        aria-label={t("passwordDataTitle")}
+        aria-label={title}
         data-testid="password-data-dialog"
         variant={TableVariant.compact}
       >
diff --git a/js/apps/admin-ui/src/user/user-credentials/CredentialRow.tsx b/js/apps/admin-ui/src/user/user-credentials/CredentialRow.tsx
index ee0656e6cba1..87d2abbf7c01 100644
--- a/js/apps/admin-ui/src/user/user-credentials/CredentialRow.tsx
+++ b/js/apps/admin-ui/src/user/user-credentials/CredentialRow.tsx
@@ -57,6 +57,7 @@ export const CredentialRow = ({
     <>
       {showData && Object.keys(credential).length !== 0 && (
         <CredentialDataDialog
+          title={credential.userLabel || t("passwordDataTitle")}
           credentialData={rows}
           onClose={() => {
             toggleShow();
diff --git a/js/apps/admin-ui/src/user/user-credentials/ResetCredentialDialog.tsx b/js/apps/admin-ui/src/user/user-credentials/ResetCredentialDialog.tsx
index 215407925142..6a712dc958cb 100644
--- a/js/apps/admin-ui/src/user/user-credentials/ResetCredentialDialog.tsx
+++ b/js/apps/admin-ui/src/user/user-credentials/ResetCredentialDialog.tsx
@@ -72,8 +72,8 @@ export const ResetCredentialDialog = ({
       onCancel={onClose}
       toggleDialog={onClose}
       continueButtonLabel="credentialResetConfirm"
-      onConfirm={() => {
-        handleSubmit(sendCredentialsResetEmail)();
+      onConfirm={async () => {
+        await handleSubmit(sendCredentialsResetEmail)();
       }}
       confirmButtonDisabled={!resetIsNotDisabled}
     >
diff --git a/js/apps/admin-ui/src/user/user-credentials/ResetPasswordDialog.tsx b/js/apps/admin-ui/src/user/user-credentials/ResetPasswordDialog.tsx
index 1e57fa1ae7f0..433abd305660 100644
--- a/js/apps/admin-ui/src/user/user-credentials/ResetPasswordDialog.tsx
+++ b/js/apps/admin-ui/src/user/user-credentials/ResetPasswordDialog.tsx
@@ -97,7 +97,10 @@ export const ResetPasswordDialog = ({
         id: user.id!,
       });
       const credentialLabel = credentials.find((c) => c.type === "password");
-      if (credentialLabel) {
+      const isLocalCredential =
+        credentialLabel && credentialLabel.federationLink === undefined;
+
+      if (isLocalCredential) {
         await adminClient.users.updateCredentialLabel(
           {
             id: user.id!,
@@ -154,8 +157,8 @@ export const ResetPasswordDialog = ({
             <PasswordInput
               data-testid="passwordField"
               id="password"
-              onChange={(e) => {
-                onChange(e);
+              onChange={async (e) => {
+                await onChange(e);
                 if (passwordConfirmation !== e.currentTarget.value) {
                   setError("passwordConfirmation", {
                     message: t("confirmPasswordDoesNotMatch").toString(),
diff --git a/js/apps/admin-ui/src/utils/useIsAdminPermissionsClient.ts b/js/apps/admin-ui/src/utils/useIsAdminPermissionsClient.ts
index 310959248766..3cc9a314ea1e 100644
--- a/js/apps/admin-ui/src/utils/useIsAdminPermissionsClient.ts
+++ b/js/apps/admin-ui/src/utils/useIsAdminPermissionsClient.ts
@@ -1,29 +1,20 @@
-import { useState } from "react";
-import { useFetch } from "@keycloak/keycloak-ui-shared";
-import { useAdminClient } from "../admin-client";
-import ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import { useState, useEffect } from "react";
+import { useRealm } from "../context/realm-context/RealmContext";
 
 export function useIsAdminPermissionsClient(selectedClientId: string) {
-  const { adminClient } = useAdminClient();
+  const { realmRepresentation } = useRealm();
   const [isAdminPermissionsClient, setIsAdminPermissionsClient] =
     useState<boolean>(false);
 
-  useFetch(
-    async () => {
-      const clients: ClientRepresentation[] = await adminClient.clients.find();
-      return clients;
-    },
-    (clients: ClientRepresentation[]) => {
-      const adminPermissionsClient = clients.find(
-        (client) => client.clientId === "admin-permissions",
-      );
-
+  useEffect(() => {
+    if (realmRepresentation?.adminPermissionsClient) {
       setIsAdminPermissionsClient(
-        selectedClientId === adminPermissionsClient?.id,
+        selectedClientId === realmRepresentation.adminPermissionsClient.id,
       );
-    },
-    [],
-  );
+    } else {
+      setIsAdminPermissionsClient(false);
+    }
+  }, [selectedClientId, realmRepresentation]);
 
   return isAdminPermissionsClient;
 }
diff --git a/js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts b/js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts
index ac024e976753..37809185ce64 100644
--- a/js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts
+++ b/js/apps/admin-ui/src/utils/useIsFeatureEnabled.ts
@@ -14,6 +14,8 @@ export enum Feature {
   Organizations = "ORGANIZATION",
   OpenId4VCI = "OID4VC_VCI",
   QuickTheme = "QUICK_THEME",
+  StandardTokenExchangeV2 = "TOKEN_EXCHANGE_STANDARD_V2",
+  Passkeys = "PASSKEYS",
 }
 
 export default function useIsFeatureEnabled() {
diff --git a/js/apps/admin-ui/src/utils/useQueryPermission.ts b/js/apps/admin-ui/src/utils/useQueryPermission.ts
index 1d6ca6f58033..46aa2f62c18f 100644
--- a/js/apps/admin-ui/src/utils/useQueryPermission.ts
+++ b/js/apps/admin-ui/src/utils/useQueryPermission.ts
@@ -26,7 +26,7 @@ export default function useQueryPermission(
     setStatus(null);
     setPlainStatus(null);
 
-    navigator.permissions.query({ name }).then((newStatus) => {
+    void navigator.permissions.query({ name }).then((newStatus) => {
       setStatus(newStatus);
       updatePlainStatus(newStatus);
     });
diff --git a/js/apps/admin-ui/src/utils/useSortedResourceTypes.ts b/js/apps/admin-ui/src/utils/useSortedResourceTypes.ts
new file mode 100644
index 000000000000..aa4868566ba3
--- /dev/null
+++ b/js/apps/admin-ui/src/utils/useSortedResourceTypes.ts
@@ -0,0 +1,35 @@
+import ResourceServerRepresentation from "@keycloak/keycloak-admin-client/lib/defs/resourceServerRepresentation";
+import { useMemo, useState } from "react";
+import { useAdminClient } from "../admin-client";
+import { useFetch } from "@keycloak/keycloak-ui-shared";
+import { sortBy } from "lodash-es";
+
+type UseSortedResourceTypesProps = {
+  clientId: string;
+};
+
+export default function useSortedResourceTypes({
+  clientId,
+}: UseSortedResourceTypesProps) {
+  const { adminClient } = useAdminClient();
+  const [resourceServer, setResourceServer] =
+    useState<ResourceServerRepresentation>();
+
+  useFetch(
+    () =>
+      adminClient.clients.getResourceServer({
+        id: clientId,
+      }),
+    setResourceServer,
+    [clientId],
+  );
+
+  const resourceTypes = useMemo(() => {
+    const allResourceTypes = resourceServer?.authorizationSchema?.resourceTypes;
+    return allResourceTypes
+      ? sortBy(Object.values(allResourceTypes), "type")
+      : [];
+  }, [resourceServer]);
+
+  return resourceTypes;
+}
diff --git a/js/apps/admin-ui/test/autentication/flow.ts b/js/apps/admin-ui/test/autentication/flow.ts
new file mode 100644
index 000000000000..5b0d2651615e
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/flow.ts
@@ -0,0 +1,147 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem } from "../utils/form";
+import { confirmModal } from "../utils/modal";
+
+export async function fillDuplicateFlowModal(
+  page: Page,
+  alias: string,
+  description?: string,
+) {
+  await page.getByTestId("alias").fill(alias);
+  await page.getByTestId("description").fill(description || "");
+  await confirmModal(page);
+}
+
+async function clickEditDropdownForFlow(page: Page, flowName: string) {
+  await page.getByTestId(`${flowName}-edit-dropdown`).click();
+}
+
+async function selectExecutionTestId(page: Page, executionTestId: string) {
+  await page.getByTestId(executionTestId).click();
+  await page.getByTestId("modal-add").click();
+}
+
+export async function addExecution(
+  page: Page,
+  subFlowName: string,
+  executionTestId: string,
+) {
+  await clickEditDropdownForFlow(page, subFlowName);
+  await page.getByRole("menuitem", { name: "Add execution" }).click();
+  await selectExecutionTestId(page, executionTestId);
+}
+
+export async function addCondition(
+  page: Page,
+  subFlowName: string,
+  executionTestId: string,
+) {
+  await clickEditDropdownForFlow(page, subFlowName);
+  await page.getByRole("menuitem", { name: "Add condition" }).click();
+  await selectExecutionTestId(page, executionTestId);
+}
+
+export async function addSubFlow(
+  page: Page,
+  subFlowName: string,
+  name: string,
+) {
+  await clickEditDropdownForFlow(page, subFlowName);
+  await page.getByRole("menuitem", { name: "Add sub-flow" }).click();
+  await page.getByTestId("name").fill(name);
+  await page.getByTestId("modal-add").click();
+}
+
+export async function clickDeleteRow(page: Page, flowName: string) {
+  await page.getByTestId(`${flowName}-delete`).click();
+}
+
+export async function assertRowExists(page: Page, name: string, exists = true) {
+  const locator = page.getByTestId(name);
+  if (exists) {
+    await expect(locator).toBeVisible();
+  } else {
+    await expect(locator).not.toBeVisible();
+  }
+}
+
+export async function fillBindFlowModal(page: Page, flowName: string) {
+  await selectItem(page, page.locator("#chooseBindingType"), flowName);
+}
+
+export async function goToRequiredActions(page: Page) {
+  await page.getByTestId("requiredActions").click();
+}
+
+export async function goToPoliciesTab(page: Page) {
+  await page.getByTestId("policies").click();
+}
+
+export async function goToOTPPolicyTab(page: Page) {
+  await goToPoliciesTab(page);
+  await page.getByTestId("otpPolicy").click();
+}
+
+export async function goToWebAuthnTab(page: Page) {
+  await goToPoliciesTab(page);
+  await page.getByTestId("webauthnPolicy").click();
+}
+
+export async function goToCIBAPolicyTab(page: Page) {
+  await goToPoliciesTab(page);
+  await page.getByTestId("tab-ciba-policy").click();
+}
+
+export async function addPolicy(page: Page, value) {
+  await selectItem(page, page.getByTestId("add-policy"), value);
+}
+
+const toKey = (name: string) => {
+  return name.replace(/\s/g, "-");
+};
+
+const getEnabledSwitch = (page: Page, name: string) => {
+  return page.locator(`#enable-${toKey(name)}`);
+};
+
+const getDefaultSwitch = (page: Page, name: string) => {
+  return page.locator(`#default-${toKey(name)}`);
+};
+
+export async function clickSwitchPolicy(page: Page, policyName: string) {
+  await getEnabledSwitch(page, policyName).click({ force: true });
+}
+
+export async function clickDefaultSwitchPolicy(page: Page, policyName: string) {
+  await getDefaultSwitch(page, policyName).click({ force: true });
+}
+
+export async function assertSwitchPolicyChecked(
+  page: Page,
+  policyName: string,
+) {
+  await expect(getEnabledSwitch(page, policyName)).toBeChecked();
+}
+
+export async function assertDefaultSwitchPolicyEnabled(
+  page: Page,
+  policyName: string,
+) {
+  await expect(getDefaultSwitch(page, policyName)).toBeEnabled();
+}
+
+export async function goToCreateItem(page: Page) {
+  await page.getByRole("link", { name: "Create flow" }).click();
+}
+
+export async function fillCreateForm(
+  page: Page,
+  name: string,
+  description: string,
+  type: string,
+) {
+  await page.getByTestId("alias").fill(name);
+  await page.getByTestId("description").fill(description);
+  await selectItem(page, page.getByLabel("Flow type"), type);
+  await page.getByTestId("create").click();
+}
diff --git a/js/apps/admin-ui/test/autentication/flows.spec.ts b/js/apps/admin-ui/test/autentication/flows.spec.ts
new file mode 100644
index 000000000000..fbfbe404e15d
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/flows.spec.ts
@@ -0,0 +1,355 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertRequiredFieldError, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertAxeViolations,
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToAuthentication, goToRealm } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  clickRowKebabItem,
+  clickTableRowItem,
+  getRowByCellText,
+  searchItem,
+} from "../utils/table";
+import {
+  addCondition,
+  addExecution,
+  addPolicy,
+  addSubFlow,
+  assertDefaultSwitchPolicyEnabled,
+  assertRowExists,
+  assertSwitchPolicyChecked,
+  clickDefaultSwitchPolicy,
+  clickDeleteRow,
+  clickSwitchPolicy,
+  fillBindFlowModal,
+  fillCreateForm,
+  fillDuplicateFlowModal,
+  goToCIBAPolicyTab,
+  goToCreateItem,
+  goToOTPPolicyTab,
+  goToPoliciesTab,
+  goToRequiredActions,
+  goToWebAuthnTab,
+} from "./flow";
+
+test.describe("Authentication test", () => {
+  const realmName = `authentication-flow-${uuidv4()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+  });
+
+  test("authentication search flow", async ({ page }) => {
+    const itemId = "browser";
+    await searchItem(page, "Search for flow", itemId);
+    await expect(getRowByCellText(page, itemId)).toBeVisible();
+    await expect(getRowByCellText(page, "clients")).not.toBeVisible();
+  });
+
+  test("should create duplicate of existing flow", async ({ page }) => {
+    await clickRowKebabItem(page, "browser", "Duplicate");
+    await fillDuplicateFlowModal(page, "Copy of browser");
+
+    await assertNotificationMessage(page, "Flow successfully duplicated");
+    await expect(page.locator('text="Copy of browser"')).toBeVisible();
+  });
+
+  test("Should fail duplicate with empty flow name", async ({ page }) => {
+    await clickRowKebabItem(page, "Direct grant", "Duplicate");
+    await fillDuplicateFlowModal(page, "");
+
+    await assertRequiredFieldError(page, "alias");
+  });
+
+  test("Should fail duplicate with duplicated name", async ({ page }) => {
+    await clickRowKebabItem(page, "Direct grant", "Duplicate");
+    await fillDuplicateFlowModal(page, "browser");
+
+    await assertNotificationMessage(
+      page,
+      "Could not duplicate flow: New flow alias name already exists",
+    );
+  });
+
+  test.describe("Flow details", () => {
+    const flowName = "Copy of browser test";
+
+    test.beforeEach(async ({ page }) => {
+      await adminClient.copyFlow("browser", flowName, realmName);
+      await page.getByTestId("refresh").click();
+    });
+
+    test.afterEach(() => adminClient.deleteFlow(flowName, realmName));
+
+    test("Should add a execution", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+      await addExecution(
+        page,
+        flowName + " forms",
+        "reset-credentials-choose-user",
+      );
+
+      await assertNotificationMessage(page, "Flow successfully updated");
+      await assertRowExists(page, "Choose User");
+    });
+
+    test("should add a condition", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+
+      await addCondition(
+        page,
+        flowName + " Browser - Conditional 2FA",
+        "conditional-user-role",
+      );
+
+      await assertNotificationMessage(page, "Flow successfully updated");
+    });
+
+    test("Should add a sub-flow", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+
+      const name = "SubFlow";
+      await addSubFlow(page, flowName + " Browser - Conditional 2FA", name);
+
+      await assertNotificationMessage(page, "Flow successfully updated");
+      await assertRowExists(page, name);
+    });
+
+    test("Should remove an execution", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+
+      const name = "Cookie";
+      await assertRowExists(page, name);
+
+      await clickDeleteRow(page, name);
+      await confirmModal(page);
+      await assertRowExists(page, "Cookie", false);
+    });
+
+    test("Should set as default in action menu", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+      await selectActionToggleItem(page, "Bind flow");
+
+      // set as default
+      await fillBindFlowModal(page, "Direct grant flow");
+      await clickSaveButton(page);
+      await assertNotificationMessage(page, "Flow successfully updated");
+      await expect(page.getByText("Default")).toBeVisible();
+
+      // unset as default
+      await goToAuthentication(page);
+      await clickTableRowItem(page, "direct grant");
+      await selectActionToggleItem(page, "Bind flow");
+      await fillBindFlowModal(page, "Direct grant flow");
+      await clickSaveButton(page);
+    });
+
+    test("Drag and drop execution", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+      const source = page.getByText("Identity Provider Redirector");
+      const target = page.getByText("Kerberos");
+
+      // execute mouse movement twice to trigger dragover event
+      await source.hover();
+      await source.hover();
+
+      await page.mouse.down();
+      await target.hover();
+      await target.hover();
+
+      await page.mouse.up();
+
+      await assertNotificationMessage(page, "Flow successfully updated");
+    });
+
+    test("Should edit flow details", async ({ page }) => {
+      await clickTableRowItem(page, flowName);
+
+      await selectActionToggleItem(page, "Edit info");
+
+      const newName = "New flow name";
+      await fillDuplicateFlowModal(page, newName, "Other description");
+      await assertNotificationMessage(page, "Flow successfully updated");
+      await expect(page.locator(`text="${newName}"`)).toBeVisible();
+    });
+  });
+});
+
+test.describe("Required actions", () => {
+  const realmName = `test-${uuidv4()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+    await goToRequiredActions(page);
+  });
+
+  test("should enable delete account", async ({ page }) => {
+    const action = "Delete Account";
+    await clickSwitchPolicy(page, action);
+    await assertNotificationMessage(
+      page,
+      "Updated required action successfully",
+    );
+    await assertSwitchPolicyChecked(page, action);
+  });
+
+  test("should register an unregistered action", async ({ page }) => {
+    const action = "Verify Profile";
+    await assertSwitchPolicyChecked(page, action);
+    await assertDefaultSwitchPolicyEnabled(page, action);
+    await clickSwitchPolicy(page, action);
+    await assertNotificationMessage(
+      page,
+      "Updated required action successfully",
+    );
+    await clickSwitchPolicy(page, action);
+    await assertNotificationMessage(
+      page,
+      "Updated required action successfully",
+    );
+    await assertSwitchPolicyChecked(page, action);
+    await assertDefaultSwitchPolicyEnabled(page, action);
+  });
+
+  test("should set action as default", async ({ page }) => {
+    const action = "Configure OTP";
+    await clickDefaultSwitchPolicy(page, action);
+    await assertNotificationMessage(
+      page,
+      "Updated required action successfully",
+    );
+    await assertSwitchPolicyChecked(page, action);
+  });
+});
+
+test.describe("Password policies tab", () => {
+  const realmName = `policies-password-${uuidv4()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+    await goToPoliciesTab(page);
+  });
+
+  test("should add password policies", async ({ page }) => {
+    await assertEmptyTable(page);
+    await addPolicy(page, "Not Recently Used");
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      "Password policies successfully updated",
+    );
+  });
+});
+
+test.describe("Accessibility tests for authentication", () => {
+  const realmName = "a11y-realm";
+  const flowName = `Flow-${uuidv4()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+  });
+
+  test("should pass accessibility checks on main page", async ({ page }) => {
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ authentication tab/ flows sub tab/ creating flow form", async ({
+    page,
+  }) => {
+    await goToCreateItem(page);
+
+    await assertAxeViolations(page);
+    await page.getByTestId("cancel").click();
+  });
+
+  test("Check a11y violations on load/ authentication tab/ flows sub tab/ creating flow", async ({
+    page,
+  }) => {
+    await goToCreateItem(page);
+    await fillCreateForm(
+      page,
+      flowName,
+      "Some nice description about what this flow does",
+      "Client flow",
+    );
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ authentication tab/ flows sub tab/ creating", async ({
+    page,
+  }) => {
+    await clickTableRowItem(page, "reset credentials");
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ authentication tab/ required actions sub tab", async ({
+    page,
+  }) => {
+    await goToRequiredActions(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ policies tab/ password policy sub tab", async ({
+    page,
+  }) => {
+    await goToPoliciesTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ authentication tab/ policies sub tab/ adding policy", async ({
+    page,
+  }) => {
+    await goToPoliciesTab(page);
+    await addPolicy(page, "Not Recently Used");
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ policies tab/ otp policy sub tab", async ({
+    page,
+  }) => {
+    await goToOTPPolicyTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ policies tab/ WebAuthn Policies sub tab", async ({
+    page,
+  }) => {
+    await goToWebAuthnTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on load/ policies tab/ CIBA Policy sub tab", async ({
+    page,
+  }) => {
+    await goToCIBAPolicyTab(page);
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/autentication/policies-ciba.spec.ts b/js/apps/admin-ui/test/autentication/policies-ciba.spec.ts
new file mode 100644
index 000000000000..9d7e36553db4
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/policies-ciba.spec.ts
@@ -0,0 +1,102 @@
+import { test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import adminClient from "../utils/AdminClient";
+import {
+  assertFieldError,
+  assertRequiredFieldError,
+  clickSaveButton,
+} from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToAuthentication, goToRealm } from "../utils/sidebar";
+import {
+  assertBackchannelTokenDeliveryMode,
+  assertExpiresInput,
+  assertIntervalInput,
+  assertSaveButtonDisabled,
+  clearExpiresInput,
+  clearIntervalInput,
+  expiresInput,
+  goToCIBAPolicyTab,
+  intervalInput,
+  setBackchannelTokenDeliveryMode,
+  setExpiresInput,
+  setIntervalInput,
+} from "./policies-ciba";
+
+test.describe("Authentication - Policies - CIBA", () => {
+  const realmName = `authentication-policies-${uuidv4()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealm(realmName);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+    await goToCIBAPolicyTab(page);
+  });
+
+  test("displays the initial state", async ({ page }) => {
+    // Check initial select value
+    await assertBackchannelTokenDeliveryMode(page, "Poll");
+
+    await assertExpiresInput(page, 120);
+    await assertIntervalInput(page, 5);
+
+    await assertSaveButtonDisabled(page);
+  });
+
+  test("validates the fields", async ({ page }) => {
+    // Test required fields
+    await clearExpiresInput(page);
+    await clearIntervalInput(page);
+
+    await assertRequiredFieldError(page, expiresInput);
+    await assertRequiredFieldError(page, intervalInput);
+
+    await assertSaveButtonDisabled(page);
+
+    // Test minimum values
+    await setExpiresInput(page, 9);
+    await setIntervalInput(page, -1);
+
+    await assertFieldError(page, expiresInput, "Must be greater than 10");
+    await assertFieldError(page, intervalInput, "Must be greater than 0");
+
+    await assertSaveButtonDisabled(page);
+
+    // // Test maximum values
+
+    await setExpiresInput(page, 601);
+    await setIntervalInput(page, 601);
+
+    await assertFieldError(page, expiresInput, "Must be less than 600");
+    await assertFieldError(page, intervalInput, "Must be less than 600");
+
+    await assertSaveButtonDisabled(page);
+  });
+
+  test("saves the form", async ({ page }) => {
+    // Set new values
+    await setBackchannelTokenDeliveryMode(page, "Ping");
+
+    await setExpiresInput(page, 140);
+    await setIntervalInput(page, 20);
+
+    // Save and verify success
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "CIBA policy successfully updated");
+
+    // Verify saved values
+    await assertBackchannelTokenDeliveryMode(page, "Ping");
+
+    await assertExpiresInput(page, 140);
+    await assertIntervalInput(page, 20);
+  });
+});
diff --git a/js/apps/admin-ui/test/autentication/policies-ciba.ts b/js/apps/admin-ui/test/autentication/policies-ciba.ts
new file mode 100644
index 000000000000..96faedca7baa
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/policies-ciba.ts
@@ -0,0 +1,79 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+export async function goToCIBAPolicyTab(page: Page) {
+  await page.getByTestId("policies").click();
+  await page.getByTestId("tab-ciba-policy").click();
+}
+
+export async function assertBackchannelTokenDeliveryMode(
+  page: Page,
+  deliveryMode: string,
+) {
+  const deliveryModeSelect = getBackchannelTokenDeliveryModeSelect(page);
+  await expect(deliveryModeSelect).toHaveText(deliveryMode);
+}
+
+export async function setBackchannelTokenDeliveryMode(
+  page: Page,
+  deliveryMode: string,
+) {
+  const deliveryModeSelect = getBackchannelTokenDeliveryModeSelect(page);
+  await selectItem(page, deliveryModeSelect, deliveryMode);
+}
+
+function getBackchannelTokenDeliveryModeSelect(page: Page) {
+  return page.getByLabel("Backchannel Token Delivery");
+}
+
+export async function assertExpiresInput(page: Page, value: number) {
+  const input = getExpiresInput(page);
+  await expect(input).toHaveValue(value.toString());
+}
+
+export async function setExpiresInput(page: Page, value: number) {
+  const input = getExpiresInput(page);
+  await input.fill(value.toString());
+}
+
+export async function clearExpiresInput(page: Page) {
+  return getExpiresInput(page).clear();
+}
+
+export const expiresInput = "attributes.cibaExpiresIn";
+function getExpiresInput(page: Page) {
+  return page.getByTestId(expiresInput);
+}
+
+export async function assertIntervalInput(page: Page, value: number) {
+  const input = getIntervalInput(page);
+  await expect(input).toHaveValue(value.toString());
+}
+
+export async function setIntervalInput(page: Page, value: number) {
+  const input = getIntervalInput(page);
+  await input.fill(value.toString());
+}
+
+export async function clearIntervalInput(page: Page) {
+  return getIntervalInput(page).clear();
+}
+
+export const intervalInput = "attributes.cibaInterval";
+function getIntervalInput(page: Page) {
+  return page.getByTestId(intervalInput);
+}
+
+export async function assertSaveButtonDisabled(page: Page) {
+  const button = getSaveButton(page);
+  await expect(button).toBeDisabled();
+}
+
+export async function assertSaveButtonEnabled(page: Page) {
+  const button = getSaveButton(page);
+  await expect(button).toBeEnabled();
+}
+
+function getSaveButton(page: Page) {
+  return page.getByTestId("save");
+}
diff --git a/js/apps/admin-ui/test/autentication/policies.spec.ts b/js/apps/admin-ui/test/autentication/policies.spec.ts
new file mode 100644
index 000000000000..ef9395933e3c
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/policies.spec.ts
@@ -0,0 +1,95 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToAuthentication, goToRealm } from "../utils/sidebar";
+import {
+  assertSupportedApplications,
+  fillSelects,
+  goToOTPPolicyTab,
+  goToWebauthnPage,
+  goToWebauthnPasswordlessPage,
+  increaseInitialCounter,
+  setPolicyType,
+  setWebAuthnPolicyCreateTimeout,
+} from "./policies";
+
+test.describe("OTP policies tab", () => {
+  const realmName = `policies-otp-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToAuthentication(page);
+    await goToOTPPolicyTab(page);
+  });
+
+  test("should change to hotp", async ({ page }) => {
+    // Check initial supported applications
+    await assertSupportedApplications(page, [
+      "FreeOTP",
+      "Google Authenticator",
+      "Microsoft Authenticator",
+    ]);
+
+    // Change policy type and save
+    await setPolicyType(page, "hotp");
+    await increaseInitialCounter(page);
+    await clickSaveButton(page);
+
+    // // Verify notification and updated supported applications
+    await assertNotificationMessage(page, "OTP policy successfully updated");
+    await assertSupportedApplications(page, [
+      "FreeOTP",
+      "Google Authenticator",
+    ]);
+  });
+});
+
+test.describe("Webauthn policies tabs", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToAuthentication(page);
+  });
+
+  test("should fill webauthn settings", async ({ page }) => {
+    await goToWebauthnPage(page);
+
+    await fillSelects(page, {
+      webAuthnPolicyAttestationConveyancePreference: "Indirect",
+      webAuthnPolicyRequireResidentKey: "Yes",
+      webAuthnPolicyUserVerificationRequirement: "Preferred",
+    });
+
+    await setWebAuthnPolicyCreateTimeout(page, 30);
+    await clickSaveButton(page);
+
+    await assertNotificationMessage(
+      page,
+      "Updated webauthn policies successfully",
+    );
+  });
+
+  test("should fill webauthn passwordless settings", async ({ page }) => {
+    await goToWebauthnPasswordlessPage(page);
+
+    await fillSelects(page, {
+      webAuthnPolicyPasswordlessAttestationConveyancePreference: "Indirect",
+      webAuthnPolicyPasswordlessRequireResidentKey: "Yes",
+      webAuthnPolicyPasswordlessUserVerificationRequirement: "Preferred",
+    });
+
+    await clickSaveButton(page);
+
+    await assertNotificationMessage(
+      page,
+      "Updated webauthn policies successfully",
+    );
+  });
+});
diff --git a/js/apps/admin-ui/test/autentication/policies.ts b/js/apps/admin-ui/test/autentication/policies.ts
new file mode 100644
index 000000000000..456019670787
--- /dev/null
+++ b/js/apps/admin-ui/test/autentication/policies.ts
@@ -0,0 +1,47 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+export async function goToOTPPolicyTab(page: Page) {
+  await page.getByTestId("policies").click();
+  await page.getByTestId("otpPolicy").click();
+}
+
+export async function assertSupportedApplications(
+  page: Page,
+  applications: string[],
+) {
+  const supportedApplications = page.getByTestId("supportedApplications");
+  await expect(supportedApplications).toHaveText(applications.join(""));
+}
+
+export async function setPolicyType(page: Page, type: string) {
+  await page.getByTestId(type).click();
+}
+
+export async function increaseInitialCounter(page: Page) {
+  await page.locator("#otpPolicyInitialCounter").getByLabel("Plus").click();
+}
+
+export async function goToWebauthnPage(page: Page) {
+  await page.getByTestId("policies").click();
+  await page.getByTestId("webauthnPolicy").click();
+}
+
+export async function goToWebauthnPasswordlessPage(page: Page) {
+  await page.getByTestId("policies").click();
+  await page.getByTestId("webauthnPasswordlessPolicy").click();
+}
+
+export async function fillSelects(page: Page, data: Record<string, string>) {
+  for (const prop of Object.keys(data)) {
+    const select = page.locator(`#${prop}`);
+    await selectItem(page, select, data[prop]);
+  }
+}
+
+export async function setWebAuthnPolicyCreateTimeout(
+  page: Page,
+  value: number,
+) {
+  await page.getByTestId("webAuthnPolicyCreateTimeout").fill(String(value));
+}
diff --git a/js/apps/admin-ui/test/client-scope/main.spec.ts b/js/apps/admin-ui/test/client-scope/main.spec.ts
new file mode 100644
index 000000000000..8ba1606ee612
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/main.spec.ts
@@ -0,0 +1,234 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertSaveButtonIsDisabled, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToClientScopes } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickNextPageButton,
+  clickRowKebabItem,
+  clickSelectRow,
+  getTableData,
+  searchItem,
+} from "../utils/table";
+import {
+  assertConsentInputIsVisible,
+  assertSwitchDisplayOnConsentScreenIsChecked,
+  fillClientScopeData,
+  getTableAssignedTypeColumn,
+  getTableProtocolColumn,
+  goToCreateItem,
+  selectChangeType,
+  selectClientScopeFilter,
+  selectSecondaryFilterAssignedType,
+  selectSecondaryFilterProtocol,
+  switchOffDisplayOnConsentScreen,
+} from "./main";
+
+enum FilterAssignedType {
+  AllTypes = "All types",
+  Default = "Default",
+  Optional = "Optional",
+  None = "None",
+}
+
+enum FilterProtocol {
+  All = "All",
+  SAML = "SAML",
+  OpenID = "OpenID Connect",
+}
+
+test.describe("Client Scopes test", () => {
+  const clientScopeName = "client-scope-test";
+  const itemId = `client-scope-test-${uuidv4()}`;
+  const clientScope = {
+    name: clientScopeName,
+    description: "",
+    protocol: "openid-connect",
+    attributes: {
+      "include.in.token.scope": "true",
+      "display.on.consent.screen": "true",
+      "gui.order": "1",
+      "consent.screen.text": "",
+    },
+  };
+  const placeHolder = "Search for client scope";
+  const tableName = "Client scopes";
+
+  test.beforeAll(async () => {
+    for (let i = 0; i < 5; i++) {
+      clientScope.name = clientScopeName + i;
+      await adminClient.createClientScope(clientScope);
+    }
+  });
+
+  test.afterAll(async () => {
+    for (let i = 0; i < 5; i++) {
+      if (await adminClient.existsClientScope(clientScopeName + i)) {
+        await adminClient.deleteClientScope(clientScopeName + i);
+      }
+    }
+  });
+
+  test.describe("Client Scope filter list items", () => {
+    test.beforeEach(async ({ page }) => {
+      await login(page);
+      await goToClientScopes(page);
+    });
+
+    test("should filter item by name", async ({ page }) => {
+      const itemName = clientScopeName + "0";
+      await searchItem(page, placeHolder, itemName);
+      await assertRowExists(page, itemName);
+      const rows = await getTableData(page, tableName);
+      expect(rows.length).toBe(1);
+    });
+
+    test("should filter items by Assigned type Default", async ({ page }) => {
+      await selectClientScopeFilter(page, "Assigned type");
+      await selectSecondaryFilterAssignedType(page, FilterAssignedType.Default);
+
+      const assignedTypes = await getTableAssignedTypeColumn(page, tableName);
+
+      expect(assignedTypes).toContain(FilterAssignedType.Default);
+      expect(assignedTypes).not.toContain(FilterAssignedType.Optional);
+      expect(assignedTypes).not.toContain(FilterAssignedType.None);
+    });
+
+    test("should filter items by Assigned type Optional", async ({ page }) => {
+      await selectClientScopeFilter(page, "Assigned type");
+      await selectSecondaryFilterAssignedType(
+        page,
+        FilterAssignedType.Optional,
+      );
+
+      const assignedTypes = await getTableAssignedTypeColumn(page, tableName);
+
+      expect(assignedTypes).not.toContain(FilterAssignedType.Default);
+      expect(assignedTypes).not.toContain(FilterAssignedType.None);
+      expect(assignedTypes).toContain(FilterAssignedType.Optional);
+    });
+
+    test("should filter items by Assigned type All", async ({ page }) => {
+      await selectClientScopeFilter(page, "Assigned type");
+      await selectSecondaryFilterAssignedType(
+        page,
+        FilterAssignedType.AllTypes,
+      );
+
+      const assignedTypes = await getTableAssignedTypeColumn(page, tableName);
+
+      expect(assignedTypes).toContain(FilterAssignedType.Default);
+      expect(assignedTypes).toContain(FilterAssignedType.Optional);
+      expect(assignedTypes).toContain(FilterAssignedType.None);
+    });
+
+    test("should filter items by Protocol OpenID", async ({ page }) => {
+      await selectClientScopeFilter(page, "Protocol");
+      await selectSecondaryFilterProtocol(page, FilterProtocol.OpenID);
+
+      const protocols = await getTableProtocolColumn(page, tableName);
+
+      expect(protocols).not.toContain(FilterProtocol.SAML);
+      expect(protocols).toContain(FilterProtocol.OpenID);
+    });
+
+    test("should filter items by Protocol SAML", async ({ page }) => {
+      await selectClientScopeFilter(page, "Protocol");
+      await selectSecondaryFilterProtocol(page, FilterProtocol.SAML);
+
+      const protocols = await getTableProtocolColumn(page, tableName);
+
+      expect(protocols).toContain(FilterProtocol.SAML);
+      expect(protocols).not.toContain(FilterProtocol.OpenID);
+    });
+
+    test("should show items on next page are more than 11", async ({
+      page,
+    }) => {
+      await clickNextPageButton(page);
+      const rows = await getTableData(page, tableName);
+      expect(rows.length).toBeGreaterThan(1);
+    });
+  });
+
+  test.describe("Client Scope modify list items", () => {
+    test.beforeEach(async ({ page }) => {
+      await login(page);
+      await goToClientScopes(page);
+    });
+
+    test("should modify selected item type to Default", async ({ page }) => {
+      const itemName = clientScopeName + "0";
+      await clickSelectRow(page, tableName, itemName);
+      await selectChangeType(page, FilterAssignedType.Default);
+      await assertNotificationMessage(page, "Scope mapping updated");
+
+      const rows = await getTableData(page, tableName);
+      const itemRow = rows.find((r) => r.includes(itemName));
+      expect(itemRow).toContain(FilterAssignedType.Default);
+    });
+  });
+
+  test.describe("Client Scope creation", () => {
+    test.beforeEach(async ({ page }) => {
+      await login(page);
+      await goToClientScopes(page);
+    });
+
+    test("should fail creating client scope", async ({ page }) => {
+      await goToCreateItem(page);
+      await assertSaveButtonIsDisabled(page);
+
+      await fillClientScopeData(page, "address");
+      await page.getByTestId("save").click();
+
+      await assertNotificationMessage(
+        page,
+        "Could not create client scope: 'Client Scope address already exists'",
+      );
+
+      await fillClientScopeData(page, "");
+      await expect(page.getByTestId("save")).toBeDisabled();
+    });
+
+    test("hides 'consent text' field when 'display consent' switch is disabled", async ({
+      page,
+    }) => {
+      await goToCreateItem(page);
+
+      await assertSwitchDisplayOnConsentScreenIsChecked(page);
+      await assertConsentInputIsVisible(page);
+
+      await switchOffDisplayOnConsentScreen(page);
+
+      await assertConsentInputIsVisible(page, true);
+    });
+
+    test("Client scope CRUD test", async ({ page }) => {
+      await assertRowExists(page, itemId, false);
+      await goToCreateItem(page);
+
+      await fillClientScopeData(page, itemId);
+      await clickSaveButton(page);
+
+      await assertNotificationMessage(page, "Client scope created");
+
+      await goToClientScopes(page);
+
+      await searchItem(page, placeHolder, itemId);
+      await assertRowExists(page, itemId);
+      await clickRowKebabItem(page, itemId, "Delete");
+
+      await confirmModal(page);
+      await assertNotificationMessage(
+        page,
+        "The client scope has been deleted",
+      );
+      await assertRowExists(page, itemId, false);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/client-scope/main.ts b/js/apps/admin-ui/test/client-scope/main.ts
new file mode 100644
index 000000000000..99d8232ca2d4
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/main.ts
@@ -0,0 +1,90 @@
+import { Page, expect } from "@playwright/test";
+import { assertSwitchIsChecked, selectItem, switchOff } from "../utils/form";
+import { clickTableToolbarItem, getTableData } from "../utils/table";
+
+export async function selectClientScopeFilter(page: Page, value: string) {
+  await page.getByTestId("clientScopeSearch").click();
+  await page.getByRole("menuitem", { name: value, exact: true }).click();
+}
+
+export async function selectSecondaryFilterAssignedType(
+  page: Page,
+  value: string,
+) {
+  await selectItem(page, page.getByTestId("clientScopeSearchType"), value);
+}
+
+export async function selectSecondaryFilterProtocol(
+  page: Page,
+  protocol: string,
+) {
+  await selectItem(
+    page,
+    page.getByTestId("clientScopeSearchProtocol"),
+    protocol,
+  );
+}
+
+export async function getTableAssignedTypeColumn(
+  page: Page,
+  tableName: string,
+) {
+  const rows = await getTableData(page, tableName);
+  return rows.map((row) => row[2]);
+}
+
+export async function getTableProtocolColumn(page: Page, tableName: string) {
+  const rows = await getTableData(page, tableName);
+  return rows.map((row) => row[3]);
+}
+
+export async function selectChangeType(page: Page, value: string) {
+  await selectItem(
+    page,
+    page.getByRole("button", { name: "Change type to" }),
+    value,
+  );
+}
+
+export async function goToCreateItem(page: Page) {
+  await clickTableToolbarItem(page, "Create client scope");
+}
+
+export async function fillClientScopeData(
+  page: Page,
+  name: string,
+  description = "",
+  consentScreenText = "",
+  displayOrder = "",
+) {
+  await page.getByTestId("name").fill(name);
+  await page.getByTestId("description").fill(description);
+  await selectItem(page, "#kc-protocol", "OpenID Connect");
+
+  await getConsentScreenTextInput(page).fill(consentScreenText);
+  await page.getByTestId("attributes.gui🍺order").fill(displayOrder);
+}
+
+function getSwitchDisplayOnConsentScreenInput() {
+  return "#attributes\\.display🍺on🍺consent🍺screen";
+}
+
+function getConsentScreenTextInput(page: Page) {
+  return page.getByTestId("attributes.consent🍺screen🍺text");
+}
+
+export async function assertSwitchDisplayOnConsentScreenIsChecked(page: Page) {
+  await assertSwitchIsChecked(page, getSwitchDisplayOnConsentScreenInput());
+}
+
+export async function assertConsentInputIsVisible(page: Page, not = false) {
+  if (not) {
+    await expect(getConsentScreenTextInput(page)).not.toBeVisible();
+  } else {
+    await expect(getConsentScreenTextInput(page)).toBeVisible();
+  }
+}
+
+export async function switchOffDisplayOnConsentScreen(page: Page) {
+  await switchOff(page, getSwitchDisplayOnConsentScreenInput());
+}
diff --git a/js/apps/admin-ui/test/client-scope/mappers.spec.ts b/js/apps/admin-ui/test/client-scope/mappers.spec.ts
new file mode 100644
index 000000000000..2487fd38aedd
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/mappers.spec.ts
@@ -0,0 +1,91 @@
+import { test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import { clickCancelButton, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToClientScopes } from "../utils/sidebar";
+import { assertRowExists, clickTableRowItem, searchItem } from "../utils/table";
+import {
+  addMappersByConfiguration,
+  addPredefinedMappers,
+  assertMapperConfigurationValues,
+  ClaimJsonType,
+  fillMapperDetails,
+  goToMappersTab,
+  removeMappers,
+} from "./mappers";
+import adminClient from "../utils/AdminClient";
+
+test.describe("Mappers tab test", () => {
+  const placeHolderClientScope = "Search for client scope";
+  const placeHolder = "Search for mapper";
+
+  const scopeName = `client-scope-mapper-${uuidv4()}`;
+
+  test.beforeAll(async () => {
+    const { id } = await adminClient.createClientScope({
+      name: scopeName,
+      description: "",
+      protocol: "openid-connect",
+    });
+    await adminClient.addMapping(id, {
+      name: "test",
+      protocol: "openid-connect",
+      protocolMapper: "oidc-hardcoded-claim-mapper",
+    });
+  });
+
+  test.afterAll(() => adminClient.deleteClientScope(scopeName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClientScopes(page);
+    await searchItem(page, placeHolderClientScope, scopeName);
+    await clickTableRowItem(page, scopeName);
+    await goToMappersTab(page);
+  });
+
+  test("CRUD predefined mappers", async ({ page }) => {
+    const mappers = ["birthdate", "email", "family name"];
+
+    await addPredefinedMappers(page, mappers);
+
+    // Configure first mapper
+    await searchItem(page, placeHolder, mappers[0]);
+    await clickTableRowItem(page, mappers[0]);
+    await fillMapperDetails(
+      page,
+      mappers[0] + "1",
+      mappers[0] + "2",
+      ClaimJsonType.Long,
+    );
+
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Mapping successfully updated");
+
+    await goToClientScopes(page);
+    await searchItem(page, placeHolderClientScope, scopeName);
+    await clickTableRowItem(page, scopeName);
+    await goToMappersTab(page);
+    await searchItem(page, placeHolder, mappers[0]);
+    await clickTableRowItem(page, mappers[0]);
+
+    await assertMapperConfigurationValues(
+      page,
+      mappers[0] + "1",
+      mappers[0] + "2",
+      ClaimJsonType.Long,
+    );
+
+    await clickCancelButton(page);
+  });
+
+  test("crud mappers by configuration", async ({ page }) => {
+    const mapperNames = ["Pairwise subject identifier", "Allowed Web Origins"];
+    await addMappersByConfiguration(page, mapperNames);
+
+    await assertRowExists(page, mapperNames[0]);
+
+    await removeMappers(page, mapperNames);
+  });
+});
diff --git a/js/apps/admin-ui/test/client-scope/mappers.ts b/js/apps/admin-ui/test/client-scope/mappers.ts
new file mode 100644
index 000000000000..943fb67d2315
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/mappers.ts
@@ -0,0 +1,100 @@
+import { Page, expect } from "@playwright/test";
+import {
+  assertSelectValue,
+  clickCancelButton,
+  clickSaveButton,
+  selectItem,
+} from "../utils/form";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import {
+  assertRowExists,
+  clickRowKebabItem,
+  clickSelectRow,
+} from "../utils/table";
+
+export enum ClaimJsonType {
+  String = "String",
+  Long = "long",
+  Int = "int",
+  Boolean = "boolean",
+  Json = "JSON",
+}
+
+export async function goToMappersTab(page: Page) {
+  await page.getByTestId("mappers").click();
+}
+
+async function clickAddMapperButton(page: Page) {
+  await page.getByRole("button", { name: "Add mapper" }).click();
+}
+
+export async function addPredefinedMappers(page: Page, mappers: string[]) {
+  await clickAddMapperButton(page);
+  await page.getByRole("menuitem", { name: "From predefined mappers" }).click();
+
+  for (const mapperName of mappers) {
+    await clickSelectRow(page, "Add predefined mappers", mapperName);
+  }
+
+  await confirmModal(page);
+  await assertNotificationMessage(page, "Mapping successfully created");
+
+  for (const mapperName of mappers) {
+    await assertRowExists(page, mapperName);
+  }
+}
+
+export async function addMappersByConfiguration(page: Page, mappers: string[]) {
+  for (const mapperName of mappers) {
+    await clickAddMapperButton(page);
+    await page.getByRole("menuitem", { name: "By configuration" }).click();
+
+    await page.getByText(mapperName, { exact: true }).click();
+    await page.getByTestId("name").fill(mapperName);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Mapping successfully created");
+    await clickCancelButton(page);
+  }
+}
+
+function getUserAttribute(page: Page) {
+  return page.getByTestId("config.user🍺attribute");
+}
+
+function getClaimName(page: Page) {
+  return page.getByTestId("claim.name");
+}
+
+function getClaimJsonType(page: Page) {
+  return page.getByLabel("Claim JSON Type");
+}
+
+export async function fillMapperDetails(
+  page: Page,
+  userAttribute: string,
+  tokenClaimName: string,
+  jsonType: ClaimJsonType,
+) {
+  await getUserAttribute(page).fill(userAttribute);
+  await getClaimName(page).fill(tokenClaimName);
+  await selectItem(page, getClaimJsonType(page), jsonType);
+}
+
+export async function assertMapperConfigurationValues(
+  page: Page,
+  userAttribute: string,
+  tokenClaimName: string,
+  jsonType: ClaimJsonType,
+) {
+  await expect(getUserAttribute(page)).toHaveValue(userAttribute);
+  await expect(getClaimName(page)).toHaveValue(tokenClaimName);
+  await assertSelectValue(getClaimJsonType(page), jsonType);
+}
+
+export async function removeMappers(page: Page, mapperNames: string[]) {
+  for (const name of mapperNames) {
+    await clickRowKebabItem(page, name, "Delete");
+    await assertNotificationMessage(page, "Mapping successfully deleted");
+  }
+}
diff --git a/js/apps/admin-ui/test/client-scope/scope.spec.ts b/js/apps/admin-ui/test/client-scope/scope.spec.ts
new file mode 100644
index 000000000000..e7e2feaf1a42
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/scope.spec.ts
@@ -0,0 +1,70 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalTitle, confirmModal } from "../utils/modal";
+import {
+  pickRoleType,
+  clickHideInheritedRoles,
+  clickUnassign,
+  confirmModalAssign,
+  pickRole,
+} from "../utils/roles";
+import { goToClientScopes } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertRowExists,
+  clickSelectRow,
+  clickTableRowItem,
+  getTableData,
+  searchItem,
+} from "../utils/table";
+import { goToScopeTab } from "./scope";
+
+test.describe("Scope tab test", () => {
+  const scopeName = `client-scope-mapper-${uuidv4()}`;
+  const tableName = "Role list";
+
+  test.beforeAll(async () =>
+    adminClient.createClientScope({
+      name: scopeName,
+      description: "",
+      protocol: "openid-connect",
+    }),
+  );
+
+  test.afterAll(() => adminClient.deleteClientScope(scopeName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClientScopes(page);
+    await searchItem(page, "Search for client scope", scopeName);
+    await clickTableRowItem(page, scopeName);
+    await goToScopeTab(page);
+  });
+
+  test("Assign and unassign role", async ({ page }) => {
+    const role = "admin";
+
+    await pickRoleType(page, "roles");
+    await pickRole(page, role, true);
+    await confirmModalAssign(page);
+
+    await assertNotificationMessage(page, "Role mapping updated");
+
+    await assertRowExists(page, role);
+
+    await clickHideInheritedRoles(page);
+    const data = await getTableData(page, tableName);
+    expect(data.length).toBeGreaterThan(1);
+    await clickHideInheritedRoles(page);
+
+    await clickSelectRow(page, tableName, role);
+    await clickUnassign(page);
+
+    await assertModalTitle(page, "Remove role?");
+    await confirmModal(page);
+    await assertEmptyTable(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/client-scope/scope.ts b/js/apps/admin-ui/test/client-scope/scope.ts
new file mode 100644
index 000000000000..302f6a758fa8
--- /dev/null
+++ b/js/apps/admin-ui/test/client-scope/scope.ts
@@ -0,0 +1,5 @@
+import { Page } from "@playwright/test";
+
+export async function goToScopeTab(page: Page) {
+  await page.getByTestId("scopeTab").click();
+}
diff --git a/js/apps/admin-ui/test/clients/advanced.spec.ts b/js/apps/admin-ui/test/clients/advanced.spec.ts
new file mode 100644
index 000000000000..7fb7b30d9069
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/advanced.spec.ts
@@ -0,0 +1,187 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuidv4 } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import { assertEmptyTable, clickTableRowItem } from "../utils/table";
+import {
+  assertAccessTokenSignatureAlgorithm,
+  assertAdvancedSwitchesOn,
+  assertBrowserFlowInput,
+  assertOnExcludeSessionStateSwitch,
+  assertTestClusterAvailability,
+  assertTokenLifespanClientOfflineSessionMaxVisible,
+  assertDirectGrantInput,
+  clickAdvancedSwitches,
+  clickAllCompatibilitySwitch,
+  deleteClusterNode,
+  expandClusterNode,
+  goToAdvancedTab,
+  registerNodeManually,
+  revertAdvanced,
+  revertCompatibility,
+  revertFineGrain,
+  saveAdvanced,
+  saveCompatibility,
+  saveFineGrain,
+  selectAccessTokenSignatureAlgorithm,
+  selectBrowserFlowInput,
+  selectDirectGrantInput,
+  switchOffExcludeSessionStateSwitch,
+  saveAuthFlowOverride,
+  revertAuthFlowOverride,
+  saveOid4vci,
+  revertOid4vci,
+  assertOid4vciEnabled,
+  switchOid4vciEnabled,
+} from "./advanced";
+
+test.describe("Advanced tab test", () => {
+  const clientId = `advanced-tab-${uuidv4()}`;
+
+  test.beforeAll(() =>
+    adminClient.createClient({ clientId, publicClient: true }),
+  );
+
+  test.afterAll(() => adminClient.deleteClient(clientId));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await clickTableRowItem(page, clientId);
+    await goToAdvancedTab(page);
+  });
+
+  test("Clustering", async ({ page }) => {
+    const host = "localhost";
+    await expandClusterNode(page);
+    await assertEmptyTable(page);
+    await registerNodeManually(page, host);
+    await assertTestClusterAvailability(page, true);
+    await deleteClusterNode(page, host);
+    await assertEmptyTable(page);
+  });
+
+  test("Fine grain OpenID connect configuration", async ({ page }) => {
+    const algorithm = "ES384";
+    await selectAccessTokenSignatureAlgorithm(page, algorithm);
+    await saveFineGrain(page);
+    await selectAccessTokenSignatureAlgorithm(page, "HS384");
+    await revertFineGrain(page);
+    await assertAccessTokenSignatureAlgorithm(page, algorithm);
+  });
+
+  test("OIDC Compatibility Modes configuration", async ({ page }) => {
+    await clickAllCompatibilitySwitch(page);
+    await saveCompatibility(page);
+    await switchOffExcludeSessionStateSwitch(page);
+    await revertCompatibility(page);
+    await assertOnExcludeSessionStateSwitch(page);
+  });
+
+  test("Client Offline Session Max", async ({ page }) => {
+    await assertTokenLifespanClientOfflineSessionMaxVisible(page, false);
+  });
+
+  test("Advanced settings", async ({ page }) => {
+    await clickAdvancedSwitches(page);
+    await saveAdvanced(page);
+    await assertAdvancedSwitchesOn(page);
+    await clickAdvancedSwitches(page, false);
+    await revertAdvanced(page);
+    await assertAdvancedSwitchesOn(page);
+  });
+
+  test("Authentication flow override", async ({ page }) => {
+    await selectBrowserFlowInput(page, "browser");
+    await selectDirectGrantInput(page, "docker auth");
+    await assertBrowserFlowInput(page, "browser");
+    await assertDirectGrantInput(page, "docker auth");
+    await revertAuthFlowOverride(page);
+    await assertBrowserFlowInput(page, "Choose...");
+    await assertDirectGrantInput(page, "Choose...");
+    await selectBrowserFlowInput(page, "browser");
+    await selectDirectGrantInput(page, "docker auth");
+    await saveAuthFlowOverride(page);
+    await selectBrowserFlowInput(page, "first broker login");
+    await selectDirectGrantInput(page, "first broker login");
+    await revertAuthFlowOverride(page);
+  });
+});
+
+test.describe("Client Offline Session Max", () => {
+  const realmName = `client-offline-session-${uuidv4()}`;
+  const clientId = `clientId-${uuidv4()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, {
+      offlineSessionMaxLifespanEnabled: true,
+    });
+    await adminClient.createClient({ clientId, realm: realmName });
+  });
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+    await clickTableRowItem(page, clientId);
+    await goToAdvancedTab(page);
+  });
+
+  test("Client Offline Session Max", async ({ page }) => {
+    await assertTokenLifespanClientOfflineSessionMaxVisible(page, true);
+  });
+});
+
+test.describe("OpenID for Verifiable Credentials", () => {
+  const realmName = `oid4vci-test-${uuidv4()}`;
+  const clientIdOpenIdConnect = `client-oidc-${uuidv4()}`;
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, {});
+    await adminClient.createClient({
+      clientId: clientIdOpenIdConnect,
+      realm: realmName,
+      protocol: "openid-connect",
+    });
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.describe("with protocol openid-connect", () => {
+    test.beforeEach(async ({ page }) => {
+      await login(page);
+      await goToRealm(page, realmName);
+      await goToClients(page);
+      await clickTableRowItem(page, clientIdOpenIdConnect);
+
+      await page.waitForSelector('[data-testid="advancedTab"]', {
+        state: "visible",
+        timeout: 10000,
+      });
+      await page.getByTestId("advancedTab").click();
+    });
+
+    test("should handle OID4VC section visibility based on feature flag", async ({
+      page,
+    }) => {
+      const toggleSwitch = page.locator("#attributes\\.oid4vci🍺enabled");
+
+      const isVisible = await toggleSwitch.isVisible();
+
+      if (isVisible) {
+        await toggleSwitch.scrollIntoViewIfNeeded();
+        await assertOid4vciEnabled(page, false);
+        await switchOid4vciEnabled(page, true);
+        await saveOid4vci(page);
+        await assertOid4vciEnabled(page, true);
+        await switchOid4vciEnabled(page, false);
+        await assertOid4vciEnabled(page, false);
+        await revertOid4vci(page);
+        await assertOid4vciEnabled(page, true);
+      } else {
+        await expect(toggleSwitch).toBeHidden();
+      }
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/advanced.ts b/js/apps/admin-ui/test/clients/advanced.ts
new file mode 100644
index 000000000000..42de2ff0a5ec
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/advanced.ts
@@ -0,0 +1,191 @@
+import { Page, expect } from "@playwright/test";
+import {
+  assertSelectValue,
+  selectItem,
+  switchOff,
+  switchOn,
+} from "../utils/form";
+import { confirmModal } from "../utils/modal";
+import { clickRowKebabItem } from "../utils/table";
+
+export async function goToAdvancedTab(page: Page) {
+  await page.getByTestId("advancedTab").click();
+}
+
+export async function expandClusterNode(page: Page) {
+  await page.getByRole("button", { name: "Registered cluster nodes" }).click();
+}
+
+export async function registerNodeManually(page: Page, host: string) {
+  await page.getByTestId("no-nodes-registered-empty-action").click();
+  await page.getByTestId("node").fill(host);
+  await page.getByRole("button", { name: "Save" }).click();
+}
+
+export async function assertTestClusterAvailability(
+  page: Page,
+  expected: boolean = true,
+) {
+  const button = page.getByTestId("test-cluster-availability");
+  if (expected) {
+    await expect(button).toBeEnabled();
+  } else {
+    await expect(button).toBeDisabled();
+  }
+}
+
+export async function deleteClusterNode(page: Page, host: string) {
+  await clickRowKebabItem(page, host, "Delete");
+  await confirmModal(page);
+}
+
+function getAccessTokenSignatureAlgorithm(page: Page) {
+  return page.locator("#attributes\\.access🍺token🍺signed🍺response🍺alg");
+}
+
+export async function selectAccessTokenSignatureAlgorithm(
+  page: Page,
+  algorithm: string,
+) {
+  await selectItem(page, getAccessTokenSignatureAlgorithm(page), algorithm);
+}
+
+export async function assertAccessTokenSignatureAlgorithm(
+  page: Page,
+  value: string,
+) {
+  await assertSelectValue(getAccessTokenSignatureAlgorithm(page), value);
+}
+
+export async function saveFineGrain(page: Page) {
+  await page.getByTestId("fineGrainSave").click();
+}
+
+export async function revertFineGrain(page: Page) {
+  await page.getByTestId("fineGrainRevert").click();
+}
+
+const excludeSessionStateSwitch =
+  "#excludeSessionStateFromAuthenticationResponse-switch";
+
+export async function switchOffExcludeSessionStateSwitch(page: Page) {
+  await switchOff(page, excludeSessionStateSwitch);
+}
+
+export async function assertOnExcludeSessionStateSwitch(page: Page) {
+  await expect(page.locator(excludeSessionStateSwitch)).toBeChecked();
+}
+
+export async function clickAllCompatibilitySwitch(page: Page) {
+  await switchOn(page, excludeSessionStateSwitch);
+  await switchOff(page, "#useRefreshTokens");
+  await switchOn(page, "#useRefreshTokenForClientCredentialsGrant");
+  await switchOn(page, "#useLowerCaseBearerType");
+}
+
+export async function saveCompatibility(page: Page) {
+  await page.getByTestId("OIDCCompatabilitySave").click();
+}
+
+export async function revertCompatibility(page: Page) {
+  await page.getByTestId("OIDCCompatabilityRevert").click();
+}
+
+export async function assertTokenLifespanClientOfflineSessionMaxVisible(
+  page: Page,
+  visible: boolean,
+) {
+  const locator = page.getByTestId("token-lifespan-clientOfflineSessionMax");
+  if (visible) {
+    await expect(locator).toBeVisible();
+  } else {
+    await expect(locator).toBeHidden();
+  }
+}
+
+const oAuthMutualSwitch =
+  "#attributes\\.tls🍺client🍺certificate🍺bound🍺access🍺tokens";
+const pushedAuthorizationRequestRequiredSwitch =
+  "#attributes\\.require🍺pushed🍺authorization🍺requests";
+const oid4vciEnabledSwitch = "#attributes\\.oid4vci🍺enabled";
+
+export async function clickAdvancedSwitches(page: Page, toggle = true) {
+  if (toggle) {
+    await switchOn(page, oAuthMutualSwitch);
+    await switchOn(page, pushedAuthorizationRequestRequiredSwitch);
+  } else {
+    await switchOff(page, oAuthMutualSwitch);
+    await switchOff(page, pushedAuthorizationRequestRequiredSwitch);
+  }
+}
+
+export async function assertAdvancedSwitchesOn(page: Page) {
+  await expect(page.locator(oAuthMutualSwitch)).toBeChecked();
+  await expect(
+    page.locator(pushedAuthorizationRequestRequiredSwitch),
+  ).toBeChecked();
+}
+
+export async function saveAdvanced(page: Page) {
+  await page.getByTestId("OIDCAdvancedSave").click();
+}
+
+export async function revertAdvanced(page: Page) {
+  await page.getByTestId("OIDCAdvancedRevert").click();
+}
+
+function getBrowserFlowInput(page: Page) {
+  return page.locator("#authenticationFlowBindingOverrides\\.browser");
+}
+
+function getDirectFlowInput(page: Page) {
+  return page.locator("#authenticationFlowBindingOverrides\\.direct_grant");
+}
+
+export async function selectBrowserFlowInput(page: Page, value: string) {
+  await selectItem(page, getBrowserFlowInput(page), value);
+}
+
+export async function selectDirectGrantInput(page: Page, value: string) {
+  await selectItem(page, getDirectFlowInput(page), value);
+}
+
+export async function assertBrowserFlowInput(page: Page, value: string) {
+  await assertSelectValue(getBrowserFlowInput(page), value);
+}
+
+export async function assertDirectGrantInput(page: Page, value: string) {
+  await assertSelectValue(getDirectFlowInput(page), value);
+}
+
+export async function saveAuthFlowOverride(page: Page) {
+  await page.getByTestId("OIDCAuthFlowOverrideSave").click();
+}
+
+export async function revertAuthFlowOverride(page: Page) {
+  await page.getByTestId("OIDCAuthFlowOverrideRevert").click();
+}
+
+export async function switchOid4vciEnabled(page: Page, enable: boolean) {
+  if (enable) {
+    await switchOn(page, oid4vciEnabledSwitch);
+  } else {
+    await switchOff(page, oid4vciEnabledSwitch);
+  }
+}
+
+export async function assertOid4vciEnabled(page: Page, enabled: boolean) {
+  if (enabled) {
+    await expect(page.locator(oid4vciEnabledSwitch)).toBeChecked();
+  } else {
+    await expect(page.locator(oid4vciEnabledSwitch)).not.toBeChecked();
+  }
+}
+
+export async function saveOid4vci(page: Page) {
+  await page.getByTestId("oid4vciSave").click();
+}
+
+export async function revertOid4vci(page: Page) {
+  await page.getByTestId("oid4vciRevert").click();
+}
diff --git a/js/apps/admin-ui/test/clients/authorization.spec.ts b/js/apps/admin-ui/test/clients/authorization.spec.ts
new file mode 100644
index 000000000000..e33c3250f712
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/authorization.spec.ts
@@ -0,0 +1,251 @@
+import { test } from "@playwright/test";
+import adminClient from "../utils/AdminClient";
+import { clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertAxeViolations,
+  assertNotificationMessage,
+} from "../utils/masthead";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import { assertRowExists, clickTableRowItem, searchItem } from "../utils/table";
+import {
+  assertClipboardHasText,
+  assertDefaultResource,
+  assertDownload,
+  clickAuthenticationSaveButton,
+  clickCopyButton,
+  createAuthorizationScope,
+  createPermission,
+  createPolicy,
+  createResource,
+  deletePolicy,
+  fillForm,
+  goToAuthorizationTab,
+  goToExportSubTab,
+  goToPermissionsSubTab,
+  goToPoliciesSubTab,
+  goToResourcesSubTab,
+  goToScopesSubTab,
+  inputClient,
+  selectResource,
+  setPolicy,
+} from "./authorization";
+
+test.describe("Client authentication subtab", () => {
+  const clientId = `client-authentication-${crypto.randomUUID()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createClient({
+      protocol: "openid-connect",
+      clientId,
+      publicClient: false,
+      authorizationServicesEnabled: true,
+      serviceAccountsEnabled: true,
+      standardFlowEnabled: true,
+    });
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteClient(clientId);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await searchItem(page, "Search for client", clientId);
+    await clickTableRowItem(page, clientId);
+    await goToAuthorizationTab(page);
+  });
+
+  test("Should update the resource server settings", async ({ page }) => {
+    await setPolicy(page, "DISABLED");
+    await clickAuthenticationSaveButton(page);
+    await assertNotificationMessage(page, "Resource successfully updated");
+  });
+
+  test("Should create a resource", async ({ page }) => {
+    await goToResourcesSubTab(page);
+    await assertDefaultResource(page);
+    await createResource(page, {
+      name: "Resource",
+      displayName: "The display name",
+      type: "type",
+      uris: ["one", "two"],
+    });
+
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Resource created successfully");
+  });
+
+  test("Edit a resource", async ({ page }) => {
+    await goToResourcesSubTab(page);
+    await clickTableRowItem(page, "Default Resource");
+
+    await fillForm(page, { displayName: "updated" });
+    await clickSaveButton(page);
+
+    await assertNotificationMessage(page, "Resource successfully updated");
+  });
+
+  test("Should create a scope", async ({ page }) => {
+    await goToScopesSubTab(page);
+    await createAuthorizationScope(page, {
+      name: "The scope",
+      displayName: "Display something",
+      iconUri: "res://something",
+    });
+    await clickSaveButton(page);
+
+    await assertNotificationMessage(
+      page,
+      "Authorization scope created successfully",
+    );
+    await goToScopesSubTab(page);
+    await assertRowExists(page, "The scope");
+  });
+
+  test("Should create a permission", async ({ page }) => {
+    await goToPermissionsSubTab(page);
+
+    await createPermission(page, "resource", {
+      name: "Permission name",
+      description: "Something describing this permission",
+    });
+    await selectResource(page, "Default Resource");
+
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      "Successfully created the permission",
+    );
+  });
+
+  test("Should create a policy", async ({ page }) => {
+    await goToPoliciesSubTab(page);
+    await createPolicy(page, "Regex", {
+      name: "Regex policy",
+      description: "Policy for regex",
+      targetClaim: "I don't know",
+      pattern: ".*?",
+    });
+    await clickSaveButton(page);
+
+    await assertNotificationMessage(page, "Successfully created the policy");
+  });
+
+  test("Should delete a policy", async ({ page }) => {
+    await goToPoliciesSubTab(page);
+    await deletePolicy(page, "Default Policy");
+
+    await assertNotificationMessage(page, "The Policy successfully deleted");
+  });
+
+  test("Should create a client policy", async ({ page }) => {
+    await goToPoliciesSubTab(page);
+    await createPolicy(page, "Client", {
+      name: "Client policy",
+      description: "Extra client field",
+    });
+
+    await inputClient(page, "master-realm");
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Successfully created the policy");
+  });
+
+  test("Should copy auth details", async ({ page, context, browserName }) => {
+    test.skip(browserName === "firefox", "Still working on it");
+    await context.grantPermissions(["clipboard-write", "clipboard-read"]);
+    await goToExportSubTab(page);
+    await clickCopyButton(page);
+    await assertNotificationMessage(page, "Authorization details copied.");
+    await assertClipboardHasText(page);
+  });
+
+  test("Should export auth details", async ({ page }) => {
+    await goToExportSubTab(page);
+
+    await assertDownload(page);
+  });
+});
+
+test.describe("Client authorization tab access for view-realm-authorization", () => {
+  const clientId = `realm-view-authz-client-${crypto.randomUUID()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm("realm-view-authz");
+    const testUser = await adminClient.createUser({
+      // Create user in master realm
+      username: "test-view-authz-user",
+      enabled: true,
+      credentials: [{ type: "password", value: "password" }],
+    });
+
+    await adminClient.addClientRoleToUser(
+      testUser.id!,
+      "realm-view-authz-realm",
+      ["view-realm", "view-users", "view-authorization", "view-clients"],
+    );
+    await adminClient.createClient({
+      realm: "realm-view-authz",
+      clientId,
+      authorizationServicesEnabled: true,
+      serviceAccountsEnabled: true,
+      standardFlowEnabled: true,
+    });
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteUser("test-view-authz-user");
+    await adminClient.deleteRealm("realm-view-authz");
+  });
+
+  test("Should view authorization tab", async ({ page }) => {
+    await login(page, "test-view-authz-user", "password");
+
+    await goToRealm(page, "realm-view-authz");
+    await page.reload();
+    await goToClients(page);
+
+    await searchItem(page, "Search for client", clientId);
+    await clickTableRowItem(page, clientId);
+    await goToAuthorizationTab(page);
+
+    await goToResourcesSubTab(page);
+    await clickTableRowItem(page, "Default Resource");
+    await page.goBack();
+
+    await goToScopesSubTab(page);
+    await goToPoliciesSubTab(page);
+    await goToPermissionsSubTab(page);
+  });
+});
+
+test.describe("Accessibility tests for client authorization", () => {
+  const clientId = `realm-view-authz-client-${crypto.randomUUID()}`;
+  test.beforeAll(() =>
+    adminClient.createClient({
+      protocol: "openid-connect",
+      clientId,
+      publicClient: false,
+      authorizationServicesEnabled: true,
+      serviceAccountsEnabled: true,
+      standardFlowEnabled: true,
+    }),
+  );
+
+  test.afterAll(() => adminClient.deleteClient(clientId));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await searchItem(page, "Search for client", clientId);
+    await clickTableRowItem(page, clientId);
+    await goToAuthorizationTab(page);
+  });
+
+  test("Check a11y violations on load/ client authorization", async ({
+    page,
+  }) => {
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/authorization.ts b/js/apps/admin-ui/test/clients/authorization.ts
new file mode 100644
index 000000000000..4f73e1e53c27
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/authorization.ts
@@ -0,0 +1,143 @@
+import ResourceRepresentation from "@keycloak/keycloak-admin-client/lib/defs/resourceRepresentation";
+import ScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/scopeRepresentation";
+import { Page, expect } from "@playwright/test";
+import { clickRowKebabItem, getRowByCellText } from "../utils/table";
+import { confirmModal } from "../utils/modal";
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+
+export async function goToAuthorizationTab(page: Page) {
+  await page.getByTestId("authorizationTab").click();
+}
+
+export async function goToResourcesSubTab(page: Page) {
+  await page.getByTestId("authorizationResources").click();
+}
+
+export async function setPolicy(page: Page, policy: string) {
+  await page.getByTestId(policy).click();
+}
+
+export async function clickAuthenticationSaveButton(page: Page) {
+  await page.getByTestId("authenticationSettings-save").click();
+}
+
+export async function assertDefaultResource(page: Page) {
+  await expect(page.getByTestId("name-column-Default Resource")).toHaveText(
+    "Default Resource",
+  );
+}
+
+export async function assertResource(page: Page, name: string) {
+  await expect(getRowByCellText(page, name)).toBeVisible();
+}
+
+export async function createResource(
+  page: Page,
+  resource: ResourceRepresentation,
+) {
+  await page.getByTestId("createResource").click();
+  await fillForm(page, resource);
+}
+
+export async function fillForm(
+  page: Page,
+  resource:
+    | ResourceRepresentation
+    | ScopeRepresentation
+    | PolicyRepresentation
+    | { [key: string]: string },
+) {
+  for (const [key, value] of Object.entries(resource)) {
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index++) {
+        const v = value[index];
+        await page.getByTestId(`${key}${index}`).fill(v);
+        await page.getByTestId("uris-addValue").click();
+      }
+    } else {
+      await page.getByTestId(key).fill(value);
+    }
+  }
+}
+
+export async function goToScopesSubTab(page: Page) {
+  await page.getByTestId("authorizationScopes").click();
+}
+
+export async function createAuthorizationScope(
+  page: Page,
+  scope: ScopeRepresentation,
+) {
+  await page.getByTestId("no-authorization-scopes-empty-action").click();
+  await fillForm(page, scope);
+}
+
+export async function goToPoliciesSubTab(page: Page) {
+  await page.getByTestId("authorizationPolicies").click();
+}
+
+export async function createPolicy(
+  page: Page,
+  type: string,
+  policy: { [key: string]: string },
+) {
+  await page.getByTestId("createPolicy").click();
+  await page.getByRole("gridcell", { name: type, exact: true }).click();
+  await fillForm(page, policy);
+}
+
+export async function deletePolicy(page: Page, policyName: string) {
+  await clickRowKebabItem(page, policyName, "Delete");
+  await confirmModal(page);
+}
+
+export async function inputClient(page: Page, clientName: string) {
+  await page.getByLabel("Type to filter").click();
+  await page.getByLabel("Type to filter").fill(clientName);
+  await page.getByRole("option", { name: clientName }).click();
+}
+
+export async function goToPermissionsSubTab(page: Page) {
+  await page.getByTestId("authorizationPermissions").click();
+}
+
+export async function createPermission(
+  page: Page,
+  type: string,
+  permission: PolicyRepresentation,
+) {
+  await page.getByTestId("permissionCreateDropdown").click();
+  await page.getByTestId(`create-${type}`).click();
+  await fillForm(page, permission);
+}
+
+export async function selectResource(page: Page, resourceName: string) {
+  await page.locator("#resources").getByLabel("Menu toggle").click();
+  await page.getByRole("option", { name: resourceName }).click();
+}
+
+export async function goToExportSubTab(page: Page) {
+  await page.getByTestId("authorizationExport").click();
+}
+
+export async function clickCopyButton(page: Page) {
+  await page.getByTestId("authorization-export-copy").click();
+}
+
+export async function assertClipboardHasText(page: Page) {
+  const clipboardText = await page.evaluateHandle(() =>
+    navigator.clipboard.readText(),
+  );
+  await expect(page.getByTestId("authorization-export-code-editor")).toHaveText(
+    await clipboardText.jsonValue(),
+  );
+}
+
+export async function assertDownload(page: Page) {
+  const downloadPromise = page.waitForEvent("download");
+
+  await page.getByTestId("authorization-export-download").click();
+
+  const download = await downloadPromise;
+  expect(download.suggestedFilename()).toBeDefined();
+}
diff --git a/js/apps/admin-ui/test/clients/details.spec.ts b/js/apps/admin-ui/test/clients/details.spec.ts
new file mode 100644
index 000000000000..a19fec9cb55e
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/details.spec.ts
@@ -0,0 +1,76 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertRequiredFieldError } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import { clickTableRowItem, searchItem } from "../utils/table";
+import { continueNext, createClient, save } from "./utils";
+import {
+  assertKeyForCodeExchangeInput,
+  selectKeyForCodeExchangeInput,
+} from "./details";
+
+test.describe("Clients details test", () => {
+  const realmName = `clients-details-realm-${uuid()}`;
+  const clientId = `client-details-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createClient({
+      clientId,
+      protocol: "openid-connect",
+      publicClient: false,
+      realm: realmName,
+    });
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealm(realmName);
+    await adminClient.deleteClient(clientId);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+    await searchItem(page, "Search for client", clientId);
+  });
+
+  test("Should test clientId required", async ({ page }) => {
+    await createClient(page);
+    await assertRequiredFieldError(page, "clientId");
+  });
+
+  test("Cancel create should return to clients", async ({ page }) => {
+    await createClient(
+      page,
+      { clientId },
+      async () => await page.getByRole("button", { name: "Cancel" }).click(),
+    );
+
+    await expect(page).not.toHaveURL("add-client");
+  });
+
+  test("Should be able to create a client", async ({ page }) => {
+    await createClient(page, {
+      clientId: `created-client-${uuid()}`,
+      name: "ClientName",
+      description: "ClientDescription",
+    });
+
+    await continueNext(page);
+    await save(page);
+
+    await assertNotificationMessage(page, "Client created successfully");
+  });
+
+  test("Should be able to update a client", async ({ page }) => {
+    await clickTableRowItem(page, clientId);
+    await selectKeyForCodeExchangeInput(page, "S256");
+    await save(page);
+    await assertNotificationMessage(page, "Client successfully updated");
+    await assertKeyForCodeExchangeInput(page, "S256");
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/details.ts b/js/apps/admin-ui/test/clients/details.ts
new file mode 100644
index 000000000000..e59194cff6b8
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/details.ts
@@ -0,0 +1,14 @@
+import { Page } from "@playwright/test";
+import { selectItem, assertSelectValue } from "../utils/form";
+
+function getKeyForCodeExchangeInput(page: Page) {
+  return page.locator("#keyForCodeExchange");
+}
+
+export async function selectKeyForCodeExchangeInput(page: Page, value: string) {
+  await selectItem(page, getKeyForCodeExchangeInput(page), value);
+}
+
+export async function assertKeyForCodeExchangeInput(page: Page, value: string) {
+  await assertSelectValue(getKeyForCodeExchangeInput(page), value);
+}
diff --git a/js/apps/admin-ui/test/clients/initial-access.spec.ts b/js/apps/admin-ui/test/clients/initial-access.spec.ts
new file mode 100644
index 000000000000..3d51e960e001
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/initial-access.spec.ts
@@ -0,0 +1,105 @@
+import { expect, test } from "@playwright/test";
+import adminClient from "../utils/AdminClient";
+import { clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalTitle, confirmModal } from "../utils/modal";
+import { goToClients } from "../utils/sidebar";
+import {
+  assertNoResults,
+  clearAllFilters,
+  clickRowKebabItem,
+  clickTableToolbarItem,
+  getTableData,
+  searchItem,
+} from "../utils/table";
+import {
+  assertClipboardContent,
+  assertCountValue,
+  assertExpirationGreaterThanZeroError,
+  assertInitialAccessTokensIsEmpty,
+  assertInitialAccessTokensIsNotEmpty,
+  checkSaveButtonIsDisabled as assertSaveButtonIsDisabled,
+  closeModal,
+  fillNewTokenData,
+  goToCreateFromEmptyList,
+  goToInitialAccessTokenTab,
+} from "./initial-access";
+
+test.describe("Client initial access tokens", () => {
+  const tableName = "Initial access token";
+  const placeHolder = "Search token";
+  const countCellNumber = 3;
+  const remainingCountCellNumber = 4;
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+  });
+
+  test.afterAll(async () => adminClient.deleteAllTokens());
+
+  test("Initial access token can't be created with 0 days and count", async ({
+    page,
+  }) => {
+    await goToInitialAccessTokenTab(page);
+    await assertInitialAccessTokensIsEmpty(page);
+    await goToCreateFromEmptyList(page);
+    await fillNewTokenData(page, 0, 0);
+    await assertExpirationGreaterThanZeroError(page);
+    await assertCountValue(page, 1);
+    await assertSaveButtonIsDisabled(page);
+  });
+
+  test("Initial access token", async ({ page, context, browserName }) => {
+    test.skip(browserName === "firefox", "Still working on it");
+    await context.grantPermissions(["clipboard-write", "clipboard-read"]);
+
+    await goToInitialAccessTokenTab(page);
+    await assertInitialAccessTokensIsEmpty(page);
+    await goToCreateFromEmptyList(page);
+    await fillNewTokenData(page, 1, 3);
+    await clickSaveButton(page);
+
+    await assertModalTitle(page, "Initial access token details");
+    await assertClipboardContent(page);
+    await closeModal(page);
+
+    await assertNotificationMessage(
+      page,
+      "New initial access token has been created",
+    );
+
+    await assertInitialAccessTokensIsNotEmpty(page);
+
+    await searchItem(page, placeHolder, "John Doe");
+    await assertNoResults(page);
+    await clearAllFilters(page);
+
+    let data = (await getTableData(page, tableName))[0];
+    expect(data[countCellNumber]).toBe("4");
+    expect(data[remainingCountCellNumber]).toBe("4");
+
+    await clickTableToolbarItem(page, "Create");
+    await fillNewTokenData(page, 1, 3);
+    await clickSaveButton(page);
+    await assertClipboardContent(page);
+    await closeModal(page);
+
+    await clickRowKebabItem(page, data[0], "Delete");
+    await assertModalTitle(page, "Delete initial access token?");
+    await confirmModal(page);
+
+    await assertNotificationMessage(
+      page,
+      "Initial access token deleted successfully",
+    );
+    await assertInitialAccessTokensIsNotEmpty(page);
+    data = (await getTableData(page, tableName))[0];
+
+    await clickRowKebabItem(page, data[0], "Delete");
+    await confirmModal(page);
+
+    await assertInitialAccessTokensIsEmpty(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/initial-access.ts b/js/apps/admin-ui/test/clients/initial-access.ts
new file mode 100644
index 000000000000..9227c52c6379
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/initial-access.ts
@@ -0,0 +1,63 @@
+import { Page, expect } from "@playwright/test";
+import { assertFieldError } from "../utils/form";
+
+export async function goToInitialAccessTokenTab(page: Page) {
+  await page.getByTestId("initialAccessToken").click();
+}
+
+export async function assertInitialAccessTokensIsEmpty(page: Page) {
+  await expect(
+    page.getByTestId("no-initial-access-tokens-empty-action"),
+  ).toBeVisible();
+}
+
+export async function assertInitialAccessTokensIsNotEmpty(page: Page) {
+  await expect(
+    page.getByTestId("no-initial-access-tokens-empty-action"),
+  ).not.toBeVisible();
+}
+
+export async function goToCreateFromEmptyList(page: Page) {
+  await page.getByTestId("no-initial-access-tokens-empty-action").click();
+}
+
+export async function fillNewTokenData(
+  page: Page,
+  days: number,
+  count: number,
+) {
+  await page.getByTestId("expiration").fill(days.toString());
+
+  for (let i = 0; i < count; i++) {
+    await page.locator('#count [aria-label="Plus"]').click();
+  }
+}
+
+export async function assertExpirationGreaterThanZeroError(page: Page) {
+  await assertFieldError(
+    page,
+    "expiration",
+    "Value should be greater than or equal to 1",
+  );
+}
+
+export async function assertCountValue(page: Page, expectedCount: number) {
+  await expect(page.locator("#count input")).toHaveValue(
+    expectedCount.toString(),
+  );
+}
+
+export async function checkSaveButtonIsDisabled(page: Page) {
+  await expect(page.getByTestId("save")).toBeDisabled();
+}
+
+export async function assertClipboardContent(page: Page) {
+  await page.locator('[data-testid="initialAccessToken"] button').click();
+  expect(await page.evaluate(() => navigator.clipboard.readText())).toMatch(
+    /^[0-9A-Za-z.\-_]{300,}$/,
+  );
+}
+
+export async function closeModal(page: Page) {
+  await page.getByLabel("Close", { exact: true }).click();
+}
diff --git a/js/apps/admin-ui/test/clients/main.spec.ts b/js/apps/admin-ui/test/clients/main.spec.ts
new file mode 100644
index 000000000000..ae1cecfdcf63
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/main.spec.ts
@@ -0,0 +1,155 @@
+import { expect, test } from "@playwright/test";
+import path from "path";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertRequiredFieldError } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalTitle, confirmModal } from "../utils/modal";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import {
+  clearAllFilters,
+  clickRowKebabItem,
+  getRowByCellText,
+  searchItem,
+} from "../utils/table";
+import {
+  cancel,
+  clientCapabilityConfig,
+  continueNext,
+  createClient,
+  save,
+} from "./utils";
+
+test.describe("Clients test", () => {
+  const realmName = `clients-realm-${uuid()}`;
+  const clientId = `clientId`;
+  const placeHolder = "Search for client";
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealm(realmName);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+  });
+
+  test("Should test clientId required", async ({ page }) => {
+    await createClient(page);
+    await assertRequiredFieldError(page, "clientId");
+  });
+
+  test("Cancel create should return to clients", async ({ page }) => {
+    await createClient(page, { clientId }, () => cancel(page));
+
+    await expect(page).not.toHaveURL("add-client");
+  });
+
+  test("Should be able to create a client", async ({ page }) => {
+    await createClient(page, {
+      clientId: `created-client-${uuid()}`,
+      name: "ClientName",
+      description: "ClientDescription",
+    });
+
+    await continueNext(page);
+    await save(page);
+
+    await assertNotificationMessage(page, "Client created successfully");
+  });
+
+  test("Should fail creating client that already exists", async ({ page }) => {
+    await createClient(page, {
+      clientId: "account",
+      name: "${account}",
+    });
+
+    await continueNext(page);
+    await save(page);
+
+    await assertNotificationMessage(
+      page,
+      "Could not create client: 'Client account already exists'",
+    );
+  });
+
+  test("Create client", async ({ page }) => {
+    const client = {
+      clientId,
+      name: "ClientName",
+      description: "ClientDescription",
+      alwaysDisplayInConsole: true,
+      publicClient: true,
+      directAccessGrantsEnabled: true,
+      implicitFlowEnabled: true,
+      serviceAccountsEnabled: true,
+      standardFlowEnabled: true,
+      attributes: {
+        "oauth2.device.authorization.grant.enabled": "true",
+        "oidc.ciba.grant.enabled": "true",
+      },
+    };
+    await createClient(page, client);
+    await clientCapabilityConfig(page, client);
+    await continueNext(page);
+    await save(page);
+
+    await assertNotificationMessage(page, "Client created successfully");
+
+    await goToClients(page);
+    await clickRowKebabItem(page, clientId, "Delete");
+    await assertModalTitle(page, `Delete ${clientId} ?`);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "The client has been deleted");
+  });
+
+  test("Search for clients", async ({ page }) => {
+    await searchItem(page, placeHolder, "John Doe");
+    await expect(
+      page.getByRole("heading", { name: "No search results" }),
+    ).toBeVisible();
+
+    await clearAllFilters(page);
+    await expect(getRowByCellText(page, "account")).toBeVisible();
+  });
+
+  test.describe("Clients import", () => {
+    test.beforeAll(() =>
+      adminClient.createClient({
+        clientId: "identical",
+        protocol: "openid-connect",
+        realm: realmName,
+      }),
+    );
+
+    test.afterAll(() => adminClient.deleteClient("identical"));
+
+    test("Import client", async ({ page }) => {
+      await page.getByTestId("importClient").click();
+
+      const fileChooserPromise = page.waitForEvent("filechooser");
+      await page.getByText("Browse...").click();
+      const fileChooser = await fileChooserPromise;
+      await fileChooser.setFiles(
+        new URL(
+          path.join(
+            path.dirname(import.meta.url),
+            "../utils/files/import-identical-client.json",
+          ),
+        ).pathname,
+      );
+
+      await save(page);
+      await assertNotificationMessage(
+        page,
+        "Could not import client: Client identical already exists",
+      );
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/registration-policies.spec.ts b/js/apps/admin-ui/test/clients/registration-policies.spec.ts
new file mode 100644
index 000000000000..3607c69da987
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/registration-policies.spec.ts
@@ -0,0 +1,153 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { clickCancelButton, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertAxeViolations,
+  assertNotificationMessage,
+} from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickRowKebabItem,
+  clickTableRowItem,
+  getTableData,
+} from "../utils/table";
+import {
+  clickCreateAnonymousPolicy,
+  clickCreateAuthenticatedPolicy,
+  createPolicy,
+  fillPolicyForm,
+  goToAuthenticatedSubTab,
+  goToClientRegistrationTab,
+} from "./registration-policies";
+
+test.describe("Client registration policies tab", () => {
+  const tabName = "Client registration";
+  const realmName = `clients-details-realm-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+    await goToClientRegistrationTab(page);
+  });
+
+  test.describe("Anonymous client policies subtab", () => {
+    const policyName = "newAnonymPolicy1";
+    const policyNameUpdated = "policy2";
+
+    test("check anonymous clients list is not empty", async ({ page }) => {
+      const rows = await getTableData(page, tabName);
+      expect(rows.length).toBeGreaterThan(1);
+    });
+
+    test("add anonymous client registration policy", async ({ page }) => {
+      await clickCreateAnonymousPolicy(page);
+      await createPolicy(page, "max-clients", { name: policyName });
+      await clickSaveButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "New client policy created successfully",
+      );
+      await clickCancelButton(page);
+
+      await assertRowExists(page, policyName);
+    });
+
+    test("edit anonymous client registration policy", async ({ page }) => {
+      await clickTableRowItem(page, "Consent Required");
+      await fillPolicyForm(page, { name: policyNameUpdated });
+      await clickSaveButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "Client policy updated successfully",
+      );
+      await clickCancelButton(page);
+
+      await assertRowExists(page, policyNameUpdated);
+    });
+
+    test("delete anonymous client registration policy", async ({ page }) => {
+      await clickRowKebabItem(page, "Full Scope Disabled", "Delete");
+      await confirmModal(page);
+
+      await assertNotificationMessage(
+        page,
+        "Client registration policy deleted successfully",
+      );
+    });
+  });
+
+  test.describe("Authenticated client policies subtab", () => {
+    const policyName = "newAuthPolicy1";
+    const policyNameUpdated = "policy3";
+
+    test.beforeEach(async ({ page }) => {
+      await goToAuthenticatedSubTab(page);
+    });
+
+    test("check authenticated clients list is not empty", async ({ page }) => {
+      const rows = await getTableData(page, tabName);
+      expect(rows.length).toBeGreaterThan(1);
+    });
+
+    test("add authenticated client registration policy", async ({ page }) => {
+      await clickCreateAuthenticatedPolicy(page);
+      await createPolicy(page, "scope", { name: policyName });
+      await clickSaveButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "New client policy created successfully",
+      );
+      await clickCancelButton(page);
+
+      await assertRowExists(page, policyName);
+    });
+
+    test("edit authenticated client registration policy", async ({ page }) => {
+      await clickTableRowItem(page, "Allowed Protocol Mapper Types");
+      await fillPolicyForm(page, { name: policyNameUpdated });
+      await clickSaveButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "Client policy updated successfully",
+      );
+      await clickCancelButton(page);
+      await assertRowExists(page, policyNameUpdated);
+    });
+
+    test("delete authenticated client registration policy", async ({
+      page,
+    }) => {
+      await clickRowKebabItem(page, "Allowed Client Scopes", "Delete");
+      await confirmModal(page);
+
+      await assertNotificationMessage(
+        page,
+        "Client registration policy deleted successfully",
+      );
+    });
+  });
+});
+
+test.describe("Accessibility tests for client registration policies", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await goToClientRegistrationTab(page);
+  });
+
+  test("Check accessibility violations", async ({ page }) => {
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/registration-policies.ts b/js/apps/admin-ui/test/clients/registration-policies.ts
new file mode 100644
index 000000000000..970a0ab5de0e
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/registration-policies.ts
@@ -0,0 +1,28 @@
+import { Page } from "@playwright/test";
+
+export async function goToClientRegistrationTab(page: Page) {
+  await page.getByTestId("registration").click();
+}
+
+export async function goToAuthenticatedSubTab(page: Page) {
+  await page.getByTestId("authenticated").click();
+}
+
+export async function clickCreateAnonymousPolicy(page: Page) {
+  await page.getByTestId("createPolicy-anonymous").click();
+}
+
+export async function clickCreateAuthenticatedPolicy(page: Page) {
+  await page.getByTestId("createPolicy-authenticated").click();
+}
+
+type Policy = { name: string };
+
+export async function createPolicy(page: Page, type: string, data: Policy) {
+  await page.getByTestId(type).getByText(type, { exact: true }).click();
+  await fillPolicyForm(page, data);
+}
+
+export async function fillPolicyForm(page: Page, data: Policy) {
+  await page.getByTestId("name").fill(data.name);
+}
diff --git a/js/apps/admin-ui/test/clients/role.spec.ts b/js/apps/admin-ui/test/clients/role.spec.ts
new file mode 100644
index 000000000000..287697b3c65b
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/role.spec.ts
@@ -0,0 +1,215 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import {
+  assertAttributeLength,
+  clickAttributeSaveButton,
+  deleteAttribute,
+  fillAttributeData,
+  goToAttributesTab,
+} from "../utils/attributes";
+import { assertRequiredFieldError, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { assertModalTitle, confirmModal } from "../utils/modal";
+import { clickUnassign } from "../utils/roles";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import {
+  assertNoResults,
+  assertRowExists,
+  clearAllFilters,
+  clickRowKebabItem,
+  clickSelectRow,
+  clickTableRowItem,
+  searchItem,
+} from "../utils/table";
+import {
+  addAssociatedRoles,
+  assertDescriptionValue,
+  fillRoleData,
+  goToAssociatedRolesTab,
+  goToCreateRole,
+  goToCreateRoleFromEmptyState,
+  goToRolesTab,
+} from "./role";
+
+test.describe("Roles tab test", () => {
+  const realmName = `clients-realm-${uuid()}`;
+  const itemId = `client-crud-${uuid()}`;
+  const updatableItem = `role-name-${uuid()}`;
+  const client = `client-${uuid()}`;
+  const oneRoleClient = `client-one-role-${uuid()}`;
+  const createRealmRoleName = `create-realm-${uuid()}`;
+  const placeHolder = "Search role by name";
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createClient({
+      clientId: client,
+      protocol: "openid-connect",
+      publicClient: false,
+      realm: realmName,
+    });
+    await adminClient.createRealmRole({
+      name: createRealmRoleName,
+      realm: realmName,
+    });
+    const { id } = await adminClient.createClient({
+      clientId: oneRoleClient,
+      protocol: "openid-connect",
+      publicClient: false,
+      realm: realmName,
+    });
+    await adminClient.createClientRole(id, {
+      name: updatableItem,
+      realm: realmName,
+    });
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test("should fail to create client role with empty name", async ({
+    page,
+  }) => {
+    await clickTableRowItem(page, client);
+    await goToRolesTab(page);
+
+    await goToCreateRoleFromEmptyState(page);
+    await fillRoleData(page, "");
+    await clickSaveButton(page);
+    await assertRequiredFieldError(page, "name");
+  });
+
+  test("should create client role", async ({ page }) => {
+    await clickTableRowItem(page, client);
+    await goToRolesTab(page);
+
+    await goToCreateRoleFromEmptyState(page);
+    await fillRoleData(page, itemId);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Role created");
+  });
+
+  test("should update client role description", async ({ page }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+
+    const updateDescription = "updated description";
+    await clickTableRowItem(page, updatableItem);
+    await fillRoleData(page, updatableItem, updateDescription);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "The role has been saved");
+    await assertDescriptionValue(page, updateDescription);
+  });
+
+  test("should add and delete attribute to client role", async ({ page }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+    await clickTableRowItem(page, updatableItem);
+    await goToAttributesTab(page);
+
+    // Add attribute
+    await fillAttributeData(page, "crud_attribute_key", "crud_attribute_value");
+    await clickAttributeSaveButton(page);
+    await assertAttributeLength(page, 1);
+    await assertNotificationMessage(page, "The role has been saved");
+
+    // Delete attribute
+    await deleteAttribute(page, 0);
+    await clickAttributeSaveButton(page);
+    await assertNotificationMessage(page, "The role has been saved");
+    await assertAttributeLength(page, 0);
+  });
+
+  test("should fail to create duplicate client role", async ({ page }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+
+    await goToCreateRole(page);
+    await fillRoleData(page, updatableItem);
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      `Could not create role: Role with name ${updatableItem} already exists`,
+    );
+  });
+
+  test("should search existing and non-existing client role", async ({
+    page,
+  }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+
+    // Search non-existing
+    await searchItem(page, placeHolder, "role_DNE");
+    await assertNoResults(page);
+
+    // Search existing
+    await clearAllFilters(page);
+    await searchItem(page, placeHolder, updatableItem);
+    await assertRowExists(page, updatableItem);
+
+    // Empty search
+    await searchItem(page, placeHolder, "");
+    await assertRowExists(page, updatableItem);
+  });
+
+  test("should handle associated realm roles", async ({ page }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+    await clickTableRowItem(page, updatableItem);
+    await goToAssociatedRolesTab(page);
+
+    // Add associated realm role
+    await addAssociatedRoles(page, createRealmRoleName);
+    await assertNotificationMessage(page, "Associated roles have been added");
+
+    // Remove associated roles
+    await clickSelectRow(page, "Role list", createRealmRoleName);
+    await clickUnassign(page);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Role mapping updated");
+  });
+
+  test("should handle associated client roles", async ({ page }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+    await clickTableRowItem(page, updatableItem);
+    await goToAssociatedRolesTab(page);
+
+    // Add associated client roles
+    await addAssociatedRoles(page, "manage-account", "client");
+    await assertNotificationMessage(page, "Associated roles have been added");
+  });
+
+  test("should delete client role", async ({ page }) => {
+    // Delete from list
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+
+    await clickRowKebabItem(page, updatableItem, "Delete");
+    await assertModalTitle(page, "Delete role?");
+    await confirmModal(page);
+  });
+
+  test.skip("Should delete client role from role details test", async ({
+    page,
+  }) => {
+    await clickTableRowItem(page, oneRoleClient);
+    await goToRolesTab(page);
+    await clickTableRowItem(page, updatableItem);
+
+    await selectActionToggleItem(page, "Delete this role");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "The role has been deleted");
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/role.ts b/js/apps/admin-ui/test/clients/role.ts
new file mode 100644
index 000000000000..f81e87b9a94d
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/role.ts
@@ -0,0 +1,51 @@
+import { expect, Page } from "@playwright/test";
+import {
+  pickRoleType,
+  confirmModalAssign,
+  pickRole,
+  RoleType,
+} from "../utils/roles";
+
+export async function goToRolesTab(page: Page) {
+  await page.getByTestId("rolesTab").click();
+}
+
+export async function goToCreateRoleFromEmptyState(page: Page) {
+  await page.getByTestId("no-roles-for-this-client-empty-action").click();
+}
+
+export async function goToCreateRole(page: Page) {
+  await page.getByTestId("create-role").click();
+}
+
+function getDescription(page: Page) {
+  return page.getByTestId("description");
+}
+
+export async function fillRoleData(page: Page, name: string, description = "") {
+  const nameInput = page.getByTestId("name");
+  await nameInput.waitFor();
+  const isDisabled = await nameInput.isDisabled();
+  if (!isDisabled) {
+    await nameInput.fill(name);
+  }
+  await getDescription(page).fill(description);
+}
+
+export async function assertDescriptionValue(page: Page, value: string) {
+  await expect(getDescription(page)).toHaveValue(value);
+}
+
+export async function goToAssociatedRolesTab(page: Page) {
+  await page.getByTestId("associatedRolesTab").click();
+}
+
+export async function addAssociatedRoles(
+  page: Page,
+  roleName: string,
+  roleType: RoleType = "roles",
+) {
+  await pickRoleType(page, roleType);
+  await pickRole(page, roleName, true);
+  await confirmModalAssign(page);
+}
diff --git a/js/apps/admin-ui/test/clients/saml.spec.ts b/js/apps/admin-ui/test/clients/saml.spec.ts
new file mode 100644
index 000000000000..920efe3c7a4b
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/saml.spec.ts
@@ -0,0 +1,179 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { switchOff, switchOn } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalTitle, cancelModal, confirmModal } from "../utils/modal";
+import { goToClients } from "../utils/sidebar";
+import { clickTableRowItem } from "../utils/table";
+import { goToAdvancedTab, revertFineGrain, saveFineGrain } from "./advanced";
+import {
+  assertCertificate,
+  assertNameIdFormatDropdown,
+  assertSamlClientDetails,
+  assertTermsOfServiceUrl,
+  clickClientSignature,
+  clickEncryptionAssertions,
+  clickGenerate,
+  clickPostBinding,
+  goToKeysTab,
+  saveSamlSettings,
+  setTermsOfServiceUrl,
+} from "./saml";
+
+test.describe("Fine Grain SAML Endpoint Configuration", () => {
+  const clientName = `saml-advanced-tab-${uuid()}`;
+
+  test.beforeAll(() =>
+    adminClient.createClient({
+      protocol: "saml",
+      clientId: clientName,
+      publicClient: false,
+    }),
+  );
+
+  test.afterAll(() => adminClient.deleteClient(clientName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await clickTableRowItem(page, clientName);
+    await goToAdvancedTab(page);
+  });
+
+  test("should set Terms of service URL", async ({ page }) => {
+    const termsOfServiceUrl = "http://some.url/terms-of-service.html";
+
+    // Set and save URL
+    await setTermsOfServiceUrl(page, termsOfServiceUrl);
+    await saveFineGrain(page);
+    await assertNotificationMessage(page, "Client successfully updated");
+
+    // Try to set different URL but revert
+    await setTermsOfServiceUrl(page, "http://not.saveing.this/");
+    await revertFineGrain(page);
+
+    // Verify original URL remains
+    await assertTermsOfServiceUrl(page, termsOfServiceUrl);
+  });
+
+  test("should show error for invalid terms of service URL", async ({
+    page,
+  }) => {
+    await setTermsOfServiceUrl(page, "not a url");
+    await saveFineGrain(page);
+    await assertNotificationMessage(
+      page,
+      "Client could not be updated: invalid_inputTerms of service URL is not a valid URL",
+    );
+  });
+});
+
+test.describe("Clients SAML tests", () => {
+  const clientId = "saml";
+
+  const clientName = `saml-settings-${uuid()}`;
+
+  test.beforeAll(() =>
+    adminClient.createClient({
+      protocol: "saml",
+      clientId: clientName,
+    }),
+  );
+
+  test.afterAll(() => adminClient.deleteClient(clientName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToClients(page);
+    await clickTableRowItem(page, clientId);
+  });
+
+  test("should display the saml sections on details screen", async ({
+    page,
+  }) => {
+    await assertSamlClientDetails(page);
+  });
+
+  test("should save force name id format", async ({ page }) => {
+    await clickPostBinding(page);
+    await saveSamlSettings(page);
+    await assertNotificationMessage(page, "Client successfully updated");
+  });
+
+  test("should not disable signature when cancel", async ({ page }) => {
+    await goToKeysTab(page);
+    await clickClientSignature(page);
+    await assertModalTitle(page, 'Disable "Client signature required"');
+    await cancelModal(page);
+    await assertCertificate(page, false);
+  });
+
+  test("should disable client signature", async ({ page }) => {
+    await goToKeysTab(page);
+    await clickClientSignature(page);
+    await assertModalTitle(page, 'Disable "Client signature required"');
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Client successfully updated");
+    await assertCertificate(page);
+  });
+
+  test("should enable Encryption keys config", async ({ page }) => {
+    await goToKeysTab(page);
+    await clickEncryptionAssertions(page);
+    await clickGenerate(page);
+    await assertNotificationMessage(
+      page,
+      "New key pair and certificate generated successfully",
+    );
+    await confirmModal(page);
+    await assertCertificate(page, false);
+  });
+
+  test("should check SAML capabilities", async ({ page }) => {
+    // Assert Name ID Format dropdown exists
+    await assertNameIdFormatDropdown(page);
+
+    // Assert SAML Capabilities switches exist
+    const switches = [
+      ['[data-testid="attributes.saml_force_name_id_format"]', "on"],
+      ['[data-testid="attributes.saml.artifact.binding"]', "on"],
+      ['[data-testid="attributes.saml.artifact.binding"]', "off"],
+      ['[data-testid="attributes.saml.server.signature"]', "off"],
+      ['[data-testid="attributes.saml.assertion.signature"]', "on"],
+    ];
+
+    for (const [name, value] of switches) {
+      if (value === "off") {
+        await switchOff(page, name);
+      } else {
+        await switchOn(page, name);
+      }
+    }
+  });
+
+  test("should check access settings", async ({ page }) => {
+    const validUrl =
+      "http://localhost:8180/realms/master/protocol/" + clientId + "/clients/";
+    const invalidUrlError =
+      "Client could not be updated: invalid_inputRoot URL is not a valid URL";
+
+    await page.getByTestId("rootUrl").fill("Invalid URL");
+    await saveSamlSettings(page);
+    await assertNotificationMessage(page, invalidUrlError);
+    await page.getByTestId("rootUrl").clear();
+
+    await page.getByTestId("baseUrl").fill("Invalid URL");
+    await saveSamlSettings(page);
+
+    await assertNotificationMessage(page, invalidUrlError);
+    await page.getByTestId("baseUrl").clear();
+
+    await page.getByTestId("rootUrl").fill(validUrl);
+    await page.getByTestId("baseUrl").fill(validUrl);
+    await saveSamlSettings(page);
+
+    await assertNotificationMessage(page, "Client successfully updated");
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/saml.ts b/js/apps/admin-ui/test/clients/saml.ts
new file mode 100644
index 000000000000..5510e067ad26
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/saml.ts
@@ -0,0 +1,68 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem, switchOff, switchOn } from "../utils/form";
+
+function getTermsOfServiceUrl(page: Page) {
+  return page.getByTestId("attributes.tosUri");
+}
+
+export async function setTermsOfServiceUrl(page: Page, url: string) {
+  await getTermsOfServiceUrl(page).fill(url);
+}
+
+export async function saveFineGrain(page: Page) {
+  await page.getByTestId("fineGrainSave").click();
+}
+
+export async function revertFineGrain(page: Page) {
+  await page.getByTestId("fineGrainRevert").click();
+}
+
+export async function assertTermsOfServiceUrl(page: Page, expectedUrl: string) {
+  await expect(getTermsOfServiceUrl(page)).toHaveValue(expectedUrl);
+}
+
+export async function assertSamlClientDetails(page: Page) {
+  await expect(page.getByTestId("jump-link-saml-capabilities")).toBeVisible();
+}
+
+export async function clickPostBinding(page: Page) {
+  await switchOff(page, "#attributes\\.saml🍺force🍺post🍺binding");
+}
+
+export async function saveSamlSettings(page: Page) {
+  await page.getByTestId("settings-save").click();
+}
+
+export async function goToKeysTab(page: Page) {
+  await page.getByTestId("keysTab").click();
+}
+
+export async function clickClientSignature(page: Page) {
+  await switchOff(page, "#clientSignature");
+}
+
+export async function assertCertificate(page: Page, exists = true) {
+  await expect(page.getByTestId("certificate")).toHaveCount(exists ? 0 : 1);
+}
+
+export async function clickEncryptionAssertions(page: Page) {
+  await switchOn(page, "#encryptAssertions");
+}
+
+export async function clickGenerate(page: Page) {
+  await page.getByTestId("generate").click();
+}
+
+export async function assertNameIdFormatDropdown(page: Page) {
+  const items = ["username", "email", "transient", "persistent"];
+  for (const item of items) {
+    await selectItem(
+      page,
+      page.locator("#attributes\\.saml_name_id_format"),
+      item,
+    );
+    await expect(page.locator("#attributes\\.saml_name_id_format")).toHaveText(
+      item,
+    );
+  }
+}
diff --git a/js/apps/admin-ui/test/clients/scope.spec.ts b/js/apps/admin-ui/test/clients/scope.spec.ts
new file mode 100644
index 000000000000..4af6567f1900
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/scope.spec.ts
@@ -0,0 +1,238 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { selectChangeType } from "../client-scope/main";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalTitle, confirmModal } from "../utils/modal";
+import { goToClients, goToRealm } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertRowExists,
+  clickNextPageButton,
+  clickRowKebabItem,
+  clickSelectRow,
+  clickTableRowItem,
+  clickTableToolbarItem,
+  getTableData,
+  searchItem,
+} from "../utils/table";
+import {
+  assertHasAccessTokenGenerated,
+  assertHasIdTokenGenerated,
+  assertHasUserInfoGenerated,
+  assertNoAccessTokenGenerated,
+  assertNoIdTokenGenerated,
+  assertNoUserInfoGenerated,
+  assertTableCellDropdownValue,
+  clickAddClientScope,
+  clickAddScope,
+  goToClientScopeEvaluateTab,
+  goToClientScopesTab,
+  goToGenerateAccessTokenTab,
+  selectUser,
+} from "./scope";
+
+type ClientScope = {
+  name: string;
+  description: string;
+  protocol: string;
+  attributes: {
+    "include.in.token.scope": string;
+    "display.on.consent.screen": string;
+    "gui.order": string;
+    "consent.screen.text": string;
+  };
+};
+
+test.describe("Client details - Client scopes subtab", () => {
+  const clientId = "client-scopes-subtab-test";
+  const clientScopeName = "client-scope-test";
+  const clientScopeNameDefaultType = "client-scope-test-default-type";
+  const clientScopeNameOptionalType = "client-scope-test-optional-type";
+  const msgScopeMappingRemoved = "Scope mapping successfully removed";
+  const realmName = `clients-realm-${uuid()}`;
+  const placeHolder = "Search by name";
+  const tableName = "clientScopeList-0";
+
+  const clientScope: ClientScope = {
+    name: clientScopeName,
+    description: "",
+    protocol: "openid-connect",
+    attributes: {
+      "include.in.token.scope": "true",
+      "display.on.consent.screen": "true",
+      "gui.order": "1",
+      "consent.screen.text": "",
+    },
+  };
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createClient({
+      realm: realmName,
+      clientId,
+      protocol: "openid-connect",
+      publicClient: false,
+    });
+    for (let i = 0; i < 5; i++) {
+      clientScope.name = clientScopeName + i;
+      await adminClient.createClientScope({ ...clientScope, realm: realmName });
+      await adminClient.addDefaultClientScopeInClient(
+        clientScopeName + i,
+        clientId,
+        realmName,
+      );
+    }
+    clientScope.name = clientScopeNameDefaultType;
+    await adminClient.createClientScope({ ...clientScope, realm: realmName });
+    clientScope.name = clientScopeNameOptionalType;
+    await adminClient.createClientScope({ ...clientScope, realm: realmName });
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+    await searchItem(page, "Search for client", clientId);
+    await clickTableRowItem(page, clientId);
+    await goToClientScopesTab(page);
+  });
+
+  test("Should list client scopes", async ({ page }) => {
+    const rows = await getTableData(page, tableName);
+    expect(rows.length).toBeGreaterThan(2);
+    await assertRowExists(page, clientScopeName + "0");
+  });
+
+  test("Should search existing client scope by name", async ({ page }) => {
+    await searchItem(page, placeHolder, clientScopeName + "0");
+    await assertRowExists(page, clientScopeName + "0");
+    const rows = await getTableData(page, tableName);
+    expect(rows.length).toBe(1);
+  });
+
+  test("Should search non-existent client scope by name", async ({ page }) => {
+    await searchItem(page, placeHolder, "non-existent-item");
+    await assertEmptyTable(page);
+  });
+
+  test("Should add client scope with optional assigned type", async ({
+    page,
+  }) => {
+    await clickAddClientScope(page);
+    await assertModalTitle(page, `Add client scopes to ${clientId}`);
+    await clickSelectRow(
+      page,
+      "Choose a mapper type",
+      clientScopeNameOptionalType,
+    );
+    await clickAddScope(page, "Optional");
+    await assertNotificationMessage(page, "Scope mapping updated");
+    await searchItem(page, placeHolder, clientScopeNameOptionalType);
+    await assertRowExists(page, clientScopeNameOptionalType);
+    await assertTableCellDropdownValue(page, "Optional");
+  });
+
+  const itemName = clientScopeName + 0;
+  test(`Should change item AssignedType to default from search bar`, async ({
+    page,
+  }) => {
+    await searchItem(page, placeHolder, itemName);
+    await clickSelectRow(page, "clientScopeList-0", itemName);
+    await selectChangeType(page, "Default");
+    await assertNotificationMessage(page, "Scope mapping updated");
+    await searchItem(page, placeHolder, itemName);
+    await assertTableCellDropdownValue(page, "Default");
+    await assertRowExists(page, itemName);
+  });
+
+  test("Should show items on next page are more than 11", async ({ page }) => {
+    await clickNextPageButton(page);
+    const rows = await getTableData(page, tableName);
+    expect(rows.length).toBeGreaterThan(1);
+  });
+
+  test("Should remove client scope", async ({ page }) => {
+    await searchItem(page, placeHolder, clientScopeName + "0");
+    await clickRowKebabItem(page, clientScopeName + "0", "Remove");
+    await confirmModal(page);
+    await assertNotificationMessage(page, msgScopeMappingRemoved);
+    await searchItem(page, placeHolder, clientScopeName + "0");
+    await assertEmptyTable(page);
+  });
+
+  test("Should remove multiple client scopes from search bar", async ({
+    page,
+  }) => {
+    const itemName1 = clientScopeName + 1;
+    const itemName2 = clientScopeName + 2;
+    await searchItem(page, placeHolder, clientScopeName);
+    await clickSelectRow(page, tableName, itemName1);
+    await clickSelectRow(page, tableName, itemName2);
+    await clickTableToolbarItem(page, "Remove", true);
+    await assertNotificationMessage(page, msgScopeMappingRemoved);
+    await searchItem(page, placeHolder, clientScopeName);
+    await assertRowExists(page, itemName1, false);
+    await assertRowExists(page, itemName2, false);
+  });
+});
+
+test.describe("Client scopes evaluate subtab", () => {
+  const clientName = "testClient";
+  const userName = "admin-a";
+  const realmName = `clients-realm-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createClient({
+      realm: realmName,
+      protocol: "openid-connect",
+      clientId: clientName,
+      publicClient: false,
+    });
+    await adminClient.createUser({
+      realm: realmName,
+      username: userName,
+      enabled: true,
+    });
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToClients(page);
+  });
+
+  test("check effective protocol mappers list", async ({ page }) => {
+    await searchItem(page, "Search for client", clientName);
+    await clickTableRowItem(page, clientName);
+    await goToClientScopesTab(page);
+    await goToClientScopeEvaluateTab(page);
+
+    const rows = await getTableData(page, "Effective protocol mappers");
+    expect(rows.length).toBeGreaterThan(1);
+  });
+
+  test("check generated id token and user info", async ({ page }) => {
+    await searchItem(page, "Search for client", clientName);
+    await clickTableRowItem(page, clientName);
+    await goToClientScopesTab(page);
+    await goToClientScopeEvaluateTab(page);
+
+    await assertNoAccessTokenGenerated(page);
+    await assertNoIdTokenGenerated(page);
+    await assertNoUserInfoGenerated(page);
+
+    await goToGenerateAccessTokenTab(page);
+    await selectUser(page, userName);
+
+    await assertHasUserInfoGenerated(page, userName);
+    await assertHasAccessTokenGenerated(page, userName);
+    await assertHasIdTokenGenerated(page, userName);
+  });
+});
diff --git a/js/apps/admin-ui/test/clients/scope.ts b/js/apps/admin-ui/test/clients/scope.ts
new file mode 100644
index 000000000000..fc4e4f805369
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/scope.ts
@@ -0,0 +1,89 @@
+import { Page, expect } from "@playwright/test";
+import { clickTableToolbarItem } from "../utils/table";
+import { selectItem } from "../utils/form";
+
+export async function goToClientScopesTab(page: Page) {
+  await page.getByTestId("clientScopesTab").click();
+}
+
+export async function goToClientScopeEvaluateTab(page: Page) {
+  await page.getByTestId("clientScopesEvaluateTab").click();
+}
+
+export async function clickAddClientScope(page: Page) {
+  await clickTableToolbarItem(page, "Add client scope");
+}
+
+export async function clickAddScope(page: Page, option: string) {
+  await page.getByTestId("add-dropdown").click();
+  await page.getByRole("menuitem", { name: option }).click();
+}
+
+export async function assertTableCellDropdownValue(page: Page, value: string) {
+  await expect(page.getByTestId("cell-dropdown")).toHaveText(value);
+}
+
+export async function goToGenerateAccessTokenTab(page: Page) {
+  await page.getByTestId("generated-access-token-tab").click();
+}
+
+export async function assertHasAccessTokenGenerated(
+  page: Page,
+  username: string,
+) {
+  await goToGenerateAccessTokenTab(page);
+  await expect(page.getByLabel("generatedAccessToken")).toContainText(
+    formatUsername(username),
+  );
+}
+
+export async function assertNoAccessTokenGenerated(page: Page) {
+  await goToGenerateAccessTokenTab(page);
+  await expect(
+    page.getByRole("heading", { name: "No generated access token" }),
+  ).toBeVisible();
+}
+
+export async function assertHasUserInfoGenerated(page: Page, username: string) {
+  await goToUserInfoTab(page);
+  await expect(page.getByLabel("generatedUserInfo")).toContainText(
+    formatUsername(username),
+  );
+}
+
+function formatUsername(username: string) {
+  return `"preferred_username": "${username}"`;
+}
+
+async function goToIdTokenTab(page: Page) {
+  await page.getByTestId("generated-id-token-tab").click();
+}
+
+export async function assertHasIdTokenGenerated(page: Page, username: string) {
+  await goToIdTokenTab(page);
+  await expect(page.getByLabel("generatedIdToken")).toContainText(
+    formatUsername(username),
+  );
+}
+
+export async function assertNoIdTokenGenerated(page: Page) {
+  await goToIdTokenTab(page);
+  await expect(
+    page.getByRole("heading", { name: "No generated id token" }),
+  ).toBeVisible();
+}
+
+async function goToUserInfoTab(page: Page) {
+  await page.getByTestId("generated-user-info-tab").click();
+}
+
+export async function assertNoUserInfoGenerated(page: Page) {
+  await goToUserInfoTab(page);
+  await expect(
+    page.getByRole("heading", { name: "No generated user info" }),
+  ).toBeVisible();
+}
+
+export async function selectUser(page: Page, username: string) {
+  await selectItem(page, page.getByTestId("user"), username);
+}
diff --git a/js/apps/admin-ui/test/clients/utils.ts b/js/apps/admin-ui/test/clients/utils.ts
new file mode 100644
index 000000000000..d46bd3134fbf
--- /dev/null
+++ b/js/apps/admin-ui/test/clients/utils.ts
@@ -0,0 +1,64 @@
+import ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import { Page } from "@playwright/test";
+
+export async function createClient(
+  page: Page,
+  client?: ClientRepresentation,
+  action?: () => Promise<void>,
+) {
+  await page.getByTestId("createClient").click();
+  await page.getByTestId("clientId").fill(client?.clientId || "");
+  await page.getByTestId("name").fill(client?.name || "");
+  await page.getByTestId("description").fill(client?.description || "");
+  await page.getByLabel("Client type", { exact: true }).click();
+  await page
+    .getByRole("option", { name: client?.protocol || "OpenID Connect" })
+    .click();
+
+  if (client?.alwaysDisplayInConsole)
+    await page.getByText("Always display in UI").click();
+
+  if (action) {
+    await action();
+  } else {
+    await continueNext(page);
+  }
+}
+
+export async function clientCapabilityConfig(
+  page: Page,
+  client: ClientRepresentation,
+) {
+  if (client.publicClient)
+    await page.getByText("Client authentication", { exact: true }).click();
+
+  if (client.directAccessGrantsEnabled)
+    await page.getByTestId("direct").click();
+
+  if (client.implicitFlowEnabled) await page.getByTestId("implicit").click();
+
+  if (client.serviceAccountsEnabled)
+    await page.getByTestId("service-account").click();
+
+  if (client.standardFlowEnabled) await page.getByTestId("standard").click();
+
+  if (
+    client.attributes?.["oauth2.device.authorization.grant.enabled"] === "true"
+  )
+    await page.getByTestId("oauth-device-authorization-grant").click();
+
+  if (client.attributes?.["oidc.ciba.grant.enabled"] === "true")
+    await page.getByTestId("oidc-ciba-grant").click();
+}
+
+export async function continueNext(page: Page) {
+  await page.getByRole("button", { name: "Next" }).click();
+}
+
+export async function save(page: Page) {
+  await page.getByRole("button", { name: "Save" }).click();
+}
+
+export async function cancel(page: Page) {
+  await page.getByRole("button", { name: "Cancel" }).click();
+}
diff --git a/js/apps/admin-ui/test/events/list.spec.ts b/js/apps/admin-ui/test/events/list.spec.ts
new file mode 100644
index 000000000000..01e8a191df58
--- /dev/null
+++ b/js/apps/admin-ui/test/events/list.spec.ts
@@ -0,0 +1,121 @@
+import { Page, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login, logout } from "../utils/login";
+import { assertAxeViolations } from "../utils/masthead";
+import { goToEvents, goToRealm } from "../utils/sidebar";
+import { assertEmptyTable, assertRowExists, expandRow } from "../utils/table";
+import {
+  assertSearchButtonDisabled,
+  assertSearchChipGroupItemExist,
+  clickSearchButton,
+  clickSearchPanel,
+  enableSaveEvents,
+  fillSearchPanel,
+  goToAdminEventsTab,
+  goToEventsConfig,
+} from "./list";
+
+test.describe("Events tests", () => {
+  const tableName = "Events";
+  const realmName = `events-realm-${uuid()}`;
+
+  const eventsTestUser = {
+    eventsTestUserId: "",
+    userRepresentation: {
+      username: `events-test-${uuid()}`,
+      enabled: true,
+      credentials: [{ value: "events-test" }],
+      realm: realmName,
+      email: "some@email.com",
+      firstName: "Erik",
+      lastName: "Blankenburg",
+    },
+  };
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, { enabled: true });
+    const { id } = await adminClient.createUser(
+      eventsTestUser.userRepresentation,
+    );
+    eventsTestUser.eventsTestUserId = id!;
+    await adminClient.addClientRoleToUser(
+      id!,
+      "realm-management",
+      ["realm-admin"],
+      realmName,
+    );
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.describe("User events list empty", () => {
+    test.beforeEach(async ({ page }) => {
+      await login(page);
+      await goToRealm(page, realmName);
+      await goToEvents(page);
+    });
+
+    test("Show empty when no save events", async ({ page }) => {
+      await goToEventsConfig(page);
+      await goToEvents(page);
+      await assertEmptyTable(page);
+    });
+  });
+
+  test.describe("User events with events", () => {
+    let page: Page;
+    test.beforeAll(async ({ browser }) => {
+      page = await browser.newPage();
+      await login(page);
+      await goToRealm(page, realmName);
+      await goToEvents(page);
+      await goToEventsConfig(page);
+      await enableSaveEvents(page);
+
+      await logout(page);
+    });
+
+    test.afterAll(async () => {
+      await page.close();
+    });
+
+    test.beforeEach(async ({ page }) => {
+      await login(
+        page,
+        eventsTestUser.userRepresentation.username,
+        eventsTestUser.userRepresentation.credentials[0].value,
+        realmName,
+      );
+      await goToEvents(page);
+    });
+
+    test("Expand item to see more information", async ({ page }) => {
+      await expandRow(page, tableName, 0);
+      await assertRowExists(page, "token_id");
+    });
+
+    test("Search by user ID", async ({ page }) => {
+      await clickSearchPanel(page);
+      await assertSearchButtonDisabled(page);
+      await fillSearchPanel(page, {
+        userId: eventsTestUser.eventsTestUserId,
+      });
+      await clickSearchButton(page);
+
+      await assertSearchChipGroupItemExist(
+        page,
+        eventsTestUser.eventsTestUserId,
+      );
+    });
+
+    test("Check accessibility on user events tab", async ({ page }) => {
+      await assertAxeViolations(page);
+    });
+
+    test("Check accessibility on admin events tab", async ({ page }) => {
+      await goToAdminEventsTab(page);
+      await assertAxeViolations(page);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/events/list.ts b/js/apps/admin-ui/test/events/list.ts
new file mode 100644
index 000000000000..8ac5cf3e5b68
--- /dev/null
+++ b/js/apps/admin-ui/test/events/list.ts
@@ -0,0 +1,77 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem, switchOn } from "../utils/form";
+
+export async function goToEventsConfig(page: Page) {
+  await page.getByRole("link", { name: "Event configs" }).click();
+}
+
+async function removeLastAlert(page: Page) {
+  await page.getByTestId("last-alert").locator("button").click();
+}
+
+async function turnOnUserEvents(page: Page) {
+  await page.getByTestId("rs-events-tab").click();
+  await switchOn(page, "[data-testid='eventsEnabled']");
+  await page.getByTestId("save-user").click();
+  await removeLastAlert(page);
+}
+
+async function turnOnAdminEvents(page: Page) {
+  await page.getByTestId("rs-admin-events-tab").click();
+  await switchOn(page, "[data-testid='adminEventsEnabled']");
+  await page.getByTestId("save-admin").click();
+  await removeLastAlert(page);
+}
+
+export async function enableSaveEvents(page: Page) {
+  await turnOnUserEvents(page);
+  await turnOnAdminEvents(page);
+}
+
+export async function clickSearchPanel(page: Page) {
+  await page.getByTestId("dropdown-panel-btn").click();
+}
+
+type SearchParam = {
+  userId?: string;
+  client?: string;
+  eventType?: string;
+};
+
+export async function fillSearchPanel(
+  page: Page,
+  { userId, client, eventType }: SearchParam,
+) {
+  if (userId) await page.getByTestId("userId-searchField").fill(userId);
+  if (client) await page.getByTestId("client-searchField").fill(client);
+  if (eventType) await selectItem(page, page.getByLabel("Select"), eventType);
+}
+
+export async function assertSearchButtonDisabled(page: Page, disabled = true) {
+  if (disabled) {
+    await expect(page.getByTestId("search-events-btn")).toBeDisabled();
+  } else {
+    await expect(page.getByTestId("search-events-btn")).not.toBeDisabled();
+  }
+}
+
+export async function clickSearchButton(page: Page) {
+  await page.getByTestId("search-events-btn").click();
+}
+
+export async function assertSearchChipGroupItemExist(
+  page: Page,
+  itemName: string,
+  exist = true,
+) {
+  const locator = page.getByRole("group", { name: "User ID" });
+  if (exist) {
+    await expect(locator).toHaveText(`User ID${itemName}`);
+  } else {
+    await expect(locator).not.toBeVisible();
+  }
+}
+
+export async function goToAdminEventsTab(page: Page) {
+  await page.getByTestId("admin-events-tab").click();
+}
diff --git a/js/apps/admin-ui/test/groups/attributes.spec.ts b/js/apps/admin-ui/test/groups/attributes.spec.ts
new file mode 100644
index 000000000000..976086b96c61
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/attributes.spec.ts
@@ -0,0 +1,42 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import {
+  assertAttributeLength,
+  clickAttributeSaveButton,
+  deleteAttribute,
+  fillAttributeData,
+  goToAttributesTab,
+} from "../utils/attributes";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToGroups } from "../utils/sidebar";
+import { goToGroupDetails } from "./util";
+
+test.describe("Attributes", () => {
+  const groupName = `group-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createGroup(groupName));
+
+  test.afterAll(() => adminClient.deleteGroups());
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToGroups(page);
+    await goToGroupDetails(page, groupName);
+    await goToAttributesTab(page);
+  });
+
+  test("Add/remove attribute", async ({ page }) => {
+    await fillAttributeData(page, "key", "value");
+    await clickAttributeSaveButton(page);
+    await assertNotificationMessage(page, "Group updated");
+    await assertAttributeLength(page, 1);
+
+    // remove attribute
+    await deleteAttribute(page, 0);
+    await clickAttributeSaveButton(page);
+    await assertNotificationMessage(page, "Group updated");
+    await assertAttributeLength(page, 0);
+  });
+});
diff --git a/js/apps/admin-ui/test/groups/list.spec.ts b/js/apps/admin-ui/test/groups/list.spec.ts
new file mode 100644
index 000000000000..4a823ceabb30
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/list.spec.ts
@@ -0,0 +1,158 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import {
+  assertAxeViolations,
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { cancelModal, confirmModal } from "../utils/modal";
+import { goToGroups } from "../utils/sidebar";
+import {
+  assertNoResults,
+  assertRowExists,
+  clickRowKebabItem,
+  clickSelectRow,
+  clickTableRowItem,
+  clickTableToolbarItem,
+  searchItem,
+} from "../utils/table";
+import { createGroup, editGroup, searchGroup } from "./list";
+import { goToGroupDetails } from "./util";
+
+test.describe("Group test", () => {
+  const groupName = `group-${uuid()}`;
+  const users: { id: string; username: string }[] = [];
+  const username = "test-user";
+
+  test.beforeAll(async () => {
+    for (let i = 0; i < 5; i++) {
+      const user = await adminClient.createUser({
+        username: username + i,
+        enabled: true,
+      });
+      users.push({ id: user.id!, username: username + i });
+    }
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteGroups();
+    for (let i = 0; i < 5; i++) {
+      await adminClient.deleteUser(username + i);
+    }
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToGroups(page);
+  });
+
+  test("Create group test", async ({ page }) => {
+    await createGroup(page, groupName, "", true);
+    await assertNotificationMessage(page, "Group created");
+    await searchGroup(page, groupName);
+    await assertRowExists(page, groupName, true);
+
+    // create group from search bar
+    const secondGroupName = `group-second-${uuid()}`;
+    await createGroup(page, secondGroupName, "some sort of description", false);
+    await assertNotificationMessage(page, "Group created");
+    await clickTableRowItem(page, secondGroupName);
+    await expect(page.getByText("some sort of description")).toBeVisible();
+    await page.goBack();
+
+    await searchGroup(page, secondGroupName);
+    await assertRowExists(page, secondGroupName, true);
+    await adminClient.deleteGroups();
+  });
+
+  test("Fail to create group with empty name", async ({ page }) => {
+    await createGroup(page, " ", "", true);
+    await assertNotificationMessage(
+      page,
+      "Could not create group Group name is missing",
+    );
+  });
+
+  test("Fail to create group with duplicated name", async ({ page }) => {
+    await createGroup(page, groupName, "", true);
+    await createGroup(page, groupName, "", false);
+    await assertNotificationMessage(
+      page,
+      `Could not create group Top level group named '${groupName}' already exists.`,
+    );
+    await cancelModal(page);
+  });
+});
+
+test.describe("Search group under current group", () => {
+  const predefinedGroups = ["level", "level1", "level2", "level3"];
+
+  const placeholder = "Filter groups";
+  const tableName = "Groups";
+
+  test.beforeEach(async ({ page }) => {
+    for (const group of predefinedGroups) {
+      await adminClient.createGroup(group);
+    }
+    await login(page);
+    await goToGroups(page);
+  });
+
+  test.afterEach(() => adminClient.deleteGroups());
+
+  test("Search group that exists", async ({ page }) => {
+    await searchItem(page, placeholder, predefinedGroups[1]);
+    await assertRowExists(page, predefinedGroups[1]);
+  });
+
+  test("Search group that does not exists", async ({ page }) => {
+    await searchItem(page, placeholder, "not-existent-group");
+    await assertNoResults(page);
+  });
+
+  test("Duplicate group from item bar", async ({ page }) => {
+    await clickRowKebabItem(page, predefinedGroups[1], "Duplicate");
+    await page.getByTestId("duplicateGroup").click();
+    await assertNotificationMessage(page, "Group duplicated");
+    await assertRowExists(page, `Copy of ${predefinedGroups[1]}`, true);
+  });
+
+  test("Delete group from item bar", async ({ page }) => {
+    await clickRowKebabItem(page, predefinedGroups[1], "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Group deleted");
+    await assertRowExists(page, predefinedGroups[1], false);
+  });
+
+  test("Delete group from search bar", async ({ page }) => {
+    await clickSelectRow(page, tableName, predefinedGroups[2]);
+    await clickTableToolbarItem(page, "Delete", true);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Group deleted");
+    await assertRowExists(page, predefinedGroups[2], false);
+  });
+
+  test("Edit group", async ({ page }) => {
+    const newGroupName = "new_group_name";
+    const description = "new description";
+    await clickRowKebabItem(page, predefinedGroups[3], "Edit");
+    await editGroup(page, newGroupName, description);
+    await assertNotificationMessage(page, "Group updated");
+    await assertRowExists(page, newGroupName);
+    await assertRowExists(page, predefinedGroups[3], false);
+  });
+
+  test("Delete group from group details", async ({ page }) => {
+    await goToGroupDetails(page, predefinedGroups[2]);
+    await selectActionToggleItem(page, "Delete group");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Group deleted");
+    await assertRowExists(page, predefinedGroups[2], false);
+  });
+
+  test("Check a11y violations on groups page", async ({ page }) => {
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/groups/list.ts b/js/apps/admin-ui/test/groups/list.ts
new file mode 100644
index 000000000000..63daab4765de
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/list.ts
@@ -0,0 +1,31 @@
+import { Page } from "@playwright/test";
+
+export async function createGroup(
+  page: Page,
+  name: string,
+  description: string,
+  fromEmptyState = false,
+) {
+  if (fromEmptyState) {
+    await page.getByTestId("no-groups-in-this-realm-empty-action").click();
+  } else {
+    await page.getByTestId("openCreateGroupModal").click();
+  }
+  await page.getByTestId("name").fill(name);
+  await page.getByTestId("description").fill(description);
+  await page.getByTestId("createGroup").click();
+}
+
+export async function searchGroup(page: Page, name: string) {
+  await page.getByTestId("group-search").locator("input").fill(name);
+  await page
+    .getByTestId("group-search")
+    .getByLabel("Search", { exact: true })
+    .click();
+}
+
+export async function editGroup(page: Page, name: string, description: string) {
+  await page.getByTestId("name").fill(name);
+  await page.getByTestId("description").fill(description);
+  await page.getByTestId("renameGroup").click();
+}
diff --git a/js/apps/admin-ui/test/groups/members.spec.ts b/js/apps/admin-ui/test/groups/members.spec.ts
new file mode 100644
index 000000000000..29927cc85e1d
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/members.spec.ts
@@ -0,0 +1,134 @@
+import { test } from "@playwright/test";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { cancelModal } from "../utils/modal";
+import { goToGroups } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickRowKebabItem,
+  clickSelectRow,
+  clickTableRowItem,
+} from "../utils/table";
+import {
+  addMember,
+  goToMembersTab,
+  leaveGroup,
+  toggleIncludeSubGroupUsers,
+} from "./members";
+import { goToChildGroupsTab } from "./util";
+
+test.describe("Members", () => {
+  const predefinedGroups = ["level", "level1", "level2", "level3"];
+  const emptyGroup = "empty-group";
+  const users: { id: string; username: string }[] = [];
+  const username = "test-user";
+  const tableName = "Members";
+
+  test.beforeAll(async () => {
+    const createdGroups = await adminClient.createSubGroups(predefinedGroups);
+    for (let index = 0; index < 5; index++) {
+      const { id } = await adminClient.createUser({
+        username: username + index,
+        enabled: true,
+      });
+      users.push({ id: id!, username: username + index });
+    }
+
+    for (let index = 0; index < 5; index++) {
+      await adminClient.addUserToGroup(
+        users[index].id!,
+        createdGroups[index % 3].id,
+      );
+    }
+    await adminClient.createGroup(emptyGroup);
+    await adminClient.createUser({
+      username: "new",
+      enabled: true,
+    });
+  });
+
+  test.afterAll(async () => {
+    for (const user of users) {
+      await adminClient.deleteUser(user.username);
+    }
+    await adminClient.deleteUser("new");
+    await adminClient.deleteGroups();
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroups[0]);
+    await goToMembersTab(page);
+  });
+
+  test("Add member from search bar", async ({ page }) => {
+    await addMember(page, ["new"], false);
+    await assertNotificationMessage(page, "1 user added to the group");
+  });
+
+  test("Show members with sub-group users", async ({ page }) => {
+    // Check initial users
+    await assertRowExists(page, users[0].username, true);
+    await assertRowExists(page, users[3].username, true);
+
+    // Toggle sub-group users and check additional users
+    await toggleIncludeSubGroupUsers(page);
+
+    for (const user of users) {
+      await assertRowExists(page, user.username, true);
+    }
+
+    // Navigate to child groups and check users
+    await goToChildGroupsTab(page);
+    await clickTableRowItem(page, predefinedGroups[1]);
+    await goToMembersTab(page);
+    await assertRowExists(page, users[1].username, true);
+    await assertRowExists(page, users[4].username, true);
+
+    await goToChildGroupsTab(page);
+    await clickTableRowItem(page, predefinedGroups[2]);
+    await goToMembersTab(page);
+    await assertRowExists(page, users[2].username, true);
+  });
+
+  test("Add member from empty state", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, emptyGroup);
+    await goToMembersTab(page);
+    await addMember(page, [users[0].username, users[1].username], true);
+    await assertNotificationMessage(page, "2 users added to the group");
+  });
+
+  test("Leave group from search bar", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroups[0]);
+    await goToMembersTab(page);
+    await clickSelectRow(page, tableName, users[0].username);
+    await leaveGroup(page);
+    await assertNotificationMessage(page, "1 user left the group");
+    await assertRowExists(page, users[0].username, false);
+  });
+
+  test("Leave group from item bar", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroups[0]);
+    await goToMembersTab(page);
+    await clickRowKebabItem(page, users[3].username, "Leave");
+    await assertNotificationMessage(page, "1 user left the group");
+    await assertRowExists(page, users[3].username, false);
+  });
+
+  test("Show memberships from item bar", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroups[0]);
+    await goToChildGroupsTab(page);
+    await clickTableRowItem(page, predefinedGroups[1]);
+
+    await goToMembersTab(page);
+    await clickRowKebabItem(page, users[1].username, "Show memberships");
+    await assertRowExists(page, predefinedGroups[0], true);
+    await cancelModal(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/groups/members.ts b/js/apps/admin-ui/test/groups/members.ts
new file mode 100644
index 000000000000..991798cdb98c
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/members.ts
@@ -0,0 +1,32 @@
+import { Page } from "@playwright/test";
+import { clickSelectRow, clickTableToolbarItem } from "../utils/table";
+
+export async function goToMembersTab(page: Page) {
+  await page.getByTestId("members").click();
+}
+
+export async function addMember(
+  page: Page,
+  usernames: string[],
+  fromEmptyState = false,
+) {
+  if (fromEmptyState) {
+    await page.getByTestId("no-users-found-empty-action").click();
+  } else {
+    await page.getByTestId("addMember").click();
+  }
+
+  for (const username of usernames) {
+    await clickSelectRow(page, "Users", username);
+  }
+
+  await page.getByTestId("add").click();
+}
+
+export async function toggleIncludeSubGroupUsers(page: Page) {
+  await page.getByTestId("includeSubGroupsCheck").click();
+}
+
+export async function leaveGroup(page: Page) {
+  await clickTableToolbarItem(page, "Leave", true);
+}
diff --git a/js/apps/admin-ui/test/groups/role.spec.ts b/js/apps/admin-ui/test/groups/role.spec.ts
new file mode 100644
index 000000000000..1151d82c5dea
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/role.spec.ts
@@ -0,0 +1,83 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import {
+  pickRoleType,
+  clickHideInheritedRoles,
+  clickUnassign,
+  confirmModalAssign,
+  pickRole,
+} from "../utils/roles";
+import { goToGroups } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertRowExists,
+  clickTableRowItem,
+} from "../utils/table";
+import { goToRoleMappingTab } from "./role";
+
+test.describe("Role mappings", () => {
+  const predefinedGroup = "group1";
+  const predefinedGroup1 = "group2";
+
+  const roleName = `remove-role-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createGroup(predefinedGroup);
+    const { id } = await adminClient.createGroup(predefinedGroup1);
+
+    await adminClient.createRealmRole({
+      name: roleName,
+      clientRole: true,
+    });
+    await adminClient.addRealmRoleToGroup(id, roleName);
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealmRole(roleName);
+    await adminClient.deleteGroups();
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroup);
+    await goToRoleMappingTab(page);
+  });
+
+  test("Check empty state", async ({ page }) => {
+    await assertEmptyTable(page);
+  });
+
+  test("Assign roles from empty state", async ({ page }) => {
+    await pickRoleType(page, "roles");
+    await pickRole(page, "default-roles-master", true);
+    await confirmModalAssign(page);
+
+    await assertNotificationMessage(page, "Role mapping updated");
+    await assertRowExists(page, "default-roles-master");
+  });
+
+  test("Check hide inherited roles option", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroup1);
+    await goToRoleMappingTab(page);
+
+    await clickHideInheritedRoles(page);
+  });
+
+  test("Remove roles", async ({ page }) => {
+    await goToGroups(page);
+    await clickTableRowItem(page, predefinedGroup1);
+    await goToRoleMappingTab(page);
+
+    await pickRole(page, roleName);
+    await clickUnassign(page);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Role mapping updated");
+    await assertEmptyTable(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/groups/role.ts b/js/apps/admin-ui/test/groups/role.ts
new file mode 100644
index 000000000000..b2422c033eec
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/role.ts
@@ -0,0 +1,5 @@
+import { Page } from "@playwright/test";
+
+export async function goToRoleMappingTab(page: Page) {
+  await page.getByTestId("role-mapping-tab").click();
+}
diff --git a/js/apps/admin-ui/test/groups/util.ts b/js/apps/admin-ui/test/groups/util.ts
new file mode 100644
index 000000000000..b09c347c76b2
--- /dev/null
+++ b/js/apps/admin-ui/test/groups/util.ts
@@ -0,0 +1,10 @@
+import { Page } from "@playwright/test";
+import { clickTableRowItem } from "../utils/table";
+
+export async function goToGroupDetails(page: Page, name: string) {
+  await clickTableRowItem(page, name);
+}
+
+export async function goToChildGroupsTab(page: Page) {
+  await page.getByTestId("groups").click();
+}
diff --git a/js/apps/admin-ui/test/identity-providers/main.ts b/js/apps/admin-ui/test/identity-providers/main.ts
new file mode 100644
index 000000000000..16f42807c168
--- /dev/null
+++ b/js/apps/admin-ui/test/identity-providers/main.ts
@@ -0,0 +1,143 @@
+import { Page, expect } from "@playwright/test";
+
+const SERVER_URL = "http://localhost:8080";
+const discoveryUrl = `${SERVER_URL}/realms/master/.well-known/openid-configuration`;
+const authorizationUrl = `${SERVER_URL}/realms/master/protocol/openid-connect/auth`;
+
+const samlDiscoveryUrl = `${SERVER_URL}/realms/master/protocol/saml/descriptor`;
+
+async function clickProviderCard(page: Page, providerName: string) {
+  await page.getByTestId(`${providerName}-card`).click();
+}
+
+async function fillDiscoveryUrl(page: Page, discoveryUrl: string) {
+  await page.getByTestId("discoveryEndpoint").fill(discoveryUrl);
+  await expect(page.getByTestId("playwright-result")).toHaveText("success");
+}
+
+async function clickAddButton(page: Page) {
+  await page.getByTestId("createProvider").click();
+}
+
+export async function createOIDCProvider(
+  page: Page,
+  providerName: string,
+  secret: string,
+) {
+  await clickProviderCard(page, providerName);
+  await fillDiscoveryUrl(page, discoveryUrl);
+  await page.getByTestId("displayName").fill(providerName);
+  await page.getByTestId("config.clientId").fill(providerName);
+  await page.getByTestId("config.clientSecret").fill(secret);
+  await clickAddButton(page);
+}
+
+export async function createSAMLProvider(
+  page: Page,
+  providerName: string,
+  displayName: string,
+) {
+  await clickProviderCard(page, providerName);
+  await fillDiscoveryUrl(page, samlDiscoveryUrl);
+  await page.getByTestId("displayName").fill(displayName);
+  await clickAddButton(page);
+}
+
+export async function assertAuthorizationUrl(page: Page) {
+  await expect(page.getByTestId("config.authorizationUrl")).toHaveValue(
+    authorizationUrl,
+  );
+}
+
+type UrlType =
+  | "authorization"
+  | "token"
+  | "tokenIntrospection"
+  | "singleSignOnService"
+  | "singleLogoutService";
+
+export async function setUrl(page: Page, urlType: UrlType, value: string) {
+  await page.getByTestId(`config.${urlType}Url`).fill(value);
+}
+
+export async function assertInvalidUrlNotification(
+  page: Page,
+  urlType: UrlType,
+) {
+  await expect(page.getByTestId("last-alert")).toHaveText(
+    `Could not update the provider The url [${urlType}${urlType.startsWith("single") ? "U" : "_u"}rl] is malformed`,
+  );
+}
+
+export async function clickSaveButton(page: Page) {
+  await page.getByTestId("idp-details-save").click();
+}
+
+export async function clickRevertButton(page: Page) {
+  await page.getByTestId("idp-details-revert").click();
+}
+
+async function assertElementExists(
+  page: Page,
+  locator: string,
+  exist: boolean = true,
+) {
+  if (exist) {
+    await expect(page.locator(locator)).toBeVisible();
+  } else {
+    await expect(page.locator(locator)).toBeHidden();
+  }
+}
+
+export async function assertJwksUrlExists(page: Page, exist: boolean = true) {
+  await assertElementExists(page, "[data-testid='config.jwksUrl']", exist);
+}
+
+export async function assertPkceMethodExists(
+  page: Page,
+  exist: boolean = true,
+) {
+  await assertElementExists(page, "#config\\.pkceMethod", exist);
+}
+
+export async function goToMappersTab(page: Page) {
+  await page.getByTestId("mappers-tab").click();
+}
+
+export async function addMapper(
+  page: Page,
+  mapperType: string,
+  mapperName: string,
+) {
+  await page.getByTestId("no-mappers-empty-action").click();
+  await page.locator("#identityProviderMapper").click();
+  await page.getByTestId(`${mapperType}-idp-mapper`).click();
+  await page.getByTestId("name").fill(mapperName);
+}
+
+export async function clickSaveMapper(page: Page) {
+  await page.getByTestId("new-mapper-save-button").click();
+}
+
+export async function clickCancelMapper(page: Page) {
+  await page.getByTestId("new-mapper-cancel-button").click();
+}
+
+export async function assertOnMappingPage(page: Page) {
+  await expect(page).toHaveURL(/.*mappers$/);
+}
+
+export async function addAuthConstraints(
+  page: Page,
+  classRefName: string,
+  declRefName: string,
+) {
+  await page.getByTestId("classref-field").fill(classRefName);
+  await page.getByTestId("config.authnContextClassRefs-addValue").click();
+  await page.getByTestId("declref-field").fill(declRefName);
+  await page.getByTestId("config.authnContextDeclRefs-addValue").click();
+  await page
+    .getByTestId("config.singleSignOnServiceUrl")
+    .fill(samlDiscoveryUrl);
+  await page.getByTestId("idp-details-save").click();
+}
diff --git a/js/apps/admin-ui/test/identity-providers/oidc.spec.ts b/js/apps/admin-ui/test/identity-providers/oidc.spec.ts
new file mode 100644
index 000000000000..9d7d87da86b3
--- /dev/null
+++ b/js/apps/admin-ui/test/identity-providers/oidc.spec.ts
@@ -0,0 +1,109 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { switchOn } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToIdentityProviders } from "../utils/sidebar";
+import { clickTableRowItem } from "../utils/table";
+import {
+  addMapper,
+  assertAuthorizationUrl,
+  assertInvalidUrlNotification,
+  assertJwksUrlExists,
+  assertOnMappingPage,
+  assertPkceMethodExists,
+  clickCancelMapper,
+  clickRevertButton,
+  clickSaveButton,
+  clickSaveMapper,
+  createOIDCProvider,
+  goToMappersTab,
+  setUrl,
+} from "./main";
+
+test.describe("OIDC identity provider test", () => {
+  const oidcProviderName = "oidc";
+  const secret = "123";
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToIdentityProviders(page);
+  });
+
+  test.afterAll(() => adminClient.deleteIdentityProvider(oidcProviderName));
+
+  test("should create an OIDC provider using discovery url", async ({
+    page,
+  }) => {
+    await createOIDCProvider(page, oidcProviderName, secret);
+    await assertNotificationMessage(
+      page,
+      "Identity provider successfully created",
+    );
+    await assertAuthorizationUrl(page);
+
+    await setUrl(page, "authorization", "invalid");
+    await clickSaveButton(page);
+    await assertInvalidUrlNotification(page, "authorization");
+    await clickRevertButton(page);
+
+    await setUrl(page, "token", "invalid");
+    await clickSaveButton(page);
+    await assertInvalidUrlNotification(page, "token");
+    await clickRevertButton(page);
+
+    await setUrl(page, "tokenIntrospection", "invalid");
+    await clickSaveButton(page);
+    await assertInvalidUrlNotification(page, "tokenIntrospection");
+    await clickRevertButton(page);
+
+    await assertJwksUrlExists(page);
+    await page.getByText("Use JWKS URL").click();
+    await assertJwksUrlExists(page, false);
+
+    await assertPkceMethodExists(page, false);
+    await switchOn(page, "#config\\.pkceEnabled");
+    await assertPkceMethodExists(page);
+
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Provider successfully updated");
+  });
+});
+
+test.describe("Edit OIDC Provider", () => {
+  const oidcProviderName = "OpenID Connect v1.0";
+  const alias = `edit-oidc-${uuid()}`;
+
+  test.beforeEach(async ({ page }) => {
+    await adminClient.createIdentityProvider(oidcProviderName, alias);
+    await login(page);
+    await goToIdentityProviders(page);
+    await clickTableRowItem(page, oidcProviderName);
+  });
+
+  test.afterEach(() => adminClient.deleteIdentityProvider(alias));
+
+  test("should add OIDC mapper of type Attribute Importer", async ({
+    page,
+  }) => {
+    await goToMappersTab(page);
+    await addMapper(page, "oidc-user-attribute", "OIDC Attribute Importer");
+    await clickSaveMapper(page);
+    await assertNotificationMessage(page, "Mapper created successfully.");
+  });
+
+  test("should add OIDC mapper of type Claim To Role", async ({ page }) => {
+    await goToMappersTab(page);
+    await addMapper(page, "oidc-role", "OIDC Claim to Role");
+    await clickSaveMapper(page);
+    await assertNotificationMessage(page, "Mapper created successfully.");
+  });
+
+  test("should cancel the addition of the OIDC mapper", async ({ page }) => {
+    await goToMappersTab(page);
+    await addMapper(page, "oidc-role", "OIDC Claim to Role");
+    await clickCancelMapper(page);
+    await assertOnMappingPage(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/identity-providers/saml.spec.ts b/js/apps/admin-ui/test/identity-providers/saml.spec.ts
new file mode 100644
index 000000000000..6e8271a31533
--- /dev/null
+++ b/js/apps/admin-ui/test/identity-providers/saml.spec.ts
@@ -0,0 +1,91 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToIdentityProviders } from "../utils/sidebar";
+import { clickTableRowItem } from "../utils/table";
+import {
+  addAuthConstraints,
+  addMapper,
+  clickCancelMapper,
+  clickSaveMapper,
+  createSAMLProvider,
+  goToMappersTab,
+} from "./main";
+import { editSAMLSettings } from "./saml";
+
+test.describe("SAML identity provider test", () => {
+  const samlProviderName = "saml";
+  const samlDisplayName = "saml";
+
+  test.afterAll(() => adminClient.deleteIdentityProvider(samlProviderName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToIdentityProviders(page);
+  });
+
+  test("should create a SAML provider using entity descriptor", async ({
+    page,
+  }) => {
+    await createSAMLProvider(page, samlProviderName, samlDisplayName);
+    await assertNotificationMessage(
+      page,
+      "Identity provider successfully created",
+    );
+  });
+});
+
+test.describe("SAML identity provider test", () => {
+  const samlProviderName = "SAML v2.0";
+  const classRefName = "acClassRef-1";
+  const declRefName = "acDeclRef-1";
+  const alias = `edit-oidc-${uuid()}`;
+
+  test.beforeEach(async ({ page }) => {
+    await adminClient.createIdentityProvider(samlProviderName, alias);
+    await login(page);
+    await goToIdentityProviders(page);
+    await clickTableRowItem(page, samlProviderName);
+  });
+
+  test.afterEach(() => adminClient.deleteIdentityProvider(alias));
+
+  test("should add auth constraints to existing SAML provider", async ({
+    page,
+  }) => {
+    await addAuthConstraints(page, classRefName, declRefName);
+    await assertNotificationMessage(page, "Provider successfully updated");
+  });
+
+  const mapperTests = [
+    { type: "saml-advanced-role", name: "SAML mapper" },
+    {
+      type: "saml-username",
+      name: "SAML Username Template Importer Mapper",
+    },
+    {
+      type: "hardcoded-user-session-attribute",
+      name: "Hardcoded User Session Attribute",
+    },
+    { type: "saml-user-attribute", name: "Attribute Importer" },
+    { type: "oidc-hardcoded-role", name: "Hardcoded Role" },
+    { type: "saml-role", name: "SAML Attribute To Role" },
+  ];
+
+  for (const { type, name } of mapperTests) {
+    test(`should add SAML mapper of type ${name}`, async ({ page }) => {
+      await goToMappersTab(page);
+      await addMapper(page, type, name);
+      await clickSaveMapper(page);
+      await assertNotificationMessage(page, "Mapper created successfully.");
+      await clickCancelMapper(page);
+    });
+  }
+
+  test("should edit SAML settings", async ({ page }) => {
+    await editSAMLSettings(page, samlProviderName);
+    await assertNotificationMessage(page, "Provider successfully updated");
+  });
+});
diff --git a/js/apps/admin-ui/test/identity-providers/saml.ts b/js/apps/admin-ui/test/identity-providers/saml.ts
new file mode 100644
index 000000000000..9d238cd48e16
--- /dev/null
+++ b/js/apps/admin-ui/test/identity-providers/saml.ts
@@ -0,0 +1,59 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem, switchOff, switchOn } from "../utils/form";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToIdentityProviders } from "../utils/sidebar";
+import { clickTableRowItem } from "../utils/table";
+import { assertInvalidUrlNotification, clickSaveButton, setUrl } from "./main";
+
+export async function editSAMLSettings(page: Page, samlProviderName: string) {
+  // Toggle provider state
+  await switchOff(page, "#-switch");
+  await confirmModal(page);
+  await assertNotificationMessage(page, "Provider successfully updated");
+  await goToIdentityProviders(page);
+  await expect(page.getByText("Disabled")).toBeVisible();
+
+  await clickTableRowItem(page, samlProviderName);
+  await switchOn(page, "#-switch");
+
+  // Verify and configure settings
+  await setUrl(page, "singleSignOnService", "invalid");
+  await clickSaveButton(page);
+  await assertInvalidUrlNotification(page, "singleSignOnService");
+  await setUrl(page, "singleSignOnService", "https://valid.com");
+
+  await setUrl(page, "singleLogoutService", "invalid");
+  await clickSaveButton(page);
+  await assertInvalidUrlNotification(page, "singleLogoutService");
+  await setUrl(page, "singleLogoutService", "https://valid.com");
+
+  await selectItem(
+    page,
+    page.locator("#config\\.nameIDPolicyFormat"),
+    "Kerberos",
+  );
+  await selectItem(
+    page,
+    page.locator("#config\\.principalType"),
+    "Attribute [Name]",
+  );
+
+  // Toggle SAML switches
+  const switches = [
+    "config.allowCreate",
+    "config.wantAssertionsSigned",
+    "config.wantAssertionsEncrypted",
+    "config.forceAuthn",
+  ];
+  for (const switchId of switches) {
+    await switchOn(page, `[data-testid="${switchId}"]`);
+  }
+
+  const switchOffIds = ["config.sendIdTokenOnLogout"];
+  for (const switchId of switchOffIds) {
+    await switchOff(page, `[data-testid="${switchId}"]`);
+  }
+
+  await clickSaveButton(page);
+}
diff --git a/js/apps/admin-ui/test/masthead/main.spec.ts b/js/apps/admin-ui/test/masthead/main.spec.ts
new file mode 100644
index 000000000000..a1e7137c3a66
--- /dev/null
+++ b/js/apps/admin-ui/test/masthead/main.spec.ts
@@ -0,0 +1,116 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login, logout } from "../utils/login";
+import { assertAxeViolations } from "../utils/masthead";
+import { goToClients } from "../utils/sidebar";
+import {
+  assertIsDesktopView,
+  assertIsMobileView,
+  clickGlobalHelp,
+  getDocumentationLink,
+  goToAccountManagement,
+  toggleGlobalHelp,
+  toggleMobileViewHelp,
+  toggleUsernameDropdown,
+} from "./main";
+
+test.describe("Masthead tests", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+  });
+
+  test.describe("Desktop view", () => {
+    test("Go to account console and back to admin console", async ({
+      page,
+    }) => {
+      await goToAccountManagement(page);
+      await expect(page).toHaveURL(/\/realms\/master\/account/);
+    });
+
+    test("Sign out reaches to log in screen", async ({ page }) => {
+      await logout(page);
+      await expect(page).toHaveURL(/\/auth/);
+    });
+
+    test("Go to realm info", async ({ page }) => {
+      await goToClients(page);
+      await toggleUsernameDropdown(page);
+      await page.getByRole("menuitem", { name: "Realm info" }).click();
+      await expect(page.getByTestId("welcomeTitle")).toContainText("Welcome");
+    });
+
+    test("Should go to documentation page", async ({ page }) => {
+      await clickGlobalHelp(page);
+      await expect(getDocumentationLink(page)).toHaveAttribute(
+        "href",
+        "https://www.keycloak.org/docs/latest/server_admin/index.html",
+      );
+    });
+
+    test("Enable/disable help mode in desktop mode", async ({ page }) => {
+      const helpLabel = '[data-testid="help-label-enabledFeatures"]';
+      await assertIsDesktopView(page);
+      await page.getByTestId("infoTab").click();
+      await expect(page.locator(helpLabel)).toBeVisible();
+      await clickGlobalHelp(page);
+      await toggleGlobalHelp(page);
+      await expect(page.locator(helpLabel)).toBeHidden();
+      await toggleGlobalHelp(page);
+      await expect(page.locator(helpLabel)).toBeVisible();
+    });
+
+    test("Check a11y violations on load/ masthead", async ({ page }) => {
+      await assertAxeViolations(page);
+    });
+  });
+
+  test.describe("Login works for unprivileged users", () => {
+    const realmName = `test-realm-${uuid()}`;
+    const username = `test-user-${uuid()}`;
+
+    test.beforeAll(async () => {
+      await adminClient.createRealm(realmName, { enabled: true });
+      await adminClient.createUser({
+        realm: realmName,
+        username,
+        enabled: true,
+        emailVerified: true,
+        credentials: [{ type: "password", value: "test" }],
+        firstName: "Test",
+        lastName: "User",
+        email: "test@keycloak.org",
+      });
+    });
+
+    test.afterAll(() => adminClient.deleteRealm(realmName));
+
+    test("Login without privileges to see admin console", async ({ page }) => {
+      await logout(page);
+      await login(page, username, "test", realmName);
+      await logout(page, "Test User");
+      await expect(page).toHaveURL(/\/auth/);
+    });
+  });
+
+  test.describe("Mobile view", () => {
+    test.beforeEach(async ({ page }) => {
+      await page.setViewportSize({ width: 360, height: 640 });
+    });
+    test("Mobile menu is shown when in mobile view", async ({ page }) => {
+      await assertIsMobileView(page);
+    });
+
+    test("Enable/disable help mode in mobile view", async ({ page }) => {
+      await assertIsMobileView(page);
+      await toggleUsernameDropdown(page);
+      await toggleMobileViewHelp(page);
+      await expect(page.getByTestId("helpIcon")).toBeVisible();
+      await expect(page.getByText("Help off")).toBeVisible();
+    });
+
+    test("Check a11y violations on load/ masthead", async ({ page }) => {
+      await assertAxeViolations(page);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/masthead/main.ts b/js/apps/admin-ui/test/masthead/main.ts
new file mode 100644
index 000000000000..2704df803736
--- /dev/null
+++ b/js/apps/admin-ui/test/masthead/main.ts
@@ -0,0 +1,55 @@
+import { Page, expect } from "@playwright/test";
+
+function getMobileUserDropdownSelector(page: Page) {
+  return page.getByTestId("options-kebab-toggle");
+}
+
+function getUserDropdownSelector(page: Page) {
+  return page.getByTestId("options-toggle");
+}
+
+async function getUserDropdown(page: Page) {
+  const width = await page.evaluate(
+    () => document.documentElement.getBoundingClientRect().width,
+  );
+  if (width < 1024) {
+    return getMobileUserDropdownSelector(page);
+  } else {
+    return getUserDropdownSelector(page);
+  }
+}
+
+export async function goToAccountManagement(page: Page) {
+  await (await getUserDropdown(page)).click();
+  await page.locator("#manage-account").click();
+}
+
+export async function assertIsMobileView(page: Page) {
+  await expect(getUserDropdownSelector(page)).toBeHidden();
+  await expect(getMobileUserDropdownSelector(page)).toBeVisible();
+}
+
+export async function assertIsDesktopView(page: Page) {
+  await expect(getUserDropdownSelector(page)).toBeVisible();
+  await expect(getMobileUserDropdownSelector(page)).toBeHidden();
+}
+
+export async function toggleUsernameDropdown(page: Page) {
+  await (await getUserDropdown(page)).click();
+}
+
+export async function toggleMobileViewHelp(page: Page) {
+  await page.getByRole("menuitem", { name: "Help on" }).click();
+}
+
+export function getDocumentationLink(page: Page) {
+  return page.getByTestId("documentation-link");
+}
+
+export async function clickGlobalHelp(page: Page) {
+  await page.getByTestId("help-toggle").click();
+}
+
+export async function toggleGlobalHelp(page: Page) {
+  await page.locator("#enableHelp").click({ force: true });
+}
diff --git a/js/apps/admin-ui/test/masthead/realm.spec.ts b/js/apps/admin-ui/test/masthead/realm.spec.ts
new file mode 100644
index 000000000000..7d900a4a1263
--- /dev/null
+++ b/js/apps/admin-ui/test/masthead/realm.spec.ts
@@ -0,0 +1,115 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertRequiredFieldError, switchOff } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToClients, goToRealmSettings } from "../utils/sidebar";
+import { assertRowExists } from "../utils/table";
+import {
+  assertCurrentRealm,
+  clickClearResourceFile,
+  clickConfirmClear,
+  clickCreateRealm,
+  clickCreateRealmForm,
+  fillRealmName,
+  goToRealmSection,
+} from "./realm";
+
+const testRealmName = `Test-realm-${uuid()}`;
+const newRealmName = `New-Test-realm-${uuid()}`;
+const editedRealmName = `Edited-Test-realm-${uuid()}`;
+const testDisabledName = `Test-Disabled-${uuid()}`;
+const specialCharsName = `%22-${uuid()}`;
+
+test.describe("Realm tests", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await clickCreateRealm(page);
+  });
+
+  test.afterAll(async () => {
+    await Promise.all(
+      [testRealmName, newRealmName, editedRealmName, specialCharsName].map(
+        (realm) => adminClient.deleteRealm(realm),
+      ),
+    );
+  });
+
+  test("should fail creating duplicated or empty name realm", async ({
+    page,
+  }) => {
+    await page.getByTestId("create").click();
+    await assertRequiredFieldError(page, "realm");
+
+    await fillRealmName(page, "master");
+    await clickCreateRealmForm(page);
+
+    await assertNotificationMessage(
+      page,
+      "Could not create realm Realm master already exists",
+    );
+  });
+
+  test("should create Test realm", async ({ page }) => {
+    await page.locator(".w-tc-editor-text").fill("clear this field");
+    await clickClearResourceFile(page);
+    await clickConfirmClear(page);
+
+    await fillRealmName(page, testRealmName);
+    await clickCreateRealmForm(page);
+
+    await assertNotificationMessage(page, "Realm created successfully");
+  });
+
+  test("CRUD test of Disabled realm", async ({ page }) => {
+    await fillRealmName(page, testDisabledName);
+    await clickCreateRealmForm(page);
+
+    await assertNotificationMessage(page, "Realm created successfully");
+
+    await goToRealmSettings(page);
+
+    await switchOff(page, `#${testDisabledName}-switch`);
+    await confirmModal(page);
+
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await goToRealmSettings(page);
+    await selectActionToggleItem(page, "Delete");
+    await confirmModal(page);
+
+    await assertNotificationMessage(page, "The realm has been deleted");
+
+    await assertCurrentRealm(page, testDisabledName, true);
+  });
+
+  test("should create realm from new a realm", async ({ page }) => {
+    await fillRealmName(page, newRealmName);
+    await clickCreateRealmForm(page);
+
+    await assertNotificationMessage(page, "Realm created successfully");
+
+    await clickCreateRealm(page);
+    await fillRealmName(page, editedRealmName);
+    await clickCreateRealmForm(page);
+
+    await assertNotificationMessage(page, "Realm created successfully");
+
+    await goToRealmSection(page);
+    await assertRowExists(page, newRealmName);
+    await assertRowExists(page, editedRealmName);
+  });
+
+  test("should create realm with special characters", async ({ page }) => {
+    await fillRealmName(page, specialCharsName);
+    await clickCreateRealmForm(page);
+
+    await goToClients(page);
+    await assertRowExists(page, "account-console");
+  });
+});
diff --git a/js/apps/admin-ui/test/masthead/realm.ts b/js/apps/admin-ui/test/masthead/realm.ts
new file mode 100644
index 000000000000..a33893233620
--- /dev/null
+++ b/js/apps/admin-ui/test/masthead/realm.ts
@@ -0,0 +1,44 @@
+import { Page, expect } from "@playwright/test";
+import { goToRealm, goToRealms } from "../utils/sidebar";
+
+function getCurrentRealmItem(page: Page) {
+  return page.getByTestId("currentRealm");
+}
+
+export async function goToRealmSection(page: Page) {
+  const realmName = await getCurrentRealmItem(page).textContent();
+  await goToRealm(page, realmName!);
+}
+
+export async function clickCreateRealm(page: Page) {
+  await goToRealms(page);
+  await page.getByTestId("add-realm").click();
+}
+
+export async function fillRealmName(page: Page, realmName: string) {
+  await page.getByTestId("realm").fill(realmName);
+}
+
+export async function clickCreateRealmForm(page: Page) {
+  await page.getByTestId("create").click();
+}
+
+export async function clickClearResourceFile(page: Page) {
+  await page.getByRole("button", { name: "Clear" }).click();
+}
+
+export async function clickConfirmClear(page: Page) {
+  await page.getByTestId("clear-button").click();
+}
+
+export async function assertCurrentRealm(
+  page: Page,
+  realmName: string,
+  not = false,
+) {
+  if (!not) {
+    await expect(getCurrentRealmItem(page)).toContainText(realmName);
+  } else {
+    await expect(getCurrentRealmItem(page)).not.toContainText(realmName);
+  }
+}
diff --git a/js/apps/admin-ui/test/organization/idp.spec.ts b/js/apps/admin-ui/test/organization/idp.spec.ts
new file mode 100644
index 000000000000..8744794c066b
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/idp.spec.ts
@@ -0,0 +1,57 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToOrganizations, goToRealm } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertRowExists,
+  clickTableRowItem,
+} from "../utils/table";
+import {
+  clickAddIdentityProvider,
+  fillForm,
+  goToIdentityProviders,
+} from "./idp";
+
+test.describe("Identity providers", () => {
+  const realmName = `organization-idp-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, { organizationsEnabled: true });
+    await adminClient.createOrganization({
+      realm: realmName,
+      name: "idp",
+      domains: [{ name: "o.com", verified: false }],
+    });
+    await adminClient.createIdentityProvider(
+      "BitBucket",
+      "bitbucket",
+      realmName,
+    );
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToOrganizations(page);
+    await clickTableRowItem(page, "idp");
+    await goToIdentityProviders(page);
+  });
+
+  test("should add idp", async ({ page }) => {
+    await assertEmptyTable(page);
+    await clickAddIdentityProvider(page);
+    await fillForm(page, { name: "bitbucket", domain: "o.com" });
+    await confirmModal(page);
+    await assertNotificationMessage(
+      page,
+      "Identity provider successfully linked to organization",
+    );
+    await assertRowExists(page, "bitbucket");
+  });
+});
diff --git a/js/apps/admin-ui/test/organization/idp.ts b/js/apps/admin-ui/test/organization/idp.ts
new file mode 100644
index 000000000000..fd6cb16ec125
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/idp.ts
@@ -0,0 +1,27 @@
+import { Page } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+export async function goToIdentityProviders(page: Page) {
+  await page.getByTestId("identityProvidersTab").click();
+}
+
+export async function clickAddIdentityProvider(page: Page) {
+  await page
+    .getByTestId("no-identity-provider-in-this-organization-empty-action")
+    .click();
+}
+
+export async function fillForm(
+  page: Page,
+  data: {
+    name: string;
+    domain: string;
+  },
+) {
+  await selectItem(page, page.getByTestId("alias"), data.name);
+  await selectItem(
+    page,
+    page.locator("#config\\.kc🍺org🍺domain"),
+    data.domain,
+  );
+}
diff --git a/js/apps/admin-ui/test/organization/main.spec.ts b/js/apps/admin-ui/test/organization/main.spec.ts
new file mode 100644
index 000000000000..b181134084c3
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/main.spec.ts
@@ -0,0 +1,108 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertSaveButtonIsDisabled, clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToOrganizations, goToRealm } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickRowKebabItem,
+  clickTableRowItem,
+} from "../utils/table";
+import {
+  fillCreatePage,
+  fillNameField,
+  getNameField,
+  goToCreate,
+} from "./main";
+
+test.describe("Organization CRUD", () => {
+  const realmName = `organization-${uuid()}`;
+
+  test.beforeAll(() =>
+    adminClient.createRealm(realmName, { organizationsEnabled: true }),
+  );
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToOrganizations(page);
+  });
+
+  test("should create new organization", async ({ page }) => {
+    await goToCreate(page);
+    await assertSaveButtonIsDisabled(page);
+    await fillCreatePage(page, { name: "orgName" });
+    await fillCreatePage(page, {
+      name: "orgName",
+      domain: ["ame.org", "test.nl"],
+      description: "some description",
+    });
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Organization successfully saved.");
+  });
+
+  test.describe("Existing organization", () => {
+    const orgName = `org-edit-${uuid()}`;
+    const delOrgName = `org-del-${uuid()}`;
+    const delOrgName2 = `org-del-${uuid()}`;
+
+    test.beforeAll(async () => {
+      await adminClient.createOrganization({
+        realm: realmName,
+        name: orgName,
+        domains: [{ name: orgName, verified: false }],
+      });
+      await adminClient.createOrganization({
+        realm: realmName,
+        name: delOrgName,
+        domains: [{ name: delOrgName, verified: false }],
+      });
+      await adminClient.createOrganization({
+        realm: realmName,
+        name: delOrgName2,
+        domains: [{ name: delOrgName2, verified: false }],
+      });
+    });
+
+    test.afterAll(async () => {
+      await adminClient.deleteOrganization(orgName, realmName);
+    });
+
+    test("should modify existing organization", async ({ page }) => {
+      await clickTableRowItem(page, orgName);
+      const newValue = "newName";
+      await fillNameField(page, newValue);
+      await expect(getNameField(page)).toHaveValue(newValue);
+      await clickSaveButton(page);
+      await assertNotificationMessage(page, "Organization successfully saved.");
+      await goToOrganizations(page);
+      await assertRowExists(page, newValue);
+    });
+
+    test("should delete from list", async ({ page }) => {
+      await clickRowKebabItem(page, delOrgName, "Delete");
+      await confirmModal(page);
+      await assertNotificationMessage(
+        page,
+        "The organization has been deleted",
+      );
+    });
+
+    test("should delete from details page", async ({ page }) => {
+      await clickTableRowItem(page, delOrgName2);
+      await selectActionToggleItem(page, "Delete");
+      await confirmModal(page);
+      await assertNotificationMessage(
+        page,
+        "The organization has been deleted",
+      );
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/organization/main.ts b/js/apps/admin-ui/test/organization/main.ts
new file mode 100644
index 000000000000..931112487c7f
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/main.ts
@@ -0,0 +1,34 @@
+import { Page } from "@playwright/test";
+
+export async function goToCreate(page: Page, empty: boolean = true) {
+  await page
+    .getByTestId(empty ? "no-organizations-empty-action" : "addOrganization")
+    .click();
+}
+
+export async function fillCreatePage(
+  page: Page,
+  values: { name: string; domain?: string[]; description?: string },
+) {
+  await fillNameField(page, values.name);
+  if (values.domain) {
+    for (let index = 0; index < values.domain.length; index++) {
+      await page.getByTestId(`domains${index}`).fill(values.domain[index]);
+      if (index !== values.domain.length - 1) {
+        await page.getByTestId("domains-addValue").click();
+      }
+    }
+  }
+  if (values.description) {
+    await page.getByTestId("description").fill(values.description);
+  }
+}
+
+export function getNameField(page: Page) {
+  return page.getByTestId("name");
+}
+
+export async function fillNameField(page: Page, name: string) {
+  await getNameField(page).clear();
+  await getNameField(page).fill(name);
+}
diff --git a/js/apps/admin-ui/test/organization/members.spec.ts b/js/apps/admin-ui/test/organization/members.spec.ts
new file mode 100644
index 000000000000..5cc3f9e0c049
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/members.spec.ts
@@ -0,0 +1,48 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { clickAdd } from "../utils/modal";
+import { goToOrganizations, goToRealm } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickSelectRow,
+  clickTableRowItem,
+} from "../utils/table";
+import { clickAddRealmUser, goToMembersTab } from "./members";
+
+test.describe("Members", () => {
+  const realmName = `organization-members-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, { organizationsEnabled: true });
+    await adminClient.createOrganization({
+      realm: realmName,
+      name: "member",
+      domains: [{ name: "o.com", verified: false }],
+    });
+    await adminClient.createUser({
+      realm: realmName,
+      username: "realm-user",
+      enabled: true,
+    });
+  });
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToOrganizations(page);
+    await clickTableRowItem(page, "member");
+    await goToMembersTab(page);
+  });
+
+  test("should add member", async ({ page }) => {
+    await clickAddRealmUser(page);
+    await clickSelectRow(page, "Users", "realm-user");
+    await clickAdd(page);
+    await assertNotificationMessage(page, "1 user added to the organization");
+    await assertRowExists(page, "realm-user");
+  });
+});
diff --git a/js/apps/admin-ui/test/organization/members.ts b/js/apps/admin-ui/test/organization/members.ts
new file mode 100644
index 000000000000..1d0170f67fcb
--- /dev/null
+++ b/js/apps/admin-ui/test/organization/members.ts
@@ -0,0 +1,9 @@
+import { Page } from "@playwright/test";
+
+export async function goToMembersTab(page: Page) {
+  await page.getByTestId("membersTab").click();
+}
+
+export async function clickAddRealmUser(page: Page) {
+  await page.getByTestId("add-realm-user-empty-action").click();
+}
diff --git a/js/apps/admin-ui/test/permissions/main.spec.ts b/js/apps/admin-ui/test/permissions/main.spec.ts
new file mode 100644
index 000000000000..ec8c527f9958
--- /dev/null
+++ b/js/apps/admin-ui/test/permissions/main.spec.ts
@@ -0,0 +1,210 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { clickSaveButton, selectItem } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm } from "../utils/sidebar";
+import { assertRowExists } from "../utils/table";
+import {
+  clickCreateNewPolicy,
+  clickCreatePermission,
+  clickCreatePolicySaveButton,
+  clickSearchButton,
+  deletePermission,
+  fillPermissionForm,
+  goToEvaluation,
+  goToPermissions,
+  openSearchPanel,
+  pickGroup,
+  removeGroup,
+  selectResource,
+} from "./main";
+import { fillPolicyForm, goToPolicies } from "./policy";
+
+test.describe("Permissions section tests", () => {
+  const realmName = `permissions-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName, { adminPermissionsEnabled: true });
+    await adminClient.createUser({
+      realm: realmName,
+      username: "test-user",
+      enabled: true,
+    });
+    await adminClient.createGroup("one", realmName);
+    await adminClient.createGroup("two", realmName);
+  });
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToPermissions(page);
+  });
+
+  test("should create permission", async ({ page }) => {
+    await clickCreatePermission(page);
+    await selectResource(page, "Users");
+    await fillPermissionForm(page, {
+      name: "test-permission",
+      description: "test-description",
+      scopes: ["view"],
+    });
+    await clickCreateNewPolicy(page);
+    await fillPolicyForm(
+      page,
+      {
+        name: "test-policy",
+        description: "test-description",
+        type: "User",
+        user: "test-user",
+      },
+      true,
+    );
+    await clickCreatePolicySaveButton(page);
+    await assertNotificationMessage(page, "Successfully created the policy");
+
+    await expect(
+      page.getByRole("gridcell", { name: "test-policy" }),
+    ).toBeVisible();
+
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      "Successfully created the permission",
+    );
+
+    await goToPermissions(page);
+    await assertRowExists(page, "test-permission");
+    await deletePermission(page, "test-permission");
+    await goToPolicies(page);
+    await assertRowExists(page, "test-policy");
+  });
+
+  test("should edit group permission", async ({ page }) => {
+    await clickCreatePermission(page);
+    await selectResource(page, "Groups");
+    await fillPermissionForm(page, {
+      name: "test-group-permission",
+      scopes: ["view"],
+      enforcementMode: "specificResources",
+    });
+    await pickGroup(page, "one");
+    await pickGroup(page, "two");
+
+    await clickCreateNewPolicy(page);
+    await fillPolicyForm(
+      page,
+      {
+        name: "test-policy2",
+        description: "test-description",
+        type: "User",
+        user: "test-user",
+      },
+      true,
+    );
+
+    await clickCreatePolicySaveButton(page);
+    await assertNotificationMessage(page, "Successfully created the policy");
+    await clickSaveButton(page);
+    await removeGroup(page, "one");
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      "Successfully updated the permission",
+    );
+  });
+
+  test.describe("evaluate permissions", () => {
+    test.beforeAll(async () => {
+      await adminClient.createUser({
+        realm: realmName,
+        username: "other-user",
+        enabled: true,
+      });
+      await adminClient.createUser({
+        realm: realmName,
+        username: "user1",
+        enabled: true,
+      });
+      const { id } = await adminClient.createUserPolicy({
+        realm: realmName,
+        name: "other-policy",
+        description: "other-description",
+        type: "user",
+        username: "other-user",
+      });
+      await adminClient.createPermission({
+        realm: realmName,
+        name: "client-permission",
+        description: "",
+        policies: [id!],
+        resources: [],
+        resourceType: "Clients",
+        scopes: ["view"],
+      });
+    });
+
+    test("should evaluate permissions success", async ({ page }) => {
+      await goToEvaluation(page);
+      await selectItem(page, page.getByTestId("user"), "other-user");
+      await selectItem(page, "#resourceType", "Clients");
+      await selectItem(page, "#clients", "account");
+      await selectItem(page, "#authScopes", "view");
+      await page.getByTestId("permission-eval").click();
+
+      await expect(
+        page.getByRole("heading", { name: "Success alert: account with" }),
+      ).toBeVisible();
+    });
+
+    test("should evaluate permissions denied", async ({ page }) => {
+      await goToEvaluation(page);
+      await selectItem(page, page.getByTestId("user"), "user1");
+      await selectItem(page, "#resourceType", "Clients");
+      await selectItem(page, "#clients", "account");
+      await selectItem(page, "#authScopes", "view");
+      await page.getByTestId("permission-eval").click();
+
+      await expect(
+        page.getByRole("heading", { name: "Warning alert: account with" }),
+      ).toBeVisible();
+    });
+  });
+
+  test.describe("permission search", () => {
+    test.beforeAll(async () => {
+      for (let i = 0; i < 5; i++) {
+        await adminClient.createPermission({
+          realm: realmName,
+          name: `permission-${i}`,
+          description: "",
+          policies: [],
+          resources: [],
+          resourceType: i % 2 ? "Clients" : "Users",
+          scopes: ["view"],
+        });
+      }
+    });
+
+    test("should search permission", async ({ page }) => {
+      await openSearchPanel(page);
+      await page.getByTestId("name").fill("permission-1");
+      await clickSearchButton(page);
+
+      await assertRowExists(page, "permission-1");
+      await assertRowExists(page, "permission-2", false);
+    });
+
+    test("should search permission filter clients", async ({ page }) => {
+      await openSearchPanel(page);
+      await selectItem(page, "#resourceType", "Clients");
+      await clickSearchButton(page);
+
+      await assertRowExists(page, "permission-1");
+      await assertRowExists(page, "permission-2", false);
+      await assertRowExists(page, "permission-3");
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/permissions/main.ts b/js/apps/admin-ui/test/permissions/main.ts
new file mode 100644
index 000000000000..9743350a4328
--- /dev/null
+++ b/js/apps/admin-ui/test/permissions/main.ts
@@ -0,0 +1,77 @@
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import { Page } from "@playwright/test";
+import { selectItem } from "../utils/form";
+import { confirmModal } from "../utils/modal";
+import { clickRowKebabItem } from "../utils/table";
+
+type PermissionForm = PolicyRepresentation & {
+  enforcementMode?: "allResources" | "specificResources";
+};
+
+export async function goToPermissions(page: Page) {
+  await page.getByTestId("nav-item-permissions").click();
+}
+
+export async function goToEvaluation(page: Page) {
+  await page.getByTestId("permissionsEvaluation").click();
+}
+
+export async function clickCreatePermission(page: Page) {
+  await page.getByTestId("no-permissions-empty-action").click();
+}
+
+export async function selectResource(page: Page, resourceName: string) {
+  await page.getByRole("gridcell", { name: resourceName, exact: true }).click();
+}
+
+export async function fillPermissionForm(page: Page, data: PermissionForm) {
+  const entries = Object.entries(data);
+  for (const [key, value] of entries) {
+    if (key === "scopes") {
+      await selectItem(page, "#scopes", value[0]);
+      continue;
+    }
+    if (key === "enforcementMode") {
+      await page.locator(`input[id='${value}']`).click();
+      continue;
+    }
+    await page.getByTestId(key).fill(value);
+  }
+}
+
+export async function pickGroup(page: Page, groupName: string) {
+  await page.getByTestId("select-group-button").click();
+  await page.getByTestId(`${groupName}-check`).check();
+  await page.getByTestId("add-button").click();
+}
+
+export async function removeGroup(page: Page, groupName: string) {
+  await page
+    .getByRole("row", { name: `/${groupName}` })
+    .getByRole("button")
+    .click();
+}
+
+export async function clickCreateNewPolicy(page: Page) {
+  await page.getByTestId("select-createNewPolicy-button").click();
+}
+
+export async function clickCreatePolicySaveButton(page: Page) {
+  await page
+    .getByRole("dialog", { name: "Create policy" })
+    .getByTestId("save")
+    .click();
+}
+
+export async function openSearchPanel(page: Page) {
+  await page.getByTestId("searchdropdown_dorpdown").click();
+}
+
+export async function clickSearchButton(page: Page) {
+  await page.getByTestId("search-btn").click();
+}
+
+export async function deletePermission(page: Page, name: string) {
+  await clickRowKebabItem(page, name, "Delete");
+  await confirmModal(page);
+}
diff --git a/js/apps/admin-ui/test/permissions/policy.spec.ts b/js/apps/admin-ui/test/permissions/policy.spec.ts
new file mode 100644
index 000000000000..979255e460ae
--- /dev/null
+++ b/js/apps/admin-ui/test/permissions/policy.spec.ts
@@ -0,0 +1,40 @@
+import test from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { clickSaveButton } from "../utils/form";
+import { login } from "../utils/login";
+import { goToRealm } from "../utils/sidebar";
+import { goToPermissions } from "./main";
+import {
+  clickCreateNewPolicy,
+  clickPolicyType,
+  fillPolicyForm,
+  goToPolicies,
+} from "./policy";
+
+test.describe("Policy section tests", () => {
+  const realmName = `permissions-policy-${uuid()}`;
+
+  test.beforeAll(() =>
+    adminClient.createRealm(realmName, { adminPermissionsEnabled: true }),
+  );
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToPermissions(page);
+    await goToPolicies(page);
+  });
+
+  test("create policy", async ({ page }) => {
+    await clickCreateNewPolicy(page);
+    await clickPolicyType(page, "Client");
+    await fillPolicyForm(page, {
+      name: "test-policy",
+      description: "test-description",
+      client: "broker",
+    });
+    await clickSaveButton(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/permissions/policy.ts b/js/apps/admin-ui/test/permissions/policy.ts
new file mode 100644
index 000000000000..b9ac6ebf2fb8
--- /dev/null
+++ b/js/apps/admin-ui/test/permissions/policy.ts
@@ -0,0 +1,54 @@
+import { Page } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+export async function clickCreateNewPolicy(page: Page) {
+  await page.getByTestId("no-policies-empty-action").click();
+}
+
+export async function goToPolicies(page: Page) {
+  await page.getByTestId("permissionsPolicies").click();
+}
+
+export async function clickPolicyType(page: Page, type: string) {
+  await page.getByRole("gridcell", { name: type, exact: true }).click();
+}
+
+type PolicyForm = {
+  name: string;
+  description: string;
+  type?: string;
+  user?: string;
+  client?: string;
+};
+
+export async function fillPolicyForm(
+  page: Page,
+  data: PolicyForm,
+  dialog: boolean = false,
+) {
+  const entries = Object.entries(data);
+  for (const [key, value] of entries) {
+    if (key === "type") {
+      await selectItem(page, "#type", value);
+      continue;
+    }
+    if (key === "user") {
+      await selectItem(
+        page,
+        page.getByRole("combobox", { name: "Type to filter" }),
+        value,
+      );
+      continue;
+    }
+    if (key === "client") {
+      await selectItem(page, "#clients", value);
+      await page.locator("#clients").click();
+      continue;
+    }
+
+    const locator = dialog
+      ? page.getByRole("dialog", { name: "Create policy" })
+      : page;
+    await locator.getByTestId(key).fill(value);
+  }
+}
diff --git a/js/apps/admin-ui/test/realm-roles/axe.spec.ts b/js/apps/admin-ui/test/realm-roles/axe.spec.ts
new file mode 100644
index 000000000000..ea84ca84c456
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-roles/axe.spec.ts
@@ -0,0 +1,40 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertAxeViolations } from "../utils/masthead";
+import { goToRealm, goToRealmRoles } from "../utils/sidebar";
+import { clickTableRowItem } from "../utils/table";
+
+test.describe("Accessibility tests for realm roles", () => {
+  const realmName = "role-a11y-" + uuid();
+  const defaultRolesMaster = "default-roles-" + realmName;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmRoles(page);
+  });
+
+  test("Check a11y violations on load/ realm roles", async ({ page }) => {
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on default-roles-master default tab and default roles tabs", async ({
+    page,
+  }) => {
+    await clickTableRowItem(page, defaultRolesMaster);
+    await assertAxeViolations(page);
+
+    await page.click("text=Default groups");
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on empty create role form", async ({ page }) => {
+    await page.click("text=Create role");
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-roles/main.spec.ts b/js/apps/admin-ui/test/realm-roles/main.spec.ts
new file mode 100644
index 000000000000..6f395598fce2
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-roles/main.spec.ts
@@ -0,0 +1,319 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import { fillRoleData } from "../clients/role";
+import adminClient from "../utils/AdminClient";
+import {
+  assertAttribute,
+  assertAttributeLength,
+  clickAttributeSaveButton,
+  deleteAttribute,
+  fillAttributeData,
+  goToAttributesTab,
+} from "../utils/attributes";
+import {
+  assertRequiredFieldError,
+  clickCancelButton,
+  clickSaveButton,
+} from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import {
+  pickRoleType,
+  clickUnassign,
+  confirmModalAssign,
+  pickRole,
+} from "../utils/roles";
+import { goToRealm, goToRealmRoles } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertNoResults,
+  assertRowExists,
+  clickRowKebabItem,
+  clickTableRowItem,
+  searchItem,
+} from "../utils/table";
+import {
+  assertUnassignDisabled,
+  clickCreateRoleButton,
+  goToAssociatedRolesTab,
+} from "./main";
+
+test.describe("Realm roles test", () => {
+  const realmName = `realm-roles-${uuid()}`;
+  const prefix = "realm_role_crud";
+  const searchPlaceHolder = "Search role by name";
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmRoles(page);
+  });
+
+  test("should fail creating realm role", async ({ page }) => {
+    await clickCreateRoleButton(page);
+    await clickSaveButton(page);
+    await assertRequiredFieldError(page, "name");
+
+    await fillRoleData(page, "admin");
+    await clickSaveButton(page);
+    await clickCancelButton(page);
+
+    await clickCreateRoleButton(page);
+    await fillRoleData(page, "admin");
+    await clickSaveButton(page);
+    await assertNotificationMessage(
+      page,
+      "Could not create role: Role with name admin already exists",
+    );
+  });
+
+  test("shouldn't create a realm role based with only whitespace name", async ({
+    page,
+  }) => {
+    await clickCreateRoleButton(page);
+    await fillRoleData(page, " ");
+    await assertRequiredFieldError(page, "name");
+  });
+
+  test("Realm role CRUD test", async ({ page }) => {
+    const itemId = prefix + uuid();
+
+    // Create
+    await assertRowExists(page, itemId, false);
+    await clickCreateRoleButton(page);
+    await fillRoleData(page, itemId);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Role created");
+    await goToRealmRoles(page);
+
+    await searchItem(page, searchPlaceHolder, itemId);
+    await clickRowKebabItem(page, itemId, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "The role has been deleted");
+
+    await assertRowExists(page, itemId, false);
+  });
+
+  test("should delete role from details action", async ({ page }) => {
+    const itemId = prefix + uuid();
+
+    await clickCreateRoleButton(page);
+    await fillRoleData(page, itemId);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Role created");
+    await goToRealmRoles(page);
+    await clickRowKebabItem(page, itemId, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "The role has been deleted");
+  });
+
+  test("should not be able to delete default role", async ({ page }) => {
+    const defaultRole = "default-roles-" + realmName;
+    await searchItem(page, searchPlaceHolder, defaultRole);
+    await clickRowKebabItem(page, defaultRole, "Delete");
+    await assertNotificationMessage(page, "You cannot delete a default role.");
+  });
+
+  test("Add associated roles test", async ({ page }) => {
+    const itemId = prefix + uuid();
+
+    // Create
+    await assertRowExists(page, itemId, false);
+    await clickCreateRoleButton(page);
+    await fillRoleData(page, itemId);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "Role created");
+    await goToAssociatedRolesTab(page);
+
+    // Add associated realm role from search bar
+    await pickRoleType(page, "roles");
+    await pickRole(page, "offline_access", true);
+    await confirmModalAssign(page);
+    await assertNotificationMessage(page, "Associated roles have been added");
+
+    // Add associated client role from search bar
+    await pickRoleType(page, "client");
+    await pickRole(page, "manage-account", true);
+    await confirmModalAssign(page);
+    await assertNotificationMessage(page, "Associated roles have been added");
+
+    // Add associated client role
+    await pickRoleType(page, "client");
+    await pickRole(page, "manage-consent", true);
+    await confirmModalAssign(page);
+    await assertNotificationMessage(page, "Associated roles have been added");
+  });
+
+  test("should search existing associated role by name and go to it", async ({
+    page,
+  }) => {
+    const realmRole = "offline_access";
+    await searchItem(page, searchPlaceHolder, "offline_access");
+    await assertRowExists(page, realmRole);
+    await clickTableRowItem(page, realmRole);
+    await expect(
+      page.getByTestId("view-header").locator("text=" + realmRole),
+    ).toBeVisible();
+    await page.click("text=Cancel");
+  });
+
+  test("should go to default-roles-master link role name and check assign roles table is not empty", async ({
+    page,
+  }) => {
+    const defaultRole = "default-roles-" + realmName;
+    await clickTableRowItem(page, defaultRole);
+
+    await page.click("text=Default groups");
+    await assertEmptyTable(page);
+
+    await page.click("text=Default roles");
+    await expect(page.getByTestId("assigned-roles")).toBeVisible();
+  });
+
+  test("Should search non-existent associated role by name", async ({
+    page,
+  }) => {
+    const itemName = "non-existent-associated-role";
+    await searchItem(page, searchPlaceHolder, itemName);
+    await assertNoResults(page);
+  });
+
+  test("Should hide inherited roles test", async ({ page }) => {
+    const itemId = prefix + uuid();
+    await adminClient.createRealmRole({ name: itemId, realm: realmName });
+
+    await searchItem(page, searchPlaceHolder, itemId);
+    await clickTableRowItem(page, itemId);
+    await goToAssociatedRolesTab(page);
+    await page.getByTestId("show-inherited-roles-empty-action").click();
+  });
+
+  test("Should fail to remove role when all unchecked from search bar", async ({
+    page,
+  }) => {
+    const itemId = prefix + uuid();
+    await adminClient.createRealmRole({ name: itemId, realm: realmName });
+
+    await searchItem(page, searchPlaceHolder, itemId);
+    await clickTableRowItem(page, itemId);
+    await goToAssociatedRolesTab(page);
+
+    await pickRoleType(page, "client");
+    await pickRole(page, "view-profile", true);
+    await confirmModalAssign(page);
+
+    await assertUnassignDisabled(page);
+  });
+
+  test("Should delete single non-inherited role item", async ({ page }) => {
+    const itemId = prefix + uuid();
+    await adminClient.createRealmRole({ name: itemId, realm: realmName });
+
+    await searchItem(page, searchPlaceHolder, itemId);
+    await clickTableRowItem(page, itemId);
+    await goToAssociatedRolesTab(page);
+
+    await pickRoleType(page, "client");
+    await pickRole(page, "view-profile", true);
+    await confirmModalAssign(page);
+
+    await clickRowKebabItem(page, "account view-profile", "Unassign");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Role mapping updated");
+  });
+
+  test("Should delete all roles from search bar", async ({ page }) => {
+    const itemId = prefix + uuid();
+    await adminClient.createRealmRole({ name: itemId, realm: realmName });
+
+    await searchItem(page, searchPlaceHolder, itemId);
+    await clickTableRowItem(page, itemId);
+    await goToAssociatedRolesTab(page);
+
+    await pickRoleType(page, "client");
+    await pickRole(page, "view-profile", true);
+    await confirmModalAssign(page);
+
+    await page.locator('input[name="check-all"]').check();
+    await clickUnassign(page);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Role mapping updated");
+  });
+
+  test.describe("edit role details", () => {
+    const editRoleName = "going to edit";
+    const description = "some description";
+    const updateDescription = "updated description";
+
+    test.beforeEach(async () => {
+      await adminClient.createRealmRole({
+        realm: realmName,
+        name: editRoleName,
+        description,
+      });
+    });
+
+    test.afterEach(() => adminClient.deleteRealmRole(editRoleName, realmName));
+
+    test("should edit realm role details", async ({ page }) => {
+      await searchItem(page, searchPlaceHolder, editRoleName);
+      await clickTableRowItem(page, editRoleName);
+      await expect(page.locator("input[name='name']")).toBeDisabled();
+      await expect(page.locator("textarea[name='description']")).toHaveValue(
+        description,
+      );
+      await page.fill("textarea[name='description']", updateDescription);
+      await clickSaveButton(page);
+      await assertNotificationMessage(page, "The role has been saved");
+      await expect(page.locator("textarea[name='description']")).toHaveValue(
+        updateDescription,
+      );
+    });
+
+    test("should add attribute", async ({ page }) => {
+      await searchItem(page, searchPlaceHolder, editRoleName);
+      await clickTableRowItem(page, editRoleName);
+
+      await goToAttributesTab(page);
+      await fillAttributeData(page, "one", "1");
+      await clickAttributeSaveButton(page);
+      await assertNotificationMessage(page, "The role has been saved");
+      await assertAttributeLength(page, 1);
+    });
+
+    test("should add attribute multiple", async ({ page }) => {
+      await searchItem(page, searchPlaceHolder, editRoleName);
+      await clickTableRowItem(page, editRoleName);
+
+      await goToAttributesTab(page);
+      await fillAttributeData(page, "one", "1");
+      await fillAttributeData(page, "two", "2", undefined, 1);
+      await fillAttributeData(page, "three", "3", undefined, 2);
+
+      await clickAttributeSaveButton(page);
+      await assertNotificationMessage(page, "The role has been saved");
+      await assertAttributeLength(page, 3);
+      await assertAttribute(page, "one", "1");
+      await assertAttribute(page, "two", "2", 1);
+    });
+
+    test("should delete attribute", async ({ page }) => {
+      await searchItem(page, searchPlaceHolder, editRoleName);
+      await clickTableRowItem(page, editRoleName);
+      await goToAttributesTab(page);
+      await fillAttributeData(page, "one", "1");
+      await fillAttributeData(page, "two", "2", undefined, 1);
+      await clickAttributeSaveButton(page);
+
+      await deleteAttribute(page, 1);
+      await clickAttributeSaveButton(page);
+
+      await assertNotificationMessage(page, "The role has been saved");
+      await assertAttributeLength(page, 1);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-roles/main.ts b/js/apps/admin-ui/test/realm-roles/main.ts
new file mode 100644
index 000000000000..4f30bc40e1c9
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-roles/main.ts
@@ -0,0 +1,13 @@
+import { Page, expect } from "@playwright/test";
+
+export async function clickCreateRoleButton(page: Page) {
+  await page.locator("text=Create role").click();
+}
+
+export async function goToAssociatedRolesTab(page: Page) {
+  await page.getByTestId("associatedRolesTab").click();
+}
+
+export async function assertUnassignDisabled(page: Page) {
+  await expect(page.getByTestId("unAssignRole")).toBeDisabled();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/accessibility.spec.ts b/js/apps/admin-ui/test/realm-settings/accessibility.spec.ts
new file mode 100644
index 000000000000..4c31ae5d2df6
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/accessibility.spec.ts
@@ -0,0 +1,193 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertAxeViolations } from "../utils/masthead";
+import { pickRoleType } from "../utils/roles";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  goToClientPoliciesList,
+  goToClientPoliciesTab,
+} from "./client-policies";
+import { goToRealmEventsTab } from "./events";
+import { goToAddProviders, goToKeys } from "./keys";
+import { goToLocalizationTab, goToRealmOverridesSubTab } from "./localization";
+import { goToLoginTab } from "./login";
+
+test.describe("Accessibility tests for realm settings", () => {
+  const realmName = `realm-settings-accessibility-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+  });
+
+  test("Check a11y violations on load/ realm settings/ general tab", async ({
+    page,
+  }) => {
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on login tab", async ({ page }) => {
+    await goToLoginTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on email tab", async ({ page }) => {
+    await page.getByTestId("rs-email-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on themes tab", async ({ page }) => {
+    await page.getByTestId("rs-themes-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on keys tab/ keys list sub tab", async ({
+    page,
+  }) => {
+    await goToKeys(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on keys tab/ providers sub tab", async ({
+    page,
+  }) => {
+    await goToKeys(page);
+    await goToAddProviders(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on keys tab/ providers sub tab / adding provider", async ({
+    page,
+  }) => {
+    await goToKeys(page);
+    await goToAddProviders(page);
+    await page.getByTestId("addProviderDropdown").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on events tab/ event listeners sub tab", async ({
+    page,
+  }) => {
+    await goToRealmEventsTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on events tab/ user events settings sub tab", async ({
+    page,
+  }) => {
+    await goToRealmEventsTab(page);
+    await page.getByTestId("rs-events-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on events tab/ admin events settings sub tab", async ({
+    page,
+  }) => {
+    await goToRealmEventsTab(page);
+    await page.getByTestId("rs-admin-events-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on localization locales sub tab", async ({
+    page,
+  }) => {
+    await goToLocalizationTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on localization realm overrides sub tab", async ({
+    page,
+  }) => {
+    await goToLocalizationTab(page);
+    await goToRealmOverridesSubTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on localization realm overrides sub tab/ adding message bundle", async ({
+    page,
+  }) => {
+    await goToLocalizationTab(page);
+    await goToRealmOverridesSubTab(page);
+    await page.getByTestId("add-translationBtn").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on localization effective message bundles sub tab", async ({
+    page,
+  }) => {
+    await goToLocalizationTab(page);
+    await page
+      .getByTestId("rs-localization-effective-message-bundles-tab")
+      .click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on security defenses tab", async ({ page }) => {
+    await page.getByTestId("rs-security-defenses-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on sessions tab", async ({ page }) => {
+    await page.getByTestId("rs-sessions-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on tokens tab", async ({ page }) => {
+    await page.getByTestId("rs-tokens-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on client policies tab/ profiles sub tab", async ({
+    page,
+  }) => {
+    await goToClientPoliciesTab(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on client policies tab/ creating profile", async ({
+    page,
+  }) => {
+    await goToClientPoliciesTab(page);
+    await page.getByTestId("createProfile").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on client policies tab/ policies sub tab", async ({
+    page,
+  }) => {
+    await goToClientPoliciesTab(page);
+    await goToClientPoliciesList(page);
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on client policies tab/ creating policy", async ({
+    page,
+  }) => {
+    await goToClientPoliciesTab(page);
+    await goToClientPoliciesList(page);
+    await page.getByTestId("no-client-policies-empty-action").click();
+    await assertAxeViolations(page);
+    await page.getByTestId("cancelCreatePolicy").click();
+  });
+
+  test("Check a11y violations on user registration tab/ default roles sub tab", async ({
+    page,
+  }) => {
+    await page.getByTestId("rs-userRegistration-tab").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on user registration tab/ default roles sub tab/ assigning role", async ({
+    page,
+  }) => {
+    await page.getByTestId("rs-userRegistration-tab").click();
+    await pickRoleType(page, "client");
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/client-policies.spec.ts b/js/apps/admin-ui/test/realm-settings/client-policies.spec.ts
new file mode 100644
index 000000000000..3b6dccf7fed0
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/client-policies.spec.ts
@@ -0,0 +1,203 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertFieldError } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import {
+  assertModalMessage,
+  assertModalTitle,
+  cancelModal,
+  confirmModal,
+} from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertEmptyTable,
+  assertRowExists,
+  clickTableRowItem,
+  searchItem,
+} from "../utils/table";
+import {
+  addClientRolesCondition,
+  addClientScopeCondition,
+  addClientUpdaterSourceHost,
+  assertExists,
+  checkNewClientPolicyForm as assertNewClientPolicyForm,
+  assertRoles,
+  clickAddCondition,
+  clickCancelClientPolicyCreation,
+  clickSaveClientPolicy,
+  clickSaveConditionButton,
+  createNewClientPolicyFromEmptyState,
+  deleteClientPolicyFromDetails,
+  deleteClientPolicyItemFromTable,
+  deleteCondition,
+  fillClientPolicyForm,
+  fillClientRolesCondition,
+  goBackToPolicies,
+  goToClientPoliciesList,
+  goToClientPoliciesTab,
+  selectCondition,
+  shouldCancelAddingCondition,
+  shouldNotHaveConditionsConfigured,
+  shouldReloadJSONPolicies,
+} from "./client-policies";
+
+test.describe("Realm settings client policies tab tests", () => {
+  const realmName = `realm-settings-client-policies_${uuid()}`;
+  const placeHolder = "Search client policy";
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToClientPoliciesTab(page);
+  });
+
+  test("Complete new client form and cancel", async ({ page }) => {
+    await goToClientPoliciesList(page);
+
+    await createNewClientPolicyFromEmptyState(page, "Test", "Test Description");
+    await assertNewClientPolicyForm(page);
+    await clickCancelClientPolicyCreation(page);
+    await assertEmptyTable(page);
+  });
+
+  test("Complete new client form and submit", async ({ page }) => {
+    await goToClientPoliciesList(page);
+
+    await createNewClientPolicyFromEmptyState(page, "New", "New Description");
+    await clickSaveClientPolicy(page);
+    await assertNotificationMessage(page, "New policy created");
+  });
+
+  test.describe("Editing client policy", () => {
+    test.beforeAll(() =>
+      adminClient.createClientPolicy("Test", "Test Description", realmName),
+    );
+
+    test.afterAll(() => adminClient.deleteClientPolicy("Test", realmName));
+    test.beforeEach(async ({ page }) => {
+      await goToClientPoliciesList(page);
+      await clickTableRowItem(page, "Test");
+    });
+
+    test("Should perform client profile search by profile name", async ({
+      page,
+    }) => {
+      await page.getByRole("link", { name: "Client policies" }).click();
+      await goToClientPoliciesList(page);
+      await searchItem(page, placeHolder, "Test");
+      await assertRowExists(page, "Test");
+    });
+
+    test("Should not have conditions configured by default", async ({
+      page,
+    }) => {
+      await shouldNotHaveConditionsConfigured(page);
+    });
+
+    test("Should cancel adding a new condition to a client profile", async ({
+      page,
+    }) => {
+      await clickAddCondition(page);
+      await shouldCancelAddingCondition(page);
+    });
+
+    test("Should add a new client-roles condition to a client profile", async ({
+      page,
+    }) => {
+      await clickAddCondition(page);
+      await addClientScopeCondition(page);
+      await clickSaveConditionButton(page);
+      await assertNotificationMessage(page, "Condition created successfully.");
+      await assertExists(page, "client-scopes-condition-link");
+    });
+
+    test("Should edit the client-roles condition of a client profile", async ({
+      page,
+    }) => {
+      const role = "manage-realm";
+      // Add a new client-roles condition
+      await clickAddCondition(page);
+      await addClientRolesCondition(page, role);
+      await clickSaveConditionButton(page);
+
+      // Edit the client-roles condition
+      await selectCondition(page, "client-roles");
+      await assertRoles(page, role);
+      await fillClientRolesCondition(page, "admin");
+      await clickSaveConditionButton(page);
+      await assertNotificationMessage(page, "Condition updated successfully.");
+    });
+
+    test("Should cancel deleting condition from a client profile", async ({
+      page,
+    }) => {
+      // Add a new condition
+      const condition = "client-updater-source-host";
+      const conditionLink = `${condition}-condition-link`;
+      await clickAddCondition(page);
+      await addClientUpdaterSourceHost(page);
+      await clickSaveConditionButton(page);
+
+      await deleteCondition(page, condition);
+      await assertModalTitle(page, "Delete condition?");
+      await assertModalMessage(
+        page,
+        `This action will permanently delete ${condition}. This cannot be undone.`,
+      );
+      await cancelModal(page);
+      await assertExists(page, conditionLink);
+
+      await deleteCondition(page, condition);
+      await confirmModal(page);
+      await assertExists(page, conditionLink, false);
+    });
+
+    test("Should not create duplicate client profile", async ({ page }) => {
+      await goBackToPolicies(page);
+      await goToClientPoliciesList(page);
+      await page.getByTestId("createPolicy").click();
+      await fillClientPolicyForm(page, "Test", "Test Again Description");
+      await assertFieldError(
+        page,
+        "name",
+        "The name must be unique within the realm",
+      );
+    });
+  });
+
+  test("Check reloading JSON policies", async ({ page }) => {
+    await shouldReloadJSONPolicies(page);
+  });
+
+  test.describe("Delete client policy", () => {
+    const testPolicy = "DeletablePolicy";
+    test.beforeEach(() =>
+      adminClient.createClientPolicy(testPolicy, "Test Description", realmName),
+    );
+    test.beforeEach(async ({ page }) => {
+      await goToClientPoliciesList(page);
+    });
+
+    test("Check deleting the client policy", async ({ page }) => {
+      await deleteClientPolicyItemFromTable(page, testPolicy);
+      await confirmModal(page);
+      await assertNotificationMessage(page, "Client policy deleted");
+      await assertRowExists(page, testPolicy, false);
+    });
+
+    test("Check deleting newly created client policy from create view via dropdown", async ({
+      page,
+    }) => {
+      await deleteClientPolicyFromDetails(page, testPolicy);
+      await confirmModal(page);
+      await assertNotificationMessage(page, "Client policy deleted");
+      await assertRowExists(page, testPolicy, false);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/client-policies.ts b/js/apps/admin-ui/test/realm-settings/client-policies.ts
new file mode 100644
index 000000000000..250537dc4c72
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/client-policies.ts
@@ -0,0 +1,174 @@
+import { Page, expect } from "@playwright/test";
+import { clickRowKebabItem } from "../utils/table";
+import { selectItem } from "../utils/form";
+
+export async function goToClientPoliciesTab(page: Page) {
+  await page.getByTestId("rs-clientPolicies-tab").click();
+}
+
+export async function goToClientPoliciesList(page: Page) {
+  await page.getByTestId("rs-policies-clientPolicies-tab").click();
+}
+
+export async function goBackToPolicies(page: Page) {
+  await page.getByRole("link", { name: "Client policies" }).click();
+}
+
+export async function checkDisplayPoliciesTab(page: Page) {
+  await expect(page.getByTestId("rs-client-policies-tab")).toBeVisible();
+}
+
+function getPolicyNameField(page: Page) {
+  return page.getByTestId("name");
+}
+
+function getPolicyDescriptionField(page: Page) {
+  return page.getByTestId("client-policy-description");
+}
+
+export async function fillClientPolicyForm(
+  page: Page,
+  name: string,
+  description: string,
+) {
+  await getPolicyNameField(page).fill(name);
+  await getPolicyDescriptionField(page).fill(description);
+}
+
+export async function createNewClientPolicyFromEmptyState(
+  page: Page,
+  name: string,
+  description: string,
+  cancel: boolean = false,
+) {
+  await page.getByTestId("no-client-policies-empty-action").click();
+  await fillClientPolicyForm(page, name, description);
+  if (cancel) {
+    await page.getByTestId("cancelCreatePolicy").click();
+  }
+}
+
+export async function clickSaveClientPolicy(page: Page) {
+  await page.getByTestId("saveCreatePolicy").click();
+}
+
+export async function checkNewClientPolicyForm(page: Page) {
+  await expect(getPolicyNameField(page)).toBeVisible();
+  await expect(getPolicyDescriptionField(page)).toBeVisible();
+}
+
+export async function clickCancelClientPolicyCreation(page: Page) {
+  await page.getByTestId("cancelCreatePolicy").click();
+}
+
+export async function searchClientPolicy(page: Page, name: string) {
+  await page.getByPlaceholder("Search by name").fill(name);
+  await page.keyboard.press("Enter");
+}
+
+export async function shouldNotHaveConditionsConfigured(page: Page) {
+  await expect(page.getByTestId("no-conditions")).toBeVisible();
+}
+
+export async function clickAddCondition(page: Page) {
+  await page.getByTestId("addCondition").click();
+}
+
+async function selectConditionType(page: Page, condition: string) {
+  await page.locator("#provider").click();
+  await page.getByTestId(condition).click();
+}
+
+export async function clickCancelConditionButton(page: Page) {
+  await page.getByTestId("addCondition-cancelBtn").click();
+}
+
+export async function shouldCancelAddingCondition(page: Page) {
+  await selectConditionType(page, "any-client");
+  await clickCancelConditionButton(page);
+}
+
+export async function clickSaveConditionButton(page: Page) {
+  await page.getByTestId("addCondition-saveBtn").click();
+}
+
+export async function selectCondition(page: Page, condition: string) {
+  await page.getByTestId(`${condition}-condition-link`).click();
+}
+
+export async function assertRoles(page: Page, role: string) {
+  await expect(page.getByTestId("config.roles0")).toHaveValue(role);
+}
+
+export async function addClientScopeCondition(
+  page: Page,
+  scope: string = "Optional",
+) {
+  await selectConditionType(page, "client-scopes");
+  await selectItem(page, "#type", scope);
+}
+
+export async function addClientUpdaterSourceHost(page: Page) {
+  await selectConditionType(page, "client-updater-source-host");
+}
+
+export async function addClientRolesCondition(page: Page, role: string) {
+  await selectConditionType(page, "client-roles");
+  await fillClientRolesCondition(page, role);
+}
+
+export async function fillClientRolesCondition(page: Page, role: string) {
+  await page.getByTestId("config.roles0").fill(role);
+}
+
+export async function assertExists(page: Page, row: string, exist = true) {
+  await expect(page.getByTestId(row)).toBeVisible({ visible: exist });
+}
+
+export async function shouldEditClientRolesCondition(page: Page) {
+  await page.getByTestId("edit-condition").click();
+  await page.getByTestId("client-roles").click();
+  await page.getByTestId("save").click();
+}
+
+export async function shouldEditClientScopesCondition(page: Page) {
+  await page.getByTestId("edit-condition").click();
+  await page.getByTestId("client-scopes").click();
+  await page.getByTestId("save").click();
+}
+
+export async function deleteCondition(page: Page, name: string) {
+  await page.getByTestId(`delete-${name}-condition`).click();
+}
+
+export async function checkConditionsListContains(
+  page: Page,
+  condition: string,
+) {
+  await expect(page.getByTestId("conditions-list")).toContainText(condition);
+}
+
+export async function shouldDeleteClientScopesCondition(page: Page) {
+  await page.getByTestId("delete-condition").click();
+  await page.getByTestId("confirm").click();
+}
+
+export async function deleteClientPolicyItemFromTable(
+  page: Page,
+  name: string,
+) {
+  await clickRowKebabItem(page, name, "Delete");
+}
+
+export async function checkElementInList(page: Page, name: string) {
+  await expect(page.getByRole("row", { name })).toBeVisible();
+}
+
+export async function deleteClientPolicyFromDetails(page: Page, name: string) {
+  await clickRowKebabItem(page, name, "Delete");
+}
+
+export async function shouldReloadJSONPolicies(page: Page) {
+  await page.getByTestId("jsonEditor-profilesView").click();
+  await page.getByTestId("jsonEditor-reloadBtn").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/client-profiles.spec.ts b/js/apps/admin-ui/test/realm-settings/client-profiles.spec.ts
new file mode 100644
index 000000000000..58d544635e05
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/client-profiles.spec.ts
@@ -0,0 +1,120 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import {
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertExecutorInList,
+  assertIntentClient,
+  cancelClientProfileCreation,
+  checkElementNotInList,
+  clickAddExecutor,
+  clickDeleteExecutor,
+  clickSaveClientProfile,
+  createClientProfile,
+  goToClientPoliciesTab,
+  goToClientProfilesList,
+  saveClientProfileCreation,
+  searchClientProfile,
+  searchNonExistingClientProfile,
+  selectExecutorType,
+} from "./client-profiles";
+import { clickTableRowItem } from "../utils/table";
+import { confirmModal } from "../utils/modal";
+
+test.describe("Realm settings client profiles tab tests", () => {
+  const profileName = "Test";
+  const realmName = `client-profiles-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToClientPoliciesTab(page);
+    await goToClientProfilesList(page);
+  });
+
+  test("Complete new client form and cancel", async ({ page }) => {
+    await createClientProfile(page, profileName, "Test Description");
+    await cancelClientProfileCreation(page);
+    await checkElementNotInList(page, profileName);
+  });
+
+  test("Complete new client form and submit", async ({ page }) => {
+    await createClientProfile(page, profileName, "Test Description");
+    await saveClientProfileCreation(page);
+    await assertNotificationMessage(page, "New client profile created");
+  });
+
+  test("Should perform client profile search by profile name", async ({
+    page,
+  }) => {
+    await searchClientProfile(page, "fapi-ciba");
+  });
+
+  test("Should search non-existent client profile", async ({ page }) => {
+    await searchNonExistingClientProfile(page, "nonExistentProfile");
+  });
+
+  test.describe("Edit client profile", () => {
+    const editedProfileName = "Edit";
+    test.beforeAll(() =>
+      adminClient.createClientProfile(
+        editedProfileName,
+        "Edit Description",
+        realmName,
+      ),
+    );
+
+    test.beforeEach(async ({ page }) => {
+      await clickTableRowItem(page, editedProfileName);
+    });
+
+    test("Should add executor to client profile", async ({ page }) => {
+      const executorType = "intent-client-bind-checker";
+      await clickAddExecutor(page);
+      await selectExecutorType(page, executorType);
+      await assertIntentClient(
+        page,
+        "https://rs.keycloak-fapi.org/check-intent-client-bound",
+      );
+
+      await clickSaveClientProfile(page);
+      await assertNotificationMessage(
+        page,
+        "Success! Executor created successfully",
+      );
+
+      await assertExecutorInList(page, executorType);
+    });
+
+    test("Should delete executor from a client profile", async ({ page }) => {
+      // Create a new executor
+      const executorType = "confidential-client";
+      await clickAddExecutor(page);
+      await selectExecutorType(page, executorType);
+      await clickSaveClientProfile(page);
+
+      // Delete the executor
+      await clickDeleteExecutor(page, executorType);
+      await assertNotificationMessage(
+        page,
+        "Success! The executor was deleted.",
+      );
+      await checkElementNotInList(page, executorType);
+    });
+
+    test("Check deleting the client profile", async ({ page }) => {
+      await selectActionToggleItem(page, "Delete this client profile");
+      await confirmModal(page);
+      await assertNotificationMessage(page, "Client profile deleted");
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/client-profiles.ts b/js/apps/admin-ui/test/realm-settings/client-profiles.ts
new file mode 100644
index 000000000000..d3db444d2219
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/client-profiles.ts
@@ -0,0 +1,79 @@
+import { Page, expect } from "@playwright/test";
+import { assertEmptyTable, assertRowExists, searchItem } from "../utils/table";
+import { confirmModal } from "../utils/modal";
+
+export async function goToClientPoliciesTab(page: Page) {
+  await page.getByTestId("rs-clientPolicies-tab").click();
+}
+
+export async function goToClientProfilesList(page: Page) {
+  await page.getByTestId("rs-policies-clientProfiles-tab").click();
+}
+
+export async function shouldDisplayProfilesTab(page: Page) {
+  await expect(page.getByTestId("createProfileBtn")).toBeVisible();
+  await expect(page.getByTestId("formViewSelect")).toBeVisible();
+  await expect(page.getByTestId("jsonEditorSelect")).toBeVisible();
+  await expect(page.locator("table")).toBeVisible();
+  await expect(page.locator("td")).toContainText("Global");
+}
+
+export async function createClientProfile(
+  page: Page,
+  name: string,
+  description: string,
+) {
+  await page.getByTestId("createProfile").click();
+  await page.getByTestId("name").fill(name);
+  await page.getByTestId("description").fill(description);
+}
+
+export async function saveClientProfileCreation(page: Page) {
+  await page.getByTestId("saveCreateProfile").click();
+}
+
+export async function cancelClientProfileCreation(page: Page) {
+  await page.getByTestId("cancelCreateProfile").click();
+}
+
+export async function searchClientProfile(page: Page, name: string) {
+  await searchItem(page, "Search", name);
+  await assertRowExists(page, name);
+}
+
+export async function checkElementNotInList(page: Page, name: string) {
+  await assertRowExists(page, name, false);
+}
+
+export async function searchNonExistingClientProfile(page: Page, name: string) {
+  await searchItem(page, "Search", name);
+  await assertEmptyTable(page);
+}
+
+export async function clickAddExecutor(page: Page) {
+  await page.getByTestId("addExecutor").click();
+}
+
+export async function selectExecutorType(page: Page, type: string) {
+  await page.locator("#kc-executor").click();
+  await page.getByTestId(type).click();
+}
+
+export async function assertIntentClient(page: Page, value: string) {
+  await expect(
+    page.getByTestId("intent-client-bind-check-endpoint"),
+  ).toHaveValue(value);
+}
+
+export async function clickSaveClientProfile(page: Page) {
+  await page.getByTestId("addExecutor-saveBtn").click();
+}
+
+export async function assertExecutorInList(page: Page, name: string) {
+  await expect(page.getByText(name)).toBeVisible();
+}
+
+export async function clickDeleteExecutor(page: Page, name: string) {
+  await page.getByTestId(`deleteExecutor-${name}`).click();
+  await confirmModal(page);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/email.spec.ts b/js/apps/admin-ui/test/realm-settings/email.spec.ts
new file mode 100644
index 000000000000..3ec63f9d0f4a
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/email.spec.ts
@@ -0,0 +1,53 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  clickSaveEmailButton,
+  goToEmailTab,
+  populateEmailPageNoAuth,
+  assertEmailPageNoAuth,
+  populateEmailPageWithPasswordAuth,
+  assertEmailPageWithPasswordAuth,
+  populateEmailPageWithTokenAuth,
+  assertEmailPageWithTokenAuth,
+} from "./email";
+
+test.describe("Email", () => {
+  const realmName = `email-realm-settings-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToEmailTab(page);
+  });
+
+  test("Add email data with no authentication", async ({ page }) => {
+    await populateEmailPageNoAuth(page);
+    await clickSaveEmailButton(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+    await goToRealmSettings(page);
+    await goToEmailTab(page);
+    await assertEmailPageNoAuth(page);
+
+    await populateEmailPageWithPasswordAuth(page);
+    await clickSaveEmailButton(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+    await goToRealmSettings(page);
+    await goToEmailTab(page);
+    await assertEmailPageWithPasswordAuth(page);
+
+    await populateEmailPageWithTokenAuth(page);
+    await clickSaveEmailButton(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+    await goToRealmSettings(page);
+    await goToEmailTab(page);
+    await assertEmailPageWithTokenAuth(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/email.ts b/js/apps/admin-ui/test/realm-settings/email.ts
new file mode 100644
index 000000000000..8c98c8a50537
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/email.ts
@@ -0,0 +1,149 @@
+import { Page, expect } from "@playwright/test";
+import { switchOn } from "../utils/form";
+
+export async function goToEmailTab(page: Page) {
+  await page.getByTestId("rs-email-tab").click();
+}
+
+export async function populateEmailPageNoAuth(page: Page) {
+  await getFrom(page).fill("test@local.local");
+  await getFromDisplayName(page).fill("Tester");
+  await getReplyTo(page).fill("replyto-test@local.local");
+  await getReplyToDisplayName(page).fill("ReplyTo Tester");
+  await getEnvelopeFrom(page).fill("envelope-test@local.local");
+
+  await getHost(page).fill("host.smtp.local");
+  await getPort(page).fill("123");
+
+  await getEnableSSL(page).check();
+  await getEnableStartTLS(page).check();
+
+  await getDebug(page).check();
+}
+
+export async function assertEmailPageNoAuth(page: Page) {
+  await expect(getFrom(page)).toHaveValue("test@local.local");
+
+  await expect(getFromDisplayName(page)).toHaveValue("Tester");
+  await expect(getReplyTo(page)).toHaveValue("replyto-test@local.local");
+  await expect(getReplyToDisplayName(page)).toHaveValue("ReplyTo Tester");
+  await expect(getEnvelopeFrom(page)).toHaveValue("envelope-test@local.local");
+
+  await expect(getHost(page)).toHaveValue("host.smtp.local");
+  await expect(getPort(page)).toHaveValue("123");
+
+  await expect(getEnableSSL(page)).toBeChecked();
+  await expect(getEnableStartTLS(page)).toBeChecked();
+
+  await expect(getDebug(page)).toBeChecked();
+}
+
+export async function populateEmailPageWithPasswordAuth(page: Page) {
+  await switchOn(page, getAuth(page));
+  await getUser(page).fill("user");
+  await getAuthTypeBasic(page).check();
+  await getPassword(page).fill("password");
+}
+
+export async function assertEmailPageWithPasswordAuth(page: Page) {
+  await expect(getAuth(page)).toBeChecked();
+  await expect(getUser(page)).toHaveValue("user");
+  await expect(getAuthTypeBasic(page)).toBeChecked();
+  await expect(getPassword(page)).toHaveValue("**********");
+}
+
+export async function populateEmailPageWithTokenAuth(page: Page) {
+  await getAuthTypeToken(page).check();
+  await getAuthTokenUrl(page).fill("https://auth.token.url");
+  await getAuthTokenScope(page).fill("scope");
+  await getAuthTokenClientId(page).fill("client-id");
+  await getAuthTokenClientSecret(page).fill("client-secret");
+}
+
+export async function assertEmailPageWithTokenAuth(page: Page) {
+  await expect(getAuthTypeToken(page)).toBeChecked();
+  await expect(getAuthTokenUrl(page)).toHaveValue("https://auth.token.url");
+  await expect(getAuthTokenScope(page)).toHaveValue("scope");
+  await expect(getAuthTokenClientId(page)).toHaveValue("client-id");
+  await expect(getAuthTokenClientSecret(page)).toHaveValue("**********");
+}
+
+function getFrom(page: Page) {
+  return page.getByTestId("smtpServer.from");
+}
+
+function getFromDisplayName(page: Page) {
+  return page.getByTestId("smtpServer.fromDisplayName");
+}
+
+function getReplyTo(page: Page) {
+  return page.getByTestId("smtpServer.replyTo");
+}
+
+function getReplyToDisplayName(page: Page) {
+  return page.getByTestId("smtpServer.replyToDisplayName");
+}
+
+function getEnvelopeFrom(page: Page) {
+  return page.getByTestId("smtpServer.envelopeFrom");
+}
+
+function getHost(page: Page) {
+  return page.getByTestId("smtpServer.host");
+}
+
+function getPort(page: Page) {
+  return page.getByTestId("smtpServer.port");
+}
+
+function getEnableSSL(page: Page) {
+  return page.getByTestId("enable-ssl");
+}
+
+function getEnableStartTLS(page: Page) {
+  return page.getByTestId("enable-start-tls");
+}
+
+function getAuth(page: Page) {
+  return page.getByTestId("smtpServer.auth");
+}
+
+function getUser(page: Page) {
+  return page.getByTestId("smtpServer.user");
+}
+
+function getAuthTypeBasic(page: Page) {
+  return page.getByTestId("smtpServer.authType.basic");
+}
+
+function getAuthTypeToken(page: Page) {
+  return page.getByTestId("smtpServer.authType.token");
+}
+
+function getPassword(page: Page) {
+  return page.getByTestId("smtpServer.password");
+}
+
+function getAuthTokenUrl(page: Page) {
+  return page.getByTestId("smtpServer.authTokenUrl");
+}
+
+function getAuthTokenScope(page: Page) {
+  return page.getByTestId("smtpServer.authTokenScope");
+}
+
+function getAuthTokenClientId(page: Page) {
+  return page.getByTestId("smtpServer.authTokenClientId");
+}
+
+function getAuthTokenClientSecret(page: Page) {
+  return page.getByTestId("smtpServer.authTokenClientSecret");
+}
+
+function getDebug(page: Page) {
+  return page.getByTestId("enable-debug");
+}
+
+export async function clickSaveEmailButton(page: Page) {
+  await page.getByTestId("email-tab-save").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/events.spec.ts b/js/apps/admin-ui/test/realm-settings/events.spec.ts
new file mode 100644
index 000000000000..5f32d6cc08e9
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/events.spec.ts
@@ -0,0 +1,75 @@
+import { test } from "@playwright/test";
+import adminClient from "../utils/AdminClient";
+import { switchOn } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { assertModalMessage, confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import { assertRowExists, searchItem } from "../utils/table";
+import {
+  addSavedEventTypes,
+  clickClearEvents,
+  clickRemoveListener,
+  clickSaveEventsConfig,
+  clickSaveEventsListener,
+  fillEventListener,
+  goToEventsTab,
+  goToRealmEventsTab,
+} from "./events";
+
+test.describe("Realm settings events tab tests", () => {
+  const realmName = `events-realm-settings-${crypto.randomUUID()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToRealmEventsTab(page);
+  });
+
+  test("Enable user events", async ({ page }) => {
+    await goToEventsTab(page);
+
+    await switchOn(page, "[data-testid='eventsEnabled']");
+    await clickSaveEventsConfig(page);
+    await assertNotificationMessage(page, "Successfully saved configuration");
+
+    await clickClearEvents(page);
+    await assertModalMessage(
+      page,
+      "If you clear all events of this realm, all records will be permanently cleared in the database",
+    );
+    await confirmModal(page);
+    await assertNotificationMessage(page, "The user events have been cleared");
+
+    const eventTypes = ["Identity provider response", "Client info error"];
+    await addSavedEventTypes(page, eventTypes);
+
+    await assertNotificationMessage(page, "Successfully saved configuration");
+
+    for (const event of eventTypes) {
+      await searchItem(page, "Search saved event type", event);
+      await assertRowExists(page, event);
+    }
+  });
+
+  test("Should revert saving event listener", async ({ page }) => {
+    await fillEventListener(page, "email");
+    await page.getByTestId("revertEventListenerBtn").click();
+  });
+
+  test("Should save event listener", async ({ page }) => {
+    await fillEventListener(page, "email");
+    await clickSaveEventsListener(page);
+    await assertNotificationMessage(page, "Event listener has been updated.");
+  });
+
+  test("Should remove event from event listener", async ({ page }) => {
+    await clickRemoveListener(page, "jboss-logging");
+    await clickSaveEventsListener(page);
+    await assertNotificationMessage(page, "Event listener has been updated.");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/events.ts b/js/apps/admin-ui/test/realm-settings/events.ts
new file mode 100644
index 000000000000..71bf822b789b
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/events.ts
@@ -0,0 +1,46 @@
+import { Page } from "@playwright/test";
+import { clickSelectRow } from "../utils/table";
+
+export async function goToRealmEventsTab(page: Page) {
+  await page.getByTestId("rs-realm-events-tab").click();
+}
+
+export async function goToEventsTab(page: Page) {
+  await page.getByTestId("rs-events-tab").click();
+}
+
+export async function clickSaveEventsConfig(page: Page) {
+  await page.getByTestId("save-user").click();
+}
+
+export async function clickClearEvents(page: Page) {
+  await page.getByTestId("clear-user-events").click();
+}
+
+export async function addSavedEventTypes(page: Page, eventTypes: string[]) {
+  await page.getByTestId("addTypes").click();
+  for (const eventType of eventTypes) {
+    await clickSelectRow(page, "Add types", eventType);
+  }
+  await page.getByTestId("addEventTypeConfirm").click();
+}
+
+export async function fillEventListener(page: Page, listener: string) {
+  const eventListener = page.getByRole("combobox", { name: "Type to filter" });
+  await eventListener.click();
+  await eventListener.fill(listener);
+  await page.getByRole("option", { name: listener }).click();
+  await page.keyboard.press("Escape");
+}
+
+export async function clickRevertButton(page: Page) {
+  await page.getByTestId("revertEventListenerBtn").click();
+}
+
+export async function clickSaveEventsListener(page: Page) {
+  await page.getByTestId("saveEventListenerBtn").click();
+}
+
+export async function clickRemoveListener(page: Page, listener: string) {
+  await page.getByRole("button", { name: `close ${listener}` }).click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/export.spec.ts b/js/apps/admin-ui/test/realm-settings/export.spec.ts
new file mode 100644
index 000000000000..a971b1f0b32b
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/export.spec.ts
@@ -0,0 +1,59 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { selectActionToggleItem } from "../utils/masthead";
+import { cancelModal, confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertDialogClosed,
+  assertWarningMessage,
+  toggleIncludeClients,
+  toggleIncludeGroupsAndRoles,
+} from "./export";
+
+test.describe("Partial realm export", () => {
+  const REALM_NAME = `partial-export-test-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(REALM_NAME);
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealm(REALM_NAME);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, REALM_NAME);
+    await goToRealmSettings(page);
+    await selectActionToggleItem(page, "Partial export");
+  });
+
+  test("Closes the dialog", async ({ page }) => {
+    await cancelModal(page);
+    await assertDialogClosed(page);
+  });
+
+  test("Shows a warning message", async ({ page }) => {
+    await assertWarningMessage(page);
+
+    await toggleIncludeGroupsAndRoles(page);
+    await assertWarningMessage(page, true);
+    await toggleIncludeGroupsAndRoles(page, false);
+
+    await toggleIncludeClients(page);
+    await assertWarningMessage(page, true);
+    await toggleIncludeClients(page, false);
+    await assertWarningMessage(page);
+  });
+
+  test("Exports the realm", async ({ page }) => {
+    await toggleIncludeGroupsAndRoles(page);
+    await toggleIncludeClients(page);
+    await confirmModal(page);
+
+    const download = await page.waitForEvent("download");
+    expect(download.suggestedFilename()).toBeDefined();
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/export.ts b/js/apps/admin-ui/test/realm-settings/export.ts
new file mode 100644
index 000000000000..622437158eff
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/export.ts
@@ -0,0 +1,38 @@
+import { Page, expect } from "@playwright/test";
+import { switchOff, switchOn } from "../utils/form";
+
+export async function assertDialogClosed(page: Page) {
+  await expect(page.getByTestId("confirm")).not.toBeVisible();
+}
+
+export async function assertWarningMessage(page: Page, toBeVisible = false) {
+  if (toBeVisible) {
+    await expect(page.getByTestId("warning-message")).toBeVisible();
+  } else {
+    await expect(page.getByTestId("warning-message")).not.toBeVisible();
+  }
+}
+
+function getIncludeGroupsAndRoles() {
+  return "[data-testid='include-groups-and-roles-check']";
+}
+
+export async function toggleIncludeGroupsAndRoles(page: Page, on = true) {
+  if (on) {
+    await switchOn(page, getIncludeGroupsAndRoles());
+  } else {
+    await switchOff(page, getIncludeGroupsAndRoles());
+  }
+}
+
+function getIncludeClients() {
+  return "[data-testid='include-clients-check']";
+}
+
+export async function toggleIncludeClients(page: Page, on = true) {
+  if (on) {
+    await switchOn(page, getIncludeClients());
+  } else {
+    await switchOff(page, getIncludeClients());
+  }
+}
diff --git a/js/apps/admin-ui/test/realm-settings/general.spec.ts b/js/apps/admin-ui/test/realm-settings/general.spec.ts
new file mode 100644
index 000000000000..6a0a1e288ba8
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/general.spec.ts
@@ -0,0 +1,123 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { switchOff, switchOn } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToClients, goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertDisplayName,
+  assertFrontendURL,
+  assertRequireSSL,
+  clickRevertButton,
+  clickSaveRealm,
+  fillDisplayName,
+  fillFrontendURL,
+  fillRequireSSL,
+} from "./general";
+import { SERVER_URL } from "../utils/constants";
+
+test.describe("Realm settings general tab tests", () => {
+  const realmName = `general-realm-settings-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+  });
+
+  test("Check Access Endpoints OpenID Endpoint Configuration link", async ({
+    page,
+  }) => {
+    const locator = page.getByRole("link", {
+      name: "OpenID Endpoint Configuration",
+    });
+
+    await expect(locator).toHaveAttribute(
+      "href",
+      `${SERVER_URL}/realms/${realmName}/.well-known/openid-configuration`,
+    );
+    await expect(locator).toHaveAttribute("target", "_blank");
+    await expect(locator).toHaveAttribute("rel", "noreferrer noopener");
+
+    const link = await page
+      .getByRole("link", { name: "OpenID Endpoint Configuration" })
+      .getAttribute("href");
+    const response = await page.request.get(link!);
+    expect(response.status()).toBe(200);
+  });
+
+  test("all general tab switches", async ({ page }) => {
+    await switchOn(page, "#userManagedAccessAllowed");
+    await clickSaveRealm(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await switchOff(page, "#userManagedAccessAllowed");
+    await clickSaveRealm(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+  });
+
+  test("realm enable/disable switch", async ({ page }) => {
+    // Enable realm
+    await switchOn(page, `#${realmName}-switch`);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    // Disable realm
+    await switchOff(page, `#${realmName}-switch`);
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+  });
+
+  test("Fail to set Realm ID to empty", async ({ page }) => {
+    await page.getByRole("textbox", { name: "Copyable input" }).fill("");
+    await clickSaveRealm(page);
+    await expect(page.getByText("Required field")).toBeVisible();
+  });
+
+  test("Modify Display name", async ({ page }) => {
+    const name = "display_name";
+    await fillDisplayName(page, name);
+    await clickSaveRealm(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+    await goToClients(page);
+    await goToRealmSettings(page);
+    await assertDisplayName(page, name);
+  });
+
+  test("Modify front end URL", async ({ page }) => {
+    const frontendUrl = "www.example.com";
+    await goToRealmSettings(page);
+    await fillFrontendURL(page, frontendUrl);
+
+    await clickSaveRealm(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await goToClients(page);
+    await goToRealmSettings(page);
+    await assertFrontendURL(page, frontendUrl);
+  });
+
+  test("Select SSL all requests", async ({ page }) => {
+    await goToRealmSettings(page);
+    await fillRequireSSL(page, "All requests");
+    await clickSaveRealm(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await goToClients(page);
+    await goToRealmSettings(page);
+    await assertRequireSSL(page, "All requests");
+  });
+
+  test("Verify 'Revert' button works", async ({ page }) => {
+    await fillDisplayName(page, "display_name");
+    await clickSaveRealm(page);
+
+    await fillDisplayName(page, "should_be_reverted");
+    await clickRevertButton(page);
+    await assertDisplayName(page, "display_name");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/general.ts b/js/apps/admin-ui/test/realm-settings/general.ts
new file mode 100644
index 000000000000..6d9c64c16353
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/general.ts
@@ -0,0 +1,42 @@
+import { Page, expect } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+export async function clickSaveRealm(page: Page) {
+  await page.getByTestId("realmSettingsGeneralTab-save").click();
+}
+
+function getDisplayName(page: Page) {
+  return page.getByTestId("displayName");
+}
+
+export async function fillDisplayName(page: Page, value: string) {
+  await getDisplayName(page).fill(value);
+}
+
+export async function assertDisplayName(page: Page, value: string) {
+  await expect(getDisplayName(page)).toHaveValue(value);
+}
+
+function getFrontendURL(page: Page) {
+  return page.getByTestId("attributes.frontendUrl");
+}
+
+export async function fillFrontendURL(page: Page, value: string) {
+  await getFrontendURL(page).fill(value);
+}
+
+export async function assertFrontendURL(page: Page, value: string) {
+  await expect(getFrontendURL(page)).toHaveValue(value);
+}
+
+export async function fillRequireSSL(page: Page, value: string) {
+  await selectItem(page, "#sslRequired", value);
+}
+
+export async function assertRequireSSL(page: Page, value: string) {
+  await expect(page.locator("#sslRequired")).toHaveText(value);
+}
+
+export async function clickRevertButton(page: Page) {
+  await page.getByTestId("realmSettingsGeneralTab-revert").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/i18n.spec.ts b/js/apps/admin-ui/test/realm-settings/i18n.spec.ts
new file mode 100644
index 000000000000..2a790976101c
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/i18n.spec.ts
@@ -0,0 +1,135 @@
+import { Page, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { goToUserFederation } from "../utils/sidebar";
+import { assertProviderCardText, assertRealmSettingsText } from "./i18n";
+
+// Test configuration
+const testConfig = {
+  userId: "",
+  username: "user_i18n_test",
+  password: "user_i18n_test",
+  supportedLocales: ["en", "de", "de-CH", "fo"],
+  realmName: `realm-i18n-${uuid()}`,
+};
+
+async function setupRealm() {
+  const realmName = testConfig.realmName;
+  await adminClient.createRealm(realmName, {
+    supportedLocales: ["en", "de", "de-CH", "fo"],
+    internationalizationEnabled: true,
+    enabled: true,
+  });
+}
+
+async function createUser() {
+  const username = testConfig.username;
+  const { id } = await adminClient.createUser({
+    realm: testConfig.realmName,
+    username,
+    enabled: true,
+    credentials: [{ type: "password", temporary: false, value: username }],
+    email: "user_i18n_test@example.com",
+    firstName: "User",
+    lastName: "I18n",
+  });
+  testConfig.userId = id!;
+
+  await adminClient.addClientRoleToUser(
+    id!,
+    "realm-management",
+    ["realm-admin"],
+    testConfig.realmName,
+  );
+}
+
+async function updateUserLocale(locale: string) {
+  await adminClient.updateUser(testConfig.userId, {
+    attributes: { locale: locale },
+    realm: testConfig.realmName,
+  });
+}
+
+async function goToPage(page: Page, locale: string) {
+  await updateUserLocale(locale);
+  await login(
+    page,
+    testConfig.username,
+    testConfig.password,
+    testConfig.realmName,
+  );
+  await goToUserFederation(page);
+}
+
+async function addLocalization(locale: string, key: string, value: string) {
+  return adminClient.addLocalizationText(
+    locale,
+    key,
+    value,
+    testConfig.realmName,
+  );
+}
+
+test.describe("i18n tests", () => {
+  // Constants for test assertions
+  const texts = {
+    realmLocalizationEn: "realmSettings en",
+    themeLocalizationEn: "Realm settings",
+    realmLocalizationDe: "realmSettings de",
+    themeLocalizationDe: "Realm-Einstellungen",
+    realmLocalizationDeCh: "realmSettings de-CH",
+  };
+
+  test.beforeAll(async () => {
+    await setupRealm();
+    await createUser();
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(testConfig.realmName));
+
+  test.afterEach(async () => {
+    await adminClient.removeAllLocalizationTexts();
+  });
+
+  test("should use THEME localization for fallback when no realm localization exists", async ({
+    page,
+  }) => {
+    await goToPage(page, "fo");
+    await assertRealmSettingsText(page, texts.themeLocalizationEn);
+  });
+
+  test("should use THEME localization for language with existing theme localization", async ({
+    page,
+  }) => {
+    await goToPage(page, "de");
+    await assertRealmSettingsText(page, texts.themeLocalizationDe);
+  });
+
+  test("should use REALM localization for language when available", async ({
+    page,
+  }) => {
+    await addLocalization("de", "realmSettings", texts.realmLocalizationDe);
+    await goToPage(page, "de");
+    await assertRealmSettingsText(page, texts.realmLocalizationDe);
+  });
+
+  test("should apply plurals and interpolation for THEME localization", async ({
+    page,
+  }) => {
+    await goToPage(page, "en");
+    await assertProviderCardText(page, "ldap", "Add Ldap providers");
+  });
+
+  test("should apply plurals and interpolation for REALM localization", async ({
+    page,
+  }) => {
+    await addLocalization(
+      "en",
+      "addProvider_other",
+      "addProvider_other en: {{provider}}",
+    );
+    await goToPage(page, "en");
+    await assertProviderCardText(page, "ldap", "addProvider_other en: Ldap");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/i18n.ts b/js/apps/admin-ui/test/realm-settings/i18n.ts
new file mode 100644
index 000000000000..d6e33b013e2b
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/i18n.ts
@@ -0,0 +1,18 @@
+import { expect, Page } from "@playwright/test";
+
+export async function assertRealmSettingsText(
+  page: Page,
+  expectedText: string,
+) {
+  const element = page.locator("#nav-item-realm-settings");
+  await expect(element).toContainText(expectedText);
+}
+
+export async function assertProviderCardText(
+  page: Page,
+  provider: string,
+  expectedText: string,
+) {
+  const card = page.locator(`[data-testid="${provider}-card"]`);
+  await expect(card).toContainText(expectedText);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/import.spec.ts b/js/apps/admin-ui/test/realm-settings/import.spec.ts
new file mode 100644
index 000000000000..1b6797f47e55
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/import.spec.ts
@@ -0,0 +1,136 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { chooseFile } from "../utils/file-chooser";
+import { selectItem } from "../utils/form";
+import { login } from "../utils/login";
+import { selectActionToggleItem } from "../utils/masthead";
+import { cancelModal, confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertClearButtonDisabled,
+  assertClientVisible,
+  assertGroupVisible,
+  assertImportButtonDisabled,
+  assertResultTable,
+  assertTextAreaToHaveText,
+  assertTextContent,
+  assertUserVisible,
+  clickClearButton,
+  clickClearConfirmButton,
+  closeModal,
+  fillTextarea,
+  toggleClients,
+  toggleGroups,
+  toggleUsers,
+} from "./import";
+
+test.describe("Partial import test", () => {
+  const testRealm = `Partial-import-${uuid()}`;
+  const testRealm2 = `Partial-import-2-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(testRealm);
+    await adminClient.createRealm(testRealm2);
+  });
+
+  test.afterAll(async () => {
+    await adminClient.deleteRealm(testRealm);
+    await adminClient.deleteRealm(testRealm2);
+  });
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, testRealm);
+    await goToRealmSettings(page);
+    await selectActionToggleItem(page, "Partial import");
+  });
+
+  test("Opens and closes partial import dialog", async ({ page }) => {
+    await expect(page.getByTestId("confirm")).toBeDisabled();
+    await cancelModal(page);
+    await expect(page.getByTestId("confirm")).not.toBeVisible();
+  });
+
+  test("Import button only enabled if JSON has something to import", async ({
+    page,
+  }) => {
+    await fillTextarea(page, "{}");
+    await assertImportButtonDisabled(page);
+    await cancelModal(page);
+  });
+
+  test("Displays user options after multi-realm import", async ({ page }) => {
+    await chooseFile(page, "../utils/files/multi-realm.json");
+
+    await assertImportButtonDisabled(page);
+
+    await toggleUsers(page);
+    await assertImportButtonDisabled(page, false);
+
+    await toggleGroups(page);
+    await assertImportButtonDisabled(page, false);
+
+    await toggleGroups(page, false);
+    await toggleUsers(page, false);
+    await assertImportButtonDisabled(page);
+
+    await assertTextContent(page, "1 Users");
+    await assertTextContent(page, "1 Groups");
+    await assertTextContent(page, "1 Clients");
+    await assertTextContent(page, "1 Identity providers");
+    await assertTextContent(page, "2 Realm roles");
+    await assertTextContent(page, "1 Client roles");
+
+    await toggleGroups(page);
+    await selectItem(page, page.locator("#realm-selector"), "realm2");
+    await assertImportButtonDisabled(page);
+
+    await assertTextContent(page, "2 Clients");
+
+    await toggleClients(page);
+    await assertImportButtonDisabled(page, false);
+    await confirmModal(page);
+
+    await assertTextContent(page, "2 records added");
+    await assertResultTable(page, "customer-portal");
+    await assertResultTable(page, "customer-portal2");
+    await closeModal(page);
+  });
+
+  test("Displays user options after realm-less import and does the import", async ({
+    page,
+  }) => {
+    await cancelModal(page);
+    await goToRealm(page, testRealm2);
+    await goToRealmSettings(page);
+    await selectActionToggleItem(page, "Partial import");
+
+    await chooseFile(page, "../utils/files/client-only.json");
+
+    await expect(page.locator("select")).not.toBeVisible();
+
+    await assertTextContent(page, "1 Clients");
+
+    await assertClientVisible(page);
+    await assertUserVisible(page, false);
+    await assertGroupVisible(page, false);
+
+    await toggleClients(page);
+    await confirmModal(page);
+
+    await assertTextContent(page, "One record added");
+    await assertResultTable(page, "customer-portal3");
+  });
+
+  test("Should clear the input with the button", async ({ page }) => {
+    await assertClearButtonDisabled(page);
+    await assertTextAreaToHaveText(page, "");
+    await fillTextarea(page, "{}");
+    await assertTextAreaToHaveText(page, "{}");
+    await assertClearButtonDisabled(page, false);
+    await clickClearButton(page);
+    await clickClearConfirmButton(page);
+    await assertTextAreaToHaveText(page, "");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/import.ts b/js/apps/admin-ui/test/realm-settings/import.ts
new file mode 100644
index 000000000000..29c5ab868f9c
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/import.ts
@@ -0,0 +1,108 @@
+import { Locator, Page, expect } from "@playwright/test";
+import { switchOff, switchOn } from "../utils/form";
+
+export async function assertImportButtonDisabled(page: Page, disabled = true) {
+  if (disabled) {
+    await expect(page.getByTestId("confirm")).toBeDisabled();
+  } else {
+    await expect(page.getByTestId("confirm")).not.toBeDisabled();
+  }
+}
+
+function getUsers(page: Page) {
+  return page.getByTestId("users-checkbox");
+}
+
+export async function toggleUsers(page: Page, on = true) {
+  if (on) {
+    await switchOn(page, getUsers(page));
+  } else {
+    await switchOff(page, getUsers(page));
+  }
+}
+
+function getGroups(page: Page) {
+  return page.getByTestId("groups-checkbox");
+}
+
+export async function toggleGroups(page: Page, on = true) {
+  if (on) {
+    await switchOn(page, getGroups(page));
+  } else {
+    await switchOff(page, getGroups(page));
+  }
+}
+
+function getClients(page: Page) {
+  return page.getByTestId("clients-checkbox");
+}
+
+export async function toggleClients(page: Page, on = true) {
+  if (on) {
+    await switchOn(page, getClients(page));
+  } else {
+    await switchOff(page, getClients(page));
+  }
+}
+
+function assertVisible(page: Page, locator: Locator, visible = true) {
+  return expect(locator).toBeVisible({ visible });
+}
+
+export async function assertClientVisible(page: Page, visible = true) {
+  await assertVisible(page, getClients(page), visible);
+}
+
+export async function assertUserVisible(page: Page, visible = true) {
+  await assertVisible(page, getUsers(page), visible);
+}
+
+export async function assertGroupVisible(page: Page, visible = true) {
+  await assertVisible(page, getGroups(page), visible);
+}
+
+export async function assertTextContent(page: Page, text: string) {
+  await expect(page.locator(`text=${text}`)).toBeVisible();
+}
+
+export async function assertResultTable(page: Page, text: string) {
+  await expect(
+    page.getByRole("gridcell", { name: text, exact: true }),
+  ).toBeVisible();
+}
+
+export async function closeModal(page: Page) {
+  await page.getByTestId("close-button").click();
+}
+
+function getClearButton(page: Page) {
+  return page.locator("button").filter({ hasText: /^Clear$/ });
+}
+
+export async function clickClearButton(page: Page) {
+  await getClearButton(page).click();
+}
+
+export async function clickClearConfirmButton(page: Page) {
+  await page.getByTestId("clear-button").click();
+}
+
+export async function assertClearButtonDisabled(page: Page, disabled = true) {
+  if (disabled) {
+    await expect(getClearButton(page)).toBeDisabled();
+  } else {
+    await expect(getClearButton(page)).not.toBeDisabled();
+  }
+}
+
+function getTextArea(page: Page) {
+  return page.getByRole("textbox", { name: "File content" });
+}
+
+export async function fillTextarea(page: Page, text: string) {
+  await getTextArea(page).fill(text);
+}
+
+export async function assertTextAreaToHaveText(page: Page, text: string) {
+  await expect(getTextArea(page)).toHaveText(text);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/keys.spec.ts b/js/apps/admin-ui/test/realm-settings/keys.spec.ts
new file mode 100644
index 000000000000..3672456848f2
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/keys.spec.ts
@@ -0,0 +1,117 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { switchToggle } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import { assertRowExists, clickRowKebabItem, searchItem } from "../utils/table";
+import {
+  assertPriority,
+  goToAddProviders,
+  goToDetails,
+  goToKeys,
+  switchToFilter,
+} from "./keys";
+
+test.describe("Realm Settings - Keys", () => {
+  const realmName = `events-realm-settings-${uuid()}`;
+  const searchPlaceholder = "Search key";
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToKeys(page);
+  });
+
+  test("Add Providers", async ({ page }) => {
+    await goToAddProviders(page);
+    const providers = [
+      { option: "option-aes-generated", name: "test_aes-generated" },
+      {
+        option: "option-ecdsa-generated",
+        name: "test_ecdsa-generated",
+        switches: ["active", "ecGenerateCertificate"],
+      },
+      { option: "option-rsa-generated", name: "test_rsa-generated" },
+      { option: "option-rsa-enc-generated", name: "test_rsa-enc-generated" },
+    ];
+
+    for (const provider of providers) {
+      await page.getByTestId("addProviderDropdown").click();
+      await page.getByTestId(provider.option).click();
+      await page.getByTestId("name").fill(provider.name);
+      if (provider.switches) {
+        for (const switchId of provider.switches) {
+          await switchToggle(page, `#${switchId}`);
+        }
+      }
+      await page.getByTestId("add-provider-button").click();
+    }
+  });
+
+  test("Search providers", async ({ page }) => {
+    await goToAddProviders(page);
+    await searchItem(page, "Search", "hmac");
+    await assertRowExists(page, "hmac-generated");
+  });
+
+  test("Go to details", async ({ page }) => {
+    await goToAddProviders(page);
+    await goToDetails(page, "hmac-generated");
+    await assertPriority(page, "100");
+  });
+
+  test("Should search active keys", async ({ page }) => {
+    await switchToFilter(page);
+    await searchItem(page, searchPlaceholder, "hmac");
+    await assertRowExists(page, "hmac-generated-hs512");
+  });
+
+  test("Should search passive keys", async ({ page }) => {
+    const name = "some-key";
+    await adminClient.addKeyProvider(
+      name,
+      false,
+      true,
+      "ecdh-generated",
+      realmName,
+    );
+    await goToRealmSettings(page);
+    await goToKeys(page);
+    await switchToFilter(page, "Passive keys");
+    await searchItem(page, searchPlaceholder, "ENC");
+    await assertRowExists(page, name);
+  });
+
+  test("Should search disabled keys", async ({ page }) => {
+    const name = "disabled-key";
+    await adminClient.addKeyProvider(
+      name,
+      true,
+      false,
+      "ecdh-generated",
+      realmName,
+    );
+    await goToRealmSettings(page);
+    await goToKeys(page);
+    await switchToFilter(page, "Disabled keys");
+    await searchItem(page, searchPlaceholder, "dis");
+    await assertRowExists(page, name);
+  });
+
+  test("Delete provider", async ({ page }) => {
+    await goToAddProviders(page);
+    await clickRowKebabItem(page, "hmac-generated-hs512", "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(
+      page,
+      "Success. The provider has been deleted.",
+    );
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/keys.ts b/js/apps/admin-ui/test/realm-settings/keys.ts
new file mode 100644
index 000000000000..e9e8b1cc0cd2
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/keys.ts
@@ -0,0 +1,23 @@
+import { Page, expect } from "@playwright/test";
+import { clickTableRowItem } from "../utils/table";
+import { selectItem } from "../utils/form";
+
+export async function goToKeys(page: Page) {
+  await page.getByTestId("rs-keys-tab").click();
+}
+
+export async function goToAddProviders(page: Page) {
+  await page.getByTestId("rs-providers-tab").click();
+}
+
+export async function goToDetails(page: Page, providerName: string) {
+  await clickTableRowItem(page, providerName);
+}
+
+export async function assertPriority(page: Page, priority: string) {
+  await expect(page.getByTestId("priority")).toHaveValue(priority);
+}
+
+export async function switchToFilter(page: Page, filter = "Active keys") {
+  await selectItem(page, page.getByTestId("keysListinput"), filter);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/localization.spec.ts b/js/apps/admin-ui/test/realm-settings/localization.spec.ts
new file mode 100644
index 000000000000..c83df969c5f4
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/localization.spec.ts
@@ -0,0 +1,104 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import { assertRowExists, clickRowKebabItem, searchItem } from "../utils/table";
+import {
+  addBundle,
+  clickConfirmEditButton,
+  clickCreateButton,
+  clicksSaveLocalization,
+  editBundle,
+  goToLocalizationTab,
+  goToRealmOverridesSubTab,
+  selectLocale,
+  switchInternationalization,
+} from "./localization";
+
+test.describe("Go to localization tab", () => {
+  const realmName = `localization-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToLocalizationTab(page);
+  });
+
+  test("Locales tab - Add locale", async ({ page }) => {
+    await switchInternationalization(page);
+    await selectLocale(page, "Danish");
+
+    await clicksSaveLocalization(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+  });
+
+  test.describe("Locales tab - CRUD bundle", () => {
+    test.beforeAll(() =>
+      adminClient.updateRealm(realmName, { internationalizationEnabled: true }),
+    );
+
+    test.beforeEach(async ({ page }) => {
+      await goToRealmOverridesSubTab(page);
+    });
+
+    test("Realm Overrides - Add and delete bundle", async ({ page }) => {
+      await addBundle(page, "key", "123");
+      await clickCreateButton(page);
+      await addBundle(page, "value", "abc");
+      await clickCreateButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "Success! The translation has been added.",
+      );
+
+      await assertRowExists(page, "key");
+      await clickRowKebabItem(page, "key", "Delete");
+      await confirmModal(page);
+      await assertNotificationMessage(
+        page,
+        "Successfully removed translation(s).",
+      );
+    });
+
+    test("Realm Overrides - Search for and delete bundle", async ({ page }) => {
+      await addBundle(page, "search", "321");
+      await clickCreateButton(page);
+
+      await searchItem(page, "Search for translation", "321");
+      await assertRowExists(page, "search");
+
+      await searchItem(page, "Search for translation", "not-found");
+      await assertRowExists(page, "not-found", false);
+    });
+
+    test("Realm Overrides - Edit and cancel edit message bundle", async ({
+      page,
+    }) => {
+      await goToRealmOverridesSubTab(page);
+
+      const key = "edit";
+      await addBundle(page, key, "123");
+      await clickCreateButton(page);
+      await addBundle(page, "value", "abc");
+      await clickCreateButton(page);
+
+      await assertNotificationMessage(
+        page,
+        "Success! The translation has been added.",
+      );
+
+      await editBundle(page, 0, "def");
+      await clickConfirmEditButton(page, 0);
+      await assertNotificationMessage(page, "Success! Translation updated.");
+      await assertRowExists(page, "def");
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/localization.ts b/js/apps/admin-ui/test/realm-settings/localization.ts
new file mode 100644
index 000000000000..6cfdbcb6ccb2
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/localization.ts
@@ -0,0 +1,54 @@
+import { Page } from "@playwright/test";
+import { selectItem, switchOff, switchOn } from "../utils/form";
+
+export async function goToLocalizationTab(page: Page) {
+  await page.getByTestId("rs-localization-tab").click();
+}
+
+export async function goToLocalesSubTab(page: Page) {
+  await page.getByTestId("rs-localization-locales-sub-tab").click();
+}
+
+export async function goToRealmOverridesSubTab(page: Page) {
+  await page.getByTestId("rs-localization-realm-overrides-tab").click();
+}
+
+export async function switchInternationalization(
+  page: Page,
+  on: boolean = true,
+) {
+  const localeSwitch = page.getByTestId("internationalizationEnabled");
+  if (on) {
+    await switchOn(page, localeSwitch);
+  } else {
+    await switchOff(page, localeSwitch);
+  }
+}
+
+export async function selectLocale(page: Page, locale: string) {
+  await selectItem(page, "#supportedLocales", locale);
+  await page.keyboard.press("Escape");
+}
+
+export async function clicksSaveLocalization(page: Page) {
+  await page.getByTestId("localization-tab-save").click();
+}
+
+export async function addBundle(page: Page, key: string, value: string) {
+  await page.getByTestId("add-translationBtn").click();
+  await page.getByTestId("key").fill(key);
+  await page.getByTestId("value").fill(value);
+}
+
+export async function clickCreateButton(page: Page) {
+  await page.getByTestId("add-translation-confirm-button").click();
+}
+
+export async function editBundle(page: Page, row: number, value: string) {
+  await page.getByTestId(`editTranslationBtn-${row}`).click();
+  await page.getByTestId(`editTranslationValueInput-${row}`).fill(value);
+}
+
+export async function clickConfirmEditButton(page: Page, row: number) {
+  await page.getByTestId(`editTranslationAcceptBtn-${row}`).click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/login.spec.ts b/js/apps/admin-ui/test/realm-settings/login.spec.ts
new file mode 100644
index 000000000000..bdc940748cf7
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/login.spec.ts
@@ -0,0 +1,57 @@
+import { Page, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertSwitchIsChecked, switchToggle } from "../utils/form";
+import { login } from "../utils/login";
+import {
+  goToClientScopes,
+  goToRealm,
+  goToRealmSettings,
+} from "../utils/sidebar";
+import { goToLoginTab } from "./login";
+
+test.describe("Realm settings tabs tests", () => {
+  const realmName = `realm-settings_${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToLoginTab(page);
+  });
+
+  const testToggle = async (
+    page: Page,
+    realmSwitch: string,
+    expectedValue: boolean,
+  ) => {
+    await switchToggle(page, `[data-testid="${realmSwitch}"]`);
+
+    await goToClientScopes(page);
+    await goToRealmSettings(page);
+    await goToLoginTab(page);
+
+    await assertSwitchIsChecked(
+      page,
+      `[data-testid="${realmSwitch}"]`,
+      !expectedValue,
+    );
+  };
+
+  test("Go to login tab", async ({ page }) => {
+    await testToggle(page, "user-reg-switch", true);
+    await testToggle(page, "forgot-pw-switch", true);
+    await testToggle(page, "remember-me-switch", true);
+    await testToggle(page, "login-with-email-switch", false);
+    await testToggle(page, "duplicate-emails-switch", true);
+
+    await assertSwitchIsChecked(
+      page,
+      `[data-testid="email-as-username-switch"]`,
+      true,
+    );
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/login.ts b/js/apps/admin-ui/test/realm-settings/login.ts
new file mode 100644
index 000000000000..c81c0adb8a3a
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/login.ts
@@ -0,0 +1,5 @@
+import { Page } from "@playwright/test";
+
+export async function goToLoginTab(page: Page) {
+  await page.getByTestId("rs-login-tab").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/security-defenses.spec.ts b/js/apps/admin-ui/test/realm-settings/security-defenses.spec.ts
new file mode 100644
index 000000000000..1b1bdf780866
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/security-defenses.spec.ts
@@ -0,0 +1,47 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { selectItem } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  clickSaveBruteForce,
+  clickSaveSecurityDefenses,
+  fillMaxDeltaTimeSeconds,
+  fillMaxFailureWaitSeconds,
+  fillMinimumQuickLoginWaitSeconds,
+  fillWaitIncrementSeconds,
+  goToSecurityDefensesTab,
+} from "./security-defenses";
+
+test.describe("Security defenses", () => {
+  const realmName = `security-defenses-realm-settings-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToSecurityDefensesTab(page);
+  });
+
+  test("Realm header settings", async ({ page }) => {
+    await page.getByTestId("browserSecurityHeaders.xFrameOptions").fill("DENY");
+    await clickSaveSecurityDefenses(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+  });
+
+  test("Brute force detection", async ({ page }) => {
+    await page.getByTestId("security-defenses-brute-force-tab").click();
+    await selectItem(page, "#kc-brute-force-mode", "Lockout temporarily");
+    await fillWaitIncrementSeconds(page, "1");
+    await fillMaxFailureWaitSeconds(page, "1");
+    await fillMaxDeltaTimeSeconds(page, "1");
+    await fillMinimumQuickLoginWaitSeconds(page, "1");
+    await clickSaveBruteForce(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/security-defenses.ts b/js/apps/admin-ui/test/realm-settings/security-defenses.ts
new file mode 100644
index 000000000000..b274d3fa226a
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/security-defenses.ts
@@ -0,0 +1,32 @@
+import { Page } from "@playwright/test";
+
+export async function goToSecurityDefensesTab(page: Page) {
+  await page.getByTestId("rs-security-defenses-tab").click();
+}
+
+export async function clickSaveSecurityDefenses(page: Page) {
+  await page.getByTestId("headers-form-tab-save").click();
+}
+
+export async function fillWaitIncrementSeconds(page: Page, value: string) {
+  await page.getByTestId("waitIncrementSeconds").fill(value);
+}
+
+export async function fillMaxFailureWaitSeconds(page: Page, value: string) {
+  await page.getByTestId("maxFailureWaitSeconds").fill(value);
+}
+
+export async function fillMaxDeltaTimeSeconds(page: Page, value: string) {
+  await page.getByTestId("maxDeltaTimeSeconds").fill(value);
+}
+
+export async function fillMinimumQuickLoginWaitSeconds(
+  page: Page,
+  value: string,
+) {
+  await page.getByTestId("minimumQuickLoginWaitSeconds").fill(value);
+}
+
+export async function clickSaveBruteForce(page: Page) {
+  await page.getByTestId("brute-force-tab-save").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/session.spec.ts b/js/apps/admin-ui/test/realm-settings/session.spec.ts
new file mode 100644
index 000000000000..96bea049c013
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/session.spec.ts
@@ -0,0 +1,40 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertSsoSessionIdleInput,
+  assertSsoSessionIdleRememberMe,
+  assertSsoSessionMaxInput,
+  assertSsoSessionMaxRememberMe,
+  clickSaveSessionsButton,
+  goToSessionsTab,
+  populateSessionsPage,
+} from "./sessions";
+
+test.describe("Sessions", () => {
+  const realmName = `sessions-realm-settings-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToSessionsTab(page);
+  });
+
+  test("Add session data", async ({ page }) => {
+    await populateSessionsPage(page);
+    await clickSaveSessionsButton(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await assertSsoSessionIdleInput(page, "1");
+    await assertSsoSessionMaxInput(page, "2");
+    await assertSsoSessionIdleRememberMe(page, "3");
+    await assertSsoSessionMaxRememberMe(page, "4");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/sessions.ts b/js/apps/admin-ui/test/realm-settings/sessions.ts
new file mode 100644
index 000000000000..32662192b242
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/sessions.ts
@@ -0,0 +1,82 @@
+import { Page, expect } from "@playwright/test";
+import { changeTimeUnit, switchOn } from "../utils/form";
+
+export async function goToSessionsTab(page: Page) {
+  await page.getByTestId("rs-sessions-tab").click();
+}
+
+function getSsoSessionIdleInput(page: Page) {
+  return page.getByTestId("sso-session-idle-input");
+}
+
+function getSsoSessionMaxInput(page: Page) {
+  return page.getByTestId("sso-session-max-input");
+}
+
+function getSsoSessionIdleRememberMe(page: Page) {
+  return page.getByTestId("sso-session-idle-remember-me-input");
+}
+
+function getSsoSessionMaxRememberMe(page: Page) {
+  return page.getByTestId("sso-session-max-remember-me-input");
+}
+
+export async function populateSessionsPage(page: Page) {
+  await getSsoSessionIdleInput(page).fill("1");
+  await changeTimeUnit(page, "Minutes", "#kc-sso-session-idle-select-menu");
+
+  await getSsoSessionMaxInput(page).fill("2");
+  await changeTimeUnit(page, "Hours", "#kc-sso-session-max-select-menu");
+
+  await getSsoSessionIdleRememberMe(page).fill("3");
+  await changeTimeUnit(
+    page,
+    "Days",
+    "#kc-sso-session-idle-remember-me-select-menu",
+  );
+
+  await getSsoSessionMaxRememberMe(page).fill("4");
+  await changeTimeUnit(
+    page,
+    "Minutes",
+    "#kc-sso-session-max-remember-me-select-menu",
+  );
+
+  await page.getByTestId("client-session-idle-input").fill("5");
+  await changeTimeUnit(page, "Hours", "#kc-client-session-idle-select-menu");
+
+  await page.getByTestId("client-session-max-input").fill("6");
+  await changeTimeUnit(page, "Days", "#kc-client-session-max-select-menu");
+
+  await page.getByTestId("offline-session-idle-input").fill("7");
+  await switchOn(page, "#kc-offline-session-max");
+
+  await page.getByTestId("login-timeout-input").fill("9");
+  await changeTimeUnit(page, "Minutes", "#kc-login-timeout-select-menu");
+
+  await page.getByTestId("login-action-timeout-input").fill("10");
+  await changeTimeUnit(page, "Days", "#kc-login-action-timeout-select-menu");
+}
+
+export async function clickSaveSessionsButton(page: Page) {
+  await page.getByTestId("sessions-tab-save").click();
+}
+
+export async function assertSsoSessionIdleInput(page: Page, value: string) {
+  await expect(getSsoSessionIdleInput(page)).toHaveValue(value);
+}
+
+export async function assertSsoSessionMaxInput(page: Page, value: string) {
+  await expect(getSsoSessionMaxInput(page)).toHaveValue(value);
+}
+
+export async function assertSsoSessionIdleRememberMe(
+  page: Page,
+  value: string,
+) {
+  await expect(getSsoSessionIdleRememberMe(page)).toHaveValue(value);
+}
+
+export async function assertSsoSessionMaxRememberMe(page: Page, value: string) {
+  await expect(getSsoSessionMaxRememberMe(page)).toHaveValue(value);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/tokens.spec.ts b/js/apps/admin-ui/test/realm-settings/tokens.spec.ts
new file mode 100644
index 000000000000..699e42ce2cf7
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/tokens.spec.ts
@@ -0,0 +1,38 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import {
+  assertAccessTokenLifespan,
+  assertAccessTokenLifespanImplicitInput,
+  assertParRequestUriLifespan,
+  clickSaveSessionsButton,
+  goToTokensTab,
+  populateTokensPage,
+} from "./tokens";
+
+test.describe("Realm Settings - Tokens", () => {
+  const realmName = `tokens-realm-settings-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToTokensTab(page);
+  });
+
+  test("Add token data", async ({ page }) => {
+    await populateTokensPage(page);
+    await clickSaveSessionsButton(page);
+    await assertNotificationMessage(page, "Realm successfully updated");
+
+    await assertAccessTokenLifespan(page, "1");
+    await assertParRequestUriLifespan(page, "2");
+    await assertAccessTokenLifespanImplicitInput(page, "2");
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/tokens.ts b/js/apps/admin-ui/test/realm-settings/tokens.ts
new file mode 100644
index 000000000000..8d455dd76932
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/tokens.ts
@@ -0,0 +1,79 @@
+import { Page, expect } from "@playwright/test";
+import { changeTimeUnit, switchOn } from "../utils/form";
+
+export async function goToTokensTab(page: Page) {
+  await page.getByTestId("rs-tokens-tab").click();
+}
+
+function getAccessTokenLifespan(page: Page) {
+  return page.getByTestId("access-token-lifespan-input");
+}
+
+function getParRequestUriLifespan(page: Page) {
+  return page.getByTestId("par-request-uri-lifespan-input");
+}
+
+function getAccessTokenLifespanImplicitInput(page: Page) {
+  return page.getByTestId("access-token-lifespan-implicit-input");
+}
+
+export async function populateTokensPage(page: Page) {
+  await switchOn(page, page.getByTestId("revoke-refresh-token-switch"));
+
+  await getAccessTokenLifespan(page).fill("1");
+  await changeTimeUnit(page, "Days", "#kc-access-token-lifespan-select-menu");
+
+  await getParRequestUriLifespan(page).fill("2");
+  await changeTimeUnit(
+    page,
+    "Minutes",
+    "#kc-access-token-lifespan-implicit-select-menu",
+  );
+
+  await getAccessTokenLifespanImplicitInput(page).fill("2");
+  await changeTimeUnit(page, "Hours", "#par-request-uri-lifespan-select-menu");
+
+  await page.getByTestId("client-login-timeout-input").fill("3");
+  await changeTimeUnit(page, "Hours", "#kc-client-login-timeout-select-menu");
+
+  await page.getByTestId("user-initiated-action-lifespan").fill("4");
+  await changeTimeUnit(
+    page,
+    "Minutes",
+    "#kc-user-initiated-action-lifespan-select-menu",
+  );
+
+  await page.getByTestId("default-admin-initated-input").fill("5");
+  await changeTimeUnit(page, "Days", "#kc-default-admin-initiated-select-menu");
+
+  await page.getByTestId("email-verification-input").fill("6");
+  await changeTimeUnit(page, "Days", "#kc-email-verification-select-menu");
+
+  await page.getByTestId("idp-email-verification-input").fill("7");
+  await changeTimeUnit(page, "Days", "#kc-idp-email-verification-select-menu");
+
+  await page.getByTestId("forgot-pw-input").fill("8");
+  await changeTimeUnit(page, "Days", "#kc-forgot-pw-select-menu");
+
+  await page.getByTestId("execute-actions-input").fill("9");
+  await changeTimeUnit(page, "Days", "#kc-execute-actions-select-menu");
+}
+
+export async function clickSaveSessionsButton(page: Page) {
+  await page.getByTestId("tokens-tab-save").click();
+}
+
+export async function assertAccessTokenLifespan(page: Page, value: string) {
+  await expect(getAccessTokenLifespan(page)).toHaveValue(value);
+}
+
+export async function assertParRequestUriLifespan(page: Page, value: string) {
+  await expect(getParRequestUriLifespan(page)).toHaveValue(value);
+}
+
+export async function assertAccessTokenLifespanImplicitInput(
+  page: Page,
+  value: string,
+) {
+  await expect(getAccessTokenLifespanImplicitInput(page)).toHaveValue(value);
+}
diff --git a/js/apps/admin-ui/test/realm-settings/user-registration.spec.ts b/js/apps/admin-ui/test/realm-settings/user-registration.spec.ts
new file mode 100644
index 000000000000..874c64436096
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/user-registration.spec.ts
@@ -0,0 +1,67 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { pickRoleType, confirmModalAssign, pickRole } from "../utils/roles";
+import { goToRealm, goToRealmSettings } from "../utils/sidebar";
+import { assertRowExists, clickRowKebabItem, searchItem } from "../utils/table";
+import {
+  goToDefaultGroupTab,
+  goToUserRegistrationTab,
+} from "./user-registration";
+
+const groupName = "The default group";
+
+test.describe("Realm settings - User registration tab", () => {
+  const realmName = `realm-settings-user-registration-${uuid()}`;
+  const roleName = "theRole";
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createRealmRole({ name: roleName, realm: realmName });
+    await adminClient.createGroup(groupName, realmName);
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToUserRegistrationTab(page);
+  });
+
+  test(`Add / remove ${roleName} role`, async ({ page }) => {
+    const roleType = "roles";
+
+    await pickRoleType(page, roleType);
+    await pickRole(page, roleName, true);
+    await confirmModalAssign(page);
+    await assertNotificationMessage(page, "Associated roles have been added");
+
+    await searchItem(page, "Search", roleName);
+    await assertRowExists(page, roleName);
+
+    // remove role
+
+    await clickRowKebabItem(page, roleName, "Unassign");
+    await confirmModal(page);
+    await assertNotificationMessage(page, "Role mapping updated");
+  });
+
+  test("Add default group", async ({ page }) => {
+    await goToDefaultGroupTab(page);
+    await page.getByTestId("no-default-groups-empty-action").click();
+
+    await page.getByTestId(`${groupName}-check`).click();
+    await page.getByTestId("add-button").click();
+    await assertNotificationMessage(
+      page,
+      "New group added to the default groups",
+    );
+
+    await assertRowExists(page, groupName);
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/user-registration.ts b/js/apps/admin-ui/test/realm-settings/user-registration.ts
new file mode 100644
index 000000000000..a5b9daeaadc3
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/user-registration.ts
@@ -0,0 +1,9 @@
+import { Page } from "@playwright/test";
+
+export async function goToUserRegistrationTab(page: Page) {
+  await page.getByTestId("rs-userRegistration-tab").click();
+}
+
+export async function goToDefaultGroupTab(page: Page) {
+  await page.getByTestId("default-groups-tab").click();
+}
diff --git a/js/apps/admin-ui/test/realm-settings/userprofile.spec.ts b/js/apps/admin-ui/test/realm-settings/userprofile.spec.ts
new file mode 100644
index 000000000000..147b6d24eca9
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/userprofile.spec.ts
@@ -0,0 +1,260 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { assertFieldError, selectItem, switchOn } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings, goToUsers } from "../utils/sidebar";
+import {
+  assertRowExists,
+  clickRowKebabItem,
+  clickTableRowItem,
+} from "../utils/table";
+import { goToLoginTab } from "./login";
+import {
+  clickAddValidator,
+  clickCancelAttribute,
+  clickCreateAttribute,
+  clickSaveAttribute,
+  clickSaveValidator,
+  fillAttributeForm,
+  goToAttributeGroupsTab,
+  goToAttributesTab,
+  goToUserProfileTab,
+  switchOffIfOn,
+} from "./userprofile";
+
+test.describe("User profile tabs", () => {
+  const name = "Test";
+  const displayName = "Test display name";
+  const modifyName = "ModifyTest";
+  const group = `realm-settings-group-${uuid()}`;
+
+  const realmName = `sessions-realm-user-profile-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.addUserProfile(realmName, {
+      attributes: [
+        {
+          name: modifyName,
+          displayName,
+        },
+      ],
+      groups: [
+        {
+          name: group,
+        },
+      ],
+    });
+  });
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await goToUserProfileTab(page);
+  });
+
+  test.afterEach(async () => {
+    await adminClient.deleteUser("testuser7", realmName, true);
+    await adminClient.deleteUser("testuser9@gmail.com", realmName, true);
+    await adminClient.deleteUser("testuser10", realmName, true);
+    await adminClient.deleteUser("testuser11", realmName, true);
+  });
+
+  test.describe("Attributes sub tab tests", () => {
+    test("Completes new attribute form and performs cancel", async ({
+      page,
+    }) => {
+      await clickCreateAttribute(page);
+      await fillAttributeForm(page, { name, displayName });
+      await clickCancelAttribute(page);
+      await assertRowExists(page, name, false);
+    });
+
+    test("Completes new attribute form and performs submit", async ({
+      page,
+    }) => {
+      await clickCreateAttribute(page);
+      await fillAttributeForm(page, { name, displayName });
+      await clickSaveAttribute(page);
+      await assertNotificationMessage(
+        page,
+        "Success! User Profile configuration has been saved.",
+      );
+    });
+
+    test("Modifies existing attribute and performs save", async ({ page }) => {
+      const displayName = "Edited display name";
+      await clickTableRowItem(page, modifyName);
+      await fillAttributeForm(page, { displayName });
+      await clickSaveAttribute(page);
+      await assertNotificationMessage(
+        page,
+        "Success! User Profile configuration has been saved.",
+      );
+      await assertRowExists(page, displayName, true);
+    });
+
+    test("Adds and removes validator to/from existing attribute and performs save", async ({
+      page,
+    }) => {
+      await clickTableRowItem(page, modifyName);
+      await clickAddValidator(page);
+      await selectItem(
+        page,
+        page.getByRole("button", { name: "Select an option" }),
+        "email Email format validator",
+      );
+      await clickSaveValidator(page);
+      await expect(
+        page.locator('tbody [data-label="Validator name"]'),
+      ).toContainText("email");
+
+      await page.getByTestId("deleteValidator").click();
+      await confirmModal(page);
+      await expect(page.locator(".kc-emptyValidators")).toContainText(
+        "No validators.",
+      );
+    });
+  });
+
+  test("Deletes an attributes group", async ({ page }) => {
+    await goToAttributeGroupsTab(page);
+    await clickRowKebabItem(page, group, "Delete");
+    await confirmModal(page);
+    await assertRowExists(page, group, false);
+  });
+
+  test("Checks that not required attribute is not present when user is created with email as username and edit username set to disabled", async ({
+    page,
+  }) => {
+    const attrName = "newAttribute1";
+
+    await clickCreateAttribute(page);
+    await fillAttributeForm(page, { name: attrName, displayName: attrName });
+    await page.getByTestId("admin-edit").uncheck();
+    await clickSaveAttribute(page);
+
+    await goToRealmSettings(page);
+    await goToLoginTab(page);
+    await switchOn(page, "#kc-edit-username-switch");
+
+    await goToUsers(page);
+    await page.getByTestId("no-users-found-empty-action").click();
+    await expect(page.getByTestId(attrName)).toBeHidden();
+    await page.getByTestId("username").fill("testuser7");
+    await page.getByTestId("user-creation-save").click();
+    await assertNotificationMessage(page, "The user has been created");
+  });
+
+  test("Checks that not required attribute is not present when user is created/edited with email as username enabled", async ({
+    page,
+  }) => {
+    const attrName = "newAttribute2";
+
+    await clickCreateAttribute(page);
+    await fillAttributeForm(page, { name: attrName, displayName: attrName });
+    await page.getByTestId("admin-edit").uncheck();
+    await clickSaveAttribute(page);
+
+    await goToRealmSettings(page);
+    await goToLoginTab(page);
+    await switchOn(page, "#kc-email-as-username-switch");
+
+    await goToUsers(page);
+    await page.getByTestId("no-users-found-empty-action").click();
+    await page.getByTestId("email").fill("testuser8@gmail.com");
+    await expect(page.getByTestId(attrName)).toBeHidden();
+    await page.getByTestId("user-creation-save").click();
+    await assertNotificationMessage(page, "The user has been created");
+
+    await page.getByTestId("email").fill(`testuser9@gmail.com`);
+    await page.getByTestId("user-creation-save").click();
+    await assertNotificationMessage(page, "The user has been saved");
+  });
+
+  test("Checks that not required attribute with permissions to view/edit is present when user is created", async ({
+    page,
+  }) => {
+    const attrName = "newAttribute3";
+
+    await clickCreateAttribute(page);
+    await fillAttributeForm(page, { name: attrName, displayName: attrName });
+    await page.getByTestId("user-edit").check();
+    await page.getByTestId("user-view").check();
+    await page.getByTestId("admin-view").check();
+    await clickSaveAttribute(page);
+
+    await goToRealmSettings(page);
+    await goToLoginTab(page);
+    await switchOffIfOn(page, "#kc-email-as-username-switch");
+
+    await goToUsers(page);
+    await page.getByTestId("no-users-found-empty-action").click();
+    await expect(page.getByTestId(attrName)).toBeVisible();
+    await page.getByTestId("username").fill("testuser10");
+    await page.getByTestId("user-creation-save").click();
+    await assertNotificationMessage(page, "The user has been created");
+    await expect(page.getByTestId(attrName)).toBeVisible();
+  });
+
+  test("Checks that required attribute with permissions to view/edit is present and required when user is created", async ({
+    page,
+  }) => {
+    const attrName = "newAttribute4";
+
+    await goToUserProfileTab(page);
+    await goToAttributesTab(page);
+    await clickCreateAttribute(page);
+    await page.getByTestId("name").fill(attrName);
+    await page.getByTestId("attributes-displayName").fill(attrName);
+    await page.getByTestId("user-edit").check();
+    await page.getByTestId("user-view").check();
+    await page.getByTestId("admin-view").check();
+    await switchOn(page, "#kc-required");
+    await clickSaveAttribute(page);
+
+    await goToUsers(page);
+    await page.getByTestId("no-users-found-empty-action").click();
+    await expect(page.getByTestId(attrName)).toBeVisible();
+    await page.getByTestId("username").fill("testuser11");
+    await page.getByTestId("user-creation-save").click();
+    await assertFieldError(page, attrName, `Please specify '${attrName}'.`);
+
+    await page.getByTestId(attrName).fill("MyAttribute");
+    await page.getByTestId("user-creation-save").click();
+    await assertNotificationMessage(page, "The user has been created");
+  });
+
+  test("Checks that attribute group is visible when user with existing attribute is created", async ({
+    page,
+  }) => {
+    const group = "personalInfo";
+
+    await goToUserProfileTab(page);
+    await goToAttributeGroupsTab(page);
+    await page.getByTestId("create-attributes-groups-action").click();
+    await page.getByTestId("name").fill(group);
+    await page.getByTestId("attributes-displayHeader").fill(group);
+    await page.getByTestId("saveGroupBtn").click();
+    await goToAttributesTab(page);
+    await clickTableRowItem(page, modifyName);
+    await selectItem(page, "#group", group);
+    await page.getByTestId("admin-edit").check();
+
+    await clickSaveAttribute(page);
+    await assertNotificationMessage(
+      page,
+      "Success! User Profile configuration has been saved.",
+    );
+
+    await goToUsers(page);
+    await page.getByTestId("no-users-found-empty-action").click();
+
+    await expect(page.getByRole("heading", { name: group })).toBeVisible();
+  });
+});
diff --git a/js/apps/admin-ui/test/realm-settings/userprofile.ts b/js/apps/admin-ui/test/realm-settings/userprofile.ts
new file mode 100644
index 000000000000..cced4f6b261c
--- /dev/null
+++ b/js/apps/admin-ui/test/realm-settings/userprofile.ts
@@ -0,0 +1,53 @@
+import { Page } from "@playwright/test";
+
+export async function goToUserProfileTab(page: Page) {
+  await page.getByTestId("rs-user-profile-tab").click();
+}
+
+export async function goToAttributesTab(page: Page) {
+  await page.getByTestId("attributesTab").click();
+}
+
+export async function clickCreateAttribute(page: Page) {
+  await page.getByTestId("createAttributeBtn").click();
+}
+
+type AttributeForm = {
+  name?: string;
+  displayName?: string;
+};
+
+export async function fillAttributeForm(
+  page: Page,
+  { name, displayName }: AttributeForm,
+) {
+  if (name) await page.getByTestId("name").fill(name);
+  if (displayName)
+    await page.getByTestId("attributes-displayName").fill(displayName);
+}
+
+export async function clickCancelAttribute(page: Page) {
+  await page.getByTestId("attribute-cancel").click();
+}
+
+export async function clickSaveAttribute(page: Page) {
+  await page.getByTestId("attribute-create").click();
+}
+
+export async function clickAddValidator(page: Page) {
+  await page.getByTestId("addValidator").click();
+}
+
+export async function clickSaveValidator(page: Page) {
+  await page.getByTestId("save-validator-role-button").click();
+}
+
+export async function goToAttributeGroupsTab(page: Page) {
+  await page.getByTestId("attributesGroupTab").click();
+}
+
+export async function switchOffIfOn(page: Page, selector: string) {
+  if (await page.isChecked(selector)) {
+    await page.locator(selector).click({ force: true });
+  }
+}
diff --git a/js/apps/admin-ui/test/sessions/main.spec.ts b/js/apps/admin-ui/test/sessions/main.spec.ts
new file mode 100644
index 000000000000..5a5a27e8e81f
--- /dev/null
+++ b/js/apps/admin-ui/test/sessions/main.spec.ts
@@ -0,0 +1,183 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import {
+  assertAxeViolations,
+  assertNotificationMessage,
+  selectActionToggleItem,
+} from "../utils/masthead";
+import { goToSessions } from "../utils/sidebar";
+import {
+  assertNoResults,
+  assertRowExists,
+  clickRowKebabItem,
+  clickTableRowItem,
+  getTableData,
+  searchItem,
+} from "../utils/table";
+import {
+  assertNotBeforeValue,
+  assertRowHasSignOutKebab,
+  clickNotBefore,
+  clickPush,
+  clickSetToNow,
+} from "./main";
+
+const admin = "admin";
+const client = "security-admin-console";
+const tableName = "Sessions";
+const placeHolder = "Search session";
+
+test.describe("Sessions test", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToSessions(page);
+  });
+
+  test.describe("Sessions list view", () => {
+    test("check item values", async ({ page }) => {
+      await searchItem(page, placeHolder, client);
+      const rows = await getTableData(page, tableName);
+      expect(rows).not.toBeNull();
+
+      await assertRowHasSignOutKebab(page, admin);
+    });
+
+    test("go to item accessed clients link", async ({ page }) => {
+      await searchItem(page, placeHolder, client);
+      await clickTableRowItem(page, admin);
+      expect(page.url()).toMatch(/users\/.*\/sessions/);
+    });
+  });
+});
+
+test.describe("Offline sessions", () => {
+  const clientId = `offline-client-${uuid()}`;
+  const username = `user-${uuid()}`;
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToSessions(page);
+  });
+
+  test.beforeEach(async () => {
+    await Promise.all([
+      adminClient.createClient({
+        protocol: "openid-connect",
+        clientId,
+        publicClient: false,
+        directAccessGrantsEnabled: true,
+        clientAuthenticatorType: "client-secret",
+        secret: "secret",
+        standardFlowEnabled: true,
+      }),
+      adminClient.createUser({
+        username,
+        enabled: true,
+        credentials: [{ type: "password", value: "password" }],
+      }),
+    ]);
+
+    await adminClient.auth({
+      username,
+      password: "password",
+      grantType: "password",
+      clientId,
+      clientSecret: "secret",
+      scopes: ["openid", "offline_access"],
+    });
+  });
+
+  test.afterAll(async () => {
+    await Promise.all([
+      adminClient.deleteClient(clientId),
+      adminClient.deleteUser(username),
+    ]);
+  });
+
+  test("check offline token", async ({ page }) => {
+    await searchItem(page, placeHolder, clientId);
+    await assertRowExists(page, username);
+    await clickRowKebabItem(page, username, "Revoke");
+
+    await searchItem(page, placeHolder, clientId);
+    await assertRowExists(page, username, false);
+  });
+});
+
+test.describe("Search", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToSessions(page);
+  });
+
+  test("search non-existent session", async ({ page }) => {
+    await searchItem(page, placeHolder, "non-existent-session");
+    await assertNoResults(page);
+  });
+});
+
+test.describe("revocation", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToSessions(page);
+  });
+
+  test("Clear revocation notBefore", async ({ page }) => {
+    await selectActionToggleItem(page, "Revocation");
+    await clickNotBefore(page);
+    await assertNotificationMessage(
+      page,
+      'Success! "Not Before" cleared for realm.',
+    );
+  });
+
+  test("Check if notBefore cleared", async ({ page }) => {
+    await selectActionToggleItem(page, "Revocation");
+    await assertNotBeforeValue(page, "None");
+  });
+
+  test("Set revocation notBefore", async ({ page }) => {
+    await selectActionToggleItem(page, "Revocation");
+    await clickSetToNow(page);
+    await assertNotificationMessage(
+      page,
+      'Success! "Not before" set for realm',
+    );
+  });
+
+  test("Push when URI not configured", async ({ page }) => {
+    await selectActionToggleItem(page, "Revocation");
+    await clickPush(page);
+    await assertNotificationMessage(
+      page,
+      "No push sent. No admin URI configured or no registered cluster nodes available",
+    );
+  });
+});
+
+test.describe("Accessibility tests for sessions", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToSessions(page);
+  });
+
+  test("Check a11y violations on load/ sessions", async ({ page }) => {
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on revocation dialog", async ({ page }) => {
+    await page.getByTestId("action-dropdown").click();
+    await page.getByTestId("revocation").click();
+    await assertAxeViolations(page);
+  });
+
+  test("Check a11y violations on sign out all active sessions dialog", async ({
+    page,
+  }) => {
+    await page.getByTestId("action-dropdown").click();
+    await page.getByTestId("logout-all").click();
+    await assertAxeViolations(page);
+  });
+});
diff --git a/js/apps/admin-ui/test/sessions/main.ts b/js/apps/admin-ui/test/sessions/main.ts
new file mode 100644
index 000000000000..89f57014f7f8
--- /dev/null
+++ b/js/apps/admin-ui/test/sessions/main.ts
@@ -0,0 +1,27 @@
+import { Page, expect } from "@playwright/test";
+
+export async function assertRowHasSignOutKebab(page: Page, row: string) {
+  await page
+    .getByRole("row", { name: row })
+    .getByLabel("Kebab toggle")
+    .first()
+    .click();
+
+  await expect(page.getByRole("menuitem", { name: "Sign out" })).toBeVisible();
+}
+
+export async function clickNotBefore(page: Page) {
+  await page.getByTestId("clear-not-before-button").click();
+}
+
+export async function assertNotBeforeValue(page: Page, value: string) {
+  await expect(page.getByTestId("not-before-input")).toHaveValue(value);
+}
+
+export async function clickSetToNow(page: Page) {
+  await page.getByTestId("set-to-now-button").click();
+}
+
+export async function clickPush(page: Page) {
+  await page.getByTestId("modal-test-connection-button").click();
+}
diff --git a/js/apps/admin-ui/test/user-federation/kerberos.spec.ts b/js/apps/admin-ui/test/user-federation/kerberos.spec.ts
new file mode 100644
index 000000000000..a79f14d63e93
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/kerberos.spec.ts
@@ -0,0 +1,226 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { selectItem, switchOff, switchToggle } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToUserFederation } from "../utils/sidebar";
+import {
+  clickAddProvider,
+  clickSave,
+  clickUserFederationCard,
+  fillKerberosForm,
+} from "./kerberos";
+
+const provider = "kerberos";
+const initCapProvider = provider.charAt(0).toUpperCase() + provider.slice(1);
+
+const kerberosName = "my-kerberos";
+const kerberosRealm = "my-realm";
+const kerberosPrincipal = "my-principal";
+const kerberosKeytab = "my-keytab";
+
+const firstKerberosName = `${kerberosName}-1`;
+const firstKerberosRealm = `${kerberosRealm}-1`;
+const firstKerberosPrincipal = `${kerberosPrincipal}-1`;
+const firstKerberosKeytab = `${kerberosKeytab}-1`;
+
+const secondKerberosName = `${kerberosName}-2`;
+const secondKerberosRealm = `${kerberosRealm}-2`;
+const secondKerberosPrincipal = `${kerberosPrincipal}-2`;
+const secondKerberosKeytab = `${kerberosKeytab}-2`;
+
+const defaultPolicy = "DEFAULT";
+const weeklyPolicy = "EVICT_WEEKLY";
+const dailyPolicy = "EVICT_DAILY";
+const lifespanPolicy = "MAX_LIFESPAN";
+const noCachePolicy = "NO_CACHE";
+
+const newKerberosDay = "Wednesday";
+const newKerberosHour = "15";
+const newKerberosMinute = "55";
+const maxLifespan = 5;
+
+const addProviderMenu = "Add new provider";
+const createdSuccessMessage = "User federation provider successfully created";
+const savedSuccessMessage = "User federation provider successfully saved";
+
+test.describe("User Fed Kerberos tests", () => {
+  const realmName = `user-federation-kerberos_${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+  });
+
+  test("Should create Kerberos provider from empty state", async ({ page }) => {
+    await goToUserFederation(page);
+    await clickAddProvider(page, provider);
+
+    await fillKerberosForm(page, {
+      alias: "new-kerberos",
+      config: {
+        kerberosRealm: firstKerberosRealm,
+        serverPrincipal: firstKerberosPrincipal,
+        keyTab: firstKerberosKeytab,
+      },
+    });
+    await clickSave(page, provider);
+    await assertNotificationMessage(page, createdSuccessMessage);
+  });
+
+  test.describe("Edit Kerberos provider", () => {
+    test.beforeAll(() =>
+      adminClient.createUserFederation(realmName, {
+        providerId: provider,
+        name: firstKerberosName,
+        config: {
+          kerberosRealm: [firstKerberosRealm],
+          serverPrincipal: [firstKerberosPrincipal],
+          keyTab: [firstKerberosKeytab],
+        },
+      }),
+    );
+
+    test.beforeEach(async ({ page }) => {
+      await goToUserFederation(page);
+    });
+
+    test("Should edit existing Kerberos provider", async ({ page }) => {
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+      await expect(
+        page.getByRole("heading", { name: "Required Settings" }),
+      ).toBeVisible();
+
+      await switchToggle(page, page.getByTestId("debug"));
+      await switchToggle(
+        page,
+        page.getByTestId("allow-password-authentication"),
+      );
+      await switchToggle(page, page.getByTestId("update-first-login"));
+
+      await clickSave(page, provider);
+      await assertNotificationMessage(page, savedSuccessMessage);
+
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.getByTestId("debug")).toBeChecked();
+      await expect(
+        page.getByTestId("allow-password-authentication"),
+      ).toBeChecked();
+      await expect(page.getByTestId("update-first-login")).toBeChecked();
+    });
+
+    test("Should set cache policy to evict_daily", async ({ page }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await selectItem(page, "#kc-cache-policy", dailyPolicy);
+      await selectItem(page, "#kc-eviction-hour", newKerberosHour);
+      await selectItem(page, "#kc-eviction-minute", newKerberosMinute);
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.getByText(dailyPolicy)).toBeVisible();
+      await expect(page.getByText(defaultPolicy)).toBeHidden();
+    });
+
+    test("Should set cache policy to evict_weekly", async ({ page }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await selectItem(page, "#kc-cache-policy", weeklyPolicy);
+      await selectItem(page, "#kc-eviction-day", newKerberosDay);
+      await selectItem(page, "#kc-eviction-hour", newKerberosHour);
+      await selectItem(page, "#kc-eviction-minute", newKerberosMinute);
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.getByText(weeklyPolicy)).toBeVisible();
+      await expect(page.getByText(defaultPolicy)).toBeHidden();
+    });
+
+    test("Should set cache policy to max_lifespan", async ({ page }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await selectItem(page, "#kc-cache-policy", lifespanPolicy);
+      for (let i = 0; i < maxLifespan; i++) {
+        await page.getByTestId("kerberos-cache-lifespan").click();
+      }
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.getByText(lifespanPolicy)).toBeVisible();
+      await expect(page.getByText(defaultPolicy)).toBeHidden();
+    });
+
+    test("Should set cache policy to no_cache", async ({ page }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await selectItem(page, "#kc-cache-policy", noCachePolicy);
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.getByText(noCachePolicy)).toBeVisible();
+      await expect(page.getByText(defaultPolicy)).toBeHidden();
+    });
+
+    test("Should edit existing Kerberos provider and cancel", async ({
+      page,
+    }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await selectItem(page, "#kc-cache-policy", weeklyPolicy);
+      await selectItem(page, "#kc-eviction-day", newKerberosDay);
+      await selectItem(page, "#kc-eviction-hour", newKerberosHour);
+      await selectItem(page, "#kc-eviction-minute", newKerberosMinute);
+      await page.getByTestId(`${provider}-cancel`).click();
+
+      await clickUserFederationCard(page, firstKerberosName);
+
+      await expect(page.locator("#kc-cache-policy")).toHaveText(defaultPolicy);
+    });
+
+    test("Should disable an existing Kerberos provider", async ({ page }) => {
+      await clickUserFederationCard(page, firstKerberosName);
+      await switchOff(page, "#Kerberos-switch");
+      await confirmModal(page);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+
+      await expect(page.locator("text=Disabled")).toBeVisible();
+    });
+
+    test("Should create new Kerberos provider using the New Provider dropdown", async ({
+      page,
+    }) => {
+      await page.getByText(addProviderMenu).click();
+      await page.getByRole("menuitem", { name: initCapProvider }).click();
+
+      await fillKerberosForm(page, {
+        alias: secondKerberosName,
+        config: {
+          kerberosRealm: secondKerberosRealm,
+          serverPrincipal: secondKerberosPrincipal,
+          keyTab: secondKerberosKeytab,
+        },
+      });
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, createdSuccessMessage);
+      await expect(page.getByText(secondKerberosName)).toBeVisible();
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/user-federation/kerberos.ts b/js/apps/admin-ui/test/user-federation/kerberos.ts
new file mode 100644
index 000000000000..d217ac9ca2d8
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/kerberos.ts
@@ -0,0 +1,28 @@
+import IdentityProviderRepresentation from "@keycloak/keycloak-admin-client/lib/defs/identityProviderRepresentation";
+import { Page } from "@playwright/test";
+
+export async function clickAddProvider(page: Page, provider: string) {
+  await page.getByTestId(`${provider}-card`).click();
+}
+
+export async function fillKerberosForm(
+  page: Page,
+  data: IdentityProviderRepresentation,
+) {
+  await page.getByTestId("name").fill(data.alias!);
+  await page
+    .getByTestId("config.kerberosRealm.0")
+    .fill(data.config!["kerberosRealm"]!);
+  await page
+    .getByTestId("config.serverPrincipal.0")
+    .fill(data.config!["serverPrincipal"]!);
+  await page.getByTestId("config.keyTab.0").fill(data.config!["keyTab"]!);
+}
+
+export async function clickSave(page: Page, provider: string) {
+  await page.getByTestId(`${provider}-save`).click();
+}
+
+export async function clickUserFederationCard(page: Page, name: string) {
+  await page.getByRole("link", { name }).click();
+}
diff --git a/js/apps/admin-ui/test/user-federation/ldap-mapper.spec.ts b/js/apps/admin-ui/test/user-federation/ldap-mapper.spec.ts
new file mode 100644
index 000000000000..81778b0d0ba1
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/ldap-mapper.spec.ts
@@ -0,0 +1,178 @@
+import { test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { selectItem } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToUserFederation } from "../utils/sidebar";
+import { assertRowExists, clickRowKebabItem, searchItem } from "../utils/table";
+import {
+  clickAddMapper,
+  fillHardwareAttributeMapper,
+  goToMapperTab,
+  saveMapper,
+} from "./ldap-mapper";
+
+const provider = "ldap";
+
+const ldapName = "ldap-mappers-testing";
+
+// connection and authentication settings
+const mapperCreatedSuccess = "Mapping successfully created";
+const mapperDeletedSuccess = "Mapping successfully deleted";
+const groupName = "aa-uf-mappers-group";
+const clientName = "aa-uf-mappers-client";
+const roleName = "aa-uf-mappers-role";
+
+// mapperType variables
+const hcAttMapper = "hardcoded-attribute-mapper";
+const hcLdapGroupMapper = "hardcoded-ldap-group-mapper";
+const hcLdapAttMapper = "hardcoded-ldap-attribute-mapper";
+const roleLdapMapper = "role-ldap-mapper";
+const hcLdapRoleMapper = "hardcoded-ldap-role-mapper";
+
+test.describe("User Fed LDAP mapper tests", () => {
+  const realmName = `user-federation-kerberos_${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+    await adminClient.createUserFederation(realmName, {
+      providerId: provider,
+      name: ldapName,
+      config: {
+        connectionUrl: ["ldap://localhost:3004"],
+        bindType: ["simple"],
+        bindDn: ["cn=user,dc=test"],
+        bindCredential: ["user"],
+        usersDn: ["user-dn-1"],
+        rdnLDAPAttribute: ["uid"],
+        userObjectClasses: ["inetOrgPerson, organizationalPerson"],
+        editMode: ["READ_ONLY"],
+      },
+    });
+    await adminClient.createGroup(groupName, realmName);
+    await adminClient.createClient({
+      realm: realmName,
+      clientId: clientName,
+    });
+    await adminClient.createRealmRole({
+      realm: realmName,
+      name: roleName,
+    });
+  });
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToUserFederation(page);
+    await page.getByRole("link", { name: ldapName }).click();
+    await goToMapperTab(page);
+  });
+
+  test("Delete default mappers", async ({ page }) => {
+    const creationDateMapper = "creation date";
+    const emailMapper = "email";
+    const lastNameMapper = "last name";
+    const modifyDateMapper = "modify date";
+
+    await searchItem(page, "Search", creationDateMapper);
+    await clickRowKebabItem(page, creationDateMapper, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, mapperDeletedSuccess);
+    await assertRowExists(page, creationDateMapper, false);
+
+    await searchItem(page, "Search", emailMapper);
+    await clickRowKebabItem(page, emailMapper, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, mapperDeletedSuccess);
+    await assertRowExists(page, emailMapper, false);
+
+    await searchItem(page, "Search", lastNameMapper);
+    await clickRowKebabItem(page, lastNameMapper, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, mapperDeletedSuccess);
+    await assertRowExists(page, lastNameMapper, false);
+
+    await searchItem(page, "Search", modifyDateMapper);
+    await clickRowKebabItem(page, modifyDateMapper, "Delete");
+    await confirmModal(page);
+    await assertNotificationMessage(page, mapperDeletedSuccess);
+    await assertRowExists(page, modifyDateMapper, false);
+  });
+
+  test("Create hardcoded attribute mapper", async ({ page }) => {
+    await clickAddMapper(page);
+    await selectItem(page, "#kc-providerId", hcAttMapper);
+
+    await fillHardwareAttributeMapper(page, {
+      name: `${hcAttMapper}-test`,
+      config: {
+        "user.model.attribute": ["middleName"],
+        "attribute.value": ["test"],
+      },
+    });
+    await saveMapper(page);
+    await assertNotificationMessage(page, mapperCreatedSuccess);
+    await assertRowExists(page, hcAttMapper, true);
+  });
+
+  test("Create hardcoded ldap group mapper", async ({ page }) => {
+    await clickAddMapper(page);
+    await selectItem(page, "#kc-providerId", hcLdapGroupMapper);
+
+    await fillHardwareAttributeMapper(page, {
+      name: `${hcLdapGroupMapper}-test`,
+      config: {
+        group: [groupName],
+      },
+    });
+    await saveMapper(page);
+    await assertNotificationMessage(page, mapperCreatedSuccess);
+    await assertRowExists(page, hcLdapGroupMapper, true);
+  });
+
+  test("Create hardcoded ldap attribute mapper", async ({ page }) => {
+    await clickAddMapper(page);
+    await selectItem(page, "#kc-providerId", hcLdapAttMapper);
+    await fillHardwareAttributeMapper(page, {
+      name: `${hcLdapAttMapper}-test`,
+      config: {
+        "ldap.attribute.name": ["someName"],
+        "ldap.attribute.value": ["test"],
+      },
+    });
+    await saveMapper(page);
+    await assertNotificationMessage(page, mapperCreatedSuccess);
+    await assertRowExists(page, hcLdapAttMapper, true);
+  });
+
+  test("Create hardcoded ldap role mapper", async ({ page }) => {
+    await clickAddMapper(page);
+    await selectItem(page, "#kc-providerId", hcLdapRoleMapper);
+    await fillHardwareAttributeMapper(page, {
+      name: `${hcLdapRoleMapper}-test`,
+      config: {
+        role: [roleName],
+      },
+    });
+    await saveMapper(page);
+    await assertNotificationMessage(page, mapperCreatedSuccess);
+    await assertRowExists(page, hcLdapRoleMapper, true);
+  });
+
+  test("Create role ldap mapper", async ({ page }) => {
+    await clickAddMapper(page);
+    await selectItem(page, "#kc-providerId", roleLdapMapper);
+    await fillHardwareAttributeMapper(page, {
+      name: `${roleLdapMapper}-test`,
+      config: {
+        roleDn: ["role-dn"],
+      },
+    });
+    await saveMapper(page);
+    await assertNotificationMessage(page, mapperCreatedSuccess);
+    await assertRowExists(page, roleLdapMapper, true);
+  });
+});
diff --git a/js/apps/admin-ui/test/user-federation/ldap-mapper.ts b/js/apps/admin-ui/test/user-federation/ldap-mapper.ts
new file mode 100644
index 000000000000..04dee99ae769
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/ldap-mapper.ts
@@ -0,0 +1,53 @@
+import ComponentRepresentation from "@keycloak/keycloak-admin-client/lib/defs/componentRepresentation";
+import { Page } from "@playwright/test";
+import { pickRoleType, confirmModalAssign, pickRole } from "../utils/roles";
+
+export async function goToMapperTab(page: Page) {
+  await page.getByTestId("ldap-mappers-tab").click();
+}
+
+export async function clickAddMapper(page: Page) {
+  await page.getByTestId("add-mapper-btn").click();
+}
+
+export async function fillHardwareAttributeMapper(
+  page: Page,
+  data: ComponentRepresentation,
+) {
+  await page.getByTestId("name").fill(data.name || "");
+  if (data.config?.["user.model.attribute"])
+    await page
+      .getByTestId("config.user🍺model🍺attribute")
+      .fill(data.config?.["user.model.attribute"][0] || "");
+
+  if (data.config?.["attribute.value"])
+    await page
+      .getByTestId("attribute.value")
+      .fill(data.config?.["attribute.value"][0] || "");
+
+  if (data.config?.group)
+    await page.getByTestId("group").fill(data.config?.group[0] || "");
+
+  if (data.config?.["ldap.attribute.name"])
+    await page
+      .getByTestId("ldap.attribute.name")
+      .fill(data.config?.["ldap.attribute.name"][0] || "");
+
+  if (data.config?.["ldap.attribute.value"])
+    await page
+      .getByTestId("ldap.attribute.value")
+      .fill(data.config?.["ldap.attribute.value"][0] || "");
+
+  if (data.config?.role) {
+    await pickRoleType(page, "roles");
+    await pickRole(page, data.config.role[0], true);
+    await confirmModalAssign(page);
+  }
+
+  if (data.config?.roleDn)
+    await page.getByTestId("roles.dn").fill(data.config?.roleDn[0] || "");
+}
+
+export async function saveMapper(page: Page) {
+  await page.getByTestId("ldap-mapper-save").click();
+}
diff --git a/js/apps/admin-ui/test/user-federation/ldap.spec.ts b/js/apps/admin-ui/test/user-federation/ldap.spec.ts
new file mode 100644
index 000000000000..e92b9c833a1d
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/ldap.spec.ts
@@ -0,0 +1,211 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { goToRealm, goToUserFederation } from "../utils/sidebar";
+import { clickAddProvider, clickSave } from "./kerberos";
+import {
+  assertEvictionValues,
+  clickLdapCard,
+  fillEviction,
+  fillLdapForm,
+  selectEvictionPolicy,
+} from "./ldap";
+import { switchToggle } from "../utils/form";
+
+const provider = "ldap";
+
+const firstLdapName = "my-ldap";
+const firstLdapVendor = "Active Directory";
+const updatedLdapName = `${firstLdapName}-updated`;
+
+// connection and authentication settings
+const connectionUrlValid = "ldap://localhost:3004";
+const bindTypeSimple = "simple";
+const truststoreSpiAlways = "Always";
+const connectionTimeoutTwoSecs = "2000";
+const bindDnCnDc = "cn=user,dc=test";
+const bindCredsValid = "user";
+
+const bindTypeNone = "none";
+const truststoreSpiNever = "Never";
+
+// ldap searching and updating
+const editModeReadOnly = "READ_ONLY";
+const editModeWritable = "WRITABLE";
+
+const firstUsersDn = "user-dn-1";
+const firstUserLdapAtt = "uid";
+const firstRdnLdapAtt = "uid";
+const firstUuidLdapAtt = "entryUUID";
+const firstUserObjClasses = "inetOrgPerson, organizationalPerson";
+const firstUserLdapFilter = "(first-filter)";
+const firstReadTimeout = "5000";
+
+const secondUsersDn = "user-dn-2";
+const secondUserLdapAtt = "cn";
+const secondRdnLdapAtt = "cn";
+const secondUuidLdapAtt = "objectGUID";
+const secondUserObjClasses = "person, organizationalPerson, user";
+
+const weeklyPolicy = "EVICT_WEEKLY";
+const dailyPolicy = "EVICT_DAILY";
+const newLdapDay = "Wednesday";
+const newLdapHour = "15";
+const newLdapMinute = "55";
+
+const createdSuccessMessage = "User federation provider successfully created";
+const savedSuccessMessage = "User federation provider successfully saved";
+const validatePasswordPolicyFailMessage =
+  "User federation provider could not be saved: Validate Password Policy is applicable only with WRITABLE edit mode";
+
+test.describe("User Federation LDAP tests", () => {
+  const realmName = `user-federation-ldap-${uuid()}`;
+
+  test.beforeAll(() => adminClient.createRealm(realmName));
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToUserFederation(page);
+  });
+
+  test("Should create LDAP provider from empty state", async ({ page }) => {
+    await clickAddProvider(page, provider);
+
+    await fillLdapForm(page, {
+      name: "new-ldap",
+      config: {
+        vendor: [firstLdapVendor],
+        connectionUrl: [connectionUrlValid],
+        bindType: [bindTypeSimple],
+        useTruststoreSpi: [truststoreSpiAlways],
+        connectionTimeout: [connectionTimeoutTwoSecs],
+        bindDn: [bindDnCnDc],
+        bindCredential: [bindCredsValid],
+        editMode: [editModeReadOnly],
+        usersDn: [firstUsersDn],
+        usernameLDAPAttribute: [firstUserLdapAtt],
+        rdnLDAPAttribute: [firstRdnLdapAtt],
+        uuidLDAPAttribute: [firstUuidLdapAtt],
+        userObjectClasses: [firstUserObjClasses],
+        customUserSearchFilter: [firstUserLdapFilter],
+        readTimeout: [firstReadTimeout],
+      },
+    });
+    await clickSave(page, provider);
+
+    await assertNotificationMessage(page, createdSuccessMessage);
+    await goToUserFederation(page);
+  });
+
+  test.describe("Edit provider", () => {
+    test.beforeAll(() =>
+      adminClient.createUserFederation(realmName, {
+        providerId: provider,
+        name: firstLdapName,
+        config: {
+          vendor: [firstLdapVendor],
+          connectionUrl: [connectionUrlValid],
+          bindType: [bindTypeSimple],
+          bindDn: [bindDnCnDc],
+          bindCredential: [bindCredsValid],
+          editMode: [editModeReadOnly],
+          usersDn: [firstUsersDn],
+          usernameLDAPAttribute: [firstUserLdapAtt],
+          rdnLDAPAttribute: [firstRdnLdapAtt],
+        },
+      }),
+    );
+
+    test.beforeEach(async ({ page }) => {
+      await clickLdapCard(page, firstLdapName);
+    });
+
+    test("Should fail updating advanced settings", async ({ page }) => {
+      await switchToggle(page, page.getByTestId("ldapv3-password"));
+      await switchToggle(page, page.getByTestId("password-policy"));
+      await switchToggle(page, page.getByTestId("trust-email"));
+      await clickSave(page, provider);
+      await assertNotificationMessage(page, validatePasswordPolicyFailMessage);
+    });
+
+    test("Should update advanced settings", async ({ page }) => {
+      await switchToggle(page, page.getByTestId("ldapv3-password"));
+      await switchToggle(page, page.getByTestId("password-policy"));
+      await switchToggle(page, page.getByTestId("trust-email"));
+
+      await fillLdapForm(page, {
+        name: updatedLdapName,
+        config: {
+          connectionUrl: [connectionUrlValid],
+          editMode: [editModeWritable],
+          usersDn: [secondUsersDn],
+          usernameLDAPAttribute: [secondUserLdapAtt],
+          rdnLDAPAttribute: [secondRdnLdapAtt],
+          uuidLDAPAttribute: [secondUuidLdapAtt],
+          userObjectClasses: [secondUserObjClasses],
+        },
+      });
+      await clickSave(page, provider);
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickLdapCard(page, updatedLdapName);
+      await expect(page.getByTestId("ldapv3-password")).toBeChecked();
+      await expect(page.getByTestId("password-policy")).toBeChecked();
+      await expect(page.getByTestId("trust-email")).toBeChecked();
+    });
+
+    test("Should set cache policy to evict_daily", async ({ page }) => {
+      await selectEvictionPolicy(page, dailyPolicy);
+      await fillEviction(page, ["hour", newLdapHour]);
+      await fillEviction(page, ["minute", newLdapMinute]);
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickLdapCard(page, firstLdapName);
+
+      await assertEvictionValues(page, [
+        ["hour", newLdapHour],
+        ["minute", newLdapMinute],
+      ]);
+    });
+
+    test("Should set cache policy to evict_weekly", async ({ page }) => {
+      await selectEvictionPolicy(page, weeklyPolicy);
+      await fillEviction(page, ["day", newLdapDay]);
+      await fillEviction(page, ["hour", newLdapHour]);
+      await fillEviction(page, ["minute", newLdapMinute]);
+      await clickSave(page, provider);
+
+      await assertNotificationMessage(page, savedSuccessMessage);
+      await goToUserFederation(page);
+      await clickLdapCard(page, firstLdapName);
+
+      await assertEvictionValues(page, [
+        ["day", newLdapDay],
+        ["hour", newLdapHour],
+        ["minute", newLdapMinute],
+      ]);
+    });
+
+    test("Update connection and authentication settings and save", async ({
+      page,
+    }) => {
+      await fillLdapForm(page, {
+        name: updatedLdapName,
+        config: {
+          connectionUrl: [connectionUrlValid],
+          bindType: [bindTypeNone],
+          useTruststoreSpi: [truststoreSpiNever],
+          connectionTimeout: [connectionTimeoutTwoSecs],
+        },
+      });
+      await clickSave(page, provider);
+      await assertNotificationMessage(page, savedSuccessMessage);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/user-federation/ldap.ts b/js/apps/admin-ui/test/user-federation/ldap.ts
new file mode 100644
index 000000000000..3ced54e3876d
--- /dev/null
+++ b/js/apps/admin-ui/test/user-federation/ldap.ts
@@ -0,0 +1,59 @@
+import ComponentRepresentation from "@keycloak/keycloak-admin-client/lib/defs/componentRepresentation";
+import { Page, expect } from "@playwright/test";
+import { selectItem } from "../utils/form";
+
+const filteredConfig = ["vendor", "bindType", "useTruststoreSpi", "editMode"];
+export async function fillLdapForm(page: Page, ldap: ComponentRepresentation) {
+  await page.getByTestId("name").fill(ldap.name!);
+
+  if (ldap.config?.vendor) {
+    await selectItem(page, "#kc-vendor", ldap.config.vendor[0]);
+  }
+
+  if (ldap.config?.bindType) {
+    await selectItem(page, "#kc-bind-type", ldap.config.bindType[0]);
+  }
+
+  if (ldap.config?.truststoreSpiAlways) {
+    await selectItem(
+      page,
+      "#useTruststoreSpi",
+      ldap.config.useTruststoreSpi[0],
+    );
+  }
+
+  if (ldap.config?.editMode) {
+    await selectItem(page, "#editMode", ldap.config.editMode[0]);
+  }
+
+  for (const key in ldap.config) {
+    if (filteredConfig.includes(key)) {
+      continue;
+    }
+    await page
+      .getByTestId(`config.${key}.0`)
+      .fill(ldap.config[key][0], { force: true });
+  }
+}
+
+export async function selectEvictionPolicy(page: Page, policy: string) {
+  await page.locator("#kc-cache-policy").click();
+  await page.getByRole("option", { name: policy }).click();
+}
+
+export async function fillEviction(page: Page, evict: [string, string]) {
+  await selectItem(page, `#kc-eviction-${evict[0]}`, evict[1]);
+}
+
+export async function clickLdapCard(page: Page, name: string) {
+  await page.getByRole("link", { name }).click();
+}
+
+export async function assertEvictionValues(
+  page: Page,
+  evictionValues: [string, string][],
+) {
+  for (const evict of evictionValues) {
+    await expect(page.locator(`#kc-eviction-${evict[0]}`)).toHaveText(evict[1]);
+  }
+}
diff --git a/js/apps/admin-ui/test/users/main.spec.ts b/js/apps/admin-ui/test/users/main.spec.ts
new file mode 100644
index 000000000000..4de462c02baf
--- /dev/null
+++ b/js/apps/admin-ui/test/users/main.spec.ts
@@ -0,0 +1,217 @@
+import { expect, test } from "@playwright/test";
+import { v4 as uuid } from "uuid";
+import adminClient from "../utils/AdminClient";
+import {
+  assertAttributeLength,
+  clickAttributeSaveButton,
+  fillAttributeData,
+  goToAttributesTab,
+} from "../utils/attributes";
+import { selectItem } from "../utils/form";
+import { login } from "../utils/login";
+import { assertNotificationMessage } from "../utils/masthead";
+import { confirmModal } from "../utils/modal";
+import { goToRealm, goToRealmSettings, goToUsers } from "../utils/sidebar";
+import {
+  assertNoResults,
+  assertRowExists,
+  clickTableRowItem,
+  searchItem,
+} from "../utils/table";
+import {
+  clickAddUserButton,
+  clickCancelButton,
+  clickSaveButton,
+  fillUserForm,
+  goToGroupTab,
+  joinGroup,
+} from "./main";
+
+let groupName = "group";
+let groupsList: string[] = [];
+
+test.describe("User creation", () => {
+  const realmName = `users-${uuid()}`;
+
+  const userId = `user_crud-${uuid()}`;
+
+  test.beforeAll(async () => {
+    await adminClient.createRealm(realmName);
+
+    for (let i = 0; i <= 2; i++) {
+      groupName += "_" + uuid();
+      await adminClient.createGroup(groupName, realmName);
+      groupsList = [...groupsList, groupName];
+    }
+  });
+
+  test.afterAll(() => adminClient.deleteRealm(realmName));
+
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+    await goToRealm(page, realmName);
+    await goToRealmSettings(page);
+    await selectItem(page, "#unmanagedAttributePolicy", "Enabled");
+    await page.getByTestId("realmSettingsGeneralTab-save").click();
+    await goToUsers(page);
+  });
+
+  test.afterEach(() => adminClient.deleteUser(userId, realmName, true));
+
+  test("Go to create User page", async ({ page }) => {
+    await clickAddUserButton(page);
+    await expect(page).toHaveURL(/.*users\/add-user/);
+
+    await clickCancelButton(page);
+    await expect(page).not.toHaveURL(/.*users\/add-user/);
+  });
+
+  test("Create user test", async ({ page }) => {
+    await clickAddUserButton(page);
+    await fillUserForm(page, {
+      username: userId,
+      email: `example_${uuid()}@example.com`,
+    });
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "The user has been created");
+  });
+
+  test("Should check temporary admin user existence", async ({ page }) => {
+    // check banner visibility first
+    await expect(page.locator(".pf-v5-c-banner")).toContainText(
+      "You are logged in as a temporary admin user.",
+    );
+
+    await goToRealm(page, "master");
+    await goToUsers(page);
+    await searchItem(page, "Search", "admin");
+    await assertRowExists(page, "admin");
+    await expect(page.locator("#temporary-admin-label")).toBeVisible();
+  });
+
+  test("Create user with groups test", async ({ page }) => {
+    await clickAddUserButton(page);
+    await fillUserForm(page, { username: userId });
+    await joinGroup(page, [groupsList[0]]);
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "The user has been created");
+  });
+
+  test("Create user with credentials test", async ({ page }) => {
+    await clickAddUserButton(page);
+    await fillUserForm(page, {
+      username: userId,
+      email: `example_${uuid()}@example.com`,
+      firstName: "firstname",
+      lastName: "lastname",
+    });
+    await clickSaveButton(page);
+    await assertNotificationMessage(page, "The user has been created");
+
+    await page.getByTestId("credentials").click();
+    await page.getByTestId("no-credentials-empty-action").click();
+    await page.getByTestId("passwordField").fill("test");
+    await page.getByTestId("passwordConfirmationField").fill("test");
+
+    await confirmModal(page);
+    await confirmModal(page);
+  });
+
+  test.describe("Existing users", () => {
+    const placeHolder = "Search user";
+    const existingUserId = `existing_user-${uuid()}`;
+    const existingUserId2 = `existing_user2-${uuid()}`;
+
+    test.beforeAll(() =>
+      Promise.all([
+        adminClient.createUser({
+          realm: realmName,
+          username: existingUserId,
+        }),
+        adminClient.createUser({
+          realm: realmName,
+          username: existingUserId2,
+        }),
+      ]),
+    );
+
+    test("Search existing user test", async ({ page }) => {
+      await searchItem(page, placeHolder, existingUserId);
+      await assertRowExists(page, existingUserId);
+    });
+
+    test("Search non-existing user test", async ({ page }) => {
+      await searchItem(page, "Search", "user_DNE");
+      await assertNoResults(page);
+    });
+
+    test("User details test", async ({ page }) => {
+      await searchItem(page, placeHolder, existingUserId);
+      await assertRowExists(page, existingUserId);
+      await clickTableRowItem(page, existingUserId);
+
+      await fillUserForm(page, {
+        email: `example_${uuid()}@example.com`,
+        firstName: "first",
+        lastName: "last",
+      });
+      await clickSaveButton(page);
+      await assertNotificationMessage(page, "The user has been saved");
+
+      await goToUsers(page);
+      await searchItem(page, placeHolder, existingUserId);
+      await assertRowExists(page, existingUserId);
+    });
+
+    const attributesName = "unmanagedAttributes";
+
+    test("Select Unmanaged attributes", async ({ page }) => {
+      await clickTableRowItem(page, existingUserId);
+
+      await goToAttributesTab(page);
+      await fillAttributeData(page, "key_test", "value_test", attributesName);
+      await clickAttributeSaveButton(page);
+      await assertNotificationMessage(page, "The user has been saved");
+
+      await fillAttributeData(page, "LDAP_ID", "value_test", attributesName, 1);
+      await fillAttributeData(
+        page,
+        "LDAP_ID",
+        "another_value_test",
+        attributesName,
+        2,
+      );
+      await clickAttributeSaveButton(page);
+      await expect(page.getByText("Update of read-only attribute")).toHaveCount(
+        2,
+      );
+      await assertNotificationMessage(page, "The user has not been saved: ");
+    });
+
+    test("User attributes with multiple values test", async ({ page }) => {
+      await clickTableRowItem(page, existingUserId2);
+
+      await goToAttributesTab(page);
+      await fillAttributeData(page, "key-multiple", "value1", attributesName);
+      await fillAttributeData(
+        page,
+        "key-multiple",
+        "value2",
+        attributesName,
+        1,
+      );
+      await clickAttributeSaveButton(page);
+      await assertNotificationMessage(page, "The user has been saved");
+      await assertAttributeLength(page, 2, attributesName);
+    });
+
+    test("Add user to groups test", async ({ page }) => {
+      await clickTableRowItem(page, existingUserId);
+
+      await goToGroupTab(page);
+      await joinGroup(page, groupsList, true);
+      await assertNotificationMessage(page, "Added group membership");
+      await assertRowExists(page, groupsList[2]);
+    });
+  });
+});
diff --git a/js/apps/admin-ui/test/users/main.ts b/js/apps/admin-ui/test/users/main.ts
new file mode 100644
index 000000000000..b83421978142
--- /dev/null
+++ b/js/apps/admin-ui/test/users/main.ts
@@ -0,0 +1,47 @@
+import { Page } from "@playwright/test";
+
+export async function clickCancelButton(page: Page) {
+  await page.getByTestId("user-creation-revert").click();
+}
+
+export async function clickSaveButton(page: Page) {
+  await page.getByTestId("user-creation-save").click();
+}
+
+export async function clickAddUserButton(page: Page) {
+  await page.getByTestId("no-users-found-empty-action").click();
+}
+
+export async function fillUserForm(
+  page: Page,
+  user: {
+    username?: string;
+    email?: string;
+    firstName?: string;
+    lastName?: string;
+  },
+) {
+  const { username, email, firstName, lastName } = user;
+  if (username) await page.getByTestId("username").fill(username);
+  if (email) await page.getByTestId("email").fill(email);
+  if (firstName) await page.getByTestId("firstName").fill(firstName);
+  if (lastName) await page.getByTestId("lastName").fill(lastName);
+}
+
+export async function goToGroupTab(page: Page) {
+  await page.getByTestId("user-groups-tab").click();
+}
+
+export async function joinGroup(page: Page, groups: string[], empty = false) {
+  if (empty) {
+    await page.getByTestId("no-groups-empty-action").click();
+  } else {
+    await page.getByTestId("join-groups-button").click();
+  }
+
+  for (const group of groups) {
+    await page.getByTestId(`${group}-check`).click();
+  }
+
+  await page.getByTestId("join-button").click();
+}
diff --git a/js/apps/admin-ui/test/utils/AdminClient.ts b/js/apps/admin-ui/test/utils/AdminClient.ts
new file mode 100644
index 000000000000..c1442e08153b
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/AdminClient.ts
@@ -0,0 +1,674 @@
+import KeycloakAdminClient from "@keycloak/keycloak-admin-client";
+import type ClientRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientRepresentation";
+import type ClientScopeRepresentation from "@keycloak/keycloak-admin-client/lib/defs/clientScopeRepresentation";
+import ComponentRepresentation from "@keycloak/keycloak-admin-client/lib/defs/componentRepresentation";
+import OrganizationRepresentation from "@keycloak/keycloak-admin-client/lib/defs/organizationRepresentation";
+import PolicyRepresentation from "@keycloak/keycloak-admin-client/lib/defs/policyRepresentation";
+import ProtocolMapperRepresentation from "@keycloak/keycloak-admin-client/lib/defs/protocolMapperRepresentation";
+import type RealmRepresentation from "@keycloak/keycloak-admin-client/lib/defs/realmRepresentation";
+import type RoleRepresentation from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
+import type { RoleMappingPayload } from "@keycloak/keycloak-admin-client/lib/defs/roleRepresentation";
+import type { UserProfileConfig } from "@keycloak/keycloak-admin-client/lib/defs/userProfileMetadata";
+import type UserRepresentation from "@keycloak/keycloak-admin-client/lib/defs/userRepresentation";
+import { Credentials } from "@keycloak/keycloak-admin-client/lib/utils/auth";
+import { merge } from "lodash-es";
+
+class AdminClient {
+  readonly #client = new KeycloakAdminClient({
+    baseUrl: "http://localhost:8080/",
+    realmName: "master",
+  });
+
+  #login() {
+    return this.#client.auth({
+      username: "admin",
+      password: "admin",
+      grantType: "password",
+      clientId: "admin-cli",
+    });
+  }
+
+  async auth(credentials: Credentials) {
+    return this.#client.auth(credentials);
+  }
+
+  async loginUser(username: string, password: string, clientId: string) {
+    return this.#client.auth({
+      username: username,
+      password: password,
+      grantType: "password",
+      clientId: clientId,
+    });
+  }
+
+  async createRealm(realm: string, payload?: RealmRepresentation) {
+    await this.#login();
+    await this.#client.realms.create({ realm, ...payload });
+  }
+
+  async updateRealm(realm: string, payload: RealmRepresentation) {
+    await this.#login();
+    await this.#client.realms.update({ realm }, payload);
+  }
+
+  async getRealm(realm: string) {
+    await this.#login();
+    return await this.#client.realms.findOne({ realm });
+  }
+
+  async deleteRealm(realm: string) {
+    await this.#login();
+    const foundRealm = await this.#client.realms.findOne({ realm });
+    if (foundRealm) {
+      await this.#client.realms.del({ realm });
+    }
+  }
+
+  async createClient(
+    client: ClientRepresentation & {
+      realm?: string;
+    },
+  ) {
+    await this.#login();
+    return await this.#client.clients.create(client);
+  }
+
+  async deleteClient(clientName: string) {
+    await this.#login();
+    const client = (
+      await this.#client.clients.find({ clientId: clientName })
+    )[0];
+
+    if (client) {
+      await this.#client.clients.del({ id: client.id! });
+    }
+  }
+
+  async getClient(clientName: string) {
+    await this.#login();
+    return (await this.#client.clients.find({ clientId: clientName }))[0];
+  }
+
+  async createGroup(groupName: string, realm: string = this.#client.realmName) {
+    await this.#login();
+    return await this.#client.groups.create({ name: groupName, realm });
+  }
+
+  async createSubGroups(groups: string[]) {
+    await this.#login();
+    let parentGroup = undefined;
+    const createdGroups = [];
+    for (const group of groups) {
+      if (!parentGroup) {
+        parentGroup = await this.#client.groups.create({ name: group });
+      } else {
+        parentGroup = await this.#client.groups.createChildGroup(
+          { id: parentGroup.id },
+          { name: group },
+        );
+      }
+      createdGroups.push(parentGroup);
+    }
+    return createdGroups;
+  }
+
+  async deleteGroups() {
+    await this.#login();
+    const groups = await this.#client.groups.find();
+    for (const group of groups) {
+      await this.#client.groups.del({ id: group.id! });
+    }
+  }
+
+  async createUser(user: UserRepresentation & { realm?: string }) {
+    await this.#login();
+
+    const { id } = await this.#client.users.create(user);
+    const createdUser = await this.#client.users.findOne({
+      id,
+      realm: user.realm || this.#client.realmName,
+    });
+
+    if (!createdUser) {
+      throw new Error(
+        "Unable to create user, created user could not be found.",
+      );
+    }
+
+    return createdUser;
+  }
+
+  async updateUser(
+    id: string,
+    payload: UserRepresentation & { realm: string },
+  ) {
+    await this.#login();
+    const { realm, ...rest } = payload;
+    const user = await this.#client.users.findOne({ id, realm });
+    return this.#client.users.update(
+      { id, realm: realm || this.#client.realmName },
+      { ...user, ...rest },
+    );
+  }
+
+  async getAdminUser() {
+    await this.#login();
+    const [user] = await this.#client.users.find({ username: "admin" });
+    return user;
+  }
+
+  async addUserToGroup(userId: string, groupId: string) {
+    await this.#login();
+    await this.#client.users.addToGroup({ id: userId, groupId });
+  }
+
+  async createUserInGroup(username: string, groupId: string) {
+    await this.#login();
+    const user = await this.createUser({ username, enabled: true });
+    await this.#client.users.addToGroup({ id: user.id!, groupId });
+  }
+
+  async addRealmRoleToUser(
+    userId: string,
+    roleName: string,
+    realmName: string = this.#client.realmName,
+  ) {
+    await this.#login();
+
+    const realmRole = await this.#client.roles.findOneByName({
+      name: roleName,
+      realm: realmName,
+    });
+
+    await this.#client.users.addRealmRoleMappings({
+      id: userId,
+      roles: [realmRole as RoleMappingPayload],
+      realm: realmName,
+    });
+  }
+
+  async addClientRoleToUser(
+    userId: string,
+    clientId: string,
+    roleNames: string[],
+    realmName: string = this.#client.realmName,
+  ) {
+    await this.#login();
+
+    const client = await this.#client.clients.find({
+      clientId,
+      realm: realmName,
+    });
+    const clientRoles = await Promise.all(
+      roleNames.map(
+        async (roleName) =>
+          (await this.#client.clients.findRole({
+            id: client[0].id!,
+            roleName: roleName,
+            realm: realmName,
+          })) as RoleMappingPayload,
+      ),
+    );
+    await this.#client.users.addClientRoleMappings({
+      id: userId,
+      clientUniqueId: client[0].id!,
+      roles: clientRoles,
+      realm: realmName,
+    });
+  }
+
+  async addRealmRoleToGroup(
+    groupId: string,
+    roleName: string,
+    realmName: string = this.#client.realmName,
+  ) {
+    await this.#login();
+
+    const realmRole = await this.#client.roles.findOneByName({
+      name: roleName,
+      realm: realmName,
+    });
+
+    await this.#client.groups.addRealmRoleMappings({
+      id: groupId,
+      roles: [realmRole as RoleMappingPayload],
+      realm: realmName,
+    });
+  }
+
+  async deleteUser(
+    username: string,
+    realm: string = this.#client.realmName,
+    ignoreNonExisting: boolean = false,
+  ) {
+    await this.#login();
+    const foundUsers = await this.#client.users.find({ username, realm });
+    if (foundUsers.length == 0) {
+      if (ignoreNonExisting) {
+        return;
+      } else {
+        throw new Error(`User not found: ${username}`);
+      }
+    }
+
+    await this.#client.users.del({ id: foundUsers[0].id!, realm });
+  }
+
+  async createClientScope(
+    scope: ClientScopeRepresentation & { realm?: string },
+  ) {
+    await this.#login();
+    return await this.#client.clientScopes.create(scope);
+  }
+
+  async addMapping(id: string, mapping: ProtocolMapperRepresentation) {
+    await this.#login();
+    return this.#client.clientScopes.addProtocolMapper({ id }, mapping);
+  }
+
+  async deleteClientScope(clientScopeName: string) {
+    await this.#login();
+    const clientScope = await this.#client.clientScopes.findOneByName({
+      name: clientScopeName,
+    });
+    return await this.#client.clientScopes.del({ id: clientScope?.id! });
+  }
+
+  async existsClientScope(clientScopeName: string) {
+    await this.#login();
+    return (await this.#client.clientScopes.findOneByName({
+      name: clientScopeName,
+    })) == undefined
+      ? false
+      : true;
+  }
+
+  async addDefaultClientScopeInClient(
+    clientScopeName: string,
+    clientId: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const scope = await this.#client.clientScopes.findOneByName({
+      realm,
+      name: clientScopeName,
+    });
+    const client = await this.#client.clients.find({
+      clientId: clientId,
+      realm,
+    });
+    return await this.#client.clients.addDefaultClientScope({
+      realm,
+      id: client[0]?.id!,
+      clientScopeId: scope?.id!,
+    });
+  }
+
+  async removeDefaultClientScopeInClient(
+    clientScopeName: string,
+    clientId: string,
+  ) {
+    await this.#login();
+    const scope = await this.#client.clientScopes.findOneByName({
+      name: clientScopeName,
+    });
+    const client = await this.#client.clients.find({ clientId: clientId });
+    return await this.#client.clients.delDefaultClientScope({
+      id: client[0]?.id!,
+      clientScopeId: scope?.id!,
+    });
+  }
+
+  async getUserProfile(realm: string) {
+    await this.#login();
+
+    return await this.#client.users.getProfile({ realm });
+  }
+
+  async addUserProfile(realm: string, userProfile: UserProfileConfig) {
+    await this.#login();
+    const currentProfile = await this.#client.users.getProfile({ realm });
+    await this.#client.users.updateProfile({
+      groups: [...(userProfile.groups || []), ...(currentProfile.groups || [])],
+      attributes: [
+        ...(userProfile.attributes || []),
+        ...(currentProfile.attributes || []),
+      ],
+      realm,
+    });
+  }
+
+  async updateUserProfile(realm: string, userProfile: UserProfileConfig) {
+    await this.#login();
+
+    await this.#client.users.updateProfile(merge(userProfile, { realm }));
+  }
+
+  async addGroupToProfile(realm: string, groupName: string) {
+    await this.#login();
+
+    const currentProfile = await this.#client.users.getProfile({ realm });
+
+    await this.#client.users.updateProfile({
+      ...currentProfile,
+      realm,
+      ...{ groups: [...currentProfile.groups!, { name: groupName }] },
+    });
+  }
+
+  async createRealmRole(payload: RoleRepresentation & { realm?: string }) {
+    await this.#login();
+
+    return await this.#client.roles.create(payload);
+  }
+
+  async createClientRole(
+    id: string,
+    payload: RoleRepresentation & { realm?: string },
+  ) {
+    await this.#login();
+
+    return await this.#client.clients.createRole({
+      id,
+      ...payload,
+    });
+  }
+
+  async createClientPolicy(
+    name: string,
+    description: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const { policies } = await this.#client.clientPolicies.listPolicies({
+      realm,
+    });
+    return await this.#client.clientPolicies.updatePolicy({
+      realm,
+      policies: [...policies!, { name, description }],
+    });
+  }
+
+  async deleteClientPolicy(
+    name: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const { policies } = await this.#client.clientPolicies.listPolicies({
+      realm,
+    });
+    return await this.#client.clientPolicies.updatePolicy({
+      realm,
+      policies: [...policies!.filter((policy) => policy.name !== name)],
+    });
+  }
+
+  async createClientProfile(
+    name: string,
+    description: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const { profiles } = await this.#client.clientPolicies.listProfiles({
+      realm,
+    });
+    return await this.#client.clientPolicies.createProfiles({
+      realm,
+      profiles: [...profiles!, { name, description }],
+    });
+  }
+
+  async deleteRealmRole(name: string, realm: string = this.#client.realmName) {
+    await this.#login();
+    return await this.#client.roles.delByName({ name, realm });
+  }
+
+  async createIdentityProvider(
+    idpDisplayName: string,
+    alias: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const identityProviders =
+      (await this.#client.serverInfo.find({ realm })).identityProviders || [];
+    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
+    await this.#client.identityProviders.create({
+      realm,
+      providerId: idp?.id!,
+      displayName: idpDisplayName,
+      alias: alias,
+    });
+  }
+
+  async deleteIdentityProvider(idpAlias: string) {
+    await this.#login();
+    await this.#client.identityProviders.del({
+      alias: idpAlias,
+    });
+  }
+
+  async unlinkAccountIdentityProvider(
+    username: string,
+    idpDisplayName: string,
+  ) {
+    await this.#login();
+    const user = await this.#client.users.find({ username });
+    const identityProviders =
+      (await this.#client.serverInfo.find()).identityProviders || [];
+    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
+    await this.#client.users.delFromFederatedIdentity({
+      id: user[0].id!,
+      federatedIdentityId: idp?.id!,
+    });
+  }
+
+  async linkAccountIdentityProvider(username: string, idpDisplayName: string) {
+    await this.#login();
+    const user = await this.#client.users.find({ username });
+    const identityProviders =
+      (await this.#client.serverInfo.find()).identityProviders || [];
+    const idp = identityProviders.find(({ name }) => name === idpDisplayName);
+    const fedIdentity = {
+      identityProvider: idp?.id,
+      userId: "testUserIdApi",
+      userName: "testUserNameApi",
+    };
+    await this.#client.users.addToFederatedIdentity({
+      id: user[0].id!,
+      federatedIdentityId: idp?.id!,
+      federatedIdentity: fedIdentity,
+    });
+  }
+
+  async addLocalizationText(
+    locale: string,
+    key: string,
+    value: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    await this.#client.realms.addLocalization(
+      { realm, selectedLocale: locale, key: key },
+      value,
+    );
+  }
+
+  async removeAllLocalizationTexts() {
+    await this.#login();
+    const localesWithTexts = await this.#client.realms.getRealmSpecificLocales({
+      realm: this.#client.realmName,
+    });
+    await Promise.all(
+      localesWithTexts.map((locale) =>
+        this.#client.realms.deleteRealmLocalizationTexts({
+          realm: this.#client.realmName,
+          selectedLocale: locale,
+        }),
+      ),
+    );
+  }
+
+  async inRealm<T>(realm: string, fn: () => Promise<T>) {
+    const prevRealm = this.#client.realmName;
+    this.#client.realmName = realm;
+    try {
+      return await fn();
+    } finally {
+      this.#client.realmName = prevRealm;
+    }
+  }
+
+  async createOrganization(
+    org: OrganizationRepresentation & { realm?: string },
+  ) {
+    await this.#login();
+    await this.#client.organizations.create(org);
+  }
+
+  async deleteOrganization(
+    name: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    const found = await this.#client.organizations.find({
+      search: name,
+      realm,
+    });
+    if (found.length !== 0) {
+      await this.#client.organizations.delById({ id: found[0].id!, realm });
+    }
+  }
+
+  async copyFlow(
+    name: string,
+    newName: string,
+    realmName: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    await this.#client.authenticationManagement.copyFlow({
+      flow: name,
+      newName: newName,
+      realm: realmName,
+    });
+  }
+
+  async getFlow(name: string, realmName: string = this.#client.realmName) {
+    await this.#login();
+    const flows = await this.#client.authenticationManagement.getFlows({
+      realm: realmName,
+    });
+    return flows.find((flow) => flow.alias === name);
+  }
+
+  async deleteFlow(name: string, realmName: string = this.#client.realmName) {
+    await this.#login();
+    const flows = await this.#client.authenticationManagement.getFlows({
+      realm: realmName,
+    });
+    const flow = flows.find((f) => f.alias === name)!;
+    if (flow) {
+      await this.#client.authenticationManagement.deleteFlow({
+        flowId: flow.id!,
+        realm: realmName,
+      });
+    }
+  }
+
+  async deleteAllTokens(realm: string = this.#client.realmName) {
+    await this.#login();
+    const tokens = await this.#client.realms.getClientsInitialAccess({ realm });
+    for (const token of tokens) {
+      await this.#client.realms.delClientsInitialAccess({
+        realm: realm,
+        id: token.id!,
+      });
+    }
+  }
+
+  async addKeyProvider(
+    name: string,
+    active: boolean,
+    enabled: boolean,
+    providerType: string,
+    realm: string = this.#client.realmName,
+  ) {
+    await this.#login();
+    await this.#client.components.create({
+      realm,
+      name,
+      config: {
+        enabled: [`${enabled}`],
+        active: [`${active}`],
+        priority: ["0"],
+      },
+      providerId: providerType,
+      providerType: "org.keycloak.keys.KeyProvider",
+    });
+  }
+
+  async createUserFederation(
+    realmName: string,
+    federatedIdentity: ComponentRepresentation,
+  ) {
+    await this.#login();
+    const realm = await this.#client.realms.findOne({
+      realm: realmName,
+    });
+    if (!realm) {
+      throw new Error(`Realm ${realmName} not found`);
+    }
+
+    await this.#client.components.create({
+      realm: realmName,
+      parentId: realm.id,
+      providerType: "org.keycloak.storage.UserStorageProvider",
+      ...federatedIdentity,
+    });
+  }
+
+  async #getPermissionClient(realm: string = this.#client.realmName) {
+    const clients = await this.#client.clients.find({
+      realm,
+      clientId: "admin-permissions",
+    });
+    if (clients.length === 0)
+      throw new Error("Client admin-permissions not found");
+    return clients[0];
+  }
+
+  async createPermission({
+    realm,
+    ...permission
+  }: PolicyRepresentation & { realm?: string }) {
+    await this.#login();
+    const client = await this.#getPermissionClient(realm);
+    await this.#client.clients.createPermission(
+      { id: client.id!, type: "scope", realm },
+      permission,
+    );
+  }
+
+  async createUserPolicy({
+    username,
+    realm,
+    ...policy
+  }: PolicyRepresentation & { realm?: string; username: string }) {
+    await this.#login();
+    const user = await this.#client.users.find({ username, realm });
+    if (user.length === 0) {
+      throw new Error(`User ${username} not found`);
+    }
+    const client = await this.#getPermissionClient(realm);
+    return this.#client.clients.createPolicy(
+      { id: client.id!, type: policy.type!, realm },
+      {
+        users: [user[0].id!],
+        ...policy,
+      },
+    );
+  }
+}
+
+const adminClient = new AdminClient();
+
+export default adminClient;
diff --git a/js/apps/admin-ui/test/utils/attributes.ts b/js/apps/admin-ui/test/utils/attributes.ts
new file mode 100644
index 000000000000..fb6a68470fc5
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/attributes.ts
@@ -0,0 +1,54 @@
+import { Page, expect } from "@playwright/test";
+
+export async function goToAttributesTab(page: Page) {
+  await page.getByTestId("attributesTab").click();
+}
+
+function getAttribute(
+  page: Page,
+  index: number,
+  key: string,
+  name: string = "attributes",
+) {
+  return page.locator(`input[name="${name}\\.${index}\\.${key}"]`);
+}
+
+export async function fillAttributeData(
+  page: Page,
+  key: string,
+  value: string,
+  name: string = "attributes",
+  index: number = 0,
+) {
+  await page.getByTestId(`${name}-add-row`).click();
+
+  await getAttribute(page, index, "key", name).fill(key);
+  await getAttribute(page, index, "value", name).fill(value);
+}
+
+export async function deleteAttribute(page: Page, row: number) {
+  await page.getByTestId("attributes-remove").nth(row).click();
+}
+
+export async function clickAttributeSaveButton(page: Page) {
+  await page.getByTestId("attributes-save").click();
+}
+
+export async function assertAttributeLength(
+  page: Page,
+  length: number,
+  name: string = "attributes",
+) {
+  const rows = await page.getByTestId(`${name}-key`).all();
+  expect(rows.length).toBe(length);
+}
+
+export async function assertAttribute(
+  page: Page,
+  key: string,
+  value: string,
+  index: number = 0,
+) {
+  await expect(getAttribute(page, index, "key")).toHaveValue(key);
+  await expect(getAttribute(page, index, "value")).toHaveValue(value);
+}
diff --git a/js/apps/admin-ui/test/utils/constants.ts b/js/apps/admin-ui/test/utils/constants.ts
new file mode 100644
index 000000000000..1c059f438f4a
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/constants.ts
@@ -0,0 +1,5 @@
+export const SERVER_URL = "http://localhost:8080";
+export const ROOT_PATH = "/admin/:realm/console";
+export const DEFAULT_REALM = "master";
+export const ADMIN_USER = "admin";
+export const ADMIN_PASSWORD = "admin";
diff --git a/js/apps/admin-ui/test/utils/file-chooser.ts b/js/apps/admin-ui/test/utils/file-chooser.ts
new file mode 100644
index 000000000000..65e4bc84c29f
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/file-chooser.ts
@@ -0,0 +1,11 @@
+import { Page } from "@playwright/test";
+import path from "path";
+
+export async function chooseFile(page: Page, file: string) {
+  const fileChooserPromise = page.waitForEvent("filechooser");
+  await page.getByText("Browse...").click();
+  const fileChooser = await fileChooserPromise;
+  await fileChooser.setFiles(
+    new URL(path.join(path.dirname(import.meta.url), file)).pathname,
+  );
+}
diff --git a/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/client-only.json b/js/apps/admin-ui/test/utils/files/client-only.json
similarity index 100%
rename from js/apps/admin-ui/cypress/fixtures/partial-import-test-data/client-only.json
rename to js/apps/admin-ui/test/utils/files/client-only.json
diff --git a/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/import-identical-client.json b/js/apps/admin-ui/test/utils/files/import-identical-client.json
similarity index 100%
rename from js/apps/admin-ui/cypress/fixtures/partial-import-test-data/import-identical-client.json
rename to js/apps/admin-ui/test/utils/files/import-identical-client.json
diff --git a/js/apps/admin-ui/cypress/fixtures/partial-import-test-data/multi-realm.json b/js/apps/admin-ui/test/utils/files/multi-realm.json
similarity index 100%
rename from js/apps/admin-ui/cypress/fixtures/partial-import-test-data/multi-realm.json
rename to js/apps/admin-ui/test/utils/files/multi-realm.json
diff --git a/js/apps/admin-ui/test/utils/form.ts b/js/apps/admin-ui/test/utils/form.ts
new file mode 100644
index 000000000000..92f9417561ff
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/form.ts
@@ -0,0 +1,86 @@
+import { expect, Locator, Page } from "@playwright/test";
+
+export async function assertRequiredFieldError(page: Page, field: string) {
+  await expect(page.getByTestId(field + "-helper")).toHaveText(/required/i);
+}
+
+export async function assertFieldError(
+  page: Page,
+  field: string,
+  text: string,
+) {
+  await expect(page.getByTestId(field + "-helper")).toHaveText(text);
+}
+
+export async function selectItem(
+  page: Page,
+  field: Locator | string,
+  value: string,
+) {
+  const element = typeof field === "string" ? page.locator(field) : field;
+  await element.click();
+  await page.getByRole("option", { name: value, exact: true }).click();
+}
+
+export async function assertSelectValue(field: Locator, value: string) {
+  const text = field;
+  await expect(text).toHaveText(value);
+}
+
+export async function switchOn(page: Page, id: string | Locator) {
+  const switchElement = typeof id === "string" ? page.locator(id) : id;
+  await switchElement.click({ force: true });
+  await expect(switchElement).toBeChecked();
+}
+
+export async function switchOff(page: Page, id: string | Locator) {
+  const switchElement = typeof id === "string" ? page.locator(id) : id;
+  await expect(switchElement).toBeChecked();
+  await switchElement.click({ force: true });
+}
+
+export async function switchToggle(page: Page, id: string | Locator) {
+  const switchElement = typeof id === "string" ? page.locator(id) : id;
+  await switchElement.click({ force: true });
+}
+
+export async function assertSwitchIsChecked(
+  page: Page,
+  id: string,
+  not = false,
+) {
+  if (not) {
+    await expect(page.locator(id)).not.toBeChecked();
+  } else {
+    await expect(page.locator(id)).toBeChecked();
+  }
+}
+
+function getSaveButton(page: Page) {
+  return page.getByTestId("save");
+}
+
+export async function clickSaveButton(page: Page) {
+  await getSaveButton(page).click();
+}
+
+export async function assertSaveButtonIsDisabled(page: Page) {
+  await expect(getSaveButton(page)).toBeDisabled();
+}
+
+export async function clickCancelButton(page: Page) {
+  await page.getByTestId("cancel").click();
+}
+
+async function clickOption(page: Page, option: string) {
+  await page.getByRole("option", { name: option }).click();
+}
+
+export async function changeTimeUnit(
+  page: Page,
+  unit: "Minutes" | "Hours" | "Days",
+  inputType: string,
+) {
+  await page.locator(inputType).click();
+  await clickOption(page, unit);
+}
diff --git a/js/apps/admin-ui/test/utils/login.ts b/js/apps/admin-ui/test/utils/login.ts
new file mode 100644
index 000000000000..79f1ddf3d22f
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/login.ts
@@ -0,0 +1,28 @@
+import { Page } from "@playwright/test";
+
+import {
+  ADMIN_PASSWORD,
+  ADMIN_USER,
+  DEFAULT_REALM,
+  SERVER_URL,
+  ROOT_PATH,
+} from "./constants";
+
+export const login = async (
+  page: Page,
+  username = ADMIN_USER,
+  password = ADMIN_PASSWORD,
+  realm = DEFAULT_REALM,
+) => {
+  const rootPath = SERVER_URL + ROOT_PATH.replace(":realm", realm);
+
+  await page.goto(rootPath);
+  await page.getByLabel("Username").fill(username);
+  await page.getByLabel("Password", { exact: true }).fill(password);
+  await page.getByRole("button", { name: "Sign In" }).click();
+};
+
+export const logout = async (page: Page, username: string = "admin") => {
+  await page.getByRole("button", { name: username, exact: true }).click();
+  await page.getByRole("menuitem", { name: "Sign out" }).click();
+};
diff --git a/js/apps/admin-ui/test/utils/masthead.ts b/js/apps/admin-ui/test/utils/masthead.ts
new file mode 100644
index 000000000000..a77a89c80a9f
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/masthead.ts
@@ -0,0 +1,25 @@
+import AxeBuilder from "@axe-core/playwright";
+import { expect, Page } from "@playwright/test";
+
+export async function assertNotificationMessage(page: Page, message: string) {
+  await expect(page.getByTestId("last-alert")).toHaveText(message);
+}
+
+function getActionToggleButton(page: Page) {
+  return page.getByTestId("action-dropdown");
+}
+
+export async function selectActionToggleItem(page: Page, item: string) {
+  await getActionToggleButton(page).click();
+  await page.getByRole("menuitem", { name: item, exact: true }).click();
+}
+
+export async function assertAxeViolations(page: Page) {
+  let { violations } = await new AxeBuilder({ page }).analyze();
+  violations = violations.filter(
+    (v) => v.impact === "critical" || v.impact === "serious",
+  );
+  if (violations.length !== 0) console.info(violations);
+
+  expect(violations.length, violations.map((v) => v.help).join("\n")).toBe(0);
+}
diff --git a/js/apps/admin-ui/test/utils/modal.ts b/js/apps/admin-ui/test/utils/modal.ts
new file mode 100644
index 000000000000..f2f33118040d
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/modal.ts
@@ -0,0 +1,21 @@
+import { expect, Page } from "@playwright/test";
+
+export async function assertModalTitle(page: Page, title: string) {
+  await expect(page.getByText(title, { exact: true })).toBeVisible();
+}
+
+export async function assertModalMessage(page: Page, message: string) {
+  await expect(page.getByText(message, { exact: true })).toBeVisible();
+}
+
+export async function confirmModal(page: Page) {
+  await page.getByTestId("confirm").click();
+}
+
+export async function cancelModal(page: Page) {
+  await page.getByTestId("cancel").click();
+}
+
+export async function clickAdd(page: Page) {
+  await page.getByTestId("add").click();
+}
diff --git a/js/apps/admin-ui/test/utils/roles.ts b/js/apps/admin-ui/test/utils/roles.ts
new file mode 100644
index 000000000000..9ec266ac7cbb
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/roles.ts
@@ -0,0 +1,39 @@
+import { Page } from "@playwright/test";
+import { clickSelectRow } from "./table";
+
+export type RoleType = "client" | "roles";
+const rolePickTableName = "Role list";
+
+export async function pickRoleType(page: Page, roleType: RoleType) {
+  await page.getByTestId("add-role-mapping-button").click();
+
+  let filter;
+  if (roleType === "client") {
+    filter = "Client roles";
+  } else {
+    filter = "Realm roles";
+  }
+
+  await page.getByRole("menuitem", { name: filter, exact: true }).click();
+}
+
+export async function pickRole(
+  page: Page,
+  roleName: string,
+  dialog: boolean = false,
+) {
+  const name = dialog ? "Associated roles" : rolePickTableName;
+  await clickSelectRow(page, name, roleName);
+}
+
+export async function confirmModalAssign(page: Page) {
+  await page.getByTestId("assign").click();
+}
+
+export async function clickHideInheritedRoles(page: Page) {
+  await page.getByTestId("hideInheritedRoles").click();
+}
+
+export async function clickUnassign(page: Page) {
+  await page.getByTestId("unAssignRole").click();
+}
diff --git a/js/apps/admin-ui/test/utils/sidebar.ts b/js/apps/admin-ui/test/utils/sidebar.ts
new file mode 100644
index 000000000000..26f133f115c6
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/sidebar.ts
@@ -0,0 +1,62 @@
+import { Page } from "@playwright/test";
+import { clickTableRowItem } from "./table";
+
+export async function goToRealm(page: Page, realmName: string) {
+  const currentRealm = await page.getByTestId("currentRealm").textContent();
+  if (currentRealm !== realmName) {
+    await goToRealms(page);
+    await clickTableRowItem(page, realmName);
+  }
+}
+
+export async function goToRealms(page: Page) {
+  await page.getByTestId("nav-item-realms").click();
+}
+
+export async function goToOrganizations(page: Page) {
+  await page.getByTestId("nav-item-organizations").click();
+}
+
+export async function goToClients(page: Page) {
+  await page.getByTestId("nav-item-clients").click();
+}
+
+export async function goToClientScopes(page: Page) {
+  await page.getByTestId("nav-item-client-scopes").click();
+}
+
+export async function goToRealmRoles(page: Page) {
+  await page.getByTestId("nav-item-roles").click();
+}
+
+export async function goToUsers(page: Page) {
+  await page.getByTestId("nav-item-users").click();
+}
+
+export async function goToGroups(page: Page) {
+  await page.getByTestId("nav-item-groups").click();
+}
+
+export async function goToSessions(page: Page) {
+  await page.getByTestId("nav-item-sessions").click();
+}
+
+export async function goToEvents(page: Page) {
+  await page.getByTestId("nav-item-events").click();
+}
+
+export async function goToRealmSettings(page: Page) {
+  await page.getByTestId("nav-item-realm-settings").click();
+}
+
+export async function goToAuthentication(page: Page) {
+  await page.getByTestId("nav-item-authentication").click();
+}
+
+export async function goToIdentityProviders(page: Page) {
+  await page.getByTestId("nav-item-identity-providers").click();
+}
+
+export async function goToUserFederation(page: Page) {
+  await page.getByTestId("nav-item-user-federation").click();
+}
diff --git a/js/apps/admin-ui/test/utils/table.ts b/js/apps/admin-ui/test/utils/table.ts
new file mode 100644
index 000000000000..b897c6225317
--- /dev/null
+++ b/js/apps/admin-ui/test/utils/table.ts
@@ -0,0 +1,121 @@
+import { Locator, Page, expect } from "@playwright/test";
+
+export async function searchItem(
+  page: Page,
+  placeHolder: string,
+  itemName: string,
+) {
+  await page.locator("table tbody").waitFor();
+  await page.getByPlaceholder(placeHolder).fill(itemName);
+  await page.keyboard.press("Enter");
+}
+
+export async function clearAllFilters(page: Page) {
+  await page.getByTestId("clear-all-filters-empty-action").click();
+}
+
+export async function clickTableRowItem(page: Page, itemName: string) {
+  await page.getByRole("link", { name: itemName }).first().click();
+}
+
+export function getRowByCellText(page: Page, cellText: string): Locator {
+  return page.getByText(cellText, { exact: true });
+}
+
+export async function clickRowKebabItem(
+  page: Page,
+  itemName: string,
+  action: string,
+) {
+  await page
+    .getByRole("row", { name: itemName })
+    .getByLabel("Kebab toggle")
+    .click();
+  await page.getByRole("menuitem", { name: action }).click();
+}
+
+export async function assertRowExists(
+  page: Page,
+  itemName: string,
+  exist = true,
+) {
+  if (exist) {
+    await expect(page.getByRole("row", { name: itemName })).toBeVisible();
+  } else {
+    await expect(page.getByRole("row", { name: itemName })).toBeHidden();
+  }
+}
+
+export async function assertNoResults(page: Page) {
+  await expect(
+    page.getByRole("heading", { name: "No search results" }),
+  ).toBeVisible();
+}
+
+export async function clickTableToolbarItem(
+  page: Page,
+  itemName: string,
+  kebab = false,
+) {
+  if (kebab) {
+    await page.getByTestId("kebab").click();
+  }
+  return page
+    .locator(`[data-testid="table-toolbar"]`)
+    .getByText(itemName)
+    .click();
+}
+
+export async function getTableData(page: Page, name: string) {
+  const table = page
+    .getByRole("grid")
+    .and(page.getByLabel(name, { exact: true }));
+  await table.locator("tbody").waitFor();
+  const rows = await table.locator("tbody tr").elementHandles();
+
+  const tableData = await Promise.all(
+    rows.map(async (row) => {
+      const cells = await row.$$("td");
+      return await Promise.all(cells.map((cell) => cell.innerText()));
+    }),
+  );
+  return tableData;
+}
+
+export async function clickNextPageButton(page: Page) {
+  await page
+    .getByLabel("Pagination bottom")
+    .getByLabel("Go to next page")
+    .click();
+}
+
+export async function assertEmptyTable(page: Page) {
+  await expect(page.getByTestId("empty-state")).toBeVisible();
+}
+
+export async function clickSelectRow(
+  page: Page,
+  tableName: string,
+  row: number | string,
+) {
+  if (typeof row === "string") {
+    const rows = await getTableData(page, tableName);
+    const rowIndex = rows.findIndex((r) => r.includes(row as string));
+    if (rowIndex === -1) {
+      throw new Error(`Row ${row} not found: ${rows}`);
+    }
+    row = rowIndex;
+  }
+  await page.getByLabel(tableName).getByLabel(`Select row ${row}`).click();
+}
+
+export async function expandRow(page: Page, tableName: string, row: number) {
+  await page
+    .getByLabel(tableName)
+    .locator(`button[id="expandable-row-${row}"]`)
+    .click();
+}
+
+export async function refreshTable(page: Page) {
+  await page.getByTestId("refresh").click();
+}
diff --git a/js/apps/admin-ui/vite.config.ts b/js/apps/admin-ui/vite.config.ts
index 50d33fa5a638..95dec2997040 100644
--- a/js/apps/admin-ui/vite.config.ts
+++ b/js/apps/admin-ui/vite.config.ts
@@ -1,20 +1,52 @@
 import react from "@vitejs/plugin-react-swc";
+import { readFileSync } from "node:fs";
 import path from "path";
+import { getProperties } from "properties-file";
 import { defineConfig, loadEnv } from "vite";
 import { checker } from "vite-plugin-checker";
 import dts from "vite-plugin-dts";
+import { configDefaults } from "vitest/config";
 
 // https://vitejs.dev/config/
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), "");
   const external = ["react", "react/jsx-runtime", "react-dom"];
-  const plugins = [react(), checker({ typescript: true })];
+  const plugins = [
+    react(),
+    checker({ typescript: true }),
+    {
+      name: "message-bundle-transformer",
+      resolveId(source) {
+        if (source === "message-bundle") {
+          return source;
+        }
+        return null;
+      },
+      load(id) {
+        if (id === "message-bundle") {
+          let properties = {};
+          if (process.env.NODE_ENV === "development") {
+            properties = getProperties(
+              readFileSync(
+                "./maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties",
+              ),
+            );
+          }
+          return {
+            code: `export default ${JSON.stringify(properties)};`,
+          };
+        }
+        return null;
+      },
+    },
+  ];
   const input = env.LIB ? undefined : "src/main.tsx";
   if (env.LIB) {
     external.push("react-router-dom");
     external.push("react-i18next");
     plugins.push(dts({ insertTypesEntry: true }));
   }
+
   const lib = env.LIB
     ? {
         outDir: "lib",
@@ -49,6 +81,7 @@ export default defineConfig(({ mode }) => {
     test: {
       watch: false,
       environment: "jsdom",
+      exclude: [...configDefaults.exclude, "./test/**"],
       server: {
         deps: {
           inline: [/@patternfly\/.*/],
diff --git a/js/apps/create-keycloak-theme/package.json b/js/apps/create-keycloak-theme/package.json
index 12bcfc8f82ff..04e63164b843 100644
--- a/js/apps/create-keycloak-theme/package.json
+++ b/js/apps/create-keycloak-theme/package.json
@@ -15,9 +15,9 @@
   },
   "dependencies": {
     "chalk": "^5.4.1",
-    "commander": "^12.1.0",
-    "fs-extra": "^11.2.0",
+    "commander": "^14.0.0",
+    "fs-extra": "^11.3.0",
     "mustache": "^4.2.0",
-    "simple-git": "^3.27.0"
+    "simple-git": "^3.28.0"
   }
 }
diff --git a/js/apps/create-keycloak-theme/templates/maven-resources/theme/my-account/account/index.ftl.mu b/js/apps/create-keycloak-theme/templates/maven-resources/theme/my-account/account/index.ftl.mu
index 5f65e15c6cc8..e45bb5864e10 100644
--- a/js/apps/create-keycloak-theme/templates/maven-resources/theme/my-account/account/index.ftl.mu
+++ b/js/apps/create-keycloak-theme/templates/maven-resources/theme/my-account/account/index.ftl.mu
@@ -134,7 +134,7 @@
           "isRegistrationEmailAsUsername": ${realm.registrationEmailAsUsername?c},
           "isEditUserNameAllowed": ${realm.editUsernameAllowed?c},
           "isInternationalizationEnabled": ${realm.isInternationalizationEnabled()?c},
-          "isLinkedAccountsEnabled": ${realm.identityFederationEnabled?c},
+          "isLinkedAccountsEnabled": ${isLinkedAccountsEnabled?c},
           "isMyResourcesEnabled": ${(realm.userManagedAccessAllowed && isAuthorizationEnabled)?c},
           "isViewOrganizationsEnabled": ${isViewOrganizationsEnabled?c},
           "deleteAccountAllowed": ${deleteAccountAllowed?c},
diff --git a/js/apps/keycloak-server/README.md b/js/apps/keycloak-server/README.md
index 9a389034b604..c6d2986940e6 100644
--- a/js/apps/keycloak-server/README.md
+++ b/js/apps/keycloak-server/README.md
@@ -51,7 +51,4 @@ KC_FEATURES=login:v2,account:v3,admin-fine-grained-authz,transient-users,oid4vc-
 
 **All other arguments will be passed through to the underlying Keycloak server.**
 
-In order for the development version of the Admin UI to work you will have to import a custom client to the Keycloak server. This is only required during development as the development server for the Admin UI runs on a different port. This client will be imported automatically under the name `security-admin-console-v2` when the Keycloak server starts.
-
-This client only allows redirects from/to "localhost:8080" so be sure either modify the client json in `./scripts` or only attempt to authenticate and redirect from that address
 
diff --git a/js/apps/keycloak-server/package.json b/js/apps/keycloak-server/package.json
index 469faadef521..0c81cd5453f9 100644
--- a/js/apps/keycloak-server/package.json
+++ b/js/apps/keycloak-server/package.json
@@ -8,10 +8,10 @@
     "delete-server": "rm -r ./server"
   },
   "dependencies": {
-    "@octokit/rest": "^21.1.0",
+    "@octokit/rest": "^22.0.0",
     "@types/gunzip-maybe": "^1.4.2",
     "@types/tar-fs": "^2.0.4",
     "gunzip-maybe": "^1.4.2",
-    "tar-fs": "^3.0.7"
+    "tar-fs": "^3.1.0"
   }
 }
diff --git a/js/apps/keycloak-server/scripts/start-server.js b/js/apps/keycloak-server/scripts/start-server.js
index 78be00035782..d7b6e6a40d1d 100755
--- a/js/apps/keycloak-server/scripts/start-server.js
+++ b/js/apps/keycloak-server/scripts/start-server.js
@@ -60,7 +60,7 @@ async function startServer() {
     path.join(SERVER_DIR, `bin/kc${SCRIPT_EXTENSION}`),
     [
       "start-dev",
-      `--features="login:v2,account:v3,admin-fine-grained-authz,transient-users,oid4vc-vci,organization"`,
+      `--features="login:v2,account:v3,admin-fine-grained-authz:v2,transient-users,oid4vc-vci,organization,declarative-ui,quick-theme"`,
       ...keycloakArgs,
     ],
     {
diff --git a/js/eslint.config.js b/js/eslint.config.js
index 2aa0fdcf6977..103fc0ba13ca 100644
--- a/js/eslint.config.js
+++ b/js/eslint.config.js
@@ -2,7 +2,6 @@
 import { fixupPluginRules } from "@eslint/compat";
 import { FlatCompat } from "@eslint/eslintrc";
 import eslint from "@eslint/js";
-import mochaPlugin from "eslint-plugin-mocha";
 import playwright from "eslint-plugin-playwright";
 import prettierRecommended from "eslint-plugin-prettier/recommended";
 import reactCompiler from "eslint-plugin-react-compiler";
@@ -22,8 +21,6 @@ export default tseslint.config(
       "**/lib/",
       "**/target/",
       "./apps/keycloak-server/server/",
-      // Keycloak JS follows a completely different and outdated style, so we'll exclude it for now.
-      "./libs/keycloak-js/",
     ],
   },
   eslint.configs.recommended,
@@ -69,7 +66,6 @@ export default tseslint.config(
       "@typescript-eslint/no-dynamic-delete": "off",
       "@typescript-eslint/no-explicit-any": "off",
       "@typescript-eslint/no-extraneous-class": "off",
-      "@typescript-eslint/no-floating-promises": "off",
       "@typescript-eslint/no-inferrable-types": "off",
       "@typescript-eslint/no-invalid-void-type": "off",
       "@typescript-eslint/no-misused-promises": "off",
@@ -139,29 +135,9 @@ export default tseslint.config(
       "lodash/import-scope": ["error", "member"],
     },
   },
-  ...[
-    ...compat.extends("plugin:cypress/recommended"),
-    mochaPlugin.configs.flat.recommended,
-  ].map((config) => ({
-    ...config,
-    files: ["**/cypress/**/*"],
-  })),
-  {
-    files: ["**/cypress/**/*"],
-    // TODO: Set these rules to "error" when issues have been resolved.
-    rules: {
-      "cypress/no-unnecessary-waiting": "warn",
-      "cypress/unsafe-to-chain-command": "warn",
-      "mocha/max-top-level-suites": "off",
-      "mocha/no-exclusive-tests": "error",
-      "mocha/no-identical-title": "off",
-      "mocha/no-mocha-arrows": "off",
-      "mocha/no-setup-in-describe": "off",
-    },
-  },
   {
     ...playwright.configs["flat/recommended"],
-    files: ["apps/account-ui/test/**"],
+    files: ["apps/account-ui/test/**", "apps/admin-ui/test/**"],
   },
   {
     files: ["libs/keycloak-admin-client/test/**"],
diff --git a/js/libs/keycloak-admin-client/package.json b/js/libs/keycloak-admin-client/package.json
index 083574137a50..efb42a73f439 100644
--- a/js/libs/keycloak-admin-client/package.json
+++ b/js/libs/keycloak-admin-client/package.json
@@ -44,14 +44,14 @@
     "url-template": "^3.1.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^9.3.0",
-    "@types/chai": "^5.0.1",
+    "@faker-js/faker": "^9.9.0",
+    "@types/chai": "^5.2.2",
     "@types/lodash-es": "^4.17.12",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^22.10.6",
-    "chai": "^5.1.2",
+    "@types/node": "^24.0.12",
+    "chai": "^5.2.0",
     "lodash-es": "^4.17.21",
-    "mocha": "^11.0.1",
+    "mocha": "^11.7.1",
     "ts-node": "^10.9.2"
   },
   "author": {
diff --git a/js/libs/keycloak-admin-client/src/defs/credentialRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/credentialRepresentation.ts
index c5438f11659c..a9c8bc6577de 100644
--- a/js/libs/keycloak-admin-client/src/defs/credentialRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/credentialRepresentation.ts
@@ -12,4 +12,5 @@ export default interface CredentialRepresentation {
   type?: string;
   userLabel?: string;
   value?: string;
+  federationLink?: string;
 }
diff --git a/js/libs/keycloak-admin-client/src/defs/evaluationResultRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/evaluationResultRepresentation.ts
index 689af48f75fe..8a57ae0dcba1 100644
--- a/js/libs/keycloak-admin-client/src/defs/evaluationResultRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/evaluationResultRepresentation.ts
@@ -9,4 +9,5 @@ export default interface EvaluationResultRepresentation {
   policies?: PolicyResultRepresentation[];
   status?: DecisionEffect;
   allowedScopes?: ScopeRepresentation[];
+  deniedScopes?: ScopeRepresentation[];
 }
diff --git a/js/libs/keycloak-admin-client/src/defs/groupRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/groupRepresentation.ts
index 691b35e8574b..4cb184cea7e7 100644
--- a/js/libs/keycloak-admin-client/src/defs/groupRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/groupRepresentation.ts
@@ -5,6 +5,7 @@
 export default interface GroupRepresentation {
   id?: string;
   name?: string;
+  description?: string;
   path?: string;
   subGroupCount?: number;
   subGroups?: GroupRepresentation[];
diff --git a/js/libs/keycloak-admin-client/src/defs/keystoreConfig.ts b/js/libs/keycloak-admin-client/src/defs/keystoreConfig.ts
index 5c11410ed801..09f89df643a8 100644
--- a/js/libs/keycloak-admin-client/src/defs/keystoreConfig.ts
+++ b/js/libs/keycloak-admin-client/src/defs/keystoreConfig.ts
@@ -8,4 +8,6 @@ export default interface KeyStoreConfig {
   keyAlias?: string;
   realmAlias?: string;
   format?: string;
+  keySize?: number;
+  validity?: number;
 }
diff --git a/js/libs/keycloak-admin-client/src/defs/memberRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/memberRepresentation.ts
new file mode 100644
index 000000000000..8dc9fe6ed843
--- /dev/null
+++ b/js/libs/keycloak-admin-client/src/defs/memberRepresentation.ts
@@ -0,0 +1,5 @@
+import type UserRepresentation from "./userRepresentation.js";
+
+export default interface MemberRepresentation extends UserRepresentation {
+  membershipType?: string;
+}
diff --git a/js/libs/keycloak-admin-client/src/defs/organizationRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/organizationRepresentation.ts
index 331256b7fcc3..2ebaa7bcf24b 100644
--- a/js/libs/keycloak-admin-client/src/defs/organizationRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/organizationRepresentation.ts
@@ -1,11 +1,16 @@
 import type OrganizationDomainRepresentation from "./organizationDomainRepresentation.js";
+import type IdentityProviderRepresentation from "./identityProviderRepresentation.js";
+import type MemberRepresentation from "./memberRepresentation.js";
 
 export default interface OrganizationRepresentation {
   id?: string;
   name?: string;
+  alias?: string;
   description?: string;
   redirectUrl?: string;
   enabled?: boolean;
   attributes?: Record<string, string[]>;
   domains?: OrganizationDomainRepresentation[];
+  members?: MemberRepresentation[];
+  identityProviders?: IdentityProviderRepresentation[];
 }
diff --git a/js/libs/keycloak-admin-client/src/defs/policyRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/policyRepresentation.ts
index 7b4158989e1b..3018adae780b 100644
--- a/js/libs/keycloak-admin-client/src/defs/policyRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/policyRepresentation.ts
@@ -37,4 +37,5 @@ export default interface PolicyRepresentation {
   type?: string;
   users?: string[];
   roles?: PolicyRoleRepresentation[];
+  resourceType?: string;
 }
diff --git a/js/libs/keycloak-admin-client/src/defs/realmRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/realmRepresentation.ts
index 4600a3d0ccca..a09979a895ec 100644
--- a/js/libs/keycloak-admin-client/src/defs/realmRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/realmRepresentation.ts
@@ -24,6 +24,7 @@ export default interface RealmRepresentation {
   actionTokenGeneratedByUserLifespan?: number;
   adminEventsDetailsEnabled?: boolean;
   adminEventsEnabled?: boolean;
+  adminPermissionsClient?: ClientRepresentation;
   adminPermissionsEnabled?: boolean;
   adminTheme?: string;
   attributes?: Record<string, any>;
diff --git a/js/libs/keycloak-admin-client/src/defs/resourceEvaluation.ts b/js/libs/keycloak-admin-client/src/defs/resourceEvaluation.ts
index e3f02fad896c..00feb2dce01f 100644
--- a/js/libs/keycloak-admin-client/src/defs/resourceEvaluation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/resourceEvaluation.ts
@@ -2,9 +2,10 @@ import type ResourceRepresentation from "./resourceRepresentation.js";
 
 export default interface ResourceEvaluation {
   roleIds?: string[];
-  clientId: string;
+  clientId?: string;
   userId: string;
   resources?: ResourceRepresentation[];
+  resourceType?: string;
   entitlements: boolean;
   context: {
     attributes: {
diff --git a/js/libs/keycloak-admin-client/src/defs/resourceServerRepresentation.ts b/js/libs/keycloak-admin-client/src/defs/resourceServerRepresentation.ts
index eb0cc90543c7..9f16361d03df 100644
--- a/js/libs/keycloak-admin-client/src/defs/resourceServerRepresentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/resourceServerRepresentation.ts
@@ -10,16 +10,24 @@ export default interface ResourceServerRepresentation {
   clientId?: string;
   name?: string;
   allowRemoteResourceManagement?: boolean;
+  authorizationSchema?: AuthorizationSchemaRepresentation;
   policyEnforcementMode?: PolicyEnforcementMode;
   resources?: ResourceRepresentation[];
   policies?: PolicyRepresentation[];
   scopes?: ScopeRepresentation[];
   decisionStrategy?: DecisionStrategy;
 }
+export interface AuthorizationSchemaRepresentation {
+  resourceTypes?: ResourceTypesRepresentation[];
+}
 export interface ResourceOwnerRepresentation {
   id?: string;
   name?: string;
 }
+export interface ResourceTypesRepresentation {
+  type?: string;
+  scopes?: string[];
+}
 export interface AbstractPolicyRepresentation {
   id?: string;
   name?: string;
diff --git a/js/libs/keycloak-admin-client/src/defs/serverInfoRepesentation.ts b/js/libs/keycloak-admin-client/src/defs/serverInfoRepesentation.ts
index 5cfed263c06a..f63d9f462351 100644
--- a/js/libs/keycloak-admin-client/src/defs/serverInfoRepesentation.ts
+++ b/js/libs/keycloak-admin-client/src/defs/serverInfoRepesentation.ts
@@ -11,6 +11,7 @@ import type SystemInfoRepresentation from "./systemInfoRepersantation.js";
  */
 export interface ServerInfoRepresentation {
   systemInfo?: SystemInfoRepresentation;
+  cpuInfo?: CpuInfoRepresentation;
   memoryInfo?: MemoryInfoRepresentation;
   profileInfo?: ProfileInfoRepresentation;
   features?: FeatureRepresentation[];
@@ -63,6 +64,10 @@ export interface MemoryInfoRepresentation {
   freeFormated: string;
 }
 
+export interface CpuInfoRepresentation {
+  processorCount: number;
+}
+
 export interface ProtocolMapperTypeRepresentation {
   id: string;
   name: string;
diff --git a/js/libs/keycloak-admin-client/src/resources/agent.ts b/js/libs/keycloak-admin-client/src/resources/agent.ts
index 5b16ca44e270..147d32781a4c 100644
--- a/js/libs/keycloak-admin-client/src/resources/agent.ts
+++ b/js/libs/keycloak-admin-client/src/resources/agent.ts
@@ -231,7 +231,11 @@ export class Agent {
           : JSON.stringify(payloadKey ? payload[payloadKey] : payload);
     }
 
-    if (!requestHeaders.has("content-type") && !(payload instanceof FormData)) {
+    if (
+      requestOptions.body &&
+      !requestHeaders.has("content-type") &&
+      !(payload instanceof FormData)
+    ) {
       requestHeaders.set("content-type", "application/json");
     }
 
diff --git a/js/libs/keycloak-admin-client/src/resources/cache.ts b/js/libs/keycloak-admin-client/src/resources/cache.ts
index 820bdf54641b..22dec7366f35 100644
--- a/js/libs/keycloak-admin-client/src/resources/cache.ts
+++ b/js/libs/keycloak-admin-client/src/resources/cache.ts
@@ -10,6 +10,10 @@ export class Cache extends Resource<{ realm?: string }> {
     method: "POST",
     path: "/clear-keys-cache",
   });
+  public clearCrlCache = this.makeRequest<{}, void>({
+    method: "POST",
+    path: "/clear-crl-cache",
+  });
   public clearRealmCache = this.makeRequest<{}, void>({
     method: "POST",
     path: "/clear-realm-cache",
diff --git a/js/libs/keycloak-admin-client/src/resources/clients.ts b/js/libs/keycloak-admin-client/src/resources/clients.ts
index 23b05a88f812..ec5ac6449500 100644
--- a/js/libs/keycloak-admin-client/src/resources/clients.ts
+++ b/js/libs/keycloak-admin-client/src/resources/clients.ts
@@ -420,13 +420,13 @@ export class Clients extends Resource<{ realm?: string }> {
   });
 
   public evaluateGenerateAccessToken = this.makeRequest<
-    { id: string; scope: string; userId: string },
+    { id: string; scope: string; userId: string; audience: string },
     Record<string, unknown>
   >({
     method: "GET",
     path: "/{id}/evaluate-scopes/generate-example-access-token",
     urlParamKeys: ["id"],
-    queryParamKeys: ["scope", "userId"],
+    queryParamKeys: ["scope", "userId", "audience"],
   });
 
   public evaluateGenerateUserInfo = this.makeRequest<
@@ -774,6 +774,20 @@ export class Clients extends Resource<{ realm?: string }> {
     urlParamKeys: ["id", "resourceName"],
   });
 
+  public listPermissionScope = this.makeRequest<
+    {
+      id: string;
+      policyId?: string;
+      name?: string;
+      resource?: string;
+    } & PaginatedQuery,
+    PolicyRepresentation[]
+  >({
+    method: "GET",
+    path: "/{id}/authz/resource-server/permission/scope",
+    urlParamKeys: ["id"],
+  });
+
   public createAuthorizationScope = this.makeUpdateRequest<
     { id: string },
     ScopeRepresentation
diff --git a/js/libs/keycloak-admin-client/test/clients.spec.ts b/js/libs/keycloak-admin-client/test/clients.spec.ts
index c75932b5e551..bdc0794b6cfa 100644
--- a/js/libs/keycloak-admin-client/test/clients.spec.ts
+++ b/js/libs/keycloak-admin-client/test/clients.spec.ts
@@ -1099,6 +1099,30 @@ describe("Clients", () => {
       expect(result).to.deep.equal([]);
     });
 
+    it("list permission scope", async () => {
+      permission = await kcAdminClient.clients.createPermission(
+        {
+          id: currentClient.id!,
+          type: "scope",
+        },
+        {
+          name: permissionConfig.name,
+          // @ts-ignore
+          resources: [resource._id],
+          policies: [policy.id!],
+          scopes: scopes.map((scope) => scope.id!),
+        },
+      );
+
+      const p = await kcAdminClient.clients.listPermissionScope({
+        id: currentClient.id!,
+        name: permissionConfig.name,
+      });
+
+      expect(p.length).to.be.eq(1);
+      expect(p[0].name).to.be.eq(permissionConfig.name);
+    });
+
     it("import resource", async () => {
       await kcAdminClient.clients.importResource(
         { id: currentClient.id! },
diff --git a/js/libs/keycloak-admin-client/test/groups.spec.ts b/js/libs/keycloak-admin-client/test/groups.spec.ts
index 7ac416afedb9..ad459654c4a4 100644
--- a/js/libs/keycloak-admin-client/test/groups.spec.ts
+++ b/js/libs/keycloak-admin-client/test/groups.spec.ts
@@ -70,7 +70,7 @@ describe("Groups", () => {
     const groupId = currentGroup.id;
     await kcAdminClient.groups.update(
       { id: groupId! },
-      { name: "another-group-name" },
+      { name: "another-group-name", description: "another-group-description" },
     );
 
     const group = await kcAdminClient.groups.findOne({
diff --git a/js/libs/keycloak-admin-client/test/realms.spec.ts b/js/libs/keycloak-admin-client/test/realms.spec.ts
index d22267c68ea2..8de5dd02ea61 100644
--- a/js/libs/keycloak-admin-client/test/realms.spec.ts
+++ b/js/libs/keycloak-admin-client/test/realms.spec.ts
@@ -158,7 +158,7 @@ describe("Realms", () => {
     });
 
     after(async () => {
-      deleteRealm(kcAdminClient, currentRealmName);
+      await deleteRealm(kcAdminClient, currentRealmName);
     });
 
     it("list client initial access", async () => {
@@ -211,7 +211,7 @@ describe("Realms", () => {
     });
 
     after(async () => {
-      deleteRealm(kcAdminClient, currentRealmName);
+      await deleteRealm(kcAdminClient, currentRealmName);
     });
 
     it("add group to default groups", async () => {
@@ -321,7 +321,7 @@ describe("Realms", () => {
     });
 
     after(async () => {
-      deleteRealm(kcAdminClient, currentRealmName);
+      await deleteRealm(kcAdminClient, currentRealmName);
     });
   });
 
@@ -360,7 +360,7 @@ describe("Realms", () => {
     });
 
     after(async () => {
-      deleteRealm(kcAdminClient, currentRealmName);
+      await deleteRealm(kcAdminClient, currentRealmName);
     });
   });
 
@@ -396,7 +396,7 @@ describe("Realms", () => {
     });
 
     after(async () => {
-      deleteRealm(kcAdminClient, currentRealmName);
+      await deleteRealm(kcAdminClient, currentRealmName);
     });
   });
 
diff --git a/js/libs/keycloak-js/README.md b/js/libs/keycloak-js/README.md
deleted file mode 100644
index cfeaf7cb0967..000000000000
--- a/js/libs/keycloak-js/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Keycloak JS
-
-The documentation can be found in the [Keycloak documentation](https://www.keycloak.org/securing-apps/javascript-adapter).
diff --git a/js/libs/keycloak-js/lib/keycloak-authz.d.ts b/js/libs/keycloak-js/lib/keycloak-authz.d.ts
deleted file mode 100644
index a035cf9b491b..000000000000
--- a/js/libs/keycloak-js/lib/keycloak-authz.d.ts
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * MIT License
- *
- * Copyright 2017 Brett Epps <https://github.com/eppsilon>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
- * associated documentation files (the "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
- * following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all copies or substantial
- * portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
- * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
- * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-import Keycloak from './keycloak.js';
-
-export interface KeycloakAuthorizationPromise {
-	then(onGrant: (rpt: string) => void, onDeny: () => void, onError: () => void): void;
-}
-
-export interface AuthorizationRequest {
-	/**
-	 * An array of objects representing the resource and scopes.
-	 */
-	permissions?:ResourcePermission[],
-
-	/**
-	 * A permission ticket obtained from a resource server when using UMA authorization protocol.
-	 */
-	ticket?:string,
-
-	/**
-	 * A boolean value indicating whether the server should create permission requests to the resources
-	 * and scopes referenced by a permission ticket. This parameter will only take effect when used together
-	 * with the ticket parameter as part of a UMA authorization process.
-	 */
-	submitRequest?:boolean,
-
-	/**
-	 * Defines additional information about this authorization request in order to specify how it should be processed
-	 * by the server.
-	 */
-	metadata?:AuthorizationRequestMetadata,
-
-	/**
-	 * Defines whether or not this authorization request should include the current RPT. If set to true, the RPT will
-	 * be sent and permissions in the current RPT will be included in the new RPT. Otherwise, only the permissions referenced in this
-	 * authorization request will be granted in the new RPT.
-	 */
-	incrementalAuthorization?:boolean
-}
-
-export interface AuthorizationRequestMetadata {
-	/**
-	 * A boolean value indicating to the server if resource names should be included in the RPT’s permissions.
-	 * If false, only the resource identifier is included.
-	 */
-	responseIncludeResourceName?:any,
-
-	/**
-	 * An integer N that defines a limit for the amount of permissions an RPT can have. When used together with
-	 * rpt parameter, only the last N requested permissions will be kept in the RPT.
-	 */
-	response_permissions_limit?:number
-}
-
-export interface ResourcePermission {
-	/**
-	 * The id or name of a resource.
-	 */
-	id:string,
-
-	/**
-	 * An array of strings where each value is the name of a scope associated with the resource.
-	 */
-	scopes?:string[]
-}
-
-/**
- * @deprecated Instead of importing 'KeycloakAuthorizationInstance' you can import 'KeycloakAuthorization' directly as a type.
- */
-export type KeycloakAuthorizationInstance = KeycloakAuthorization;
-
-/**
- * @deprecated Construct a KeycloakAuthorization instance using the `new` keyword instead.
- */
-declare function KeycloakAuthorization(keycloak: Keycloak): KeycloakAuthorization;
-
-declare class KeycloakAuthorization {
-	/**
-	 * Creates a new Keycloak client instance.
-	 * @param config Path to a JSON config file or a plain config object.
-	 */
-	constructor(keycloak: Keycloak)
-
-	rpt: any;
-	config: { rpt_endpoint: string };
-
-	/**
-	 * Initializes the `KeycloakAuthorization` instance.
-	 * @deprecated Initialization now happens automatically, calling this method is no longer required.
-	 */
-	init(): void;
-
-	/**
-	 * A promise that resolves when the `KeycloakAuthorization` instance is initialized.
-	 * @deprecated Initialization now happens automatically, using this property is no longer required.
-	 */
-	ready: Promise<void>;
-
-	/**
-	 * This method enables client applications to better integrate with resource servers protected by a Keycloak
-	 * policy enforcer using UMA protocol.
-	 *
-	 * The authorization request must be provided with a ticket.
-	 *
-	 * @param authorizationRequest An AuthorizationRequest instance with a valid permission ticket set.
-	 * @returns A promise to set functions to be invoked on grant, deny or error.
-	 */
-	authorize(authorizationRequest: AuthorizationRequest): KeycloakAuthorizationPromise;
-
-	/**
-	 * Obtains all entitlements from a Keycloak server based on a given resourceServerId.
-	 *
-	 * @param resourceServerId The id (client id) of the resource server to obtain permissions from.
-	 * @param authorizationRequest An AuthorizationRequest instance.
-	 * @returns A promise to set functions to be invoked on grant, deny or error.
-	 */
-	entitlement(resourceServerId: string, authorizationRequest?: AuthorizationRequest): KeycloakAuthorizationPromise;
-}
-
-export default KeycloakAuthorization;
-
-/**
- * @deprecated The 'KeycloakAuthorization' namespace is deprecated, use named imports instead.
- */
-export as namespace KeycloakAuthorization;
diff --git a/js/libs/keycloak-js/lib/keycloak-authz.js b/js/libs/keycloak-js/lib/keycloak-authz.js
deleted file mode 100644
index 8b4f439134c2..000000000000
--- a/js/libs/keycloak-js/lib/keycloak-authz.js
+++ /dev/null
@@ -1,296 +0,0 @@
-/*
- *  Copyright 2016 Red Hat, Inc. and/or its affiliates
- *  and other contributors as indicated by the @author tags.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-
-var KeycloakAuthorization = function (keycloak, options) {
-    var _instance = this;
-    this.rpt = null;
-
-    // Only here for backwards compatibility, as the configuration is now loaded on demand.
-    // See:
-    // - https://github.com/keycloak/keycloak/pull/6619
-    // - https://issues.redhat.com/browse/KEYCLOAK-10894
-    // TODO: Remove both `ready` property and `init` method in a future version
-    Object.defineProperty(this, 'ready', {
-        get() {
-            console.warn("The 'ready' property is deprecated and will be removed in a future version. Initialization now happens automatically, using this property is no longer required.");
-            return Promise.resolve();
-        },
-    });
-    
-    this.init = () => {
-        console.warn("The 'init()' method is deprecated and will be removed in a future version. Initialization now happens automatically, calling this method is no longer required.");
-    };
-
-    /** @type {Promise<unknown> | undefined} */
-    let configPromise;
-
-    /**
-     * Initializes the configuration or re-uses the existing one if present.
-     * @returns {Promise<void>} A promise that resolves when the configuration is loaded.
-     */
-    async function initializeConfigIfNeeded() {
-        if (_instance.config) {
-            return _instance.config;
-        }
-
-        if (configPromise) {
-            return await configPromise;
-        }
-
-        if (!keycloak.didInitialize) {
-            throw new Error('The Keycloak instance has not been initialized yet.');
-        }
-        
-        configPromise = loadConfig(keycloak.authServerUrl, keycloak.realm);
-        _instance.config = await configPromise;
-    }
-
-    /**
-     * This method enables client applications to better integrate with resource servers protected by a Keycloak
-     * policy enforcer using UMA protocol.
-     *
-     * The authorization request must be provided with a ticket.
-     */
-    this.authorize = function (authorizationRequest) {
-        this.then = async function (onGrant, onDeny, onError) {
-            try {
-                await initializeConfigIfNeeded();
-            } catch (error) {
-                handleError(error, onError);
-                return;
-            }
-
-            if (authorizationRequest && authorizationRequest.ticket) {
-                var request = new XMLHttpRequest();
-
-                request.open('POST', _instance.config.token_endpoint, true);
-                request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
-                request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token);
-
-                request.onreadystatechange = function () {
-                    if (request.readyState == 4) {
-                        var status = request.status;
-
-                        if (status >= 200 && status < 300) {
-                            var rpt = JSON.parse(request.responseText).access_token;
-                            _instance.rpt = rpt;
-                            onGrant(rpt);
-                        } else if (status == 403) {
-                            if (onDeny) {
-                                onDeny();
-                            } else {
-                                console.error('Authorization request was denied by the server.');
-                            }
-                        } else {
-                            if (onError) {
-                                onError();
-                            } else {
-                                console.error('Could not obtain authorization data from server.');
-                            }
-                        }
-                    }
-                };
-
-                var params = "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&client_id=" + keycloak.clientId + "&ticket=" + authorizationRequest.ticket;
-
-                if (authorizationRequest.submitRequest != undefined) {
-                    params += "&submit_request=" + authorizationRequest.submitRequest;
-                }
-
-                var metadata = authorizationRequest.metadata;
-
-                if (metadata) {
-                    if (metadata.responseIncludeResourceName) {
-                        params += "&response_include_resource_name=" + metadata.responseIncludeResourceName;
-                    }
-                    if (metadata.responsePermissionsLimit) {
-                        params += "&response_permissions_limit=" + metadata.responsePermissionsLimit;
-                    }
-                }
-
-                if (_instance.rpt && (authorizationRequest.incrementalAuthorization == undefined || authorizationRequest.incrementalAuthorization)) {
-                    params += "&rpt=" + _instance.rpt;
-                }
-
-                request.send(params);
-            }
-        };
-
-        return this;
-    };
-
-    /**
-     * Obtains all entitlements from a Keycloak Server based on a given resourceServerId.
-     */
-    this.entitlement = function (resourceServerId, authorizationRequest) {
-        this.then = async function (onGrant, onDeny, onError) {
-            try {
-                await initializeConfigIfNeeded();
-            } catch (error) {
-                handleError(error, onError);
-                return;
-            }
-
-            var request = new XMLHttpRequest();
-
-            request.open('POST', _instance.config.token_endpoint, true);
-            request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
-            request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token);
-
-            request.onreadystatechange = function () {
-                if (request.readyState == 4) {
-                    var status = request.status;
-
-                    if (status >= 200 && status < 300) {
-                        var rpt = JSON.parse(request.responseText).access_token;
-                        _instance.rpt = rpt;
-                        onGrant(rpt);
-                    } else if (status == 403) {
-                        if (onDeny) {
-                            onDeny();
-                        } else {
-                            console.error('Authorization request was denied by the server.');
-                        }
-                    } else {
-                        if (onError) {
-                            onError();
-                        } else {
-                            console.error('Could not obtain authorization data from server.');
-                        }
-                    }
-                }
-            };
-
-            if (!authorizationRequest) {
-                authorizationRequest = {};
-            }
-
-            var params = "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&client_id=" + keycloak.clientId;
-
-            if (authorizationRequest.claimToken) {
-                params += "&claim_token=" + authorizationRequest.claimToken;
-
-                if (authorizationRequest.claimTokenFormat) {
-                    params += "&claim_token_format=" + authorizationRequest.claimTokenFormat;
-                }
-            }
-
-            params += "&audience=" + resourceServerId;
-
-            var permissions = authorizationRequest.permissions;
-
-            if (!permissions) {
-                permissions = [];
-            }
-
-            for (var i = 0; i < permissions.length; i++) {
-                var resource = permissions[i];
-                var permission = resource.id;
-
-                if (resource.scopes && resource.scopes.length > 0) {
-                    permission += "#";
-                    for (var j = 0; j < resource.scopes.length; j++) {
-                        var scope = resource.scopes[j];
-                        if (permission.indexOf('#') != permission.length - 1) {
-                            permission += ",";
-                        }
-                        permission += scope;
-                    }
-                }
-
-                params += "&permission=" + permission;
-            }
-
-            var metadata = authorizationRequest.metadata;
-
-            if (metadata) {
-                if (metadata.responseIncludeResourceName) {
-                    params += "&response_include_resource_name=" + metadata.responseIncludeResourceName;
-                }
-                if (metadata.responsePermissionsLimit) {
-                    params += "&response_permissions_limit=" + metadata.responsePermissionsLimit;
-                }
-            }
-
-            if (_instance.rpt) {
-                params += "&rpt=" + _instance.rpt;
-            }
-
-            request.send(params);
-        };
-
-        return this;
-    };
-
-    return this;
-};
-
-/**
- * Obtains the configuration from the server.
- * @param {string} serverUrl The URL of the Keycloak server.
- * @param {string} realm The realm name.
- * @returns {Promise<unknown>} A promise that resolves when the configuration is loaded.
- */
-async function loadConfig(serverUrl, realm) {
-    const url = `${serverUrl}/realms/${encodeURIComponent(realm)}/.well-known/uma2-configuration`;
-
-    try {
-        return await fetchJSON(url);
-    } catch (error) {
-        throw new Error('Could not obtain configuration from server.', { cause: error });
-    }
-}
-
-/**
- * Fetches the JSON data from the given URL.
- * @param {string} url The URL to fetch the data from.
- * @returns {Promise<unknown>} A promise that resolves when the data is loaded.
- */
-async function fetchJSON(url) {
-    let response;
-
-    try {
-        response = await fetch(url);
-    } catch (error) {
-        throw new Error('Server did not respond.', { cause: error });
-    }
-
-    if (!response.ok) {
-        throw new Error('Server responded with an invalid status.');
-    }
-
-    try {
-        return await response.json();
-    } catch (error) {
-        throw new Error('Server responded with invalid JSON.', { cause: error });
-    }
-}
-
-/**
- * @param {unknown} error 
- * @param {((error: unknown) => void) | undefined} handler 
- */
-function handleError(error, handler) {
-    if (handler) {
-        handler(error);
-    } else {
-        console.error(message, error);
-    }
-}
-
-export default KeycloakAuthorization;
diff --git a/js/libs/keycloak-js/lib/keycloak.d.ts b/js/libs/keycloak-js/lib/keycloak.d.ts
deleted file mode 100644
index 507d31ecaf7d..000000000000
--- a/js/libs/keycloak-js/lib/keycloak.d.ts
+++ /dev/null
@@ -1,660 +0,0 @@
-/*
- * MIT License
- *
- * Copyright 2017 Brett Epps <https://github.com/eppsilon>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
- * associated documentation files (the "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
- * following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all copies or substantial
- * portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
- * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
- * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-export type KeycloakOnLoad = 'login-required'|'check-sso';
-export type KeycloakResponseMode = 'query'|'fragment';
-export type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
-export type KeycloakFlow = 'standard'|'implicit'|'hybrid';
-export type KeycloakPkceMethod = 'S256' | false;
-
-export interface KeycloakConfig {
-	/**
-	 * URL to the Keycloak server, for example: http://keycloak-server/auth
-	 */
-	url: string;
-	/**
-	 * Name of the realm, for example: 'myrealm'
-	 */
-	realm: string;
-	/**
-	 * Client identifier, example: 'myapp'
-	 */
-	clientId: string;
-}
-
-export interface Acr {
-	/**
-	 * Array of values, which will be used inside ID Token `acr` claim sent inside the `claims` parameter to Keycloak server during login.
-	 * Values should correspond to the ACR levels defined in the ACR to Loa mapping for realm or client or to the numbers (levels) inside defined
-	 * Keycloak authentication flow. See section 5.5.1 of OIDC 1.0 specification for the details.
-	 */
-	values: string[];
-	/**
-	 * This parameter specifies if ACR claims is considered essential or not.
-	 */
-	essential: boolean;
-}
-
-export interface KeycloakInitOptions {
-	/**
-	 * Adds a [cryptographic nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce)
-	 * to verify that the authentication response matches the request.
-	 * @default true
-	 */
-	useNonce?: boolean;
-
-	/**
-	 * 
-	 * Allow usage of different types of adapters or a custom adapter to make Keycloak work in different environments.
-	 *
-	 * The following options are supported:
-	 * - `default` - Use default APIs that are available in browsers.
-	 * - `cordova` - Use a WebView in Cordova.
-	 * - `cordova-native` - Use Cordova native APIs, this is recommended over `cordova`.
-	 *
-	 * It's also possible to pass in a custom adapter for the environment you are running Keycloak in. In order to do so extend the `KeycloakAdapter` interface and implement the methods that are defined there.
-	 *
-	 * For example:
-	 *
-	 * ```ts
-	 * // Implement the 'KeycloakAdapter' interface so that all required methods are guaranteed to be present.
-	 * const MyCustomAdapter: KeycloakAdapter = {
-	 * 	login(options) {
-	 * 		// Write your own implementation here.
-	 * 	}
-	 *
-	 * 	// The other methods go here...
-	 * };
-	 *
-	 * keycloak.init({
-	 * 	adapter: MyCustomAdapter,
-	 * });
-	 * ```
-	 */
-	adapter?: 'default' | 'cordova' | 'cordova-native' | KeycloakAdapter;
-	
-	/**
-	 * Specifies an action to do on load.
-	 */
-	onLoad?: KeycloakOnLoad;
-
-	/**
-	 * Set an initial value for the token.
-	 */
-	token?: string;
-
-	/**
-	 * Set an initial value for the refresh token.
-	 */
-	refreshToken?: string;
-
-	/**
-	 * Set an initial value for the id token (only together with `token` or
-	 * `refreshToken`).
-	 */
-	idToken?: string;
-
-	/**
-	 * Set an initial value for skew between local time and Keycloak server in
-	 * seconds (only together with `token` or `refreshToken`).
-	 */
-	timeSkew?: number;
-
-	/**
-	 * Set to enable/disable monitoring login state.
-	 * @default true
-	 */
-	checkLoginIframe?: boolean;
-
-	/**
-	 * Set the interval to check login state (in seconds).
-	 * @default 5
-	 */
-	checkLoginIframeInterval?: number;
-
-	/**
-	 * Set the OpenID Connect response mode to send to Keycloak upon login.
-	 * @default fragment After successful authentication Keycloak will redirect
-	 *                   to JavaScript application with OpenID Connect parameters
-	 *                   added in URL fragment. This is generally safer and
-	 *                   recommended over query.
-	 */
-	responseMode?: KeycloakResponseMode;
-
-	/**
-	 * Specifies a default uri to redirect to after login or logout.
-	 * This is currently supported for adapter 'cordova-native' and 'default'
-	 */
-	redirectUri?: string;
-
-	/**
-	 * Specifies an uri to redirect to after silent check-sso.
-	 * Silent check-sso will only happen, when this redirect uri is given and
-	 * the specified uri is available within the application.
-	 */
-	silentCheckSsoRedirectUri?: string;
-
-	/**
-	 * Specifies whether the silent check-sso should fallback to "non-silent"
-	 * check-sso when 3rd party cookies are blocked by the browser. Defaults
-	 * to true.
-	 */
-	silentCheckSsoFallback?: boolean;
-
-	/**
-	 * Set the OpenID Connect flow.
-	 * @default standard
-	 */
-	flow?: KeycloakFlow;
-
-	/**
-	 * Configures the Proof Key for Code Exchange (PKCE) method to use. This will default to 'S256'.
-	 * Can be disabled by passing `false`.
-	 */
-	pkceMethod?: KeycloakPkceMethod;
-
-	/**
-	 * Configures the 'acr_values' query param in compliance with section 3.1.2.1
-	 * of the OIDC 1.0 specification.
-	 * Used to tell Keycloak what level of authentication the user needs.
-	 */
-	acrValues?: string;
-
-	/**
-	 * Enables logging messages from Keycloak to the console.
-	 * @default false
-	 */
-	enableLogging?: boolean
-
-	/**
-	 * Set the default scope parameter to the login endpoint. Use a space-delimited list of scopes. 
-	 * Note that the scope 'openid' will be always be added to the list of scopes by the adapter.
-	 * Note that the default scope specified here is overwritten if the `login()` options specify scope explicitly.
-	 */
-	scope?: string
-	
-	/**
-	 * Configures how long will Keycloak adapter wait for receiving messages from server in ms. This is used,
-	 * for example, when waiting for response of 3rd party cookies check.
-	 *
-	 * @default 10000
-	 */
-	messageReceiveTimeout?: number
-
-	/**
-	 * When onLoad is 'login-required', sets the 'ui_locales' query param in compliance with section 3.1.2.1
-	 * of the OIDC 1.0 specification.
-	 */
-	locale?: string;
-
-	/**
-	 * HTTP method for calling the end_session endpoint. Defaults to 'GET'.
-	 */
-	logoutMethod?: 'GET' | 'POST';
-}
-
-export interface KeycloakLoginOptions {
-	/**
-	 * Specifies the scope parameter for the login url
-	 * The scope 'openid' will be added to the scope if it is missing or undefined.
-	 */
-	scope?: string;
-
-	/**
-	 * Specifies the uri to redirect to after login.
-	 */
-	redirectUri?: string;
-
-	/**
-	 * By default the login screen is displayed if the user is not logged into
-	 * Keycloak. To only authenticate to the application if the user is already
-	 * logged in and not display the login page if the user is not logged in, set
-	 * this option to `'none'`. To always require re-authentication and ignore
-	 * SSO, set this option to `'login'`. To always prompt the user for consent,
-	 * set this option to `'consent'`. This ensures that consent is requested,
-	 * even if it has been given previously.
-	 */
-	prompt?: 'none' | 'login' | 'consent';
-
-	/**
-	 * If value is `'register'` then user is redirected to registration page,
-	 * otherwise to login page.
-	 */
-	action?: string;
-
-	/**
-	 * Used just if user is already authenticated. Specifies maximum time since
-	 * the authentication of user happened. If user is already authenticated for
-	 * longer time than `'maxAge'`, the SSO is ignored and he will need to
-	 * authenticate again.
-	 */
-	maxAge?: number;
-
-	/**
-	 * Used to pre-fill the username/email field on the login form.
-	 */
-	loginHint?: string;
-
-	/**
-	 * Sets the `acr` claim of the ID token sent inside the `claims` parameter. See section 5.5.1 of the OIDC 1.0 specification.
-	 */
-	acr?: Acr;
-
-	/**
-	 * Configures the 'acr_values' query param in compliance with section 3.1.2.1
-	 * of the OIDC 1.0 specification.
-	 * Used to tell Keycloak what level of authentication the user needs.
-	 */
-	acrValues?: string;
-
-	/**
-	 * Used to tell Keycloak which IDP the user wants to authenticate with.
-	 */
-	idpHint?: string;
-
-				/**
-	 * Sets the 'ui_locales' query param in compliance with section 3.1.2.1
-							 * of the OIDC 1.0 specification.
-	 */
-	locale?: string;
-
-	/**
-	 * Specifies arguments that are passed to the Cordova in-app-browser (if applicable).
-	 * Options 'hidden' and 'location' are not affected by these arguments.
-	 * All available options are defined at https://cordova.apache.org/docs/en/latest/reference/cordova-plugin-inappbrowser/.
-	 * Example of use: { zoom: "no", hardwareback: "yes" }
-	 */
-	cordovaOptions?: { [optionName: string]: string };
-}
-
-export interface KeycloakLogoutOptions {
-	/**
-	 * Specifies the uri to redirect to after logout.
-	 */
-	redirectUri?: string;
-
-	/**
-	 * HTTP method for calling the end_session endpoint. Defaults to 'GET'.
-	 */
-	logoutMethod?: 'GET' | 'POST';
-}
-
-export interface KeycloakRegisterOptions extends Omit<KeycloakLoginOptions, 'action'> { }
-
-export interface KeycloakAccountOptions {
-	/**
-	 * Specifies the uri to redirect to when redirecting back to the application.
-	 */
-	redirectUri?: string;	
-}
-export interface KeycloakError {
-	error: string;
-	error_description: string;
-}
-
-export interface KeycloakAdapter {
-	login(options?: KeycloakLoginOptions): Promise<void>;
-	logout(options?: KeycloakLogoutOptions): Promise<void>;
-	register(options?: KeycloakRegisterOptions): Promise<void>;
-	accountManagement(): Promise<void>;
-	redirectUri(options: { redirectUri: string; }, encodeHash: boolean): string;
-}
-
-export interface KeycloakProfile {
-	id?: string;
-	username?: string;
-	email?: string;
-	firstName?: string;
-	lastName?: string;
-	enabled?: boolean;
-	emailVerified?: boolean;
-	totp?: boolean;
-	createdTimestamp?: number;
-	attributes?: Record<string, unknown>;
-}
-
-export interface KeycloakTokenParsed {
-	iss?: string;
-	sub?: string;
-	aud?: string;
-	exp?: number;
-	iat?: number;
-	auth_time?: number;
-	nonce?: string;
-	acr?: string;
-	amr?: string;
-	azp?: string;
-	session_state?: string;
-	realm_access?: KeycloakRoles;
-	resource_access?: KeycloakResourceAccess;
-	[key: string]: any; // Add other attributes here.
-}
-
-export interface KeycloakResourceAccess {
-	[key: string]: KeycloakRoles
-}
-
-export interface KeycloakRoles {
-	roles: string[];
-}
-
-/**
- * @deprecated Instead of importing 'KeycloakInstance' you can import 'Keycloak' directly as a type.
- */
-export type KeycloakInstance = Keycloak;
-
-/**
- * A client for the Keycloak authentication server.
- * @see {@link https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html|Keycloak JS adapter documentation}
- */
-declare class Keycloak {
-	/**
-	 * Creates a new Keycloak client instance.
-	 * @param config A configuration object or path to a JSON config file.
-	 */
-	constructor(config: KeycloakConfig | string)
-
-	/**
-	 * Is true if the user is authenticated, false otherwise.
-	 */
-	authenticated?: boolean;
-
-	/**
-	* The user id.
-	*/
-	subject?: string;
-
-	/**
-	* Response mode passed in init (default value is `'fragment'`).
-	*/
-	responseMode?: KeycloakResponseMode;
-
-	/**
-	* Response type sent to Keycloak with login requests. This is determined
-	* based on the flow value used during initialization, but can be overridden
-	* by setting this value.
-	*/
-	responseType?: KeycloakResponseType;
-
-	/**
-	* Flow passed in init.
-	*/
-	flow?: KeycloakFlow;
-
-	/**
-	* The realm roles associated with the token.
-	*/
-	realmAccess?: KeycloakRoles;
-
-	/**
-	* The resource roles associated with the token.
-	*/
-	resourceAccess?: KeycloakResourceAccess;
-
-	/**
-	* The base64 encoded token that can be sent in the Authorization header in
-	* requests to services.
-	*/
-	token?: string;
-
-	/**
-	* The parsed token as a JavaScript object.
-	*/
-	tokenParsed?: KeycloakTokenParsed;
-
-	/**
-	* The base64 encoded refresh token that can be used to retrieve a new token.
-	*/
-	refreshToken?: string;
-
-	/**
-	* The parsed refresh token as a JavaScript object.
-	*/
-	refreshTokenParsed?: KeycloakTokenParsed;
-
-	/**
-	* The base64 encoded ID token.
-	*/
-	idToken?: string;
-
-	/**
-	* The parsed id token as a JavaScript object.
-	*/
-	idTokenParsed?: KeycloakTokenParsed;
-
-	/**
-	* The estimated time difference between the browser time and the Keycloak
-	* server in seconds. This value is just an estimation, but is accurate
-	* enough when determining if a token is expired or not.
-	*/
-	timeSkew?: number;
-
-	/**
-	* Whether the instance has been initialized by calling `.init()`.
-	*/
-	didInitialize: boolean;
-	
-	/**
-	* @private Undocumented.
-	*/
-	loginRequired?: boolean;
-
-	/**
-	* @private Undocumented.
-	*/
-	authServerUrl?: string;
-
-	/**
-	* @private Undocumented.
-	*/
-	realm?: string;
-
-	/**
-	* @private Undocumented.
-	*/
-	clientId?: string;
-
-	/**
-	* @private Undocumented.
-	*/
-	redirectUri?: string;
-
-	/**
-	* @private Undocumented.
-	*/
-	sessionId?: string;
-
-	/**
-	* @private Undocumented.
-	*/
-	profile?: KeycloakProfile;
-
-	/**
-	* @private Undocumented.
-	*/
-	userInfo?: {}; // KeycloakUserInfo;
-
-	/**
-	* Called when the adapter is initialized.
-	*/
-	onReady?(authenticated?: boolean): void;
-
-	/**
-	* Called when a user is successfully authenticated.
-	*/
-	onAuthSuccess?(): void;
-
-	/**
-	* Called if there was an error during authentication.
-	*/
-	onAuthError?(errorData: KeycloakError): void;
-
-	/**
-	* Called when the token is refreshed.
-	*/
-	onAuthRefreshSuccess?(): void;
-
-	/**
-	* Called if there was an error while trying to refresh the token.
-	*/
-	onAuthRefreshError?(): void;
-
-	/**
-	* Called if the user is logged out (will only be called if the session
-	* status iframe is enabled, or in Cordova mode).
-	*/
-	onAuthLogout?(): void;
-
-	/**
-	* Called when the access token is expired. If a refresh token is available
-	* the token can be refreshed with Keycloak#updateToken, or in cases where
-	* it's not (ie. with implicit flow) you can redirect to login screen to
-	* obtain a new access token.
-	*/
-	onTokenExpired?(): void;
-
-	/**
-	* Called when a AIA has been requested by the application.
-	* @param status the outcome of the required action
-	* @param action the alias name of the required action, e.g. UPDATE_PASSWORD, CONFIGURE_TOTP etc.
-	*/
-	onActionUpdate?(status: 'success'|'cancelled'|'error', action?: string): void;
-
-	/**
-	* Called to initialize the adapter.
-	* @param initOptions Initialization options.
-	* @returns A promise to set functions to be invoked on success or error.
-	*/
-	init(initOptions?: KeycloakInitOptions): Promise<boolean>;
-
-	/**
-	* Redirects to login form.
-	* @param options Login options.
-	*/
-	login(options?: KeycloakLoginOptions): Promise<void>;
-
-	/**
-	* Redirects to logout.
-	* @param options Logout options.
-	*/
-	logout(options?: KeycloakLogoutOptions): Promise<void>;
-
-	/**
-	* Redirects to registration form.
-	* @param options The options used for the registration.
-	*/
-	register(options?: KeycloakRegisterOptions): Promise<void>;
-
-	/**
-	* Redirects to the Account Management Console.
-	*/
-	accountManagement(): Promise<void>;
-
-	/**
-	* Returns the URL to login form.
-	* @param options Supports same options as Keycloak#login.
-	*/
-	createLoginUrl(options?: KeycloakLoginOptions): Promise<string>;
-
-	/**
-	* Returns the URL to logout the user.
-	* @param options Logout options.
-	*/
-	createLogoutUrl(options?: KeycloakLogoutOptions): string;
-
-	/**
-	* Returns the URL to registration page.
-	* @param options The options used for creating the registration URL.
-	*/
-	createRegisterUrl(options?: KeycloakRegisterOptions): Promise<string>;
-
-	/**
-	* Returns the URL to the Account Management Console.
-	* @param options The options used for creating the account URL.
-	*/
-	createAccountUrl(options?: KeycloakAccountOptions): string;
-
-	/**
-	* Returns true if the token has less than `minValidity` seconds left before
-	* it expires.
-	* @param minValidity If not specified, `0` is used.
-	*/
-	isTokenExpired(minValidity?: number): boolean;
-
-	/**
-	* If the token expires within `minValidity` seconds, the token is refreshed.
-	* If the session status iframe is enabled, the session status is also
-	* checked.
-	* @param minValidity If not specified, `5` is used.
-	* @returns A promise to set functions that can be invoked if the token is
-	*          still valid, or if the token is no longer valid.
-	* @example
-	* ```js
-	* keycloak.updateToken(5).then(function(refreshed) {
-	*   if (refreshed) {
-	*     alert('Token was successfully refreshed');
-	*   } else {
-	*     alert('Token is still valid');
-	*   }
-	* }).catch(function() {
-	*   alert('Failed to refresh the token, or the session has expired');
-	* });
-	*/
-	updateToken(minValidity?: number): Promise<boolean>;
-
-	/**
-	* Clears authentication state, including tokens. This can be useful if
-	* the application has detected the session was expired, for example if
-	* updating token fails. Invoking this results in Keycloak#onAuthLogout
-	* callback listener being invoked.
-	*/
-	clearToken(): void;
-
-	/**
-	* Returns true if the token has the given realm role.
-	* @param role A realm role name.
-	*/
-	hasRealmRole(role: string): boolean;
-
-	/**
-	* Returns true if the token has the given role for the resource.
-	* @param role A role name.
-	* @param resource If not specified, `clientId` is used.
-	*/
-	hasResourceRole(role: string, resource?: string): boolean;
-
-	/**
-	* Loads the user's profile.
-	* @returns A promise to set functions to be invoked on success or error.
-	*/
-	loadUserProfile(): Promise<KeycloakProfile>;
-
-	/**
-	* @private Undocumented.
-	*/
-	loadUserInfo(): Promise<{}>;
-}
-
-export default Keycloak;
-
-/**
- * @deprecated The 'Keycloak' namespace is deprecated, use named imports instead.
- */
-export as namespace Keycloak;
diff --git a/js/libs/keycloak-js/lib/keycloak.js b/js/libs/keycloak-js/lib/keycloak.js
deleted file mode 100755
index 47225f4dd433..000000000000
--- a/js/libs/keycloak-js/lib/keycloak.js
+++ /dev/null
@@ -1,1873 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-function Keycloak (config) {
-    if (!(this instanceof Keycloak)) {
-        throw new Error("The 'Keycloak' constructor must be invoked with 'new'.")
-    }
-
-    if (typeof config !== 'string' && !isObject(config)) {
-        throw new Error("The 'Keycloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
-    }
-
-    if (isObject(config)) {
-        const requiredProperties = 'oidcProvider' in config
-            ? ['clientId']
-            : ['url', 'realm', 'clientId'];
-
-        for (const property of requiredProperties) {
-            if (!config[property]) {
-                throw new Error(`The configuration object is missing the required '${property}' property.`);
-            }
-        }
-    }
-
-    var kc = this;
-    var adapter;
-    var refreshQueue = [];
-    var callbackStorage;
-
-    var loginIframe = {
-        enable: true,
-        callbackList: [],
-        interval: 5
-    };
-
-    kc.didInitialize = false;
-
-    var useNonce = true;
-    var logInfo = createLogger(console.info);
-    var logWarn = createLogger(console.warn);
-
-    if (!globalThis.isSecureContext) {
-        logWarn(
-            "[KEYCLOAK] Keycloak JS must be used in a 'secure context' to function properly as it relies on browser APIs that are otherwise not available.\n" +
-            "Continuing to run your application insecurely will lead to unexpected behavior and breakage.\n\n" +
-            "For more information see: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts"
-        );
-    }
-
-    kc.init = function (initOptions = {}) {
-        if (kc.didInitialize) {
-            throw new Error("A 'Keycloak' instance can only be initialized once.");
-        }
-
-        kc.didInitialize = true;
-
-        kc.authenticated = false;
-
-        callbackStorage = createCallbackStorage();
-        var adapters = ['default', 'cordova', 'cordova-native'];
-
-        if (adapters.indexOf(initOptions.adapter) > -1) {
-            adapter = loadAdapter(initOptions.adapter);
-        } else if (typeof initOptions.adapter === "object") {
-            adapter = initOptions.adapter;
-        } else {
-            if (window.Cordova || window.cordova) {
-                adapter = loadAdapter('cordova');
-            } else {
-                adapter = loadAdapter();
-            }
-        }
-
-        if (typeof initOptions.useNonce !== 'undefined') {
-            useNonce = initOptions.useNonce;
-        }
-
-        if (typeof initOptions.checkLoginIframe !== 'undefined') {
-            loginIframe.enable = initOptions.checkLoginIframe;
-        }
-
-        if (initOptions.checkLoginIframeInterval) {
-            loginIframe.interval = initOptions.checkLoginIframeInterval;
-        }
-
-        if (initOptions.onLoad === 'login-required') {
-            kc.loginRequired = true;
-        }
-
-        if (initOptions.responseMode) {
-            if (initOptions.responseMode === 'query' || initOptions.responseMode === 'fragment') {
-                kc.responseMode = initOptions.responseMode;
-            } else {
-                throw 'Invalid value for responseMode';
-            }
-        }
-
-        if (initOptions.flow) {
-            switch (initOptions.flow) {
-                case 'standard':
-                    kc.responseType = 'code';
-                    break;
-                case 'implicit':
-                    kc.responseType = 'id_token token';
-                    break;
-                case 'hybrid':
-                    kc.responseType = 'code id_token token';
-                    break;
-                default:
-                    throw 'Invalid value for flow';
-            }
-            kc.flow = initOptions.flow;
-        }
-
-        if (initOptions.timeSkew != null) {
-            kc.timeSkew = initOptions.timeSkew;
-        }
-
-        if(initOptions.redirectUri) {
-            kc.redirectUri = initOptions.redirectUri;
-        }
-
-        if (initOptions.silentCheckSsoRedirectUri) {
-            kc.silentCheckSsoRedirectUri = initOptions.silentCheckSsoRedirectUri;
-        }
-
-        if (typeof initOptions.silentCheckSsoFallback === 'boolean') {
-            kc.silentCheckSsoFallback = initOptions.silentCheckSsoFallback;
-        } else {
-            kc.silentCheckSsoFallback = true;
-        }
-
-        if (typeof initOptions.pkceMethod !== "undefined") {
-            if (initOptions.pkceMethod !== "S256" && initOptions.pkceMethod !== false) {
-                throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${initOptions.pkceMethod}.`);
-            }
-
-            kc.pkceMethod = initOptions.pkceMethod;
-        } else {
-            kc.pkceMethod = "S256";
-        }
-
-        if (typeof initOptions.enableLogging === 'boolean') {
-            kc.enableLogging = initOptions.enableLogging;
-        } else {
-            kc.enableLogging = false;
-        }
-
-        if (initOptions.logoutMethod === 'POST') {
-            kc.logoutMethod = 'POST';
-        } else {
-            kc.logoutMethod = 'GET';
-        }
-
-        if (typeof initOptions.scope === 'string') {
-            kc.scope = initOptions.scope;
-        }
-
-        if (typeof initOptions.acrValues === 'string') {
-            kc.acrValues = initOptions.acrValues;
-        }
-
-        if (typeof initOptions.messageReceiveTimeout === 'number' && initOptions.messageReceiveTimeout > 0) {
-            kc.messageReceiveTimeout = initOptions.messageReceiveTimeout;
-        } else {
-            kc.messageReceiveTimeout = 10000;
-        }
-
-        if (!kc.responseMode) {
-            kc.responseMode = 'fragment';
-        }
-        if (!kc.responseType) {
-            kc.responseType = 'code';
-            kc.flow = 'standard';
-        }
-
-        var promise = createPromise();
-
-        var initPromise = createPromise();
-        initPromise.promise.then(function() {
-            kc.onReady && kc.onReady(kc.authenticated);
-            promise.setSuccess(kc.authenticated);
-        }).catch(function(error) {
-            promise.setError(error);
-        });
-
-        var configPromise = loadConfig();
-
-        function onLoad() {
-            var doLogin = function(prompt) {
-                if (!prompt) {
-                    options.prompt = 'none';
-                }
-
-                if (initOptions.locale) {
-                    options.locale = initOptions.locale;
-                }
-                kc.login(options).then(function () {
-                    initPromise.setSuccess();
-                }).catch(function (error) {
-                    initPromise.setError(error);
-                });
-            }
-
-            var checkSsoSilently = async function() {
-                var ifrm = document.createElement("iframe");
-                var src = await kc.createLoginUrl({prompt: 'none', redirectUri: kc.silentCheckSsoRedirectUri});
-                ifrm.setAttribute("src", src);
-                ifrm.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin");
-                ifrm.setAttribute("title", "keycloak-silent-check-sso");
-                ifrm.style.display = "none";
-                document.body.appendChild(ifrm);
-
-                var messageCallback = function(event) {
-                    if (event.origin !== window.location.origin || ifrm.contentWindow !== event.source) {
-                        return;
-                    }
-
-                    var oauth = parseCallback(event.data);
-                    processCallback(oauth, initPromise);
-
-                    document.body.removeChild(ifrm);
-                    window.removeEventListener("message", messageCallback);
-                };
-
-                window.addEventListener("message", messageCallback);
-            };
-
-            var options = {};
-            switch (initOptions.onLoad) {
-                case 'check-sso':
-                    if (loginIframe.enable) {
-                        setupCheckLoginIframe().then(function() {
-                            checkLoginIframe().then(function (unchanged) {
-                                if (!unchanged) {
-                                    kc.silentCheckSsoRedirectUri ? checkSsoSilently() : doLogin(false);
-                                } else {
-                                    initPromise.setSuccess();
-                                }
-                            }).catch(function (error) {
-                                initPromise.setError(error);
-                            });
-                        });
-                    } else {
-                        kc.silentCheckSsoRedirectUri ? checkSsoSilently() : doLogin(false);
-                    }
-                    break;
-                case 'login-required':
-                    doLogin(true);
-                    break;
-                default:
-                    throw 'Invalid value for onLoad';
-            }
-        }
-
-        function processInit() {
-            var callback = parseCallback(window.location.href);
-
-            if (callback) {
-                window.history.replaceState(window.history.state, null, callback.newUrl);
-            }
-
-            if (callback && callback.valid) {
-                return setupCheckLoginIframe().then(function() {
-                    processCallback(callback, initPromise);
-                }).catch(function (error) {
-                    initPromise.setError(error);
-                });
-            }
-
-            if (initOptions.token && initOptions.refreshToken) {
-                setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
-
-                if (loginIframe.enable) {
-                    setupCheckLoginIframe().then(function() {
-                        checkLoginIframe().then(function (unchanged) {
-                            if (unchanged) {
-                                kc.onAuthSuccess && kc.onAuthSuccess();
-                                initPromise.setSuccess();
-                                scheduleCheckIframe();
-                            } else {
-                                initPromise.setSuccess();
-                            }
-                        }).catch(function (error) {
-                            initPromise.setError(error);
-                        });
-                    });
-                } else {
-                    kc.updateToken(-1).then(function() {
-                        kc.onAuthSuccess && kc.onAuthSuccess();
-                        initPromise.setSuccess();
-                    }).catch(function(error) {
-                        kc.onAuthError && kc.onAuthError();
-                        if (initOptions.onLoad) {
-                            onLoad();
-                        } else {
-                            initPromise.setError(error);
-                        }
-                    });
-                }
-            } else if (initOptions.onLoad) {
-                onLoad();
-            } else {
-                initPromise.setSuccess();
-            }
-        }
-
-        configPromise.then(function () {
-            check3pCookiesSupported()
-                .then(processInit)
-                .catch(function (error) {
-                    promise.setError(error);
-                });
-        });
-        configPromise.catch(function (error) {
-            promise.setError(error);
-        });
-
-        return promise.promise;
-    }
-
-    kc.login = function (options) {
-        return adapter.login(options);
-    }
-
-    function generateRandomData(len) {
-        if (typeof crypto === "undefined" || typeof crypto.getRandomValues === "undefined") {
-            throw new Error("Web Crypto API is not available.");
-        }
-
-        return crypto.getRandomValues(new Uint8Array(len));
-    }
-
-    function generateCodeVerifier(len) {
-        return generateRandomString(len, 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789');
-    }
-
-    function generateRandomString(len, alphabet){
-        var randomData = generateRandomData(len);
-        var chars = new Array(len);
-        for (var i = 0; i < len; i++) {
-            chars[i] = alphabet.charCodeAt(randomData[i] % alphabet.length);
-        }
-        return String.fromCharCode.apply(null, chars);
-    }
-
-    async function generatePkceChallenge(pkceMethod, codeVerifier) {
-        if (pkceMethod !== "S256") {
-            throw new TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${pkceMethod}'.`);
-        }
-
-        // hash codeVerifier, then encode as url-safe base64 without padding
-        const hashBytes = new Uint8Array(await sha256Digest(codeVerifier));
-        const encodedHash = bytesToBase64(hashBytes)
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/\=/g, '');
-
-        return encodedHash;
-    }
-
-    function buildClaimsParameter(requestedAcr){
-        var claims = {
-            id_token: {
-                acr: requestedAcr
-            }
-        }
-        return JSON.stringify(claims);
-    }
-
-    kc.createLoginUrl = async function(options) {
-        var state = createUUID();
-        var nonce = createUUID();
-
-        var redirectUri = adapter.redirectUri(options);
-
-        var callbackState = {
-            state: state,
-            nonce: nonce,
-            redirectUri: encodeURIComponent(redirectUri),
-            loginOptions: options
-        };
-
-        if (options && options.prompt) {
-            callbackState.prompt = options.prompt;
-        }
-
-        var baseUrl;
-        if (options && options.action == 'register') {
-            baseUrl = kc.endpoints.register();
-        } else {
-            baseUrl = kc.endpoints.authorize();
-        }
-
-        var scope = options && options.scope || kc.scope;
-        if (!scope) {
-            // if scope is not set, default to "openid"
-            scope = "openid";
-        } else if (scope.indexOf("openid") === -1) {
-            // if openid scope is missing, prefix the given scopes with it
-            scope = "openid " + scope;
-        }
-
-        var url = baseUrl
-            + '?client_id=' + encodeURIComponent(kc.clientId)
-            + '&redirect_uri=' + encodeURIComponent(redirectUri)
-            + '&state=' + encodeURIComponent(state)
-            + '&response_mode=' + encodeURIComponent(kc.responseMode)
-            + '&response_type=' + encodeURIComponent(kc.responseType)
-            + '&scope=' + encodeURIComponent(scope);
-        if (useNonce) {
-            url = url + '&nonce=' + encodeURIComponent(nonce);
-        }
-
-        if (options && options.prompt) {
-            url += '&prompt=' + encodeURIComponent(options.prompt);
-        }
-
-        if (options && typeof options.maxAge === 'number') {
-            url += '&max_age=' + encodeURIComponent(options.maxAge);
-        }
-
-        if (options && options.loginHint) {
-            url += '&login_hint=' + encodeURIComponent(options.loginHint);
-        }
-
-        if (options && options.idpHint) {
-            url += '&kc_idp_hint=' + encodeURIComponent(options.idpHint);
-        }
-
-        if (options && options.action && options.action != 'register') {
-            url += '&kc_action=' + encodeURIComponent(options.action);
-        }
-
-        if (options && options.locale) {
-            url += '&ui_locales=' + encodeURIComponent(options.locale);
-        }
-
-        if (options && options.acr) {
-            var claimsParameter = buildClaimsParameter(options.acr);
-            url += '&claims=' + encodeURIComponent(claimsParameter);
-        }
-
-        if ((options && options.acrValues) || kc.acrValues) {
-            url += '&acr_values=' + encodeURIComponent(options.acrValues || kc.acrValues);
-        }
-
-        if (kc.pkceMethod) {
-            try {
-                const codeVerifier = generateCodeVerifier(96);
-                const pkceChallenge = await generatePkceChallenge(kc.pkceMethod, codeVerifier);
-
-                callbackState.pkceCodeVerifier = codeVerifier;
-
-                url += '&code_challenge=' + pkceChallenge;
-                url += '&code_challenge_method=' + kc.pkceMethod;
-            } catch (error) {
-                throw new Error("Failed to generate PKCE challenge.", { cause: error });
-            }
-        }
-
-        callbackStorage.add(callbackState);
-
-        return url;
-    }
-
-    kc.logout = function(options) {
-        return adapter.logout(options);
-    }
-
-    kc.createLogoutUrl = function(options) {
-
-        const logoutMethod = options?.logoutMethod ?? kc.logoutMethod;
-        if (logoutMethod === 'POST') {
-            return kc.endpoints.logout();
-        }
-
-        var url = kc.endpoints.logout()
-            + '?client_id=' + encodeURIComponent(kc.clientId)
-            + '&post_logout_redirect_uri=' + encodeURIComponent(adapter.redirectUri(options, false));
-
-        if (kc.idToken) {
-            url += '&id_token_hint=' + encodeURIComponent(kc.idToken);
-        }
-
-        return url;
-    }
-
-    kc.register = function (options) {
-        return adapter.register(options);
-    }
-
-    kc.createRegisterUrl = async function(options) {
-        if (!options) {
-            options = {};
-        }
-        options.action = 'register';
-        return await kc.createLoginUrl(options);
-    }
-
-    kc.createAccountUrl = function(options) {
-        var realm = getRealmUrl();
-        var url = undefined;
-        if (typeof realm !== 'undefined') {
-            url = realm
-            + '/account'
-            + '?referrer=' + encodeURIComponent(kc.clientId)
-            + '&referrer_uri=' + encodeURIComponent(adapter.redirectUri(options));
-        }
-        return url;
-    }
-
-    kc.accountManagement = function() {
-        return adapter.accountManagement();
-    }
-
-    kc.hasRealmRole = function (role) {
-        var access = kc.realmAccess;
-        return !!access && access.roles.indexOf(role) >= 0;
-    }
-
-    kc.hasResourceRole = function(role, resource) {
-        if (!kc.resourceAccess) {
-            return false;
-        }
-
-        var access = kc.resourceAccess[resource || kc.clientId];
-        return !!access && access.roles.indexOf(role) >= 0;
-    }
-
-    kc.loadUserProfile = function() {
-        var url = getRealmUrl() + '/account';
-        var req = new XMLHttpRequest();
-        req.open('GET', url, true);
-        req.setRequestHeader('Accept', 'application/json');
-        req.setRequestHeader('Authorization', 'bearer ' + kc.token);
-
-        var promise = createPromise();
-
-        req.onreadystatechange = function () {
-            if (req.readyState == 4) {
-                if (req.status == 200) {
-                    kc.profile = JSON.parse(req.responseText);
-                    promise.setSuccess(kc.profile);
-                } else {
-                    promise.setError();
-                }
-            }
-        }
-
-        req.send();
-
-        return promise.promise;
-    }
-
-    kc.loadUserInfo = function() {
-        var url = kc.endpoints.userinfo();
-        var req = new XMLHttpRequest();
-        req.open('GET', url, true);
-        req.setRequestHeader('Accept', 'application/json');
-        req.setRequestHeader('Authorization', 'bearer ' + kc.token);
-
-        var promise = createPromise();
-
-        req.onreadystatechange = function () {
-            if (req.readyState == 4) {
-                if (req.status == 200) {
-                    kc.userInfo = JSON.parse(req.responseText);
-                    promise.setSuccess(kc.userInfo);
-                } else {
-                    promise.setError();
-                }
-            }
-        }
-
-        req.send();
-
-        return promise.promise;
-    }
-
-    kc.isTokenExpired = function(minValidity) {
-        if (!kc.tokenParsed || (!kc.refreshToken && kc.flow != 'implicit' )) {
-            throw 'Not authenticated';
-        }
-
-        if (kc.timeSkew == null) {
-            logInfo('[KEYCLOAK] Unable to determine if token is expired as timeskew is not set');
-            return true;
-        }
-
-        var expiresIn = kc.tokenParsed['exp'] - Math.ceil(new Date().getTime() / 1000) + kc.timeSkew;
-        if (minValidity) {
-            if (isNaN(minValidity)) {
-                throw 'Invalid minValidity';
-            }
-            expiresIn -= minValidity;
-        }
-        return expiresIn < 0;
-    }
-
-    kc.updateToken = function(minValidity) {
-        var promise = createPromise();
-
-        if (!kc.refreshToken) {
-            promise.setError();
-            return promise.promise;
-        }
-
-        minValidity = minValidity || 5;
-
-        var exec = function() {
-            var refreshToken = false;
-            if (minValidity == -1) {
-                refreshToken = true;
-                logInfo('[KEYCLOAK] Refreshing token: forced refresh');
-            } else if (!kc.tokenParsed || kc.isTokenExpired(minValidity)) {
-                refreshToken = true;
-                logInfo('[KEYCLOAK] Refreshing token: token expired');
-            }
-
-            if (!refreshToken) {
-                promise.setSuccess(false);
-            } else {
-                var params = 'grant_type=refresh_token&' + 'refresh_token=' + kc.refreshToken;
-                var url = kc.endpoints.token();
-
-                refreshQueue.push(promise);
-
-                if (refreshQueue.length == 1) {
-                    var req = new XMLHttpRequest();
-                    req.open('POST', url, true);
-                    req.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
-                    req.withCredentials = true;
-
-                    params += '&client_id=' + encodeURIComponent(kc.clientId);
-
-                    var timeLocal = new Date().getTime();
-
-                    req.onreadystatechange = function () {
-                        if (req.readyState == 4) {
-                            if (req.status == 200) {
-                                logInfo('[KEYCLOAK] Token refreshed');
-
-                                timeLocal = (timeLocal + new Date().getTime()) / 2;
-
-                                var tokenResponse = JSON.parse(req.responseText);
-
-                                setToken(tokenResponse['access_token'], tokenResponse['refresh_token'], tokenResponse['id_token'], timeLocal);
-
-                                kc.onAuthRefreshSuccess && kc.onAuthRefreshSuccess();
-                                for (var p = refreshQueue.pop(); p != null; p = refreshQueue.pop()) {
-                                    p.setSuccess(true);
-                                }
-                            } else {
-                                logWarn('[KEYCLOAK] Failed to refresh token');
-
-                                if (req.status == 400) {
-                                    kc.clearToken();
-                                }
-
-                                kc.onAuthRefreshError && kc.onAuthRefreshError();
-                                for (var p = refreshQueue.pop(); p != null; p = refreshQueue.pop()) {
-                                    p.setError("Failed to refresh token: An unexpected HTTP error occurred while attempting to refresh the token.");
-                                }
-                            }
-                        }
-                    };
-
-                    req.send(params);
-                }
-            }
-        }
-
-        if (loginIframe.enable) {
-            var iframePromise = checkLoginIframe();
-            iframePromise.then(function() {
-                exec();
-            }).catch(function(error) {
-                promise.setError(error);
-            });
-        } else {
-            exec();
-        }
-
-        return promise.promise;
-    }
-
-    kc.clearToken = function() {
-        if (kc.token) {
-            setToken(null, null, null);
-            kc.onAuthLogout && kc.onAuthLogout();
-            if (kc.loginRequired) {
-                kc.login();
-            }
-        }
-    }
-
-    function getRealmUrl() {
-        if (typeof kc.authServerUrl !== 'undefined') {
-            if (kc.authServerUrl.charAt(kc.authServerUrl.length - 1) == '/') {
-                return kc.authServerUrl + 'realms/' + encodeURIComponent(kc.realm);
-            } else {
-                return kc.authServerUrl + '/realms/' + encodeURIComponent(kc.realm);
-            }
-        } else {
-            return undefined;
-        }
-    }
-
-    function getOrigin() {
-        if (!window.location.origin) {
-            return window.location.protocol + "//" + window.location.hostname + (window.location.port ? ':' + window.location.port: '');
-        } else {
-            return window.location.origin;
-        }
-    }
-
-    function processCallback(oauth, promise) {
-        var code = oauth.code;
-        var error = oauth.error;
-        var prompt = oauth.prompt;
-
-        var timeLocal = new Date().getTime();
-
-        if (oauth['kc_action_status']) {
-            kc.onActionUpdate && kc.onActionUpdate(oauth['kc_action_status'], oauth['kc_action']);
-        }
-
-        if (error) {
-            if (prompt != 'none') {
-                if (oauth.error_description && oauth.error_description === "authentication_expired") {
-                    kc.login(oauth.loginOptions);
-                } else {
-                    var errorData = { error: error, error_description: oauth.error_description };
-                    kc.onAuthError && kc.onAuthError(errorData);
-                    promise && promise.setError(errorData);
-                }
-            } else {
-                promise && promise.setSuccess();
-            }
-            return;
-        } else if ((kc.flow != 'standard') && (oauth.access_token || oauth.id_token)) {
-            authSuccess(oauth.access_token, null, oauth.id_token, true);
-        }
-
-        if ((kc.flow != 'implicit') && code) {
-            var params = 'code=' + code + '&grant_type=authorization_code';
-            var url = kc.endpoints.token();
-
-            var req = new XMLHttpRequest();
-            req.open('POST', url, true);
-            req.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
-
-            params += '&client_id=' + encodeURIComponent(kc.clientId);
-            params += '&redirect_uri=' + oauth.redirectUri;
-
-            if (oauth.pkceCodeVerifier) {
-                params += '&code_verifier=' + oauth.pkceCodeVerifier;
-            }
-
-            req.withCredentials = true;
-
-            req.onreadystatechange = function() {
-                if (req.readyState == 4) {
-                    if (req.status == 200) {
-
-                        var tokenResponse = JSON.parse(req.responseText);
-                        authSuccess(tokenResponse['access_token'], tokenResponse['refresh_token'], tokenResponse['id_token'], kc.flow === 'standard');
-                        scheduleCheckIframe();
-                    } else {
-                        kc.onAuthError && kc.onAuthError();
-                        promise && promise.setError();
-                    }
-                }
-            };
-
-            req.send(params);
-        }
-
-        function authSuccess(accessToken, refreshToken, idToken, fulfillPromise) {
-            timeLocal = (timeLocal + new Date().getTime()) / 2;
-
-            setToken(accessToken, refreshToken, idToken, timeLocal);
-
-            if (useNonce && (kc.idTokenParsed && kc.idTokenParsed.nonce != oauth.storedNonce)) {
-                logInfo('[KEYCLOAK] Invalid nonce, clearing token');
-                kc.clearToken();
-                promise && promise.setError();
-            } else {
-                if (fulfillPromise) {
-                    kc.onAuthSuccess && kc.onAuthSuccess();
-                    promise && promise.setSuccess();
-                }
-            }
-        }
-
-    }
-
-    function loadConfig() {
-        var promise = createPromise();
-        var configUrl;
-
-        if (typeof config === 'string') {
-            configUrl = config;
-        }
-
-        function setupOidcEndoints(oidcConfiguration) {
-            if (! oidcConfiguration) {
-                kc.endpoints = {
-                    authorize: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/auth';
-                    },
-                    token: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/token';
-                    },
-                    logout: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/logout';
-                    },
-                    checkSessionIframe: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/login-status-iframe.html';
-                    },
-                    thirdPartyCookiesIframe: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/3p-cookies/step1.html';
-                    },
-                    register: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/registrations';
-                    },
-                    userinfo: function() {
-                        return getRealmUrl() + '/protocol/openid-connect/userinfo';
-                    }
-                };
-            } else {
-                kc.endpoints = {
-                    authorize: function() {
-                        return oidcConfiguration.authorization_endpoint;
-                    },
-                    token: function() {
-                        return oidcConfiguration.token_endpoint;
-                    },
-                    logout: function() {
-                        if (!oidcConfiguration.end_session_endpoint) {
-                            throw "Not supported by the OIDC server";
-                        }
-                        return oidcConfiguration.end_session_endpoint;
-                    },
-                    checkSessionIframe: function() {
-                        if (!oidcConfiguration.check_session_iframe) {
-                            throw "Not supported by the OIDC server";
-                        }
-                        return oidcConfiguration.check_session_iframe;
-                    },
-                    register: function() {
-                        throw 'Redirection to "Register user" page not supported in standard OIDC mode';
-                    },
-                    userinfo: function() {
-                        if (!oidcConfiguration.userinfo_endpoint) {
-                            throw "Not supported by the OIDC server";
-                        }
-                        return oidcConfiguration.userinfo_endpoint;
-                    }
-                }
-            }
-        }
-
-        if (configUrl) {
-            var req = new XMLHttpRequest();
-            req.open('GET', configUrl, true);
-            req.setRequestHeader('Accept', 'application/json');
-
-            req.onreadystatechange = function () {
-                if (req.readyState == 4) {
-                    if (req.status == 200 || fileLoaded(req)) {
-                        var config = JSON.parse(req.responseText);
-
-                        kc.authServerUrl = config['auth-server-url'];
-                        kc.realm = config['realm'];
-                        kc.clientId = config['resource'];
-                        setupOidcEndoints(null);
-                        promise.setSuccess();
-                    } else {
-                        promise.setError();
-                    }
-                }
-            };
-
-            req.send();
-        } else {
-            kc.clientId = config.clientId;
-
-            var oidcProvider = config['oidcProvider'];
-            if (!oidcProvider) {
-                kc.authServerUrl = config.url;
-                kc.realm = config.realm;
-                setupOidcEndoints(null);
-                promise.setSuccess();
-            } else {
-                if (typeof oidcProvider === 'string') {
-                    var oidcProviderConfigUrl;
-                    if (oidcProvider.charAt(oidcProvider.length - 1) == '/') {
-                        oidcProviderConfigUrl = oidcProvider + '.well-known/openid-configuration';
-                    } else {
-                        oidcProviderConfigUrl = oidcProvider + '/.well-known/openid-configuration';
-                    }
-                    var req = new XMLHttpRequest();
-                    req.open('GET', oidcProviderConfigUrl, true);
-                    req.setRequestHeader('Accept', 'application/json');
-
-                    req.onreadystatechange = function () {
-                        if (req.readyState == 4) {
-                            if (req.status == 200 || fileLoaded(req)) {
-                                var oidcProviderConfig = JSON.parse(req.responseText);
-                                setupOidcEndoints(oidcProviderConfig);
-                                promise.setSuccess();
-                            } else {
-                                promise.setError();
-                            }
-                        }
-                    };
-
-                    req.send();
-                } else {
-                    setupOidcEndoints(oidcProvider);
-                    promise.setSuccess();
-                }
-            }
-        }
-
-        return promise.promise;
-    }
-
-    function fileLoaded(xhr) {
-        return xhr.status == 0 && xhr.responseText && xhr.responseURL.startsWith('file:');
-    }
-
-    function setToken(token, refreshToken, idToken, timeLocal) {
-        if (kc.tokenTimeoutHandle) {
-            clearTimeout(kc.tokenTimeoutHandle);
-            kc.tokenTimeoutHandle = null;
-        }
-
-        if (refreshToken) {
-            kc.refreshToken = refreshToken;
-            kc.refreshTokenParsed = decodeToken(refreshToken);
-        } else {
-            delete kc.refreshToken;
-            delete kc.refreshTokenParsed;
-        }
-
-        if (idToken) {
-            kc.idToken = idToken;
-            kc.idTokenParsed = decodeToken(idToken);
-        } else {
-            delete kc.idToken;
-            delete kc.idTokenParsed;
-        }
-
-        if (token) {
-            kc.token = token;
-            kc.tokenParsed = decodeToken(token);
-            kc.sessionId = kc.tokenParsed.sid;
-            kc.authenticated = true;
-            kc.subject = kc.tokenParsed.sub;
-            kc.realmAccess = kc.tokenParsed.realm_access;
-            kc.resourceAccess = kc.tokenParsed.resource_access;
-
-            if (timeLocal) {
-                kc.timeSkew = Math.floor(timeLocal / 1000) - kc.tokenParsed.iat;
-            }
-
-            if (kc.timeSkew != null) {
-                logInfo('[KEYCLOAK] Estimated time difference between browser and server is ' + kc.timeSkew + ' seconds');
-
-                if (kc.onTokenExpired) {
-                    var expiresIn = (kc.tokenParsed['exp'] - (new Date().getTime() / 1000) + kc.timeSkew) * 1000;
-                    logInfo('[KEYCLOAK] Token expires in ' + Math.round(expiresIn / 1000) + ' s');
-                    if (expiresIn <= 0) {
-                        kc.onTokenExpired();
-                    } else {
-                        kc.tokenTimeoutHandle = setTimeout(kc.onTokenExpired, expiresIn);
-                    }
-                }
-            }
-        } else {
-            delete kc.token;
-            delete kc.tokenParsed;
-            delete kc.subject;
-            delete kc.realmAccess;
-            delete kc.resourceAccess;
-
-            kc.authenticated = false;
-        }
-    }
-
-    function createUUID() {
-        if (typeof crypto === "undefined" || typeof crypto.randomUUID === "undefined") {
-            throw new Error("Web Crypto API is not available.");
-        }
-
-        return crypto.randomUUID();
-    }
-
-    function parseCallback(url) {
-        var oauth = parseCallbackUrl(url);
-        if (!oauth) {
-            return;
-        }
-
-        var oauthState = callbackStorage.get(oauth.state);
-
-        if (oauthState) {
-            oauth.valid = true;
-            oauth.redirectUri = oauthState.redirectUri;
-            oauth.storedNonce = oauthState.nonce;
-            oauth.prompt = oauthState.prompt;
-            oauth.pkceCodeVerifier = oauthState.pkceCodeVerifier;
-            oauth.loginOptions = oauthState.loginOptions;
-        }
-
-        return oauth;
-    }
-
-    function parseCallbackUrl(url) {
-        var supportedParams;
-        switch (kc.flow) {
-            case 'standard':
-                supportedParams = ['code', 'state', 'session_state', 'kc_action_status', 'kc_action', 'iss'];
-                break;
-            case 'implicit':
-                supportedParams = ['access_token', 'token_type', 'id_token', 'state', 'session_state', 'expires_in', 'kc_action_status', 'kc_action', 'iss'];
-                break;
-            case 'hybrid':
-                supportedParams = ['access_token', 'token_type', 'id_token', 'code', 'state', 'session_state', 'expires_in', 'kc_action_status', 'kc_action', 'iss'];
-                break;
-        }
-
-        supportedParams.push('error');
-        supportedParams.push('error_description');
-        supportedParams.push('error_uri');
-
-        var queryIndex = url.indexOf('?');
-        var fragmentIndex = url.indexOf('#');
-
-        var newUrl;
-        var parsed;
-
-        if (kc.responseMode === 'query' && queryIndex !== -1) {
-            newUrl = url.substring(0, queryIndex);
-            parsed = parseCallbackParams(url.substring(queryIndex + 1, fragmentIndex !== -1 ? fragmentIndex : url.length), supportedParams);
-            if (parsed.paramsString !== '') {
-                newUrl += '?' + parsed.paramsString;
-            }
-            if (fragmentIndex !== -1) {
-                newUrl += url.substring(fragmentIndex);
-            }
-        } else if (kc.responseMode === 'fragment' && fragmentIndex !== -1) {
-            newUrl = url.substring(0, fragmentIndex);
-            parsed = parseCallbackParams(url.substring(fragmentIndex + 1), supportedParams);
-            if (parsed.paramsString !== '') {
-                newUrl += '#' + parsed.paramsString;
-            }
-        }
-
-        if (parsed && parsed.oauthParams) {
-            if (kc.flow === 'standard' || kc.flow === 'hybrid') {
-                if ((parsed.oauthParams.code || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                    parsed.oauthParams.newUrl = newUrl;
-                    return parsed.oauthParams;
-                }
-            } else if (kc.flow === 'implicit') {
-                if ((parsed.oauthParams.access_token || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                    parsed.oauthParams.newUrl = newUrl;
-                    return parsed.oauthParams;
-                }
-            }
-        }
-    }
-
-    function parseCallbackParams(paramsString, supportedParams) {
-        var p = paramsString.split('&');
-        var result = {
-            paramsString: '',
-            oauthParams: {}
-        }
-        for (var i = 0; i < p.length; i++) {
-            var split = p[i].indexOf("=");
-            var key = p[i].slice(0, split);
-            if (supportedParams.indexOf(key) !== -1) {
-                result.oauthParams[key] = p[i].slice(split + 1);
-            } else {
-                if (result.paramsString !== '') {
-                    result.paramsString += '&';
-                }
-                result.paramsString += p[i];
-            }
-        }
-        return result;
-    }
-
-    function createPromise() {
-        // Need to create a native Promise which also preserves the
-        // interface of the custom promise type previously used by the API
-        var p = {
-            setSuccess: function(result) {
-                p.resolve(result);
-            },
-
-            setError: function(result) {
-                p.reject(result);
-            }
-        };
-        p.promise = new Promise(function(resolve, reject) {
-            p.resolve = resolve;
-            p.reject = reject;
-        });
-
-        return p;
-    }
-
-    // Function to extend existing native Promise with timeout
-    function applyTimeoutToPromise(promise, timeout, errorMessage) {
-        var timeoutHandle = null;
-        var timeoutPromise = new Promise(function (resolve, reject) {
-            timeoutHandle = setTimeout(function () {
-                reject({ "error": errorMessage || "Promise is not settled within timeout of " + timeout + "ms" });
-            }, timeout);
-        });
-
-        return Promise.race([promise, timeoutPromise]).finally(function () {
-            clearTimeout(timeoutHandle);
-        });
-    }
-
-    function setupCheckLoginIframe() {
-        var promise = createPromise();
-
-        if (!loginIframe.enable) {
-            promise.setSuccess();
-            return promise.promise;
-        }
-
-        if (loginIframe.iframe) {
-            promise.setSuccess();
-            return promise.promise;
-        }
-
-        var iframe = document.createElement('iframe');
-        loginIframe.iframe = iframe;
-
-        iframe.onload = function() {
-            var authUrl = kc.endpoints.authorize();
-            if (authUrl.charAt(0) === '/') {
-                loginIframe.iframeOrigin = getOrigin();
-            } else {
-                loginIframe.iframeOrigin = authUrl.substring(0, authUrl.indexOf('/', 8));
-            }
-            promise.setSuccess();
-        }
-
-        var src = kc.endpoints.checkSessionIframe();
-        iframe.setAttribute('src', src );
-        iframe.setAttribute('sandbox', 'allow-storage-access-by-user-activation allow-scripts allow-same-origin');
-        iframe.setAttribute('title', 'keycloak-session-iframe' );
-        iframe.style.display = 'none';
-        document.body.appendChild(iframe);
-
-        var messageCallback = function(event) {
-            if ((event.origin !== loginIframe.iframeOrigin) || (loginIframe.iframe.contentWindow !== event.source)) {
-                return;
-            }
-
-            if (!(event.data == 'unchanged' || event.data == 'changed' || event.data == 'error')) {
-                return;
-            }
-
-
-            if (event.data != 'unchanged') {
-                kc.clearToken();
-            }
-
-            var callbacks = loginIframe.callbackList.splice(0, loginIframe.callbackList.length);
-
-            for (var i = callbacks.length - 1; i >= 0; --i) {
-                var promise = callbacks[i];
-                if (event.data == 'error') {
-                    promise.setError();
-                } else {
-                    promise.setSuccess(event.data == 'unchanged');
-                }
-            }
-        };
-
-        window.addEventListener('message', messageCallback, false);
-
-        return promise.promise;
-    }
-
-    function scheduleCheckIframe() {
-        if (loginIframe.enable) {
-            if (kc.token) {
-                setTimeout(function() {
-                    checkLoginIframe().then(function(unchanged) {
-                        if (unchanged) {
-                            scheduleCheckIframe();
-                        }
-                    });
-                }, loginIframe.interval * 1000);
-            }
-        }
-    }
-
-    function checkLoginIframe() {
-        var promise = createPromise();
-
-        if (loginIframe.iframe && loginIframe.iframeOrigin ) {
-            var msg = kc.clientId + ' ' + (kc.sessionId ? kc.sessionId : '');
-            loginIframe.callbackList.push(promise);
-            var origin = loginIframe.iframeOrigin;
-            if (loginIframe.callbackList.length == 1) {
-                loginIframe.iframe.contentWindow.postMessage(msg, origin);
-            }
-        } else {
-            promise.setSuccess();
-        }
-
-        return promise.promise;
-    }
-
-    function check3pCookiesSupported() {
-        var promise = createPromise();
-
-        if ((loginIframe.enable || kc.silentCheckSsoRedirectUri) && typeof kc.endpoints.thirdPartyCookiesIframe === 'function') {
-            var iframe = document.createElement('iframe');
-            iframe.setAttribute('src', kc.endpoints.thirdPartyCookiesIframe());
-            iframe.setAttribute('sandbox', 'allow-storage-access-by-user-activation allow-scripts allow-same-origin');
-            iframe.setAttribute('title', 'keycloak-3p-check-iframe' );
-            iframe.style.display = 'none';
-            document.body.appendChild(iframe);
-
-            var messageCallback = function(event) {
-                if (iframe.contentWindow !== event.source) {
-                    return;
-                }
-
-                if (event.data !== "supported" && event.data !== "unsupported") {
-                    return;
-                } else if (event.data === "unsupported") {
-                    logWarn(
-                        "[KEYCLOAK] Your browser is blocking access to 3rd-party cookies, this means:\n\n" +
-                        " - It is not possible to retrieve tokens without redirecting to the Keycloak server (a.k.a. no support for silent authentication).\n" +
-                        " - It is not possible to automatically detect changes to the session status (such as the user logging out in another tab).\n\n" +
-                        "For more information see: https://www.keycloak.org/securing-apps/javascript-adapter#_modern_browsers"
-                    );
-
-                    loginIframe.enable = false;
-                    if (kc.silentCheckSsoFallback) {
-                        kc.silentCheckSsoRedirectUri = false;
-                    }
-                }
-
-                document.body.removeChild(iframe);
-                window.removeEventListener("message", messageCallback);
-                promise.setSuccess();
-            };
-
-            window.addEventListener('message', messageCallback, false);
-        } else {
-            promise.setSuccess();
-        }
-
-        return applyTimeoutToPromise(promise.promise, kc.messageReceiveTimeout, "Timeout when waiting for 3rd party check iframe message.");
-    }
-
-    function loadAdapter(type) {
-        if (!type || type == 'default') {
-            return {
-                login: async function(options) {
-                    window.location.assign(await kc.createLoginUrl(options));
-                    return createPromise().promise;
-                },
-
-                logout: async function(options) {
-
-                    const logoutMethod = options?.logoutMethod ?? kc.logoutMethod;
-                    if (logoutMethod === "GET") {
-                        window.location.replace(kc.createLogoutUrl(options));
-                        return;
-                    }
-
-                    // Create form to send POST request.
-                    const form = document.createElement("form");
-
-                    form.setAttribute("method", "POST");
-                    form.setAttribute("action", kc.createLogoutUrl(options));
-                    form.style.display = "none";
-
-                    // Add data to form as hidden input fields.
-                    const data = {
-                        id_token_hint: kc.idToken,
-                        client_id: kc.clientId,
-                        post_logout_redirect_uri: adapter.redirectUri(options, false)
-                    };
-
-                    for (const [name, value] of Object.entries(data)) {
-                        const input = document.createElement("input");
-
-                        input.setAttribute("type", "hidden");
-                        input.setAttribute("name", name);
-                        input.setAttribute("value", value);
-
-                        form.appendChild(input);
-                    }
-
-                    // Append form to page and submit it to perform logout and redirect.
-                    document.body.appendChild(form);
-                    form.submit();
-                },
-
-                register: async function(options) {
-                    window.location.assign(await kc.createRegisterUrl(options));
-                    return createPromise().promise;
-                },
-
-                accountManagement : function() {
-                    var accountUrl = kc.createAccountUrl();
-                    if (typeof accountUrl !== 'undefined') {
-                        window.location.href = accountUrl;
-                    } else {
-                        throw "Not supported by the OIDC server";
-                    }
-                    return createPromise().promise;
-                },
-
-                redirectUri: function(options, encodeHash) {
-                    if (arguments.length == 1) {
-                        encodeHash = true;
-                    }
-
-                    if (options && options.redirectUri) {
-                        return options.redirectUri;
-                    } else if (kc.redirectUri) {
-                        return kc.redirectUri;
-                    } else {
-                        return location.href;
-                    }
-                }
-            };
-        }
-
-        if (type == 'cordova') {
-            loginIframe.enable = false;
-            var cordovaOpenWindowWrapper = function(loginUrl, target, options) {
-                if (window.cordova && window.cordova.InAppBrowser) {
-                    // Use inappbrowser for IOS and Android if available
-                    return window.cordova.InAppBrowser.open(loginUrl, target, options);
-                } else {
-                    return window.open(loginUrl, target, options);
-                }
-            };
-
-            var shallowCloneCordovaOptions = function (userOptions) {
-                if (userOptions && userOptions.cordovaOptions) {
-                    return Object.keys(userOptions.cordovaOptions).reduce(function (options, optionName) {
-                        options[optionName] = userOptions.cordovaOptions[optionName];
-                        return options;
-                    }, {});
-                } else {
-                    return {};
-                }
-            };
-
-            var formatCordovaOptions = function (cordovaOptions) {
-                return Object.keys(cordovaOptions).reduce(function (options, optionName) {
-                    options.push(optionName+"="+cordovaOptions[optionName]);
-                    return options;
-                }, []).join(",");
-            };
-
-            var createCordovaOptions = function (userOptions) {
-                var cordovaOptions = shallowCloneCordovaOptions(userOptions);
-                cordovaOptions.location = 'no';
-                if (userOptions && userOptions.prompt == 'none') {
-                    cordovaOptions.hidden = 'yes';
-                }
-                return formatCordovaOptions(cordovaOptions);
-            };
-
-            var getCordovaRedirectUri = function() {
-                return kc.redirectUri || 'http://localhost';
-            }
-
-            return {
-                login: async function(options) {
-                    var promise = createPromise();
-
-                    var cordovaOptions = createCordovaOptions(options);
-                    var loginUrl = await kc.createLoginUrl(options);
-                    var ref = cordovaOpenWindowWrapper(loginUrl, '_blank', cordovaOptions);
-                    var completed = false;
-
-                    var closed = false;
-                    var closeBrowser = function() {
-                        closed = true;
-                        ref.close();
-                    };
-
-                    ref.addEventListener('loadstart', function(event) {
-                        if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                            var callback = parseCallback(event.url);
-                            processCallback(callback, promise);
-                            closeBrowser();
-                            completed = true;
-                        }
-                    });
-
-                    ref.addEventListener('loaderror', function(event) {
-                        if (!completed) {
-                            if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                                var callback = parseCallback(event.url);
-                                processCallback(callback, promise);
-                                closeBrowser();
-                                completed = true;
-                            } else {
-                                promise.setError();
-                                closeBrowser();
-                            }
-                        }
-                    });
-
-                    ref.addEventListener('exit', function(event) {
-                        if (!closed) {
-                            promise.setError({
-                                reason: "closed_by_user"
-                            });
-                        }
-                    });
-
-                    return promise.promise;
-                },
-
-                logout: function(options) {
-                    var promise = createPromise();
-
-                    var logoutUrl = kc.createLogoutUrl(options);
-                    var ref = cordovaOpenWindowWrapper(logoutUrl, '_blank', 'location=no,hidden=yes,clearcache=yes');
-
-                    var error;
-
-                    ref.addEventListener('loadstart', function(event) {
-                        if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                            ref.close();
-                        }
-                    });
-
-                    ref.addEventListener('loaderror', function(event) {
-                        if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                            ref.close();
-                        } else {
-                            error = true;
-                            ref.close();
-                        }
-                    });
-
-                    ref.addEventListener('exit', function(event) {
-                        if (error) {
-                            promise.setError();
-                        } else {
-                            kc.clearToken();
-                            promise.setSuccess();
-                        }
-                    });
-
-                    return promise.promise;
-                },
-
-                register : async function(options) {
-                    var promise = createPromise();
-                    var registerUrl = await kc.createRegisterUrl();
-                    var cordovaOptions = createCordovaOptions(options);
-                    var ref = cordovaOpenWindowWrapper(registerUrl, '_blank', cordovaOptions);
-                    ref.addEventListener('loadstart', function(event) {
-                        if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                            ref.close();
-                            var oauth = parseCallback(event.url);
-                            processCallback(oauth, promise);
-                        }
-                    });
-                    return promise.promise;
-                },
-
-                accountManagement : function() {
-                    var accountUrl = kc.createAccountUrl();
-                    if (typeof accountUrl !== 'undefined') {
-                        var ref = cordovaOpenWindowWrapper(accountUrl, '_blank', 'location=no');
-                        ref.addEventListener('loadstart', function(event) {
-                            if (event.url.indexOf(getCordovaRedirectUri()) == 0) {
-                                ref.close();
-                            }
-                        });
-                    } else {
-                        throw "Not supported by the OIDC server";
-                    }
-                },
-
-                redirectUri: function(options) {
-                    return getCordovaRedirectUri();
-                }
-            }
-        }
-
-        if (type == 'cordova-native') {
-            loginIframe.enable = false;
-
-            return {
-                login: async function(options) {
-                    var promise = createPromise();
-                    var loginUrl = await kc.createLoginUrl(options);
-
-                    universalLinks.subscribe('keycloak', function(event) {
-                        universalLinks.unsubscribe('keycloak');
-                        window.cordova.plugins.browsertab.close();
-                        var oauth = parseCallback(event.url);
-                        processCallback(oauth, promise);
-                    });
-
-                    window.cordova.plugins.browsertab.openUrl(loginUrl);
-                    return promise.promise;
-                },
-
-                logout: function(options) {
-                    var promise = createPromise();
-                    var logoutUrl = kc.createLogoutUrl(options);
-
-                    universalLinks.subscribe('keycloak', function(event) {
-                        universalLinks.unsubscribe('keycloak');
-                        window.cordova.plugins.browsertab.close();
-                        kc.clearToken();
-                        promise.setSuccess();
-                    });
-
-                    window.cordova.plugins.browsertab.openUrl(logoutUrl);
-                    return promise.promise;
-                },
-
-                register : async function(options) {
-                    var promise = createPromise();
-                    var registerUrl = await kc.createRegisterUrl(options);
-                    universalLinks.subscribe('keycloak' , function(event) {
-                        universalLinks.unsubscribe('keycloak');
-                        window.cordova.plugins.browsertab.close();
-                        var oauth = parseCallback(event.url);
-                        processCallback(oauth, promise);
-                    });
-                    window.cordova.plugins.browsertab.openUrl(registerUrl);
-                    return promise.promise;
-
-                },
-
-                accountManagement : function() {
-                    var accountUrl = kc.createAccountUrl();
-                    if (typeof accountUrl !== 'undefined') {
-                        window.cordova.plugins.browsertab.openUrl(accountUrl);
-                    } else {
-                        throw "Not supported by the OIDC server";
-                    }
-                },
-
-                redirectUri: function(options) {
-                    if (options && options.redirectUri) {
-                        return options.redirectUri;
-                    } else if (kc.redirectUri) {
-                        return kc.redirectUri;
-                    } else {
-                        return "http://localhost";
-                    }
-                }
-            }
-        }
-
-        throw 'invalid adapter type: ' + type;
-    }
-
-    const STORAGE_KEY_PREFIX = 'kc-callback-';
-
-    var LocalStorage = function() {
-        if (!(this instanceof LocalStorage)) {
-            return new LocalStorage();
-        }
-
-        localStorage.setItem('kc-test', 'test');
-        localStorage.removeItem('kc-test');
-
-        var cs = this;
-
-        /**
-         * Clears all values from local storage that are no longer valid.
-         */
-        function clearInvalidValues() {
-            const currentTime = Date.now();
-
-            for (const [key, value] of getStoredEntries()) {
-                // Attempt to parse the expiry time from the value.
-                const expiry = parseExpiry(value);
-
-                // Discard the value if it is malformed or expired.
-                if (expiry === null || expiry < currentTime) {
-                    localStorage.removeItem(key);
-                }
-            }
-        }
-
-        /**
-         * Clears all known values from local storage.
-         */
-        function clearAllValues() {
-            for (const [key] of getStoredEntries()) {
-                localStorage.removeItem(key);
-            }
-        }
-
-        /**
-         * Gets all entries stored in local storage that are known to be managed by this class.
-         * @returns {Array<[string, unknown]>} An array of key-value pairs.
-         */
-        function getStoredEntries() {
-            return Object.entries(localStorage).filter(([key]) => key.startsWith(STORAGE_KEY_PREFIX));
-        }
-
-        /**
-         * Parses the expiry time from a value stored in local storage.
-         * @param {unknown} value
-         * @returns {number | null} The expiry time in milliseconds, or `null` if the value is malformed.
-         */
-        function parseExpiry(value) {
-            let parsedValue;
-
-            // Attempt to parse the value as JSON.
-            try {
-                parsedValue = JSON.parse(value);
-            } catch (error) {
-                return null;
-            }
-
-            // Attempt to extract the 'expires' property.
-            if (isObject(parsedValue) && 'expires' in parsedValue && typeof parsedValue.expires === 'number') {
-                return parsedValue.expires;
-            }
-
-            return null;
-        }
-
-        cs.get = function(state) {
-            if (!state) {
-                return;
-            }
-
-            var key = STORAGE_KEY_PREFIX + state;
-            var value = localStorage.getItem(key);
-            if (value) {
-                localStorage.removeItem(key);
-                value = JSON.parse(value);
-            }
-
-            clearInvalidValues();
-            return value;
-        };
-
-        cs.add = function(state) {
-            clearInvalidValues();
-
-            const key = STORAGE_KEY_PREFIX + state.state;
-            const value = JSON.stringify({
-                ...state,
-                // Set the expiry time to 1 hour from now.
-                expires: Date.now() + (60 * 60 * 1000)
-            });
-
-            try {
-                localStorage.setItem(key, value);
-            } catch (error) {
-                // If the storage is full, clear all known values and try again.
-                clearAllValues();
-                localStorage.setItem(key, value);
-            }
-        };
-    };
-
-    var CookieStorage = function() {
-        if (!(this instanceof CookieStorage)) {
-            return new CookieStorage();
-        }
-
-        var cs = this;
-
-        cs.get = function(state) {
-            if (!state) {
-                return;
-            }
-
-            var value = getCookie(STORAGE_KEY_PREFIX + state);
-            setCookie(STORAGE_KEY_PREFIX + state, '', cookieExpiration(-100));
-            if (value) {
-                return JSON.parse(value);
-            }
-        };
-
-        cs.add = function(state) {
-            setCookie(STORAGE_KEY_PREFIX + state.state, JSON.stringify(state), cookieExpiration(60));
-        };
-
-        cs.removeItem = function(key) {
-            setCookie(key, '', cookieExpiration(-100));
-        };
-
-        var cookieExpiration = function (minutes) {
-            var exp = new Date();
-            exp.setTime(exp.getTime() + (minutes*60*1000));
-            return exp;
-        };
-
-        var getCookie = function (key) {
-            var name = key + '=';
-            var ca = document.cookie.split(';');
-            for (var i = 0; i < ca.length; i++) {
-                var c = ca[i];
-                while (c.charAt(0) == ' ') {
-                    c = c.substring(1);
-                }
-                if (c.indexOf(name) == 0) {
-                    return c.substring(name.length, c.length);
-                }
-            }
-            return '';
-        };
-
-        var setCookie = function (key, value, expirationDate) {
-            var cookie = key + '=' + value + '; '
-                + 'expires=' + expirationDate.toUTCString() + '; ';
-            document.cookie = cookie;
-        }
-    };
-
-    function createCallbackStorage() {
-        try {
-            return new LocalStorage();
-        } catch (err) {
-        }
-
-        return new CookieStorage();
-    }
-
-    function createLogger(fn) {
-        return function() {
-            if (kc.enableLogging) {
-                fn.apply(console, Array.prototype.slice.call(arguments));
-            }
-        };
-    }
-}
-
-export default Keycloak;
-
-/**
- * @param {ArrayBuffer} bytes
- * @see https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
- */
-function bytesToBase64(bytes) {
-    const binString = String.fromCodePoint(...bytes);
-    return btoa(binString);
-}
-
-/**
- * @param {string} message
- * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest#basic_example
- */
-async function sha256Digest(message) {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(message);
-
-    if (typeof crypto === "undefined" || typeof crypto.subtle === "undefined") {
-        throw new Error("Web Crypto API is not available.");
-    }
-
-    return await crypto.subtle.digest("SHA-256", data);
-}
-
-/**
- * @param {string} token
- */
-function decodeToken(token) {
-    const [header, payload] = token.split(".");
-
-    if (typeof payload !== "string") {
-        throw new Error("Unable to decode token, payload not found.");
-    }
-
-    let decoded;
-
-    try {
-        decoded = base64UrlDecode(payload);
-    } catch (error) {
-        throw new Error("Unable to decode token, payload is not a valid Base64URL value.", { cause: error });
-    }
-
-    try {
-        return JSON.parse(decoded);
-    } catch (error) {
-        throw new Error("Unable to decode token, payload is not a valid JSON value.", { cause: error });
-    }
-}
-
-/**
- * @param {string} input
- */
-function base64UrlDecode(input) {
-    let output = input
-        .replaceAll("-", "+")
-        .replaceAll("_", "/");
-
-    switch (output.length % 4) {
-        case 0:
-            break;
-        case 2:
-            output += "==";
-            break;
-        case 3:
-            output += "=";
-            break;
-        default:
-            throw new Error("Input is not of the correct length.");
-    }
-
-    try {
-        return b64DecodeUnicode(output);
-    } catch (error) {
-        return atob(output);
-    }
-}
-
-/**
- * @param {string} input
- */
-function b64DecodeUnicode(input) {
-    return decodeURIComponent(atob(input).replace(/(.)/g, (m, p) => {
-        let code = p.charCodeAt(0).toString(16).toUpperCase();
-
-        if (code.length < 2) {
-            code = "0" + code;
-        }
-
-        return "%" + code;
-    }));
-}
-
-/**
- * Check if the input is an object that can be operated on.
- * @param {unknown} input
- */
-function isObject(input) {
-    return typeof input === 'object' && input !== null;
-}
diff --git a/js/libs/keycloak-js/package.json b/js/libs/keycloak-js/package.json
deleted file mode 100644
index be564f9fe8f4..000000000000
--- a/js/libs/keycloak-js/package.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "name": "keycloak-js",
-  "version": "999.0.0-SNAPSHOT",
-  "type": "module",
-  "description": "A client-side JavaScript OpenID Connect library that can be used to secure web applications.",
-  "exports": {
-    ".": {
-      "types": "./lib/keycloak.d.ts",
-      "default": "./lib/keycloak.js"
-    },
-    "./authz": {
-      "types": "./lib/keycloak-authz.d.ts",
-      "default": "./lib/keycloak-authz.js"
-    }
-  },
-  "files": [
-    "lib"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/keycloak/keycloak.git"
-  },
-  "author": "Keycloak",
-  "license": "Apache-2.0",
-  "homepage": "https://www.keycloak.org",
-  "keywords": [
-    "keycloak",
-    "sso",
-    "oauth",
-    "oauth2",
-    "authentication"
-  ]
-}
diff --git a/js/libs/keycloak-js/pom.xml b/js/libs/keycloak-js/pom.xml
deleted file mode 100644
index 68906bf6a463..000000000000
--- a/js/libs/keycloak-js/pom.xml
+++ /dev/null
@@ -1,94 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-
-    <parent>
-        <artifactId>keycloak-js-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>999.0.0-SNAPSHOT</version>
-        <relativePath>../../pom.xml</relativePath>
-    </parent>
-
-    <artifactId>keycloak-js-adapter</artifactId>
-
-    <name>Keycloak JavaScript Adapter</name>
-    <description>A client-side JavaScript OpenID Connect library that can be used to secure web applications.</description>
-    <packaging>pom</packaging>
-
-    <profiles>
-        <profile>
-            <id>jboss-release</id>
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-antrun-plugin</artifactId>
-                        <executions>
-                            <execution>
-                                <id>create-target-dir</id>
-                                <phase>prepare-package</phase>
-                                <configuration>
-                                    <target>
-                                        <mkdir dir="./target" />
-                                    </target>
-                                </configuration>
-                                <goals>
-                                    <goal>run</goal>
-                                </goals>
-                            </execution>
-                        </executions>
-                    </plugin>
-                    <plugin>
-                        <groupId>com.github.eirslett</groupId>
-                        <artifactId>frontend-maven-plugin</artifactId>
-                        <executions>
-                            <execution>
-                                <id>pnpm-pack</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>pnpm</goal>
-                                </goals>
-                                <configuration>
-                                    <arguments>pack --pack-destination=target</arguments>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                    <plugin>
-                        <groupId>org.codehaus.mojo</groupId>
-                        <artifactId>build-helper-maven-plugin</artifactId>
-                        <executions>
-                            <execution>
-                                <id>attach-artifacts</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>attach-artifact</goal>
-                                </goals>
-                                <configuration>
-                                    <artifacts>
-                                        <artifact>
-                                            <file>target/keycloak-js-${project.version.npm}.tgz</file>
-                                            <type>tar.gz</type>
-                                        </artifact>
-                                    </artifacts>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                </plugins>
-            </build>
-        </profile>
-    </profiles>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-                <configuration>
-                    <skip>false</skip>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
-</project>
diff --git a/js/libs/keycloak-js/tsconfig.json b/js/libs/keycloak-js/tsconfig.json
deleted file mode 100644
index 34cf7dd5c6b9..000000000000
--- a/js/libs/keycloak-js/tsconfig.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "compilerOptions": {
-    "allowSyntheticDefaultImports": true
-  }
-}
diff --git a/js/libs/ui-shared/package.json b/js/libs/ui-shared/package.json
index 685b7d3a5cc5..c8e9b692606a 100644
--- a/js/libs/ui-shared/package.json
+++ b/js/libs/ui-shared/package.json
@@ -44,28 +44,28 @@
   },
   "dependencies": {
     "@keycloak/keycloak-admin-client": "workspace:*",
-    "@patternfly/react-core": "^5.4.10",
+    "@patternfly/react-core": "^5.4.14",
     "@patternfly/react-icons": "^5.4.2",
     "@patternfly/react-styles": "^5.4.1",
-    "@patternfly/react-table": "^5.4.13",
-    "i18next": "^24.2.1",
-    "keycloak-js": "workspace:*",
+    "@patternfly/react-table": "^5.4.16",
+    "i18next": "^25.3.1",
+    "keycloak-js": "^26.2.0",
     "lodash-es": "^4.17.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "react-hook-form": "7.54.2",
-    "react-i18next": "^15.4.0"
+    "react-hook-form": "7.60.0",
+    "react-i18next": "^15.5.3"
   },
   "devDependencies": {
     "@types/lodash-es": "^4.17.12",
-    "@types/react": "^18.3.13",
-    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react-swc": "^3.7.2",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react-swc": "^3.10.2",
     "rollup-plugin-peer-deps-external": "^2.2.4",
-    "vite": "^6.0.7",
-    "vite-plugin-checker": "^0.8.0",
-    "vite-plugin-dts": "^4.5.0",
-    "vite-plugin-lib-inject-css": "^2.2.1",
-    "vitest": "^2.1.8"
+    "vite": "^7.0.3",
+    "vite-plugin-checker": "^0.10.0",
+    "vite-plugin-dts": "^4.5.4",
+    "vite-plugin-lib-inject-css": "^2.2.2",
+    "vitest": "^3.2.4"
   }
 }
diff --git a/js/libs/ui-shared/src/controls/FileUploadControl.tsx b/js/libs/ui-shared/src/controls/FileUploadControl.tsx
new file mode 100644
index 000000000000..ad7d94c74726
--- /dev/null
+++ b/js/libs/ui-shared/src/controls/FileUploadControl.tsx
@@ -0,0 +1,81 @@
+import {
+  FileUpload,
+  ValidatedOptions,
+  FileUploadProps,
+} from "@patternfly/react-core";
+import { ReactNode, useState } from "react";
+import {
+  FieldPath,
+  FieldValues,
+  PathValue,
+  UseControllerProps,
+  useController,
+} from "react-hook-form";
+import { getRuleValue } from "../utils/getRuleValue";
+import { FormLabel } from "./FormLabel";
+import { useTranslation } from "react-i18next";
+
+export type FileUploadControlProps<
+  T extends FieldValues,
+  P extends FieldPath<T> = FieldPath<T>,
+> = UseControllerProps<T, P> &
+  Omit<FileUploadProps, "name" | "isRequired" | "required"> & {
+    label: string;
+    labelIcon?: string | ReactNode;
+    isDisabled?: boolean;
+    "data-testid"?: string;
+    type?: string;
+  };
+
+export const FileUploadControl = <
+  T extends FieldValues,
+  P extends FieldPath<T> = FieldPath<T>,
+>(
+  props: FileUploadControlProps<T, P>,
+) => {
+  const { labelIcon, ...rest } = props;
+  const required = !!getRuleValue(props.rules?.required);
+  const defaultValue = props.defaultValue ?? ("" as PathValue<T, P>);
+
+  const { t } = useTranslation();
+
+  const [filename, setFilename] = useState<string>("");
+
+  const { field, fieldState } = useController({
+    ...props,
+    defaultValue,
+  });
+
+  return (
+    <FormLabel
+      name={props.name}
+      label={props.label}
+      labelIcon={labelIcon}
+      isRequired={required}
+      error={fieldState.error}
+    >
+      <FileUpload
+        isRequired={required}
+        data-testid={props["data-testid"] || props.name}
+        filename={filename}
+        browseButtonText={t("browse")}
+        validated={
+          fieldState.error ? ValidatedOptions.error : ValidatedOptions.default
+        }
+        hideDefaultPreview
+        isDisabled={props.isDisabled}
+        type="text"
+        onFileInputChange={(_, file) => {
+          field.onChange(file);
+          setFilename(file.name);
+        }}
+        onClearClick={() => {
+          field.onChange(null);
+          setFilename("");
+        }}
+        {...rest}
+        {...field}
+      />
+    </FormLabel>
+  );
+};
diff --git a/js/libs/ui-shared/src/controls/FormLabel.tsx b/js/libs/ui-shared/src/controls/FormLabel.tsx
index 126b857f0827..1e2919c5d2ec 100644
--- a/js/libs/ui-shared/src/controls/FormLabel.tsx
+++ b/js/libs/ui-shared/src/controls/FormLabel.tsx
@@ -5,6 +5,7 @@ import { FormErrorText } from "./FormErrorText";
 import { HelpItem } from "./HelpItem";
 
 export type FieldProps<T extends FieldValues = FieldValues> = {
+  id?: string | undefined;
   label?: string;
   name: string;
   labelIcon?: string | ReactNode;
@@ -15,6 +16,7 @@ export type FieldProps<T extends FieldValues = FieldValues> = {
 type FormLabelProps = FieldProps & Omit<FormGroupProps, "label" | "labelIcon">;
 
 export const FormLabel = ({
+  id,
   name,
   label,
   labelIcon,
@@ -24,10 +26,10 @@ export const FormLabel = ({
 }: PropsWithChildren<FormLabelProps>) => (
   <FormGroup
     label={label || name}
-    fieldId={name}
+    fieldId={id || name}
     labelIcon={
       labelIcon ? (
-        <HelpItem helpText={labelIcon} fieldLabelId={name} />
+        <HelpItem helpText={labelIcon} fieldLabelId={id || name} />
       ) : undefined
     }
     {...rest}
diff --git a/js/libs/ui-shared/src/controls/OrganizationTable.tsx b/js/libs/ui-shared/src/controls/OrganizationTable.tsx
index af55035b90d4..35d359593a3e 100644
--- a/js/libs/ui-shared/src/controls/OrganizationTable.tsx
+++ b/js/libs/ui-shared/src/controls/OrganizationTable.tsx
@@ -63,6 +63,7 @@ export type OrganizationTableProps = PropsWithChildren & {
   toolbarItem?: ReactNode;
   isPaginated?: boolean;
   isSearching?: boolean;
+  searchPlaceholderKey?: string;
   onSelect?: (orgs: OrganizationRepresentation[]) => void;
   onDelete?: (org: OrganizationRepresentation) => void;
   deleteLabel?: string;
@@ -73,6 +74,7 @@ export const OrganizationTable = ({
   toolbarItem,
   isPaginated = false,
   isSearching = false,
+  searchPlaceholderKey,
   onSelect,
   onDelete,
   deleteLabel = "delete",
@@ -87,6 +89,7 @@ export const OrganizationTable = ({
       isPaginated={isPaginated}
       isSearching={isSearching}
       ariaLabelKey="organizationList"
+      searchPlaceholderKey={searchPlaceholderKey}
       toolbarItem={toolbarItem}
       onSelect={onSelect}
       canSelectAll={onSelect !== undefined}
diff --git a/js/libs/ui-shared/src/controls/SwitchControl.tsx b/js/libs/ui-shared/src/controls/SwitchControl.tsx
index f8687781652e..baa6163ef04e 100644
--- a/js/libs/ui-shared/src/controls/SwitchControl.tsx
+++ b/js/libs/ui-shared/src/controls/SwitchControl.tsx
@@ -8,12 +8,13 @@ import {
 } from "react-hook-form";
 import { SwitchProps, Switch } from "@patternfly/react-core";
 import { FormLabel } from "./FormLabel";
+import { debeerify } from "../user-profile/utils";
 
 export type SwitchControlProps<
   T extends FieldValues,
   P extends FieldPath<T> = FieldPath<T>,
 > = Omit<SwitchProps, "name" | "defaultValue" | "ref"> &
-  UseControllerProps<T, P> & {
+  UseControllerProps<any, P> & {
     name: string;
     label?: string;
     labelIcon?: string;
@@ -51,7 +52,7 @@ export const SwitchControl = <
           <Switch
             {...props}
             id={props.name}
-            data-testid={props.name}
+            data-testid={debeerify(props.name)}
             label={labelOn}
             isChecked={stringify ? value === "true" : value}
             onChange={(e, checked) => {
diff --git a/js/libs/ui-shared/src/controls/TextAreaControl.tsx b/js/libs/ui-shared/src/controls/TextAreaControl.tsx
index bfa258685871..42a92e2b5a65 100644
--- a/js/libs/ui-shared/src/controls/TextAreaControl.tsx
+++ b/js/libs/ui-shared/src/controls/TextAreaControl.tsx
@@ -53,6 +53,7 @@ export const TextAreaControl = <
           fieldState.error ? ValidatedOptions.error : ValidatedOptions.default
         }
         isDisabled={props.isDisabled}
+        {...props}
         {...field}
       />
     </FormLabel>
diff --git a/js/libs/ui-shared/src/controls/select-control/SelectControl.tsx b/js/libs/ui-shared/src/controls/select-control/SelectControl.tsx
index be5a07d57769..4ff7ccbc9c02 100644
--- a/js/libs/ui-shared/src/controls/select-control/SelectControl.tsx
+++ b/js/libs/ui-shared/src/controls/select-control/SelectControl.tsx
@@ -41,6 +41,7 @@ export type SelectControlProps<
     name: string;
     label?: string;
     options: OptionType;
+    selectedOptions?: OptionType;
     labelIcon?: string;
     controller: Omit<ControllerProps, "name" | "render">;
     onFilter?: (value: string) => void;
@@ -49,6 +50,10 @@ export type SelectControlProps<
     menuAppendTo?: string;
     placeholderText?: string;
     chipGroupProps?: ChipGroupProps;
+    onSelect?: (
+      value: string | string[],
+      onChangeHandler: (value: string | string[]) => void,
+    ) => void;
   };
 
 export const isSelectBasedOptions = (
diff --git a/js/libs/ui-shared/src/controls/select-control/SingleSelectControl.tsx b/js/libs/ui-shared/src/controls/select-control/SingleSelectControl.tsx
index 186499055993..cf3ac3e1a8d0 100644
--- a/js/libs/ui-shared/src/controls/select-control/SingleSelectControl.tsx
+++ b/js/libs/ui-shared/src/controls/select-control/SingleSelectControl.tsx
@@ -30,8 +30,11 @@ export const SingleSelectControl = <
   name,
   label,
   options,
+  selectedOptions = [],
   controller,
   labelIcon,
+  isDisabled,
+  onSelect,
   ...rest
 }: SelectControlProps<T, P>) => {
   const {
@@ -43,6 +46,7 @@ export const SingleSelectControl = <
 
   return (
     <FormLabel
+      id={id}
       name={name}
       label={label}
       isRequired={required}
@@ -56,6 +60,7 @@ export const SingleSelectControl = <
         render={({ field: { onChange, value } }) => (
           <Select
             {...rest}
+            variant="default"
             onClick={() => setOpen(!open)}
             onOpenChange={() => setOpen(false)}
             selected={
@@ -71,13 +76,14 @@ export const SingleSelectControl = <
             }
             toggle={(ref) => (
               <MenuToggle
-                id={id || name.slice(name.lastIndexOf(".") + 1)}
+                id={id || name}
                 ref={ref}
                 onClick={() => setOpen(!open)}
                 isExpanded={open}
                 isFullWidth
                 status={get(errors, name) ? MenuToggleStatus.danger : undefined}
-                aria-label="toggle"
+                aria-label={label}
+                isDisabled={isDisabled}
               >
                 {isSelectBasedOptions(options)
                   ? options.find(
@@ -88,14 +94,19 @@ export const SingleSelectControl = <
               </MenuToggle>
             )}
             onSelect={(_event, v) => {
-              const option = v?.toString();
-              onChange(Array.isArray(value) ? [option] : option);
+              const option = v?.toString()!;
+              const convertedValue = Array.isArray(value) ? [option] : option;
+              if (onSelect) {
+                onSelect(convertedValue, onChange);
+              } else {
+                onChange(convertedValue);
+              }
               setOpen(false);
             }}
             isOpen={open}
           >
             <SelectList data-testid={`select-${name}`}>
-              {options.map((option) => (
+              {[...options, ...selectedOptions].map((option) => (
                 <SelectOption key={key(option)} value={key(option)}>
                   {isString(option) ? option : option.value}
                 </SelectOption>
diff --git a/js/libs/ui-shared/src/controls/select-control/TypeaheadSelectControl.tsx b/js/libs/ui-shared/src/controls/select-control/TypeaheadSelectControl.tsx
index 13e4e4a79f19..6fc264f25265 100644
--- a/js/libs/ui-shared/src/controls/select-control/TypeaheadSelectControl.tsx
+++ b/js/libs/ui-shared/src/controls/select-control/TypeaheadSelectControl.tsx
@@ -24,6 +24,7 @@ import {
 import { getRuleValue } from "../../utils/getRuleValue";
 import { FormLabel } from "../FormLabel";
 import {
+  OptionType,
   SelectControlOption,
   SelectControlProps,
   SelectVariant,
@@ -43,6 +44,7 @@ export const TypeaheadSelectControl = <
   name,
   label,
   options,
+  selectedOptions = [],
   controller,
   labelIcon,
   placeholderText,
@@ -57,27 +59,50 @@ export const TypeaheadSelectControl = <
   const [open, setOpen] = useState(false);
   const [filterValue, setFilterValue] = useState("");
   const [focusedItemIndex, setFocusedItemIndex] = useState<number>(0);
+  const [selectedOptionsState, setSelectedOptions] = useState<
+    SelectControlOption[]
+  >([]);
   const textInputRef = useRef<HTMLInputElement>();
   const required = getRuleValue(controller.rules?.required) === true;
+  const isTypeaheadMulti = variant === SelectVariant.typeaheadMulti;
 
-  const filteredOptions = options.filter((option) =>
-    getValue(option).toLowerCase().startsWith(filterValue.toLowerCase()),
+  const combinedOptions = useMemo(
+    () =>
+      [
+        ...options.filter(
+          (o) => !selectedOptions.map((o) => getValue(o)).includes(getValue(o)),
+        ),
+        ...selectedOptions,
+      ] as OptionType,
+    [selectedOptions, options],
   );
 
-  const convert = useMemo(
-    () =>
-      filteredOptions.map((option, index) => (
-        <SelectOption
-          key={key(option)}
-          value={key(option)}
-          isFocused={focusedItemIndex === index}
-        >
-          {getValue(option)}
-        </SelectOption>
-      )),
-    [focusedItemIndex, filteredOptions],
+  const filteredOptions = combinedOptions.filter((option) =>
+    getValue(option).toLowerCase().startsWith(filterValue.toLowerCase()),
   );
 
+  const updateValue = (
+    option: string | string[],
+    field: ControllerRenderProps<FieldValues, string>,
+  ) => {
+    if (field.value.includes(option)) {
+      field.onChange(field.value.filter((item: string) => item !== option));
+      if (isSelectBasedOptions(options)) {
+        setSelectedOptions(
+          selectedOptionsState.filter((item) => item.key !== option),
+        );
+      }
+    } else {
+      field.onChange([...field.value, option]);
+      if (isSelectBasedOptions(combinedOptions)) {
+        setSelectedOptions([
+          ...selectedOptionsState,
+          combinedOptions.find((o) => o.key === option)!,
+        ]);
+      }
+    }
+  };
+
   const onInputKeyDown = (
     event: React.KeyboardEvent<HTMLDivElement>,
     field: ControllerRenderProps<FieldValues, string>,
@@ -89,17 +114,14 @@ export const TypeaheadSelectControl = <
       case "Enter": {
         event.preventDefault();
 
-        if (variant !== SelectVariant.typeaheadMulti) {
+        if (!isTypeaheadMulti) {
           setFilterValue(getValue(focusedItem));
         } else {
           setFilterValue("");
         }
 
-        field.onChange(
-          Array.isArray(field.value)
-            ? [...field.value, key(focusedItem)]
-            : key(focusedItem),
-        );
+        updateValue(key(focusedItem), field);
+
         setOpen(false);
         setFocusedItemIndex(0);
 
@@ -147,6 +169,7 @@ export const TypeaheadSelectControl = <
 
   return (
     <FormLabel
+      id={id}
       name={name}
       label={label}
       isRequired={required}
@@ -162,8 +185,8 @@ export const TypeaheadSelectControl = <
             {...rest}
             onOpenChange={() => setOpen(false)}
             selected={
-              isSelectBasedOptions(options)
-                ? options
+              isSelectBasedOptions(combinedOptions)
+                ? combinedOptions
                     .filter((o) =>
                       Array.isArray(field.value)
                         ? field.value.includes(o.key)
@@ -176,7 +199,7 @@ export const TypeaheadSelectControl = <
             toggle={(ref) => (
               <MenuToggle
                 ref={ref}
-                id={id || name.slice(name.lastIndexOf(".") + 1)}
+                id={id || name}
                 variant="typeahead"
                 onClick={() => {
                   setOpen(!open);
@@ -191,8 +214,8 @@ export const TypeaheadSelectControl = <
                     placeholder={placeholderText}
                     value={
                       variant === SelectVariant.typeahead && field.value
-                        ? isSelectBasedOptions(options)
-                          ? options.find(
+                        ? isSelectBasedOptions(combinedOptions)
+                          ? combinedOptions.find(
                               (o) =>
                                 o.key ===
                                 (Array.isArray(field.value)
@@ -230,9 +253,11 @@ export const TypeaheadSelectControl = <
                                   );
                                 }}
                               >
-                                {isSelectBasedOptions(options)
-                                  ? options.find((o) => selection === o.key)
-                                      ?.value
+                                {isSelectBasedOptions(combinedOptions)
+                                  ? [
+                                      ...combinedOptions,
+                                      ...selectedOptionsState,
+                                    ].find((o) => selection === o.key)?.value
                                   : getValue(selection)}
                               </Chip>
                             ),
@@ -246,7 +271,7 @@ export const TypeaheadSelectControl = <
                         variant="plain"
                         onClick={() => {
                           setFilterValue("");
-                          field.onChange("");
+                          field.onChange(isTypeaheadMulti ? [] : "");
                           textInputRef?.current?.focus();
                         }}
                         aria-label="Clear input value"
@@ -261,17 +286,9 @@ export const TypeaheadSelectControl = <
             onSelect={(event, v) => {
               event?.stopPropagation();
               const option = v?.toString();
-              if (
-                variant === SelectVariant.typeaheadMulti &&
-                Array.isArray(field.value)
-              ) {
-                if (field.value.includes(option)) {
-                  field.onChange(
-                    field.value.filter((item: string) => item !== option),
-                  );
-                } else {
-                  field.onChange([...field.value, option]);
-                }
+              if (isTypeaheadMulti && Array.isArray(field.value)) {
+                setFilterValue("");
+                updateValue(option || "", field);
               } else {
                 field.onChange(Array.isArray(field.value) ? [option] : option);
                 setOpen(false);
@@ -279,7 +296,18 @@ export const TypeaheadSelectControl = <
             }}
             isOpen={open}
           >
-            <SelectList>{convert}</SelectList>
+            <SelectList>
+              {filteredOptions.map((option, index) => (
+                <SelectOption
+                  key={key(option)}
+                  value={key(option)}
+                  isFocused={focusedItemIndex === index}
+                  isActive={field.value.includes(getValue(option))}
+                >
+                  {getValue(option)}
+                </SelectOption>
+              ))}
+            </SelectList>
           </Select>
         )}
       />
diff --git a/js/libs/ui-shared/src/controls/table/KeycloakDataTable.tsx b/js/libs/ui-shared/src/controls/table/KeycloakDataTable.tsx
index 0a698c68c055..fcb1567bd470 100644
--- a/js/libs/ui-shared/src/controls/table/KeycloakDataTable.tsx
+++ b/js/libs/ui-shared/src/controls/table/KeycloakDataTable.tsx
@@ -88,21 +88,21 @@ const CellRenderer = ({
   index,
   actions,
   actionResolver,
-}: CellRendererProps) => (
-  <>
-    {row.cells!.map((c, i) => (
-      <Td key={`cell-${i}`}>{(isRow(c) ? c.title : c) as ReactNode}</Td>
-    ))}
-    {(actions || actionResolver) && (
-      <Td isActionCell>
-        <ActionsColumn
-          items={actions || actionResolver?.(row, {})!}
-          extraData={{ rowIndex: index }}
-        />
-      </Td>
-    )}
-  </>
-);
+}: CellRendererProps) => {
+  const items = actions || actionResolver?.(row, {});
+  return (
+    <>
+      {row.cells!.map((c, i) => (
+        <Td key={`cell-${i}`}>{(isRow(c) ? c.title : c) as ReactNode}</Td>
+      ))}
+      {items && items.length > 0 && !row.disableActions && (
+        <Td isActionCell>
+          <ActionsColumn items={items} extraData={{ rowIndex: index }} />
+        </Td>
+      )}
+    </>
+  );
+};
 
 const ExpandableRowRenderer = ({ row }: CellRendererProps) =>
   row.cells!.map((c, i) => (
@@ -156,24 +156,31 @@ function DataTable<T>({
   };
 
   const updateState = (rowIndex: number, isSelected: boolean) => {
-    if (rowIndex === -1) {
-      const rowsSelectedOnPageIds = rowsSelectedOnPage.map((v) => get(v, "id"));
-      updateSelectedRows(
-        isSelected
-          ? [...selectedRows, ...rows.map((row) => row.data)]
-          : selectedRows.filter(
-              (v) => !rowsSelectedOnPageIds.includes(get(v, "id")),
-            ),
-      );
+    if (isRadio) {
+      const selectedRow = isSelected ? [rows[rowIndex].data] : [];
+      updateSelectedRows(selectedRow);
     } else {
-      if (isSelected) {
-        updateSelectedRows([...selectedRows, rows[rowIndex].data]);
-      } else {
+      if (rowIndex === -1) {
+        const rowsSelectedOnPageIds = rowsSelectedOnPage.map((v) =>
+          get(v, "id"),
+        );
         updateSelectedRows(
-          selectedRows.filter(
-            (v) => get(v, "id") !== (rows[rowIndex] as IRow).data.id,
-          ),
+          isSelected
+            ? [...selectedRows, ...rows.map((row) => row.data)]
+            : selectedRows.filter(
+                (v) => !rowsSelectedOnPageIds.includes(get(v, "id")),
+              ),
         );
+      } else {
+        if (isSelected) {
+          updateSelectedRows([...selectedRows, rows[rowIndex].data]);
+        } else {
+          updateSelectedRows(
+            selectedRows.filter(
+              (v) => get(v, "id") !== (rows[rowIndex] as IRow).data.id,
+            ),
+          );
+        }
       }
     }
   };
@@ -228,6 +235,7 @@ function DataTable<T>({
                       (v) => get(v, "id") === row.data.id,
                     ),
                     variant: isRadio ? "radio" : "checkbox",
+                    isDisabled: row.disableSelection,
                   }}
                 />
               )}
@@ -246,17 +254,21 @@ function DataTable<T>({
             {index % 2 === 0 ? (
               <Tr>
                 <Td
-                  expand={{
-                    isExpanded: !!expandedRows[index],
-                    rowIndex: index,
-                    expandId: `${index}`,
-                    onToggle: (_, rowIndex, isOpen) => {
-                      onCollapse(isOpen, rowIndex);
-                      const expand = [...expandedRows];
-                      expand[index] = isOpen;
-                      setExpandedRows(expand);
-                    },
-                  }}
+                  expand={
+                    rows[index + 1].cells.length === 0
+                      ? undefined
+                      : {
+                          isExpanded: !!expandedRows[index],
+                          rowIndex: index,
+                          expandId: "expandable-row-",
+                          onToggle: (_, rowIndex, isOpen) => {
+                            onCollapse(isOpen, rowIndex);
+                            const expand = [...expandedRows];
+                            expand[index] = isOpen;
+                            setExpandedRows(expand);
+                          },
+                        }
+                  }
                 />
                 <CellRenderer
                   row={row}
@@ -548,7 +560,7 @@ export function KeycloakDataTable<T>({
 
   return (
     <>
-      {(loading || !noData || searching) && (
+      {(!noData || searching) && (
         <PaginatingTableToolbar
           id={id}
           count={rowLength}
@@ -571,7 +583,7 @@ export function KeycloakDataTable<T>({
             <>
               {toolbarItem} <ToolbarItem variant="separator" />{" "}
               <ToolbarItem>
-                <Button variant="link" onClick={refresh}>
+                <Button variant="link" onClick={refresh} data-testid="refresh">
                   <SyncAltIcon /> {t("refresh")}
                 </Button>
               </ToolbarItem>
@@ -619,9 +631,9 @@ export function KeycloakDataTable<T>({
               }
             />
           )}
-          {loading && <KeycloakSpinner />}
         </PaginatingTableToolbar>
       )}
+      {loading && <KeycloakSpinner />}
       {!loading && noData && !searching && emptyState}
     </>
   );
diff --git a/js/libs/ui-shared/src/controls/table/ListEmptyState.tsx b/js/libs/ui-shared/src/controls/table/ListEmptyState.tsx
index 7319bd62529f..1074980ba36c 100644
--- a/js/libs/ui-shared/src/controls/table/ListEmptyState.tsx
+++ b/js/libs/ui-shared/src/controls/table/ListEmptyState.tsx
@@ -1,4 +1,9 @@
-import { ComponentClass, MouseEventHandler, ReactNode } from "react";
+import {
+  ComponentClass,
+  MouseEventHandler,
+  PropsWithChildren,
+  ReactNode,
+} from "react";
 import {
   EmptyState,
   EmptyStateIcon,
@@ -40,7 +45,8 @@ export const ListEmptyState = ({
   secondaryActions,
   icon,
   isDisabled = false,
-}: ListEmptyStateProps) => {
+  children,
+}: PropsWithChildren<ListEmptyStateProps>) => {
   return (
     <EmptyState data-testid="empty-state" variant="lg">
       {hasIcon && isSearchVariant ? (
@@ -63,6 +69,7 @@ export const ListEmptyState = ({
             {primaryActionText}
           </Button>
         )}
+        {children}
         {secondaryActions && (
           <EmptyStateActions>
             {secondaryActions.map((action) => (
diff --git a/js/libs/ui-shared/src/controls/table/TableToolbar.tsx b/js/libs/ui-shared/src/controls/table/TableToolbar.tsx
index 66f20fc4af6c..5c6437f784ee 100644
--- a/js/libs/ui-shared/src/controls/table/TableToolbar.tsx
+++ b/js/libs/ui-shared/src/controls/table/TableToolbar.tsx
@@ -45,7 +45,7 @@ export const TableToolbar = ({
 
   return (
     <>
-      <Toolbar>
+      <Toolbar data-testid="table-toolbar">
         <ToolbarContent>
           {inputGroupName && (
             <ToolbarItem>
diff --git a/js/libs/ui-shared/src/main.ts b/js/libs/ui-shared/src/main.ts
index 6eb7c5d760a2..4322edcde784 100644
--- a/js/libs/ui-shared/src/main.ts
+++ b/js/libs/ui-shared/src/main.ts
@@ -43,6 +43,10 @@ export {
   KeycloakTextArea,
   type KeycloakTextAreaProps,
 } from "./controls/keycloak-text-area/KeycloakTextArea";
+export {
+  FileUploadControl,
+  type FileUploadControlProps,
+} from "./controls/FileUploadControl";
 export { IconMapper } from "./icons/IconMapper";
 export { FormPanel } from "./scroll-form/FormPanel";
 export { ScrollForm, mainPageContentId } from "./scroll-form/ScrollForm";
diff --git a/js/libs/ui-shared/src/masthead/Masthead.tsx b/js/libs/ui-shared/src/masthead/Masthead.tsx
index 0a39ae0a2874..450a6accac57 100644
--- a/js/libs/ui-shared/src/masthead/Masthead.tsx
+++ b/js/libs/ui-shared/src/masthead/Masthead.tsx
@@ -54,6 +54,7 @@ type KeycloakMastheadProps = MastheadMainProps & {
   kebabDropdownItems?: ReactNode[];
   dropdownItems?: ReactNode[];
   toolbarItems?: ReactNode[];
+  toolbar?: ReactNode;
 };
 
 const KeycloakMasthead = ({
@@ -68,6 +69,7 @@ const KeycloakMasthead = ({
   kebabDropdownItems,
   dropdownItems = [],
   toolbarItems,
+  toolbar,
   ...rest
 }: KeycloakMastheadProps) => {
   const { t } = useTranslation();
@@ -102,6 +104,7 @@ const KeycloakMasthead = ({
         <img src={src} alt={alt} className={className} />
       </MastheadBrand>
       <MastheadContent>
+        {toolbar}
         <Toolbar>
           <ToolbarContent>
             {toolbarItems?.map((item, index) => (
diff --git a/js/libs/ui-shared/src/scroll-form/ScrollForm.tsx b/js/libs/ui-shared/src/scroll-form/ScrollForm.tsx
index 6329500a277b..1bf824502dac 100644
--- a/js/libs/ui-shared/src/scroll-form/ScrollForm.tsx
+++ b/js/libs/ui-shared/src/scroll-form/ScrollForm.tsx
@@ -80,10 +80,17 @@ export const ScrollForm = ({
               const scrollId = spacesToHyphens(title.toLowerCase());
 
               return (
-                // note that JumpLinks currently does not work with spaces in the href
                 <JumpLinksItem
                   key={title}
-                  href={`#${scrollId}`}
+                  onClick={() => {
+                    const element = document.getElementById(scrollId);
+                    if (element) {
+                      element.scrollIntoView({
+                        behavior: "smooth",
+                        block: "start",
+                      });
+                    }
+                  }}
                   data-testid={`jump-link-${scrollId}`}
                 >
                   {title}
diff --git a/js/libs/ui-shared/src/select/KeycloakSelect.tsx b/js/libs/ui-shared/src/select/KeycloakSelect.tsx
index cc544bd86bc8..dede9869a101 100644
--- a/js/libs/ui-shared/src/select/KeycloakSelect.tsx
+++ b/js/libs/ui-shared/src/select/KeycloakSelect.tsx
@@ -15,7 +15,7 @@ export const propertyToString = (prop: string | number | undefined) =>
 
 export type KeycloakSelectProps<> = Omit<
   SelectProps,
-  "name" | "toggle" | "selected" | "onClick" | "onSelect"
+  "name" | "toggle" | "selected" | "onClick" | "onSelect" | "variant"
 > & {
   toggleId?: string;
   onFilter?: (value: string) => JSX.Element[];
diff --git a/js/libs/ui-shared/src/select/TypeaheadSelect.tsx b/js/libs/ui-shared/src/select/TypeaheadSelect.tsx
index 08d9c344eb70..1bac27fe28a7 100644
--- a/js/libs/ui-shared/src/select/TypeaheadSelect.tsx
+++ b/js/libs/ui-shared/src/select/TypeaheadSelect.tsx
@@ -115,7 +115,11 @@ export const TypeaheadSelect = ({
       {...rest}
       onClick={toggle}
       onOpenChange={(isOpen) => onToggle?.(isOpen)}
-      onSelect={(_, value) => onSelect?.(value || "")}
+      onSelect={(_, value) => {
+        onSelect?.(value || "");
+        onFilter?.("");
+        setFilterValue("");
+      }}
       maxMenuHeight={propertyToString(maxHeight)}
       popperProps={{ direction, width: propertyToString(width) }}
       toggle={(ref) => (
diff --git a/js/libs/ui-shared/src/user-profile/LocaleSelector.tsx b/js/libs/ui-shared/src/user-profile/LocaleSelector.tsx
index 2e53f23db41b..994ae09e8aa8 100644
--- a/js/libs/ui-shared/src/user-profile/LocaleSelector.tsx
+++ b/js/libs/ui-shared/src/user-profile/LocaleSelector.tsx
@@ -43,7 +43,7 @@ export const LocaleSelector = ({
         name="attributes.locale"
         label={t("selectALocale")}
         controller={{ defaultValue: "" }}
-        options={locales}
+        options={[{ key: "", value: t("defaultLocale") }, ...locales]}
         variant={locales.length >= 10 ? "typeahead" : "single"}
       />
     </FormProvider>
diff --git a/js/libs/ui-shared/src/user-profile/TextComponent.tsx b/js/libs/ui-shared/src/user-profile/TextComponent.tsx
index e7b0f212cfab..327d2281295f 100644
--- a/js/libs/ui-shared/src/user-profile/TextComponent.tsx
+++ b/js/libs/ui-shared/src/user-profile/TextComponent.tsx
@@ -23,13 +23,13 @@ export const TextComponent = (props: UserProfileFieldProps) => {
             : label(
                 props.t,
                 attribute.annotations?.["inputTypePlaceholder"] as string,
-                attribute.name,
+                "",
                 attribute.annotations?.[
                   "inputOptionLabelsI18nPrefix"
                 ] as string,
               )
         }
-        readOnly={attribute.readOnly}
+        isDisabled={attribute.readOnly}
         isRequired={isRequired}
         {...form.register(fieldName(attribute.name))}
       />
diff --git a/js/libs/ui-shared/src/user-profile/utils.ts b/js/libs/ui-shared/src/user-profile/utils.ts
index 63a8e908170d..7aa6b8c69a60 100644
--- a/js/libs/ui-shared/src/user-profile/utils.ts
+++ b/js/libs/ui-shared/src/user-profile/utils.ts
@@ -73,12 +73,13 @@ export function setUserProfileServerError<T>(
   ).forEach((e) => {
     const params = Object.assign(
       {},
-      e.params?.map((p) => (isBundleKey(p.toString()) ? t(unWrap(p)) : p)),
+      e.params?.map((p) => (isBundleKey(p?.toString()) ? t(unWrap(p)) : p)),
     );
     setError(fieldName(e.field) as keyof T, {
       message: t(
         isBundleKey(e.errorMessage) ? unWrap(e.errorMessage) : e.errorMessage,
         {
+          /* eslint-disable @typescript-eslint/no-misused-spread */
           ...params,
           defaultValue: e.errorMessage || e.field,
         },
diff --git a/js/osv-scanner.toml b/js/osv-scanner.toml
new file mode 100644
index 000000000000..d5fc8f5156c5
--- /dev/null
+++ b/js/osv-scanner.toml
@@ -0,0 +1,21 @@
+# Ignore false positives for https://securityscorecards.dev/viewer/?uri=github.com/keycloak/keycloak
+
+# Reason
+[[IgnoredVulns]]
+id = "GHSA-9mvj-f7w8-pvh2"
+reason = "reason"
+
+# Reason
+[[IgnoredVulns]]
+id = "GHSA-67mh-4wv8-2f99"
+reason = "reason"
+
+# Reason
+[[IgnoredVulns]]
+id = "GHSA-gxr4-xjj5-5px2"
+reason = "reason"
+
+# Reason
+[[IgnoredVulns]]
+id = "GHSA-jpcq-cgw6-v4j6"
+reason = "reason"
diff --git a/js/package.json b/js/package.json
index 8a1b0f4900ca..2669ffa12bb7 100644
--- a/js/package.json
+++ b/js/package.json
@@ -2,7 +2,7 @@
   "name": "root",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@9.14.4+sha512.c8180b3fbe4e4bca02c94234717896b5529740a6cbadf19fa78254270403ea2f27d4e1d46a08a0f56c89b63dc8ebfd3ee53326da720273794e6200fcf0d184ab",
+  "packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af",
   "scripts": {
     "prepare": "cd .. && husky js/.husky",
     "build": "wireit"
@@ -19,27 +19,25 @@
     }
   },
   "devDependencies": {
-    "@eslint/compat": "^1.2.5",
-    "@eslint/eslintrc": "^3.2.0",
-    "@eslint/js": "^9.18.0",
-    "@types/node": "^22.10.6",
-    "eslint": "^9.18.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-cypress": "^4.1.0",
+    "@eslint/compat": "^1.3.1",
+    "@eslint/eslintrc": "^3.3.1",
+    "@eslint/js": "^9.30.1",
+    "@types/node": "^24.0.12",
+    "eslint": "^9.30.1",
+    "eslint-config-prettier": "^10.1.5",
     "eslint-plugin-lodash": "^8.0.0",
-    "eslint-plugin-mocha": "^10.5.0",
-    "eslint-plugin-playwright": "^2.1.0",
-    "eslint-plugin-prettier": "^5.2.1",
-    "eslint-plugin-react": "^7.37.4",
-    "eslint-plugin-react-compiler": "19.0.0-beta-55955c9-20241229",
-    "eslint-plugin-react-hooks": "^5.0.0",
+    "eslint-plugin-playwright": "^2.2.0",
+    "eslint-plugin-prettier": "^5.5.1",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-compiler": "19.0.0-beta-714736e-20250131",
+    "eslint-plugin-react-hooks": "~5.2.0",
     "husky": "^9.1.7",
-    "lint-staged": "^15.3.0",
-    "prettier": "^3.4.2",
+    "lint-staged": "^16.1.2",
+    "prettier": "^3.6.2",
     "tslib": "^2.8.1",
-    "typescript": "^5.7.2",
-    "typescript-eslint": "^8.19.1",
-    "wireit": "^0.14.9"
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.36.0",
+    "wireit": "^0.14.12"
   },
   "pnpm": {
     "ignoredOptionalDependencies": [
@@ -65,6 +63,10 @@
       "moment-timezone",
       "patternfly-bootstrap-combobox",
       "patternfly-bootstrap-treeview"
+    ],
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild"
     ]
   },
   "lint-staged": {
diff --git a/js/pnpm-lock.yaml b/js/pnpm-lock.yaml
index 225189cebbd6..9998395f1381 100644
--- a/js/pnpm-lock.yaml
+++ b/js/pnpm-lock.yaml
@@ -9,68 +9,62 @@ importers:
   .:
     devDependencies:
       '@eslint/compat':
-        specifier: ^1.2.5
-        version: 1.2.5(eslint@9.18.0)
+        specifier: ^1.3.1
+        version: 1.3.1(eslint@9.30.1)
       '@eslint/eslintrc':
-        specifier: ^3.2.0
-        version: 3.2.0
+        specifier: ^3.3.1
+        version: 3.3.1
       '@eslint/js':
-        specifier: ^9.18.0
-        version: 9.18.0
+        specifier: ^9.30.1
+        version: 9.30.1
       '@types/node':
-        specifier: ^22.10.6
-        version: 22.10.6
+        specifier: ^24.0.12
+        version: 24.0.12
       eslint:
-        specifier: ^9.18.0
-        version: 9.18.0
+        specifier: ^9.30.1
+        version: 9.30.1
       eslint-config-prettier:
-        specifier: ^10.0.1
-        version: 10.0.1(eslint@9.18.0)
-      eslint-plugin-cypress:
-        specifier: ^4.1.0
-        version: 4.1.0(eslint@9.18.0)
+        specifier: ^10.1.5
+        version: 10.1.5(eslint@9.30.1)
       eslint-plugin-lodash:
         specifier: ^8.0.0
-        version: 8.0.0(eslint@9.18.0)
-      eslint-plugin-mocha:
-        specifier: ^10.5.0
-        version: 10.5.0(eslint@9.18.0)
+        version: 8.0.0(eslint@9.30.1)
       eslint-plugin-playwright:
-        specifier: ^2.1.0
-        version: 2.1.0(eslint@9.18.0)
+        specifier: ^2.2.0
+        version: 2.2.0(eslint@9.30.1)
       eslint-plugin-prettier:
-        specifier: ^5.2.1
-        version: 5.2.1(eslint-config-prettier@10.0.1(eslint@9.18.0))(eslint@9.18.0)(prettier@3.4.2)
+        specifier: ^5.5.1
+        version: 5.5.1(eslint-config-prettier@10.1.5(eslint@9.30.1))(eslint@9.30.1)(prettier@3.6.2)
       eslint-plugin-react:
-        specifier: ^7.37.4
-        version: 7.37.4(eslint@9.18.0)
+        specifier: ^7.37.5
+        version: 7.37.5(eslint@9.30.1)
       eslint-plugin-react-compiler:
-        specifier: 19.0.0-beta-55955c9-20241229
-        version: 19.0.0-beta-55955c9-20241229(eslint@9.18.0)
+        specifier: 19.0.0-beta-714736e-20250131
+        version: 19.0.0-beta-714736e-20250131(eslint@9.30.1)
       eslint-plugin-react-hooks:
-        specifier: ^5.0.0
-        version: 5.0.0(eslint@9.18.0)
+        specifier: ~5.2.0
+        version: 5.2.0(eslint@9.30.1)
       husky:
         specifier: ^9.1.7
         version: 9.1.7
       lint-staged:
-        specifier: ^15.3.0
-        version: 15.3.0
+        specifier: ^16.1.2
+        version: 16.1.2
       prettier:
-        specifier: ^3.4.2
-        version: 3.4.2
+        specifier: ^3.6.2
+        version: 3.6.2
       tslib:
         specifier: ^2.8.1
         version: 2.8.1
       typescript:
-        specifier: ^5.7.2
-        version: 5.7.2
+        specifier: ^5.8.3
+        version: 5.8.3
       typescript-eslint:
-        specifier: ^8.19.1
-        version: 8.19.1(eslint@9.18.0)(typescript@5.7.2)
+        specifier: ^8.36.0
+        version: 8.36.0(eslint@9.30.1)(typescript@5.8.3)
       wireit:
-        specifier: ^0.14.9
-        version: 0.14.9
+        specifier: ^0.14.12
+        version: 0.14.12
 
   apps/account-ui:
     dependencies:
@@ -81,23 +75,23 @@ importers:
         specifier: ^5.4.2
         version: 5.4.2
       '@patternfly/react-core':
-        specifier: ^5.4.10
-        version: 5.4.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.14
+        version: 5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-icons':
         specifier: ^5.4.2
         version: 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-table':
-        specifier: ^5.4.13
-        version: 5.4.13(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.16
+        version: 5.4.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       i18next:
-        specifier: ^24.2.1
-        version: 24.2.1(typescript@5.7.2)
-      i18next-http-backend:
-        specifier: ^3.0.1
-        version: 3.0.1
+        specifier: ^25.3.1
+        version: 25.3.1(typescript@5.8.3)
+      i18next-fetch-backend:
+        specifier: ^6.0.0
+        version: 6.0.0
       keycloak-js:
-        specifier: workspace:*
-        version: link:../../libs/keycloak-js
+        specifier: ^26.2.0
+        version: 26.2.0
       lodash-es:
         specifier: ^4.17.21
         version: 4.17.21
@@ -108,48 +102,54 @@ importers:
         specifier: ^18.3.1
         version: 18.3.1(react@18.3.1)
       react-hook-form:
-        specifier: ^7.54.2
-        version: 7.54.2(react@18.3.1)
+        specifier: ^7.60.0
+        version: 7.60.0(react@18.3.1)
       react-i18next:
-        specifier: ^15.4.0
-        version: 15.4.0(i18next@24.2.1(typescript@5.7.2))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^15.5.3
+        version: 15.5.3(i18next@25.3.1(typescript@5.8.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.8.3)
       react-router-dom:
-        specifier: ^6.28.1
-        version: 6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^6.30.1
+        version: 6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
     devDependencies:
       '@keycloak/keycloak-admin-client':
         specifier: workspace:*
         version: link:../../libs/keycloak-admin-client
       '@playwright/test':
-        specifier: ^1.49.1
-        version: 1.49.1
+        specifier: ^1.53.2
+        version: 1.53.2
       '@types/lodash-es':
         specifier: ^4.17.12
         version: 4.17.12
       '@types/react':
-        specifier: ^18.3.13
-        version: 18.3.13
+        specifier: ^18.3.18
+        version: 18.3.18
       '@types/react-dom':
-        specifier: ^18.3.1
-        version: 18.3.1
+        specifier: ^18.3.5
+        version: 18.3.5(@types/react@18.3.18)
       '@vitejs/plugin-react-swc':
-        specifier: ^3.7.2
-        version: 3.7.2(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^3.10.2
+        version: 3.10.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
+      cross-env:
+        specifier: ^7.0.3
+        version: 7.0.3
       lightningcss:
-        specifier: ^1.28.2
-        version: 1.28.2
+        specifier: ^1.30.1
+        version: 1.30.1
       vite:
-        specifier: ^6.0.7
-        version: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
+        specifier: ^7.0.3
+        version: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
       vite-plugin-checker:
-        specifier: ^0.8.0
-        version: 0.8.0(eslint@9.18.0)(optionator@0.9.4)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^0.10.0
+        version: 0.10.0(eslint@9.30.1)(optionator@0.9.4)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vite-plugin-dts:
-        specifier: ^4.5.0
-        version: 4.5.0(@types/node@22.10.6)(rollup@4.30.1)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^4.5.4
+        version: 4.5.4(@types/node@24.0.12)(rollup@4.44.2)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
 
   apps/admin-ui:
     dependencies:
+      '@dagrejs/dagre':
+        specifier: ^1.1.5
+        version: 1.1.5
       '@keycloak/keycloak-admin-client':
         specifier: workspace:*
         version: link:../../libs/keycloak-admin-client
@@ -160,8 +160,8 @@ importers:
         specifier: ^5.4.2
         version: 5.4.2
       '@patternfly/react-core':
-        specifier: ^5.4.10
-        version: 5.4.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.14
+        version: 5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-icons':
         specifier: ^5.4.2
         version: 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -169,17 +169,14 @@ importers:
         specifier: ^5.4.1
         version: 5.4.1
       '@patternfly/react-table':
-        specifier: ^5.4.13
-        version: 5.4.13(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.16
+        version: 5.4.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@uiw/react-textarea-code-editor':
-        specifier: ^3.1.0
-        version: 3.1.0(@babel/runtime@7.26.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^3.1.1
+        version: 3.1.1(@babel/runtime@7.27.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       admin-ui:
         specifier: 'file:'
-        version: '@keycloak/keycloak-admin-ui@file:apps/admin-ui(@babel/runtime@7.26.0)(@types/react@18.3.13)(typescript@5.7.2)'
-      dagre:
-        specifier: ^0.8.5
-        version: 0.8.5
+        version: '@keycloak/keycloak-admin-ui@file:apps/admin-ui(@babel/runtime@7.27.6)(@types/react@18.3.18)(typescript@5.8.3)'
       file-saver:
         specifier: ^2.0.5
         version: 2.0.5
@@ -187,17 +184,17 @@ importers:
         specifier: ^6.0.1
         version: 6.0.1
       i18next:
-        specifier: ^24.2.1
-        version: 24.2.1(typescript@5.7.2)
-      i18next-http-backend:
-        specifier: ^3.0.1
-        version: 3.0.1
+        specifier: ^25.3.1
+        version: 25.3.1(typescript@5.8.3)
+      i18next-fetch-backend:
+        specifier: ^6.0.0
+        version: 6.0.0
       jszip:
         specifier: ^3.10.1
         version: 3.10.1
       keycloak-js:
-        specifier: workspace:*
-        version: link:../../libs/keycloak-js
+        specifier: ^26.2.0
+        version: 26.2.0
       lodash-es:
         specifier: ^4.17.21
         version: 4.17.21
@@ -211,27 +208,27 @@ importers:
         specifier: ^18.3.1
         version: 18.3.1(react@18.3.1)
       react-hook-form:
-        specifier: ^7.54.2
-        version: 7.54.2(react@18.3.1)
+        specifier: ^7.60.0
+        version: 7.60.0(react@18.3.1)
       react-i18next:
-        specifier: ^15.4.0
-        version: 15.4.0(i18next@24.2.1(typescript@5.7.2))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^15.5.3
+        version: 15.5.3(i18next@25.3.1(typescript@5.8.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.8.3)
       react-router-dom:
-        specifier: ^6.28.1
-        version: 6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^6.30.1
+        version: 6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       reactflow:
         specifier: ^11.11.4
-        version: 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        version: 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       use-react-router-breadcrumbs:
         specifier: ^4.0.1
-        version: 4.0.1(react-router-dom@6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1)
+        version: 4.0.1(react-router-dom@6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1)
     devDependencies:
-      '@4tw/cypress-drag-drop':
-        specifier: ^2.2.5
-        version: 2.2.5(cypress@13.17.0)
-      '@testing-library/cypress':
-        specifier: ^10.0.2
-        version: 10.0.2(cypress@13.17.0)
+      '@axe-core/playwright':
+        specifier: ^4.10.2
+        version: 4.10.2(playwright-core@1.53.2)
+      '@playwright/test':
+        specifier: ^1.53.2
+        version: 1.53.2
       '@testing-library/dom':
         specifier: ^10.4.0
         version: 10.4.0
@@ -239,11 +236,11 @@ importers:
         specifier: ^6.6.3
         version: 6.6.3
       '@testing-library/react':
-        specifier: ^16.1.0
-        version: 16.1.0(@testing-library/dom@10.4.0)(@types/react-dom@18.3.1)(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^16.3.0
+        version: 16.3.0(@testing-library/dom@10.4.0)(@types/react-dom@18.3.5(@types/react@18.3.18))(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@types/dagre':
-        specifier: ^0.7.52
-        version: 0.7.52
+        specifier: ^0.7.53
+        version: 0.7.53
       '@types/file-saver':
         specifier: ^2.0.7
         version: 2.0.7
@@ -251,47 +248,44 @@ importers:
         specifier: ^4.17.12
         version: 4.17.12
       '@types/react':
-        specifier: ^18.3.13
-        version: 18.3.13
+        specifier: ^18.3.18
+        version: 18.3.18
       '@types/react-dom':
-        specifier: ^18.3.1
-        version: 18.3.1
+        specifier: ^18.3.5
+        version: 18.3.5(@types/react@18.3.18)
       '@vitejs/plugin-react-swc':
-        specifier: ^3.7.2
-        version: 3.7.2(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
-      cypress:
-        specifier: ^13.17.0
-        version: 13.17.0
-      cypress-axe:
-        specifier: ^1.5.0
-        version: 1.5.0(axe-core@4.10.2)(cypress@13.17.0)
-      cypress-split:
-        specifier: ^1.24.7
-        version: 1.24.7(@babel/core@7.26.0)
+        specifier: ^3.10.2
+        version: 3.10.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
+      cross-env:
+        specifier: ^7.0.3
+        version: 7.0.3
       jsdom:
-        specifier: ^26.0.0
-        version: 26.0.0
-      ldap-server-mock:
-        specifier: ^6.0.1
-        version: 6.0.1
+        specifier: ^26.1.0
+        version: 26.1.0
       lightningcss:
-        specifier: ^1.28.2
-        version: 1.28.2
+        specifier: ^1.30.1
+        version: 1.30.1
+      properties-file:
+        specifier: ^3.5.12
+        version: 3.5.12
       ts-node:
         specifier: ^10.9.2
-        version: 10.9.2(@swc/core@1.9.3)(@types/node@22.10.6)(typescript@5.7.2)
+        version: 10.9.2(@swc/core@1.12.0)(@types/node@24.0.12)(typescript@5.8.3)
+      uuid:
+        specifier: ^11.1.0
+        version: 11.1.0
       vite:
-        specifier: ^6.0.7
-        version: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
+        specifier: ^7.0.3
+        version: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
       vite-plugin-checker:
-        specifier: ^0.8.0
-        version: 0.8.0(eslint@9.18.0)(optionator@0.9.4)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^0.10.0
+        version: 0.10.0(eslint@9.30.1)(optionator@0.9.4)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vite-plugin-dts:
-        specifier: ^4.5.0
-        version: 4.5.0(@types/node@22.10.6)(rollup@4.30.1)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^4.5.4
+        version: 4.5.4(@types/node@24.0.12)(rollup@4.44.2)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vitest:
-        specifier: ^2.1.8
-        version: 2.1.8(@types/node@22.10.6)(jsdom@26.0.0)(lightningcss@1.28.2)(terser@5.36.0)
+        specifier: ^3.2.4
+        version: 3.2.4(@types/node@24.0.12)(jsdom@26.1.0)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
 
   apps/create-keycloak-theme:
     dependencies:
@@ -299,23 +293,23 @@ importers:
         specifier: ^5.4.1
         version: 5.4.1
       commander:
-        specifier: ^12.1.0
-        version: 12.1.0
+        specifier: ^14.0.0
+        version: 14.0.0
       fs-extra:
-        specifier: ^11.2.0
-        version: 11.2.0
+        specifier: ^11.3.0
+        version: 11.3.0
       mustache:
         specifier: ^4.2.0
         version: 4.2.0
       simple-git:
-        specifier: ^3.27.0
-        version: 3.27.0
+        specifier: ^3.28.0
+        version: 3.28.0
 
   apps/keycloak-server:
     dependencies:
       '@octokit/rest':
-        specifier: ^21.1.0
-        version: 21.1.0
+        specifier: ^22.0.0
+        version: 22.0.0
       '@types/gunzip-maybe':
         specifier: ^1.4.2
         version: 1.4.2
@@ -326,8 +320,8 @@ importers:
         specifier: ^1.4.2
         version: 1.4.2
       tar-fs:
-        specifier: ^3.0.7
-        version: 3.0.7
+        specifier: ^3.1.0
+        version: 3.1.0
 
   libs/keycloak-admin-client:
     dependencies:
@@ -342,11 +336,11 @@ importers:
         version: 3.1.1
     devDependencies:
       '@faker-js/faker':
-        specifier: ^9.3.0
-        version: 9.3.0
+        specifier: ^9.9.0
+        version: 9.9.0
       '@types/chai':
-        specifier: ^5.0.1
-        version: 5.0.1
+        specifier: ^5.2.2
+        version: 5.2.2
       '@types/lodash-es':
         specifier: ^4.17.12
         version: 4.17.12
@@ -354,22 +348,20 @@ importers:
         specifier: ^10.0.10
         version: 10.0.10
       '@types/node':
-        specifier: ^22.10.6
-        version: 22.10.6
+        specifier: ^24.0.12
+        version: 24.0.12
       chai:
-        specifier: ^5.1.2
-        version: 5.1.2
+        specifier: ^5.2.0
+        version: 5.2.0
       lodash-es:
         specifier: ^4.17.21
         version: 4.17.21
       mocha:
-        specifier: ^11.0.1
-        version: 11.0.1
+        specifier: ^11.7.1
+        version: 11.7.1
       ts-node:
         specifier: ^10.9.2
-        version: 10.9.2(@swc/core@1.9.3)(@types/node@22.10.6)(typescript@5.7.2)
-
-  libs/keycloak-js: {}
+        version: 10.9.2(@swc/core@1.12.0)(@types/node@24.0.12)(typescript@5.8.3)
 
   libs/ui-shared:
     dependencies:
@@ -377,8 +369,8 @@ importers:
         specifier: workspace:*
         version: link:../keycloak-admin-client
       '@patternfly/react-core':
-        specifier: ^5.4.10
-        version: 5.4.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.14
+        version: 5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-icons':
         specifier: ^5.4.2
         version: 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -386,14 +378,14 @@ importers:
         specifier: ^5.4.1
         version: 5.4.1
       '@patternfly/react-table':
-        specifier: ^5.4.13
-        version: 5.4.13(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^5.4.16
+        version: 5.4.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       i18next:
-        specifier: ^24.2.1
-        version: 24.2.1(typescript@5.7.2)
+        specifier: ^25.3.1
+        version: 25.3.1(typescript@5.8.3)
       keycloak-js:
-        specifier: workspace:*
-        version: link:../keycloak-js
+        specifier: ^26.2.0
+        version: 26.2.0
       lodash-es:
         specifier: ^4.17.21
         version: 4.17.21
@@ -404,48 +396,48 @@ importers:
         specifier: ^18.3.1
         version: 18.3.1(react@18.3.1)
       react-hook-form:
-        specifier: 7.54.2
-        version: 7.54.2(react@18.3.1)
+        specifier: 7.60.0
+        version: 7.60.0(react@18.3.1)
       react-i18next:
-        specifier: ^15.4.0
-        version: 15.4.0(i18next@24.2.1(typescript@5.7.2))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^15.5.3
+        version: 15.5.3(i18next@25.3.1(typescript@5.8.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.8.3)
     devDependencies:
       '@types/lodash-es':
         specifier: ^4.17.12
         version: 4.17.12
       '@types/react':
-        specifier: ^18.3.13
-        version: 18.3.13
+        specifier: ^18.3.18
+        version: 18.3.18
       '@types/react-dom':
-        specifier: ^18.3.1
-        version: 18.3.1
+        specifier: ^18.3.5
+        version: 18.3.5(@types/react@18.3.18)
       '@vitejs/plugin-react-swc':
-        specifier: ^3.7.2
-        version: 3.7.2(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^3.10.2
+        version: 3.10.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       rollup-plugin-peer-deps-external:
         specifier: ^2.2.4
-        version: 2.2.4(rollup@4.30.1)
+        version: 2.2.4(rollup@4.44.2)
       vite:
-        specifier: ^6.0.7
-        version: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
+        specifier: ^7.0.3
+        version: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
       vite-plugin-checker:
-        specifier: ^0.8.0
-        version: 0.8.0(eslint@9.18.0)(optionator@0.9.4)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^0.10.0
+        version: 0.10.0(eslint@9.30.1)(optionator@0.9.4)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vite-plugin-dts:
-        specifier: ^4.5.0
-        version: 4.5.0(@types/node@22.10.6)(rollup@4.30.1)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^4.5.4
+        version: 4.5.4(@types/node@24.0.12)(rollup@4.44.2)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vite-plugin-lib-inject-css:
-        specifier: ^2.2.1
-        version: 2.2.1(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))
+        specifier: ^2.2.2
+        version: 2.2.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
       vitest:
-        specifier: ^2.1.8
-        version: 2.1.8(@types/node@22.10.6)(jsdom@26.0.0)(lightningcss@1.28.2)(terser@5.36.0)
+        specifier: ^3.2.4
+        version: 3.2.4(@types/node@24.0.12)(jsdom@26.1.0)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
 
   themes-vendor:
     dependencies:
       '@noble/hashes':
-        specifier: ^1.7.0
-        version: 1.7.0
+        specifier: ^1.8.0
+        version: 1.8.0
       '@patternfly-v5/patternfly':
         specifier: npm:@patternfly/patternfly@^5.4.2
         version: '@patternfly/patternfly@5.4.2'
@@ -465,138 +457,130 @@ importers:
         specifier: ^1.5.4
         version: 1.5.4
       uuid:
-        specifier: ^11.0.5
-        version: 11.0.5
+        specifier: ^11.1.0
+        version: 11.1.0
     devDependencies:
       '@rollup/plugin-commonjs':
-        specifier: ^28.0.2
-        version: 28.0.2(rollup@4.30.1)
+        specifier: ^28.0.6
+        version: 28.0.6(rollup@4.44.2)
       '@rollup/plugin-node-resolve':
-        specifier: ^16.0.0
-        version: 16.0.0(rollup@4.30.1)
+        specifier: ^16.0.1
+        version: 16.0.1(rollup@4.44.2)
       '@rollup/plugin-replace':
         specifier: ^6.0.2
-        version: 6.0.2(rollup@4.30.1)
+        version: 6.0.2(rollup@4.44.2)
       '@rollup/plugin-terser':
         specifier: ^0.4.4
-        version: 0.4.4(rollup@4.30.1)
+        version: 0.4.4(rollup@4.44.2)
       rollup:
-        specifier: ^4.30.1
-        version: 4.30.1
+        specifier: ^4.44.2
+        version: 4.44.2
 
 packages:
 
-  '@4tw/cypress-drag-drop@2.2.5':
-    resolution: {integrity: sha512-3ghTmzhOmUqeN6U3QmUnKRUxI7OMLbJA4hHUY/eS/FhWJgxbiGgcaELbolWnBAOpajPXcsNQGYEj9brd59WH6A==}
-    peerDependencies:
-      cypress: 2 - 13
-
-  '@actions/core@1.11.1':
-    resolution: {integrity: sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==}
-
-  '@actions/exec@1.1.1':
-    resolution: {integrity: sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==}
-
-  '@actions/http-client@2.2.3':
-    resolution: {integrity: sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==}
-
-  '@actions/io@1.1.3':
-    resolution: {integrity: sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==}
-
-  '@adobe/css-tools@4.4.1':
-    resolution: {integrity: sha512-12WGKBQzjUAI4ayyF4IAtfw2QR/IDoqk6jTddXDhtYTJF9ASmoE1zst7cVtP0aL/F1jUJL5r+JxKXKEgHNbEUQ==}
+  '@adobe/css-tools@4.4.2':
+    resolution: {integrity: sha512-baYZExFpsdkBNuvGKTKWCwKH57HRZLVtycZS05WTQNVOiXVSeAki3nU35zlRbToeMW8aHlJfyS+1C4BOv27q0A==}
 
   '@ampproject/remapping@2.3.0':
     resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
     engines: {node: '>=6.0.0'}
 
-  '@asamuzakjp/css-color@2.8.2':
-    resolution: {integrity: sha512-RtWv9jFN2/bLExuZgFFZ0I3pWWeezAHGgrmjqGGWclATl1aDe3yhCUaI0Ilkp6OCk9zX7+FjvDasEX8Q9Rxc5w==}
+  '@asamuzakjp/css-color@3.1.1':
+    resolution: {integrity: sha512-hpRD68SV2OMcZCsrbdkccTw5FXjNDLo5OuqSHyHZfwweGsDWZwDJ2+gONyNAbazZclobMirACLw0lk8WVxIqxA==}
 
-  '@ast-grep/napi-darwin-arm64@0.32.2':
-    resolution: {integrity: sha512-TPUJEO6irdYeGnalM878B93bqxLBslxhADQwQodtRfoK0Twd2T/U1ZcWVA1ntV1buR0C7ipHVT2737O/Aj31+Q==}
+  '@ast-grep/napi-darwin-arm64@0.36.2':
+    resolution: {integrity: sha512-0dzW+5SRuUxAlfwgMiUWXSvvyVD3nffzLtH5RhH2a1VXbQxi2UFWZqtfhv6e27iIUTnPfZDnZGNRw8FZgttMfQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@ast-grep/napi-darwin-x64@0.32.2':
-    resolution: {integrity: sha512-VBouGnUTpV2sSdktjF6pVy/Rw8PkWe0U5TFx0zzQIGmPeoTUfClpuqWdKLlBGyKs0nKQ5+TKw989csKTFTU6wQ==}
+  '@ast-grep/napi-darwin-x64@0.36.2':
+    resolution: {integrity: sha512-7TPdnq55OBXGcJLDARObI5BUFbp0AVRMGEzjnIBMWbRSowlDVTH7qBWwNAYk4auCdkwG8EBL40BUIHmagzpoCw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@ast-grep/napi-linux-arm64-gnu@0.32.2':
-    resolution: {integrity: sha512-mVHbzQPCyG550lDa1t83BtITRmnA9464L2HtLCaRfLf0PUSMe44kyWYJDwt5YhaYWEZzTuVKxAhxZERiAgP6KA==}
+  '@ast-grep/napi-linux-arm64-gnu@0.36.2':
+    resolution: {integrity: sha512-/h51eEnEYCq4bclzhynH+964LQXDKXgNb2Un+Y9TLOU8VRaGNawTkZkFq+iBp8T1hl0CznnsQQsg+9pHDHprHQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@ast-grep/napi-linux-arm64-musl@0.32.2':
-    resolution: {integrity: sha512-AWCrr5PgnrJBgm4N604KOJcG3dZpCFsee7v2MKyYTVDZ1ls75iLncTcRPi+Na7O0h9B6XJUpgh8VQ5RhzPEvzQ==}
+  '@ast-grep/napi-linux-arm64-musl@0.36.2':
+    resolution: {integrity: sha512-RIuk0VaQW2b5uOPJzuYFQBwMZIEVnp6maXPjnatUHxfniirSI172E7LtOU/FIEpCjU9Fpq23A79S43ImFt1KLA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@ast-grep/napi-linux-x64-gnu@0.32.2':
-    resolution: {integrity: sha512-P51SZCa2V4j79+X8YT1gZaMGNUjiUyf9KrdnAFKpf2w3iSXhWaa/cMAUoEeRFgSHSQ1ReaCOZNaJI4vRUGZQtg==}
+  '@ast-grep/napi-linux-x64-gnu@0.36.2':
+    resolution: {integrity: sha512-Xmb50HPfRNi+iLtHp+8/dqiTd8tjArYxOdj1tZzjRndpKhFpQDVrcOnPFObDCRgxVeLovdql9A1ad6BMcEL01Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@ast-grep/napi-linux-x64-musl@0.32.2':
-    resolution: {integrity: sha512-MlApu44GKdluuTaDE/HK+T/+UfpU4tdR7JZSxEJQGt6jnVpbWEIbq2szsFNTUtu0eYb7mqn64ftC5QHC6RRRag==}
+  '@ast-grep/napi-linux-x64-musl@0.36.2':
+    resolution: {integrity: sha512-RSnqCsl3OBfJWh2rETtv3o7xd4QnbB2YTh6H6oYfFhhX0tlon/V+bUXI77hU2/W73hj9GHqWZsygsF43NXn/Hw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@ast-grep/napi-win32-arm64-msvc@0.32.2':
-    resolution: {integrity: sha512-cs0Pa//3Vm5mBCKQgmVkwy7U9LGxVAD0w8aRwqdzNz2fdxpQ5XX+GhZH4EnvNZAsVTCrgdqIY5pKq6oUDDLeBA==}
+  '@ast-grep/napi-win32-arm64-msvc@0.36.2':
+    resolution: {integrity: sha512-/Q85h8F9K2G8qig0lndZWb+ykCfhfpSN27F3i7Aw5C0Ph7S6vFH76xn3l3dJTZb2CwUSsv4JNoqmFmY4B8DExQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@ast-grep/napi-win32-ia32-msvc@0.32.2':
-    resolution: {integrity: sha512-nMv+XTM9t+1gkceSKBmt+A5VKrQvTtnh65TK8NRdD7MxHpYhlZazZx3qBf2s13mb2qkRjLD0Umu33ZmXUvFblA==}
+  '@ast-grep/napi-win32-ia32-msvc@0.36.2':
+    resolution: {integrity: sha512-bDdwErB7zf9DvRx3kNZyMKJb9by5ra24WAXSiVzI8MR387ibZP9UCTzKuGqPrbuZADYWiOgsg3nXMklyPFtmhQ==}
     engines: {node: '>= 10'}
     cpu: [ia32]
     os: [win32]
 
-  '@ast-grep/napi-win32-x64-msvc@0.32.2':
-    resolution: {integrity: sha512-dEU2/BSahI9GSlibc0HGYldBOhpl8fNv1XsM5rEVLBQ++Eg6QhIXQG1cjPsnGAaSaTDvurBTj/09WiPJt58rZw==}
+  '@ast-grep/napi-win32-x64-msvc@0.36.2':
+    resolution: {integrity: sha512-LVZ2DqP9fRfyUceE0BGnlKoPmSx3dYYApSEUdt82Pn7jEVWpFFyTLFmZ9ILiCSaVc6urMJpKWdxAHFqDNNlGfg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@ast-grep/napi@0.32.2':
-    resolution: {integrity: sha512-VHgEqKBJH1wZH3GHI09Io4TySi8IpEi3s0EOtKAvvyixUxpqMNw+vx6a4sJDQUrLSGPeQ5e0ZokQi2GOGovY1g==}
+  '@ast-grep/napi@0.36.2':
+    resolution: {integrity: sha512-ByenQQ0BtqqY0pvlmipvkDv/cKl/9vVjBydS7hloXOdmXPoUF0pHdlilC7ZfrRW97EzPQQZT2jgHl2tu7zg9QA==}
     engines: {node: '>= 10'}
 
+  '@axe-core/playwright@4.10.2':
+    resolution: {integrity: sha512-6/b5BJjG6hDaRNtgzLIfKr5DfwyiLHO4+ByTLB0cJgWSM8Ll7KqtdblIS6bEkwSF642/Ex91vNqIl3GLXGlceg==}
+    peerDependencies:
+      playwright-core: '>= 1.0.0'
+
   '@babel/code-frame@7.26.2':
     resolution: {integrity: sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/compat-data@7.26.2':
-    resolution: {integrity: sha512-Z0WgzSEa+aUcdiJuCIqgujCshpMWgUpgOxXotrYPSA53hA3qopNaqcJpyr0hVb1FeWdnqFA35/fUtXgBK8srQg==}
+  '@babel/code-frame@7.27.1':
+    resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/core@7.26.0':
-    resolution: {integrity: sha512-i1SLeK+DzNnQ3LL/CswPCa/E5u4lh1k6IAEphON8F+cXt0t9euTshDru0q7/IqMa1PMPz5RnHuHscF8/ZJsStg==}
+  '@babel/compat-data@7.26.8':
+    resolution: {integrity: sha512-oH5UPLMWR3L2wEFLnFJ1TZXqHufiTKAiLfqw5zkhS4dKXLJ10yVztfil/twG8EDTA4F/tvVNw9nOl4ZMslB8rQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/generator@7.26.2':
-    resolution: {integrity: sha512-zevQbhbau95nkoxSq3f/DC/SC+EEOUZd3DYqfSkMhY2/wfSeaHV1Ew4vk8e+x8lja31IbyuUa2uQ3JONqKbysw==}
+  '@babel/core@7.26.9':
+    resolution: {integrity: sha512-lWBYIrF7qK5+GjY5Uy+/hEgp8OJWOD/rpy74GplYRhEauvbHDeFB8t5hPOZxCZ0Oxf4Cc36tK51/l3ymJysrKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.26.9':
+    resolution: {integrity: sha512-kEWdzjOAUMW4hAyrzJ0ZaTOu9OmpyDIQicIh0zg0EEcEkYXZb2TjtBhnHi2ViX7PKwZqF4xwqfAm299/QMP3lg==}
     engines: {node: '>=6.9.0'}
 
   '@babel/helper-annotate-as-pure@7.25.9':
     resolution: {integrity: sha512-gv7320KBUFJz1RnylIg5WWYPRXKZ884AGkYpgpWW02TH66Dl+HaC1t1CKd0z3R4b6hdYEcmrNZHUmfCP+1u3/g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-compilation-targets@7.25.9':
-    resolution: {integrity: sha512-j9Db8Suy6yV/VHa4qzrj9yZfZxhLWQdVnRlXxmKLYlhWUVB1sB2G5sxuWYXk/whHD9iW76PmNzxZ4UCnTQTVEQ==}
+  '@babel/helper-compilation-targets@7.26.5':
+    resolution: {integrity: sha512-IXuyn5EkouFJscIDuFF5EsiSolseme1s0CZB+QxVugqJLYmKdxI1VfIBOst0SUu4rnk2Z7kqTwmoO1lp3HIfnA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-create-class-features-plugin@7.25.9':
-    resolution: {integrity: sha512-UTZQMvt0d/rSz6KI+qdu7GQze5TIajwTS++GUozlw8VBJDEOAqSXwm1WvmYEZwqdqSGQshRocPDqrt4HBZB3fQ==}
+  '@babel/helper-create-class-features-plugin@7.26.9':
+    resolution: {integrity: sha512-ubbUqCofvxPRurw5L8WTsCLSkQiVpov4Qx0WMA+jUN+nXBK8ADPlJO1grkFw5CWKC5+sZSOfuGMdX1aI1iT9Sg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
@@ -619,12 +603,12 @@ packages:
     resolution: {integrity: sha512-FIpuNaz5ow8VyrYcnXQTDRGvV6tTjkNtCK/RYNDXGSLlUD6cBuQTSw43CShGxjvfBTfcUA/r6UhUCbtYqkhcuQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-plugin-utils@7.25.9':
-    resolution: {integrity: sha512-kSMlyUVdWe25rEsRGviIgOWnoT/nfABVWlqt9N19/dIPWViAOW2s9wznP5tURbs/IDuNk4gPy3YdYRgH3uxhBw==}
+  '@babel/helper-plugin-utils@7.26.5':
+    resolution: {integrity: sha512-RS+jZcRdZdRFzMyr+wcsaqOmld1/EqTghfaBGQQd/WnRdzdlvSZ//kF7U8VQTxf1ynZ4cjUcYgjVGx13ewNPMg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-replace-supers@7.25.9':
-    resolution: {integrity: sha512-IiDqTOTBQy0sWyeXyGSC5TBJpGFXBkRynjBeXsvbhQFKj2viwJC76Epz35YLU1fpe/Am6Vppb7W7zM4fPQzLsQ==}
+  '@babel/helper-replace-supers@7.26.5':
+    resolution: {integrity: sha512-bJ6iIVdYX1YooY2X7w1q6VITt+LnUILtNk7zT78ykuwStx8BauCzxvFqFaHjOpW1bVnSUM1PN1f0p5P21wHxvg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
@@ -637,20 +621,33 @@ packages:
     resolution: {integrity: sha512-4A/SCr/2KLd5jrtOMFzaKjVtAei3+2r/NChoBNoZ3EyP/+GlhoaEGoWOZUmFmoITP7zOJyHIMm+DYRd8o3PvHA==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-string-parser@7.27.1':
+    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-validator-identifier@7.25.9':
     resolution: {integrity: sha512-Ed61U6XJc3CVRfkERJWDz4dJwKe7iLmmJsbOGu9wSloNSFttHV0I8g6UAgb7qnK5ly5bGLPd4oXZlxCdANBOWQ==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/helper-validator-identifier@7.27.1':
+    resolution: {integrity: sha512-D2hP9eA+Sqx1kBZgzxZh0y1trbuU+JoDkiEwqhQ36nodYqJwyEIhPSdMNd7lOm/4io72luTPWH20Yda0xOuUow==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/helper-validator-option@7.25.9':
     resolution: {integrity: sha512-e/zv1co8pp55dNdEcCynfj9X7nyUKUXoUEwfXqaZt0omVOmDe9oOTdKStH4GmAw6zxMFs50ZayuMfHDKlO7Tfw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helpers@7.26.0':
-    resolution: {integrity: sha512-tbhNuIxNcVb21pInl3ZSjksLCvgdZy9KwJ8brv993QtIVKJBBkYXz4q4ZbAv31GdnC+R90np23L5FbEBlthAEw==}
+  '@babel/helpers@7.26.9':
+    resolution: {integrity: sha512-Mz/4+y8udxBKdmzt/UjPACs4G3j5SshJJEFFKxlCGPydG4JAHXxjWjAwjd09tf6oINvl1VfMJo+nB7H2YKQ0dA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.26.2':
-    resolution: {integrity: sha512-DWMCZH9WA4Maitz2q21SRKHo9QXZxkDsbNZoVD62gusNtNBBqDg9i7uOhASfTfIGNzW+O+r7+jAlM8dwphcJKQ==}
+  '@babel/parser@7.26.9':
+    resolution: {integrity: sha512-81NWa1njQblgZbQHxWHpxxCzNsa3ZwvFqpUg7P+NNUU6f3UU2jBEg4OlF/J6rl8+PQGh1q6/zWScd001YwcA5A==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/parser@7.27.2':
+    resolution: {integrity: sha512-QYLs8299NA7WM/bZAdp+CviYYkVoYXlDW2rzliy3chxd1PQjej7JORuMJDJXJUb9g0TT+B99EwaVLKmX+sPXWw==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
@@ -661,49 +658,51 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
-  '@babel/plugin-syntax-jsx@7.25.9':
-    resolution: {integrity: sha512-ld6oezHQMZsZfp6pWtbjaNDF2tiiCYYDqQszHt5VV437lewP9aSi2Of99CK0D0XB21k7FLgnLcmQKyKzynfeAA==}
+  '@babel/runtime@7.26.9':
+    resolution: {integrity: sha512-aA63XwOkcl4xxQa3HjPMqOP6LiK0ZDv3mUPYEFXkpHbaFjtGggE1A61FjFzJnB+p7/oy2gA8E+rcBNl/zC1tMg==}
     engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
 
-  '@babel/runtime@7.26.0':
-    resolution: {integrity: sha512-FDSOghenHTiToteC/QRlv2q3DhPZ/oOXTBoirfWNx1Cx3TMVcGWQtMMmQcSvb/JjpNeGzx8Pq/b4fKEJuWm1sw==}
+  '@babel/runtime@7.27.0':
+    resolution: {integrity: sha512-VtPOkrdPHZsKc/clNqyi9WUA8TINkZ4cGk63UUE3u4pmB2k+ZMQRDuIOagv8UVd6j7k0T3+RRIb7beKTebNbcw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/template@7.25.9':
-    resolution: {integrity: sha512-9DGttpmPvIxBb/2uwpVo3dqJ+O6RooAFOS+lB+xDqoE2PVCE8nfoHMdZLpfCQRLwvohzXISPZcgxt80xLfsuwg==}
+  '@babel/runtime@7.27.6':
+    resolution: {integrity: sha512-vbavdySgbTTrmFE+EsiqUTzlOr5bzlnJtUv9PynGCAKvfQqjIXbvFdumPM/GxMDfyuGMJaJAU6TO4zc1Jf1i8Q==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/traverse@7.25.9':
-    resolution: {integrity: sha512-ZCuvfwOwlz/bawvAuvcj8rrithP2/N55Tzz342AkTvq4qaWbGfmCk/tKhNaV2cthijKrPAA8SRJV5WWe7IBMJw==}
+  '@babel/template@7.26.9':
+    resolution: {integrity: sha512-qyRplbeIpNZhmzOysF/wFMuP9sctmh2cFzRAZOn1YapxBsE1i9bJIY586R/WBLfLcmcBlM8ROBiQURnnNy+zfA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.26.0':
-    resolution: {integrity: sha512-Z/yiTPj+lDVnF7lWeKCIJzaIkI0vYO87dMpZ4bg4TDrFe4XXLFWL1TbXU27gBP3QccxV9mZICCrnjnYlJjXHOA==}
+  '@babel/traverse@7.26.9':
+    resolution: {integrity: sha512-ZYW7L+pL8ahU5fXmNbPF+iZFHCv5scFak7MZ9bwaRPLUhHh7QQEMjZUg0HevihoqCM5iSYHN61EyCoZvqC+bxg==}
     engines: {node: '>=6.9.0'}
 
-  '@colors/colors@1.5.0':
-    resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==}
-    engines: {node: '>=0.1.90'}
+  '@babel/types@7.26.9':
+    resolution: {integrity: sha512-Y3IR1cRnOxOCDvMmNiym7XpXQ93iGDDPHx+Zj+NM+rg0fBaShfQLkg+hKPaZCEvg5N/LeCo4+Rj/i3FuJsIQaw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.27.1':
+    resolution: {integrity: sha512-+EzkxvLNfiUeKMgy/3luqfsCWFRXLb7U6wNQTk60tovuckwB15B191tJWvpp4HjiQWdJkCxO3Wbvc6jlk3Xb2Q==}
+    engines: {node: '>=6.9.0'}
 
   '@cspotcode/source-map-support@0.8.1':
     resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
     engines: {node: '>=12'}
 
-  '@csstools/color-helpers@5.0.1':
-    resolution: {integrity: sha512-MKtmkA0BX87PKaO1NFRTFH+UnkgnmySQOvNxJubsadusqPEC2aJ9MOQiMceZJJ6oitUl/i0L6u0M1IrmAOmgBA==}
+  '@csstools/color-helpers@5.0.2':
+    resolution: {integrity: sha512-JqWH1vsgdGcw2RR6VliXXdA0/59LttzlU8UlRT/iUUsEeWfYq8I+K0yhihEUTTHLRm1EXvpsCx3083EU15ecsA==}
     engines: {node: '>=18'}
 
-  '@csstools/css-calc@2.1.1':
-    resolution: {integrity: sha512-rL7kaUnTkL9K+Cvo2pnCieqNpTKgQzy5f+N+5Iuko9HAoasP+xgprVh7KN/MaJVvVL1l0EzQq2MoqBHKSrDrag==}
+  '@csstools/css-calc@2.1.2':
+    resolution: {integrity: sha512-TklMyb3uBB28b5uQdxjReG4L80NxAqgrECqLZFQbyLekwwlcDDS8r3f07DKqeo8C4926Br0gf/ZDe17Zv4wIuw==}
     engines: {node: '>=18'}
     peerDependencies:
       '@csstools/css-parser-algorithms': ^3.0.4
       '@csstools/css-tokenizer': ^3.0.3
 
-  '@csstools/css-color-parser@3.0.7':
-    resolution: {integrity: sha512-nkMp2mTICw32uE5NN+EsJ4f5N+IGFeCFu4bGpiKgb2Pq/7J/MpyLBeQ5ry4KKtRFZaYs6sTmcMYrSRIyj5DFKA==}
+  '@csstools/css-color-parser@3.0.8':
+    resolution: {integrity: sha512-pdwotQjCCnRPuNi06jFuP68cykU1f3ZWExLe/8MQ1LOs8Xq+fTkYgd+2V8mWUWMrOn9iS2HftPVaMZDaXzGbhQ==}
     engines: {node: '>=18'}
     peerDependencies:
       '@csstools/css-parser-algorithms': ^3.0.4
@@ -719,451 +718,171 @@ packages:
     resolution: {integrity: sha512-UJnjoFsmxfKUdNYdWgOB0mWUypuLvAfQPH1+pyvRJs6euowbFkFC6P13w1l8mJyi3vxYMxc9kld5jZEGRQs6bw==}
     engines: {node: '>=18'}
 
-  '@cypress/request@3.0.6':
-    resolution: {integrity: sha512-fi0eVdCOtKu5Ed6+E8mYxUF6ZTFJDZvHogCBelM0xVXmrDEkyM22gRArQzq1YcHPm1V47Vf/iAD+WgVdUlJCGg==}
-    engines: {node: '>= 6'}
+  '@dagrejs/dagre@1.1.5':
+    resolution: {integrity: sha512-Ghgrh08s12DCL5SeiR6AoyE80mQELTWhJBRmXfFoqDiFkR458vPEdgTbbjA0T+9ETNxUblnD0QW55tfdvi5pjQ==}
 
-  '@cypress/xvfb@1.2.4':
-    resolution: {integrity: sha512-skbBzPggOVYCbnGgV+0dmBdW/s77ZkAOXIC1knS8NagwDjBrNC1LuXtQJeiN6l+m7lzmHtaoUw/ctJKdqkG57Q==}
+  '@dagrejs/graphlib@2.2.4':
+    resolution: {integrity: sha512-mepCf/e9+SKYy1d02/UkvSy6+6MoyXhVxP8lLDfA7BPE1X1d4dR0sZznmbM8/XVJ1GPM+Svnx7Xj6ZweByWUkw==}
+    engines: {node: '>17.0.0'}
 
-  '@dependents/detective-less@5.0.0':
-    resolution: {integrity: sha512-D/9dozteKcutI5OdxJd8rU+fL6XgaaRg60sPPJWkT33OCiRfkCu5wO5B/yXTaaL2e6EB0lcCBGe5E0XscZCvvQ==}
+  '@esbuild/aix-ppc64@0.25.6':
+    resolution: {integrity: sha512-ShbM/3XxwuxjFiuVBHA+d3j5dyac0aEVVq1oluIDf71hUw0aRF59dV/efUsIwFnR6m8JNM2FjZOzmaZ8yG61kw==}
     engines: {node: '>=18'}
-
-  '@esbuild/aix-ppc64@0.21.5':
-    resolution: {integrity: sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==}
-    engines: {node: '>=12'}
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/aix-ppc64@0.23.1':
-    resolution: {integrity: sha512-6VhYk1diRqrhBAqpJEdjASR/+WVRtfjpqKuNw11cLiaWpAT/Uu+nokB+UJnevzy/P9C/ty6AOe0dwueMrGh/iQ==}
-    engines: {node: '>=18'}
-    cpu: [ppc64]
-    os: [aix]
-
-  '@esbuild/aix-ppc64@0.24.2':
-    resolution: {integrity: sha512-thpVCb/rhxE/BnMLQ7GReQLLN8q9qbHmI55F4489/ByVg2aQaQ6kbcLb6FHkocZzQhxc4gx0sCk0tJkKBFzDhA==}
-    engines: {node: '>=18'}
-    cpu: [ppc64]
-    os: [aix]
-
-  '@esbuild/android-arm64@0.21.5':
-    resolution: {integrity: sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [android]
-
-  '@esbuild/android-arm64@0.23.1':
-    resolution: {integrity: sha512-xw50ipykXcLstLeWH7WRdQuysJqejuAGPd30vd1i5zSyKK3WE+ijzHmLKxdiCMtH1pHz78rOg0BKSYOSB/2Khw==}
+  '@esbuild/android-arm64@0.25.6':
+    resolution: {integrity: sha512-hd5zdUarsK6strW+3Wxi5qWws+rJhCCbMiC9QZyzoxfk5uHRIE8T287giQxzVpEvCwuJ9Qjg6bEjcRJcgfLqoA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm64@0.24.2':
-    resolution: {integrity: sha512-cNLgeqCqV8WxfcTIOeL4OAtSmL8JjcN6m09XIgro1Wi7cF4t/THaWEa7eL5CMoMBdjoHOTh/vwTO/o2TRXIyzg==}
+  '@esbuild/android-arm@0.25.6':
+    resolution: {integrity: sha512-S8ToEOVfg++AU/bHwdksHNnyLyVM+eMVAOf6yRKFitnwnbwwPNqKr3srzFRe7nzV69RQKb5DgchIX5pt3L53xg==}
     engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [android]
-
-  '@esbuild/android-arm@0.21.5':
-    resolution: {integrity: sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==}
-    engines: {node: '>=12'}
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-arm@0.23.1':
-    resolution: {integrity: sha512-uz6/tEy2IFm9RYOyvKl88zdzZfwEfKZmnX9Cj1BHjeSGNuGLuMD1kR8y5bteYmwqKm1tj8m4cb/aKEorr6fHWQ==}
-    engines: {node: '>=18'}
-    cpu: [arm]
-    os: [android]
-
-  '@esbuild/android-arm@0.24.2':
-    resolution: {integrity: sha512-tmwl4hJkCfNHwFB3nBa8z1Uy3ypZpxqxfTQOcHX+xRByyYgunVbZ9MzUUfb0RxaHIMnbHagwAxuTL+tnNM+1/Q==}
-    engines: {node: '>=18'}
-    cpu: [arm]
-    os: [android]
-
-  '@esbuild/android-x64@0.21.5':
-    resolution: {integrity: sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [android]
-
-  '@esbuild/android-x64@0.23.1':
-    resolution: {integrity: sha512-nlN9B69St9BwUoB+jkyU090bru8L0NA3yFvAd7k8dNsVH8bi9a8cUAUSEcEEgTp2z3dbEDGJGfP6VUnkQnlReg==}
+  '@esbuild/android-x64@0.25.6':
+    resolution: {integrity: sha512-0Z7KpHSr3VBIO9A/1wcT3NTy7EB4oNC4upJ5ye3R7taCc2GUdeynSLArnon5G8scPwaU866d3H4BCrE5xLW25A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
-  '@esbuild/android-x64@0.24.2':
-    resolution: {integrity: sha512-B6Q0YQDqMx9D7rvIcsXfmJfvUYLoP722bgfBlO5cGvNVb5V/+Y7nhBE3mHV9OpxBf4eAS2S68KZztiPaWq4XYw==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [android]
-
-  '@esbuild/darwin-arm64@0.21.5':
-    resolution: {integrity: sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@esbuild/darwin-arm64@0.23.1':
-    resolution: {integrity: sha512-YsS2e3Wtgnw7Wq53XXBLcV6JhRsEq8hkfg91ESVadIrzr9wO6jJDMZnCQbHm1Guc5t/CdDiFSSfWP58FNuvT3Q==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@esbuild/darwin-arm64@0.24.2':
-    resolution: {integrity: sha512-kj3AnYWc+CekmZnS5IPu9D+HWtUI49hbnyqk0FLEJDbzCIQt7hg7ucF1SQAilhtYpIujfaHr6O0UHlzzSPdOeA==}
+  '@esbuild/darwin-arm64@0.25.6':
+    resolution: {integrity: sha512-FFCssz3XBavjxcFxKsGy2DYK5VSvJqa6y5HXljKzhRZ87LvEi13brPrf/wdyl/BbpbMKJNOr1Sd0jtW4Ge1pAA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.21.5':
-    resolution: {integrity: sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@esbuild/darwin-x64@0.23.1':
-    resolution: {integrity: sha512-aClqdgTDVPSEGgoCS8QDG37Gu8yc9lTHNAQlsztQ6ENetKEO//b8y31MMu2ZaPbn4kVsIABzVLXYLhCGekGDqw==}
+  '@esbuild/darwin-x64@0.25.6':
+    resolution: {integrity: sha512-GfXs5kry/TkGM2vKqK2oyiLFygJRqKVhawu3+DOCk7OxLy/6jYkWXhlHwOoTb0WqGnWGAS7sooxbZowy+pK9Yg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.24.2':
-    resolution: {integrity: sha512-WeSrmwwHaPkNR5H3yYfowhZcbriGqooyu3zI/3GGpF8AyUdsrrP0X6KumITGA9WOyiJavnGZUwPGvxvwfWPHIA==}
+  '@esbuild/freebsd-arm64@0.25.6':
+    resolution: {integrity: sha512-aoLF2c3OvDn2XDTRvn8hN6DRzVVpDlj2B/F66clWd/FHLiHaG3aVZjxQX2DYphA5y/evbdGvC6Us13tvyt4pWg==}
     engines: {node: '>=18'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@esbuild/freebsd-arm64@0.21.5':
-    resolution: {integrity: sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==}
-    engines: {node: '>=12'}
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-arm64@0.23.1':
-    resolution: {integrity: sha512-h1k6yS8/pN/NHlMl5+v4XPfikhJulk4G+tKGFIOwURBSFzE8bixw1ebjluLOjfwtLqY0kewfjLSrO6tN2MgIhA==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@esbuild/freebsd-arm64@0.24.2':
-    resolution: {integrity: sha512-UN8HXjtJ0k/Mj6a9+5u6+2eZ2ERD7Edt1Q9IZiB5UZAIdPnVKDoG7mdTVGhHJIeEml60JteamR3qhsr1r8gXvg==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@esbuild/freebsd-x64@0.21.5':
-    resolution: {integrity: sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [freebsd]
-
-  '@esbuild/freebsd-x64@0.23.1':
-    resolution: {integrity: sha512-lK1eJeyk1ZX8UklqFd/3A60UuZ/6UVfGT2LuGo3Wp4/z7eRTRYY+0xOu2kpClP+vMTi9wKOfXi2vjUpO1Ro76g==}
+  '@esbuild/freebsd-x64@0.25.6':
+    resolution: {integrity: sha512-2SkqTjTSo2dYi/jzFbU9Plt1vk0+nNg8YC8rOXXea+iA3hfNJWebKYPs3xnOUf9+ZWhKAaxnQNUf2X9LOpeiMQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.24.2':
-    resolution: {integrity: sha512-TvW7wE/89PYW+IevEJXZ5sF6gJRDY/14hyIGFXdIucxCsbRmLUcjseQu1SyTko+2idmCw94TgyaEZi9HUSOe3Q==}
+  '@esbuild/linux-arm64@0.25.6':
+    resolution: {integrity: sha512-b967hU0gqKd9Drsh/UuAm21Khpoh6mPBSgz8mKRq4P5mVK8bpA+hQzmm/ZwGVULSNBzKdZPQBRT3+WuVavcWsQ==}
     engines: {node: '>=18'}
-    cpu: [x64]
-    os: [freebsd]
-
-  '@esbuild/linux-arm64@0.21.5':
-    resolution: {integrity: sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==}
-    engines: {node: '>=12'}
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm64@0.23.1':
-    resolution: {integrity: sha512-/93bf2yxencYDnItMYV/v116zff6UyTjo4EtEQjUBeGiVpMmffDNUyD9UN2zV+V3LRV3/on4xdZ26NKzn6754g==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [linux]
-
-  '@esbuild/linux-arm64@0.24.2':
-    resolution: {integrity: sha512-7HnAD6074BW43YvvUmE/35Id9/NB7BeX5EoNkK9obndmZBUk8xmJJeU7DwmUeN7tkysslb2eSl6CTrYz6oEMQg==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [linux]
-
-  '@esbuild/linux-arm@0.21.5':
-    resolution: {integrity: sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==}
-    engines: {node: '>=12'}
-    cpu: [arm]
-    os: [linux]
-
-  '@esbuild/linux-arm@0.23.1':
-    resolution: {integrity: sha512-CXXkzgn+dXAPs3WBwE+Kvnrf4WECwBdfjfeYHpMeVxWE0EceB6vhWGShs6wi0IYEqMSIzdOF1XjQ/Mkm5d7ZdQ==}
-    engines: {node: '>=18'}
-    cpu: [arm]
-    os: [linux]
-
-  '@esbuild/linux-arm@0.24.2':
-    resolution: {integrity: sha512-n0WRM/gWIdU29J57hJyUdIsk0WarGd6To0s+Y+LwvlC55wt+GT/OgkwoXCXvIue1i1sSNWblHEig00GBWiJgfA==}
+  '@esbuild/linux-arm@0.25.6':
+    resolution: {integrity: sha512-SZHQlzvqv4Du5PrKE2faN0qlbsaW/3QQfUUc6yO2EjFcA83xnwm91UbEEVx4ApZ9Z5oG8Bxz4qPE+HFwtVcfyw==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.21.5':
-    resolution: {integrity: sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==}
-    engines: {node: '>=12'}
-    cpu: [ia32]
-    os: [linux]
-
-  '@esbuild/linux-ia32@0.23.1':
-    resolution: {integrity: sha512-VTN4EuOHwXEkXzX5nTvVY4s7E/Krz7COC8xkftbbKRYAl96vPiUssGkeMELQMOnLOJ8k3BY1+ZY52tttZnHcXQ==}
+  '@esbuild/linux-ia32@0.25.6':
+    resolution: {integrity: sha512-aHWdQ2AAltRkLPOsKdi3xv0mZ8fUGPdlKEjIEhxCPm5yKEThcUjHpWB1idN74lfXGnZ5SULQSgtr5Qos5B0bPw==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.24.2':
-    resolution: {integrity: sha512-sfv0tGPQhcZOgTKO3oBE9xpHuUqguHvSo4jl+wjnKwFpapx+vUDcawbwPNuBIAYdRAvIDBfZVvXprIj3HA+Ugw==}
-    engines: {node: '>=18'}
-    cpu: [ia32]
-    os: [linux]
-
-  '@esbuild/linux-loong64@0.21.5':
-    resolution: {integrity: sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==}
-    engines: {node: '>=12'}
-    cpu: [loong64]
-    os: [linux]
-
-  '@esbuild/linux-loong64@0.23.1':
-    resolution: {integrity: sha512-Vx09LzEoBa5zDnieH8LSMRToj7ir/Jeq0Gu6qJ/1GcBq9GkfoEAoXvLiW1U9J1qE/Y/Oyaq33w5p2ZWrNNHNEw==}
-    engines: {node: '>=18'}
-    cpu: [loong64]
-    os: [linux]
-
-  '@esbuild/linux-loong64@0.24.2':
-    resolution: {integrity: sha512-CN9AZr8kEndGooS35ntToZLTQLHEjtVB5n7dl8ZcTZMonJ7CCfStrYhrzF97eAecqVbVJ7APOEe18RPI4KLhwQ==}
+  '@esbuild/linux-loong64@0.25.6':
+    resolution: {integrity: sha512-VgKCsHdXRSQ7E1+QXGdRPlQ/e08bN6WMQb27/TMfV+vPjjTImuT9PmLXupRlC90S1JeNNW5lzkAEO/McKeJ2yg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.21.5':
-    resolution: {integrity: sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==}
-    engines: {node: '>=12'}
-    cpu: [mips64el]
-    os: [linux]
-
-  '@esbuild/linux-mips64el@0.23.1':
-    resolution: {integrity: sha512-nrFzzMQ7W4WRLNUOU5dlWAqa6yVeI0P78WKGUo7lg2HShq/yx+UYkeNSE0SSfSure0SqgnsxPvmAUu/vu0E+3Q==}
-    engines: {node: '>=18'}
-    cpu: [mips64el]
-    os: [linux]
-
-  '@esbuild/linux-mips64el@0.24.2':
-    resolution: {integrity: sha512-iMkk7qr/wl3exJATwkISxI7kTcmHKE+BlymIAbHO8xanq/TjHaaVThFF6ipWzPHryoFsesNQJPE/3wFJw4+huw==}
+  '@esbuild/linux-mips64el@0.25.6':
+    resolution: {integrity: sha512-WViNlpivRKT9/py3kCmkHnn44GkGXVdXfdc4drNmRl15zVQ2+D2uFwdlGh6IuK5AAnGTo2qPB1Djppj+t78rzw==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.21.5':
-    resolution: {integrity: sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==}
-    engines: {node: '>=12'}
-    cpu: [ppc64]
-    os: [linux]
-
-  '@esbuild/linux-ppc64@0.23.1':
-    resolution: {integrity: sha512-dKN8fgVqd0vUIjxuJI6P/9SSSe/mB9rvA98CSH2sJnlZ/OCZWO1DJvxj8jvKTfYUdGfcq2dDxoKaC6bHuTlgcw==}
+  '@esbuild/linux-ppc64@0.25.6':
+    resolution: {integrity: sha512-wyYKZ9NTdmAMb5730I38lBqVu6cKl4ZfYXIs31Baf8aoOtB4xSGi3THmDYt4BTFHk7/EcVixkOV2uZfwU3Q2Jw==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.24.2':
-    resolution: {integrity: sha512-shsVrgCZ57Vr2L8mm39kO5PPIb+843FStGt7sGGoqiiWYconSxwTiuswC1VJZLCjNiMLAMh34jg4VSEQb+iEbw==}
+  '@esbuild/linux-riscv64@0.25.6':
+    resolution: {integrity: sha512-KZh7bAGGcrinEj4qzilJ4hqTY3Dg2U82c8bv+e1xqNqZCrCyc+TL9AUEn5WGKDzm3CfC5RODE/qc96OcbIe33w==}
     engines: {node: '>=18'}
-    cpu: [ppc64]
-    os: [linux]
-
-  '@esbuild/linux-riscv64@0.21.5':
-    resolution: {integrity: sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==}
-    engines: {node: '>=12'}
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.23.1':
-    resolution: {integrity: sha512-5AV4Pzp80fhHL83JM6LoA6pTQVWgB1HovMBsLQ9OZWLDqVY8MVobBXNSmAJi//Csh6tcY7e7Lny2Hg1tElMjIA==}
+  '@esbuild/linux-s390x@0.25.6':
+    resolution: {integrity: sha512-9N1LsTwAuE9oj6lHMyyAM+ucxGiVnEqUdp4v7IaMmrwb06ZTEVCIs3oPPplVsnjPfyjmxwHxHMF8b6vzUVAUGw==}
     engines: {node: '>=18'}
-    cpu: [riscv64]
-    os: [linux]
-
-  '@esbuild/linux-riscv64@0.24.2':
-    resolution: {integrity: sha512-4eSFWnU9Hhd68fW16GD0TINewo1L6dRrB+oLNNbYyMUAeOD2yCK5KXGK1GH4qD/kT+bTEXjsyTCiJGHPZ3eM9Q==}
-    engines: {node: '>=18'}
-    cpu: [riscv64]
-    os: [linux]
-
-  '@esbuild/linux-s390x@0.21.5':
-    resolution: {integrity: sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==}
-    engines: {node: '>=12'}
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.23.1':
-    resolution: {integrity: sha512-9ygs73tuFCe6f6m/Tb+9LtYxWR4c9yg7zjt2cYkjDbDpV/xVn+68cQxMXCjUpYwEkze2RcU/rMnfIXNRFmSoDw==}
+  '@esbuild/linux-x64@0.25.6':
+    resolution: {integrity: sha512-A6bJB41b4lKFWRKNrWoP2LHsjVzNiaurf7wyj/XtFNTsnPuxwEBWHLty+ZE0dWBKuSK1fvKgrKaNjBS7qbFKig==}
     engines: {node: '>=18'}
-    cpu: [s390x]
-    os: [linux]
-
-  '@esbuild/linux-s390x@0.24.2':
-    resolution: {integrity: sha512-S0Bh0A53b0YHL2XEXC20bHLuGMOhFDO6GN4b3YjRLK//Ep3ql3erpNcPlEFed93hsQAjAQDNsvcK+hV90FubSw==}
-    engines: {node: '>=18'}
-    cpu: [s390x]
-    os: [linux]
-
-  '@esbuild/linux-x64@0.21.5':
-    resolution: {integrity: sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==}
-    engines: {node: '>=12'}
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/linux-x64@0.23.1':
-    resolution: {integrity: sha512-EV6+ovTsEXCPAp58g2dD68LxoP/wK5pRvgy0J/HxPGB009omFPv3Yet0HiaqvrIrgPTBuC6wCH1LTOY91EO5hQ==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [linux]
-
-  '@esbuild/linux-x64@0.24.2':
-    resolution: {integrity: sha512-8Qi4nQcCTbLnK9WoMjdC9NiTG6/E38RNICU6sUNqK0QFxCYgoARqVqxdFmWkdonVsvGqWhmm7MO0jyTqLqwj0Q==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [linux]
-
-  '@esbuild/netbsd-arm64@0.24.2':
-    resolution: {integrity: sha512-wuLK/VztRRpMt9zyHSazyCVdCXlpHkKm34WUyinD2lzK07FAHTq0KQvZZlXikNWkDGoT6x3TD51jKQ7gMVpopw==}
+  '@esbuild/netbsd-arm64@0.25.6':
+    resolution: {integrity: sha512-IjA+DcwoVpjEvyxZddDqBY+uJ2Snc6duLpjmkXm/v4xuS3H+3FkLZlDm9ZsAbF9rsfP3zeA0/ArNDORZgrxR/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.21.5':
-    resolution: {integrity: sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [netbsd]
-
-  '@esbuild/netbsd-x64@0.23.1':
-    resolution: {integrity: sha512-aevEkCNu7KlPRpYLjwmdcuNz6bDFiE7Z8XC4CPqExjTvrHugh28QzUXVOZtiYghciKUacNktqxdpymplil1beA==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [netbsd]
-
-  '@esbuild/netbsd-x64@0.24.2':
-    resolution: {integrity: sha512-VefFaQUc4FMmJuAxmIHgUmfNiLXY438XrL4GDNV1Y1H/RW3qow68xTwjZKfj/+Plp9NANmzbH5R40Meudu8mmw==}
+  '@esbuild/netbsd-x64@0.25.6':
+    resolution: {integrity: sha512-dUXuZr5WenIDlMHdMkvDc1FAu4xdWixTCRgP7RQLBOkkGgwuuzaGSYcOpW4jFxzpzL1ejb8yF620UxAqnBrR9g==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/openbsd-arm64@0.23.1':
-    resolution: {integrity: sha512-3x37szhLexNA4bXhLrCC/LImN/YtWis6WXr1VESlfVtVeoFJBRINPJ3f0a/6LV8zpikqoUg4hyXw0sFBt5Cr+Q==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [openbsd]
-
-  '@esbuild/openbsd-arm64@0.24.2':
-    resolution: {integrity: sha512-YQbi46SBct6iKnszhSvdluqDmxCJA+Pu280Av9WICNwQmMxV7nLRHZfjQzwbPs3jeWnuAhE9Jy0NrnJ12Oz+0A==}
+  '@esbuild/openbsd-arm64@0.25.6':
+    resolution: {integrity: sha512-l8ZCvXP0tbTJ3iaqdNf3pjaOSd5ex/e6/omLIQCVBLmHTlfXW3zAxQ4fnDmPLOB1x9xrcSi/xtCWFwCZRIaEwg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.21.5':
-    resolution: {integrity: sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [openbsd]
-
-  '@esbuild/openbsd-x64@0.23.1':
-    resolution: {integrity: sha512-aY2gMmKmPhxfU+0EdnN+XNtGbjfQgwZj43k8G3fyrDM/UdZww6xrWxmDkuz2eCZchqVeABjV5BpildOrUbBTqA==}
+  '@esbuild/openbsd-x64@0.25.6':
+    resolution: {integrity: sha512-hKrmDa0aOFOr71KQ/19JC7az1P0GWtCN1t2ahYAf4O007DHZt/dW8ym5+CUdJhQ/qkZmI1HAF8KkJbEFtCL7gw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.24.2':
-    resolution: {integrity: sha512-+iDS6zpNM6EnJyWv0bMGLWSWeXGN/HTaF/LXHXHwejGsVi+ooqDfMCCTerNFxEkM3wYVcExkeGXNqshc9iMaOA==}
+  '@esbuild/openharmony-arm64@0.25.6':
+    resolution: {integrity: sha512-+SqBcAWoB1fYKmpWoQP4pGtx+pUUC//RNYhFdbcSA16617cchuryuhOCRpPsjCblKukAckWsV+aQ3UKT/RMPcA==}
     engines: {node: '>=18'}
-    cpu: [x64]
-    os: [openbsd]
-
-  '@esbuild/sunos-x64@0.21.5':
-    resolution: {integrity: sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==}
-    engines: {node: '>=12'}
-    cpu: [x64]
-    os: [sunos]
-
-  '@esbuild/sunos-x64@0.23.1':
-    resolution: {integrity: sha512-RBRT2gqEl0IKQABT4XTj78tpk9v7ehp+mazn2HbUeZl1YMdaGAQqhapjGTCe7uw7y0frDi4gS0uHzhvpFuI1sA==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [sunos]
+    cpu: [arm64]
+    os: [openharmony]
 
-  '@esbuild/sunos-x64@0.24.2':
-    resolution: {integrity: sha512-hTdsW27jcktEvpwNHJU4ZwWFGkz2zRJUz8pvddmXPtXDzVKTTINmlmga3ZzwcuMpUvLw7JkLy9QLKyGpD2Yxig==}
+  '@esbuild/sunos-x64@0.25.6':
+    resolution: {integrity: sha512-dyCGxv1/Br7MiSC42qinGL8KkG4kX0pEsdb0+TKhmJZgCUDBGmyo1/ArCjNGiOLiIAgdbWgmWgib4HoCi5t7kA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/win32-arm64@0.21.5':
-    resolution: {integrity: sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==}
-    engines: {node: '>=12'}
-    cpu: [arm64]
-    os: [win32]
-
-  '@esbuild/win32-arm64@0.23.1':
-    resolution: {integrity: sha512-4O+gPR5rEBe2FpKOVyiJ7wNDPA8nGzDuJ6gN4okSA1gEOYZ67N8JPk58tkWtdtPeLz7lBnY6I5L3jdsr3S+A6A==}
+  '@esbuild/win32-arm64@0.25.6':
+    resolution: {integrity: sha512-42QOgcZeZOvXfsCBJF5Afw73t4veOId//XD3i+/9gSkhSV6Gk3VPlWncctI+JcOyERv85FUo7RxuxGy+z8A43Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-arm64@0.24.2':
-    resolution: {integrity: sha512-LihEQ2BBKVFLOC9ZItT9iFprsE9tqjDjnbulhHoFxYQtQfai7qfluVODIYxt1PgdoyQkz23+01rzwNwYfutxUQ==}
-    engines: {node: '>=18'}
-    cpu: [arm64]
-    os: [win32]
-
-  '@esbuild/win32-ia32@0.21.5':
-    resolution: {integrity: sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==}
-    engines: {node: '>=12'}
-    cpu: [ia32]
-    os: [win32]
-
-  '@esbuild/win32-ia32@0.23.1':
-    resolution: {integrity: sha512-BcaL0Vn6QwCwre3Y717nVHZbAa4UBEigzFm6VdsVdT/MbZ38xoj1X9HPkZhbmaBGUD1W8vxAfffbDe8bA6AKnQ==}
+  '@esbuild/win32-ia32@0.25.6':
+    resolution: {integrity: sha512-4AWhgXmDuYN7rJI6ORB+uU9DHLq/erBbuMoAuB4VWJTu5KtCgcKYPynF0YI1VkBNuEfjNlLrFr9KZPJzrtLkrQ==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.24.2':
-    resolution: {integrity: sha512-q+iGUwfs8tncmFC9pcnD5IvRHAzmbwQ3GPS5/ceCyHdjXubwQWI12MKWSNSMYLJMq23/IUCvJMS76PDqXe1fxA==}
+  '@esbuild/win32-x64@0.25.6':
+    resolution: {integrity: sha512-NgJPHHbEpLQgDH2MjQu90pzW/5vvXIZ7KOnPyNBm92A6WgZ/7b6fJyUBjoumLqeOQQGqY2QjQxRo97ah4Sj0cA==}
     engines: {node: '>=18'}
-    cpu: [ia32]
-    os: [win32]
-
-  '@esbuild/win32-x64@0.21.5':
-    resolution: {integrity: sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==}
-    engines: {node: '>=12'}
     cpu: [x64]
     os: [win32]
 
-  '@esbuild/win32-x64@0.23.1':
-    resolution: {integrity: sha512-BHpFFeslkWrXWyUPnbKm+xYYVYruCinGcftSBaa8zoF9hZO4BcSCFUvHVTtzpIY6YzUnYtuEhZ+C9iEXjxnasg==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [win32]
-
-  '@esbuild/win32-x64@0.24.2':
-    resolution: {integrity: sha512-7VTgWzgMGvup6aSqDPLiW5zHaxYJGTO4OokMjIlrCtf+VpEL+cXKtCvg723iguPYI5oaUNdS+/V7OU2gvXVWEg==}
-    engines: {node: '>=18'}
-    cpu: [x64]
-    os: [win32]
-
-  '@eslint-community/eslint-utils@4.4.1':
-    resolution: {integrity: sha512-s3O3waFUrMV8P/XaF/+ZTp1X9XBZW1a4B97ZnjQF2KYWaFD2A8KyFBsrsfSjEmjn3RGWAIuvlneuZm3CUK3jbA==}
+  '@eslint-community/eslint-utils@4.7.0':
+    resolution: {integrity: sha512-dyybb3AcajC7uha6CvhdVRJqaKyn7w2YKqKyAN37NKYgZT36w+iRb0Dymmc5qEJ549c/S31cMMSFd75bteCpCw==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
@@ -1172,46 +891,50 @@ packages:
     resolution: {integrity: sha512-CCZCDJuduB9OUkFkY2IgppNZMi2lBQgD2qzwXkEia16cge2pijY/aXi96CJMquDMn3nJdlPV1A5KrJEXwfLNzQ==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
-  '@eslint/compat@1.2.5':
-    resolution: {integrity: sha512-5iuG/StT+7OfvhoBHPlmxkPA9om6aDUFgmD4+mWKAGsYt4vCe8rypneG03AuseyRHBmcCLXQtIH5S26tIoggLg==}
+  '@eslint/compat@1.3.1':
+    resolution: {integrity: sha512-k8MHony59I5EPic6EQTCNOuPoVBnoYXkP+20xvwFjN7t0qI3ImyvyBgg+hIVPwC8JaxVjjUZld+cLfBLFDLucg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      eslint: ^9.10.0
+      eslint: ^8.40 || 9
     peerDependenciesMeta:
       eslint:
         optional: true
 
-  '@eslint/config-array@0.19.0':
-    resolution: {integrity: sha512-zdHg2FPIFNKPdcHWtiNT+jEFCHYVplAXRDlQDyqy0zGx/q2parwh7brGJSiTxRk/TSMkbM//zt/f5CHgyTyaSQ==}
+  '@eslint/config-array@0.21.0':
+    resolution: {integrity: sha512-ENIdc4iLu0d93HeYirvKmrzshzofPw6VkZRKQGe9Nv46ZnWUzcF1xV01dcvEg/1wXUR61OmmlSfyeyO7EvjLxQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/core@0.10.0':
-    resolution: {integrity: sha512-gFHJ+xBOo4G3WRlR1e/3G8A6/KZAH6zcE/hkLRCZTi/B9avAG365QhFA8uOGzTMqgTghpn7/fSnscW++dpMSAw==}
+  '@eslint/config-helpers@0.3.0':
+    resolution: {integrity: sha512-ViuymvFmcJi04qdZeDc2whTHryouGcDlaxPqarTD0ZE10ISpxGUVZGZDx4w01upyIynL3iu6IXH2bS1NhclQMw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/eslintrc@3.2.0':
-    resolution: {integrity: sha512-grOjVNN8P3hjJn/eIETF1wwd12DdnwFDoyceUJLYYdkpbwq3nLi+4fqrTAONx7XDALqlL220wC/RHSC/QTI/0w==}
+  '@eslint/core@0.14.0':
+    resolution: {integrity: sha512-qIbV0/JZr7iSDjqAc60IqbLdsj9GDt16xQtWD+B78d/HAlvysGdZZ6rpJHGAc2T0FQx1X6thsSPdnoiGKdNtdg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/js@9.18.0':
-    resolution: {integrity: sha512-fK6L7rxcq6/z+AaQMtiFTkvbHkBLNlwyRxHpKawP0x3u9+NC6MQTnFW+AdpwC6gfHTW0051cokQgtTN2FqlxQA==}
+  '@eslint/core@0.15.1':
+    resolution: {integrity: sha512-bkOp+iumZCCbt1K1CmWf0R9pM5yKpDv+ZXtvSyQpudrI9kuFLp+bM2WOPXImuD/ceQuaa8f5pj93Y7zyECIGNA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/object-schema@2.1.4':
-    resolution: {integrity: sha512-BsWiH1yFGjXXS2yvrf5LyuoSIIbPrGUWob917o+BTKuZ7qJdxX8aJLRxs1fS9n6r7vESrq1OUqb68dANcFXuQQ==}
+  '@eslint/eslintrc@3.3.1':
+    resolution: {integrity: sha512-gtF186CXhIl1p4pJNGZw8Yc6RlshoePRvE0X91oPGb3vZ8pM3qOS9W9NGPat9LziaBV7XrJWGylNQXkGcnM3IQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/plugin-kit@0.2.5':
-    resolution: {integrity: sha512-lB05FkqEdUg2AA0xEbUz0SnkXT1LcCTa438W4IWTUh4hdOnVbQyOJ81OrDXsJk/LSiJHubgGEFoR5EHq1NsH1A==}
+  '@eslint/js@9.30.1':
+    resolution: {integrity: sha512-zXhuECFlyep42KZUhWjfvsmXGX39W8K8LFb8AWXM9gSV9dQB+MrJGLKvW6Zw0Ggnbpw0VHTtrhFXYe3Gym18jg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@faker-js/faker@9.3.0':
-    resolution: {integrity: sha512-r0tJ3ZOkMd9xsu3VRfqlFR6cz0V/jFYRswAIpC+m/DIfAUXq7g8N7wTAlhSANySXYGKzGryfDXwtwsY8TxEIDw==}
-    engines: {node: '>=18.0.0', npm: '>=9.0.0'}
+  '@eslint/object-schema@2.1.6':
+    resolution: {integrity: sha512-RBMg5FRL0I0gs51M/guSAj5/e14VQ4tpZnQNWwuDT66P14I43ItmPfIZRhO9fUVIPOAQXU47atlywZ/czoqFPA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@fastify/busboy@2.1.1':
-    resolution: {integrity: sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==}
-    engines: {node: '>=14'}
+  '@eslint/plugin-kit@0.3.3':
+    resolution: {integrity: sha512-1+WqvgNMhmlAambTvT3KPtCl/Ibr68VldY2XY40SL1CE0ZXiakFR/cbTspaF5HsnpDMvcYYoJHfl4980NBjGag==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@faker-js/faker@9.9.0':
+    resolution: {integrity: sha512-OEl393iCOoo/z8bMezRlJu+GlRGlsKbUAN7jKB6LhnKoqKve5DXRpalbItIIcwnCjs1k/FOPjFzcA6Qn+H+YbA==}
+    engines: {node: '>=18.0.0', npm: '>=9.0.0'}
 
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
@@ -1229,16 +952,16 @@ packages:
     resolution: {integrity: sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==}
     engines: {node: '>=18.18'}
 
-  '@humanwhocodes/retry@0.4.1':
-    resolution: {integrity: sha512-c7hNEllBlenFTHBky65mhq8WD2kbN9Q6gk0bTk8lSBvc554jpXSkST1iePudpt7+A/AQvuHs9EMqjHDXMY1lrA==}
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
 
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
 
-  '@jridgewell/gen-mapping@0.3.5':
-    resolution: {integrity: sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==}
+  '@jridgewell/gen-mapping@0.3.8':
+    resolution: {integrity: sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA==}
     engines: {node: '>=6.0.0'}
 
   '@jridgewell/resolve-uri@3.1.2':
@@ -1270,11 +993,11 @@ packages:
   '@kwsites/promise-deferred@1.1.1':
     resolution: {integrity: sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==}
 
-  '@microsoft/api-extractor-model@7.30.2':
-    resolution: {integrity: sha512-3/t2F+WhkJgBzSNwlkTIL0tBgUoBqDqL66pT+nh2mPbM0NIDGVGtpqbGWPgHIzn/mn7kGS/Ep8D8po58e8UUIw==}
+  '@microsoft/api-extractor-model@7.30.6':
+    resolution: {integrity: sha512-znmFn69wf/AIrwHya3fxX6uB5etSIn6vg4Q4RB/tb5VDDs1rqREc+AvMC/p19MUN13CZ7+V/8pkYPTj7q8tftg==}
 
-  '@microsoft/api-extractor@7.49.1':
-    resolution: {integrity: sha512-jRTR/XbQF2kb+dYn8hfYSicOGA99+Fo00GrsdMwdfE3eIgLtKdH6Qa2M3wZV9S2XmbgCaGX1OdPtYctbfu5jQg==}
+  '@microsoft/api-extractor@7.52.8':
+    resolution: {integrity: sha512-cszYIcjiNscDoMB1CIKZ3My61+JOhpERGlGr54i6bocvGLrcL/wo9o+RNXMBrb7XgLtKaizZWUpqRduQuHQLdg==}
     hasBin: true
 
   '@microsoft/tsdoc-config@0.17.1':
@@ -1283,8 +1006,8 @@ packages:
   '@microsoft/tsdoc@0.15.1':
     resolution: {integrity: sha512-4aErSrCR/On/e5G2hDP0wjooqDdauzEbIq8hIkIe5pXV0rtWJZvdCEKL0ykZxex+IxIwBp0eGeV48hQN07dXtw==}
 
-  '@noble/hashes@1.7.0':
-    resolution: {integrity: sha512-HXydb0DgzTpDPwbVeDGCG1gIu7X6+AuU6Zl6av/E/KG8LMsvPntvq+w17CHRpKBmN6Ybdrt1eP3k4cj8DJa78w==}
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
     engines: {node: ^14.21.3 || >=16}
 
   '@nodelib/fs.scandir@2.1.5':
@@ -1299,57 +1022,57 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@octokit/auth-token@5.1.1':
-    resolution: {integrity: sha512-rh3G3wDO8J9wSjfI436JUKzHIxq8NaiL0tVeB2aXmG6p/9859aUOAjA9pmSPNGGZxfwmaJ9ozOJImuNVJdpvbA==}
-    engines: {node: '>= 18'}
+  '@octokit/auth-token@6.0.0':
+    resolution: {integrity: sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==}
+    engines: {node: '>= 20'}
 
-  '@octokit/core@6.1.3':
-    resolution: {integrity: sha512-z+j7DixNnfpdToYsOutStDgeRzJSMnbj8T1C/oQjB6Aa+kRfNjs/Fn7W6c8bmlt6mfy3FkgeKBRnDjxQow5dow==}
-    engines: {node: '>= 18'}
+  '@octokit/core@7.0.2':
+    resolution: {integrity: sha512-ODsoD39Lq6vR6aBgvjTnA3nZGliknKboc9Gtxr7E4WDNqY24MxANKcuDQSF0jzapvGb3KWOEDrKfve4HoWGK+g==}
+    engines: {node: '>= 20'}
 
-  '@octokit/endpoint@10.1.1':
-    resolution: {integrity: sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==}
-    engines: {node: '>= 18'}
+  '@octokit/endpoint@11.0.0':
+    resolution: {integrity: sha512-hoYicJZaqISMAI3JfaDr1qMNi48OctWuOih1m80bkYow/ayPw6Jj52tqWJ6GEoFTk1gBqfanSoI1iY99Z5+ekQ==}
+    engines: {node: '>= 20'}
 
-  '@octokit/graphql@8.1.2':
-    resolution: {integrity: sha512-bdlj/CJVjpaz06NBpfHhp4kGJaRZfz7AzC+6EwUImRtrwIw8dIgJ63Xg0OzV9pRn3rIzrt5c2sa++BL0JJ8GLw==}
-    engines: {node: '>= 18'}
+  '@octokit/graphql@9.0.1':
+    resolution: {integrity: sha512-j1nQNU1ZxNFx2ZtKmL4sMrs4egy5h65OMDmSbVyuCzjOcwsHq6EaYjOTGXPQxgfiN8dJ4CriYHk6zF050WEULg==}
+    engines: {node: '>= 20'}
 
-  '@octokit/openapi-types@23.0.1':
-    resolution: {integrity: sha512-izFjMJ1sir0jn0ldEKhZ7xegCTj/ObmEDlEfpFrx4k/JyZSMRHbO3/rBwgE7f3m2DHt+RrNGIVw4wSmwnm3t/g==}
+  '@octokit/openapi-types@25.1.0':
+    resolution: {integrity: sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==}
 
-  '@octokit/plugin-paginate-rest@11.4.0':
-    resolution: {integrity: sha512-ttpGck5AYWkwMkMazNCZMqxKqIq1fJBNxBfsFwwfyYKTf914jKkLF0POMS3YkPBwp5g1c2Y4L79gDz01GhSr1g==}
-    engines: {node: '>= 18'}
+  '@octokit/plugin-paginate-rest@13.0.1':
+    resolution: {integrity: sha512-m1KvHlueScy4mQJWvFDCxFBTIdXS0K1SgFGLmqHyX90mZdCIv6gWBbKRhatxRjhGlONuTK/hztYdaqrTXcFZdQ==}
+    engines: {node: '>= 20'}
     peerDependencies:
       '@octokit/core': '>=6'
 
-  '@octokit/plugin-request-log@5.3.1':
-    resolution: {integrity: sha512-n/lNeCtq+9ofhC15xzmJCNKP2BWTv8Ih2TTy+jatNCCq/gQP/V7rK3fjIfuz0pDWDALO/o/4QY4hyOF6TQQFUw==}
-    engines: {node: '>= 18'}
+  '@octokit/plugin-request-log@6.0.0':
+    resolution: {integrity: sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==}
+    engines: {node: '>= 20'}
     peerDependencies:
       '@octokit/core': '>=6'
 
-  '@octokit/plugin-rest-endpoint-methods@13.3.0':
-    resolution: {integrity: sha512-LUm44shlmkp/6VC+qQgHl3W5vzUP99ZM54zH6BuqkJK4DqfFLhegANd+fM4YRLapTvPm4049iG7F3haANKMYvQ==}
-    engines: {node: '>= 18'}
+  '@octokit/plugin-rest-endpoint-methods@16.0.0':
+    resolution: {integrity: sha512-kJVUQk6/dx/gRNLWUnAWKFs1kVPn5O5CYZyssyEoNYaFedqZxsfYs7DwI3d67hGz4qOwaJ1dpm07hOAD1BXx6g==}
+    engines: {node: '>= 20'}
     peerDependencies:
       '@octokit/core': '>=6'
 
-  '@octokit/request-error@6.1.6':
-    resolution: {integrity: sha512-pqnVKYo/at0NuOjinrgcQYpEbv4snvP3bKMRqHaD9kIsk9u1LCpb2smHZi8/qJfgeNqLo5hNW4Z7FezNdEo0xg==}
-    engines: {node: '>= 18'}
+  '@octokit/request-error@7.0.0':
+    resolution: {integrity: sha512-KRA7VTGdVyJlh0cP5Tf94hTiYVVqmt2f3I6mnimmaVz4UG3gQV/k4mDJlJv3X67iX6rmN7gSHCF8ssqeMnmhZg==}
+    engines: {node: '>= 20'}
 
-  '@octokit/request@9.1.4':
-    resolution: {integrity: sha512-tMbOwGm6wDII6vygP3wUVqFTw3Aoo0FnVQyhihh8vVq12uO3P+vQZeo2CKMpWtPSogpACD0yyZAlVlQnjW71DA==}
-    engines: {node: '>= 18'}
+  '@octokit/request@10.0.2':
+    resolution: {integrity: sha512-iYj4SJG/2bbhh+iIpFmG5u49DtJ4lipQ+aPakjL9OKpsGY93wM8w06gvFbEQxcMsZcCvk5th5KkIm2m8o14aWA==}
+    engines: {node: '>= 20'}
 
-  '@octokit/rest@21.1.0':
-    resolution: {integrity: sha512-93iLxcKDJboUpmnUyeJ6cRIi7z7cqTZT1K7kRK4LobGxwTwpsa+2tQQbRQNGy7IFDEAmrtkf4F4wBj3D5rVlJQ==}
-    engines: {node: '>= 18'}
+  '@octokit/rest@22.0.0':
+    resolution: {integrity: sha512-z6tmTu9BTnw51jYGulxrlernpsQYXpui1RK21vmXn8yF5bp6iX16yfTtJYGK5Mh1qDkvDOmp2n8sRMcQmR8jiA==}
+    engines: {node: '>= 20'}
 
-  '@octokit/types@13.7.0':
-    resolution: {integrity: sha512-BXfRP+3P3IN6fd4uF3SniaHKOO4UXWBfkdR3vA8mIvaoO/wLjGN5qivUtW0QRitBHHMcfC41SLhNVYIZZE+wkA==}
+  '@octokit/types@14.1.0':
+    resolution: {integrity: sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==}
 
   '@patternfly/patternfly@4.224.5':
     resolution: {integrity: sha512-io0huj+LCP5FgDZJDaLv1snxktTYs8iCFz/W1VDRneYoebNHLmGfQdF7Yn8bS6PF7qmN6oJKEBlq3AjmmE8vdA==}
@@ -1357,14 +1080,8 @@ packages:
   '@patternfly/patternfly@5.4.2':
     resolution: {integrity: sha512-+BaokNR8/AmTYMESxby9UtQXPGACg449BXQd0KejAvW/uGxlgO6mY1X1205DeBEHoK3e/vXkYXjvZPpv/tcxSA==}
 
-  '@patternfly/react-core@5.4.10':
-    resolution: {integrity: sha512-lThdXKqHc9sN5AqPskZa1YmUmSwbjdkaT8neTCdMjfnBaBanYCmSCNUMYUsoB0L/2siu2Vlcp12RRaG5hZeN2g==}
-    peerDependencies:
-      react: ^17 || ^18
-      react-dom: ^17 || ^18
-
-  '@patternfly/react-core@5.4.12':
-    resolution: {integrity: sha512-RI1xS1JGJdE/FvpkMzawaE21oeTc/e+WbxvFXqZfLhTz60P8RzVG1nYWXDL747Onkz3SYtY79PhQ8nsLeO5sJQ==}
+  '@patternfly/react-core@5.4.14':
+    resolution: {integrity: sha512-oXVMzLs9Pa+xmdc39L2u05zbXfY3mWuOFi4GDv44GPdDexZUFy5W69+Nv5P8cwfMim55Nf5kKYpcqmatD2bBXw==}
     peerDependencies:
       react: ^17 || ^18
       react-dom: ^17 || ^18
@@ -1378,8 +1095,8 @@ packages:
   '@patternfly/react-styles@5.4.1':
     resolution: {integrity: sha512-XA8PXksD8uiA3RTwxdUwJXOCf+V6sVd+2HKapWAdRLvtSV+Sdk7NgCvalb4IAQncsddLopjPQD8gAHA298+N8w==}
 
-  '@patternfly/react-table@5.4.13':
-    resolution: {integrity: sha512-cYw+pgpZXKGg3dZxudteUURqmj5O0ec7aNE80NLqFTcnI0MAOnfrFzCNApXJErn+MjD0VolMcC+H48eaRkT8TA==}
+  '@patternfly/react-table@5.4.16':
+    resolution: {integrity: sha512-K/xNdTvFKFyD6WhuBU/GCq/3LTrSaObdXSTmzefWWcPcN0gcf/J3ouiuapj951JIsP13CMmwJBNtEa3aHR8igg==}
     peerDependencies:
       react: ^17 || ^18
       react-dom: ^17 || ^18
@@ -1391,12 +1108,12 @@ packages:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
     engines: {node: '>=14'}
 
-  '@pkgr/core@0.1.1':
-    resolution: {integrity: sha512-cq8o4cWH0ibXh9VGi5P20Tu9XF/0fFXl9EUinr9QfTM7a7p0oTA4iJRCQWppXR1Pg8dSM0UCItCkPwsk9qWWYA==}
+  '@pkgr/core@0.2.7':
+    resolution: {integrity: sha512-YLT9Zo3oNPJoBjBc4q8G2mjU4tqIbf5CEOORbUUr48dCD9q3umJ3IPlVqOqDakPfd2HuwccBaqlGhN4Gmr5OWg==}
     engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
 
-  '@playwright/test@1.49.1':
-    resolution: {integrity: sha512-Ky+BVzPz8pL6PQxHqNRW1k3mIyv933LML7HktS8uik0bUXNCdPhoS/kLihiO1tMf/egaJb4IutXd7UywvXEW+g==}
+  '@playwright/test@1.53.2':
+    resolution: {integrity: sha512-tEB2U5z74ebBeyfGNZ3Jfg29AnW+5HlWhvHtb/Mqco9pFdZU1ZLNdVb2UtB5CvmiilNr2ZfVH/qMmAROG/XTzw==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -1436,12 +1153,15 @@ packages:
       react: '>=17'
       react-dom: '>=17'
 
-  '@remix-run/router@1.21.0':
-    resolution: {integrity: sha512-xfSkCAchbdG5PnbrKqFWwia4Bi61nH+wm8wLEqfHDyp7Y3dZzgqS2itV8i4gAq9pC2HsTpwyBC6Ds8VHZ96JlA==}
+  '@remix-run/router@1.23.0':
+    resolution: {integrity: sha512-O3rHJzAQKamUz1fvE0Qaw0xSFqsA/yafi2iqeE0pvdFtCO1viYx8QL6f3Ln/aCCTLxs68SLf0KPM9eSeM8yBnA==}
     engines: {node: '>=14.0.0'}
 
-  '@rollup/plugin-commonjs@28.0.2':
-    resolution: {integrity: sha512-BEFI2EDqzl+vA1rl97IDRZ61AIwGH093d9nz8+dThxJNH8oSoB7MjWvPCX3dkaK1/RCJ/1v/R1XB15FuSs0fQw==}
+  '@rolldown/pluginutils@1.0.0-beta.11':
+    resolution: {integrity: sha512-L/gAA/hyCSuzTF1ftlzUSI/IKr2POHsv1Dd78GfqkR83KMNuswWD61JxGV2L7nRwBBBSDr6R1gCkdTmoN7W4ag==}
+
+  '@rollup/plugin-commonjs@28.0.6':
+    resolution: {integrity: sha512-XSQB1K7FUU5QP+3lOQmVCE3I0FcbbNvmNT4VJSj93iUjayaARrTQeoRdiYQoftAJBLrR9t2agwAd3ekaTgHNlw==}
     engines: {node: '>=16.0.0 || 14 >= 14.17'}
     peerDependencies:
       rollup: ^2.68.0||^3.0.0||^4.0.0
@@ -1449,8 +1169,8 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/plugin-node-resolve@16.0.0':
-    resolution: {integrity: sha512-0FPvAeVUT/zdWoO0jnb/V5BlBsUSNfkIOtFHzMO4H9MOklrmQFY6FduVHKucNb/aTFxvnGhj4MNj/T1oNdDfNg==}
+  '@rollup/plugin-node-resolve@16.0.1':
+    resolution: {integrity: sha512-tk5YCxJWIG81umIvNkSod2qK5KyQW19qcBF/B78n1bjtOON6gzKoVeSzAE8yHCZEDmqkHKkxplExA8KzdJLJpA==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       rollup: ^2.78.0||^3.0.0||^4.0.0
@@ -1476,8 +1196,8 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/pluginutils@5.1.3':
-    resolution: {integrity: sha512-Pnsb6f32CD2W3uCaLZIzDmeFyQ2b8UWMFI7xtwUezpcGBDVDW6y9XgAWIlARiGAo6eNF5FK5aQTr0LFyNyqq5A==}
+  '@rollup/pluginutils@5.1.4':
+    resolution: {integrity: sha512-USm05zrsFxYLPdWWq+K3STlWiT/3ELn3RcV5hJMghpeAIhxfsUIg6mt12CBJBInWMV4VneoV7SfGv8xIwo2qNQ==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
@@ -1485,8 +1205,8 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/pluginutils@5.1.4':
-    resolution: {integrity: sha512-USm05zrsFxYLPdWWq+K3STlWiT/3ELn3RcV5hJMghpeAIhxfsUIg6mt12CBJBInWMV4VneoV7SfGv8xIwo2qNQ==}
+  '@rollup/pluginutils@5.2.0':
+    resolution: {integrity: sha512-qWJ2ZTbmumwiLFomfzTyt5Kng4hwPi9rwCYN4SHb6eaRU1KNO4ccxINHr/VhH4GgPlt1XfSTLX2LBTme8ne4Zw==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
@@ -1494,198 +1214,108 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.30.0':
-    resolution: {integrity: sha512-qFcFto9figFLz2g25DxJ1WWL9+c91fTxnGuwhToCl8BaqDsDYMl/kOnBXAyAqkkzAWimYMSWNPWEjt+ADAHuoQ==}
+  '@rollup/rollup-android-arm-eabi@4.44.2':
+    resolution: {integrity: sha512-g0dF8P1e2QYPOj1gu7s/3LVP6kze9A7m6x0BZ9iTdXK8N5c2V7cpBKHV3/9A4Zd8xxavdhK0t4PnqjkqVmUc9Q==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm-eabi@4.30.1':
-    resolution: {integrity: sha512-pSWY+EVt3rJ9fQ3IqlrEUtXh3cGqGtPDH1FQlNZehO2yYxCHEX1SPsz1M//NXwYfbTlcKr9WObLnJX9FsS9K1Q==}
-    cpu: [arm]
-    os: [android]
-
-  '@rollup/rollup-android-arm64@4.30.0':
-    resolution: {integrity: sha512-vqrQdusvVl7dthqNjWCL043qelBK+gv9v3ZiqdxgaJvmZyIAAXMjeGVSqZynKq69T7062T5VrVTuikKSAAVP6A==}
-    cpu: [arm64]
-    os: [android]
-
-  '@rollup/rollup-android-arm64@4.30.1':
-    resolution: {integrity: sha512-/NA2qXxE3D/BRjOJM8wQblmArQq1YoBVJjrjoTSBS09jgUisq7bqxNHJ8kjCHeV21W/9WDGwJEWSN0KQ2mtD/w==}
+  '@rollup/rollup-android-arm64@4.44.2':
+    resolution: {integrity: sha512-Yt5MKrOosSbSaAK5Y4J+vSiID57sOvpBNBR6K7xAaQvk3MkcNVV0f9fE20T+41WYN8hDn6SGFlFrKudtx4EoxA==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.30.0':
-    resolution: {integrity: sha512-617pd92LhdA9+wpixnzsyhVft3szYiN16aNUMzVkf2N+yAk8UXY226Bfp36LvxYTUt7MO/ycqGFjQgJ0wlMaWQ==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@rollup/rollup-darwin-arm64@4.30.1':
-    resolution: {integrity: sha512-r7FQIXD7gB0WJ5mokTUgUWPl0eYIH0wnxqeSAhuIwvnnpjdVB8cRRClyKLQr7lgzjctkbp5KmswWszlwYln03Q==}
+  '@rollup/rollup-darwin-arm64@4.44.2':
+    resolution: {integrity: sha512-EsnFot9ZieM35YNA26nhbLTJBHD0jTwWpPwmRVDzjylQT6gkar+zenfb8mHxWpRrbn+WytRRjE0WKsfaxBkVUA==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.30.0':
-    resolution: {integrity: sha512-Y3b4oDoaEhCypg8ajPqigKDcpi5ZZovemQl9Edpem0uNv6UUjXv7iySBpGIUTSs2ovWOzYpfw9EbFJXF/fJHWw==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@rollup/rollup-darwin-x64@4.30.1':
-    resolution: {integrity: sha512-x78BavIwSH6sqfP2xeI1hd1GpHL8J4W2BXcVM/5KYKoAD3nNsfitQhvWSw+TFtQTLZ9OmlF+FEInEHyubut2OA==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@rollup/rollup-freebsd-arm64@4.30.0':
-    resolution: {integrity: sha512-3REQJ4f90sFIBfa0BUokiCdrV/E4uIjhkWe1bMgCkhFXbf4D8YN6C4zwJL881GM818qVYE9BO3dGwjKhpo2ABA==}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@rollup/rollup-freebsd-arm64@4.30.1':
-    resolution: {integrity: sha512-HYTlUAjbO1z8ywxsDFWADfTRfTIIy/oUlfIDmlHYmjUP2QRDTzBuWXc9O4CXM+bo9qfiCclmHk1x4ogBjOUpUQ==}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@rollup/rollup-freebsd-x64@4.30.0':
-    resolution: {integrity: sha512-ZtY3Y8icbe3Cc+uQicsXG5L+CRGUfLZjW6j2gn5ikpltt3Whqjfo5mkyZ86UiuHF9Q3ZsaQeW7YswlHnN+lAcg==}
+  '@rollup/rollup-darwin-x64@4.44.2':
+    resolution: {integrity: sha512-dv/t1t1RkCvJdWWxQ2lWOO+b7cMsVw5YFaS04oHpZRWehI1h0fV1gF4wgGCTyQHHjJDfbNpwOi6PXEafRBBezw==}
     cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.44.2':
+    resolution: {integrity: sha512-W4tt4BLorKND4qeHElxDoim0+BsprFTwb+vriVQnFFtT/P6v/xO5I99xvYnVzKWrK6j7Hb0yp3x7V5LUbaeOMg==}
+    cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.30.1':
-    resolution: {integrity: sha512-1MEdGqogQLccphhX5myCJqeGNYTNcmTyaic9S7CG3JhwuIByJ7J05vGbZxsizQthP1xpVx7kd3o31eOogfEirw==}
+  '@rollup/rollup-freebsd-x64@4.44.2':
+    resolution: {integrity: sha512-tdT1PHopokkuBVyHjvYehnIe20fxibxFCEhQP/96MDSOcyjM/shlTkZZLOufV3qO6/FQOSiJTBebhVc12JyPTA==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.30.0':
-    resolution: {integrity: sha512-bsPGGzfiHXMhQGuFGpmo2PyTwcrh2otL6ycSZAFTESviUoBOuxF7iBbAL5IJXc/69peXl5rAtbewBFeASZ9O0g==}
-    cpu: [arm]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm-gnueabihf@4.30.1':
-    resolution: {integrity: sha512-PaMRNBSqCx7K3Wc9QZkFx5+CX27WFpAMxJNiYGAXfmMIKC7jstlr32UhTgK6T07OtqR+wYlWm9IxzennjnvdJg==}
-    cpu: [arm]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm-musleabihf@4.30.0':
-    resolution: {integrity: sha512-kvyIECEhs2DrrdfQf++maCWJIQ974EI4txlz1nNSBaCdtf7i5Xf1AQCEJWOC5rEBisdaMFFnOWNLYt7KpFqy5A==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.44.2':
+    resolution: {integrity: sha512-+xmiDGGaSfIIOXMzkhJ++Oa0Gwvl9oXUeIiwarsdRXSe27HUIvjbSIpPxvnNsRebsNdUo7uAiQVgBD1hVriwSQ==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.30.1':
-    resolution: {integrity: sha512-B8Rcyj9AV7ZlEFqvB5BubG5iO6ANDsRKlhIxySXcF1axXYUyqwBok+XZPgIYGBgs7LDXfWfifxhw0Ik57T0Yug==}
+  '@rollup/rollup-linux-arm-musleabihf@4.44.2':
+    resolution: {integrity: sha512-bDHvhzOfORk3wt8yxIra8N4k/N0MnKInCW5OGZaeDYa/hMrdPaJzo7CSkjKZqX4JFUWjUGm88lI6QJLCM7lDrA==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-gnu@4.30.0':
-    resolution: {integrity: sha512-CFE7zDNrokaotXu+shwIrmWrFxllg79vciH4E/zeK7NitVuWEaXRzS0mFfFvyhZfn8WfVOG/1E9u8/DFEgK7WQ==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm64-gnu@4.30.1':
-    resolution: {integrity: sha512-hqVyueGxAj3cBKrAI4aFHLV+h0Lv5VgWZs9CUGqr1z0fZtlADVV1YPOij6AhcK5An33EXaxnDLmJdQikcn5NEw==}
+  '@rollup/rollup-linux-arm64-gnu@4.44.2':
+    resolution: {integrity: sha512-NMsDEsDiYghTbeZWEGnNi4F0hSbGnsuOG+VnNvxkKg0IGDvFh7UVpM/14mnMwxRxUf9AdAVJgHPvKXf6FpMB7A==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-musl@4.30.0':
-    resolution: {integrity: sha512-MctNTBlvMcIBP0t8lV/NXiUwFg9oK5F79CxLU+a3xgrdJjfBLVIEHSAjQ9+ipofN2GKaMLnFFXLltg1HEEPaGQ==}
+  '@rollup/rollup-linux-arm64-musl@4.44.2':
+    resolution: {integrity: sha512-lb5bxXnxXglVq+7imxykIp5xMq+idehfl+wOgiiix0191av84OqbjUED+PRC5OA8eFJYj5xAGcpAZ0pF2MnW+A==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-musl@4.30.1':
-    resolution: {integrity: sha512-i4Ab2vnvS1AE1PyOIGp2kXni69gU2DAUVt6FSXeIqUCPIR3ZlheMW3oP2JkukDfu3PsexYRbOiJrY+yVNSk9oA==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@rollup/rollup-linux-loongarch64-gnu@4.30.0':
-    resolution: {integrity: sha512-fBpoYwLEPivL3q368+gwn4qnYnr7GVwM6NnMo8rJ4wb0p/Y5lg88vQRRP077gf+tc25akuqd+1Sxbn9meODhwA==}
-    cpu: [loong64]
-    os: [linux]
-
-  '@rollup/rollup-linux-loongarch64-gnu@4.30.1':
-    resolution: {integrity: sha512-fARcF5g296snX0oLGkVxPmysetwUk2zmHcca+e9ObOovBR++9ZPOhqFUM61UUZ2EYpXVPN1redgqVoBB34nTpQ==}
+  '@rollup/rollup-linux-loongarch64-gnu@4.44.2':
+    resolution: {integrity: sha512-Yl5Rdpf9pIc4GW1PmkUGHdMtbx0fBLE1//SxDmuf3X0dUC57+zMepow2LK0V21661cjXdTn8hO2tXDdAWAqE5g==}
     cpu: [loong64]
     os: [linux]
 
-  '@rollup/rollup-linux-powerpc64le-gnu@4.30.0':
-    resolution: {integrity: sha512-1hiHPV6dUaqIMXrIjN+vgJqtfkLpqHS1Xsg0oUfUVD98xGp1wX89PIXgDF2DWra1nxAd8dfE0Dk59MyeKaBVAw==}
-    cpu: [ppc64]
-    os: [linux]
-
-  '@rollup/rollup-linux-powerpc64le-gnu@4.30.1':
-    resolution: {integrity: sha512-GLrZraoO3wVT4uFXh67ElpwQY0DIygxdv0BNW9Hkm3X34wu+BkqrDrkcsIapAY+N2ATEbvak0XQ9gxZtCIA5Rw==}
+  '@rollup/rollup-linux-powerpc64le-gnu@4.44.2':
+    resolution: {integrity: sha512-03vUDH+w55s680YYryyr78jsO1RWU9ocRMaeV2vMniJJW/6HhoTBwyyiiTPVHNWLnhsnwcQ0oH3S9JSBEKuyqw==}
     cpu: [ppc64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.30.0':
-    resolution: {integrity: sha512-U0xcC80SMpEbvvLw92emHrNjlS3OXjAM0aVzlWfar6PR0ODWCTQtKeeB+tlAPGfZQXicv1SpWwRz9Hyzq3Jx3g==}
+  '@rollup/rollup-linux-riscv64-gnu@4.44.2':
+    resolution: {integrity: sha512-iYtAqBg5eEMG4dEfVlkqo05xMOk6y/JXIToRca2bAWuqjrJYJlx/I7+Z+4hSrsWU8GdJDFPL4ktV3dy4yBSrzg==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.30.1':
-    resolution: {integrity: sha512-0WKLaAUUHKBtll0wvOmh6yh3S0wSU9+yas923JIChfxOaaBarmb/lBKPF0w/+jTVozFnOXJeRGZ8NvOxvk/jcw==}
+  '@rollup/rollup-linux-riscv64-musl@4.44.2':
+    resolution: {integrity: sha512-e6vEbgaaqz2yEHqtkPXa28fFuBGmUJ0N2dOJK8YUfijejInt9gfCSA7YDdJ4nYlv67JfP3+PSWFX4IVw/xRIPg==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-s390x-gnu@4.30.0':
-    resolution: {integrity: sha512-VU/P/IODrNPasgZDLIFJmMiLGez+BN11DQWfTVlViJVabyF3JaeaJkP6teI8760f18BMGCQOW9gOmuzFaI1pUw==}
-    cpu: [s390x]
-    os: [linux]
-
-  '@rollup/rollup-linux-s390x-gnu@4.30.1':
-    resolution: {integrity: sha512-GWFs97Ruxo5Bt+cvVTQkOJ6TIx0xJDD/bMAOXWJg8TCSTEK8RnFeOeiFTxKniTc4vMIaWvCplMAFBt9miGxgkA==}
+  '@rollup/rollup-linux-s390x-gnu@4.44.2':
+    resolution: {integrity: sha512-evFOtkmVdY3udE+0QKrV5wBx7bKI0iHz5yEVx5WqDJkxp9YQefy4Mpx3RajIVcM6o7jxTvVd/qpC1IXUhGc1Mw==}
     cpu: [s390x]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.30.0':
-    resolution: {integrity: sha512-laQVRvdbKmjXuFA3ZiZj7+U24FcmoPlXEi2OyLfbpY2MW1oxLt9Au8q9eHd0x6Pw/Kw4oe9gwVXWwIf2PVqblg==}
+  '@rollup/rollup-linux-x64-gnu@4.44.2':
+    resolution: {integrity: sha512-/bXb0bEsWMyEkIsUL2Yt5nFB5naLAwyOWMEviQfQY1x3l5WsLKgvZf66TM7UTfED6erckUVUJQ/jJ1FSpm3pRQ==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.30.1':
-    resolution: {integrity: sha512-UtgGb7QGgXDIO+tqqJ5oZRGHsDLO8SlpE4MhqpY9Llpzi5rJMvrK6ZGhsRCST2abZdBqIBeXW6WPD5fGK5SDwg==}
+  '@rollup/rollup-linux-x64-musl@4.44.2':
+    resolution: {integrity: sha512-3D3OB1vSSBXmkGEZR27uiMRNiwN08/RVAcBKwhUYPaiZ8bcvdeEwWPvbnXvvXHY+A/7xluzcN+kaiOFNiOZwWg==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-musl@4.30.0':
-    resolution: {integrity: sha512-3wzKzduS7jzxqcOvy/ocU/gMR3/QrHEFLge5CD7Si9fyHuoXcidyYZ6jyx8OPYmCcGm3uKTUl+9jUSAY74Ln5A==}
-    cpu: [x64]
-    os: [linux]
-
-  '@rollup/rollup-linux-x64-musl@4.30.1':
-    resolution: {integrity: sha512-V9U8Ey2UqmQsBT+xTOeMzPzwDzyXmnAoO4edZhL7INkwQcaW1Ckv3WJX3qrrp/VHaDkEWIBWhRwP47r8cdrOow==}
-    cpu: [x64]
-    os: [linux]
-
-  '@rollup/rollup-win32-arm64-msvc@4.30.0':
-    resolution: {integrity: sha512-jROwnI1+wPyuv696rAFHp5+6RFhXGGwgmgSfzE8e4xfit6oLRg7GyMArVUoM3ChS045OwWr9aTnU+2c1UdBMyw==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@rollup/rollup-win32-arm64-msvc@4.30.1':
-    resolution: {integrity: sha512-WabtHWiPaFF47W3PkHnjbmWawnX/aE57K47ZDT1BXTS5GgrBUEpvOzq0FI0V/UYzQJgdb8XlhVNH8/fwV8xDjw==}
+  '@rollup/rollup-win32-arm64-msvc@4.44.2':
+    resolution: {integrity: sha512-VfU0fsMK+rwdK8mwODqYeM2hDrF2WiHaSmCBrS7gColkQft95/8tphyzv2EupVxn3iE0FI78wzffoULH1G+dkw==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.30.0':
-    resolution: {integrity: sha512-duzweyup5WELhcXx5H1jokpr13i3BV9b48FMiikYAwk/MT1LrMYYk2TzenBd0jj4ivQIt58JWSxc19y4SvLP4g==}
-    cpu: [ia32]
-    os: [win32]
-
-  '@rollup/rollup-win32-ia32-msvc@4.30.1':
-    resolution: {integrity: sha512-pxHAU+Zv39hLUTdQQHUVHf4P+0C47y/ZloorHpzs2SXMRqeAWmGghzAhfOlzFHHwjvgokdFAhC4V+6kC1lRRfw==}
+  '@rollup/rollup-win32-ia32-msvc@4.44.2':
+    resolution: {integrity: sha512-+qMUrkbUurpE6DVRjiJCNGZBGo9xM4Y0FXU5cjgudWqIBWbcLkjE3XprJUsOFgC6xjBClwVa9k6O3A7K3vxb5Q==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.30.0':
-    resolution: {integrity: sha512-DYvxS0M07PvgvavMIybCOBYheyrqlui6ZQBHJs6GqduVzHSZ06TPPvlfvnYstjODHQ8UUXFwt5YE+h0jFI8kwg==}
+  '@rollup/rollup-win32-x64-msvc@4.44.2':
+    resolution: {integrity: sha512-3+QZROYfJ25PDcxFF66UEk8jGWigHJeecZILvkPkyQN7oc5BvFo4YEXFkOs154j3FTMp9mn9Ky8RCOwastduEA==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.30.1':
-    resolution: {integrity: sha512-D6qjsXGcvhTjv0kI4fU8tUuBDF/Ueee4SVX79VfNDXZa64TfCW1Slkb6Z7O1p7vflqZjcmOVdZlqf8gvJxc6og==}
-    cpu: [x64]
-    os: [win32]
-
-  '@rushstack/node-core-library@5.10.2':
-    resolution: {integrity: sha512-xOF/2gVJZTfjTxbo4BDj9RtQq/HFnrrKdtem4JkyRLnwsRz2UDTg8gA1/et10fBx5RxmZD9bYVGST69W8ME5OQ==}
+  '@rushstack/node-core-library@5.13.1':
+    resolution: {integrity: sha512-5yXhzPFGEkVc9Fu92wsNJ9jlvdwz4RNb2bMso+/+TH0nMm1jDDDsOIf4l8GAkPxGuwPw5DH24RliWVfSPhlW/Q==}
     peerDependencies:
       '@types/node': '*'
     peerDependenciesMeta:
@@ -1695,82 +1325,82 @@ packages:
   '@rushstack/rig-package@0.5.3':
     resolution: {integrity: sha512-olzSSjYrvCNxUFZowevC3uz8gvKr3WTpHQ7BkpjtRpA3wK+T0ybep/SRUMfr195gBzJm5gaXw0ZMgjIyHqJUow==}
 
-  '@rushstack/terminal@0.14.5':
-    resolution: {integrity: sha512-TEOpNwwmsZVrkp0omnuTUTGZRJKTr6n6m4OITiNjkqzLAkcazVpwR1SOtBg6uzpkIBLgrcNHETqI8rbw3uiUfw==}
+  '@rushstack/terminal@0.15.3':
+    resolution: {integrity: sha512-DGJ0B2Vm69468kZCJkPj3AH5nN+nR9SPmC0rFHtzsS4lBQ7/dgOwtwVxYP7W9JPDMuRBkJ4KHmWKr036eJsj9g==}
     peerDependencies:
       '@types/node': '*'
     peerDependenciesMeta:
       '@types/node':
         optional: true
 
-  '@rushstack/ts-command-line@4.23.3':
-    resolution: {integrity: sha512-HazKL8fv4HMQMzrKJCrOrhyBPPdzk7iajUXgsASwjQ8ROo1cmgyqxt/k9+SdmrNLGE1zATgRqMUH3s/6smbRMA==}
+  '@rushstack/ts-command-line@5.0.1':
+    resolution: {integrity: sha512-bsbUucn41UXrQK7wgM8CNM/jagBytEyJqXw/umtI8d68vFm1Jwxh1OtLrlW7uGZgjCWiiPH6ooUNa1aVsuVr3Q==}
 
-  '@swc/core-darwin-arm64@1.9.3':
-    resolution: {integrity: sha512-hGfl/KTic/QY4tB9DkTbNuxy5cV4IeejpPD4zo+Lzt4iLlDWIeANL4Fkg67FiVceNJboqg48CUX+APhDHO5G1w==}
+  '@swc/core-darwin-arm64@1.12.0':
+    resolution: {integrity: sha512-usLr8kC80GDv3pwH2zoEaS279kxtWY0MY3blbMFw7zA8fAjqxa8IDxm3WcgyNLNWckWn4asFfguEwz/Weem3nA==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@swc/core-darwin-x64@1.9.3':
-    resolution: {integrity: sha512-IaRq05ZLdtgF5h9CzlcgaNHyg4VXuiStnOFpfNEMuI5fm5afP2S0FHq8WdakUz5WppsbddTdplL+vpeApt/WCQ==}
+  '@swc/core-darwin-x64@1.12.0':
+    resolution: {integrity: sha512-Cvv4sqDcTY7QF2Dh1vn2Xbt/1ENYQcpmrGHzITJrXzxA2aBopsz/n4yQDiyRxTR0t802m4xu0CzMoZIHvVruWQ==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [darwin]
 
-  '@swc/core-linux-arm-gnueabihf@1.9.3':
-    resolution: {integrity: sha512-Pbwe7xYprj/nEnZrNBvZfjnTxlBIcfApAGdz2EROhjpPj+FBqBa3wOogqbsuGGBdCphf8S+KPprL1z+oDWkmSQ==}
+  '@swc/core-linux-arm-gnueabihf@1.12.0':
+    resolution: {integrity: sha512-seM4/XMJMOupkzfLfHl8sRa3NdhsVZp+XgwA/vVeYZYJE4wuWUxVzhCYzwmNftVY32eF2IiRaWnhG6ho6jusnQ==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux]
 
-  '@swc/core-linux-arm64-gnu@1.9.3':
-    resolution: {integrity: sha512-AQ5JZiwNGVV/2K2TVulg0mw/3LYfqpjZO6jDPtR2evNbk9Yt57YsVzS+3vHSlUBQDRV9/jqMuZYVU3P13xrk+g==}
+  '@swc/core-linux-arm64-gnu@1.12.0':
+    resolution: {integrity: sha512-Al0x33gUVxNY5tutEYpSyv7mze6qQS1ONa0HEwoRxcK9WXsX0NHLTiOSGZoCUS1SsXM37ONlbA6/Bsp1MQyP+g==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
 
-  '@swc/core-linux-arm64-musl@1.9.3':
-    resolution: {integrity: sha512-tzVH480RY6RbMl/QRgh5HK3zn1ZTFsThuxDGo6Iuk1MdwIbdFYUY034heWUTI4u3Db97ArKh0hNL0xhO3+PZdg==}
+  '@swc/core-linux-arm64-musl@1.12.0':
+    resolution: {integrity: sha512-OeFHz/5Hl9v75J9TYA5jQxNIYAZMqaiPpd9dYSTK2Xyqa/ZGgTtNyPhIwVfxx+9mHBf6+9c1mTlXUtACMtHmaQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
 
-  '@swc/core-linux-x64-gnu@1.9.3':
-    resolution: {integrity: sha512-ivXXBRDXDc9k4cdv10R21ccBmGebVOwKXT/UdH1PhxUn9m/h8erAWjz5pcELwjiMf27WokqPgaWVfaclDbgE+w==}
+  '@swc/core-linux-x64-gnu@1.12.0':
+    resolution: {integrity: sha512-ltIvqNi7H0c5pRawyqjeYSKEIfZP4vv/datT3mwT6BW7muJtd1+KIDCPFLMIQ4wm/h76YQwPocsin3fzmnFdNA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
 
-  '@swc/core-linux-x64-musl@1.9.3':
-    resolution: {integrity: sha512-ILsGMgfnOz1HwdDz+ZgEuomIwkP1PHT6maigZxaCIuC6OPEhKE8uYna22uU63XvYcLQvZYDzpR3ms47WQPuNEg==}
+  '@swc/core-linux-x64-musl@1.12.0':
+    resolution: {integrity: sha512-Z/DhpjehaTK0uf+MhNB7mV9SuewpGs3P/q9/8+UsJeYoFr7yuOoPbAvrD6AqZkf6Bh7MRZ5OtG+KQgG5L+goiA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
 
-  '@swc/core-win32-arm64-msvc@1.9.3':
-    resolution: {integrity: sha512-e+XmltDVIHieUnNJHtspn6B+PCcFOMYXNJB1GqoCcyinkEIQNwC8KtWgMqUucUbEWJkPc35NHy9k8aCXRmw9Kg==}
+  '@swc/core-win32-arm64-msvc@1.12.0':
+    resolution: {integrity: sha512-wHnvbfHIh2gfSbvuFT7qP97YCMUDh+fuiso+pcC6ug8IsMxuViNapHET4o0ZdFNWHhXJ7/s0e6w7mkOalsqQiQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
-  '@swc/core-win32-ia32-msvc@1.9.3':
-    resolution: {integrity: sha512-rqpzNfpAooSL4UfQnHhkW8aL+oyjqJniDP0qwZfGnjDoJSbtPysHg2LpcOBEdSnEH+uIZq6J96qf0ZFD8AGfXA==}
+  '@swc/core-win32-ia32-msvc@1.12.0':
+    resolution: {integrity: sha512-88umlXwK+7J2p4DjfWHXQpmlZgCf1ayt6Ssj+PYlAfMCR0aBiJoAMwHWrvDXEozyOrsyP1j2X6WxbmA861vL5Q==}
     engines: {node: '>=10'}
     cpu: [ia32]
     os: [win32]
 
-  '@swc/core-win32-x64-msvc@1.9.3':
-    resolution: {integrity: sha512-3YJJLQ5suIEHEKc1GHtqVq475guiyqisKSoUnoaRtxkDaW5g1yvPt9IoSLOe2mRs7+FFhGGU693RsBUSwOXSdQ==}
+  '@swc/core-win32-x64-msvc@1.12.0':
+    resolution: {integrity: sha512-KR9TSRp+FEVOhbgTU6c94p/AYpsyBk7dIvlKQiDp8oKScUoyHG5yjmMBFN/BqUyTq4kj6zlgsY2rFE4R8/yqWg==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
-  '@swc/core@1.9.3':
-    resolution: {integrity: sha512-oRj0AFePUhtatX+BscVhnzaAmWjpfAeySpM1TCbxA1rtBDeH/JDhi5yYzAKneDYtVtBvA7ApfeuzhMC9ye4xSg==}
+  '@swc/core@1.12.0':
+    resolution: {integrity: sha512-/C0kiMHPY/HnLfqXYGMGxGck3A5Y3mqwxfv+EwHTPHGjAVRfHpWAEEBTSTF5C88vVY6CvwBEkhR2TX7t8Mahcw==}
     engines: {node: '>=10'}
     peerDependencies:
-      '@swc/helpers': '*'
+      '@swc/helpers': '>=0.5.17'
     peerDependenciesMeta:
       '@swc/helpers':
         optional: true
@@ -1778,14 +1408,8 @@ packages:
   '@swc/counter@0.1.3':
     resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
 
-  '@swc/types@0.1.17':
-    resolution: {integrity: sha512-V5gRru+aD8YVyCOMAjMpWR1Ui577DD5KSJsHP8RAxopAH22jFz6GZd/qxqjO6MJHQhcsjvjOFXyDhyLQUnMveQ==}
-
-  '@testing-library/cypress@10.0.2':
-    resolution: {integrity: sha512-dKv95Bre5fDmNb9tOIuWedhGUryxGu1GWYWtXDqUsDPcr9Ekld0fiTb+pcBvSsFpYXAZSpmyEjhoXzLbhh06yQ==}
-    engines: {node: '>=12', npm: '>=6'}
-    peerDependencies:
-      cypress: ^12.0.0 || ^13.0.0
+  '@swc/types@0.1.23':
+    resolution: {integrity: sha512-u1iIVZV9Q0jxY+yM2vw/hZGDNudsN85bBpTqzAQ9rzkxW9D+e3aEM4Han+ow518gSewkXgjmEK0BD79ZcNVgPw==}
 
   '@testing-library/dom@10.4.0':
     resolution: {integrity: sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ==}
@@ -1795,8 +1419,8 @@ packages:
     resolution: {integrity: sha512-IteBhl4XqYNkM54f4ejhLRJiZNqcSCoXUOG2CPK7qbD322KjQozM4kHQOfkG2oln9b9HTYqs+Sae8vBATubxxA==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
-  '@testing-library/react@16.1.0':
-    resolution: {integrity: sha512-Q2ToPvg0KsVL0ohND9A3zLJWcOXXcO8IDu3fj11KhNt0UlCWyFyvnCIBkd12tidB2lkiVRG8VFqdhcqhqnAQtg==}
+  '@testing-library/react@16.3.0':
+    resolution: {integrity: sha512-kFSyxiEDwv1WLl2fgsq6pPBbw5aWKrsY2/noi1Id0TK0UParSF62oFQFGHXIyaG4pp2tEub/Zlel+fjjZILDsw==}
     engines: {node: '>=18'}
     peerDependencies:
       '@testing-library/dom': ^10.0.0
@@ -1828,8 +1452,8 @@ packages:
   '@types/aria-query@5.0.4':
     resolution: {integrity: sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==}
 
-  '@types/chai@5.0.1':
-    resolution: {integrity: sha512-5T8ajsg3M/FOncpLYW7sdOcD6yf4+722sze/tc4KQV0P8Z2rAr3SAuHCIkYmYpt8VbcQlnz8SxlOlPQYefe4cA==}
+  '@types/chai@5.2.2':
+    resolution: {integrity: sha512-8kB30R7Hwqf40JPiKhVzodJs2Qc1ZJ5zuT3uzw5Hq/dhNCl3G3l83jfpdI1e20BP348+fV7VIL/+FxaXkqBmWg==}
 
   '@types/d3-array@3.2.1':
     resolution: {integrity: sha512-Y2Jn2idRrLzUfAKV2LyRImR+y4oa2AntrgID95SHJxuMUrkNXmanDSed71sRNZysveJVt1hLLemQZIady0FpEg==}
@@ -1882,8 +1506,8 @@ packages:
   '@types/d3-interpolate@3.0.4':
     resolution: {integrity: sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==}
 
-  '@types/d3-path@3.1.0':
-    resolution: {integrity: sha512-P2dlU/q51fkOc/Gfl3Ul9kicV7l+ra934qBFXCFhrZMOL6du1TM0pm1ThYvENukyOn5h9v+yMJ9Fn5JK4QozrQ==}
+  '@types/d3-path@3.1.1':
+    resolution: {integrity: sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==}
 
   '@types/d3-polygon@3.0.2':
     resolution: {integrity: sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA==}
@@ -1897,14 +1521,14 @@ packages:
   '@types/d3-scale-chromatic@3.1.0':
     resolution: {integrity: sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==}
 
-  '@types/d3-scale@4.0.8':
-    resolution: {integrity: sha512-gkK1VVTr5iNiYJ7vWDI+yUFFlszhNMtVeneJ6lUTKPjprsvLLI9/tgEGiXJOnlINJA8FyA88gfnQsHbybVZrYQ==}
+  '@types/d3-scale@4.0.9':
+    resolution: {integrity: sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==}
 
   '@types/d3-selection@3.0.11':
     resolution: {integrity: sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==}
 
-  '@types/d3-shape@3.1.6':
-    resolution: {integrity: sha512-5KKk5aKGu2I+O6SONMYSNflgiP0WfZIQvVUMan50wHsLG1G94JlxEVnCpQARfTtzytuY0p/9PXXZb3I7giofIA==}
+  '@types/d3-shape@3.1.7':
+    resolution: {integrity: sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg==}
 
   '@types/d3-time-format@4.0.3':
     resolution: {integrity: sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg==}
@@ -1924,20 +1548,23 @@ packages:
   '@types/d3@7.4.3':
     resolution: {integrity: sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww==}
 
-  '@types/dagre@0.7.52':
-    resolution: {integrity: sha512-XKJdy+OClLk3hketHi9Qg6gTfe1F3y+UFnHxKA2rn9Dw+oXa4Gb378Ztz9HlMgZKSxpPmn4BNVh9wgkpvrK1uw==}
+  '@types/dagre@0.7.53':
+    resolution: {integrity: sha512-f4gkWqzPZvYmKhOsDnhq/R8mO4UMcKdxZo+i5SCkOU1wvGeHJeUXGIHeE9pnwGyPMDof1Vx5ZQo4nxpeg2TTVQ==}
 
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
-  '@types/estree@1.0.6':
-    resolution: {integrity: sha512-AYnb1nQyY49te+VRAVgmzfcgjYS91mY5P0TKUDCLEM+gNnA+3T6rWITXRLYCpahpqSQbN5cE+gHpnPyXjHWxcw==}
+  '@types/estree@1.0.7':
+    resolution: {integrity: sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
   '@types/file-saver@2.0.7':
     resolution: {integrity: sha512-dNKVfHd/jk0SkR/exKGj2ggkB45MAkzvWCaqLUUgkyjITkGNzH8H+yUwr+BLJUBjZOe9w8X3wgmXhZDRg1ED6A==}
 
-  '@types/geojson@7946.0.14':
-    resolution: {integrity: sha512-WCfD5Ht3ZesJUsONdhvm84dmzWOiOzOAqOncN0++w0lBw1o8OuDNJF2McvvCef/yBqb/HYRahp1BYtODFQ8bRg==}
+  '@types/geojson@7946.0.16':
+    resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
 
   '@types/gunzip-maybe@1.4.2':
     resolution: {integrity: sha512-2uqXZg1jTCKE1Pjbab8qb74+f2+i9h/jz8rQ+jRR+zaNJF75zWwrpbX8/TjF4m56m3KFOg9umHdCJ074KwiVxg==}
@@ -1954,8 +1581,8 @@ packages:
   '@types/lodash-es@4.17.12':
     resolution: {integrity: sha512-0NgftHUcV4v34VhXm8QBSftKVXtbkBG3ViCjs6+eJ5a6y6Mi/jiFGPc1sC7QK+9BFhWrURE3EOggmWaSxL9OzQ==}
 
-  '@types/lodash@4.17.13':
-    resolution: {integrity: sha512-lfx+dftrEZcdBPczf9d0Qv0x+j/rfNCMuC6OcfXmO8gkfeNAY88PgKUbvG56whcN23gc27yenwF6oJZXGFpYxg==}
+  '@types/lodash@4.17.15':
+    resolution: {integrity: sha512-w/P33JFeySuhN6JLkysYUK2gEmy9kHHFN7E8ro0tkfmlDOgxBDzWEZ/J8cWA+fHqFevpswDTFZnDx+R9lbL6xw==}
 
   '@types/mdast@4.0.4':
     resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
@@ -1963,33 +1590,29 @@ packages:
   '@types/mocha@10.0.10':
     resolution: {integrity: sha512-xPyYSz1cMPnJQhl0CLMH68j3gprKZaTjG3s5Vi+fDgx+uhG9NOXwbVt52eFS8ECyXhyKcjDLCBEqBExKuiZb7Q==}
 
-  '@types/node@22.10.5':
-    resolution: {integrity: sha512-F8Q+SeGimwOo86fiovQh8qiXfFEh2/ocYv7tU5pJ3EXMSSxk1Joj5wefpFK2fHTf/N6HKGSxIDBT9f3gCxXPkQ==}
+  '@types/node@22.13.5':
+    resolution: {integrity: sha512-+lTU0PxZXn0Dr1NBtC7Y8cR21AJr87dLLU953CWA6pMxxv/UDc7jYAY90upcrie1nRcD6XNG5HOYEDtgW5TxAg==}
 
-  '@types/node@22.10.6':
-    resolution: {integrity: sha512-qNiuwC4ZDAUNcY47xgaSuS92cjf8JbSUoaKS77bmLG1rU7MlATVSiw/IlrjtIyyskXBZ8KkNfjK/P5na7rgXbQ==}
+  '@types/node@24.0.12':
+    resolution: {integrity: sha512-LtOrbvDf5ndC9Xi+4QZjVL0woFymF/xSTKZKPgrrl7H7XoeDvnD+E2IclKVDyaK9UM756W/3BXqSU+JEHopA9g==}
 
   '@types/prismjs@1.26.5':
     resolution: {integrity: sha512-AUZTa7hQ2KY5L7AmtSiqxlhWxb4ina0yd8hNbl4TWuqnv/pFP0nDMb3YrfSBf4hJVGLh2YEIBfKaBW/9UEl6IQ==}
 
-  '@types/prop-types@15.7.13':
-    resolution: {integrity: sha512-hCZTSvwbzWGvhqxp/RqVqwU999pBf2vp7hzIjiYOsl8wqOmUxkQ6ddw1cV3l8811+kdUFus/q4d1Y3E3SyEifA==}
+  '@types/prop-types@15.7.14':
+    resolution: {integrity: sha512-gNMvNH49DJ7OJYv+KAKn0Xp45p8PLl6zo2YnvDIbTd4J6MER2BmWN49TG7n9LvkyihINxeKW8+3bfS2yDC9dzQ==}
 
-  '@types/react-dom@18.3.1':
-    resolution: {integrity: sha512-qW1Mfv8taImTthu4KoXgDfLuk4bydU6Q/TkADnDWWHwi4NX4BR+LWfTp2sVmTqRrsHvyDDTelgelxJ+SsejKKQ==}
+  '@types/react-dom@18.3.5':
+    resolution: {integrity: sha512-P4t6saawp+b/dFrUr2cvkVsfvPguwsxtH6dNIYRllMsefqFzkZk5UIjzyDOv5g1dXIPdG4Sp1yCR4Z6RCUsG/Q==}
+    peerDependencies:
+      '@types/react': ^18.0.0
 
-  '@types/react@18.3.13':
-    resolution: {integrity: sha512-ii/gswMmOievxAJed4PAHT949bpYjPKXvXo1v6cRB/kqc2ZR4n+SgyCyvyc5Fec5ez8VnUumI1Vk7j6fRyRogg==}
+  '@types/react@18.3.18':
+    resolution: {integrity: sha512-t4yC+vtgnkYjNSKlFx1jkAhH8LgTo2N/7Qvi83kdEaUtMDiwpbLAktKDaAMlRcJ5eSxZkH74eEGt1ky31d7kfQ==}
 
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
-  '@types/sinonjs__fake-timers@8.1.1':
-    resolution: {integrity: sha512-0kSuKjAS0TrGLJ0M/+8MaFkGsQhZpB6pxOmvS3K8FYI72K//YmdfoW9X2qPsAKh1mkwxGD5zib9s1FIFed6E8g==}
-
-  '@types/sizzle@2.3.9':
-    resolution: {integrity: sha512-xzLEyKB50yqCUPUJkIsrVvoWNfFUbIZI+RspLWt8u+tIW/BetMBZtgV2LY/2o+tYH8dRvQ+eoPf3NdhQCcLE2w==}
-
   '@types/tar-fs@2.0.4':
     resolution: {integrity: sha512-ipPec0CjTmVDWE+QKr9cTmIIoTl7dFG/yARCM5MqK8i6CNLIG1P8x4kwDsOQY1ChZOZjH0wO9nvfgBvWl4R3kA==}
 
@@ -2002,137 +1625,123 @@ packages:
   '@types/unist@3.0.3':
     resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
 
-  '@types/yauzl@2.10.3':
-    resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
-
-  '@typescript-eslint/eslint-plugin@8.19.1':
-    resolution: {integrity: sha512-tJzcVyvvb9h/PB96g30MpxACd9IrunT7GF9wfA9/0TJ1LxGOJx1TdPzSbBBnNED7K9Ka8ybJsnEpiXPktolTLg==}
+  '@typescript-eslint/eslint-plugin@8.36.0':
+    resolution: {integrity: sha512-lZNihHUVB6ZZiPBNgOQGSxUASI7UJWhT8nHyUGCnaQ28XFCw98IfrMCG3rUl1uwUWoAvodJQby2KTs79UTcrAg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      '@typescript-eslint/parser': ^8.0.0 || ^8.0.0-alpha.0
+      '@typescript-eslint/parser': ^8.36.0
       eslint: ^8.57.0 || ^9.0.0
-      typescript: '>=4.8.4 <5.8.0'
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/parser@8.19.1':
-    resolution: {integrity: sha512-67gbfv8rAwawjYx3fYArwldTQKoYfezNUT4D5ioWetr/xCrxXxvleo3uuiFuKfejipvq+og7mjz3b0G2bVyUCw==}
+  '@typescript-eslint/parser@8.36.0':
+    resolution: {integrity: sha512-FuYgkHwZLuPbZjQHzJXrtXreJdFMKl16BFYyRrLxDhWr6Qr7Kbcu2s1Yhu8tsiMXw1S0W1pjfFfYEt+R604s+Q==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
-      typescript: '>=4.8.4 <5.8.0'
-
-  '@typescript-eslint/scope-manager@8.19.1':
-    resolution: {integrity: sha512-60L9KIuN/xgmsINzonOcMDSB8p82h95hoBfSBtXuO4jlR1R9L1xSkmVZKgCPVfavDlXihh4ARNjXhh1gGnLC7Q==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/type-utils@8.19.1':
-    resolution: {integrity: sha512-Rp7k9lhDKBMRJB/nM9Ksp1zs4796wVNyihG9/TU9R6KCJDNkQbc2EOKjrBtLYh3396ZdpXLtr/MkaSEmNMtykw==}
+  '@typescript-eslint/project-service@8.36.0':
+    resolution: {integrity: sha512-JAhQFIABkWccQYeLMrHadu/fhpzmSQ1F1KXkpzqiVxA/iYI6UnRt2trqXHt1sYEcw1mxLnB9rKMsOxXPxowN/g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      eslint: ^8.57.0 || ^9.0.0
-      typescript: '>=4.8.4 <5.8.0'
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/types@7.18.0':
-    resolution: {integrity: sha512-iZqi+Ds1y4EDYUtlOOC+aUmxnE9xS/yCigkjA7XpTKV6nCBd3Hp/PRGGmdwnfkV2ThMyYldP1wRpm/id99spTQ==}
-    engines: {node: ^18.18.0 || >=20.0.0}
+  '@typescript-eslint/scope-manager@8.36.0':
+    resolution: {integrity: sha512-wCnapIKnDkN62fYtTGv2+RY8FlnBYA3tNm0fm91kc2BjPhV2vIjwwozJ7LToaLAyb1ca8BxrS7vT+Pvvf7RvqA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/types@8.19.1':
-    resolution: {integrity: sha512-JBVHMLj7B1K1v1051ZaMMgLW4Q/jre5qGK0Ew6UgXz1Rqh+/xPzV1aW581OM00X6iOfyr1be+QyW8LOUf19BbA==}
+  '@typescript-eslint/tsconfig-utils@8.36.0':
+    resolution: {integrity: sha512-Nhh3TIEgN18mNbdXpd5Q8mSCBnrZQeY9V7Ca3dqYvNDStNIGRmJA6dmrIPMJ0kow3C7gcQbpsG2rPzy1Ks/AnA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/typescript-estree@7.18.0':
-    resolution: {integrity: sha512-aP1v/BSPnnyhMHts8cf1qQ6Q1IFwwRvAQGRvBFkWlo3/lH29OXA3Pts+c10nxRxIBrDnoMqzhgdwVe5f2D6OzA==}
-    engines: {node: ^18.18.0 || >=20.0.0}
+  '@typescript-eslint/type-utils@8.36.0':
+    resolution: {integrity: sha512-5aaGYG8cVDd6cxfk/ynpYzxBRZJk7w/ymto6uiyUFtdCozQIsQWh7M28/6r57Fwkbweng8qAzoMCPwSJfWlmsg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      typescript: '*'
-    peerDependenciesMeta:
-      typescript:
-        optional: true
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/types@8.36.0':
+    resolution: {integrity: sha512-xGms6l5cTJKQPZOKM75Dl9yBfNdGeLRsIyufewnxT4vZTrjC0ImQT4fj8QmtJK84F58uSh5HVBSANwcfiXxABQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/typescript-estree@8.19.1':
-    resolution: {integrity: sha512-jk/TZwSMJlxlNnqhy0Eod1PNEvCkpY6MXOXE/WLlblZ6ibb32i2We4uByoKPv1d0OD2xebDv4hbs3fm11SMw8Q==}
+  '@typescript-eslint/typescript-estree@8.36.0':
+    resolution: {integrity: sha512-JaS8bDVrfVJX4av0jLpe4ye0BpAaUW7+tnS4Y4ETa3q7NoZgzYbN9zDQTJ8kPb5fQ4n0hliAt9tA4Pfs2zA2Hg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      typescript: '>=4.8.4 <5.8.0'
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/utils@8.19.1':
-    resolution: {integrity: sha512-IxG5gLO0Ne+KaUc8iW1A+XuKLd63o4wlbI1Zp692n1xojCl/THvgIKXJXBZixTh5dd5+yTJ/VXH7GJaaw21qXA==}
+  '@typescript-eslint/utils@8.36.0':
+    resolution: {integrity: sha512-VOqmHu42aEMT+P2qYjylw6zP/3E/HvptRwdn/PZxyV27KhZg2IOszXod4NcXisWzPAGSS4trE/g4moNj6XmH2g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
-      typescript: '>=4.8.4 <5.8.0'
-
-  '@typescript-eslint/visitor-keys@7.18.0':
-    resolution: {integrity: sha512-cDF0/Gf81QpY3xYyJKDV14Zwdmid5+uuENhjH2EqFaF0ni+yAyq/LzMaIJdhNJXZI7uLzwIlA+V7oWoyn6Curg==}
-    engines: {node: ^18.18.0 || >=20.0.0}
+      typescript: '>=4.8.4 <5.9.0'
 
-  '@typescript-eslint/visitor-keys@8.19.1':
-    resolution: {integrity: sha512-fzmjU8CHK853V/avYZAvuVut3ZTfwN5YtMaoi+X9Y9MA9keaWNHC3zEQ9zvyX/7Hj+5JkNyK1l7TOR2hevHB6Q==}
+  '@typescript-eslint/visitor-keys@8.36.0':
+    resolution: {integrity: sha512-vZrhV2lRPWDuGoxcmrzRZyxAggPL+qp3WzUrlZD+slFueDiYHxeBa34dUXPuC0RmGKzl4lS5kFJYvKCq9cnNDA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@uiw/react-textarea-code-editor@3.1.0':
-    resolution: {integrity: sha512-lcAb5foG8K32ntg8dzY0A8vFyQP33SxuN8oatVYxJaxf2WDeiV0Jzk8/8lsOzthafEpgxc/X3RS2elYmvHn8TQ==}
+  '@uiw/react-textarea-code-editor@3.1.1':
+    resolution: {integrity: sha512-AERRbp/d85vWR+UPgsB5hEgerNXuyszdmhWl2fV2H2jN63jgOobwEnjIpb76Vwy8SaGa/AdehaoJX2XZgNXtJA==}
     peerDependencies:
       '@babel/runtime': '>=7.10.0'
       react: '>=16.9.0'
       react-dom: '>=16.9.0'
 
-  '@ungap/structured-clone@1.2.0':
-    resolution: {integrity: sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==}
+  '@ungap/structured-clone@1.3.0':
+    resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
 
-  '@vitejs/plugin-react-swc@3.7.2':
-    resolution: {integrity: sha512-y0byko2b2tSVVf5Gpng1eEhX1OvPC7x8yns1Fx8jDzlJp4LS6CMkCPfLw47cjyoMrshQDoQw4qcgjsU9VvlCew==}
+  '@vitejs/plugin-react-swc@3.10.2':
+    resolution: {integrity: sha512-xD3Rdvrt5LgANug7WekBn1KhcvLn1H3jNBfJRL3reeOIua/WnZOEV5qi5qIBq5T8R0jUDmRtxuvk4bPhzGHDWw==}
     peerDependencies:
-      vite: ^4 || ^5 || ^6
+      vite: ^4 || ^5 || ^6 || ^7.0.0-beta.0
 
-  '@vitest/expect@2.1.8':
-    resolution: {integrity: sha512-8ytZ/fFHq2g4PJVAtDX57mayemKgDR6X3Oa2Foro+EygiOJHUXhCqBAAKQYYajZpFoIfvBCF1j6R6IYRSIUFuw==}
+  '@vitest/expect@3.2.4':
+    resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
 
-  '@vitest/mocker@2.1.8':
-    resolution: {integrity: sha512-7guJ/47I6uqfttp33mgo6ga5Gr1VnL58rcqYKyShoRK9ebu8T5Rs6HN3s1NABiBeVTdWNrwUMcHH54uXZBN4zA==}
+  '@vitest/mocker@3.2.4':
+    resolution: {integrity: sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^5.0.0
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
     peerDependenciesMeta:
       msw:
         optional: true
       vite:
         optional: true
 
-  '@vitest/pretty-format@2.1.8':
-    resolution: {integrity: sha512-9HiSZ9zpqNLKlbIDRWOnAWqgcA7xu+8YxXSekhr0Ykab7PAYFkhkwoqVArPOtJhPmYeE2YHgKZlj3CP36z2AJQ==}
+  '@vitest/pretty-format@3.2.4':
+    resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
 
-  '@vitest/runner@2.1.8':
-    resolution: {integrity: sha512-17ub8vQstRnRlIU5k50bG+QOMLHRhYPAna5tw8tYbj+jzjcspnwnwtPtiOlkuKC4+ixDPTuLZiqiWWQ2PSXHVg==}
+  '@vitest/runner@3.2.4':
+    resolution: {integrity: sha512-oukfKT9Mk41LreEW09vt45f8wx7DordoWUZMYdY/cyAk7w5TWkTRCNZYF7sX7n2wB7jyGAl74OxgwhPgKaqDMQ==}
 
-  '@vitest/snapshot@2.1.8':
-    resolution: {integrity: sha512-20T7xRFbmnkfcmgVEz+z3AU/3b0cEzZOt/zmnvZEctg64/QZbSDJEVm9fLnnlSi74KibmRsO9/Qabi+t0vCRPg==}
+  '@vitest/snapshot@3.2.4':
+    resolution: {integrity: sha512-dEYtS7qQP2CjU27QBC5oUOxLE/v5eLkGqPE0ZKEIDGMs4vKWe7IjgLOeauHsR0D5YuuycGRO5oSRXnwnmA78fQ==}
 
-  '@vitest/spy@2.1.8':
-    resolution: {integrity: sha512-5swjf2q95gXeYPevtW0BLk6H8+bPlMb4Vw/9Em4hFxDcaOxS+e0LOX4yqNxoHzMR2akEB2xfpnWUzkZokmgWDg==}
+  '@vitest/spy@3.2.4':
+    resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
 
-  '@vitest/utils@2.1.8':
-    resolution: {integrity: sha512-dwSoui6djdwbfFmIgbIjX2ZhIoG7Ex/+xpxyiEgIGzjliY8xGkcpITKTlp6B4MgtGkF2ilvm97cPM96XZaAgcA==}
+  '@vitest/utils@3.2.4':
+    resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
 
-  '@volar/language-core@2.4.11':
-    resolution: {integrity: sha512-lN2C1+ByfW9/JRPpqScuZt/4OrUUse57GLI6TbLgTIqBVemdl1wNcZ1qYGEo2+Gw8coYLgCy7SuKqn6IrQcQgg==}
+  '@volar/language-core@2.4.14':
+    resolution: {integrity: sha512-X6beusV0DvuVseaOEy7GoagS4rYHgDHnTrdOj5jeUb49fW5ceQyP9Ej5rBhqgz2wJggl+2fDbbojq1XKaxDi6w==}
 
-  '@volar/source-map@2.4.11':
-    resolution: {integrity: sha512-ZQpmafIGvaZMn/8iuvCFGrW3smeqkq/IIh9F1SdSx9aUl0J4Iurzd6/FhmjNO5g2ejF3rT45dKskgXWiofqlZQ==}
+  '@volar/source-map@2.4.14':
+    resolution: {integrity: sha512-5TeKKMh7Sfxo8021cJfmBzcjfY1SsXsPMMjMvjY7ivesdnybqqS+GxGAoXHAOUawQTwtdUxgP65Im+dEmvWtYQ==}
 
-  '@volar/typescript@2.4.11':
-    resolution: {integrity: sha512-2DT+Tdh88Spp5PyPbqhyoYavYCPDsqbHLFwcUI9K1NlY1YgUJvujGdrqUp0zWxnW7KWNTr3xSpMuv2WnaTKDAw==}
+  '@volar/typescript@2.4.14':
+    resolution: {integrity: sha512-p8Z6f/bZM3/HyCdRNFZOEEzts51uV8WHeN8Tnfnm2EBv6FDB2TQLzfVx7aJvnl8ofKAOnS64B2O8bImBFaauRw==}
 
-  '@vue/compiler-core@3.5.13':
-    resolution: {integrity: sha512-oOdAkwqUfW1WqpwSYJce06wvt6HljgY3fGeM9NcVA1HaYOij3mZG9Rkysn0OHuyUAGMbEbARIpsG+LPVlBJ5/Q==}
+  '@vue/compiler-core@3.5.14':
+    resolution: {integrity: sha512-k7qMHMbKvoCXIxPhquKQVw3Twid3Kg4s7+oYURxLGRd56LiuHJVrvFKI4fm2AM3c8apqODPfVJGoh8nePbXMRA==}
 
-  '@vue/compiler-dom@3.5.13':
-    resolution: {integrity: sha512-ZOJ46sMOKUjO3e94wPdCzQ6P1Lx/vhp2RSvfaab88Ajexs0AHeV0uasYhi99WPaogmBlRHNRuly8xV75cNTMDA==}
-
-  '@vue/compiler-sfc@3.5.13':
-    resolution: {integrity: sha512-6VdaljMpD82w6c2749Zhf5T9u5uLBWKnVue6XWxprDobftnletJ8+oel7sexFfM3qIxNmVE7LSFGTpv6obNyaQ==}
-
-  '@vue/compiler-ssr@3.5.13':
-    resolution: {integrity: sha512-wMH6vrYHxQl/IybKJagqbquvxpWCuVYpoUJfCqFZwa/JY1GdATAQ+TgVtgrwwMZ0D07QhA99rs/EAAWfvG6KpA==}
+  '@vue/compiler-dom@3.5.14':
+    resolution: {integrity: sha512-1aOCSqxGOea5I80U2hQJvXYpPm/aXo95xL/m/mMhgyPUsKe9jhjwWpziNAw7tYRnbz1I61rd9Mld4W9KmmRoug==}
 
   '@vue/compiler-vue2@2.7.16':
     resolution: {integrity: sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A==}
@@ -2145,11 +1754,8 @@ packages:
       typescript:
         optional: true
 
-  '@vue/shared@3.5.13':
-    resolution: {integrity: sha512-/hnE/qP5ZoGpol0a5mDi45bOd7t3tjYJBjsgCsivow7D48cJeV5l05RD82lPqi7gRiphZM37rnhW1l6ZoCNNnQ==}
-
-  abstract-logging@2.0.1:
-    resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
+  '@vue/shared@3.5.14':
+    resolution: {integrity: sha512-oXTwNxVfc9EtP1zzXAlSlgARLXNC84frFYkS0HHz0h3E4WZSP9sywqjqzGCP9Y34M8ipNmd380pVgmMuwELDyQ==}
 
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
@@ -2165,14 +1771,20 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  acorn@8.14.1:
+    resolution: {integrity: sha512-OvQ/2pUDKmgfCg++xsTX1wGxfTaszcHVcTctW4UJB4hibJx2HXxxO5UmVgyjMa+ZDsiaf5wWLXYpRWMmBI0QHg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  acorn@8.15.0:
+    resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
   agent-base@7.1.3:
     resolution: {integrity: sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==}
     engines: {node: '>= 14'}
 
-  aggregate-error@3.1.0:
-    resolution: {integrity: sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==}
-    engines: {node: '>=8'}
-
   ajv-draft-04@1.0.0:
     resolution: {integrity: sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw==}
     peerDependencies:
@@ -2201,14 +1813,6 @@ packages:
   alien-signals@0.4.14:
     resolution: {integrity: sha512-itUAVzhczTmP2U5yX67xVpsbbOiquusbWVyA9N+sy6+r6YVbFkahXvNCeEPWEOMhwDYwbVbGHFkVL03N9I5g+Q==}
 
-  ansi-colors@4.1.3:
-    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
-    engines: {node: '>=6'}
-
-  ansi-escapes@4.3.2:
-    resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==}
-    engines: {node: '>=8'}
-
   ansi-escapes@7.0.0:
     resolution: {integrity: sha512-GdYO7a61mR0fOlAsvC9/rIHf7L96sBc6dEWzeOu+KAea5bZyQRPIpojrVoI4AXGJS/ycu/fBTdLrUkA4ODrvjw==}
     engines: {node: '>=18'}
@@ -2237,18 +1841,9 @@ packages:
     resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
     engines: {node: '>= 8'}
 
-  app-module-path@2.2.0:
-    resolution: {integrity: sha512-gkco+qxENJV+8vFcDiiFhuoSvRXb2a/QPqpSoWhVz829VNJfOTnELbBmPmNKFxf3xdNnw4DWCkzkDaavcX/1YQ==}
-
-  arch@2.2.0:
-    resolution: {integrity: sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ==}
-
   arg@4.1.3:
     resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==}
 
-  arg@5.0.2:
-    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
-
   argparse@1.0.10:
     resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
 
@@ -2270,16 +1865,12 @@ packages:
     resolution: {integrity: sha512-itaWrbYbqpGXkGhZPGUulwnhVf5Hpy1xiCFsGqyIGglbBxmG5vSjxQen3/WGOjPpNEv1RtBLKxbmVXm8HpJStQ==}
     engines: {node: '>= 0.4'}
 
-  array-union@2.1.0:
-    resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
-    engines: {node: '>=8'}
-
   array.prototype.findlast@1.2.5:
     resolution: {integrity: sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==}
     engines: {node: '>= 0.4'}
 
-  array.prototype.flat@1.3.2:
-    resolution: {integrity: sha512-djYB+Zx2vLewY8RWlNCUdHjDXs2XOgm602S9E7P/UpHgfeHL00cRiIF+IN/G/aUJ7kGPb6yO/ErDI5V2s8iycA==}
+  array.prototype.flat@1.3.3:
+    resolution: {integrity: sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
     engines: {node: '>= 0.4'}
 
   array.prototype.flatmap@1.3.3:
@@ -2294,34 +1885,13 @@ packages:
     resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
     engines: {node: '>= 0.4'}
 
-  asn1@0.2.6:
-    resolution: {integrity: sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==}
-
-  assert-plus@1.0.0:
-    resolution: {integrity: sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==}
-    engines: {node: '>=0.8'}
-
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
 
-  ast-module-types@6.0.0:
-    resolution: {integrity: sha512-LFRg7178Fw5R4FAEwZxVqiRI8IxSM+Ay2UBrHoCerXNme+kMMMfz7T3xDGV/c2fer87hcrtgJGsnSOfUrPK6ng==}
-    engines: {node: '>=18'}
-
-  astral-regex@2.0.0:
-    resolution: {integrity: sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
-    engines: {node: '>=8'}
-
-  async@3.2.6:
-    resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
-
-  asynckit@0.4.0:
-    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
-
-  at-least-node@1.0.0:
-    resolution: {integrity: sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==}
-    engines: {node: '>= 4.0.0'}
+  async-function@1.0.0:
+    resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
+    engines: {node: '>= 0.4'}
 
   attr-accept@2.2.5:
     resolution: {integrity: sha512-0bDNnY/u6pPwHDMoF0FieU354oBi0a8rD9FcsLwzcGWbc8KS8KPIi7y+s13OlVY+gMWc/9xEMUgNE6Qm8ZllYQ==}
@@ -2331,23 +1901,13 @@ packages:
     resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
     engines: {node: '>= 0.4'}
 
-  aws-sign2@0.7.0:
-    resolution: {integrity: sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA==}
-
-  aws4@1.13.2:
-    resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==}
-
-  axe-core@4.10.2:
-    resolution: {integrity: sha512-RE3mdQ7P3FRSe7eqCWoeQ/Z9QXrtniSjp1wUjt5nRC3WIpz5rSCve6o3fsZ2aCpJtrZjSZgjwXAoTO5k4tEI0w==}
+  axe-core@4.10.3:
+    resolution: {integrity: sha512-Xm7bpRXnDSX2YE2YFfBk2FnF0ep6tmG7xPh8iHee8MIcrgq762Nkce856dYtJYLkuIoYZvGfTs/PbZhideTcEg==}
     engines: {node: '>=4'}
 
   b4a@1.6.7:
     resolution: {integrity: sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==}
 
-  backoff@2.5.0:
-    resolution: {integrity: sha512-wC5ihrnUXmR2douXmXLCe5O3zg3GKIyvRi/hi58a/XyRxVI+3/yM0PYueQOZXPXQ9pxBislYkw+sF9b7C/RuMA==}
-    engines: {node: '>= 0.6'}
-
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
 
@@ -2358,40 +1918,43 @@ packages:
     resolution: {integrity: sha512-vjtV3hiLqYDNRoiAv0zC4QaGAMPomEoq83PRmYIofPswwZurCeWR5LByXm7SyoL0Zh5+2z0+HC7jG8gSZJUh0w==}
     engines: {node: '>= 16'}
 
-  bare-events@2.5.0:
-    resolution: {integrity: sha512-/E8dDe9dsbLyh2qrZ64PEPadOQ0F4gbl1sUJOrmph7xOiIxfY8vwab/4bFLh4Y88/Hk/ujKcrQKc+ps0mv873A==}
+  bare-events@2.5.4:
+    resolution: {integrity: sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==}
 
-  bare-fs@2.3.5:
-    resolution: {integrity: sha512-SlE9eTxifPDJrT6YgemQ1WGFleevzwY+XAP1Xqgl56HtcrisC2CHCZ2tq6dBpcH2TnNxwUEUGhweo+lrQtYuiw==}
-
-  bare-os@2.4.4:
-    resolution: {integrity: sha512-z3UiI2yi1mK0sXeRdc4O1Kk8aOa/e+FNWZcTiPB/dfTWyLypuE99LibgRaQki914Jq//yAWylcAt+mknKdixRQ==}
-
-  bare-path@2.1.3:
-    resolution: {integrity: sha512-lh/eITfU8hrj9Ru5quUp0Io1kJWIk1bTjzo7JH1P5dWmQ2EL4hFUlfI8FonAhSlgIfhn63p84CDY/x+PisgcXA==}
+  bare-fs@4.1.5:
+    resolution: {integrity: sha512-1zccWBMypln0jEE05LzZt+V/8y8AQsQQqxtklqaIyg5nu6OAYFhZxPXinJTSG+kU5qyNmeLgcn9AW7eHiCHVLA==}
+    engines: {bare: '>=1.16.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
 
-  bare-stream@2.4.2:
-    resolution: {integrity: sha512-XZ4ln/KV4KT+PXdIWTKjsLY+quqCaEtqqtgGJVPw9AoM73By03ij64YjepK0aQvHSWDb6AfAZwqKaFu68qkrdA==}
+  bare-os@3.6.1:
+    resolution: {integrity: sha512-uaIjxokhFidJP+bmmvKSgiMzj2sV5GPHaZVAIktcxcpCyBFFWO+YlikVAdhmUo2vYFvFhOXIAlldqV29L8126g==}
+    engines: {bare: '>=1.14.0'}
 
-  base64-js@1.5.1:
-    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+  bare-path@3.0.0:
+    resolution: {integrity: sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==}
 
-  bcrypt-pbkdf@1.0.2:
-    resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
+  bare-stream@2.6.5:
+    resolution: {integrity: sha512-jSmxKJNJmHySi6hC42zlZnq00rga4jjxcgNZjY9N5WlOe/iOoGRtdwGsHzQv2RlH2KOYMwGUXhf2zXd32BA9RA==}
+    peerDependencies:
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true
 
-  before-after-hook@3.0.2:
-    resolution: {integrity: sha512-Nik3Sc0ncrMK4UUdXQmAnRtzmNQTAAXmXIopizwZ1W1t8QmfJj+zL4OA2I7XPTPW5z5TDqv4hRo/JzouDJnX3A==}
+  before-after-hook@4.0.0:
+    resolution: {integrity: sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==}
 
   binary-extensions@2.3.0:
     resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
     engines: {node: '>=8'}
 
-  blob-util@2.0.2:
-    resolution: {integrity: sha512-T7JQa+zsXXEa6/8ZhHcQEW1UFfVM49Ts65uBkFL6fz2QmrElqmbajIDJvuA0tEhRe5eIjpV9ZF+0RfZR9voJFQ==}
-
-  bluebird@3.7.2:
-    resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
-
   bootstrap@3.4.1:
     resolution: {integrity: sha512-yN5oZVmRCwe5aKwzRj6736nSmKDX7pLYwsXiCj/EYmo16hODaBiT4En5btW/jhBF/seV+XMx3aYwukYC3A49DA==}
     engines: {node: '>=6'}
@@ -2399,8 +1962,11 @@ packages:
   brace-expansion@1.1.11:
     resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
 
-  brace-expansion@2.0.1:
-    resolution: {integrity: sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==}
+  brace-expansion@1.1.12:
+    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
+
+  brace-expansion@2.0.2:
+    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
 
   brace-expansion@4.0.0:
     resolution: {integrity: sha512-l/mOwLWs7BQIgOKrL46dIAbyCKvPV7YJPDspkuc88rHsZRlg3hptUGdU7Trv0VFP4d3xnSGBQrKu5ZvGB7UeIw==}
@@ -2416,38 +1982,28 @@ packages:
   browserify-zlib@0.1.4:
     resolution: {integrity: sha512-19OEpq7vWgsH6WkvkBJQDFvJS1uPcbFOQ4v9CU839dO+ZZXUZO6XpE6hNCqvlIIj+4fZvRiJ6DsAQ382GwiyTQ==}
 
-  browserslist@4.24.2:
-    resolution: {integrity: sha512-ZIc+Q62revdMcqC6aChtW4jz3My3klmCO1fEmINZY/8J3EpBg5/A/D0AKmBveUh6pgoeycoMkVMko84tuYS+Gg==}
+  browserslist@4.24.4:
+    resolution: {integrity: sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
-  buffer-crc32@0.2.13:
-    resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
-
   buffer-from@1.1.2:
     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
 
-  buffer@5.7.1:
-    resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}
-
   cac@6.7.14:
     resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
     engines: {node: '>=8'}
 
-  cachedir@2.4.0:
-    resolution: {integrity: sha512-9EtFOZR8g22CL7BWjJ9BUx1+A/djkofnyW3aOXZORNW2kxoUpx2h+uN2cOqwPmFhnpVmxg+KW2OjOSgChTEvsQ==}
-    engines: {node: '>=6'}
-
-  call-bind-apply-helpers@1.0.1:
-    resolution: {integrity: sha512-BhYE+WDaywFg2TBWYNXAE+8B1ATnThNBqXHP5nQu0jWJdVvY2hvkpyB3qOmtmDePiS5/BDQ8wASEWGMWRG148g==}
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
 
   call-bind@1.0.8:
     resolution: {integrity: sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==}
     engines: {node: '>= 0.4'}
 
-  call-bound@1.0.3:
-    resolution: {integrity: sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA==}
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
     engines: {node: '>= 0.4'}
 
   callsites@3.1.0:
@@ -2462,17 +2018,14 @@ packages:
     resolution: {integrity: sha512-cgRwKKavoDKLTjO4FQTs3dRBePZp/2Y9Xpud0FhuCOTE86M2cniKN4CCXgRnsyXNMmQMifVHcv6SPaMtTx6ofQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  caniuse-lite@1.0.30001684:
-    resolution: {integrity: sha512-G1LRwLIQjBQoyq0ZJGqGIJUXzJ8irpbjHLpVRXDvBEScFJ9b17sgK6vlx0GAJFE21okD7zXl08rRRUfq6HdoEQ==}
-
-  caseless@0.12.0:
-    resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==}
+  caniuse-lite@1.0.30001700:
+    resolution: {integrity: sha512-2S6XIXwaE7K7erT8dY+kLQcpa5ms63XlRkMkReXjle+kf6c5g38vyMl+Z5y8dSxOFDhcFe+nxnn261PLxBSQsQ==}
 
   ccount@2.0.1:
     resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
 
-  chai@5.1.2:
-    resolution: {integrity: sha512-aGtmf24DW6MLHHG5gCx4zaI3uBq3KRtxeVs0DjFH6Z0rDNbsvTxFASFvdj79pxjxZ8/5u3PIiN3IwEIQkiiuPw==}
+  chai@5.2.0:
+    resolution: {integrity: sha512-mCuXncKXk5iCLhfhwTc0izo0gtEmpz5CtG2y8GiOINBlMVS6v8TMRc5TaLWKS6692m9+dVVfzgeVxR5UxWHTYw==}
     engines: {node: '>=12'}
 
   chalk@3.0.0:
@@ -2503,51 +2056,28 @@ packages:
     resolution: {integrity: sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==}
     engines: {node: '>= 16'}
 
-  check-more-types@2.24.0:
-    resolution: {integrity: sha512-Pj779qHxV2tuapviy1bSZNEL1maXr13bPYpsvSDB68HlYcYuhlDrmGd63i0JHMCLKzc7rUSNIrpdJlhVlNwrxA==}
-    engines: {node: '>= 0.8.0'}
-
   chokidar@3.6.0:
     resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
     engines: {node: '>= 8.10.0'}
 
-  ci-info@4.1.0:
-    resolution: {integrity: sha512-HutrvTNsF48wnxkzERIXOe5/mlcfFcbfCmwcg6CJnizbSue78AbDt+1cgl26zwn61WFxhcPykPfZrbqjGmBb4A==}
-    engines: {node: '>=8'}
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
 
   classcat@5.0.5:
     resolution: {integrity: sha512-JhZUT7JFcQy/EzW605k/ktHtncoo9vnyW/2GspNYwFlN1C/WmjuV/xtS04e9SOkL2sTdw0VAZ2UGCcQ9lR6p6w==}
 
-  clean-stack@2.2.0:
-    resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==}
-    engines: {node: '>=6'}
-
-  cli-cursor@3.1.0:
-    resolution: {integrity: sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==}
-    engines: {node: '>=8'}
-
   cli-cursor@5.0.0:
     resolution: {integrity: sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==}
     engines: {node: '>=18'}
 
-  cli-table3@0.6.5:
-    resolution: {integrity: sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
-    engines: {node: 10.* || >= 12.*}
-
-  cli-truncate@2.1.0:
-    resolution: {integrity: sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==}
-    engines: {node: '>=8'}
-
   cli-truncate@4.0.0:
     resolution: {integrity: sha512-nPdaFdQ0h/GEigbPClz11D0v/ZJEwxmeVZGeMo3Z5StPtUTkA9o1lD6QwoirYiSDzbcwn2XcjwmCp68W1IS4TA==}
     engines: {node: '>=18'}
 
-  cliui@7.0.4:
-    resolution: {integrity: sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==}
-
-  clone@1.0.4:
-    resolution: {integrity: sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==}
-    engines: {node: '>=0.8'}
+  cliui@8.0.1:
+    resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
+    engines: {node: '>=12'}
 
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
@@ -2559,32 +2089,16 @@ packages:
   colorette@2.0.20:
     resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
 
-  combined-stream@1.0.8:
-    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
-    engines: {node: '>= 0.8'}
-
   comma-separated-tokens@2.0.3:
     resolution: {integrity: sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==}
 
-  commander@12.1.0:
-    resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
-    engines: {node: '>=18'}
+  commander@14.0.0:
+    resolution: {integrity: sha512-2uM9rYjPvyq39NwLRqaiLtWHyDC1FvryJDa2ATTVims5YAS4PupsEQsDvP14FqhFr0P49CYDugi59xaxJlTXRA==}
+    engines: {node: '>=20'}
 
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
-  commander@6.2.1:
-    resolution: {integrity: sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==}
-    engines: {node: '>= 6'}
-
-  commander@8.3.0:
-    resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
-    engines: {node: '>= 12'}
-
-  common-tags@1.8.2:
-    resolution: {integrity: sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA==}
-    engines: {node: '>=4.0.0'}
-
   commondir@1.0.1:
     resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
 
@@ -2597,24 +2111,22 @@ packages:
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
-  console.table@0.10.0:
-    resolution: {integrity: sha512-dPyZofqggxuvSf7WXvNjuRfnsOk1YazkVP8FdxH4tcH2c37wc79/Yl6Bhr7Lsu00KMgy2ql/qCMuNu8xctZM8g==}
-    engines: {node: '> 0.10'}
+  confbox@0.2.2:
+    resolution: {integrity: sha512-1NB+BKqhtNipMsov4xI/NnhCKp9XG9NamYp5PVm9klAT0fsrNPjaFICsCFhNhwZJKNh7zB/3q8qXz0E9oaMNtQ==}
 
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
-  core-util-is@1.0.2:
-    resolution: {integrity: sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==}
-
   core-util-is@1.0.3:
     resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
 
   create-require@1.1.1:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
 
-  cross-fetch@4.0.0:
-    resolution: {integrity: sha512-e4a5N8lVvuLgAWgnCrLr2PP0YyDOTHa9H/Rj54dirp61qXnNq46m82bRhNqIA5VccJtWBvPTFRV3TtvHUKPB1g==}
+  cross-env@7.0.3:
+    resolution: {integrity: sha512-+/HKd6EgcQCJGh2PSjZuUitQBQynKor4wrFbRg4DtAgS1aWO+gU52xpH7M9ScGgXSYmAVS9bIJ8EzuaGw0oNAw==}
+    engines: {node: '>=10.14', npm: '>=6', yarn: '>=1'}
+    hasBin: true
 
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
@@ -2623,29 +2135,13 @@ packages:
   css.escape@1.5.1:
     resolution: {integrity: sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==}
 
-  cssstyle@4.2.1:
-    resolution: {integrity: sha512-9+vem03dMXG7gDmZ62uqmRiMRNtinIZ9ZyuF6BdxzfOD+FdN5hretzynkn0ReS2DO2GSw76RWHs0UmJPI2zUjw==}
+  cssstyle@4.3.0:
+    resolution: {integrity: sha512-6r0NiY0xizYqfBvWp1G7WXJ06/bZyrk7Dc6PHql82C/pKGUTKu4yAX4Y8JPamb1ob9nBKuxWzCGTRuGwU3yxJQ==}
     engines: {node: '>=18'}
 
   csstype@3.1.3:
     resolution: {integrity: sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==}
 
-  cypress-axe@1.5.0:
-    resolution: {integrity: sha512-Hy/owCjfj+25KMsecvDgo4fC/781ccL+e8p+UUYoadGVM2ogZF9XIKbiM6KI8Y3cEaSreymdD6ZzccbI2bY0lQ==}
-    engines: {node: '>=10'}
-    peerDependencies:
-      axe-core: ^3 || ^4
-      cypress: ^10 || ^11 || ^12 || ^13
-
-  cypress-split@1.24.7:
-    resolution: {integrity: sha512-JOxWgCQHi/JMOwznm6VF7V1GHYEM9Mxz6EipZu9WgQtqnRjk3QX6lBXJMjRXOPqArguL9S49OSFUQXDiC19hBg==}
-    hasBin: true
-
-  cypress@13.17.0:
-    resolution: {integrity: sha512-5xWkaPurwkIljojFidhw8lFScyxhtiFHl/i/3zov+1Z5CmY4t9tjIdvSXfu82Y3w7wt0uR9KkucbhkVvJZLQSA==}
-    engines: {node: ^16.0.0 || ^18.0.0 || >=20.0.0}
-    hasBin: true
-
   d3-color@3.1.0:
     resolution: {integrity: sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==}
     engines: {node: '>=12'}
@@ -2684,13 +2180,6 @@ packages:
     resolution: {integrity: sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw==}
     engines: {node: '>=12'}
 
-  dagre@0.8.5:
-    resolution: {integrity: sha512-/aTqmnRta7x7MCCpExk7HQL2O4owCT2h8NT//9I1OQ9vt29Pa0BzSAkR5lwFUcQ7491yVi/3CXU9jQ5o0Mn2Sw==}
-
-  dashdash@1.14.1:
-    resolution: {integrity: sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==}
-    engines: {node: '>=0.10'}
-
   data-urls@5.0.0:
     resolution: {integrity: sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==}
     engines: {node: '>=18'}
@@ -2707,31 +2196,11 @@ packages:
     resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
     engines: {node: '>= 0.4'}
 
-  dayjs@1.11.13:
-    resolution: {integrity: sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg==}
-
   de-indent@1.0.2:
     resolution: {integrity: sha512-e/1zu3xH5MQryN2zdVaF0OrdNLUbvWxzMbi+iNA6Bky7l1RoP8a2fIbRocyHclXt/arDrrR6lL3TqFD9pMQTsg==}
 
-  debug@3.2.7:
-    resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
-  debug@4.3.4:
-    resolution: {integrity: sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==}
-    engines: {node: '>=6.0'}
-    peerDependencies:
-      supports-color: '*'
-    peerDependenciesMeta:
-      supports-color:
-        optional: true
-
-  debug@4.3.7:
-    resolution: {integrity: sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==}
+  debug@4.4.0:
+    resolution: {integrity: sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==}
     engines: {node: '>=6.0'}
     peerDependencies:
       supports-color: '*'
@@ -2739,8 +2208,8 @@ packages:
       supports-color:
         optional: true
 
-  debug@4.4.0:
-    resolution: {integrity: sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==}
+  debug@4.4.1:
+    resolution: {integrity: sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==}
     engines: {node: '>=6.0'}
     peerDependencies:
       supports-color: '*'
@@ -2752,20 +2221,16 @@ packages:
     resolution: {integrity: sha512-9iE1PgSik9HeIIw2JO94IidnE3eBoQrFJ3w7sFuzSX4DpmZ3v5sZpUiV5Swcf6mQEF+Y0ru8Neo+p+nyh2J+hQ==}
     engines: {node: '>=10'}
 
-  decimal.js@10.4.3:
-    resolution: {integrity: sha512-VBBaLc1MgL5XpzgIP7ny5Z6Nx3UrRkIViUkPUdtl9aya5amy3De1gsUUSB1g3+3sExYNjCAsAznmukyxCb1GRA==}
+  decimal.js@10.5.0:
+    resolution: {integrity: sha512-8vDa8Qxvr/+d94hSh5P3IJwI5t8/c0KsMp+g8bNw9cY2icONa5aPfvKeieW1WlG0WQYwwhJ7mjui2xtiePQSXw==}
 
-  decode-named-character-reference@1.0.2:
-    resolution: {integrity: sha512-O8x12RzrUF8xyVcY0KJowWsmaJxQbmy0/EtnNtHRpsOcT7dFk5W598coHqBVpmWo1oQQfsCqfCmkZN5DJrZVdg==}
+  decode-named-character-reference@1.1.0:
+    resolution: {integrity: sha512-Wy+JTSbFThEOXQIR2L6mxJvEs+veIzpmqD7ynWxMXGpnk3smkHQOp6forLdHsKpAMW9iJpaBBIxz285t1n1C3w==}
 
   deep-eql@5.0.2:
     resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
     engines: {node: '>=6'}
 
-  deep-equal@2.2.3:
-    resolution: {integrity: sha512-ZIwpnevOurS8bpT4192sqAowWM76JDKSHYzMLty3BZGSswgq6pBaH3DhCSW5xVAZICZyKdOBPjwww5wfgT/6PA==}
-    engines: {node: '>= 0.4'}
-
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -2773,9 +2238,6 @@ packages:
     resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
     engines: {node: '>=0.10.0'}
 
-  defaults@1.0.4:
-    resolution: {integrity: sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
-
   define-data-property@1.1.4:
     resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
     engines: {node: '>= 0.4'}
@@ -2784,66 +2246,13 @@ packages:
     resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
     engines: {node: '>= 0.4'}
 
-  delayed-stream@1.0.0:
-    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
-    engines: {node: '>=0.4.0'}
-
-  dependency-tree@11.0.1:
-    resolution: {integrity: sha512-eCt7HSKIC9NxgIykG2DRq3Aewn9UhVS14MB3rEn6l/AsEI1FBg6ZGSlCU0SZ6Tjm2kkhj6/8c2pViinuyKELhg==}
-    engines: {node: '>=18'}
-    hasBin: true
-
   dequal@2.0.3:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
 
-  detect-libc@1.0.3:
-    resolution: {integrity: sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==}
-    engines: {node: '>=0.10'}
-    hasBin: true
-
-  detective-amd@6.0.0:
-    resolution: {integrity: sha512-NTqfYfwNsW7AQltKSEaWR66hGkTeD52Kz3eRQ+nfkA9ZFZt3iifRCWh+yZ/m6t3H42JFwVFTrml/D64R2PAIOA==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  detective-cjs@6.0.0:
-    resolution: {integrity: sha512-R55jTS6Kkmy6ukdrbzY4x+I7KkXiuDPpFzUViFV/tm2PBGtTCjkh9ZmTuJc1SaziMHJOe636dtiZLEuzBL9drg==}
-    engines: {node: '>=18'}
-
-  detective-es6@5.0.0:
-    resolution: {integrity: sha512-NGTnzjvgeMW1khUSEXCzPDoraLenWbUjCFjwxReH+Ir+P6LGjYtaBbAvITWn2H0VSC+eM7/9LFOTAkrta6hNYg==}
-    engines: {node: '>=18'}
-
-  detective-postcss@7.0.0:
-    resolution: {integrity: sha512-pSXA6dyqmBPBuERpoOKKTUUjQCZwZPLRbd1VdsTbt6W+m/+6ROl4BbE87yQBUtLoK7yX8pvXHdKyM/xNIW9F7A==}
-    engines: {node: ^14.0.0 || >=16.0.0}
-    peerDependencies:
-      postcss: ^8.4.38
-
-  detective-sass@6.0.0:
-    resolution: {integrity: sha512-h5GCfFMkPm4ZUUfGHVPKNHKT8jV7cSmgK+s4dgQH4/dIUNh9/huR1fjEQrblOQNDalSU7k7g+tiW9LJ+nVEUhg==}
-    engines: {node: '>=18'}
-
-  detective-scss@5.0.0:
-    resolution: {integrity: sha512-Y64HyMqntdsCh1qAH7ci95dk0nnpA29g319w/5d/oYcHolcGUVJbIhOirOFjfN1KnMAXAFm5FIkZ4l2EKFGgxg==}
-    engines: {node: '>=18'}
-
-  detective-stylus@5.0.0:
-    resolution: {integrity: sha512-KMHOsPY6aq3196WteVhkY5FF+6Nnc/r7q741E+Gq+Ax9mhE2iwj8Hlw8pl+749hPDRDBHZ2WlgOjP+twIG61vQ==}
-    engines: {node: '>=18'}
-
-  detective-typescript@13.0.0:
-    resolution: {integrity: sha512-tcMYfiFWoUejSbvSblw90NDt76/4mNftYCX0SMnVRYzSXv8Fvo06hi4JOPdNvVNxRtCAKg3MJ3cBJh+ygEMH+A==}
-    engines: {node: ^14.14.0 || >=16.0.0}
-    peerDependencies:
-      typescript: ^5.4.4
-
-  detective-vue2@2.1.0:
-    resolution: {integrity: sha512-IHQVhwk7dKaJ+GHBsL27mS9NRO1/vLZJPSODqtJgKquij0/UL8NvrbXbADbYeTkwyh1ReW/v9u9IRyEO5dvGZg==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      typescript: ^5.4.4
+  detect-libc@2.0.4:
+    resolution: {integrity: sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==}
+    engines: {node: '>=8'}
 
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
@@ -2852,14 +2261,10 @@ packages:
     resolution: {integrity: sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==}
     engines: {node: '>=0.3.1'}
 
-  diff@5.2.0:
-    resolution: {integrity: sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==}
+  diff@7.0.0:
+    resolution: {integrity: sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==}
     engines: {node: '>=0.3.1'}
 
-  dir-glob@3.0.1:
-    resolution: {integrity: sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
-    engines: {node: '>=8'}
-
   doctrine@2.1.0:
     resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
     engines: {node: '>=0.10.0'}
@@ -2880,14 +2285,8 @@ packages:
   eastasianwidth@0.2.0:
     resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
 
-  easy-table@1.1.0:
-    resolution: {integrity: sha512-oq33hWOSSnl2Hoh00tZWaIPi1ievrD9aFG82/IgjlycAnW9hHx5PkJiXpxPsgEE+H7BsbVQXFVFST8TEXS6/pA==}
-
-  ecc-jsbn@0.1.2:
-    resolution: {integrity: sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==}
-
-  electron-to-chromium@1.5.67:
-    resolution: {integrity: sha512-nz88NNBsD7kQSAGGJyp8hS6xSPtWwqNogA0mjtc2nUYeEf3nURK9qpV18TuBdDmEDgVWotS8Wkzf+V52dSQ/LQ==}
+  electron-to-chromium@1.5.104:
+    resolution: {integrity: sha512-Us9M2L4cO/zMBqVkJtnj353nQhMju9slHm62NprKTmdF3HH8wYOtNvDFq/JB2+ZRoGLzdvYDiATlMHs98XBM1g==}
 
   emoji-regex@10.4.0:
     resolution: {integrity: sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw==}
@@ -2898,27 +2297,23 @@ packages:
   emoji-regex@9.2.2:
     resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
 
-  end-of-stream@1.4.4:
-    resolution: {integrity: sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==}
-
-  enhanced-resolve@5.17.1:
-    resolution: {integrity: sha512-LMHl3dXhTcfv8gM4kEzIUeTQ+7fpdA0l2tUf34BddXPkz2A5xJ5L/Pchd5BL6rdccM9QGvu0sWZzK1Z1t4wwyg==}
-    engines: {node: '>=10.13.0'}
-
-  enquirer@2.4.1:
-    resolution: {integrity: sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ==}
-    engines: {node: '>=8.6'}
+  end-of-stream@1.4.5:
+    resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
 
   entities@4.5.0:
     resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
     engines: {node: '>=0.12'}
 
+  entities@6.0.0:
+    resolution: {integrity: sha512-aKstq2TDOndCn4diEyp9Uq/Flu2i1GlLkc6XIDQSDMuaFE3OPW5OphLCyQ5SpSJZTb4reN+kTcYru5yIfXoRPw==}
+    engines: {node: '>=0.12'}
+
   environment@1.1.0:
     resolution: {integrity: sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==}
     engines: {node: '>=18'}
 
-  es-abstract@1.23.7:
-    resolution: {integrity: sha512-OygGC8kIcDhXX+6yAZRGLqwi2CmEXCbLQixeGUgYeR+Qwlppqmo7DIDr8XibtEBZp+fJcoYpoatp5qwLMEdcqQ==}
+  es-abstract@1.23.9:
+    resolution: {integrity: sha512-py07lI0wjxAC/DcfK1S6G7iANonniZwTISvdPzk9hzeH0IZIshbuuFxLIU96OyF89Yb9hiqWn8M/bY83KY5vzA==}
     engines: {node: '>= 0.4'}
 
   es-define-property@1.0.1:
@@ -2929,43 +2324,31 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-get-iterator@1.1.3:
-    resolution: {integrity: sha512-sPZmqHBe6JIiTfN5q2pEi//TwxmAFHwj/XEuYjTuse78i8KxaqMTTzxPoFKuzRpDpTJ+0NAbpfenkmH2rePtuw==}
-
   es-iterator-helpers@1.2.1:
     resolution: {integrity: sha512-uDn+FE1yrDzyC0pCo961B2IHbdM8y/ACZsKD4dG6WqrjV53BADjwa7D+1aom2rsNVfLyDgU/eigvlJGJ08OQ4w==}
     engines: {node: '>= 0.4'}
 
-  es-module-lexer@1.5.4:
-    resolution: {integrity: sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==}
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
 
-  es-object-atoms@1.0.0:
-    resolution: {integrity: sha512-MZ4iQ6JwHOBQjahnjwaC1ZtIBH+2ohjamzAO3oaHcXYup7qxjF2fixyH+Q71voWHeOkI2q/TnJao/KfXYIZWbw==}
+  es-object-atoms@1.1.1:
+    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
     engines: {node: '>= 0.4'}
 
-  es-set-tostringtag@2.0.3:
-    resolution: {integrity: sha512-3T8uNMC3OQTHkFUsFq8r/BwAXLHvU/9O9mE0fBc/MY5iq/8H7ncvO947LmYA6ldWw9Uh8Yhf25zu6n7nML5QWQ==}
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
     engines: {node: '>= 0.4'}
 
-  es-shim-unscopables@1.0.2:
-    resolution: {integrity: sha512-J3yBRXCzDu4ULnQwxyToo/OjdMx6akgVC7K6few0a7F/0wLtmKKN7I73AH5T2836UuXRqN7Qg+IIUw/+YJksRw==}
+  es-shim-unscopables@1.1.0:
+    resolution: {integrity: sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
+    engines: {node: '>= 0.4'}
 
   es-to-primitive@1.3.0:
     resolution: {integrity: sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==}
     engines: {node: '>= 0.4'}
 
-  esbuild@0.21.5:
-    resolution: {integrity: sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==}
-    engines: {node: '>=12'}
-    hasBin: true
-
-  esbuild@0.23.1:
-    resolution: {integrity: sha512-VVNz/9Sa0bs5SELtn3f7qhJCDPCF5oMEl5cO9/SSinpE9hbPVvxbd572HH5AKiP7WD8INO53GgfDDhRjkylHEg==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  esbuild@0.24.2:
-    resolution: {integrity: sha512-+9egpBW8I3CD5XPe0n6BfT5fxLzxrlDzqydF3aviG+9ni1lDC/OvMHcxqEFV0+LANZG5R1bFMWfUrjVsdwxJvA==}
+  esbuild@0.25.6:
+    resolution: {integrity: sha512-GVuzuUwtdsghE3ocJ9Bs8PNoF13HNQ5TXbEi2AhvVb8xU1Iwt9Fos9FEamfoee+u/TOsn7GUWc04lz46n2bbTg==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -2973,55 +2356,35 @@ packages:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
 
-  escape-string-regexp@1.0.5:
-    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
-    engines: {node: '>=0.8.0'}
-
   escape-string-regexp@4.0.0:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
 
-  escodegen@2.1.0:
-    resolution: {integrity: sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==}
-    engines: {node: '>=6.0'}
-    hasBin: true
-
-  eslint-config-prettier@10.0.1:
-    resolution: {integrity: sha512-lZBts941cyJyeaooiKxAtzoPHTN+GbQTJFAIdQbRhA4/8whaAraEh47Whw/ZFfrjNSnlAxqfm9i0XVAEkULjCw==}
+  eslint-config-prettier@10.1.5:
+    resolution: {integrity: sha512-zc1UmCpNltmVY34vuLRV61r1K27sWuX39E+uyUnY8xS2Bex88VV9cugG+UZbRSRGtGyFboj+D8JODyme1plMpw==}
     hasBin: true
     peerDependencies:
       eslint: '>=7.0.0'
 
-  eslint-plugin-cypress@4.1.0:
-    resolution: {integrity: sha512-JhqkMY02mw74USwK9OFhectx3YSj6Co1NgWBxlGdKvlqiAp9vdEuQqt33DKGQFvvGS/NWtduuhWXWNnU29xDSg==}
-    peerDependencies:
-      eslint: '>=9'
-
   eslint-plugin-lodash@8.0.0:
     resolution: {integrity: sha512-7DA8485FolmWRzh+8t4S8Pzin2TTuWfb0ZW3j/2fYElgk82ZanFz8vDcvc4BBPceYdX1p/za+tkbO68maDBGGw==}
     engines: {node: '>=10'}
     peerDependencies:
       eslint: '>=9.0.0'
 
-  eslint-plugin-mocha@10.5.0:
-    resolution: {integrity: sha512-F2ALmQVPT1GoP27O1JTZGrV9Pqg8k79OeIuvw63UxMtQKREZtmkK1NFgkZQ2TW7L2JSSFKHFPTtHu5z8R9QNRw==}
-    engines: {node: '>=14.0.0'}
-    peerDependencies:
-      eslint: '>=7.0.0'
-
-  eslint-plugin-playwright@2.1.0:
-    resolution: {integrity: sha512-wMbHOehofSB1cBdzz2CLaCYaKNLeTQ0YnOW+7AHa281TJqlpEJUBgTHbRUYOUxiXphfWwOyTPvgr6vvEmArbSA==}
+  eslint-plugin-playwright@2.2.0:
+    resolution: {integrity: sha512-qSQpAw7RcSzE3zPp8FMGkthaCWovHZ/BsXtpmnGax9vQLIovlh1bsZHEa2+j2lv9DWhnyeLM/qZmp7ffQZfQvg==}
     engines: {node: '>=16.6.0'}
     peerDependencies:
       eslint: '>=8.40.0'
 
-  eslint-plugin-prettier@5.2.1:
-    resolution: {integrity: sha512-gH3iR3g4JfF+yYPaJYkN7jEl9QbweL/YfkoRlNnuIEHEz1vHVlCmWOS+eGGiRuzHQXdJFCOTxRgvju9b8VUmrw==}
+  eslint-plugin-prettier@5.5.1:
+    resolution: {integrity: sha512-dobTkHT6XaEVOo8IO90Q4DOSxnm3Y151QxPJlM/vKC0bVy+d6cVWQZLlFiuZPP0wS6vZwSKeJgKkcS+KfMBlRw==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       '@types/eslint': '>=8.0.0'
       eslint: '>=8.0.0'
-      eslint-config-prettier: '*'
+      eslint-config-prettier: '>= 7.0.0 <10.0.0 || >=10.1.0'
       prettier: '>=3.0.0'
     peerDependenciesMeta:
       '@types/eslint':
@@ -3029,48 +2392,38 @@ packages:
       eslint-config-prettier:
         optional: true
 
-  eslint-plugin-react-compiler@19.0.0-beta-55955c9-20241229:
-    resolution: {integrity: sha512-KsE6bQrNvtPDbMb9EolZ2C+Z2/uv2Y5cAUgN+pzbriXjKlf1FkbgiyE153m2mIT6gEZq2OrtFvX7uJj5IrNQlg==}
+  eslint-plugin-react-compiler@19.0.0-beta-714736e-20250131:
+    resolution: {integrity: sha512-iTPUaHzvBejGqicSwZLCDBgWBxLzU1Dvqjs31loNoOPRnsey5dcOupaZajECKVvXmB1wcbIWNp6/VR5+dM9d6w==}
     engines: {node: ^14.17.0 || ^16.0.0 || >= 18.0.0}
     peerDependencies:
       eslint: '>=7'
 
-  eslint-plugin-react-hooks@5.0.0:
-    resolution: {integrity: sha512-hIOwI+5hYGpJEc4uPRmz2ulCjAGD/N13Lukkh8cLV0i2IRk/bdZDYjgLVHj+U9Z704kLIdIO6iueGvxNur0sgw==}
+  eslint-plugin-react-hooks@5.2.0:
+    resolution: {integrity: sha512-+f15FfK64YQwZdJNELETdn5ibXEUQmW1DZL6KXhNnc2heoy/sg9VJJeT7n8TlMWouzWqSWavFkIhHyIbIAEapg==}
     engines: {node: '>=10'}
     peerDependencies:
       eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0
 
-  eslint-plugin-react@7.37.4:
-    resolution: {integrity: sha512-BGP0jRmfYyvOyvMoRX/uoUeW+GqNj9y16bPQzqAHf3AYII/tDs+jMN0dBVkl88/OZwNGwrVFxE7riHsXVfy/LQ==}
+  eslint-plugin-react@7.37.5:
+    resolution: {integrity: sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==}
     engines: {node: '>=4'}
     peerDependencies:
       eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
 
-  eslint-scope@8.2.0:
-    resolution: {integrity: sha512-PHlWUfG6lvPc3yvP5A4PNyBL1W8fkDUccmI21JUu/+GKZBoH/W5u6usENXUrWFRsyoW5ACUjFGgAFQp5gUlb/A==}
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  eslint-utils@3.0.0:
-    resolution: {integrity: sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==}
-    engines: {node: ^10.0.0 || ^12.0.0 || >= 14.0.0}
-    peerDependencies:
-      eslint: '>=5'
-
-  eslint-visitor-keys@2.1.0:
-    resolution: {integrity: sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==}
-    engines: {node: '>=10'}
-
   eslint-visitor-keys@3.4.3:
     resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  eslint-visitor-keys@4.2.0:
-    resolution: {integrity: sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==}
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  eslint@9.18.0:
-    resolution: {integrity: sha512-+waTfRWQlSbpt3KWE+CjrPPYnbq9kfZIYUqapc0uBXyjTp8aYXZDsUH16m39Ryq3NjAVP4tjuF7KaukeqoCoaA==}
+  eslint@9.30.1:
+    resolution: {integrity: sha512-zmxXPNMOXmwm9E0yQLi5uqXHs7uq2UIiqEKo3Gq+3fwo1XrJ+hijAZImyF7hclW3E6oHz43Yk3RP8at6OTKflQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     hasBin: true
     peerDependencies:
@@ -3083,10 +2436,9 @@ packages:
     resolution: {integrity: sha512-0QYC8b24HWY8zjRnDTL6RiHfDbAWn63qb4LMj1Z4b076A4une81+z03Kg7l7mn/48PUTqoLptSXez8oknU8Clg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  esprima@4.0.1:
-    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
-    engines: {node: '>=4'}
-    hasBin: true
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
   esquery@1.6.0:
     resolution: {integrity: sha512-ca9pw9fomFcKPvFLXhBKUK90ZvGibiGOvRJNbjljY7s7uq/5YO4BOzcYtJqExdx99rF6aAcnRxHmcUHcz6sQsg==}
@@ -3110,46 +2462,21 @@ packages:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
-  eventemitter2@6.4.7:
-    resolution: {integrity: sha512-tYUSVOGeQPKt/eC1ABfhHy5Xd96N3oIijJvN3O9+TsC28T5V9yX9oEfEK5faP0EFSNVOG97qtAS68GBrQB2hDg==}
-
   eventemitter3@5.0.1:
     resolution: {integrity: sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==}
 
-  execa@4.1.0:
-    resolution: {integrity: sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==}
-    engines: {node: '>=10'}
-
-  execa@8.0.1:
-    resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==}
-    engines: {node: '>=16.17'}
-
-  executable@4.1.1:
-    resolution: {integrity: sha512-8iA79xD3uAch729dUG8xaaBBFGaEa0wdD2VkYLFHwlqosEj/jT66AzcreRDSgV7ehnNLBW2WR5jIXwGKjVdTLg==}
-    engines: {node: '>=4'}
-
-  expect-type@1.1.0:
-    resolution: {integrity: sha512-bFi65yM+xZgk+u/KRIpekdSYkTB5W1pEf0Lt8Q8Msh7b+eQ7LXVtIB1Bkm4fvclDEL1b2CZkMhv2mOeF8tMdkA==}
+  expect-type@1.2.1:
+    resolution: {integrity: sha512-/kP8CAwxzLVEeFrMm4kMmy4CCDlpipyA7MYLVrdJIkV0fYF0UaigQHRsxHiuY/GEea+bh4KSv3TIlgr+2UL6bw==}
     engines: {node: '>=12.0.0'}
 
+  exsolve@1.0.5:
+    resolution: {integrity: sha512-pz5dvkYYKQ1AHVrgOzBKWeP4u4FRb3a6DNK2ucr0OoNwYIU4QWsJ+NM36LLzORT+z845MzKHHhpXiUF5nvQoJg==}
+
   extend@3.0.2:
     resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
 
-  extract-zip@2.0.1:
-    resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==}
-    engines: {node: '>= 10.17.0'}
-    hasBin: true
-
-  extsprintf@1.3.0:
-    resolution: {integrity: sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==}
-    engines: {'0': node >=0.6.0}
-
-  extsprintf@1.4.1:
-    resolution: {integrity: sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==}
-    engines: {'0': node >=0.6.0}
-
-  fast-content-type-parse@2.0.1:
-    resolution: {integrity: sha512-nGqtvLrj5w0naR6tDPfB4cUmYCqouzyQiz6C5y/LtcDllJdrcc6WaWW6iXyIIOErTa/XRybj28aasdn4LkVk6Q==}
+  fast-content-type-parse@3.0.0:
+    resolution: {integrity: sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==}
 
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
@@ -3160,8 +2487,8 @@ packages:
   fast-fifo@1.3.2:
     resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
 
-  fast-glob@3.3.2:
-    resolution: {integrity: sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==}
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
     engines: {node: '>=8.6.0'}
 
   fast-json-stable-stringify@2.1.0:
@@ -3170,27 +2497,17 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-shuffle@6.1.1:
-    resolution: {integrity: sha512-HPxFJxEi18KPmVQuK5Hi5l4KSl3u50jtaxseRrPqrxewqfvU+sTPTaUpP33Hj+NdJoLuJP5ipx3ybTr+fa6dEw==}
-
-  fastq@1.17.1:
-    resolution: {integrity: sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==}
+  fastq@1.19.1:
+    resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
 
-  fd-slicer@1.1.0:
-    resolution: {integrity: sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==}
-
-  fdir@6.4.2:
-    resolution: {integrity: sha512-KnhMXsKSPZlAhp7+IjUkRZKPb4fUyccpDrdFXbi4QL1qkmFh9kVY09Yox+n4MaOb3lHZ1Tv829C3oaaXoMYPDQ==}
+  fdir@6.4.6:
+    resolution: {integrity: sha512-hiFoqpyZcfNm1yc4u8oWCf9A2c4D3QjCrks3zmoVKVxpQRzmPNar1hUJcBG2RQHvEVGDN+Jm81ZheVLAQMK6+w==}
     peerDependencies:
       picomatch: ^3 || ^4
     peerDependenciesMeta:
       picomatch:
         optional: true
 
-  figures@3.2.0:
-    resolution: {integrity: sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==}
-    engines: {node: '>=8'}
-
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
     engines: {node: '>=16.0.0'}
@@ -3202,24 +2519,10 @@ packages:
     resolution: {integrity: sha512-QgXo+mXTe8ljeqUFaX3QVHc5osSItJ/Km+xpocx0aSqWGMSCf6qYs/VnzZgS864Pjn5iceMRFigeAV7AfTlaig==}
     engines: {node: '>= 12'}
 
-  filing-cabinet@5.0.2:
-    resolution: {integrity: sha512-RZlFj8lzyu6jqtFBeXNqUjjNG6xm+gwXue3T70pRxw1W40kJwlgq0PSWAmh0nAnn5DHuBIecLXk9+1VKS9ICXA==}
-    engines: {node: '>=18'}
-    hasBin: true
-
   fill-range@7.1.1:
     resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
     engines: {node: '>=8'}
 
-  find-cypress-specs@1.46.2:
-    resolution: {integrity: sha512-eXvGQMftYDTbQflVX6TzJj7hA0ypO5+FfUrnMdRf1+yCu5xVY5wPv721AWp/xPBOpQXwx5jdoZRH9m95U/1c7A==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  find-test-names@1.28.30:
-    resolution: {integrity: sha512-b5PLJ5WnskdaYHBf+38FN/4TKh5lqwrltITkqxuARsN2bW6civrhqOXbVA+4727YNowYLt/jtIC9Dsn7eJSP6A==}
-    hasBin: true
-
   find-up@5.0.0:
     resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
     engines: {node: '>=10'}
@@ -3237,8 +2540,8 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
-  flatted@3.3.2:
-    resolution: {integrity: sha512-AiwGJM8YcNOaobumgtng+6NHuOqC3A7MixFeDafM3X9cIUM+xUXoS5Vfgf+OihAYe20fxqNM9yPBXJzRtZ/4eA==}
+  flatted@3.3.3:
+    resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
 
   focus-trap@7.6.2:
     resolution: {integrity: sha512-9FhUxK1hVju2+AiQIDJ5Dd//9R2n2RAfJ0qfhF4IHGHgcoEUTMpbTeG/zbEuwaiYXfuAH6XE0/aCyxDdRM+W5w==}
@@ -3247,34 +2550,17 @@ packages:
     resolution: {integrity: sha512-U6kGnykA/6bFmg1M/oT9EkFeIYv7JlX3bozwQJWiiLz6L0w3F5vBVPxHlwyX/vtNq1ckcpRKOB9f2Qal/VtFpg==}
     engines: {node: '>=0.10.3'}
 
-  for-each@0.3.3:
-    resolution: {integrity: sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==}
-
-  foreground-child@3.3.0:
-    resolution: {integrity: sha512-Ld2g8rrAyMYFXBhEqMz8ZAHBi4J4uS1i/CxGMDnjyFWddMXLVcDp051DZfu+t7+ab7Wv6SMqpWmyFIj5UbfFvg==}
-    engines: {node: '>=14'}
-
-  forever-agent@0.6.1:
-    resolution: {integrity: sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==}
-
-  form-data@4.0.1:
-    resolution: {integrity: sha512-tzN8e4TX8+kkxGPK8D5u0FNmjPUjw3lwC9lSLxxoB/+GtsJG91CO8bSWy73APlgAZzZbXEYZJuxjkHH2w+Ezhw==}
-    engines: {node: '>= 6'}
-
-  fs-extra@11.2.0:
-    resolution: {integrity: sha512-PmDi3uwK5nFuXh7XDTlVnS17xJS7vW36is2+w3xcv8SVxiB4NyATf4ctkVY5bkSjX0Y4nbvZCq1/EjtEyr9ktw==}
-    engines: {node: '>=14.14'}
-
-  fs-extra@7.0.1:
-    resolution: {integrity: sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==}
-    engines: {node: '>=6 <7 || >=8'}
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
 
-  fs-extra@9.1.0:
-    resolution: {integrity: sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==}
-    engines: {node: '>=10'}
+  foreground-child@3.3.1:
+    resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
+    engines: {node: '>=14'}
 
-  fs.realpath@1.0.0:
-    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
+  fs-extra@11.3.0:
+    resolution: {integrity: sha512-Z4XaCL6dUDHfP/jT25jJKMmtxvuwbkrD1vNSMFlo9lNLY2c5FHYSQgHPRZUjAB26TpDEoW9HCOgplrdbaPV/ew==}
+    engines: {node: '>=14.14'}
 
   fsevents@2.3.2:
     resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
@@ -3300,10 +2586,6 @@ packages:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
 
-  get-amd-module-type@6.0.0:
-    resolution: {integrity: sha512-hFM7oivtlgJ3d6XWD6G47l8Wyh/C6vFw5G24Kk1Tbq85yh5gcM8Fne5/lFhiuxB+RT6+SI7I1ThB9lG4FBh3jw==}
-    engines: {node: '>=18'}
-
   get-caller-file@2.0.5:
     resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
     engines: {node: 6.* || 8.* || >= 10.*}
@@ -3312,33 +2594,20 @@ packages:
     resolution: {integrity: sha512-vpeMIQKxczTD/0s2CdEWHcb0eeJe6TFjxb+J5xgX7hScxqrGuyjmv4c1D4A/gelKfyox0gJJwIHF+fLjeaM8kQ==}
     engines: {node: '>=18'}
 
-  get-intrinsic@1.2.6:
-    resolution: {integrity: sha512-qxsEs+9A+u85HhllWJJFicJfPDhRmjzoYdl64aMWW9yRIJmSyxdn8IEkuIM530/7T+lv0TIHd8L6Q/ra0tEoeA==}
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
     engines: {node: '>= 0.4'}
 
-  get-own-enumerable-property-symbols@3.0.2:
-    resolution: {integrity: sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g==}
-
-  get-stream@5.2.0:
-    resolution: {integrity: sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==}
-    engines: {node: '>=8'}
-
-  get-stream@8.0.1:
-    resolution: {integrity: sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA==}
-    engines: {node: '>=16'}
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
 
   get-symbol-description@1.1.0:
     resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
     engines: {node: '>= 0.4'}
 
-  get-tsconfig@4.8.1:
-    resolution: {integrity: sha512-k9PN+cFBmaLWtVz29SkUoqU5O0slLuHJXt/2P+tMVFT+phsSGXGkp9t3rQIqdz0e+06EHNGs3oM6ZX1s2zHxRg==}
-
-  getos@3.2.1:
-    resolution: {integrity: sha512-U56CfOK17OKgTVqozZjUKNdkfEv6jk5WISBJ8SHoagjE6L69zOwl3Z+O8myjY9MEW3i2HPWQBt/LTbCgcC973Q==}
-
-  getpass@0.1.7:
-    resolution: {integrity: sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==}
+  get-tsconfig@4.10.1:
+    resolution: {integrity: sha512-auHyJ4AgMz7vgS8Hp3N6HXSmlMdUyhSUrfBF16w153rxtLIEOE+HGqaBppczZvnHLqQJfiHotCYpNhl0lUROFQ==}
 
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
@@ -3352,14 +2621,6 @@ packages:
     resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
     hasBin: true
 
-  glob@7.2.3:
-    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Glob versions prior to v9 are no longer supported
-
-  global-dirs@3.0.1:
-    resolution: {integrity: sha512-NBcGGFbBA9s1VzD41QXDG+3++t9Mn5t1FpLdhESY6oKY4gYTFpX4wO3sqGUa0Srjtbfj3szX0RnemmrVRUdULA==}
-    engines: {node: '>=10'}
-
   globals@11.12.0:
     resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
     engines: {node: '>=4'}
@@ -3372,23 +2633,10 @@ packages:
     resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
     engines: {node: '>=18'}
 
-  globals@15.12.0:
-    resolution: {integrity: sha512-1+gLErljJFhbOVyaetcwJiJ4+eLe45S2E7P5UiZ9xGfeq3ATQf5DOv9G7MH3gGbKQLkzmNh2DxfZwLdw+j6oTQ==}
-    engines: {node: '>=18'}
-
   globalthis@1.0.4:
     resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
     engines: {node: '>= 0.4'}
 
-  globby@11.1.0:
-    resolution: {integrity: sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==}
-    engines: {node: '>=10'}
-
-  gonzales-pe@4.3.0:
-    resolution: {integrity: sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ==}
-    engines: {node: '>=0.6.0'}
-    hasBin: true
-
   gopd@1.2.0:
     resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
     engines: {node: '>= 0.4'}
@@ -3399,15 +2647,13 @@ packages:
   graphemer@1.4.0:
     resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
 
-  graphlib@2.1.8:
-    resolution: {integrity: sha512-jcLLfkpoVGmH7/InMC/1hIvOPSUh38oJtGhvrOFGzioE1DZ+0YW16RgmOJhHiuWTvGiJQ9Z1Ik43JvkRPRvE+A==}
-
   gunzip-maybe@1.4.2:
     resolution: {integrity: sha512-4haO1M4mLO91PW57BMsDFf75UmwoRX0GkdD+Faw+Lr+r/OZrOCS0pIBwOL1xCKQqnQzbNFGgK2V2CpBUPeFNTw==}
     hasBin: true
 
-  has-bigints@1.0.2:
-    resolution: {integrity: sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==}
+  has-bigints@1.1.0:
+    resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
+    engines: {node: '>= 0.4'}
 
   has-flag@4.0.0:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
@@ -3435,8 +2681,8 @@ packages:
   hast-util-from-html@2.0.3:
     resolution: {integrity: sha512-CUSRHXyKjzHov8yKsQjGOElXy/3EKpyX56ELnkHH34vDVw1N1XSQ1ZcAvTyAPtGqLTuKP/uxM+aLkSPqF/EtMw==}
 
-  hast-util-from-parse5@8.0.2:
-    resolution: {integrity: sha512-SfMzfdAi/zAoZ1KkFEyyeXBn7u/ShQrfd675ZEE9M3qj+PMFX05xubzRyF76CCSJu8au9jgVxDV1+okFvgZU4A==}
+  hast-util-from-parse5@8.0.3:
+    resolution: {integrity: sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg==}
 
   hast-util-parse-selector@3.1.1:
     resolution: {integrity: sha512-jdlwBjEexy1oGz0aJ2f4GKMaVKkA9jwjr4MjAAI22E5fM/TXVZHuS5OpONtdeIkRKqAaryQ2E9xNQxijoThSZA==}
@@ -3444,8 +2690,8 @@ packages:
   hast-util-parse-selector@4.0.0:
     resolution: {integrity: sha512-wkQCkSYoOGCRKERFWcxMVMOcYE2K1AaNLU8DXS9arxnLOUEWbOXKXiJUNzEpqZ3JOKpnha3jkFrumEjVliDe7A==}
 
-  hast-util-to-html@9.0.3:
-    resolution: {integrity: sha512-M17uBDzMJ9RPCqLMO92gNNUDuBSq10a25SDBI08iCCxmorf4Yy6sYHK57n9WAbRAAaU+DuR4W6GN9K4DFZesYg==}
+  hast-util-to-html@9.0.5:
+    resolution: {integrity: sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==}
 
   hast-util-to-string@3.0.1:
     resolution: {integrity: sha512-XelQVTDWvqcl3axRfI0xSeoVKzyIFPwsAGSLIsKdJKQMXDYJS4WYrBNF/8J7RdhIcFI2BOHgAifggsvsxp/3+A==}
@@ -3456,8 +2702,8 @@ packages:
   hastscript@7.2.0:
     resolution: {integrity: sha512-TtYPq24IldU8iKoJQqvZOuhi5CyCQRAbvDOX0x1eW6rsHSxa/1i2CCiptNTotGHJ3VoHRGmqiv6/D3q113ikkw==}
 
-  hastscript@9.0.0:
-    resolution: {integrity: sha512-jzaLBGavEDKHrc5EfFImKN7nZKKBdSLIdGvCwDZ9TfzbF2ffXiov8CKE445L2Z1Ek2t/m4SKQ2j6Ipv7NyUolw==}
+  hastscript@9.0.1:
+    resolution: {integrity: sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w==}
 
   he@1.2.0:
     resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==}
@@ -3483,35 +2729,21 @@ packages:
     resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
     engines: {node: '>= 14'}
 
-  http-signature@1.4.0:
-    resolution: {integrity: sha512-G5akfn7eKbpDN+8nPS/cb57YeA1jLTVxjpCj7tmm3QKPdyDy7T+qSC40e9ptydSWvkwjSXw1VbkpyEm39ukeAg==}
-    engines: {node: '>=0.10'}
-
   https-proxy-agent@7.0.6:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
-  human-signals@1.1.1:
-    resolution: {integrity: sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==}
-    engines: {node: '>=8.12.0'}
-
-  human-signals@5.0.0:
-    resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
-    engines: {node: '>=16.17.0'}
-
-  humanize-duration@3.32.1:
-    resolution: {integrity: sha512-inh5wue5XdfObhu/IGEMiA1nUXigSGcaKNemcbLRKa7jXYGDZXr3LoT9pTIzq2hPEbld7w/qv9h+ikWGz8fL1g==}
-
   husky@9.1.7:
     resolution: {integrity: sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==}
     engines: {node: '>=18'}
     hasBin: true
 
-  i18next-http-backend@3.0.1:
-    resolution: {integrity: sha512-XT2lYSkbAtDE55c6m7CtKxxrsfuRQO3rUfHzj8ZyRtY9CkIX3aRGwXGTkUhpGWce+J8n7sfu3J0f2wTzo7Lw0A==}
+  i18next-fetch-backend@6.0.0:
+    resolution: {integrity: sha512-kVqnydqLVMZfVlOuP2nf71cREydlxEKLH43jUXAFdOku/GF+6b9fBg31anoos5XncdhdtiYgL9fheqMrtXRwng==}
+    engines: {node: '>=18'}
 
-  i18next@24.2.1:
-    resolution: {integrity: sha512-Q2wC1TjWcSikn1VAJg13UGIjc+okpFxQTxjVAymOnSA3RpttBQNMPf2ovcgoFVsV4QNxTfNZMAxorXZXsk4fBA==}
+  i18next@25.3.1:
+    resolution: {integrity: sha512-S4CPAx8LfMOnURnnJa8jFWvur+UX/LWcl6+61p9VV7SK2m0445JeBJ6tLD0D5SR0H29G4PYfWkEhivKG5p4RDg==}
     peerDependencies:
       typescript: ^5
     peerDependenciesMeta:
@@ -3522,18 +2754,19 @@ packages:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
 
-  ieee754@1.2.1:
-    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
-
   ignore@5.3.2:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
 
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
   immediate@3.0.6:
     resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==}
 
-  import-fresh@3.3.0:
-    resolution: {integrity: sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==}
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
     engines: {node: '>=6'}
 
   import-lazy@4.0.0:
@@ -3548,41 +2781,25 @@ packages:
     resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
     engines: {node: '>=8'}
 
-  inflight@1.0.6:
-    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
-    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
-
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ini@2.0.0:
-    resolution: {integrity: sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==}
-    engines: {node: '>=10'}
-
   internal-slot@1.1.0:
     resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
     engines: {node: '>= 0.4'}
 
-  interpret@1.4.0:
-    resolution: {integrity: sha512-agE4QfB2Lkp9uICn7BAqoscw4SZP9kTE2hxiFI3jBPmXJfdqiahTbUuKGsMoN2GtqL9AxhYioAcVvgsb1HvRbA==}
-    engines: {node: '>= 0.10'}
-
   is-alphabetical@2.0.1:
     resolution: {integrity: sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==}
 
   is-alphanumerical@2.0.1:
     resolution: {integrity: sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==}
 
-  is-arguments@1.1.1:
-    resolution: {integrity: sha512-8Q7EARjzEnKpt/PCD7e1cgUS0a6X8u5tdSiMqXhojOdoV9TsMsiO+9VLC5vAmO8N7/GmXn7yjR8qnA6bVAEzfA==}
-    engines: {node: '>= 0.4'}
-
   is-array-buffer@3.0.5:
     resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
     engines: {node: '>= 0.4'}
 
-  is-async-function@2.0.0:
-    resolution: {integrity: sha512-Y1JXKrfykRJGdlDwdKlLpLyMIiWqWvuSd17TvZk68PLAOGOoF4Xyav1z0Xhoi+gCYjZVeC5SI+hYFOfvXmGRCA==}
+  is-async-function@2.1.1:
+    resolution: {integrity: sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
     engines: {node: '>= 0.4'}
 
   is-bigint@1.1.0:
@@ -3593,16 +2810,16 @@ packages:
     resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
     engines: {node: '>=8'}
 
-  is-boolean-object@1.2.1:
-    resolution: {integrity: sha512-l9qO6eFlUETHtuihLcYOaLKByJ1f+N4kthcU9YjHy3N+B3hWv0y/2Nd0mu/7lTFnRQHTrSdXF50HQ3bl5fEnng==}
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
     engines: {node: '>= 0.4'}
 
   is-callable@1.2.7:
     resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
     engines: {node: '>= 0.4'}
 
-  is-core-module@2.15.1:
-    resolution: {integrity: sha512-z0vtXSwucUJtANQWldhbtbt7BnL0vxiFjIdDLAatwhDYty2bad6s+rijD6Ri4YuYJubLzIJLUidCh09e1djEVQ==}
+  is-core-module@2.16.1:
+    resolution: {integrity: sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==}
     engines: {node: '>= 0.4'}
 
   is-data-view@1.0.2:
@@ -3623,8 +2840,8 @@ packages:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
 
-  is-finalizationregistry@1.1.0:
-    resolution: {integrity: sha512-qfMdqbAQEwBw78ZyReKnlA8ezmPdb9BemzIIip/JkjaZUhitfXDkkr+3QTboW0JrSXT1QWyYShpvnNHGZ4c4yA==}
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
     engines: {node: '>= 0.4'}
 
   is-fullwidth-code-point@3.0.0:
@@ -3639,8 +2856,8 @@ packages:
     resolution: {integrity: sha512-OVa3u9kkBbw7b8Xw5F9P+D/T9X+Z4+JruYVNapTjPYZYUznQ5YfWeFkOj606XYYW8yugTfC8Pj0hYqvi4ryAhA==}
     engines: {node: '>=18'}
 
-  is-generator-function@1.0.10:
-    resolution: {integrity: sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==}
+  is-generator-function@1.1.0:
+    resolution: {integrity: sha512-nPUB5km40q9e8UfN/Zc24eLlzdSf9OfKByBw9CIdw4H1giPMeA0OIJvbchsCu4npfI2QcMVBsGEBHKZ7wLTWmQ==}
     engines: {node: '>= 0.4'}
 
   is-glob@4.0.3:
@@ -3654,10 +2871,6 @@ packages:
   is-hexadecimal@2.0.1:
     resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
 
-  is-installed-globally@0.4.0:
-    resolution: {integrity: sha512-iwGqO3J21aaSkC7jWnHP/difazwS7SFeIqxv6wEtLU8Y5KlzFTjyqcSIT0d8s4+dDhKytsk9PJZ2BkS5eZwQRQ==}
-    engines: {node: '>=10'}
-
   is-map@2.0.3:
     resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
     engines: {node: '>= 0.4'}
@@ -3673,14 +2886,6 @@ packages:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
 
-  is-obj@1.0.1:
-    resolution: {integrity: sha512-l4RyHgRqGN4Y3+9JHVrNqO+tN0rV5My76uW5/nuO4K1b6vw5G8d/cmFjP9tRfEsdhZNt0IFdZuK/c2Vr4Nb+Qg==}
-    engines: {node: '>=0.10.0'}
-
-  is-path-inside@3.0.3:
-    resolution: {integrity: sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==}
-    engines: {node: '>=8'}
-
   is-plain-obj@2.1.0:
     resolution: {integrity: sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==}
     engines: {node: '>=8'}
@@ -3699,10 +2904,6 @@ packages:
     resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
     engines: {node: '>= 0.4'}
 
-  is-regexp@1.0.0:
-    resolution: {integrity: sha512-7zjFAPO4/gwyQAAgRRmqeEeyIICSdmCqa3tsVHMdBzaXXRiqopZL4Cyghg/XulGWrtABTpbnYYzzIRffLkP4oA==}
-    engines: {node: '>=0.10.0'}
-
   is-set@2.0.3:
     resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
     engines: {node: '>= 0.4'}
@@ -3711,14 +2912,6 @@ packages:
     resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
     engines: {node: '>= 0.4'}
 
-  is-stream@2.0.1:
-    resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
-    engines: {node: '>=8'}
-
-  is-stream@3.0.0:
-    resolution: {integrity: sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-
   is-string@1.1.1:
     resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
     engines: {node: '>= 0.4'}
@@ -3731,30 +2924,20 @@ packages:
     resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
     engines: {node: '>= 0.4'}
 
-  is-typedarray@1.0.0:
-    resolution: {integrity: sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
-
   is-unicode-supported@0.1.0:
     resolution: {integrity: sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==}
     engines: {node: '>=10'}
 
-  is-url-superb@4.0.0:
-    resolution: {integrity: sha512-GI+WjezhPPcbM+tqE9LnmsY5qqjwHzTvjJ36wxYX5ujNXefSUJ/T17r5bqDV8yLhcgB59KTPNOc9O9cmHTPWsA==}
-    engines: {node: '>=10'}
-
-  is-url@1.2.4:
-    resolution: {integrity: sha512-ITvGim8FhRiYe4IQ5uHSkj7pVaPDrCTkNd3yq3cV7iZAcJdHTUMPMEHcqSOy9xZ9qFenQCvi+2wjH9a1nXqHww==}
-
   is-weakmap@2.0.2:
     resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
     engines: {node: '>= 0.4'}
 
-  is-weakref@1.1.0:
-    resolution: {integrity: sha512-SXM8Nwyys6nT5WP6pltOwKytLV7FqQ4UiibxVmW+EIosHcmCqkkjViTb5SNssDlkCiEYRP1/pdWUKVvZBmsR2Q==}
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
     engines: {node: '>= 0.4'}
 
-  is-weakset@2.0.3:
-    resolution: {integrity: sha512-LvIm3/KWzS9oRFHugab7d+M/GcBXuXX5xZkzPmN+NxihdQlZUQ4dWuSV1xR/sq6upL1TJEDrfBgRepHFdBtSNQ==}
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
     engines: {node: '>= 0.4'}
 
   isarray@1.0.0:
@@ -3766,11 +2949,8 @@ packages:
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
-  isstream@0.1.2:
-    resolution: {integrity: sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g==}
-
-  iterator.prototype@1.1.4:
-    resolution: {integrity: sha512-x4WH0BWmrMmg4oHHl+duwubhrvczGlyuGAZu3nvrf0UXOfPu8IhZObFEr7DE/iv01YgVZrsOiRcqw2srkKEDIA==}
+  iterator.prototype@1.1.5:
+    resolution: {integrity: sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
     engines: {node: '>= 0.4'}
 
   jackspeak@3.4.3:
@@ -3781,19 +2961,20 @@ packages:
 
   jquery@3.4.1:
     resolution: {integrity: sha512-36+AdBzCL+y6qjw5Tx7HgzeGCzC81MDDgaUP8ld2zhx58HdqXGoBd+tHdrBMiyjGQs0Hxs/MLZTu/eHNJJuWPw==}
+    deprecated: This version is deprecated. Please upgrade to the latest version or find support at https://www.herodevs.com/support/jquery-nes.
 
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
+  js-tokens@9.0.1:
+    resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
+
   js-yaml@4.1.0:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
 
-  jsbn@0.1.1:
-    resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
-
-  jsdom@26.0.0:
-    resolution: {integrity: sha512-BZYDGVAIriBWTpIxYzrXjv3E/4u8+/pSG5bQdIYCbNCGOvsPkDQfTVLAIXAf9ETdCpduCVTkDe2NNZ8NIwUVzw==}
+  jsdom@26.1.0:
+    resolution: {integrity: sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==}
     engines: {node: '>=18'}
     peerDependencies:
       canvas: ^3.0.0
@@ -3801,8 +2982,8 @@ packages:
       canvas:
         optional: true
 
-  jsesc@3.0.2:
-    resolution: {integrity: sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g==}
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
     hasBin: true
 
@@ -3815,15 +2996,9 @@ packages:
   json-schema-traverse@1.0.0:
     resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
 
-  json-schema@0.4.0:
-    resolution: {integrity: sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==}
-
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
-  json-stringify-safe@5.0.1:
-    resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
-
   json5@2.2.3:
     resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
     engines: {node: '>=6'}
@@ -3832,16 +3007,9 @@ packages:
   jsonc-parser@3.3.1:
     resolution: {integrity: sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==}
 
-  jsonfile@4.0.0:
-    resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
-
   jsonfile@6.1.0:
     resolution: {integrity: sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==}
 
-  jsprim@2.0.2:
-    resolution: {integrity: sha512-gqXddjPqQ6G40VdnI6T6yObEC+pDNvyP95wdQhkWkg7crHH3km5qP1FsOXEkzEQwnz6gz5qGTn1c2Y52wP3OyQ==}
-    engines: {'0': node >=0.6.0}
-
   jsx-ast-utils@3.3.5:
     resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
     engines: {node: '>=4.0'}
@@ -3849,34 +3017,15 @@ packages:
   jszip@3.10.1:
     resolution: {integrity: sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==}
 
+  keycloak-js@26.2.0:
+    resolution: {integrity: sha512-CrFcXTN+d6J0V/1v3Zpioys6qHNWE6yUzVVIsCUAmFn9H14GZ0vuYod+lt+SSpMgWGPuneDZBSGBAeLBFuqjsw==}
+
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
   kolorist@1.8.0:
     resolution: {integrity: sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ==}
 
-  lazy-ass@1.6.0:
-    resolution: {integrity: sha512-cc8oEVoctTvsFZ/Oje/kGnHbpWHYBe8IAJe4C0QNc3t8uM/0Y8+erSz/7Y1ALuXTEZTMvxXwO6YbX1ey3ujiZw==}
-    engines: {node: '> 0.8'}
-
-  lazy-ass@2.0.3:
-    resolution: {integrity: sha512-/O3/DoQmI1XAhklDvF1dAjFf/epE8u3lzOZegQfLZ8G7Ud5bTRSZiFOpukHCu6jODrCA4gtIdwUCC7htxcDACA==}
-    engines: {node: '> 0.8'}
-
-  ldap-filter@0.3.3:
-    resolution: {integrity: sha512-/tFkx5WIn4HuO+6w9lsfxq4FN3O+fDZeO9Mek8dCD8rTUpqzRa766BOBO7BcGkn3X86m5+cBm1/2S/Shzz7gMg==}
-    engines: {node: '>=0.8'}
-
-  ldap-server-mock@6.0.1:
-    resolution: {integrity: sha512-EPQ6bxeuZZ9jz6gtoS4JoJaCd100Aq2V+xA5tn9KPy1sLPq5NUbmGQNEX2NTNIPD9e286Jb2WWx7s8hp7gr6iQ==}
-    engines: {node: '>=16.3.0', npm: '>=7.15.1'}
-    hasBin: true
-
-  ldapjs@2.3.3:
-    resolution: {integrity: sha512-75QiiLJV/PQqtpH+HGls44dXweviFwQ6SiIK27EqzKQ5jU/7UFrl2E5nLdQ3IYRBzJ/AVFJI66u0MZ0uofKYwg==}
-    engines: {node: '>=10.13.0'}
-    deprecated: This package has been decomissioned. See https://github.com/ldapjs/node-ldapjs/blob/8ffd0bc9c149088a10ec4c1ec6a18450f76ad05d/README.md
-
   levn@0.4.1:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
@@ -3884,94 +3033,85 @@ packages:
   lie@3.3.0:
     resolution: {integrity: sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==}
 
-  lightningcss-darwin-arm64@1.28.2:
-    resolution: {integrity: sha512-/8cPSqZiusHSS+WQz0W4NuaqFjquys1x+NsdN/XOHb+idGHJSoJ7SoQTVl3DZuAgtPZwFZgRfb/vd1oi8uX6+g==}
+  lightningcss-darwin-arm64@1.30.1:
+    resolution: {integrity: sha512-c8JK7hyE65X1MHMN+Viq9n11RRC7hgin3HhYKhrMyaXflk5GVplZ60IxyoVtzILeKr+xAJwg6zK6sjTBJ0FKYQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [darwin]
 
-  lightningcss-darwin-x64@1.28.2:
-    resolution: {integrity: sha512-R7sFrXlgKjvoEG8umpVt/yutjxOL0z8KWf0bfPT3cYMOW4470xu5qSHpFdIOpRWwl3FKNMUdbKtMUjYt0h2j4g==}
+  lightningcss-darwin-x64@1.30.1:
+    resolution: {integrity: sha512-k1EvjakfumAQoTfcXUcHQZhSpLlkAuEkdMBsI/ivWw9hL+7FtilQc0Cy3hrx0AAQrVtQAbMI7YjCgYgvn37PzA==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [darwin]
 
-  lightningcss-freebsd-x64@1.28.2:
-    resolution: {integrity: sha512-l2qrCT+x7crAY+lMIxtgvV10R8VurzHAoUZJaVFSlHrN8kRLTvEg9ObojIDIexqWJQvJcVVV3vfzsEynpiuvgA==}
+  lightningcss-freebsd-x64@1.30.1:
+    resolution: {integrity: sha512-kmW6UGCGg2PcyUE59K5r0kWfKPAVy4SltVeut+umLCFoJ53RdCUWxcRDzO1eTaxf/7Q2H7LTquFHPL5R+Gjyig==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [freebsd]
 
-  lightningcss-linux-arm-gnueabihf@1.28.2:
-    resolution: {integrity: sha512-DKMzpICBEKnL53X14rF7hFDu8KKALUJtcKdFUCW5YOlGSiwRSgVoRjM97wUm/E0NMPkzrTi/rxfvt7ruNK8meg==}
+  lightningcss-linux-arm-gnueabihf@1.30.1:
+    resolution: {integrity: sha512-MjxUShl1v8pit+6D/zSPq9S9dQ2NPFSQwGvxBCYaBYLPlCWuPh9/t1MRS8iUaR8i+a6w7aps+B4N0S1TYP/R+Q==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm]
     os: [linux]
 
-  lightningcss-linux-arm64-gnu@1.28.2:
-    resolution: {integrity: sha512-nhfjYkfymWZSxdtTNMWyhFk2ImUm0X7NAgJWFwnsYPOfmtWQEapzG/DXZTfEfMjSzERNUNJoQjPAbdqgB+sjiw==}
+  lightningcss-linux-arm64-gnu@1.30.1:
+    resolution: {integrity: sha512-gB72maP8rmrKsnKYy8XUuXi/4OctJiuQjcuqWNlJQ6jZiWqtPvqFziskH3hnajfvKB27ynbVCucKSm2rkQp4Bw==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
 
-  lightningcss-linux-arm64-musl@1.28.2:
-    resolution: {integrity: sha512-1SPG1ZTNnphWvAv8RVOymlZ8BDtAg69Hbo7n4QxARvkFVCJAt0cgjAw1Fox0WEhf4PwnyoOBaVH0Z5YNgzt4dA==}
+  lightningcss-linux-arm64-musl@1.30.1:
+    resolution: {integrity: sha512-jmUQVx4331m6LIX+0wUhBbmMX7TCfjF5FoOH6SD1CttzuYlGNVpA7QnrmLxrsub43ClTINfGSYyHe2HWeLl5CQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [linux]
 
-  lightningcss-linux-x64-gnu@1.28.2:
-    resolution: {integrity: sha512-ZhQy0FcO//INWUdo/iEdbefntTdpPVQ0XJwwtdbBuMQe+uxqZoytm9M+iqR9O5noWFaxK+nbS2iR/I80Q2Ofpg==}
+  lightningcss-linux-x64-gnu@1.30.1:
+    resolution: {integrity: sha512-piWx3z4wN8J8z3+O5kO74+yr6ze/dKmPnI7vLqfSqI8bccaTGY5xiSGVIJBDd5K5BHlvVLpUB3S2YCfelyJ1bw==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
 
-  lightningcss-linux-x64-musl@1.28.2:
-    resolution: {integrity: sha512-alb/j1NMrgQmSFyzTbN1/pvMPM+gdDw7YBuQ5VSgcFDypN3Ah0BzC2dTZbzwzaMdUVDszX6zH5MzjfVN1oGuww==}
+  lightningcss-linux-x64-musl@1.30.1:
+    resolution: {integrity: sha512-rRomAK7eIkL+tHY0YPxbc5Dra2gXlI63HL+v1Pdi1a3sC+tJTcFrHX+E86sulgAXeI7rSzDYhPSeHHjqFhqfeQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [linux]
 
-  lightningcss-win32-arm64-msvc@1.28.2:
-    resolution: {integrity: sha512-WnwcjcBeAt0jGdjlgbT9ANf30pF0C/QMb1XnLnH272DQU8QXh+kmpi24R55wmWBwaTtNAETZ+m35ohyeMiNt+g==}
+  lightningcss-win32-arm64-msvc@1.30.1:
+    resolution: {integrity: sha512-mSL4rqPi4iXq5YVqzSsJgMVFENoa4nGTT/GjO2c0Yl9OuQfPsIfncvLrEW6RbbB24WtZ3xP/2CCmI3tNkNV4oA==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [win32]
 
-  lightningcss-win32-x64-msvc@1.28.2:
-    resolution: {integrity: sha512-3piBifyT3avz22o6mDKywQC/OisH2yDK+caHWkiMsF82i3m5wDBadyCjlCQ5VNgzYkxrWZgiaxHDdd5uxsi0/A==}
+  lightningcss-win32-x64-msvc@1.30.1:
+    resolution: {integrity: sha512-PVqXh48wh4T53F/1CCu8PIPCxLzWyCnn/9T5W1Jpmdy5h9Cwd+0YQS6/LwhHXSafuc61/xg9Lv5OrCby6a++jg==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [win32]
 
-  lightningcss@1.28.2:
-    resolution: {integrity: sha512-ePLRrbt3fgjXI5VFZOLbvkLD5ZRuxGKm+wJ3ujCqBtL3NanDHPo/5zicR5uEKAPiIjBYF99BM4K4okvMznjkVA==}
+  lightningcss@1.30.1:
+    resolution: {integrity: sha512-xi6IyHML+c9+Q3W0S4fCQJOym42pyurFiJUHEcEyHS0CeKzia4yZDEsLlqOFykxOdHpNy0NmvVO31vcSqAxJCg==}
     engines: {node: '>= 12.0.0'}
 
   lilconfig@3.1.3:
     resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
     engines: {node: '>=14'}
 
-  lint-staged@15.3.0:
-    resolution: {integrity: sha512-vHFahytLoF2enJklgtOtCtIjZrKD/LoxlaUusd5nh7dWv/dkKQJY74ndFSzxCdv7g0ueGg1ORgTSt4Y9LPZn9A==}
-    engines: {node: '>=18.12.0'}
+  lint-staged@16.1.2:
+    resolution: {integrity: sha512-sQKw2Si2g9KUZNY3XNvRuDq4UJqpHwF0/FQzZR2M7I5MvtpWvibikCjUVJzZdGE0ByurEl3KQNvsGetd1ty1/Q==}
+    engines: {node: '>=20.17'}
     hasBin: true
 
-  listr2@3.14.0:
-    resolution: {integrity: sha512-TyWI8G99GX9GjE54cJ+RrNMcIFBfwMPxc3XTFiAYGN4s10hWROGtOg7+O6u6LE3mNkyld7RSLE6nrKBvTfcs3g==}
-    engines: {node: '>=10.0.0'}
-    peerDependencies:
-      enquirer: '>= 2.3.0 < 3'
-    peerDependenciesMeta:
-      enquirer:
-        optional: true
-
-  listr2@8.2.5:
-    resolution: {integrity: sha512-iyAZCeyD+c1gPyE9qpFu8af0Y+MRtmKOncdGoA2S5EY8iFq99dmmvkNnHiWo+pj0s7yH7l3KPIgee77tKpXPWQ==}
+  listr2@8.3.3:
+    resolution: {integrity: sha512-LWzX2KsqcB1wqQ4AHgYb4RsDXauQiqhjLk+6hjbaeHG4zpjjVAB6wC/gz6X0l+Du1cN3pUB5ZlrvTbhGSNnUQQ==}
     engines: {node: '>=18.0.0'}
 
-  local-pkg@0.5.1:
-    resolution: {integrity: sha512-9rrA30MRRP3gBD3HTGnC6cDFpaE1kVDWxWgqWJUN0RvDNAo+Nz/9GxB+nHOH0ifbVFy0hSA1V6vFDvnx54lTEQ==}
+  local-pkg@1.1.1:
+    resolution: {integrity: sha512-WunYko2W1NcdfAFpuLUoucsgULmgDBRkdxHxWQ7mK0cQqwPiy8E1enjuRBrhLtZkB5iScJ1XIPdhVEFK8aOLSg==}
     engines: {node: '>=14'}
 
   locate-path@6.0.0:
@@ -3984,9 +3124,6 @@ packages:
   lodash.merge@4.6.2:
     resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
 
-  lodash.once@4.1.1:
-    resolution: {integrity: sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==}
-
   lodash@4.17.21:
     resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
 
@@ -3994,31 +3131,23 @@ packages:
     resolution: {integrity: sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==}
     engines: {node: '>=10'}
 
-  log-update@4.0.0:
-    resolution: {integrity: sha512-9fkkDevMefjg0mmzWFBW8YkFP91OrizzkW3diF7CpG+S2EYdy4+TVfGwz1zeF8x7hCx1ovSPTOE9Ngib74qqUg==}
-    engines: {node: '>=10'}
-
   log-update@6.1.0:
     resolution: {integrity: sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==}
     engines: {node: '>=18'}
 
-  long@5.2.3:
-    resolution: {integrity: sha512-lcHwpNoggQTObv5apGNCTdJrO69eHOZMi4BNC+rTLER8iHAqGrUVeLh/irVIM7zTw2bOXA8T6uNPeujwOLg/2Q==}
-
   loose-envify@1.4.0:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
-  loupe@3.1.2:
-    resolution: {integrity: sha512-23I4pFZHmAemUnz8WZXbYRSKYj801VDaNv9ETuMh7IrMc7VuVVSo+Z9iLE3ni30+U48iDWfi30d3twAXBYmnCg==}
+  loupe@3.1.3:
+    resolution: {integrity: sha512-kkIp7XSkP78ZxJEsSxW3712C6teJVoeHHwgo9zJ380de7IYyJ2ISlxojcH2pC5OFLewESmnRi/+XCDIEEVyoug==}
+
+  loupe@3.1.4:
+    resolution: {integrity: sha512-wJzkKwJrheKtknCOKNEtDK4iqg/MxmZheEMtSTYvnzRdEYaZzmgH976nenp8WdJRdx5Vc1X/9MO0Oszl6ezeXg==}
 
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
-  lru-cache@11.0.2:
-    resolution: {integrity: sha512-123qHRfJBmo2jXDbo/a5YOQrJoHF/GNQTLzQ5+IdK5pWpceK17yRc6ozlWd25FxvGKQbIUs91fDFkXmDHTKcyA==}
-    engines: {node: 20 || >=22}
-
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
@@ -4030,9 +3159,6 @@ packages:
     resolution: {integrity: sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==}
     hasBin: true
 
-  magic-string@0.30.14:
-    resolution: {integrity: sha512-5c99P1WKTed11ZC0HMJOj6CDIue6F8ySu+bJL+85q1zBEIY8IklrJ1eiKC2NDRh3Ct3FcvmJPyQHb9erXMTJNw==}
-
   magic-string@0.30.17:
     resolution: {integrity: sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==}
 
@@ -4046,9 +3172,6 @@ packages:
   mdast-util-to-hast@13.2.0:
     resolution: {integrity: sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==}
 
-  merge-stream@2.0.0:
-    resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
-
   merge2@1.4.1:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
@@ -4065,29 +3188,13 @@ packages:
   micromark-util-symbol@2.0.1:
     resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==}
 
-  micromark-util-types@2.0.1:
-    resolution: {integrity: sha512-534m2WhVTddrcKVepwmVEVnUAmtrx9bfIjNoQHRqfnvdaHQiFytEhJoTgpWJvDEXCO5gLTQh3wYC1PgOJA4NSQ==}
+  micromark-util-types@2.0.2:
+    resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==}
 
   micromatch@4.0.8:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
-  mime-db@1.52.0:
-    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
-    engines: {node: '>= 0.6'}
-
-  mime-types@2.1.35:
-    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
-    engines: {node: '>= 0.6'}
-
-  mimic-fn@2.1.0:
-    resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
-    engines: {node: '>=6'}
-
-  mimic-fn@4.0.0:
-    resolution: {integrity: sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==}
-    engines: {node: '>=12'}
-
   mimic-function@5.0.1:
     resolution: {integrity: sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==}
     engines: {node: '>=18'}
@@ -4102,42 +3209,22 @@ packages:
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
-  minimatch@5.1.6:
-    resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==}
-    engines: {node: '>=10'}
-
   minimatch@9.0.5:
     resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
     engines: {node: '>=16 || 14 >=14.17'}
 
-  minimist@1.2.8:
-    resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
-
   minipass@7.1.2:
     resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==}
     engines: {node: '>=16 || 14 >=14.17'}
 
-  mlly@1.7.3:
-    resolution: {integrity: sha512-xUsx5n/mN0uQf4V548PKQ+YShA4/IW0KI1dZhrNrPCLG+xizETbHTkOa1f8/xut9JRPp8kQuMnz0oqwkTiLo/A==}
+  mlly@1.7.4:
+    resolution: {integrity: sha512-qmdSIPC4bDJXgZTCR7XosJiNKySV7O215tsPtDN9iEO/7q/76b/ijtgRu/+epFXSJhijtTCCGp3DWS549P3xKw==}
 
-  mocha@11.0.1:
-    resolution: {integrity: sha512-+3GkODfsDG71KSCQhc4IekSW+ItCK/kiez1Z28ksWvYhKXV/syxMlerR/sC7whDp7IyreZ4YxceMLdTs5hQE8A==}
+  mocha@11.7.1:
+    resolution: {integrity: sha512-5EK+Cty6KheMS/YLPPMJC64g5V61gIR25KsRItHw6x4hEKT6Njp1n9LOlH4gpevuwMVS66SXaBBpg+RWZkza4A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     hasBin: true
 
-  module-definition@6.0.0:
-    resolution: {integrity: sha512-sEGP5nKEXU7fGSZUML/coJbrO+yQtxcppDAYWRE9ovWsTbFoUHB2qDUx564WUzDaBHXsD46JBbIK5WVTwCyu3w==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  module-lookup-amd@9.0.2:
-    resolution: {integrity: sha512-p7PzSVEWiW9fHRX9oM+V4aV5B2nCVddVNv4DZ/JB6t9GsXY4E+ZVhPpnwUX7bbJyGeeVZqhS8q/JZ/H77IqPFA==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  ms@2.1.2:
-    resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}
-
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
@@ -4148,55 +3235,38 @@ packages:
     resolution: {integrity: sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==}
     hasBin: true
 
-  nanoid@3.3.8:
-    resolution: {integrity: sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==}
+  nano-spawn@1.0.2:
+    resolution: {integrity: sha512-21t+ozMQDAL/UGgQVBbZ/xXvNO10++ZPuTmKRO8k9V3AClVRht49ahtDjfY8l1q6nSHOrE5ASfthzH3ol6R/hg==}
+    engines: {node: '>=20.17'}
+
+  nanoid@3.3.11:
+    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
-  node-fetch@2.7.0:
-    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
-    engines: {node: 4.x || >=6.0.0}
-    peerDependencies:
-      encoding: ^0.1.0
-    peerDependenciesMeta:
-      encoding:
-        optional: true
-
-  node-releases@2.0.18:
-    resolution: {integrity: sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==}
-
-  node-source-walk@7.0.0:
-    resolution: {integrity: sha512-1uiY543L+N7Og4yswvlm5NCKgPKDEXd9AUR9Jh3gen6oOeBsesr6LqhXom1er3eRzSUcVRWXzhv8tSNrIfGHKw==}
-    engines: {node: '>=18'}
+  node-releases@2.0.19:
+    resolution: {integrity: sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==}
 
   normalize-path@3.0.0:
     resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
     engines: {node: '>=0.10.0'}
 
-  npm-run-path@4.0.1:
-    resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
-    engines: {node: '>=8'}
-
-  npm-run-path@5.3.0:
-    resolution: {integrity: sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+  npm-run-path@6.0.0:
+    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
+    engines: {node: '>=18'}
 
-  nwsapi@2.2.16:
-    resolution: {integrity: sha512-F1I/bimDpj3ncaNDhfyMWuFqmQDBwDB0Fogc2qpL3BWvkQteFD/8BzWuIRl83rq0DXfm8SGt/HFhLXZyljTXcQ==}
+  nwsapi@2.2.20:
+    resolution: {integrity: sha512-/ieB+mDe4MrrKMT8z+mQL8klXydZWGR5Dowt4RAGKbJ3kIGEx3X4ljUo+6V73IXtUPWgfOlU5B9MlGxFO5T+cA==}
 
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
 
-  object-inspect@1.13.3:
-    resolution: {integrity: sha512-kDCGIbxkDSXE3euJZZXzc6to7fCrKHNI/hSRQnRuQ+BWjFNzZwiFF8fj/6o2t2G9/jTj8PSIYTfCLelLZEeRpA==}
-    engines: {node: '>= 0.4'}
-
-  object-is@1.1.6:
-    resolution: {integrity: sha512-F8cZ+KfGlSGi09lJT7/Nd6KJZ9ygtvYC0/UYYLI9nmQKLMnydpB9yvbv9K1uSkEu7FU9vYPmVwLg328tX+ot3Q==}
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
     engines: {node: '>= 0.4'}
 
   object-keys@1.1.1:
@@ -4207,8 +3277,8 @@ packages:
     resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
     engines: {node: '>= 0.4'}
 
-  object.entries@1.1.8:
-    resolution: {integrity: sha512-cmopxi8VwRIAw/fkijJohSfpef5PdN0pMQJN6VC/ZKvn0LIknWD8KtgY6KlQdEc4tIjcQ3HxSMmnvtzIscdaYQ==}
+  object.entries@1.1.9:
+    resolution: {integrity: sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
     engines: {node: '>= 0.4'}
 
   object.fromentries@2.0.8:
@@ -4222,14 +3292,6 @@ packages:
   once@1.4.0:
     resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
 
-  onetime@5.1.2:
-    resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
-    engines: {node: '>=6'}
-
-  onetime@6.0.0:
-    resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
-    engines: {node: '>=12'}
-
   onetime@7.0.0:
     resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
     engines: {node: '>=18'}
@@ -4238,8 +3300,9 @@ packages:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
 
-  ospath@1.2.2:
-    resolution: {integrity: sha512-o6E5qJV5zkAbIDNhGSIlyOhScKXgQrSRMilfph0clDfM0nEnBOlKlH4sWDmG95BW/CvwNz0vmm7dJVtU2KlMiA==}
+  own-keys@1.0.1:
+    resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
+    engines: {node: '>= 0.4'}
 
   p-debounce@4.0.0:
     resolution: {integrity: sha512-4Ispi9I9qYGO4lueiLDhe4q4iK5ERK8reLsuzH6BPaXn53EGaua8H66PXIFGrW897hwjXp+pVLrm/DLxN0RF0A==}
@@ -4253,10 +3316,6 @@ packages:
     resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
     engines: {node: '>=10'}
 
-  p-map@4.0.0:
-    resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
-    engines: {node: '>=10'}
-
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
@@ -4270,8 +3329,8 @@ packages:
     resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
     engines: {node: '>=6'}
 
-  parse-entities@4.0.1:
-    resolution: {integrity: sha512-SWzvYcSJh4d/SGLIOQfZ/CoNv6BTlI6YEQ7Nj82oDVnRpwe/Z/F1EMx42x3JAOwGBlCjeCH0BRJQbQ/opHL17w==}
+  parse-entities@4.0.2:
+    resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==}
 
   parse-numeric-range@1.3.0:
     resolution: {integrity: sha512-twN+njEipszzlMJd4ONUYgSfZPDxgHhT9Ahed5uTigpQn90FggW4SA/AIPq/6a149fTbE9qBEcSwE3FAEp6wQQ==}
@@ -4279,6 +3338,9 @@ packages:
   parse5@7.2.1:
     resolution: {integrity: sha512-BuBYQYlv1ckiPdQi/ohiivi9Sagc9JG+Ozs0r7b/0iK3sKmrb0b9FdWdBbOdx6hBCM/F9Ir82ofnBhtZOjCRPQ==}
 
+  parse5@7.3.0:
+    resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
+
   path-browserify@1.0.1:
     resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==}
 
@@ -4286,10 +3348,6 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
-  path-is-absolute@1.0.1:
-    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
-    engines: {node: '>=0.10.0'}
-
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
@@ -4305,12 +3363,8 @@ packages:
     resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
     engines: {node: '>=16 || 14 >=14.18'}
 
-  path-type@4.0.0:
-    resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
-    engines: {node: '>=8'}
-
-  pathe@1.1.2:
-    resolution: {integrity: sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==}
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
   pathval@2.0.0:
     resolution: {integrity: sha512-vE7JKRyES09KiunauX7nd2Q9/L7lhok4smP9RZTDeD4MVs72Dp2qNFVz39Nz5a0FVEW0BJR6C0DYrq6unoziZA==}
@@ -4319,18 +3373,9 @@ packages:
   patternfly@3.59.5:
     resolution: {integrity: sha512-SMQynv9eFrWWG0Ujta5+jPjxHdQB3xkTLiDW5VP8XXc0nGUxXb4EnZh21qiMeGGJYaKpu9CzaPEpCvuBxgYWHQ==}
 
-  pcg@1.1.0:
-    resolution: {integrity: sha512-S+bYs8CV6l2lj01PRN4g9EiHDktcXJKD9FdE/FqpdXSuy1zImsRq8A8T5UK6gkXdI9O5YFdAgH40uPoR8Bk8aQ==}
-
   peek-stream@1.1.3:
     resolution: {integrity: sha512-FhJ+YbOSBb9/rIl2ZeE/QHEsWn7PqNYt8ARAY3kIgNGOk13g9FGyIY6JIl/xB/3TFRVoTv5as0l11weORrTekA==}
 
-  pend@1.2.0:
-    resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==}
-
-  performance-now@2.1.0:
-    resolution: {integrity: sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==}
-
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
@@ -4347,50 +3392,30 @@ packages:
     engines: {node: '>=0.10'}
     hasBin: true
 
-  pify@2.3.0:
-    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
-    engines: {node: '>=0.10.0'}
+  pkg-types@1.3.1:
+    resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
-  pkg-types@1.2.1:
-    resolution: {integrity: sha512-sQoqa8alT3nHjGuTjuKgOnvjo4cljkufdtLMnO2LBP/wRwuDlo1tkaEdMxCRhyGRPacv/ztlZgDPm2b7FAmEvw==}
+  pkg-types@2.1.0:
+    resolution: {integrity: sha512-wmJwA+8ihJixSoHKxZJRBQG1oY8Yr9pGLzRmSsNms0iNWyHHAlZCa7mmKiFR10YPZuz/2k169JiS/inOjBCZ2A==}
 
-  playwright-core@1.49.1:
-    resolution: {integrity: sha512-BzmpVcs4kE2CH15rWfzpjzVGhWERJfmnXmniSyKeRZUs9Ws65m+RGIi7mjJK/euCegfn3i7jvqWeWyHe9y3Vgg==}
+  playwright-core@1.53.2:
+    resolution: {integrity: sha512-ox/OytMy+2w1jcYEYlOo1Hhp8hZkLCximMTUTMBXjGUA1KoFfiSZ+DU+3a739jsPY0yoKH2TFy9S2fsJas8yAw==}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.49.1:
-    resolution: {integrity: sha512-VYL8zLoNTBxVOrJBbDuRgDWa3i+mfQgDTrL8Ah9QXZ7ax4Dsj0MSq5bYgytRnDVVe+njoKnfsYkH3HzqVj5UZA==}
+  playwright@1.53.2:
+    resolution: {integrity: sha512-6K/qQxVFuVQhRQhFsVZ9fGeatxirtrpPgxzBYWyZLEXJzqYwuL4fuNmfOfD5et1tJE4GScKyPNeLhZeRwuTU3A==}
     engines: {node: '>=18'}
     hasBin: true
 
-  pluralize@8.0.0:
-    resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
-    engines: {node: '>=4'}
-
-  possible-typed-array-names@1.0.0:
-    resolution: {integrity: sha512-d7Uw+eZoloe0EHDIYoe+bQ5WXnGMOpmiZFTuMWCwpjzzkL2nTjcKiAk4hh8TjnGye2TwWOk3UXucZ+3rbmBa8Q==}
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
 
-  postcss-values-parser@6.0.2:
-    resolution: {integrity: sha512-YLJpK0N1brcNJrs9WatuJFtHaV9q5aAOj+S4DI5S7jgHlRfm0PIbDCAFRYMQD5SHq7Fy6xsDhyutgS0QOAs0qw==}
-    engines: {node: '>=10'}
-    peerDependencies:
-      postcss: ^8.2.9
-
-  postcss@8.4.49:
-    resolution: {integrity: sha512-OCVPnIObs4N29kxTjzLfUryOkvZEq+pf8jTF0lg8E7uETuWHA+v7j3c/xJmiqpX450191LlmZfUKkXxkTry7nA==}
+  postcss@8.5.6:
+    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
     engines: {node: ^10 || ^12 || >=14}
 
-  precinct@12.1.2:
-    resolution: {integrity: sha512-x2qVN3oSOp3D05ihCd8XdkIPuEQsyte7PSxzLqiRgktu79S5Dr1I75/S+zAup8/0cwjoiJTQztE9h0/sWp9bJQ==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  precond@0.2.3:
-    resolution: {integrity: sha512-QCYG84SgGyGzqJ/vlMsxeXd/pgL/I94ixdNFyh1PusWmTCyVfPJjZ1K1jvHtsbfnXQs2TSkEP2fR7QiMZAnKFQ==}
-    engines: {node: '>= 0.6'}
-
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -4399,15 +3424,11 @@ packages:
     resolution: {integrity: sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==}
     engines: {node: '>=6.0.0'}
 
-  prettier@3.4.2:
-    resolution: {integrity: sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ==}
+  prettier@3.6.2:
+    resolution: {integrity: sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==}
     engines: {node: '>=14'}
     hasBin: true
 
-  pretty-bytes@5.6.0:
-    resolution: {integrity: sha512-FFw039TmrBqFK8ma/7OL3sDz/VytdtJr044/QUJtH0wK9lb9jLq9tJyIxUwtQJHwar2BqtiA4iCWSwo9JLkzFg==}
-    engines: {node: '>=6'}
-
   pretty-format@27.5.1:
     resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==}
     engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
@@ -4415,27 +3436,26 @@ packages:
   process-nextick-args@2.0.1:
     resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
 
-  process@0.11.10:
-    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
-    engines: {node: '>= 0.6.0'}
-
   prop-types@15.8.1:
     resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
 
   proper-lockfile@4.1.2:
     resolution: {integrity: sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==}
 
+  properties-file@3.5.12:
+    resolution: {integrity: sha512-7dvf+jph2BoEWv0NskL0RIuBocAzf7R62qvG1K8q5ea8BddjepuwFiLLH1bgQGzSYYNvJHDXonnssd9dZ07RGA==}
+
   property-information@6.5.0:
     resolution: {integrity: sha512-PgTgs/BlvHxOu8QuEN7wi5A0OmXaBcHpmCSTehcs6Uuu9IkDIEo13Hy7n898RHfrQ49vKCoGeWZSaAK01nwVig==}
 
-  proxy-from-env@1.0.0:
-    resolution: {integrity: sha512-F2JHgJQ1iqwnHDcQjVBsq3n/uoaFL+iPW/eAeL7kVxy/2RrWaN4WroKjjvbsoRtv0ftelNyC01bjRhn/bhcf4A==}
+  property-information@7.0.0:
+    resolution: {integrity: sha512-7D/qOz/+Y4X/rzSB6jKxKUsQnphO046ei8qxG59mtM3RG3DHgTK81HrxrmoDVINJb8NKT5ZsRbwHvQ6B68Iyhg==}
 
   pump@2.0.1:
     resolution: {integrity: sha512-ruPMNRkN3MHP1cWJc9OWr+T/xDP0jhXYCLfJcBuX54hhfIBnaQmAUMfDcG4DM5UMWByBbJY69QSphm3jtDKIkA==}
 
-  pump@3.0.2:
-    resolution: {integrity: sha512-tUPXtzlGM8FE3P0ZL6DVs/3P58k9nk8/jZeQCurTJylQA8qFYzHFfhBJkuqyE0FifOsQ0uKWekiZ5g8wtr28cw==}
+  pump@3.0.3:
+    resolution: {integrity: sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==}
 
   pumpify@1.5.1:
     resolution: {integrity: sha512-oClZI37HvuUJJxSKKrC17bZ9Cu0ZYhEAGPsPUy9KlMUmv9dKX2o77RUmq7f3XjIxbwyGwYzbzQ1L2Ks8sIradQ==}
@@ -4444,25 +3464,12 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  qs@6.13.0:
-    resolution: {integrity: sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==}
-    engines: {node: '>=0.6'}
+  quansync@0.2.10:
+    resolution: {integrity: sha512-t41VRkMYbkHyCYmOvx/6URnN80H7k4X0lLdBMGsz+maAwrJQYB1djpV6vHrQIBE0WBSGqhtEHrK9U3DWWH8v7A==}
 
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
-  queue-tick@1.0.1:
-    resolution: {integrity: sha512-kJt5qhMxoszgU/62PLP1CJytzd2NKetjSRnyuj31fDd3Rlcz3fzlFdFLD1SItunPwyqEOkca6GbV612BWfaBag==}
-
-  quote-unquote@1.0.0:
-    resolution: {integrity: sha512-twwRO/ilhlG/FIgYeKGFqyHhoEhqgnKVkcmqMKi2r524gz3ZbDTcyFt38E9xjJI2vT+KbRNHVbnJ/e0I25Azwg==}
-
-  rambda@7.5.0:
-    resolution: {integrity: sha512-y/M9weqWAH4iopRd7EHDEQQvpFPHj1AA3oHozE9tfITHUtTR7Z9PSlIRRG2l1GuW7sefC1cXFfIcF+cgnShdBA==}
-
-  ramda@0.29.1:
-    resolution: {integrity: sha512-OfxIeWzd4xdUNxlWhgFazxsA/nl3mS4/jGZI5n00uWOoSSFRhC1b6gl6xvmzUamgmqELraWp0J/qqVlXYPDPyA==}
-
   randombytes@2.1.0:
     resolution: {integrity: sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==}
 
@@ -4471,30 +3478,33 @@ packages:
     peerDependencies:
       react: ^18.3.1
 
-  react-dropzone@14.3.5:
-    resolution: {integrity: sha512-9nDUaEEpqZLOz5v5SUcFA0CjM4vq8YbqO0WRls+EYT7+DvxUdzDPKNCPLqGfj3YL9MsniCLCD4RFA6M95V6KMQ==}
+  react-dropzone@14.3.8:
+    resolution: {integrity: sha512-sBgODnq+lcA4P296DY4wacOZz3JFpD99fp+hb//iBO2HHnyeZU3FwWyXJ6salNpqQdsZrgMrotuko/BdJMV8Ug==}
     engines: {node: '>= 10.13'}
     peerDependencies:
       react: '>= 16.8 || 18.0.0'
 
-  react-hook-form@7.54.2:
-    resolution: {integrity: sha512-eHpAUgUjWbZocoQYUHposymRb4ZP6d0uwUnooL2uOybA9/3tPUvoAKqEWK1WaSiTxxOfTpffNZP7QwlnM3/gEg==}
+  react-hook-form@7.60.0:
+    resolution: {integrity: sha512-SBrYOvMbDB7cV8ZfNpaiLcgjH/a1c7aK0lK+aNigpf4xWLO8q+o4tcvVurv3c4EOyzn/3dCsYt4GKD42VvJ/+A==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17 || ^18 || ^19
 
-  react-i18next@15.4.0:
-    resolution: {integrity: sha512-Py6UkX3zV08RTvL6ZANRoBh9sL/ne6rQq79XlkHEdd82cZr2H9usbWpUNVadJntIZP2pu3M2rL1CN+5rQYfYFw==}
+  react-i18next@15.5.3:
+    resolution: {integrity: sha512-ypYmOKOnjqPEJZO4m1BI0kS8kWqkBNsKYyhVUfij0gvjy9xJNoG/VcGkxq5dRlVwzmrmY1BQMAmpbbUBLwC4Kw==}
     peerDependencies:
       i18next: '>= 23.2.3'
       react: '>= 16.8.0'
       react-dom: '*'
       react-native: '*'
+      typescript: ^5
     peerDependenciesMeta:
       react-dom:
         optional: true
       react-native:
         optional: true
+      typescript:
+        optional: true
 
   react-is@16.13.1:
     resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
@@ -4502,15 +3512,15 @@ packages:
   react-is@17.0.2:
     resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==}
 
-  react-router-dom@6.28.1:
-    resolution: {integrity: sha512-YraE27C/RdjcZwl5UCqF/ffXnZDxpJdk9Q6jw38SZHjXs7NNdpViq2l2c7fO7+4uWaEfcwfGCv3RSg4e1By/fQ==}
+  react-router-dom@6.30.1:
+    resolution: {integrity: sha512-llKsgOkZdbPU1Eg3zK8lCn+sjD9wMRZZPuzmdWWX5SUs8OFkN5HnFVC0u5KMeMaC9aoancFI/KoLuKPqN+hxHw==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       react: '>=16.8'
       react-dom: '>=16.8'
 
-  react-router@6.28.1:
-    resolution: {integrity: sha512-2omQTA3rkMljmrvvo6WtewGdVh45SpL9hGiCI9uUrwGGfNFDIvGK4gYJsKlJoNVi6AQZcopSCballL+QGOm7fA==}
+  react-router@6.30.1:
+    resolution: {integrity: sha512-X1m21aEmxGXqENEPG3T6u0Th7g0aS4ZmoNynhbs+Cn+q+QGTLt+d5IQ2bHAXKzKcxGJjxACpVbnYQSCRcfxHlQ==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       react: '>=16.8'
@@ -4532,26 +3542,26 @@ packages:
     resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
     engines: {node: '>=8.10.0'}
 
-  rechoir@0.6.2:
-    resolution: {integrity: sha512-HFM8rkZ+i3zrV+4LQjwQ0W+ez98pApMGM3HUrN04j3CqzPOzl9nmP15Y8YXNm8QHGv/eacOVEjqhmWpkRV0NAw==}
-    engines: {node: '>= 0.10'}
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
 
   redent@3.0.0:
     resolution: {integrity: sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==}
     engines: {node: '>=8'}
 
-  reflect.getprototypeof@1.0.9:
-    resolution: {integrity: sha512-r0Ay04Snci87djAsI4U+WNRcSw5S4pOH7qFjd/veA5gC7TbqESR3tcj28ia95L/fYUDw11JKP7uqUKUAfVvV5Q==}
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
     engines: {node: '>= 0.4'}
 
-  refractor@4.8.1:
-    resolution: {integrity: sha512-/fk5sI0iTgFYlmVGYVew90AoYnNMP6pooClx/XKqyeeCQXrL0Kvgn8V0VEht5ccdljbzzF1i3Q213gcntkRExg==}
+  refractor@4.9.0:
+    resolution: {integrity: sha512-nEG1SPXFoGGx+dcjftjv8cAjEusIh6ED1xhf5DG3C0x/k+rmZ2duKnc3QLpt6qeHv5fPb8uwN3VWN2BT7fr3Og==}
 
   regenerator-runtime@0.14.1:
     resolution: {integrity: sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==}
 
-  regexp.prototype.flags@1.5.3:
-    resolution: {integrity: sha512-vqlC04+RQoFalODCbCumG2xIOvapzVMHwsyIGM/SIE8fRhFFsXeH8/QQ+s0T0kDAhKc4k30s73/0ydkHQz6HlQ==}
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
     engines: {node: '>= 0.4'}
 
   rehype-parse@9.0.1:
@@ -4566,13 +3576,6 @@ packages:
   rehype@13.0.2:
     resolution: {integrity: sha512-j31mdaRFrwFRUIlxGeuPXXKWQxet52RBQRvCmzl5eCefn/KGbomK5GMHNMsOJf55fgo3qw5tST5neDuarDYR2A==}
 
-  request-progress@3.0.0:
-    resolution: {integrity: sha512-MnWzEHHaxHO2iWiQuHrUPBi/1WeBf5PkxQqNyNvLl9VAYSdXkP8tQ3pBSeCPD+yw0v0Aq1zosWLz0BdeXpWwZg==}
-
-  require-and-forget@1.0.1:
-    resolution: {integrity: sha512-Sea861D/seGo3cptxc857a34Df0oEijXit8Q3IDodiwZMzVmyXrRI9EgQQa3hjkhoEjNzCBvv0t/0fMgebmWLg==}
-    engines: {node: '>=6'}
-
   require-directory@2.1.1:
     resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
     engines: {node: '>=0.10.0'}
@@ -4581,19 +3584,6 @@ packages:
     resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
     engines: {node: '>=0.10.0'}
 
-  requirejs-config-file@4.0.0:
-    resolution: {integrity: sha512-jnIre8cbWOyvr8a5F2KuqBnY+SDA4NXr/hzEZJG79Mxm2WiFQz2dzhC8ibtPJS7zkmBEl1mxSwp5HhC1W4qpxw==}
-    engines: {node: '>=10.13.0'}
-
-  requirejs@2.3.7:
-    resolution: {integrity: sha512-DouTG8T1WanGok6Qjg2SXuCMzszOo0eHeH9hDZ5Y4x8Je+9JB38HdTLT4/VA8OaUhBa0JPVHJ0pyBkM1z+pDsw==}
-    engines: {node: '>=0.4.0'}
-    hasBin: true
-
-  resolve-dependency-path@4.0.0:
-    resolution: {integrity: sha512-hlY1SybBGm5aYN3PC4rp15MzsJLM1w+MEA/4KU3UBPfz4S0lL3FL6mgv7JgaA8a+ZTeEQAiF1a1BuN2nkqiIlg==}
-    engines: {node: '>=18'}
-
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -4601,18 +3591,15 @@ packages:
   resolve-pkg-maps@1.0.0:
     resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
 
-  resolve@1.22.8:
-    resolution: {integrity: sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==}
+  resolve@1.22.10:
+    resolution: {integrity: sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==}
+    engines: {node: '>= 0.4'}
     hasBin: true
 
   resolve@2.0.0-next.5:
     resolution: {integrity: sha512-U7WjGVG9sH8tvjW5SmGbQuui75FiyjAX72HX15DwBBwF9dNiQZRQAg9nnPhYy+TUnE0+VcrttuvNI8oSxZcocA==}
     hasBin: true
 
-  restore-cursor@3.1.0:
-    resolution: {integrity: sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==}
-    engines: {node: '>=8'}
-
   restore-cursor@5.1.0:
     resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
     engines: {node: '>=18'}
@@ -4621,8 +3608,8 @@ packages:
     resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
     engines: {node: '>= 4'}
 
-  reusify@1.0.4:
-    resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
   rfc4648@1.5.4:
@@ -4636,13 +3623,8 @@ packages:
     peerDependencies:
       rollup: '*'
 
-  rollup@4.30.0:
-    resolution: {integrity: sha512-sDnr1pcjTgUT69qBksNF1N1anwfbyYG6TBQ22b03bII8EdiUQ7J0TlozVaTMjT/eEJAO49e1ndV7t+UZfL1+vA==}
-    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
-    hasBin: true
-
-  rollup@4.30.1:
-    resolution: {integrity: sha512-mlJ4glW020fPuLi7DkM/lN97mYEZGWeqBnrljzN0gs7GLctqX3lNWxKQ7Gl712UAX+6fog/L3jh4gb7R6aVi3w==}
+  rollup@4.44.2:
+    resolution: {integrity: sha512-PVoapzTwSEcelaWGth3uR66u7ZRo6qhPHc0f2uRO9fX6XDVNrIiGYS0Pj9+R8yIIYSD/mCx2b16Ws9itljKSPg==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -4652,9 +3634,6 @@ packages:
   run-parallel@1.2.0:
     resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
 
-  rxjs@7.8.1:
-    resolution: {integrity: sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==}
-
   safe-array-concat@1.1.3:
     resolution: {integrity: sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q==}
     engines: {node: '>=0.4'}
@@ -4665,6 +3644,10 @@ packages:
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
   safe-regex-test@1.1.0:
     resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
     engines: {node: '>= 0.4'}
@@ -4672,11 +3655,6 @@ packages:
   safer-buffer@2.1.2:
     resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
 
-  sass-lookup@6.0.1:
-    resolution: {integrity: sha512-nl9Wxbj9RjEJA5SSV0hSDoU2zYGtE+ANaDS4OFUR7nYrquvBFvPKZZtQHe3lvnxCcylEDV00KUijjdMTUElcVQ==}
-    engines: {node: '>=18'}
-    hasBin: true
-
   saxes@6.0.0:
     resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
     engines: {node: '>=v12.22.7'}
@@ -4693,8 +3671,8 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  semver@7.6.3:
-    resolution: {integrity: sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==}
+  semver@7.7.2:
+    resolution: {integrity: sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -4709,6 +3687,10 @@ packages:
     resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
     engines: {node: '>= 0.4'}
 
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
   setimmediate@1.0.5:
     resolution: {integrity: sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==}
 
@@ -4720,11 +3702,6 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
-  shelljs@0.8.5:
-    resolution: {integrity: sha512-TiwcRcrkhHvbrZbnRcFYMLl30Dfov3HKqzp5tO5b4pt6G/SezKcYhmDg15zXVBswHmctSAQKznqNW2LO5tTDow==}
-    engines: {node: '>=4'}
-    hasBin: true
-
   side-channel-list@1.0.0:
     resolution: {integrity: sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==}
     engines: {node: '>= 0.4'}
@@ -4751,24 +3728,8 @@ packages:
     resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
     engines: {node: '>=14'}
 
-  simple-bin-help@1.8.0:
-    resolution: {integrity: sha512-0LxHn+P1lF5r2WwVB/za3hLRIsYoLaNq1CXqjbrs3ZvLuvlWnRKrUjEWzV7umZL7hpQ7xULiQMV+0iXdRa5iFg==}
-    engines: {node: '>=14.16'}
-
-  simple-git@3.27.0:
-    resolution: {integrity: sha512-ivHoFS9Yi9GY49ogc6/YAi3Fl9ROnF4VyubNylgCkA+RVqLaKWnDSzXOVzya8csELIaWaYNutsEuAhZrtOjozA==}
-
-  slash@3.0.0:
-    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
-    engines: {node: '>=8'}
-
-  slice-ansi@3.0.0:
-    resolution: {integrity: sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==}
-    engines: {node: '>=8'}
-
-  slice-ansi@4.0.0:
-    resolution: {integrity: sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==}
-    engines: {node: '>=10'}
+  simple-git@3.28.0:
+    resolution: {integrity: sha512-Rs/vQRwsn1ILH1oBUy8NucJlXmnnLeLCfcvbSehkPzbv3wwoFWIdtfd6Ndo6ZPhlPsCZ60CPI4rxurnwAa+a2w==}
 
   slice-ansi@5.0.0:
     resolution: {integrity: sha512-FC+lgizVPfie0kkhqUScwRu1O/lF6NOgJmlCgK+/LYxDCTk8sGelYaHDhFcDN+Sn3Cv+3VSa4Byeo+IMCzpMgQ==}
@@ -4795,33 +3756,20 @@ packages:
   space-separated-tokens@2.0.2:
     resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
 
-  spec-change@1.11.11:
-    resolution: {integrity: sha512-wSxi1XKeNr8JxBlYj13Lw8TTMpojYU2zRlkmyXl0kHp+xGkwYUpXaVXcofiEmEqrq1HoGg7pwKEzvMjYcQubtw==}
-    hasBin: true
-
   sprintf-js@1.0.3:
     resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
 
-  sshpk@1.18.0:
-    resolution: {integrity: sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==}
-    engines: {node: '>=0.10.0'}
-    hasBin: true
-
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
-  std-env@3.8.0:
-    resolution: {integrity: sha512-Bc3YwwCB+OzldMxOXJIIvC6cPRWr/LxOp48CdQTOkPyk/t4JWWJbrilwBd7RJzKV8QW7tJkcgAmeuLLJugl5/w==}
-
-  stop-iteration-iterator@1.0.0:
-    resolution: {integrity: sha512-iCGQj+0l0HOdZ2AEeBADlsRC+vsnDsZsbdSiH1yNSjcfKM7fdpCMfqAL/dwF5BLiw/XhRft/Wax6zQbhq2BcjQ==}
-    engines: {node: '>= 0.4'}
+  std-env@3.9.0:
+    resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
 
   stream-shift@1.0.3:
     resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==}
 
-  streamx@2.20.2:
-    resolution: {integrity: sha512-aDGDLU+j9tJcUdPGOaHmVF1u/hhI+CsGkT02V3OKlHDV7IukOI+nTWAGkiZEKCO35rWN1wIr4tS7YFr1f4qSvA==}
+  streamx@2.22.1:
+    resolution: {integrity: sha512-znKXEBxfatz2GBNK02kRnCXjV+AA4kjZIUxeWSr3UGirZMJfTE9uiwKHobnbgxWyL/JWro8tTq+vOqAK1/qbSA==}
 
   string-argv@0.3.2:
     resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==}
@@ -4864,10 +3812,6 @@ packages:
   stringify-entities@4.0.4:
     resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
 
-  stringify-object@3.3.0:
-    resolution: {integrity: sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw==}
-    engines: {node: '>=4'}
-
   strip-ansi@6.0.1:
     resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
     engines: {node: '>=8'}
@@ -4876,18 +3820,6 @@ packages:
     resolution: {integrity: sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==}
     engines: {node: '>=12'}
 
-  strip-bom@3.0.0:
-    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
-    engines: {node: '>=4'}
-
-  strip-final-newline@2.0.0:
-    resolution: {integrity: sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==}
-    engines: {node: '>=6'}
-
-  strip-final-newline@3.0.0:
-    resolution: {integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==}
-    engines: {node: '>=12'}
-
   strip-indent@3.0.0:
     resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
     engines: {node: '>=8'}
@@ -4896,10 +3828,8 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
-  stylus-lookup@6.0.0:
-    resolution: {integrity: sha512-RaWKxAvPnIXrdby+UWCr1WRfa+lrPMSJPySte4Q6a+rWyjeJyFOLJxr5GrAVfcMCsfVlCuzTAJ/ysYT8p8do7Q==}
-    engines: {node: '>=18'}
-    hasBin: true
+  strip-literal@3.0.0:
+    resolution: {integrity: sha512-TcccoMhJOM3OebGhSBEmp3UZ2SfDMZUEBdRA/9ynfLi8yYajyWX3JiXArcJt4Umh4vISpspkQIY8ZZoCqjbviA==}
 
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
@@ -4916,109 +3846,82 @@ packages:
   symbol-tree@3.2.4:
     resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
 
-  synckit@0.9.2:
-    resolution: {integrity: sha512-vrozgXDQwYO72vHjUb/HnFbQx1exDjoKzqx23aXEg2a9VIg2TSFZ8FmeZpTjUCFMYw7mpX4BE2SFu8wI7asYsw==}
+  synckit@0.11.8:
+    resolution: {integrity: sha512-+XZ+r1XGIJGeQk3VvXhT6xx/VpbHsRzsTkGgF6E5RX9TTXD0118l87puaEBZ566FhqblC6U0d4XnubznJDm30A==}
     engines: {node: ^14.18.0 || >=16.0.0}
 
   tabbable@6.2.0:
     resolution: {integrity: sha512-Cat63mxsVJlzYvN51JmVXIgNoUokrIaT2zLclCXjRd8boZ0004U4KCs/sToJ75C6sdlByWxpYnb5Boif1VSFew==}
 
-  tapable@2.2.1:
-    resolution: {integrity: sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==}
-    engines: {node: '>=6'}
-
-  tar-fs@3.0.7:
-    resolution: {integrity: sha512-2sAfoF/zw/2n8goUGnGRZTWTD4INtnScPZvyYBI6BDlJ3wNR5o1dw03EfBvuhG6GBLvC4J+C7j7W+64aZ0ogQA==}
+  tar-fs@3.1.0:
+    resolution: {integrity: sha512-5Mty5y/sOF1YWj1J6GiBodjlDc05CUR8PKXrsnFAiSG0xA+GHeWLovaZPYUDXkH/1iKRf2+M5+OrRgzC7O9b7w==}
 
   tar-stream@3.1.7:
     resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==}
 
-  terser@5.36.0:
-    resolution: {integrity: sha512-IYV9eNMuFAV4THUspIRXkLakHnV6XO7FEdtKjf/mDyrnqUg9LnlOn6/RwRvM9SZjR4GUq8Nk8zj67FzVARr74w==}
+  terser@5.39.0:
+    resolution: {integrity: sha512-LBAhFyLho16harJoWMg/nZsQYgTrg5jXOn2nCYjRUcZZEdE3qa2zb8QEDRUGVZBW4rlazf2fxkg8tztybTaqWw==}
     engines: {node: '>=10'}
     hasBin: true
 
-  text-decoder@1.2.1:
-    resolution: {integrity: sha512-x9v3H/lTKIJKQQe7RPQkLfKAnc9lUTkWDypIQgTzPJAq+5/GCDHonmshfvlsNSj58yyshbIJJDLmU15qNERrXQ==}
-
-  throttleit@1.0.1:
-    resolution: {integrity: sha512-vDZpf9Chs9mAdfY046mcPt8fg5QSZr37hEH4TXYBnDF+izxgrbRGUAAaBvIk/fJm9aOFCGFd1EsNg5AZCbnQCQ==}
+  text-decoder@1.2.3:
+    resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}
 
   through2@2.0.5:
     resolution: {integrity: sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==}
 
-  through@2.3.8:
-    resolution: {integrity: sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==}
-
   tiny-invariant@1.3.3:
     resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
 
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@0.3.1:
-    resolution: {integrity: sha512-WiCJLEECkO18gwqIp6+hJg0//p23HXp4S+gGtAKu3mI2F2/sXC4FvHvXvB0zJVVaTPhx1/tOwdbRsa1sOBIKqQ==}
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
 
-  tinyglobby@0.2.10:
-    resolution: {integrity: sha512-Zc+8eJlFMvgatPZTl6A9L/yht8QqdmUNtURHaKZLmKBE12hNPSrqNkUp2cs3M/UKmNVVAMFQYSjYIVHDjW5zew==}
+  tinyglobby@0.2.14:
+    resolution: {integrity: sha512-tX5e7OM1HnYr2+a2C/4V0htOcSQcoSTH9KgJnVvNm5zm/cyEWKJ7j7YutsH9CxMdtOkkLFy2AHrMci9IM8IPZQ==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@1.0.2:
-    resolution: {integrity: sha512-al6n+QEANGFOMf/dmUMsuS5/r9B06uwlyNjZZql/zv8J7ybHCgoihBNORZCY2mzUuAnomQa2JdhyHKzZxPCrFA==}
+  tinypool@1.1.1:
+    resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
     engines: {node: ^18.0.0 || >=20.0.0}
 
-  tinyrainbow@1.2.0:
-    resolution: {integrity: sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==}
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
     engines: {node: '>=14.0.0'}
 
-  tinyspy@3.0.2:
-    resolution: {integrity: sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==}
+  tinyspy@4.0.3:
+    resolution: {integrity: sha512-t2T/WLB2WRgZ9EpE4jgPJ9w+i66UZfDc8wHh0xrwiRNN+UwH98GIJkTeZqX9rg0i0ptwzqW+uYeIF0T4F8LR7A==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@6.1.64:
-    resolution: {integrity: sha512-uqnl8vGV16KsyflHOzqrYjjArjfXaU6rMPXYy2/ZWoRKCkXtghgB4VwTDXUG+t0OTGeSewNAG31/x1gCTfLt+Q==}
+  tldts-core@6.1.86:
+    resolution: {integrity: sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==}
 
-  tldts@6.1.64:
-    resolution: {integrity: sha512-ph4AE5BXWIOsSy9stpoeo7bYe/Cy7VfpciIH4RhVZUPItCJmhqWCN0EVzxd8BOHiyNb42vuJc6NWTjJkg91Tuw==}
+  tldts@6.1.86:
+    resolution: {integrity: sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==}
     hasBin: true
 
-  tmp@0.2.3:
-    resolution: {integrity: sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==}
-    engines: {node: '>=14.14'}
-
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
 
-  tough-cookie@5.0.0:
-    resolution: {integrity: sha512-FRKsF7cz96xIIeMZ82ehjC3xW2E+O2+v11udrDYewUbszngYhsGa8z6YUMMzO9QJZzzyd0nGGXnML/TReX6W8Q==}
+  tough-cookie@5.1.2:
+    resolution: {integrity: sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==}
     engines: {node: '>=16'}
 
-  tr46@0.0.3:
-    resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
-
-  tr46@5.0.0:
-    resolution: {integrity: sha512-tk2G5R2KRwBd+ZN0zaEXpmzdKyOYksXwywulIX95MBODjSzMIuQnQ3m8JxgbhnL1LeVo7lqQKsYa1O3Htl7K5g==}
+  tr46@5.1.0:
+    resolution: {integrity: sha512-IUWnUK7ADYR5Sl1fZlO1INDUhVhatWl7BtJWsIhwJ0UAK7ilzzIa8uIqOO/aYVWHZPJkKbEL+362wrzoeRF7bw==}
     engines: {node: '>=18'}
 
-  tree-kill@1.2.2:
-    resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
-    hasBin: true
-
   trim-lines@3.0.1:
     resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==}
 
   trough@2.2.0:
     resolution: {integrity: sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==}
 
-  ts-api-utils@1.4.3:
-    resolution: {integrity: sha512-i3eMG77UTMD0hZhgRS562pv83RC6ukSAC2GMNWc+9dieh/+jDM5u5YG+NHX6VNDRHQcHwmsTHctP9LhbC3WxVw==}
-    engines: {node: '>=16'}
-    peerDependencies:
-      typescript: '>=4.2.0'
-
-  ts-api-utils@2.0.0:
-    resolution: {integrity: sha512-xCt/TOAc+EOHS1XPnijD3/yzpH6qg2xppZO1YDqGoVsNXfQfzHpOdNuXwrwOU8u4ITXJyDCTyt8w5g1sZv9ynQ==}
+  ts-api-utils@2.1.0:
+    resolution: {integrity: sha512-CUgTZL1irw8u29bzrOD/nH85jqyc74D6SshFgujOIA7osm2Rz7dYH77agkx7H4FBNxDq7Cjf+IjaX/8zwFW+ZQ==}
     engines: {node: '>=18.12'}
     peerDependencies:
       typescript: '>=4.8.4'
@@ -5037,28 +3940,14 @@ packages:
       '@swc/wasm':
         optional: true
 
-  tsconfig-paths@4.2.0:
-    resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
-    engines: {node: '>=6'}
-
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
-  tsx@4.19.2:
-    resolution: {integrity: sha512-pOUl6Vo2LUq/bSa8S5q7b91cgNSjctn9ugq/+Mvow99qW6x/UZYwzxy/3NmqoT66eHYfCVvFvACC58UBPFf28g==}
+  tsx@4.19.3:
+    resolution: {integrity: sha512-4H8vUNGNjQ4V2EOoGw005+c+dGuPSnhpPBPHBtsZdGZBk/iJb4kguGlPWaZTZ3q5nMtFOEsY0nRDlh9PJyd6SQ==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
-  tunnel-agent@0.6.0:
-    resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
-
-  tunnel@0.0.6:
-    resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
-    engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
-
-  tweetnacl@0.14.5:
-    resolution: {integrity: sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==}
-
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -5067,10 +3956,6 @@ packages:
     resolution: {integrity: sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==}
     engines: {node: '>=10'}
 
-  type-fest@0.21.3:
-    resolution: {integrity: sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==}
-    engines: {node: '>=10'}
-
   typed-array-buffer@1.0.3:
     resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
     engines: {node: '>= 0.4'}
@@ -5087,20 +3972,25 @@ packages:
     resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==}
     engines: {node: '>= 0.4'}
 
-  typescript-eslint@8.19.1:
-    resolution: {integrity: sha512-LKPUQpdEMVOeKluHi8md7rwLcoXHhwvWp3x+sJkMuq3gGm9yaYJtPo8sRZSblMFJ5pcOGCAak/scKf1mvZDlQw==}
+  typescript-eslint@8.36.0:
+    resolution: {integrity: sha512-fTCqxthY+h9QbEgSIBfL9iV6CvKDFuoxg6bHPNpJ9HIUzS+jy2lCEyCmGyZRWEBSaykqcDPf1SJ+BfCI8DRopA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
-      typescript: '>=4.8.4 <5.8.0'
+      typescript: '>=4.8.4 <5.9.0'
+
+  typescript@5.8.2:
+    resolution: {integrity: sha512-aJn6wq13/afZp/jT9QZmwEjDqqvSGp1VT5GVg+f/t6/oVyrgXM6BY1h9BRh/O5p3PlUPAe+WuiEZOmb/49RqoQ==}
+    engines: {node: '>=14.17'}
+    hasBin: true
 
-  typescript@5.7.2:
-    resolution: {integrity: sha512-i5t66RHxDvVN40HfDd1PsEThGNnlMCMT3jMUuoh9/0TaqWevNontacunWyN02LA9/fIbEWlcHZcgTKb9QoaLfg==}
+  typescript@5.8.3:
+    resolution: {integrity: sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==}
     engines: {node: '>=14.17'}
     hasBin: true
 
-  ufo@1.5.4:
-    resolution: {integrity: sha512-UsUk3byDzKd04EyoZ7U4DOlxQaD14JUKQl6/P7wiX4FNvUfm3XL246n9W5AmqwW5RSFJ27NAuM0iLscAOYUiGQ==}
+  ufo@1.6.1:
+    resolution: {integrity: sha512-9a4/uxlTWJ4+a5i0ooc1rU7C7YOw3wT+UGqdeNNHWnOF9qcMBgLRS+4IYUqbczewFx4mLEig6gawh7X6mFlEkA==}
 
   unbox-primitive@1.1.0:
     resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
@@ -5109,9 +3999,12 @@ packages:
   undici-types@6.20.0:
     resolution: {integrity: sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==}
 
-  undici@5.28.4:
-    resolution: {integrity: sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==}
-    engines: {node: '>=14.0'}
+  undici-types@7.8.0:
+    resolution: {integrity: sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw==}
+
+  unicorn-magic@0.3.0:
+    resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
+    engines: {node: '>=18'}
 
   unified@11.0.5:
     resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==}
@@ -5134,23 +4027,15 @@ packages:
   unist-util-visit@5.0.0:
     resolution: {integrity: sha512-MR04uvD+07cwl/yhVuVWAtw+3GOR/knlL55Nd/wAdblk27GCVt3lqpTivy/tkJcZoNPzTwS1Y+KMojlLDhoTzg==}
 
-  universal-user-agent@7.0.2:
-    resolution: {integrity: sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q==}
-
-  universalify@0.1.2:
-    resolution: {integrity: sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==}
-    engines: {node: '>= 4.0.0'}
+  universal-user-agent@7.0.3:
+    resolution: {integrity: sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==}
 
   universalify@2.0.1:
     resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
     engines: {node: '>= 10.0.0'}
 
-  untildify@4.0.0:
-    resolution: {integrity: sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==}
-    engines: {node: '>=8'}
-
-  update-browserslist-db@1.1.1:
-    resolution: {integrity: sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==}
+  update-browserslist-db@1.1.2:
+    resolution: {integrity: sha512-PPypAm5qvlD7XMZC3BujecnaOxwhrtoFR+Dqkk5Aa/6DssiH0ibKoketaj9w8LP7Bont1rYeoV5plxD7RTEPRg==}
     hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
@@ -5172,37 +4057,21 @@ packages:
       react: '>=16.8'
       react-router-dom: '>=6.0.0'
 
-  use-sync-external-store@1.2.2:
-    resolution: {integrity: sha512-PElTlVMwpblvbNqQ82d2n6RjStvdSoNe9FG28kNfz3WiXilJm4DdNkEzRhCZuIDwY8U08WVihhGR5iRqAwfDiw==}
+  use-sync-external-store@1.4.0:
+    resolution: {integrity: sha512-9WXSPC5fMv61vaupRkCKCxsPxBocVnwakBEkMIHHpkTTg6icbJtg6jzgtLDm4bl3cSHAca52rYWih0k4K3PfHw==}
     peerDependencies:
-      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  uuid@11.0.5:
-    resolution: {integrity: sha512-508e6IcKLrhxKdBbcA2b4KQZlLVp2+J5UwQ6F7Drckkc5N9ZJwFa4TgWtsww9UG8fGHbm6gbV19TdM5pQ4GaIA==}
-    hasBin: true
-
-  uuid@8.3.2:
-    resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
+  uuid@11.1.0:
+    resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==}
     hasBin: true
 
   v8-compile-cache-lib@3.0.1:
     resolution: {integrity: sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==}
 
-  vasync@2.2.1:
-    resolution: {integrity: sha512-Hq72JaTpcTFdWiNA4Y22Amej2GH3BFmBaKPPlDZ4/oC8HNn2ISHLkFrJU4Ds8R3jcUi7oo5Y9jcMHKjES+N9wQ==}
-    engines: {'0': node >=0.6.0}
-
-  verror@1.10.0:
-    resolution: {integrity: sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==}
-    engines: {'0': node >=0.6.0}
-
-  verror@1.10.1:
-    resolution: {integrity: sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==}
-    engines: {node: '>=0.6.0'}
-
   vfile-location@5.0.3:
     resolution: {integrity: sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg==}
 
@@ -5212,25 +4081,25 @@ packages:
   vfile@6.0.3:
     resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
 
-  vite-node@2.1.8:
-    resolution: {integrity: sha512-uPAwSr57kYjAUux+8E2j0q0Fxpn8M9VoyfGiRI8Kfktz9NcYMCenwY5RnZxnF1WTu3TGiYipirIzacLL3VVGFg==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  vite-node@3.2.4:
+    resolution: {integrity: sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
     hasBin: true
 
-  vite-plugin-checker@0.8.0:
-    resolution: {integrity: sha512-UA5uzOGm97UvZRTdZHiQVYFnd86AVn8EVaD4L3PoVzxH+IZSfaAw14WGFwX9QS23UW3lV/5bVKZn6l0w+q9P0g==}
+  vite-plugin-checker@0.10.0:
+    resolution: {integrity: sha512-EcAi4M5mzayH386Hc1xWi+vnfl4a+1vrDP9PVEQImUR6tIjItNK6R/98YNnJkaAq1ond2qkA6f+H49aprUgzGA==}
     engines: {node: '>=14.16'}
     peerDependencies:
       '@biomejs/biome': '>=1.7'
       eslint: '>=7'
-      meow: ^9.0.0
-      optionator: ^0.9.1
-      stylelint: '>=13'
+      meow: ^13.2.0
+      optionator: ^0.9.4
+      stylelint: '>=16'
       typescript: '*'
       vite: '>=2.0.0'
       vls: '*'
       vti: '*'
-      vue-tsc: ~2.1.6
+      vue-tsc: ~2.2.10 || ^3.0.0
     peerDependenciesMeta:
       '@biomejs/biome':
         optional: true
@@ -5251,8 +4120,8 @@ packages:
       vue-tsc:
         optional: true
 
-  vite-plugin-dts@4.5.0:
-    resolution: {integrity: sha512-M1lrPTdi7gilLYRZoLmGYnl4fbPryVYsehPN9JgaxjJKTs8/f7tuAlvCCvOLB5gRDQTTKnptBcB0ACsaw2wNLw==}
+  vite-plugin-dts@4.5.4:
+    resolution: {integrity: sha512-d4sOM8M/8z7vRXHHq/ebbblfaxENjogAAekcfcDCCwAyvGqnPrc7f4NZbvItS+g4WTgerW0xDwSz5qz11JT3vg==}
     peerDependencies:
       typescript: '*'
       vite: '*'
@@ -5260,55 +4129,24 @@ packages:
       vite:
         optional: true
 
-  vite-plugin-lib-inject-css@2.2.1:
-    resolution: {integrity: sha512-PW3n/zRacr7bwNagHOnJfaVLoZyGDCPuFMJTyTFqjk4Xi0HKd1cK5+WlBidBBeWK8QE3SV0i+FsWmN+frBLCVQ==}
-    peerDependencies:
-      vite: '*'
-
-  vite@5.4.11:
-    resolution: {integrity: sha512-c7jFQRklXua0mTzneGW9QVyxFjUgwcihC4bXEtujIo2ouWCe1Ajt/amn2PCxYnhYfd5k09JX3SB7OYWFKYqj8Q==}
-    engines: {node: ^18.0.0 || >=20.0.0}
-    hasBin: true
+  vite-plugin-lib-inject-css@2.2.2:
+    resolution: {integrity: sha512-NF30p0GwtfSAmVlxo2NgPXM2rEdtgV7LFi4lkzajKD7P3Ru/ZAFmI533M0Z5qyMZpvNMxVGkewzpjD0HOWtbDQ==}
     peerDependencies:
-      '@types/node': ^18.0.0 || >=20.0.0
-      less: '*'
-      lightningcss: ^1.21.0
-      sass: '*'
-      sass-embedded: '*'
-      stylus: '*'
-      sugarss: '*'
-      terser: ^5.4.0
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
-      less:
-        optional: true
-      lightningcss:
-        optional: true
-      sass:
-        optional: true
-      sass-embedded:
-        optional: true
-      stylus:
-        optional: true
-      sugarss:
-        optional: true
-      terser:
-        optional: true
+      vite: '*'
 
-  vite@6.0.7:
-    resolution: {integrity: sha512-RDt8r/7qx9940f8FcOIAH9PTViRrghKaK2K1jY3RaAURrEUbm9Du1mJ72G+jlhtG3WwodnfzY8ORQZbBavZEAQ==}
-    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+  vite@7.0.3:
+    resolution: {integrity: sha512-y2L5oJZF7bj4c0jgGYgBNSdIu+5HF+m68rn2cQXFbGoShdhV1phX9rbnxy9YXj82aS8MMsCLAAFkRxZeWdldrQ==}
+    engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
-      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      '@types/node': ^20.19.0 || >=22.12.0
       jiti: '>=1.21.0'
-      less: '*'
+      less: ^4.0.0
       lightningcss: ^1.21.0
-      sass: '*'
-      sass-embedded: '*'
-      stylus: '*'
-      sugarss: '*'
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
       terser: ^5.16.0
       tsx: ^4.8.1
       yaml: ^2.4.2
@@ -5336,20 +4174,23 @@ packages:
       yaml:
         optional: true
 
-  vitest@2.1.8:
-    resolution: {integrity: sha512-1vBKTZskHw/aosXqQUlVWWlGUxSJR8YtiyZDJAFeW2kPAeX6S3Sool0mjspO+kXLuxVWlEDDowBAeqeAQefqLQ==}
-    engines: {node: ^18.0.0 || >=20.0.0}
+  vitest@3.2.4:
+    resolution: {integrity: sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
-      '@types/node': ^18.0.0 || >=20.0.0
-      '@vitest/browser': 2.1.8
-      '@vitest/ui': 2.1.8
+      '@types/debug': ^4.1.12
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      '@vitest/browser': 3.2.4
+      '@vitest/ui': 3.2.4
       happy-dom: '*'
       jsdom: '*'
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
+      '@types/debug':
+        optional: true
       '@types/node':
         optional: true
       '@vitest/browser':
@@ -5365,43 +4206,16 @@ packages:
     resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
     engines: {node: '>=0.10.0'}
 
-  vscode-jsonrpc@6.0.0:
-    resolution: {integrity: sha512-wnJA4BnEjOSyFMvjZdpiOwhSq9uDoK8e/kpRJDTaMYzwlkrhG1fwDIZI94CLsLzlCK5cIbMMtFlJlfR57Lavmg==}
-    engines: {node: '>=8.0.0 || >=10.0.0'}
-
-  vscode-languageclient@7.0.0:
-    resolution: {integrity: sha512-P9AXdAPlsCgslpP9pRxYPqkNYV7Xq8300/aZDpO35j1fJm/ncize8iGswzYlcvFw5DQUx4eVk+KvfXdL0rehNg==}
-    engines: {vscode: ^1.52.0}
-
-  vscode-languageserver-protocol@3.16.0:
-    resolution: {integrity: sha512-sdeUoAawceQdgIfTI+sdcwkiK2KU+2cbEYA0agzM2uqaUy2UpnnGHtWTHVEtS0ES4zHU0eMFRGN+oQgDxlD66A==}
-
-  vscode-languageserver-textdocument@1.0.12:
-    resolution: {integrity: sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==}
-
-  vscode-languageserver-types@3.16.0:
-    resolution: {integrity: sha512-k8luDIWJWyenLc5ToFQQMaSrqCHiLwyKPHKPQZ5zz21vM+vIVUSvsRpcbiECH4WR88K2XZqc4ScRcZ7nk/jbeA==}
-
-  vscode-languageserver@7.0.0:
-    resolution: {integrity: sha512-60HTx5ID+fLRcgdHfmz0LDZAXYEV68fzwG0JWwEPBode9NuMYTIxuYXPg4ngO8i8+Ou0lM7y6GzaYWbiDL0drw==}
-    hasBin: true
-
-  vscode-uri@3.0.8:
-    resolution: {integrity: sha512-AyFQ0EVmsOZOlAnxoFOGOq1SQDWAB7C6aqMGS23svWAllfOaxbuFvcT8D1i8z3Gyn8fraVeZNNmN6e9bxxXkKw==}
+  vscode-uri@3.1.0:
+    resolution: {integrity: sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==}
 
   w3c-xmlserializer@5.0.0:
     resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
     engines: {node: '>=18'}
 
-  wcwidth@1.0.1:
-    resolution: {integrity: sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==}
-
   web-namespaces@2.0.1:
     resolution: {integrity: sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ==}
 
-  webidl-conversions@3.0.1:
-    resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
-
   webidl-conversions@7.0.0:
     resolution: {integrity: sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==}
     engines: {node: '>=12'}
@@ -5414,13 +4228,10 @@ packages:
     resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==}
     engines: {node: '>=18'}
 
-  whatwg-url@14.1.0:
-    resolution: {integrity: sha512-jlf/foYIKywAt3x/XWKZ/3rz8OSJPiWktjmk891alJUEjiVxKX9LEO92qH3hv4aJ0mN3MWPvGMCy8jQi95xK4w==}
+  whatwg-url@14.2.0:
+    resolution: {integrity: sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==}
     engines: {node: '>=18'}
 
-  whatwg-url@5.0.0:
-    resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
-
   which-boxed-primitive@1.1.1:
     resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
     engines: {node: '>= 0.4'}
@@ -5433,8 +4244,8 @@ packages:
     resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
     engines: {node: '>= 0.4'}
 
-  which-typed-array@1.1.18:
-    resolution: {integrity: sha512-qEcY+KJYlWyLH9vNbsr6/5j59AXk5ni5aakf8ldzBvGde6Iz4sxZGkJyWSAueTG7QhOvNRYb1lDdFmL5Td0QKA==}
+  which-typed-array@1.1.19:
+    resolution: {integrity: sha512-rEvr90Bck4WZt9HHFC4DJMsjvu7x+r6bImz0/BrbWb7A2djJ8hnZMrWnHo9F8ssv0OMErasDhftrfROTyqSDrw==}
     engines: {node: '>= 0.4'}
 
   which@2.0.2:
@@ -5447,8 +4258,8 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
-  wireit@0.14.9:
-    resolution: {integrity: sha512-hFc96BgyslfO1WGSzQqOVYd5N3TB+4u9w70L9GHR/T7SYjvFmeznkYMsRIjMLhPcVabCEYPW1vV66wmIVDs+dQ==}
+  wireit@0.14.12:
+    resolution: {integrity: sha512-gNSd+nZmMo6cuICezYXRIayu6TSOeCSCDzjSF0q6g8FKDsRbdqrONrSZYzdk/uBISmRcv4vZtsno6GyGvdXwGA==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -5456,12 +4267,8 @@ packages:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
 
-  workerpool@6.5.1:
-    resolution: {integrity: sha512-Fs4dNYcsdpYSAfVxhnl1L5zTksjvOJxtC5hzMNl+1t9B8hTJTdKDyZ5ju7ztgPy+ft9tBFXoOlDNiOT9WUXZlA==}
-
-  wrap-ansi@6.2.0:
-    resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
-    engines: {node: '>=8'}
+  workerpool@9.3.2:
+    resolution: {integrity: sha512-Xz4Nm9c+LiBHhDR5bDLnNzmj6+5F+cyEAWPMkbs2awq/dYazR/efelZzUAjB/y3kNHL+uzkHvxVVpaOfGCPV7A==}
 
   wrap-ansi@7.0.0:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
@@ -5478,8 +4285,8 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  ws@8.18.0:
-    resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==}
+  ws@8.18.1:
+    resolution: {integrity: sha512-RKW2aJZMXeMxVpnZ6bck+RswznaxmzdULiBr6KY7XkTnW8uvt0iT9H5DkHUChXrc+uurzwa0rVI16n/Xzjdz1w==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -5511,25 +4318,22 @@ packages:
   yallist@4.0.0:
     resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
 
-  yaml@2.6.1:
-    resolution: {integrity: sha512-7r0XPzioN/Q9kXBro/XPnA6kznR73DHq+GXh5ON7ZozRO6aMjbmiBuKste2wslTFkC5d1dw0GooOCepZXJ2SAg==}
-    engines: {node: '>= 14'}
+  yaml@2.8.0:
+    resolution: {integrity: sha512-4lLa/EcQCB0cJkyts+FpIRx5G/llPxfP6VQU5KByHEhLxY3IJCH0f0Hy1MHI8sClTvsIb8qwRJ6R/ZdlDJ/leQ==}
+    engines: {node: '>= 14.6'}
     hasBin: true
 
-  yargs-parser@20.2.9:
-    resolution: {integrity: sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==}
-    engines: {node: '>=10'}
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
 
   yargs-unparser@2.0.0:
     resolution: {integrity: sha512-7pRTIA9Qc1caZ0bZ6RYRGbHJthJWuakf+WmHK0rVeLkNrrGhfoabBNdue6kdINI6r4if7ocq9aD/n7xwKOdzOA==}
     engines: {node: '>=10'}
 
-  yargs@16.2.0:
-    resolution: {integrity: sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==}
-    engines: {node: '>=10'}
-
-  yauzl@2.10.0:
-    resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==}
+  yargs@17.7.2:
+    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+    engines: {node: '>=12'}
 
   yn@3.1.1:
     resolution: {integrity: sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==}
@@ -5545,11 +4349,11 @@ packages:
     peerDependencies:
       zod: ^3.18.0
 
-  zod@3.23.8:
-    resolution: {integrity: sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==}
+  zod@3.24.2:
+    resolution: {integrity: sha512-lY7CDW43ECgW9u1TcT3IoXHflywfVqDYze4waEz812jR/bZ8FHDsl7pFQoSZTz5N+2NqRXs8GBwnAwo3ZNxqhQ==}
 
-  zustand@4.5.5:
-    resolution: {integrity: sha512-+0PALYNJNgK6hldkgDq2vLrw5f6g/jCInz52n9RTpropGgeAf/ioFUCdtsjCqu4gNhW9D01rUQBROoRjdzyn2Q==}
+  zustand@4.5.6:
+    resolution: {integrity: sha512-ibr/n1hBzLLj5Y+yUcU7dYw8p6WnIVzdJbnX+1YpaScvZVF2ziugqHs+LAmHw4lWO9c/zRj+K1ncgWDQuthEdQ==}
     engines: {node: '>=12.7.0'}
     peerDependencies:
       '@types/react': '>=16.8'
@@ -5592,79 +4396,64 @@ ignoredOptionalDependencies:
 
 snapshots:
 
-  '@4tw/cypress-drag-drop@2.2.5(cypress@13.17.0)':
-    dependencies:
-      cypress: 13.17.0
-
-  '@actions/core@1.11.1':
-    dependencies:
-      '@actions/exec': 1.1.1
-      '@actions/http-client': 2.2.3
-
-  '@actions/exec@1.1.1':
-    dependencies:
-      '@actions/io': 1.1.3
-
-  '@actions/http-client@2.2.3':
-    dependencies:
-      tunnel: 0.0.6
-      undici: 5.28.4
-
-  '@actions/io@1.1.3': {}
-
-  '@adobe/css-tools@4.4.1': {}
+  '@adobe/css-tools@4.4.2': {}
 
   '@ampproject/remapping@2.3.0':
     dependencies:
-      '@jridgewell/gen-mapping': 0.3.5
+      '@jridgewell/gen-mapping': 0.3.8
       '@jridgewell/trace-mapping': 0.3.25
 
-  '@asamuzakjp/css-color@2.8.2':
+  '@asamuzakjp/css-color@3.1.1':
     dependencies:
-      '@csstools/css-calc': 2.1.1(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
-      '@csstools/css-color-parser': 3.0.7(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
+      '@csstools/css-calc': 2.1.2(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
+      '@csstools/css-color-parser': 3.0.8(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
       '@csstools/css-parser-algorithms': 3.0.4(@csstools/css-tokenizer@3.0.3)
       '@csstools/css-tokenizer': 3.0.3
-      lru-cache: 11.0.2
+      lru-cache: 10.4.3
 
-  '@ast-grep/napi-darwin-arm64@0.32.2':
+  '@ast-grep/napi-darwin-arm64@0.36.2':
     optional: true
 
-  '@ast-grep/napi-darwin-x64@0.32.2':
+  '@ast-grep/napi-darwin-x64@0.36.2':
     optional: true
 
-  '@ast-grep/napi-linux-arm64-gnu@0.32.2':
+  '@ast-grep/napi-linux-arm64-gnu@0.36.2':
     optional: true
 
-  '@ast-grep/napi-linux-arm64-musl@0.32.2':
+  '@ast-grep/napi-linux-arm64-musl@0.36.2':
     optional: true
 
-  '@ast-grep/napi-linux-x64-gnu@0.32.2':
+  '@ast-grep/napi-linux-x64-gnu@0.36.2':
     optional: true
 
-  '@ast-grep/napi-linux-x64-musl@0.32.2':
+  '@ast-grep/napi-linux-x64-musl@0.36.2':
     optional: true
 
-  '@ast-grep/napi-win32-arm64-msvc@0.32.2':
+  '@ast-grep/napi-win32-arm64-msvc@0.36.2':
     optional: true
 
-  '@ast-grep/napi-win32-ia32-msvc@0.32.2':
+  '@ast-grep/napi-win32-ia32-msvc@0.36.2':
     optional: true
 
-  '@ast-grep/napi-win32-x64-msvc@0.32.2':
+  '@ast-grep/napi-win32-x64-msvc@0.36.2':
     optional: true
 
-  '@ast-grep/napi@0.32.2':
+  '@ast-grep/napi@0.36.2':
     optionalDependencies:
-      '@ast-grep/napi-darwin-arm64': 0.32.2
-      '@ast-grep/napi-darwin-x64': 0.32.2
-      '@ast-grep/napi-linux-arm64-gnu': 0.32.2
-      '@ast-grep/napi-linux-arm64-musl': 0.32.2
-      '@ast-grep/napi-linux-x64-gnu': 0.32.2
-      '@ast-grep/napi-linux-x64-musl': 0.32.2
-      '@ast-grep/napi-win32-arm64-msvc': 0.32.2
-      '@ast-grep/napi-win32-ia32-msvc': 0.32.2
-      '@ast-grep/napi-win32-x64-msvc': 0.32.2
+      '@ast-grep/napi-darwin-arm64': 0.36.2
+      '@ast-grep/napi-darwin-x64': 0.36.2
+      '@ast-grep/napi-linux-arm64-gnu': 0.36.2
+      '@ast-grep/napi-linux-arm64-musl': 0.36.2
+      '@ast-grep/napi-linux-x64-gnu': 0.36.2
+      '@ast-grep/napi-linux-x64-musl': 0.36.2
+      '@ast-grep/napi-win32-arm64-msvc': 0.36.2
+      '@ast-grep/napi-win32-ia32-msvc': 0.36.2
+      '@ast-grep/napi-win32-x64-msvc': 0.36.2
+
+  '@axe-core/playwright@4.10.2(playwright-core@1.53.2)':
+    dependencies:
+      axe-core: 4.10.3
+      playwright-core: 1.53.2
 
   '@babel/code-frame@7.26.2':
     dependencies:
@@ -5672,179 +4461,196 @@ snapshots:
       js-tokens: 4.0.0
       picocolors: 1.1.1
 
-  '@babel/compat-data@7.26.2': {}
+  '@babel/code-frame@7.27.1':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.27.1
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.26.8': {}
 
-  '@babel/core@7.26.0':
+  '@babel/core@7.26.9':
     dependencies:
       '@ampproject/remapping': 2.3.0
-      '@babel/code-frame': 7.26.2
-      '@babel/generator': 7.26.2
-      '@babel/helper-compilation-targets': 7.25.9
-      '@babel/helper-module-transforms': 7.26.0(@babel/core@7.26.0)
-      '@babel/helpers': 7.26.0
-      '@babel/parser': 7.26.2
-      '@babel/template': 7.25.9
-      '@babel/traverse': 7.25.9
-      '@babel/types': 7.26.0
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.26.9
+      '@babel/helper-compilation-targets': 7.26.5
+      '@babel/helper-module-transforms': 7.26.0(@babel/core@7.26.9)
+      '@babel/helpers': 7.26.9
+      '@babel/parser': 7.26.9
+      '@babel/template': 7.26.9
+      '@babel/traverse': 7.26.9
+      '@babel/types': 7.26.9
       convert-source-map: 2.0.0
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/generator@7.26.2':
+  '@babel/generator@7.26.9':
     dependencies:
-      '@babel/parser': 7.26.2
-      '@babel/types': 7.26.0
-      '@jridgewell/gen-mapping': 0.3.5
+      '@babel/parser': 7.26.9
+      '@babel/types': 7.26.9
+      '@jridgewell/gen-mapping': 0.3.8
       '@jridgewell/trace-mapping': 0.3.25
-      jsesc: 3.0.2
+      jsesc: 3.1.0
 
   '@babel/helper-annotate-as-pure@7.25.9':
     dependencies:
-      '@babel/types': 7.26.0
+      '@babel/types': 7.26.9
 
-  '@babel/helper-compilation-targets@7.25.9':
+  '@babel/helper-compilation-targets@7.26.5':
     dependencies:
-      '@babel/compat-data': 7.26.2
+      '@babel/compat-data': 7.26.8
       '@babel/helper-validator-option': 7.25.9
-      browserslist: 4.24.2
+      browserslist: 4.24.4
       lru-cache: 5.1.1
       semver: 6.3.1
 
-  '@babel/helper-create-class-features-plugin@7.25.9(@babel/core@7.26.0)':
+  '@babel/helper-create-class-features-plugin@7.26.9(@babel/core@7.26.9)':
     dependencies:
-      '@babel/core': 7.26.0
+      '@babel/core': 7.26.9
       '@babel/helper-annotate-as-pure': 7.25.9
       '@babel/helper-member-expression-to-functions': 7.25.9
       '@babel/helper-optimise-call-expression': 7.25.9
-      '@babel/helper-replace-supers': 7.25.9(@babel/core@7.26.0)
+      '@babel/helper-replace-supers': 7.26.5(@babel/core@7.26.9)
       '@babel/helper-skip-transparent-expression-wrappers': 7.25.9
-      '@babel/traverse': 7.25.9
+      '@babel/traverse': 7.26.9
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-member-expression-to-functions@7.25.9':
     dependencies:
-      '@babel/traverse': 7.25.9
-      '@babel/types': 7.26.0
+      '@babel/traverse': 7.26.9
+      '@babel/types': 7.26.9
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-module-imports@7.25.9':
     dependencies:
-      '@babel/traverse': 7.25.9
-      '@babel/types': 7.26.0
+      '@babel/traverse': 7.26.9
+      '@babel/types': 7.26.9
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-transforms@7.26.0(@babel/core@7.26.0)':
+  '@babel/helper-module-transforms@7.26.0(@babel/core@7.26.9)':
     dependencies:
-      '@babel/core': 7.26.0
+      '@babel/core': 7.26.9
       '@babel/helper-module-imports': 7.25.9
-      '@babel/helper-validator-identifier': 7.25.9
-      '@babel/traverse': 7.25.9
+      '@babel/helper-validator-identifier': 7.27.1
+      '@babel/traverse': 7.26.9
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-optimise-call-expression@7.25.9':
     dependencies:
-      '@babel/types': 7.26.0
+      '@babel/types': 7.26.9
 
-  '@babel/helper-plugin-utils@7.25.9': {}
+  '@babel/helper-plugin-utils@7.26.5': {}
 
-  '@babel/helper-replace-supers@7.25.9(@babel/core@7.26.0)':
+  '@babel/helper-replace-supers@7.26.5(@babel/core@7.26.9)':
     dependencies:
-      '@babel/core': 7.26.0
+      '@babel/core': 7.26.9
       '@babel/helper-member-expression-to-functions': 7.25.9
       '@babel/helper-optimise-call-expression': 7.25.9
-      '@babel/traverse': 7.25.9
+      '@babel/traverse': 7.26.9
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-skip-transparent-expression-wrappers@7.25.9':
     dependencies:
-      '@babel/traverse': 7.25.9
-      '@babel/types': 7.26.0
+      '@babel/traverse': 7.26.9
+      '@babel/types': 7.26.9
     transitivePeerDependencies:
       - supports-color
 
   '@babel/helper-string-parser@7.25.9': {}
 
+  '@babel/helper-string-parser@7.27.1': {}
+
   '@babel/helper-validator-identifier@7.25.9': {}
 
+  '@babel/helper-validator-identifier@7.27.1': {}
+
   '@babel/helper-validator-option@7.25.9': {}
 
-  '@babel/helpers@7.26.0':
+  '@babel/helpers@7.26.9':
+    dependencies:
+      '@babel/template': 7.26.9
+      '@babel/types': 7.26.9
+
+  '@babel/parser@7.26.9':
     dependencies:
-      '@babel/template': 7.25.9
-      '@babel/types': 7.26.0
+      '@babel/types': 7.26.9
 
-  '@babel/parser@7.26.2':
+  '@babel/parser@7.27.2':
     dependencies:
-      '@babel/types': 7.26.0
+      '@babel/types': 7.27.1
 
-  '@babel/plugin-proposal-private-methods@7.18.6(@babel/core@7.26.0)':
+  '@babel/plugin-proposal-private-methods@7.18.6(@babel/core@7.26.9)':
     dependencies:
-      '@babel/core': 7.26.0
-      '@babel/helper-create-class-features-plugin': 7.25.9(@babel/core@7.26.0)
-      '@babel/helper-plugin-utils': 7.25.9
+      '@babel/core': 7.26.9
+      '@babel/helper-create-class-features-plugin': 7.26.9(@babel/core@7.26.9)
+      '@babel/helper-plugin-utils': 7.26.5
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-syntax-jsx@7.25.9(@babel/core@7.26.0)':
+  '@babel/runtime@7.26.9':
     dependencies:
-      '@babel/core': 7.26.0
-      '@babel/helper-plugin-utils': 7.25.9
+      regenerator-runtime: 0.14.1
 
-  '@babel/runtime@7.26.0':
+  '@babel/runtime@7.27.0':
     dependencies:
       regenerator-runtime: 0.14.1
 
-  '@babel/template@7.25.9':
+  '@babel/runtime@7.27.6': {}
+
+  '@babel/template@7.26.9':
     dependencies:
-      '@babel/code-frame': 7.26.2
-      '@babel/parser': 7.26.2
-      '@babel/types': 7.26.0
+      '@babel/code-frame': 7.27.1
+      '@babel/parser': 7.26.9
+      '@babel/types': 7.26.9
 
-  '@babel/traverse@7.25.9':
+  '@babel/traverse@7.26.9':
     dependencies:
-      '@babel/code-frame': 7.26.2
-      '@babel/generator': 7.26.2
-      '@babel/parser': 7.26.2
-      '@babel/template': 7.25.9
-      '@babel/types': 7.26.0
-      debug: 4.4.0(supports-color@8.1.1)
+      '@babel/code-frame': 7.27.1
+      '@babel/generator': 7.26.9
+      '@babel/parser': 7.26.9
+      '@babel/template': 7.26.9
+      '@babel/types': 7.26.9
+      debug: 4.4.1(supports-color@8.1.1)
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/types@7.26.0':
+  '@babel/types@7.26.9':
     dependencies:
       '@babel/helper-string-parser': 7.25.9
-      '@babel/helper-validator-identifier': 7.25.9
+      '@babel/helper-validator-identifier': 7.27.1
 
-  '@colors/colors@1.5.0':
-    optional: true
+  '@babel/types@7.27.1':
+    dependencies:
+      '@babel/helper-string-parser': 7.27.1
+      '@babel/helper-validator-identifier': 7.27.1
 
   '@cspotcode/source-map-support@0.8.1':
     dependencies:
       '@jridgewell/trace-mapping': 0.3.9
 
-  '@csstools/color-helpers@5.0.1': {}
+  '@csstools/color-helpers@5.0.2': {}
 
-  '@csstools/css-calc@2.1.1(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)':
+  '@csstools/css-calc@2.1.2(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)':
     dependencies:
       '@csstools/css-parser-algorithms': 3.0.4(@csstools/css-tokenizer@3.0.3)
       '@csstools/css-tokenizer': 3.0.3
 
-  '@csstools/css-color-parser@3.0.7(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)':
+  '@csstools/css-color-parser@3.0.8(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)':
     dependencies:
-      '@csstools/color-helpers': 5.0.1
-      '@csstools/css-calc': 2.1.1(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
+      '@csstools/color-helpers': 5.0.2
+      '@csstools/css-calc': 2.1.2(@csstools/css-parser-algorithms@3.0.4(@csstools/css-tokenizer@3.0.3))(@csstools/css-tokenizer@3.0.3)
       '@csstools/css-parser-algorithms': 3.0.4(@csstools/css-tokenizer@3.0.3)
       '@csstools/css-tokenizer': 3.0.3
 
@@ -5854,304 +4660,143 @@ snapshots:
 
   '@csstools/css-tokenizer@3.0.3': {}
 
-  '@cypress/request@3.0.6':
-    dependencies:
-      aws-sign2: 0.7.0
-      aws4: 1.13.2
-      caseless: 0.12.0
-      combined-stream: 1.0.8
-      extend: 3.0.2
-      forever-agent: 0.6.1
-      form-data: 4.0.1
-      http-signature: 1.4.0
-      is-typedarray: 1.0.0
-      isstream: 0.1.2
-      json-stringify-safe: 5.0.1
-      mime-types: 2.1.35
-      performance-now: 2.1.0
-      qs: 6.13.0
-      safe-buffer: 5.2.1
-      tough-cookie: 5.0.0
-      tunnel-agent: 0.6.0
-      uuid: 8.3.2
-
-  '@cypress/xvfb@1.2.4(supports-color@8.1.1)':
-    dependencies:
-      debug: 3.2.7(supports-color@8.1.1)
-      lodash.once: 4.1.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@dependents/detective-less@5.0.0':
+  '@dagrejs/dagre@1.1.5':
     dependencies:
-      gonzales-pe: 4.3.0
-      node-source-walk: 7.0.0
-
-  '@esbuild/aix-ppc64@0.21.5':
-    optional: true
-
-  '@esbuild/aix-ppc64@0.23.1':
-    optional: true
-
-  '@esbuild/aix-ppc64@0.24.2':
-    optional: true
-
-  '@esbuild/android-arm64@0.21.5':
-    optional: true
-
-  '@esbuild/android-arm64@0.23.1':
-    optional: true
-
-  '@esbuild/android-arm64@0.24.2':
-    optional: true
-
-  '@esbuild/android-arm@0.21.5':
-    optional: true
-
-  '@esbuild/android-arm@0.23.1':
-    optional: true
-
-  '@esbuild/android-arm@0.24.2':
-    optional: true
-
-  '@esbuild/android-x64@0.21.5':
-    optional: true
-
-  '@esbuild/android-x64@0.23.1':
-    optional: true
-
-  '@esbuild/android-x64@0.24.2':
-    optional: true
-
-  '@esbuild/darwin-arm64@0.21.5':
-    optional: true
-
-  '@esbuild/darwin-arm64@0.23.1':
-    optional: true
-
-  '@esbuild/darwin-arm64@0.24.2':
-    optional: true
-
-  '@esbuild/darwin-x64@0.21.5':
-    optional: true
-
-  '@esbuild/darwin-x64@0.23.1':
-    optional: true
-
-  '@esbuild/darwin-x64@0.24.2':
-    optional: true
-
-  '@esbuild/freebsd-arm64@0.21.5':
-    optional: true
-
-  '@esbuild/freebsd-arm64@0.23.1':
-    optional: true
-
-  '@esbuild/freebsd-arm64@0.24.2':
-    optional: true
-
-  '@esbuild/freebsd-x64@0.21.5':
-    optional: true
-
-  '@esbuild/freebsd-x64@0.23.1':
-    optional: true
-
-  '@esbuild/freebsd-x64@0.24.2':
-    optional: true
-
-  '@esbuild/linux-arm64@0.21.5':
-    optional: true
-
-  '@esbuild/linux-arm64@0.23.1':
-    optional: true
-
-  '@esbuild/linux-arm64@0.24.2':
-    optional: true
-
-  '@esbuild/linux-arm@0.21.5':
-    optional: true
-
-  '@esbuild/linux-arm@0.23.1':
-    optional: true
-
-  '@esbuild/linux-arm@0.24.2':
-    optional: true
-
-  '@esbuild/linux-ia32@0.21.5':
-    optional: true
-
-  '@esbuild/linux-ia32@0.23.1':
-    optional: true
-
-  '@esbuild/linux-ia32@0.24.2':
-    optional: true
+      '@dagrejs/graphlib': 2.2.4
 
-  '@esbuild/linux-loong64@0.21.5':
-    optional: true
-
-  '@esbuild/linux-loong64@0.23.1':
-    optional: true
-
-  '@esbuild/linux-loong64@0.24.2':
-    optional: true
-
-  '@esbuild/linux-mips64el@0.21.5':
-    optional: true
-
-  '@esbuild/linux-mips64el@0.23.1':
-    optional: true
-
-  '@esbuild/linux-mips64el@0.24.2':
-    optional: true
-
-  '@esbuild/linux-ppc64@0.21.5':
-    optional: true
-
-  '@esbuild/linux-ppc64@0.23.1':
-    optional: true
-
-  '@esbuild/linux-ppc64@0.24.2':
-    optional: true
-
-  '@esbuild/linux-riscv64@0.21.5':
-    optional: true
-
-  '@esbuild/linux-riscv64@0.23.1':
-    optional: true
-
-  '@esbuild/linux-riscv64@0.24.2':
-    optional: true
-
-  '@esbuild/linux-s390x@0.21.5':
-    optional: true
+  '@dagrejs/graphlib@2.2.4': {}
 
-  '@esbuild/linux-s390x@0.23.1':
+  '@esbuild/aix-ppc64@0.25.6':
     optional: true
 
-  '@esbuild/linux-s390x@0.24.2':
+  '@esbuild/android-arm64@0.25.6':
     optional: true
 
-  '@esbuild/linux-x64@0.21.5':
+  '@esbuild/android-arm@0.25.6':
     optional: true
 
-  '@esbuild/linux-x64@0.23.1':
+  '@esbuild/android-x64@0.25.6':
     optional: true
 
-  '@esbuild/linux-x64@0.24.2':
+  '@esbuild/darwin-arm64@0.25.6':
     optional: true
 
-  '@esbuild/netbsd-arm64@0.24.2':
+  '@esbuild/darwin-x64@0.25.6':
     optional: true
 
-  '@esbuild/netbsd-x64@0.21.5':
+  '@esbuild/freebsd-arm64@0.25.6':
     optional: true
 
-  '@esbuild/netbsd-x64@0.23.1':
+  '@esbuild/freebsd-x64@0.25.6':
     optional: true
 
-  '@esbuild/netbsd-x64@0.24.2':
+  '@esbuild/linux-arm64@0.25.6':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.23.1':
+  '@esbuild/linux-arm@0.25.6':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.24.2':
+  '@esbuild/linux-ia32@0.25.6':
     optional: true
 
-  '@esbuild/openbsd-x64@0.21.5':
+  '@esbuild/linux-loong64@0.25.6':
     optional: true
 
-  '@esbuild/openbsd-x64@0.23.1':
+  '@esbuild/linux-mips64el@0.25.6':
     optional: true
 
-  '@esbuild/openbsd-x64@0.24.2':
+  '@esbuild/linux-ppc64@0.25.6':
     optional: true
 
-  '@esbuild/sunos-x64@0.21.5':
+  '@esbuild/linux-riscv64@0.25.6':
     optional: true
 
-  '@esbuild/sunos-x64@0.23.1':
+  '@esbuild/linux-s390x@0.25.6':
     optional: true
 
-  '@esbuild/sunos-x64@0.24.2':
+  '@esbuild/linux-x64@0.25.6':
     optional: true
 
-  '@esbuild/win32-arm64@0.21.5':
+  '@esbuild/netbsd-arm64@0.25.6':
     optional: true
 
-  '@esbuild/win32-arm64@0.23.1':
+  '@esbuild/netbsd-x64@0.25.6':
     optional: true
 
-  '@esbuild/win32-arm64@0.24.2':
+  '@esbuild/openbsd-arm64@0.25.6':
     optional: true
 
-  '@esbuild/win32-ia32@0.21.5':
+  '@esbuild/openbsd-x64@0.25.6':
     optional: true
 
-  '@esbuild/win32-ia32@0.23.1':
+  '@esbuild/openharmony-arm64@0.25.6':
     optional: true
 
-  '@esbuild/win32-ia32@0.24.2':
+  '@esbuild/sunos-x64@0.25.6':
     optional: true
 
-  '@esbuild/win32-x64@0.21.5':
+  '@esbuild/win32-arm64@0.25.6':
     optional: true
 
-  '@esbuild/win32-x64@0.23.1':
+  '@esbuild/win32-ia32@0.25.6':
     optional: true
 
-  '@esbuild/win32-x64@0.24.2':
+  '@esbuild/win32-x64@0.25.6':
     optional: true
 
-  '@eslint-community/eslint-utils@4.4.1(eslint@9.18.0)':
+  '@eslint-community/eslint-utils@4.7.0(eslint@9.30.1)':
     dependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.1': {}
 
-  '@eslint/compat@1.2.5(eslint@9.18.0)':
+  '@eslint/compat@1.3.1(eslint@9.30.1)':
     optionalDependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
 
-  '@eslint/config-array@0.19.0':
+  '@eslint/config-array@0.21.0':
     dependencies:
-      '@eslint/object-schema': 2.1.4
-      debug: 4.4.0(supports-color@8.1.1)
+      '@eslint/object-schema': 2.1.6
+      debug: 4.4.1(supports-color@8.1.1)
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
 
-  '@eslint/core@0.10.0':
+  '@eslint/config-helpers@0.3.0': {}
+
+  '@eslint/core@0.14.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/core@0.15.1':
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/eslintrc@3.2.0':
+  '@eslint/eslintrc@3.3.1':
     dependencies:
       ajv: 6.12.6
-      debug: 4.3.7(supports-color@8.1.1)
+      debug: 4.4.0
       espree: 10.3.0
       globals: 14.0.0
       ignore: 5.3.2
-      import-fresh: 3.3.0
+      import-fresh: 3.3.1
       js-yaml: 4.1.0
       minimatch: 3.1.2
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
       - supports-color
 
-  '@eslint/js@9.18.0': {}
+  '@eslint/js@9.30.1': {}
 
-  '@eslint/object-schema@2.1.4': {}
+  '@eslint/object-schema@2.1.6': {}
 
-  '@eslint/plugin-kit@0.2.5':
+  '@eslint/plugin-kit@0.3.3':
     dependencies:
-      '@eslint/core': 0.10.0
+      '@eslint/core': 0.15.1
       levn: 0.4.1
 
-  '@faker-js/faker@9.3.0': {}
-
-  '@fastify/busboy@2.1.1': {}
+  '@faker-js/faker@9.9.0': {}
 
   '@humanfs/core@0.19.1': {}
 
@@ -6164,7 +4809,7 @@ snapshots:
 
   '@humanwhocodes/retry@0.3.1': {}
 
-  '@humanwhocodes/retry@0.4.1': {}
+  '@humanwhocodes/retry@0.4.3': {}
 
   '@isaacs/cliui@8.0.2':
     dependencies:
@@ -6175,7 +4820,7 @@ snapshots:
       wrap-ansi: 8.1.0
       wrap-ansi-cjs: wrap-ansi@7.0.0
 
-  '@jridgewell/gen-mapping@0.3.5':
+  '@jridgewell/gen-mapping@0.3.8':
     dependencies:
       '@jridgewell/set-array': 1.2.1
       '@jridgewell/sourcemap-codec': 1.5.0
@@ -6187,7 +4832,7 @@ snapshots:
 
   '@jridgewell/source-map@0.3.6':
     dependencies:
-      '@jridgewell/gen-mapping': 0.3.5
+      '@jridgewell/gen-mapping': 0.3.8
       '@jridgewell/trace-mapping': 0.3.25
 
   '@jridgewell/sourcemap-codec@1.5.0': {}
@@ -6202,71 +4847,70 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.0
 
-  '@keycloak/keycloak-admin-ui@file:apps/admin-ui(@babel/runtime@7.26.0)(@types/react@18.3.13)(typescript@5.7.2)':
+  '@keycloak/keycloak-admin-ui@file:apps/admin-ui(@babel/runtime@7.27.6)(@types/react@18.3.18)(typescript@5.8.3)':
     dependencies:
+      '@dagrejs/dagre': 1.1.5
       '@keycloak/keycloak-admin-client': link:libs/keycloak-admin-client
       '@keycloak/keycloak-ui-shared': link:libs/ui-shared
       '@patternfly/patternfly': 5.4.2
-      '@patternfly/react-core': 5.4.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@patternfly/react-core': 5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-icons': 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-styles': 5.4.1
-      '@patternfly/react-table': 5.4.13(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@uiw/react-textarea-code-editor': 3.1.0(@babel/runtime@7.26.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      dagre: 0.8.5
+      '@patternfly/react-table': 5.4.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@uiw/react-textarea-code-editor': 3.1.1(@babel/runtime@7.27.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       file-saver: 2.0.5
       flat: 6.0.1
-      i18next: 24.2.1(typescript@5.7.2)
-      i18next-http-backend: 3.0.1
+      i18next: 25.3.1(typescript@5.8.3)
+      i18next-fetch-backend: 6.0.0
       jszip: 3.10.1
-      keycloak-js: link:libs/keycloak-js
+      keycloak-js: 26.2.0
       lodash-es: 4.17.21
       p-debounce: 4.0.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      react-hook-form: 7.54.2(react@18.3.1)
-      react-i18next: 15.4.0(i18next@24.2.1(typescript@5.7.2))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      react-router-dom: 6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      reactflow: 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      use-react-router-breadcrumbs: 4.0.1(react-router-dom@6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1)
+      react-hook-form: 7.60.0(react@18.3.1)
+      react-i18next: 15.5.3(i18next@25.3.1(typescript@5.8.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.8.3)
+      react-router-dom: 6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      reactflow: 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      use-react-router-breadcrumbs: 4.0.1(react-router-dom@6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1)
     transitivePeerDependencies:
       - '@babel/runtime'
       - '@types/react'
-      - encoding
       - immer
       - react-native
       - typescript
 
   '@kwsites/file-exists@1.1.1':
     dependencies:
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
     transitivePeerDependencies:
       - supports-color
 
   '@kwsites/promise-deferred@1.1.1': {}
 
-  '@microsoft/api-extractor-model@7.30.2(@types/node@22.10.6)':
+  '@microsoft/api-extractor-model@7.30.6(@types/node@24.0.12)':
     dependencies:
       '@microsoft/tsdoc': 0.15.1
       '@microsoft/tsdoc-config': 0.17.1
-      '@rushstack/node-core-library': 5.10.2(@types/node@22.10.6)
+      '@rushstack/node-core-library': 5.13.1(@types/node@24.0.12)
     transitivePeerDependencies:
       - '@types/node'
 
-  '@microsoft/api-extractor@7.49.1(@types/node@22.10.6)':
+  '@microsoft/api-extractor@7.52.8(@types/node@24.0.12)':
     dependencies:
-      '@microsoft/api-extractor-model': 7.30.2(@types/node@22.10.6)
+      '@microsoft/api-extractor-model': 7.30.6(@types/node@24.0.12)
       '@microsoft/tsdoc': 0.15.1
       '@microsoft/tsdoc-config': 0.17.1
-      '@rushstack/node-core-library': 5.10.2(@types/node@22.10.6)
+      '@rushstack/node-core-library': 5.13.1(@types/node@24.0.12)
       '@rushstack/rig-package': 0.5.3
-      '@rushstack/terminal': 0.14.5(@types/node@22.10.6)
-      '@rushstack/ts-command-line': 4.23.3(@types/node@22.10.6)
+      '@rushstack/terminal': 0.15.3(@types/node@24.0.12)
+      '@rushstack/ts-command-line': 5.0.1(@types/node@24.0.12)
       lodash: 4.17.21
       minimatch: 3.0.8
-      resolve: 1.22.8
+      resolve: 1.22.10
       semver: 7.5.4
       source-map: 0.6.1
-      typescript: 5.7.2
+      typescript: 5.8.2
     transitivePeerDependencies:
       - '@types/node'
 
@@ -6275,11 +4919,11 @@ snapshots:
       '@microsoft/tsdoc': 0.15.1
       ajv: 8.12.0
       jju: 1.4.0
-      resolve: 1.22.8
+      resolve: 1.22.10
 
   '@microsoft/tsdoc@0.15.1': {}
 
-  '@noble/hashes@1.7.0': {}
+  '@noble/hashes@1.8.0': {}
 
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
@@ -6291,86 +4935,75 @@ snapshots:
   '@nodelib/fs.walk@1.2.8':
     dependencies:
       '@nodelib/fs.scandir': 2.1.5
-      fastq: 1.17.1
+      fastq: 1.19.1
 
-  '@octokit/auth-token@5.1.1': {}
+  '@octokit/auth-token@6.0.0': {}
 
-  '@octokit/core@6.1.3':
+  '@octokit/core@7.0.2':
     dependencies:
-      '@octokit/auth-token': 5.1.1
-      '@octokit/graphql': 8.1.2
-      '@octokit/request': 9.1.4
-      '@octokit/request-error': 6.1.6
-      '@octokit/types': 13.7.0
-      before-after-hook: 3.0.2
-      universal-user-agent: 7.0.2
+      '@octokit/auth-token': 6.0.0
+      '@octokit/graphql': 9.0.1
+      '@octokit/request': 10.0.2
+      '@octokit/request-error': 7.0.0
+      '@octokit/types': 14.1.0
+      before-after-hook: 4.0.0
+      universal-user-agent: 7.0.3
 
-  '@octokit/endpoint@10.1.1':
+  '@octokit/endpoint@11.0.0':
     dependencies:
-      '@octokit/types': 13.7.0
-      universal-user-agent: 7.0.2
+      '@octokit/types': 14.1.0
+      universal-user-agent: 7.0.3
 
-  '@octokit/graphql@8.1.2':
+  '@octokit/graphql@9.0.1':
     dependencies:
-      '@octokit/request': 9.1.4
-      '@octokit/types': 13.7.0
-      universal-user-agent: 7.0.2
+      '@octokit/request': 10.0.2
+      '@octokit/types': 14.1.0
+      universal-user-agent: 7.0.3
 
-  '@octokit/openapi-types@23.0.1': {}
+  '@octokit/openapi-types@25.1.0': {}
 
-  '@octokit/plugin-paginate-rest@11.4.0(@octokit/core@6.1.3)':
+  '@octokit/plugin-paginate-rest@13.0.1(@octokit/core@7.0.2)':
     dependencies:
-      '@octokit/core': 6.1.3
-      '@octokit/types': 13.7.0
+      '@octokit/core': 7.0.2
+      '@octokit/types': 14.1.0
 
-  '@octokit/plugin-request-log@5.3.1(@octokit/core@6.1.3)':
+  '@octokit/plugin-request-log@6.0.0(@octokit/core@7.0.2)':
     dependencies:
-      '@octokit/core': 6.1.3
+      '@octokit/core': 7.0.2
 
-  '@octokit/plugin-rest-endpoint-methods@13.3.0(@octokit/core@6.1.3)':
+  '@octokit/plugin-rest-endpoint-methods@16.0.0(@octokit/core@7.0.2)':
     dependencies:
-      '@octokit/core': 6.1.3
-      '@octokit/types': 13.7.0
+      '@octokit/core': 7.0.2
+      '@octokit/types': 14.1.0
 
-  '@octokit/request-error@6.1.6':
+  '@octokit/request-error@7.0.0':
     dependencies:
-      '@octokit/types': 13.7.0
+      '@octokit/types': 14.1.0
 
-  '@octokit/request@9.1.4':
+  '@octokit/request@10.0.2':
     dependencies:
-      '@octokit/endpoint': 10.1.1
-      '@octokit/request-error': 6.1.6
-      '@octokit/types': 13.7.0
-      fast-content-type-parse: 2.0.1
-      universal-user-agent: 7.0.2
+      '@octokit/endpoint': 11.0.0
+      '@octokit/request-error': 7.0.0
+      '@octokit/types': 14.1.0
+      fast-content-type-parse: 3.0.0
+      universal-user-agent: 7.0.3
 
-  '@octokit/rest@21.1.0':
+  '@octokit/rest@22.0.0':
     dependencies:
-      '@octokit/core': 6.1.3
-      '@octokit/plugin-paginate-rest': 11.4.0(@octokit/core@6.1.3)
-      '@octokit/plugin-request-log': 5.3.1(@octokit/core@6.1.3)
-      '@octokit/plugin-rest-endpoint-methods': 13.3.0(@octokit/core@6.1.3)
+      '@octokit/core': 7.0.2
+      '@octokit/plugin-paginate-rest': 13.0.1(@octokit/core@7.0.2)
+      '@octokit/plugin-request-log': 6.0.0(@octokit/core@7.0.2)
+      '@octokit/plugin-rest-endpoint-methods': 16.0.0(@octokit/core@7.0.2)
 
-  '@octokit/types@13.7.0':
+  '@octokit/types@14.1.0':
     dependencies:
-      '@octokit/openapi-types': 23.0.1
+      '@octokit/openapi-types': 25.1.0
 
   '@patternfly/patternfly@4.224.5': {}
 
   '@patternfly/patternfly@5.4.2': {}
 
-  '@patternfly/react-core@5.4.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
-    dependencies:
-      '@patternfly/react-icons': 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@patternfly/react-styles': 5.4.1
-      '@patternfly/react-tokens': 5.4.1
-      focus-trap: 7.6.2
-      react: 18.3.1
-      react-dom: 18.3.1(react@18.3.1)
-      react-dropzone: 14.3.5(react@18.3.1)
-      tslib: 2.8.1
-
-  '@patternfly/react-core@5.4.12(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@patternfly/react-core@5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
       '@patternfly/react-icons': 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-styles': 5.4.1
@@ -6378,7 +5011,7 @@ snapshots:
       focus-trap: 7.6.2
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      react-dropzone: 14.3.5(react@18.3.1)
+      react-dropzone: 14.3.8(react@18.3.1)
       tslib: 2.8.1
 
   '@patternfly/react-icons@5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
@@ -6388,9 +5021,9 @@ snapshots:
 
   '@patternfly/react-styles@5.4.1': {}
 
-  '@patternfly/react-table@5.4.13(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@patternfly/react-table@5.4.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@patternfly/react-core': 5.4.12(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@patternfly/react-core': 5.4.14(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-icons': 5.4.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@patternfly/react-styles': 5.4.1
       '@patternfly/react-tokens': 5.4.1
@@ -6404,35 +5037,35 @@ snapshots:
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
-  '@pkgr/core@0.1.1': {}
+  '@pkgr/core@0.2.7': {}
 
-  '@playwright/test@1.49.1':
+  '@playwright/test@1.53.2':
     dependencies:
-      playwright: 1.49.1
+      playwright: 1.53.2
 
-  '@reactflow/background@11.3.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/background@11.3.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       classcat: 5.0.5
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@reactflow/controls@11.2.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/controls@11.2.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       classcat: 5.0.5
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@reactflow/core@11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/core@11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
       '@types/d3': 7.4.3
       '@types/d3-drag': 3.0.7
@@ -6444,14 +5077,14 @@ snapshots:
       d3-zoom: 3.0.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@reactflow/minimap@11.7.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/minimap@11.7.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@types/d3-selection': 3.0.11
       '@types/d3-zoom': 3.0.8
       classcat: 5.0.5
@@ -6459,300 +5092,242 @@ snapshots:
       d3-zoom: 3.0.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@reactflow/node-resizer@2.2.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/node-resizer@2.2.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       classcat: 5.0.5
       d3-drag: 3.0.0
       d3-selection: 3.0.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@reactflow/node-toolbar@1.3.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@reactflow/node-toolbar@1.3.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       classcat: 5.0.5
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      zustand: 4.5.5(@types/react@18.3.13)(react@18.3.1)
+      zustand: 4.5.6(@types/react@18.3.18)(react@18.3.1)
     transitivePeerDependencies:
       - '@types/react'
       - immer
 
-  '@remix-run/router@1.21.0': {}
+  '@remix-run/router@1.23.0': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.11': {}
 
-  '@rollup/plugin-commonjs@28.0.2(rollup@4.30.1)':
+  '@rollup/plugin-commonjs@28.0.6(rollup@4.44.2)':
     dependencies:
-      '@rollup/pluginutils': 5.1.3(rollup@4.30.1)
+      '@rollup/pluginutils': 5.2.0(rollup@4.44.2)
       commondir: 1.0.1
       estree-walker: 2.0.2
-      fdir: 6.4.2(picomatch@4.0.2)
+      fdir: 6.4.6(picomatch@4.0.2)
       is-reference: 1.2.1
-      magic-string: 0.30.14
+      magic-string: 0.30.17
       picomatch: 4.0.2
     optionalDependencies:
-      rollup: 4.30.1
+      rollup: 4.44.2
 
-  '@rollup/plugin-node-resolve@16.0.0(rollup@4.30.1)':
+  '@rollup/plugin-node-resolve@16.0.1(rollup@4.44.2)':
     dependencies:
-      '@rollup/pluginutils': 5.1.3(rollup@4.30.1)
+      '@rollup/pluginutils': 5.1.4(rollup@4.44.2)
       '@types/resolve': 1.20.2
       deepmerge: 4.3.1
       is-module: 1.0.0
-      resolve: 1.22.8
+      resolve: 1.22.10
     optionalDependencies:
-      rollup: 4.30.1
+      rollup: 4.44.2
 
-  '@rollup/plugin-replace@6.0.2(rollup@4.30.1)':
+  '@rollup/plugin-replace@6.0.2(rollup@4.44.2)':
     dependencies:
-      '@rollup/pluginutils': 5.1.3(rollup@4.30.1)
-      magic-string: 0.30.14
+      '@rollup/pluginutils': 5.1.4(rollup@4.44.2)
+      magic-string: 0.30.17
     optionalDependencies:
-      rollup: 4.30.1
+      rollup: 4.44.2
 
-  '@rollup/plugin-terser@0.4.4(rollup@4.30.1)':
+  '@rollup/plugin-terser@0.4.4(rollup@4.44.2)':
     dependencies:
       serialize-javascript: 6.0.2
       smob: 1.5.0
-      terser: 5.36.0
+      terser: 5.39.0
     optionalDependencies:
-      rollup: 4.30.1
+      rollup: 4.44.2
 
-  '@rollup/pluginutils@5.1.3(rollup@4.30.1)':
+  '@rollup/pluginutils@5.1.4(rollup@4.44.2)':
     dependencies:
-      '@types/estree': 1.0.6
+      '@types/estree': 1.0.7
       estree-walker: 2.0.2
       picomatch: 4.0.2
     optionalDependencies:
-      rollup: 4.30.1
+      rollup: 4.44.2
 
-  '@rollup/pluginutils@5.1.4(rollup@4.30.1)':
+  '@rollup/pluginutils@5.2.0(rollup@4.44.2)':
     dependencies:
-      '@types/estree': 1.0.6
+      '@types/estree': 1.0.8
       estree-walker: 2.0.2
       picomatch: 4.0.2
     optionalDependencies:
-      rollup: 4.30.1
-
-  '@rollup/rollup-android-arm-eabi@4.30.0':
-    optional: true
-
-  '@rollup/rollup-android-arm-eabi@4.30.1':
-    optional: true
-
-  '@rollup/rollup-android-arm64@4.30.0':
-    optional: true
-
-  '@rollup/rollup-android-arm64@4.30.1':
-    optional: true
-
-  '@rollup/rollup-darwin-arm64@4.30.0':
-    optional: true
-
-  '@rollup/rollup-darwin-arm64@4.30.1':
-    optional: true
-
-  '@rollup/rollup-darwin-x64@4.30.0':
-    optional: true
-
-  '@rollup/rollup-darwin-x64@4.30.1':
-    optional: true
-
-  '@rollup/rollup-freebsd-arm64@4.30.0':
-    optional: true
-
-  '@rollup/rollup-freebsd-arm64@4.30.1':
-    optional: true
-
-  '@rollup/rollup-freebsd-x64@4.30.0':
-    optional: true
+      rollup: 4.44.2
 
-  '@rollup/rollup-freebsd-x64@4.30.1':
+  '@rollup/rollup-android-arm-eabi@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.30.0':
+  '@rollup/rollup-android-arm64@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.30.1':
+  '@rollup/rollup-darwin-arm64@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.30.0':
+  '@rollup/rollup-darwin-x64@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.30.1':
+  '@rollup/rollup-freebsd-arm64@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.30.0':
+  '@rollup/rollup-freebsd-x64@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.30.1':
+  '@rollup/rollup-linux-arm-gnueabihf@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.30.0':
+  '@rollup/rollup-linux-arm-musleabihf@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.30.1':
+  '@rollup/rollup-linux-arm64-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-loongarch64-gnu@4.30.0':
+  '@rollup/rollup-linux-arm64-musl@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-loongarch64-gnu@4.30.1':
+  '@rollup/rollup-linux-loongarch64-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-powerpc64le-gnu@4.30.0':
+  '@rollup/rollup-linux-powerpc64le-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-powerpc64le-gnu@4.30.1':
+  '@rollup/rollup-linux-riscv64-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.30.0':
+  '@rollup/rollup-linux-riscv64-musl@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.30.1':
+  '@rollup/rollup-linux-s390x-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.30.0':
+  '@rollup/rollup-linux-x64-gnu@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.30.1':
+  '@rollup/rollup-linux-x64-musl@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.30.0':
+  '@rollup/rollup-win32-arm64-msvc@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.30.1':
+  '@rollup/rollup-win32-ia32-msvc@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.30.0':
+  '@rollup/rollup-win32-x64-msvc@4.44.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.30.1':
-    optional: true
-
-  '@rollup/rollup-win32-arm64-msvc@4.30.0':
-    optional: true
-
-  '@rollup/rollup-win32-arm64-msvc@4.30.1':
-    optional: true
-
-  '@rollup/rollup-win32-ia32-msvc@4.30.0':
-    optional: true
-
-  '@rollup/rollup-win32-ia32-msvc@4.30.1':
-    optional: true
-
-  '@rollup/rollup-win32-x64-msvc@4.30.0':
-    optional: true
-
-  '@rollup/rollup-win32-x64-msvc@4.30.1':
-    optional: true
-
-  '@rushstack/node-core-library@5.10.2(@types/node@22.10.6)':
+  '@rushstack/node-core-library@5.13.1(@types/node@24.0.12)':
     dependencies:
       ajv: 8.13.0
       ajv-draft-04: 1.0.0(ajv@8.13.0)
       ajv-formats: 3.0.1(ajv@8.13.0)
-      fs-extra: 7.0.1
+      fs-extra: 11.3.0
       import-lazy: 4.0.0
       jju: 1.4.0
-      resolve: 1.22.8
+      resolve: 1.22.10
       semver: 7.5.4
     optionalDependencies:
-      '@types/node': 22.10.6
+      '@types/node': 24.0.12
 
   '@rushstack/rig-package@0.5.3':
     dependencies:
-      resolve: 1.22.8
+      resolve: 1.22.10
       strip-json-comments: 3.1.1
 
-  '@rushstack/terminal@0.14.5(@types/node@22.10.6)':
+  '@rushstack/terminal@0.15.3(@types/node@24.0.12)':
     dependencies:
-      '@rushstack/node-core-library': 5.10.2(@types/node@22.10.6)
+      '@rushstack/node-core-library': 5.13.1(@types/node@24.0.12)
       supports-color: 8.1.1
     optionalDependencies:
-      '@types/node': 22.10.6
+      '@types/node': 24.0.12
 
-  '@rushstack/ts-command-line@4.23.3(@types/node@22.10.6)':
+  '@rushstack/ts-command-line@5.0.1(@types/node@24.0.12)':
     dependencies:
-      '@rushstack/terminal': 0.14.5(@types/node@22.10.6)
+      '@rushstack/terminal': 0.15.3(@types/node@24.0.12)
       '@types/argparse': 1.0.38
       argparse: 1.0.10
       string-argv: 0.3.2
     transitivePeerDependencies:
       - '@types/node'
 
-  '@swc/core-darwin-arm64@1.9.3':
+  '@swc/core-darwin-arm64@1.12.0':
     optional: true
 
-  '@swc/core-darwin-x64@1.9.3':
+  '@swc/core-darwin-x64@1.12.0':
     optional: true
 
-  '@swc/core-linux-arm-gnueabihf@1.9.3':
+  '@swc/core-linux-arm-gnueabihf@1.12.0':
     optional: true
 
-  '@swc/core-linux-arm64-gnu@1.9.3':
+  '@swc/core-linux-arm64-gnu@1.12.0':
     optional: true
 
-  '@swc/core-linux-arm64-musl@1.9.3':
+  '@swc/core-linux-arm64-musl@1.12.0':
     optional: true
 
-  '@swc/core-linux-x64-gnu@1.9.3':
+  '@swc/core-linux-x64-gnu@1.12.0':
     optional: true
 
-  '@swc/core-linux-x64-musl@1.9.3':
+  '@swc/core-linux-x64-musl@1.12.0':
     optional: true
 
-  '@swc/core-win32-arm64-msvc@1.9.3':
+  '@swc/core-win32-arm64-msvc@1.12.0':
     optional: true
 
-  '@swc/core-win32-ia32-msvc@1.9.3':
+  '@swc/core-win32-ia32-msvc@1.12.0':
     optional: true
 
-  '@swc/core-win32-x64-msvc@1.9.3':
+  '@swc/core-win32-x64-msvc@1.12.0':
     optional: true
 
-  '@swc/core@1.9.3':
+  '@swc/core@1.12.0':
     dependencies:
       '@swc/counter': 0.1.3
-      '@swc/types': 0.1.17
+      '@swc/types': 0.1.23
     optionalDependencies:
-      '@swc/core-darwin-arm64': 1.9.3
-      '@swc/core-darwin-x64': 1.9.3
-      '@swc/core-linux-arm-gnueabihf': 1.9.3
-      '@swc/core-linux-arm64-gnu': 1.9.3
-      '@swc/core-linux-arm64-musl': 1.9.3
-      '@swc/core-linux-x64-gnu': 1.9.3
-      '@swc/core-linux-x64-musl': 1.9.3
-      '@swc/core-win32-arm64-msvc': 1.9.3
-      '@swc/core-win32-ia32-msvc': 1.9.3
-      '@swc/core-win32-x64-msvc': 1.9.3
+      '@swc/core-darwin-arm64': 1.12.0
+      '@swc/core-darwin-x64': 1.12.0
+      '@swc/core-linux-arm-gnueabihf': 1.12.0
+      '@swc/core-linux-arm64-gnu': 1.12.0
+      '@swc/core-linux-arm64-musl': 1.12.0
+      '@swc/core-linux-x64-gnu': 1.12.0
+      '@swc/core-linux-x64-musl': 1.12.0
+      '@swc/core-win32-arm64-msvc': 1.12.0
+      '@swc/core-win32-ia32-msvc': 1.12.0
+      '@swc/core-win32-x64-msvc': 1.12.0
 
   '@swc/counter@0.1.3': {}
 
-  '@swc/types@0.1.17':
+  '@swc/types@0.1.23':
     dependencies:
       '@swc/counter': 0.1.3
 
-  '@testing-library/cypress@10.0.2(cypress@13.17.0)':
-    dependencies:
-      '@babel/runtime': 7.26.0
-      '@testing-library/dom': 10.4.0
-      cypress: 13.17.0
-
   '@testing-library/dom@10.4.0':
     dependencies:
       '@babel/code-frame': 7.26.2
-      '@babel/runtime': 7.26.0
+      '@babel/runtime': 7.26.9
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
       chalk: 4.1.2
@@ -6762,7 +5337,7 @@ snapshots:
 
   '@testing-library/jest-dom@6.6.3':
     dependencies:
-      '@adobe/css-tools': 4.4.1
+      '@adobe/css-tools': 4.4.2
       aria-query: 5.3.2
       chalk: 3.0.0
       css.escape: 1.5.1
@@ -6770,15 +5345,15 @@ snapshots:
       lodash: 4.17.21
       redent: 3.0.0
 
-  '@testing-library/react@16.1.0(@testing-library/dom@10.4.0)(@types/react-dom@18.3.1)(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@testing-library/react@16.3.0(@testing-library/dom@10.4.0)(@types/react-dom@18.3.5(@types/react@18.3.18))(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@babel/runtime': 7.26.0
+      '@babel/runtime': 7.27.0
       '@testing-library/dom': 10.4.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
     optionalDependencies:
-      '@types/react': 18.3.13
-      '@types/react-dom': 18.3.1
+      '@types/react': 18.3.18
+      '@types/react-dom': 18.3.5(@types/react@18.3.18)
 
   '@tsconfig/node10@1.0.11': {}
 
@@ -6792,7 +5367,7 @@ snapshots:
 
   '@types/aria-query@5.0.4': {}
 
-  '@types/chai@5.0.1':
+  '@types/chai@5.2.2':
     dependencies:
       '@types/deep-eql': 4.0.2
 
@@ -6813,7 +5388,7 @@ snapshots:
   '@types/d3-contour@3.0.6':
     dependencies:
       '@types/d3-array': 3.2.1
-      '@types/geojson': 7946.0.14
+      '@types/geojson': 7946.0.16
 
   '@types/d3-delaunay@6.0.4': {}
 
@@ -6837,7 +5412,7 @@ snapshots:
 
   '@types/d3-geo@3.1.0':
     dependencies:
-      '@types/geojson': 7946.0.14
+      '@types/geojson': 7946.0.16
 
   '@types/d3-hierarchy@3.1.7': {}
 
@@ -6845,7 +5420,7 @@ snapshots:
     dependencies:
       '@types/d3-color': 3.1.3
 
-  '@types/d3-path@3.1.0': {}
+  '@types/d3-path@3.1.1': {}
 
   '@types/d3-polygon@3.0.2': {}
 
@@ -6855,15 +5430,15 @@ snapshots:
 
   '@types/d3-scale-chromatic@3.1.0': {}
 
-  '@types/d3-scale@4.0.8':
+  '@types/d3-scale@4.0.9':
     dependencies:
       '@types/d3-time': 3.0.4
 
   '@types/d3-selection@3.0.11': {}
 
-  '@types/d3-shape@3.1.6':
+  '@types/d3-shape@3.1.7':
     dependencies:
-      '@types/d3-path': 3.1.0
+      '@types/d3-path': 3.1.1
 
   '@types/d3-time-format@4.0.3': {}
 
@@ -6899,33 +5474,35 @@ snapshots:
       '@types/d3-geo': 3.1.0
       '@types/d3-hierarchy': 3.1.7
       '@types/d3-interpolate': 3.0.4
-      '@types/d3-path': 3.1.0
+      '@types/d3-path': 3.1.1
       '@types/d3-polygon': 3.0.2
       '@types/d3-quadtree': 3.0.6
       '@types/d3-random': 3.0.3
-      '@types/d3-scale': 4.0.8
+      '@types/d3-scale': 4.0.9
       '@types/d3-scale-chromatic': 3.1.0
       '@types/d3-selection': 3.0.11
-      '@types/d3-shape': 3.1.6
+      '@types/d3-shape': 3.1.7
       '@types/d3-time': 3.0.4
       '@types/d3-time-format': 4.0.3
       '@types/d3-timer': 3.0.2
       '@types/d3-transition': 3.0.9
       '@types/d3-zoom': 3.0.8
 
-  '@types/dagre@0.7.52': {}
+  '@types/dagre@0.7.53': {}
 
   '@types/deep-eql@4.0.2': {}
 
-  '@types/estree@1.0.6': {}
+  '@types/estree@1.0.7': {}
+
+  '@types/estree@1.0.8': {}
 
   '@types/file-saver@2.0.7': {}
 
-  '@types/geojson@7946.0.14': {}
+  '@types/geojson@7946.0.16': {}
 
   '@types/gunzip-maybe@1.4.2':
     dependencies:
-      '@types/node': 22.10.5
+      '@types/node': 22.13.5
 
   '@types/hast@2.3.10':
     dependencies:
@@ -6939,9 +5516,9 @@ snapshots:
 
   '@types/lodash-es@4.17.12':
     dependencies:
-      '@types/lodash': 4.17.13
+      '@types/lodash': 4.17.15
 
-  '@types/lodash@4.17.13': {}
+  '@types/lodash@4.17.15': {}
 
   '@types/mdast@4.0.4':
     dependencies:
@@ -6949,274 +5526,246 @@ snapshots:
 
   '@types/mocha@10.0.10': {}
 
-  '@types/node@22.10.5':
+  '@types/node@22.13.5':
     dependencies:
       undici-types: 6.20.0
 
-  '@types/node@22.10.6':
+  '@types/node@24.0.12':
     dependencies:
-      undici-types: 6.20.0
+      undici-types: 7.8.0
 
   '@types/prismjs@1.26.5': {}
 
-  '@types/prop-types@15.7.13': {}
+  '@types/prop-types@15.7.14': {}
 
-  '@types/react-dom@18.3.1':
+  '@types/react-dom@18.3.5(@types/react@18.3.18)':
     dependencies:
-      '@types/react': 18.3.13
+      '@types/react': 18.3.18
 
-  '@types/react@18.3.13':
+  '@types/react@18.3.18':
     dependencies:
-      '@types/prop-types': 15.7.13
+      '@types/prop-types': 15.7.14
       csstype: 3.1.3
 
   '@types/resolve@1.20.2': {}
 
-  '@types/sinonjs__fake-timers@8.1.1': {}
-
-  '@types/sizzle@2.3.9': {}
-
   '@types/tar-fs@2.0.4':
     dependencies:
-      '@types/node': 22.10.5
+      '@types/node': 22.13.5
       '@types/tar-stream': 3.1.3
 
   '@types/tar-stream@3.1.3':
     dependencies:
-      '@types/node': 22.10.6
+      '@types/node': 24.0.12
 
   '@types/unist@2.0.11': {}
 
   '@types/unist@3.0.3': {}
 
-  '@types/yauzl@2.10.3':
-    dependencies:
-      '@types/node': 22.10.6
-    optional: true
-
-  '@typescript-eslint/eslint-plugin@8.19.1(@typescript-eslint/parser@8.19.1(eslint@9.18.0)(typescript@5.7.2))(eslint@9.18.0)(typescript@5.7.2)':
+  '@typescript-eslint/eslint-plugin@8.36.0(@typescript-eslint/parser@8.36.0(eslint@9.30.1)(typescript@5.8.3))(eslint@9.30.1)(typescript@5.8.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.1
-      '@typescript-eslint/parser': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      '@typescript-eslint/scope-manager': 8.19.1
-      '@typescript-eslint/type-utils': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      '@typescript-eslint/utils': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      '@typescript-eslint/visitor-keys': 8.19.1
-      eslint: 9.18.0
+      '@typescript-eslint/parser': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      '@typescript-eslint/scope-manager': 8.36.0
+      '@typescript-eslint/type-utils': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.36.0
+      eslint: 9.30.1
       graphemer: 1.4.0
-      ignore: 5.3.2
+      ignore: 7.0.5
       natural-compare: 1.4.0
-      ts-api-utils: 2.0.0(typescript@5.7.2)
-      typescript: 5.7.2
+      ts-api-utils: 2.1.0(typescript@5.8.3)
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.19.1(eslint@9.18.0)(typescript@5.7.2)':
+  '@typescript-eslint/parser@8.36.0(eslint@9.30.1)(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.19.1
-      '@typescript-eslint/types': 8.19.1
-      '@typescript-eslint/typescript-estree': 8.19.1(typescript@5.7.2)
-      '@typescript-eslint/visitor-keys': 8.19.1
-      debug: 4.4.0(supports-color@8.1.1)
-      eslint: 9.18.0
-      typescript: 5.7.2
+      '@typescript-eslint/scope-manager': 8.36.0
+      '@typescript-eslint/types': 8.36.0
+      '@typescript-eslint/typescript-estree': 8.36.0(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.36.0
+      debug: 4.4.1(supports-color@8.1.1)
+      eslint: 9.30.1
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/scope-manager@8.19.1':
-    dependencies:
-      '@typescript-eslint/types': 8.19.1
-      '@typescript-eslint/visitor-keys': 8.19.1
-
-  '@typescript-eslint/type-utils@8.19.1(eslint@9.18.0)(typescript@5.7.2)':
+  '@typescript-eslint/project-service@8.36.0(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/typescript-estree': 8.19.1(typescript@5.7.2)
-      '@typescript-eslint/utils': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      debug: 4.4.0(supports-color@8.1.1)
-      eslint: 9.18.0
-      ts-api-utils: 2.0.0(typescript@5.7.2)
-      typescript: 5.7.2
+      '@typescript-eslint/tsconfig-utils': 8.36.0(typescript@5.8.3)
+      '@typescript-eslint/types': 8.36.0
+      debug: 4.4.1(supports-color@8.1.1)
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/types@7.18.0': {}
+  '@typescript-eslint/scope-manager@8.36.0':
+    dependencies:
+      '@typescript-eslint/types': 8.36.0
+      '@typescript-eslint/visitor-keys': 8.36.0
 
-  '@typescript-eslint/types@8.19.1': {}
+  '@typescript-eslint/tsconfig-utils@8.36.0(typescript@5.8.3)':
+    dependencies:
+      typescript: 5.8.3
 
-  '@typescript-eslint/typescript-estree@7.18.0(typescript@5.7.2)':
+  '@typescript-eslint/type-utils@8.36.0(eslint@9.30.1)(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/types': 7.18.0
-      '@typescript-eslint/visitor-keys': 7.18.0
-      debug: 4.4.0(supports-color@8.1.1)
-      globby: 11.1.0
-      is-glob: 4.0.3
-      minimatch: 9.0.5
-      semver: 7.6.3
-      ts-api-utils: 1.4.3(typescript@5.7.2)
-    optionalDependencies:
-      typescript: 5.7.2
+      '@typescript-eslint/typescript-estree': 8.36.0(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      debug: 4.4.1(supports-color@8.1.1)
+      eslint: 9.30.1
+      ts-api-utils: 2.1.0(typescript@5.8.3)
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/typescript-estree@8.19.1(typescript@5.7.2)':
+  '@typescript-eslint/types@8.36.0': {}
+
+  '@typescript-eslint/typescript-estree@8.36.0(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/types': 8.19.1
-      '@typescript-eslint/visitor-keys': 8.19.1
-      debug: 4.4.0(supports-color@8.1.1)
-      fast-glob: 3.3.2
+      '@typescript-eslint/project-service': 8.36.0(typescript@5.8.3)
+      '@typescript-eslint/tsconfig-utils': 8.36.0(typescript@5.8.3)
+      '@typescript-eslint/types': 8.36.0
+      '@typescript-eslint/visitor-keys': 8.36.0
+      debug: 4.4.1(supports-color@8.1.1)
+      fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.6.3
-      ts-api-utils: 2.0.0(typescript@5.7.2)
-      typescript: 5.7.2
+      semver: 7.7.2
+      ts-api-utils: 2.1.0(typescript@5.8.3)
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.19.1(eslint@9.18.0)(typescript@5.7.2)':
+  '@typescript-eslint/utils@8.36.0(eslint@9.30.1)(typescript@5.8.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.1(eslint@9.18.0)
-      '@typescript-eslint/scope-manager': 8.19.1
-      '@typescript-eslint/types': 8.19.1
-      '@typescript-eslint/typescript-estree': 8.19.1(typescript@5.7.2)
-      eslint: 9.18.0
-      typescript: 5.7.2
+      '@eslint-community/eslint-utils': 4.7.0(eslint@9.30.1)
+      '@typescript-eslint/scope-manager': 8.36.0
+      '@typescript-eslint/types': 8.36.0
+      '@typescript-eslint/typescript-estree': 8.36.0(typescript@5.8.3)
+      eslint: 9.30.1
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@7.18.0':
-    dependencies:
-      '@typescript-eslint/types': 7.18.0
-      eslint-visitor-keys: 3.4.3
-
-  '@typescript-eslint/visitor-keys@8.19.1':
+  '@typescript-eslint/visitor-keys@8.36.0':
     dependencies:
-      '@typescript-eslint/types': 8.19.1
-      eslint-visitor-keys: 4.2.0
+      '@typescript-eslint/types': 8.36.0
+      eslint-visitor-keys: 4.2.1
 
-  '@uiw/react-textarea-code-editor@3.1.0(@babel/runtime@7.26.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@uiw/react-textarea-code-editor@3.1.1(@babel/runtime@7.27.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
-      '@babel/runtime': 7.26.0
+      '@babel/runtime': 7.27.6
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
       rehype: 13.0.2
       rehype-prism-plus: 2.0.0
 
-  '@ungap/structured-clone@1.2.0': {}
+  '@ungap/structured-clone@1.3.0': {}
 
-  '@vitejs/plugin-react-swc@3.7.2(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1))':
+  '@vitejs/plugin-react-swc@3.10.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))':
     dependencies:
-      '@swc/core': 1.9.3
-      vite: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
+      '@rolldown/pluginutils': 1.0.0-beta.11
+      '@swc/core': 1.12.0
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
     transitivePeerDependencies:
       - '@swc/helpers'
 
-  '@vitest/expect@2.1.8':
+  '@vitest/expect@3.2.4':
     dependencies:
-      '@vitest/spy': 2.1.8
-      '@vitest/utils': 2.1.8
-      chai: 5.1.2
-      tinyrainbow: 1.2.0
+      '@types/chai': 5.2.2
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.2.0
+      tinyrainbow: 2.0.0
 
-  '@vitest/mocker@2.1.8(vite@5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0))':
+  '@vitest/mocker@3.2.4(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))':
     dependencies:
-      '@vitest/spy': 2.1.8
+      '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.17
     optionalDependencies:
-      vite: 5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
 
-  '@vitest/pretty-format@2.1.8':
+  '@vitest/pretty-format@3.2.4':
     dependencies:
-      tinyrainbow: 1.2.0
+      tinyrainbow: 2.0.0
 
-  '@vitest/runner@2.1.8':
+  '@vitest/runner@3.2.4':
     dependencies:
-      '@vitest/utils': 2.1.8
-      pathe: 1.1.2
+      '@vitest/utils': 3.2.4
+      pathe: 2.0.3
+      strip-literal: 3.0.0
 
-  '@vitest/snapshot@2.1.8':
+  '@vitest/snapshot@3.2.4':
     dependencies:
-      '@vitest/pretty-format': 2.1.8
+      '@vitest/pretty-format': 3.2.4
       magic-string: 0.30.17
-      pathe: 1.1.2
+      pathe: 2.0.3
 
-  '@vitest/spy@2.1.8':
+  '@vitest/spy@3.2.4':
     dependencies:
-      tinyspy: 3.0.2
+      tinyspy: 4.0.3
 
-  '@vitest/utils@2.1.8':
+  '@vitest/utils@3.2.4':
     dependencies:
-      '@vitest/pretty-format': 2.1.8
-      loupe: 3.1.2
-      tinyrainbow: 1.2.0
+      '@vitest/pretty-format': 3.2.4
+      loupe: 3.1.4
+      tinyrainbow: 2.0.0
 
-  '@volar/language-core@2.4.11':
+  '@volar/language-core@2.4.14':
     dependencies:
-      '@volar/source-map': 2.4.11
+      '@volar/source-map': 2.4.14
 
-  '@volar/source-map@2.4.11': {}
+  '@volar/source-map@2.4.14': {}
 
-  '@volar/typescript@2.4.11':
+  '@volar/typescript@2.4.14':
     dependencies:
-      '@volar/language-core': 2.4.11
+      '@volar/language-core': 2.4.14
       path-browserify: 1.0.1
-      vscode-uri: 3.0.8
+      vscode-uri: 3.1.0
 
-  '@vue/compiler-core@3.5.13':
+  '@vue/compiler-core@3.5.14':
     dependencies:
-      '@babel/parser': 7.26.2
-      '@vue/shared': 3.5.13
+      '@babel/parser': 7.27.2
+      '@vue/shared': 3.5.14
       entities: 4.5.0
       estree-walker: 2.0.2
       source-map-js: 1.2.1
 
-  '@vue/compiler-dom@3.5.13':
-    dependencies:
-      '@vue/compiler-core': 3.5.13
-      '@vue/shared': 3.5.13
-
-  '@vue/compiler-sfc@3.5.13':
-    dependencies:
-      '@babel/parser': 7.26.2
-      '@vue/compiler-core': 3.5.13
-      '@vue/compiler-dom': 3.5.13
-      '@vue/compiler-ssr': 3.5.13
-      '@vue/shared': 3.5.13
-      estree-walker: 2.0.2
-      magic-string: 0.30.17
-      postcss: 8.4.49
-      source-map-js: 1.2.1
-
-  '@vue/compiler-ssr@3.5.13':
+  '@vue/compiler-dom@3.5.14':
     dependencies:
-      '@vue/compiler-dom': 3.5.13
-      '@vue/shared': 3.5.13
+      '@vue/compiler-core': 3.5.14
+      '@vue/shared': 3.5.14
 
   '@vue/compiler-vue2@2.7.16':
     dependencies:
       de-indent: 1.0.2
       he: 1.2.0
 
-  '@vue/language-core@2.2.0(typescript@5.7.2)':
+  '@vue/language-core@2.2.0(typescript@5.8.3)':
     dependencies:
-      '@volar/language-core': 2.4.11
-      '@vue/compiler-dom': 3.5.13
+      '@volar/language-core': 2.4.14
+      '@vue/compiler-dom': 3.5.14
       '@vue/compiler-vue2': 2.7.16
-      '@vue/shared': 3.5.13
+      '@vue/shared': 3.5.14
       alien-signals: 0.4.14
       minimatch: 9.0.5
       muggle-string: 0.4.1
       path-browserify: 1.0.1
     optionalDependencies:
-      typescript: 5.7.2
+      typescript: 5.8.3
 
-  '@vue/shared@3.5.13': {}
+  '@vue/shared@3.5.14': {}
 
-  abstract-logging@2.0.1: {}
+  acorn-jsx@5.3.2(acorn@8.14.1):
+    dependencies:
+      acorn: 8.14.1
 
-  acorn-jsx@5.3.2(acorn@8.14.0):
+  acorn-jsx@5.3.2(acorn@8.15.0):
     dependencies:
-      acorn: 8.14.0
+      acorn: 8.15.0
 
   acorn-walk@8.3.4:
     dependencies:
@@ -7224,12 +5773,11 @@ snapshots:
 
   acorn@8.14.0: {}
 
-  agent-base@7.1.3: {}
+  acorn@8.14.1: {}
 
-  aggregate-error@3.1.0:
-    dependencies:
-      clean-stack: 2.2.0
-      indent-string: 4.0.0
+  acorn@8.15.0: {}
+
+  agent-base@7.1.3: {}
 
   ajv-draft-04@1.0.0(ajv@8.13.0):
     optionalDependencies:
@@ -7262,12 +5810,6 @@ snapshots:
 
   alien-signals@0.4.14: {}
 
-  ansi-colors@4.1.3: {}
-
-  ansi-escapes@4.3.2:
-    dependencies:
-      type-fest: 0.21.3
-
   ansi-escapes@7.0.0:
     dependencies:
       environment: 1.1.0
@@ -7289,14 +5831,8 @@ snapshots:
       normalize-path: 3.0.0
       picomatch: 2.3.1
 
-  app-module-path@2.2.0: {}
-
-  arch@2.2.0: {}
-
   arg@4.1.3: {}
 
-  arg@5.0.2: {}
-
   argparse@1.0.10:
     dependencies:
       sprintf-js: 1.0.3
@@ -7311,140 +5847,108 @@ snapshots:
 
   array-buffer-byte-length@1.0.2:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       is-array-buffer: 3.0.5
 
   array-includes@3.1.8:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-object-atoms: 1.0.0
-      get-intrinsic: 1.2.6
+      es-abstract: 1.23.9
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
       is-string: 1.1.1
 
-  array-union@2.1.0: {}
-
   array.prototype.findlast@1.2.5:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
       es-errors: 1.3.0
-      es-object-atoms: 1.0.0
-      es-shim-unscopables: 1.0.2
+      es-object-atoms: 1.1.1
+      es-shim-unscopables: 1.1.0
 
-  array.prototype.flat@1.3.2:
+  array.prototype.flat@1.3.3:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-shim-unscopables: 1.0.2
+      es-abstract: 1.23.9
+      es-shim-unscopables: 1.1.0
 
   array.prototype.flatmap@1.3.3:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-shim-unscopables: 1.0.2
+      es-abstract: 1.23.9
+      es-shim-unscopables: 1.1.0
 
   array.prototype.tosorted@1.1.4:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
       es-errors: 1.3.0
-      es-shim-unscopables: 1.0.2
+      es-shim-unscopables: 1.1.0
 
   arraybuffer.prototype.slice@1.0.4:
     dependencies:
       array-buffer-byte-length: 1.0.2
       call-bind: 1.0.8
-      define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-errors: 1.3.0
-      get-intrinsic: 1.2.6
-      is-array-buffer: 3.0.5
-
-  asn1@0.2.6:
-    dependencies:
-      safer-buffer: 2.1.2
-
-  assert-plus@1.0.0: {}
+      define-properties: 1.2.1
+      es-abstract: 1.23.9
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
 
   assertion-error@2.0.1: {}
 
-  ast-module-types@6.0.0: {}
-
-  astral-regex@2.0.0: {}
-
-  async@3.2.6: {}
-
-  asynckit@0.4.0: {}
-
-  at-least-node@1.0.0: {}
+  async-function@1.0.0: {}
 
   attr-accept@2.2.5: {}
 
   available-typed-arrays@1.0.7:
     dependencies:
-      possible-typed-array-names: 1.0.0
-
-  aws-sign2@0.7.0: {}
+      possible-typed-array-names: 1.1.0
 
-  aws4@1.13.2: {}
-
-  axe-core@4.10.2: {}
+  axe-core@4.10.3: {}
 
   b4a@1.6.7: {}
 
-  backoff@2.5.0:
-    dependencies:
-      precond: 0.2.3
-
   bail@2.0.2: {}
 
   balanced-match@1.0.2: {}
 
   balanced-match@3.0.1: {}
 
-  bare-events@2.5.0:
+  bare-events@2.5.4:
     optional: true
 
-  bare-fs@2.3.5:
+  bare-fs@4.1.5:
     dependencies:
-      bare-events: 2.5.0
-      bare-path: 2.1.3
-      bare-stream: 2.4.2
+      bare-events: 2.5.4
+      bare-path: 3.0.0
+      bare-stream: 2.6.5(bare-events@2.5.4)
     optional: true
 
-  bare-os@2.4.4:
+  bare-os@3.6.1:
     optional: true
 
-  bare-path@2.1.3:
+  bare-path@3.0.0:
     dependencies:
-      bare-os: 2.4.4
+      bare-os: 3.6.1
     optional: true
 
-  bare-stream@2.4.2:
+  bare-stream@2.6.5(bare-events@2.5.4):
     dependencies:
-      streamx: 2.20.2
+      streamx: 2.22.1
+    optionalDependencies:
+      bare-events: 2.5.4
     optional: true
 
-  base64-js@1.5.1: {}
-
-  bcrypt-pbkdf@1.0.2:
-    dependencies:
-      tweetnacl: 0.14.5
-
-  before-after-hook@3.0.2: {}
+  before-after-hook@4.0.0: {}
 
   binary-extensions@2.3.0: {}
 
-  blob-util@2.0.2: {}
-
-  bluebird@3.7.2: {}
-
   bootstrap@3.4.1: {}
 
   brace-expansion@1.1.11:
@@ -7452,7 +5956,12 @@ snapshots:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@2.0.1:
+  brace-expansion@1.1.12:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@2.0.2:
     dependencies:
       balanced-match: 1.0.2
 
@@ -7470,42 +5979,33 @@ snapshots:
     dependencies:
       pako: 0.2.9
 
-  browserslist@4.24.2:
+  browserslist@4.24.4:
     dependencies:
-      caniuse-lite: 1.0.30001684
-      electron-to-chromium: 1.5.67
-      node-releases: 2.0.18
-      update-browserslist-db: 1.1.1(browserslist@4.24.2)
-
-  buffer-crc32@0.2.13: {}
+      caniuse-lite: 1.0.30001700
+      electron-to-chromium: 1.5.104
+      node-releases: 2.0.19
+      update-browserslist-db: 1.1.2(browserslist@4.24.4)
 
   buffer-from@1.1.2: {}
 
-  buffer@5.7.1:
-    dependencies:
-      base64-js: 1.5.1
-      ieee754: 1.2.1
-
   cac@6.7.14: {}
 
-  cachedir@2.4.0: {}
-
-  call-bind-apply-helpers@1.0.1:
+  call-bind-apply-helpers@1.0.2:
     dependencies:
       es-errors: 1.3.0
       function-bind: 1.1.2
 
   call-bind@1.0.8:
     dependencies:
-      call-bind-apply-helpers: 1.0.1
+      call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
-      get-intrinsic: 1.2.6
+      get-intrinsic: 1.3.0
       set-function-length: 1.2.2
 
-  call-bound@1.0.3:
+  call-bound@1.0.4:
     dependencies:
-      call-bind-apply-helpers: 1.0.1
-      get-intrinsic: 1.2.6
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
 
   callsites@3.1.0: {}
 
@@ -7513,18 +6013,16 @@ snapshots:
 
   camelize-ts@3.0.0: {}
 
-  caniuse-lite@1.0.30001684: {}
-
-  caseless@0.12.0: {}
+  caniuse-lite@1.0.30001700: {}
 
   ccount@2.0.1: {}
 
-  chai@5.1.2:
+  chai@5.2.0:
     dependencies:
       assertion-error: 2.0.1
       check-error: 2.1.1
       deep-eql: 5.0.2
-      loupe: 3.1.2
+      loupe: 3.1.3
       pathval: 2.0.0
 
   chalk@3.0.0:
@@ -7549,8 +6047,6 @@ snapshots:
 
   check-error@2.1.1: {}
 
-  check-more-types@2.24.0: {}
-
   chokidar@3.6.0:
     dependencies:
       anymatch: 3.1.3
@@ -7563,45 +6059,27 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
-  ci-info@4.1.0: {}
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
 
   classcat@5.0.5: {}
 
-  clean-stack@2.2.0: {}
-
-  cli-cursor@3.1.0:
-    dependencies:
-      restore-cursor: 3.1.0
-
   cli-cursor@5.0.0:
     dependencies:
       restore-cursor: 5.1.0
 
-  cli-table3@0.6.5:
-    dependencies:
-      string-width: 4.2.3
-    optionalDependencies:
-      '@colors/colors': 1.5.0
-
-  cli-truncate@2.1.0:
-    dependencies:
-      slice-ansi: 3.0.0
-      string-width: 4.2.3
-
   cli-truncate@4.0.0:
     dependencies:
       slice-ansi: 5.0.0
       string-width: 7.2.0
 
-  cliui@7.0.4:
+  cliui@8.0.1:
     dependencies:
       string-width: 4.2.3
       strip-ansi: 6.0.1
       wrap-ansi: 7.0.0
 
-  clone@1.0.4:
-    optional: true
-
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -7610,22 +6088,12 @@ snapshots:
 
   colorette@2.0.20: {}
 
-  combined-stream@1.0.8:
-    dependencies:
-      delayed-stream: 1.0.0
-
   comma-separated-tokens@2.0.3: {}
 
-  commander@12.1.0: {}
+  commander@14.0.0: {}
 
   commander@2.20.3: {}
 
-  commander@6.2.1: {}
-
-  commander@8.3.0: {}
-
-  common-tags@1.8.2: {}
-
   commondir@1.0.1: {}
 
   compare-versions@6.1.1: {}
@@ -7634,23 +6102,17 @@ snapshots:
 
   confbox@0.1.8: {}
 
-  console.table@0.10.0:
-    dependencies:
-      easy-table: 1.1.0
+  confbox@0.2.2: {}
 
   convert-source-map@2.0.0: {}
 
-  core-util-is@1.0.2: {}
-
   core-util-is@1.0.3: {}
 
   create-require@1.1.1: {}
 
-  cross-fetch@4.0.0:
+  cross-env@7.0.3:
     dependencies:
-      node-fetch: 2.7.0
-    transitivePeerDependencies:
-      - encoding
+      cross-spawn: 7.0.6
 
   cross-spawn@7.0.6:
     dependencies:
@@ -7660,78 +6122,13 @@ snapshots:
 
   css.escape@1.5.1: {}
 
-  cssstyle@4.2.1:
+  cssstyle@4.3.0:
     dependencies:
-      '@asamuzakjp/css-color': 2.8.2
+      '@asamuzakjp/css-color': 3.1.1
       rrweb-cssom: 0.8.0
 
   csstype@3.1.3: {}
 
-  cypress-axe@1.5.0(axe-core@4.10.2)(cypress@13.17.0):
-    dependencies:
-      axe-core: 4.10.2
-      cypress: 13.17.0
-
-  cypress-split@1.24.7(@babel/core@7.26.0):
-    dependencies:
-      '@actions/core': 1.11.1
-      arg: 5.0.2
-      console.table: 0.10.0
-      debug: 4.4.0(supports-color@8.1.1)
-      fast-shuffle: 6.1.1
-      find-cypress-specs: 1.46.2(@babel/core@7.26.0)
-      globby: 11.1.0
-      humanize-duration: 3.32.1
-    transitivePeerDependencies:
-      - '@babel/core'
-      - supports-color
-
-  cypress@13.17.0:
-    dependencies:
-      '@cypress/request': 3.0.6
-      '@cypress/xvfb': 1.2.4(supports-color@8.1.1)
-      '@types/sinonjs__fake-timers': 8.1.1
-      '@types/sizzle': 2.3.9
-      arch: 2.2.0
-      blob-util: 2.0.2
-      bluebird: 3.7.2
-      buffer: 5.7.1
-      cachedir: 2.4.0
-      chalk: 4.1.2
-      check-more-types: 2.24.0
-      ci-info: 4.1.0
-      cli-cursor: 3.1.0
-      cli-table3: 0.6.5
-      commander: 6.2.1
-      common-tags: 1.8.2
-      dayjs: 1.11.13
-      debug: 4.4.0(supports-color@8.1.1)
-      enquirer: 2.4.1
-      eventemitter2: 6.4.7
-      execa: 4.1.0
-      executable: 4.1.1
-      extract-zip: 2.0.1(supports-color@8.1.1)
-      figures: 3.2.0
-      fs-extra: 9.1.0
-      getos: 3.2.1
-      is-installed-globally: 0.4.0
-      lazy-ass: 1.6.0
-      listr2: 3.14.0(enquirer@2.4.1)
-      lodash: 4.17.21
-      log-symbols: 4.1.0
-      minimist: 1.2.8
-      ospath: 1.2.2
-      pretty-bytes: 5.6.0
-      process: 0.11.10
-      proxy-from-env: 1.0.0
-      request-progress: 3.0.0
-      semver: 7.6.3
-      supports-color: 8.1.1
-      tmp: 0.2.3
-      tree-kill: 1.2.2
-      untildify: 4.0.0
-      yauzl: 2.10.0
-
   d3-color@3.1.0: {}
 
   d3-dispatch@3.0.1: {}
@@ -7768,59 +6165,36 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  dagre@0.8.5:
-    dependencies:
-      graphlib: 2.1.8
-      lodash: 4.17.21
-
-  dashdash@1.14.1:
-    dependencies:
-      assert-plus: 1.0.0
-
   data-urls@5.0.0:
     dependencies:
       whatwg-mimetype: 4.0.0
-      whatwg-url: 14.1.0
+      whatwg-url: 14.2.0
 
   data-view-buffer@1.0.2:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
       is-data-view: 1.0.2
 
   data-view-byte-length@1.0.2:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
       is-data-view: 1.0.2
 
   data-view-byte-offset@1.0.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
       is-data-view: 1.0.2
 
-  dayjs@1.11.13: {}
-
   de-indent@1.0.2: {}
 
-  debug@3.2.7(supports-color@8.1.1):
-    dependencies:
-      ms: 2.1.3
-    optionalDependencies:
-      supports-color: 8.1.1
-
-  debug@4.3.4:
-    dependencies:
-      ms: 2.1.2
-
-  debug@4.3.7(supports-color@8.1.1):
+  debug@4.4.0:
     dependencies:
       ms: 2.1.3
-    optionalDependencies:
-      supports-color: 8.1.1
 
-  debug@4.4.0(supports-color@8.1.1):
+  debug@4.4.1(supports-color@8.1.1):
     dependencies:
       ms: 2.1.3
     optionalDependencies:
@@ -7828,44 +6202,18 @@ snapshots:
 
   decamelize@4.0.0: {}
 
-  decimal.js@10.4.3: {}
+  decimal.js@10.5.0: {}
 
-  decode-named-character-reference@1.0.2:
+  decode-named-character-reference@1.1.0:
     dependencies:
       character-entities: 2.0.2
 
   deep-eql@5.0.2: {}
 
-  deep-equal@2.2.3:
-    dependencies:
-      array-buffer-byte-length: 1.0.2
-      call-bind: 1.0.8
-      es-get-iterator: 1.1.3
-      get-intrinsic: 1.2.6
-      is-arguments: 1.1.1
-      is-array-buffer: 3.0.5
-      is-date-object: 1.1.0
-      is-regex: 1.2.1
-      is-shared-array-buffer: 1.0.4
-      isarray: 2.0.5
-      object-is: 1.1.6
-      object-keys: 1.1.1
-      object.assign: 4.1.7
-      regexp.prototype.flags: 1.5.3
-      side-channel: 1.1.0
-      which-boxed-primitive: 1.1.1
-      which-collection: 1.0.2
-      which-typed-array: 1.1.18
-
   deep-is@0.1.4: {}
 
   deepmerge@4.3.1: {}
 
-  defaults@1.0.4:
-    dependencies:
-      clone: 1.0.4
-    optional: true
-
   define-data-property@1.1.4:
     dependencies:
       es-define-property: 1.0.1
@@ -7878,76 +6226,9 @@ snapshots:
       has-property-descriptors: 1.0.2
       object-keys: 1.1.1
 
-  delayed-stream@1.0.0: {}
-
-  dependency-tree@11.0.1:
-    dependencies:
-      commander: 12.1.0
-      filing-cabinet: 5.0.2
-      precinct: 12.1.2
-      typescript: 5.7.2
-    transitivePeerDependencies:
-      - supports-color
-
   dequal@2.0.3: {}
 
-  detect-libc@1.0.3: {}
-
-  detective-amd@6.0.0:
-    dependencies:
-      ast-module-types: 6.0.0
-      escodegen: 2.1.0
-      get-amd-module-type: 6.0.0
-      node-source-walk: 7.0.0
-
-  detective-cjs@6.0.0:
-    dependencies:
-      ast-module-types: 6.0.0
-      node-source-walk: 7.0.0
-
-  detective-es6@5.0.0:
-    dependencies:
-      node-source-walk: 7.0.0
-
-  detective-postcss@7.0.0(postcss@8.4.49):
-    dependencies:
-      is-url: 1.2.4
-      postcss: 8.4.49
-      postcss-values-parser: 6.0.2(postcss@8.4.49)
-
-  detective-sass@6.0.0:
-    dependencies:
-      gonzales-pe: 4.3.0
-      node-source-walk: 7.0.0
-
-  detective-scss@5.0.0:
-    dependencies:
-      gonzales-pe: 4.3.0
-      node-source-walk: 7.0.0
-
-  detective-stylus@5.0.0: {}
-
-  detective-typescript@13.0.0(typescript@5.7.2):
-    dependencies:
-      '@typescript-eslint/typescript-estree': 7.18.0(typescript@5.7.2)
-      ast-module-types: 6.0.0
-      node-source-walk: 7.0.0
-      typescript: 5.7.2
-    transitivePeerDependencies:
-      - supports-color
-
-  detective-vue2@2.1.0(typescript@5.7.2):
-    dependencies:
-      '@dependents/detective-less': 5.0.0
-      '@vue/compiler-sfc': 3.5.13
-      detective-es6: 5.0.0
-      detective-sass: 6.0.0
-      detective-scss: 5.0.0
-      detective-stylus: 5.0.0
-      detective-typescript: 13.0.0(typescript@5.7.2)
-      typescript: 5.7.2
-    transitivePeerDependencies:
-      - supports-color
+  detect-libc@2.0.4: {}
 
   devlop@1.1.0:
     dependencies:
@@ -7955,11 +6236,7 @@ snapshots:
 
   diff@4.0.2: {}
 
-  diff@5.2.0: {}
-
-  dir-glob@3.0.1:
-    dependencies:
-      path-type: 4.0.0
+  diff@7.0.0: {}
 
   doctrine@2.1.0:
     dependencies:
@@ -7971,29 +6248,20 @@ snapshots:
 
   dunder-proto@1.0.1:
     dependencies:
-      call-bind-apply-helpers: 1.0.1
+      call-bind-apply-helpers: 1.0.2
       es-errors: 1.3.0
       gopd: 1.2.0
 
   duplexify@3.7.1:
     dependencies:
-      end-of-stream: 1.4.4
+      end-of-stream: 1.4.5
       inherits: 2.0.4
       readable-stream: 2.3.8
       stream-shift: 1.0.3
 
   eastasianwidth@0.2.0: {}
 
-  easy-table@1.1.0:
-    optionalDependencies:
-      wcwidth: 1.0.1
-
-  ecc-jsbn@0.1.2:
-    dependencies:
-      jsbn: 0.1.1
-      safer-buffer: 2.1.2
-
-  electron-to-chromium@1.5.67: {}
+  electron-to-chromium@1.5.104: {}
 
   emoji-regex@10.4.0: {}
 
@@ -8001,41 +6269,34 @@ snapshots:
 
   emoji-regex@9.2.2: {}
 
-  end-of-stream@1.4.4:
+  end-of-stream@1.4.5:
     dependencies:
       once: 1.4.0
 
-  enhanced-resolve@5.17.1:
-    dependencies:
-      graceful-fs: 4.2.11
-      tapable: 2.2.1
-
-  enquirer@2.4.1:
-    dependencies:
-      ansi-colors: 4.1.3
-      strip-ansi: 6.0.1
-
   entities@4.5.0: {}
 
+  entities@6.0.0: {}
+
   environment@1.1.0: {}
 
-  es-abstract@1.23.7:
+  es-abstract@1.23.9:
     dependencies:
       array-buffer-byte-length: 1.0.2
       arraybuffer.prototype.slice: 1.0.4
       available-typed-arrays: 1.0.7
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       data-view-buffer: 1.0.2
       data-view-byte-length: 1.0.2
       data-view-byte-offset: 1.0.1
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.0.0
-      es-set-tostringtag: 2.0.3
+      es-object-atoms: 1.1.1
+      es-set-tostringtag: 2.1.0
       es-to-primitive: 1.3.0
       function.prototype.name: 1.1.8
-      get-intrinsic: 1.2.6
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
       get-symbol-description: 1.1.0
       globalthis: 1.0.4
       gopd: 1.2.0
@@ -8051,14 +6312,17 @@ snapshots:
       is-shared-array-buffer: 1.0.4
       is-string: 1.1.1
       is-typed-array: 1.1.15
-      is-weakref: 1.1.0
+      is-weakref: 1.1.1
       math-intrinsics: 1.1.0
-      object-inspect: 1.13.3
+      object-inspect: 1.13.4
       object-keys: 1.1.1
       object.assign: 4.1.7
-      regexp.prototype.flags: 1.5.3
+      own-keys: 1.0.1
+      regexp.prototype.flags: 1.5.4
       safe-array-concat: 1.1.3
+      safe-push-apply: 1.0.0
       safe-regex-test: 1.1.0
+      set-proto: 1.0.0
       string.prototype.trim: 1.2.10
       string.prototype.trimend: 1.0.9
       string.prototype.trimstart: 1.0.8
@@ -8067,56 +6331,45 @@ snapshots:
       typed-array-byte-offset: 1.0.4
       typed-array-length: 1.0.7
       unbox-primitive: 1.1.0
-      which-typed-array: 1.1.18
+      which-typed-array: 1.1.19
 
   es-define-property@1.0.1: {}
 
   es-errors@1.3.0: {}
 
-  es-get-iterator@1.1.3:
-    dependencies:
-      call-bind: 1.0.8
-      get-intrinsic: 1.2.6
-      has-symbols: 1.1.0
-      is-arguments: 1.1.1
-      is-map: 2.0.3
-      is-set: 2.0.3
-      is-string: 1.1.1
-      isarray: 2.0.5
-      stop-iteration-iterator: 1.0.0
-
   es-iterator-helpers@1.2.1:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
       es-errors: 1.3.0
-      es-set-tostringtag: 2.0.3
+      es-set-tostringtag: 2.1.0
       function-bind: 1.1.2
-      get-intrinsic: 1.2.6
+      get-intrinsic: 1.3.0
       globalthis: 1.0.4
       gopd: 1.2.0
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
       internal-slot: 1.1.0
-      iterator.prototype: 1.1.4
+      iterator.prototype: 1.1.5
       safe-array-concat: 1.1.3
 
-  es-module-lexer@1.5.4: {}
+  es-module-lexer@1.7.0: {}
 
-  es-object-atoms@1.0.0:
+  es-object-atoms@1.1.1:
     dependencies:
       es-errors: 1.3.0
 
-  es-set-tostringtag@2.0.3:
+  es-set-tostringtag@2.1.0:
     dependencies:
-      get-intrinsic: 1.2.6
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
       hasown: 2.0.2
 
-  es-shim-unscopables@1.0.2:
+  es-shim-unscopables@1.1.0:
     dependencies:
       hasown: 2.0.2
 
@@ -8126,153 +6379,79 @@ snapshots:
       is-date-object: 1.1.0
       is-symbol: 1.1.1
 
-  esbuild@0.21.5:
-    optionalDependencies:
-      '@esbuild/aix-ppc64': 0.21.5
-      '@esbuild/android-arm': 0.21.5
-      '@esbuild/android-arm64': 0.21.5
-      '@esbuild/android-x64': 0.21.5
-      '@esbuild/darwin-arm64': 0.21.5
-      '@esbuild/darwin-x64': 0.21.5
-      '@esbuild/freebsd-arm64': 0.21.5
-      '@esbuild/freebsd-x64': 0.21.5
-      '@esbuild/linux-arm': 0.21.5
-      '@esbuild/linux-arm64': 0.21.5
-      '@esbuild/linux-ia32': 0.21.5
-      '@esbuild/linux-loong64': 0.21.5
-      '@esbuild/linux-mips64el': 0.21.5
-      '@esbuild/linux-ppc64': 0.21.5
-      '@esbuild/linux-riscv64': 0.21.5
-      '@esbuild/linux-s390x': 0.21.5
-      '@esbuild/linux-x64': 0.21.5
-      '@esbuild/netbsd-x64': 0.21.5
-      '@esbuild/openbsd-x64': 0.21.5
-      '@esbuild/sunos-x64': 0.21.5
-      '@esbuild/win32-arm64': 0.21.5
-      '@esbuild/win32-ia32': 0.21.5
-      '@esbuild/win32-x64': 0.21.5
-
-  esbuild@0.23.1:
-    optionalDependencies:
-      '@esbuild/aix-ppc64': 0.23.1
-      '@esbuild/android-arm': 0.23.1
-      '@esbuild/android-arm64': 0.23.1
-      '@esbuild/android-x64': 0.23.1
-      '@esbuild/darwin-arm64': 0.23.1
-      '@esbuild/darwin-x64': 0.23.1
-      '@esbuild/freebsd-arm64': 0.23.1
-      '@esbuild/freebsd-x64': 0.23.1
-      '@esbuild/linux-arm': 0.23.1
-      '@esbuild/linux-arm64': 0.23.1
-      '@esbuild/linux-ia32': 0.23.1
-      '@esbuild/linux-loong64': 0.23.1
-      '@esbuild/linux-mips64el': 0.23.1
-      '@esbuild/linux-ppc64': 0.23.1
-      '@esbuild/linux-riscv64': 0.23.1
-      '@esbuild/linux-s390x': 0.23.1
-      '@esbuild/linux-x64': 0.23.1
-      '@esbuild/netbsd-x64': 0.23.1
-      '@esbuild/openbsd-arm64': 0.23.1
-      '@esbuild/openbsd-x64': 0.23.1
-      '@esbuild/sunos-x64': 0.23.1
-      '@esbuild/win32-arm64': 0.23.1
-      '@esbuild/win32-ia32': 0.23.1
-      '@esbuild/win32-x64': 0.23.1
-
-  esbuild@0.24.2:
+  esbuild@0.25.6:
     optionalDependencies:
-      '@esbuild/aix-ppc64': 0.24.2
-      '@esbuild/android-arm': 0.24.2
-      '@esbuild/android-arm64': 0.24.2
-      '@esbuild/android-x64': 0.24.2
-      '@esbuild/darwin-arm64': 0.24.2
-      '@esbuild/darwin-x64': 0.24.2
-      '@esbuild/freebsd-arm64': 0.24.2
-      '@esbuild/freebsd-x64': 0.24.2
-      '@esbuild/linux-arm': 0.24.2
-      '@esbuild/linux-arm64': 0.24.2
-      '@esbuild/linux-ia32': 0.24.2
-      '@esbuild/linux-loong64': 0.24.2
-      '@esbuild/linux-mips64el': 0.24.2
-      '@esbuild/linux-ppc64': 0.24.2
-      '@esbuild/linux-riscv64': 0.24.2
-      '@esbuild/linux-s390x': 0.24.2
-      '@esbuild/linux-x64': 0.24.2
-      '@esbuild/netbsd-arm64': 0.24.2
-      '@esbuild/netbsd-x64': 0.24.2
-      '@esbuild/openbsd-arm64': 0.24.2
-      '@esbuild/openbsd-x64': 0.24.2
-      '@esbuild/sunos-x64': 0.24.2
-      '@esbuild/win32-arm64': 0.24.2
-      '@esbuild/win32-ia32': 0.24.2
-      '@esbuild/win32-x64': 0.24.2
+      '@esbuild/aix-ppc64': 0.25.6
+      '@esbuild/android-arm': 0.25.6
+      '@esbuild/android-arm64': 0.25.6
+      '@esbuild/android-x64': 0.25.6
+      '@esbuild/darwin-arm64': 0.25.6
+      '@esbuild/darwin-x64': 0.25.6
+      '@esbuild/freebsd-arm64': 0.25.6
+      '@esbuild/freebsd-x64': 0.25.6
+      '@esbuild/linux-arm': 0.25.6
+      '@esbuild/linux-arm64': 0.25.6
+      '@esbuild/linux-ia32': 0.25.6
+      '@esbuild/linux-loong64': 0.25.6
+      '@esbuild/linux-mips64el': 0.25.6
+      '@esbuild/linux-ppc64': 0.25.6
+      '@esbuild/linux-riscv64': 0.25.6
+      '@esbuild/linux-s390x': 0.25.6
+      '@esbuild/linux-x64': 0.25.6
+      '@esbuild/netbsd-arm64': 0.25.6
+      '@esbuild/netbsd-x64': 0.25.6
+      '@esbuild/openbsd-arm64': 0.25.6
+      '@esbuild/openbsd-x64': 0.25.6
+      '@esbuild/openharmony-arm64': 0.25.6
+      '@esbuild/sunos-x64': 0.25.6
+      '@esbuild/win32-arm64': 0.25.6
+      '@esbuild/win32-ia32': 0.25.6
+      '@esbuild/win32-x64': 0.25.6
 
   escalade@3.2.0: {}
 
-  escape-string-regexp@1.0.5: {}
-
   escape-string-regexp@4.0.0: {}
 
-  escodegen@2.1.0:
-    dependencies:
-      esprima: 4.0.1
-      estraverse: 5.3.0
-      esutils: 2.0.3
-    optionalDependencies:
-      source-map: 0.6.1
-
-  eslint-config-prettier@10.0.1(eslint@9.18.0):
-    dependencies:
-      eslint: 9.18.0
-
-  eslint-plugin-cypress@4.1.0(eslint@9.18.0):
+  eslint-config-prettier@10.1.5(eslint@9.30.1):
     dependencies:
-      eslint: 9.18.0
-      globals: 15.12.0
+      eslint: 9.30.1
 
-  eslint-plugin-lodash@8.0.0(eslint@9.18.0):
+  eslint-plugin-lodash@8.0.0(eslint@9.30.1):
     dependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
       lodash: 4.17.21
 
-  eslint-plugin-mocha@10.5.0(eslint@9.18.0):
-    dependencies:
-      eslint: 9.18.0
-      eslint-utils: 3.0.0(eslint@9.18.0)
-      globals: 13.24.0
-      rambda: 7.5.0
-
-  eslint-plugin-playwright@2.1.0(eslint@9.18.0):
+  eslint-plugin-playwright@2.2.0(eslint@9.30.1):
     dependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
       globals: 13.24.0
 
-  eslint-plugin-prettier@5.2.1(eslint-config-prettier@10.0.1(eslint@9.18.0))(eslint@9.18.0)(prettier@3.4.2):
+  eslint-plugin-prettier@5.5.1(eslint-config-prettier@10.1.5(eslint@9.30.1))(eslint@9.30.1)(prettier@3.6.2):
     dependencies:
-      eslint: 9.18.0
-      prettier: 3.4.2
+      eslint: 9.30.1
+      prettier: 3.6.2
       prettier-linter-helpers: 1.0.0
-      synckit: 0.9.2
+      synckit: 0.11.8
     optionalDependencies:
-      eslint-config-prettier: 10.0.1(eslint@9.18.0)
+      eslint-config-prettier: 10.1.5(eslint@9.30.1)
 
-  eslint-plugin-react-compiler@19.0.0-beta-55955c9-20241229(eslint@9.18.0):
+  eslint-plugin-react-compiler@19.0.0-beta-714736e-20250131(eslint@9.30.1):
     dependencies:
-      '@babel/core': 7.26.0
-      '@babel/parser': 7.26.2
-      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.26.0)
-      eslint: 9.18.0
+      '@babel/core': 7.26.9
+      '@babel/parser': 7.26.9
+      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.26.9)
+      eslint: 9.30.1
       hermes-parser: 0.25.1
-      zod: 3.23.8
-      zod-validation-error: 3.4.0(zod@3.23.8)
+      zod: 3.24.2
+      zod-validation-error: 3.4.0(zod@3.24.2)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-react-hooks@5.0.0(eslint@9.18.0):
+  eslint-plugin-react-hooks@5.2.0(eslint@9.30.1):
     dependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
 
-  eslint-plugin-react@7.37.4(eslint@9.18.0):
+  eslint-plugin-react@7.37.5(eslint@9.30.1):
     dependencies:
       array-includes: 3.1.8
       array.prototype.findlast: 1.2.5
@@ -8280,12 +6459,12 @@ snapshots:
       array.prototype.tosorted: 1.1.4
       doctrine: 2.1.0
       es-iterator-helpers: 1.2.1
-      eslint: 9.18.0
+      eslint: 9.30.1
       estraverse: 5.3.0
       hasown: 2.0.2
       jsx-ast-utils: 3.3.5
       minimatch: 3.1.2
-      object.entries: 1.1.8
+      object.entries: 1.1.9
       object.fromentries: 2.0.8
       object.values: 1.2.1
       prop-types: 15.8.1
@@ -8294,44 +6473,38 @@ snapshots:
       string.prototype.matchall: 4.0.12
       string.prototype.repeat: 1.0.0
 
-  eslint-scope@8.2.0:
+  eslint-scope@8.4.0:
     dependencies:
       esrecurse: 4.3.0
       estraverse: 5.3.0
 
-  eslint-utils@3.0.0(eslint@9.18.0):
-    dependencies:
-      eslint: 9.18.0
-      eslint-visitor-keys: 2.1.0
-
-  eslint-visitor-keys@2.1.0: {}
-
   eslint-visitor-keys@3.4.3: {}
 
-  eslint-visitor-keys@4.2.0: {}
+  eslint-visitor-keys@4.2.1: {}
 
-  eslint@9.18.0:
+  eslint@9.30.1:
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.1(eslint@9.18.0)
+      '@eslint-community/eslint-utils': 4.7.0(eslint@9.30.1)
       '@eslint-community/regexpp': 4.12.1
-      '@eslint/config-array': 0.19.0
-      '@eslint/core': 0.10.0
-      '@eslint/eslintrc': 3.2.0
-      '@eslint/js': 9.18.0
-      '@eslint/plugin-kit': 0.2.5
+      '@eslint/config-array': 0.21.0
+      '@eslint/config-helpers': 0.3.0
+      '@eslint/core': 0.14.0
+      '@eslint/eslintrc': 3.3.1
+      '@eslint/js': 9.30.1
+      '@eslint/plugin-kit': 0.3.3
       '@humanfs/node': 0.16.6
       '@humanwhocodes/module-importer': 1.0.1
-      '@humanwhocodes/retry': 0.4.1
-      '@types/estree': 1.0.6
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
       '@types/json-schema': 7.0.15
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
       escape-string-regexp: 4.0.0
-      eslint-scope: 8.2.0
-      eslint-visitor-keys: 4.2.0
-      espree: 10.3.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
       esquery: 1.6.0
       esutils: 2.0.3
       fast-deep-equal: 3.1.3
@@ -8351,11 +6524,15 @@ snapshots:
 
   espree@10.3.0:
     dependencies:
-      acorn: 8.14.0
-      acorn-jsx: 5.3.2(acorn@8.14.0)
-      eslint-visitor-keys: 4.2.0
+      acorn: 8.14.1
+      acorn-jsx: 5.3.2(acorn@8.14.1)
+      eslint-visitor-keys: 4.2.1
 
-  esprima@4.0.1: {}
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.15.0
+      acorn-jsx: 5.3.2(acorn@8.15.0)
+      eslint-visitor-keys: 4.2.1
 
   esquery@1.6.0:
     dependencies:
@@ -8371,61 +6548,19 @@ snapshots:
 
   estree-walker@3.0.3:
     dependencies:
-      '@types/estree': 1.0.6
+      '@types/estree': 1.0.8
 
   esutils@2.0.3: {}
 
-  eventemitter2@6.4.7: {}
-
   eventemitter3@5.0.1: {}
 
-  execa@4.1.0:
-    dependencies:
-      cross-spawn: 7.0.6
-      get-stream: 5.2.0
-      human-signals: 1.1.1
-      is-stream: 2.0.1
-      merge-stream: 2.0.0
-      npm-run-path: 4.0.1
-      onetime: 5.1.2
-      signal-exit: 3.0.7
-      strip-final-newline: 2.0.0
-
-  execa@8.0.1:
-    dependencies:
-      cross-spawn: 7.0.6
-      get-stream: 8.0.1
-      human-signals: 5.0.0
-      is-stream: 3.0.0
-      merge-stream: 2.0.0
-      npm-run-path: 5.3.0
-      onetime: 6.0.0
-      signal-exit: 4.1.0
-      strip-final-newline: 3.0.0
-
-  executable@4.1.1:
-    dependencies:
-      pify: 2.3.0
+  expect-type@1.2.1: {}
 
-  expect-type@1.1.0: {}
+  exsolve@1.0.5: {}
 
   extend@3.0.2: {}
 
-  extract-zip@2.0.1(supports-color@8.1.1):
-    dependencies:
-      debug: 4.4.0(supports-color@8.1.1)
-      get-stream: 5.2.0
-      yauzl: 2.10.0
-    optionalDependencies:
-      '@types/yauzl': 2.10.3
-    transitivePeerDependencies:
-      - supports-color
-
-  extsprintf@1.3.0: {}
-
-  extsprintf@1.4.1: {}
-
-  fast-content-type-parse@2.0.1: {}
+  fast-content-type-parse@3.0.0: {}
 
   fast-deep-equal@3.1.3: {}
 
@@ -8433,7 +6568,7 @@ snapshots:
 
   fast-fifo@1.3.2: {}
 
-  fast-glob@3.3.2:
+  fast-glob@3.3.3:
     dependencies:
       '@nodelib/fs.stat': 2.0.5
       '@nodelib/fs.walk': 1.2.8
@@ -8445,26 +6580,14 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-shuffle@6.1.1:
-    dependencies:
-      pcg: 1.1.0
-
-  fastq@1.17.1:
-    dependencies:
-      reusify: 1.0.4
-
-  fd-slicer@1.1.0:
+  fastq@1.19.1:
     dependencies:
-      pend: 1.2.0
+      reusify: 1.1.0
 
-  fdir@6.4.2(picomatch@4.0.2):
+  fdir@6.4.6(picomatch@4.0.2):
     optionalDependencies:
       picomatch: 4.0.2
 
-  figures@3.2.0:
-    dependencies:
-      escape-string-regexp: 1.0.5
-
   file-entry-cache@8.0.0:
     dependencies:
       flat-cache: 4.0.1
@@ -8475,54 +6598,10 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  filing-cabinet@5.0.2:
-    dependencies:
-      app-module-path: 2.2.0
-      commander: 12.1.0
-      enhanced-resolve: 5.17.1
-      module-definition: 6.0.0
-      module-lookup-amd: 9.0.2
-      resolve: 1.22.8
-      resolve-dependency-path: 4.0.0
-      sass-lookup: 6.0.1
-      stylus-lookup: 6.0.0
-      tsconfig-paths: 4.2.0
-      typescript: 5.7.2
-
   fill-range@7.1.1:
     dependencies:
       to-regex-range: 5.0.1
 
-  find-cypress-specs@1.46.2(@babel/core@7.26.0):
-    dependencies:
-      '@actions/core': 1.11.1
-      arg: 5.0.2
-      console.table: 0.10.0
-      debug: 4.4.0(supports-color@8.1.1)
-      find-test-names: 1.28.30(@babel/core@7.26.0)
-      globby: 11.1.0
-      minimatch: 3.1.2
-      pluralize: 8.0.0
-      require-and-forget: 1.0.1
-      shelljs: 0.8.5
-      spec-change: 1.11.11
-      tsx: 4.19.2
-    transitivePeerDependencies:
-      - '@babel/core'
-      - supports-color
-
-  find-test-names@1.28.30(@babel/core@7.26.0):
-    dependencies:
-      '@babel/parser': 7.26.2
-      '@babel/plugin-syntax-jsx': 7.25.9(@babel/core@7.26.0)
-      acorn-walk: 8.3.4
-      debug: 4.4.0(supports-color@8.1.1)
-      globby: 11.1.0
-      simple-bin-help: 1.8.0
-    transitivePeerDependencies:
-      - '@babel/core'
-      - supports-color
-
   find-up@5.0.0:
     dependencies:
       locate-path: 6.0.0
@@ -8530,14 +6609,14 @@ snapshots:
 
   flat-cache@4.0.1:
     dependencies:
-      flatted: 3.3.2
+      flatted: 3.3.3
       keyv: 4.5.4
 
   flat@5.0.2: {}
 
   flat@6.0.1: {}
 
-  flatted@3.3.2: {}
+  flatted@3.3.3: {}
 
   focus-trap@7.6.2:
     dependencies:
@@ -8545,44 +6624,21 @@ snapshots:
 
   font-awesome@4.7.0: {}
 
-  for-each@0.3.3:
+  for-each@0.3.5:
     dependencies:
       is-callable: 1.2.7
 
-  foreground-child@3.3.0:
+  foreground-child@3.3.1:
     dependencies:
       cross-spawn: 7.0.6
       signal-exit: 4.1.0
 
-  forever-agent@0.6.1: {}
-
-  form-data@4.0.1:
-    dependencies:
-      asynckit: 0.4.0
-      combined-stream: 1.0.8
-      mime-types: 2.1.35
-
-  fs-extra@11.2.0:
-    dependencies:
-      graceful-fs: 4.2.11
-      jsonfile: 6.1.0
-      universalify: 2.0.1
-
-  fs-extra@7.0.1:
-    dependencies:
-      graceful-fs: 4.2.11
-      jsonfile: 4.0.0
-      universalify: 0.1.2
-
-  fs-extra@9.1.0:
+  fs-extra@11.3.0:
     dependencies:
-      at-least-node: 1.0.0
       graceful-fs: 4.2.11
       jsonfile: 6.1.0
       universalify: 2.0.1
 
-  fs.realpath@1.0.0: {}
-
   fsevents@2.3.2:
     optional: true
 
@@ -8594,7 +6650,7 @@ snapshots:
   function.prototype.name@1.1.8:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
       hasown: 2.0.2
@@ -8604,53 +6660,38 @@ snapshots:
 
   gensync@1.0.0-beta.2: {}
 
-  get-amd-module-type@6.0.0:
-    dependencies:
-      ast-module-types: 6.0.0
-      node-source-walk: 7.0.0
-
   get-caller-file@2.0.5: {}
 
   get-east-asian-width@1.3.0: {}
 
-  get-intrinsic@1.2.6:
+  get-intrinsic@1.3.0:
     dependencies:
-      call-bind-apply-helpers: 1.0.1
-      dunder-proto: 1.0.1
+      call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
       function-bind: 1.1.2
+      get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
       hasown: 2.0.2
       math-intrinsics: 1.1.0
 
-  get-own-enumerable-property-symbols@3.0.2: {}
-
-  get-stream@5.2.0:
+  get-proto@1.0.1:
     dependencies:
-      pump: 3.0.2
-
-  get-stream@8.0.1: {}
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.1
 
   get-symbol-description@1.1.0:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
-      get-intrinsic: 1.2.6
+      get-intrinsic: 1.3.0
 
-  get-tsconfig@4.8.1:
+  get-tsconfig@4.10.1:
     dependencies:
       resolve-pkg-maps: 1.0.0
-
-  getos@3.2.1:
-    dependencies:
-      async: 3.2.6
-
-  getpass@0.1.7:
-    dependencies:
-      assert-plus: 1.0.0
+    optional: true
 
   glob-parent@5.1.2:
     dependencies:
@@ -8662,26 +6703,13 @@ snapshots:
 
   glob@10.4.5:
     dependencies:
-      foreground-child: 3.3.0
+      foreground-child: 3.3.1
       jackspeak: 3.4.3
       minimatch: 9.0.5
       minipass: 7.1.2
       package-json-from-dist: 1.0.1
       path-scurry: 1.11.1
 
-  glob@7.2.3:
-    dependencies:
-      fs.realpath: 1.0.0
-      inflight: 1.0.6
-      inherits: 2.0.4
-      minimatch: 3.1.2
-      once: 1.4.0
-      path-is-absolute: 1.0.1
-
-  global-dirs@3.0.1:
-    dependencies:
-      ini: 2.0.0
-
   globals@11.12.0: {}
 
   globals@13.24.0:
@@ -8690,36 +6718,17 @@ snapshots:
 
   globals@14.0.0: {}
 
-  globals@15.12.0: {}
-
   globalthis@1.0.4:
     dependencies:
       define-properties: 1.2.1
       gopd: 1.2.0
 
-  globby@11.1.0:
-    dependencies:
-      array-union: 2.1.0
-      dir-glob: 3.0.1
-      fast-glob: 3.3.2
-      ignore: 5.3.2
-      merge2: 1.4.1
-      slash: 3.0.0
-
-  gonzales-pe@4.3.0:
-    dependencies:
-      minimist: 1.2.8
-
   gopd@1.2.0: {}
 
   graceful-fs@4.2.11: {}
 
   graphemer@1.4.0: {}
 
-  graphlib@2.1.8:
-    dependencies:
-      lodash: 4.17.21
-
   gunzip-maybe@1.4.2:
     dependencies:
       browserify-zlib: 0.1.4
@@ -8729,7 +6738,7 @@ snapshots:
       pumpify: 1.5.1
       through2: 2.0.5
 
-  has-bigints@1.0.2: {}
+  has-bigints@1.1.0: {}
 
   has-flag@4.0.0: {}
 
@@ -8755,18 +6764,18 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       devlop: 1.1.0
-      hast-util-from-parse5: 8.0.2
-      parse5: 7.2.1
+      hast-util-from-parse5: 8.0.3
+      parse5: 7.3.0
       vfile: 6.0.3
       vfile-message: 4.0.2
 
-  hast-util-from-parse5@8.0.2:
+  hast-util-from-parse5@8.0.3:
     dependencies:
       '@types/hast': 3.0.4
       '@types/unist': 3.0.3
       devlop: 1.1.0
-      hastscript: 9.0.0
-      property-information: 6.5.0
+      hastscript: 9.0.1
+      property-information: 7.0.0
       vfile: 6.0.3
       vfile-location: 5.0.3
       web-namespaces: 2.0.1
@@ -8779,7 +6788,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
 
-  hast-util-to-html@9.0.3:
+  hast-util-to-html@9.0.5:
     dependencies:
       '@types/hast': 3.0.4
       '@types/unist': 3.0.3
@@ -8788,7 +6797,7 @@ snapshots:
       hast-util-whitespace: 3.0.0
       html-void-elements: 3.0.0
       mdast-util-to-hast: 13.2.0
-      property-information: 6.5.0
+      property-information: 7.0.0
       space-separated-tokens: 2.0.2
       stringify-entities: 4.0.4
       zwitch: 2.0.4
@@ -8809,12 +6818,12 @@ snapshots:
       property-information: 6.5.0
       space-separated-tokens: 2.0.2
 
-  hastscript@9.0.0:
+  hastscript@9.0.1:
     dependencies:
       '@types/hast': 3.0.4
       comma-separated-tokens: 2.0.3
       hast-util-parse-selector: 4.0.0
-      property-information: 6.5.0
+      property-information: 7.0.0
       space-separated-tokens: 2.0.2
 
   he@1.2.0: {}
@@ -8838,54 +6847,38 @@ snapshots:
   http-proxy-agent@7.0.2:
     dependencies:
       agent-base: 7.1.3
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
     transitivePeerDependencies:
       - supports-color
 
-  http-signature@1.4.0:
-    dependencies:
-      assert-plus: 1.0.0
-      jsprim: 2.0.2
-      sshpk: 1.18.0
-
   https-proxy-agent@7.0.6:
     dependencies:
       agent-base: 7.1.3
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
     transitivePeerDependencies:
       - supports-color
 
-  human-signals@1.1.1: {}
-
-  human-signals@5.0.0: {}
-
-  humanize-duration@3.32.1: {}
-
   husky@9.1.7: {}
 
-  i18next-http-backend@3.0.1:
-    dependencies:
-      cross-fetch: 4.0.0
-    transitivePeerDependencies:
-      - encoding
+  i18next-fetch-backend@6.0.0: {}
 
-  i18next@24.2.1(typescript@5.7.2):
+  i18next@25.3.1(typescript@5.8.3):
     dependencies:
-      '@babel/runtime': 7.26.0
+      '@babel/runtime': 7.27.6
     optionalDependencies:
-      typescript: 5.7.2
+      typescript: 5.8.3
 
   iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
 
-  ieee754@1.2.1: {}
-
   ignore@5.3.2: {}
 
+  ignore@7.0.5: {}
+
   immediate@3.0.6: {}
 
-  import-fresh@3.3.0:
+  import-fresh@3.3.1:
     dependencies:
       parent-module: 1.0.1
       resolve-from: 4.0.0
@@ -8896,23 +6889,14 @@ snapshots:
 
   indent-string@4.0.0: {}
 
-  inflight@1.0.6:
-    dependencies:
-      once: 1.4.0
-      wrappy: 1.0.2
-
   inherits@2.0.4: {}
 
-  ini@2.0.0: {}
-
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
       hasown: 2.0.2
       side-channel: 1.1.0
 
-  interpret@1.4.0: {}
-
   is-alphabetical@2.0.1: {}
 
   is-alphanumerical@2.0.1:
@@ -8920,49 +6904,48 @@ snapshots:
       is-alphabetical: 2.0.1
       is-decimal: 2.0.1
 
-  is-arguments@1.1.1:
-    dependencies:
-      call-bind: 1.0.8
-      has-tostringtag: 1.0.2
-
   is-array-buffer@3.0.5:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
-      get-intrinsic: 1.2.6
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
 
-  is-async-function@2.0.0:
+  is-async-function@2.1.1:
     dependencies:
+      async-function: 1.0.0
+      call-bound: 1.0.4
+      get-proto: 1.0.1
       has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
 
   is-bigint@1.1.0:
     dependencies:
-      has-bigints: 1.0.2
+      has-bigints: 1.1.0
 
   is-binary-path@2.1.0:
     dependencies:
       binary-extensions: 2.3.0
 
-  is-boolean-object@1.2.1:
+  is-boolean-object@1.2.2:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       has-tostringtag: 1.0.2
 
   is-callable@1.2.7: {}
 
-  is-core-module@2.15.1:
+  is-core-module@2.16.1:
     dependencies:
       hasown: 2.0.2
 
   is-data-view@1.0.2:
     dependencies:
-      call-bound: 1.0.3
-      get-intrinsic: 1.2.6
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
       is-typed-array: 1.1.15
 
   is-date-object@1.1.0:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       has-tostringtag: 1.0.2
 
   is-decimal@2.0.1: {}
@@ -8971,9 +6954,9 @@ snapshots:
 
   is-extglob@2.1.1: {}
 
-  is-finalizationregistry@1.1.0:
+  is-finalizationregistry@1.1.1:
     dependencies:
-      call-bind: 1.0.8
+      call-bound: 1.0.4
 
   is-fullwidth-code-point@3.0.0: {}
 
@@ -8983,9 +6966,12 @@ snapshots:
     dependencies:
       get-east-asian-width: 1.3.0
 
-  is-generator-function@1.0.10:
+  is-generator-function@1.1.0:
     dependencies:
+      call-bound: 1.0.4
+      get-proto: 1.0.1
       has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
 
   is-glob@4.0.3:
     dependencies:
@@ -8995,26 +6981,17 @@ snapshots:
 
   is-hexadecimal@2.0.1: {}
 
-  is-installed-globally@0.4.0:
-    dependencies:
-      global-dirs: 3.0.1
-      is-path-inside: 3.0.3
-
   is-map@2.0.3: {}
 
   is-module@1.0.0: {}
 
   is-number-object@1.1.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       has-tostringtag: 1.0.2
 
   is-number@7.0.0: {}
 
-  is-obj@1.0.1: {}
-
-  is-path-inside@3.0.3: {}
-
   is-plain-obj@2.1.0: {}
 
   is-plain-obj@4.1.0: {}
@@ -9023,60 +7000,48 @@ snapshots:
 
   is-reference@1.2.1:
     dependencies:
-      '@types/estree': 1.0.6
+      '@types/estree': 1.0.8
 
   is-regex@1.2.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
       hasown: 2.0.2
 
-  is-regexp@1.0.0: {}
-
   is-set@2.0.3: {}
 
   is-shared-array-buffer@1.0.4:
     dependencies:
-      call-bound: 1.0.3
-
-  is-stream@2.0.1: {}
-
-  is-stream@3.0.0: {}
+      call-bound: 1.0.4
 
   is-string@1.1.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       has-tostringtag: 1.0.2
 
   is-symbol@1.1.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       has-symbols: 1.1.0
       safe-regex-test: 1.1.0
 
   is-typed-array@1.1.15:
     dependencies:
-      which-typed-array: 1.1.18
-
-  is-typedarray@1.0.0: {}
+      which-typed-array: 1.1.19
 
   is-unicode-supported@0.1.0: {}
 
-  is-url-superb@4.0.0: {}
-
-  is-url@1.2.4: {}
-
   is-weakmap@2.0.2: {}
 
-  is-weakref@1.1.0:
+  is-weakref@1.1.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
 
-  is-weakset@2.0.3:
+  is-weakset@2.0.4:
     dependencies:
-      call-bind: 1.0.8
-      get-intrinsic: 1.2.6
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
 
   isarray@1.0.0: {}
 
@@ -9084,15 +7049,13 @@ snapshots:
 
   isexe@2.0.0: {}
 
-  isstream@0.1.2: {}
-
-  iterator.prototype@1.1.4:
+  iterator.prototype@1.1.5:
     dependencies:
       define-data-property: 1.1.4
-      es-object-atoms: 1.0.0
-      get-intrinsic: 1.2.6
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
       has-symbols: 1.1.0
-      reflect.getprototypeof: 1.0.9
       set-function-name: 2.0.2
 
   jackspeak@3.4.3:
@@ -9107,41 +7070,40 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
+  js-tokens@9.0.1: {}
+
   js-yaml@4.1.0:
     dependencies:
       argparse: 2.0.1
 
-  jsbn@0.1.1: {}
-
-  jsdom@26.0.0:
+  jsdom@26.1.0:
     dependencies:
-      cssstyle: 4.2.1
+      cssstyle: 4.3.0
       data-urls: 5.0.0
-      decimal.js: 10.4.3
-      form-data: 4.0.1
+      decimal.js: 10.5.0
       html-encoding-sniffer: 4.0.0
       http-proxy-agent: 7.0.2
       https-proxy-agent: 7.0.6
       is-potential-custom-element-name: 1.0.1
-      nwsapi: 2.2.16
+      nwsapi: 2.2.20
       parse5: 7.2.1
       rrweb-cssom: 0.8.0
       saxes: 6.0.0
       symbol-tree: 3.2.4
-      tough-cookie: 5.0.0
+      tough-cookie: 5.1.2
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 7.0.0
       whatwg-encoding: 3.1.1
       whatwg-mimetype: 4.0.0
-      whatwg-url: 14.1.0
-      ws: 8.18.0
+      whatwg-url: 14.2.0
+      ws: 8.18.1
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - bufferutil
       - supports-color
       - utf-8-validate
 
-  jsesc@3.0.2: {}
+  jsesc@3.1.0: {}
 
   json-buffer@3.0.1: {}
 
@@ -9149,37 +7111,22 @@ snapshots:
 
   json-schema-traverse@1.0.0: {}
 
-  json-schema@0.4.0: {}
-
   json-stable-stringify-without-jsonify@1.0.1: {}
 
-  json-stringify-safe@5.0.1: {}
-
   json5@2.2.3: {}
 
   jsonc-parser@3.3.1: {}
 
-  jsonfile@4.0.0:
-    optionalDependencies:
-      graceful-fs: 4.2.11
-
   jsonfile@6.1.0:
     dependencies:
       universalify: 2.0.1
     optionalDependencies:
       graceful-fs: 4.2.11
 
-  jsprim@2.0.2:
-    dependencies:
-      assert-plus: 1.0.0
-      extsprintf: 1.3.0
-      json-schema: 0.4.0
-      verror: 1.10.0
-
   jsx-ast-utils@3.3.5:
     dependencies:
       array-includes: 3.1.8
-      array.prototype.flat: 1.3.2
+      array.prototype.flat: 1.3.3
       object.assign: 4.1.7
       object.values: 1.2.1
 
@@ -9190,36 +7137,14 @@ snapshots:
       readable-stream: 2.3.8
       setimmediate: 1.0.5
 
+  keycloak-js@26.2.0: {}
+
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
 
   kolorist@1.8.0: {}
 
-  lazy-ass@1.6.0: {}
-
-  lazy-ass@2.0.3: {}
-
-  ldap-filter@0.3.3:
-    dependencies:
-      assert-plus: 1.0.0
-
-  ldap-server-mock@6.0.1:
-    dependencies:
-      ldapjs: 2.3.3
-      tslib: 2.8.1
-
-  ldapjs@2.3.3:
-    dependencies:
-      abstract-logging: 2.0.1
-      asn1: 0.2.6
-      assert-plus: 1.0.0
-      backoff: 2.5.0
-      ldap-filter: 0.3.3
-      once: 1.4.0
-      vasync: 2.2.1
-      verror: 1.10.1
-
   levn@0.4.1:
     dependencies:
       prelude-ls: 1.2.1
@@ -9229,82 +7154,69 @@ snapshots:
     dependencies:
       immediate: 3.0.6
 
-  lightningcss-darwin-arm64@1.28.2:
+  lightningcss-darwin-arm64@1.30.1:
     optional: true
 
-  lightningcss-darwin-x64@1.28.2:
+  lightningcss-darwin-x64@1.30.1:
     optional: true
 
-  lightningcss-freebsd-x64@1.28.2:
+  lightningcss-freebsd-x64@1.30.1:
     optional: true
 
-  lightningcss-linux-arm-gnueabihf@1.28.2:
+  lightningcss-linux-arm-gnueabihf@1.30.1:
     optional: true
 
-  lightningcss-linux-arm64-gnu@1.28.2:
+  lightningcss-linux-arm64-gnu@1.30.1:
     optional: true
 
-  lightningcss-linux-arm64-musl@1.28.2:
+  lightningcss-linux-arm64-musl@1.30.1:
     optional: true
 
-  lightningcss-linux-x64-gnu@1.28.2:
+  lightningcss-linux-x64-gnu@1.30.1:
     optional: true
 
-  lightningcss-linux-x64-musl@1.28.2:
+  lightningcss-linux-x64-musl@1.30.1:
     optional: true
 
-  lightningcss-win32-arm64-msvc@1.28.2:
+  lightningcss-win32-arm64-msvc@1.30.1:
     optional: true
 
-  lightningcss-win32-x64-msvc@1.28.2:
+  lightningcss-win32-x64-msvc@1.30.1:
     optional: true
 
-  lightningcss@1.28.2:
+  lightningcss@1.30.1:
     dependencies:
-      detect-libc: 1.0.3
+      detect-libc: 2.0.4
     optionalDependencies:
-      lightningcss-darwin-arm64: 1.28.2
-      lightningcss-darwin-x64: 1.28.2
-      lightningcss-freebsd-x64: 1.28.2
-      lightningcss-linux-arm-gnueabihf: 1.28.2
-      lightningcss-linux-arm64-gnu: 1.28.2
-      lightningcss-linux-arm64-musl: 1.28.2
-      lightningcss-linux-x64-gnu: 1.28.2
-      lightningcss-linux-x64-musl: 1.28.2
-      lightningcss-win32-arm64-msvc: 1.28.2
-      lightningcss-win32-x64-msvc: 1.28.2
+      lightningcss-darwin-arm64: 1.30.1
+      lightningcss-darwin-x64: 1.30.1
+      lightningcss-freebsd-x64: 1.30.1
+      lightningcss-linux-arm-gnueabihf: 1.30.1
+      lightningcss-linux-arm64-gnu: 1.30.1
+      lightningcss-linux-arm64-musl: 1.30.1
+      lightningcss-linux-x64-gnu: 1.30.1
+      lightningcss-linux-x64-musl: 1.30.1
+      lightningcss-win32-arm64-msvc: 1.30.1
+      lightningcss-win32-x64-msvc: 1.30.1
 
   lilconfig@3.1.3: {}
 
-  lint-staged@15.3.0:
+  lint-staged@16.1.2:
     dependencies:
       chalk: 5.4.1
-      commander: 12.1.0
-      debug: 4.4.0(supports-color@8.1.1)
-      execa: 8.0.1
+      commander: 14.0.0
+      debug: 4.4.1(supports-color@8.1.1)
       lilconfig: 3.1.3
-      listr2: 8.2.5
+      listr2: 8.3.3
       micromatch: 4.0.8
+      nano-spawn: 1.0.2
       pidtree: 0.6.0
       string-argv: 0.3.2
-      yaml: 2.6.1
+      yaml: 2.8.0
     transitivePeerDependencies:
       - supports-color
 
-  listr2@3.14.0(enquirer@2.4.1):
-    dependencies:
-      cli-truncate: 2.1.0
-      colorette: 2.0.20
-      log-update: 4.0.0
-      p-map: 4.0.0
-      rfdc: 1.4.1
-      rxjs: 7.8.1
-      through: 2.3.8
-      wrap-ansi: 7.0.0
-    optionalDependencies:
-      enquirer: 2.4.1
-
-  listr2@8.2.5:
+  listr2@8.3.3:
     dependencies:
       cli-truncate: 4.0.0
       colorette: 2.0.20
@@ -9313,10 +7225,11 @@ snapshots:
       rfdc: 1.4.1
       wrap-ansi: 9.0.0
 
-  local-pkg@0.5.1:
+  local-pkg@1.1.1:
     dependencies:
-      mlly: 1.7.3
-      pkg-types: 1.2.1
+      mlly: 1.7.4
+      pkg-types: 2.1.0
+      quansync: 0.2.10
 
   locate-path@6.0.0:
     dependencies:
@@ -9326,8 +7239,6 @@ snapshots:
 
   lodash.merge@4.6.2: {}
 
-  lodash.once@4.1.1: {}
-
   lodash@4.17.21: {}
 
   log-symbols@4.1.0:
@@ -9335,13 +7246,6 @@ snapshots:
       chalk: 4.1.2
       is-unicode-supported: 0.1.0
 
-  log-update@4.0.0:
-    dependencies:
-      ansi-escapes: 4.3.2
-      cli-cursor: 3.1.0
-      slice-ansi: 4.0.0
-      wrap-ansi: 6.2.0
-
   log-update@6.1.0:
     dependencies:
       ansi-escapes: 7.0.0
@@ -9350,17 +7254,15 @@ snapshots:
       strip-ansi: 7.1.0
       wrap-ansi: 9.0.0
 
-  long@5.2.3: {}
-
   loose-envify@1.4.0:
     dependencies:
       js-tokens: 4.0.0
 
-  loupe@3.1.2: {}
+  loupe@3.1.3: {}
 
-  lru-cache@10.4.3: {}
+  loupe@3.1.4: {}
 
-  lru-cache@11.0.2: {}
+  lru-cache@10.4.3: {}
 
   lru-cache@5.1.1:
     dependencies:
@@ -9372,10 +7274,6 @@ snapshots:
 
   lz-string@1.5.0: {}
 
-  magic-string@0.30.14:
-    dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.0
-
   magic-string@0.30.17:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.0
@@ -9388,7 +7286,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@ungap/structured-clone': 1.2.0
+      '@ungap/structured-clone': 1.3.0
       devlop: 1.1.0
       micromark-util-sanitize-uri: 2.0.1
       trim-lines: 3.0.1
@@ -9396,14 +7294,12 @@ snapshots:
       unist-util-visit: 5.0.0
       vfile: 6.0.3
 
-  merge-stream@2.0.0: {}
-
   merge2@1.4.1: {}
 
   micromark-util-character@2.1.1:
     dependencies:
       micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.1
+      micromark-util-types: 2.0.2
 
   micromark-util-encode@2.0.1: {}
 
@@ -9415,23 +7311,13 @@ snapshots:
 
   micromark-util-symbol@2.0.1: {}
 
-  micromark-util-types@2.0.1: {}
+  micromark-util-types@2.0.2: {}
 
   micromatch@4.0.8:
     dependencies:
       braces: 3.0.3
       picomatch: 2.3.1
 
-  mime-db@1.52.0: {}
-
-  mime-types@2.1.35:
-    dependencies:
-      mime-db: 1.52.0
-
-  mimic-fn@2.1.0: {}
-
-  mimic-fn@4.0.0: {}
-
   mimic-function@5.0.1: {}
 
   min-indent@1.0.1: {}
@@ -9442,148 +7328,107 @@ snapshots:
 
   minimatch@3.1.2:
     dependencies:
-      brace-expansion: 1.1.11
-
-  minimatch@5.1.6:
-    dependencies:
-      brace-expansion: 2.0.1
+      brace-expansion: 1.1.12
 
   minimatch@9.0.5:
     dependencies:
-      brace-expansion: 2.0.1
-
-  minimist@1.2.8: {}
+      brace-expansion: 2.0.2
 
   minipass@7.1.2: {}
 
-  mlly@1.7.3:
+  mlly@1.7.4:
     dependencies:
-      acorn: 8.14.0
-      pathe: 1.1.2
-      pkg-types: 1.2.1
-      ufo: 1.5.4
+      acorn: 8.14.1
+      pathe: 2.0.3
+      pkg-types: 1.3.1
+      ufo: 1.6.1
 
-  mocha@11.0.1:
+  mocha@11.7.1:
     dependencies:
-      ansi-colors: 4.1.3
       browser-stdout: 1.3.1
-      chokidar: 3.6.0
-      debug: 4.3.7(supports-color@8.1.1)
-      diff: 5.2.0
+      chokidar: 4.0.3
+      debug: 4.4.1(supports-color@8.1.1)
+      diff: 7.0.0
       escape-string-regexp: 4.0.0
       find-up: 5.0.0
       glob: 10.4.5
       he: 1.2.0
       js-yaml: 4.1.0
       log-symbols: 4.1.0
-      minimatch: 5.1.6
+      minimatch: 9.0.5
       ms: 2.1.3
+      picocolors: 1.1.1
       serialize-javascript: 6.0.2
       strip-json-comments: 3.1.1
       supports-color: 8.1.1
-      workerpool: 6.5.1
-      yargs: 16.2.0
-      yargs-parser: 20.2.9
+      workerpool: 9.3.2
+      yargs: 17.7.2
+      yargs-parser: 21.1.1
       yargs-unparser: 2.0.0
 
-  module-definition@6.0.0:
-    dependencies:
-      ast-module-types: 6.0.0
-      node-source-walk: 7.0.0
-
-  module-lookup-amd@9.0.2:
-    dependencies:
-      commander: 12.1.0
-      glob: 7.2.3
-      requirejs: 2.3.7
-      requirejs-config-file: 4.0.0
-
-  ms@2.1.2: {}
-
   ms@2.1.3: {}
 
   muggle-string@0.4.1: {}
 
   mustache@4.2.0: {}
 
-  nanoid@3.3.8: {}
-
-  natural-compare@1.4.0: {}
+  nano-spawn@1.0.2: {}
 
-  node-fetch@2.7.0:
-    dependencies:
-      whatwg-url: 5.0.0
+  nanoid@3.3.11: {}
 
-  node-releases@2.0.18: {}
+  natural-compare@1.4.0: {}
 
-  node-source-walk@7.0.0:
-    dependencies:
-      '@babel/parser': 7.26.2
+  node-releases@2.0.19: {}
 
   normalize-path@3.0.0: {}
 
-  npm-run-path@4.0.1:
-    dependencies:
-      path-key: 3.1.1
-
-  npm-run-path@5.3.0:
+  npm-run-path@6.0.0:
     dependencies:
       path-key: 4.0.0
+      unicorn-magic: 0.3.0
 
-  nwsapi@2.2.16: {}
+  nwsapi@2.2.20: {}
 
   object-assign@4.1.1: {}
 
-  object-inspect@1.13.3: {}
-
-  object-is@1.1.6:
-    dependencies:
-      call-bind: 1.0.8
-      define-properties: 1.2.1
+  object-inspect@1.13.4: {}
 
   object-keys@1.1.1: {}
 
   object.assign@4.1.7:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
       has-symbols: 1.1.0
       object-keys: 1.1.1
 
-  object.entries@1.1.8:
+  object.entries@1.1.9:
     dependencies:
       call-bind: 1.0.8
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
 
   object.fromentries@2.0.8:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-object-atoms: 1.0.0
+      es-abstract: 1.23.9
+      es-object-atoms: 1.1.1
 
   object.values@1.2.1:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
 
   once@1.4.0:
     dependencies:
       wrappy: 1.0.2
 
-  onetime@5.1.2:
-    dependencies:
-      mimic-fn: 2.1.0
-
-  onetime@6.0.0:
-    dependencies:
-      mimic-fn: 4.0.0
-
   onetime@7.0.0:
     dependencies:
       mimic-function: 5.0.1
@@ -9597,7 +7442,11 @@ snapshots:
       type-check: 0.4.0
       word-wrap: 1.2.5
 
-  ospath@1.2.2: {}
+  own-keys@1.0.1:
+    dependencies:
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
 
   p-debounce@4.0.0: {}
 
@@ -9609,10 +7458,6 @@ snapshots:
     dependencies:
       p-limit: 3.1.0
 
-  p-map@4.0.0:
-    dependencies:
-      aggregate-error: 3.1.0
-
   package-json-from-dist@1.0.1: {}
 
   pako@0.2.9: {}
@@ -9623,13 +7468,12 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
-  parse-entities@4.0.1:
+  parse-entities@4.0.2:
     dependencies:
       '@types/unist': 2.0.11
-      character-entities: 2.0.2
       character-entities-legacy: 3.0.0
       character-reference-invalid: 2.0.1
-      decode-named-character-reference: 1.0.2
+      decode-named-character-reference: 1.1.0
       is-alphanumerical: 2.0.1
       is-decimal: 2.0.1
       is-hexadecimal: 2.0.1
@@ -9640,12 +7484,14 @@ snapshots:
     dependencies:
       entities: 4.5.0
 
+  parse5@7.3.0:
+    dependencies:
+      entities: 6.0.0
+
   path-browserify@1.0.1: {}
 
   path-exists@4.0.0: {}
 
-  path-is-absolute@1.0.1: {}
-
   path-key@3.1.1: {}
 
   path-key@4.0.0: {}
@@ -9657,9 +7503,7 @@ snapshots:
       lru-cache: 10.4.3
       minipass: 7.1.2
 
-  path-type@4.0.0: {}
-
-  pathe@1.1.2: {}
+  pathe@2.0.3: {}
 
   pathval@2.0.0: {}
 
@@ -9669,21 +7513,12 @@ snapshots:
       font-awesome: 4.7.0
       jquery: 3.4.1
 
-  pcg@1.1.0:
-    dependencies:
-      long: 5.2.3
-      ramda: 0.29.1
-
   peek-stream@1.1.3:
     dependencies:
       buffer-from: 1.1.2
       duplexify: 3.7.1
       through2: 2.0.5
 
-  pend@1.2.0: {}
-
-  performance-now@2.1.0: {}
-
   picocolors@1.1.1: {}
 
   picomatch@2.3.1: {}
@@ -9692,70 +7527,41 @@ snapshots:
 
   pidtree@0.6.0: {}
 
-  pify@2.3.0: {}
-
-  pkg-types@1.2.1:
+  pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
-      mlly: 1.7.3
-      pathe: 1.1.2
+      mlly: 1.7.4
+      pathe: 2.0.3
+
+  pkg-types@2.1.0:
+    dependencies:
+      confbox: 0.2.2
+      exsolve: 1.0.5
+      pathe: 2.0.3
 
-  playwright-core@1.49.1: {}
+  playwright-core@1.53.2: {}
 
-  playwright@1.49.1:
+  playwright@1.53.2:
     dependencies:
-      playwright-core: 1.49.1
+      playwright-core: 1.53.2
     optionalDependencies:
       fsevents: 2.3.2
 
-  pluralize@8.0.0: {}
-
-  possible-typed-array-names@1.0.0: {}
-
-  postcss-values-parser@6.0.2(postcss@8.4.49):
-    dependencies:
-      color-name: 1.1.4
-      is-url-superb: 4.0.0
-      postcss: 8.4.49
-      quote-unquote: 1.0.0
+  possible-typed-array-names@1.1.0: {}
 
-  postcss@8.4.49:
+  postcss@8.5.6:
     dependencies:
-      nanoid: 3.3.8
+      nanoid: 3.3.11
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  precinct@12.1.2:
-    dependencies:
-      '@dependents/detective-less': 5.0.0
-      commander: 12.1.0
-      detective-amd: 6.0.0
-      detective-cjs: 6.0.0
-      detective-es6: 5.0.0
-      detective-postcss: 7.0.0(postcss@8.4.49)
-      detective-sass: 6.0.0
-      detective-scss: 5.0.0
-      detective-stylus: 5.0.0
-      detective-typescript: 13.0.0(typescript@5.7.2)
-      detective-vue2: 2.1.0(typescript@5.7.2)
-      module-definition: 6.0.0
-      node-source-walk: 7.0.0
-      postcss: 8.4.49
-      typescript: 5.7.2
-    transitivePeerDependencies:
-      - supports-color
-
-  precond@0.2.3: {}
-
   prelude-ls@1.2.1: {}
 
   prettier-linter-helpers@1.0.0:
     dependencies:
       fast-diff: 1.3.0
 
-  prettier@3.4.2: {}
-
-  pretty-bytes@5.6.0: {}
+  prettier@3.6.2: {}
 
   pretty-format@27.5.1:
     dependencies:
@@ -9765,8 +7571,6 @@ snapshots:
 
   process-nextick-args@2.0.1: {}
 
-  process@0.11.10: {}
-
   prop-types@15.8.1:
     dependencies:
       loose-envify: 1.4.0
@@ -9779,18 +7583,20 @@ snapshots:
       retry: 0.12.0
       signal-exit: 3.0.7
 
+  properties-file@3.5.12: {}
+
   property-information@6.5.0: {}
 
-  proxy-from-env@1.0.0: {}
+  property-information@7.0.0: {}
 
   pump@2.0.1:
     dependencies:
-      end-of-stream: 1.4.4
+      end-of-stream: 1.4.5
       once: 1.4.0
 
-  pump@3.0.2:
+  pump@3.0.3:
     dependencies:
-      end-of-stream: 1.4.4
+      end-of-stream: 1.4.5
       once: 1.4.0
 
   pumpify@1.5.1:
@@ -9801,20 +7607,10 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qs@6.13.0:
-    dependencies:
-      side-channel: 1.1.0
+  quansync@0.2.10: {}
 
   queue-microtask@1.2.3: {}
 
-  queue-tick@1.0.1: {}
-
-  quote-unquote@1.0.0: {}
-
-  rambda@7.5.0: {}
-
-  ramda@0.29.1: {}
-
   randombytes@2.1.0:
     dependencies:
       safe-buffer: 5.2.1
@@ -9825,54 +7621,55 @@ snapshots:
       react: 18.3.1
       scheduler: 0.23.2
 
-  react-dropzone@14.3.5(react@18.3.1):
+  react-dropzone@14.3.8(react@18.3.1):
     dependencies:
       attr-accept: 2.2.5
       file-selector: 2.1.2
       prop-types: 15.8.1
       react: 18.3.1
 
-  react-hook-form@7.54.2(react@18.3.1):
+  react-hook-form@7.60.0(react@18.3.1):
     dependencies:
       react: 18.3.1
 
-  react-i18next@15.4.0(i18next@24.2.1(typescript@5.7.2))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+  react-i18next@15.5.3(i18next@25.3.1(typescript@5.8.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.8.3):
     dependencies:
-      '@babel/runtime': 7.26.0
+      '@babel/runtime': 7.27.6
       html-parse-stringify: 3.0.1
-      i18next: 24.2.1(typescript@5.7.2)
+      i18next: 25.3.1(typescript@5.8.3)
       react: 18.3.1
     optionalDependencies:
       react-dom: 18.3.1(react@18.3.1)
+      typescript: 5.8.3
 
   react-is@16.13.1: {}
 
   react-is@17.0.2: {}
 
-  react-router-dom@6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+  react-router-dom@6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
     dependencies:
-      '@remix-run/router': 1.21.0
+      '@remix-run/router': 1.23.0
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      react-router: 6.28.1(react@18.3.1)
+      react-router: 6.30.1(react@18.3.1)
 
-  react-router@6.28.1(react@18.3.1):
+  react-router@6.30.1(react@18.3.1):
     dependencies:
-      '@remix-run/router': 1.21.0
+      '@remix-run/router': 1.23.0
       react: 18.3.1
 
   react@18.3.1:
     dependencies:
       loose-envify: 1.4.0
 
-  reactflow@11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+  reactflow@11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
     dependencies:
-      '@reactflow/background': 11.3.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@reactflow/controls': 11.2.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@reactflow/core': 11.11.4(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@reactflow/minimap': 11.7.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@reactflow/node-resizer': 2.2.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@reactflow/node-toolbar': 1.3.14(@types/react@18.3.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/background': 11.3.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/controls': 11.2.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/core': 11.11.4(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/minimap': 11.7.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/node-resizer': 2.2.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@reactflow/node-toolbar': 1.3.14(@types/react@18.3.18)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
     transitivePeerDependencies:
@@ -9893,40 +7690,40 @@ snapshots:
     dependencies:
       picomatch: 2.3.1
 
-  rechoir@0.6.2:
-    dependencies:
-      resolve: 1.22.8
+  readdirp@4.1.2: {}
 
   redent@3.0.0:
     dependencies:
       indent-string: 4.0.0
       strip-indent: 3.0.0
 
-  reflect.getprototypeof@1.0.9:
+  reflect.getprototypeof@1.0.10:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      dunder-proto: 1.0.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
       es-errors: 1.3.0
-      get-intrinsic: 1.2.6
-      gopd: 1.2.0
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
       which-builtin-type: 1.2.1
 
-  refractor@4.8.1:
+  refractor@4.9.0:
     dependencies:
       '@types/hast': 2.3.10
       '@types/prismjs': 1.26.5
       hastscript: 7.2.0
-      parse-entities: 4.0.1
+      parse-entities: 4.0.2
 
   regenerator-runtime@0.14.1: {}
 
-  regexp.prototype.flags@1.5.3:
+  regexp.prototype.flags@1.5.4:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
       es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
       set-function-name: 2.0.2
 
   rehype-parse@9.0.1:
@@ -9939,7 +7736,7 @@ snapshots:
     dependencies:
       hast-util-to-string: 3.0.1
       parse-numeric-range: 1.3.0
-      refractor: 4.8.1
+      refractor: 4.9.0
       rehype-parse: 9.0.1
       unist-util-filter: 5.0.1
       unist-util-visit: 5.0.0
@@ -9947,7 +7744,7 @@ snapshots:
   rehype-stringify@10.0.1:
     dependencies:
       '@types/hast': 3.0.4
-      hast-util-to-html: 9.0.3
+      hast-util-to-html: 9.0.5
       unified: 11.0.5
 
   rehype@13.0.2:
@@ -9957,50 +7754,27 @@ snapshots:
       rehype-stringify: 10.0.1
       unified: 11.0.5
 
-  request-progress@3.0.0:
-    dependencies:
-      throttleit: 1.0.1
-
-  require-and-forget@1.0.1:
-    dependencies:
-      debug: 4.3.4
-    transitivePeerDependencies:
-      - supports-color
-
   require-directory@2.1.1: {}
 
   require-from-string@2.0.2: {}
 
-  requirejs-config-file@4.0.0:
-    dependencies:
-      esprima: 4.0.1
-      stringify-object: 3.3.0
-
-  requirejs@2.3.7: {}
-
-  resolve-dependency-path@4.0.0: {}
-
   resolve-from@4.0.0: {}
 
-  resolve-pkg-maps@1.0.0: {}
+  resolve-pkg-maps@1.0.0:
+    optional: true
 
-  resolve@1.22.8:
+  resolve@1.22.10:
     dependencies:
-      is-core-module: 2.15.1
+      is-core-module: 2.16.1
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
   resolve@2.0.0-next.5:
     dependencies:
-      is-core-module: 2.15.1
+      is-core-module: 2.16.1
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
-  restore-cursor@3.1.0:
-    dependencies:
-      onetime: 5.1.2
-      signal-exit: 3.0.7
-
   restore-cursor@5.1.0:
     dependencies:
       onetime: 7.0.0
@@ -10008,64 +7782,40 @@ snapshots:
 
   retry@0.12.0: {}
 
-  reusify@1.0.4: {}
+  reusify@1.1.0: {}
 
   rfc4648@1.5.4: {}
 
   rfdc@1.4.1: {}
 
-  rollup-plugin-peer-deps-external@2.2.4(rollup@4.30.1):
-    dependencies:
-      rollup: 4.30.1
-
-  rollup@4.30.0:
+  rollup-plugin-peer-deps-external@2.2.4(rollup@4.44.2):
     dependencies:
-      '@types/estree': 1.0.6
-    optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.30.0
-      '@rollup/rollup-android-arm64': 4.30.0
-      '@rollup/rollup-darwin-arm64': 4.30.0
-      '@rollup/rollup-darwin-x64': 4.30.0
-      '@rollup/rollup-freebsd-arm64': 4.30.0
-      '@rollup/rollup-freebsd-x64': 4.30.0
-      '@rollup/rollup-linux-arm-gnueabihf': 4.30.0
-      '@rollup/rollup-linux-arm-musleabihf': 4.30.0
-      '@rollup/rollup-linux-arm64-gnu': 4.30.0
-      '@rollup/rollup-linux-arm64-musl': 4.30.0
-      '@rollup/rollup-linux-loongarch64-gnu': 4.30.0
-      '@rollup/rollup-linux-powerpc64le-gnu': 4.30.0
-      '@rollup/rollup-linux-riscv64-gnu': 4.30.0
-      '@rollup/rollup-linux-s390x-gnu': 4.30.0
-      '@rollup/rollup-linux-x64-gnu': 4.30.0
-      '@rollup/rollup-linux-x64-musl': 4.30.0
-      '@rollup/rollup-win32-arm64-msvc': 4.30.0
-      '@rollup/rollup-win32-ia32-msvc': 4.30.0
-      '@rollup/rollup-win32-x64-msvc': 4.30.0
-      fsevents: 2.3.3
+      rollup: 4.44.2
 
-  rollup@4.30.1:
+  rollup@4.44.2:
     dependencies:
-      '@types/estree': 1.0.6
+      '@types/estree': 1.0.8
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.30.1
-      '@rollup/rollup-android-arm64': 4.30.1
-      '@rollup/rollup-darwin-arm64': 4.30.1
-      '@rollup/rollup-darwin-x64': 4.30.1
-      '@rollup/rollup-freebsd-arm64': 4.30.1
-      '@rollup/rollup-freebsd-x64': 4.30.1
-      '@rollup/rollup-linux-arm-gnueabihf': 4.30.1
-      '@rollup/rollup-linux-arm-musleabihf': 4.30.1
-      '@rollup/rollup-linux-arm64-gnu': 4.30.1
-      '@rollup/rollup-linux-arm64-musl': 4.30.1
-      '@rollup/rollup-linux-loongarch64-gnu': 4.30.1
-      '@rollup/rollup-linux-powerpc64le-gnu': 4.30.1
-      '@rollup/rollup-linux-riscv64-gnu': 4.30.1
-      '@rollup/rollup-linux-s390x-gnu': 4.30.1
-      '@rollup/rollup-linux-x64-gnu': 4.30.1
-      '@rollup/rollup-linux-x64-musl': 4.30.1
-      '@rollup/rollup-win32-arm64-msvc': 4.30.1
-      '@rollup/rollup-win32-ia32-msvc': 4.30.1
-      '@rollup/rollup-win32-x64-msvc': 4.30.1
+      '@rollup/rollup-android-arm-eabi': 4.44.2
+      '@rollup/rollup-android-arm64': 4.44.2
+      '@rollup/rollup-darwin-arm64': 4.44.2
+      '@rollup/rollup-darwin-x64': 4.44.2
+      '@rollup/rollup-freebsd-arm64': 4.44.2
+      '@rollup/rollup-freebsd-x64': 4.44.2
+      '@rollup/rollup-linux-arm-gnueabihf': 4.44.2
+      '@rollup/rollup-linux-arm-musleabihf': 4.44.2
+      '@rollup/rollup-linux-arm64-gnu': 4.44.2
+      '@rollup/rollup-linux-arm64-musl': 4.44.2
+      '@rollup/rollup-linux-loongarch64-gnu': 4.44.2
+      '@rollup/rollup-linux-powerpc64le-gnu': 4.44.2
+      '@rollup/rollup-linux-riscv64-gnu': 4.44.2
+      '@rollup/rollup-linux-riscv64-musl': 4.44.2
+      '@rollup/rollup-linux-s390x-gnu': 4.44.2
+      '@rollup/rollup-linux-x64-gnu': 4.44.2
+      '@rollup/rollup-linux-x64-musl': 4.44.2
+      '@rollup/rollup-win32-arm64-msvc': 4.44.2
+      '@rollup/rollup-win32-ia32-msvc': 4.44.2
+      '@rollup/rollup-win32-x64-msvc': 4.44.2
       fsevents: 2.3.3
 
   rrweb-cssom@0.8.0: {}
@@ -10074,15 +7824,11 @@ snapshots:
     dependencies:
       queue-microtask: 1.2.3
 
-  rxjs@7.8.1:
-    dependencies:
-      tslib: 2.8.1
-
   safe-array-concat@1.1.3:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
-      get-intrinsic: 1.2.6
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
       has-symbols: 1.1.0
       isarray: 2.0.5
 
@@ -10090,18 +7836,19 @@ snapshots:
 
   safe-buffer@5.2.1: {}
 
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
   safe-regex-test@1.1.0:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
       is-regex: 1.2.1
 
   safer-buffer@2.1.2: {}
 
-  sass-lookup@6.0.1:
-    dependencies:
-      commander: 12.1.0
-
   saxes@6.0.0:
     dependencies:
       xmlchars: 2.2.0
@@ -10116,7 +7863,7 @@ snapshots:
     dependencies:
       lru-cache: 6.0.0
 
-  semver@7.6.3: {}
+  semver@7.7.2: {}
 
   serialize-javascript@6.0.2:
     dependencies:
@@ -10127,7 +7874,7 @@ snapshots:
       define-data-property: 1.1.4
       es-errors: 1.3.0
       function-bind: 1.1.2
-      get-intrinsic: 1.2.6
+      get-intrinsic: 1.3.0
       gopd: 1.2.0
       has-property-descriptors: 1.0.2
 
@@ -10138,6 +7885,12 @@ snapshots:
       functions-have-names: 1.2.3
       has-property-descriptors: 1.0.2
 
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+
   setimmediate@1.0.5: {}
 
   shebang-command@2.0.0:
@@ -10146,36 +7899,30 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
-  shelljs@0.8.5:
-    dependencies:
-      glob: 7.2.3
-      interpret: 1.4.0
-      rechoir: 0.6.2
-
   side-channel-list@1.0.0:
     dependencies:
       es-errors: 1.3.0
-      object-inspect: 1.13.3
+      object-inspect: 1.13.4
 
   side-channel-map@1.0.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
-      get-intrinsic: 1.2.6
-      object-inspect: 1.13.3
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
 
   side-channel-weakmap@1.0.2:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
-      get-intrinsic: 1.2.6
-      object-inspect: 1.13.3
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
       side-channel-map: 1.0.1
 
   side-channel@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      object-inspect: 1.13.3
+      object-inspect: 1.13.4
       side-channel-list: 1.0.0
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
@@ -10186,30 +7933,14 @@ snapshots:
 
   signal-exit@4.1.0: {}
 
-  simple-bin-help@1.8.0: {}
-
-  simple-git@3.27.0:
+  simple-git@3.28.0:
     dependencies:
       '@kwsites/file-exists': 1.1.1
       '@kwsites/promise-deferred': 1.1.1
-      debug: 4.3.7(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
     transitivePeerDependencies:
       - supports-color
 
-  slash@3.0.0: {}
-
-  slice-ansi@3.0.0:
-    dependencies:
-      ansi-styles: 4.3.0
-      astral-regex: 2.0.0
-      is-fullwidth-code-point: 3.0.0
-
-  slice-ansi@4.0.0:
-    dependencies:
-      ansi-styles: 4.3.0
-      astral-regex: 2.0.0
-      is-fullwidth-code-point: 3.0.0
-
   slice-ansi@5.0.0:
     dependencies:
       ansi-styles: 6.2.1
@@ -10233,48 +7964,20 @@ snapshots:
 
   space-separated-tokens@2.0.2: {}
 
-  spec-change@1.11.11:
-    dependencies:
-      arg: 5.0.2
-      debug: 4.4.0(supports-color@8.1.1)
-      deep-equal: 2.2.3
-      dependency-tree: 11.0.1
-      lazy-ass: 2.0.3
-      tinyglobby: 0.2.10
-    transitivePeerDependencies:
-      - supports-color
-
   sprintf-js@1.0.3: {}
 
-  sshpk@1.18.0:
-    dependencies:
-      asn1: 0.2.6
-      assert-plus: 1.0.0
-      bcrypt-pbkdf: 1.0.2
-      dashdash: 1.14.1
-      ecc-jsbn: 0.1.2
-      getpass: 0.1.7
-      jsbn: 0.1.1
-      safer-buffer: 2.1.2
-      tweetnacl: 0.14.5
-
   stackback@0.0.2: {}
 
-  std-env@3.8.0: {}
-
-  stop-iteration-iterator@1.0.0:
-    dependencies:
-      internal-slot: 1.1.0
+  std-env@3.9.0: {}
 
   stream-shift@1.0.3: {}
 
-  streamx@2.20.2:
+  streamx@2.22.1:
     dependencies:
       fast-fifo: 1.3.2
-      queue-tick: 1.0.1
-      text-decoder: 1.2.1
+      text-decoder: 1.2.3
     optionalDependencies:
-      bare-events: 2.5.0
+      bare-events: 2.5.4
 
   string-argv@0.3.2: {}
 
@@ -10299,46 +8002,46 @@ snapshots:
   string.prototype.matchall@4.0.12:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
       es-errors: 1.3.0
-      es-object-atoms: 1.0.0
-      get-intrinsic: 1.2.6
+      es-object-atoms: 1.1.1
+      get-intrinsic: 1.3.0
       gopd: 1.2.0
       has-symbols: 1.1.0
       internal-slot: 1.1.0
-      regexp.prototype.flags: 1.5.3
+      regexp.prototype.flags: 1.5.4
       set-function-name: 2.0.2
       side-channel: 1.1.0
 
   string.prototype.repeat@1.0.0:
     dependencies:
       define-properties: 1.2.1
-      es-abstract: 1.23.7
+      es-abstract: 1.23.9
 
   string.prototype.trim@1.2.10:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-data-property: 1.1.4
       define-properties: 1.2.1
-      es-abstract: 1.23.7
-      es-object-atoms: 1.0.0
+      es-abstract: 1.23.9
+      es-object-atoms: 1.1.1
       has-property-descriptors: 1.0.2
 
   string.prototype.trimend@1.0.9:
     dependencies:
       call-bind: 1.0.8
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
 
   string.prototype.trimstart@1.0.8:
     dependencies:
       call-bind: 1.0.8
       define-properties: 1.2.1
-      es-object-atoms: 1.0.0
+      es-object-atoms: 1.1.1
 
   string_decoder@1.1.1:
     dependencies:
@@ -10349,12 +8052,6 @@ snapshots:
       character-entities-html4: 2.1.0
       character-entities-legacy: 3.0.0
 
-  stringify-object@3.3.0:
-    dependencies:
-      get-own-enumerable-property-symbols: 3.0.2
-      is-obj: 1.0.1
-      is-regexp: 1.0.0
-
   strip-ansi@6.0.1:
     dependencies:
       ansi-regex: 5.0.1
@@ -10363,21 +8060,15 @@ snapshots:
     dependencies:
       ansi-regex: 6.1.0
 
-  strip-bom@3.0.0: {}
-
-  strip-final-newline@2.0.0: {}
-
-  strip-final-newline@3.0.0: {}
-
   strip-indent@3.0.0:
     dependencies:
       min-indent: 1.0.1
 
   strip-json-comments@3.1.1: {}
 
-  stylus-lookup@6.0.0:
+  strip-literal@3.0.0:
     dependencies:
-      commander: 12.1.0
+      js-tokens: 9.0.1
 
   supports-color@7.2.0:
     dependencies:
@@ -10391,142 +8082,116 @@ snapshots:
 
   symbol-tree@3.2.4: {}
 
-  synckit@0.9.2:
+  synckit@0.11.8:
     dependencies:
-      '@pkgr/core': 0.1.1
-      tslib: 2.8.1
+      '@pkgr/core': 0.2.7
 
   tabbable@6.2.0: {}
 
-  tapable@2.2.1: {}
-
-  tar-fs@3.0.7:
+  tar-fs@3.1.0:
     dependencies:
-      pump: 3.0.2
+      pump: 3.0.3
       tar-stream: 3.1.7
     optionalDependencies:
-      bare-fs: 2.3.5
-      bare-path: 2.1.3
+      bare-fs: 4.1.5
+      bare-path: 3.0.0
+    transitivePeerDependencies:
+      - bare-buffer
 
   tar-stream@3.1.7:
     dependencies:
       b4a: 1.6.7
       fast-fifo: 1.3.2
-      streamx: 2.20.2
+      streamx: 2.22.1
 
-  terser@5.36.0:
+  terser@5.39.0:
     dependencies:
       '@jridgewell/source-map': 0.3.6
       acorn: 8.14.0
       commander: 2.20.3
       source-map-support: 0.5.21
 
-  text-decoder@1.2.1: {}
-
-  throttleit@1.0.1: {}
+  text-decoder@1.2.3:
+    dependencies:
+      b4a: 1.6.7
 
   through2@2.0.5:
     dependencies:
       readable-stream: 2.3.8
       xtend: 4.0.2
 
-  through@2.3.8: {}
-
   tiny-invariant@1.3.3: {}
 
   tinybench@2.9.0: {}
 
-  tinyexec@0.3.1: {}
+  tinyexec@0.3.2: {}
 
-  tinyglobby@0.2.10:
+  tinyglobby@0.2.14:
     dependencies:
-      fdir: 6.4.2(picomatch@4.0.2)
+      fdir: 6.4.6(picomatch@4.0.2)
       picomatch: 4.0.2
 
-  tinypool@1.0.2: {}
+  tinypool@1.1.1: {}
 
-  tinyrainbow@1.2.0: {}
+  tinyrainbow@2.0.0: {}
 
-  tinyspy@3.0.2: {}
+  tinyspy@4.0.3: {}
 
-  tldts-core@6.1.64: {}
+  tldts-core@6.1.86: {}
 
-  tldts@6.1.64:
+  tldts@6.1.86:
     dependencies:
-      tldts-core: 6.1.64
-
-  tmp@0.2.3: {}
+      tldts-core: 6.1.86
 
   to-regex-range@5.0.1:
     dependencies:
       is-number: 7.0.0
 
-  tough-cookie@5.0.0:
+  tough-cookie@5.1.2:
     dependencies:
-      tldts: 6.1.64
-
-  tr46@0.0.3: {}
+      tldts: 6.1.86
 
-  tr46@5.0.0:
+  tr46@5.1.0:
     dependencies:
       punycode: 2.3.1
 
-  tree-kill@1.2.2: {}
-
   trim-lines@3.0.1: {}
 
   trough@2.2.0: {}
 
-  ts-api-utils@1.4.3(typescript@5.7.2):
-    dependencies:
-      typescript: 5.7.2
-
-  ts-api-utils@2.0.0(typescript@5.7.2):
+  ts-api-utils@2.1.0(typescript@5.8.3):
     dependencies:
-      typescript: 5.7.2
+      typescript: 5.8.3
 
-  ts-node@10.9.2(@swc/core@1.9.3)(@types/node@22.10.6)(typescript@5.7.2):
+  ts-node@10.9.2(@swc/core@1.12.0)(@types/node@24.0.12)(typescript@5.8.3):
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       '@tsconfig/node10': 1.0.11
       '@tsconfig/node12': 1.0.11
       '@tsconfig/node14': 1.0.3
       '@tsconfig/node16': 1.0.4
-      '@types/node': 22.10.6
+      '@types/node': 24.0.12
       acorn: 8.14.0
       acorn-walk: 8.3.4
       arg: 4.1.3
       create-require: 1.1.1
       diff: 4.0.2
       make-error: 1.3.6
-      typescript: 5.7.2
+      typescript: 5.8.3
       v8-compile-cache-lib: 3.0.1
       yn: 3.1.1
     optionalDependencies:
-      '@swc/core': 1.9.3
-
-  tsconfig-paths@4.2.0:
-    dependencies:
-      json5: 2.2.3
-      minimist: 1.2.8
-      strip-bom: 3.0.0
+      '@swc/core': 1.12.0
 
   tslib@2.8.1: {}
 
-  tsx@4.19.2:
+  tsx@4.19.3:
     dependencies:
-      esbuild: 0.23.1
-      get-tsconfig: 4.8.1
+      esbuild: 0.25.6
+      get-tsconfig: 4.10.1
     optionalDependencies:
       fsevents: 2.3.3
-
-  tunnel-agent@0.6.0:
-    dependencies:
-      safe-buffer: 5.2.1
-
-  tunnel@0.0.6: {}
-
-  tweetnacl@0.14.5: {}
+    optional: true
 
   type-check@0.4.0:
     dependencies:
@@ -10534,18 +8199,16 @@ snapshots:
 
   type-fest@0.20.2: {}
 
-  type-fest@0.21.3: {}
-
   typed-array-buffer@1.0.3:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       es-errors: 1.3.0
       is-typed-array: 1.1.15
 
   typed-array-byte-length@1.0.3:
     dependencies:
       call-bind: 1.0.8
-      for-each: 0.3.3
+      for-each: 0.3.5
       gopd: 1.2.0
       has-proto: 1.2.0
       is-typed-array: 1.1.15
@@ -10554,47 +8217,49 @@ snapshots:
     dependencies:
       available-typed-arrays: 1.0.7
       call-bind: 1.0.8
-      for-each: 0.3.3
+      for-each: 0.3.5
       gopd: 1.2.0
       has-proto: 1.2.0
       is-typed-array: 1.1.15
-      reflect.getprototypeof: 1.0.9
+      reflect.getprototypeof: 1.0.10
 
   typed-array-length@1.0.7:
     dependencies:
       call-bind: 1.0.8
-      for-each: 0.3.3
+      for-each: 0.3.5
       gopd: 1.2.0
       is-typed-array: 1.1.15
-      possible-typed-array-names: 1.0.0
-      reflect.getprototypeof: 1.0.9
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
 
-  typescript-eslint@8.19.1(eslint@9.18.0)(typescript@5.7.2):
+  typescript-eslint@8.36.0(eslint@9.30.1)(typescript@5.8.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.19.1(@typescript-eslint/parser@8.19.1(eslint@9.18.0)(typescript@5.7.2))(eslint@9.18.0)(typescript@5.7.2)
-      '@typescript-eslint/parser': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      '@typescript-eslint/utils': 8.19.1(eslint@9.18.0)(typescript@5.7.2)
-      eslint: 9.18.0
-      typescript: 5.7.2
+      '@typescript-eslint/eslint-plugin': 8.36.0(@typescript-eslint/parser@8.36.0(eslint@9.30.1)(typescript@5.8.3))(eslint@9.30.1)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.36.0(eslint@9.30.1)(typescript@5.8.3)
+      eslint: 9.30.1
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
-  typescript@5.7.2: {}
+  typescript@5.8.2: {}
+
+  typescript@5.8.3: {}
 
-  ufo@1.5.4: {}
+  ufo@1.6.1: {}
 
   unbox-primitive@1.1.0:
     dependencies:
-      call-bound: 1.0.3
-      has-bigints: 1.0.2
+      call-bound: 1.0.4
+      has-bigints: 1.1.0
       has-symbols: 1.1.0
       which-boxed-primitive: 1.1.1
 
   undici-types@6.20.0: {}
 
-  undici@5.28.4:
-    dependencies:
-      '@fastify/busboy': 2.1.1
+  undici-types@7.8.0: {}
+
+  unicorn-magic@0.3.0: {}
 
   unified@11.0.5:
     dependencies:
@@ -10635,17 +8300,13 @@ snapshots:
       unist-util-is: 6.0.0
       unist-util-visit-parents: 6.0.1
 
-  universal-user-agent@7.0.2: {}
-
-  universalify@0.1.2: {}
+  universal-user-agent@7.0.3: {}
 
   universalify@2.0.1: {}
 
-  untildify@4.0.0: {}
-
-  update-browserslist-db@1.1.1(browserslist@4.24.2):
+  update-browserslist-db@1.1.2(browserslist@4.24.4):
     dependencies:
-      browserslist: 4.24.2
+      browserslist: 4.24.4
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -10657,39 +8318,21 @@ snapshots:
 
   url-template@3.1.1: {}
 
-  use-react-router-breadcrumbs@4.0.1(react-router-dom@6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1):
+  use-react-router-breadcrumbs@4.0.1(react-router-dom@6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react@18.3.1):
     dependencies:
       react: 18.3.1
-      react-router-dom: 6.28.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react-router-dom: 6.30.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
 
-  use-sync-external-store@1.2.2(react@18.3.1):
+  use-sync-external-store@1.4.0(react@18.3.1):
     dependencies:
       react: 18.3.1
 
   util-deprecate@1.0.2: {}
 
-  uuid@11.0.5: {}
-
-  uuid@8.3.2: {}
+  uuid@11.1.0: {}
 
   v8-compile-cache-lib@3.0.1: {}
 
-  vasync@2.2.1:
-    dependencies:
-      verror: 1.10.0
-
-  verror@1.10.0:
-    dependencies:
-      assert-plus: 1.0.0
-      core-util-is: 1.0.2
-      extsprintf: 1.4.1
-
-  verror@1.10.1:
-    dependencies:
-      assert-plus: 1.0.0
-      core-util-is: 1.0.2
-      extsprintf: 1.4.1
-
   vfile-location@5.0.3:
     dependencies:
       '@types/unist': 3.0.3
@@ -10705,15 +8348,16 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.2
 
-  vite-node@2.1.8(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0):
+  vite-node@3.2.4(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0):
     dependencies:
       cac: 6.7.14
-      debug: 4.4.0(supports-color@8.1.1)
-      es-module-lexer: 1.5.4
-      pathe: 1.1.2
-      vite: 5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)
+      debug: 4.4.1(supports-color@8.1.1)
+      es-module-lexer: 1.7.0
+      pathe: 2.0.3
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
     transitivePeerDependencies:
       - '@types/node'
+      - jiti
       - less
       - lightningcss
       - sass
@@ -10722,105 +8366,98 @@ snapshots:
       - sugarss
       - supports-color
       - terser
+      - tsx
+      - yaml
 
-  vite-plugin-checker@0.8.0(eslint@9.18.0)(optionator@0.9.4)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)):
+  vite-plugin-checker@0.10.0(eslint@9.30.1)(optionator@0.9.4)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)):
     dependencies:
-      '@babel/code-frame': 7.26.2
-      ansi-escapes: 4.3.2
-      chalk: 4.1.2
-      chokidar: 3.6.0
-      commander: 8.3.0
-      fast-glob: 3.3.2
-      fs-extra: 11.2.0
-      npm-run-path: 4.0.1
-      strip-ansi: 6.0.1
+      '@babel/code-frame': 7.27.1
+      chokidar: 4.0.3
+      npm-run-path: 6.0.0
+      picocolors: 1.1.1
+      picomatch: 4.0.2
+      strip-ansi: 7.1.0
       tiny-invariant: 1.3.3
-      vite: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
-      vscode-languageclient: 7.0.0
-      vscode-languageserver: 7.0.0
-      vscode-languageserver-textdocument: 1.0.12
-      vscode-uri: 3.0.8
+      tinyglobby: 0.2.14
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
+      vscode-uri: 3.1.0
     optionalDependencies:
-      eslint: 9.18.0
+      eslint: 9.30.1
       optionator: 0.9.4
-      typescript: 5.7.2
+      typescript: 5.8.3
 
-  vite-plugin-dts@4.5.0(@types/node@22.10.6)(rollup@4.30.1)(typescript@5.7.2)(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)):
+  vite-plugin-dts@4.5.4(@types/node@24.0.12)(rollup@4.44.2)(typescript@5.8.3)(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)):
     dependencies:
-      '@microsoft/api-extractor': 7.49.1(@types/node@22.10.6)
-      '@rollup/pluginutils': 5.1.4(rollup@4.30.1)
-      '@volar/typescript': 2.4.11
-      '@vue/language-core': 2.2.0(typescript@5.7.2)
+      '@microsoft/api-extractor': 7.52.8(@types/node@24.0.12)
+      '@rollup/pluginutils': 5.1.4(rollup@4.44.2)
+      '@volar/typescript': 2.4.14
+      '@vue/language-core': 2.2.0(typescript@5.8.3)
       compare-versions: 6.1.1
-      debug: 4.4.0(supports-color@8.1.1)
+      debug: 4.4.1(supports-color@8.1.1)
       kolorist: 1.8.0
-      local-pkg: 0.5.1
+      local-pkg: 1.1.1
       magic-string: 0.30.17
-      typescript: 5.7.2
+      typescript: 5.8.3
     optionalDependencies:
-      vite: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
     transitivePeerDependencies:
       - '@types/node'
       - rollup
       - supports-color
 
-  vite-plugin-lib-inject-css@2.2.1(vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)):
+  vite-plugin-lib-inject-css@2.2.2(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)):
     dependencies:
-      '@ast-grep/napi': 0.32.2
+      '@ast-grep/napi': 0.36.2
       magic-string: 0.30.17
       picocolors: 1.1.1
-      vite: 6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1)
-
-  vite@5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0):
-    dependencies:
-      esbuild: 0.21.5
-      postcss: 8.4.49
-      rollup: 4.30.1
-    optionalDependencies:
-      '@types/node': 22.10.6
-      fsevents: 2.3.3
-      lightningcss: 1.28.2
-      terser: 5.36.0
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
 
-  vite@6.0.7(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)(tsx@4.19.2)(yaml@2.6.1):
+  vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0):
     dependencies:
-      esbuild: 0.24.2
-      postcss: 8.4.49
-      rollup: 4.30.0
+      esbuild: 0.25.6
+      fdir: 6.4.6(picomatch@4.0.2)
+      picomatch: 4.0.2
+      postcss: 8.5.6
+      rollup: 4.44.2
+      tinyglobby: 0.2.14
     optionalDependencies:
-      '@types/node': 22.10.6
+      '@types/node': 24.0.12
       fsevents: 2.3.3
-      lightningcss: 1.28.2
-      terser: 5.36.0
-      tsx: 4.19.2
-      yaml: 2.6.1
-
-  vitest@2.1.8(@types/node@22.10.6)(jsdom@26.0.0)(lightningcss@1.28.2)(terser@5.36.0):
-    dependencies:
-      '@vitest/expect': 2.1.8
-      '@vitest/mocker': 2.1.8(vite@5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0))
-      '@vitest/pretty-format': 2.1.8
-      '@vitest/runner': 2.1.8
-      '@vitest/snapshot': 2.1.8
-      '@vitest/spy': 2.1.8
-      '@vitest/utils': 2.1.8
-      chai: 5.1.2
-      debug: 4.3.7(supports-color@8.1.1)
-      expect-type: 1.1.0
-      magic-string: 0.30.14
-      pathe: 1.1.2
-      std-env: 3.8.0
+      lightningcss: 1.30.1
+      terser: 5.39.0
+      tsx: 4.19.3
+      yaml: 2.8.0
+
+  vitest@3.2.4(@types/node@24.0.12)(jsdom@26.1.0)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0):
+    dependencies:
+      '@types/chai': 5.2.2
+      '@vitest/expect': 3.2.4
+      '@vitest/mocker': 3.2.4(vite@7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0))
+      '@vitest/pretty-format': 3.2.4
+      '@vitest/runner': 3.2.4
+      '@vitest/snapshot': 3.2.4
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.2.0
+      debug: 4.4.1(supports-color@8.1.1)
+      expect-type: 1.2.1
+      magic-string: 0.30.17
+      pathe: 2.0.3
+      picomatch: 4.0.2
+      std-env: 3.9.0
       tinybench: 2.9.0
-      tinyexec: 0.3.1
-      tinypool: 1.0.2
-      tinyrainbow: 1.2.0
-      vite: 5.4.11(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)
-      vite-node: 2.1.8(@types/node@22.10.6)(lightningcss@1.28.2)(terser@5.36.0)
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.14
+      tinypool: 1.1.1
+      tinyrainbow: 2.0.0
+      vite: 7.0.3(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
+      vite-node: 3.2.4(@types/node@24.0.12)(lightningcss@1.30.1)(terser@5.39.0)(tsx@4.19.3)(yaml@2.8.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 22.10.6
-      jsdom: 26.0.0
+      '@types/node': 24.0.12
+      jsdom: 26.1.0
     transitivePeerDependencies:
+      - jiti
       - less
       - lightningcss
       - msw
@@ -10830,45 +8467,19 @@ snapshots:
       - sugarss
       - supports-color
       - terser
+      - tsx
+      - yaml
 
   void-elements@3.1.0: {}
 
-  vscode-jsonrpc@6.0.0: {}
-
-  vscode-languageclient@7.0.0:
-    dependencies:
-      minimatch: 3.1.2
-      semver: 7.6.3
-      vscode-languageserver-protocol: 3.16.0
-
-  vscode-languageserver-protocol@3.16.0:
-    dependencies:
-      vscode-jsonrpc: 6.0.0
-      vscode-languageserver-types: 3.16.0
-
-  vscode-languageserver-textdocument@1.0.12: {}
-
-  vscode-languageserver-types@3.16.0: {}
-
-  vscode-languageserver@7.0.0:
-    dependencies:
-      vscode-languageserver-protocol: 3.16.0
-
-  vscode-uri@3.0.8: {}
+  vscode-uri@3.1.0: {}
 
   w3c-xmlserializer@5.0.0:
     dependencies:
       xml-name-validator: 5.0.0
 
-  wcwidth@1.0.1:
-    dependencies:
-      defaults: 1.0.4
-    optional: true
-
   web-namespaces@2.0.1: {}
 
-  webidl-conversions@3.0.1: {}
-
   webidl-conversions@7.0.0: {}
 
   whatwg-encoding@3.1.1:
@@ -10877,53 +8488,49 @@ snapshots:
 
   whatwg-mimetype@4.0.0: {}
 
-  whatwg-url@14.1.0:
+  whatwg-url@14.2.0:
     dependencies:
-      tr46: 5.0.0
+      tr46: 5.1.0
       webidl-conversions: 7.0.0
 
-  whatwg-url@5.0.0:
-    dependencies:
-      tr46: 0.0.3
-      webidl-conversions: 3.0.1
-
   which-boxed-primitive@1.1.1:
     dependencies:
       is-bigint: 1.1.0
-      is-boolean-object: 1.2.1
+      is-boolean-object: 1.2.2
       is-number-object: 1.1.1
       is-string: 1.1.1
       is-symbol: 1.1.1
 
   which-builtin-type@1.2.1:
     dependencies:
-      call-bound: 1.0.3
+      call-bound: 1.0.4
       function.prototype.name: 1.1.8
       has-tostringtag: 1.0.2
-      is-async-function: 2.0.0
+      is-async-function: 2.1.1
       is-date-object: 1.1.0
-      is-finalizationregistry: 1.1.0
-      is-generator-function: 1.0.10
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.1.0
       is-regex: 1.2.1
-      is-weakref: 1.1.0
+      is-weakref: 1.1.1
       isarray: 2.0.5
       which-boxed-primitive: 1.1.1
       which-collection: 1.0.2
-      which-typed-array: 1.1.18
+      which-typed-array: 1.1.19
 
   which-collection@1.0.2:
     dependencies:
       is-map: 2.0.3
       is-set: 2.0.3
       is-weakmap: 2.0.2
-      is-weakset: 2.0.3
+      is-weakset: 2.0.4
 
-  which-typed-array@1.1.18:
+  which-typed-array@1.1.19:
     dependencies:
       available-typed-arrays: 1.0.7
       call-bind: 1.0.8
-      call-bound: 1.0.3
-      for-each: 0.3.3
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
       gopd: 1.2.0
       has-tostringtag: 1.0.2
 
@@ -10936,23 +8543,17 @@ snapshots:
       siginfo: 2.0.0
       stackback: 0.0.2
 
-  wireit@0.14.9:
+  wireit@0.14.12:
     dependencies:
       brace-expansion: 4.0.0
       chokidar: 3.6.0
-      fast-glob: 3.3.2
+      fast-glob: 3.3.3
       jsonc-parser: 3.3.1
       proper-lockfile: 4.1.2
 
   word-wrap@1.2.5: {}
 
-  workerpool@6.5.1: {}
-
-  wrap-ansi@6.2.0:
-    dependencies:
-      ansi-styles: 4.3.0
-      string-width: 4.2.3
-      strip-ansi: 6.0.1
+  workerpool@9.3.2: {}
 
   wrap-ansi@7.0.0:
     dependencies:
@@ -10974,7 +8575,7 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  ws@8.18.0: {}
+  ws@8.18.1: {}
 
   xml-name-validator@5.0.0: {}
 
@@ -10988,9 +8589,9 @@ snapshots:
 
   yallist@4.0.0: {}
 
-  yaml@2.6.1: {}
+  yaml@2.8.0: {}
 
-  yargs-parser@20.2.9: {}
+  yargs-parser@21.1.1: {}
 
   yargs-unparser@2.0.0:
     dependencies:
@@ -10999,36 +8600,31 @@ snapshots:
       flat: 5.0.2
       is-plain-obj: 2.1.0
 
-  yargs@16.2.0:
+  yargs@17.7.2:
     dependencies:
-      cliui: 7.0.4
+      cliui: 8.0.1
       escalade: 3.2.0
       get-caller-file: 2.0.5
       require-directory: 2.1.1
       string-width: 4.2.3
       y18n: 5.0.8
-      yargs-parser: 20.2.9
-
-  yauzl@2.10.0:
-    dependencies:
-      buffer-crc32: 0.2.13
-      fd-slicer: 1.1.0
+      yargs-parser: 21.1.1
 
   yn@3.1.1: {}
 
   yocto-queue@0.1.0: {}
 
-  zod-validation-error@3.4.0(zod@3.23.8):
+  zod-validation-error@3.4.0(zod@3.24.2):
     dependencies:
-      zod: 3.23.8
+      zod: 3.24.2
 
-  zod@3.23.8: {}
+  zod@3.24.2: {}
 
-  zustand@4.5.5(@types/react@18.3.13)(react@18.3.1):
+  zustand@4.5.6(@types/react@18.3.18)(react@18.3.1):
     dependencies:
-      use-sync-external-store: 1.2.2(react@18.3.1)
+      use-sync-external-store: 1.4.0(react@18.3.1)
     optionalDependencies:
-      '@types/react': 18.3.13
+      '@types/react': 18.3.18
       react: 18.3.1
 
   zwitch@2.0.4: {}
diff --git a/js/pom.xml b/js/pom.xml
index 70bbeeee75d7..abb40f8671fb 100644
--- a/js/pom.xml
+++ b/js/pom.xml
@@ -20,13 +20,12 @@
         <module>apps/admin-ui</module>
         <module>libs/keycloak-admin-client</module>
         <module>libs/ui-shared</module>
-        <module>libs/keycloak-js</module>
         <module>themes-vendor</module>
     </modules>
 
     <properties>
-        <node.version>v22.11.0</node.version>
-        <pnpm.version>9.14.4</pnpm.version>
+        <node.version>v22.14.0</node.version>
+        <pnpm.version>10.4.1</pnpm.version>
         <!-- The JavaScript projects use non-standard folders for their sources, therefore, name it here explicitly -->
         <maven.build.cache.input.1>src</maven.build.cache.input.1>
         <maven.build.cache.input.2>public</maven.build.cache.input.2>
@@ -51,6 +50,19 @@
         </pluginManagement>
 
         <plugins>
+            <plugin>
+                <groupId>org.keycloak</groupId>
+                <artifactId>theme-verifier-maven-plugin</artifactId>
+                <version>${project.version}</version>
+                <executions>
+                    <execution>
+                        <id>verify-theme</id>
+                        <goals>
+                            <goal>verify-theme</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <!-- Clean child modules from parent, as we trigger the build here for parallelization. -->
                 <artifactId>maven-clean-plugin</artifactId>
diff --git a/js/themes-vendor/package.json b/js/themes-vendor/package.json
index 986990a07892..a0fe409bdb0c 100644
--- a/js/themes-vendor/package.json
+++ b/js/themes-vendor/package.json
@@ -20,20 +20,20 @@
     }
   },
   "dependencies": {
-    "@noble/hashes": "^1.7.0",
+    "@noble/hashes": "^1.8.0",
     "@patternfly-v5/patternfly": "npm:@patternfly/patternfly@^5.4.2",
     "@patternfly/patternfly": "^4.224.5",
     "patternfly": "^3.59.5",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "rfc4648": "^1.5.4",
-    "uuid": "^11.0.5"
+    "uuid": "^11.1.0"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^28.0.2",
-    "@rollup/plugin-node-resolve": "^16.0.0",
+    "@rollup/plugin-commonjs": "^28.0.6",
+    "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-replace": "^6.0.2",
     "@rollup/plugin-terser": "^0.4.4",
-    "rollup": "^4.30.1"
+    "rollup": "^4.44.2"
   }
 }
diff --git a/misc/theme-verifier/pom.xml b/misc/theme-verifier/pom.xml
new file mode 100644
index 000000000000..c83dc9b0ebd9
--- /dev/null
+++ b/misc/theme-verifier/pom.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2025 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.keycloak</groupId>
+        <artifactId>keycloak-parent</artifactId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+
+    <groupId>org.keycloak</groupId>
+    <artifactId>theme-verifier-maven-plugin</artifactId>
+    <version>999.0.0-SNAPSHOT</version>
+
+    <name>Keycloak Theme verifier</name>
+
+    <packaging>maven-plugin</packaging>
+
+    <properties>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven-plugin-tools.version>3.15.1</maven-plugin-tools.version>
+        <maven-plugin-api.version>3.9.9</maven-plugin-api.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven</groupId>
+            <artifactId>maven-plugin-api</artifactId>
+            <version>${maven-plugin-api.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven.plugin-tools</groupId>
+            <artifactId>maven-plugin-annotations</artifactId>
+            <version>${maven-plugin-tools.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven</groupId>
+            <artifactId>maven-core</artifactId>
+            <version>${maven-plugin-api.version}</version>
+            <scope>compile</scope>
+        </dependency>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.18.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest</artifactId>
+            <version>2.2</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
+            <artifactId>owasp-java-html-sanitizer</artifactId>
+            <version>20240325.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+            <version>1.13.0</version>
+            <scope>compile</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/MessagePropertiesFilter.java b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/MessagePropertiesFilter.java
new file mode 100644
index 000000000000..4e4c9fa5d8b8
--- /dev/null
+++ b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/MessagePropertiesFilter.java
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.themeverifier;
+
+import org.apache.commons.io.filefilter.AbstractFileFilter;
+
+import java.io.File;
+
+public class MessagePropertiesFilter extends AbstractFileFilter {
+    public static MessagePropertiesFilter INSTANCE = new MessagePropertiesFilter();
+
+    @Override
+    public boolean accept(File file) {
+        return file.getName().startsWith("messages_") && file.getName().endsWith(".properties");
+    }
+}
diff --git a/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/ThemeVerifierMojo.java b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/ThemeVerifierMojo.java
new file mode 100644
index 000000000000..75ba00b2441e
--- /dev/null
+++ b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/ThemeVerifierMojo.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.themeverifier;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.filefilter.DirectoryFileFilter;
+import org.apache.maven.model.Resource;
+import org.apache.maven.plugin.AbstractMojo;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProject;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@Mojo(name = "verify-theme", defaultPhase = LifecyclePhase.INSTALL, threadSafe = true)
+public class ThemeVerifierMojo extends AbstractMojo {
+
+    @Parameter(defaultValue = "${project}", readonly = true)
+    private MavenProject mavenProject;
+
+    @Parameter(defaultValue = "false", readonly = true)
+    private boolean validateMessageFormatQuotes;
+
+    @Override
+    public void execute() throws MojoExecutionException, MojoFailureException {
+        Iterator<Resource> resources = mavenProject.getResources().iterator();
+        List<String> messages = new ArrayList<>();
+        while (resources.hasNext()) {
+            Resource resource = resources.next();
+            File dir = new File(resource.getDirectory());
+            Iterator<File> fileIterator = FileUtils.iterateFiles(dir, MessagePropertiesFilter.INSTANCE, DirectoryFileFilter.INSTANCE);
+            while (fileIterator.hasNext()) {
+                File file = fileIterator.next();
+                messages.addAll(new VerifyMessageProperties(file).withValidateMessageFormatQuotes(validateMessageFormatQuotes).verify());
+            }
+        }
+        if (!messages.isEmpty()) {
+            throw new MojoFailureException("Validation errors: " + messages.stream().collect(Collectors.joining(System.lineSeparator())));
+        }
+    }
+}
diff --git a/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java
new file mode 100644
index 000000000000..2cae1f2c3920
--- /dev/null
+++ b/misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java
@@ -0,0 +1,331 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.themeverifier;
+
+import org.apache.maven.plugin.MojoExecutionException;
+import org.owasp.html.PolicyFactory;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.StringReader;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.MissingResourceException;
+import java.util.Objects;
+import java.util.PropertyResourceBundle;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public class VerifyMessageProperties {
+
+    private final File file;
+    private List<String> messages;
+    private boolean validateMessageFormatQuotes;
+
+    public VerifyMessageProperties(File file) {
+        this.file = file;
+    }
+
+    public List<String> verify() throws MojoExecutionException {
+        messages = new ArrayList<>();
+        try {
+            String contents = Files.readString(file.toPath());
+            verifyNoDuplicateKeys(contents);
+            verifySafeHtml();
+            verifyProblematicBlanks();
+            if (validateMessageFormatQuotes) {
+                verifyMessageFormatQuotes();
+                verifyMessageFormatPlaceholders();
+            } else {
+                verifyNotMessageFormatQuotes();
+                verifyNotMessageFormatPlaceholders();
+            }
+            verifyUnbalancedCurlyBraces();
+        } catch (IOException e) {
+            throw new MojoExecutionException("Can not read file " + file, e);
+        }
+        return messages;
+    }
+
+    private final static Pattern DOUBLE_SINGLE_QUOTES = Pattern.compile("''");
+
+    private void verifyNotMessageFormatQuotes() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (DOUBLE_SINGLE_QUOTES.matcher(value).find()) {
+                messages.add("Double single quotes are not allowed in message formats as they might be shown in frontends as-is in '" + key + "' for file " + file + ": " + value);
+            }
+
+        });
+    }
+
+    private static final Pattern SINGLE_QUOTE_MIDDLE = Pattern.compile("[^']'[^']");
+    private static final Pattern SINGLE_QUOTE_END = Pattern.compile("[^']'$");
+    private static final Pattern SINGLE_QUOTE_START = Pattern.compile("^'[^']");
+
+    private void verifyMessageFormatQuotes() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (SINGLE_QUOTE_START.matcher(value).find()
+            || SINGLE_QUOTE_MIDDLE.matcher(value).find()
+            || SINGLE_QUOTE_END.matcher(value).find()) {
+                messages.add("Single quotes are not allowed in message formats due to unexpected behaviors in '" + key + "' for file " + file + ": " + value);
+            }
+
+        });
+    }
+
+    private static final Pattern DOUBLE_CURLY_BRACES_START = Pattern.compile("\\{\\{[0-9]");
+    private static final Pattern DOUBLE_CURLY_BRACES_END = Pattern.compile("[0-9]}}");
+
+    private void verifyMessageFormatPlaceholders() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (DOUBLE_CURLY_BRACES_START.matcher(value).find()
+                    || DOUBLE_CURLY_BRACES_END.matcher(value).find()) {
+                messages.add("Double curly braces are not allowed in message formats in the backend for in '" + key + "' for file " + file + ": " + value);
+            }
+
+        });
+    }
+
+    private static final Pattern SINGLE_CURLY_BRACE_MIDDLE = Pattern.compile("[^{]\\{[0-9]");
+    private static final Pattern SINGLE_CURLY_BRACE_END = Pattern.compile("[0-9]}$");
+    private static final Pattern SINGLE_CURLY_BRACE_START = Pattern.compile("^\\{[0-9]");
+
+    private void verifyNotMessageFormatPlaceholders() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (SINGLE_CURLY_BRACE_START.matcher(value).find()
+                    || SINGLE_CURLY_BRACE_MIDDLE.matcher(value).find()
+                    || SINGLE_CURLY_BRACE_END.matcher(value).find()) {
+                messages.add("Single curly quotes are not supported as placeholders for the frontend in '" + key + "' for file " + file + ": " + value);
+            }
+
+        });
+    }
+
+    private static final Pattern UNBALANCED_ONE = Pattern.compile("\\{\\{[^{}]*}[^}]");
+    private static final Pattern UNBALANCED_ONE_END = Pattern.compile("\\{\\{[^{}]*}$");
+    private static final Pattern UNBALANCED_TWO = Pattern.compile("[^{]\\{[^{}]*}}");
+    private static final Pattern UNBALANCED_TWO_START = Pattern.compile("^\\{[^{}]*}}");
+
+    private void verifyUnbalancedCurlyBraces() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (UNBALANCED_ONE.matcher(value).find() || UNBALANCED_ONE_END.matcher(value).find()
+                || UNBALANCED_TWO.matcher(value).find() || UNBALANCED_TWO_START.matcher(value).find()) {
+                messages.add("Unbalanced curly braces in key '" + key + "' for file " + file + ": " + value);
+            }
+
+        });
+    }
+
+    private PropertyResourceBundle getPropertyResourceBundle() {
+        PropertyResourceBundle bundle;
+        try (FileInputStream fis = new FileInputStream(file)) {
+            bundle = new PropertyResourceBundle(fis);
+        } catch (IOException e) {
+            throw new RuntimeException("unable to read file " + file, e);
+        }
+        return bundle;
+    }
+
+    PolicyFactory POLICY_SOME_HTML = new org.owasp.html.HtmlPolicyBuilder()
+            .allowElements(
+                    "br", "p", "strong", "b"
+            ).toFactory();
+
+    PolicyFactory POLICY_NO_HTML = new org.owasp.html.HtmlPolicyBuilder().toFactory();
+
+    private void verifySafeHtml() {
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        PropertyResourceBundle bundleEnglish;
+        String englishFile = file.getAbsolutePath().replaceAll("resources-community", "resources")
+                .replaceAll("_[a-zA-Z-_]*\\.properties", "_en.properties");
+        try (FileInputStream fis = new FileInputStream(englishFile)) {
+            bundleEnglish = new PropertyResourceBundle(fis);
+        } catch (IOException e) {
+            throw new RuntimeException("unable to read file " + englishFile, e);
+        }
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+            value = normalizeValue(key, value);
+            String englishValue = getEnglishValue(key, bundleEnglish);
+            englishValue = normalizeValue(key, englishValue);
+
+            value = santizeAnchors(key, value, englishValue);
+
+            // Only if the English source string contains HTML we also allow HTML in the translation
+            PolicyFactory policy = containsHtml(englishValue) ? POLICY_SOME_HTML : POLICY_NO_HTML;
+            String sanitized = policy.sanitize(value);
+
+            // Sanitizer will escape HTML entities for quotes and also for numberic tags like '<1>'
+            sanitized = org.apache.commons.text.StringEscapeUtils.unescapeHtml4(sanitized);
+            // Sanitizer will add them when there are double curly braces
+            sanitized = sanitized.replace("<!-- -->", "");
+
+            if (!Objects.equals(sanitized, value)) {
+
+                // Strip identical characters from the beginning and the end to show where the difference is
+                int start = 0;
+                while (start < sanitized.length() && start < value.length() && value.charAt(start) == sanitized.charAt(start)) {
+                    start++;
+                }
+                int end = 0;
+                while (end < sanitized.length() - start && end < value.length() - start && value.charAt(value.length() - end - 1) == sanitized.charAt(sanitized.length() - end - 1)) {
+                    end++;
+                }
+
+                messages.add("Illegal HTML in key " + key + " for file " + file + ": '" + value.substring(start, value.length() - end) + "' vs. '" + sanitized.substring(start, sanitized.length() - end) + "'");
+            }
+
+        });
+    }
+
+    /**
+     * Double blanks and blanks at the beginning of end of the string are difficult to translation in the translation tools and
+     * are easily missed. If a blank before or after the string is needed in the UI, add it in the HTML template.
+     */
+    private void verifyProblematicBlanks() {
+        if (!file.getName().endsWith("_en.properties")) {
+            // Only check EN original files, as the other files are checked by the translation tools
+            return;
+        }
+        PropertyResourceBundle bundle = getPropertyResourceBundle();
+
+        bundle.getKeys().asIterator().forEachRemaining(key -> {
+            String value = bundle.getString(key);
+
+            if (value.contains("  ")) {
+                messages.add("Duplicate blanks in '" + key + "' for file " + file + ": '" + value);
+            }
+
+            if (value.startsWith(" ")) {
+                messages.add(key + " starts with a blank in file " + file + ": '" + value);
+            }
+
+            if (value.endsWith(" ")) {
+                messages.add(key + " ends with a blank in file " + file + ": '" + value);
+            }
+        });
+    }
+
+    private String normalizeValue(String key, String value) {
+        if (key.equals("templateHelp")) {
+            // Allow "CLAIM.<NAME>" here
+            value = value.replaceAll("CLAIM\\.<[A-Z]*>", "");
+        } else if (key.equals("optimizeLookupHelp")) {
+            // Allow "<Extensions>" here
+            value = value.replaceAll("<Extensions>", "");
+        } else if (key.startsWith("linkExpirationFormatter.timePeriodUnit") || key.equals("error-invalid-multivalued-size")) {
+            // The problem is the "<" that appears in the choice
+            value = value.replaceAll("\\{[0-9]+,choice,[^}]*}", "...");
+        }
+
+        // Unescape HTML entities, as we later also unescape HTML entities in the sanitized value
+        value = org.apache.commons.text.StringEscapeUtils.unescapeHtml4(value);
+
+        return value;
+    }
+
+    Pattern HTML_TAGS = Pattern.compile("<[a-z]+[^>]*>");
+
+    private boolean containsHtml(String englishValue) {
+        return HTML_TAGS.matcher(englishValue).find();
+    }
+
+    private static final Pattern ANCHOR_PATTERN = Pattern.compile("</?a[^>]*>");
+
+    /**
+     * Allow only those anchor tags from the source key to also appear in the target key.
+     */
+    private String santizeAnchors(String key, String value, String englishValue) {
+        Matcher matcher = ANCHOR_PATTERN.matcher(value);
+        Matcher englishMatcher = ANCHOR_PATTERN.matcher(englishValue);
+        while (matcher.find()) {
+            if (englishMatcher.find() && Objects.equals(matcher.group(), englishMatcher.group())) {
+                value = value.replaceFirst(Pattern.quote(englishMatcher.group()), "");
+            } else {
+                messages.add("Didn't find anchor tag " + matcher.group() + " in original string");
+                break;
+            }
+        }
+        return value;
+    }
+
+    private static String getEnglishValue(String key, PropertyResourceBundle bundleEnglish) {
+        String englishValue;
+        try {
+            englishValue = bundleEnglish.getString(key);
+        } catch (MissingResourceException ex) {
+            englishValue = "";
+        }
+        return englishValue;
+    }
+
+    private void verifyNoDuplicateKeys(String contents) throws IOException {
+        BufferedReader bufferedReader = new BufferedReader(new StringReader(contents));
+        String line;
+        HashSet<String> seenKeys = new HashSet<>();
+        HashSet<String> duplicateKeys = new HashSet<>();
+        while ((line = bufferedReader.readLine()) != null) {
+            if (line.startsWith("#") || line.isEmpty()) {
+                continue;
+            }
+            int split = line.indexOf("=");
+            if (split != -1) {
+                String key = line.substring(0, split).trim();
+                if (seenKeys.contains(key)) {
+                    duplicateKeys.add(key);
+                } else {
+                    seenKeys.add(key);
+                }
+            }
+        }
+        if (!duplicateKeys.isEmpty()) {
+            messages.add("Duplicate keys in file '" + file.getAbsolutePath() + "': " + duplicateKeys);
+        }
+    }
+
+    public VerifyMessageProperties withValidateMessageFormatQuotes(boolean validateMessageFormatQuotes) {
+        this.validateMessageFormatQuotes = validateMessageFormatQuotes;
+        return this;
+    }
+
+}
diff --git a/misc/theme-verifier/src/test/java/org/keycloak/themeverifier/VerifyMessagePropertiesTest.java b/misc/theme-verifier/src/test/java/org/keycloak/themeverifier/VerifyMessagePropertiesTest.java
new file mode 100644
index 000000000000..ef2943090be2
--- /dev/null
+++ b/misc/theme-verifier/src/test/java/org/keycloak/themeverifier/VerifyMessagePropertiesTest.java
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.themeverifier;
+
+import org.apache.maven.plugin.MojoExecutionException;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Test;
+
+import java.io.File;
+import java.net.URL;
+import java.util.List;
+
+class VerifyMessagePropertiesTest {
+
+    @Test
+    void verifyDuplicateKeysDetected() throws MojoExecutionException {
+        List<String> verify = getFile("duplicateKeys_en.properties").verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Duplicate keys in file")));
+    }
+
+    @Test
+    void verifyIllegalHtmlTagDetected() throws MojoExecutionException {
+        List<String> verify = getFile("illegalHtmlTag_en.properties").verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Illegal HTML")));
+    }
+
+    @Test
+    void verifyNoHtmlAllowed() throws MojoExecutionException {
+        List<String> verify = getFile("noHtml_de.properties").verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Illegal HTML")));
+    }
+
+    @Test
+    void verifyNoChangedAnchors() throws MojoExecutionException {
+        List<String> verify = getFile("changedAnchor_de.properties").verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Didn't find anchor tag")));
+    }
+
+    @Test
+    void verifySingleCurlyBraces() throws MojoExecutionException {
+        List<String> verify = getFile("doubleCurlyBraces_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Double curly braces are not allowed")));
+    }
+
+    @Test
+    void verifyNoDoubleCurlyBrances() throws MojoExecutionException {
+        List<String> verify = getFile("doubleCurlyBraces_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Double curly braces are not allowed")));
+    }
+
+    @Test
+    void verifyNoSingleCurlyBraces() throws MojoExecutionException {
+        List<String> verify = getFile("singleCurlyBracesEnd_en.properties").withValidateMessageFormatQuotes(false).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single curly quotes are not supported")));
+
+        verify = getFile("singleCurlyBracesMiddle_en.properties").withValidateMessageFormatQuotes(false).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single curly quotes are not supported")));
+
+        verify = getFile("singleCurlyBracesStart_en.properties").withValidateMessageFormatQuotes(false).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single curly quotes are not supported")));
+
+    }
+
+    @Test
+    void verifyNoSingleQuoteForMessageFormat() throws MojoExecutionException {
+        List<String> verify = getFile("singleQuotesStart_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single quotes are not allowed")));
+
+        verify = getFile("singleQuotesMiddle_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single quotes are not allowed")));
+
+        verify = getFile("singleQuotesEnd_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Single quotes are not allowed")));
+
+    }
+
+    @Test
+    void verifyNoUnbalancedCurlyBraces() throws MojoExecutionException {
+        List<String> verify = getFile("unbalancedCurlyBracesOne_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Unbalanced curly braces")));
+
+        verify = getFile("unbalancedCurlyBracesOneEnd_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Unbalanced curly braces")));
+
+        verify = getFile("unbalancedCurlyBracesTwo_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Unbalanced curly braces")));
+
+        verify = getFile("unbalancedCurlyBracesTwoStart_en.properties").withValidateMessageFormatQuotes(true).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Unbalanced curly braces")));
+    }
+
+    @Test
+    void verifyNoDoubleQuoteForUIMessages() throws MojoExecutionException {
+        List<String> verify = getFile("doubleSingleQuotes_en.properties").withValidateMessageFormatQuotes(false).verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Double single quotes are not allowed")));
+    }
+
+    @Test
+    void verifyNoExtraBlanks() throws MojoExecutionException {
+        List<String> verify = getFile("blanks_en.properties").verify();
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("Duplicate blanks")));
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("starts with a blank")));
+        MatcherAssert.assertThat(verify, Matchers.hasItem(Matchers.containsString("ends with a blank")));
+    }
+
+    private static VerifyMessageProperties getFile(String fixture) {
+        URL resource = VerifyMessageProperties.class.getResource("/" + fixture);
+        if (resource == null) {
+            throw new RuntimeException("Resource not found: " + fixture);
+        }
+        return new VerifyMessageProperties(new File(resource.getFile()));
+    }
+
+}
diff --git a/misc/theme-verifier/src/test/resources/blanks_en.properties b/misc/theme-verifier/src/test/resources/blanks_en.properties
new file mode 100644
index 000000000000..f54627a7598f
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/blanks_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=\ word  word\ 
diff --git a/misc/theme-verifier/src/test/resources/changedAnchor_de.properties b/misc/theme-verifier/src/test/resources/changedAnchor_de.properties
new file mode 100644
index 000000000000..84b3552a74ee
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/changedAnchor_de.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=Some <a href="http://malicious.com">link</a>
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/changedAnchor_en.properties b/misc/theme-verifier/src/test/resources/changedAnchor_en.properties
new file mode 100644
index 000000000000..84a0c43d36bf
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/changedAnchor_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=Some <a href="http://example.com">link</a>
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/doubleCurlyBraces_en.properties b/misc/theme-verifier/src/test/resources/doubleCurlyBraces_en.properties
new file mode 100644
index 000000000000..904e33f2a86b
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/doubleCurlyBraces_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key={{0}}
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/doubleSingleQuotes_en.properties b/misc/theme-verifier/src/test/resources/doubleSingleQuotes_en.properties
new file mode 100644
index 000000000000..e705a673c076
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/doubleSingleQuotes_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=test''test
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/duplicateKeys_en.properties b/misc/theme-verifier/src/test/resources/duplicateKeys_en.properties
new file mode 100644
index 000000000000..5622d4d5a09f
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/duplicateKeys_en.properties
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=value
+key=value
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/illegalHtmlTag_en.properties b/misc/theme-verifier/src/test/resources/illegalHtmlTag_en.properties
new file mode 100644
index 000000000000..6d8c3a1739f1
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/illegalHtmlTag_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=Some <div>tag</div
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/noHtml_de.properties b/misc/theme-verifier/src/test/resources/noHtml_de.properties
new file mode 100644
index 000000000000..702a1faab8e2
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/noHtml_de.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=Some <b>HTML</b>
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/noHtml_en.properties b/misc/theme-verifier/src/test/resources/noHtml_en.properties
new file mode 100644
index 000000000000..03d58e73b1fb
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/noHtml_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=No HTML
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleCurlyBracesEnd_en.properties b/misc/theme-verifier/src/test/resources/singleCurlyBracesEnd_en.properties
new file mode 100644
index 000000000000..a3467d32722b
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleCurlyBracesEnd_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=x{0}
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleCurlyBracesMiddle_en.properties b/misc/theme-verifier/src/test/resources/singleCurlyBracesMiddle_en.properties
new file mode 100644
index 000000000000..74c13ccc1c46
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleCurlyBracesMiddle_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=x{0}x
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleCurlyBracesStart_en.properties b/misc/theme-verifier/src/test/resources/singleCurlyBracesStart_en.properties
new file mode 100644
index 000000000000..c94eea157393
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleCurlyBracesStart_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key={0}x
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleQuotesEnd_en.properties b/misc/theme-verifier/src/test/resources/singleQuotesEnd_en.properties
new file mode 100644
index 000000000000..d466d32a8866
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleQuotesEnd_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key='value
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleQuotesMiddle_en.properties b/misc/theme-verifier/src/test/resources/singleQuotesMiddle_en.properties
new file mode 100644
index 000000000000..a1fb5efcaab3
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleQuotesMiddle_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=va'lue
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/singleQuotesStart_en.properties b/misc/theme-verifier/src/test/resources/singleQuotesStart_en.properties
new file mode 100644
index 000000000000..d466d32a8866
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/singleQuotesStart_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key='value
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOneEnd_en.properties b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOneEnd_en.properties
new file mode 100644
index 000000000000..b3852f726276
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOneEnd_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=text {{prop}
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOne_en.properties b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOne_en.properties
new file mode 100644
index 000000000000..9e32cef56a6f
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesOne_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=text {{prop} text
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwoStart_en.properties b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwoStart_en.properties
new file mode 100644
index 000000000000..7c5a57d99a88
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwoStart_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key={prop}} text
\ No newline at end of file
diff --git a/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwo_en.properties b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwo_en.properties
new file mode 100644
index 000000000000..2126aaf30073
--- /dev/null
+++ b/misc/theme-verifier/src/test/resources/unbalancedCurlyBracesTwo_en.properties
@@ -0,0 +1,17 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+key=text {prop}} text
\ No newline at end of file
diff --git a/model/infinispan/pom.xml b/model/infinispan/pom.xml
index 186e8da7267e..c3717a985c7d 100755
--- a/model/infinispan/pom.xml
+++ b/model/infinispan/pom.xml
@@ -83,6 +83,16 @@
             <artifactId>infinispan-component-annotations</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.infinispan</groupId>
+            <artifactId>infinispan-component-processor</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.micrometer</groupId>
+            <artifactId>micrometer-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
 
         <dependency>
             <groupId>junit</groupId>
@@ -111,7 +121,25 @@
                     </execution>
                 </executions>
                 <configuration combine.self="append">
-                    <remoteLockFiles>https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/release/26.0/model/infinispan/proto.lock</remoteLockFiles>
+                    <remoteLockFiles>https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/release/26.0/model/infinispan/proto.lock,https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/archive/release/26.1/model/infinispan/proto.lock,https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/release/26.2/model/infinispan/proto.lock</remoteLockFiles>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>org.infinispan</groupId>
+                            <artifactId>infinispan-component-processor</artifactId>
+                            <version>${infinispan.version}</version>
+                        </path>
+                        <path>
+                            <groupId>org.infinispan.protostream</groupId>
+                            <artifactId>protostream-processor</artifactId>
+                            <version>${protostream.version}</version>
+                        </path>
+                    </annotationProcessorPaths>
                 </configuration>
             </plugin>
         </plugins>
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/CrossDCAwareCacheFactory.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/CrossDCAwareCacheFactory.java
deleted file mode 100644
index 546b9de3954f..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/CrossDCAwareCacheFactory.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.cluster.infinispan;
-
-import java.util.Set;
-
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.Flag;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.commons.api.BasicCache;
-import org.infinispan.persistence.remote.RemoteStore;
-import org.jboss.logging.Logger;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-abstract class CrossDCAwareCacheFactory {
-
-    protected static final Logger logger = Logger.getLogger(CrossDCAwareCacheFactory.class);
-
-
-    abstract BasicCache<String, Object> getCache();
-
-
-    static CrossDCAwareCacheFactory getFactory(Cache<String, Object> workCache, Set<RemoteStore> remoteStores) {
-        if (remoteStores.isEmpty()) {
-            logger.debugf("No configured remoteStore available. Cross-DC scenario is not used");
-            return new InfinispanCacheWrapperFactory(workCache);
-        } else {
-            logger.debugf("RemoteStore is available. Cross-DC scenario will be used");
-
-            if (remoteStores.size() > 1) {
-                logger.warnf("More remoteStores configured for work cache. Will use just the first one");
-            }
-
-            // For cross-DC scenario, we need to return underlying remoteCache for atomic operations to work properly
-            RemoteStore remoteStore = remoteStores.iterator().next();
-            RemoteCache remoteCache = remoteStore.getRemoteCache();
-
-            if (remoteCache == null) {
-                String cacheName = remoteStore.getConfiguration().remoteCacheName();
-                throw new IllegalStateException("Remote cache '" + cacheName + "' is not available.");
-            }
-
-            return new RemoteCacheWrapperFactory(remoteCache);
-        }
-    }
-
-
-    // We don't have external JDG configured. No cross-DC.
-    private static class InfinispanCacheWrapperFactory extends CrossDCAwareCacheFactory {
-
-        private final Cache<String, Object> workCache;
-
-        InfinispanCacheWrapperFactory(Cache<String, Object> workCache) {
-            this.workCache = workCache;
-        }
-
-        @Override
-        BasicCache<String, Object> getCache() {
-            return workCache;
-        }
-
-    }
-
-
-    // We have external JDG configured. Cross-DC should be enabled
-    private static class RemoteCacheWrapperFactory extends CrossDCAwareCacheFactory {
-
-        private final RemoteCache<String, Object> remoteCache;
-
-        RemoteCacheWrapperFactory(RemoteCache<String, Object> remoteCache) {
-            this.remoteCache = remoteCache;
-        }
-
-        @Override
-        BasicCache<String, Object> getCache() {
-            // Flags are per-invocation!
-            return remoteCache.withFlags(Flag.FORCE_RETURN_VALUE);
-        }
-
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProvider.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProvider.java
index 0019f3de8960..db78685f7a52 100644
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProvider.java
@@ -19,17 +19,33 @@
 
 import java.util.Collection;
 import java.util.Collections;
+import java.util.List;
 import java.util.concurrent.Callable;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
 
+import org.infinispan.Cache;
+import org.infinispan.notifications.Listener;
+import org.infinispan.notifications.cachelistener.annotation.CacheEntryCreated;
+import org.infinispan.notifications.cachelistener.annotation.CacheEntryModified;
+import org.infinispan.notifications.cachelistener.annotation.CacheEntryRemoved;
+import org.infinispan.notifications.cachelistener.event.CacheEntryCreatedEvent;
+import org.infinispan.notifications.cachelistener.event.CacheEntryModifiedEvent;
+import org.infinispan.notifications.cachelistener.event.CacheEntryRemovedEvent;
 import org.jboss.logging.Logger;
 import org.keycloak.cluster.ClusterEvent;
 import org.keycloak.cluster.ClusterListener;
 import org.keycloak.cluster.ClusterProvider;
 import org.keycloak.cluster.ExecutionResult;
+import org.keycloak.common.util.ConcurrentMultivaluedHashMap;
 import org.keycloak.common.util.Retry;
+import org.keycloak.common.util.SecretGenerator;
+import org.keycloak.common.util.Time;
+import org.keycloak.connections.infinispan.TopologyInfo;
+import org.keycloak.models.sessions.infinispan.CacheDecorators;
 
 /**
  *
@@ -44,16 +60,18 @@ public class InfinispanClusterProvider implements ClusterProvider {
 
     private final int clusterStartupTime;
     private final String myAddress;
-    private final CrossDCAwareCacheFactory crossDCAwareCacheFactory;
-    private final InfinispanNotificationsManager notificationsManager; // Just to extract notifications related stuff to separate class
+    private final String mySite;
+    private final Cache<String, Object> workCache;
+    private final ConcurrentMultivaluedHashMap<String, ClusterListener> listeners = new ConcurrentMultivaluedHashMap<>();
+    private final ConcurrentMap<String, TaskCallback> taskCallbacks = new ConcurrentHashMap<>();
 
     private final ExecutorService localExecutor;
 
-    public InfinispanClusterProvider(int clusterStartupTime, String myAddress, CrossDCAwareCacheFactory crossDCAwareCacheFactory, InfinispanNotificationsManager notificationsManager, ExecutorService localExecutor) {
-        this.myAddress = myAddress;
+    public InfinispanClusterProvider(int clusterStartupTime, TopologyInfo topologyInfo, Cache<String, Object> workCache, ExecutorService localExecutor) {
+        this.myAddress = topologyInfo.getMyNodeName();
+        this.mySite = topologyInfo.getMySiteName();
         this.clusterStartupTime = clusterStartupTime;
-        this.crossDCAwareCacheFactory = crossDCAwareCacheFactory;
-        this.notificationsManager = notificationsManager;
+        this.workCache = workCache;
         this.localExecutor = localExecutor;
     }
 
@@ -95,7 +113,7 @@ public <T> ExecutionResult<T> executeIfNotExecuted(String taskKey, int taskTimeo
     @Override
     public Future<Boolean> executeIfNotExecutedAsync(String taskKey, int taskTimeoutInSeconds, Callable task) {
         TaskCallback newCallback = new TaskCallback();
-        TaskCallback callback = this.notificationsManager.registerTaskCallback(TASK_KEY_PREFIX + taskKey, newCallback);
+        TaskCallback callback = registerTaskCallback(TASK_KEY_PREFIX + taskKey, newCallback);
 
         // We successfully submitted our task
         if (newCallback == callback) {
@@ -119,26 +137,15 @@ public Future<Boolean> executeIfNotExecutedAsync(String taskKey, int taskTimeout
         return callback.getFuture();
     }
 
-
-    @Override
-    public void registerListener(String taskKey, ClusterListener task) {
-        this.notificationsManager.registerListener(taskKey, task);
-    }
-
-    @Override
-    public void notify(String taskKey, ClusterEvent event, boolean ignoreSender, DCNotify dcNotify) {
-        notificationsManager.notify(taskKey, Collections.singleton(event), ignoreSender, dcNotify);
-    }
-
-    @Override
-    public void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender, DCNotify dcNotify) {
-        notificationsManager.notify(taskKey, events, ignoreSender, dcNotify);
+    TaskCallback registerTaskCallback(String taskKey, TaskCallback callback) {
+        TaskCallback existing = taskCallbacks.putIfAbsent(taskKey, callback);
+        return existing == null ? callback : existing;
     }
 
     private boolean tryLock(String cacheKey, int taskTimeoutInSeconds) {
         LockEntry myLock = new LockEntry(myAddress);
 
-        LockEntry existingLock = InfinispanClusterProviderFactory.putIfAbsentWithRetries(crossDCAwareCacheFactory, cacheKey, myLock, taskTimeoutInSeconds);
+        LockEntry existingLock = (LockEntry) workCache.putIfAbsent(cacheKey, myLock, Time.toMillis(taskTimeoutInSeconds), TimeUnit.MILLISECONDS);
         if (existingLock != null) {
             if (logger.isTraceEnabled()) {
                 logger.tracef("Task %s in progress already by node %s. Ignoring task.", cacheKey, existingLock.node());
@@ -152,12 +159,11 @@ private boolean tryLock(String cacheKey, int taskTimeoutInSeconds) {
         }
     }
 
-
     private void removeFromCache(String cacheKey) {
         // More attempts to send the message (it may fail if some node fails in the meantime)
         Retry.executeWithBackoff((int iteration) -> {
 
-            crossDCAwareCacheFactory.getCache().remove(cacheKey);
+            CacheDecorators.ignoreReturnValues(workCache).remove(cacheKey);
             if (logger.isTraceEnabled()) {
                 logger.tracef("Task %s removed from the cache", cacheKey);
             }
@@ -165,4 +171,94 @@ private void removeFromCache(String cacheKey) {
         }, 10, 10);
     }
 
+    @Override
+    public void registerListener(String taskKey, ClusterListener task) {
+        this.listeners.add(taskKey, task);
+    }
+
+    @Override
+    public void notify(String taskKey, ClusterEvent event, boolean ignoreSender, DCNotify dcNotify) {
+        notify(taskKey, Collections.singleton(event), ignoreSender, dcNotify);
+    }
+
+    public void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender) {
+        notify(taskKey, events, ignoreSender, DCNotify.ALL_DCS);
+    }
+
+    @Override
+    public void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender, DCNotify dcNotify) {
+        if (events == null || events.isEmpty()) {
+            return;
+        }
+        var wrappedEvent = WrapperClusterEvent.wrap(taskKey, events, myAddress, mySite, dcNotify, ignoreSender);
+
+        String eventKey = SecretGenerator.getInstance().generateSecureID();
+
+        if (logger.isTraceEnabled()) {
+            logger.tracef("Sending event with key %s: %s", eventKey, events);
+        }
+
+        CacheDecorators.ignoreReturnValues(workCache)
+              .put(eventKey, wrappedEvent, 120, TimeUnit.SECONDS);
+    }
+
+    @Listener(observation = Listener.Observation.POST)
+    public class CacheEntryListener {
+
+        @CacheEntryCreated
+        public void cacheEntryCreated(CacheEntryCreatedEvent<String, Object> event) {
+            eventReceived(event.getKey(), event.getValue());
+        }
+
+        @CacheEntryModified
+        public void cacheEntryModified(CacheEntryModifiedEvent<String, Object> event) {
+            eventReceived(event.getKey(), event.getNewValue());
+        }
+
+        @CacheEntryRemoved
+        public void cacheEntryRemoved(CacheEntryRemovedEvent<String, Object> event) {
+            taskFinished(event.getKey());
+        }
+    }
+
+    private void eventReceived(String key, Object obj) {
+        if (!(obj instanceof WrapperClusterEvent event)) {
+            // Items with the TASK_KEY_PREFIX might be gone fast once the locking is complete, therefore, don't log them.
+            // It is still good to have the warning in case of real events return null because they have been, for example, expired
+            if (obj == null && !key.startsWith(TASK_KEY_PREFIX)) {
+                logger.warnf("Event object wasn't available in remote cache after event was received. Event key: %s", key);
+            }
+            return;
+        }
+
+        if (event.rejectEvent(myAddress, mySite)) {
+            return;
+        }
+
+        String eventKey = event.getEventKey();
+
+        if (logger.isTraceEnabled()) {
+            logger.tracef("Received event: %s", event);
+        }
+
+        List<ClusterListener> myListeners = listeners.get(eventKey);
+        if (myListeners != null) {
+            for (var e : event.getDelegateEvents()) {
+                myListeners.forEach(e);
+            }
+        }
+    }
+
+
+    void taskFinished(String taskKey) {
+        TaskCallback callback = taskCallbacks.remove(taskKey);
+
+        if (callback != null) {
+            if (logger.isDebugEnabled()) {
+                logger.debugf("Finished task '%s' with '%b'", taskKey, true);
+            }
+            callback.setSuccess(true);
+            callback.getTaskCompletedLatch().countDown();
+        }
+    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProviderFactory.java
index 662a63463e77..0f9b6ca1a08c 100644
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanClusterProviderFactory.java
@@ -22,26 +22,23 @@
 import java.util.Set;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
 
 import org.infinispan.Cache;
-import org.infinispan.client.hotrod.exceptions.HotRodClientException;
 import org.infinispan.configuration.cache.CacheMode;
+import org.infinispan.context.Flag;
 import org.infinispan.lifecycle.ComponentStatus;
 import org.infinispan.notifications.Listener;
 import org.infinispan.notifications.cachemanagerlistener.annotation.Merged;
 import org.infinispan.notifications.cachemanagerlistener.annotation.ViewChanged;
 import org.infinispan.notifications.cachemanagerlistener.event.MergeEvent;
 import org.infinispan.notifications.cachemanagerlistener.event.ViewChangedEvent;
-import org.infinispan.persistence.remote.RemoteStore;
 import org.infinispan.remoting.transport.Address;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.cluster.ClusterProvider;
 import org.keycloak.cluster.ClusterProviderFactory;
-import org.keycloak.common.util.Retry;
+import org.keycloak.common.Profile;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
@@ -61,16 +58,8 @@ public class InfinispanClusterProviderFactory implements ClusterProviderFactory,
 
     protected static final Logger logger = Logger.getLogger(InfinispanClusterProviderFactory.class);
 
-    // Infinispan cache
     private volatile Cache<String, Object> workCache;
-
-    // Ensure that atomic operations (like putIfAbsent) must work correctly in any of: non-clustered, clustered or cross-Data-Center (cross-DC) setups
-    private CrossDCAwareCacheFactory crossDCAwareCacheFactory;
-
-    private int clusterStartupTime;
-
-    // Just to extract notifications related stuff to separate class
-    private InfinispanNotificationsManager notificationsManager;
+    private volatile ClusterProvider clusterProvider;
 
     private final ExecutorService localExecutor = Executors.newCachedThreadPool(r -> {
         Thread thread = Executors.defaultThreadFactory().newThread(r);
@@ -82,40 +71,37 @@ public class InfinispanClusterProviderFactory implements ClusterProviderFactory,
 
     @Override
     public ClusterProvider create(KeycloakSession session) {
-        lazyInit(session);
-        String myAddress = InfinispanUtil.getTopologyInfo(session).getMyNodeName();
-        return new InfinispanClusterProvider(clusterStartupTime, myAddress, crossDCAwareCacheFactory, notificationsManager, localExecutor);
+        return lazyInit(session);
     }
 
-    private void lazyInit(KeycloakSession session) {
-        if (workCache == null) {
-            synchronized (this) {
-                if (workCache == null) {
-                    InfinispanConnectionProvider ispnConnections = session.getProvider(InfinispanConnectionProvider.class);
-                    workCache = ispnConnections.getCache(InfinispanConnectionProvider.WORK_CACHE_NAME);
+    private ClusterProvider lazyInit(KeycloakSession session) {
+        if (clusterProvider != null)
+            return clusterProvider;
 
-                    workCacheListener = new ViewChangeListener();
-                    workCache.getCacheManager().addListener(workCacheListener);
+        synchronized (this) {
+            if (clusterProvider != null)
+                return clusterProvider;
+            InfinispanConnectionProvider ispnConnections = session.getProvider(InfinispanConnectionProvider.class);
+            this.workCache = ispnConnections.getCache(InfinispanConnectionProvider.WORK_CACHE_NAME);
 
-                    // See if we have RemoteStore (external JDG) configured for cross-Data-Center scenario
-                    Set<RemoteStore> remoteStores = InfinispanUtil.getRemoteStores(workCache);
-                    crossDCAwareCacheFactory = CrossDCAwareCacheFactory.getFactory(workCache, remoteStores);
+            workCacheListener = new ViewChangeListener();
+            workCache.getCacheManager().addListener(workCacheListener);
 
-                    clusterStartupTime = initClusterStartupTime(session);
+            var clusterStartupTime = initClusterStartupTime(session);
+            TopologyInfo topologyInfo = InfinispanUtil.getTopologyInfo(session);
+            var cp = new InfinispanClusterProvider(clusterStartupTime, topologyInfo, workCache, localExecutor);
 
-                    TopologyInfo topologyInfo = InfinispanUtil.getTopologyInfo(session);
-                    String myAddress = topologyInfo.getMyNodeName();
-                    String mySite = topologyInfo.getMySiteName();
+            // We need CacheEntryListener for communication within current DC
+            workCache.addListener(cp.new CacheEntryListener());
+            logger.debugf("Added listener for infinispan cache: %s", workCache.getName());
 
-                    notificationsManager = InfinispanNotificationsManager.create(session, workCache, myAddress, mySite, remoteStores);
-                }
-            }
+            this.clusterProvider = cp;
+            return clusterProvider;
         }
     }
 
-
     protected int initClusterStartupTime(KeycloakSession session) {
-        Integer existingClusterStartTime = (Integer) crossDCAwareCacheFactory.getCache().get(InfinispanClusterProvider.CLUSTER_STARTUP_TIME_KEY);
+        Integer existingClusterStartTime = (Integer) workCache.get(InfinispanClusterProvider.CLUSTER_STARTUP_TIME_KEY);
         if (existingClusterStartTime != null) {
             logger.debugf("Loaded cluster startup time: %s", Time.toDate(existingClusterStartTime).toString());
             return existingClusterStartTime;
@@ -123,7 +109,7 @@ protected int initClusterStartupTime(KeycloakSession session) {
             // clusterStartTime not yet initialized. Let's try to put our startupTime
             int serverStartTime = (int) (session.getKeycloakSessionFactory().getServerStartupTimestamp() / 1000);
 
-            existingClusterStartTime = putIfAbsentWithRetries(crossDCAwareCacheFactory, InfinispanClusterProvider.CLUSTER_STARTUP_TIME_KEY, serverStartTime, -1);
+            existingClusterStartTime = (Integer) workCache.putIfAbsent(InfinispanClusterProvider.CLUSTER_STARTUP_TIME_KEY, serverStartTime);
             if (existingClusterStartTime == null) {
                 logger.debugf("Initialized cluster startup time to %s", Time.toDate(serverStartTime).toString());
                 return serverStartTime;
@@ -134,38 +120,6 @@ protected int initClusterStartupTime(KeycloakSession session) {
         }
     }
 
-
-    // Will retry few times for the case when backup site not available in cross-dc environment.
-    // The site might be taken offline automatically if "take-offline" properly configured
-    static <V> V putIfAbsentWithRetries(CrossDCAwareCacheFactory crossDCAwareCacheFactory, String key, V value, int taskTimeoutInSeconds) {
-        AtomicReference<V> resultRef = new AtomicReference<>();
-
-        Retry.executeWithBackoff(iteration -> {
-
-            try {
-                V result;
-                if (taskTimeoutInSeconds > 0) {
-                    long lifespanMs = InfinispanUtil.toHotrodTimeMs(crossDCAwareCacheFactory.getCache(), Time.toMillis(taskTimeoutInSeconds));
-                    result = (V) crossDCAwareCacheFactory.getCache().putIfAbsent(key, value, lifespanMs, TimeUnit.MILLISECONDS);
-                } else {
-                    result = (V) crossDCAwareCacheFactory.getCache().putIfAbsent(key, value);
-                }
-                resultRef.set(result);
-
-            } catch (HotRodClientException re) {
-                logger.warnf(re, "Failed to write key '%s' and value '%s' in iteration '%d' . Retrying", key, value, iteration);
-
-                // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                throw re;
-            }
-
-        }, 10, 10);
-
-        return resultRef.get();
-    }
-
-
-
     @Override
     public void init(Config.Scope config) {
     }
@@ -201,15 +155,25 @@ public class ViewChangeListener {
 
         @Merged
         public void mergeEvent(MergeEvent event) {
-           // During split-brain only Keycloak instances contained within the same partition will receive updates via
-           // the work cache. On split-brain heal it's necessary for us to clear all local caches so that potentially
-           // stale values are invalidated and subsequent requests are forced to read from the DB.
-           localExecutor.execute(() ->
-              Arrays.stream(InfinispanConnectionProvider.LOCAL_CACHE_NAMES)
-                    .map(name -> workCache.getCacheManager().getCache(name))
-                    .filter(cache -> cache.getCacheConfiguration().clustering().cacheMode() == CacheMode.LOCAL)
-                    .forEach(Cache::clear)
-           );
+            // During split-brain only Keycloak instances contained within the same partition will receive updates via
+            // the work cache. On split-brain healing, it's necessary for us to clear all local caches so that potentially
+            // stale values are invalidated and subsequent requests are forced to read from the DB.
+            localExecutor.execute(() ->
+                    Arrays.stream(InfinispanConnectionProvider.LOCAL_CACHE_NAMES)
+                            .map(name -> workCache.getCacheManager().getCache(name))
+                            .filter(cache -> cache.getCacheConfiguration().clustering().cacheMode() == CacheMode.LOCAL)
+                            .forEach(Cache::clear)
+            );
+
+            if (Profile.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS)) {
+                // If persistent user sessions are enabled, the reasoning from above is true for the user and client sessions as well.
+                // As the session caches are distributed caches and as this runs on every node, run it locally on each node.
+                localExecutor.execute(() ->
+                        Arrays.stream(InfinispanConnectionProvider.USER_AND_CLIENT_SESSION_CACHES)
+                                .map(name -> workCache.getCacheManager().getCache(name).getAdvancedCache().withFlags(Flag.CACHE_MODE_LOCAL))
+                                .forEach(Cache::clear)
+                );
+            }
         }
 
         @ViewChanged
@@ -247,8 +211,5 @@ public void viewChanged(ViewChangedEvent event) {
         private Set<String> convertAddresses(Collection<Address> addresses) {
             return addresses.stream().map(Object::toString).collect(Collectors.toSet());
         }
-
     }
-
-
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanNotificationsManager.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanNotificationsManager.java
deleted file mode 100644
index a62c0fead209..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/InfinispanNotificationsManager.java
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.cluster.infinispan;
-
-import java.util.Collection;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.RejectedExecutionException;
-import java.util.concurrent.TimeUnit;
-import java.util.function.Supplier;
-
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryCreated;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryModified;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryRemoved;
-import org.infinispan.client.hotrod.annotation.ClientListener;
-import org.infinispan.client.hotrod.event.ClientCacheEntryCreatedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryModifiedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryRemovedEvent;
-import org.infinispan.client.hotrod.exceptions.HotRodClientException;
-import org.infinispan.context.Flag;
-import org.infinispan.notifications.Listener;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryCreated;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryModified;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryRemoved;
-import org.infinispan.notifications.cachelistener.event.CacheEntryCreatedEvent;
-import org.infinispan.notifications.cachelistener.event.CacheEntryModifiedEvent;
-import org.infinispan.notifications.cachelistener.event.CacheEntryRemovedEvent;
-import org.infinispan.persistence.remote.RemoteStore;
-import org.jboss.logging.Logger;
-import org.keycloak.cluster.ClusterEvent;
-import org.keycloak.cluster.ClusterListener;
-import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.common.util.ConcurrentMultivaluedHashMap;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory;
-import org.keycloak.executors.ExecutorsProvider;
-import org.keycloak.models.KeycloakSession;
-
-import static org.keycloak.cluster.infinispan.InfinispanClusterProvider.TASK_KEY_PREFIX;
-
-/**
- * Impl for sending infinispan messages across cluster and listening to them
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class InfinispanNotificationsManager {
-
-    protected static final Logger logger = Logger.getLogger(InfinispanNotificationsManager.class);
-
-    private static final int BACKOFF_BASE_MILLIS = 10;
-    private static final int MAX_BACKOFF_RETRIES = 10;
-
-    private final ConcurrentMultivaluedHashMap<String, ClusterListener> listeners = new ConcurrentMultivaluedHashMap<>();
-
-    private final ConcurrentMap<String, TaskCallback> taskCallbacks = new ConcurrentHashMap<>();
-
-    private final Cache<String, Object> workCache;
-
-    private final RemoteCache<String, Object> workRemoteCache;
-
-    private final String myAddress;
-
-    private final String mySite;
-
-    private final ExecutorService listenersExecutor;
-
-    protected InfinispanNotificationsManager(Cache<String, Object> workCache, RemoteCache<String, Object> workRemoteCache, String myAddress, String mySite, ExecutorService listenersExecutor) {
-        this.workCache = workCache;
-        this.workRemoteCache = workRemoteCache;
-        this.myAddress = myAddress;
-        this.mySite = mySite;
-        this.listenersExecutor = listenersExecutor;
-    }
-
-
-    // Create and init manager including all listeners etc
-    public static InfinispanNotificationsManager create(KeycloakSession session, Cache<String, Object> workCache, String myAddress, String mySite, Set<RemoteStore> remoteStores) {
-        RemoteCache<String, Object> workRemoteCache = null;
-
-        if (!remoteStores.isEmpty()) {
-            RemoteStore remoteStore = remoteStores.iterator().next();
-            workRemoteCache = remoteStore.getRemoteCache();
-
-            if (mySite == null) {
-                throw new IllegalStateException("Multiple datacenters available, but site name is not configured! Check your configuration");
-            }
-        }
-
-        ExecutorService listenersExecutor = workRemoteCache==null ? null : session.getProvider(ExecutorsProvider.class).getExecutor("work-cache-event-listener");
-        InfinispanNotificationsManager manager = new InfinispanNotificationsManager(workCache, workRemoteCache, myAddress, mySite, listenersExecutor);
-
-        // We need CacheEntryListener for communication within current DC
-        workCache.addListener(manager.new CacheEntryListener());
-        logger.debugf("Added listener for infinispan cache: %s", workCache.getName());
-
-        // Added listener for remoteCache to notify other DCs
-        if (workRemoteCache != null) {
-            workRemoteCache.addClientListener(manager.new HotRodListener(workRemoteCache));
-            logger.debugf("Added listener for HotRod remoteStore cache: %s", workRemoteCache.getName());
-        }
-
-        return manager;
-    }
-
-
-    void registerListener(String taskKey, ClusterListener task) {
-        listeners.add(taskKey, task);
-    }
-
-
-    TaskCallback registerTaskCallback(String taskKey, TaskCallback callback) {
-        TaskCallback existing = taskCallbacks.putIfAbsent(taskKey, callback);
-
-        if (existing != null) {
-            return existing;
-        } else {
-            return callback;
-        }
-    }
-
-
-    void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender, ClusterProvider.DCNotify dcNotify) {
-        if (events == null || events.isEmpty()) {
-            return;
-        }
-        var wrappedEvent = WrapperClusterEvent.wrap(taskKey, events, myAddress, mySite, dcNotify, ignoreSender);
-
-        String eventKey = UUID.randomUUID().toString();
-
-        if (logger.isTraceEnabled()) {
-            logger.tracef("Sending event with key %s: %s", eventKey, events);
-        }
-
-        if (dcNotify == ClusterProvider.DCNotify.LOCAL_DC_ONLY || workRemoteCache == null) {
-            // Just put it to workCache, but skip notifying remoteCache
-            workCache.getAdvancedCache().withFlags(Flag.IGNORE_RETURN_VALUES, Flag.SKIP_CACHE_STORE)
-                    .put(eventKey, wrappedEvent, 120, TimeUnit.SECONDS);
-        } else {
-            // Add directly to remoteCache. Will notify remote listeners on all nodes in all DCs
-            Retry.executeWithBackoff((int iteration) -> {
-                try {
-                    DefaultInfinispanConnectionProviderFactory.runWithReadLockOnCacheManager(() ->
-                            workRemoteCache.put(eventKey, wrappedEvent, 120, TimeUnit.SECONDS)
-                    );
-                } catch (HotRodClientException re) {
-                if (logger.isDebugEnabled()) {
-                    logger.debugf(re, "Failed sending notification to remote cache '%s'. Key: '%s', iteration '%s'. Will try to retry the task",
-                            workRemoteCache.getName(), eventKey, iteration);
-                }
-
-                // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                throw re;
-            }
-
-        }, 10, 10);
-
-        }
-    }
-
-
-    @Listener(observation = Listener.Observation.POST)
-    public class CacheEntryListener {
-
-        @CacheEntryCreated
-        public void cacheEntryCreated(CacheEntryCreatedEvent<String, Object> event) {
-            eventReceived(event.getKey(), event.getValue());
-        }
-
-        @CacheEntryModified
-        public void cacheEntryModified(CacheEntryModifiedEvent<String, Object> event) {
-            eventReceived(event.getKey(), event.getNewValue());
-        }
-
-        @CacheEntryRemoved
-        public void cacheEntryRemoved(CacheEntryRemovedEvent<String, Object> event) {
-            taskFinished(event.getKey());
-        }
-
-    }
-
-
-    @ClientListener
-    public class HotRodListener {
-
-        private final RemoteCache<String, Object> remoteCache;
-
-        public HotRodListener(RemoteCache<String, Object> remoteCache) {
-            this.remoteCache = remoteCache;
-        }
-
-
-        @ClientCacheEntryCreated
-        public void created(ClientCacheEntryCreatedEvent<String> event) {
-            hotrodEventReceived(event.getKey());
-        }
-
-
-        @ClientCacheEntryModified
-        public void updated(ClientCacheEntryModifiedEvent<String> event) {
-            hotrodEventReceived(event.getKey());
-        }
-
-
-        @ClientCacheEntryRemoved
-        public void removed(ClientCacheEntryRemovedEvent<String> event) {
-            taskFinished(event.getKey());
-        }
-
-
-        private void hotrodEventReceived(String key) {
-            // TODO: Look at CacheEventConverter stuff to possibly include value in the event and avoid additional remoteCache request
-            try {
-                listenersExecutor.submit(() -> {
-                    Supplier<Object> fetchEvent = () -> remoteCache.get(key);
-                    Object event = DefaultInfinispanConnectionProviderFactory.runWithReadLockOnCacheManager(fetchEvent);
-                    int iteration = 0;
-                    // Event might have been generated from a node which is more up-to-date, so the fetch might return null.
-                    // Retry until we find a node that is up-to-date and has the entry.
-                    while (event == null && iteration < MAX_BACKOFF_RETRIES) {
-                        ++iteration;
-                        try {
-                            Thread.sleep(Retry.computeBackoffInterval(BACKOFF_BASE_MILLIS, iteration));
-                        } catch (InterruptedException e) {
-                            Thread.currentThread().interrupt();
-                            return;
-                        }
-                        event = DefaultInfinispanConnectionProviderFactory.runWithReadLockOnCacheManager(fetchEvent);
-                    }
-                    eventReceived(key, event);
-
-                });
-            } catch (RejectedExecutionException ree) {
-                // server is shutting down or pool was terminated - don't throw errors
-                if (ree.getMessage() != null && (ree.getMessage().contains("Terminated") || ree.getMessage().contains("Shutting down"))) {
-                    logger.warnf("Rejected submitting of the event for key: %s because server is shutting down or pool was terminated.", key);
-                    logger.debug(ree);
-                } else {
-                    // avoid touching the cache when creating a log message to avoid a deadlock in Infinispan 12.1.7.Final
-                    logger.errorf("Rejected submitting of the event for key: %s. Server going to shutdown or pool exhausted. Pool: %s", key, listenersExecutor.toString());
-                    throw ree;
-                }
-            }
-        }
-    }
-
-    private void eventReceived(String key, Object obj) {
-        if (!(obj instanceof WrapperClusterEvent event)) {
-            // Items with the TASK_KEY_PREFIX might be gone fast once the locking is complete, therefore, don't log them.
-            // It is still good to have the warning in case of real events return null because they have been, for example, expired
-            if (obj == null && !key.startsWith(TASK_KEY_PREFIX)) {
-                logger.warnf("Event object wasn't available in remote cache after event was received. Event key: %s", key);
-            }
-            return;
-        }
-
-        if (event.rejectEvent(myAddress, mySite)) {
-            return;
-        }
-
-        String eventKey = event.getEventKey();
-
-        if (logger.isTraceEnabled()) {
-            logger.tracef("Received event: %s", event);
-        }
-
-        List<ClusterListener> myListeners = listeners.get(eventKey);
-        if (myListeners != null) {
-            for (var e : event.getDelegateEvents()) {
-                myListeners.forEach(e);
-            }
-        }
-    }
-
-
-    void taskFinished(String taskKey) {
-        TaskCallback callback = taskCallbacks.remove(taskKey);
-
-        if (callback != null) {
-            if (logger.isDebugEnabled()) {
-                logger.debugf("Finished task '%s' with '%b'", taskKey, true);
-            }
-            callback.setSuccess(true);
-            callback.getTaskCompletedLatch().countDown();
-        }
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanClusterProvider.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanClusterProvider.java
index bf530cdf5130..c1996ef6428f 100644
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanClusterProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanClusterProvider.java
@@ -117,6 +117,11 @@ public void notify(String taskKey, ClusterEvent event, boolean ignoreSender, DCN
         data.notificationManager().notify(taskKey, Collections.singleton(event), ignoreSender, dcNotify);
     }
 
+    @Override
+    public void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender) {
+        data.notificationManager().notify(taskKey, events, ignoreSender, DCNotify.ALL_DCS);
+    }
+
     @Override
     public void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender, DCNotify dcNotify) {
         data.notificationManager().notify(taskKey, events, ignoreSender, dcNotify);
diff --git a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanNotificationManager.java b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanNotificationManager.java
index 53b4d0a52c73..3e1f20dc711a 100644
--- a/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanNotificationManager.java
+++ b/model/infinispan/src/main/java/org/keycloak/cluster/infinispan/remote/RemoteInfinispanNotificationManager.java
@@ -20,7 +20,6 @@
 import java.lang.invoke.MethodHandles;
 import java.util.Collection;
 import java.util.List;
-import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.Executor;
@@ -43,6 +42,7 @@
 import org.keycloak.cluster.infinispan.WrapperClusterEvent;
 import org.keycloak.common.util.ConcurrentMultivaluedHashMap;
 import org.keycloak.common.util.Retry;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.connections.infinispan.TopologyInfo;
 
 import static org.keycloak.cluster.infinispan.InfinispanClusterProvider.TASK_KEY_PREFIX;
@@ -90,7 +90,7 @@ public void notify(String taskKey, Collection<? extends ClusterEvent> events, bo
         }
         var wrappedEvent = WrapperClusterEvent.wrap(taskKey, events, topologyInfo.getMyNodeName(), topologyInfo.getMySiteName(), dcNotify, ignoreSender);
 
-        var eventKey = UUID.randomUUID().toString();
+        var eventKey = SecretGenerator.getInstance().generateSecureID();
 
         if (logger.isTraceEnabled()) {
             logger.tracef("Sending event with key %s: %s", eventKey, events);
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProvider.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProvider.java
index 5634657aa1af..e942de6f5cdb 100644
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProvider.java
@@ -37,12 +37,10 @@
 public class DefaultInfinispanConnectionProvider implements InfinispanConnectionProvider {
 
     private final EmbeddedCacheManager cacheManager;
-    private final RemoteCacheProvider remoteCacheProvider;
     private final TopologyInfo topologyInfo;
 
-    public DefaultInfinispanConnectionProvider(EmbeddedCacheManager cacheManager, RemoteCacheProvider remoteCacheProvider, TopologyInfo topologyInfo) {
+    public DefaultInfinispanConnectionProvider(EmbeddedCacheManager cacheManager, TopologyInfo topologyInfo) {
         this.cacheManager = cacheManager;
-        this.remoteCacheProvider = remoteCacheProvider;
         this.topologyInfo = topologyInfo;
     }
 
@@ -61,7 +59,7 @@ public <K, V> Cache<K, V> getCache(String name, boolean createIfAbsent) {
 
     @Override
     public <K, V> RemoteCache<K, V> getRemoteCache(String cacheName) {
-        return remoteCacheProvider.getRemoteCache(cacheName);
+        throw new IllegalStateException("Remote stores cannot be used with Embedded Infinispan.");
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProviderFactory.java
index 9247fc4a9fbf..6ff30a16060e 100755
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProviderFactory.java
@@ -17,78 +17,55 @@
 
 package org.keycloak.connections.infinispan;
 
-import java.util.Arrays;
-import java.util.Iterator;
-import java.util.ServiceLoader;
+import java.util.List;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReadWriteLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock;
-import java.util.function.Supplier;
 
-import org.infinispan.client.hotrod.ProtocolVersion;
 import org.infinispan.client.hotrod.RemoteCacheManager;
-import org.infinispan.commons.dataconversion.MediaType;
-import org.infinispan.configuration.cache.CacheMode;
 import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
 import org.infinispan.eviction.EvictionStrategy;
 import org.infinispan.manager.DefaultCacheManager;
 import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.persistence.remote.configuration.RemoteStoreConfigurationBuilder;
-import org.infinispan.transaction.LockingMode;
-import org.infinispan.transaction.TransactionMode;
-import org.infinispan.transaction.lookup.EmbeddedTransactionManagerLookup;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.cluster.ClusterEvent;
 import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.cluster.ManagedCacheManagerProvider;
 import org.keycloak.connections.infinispan.remote.RemoteInfinispanConnectionProvider;
-import org.keycloak.connections.jpa.JpaConnectionProvider;
 import org.keycloak.infinispan.util.InfinispanUtils;
-import org.keycloak.marshalling.Marshalling;
+import org.keycloak.marshalling.KeycloakIndexSchemaUtil;
+import org.keycloak.marshalling.KeycloakModelSchema;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.cache.infinispan.ClearCacheEvent;
 import org.keycloak.models.cache.infinispan.events.RealmRemovedEvent;
 import org.keycloak.models.cache.infinispan.events.RealmUpdatedEvent;
+import org.keycloak.models.sessions.infinispan.query.ClientSessionQueries;
+import org.keycloak.models.sessions.infinispan.query.UserSessionQueries;
+import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanAuthenticationSessionProviderFactory;
+import org.keycloak.models.sessions.infinispan.remote.RemoteUserLoginFailureProviderFactory;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.PostMigrationEvent;
 import org.keycloak.provider.InvalidationHandler.ObjectType;
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderEvent;
+import org.keycloak.provider.ProviderEventListener;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProvider;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProvider;
+import org.keycloak.spi.infinispan.impl.embedded.CacheConfigurator;
 
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.ACTION_TOKEN_CACHE;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_REVISIONS_CACHE_DEFAULT_MAX;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_REVISIONS_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLUSTERED_CACHE_NAMES;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.JGROUPS_BIND_ADDR;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.JGROUPS_UDP_MCAST_ADDR;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.JMX_DOMAIN;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CRL_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.KEYS_CACHE_DEFAULT_MAX;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.KEYS_CACHE_MAX_IDLE_SECONDS;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.KEYS_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_REVISIONS_CACHE_DEFAULT_MAX;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_REVISIONS_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_REVISIONS_CACHE_DEFAULT_MAX;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_REVISIONS_CACHE_NAME;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.WORK_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.skipSessionsCacheIfRequired;
-import static org.keycloak.connections.infinispan.InfinispanUtil.configureTransport;
-import static org.keycloak.connections.infinispan.InfinispanUtil.createCacheConfigurationBuilder;
-import static org.keycloak.connections.infinispan.InfinispanUtil.getActionTokenCacheConfig;
 import static org.keycloak.connections.infinispan.InfinispanUtil.setTimeServiceToKeycloakTime;
 import static org.keycloak.models.cache.infinispan.InfinispanCacheRealmProviderFactory.REALM_CLEAR_CACHE_EVENTS;
 import static org.keycloak.models.cache.infinispan.InfinispanCacheRealmProviderFactory.REALM_INVALIDATION_EVENTS;
@@ -96,7 +73,7 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class DefaultInfinispanConnectionProviderFactory implements InfinispanConnectionProviderFactory {
+public class DefaultInfinispanConnectionProviderFactory implements InfinispanConnectionProviderFactory, ProviderEventListener {
 
     private static final ReadWriteLock READ_WRITE_LOCK = new ReentrantReadWriteLock();
     private static final Logger logger = Logger.getLogger(DefaultInfinispanConnectionProviderFactory.class);
@@ -105,22 +82,13 @@ public class DefaultInfinispanConnectionProviderFactory implements InfinispanCon
 
     private volatile EmbeddedCacheManager cacheManager;
 
-    private volatile RemoteCacheProvider remoteCacheProvider;
-
-    protected volatile boolean containerManaged;
-
-    private volatile TopologyInfo topologyInfo;
-
     private volatile RemoteCacheManager remoteCacheManager;
 
+    private volatile InfinispanConnectionProvider connectionProvider;
+
     @Override
     public InfinispanConnectionProvider create(KeycloakSession session) {
-        lazyInit(session);
-
-        return InfinispanUtils.isRemoteInfinispan() ?
-                new RemoteInfinispanConnectionProvider(cacheManager, remoteCacheManager, topologyInfo) :
-                new DefaultInfinispanConnectionProvider(cacheManager, remoteCacheProvider, topologyInfo);
-
+        return lazyInit(session);
     }
 
     /*
@@ -139,16 +107,6 @@ public static void runWithReadLockOnCacheManager(Runnable task) {
         }
     }
 
-    public static <T> T runWithReadLockOnCacheManager(Supplier<T> task) {
-        Lock lock = DefaultInfinispanConnectionProviderFactory.READ_WRITE_LOCK.readLock();
-        lock.lock();
-        try {
-            return task.get();
-        } finally {
-            lock.unlock();
-        }
-    }
-
     public static void runWithWriteLockOnCacheManager(Runnable task) {
         Lock lock = DefaultInfinispanConnectionProviderFactory.READ_WRITE_LOCK.writeLock();
         lock.lock();
@@ -165,11 +123,13 @@ public void close() {
         runWithWriteLockOnCacheManager(() -> {
             if (cacheManager != null) {
                 cacheManager.stop();
-            }
-            if (remoteCacheProvider != null) {
-                remoteCacheProvider.stop();
+                cacheManager = null;
             }
         });
+        if (remoteCacheManager != null) {
+            remoteCacheManager.close();
+            remoteCacheManager = null;
+        }
     }
 
     @Override
@@ -184,285 +144,88 @@ public void init(Config.Scope config) {
 
     @Override
     public void postInit(KeycloakSessionFactory factory) {
-        factory.register((ProviderEvent event) -> {
-            if (event instanceof PostMigrationEvent) {
-                KeycloakModelUtils.runJobInTransaction(factory, this::registerSystemWideListeners);
-            }
-        });
+        factory.register(this);
     }
 
-    protected void lazyInit(KeycloakSession keycloakSession) {
-        if (cacheManager == null) {
-            synchronized (this) {
-                if (cacheManager == null) {
-                    EmbeddedCacheManager managedCacheManager = null;
-                    RemoteCacheManager rcm = null;
-                    Iterator<ManagedCacheManagerProvider> providers = ServiceLoader.load(ManagedCacheManagerProvider.class, DefaultInfinispanConnectionProvider.class.getClassLoader())
-                            .iterator();
-
-                    if (providers.hasNext()) {
-                        ManagedCacheManagerProvider provider = providers.next();
-
-                        if (providers.hasNext()) {
-                            throw new RuntimeException("Multiple " + org.keycloak.cluster.ManagedCacheManagerProvider.class + " providers found.");
-                        }
-
-                        managedCacheManager = provider.getEmbeddedCacheManager(keycloakSession, config);
-                        if (InfinispanUtils.isRemoteInfinispan()) {
-                            rcm = provider.getRemoteCacheManager(config);
-                        }
-                    }
-
-                    // store it in a locale variable first, so it is not visible to the outside, yet
-                    EmbeddedCacheManager localCacheManager;
-                    if (managedCacheManager == null) {
-                        if (!config.getBoolean("embedded", false)) {
-                            throw new RuntimeException("No " + ManagedCacheManagerProvider.class.getName() + " found. If running in embedded mode set the [embedded] property to this provider.");
-                        }
-                        localCacheManager = initEmbedded();
-                        if (InfinispanUtils.isRemoteInfinispan()) {
-                            rcm = initRemote();
-                        }
-                    } else {
-                        localCacheManager = initContainerManaged(managedCacheManager);
-                    }
-
-                    logger.infof(topologyInfo.toString());
-
-                    remoteCacheProvider = new RemoteCacheProvider(config, localCacheManager);
-                    // only set the cache manager attribute at the very end to avoid passing a half-initialized entry callers
-                    cacheManager = localCacheManager;
-                    remoteCacheManager = rcm;
-                }
-            }
+    protected InfinispanConnectionProvider lazyInit(KeycloakSession keycloakSession) {
+        if (connectionProvider != null) {
+            return connectionProvider;
         }
-    }
-
-    private RemoteCacheManager initRemote() {
-        var host = config.get("remoteStoreHost", "127.0.0.1");
-        var port = config.getInt("remoteStorePort", 11222);
-
-        org.infinispan.client.hotrod.configuration.ConfigurationBuilder builder = new org.infinispan.client.hotrod.configuration.ConfigurationBuilder();
-        builder.addServer().host(host).port(port);
-        builder.connectionPool().maxActive(16).exhaustedAction(org.infinispan.client.hotrod.configuration.ExhaustedAction.CREATE_NEW);
-
-        Marshalling.configure(builder);
-
-        RemoteCacheManager remoteCacheManager = new RemoteCacheManager(builder.build());
-
-        // establish connection to all caches
-        skipSessionsCacheIfRequired(Arrays.stream(CLUSTERED_CACHE_NAMES)).forEach(remoteCacheManager::getCache);
-        return remoteCacheManager;
-
-    }
-
-    protected EmbeddedCacheManager initContainerManaged(EmbeddedCacheManager cacheManager) {
-        containerManaged = true;
-
-        defineRevisionCache(cacheManager, REALM_CACHE_NAME, REALM_REVISIONS_CACHE_NAME, REALM_REVISIONS_CACHE_DEFAULT_MAX);
-        defineRevisionCache(cacheManager, USER_CACHE_NAME, USER_REVISIONS_CACHE_NAME, USER_REVISIONS_CACHE_DEFAULT_MAX);
-        defineRevisionCache(cacheManager, AUTHORIZATION_CACHE_NAME, AUTHORIZATION_REVISIONS_CACHE_NAME, AUTHORIZATION_REVISIONS_CACHE_DEFAULT_MAX);
-
-        cacheManager.getCache(KEYS_CACHE_NAME, true);
-
-        this.topologyInfo = new TopologyInfo(cacheManager, config, false, getId());
-
-        logger.debugv("Using container managed Infinispan cache container, lookup={0}", cacheManager);
-
-        return cacheManager;
-    }
-
-    protected EmbeddedCacheManager initEmbedded() {
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-
-        boolean clustered = config.getBoolean("clustered", false);
-        boolean async = config.getBoolean("async", false);
-        boolean useKeycloakTimeService = config.getBoolean("useKeycloakTimeService", false);
-
-        this.topologyInfo = new TopologyInfo(cacheManager, config, true, getId());
-
-        if (clustered) {
-            String jgroupsUdpMcastAddr = config.get("jgroupsUdpMcastAddr", System.getProperty(JGROUPS_UDP_MCAST_ADDR));
-            String jgroupsBindAddr = config.get("jgroupsBindAddr", System.getProperty(JGROUPS_BIND_ADDR));
-            configureTransport(gcb, topologyInfo.getMyNodeName(), topologyInfo.getMySiteName(), jgroupsUdpMcastAddr, jgroupsBindAddr,
-                    "default-configs/default-keycloak-jgroups-udp.xml");
-            gcb.jmx()
-              .domain(JMX_DOMAIN + "-" + topologyInfo.getMyNodeName()).enable();
-        } else {
-            gcb.jmx().domain(JMX_DOMAIN).enable();
-        }
-
-        Marshalling.configure(gcb);
-
-        if (InfinispanUtils.isRemoteInfinispan()) {
-            // Disable JGroups, not required when the data is stored in the Remote Cache.
-            // The existing caches are local and do not require JGroups to work properly.
-            gcb.nonClusteredDefault();
-        }
-
-        EmbeddedCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-        if (useKeycloakTimeService) {
-            setTimeServiceToKeycloakTime(cacheManager);
-        }
-        containerManaged = false;
-
-        logger.debug("Started embedded Infinispan cache container");
-
-        var localConfiguration = createCacheConfigurationBuilder().build();
-
-        // local caches first
-        defineLocalCache(cacheManager, REALM_CACHE_NAME, REALM_REVISIONS_CACHE_NAME, localConfiguration, REALM_REVISIONS_CACHE_DEFAULT_MAX);
-        defineLocalCache(cacheManager, AUTHORIZATION_CACHE_NAME, AUTHORIZATION_REVISIONS_CACHE_NAME, localConfiguration, AUTHORIZATION_REVISIONS_CACHE_DEFAULT_MAX);
-        defineLocalCache(cacheManager, USER_CACHE_NAME, USER_REVISIONS_CACHE_NAME, localConfiguration, USER_REVISIONS_CACHE_DEFAULT_MAX);
-
-        cacheManager.defineConfiguration(KEYS_CACHE_NAME, getKeysCacheConfig());
-        cacheManager.getCache(KEYS_CACHE_NAME, true);
-
-        var builder = createCacheConfigurationBuilder();
-        if (clustered) {
-            builder.simpleCache(false);
-            String sessionsMode = config.get("sessionsMode", "distributed");
-            if (sessionsMode.equalsIgnoreCase("replicated")) {
-                builder.clustering().cacheMode(async ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC);
-            } else if (sessionsMode.equalsIgnoreCase("distributed")) {
-                builder.clustering().cacheMode(async ? CacheMode.DIST_ASYNC : CacheMode.DIST_SYNC);
-            } else {
-                throw new RuntimeException("Invalid value for sessionsMode");
+        synchronized (this) {
+            if (connectionProvider != null) {
+                return connectionProvider;
             }
 
-            int owners = config.getInt("sessionsOwners", 2);
-            logger.debugf("Session owners: %d", owners);
-
-            int l1Lifespan = config.getInt("l1Lifespan", 600000);
-            boolean l1Enabled = l1Lifespan > 0;
-            Boolean awaitInitialTransfer = config.getBoolean("awaitInitialTransfer", true);
-            builder.clustering()
-                    .hash()
-                        .numOwners(owners)
-                        .numSegments(config.getInt("sessionsSegments", 60))
-                    .l1()
-                        .enabled(l1Enabled)
-                        .lifespan(l1Lifespan)
-                    .stateTransfer().awaitInitialTransfer(awaitInitialTransfer).timeout(30, TimeUnit.SECONDS);
-        }
-
-        if (InfinispanUtils.isEmbeddedInfinispan()) {
-            // Base configuration doesn't contain any remote stores
-            var clusteredConfiguration = builder.build();
-
-            defineClusteredCache(cacheManager, USER_SESSION_CACHE_NAME, clusteredConfiguration);
-            defineClusteredCache(cacheManager, OFFLINE_USER_SESSION_CACHE_NAME, clusteredConfiguration);
-            defineClusteredCache(cacheManager, CLIENT_SESSION_CACHE_NAME, clusteredConfiguration);
-            defineClusteredCache(cacheManager, OFFLINE_CLIENT_SESSION_CACHE_NAME, clusteredConfiguration);
+            this.cacheManager = createEmbeddedCacheManager(keycloakSession);
+            injectKeycloakTimeService(cacheManager);
+            var topologyInfo = new TopologyInfo(cacheManager);
+            logger.infof(topologyInfo.toString());
 
-            defineClusteredCache(cacheManager, LOGIN_FAILURE_CACHE_NAME, clusteredConfiguration);
-            defineClusteredCache(cacheManager, AUTHENTICATION_SESSIONS_CACHE_NAME, clusteredConfiguration);
-
-            var actionTokenBuilder = getActionTokenCacheConfig();
-            if (clustered) {
-                actionTokenBuilder.simpleCache(false);
-                actionTokenBuilder.clustering().cacheMode(async ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC);
-            }
-            defineClusteredCache(cacheManager, ACTION_TOKEN_CACHE, actionTokenBuilder.build());
+            this.remoteCacheManager = createRemoteCacheManager(keycloakSession);
+            this.connectionProvider = InfinispanUtils.isRemoteInfinispan() ?
+                  new RemoteInfinispanConnectionProvider(cacheManager, remoteCacheManager, topologyInfo) :
+                  new DefaultInfinispanConnectionProvider(cacheManager, topologyInfo);
 
-            var workBuilder = createCacheConfigurationBuilder()
-                    .expiration().enableReaper().wakeUpInterval(15, TimeUnit.SECONDS);
-            if (clustered) {
-                workBuilder.simpleCache(false);
-                workBuilder.clustering().cacheMode(async ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC);
-            }
-            defineClusteredCache(cacheManager, WORK_CACHE_NAME, workBuilder.build());
+            return connectionProvider;
         }
-
-        return cacheManager;
     }
 
-    private void defineLocalCache(EmbeddedCacheManager cacheManager, String cacheName, String revCacheName, Configuration configuration, long defaultMaxEntries) {
-        cacheManager.defineConfiguration(cacheName, configuration);
-        defineRevisionCache(cacheManager, cacheName, revCacheName, defaultMaxEntries);
-    }
+    protected EmbeddedCacheManager createEmbeddedCacheManager(KeycloakSession session) {
+        var holder = session.getProvider(CacheEmbeddedConfigProvider.class).configuration();
+        var cm = new DefaultCacheManager(holder, true);
+        cm.getCache(KEYS_CACHE_NAME, true);
+        cm.getCache(CRL_CACHE_NAME, true);
 
-    private void defineRevisionCache(EmbeddedCacheManager cacheManager, String cacheName, String revCacheName, long defaultMaxEntries) {
-        var maxCount = cacheManager.getCache(cacheName).getCacheConfiguration().memory().maxCount();
-        maxCount = maxCount > 0 ? 2 * maxCount : defaultMaxEntries;
-        cacheManager.defineConfiguration(revCacheName, getRevisionCacheConfig(maxCount));
-        cacheManager.getCache(revCacheName);
+        logger.debugv("Using container managed Infinispan cache container, lookup={0}", cm);
+        return cm;
     }
 
-    private void defineClusteredCache(EmbeddedCacheManager cacheManager, String cacheName, Configuration baseConfiguration) {
-        // copy base configuration
-        var builder = createCacheConfigurationBuilder();
-        builder.read(baseConfiguration);
-        if (config.getBoolean("remoteStoreEnabled", false)) {
-            configureRemoteCacheStore(builder, config.getBoolean("async", false), cacheName);
+    protected RemoteCacheManager createRemoteCacheManager(KeycloakSession session) {
+        var remoteConfig = session.getProvider(CacheRemoteConfigProvider.class).configuration();
+        if (remoteConfig.isEmpty()) {
+            logger.debug("Remote Cache feature is disabled");
+            return null;
         }
-        cacheManager.defineConfiguration(cacheName, builder.build());
-        cacheManager.getCache(cacheName);
-    }
-
-    private Configuration getRevisionCacheConfig(long maxEntries) {
-        ConfigurationBuilder cb = createCacheConfigurationBuilder();
-        cb.simpleCache(false);
-        cb.invocationBatching().enable().transaction().transactionMode(TransactionMode.TRANSACTIONAL);
-
-        // Use Embedded manager even in managed ( wildfly/eap ) environment. We don't want infinispan to participate in global transaction
-        cb.transaction().transactionManagerLookup(new EmbeddedTransactionManagerLookup());
-
-        cb.transaction().lockingMode(LockingMode.PESSIMISTIC);
-        if (cb.memory().storage().canStoreReferences()) {
-            cb.encoding().mediaType(MediaType.APPLICATION_OBJECT_TYPE);
-        }
-
-        cb.memory()
-                .whenFull(EvictionStrategy.REMOVE)
-                .maxCount(maxEntries);
-
-        return cb.build();
+        logger.debug("Remote Cache feature is enabled");
+        var rcm = new RemoteCacheManager(remoteConfig.get());
+
+        // upload the schema before trying to access the caches
+        // not caching the list; it is only used during startup
+        var entities = List.of(
+                new KeycloakIndexSchemaUtil.IndexedEntity(RemoteUserLoginFailureProviderFactory.PROTO_ENTITY, LOGIN_FAILURE_CACHE_NAME),
+                new KeycloakIndexSchemaUtil.IndexedEntity(RemoteInfinispanAuthenticationSessionProviderFactory.PROTO_ENTITY, AUTHENTICATION_SESSIONS_CACHE_NAME),
+                new KeycloakIndexSchemaUtil.IndexedEntity(ClientSessionQueries.CLIENT_SESSION, CLIENT_SESSION_CACHE_NAME),
+                new KeycloakIndexSchemaUtil.IndexedEntity(ClientSessionQueries.CLIENT_SESSION, OFFLINE_CLIENT_SESSION_CACHE_NAME),
+                new KeycloakIndexSchemaUtil.IndexedEntity(UserSessionQueries.USER_SESSION, USER_SESSION_CACHE_NAME),
+                new KeycloakIndexSchemaUtil.IndexedEntity(UserSessionQueries.USER_SESSION, OFFLINE_USER_SESSION_CACHE_NAME)
+        );
+        KeycloakIndexSchemaUtil.uploadAndReindexCaches(rcm, KeycloakModelSchema.INSTANCE, entities);
+        return rcm;
     }
 
-    // Used for cross-data centers scenario. Usually integration with external JDG server, which itself handles communication between DCs.
-    private void configureRemoteCacheStore(ConfigurationBuilder builder, boolean async, String cacheName) {
-        String jdgServer = config.get("remoteStoreHost", "127.0.0.1");
-        Integer jdgPort = config.getInt("remoteStorePort", 11222);
-
-        // After upgrade to Infinispan 12.1.7.Final it's required that both remote store and embedded cache use
-        // the same key media type to allow segmentation. Also, the number of segments in an embedded cache needs to match number of segments in the remote store.
-        boolean segmented = config.getBoolean("segmented", false);
-
-        //noinspection removal
-        builder.persistence()
-                .passivation(false)
-                .addStore(RemoteStoreConfigurationBuilder.class)
-                .ignoreModifications(false)
-                .purgeOnStartup(false)
-                .preload(false)
-                .shared(true)
-                .remoteCacheName(cacheName)
-                .segmented(segmented)
-                .rawValues(true)
-                .forceReturnValues(false)
-                .protocolVersion(getHotrodVersion())
-                .addServer()
-                .host(jdgServer)
-                .port(jdgPort)
-                .async()
-                .enabled(async);
+    /**
+     * @deprecated not invoked anymore. Overwrite {@link #createEmbeddedCacheManager(KeycloakSession)}.
+     */
+    @Deprecated(since = "26.0", forRemoval = true)
+    protected EmbeddedCacheManager initContainerManaged(EmbeddedCacheManager cacheManager) {
+        throw new UnsupportedOperationException();
     }
 
-    private ProtocolVersion getHotrodVersion() {
-        String hotrodVersionStr = config.get("hotrodProtocolVersion", ProtocolVersion.DEFAULT_PROTOCOL_VERSION.toString());
-        ProtocolVersion hotrodVersion = ProtocolVersion.parseVersion(hotrodVersionStr);
-        if (hotrodVersion == null) {
-            hotrodVersion = ProtocolVersion.DEFAULT_PROTOCOL_VERSION;
-        }
-
-        logger.debugf("HotRod protocol version: %s", hotrodVersion);
-
-        return hotrodVersion;
+    /**
+     * @deprecated not used anymore. Overwrite {@link #createEmbeddedCacheManager(KeycloakSession)} if you want to
+     * create a custom {@link EmbeddedCacheManager}.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
+    protected EmbeddedCacheManager initEmbedded() {
+        throw new UnsupportedOperationException();
     }
 
+    /**
+     * @deprecated not used anymore
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     protected Configuration getKeysCacheConfig() {
-        ConfigurationBuilder cb = createCacheConfigurationBuilder();
+        var cb = CacheConfigurator.createCacheConfigurationBuilder();
 
         cb.memory()
                 .whenFull(EvictionStrategy.REMOVE)
@@ -473,6 +236,14 @@ protected Configuration getKeysCacheConfig() {
         return cb.build();
     }
 
+    /**
+     * @deprecated Use {@link CacheConfigurator#getCrlCacheConfig()}
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
+    protected Configuration getCrlCacheConfig() {
+        return CacheConfigurator.getCrlCacheConfig().build();
+    }
+
     private void registerSystemWideListeners(KeycloakSession session) {
         KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
         ClusterProvider cluster = session.getProvider(ClusterProvider.class);
@@ -490,8 +261,21 @@ private void registerSystemWideListeners(KeycloakSession session) {
         });
     }
 
+    private void injectKeycloakTimeService(EmbeddedCacheManager cacheManager) {
+        if (config.getBoolean("useKeycloakTimeService", Boolean.FALSE)) {
+            setTimeServiceToKeycloakTime(cacheManager);
+        }
+    }
+
     @Override
     public Set<Class<? extends Provider>> dependsOn() {
-        return Set.of(JpaConnectionProvider.class);
+        return Set.of(CacheRemoteConfigProvider.class, CacheEmbeddedConfigProvider.class);
+    }
+
+    @Override
+    public void onEvent(ProviderEvent event) {
+        if (event instanceof PostMigrationEvent pme) {
+            KeycloakModelUtils.runJobInTransaction(pme.getFactory(), this::registerSystemWideListeners);
+        }
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java
index 9e92ee852388..8e0771beba50 100755
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java
@@ -64,6 +64,9 @@ public interface InfinispanConnectionProvider extends Provider {
     int KEYS_CACHE_DEFAULT_MAX = 1000;
     int KEYS_CACHE_MAX_IDLE_SECONDS = 3600;
 
+    String CRL_CACHE_NAME = "crl";
+    int CRL_CACHE_DEFAULT_MAX = 1000;
+
     // System property used on Wildfly to identify distributedCache address and sticky session route
     String JBOSS_NODE_NAME = "jboss.node.name";
     String JGROUPS_UDP_MCAST_ADDR = "jgroups.mcast_addr";
@@ -85,7 +88,16 @@ public interface InfinispanConnectionProvider extends Provider {
             USER_REVISIONS_CACHE_NAME,
             AUTHORIZATION_CACHE_NAME,
             AUTHORIZATION_REVISIONS_CACHE_NAME,
-            KEYS_CACHE_NAME
+            KEYS_CACHE_NAME,
+            CRL_CACHE_NAME,
+    };
+
+    // list of cache name for user and client session caches, both offline and online
+    String[] USER_AND_CLIENT_SESSION_CACHES = {
+            USER_SESSION_CACHE_NAME,
+            CLIENT_SESSION_CACHE_NAME,
+            OFFLINE_USER_SESSION_CACHE_NAME,
+            OFFLINE_CLIENT_SESSION_CACHE_NAME,
     };
 
     // list of cache name which could be defined as distributed or replicated
@@ -102,6 +114,21 @@ public interface InfinispanConnectionProvider extends Provider {
 
     String[] ALL_CACHES_NAME = Stream.concat(Arrays.stream(LOCAL_CACHE_NAMES), Arrays.stream(CLUSTERED_CACHE_NAMES)).toArray(String[]::new);
 
+    String[] LOCAL_MAX_COUNT_CACHES = new String[]{
+            AUTHORIZATION_CACHE_NAME,
+            CRL_CACHE_NAME,
+            KEYS_CACHE_NAME,
+            REALM_CACHE_NAME,
+            USER_CACHE_NAME
+    };
+
+    String[] CLUSTERED_MAX_COUNT_CACHES = new String[]{
+            CLIENT_SESSION_CACHE_NAME,
+            OFFLINE_USER_SESSION_CACHE_NAME,
+            OFFLINE_CLIENT_SESSION_CACHE_NAME,
+            USER_SESSION_CACHE_NAME
+    };
+
     /**
      *
      * Effectively the same as {@link InfinispanConnectionProvider#getCache(String, boolean)} with createIfAbsent set to {@code true}
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionSpi.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionSpi.java
index 7c357163bd50..22d49d763847 100644
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionSpi.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionSpi.java
@@ -17,8 +17,6 @@
 
 package org.keycloak.connections.infinispan;
 
-import org.keycloak.provider.Provider;
-import org.keycloak.provider.ProviderFactory;
 import org.keycloak.provider.Spi;
 
 /**
@@ -26,6 +24,8 @@
  */
 public class InfinispanConnectionSpi implements Spi {
 
+    public static final String SPI_NAME = "connectionsInfinispan";
+
     @Override
     public boolean isInternal() {
         return true;
@@ -33,16 +33,16 @@ public boolean isInternal() {
 
     @Override
     public String getName() {
-        return "connectionsInfinispan";
+        return SPI_NAME;
     }
 
     @Override
-    public Class<? extends Provider> getProviderClass() {
+    public Class<InfinispanConnectionProvider> getProviderClass() {
         return InfinispanConnectionProvider.class;
     }
 
     @Override
-    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+    public Class<InfinispanConnectionProviderFactory> getProviderFactoryClass() {
         return InfinispanConnectionProviderFactory.class;
     }
 
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanUtil.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanUtil.java
index d5e5ce7dcf03..95f8e03d7213 100644
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanUtil.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanUtil.java
@@ -17,11 +17,10 @@
 
 package org.keycloak.connections.infinispan;
 
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.ProtocolVersion;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.commons.api.BasicCache;
-import org.infinispan.commons.dataconversion.MediaType;
+import java.time.Instant;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+
 import org.infinispan.commons.time.TimeService;
 import org.infinispan.commons.util.FileLookup;
 import org.infinispan.commons.util.FileLookupFactory;
@@ -29,24 +28,17 @@
 import org.infinispan.configuration.global.GlobalConfigurationBuilder;
 import org.infinispan.configuration.global.TransportConfigurationBuilder;
 import org.infinispan.eviction.EvictionStrategy;
-import org.infinispan.factories.ComponentRegistry;
 import org.infinispan.factories.GlobalComponentRegistry;
 import org.infinispan.factories.impl.BasicComponentRegistry;
 import org.infinispan.factories.impl.ComponentRef;
 import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.persistence.manager.PersistenceManager;
-import org.infinispan.persistence.remote.RemoteStore;
 import org.infinispan.remoting.transport.jgroups.JGroupsTransport;
 import org.infinispan.util.EmbeddedTimeService;
 import org.jboss.logging.Logger;
 import org.jgroups.JChannel;
 import org.keycloak.common.util.Time;
 import org.keycloak.models.KeycloakSession;
-
-import java.time.Instant;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicReference;
+import org.keycloak.spi.infinispan.impl.embedded.CacheConfigurator;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -57,50 +49,17 @@ public class InfinispanUtil {
 
     public static final int MAXIMUM_REPLACE_RETRIES = 25;
 
-    // See if we have RemoteStore (external JDG) configured for cross-Data-Center scenario
-    public static Set<RemoteStore> getRemoteStores(Cache<?, ?> ispnCache) {
-        return ComponentRegistry.componentOf(ispnCache, PersistenceManager.class).getStores(RemoteStore.class);
-    }
-
-
-    public static RemoteCache getRemoteCache(Cache<?, ?> ispnCache) {
-        Set<RemoteStore> remoteStores = getRemoteStores(ispnCache);
-        if (remoteStores.isEmpty()) {
-            return null;
-        } else {
-            return remoteStores.iterator().next().getRemoteCache();
-        }
-    }
-
-
     public static TopologyInfo getTopologyInfo(KeycloakSession session) {
         return session.getProvider(InfinispanConnectionProvider.class).getTopologyInfo();
     }
 
 
-    /**
-     * Convert the given value to the proper value, which can be used when calling operations for the infinispan remoteCache.
-     *
-     * Infinispan HotRod protocol of versions older than 3.0 uses the "lifespan" or "maxIdle" as the normal expiration time when the value is 30 days or less.
-     * However for the bigger values, it assumes that the value is unix timestamp.
-     *
-     * @param ispnCache
-     * @param lifespanOrigMs
-     * @return
-     */
-    public static long toHotrodTimeMs(BasicCache<?, ?> ispnCache, long lifespanOrigMs) {
-        if (ispnCache instanceof RemoteCache<?, ?> remoteCache && lifespanOrigMs > 2592000000L) {
-            ProtocolVersion protocolVersion = remoteCache.getRemoteCacheContainer().getConfiguration().version();
-            if (ProtocolVersion.PROTOCOL_VERSION_30.compareTo(protocolVersion) > 0) {
-                return Time.currentTimeMillis() + lifespanOrigMs;
-            }
-        }
-
-        return lifespanOrigMs;
-    }
-
     private static final Object CHANNEL_INIT_SYNCHRONIZER = new Object();
 
+    /**
+     * @deprecated to be removed without replacement.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     public static void configureTransport(GlobalConfigurationBuilder gcb, String nodeName, String siteName, String jgroupsUdpMcastAddr,
                                           String jgroupsBindAddr, String jgroupsConfigPath) {
         if (nodeName == null) {
@@ -160,20 +119,20 @@ public static void configureTransport(GlobalConfigurationBuilder gcb, String nod
         }
     }
 
+    /**
+     * @deprecated to be removed. Use {@link CacheConfigurator#createCacheConfigurationBuilder()}.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     public static ConfigurationBuilder createCacheConfigurationBuilder() {
-        ConfigurationBuilder builder = new ConfigurationBuilder();
-
-        // need to force the encoding to application/x-java-object to avoid unnecessary conversion of keys/values. See WFLY-14356.
-        builder.encoding().mediaType(MediaType.APPLICATION_OBJECT_TYPE);
-
-        // needs to be disabled if transaction is enabled
-        builder.simpleCache(true);
-
-        return builder;
+        return CacheConfigurator.createCacheConfigurationBuilder();
     }
 
+    /**
+     * @deprecated to be removed without replacement.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     public static ConfigurationBuilder getActionTokenCacheConfig() {
-        ConfigurationBuilder cb = createCacheConfigurationBuilder();
+        var cb = CacheConfigurator.createCacheConfigurationBuilder();
 
         cb.memory()
                 .whenFull(EvictionStrategy.MANUAL)
@@ -185,9 +144,26 @@ public static ConfigurationBuilder getActionTokenCacheConfig() {
         return cb;
     }
 
+    /**
+     * @deprecated to be removed. Use {@link CacheConfigurator#getCrlCacheConfig()}.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
+    public static ConfigurationBuilder getCrlCacheConfig() {
+        return CacheConfigurator.getCrlCacheConfig();
+    }
+
+    /**
+     * @deprecated to be removed. Use {@link CacheConfigurator#getRevisionCacheConfig(long)}.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
+    public static ConfigurationBuilder getRevisionCacheConfig(long maxEntries) {
+        return CacheConfigurator.getRevisionCacheConfig(maxEntries);
+    }
+
     /**
      * Replaces the {@link TimeService} in infinispan with the one that respects Keycloak {@link Time}.
-     * @param cacheManager
+     *
+     * @param cacheManager The {@link EmbeddedCacheManager} to inject the Keycloak {@link Time}.
      * @return Runnable to revert replacement of the infinispan time service
      */
     public static Runnable setTimeServiceToKeycloakTime(EmbeddedCacheManager cacheManager) {
@@ -207,14 +183,13 @@ public static Runnable setTimeServiceToKeycloakTime(EmbeddedCacheManager cacheMa
 
     /**
      * Forked from org.infinispan.test.TestingUtil class
-     *
+     * <p>
      * Replaces a component in a running cache manager (global component registry).
      *
-     * @param cacheMgr       cache in which to replace component
+     * @param cacheMgr             cache in which to replace component
      * @param componentType        component type of which to replace
      * @param replacementComponent new instance
      * @param rewire               if true, ComponentRegistry.rewire() is called after replacing.
-     *
      * @return the original component that was replaced
      */
     private static <T> T replaceComponent(EmbeddedCacheManager cacheMgr, Class<T> componentType, T replacementComponent, boolean rewire) {
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/RemoteCacheProvider.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/RemoteCacheProvider.java
deleted file mode 100644
index 1c2ce0392baf..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/RemoteCacheProvider.java
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.connections.infinispan;
-
-import java.io.IOException;
-import java.lang.reflect.Field;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.NameCallback;
-import javax.security.auth.callback.PasswordCallback;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.sasl.RealmCallback;
-
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.RemoteCacheManager;
-import org.infinispan.client.hotrod.configuration.Configuration;
-import org.infinispan.client.hotrod.configuration.ConfigurationBuilder;
-import org.infinispan.commons.configuration.Combine;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.jboss.logging.Logger;
-import org.keycloak.Config;
-import org.keycloak.common.util.reflections.Reflections;
-
-import java.util.stream.Collectors;
-import org.infinispan.client.hotrod.exceptions.HotRodClientException;
-
-/**
- * Get either just remoteCache associated with remoteStore associated with infinispan cache of given name. If security is enabled, then
- * return secured remoteCache based on the template provided by remoteStore configuration but with added "authentication" configuration
- * of secured hotrod endpoint (RemoteStore doesn't yet allow to configure "security" of hotrod endpoints)
- *
- * TODO: Remove this class once we upgrade to infinispan version, which allows to configure security for remoteStore itself
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RemoteCacheProvider {
-
-    public static final String SCRIPT_CACHE_NAME = "___script_cache";
-
-    protected static final Logger logger = Logger.getLogger(RemoteCacheProvider.class);
-
-    private final Config.Scope config;
-    private final EmbeddedCacheManager cacheManager;
-
-    private final Map<String, RemoteCache> availableCaches = new HashMap<>();
-
-    // Enlist secured managers, which are managed by us and should be shutdown on stop
-    private final Map<String, RemoteCacheManager> managedManagers = new HashMap<>();
-
-    public RemoteCacheProvider(Config.Scope config, EmbeddedCacheManager cacheManager) {
-        this.config = config;
-        this.cacheManager = cacheManager;
-    }
-
-    public RemoteCache getRemoteCache(String cacheName) {
-        if (availableCaches.get(cacheName) == null) {
-            synchronized (this) {
-                if (availableCaches.get(cacheName) == null) {
-                    RemoteCache remoteCache = loadRemoteCache(cacheName);
-                    availableCaches.put(cacheName, remoteCache);
-                }
-            }
-        }
-
-        return availableCaches.get(cacheName);
-    }
-
-    public void stop() {
-        logger.debugf("Shutdown %d registered secured remoteCache managers", managedManagers.size());
-
-        for (RemoteCacheManager mgr : managedManagers.values()) {
-            mgr.stop();
-        }
-    }
-
-
-    protected synchronized RemoteCache loadRemoteCache(String cacheName) {
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cacheManager.getCache(cacheName));
-
-        if (remoteCache == null) {
-            return null;
-        }
-
-        logger.infof("Hotrod version for remoteCache %s: %s", remoteCache.getName(), remoteCache.getRemoteCacheManager().getConfiguration().version());
-
-        Boolean remoteStoreSecurity = config.getBoolean("remoteStoreSecurityEnabled");
-        if (remoteStoreSecurity == null) {
-            try {
-                logger.debugf("Detecting remote security settings of HotRod server, cache %s. Disable by explicitly setting \"remoteStoreSecurityEnabled\" property in spi=connectionsInfinispan/provider=default", cacheName);
-                remoteStoreSecurity = false;
-                final RemoteCache<Object, Object> scriptCache = remoteCache.getRemoteCacheManager().getCache(SCRIPT_CACHE_NAME);
-                if (scriptCache == null) {
-                    logger.debug("Cannot detect remote security settings of HotRod server, disabling.");
-                } else {
-                    scriptCache.containsKey("");
-                }
-            } catch (HotRodClientException ex) {
-                logger.debug("Seems that HotRod server requires authentication, enabling.");
-                remoteStoreSecurity = true;
-            }
-        }
-
-        if (remoteStoreSecurity) {
-            logger.infof("Remote store security for cache %s is enabled. Disable by setting \"remoteStoreSecurityEnabled\" property to \"false\" in spi=connectionsInfinispan/provider=default", cacheName);
-            RemoteCacheManager securedMgr = getOrCreateSecuredRemoteCacheManager(config, cacheName, remoteCache.getRemoteCacheManager());
-            return securedMgr.getCache(remoteCache.getName());
-        } else {
-            logger.infof("Remote store security for cache %s is disabled. If server fails to connect to remote JDG server, enable it.", cacheName);
-            return remoteCache;
-        }
-    }
-
-
-    protected RemoteCacheManager getOrCreateSecuredRemoteCacheManager(Config.Scope config, String cacheName, RemoteCacheManager origManager) {
-        String serverName = config.get("remoteStoreSecurityServerName", "keycloak-jdg-server");
-        String realm = config.get("remoteStoreSecurityRealm", "AllowScriptManager");
-
-        String username = config.get("remoteStoreSecurityUsername", "___script_manager");
-        String password = config.get("remoteStoreSecurityPassword", "not-so-secret-password");
-
-        // Create configuration template from the original configuration provided at remoteStore level
-        Configuration origConfig = origManager.getConfiguration();
-
-        ConfigurationBuilder cfgBuilder = new ConfigurationBuilder()
-                .read(origConfig, Combine.DEFAULT);
-
-        String securedHotRodEndpoint = origConfig.servers().stream()
-              .map(serverConfiguration -> serverConfiguration.host() + ":" + serverConfiguration.port())
-              .collect(Collectors.joining(";"));
-
-        if (managedManagers.containsKey(securedHotRodEndpoint)) {
-            return managedManagers.get(securedHotRodEndpoint);
-        }
-
-        logger.infof("Creating secured RemoteCacheManager for Server: '%s', Cache: '%s', Realm: '%s', Username: '%s', Secured HotRod endpoint: '%s'", serverName, cacheName, realm, username, securedHotRodEndpoint);
-
-        // Workaround as I need a way to override servers and it's not possible to remove existing :/
-        try {
-            Field serversField = cfgBuilder.getClass().getDeclaredField("servers");
-            Reflections.setAccessible(serversField);
-            List origServers = Reflections.getFieldValue(serversField, cfgBuilder, List.class);
-            origServers.clear();
-        } catch (NoSuchFieldException nsfe) {
-            throw new RuntimeException(nsfe);
-        }
-
-        // Create configuration based on the configuration template from remoteStore. Just add security and override secured endpoint
-        Configuration newConfig = cfgBuilder
-                .addServers(securedHotRodEndpoint)
-                .security()
-                  .authentication()
-                    .serverName(serverName) //define server name, should be specified in XML configuration on JDG side
-                    .saslMechanism("DIGEST-MD5") // define SASL mechanism, in this example we use DIGEST with MD5 hash
-                    .callbackHandler(new LoginHandler(username, password.toCharArray(), realm)) // define login handler, implementation defined
-                    .enable()
-                .build();
-
-        final RemoteCacheManager remoteCacheManager = new RemoteCacheManager(newConfig);
-        managedManagers.put(securedHotRodEndpoint, remoteCacheManager);
-        return remoteCacheManager;
-    }
-
-
-    private static class LoginHandler implements CallbackHandler {
-        final private String login;
-        final private char[] password;
-        final private String realm;
-
-        private LoginHandler(String login, char[] password, String realm) {
-            this.login = login;
-            this.password = password;
-            this.realm = realm;
-        }
-
-        @Override
-        public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
-            for (Callback callback : callbacks) {
-                if (callback instanceof NameCallback) {
-                    ((NameCallback) callback).setName(login);
-                } else if (callback instanceof PasswordCallback) {
-                    ((PasswordCallback) callback).setPassword(password);
-                } else if (callback instanceof RealmCallback) {
-                    ((RealmCallback) callback).setText(realm);
-                } else {
-                    throw new UnsupportedCallbackException(callback);
-                }
-            }
-        }
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/TopologyInfo.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/TopologyInfo.java
index 7ac528f09ec9..021de2898cff 100644
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/TopologyInfo.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/TopologyInfo.java
@@ -17,6 +17,10 @@
 
 package org.keycloak.connections.infinispan;
 
+import java.net.InetSocketAddress;
+import java.security.SecureRandom;
+import java.util.Objects;
+
 import org.infinispan.Cache;
 import org.infinispan.distribution.DistributionManager;
 import org.infinispan.factories.GlobalComponentRegistry;
@@ -31,10 +35,6 @@
 import org.jgroups.util.NameCache;
 import org.keycloak.Config;
 
-import java.net.InetSocketAddress;
-import java.security.SecureRandom;
-import java.util.Objects;
-
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -44,76 +44,45 @@ public class TopologyInfo {
 
 
     // Node name used in clustered environment. This typically points to "jboss.node.name" . If "jboss.node.name" is not set, it is randomly generated
-    // name
     private final String myNodeName;
 
-    // Used just if "site" is configured (typically in cross-dc environment). Otherwise null
+    // Used just if "site" is configured (typically in multi-site environment). Otherwise null
     private final String mySiteName;
 
     private final boolean isGeneratedNodeName;
 
 
+    /**
+     * @deprecated Use {@link #TopologyInfo(EmbeddedCacheManager)} instead.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     public TopologyInfo(EmbeddedCacheManager cacheManager, Config.Scope config, boolean embedded, String providerId) {
-        String siteName;
-        String nodeName;
-        boolean isGeneratedNodeName = false;
-
-        if (System.getProperty(InfinispanConnectionProvider.JBOSS_SITE_NAME) != null) {
-            throw new IllegalArgumentException(
-                    String.format("System property %s is in use. Use --spi-connections-infinispan-%s-site-name config option instead",
-                            InfinispanConnectionProvider.JBOSS_SITE_NAME, providerId));
-        }
+        this(cacheManager);
+    }
 
-        if (!embedded) {
-            var addr = cacheManager.getAddress();
-            if (addr != null) {
-                nodeName = addr.toString();
-                siteName = cacheManager.getCacheManagerConfiguration().transport().siteId();
-                if (siteName == null) {
-                    siteName = config.get("siteName");
-                }
-            } else {
-                nodeName = System.getProperty(InfinispanConnectionProvider.JBOSS_NODE_NAME);
-                siteName = config.get("siteName");
-            }
-            if (nodeName == null || nodeName.equals("localhost")) {
-                isGeneratedNodeName = true;
-                nodeName = generateNodeName();
-            }
+    public TopologyInfo(EmbeddedCacheManager cacheManager) {
+        var transportConfig = cacheManager.getCacheManagerConfiguration().transport();
+        var transport = GlobalComponentRegistry.componentOf(cacheManager, Transport.class);
+
+        if (transport == null) {
+            // non-clustered mode
+            // if the user sets a node name, use it; otherwise, generate the node name.
+            var nodeName = transportConfig.nodeName();
+            this.isGeneratedNodeName = nodeName == null || nodeName.isEmpty();
+            this.myNodeName = isGeneratedNodeName ? generateNodeName() : nodeName;
         } else {
-            boolean clustered = config.getBoolean("clustered", false);
-
-            nodeName = config.get("nodeName", System.getProperty(InfinispanConnectionProvider.JBOSS_NODE_NAME));
-            if (nodeName != null && nodeName.isEmpty()) {
-                nodeName = null;
-            }
-
-            siteName = config.get("siteName");
-            if (siteName != null && siteName.isEmpty()) {
-                siteName = null;
-            }
-
-            if (nodeName == null) {
-                if (!clustered) {
-                    isGeneratedNodeName = true;
-                    nodeName = generateNodeName();
-                } else {
-                    throw new IllegalStateException("You must set jboss.node.name if you use clustered mode for InfinispanConnectionProvider");
-                }
-            }
+            // clustered mode
+            // returns the node name configured; if not set, the node name generated by JGroups.
+            this.myNodeName = transport.localNodeName();
+            this.isGeneratedNodeName = false;
         }
-
-        this.myNodeName = nodeName;
-        this.mySiteName = siteName;
-        this.isGeneratedNodeName = isGeneratedNodeName;
+        this.mySiteName = transportConfig.siteId();
     }
 
-
-    private String generateNodeName() {
+    private static String generateNodeName() {
         return InfinispanConnectionProvider.NODE_PREFIX + new SecureRandom().nextInt(1000000);
     }
 
-
     public String getMyNodeName() {
         return myNodeName;
     }
@@ -122,13 +91,11 @@ public String getMySiteName() {
         return mySiteName;
     }
 
-
     @Override
     public String toString() {
         return String.format("Node name: %s, Site name: %s", myNodeName, mySiteName);
     }
 
-
     /**
      * True if I am primary owner of the key in case of distributed caches. In case of local caches, always return true
      */
diff --git a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/remote/RemoteLoadBalancerCheckProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/remote/RemoteLoadBalancerCheckProviderFactory.java
index 70b87f2d50b6..d6b477da2e5f 100644
--- a/model/infinispan/src/main/java/org/keycloak/connections/infinispan/remote/RemoteLoadBalancerCheckProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/connections/infinispan/remote/RemoteLoadBalancerCheckProviderFactory.java
@@ -20,6 +20,7 @@
 import java.lang.invoke.MethodHandles;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Set;
 import java.util.concurrent.Callable;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ScheduledFuture;
@@ -43,6 +44,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
+import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.provider.ProviderConfigurationBuilder;
 
@@ -121,7 +123,12 @@ public int order() {
         return InfinispanUtils.PROVIDER_ORDER;
     }
 
-    @Override
+   @Override
+   public Set<Class<? extends Provider>> dependsOn() {
+      return Set.of(InfinispanConnectionProvider.class);
+   }
+
+   @Override
     public List<ProviderConfigProperty> getConfigMetadata() {
         return ProviderConfigurationBuilder.create()
                 .property()
diff --git a/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProvider.java b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProvider.java
new file mode 100644
index 000000000000..d45ac671918e
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProvider.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.crl.infinispan;
+
+import org.infinispan.Cache;
+import org.keycloak.cluster.ClusterProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.cache.CacheCrlProvider;
+import org.keycloak.models.cache.infinispan.ClearCacheEvent;
+
+public class InfinispanCacheCrlProvider implements CacheCrlProvider {
+
+    private final KeycloakSession session;
+
+    private final Cache<String, X509CRLEntry> crlCache;
+
+    public InfinispanCacheCrlProvider(KeycloakSession session, Cache<String, X509CRLEntry> crlCache) {
+        this.session = session;
+        this.crlCache = crlCache;
+    }
+
+    @Override
+    public void clearCache() {
+        crlCache.clear();
+        ClusterProvider cluster = session.getProvider(ClusterProvider.class);
+        cluster.notify(InfinispanCacheCrlProviderFactory.CRL_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), true);
+    }
+
+    @Override
+    public void close() {
+
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProviderFactory.java
new file mode 100644
index 000000000000..297b76ed99bb
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCacheCrlProviderFactory.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.crl.infinispan;
+
+import org.infinispan.Cache;
+import org.keycloak.Config;
+import org.keycloak.cluster.ClusterEvent;
+import org.keycloak.cluster.ClusterProvider;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.cache.CacheCrlProvider;
+import org.keycloak.models.cache.CacheCrlProviderFactory;
+
+public class InfinispanCacheCrlProviderFactory implements CacheCrlProviderFactory {
+
+    public static final String PROVIDER_ID = "infinispan";
+
+    public static final String CRL_CLEAR_CACHE_EVENTS = "CRL_CLEAR_CACHE_EVENTS";
+
+    private volatile Cache<String, X509CRLEntry> crlCache;
+
+    @Override
+    public CacheCrlProvider create(KeycloakSession session) {
+        lazyInit(session);
+        return new InfinispanCacheCrlProvider(session, crlCache);
+    }
+
+    private void lazyInit(KeycloakSession session) {
+        if (crlCache == null) {
+            synchronized (this) {
+                if (crlCache == null) {
+                    crlCache = session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CRL_CACHE_NAME);
+                    ClusterProvider cluster = session.getProvider(ClusterProvider.class);
+
+                    cluster.registerListener(CRL_CLEAR_CACHE_EVENTS, (ClusterEvent event) -> {
+                        crlCache.clear();
+                    });
+                }
+            }
+        }
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProvider.java b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProvider.java
new file mode 100644
index 000000000000..951cb8632ec9
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProvider.java
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crl.infinispan;
+
+import java.security.GeneralSecurityException;
+import java.security.cert.X509CRL;
+import java.util.Date;
+import java.util.Map;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.FutureTask;
+import java.util.concurrent.TimeUnit;
+import org.infinispan.Cache;
+import org.jboss.logging.Logger;
+import org.keycloak.common.util.Time;
+import org.keycloak.crl.CrlStorageProvider;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class InfinispanCrlStorageProvider implements CrlStorageProvider {
+
+    private static final Logger log = Logger.getLogger(InfinispanCrlStorageProvider.class);
+
+    private final SharedData data;
+
+    public InfinispanCrlStorageProvider(SharedData data) {
+        this.data = data;
+    }
+
+    @Override
+    public X509CRL get(String key, Callable<X509CRL> loader) throws GeneralSecurityException {
+        final X509CRLEntry crlEntry = data.cache().get(key);
+        final long currentTime = Time.currentTimeMillis();
+        if (crlEntry != null && (crlEntry.crl().getNextUpdate() == null || crlEntry.crl().getNextUpdate().compareTo(new Date(currentTime)) > 0)) {
+            log.debugf("returning CRL '%s' from cache because it's cached OK", key);
+            return crlEntry.crl();
+        }
+
+        // refresh the crl entry in the cache
+        return reloadCrl(key, loader, currentTime, crlEntry);
+    }
+
+    @Override
+    public boolean refreshCache(String key, Callable<X509CRL> loader) throws GeneralSecurityException {
+        final X509CRLEntry entry = data.cache().get(key);
+        final X509CRL crl = reloadCrl(key, loader, Time.currentTimeMillis(), entry);
+        return  crl != null && (entry == null || entry.crl() != crl);
+    }
+
+    @Override
+    public void close() {
+        // no-op
+    }
+
+    private X509CRL reloadCrl(String key, Callable<X509CRL> loader, long currentTime, X509CRLEntry crlEntry) {
+        if (crlEntry != null && currentTime < crlEntry.lastRequestTime()+ data.minTimeBetweenRequests()){
+            log.debugf("Avoiding loading crl with key '%s' again, last refreshed time %d", key, crlEntry.lastRequestTime());
+            return crlEntry.crl();
+        }
+
+        FutureTask<X509CRL> task = new FutureTask<>(() -> loadCrl(key, loader, currentTime));
+
+        final FutureTask<X509CRL> existing = data.tasksInProgress().putIfAbsent(key, task);
+        if (existing == null) {
+            log.debugf("Reloading crl for model key '%s'.", key);
+            task.run();
+        } else {
+            task = existing;
+        }
+
+        try {
+            return task.get();
+        } catch (ExecutionException ee) {
+            throw new RuntimeException("Error when loading crl " + key + " : " + ee.getMessage(), ee);
+        } catch (InterruptedException ie) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException("Error. Interrupted when loading crl " + key, ie);
+        } finally {
+            // Our thread inserted the task. Let's clean
+            if (existing == null) {
+                data.tasksInProgress().remove(key);
+            }
+        }
+    }
+
+    private X509CRL loadCrl(String key, Callable<X509CRL> loader, long currentTime) throws Exception {
+        final X509CRL crl = loader.call();
+        if (crl == null) {
+            log.warnf("Loading crl with key '%s' returned null.", key);
+            return null;
+        }
+        long lifespan = getLifespan(crl, currentTime);
+        if (lifespan > 0) {
+            data.cache().put(key, new X509CRLEntry(crl, currentTime), lifespan, TimeUnit.MILLISECONDS);
+            log.debugf("The crl with key '%s' was retrieved successfully and cached for %d millis.", key, lifespan);
+        } else {
+            data.cache().put(key, new X509CRLEntry(crl, currentTime));
+            log.debugf("The crl with key '%s' was retrieved successfully and cached forever.", key);
+        }
+        return crl;
+    }
+
+    private long getLifespan(X509CRL crl, long currentTime) {
+        final long cacheTime = data.cacheTime();
+
+        if (crl.getNextUpdate() == null) {
+            return cacheTime;
+        }
+
+        final long nextUpdateTime = crl.getNextUpdate().getTime() - currentTime;
+        if (nextUpdateTime <= 0) {
+            // if the CRL is expired just cache the minimum time
+            return data.minTimeBetweenRequests();
+        } else if (cacheTime > 0) {
+            // get the minimum between cacheTime and nextUpdate
+            return Math.min(cacheTime, nextUpdateTime);
+        } else {
+            // just return the next update because default cache is infinite
+            return nextUpdateTime;
+        }
+    }
+
+    protected interface SharedData {
+        Cache<String, X509CRLEntry> cache();
+        Map<String, FutureTask<X509CRL>> tasksInProgress();
+        long cacheTime();
+        long minTimeBetweenRequests();
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProviderFactory.java
new file mode 100644
index 000000000000..19600fa299de
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/InfinispanCrlStorageProviderFactory.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crl.infinispan;
+
+import java.security.cert.X509CRL;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.FutureTask;
+import java.util.concurrent.TimeUnit;
+import org.infinispan.Cache;
+import org.keycloak.Config;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+import org.keycloak.crl.CrlStorageProvider;
+import org.keycloak.crl.CrlStorageProviderFactory;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class InfinispanCrlStorageProviderFactory implements CrlStorageProviderFactory, InfinispanCrlStorageProvider.SharedData {
+
+    public static final String PROVIDER_ID = "infinispan";
+
+    private volatile Cache<String, X509CRLEntry> crlCache;
+    private final Map<String, FutureTask<X509CRL>> tasksInProgress = new ConcurrentHashMap<>();
+    private volatile long cacheTime;
+    private volatile long minTimeBetweenRequests;
+
+    @Override
+    public CrlStorageProvider create(KeycloakSession session) {
+        lazyInit(session);
+        return new InfinispanCrlStorageProvider(this);
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        return ProviderConfigurationBuilder.create()
+                .property()
+                    .name("cacheTime")
+                    .type("int")
+                    .helpText(
+                            """
+                            Interval in seconds that the CRL is cached. The next update time of the CRL is always a minimum if present.
+                            Zero or a negative value means CRL is cached until the next update time specified in the CRL (or infinite if the
+                            CRL does not contain the next update).
+                            """
+                    )
+                    .defaultValue(-1)
+                    .add()
+                .property()
+                    .name("minTimeBetweenRequests")
+                    .type("int")
+                    .helpText(
+                            """
+                            Minimum interval in seconds between two requests to retrieve the CRL. The CRL is not updated
+                            from the URL again until this minimum time has passed since the previous refresh. In theory
+                            this option is never used if the CRL is refreshed correctly in the next update time.
+                            The interval should be a positive number. Default 10 seconds.
+                            """
+                    )
+                    .defaultValue(10)
+                    .add()
+                .build();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        final long tmpCacheTime = config.getLong("cacheTime", -1L);
+        cacheTime = tmpCacheTime > 0? TimeUnit.SECONDS.toMillis(tmpCacheTime) : -1L;
+
+        final long tmpMinTimeBetweenRequests = config.getLong("minTimeBetweenRequests", 10L);
+        minTimeBetweenRequests = tmpMinTimeBetweenRequests > 0? TimeUnit.SECONDS.toMillis(tmpMinTimeBetweenRequests) : 10_000L;
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // no-op
+    }
+
+    @Override
+    public void close() {
+        // no-op
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    private void lazyInit(KeycloakSession session) {
+        if (crlCache == null) {
+            synchronized (this) {
+                if (crlCache == null) {
+                    this.crlCache = session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CRL_CACHE_NAME);
+                }
+            }
+        }
+    }
+
+    @Override
+    public Cache<String, X509CRLEntry> cache() {
+        return crlCache;
+    }
+
+    @Override
+    public Map<String, FutureTask<X509CRL>> tasksInProgress() {
+        return tasksInProgress;
+    }
+
+    @Override
+    public long cacheTime() {
+        return cacheTime;
+    }
+
+    @Override
+    public long minTimeBetweenRequests() {
+        return minTimeBetweenRequests;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/crl/infinispan/X509CRLEntry.java b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/X509CRLEntry.java
new file mode 100644
index 000000000000..901aa52792ae
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/crl/infinispan/X509CRLEntry.java
@@ -0,0 +1,25 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crl.infinispan;
+
+import java.security.cert.X509CRL;
+
+/**
+ *
+ * @author rmartinc
+ */
+public record X509CRLEntry(X509CRL crl, long lastRequestTime) {}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/compatibility/CachingCompatibilityMetadataProvider.java b/model/infinispan/src/main/java/org/keycloak/infinispan/compatibility/CachingCompatibilityMetadataProvider.java
new file mode 100644
index 000000000000..ca385e3a25bb
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/compatibility/CachingCompatibilityMetadataProvider.java
@@ -0,0 +1,45 @@
+package org.keycloak.infinispan.compatibility;
+
+import java.util.Map;
+import org.infinispan.commons.util.Version;
+import org.keycloak.common.Profile;
+import org.keycloak.common.util.MultiSiteUtils;
+import org.keycloak.compatibility.CompatibilityMetadataProvider;
+import org.keycloak.infinispan.util.InfinispanUtils;
+
+/**
+ * A {@link CompatibilityMetadataProvider} to provide metadata for the CLI options under the Caching category and
+ * anything related to Infinispan.
+ */
+public class CachingCompatibilityMetadataProvider implements CompatibilityMetadataProvider {
+
+    public static final String ID = "caching";
+
+    @Override
+    public Map<String, String> metadata() {
+        return InfinispanUtils.isRemoteInfinispan() ?
+                remoteInfinispanMetadata() :
+                embeddedInfinispanMetadata();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    private static Map<String, String> remoteInfinispanMetadata() {
+        return Map.of(
+                "mode", "remote",
+                "persistence", Boolean.toString(MultiSiteUtils.isPersistentSessionsEnabled())
+        );
+    }
+
+    private static Map<String, String> embeddedInfinispanMetadata() {
+        return Map.of(
+                "mode", "embedded",
+                "persistence", Boolean.toString(Profile.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS)),
+                "version", Version.getVersion(),
+                "jgroupsVersion", org.jgroups.Version.printVersion()
+        );
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/module/KeycloakModule.java b/model/infinispan/src/main/java/org/keycloak/infinispan/module/KeycloakModule.java
new file mode 100644
index 000000000000..51bbe2b7d5f3
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/module/KeycloakModule.java
@@ -0,0 +1,21 @@
+package org.keycloak.infinispan.module;
+
+import org.infinispan.configuration.global.GlobalConfiguration;
+import org.infinispan.factories.GlobalComponentRegistry;
+import org.infinispan.factories.annotations.InfinispanModule;
+import org.infinispan.factories.impl.BasicComponentRegistry;
+import org.infinispan.lifecycle.ModuleLifecycle;
+import org.keycloak.jgroups.certificates.CertificateReloadManager;
+
+@InfinispanModule(name = "keycloak", requiredModules = {"core"})
+public class KeycloakModule implements ModuleLifecycle {
+
+    @Override
+    public void cacheManagerStarting(GlobalComponentRegistry gcr, GlobalConfiguration globalConfiguration) {
+        // start certificate reload manager before the JGroupsTransport
+        //noinspection removal
+        gcr.getComponent(BasicComponentRegistry.class)
+                .getComponent(CertificateReloadManager.class)
+                .running();
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfiguration.java b/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfiguration.java
new file mode 100644
index 000000000000..9405eb0e800c
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfiguration.java
@@ -0,0 +1,35 @@
+package org.keycloak.infinispan.module.configuration.global;
+
+import org.infinispan.commons.configuration.BuiltBy;
+import org.infinispan.commons.configuration.attributes.AttributeDefinition;
+import org.infinispan.commons.configuration.attributes.AttributeSet;
+import org.keycloak.models.KeycloakSessionFactory;
+
+@BuiltBy(KeycloakConfigurationBuilder.class)
+public class KeycloakConfiguration {
+
+    static final AttributeDefinition<KeycloakSessionFactory> KEYCLOAK_SESSION_FACTORY = AttributeDefinition.builder("keycloak-session-factory", null, KeycloakSessionFactory.class)
+            .global(true)
+            .autoPersist(false)
+            .immutable()
+            .build();
+
+    private final AttributeSet attributes;
+
+    static AttributeSet attributeSet() {
+        return new AttributeSet(KeycloakConfiguration.class, KEYCLOAK_SESSION_FACTORY);
+    }
+
+    KeycloakConfiguration(AttributeSet attributes) {
+        this.attributes = attributes;
+    }
+
+    AttributeSet attributes() {
+        return attributes;
+    }
+
+    public KeycloakSessionFactory keycloakSessionFactory() {
+        return attributes.attribute(KEYCLOAK_SESSION_FACTORY).get();
+    }
+
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfigurationBuilder.java b/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfigurationBuilder.java
new file mode 100644
index 000000000000..d2aa92dd74d7
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/module/configuration/global/KeycloakConfigurationBuilder.java
@@ -0,0 +1,43 @@
+package org.keycloak.infinispan.module.configuration.global;
+
+import org.infinispan.commons.configuration.Builder;
+import org.infinispan.commons.configuration.Combine;
+import org.infinispan.commons.configuration.attributes.AttributeSet;
+import org.infinispan.configuration.global.GlobalConfigurationBuilder;
+import org.keycloak.models.KeycloakSessionFactory;
+
+public class KeycloakConfigurationBuilder implements Builder<KeycloakConfiguration> {
+
+    private final AttributeSet attributes;
+
+    public KeycloakConfigurationBuilder(GlobalConfigurationBuilder unused) {
+        attributes = KeycloakConfiguration.attributeSet();
+    }
+
+    @Override
+    public KeycloakConfiguration create() {
+        return new KeycloakConfiguration(attributes.protect());
+    }
+
+    @Override
+    public Builder<?> read(KeycloakConfiguration template, Combine combine) {
+        attributes.read(template.attributes(), combine);
+        return this;
+    }
+
+    @Override
+    public AttributeSet attributes() {
+        return attributes;
+    }
+
+    @Override
+    public void validate() {
+
+    }
+
+    public KeycloakConfigurationBuilder setKeycloakSessionFactory(KeycloakSessionFactory keycloakSessionFactory) {
+        attributes.attribute(KeycloakConfiguration.KEYCLOAK_SESSION_FACTORY).set(keycloakSessionFactory);
+        return this;
+    }
+
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/module/factory/CertificateReloadManagerFactory.java b/model/infinispan/src/main/java/org/keycloak/infinispan/module/factory/CertificateReloadManagerFactory.java
new file mode 100644
index 000000000000..1752e7f99937
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/module/factory/CertificateReloadManagerFactory.java
@@ -0,0 +1,33 @@
+package org.keycloak.infinispan.module.factory;
+
+import org.infinispan.factories.AbstractComponentFactory;
+import org.infinispan.factories.AutoInstantiableFactory;
+import org.infinispan.factories.annotations.DefaultFactoryFor;
+import org.keycloak.jgroups.certificates.CertificateReloadManager;
+import org.keycloak.infinispan.module.configuration.global.KeycloakConfiguration;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+
+@DefaultFactoryFor(classes = CertificateReloadManager.class)
+public class CertificateReloadManagerFactory extends AbstractComponentFactory implements AutoInstantiableFactory {
+
+    @Override
+    public Object construct(String componentName) {
+        var kcConfig = globalConfiguration.module(KeycloakConfiguration.class);
+        if (kcConfig == null) {
+            return null;
+        }
+        var sessionFactory = kcConfig.keycloakSessionFactory();
+        if (supportsReloadAndRotation(sessionFactory)) {
+            return new CertificateReloadManager(sessionFactory);
+        }
+        return null;
+    }
+
+    private boolean supportsReloadAndRotation(KeycloakSessionFactory factory) {
+        try (var session = factory.create()) {
+            var provider = session.getProvider(JGroupsCertificateProvider.class);
+            return provider != null && provider.isEnabled() && provider.supportRotateAndReload();
+        }
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/infinispan/util/InfinispanUtils.java b/model/infinispan/src/main/java/org/keycloak/infinispan/util/InfinispanUtils.java
index 9339c37a934d..f2b0b4ae1942 100644
--- a/model/infinispan/src/main/java/org/keycloak/infinispan/util/InfinispanUtils.java
+++ b/model/infinispan/src/main/java/org/keycloak/infinispan/util/InfinispanUtils.java
@@ -31,6 +31,10 @@ public final class InfinispanUtils {
     private InfinispanUtils() {
     }
 
+    private static final String INFINISPAN_VIRTUAL_THREADS_PROP = "org.infinispan.threads.virtual";
+
+    private static final int MIN_VT_POOL_SIZE = 2;
+
     // all providers have the same order
     public static final int PROVIDER_ORDER = 1;
 
@@ -93,4 +97,33 @@ public static void maxRetriesToOperationalInfo(Map<String, String> map, int valu
     public static void retryBaseTimeMillisToOperationalInfo(Map<String, String> map, int value) {
         map.put(CONFIG_RETRIES_BASE_TIME_MILLIS, Integer.toString(value));
     }
+
+    public static boolean isVirtualThreadsEnabled() {
+        return Boolean.parseBoolean(System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP));
+    }
+
+    public static void configureVirtualThreads() {
+        // enable Infinispan and JGroups virtual threads by default
+        if (System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP) == null && getParallelism() >= MIN_VT_POOL_SIZE)
+            System.setProperty(INFINISPAN_VIRTUAL_THREADS_PROP, "true");
+    }
+
+    public static void ensureVirtualThreadsParallelism() {
+        if (isVirtualThreadsEnabled()) {
+            if (getParallelism() < MIN_VT_POOL_SIZE) {
+                throw new RuntimeException("To be able to use Infinispan/JGroups virtual threads, you need to set the Java system property jdk.virtualThreadScheduler.parallelism to at least " + MIN_VT_POOL_SIZE);
+            }
+        }
+    }
+
+    private static int getParallelism() {
+        int parallelism;
+        String parallelismValue = System.getProperty("jdk.virtualThreadScheduler.parallelism");
+        if (parallelismValue != null) {
+            parallelism = Integer.parseInt(parallelismValue);
+        } else {
+            parallelism = Runtime.getRuntime().availableProcessors();
+        }
+        return parallelism;
+    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/CertificateReloadManager.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/CertificateReloadManager.java
new file mode 100644
index 000000000000..c3f7d9c1f5c3
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/CertificateReloadManager.java
@@ -0,0 +1,258 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.lang.invoke.MethodHandles;
+import java.time.Duration;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.locks.ReentrantLock;
+
+import org.infinispan.commons.api.Lifecycle;
+import org.infinispan.factories.KnownComponentNames;
+import org.infinispan.factories.annotations.ComponentName;
+import org.infinispan.factories.annotations.Inject;
+import org.infinispan.factories.annotations.Start;
+import org.infinispan.factories.annotations.Stop;
+import org.infinispan.factories.scopes.Scope;
+import org.infinispan.factories.scopes.Scopes;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.infinispan.notifications.Listener;
+import org.infinispan.notifications.cachemanagerlistener.CacheManagerNotifier;
+import org.infinispan.notifications.cachemanagerlistener.annotation.Merged;
+import org.infinispan.notifications.cachemanagerlistener.annotation.ViewChanged;
+import org.infinispan.notifications.cachemanagerlistener.event.ViewChangedEvent;
+import org.infinispan.remoting.transport.Address;
+import org.infinispan.util.concurrent.BlockingManager;
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+
+/**
+ * Class to handle JGroups certificate reloading for encryption (mTLS).
+ * <p>
+ * This class is attached to Infinispan lifecycle, and it starts/stops together with the {@link EmbeddedCacheManager}.
+ * <p>
+ * It provides two public methods, {@link #rotateCertificate()} to force a certificate rotation without waiting for the
+ * configured period, and {@link #reloadCertificate()} to force a certificate reloading from storage and schedule the
+ * next rotation.
+ * <p>
+ * When the timer expires, only the cluster coordinator generates a new certificate. It notifies the other cluster
+ * members that a new certificate is available in storage. Both the key and trust stores keep a hold of the old and the
+ * new certificates.
+ * <p>
+ * Last, but not least, it listens to topology changes and, if the coordinator crashes, the new re-elected coordinator
+ * will continue to perform its duties to rotate the certificate.
+ */
+@Scope(Scopes.GLOBAL)
+@Listener
+public class CertificateReloadManager implements Lifecycle {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+    private static final Duration RETRY_WAIT_TIME = Duration.ofMinutes(1);
+    private static final Duration BOOT_PERIOD = Duration.ofMillis(500);
+
+    private final KeycloakSessionFactory sessionFactory;
+    private final AutoCloseableLock lock;
+    private ScheduledFuture<?> scheduledFuture;
+    private ScheduledFuture<?> bootFuture;
+
+    @Inject EmbeddedCacheManager cacheManager;
+    @Inject CacheManagerNotifier notifier;
+    @Inject BlockingManager blockingManager;
+    @ComponentName(KnownComponentNames.EXPIRATION_SCHEDULED_EXECUTOR)
+    @Inject ScheduledExecutorService scheduledExecutorService;
+
+    public CertificateReloadManager(KeycloakSessionFactory sessionFactory) {
+        this.sessionFactory = sessionFactory;
+        lock = new AutoCloseableLock(new ReentrantLock());
+    }
+
+    @Override
+    @Start
+    public void start() {
+        logger.info("Starting JGroups certificate reload manager");
+        notifier.addListener(this);
+        scheduleNextRotation();
+
+        lock.lock();
+        try(lock) {
+            // It is invoked before JGroups starts; it schedules a fast pace reload of the certificate.
+            // It is canceled when it gets a view from JGroups.
+            // This is here to prevent the case when a node joins during a rotation process.
+            bootFuture = scheduledExecutorService.scheduleAtFixedRate(() -> blockingManager.runBlocking(this::bootReload, "boot-reload"), BOOT_PERIOD.toMillis(), BOOT_PERIOD.toMillis(), TimeUnit.MILLISECONDS);
+        }
+
+    }
+
+    @Override
+    @Stop
+    public void stop() {
+        logger.info("Stopping JGroups certificate reload manager");
+        notifier.removeListener(this);
+        lock.lock();
+        try (lock) {
+            if (scheduledFuture == null) {
+                return;
+            }
+            scheduledFuture.cancel(true);
+        }
+    }
+
+    /**
+     * Creates and reload a new certificate.
+     */
+    public void rotateCertificate() {
+        logger.info("Rotating JGroups certificate");
+        lock.lock();
+        try (lock) {
+            KeycloakModelUtils.runJobInTransaction(sessionFactory, CertificateReloadManager::replaceCertificateInTransaction);
+            sendReloadNotification();
+        } catch (RuntimeException e) {
+            logger.warn("Failed to rotate JGroups certificate", e);
+            retry(this::rotateCertificate, "retry-rotate");
+        }
+    }
+
+    /**
+     * Reloads the certificate from storage.
+     */
+    public void reloadCertificate() {
+        logger.info("Reloading JGroups Certificate");
+        lock.lock();
+        try (lock) {
+            if (bootFuture != null) {
+                bootFuture.cancel(true);
+                bootFuture = null;
+            }
+            KeycloakModelUtils.runJobInTransaction(sessionFactory, CertificateReloadManager::loadCertificateInTransaction);
+        } catch (RuntimeException e) {
+            logger.warn("Failed to reload JGroups certificate", e);
+            retry(this::reloadCertificate, "retry-reload");
+        } finally {
+            scheduleNextRotation();
+        }
+    }
+
+    @ViewChanged
+    @Merged
+    public void onViewChanged(ViewChangedEvent event) {
+        logger.debug("On view changed");
+        // probably a waste to reload, but if we have a partition, we reload the most recent certificate stored.
+        reloadCertificate();
+    }
+
+    // testing purpose
+    public boolean isCoordinator() {
+        return cacheManager.isCoordinator();
+    }
+
+    // testing purpose
+    public boolean hasRotationTask() {
+        lock.lock();
+        try (lock) {
+            return scheduledFuture != null;
+        }
+    }
+
+    private void bootReload() {
+        logger.debug("[Boot] reloading certificate.");
+        lock.lock();
+        try (lock) {
+            KeycloakModelUtils.runJobInTransaction(sessionFactory, CertificateReloadManager::loadCertificateInTransaction);
+        } catch (RuntimeException e) {
+            logger.warn("Exception on boot reload cycle. Ignoring it.", e);
+        }
+    }
+
+    private void onInvalidCertificate() {
+        logger.info("On certificate exception");
+        blockingManager.runBlocking(this::reloadCertificate, "invalid-certificate");
+    }
+
+    private void onCertificateReloadResponse(Address address, Void unused, Throwable throwable) {
+        if (throwable != null) {
+            logger.warnf(throwable, "Node %s failed to handle JGroups certificate reload notification.", address);
+            retry(() -> sendReloadNotification(address), "retry-notification");
+        }
+    }
+
+    private void scheduleNextRotation() {
+        lock.lock();
+        try (lock) {
+            if (scheduledFuture != null) {
+                scheduledFuture.cancel(false);
+            }
+            if (!isCoordinator()) {
+                return;
+            }
+
+            var delay = KeycloakModelUtils.runJobInTransactionWithResult(sessionFactory, CertificateReloadManager::nextRotationDelay);
+            logger.debugf("Next rotation in %s", delay);
+            if (delay.isZero()) {
+                blockingManager.runBlocking(this::rotateCertificate, "rotate");
+                return;
+            }
+            scheduledFuture = scheduledExecutorService.schedule(() -> blockingManager.runBlocking(this::rotateCertificate, "rotate"), delay.toSeconds(), TimeUnit.SECONDS);
+        }
+    }
+
+    private static void replaceCertificateInTransaction(KeycloakSession session) {
+        session.getProvider(JGroupsCertificateProvider.class).rotateCertificate();
+    }
+
+    private static void loadCertificateInTransaction(KeycloakSession session) {
+        session.getProvider(JGroupsCertificateProvider.class).reloadCertificate();
+    }
+
+    private static Duration nextRotationDelay(KeycloakSession session) {
+        return session.getProvider(JGroupsCertificateProvider.class).nextRotation();
+    }
+
+    private void sendReloadNotification() {
+        cacheManager.executor()
+                .allNodeSubmission()
+                .submitConsumer(ReloadCertificateFunction.getInstance(), this::onCertificateReloadResponse);
+    }
+
+    private void sendReloadNotification(Address destination) {
+        cacheManager.executor()
+                .filterTargets(destination::equals)
+                .submitConsumer(ReloadCertificateFunction.getInstance(), this::onCertificateReloadResponse);
+    }
+
+    private void retry(Runnable runnable, String traceId) {
+        scheduledExecutorService.schedule(() -> blockingManager.runBlocking(runnable, traceId), RETRY_WAIT_TIME.toSeconds(), TimeUnit.SECONDS);
+    }
+
+    private record AutoCloseableLock(ReentrantLock innerLock) implements AutoCloseable {
+
+        public void lock() {
+            innerLock.lock();
+        }
+
+        @Override
+        public void close() {
+            innerLock.unlock();
+        }
+    }
+
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DatabaseJGroupsCertificateProvider.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DatabaseJGroupsCertificateProvider.java
new file mode 100644
index 000000000000..0e93fdcb7677
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DatabaseJGroupsCertificateProvider.java
@@ -0,0 +1,198 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.io.IOException;
+import java.lang.invoke.MethodHandles;
+import java.security.GeneralSecurityException;
+import java.time.Duration;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+import org.jboss.logging.Logger;
+import org.keycloak.common.util.Retry;
+import org.keycloak.common.util.Time;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+import org.keycloak.storage.configuration.ServerConfigStorageProvider;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.TrustManager;
+
+import static org.keycloak.jgroups.certificates.JGroupsCertificate.fromJson;
+import static org.keycloak.jgroups.certificates.JGroupsCertificate.toJson;
+
+/**
+ * A {@link JGroupsCertificateProvider} implementation that stores the certificates in the database.
+ * <p>
+ * The generated certificate is self-signed, and the database is used to share the certificate amongst the Keycloak
+ * instances in the cluster. This implementation supports rotation and reloading of the certificate. The rotation can
+ * happen at any time, or by a periodic task, or by sysadmin request.
+ */
+public class DatabaseJGroupsCertificateProvider implements JGroupsCertificateProvider {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+    public static final String CERTIFICATE_ID = "crt_jgroups";
+    private static final int STARTUP_RETRIES = 5;
+    private static final int STARTUP_RETRY_SLEEP_MILLIS = 500;
+
+    private final KeycloakSessionFactory sessionFactory;
+    private final ReloadingX509ExtendedKeyManager keyManager;
+    private final ReloadingX509ExtendedTrustManager trustManager;
+    private final Lock lock = new ReentrantLock();
+    // not final to be updated for testing
+    private volatile Duration rotationPeriod;
+    private volatile JGroupsCertificate currentCertificate;
+
+    private DatabaseJGroupsCertificateProvider(KeycloakSessionFactory sessionFactory, Duration rotationPeriod) {
+        this.sessionFactory = Objects.requireNonNull(sessionFactory);
+        this.rotationPeriod = Objects.requireNonNull(rotationPeriod);
+        keyManager = new ReloadingX509ExtendedKeyManager();
+        trustManager = new ReloadingX509ExtendedTrustManager();
+        currentCertificate = new JGroupsCertificate();
+    }
+
+    public static DatabaseJGroupsCertificateProvider create(KeycloakSessionFactory factory, Duration rotationPeriod) {
+        var provider = new DatabaseJGroupsCertificateProvider(factory, rotationPeriod);
+        provider.init();
+        return provider;
+    }
+
+    private void init() {
+        logger.debug("Initializing JGroups mTLS certificate.");
+        var cert = Retry.call(ignored -> KeycloakModelUtils.runJobInTransactionWithResult(sessionFactory, this::loadOrCreateCertificate), STARTUP_RETRIES, STARTUP_RETRY_SLEEP_MILLIS);
+        useCertificate(cert);
+        trustManager.setExceptionHandler(this::onTrustManagerException);
+    }
+
+    @Override
+    public void rotateCertificate() {
+        KeycloakModelUtils.runJobInTransaction(sessionFactory, this::replaceCertificateFromDatabase);
+    }
+
+    @Override
+    public void reloadCertificate() {
+        doReload();
+    }
+
+    @Override
+    public Duration nextRotation() {
+        var cert = currentCertificate;
+        return delayUntilNextRotation(Instant.ofEpochMilli(cert.getGeneratedMillis()), cert.getCertificate().getNotAfter().toInstant());
+    }
+
+    @Override
+    public boolean supportRotateAndReload() {
+        return true;
+    }
+
+    @Override
+    public KeyManager keyManager() {
+        return keyManager;
+    }
+
+    @Override
+    public TrustManager trustManager() {
+        return trustManager;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+
+    public void setRotationPeriod(Duration rotationPeriod) {
+        this.rotationPeriod = Objects.requireNonNull(rotationPeriod);
+    }
+
+    public Duration getRotationPeriod() {
+        return rotationPeriod;
+    }
+
+    public JGroupsCertificate getCurrentCertificate() {
+        return currentCertificate;
+    }
+
+    private void onTrustManagerException() {
+        doReload();
+    }
+
+    private void doReload() {
+        KeycloakModelUtils.runJobInTransactionWithResult(sessionFactory, DatabaseJGroupsCertificateProvider::loadCertificateFromDatabase)
+                .map(JGroupsCertificate::fromJson)
+                .ifPresent(this::useCertificate);
+    }
+
+    private Duration delayUntilNextRotation(Instant certificateStartInstant, Instant certificateEndInstant) {
+        // Avoid the current certificate to expire if the old duration was shorter than the new duration.
+        // Compute the rotation instant based on the certificate start and end instants.
+        var rotationInstant = certificateStartInstant.plus(Duration.between(certificateStartInstant, certificateEndInstant).dividedBy(2));
+
+        // Compute rotation instant based on the configured rotationPeriod.
+        var configuredRotation = certificateStartInstant.plus(rotationPeriod);
+
+        // Pick the smaller one.
+        // Most of the time they are the same, but we need to cover the case where the user modifies the rotation period to a short interval.
+        var secondsLeft = configuredRotation.isBefore(rotationInstant) ?
+                Instant.ofEpochSecond(Time.currentTime()).until(configuredRotation, ChronoUnit.SECONDS) :
+                Instant.ofEpochSecond(Time.currentTime()).until(rotationInstant, ChronoUnit.SECONDS);
+        return secondsLeft > 0 ? Duration.ofSeconds(secondsLeft) : Duration.ZERO;
+    }
+
+    private static Optional<String> loadCertificateFromDatabase(KeycloakSession session) {
+        return session.getProvider(ServerConfigStorageProvider.class).find(CERTIFICATE_ID);
+    }
+
+    private void replaceCertificateFromDatabase(KeycloakSession session) {
+        var storage = session.getProvider(ServerConfigStorageProvider.class);
+        storage.replace(CERTIFICATE_ID, currentCertificate::isSameAlias, this::generateSelfSignedCertificate);
+    }
+
+    private void useCertificate(JGroupsCertificate certificate) {
+        lock.lock();
+        try {
+            if (Objects.equals(currentCertificate.getAlias(), certificate.getAlias())) {
+                return;
+            }
+            var km = Utils.createKeyManager(certificate);
+            var tm = Utils.createTrustManager(certificate);
+            currentCertificate = certificate;
+            keyManager.reload(km);
+            trustManager.reload(tm);
+        } catch (GeneralSecurityException | IOException e) {
+            throw new RuntimeException(e);
+        } finally {
+            lock.unlock();
+        }
+    }
+
+    private JGroupsCertificate loadOrCreateCertificate(KeycloakSession session) {
+        var storage = session.getProvider(ServerConfigStorageProvider.class);
+        return fromJson(storage.loadOrCreate(CERTIFICATE_ID, this::generateSelfSignedCertificate));
+    }
+
+    private String generateSelfSignedCertificate() {
+        return toJson(Utils.generateSelfSignedCertificate(rotationPeriod.multipliedBy(2L)));
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DefaultJGroupsCertificateProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DefaultJGroupsCertificateProviderFactory.java
new file mode 100644
index 000000000000..28c912bedd6f
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/DefaultJGroupsCertificateProviderFactory.java
@@ -0,0 +1,189 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.io.File;
+import java.time.Duration;
+import java.util.List;
+import java.util.Set;
+
+import org.keycloak.Config;
+import org.keycloak.config.CachingOptions;
+import org.keycloak.config.Option;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+import org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory;
+import org.keycloak.storage.configuration.ServerConfigStorageProvider;
+
+/**
+ * The default implementation for {@link JGroupsCertificateProvider}.
+ * <p>
+ * This implementation will return different implementation based on the current configuration.
+ *
+ * @see DatabaseJGroupsCertificateProvider
+ * @see FileJGroupsCertificateProvider
+ */
+public class DefaultJGroupsCertificateProviderFactory implements JGroupsCertificateProviderFactory {
+
+    // config
+    private static final String ENABLED = "enabled";
+    private static final String ROTATION = "rotation";
+    private static final String KEYSTORE_PATH = "keystoreFile";
+    private static final String KEYSTORE_PASSWORD = "keystorePassword";
+    private static final String TRUSTSTORE_PATH = "truststoreFile";
+    private static final String TRUSTSTORE_PASSWORD = "truststorePassword";
+
+    // shared state
+    private volatile JGroupsCertificateProvider provider;
+    private volatile Config.Scope configuration;
+
+    @Override
+    public JGroupsCertificateProvider create(KeycloakSession session) {
+        if (provider == null) {
+            postInit(session.getKeycloakSessionFactory());
+        }
+        return provider;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.configuration = config;
+    }
+
+    @Override
+    public synchronized void postInit(KeycloakSessionFactory factory) {
+        if (provider != null) {
+            return;
+        }
+        provider = createProvider(factory);
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public Set<Class<? extends Provider>> dependsOn() {
+        return Set.of(ServerConfigStorageProvider.class);
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        var builder = ProviderConfigurationBuilder.create();
+        addEnabledOption(builder);
+        addRotationOption(builder);
+        addPropertyForFile(builder, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE, KEYSTORE_PATH);
+        addPropertyForFile(builder, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE, TRUSTSTORE_PATH);
+        addPropertyForPassword(builder, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD, KEYSTORE_PASSWORD);
+        addPropertyForPassword(builder, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD, TRUSTSTORE_PASSWORD);
+        return builder.build();
+    }
+
+    private JGroupsCertificateProvider createProvider(KeycloakSessionFactory factory) {
+        if (!configuration.getBoolean(ENABLED, Boolean.FALSE)) {
+            return JGroupsCertificateProvider.DISABLED;
+        }
+        if (isKeystoreOrTruststoreConfigured()) {
+            return FileJGroupsCertificateProvider.create(
+                  requireConfigurationAndFile(KEYSTORE_PATH, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE),
+                  requireConfiguration(KEYSTORE_PASSWORD, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD),
+                  requireConfigurationAndFile(TRUSTSTORE_PATH, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE),
+                  requireConfiguration(TRUSTSTORE_PASSWORD, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD)
+            );
+        }
+        return DatabaseJGroupsCertificateProvider.create(factory, Duration.ofDays(requireRotationInDays()));
+    }
+
+    private boolean isKeystoreOrTruststoreConfigured() {
+        return configuration.get(KEYSTORE_PATH) != null || configuration.get(TRUSTSTORE_PATH) != null;
+    }
+
+    private long requireRotationInDays() {
+        var value = configuration.getLong(ROTATION);
+        if (value == null) {
+            throw new RuntimeException("Property '%s' required but not specified.".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION.getKey()));
+        }
+        return value;
+    }
+
+    private String requireConfigurationAndFile(String key, Option<?> option) {
+        var value = requireConfiguration(key, option);
+        if (!new File(value).exists()) {
+            throw new RuntimeException("Property '%s' file '%s' does not exist.".formatted(key, value));
+        }
+        return value;
+    }
+
+    private String requireConfiguration(String key, Option<?> option) {
+        var value = configuration.get(key);
+        if (value == null) {
+            throw new RuntimeException("Property '%s' required but not specified".formatted(option.getKey()));
+        }
+        return value;
+    }
+
+    private static void addEnabledOption(ProviderConfigurationBuilder builder) {
+        propertyForOption(builder, CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)
+                .name(ENABLED)
+                .type(ProviderConfigProperty.BOOLEAN_TYPE)
+                .label("enabled")
+                .add();
+    }
+
+    private static void addRotationOption(ProviderConfigurationBuilder builder) {
+        propertyForOption(builder, CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION)
+                .name(ROTATION)
+                .type(ProviderConfigProperty.INTEGER_TYPE)
+                .label("days")
+                .add();
+    }
+
+    private static void addPropertyForFile(ProviderConfigurationBuilder builder, Option<?> option, String name) {
+        propertyForOption(builder, option)
+                .name(name)
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .label("file")
+                .add();
+    }
+
+    private static void addPropertyForPassword(ProviderConfigurationBuilder builder, Option<?> option, String name) {
+        propertyForOption(builder, option)
+                .name(name)
+                .type(ProviderConfigProperty.PASSWORD)
+                .label("password")
+                .secret(true)
+                .add();
+    }
+
+    private static ProviderConfigurationBuilder.ProviderConfigPropertyBuilder propertyForOption(ProviderConfigurationBuilder builder, Option<?> option) {
+        var property = builder.property();
+        option.getDefaultValue().ifPresent(property::defaultValue);
+        property.helpText(option.getDescription());
+        return property;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/FileJGroupsCertificateProvider.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/FileJGroupsCertificateProvider.java
new file mode 100644
index 000000000000..0c5148294700
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/FileJGroupsCertificateProvider.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.util.Objects;
+
+import org.jgroups.util.FileWatcher;
+import org.jgroups.util.SslContextFactory;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.TrustManager;
+
+/**
+ * A {@link JGroupsCertificateProvider} implementation that reads the key and trust stores from a file.
+ * <p>
+ * This implementation periodically inspects the file for changes. If the files are modified, the new key and trust
+ * stores are reloaded and used.
+ */
+public class FileJGroupsCertificateProvider implements JGroupsCertificateProvider {
+
+    private final SslContextFactory.Context context;
+
+    private FileJGroupsCertificateProvider(SslContextFactory.Context context) {
+        this.context = Objects.requireNonNull(context);
+    }
+
+    public static FileJGroupsCertificateProvider create(String keyStoreFile, String keyStorePassword, String trustStoreFile, String trustStorePassword) {
+        var context = new SslContextFactory()
+                .sslProtocol("TLS")
+                .keyStoreFileName(Objects.requireNonNull(keyStoreFile))
+                .keyStorePassword(Objects.requireNonNull(keyStorePassword))
+                .keyStoreType("pkcs12")
+                .trustStoreFileName(Objects.requireNonNull(trustStoreFile))
+                .trustStorePassword(Objects.requireNonNull(trustStorePassword))
+                .trustStoreType("pkcs12")
+                .watcher(new FileWatcher())
+                .build();
+        return new FileJGroupsCertificateProvider(context);
+    }
+
+
+    @Override
+    public KeyManager keyManager() {
+        return context.keyManager();
+    }
+
+    @Override
+    public TrustManager trustManager() {
+        return context.trustManager();
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/JGroupsCertificate.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/JGroupsCertificate.java
new file mode 100644
index 000000000000..e4ba9599906c
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/JGroupsCertificate.java
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.security.KeyPair;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.keycloak.common.util.PemUtils;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * JPA entity to store the {@link X509Certificate} and {@link KeyPair}.
+ */
+@SuppressWarnings("unused")
+public class JGroupsCertificate {
+
+    @JsonProperty("prvKey")
+    private String privateKeyPem;
+
+    @JsonProperty("pubKey")
+    private String publicKeyPem;
+
+    @JsonProperty("crt")
+    private String certificatePem;
+
+    @JsonProperty("alias")
+    private String alias;
+
+    @JsonProperty("generatedMillis")
+    private long generatedMillis;
+
+    public JGroupsCertificate() {
+    }
+
+    public String getCertificatePem() {
+        return certificatePem;
+    }
+
+    public void setCertificatePem(String certificatePem) {
+        this.certificatePem = certificatePem;
+    }
+
+    public String getPrivateKeyPem() {
+        return privateKeyPem;
+    }
+
+    public void setPrivateKeyPem(String privateKeyPem) {
+        this.privateKeyPem = privateKeyPem;
+    }
+
+    public String getPublicKeyPem() {
+        return publicKeyPem;
+    }
+
+    public void setPublicKeyPem(String publicKeyPem) {
+        this.publicKeyPem = publicKeyPem;
+    }
+
+    public String getAlias() {
+        return alias;
+    }
+
+    public void setAlias(String alias) {
+        this.alias = alias;
+    }
+
+    public long getGeneratedMillis() {
+        return generatedMillis;
+    }
+
+    public void setGeneratedMillis(long generatedMillis) {
+        this.generatedMillis = generatedMillis;
+    }
+
+    @JsonIgnore
+    public void setCertificate(X509Certificate certificate) {
+        Objects.requireNonNull(certificate);
+        setCertificatePem(PemUtils.encodeCertificate(certificate));
+    }
+
+    @JsonIgnore
+    public void setKeyPair(KeyPair keyPair) {
+        Objects.requireNonNull(keyPair);
+        setPrivateKeyPem(PemUtils.encodeKey(keyPair.getPrivate()));
+        setPublicKeyPem(PemUtils.encodeKey(keyPair.getPublic()));
+    }
+
+    @JsonIgnore
+    public X509Certificate getCertificate() {
+        return PemUtils.decodeCertificate(getCertificatePem());
+    }
+
+    @JsonIgnore
+    public KeyPair getKeyPair() {
+        var prv = PemUtils.decodePrivateKey(getPrivateKeyPem());
+        var pub = PemUtils.decodePublicKey(getPublicKeyPem());
+        return new KeyPair(pub, prv);
+    }
+
+    @JsonIgnore
+    public PrivateKey getPrivateKey() {
+        return PemUtils.decodePrivateKey(getPrivateKeyPem());
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == null || getClass() != o.getClass()) return false;
+
+        JGroupsCertificate that = (JGroupsCertificate) o;
+        return Objects.equals(privateKeyPem, that.privateKeyPem) &&
+                Objects.equals(publicKeyPem, that.publicKeyPem) &&
+                Objects.equals(certificatePem, that.certificatePem);
+    }
+
+    @Override
+    public int hashCode() {
+        int result = Objects.hashCode(privateKeyPem);
+        result = 31 * result + Objects.hashCode(publicKeyPem);
+        result = 31 * result + Objects.hashCode(certificatePem);
+        return result;
+    }
+
+    public boolean isSameAlias(String jsonCertificate) {
+        return Objects.equals(alias, fromJson(jsonCertificate).getAlias());
+    }
+
+    public static String toJson(JGroupsCertificate entity) {
+        try {
+            return JsonSerialization.mapper.writeValueAsString(entity);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Should never happen!", e);
+        }
+    }
+
+    public static JGroupsCertificate fromJson(String json) {
+        try {
+            return JsonSerialization.mapper.readValue(json, JGroupsCertificate.class);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Should never happen!", e);
+        }
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadCertificateFunction.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadCertificateFunction.java
new file mode 100644
index 000000000000..a8400bac6ec2
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadCertificateFunction.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.util.function.Function;
+
+import org.infinispan.factories.GlobalComponentRegistry;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.infinispan.protostream.annotations.ProtoFactory;
+import org.infinispan.protostream.annotations.ProtoTypeId;
+import org.keycloak.marshalling.Marshalling;
+
+/**
+ * Reloads the JGroups certificate
+ */
+@ProtoTypeId(Marshalling.RELOAD_CERTIFICATE_FUNCTION)
+public final class ReloadCertificateFunction implements Function<EmbeddedCacheManager, Void> {
+
+    private static final ReloadCertificateFunction INSTANCE = new ReloadCertificateFunction();
+
+    private ReloadCertificateFunction() {}
+
+    @ProtoFactory
+    public static ReloadCertificateFunction getInstance() {
+        return INSTANCE;
+    }
+
+    @Override
+    public Void apply(EmbeddedCacheManager embeddedCacheManager) {
+        var crm = GlobalComponentRegistry.componentOf(embeddedCacheManager, CertificateReloadManager.class);
+        if (crm != null) {
+            crm.reloadCertificate();
+        }
+        return null;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedKeyManager.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedKeyManager.java
new file mode 100644
index 000000000000..57c0a1124672
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedKeyManager.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.lang.invoke.MethodHandles;
+import java.net.Socket;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+import org.jboss.logging.Logger;
+
+import javax.net.ssl.X509ExtendedKeyManager;
+
+/**
+ * A {@link X509ExtendedKeyManager} implementation that allows to update the keys and certificates at runtime.
+ */
+class ReloadingX509ExtendedKeyManager extends X509ExtendedKeyManager {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+    private volatile X509ExtendedKeyManager delegate;
+
+    @Override
+    public String[] getClientAliases(String keyType, Principal[] issuers) {
+        var r = delegate.getClientAliases(keyType, issuers);
+        if (logger.isDebugEnabled() && r != null) {
+            logger.debugf("getClientAliases - %s", Arrays.toString(r));
+        }
+        return r;
+    }
+
+    @Override
+    public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
+        var r = delegate.chooseClientAlias(keyType, issuers, socket);
+        logger.debugf("chooseClientAlias - %s", r);
+        return r;
+    }
+
+    @Override
+    public String[] getServerAliases(String keyType, Principal[] issuers) {
+        var r = delegate.getServerAliases(keyType, issuers);
+        if (logger.isDebugEnabled()) {
+            logger.debugf("getServerAliases - %s", Arrays.toString(r));
+        }
+        return r;
+    }
+
+    @Override
+    public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
+        var r = delegate.chooseServerAlias(keyType, issuers, socket);
+        logger.debugf("chooseServerAlias - %s", r);
+        return r;
+    }
+
+    @Override
+    public X509Certificate[] getCertificateChain(String alias) {
+        var r = delegate.getCertificateChain(alias);
+        if (logger.isDebugEnabled() && r != null) {
+            logger.debugf("getCertificateChain - serial numbers: %s", Arrays.stream(r).map(X509Certificate::getSerialNumber).map(String::valueOf).collect(Collectors.joining(", ")));
+        }
+        return r;
+    }
+
+    @Override
+    public PrivateKey getPrivateKey(String alias) {
+        return delegate.getPrivateKey(alias);
+    }
+
+    public void reload(X509ExtendedKeyManager keyManager) {
+        delegate = Objects.requireNonNull(keyManager);
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedTrustManager.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedTrustManager.java
new file mode 100644
index 000000000000..39fded07d34b
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/ReloadingX509ExtendedTrustManager.java
@@ -0,0 +1,117 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.net.Socket;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.X509ExtendedTrustManager;
+
+/**
+ * A {@link X509ExtendedTrustManager} that allows to update the trusted certificate at runtime.
+ */
+class ReloadingX509ExtendedTrustManager extends X509ExtendedTrustManager {
+
+    private volatile X509ExtendedTrustManager delegate;
+    private volatile Runnable onException;
+
+    public ReloadingX509ExtendedTrustManager() {
+        this.onException = () -> {
+        };
+    }
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException {
+        try {
+            delegate.checkClientTrusted(chain, authType, engine);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException {
+        try {
+            delegate.checkClientTrusted(chain, authType, socket);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) throws CertificateException {
+        try {
+
+            delegate.checkServerTrusted(chain, authType, engine);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException {
+        try {
+
+            delegate.checkServerTrusted(chain, authType, socket);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        try {
+
+            delegate.checkClientTrusted(chain, authType);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        try {
+            delegate.checkServerTrusted(chain, authType);
+        } catch (CertificateException e) {
+            onException.run();
+            throw e;
+        }
+    }
+
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+        return delegate.getAcceptedIssuers();
+    }
+
+    public void setExceptionHandler(Runnable runnable) {
+        this.onException = Objects.requireNonNullElse(runnable, () -> {
+        });
+    }
+
+    public void reload(X509ExtendedTrustManager trustManager) {
+        delegate = Objects.requireNonNull(trustManager);
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/Utils.java b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/Utils.java
new file mode 100644
index 000000000000..0567add5498a
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/certificates/Utils.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.certificates;
+
+import java.io.IOException;
+import java.lang.invoke.MethodHandles;
+import java.math.BigInteger;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.cert.CertificateException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Date;
+import java.util.UUID;
+
+import org.jboss.logging.Logger;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.CertificateUtils;
+import org.keycloak.common.util.KeyUtils;
+import org.keycloak.common.util.KeystoreUtil;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509ExtendedKeyManager;
+import javax.net.ssl.X509ExtendedTrustManager;
+
+public final class Utils {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+    private static final String JGROUPS_SUBJECT = "jgroups";
+    private static final char[] KEY_PASSWORD = "jgroups-password".toCharArray();
+
+    private Utils() {
+    }
+
+    public static JGroupsCertificate generateSelfSignedCertificate(Duration validity) {
+        var endDate = Date.from(Instant.now().plus(validity));
+        var keyPair = KeyUtils.generateRsaKeyPair(2048);
+        var certificate = CertificateUtils.generateV1SelfSignedCertificate(keyPair, JGROUPS_SUBJECT, BigInteger.valueOf(System.currentTimeMillis()), endDate);
+
+        logger.debugf("Created JGroups certificate. Valid until %s", certificate.getNotAfter());
+
+        var entity = new JGroupsCertificate();
+        entity.setCertificate(certificate);
+        entity.setKeyPair(keyPair);
+        entity.setAlias(UUID.randomUUID().toString());
+        entity.setGeneratedMillis(System.currentTimeMillis());
+        return entity;
+    }
+
+    public static X509ExtendedKeyManager createKeyManager(JGroupsCertificate certificate) throws GeneralSecurityException, IOException {
+        var ks = getKeyStore();
+        ks.setKeyEntry(certificate.getAlias(), certificate.getPrivateKey(), KEY_PASSWORD, new java.security.cert.Certificate[]{certificate.getCertificate()});
+        var kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        kmf.init(ks, KEY_PASSWORD);
+        for (KeyManager km : kmf.getKeyManagers()) {
+            if (km instanceof X509ExtendedKeyManager) {
+                return (X509ExtendedKeyManager) km;
+            }
+        }
+        throw new GeneralSecurityException("Could not obtain an X509ExtendedKeyManager");
+    }
+
+    public static X509ExtendedTrustManager createTrustManager(JGroupsCertificate certificate) throws GeneralSecurityException, IOException {
+        var ks = getKeyStore();
+        ks.setCertificateEntry(certificate.getAlias(), certificate.getCertificate());
+        var tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        tmf.init(ks);
+        for (TrustManager tm : tmf.getTrustManagers()) {
+            if (tm instanceof X509ExtendedTrustManager) {
+                return (X509ExtendedTrustManager) tm;
+            }
+        }
+        throw new GeneralSecurityException("Could not obtain an X509TrustManager");
+    }
+
+    private static KeyStore getKeyStore() throws KeyStoreException, NoSuchProviderException, CertificateException, IOException, NoSuchAlgorithmException {
+        KeystoreUtil.KeystoreFormat keystoreFormat = CryptoIntegration.getProvider().getSupportedKeyStoreTypes().findFirst().orElseThrow(() -> new RuntimeException("No supported keystore types found"));
+        var ks = CryptoIntegration.getProvider().getKeyStore(keystoreFormat);
+        ks.load(null, null);
+        return ks;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/jgroups/protocol/KEYCLOAK_JDBC_PING2.java b/model/infinispan/src/main/java/org/keycloak/jgroups/protocol/KEYCLOAK_JDBC_PING2.java
new file mode 100644
index 000000000000..202a3b22913c
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/jgroups/protocol/KEYCLOAK_JDBC_PING2.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jgroups.protocol;
+
+import org.jgroups.protocols.JDBC_PING2;
+import org.jgroups.protocols.PingData;
+import org.keycloak.connections.jpa.JpaConnectionProviderFactory;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.Objects;
+
+/**
+ * Enhanced JDBC_PING2 to handle entries transactionally.
+ * <p>
+ * Workaround for issue <a href="https://issues.redhat.com/browse/JGRP-2870">JGRP-2870</a>
+ */
+public class KEYCLOAK_JDBC_PING2 extends JDBC_PING2 {
+
+    private JpaConnectionProviderFactory factory;
+
+    @Override
+    protected void writeToDB(PingData data, String clustername) throws SQLException {
+        lock.lock();
+        try (Connection connection = getConnection()) {
+            if(call_insert_sp != null && insert_sp != null)
+                callInsertStoredProcedure(connection, data, clustername);
+            else {
+                boolean isAutocommit = connection.getAutoCommit();
+                try {
+                    if (isAutocommit) {
+                        // Always use a transaction for the delete+insert to make it atomic
+                        // to avoid the short moment where there is no entry in the table.
+                        connection.setAutoCommit(false);
+                    }
+                    delete(connection, clustername, data.getAddress());
+                    insert(connection, data, clustername);
+                    if (isAutocommit) {
+                        connection.commit();
+                    }
+                } catch (SQLException e) {
+                    if (isAutocommit) {
+                        connection.rollback();
+                    }
+                    throw e;
+                } finally {
+                    if (isAutocommit) {
+                        connection.setAutoCommit(true);
+                    }
+                }
+            }
+        } finally {
+            lock.unlock();
+        }
+
+    }
+
+    @Override
+    protected void loadDriver() {
+        //no-op, using JpaConnectionProviderFactory
+    }
+
+    @Override
+    protected Connection getConnection() {
+        return factory.getConnection();
+    }
+
+    public void setJpaConnectionProviderFactory(JpaConnectionProviderFactory factory) {
+        this.factory = Objects.requireNonNull(factory);
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanCachePublicKeyProvider.java b/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanCachePublicKeyProvider.java
index 746e207fa74c..302319d8dea6 100644
--- a/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanCachePublicKeyProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanCachePublicKeyProvider.java
@@ -38,7 +38,7 @@ public InfinispanCachePublicKeyProvider(KeycloakSession session, Cache<String, P
     public void clearCache() {
         keys.clear();
         ClusterProvider cluster = session.getProvider(ClusterProvider.class);
-        cluster.notify(InfinispanCachePublicKeyProviderFactory.KEYS_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), true, ClusterProvider.DCNotify.ALL_DCS);
+        cluster.notify(InfinispanCachePublicKeyProviderFactory.KEYS_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), true);
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanPublicKeyStorageProvider.java b/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanPublicKeyStorageProvider.java
index f98f7eb9469c..47011756ea2a 100644
--- a/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanPublicKeyStorageProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/keys/infinispan/InfinispanPublicKeyStorageProvider.java
@@ -120,7 +120,7 @@ protected void runInvalidations() {
                 .peek(keys::remove)
                 .map(PublicKeyStorageInvalidationEvent::create)
                 .toList();
-        cluster.notify(InfinispanCachePublicKeyProviderFactory.PUBLIC_KEY_STORAGE_INVALIDATION_EVENT, events, true, ClusterProvider.DCNotify.ALL_DCS);
+        cluster.notify(InfinispanCachePublicKeyProviderFactory.PUBLIC_KEY_STORAGE_INVALIDATION_EVENT, events, true);
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakIndexSchemaUtil.java b/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakIndexSchemaUtil.java
index c17ea319d1f8..d0933a787c1d 100644
--- a/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakIndexSchemaUtil.java
+++ b/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakIndexSchemaUtil.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.marshalling;
 
+import java.lang.invoke.MethodHandles;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -24,14 +25,24 @@
 import java.util.stream.Stream;
 
 import org.infinispan.api.annotations.indexing.model.Values;
+import org.infinispan.client.hotrod.RemoteCache;
+import org.infinispan.client.hotrod.RemoteCacheManager;
+import org.infinispan.client.hotrod.RemoteCacheManagerAdmin;
+import org.infinispan.commons.internal.InternalCacheNames;
+import org.infinispan.protostream.GeneratedSchema;
 import org.infinispan.protostream.config.Configuration;
 import org.infinispan.protostream.descriptors.AnnotationElement;
 import org.infinispan.protostream.descriptors.Descriptor;
 import org.infinispan.protostream.descriptors.FieldDescriptor;
+import org.infinispan.protostream.descriptors.FileDescriptor;
 import org.infinispan.protostream.impl.AnnotatedDescriptorImpl;
+import org.infinispan.query.remote.client.ProtobufMetadataManagerConstants;
+import org.jboss.logging.Logger;
 
 public class KeycloakIndexSchemaUtil {
 
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+
     // Basic annotation data
     private static final String BASIC_ANNOTATION = "Basic";
     private static final String NAME_ATTRIBUTE = "name";
@@ -44,6 +55,87 @@ public class KeycloakIndexSchemaUtil {
     // we only use Basic annotation, we may need to add others in the future.
     private static final List<String> INDEX_ANNOTATION = List.of(BASIC_ANNOTATION);
 
+    /**
+     * Uploads the {@link GeneratedSchema} to the Infinispan cluster.
+     * <p>
+     * If indexing is enabled for one or more entities present in the {@link GeneratedSchema}, users may add a list of
+     * entities, and the caches where they live. This method will update the indexing schema and perform the reindexing
+     * for the new schema. Note that reindexing may be an expensive operation, depending on the amount of data.
+     *
+     * @param remoteCacheManager The {@link RemoteCacheManager} connected to the Infinispan server.
+     * @param schema             The {@link GeneratedSchema} instance to upload.
+     * @param indexedEntities    The {@link List} of indexed entities and their caches. Duplicates are allowed if the
+     *                           same entity is stored in multiple caches.
+     * @throws NullPointerException if {@code remoteCacheManager} or {@code schema} is null.
+     */
+    public static void uploadAndReindexCaches(RemoteCacheManager remoteCacheManager, GeneratedSchema schema, List<IndexedEntity> indexedEntities) {
+        var key = schema.getProtoFileName();
+        var current = schema.getProtoFile();
+
+        var protostreamMetadataCache = remoteCacheManager.<String, String>getCache(InternalCacheNames.PROTOBUF_METADATA_CACHE_NAME);
+        var stored = protostreamMetadataCache.getWithMetadata(key);
+        if (stored == null) {
+            if (protostreamMetadataCache.putIfAbsent(key, current) == null) {
+                logger.info("Infinispan ProtoStream schema uploaded for the first time.");
+            } else {
+                logger.info("Failed to update Infinispan ProtoStream schema. Assumed it was updated by other Keycloak server.");
+            }
+            checkForProtoSchemaErrors(protostreamMetadataCache);
+            return;
+        }
+        if (Objects.equals(stored.getValue(), current)) {
+            logger.info("Infinispan ProtoStream schema is up to date!");
+            return;
+        }
+        if (protostreamMetadataCache.replaceWithVersion(key, current, stored.getVersion())) {
+            logger.info("Infinispan ProtoStream schema successful updated.");
+            reindexCaches(remoteCacheManager, stored.getValue(), current, indexedEntities);
+        } else {
+            logger.info("Failed to update Infinispan ProtoStream schema. Assumed it was updated by other Keycloak server.");
+        }
+        checkForProtoSchemaErrors(protostreamMetadataCache);
+    }
+
+    private static void checkForProtoSchemaErrors(RemoteCache<String, String> protostreamMetadataCache) {
+        var errors = protostreamMetadataCache.get(ProtobufMetadataManagerConstants.ERRORS_KEY_SUFFIX);
+        if (errors == null) {
+            return;
+        }
+        for (String errorFile : errors.split("\n")) {
+            logger.errorf("%nThere was an error in proto file: %s%nError message: %s%nCurrent proto schema: %s%n",
+                    errorFile,
+                    protostreamMetadataCache.get(errorFile + ProtobufMetadataManagerConstants.ERRORS_KEY_SUFFIX),
+                    protostreamMetadataCache.get(errorFile));
+        }
+    }
+
+    private static void reindexCaches(RemoteCacheManager remoteCacheManager, String oldSchema, String newSchema, List<IndexedEntity> indexedEntities) {
+        if (indexedEntities == null || indexedEntities.isEmpty()) {
+            return;
+        }
+        var oldPS = KeycloakModelSchema.parseProtoSchema(oldSchema);
+        var newPS = KeycloakModelSchema.parseProtoSchema(newSchema);
+        var admin = remoteCacheManager.administration();
+
+        indexedEntities.stream()
+                .filter(Objects::nonNull)
+                .filter(indexedEntity -> isEntityChanged(oldPS, newPS, indexedEntity.entity()))
+                .map(IndexedEntity::cache)
+                .distinct()
+                .forEach(cacheName -> updateSchemaAndReIndexCache(admin, cacheName));
+    }
+
+    private static boolean isEntityChanged(FileDescriptor oldSchema, FileDescriptor newSchema, String entity) {
+        var v1 = KeycloakModelSchema.findEntity(oldSchema, entity);
+        var v2 = KeycloakModelSchema.findEntity(newSchema, entity);
+        return v1.isPresent() && v2.isPresent() && KeycloakIndexSchemaUtil.isIndexSchemaChanged(v1.get(), v2.get());
+    }
+
+    private static void updateSchemaAndReIndexCache(RemoteCacheManagerAdmin admin, String cacheName) {
+        admin.updateIndexSchema(cacheName);
+        admin.reindexCache(cacheName);
+    }
+
     /**
      * Adds the annotations to the ProtoStream parser.
      */
@@ -72,7 +164,8 @@ public static void configureAnnotationProcessor(Configuration.Builder builder) {
     }
 
     /**
-     * Compares two entities and returns {@code true} if any indexing related annotation were changed, added or removed.
+     * Compares two entities and returns {@code true} if any indexing related annotation were changed, added or
+     * removed.
      */
     public static boolean isIndexSchemaChanged(Descriptor oldDescriptor, Descriptor newDescriptor) {
         var allFields = Stream.concat(
@@ -157,4 +250,10 @@ private static Map<String, Object> getAnnotationValues(AnnotationElement.Annotat
                 .collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().getValue().getValue()));
     }
 
+    public record IndexedEntity(String entity, String cache) {
+        public IndexedEntity {
+            Objects.requireNonNull(entity);
+            Objects.requireNonNull(cache);
+        }
+    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakModelSchema.java b/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakModelSchema.java
index 2215f9ee4992..b9b6b75d0edc 100644
--- a/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakModelSchema.java
+++ b/model/infinispan/src/main/java/org/keycloak/marshalling/KeycloakModelSchema.java
@@ -33,6 +33,7 @@
 import org.keycloak.cluster.infinispan.LockEntryPredicate;
 import org.keycloak.cluster.infinispan.WrapperClusterEvent;
 import org.keycloak.component.ComponentModel;
+import org.keycloak.jgroups.certificates.ReloadCertificateFunction;
 import org.keycloak.keys.infinispan.PublicKeyStorageInvalidationEvent;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.cache.infinispan.ClearCacheEvent;
@@ -79,7 +80,6 @@
 import org.keycloak.models.cache.infinispan.stream.InRealmPredicate;
 import org.keycloak.models.sessions.infinispan.changes.ReplaceFunction;
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.changes.sessions.LastSessionRefreshEvent;
 import org.keycloak.models.sessions.infinispan.changes.sessions.SessionData;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionStore;
@@ -95,14 +95,13 @@
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveAllUserLoginFailuresEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveUserSessionsEvent;
-import org.keycloak.models.sessions.infinispan.initializer.InitializerState;
 import org.keycloak.models.sessions.infinispan.stream.AuthClientSessionSetMapper;
 import org.keycloak.models.sessions.infinispan.stream.CollectionToStreamMapper;
 import org.keycloak.models.sessions.infinispan.stream.GroupAndCountCollectorSupplier;
 import org.keycloak.models.sessions.infinispan.stream.MapEntryToKeyMapper;
 import org.keycloak.models.sessions.infinispan.stream.SessionPredicate;
-import org.keycloak.models.sessions.infinispan.stream.SessionWrapperPredicate;
 import org.keycloak.models.sessions.infinispan.stream.SessionUnwrapMapper;
+import org.keycloak.models.sessions.infinispan.stream.SessionWrapperPredicate;
 import org.keycloak.models.sessions.infinispan.stream.UserSessionPredicate;
 import org.keycloak.sessions.CommonClientSessionModel;
 import org.keycloak.storage.UserStorageProviderModel;
@@ -149,14 +148,10 @@
                 ScopeUpdatedEvent.class,
                 ScopeRemovedEvent.class,
 
-                // models.sessions.infinispan.initializer package
-                InitializerState.class,
-
                 // models.sessions.infinispan.changes package
                 SessionEntityWrapper.class,
 
                 // models.sessions.infinispan.changes.sessions package
-                LastSessionRefreshEvent.class,
                 SessionData.class,
 
                 // models.cache.infinispan.authorization.stream package
@@ -206,7 +201,6 @@
                 UserFullInvalidationEvent.class,
                 UserUpdatedEvent.class,
 
-
                 // sessions.infinispan.entities package
                 AuthenticatedClientSessionStore.class,
                 AuthenticatedClientSessionEntity.class,
@@ -227,6 +221,9 @@
                 GroupAndCountCollectorSupplier.class,
                 MapEntryToKeyMapper.class,
                 SessionUnwrapMapper.class,
+
+                // infinispan.module.certificates
+                ReloadCertificateFunction.class,
         }
 )
 public interface KeycloakModelSchema extends GeneratedSchema {
diff --git a/model/infinispan/src/main/java/org/keycloak/marshalling/Marshalling.java b/model/infinispan/src/main/java/org/keycloak/marshalling/Marshalling.java
index 4db2b49e2be2..e6b3be0b9a1c 100644
--- a/model/infinispan/src/main/java/org/keycloak/marshalling/Marshalling.java
+++ b/model/infinispan/src/main/java/org/keycloak/marshalling/Marshalling.java
@@ -17,8 +17,12 @@
 
 package org.keycloak.marshalling;
 
+import java.util.List;
+
 import org.infinispan.client.hotrod.configuration.ConfigurationBuilder;
+import org.infinispan.commons.util.ServiceFinder;
 import org.infinispan.configuration.global.GlobalConfigurationBuilder;
+import org.infinispan.protostream.SerializationContextInitializer;
 
 /**
  * Ids of the protostream type.
@@ -45,6 +49,19 @@ public final class Marshalling {
 
     public static final String PROTO_SCHEMA_PACKAGE = "keycloak";
 
+    private static List<SerializationContextInitializer> SCHEMAS;
+
+    public static List<SerializationContextInitializer> getSchemas() {
+        if (SCHEMAS == null) {
+            setSchemas(ServiceFinder.load(SerializationContextInitializer.class).stream().toList());
+        }
+        return SCHEMAS;
+    }
+
+    public static void setSchemas(List<SerializationContextInitializer> schemas) {
+        SCHEMAS = List.copyOf(schemas);
+    }
+
     private Marshalling() {
     }
 
@@ -163,13 +180,14 @@ private Marshalling() {
     public static final int PERMISSION_TICKET_REMOVED_EVENT = 65613;
     public static final int PERMISSION_TICKET_UPDATED_EVENT = 65614;
 
+    public static final int RELOAD_CERTIFICATE_FUNCTION = 65615;
+
     public static void configure(GlobalConfigurationBuilder builder) {
-        builder.serialization()
-                .addContextInitializer(KeycloakModelSchema.INSTANCE);
+        getSchemas().forEach(builder.serialization()::addContextInitializer);
     }
 
     public static void configure(ConfigurationBuilder builder) {
-        builder.addContextInitializer(KeycloakModelSchema.INSTANCE);
+        getSchemas().forEach(builder::addContextInitializer);
     }
 
     public static String protoEntity(Class<?> clazz) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CacheManager.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CacheManager.java
index ca5e31654cfc..a0fa8d3d7f9d 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CacheManager.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CacheManager.java
@@ -200,7 +200,7 @@ public void addInvalidations(Predicate<Map.Entry<String, Revisioned>> predicate,
     private void put(String id, Revisioned object, long lifespan) {
         if (lifespan < 0) {
             cache.putForExternalRead(id, object);
-        } else {
+        } else if (lifespan > 0) {
             cache.putForExternalRead(id, object, lifespan, TimeUnit.MILLISECONDS);
         }
     }
@@ -215,7 +215,7 @@ private Iterator<Map.Entry<String, Revisioned>> getEntryIterator(Predicate<Map.E
 
     public void sendInvalidationEvents(KeycloakSession session, Collection<InvalidationEvent> invalidationEvents, String eventKey) {
         session.getProvider(ClusterProvider.class)
-                .notify(eventKey, invalidationEvents, true, ClusterProvider.DCNotify.ALL_DCS);
+                .notify(eventKey, invalidationEvents, true);
     }
 
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CachedCount.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CachedCount.java
index 758d72cd2ac2..24a230eecf30 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CachedCount.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/CachedCount.java
@@ -22,18 +22,18 @@
 
 public class CachedCount extends AbstractRevisioned implements InRealm {
 
-    private final RealmModel realm;
+    private final String realm;
     private final long count;
 
     public CachedCount(Long revision, RealmModel realm, String cacheKey, long count) {
         super(revision, cacheKey);
-        this.realm = realm;
+        this.realm = realm.getId();
         this.count = count;
     }
 
     @Override
     public String getRealm() {
-        return realm.getId();
+        return realm;
     }
 
     public long getCount() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/DefaultLazyLoader.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/DefaultLazyLoader.java
index d0c428dfe8b7..0a63c53ed1ca 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/DefaultLazyLoader.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/DefaultLazyLoader.java
@@ -16,12 +16,17 @@
  */
 package org.keycloak.models.cache.infinispan;
 
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.runWithoutAuthorization;
+
 import java.util.function.Function;
 import java.util.function.Supplier;
 
+import org.keycloak.models.KeycloakSession;
+
 /**
- * Default implementation of {@link DefaultLazyLoader} that only fetches data once. This implementation is not thread-safe
- * and cached data is assumed to not be shared across different threads to sync state.
+ * Default implementation of {@link DefaultLazyLoader} that only fetches data once. This implementation is thread-safe
+ * as cached data is used in instanced of {@link org.keycloak.models.cache.infinispan.entities.CachedRealm} which are shared
+ * between multiple threads within a Keycloak instance.
  *
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -29,7 +34,7 @@ public class DefaultLazyLoader<S, D> implements LazyLoader<S, D> {
 
     private final Function<S, D> loader;
     private final Supplier<D> fallback;
-    private D data;
+    private volatile D data;
 
     public DefaultLazyLoader(Function<S, D> loader, Supplier<D> fallback) {
         this.loader = loader;
@@ -37,10 +42,17 @@ public DefaultLazyLoader(Function<S, D> loader, Supplier<D> fallback) {
     }
 
     @Override
-    public D get(Supplier<S> sourceSupplier) {
+    public D get(KeycloakSession session, Supplier<S> sourceSupplier) {
         if (data == null) {
-            S source = sourceSupplier.get();
-            data = source == null ? fallback.get() : this.loader.apply(source);
+            synchronized (this) {
+                if (data == null) {
+                    runWithoutAuthorization(session, () -> {
+                        // make sure caching does not include partial results when FGAP is enabled
+                        S source = sourceSupplier.get();
+                        data = source == null ? fallback.get() : loader.apply(source);
+                    });
+                }
+            }
         }
         return data;
     }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java
index 223a4be2e530..d414e8dc6e00 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/GroupAdapter.java
@@ -51,7 +51,7 @@ public GroupAdapter(CachedGroup cached, RealmCacheSession cacheSession, Keycloak
         this.cacheSession = cacheSession;
         this.keycloakSession = keycloakSession;
         this.realm = realm;
-        modelSupplier = this::getGroupModel;
+        modelSupplier = new LazyModel<>(this::getGroupModel);
     }
 
     protected void getDelegateForUpdate() {
@@ -112,6 +112,18 @@ public void setName(String name) {
 
     }
 
+    @Override
+    public String getDescription() {
+        if (isUpdated()) return updated.getDescription();
+        return cached.getDescription();
+    }
+
+    @Override
+    public void setDescription(String description) {
+        getDelegateForUpdate();
+        updated.setDescription(description);
+    }
+
     @Override
     public void setSingleAttribute(String name, String value) {
         getDelegateForUpdate();
@@ -134,13 +146,13 @@ public void removeAttribute(String name) {
     @Override
     public String getFirstAttribute(String name) {
         if (isUpdated()) return updated.getFirstAttribute(name);
-        return cached.getAttributes(modelSupplier).getFirst(name);
+        return cached.getAttributes(keycloakSession, modelSupplier).getFirst(name);
     }
 
     @Override
     public Stream<String> getAttributeStream(String name) {
         if (isUpdated()) return updated.getAttributeStream(name);
-        List<String> values = cached.getAttributes(modelSupplier).get(name);
+        List<String> values = cached.getAttributes(keycloakSession, modelSupplier).get(name);
         if (values == null) return Stream.empty();
         return values.stream();
     }
@@ -148,7 +160,7 @@ public Stream<String> getAttributeStream(String name) {
     @Override
     public Map<String, List<String>> getAttributes() {
         if (isUpdated()) return updated.getAttributes();
-        return cached.getAttributes(modelSupplier);
+        return cached.getAttributes(keycloakSession, modelSupplier);
     }
 
     @Override
@@ -167,13 +179,13 @@ public Stream<RoleModel> getClientRoleMappingsStream(ClientModel app) {
     public boolean hasDirectRole(RoleModel role) {
         if (isUpdated()) return updated.hasDirectRole(role);
 
-        return cached.getRoleMappings(modelSupplier).contains(role.getId());
+        return cached.getRoleMappings(keycloakSession, modelSupplier).contains(role.getId());
     }
 
     @Override
     public boolean hasRole(RoleModel role) {
         if (isUpdated()) return updated.hasRole(role);
-        if (cached.getRoleMappings(modelSupplier).contains(role.getId())) return true;
+        if (cached.getRoleMappings(keycloakSession, modelSupplier).contains(role.getId())) return true;
         if (getRoleMappingsStream().anyMatch(r -> r.hasRole(role))) return true;
         GroupModel parent = getParent();
         return parent != null && parent.hasRole(role);
@@ -189,7 +201,7 @@ public void grantRole(RoleModel role) {
     public Stream<RoleModel> getRoleMappingsStream() {
         if (isUpdated()) return updated.getRoleMappingsStream();
         Set<RoleModel> roles = new HashSet<>();
-        for (String id : cached.getRoleMappings(modelSupplier)) {
+        for (String id : cached.getRoleMappings(keycloakSession, modelSupplier)) {
             RoleModel roleById = keycloakSession.roles().getRoleById(realm, id);
             if (roleById == null) {
                 // chance that role was removed, so just delegate to persistence and get user invalidated
@@ -225,7 +237,7 @@ public String getParentId() {
     public Stream<GroupModel> getSubGroupsStream() {
         if (isUpdated()) return updated.getSubGroupsStream();
         Set<GroupModel> subGroups = new HashSet<>();
-        for (String id : cached.getSubGroups(modelSupplier)) {
+        for (String id : cached.getSubGroups(keycloakSession, modelSupplier)) {
             GroupModel subGroup = keycloakSession.groups().getGroupById(realm, id);
             if (subGroup == null) {
                 // chance that role was removed, so just delegate to persistence and get user invalidated
@@ -259,7 +271,8 @@ public Stream<GroupModel> getSubGroupsStream(String search, Boolean exact, Integ
     @Override
     public Long getSubGroupsCount() {
         if (isUpdated()) return updated.getSubGroupsCount();
-        return cached.getSubGroupsCount(modelSupplier);
+        GroupModel model = modelSupplier.get();
+        return model == null ? null : model.getSubGroupsCount();
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyLoader.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyLoader.java
index b37cde7d0762..9ab0b8772a1f 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyLoader.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyLoader.java
@@ -18,6 +18,8 @@
 
 import java.util.function.Supplier;
 
+import org.keycloak.models.KeycloakSession;
+
 /**
  * <p>A functional interface that can be used to return data {@code D} from a source {@code S} where implementations are free to define how and when
  * data is fetched from source as well how it is internally cached.
@@ -33,8 +35,9 @@ public interface LazyLoader<S, D> {
      * Returns data from the given {@code source}. Data is only fetched from {@code source} once and only if necessary, it is
      * up to implementations to decide the momentum to actually fetch data from source.
      *
+     * @param session the session
      * @param source the source from where data will be fetched.
      * @return the data from source
      */
-    D get(Supplier<S> source);
+    D get(KeycloakSession session, Supplier<S> source);
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyModel.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyModel.java
new file mode 100644
index 000000000000..5c2ae61f9970
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/LazyModel.java
@@ -0,0 +1,21 @@
+package org.keycloak.models.cache.infinispan;
+
+import java.util.function.Supplier;
+
+public class LazyModel<M> implements Supplier<M> {
+
+    private final Supplier<M> supplier;
+    private M model;
+
+    public LazyModel(Supplier<M> supplier) {
+        this.supplier = supplier;
+    }
+
+    @Override
+    public M get() {
+        if (model == null) {
+            model = supplier.get();
+        }
+        return model;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmAdapter.java
index e932dadc1383..b932a2a080dc 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmAdapter.java
@@ -78,7 +78,7 @@ public RealmAdapter(KeycloakSession session, CachedRealm cached, RealmCacheSessi
         this.cached = cached;
         this.cacheSession = cacheSession;
         this.session = session;
-        this.modelSupplier = this::getRealm;
+        this.modelSupplier = new LazyModel<>(this::getRealm);
     }
 
     @Override
@@ -409,7 +409,7 @@ public void setDuplicateEmailsAllowed(boolean duplicateEmailsAllowed) {
                 @Override
                 protected void commitImpl() {
                     ClusterProvider cluster = session.getProvider(ClusterProvider.class);
-                    cluster.notify(InfinispanUserCacheProviderFactory.USER_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), false, ClusterProvider.DCNotify.ALL_DCS);
+                    cluster.notify(InfinispanUserCacheProviderFactory.USER_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), false);
                 }
 
                 @Override
@@ -721,19 +721,19 @@ public Stream<RequiredCredentialModel> getRequiredCredentialsStream() {
     public OAuth2DeviceConfig getOAuth2DeviceConfig() {
         if (isUpdated())
             return updated.getOAuth2DeviceConfig();
-        return cached.getOAuth2DeviceConfig(modelSupplier);
+        return cached.getOAuth2DeviceConfig(session, modelSupplier);
     }
 
     @Override
     public CibaConfig getCibaPolicy() {
         if (isUpdated()) return updated.getCibaPolicy();
-        return cached.getCibaConfig(modelSupplier);
+        return cached.getCibaConfig(session, modelSupplier);
     }
 
     @Override
     public ParConfig getParPolicy() {
         if (isUpdated()) return updated.getParPolicy();
-        return cached.getParConfig(modelSupplier);
+        return cached.getParConfig(session, modelSupplier);
     }
 
     @Override
@@ -1376,7 +1376,11 @@ public void updateAuthenticationFlow(AuthenticationFlowModel model) {
     @Override
     public Stream<AuthenticationExecutionModel> getAuthenticationExecutionsStream(String flowId) {
         if (isUpdated()) return updated.getAuthenticationExecutionsStream(flowId);
-        return cached.getAuthenticationExecutions().get(flowId).stream();
+        List<AuthenticationExecutionModel> executions = cached.getAuthenticationExecutions().get(flowId);
+        if (executions == null) {
+            return Stream.empty();
+        }
+        return executions.stream();
     }
 
     @Override
@@ -1606,7 +1610,7 @@ public void removeDefaultClientScope(ClientScopeModel clientScope) {
     @Override
     public Stream<ClientScopeModel> getDefaultClientScopesStream(boolean defaultScope) {
         if (isUpdated()) return updated.getDefaultClientScopesStream(defaultScope);
-        List<String> clientScopeIds = defaultScope ? cached.getDefaultDefaultClientScopes() : cached.getOptionalDefaultClientScopes();
+        List<String> clientScopeIds = defaultScope ? cached.getDefaultDefaultClientScopes(session, modelSupplier) : cached.getOptionalDefaultClientScopes(session, modelSupplier);
         return clientScopeIds.stream()
                 .map(scope -> cacheSession.getClientScopeById(this, scope))
                 .filter(Objects::nonNull);
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java
index 2e51914aead9..d200b02fdb09 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheManager.java
@@ -64,8 +64,9 @@ public void realmRemoval(String id, String name, Set<String> invalidations) {
         addInvalidations(InRealmPredicate.create().realm(id), invalidations);
     }
 
-    public void roleAdded(String roleContainerId, Set<String> invalidations) {
+    public void roleAdded(String roleContainerId, String roleName, Set<String> invalidations) {
         invalidations.add(RealmCacheSession.getRolesCacheKey(roleContainerId));
+        invalidations.add(RealmCacheSession.getRoleByNameCacheKey(roleContainerId, roleName));
     }
 
     public void roleUpdated(String roleContainerId, String roleName, Set<String> invalidations) {
@@ -94,7 +95,6 @@ public void clientScopeRemoval(String realmId, Set<String> invalidations) {
 
     public void groupQueriesInvalidations(String realmId, Set<String> invalidations) {
         invalidations.add(RealmCacheSession.getGroupsQueryCacheKey(realmId));
-        invalidations.add(RealmCacheSession.getTopGroupsQueryCacheKey(realmId));
         addInvalidations(GroupListPredicate.create().realm(realmId), invalidations);
     }
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java
index 7ecc221de847..d5f4342cf0cb 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java
@@ -22,10 +22,7 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
@@ -64,6 +61,7 @@
 import org.keycloak.models.cache.infinispan.entities.GroupNameQuery;
 import org.keycloak.models.cache.infinispan.entities.RealmListQuery;
 import org.keycloak.models.cache.infinispan.entities.RoleListQuery;
+import org.keycloak.models.cache.infinispan.entities.RoleByNameQuery;
 import org.keycloak.models.cache.infinispan.events.ClientAddedEvent;
 import org.keycloak.models.cache.infinispan.events.ClientRemovedEvent;
 import org.keycloak.models.cache.infinispan.events.ClientScopeAddedEvent;
@@ -185,7 +183,7 @@ public RealmCacheSession(RealmCacheManager cache, KeycloakSession session) {
     @Override
     public void clear() {
         ClusterProvider cluster = session.getProvider(ClusterProvider.class);
-        cluster.notify(InfinispanCacheRealmProviderFactory.REALM_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), false, ClusterProvider.DCNotify.ALL_DCS);
+        cluster.notify(InfinispanCacheRealmProviderFactory.REALM_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), false);
     }
 
     @Override
@@ -320,13 +318,13 @@ private void invalidateRole(String id) {
         if (adapter != null) adapter.invalidate();
     }
 
-    private void addedRole(String roleId, String roleContainerId) {
+    private void addedRole(String roleId, String roleContainerId, String roleName) {
         // this is needed so that a new role that hasn't been committed isn't cached in a query
         listInvalidations.add(roleContainerId);
 
         invalidateRole(roleId);
-        cache.roleAdded(roleContainerId, invalidations);
-        invalidationEvents.add(RoleAddedEvent.create(roleId, roleContainerId));
+        cache.roleAdded(roleContainerId, roleName, invalidations);
+        invalidationEvents.add(RoleAddedEvent.create(roleId, roleContainerId, roleName));
     }
 
     @Override
@@ -631,10 +629,6 @@ static String getClientScopesCacheKey(String client, boolean defaultScope) {
         return client + "." + (defaultScope ? SCOPE_KEY_DEFAULT : SCOPE_KEY_OPTIONAL) + ".clientscopes";
     }
 
-    static String getTopGroupsQueryCacheKey(String realm) {
-        return realm + ".top.groups";
-    }
-
     static String getGroupByNameCacheKey(String realm, String parentId, String name) {
         if (parentId != null) {
             return realm + ".group." + parentId + "." + name;
@@ -719,7 +713,7 @@ public RoleModel addRealmRole(RealmModel realm, String name) {
     @Override
     public RoleModel addRealmRole(RealmModel realm, String id, String name) {
         RoleModel role = getRoleDelegate().addRealmRole(realm, id, name);
-        addedRole(role.getId(), realm.getId());
+        addedRole(role.getId(), realm.getId(), name);
         return role;
     }
 
@@ -836,7 +830,7 @@ public RoleModel addClientRole(ClientModel client, String name) {
     @Override
     public RoleModel addClientRole(ClientModel client, String id, String name) {
         RoleModel role = getRoleDelegate().addClientRole(client, id, name);
-        addedRole(role.getId(), client.getId());
+        addedRole(role.getId(), client.getId(), name);
         return role;
     }
 
@@ -848,7 +842,7 @@ public RoleModel getRealmRole(RealmModel realm, String name) {
             return getRoleDelegate().getRealmRole(realm, name);
         }
 
-        RoleListQuery query = cache.get(cacheKey, RoleListQuery.class);
+        RoleByNameQuery query = cache.get(cacheKey, RoleByNameQuery.class);
         if (query != null) {
             logger.tracev("getRealmRole cache hit: {0}.{1}", realm.getName(), name);
         }
@@ -856,13 +850,21 @@ public RoleModel getRealmRole(RealmModel realm, String name) {
         if (query == null) {
             Long loaded = cache.getCurrentRevision(cacheKey);
             RoleModel model = getRoleDelegate().getRealmRole(realm, name);
-            if (model == null) return null;
-            query = new RoleListQuery(loaded, cacheKey, realm, model.getId());
+            if (model == null) {
+                // caching empty results will speed up the policy evaluation which tries to look up the role by name and ID
+                query = new RoleByNameQuery(loaded, cacheKey, realm, null);
+            } else {
+                query = new RoleByNameQuery(loaded, cacheKey, realm, model.getId());
+            }
             logger.tracev("adding realm role cache miss: client {0} key {1}", realm.getName(), cacheKey);
             cache.addRevisioned(query, startupRevision);
             return model;
         }
-        RoleModel role = getRoleById(realm, query.getRoles().iterator().next());
+        String roleId = query.getRole();
+        if (roleId == null) {
+            return null;
+        }
+        RoleModel role = getRoleById(realm, roleId);
         if (role == null) {
             invalidations.add(cacheKey);
             return getRoleDelegate().getRealmRole(realm, name);
@@ -878,7 +880,7 @@ public RoleModel getClientRole(ClientModel client, String name) {
             return getRoleDelegate().getClientRole(client, name);
         }
 
-        RoleListQuery query = cache.get(cacheKey, RoleListQuery.class);
+        RoleByNameQuery query = cache.get(cacheKey, RoleByNameQuery.class);
         if (query != null) {
             logger.tracev("getClientRole cache hit: {0}.{1}", client.getClientId(), name);
         }
@@ -886,13 +888,21 @@ public RoleModel getClientRole(ClientModel client, String name) {
         if (query == null) {
             Long loaded = cache.getCurrentRevision(cacheKey);
             RoleModel model = getRoleDelegate().getClientRole(client, name);
-            if (model == null) return null;
-            query = new RoleListQuery(loaded, cacheKey, client.getRealm(), model.getId(), client.getClientId());
+            if (model == null) {
+                // caching empty results will speed up the policy evaluation which tries to look up the role by name and ID
+                query = new RoleByNameQuery(loaded, cacheKey, client.getRealm(), null, client.getClientId());
+            } else {
+                query = new RoleByNameQuery(loaded, cacheKey, client.getRealm(), model.getId(), client.getClientId());
+            }
             logger.tracev("adding client role cache miss: client {0} key {1}", client.getClientId(), cacheKey);
             cache.addRevisioned(query, startupRevision);
             return model;
         }
-        RoleModel role = getRoleById(client.getRealm(), query.getRoles().iterator().next());
+        String roleId = query.getRole();
+        if (roleId == null) {
+            return null;
+        }
+        RoleModel role = getRoleById(client.getRealm(), roleId);
         if (role == null) {
             invalidations.add(cacheKey);
             return getRoleDelegate().getClientRole(client, name);
@@ -1079,57 +1089,6 @@ public Stream<GroupModel> getGroupsByRoleStream(RealmModel realm, RoleModel role
 
     @Override
     public Stream<GroupModel> getTopLevelGroupsStream(RealmModel realm, String search, Boolean exact, Integer first, Integer max) {
-        String cacheKey = getTopGroupsQueryCacheKey(realm.getId());
-
-        if (hasInvalidation(realm, cacheKey)) {
-            return getGroupDelegate().getTopLevelGroupsStream(realm, search, exact, first, max);
-        }
-
-        GroupListQuery query = cache.get(cacheKey, GroupListQuery.class);
-        String searchKey = Optional.ofNullable(search).orElse("") + "." + Optional.ofNullable(first).orElse(-1) + "." + Optional.ofNullable(max).orElse(-1);
-        Set<String> cached;
-
-        if (Objects.isNull(query)) {
-            // not cached yet
-            Long loaded = cache.getCurrentRevision(cacheKey);
-            cached = getGroupDelegate().getTopLevelGroupsStream(realm, search, exact, first, max).map(GroupModel::getId).collect(Collectors.toSet());
-            query = new GroupListQuery(loaded, cacheKey, realm, searchKey, cached);
-            logger.tracev("adding realm getTopLevelGroups cache miss: realm {0} key {1}", realm.getName(), cacheKey);
-            cache.addRevisioned(query, startupRevision);
-        } else {
-            logger.tracev("getTopLevelGroups cache hit: {0}", realm.getName());
-
-            cached = query.getGroups(searchKey);
-
-            if (hasInvalidation(realm, cacheKey) || cached == null) {
-                // there is a cache entry, but the current search is not yet cached
-                cache.invalidateObject(cacheKey);
-                Long loaded = cache.getCurrentRevision(cacheKey);
-                cached = getGroupDelegate().getTopLevelGroupsStream(realm, search, exact, first, max).map(GroupModel::getId).collect(Collectors.toSet());
-                query = new GroupListQuery(loaded, cacheKey, realm, searchKey, cached, query);
-                logger.tracev("adding realm getTopLevelGroups search cache miss: realm {0} key {1}", realm.getName(), searchKey);
-                cache.addRevisioned(query, cache.getCurrentCounter());
-            }
-        }
-
-        AtomicBoolean invalidate = new AtomicBoolean(false);
-        Stream<GroupModel> groups = cached.stream()
-                .map((id) -> session.groups().getGroupById(realm, id))
-                .takeWhile(group -> {
-                    if (Objects.isNull(group)) {
-                        invalidate.set(true);
-                        return false;
-                    }
-                    return true;
-                })
-                .sorted(GroupModel.COMPARE_BY_NAME);
-
-        if (!invalidate.get()) {
-            return groups;
-        }
-
-        invalidations.add(cacheKey);
-
         return getGroupDelegate().getTopLevelGroupsStream(realm, search, exact, first, max);
     }
 
@@ -1302,8 +1261,6 @@ protected ClientModel validateCache(RealmModel realm, CachedClient cached) {
             }
             ClientStorageProviderModel model = new ClientStorageProviderModel(component);
 
-            // although we do set a timeout, Infinispan has no guarantees when the user will be evicted
-            // its also hard to test stuff
             if (model.shouldInvalidate(cached)) {
                 registerClientInvalidation(cached.getId(), cached.getClientId(), realm.getId());
                 return getClientDelegate().getClientById(realm, cached.getId());
@@ -1482,6 +1439,17 @@ public void removeClientScopes(RealmModel realm) {
         getClientScopesStream(realm).map(ClientScopeModel::getId).forEach(id -> removeClientScope(realm, id));
     }
 
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByProtocol(RealmModel realm, String protocol) {
+        return getClientScopeDelegate().getClientScopesByProtocol(realm, protocol);
+    }
+
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByAttributes(RealmModel realm, Map<String, String> searchMap,
+                                                                boolean useOr) {
+        return getClientScopeDelegate().getClientScopesByAttributes(realm, searchMap, useOr);
+    }
+
     @Override
     public void addClientScopes(RealmModel realm, ClientModel client, Set<ClientScopeModel> clientScopes, boolean defaultScope) {
         getClientDelegate().addClientScopes(realm, client, clientScopes, defaultScope);
@@ -1514,13 +1482,16 @@ public Map<String, ClientScopeModel> getClientScopes(RealmModel realm, ClientMod
             return model;
         }
         Map<String, ClientScopeModel> assignedScopes = new HashMap<>();
+
+        List<String> acceptedClientProtocols = KeycloakModelUtils.getAcceptedClientScopeProtocols(client);
         for (String id : query.getClientScopes()) {
             ClientScopeModel clientScope = session.clientScopes().getClientScopeById(realm, id);
             if (clientScope == null) {
                 invalidations.add(cacheKey);
                 return getClientDelegate().getClientScopes(realm, client, defaultScopes);
             }
-            if (clientScope.getProtocol().equals((client.getProtocol() == null) ? "openid-connect" : client.getProtocol())) {
+
+            if (acceptedClientProtocols.contains(clientScope.getProtocol())) {
                 assignedScopes.put(clientScope.getName(), clientScope);
             }
         }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
index 533bb89335fb..f7dbf342be52 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.models.cache.infinispan;
 
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
@@ -28,9 +29,9 @@
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.function.Supplier;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 /**
@@ -40,17 +41,19 @@
 public class RoleAdapter implements RoleModel {
 
     protected RoleModel updated;
+    private final KeycloakSession session;
     protected CachedRole cached;
     protected RealmCacheSession cacheSession;
     protected RealmModel realm;
     protected Set<RoleModel> composites;
     private final Supplier<RoleModel> modelSupplier;
 
-    public RoleAdapter(CachedRole cached, RealmCacheSession session, RealmModel realm) {
+    public RoleAdapter(CachedRole cached, RealmCacheSession cacheSession, RealmModel realm) {
         this.cached = cached;
-        this.cacheSession = session;
+        this.cacheSession = cacheSession;
+        this.session = cacheSession.session;
         this.realm = realm;
-        this.modelSupplier = this::getRoleModel;
+        this.modelSupplier = new LazyModel<>(this::getRoleModel);
     }
 
     protected void getDelegateForUpdate() {
@@ -61,6 +64,15 @@ protected void getDelegateForUpdate() {
         }
     }
 
+    protected void getDelegateForRename(String newName) {
+        if (!Objects.equals(newName, cached.getName())) {
+            // New role name might have been cached as non-existent
+            String containerId = getContainerId();
+            cacheSession.registerRoleInvalidation(cached.getId(), newName, containerId);
+        }
+        getDelegateForUpdate();
+    }
+
     protected boolean invalidated;
 
     public void invalidate() {
@@ -102,7 +114,7 @@ public String getId() {
 
     @Override
     public void setName(String name) {
-        getDelegateForUpdate();
+        getDelegateForRename(name);
         updated.setName(name);
     }
 
@@ -206,7 +218,7 @@ public String getFirstAttribute(String name) {
             return updated.getFirstAttribute(name);
         }
 
-        return cached.getAttributes(modelSupplier).getFirst(name);
+        return cached.getAttributes(session, modelSupplier).getFirst(name);
     }
 
     @Override
@@ -215,7 +227,7 @@ public Stream<String> getAttributeStream(String name) {
             return updated.getAttributeStream(name);
         }
 
-        List<String> result = cached.getAttributes(modelSupplier).get(name);
+        List<String> result = cached.getAttributes(session, modelSupplier).get(name);
         if (result == null) {
             return Stream.empty();
         }
@@ -228,7 +240,7 @@ public Map<String, List<String>> getAttributes() {
             return updated.getAttributes();
         }
 
-        return cached.getAttributes(modelSupplier);
+        return cached.getAttributes(session, modelSupplier);
     }
 
     private RoleModel getRoleModel() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
index f67f274c9e8e..a3a72aca5496 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
@@ -62,7 +62,7 @@ public UserAdapter(CachedUser cached, UserCacheSession userProvider, KeycloakSes
         this.userProviderCache = userProvider;
         this.keycloakSession = keycloakSession;
         this.realm = realm;
-        this.modelSupplier = this::getUserModel;
+        this.modelSupplier = new LazyModel<>(this::getUserModel);
     }
 
     @Override
@@ -223,26 +223,26 @@ public void removeAttribute(String name) {
     @Override
     public String getFirstAttribute(String name) {
         if (updated != null) return updated.getFirstAttribute(name);
-        return cached.getFirstAttribute(name, modelSupplier);
+        return cached.getFirstAttribute(keycloakSession, name, modelSupplier);
     }
 
     @Override
     public Stream<String> getAttributeStream(String name) {
         if (updated != null) return updated.getAttributeStream(name);
-        List<String> result = cached.getAttributes(modelSupplier).get(name);
+        List<String> result = cached.getAttributes(keycloakSession, modelSupplier).get(name);
         return (result == null) ? Stream.empty() : result.stream();
     }
 
     @Override
     public Map<String, List<String>> getAttributes() {
         if (updated != null) return updated.getAttributes();
-        return cached.getAttributes(modelSupplier);
+        return cached.getAttributes(keycloakSession, modelSupplier);
     }
 
     @Override
     public Stream<String> getRequiredActionsStream() {
         if (updated != null) return updated.getRequiredActionsStream();
-        return cached.getRequiredActions(modelSupplier).stream();
+        return cached.getRequiredActions(keycloakSession, modelSupplier).stream();
     }
 
     @Override
@@ -318,7 +318,7 @@ public SubjectCredentialManager credentialManager() {
             @Override
             public CredentialModel getStoredCredentialById(String id) {
                 if (updated == null) {
-                    return cached.getStoredCredentials(modelSupplier).stream().filter(credential ->
+                    return cached.getStoredCredentials(keycloakSession, modelSupplier).stream().filter(credential ->
                                     Objects.equals(id, credential.getId()))
                             .findFirst().orElse(null);
                 }
@@ -328,7 +328,7 @@ public CredentialModel getStoredCredentialById(String id) {
             @Override
             public Stream<CredentialModel> getStoredCredentialsStream() {
                 if (updated == null) {
-                    return cached.getStoredCredentials(modelSupplier).stream();
+                    return cached.getStoredCredentials(keycloakSession, modelSupplier).stream();
                 }
                 return super.getStoredCredentialsStream();
             }
@@ -336,7 +336,7 @@ public Stream<CredentialModel> getStoredCredentialsStream() {
             @Override
             public Stream<CredentialModel> getStoredCredentialsByTypeStream(String type) {
                 if (updated == null) {
-                    return cached.getStoredCredentials(modelSupplier).stream().filter(credential -> Objects.equals(type, credential.getType()));
+                    return cached.getStoredCredentials(keycloakSession, modelSupplier).stream().filter(credential -> Objects.equals(type, credential.getType()));
                 }
                 return super.getStoredCredentialsByTypeStream(type);
             }
@@ -344,7 +344,7 @@ public Stream<CredentialModel> getStoredCredentialsByTypeStream(String type) {
             @Override
             public CredentialModel getStoredCredentialByNameAndType(String name, String type) {
                 if (updated == null) {
-                    return cached.getStoredCredentials(modelSupplier).stream().filter(credential ->
+                    return cached.getStoredCredentials(keycloakSession, modelSupplier).stream().filter(credential ->
                             Objects.equals(type, credential.getType()) && Objects.equals(name, credential.getUserLabel()))
                             .findFirst().orElse(null);
                 }
@@ -375,13 +375,13 @@ public Stream<RoleModel> getClientRoleMappingsStream(ClientModel app) {
     @Override
     public boolean hasDirectRole(RoleModel role) {
         if (updated != null) return updated.hasDirectRole(role);
-        return cached.getRoleMappings(modelSupplier).contains(role.getId());
+        return cached.getRoleMappings(keycloakSession, modelSupplier).contains(role.getId());
     }
 
     @Override
     public boolean hasRole(RoleModel role) {
         if (updated != null) return updated.hasRole(role);
-        return cached.getRoleMappings(modelSupplier).contains(role.getId()) ||
+        return cached.getRoleMappings(keycloakSession, modelSupplier).contains(role.getId()) ||
                 getRoleMappingsStream().anyMatch(r -> r.hasRole(role)) ||
                 RoleUtils.hasRoleFromGroup(getGroupsStream(), role, true);
     }
@@ -396,7 +396,7 @@ public void grantRole(RoleModel role) {
     public Stream<RoleModel> getRoleMappingsStream() {
         if (updated != null) return updated.getRoleMappingsStream();
         Set<RoleModel> roles = new HashSet<>();
-        for (String id : cached.getRoleMappings(modelSupplier)) {
+        for (String id : cached.getRoleMappings(keycloakSession, modelSupplier)) {
             RoleModel roleById = keycloakSession.roles().getRoleById(realm, id);
             if (roleById == null) {
                 // chance that role was removed, so just delete to persistence and get user invalidated
@@ -423,7 +423,7 @@ public Stream<GroupModel> getGroupsStream() {
             result = updated.getGroupsStream();
         } else {
             Set<GroupModel> groups = null;
-            for (String id : cached.getGroups(modelSupplier)) {
+            for (String id : cached.getGroups(keycloakSession, modelSupplier)) {
                 GroupModel groupModel = keycloakSession.groups().getGroupById(realm, id);
                 if (groupModel == null) {
                     // chance that role was removed, so just delegate to persistence and get user invalidated
@@ -468,7 +468,7 @@ public void leaveGroup(GroupModel group) {
     @Override
     public boolean isMemberOf(GroupModel group) {
         if (updated != null) return updated.isMemberOf(group);
-        return cached.getGroups(modelSupplier).contains(group.getId()) || RoleUtils.isMember(getGroupsStream(), group);
+        return cached.getGroups(keycloakSession, modelSupplier).contains(group.getId()) || RoleUtils.isMember(getGroupsStream(), group);
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserCacheSession.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserCacheSession.java
index 6b8989139688..8480d141c2c1 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserCacheSession.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserCacheSession.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.models.cache.infinispan;
 
+import static java.util.Optional.ofNullable;
 import static org.keycloak.organization.utils.Organizations.isReadOnlyOrganizationMember;
 
 import org.jboss.logging.Logger;
@@ -29,6 +30,7 @@
 import org.keycloak.models.cache.infinispan.events.InvalidationEvent;
 import org.keycloak.common.constants.ServiceAccountConstants;
 import org.keycloak.component.ComponentModel;
+import org.keycloak.connections.jpa.support.EntityManagers;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.GroupModel;
@@ -113,7 +115,7 @@ public UserCacheSession(UserCacheManager cache, KeycloakSession session) {
     public void clear() {
         cache.clear();
         ClusterProvider cluster = session.getProvider(ClusterProvider.class);
-        cluster.notify(InfinispanUserCacheProviderFactory.USER_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), true, ClusterProvider.DCNotify.ALL_DCS);
+        cluster.notify(InfinispanUserCacheProviderFactory.USER_CLEAR_CACHE_EVENTS, ClearCacheEvent.getInstance(), true);
     }
 
     public UserProvider getDelegate() {
@@ -229,7 +231,7 @@ public UserModel getUserById(RealmModel realm, String id) {
         } else {
             adapter = validateCache(realm, cached, () -> getDelegate().getUserById(realm, id));
         }
-        managedUsers.put(id, adapter);
+        addManagedUser(id, adapter);
         return adapter;
     }
 
@@ -254,9 +256,12 @@ static String getFederatedIdentityLinksCacheKey(String userId) {
     }
 
     @Override
-    public UserModel getUserByUsername(RealmModel realm, String username) {
+    public UserModel getUserByUsername(RealmModel realm, String rawUsername) {
+        if (rawUsername == null) {
+            return null;
+        }
+        String username = rawUsername.toLowerCase();
         logger.tracev("getUserByUsername: {0}", username);
-        username = username.toLowerCase();
         if (realmInvalidations.contains(realm.getId())) {
             logger.tracev("realmInvalidations");
             return getDelegate().getUserByUsername(realm, username);
@@ -268,7 +273,6 @@ public UserModel getUserByUsername(RealmModel realm, String username) {
         }
         UserListQuery query = cache.get(cacheKey, UserListQuery.class);
 
-        String userId = null;
         if (query == null) {
             logger.tracev("query null");
             Long loaded = cache.getCurrentRevision(cacheKey);
@@ -277,7 +281,7 @@ public UserModel getUserByUsername(RealmModel realm, String username) {
                 logger.tracev("model from delegate null");
                 return null;
             }
-            userId = model.getId();
+            String userId = model.getId();
             if (invalidations.contains(userId)) return model;
             if (managedUsers.containsKey(userId)) {
                 logger.tracev("return managed user");
@@ -287,20 +291,59 @@ public UserModel getUserByUsername(RealmModel realm, String username) {
             UserModel adapter = getUserAdapter(realm, userId, loaded, model);
             if (adapter instanceof UserAdapter) { // this was cached, so we can cache query too
                 query = new UserListQuery(loaded, cacheKey, realm, model.getId());
-                cache.addRevisioned(query, startupRevision);
+                cache.addRevisioned(query, startupRevision, getLifespan(realm, adapter));
             }
-            managedUsers.put(userId, adapter);
+            addManagedUser(userId, adapter);
             return adapter;
-        } else {
-            userId = query.getUsers().iterator().next();
-            if (invalidations.contains(userId)) {
-                logger.tracev("invalidated cache return delegate");
-                return getDelegate().getUserByUsername(realm, username);
+        }
 
+        String userId = query.getUsers().iterator().next();
+        if (invalidations.contains(userId)) {
+            logger.tracev("invalidated cache return delegate");
+            return getDelegate().getUserByUsername(realm, username);
+
+        }
+        logger.trace("return getUserById");
+        return ofNullable(getUserById(realm, userId))
+                // Validate for cases where the cached elements are not in sync.
+                // This might happen to changes in a federated store where caching is enabled and different items expire at different times,
+                // for example when they are evicted due to the limited size of the cache
+                .filter((u) -> username.equalsIgnoreCase(u.getUsername()))
+                .orElseGet(() -> {
+                    registerInvalidation(cacheKey);
+                    return getDelegate().getUserByUsername(realm, username);
+                });
+    }
+
+    private long getLifespan(RealmModel realm, UserModel user) {
+        if (!user.isFederated()) {
+            return -1; // cache infinite
+        }
+
+        String providerId = user.getFederationLink();
+
+        if (providerId == null) {
+            providerId = StorageId.providerId(user.getId());
+        }
+
+        ComponentModel component = realm.getComponent(providerId);
+        UserStorageProviderModel model = new UserStorageProviderModel(component);
+
+        if (model.isEnabled()) {
+            UserStorageProviderModel.CachePolicy policy = model.getCachePolicy();
+
+            if (policy == null) {
+                // no policy set, cache entries by default
+                return -1;
+            }
+
+            if (!UserStorageProviderModel.CachePolicy.NO_CACHE.equals(policy)) {
+                long lifespan = model.getLifespan();
+                return lifespan > 0 ? lifespan : -1;
             }
-            logger.trace("return getUserById");
-            return getUserById(realm, userId);
         }
+
+        return 0; // do not cache
     }
 
     protected UserModel getUserAdapter(RealmModel realm, String userId, Long loaded, UserModel delegate) {
@@ -327,8 +370,6 @@ protected UserModel validateCache(RealmModel realm, CachedUser cached, Supplier<
             }
             CacheableStorageProviderModel model = new CacheableStorageProviderModel(component);
 
-            // although we do set a timeout, Infinispan has no guarantees when the user will be evicted
-            // its also hard to test stuff
             if (model.shouldInvalidate(cached)) {
                 registerUserInvalidation(cached);
                 return supplier.get();
@@ -348,14 +389,15 @@ protected UserModel cacheUser(RealmModel realm, UserModel delegate, Long revisio
         CachedUser cached;
         UserAdapter adapter;
 
-        if (delegate.getFederationLink() != null) {
+        if (delegate.isFederated()) {
             ComponentModel component = realm.getComponent(delegate.getFederationLink());
             UserStorageProviderModel model = new UserStorageProviderModel(component);
             if (!model.isEnabled()) {
                 return new ReadOnlyUserModelDelegate(delegate, false);
             }
-            UserStorageProviderModel.CachePolicy policy = model.getCachePolicy();
-            if (policy != null && policy == UserStorageProviderModel.CachePolicy.NO_CACHE) {
+
+            long lifespan = getLifespan(realm, delegate);
+            if (lifespan == 0) {
                 return delegate;
             }
 
@@ -363,12 +405,7 @@ protected UserModel cacheUser(RealmModel realm, UserModel delegate, Long revisio
             adapter = new UserAdapter(cached, this, session, realm);
             onCache(realm, adapter, delegate);
 
-            long lifespan = model.getLifespan();
-            if (lifespan > 0) {
-                cache.addRevisioned(cached, startupRevision, lifespan);
-            } else {
-                cache.addRevisioned(cached, startupRevision);
-            }
+            cache.addRevisioned(cached, startupRevision, lifespan);
         } else {
             cached = new CachedUser(revision, realm, delegate, notBefore);
             adapter = new UserAdapter(cached, this, session, realm);
@@ -384,9 +421,9 @@ private void onCache(RealmModel realm, UserAdapter adapter, UserModel delegate)
     }
 
     @Override
-    public UserModel getUserByEmail(RealmModel realm, String email) {
-        if (email == null) return null;
-        email = email.toLowerCase();
+    public UserModel getUserByEmail(RealmModel realm, String rawEmail) {
+        if (rawEmail == null) return null;
+        String email = rawEmail.toLowerCase();
         if (realmInvalidations.contains(realm.getId())) {
             return getDelegate().getUserByEmail(realm, email);
         }
@@ -396,30 +433,37 @@ public UserModel getUserByEmail(RealmModel realm, String email) {
         }
         UserListQuery query = cache.get(cacheKey, UserListQuery.class);
 
-        String userId = null;
         if (query == null) {
             Long loaded = cache.getCurrentRevision(cacheKey);
             UserModel model = getDelegate().getUserByEmail(realm, email);
             if (model == null) return null;
-            userId = model.getId();
+            String userId = model.getId();
             if (invalidations.contains(userId)) return model;
             if (managedUsers.containsKey(userId)) return managedUsers.get(userId);
 
             UserModel adapter = getUserAdapter(realm, userId, loaded, model);
             if (adapter instanceof UserAdapter) {
                 query = new UserListQuery(loaded, cacheKey, realm, model.getId());
-                cache.addRevisioned(query, startupRevision);
+                cache.addRevisioned(query, startupRevision, getLifespan(realm, adapter));
             }
-            managedUsers.put(userId, adapter);
+            addManagedUser(userId, adapter);
             return adapter;
-        } else {
-            userId = query.getUsers().iterator().next();
-            if (invalidations.contains(userId)) {
-                return getDelegate().getUserByEmail(realm, email);
+        }
+
+        String userId = query.getUsers().iterator().next();
+        if (invalidations.contains(userId)) {
+            return getDelegate().getUserByEmail(realm, email);
 
-            }
-            return getUserById(realm, userId);
         }
+        return ofNullable(getUserById(realm, userId))
+                // Validate for cases where the cached elements are not in sync.
+                // This might happen to changes in a federated store where caching is enabled and different items expire at different times,
+                // for example when they are evicted due to the limited size of the cache
+                .filter((u) -> email.equalsIgnoreCase(u.getEmail()))
+                .orElseGet(() -> {
+                    registerInvalidation(cacheKey);
+                    return getDelegate().getUserByEmail(realm, email);
+                });
     }
 
     @Override
@@ -453,10 +497,10 @@ public UserModel getUserByFederatedIdentity(RealmModel realm, FederatedIdentityM
             UserModel adapter = getUserAdapter(realm, userId, loaded, model);
             if (adapter instanceof UserAdapter) {
                 query = new UserListQuery(loaded, cacheKey, realm, model.getId());
-                cache.addRevisioned(query, startupRevision);
+                cache.addRevisioned(query, startupRevision, getLifespan(realm, adapter));
             }
 
-            managedUsers.put(userId, adapter);
+            addManagedUser(userId, adapter);
             return adapter;
         } else {
             userId = query.getUsers().iterator().next();
@@ -540,9 +584,9 @@ public UserModel findServiceAccount(ClientModel client) {
             UserModel adapter = getUserAdapter(realm, userId, loaded, model);
             if (adapter instanceof UserAdapter) { // this was cached, so we can cache query too
                 query = new UserListQuery(loaded, cacheKey, realm, model.getId());
-                cache.addRevisioned(query, startupRevision);
+                cache.addRevisioned(query, startupRevision, getLifespan(realm, adapter));
             }
-            managedUsers.put(userId, adapter);
+            addManagedUser(userId, adapter);
             return adapter;
         } else {
             userId = query.getUsers().iterator().next();
@@ -650,7 +694,7 @@ public Stream<FederatedIdentityModel> getFederatedIdentitiesStream(RealmModel re
             Set<FederatedIdentityModel> federatedIdentities = getDelegate().getFederatedIdentitiesStream(realm, user)
                     .collect(Collectors.toSet());
             cachedLinks = new CachedFederatedIdentityLinks(loaded, cacheKey, realm, federatedIdentities);
-            cache.addRevisioned(cachedLinks, startupRevision);
+            cache.addRevisioned(cachedLinks, startupRevision); // this is Keycloak's internal store, cache indefinitely
             return federatedIdentities.stream();
         } else {
             return cachedLinks.getFederatedIdentities().stream();
@@ -722,7 +766,7 @@ public UserConsentModel getConsentByClient(RealmModel realm, String userId, Stri
 
             Long loaded = cache.getCurrentRevision(cacheKey);
             cached = new CachedUserConsents(loaded, cacheKey, realm, consents, false);
-            cache.addRevisioned(cached, startupRevision);
+            cache.addRevisioned(cached, startupRevision); // this is from Keycloak's internal store, cache indefinitely
         }
 
         Map<String, CachedUserConsent> consents = cached.getConsents();
@@ -763,7 +807,7 @@ public Stream<UserConsentModel> getConsentsStream(RealmModel realm, String userI
             Long loaded = cache.getCurrentRevision(cacheKey);
             List<UserConsentModel> consents = getDelegate().getConsentsStream(realm, userId).collect(Collectors.toList());
             cached = new CachedUserConsents(loaded, cacheKey, realm, consents.stream().map(CachedUserConsent::new).collect(Collectors.toList()));
-            cache.addRevisioned(cached, startupRevision);
+            cache.addRevisioned(cached, startupRevision); // this is from Keycloak's internal store, cache indefinitely
             return consents.stream();
         } else {
             return cached.getConsents().values().stream().map(cachedConsent -> toConsentModel(realm, cachedConsent))
@@ -827,16 +871,23 @@ public UserModel addUser(RealmModel realm, String id, String username, boolean a
         UserModel user = getDelegate().addUser(realm, id, username, addDefaultRoles, addDefaultRequiredActions);
         // just in case the transaction is rolled back you need to invalidate the user and all cache queries for that user
         fullyInvalidateUser(realm, user);
-        managedUsers.put(user.getId(), user);
+        addManagedUser(user.getId(), user);
         return user;
     }
 
+    private void addManagedUser(String id, UserModel user) {
+        if (EntityManagers.isBatchMode()) {
+            return;
+        }
+        managedUsers.put(id, user);
+    }
+
     @Override
     public UserModel addUser(RealmModel realm, String username) {
         UserModel user = getDelegate().addUser(realm, username);
         // just in case the transaction is rolled back you need to invalidate the user and all cache queries for that user
         fullyInvalidateUser(realm, user);
-        managedUsers.put(user.getId(), user);
+        addManagedUser(user.getId(), user);
         return user;
     }
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PolicyAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PolicyAdapter.java
index 6b670815a6bc..fdd4266d7e44 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PolicyAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/PolicyAdapter.java
@@ -24,6 +24,8 @@
 import org.keycloak.authorization.store.PolicyStore;
 import org.keycloak.authorization.store.ResourceStore;
 import org.keycloak.authorization.store.ScopeStore;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.cache.infinispan.LazyModel;
 import org.keycloak.models.cache.infinispan.authorization.entities.CachedPolicy;
 import org.keycloak.representations.idm.authorization.DecisionStrategy;
 import org.keycloak.representations.idm.authorization.Logic;
@@ -45,12 +47,14 @@ public class PolicyAdapter implements Policy, CachedModel<Policy> {
     private final Supplier<Policy> modelSupplier;
     protected final CachedPolicy cached;
     protected final StoreFactoryCacheSession cacheSession;
+    private final KeycloakSession session;
     protected Policy updated;
 
     public PolicyAdapter(CachedPolicy cached, StoreFactoryCacheSession cacheSession) {
         this.cached = cached;
         this.cacheSession = cacheSession;
-        this.modelSupplier = this::getPolicyModel;
+        this.session = cacheSession.session;
+        this.modelSupplier = new LazyModel<>(this::getPolicyModel);
     }
 
     @Override
@@ -58,7 +62,7 @@ public Policy getDelegateForUpdate() {
         if (updated == null) {
             updated = modelSupplier.get();
             String defaultResourceType = updated.getConfig().get("defaultResourceType");
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), defaultResourceType, cached.getResourceServerId());
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), defaultResourceType, cached.getResourceServerId());
             if (updated == null) throw new IllegalStateException("Not found in database");
         }
         return updated;
@@ -106,7 +110,7 @@ public String getName() {
     @Override
     public void setName(String name) {
         getDelegateForUpdate();
-        cacheSession.registerPolicyInvalidation(cached.getId(), name, cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), name, cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.setName(name);
     }
 
@@ -150,15 +154,15 @@ public void setLogic(Logic logic) {
     @Override
     public Map<String, String> getConfig() {
         if (isUpdated()) return updated.getConfig();
-        return cached.getConfig(modelSupplier);
+        return cached.getConfig(session, modelSupplier);
     }
 
     @Override
     public void setConfig(Map<String, String> config) {
         getDelegateForUpdate();
-        if (config.containsKey("defaultResourceType") || cached.getConfig(modelSupplier).containsKey("defaultResourceType")) {
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), config.get("defaultResourceType"), cached.getResourceServerId());
+        if (config.containsKey("defaultResourceType") || cached.getConfig(session, modelSupplier).containsKey("defaultResourceType")) {
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), config.get("defaultResourceType"), cached.getResourceServerId());
         }
         updated.setConfig(config);
 
@@ -168,7 +172,7 @@ public void setConfig(Map<String, String> config) {
     public void removeConfig(String name) {
         getDelegateForUpdate();
         if (name.equals("defaultResourceType")) {
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         }
         updated.removeConfig(name);
 
@@ -178,8 +182,8 @@ public void removeConfig(String name) {
     public void putConfig(String name, String value) {
         getDelegateForUpdate();
         if (name.equals("defaultResourceType")) {
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
-            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), value, cached.getResourceServerId());
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+            cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), value, cached.getResourceServerId());
         }
         updated.putConfig(name, value);
     }
@@ -207,7 +211,7 @@ public Set<Policy> getAssociatedPolicies() {
         associatedPolicies = new HashSet<>();
         PolicyStore policyStore = cacheSession.getPolicyStore();
         String resourceServerId = cached.getResourceServerId();
-        for (String id : cached.getAssociatedPoliciesIds(modelSupplier)) {
+        for (String id : cached.getAssociatedPoliciesIds(session, modelSupplier)) {
             Policy policy = policyStore.findById(cacheSession.getResourceServerStore().findById(resourceServerId), id);
             if (policy == null) {
                 // probably because the policy was removed
@@ -228,7 +232,7 @@ public Set<Resource> getResources() {
         resources = new HashSet<>();
         ResourceStore resourceStore = cacheSession.getResourceStore();
         ResourceServer resourceServer = getResourceServer();
-        for (String resourceId : cached.getResourcesIds(modelSupplier)) {
+        for (String resourceId : cached.getResourcesIds(session, modelSupplier)) {
             Resource resource = resourceStore.findById(resourceServer, resourceId);
             cacheSession.cacheResource(resource);
             resources.add(resource);
@@ -236,17 +240,23 @@ public Set<Resource> getResources() {
         return resources = Collections.unmodifiableSet(resources);
     }
 
+    @Override
+    public Set<String> getResourceNames() {
+        if (isUpdated()) return getResources().stream().map(Resource::getName).collect(Collectors.toSet());
+        return cached.getResourceNames(session, modelSupplier);
+    }
+
     @Override
     public void addScope(Scope scope) {
         getDelegateForUpdate();
-        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), new HashSet<>(Arrays.asList(scope.getId())), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), new HashSet<>(Arrays.asList(scope.getId())), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.addScope(scope);
     }
 
     @Override
     public void removeScope(Scope scope) {
         getDelegateForUpdate();
-        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), new HashSet<>(Arrays.asList(scope.getId())), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), new HashSet<>(Arrays.asList(scope.getId())), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.removeScope(scope);
     }
 
@@ -269,7 +279,7 @@ public void addResource(Resource resource) {
         getDelegateForUpdate();
         HashSet<String> resources = new HashSet<>();
         resources.add(resource.getId());
-        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), resources, cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), resources, cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.addResource(resource);
 
     }
@@ -279,7 +289,7 @@ public void removeResource(Resource resource) {
         getDelegateForUpdate();
         HashSet<String> resources = new HashSet<>();
         resources.add(resource.getId());
-        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), resources, cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), resources, cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.removeResource(resource);
 
     }
@@ -293,7 +303,7 @@ public Set<Scope> getScopes() {
         scopes = new HashSet<>();
         ResourceServer resourceServer = getResourceServer();
         ScopeStore scopeStore = cacheSession.getScopeStore();
-        for (String scopeId : cached.getScopesIds(modelSupplier)) {
+        for (String scopeId : cached.getScopesIds(session, modelSupplier)) {
             Scope scope = scopeStore.findById(resourceServer, scopeId);
             cacheSession.cacheScope(scope);
             scopes.add(scope);
@@ -310,7 +320,7 @@ public String getOwner() {
     @Override
     public void setOwner(String owner) {
         getDelegateForUpdate();
-        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(modelSupplier), cached.getScopesIds(modelSupplier), cached.getConfig(modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
+        cacheSession.registerPolicyInvalidation(cached.getId(), cached.getName(), cached.getResourcesIds(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getConfig(session, modelSupplier).get("defaultResourceType"), cached.getResourceServerId());
         updated.setOwner(owner);
     }
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceAdapter.java
index 4c65c4a42538..be9844b9b26f 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/ResourceAdapter.java
@@ -23,6 +23,8 @@
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.store.PermissionTicketStore;
 import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.cache.infinispan.LazyModel;
 import org.keycloak.models.cache.infinispan.authorization.entities.CachedResource;
 
 import java.util.Collections;
@@ -40,6 +42,7 @@
 public class ResourceAdapter implements Resource, CachedModel<Resource> {
 
     private final Supplier<Resource> modelSupplier;
+    private final KeycloakSession session;
     protected final CachedResource cached;
     protected final StoreFactoryCacheSession cacheSession;
     protected Resource updated;
@@ -47,14 +50,15 @@ public class ResourceAdapter implements Resource, CachedModel<Resource> {
     public ResourceAdapter(CachedResource cached, StoreFactoryCacheSession cacheSession) {
         this.cached = cached;
         this.cacheSession = cacheSession;
-        this.modelSupplier = this::getResourceModel;
+        this.session = cacheSession.session;
+        this.modelSupplier = new LazyModel<>(this::getResourceModel);
     }
 
     @Override
     public Resource getDelegateForUpdate() {
         if (updated == null) {
             updated = modelSupplier.get();
-            cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(modelSupplier), cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+            cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
             if (updated == null) throw new IllegalStateException("Not found in database");
         }
         return updated;
@@ -102,7 +106,7 @@ public String getName() {
     @Override
     public void setName(String name) {
         getDelegateForUpdate();
-        cacheSession.registerResourceInvalidation(cached.getId(), name, cached.getType(), cached.getUris(modelSupplier), cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), name, cached.getType(), cached.getUris(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
         updated.setName(name);
     }
 
@@ -115,7 +119,7 @@ public String getDisplayName() {
     @Override
     public void setDisplayName(String name) {
         getDelegateForUpdate();
-        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(modelSupplier), cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
         updated.setDisplayName(name);
     }
 
@@ -140,13 +144,13 @@ public ResourceServer getResourceServer() {
     @Override
     public Set<String> getUris() {
         if (isUpdated()) return updated.getUris();
-        return cached.getUris(modelSupplier);
+        return cached.getUris(session, modelSupplier);
     }
 
     @Override
     public void updateUris(Set<String> uris) {
         getDelegateForUpdate();
-        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), uris, cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), uris, cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
         updated.updateUris(uris);
     }
 
@@ -159,7 +163,7 @@ public String getType() {
     @Override
     public void setType(String type) {
         getDelegateForUpdate();
-        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), type, cached.getUris(modelSupplier), cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), type, cached.getUris(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
         updated.setType(type);
 
     }
@@ -171,7 +175,7 @@ public List<Scope> getScopes() {
         if (isUpdated()) return updated.getScopes();
         if (scopes != null) return scopes;
         scopes = new LinkedList<>();
-        for (String scopeId : cached.getScopesIds(modelSupplier)) {
+        for (String scopeId : cached.getScopesIds(session, modelSupplier)) {
             scopes.add(cacheSession.getScopeStore().findById(getResourceServer(), scopeId));
         }
         return scopes = Collections.unmodifiableList(scopes);
@@ -192,7 +196,7 @@ public boolean isOwnerManagedAccess() {
     @Override
     public void setOwnerManagedAccess(boolean ownerManagedAccess) {
         getDelegateForUpdate();
-        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(modelSupplier), cached.getScopesIds(modelSupplier), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(session, modelSupplier), cached.getScopesIds(session, modelSupplier), cached.getResourceServerId(), cached.getOwner());
         updated.setOwnerManagedAccess(ownerManagedAccess);
     }
 
@@ -219,21 +223,21 @@ public void updateScopes(Set<Scope> scopes) {
             }
         }
 
-        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(modelSupplier), scopes.stream().map(scope1 -> scope1.getId()).collect(Collectors.toSet()), cached.getResourceServerId(), cached.getOwner());
+        cacheSession.registerResourceInvalidation(cached.getId(), cached.getName(), cached.getType(), cached.getUris(session, modelSupplier), scopes.stream().map(scope1 -> scope1.getId()).collect(Collectors.toSet()), cached.getResourceServerId(), cached.getOwner());
         updated.updateScopes(scopes);
     }
 
     @Override
     public Map<String, List<String>> getAttributes() {
         if (updated != null) return updated.getAttributes();
-        return cached.getAttributes(modelSupplier);
+        return cached.getAttributes(session, modelSupplier);
     }
 
     @Override
     public String getSingleAttribute(String name) {
         if (updated != null) return updated.getSingleAttribute(name);
 
-        List<String> values = cached.getAttributes(modelSupplier).getOrDefault(name, Collections.emptyList());
+        List<String> values = cached.getAttributes(session, modelSupplier).getOrDefault(name, Collections.emptyList());
 
         if (values.isEmpty()) {
             return null;
@@ -246,7 +250,7 @@ public String getSingleAttribute(String name) {
     public List<String> getAttribute(String name) {
         if (updated != null) return updated.getAttribute(name);
 
-        List<String> values = cached.getAttributes(modelSupplier).getOrDefault(name, Collections.emptyList());
+        List<String> values = cached.getAttributes(session, modelSupplier).getOrDefault(name, Collections.emptyList());
 
         if (values.isEmpty()) {
             return null;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/StoreFactoryCacheSession.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/StoreFactoryCacheSession.java
index 7c3894ee535f..aabcd0d2c93e 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/StoreFactoryCacheSession.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/StoreFactoryCacheSession.java
@@ -29,6 +29,7 @@
 import java.util.function.Consumer;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.UserManagedPermissionUtil;
@@ -301,13 +302,12 @@ private Set<String> getResourceTypes(Set<String> resources, String serverId) {
         ResourceServer resourceServer = getResourceServerStore().findById(serverId);
         return resources.stream().map(resourceId -> {
             Resource resource = getResourceStore().findById(resourceServer, resourceId);
-            String type = resource.getType();
 
-            if (type != null) {
-                return type;
+            if (resource == null) {
+                return null;
             }
+            return resource.getType();
 
-            return null;
         }).filter(Objects::nonNull).collect(Collectors.toSet());
     }
 
@@ -1044,6 +1044,16 @@ public List<Policy> findDependentPolicies(ResourceServer resourceServer, String
             return getPolicyStoreDelegate().findDependentPolicies(resourceServer, id);
         }
 
+        @Override
+        public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, String configValue) {
+            return getPolicyStoreDelegate().findDependentPolicies(resourceServer, resourceType, associatedPolicyType, configKey, configValue);
+        }
+
+        @Override
+        public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, List<String> configValue) {
+            return getPolicyStoreDelegate().findDependentPolicies(resourceServer, resourceType, associatedPolicyType, configKey, configValue);
+        }
+
         private <R extends Policy, Q extends PolicyQuery> List<R> cacheQuery(String cacheKey, Class<Q> queryType, Supplier<List<R>> resultSupplier, BiFunction<Long, List<R>, Q> querySupplier, ResourceServer resourceServer) {
             return cacheQuery(cacheKey, queryType, resultSupplier, querySupplier, resourceServer, null, true);
         }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedPolicy.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedPolicy.java
index 1f208ed18329..1956c17bf5cb 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedPolicy.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedPolicy.java
@@ -21,6 +21,7 @@
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.authorization.model.Scope;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.cache.infinispan.DefaultLazyLoader;
 import org.keycloak.models.cache.infinispan.LazyLoader;
 import org.keycloak.models.cache.infinispan.entities.AbstractRevisioned;
@@ -47,6 +48,7 @@ public class CachedPolicy extends AbstractRevisioned implements InResourceServer
     private final String resourceServerId;
     private final LazyLoader<Policy, Set<String>> associatedPoliciesIds;
     private final LazyLoader<Policy, Set<String>> resourcesIds;
+    private final LazyLoader<Policy, Set<String>> resourcesNames;
     private final LazyLoader<Policy, Set<String>> scopesIds;
     private final LazyLoader<Policy, Map<String, String>> config;
     private final String owner;
@@ -63,6 +65,7 @@ public CachedPolicy(Long revision, Policy policy) {
         this.associatedPoliciesIds = new DefaultLazyLoader<>(source -> source.getAssociatedPolicies().stream().map(Policy::getId).collect(Collectors.toSet()), Collections::emptySet);
 
         this.resourcesIds = new DefaultLazyLoader<>(source -> source.getResources().stream().map(Resource::getId).collect(Collectors.toSet()), Collections::emptySet);
+        this.resourcesNames = new DefaultLazyLoader<>(source -> source.getResources().stream().map(Resource::getName).collect(Collectors.toSet()), Collections::emptySet);
 
         this.scopesIds = new DefaultLazyLoader<>(source -> source.getScopes().stream().map(Scope::getId).collect(Collectors.toSet()), Collections::emptySet);
 
@@ -83,8 +86,8 @@ public Logic getLogic() {
         return this.logic;
     }
 
-    public Map<String, String> getConfig(Supplier<Policy> policy) {
-        return this.config.get(policy);
+    public Map<String, String> getConfig(KeycloakSession session, Supplier<Policy> policy) {
+        return this.config.get(session, policy);
     }
 
     public String getName() {
@@ -95,16 +98,20 @@ public String getDescription() {
         return this.description;
     }
 
-    public Set<String> getAssociatedPoliciesIds(Supplier<Policy> policy) {
-        return this.associatedPoliciesIds.get(policy);
+    public Set<String> getAssociatedPoliciesIds(KeycloakSession session, Supplier<Policy> policy) {
+        return this.associatedPoliciesIds.get(session, policy);
     }
 
-    public Set<String> getResourcesIds(Supplier<Policy> policy) {
-        return this.resourcesIds.get(policy);
+    public Set<String> getResourcesIds(KeycloakSession session, Supplier<Policy> policy) {
+        return this.resourcesIds.get(session, policy);
     }
 
-    public Set<String> getScopesIds(Supplier<Policy> policy) {
-        return this.scopesIds.get(policy);
+    public Set<String> getResourceNames(KeycloakSession session, Supplier<Policy> policy) {
+        return this.resourcesNames.get(session, policy);
+    }
+
+    public Set<String> getScopesIds(KeycloakSession session, Supplier<Policy> policy) {
+        return this.scopesIds.get(session, policy);
     }
 
     public String getResourceServerId() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedResource.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedResource.java
index ada982feee46..4b18f9caedec 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedResource.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/authorization/entities/CachedResource.java
@@ -21,6 +21,7 @@
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.cache.infinispan.DefaultLazyLoader;
 import org.keycloak.models.cache.infinispan.LazyLoader;
 import org.keycloak.models.cache.infinispan.entities.AbstractRevisioned;
@@ -75,8 +76,8 @@ public String getDisplayName() {
         return this.displayName;
     }
 
-    public Set<String> getUris(Supplier<Resource> source) {
-        return this.uris.get(source);
+    public Set<String> getUris(KeycloakSession session, Supplier<Resource> source) {
+        return this.uris.get(session, source);
     }
 
     public String getType() {
@@ -99,11 +100,11 @@ public String getResourceServerId() {
         return this.resourceServerId;
     }
 
-    public Set<String> getScopesIds(Supplier<Resource> source) {
-        return this.scopesIds.get(source);
+    public Set<String> getScopesIds(KeycloakSession session, Supplier<Resource> source) {
+        return this.scopesIds.get(session, source);
     }
 
-    public Map<String, List<String>> getAttributes(Supplier<Resource> source) {
-        return attributes.get(source);
+    public Map<String, List<String>> getAttributes(KeycloakSession session, Supplier<Resource> source) {
+        return attributes.get(session, source);
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedGroup.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedGroup.java
index 723023f1eb16..4345d256ce42 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedGroup.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedGroup.java
@@ -20,6 +20,7 @@
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.GroupModel.Type;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.cache.infinispan.DefaultLazyLoader;
@@ -38,55 +39,56 @@ public class CachedGroup extends AbstractRevisioned implements InRealm {
 
     private final String realm;
     private final String name;
+    private final String description;
     private final String parentId;
     private final LazyLoader<GroupModel, MultivaluedHashMap<String, String>> attributes;
     private final LazyLoader<GroupModel, Set<String>> roleMappings;
     private final LazyLoader<GroupModel, Set<String>> subGroups;
-    private final LazyLoader<GroupModel, Long> subGroupsCount;
     private final Type type;
 
     public CachedGroup(Long revision, RealmModel realm, GroupModel group) {
         super(revision, group.getId());
         this.realm = realm.getId();
         this.name = group.getName();
+        this.description = group.getDescription();
         this.parentId = group.getParentId();
         this.attributes = new DefaultLazyLoader<>(source -> new MultivaluedHashMap<>(source.getAttributes()), MultivaluedHashMap::new);
         this.roleMappings = new DefaultLazyLoader<>(source -> source.getRoleMappingsStream().map(RoleModel::getId).collect(Collectors.toSet()), Collections::emptySet);
         this.subGroups = new DefaultLazyLoader<>(source -> source.getSubGroupsStream().map(GroupModel::getId).collect(Collectors.toSet()), Collections::emptySet);
-        this.subGroupsCount = new DefaultLazyLoader<>(GroupModel::getSubGroupsCount, () -> 0L);
         this.type = group.getType();
     }
 
+    @Override
     public String getRealm() {
         return realm;
     }
 
-    public MultivaluedHashMap<String, String> getAttributes(Supplier<GroupModel> group) {
-        return attributes.get(group);
+    public MultivaluedHashMap<String, String> getAttributes(KeycloakSession session, Supplier<GroupModel> group) {
+        return attributes.get(session, group);
     }
 
-    public Set<String> getRoleMappings(Supplier<GroupModel> group) {
+    public Set<String> getRoleMappings(KeycloakSession session, Supplier<GroupModel> group) {
         // it may happen that groups were not loaded before so we don't actually need to invalidate entries in the cache
         if (group == null) {
             return Collections.emptySet();
         }
-        return roleMappings.get(group);
+        return roleMappings.get(session, group);
     }
 
     public String getName() {
         return name;
     }
 
-    public String getParentId() {
-        return parentId;
+    public String getDescription() {
+        return description;
     }
 
-    public Set<String> getSubGroups(Supplier<GroupModel> group) {
-        return subGroups.get(group);
+    public String getParentId() {
+        return parentId;
     }
 
-    public Long getSubGroupsCount(Supplier<GroupModel> group) {
-        return subGroupsCount.get(group);
+    public Set<String> getSubGroups(KeycloakSession session, Supplier<GroupModel> group) {
+        return subGroups.get(session, group);
     }
 
     public Type getType() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRealm.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRealm.java
index f32822fb02ba..57a680a7e491 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRealm.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRealm.java
@@ -40,6 +40,7 @@
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.OAuth2DeviceConfig;
 import org.keycloak.models.OTPPolicy;
@@ -165,8 +166,8 @@ public class CachedRealm extends AbstractExtendableRevisioned {
     private boolean allowUserManagedAccess;
 
     protected List<String> defaultGroups;
-    protected List<String> defaultDefaultClientScopes = new LinkedList<>();
-    protected List<String> optionalDefaultClientScopes = new LinkedList<>();
+    protected DefaultLazyLoader<RealmModel, List<String>> defaultDefaultClientScopes;
+    protected DefaultLazyLoader<RealmModel, List<String>> optionalDefaultClientScopes;
     protected boolean internationalizationEnabled;
     protected Set<String> supportedLocales;
     protected String defaultLocale;
@@ -268,7 +269,10 @@ public CachedRealm(Long revision, RealmModel model) {
         ClientModel masterAdminClient = model.getMasterAdminClient();
         this.masterAdminClient = (masterAdminClient != null) ? masterAdminClient.getId() : null;
 
-        cacheClientScopes(model);
+        defaultDefaultClientScopes = new DefaultLazyLoader<>(realm -> realm.getDefaultClientScopesStream(true).map(ClientScopeModel::getId)
+                .collect(Collectors.toList()), null);
+        optionalDefaultClientScopes = new DefaultLazyLoader<>(realm -> realm.getDefaultClientScopesStream(false).map(ClientScopeModel::getId)
+                .collect(Collectors.toList()), null);
 
         internationalizationEnabled = model.isInternationalizationEnabled();
         supportedLocales = model.getSupportedLocalesStream().collect(Collectors.toSet());
@@ -326,13 +330,6 @@ public CachedRealm(Long revision, RealmModel model) {
         realmLocalizationTexts = model.getRealmLocalizationTexts();
     }
 
-    protected void cacheClientScopes(RealmModel model) {
-        defaultDefaultClientScopes = model.getDefaultClientScopesStream(true).map(ClientScopeModel::getId)
-                .collect(Collectors.toList());
-        optionalDefaultClientScopes = model.getDefaultClientScopesStream(false).map(ClientScopeModel::getId)
-                .collect(Collectors.toList());
-    }
-
     public String getMasterAdminClient() {
         return masterAdminClient;
     }
@@ -530,16 +527,16 @@ public int getAccessCodeLifespanLogin() {
         return accessCodeLifespanLogin;
     }
 
-    public OAuth2DeviceConfig getOAuth2DeviceConfig(Supplier<RealmModel> modelSupplier) {
-        return deviceConfig.get(modelSupplier);
+    public OAuth2DeviceConfig getOAuth2DeviceConfig(KeycloakSession session, Supplier<RealmModel> modelSupplier) {
+        return deviceConfig.get(session, modelSupplier);
     }
 
-    public CibaConfig getCibaConfig(Supplier<RealmModel> modelSupplier) {
-        return cibaConfig.get(modelSupplier);
+    public CibaConfig getCibaConfig(KeycloakSession session, Supplier<RealmModel> modelSupplier) {
+        return cibaConfig.get(session, modelSupplier);
     }
 
-    public ParConfig getParConfig(Supplier<RealmModel> modelSupplier) {
-        return parConfig.get(modelSupplier);
+    public ParConfig getParConfig(KeycloakSession session, Supplier<RealmModel> modelSupplier) {
+        return parConfig.get(session, modelSupplier);
     }
 
     public int getActionTokenGeneratedByAdminLifespan() {
@@ -706,12 +703,12 @@ public List<String> getDefaultGroups() {
         return defaultGroups;
     }
 
-    public List<String> getDefaultDefaultClientScopes() {
-        return defaultDefaultClientScopes;
+    public List<String> getDefaultDefaultClientScopes(KeycloakSession session, Supplier<RealmModel> modelSupplier) {
+        return defaultDefaultClientScopes.get(session, modelSupplier);
     }
 
-    public List<String> getOptionalDefaultClientScopes() {
-        return optionalDefaultClientScopes;
+    public List<String> getOptionalDefaultClientScopes(KeycloakSession session, Supplier<RealmModel> modelSupplier) {
+        return optionalDefaultClientScopes.get(session, modelSupplier);
     }
 
     public List<AuthenticationFlowModel> getAuthenticationFlowList() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRole.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRole.java
index 13684175058c..49551edb41a9 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRole.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRole.java
@@ -18,6 +18,7 @@
 package org.keycloak.models.cache.infinispan.entities;
 
 import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.cache.infinispan.DefaultLazyLoader;
@@ -73,7 +74,7 @@ public Set<String> getComposites() {
         return composites;
     }
 
-    public MultivaluedHashMap<String, String> getAttributes(Supplier<RoleModel> roleModel) {
-        return attributes.get(roleModel);
+    public MultivaluedHashMap<String, String> getAttributes(KeycloakSession session, Supplier<RoleModel> roleModel) {
+        return attributes.get(session, roleModel);
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedUser.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedUser.java
index eb47b5dfbade..064bfae2a6a5 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedUser.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedUser.java
@@ -20,6 +20,7 @@
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
@@ -83,11 +84,11 @@ public String getUsername() {
         return eagerLoadedAttributes.getFirst(UserModel.USERNAME);
     }
 
-    public String getFirstAttribute(String name, Supplier<UserModel> userModel) {
+    public String getFirstAttribute(KeycloakSession session, String name, Supplier<UserModel> userModel) {
         if(eagerLoadedAttributes.containsKey(name))
             return eagerLoadedAttributes.getFirst(name);
         else
-            return this.lazyLoadedAttributes.get(userModel).getFirst(name);
+            return this.lazyLoadedAttributes.get(session, userModel).getFirst(name);
     }
 
     public Long getCreatedTimestamp() {
@@ -106,16 +107,16 @@ public boolean isEnabled() {
         return enabled;
     }
 
-    public MultivaluedHashMap<String, String> getAttributes(Supplier<UserModel> userModel) {
-        return lazyLoadedAttributes.get(userModel);
+    public MultivaluedHashMap<String, String> getAttributes(KeycloakSession session, Supplier<UserModel> userModel) {
+        return lazyLoadedAttributes.get(session, userModel);
     }
 
-    public Set<String> getRequiredActions(Supplier<UserModel> userModel) {
-        return this.requiredActions.get(userModel);
+    public Set<String> getRequiredActions(KeycloakSession session, Supplier<UserModel> userModel) {
+        return this.requiredActions.get(session, userModel);
     }
 
-    public Set<String> getRoleMappings(Supplier<UserModel> userModel) {
-        return roleMappings.get(userModel);
+    public Set<String> getRoleMappings(KeycloakSession session, Supplier<UserModel> userModel) {
+        return roleMappings.get(session, userModel);
     }
 
     public String getFederationLink() {
@@ -126,17 +127,17 @@ public String getServiceAccountClientLink() {
         return serviceAccountClientLink;
     }
 
-    public Set<String> getGroups(Supplier<UserModel> userModel) {
-        return groups.get(userModel);
+    public Set<String> getGroups(KeycloakSession session, Supplier<UserModel> userModel) {
+        return groups.get(session, userModel);
     }
 
     public int getNotBefore() {
         return notBefore;
     }
 
-    public List<CredentialModel> getStoredCredentials(Supplier<UserModel> userModel) {
+    public List<CredentialModel> getStoredCredentials(KeycloakSession session, Supplier<UserModel> userModel) {
         // clone the credential model before returning it, so that modifications don't pollute the cache
-        return storedCredentials.get(userModel).stream().map(CredentialModel::shallowClone).collect(Collectors.toList());
+        return storedCredentials.get(session, userModel).stream().map(CredentialModel::shallowClone).collect(Collectors.toList());
     }
 
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientListQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientListQuery.java
index 4fc650d6c2ba..1cb18c42cf46 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientListQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientListQuery.java
@@ -12,19 +12,16 @@
 public class ClientListQuery extends AbstractRevisioned implements ClientQuery {
     private final Set<String> clients;
     private final String realm;
-    private final String realmName;
 
     public ClientListQuery(Long revisioned, String id, RealmModel realm, Set<String> clients) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.clients = clients;
     }
 
     public ClientListQuery(Long revisioned, String id, RealmModel realm, String client) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.clients = new HashSet<>();
         this.clients.add(client);
     }
@@ -43,7 +40,7 @@ public String getRealm() {
     public String toString() {
         return "ClientListQuery{" +
                 "id='" + getId() + "'" +
-                "realmName='" + realmName + '\'' +
+                "realm='" + realm + '\'' +
                 '}';
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientScopeListQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientScopeListQuery.java
index d19f9bd5e54f..9413bcfeaa44 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientScopeListQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/ClientScopeListQuery.java
@@ -24,13 +24,11 @@
 public class ClientScopeListQuery extends AbstractRevisioned implements ClientScopeQuery {
     private final Set<String> clientScopes;
     private final String realm;
-    private final String realmName;
     private String clientUuid;
 
     public ClientScopeListQuery(Long revisioned, String id, RealmModel realm, Set<String> clientScopes) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.clientScopes = clientScopes;
     }
 
@@ -58,7 +56,7 @@ public String getClientId() {
     public String toString() {
         return "ClientScopeListQuery{" +
                 "id='" + getId() + "'" +
-                ", realmName='" + realmName + '\'' +
+                ", realm='" + realm + '\'' +
                 ", clientUuid='" + clientUuid + '\'' +
                 '}';
     }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupListQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupListQuery.java
index 52ed4d693bb3..0a3fcc47c8a4 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupListQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupListQuery.java
@@ -14,13 +14,11 @@
  */
 public class GroupListQuery extends AbstractRevisioned implements GroupQuery {
     private final String realm;
-    private final String realmName;
     private final Map<String, Set<String>> searchKeys;
 
     public GroupListQuery(Long revisioned, String id, RealmModel realm, String searchKey, Set<String> result) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.searchKeys = new HashMap<>();
         this.searchKeys.put(searchKey, result);
     }
@@ -28,7 +26,6 @@ public GroupListQuery(Long revisioned, String id, RealmModel realm, String searc
     public GroupListQuery(Long revisioned, String id, RealmModel realm, String searchKey, Set<String> result, GroupListQuery previous) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.searchKeys = new HashMap<>();
         this.searchKeys.putAll(previous.searchKeys);
         this.searchKeys.put(searchKey, result);
@@ -37,7 +34,6 @@ public GroupListQuery(Long revisioned, String id, RealmModel realm, String searc
     public GroupListQuery(Long revisioned, String id, RealmModel realm, Set<String> ids) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.searchKeys = new HashMap<>();
         this.searchKeys.put(id, ids);
     }
@@ -66,7 +62,7 @@ public String getRealm() {
     public String toString() {
         return "GroupListQuery{" +
                 "id='" + getId() + "'" +
-                "realmName='" + realmName + '\'' +
+                "realm='" + realm + '\'' +
                 '}';
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupNameQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupNameQuery.java
index f40035634bc9..45d6999d1443 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupNameQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/GroupNameQuery.java
@@ -21,13 +21,11 @@
 
 public class GroupNameQuery extends AbstractRevisioned implements InRealm {
     private final String realm;
-    private final String realmName;
     private final String groupId;
 
     public GroupNameQuery(Long revisioned, String id, String groupId, RealmModel realm) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.groupId = groupId;
     }
 
@@ -43,7 +41,7 @@ public String getRealm() {
     public String toString() {
         return "GroupNameQuery{" +
                 "id='" + getId() + "'" +
-                "realmName='" + realmName + '\'' +
+                "realm='" + realm + '\'' +
                 '}';
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java
new file mode 100755
index 000000000000..b5b5d6640565
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleByNameQuery.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.models.cache.infinispan.entities;
+
+import org.keycloak.models.RealmModel;
+
+import java.util.Set;
+
+/**
+ * @author Alexander Schwartz
+ * @version $Revision: 1 $
+ */
+public class RoleByNameQuery extends AbstractRevisioned implements RoleQuery, InClient {
+    private final String role;
+    private final String realm;
+    private String client;
+
+    public RoleByNameQuery(Long revisioned, String id, RealmModel realm, String role) {
+        super(revisioned, id);
+        this.realm = realm.getId();
+        this.role = role;
+    }
+
+    public RoleByNameQuery(Long revision, String id, RealmModel realm, String role, String client) {
+        this(revision, id, realm, role);
+        this.client = client;
+    }
+
+    @Override
+    public Set<String> getRoles() {
+        return role == null ? Set.of() : Set.of(role);
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    @Override
+    public String getRealm() {
+        return realm;
+    }
+
+    @Override
+    public String getClientId() {
+        return client;
+    }
+
+    @Override
+    public String toString() {
+        return "RoleNameQuery{" +
+                "id='" + getId() + "'" +
+                ", realm='" + realm + '\'' +
+                ", clientUuid='" + client + '\'' +
+                '}';
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleListQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleListQuery.java
index e924c0595b96..1affc90a5084 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleListQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/RoleListQuery.java
@@ -12,20 +12,17 @@
 public class RoleListQuery extends AbstractRevisioned implements RoleQuery, InClient {
     private final Set<String> roles;
     private final String realm;
-    private final String realmName;
     private String client;
 
     public RoleListQuery(Long revisioned, String id, RealmModel realm, Set<String> roles) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.roles = roles;
     }
 
     public RoleListQuery(Long revisioned, String id, RealmModel realm, String role) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.roles = new HashSet<>();
         this.roles.add(role);
     }
@@ -59,7 +56,7 @@ public String getClientId() {
     public String toString() {
         return "RoleListQuery{" +
                 "id='" + getId() + "'" +
-                ", realmName='" + realmName + '\'' +
+                ", realm='" + realm + '\'' +
                 ", clientUuid='" + client + '\'' +
                 '}';
     }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/UserListQuery.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/UserListQuery.java
index c19e7aada1d8..7dd59ff305e8 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/UserListQuery.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/UserListQuery.java
@@ -12,19 +12,16 @@
 public class UserListQuery extends AbstractRevisioned implements UserQuery {
     private final Set<String> users;
     private final String realm;
-    private final String realmName;
 
     public UserListQuery(Long revisioned, String id, RealmModel realm, Set<String> users) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.users = users;
     }
 
     public UserListQuery(Long revisioned, String id, RealmModel realm, String user) {
         super(revisioned, id);
         this.realm = realm.getId();
-        this.realmName = realm.getName();
         this.users = new HashSet<>();
         this.users.add(user);
     }
@@ -43,7 +40,7 @@ public String getRealm() {
     public String toString() {
         return "UserListQuery{" +
                 "id='" + getId() + "'" +
-                "realmName='" + realmName + '\'' +
+                "realm='" + realm + '\'' +
                 '}';
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java
index d780006e66e6..5b397835b78e 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/RoleAddedEvent.java
@@ -20,6 +20,7 @@
 import java.util.Set;
 
 import org.infinispan.protostream.annotations.ProtoFactory;
+import org.infinispan.protostream.annotations.ProtoField;
 import org.infinispan.protostream.annotations.ProtoTypeId;
 import org.keycloak.marshalling.Marshalling;
 import org.keycloak.models.cache.infinispan.RealmCacheManager;
@@ -30,17 +31,21 @@
 @ProtoTypeId(Marshalling.ROLE_ADDED_EVENT)
 public class RoleAddedEvent extends BaseRoleEvent {
 
+    @ProtoField(3)
+    final String roleName;
+
     @ProtoFactory
-    RoleAddedEvent(String id, String containerId) {
+    RoleAddedEvent(String id, String containerId, String roleName) {
         super(id, containerId);
+        this.roleName = roleName;
     }
 
-    public static RoleAddedEvent create(String roleId, String containerId) {
-        return new RoleAddedEvent(roleId, containerId);
+    public static RoleAddedEvent create(String roleId, String containerId, String roleName) {
+        return new RoleAddedEvent(roleId, containerId, roleName);
     }
 
     @Override
     public void addInvalidations(RealmCacheManager realmCache, Set<String> invalidations) {
-        realmCache.roleAdded(containerId, invalidations);
+        realmCache.roleAdded(containerId, roleName, invalidations);
     }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/idp/InfinispanIdentityProviderStorageProvider.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/idp/InfinispanIdentityProviderStorageProvider.java
index 642855919341..9ee4cb7c060b 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/idp/InfinispanIdentityProviderStorageProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/idp/InfinispanIdentityProviderStorageProvider.java
@@ -17,6 +17,7 @@
 package org.keycloak.models.cache.infinispan.idp;
 
 import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
@@ -45,6 +46,7 @@ public class InfinispanIdentityProviderStorageProvider implements IdentityProvid
     private static final String IDP_ALIAS_KEY_SUFFIX = ".idp.alias";
     private static final String IDP_ORG_ID_KEY_SUFFIX = ".idp.orgId";
     private static final String IDP_LOGIN_SUFFIX = ".idp.login";
+    private static final String IDP_ENABLED_KEY_SUFFIX = ".idp.enabled";
 
     private final KeycloakSession session;
     private final IdentityProviderStorageProvider idpDelegate;
@@ -78,6 +80,10 @@ public static String cacheKeyForLogin(RealmModel realm, FetchMode fetchMode) {
         return realm.getId() + IDP_LOGIN_SUFFIX + "." + fetchMode;
     }
 
+    public static String cacheKeyIsEnabled(RealmModel realm) {
+        return realm.getId() + IDP_ENABLED_KEY_SUFFIX;
+    }
+
     @Override
     public IdentityProviderModel create(IdentityProviderModel model) {
         registerCountInvalidation();
@@ -164,6 +170,26 @@ public IdentityProviderModel getByAlias(String alias) {
         return createOrganizationAwareIdentityProviderModel(cached.getIdentityProvider());
     }
 
+    @Override
+    public boolean isIdentityFederationEnabled() {
+        String cacheKey = cacheKeyIsEnabled(getRealm());
+
+        if (isInvalid(cacheKey)) {
+            return idpDelegate.isIdentityFederationEnabled();
+        }
+
+        CachedCount cached = realmCache.getCache().get(cacheKey, CachedCount.class);
+
+        if (cached == null) {
+            Long loaded = realmCache.getCache().getCurrentRevision(cacheKey);
+            long count = idpDelegate.getAllStream(Map.of(), 0, 1).count();
+            cached = new CachedCount(loaded, getRealm(), cacheKey, count);
+            realmCache.getCache().addRevisioned(cached, realmCache.getStartupRevision());
+        }
+
+        return cached.getCount() > 0;
+    }
+
     @Override
     public Stream<IdentityProviderModel> getByOrganization(String orgId, Integer first, Integer max) {
         RealmModel realm = getRealm();
@@ -191,13 +217,14 @@ public Stream<IdentityProviderModel> getByOrganization(String orgId, Integer fir
                 // there is a cache entry, but the current search is not yet cached
                 cache.invalidateObject(cacheKey);
                 Long loaded = cache.getCurrentRevision(cacheKey);
-                cached = idpDelegate.getByOrganization(orgId, first, max).map(IdentityProviderModel::getInternalId).collect(Collectors.toSet());
+                cached = idpDelegate.getByOrganization(orgId, first, max).map(IdentityProviderModel::getInternalId)
+                        .collect(Collectors.toCollection(LinkedHashSet::new));
                 query = new IdentityProviderListQuery(loaded, cacheKey, realm, searchKey, cached, query);
                 cache.addRevisioned(query, cache.getCurrentCounter());
             }
         }
 
-        Set<IdentityProviderModel> identityProviders = new HashSet<>();
+        Set<IdentityProviderModel> identityProviders = new LinkedHashSet<>();
         for (String id : cached) {
             IdentityProviderModel idp = session.identityProviders().getById(id);
             if (idp == null) {
@@ -226,7 +253,8 @@ public Stream<IdentityProviderModel> getForLogin(FetchMode mode, String organiza
         if (query == null) {
             // not cached yet
             Long loaded = cache.getCurrentRevision(cacheKey);
-            cached = idpDelegate.getForLogin(mode, organizationId).map(IdentityProviderModel::getInternalId).collect(Collectors.toSet());
+            cached = idpDelegate.getForLogin(mode, organizationId).map(IdentityProviderModel::getInternalId)
+                    .collect(Collectors.toCollection(LinkedHashSet::new));
             query = new IdentityProviderListQuery(loaded, cacheKey, getRealm(), searchKey, cached);
             cache.addRevisioned(query, startupRevision);
         } else {
@@ -241,7 +269,7 @@ public Stream<IdentityProviderModel> getForLogin(FetchMode mode, String organiza
             }
         }
 
-        Set<IdentityProviderModel> identityProviders = new HashSet<>();
+        Set<IdentityProviderModel> identityProviders = new LinkedHashSet<>();
         for (String id : cached) {
             IdentityProviderModel idp = session.identityProviders().getById(id);
             if (idp == null) {
@@ -369,6 +397,7 @@ private void registerIDPInvalidation(IdentityProviderModel idp) {
 
     private void registerCountInvalidation() {
         realmCache.registerInvalidation(cacheKeyIdpCount(getRealm()));
+        realmCache.registerInvalidation(cacheKeyIsEnabled(getRealm()));
     }
 
     private void registerIDPMapperInvalidation(IdentityProviderMapperModel mapper) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedMembership.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedMembership.java
index ec20218deee4..fda8a147d19f 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedMembership.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedMembership.java
@@ -23,20 +23,20 @@
 
 public class CachedMembership extends AbstractRevisioned implements InRealm {
 
-    private final RealmModel realm;
+    private final String realm;
     private final boolean managed;
     private final boolean isMember;
 
     public CachedMembership(Long revision, String key, RealmModel realm, boolean managed, boolean isMember) {
         super(revision, key);
-        this.realm = realm;
+        this.realm = realm.getId();
         this.managed = managed;
         this.isMember = isMember;
     }
 
     @Override
     public String getRealm() {
-        return realm.getId();
+        return realm;
     }
 
     public boolean isManaged() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedOrganization.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedOrganization.java
index 52fb14bcba59..c22aa7f2f747 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedOrganization.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/CachedOrganization.java
@@ -22,6 +22,7 @@
 import java.util.stream.Stream;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OrganizationDomainModel;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.RealmModel;
@@ -80,8 +81,8 @@ public boolean isEnabled() {
         return enabled;
     }
 
-    public MultivaluedHashMap<String, String> getAttributes(Supplier<OrganizationModel> organizationModel) {
-        return attributes.get(organizationModel);
+    public MultivaluedHashMap<String, String> getAttributes(KeycloakSession session, Supplier<OrganizationModel> organizationModel) {
+        return attributes.get(session, organizationModel);
     }
 
     public Stream<OrganizationDomainModel> getDomains() {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/InfinispanOrganizationProvider.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/InfinispanOrganizationProvider.java
index dc1649d7db4f..e0fc5d64d6d5 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/InfinispanOrganizationProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/InfinispanOrganizationProvider.java
@@ -107,7 +107,7 @@ public OrganizationModel getById(String id) {
         } else if (managedOrganizations.containsKey(id)) {
             return managedOrganizations.get(id);
         }
-        OrganizationAdapter adapter = new OrganizationAdapter(cached, () -> getDelegate(), this);
+        OrganizationAdapter adapter = new OrganizationAdapter(session, cached, this::getDelegate, this);
         managedOrganizations.put(id, adapter);
         return adapter;
     }
@@ -150,6 +150,16 @@ public Stream<OrganizationModel> getAllStream(Map<String, String> attributes, In
         return getCacheDelegates(getDelegate().getAllStream(attributes, first, max));
     }
 
+    @Override
+    public long count(String search, Boolean exact) {
+        return getDelegate().count(search, exact);
+    }
+
+    @Override
+    public long count(Map<String, String> attributes) {
+        return getDelegate().count(attributes);
+    }
+
     @Override
     public void removeAll() {
         //TODO: won't scale, requires a better mechanism for bulk deleting organizations within a realm
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/OrganizationAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/OrganizationAdapter.java
index 14d4b9e6cc1a..4c56870fef79 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/OrganizationAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/organization/OrganizationAdapter.java
@@ -22,9 +22,11 @@
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OrganizationDomainModel;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.cache.infinispan.LazyModel;
 import org.keycloak.organization.OrganizationProvider;
 
 public class OrganizationAdapter implements OrganizationModel {
@@ -32,15 +34,17 @@ public class OrganizationAdapter implements OrganizationModel {
     private volatile boolean invalidated;
     private volatile OrganizationModel updated;
     private final Supplier<OrganizationModel> modelSupplier;
+    private final KeycloakSession session;
     private final CachedOrganization cached;
     private final Supplier<OrganizationProvider> delegate;
     private final InfinispanOrganizationProvider organizationCache;
 
-    public OrganizationAdapter(CachedOrganization cached, Supplier<OrganizationProvider> delegate, InfinispanOrganizationProvider organizationCache) {
+    public OrganizationAdapter(KeycloakSession session, CachedOrganization cached, Supplier<OrganizationProvider> delegate, InfinispanOrganizationProvider organizationCache) {
+        this.session = session;
         this.cached = cached;
         this.delegate = delegate;
         this.organizationCache = organizationCache;
-        this.modelSupplier = this::getOrganizationModel;
+        this.modelSupplier = new LazyModel<>(this::getOrganizationModel);
     }
 
     void invalidate() {
@@ -136,7 +140,7 @@ public void setRedirectUrl(String redirectUrl) {
     @Override
     public Map<String, List<String>> getAttributes() {
         if (isUpdated()) return updated.getAttributes();
-        return cached.getAttributes(modelSupplier);
+        return cached.getAttributes(session, modelSupplier);
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/stream/HasRolePredicate.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/stream/HasRolePredicate.java
index e55bb7fe5a25..98c490486fd9 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/stream/HasRolePredicate.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/stream/HasRolePredicate.java
@@ -44,7 +44,7 @@ void setRole(String role) {
     public boolean test(Map.Entry<String, Revisioned> entry) {
         Object value = entry.getValue();
         return (value instanceof CachedRole cachedRole && cachedRole.getComposites().contains(role)) ||
-                (value instanceof CachedGroup cachedGroup && cachedGroup.getRoleMappings(null).contains(role)) ||
+                (value instanceof CachedGroup cachedGroup && cachedGroup.getRoleMappings(null, null).contains(role)) ||
                 (value instanceof RoleQuery roleQuery && roleQuery.getRoles().contains(role)) ||
                 (value instanceof CachedClient cachedClient && cachedClient.getScope().contains(role)) ||
                 (value instanceof CachedClientScope cachedClientScope && cachedClientScope.getScope().contains(role));
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
index 46a1e4002d60..ecacfe670178 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
@@ -28,12 +28,10 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.session.UserSessionPersisterProvider;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
 import org.keycloak.models.sessions.infinispan.changes.ClientSessionUpdateTask;
 import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask;
 import org.keycloak.models.sessions.infinispan.changes.SessionsChangelogBasedTransaction;
 import org.keycloak.models.sessions.infinispan.changes.Tasks;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshChecker;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 
 import java.util.UUID;
@@ -44,14 +42,13 @@
 public class AuthenticatedClientSessionAdapter implements AuthenticatedClientSessionModel {
 
     private final KeycloakSession kcSession;
-    private final SessionRefreshStore provider;
     private AuthenticatedClientSessionEntity entity;
     private final ClientModel client;
     private final SessionsChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx;
     private UserSessionModel userSession;
     private boolean offline;
 
-    public AuthenticatedClientSessionAdapter(KeycloakSession kcSession, SessionRefreshStore provider,
+    public AuthenticatedClientSessionAdapter(KeycloakSession kcSession,
                                              AuthenticatedClientSessionEntity entity, ClientModel client, UserSessionModel userSession,
                                              SessionsChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx, boolean offline) {
         if (userSession == null) {
@@ -59,7 +56,6 @@ public AuthenticatedClientSessionAdapter(KeycloakSession kcSession, SessionRefre
         }
 
         this.kcSession = kcSession;
-        this.provider = provider;
         this.entity = entity;
         this.userSession = userSession;
         this.client = client;
@@ -155,12 +151,6 @@ public void runUpdate(AuthenticatedClientSessionEntity entity) {
                 entity.setTimestamp(timestamp);
             }
 
-            @Override
-            public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<AuthenticatedClientSessionEntity> sessionWrapper) {
-                return new CrossDCLastSessionRefreshChecker(provider.getLastSessionRefreshStore(), provider.getOfflineLastSessionRefreshStore())
-                        .shouldSaveClientSessionToRemoteCache(kcSession, client.getRealm(), sessionWrapper, userSession, offline, timestamp);
-            }
-
             @Override
             public boolean isOffline() {
                 return offline;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/CacheDecorators.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/CacheDecorators.java
index ca88a6807e77..8181da3505a1 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/CacheDecorators.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/CacheDecorators.java
@@ -21,8 +21,6 @@
 import org.infinispan.Cache;
 import org.infinispan.context.Flag;
 
-import static org.keycloak.connections.infinispan.InfinispanUtil.getRemoteStores;
-
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -38,35 +36,12 @@ public static <K, V> AdvancedCache<K, V> localCache(Cache<K, V> cache) {
     }
 
     /**
-     * Adds {@link Flag#SKIP_CACHE_LOAD} and {@link Flag#SKIP_CACHE_STORE} flags to the cache.
+     * Adds {@link Flag#IGNORE_RETURN_VALUES} flag to the cache.
      * @param cache
-     * @return Cache with the flags applied.
-     */
-    public static <K, V> AdvancedCache<K, V> skipCacheLoadersIfRemoteStoreIsEnabled(Cache<K, V> cache) {
-        if (!getRemoteStores(cache).isEmpty()) {
-            // Disabling of the cache load and cache store is only needed when a remote store is used and handled separately.
-            return cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_LOAD, Flag.SKIP_CACHE_STORE);
-        } else {
-            // If there is no remote store, use write through for all stores of the cache.
-            // Mixing remote and non-remote caches is not supported.
-            return cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_LOAD);
-        }
-    }
-
-    /**
-     * Adds {@link Flag#SKIP_CACHE_STORE} flag to the cache.
-     * @param cache
-     * @return Cache with the flags applied.
+     * @return Cache with the flag applied.
      */
-    public static <K, V> AdvancedCache<K, V> skipCacheStoreIfRemoteCacheIsEnabled(Cache<K, V> cache) {
-        if (!getRemoteStores(cache).isEmpty()) {
-            // Disabling of the cache load and cache store is only needed when a remote store is used and handled separately.
-            return cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_STORE);
-        } else {
-            // If there is no remote store, use write through for all stores of the cache.
-            // Mixing remote and non-remote caches is not supported.
-            return cache.getAdvancedCache();
-        }
+    public static <K, V> AdvancedCache<K, V> ignoreReturnValues(Cache<K, V> cache) {
+        return cache.getAdvancedCache().withFlags(Flag.IGNORE_RETURN_VALUES);
     }
 
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProvider.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProvider.java
index 52f7b7404380..301c583b99f8 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProvider.java
@@ -37,7 +37,6 @@
 import org.keycloak.models.sessions.infinispan.entities.RootAuthenticationSessionEntity;
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.SessionEventsSenderTransaction;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 import org.keycloak.models.sessions.infinispan.stream.SessionWrapperPredicate;
 import org.keycloak.models.sessions.infinispan.util.InfinispanKeyGenerator;
 import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
@@ -60,14 +59,14 @@ public class InfinispanAuthenticationSessionProvider implements AuthenticationSe
     protected final InfinispanChangelogBasedTransaction<String, RootAuthenticationSessionEntity> sessionTx;
     protected final SessionEventsSenderTransaction clusterEventsSenderTx;
 
-    public InfinispanAuthenticationSessionProvider(KeycloakSession session, RemoteCacheInvoker remoteCacheInvoker, InfinispanKeyGenerator keyGenerator,
-                                                   Cache<String, SessionEntityWrapper<RootAuthenticationSessionEntity>> cache, int authSessionsLimit,  SerializeExecutionsByKey<String> serializer) {
+    public InfinispanAuthenticationSessionProvider(KeycloakSession session, InfinispanKeyGenerator keyGenerator,
+                                                   Cache<String, SessionEntityWrapper<RootAuthenticationSessionEntity>> cache, int authSessionsLimit, SerializeExecutionsByKey<String> serializer) {
         this.session = session;
         this.keyGenerator = keyGenerator;
         this.authSessionsLimit = authSessionsLimit;
 
         this.cache = cache;
-        this.sessionTx = new InfinispanChangelogBasedTransaction<>(session, cache, remoteCacheInvoker, SessionTimeouts::getAuthSessionLifespanMS, SessionTimeouts::getAuthSessionMaxIdleMS, serializer);
+        this.sessionTx = new InfinispanChangelogBasedTransaction<>(session, cache, SessionTimeouts::getAuthSessionLifespanMS, SessionTimeouts::getAuthSessionMaxIdleMS, serializer);
         this.clusterEventsSenderTx = new SessionEventsSenderTransaction(session);
 
         session.getTransactionManager().enlistAfterCompletion(sessionTx);
@@ -118,8 +117,8 @@ public void removeExpired(RealmModel realm) {
     public void onRealmRemoved(RealmModel realm) {
         // Send message to all DCs. The remoteCache will notify client listeners on all DCs for remove authentication sessions
         clusterEventsSenderTx.addEvent(
-                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanAuthenticationSessionProviderFactory.REALM_REMOVED_AUTHSESSION_EVENT, session, realm.getId(), false),
-                ClusterProvider.DCNotify.ALL_DCS);
+                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanAuthenticationSessionProviderFactory.REALM_REMOVED_AUTHSESSION_EVENT, session, realm.getId())
+        );
     }
 
     protected void onRealmRemovedEvent(String realmId) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProviderFactory.java
index 4d90fca62611..efc4a8519097 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanAuthenticationSessionProviderFactory.java
@@ -31,7 +31,6 @@
 import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.KeycloakSessionTask;
 import org.keycloak.models.cache.infinispan.events.AuthenticationSessionAuthNoteUpdateEvent;
 import org.keycloak.models.sessions.infinispan.changes.SerializeExecutionsByKey;
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
@@ -39,10 +38,6 @@
 import org.keycloak.models.sessions.infinispan.entities.RootAuthenticationSessionEntity;
 import org.keycloak.models.sessions.infinispan.events.AbstractAuthSessionClusterListener;
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
-import org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer;
-import org.keycloak.models.sessions.infinispan.initializer.InitializerState;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader;
 import org.keycloak.models.sessions.infinispan.util.InfinispanKeyGenerator;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.PostMigrationEvent;
@@ -74,7 +69,6 @@ public class InfinispanAuthenticationSessionProviderFactory implements Authentic
 
     public static final String REALM_REMOVED_AUTHSESSION_EVENT = "REALM_REMOVED_EVENT_AUTHSESSIONS";
 
-    private RemoteCacheInvoker remoteCacheInvoker;
     SerializeExecutionsByKey<String> serializer = new SerializeExecutionsByKey<>();
     
     @Override
@@ -90,7 +84,6 @@ public static int getAuthSessionsLimit(Config.Scope config) {
 
     @Override
     public void postInit(KeycloakSessionFactory factory) {
-        this.remoteCacheInvoker = new RemoteCacheInvoker();
         keyGenerator = new InfinispanKeyGenerator();
         factory.register(new ProviderEventListener() {
 
@@ -139,7 +132,7 @@ public InfinispanAuthenticationSessionProvider create(KeycloakSession session) {
         InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
         Cache<String, SessionEntityWrapper<RootAuthenticationSessionEntity>> cache = connections.getCache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME);
         this.authSessionsCache = cache;
-        return new InfinispanAuthenticationSessionProvider(session, remoteCacheInvoker, keyGenerator, cache, authSessionsLimit, serializer);
+        return new InfinispanAuthenticationSessionProvider(session, keyGenerator, cache, authSessionsLimit, serializer);
     }
 
     private void updateAuthNotes(ClusterEvent clEvent) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanKeycloakTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanKeycloakTransaction.java
index 6856b9da90e1..def42f4bbcc4 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanKeycloakTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanKeycloakTransaction.java
@@ -240,7 +240,7 @@ public void updateLifespan(long lifespan, TimeUnit lifespanUnit) {
         }
     }
 
-    // Ignore return values. Should have better performance within cluster / cross-dc env
+    // Ignore return values. Should have better performance within cluster
     private static <K, V> BasicCache<K, V> decorateCache(BasicCache<K, V> cache) {
         if (cache instanceof RemoteCache)
             return cache;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProvider.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProvider.java
index c9e3e9bbd2c9..29db8598833b 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProvider.java
@@ -19,13 +19,11 @@
 
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
-import java.util.function.Supplier;
 
 import org.infinispan.client.hotrod.exceptions.HotRodClientException;
 import org.infinispan.commons.api.BasicCache;
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.Time;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.SingleUseObjectProvider;
@@ -44,11 +42,11 @@ public class InfinispanSingleUseObjectProvider implements SingleUseObjectProvide
     public static final Logger logger = Logger.getLogger(InfinispanSingleUseObjectProvider.class);
 
     private final KeycloakSession session;
-    private final Supplier<BasicCache<String, SingleUseObjectValueEntity>> singleUseObjectCache;
+    private final BasicCache<String, SingleUseObjectValueEntity> singleUseObjectCache;
     private final boolean persistRevokedTokens;
     private final InfinispanKeycloakTransaction tx;
 
-    public InfinispanSingleUseObjectProvider(KeycloakSession session, Supplier<BasicCache<String, SingleUseObjectValueEntity>> singleUseObjectCache, boolean persistRevokedTokens) {
+    public InfinispanSingleUseObjectProvider(KeycloakSession session, BasicCache<String, SingleUseObjectValueEntity> singleUseObjectCache, boolean persistRevokedTokens) {
         this.session = session;
         this.singleUseObjectCache = singleUseObjectCache;
         this.persistRevokedTokens = persistRevokedTokens;
@@ -60,8 +58,7 @@ public InfinispanSingleUseObjectProvider(KeycloakSession session, Supplier<Basic
     public void put(String key, long lifespanSeconds, Map<String, String> notes) {
         SingleUseObjectValueEntity tokenValue = new SingleUseObjectValueEntity(notes);
         try {
-            BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-            tx.put(cache, key, tokenValue, InfinispanUtil.toHotrodTimeMs(cache, Time.toMillis(lifespanSeconds)), TimeUnit.MILLISECONDS);
+            tx.put(singleUseObjectCache, key, tokenValue, Time.toMillis(lifespanSeconds), TimeUnit.MILLISECONDS);
         } catch (HotRodClientException re) {
             // No need to retry. The hotrod (remoteCache) has some retries in itself in case of some random network error happened.
             if (logger.isDebugEnabled()) {
@@ -85,8 +82,7 @@ public Map<String, String> get(String key) {
 
         SingleUseObjectValueEntity singleUseObjectValueEntity;
 
-        BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-        singleUseObjectValueEntity = tx.get(cache, key);
+        singleUseObjectValueEntity = tx.get(singleUseObjectCache, key);
         return singleUseObjectValueEntity != null ? singleUseObjectValueEntity.getNotes() : null;
     }
 
@@ -97,8 +93,7 @@ public Map<String, String> remove(String key) {
         }
 
         try {
-            BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-            SingleUseObjectValueEntity existing = cache.remove(key);
+            SingleUseObjectValueEntity existing = singleUseObjectCache.remove(key);
             return existing == null ? null : existing.getNotes();
         } catch (HotRodClientException re) {
             // No need to retry. The hotrod (remoteCache) has some retries in itself in case of some random network error happened.
@@ -117,8 +112,7 @@ public boolean replace(String key, Map<String, String> notes) {
             throw new ModelException("Revoked tokens can't be replaced");
         }
 
-        BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-        return cache.replace(key, new SingleUseObjectValueEntity(notes)) != null;
+        return singleUseObjectCache.replace(key, new SingleUseObjectValueEntity(notes)) != null;
     }
 
     @Override
@@ -128,11 +122,9 @@ public boolean putIfAbsent(String key, long lifespanInSeconds) {
         }
 
         SingleUseObjectValueEntity tokenValue = new SingleUseObjectValueEntity(null);
-        BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
 
         try {
-            long lifespanMs = InfinispanUtil.toHotrodTimeMs(cache, Time.toMillis(lifespanInSeconds));
-            SingleUseObjectValueEntity existing = cache.putIfAbsent(key, tokenValue, lifespanMs, TimeUnit.MILLISECONDS);
+            SingleUseObjectValueEntity existing = singleUseObjectCache.putIfAbsent(key, tokenValue, Time.toMillis(lifespanInSeconds), TimeUnit.MILLISECONDS);
             return existing == null;
         } catch (HotRodClientException re) {
             // No need to retry. The hotrod (remoteCache) has some retries in itself in case of some random network error happened.
@@ -146,8 +138,7 @@ public boolean putIfAbsent(String key, long lifespanInSeconds) {
 
     @Override
     public boolean contains(String key) {
-        BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-        return cache.containsKey(key);
+        return singleUseObjectCache.containsKey(key);
     }
 
     @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProviderFactory.java
index c003bdaa7005..fd1890c5cb34 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanSingleUseObjectProviderFactory.java
@@ -27,14 +27,11 @@
 import java.util.function.Supplier;
 
 import org.infinispan.Cache;
-import org.infinispan.client.hotrod.Flag;
-import org.infinispan.client.hotrod.RemoteCache;
 import org.infinispan.commons.api.BasicCache;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
@@ -62,7 +59,7 @@ public class InfinispanSingleUseObjectProviderFactory implements SingleUseObject
 
     private static final Logger LOG = Logger.getLogger(InfinispanSingleUseObjectProviderFactory.class);
 
-    protected volatile Supplier<BasicCache<String, SingleUseObjectValueEntity>> singleUseObjectCache;
+    protected BasicCache<String, SingleUseObjectValueEntity> singleUseObjectCache;
 
     private volatile boolean initialized;
     private boolean persistRevokedTokens;
@@ -81,16 +78,7 @@ public InfinispanSingleUseObjectProvider create(KeycloakSession session) {
     static Supplier<BasicCache<String, SingleUseObjectValueEntity>> getSingleUseObjectCache(KeycloakSession session) {
         InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
         Cache cache = connections.getCache(InfinispanConnectionProvider.ACTION_TOKEN_CACHE);
-
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cache);
-
-        if (remoteCache != null) {
-            LOG.debugf("Having remote stores. Using remote cache '%s' for single-use cache of token", remoteCache.getName());
-            return () -> remoteCache.withFlags(Flag.FORCE_RETURN_VALUE);
-        } else {
-            LOG.debugf("Not having remote stores. Using basic cache '%s' for single-use cache of token", cache.getName());
-            return () -> cache;
-        }
+        return () -> cache;
     }
 
     @Override
@@ -103,17 +91,16 @@ private void initialize(KeycloakSession session) {
             synchronized (this) {
                 if (!initialized) {
                     RevokedTokenPersisterProvider provider = session.getProvider(RevokedTokenPersisterProvider.class);
-                    BasicCache<String, SingleUseObjectValueEntity> cache = singleUseObjectCache.get();
-                    if (cache.get(LOADED) == null) {
+                    if (singleUseObjectCache.get(LOADED) == null) {
                         // in a cluster, multiple Keycloak instances might load the same data in parallel, but that wouldn't matter
                         provider.getAllRevokedTokens().forEach(revokedToken -> {
                             long lifespanSeconds = revokedToken.expiry() - Time.currentTime();
                             if (lifespanSeconds > 0) {
-                                cache.put(revokedToken.tokenId() + SingleUseObjectProvider.REVOKED_KEY, new SingleUseObjectValueEntity(Collections.emptyMap()),
-                                        InfinispanUtil.toHotrodTimeMs(cache, Time.toMillis(lifespanSeconds)), TimeUnit.MILLISECONDS);
+                                singleUseObjectCache.put(revokedToken.tokenId() + SingleUseObjectProvider.REVOKED_KEY, new SingleUseObjectValueEntity(Collections.emptyMap()),
+                                         Time.toMillis(lifespanSeconds), TimeUnit.MILLISECONDS);
                             }
                         });
-                        cache.put(LOADED, new SingleUseObjectValueEntity(Collections.emptyMap()));
+                        singleUseObjectCache.put(LOADED, new SingleUseObjectValueEntity(Collections.emptyMap()));
                     }
                     initialized = true;
                 }
@@ -126,7 +113,8 @@ public void postInit(KeycloakSessionFactory factory) {
         // It is necessary to put the cache initialization here, otherwise the cache would be initialized lazily, that
         // means also listeners will start only after first cache initialization - that would be too late
         if (singleUseObjectCache == null) {
-            this.singleUseObjectCache = getSingleUseObjectCache(factory.create());
+            InfinispanConnectionProvider connections = factory.create().getProvider(InfinispanConnectionProvider.class);
+            singleUseObjectCache = connections.getCache(InfinispanConnectionProvider.ACTION_TOKEN_CACHE);
         }
 
         if (persistRevokedTokens) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProvider.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProvider.java
index a71d5b2ae5bb..ad5653b10d69 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProvider.java
@@ -18,7 +18,6 @@
 
 import org.infinispan.Cache;
 import org.jboss.logging.Logger;
-import org.keycloak.cluster.ClusterProvider;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserLoginFailureProvider;
 import org.keycloak.models.RealmModel;
@@ -33,7 +32,6 @@
 import org.keycloak.models.sessions.infinispan.entities.LoginFailureKey;
 import org.keycloak.models.sessions.infinispan.events.RemoveAllUserLoginFailuresEvent;
 import org.keycloak.models.sessions.infinispan.events.SessionEventsSenderTransaction;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 import org.keycloak.models.sessions.infinispan.stream.Mappers;
 import org.keycloak.models.sessions.infinispan.stream.SessionWrapperPredicate;
 import org.keycloak.models.sessions.infinispan.util.FuturesHelper;
@@ -59,12 +57,11 @@ public class InfinispanUserLoginFailureProvider implements UserLoginFailureProvi
     protected final SessionEventsSenderTransaction clusterEventsSenderTx;
 
     public InfinispanUserLoginFailureProvider(KeycloakSession session,
-                                              RemoteCacheInvoker remoteCacheInvoker,
                                               Cache<LoginFailureKey, SessionEntityWrapper<LoginFailureEntity>> loginFailureCache,
                                               SerializeExecutionsByKey<LoginFailureKey> serializer) {
         this.session = session;
         this.loginFailureCache = loginFailureCache;
-        this.loginFailuresTx = new InfinispanChangelogBasedTransaction<>(session, loginFailureCache, remoteCacheInvoker, SessionTimeouts::getLoginFailuresLifespanMs, SessionTimeouts::getLoginFailuresMaxIdleMs, serializer);
+        this.loginFailuresTx = new InfinispanChangelogBasedTransaction<>(session, loginFailureCache, SessionTimeouts::getLoginFailuresLifespanMs, SessionTimeouts::getLoginFailuresMaxIdleMs, serializer);
         this.clusterEventsSenderTx = new SessionEventsSenderTransaction(session);
 
         session.getTransactionManager().enlistAfterCompletion(clusterEventsSenderTx);
@@ -107,8 +104,8 @@ public void removeAllUserLoginFailures(RealmModel realm) {
         log.tracef("removeAllUserLoginFailures(%s)%s", realm, getShortStackTrace());
 
         clusterEventsSenderTx.addEvent(
-                RemoveAllUserLoginFailuresEvent.createEvent(RemoveAllUserLoginFailuresEvent.class, InfinispanUserLoginFailureProviderFactory.REMOVE_ALL_LOGIN_FAILURES_EVENT, session, realm.getId(), true),
-                ClusterProvider.DCNotify.LOCAL_DC_ONLY);
+                RemoveAllUserLoginFailuresEvent.createEvent(RemoveAllUserLoginFailuresEvent.class, InfinispanUserLoginFailureProviderFactory.REMOVE_ALL_LOGIN_FAILURES_EVENT, session, realm.getId())
+        );
     }
 
     protected void removeAllLocalUserLoginFailuresEvent(String realmId) {
@@ -118,9 +115,9 @@ protected void removeAllLocalUserLoginFailuresEvent(String realmId) {
 
         Cache<LoginFailureKey, SessionEntityWrapper<LoginFailureEntity>> localCache = CacheDecorators.localCache(loginFailureCache);
 
-        Cache<LoginFailureKey, SessionEntityWrapper<LoginFailureEntity>> localCacheStoreIgnore = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(localCache);
-
-        localCacheStoreIgnore
+        // Go through local cache data only
+        // entries from other nodes will be removed by each instance receiving the event
+        localCache
                 .entrySet()
                 .stream()
                 .filter(SessionWrapperPredicate.create(realmId))
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProviderFactory.java
index 54475b68d270..a81ea39d0dba 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserLoginFailureProviderFactory.java
@@ -17,19 +17,13 @@
 package org.keycloak.models.sessions.infinispan;
 
 import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.persistence.remote.RemoteStore;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.KeycloakSessionTask;
-import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserLoginFailureProvider;
 import org.keycloak.models.UserLoginFailureProviderFactory;
 import org.keycloak.models.UserModel;
@@ -37,36 +31,22 @@
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
 import org.keycloak.models.sessions.infinispan.entities.LoginFailureEntity;
 import org.keycloak.models.sessions.infinispan.entities.LoginFailureKey;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
 import org.keycloak.models.sessions.infinispan.events.AbstractUserSessionClusterListener;
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveAllUserLoginFailuresEvent;
-import org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer;
-import org.keycloak.models.sessions.infinispan.initializer.InitializerState;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionListener;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader;
-import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.PostMigrationEvent;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 
-import java.util.Set;
-
 /**
  * @author <a href="mailto:mkanis@redhat.com">Martin Kanis</a>
  */
 public class InfinispanUserLoginFailureProviderFactory implements UserLoginFailureProviderFactory<InfinispanUserLoginFailureProvider>, EnvironmentDependentProviderFactory {
 
     private static final Logger log = Logger.getLogger(InfinispanUserLoginFailureProviderFactory.class);
-
     public static final String REALM_REMOVED_SESSION_EVENT = "REALM_REMOVED_EVENT_SESSIONS";
-
     public static final String REMOVE_ALL_LOGIN_FAILURES_EVENT = "REMOVE_ALL_LOGIN_FAILURES_EVENT";
 
-    private Config.Scope config;
-
-    private RemoteCacheInvoker remoteCacheInvoker;
     SerializeExecutionsByKey<LoginFailureKey> serializer = new SerializeExecutionsByKey<>();
 
     @Override
@@ -74,25 +54,18 @@ public InfinispanUserLoginFailureProvider create(KeycloakSession session) {
         InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
         Cache<LoginFailureKey, SessionEntityWrapper<LoginFailureEntity>> loginFailures = connections.getCache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME);
 
-        return new InfinispanUserLoginFailureProvider(session, remoteCacheInvoker, loginFailures, serializer);
+        return new InfinispanUserLoginFailureProvider(session, loginFailures, serializer);
     }
 
     @Override
     public void init(Config.Scope config) {
-        this.config = config;
     }
 
     @Override
     public void postInit(final KeycloakSessionFactory factory) {
-        this.remoteCacheInvoker = new RemoteCacheInvoker();
-
         factory.register(event -> {
             if (event instanceof PostMigrationEvent) {
-                KeycloakModelUtils.runJobInTransaction(factory, (KeycloakSession session) -> {
-                    checkRemoteCaches(session);
-                    registerClusterListeners(session);
-                    loadLoginFailuresFromRemoteCaches(session);
-                });
+                KeycloakModelUtils.runJobInTransaction(factory, this::registerClusterListeners);
             } else if (event instanceof UserModel.UserRemovedEvent userRemovedEvent) {
                 UserLoginFailureProvider provider = userRemovedEvent.getKeycloakSession().getProvider(UserLoginFailureProvider.class, getId());
                 provider.removeUserLoginFailure(userRemovedEvent.getRealm(), userRemovedEvent.getUser().getId());
@@ -130,80 +103,6 @@ protected void eventReceived(UserLoginFailureProvider provider, RemoveAllUserLog
         log.debug("Registered cluster listeners");
     }
 
-
-    protected void checkRemoteCaches(KeycloakSession session) {
-        InfinispanConnectionProvider ispn = session.getProvider(InfinispanConnectionProvider.class);
-
-        Cache<LoginFailureKey, SessionEntityWrapper<LoginFailureEntity>> loginFailuresCache = ispn.getCache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME);
-        checkRemoteCache(session, loginFailuresCache, SessionTimeouts::getLoginFailuresLifespanMs, SessionTimeouts::getLoginFailuresMaxIdleMs);
-    }
-
-    private <K, V extends SessionEntity> RemoteCache checkRemoteCache(KeycloakSession session, Cache<K, SessionEntityWrapper<V>> ispnCache,
-                                                                      SessionFunction<V> lifespanMsLoader, SessionFunction<V> maxIdleTimeMsLoader) {
-        Set<RemoteStore> remoteStores = InfinispanUtil.getRemoteStores(ispnCache);
-
-        if (remoteStores.isEmpty()) {
-            log.debugf("No remote store configured for cache '%s'", ispnCache.getName());
-            return null;
-        } else {
-            log.infof("Remote store configured for cache '%s'", ispnCache.getName());
-
-            RemoteCache<K, SessionEntityWrapper<V>> remoteCache = (RemoteCache) remoteStores.iterator().next().getRemoteCache();
-
-            if (remoteCache == null) {
-                throw new IllegalStateException("No remote cache available for the infinispan cache: " + ispnCache.getName());
-            }
-
-            remoteCacheInvoker.addRemoteCache(ispnCache.getName(), remoteCache);
-
-            RemoteCacheSessionListener hotrodListener = RemoteCacheSessionListener.createListener(session, ispnCache, remoteCache, lifespanMsLoader, maxIdleTimeMsLoader, null);
-            remoteCache.addClientListener(hotrodListener);
-            return remoteCache;
-        }
-    }
-
-    // Max count of worker errors. Initialization will end with exception when this number is reached
-    private int getMaxErrors() {
-        return config.getInt("maxErrors", 20);
-    }
-
-    // Count of sessions to be computed in each segment
-    private int getSessionsPerSegment() {
-        return config.getInt("sessionsPerSegment", 64);
-    }
-
-    private void loadLoginFailuresFromRemoteCaches(KeycloakSession session) {
-        for (String cacheName : remoteCacheInvoker.getRemoteCacheNames()) {
-            loadLoginFailuresFromRemoteCaches(session.getKeycloakSessionFactory(), cacheName, getSessionsPerSegment(), getMaxErrors());
-        }
-    }
-
-    private int getStalledTimeoutInSeconds(int defaultTimeout) {
-         return config.getInt("stalledTimeoutInSeconds", defaultTimeout);
-    }
-
-    private void loadLoginFailuresFromRemoteCaches(final KeycloakSessionFactory sessionFactory, String cacheName, final int sessionsPerSegment, final int maxErrors) {
-        log.debugf("Check pre-loading sessions from remote cache '%s'", cacheName);
-
-        KeycloakModelUtils.runJobInTransaction(sessionFactory, new KeycloakSessionTask() {
-
-            @Override
-            public void run(KeycloakSession session) {
-                InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
-                Cache<String, InitializerState> workCache = connections.getCache(InfinispanConnectionProvider.WORK_CACHE_NAME);
-                int defaultStateTransferTimeout = (int) (connections.getCache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME)
-                  .getCacheConfiguration().clustering().stateTransfer().timeout() / 1000);
-
-                InfinispanCacheInitializer initializer = new InfinispanCacheInitializer(sessionFactory, workCache,
-                        new RemoteCacheSessionsLoader(cacheName, sessionsPerSegment), "remoteCacheLoad::" + cacheName, maxErrors,
-                        getStalledTimeoutInSeconds(defaultStateTransferTimeout));
-                initializer.loadSessions();
-            }
-        });
-
-        log.debugf("Pre-loading login failures from remote cache '%s' finished", cacheName);
-    }
-
     @Override
     public void close() {
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java
index 2fcda5a666ec..541e57f70107 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java
@@ -18,7 +18,6 @@
 package org.keycloak.models.sessions.infinispan;
 
 import java.util.Collection;
-import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -29,7 +28,6 @@
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
-import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
@@ -37,11 +35,7 @@
 import java.util.stream.StreamSupport;
 
 import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.exceptions.HotRodClientException;
-import org.infinispan.commons.api.BasicCache;
 import org.infinispan.commons.util.concurrent.CompletionStages;
-import org.infinispan.context.Flag;
 import org.infinispan.stream.CacheCollectors;
 import org.jboss.logging.Logger;
 import org.keycloak.cluster.ClusterProvider;
@@ -50,7 +44,6 @@
 import org.keycloak.common.util.Retry;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
@@ -67,7 +60,6 @@
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
 import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask;
 import org.keycloak.models.sessions.infinispan.changes.Tasks;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionStore;
@@ -76,7 +68,6 @@
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveUserSessionsEvent;
 import org.keycloak.models.sessions.infinispan.events.SessionEventsSenderTransaction;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 import org.keycloak.models.sessions.infinispan.stream.CollectionToStreamMapper;
 import org.keycloak.models.sessions.infinispan.stream.GroupAndCountCollectorSupplier;
 import org.keycloak.models.sessions.infinispan.stream.Mappers;
@@ -85,6 +76,7 @@
 import org.keycloak.models.sessions.infinispan.util.FuturesHelper;
 import org.keycloak.models.sessions.infinispan.util.InfinispanKeyGenerator;
 import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
+import org.keycloak.utils.StreamsUtil;
 
 import static org.keycloak.models.Constants.SESSION_NOTE_LIGHTWEIGHT_USER;
 import static org.keycloak.utils.StreamsUtil.paginatedStream;
@@ -98,11 +90,6 @@ public class InfinispanUserSessionProvider implements UserSessionProvider, Sessi
 
     protected final KeycloakSession session;
 
-    protected final Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionCache;
-    protected final Cache<String, SessionEntityWrapper<UserSessionEntity>> offlineSessionCache;
-    protected final Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionCache;
-    protected final Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> offlineClientSessionCache;
-
     protected final InfinispanChangelogBasedTransaction<String, UserSessionEntity> sessionTx;
     protected final InfinispanChangelogBasedTransaction<String, UserSessionEntity> offlineSessionTx;
     protected final InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionTx;
@@ -110,20 +97,15 @@ public class InfinispanUserSessionProvider implements UserSessionProvider, Sessi
 
     protected final SessionEventsSenderTransaction clusterEventsSenderTx;
 
-    protected final CrossDCLastSessionRefreshStore lastSessionRefreshStore;
-    protected final CrossDCLastSessionRefreshStore offlineLastSessionRefreshStore;
     protected final PersisterLastSessionRefreshStore persisterLastSessionRefreshStore;
 
     protected final InfinispanKeyGenerator keyGenerator;
 
-    protected final SessionFunction offlineSessionCacheEntryLifespanAdjuster;
+    protected final SessionFunction<UserSessionEntity> offlineSessionCacheEntryLifespanAdjuster;
 
-    protected final SessionFunction offlineClientSessionCacheEntryLifespanAdjuster;
+    protected final SessionFunction<AuthenticatedClientSessionEntity> offlineClientSessionCacheEntryLifespanAdjuster;
 
     public InfinispanUserSessionProvider(KeycloakSession session,
-                                         RemoteCacheInvoker remoteCacheInvoker,
-                                         CrossDCLastSessionRefreshStore lastSessionRefreshStore,
-                                         CrossDCLastSessionRefreshStore offlineLastSessionRefreshStore,
                                          PersisterLastSessionRefreshStore persisterLastSessionRefreshStore,
                                          InfinispanKeyGenerator keyGenerator,
                                          Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionCache,
@@ -138,20 +120,13 @@ public InfinispanUserSessionProvider(KeycloakSession session,
                                          SerializeExecutionsByKey<UUID> serializerOfflineClientSession) {
         this.session = session;
 
-        this.sessionCache = sessionCache;
-        this.clientSessionCache = clientSessionCache;
-        this.offlineSessionCache = offlineSessionCache;
-        this.offlineClientSessionCache = offlineClientSessionCache;
-
-        this.sessionTx = new InfinispanChangelogBasedTransaction<>(session, sessionCache, remoteCacheInvoker, SessionTimeouts::getUserSessionLifespanMs, SessionTimeouts::getUserSessionMaxIdleMs, serializerSession);
-        this.offlineSessionTx = new InfinispanChangelogBasedTransaction<>(session, offlineSessionCache, remoteCacheInvoker, offlineSessionCacheEntryLifespanAdjuster, SessionTimeouts::getOfflineSessionMaxIdleMs, serializerOfflineSession);
-        this.clientSessionTx = new InfinispanChangelogBasedTransaction<>(session, clientSessionCache, remoteCacheInvoker, SessionTimeouts::getClientSessionLifespanMs, SessionTimeouts::getClientSessionMaxIdleMs, serializerClientSession);
-        this.offlineClientSessionTx = new InfinispanChangelogBasedTransaction<>(session, offlineClientSessionCache, remoteCacheInvoker, offlineClientSessionCacheEntryLifespanAdjuster, SessionTimeouts::getOfflineClientSessionMaxIdleMs, serializerOfflineClientSession);
+        this.sessionTx = new InfinispanChangelogBasedTransaction<>(session, sessionCache, SessionTimeouts::getUserSessionLifespanMs, SessionTimeouts::getUserSessionMaxIdleMs, serializerSession);
+        this.offlineSessionTx = new InfinispanChangelogBasedTransaction<>(session, offlineSessionCache, offlineSessionCacheEntryLifespanAdjuster, SessionTimeouts::getOfflineSessionMaxIdleMs, serializerOfflineSession);
+        this.clientSessionTx = new InfinispanChangelogBasedTransaction<>(session, clientSessionCache, SessionTimeouts::getClientSessionLifespanMs, SessionTimeouts::getClientSessionMaxIdleMs, serializerClientSession);
+        this.offlineClientSessionTx = new InfinispanChangelogBasedTransaction<>(session, offlineClientSessionCache, offlineClientSessionCacheEntryLifespanAdjuster, SessionTimeouts::getOfflineClientSessionMaxIdleMs, serializerOfflineClientSession);
 
         this.clusterEventsSenderTx = new SessionEventsSenderTransaction(session);
 
-        this.lastSessionRefreshStore = lastSessionRefreshStore;
-        this.offlineLastSessionRefreshStore = offlineLastSessionRefreshStore;
         this.persisterLastSessionRefreshStore = persisterLastSessionRefreshStore;
         this.keyGenerator = keyGenerator;
         this.offlineSessionCacheEntryLifespanAdjuster = offlineSessionCacheEntryLifespanAdjuster;
@@ -165,7 +140,7 @@ public InfinispanUserSessionProvider(KeycloakSession session,
     }
 
     protected Cache<String, SessionEntityWrapper<UserSessionEntity>> getCache(boolean offline) {
-        return offline ? offlineSessionCache : sessionCache;
+        return offline ? offlineSessionTx.getCache() : sessionTx.getCache();
     }
 
     protected InfinispanChangelogBasedTransaction<String, UserSessionEntity> getTransaction(boolean offline) {
@@ -173,23 +148,13 @@ protected InfinispanChangelogBasedTransaction<String, UserSessionEntity> getTran
     }
 
     protected Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> getClientSessionCache(boolean offline) {
-        return offline ? offlineClientSessionCache : clientSessionCache;
+        return offline ? offlineClientSessionTx.getCache() : clientSessionTx.getCache();
     }
 
     protected InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> getClientSessionTransaction(boolean offline) {
         return offline ? offlineClientSessionTx : clientSessionTx;
     }
 
-    @Override
-    public CrossDCLastSessionRefreshStore getLastSessionRefreshStore() {
-        return lastSessionRefreshStore;
-    }
-
-    @Override
-    public CrossDCLastSessionRefreshStore getOfflineLastSessionRefreshStore() {
-        return offlineLastSessionRefreshStore;
-    }
-
     @Override
     public PersisterLastSessionRefreshStore getPersisterLastSessionRefreshStore() {
         return persisterLastSessionRefreshStore;
@@ -202,12 +167,11 @@ public KeycloakSession getKeycloakSession() {
 
     @Override
     public AuthenticatedClientSessionModel createClientSession(RealmModel realm, ClientModel client, UserSessionModel userSession) {
-        final UUID clientSessionId = keyGenerator.generateKeyUUID(session, clientSessionCache);
+        InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx = clientSessionTx;
+        final UUID clientSessionId = keyGenerator.generateKeyUUID(session, clientSessionUpdateTx.getCache());
         var entity = AuthenticatedClientSessionEntity.create(clientSessionId, realm, client, userSession);
 
-        InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx = getTransaction(false);
-        InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx = getClientSessionTransaction(false);
-        AuthenticatedClientSessionAdapter adapter = new AuthenticatedClientSessionAdapter(session, this, entity, client, userSession, clientSessionUpdateTx, false);
+        AuthenticatedClientSessionAdapter adapter = new AuthenticatedClientSessionAdapter(session, entity, client, userSession, clientSessionUpdateTx, false);
 
         // For now, the clientSession is considered transient in case that userSession was transient
         UserSessionModel.SessionPersistenceState persistenceState = userSession.getPersistenceState() != null ?
@@ -216,8 +180,7 @@ public AuthenticatedClientSessionModel createClientSession(RealmModel realm, Cli
         SessionUpdateTask<AuthenticatedClientSessionEntity> createClientSessionTask = Tasks.addIfAbsentSync();
         clientSessionUpdateTx.addTask(clientSessionId, createClientSessionTask, entity, persistenceState);
 
-        SessionUpdateTask registerClientSessionTask = new RegisterClientSessionTask(client.getId(), clientSessionId);
-        userSessionUpdateTx.addTask(userSession.getId(), registerClientSessionTask);
+        sessionTx.addTask(userSession.getId(), new RegisterClientSessionTask(client.getId(), clientSessionId));
 
         return adapter;
     }
@@ -226,7 +189,7 @@ public AuthenticatedClientSessionModel createClientSession(RealmModel realm, Cli
     public UserSessionModel createUserSession(String id, RealmModel realm, UserModel user, String loginUsername, String ipAddress,
                                               String authMethod, boolean rememberMe, String brokerSessionId, String brokerUserId, UserSessionModel.SessionPersistenceState persistenceState) {
         if (id == null) {
-            id = keyGenerator.generateKeyString(session, sessionCache);
+            id = keyGenerator.generateKeyString(session, sessionTx.getCache());
         }
 
         UserSessionEntity entity = UserSessionEntity.create(id, realm, user, loginUsername, ipAddress, authMethod, rememberMe, brokerSessionId, brokerUserId);
@@ -234,7 +197,7 @@ public UserSessionModel createUserSession(String id, RealmModel realm, UserModel
         SessionUpdateTask<UserSessionEntity> createSessionTask = Tasks.addIfAbsentSync();
         sessionTx.addTask(id, createSessionTask, entity, persistenceState);
 
-        UserSessionAdapter adapter = user instanceof LightweightUserAdapter
+        UserSessionAdapter<?> adapter = user instanceof LightweightUserAdapter
           ? wrap(realm, entity, false, user)
           : wrap(realm, entity, false);
         adapter.setPersistenceState(persistenceState);
@@ -257,7 +220,7 @@ public void migrate(String modelVersion) {
         }
     }
 
-    protected UserSessionAdapter getUserSession(RealmModel realm, String id, boolean offline) {
+    protected UserSessionAdapter<InfinispanUserSessionProvider> getUserSession(RealmModel realm, String id, boolean offline) {
 
         UserSessionEntity userSessionEntityFromCache = getUserSessionEntity(realm, id, offline);
         if (userSessionEntityFromCache != null) {
@@ -270,63 +233,100 @@ protected UserSessionAdapter getUserSession(RealmModel realm, String id, boolean
 
         // Try to recover from potentially lost offline-sessions by attempting to fetch and re-import
         // the offline session information from the PersistenceProvider.
-        UserSessionEntity userSessionEntityFromPersistenceProvider = getUserSessionEntityFromPersistenceProvider(realm, id, offline);
+        UserSessionEntity userSessionEntityFromPersistenceProvider = getUserSessionEntityFromPersistenceProvider(realm, id);
         if (userSessionEntityFromPersistenceProvider != null) {
             // we successfully recovered the offline session!
-            return wrap(realm, userSessionEntityFromPersistenceProvider, offline);
+            return wrap(realm, userSessionEntityFromPersistenceProvider, true);
         }
 
         // no luck, the session is really not there anymore
         return null;
     }
 
-    private UserSessionEntity getUserSessionEntityFromPersistenceProvider(RealmModel realm, String sessionId, boolean offline) {
-
+    private UserSessionEntity getUserSessionEntityFromPersistenceProvider(RealmModel realm, String sessionId) {
         log.debugf("Offline user-session not found in infinispan, attempting UserSessionPersisterProvider lookup for sessionId=%s", sessionId);
         UserSessionPersisterProvider persister = session.getProvider(UserSessionPersisterProvider.class);
-        UserSessionModel persistentUserSession = persister.loadUserSession(realm, sessionId, offline);
+        UserSessionModel persistentUserSession = persister.loadUserSession(realm, sessionId, true);
 
         if (persistentUserSession == null) {
             log.debugf("Offline user-session not found in UserSessionPersisterProvider for sessionId=%s", sessionId);
             return null;
         }
 
-        UserSessionEntity sessionEntity = importUserSession(realm, offline, persistentUserSession);
+        UserSessionEntity sessionEntity = importUserSession(realm, persistentUserSession);
         if (sessionEntity == null) {
-            persister.removeUserSession(sessionId, offline);
+            // TODO session expired, remove or ignore?
+            persister.removeUserSession(sessionId, true);
         }
 
         return sessionEntity;
     }
 
-    private UserSessionEntity getUserSessionEntityFromCacheOrImportIfNecessary(RealmModel realm, boolean offline, UserSessionModel persistentUserSession) {
-
-        UserSessionEntity userSessionEntity = getUserSessionEntity(realm, persistentUserSession.getId(), offline);
+    private UserSessionEntity getUserSessionEntityFromCacheOrImportIfNecessary(RealmModel realm, UserSessionModel persistentUserSession) {
+        UserSessionEntity userSessionEntity = getUserSessionEntity(realm, persistentUserSession.getId(), true);
         if (userSessionEntity != null) {
             // user session present in cache, return existing session
             return userSessionEntity;
         }
 
-        return importUserSession(realm, offline, persistentUserSession);
+        return importUserSession(realm, persistentUserSession);
     }
 
-    private UserSessionEntity importUserSession(RealmModel realm, boolean offline, UserSessionModel persistentUserSession) {
-
+    private UserSessionEntity importUserSession(RealmModel realm, UserSessionModel persistentUserSession) {
         String sessionId = persistentUserSession.getId();
 
-        log.debugf("Attempting to import user-session for sessionId=%s offline=%s", sessionId, offline);
-        session.sessions().importUserSessions(Collections.singleton(persistentUserSession), offline);
-        log.debugf("user-session imported, trying another lookup for sessionId=%s offline=%s", sessionId, offline);
+        log.debugf("Attempting to import user-session for sessionId=%s offline=true", sessionId);
 
-        UserSessionEntity ispnUserSessionEntity = getUserSessionEntity(realm, sessionId, offline);
+        var userSessionEntityToImport = UserSessionEntity.createFromModel(persistentUserSession);
 
-        if (ispnUserSessionEntity != null) {
-            log.debugf("user-session found after import for sessionId=%s offline=%s", sessionId, offline);
-            return ispnUserSessionEntity;
+        long lifespan = offlineSessionCacheEntryLifespanAdjuster.apply(realm, null, userSessionEntityToImport);
+        long maxIdle = SessionTimeouts.getOfflineSessionMaxIdleMs(realm, null, userSessionEntityToImport);
+
+        if (lifespan == SessionTimeouts.ENTRY_EXPIRED_FLAG || maxIdle == SessionTimeouts.ENTRY_EXPIRED_FLAG) {
+            log.debugf("Session has expired. Do not import user-session for sessionId=%s offline=true", sessionId);
+            return null;
         }
 
-        log.debugf("user-session could not be found after import for sessionId=%s offline=%s", sessionId, offline);
-        return null;
+        UserSessionEntity existing = getTransaction(true)
+                .importSession(realm, userSessionEntityToImport.getId(), new SessionEntityWrapper<>(userSessionEntityToImport),
+                        lifespan, maxIdle);
+
+        if (existing != null) {
+            // skip import the client sessions, they should have been imported too.
+            log.debugf("The user-session already imported by another transaction for sessionId=%s offline=true", sessionId);
+            return existing;
+        }
+
+        // we need to import the client sessions too.
+        log.debugf("Attempting to import the client-sessions for user-session with sessionId=%s offline=true", sessionId);
+
+        var clientSessionsById = computeClientSessionsToImport(persistentUserSession, userSessionEntityToImport);
+        getClientSessionTransaction(true).importSessionsConcurrently(realm, clientSessionsById, offlineClientSessionCacheEntryLifespanAdjuster, SessionTimeouts::getOfflineClientSessionMaxIdleMs);
+
+        return userSessionEntityToImport;
+    }
+
+    private Map<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> computeClientSessionsToImport(UserSessionModel persistentUserSession, UserSessionEntity userSessionToImport) {
+        Map<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionsById = new HashMap<>();
+        AuthenticatedClientSessionStore clientSessions = userSessionToImport.getAuthenticatedClientSessions();
+        int lastSessionRefresh = userSessionToImport.getLastSessionRefresh();
+        String realmId = userSessionToImport.getRealmId();
+        for (Map.Entry<String, AuthenticatedClientSessionModel> entry : persistentUserSession.getAuthenticatedClientSessions().entrySet()) {
+            String clientUUID = entry.getKey();
+            AuthenticatedClientSessionModel clientSession = entry.getValue();
+            AuthenticatedClientSessionEntity clientSessionToImport = createAuthenticatedClientSessionInstance(clientSession,
+                    realmId, clientUUID, true);
+
+            // Update timestamp to the same value as userSession.
+            // LastSessionRefresh of userSession from DB will have the correct value.
+            clientSessionToImport.setTimestamp(lastSessionRefresh);
+
+            clientSessionsById.put(clientSessionToImport.getId(), new SessionEntityWrapper<>(clientSessionToImport));
+
+            // Update userSession entity with the clientSession
+            clientSessions.put(clientUUID, clientSessionToImport.getId());
+        }
+        return clientSessionsById;
     }
 
     private UserSessionEntity getUserSessionEntity(RealmModel realm, String id, boolean offline) {
@@ -342,16 +342,6 @@ private UserSessionEntity getUserSessionEntity(RealmModel realm, String id, bool
         return entity;
     }
 
-    private Stream<UserSessionModel> getUserSessionsFromPersistenceProviderStream(RealmModel realm, UserModel user, boolean offline) {
-        UserSessionPersisterProvider persister = session.getProvider(UserSessionPersisterProvider.class);
-        return persister.loadUserSessionsStream(realm, user, offline, 0, null)
-                .map(persistentUserSession -> getUserSessionEntityFromCacheOrImportIfNecessary(realm, offline, persistentUserSession))
-                .filter(Objects::nonNull)
-                .map(userSessionEntity -> (UserSessionModel) wrap(realm, userSessionEntity, offline))
-                .filter(Objects::nonNull);
-    }
-
-
     protected Stream<UserSessionModel> getUserSessionsStream(RealmModel realm, UserSessionPredicate predicate, boolean offline) {
 
         if (offline) {
@@ -383,13 +373,10 @@ protected Stream<UserSessionModel> getUserSessionsStream(RealmModel realm, UserS
             throw new ModelException("For offline sessions, only lookup by userId and brokerUserId is supported");
         }
 
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-        cache = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(cache);
-
         // return a stream that 'wraps' the infinispan cache stream so that the cache stream's elements are read one by one
         // and then mapped locally to avoid serialization issues when trying to manipulate the cache stream directly.
-        return StreamSupport.stream(cache.entrySet().stream().filter(predicate).map(Mappers.userSessionEntity()).spliterator(), false)
-                .map(entity -> this.wrap(realm, entity, offline))
+        return StreamSupport.stream(getCache(false).entrySet().stream().filter(predicate).map(Mappers.userSessionEntity()).spliterator(), false)
+                .map(entity -> this.wrap(realm, entity, false))
                 .filter(Objects::nonNull).map(Function.identity());
     }
 
@@ -407,25 +394,25 @@ public AuthenticatedClientSessionAdapter getClientSession(UserSessionModel userS
         // offline client session lookup in the persister
         if (offline) {
             log.debugf("Offline client session is not found in cache, try to load from db, userSession [%s] clientSessionId [%s] clientId [%s]", userSession.getId(), clientSessionId, client.getClientId());
-            return getClientSessionEntityFromPersistenceProvider(userSession, client, true);
+            return getClientSessionEntityFromPersistenceProvider(userSession, client);
         }
 
         return null;
     }
 
-    private AuthenticatedClientSessionAdapter getClientSessionEntityFromPersistenceProvider(UserSessionModel userSession, ClientModel client, boolean offline) {
+    private AuthenticatedClientSessionAdapter getClientSessionEntityFromPersistenceProvider(UserSessionModel userSession, ClientModel client) {
         UserSessionPersisterProvider persister = session.getProvider(UserSessionPersisterProvider.class);
-        AuthenticatedClientSessionModel clientSession = persister.loadClientSession(session.getContext().getRealm(), client, userSession, offline);
+        AuthenticatedClientSessionModel clientSession = persister.loadClientSession(session.getContext().getRealm(), client, userSession, true);
 
         if (clientSession == null) {
             return null;
         }
 
-        AuthenticatedClientSessionAdapter clientAdapter = importClientSession((UserSessionAdapter) userSession, clientSession, getTransaction(offline),
-                getClientSessionTransaction(offline), offline, true);
+        AuthenticatedClientSessionAdapter clientAdapter = importClientSession((UserSessionAdapter<?>) userSession, clientSession, getTransaction(true),
+                getClientSessionTransaction(true), true);
 
         if (clientAdapter == null) {
-            persister.removeClientSession(userSession.getId(), client.getId(), offline);
+            persister.removeClientSession(userSession.getId(), client.getId(), true);
         }
         return clientAdapter;
     }
@@ -468,16 +455,18 @@ protected Stream<UserSessionModel> getUserSessionsStream(final RealmModel realm,
             // fetch the actual offline user session count from the database
             UserSessionPersisterProvider persister = session.getProvider(UserSessionPersisterProvider.class);
             return persister.loadUserSessionsStream(realm, client, true, firstResult, maxResults)
-                    .map(persistentUserSession -> getUserSessionEntityFromCacheOrImportIfNecessary(realm, offline, persistentUserSession))
+                    .map(persistentUserSession -> getUserSessionEntityFromCacheOrImportIfNecessary(realm, persistentUserSession))
                     .filter(Objects::nonNull)
-                    .map(userSessionEntity -> (UserSessionModel) wrap(realm, userSessionEntity, offline))
+                    .map(userSessionEntity -> (UserSessionModel) wrap(realm, userSessionEntity, true))
                     .filter(Objects::nonNull);
         }
 
         UserSessionPredicate predicate = UserSessionPredicate.create(realm.getId()).client(client.getId());
 
-        return paginatedStream(getUserSessionsStream(realm, predicate, offline)
-                .sorted(Comparator.comparing(UserSessionModel::getLastSessionRefresh)), firstResult, maxResults);
+        // If the sorted stream is used within a flatMap (like in SessionsResource), it will not terminate early unless wrapped with
+        // StreamsUtil.prepareSortedStreamToWorkInsideOfFlatMapWithTerminalOperations causing unnecessary operations.
+        return paginatedStream(StreamsUtil.prepareSortedStreamToWorkInsideOfFlatMapWithTerminalOperations(getUserSessionsStream(realm, predicate, false)
+                .sorted(Comparator.comparing(UserSessionModel::getLastSessionRefresh))), firstResult, maxResults);
     }
 
     @Override
@@ -493,52 +482,7 @@ public UserSessionModel getUserSessionWithPredicate(RealmModel realm, String id,
             return userSession;
         }
 
-        // Try lookup userSession from remoteCache
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cache);
-
-        if (remoteCache != null) {
-            SessionEntityWrapper<UserSessionEntity> remoteSessionEntityWrapper = (SessionEntityWrapper<UserSessionEntity>) remoteCache.get(id);
-            if (remoteSessionEntityWrapper != null) {
-                UserSessionEntity remoteSessionEntity = remoteSessionEntityWrapper.getEntity();
-                log.debugf("getUserSessionWithPredicate(%s): remote cache contains session entity %s", id, remoteSessionEntity);
-
-                UserSessionModel remoteSessionAdapter = wrap(realm, remoteSessionEntity, offline);
-                if (predicate.test(remoteSessionAdapter)) {
-
-                    InfinispanChangelogBasedTransaction<String, UserSessionEntity> tx = getTransaction(offline);
-
-                    // Remote entity contains our predicate. Update local cache with the remote entity
-                    SessionEntityWrapper<UserSessionEntity> sessionWrapper = remoteSessionEntity.mergeRemoteEntityWithLocalEntity(tx.get(id));
-
-                    // Replace entity just in ispn cache. Skip remoteStore
-                    cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD, Flag.IGNORE_RETURN_VALUES)
-                            .replace(id, sessionWrapper);
-
-                    tx.reloadEntityInCurrentTransaction(realm, id, sessionWrapper);
-
-                    // Recursion. We should have it locally now
-                    return getUserSessionWithPredicate(realm, id, offline, predicate);
-                } else {
-                    log.debugf("getUserSessionWithPredicate(%s): found, but predicate doesn't pass", id);
-
-                    return null;
-                }
-            } else {
-                log.debugf("getUserSessionWithPredicate(%s): not found", id);
-
-                // Session not available on remoteCache. Was already removed there. So removing locally too.
-                // TODO: Can be optimized to skip calling remoteCache.remove
-                removeUserSession(realm, userSession);
-
-                return null;
-            }
-        } else {
-
-            log.debugf("getUserSessionWithPredicate(%s): remote cache not available", id);
-
-            return null;
-        }
+        return null;
     }
 
 
@@ -555,9 +499,7 @@ public Map<String, Long> getActiveClientSessionStats(RealmModel realm, boolean o
             return persister.getUserSessionsCountsByClients(realm, true);
         }
 
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-        cache = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(cache);
-        return cache.entrySet().stream()
+        return getCache(false).entrySet().stream()
                 .filter(UserSessionPredicate.create(realm.getId()))
                 .map(Mappers.authClientSessionSetMapper())
                 .flatMap(CollectionToStreamMapper.getInstance())
@@ -572,7 +514,7 @@ protected long getUserSessionsCount(RealmModel realm, ClientModel client, boolea
             return persister.getUserSessionsCount(realm, client, true);
         }
 
-        return getUserSessionsStream(realm, UserSessionPredicate.create(realm.getId()).client(client.getId()), offline).count();
+        return getUserSessionsStream(realm, UserSessionPredicate.create(realm.getId()).client(client.getId()), false).count();
     }
 
     @Override
@@ -589,11 +531,10 @@ public void removeUserSessions(RealmModel realm, UserModel user) {
     }
 
     protected void removeUserSessions(RealmModel realm, UserModel user, boolean offline) {
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-
-        cache = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(cache);
-
-        Iterator<UserSessionEntity> itr = cache.entrySet().stream().filter(UserSessionPredicate.create(realm.getId()).user(user.getId())).map(Mappers.userSessionEntity()).iterator();
+        Iterator<UserSessionEntity> itr = getCache(offline).entrySet().stream()
+                .filter(UserSessionPredicate.create(realm.getId()).user(user.getId()))
+                .map(Mappers.userSessionEntity())
+                .iterator();
 
         while (itr.hasNext()) {
             UserSessionEntity userSessionEntity = itr.next();
@@ -604,7 +545,8 @@ protected void removeUserSessions(RealmModel realm, UserModel user, boolean offl
     public void removeAllExpired() {
         // Rely on expiration of cache entries provided by infinispan. Just expire entries from persister is needed
         // TODO: Avoid iteration over all realms here (Details in the KEYCLOAK-16802)
-        session.realms().getRealmsStream().forEach(this::removeExpired);
+        UserSessionPersisterProvider provider = session.getProvider(UserSessionPersisterProvider.class);
+        session.realms().getRealmsStream().forEach(provider::removeExpired);
 
     }
 
@@ -618,8 +560,8 @@ public void removeExpired(RealmModel realm) {
     public void removeUserSessions(RealmModel realm) {
         // Don't send message to all DCs, just to all cluster nodes in current DC. The remoteCache will notify client listeners for removed userSessions.
         clusterEventsSenderTx.addEvent(
-                RemoveUserSessionsEvent.createEvent(RemoveUserSessionsEvent.class, InfinispanUserSessionProviderFactory.REMOVE_USER_SESSIONS_EVENT, session, realm.getId(), true),
-                ClusterProvider.DCNotify.LOCAL_DC_ONLY);
+                RemoveUserSessionsEvent.createEvent(RemoveUserSessionsEvent.class, InfinispanUserSessionProviderFactory.REMOVE_USER_SESSIONS_EVENT, session, realm.getId())
+        );
     }
 
     protected void onRemoveUserSessionsEvent(String realmId) {
@@ -631,35 +573,25 @@ protected void onRemoveUserSessionsEvent(String realmId) {
     public void removeLocalUserSessions(String realmId, boolean offline) {
         FuturesHelper futures = new FuturesHelper();
 
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCache = CacheDecorators.localCache(cache);
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionCache = getClientSessionCache(offline);
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> localClientSessionCache = CacheDecorators.localCache(clientSessionCache);
-
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCacheStoreIgnore = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(localCache);
+        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCache = CacheDecorators.localCache(getCache(offline));
+        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> localClientSessionCache = CacheDecorators.localCache(getClientSessionCache(offline));
 
         final AtomicInteger userSessionsSize = new AtomicInteger();
 
-        localCacheStoreIgnore
+        localCache
                 .entrySet()
                 .stream()
                 .filter(SessionWrapperPredicate.create(realmId))
-                .map(Mappers.userSessionEntity())
-                .forEach(new Consumer<UserSessionEntity>() {
-
-                    @Override
-                    public void accept(UserSessionEntity userSessionEntity) {
-                        userSessionsSize.incrementAndGet();
-
-                        // Remove session from remoteCache too. Use removeAsync for better perf
-                        Future future = localCache.removeAsync(userSessionEntity.getId());
-                        futures.addTask(future);
-                        userSessionEntity.getAuthenticatedClientSessions().forEach((clientUUID, clientSessionId) -> {
-                            Future f = localClientSessionCache.removeAsync(clientSessionId);
-                            futures.addTask(f);
-                        });
-                    }
-
+                .forEach(userSessionEntity -> {
+                    userSessionsSize.incrementAndGet();
+
+                    // Remove session from remoteCache too. Use removeAsync for better perf
+                    Future<?> future = localCache.removeAsync(userSessionEntity.getKey());
+                    futures.addTask(future);
+                    userSessionEntity.getValue().getEntity().getAuthenticatedClientSessions().forEach((clientUUID, clientSessionId) -> {
+                        Future<?> f = localClientSessionCache.removeAsync(clientSessionId);
+                        futures.addTask(f);
+                    });
                 });
 
 
@@ -672,8 +604,8 @@ public void accept(UserSessionEntity userSessionEntity) {
     public void onRealmRemoved(RealmModel realm) {
         // Don't send message to all DCs, just to all cluster nodes in current DC. The remoteCache will notify client listeners for removed userSessions.
         clusterEventsSenderTx.addEvent(
-                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanUserSessionProviderFactory.REALM_REMOVED_SESSION_EVENT, session, realm.getId(), true),
-                ClusterProvider.DCNotify.LOCAL_DC_ONLY);
+                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanUserSessionProviderFactory.REALM_REMOVED_SESSION_EVENT, session, realm.getId())
+        );
 
         UserSessionPersisterProvider sessionsPersister = session.getProvider(UserSessionPersisterProvider.class);
         if (sessionsPersister != null) {
@@ -688,9 +620,6 @@ protected void onRealmRemovedEvent(String realmId) {
 
     @Override
     public void onClientRemoved(RealmModel realm, ClientModel client) {
-//        clusterEventsSenderTx.addEvent(
-//                ClientRemovedSessionEvent.createEvent(ClientRemovedSessionEvent.class, InfinispanUserSessionProviderFactory.CLIENT_REMOVED_SESSION_EVENT, session, realm.getId(), true),
-//                ClusterProvider.DCNotify.LOCAL_DC_ONLY);
         UserSessionPersisterProvider sessionsPersister = session.getProvider(UserSessionPersisterProvider.class);
         if (sessionsPersister != null) {
             sessionsPersister.onClientRemoved(realm, client);
@@ -726,7 +655,7 @@ protected void removeUserSession(UserSessionEntity sessionEntity, boolean offlin
         userSessionUpdateTx.addTask(sessionEntity.getId(), removeTask);
     }
 
-    UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offline, UserModel user) {
+    UserSessionAdapter<InfinispanUserSessionProvider> wrap(RealmModel realm, UserSessionEntity entity, boolean offline, UserModel user) {
         InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx = getTransaction(offline);
         InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx = getClientSessionTransaction(offline);
 
@@ -734,14 +663,13 @@ UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offl
             return null;
         }
 
-        return new UserSessionAdapter(session, user, this, userSessionUpdateTx, clientSessionUpdateTx, realm, entity, offline);
+        return new UserSessionAdapter<>(session, user, this, userSessionUpdateTx, clientSessionUpdateTx, realm, entity, offline);
     }
 
-    UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offline) {
-        UserModel user = null;
+    UserSessionAdapter<InfinispanUserSessionProvider> wrap(RealmModel realm, UserSessionEntity entity, boolean offline) {
         if (Profile.isFeatureEnabled(Feature.TRANSIENT_USERS) && entity.getNotes().containsKey(SESSION_NOTE_LIGHTWEIGHT_USER)) {
             LightweightUserAdapter lua = LightweightUserAdapter.fromString(session, realm, entity.getNotes().get(SESSION_NOTE_LIGHTWEIGHT_USER));
-            final UserSessionAdapter us = wrap(realm, entity, offline, lua);
+            final UserSessionAdapter<InfinispanUserSessionProvider> us = wrap(realm, entity, offline, lua);
             lua.setUpdateHandler(lua1 -> {
                 if (lua == lua1) {  // Ensure there is no conflicting user model, only the latest lightweight user can be used
                     us.setNote(SESSION_NOTE_LIGHTWEIGHT_USER, lua1.serialize());
@@ -750,7 +678,7 @@ UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offl
             return us;
         }
 
-        user = session.users().getUserById(realm, entity.getUser());
+        UserModel user = session.users().getUserById(realm, entity.getUser());
 
         if (user == null) {
             // remove orphaned user session from the cache and from persister if the session is offline; also removes associated client sessions
@@ -766,15 +694,15 @@ UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offl
 
     AuthenticatedClientSessionAdapter wrap(UserSessionModel userSession, ClientModel client, AuthenticatedClientSessionEntity entity, boolean offline) {
         InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx = getClientSessionTransaction(offline);
-        return entity != null ? new AuthenticatedClientSessionAdapter(session, this, entity, client, userSession, clientSessionUpdateTx, offline) : null;
+        return entity != null ? new AuthenticatedClientSessionAdapter(session, entity, client, userSession, clientSessionUpdateTx, offline) : null;
     }
 
     UserSessionEntity getUserSessionEntity(RealmModel realm, UserSessionModel userSession, boolean offline) {
-        if (userSession instanceof UserSessionAdapter) {
-            if (!userSession.getRealm().equals(realm)) {
+        if (userSession instanceof UserSessionAdapter<?> usa) {
+            if (!usa.getRealm().equals(realm)) {
                 return null;
             }
-            return ((UserSessionAdapter) userSession).getEntity();
+            return usa.getEntity();
         } else {
             return getUserSessionEntity(realm, userSession.getId(), offline);
         }
@@ -783,7 +711,7 @@ UserSessionEntity getUserSessionEntity(RealmModel realm, UserSessionModel userSe
 
     @Override
     public UserSessionModel createOfflineUserSession(UserSessionModel userSession) {
-        UserSessionAdapter offlineUserSession = importUserSession(userSession, true);
+        UserSessionAdapter<?> offlineUserSession = importUserSession(userSession);
 
         // started and lastSessionRefresh set to current time
         int currentTime = Time.currentTime();
@@ -796,7 +724,7 @@ public UserSessionModel createOfflineUserSession(UserSessionModel userSession) {
     }
 
     @Override
-    public UserSessionAdapter getOfflineUserSession(RealmModel realm, String userSessionId) {
+    public UserSessionAdapter<InfinispanUserSessionProvider> getOfflineUserSession(RealmModel realm, String userSessionId) {
         return getUserSession(realm, userSessionId, true);
     }
 
@@ -816,12 +744,13 @@ public void removeOfflineUserSession(RealmModel realm, UserSessionModel userSess
 
     @Override
     public AuthenticatedClientSessionModel createOfflineClientSession(AuthenticatedClientSessionModel clientSession, UserSessionModel offlineUserSession) {
-        UserSessionAdapter userSessionAdapter = (offlineUserSession instanceof UserSessionAdapter) ? (UserSessionAdapter) offlineUserSession :
+        UserSessionAdapter<?> userSessionAdapter = (offlineUserSession instanceof UserSessionAdapter) ? (UserSessionAdapter<?>) offlineUserSession :
                 getOfflineUserSession(offlineUserSession.getRealm(), offlineUserSession.getId());
 
         InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx = getTransaction(true);
         InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx = getClientSessionTransaction(true);
-        AuthenticatedClientSessionAdapter offlineClientSession = importClientSession(userSessionAdapter, clientSession, userSessionUpdateTx, clientSessionUpdateTx, true, false);
+        AuthenticatedClientSessionAdapter offlineClientSession = importClientSession(userSessionAdapter, clientSession, userSessionUpdateTx, clientSessionUpdateTx, false);
+        assert offlineClientSession != null; // no expiration checked, it is never null
 
         // update timestamp to current time
         offlineClientSession.setTimestamp(Time.currentTime());
@@ -835,7 +764,12 @@ public AuthenticatedClientSessionModel createOfflineClientSession(AuthenticatedC
 
     @Override
     public Stream<UserSessionModel> getOfflineUserSessionsStream(RealmModel realm, UserModel user) {
-        return getUserSessionsFromPersistenceProviderStream(realm, user, true);
+        UserSessionPersisterProvider persister = session.getProvider(UserSessionPersisterProvider.class);
+        return persister.loadUserSessionsStream(realm, user, true, 0, null)
+                .map(persistentUserSession -> getUserSessionEntityFromCacheOrImportIfNecessary(realm, persistentUserSession))
+                .filter(Objects::nonNull)
+                .map(userSessionEntity -> (UserSessionModel) wrap(realm, userSessionEntity, true))
+                .filter(Objects::nonNull);
     }
 
     @Override
@@ -849,7 +783,9 @@ public Stream<UserSessionModel> getOfflineUserSessionsStream(RealmModel realm, C
     }
 
 
+    @SuppressWarnings("removal")
     @Override
+    @Deprecated(forRemoval = true, since = "25.0")
     public void importUserSessions(Collection<UserSessionModel> persistentUserSessions, boolean offline) {
         if (persistentUserSessions == null || persistentUserSessions.isEmpty()) {
             return;
@@ -884,7 +820,7 @@ public void importUserSessions(Collection<UserSessionModel> persistentUserSessio
                 .collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
 
         // Directly put all entities to the infinispan cache
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(getCache(offline));
+        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
 
         boolean importWithExpiration = sessionsById.size() == 1;
         if (importWithExpiration) {
@@ -892,88 +828,23 @@ public void importUserSessions(Collection<UserSessionModel> persistentUserSessio
                     offline ? offlineSessionCacheEntryLifespanAdjuster : SessionTimeouts::getUserSessionLifespanMs,
                     offline ? SessionTimeouts::getOfflineSessionMaxIdleMs : SessionTimeouts::getUserSessionMaxIdleMs);
         } else {
-            Retry.executeWithBackoff((int iteration) -> {
-                cache.putAll(sessionsById);
-            }, 10, 10);
-        }
-
-        // put all entities to the remoteCache (if exists)
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cache);
-        if (remoteCache != null) {
-            Map<String, SessionEntityWrapper<UserSessionEntity>> sessionsByIdForTransport = sessionsById.values().stream()
-                    .map(SessionEntityWrapper::forTransport)
-                    .collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
-
-            if (importWithExpiration) {
-                importSessionsWithExpiration(sessionsByIdForTransport, remoteCache,
-                        offline ? offlineSessionCacheEntryLifespanAdjuster : SessionTimeouts::getUserSessionLifespanMs,
-                        offline ? SessionTimeouts::getOfflineSessionMaxIdleMs : SessionTimeouts::getUserSessionMaxIdleMs);
-            } else {
-                Retry.executeWithBackoff((int iteration) -> {
-
-                    try {
-                        remoteCache.putAll(sessionsByIdForTransport);
-                    } catch (HotRodClientException re) {
-                        if (log.isDebugEnabled()) {
-                            log.debugf(re, "Failed to put import %d sessions to remoteCache. Iteration '%s'. Will try to retry the task",
-                                    sessionsByIdForTransport.size(), iteration);
-                        }
-
-                        // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                        throw re;
-                    }
-
-                }, 10, 10);
-            }
+            Retry.executeWithBackoff((int iteration) -> cache.putAll(sessionsById), 10, 10);
         }
 
         // Import client sessions
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessCache =
-                CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(offline ? offlineClientSessionCache : clientSessionCache);
+        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessCache = getClientSessionCache(offline);
 
         if (importWithExpiration) {
             importSessionsWithExpiration(clientSessionsById, clientSessCache,
                     offline ? offlineClientSessionCacheEntryLifespanAdjuster : SessionTimeouts::getClientSessionLifespanMs,
                     offline ? SessionTimeouts::getOfflineClientSessionMaxIdleMs : SessionTimeouts::getClientSessionMaxIdleMs);
         } else {
-            Retry.executeWithBackoff((int iteration) -> {
-                clientSessCache.putAll(clientSessionsById);
-            }, 10, 10);
-        }
-
-        // put all entities to the remoteCache (if exists)
-        RemoteCache remoteCacheClientSessions = InfinispanUtil.getRemoteCache(clientSessCache);
-        if (remoteCacheClientSessions != null) {
-            Map<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> sessionsByIdForTransport = clientSessionsById.values().stream()
-                    .map(SessionEntityWrapper::forTransport)
-                    .collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
-
-            if (importWithExpiration) {
-                importSessionsWithExpiration(sessionsByIdForTransport, remoteCacheClientSessions,
-                        offline ? offlineClientSessionCacheEntryLifespanAdjuster : SessionTimeouts::getClientSessionLifespanMs,
-                        offline ? SessionTimeouts::getOfflineClientSessionMaxIdleMs : SessionTimeouts::getClientSessionMaxIdleMs);
-            } else {
-                Retry.executeWithBackoff((int iteration) -> {
-
-                    try {
-                        remoteCacheClientSessions.putAll(sessionsByIdForTransport);
-                    } catch (HotRodClientException re) {
-                        if (log.isDebugEnabled()) {
-                            log.debugf(re, "Failed to put import %d client sessions to remoteCache. Iteration '%s'. Will try to retry the task",
-                                    sessionsByIdForTransport.size(), iteration);
-                        }
-
-                        // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                        throw re;
-                    }
-
-                }, 10, 10);
-            }
+            Retry.executeWithBackoff((int iteration) -> clientSessCache.putAll(clientSessionsById), 10, 10);
         }
     }
 
-    private <T extends SessionEntity> void importSessionsWithExpiration(Map<? extends Object, SessionEntityWrapper<T>> sessionsById,
-                                                                        BasicCache cache, SessionFunction<T> lifespanMsCalculator,
+    private <K, T extends SessionEntity> void importSessionsWithExpiration(Map<K, SessionEntityWrapper<T>> sessionsById,
+                                                                        Cache<K, SessionEntityWrapper<T>> cache, SessionFunction<T> lifespanMsCalculator,
                                                                         SessionFunction<T> maxIdleTimeMsCalculator) {
         sessionsById.forEach((id, sessionEntityWrapper) -> {
 
@@ -985,61 +856,37 @@ private <T extends SessionEntity> void importSessionsWithExpiration(Map<? extend
 
             if (lifespan != SessionTimeouts.ENTRY_EXPIRED_FLAG
                     && maxIdle != SessionTimeouts.ENTRY_EXPIRED_FLAG) {
-                if (cache instanceof RemoteCache) {
-                    Retry.executeWithBackoff((int iteration) -> {
-
-                        try {
-                            cache.put(id, sessionEntityWrapper, lifespan, TimeUnit.MILLISECONDS, maxIdle, TimeUnit.MILLISECONDS);
-                        } catch (HotRodClientException re) {
-                            if (log.isDebugEnabled()) {
-                                log.debugf(re, "Failed to put import %d sessions to remoteCache. Iteration '%s'. Will try to retry the task",
-                                        sessionsById.size(), iteration);
-                            }
-
-                            // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                            throw re;
-                        }
-
-                    }, 10, 10);
-                } else {
-                    cache.put(id, sessionEntityWrapper, lifespan, TimeUnit.MILLISECONDS, maxIdle, TimeUnit.MILLISECONDS);
-                }
+                cache.put(id, sessionEntityWrapper, lifespan, TimeUnit.MILLISECONDS, maxIdle, TimeUnit.MILLISECONDS);
             }
         });
     }
 
     // Imports just userSession without it's clientSessions
-    protected UserSessionAdapter importUserSession(UserSessionModel userSession, boolean offline) {
+    protected UserSessionAdapter<InfinispanUserSessionProvider> importUserSession(UserSessionModel userSession) {
         UserSessionEntity entity = UserSessionEntity.createFromModel(userSession);
 
-        InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx = getTransaction(offline);
+        InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx = getTransaction(true);
 
         SessionUpdateTask<UserSessionEntity> importTask = Tasks.addIfAbsentSync();
         userSessionUpdateTx.addTask(userSession.getId(), importTask, entity, UserSessionModel.SessionPersistenceState.PERSISTENT);
 
-        UserSessionAdapter importedSession = wrap(userSession.getRealm(), entity, offline);
-
-        return importedSession;
+        return wrap(userSession.getRealm(), entity, true);
     }
 
 
-    private AuthenticatedClientSessionAdapter importClientSession(UserSessionAdapter sessionToImportInto, AuthenticatedClientSessionModel clientSession,
+    private AuthenticatedClientSessionAdapter importClientSession(UserSessionAdapter<?> sessionToImportInto, AuthenticatedClientSessionModel clientSession,
                                                                   InfinispanChangelogBasedTransaction<String, UserSessionEntity> userSessionUpdateTx,
                                                                   InfinispanChangelogBasedTransaction<UUID, AuthenticatedClientSessionEntity> clientSessionUpdateTx,
-                                                                  boolean offline, boolean checkExpiration) {
+                                                                  boolean checkExpiration) {
         AuthenticatedClientSessionEntity entity = createAuthenticatedClientSessionInstance(clientSession,
-                sessionToImportInto.getRealm().getId(), clientSession.getClient().getId(), offline);
+                sessionToImportInto.getRealm().getId(), clientSession.getClient().getId(), true);
 
         // Update timestamp to same value as userSession. LastSessionRefresh of userSession from DB will have correct value
         entity.setTimestamp(sessionToImportInto.getLastSessionRefresh());
 
         if (checkExpiration) {
-            SessionFunction<AuthenticatedClientSessionEntity> lifespanChecker = offline
-                    ? offlineClientSessionCacheEntryLifespanAdjuster : SessionTimeouts::getClientSessionLifespanMs;
-            SessionFunction<AuthenticatedClientSessionEntity> idleTimeoutChecker = offline
-                    ? SessionTimeouts::getOfflineClientSessionMaxIdleMs : SessionTimeouts::getClientSessionMaxIdleMs;
-            if (idleTimeoutChecker.apply(sessionToImportInto.getRealm(), clientSession.getClient(), entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG
-                    || lifespanChecker.apply(sessionToImportInto.getRealm(), clientSession.getClient(), entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG) {
+            if (SessionTimeouts.getOfflineClientSessionMaxIdleMs(sessionToImportInto.getRealm(), clientSession.getClient(), entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG
+                    || offlineClientSessionCacheEntryLifespanAdjuster.apply(sessionToImportInto.getRealm(), clientSession.getClient(), entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG) {
                 return null;
             }
         }
@@ -1052,10 +899,9 @@ private AuthenticatedClientSessionAdapter importClientSession(UserSessionAdapter
         AuthenticatedClientSessionStore clientSessions = sessionToImportInto.getEntity().getAuthenticatedClientSessions();
         clientSessions.put(clientSession.getClient().getId(), clientSessionId);
 
-        SessionUpdateTask registerClientSessionTask = new RegisterClientSessionTask(clientSession.getClient().getId(), clientSessionId);
-        userSessionUpdateTx.addTask(sessionToImportInto.getId(), registerClientSessionTask);
+        userSessionUpdateTx.addTask(sessionToImportInto.getId(), new RegisterClientSessionTask(clientSession.getClient().getId(), clientSessionId));
 
-        return new AuthenticatedClientSessionAdapter(session, this, entity, clientSession.getClient(), sessionToImportInto, clientSessionUpdateTx, offline);
+        return new AuthenticatedClientSessionAdapter(session, entity, clientSession.getClient(), sessionToImportInto, clientSessionUpdateTx, true);
     }
 
 
@@ -1076,15 +922,8 @@ private AuthenticatedClientSessionEntity createAuthenticatedClientSessionInstanc
         return entity;
     }
 
-    private static class RegisterClientSessionTask implements SessionUpdateTask<UserSessionEntity> {
-
-        private final String clientUuid;
-        private final UUID clientSessionId;
-
-        public RegisterClientSessionTask(String clientUuid, UUID clientSessionId) {
-            this.clientUuid = clientUuid;
-            this.clientSessionId = clientSessionId;
-        }
+    private record RegisterClientSessionTask(String clientUuid, UUID clientSessionId)
+            implements SessionUpdateTask<UserSessionEntity> {
 
         @Override
         public void runUpdate(UserSessionEntity session) {
@@ -1097,10 +936,6 @@ public CacheOperation getOperation() {
             return CacheOperation.REPLACE;
         }
 
-        @Override
-        public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<UserSessionEntity> sessionWrapper) {
-            return CrossDCMessageStatus.SYNC;
-        }
     }
 
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java
index 7d47d2281e48..0c1aee3a80b8 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java
@@ -20,23 +20,17 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ArrayBlockingQueue;
 import java.util.concurrent.TimeUnit;
 
 import org.infinispan.Cache;
 import org.infinispan.affinity.KeyGenerator;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.persistence.remote.RemoteStore;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.common.util.Environment;
 import org.keycloak.common.util.MultiSiteUtils;
-import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
@@ -50,21 +44,13 @@
 import org.keycloak.models.sessions.infinispan.changes.PersistentUpdate;
 import org.keycloak.models.sessions.infinispan.changes.SerializeExecutionsByKey;
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStore;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStoreFactory;
 import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStoreFactory;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
 import org.keycloak.models.sessions.infinispan.events.AbstractUserSessionClusterListener;
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveUserSessionsEvent;
-import org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer;
-import org.keycloak.models.sessions.infinispan.initializer.InitializerState;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionListener;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader;
 import org.keycloak.models.sessions.infinispan.util.InfinispanKeyGenerator;
 import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
 import org.keycloak.models.utils.KeycloakModelUtils;
@@ -99,9 +85,6 @@ public class InfinispanUserSessionProviderFactory implements UserSessionProvider
 
     private Config.Scope config;
 
-    private RemoteCacheInvoker remoteCacheInvoker;
-    private CrossDCLastSessionRefreshStore lastSessionRefreshStore;
-    private CrossDCLastSessionRefreshStore offlineLastSessionRefreshStore;
     private PersisterLastSessionRefreshStore persisterLastSessionRefreshStore;
     private InfinispanKeyGenerator keyGenerator;
     SerializeExecutionsByKey<String> serializerSession = new SerializeExecutionsByKey<>();
@@ -132,9 +115,6 @@ public UserSessionProvider create(KeycloakSession session) {
         if (MultiSiteUtils.isPersistentSessionsEnabled()) {
             return new PersistentUserSessionProvider(
                     session,
-                    remoteCacheInvoker,
-                    lastSessionRefreshStore,
-                    offlineLastSessionRefreshStore,
                     keyGenerator,
                     cache,
                     offlineSessionsCache,
@@ -149,9 +129,6 @@ public UserSessionProvider create(KeycloakSession session) {
         }
         return new InfinispanUserSessionProvider(
                 session,
-                remoteCacheInvoker,
-                lastSessionRefreshStore,
-                offlineLastSessionRefreshStore,
                 persisterLastSessionRefreshStore,
                 keyGenerator,
                 cache,
@@ -171,7 +148,15 @@ public UserSessionProvider create(KeycloakSession session) {
     public void init(Config.Scope config) {
         this.config = config;
         offlineSessionCacheEntryLifespanOverride = config.getInt(CONFIG_OFFLINE_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE, -1);
+        if (offlineSessionCacheEntryLifespanOverride != -1) {
+            // to be removed in KC 27
+            log.warn("The option spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override is deprecated and will be removed in a future release");
+        }
         offlineClientSessionCacheEntryLifespanOverride = config.getInt(CONFIG_OFFLINE_CLIENT_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE, -1);
+        if (offlineClientSessionCacheEntryLifespanOverride != -1) {
+            // to be removed in KC 27
+            log.warn("The option spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override is deprecated and will be removed in a future release");
+        }
         maxBatchSize = config.getInt(CONFIG_MAX_BATCH_SIZE, DEFAULT_MAX_BATCH_SIZE);
         // Do not use caches for sessions if explicitly disabled or if embedded caches are not used
         useCaches = config.getBoolean(CONFIG_USE_CACHES, DEFAULT_USE_CACHES) && InfinispanUtils.isEmbeddedInfinispan();
@@ -196,19 +181,14 @@ protected <K> K generateKey(KeycloakSession session, Cache<K, ?> cache, KeyGener
                         }
                     };
                 } else {
-                    int preloadTransactionTimeout = getTimeoutForPreloadingSessionsSeconds();
-                    log.debugf("Will preload sessions with transaction timeout %d seconds", preloadTransactionTimeout);
-
-                    KeycloakModelUtils.runJobInTransactionWithTimeout(factory, (KeycloakSession session) -> {
+                    KeycloakModelUtils.runJobInTransaction(factory, (KeycloakSession session) -> {
 
                         keyGenerator = new InfinispanKeyGenerator();
-                        checkRemoteCaches(session);
                         if (!MultiSiteUtils.isPersistentSessionsEnabled()) {
-                            initializeLastSessionRefreshStore(factory);
+                            initializePersisterLastSessionRefreshStore(factory);
                         }
                         registerClusterListeners(session);
-                        loadSessionsFromRemoteCaches(session);
-                    }, preloadTransactionTimeout);
+                    });
                 }
 
                 } else if (event instanceof UserModel.UserRemovedEvent) {
@@ -227,12 +207,6 @@ protected <K> K generateKey(KeycloakSession session, Cache<K, ?> cache, KeyGener
                     if (persisterLastSessionRefreshStore != null) {
                         persisterLastSessionRefreshStore.reset();
                     }
-                    if (lastSessionRefreshStore != null) {
-                        lastSessionRefreshStore.reset();
-                    }
-                    if (offlineLastSessionRefreshStore != null) {
-                        offlineLastSessionRefreshStore.reset();
-                    }
                 }
             }
         });
@@ -244,26 +218,7 @@ protected <K> K generateKey(KeycloakSession session, Cache<K, ?> cache, KeyGener
         }
     }
 
-    // Max count of worker errors. Initialization will end with exception when this number is reached
-    private int getMaxErrors() {
-        return config.getInt("maxErrors", 20);
-    }
-
-    // Count of sessions to be computed in each segment
-    private int getSessionsPerSegment() {
-        return config.getInt("sessionsPerSegment", 64);
-    }
-
-    private int getTimeoutForPreloadingSessionsSeconds() {
-        Integer timeout = config.getInt("sessionsPreloadTimeoutInSeconds", null);
-        return timeout != null ? timeout : Environment.getServerStartupTimeout();
-    }
-
-    private int getStalledTimeoutInSeconds(int defaultTimeout) {
-         return config.getInt("sessionPreloadStalledTimeoutInSeconds", defaultTimeout);
-    }
-
-    public void initializeLastSessionRefreshStore(final KeycloakSessionFactory sessionFactory) {
+    public void initializePersisterLastSessionRefreshStore(final KeycloakSessionFactory sessionFactory) {
         KeycloakModelUtils.runJobInTransaction(sessionFactory, new KeycloakSessionTask() {
 
             @Override
@@ -310,65 +265,6 @@ protected void eventReceived(UserSessionProvider provider, RemoveUserSessionsEve
         log.debug("Registered cluster listeners");
     }
 
-
-    protected void checkRemoteCaches(KeycloakSession session) {
-        this.remoteCacheInvoker = new RemoteCacheInvoker();
-
-        InfinispanConnectionProvider ispn = session.getProvider(InfinispanConnectionProvider.class);
-
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionsCache = ispn.getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME);
-        RemoteCache sessionsRemoteCache = checkRemoteCache(session, sessionsCache, SessionTimeouts::getUserSessionLifespanMs, SessionTimeouts::getUserSessionMaxIdleMs);
-
-        if (sessionsRemoteCache != null) {
-            lastSessionRefreshStore = new CrossDCLastSessionRefreshStoreFactory().createAndInit(session, sessionsCache, false);
-        }
-
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionsCache = ispn.getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME);
-        checkRemoteCache(session, clientSessionsCache, SessionTimeouts::getClientSessionLifespanMs, SessionTimeouts::getClientSessionMaxIdleMs);
-
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> offlineSessionsCache = ispn.getCache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME);
-        RemoteCache offlineSessionsRemoteCache = checkRemoteCache(session, offlineSessionsCache, this::deriveOfflineSessionCacheEntryLifespanMs, SessionTimeouts::getOfflineSessionMaxIdleMs);
-
-        if (offlineSessionsRemoteCache != null) {
-            offlineLastSessionRefreshStore = new CrossDCLastSessionRefreshStoreFactory().createAndInit(session, offlineSessionsCache, true);
-        }
-
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> offlineClientSessionsCache = ispn.getCache(InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME);
-        checkRemoteCache(session, offlineClientSessionsCache, this::deriveOfflineClientSessionCacheEntryLifespanOverrideMs, SessionTimeouts::getOfflineClientSessionMaxIdleMs);
-    }
-
-    private <K, V extends SessionEntity> RemoteCache checkRemoteCache(KeycloakSession session, Cache<K, SessionEntityWrapper<V>> ispnCache,
-                                                                      SessionFunction<V> lifespanMsLoader, SessionFunction<V> maxIdleTimeMsLoader) {
-        Set<RemoteStore> remoteStores = InfinispanUtil.getRemoteStores(ispnCache);
-
-        if (remoteStores.isEmpty()) {
-            log.debugf("No remote store configured for cache '%s'", ispnCache.getName());
-            return null;
-        } else {
-            log.infof("Remote store configured for cache '%s'", ispnCache.getName());
-
-            RemoteCache<K, SessionEntityWrapper<V>> remoteCache = (RemoteCache) remoteStores.iterator().next().getRemoteCache();
-
-            if (remoteCache == null) {
-                throw new IllegalStateException("No remote cache available for the infinispan cache: " + ispnCache.getName());
-            }
-
-            remoteCacheInvoker.addRemoteCache(ispnCache.getName(), remoteCache);
-
-            Runnable onFailover = null;
-            if (useCaches && MultiSiteUtils.isPersistentSessionsEnabled()) {
-                // If persistent sessions are enabled, we want to clear the local caches when a failover of the listener on the remote store changes as we might have missed some of the remote store events
-                // which might have been triggered by another Keycloak site connected to the same remote Infinispan cluster.
-                // Due to this, we can be sure that we never have outdated information in our local cache. All entries will be re-loaded from the remote cache or the database as necessary lazily.
-                onFailover = ispnCache::clear;
-            }
-
-            RemoteCacheSessionListener hotrodListener = RemoteCacheSessionListener.createListener(session, ispnCache, remoteCache, lifespanMsLoader, maxIdleTimeMsLoader, onFailover);
-            remoteCache.addClientListener(hotrodListener);
-            return remoteCache;
-        }
-    }
-
     protected Long deriveOfflineSessionCacheEntryLifespanMs(RealmModel realm, ClientModel client, UserSessionEntity entity) {
 
         long configuredOfflineSessionLifespan = SessionTimeouts.getOfflineSessionLifespanMs(realm, client, entity);
@@ -405,36 +301,6 @@ protected Long deriveOfflineClientSessionCacheEntryLifespanOverrideMs(RealmModel
         return Math.min(TimeUnit.SECONDS.toMillis(offlineClientSessionCacheEntryLifespanOverride), configuredOfflineClientSessionLifespan);
     }
 
-
-    private void loadSessionsFromRemoteCaches(KeycloakSession session) {
-        for (String cacheName : remoteCacheInvoker.getRemoteCacheNames()) {
-            loadSessionsFromRemoteCache(session.getKeycloakSessionFactory(), cacheName, getSessionsPerSegment(), getMaxErrors());
-        }
-    }
-
-
-    private void loadSessionsFromRemoteCache(final KeycloakSessionFactory sessionFactory, String cacheName, final int sessionsPerSegment, final int maxErrors) {
-        log.debugf("Check pre-loading sessions from remote cache '%s'", cacheName);
-
-        KeycloakModelUtils.runJobInTransaction(sessionFactory, new KeycloakSessionTask() {
-
-            @Override
-            public void run(KeycloakSession session) {
-                InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
-                Cache<String, InitializerState> workCache = connections.getCache(InfinispanConnectionProvider.WORK_CACHE_NAME);
-                int defaultStateTransferTimeout = (int) (connections.getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME)
-                  .getCacheConfiguration().clustering().stateTransfer().timeout() / 1000);
-
-                InfinispanCacheInitializer initializer = new InfinispanCacheInitializer(sessionFactory, workCache,
-                        new RemoteCacheSessionsLoader(cacheName, sessionsPerSegment), "remoteCacheLoad::" + cacheName, maxErrors,
-                        getStalledTimeoutInSeconds(defaultStateTransferTimeout));
-                initializer.loadSessions();
-            }
-        });
-
-        log.debugf("Pre-loading sessions from remote cache '%s' finished", cacheName);
-    }
-
     @Override
     public void close() {
         if (persistentSessionsWorker != null) {
@@ -482,13 +348,13 @@ public List<ProviderConfigProperty> getConfigMetadata() {
         builder.property()
                 .name(CONFIG_OFFLINE_CLIENT_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE)
                 .type("int")
-                .helpText("Override how long offline client sessions should be kept in memory")
+                .helpText("Override how long offline client sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)")
                 .add();
 
         builder.property()
                 .name(CONFIG_OFFLINE_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE)
                 .type("int")
-                .helpText("Override how long offline user sessions should be kept in memory")
+                .helpText("Override how long offline user sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)")
                 .add();
 
         builder.property()
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/PersistentUserSessionProvider.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/PersistentUserSessionProvider.java
index 46254d7876fa..fbbffcfe3809 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/PersistentUserSessionProvider.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/PersistentUserSessionProvider.java
@@ -52,7 +52,6 @@
 import org.keycloak.common.util.Retry;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
@@ -75,7 +74,6 @@
 import org.keycloak.models.sessions.infinispan.changes.SessionUpdatesList;
 import org.keycloak.models.sessions.infinispan.changes.Tasks;
 import org.keycloak.models.sessions.infinispan.changes.UserSessionPersistentChangelogBasedTransaction;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionStore;
@@ -84,7 +82,6 @@
 import org.keycloak.models.sessions.infinispan.events.RealmRemovedSessionEvent;
 import org.keycloak.models.sessions.infinispan.events.RemoveUserSessionsEvent;
 import org.keycloak.models.sessions.infinispan.events.SessionEventsSenderTransaction;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 import org.keycloak.models.sessions.infinispan.stream.Mappers;
 import org.keycloak.models.sessions.infinispan.stream.SessionWrapperPredicate;
 import org.keycloak.models.sessions.infinispan.stream.UserSessionPredicate;
@@ -116,15 +113,9 @@ public class PersistentUserSessionProvider implements UserSessionProvider, Sessi
 
     protected final SessionEventsSenderTransaction clusterEventsSenderTx;
 
-    protected final CrossDCLastSessionRefreshStore lastSessionRefreshStore;
-    protected final CrossDCLastSessionRefreshStore offlineLastSessionRefreshStore;
-
     protected final InfinispanKeyGenerator keyGenerator;
 
     public PersistentUserSessionProvider(KeycloakSession session,
-                                         RemoteCacheInvoker remoteCacheInvoker,
-                                         CrossDCLastSessionRefreshStore lastSessionRefreshStore,
-                                         CrossDCLastSessionRefreshStore offlineLastSessionRefreshStore,
                                          InfinispanKeyGenerator keyGenerator,
                                          Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionCache,
                                          Cache<String, SessionEntityWrapper<UserSessionEntity>> offlineSessionCache,
@@ -148,7 +139,6 @@ public PersistentUserSessionProvider(KeycloakSession session,
 
         this.sessionTx = new UserSessionPersistentChangelogBasedTransaction(session,
                 sessionCache, offlineSessionCache,
-                remoteCacheInvoker,
                 SessionTimeouts::getUserSessionLifespanMs, SessionTimeouts::getUserSessionMaxIdleMs,
                 SessionTimeouts::getOfflineSessionLifespanMs, SessionTimeouts::getOfflineSessionMaxIdleMs,
                 asyncQueuePersistentUpdate,
@@ -157,7 +147,6 @@ public PersistentUserSessionProvider(KeycloakSession session,
 
         this.clientSessionTx = new ClientSessionPersistentChangelogBasedTransaction(session,
                 clientSessionCache, offlineClientSessionCache,
-                remoteCacheInvoker,
                 SessionTimeouts::getClientSessionLifespanMs, SessionTimeouts::getClientSessionMaxIdleMs,
                 SessionTimeouts::getOfflineClientSessionLifespanMs, SessionTimeouts::getOfflineClientSessionMaxIdleMs,
                 sessionTx,
@@ -167,8 +156,6 @@ public PersistentUserSessionProvider(KeycloakSession session,
 
         this.clusterEventsSenderTx = new SessionEventsSenderTransaction(session);
 
-        this.lastSessionRefreshStore = lastSessionRefreshStore;
-        this.offlineLastSessionRefreshStore = offlineLastSessionRefreshStore;
         this.keyGenerator = keyGenerator;
 
         session.getTransactionManager().enlistAfterCompletion(clusterEventsSenderTx);
@@ -184,16 +171,6 @@ protected Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> ge
         return offline ? offlineClientSessionCache : clientSessionCache;
     }
 
-    @Override
-    public CrossDCLastSessionRefreshStore getLastSessionRefreshStore() {
-        return lastSessionRefreshStore;
-    }
-
-    @Override
-    public CrossDCLastSessionRefreshStore getOfflineLastSessionRefreshStore() {
-        return offlineLastSessionRefreshStore;
-    }
-
     @Override
     public PersisterLastSessionRefreshStore getPersisterLastSessionRefreshStore() {
         throw new IllegalStateException("PersisterLastSessionRefreshStore is not supported in PersistentUserSessionProvider");
@@ -218,7 +195,7 @@ public AuthenticatedClientSessionModel createClientSession(RealmModel realm, Cli
             entity.getNotes().put(AuthenticatedClientSessionModel.USER_SESSION_REMEMBER_ME_NOTE, "true");
         }
 
-        AuthenticatedClientSessionAdapter adapter = new AuthenticatedClientSessionAdapter(session, this, entity, client, userSession, clientSessionTx, false);
+        AuthenticatedClientSessionAdapter adapter = new AuthenticatedClientSessionAdapter(session, entity, client, userSession, clientSessionTx, false);
 
         if (userSession.isOffline()) {
             // If this is an offline session, and the referred online session doesn't exist anymore, don't register the client session in the transaction.
@@ -364,6 +341,8 @@ public String getId() {
     @Override
     public AuthenticatedClientSessionAdapter getClientSession(UserSessionModel userSession, ClientModel client, String clientSessionId, boolean offline) {
         if (clientSessionId == null) {
+            log.debugf("Client-session id is null. userSessionId=%s, clientId=%s, offline=%s",
+                    userSession.getId(), client.getId(), offline);
             return null;
         }
 
@@ -371,7 +350,7 @@ public AuthenticatedClientSessionAdapter getClientSession(UserSessionModel userS
 
         SessionEntityWrapper<AuthenticatedClientSessionEntity> clientSessionEntity = clientSessionTx.get(client.getRealm(), client, userSession, clientSessionUUID, offline);
         if (clientSessionEntity != null) {
-            return new AuthenticatedClientSessionAdapter(session, this, clientSessionEntity.getEntity(), client, userSession, clientSessionTx, offline);
+            return new AuthenticatedClientSessionAdapter(session, clientSessionEntity.getEntity(), client, userSession, clientSessionTx, offline);
         }
 
         return null;
@@ -482,8 +461,8 @@ public void removeExpired(RealmModel realm) {
     public void removeUserSessions(RealmModel realm) {
         // Send message to all DCs as each site might have different entries in the cache
         clusterEventsSenderTx.addEvent(
-                RemoveUserSessionsEvent.createEvent(RemoveUserSessionsEvent.class, InfinispanUserSessionProviderFactory.REMOVE_USER_SESSIONS_EVENT, session, realm.getId(), true),
-                ClusterProvider.DCNotify.ALL_DCS);
+                RemoveUserSessionsEvent.createEvent(RemoveUserSessionsEvent.class, InfinispanUserSessionProviderFactory.REMOVE_USER_SESSIONS_EVENT, session, realm.getId())
+        );
 
         session.getProvider(UserSessionPersisterProvider.class).removeUserSessions(realm);
     }
@@ -495,27 +474,19 @@ protected void onRemoveUserSessionsEvent(String realmId) {
 
     // public for usage in the testsuite
     public void removeLocalUserSessions(String realmId, boolean offline) {
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCache = CacheDecorators.localCache(cache);
+        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCache = CacheDecorators.localCache(getCache(offline));
         Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionCache = getClientSessionCache(offline);
         Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> localClientSessionCache = CacheDecorators.localCache(clientSessionCache);
-
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> localCacheStoreIgnore = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(localCache);
-
         final AtomicInteger userSessionsSize = new AtomicInteger();
 
-        removeEntriesByRealm(realmId, localCacheStoreIgnore, userSessionsSize, localCache, localClientSessionCache);
-
-        // TODO: This now runs on each node on each site. Ideally it should run only once on each site.
-        removeEntriesByRealmRemote(realmId, InfinispanUtil.getRemoteCache(getCache(offline)), userSessionsSize, InfinispanUtil.getRemoteCache(getClientSessionCache(offline)));
-
+        removeEntriesByRealm(realmId, localCache, userSessionsSize, localClientSessionCache);
         log.debugf("Removed %d sessions in realm %s. Offline: %b", (Object) userSessionsSize.get(), realmId, offline);
     }
 
-    private static void removeEntriesByRealm(String realmId, Cache<String, SessionEntityWrapper<UserSessionEntity>> sessions, AtomicInteger userSessionsSize, Cache<String, SessionEntityWrapper<UserSessionEntity>> localCache, Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessions) {
+    private static void removeEntriesByRealm(String realmId, Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionsCache, AtomicInteger userSessionsSize, Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessions) {
         FuturesHelper futures = new FuturesHelper();
 
-        sessions
+        sessionsCache
                 .entrySet()
                 .stream()
                 .filter(SessionWrapperPredicate.create(realmId))
@@ -524,7 +495,7 @@ private static void removeEntriesByRealm(String realmId, Cache<String, SessionEn
                     userSessionsSize.incrementAndGet();
 
                     // Remove session from remoteCache too. Use removeAsync for better perf
-                    Future<SessionEntityWrapper<UserSessionEntity>> future = localCache.removeAsync(userSessionEntity.getId());
+                    Future<SessionEntityWrapper<UserSessionEntity>> future = sessionsCache.removeAsync(userSessionEntity.getId());
                     futures.addTask(future);
                     userSessionEntity.getAuthenticatedClientSessions().forEach((clientUUID, clientSessionId) -> {
                         Future<SessionEntityWrapper<AuthenticatedClientSessionEntity>> f = clientSessions.removeAsync(clientSessionId);
@@ -535,40 +506,12 @@ private static void removeEntriesByRealm(String realmId, Cache<String, SessionEn
         futures.waitForAllToFinish();
     }
 
-    private static void removeEntriesByRealmRemote(String realmId, RemoteCache<String, SessionEntityWrapper<UserSessionEntity>> sessions, AtomicInteger userSessionsSize, RemoteCache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessions) {
-        if (sessions == null) {
-            return;
-        }
-
-        FuturesHelper futures = new FuturesHelper();
-
-        sessions
-                .entrySet()
-                .stream()
-                .filter(UserSessionPredicate.create(realmId))
-                .map(Mappers.userSessionEntity())
-                .forEach((Consumer<UserSessionEntity>) userSessionEntity -> {
-                    userSessionsSize.incrementAndGet();
-
-                    Future<SessionEntityWrapper<UserSessionEntity>> future = sessions.withFlags(org.infinispan.client.hotrod.Flag.SKIP_LISTENER_NOTIFICATION).removeAsync(userSessionEntity.getId());
-                    futures.addTask(future);
-                    if (clientSessions != null) {
-                        userSessionEntity.getAuthenticatedClientSessions().forEach((clientUUID, clientSessionId) -> {
-                            Future<SessionEntityWrapper<AuthenticatedClientSessionEntity>> f = clientSessions.withFlags(org.infinispan.client.hotrod.Flag.SKIP_LISTENER_NOTIFICATION).removeAsync(clientSessionId);
-                            futures.addTask(f);
-                        });
-                    }
-                });
-
-        futures.waitForAllToFinish();
-    }
-
     @Override
     public void onRealmRemoved(RealmModel realm) {
         // Send message to all DCs, as each DC might have different entries in their site cache
         clusterEventsSenderTx.addEvent(
-                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanUserSessionProviderFactory.REALM_REMOVED_SESSION_EVENT, session, realm.getId(), true),
-                ClusterProvider.DCNotify.ALL_DCS);
+                RealmRemovedSessionEvent.createEvent(RealmRemovedSessionEvent.class, InfinispanUserSessionProviderFactory.REALM_REMOVED_SESSION_EVENT, session, realm.getId())
+        );
 
         UserSessionPersisterProvider sessionsPersister = session.getProvider(UserSessionPersisterProvider.class);
         if (sessionsPersister != null) {
@@ -642,6 +585,8 @@ UserSessionAdapter wrap(RealmModel realm, UserSessionEntity entity, boolean offl
         user = session.users().getUserById(realm, entity.getUser());
 
         if (user == null) {
+            // mark the user session for removal when the user bound to the session can not be resolved
+            removeUserSession(realm, wrap(realm, entity, offline, null));
             return null;
         }
 
@@ -746,8 +691,12 @@ public SessionEntityWrapper<UserSessionEntity> importUserSession(UserSessionMode
                     userSessionEntityToImport.getRealmId(), clientUUID, offline);
             clientSessionToImport.setUserSessionId(userSessionEntityToImport.getId());
 
-            // Update timestamp to same value as userSession. LastSessionRefresh of userSession from DB will have correct value
-            clientSessionToImport.setTimestamp(userSessionEntityToImport.getLastSessionRefresh());
+            if (offline) {
+                // Update timestamp to the same value as userSession. LastSessionRefresh of userSession from DB will have a correct value.
+                // This is an optimization with the old code before persistent user sessions existed, and is probably valid as an offline user session is supposed to have only one client session.
+                // Remove this code once this once the persistent sessions is the only way to handle sessions, and the old client sessions have been migrated to have an updated timestamp.
+                clientSessionToImport.setTimestamp(userSessionEntityToImport.getLastSessionRefresh());
+            }
 
             clientSessionsById.put(clientSessionToImport.getId(), new SessionEntityWrapper<>(clientSessionToImport));
 
@@ -761,8 +710,7 @@ public SessionEntityWrapper<UserSessionEntity> importUserSession(UserSessionMode
         Map<String, SessionEntityWrapper<UserSessionEntity>> sessionsById =
                     Stream.of(wrappedUserSessionEntity).collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
 
-        // Directly put all entities to the infinispan cache
-        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(getCache(offline));
+        Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = getCache(offline);
 
         sessionsById = importSessionsWithExpiration(sessionsById, cache,
                 offline ? SessionTimeouts::getOfflineSessionLifespanMs : SessionTimeouts::getUserSessionLifespanMs,
@@ -772,42 +720,17 @@ public SessionEntityWrapper<UserSessionEntity> importUserSession(UserSessionMode
             return null;
         }
 
-        // put all entities to the remoteCache (if exists)
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cache);
-        if (remoteCache != null) {
-            Map<String, SessionEntityWrapper<UserSessionEntity>> sessionsByIdForTransport = Stream.of(wrappedUserSessionEntity)
-                    .map(SessionEntityWrapper::forTransport)
-                    .collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
-
-            importSessionsWithExpiration(sessionsByIdForTransport, remoteCache,
-                    offline ? SessionTimeouts::getOfflineSessionLifespanMs : SessionTimeouts::getUserSessionLifespanMs,
-                    offline ? SessionTimeouts::getOfflineSessionMaxIdleMs : SessionTimeouts::getUserSessionMaxIdleMs);
-        }
-
         // Import client sessions
-        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessCache =
-                CacheDecorators.skipCacheLoadersIfRemoteStoreIsEnabled(offline ? offlineClientSessionCache : clientSessionCache);
+        Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessCache = getClientSessionCache(offline);
 
         importSessionsWithExpiration(clientSessionsById, clientSessCache,
                 offline ? SessionTimeouts::getOfflineClientSessionLifespanMs : SessionTimeouts::getClientSessionLifespanMs,
                 offline ? SessionTimeouts::getOfflineClientSessionMaxIdleMs : SessionTimeouts::getClientSessionMaxIdleMs);
 
-        // put all entities to the remoteCache (if exists)
-        RemoteCache remoteCacheClientSessions = InfinispanUtil.getRemoteCache(clientSessCache);
-        if (remoteCacheClientSessions != null) {
-            Map<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> sessionsByIdForTransport = clientSessionsById.values().stream()
-                    .map(SessionEntityWrapper::forTransport)
-                    .collect(Collectors.toMap(sessionEntityWrapper -> sessionEntityWrapper.getEntity().getId(), Function.identity()));
-
-            importSessionsWithExpiration(sessionsByIdForTransport, remoteCacheClientSessions,
-                    offline ? SessionTimeouts::getOfflineClientSessionLifespanMs : SessionTimeouts::getClientSessionLifespanMs,
-                    offline ? SessionTimeouts::getOfflineClientSessionMaxIdleMs : SessionTimeouts::getClientSessionMaxIdleMs);
-        }
-
         return sessionsById.entrySet().stream().findFirst().map(Map.Entry::getValue).orElse(null);
     }
 
-    private <T extends SessionEntity, K> Map<K, SessionEntityWrapper<T>> importSessionsWithExpiration(Map<K, SessionEntityWrapper<T>> sessionsById,
+    public <T extends SessionEntity, K> Map<K, SessionEntityWrapper<T>> importSessionsWithExpiration(Map<K, SessionEntityWrapper<T>> sessionsById,
                                                                               BasicCache<K, SessionEntityWrapper<T>> cache, SessionFunction<T> lifespanMsCalculator,
                                                                               SessionFunction<T> maxIdleTimeMsCalculator) {
         return sessionsById.entrySet().stream().map(entry -> {
@@ -898,7 +821,7 @@ private AuthenticatedClientSessionAdapter importOfflineClientSession(UserSession
         SessionUpdateTask<UserSessionEntity> registerClientSessionTask = new ClientSessionPersistentChangelogBasedTransaction.RegisterClientSessionTask(clientSession.getClient().getId(), clientSessionId, true);
         sessionTx.addTask(sessionToImportInto.getId(), registerClientSessionTask);
 
-        return new AuthenticatedClientSessionAdapter(session, this, entity, clientSession.getClient(), sessionToImportInto, clientSessionTx, true);
+        return new AuthenticatedClientSessionAdapter(session, entity, clientSession.getClient(), sessionToImportInto, clientSessionTx, true);
     }
 
 
@@ -935,8 +858,12 @@ public SessionEntityWrapper<UserSessionEntity> wrapPersistentEntity(RealmModel r
                     userSessionEntity.getRealmId(), clientUUID, offline);
             clientSession.setUserSessionId(userSessionEntity.getId());
 
-            // Update timestamp to same value as userSession. LastSessionRefresh of userSession from DB will have correct value
-            // clientSession.setTimestamp(userSessionEntity.getLastSessionRefresh());
+            if (offline) {
+                // Update timestamp to the same value as userSession. LastSessionRefresh of userSession from DB will have a correct value.
+                // This is an optimization with the old code before persistent user sessions existed, and is probably valid as an offline user session is supposed to have only one client session.
+                // Remove this code once this once the persistent sessions is the only way to handle sessions, and the old client sessions have been migrated to have an updated timestamp.
+                clientSession.setTimestamp(userSessionEntity.getLastSessionRefresh());
+            }
 
             ClientModel client = session.clients().getClientById(realm, clientSession.getClientId());
             if (isClientSessionExpired(realm, client, clientSession, offline)) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/SessionRefreshStore.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/SessionRefreshStore.java
index 0b15f6eaea81..795d114ad668 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/SessionRefreshStore.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/SessionRefreshStore.java
@@ -17,13 +17,8 @@
 
 package org.keycloak.models.sessions.infinispan;
 
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStore;
 import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStore;
 
 public interface SessionRefreshStore {
-    CrossDCLastSessionRefreshStore getLastSessionRefreshStore();
-
-    CrossDCLastSessionRefreshStore getOfflineLastSessionRefreshStore();
-
     PersisterLastSessionRefreshStore getPersisterLastSessionRefreshStore();
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
index 9b6635366f5c..763f6524bfdf 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.models.sessions.infinispan;
 
+import org.jboss.logging.Logger;
 import org.keycloak.common.util.MultiSiteUtils;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
@@ -26,11 +27,8 @@
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.UserSessionProvider;
 import org.keycloak.models.sessions.infinispan.changes.SessionsChangelogBasedTransaction;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshChecker;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
 import org.keycloak.models.sessions.infinispan.changes.Tasks;
 import org.keycloak.models.sessions.infinispan.changes.UserSessionUpdateTask;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshListener;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionStore;
 import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
@@ -50,6 +48,8 @@
  */
 public class UserSessionAdapter<T extends SessionRefreshStore & UserSessionProvider> implements UserSessionModel {
 
+    private static final Logger logger = Logger.getLogger(UserSessionAdapter.class);
+
     private final KeycloakSession session;
 
     private final T provider;
@@ -97,8 +97,13 @@ public Map<String, AuthenticatedClientSessionModel> getAuthenticatedClientSessio
                     final AuthenticatedClientSessionModel clientSession = provider.getClientSession(this, client, value.toString(), offline);
                     if (clientSession != null) {
                         result.put(key, clientSession);
+                    } else {
+                        // Either the client session has expired, or it hasn't been added by a concurrently running login yet.
+                        // So it is unsafe to clear it, so we need to keep it for now. Otherwise, the test ConcurrentLoginTest.concurrentLoginSingleUser will fail.
+                        // removedClientUUIDS.add(key);
                     }
                 } else {
+                    // client does no longer exist
                     removedClientUUIDS.add(key);
                 }
             });
@@ -115,51 +120,52 @@ public AuthenticatedClientSessionModel getAuthenticatedClientSessionByClient(Str
         final UUID clientSessionId = clientSessionEntities.get(clientUUID);
 
         if (clientSessionId == null) {
+            logger.debugf("Client to client session mapping not found. userSessionId=%s, clientId=%s, offline=%s, mappings=%s",
+                    getId(), clientUUID, offline, clientSessionEntities);
             return null;
         }
 
         ClientModel client = realm.getClientById(clientUUID);
 
         if (client != null) {
-            return provider.getClientSession(this, client, clientSessionId, offline);
+            // Might return null either the client session has expired, or it hasn't been added by a concurrently running login yet.
+            // So it is unsafe to clear it, so we need to keep it for now. Otherwise, the test ConcurrentLoginTest.concurrentLoginSingleUser will fail.
+            return provider.getClientSession(this, client, clientSessionId.toString(), offline);
         }
 
+        logger.debugf("Client not found. Removing from mappings. userSessionId=%s, clientId=%s, clientSessionId=%s, offline=%s",
+                getId(), clientUUID, clientSessionId, offline);
         removeAuthenticatedClientSessions(Collections.singleton(clientUUID));
         return null;
     }
 
-    private static final int MINIMUM_INACTIVE_CLIENT_SESSIONS_TO_CLEANUP = 5;
-
     @Override
     public void removeAuthenticatedClientSessions(Collection<String> removedClientUUIDS) {
         if (removedClientUUIDS == null || removedClientUUIDS.isEmpty()) {
             return;
         }
-
-        // Performance: do not remove the clientUUIDs from the user session until there is enough of them;
-        // an invalid session is handled as nonexistent in UserSessionAdapter.getAuthenticatedClientSessions()
-        if (removedClientUUIDS.size() >= MINIMUM_INACTIVE_CLIENT_SESSIONS_TO_CLEANUP) {
-            // Update user session
-            UserSessionUpdateTask task = new UserSessionUpdateTask() {
-                @Override
-                public void runUpdate(UserSessionEntity entity) {
-                    removedClientUUIDS.forEach(entity.getAuthenticatedClientSessions()::remove);
-                }
-
-                @Override
-                public boolean isOffline() {
-                    return offline;
-                }
-            };
-            update(task);
-        }
+        logger.debugf("Removing client sessions. clients=%s, offline=%s", removedClientUUIDS, offline);
 
         // do not iterate the removedClientUUIDS and remove the clientSession directly as the addTask can manipulate
         // the collection being iterated, and that can lead to unpredictable behaviour (e.g. NPE)
         List<UUID> clientSessionUuids = removedClientUUIDS.stream()
                 .map(entity.getAuthenticatedClientSessions()::get)
                 .filter(Objects::nonNull)
-                .collect(Collectors.toList());
+                .toList();
+
+        // Update user session
+        UserSessionUpdateTask task = new UserSessionUpdateTask() {
+            @Override
+            public void runUpdate(UserSessionEntity entity) {
+                removedClientUUIDS.forEach(entity.getAuthenticatedClientSessions()::remove);
+            }
+
+            @Override
+            public boolean isOffline() {
+                return offline;
+            }
+        };
+        update(task);
 
         clientSessionUuids.forEach(clientSessionId -> this.clientSessionUpdateTx.addTask(clientSessionId, Tasks.removeSync(offline)));
     }
@@ -234,10 +240,7 @@ public void setLastSessionRefresh(int lastSessionRefresh) {
         if (!MultiSiteUtils.isPersistentSessionsEnabled() && offline) {
             // Received the message from the other DC that we should update the lastSessionRefresh in local cluster. Don't update DB in that case.
             // The other DC already did.
-            Boolean ignoreRemoteCacheUpdate = (Boolean) session.getAttribute(CrossDCLastSessionRefreshListener.IGNORE_REMOTE_CACHE_UPDATE);
-            if (ignoreRemoteCacheUpdate == null || !ignoreRemoteCacheUpdate) {
-                provider.getPersisterLastSessionRefreshStore().putLastSessionRefresh(session, entity.getId(), realm.getId(), lastSessionRefresh);
-            }
+            provider.getPersisterLastSessionRefreshStore().putLastSessionRefresh(session, entity.getId(), realm.getId(), lastSessionRefresh);
         }
 
         UserSessionUpdateTask task = new UserSessionUpdateTask() {
@@ -250,12 +253,6 @@ public void runUpdate(UserSessionEntity entity) {
                 entity.setLastSessionRefresh(lastSessionRefresh);
             }
 
-            @Override
-            public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<UserSessionEntity> sessionWrapper) {
-                return new CrossDCLastSessionRefreshChecker(provider.getLastSessionRefreshStore(), provider.getOfflineLastSessionRefreshStore())
-                        .shouldSaveUserSessionToRemoteCache(UserSessionAdapter.this.session, UserSessionAdapter.this.realm, sessionWrapper, offline, lastSessionRefresh);
-            }
-
             @Override
             public boolean isOffline() {
                 return offline;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionPersistentChangelogBasedTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionPersistentChangelogBasedTransaction.java
index dd93f7c289fc..97040159384b 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionPersistentChangelogBasedTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionPersistentChangelogBasedTransaction.java
@@ -24,6 +24,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.UserSessionProvider;
 import org.keycloak.models.session.UserSessionPersisterProvider;
 import org.keycloak.models.sessions.infinispan.PersistentUserSessionProvider;
 import org.keycloak.models.sessions.infinispan.SessionFunction;
@@ -31,9 +32,8 @@
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionStore;
 import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
 
+import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.ArrayBlockingQueue;
 import java.util.concurrent.ConcurrentHashMap;
@@ -48,7 +48,6 @@ public class ClientSessionPersistentChangelogBasedTransaction extends Persistent
     public ClientSessionPersistentChangelogBasedTransaction(KeycloakSession session,
                                                             Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> cache,
                                                             Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> offlineCache,
-                                                            RemoteCacheInvoker remoteCacheInvoker,
                                                             SessionFunction<AuthenticatedClientSessionEntity> lifespanMsLoader,
                                                             SessionFunction<AuthenticatedClientSessionEntity> maxIdleTimeMsLoader,
                                                             SessionFunction<AuthenticatedClientSessionEntity> offlineLifespanMsLoader,
@@ -57,7 +56,7 @@ public ClientSessionPersistentChangelogBasedTransaction(KeycloakSession session,
                                                             ArrayBlockingQueue<PersistentUpdate> batchingQueue,
                                                             SerializeExecutionsByKey<UUID> serializerOnline,
                                                             SerializeExecutionsByKey<UUID> serializerOffline) {
-        super(session, CLIENT_SESSION_CACHE_NAME, cache, offlineCache, remoteCacheInvoker, lifespanMsLoader, maxIdleTimeMsLoader, offlineLifespanMsLoader, offlineMaxIdleTimeMsLoader, batchingQueue, serializerOnline, serializerOffline);
+        super(session, CLIENT_SESSION_CACHE_NAME, cache, offlineCache, lifespanMsLoader, maxIdleTimeMsLoader, offlineLifespanMsLoader, offlineMaxIdleTimeMsLoader, batchingQueue, serializerOnline, serializerOffline);
         this.userSessionTx = userSessionTx;
     }
 
@@ -71,14 +70,17 @@ public SessionEntityWrapper<AuthenticatedClientSessionEntity> get(RealmModel rea
             }
 
             if (wrappedEntity == null) {
-                LOG.debugf("client-session not found in cache for sessionId=%s, offline=%s, loading from persister", key, offline);
-                wrappedEntity = getSessionEntityFromPersister(realm, client, userSession, offline);
+                LOG.tracef("Client-session not found in cache, loading from persister. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                        userSession.getId(), key, client.getId(), offline);
+                wrappedEntity = getSessionEntityFromPersister(realm, client, userSession, key, offline);
             } else {
-                LOG.debugf("client-session found in cache for sessionId=%s, offline=%s", key, offline);
+                LOG.tracef("Client-session found in cache. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                        userSession.getId(), key, client.getId(), offline);
             }
 
             if (wrappedEntity == null) {
-                LOG.debugf("client-session not found in persister for sessionId=%s, offline=%s", key, offline);
+                LOG.debugf("Client-session not found in persister. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                        userSession.getId(), key, client.getId(), offline);
                 return null;
             }
 
@@ -98,27 +100,33 @@ public SessionEntityWrapper<AuthenticatedClientSessionEntity> get(RealmModel rea
         } else {
 
             // If entity is scheduled for remove, we don't return it.
-            boolean scheduledForRemove = myUpdates.getUpdateTasks().stream().filter((SessionUpdateTask task) -> {
+            boolean scheduledForRemove = myUpdates.getUpdateTasks().stream()
+                    .map(SessionUpdateTask::getOperation)
+                    .anyMatch(SessionUpdateTask.CacheOperation.REMOVE::equals);
 
-                return task.getOperation() == SessionUpdateTask.CacheOperation.REMOVE;
-
-            }).findFirst().isPresent();
+            if (scheduledForRemove) {
+                LOG.debugf("Client-session scheduled for removal in transaction. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                        userSession.getId(), key, client.getId(), offline);
+            }
 
             return scheduledForRemove ? null : myUpdates.getEntityWrapper();
         }
     }
 
-    private SessionEntityWrapper<AuthenticatedClientSessionEntity> getSessionEntityFromPersister(RealmModel realm, ClientModel client, UserSessionModel userSession, boolean offline) {
+    private SessionEntityWrapper<AuthenticatedClientSessionEntity> getSessionEntityFromPersister(RealmModel realm, ClientModel client, UserSessionModel userSession, UUID clientSessionId, boolean offline) {
         UserSessionPersisterProvider persister = kcSession.getProvider(UserSessionPersisterProvider.class);
         AuthenticatedClientSessionModel clientSession = persister.loadClientSession(realm, client, userSession, offline);
 
         if (clientSession == null) {
+            LOG.debugf("Client-session not loaded from persister. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                    userSession.getId(), clientSessionId, client.getId(), offline);
             return null;
         }
 
-        SessionEntityWrapper<AuthenticatedClientSessionEntity> authenticatedClientSessionEntitySessionEntityWrapper = importClientSession(realm, client, userSession, clientSession);
+        SessionEntityWrapper<AuthenticatedClientSessionEntity> authenticatedClientSessionEntitySessionEntityWrapper = importClientSession(realm, client, userSession, clientSession, clientSessionId);
         if (authenticatedClientSessionEntitySessionEntityWrapper == null) {
-            LOG.debugf("client-session not imported from persister for sessionId=%s, offline=%s, removing from persister.", clientSession.getId(), offline);
+            LOG.debugf("Client-session not imported from persister. It is going to be removed. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                    userSession.getId(), clientSessionId, client.getId(), offline);
             persister.removeClientSession(userSession.getId(), client.getId(), offline);
         }
 
@@ -144,38 +152,45 @@ private AuthenticatedClientSessionEntity createAuthenticatedClientSessionInstanc
         return entity;
     }
 
-    private SessionEntityWrapper<AuthenticatedClientSessionEntity> importClientSession(RealmModel realm, ClientModel client, UserSessionModel userSession, AuthenticatedClientSessionModel persistentClientSession) {
+    private SessionEntityWrapper<AuthenticatedClientSessionEntity> importClientSession(RealmModel realm, ClientModel client, UserSessionModel userSession, AuthenticatedClientSessionModel persistentClientSession, UUID clientSessionId) {
         AuthenticatedClientSessionEntity entity = createAuthenticatedClientSessionInstance(userSession.getId(), persistentClientSession,
                 realm.getId(), client.getId());
         boolean offline = userSession.isOffline();
 
         entity.setUserSessionId(userSession.getId());
 
-        // Update timestamp to same value as userSession. LastSessionRefresh of userSession from DB will have correct value
-        entity.setTimestamp(userSession.getLastSessionRefresh());
+        if (offline) {
+            // Update timestamp to the same value as userSession. LastSessionRefresh of userSession from DB will have a correct value.
+            // This is an optimization with the old code before persistent user sessions existed, and is probably valid as an offline user session is supposed to have only one client session.
+            // Remove this code once this once the persistent sessions is the only way to handle sessions, and the old client sessions have been migrated to have an updated timestamp.
+            entity.setTimestamp(userSession.getLastSessionRefresh());
+        }
+
+        SessionEntityWrapper<AuthenticatedClientSessionEntity> wrapper = new SessionEntityWrapper<>(entity);
+        Map<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> imported = ((PersistentUserSessionProvider) kcSession.getProvider(UserSessionProvider.class)).importSessionsWithExpiration(Map.of(clientSessionId, wrapper), getCache(offline),
+                getLifespanMsLoader(offline),
+                getMaxIdleMsLoader(offline));
 
-        if (getMaxIdleMsLoader(offline).apply(realm, client, entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG
-                || getLifespanMsLoader(offline).apply(realm, client, entity) == SessionTimeouts.ENTRY_EXPIRED_FLAG) {
+        if (imported.isEmpty()) {
+            LOG.debugf("Client-session has expired, not importing it. userSessionId=%s, clientSessionId=%s, clientId=%s, offline=%s",
+                    userSession.getId(), clientSessionId, client.getId(), offline);
             return null;
         }
 
-        final UUID clientSessionId = entity.getId();
-
         SessionUpdateTask<AuthenticatedClientSessionEntity> createClientSessionTask = Tasks.addIfAbsentSync();
         this.addTask(entity.getId(), createClientSessionTask, entity, UserSessionModel.SessionPersistenceState.PERSISTENT);
 
-        if (! (userSession instanceof UserSessionAdapter)) {
+        if (! (userSession instanceof UserSessionAdapter<?> sessionToImportInto)) {
             throw new IllegalStateException("UserSessionModel must be instance of UserSessionAdapter");
         }
 
-        UserSessionAdapter sessionToImportInto = (UserSessionAdapter) userSession;
         AuthenticatedClientSessionStore clientSessions = sessionToImportInto.getEntity().getAuthenticatedClientSessions();
         clientSessions.put(client.getId(), clientSessionId);
 
-        SessionUpdateTask registerClientSessionTask = new RegisterClientSessionTask(client.getId(), clientSessionId, offline);
+        SessionUpdateTask<UserSessionEntity> registerClientSessionTask = new RegisterClientSessionTask(client.getId(), clientSessionId, offline);
         userSessionTx.addTask(sessionToImportInto.getId(), registerClientSessionTask);
 
-        return new SessionEntityWrapper<>(entity);
+        return wrapper;
     }
 
     public static class RegisterClientSessionTask implements PersistentSessionUpdateTask<UserSessionEntity> {
@@ -201,11 +216,6 @@ public CacheOperation getOperation() {
             return CacheOperation.REPLACE;
         }
 
-        @Override
-        public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<UserSessionEntity> sessionWrapper) {
-            return CrossDCMessageStatus.SYNC;
-        }
-
         @Override
         public boolean isOffline() {
             return offline;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionUpdateTask.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionUpdateTask.java
index 231206b4e916..91c093c47456 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionUpdateTask.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/ClientSessionUpdateTask.java
@@ -29,9 +29,4 @@ public CacheOperation getOperation() {
         return CacheOperation.REPLACE;
     }
 
-    @Override
-    public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<AuthenticatedClientSessionEntity> sessionWrapper) {
-        return CrossDCMessageStatus.SYNC;
-    }
-
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/EmbeddedCachesChangesPerformer.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/EmbeddedCachesChangesPerformer.java
index 46065d91cb58..82eb4bd796dc 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/EmbeddedCachesChangesPerformer.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/EmbeddedCachesChangesPerformer.java
@@ -18,7 +18,6 @@
 package org.keycloak.models.sessions.infinispan.changes;
 
 import org.infinispan.Cache;
-import org.infinispan.context.Flag;
 import org.jboss.logging.Logger;
 import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.sessions.infinispan.CacheDecorators;
@@ -50,19 +49,16 @@ private void runOperationInCluster(K key, MergedUpdate<V> task,  SessionEntityWr
         switch (operation) {
             case REMOVE:
                 // Just remove it
-                CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache)
-                        .withFlags(Flag.IGNORE_RETURN_VALUES)
-                        .remove(key);
+                CacheDecorators.ignoreReturnValues(cache).remove(key);
                 break;
             case ADD:
-                CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache)
-                        .withFlags(Flag.IGNORE_RETURN_VALUES)
+                CacheDecorators.ignoreReturnValues(cache)
                         .put(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
 
                 LOG.tracef("Added entity '%s' to the cache '%s' . Lifespan: %d ms, MaxIdle: %d ms", key, cache.getName(), task.getLifespanMs(), task.getMaxIdleTimeMs());
                 break;
             case ADD_IF_ABSENT:
-                SessionEntityWrapper<V> existing = CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache).putIfAbsent(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
+                SessionEntityWrapper<V> existing = cache.putIfAbsent(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
                 if (existing != null) {
                     LOG.debugf("Existing entity in cache for key: %s . Will update it", key);
 
@@ -89,10 +85,9 @@ private void replace(K key, MergedUpdate<V> task, SessionEntityWrapper<V> oldVer
             SessionEntityWrapper<V> returnValue = null;
             int iteration = 0;
             V session = oldVersion.getEntity();
-            var writeCache = CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache);
             while (iteration++ < InfinispanUtil.MAXIMUM_REPLACE_RETRIES) {
                 SessionEntityWrapper<V> newVersionEntity = generateNewVersionAndWrapEntity(session, oldVersion.getLocalMetadata());
-                returnValue = writeCache.computeIfPresent(key, new ReplaceFunction<>(oldVersion.getVersion(), newVersionEntity), lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS);
+                returnValue = cache.computeIfPresent(key, new ReplaceFunction<>(oldVersion.getVersion(), newVersionEntity), lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS);
 
                 if (returnValue == null) {
                     LOG.debugf("Entity %s not found. Maybe removed in the meantime. Replace task will be ignored", key);
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/InfinispanChangelogBasedTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/InfinispanChangelogBasedTransaction.java
index 0addce6398a4..cd6bcdc7ae49 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/InfinispanChangelogBasedTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/InfinispanChangelogBasedTransaction.java
@@ -18,14 +18,15 @@
 package org.keycloak.models.sessions.infinispan.changes;
 
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
-import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
 
 import org.infinispan.Cache;
-import org.infinispan.context.Flag;
+import org.infinispan.commons.util.concurrent.CompletionStages;
 import org.jboss.logging.Logger;
-import org.keycloak.common.Profile;
+import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.AbstractKeycloakTransaction;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
@@ -33,13 +34,7 @@
 import org.keycloak.models.sessions.infinispan.CacheDecorators;
 import org.keycloak.models.sessions.infinispan.SessionFunction;
 import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-import org.keycloak.connections.infinispan.InfinispanUtil;
-
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
+import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -49,9 +44,7 @@ public class InfinispanChangelogBasedTransaction<K, V extends SessionEntity> ext
     public static final Logger logger = Logger.getLogger(InfinispanChangelogBasedTransaction.class);
 
     protected final KeycloakSession kcSession;
-    private final String cacheName;
     protected final Cache<K, SessionEntityWrapper<V>> cache;
-    private final RemoteCacheInvoker remoteCacheInvoker;
 
     protected final Map<K, SessionUpdatesList<V>> updates = new HashMap<>();
 
@@ -59,12 +52,10 @@ public class InfinispanChangelogBasedTransaction<K, V extends SessionEntity> ext
     protected final SessionFunction<V> maxIdleTimeMsLoader;
     private final SerializeExecutionsByKey<K> serializer;
 
-    public InfinispanChangelogBasedTransaction(KeycloakSession kcSession, Cache<K, SessionEntityWrapper<V>> cache, RemoteCacheInvoker remoteCacheInvoker,
+    public InfinispanChangelogBasedTransaction(KeycloakSession kcSession, Cache<K, SessionEntityWrapper<V>> cache,
                                                SessionFunction<V> lifespanMsLoader, SessionFunction<V> maxIdleTimeMsLoader, SerializeExecutionsByKey<K> serializer) {
         this.kcSession = kcSession;
-        this.cacheName = cache.getName();
         this.cache = cache;
-        this.remoteCacheInvoker = remoteCacheInvoker;
         this.lifespanMsLoader = lifespanMsLoader;
         this.maxIdleTimeMsLoader = maxIdleTimeMsLoader;
         this.serializer = serializer;
@@ -150,11 +141,9 @@ public SessionEntityWrapper<V> get(K key) {
             return wrappedEntity;
         } else {
             // If entity is scheduled for remove, we don't return it.
-            boolean scheduledForRemove = myUpdates.getUpdateTasks().stream().filter((SessionUpdateTask task) -> {
-
-                return task.getOperation() == SessionUpdateTask.CacheOperation.REMOVE;
-
-            }).findFirst().isPresent();
+            boolean scheduledForRemove = myUpdates.getUpdateTasks().stream()
+                    .map(SessionUpdateTask::getOperation)
+                    .anyMatch(SessionUpdateTask.CacheOperation.REMOVE::equals);
 
             return scheduledForRemove ? null : myUpdates.getEntityWrapper();
         }
@@ -165,13 +154,19 @@ protected void commitImpl() {
         for (Map.Entry<K, SessionUpdatesList<V>> entry : updates.entrySet()) {
             SessionUpdatesList<V> sessionUpdates = entry.getValue();
             SessionEntityWrapper<V> sessionWrapper = sessionUpdates.getEntityWrapper();
+            List<SessionUpdateTask<V>> updateTasks = sessionUpdates.getUpdateTasks();
+
+            if (updateTasks.isEmpty()) {
+                // no changes tracked, moving on.
+                continue;
+            }
 
             // Don't save transient entities to infinispan. They are valid just for current transaction
             if (sessionUpdates.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT) continue;
 
             // Don't save entities in infinispan that are both added and removed within the same transaction.
-            if (!sessionUpdates.getUpdateTasks().isEmpty() && sessionUpdates.getUpdateTasks().get(0).getOperation().equals(SessionUpdateTask.CacheOperation.ADD_IF_ABSENT)
-                    && sessionUpdates.getUpdateTasks().get(sessionUpdates.getUpdateTasks().size() - 1).getOperation().equals(SessionUpdateTask.CacheOperation.REMOVE)) {
+            if (updateTasks.get(0).getOperation().equals(SessionUpdateTask.CacheOperation.ADD_IF_ABSENT)
+                    && updateTasks.get(updateTasks.size() - 1).getOperation().equals(SessionUpdateTask.CacheOperation.REMOVE)) {
                 continue;
             }
 
@@ -180,14 +175,11 @@ protected void commitImpl() {
             long lifespanMs = lifespanMsLoader.apply(realm, sessionUpdates.getClient(), sessionWrapper.getEntity());
             long maxIdleTimeMs = maxIdleTimeMsLoader.apply(realm, sessionUpdates.getClient(), sessionWrapper.getEntity());
 
-            MergedUpdate<V> merged = MergedUpdate.computeUpdate(sessionUpdates.getUpdateTasks(), sessionWrapper, lifespanMs, maxIdleTimeMs);
+            MergedUpdate<V> merged = MergedUpdate.computeUpdate(updateTasks, sessionWrapper, lifespanMs, maxIdleTimeMs);
 
             if (merged != null) {
                 // Now run the operation in our cluster
                 runOperationInCluster(entry.getKey(), merged, sessionWrapper);
-
-                // Check if we need to send message to second DC
-                remoteCacheInvoker.runTask(kcSession, realm, cacheName, entry.getKey(), merged, sessionWrapper);
             }
         }
     }
@@ -202,19 +194,16 @@ private void runOperationInCluster(K key, MergedUpdate<V> task,  SessionEntityWr
         switch (operation) {
             case REMOVE:
                 // Just remove it
-                CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache)
-                        .withFlags(Flag.IGNORE_RETURN_VALUES)
-                        .remove(key);
+                CacheDecorators.ignoreReturnValues(cache).remove(key);
                 break;
             case ADD:
-                CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache)
-                        .withFlags(Flag.IGNORE_RETURN_VALUES)
+                CacheDecorators.ignoreReturnValues(cache)
                         .put(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
 
                 logger.tracef("Added entity '%s' to the cache '%s' . Lifespan: %d ms, MaxIdle: %d ms", key, cache.getName(), task.getLifespanMs(), task.getMaxIdleTimeMs());
                 break;
             case ADD_IF_ABSENT:
-                SessionEntityWrapper<V> existing = CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache).putIfAbsent(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
+                SessionEntityWrapper<V> existing = cache.putIfAbsent(key, sessionWrapper, task.getLifespanMs(), TimeUnit.MILLISECONDS, task.getMaxIdleTimeMs(), TimeUnit.MILLISECONDS);
                 if (existing != null) {
                     logger.debugf("Existing entity in cache for key: %s . Will update it", key);
 
@@ -241,17 +230,16 @@ private void replace(K key, MergedUpdate<V> task, SessionEntityWrapper<V> oldVer
             SessionEntityWrapper<V> returnValue = null;
             int iteration = 0;
             V session = oldVersion.getEntity();
-            var writeCache = CacheDecorators.skipCacheStoreIfRemoteCacheIsEnabled(cache);
             while (iteration++ < InfinispanUtil.MAXIMUM_REPLACE_RETRIES) {
 
                 if (session.shouldEvaluateRemoval() && task.shouldRemove(session)) {
                     logger.debugf("Entity %s removed after evaluation", key);
-                    writeCache.withFlags(Flag.IGNORE_RETURN_VALUES).remove(key);
+                    CacheDecorators.ignoreReturnValues(cache).remove(key);
                     return;
                 }
 
                 SessionEntityWrapper<V> newVersionEntity = generateNewVersionAndWrapEntity(session, oldVersion.getLocalMetadata());
-                returnValue = writeCache.computeIfPresent(key, new ReplaceFunction<>(oldVersion.getVersion(), newVersionEntity), lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS);
+                returnValue = cache.computeIfPresent(key, new ReplaceFunction<>(oldVersion.getVersion(), newVersionEntity), lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS);
 
                 if (returnValue == null) {
                     logger.debugf("Entity %s not found. Maybe removed in the meantime. Replace task will be ignored", key);
@@ -278,7 +266,93 @@ private void replace(K key, MergedUpdate<V> task, SessionEntityWrapper<V> oldVer
     protected void rollbackImpl() {
     }
 
-    private SessionEntityWrapper<V> generateNewVersionAndWrapEntity(V entity, Map<String, String> localMetadata) {
+    /**
+     * @return The {@link Cache} backing up this transaction.
+     */
+    public Cache<K, SessionEntityWrapper<V>> getCache() {
+        return cache;
+    }
+
+    /**
+     * Imports a session from an external source into the {@link Cache}.
+     * <p>
+     * If a session already exists in the cache, this method does not insert the {@code session}. The invoker should use
+     * the session returned by this method invocation. When the session is successfully imported, this method returns
+     * null and the {@code session} can be used by the transaction.
+     * <p>
+     * This transaction will keep track of further changes in the session.
+     *
+     * @param realmModel The {@link RealmModel} where the session belong to.
+     * @param key        The cache's key.
+     * @param session    The session to import.
+     * @param lifespan   How long the session stays cached until it is expired and removed.
+     * @param maxIdle    How long the session can be idle (without reading or writing) before being removed.
+     * @return The existing cached session. If it returns {@code null}, it means the {@code session} used in the
+     * parameters was cached.
+     */
+    public V importSession(RealmModel realmModel, K key, SessionEntityWrapper<V> session, long lifespan, long maxIdle) {
+        SessionUpdatesList<V> updatesList = updates.get(key);
+        if (updatesList != null) {
+            // exists in transaction, avoid cache operation
+            return updatesList.getEntityWrapper().getEntity();
+        }
+        SessionEntityWrapper<V> existing = cache.putIfAbsent(key, session, lifespan, TimeUnit.MILLISECONDS, maxIdle, TimeUnit.MILLISECONDS);
+        if (existing == null) {
+            // keep track of the imported session for updates
+            updates.put(key, new SessionUpdatesList<>(realmModel, session));
+            return null;
+        }
+        updates.put(key, new SessionUpdatesList<>(realmModel, existing));
+        return existing.getEntity();
+    }
+
+    /**
+     * Imports multiple sessions from an external source into the {@link Cache}.
+     * <p>
+     * If the {@code lifespanFunction} or {@code maxIdleFunction} returns {@link SessionTimeouts#ENTRY_EXPIRED_FLAG},
+     * the session is considered expired and not stored in the cache.
+     * <p>
+     * Also, if one or more sessions already exist in the {@link Cache}, it will not be imported.
+     * <p>
+     * This transaction will keep track of further changes in the sessions.
+     *
+     * @param realmModel       The {@link RealmModel} where the sessions belong to.
+     * @param sessions         The {@link Map} with the cache's key/session mapping to be imported.
+     * @param lifespanFunction The {@link java.util.function.Function} to compute the lifespan of the session. It
+     *                         defines how long the session should be stored in the cache until it is removed.
+     * @param maxIdleFunction  The {@link java.util.function.Function} to compute the max-idle of the session. It
+     *                         defines how long the session will be idle before it is removed.
+     */
+    public void importSessionsConcurrently(RealmModel realmModel, Map<K, SessionEntityWrapper<V>> sessions, SessionFunction<V> lifespanFunction, SessionFunction<V> maxIdleFunction) {
+        if (sessions.isEmpty()) {
+            //nothing to import
+            return;
+        }
+        var stage = CompletionStages.aggregateCompletionStage();
+        var allSessions = new ConcurrentHashMap<K, SessionEntityWrapper<V>>();
+        sessions.forEach((key, session) -> {
+            if (updates.containsKey(key)) {
+                //nothing to import, already exists in transaction
+                return;
+            }
+            var clientModel = session.getClientIfNeeded(realmModel);
+            var sessionEntity = session.getEntity();
+            var lifespan = lifespanFunction.apply(realmModel, clientModel, sessionEntity);
+            var maxIdle = maxIdleFunction.apply(realmModel, clientModel, sessionEntity);
+            if (lifespan == SessionTimeouts.ENTRY_EXPIRED_FLAG || maxIdle == SessionTimeouts.ENTRY_EXPIRED_FLAG) {
+                //nothing to import, already expired
+                return;
+            }
+            var future = cache.putIfAbsentAsync(key, session, lifespan, TimeUnit.MILLISECONDS, maxIdle, TimeUnit.MILLISECONDS);
+            // write result into concurrent hash map because the consumer is invoked in a different thread each time.
+            stage.dependsOn(future.thenAccept(existing -> allSessions.put(key, existing == null ? session : existing)));
+        });
+
+        CompletionStages.join(stage.freeze());
+        allSessions.forEach((key, wrapper) -> updates.put(key, new SessionUpdatesList<>(realmModel, wrapper)));
+    }
+
+    private static <V extends SessionEntity> SessionEntityWrapper<V> generateNewVersionAndWrapEntity(V entity, Map<String, String> localMetadata) {
         return new SessionEntityWrapper<>(localMetadata, entity);
     }
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/LoginFailuresUpdateTask.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/LoginFailuresUpdateTask.java
index 54994141a872..735483bb5f4f 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/LoginFailuresUpdateTask.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/LoginFailuresUpdateTask.java
@@ -29,8 +29,4 @@ public CacheOperation getOperation() {
         return CacheOperation.REPLACE;
     }
 
-    @Override
-    public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<LoginFailureEntity> sessionWrapper) {
-        return CrossDCMessageStatus.SYNC;
-    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/MergedUpdate.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/MergedUpdate.java
index 9496988f6d0c..90cfdb3c3745 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/MergedUpdate.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/MergedUpdate.java
@@ -33,13 +33,11 @@ public class MergedUpdate<S extends SessionEntity> implements SessionUpdateTask<
 
     private final List<SessionUpdateTask<S>> childUpdates = new LinkedList<>();
     private CacheOperation operation;
-    private CrossDCMessageStatus crossDCMessageStatus;
     private final long lifespanMs;
     private final long maxIdleTimeMs;
 
-    private MergedUpdate(CacheOperation operation, CrossDCMessageStatus crossDCMessageStatus, long lifespanMs, long maxIdleTimeMs) {
+    private MergedUpdate(CacheOperation operation, long lifespanMs, long maxIdleTimeMs) {
         this.operation = operation;
-        this.crossDCMessageStatus = crossDCMessageStatus;
         this.lifespanMs = lifespanMs;
         this.maxIdleTimeMs = maxIdleTimeMs;
     }
@@ -66,11 +64,6 @@ public CacheOperation getOperation() {
         return operation;
     }
 
-    @Override
-    public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<S> sessionWrapper) {
-        return crossDCMessageStatus;
-    }
-
     public long getLifespanMs() {
         return lifespanMs;
     }
@@ -96,25 +89,16 @@ public static <S extends SessionEntity> MergedUpdate<S> computeUpdate(List<Sessi
                     logger.tracef("Entry '%s' is expired. Will remove it from the cache", sessionWrapper);
                 }
 
-                result = new MergedUpdate<>(operation, child.getCrossDCMessageStatus(sessionWrapper), lifespanMs, maxIdleTimeMs);
+                result = new MergedUpdate<>(operation, lifespanMs, maxIdleTimeMs);
                 result.childUpdates.add(child);
             } else {
 
                 // Merge the operations.
                 result.operation = result.getOperation().merge(child.getOperation(), session);
 
-                // Check if we need to send message to other DCs and how critical it is
-                CrossDCMessageStatus currentDCStatus = result.getCrossDCMessageStatus(sessionWrapper);
-
-                // Optimization. If we already have SYNC, we don't need to retrieve childDCStatus
-                if (currentDCStatus != CrossDCMessageStatus.SYNC) {
-                    CrossDCMessageStatus childDCStatus = child.getCrossDCMessageStatus(sessionWrapper);
-                    result.crossDCMessageStatus = currentDCStatus.merge(childDCStatus);
-                }
-
                 // REMOVE is special case as other operations are not needed then.
                 if (result.operation == CacheOperation.REMOVE) {
-                    result = new MergedUpdate<>(result.operation, result.crossDCMessageStatus, lifespanMs, maxIdleTimeMs);
+                    result = new MergedUpdate<>(result.operation, lifespanMs, maxIdleTimeMs);
                     result.childUpdates.add(child);
                     return result;
                 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsChangelogBasedTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsChangelogBasedTransaction.java
index 6bbcc513c1a5..98ca95a3dfc3 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsChangelogBasedTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsChangelogBasedTransaction.java
@@ -25,7 +25,6 @@
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.sessions.infinispan.SessionFunction;
 import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
 import java.util.HashMap;
@@ -44,7 +43,6 @@ abstract public class PersistentSessionsChangelogBasedTransaction<K, V extends S
     private final String cacheName;
     private final Cache<K, SessionEntityWrapper<V>> cache;
     private final Cache<K, SessionEntityWrapper<V>> offlineCache;
-    private final RemoteCacheInvoker remoteCacheInvoker;
     private final SessionFunction<V> lifespanMsLoader;
     private final SessionFunction<V> maxIdleTimeMsLoader;
     private final SessionFunction<V> offlineLifespanMsLoader;
@@ -57,7 +55,6 @@ public PersistentSessionsChangelogBasedTransaction(KeycloakSession session,
                                                        String cacheName,
                                                        Cache<K, SessionEntityWrapper<V>> cache,
                                                        Cache<K, SessionEntityWrapper<V>> offlineCache,
-                                                       RemoteCacheInvoker remoteCacheInvoker,
                                                        SessionFunction<V> lifespanMsLoader,
                                                        SessionFunction<V> maxIdleTimeMsLoader,
                                                        SessionFunction<V> offlineLifespanMsLoader,
@@ -69,7 +66,6 @@ public PersistentSessionsChangelogBasedTransaction(KeycloakSession session,
         this.cacheName = cacheName;
         this.cache = cache;
         this.offlineCache = offlineCache;
-        this.remoteCacheInvoker = remoteCacheInvoker;
         this.lifespanMsLoader = lifespanMsLoader;
         this.maxIdleTimeMsLoader = maxIdleTimeMsLoader;
         this.offlineLifespanMsLoader = offlineLifespanMsLoader;
@@ -160,12 +156,6 @@ public boolean shouldConsumeChange(V entity) {
                     return !entity.isOffline();
                 }
             });
-            changesPerformers.add(new RemoteCachesChangesPerformer<>(kcSession, cache, remoteCacheInvoker) {
-                @Override
-                public boolean shouldConsumeChange(V entity) {
-                    return !entity.isOffline();
-                }
-            });
         }
 
         if (offlineCache != null) {
@@ -175,12 +165,6 @@ public boolean shouldConsumeChange(V entity) {
                     return entity.isOffline();
                 }
             });
-            changesPerformers.add(new RemoteCachesChangesPerformer<>(kcSession, offlineCache, remoteCacheInvoker) {
-                @Override
-                public boolean shouldConsumeChange(V entity) {
-                    return entity.isOffline();
-                }
-            });
         }
 
         return changesPerformers;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsWorker.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsWorker.java
index 233205251091..92ccd27a05d4 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsWorker.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/PersistentSessionsWorker.java
@@ -75,8 +75,14 @@ public void run() {
                 try {
                     process(queue);
                 } catch (InterruptedException e) {
-                    Thread.currentThread().interrupt();
-                    break;
+                    // The arjuna transaction reaper might interrupt this thread due to a long-running transaction.
+                    // But we will not terminate this thread as it will need to continue handling requests.
+                    if (!stop) {
+                        LOG.warn("Caught interrupted exception", e);
+                    }
+                } catch (RuntimeException e) {
+                    // We will need to continue
+                    LOG.warn("Exception when processing queue events", e);
                 }
             }
         }
@@ -165,6 +171,7 @@ public void stop() {
             try {
                 t.join(TimeUnit.MINUTES.toMillis(1));
             } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
                 throw new RuntimeException(e);
             }
         });
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RemoteCachesChangesPerformer.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RemoteCachesChangesPerformer.java
deleted file mode 100644
index d298815526c8..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RemoteCachesChangesPerformer.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes;
-
-import org.infinispan.Cache;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
-
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-
-public class RemoteCachesChangesPerformer<K, V extends SessionEntity> implements SessionChangesPerformer<K, V> {
-
-    private final KeycloakSession session;
-    private final Cache<K, SessionEntityWrapper<V>> cache;
-    private final RemoteCacheInvoker remoteCacheInvoker;
-    private final List<Runnable> changes = new LinkedList<>();
-
-
-    public RemoteCachesChangesPerformer(KeycloakSession session, Cache<K, SessionEntityWrapper<V>> cache, RemoteCacheInvoker remoteCacheInvoker) {
-        this.session = session;
-        this.cache = cache;
-        this.remoteCacheInvoker = remoteCacheInvoker;
-    }
-
-    @Override
-    public void registerChange(Map.Entry<K, SessionUpdatesList<V>> entry, MergedUpdate<V> merged) {
-        SessionUpdatesList<V> updates = entry.getValue();
-        changes.add(() -> remoteCacheInvoker.runTask(session, updates.getRealm(), cache.getName(), entry.getKey(), merged, updates.getEntityWrapper()));
-    }
-
-    @Override
-    public void applyChanges() {
-        changes.forEach(Runnable::run);
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RootAuthenticationSessionUpdateTask.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RootAuthenticationSessionUpdateTask.java
index 2ab878b533e6..b41217010547 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RootAuthenticationSessionUpdateTask.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/RootAuthenticationSessionUpdateTask.java
@@ -29,8 +29,4 @@ public CacheOperation getOperation() {
         return CacheOperation.REPLACE;
     }
 
-    @Override
-    public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<RootAuthenticationSessionEntity> sessionWrapper) {
-        return CrossDCMessageStatus.SYNC;
-    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/SessionUpdateTask.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/SessionUpdateTask.java
index cdc7f6fa5edb..fbc276a3e442 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/SessionUpdateTask.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/SessionUpdateTask.java
@@ -32,8 +32,6 @@ default boolean shouldRemove(S entity) {
 
     CacheOperation getOperation();
 
-    CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<S> sessionWrapper);
-
     enum CacheOperation {
 
         ADD,
@@ -58,27 +56,4 @@ CacheOperation merge(CacheOperation other, SessionEntity entity) {
             return REPLACE;
         }
     }
-
-
-    enum CrossDCMessageStatus {
-        SYNC,
-        //ASYNC,
-        // QUEUE,
-        NOT_NEEDED;
-
-
-        CrossDCMessageStatus merge(CrossDCMessageStatus other) {
-            if (this == SYNC || other == SYNC) {
-                return SYNC;
-            }
-
-            /*if (this == ASYNC || other == ASYNC) {
-                return ASYNC;
-            }*/
-
-            return NOT_NEEDED;
-        }
-
-    }
-
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/Tasks.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/Tasks.java
index 70dee7016c61..80958a674558 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/Tasks.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/Tasks.java
@@ -17,7 +17,6 @@
 package org.keycloak.models.sessions.infinispan.changes;
 
 import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask.CacheOperation;
-import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask.CrossDCMessageStatus;
 import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
 
 /**
@@ -36,10 +35,6 @@ public CacheOperation getOperation() {
             return CacheOperation.ADD_IF_ABSENT;
         }
 
-        @Override
-        public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<SessionEntity> sessionWrapper) {
-            return CrossDCMessageStatus.SYNC;
-        }
     };
 
     private static final SessionUpdateTask<? extends SessionEntity> REMOVE_SYNC = new PersistentSessionUpdateTask<SessionEntity>() {
@@ -52,11 +47,6 @@ public CacheOperation getOperation() {
             return CacheOperation.REMOVE;
         }
 
-        @Override
-        public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<SessionEntity> sessionWrapper) {
-            return CrossDCMessageStatus.SYNC;
-        }
-
         @Override
         public boolean isOffline() {
             return false;
@@ -73,11 +63,6 @@ public CacheOperation getOperation() {
             return CacheOperation.REMOVE;
         }
 
-        @Override
-        public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<SessionEntity> sessionWrapper) {
-            return CrossDCMessageStatus.SYNC;
-        }
-
         @Override
         public boolean isOffline() {
             return true;
@@ -85,8 +70,7 @@ public boolean isOffline() {
     };
 
     /**
-     * Returns a typed task of type {@link CacheOperation#ADD_IF_ABSENT} that does no other update. This operation has DC message
-     * status {@link CrossDCMessageStatus#SYNC}.
+     * Returns a typed task of type {@link CacheOperation#ADD_IF_ABSENT} that does no other update.
      * @param <S>
      * @return
      */
@@ -95,8 +79,7 @@ public static <S extends SessionEntity> SessionUpdateTask<S> addIfAbsentSync() {
     }
 
     /**
-     * Returns a typed task of type {@link CacheOperation#REMOVE} that does no other update. This operation has DC message
-     * status {@link CrossDCMessageStatus#SYNC}.
+     * Returns a typed task of type {@link CacheOperation#REMOVE} that does no other update.
      * @param <S>
      * @return
      */
@@ -105,8 +88,7 @@ public static <S extends SessionEntity> SessionUpdateTask<S> removeSync() {
     }
 
     /**
-     * Returns a typed task of type {@link CacheOperation#REMOVE} that does no other update. This operation has DC message
-     * status {@link CrossDCMessageStatus#SYNC}.
+     * Returns a typed task of type {@link CacheOperation#REMOVE} that does no other update.
      *
      * @param offline whether the operation should be performed on offline or non-offline session
      * @param <S>
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionPersistentChangelogBasedTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionPersistentChangelogBasedTransaction.java
index d1b2e50a849f..cae47c66b038 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionPersistentChangelogBasedTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionPersistentChangelogBasedTransaction.java
@@ -28,7 +28,6 @@
 import org.keycloak.models.sessions.infinispan.SessionFunction;
 import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
 import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheInvoker;
 
 import java.util.concurrent.ArrayBlockingQueue;
 
@@ -41,7 +40,6 @@ public class UserSessionPersistentChangelogBasedTransaction extends PersistentSe
     public UserSessionPersistentChangelogBasedTransaction(KeycloakSession session,
                                                           Cache<String, SessionEntityWrapper<UserSessionEntity>> cache,
                                                           Cache<String, SessionEntityWrapper<UserSessionEntity>> offlineCache,
-                                                          RemoteCacheInvoker remoteCacheInvoker,
                                                           SessionFunction<UserSessionEntity> lifespanMsLoader,
                                                           SessionFunction<UserSessionEntity> maxIdleTimeMsLoader,
                                                           SessionFunction<UserSessionEntity> offlineLifespanMsLoader,
@@ -49,7 +47,7 @@ public UserSessionPersistentChangelogBasedTransaction(KeycloakSession session,
                                                           ArrayBlockingQueue<PersistentUpdate> batchingQueue,
                                                           SerializeExecutionsByKey<String> serializerOnline,
                                                           SerializeExecutionsByKey<String> serializerOffline) {
-        super(session, USER_SESSION_CACHE_NAME, cache, offlineCache, remoteCacheInvoker, lifespanMsLoader, maxIdleTimeMsLoader, offlineLifespanMsLoader, offlineMaxIdleTimeMsLoader, batchingQueue, serializerOnline, serializerOffline);
+        super(session, USER_SESSION_CACHE_NAME, cache, offlineCache, lifespanMsLoader, maxIdleTimeMsLoader, offlineLifespanMsLoader, offlineMaxIdleTimeMsLoader, batchingQueue, serializerOnline, serializerOffline);
     }
 
     public SessionEntityWrapper<UserSessionEntity> get(RealmModel realm, String key, UserSessionModel userSession, boolean offline) {
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionUpdateTask.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionUpdateTask.java
index e17ce0cbead7..a05718c5571b 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionUpdateTask.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/UserSessionUpdateTask.java
@@ -29,8 +29,4 @@ public CacheOperation getOperation() {
         return CacheOperation.REPLACE;
     }
 
-    @Override
-    public CrossDCMessageStatus getCrossDCMessageStatus(SessionEntityWrapper<UserSessionEntity> sessionWrapper) {
-        return CrossDCMessageStatus.SYNC;
-    }
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshChecker.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshChecker.java
deleted file mode 100644
index 13adb792c53a..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshChecker.java
+++ /dev/null
@@ -1,134 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes.sessions;
-
-import java.util.UUID;
-
-import org.jboss.logging.Logger;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask;
-import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class CrossDCLastSessionRefreshChecker {
-
-    public static final Logger logger = Logger.getLogger(CrossDCLastSessionRefreshChecker.class);
-
-    private final CrossDCLastSessionRefreshStore store;
-    private final CrossDCLastSessionRefreshStore offlineStore;
-
-
-    public CrossDCLastSessionRefreshChecker(CrossDCLastSessionRefreshStore store, CrossDCLastSessionRefreshStore offlineStore) {
-        this.store = store;
-        this.offlineStore = offlineStore;
-    }
-
-
-    public SessionUpdateTask.CrossDCMessageStatus shouldSaveUserSessionToRemoteCache(
-            KeycloakSession kcSession, RealmModel realm, SessionEntityWrapper<UserSessionEntity> sessionWrapper, boolean offline, int newLastSessionRefresh) {
-
-        SessionUpdateTask.CrossDCMessageStatus baseChecks = baseChecks(kcSession, realm ,offline);
-        if (baseChecks != null) {
-            return baseChecks;
-        }
-
-        String userSessionId = sessionWrapper.getEntity().getId();
-
-        if (offline) {
-            Integer lsrr = sessionWrapper.getLocalMetadataNoteInt(UserSessionEntity.LAST_SESSION_REFRESH_REMOTE);
-            if (lsrr == null) {
-                lsrr = sessionWrapper.getEntity().getStarted();
-            }
-
-            if (lsrr + (realm.getOfflineSessionIdleTimeout() / 2) <= newLastSessionRefresh) {
-                logger.debugf("We are going to write remotely userSession %s. Remote last session refresh: %d, New last session refresh: %d",
-                        userSessionId, lsrr, newLastSessionRefresh);
-                return SessionUpdateTask.CrossDCMessageStatus.SYNC;
-            }
-        }
-
-        if (logger.isDebugEnabled()) {
-            logger.debugf("Skip writing last session refresh to the remoteCache. Session %s newLastSessionRefresh %d", userSessionId, newLastSessionRefresh);
-        }
-
-        CrossDCLastSessionRefreshStore storeToUse = offline ? offlineStore : store;
-        storeToUse.putLastSessionRefresh(kcSession, userSessionId, realm.getId(), newLastSessionRefresh);
-
-        return SessionUpdateTask.CrossDCMessageStatus.NOT_NEEDED;
-    }
-
-
-    public SessionUpdateTask.CrossDCMessageStatus shouldSaveClientSessionToRemoteCache(
-            KeycloakSession kcSession, RealmModel realm, SessionEntityWrapper<AuthenticatedClientSessionEntity> sessionWrapper, UserSessionModel userSession, boolean offline, int newTimestamp) {
-
-        SessionUpdateTask.CrossDCMessageStatus baseChecks = baseChecks(kcSession, realm ,offline);
-        if (baseChecks != null) {
-            return baseChecks;
-        }
-
-        UUID clientSessionId = sessionWrapper.getEntity().getId();
-
-        if (offline) {
-            Integer lsrr = sessionWrapper.getLocalMetadataNoteInt(AuthenticatedClientSessionEntity.LAST_TIMESTAMP_REMOTE);
-            if (lsrr == null) {
-                lsrr = userSession.getStarted();
-            }
-
-            if (lsrr + (realm.getOfflineSessionIdleTimeout() / 2) <= newTimestamp) {
-                    logger.debugf("We are going to write remotely for clientSession %s. Remote timestamp: %d, New timestamp: %d",
-                            clientSessionId, lsrr, newTimestamp);
-                return SessionUpdateTask.CrossDCMessageStatus.SYNC;
-            }
-        }
-
-        if (logger.isDebugEnabled()) {
-            logger.debugf("Skip writing timestamp to the remoteCache. ClientSession %s timestamp %d", clientSessionId, newTimestamp);
-        }
-
-        return SessionUpdateTask.CrossDCMessageStatus.NOT_NEEDED;
-    }
-
-
-    private SessionUpdateTask.CrossDCMessageStatus baseChecks(KeycloakSession kcSession, RealmModel realm, boolean offline) {
-        // revokeRefreshToken always writes everything to remoteCache immediately
-        if (realm.isRevokeRefreshToken()) {
-            return SessionUpdateTask.CrossDCMessageStatus.SYNC;
-        }
-
-        // We're likely not in cross-dc environment. Doesn't matter what we return
-        CrossDCLastSessionRefreshStore storeToUse = offline ? offlineStore : store;
-        if (storeToUse == null) {
-            return SessionUpdateTask.CrossDCMessageStatus.SYNC;
-        }
-
-        // Received the message from the other DC that we should update the lastSessionRefresh in local cluster
-        Boolean ignoreRemoteCacheUpdate = (Boolean) kcSession.getAttribute(CrossDCLastSessionRefreshListener.IGNORE_REMOTE_CACHE_UPDATE);
-        if (ignoreRemoteCacheUpdate != null && ignoreRemoteCacheUpdate) {
-            return SessionUpdateTask.CrossDCMessageStatus.NOT_NEEDED;
-        }
-
-        return null;
-    }
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshListener.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshListener.java
deleted file mode 100644
index e395ae660bff..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshListener.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes.sessions;
-
-import java.util.Map;
-
-import org.infinispan.Cache;
-import org.jboss.logging.Logger;
-import org.keycloak.cluster.ClusterEvent;
-import org.keycloak.cluster.ClusterListener;
-import org.keycloak.connections.infinispan.TopologyInfo;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-import org.keycloak.connections.infinispan.InfinispanUtil;
-import org.keycloak.models.utils.KeycloakModelUtils;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class CrossDCLastSessionRefreshListener implements ClusterListener {
-
-    public static final Logger logger = Logger.getLogger(CrossDCLastSessionRefreshListener.class);
-
-    public static final String IGNORE_REMOTE_CACHE_UPDATE = "IGNORE_REMOTE_CACHE_UPDATE";
-
-    private final boolean offline;
-
-    private final KeycloakSessionFactory sessionFactory;
-    private final Cache<String, SessionEntityWrapper<UserSessionEntity>> cache;
-    private final TopologyInfo topologyInfo;
-
-    public CrossDCLastSessionRefreshListener(KeycloakSession session, Cache<String, SessionEntityWrapper<UserSessionEntity>> cache, boolean offline) {
-        this.sessionFactory = session.getKeycloakSessionFactory();
-        this.cache = cache;
-        this.offline = offline;
-
-        this.topologyInfo = InfinispanUtil.getTopologyInfo(session);
-    }
-
-    @Override
-    public void eventReceived(ClusterEvent event) {
-        Map<String, SessionData> lastSessionRefreshes = ((LastSessionRefreshEvent) event).getLastSessionRefreshes();
-
-        if (logger.isDebugEnabled()) {
-            logger.debugf("Received refreshes. Offline %b, refreshes: %s", offline, lastSessionRefreshes);
-        }
-
-        lastSessionRefreshes.entrySet().stream().forEach((entry) -> {
-            String sessionId = entry.getKey();
-            String realmId = entry.getValue().realmId();
-            int lastSessionRefresh = entry.getValue().lastSessionRefresh();
-
-            // All nodes will receive the message. So ensure that each node updates just lastSessionRefreshes owned by him.
-            if (shouldUpdateLocalCache(sessionId)) {
-                KeycloakModelUtils.runJobInTransaction(sessionFactory, (kcSession) -> {
-
-                    RealmModel realm = kcSession.realms().getRealm(realmId);
-                    UserSessionModel userSession = offline ? kcSession.sessions().getOfflineUserSession(realm, sessionId) : kcSession.sessions().getUserSession(realm, sessionId);
-                    if (userSession == null) {
-                        logger.debugf("User session '%s' not available on node '%s' offline '%b'", sessionId, topologyInfo.getMyNodeName(), offline);
-                    } else {
-                        // Update just if lastSessionRefresh from event is bigger than ours
-                        if (lastSessionRefresh > userSession.getLastSessionRefresh()) {
-
-                            // Ensure that remoteCache won't be updated due to this
-                            kcSession.setAttribute(IGNORE_REMOTE_CACHE_UPDATE, true);
-
-                            userSession.setLastSessionRefresh(lastSessionRefresh);
-                        }
-                    }
-                });
-            }
-
-        });
-    }
-
-
-    // For distributed caches, ensure that local modification is executed just on owner
-    protected boolean shouldUpdateLocalCache(String key) {
-        return topologyInfo.amIOwner(cache, key);
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStore.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStore.java
deleted file mode 100644
index 81669d9217a1..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStore.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes.sessions;
-
-import java.util.Map;
-
-import org.jboss.logging.Logger;
-import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.models.KeycloakSession;
-
-/**
- * Cross-DC based CrossDCLastSessionRefreshStore
- *
- * Tracks the queue of lastSessionRefreshes, which were updated on this host. Those will be sent to the second DC in bulk, so second DC can update
- * lastSessionRefreshes on it's side. Message is sent either periodically or if there are lots of stored lastSessionRefreshes.
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class CrossDCLastSessionRefreshStore extends AbstractLastSessionRefreshStore {
-
-    protected static final Logger logger = Logger.getLogger(CrossDCLastSessionRefreshStore.class);
-
-    private final String eventKey;
-
-    protected CrossDCLastSessionRefreshStore(int maxIntervalBetweenMessagesSeconds, int maxCount, String eventKey) {
-        super(maxIntervalBetweenMessagesSeconds, maxCount);
-        this.eventKey = eventKey;
-    }
-
-
-    protected void sendMessage(KeycloakSession kcSession, Map<String, SessionData> refreshesToSend) {
-        LastSessionRefreshEvent event = new LastSessionRefreshEvent(refreshesToSend);
-
-        if (logger.isDebugEnabled()) {
-            logger.debugf("Sending lastSessionRefreshes for key '%s'. Refreshes: %s", eventKey, event.getLastSessionRefreshes().toString());
-        }
-
-        // Don't notify local DC about the lastSessionRefreshes. They were processed here already
-        ClusterProvider cluster = kcSession.getProvider(ClusterProvider.class);
-        cluster.notify(eventKey, event, true, ClusterProvider.DCNotify.ALL_BUT_LOCAL_DC);
-    }
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStoreFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStoreFactory.java
deleted file mode 100644
index b0d5702244dd..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/CrossDCLastSessionRefreshStoreFactory.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes.sessions;
-
-import org.infinispan.Cache;
-import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class CrossDCLastSessionRefreshStoreFactory extends AbstractLastSessionRefreshStoreFactory {
-
-    // Name of periodic tasks to send events to the other DCs
-    public static final String LSR_PERIODIC_TASK_NAME = "lastSessionRefreshes";
-    public static final String LSR_OFFLINE_PERIODIC_TASK_NAME = "lastSessionRefreshes-offline";
-
-
-    public CrossDCLastSessionRefreshStore createAndInit(KeycloakSession kcSession, Cache<String, SessionEntityWrapper<UserSessionEntity>> cache, boolean offline) {
-        return createAndInit(kcSession, cache, DEFAULT_TIMER_INTERVAL_MS, DEFAULT_MAX_INTERVAL_BETWEEN_MESSAGES_SECONDS, DEFAULT_MAX_COUNT, offline);
-    }
-
-
-    public CrossDCLastSessionRefreshStore createAndInit(KeycloakSession kcSession, Cache<String, SessionEntityWrapper<UserSessionEntity>> cache,
-                                                        long timerIntervalMs, int maxIntervalBetweenMessagesSeconds, int maxCount, boolean offline) {
-        String eventKey = offline ? LSR_OFFLINE_PERIODIC_TASK_NAME :  LSR_PERIODIC_TASK_NAME;
-        CrossDCLastSessionRefreshStore store = createStoreInstance(maxIntervalBetweenMessagesSeconds, maxCount, eventKey);
-
-        // Register listener
-        ClusterProvider cluster = kcSession.getProvider(ClusterProvider.class);
-        cluster.registerListener(eventKey, new CrossDCLastSessionRefreshListener(kcSession, cache, offline));
-
-        // Setup periodic timer check
-        setupPeriodicTimer(kcSession, store, timerIntervalMs, eventKey);
-
-        return store;
-    }
-
-
-    protected CrossDCLastSessionRefreshStore createStoreInstance(int maxIntervalBetweenMessagesSeconds, int maxCount, String eventKey) {
-        return new CrossDCLastSessionRefreshStore(maxIntervalBetweenMessagesSeconds, maxCount, eventKey);
-    }
-
-
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/LastSessionRefreshEvent.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/LastSessionRefreshEvent.java
deleted file mode 100644
index a917f1e7d674..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/LastSessionRefreshEvent.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.changes.sessions;
-
-import org.infinispan.protostream.annotations.ProtoFactory;
-import org.infinispan.protostream.annotations.ProtoField;
-import org.infinispan.protostream.annotations.ProtoTypeId;
-import org.keycloak.cluster.ClusterEvent;
-import org.keycloak.marshalling.Marshalling;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@ProtoTypeId(Marshalling.LAST_SESSION_REFRESH_EVENT)
-public class LastSessionRefreshEvent implements ClusterEvent {
-
-    private final Map<String, SessionData> lastSessionRefreshes;
-
-    @ProtoFactory
-    public LastSessionRefreshEvent(Map<String, SessionData> lastSessionRefreshes) {
-        this.lastSessionRefreshes = lastSessionRefreshes;
-    }
-
-    @ProtoField(value = 1, mapImplementation = HashMap.class)
-    public Map<String, SessionData> getLastSessionRefreshes() {
-        return lastSessionRefreshes;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        return o instanceof LastSessionRefreshEvent;
-    }
-
-    @Override
-    public int hashCode() {
-        return 1;
-    }
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/PersisterLastSessionRefreshStoreFactory.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/PersisterLastSessionRefreshStoreFactory.java
index 454d59e48fb4..748a0a498c91 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/PersisterLastSessionRefreshStoreFactory.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/changes/sessions/PersisterLastSessionRefreshStoreFactory.java
@@ -22,6 +22,7 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
+// TODO: mhajas Do not delete, is still used as an optimization for offline sessions update into the database with persistent_user_sessions disabled
 public class PersisterLastSessionRefreshStoreFactory extends AbstractLastSessionRefreshStoreFactory {
 
     // Name of periodic task to update DB with lastSessionRefreshes
@@ -32,7 +33,7 @@ public PersisterLastSessionRefreshStore createAndInit(KeycloakSession kcSession,
     }
 
 
-    private PersisterLastSessionRefreshStore createAndInit(KeycloakSession kcSession,
+    public PersisterLastSessionRefreshStore createAndInit(KeycloakSession kcSession,
                                                           long timerIntervalMs, int maxIntervalBetweenMessagesSeconds, int maxCount, boolean offline) {
         PersisterLastSessionRefreshStore store = createStoreInstance(maxIntervalBetweenMessagesSeconds, maxCount, offline);
 
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/SessionEntity.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/SessionEntity.java
index 6cac39055d97..d2704afb5bc3 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/SessionEntity.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/SessionEntity.java
@@ -23,10 +23,9 @@
 import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
 
 /**
- * Represents an entity containing data about a session, i.e. an object that is stored in infinispan cache and can be
- * potentially shared across DCs. Due to conflict management in {@code RemoteCacheInvoker} and
- * {@code InfinispanChangelogBasedTransaction} that use Infinispan's {@code replace()} method, overriding {@link #hashCode()}
- * and {@link #equals(java.lang.Object)} is <b>mandatory</b> in descendants.
+ * Represents an entity containing data about a session, i.e. an object that is stored in infinispan cache.
+ * Due to conflict management in {@code InfinispanChangelogBasedTransaction} that use Infinispan's {@code replace()}
+ * method, overriding {@link #hashCode()} and {@link #equals(java.lang.Object)} is <b>mandatory</b> in descendants.
  *
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/AbstractUserSessionClusterListener.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/AbstractUserSessionClusterListener.java
index 538bfa8392ca..b03fa52bc9c7 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/AbstractUserSessionClusterListener.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/AbstractUserSessionClusterListener.java
@@ -20,11 +20,8 @@
 import org.jboss.logging.Logger;
 import org.keycloak.cluster.ClusterEvent;
 import org.keycloak.cluster.ClusterListener;
-import org.keycloak.cluster.ClusterProvider;
-import org.keycloak.connections.infinispan.TopologyInfo;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.provider.Provider;
 
@@ -51,34 +48,13 @@ public void eventReceived(ClusterEvent event) {
             T provider = session.getProvider(providerClazz);
             SE sessionEvent = (SE) event;
 
-            boolean shouldResendEvent = shouldResendEvent(session, sessionEvent);
-
             if (log.isDebugEnabled()) {
-                log.debugf("Received user session event '%s'. Should resend event: %b", sessionEvent.toString(), shouldResendEvent);
+                log.debugf("Received user session event '%s'.", sessionEvent.toString());
             }
 
             eventReceived(provider, sessionEvent);
-
-            if (shouldResendEvent) {
-                session.getProvider(ClusterProvider.class).notify(sessionEvent.getEventKey(), event, true, ClusterProvider.DCNotify.ALL_BUT_LOCAL_DC);
-            }
-
         });
     }
 
     protected abstract void eventReceived(T provider, SE sessionEvent);
-
-
-    private boolean shouldResendEvent(KeycloakSession session, SessionClusterEvent event) {
-        if (!event.isResendingEvent()) {
-            return false;
-        }
-
-        // Just the initiator will re-send the event after receiving it
-        TopologyInfo topology = InfinispanUtil.getTopologyInfo(session);
-        String myNode = topology.getMyNodeName();
-        String mySite = topology.getMySiteName();
-        return (event.getNodeId() != null && event.getNodeId().equals(myNode) && event.getSiteId() != null && event.getSiteId().equals(mySite));
-    }
-
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionClusterEvent.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionClusterEvent.java
index 330634d6820a..b50d88df9481 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionClusterEvent.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionClusterEvent.java
@@ -20,6 +20,7 @@
 import java.util.Objects;
 
 import org.infinispan.protostream.annotations.ProtoField;
+import org.infinispan.protostream.annotations.ProtoReserved;
 import org.keycloak.cluster.ClusterEvent;
 import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.connections.infinispan.TopologyInfo;
@@ -28,19 +29,19 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
+@ProtoReserved(numbers = {3}, names = {"resendingEvent"})
 public abstract class SessionClusterEvent implements ClusterEvent {
 
     private String realmId;
     private String eventKey;
-    private boolean resendingEvent;
     private String siteId;
     private String nodeId;
 
 
-    public static <T extends SessionClusterEvent> T createEvent(Class<T> eventClass, String eventKey, KeycloakSession session, String realmId, boolean resendingEvent) {
+    public static <T extends SessionClusterEvent> T createEvent(Class<T> eventClass, String eventKey, KeycloakSession session, String realmId) {
         try {
             T event = eventClass.getDeclaredConstructor().newInstance();
-            event.setData(session, eventKey, realmId, resendingEvent);
+            event.setData(session, eventKey, realmId);
             return event;
         } catch (Exception e) {
             throw new RuntimeException(e);
@@ -48,10 +49,9 @@ public static <T extends SessionClusterEvent> T createEvent(Class<T> eventClass,
     }
 
 
-    void setData(KeycloakSession session, String eventKey, String realmId, boolean resendingEvent) {
+    void setData(KeycloakSession session, String eventKey, String realmId) {
         this.realmId = realmId;
         this.eventKey = eventKey;
-        this.resendingEvent = resendingEvent;
         TopologyInfo topology = InfinispanUtil.getTopologyInfo(session);
         this.siteId = topology.getMySiteName();
         this.nodeId = topology.getMyNodeName();
@@ -76,15 +76,6 @@ void setEventKey(String eventKey) {
         this.eventKey = eventKey;
     }
 
-    @ProtoField(3)
-    public boolean isResendingEvent() {
-        return resendingEvent;
-    }
-
-    void setResendingEvent(boolean resendingEvent) {
-        this.resendingEvent = resendingEvent;
-    }
-
     @ProtoField(4)
     public String getSiteId() {
         return siteId;
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionEventsSenderTransaction.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionEventsSenderTransaction.java
index e67d145b5cb1..702401b2293c 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionEventsSenderTransaction.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/events/SessionEventsSenderTransaction.java
@@ -36,22 +36,21 @@ public class SessionEventsSenderTransaction extends AbstractKeycloakTransaction
 
     private final KeycloakSession session;
 
-    private final Map<EventGroup, List<ClusterEvent>> sessionEvents = new HashMap<>();
+    private final Map<String, List<ClusterEvent>> sessionEvents = new HashMap<>();
 
     public SessionEventsSenderTransaction(KeycloakSession session) {
         this.session = session;
     }
 
-    public void addEvent(SessionClusterEvent event, ClusterProvider.DCNotify dcNotify) {
-        var group = new EventGroup(event.getEventKey(), dcNotify);
-        sessionEvents.computeIfAbsent(group, eventGroup -> new ArrayList<>()).add(event);
+    public void addEvent(SessionClusterEvent event) {
+        sessionEvents.computeIfAbsent(event.getEventKey(), eventGroup -> new ArrayList<>()).add(event);
     }
 
     @Override
     protected void commitImpl() {
         var cluster = session.getProvider(ClusterProvider.class);
         for (var entry : sessionEvents.entrySet()) {
-            cluster.notify(entry.getKey().eventKey(), entry.getValue(), false, entry.getKey().dcNotify());
+            cluster.notify(entry.getKey(), entry.getValue(), false);
         }
     }
 
@@ -61,5 +60,4 @@ protected void rollbackImpl() {
         sessionEvents.clear();
     }
 
-    private record EventGroup(String eventKey, ClusterProvider.DCNotify dcNotify) {}
 }
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/BaseCacheInitializer.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/BaseCacheInitializer.java
deleted file mode 100644
index 696324cd6011..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/BaseCacheInitializer.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.Cache;
-import org.infinispan.context.Flag;
-import org.infinispan.lifecycle.ComponentStatus;
-import org.jboss.logging.Logger;
-import org.keycloak.models.KeycloakSessionFactory;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public abstract class BaseCacheInitializer extends CacheInitializer {
-
-    private static final String STATE_KEY_PREFIX = "distributed::";
-
-    private static final Logger log = Logger.getLogger(BaseCacheInitializer.class);
-
-    protected final KeycloakSessionFactory sessionFactory;
-    protected final Cache<String, InitializerState> workCache;
-    protected final SessionLoader<SessionLoader.LoaderContext, SessionLoader.WorkerContext, SessionLoader.WorkerResult> sessionLoader;
-    protected final String stateKey;
-
-    public BaseCacheInitializer(KeycloakSessionFactory sessionFactory, Cache<String, InitializerState> workCache, SessionLoader<SessionLoader.LoaderContext, SessionLoader.WorkerContext, SessionLoader.WorkerResult> sessionLoader, String stateKeySuffix) {
-        this.sessionFactory = sessionFactory;
-        this.workCache = workCache;
-        this.sessionLoader = sessionLoader;
-        this.stateKey = STATE_KEY_PREFIX + stateKeySuffix;
-    }
-
-
-    @Override
-    protected boolean isFinished() {
-        InitializerState state = getStateFromCache();
-        return state != null && state.isFinished();
-    }
-
-
-    @Override
-    protected boolean isCoordinator() {
-        return workCache.getCacheManager().isCoordinator();
-    }
-
-    @Override
-    protected int getProgressIndicator() {
-        InitializerState state = getStateFromCache();
-        return state == null ? 0 : state.getProgressIndicator();
-    }
-
-    protected InitializerState getStateFromCache() {
-        // We ignore cacheStore for now, so that in Cross-DC scenario (with RemoteStore enabled) is the remoteStore ignored.
-        return workCache.getAdvancedCache()
-                .withFlags(Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD)
-                .get(stateKey);
-    }
-
-
-    protected void saveStateToCache(InitializerState state) {
-
-        // 3 attempts to send the message (it may fail if some node fails in the meantime)
-        retry(3, () -> {
-            // Save this synchronously to ensure all nodes read correct state
-            // We ignore cacheStore for now, so that in Cross-DC scenario (with RemoteStore enabled) is the remoteStore ignored.
-            BaseCacheInitializer.this.workCache.getAdvancedCache().
-                    withFlags(Flag.IGNORE_RETURN_VALUES, Flag.FORCE_SYNCHRONOUS, Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD)
-                    .put(stateKey, state);
-        });
-    }
-
-
-    private void retry(int retry, Runnable runnable) {
-        while (true) {
-            try {
-                runnable.run();
-                return;
-            } catch (RuntimeException e) {
-                ComponentStatus status = workCache.getStatus();
-                if (status.isStopping() || status.isTerminated()) {
-                    log.warn("Failed to put initializerState to the cache. Cache is already terminating");
-                    log.debug(e.getMessage(), e);
-                    return;
-                }
-                retry--;
-                if (retry == 0) {
-                    throw e;
-                }
-            }
-        }
-    }
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/CacheInitializer.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/CacheInitializer.java
deleted file mode 100644
index c41fe4a15606..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/CacheInitializer.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import java.time.Instant;
-import java.util.concurrent.TimeUnit;
-import org.jboss.logging.Logger;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public abstract class CacheInitializer {
-
-    private static final Logger log = Logger.getLogger(CacheInitializer.class);
-
-    public void loadSessions() {
-        Instant loadingMustContinueBy = Instant.now().plusSeconds(getStalledTimeoutInSeconds());
-        boolean loadingStalledInPreviousStep = false;
-        int lastProgressIndicator = 0;
-        while (!isFinished()) {
-            if (!isCoordinator()) {
-                try {
-                    TimeUnit.SECONDS.sleep(1);
-
-                    final int progressIndicator = getProgressIndicator();
-                    final boolean loadingStalled = lastProgressIndicator == progressIndicator;
-                    if (loadingStalled) {
-                        if (loadingStalledInPreviousStep) {
-                            if (Instant.now().isAfter(loadingMustContinueBy)) {
-                                throw new RuntimeException("Loading sessions has stalled for " + getStalledTimeoutInSeconds() + " seconds, possibly caused by split-brain");
-                            }
-
-                            log.tracef("Loading sessions stalled. Waiting until %s", loadingMustContinueBy);
-                        } else {
-                            loadingMustContinueBy = Instant.now().plusSeconds(getStalledTimeoutInSeconds());
-                            loadingStalledInPreviousStep = true;
-                        }
-                    } else {
-                        loadingStalledInPreviousStep = false;
-                    }
-
-                    lastProgressIndicator = progressIndicator;
-                } catch (InterruptedException ie) {
-                    log.error("Interrupted", ie);
-                    throw new RuntimeException("Loading sessions failed", ie);
-                }
-            } else {
-                startLoading();
-            }
-        }
-    }
-
-
-    protected abstract boolean isFinished();
-
-    protected abstract boolean isCoordinator();
-
-    /**
-     * Returns an integer which captures current progress. If there is a progress in loading,
-     * this indicator must be different most of the time so that it does not hit 30-seconds
-     * limit.
-     * @see #stalledTimeoutInSeconds
-     * @return
-     */
-    protected abstract int getProgressIndicator();
-
-    /**
-     * Just coordinator will run this
-     */
-    protected abstract void startLoading();
-
-    protected abstract int getStalledTimeoutInSeconds();
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InfinispanCacheInitializer.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InfinispanCacheInitializer.java
deleted file mode 100755
index 2a08148b86be..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InfinispanCacheInitializer.java
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.Cache;
-import org.jboss.logging.Logger;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.KeycloakSessionTask;
-import org.keycloak.models.utils.KeycloakModelUtils;
-
-import java.util.List;
-import java.util.Queue;
-import java.util.concurrent.ConcurrentLinkedQueue;
-
-/**
- * Startup initialization for reading persistent userSessions to be filled into infinispan/memory.
- *
- * Implementation is pretty generic and doesn't contain any "userSession" specific stuff. All logic related to how sessions are loaded is in the SessionLoader implementation
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class InfinispanCacheInitializer extends BaseCacheInitializer {
-
-    private static final Logger log = Logger.getLogger(InfinispanCacheInitializer.class);
-
-    private final int maxErrors;
-
-    // Effectively no timeout
-    private final int stalledTimeoutInSeconds;
-
-    public InfinispanCacheInitializer(KeycloakSessionFactory sessionFactory, Cache<String, InitializerState> workCache, SessionLoader sessionLoader, String stateKeySuffix, int maxErrors, int stalledTimeoutInSeconds) {
-        super(sessionFactory, workCache, sessionLoader, stateKeySuffix);
-        this.maxErrors = maxErrors;
-        this.stalledTimeoutInSeconds = stalledTimeoutInSeconds;
-    }
-
-
-    // Just coordinator will run this
-    @Override
-    protected void startLoading() {
-        InitializerState state = getStateFromCache();
-        SessionLoader.LoaderContext[] ctx = new SessionLoader.LoaderContext[1];
-        if (state == null) {
-            KeycloakModelUtils.runJobInTransaction(sessionFactory, new KeycloakSessionTask() {
-                @Override
-                public void run(KeycloakSession session) {
-                    ctx[0] = sessionLoader.computeLoaderContext();
-                }
-
-            });
-
-            state = new InitializerState(ctx[0].getSegmentsCount());
-        } else {
-            KeycloakModelUtils.runJobInTransaction(sessionFactory, new KeycloakSessionTask() {
-                @Override
-                public void run(KeycloakSession session) {
-                    ctx[0] = sessionLoader.computeLoaderContext();
-                }
-
-            });
-        }
-
-        log.debugf("Start loading with loader: '%s', ctx: '%s' , state: %s",
-                sessionLoader.toString(), ctx[0].toString(), state.toString());
-
-        startLoadingImpl(state, ctx[0]);
-    }
-
-    @Override
-    protected int getStalledTimeoutInSeconds() {
-        return this.stalledTimeoutInSeconds;
-    }
-
-    protected void startLoadingImpl(InitializerState state, SessionLoader.LoaderContext loaderCtx) {
-        final int errors = 0;
-        int segmentToLoad = 0;
-
-        int distributedWorkersCount = 1;
-
-        while (segmentToLoad < state.getSegmentsCount()) {
-
-            log.debugf("Starting next iteration with %d workers", distributedWorkersCount);
-
-            List<Integer> segments = state.getSegmentsToLoad(segmentToLoad, distributedWorkersCount);
-
-            if (log.isTraceEnabled()) {
-                log.trace("unfinished segments for this iteration: " + segments);
-            }
-
-            Queue<SessionLoader.WorkerResult> results = new ConcurrentLinkedQueue<>();
-
-            for (Integer segment : segments) {
-                SessionLoader.WorkerContext workerCtx = sessionLoader.computeWorkerContext(segment);
-
-                SessionInitializerWorker worker = new SessionInitializerWorker();
-                worker.setWorkerEnvironment(loaderCtx, workerCtx, sessionLoader);
-
-                results.add(worker.apply(sessionFactory));
-            }
-
-            boolean anyFailure = false;
-
-            // Check the results
-            for (SessionLoader.WorkerResult result : results) {
-                if (result.success()) {
-                    state.markSegmentFinished(result.segment());
-                    if (result.segment() == segmentToLoad + distributedWorkersCount - 1) {
-                        // last result for next iteration when complete
-                    }
-                } else {
-                    if (log.isTraceEnabled()) {
-                        log.tracef("Segment %d failed to compute", result.segment());
-                    }
-                    anyFailure = true;
-                }
-            }
-
-            if (errors >= maxErrors) {
-                throw new RuntimeException("Maximum count of worker errors occurred. Limit was " + maxErrors + ". See server.log for details");
-            }
-
-            if (!anyFailure) {
-                // everything is OK, prepare the new row
-                segmentToLoad += distributedWorkersCount;
-                if (log.isTraceEnabled()) {
-                    log.debugf("New initializer state is: %s", state);
-                }
-            }
-        }
-
-        // Push the state after computation is finished
-        saveStateToCache(state);
-
-        // Loader callback after the task is finished
-        this.sessionLoader.afterAllSessionsLoaded();
-
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InitializerState.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InitializerState.java
deleted file mode 100644
index 2658860b6906..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/InitializerState.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.protostream.annotations.ProtoFactory;
-import org.infinispan.protostream.annotations.ProtoField;
-import org.infinispan.protostream.annotations.ProtoTypeId;
-import org.jboss.logging.Logger;
-import org.keycloak.marshalling.Marshalling;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-
-import java.util.BitSet;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Objects;
-
-/**
- * Note that this state is <b>NOT</b> thread safe. Currently it is only used from single thread so it's fine
- * but further optimizations might need to revisit this (see {@link InfinispanCacheInitializer}).
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@ProtoTypeId(Marshalling.INITIALIZER_STATE)
-public class InitializerState extends SessionEntity {
-
-    private static final Logger log = Logger.getLogger(InitializerState.class);
-
-    private final int segmentsCount;
-    private final BitSet segments;
-
-    public InitializerState(int segmentsCount) {
-        this.segmentsCount = segmentsCount;
-        this.segments = new BitSet(segmentsCount);
-
-        log.debugf("segmentsCount: %d", segmentsCount);
-    }
-
-    @ProtoFactory
-    InitializerState(String realmId, int segmentsCount, BitSet segments) {
-        super(realmId);
-        this.segmentsCount = segmentsCount;
-        this.segments = segments;
-
-        log.debugf("segmentsCount: %d", segmentsCount);
-    }
-
-    /**
-     * Getter for the segments count.
-     * @return The number of segments of the state
-     */
-    @ProtoField(2)
-    public int getSegmentsCount() {
-        return segmentsCount;
-    }
-
-    @ProtoField(3)
-    BitSet getSegments() {
-        return segments;
-    }
-
-    /** Return true just if computation is entirely finished (all segments are true) */
-    public boolean isFinished() {
-        return segments.cardinality() == segmentsCount;
-    }
-
-    /** Return indication of progress - changes upon progress */
-    public int getProgressIndicator() {
-        return segments.hashCode();
-    }
-
-    /** Return next un-finished segments in the next row of segments.
-     * @param segmentToLoad The segment we are loading
-     * @param maxSegmentCount The max segment to load
-     * @return The list of segments to work on this step
-     */
-    public List<Integer> getSegmentsToLoad(int segmentToLoad, int maxSegmentCount) {
-        List<Integer> result = new LinkedList<>();
-        for (int i = segmentToLoad; i < (segmentToLoad + maxSegmentCount) && i < segmentsCount; i++) {
-            if (!segments.get(i)) {
-                result.add(i);
-            }
-        }
-        return result;
-    }
-
-    public void markSegmentFinished(int index) {
-        segments.set(index);
-    }
-
-    @Override
-    public String toString() {
-        int finished = segments.cardinality();
-        int nonFinished = segmentsCount - finished;
-
-        return "finished segments count: " + finished
-          + (", non-finished segments count: " + nonFinished);
-    }
-
-    @Override
-    public int hashCode() {
-        int hash = 3;
-        hash = 97 * hash + this.segmentsCount;
-        hash = 97 * hash + Objects.hashCode(this.segments);
-        return hash;
-    }
-
-    @Override
-    public boolean equals(Object obj) {
-        if (this == obj) {
-            return true;
-        }
-        if (obj == null) {
-            return false;
-        }
-        if (getClass() != obj.getClass()) {
-            return false;
-        }
-        InitializerState other = (InitializerState) obj;
-        return this.segmentsCount == other.segmentsCount && Objects.equals(this.segments, other.segments);
-    }
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/OfflinePersistentLoaderContext.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/OfflinePersistentLoaderContext.java
deleted file mode 100644
index 7a281285454f..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/OfflinePersistentLoaderContext.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class OfflinePersistentLoaderContext extends SessionLoader.LoaderContext {
-
-    private final int sessionsTotal;
-    private final int sessionsPerSegment;
-
-    public OfflinePersistentLoaderContext(int sessionsTotal, int sessionsPerSegment) {
-        super(computeSegmentsCount(sessionsTotal, sessionsPerSegment));
-        this.sessionsTotal = sessionsTotal;
-        this.sessionsPerSegment = sessionsPerSegment;
-    }
-
-
-    private static int computeSegmentsCount(int sessionsTotal, int sessionsPerSegment) {
-        int segmentsCount = sessionsTotal / sessionsPerSegment;
-        if (sessionsTotal % sessionsPerSegment >= 1) {
-            segmentsCount = segmentsCount + 1;
-        }
-        return segmentsCount;
-    }
-
-
-    @Override
-    public String toString() {
-        return new StringBuilder("OfflinePersistentLoaderContext [ ")
-                .append(" sessionsTotal: ").append(sessionsTotal)
-                .append(", sessionsPerSegment: ").append(sessionsPerSegment)
-                .append(", segmentsCount: ").append(getSegmentsCount())
-                .append(" ]")
-                .toString();
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionInitializerWorker.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionInitializerWorker.java
deleted file mode 100644
index 3a495b5ba12f..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionInitializerWorker.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.utils.KeycloakModelUtils;
-
-import java.util.function.Function;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class SessionInitializerWorker implements Function<KeycloakSessionFactory, SessionLoader.WorkerResult> {
-
-    private SessionLoader.LoaderContext loaderCtx;
-    private SessionLoader.WorkerContext workerCtx;
-    private SessionLoader<SessionLoader.LoaderContext, SessionLoader.WorkerContext, SessionLoader.WorkerResult> sessionLoader;
-
-    public void setWorkerEnvironment(SessionLoader.LoaderContext loaderCtx, SessionLoader.WorkerContext workerCtx, SessionLoader<SessionLoader.LoaderContext, SessionLoader.WorkerContext, SessionLoader.WorkerResult> sessionLoader) {
-        this.loaderCtx = loaderCtx;
-        this.workerCtx = workerCtx;
-        this.sessionLoader = sessionLoader;
-    }
-
-
-    @Override
-    public SessionLoader.WorkerResult apply(KeycloakSessionFactory sessionFactory) {
-        return KeycloakModelUtils.runJobInTransactionWithResult(sessionFactory, (session) -> sessionLoader.loadSessions(session, loaderCtx, workerCtx));
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionLoader.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionLoader.java
deleted file mode 100644
index cf6618161183..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/initializer/SessionLoader.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.keycloak.models.KeycloakSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface SessionLoader<LOADER_CONTEXT extends SessionLoader.LoaderContext,
-        WORKER_CONTEXT extends SessionLoader.WorkerContext,
-        WORKER_RESULT extends SessionLoader.WorkerResult> {
-
-
-    /**
-     *
-     * Will be triggered just once on cluster coordinator node to count the number of segments and other context data specific to whole computation.
-     * Each segment will be then later computed in one "worker" task
-     *
-     * This method could be expensive to call, so the "computed" loaderContext object is passed among workers/loaders and needs to be serializable
-     *
-     * @return
-     */
-    LOADER_CONTEXT computeLoaderContext();
-
-
-    /**
-     * Compute the worker context for current iteration
-     *
-     * @param segment the current segment (page) to compute
-     * @return
-     */
-    WORKER_CONTEXT computeWorkerContext(int segment);
-
-
-    /**
-     * Will be called on all cluster nodes to load the specified page.
-     *
-     * @param session
-     * @param loaderContext global loaderContext object, which was already computed before
-     * @param workerContext for current iteration
-     * @return
-     */
-    WORKER_RESULT loadSessions(KeycloakSession session, LOADER_CONTEXT loaderContext, WORKER_CONTEXT workerContext);
-
-
-    /**
-     * Callback triggered on cluster coordinator once it recognize that all sessions were successfully loaded
-     */
-    void afterAllSessionsLoaded();
-
-
-    /**
-     * Object, which contains some context data to be used by SessionLoader implementation. It's computed just once and then passed
-     * to each {@link SessionLoader}.
-     */
-    class LoaderContext {
-
-        private final int segmentsCount;
-
-        public LoaderContext(int segmentsCount) {
-            this.segmentsCount = segmentsCount;
-        }
-
-
-        public int getSegmentsCount() {
-            return segmentsCount;
-        }
-
-    }
-
-
-    /**
-     * Object, which is computed before each worker iteration and contains some data to be used by the corresponding worker iteration.
-     * For example info about which segment/page should be loaded by current worker.
-     */
-    record WorkerContext(int segment) {
-    }
-
-
-    /**
-     * Result of single worker iteration
-     */
-    record WorkerResult(boolean success, int segment) {
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/ClientListenerExecutorDecorator.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/ClientListenerExecutorDecorator.java
deleted file mode 100644
index 1e739cb800f5..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/ClientListenerExecutorDecorator.java
+++ /dev/null
@@ -1,297 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.remotestore;
-
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.RejectedExecutionException;
-
-import org.infinispan.client.hotrod.event.ClientCacheEntryCreatedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryModifiedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryRemovedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheFailoverEvent;
-import org.infinispan.client.hotrod.event.ClientEvent;
-import org.jboss.logging.Logger;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.common.util.Time;
-
-import static org.infinispan.client.hotrod.event.ClientEvent.Type.CLIENT_CACHE_ENTRY_CREATED;
-import static org.infinispan.client.hotrod.event.ClientEvent.Type.CLIENT_CACHE_ENTRY_REMOVED;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ClientListenerExecutorDecorator<K> {
-
-    private static final Logger logger = Logger.getLogger(ClientListenerExecutorDecorator.class);
-
-    private final Object lock = new Object();
-
-    private final ExecutorService decorated;
-
-    // Both "eventsInProgress" and "eventsQueue" maps are guarded by the "lock", so doesn't need to be concurrency safe
-
-    // Events currently submitted to the ExecutorService
-    private Map<K, MyClientEvent> eventsInProgress = new HashMap<>();
-
-    // Queue of the events waiting to process. We don't want events of same key to be processed concurrently
-    private MultivaluedHashMap<K, MyClientEventContext> eventsQueue = new MultivaluedHashMap<>();
-
-
-    public ClientListenerExecutorDecorator(ExecutorService decorated) {
-        this.decorated = decorated;
-    }
-
-
-    // Use explicit submit methods to ensure that different type of ClientEvent is not used
-
-    public void submit(ClientCacheFailoverEvent clientCacheFailoverEvent, Runnable r) {
-        decorated.submit(r);
-    }
-
-    public void submit(ClientCacheEntryCreatedEvent<K> cacheEntryCreatedEvent, Runnable r) {
-        MyClientEvent event = convertIspnClientEvent(cacheEntryCreatedEvent);
-        submit(event, r);
-    }
-
-
-    public void submit(ClientCacheEntryModifiedEvent<K> cacheEntryModifiedEvent, Runnable r) {
-        MyClientEvent event = convertIspnClientEvent(cacheEntryModifiedEvent);
-        submit(event, r);
-    }
-
-
-    public void submit(ClientCacheEntryRemovedEvent<K> cacheEntryRemovedEvent, Runnable r) {
-        MyClientEvent event = convertIspnClientEvent(cacheEntryRemovedEvent);
-        submit(event, r);
-    }
-
-
-    // IMPL
-
-    private void submit(MyClientEvent event, Runnable r) {
-        K key = event.key;
-
-        synchronized (lock) {
-            if (!eventsInProgress.containsKey(key)) {
-                submitImpl(key, event, r);
-            } else {
-                putEventToTheQueue(key, event, r);
-            }
-        }
-    }
-
-
-    // Assume it's called from the synchronized block
-    private void submitImpl(K key, MyClientEvent event, Runnable r) {
-        logger.debugf("Submitting event to the executor: %s . eventsInProgress size: %d, eventsQueue size: %d", event.toString(), eventsInProgress.size(), eventsQueue.size());
-
-        eventsInProgress.put(key, event);
-
-        Runnable decoratedRunnable = () -> {
-            Long start = null;
-            try {
-                if (logger.isDebugEnabled()) {
-                    start = Time.currentTimeMillis();
-                }
-
-                r.run();
-            } finally {
-                synchronized (lock) {
-                    eventsInProgress.remove(key);
-
-                    if (logger.isDebugEnabled()) {
-                        long took = Time.currentTimeMillis() - start;
-                        logger.debugf("Finished processing event by the executor: %s, took: %d ms. EventsInProgress size: %d", event.toString(), took, eventsInProgress.size());
-                    }
-
-                    pollQueue(key);
-                }
-            }
-        };
-
-        try {
-            decorated.submit(decoratedRunnable);
-        } catch (RejectedExecutionException ree) {
-            eventsInProgress.remove(key);
-
-            // server is shutting down or pool was terminated - don't throw errors
-            if (ree.getMessage() != null && (ree.getMessage().contains("Terminated") || ree.getMessage().contains("Shutting down"))) {
-                logger.warnf("Rejected execution of task for the event '%s' because server is shutting down or pool was terminated.", event.toString());
-                logger.debug(ree);
-            } else {
-                // avoid touching the cache when creating a log message to avoid a deadlock in Infinispan 12.1.7.Final
-                logger.errorf("Rejected execution of task for the event '%s' . Try to increase the pool size. Pool is '%s'", event.toString(), decorated.toString());
-                throw ree;
-            }
-        }
-    }
-
-
-    // Assume it's called from the synchronized block
-    private void pollQueue(K key) {
-        if (eventsQueue.containsKey(key)) {
-            List<MyClientEventContext> events = eventsQueue.get(key);
-
-            if (events.size() > 0) {
-                MyClientEventContext nextEvent = events.remove(0);
-
-                // Was last event in the queue for that key
-                if (events.size() == 0) {
-                    eventsQueue.remove(key);
-                }
-
-                submitImpl(key, nextEvent.event, nextEvent.r);
-
-            } else {
-                // Shouldn't happen
-                throw new IllegalStateException("Illegal state. Size was 0 for key " + key);
-            }
-        }
-    }
-
-
-    // Assume it's called from the synchronized block
-    private void putEventToTheQueue(K key, MyClientEvent event, Runnable r) {
-        logger.debugf("Calling putEventToTheQueue: %s", event.toString());
-
-        if (!eventsQueue.containsKey(key)) {
-            eventsQueue.putSingle(key, new MyClientEventContext(event, r));
-        } else {
-
-            List<MyClientEventContext> existingEvents = eventsQueue.get(key);
-            MyClientEventContext myNewEvent = new MyClientEventContext(event, r);
-
-            // Try to optimize queue (EG. in case we have REMOVE event, we can ignore the previous CREATE or MODIFIED events)
-            switch (event.type) {
-                case CLIENT_CACHE_ENTRY_CREATED:
-                    boolean add = true;
-                    for (MyClientEventContext ctx : existingEvents) {
-                        if (ctx.event.type == CLIENT_CACHE_ENTRY_REMOVED) {
-                            // Ignore. TODO: Log me?
-                            add = false;
-                            break;
-                        } else if (ctx.event.type == CLIENT_CACHE_ENTRY_CREATED) {
-                            // Ignore. Already on the list
-                            add = false;
-                            break;
-                        }
-                    }
-
-                    // Add to the beginning before the MODIFIED events
-                    if (add) {
-                        existingEvents.add(0, myNewEvent);
-                    }
-                    break;
-                case CLIENT_CACHE_ENTRY_MODIFIED:
-
-                    boolean addd = true;
-                    for (int i=0 ; i<existingEvents.size() ; i++) {
-                        MyClientEventContext ctx = existingEvents.get(i);
-                        if (ctx.event.type == CLIENT_CACHE_ENTRY_REMOVED) {
-                            // Ignore.
-                            addd = false;
-                            break;
-                        } else if (ctx.event.type == CLIENT_CACHE_ENTRY_CREATED) {
-                            // Shift to the next element. CREATE event go first.
-                        } else {
-                            // Can ignore the previous MODIFY event if we have newer version
-                            if (ctx.event.version < myNewEvent.event.version) {
-                                existingEvents.remove(i);
-                            } else {
-                                addd = false;
-                            }
-                        }
-
-                        if (addd) {
-                            // Add to the end
-                            existingEvents.add(myNewEvent);
-                        }
-                    }
-                    break;
-
-                case CLIENT_CACHE_ENTRY_REMOVED:
-                    // Can just ignore the other events in the queue in case of REMOVE
-                    eventsQueue.putSingle(key, new MyClientEventContext(event, r));
-                    break;
-                default:
-                    throw new IllegalStateException("Unsupported event type: " + event.type);
-            }
-
-        }
-
-        logger.debugf("Event queued. Current events for the key '%s': %s", key.toString(), eventsQueue.getList(key));
-    }
-
-
-    public MyClientEvent convertIspnClientEvent(ClientEvent ispnClientEvent) {
-        if (ispnClientEvent instanceof ClientCacheEntryCreatedEvent) {
-            ClientCacheEntryCreatedEvent<K> ev = (ClientCacheEntryCreatedEvent<K>) ispnClientEvent;
-            return new MyClientEvent(ev.getKey(), ev.getVersion(), ev.getType());
-        } else if (ispnClientEvent instanceof ClientCacheEntryModifiedEvent) {
-            ClientCacheEntryModifiedEvent<K> ev = (ClientCacheEntryModifiedEvent<K>) ispnClientEvent;
-            return new MyClientEvent(ev.getKey(), ev.getVersion(), ev.getType());
-        } else if (ispnClientEvent instanceof ClientCacheEntryRemovedEvent) {
-            ClientCacheEntryRemovedEvent<K> ev = (ClientCacheEntryRemovedEvent<K>) ispnClientEvent;
-            return new MyClientEvent(ev.getKey(), -1l, ev.getType());
-        } else {
-            throw new IllegalStateException("Unsupported event type: " + ispnClientEvent.getType());
-        }
-    }
-
-
-    private class MyClientEventContext {
-        private final MyClientEvent event;
-        private final Runnable r;
-
-        private MyClientEventContext(MyClientEvent event, Runnable r) {
-            this.event = event;
-            this.r = r;
-        }
-
-        @Override
-        public String toString() {
-            return event.toString();
-        }
-    }
-
-
-    // Using separate class as ISPN ClientEvent type doesn't provide access to key and version :/
-    private class MyClientEvent {
-        private final K key;
-        private final long version;
-        private final ClientEvent.Type type;
-
-        private MyClientEvent(K key, long version, ClientEvent.Type type) {
-            this.key = key;
-            this.version = version;
-            this.type = type;
-        }
-
-
-        @Override
-        public String toString() {
-            return String.format("ClientEvent [ type=%s, key=%s, version=%d ]", type, key, version);
-        }
-    }
-
-}
-
-
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheInvoker.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheInvoker.java
deleted file mode 100644
index 8d5f6c654d72..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheInvoker.java
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.remotestore;
-
-import org.infinispan.client.hotrod.exceptions.HotRodClientException;
-import org.keycloak.common.util.MultiSiteUtils;
-import org.keycloak.common.util.Retry;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-
-import org.infinispan.client.hotrod.Flag;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.VersionedValue;
-import org.jboss.logging.Logger;
-import org.keycloak.connections.infinispan.TopologyInfo;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.sessions.infinispan.changes.MergedUpdate;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.changes.SessionUpdateTask;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-import org.keycloak.connections.infinispan.InfinispanUtil;
-
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RemoteCacheInvoker {
-
-    public static final Logger logger = Logger.getLogger(RemoteCacheInvoker.class);
-
-    private final Map<String, RemoteCache> remoteCaches =  new HashMap<>();
-
-
-    public void addRemoteCache(String cacheName, RemoteCache remoteCache) {
-        remoteCaches.put(cacheName, remoteCache);
-    }
-
-    public Set<String> getRemoteCacheNames() {
-        return Collections.unmodifiableSet(remoteCaches.keySet());
-    }
-
-
-    public <K, V extends SessionEntity> void runTask(KeycloakSession kcSession, RealmModel realm, String cacheName, K key, MergedUpdate<V> task, SessionEntityWrapper<V> sessionWrapper) {
-        RemoteCache remoteCache = remoteCaches.get(cacheName);
-        if (remoteCache == null) {
-            return;
-        }
-
-        SessionUpdateTask.CacheOperation operation = task.getOperation();
-        SessionUpdateTask.CrossDCMessageStatus status = task.getCrossDCMessageStatus(sessionWrapper);
-
-        if (status == SessionUpdateTask.CrossDCMessageStatus.NOT_NEEDED) {
-            if (logger.isTraceEnabled()) {
-                logger.tracef("Skip writing to remoteCache for entity '%s' of cache '%s' and operation '%s'", key, cacheName, operation);
-            }
-            return;
-        }
-
-        long maxIdleTimeMs = getMaxIdleTimeMs(task);
-
-        if (logger.isTraceEnabled()) {
-            logger.tracef("Running task '%s' on remote cache '%s' . Key is '%s'", operation, cacheName, key);
-        }
-
-        TopologyInfo topology = InfinispanUtil.getTopologyInfo(kcSession);
-
-        Retry.executeWithBackoff((int iteration) -> {
-
-            try {
-                runOnRemoteCache(topology, remoteCache, maxIdleTimeMs, key, task, sessionWrapper);
-            } catch (HotRodClientException re) {
-                if (logger.isDebugEnabled()) {
-                    logger.debugf(re, "Failed running task '%s' on remote cache '%s' . Key: '%s', iteration '%s'. Will try to retry the task",
-                            operation, cacheName, key, iteration);
-                }
-
-                // Rethrow the exception. Retry will take care of handle the exception and eventually retry the operation.
-                throw re;
-            }
-
-        }, 10, 10);
-    }
-
-    private static <V extends SessionEntity> long getMaxIdleTimeMs(MergedUpdate<V> task) {
-        long maxIdleTimeMs = task.getMaxIdleTimeMs();
-        if (maxIdleTimeMs > 0) {
-            // Increase the timeout to ensure that entry won't expire on remoteCache in case that write of some entities to remoteCache is postponed (eg. userSession.lastSessionRefresh)
-            maxIdleTimeMs += 1800000;
-        }
-        return maxIdleTimeMs;
-    }
-
-    private <K, V extends SessionEntity> void runOnRemoteCache(TopologyInfo topology, RemoteCache<K, SessionEntityWrapper<V>> remoteCache, long maxIdleMs, K key, MergedUpdate<V> task, SessionEntityWrapper<V> sessionWrapper) {
-        SessionUpdateTask.CacheOperation operation = task.getOperation();
-
-        switch (operation) {
-            case REMOVE:
-                remoteCache.remove(key);
-                break;
-            case ADD:
-                remoteCache.put(key, sessionWrapper.forTransport(),
-                        InfinispanUtil.toHotrodTimeMs(remoteCache, task.getLifespanMs()), TimeUnit.MILLISECONDS,
-                        InfinispanUtil.toHotrodTimeMs(remoteCache, maxIdleMs), TimeUnit.MILLISECONDS);
-                break;
-            case ADD_IF_ABSENT:
-                SessionEntityWrapper<V> existing = remoteCache
-                        .withFlags(Flag.FORCE_RETURN_VALUE)
-                        .putIfAbsent(key, sessionWrapper.forTransport(), InfinispanUtil.toHotrodTimeMs(remoteCache, task.getLifespanMs()), TimeUnit.MILLISECONDS, InfinispanUtil.toHotrodTimeMs(remoteCache, maxIdleMs), TimeUnit.MILLISECONDS);
-                if (existing != null) {
-                    logger.debugf("Existing entity in remote cache for key: %s . Will update it", key);
-
-                    replace(topology, remoteCache, task.getLifespanMs(), maxIdleMs, key, task);
-                }
-                break;
-            case REPLACE:
-                replace(topology, remoteCache, task.getLifespanMs(), maxIdleMs, key, task);
-                break;
-            default:
-                throw new IllegalStateException("Unsupported state " +  operation);
-        }
-    }
-
-
-    private <K, V extends SessionEntity> void replace(TopologyInfo topology, RemoteCache<K, SessionEntityWrapper<V>> remoteCache, long lifespanMs, long maxIdleMs, K key, SessionUpdateTask<V> task) {
-        // Adjust based on the hotrod protocol
-        lifespanMs = InfinispanUtil.toHotrodTimeMs(remoteCache, lifespanMs);
-        maxIdleMs = InfinispanUtil.toHotrodTimeMs(remoteCache, maxIdleMs);
-
-        boolean replaced = false;
-        int replaceIteration = 0;
-        while (!replaced && replaceIteration < InfinispanUtil.MAXIMUM_REPLACE_RETRIES) {
-            replaceIteration++;
-
-            VersionedValue<SessionEntityWrapper<V>> versioned = remoteCache.getWithMetadata(key);
-            if (versioned == null) {
-                if (MultiSiteUtils.isPersistentSessionsEnabled() &&
-                    (remoteCache.getName().equals(USER_SESSION_CACHE_NAME)
-                     || remoteCache.getName().equals(CLIENT_SESSION_CACHE_NAME)
-                     || remoteCache.getName().equals(OFFLINE_USER_SESSION_CACHE_NAME)
-                     || remoteCache.getName().equals(OFFLINE_CLIENT_SESSION_CACHE_NAME))) {
-                    logger.debugf("No existing entry for %s in the remote cache to remove, might have been evicted. A delete will force an eviction in the other DC.", key);
-                    remoteCache.remove(key);
-                }
-                logger.warnf("Not found entity to replace for key '%s'", key);
-                return;
-            }
-
-            SessionEntityWrapper<V> sessionWrapper = versioned.getValue();
-            final V session = sessionWrapper.getEntity();
-
-            // Run task on the remote session
-            task.runUpdate(session);
-
-            if (logger.isTraceEnabled()) {
-                logger.tracef("%s: Before replaceWithVersion. Entity to write version %d: %s", logTopologyData(topology, replaceIteration),
-                        versioned.getVersion(), session);
-            }
-
-            replaced = remoteCache.replaceWithVersion(key, SessionEntityWrapper.forTransport(session), versioned.getVersion(), lifespanMs, TimeUnit.MILLISECONDS, maxIdleMs, TimeUnit.MILLISECONDS);
-
-            if (!replaced) {
-                logger.debugf("%s: Failed to replace entity '%s' version %d. Will retry again", logTopologyData(topology, replaceIteration), key, versioned.getVersion());
-            } else {
-                if (logger.isTraceEnabled()) {
-                    logger.tracef("%s: Replaced entity version %d in remote cache: %s", logTopologyData(topology, replaceIteration), versioned.getVersion(), session);
-                }
-            }
-        }
-
-        if (!replaced) {
-            logger.warnf("Failed to replace entity '%s' in remote cache '%s'", key, remoteCache.getName());
-        }
-    }
-
-
-    private String logTopologyData(TopologyInfo topology, int iteration) {
-        return topology.toString() + ", replaceIteration: " + iteration;
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionListener.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionListener.java
deleted file mode 100644
index 84cdaed988e7..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionListener.java
+++ /dev/null
@@ -1,285 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.remotestore;
-
-import java.util.Random;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.VersionedValue;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryCreated;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryModified;
-import org.infinispan.client.hotrod.annotation.ClientCacheEntryRemoved;
-import org.infinispan.client.hotrod.annotation.ClientCacheFailover;
-import org.infinispan.client.hotrod.annotation.ClientListener;
-import org.infinispan.client.hotrod.event.ClientCacheEntryCreatedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryModifiedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheEntryRemovedEvent;
-import org.infinispan.client.hotrod.event.ClientCacheFailoverEvent;
-import org.infinispan.client.hotrod.event.ClientEvent;
-import org.infinispan.context.Flag;
-import org.jboss.logging.Logger;
-import org.keycloak.connections.infinispan.InfinispanUtil;
-import org.keycloak.connections.infinispan.TopologyInfo;
-import org.keycloak.executors.ExecutorsProvider;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.sessions.infinispan.SessionFunction;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.entities.SessionEntity;
-import org.keycloak.models.sessions.infinispan.util.SessionTimeouts;
-import org.keycloak.models.utils.KeycloakModelUtils;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@ClientListener
-public class RemoteCacheSessionListener<K, V extends SessionEntity>  {
-
-    protected static final Logger logger = Logger.getLogger(RemoteCacheSessionListener.class);
-
-    private static final int MAXIMUM_REPLACE_RETRIES = 10;
-    private final Runnable onFailover;
-
-    private Cache<K, SessionEntityWrapper<V>> cache;
-    private RemoteCache<K, SessionEntityWrapper<V>> remoteCache;
-    private TopologyInfo topologyInfo;
-    private ClientListenerExecutorDecorator<K> executor;
-    private SessionFunction<V> lifespanMsLoader;
-    private SessionFunction<V> maxIdleTimeMsLoader;
-    private KeycloakSessionFactory sessionFactory;
-
-
-    protected RemoteCacheSessionListener(Runnable onFailover) {
-        this.onFailover = onFailover;
-    }
-
-
-    protected void init(KeycloakSession session, Cache<K, SessionEntityWrapper<V>> cache, RemoteCache<K, SessionEntityWrapper<V>> remoteCache,
-                        SessionFunction<V> lifespanMsLoader, SessionFunction<V> maxIdleTimeMsLoader) {
-        this.cache = cache;
-        this.remoteCache = remoteCache;
-
-        this.topologyInfo = InfinispanUtil.getTopologyInfo(session);
-
-        this.lifespanMsLoader = lifespanMsLoader;
-        this.maxIdleTimeMsLoader = maxIdleTimeMsLoader;
-        this.sessionFactory = session.getKeycloakSessionFactory();
-
-        ExecutorService executor = session.getProvider(ExecutorsProvider.class).getExecutor("client-listener-" + cache.getName());
-        this.executor = new ClientListenerExecutorDecorator<>(executor);
-    }
-
-
-    @ClientCacheEntryCreated
-    public void created(ClientCacheEntryCreatedEvent event) {
-        K key = (K) event.getKey();
-
-        if (shouldUpdateLocalCache(event.getType(), key, event.isCommandRetried())) {
-            this.executor.submit(event, () -> {
-
-                // Doesn't work due https://issues.jboss.org/browse/ISPN-9323. Needs to explicitly retrieve and create it
-                //cache.get(key);
-
-                createRemoteEntityInCache(key);
-
-            });
-        }
-    }
-
-    @ClientCacheFailover
-    public void cacheFailover(ClientCacheFailoverEvent event) {
-        if (onFailover != null) {
-            this.executor.submit(event, onFailover);
-        }
-    }
-
-
-    @ClientCacheEntryModified
-    public void updated(ClientCacheEntryModifiedEvent event) {
-        K key = (K) event.getKey();
-
-        if (shouldUpdateLocalCache(event.getType(), key, event.isCommandRetried())) {
-
-            this.executor.submit(event, () -> {
-
-                replaceRemoteEntityInCache(key, event.getVersion());
-
-            });
-        }
-    }
-
-
-    protected void createRemoteEntityInCache(K key) {
-        VersionedValue<SessionEntityWrapper<V>> remoteSessionVersioned = remoteCache.getWithMetadata(key);
-
-        // Maybe can happen under some circumstances that remoteCache doesn't yet contain the value sent in the event (maybe just theoretically...)
-        if (remoteSessionVersioned == null || remoteSessionVersioned.getValue() == null) {
-            logger.debugf("Entity '%s' not present in remoteCache. Ignoring create", key);
-            return;
-        }
-
-
-        V remoteSession = remoteSessionVersioned.getValue().getEntity();
-        SessionEntityWrapper<V> newWrapper = new SessionEntityWrapper<>(remoteSession);
-
-        logger.debugf("Read session entity wrapper from the remote cache: %s", remoteSession);
-
-        KeycloakModelUtils.runJobInTransaction(sessionFactory, (session -> {
-
-            RealmModel realm = session.realms().getRealm(newWrapper.getEntity().getRealmId());
-            ClientModel client = newWrapper.getClientIfNeeded(realm);
-            long lifespanMs = lifespanMsLoader.apply(realm, client, newWrapper.getEntity());
-            long maxIdleTimeMs = maxIdleTimeMsLoader.apply(realm, client, newWrapper.getEntity());
-
-            // It is possible the session may be expired by the time this has replicated, double check before inserting
-            if (maxIdleTimeMs != SessionTimeouts.ENTRY_EXPIRED_FLAG && lifespanMs != SessionTimeouts.ENTRY_EXPIRED_FLAG) {
-                logger.tracef("Calling putIfAbsent for entity '%s' in the cache '%s' . lifespan: %d ms, maxIdleTime: %d ms", key, remoteCache.getName(), lifespanMs, maxIdleTimeMs);
-                // Using putIfAbsent. Theoretic possibility that entity was already put to cache by someone else
-                cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD, Flag.IGNORE_RETURN_VALUES)
-                      .putIfAbsent(key, newWrapper, lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS);
-            } else {
-                logger.tracef("Not calling putIfAbsent for entity '%s' in the cache '%s' as entry is already expired", key, remoteCache.getName());
-            }
-
-
-        }));
-    }
-
-
-    protected void replaceRemoteEntityInCache(K key, long eventVersion) {
-        // TODO can be optimized and remoteSession sent in the event itself?
-        AtomicBoolean replaced = new AtomicBoolean(false);
-        int replaceRetries = 0;
-        int sleepInterval = 25;
-        do {
-            replaceRetries++;
-
-            SessionEntityWrapper<V> localEntityWrapper = cache.get(key);
-            VersionedValue<SessionEntityWrapper<V>> remoteSessionVersioned = remoteCache.getWithMetadata(key);
-
-            // Probably already removed
-            if (remoteSessionVersioned == null || remoteSessionVersioned.getValue() == null) {
-                logger.debugf("Entity '%s' not present in remoteCache. Ignoring replace",
-                        key);
-                return;
-            }
-
-            if (remoteSessionVersioned.getVersion() < eventVersion) {
-                try {
-                    logger.debugf("Got replace remote entity event prematurely for entity '%s', will try again. Event version: %d, got: %d",
-                            key, eventVersion, remoteSessionVersioned == null ? -1 : remoteSessionVersioned.getVersion());
-                    Thread.sleep(new Random().nextInt(sleepInterval));  // using exponential backoff
-                    continue;
-                } catch (InterruptedException ex) {
-                    continue;
-                } finally {
-                    sleepInterval = sleepInterval << 1;
-                }
-            }
-            SessionEntity remoteSession = remoteSessionVersioned.getValue().getEntity();
-
-            logger.debugf("Read session entity from the remote cache: %s . replaceRetries=%d", remoteSession, replaceRetries);
-
-            SessionEntityWrapper<V> sessionWrapper = remoteSession.mergeRemoteEntityWithLocalEntity(localEntityWrapper);
-
-            KeycloakModelUtils.runJobInTransaction(sessionFactory, (session -> {
-
-                RealmModel realm = session.realms().getRealm(sessionWrapper.getEntity().getRealmId());
-                ClientModel client = sessionWrapper.getClientIfNeeded(realm);
-                long lifespanMs = lifespanMsLoader.apply(realm, client, sessionWrapper.getEntity());
-                long maxIdleTimeMs = maxIdleTimeMsLoader.apply(realm, client, sessionWrapper.getEntity());
-
-                // We received event from remoteCache, so we won't update it back
-                replaced.set(cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD, Flag.IGNORE_RETURN_VALUES)
-                        .replace(key, localEntityWrapper, sessionWrapper, lifespanMs, TimeUnit.MILLISECONDS, maxIdleTimeMs, TimeUnit.MILLISECONDS));
-
-            }));
-
-            if (! replaced.get()) {
-                logger.debugf("Did not succeed in merging sessions, will try again: %s", remoteSession);
-            }
-        } while (replaceRetries < MAXIMUM_REPLACE_RETRIES && ! replaced.get());
-    }
-
-
-    @ClientCacheEntryRemoved
-    public void removed(ClientCacheEntryRemovedEvent event) {
-        K key = (K) event.getKey();
-
-        if (shouldUpdateLocalCache(event.getType(), key, event.isCommandRetried())) {
-
-            this.executor.submit(event, () -> {
-
-                // We received event from remoteCache, so we won't update it back
-                cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_STORE, Flag.SKIP_CACHE_LOAD, Flag.IGNORE_RETURN_VALUES)
-                        .remove(key);
-
-            });
-        }
-    }
-
-
-    // For distributed caches, ensure that local modification is executed just on owner OR if event.isCommandRetried
-    protected boolean shouldUpdateLocalCache(ClientEvent.Type type, K key, boolean commandRetried) {
-        boolean result;
-
-        // Case when cache is stopping or stopped already
-        if (!cache.getStatus().allowInvocations()) {
-            return false;
-        }
-
-        if (commandRetried) {
-            result = true;
-        } else {
-            result = topologyInfo.amIOwner(cache, key);
-        }
-
-        logger.debugf("Received event from remote store. Event '%s', key '%s', skip '%b'", type, key, !result);
-
-        return result;
-    }
-
-    public static <K, V extends SessionEntity> RemoteCacheSessionListener createListener(KeycloakSession session, Cache<K, SessionEntityWrapper<V>> cache, RemoteCache<K, SessionEntityWrapper<V>> remoteCache,
-                                                                                         SessionFunction<V> lifespanMsLoader, SessionFunction<V> maxIdleTimeMsLoader, Runnable onFailover) {
-        /*boolean isCoordinator = InfinispanUtil.isCoordinator(cache);
-
-        // Just cluster coordinator will fetch userSessions from remote cache.
-        // In case that coordinator is failover during state fetch, there is slight risk that not all userSessions will be fetched to local cluster. Assume acceptable for now
-        RemoteCacheSessionListener listener;
-        if (isCoordinator) {
-            logger.infof("Will fetch initial state from remote cache for cache '%s'", cache.getName());
-            listener = new FetchInitialStateCacheListener();
-        } else {
-            logger.infof("Won't fetch initial state from remote cache for cache '%s'", cache.getName());
-            listener = new DontFetchInitialStateCacheListener();
-        }*/
-
-        RemoteCacheSessionListener<K, V> listener = new RemoteCacheSessionListener<>(onFailover);
-        listener.init(session, cache, remoteCache, lifespanMsLoader, maxIdleTimeMsLoader);
-
-        return listener;
-    }
-
-
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoader.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoader.java
deleted file mode 100644
index be2e2e432be2..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoader.java
+++ /dev/null
@@ -1,185 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.remotestore;
-
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.MetadataValue;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.commons.util.CloseableIterator;
-import org.infinispan.context.Flag;
-import org.jboss.logging.Logger;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.initializer.SessionLoader;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.TimeUnit;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RemoteCacheSessionsLoader implements SessionLoader<RemoteCacheSessionsLoaderContext, SessionLoader.WorkerContext, SessionLoader.WorkerResult> {
-
-    private static final Logger log = Logger.getLogger(RemoteCacheSessionsLoader.class);
-
-    private final String cacheName;
-    private final int sessionsPerSegment;
-
-    public RemoteCacheSessionsLoader(String cacheName, int sessionsPerSegment) {
-        this.cacheName = cacheName;
-        this.sessionsPerSegment = sessionsPerSegment;
-    }
-
-
-    @Override
-    public RemoteCacheSessionsLoaderContext computeLoaderContext() {
-        return new RemoteCacheSessionsLoaderContext(sessionsPerSegment);
-
-    }
-
-    @Override
-    public WorkerContext computeWorkerContext(int segment) {
-        return new WorkerContext(segment);
-    }
-
-
-    @Override
-    public WorkerResult loadSessions(KeycloakSession session, RemoteCacheSessionsLoaderContext loaderContext, WorkerContext ctx) {
-        Cache<Object, Object> cache = getCache(session);
-        Cache<Object, Object> decoratedCache = cache.getAdvancedCache().withFlags(Flag.SKIP_CACHE_LOAD, Flag.SKIP_CACHE_STORE, Flag.IGNORE_RETURN_VALUES);
-        RemoteCache<?, ?> remoteCache = getRemoteCache(session);
-
-        int countLoaded = 0;
-        try (CloseableIterator<Map.Entry<Object, MetadataValue<Object>>> it = remoteCache.retrieveEntriesWithMetadata(null, loaderContext.getSessionsPerSegment())) {
-            Map<Object, Object> toInsertExpiring = new HashMap<>(loaderContext.getSessionsPerSegment());
-            Map<Object, Object> toInsertImmortal = new HashMap<>(loaderContext.getSessionsPerSegment());
-            int count = 0;
-            int maxLifespanExpiring = 0;
-            int maxIdleExpiring = -1;
-            int maxIdleImmortal = -1;
-            while (it.hasNext()) {
-                Map.Entry<Object, MetadataValue<Object>> entry = it.next();
-                boolean isImmortal = entry.getValue().getLifespan() < 0;
-                boolean shouldInsert = true;
-
-                if (!isImmortal) {
-                    // Calculate the remaining lifetime reduced by the current time, not Keycloak time as the remote Infinispan isn't on Keycloak's clock.
-                    // The lifetime will be larger than on the remote store for those entries, but all sessions contain timestamp which will be validated anyway.
-                    // If we don't trust the clock calculations here, we would instead use the maxLifeSpan as is, which could enlarge the expiry time significantly.
-                    int remainingLifespan = entry.getValue().getLifespan() - (int) ((System.currentTimeMillis() - entry.getValue().getCreated()) / 1000);
-                    maxLifespanExpiring = Math.max(maxLifespanExpiring, remainingLifespan);
-                    if (remainingLifespan <= 0) {
-                        shouldInsert = false;
-                    }
-                }
-
-                if (entry.getValue().getMaxIdle() > 0) {
-                    // The max idle time on the remote store is set to the max lifetime as remote store entries are not touched on read, and therefore would otherwise expire too early.
-                    // Still, this is the only number we have available, so we use it.
-                    if (isImmortal) {
-                        maxIdleImmortal = Math.max(maxIdleImmortal, entry.getValue().getMaxIdle());
-                    } else {
-                        maxIdleExpiring = Math.max(maxIdleExpiring, entry.getValue().getMaxIdle());
-                    }
-                }
-
-                if (shouldInsert) {
-                    (isImmortal ? toInsertImmortal : toInsertExpiring).put(entry.getKey(), entry.getValue().getValue());
-                    ++countLoaded;
-                }
-
-                if (++count == loaderContext.getSessionsPerSegment()) {
-                    if (!toInsertExpiring.isEmpty()) {
-                        insertSessions(decoratedCache, toInsertExpiring, maxIdleExpiring, maxLifespanExpiring);
-                        toInsertExpiring.clear();
-                        maxLifespanExpiring = 0;
-                        maxIdleExpiring = -1;
-                    }
-                    if (!toInsertImmortal.isEmpty()) {
-                        insertSessions(decoratedCache, toInsertImmortal, maxIdleImmortal, -1);
-                        toInsertImmortal.clear();
-                        maxIdleImmortal = -1;
-                    }
-                    count = 0;
-                }
-            }
-
-            // last batch
-            if (!toInsertExpiring.isEmpty()) {
-                insertSessions(decoratedCache, toInsertExpiring, maxIdleExpiring, maxLifespanExpiring);
-            }
-            if (!toInsertImmortal.isEmpty()) {
-                insertSessions(decoratedCache, toInsertImmortal, maxIdleImmortal, -1);
-            }
-        } catch (RuntimeException e) {
-            log.warnf(e, "Error loading sessions from remote cache '%s' for segment '%d'", remoteCache.getName(), ctx.segment());
-            throw e;
-        }
-
-        log.debugf("Successfully finished loading sessions from cache '%s' . Segment: %d, Count of sessions loaded: %d", cache.getName(), ctx.segment(), countLoaded);
-
-        return new WorkerResult(true, ctx.segment());
-    }
-
-    private void insertSessions(Cache<Object, Object> cache, Map<Object, Object> entries, int maxIdle, int lifespan) {
-        log.debugf("Adding %d entries to cache '%s'", entries.size(), cacheName);
-
-        // The `putAll` operation might time out when a node becomes unavailable, therefore, retry.
-        Retry.executeWithBackoff(
-                (int iteration) -> {
-                    DefaultInfinispanConnectionProviderFactory.runWithReadLockOnCacheManager(() -> {
-                        // With Infinispan 14.0.21/14.0.19, we've seen deadlocks in tests where this future never completed when shutting down the internal Infinispan.
-                        // Therefore, prevent the shutdown of the internal Infinispan during this step.
-                        cache.putAll(entries, lifespan, TimeUnit.SECONDS, maxIdle, TimeUnit.SECONDS);
-                    });
-                },
-                (iteration, throwable) -> log.warnf("Unable to put entries into the cache in iteration %s", iteration, throwable),
-                3,
-                10);
-    }
-
-    @Override
-    public void afterAllSessionsLoaded() {
-    }
-
-
-    protected Cache getCache(KeycloakSession session) {
-        InfinispanConnectionProvider ispn = session.getProvider(InfinispanConnectionProvider.class);
-        return ispn.getCache(cacheName);
-    }
-
-
-    // Get remoteCache, which may be secured
-    protected RemoteCache getRemoteCache(KeycloakSession session) {
-        InfinispanConnectionProvider ispn = session.getProvider(InfinispanConnectionProvider.class);
-        return ispn.getRemoteCache(cacheName);
-    }
-
-
-    @Override
-    public String toString() {
-        return new StringBuilder("RemoteCacheSessionsLoader [ ")
-                .append("cacheName: ").append(cacheName)
-                .append(", sessionsPerSegment: ").append(sessionsPerSegment)
-                .append(" ]")
-                .toString();
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoaderContext.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoaderContext.java
deleted file mode 100644
index ef04c59ae166..000000000000
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoaderContext.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.remotestore;
-
-import org.keycloak.models.sessions.infinispan.initializer.SessionLoader;
-
-/**
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RemoteCacheSessionsLoaderContext extends SessionLoader.LoaderContext {
-
-    private final int sessionsPerSegment;
-
-    public RemoteCacheSessionsLoaderContext(int sessionsPerSegment) {
-        super(1);
-        this.sessionsPerSegment = sessionsPerSegment;
-    }
-
-
-    public int getSessionsPerSegment() {
-        return sessionsPerSegment;
-    }
-
-    @Override
-    public String toString() {
-        return new StringBuilder("RemoteCacheSessionsLoaderContext [ ")
-                .append("segmentsCount: ").append(getSegmentsCount())
-                .append(", sessionsPerSegment: ").append(sessionsPerSegment)
-                .append(" ]")
-                .toString();
-    }
-}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProvider.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProvider.java
new file mode 100644
index 000000000000..0198fb0f0f58
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProvider.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.keycloak.provider.Provider;
+
+/**
+ * A provider to create the {@link ConfigurationBuilderHolder} to configure the {@link EmbeddedCacheManager}.
+ */
+public interface CacheEmbeddedConfigProvider extends Provider {
+
+    /**
+     * The {@link ConfigurationBuilderHolder} whit the {@link EmbeddedCacheManager} configuration. It must not be
+     * {@code null}.
+     *
+     * @return The {@link ConfigurationBuilderHolder} whit the {@link EmbeddedCacheManager} configuration.
+     */
+    ConfigurationBuilderHolder configuration();
+
+    @Override
+    default void close() {
+        //no-op
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderFactory.java
new file mode 100644
index 000000000000..e2110a3bc6fc
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderFactory.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * The {@link ProviderFactory} to build {@link CacheEmbeddedConfigProvider}.
+ */
+public interface CacheEmbeddedConfigProviderFactory extends ProviderFactory<CacheEmbeddedConfigProvider> {
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderSpi.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderSpi.java
new file mode 100644
index 000000000000..597ad03e8eb2
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheEmbeddedConfigProviderSpi.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.keycloak.provider.Spi;
+
+/**
+ * The {@link Spi} implementation for the {@link CacheEmbeddedConfigProviderFactory} and
+ * {@link CacheEmbeddedConfigProvider}.
+ * <p>
+ * It provides the {@link ConfigurationBuilderHolder} to configure the {@link EmbeddedCacheManager}.
+ */
+public class CacheEmbeddedConfigProviderSpi implements Spi {
+
+    public static final String SPI_NAME = "cacheEmbedded";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return SPI_NAME;
+    }
+
+    @Override
+    public Class<CacheEmbeddedConfigProvider> getProviderClass() {
+        return CacheEmbeddedConfigProvider.class;
+    }
+
+    @Override
+    public Class<CacheEmbeddedConfigProviderFactory> getProviderFactoryClass() {
+        return CacheEmbeddedConfigProviderFactory.class;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProvider.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProvider.java
new file mode 100644
index 000000000000..ddf4d0c1b138
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProvider.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import java.util.Optional;
+
+import org.infinispan.client.hotrod.configuration.Configuration;
+import org.keycloak.provider.Provider;
+
+/**
+ * A provider to create a configuration to the Hot Rod client.
+ */
+public interface CacheRemoteConfigProvider extends Provider {
+
+    /**
+     * Creates the {@link Configuration} for the Hot Rod client.
+     * <p>
+     * The optional signal if a Hot Rod client should be instantiated and started. If present, it assumes an external
+     * Infinispan cluster is ready and online, otherwise Keycloak fails to start.
+     *
+     * @return The {@link Configuration} for the Hot Rod client.
+     */
+    Optional<Configuration> configuration();
+
+    @Override
+    default void close() {
+        //no-op
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderFactory.java
new file mode 100644
index 000000000000..4a89098ae6b0
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderFactory.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * A factory for {@link CacheRemoteConfigProvider}
+ *
+ * @see CacheRemoteConfigProvider
+ */
+public interface CacheRemoteConfigProviderFactory extends ProviderFactory<CacheRemoteConfigProvider> {
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderSpi.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderSpi.java
new file mode 100644
index 000000000000..bb03a157417b
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/CacheRemoteConfigProviderSpi.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.keycloak.provider.Spi;
+
+/**
+ * An SPI to generate the configuration for the Hot Rod client.
+ */
+public class CacheRemoteConfigProviderSpi implements Spi {
+
+    public static final String SPI_NAME = "cacheRemote";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return SPI_NAME;
+    }
+
+    @Override
+    public Class<CacheRemoteConfigProvider> getProviderClass() {
+        return CacheRemoteConfigProvider.class;
+    }
+
+    @Override
+    public Class<CacheRemoteConfigProviderFactory> getProviderFactoryClass() {
+        return CacheRemoteConfigProviderFactory.class;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProvider.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProvider.java
new file mode 100644
index 000000000000..b1f017a5909d
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProvider.java
@@ -0,0 +1,122 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import java.time.Duration;
+
+import org.keycloak.provider.Provider;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.TrustManager;
+
+/**
+ * A {@link Provider} for the TLS certificate for JGroups communication.
+ * <p>
+ * <b>Implementation notes</b>
+ * <p>
+ * If the method {@link #isEnabled()} returns {@code true}, then the implementation must also implement
+ * {@link #keyManager()} and {@link #trustManager()}.
+ * <p>
+ * If the method {@link #supportRotateAndReload()} returns {@code true}, then the implementation must also implement
+ * {@link #rotateCertificate()}, {@link #reloadCertificate()} and {@link #nextRotation()}.
+ */
+public interface JGroupsCertificateProvider extends Provider {
+
+    JGroupsCertificateProvider DISABLED = new JGroupsCertificateProvider() {
+    };
+
+    /**
+     * A new certificate must be generated.
+     * <p>
+     * The generated certificate should not be used immediately, but only after {@link #reloadCertificate()} is
+     * invoked.
+     * <p>
+     * This method must be implemented when {@link #supportRotateAndReload()} returns {@code true}.
+     */
+    default void rotateCertificate() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Reloads the most recent certificate and apply it to the {@link KeyManager} and {@link TrustManager}.
+     * <p>
+     * This method must be implemented when {@link #supportRotateAndReload()} returns {@code true}.
+     */
+    default void reloadCertificate() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Returns when the next certificate rotation is required.
+     * <p>
+     * It is used to automatically rotate certificates periodically.
+     * <p>
+     * This method must be implemented when {@link #supportRotateAndReload()} returns {@code true}.
+     *
+     * @return The time until the next rotation.
+     */
+    default Duration nextRotation() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Returns a managed {@link KeyManager}.
+     * <p>
+     * If {@link #supportRotateAndReload()} returns {@code true}, the instance returned must be updated with the new
+     * certificate when {@link #reloadCertificate()}. This method is invoked only once at boot time.
+     * <p>
+     * This method must be implemented when {@link #isEnabled()} returns {@code true}.
+     *
+     * @return The {@link KeyManager} to use by the {@link javax.net.ssl.SSLContext}.
+     */
+    default KeyManager keyManager() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Returns a managed {@link TrustManager}.
+     * <p>
+     * If {@link #supportRotateAndReload()} returns {@code true}, the instance returned must be updated with the new
+     * certificate when {@link #reloadCertificate()}. This method is invoked only once at boot time.
+     * <p>
+     * This method must be implemented when {@link #isEnabled()} returns {@code true}.
+     *
+     * @return The {@link TrustManager} to use by the {@link javax.net.ssl.SSLContext}.
+     */
+    default TrustManager trustManager() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * @return {@code true} if rotation and reload requests is possible.
+     */
+    default boolean supportRotateAndReload() {
+        return false;
+    }
+
+    /**
+     * @return {@code true} if TLS is enabled for JGroups communication.
+     */
+    default boolean isEnabled() {
+        return false;
+    }
+
+    @Override
+    default void close() {
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderFactory.java
new file mode 100644
index 000000000000..7ad2a11d0514
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderFactory.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * A {@link ProviderFactory} for {@link JGroupsCertificateProvider}.
+ */
+public interface JGroupsCertificateProviderFactory extends ProviderFactory<JGroupsCertificateProvider> {
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderSpi.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderSpi.java
new file mode 100644
index 000000000000..1e449a2b3a66
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/JGroupsCertificateProviderSpi.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan;
+
+import org.keycloak.provider.Spi;
+
+/**
+ * The {@link Spi} implementation for {@link JGroupsCertificateProvider}.
+ */
+public class JGroupsCertificateProviderSpi implements Spi {
+
+    public static final String SPI_NAME = "jgroupsMtls";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return SPI_NAME;
+    }
+
+    @Override
+    public Class<JGroupsCertificateProvider> getProviderClass() {
+        return JGroupsCertificateProvider.class;
+    }
+
+    @Override
+    public Class<JGroupsCertificateProviderFactory> getProviderFactoryClass() {
+        return JGroupsCertificateProviderFactory.class;
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/Util.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/Util.java
new file mode 100644
index 000000000000..fc5aa3d30c05
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/Util.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl;
+
+import org.keycloak.config.Option;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+
+/**
+ * Utility method for this package and subpackages
+ */
+public final class Util {
+
+    private Util() {
+    }
+
+    /**
+     * Copies the {@link Option} information into the {@link ProviderConfigurationBuilder}.
+     *
+     * @param builder  The property to set/configure.
+     * @param name     The desired property name.
+     * @param label    The label of the property's argument.
+     * @param type     The type of the property's value.
+     * @param option   The source {@link Option} to gather the information.
+     * @param isSecret {@code true} if the property is a secret.
+     */
+    public static void copyFromOption(ProviderConfigurationBuilder builder, String name, String label, String type, Option<?> option, boolean isSecret) {
+        var property = builder.property()
+                .name(name)
+                .helpText(option.getDescription())
+                .label(label)
+                .type(type)
+                .secret(isSecret);
+        option.getDefaultValue().ifPresent(property::defaultValue);
+        property.options(option.getExpectedValues());
+        property.add();
+    }
+
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/CacheConfigurator.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/CacheConfigurator.java
new file mode 100644
index 000000000000..f65eb848d252
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/CacheConfigurator.java
@@ -0,0 +1,321 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl.embedded;
+
+import java.lang.invoke.MethodHandles;
+import java.util.Arrays;
+import java.util.Map;
+import java.util.function.Supplier;
+import java.util.stream.Stream;
+
+import org.infinispan.commons.dataconversion.MediaType;
+import org.infinispan.configuration.cache.AbstractStoreConfiguration;
+import org.infinispan.configuration.cache.ConfigurationBuilder;
+import org.infinispan.configuration.cache.HashConfiguration;
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.eviction.EvictionStrategy;
+import org.infinispan.transaction.LockingMode;
+import org.infinispan.transaction.TransactionMode;
+import org.infinispan.transaction.lookup.EmbeddedTransactionManagerLookup;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_REVISIONS_CACHE_DEFAULT_MAX;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHORIZATION_REVISIONS_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CRL_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.LOCAL_CACHE_NAMES;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.LOCAL_MAX_COUNT_CACHES;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_REVISIONS_CACHE_DEFAULT_MAX;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.REALM_REVISIONS_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_REVISIONS_CACHE_DEFAULT_MAX;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_REVISIONS_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.WORK_CACHE_NAME;
+
+/**
+ * Utility class related to the Infinispan cache configuration.
+ * <p>
+ * This class contains methods to configure caches based on the SPI configuration options, and it provides cache
+ * configuration defaults.
+ */
+public final class CacheConfigurator {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+
+    // Map with the default cache configuration if the cache is not present in the XML.
+    private static final Map<String, Supplier<ConfigurationBuilder>> DEFAULT_CONFIGS = Map.of(CRL_CACHE_NAME, CacheConfigurator::getCrlCacheConfig);
+    private static final Supplier<ConfigurationBuilder> TO_NULL = () -> null;
+    private static final String MAX_COUNT_SUFFIX = "MaxCount";
+
+    private CacheConfigurator() {
+    }
+
+    /**
+     * Configures the Infinispan local caches used by Keycloak (e.g., for realm or user data) using the provided
+     * Keycloak configuration.
+     *
+     * @param keycloakConfig The Keycloak configuration.
+     * @param holder         The {@link ConfigurationBuilderHolder} where the caches will be defined.
+     * @throws IllegalStateException if an Infinispan cache is not defined. This could indicate a missing or incorrect
+     *                               configuration.
+     */
+    public static void configureLocalCaches(Config.Scope keycloakConfig, ConfigurationBuilderHolder holder) {
+        logger.debug("Configuring embedded local caches");
+        // configure local caches except revision caches
+        configureCacheMaxCount(keycloakConfig, holder, Arrays.stream(LOCAL_MAX_COUNT_CACHES));
+        // configure revision caches
+        configureRevisionCache(holder, REALM_CACHE_NAME, REALM_REVISIONS_CACHE_NAME, REALM_REVISIONS_CACHE_DEFAULT_MAX);
+        configureRevisionCache(holder, USER_CACHE_NAME, USER_REVISIONS_CACHE_NAME, USER_REVISIONS_CACHE_DEFAULT_MAX);
+        configureRevisionCache(holder, AUTHORIZATION_CACHE_NAME, AUTHORIZATION_REVISIONS_CACHE_NAME, AUTHORIZATION_REVISIONS_CACHE_DEFAULT_MAX);
+        // check all caches are defined
+        checkCachesExist(holder, Arrays.stream(LOCAL_CACHE_NAMES));
+    }
+
+    /**
+     * Applies the default Infinispan cache configuration to the {@code holder}, if the cache is not present.
+     * <p>
+     * Each cache may have its own default configuration.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches will be defined.
+     */
+    public static void applyDefaultConfiguration(ConfigurationBuilderHolder holder) {
+        var configs = holder.getNamedConfigurationBuilders();
+        for (var name : InfinispanConnectionProvider.ALL_CACHES_NAME) {
+            configs.computeIfAbsent(name, cacheName -> DEFAULT_CONFIGS.getOrDefault(cacheName, TO_NULL).get());
+        }
+    }
+
+    /**
+     * Verifies that all the {@code caches} are defined in the {@code holder}.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches are configured.
+     * @param caches The {@link Stream} containing the names of the caches to check.
+     * @throws IllegalStateException if one or more Infinispan caches from the provided {@code caches} stream are not
+     *                               defined in the {@code holder}. This could indicate a missing or incorrect
+     *                               configuration for those specific caches.
+     */
+    public static void checkCachesExist(ConfigurationBuilderHolder holder, Stream<String> caches) {
+        for (var it = caches.iterator(); it.hasNext(); ) {
+            var cache = it.next();
+            var builder = holder.getNamedConfigurationBuilders().get(cache);
+            if (builder == null) {
+                throw cacheNotFound(cache);
+            }
+        }
+    }
+
+    /**
+     * Validates that the "work" cache is present in the {@code holder} and has a valid configuration.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches are configured.
+     * @throws IllegalStateException if the "work" cache is not found in the holder.
+     * @throws RuntimeException      if the "work" cache has an invalid configuration. This could include an incorrect
+     *                               settings that would prevent the cache from functioning correctly.
+     */
+    public static void validateWorkCacheConfiguration(ConfigurationBuilderHolder holder) {
+        logger.debugf("Validating %s cache configuration", WORK_CACHE_NAME);
+        var cacheBuilder = holder.getNamedConfigurationBuilders().get(WORK_CACHE_NAME);
+        if (cacheBuilder == null) {
+            throw cacheNotFound(WORK_CACHE_NAME);
+        }
+        if (holder.getGlobalConfigurationBuilder().cacheContainer().transport().getTransport() == null) {
+            // non-clustered, Keycloak started in dev mode?
+            return;
+        }
+        var cacheMode = cacheBuilder.clustering().cacheMode();
+        if (!cacheMode.isReplicated()) {
+            throw new RuntimeException("Unable to start Keycloak. '%s' cache must be replicated but is %s".formatted(WORK_CACHE_NAME, cacheMode.friendlyCacheModeString().toLowerCase()));
+        }
+    }
+
+    /**
+     * Removes clustered caches from the {@code holder}.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches are configured.
+     */
+    public static void removeClusteredCaches(ConfigurationBuilderHolder holder) {
+        logger.debug("Removing clustered caches");
+        Arrays.stream(InfinispanConnectionProvider.CLUSTERED_CACHE_NAMES).forEach(holder.getNamedConfigurationBuilders()::remove);
+    }
+
+    /**
+     * Configures the maximum number of entries for the specified caches, bounding them to this limit and preventing
+     * excessive memory usage.
+     *
+     * @param keycloakConfig The Keycloak configuration, which provides the maximum entry counts for the caches.
+     * @param holder         The {@link ConfigurationBuilderHolder} where the caches are configured.
+     * @param caches         The {@link Stream} containing the names of the caches to configure with a maximum count.
+     * @throws IllegalStateException if an Infinispan cache from the provided {@code caches} stream is not defined in
+     *                               the {@code holder}. This could indicate a missing or incorrect configuration.
+     */
+    public static void configureCacheMaxCount(Config.Scope keycloakConfig, ConfigurationBuilderHolder holder, Stream<String> caches) {
+        for (var it = caches.iterator(); it.hasNext(); ) {
+            var name = it.next();
+            var builder = holder.getNamedConfigurationBuilders().get(name);
+            if (builder == null) {
+                throw cacheNotFound(name);
+            }
+            setMemoryMaxCount(keycloakConfig, name, builder);
+        }
+    }
+
+    /**
+     * Configures all the sessions caches when persistent user sessions feature is enabled.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches are configured.
+     * @throws IllegalStateException if an Infinispan cache from the provided {@code caches} stream is not defined in
+     *                               the {@code holder}. This could indicate a missing or incorrect configuration.
+     */
+    public static void configureSessionsCachesForPersistentSessions(ConfigurationBuilderHolder holder) {
+        logger.debug("Configuring session cache (persistent user sessions)");
+        for (var name : Arrays.asList(USER_SESSION_CACHE_NAME, CLIENT_SESSION_CACHE_NAME, OFFLINE_USER_SESSION_CACHE_NAME, OFFLINE_CLIENT_SESSION_CACHE_NAME)) {
+            var builder = holder.getNamedConfigurationBuilders().get(name);
+            if (builder == null) {
+                throw cacheNotFound(name);
+            }
+            if (builder.memory().maxCount() == -1) {
+                logger.infof("Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for %s to 10000 entries.", name);
+                builder.memory().maxCount(10000);
+            }
+            /* The number of owners for these caches then need to be set to `1` to avoid backup owners with inconsistent data.
+             As primary owner evicts a key based on its locally evaluated maxCount setting, it wouldn't tell the backup owner about this, and then the backup owner would be left with a soon-to-be-outdated key.
+             While a `remove` is forwarded to the backup owner regardless if the key exists on the primary owner, a `computeIfPresent` is not, and it would leave a backup owner with an outdated key.
+             With the number of owners set to `1`, there will be no backup owners, so this is the setting to choose with persistent sessions enabled to ensure consistent data in the caches. */
+            builder.clustering().hash().numOwners(1);
+        }
+    }
+
+    /**
+     * Configures all the sessions caches when persistent user sessions feature is enabled.
+     *
+     * @param holder The {@link ConfigurationBuilderHolder} where the caches are configured.
+     * @throws IllegalStateException if an Infinispan cache from the provided {@code caches} stream is not defined in
+     *                               the {@code holder}. This could indicate a missing or incorrect configuration.
+     */
+    public static void configureSessionsCachesForVolatileSessions(ConfigurationBuilderHolder holder) {
+        logger.debug("Configuring session cache (volatile user sessions)");
+        for (var name : Arrays.asList(USER_SESSION_CACHE_NAME, CLIENT_SESSION_CACHE_NAME)) {
+            var builder = holder.getNamedConfigurationBuilders().get(name);
+            if (builder == null) {
+                throw cacheNotFound(name);
+            }
+            if (builder.memory().maxCount() != -1) {
+                logger.infof("Persistent user sessions disabled and memory limit is set. Ignoring cache limits to avoid losing sessions for cache %s.", name);
+                builder.memory().maxCount(-1);
+            }
+            if (builder.clustering().hash().attributes().attribute(HashConfiguration.NUM_OWNERS).get() == 1 &&
+                  builder.persistence().stores().stream().noneMatch(p -> p.attributes().attribute(AbstractStoreConfiguration.SHARED).get())
+            ) {
+                logger.infof("Persistent user sessions disabled with number of owners set to default value 1 for cache %s and no shared persistence store configured. Setting num_owners=2 to avoid data loss.", name);
+                builder.clustering().hash().numOwners(2);
+            }
+        }
+
+        for (var name : Arrays.asList( OFFLINE_USER_SESSION_CACHE_NAME, OFFLINE_CLIENT_SESSION_CACHE_NAME)) {
+            var builder = holder.getNamedConfigurationBuilders().get(name);
+            if (builder == null) {
+                throw cacheNotFound(name);
+            }
+            if (builder.memory().maxCount() == -1) {
+                logger.infof("Offline sessions should have a max count set to avoid excessive memory usage. Setting a default cache limit of 10000 for cache %s.", name);
+                builder.memory().maxCount(10000);
+            }
+            if (builder.clustering().hash().attributes().attribute(HashConfiguration.NUM_OWNERS).get() != 1 &&
+                    builder.persistence().stores().stream().noneMatch(p -> p.attributes().attribute(AbstractStoreConfiguration.SHARED).get())
+            ) {
+                logger.infof("Setting a memory limit implies to have exactly one owne. Setting num_owners=1 to avoid data loss.", name);
+                builder.clustering().hash().numOwners(1);
+            }
+        }
+    }
+
+    // private methods below
+
+    private static void configureRevisionCache(ConfigurationBuilderHolder holder, String baseCache, String revisionCache, long defaultMaxEntries) {
+        var baseBuilder = holder.getNamedConfigurationBuilders().get(baseCache);
+        if (baseBuilder == null) {
+            throw cacheNotFound(baseCache);
+        }
+        var maxCount = baseBuilder.memory().maxCount();
+        maxCount = maxCount > 0 ? 2 * maxCount : defaultMaxEntries;
+        logger.debugf("Creating revision cache '%s' with max-count %s", revisionCache, maxCount);
+        holder.getNamedConfigurationBuilders().put(revisionCache, getRevisionCacheConfig(maxCount));
+    }
+
+    private static void setMemoryMaxCount(Config.Scope keycloakConfig, String name, ConfigurationBuilder builder) {
+        var maxCount = keycloakConfig.getInt(maxCountConfigKey(name));
+        if (maxCount != null) {
+            logger.debugf("Overwriting max-count for cache '%s' to %s entries", name, maxCount);
+            builder.memory().maxCount(maxCount);
+        }
+    }
+
+    public static String maxCountConfigKey(String name) {
+        return name + MAX_COUNT_SUFFIX;
+    }
+
+    private static IllegalStateException cacheNotFound(String cache) {
+        return new IllegalStateException("Infinispan cache '%s' not found.".formatted(cache));
+    }
+
+    // cache configuration below
+
+    public static ConfigurationBuilder getCrlCacheConfig() {
+        var builder = createCacheConfigurationBuilder();
+        builder.memory().whenFull(EvictionStrategy.REMOVE).maxCount(InfinispanConnectionProvider.CRL_CACHE_DEFAULT_MAX);
+        return builder;
+    }
+
+    public static ConfigurationBuilder getRevisionCacheConfig(long maxEntries) {
+        var builder = createCacheConfigurationBuilder();
+        builder.simpleCache(false);
+        builder.invocationBatching().enable().transaction().transactionMode(TransactionMode.TRANSACTIONAL);
+
+        // Use Embedded manager even in managed ( wildfly/eap ) environment. We don't want infinispan to participate in global transaction
+        builder.transaction().transactionManagerLookup(new EmbeddedTransactionManagerLookup());
+
+        builder.transaction().lockingMode(LockingMode.PESSIMISTIC);
+        if (builder.memory().storage().canStoreReferences()) {
+            builder.encoding().mediaType(MediaType.APPLICATION_OBJECT_TYPE);
+        }
+
+        builder.memory().whenFull(EvictionStrategy.REMOVE).maxCount(maxEntries);
+
+        return builder;
+    }
+
+    public static ConfigurationBuilder createCacheConfigurationBuilder() {
+        ConfigurationBuilder builder = new ConfigurationBuilder();
+
+        // need to force the encoding to application/x-java-object to avoid unnecessary conversion of keys/values. See WFLY-14356.
+        builder.encoding().mediaType(MediaType.APPLICATION_OBJECT_TYPE);
+
+        // needs to be disabled if transaction is enabled
+        builder.simpleCache(true);
+
+        return builder;
+    }
+
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/DefaultCacheEmbeddedConfigProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/DefaultCacheEmbeddedConfigProviderFactory.java
new file mode 100644
index 000000000000..26e846b7628a
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/DefaultCacheEmbeddedConfigProviderFactory.java
@@ -0,0 +1,252 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl.embedded;
+
+import java.io.IOException;
+import java.lang.invoke.MethodHandles;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Stream;
+
+import io.micrometer.core.instrument.Metrics;
+import org.infinispan.configuration.cache.ConfigurationBuilder;
+import org.infinispan.configuration.cache.StatisticsConfigurationBuilder;
+import org.infinispan.configuration.global.ShutdownHookBehavior;
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.configuration.parsing.ParserRegistry;
+import org.infinispan.metrics.config.MicrometerMeterRegisterConfigurationBuilder;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.config.CachingOptions;
+import org.keycloak.config.MetricsOptions;
+import org.keycloak.infinispan.module.configuration.global.KeycloakConfigurationBuilder;
+import org.keycloak.infinispan.util.InfinispanUtils;
+import org.keycloak.marshalling.Marshalling;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProvider;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderFactory;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+import org.keycloak.spi.infinispan.impl.Util;
+
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.ALL_CACHES_NAME;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLUSTERED_MAX_COUNT_CACHES;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.LOCAL_CACHE_NAMES;
+import static org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator.createJGroupsProperties;
+
+/**
+ * The default implementation of {@link CacheEmbeddedConfigProviderFactory}.
+ * <p>
+ * It builds a {@link ConfigurationBuilderHolder} based on the Keycloak configuration.
+ * <p>
+ * Advanced users may extend this class and overwrite the method {@link #createConfiguration(KeycloakSessionFactory)}.
+ * They have access to the {@link ConfigurationBuilderHolder}, and they can modify it as needed for their custom
+ * providers.
+ */
+public class DefaultCacheEmbeddedConfigProviderFactory implements CacheEmbeddedConfigProviderFactory, CacheEmbeddedConfigProvider {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+
+    public static final String PROVIDER_ID = "default";
+
+    // Configuration
+    public static final String CONFIG = "configFile";
+    private static final String METRICS = "metricsEnabled";
+    private static final String HISTOGRAMS = "metricsHistogramsEnabled";
+    public static final String STACK = "stack";
+    public static final String NODE_NAME = "nodeName";
+    public static final String SITE_NAME = "siteName";
+
+    private volatile ConfigurationBuilderHolder builderHolder;
+    private volatile Config.Scope keycloakConfig;
+
+    @Override
+    public CacheEmbeddedConfigProvider create(KeycloakSession session) {
+        lazyInit(session.getKeycloakSessionFactory());
+        return this;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.keycloakConfig = config;
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        lazyInit(factory);
+    }
+
+    @Override
+    public ConfigurationBuilderHolder configuration() {
+        return builderHolder;
+    }
+
+    @Override
+    public void close() {
+        //no-op
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        var builder = ProviderConfigurationBuilder.create();
+        Util.copyFromOption(builder, CONFIG, "file", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_CONFIG_FILE, false);
+        Util.copyFromOption(builder, HISTOGRAMS, "enabled", ProviderConfigProperty.BOOLEAN_TYPE, CachingOptions.CACHE_METRICS_HISTOGRAMS_ENABLED, false);
+        Util.copyFromOption(builder, METRICS, "enabled", ProviderConfigProperty.BOOLEAN_TYPE, MetricsOptions.INFINISPAN_METRICS_ENABLED, false);
+        Stream.concat(Arrays.stream(LOCAL_CACHE_NAMES), Arrays.stream(CLUSTERED_MAX_COUNT_CACHES))
+                .forEach(name -> Util.copyFromOption(builder, CacheConfigurator.maxCountConfigKey(name), "max-count", ProviderConfigProperty.INTEGER_TYPE, CachingOptions.maxCountOption(name), false));
+        createTopologyProperties(builder);
+        createJGroupsProperties(builder);
+        return builder.build();
+    }
+
+    @Override
+    public Set<Class<? extends Provider>> dependsOn() {
+        return Set.of(JGroupsCertificateProvider.class);
+    }
+
+    private void lazyInit(KeycloakSessionFactory factory) {
+        if (builderHolder != null) {
+            return;
+        }
+        synchronized (this) {
+            if (builderHolder != null) {
+                return;
+            }
+            try {
+                builderHolder = createConfiguration(factory);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    protected ConfigurationBuilderHolder createConfiguration(KeycloakSessionFactory factory) throws IOException {
+        var holder = parseConfiguration(keycloakConfig, factory);
+        if (InfinispanUtils.isRemoteInfinispan()) {
+            return configureMultiSite(holder, keycloakConfig);
+        }
+        if (Profile.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS)) {
+            return configureSingleSiteWithPersistentSessions(holder, keycloakConfig, factory);
+        }
+        return configureSingleSiteWithVolatileSessions(holder, keycloakConfig, factory);
+    }
+
+    private static ConfigurationBuilderHolder configureSingleSiteWithVolatileSessions(ConfigurationBuilderHolder holder, Config.Scope keycloakConfig, KeycloakSessionFactory factory) {
+        singleSiteConfiguration(keycloakConfig, holder, factory);
+        CacheConfigurator.configureSessionsCachesForVolatileSessions(holder);
+        return holder;
+    }
+
+    private static ConfigurationBuilderHolder configureSingleSiteWithPersistentSessions(ConfigurationBuilderHolder holder, Config.Scope keycloakConfig, KeycloakSessionFactory factory) {
+        singleSiteConfiguration(keycloakConfig, holder, factory);
+        CacheConfigurator.configureSessionsCachesForPersistentSessions(holder);
+        return holder;
+    }
+
+    private static ConfigurationBuilderHolder configureMultiSite(ConfigurationBuilderHolder holder, Config.Scope keycloakConfig) {
+        logger.debug("Configuring Infinispan for multi-site deployment");
+        CacheConfigurator.removeClusteredCaches(holder);
+        CacheConfigurator.checkCachesExist(holder, Arrays.stream(LOCAL_CACHE_NAMES));
+        configureMetrics(keycloakConfig, holder);
+        // Disable JGroups, not required when the data is stored in the Remote Cache.
+        // The existing caches are local and do not require JGroups to work properly.
+        holder.getGlobalConfigurationBuilder().nonClusteredDefault();
+        return holder;
+    }
+
+    private static ConfigurationBuilderHolder parseConfiguration(Config.Scope keycloakConfig, KeycloakSessionFactory factory) throws IOException {
+        var configFile = keycloakConfig.get(CONFIG);
+        if (configFile == null) {
+            throw new IllegalArgumentException("Option 'configFile' needs to be specified");
+        }
+        var configPath = Paths.get(configFile);
+        var path = configPath.toFile().exists() ?
+                configPath.toFile().getAbsolutePath() :
+                configPath.getFileName().toString();
+
+        logger.debugf("Parsing Infinispan configuration from file: %s", path);
+        var holder = new ParserRegistry(DefaultCacheEmbeddedConfigProviderFactory.class.getClassLoader())
+                .parseFile(path);
+        // We must disable the Infinispan default ShutdownHook as we manage the EmbeddedCacheManager lifecycle explicitly
+        // with #shutdown and multiple calls to EmbeddedCacheManager#stop can lead to Exceptions being thrown.
+        holder.getGlobalConfigurationBuilder().shutdown().hookBehavior(ShutdownHookBehavior.DONT_REGISTER);
+        Marshalling.configure(holder.getGlobalConfigurationBuilder());
+        holder.getGlobalConfigurationBuilder()
+                .addModule(KeycloakConfigurationBuilder.class)
+                .setKeycloakSessionFactory(factory);
+        CacheConfigurator.applyDefaultConfiguration(holder);
+        CacheConfigurator.configureLocalCaches(keycloakConfig, holder);
+        JGroupsConfigurator.configureTopology(keycloakConfig, holder);
+        return holder;
+    }
+
+    private static void singleSiteConfiguration(Config.Scope config, ConfigurationBuilderHolder holder, KeycloakSessionFactory factory) {
+        logger.debug("Configuring Infinispan for single-site deployment");
+        CacheConfigurator.checkCachesExist(holder, Arrays.stream(ALL_CACHES_NAME));
+        CacheConfigurator.configureCacheMaxCount(config, holder, Arrays.stream(CLUSTERED_MAX_COUNT_CACHES));
+        CacheConfigurator.validateWorkCacheConfiguration(holder);
+        KeycloakModelUtils.runJobInTransaction(factory, session -> JGroupsConfigurator.configureJGroups(config, holder, session));
+        configureMetrics(config, holder);
+    }
+
+    private static void configureMetrics(Config.Scope keycloakConfig, ConfigurationBuilderHolder holder) {
+        //metrics are disabled by default (check MetricsOptions class)
+        if (keycloakConfig.getBoolean(METRICS, Boolean.FALSE)) {
+            logger.debug("Enabling Infinispan metrics");
+            var builder = holder.getGlobalConfigurationBuilder();
+            builder.addModule(MicrometerMeterRegisterConfigurationBuilder.class)
+                    .meterRegistry(Metrics.globalRegistry);
+            builder.cacheContainer().statistics(true);
+            builder.metrics()
+                    .namesAsTags(true)
+                    .histograms(keycloakConfig.getBoolean(HISTOGRAMS, Boolean.FALSE));
+            holder.getNamedConfigurationBuilders()
+                    .values()
+                    .stream()
+                    .map(ConfigurationBuilder::statistics)
+                    .forEach(StatisticsConfigurationBuilder::enable);
+        }
+    }
+
+    private static void createTopologyProperties(ProviderConfigurationBuilder builder) {
+        builder.property()
+                .name(NODE_NAME)
+                .helpText("Sets the name of the current node. This is a friendly name to make logs, etc. make more sense.")
+                .label("name")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add();
+        builder.property()
+                .name(SITE_NAME)
+                .helpText("The name of the site where this node runs. Used for server hinting.")
+                .label("name")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add();
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/JGroupsConfigurator.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/JGroupsConfigurator.java
new file mode 100644
index 000000000000..3af902bfc971
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/embedded/JGroupsConfigurator.java
@@ -0,0 +1,357 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl.embedded;
+
+import static org.infinispan.configuration.global.TransportConfiguration.STACK;
+import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_PREFIX;
+
+import java.lang.invoke.MethodHandles;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLServerSocket;
+import javax.net.ssl.TrustManager;
+
+import org.infinispan.commons.configuration.attributes.Attribute;
+import org.infinispan.configuration.global.TransportConfigurationBuilder;
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.remoting.transport.jgroups.EmbeddedJGroupsChannelConfigurator;
+import org.infinispan.remoting.transport.jgroups.JGroupsTransport;
+import org.jboss.logging.Logger;
+import org.jgroups.Global;
+import org.jgroups.conf.ClassConfigurator;
+import org.jgroups.conf.ProtocolConfiguration;
+import org.jgroups.protocols.TCP;
+import org.jgroups.protocols.TCP_NIO2;
+import org.jgroups.protocols.UDP;
+import org.jgroups.stack.Protocol;
+import org.jgroups.util.DefaultSocketFactory;
+import org.jgroups.util.SocketFactory;
+import org.keycloak.Config;
+import org.keycloak.config.CachingOptions;
+import org.keycloak.config.Option;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+import org.keycloak.connections.infinispan.InfinispanConnectionSpi;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.connections.jpa.JpaConnectionProviderFactory;
+import org.keycloak.connections.jpa.util.JpaUtils;
+import org.keycloak.infinispan.util.InfinispanUtils;
+import org.keycloak.jgroups.protocol.KEYCLOAK_JDBC_PING2;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+import org.keycloak.spi.infinispan.impl.Util;
+
+/**
+ * Utility class to configure JGroups based on the Keycloak configuration.
+ */
+public final class JGroupsConfigurator {
+
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+    private static final String TLS_PROTOCOL_VERSION = "TLSv1.3";
+    private static final String TLS_PROTOCOL = "TLS";
+
+    private JGroupsConfigurator() {
+    }
+
+    static {
+        // Use custom Keycloak JDBC_PING implementation that workarounds issue https://issues.redhat.com/browse/JGRP-2870
+        // The id 1025 follows this instruction: https://github.com/belaban/JGroups/blob/38219e9ec1c629fa2f7929e3b53d1417d8e60b61/conf/jg-protocol-ids.xml#L85
+        ClassConfigurator.addProtocol((short) 1025, KEYCLOAK_JDBC_PING2.class);
+    }
+
+    /**
+     * Configures JGroups based on the Keycloak configuration.
+     *
+     * @param config  The Keycloak configuration.
+     * @param holder  The {@link ConfigurationBuilderHolder} where the transport is configured.
+     * @param session The {@link KeycloakSession} sessions for Database access.
+     */
+    public static void configureJGroups(Config.Scope config, ConfigurationBuilderHolder holder, KeycloakSession session) {
+        var stack = config.get(DefaultCacheEmbeddedConfigProviderFactory.STACK);
+        if (stack != null) {
+            transportOf(holder).stack(stack);
+        }
+        configureTransport(config);
+        configureDiscovery(holder, session);
+        configureTls(holder, session);
+        warnDeprecatedStack(holder);
+    }
+
+    /**
+     * Configures the topology information in the Infinispan transport.
+     *
+     * @param config The Keycloak configuration.
+     * @param holder The {@link ConfigurationBuilderHolder} where the transport is configured.
+     */
+    public static void configureTopology(Config.Scope config, ConfigurationBuilderHolder holder) {
+        if (System.getProperty(InfinispanConnectionProvider.JBOSS_SITE_NAME) != null) {
+            throw new IllegalArgumentException(
+                    String.format("System property %s is in use. Use --spi-cache-embedded-%s-site-name config option instead",
+                            InfinispanConnectionProvider.JBOSS_SITE_NAME, DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID));
+        }
+        if (System.getProperty(InfinispanConnectionProvider.JBOSS_NODE_NAME) != null) {
+            throw new IllegalArgumentException(
+                    String.format("System property %s is in use. Use --spi-cache-embedded-%s-node-name config option instead",
+                            InfinispanConnectionProvider.JBOSS_NODE_NAME, DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID));
+        }
+        var transport = transportOf(holder);
+        var nodeName = config.get(DefaultCacheEmbeddedConfigProviderFactory.NODE_NAME);
+        if (nodeName != null) {
+            transport.nodeName(nodeName);
+        }
+        //legacy option, for backwards compatibility --spi-connections-infinispan-quarkus-site-name
+        var legacySiteName = Config.scope(InfinispanConnectionSpi.SPI_NAME, "quarkus").get("site-name");
+        if (legacySiteName != null) {
+            logger.warn("--spi-connections-infinispan-quarkus-site-name is deprecated and may be removed in the future. Use --spi-cache-embedded-%s-site-name".formatted(DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID));
+        }
+        var siteName = config.get(DefaultCacheEmbeddedConfigProviderFactory.SITE_NAME, legacySiteName);
+        if (siteName != null) {
+            transport.siteId(siteName);
+        }
+    }
+
+    static void createJGroupsProperties(ProviderConfigurationBuilder builder) {
+        Util.copyFromOption(builder, SystemProperties.BIND_ADDRESS.configKey, "address", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_ADDRESS, false);
+        Util.copyFromOption(builder, SystemProperties.BIND_PORT.configKey, "port", ProviderConfigProperty.INTEGER_TYPE, CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_PORT, false);
+        Util.copyFromOption(builder, SystemProperties.EXTERNAL_ADDRESS.configKey, "address", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS, false);
+        Util.copyFromOption(builder, SystemProperties.EXTERNAL_PORT.configKey, "port", ProviderConfigProperty.INTEGER_TYPE, CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT, false);
+    }
+
+    private static void configureTransport(Config.Scope config) {
+        Arrays.stream(SystemProperties.values()).forEach(p -> p.set(config));
+    }
+
+    private static void configureTls(ConfigurationBuilderHolder holder, KeycloakSession session) {
+        var provider = session.getProvider(JGroupsCertificateProvider.class);
+        if (provider == null || !provider.isEnabled()) {
+            return;
+        }
+        var factory = createSocketFactory(provider);
+        transportOf(holder).addProperty(JGroupsTransport.SOCKET_FACTORY, factory);
+        validateTlsAvailable(holder);
+        logger.info("JGroups Encryption enabled (mTLS).");
+    }
+
+    private static SocketFactory createSocketFactory(JGroupsCertificateProvider provider) {
+        try {
+            var sslContext = SSLContext.getInstance(TLS_PROTOCOL);
+            sslContext.init(new KeyManager[]{provider.keyManager()}, new TrustManager[]{provider.trustManager()}, null);
+            return createFromContext(sslContext);
+        } catch (KeyManagementException | NoSuchAlgorithmException e) {
+            // we should have valid certificates and keys.
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static SocketFactory createFromContext(SSLContext context) {
+        DefaultSocketFactory socketFactory = new DefaultSocketFactory(context);
+        final SSLParameters serverParameters = new SSLParameters();
+        serverParameters.setProtocols(new String[]{TLS_PROTOCOL_VERSION});
+        serverParameters.setNeedClientAuth(true);
+        socketFactory.setServerSocketConfigurator(socket -> ((SSLServerSocket) socket).setSSLParameters(serverParameters));
+        return socketFactory;
+    }
+
+    private static void configureDiscovery(ConfigurationBuilderHolder holder, KeycloakSession session) {
+        var stackXmlAttribute = transportStackOf(holder);
+        if (stackXmlAttribute.isModified() && !isJdbcPingStack(stackXmlAttribute.get())) {
+            logger.debugf("Custom stack configured (%s). JDBC_PING discovery disabled.", stackXmlAttribute.get());
+            return;
+        }
+
+        logger.debug("JDBC_PING discovery enabled.");
+        if (!stackXmlAttribute.isModified()) {
+            // defaults to jdbc-ping
+            transportOf(holder).stack("jdbc-ping");
+        }
+
+        var em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        var stackName = transportStackOf(holder).get();
+        var isUdp = stackName.endsWith("udp");
+        var tableName = JpaUtils.getTableNameForNativeQuery("JGROUPS_PING", em);
+        var stack = getProtocolConfigurations(tableName, isUdp);
+        var connectionFactory = (JpaConnectionProviderFactory) session.getKeycloakSessionFactory().getProviderFactory(JpaConnectionProvider.class);
+        holder.addJGroupsStack(new JpaFactoryAwareJGroupsChannelConfigurator(stackName, stack, connectionFactory, isUdp), null);
+
+        transportOf(holder).stack(stackName);
+        JGroupsConfigurator.logger.info("JGroups JDBC_PING discovery enabled.");
+    }
+
+    private static List<ProtocolConfiguration> getProtocolConfigurations(String tableName, boolean udp) {
+        var list = new ArrayList<ProtocolConfiguration>(udp ? 1 : 2);
+        list.add(new ProtocolConfiguration(KEYCLOAK_JDBC_PING2.class.getName(),
+              Map.of(
+                    // Leave initialize_sql blank as table is already created by Keycloak
+                    "initialize_sql", "",
+                    // Explicitly specify clear and select_all SQL to ensure "cluster_name" column is used, as the default
+                    // "cluster" cannot be used with Oracle DB as it's a reserved word.
+                    "clear_sql", String.format("DELETE from %s WHERE cluster_name=?", tableName),
+                    "delete_single_sql", String.format("DELETE from %s WHERE address=?", tableName),
+                    "insert_single_sql", String.format("INSERT INTO %s values (?, ?, ?, ?, ?)", tableName),
+                    "select_all_pingdata_sql", String.format("SELECT address, name, ip, coord FROM %s WHERE cluster_name=?", tableName),
+                    "remove_all_data_on_view_change", "true",
+                    "register_shutdown_hook", "false",
+                    "stack.combine", "REPLACE",
+                    "stack.position", udp ? "PING" : "MPING"
+              ))
+        );
+
+        if (!udp && InfinispanUtils.isVirtualThreadsEnabled())
+            list.add(new ProtocolConfiguration(TCP.class.getSimpleName(), Map.of("bundler_type", "per-destination")));
+
+        return list;
+    }
+
+    private static void warnDeprecatedStack(ConfigurationBuilderHolder holder) {
+        var stackName = transportStackOf(holder).get();
+        switch (stackName) {
+            case "jdbc-ping-udp":
+            case "tcp":
+            case "udp":
+            case "azure":
+            case "ec2":
+            case "google":
+                logger.warnf("Stack '%s' is deprecated. We recommend to use 'jdbc-ping' instead", stackName);
+        }
+    }
+
+    private static TransportConfigurationBuilder transportOf(ConfigurationBuilderHolder holder) {
+        return holder.getGlobalConfigurationBuilder().transport();
+    }
+
+    private static Attribute<String> transportStackOf(ConfigurationBuilderHolder holder) {
+        var transport = transportOf(holder);
+        assert transport != null;
+        return transport.attributes().attribute(STACK);
+    }
+
+    private static void validateTlsAvailable(ConfigurationBuilderHolder holder) {
+        var stackName = transportStackOf(holder).get();
+        if (stackName == null) {
+            // unable to validate
+            return;
+        }
+        var config = transportOf(holder).build();
+        for (var protocol : config.transport().jgroups().configurator(stackName).getProtocolStack()) {
+            var name = protocol.getProtocolName();
+            if (name.equals(UDP.class.getSimpleName()) ||
+                    name.equals(UDP.class.getName()) ||
+                    name.equals(TCP_NIO2.class.getSimpleName()) ||
+                    name.equals(TCP_NIO2.class.getName())) {
+                throw new RuntimeException("Cache TLS is not available with protocol " + name);
+            }
+        }
+    }
+
+    private static boolean isJdbcPingStack(String stackName) {
+        return "jdbc-ping".equals(stackName) || "jdbc-ping-udp".equals(stackName);
+    }
+
+    private static class JpaFactoryAwareJGroupsChannelConfigurator extends EmbeddedJGroupsChannelConfigurator {
+
+        private final JpaConnectionProviderFactory factory;
+
+        public JpaFactoryAwareJGroupsChannelConfigurator(String name, List<ProtocolConfiguration> stack, JpaConnectionProviderFactory factory, boolean isUdp) {
+            super(name, stack, null, isUdp ? "udp" : "tcp");
+            this.factory = Objects.requireNonNull(factory);
+        }
+
+        @Override
+        public void afterCreation(Protocol protocol) {
+            super.afterCreation(protocol);
+            if (protocol instanceof KEYCLOAK_JDBC_PING2 kcPing) {
+                kcPing.setJpaConnectionProviderFactory(factory);
+            }
+        }
+    }
+
+    private enum SystemProperties {
+        BIND_ADDRESS(CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_ADDRESS, Global.BIND_ADDR, "jgroups.bind.address"),
+        BIND_PORT(CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_PORT, Global.BIND_PORT, "jgroups.bind.port"),
+        EXTERNAL_ADDRESS(CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS, Global.EXTERNAL_ADDR),
+        EXTERNAL_PORT(CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT, Global.EXTERNAL_PORT);
+
+        final Option<?> option;
+        final String property;
+        final String altProperty;
+        final String configKey;
+
+        SystemProperties(Option<?> option, String property) {
+            this(option, property, null);
+        }
+
+        SystemProperties(Option<?> option, String property, String altProperty) {
+            this.option = option;
+            this.property = property;
+            this.altProperty = altProperty;
+            this.configKey = configKey();
+        }
+
+        void set(Config.Scope config) {
+            String userConfig = fromConfig(config);
+            if (userConfig == null) {
+                // User property is either already set or missing, so do nothing
+                return;
+            }
+            checkPropertyAlreadySet(userConfig, property);
+            if (altProperty != null)
+                checkPropertyAlreadySet(userConfig, altProperty);
+            System.setProperty(property, userConfig);
+        }
+
+        void checkPropertyAlreadySet(String userValue, String property) {
+            String userProp = System.getProperty(property);
+            if (userProp != null) {
+                logger.warnf("Conflicting system property '%s' and CLI arg '%s' set, utilising CLI value '%s'",
+                      property, option.getKey(), userValue);
+                System.clearProperty(property);
+            }
+        }
+
+        String fromConfig(Config.Scope config) {
+            if (option.getType() == Integer.class) {
+                Integer val = config.getInt(configKey);
+                return val == null ? null : val.toString();
+            }
+            return config.get(configKey);
+        }
+
+        String configKey() {
+            // Strip the scope from the key and convert to camelCase
+            String key = option.getKey().substring(CACHE_EMBEDDED_PREFIX.length() + 1);
+            StringBuilder sb = new StringBuilder(key);
+            for (int i = 0; i < sb.length(); i++) {
+                if (sb.charAt(i) == '-') {
+                    sb.deleteCharAt(i);
+                    sb.replace(i, i+1, String.valueOf(Character.toUpperCase(sb.charAt(i))));
+                }
+            }
+            return sb.toString();
+        }
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DefaultCacheRemoteConfigProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DefaultCacheRemoteConfigProviderFactory.java
new file mode 100644
index 000000000000..d22f88c9e621
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DefaultCacheRemoteConfigProviderFactory.java
@@ -0,0 +1,360 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl.remote;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.lang.invoke.MethodHandles;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+import java.util.Properties;
+
+import org.infinispan.client.hotrod.configuration.AuthenticationConfigurationBuilder;
+import org.infinispan.client.hotrod.configuration.ClientIntelligence;
+import org.infinispan.client.hotrod.configuration.Configuration;
+import org.infinispan.client.hotrod.configuration.ConfigurationBuilder;
+import org.infinispan.client.hotrod.configuration.ExhaustedAction;
+import org.infinispan.client.hotrod.impl.ConfigurationProperties;
+import org.infinispan.commons.dataconversion.MediaType;
+import org.infinispan.configuration.cache.CacheMode;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.config.CachingOptions;
+import org.keycloak.infinispan.util.InfinispanUtils;
+import org.keycloak.marshalling.Marshalling;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProvider;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory;
+
+import javax.net.ssl.SSLContext;
+
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLUSTERED_CACHE_NAMES;
+import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.skipSessionsCacheIfRequired;
+import static org.keycloak.spi.infinispan.impl.Util.copyFromOption;
+import static org.wildfly.security.sasl.util.SaslMechanismInformation.Names.SCRAM_SHA_512;
+
+/**
+ * The default implementation for {@link CacheRemoteConfigProviderFactory} and {@link CacheRemoteConfigProvider}.
+ * <p>
+ * It is used when an external Infinispan cluster is enabled.
+ */
+public class DefaultCacheRemoteConfigProviderFactory implements CacheRemoteConfigProviderFactory, CacheRemoteConfigProvider, EnvironmentDependentProviderFactory {
+
+    public static final String PROVIDER_ID = "default";
+    private static final Logger logger = Logger.getLogger(MethodHandles.lookup().lookupClass());
+
+    // configuration
+    private static final String PROPERTIES_FILE = "propertiesFile";
+    private static final String CLIENT_INTELLIGENCE = "clientIntelligence";
+    public static final String HOSTNAME = "hostname";
+    public static final String PORT = "port";
+    private static final String TLS_ENABLED = "tlsEnabled";
+    private static final String TLS_SNI_HOSTNAME = "tlsSniHostname";
+    private static final String USERNAME = "username";
+    private static final String PASSWORD = "password";
+    private static final String CONNECTION_POOL_MAX_ACTIVE = "connectionPoolMaxActive";
+    private static final String CONNECTION_POOL_EXHAUSTED_ACTION = "connectionPoolExhaustedAction";
+    private static final String AUTH_REALM = "authRealm";
+    private static final String SASL_MECHANISM = "saslMechanism";
+
+    // configuration defaults
+    private static final String CLIENT_INTELLIGENCE_DEFAULT = ClientIntelligence.getDefault().name();
+    private static final int CONNECTION_POOL_MAX_ACTIVE_DEFAULT = 16;
+    private static final String CONNECTION_POOL_EXHAUSTED_ACTION_DEFAULT = ExhaustedAction.CREATE_NEW.name();
+    private static final String SASL_MECHANISM_DEFAULT = SCRAM_SHA_512;
+
+    private volatile Configuration remoteConfiguration;
+    private volatile Config.Scope keycloakConfiguration;
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return InfinispanUtils.isRemoteInfinispan();
+    }
+
+    @Override
+    public CacheRemoteConfigProvider create(KeycloakSession session) {
+        lazyInit();
+        return this;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.keycloakConfiguration = config;
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        lazyInit();
+    }
+
+    @Override
+    public Optional<Configuration> configuration() {
+        assert remoteConfiguration != null;
+        return Optional.of(remoteConfiguration);
+    }
+
+    @Override
+    public void close() {
+        //no-op
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        var builder = ProviderConfigurationBuilder.create();
+        addHostNameAndPortConfig(builder);
+        addClientIntelligenceConfig(builder);
+        addPropertiesFileConfig(builder);
+        addConnectionPoolConfig(builder);
+        addTlsConfig(builder);
+        addAuthenticationConfig(builder);
+        return builder.build();
+    }
+
+    /**
+     * Creates the {@link ConfigurationBuilder}.
+     * <p>
+     * This class is protected if power users need to extend this class for more advanced configuration. Using a
+     * properties file is the recommended way to configure the client in more detail. Check
+     * {@link ConfigurationProperties} for property keys.
+     *
+     * @return The {@link ConfigurationBuilder}. This instance can be modified.
+     * @throws IOException if an error occurred when reading from the properties file (if configured).
+     * @see ConfigurationProperties
+     */
+    protected ConfigurationBuilder createConfigurationBuilder() throws IOException {
+        logger.info("Starting Infinispan remote cache manager (Hot Rod Client)");
+
+        var builder = new ConfigurationBuilder();
+        loadProperties(builder);
+        builder.clientIntelligence(ClientIntelligence.valueOf(keycloakConfiguration.get(CLIENT_INTELLIGENCE, CLIENT_INTELLIGENCE_DEFAULT)));
+        configureHostname(builder);
+        configureConnectionPool(builder);
+        configureTls(builder);
+        configureAuthentication(builder);
+        Marshalling.configure(builder);
+        configureRemoteCaches(builder);
+
+        return builder;
+    }
+
+    private void lazyInit() {
+        if (remoteConfiguration != null) {
+            return;
+        }
+        synchronized (this) {
+            if (remoteConfiguration != null) {
+                return;
+            }
+            try {
+                remoteConfiguration = createConfigurationBuilder().build();
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    private void loadProperties(ConfigurationBuilder builder) throws IOException {
+        var path = keycloakConfiguration.get(PROPERTIES_FILE);
+        if (path == null) {
+            logger.debug("Hot Rod properties file not configured.");
+            return;
+        }
+        var file = new File(path);
+        if (!file.exists()) {
+            throw new RuntimeException("Hot Rod properties file not found: " + path);
+        }
+        try (var is = new FileInputStream(file)) {
+            var properties = new Properties();
+            properties.load(is);
+            builder.withProperties(properties);
+        }
+    }
+
+    private void configureHostname(ConfigurationBuilder builder) {
+        var host = keycloakConfiguration.get(HOSTNAME);
+        if (host == null) {
+            logger.debug("Hot Rod hostname not configured.");
+            return;
+        }
+        var port = keycloakConfiguration.getInt(PORT, ConfigurationProperties.DEFAULT_HOTROD_PORT);
+        logger.debugf("Hot Rod connecting to %s:%s", host, port);
+
+        builder.addServer()
+                .host(host)
+                .port(port);
+    }
+
+    private void configureConnectionPool(ConfigurationBuilder builder) {
+        builder.connectionPool()
+                .maxActive(keycloakConfiguration.getInt(CONNECTION_POOL_MAX_ACTIVE, CONNECTION_POOL_MAX_ACTIVE_DEFAULT))
+                .exhaustedAction(ExhaustedAction.valueOf(keycloakConfiguration.get(CONNECTION_POOL_EXHAUSTED_ACTION, CONNECTION_POOL_EXHAUSTED_ACTION_DEFAULT)));
+    }
+
+    private void configureTls(ConfigurationBuilder builder) {
+        if (!keycloakConfiguration.getBoolean(TLS_ENABLED, Boolean.FALSE)) {
+            logger.debug("Hot Rod TLS not enabled.");
+            return;
+        }
+        var sniHostName = keycloakConfiguration.get(TLS_SNI_HOSTNAME);
+        if (sniHostName == null) {
+            sniHostName = keycloakConfiguration.get(HOSTNAME);
+        }
+        builder.security().ssl()
+                .enable()
+                .sslContext(createSSLContext())
+                .sniHostName(sniHostName);
+    }
+
+    private void configureAuthentication(ConfigurationBuilder builder) {
+        var username = keycloakConfiguration.get(USERNAME);
+        var password = keycloakConfiguration.get(PASSWORD);
+        if (username == null && password == null) {
+            logger.debug("Hot Rod authentication not enabled.");
+            return;
+        }
+        builder.security().authentication()
+                .enable()
+                .username(username)
+                .password(password)
+                .realm(keycloakConfiguration.get(AUTH_REALM, AuthenticationConfigurationBuilder.DEFAULT_REALM))
+                .saslMechanism(keycloakConfiguration.get(SASL_MECHANISM, SASL_MECHANISM_DEFAULT));
+    }
+
+    private static SSLContext createSSLContext() {
+        try {
+            // uses the default Java Runtime TrustStore, or the one generated by Keycloak (see org.keycloak.truststore.TruststoreBuilder)
+            var sslContext = SSLContext.getInstance("TLS");
+            sslContext.init(null, null, null);
+            return sslContext;
+        } catch (NoSuchAlgorithmException | KeyManagementException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static boolean shouldCreateRemoteCaches() {
+        // TODO convert to SPI option when we want to support this feature
+        // http://github.com/keycloak/keycloak/issues/32129
+        return Boolean.getBoolean("kc.cache-remote-create-caches");
+    }
+
+    private static void configureRemoteCaches(ConfigurationBuilder builder) {
+        if (!shouldCreateRemoteCaches()) {
+            return;
+        }
+        // fall back for distributed caches if not defined
+        logger.warn("Creating remote cache in external Infinispan server. It should not be used in production!");
+        var baseConfig = defaultRemoteCacheBuilder();
+
+        skipSessionsCacheIfRequired(Arrays.stream(CLUSTERED_CACHE_NAMES))
+                .forEach(name -> builder.remoteCache(name).configuration(baseConfig.toStringConfiguration(name)));
+    }
+
+    private static org.infinispan.configuration.cache.Configuration defaultRemoteCacheBuilder() {
+        var builder = new org.infinispan.configuration.cache.ConfigurationBuilder();
+        builder.clustering().cacheMode(CacheMode.DIST_SYNC);
+        builder.encoding().mediaType(MediaType.APPLICATION_PROTOSTREAM);
+        return builder.build();
+    }
+
+    // configuration option below
+
+    private static void addHostNameAndPortConfig(ProviderConfigurationBuilder builder) {
+        copyFromOption(builder, HOSTNAME, "hostname", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_REMOTE_HOST, false);
+        copyFromOption(builder, PORT, "port", ProviderConfigProperty.INTEGER_TYPE, CachingOptions.CACHE_REMOTE_PORT, false);
+    }
+
+    private static void addClientIntelligenceConfig(ProviderConfigurationBuilder builder) {
+        builder.property()
+                .name(CLIENT_INTELLIGENCE)
+                .helpText("Specifies the level of intelligence the Hot Rod client should have.")
+                .label("intelligence")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .defaultValue(CLIENT_INTELLIGENCE_DEFAULT)
+                .options(Arrays.stream(ClientIntelligence.values()).map(Enum::name).toList())
+                .add();
+    }
+
+    private static void addPropertiesFileConfig(ProviderConfigurationBuilder builder) {
+        builder.property()
+                .name(PROPERTIES_FILE)
+                .helpText("Path to the properties file with the Hot Rod client configuration.")
+                .label("file")
+                .type(ProviderConfigProperty.FILE_TYPE)
+                .add();
+    }
+
+    private static void addConnectionPoolConfig(ProviderConfigurationBuilder builder) {
+        builder.property()
+                .name(CONNECTION_POOL_MAX_ACTIVE)
+                .helpText("Sets the maximum number of connections per Infinispan server instance.")
+                .label("maxActive")
+                .type(ProviderConfigProperty.INTEGER_TYPE)
+                .defaultValue(CONNECTION_POOL_MAX_ACTIVE_DEFAULT)
+                .add();
+        builder.property()
+                .name(CONNECTION_POOL_EXHAUSTED_ACTION)
+                .helpText("Specifies what happens when asking for a connection from a server's pool, and that pool is exhausted.")
+                .label("action")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .defaultValue(CONNECTION_POOL_EXHAUSTED_ACTION_DEFAULT)
+                .options(Arrays.stream(ExhaustedAction.values()).map(Enum::name).toList())
+                .add();
+    }
+
+    private static void addAuthenticationConfig(ProviderConfigurationBuilder builder) {
+        copyFromOption(builder, USERNAME, "username", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_REMOTE_USERNAME, false);
+        copyFromOption(builder, PASSWORD, "password", ProviderConfigProperty.STRING_TYPE, CachingOptions.CACHE_REMOTE_PASSWORD, true);
+        builder.property()
+                .name(AUTH_REALM)
+                .helpText("Specifies the Infinispan server realm to be used for authentication.")
+                .label("realm")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .defaultValue(AuthenticationConfigurationBuilder.DEFAULT_REALM)
+                .add();
+        builder.property()
+                .name(SASL_MECHANISM)
+                .helpText("Selects the SASL mechanism to use for the connection to the Infinispan server.")
+                .label("mechanism")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .defaultValue(SASL_MECHANISM_DEFAULT)
+                .add();
+    }
+
+    private static void addTlsConfig(ProviderConfigurationBuilder builder) {
+        copyFromOption(builder, TLS_ENABLED, "enabled", ProviderConfigProperty.BOOLEAN_TYPE, CachingOptions.CACHE_REMOTE_TLS_ENABLED, false);
+        builder.property()
+                .name(TLS_SNI_HOSTNAME)
+                .helpText("Specifies the TLS SNI hostname for the connection to the Infinispan server.")
+                .label("hostname")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add();
+    }
+}
diff --git a/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DisabledCacheRemoteConfigProviderFactory.java b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DisabledCacheRemoteConfigProviderFactory.java
new file mode 100644
index 000000000000..a721c9d27251
--- /dev/null
+++ b/model/infinispan/src/main/java/org/keycloak/spi/infinispan/impl/remote/DisabledCacheRemoteConfigProviderFactory.java
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.spi.infinispan.impl.remote;
+
+import java.util.Optional;
+
+import org.infinispan.client.hotrod.configuration.Configuration;
+import org.keycloak.Config;
+import org.keycloak.infinispan.util.InfinispanUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProvider;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory;
+
+/**
+ * Implementation used when an external Infinispan cluster is not configured.
+ */
+public class DisabledCacheRemoteConfigProviderFactory implements CacheRemoteConfigProviderFactory, CacheRemoteConfigProvider, EnvironmentDependentProviderFactory {
+
+    private static final String PROVIDER_ID = "disabled";
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return !InfinispanUtils.isRemoteInfinispan();
+    }
+
+    @Override
+    public CacheRemoteConfigProvider create(KeycloakSession session) {
+        return this;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        //no-op
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        //no-op
+    }
+
+    @Override
+    public Optional<Configuration> configuration() {
+        // no configuration since it is disabled
+        return Optional.empty();
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider
new file mode 100644
index 000000000000..1c42214d4794
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider
@@ -0,0 +1 @@
+org.keycloak.infinispan.compatibility.CachingCompatibilityMetadataProvider
\ No newline at end of file
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.crl.CrlStorageProviderFactory b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.crl.CrlStorageProviderFactory
new file mode 100644
index 000000000000..0caf1f49671f
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.crl.CrlStorageProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.crl.infinispan.InfinispanCrlStorageProviderFactory
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheCrlProviderFactory b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheCrlProviderFactory
new file mode 100644
index 000000000000..4635116cb595
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheCrlProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.crl.infinispan.InfinispanCacheCrlProviderFactory
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index 5dd9d5ded33b..8b67e435e469 100644
--- a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -15,4 +15,8 @@
 # limitations under the License.
 #
 
-org.keycloak.connections.infinispan.InfinispanConnectionSpi
\ No newline at end of file
+org.keycloak.connections.infinispan.InfinispanConnectionSpi
+org.keycloak.spi.infinispan.CacheRemoteConfigProviderSpi
+org.keycloak.spi.infinispan.JGroupsCertificateProviderSpi
+org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderSpi
+org.keycloak.spi.infinispan.CacheRemoteConfigProviderSpi
\ No newline at end of file
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderFactory b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderFactory
new file mode 100644
index 000000000000..56395b39e752
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.spi.infinispan.impl.embedded.DefaultCacheEmbeddedConfigProviderFactory
\ No newline at end of file
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory
new file mode 100644
index 000000000000..09ec19b14984
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory
@@ -0,0 +1,19 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.spi.infinispan.impl.remote.DisabledCacheRemoteConfigProviderFactory
+org.keycloak.spi.infinispan.impl.remote.DefaultCacheRemoteConfigProviderFactory
\ No newline at end of file
diff --git a/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory
new file mode 100644
index 000000000000..f3d452d21d0c
--- /dev/null
+++ b/model/infinispan/src/main/resources/META-INF/services/org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.jgroups.certificates.DefaultJGroupsCertificateProviderFactory
\ No newline at end of file
diff --git a/model/infinispan/src/main/resources/default-configs/default-keycloak-jgroups-udp.xml b/model/infinispan/src/main/resources/default-configs/default-keycloak-jgroups-udp.xml
index 98cd13c571e2..9f6d6bf0376c 100644
--- a/model/infinispan/src/main/resources/default-configs/default-keycloak-jgroups-udp.xml
+++ b/model/infinispan/src/main/resources/default-configs/default-keycloak-jgroups-udp.xml
@@ -21,8 +21,6 @@
         thread_pool.min_threads="${jgroups.thread_pool.min_threads:0}"
         thread_pool.max_threads="${jgroups.thread_pool.max_threads:200}"
         thread_pool.keep_alive_time="60000"
-
-        thread_pool.thread_dumps_threshold="${jgroups.thread_dumps_threshold:10000}"
    />
    <RED/>
    <PING num_discovery_runs="3"/>
diff --git a/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/RemoteCacheSessionsLoaderTest.java b/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/RemoteCacheSessionsLoaderTest.java
deleted file mode 100644
index 1f9f4823c333..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/RemoteCacheSessionsLoaderTest.java
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.cluster.infinispan;
-
-
-import java.util.HashSet;
-import java.util.Set;
-
-import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.persistence.remote.configuration.RemoteStoreConfigurationBuilder;
-import org.jboss.logging.Logger;
-import org.junit.Assert;
-import org.junit.Ignore;
-import org.junit.Test;
-import org.keycloak.common.util.Time;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
-import org.keycloak.models.sessions.infinispan.initializer.SessionLoader;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoaderContext;
-import org.keycloak.connections.infinispan.InfinispanUtil;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RemoteCacheSessionsLoaderTest {
-
-    protected static final Logger logger = Logger.getLogger(RemoteCacheSessionsLoaderTest.class);
-
-    private static final int COUNT = 10000;
-
-    @Test
-    @Ignore
-    public void testRemoteCache() throws Exception {
-        String cacheName = InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
-        Cache cache1 = createManager(1, cacheName).getCache(cacheName);
-        Cache cache2 = cache1.getCacheManager().getCache("local");
-        RemoteCache remoteCache = InfinispanUtil.getRemoteCache(cache1);
-        cache1.clear();
-        cache2.clear();
-        remoteCache.clear();
-
-        try {
-
-            for (int i=0 ; i<COUNT ; i++) {
-                // Create initial item
-                UserSessionEntity session = new UserSessionEntity("loader-key-" + i);
-                session.setRealmId("master");
-                session.setBrokerSessionId("!23123123");
-                session.setBrokerUserId(null);
-                session.setUser("admin");
-                session.setLoginUsername("admin");
-                session.setIpAddress("123.44.143.178");
-                session.setStarted(Time.currentTime());
-                session.setLastSessionRefresh(Time.currentTime());
-
-                SessionEntityWrapper<UserSessionEntity> wrappedSession = new SessionEntityWrapper<>(session);
-
-                // Create caches, listeners and finally worker threads
-                remoteCache.put("loader-key-" + i, wrappedSession);
-                Assert.assertFalse(cache2.containsKey("loader-key-" + i));
-
-                if (i % 1000 == 0) {
-                    logger.infof("%d sessions added", i);
-                }
-            }
-
-
-//            RemoteCacheSessionsLoader loader = new RemoteCacheSessionsLoader(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, 64) {
-//
-//                @Override
-//                protected Cache getCache(KeycloakSession session) {
-//                    return cache2;
-//                }
-//
-//                @Override
-//                protected RemoteCache getRemoteCache(KeycloakSession session) {
-//                    return remoteCache;
-//                }
-//
-//            };
-
-            // Just to be able to test serializability
-            RemoteCacheSessionsLoader loader = new CustomLoader(cacheName, 64, cache2, remoteCache);
-
-            RemoteCacheSessionsLoaderContext ctx = loader.computeLoaderContext();
-            Assert.assertEquals(ctx.getSessionsPerSegment(), 64);
-
-            int totalCount = 0;
-            logger.infof("segmentsCount: %d", ctx.getSegmentsCount());
-
-            Set<String> visitedKeys = new HashSet<>();
-            for (int currentSegment=0 ; currentSegment<ctx.getSegmentsCount() ; currentSegment++) {
-                logger.infof("Loading segment %d", currentSegment);
-                loader.loadSessions(null, ctx, new SessionLoader.WorkerContext(currentSegment));
-
-                logger.infof("Loaded %d keys for segment %d", cache2.keySet().size(), currentSegment);
-                totalCount = totalCount + cache2.keySet().size();
-                visitedKeys.addAll(cache2.keySet());
-                cache2.clear();
-            }
-
-            Assert.assertEquals(totalCount, COUNT);
-            Assert.assertEquals(visitedKeys.size(), COUNT);
-            logger.infof("SUCCESS: Loaded %d sessions", totalCount);
-        } finally {
-            // Finish JVM
-            cache1.getCacheManager().stop();
-        }
-    }
-
-
-    private static EmbeddedCacheManager createManager(int threadId, String cacheName) {
-        return new TestCacheManagerFactory().createManager(threadId, cacheName, RemoteStoreConfigurationBuilder.class);
-    }
-
-
-    public static class CustomLoader extends RemoteCacheSessionsLoader {
-
-        private final transient Cache cache2;
-        private final transient RemoteCache remoteCache;
-
-        public CustomLoader(String cacheName, int sessionsPerSegment, Cache cache2, RemoteCache remoteCache) {
-            super(cacheName, sessionsPerSegment);
-            this.cache2 = cache2;
-            this.remoteCache = remoteCache;
-
-        }
-
-        @Override
-        protected Cache getCache(KeycloakSession session) {
-            return cache2;
-        }
-
-        @Override
-        protected RemoteCache getRemoteCache(KeycloakSession session) {
-            return remoteCache;
-        }
-
-    }
-
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/TestCacheManagerFactory.java b/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/TestCacheManagerFactory.java
deleted file mode 100644
index 7515a7995d87..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/cluster/infinispan/TestCacheManagerFactory.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.cluster.infinispan;
-
-import org.infinispan.client.hotrod.ProtocolVersion;
-import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.cache.StoreConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.persistence.remote.configuration.ExhaustedAction;
-import org.infinispan.persistence.remote.configuration.RemoteStoreConfigurationChildBuilder;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.marshalling.Marshalling;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-class TestCacheManagerFactory {
-
-
-    <T extends StoreConfigurationBuilder<?, T> & RemoteStoreConfigurationChildBuilder<T>> EmbeddedCacheManager createManager(int threadId, String cacheName, Class<T> builderClass) {
-        System.setProperty("java.net.preferIPv4Stack", "true");
-        System.setProperty("jgroups.tcp.port", "53715");
-
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-        gcb = gcb.clusteredDefault();
-        gcb.transport().clusterName("test-clustering-" + threadId);
-        Marshalling.configure(gcb);
-        gcb.jmx().domain(InfinispanConnectionProvider.JMX_DOMAIN + "-" + threadId).enable();
-        EmbeddedCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-
-        Configuration invalidationCacheConfiguration = getCacheBackedByRemoteStore(threadId, cacheName, builderClass);
-        cacheManager.defineConfiguration(cacheName, invalidationCacheConfiguration);
-        cacheManager.defineConfiguration("local", new ConfigurationBuilder().build());
-
-        return cacheManager;
-
-    }
-
-
-    private <T extends StoreConfigurationBuilder<?, T> & RemoteStoreConfigurationChildBuilder<T>> Configuration getCacheBackedByRemoteStore(int threadId, String cacheName, Class<T> builderClass) {
-        ConfigurationBuilder cacheConfigBuilder = new ConfigurationBuilder();
-
-        String host = threadId==1 ? "jdg1" : "jdg2";
-        int port = 11222;
-
-        return cacheConfigBuilder.statistics().enable()
-                .persistence().addStore(builderClass)
-                .fetchPersistentState(false)
-                .ignoreModifications(false)
-                .purgeOnStartup(false)
-                .preload(false)
-                .shared(true)
-                .remoteCacheName(cacheName)
-                .rawValues(true)
-                .forceReturnValues(false)
-                .protocolVersion(ProtocolVersion.PROTOCOL_VERSION_29)
-                .addServer()
-                    .host(host)
-                    .port(port)
-                .connectionPool()
-                    .maxActive(20)
-                    .exhaustedAction(ExhaustedAction.CREATE_NEW)
-                .async()
-                .   enabled(false).build();
-    }
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ClusteredCacheBehaviorTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ClusteredCacheBehaviorTest.java
deleted file mode 100755
index 517b48289ad9..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ClusteredCacheBehaviorTest.java
+++ /dev/null
@@ -1,141 +0,0 @@
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.Cache;
-import org.infinispan.configuration.cache.CacheMode;
-import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.notifications.Listener;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntriesEvicted;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryCreated;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryInvalidated;
-import org.infinispan.notifications.cachelistener.annotation.CacheEntryRemoved;
-import org.infinispan.notifications.cachelistener.event.CacheEntriesEvictedEvent;
-import org.infinispan.notifications.cachelistener.event.CacheEntryCreatedEvent;
-import org.infinispan.notifications.cachelistener.event.CacheEntryInvalidatedEvent;
-import org.infinispan.notifications.cachelistener.event.CacheEntryRemovedEvent;
-import org.junit.Ignore;
-import org.junit.Test;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-
-/**
- * Just a simple test to see how distributed caches work
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Ignore
-public class ClusteredCacheBehaviorTest {
-    public EmbeddedCacheManager createManager() {
-        System.setProperty("java.net.preferIPv4Stack", "true");
-        System.setProperty("jgroups.tcp.port", "53715");
-
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-        gcb = gcb.clusteredDefault();
-        gcb.transport().clusterName("test-clustering");
-        gcb.jmx().domain(InfinispanConnectionProvider.JMX_DOMAIN).enable();
-        EmbeddedCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-
-        ConfigurationBuilder invalidationConfigBuilder = new ConfigurationBuilder();
-        invalidationConfigBuilder.clustering().cacheMode(CacheMode.INVALIDATION_SYNC);
-        Configuration invalidationCacheConfiguration = invalidationConfigBuilder.build();
-        cacheManager.defineConfiguration(InfinispanConnectionProvider.REALM_CACHE_NAME, invalidationCacheConfiguration);
-
-        return cacheManager;
-
-    }
-
-    @Listener
-    public static class CacheListener {
-        String name;
-
-        public CacheListener(String name) {
-            this.name = name;
-        }
-
-
-        @CacheEntryCreated
-        public void created(CacheEntryCreatedEvent event) {
-
-            System.out.println("Listener '" + name + "' entry created  " + event.getKey() + " isPre: " + event.isPre());
-        }
-
-        @CacheEntryRemoved
-        public void removed(CacheEntryRemovedEvent<String, Object> event) {
-            System.out.println("Listener '" + name + "' entry removed  isPre: " + event.isPre());
-        }
-
-        @CacheEntryInvalidated
-        public void removed(CacheEntryInvalidatedEvent<String, Object> event) {
-            System.out.println("Listener '" + name + "' entry invalidated: isPre: " + event.isPre());
-        }
-
-        @CacheEntriesEvicted
-        public void evicted(CacheEntriesEvictedEvent<String, Object> event) {
-            System.out.println("Listener '" + name + "' entry evicted isPre: " + event.isPre());
-
-        }
-
-    }
-
-    @Test
-    public void testListener() throws Exception {
-        EmbeddedCacheManager node1 = createManager();
-        EmbeddedCacheManager node2 = createManager();
-        Cache<String, Object> node1Cache = node1.getCache(InfinispanConnectionProvider.REALM_CACHE_NAME);
-        node1Cache.addListener(new CacheListener("node1"));
-        Cache<String, Object> node2Cache = node2.getCache(InfinispanConnectionProvider.REALM_CACHE_NAME);
-        node2Cache.addListener(new CacheListener("node2"));
-
-        System.out.println("node1 create entry");
-        node1Cache.put("key", "node1");
-
-        System.out.println("node1 create entry");
-        node1Cache.put("key", "node111");
-
-        System.out.println("node2 create entry");
-        node2Cache.put("key", "node2");
-
-        System.out.println("node1 remove entry");
-        node1Cache.remove("key");
-
-        System.out.println("node2 remove entry");
-        node2Cache.remove("key");
-
-        System.out.println("node2 put entry");
-        node2Cache.put("key", "node2");
-        System.out.println("node2 evict entry");
-        node2Cache.evict("key");
-        System.out.println("node1/node2 putExternal entry");
-        node1Cache.putForExternalRead("key", "common");
-        node2Cache.putForExternalRead("key", "common");
-        System.out.println("node2 remove entry");
-        node2Cache.remove("key");
-        System.out.println("node1 remove entry");
-        node1Cache.remove("key");
-
-        // test remove non-existing node 2, existing node 1
-        System.out.println("Test non existent remove");
-        System.out.println("node1 create entry");
-        node1Cache.put("key", "value");
-        System.out.println("node2 remove non-existent entry");
-        System.out.println("exists?: " + node2Cache.containsKey("key"));
-        node2Cache.remove("key");
-
-        // test clear
-        System.out.println("Test clear cache");
-        System.out.println("add key to node 1, key2 to node2");
-        node1Cache.putForExternalRead("key", "value");
-        node2Cache.putForExternalRead("key", "value");
-        node2Cache.putForExternalRead("key2", "value");
-        System.out.println("Clear from node1");
-        node1Cache.clear();
-        System.out.println("node 2 exists key2?: " + node2Cache.containsKey("key2"));
-        System.out.println("node 2 exists key?: " + node2Cache.containsKey("key"));
-
-
-
-    }
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyLockingTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyLockingTest.java
deleted file mode 100755
index c4cfc9b840a0..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyLockingTest.java
+++ /dev/null
@@ -1,85 +0,0 @@
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.Cache;
-import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.transaction.LockingMode;
-import org.infinispan.transaction.lookup.EmbeddedTransactionManagerLookup;
-import org.junit.Ignore;
-import org.junit.Test;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ExecutorService;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Ignore
-public class ConcurrencyLockingTest {
-
-    @Test
-    public void testLocking() throws Exception {
-        final DefaultCacheManager cacheManager = getVersionedCacheManager();
-        Cache<String, String> cache = cacheManager.getCache("COUNTER_CACHE");
-
-        Map<String, String> map = new HashMap<>();
-        map.put("key1", "val1");
-        map.put("key2", "val2");
-        cache.putAll(map);
-
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        executor.execute(new Runnable() {
-            @Override
-            public void run() {
-                Cache<String, String> cache = cacheManager.getCache("COUNTER_CACHE");
-                cache.startBatch();
-                System.out.println("thread lock");
-                cache.getAdvancedCache().lock("key");
-                try {
-                    Thread.sleep(100000);
-                } catch (InterruptedException e) {
-                    throw new RuntimeException(e);
-                }
-                cache.endBatch(true);
-
-            }
-        });
-        Thread.sleep(10);
-        cache.startBatch();
-        cache.getAdvancedCache().lock("key");
-        cache.put("key", "1234");
-        System.out.println("after put");
-        cache.endBatch(true);
-
-        Thread.sleep(1000000);
-
-
-
-    }
-
-    protected DefaultCacheManager getVersionedCacheManager() {
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-        gcb.jmx().domain(InfinispanConnectionProvider.JMX_DOMAIN).enable();
-        final DefaultCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-
-        ConfigurationBuilder invalidationConfigBuilder = new ConfigurationBuilder();
-        Configuration invalidationCacheConfiguration = invalidationConfigBuilder.build();
-        cacheManager.defineConfiguration(InfinispanConnectionProvider.REALM_CACHE_NAME, invalidationCacheConfiguration);
-
-        ConfigurationBuilder counterConfigBuilder = new ConfigurationBuilder();
-        counterConfigBuilder.invocationBatching().enable();
-        counterConfigBuilder.transaction().transactionManagerLookup(new EmbeddedTransactionManagerLookup());
-        counterConfigBuilder.transaction().lockingMode(LockingMode.PESSIMISTIC);
-        Configuration counterCacheConfiguration = counterConfigBuilder.build();
-        cacheManager.defineConfiguration("COUNTER_CACHE", counterCacheConfiguration);
-
-        return cacheManager;
-    }
-
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyVersioningTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyVersioningTest.java
old mode 100755
new mode 100644
index 27e75810d1b3..c327f869f036
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyVersioningTest.java
+++ b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/ConcurrencyVersioningTest.java
@@ -1,3 +1,20 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package org.keycloak.models.sessions.infinispan.initializer;
 
 import org.infinispan.Cache;
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/InitializerStateTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/InitializerStateTest.java
deleted file mode 100644
index ec117670c003..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/InitializerStateTest.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoaderContext;
-import org.keycloak.storage.CacheableStorageProviderModel;
-
-import java.text.DateFormat;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.List;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class InitializerStateTest {
-
-    @Test
-    public void testOfflineLoaderContext() {
-        OfflinePersistentLoaderContext ctx = new OfflinePersistentLoaderContext(28, 5);
-        Assert.assertEquals(ctx.getSegmentsCount(), 6);
-
-        ctx = new OfflinePersistentLoaderContext(19, 5);
-        Assert.assertEquals(ctx.getSegmentsCount(), 4);
-
-        ctx = new OfflinePersistentLoaderContext(20, 5);
-        Assert.assertEquals(ctx.getSegmentsCount(), 4);
-
-        ctx = new OfflinePersistentLoaderContext(21, 5);
-        Assert.assertEquals(ctx.getSegmentsCount(), 5);
-    }
-
-
-    @Test
-    public void testRemoteLoaderContext() {
-        assertSegmentsForRemoteLoader(64, 1);
-    }
-
-    private void assertSegmentsForRemoteLoader(int sessionsPerSegment, int expectedSegments) {
-        RemoteCacheSessionsLoaderContext ctx = new RemoteCacheSessionsLoaderContext(sessionsPerSegment);
-        Assert.assertEquals(expectedSegments, ctx.getSegmentsCount());
-    }
-
-
-    @Test
-    public void testComputationState() {
-        OfflinePersistentLoaderContext ctx = new OfflinePersistentLoaderContext(28, 5);
-        Assert.assertEquals(ctx.getSegmentsCount(), 6);
-
-        InitializerState state = new InitializerState(ctx.getSegmentsCount());
-
-        Assert.assertFalse(state.isFinished());
-        List<Integer> segments = state.getSegmentsToLoad(0, 3);
-        assertContains(segments, 3, 0, 1, 2);
-
-        state.markSegmentFinished(1);
-        state.markSegmentFinished(2);
-        segments = state.getSegmentsToLoad(0, 3);
-        assertContains(segments, 1, 0);
-
-        state.markSegmentFinished(0);
-        state.markSegmentFinished(3);
-        segments = state.getSegmentsToLoad(4, 4);
-        assertContains(segments, 2, 4, 5);
-
-        state.markSegmentFinished(4);
-        state.markSegmentFinished(5);
-        segments = state.getSegmentsToLoad(4, 4);
-        Assert.assertTrue(segments.isEmpty());
-        Assert.assertTrue(state.isFinished());
-    }
-
-    private void assertContains(List<Integer> segments, int expectedLength, int... expected) {
-        Assert.assertEquals(segments.size(), expectedLength);
-        for (int i : expected) {
-            Assert.assertTrue(segments.contains(i));
-        }
-    }
-
-    @Test
-    public void testDailyTimeout() {
-        Date date = new Date(CacheableStorageProviderModel.dailyTimeout(10, 30));
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        date = new Date(CacheableStorageProviderModel.dailyTimeout(17, 45));
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        date = new Date(CacheableStorageProviderModel.weeklyTimeout(Calendar.MONDAY, 13, 45));
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        date = new Date(CacheableStorageProviderModel.weeklyTimeout(Calendar.THURSDAY, 13, 45));
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        System.out.println("----");
-        Calendar cal = Calendar.getInstance();
-        cal.add(Calendar.HOUR, 1);
-        int hour = cal.get(Calendar.HOUR_OF_DAY);
-        int min = cal.get(Calendar.MINUTE);
-        date = new Date(cal.getTimeInMillis());
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        date = new Date(CacheableStorageProviderModel.dailyTimeout(hour, min));
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-        cal = Calendar.getInstance();
-        cal.set(Calendar.DAY_OF_WEEK, Calendar.MONDAY);
-        date = new Date(cal.getTimeInMillis());
-        System.out.println(DateFormat.getDateTimeInstance(DateFormat.FULL, DateFormat.FULL).format(date));
-
-
-    }
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/L1SerializationIssueTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/L1SerializationIssueTest.java
deleted file mode 100644
index e5952d14c4c9..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/L1SerializationIssueTest.java
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import java.io.Serializable;
-
-import org.infinispan.Cache;
-import org.infinispan.configuration.cache.CacheMode;
-import org.infinispan.configuration.cache.ClusteringConfigurationBuilder;
-import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.jboss.logging.Logger;
-import org.junit.Ignore;
-import org.junit.Test;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-
-/**
- * Reproducer for RHSSO-377 / ISPN-6806
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@Ignore
-public class L1SerializationIssueTest {
-
-    protected static final Logger logger = Logger.getLogger(L1SerializationIssueTest.class);
-
-    // Conf
-    private static final boolean L1_ENABLED = true;  // Workaround 1 : If it's disabled, the exception won't happen
-    private static final int L1_LIFESPAN_MS = 6000;
-    private static final int L1_CLEANER_MS = 60000;  // Seems that this value doesn't matter to anything...
-    private static final int NUM_OWNERS = 1;         // Workaround 2 : If it's 2, the exception won't happen
-
-    private static final int TIME_BEFORE_RESTORE_NODE = 5000; // Workaroud 3 : If it's bigger than L1_LIFESPAN_MS, the exception won't happen
-    private static final int ITEMS_COUNT = 1000;
-
-    private static final String CACHE_NAME = "my-dist";
-
-
-    @Test
-    public void testL1Bug() throws Exception {
-        EmbeddedCacheManager node1 = null;
-        EmbeddedCacheManager node2 = null;
-        EmbeddedCacheManager node3 = null;
-
-        try {
-
-            node1 = createManager();
-            Cache<String, Object> node1Cache = node1.getCache(CACHE_NAME);
-            logger.info("Node1Cache started");
-
-            node2 = createManager();
-            Cache<String, Object> node2Cache = node2.getCache(CACHE_NAME);
-            logger.info("Node2Cache started");
-
-            node3 = createManager();
-            Cache<String, Object> node3Cache = node3.getCache(CACHE_NAME);
-            logger.info("Node3Cache started");
-
-            // Put some items on node1
-            writeItems(node1Cache);
-
-            // Get all items on node2. This will save them to L1 cache on node2
-            readItems(node2Cache);
-
-            // See the great performance with L1 enabled as everything read from L1 cache and there are no remote calls at all
-            //readItems(node2Cache);
-
-            // Write and see worse performance with L1 enabled as every write needs to invalidate L1 cache on node2 too
-            //writeItems(node1Cache);
-
-            // Kill node3
-            node3.stop();
-
-            // Wait
-            logger.infof("Stopped node3. Will wait %d milliseconds", TIME_BEFORE_RESTORE_NODE);
-            Thread.sleep(TIME_BEFORE_RESTORE_NODE);
-
-            // Start node3 again
-            logger.info("Going to start node3 again");
-
-            node3 = createManager();
-            node3Cache = node3.getCache(CACHE_NAME);
-            logger.info("Node3Cache started again");
-
-            logger.info("Test finished successfuly");
-        } finally {
-            if (node1 != null) node1.stop();
-            if (node2 != null) node2.stop();
-            if (node3 != null) node3.stop();
-        }
-    }
-
-
-    private void writeItems(Cache<String, Object> cache) {
-        long start = System.currentTimeMillis();
-        for (int i=0 ; i < ITEMS_COUNT ; i++) {
-            String key = "key-" + i;
-            cache.put(key, new MySerializable());
-        }
-        logger.infof("Write %d items in %d ms", ITEMS_COUNT, System.currentTimeMillis() - start);
-    }
-
-
-    private void readItems(Cache<String, Object> cache) {
-        long start = System.currentTimeMillis();
-        for (int i=0 ; i < ITEMS_COUNT ; i++) {
-            String key = "key-" + i;
-            cache.get(key);
-        }
-        logger.infof("Read %d items in %d ms", ITEMS_COUNT, System.currentTimeMillis() - start);
-    }
-
-
-
-    private EmbeddedCacheManager createManager() {
-        System.setProperty("java.net.preferIPv4Stack", "true");
-        System.setProperty("jgroups.tcp.port", "53715");
-
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-        gcb = gcb.clusteredDefault();
-        gcb.transport().clusterName("test-clustering");
-        gcb.jmx().domain(InfinispanConnectionProvider.JMX_DOMAIN).enable();
-        EmbeddedCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-
-        ConfigurationBuilder distConfigBuilder = new ConfigurationBuilder();
-        ClusteringConfigurationBuilder clusterConfBuilder = distConfigBuilder.clustering();
-        clusterConfBuilder.cacheMode(CacheMode.DIST_SYNC);
-        clusterConfBuilder.hash().numOwners(NUM_OWNERS);
-        clusterConfBuilder.l1().enabled(L1_ENABLED)
-                .lifespan(L1_LIFESPAN_MS)
-                .cleanupTaskFrequency(L1_CLEANER_MS);
-        Configuration distCacheConfiguration = distConfigBuilder.build();
-        cacheManager.defineConfiguration(CACHE_NAME, distCacheConfiguration);
-
-        return cacheManager;
-    }
-
-    public static class MySerializable implements Serializable {
-    }
-
-}
diff --git a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/OutdatedTopologyExceptionReproducerTest.java b/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/OutdatedTopologyExceptionReproducerTest.java
deleted file mode 100644
index b647cdda2b11..000000000000
--- a/model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/OutdatedTopologyExceptionReproducerTest.java
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.sessions.infinispan.initializer;
-
-import org.infinispan.Cache;
-import org.infinispan.configuration.cache.CacheMode;
-import org.infinispan.configuration.cache.Configuration;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfigurationBuilder;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.jboss.logging.Logger;
-import org.junit.Assert;
-import org.junit.Ignore;
-import org.junit.Test;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-
-/**
- * Reproducer for KEYCLOAK-3306. Uncomment the snippet for adding StateTransferInterceptor to have test fixed.
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@Ignore
-public class OutdatedTopologyExceptionReproducerTest {
-
-    protected static final Logger logger = Logger.getLogger(OutdatedTopologyExceptionReproducerTest.class);
-
-    private static final int THREADS_COUNT = 20;
-
-    @Test
-    public void testListener() throws Exception {
-        EmbeddedCacheManager node1 = null;
-        EmbeddedCacheManager node2 = null;
-
-        try {
-            node1 = createManager();
-            Cache<String, Object> node1Cache = node1.getCache(InfinispanConnectionProvider.REALM_CACHE_NAME);
-            logger.info("Node1Cache started");
-
-            List<CacheOperations> cacheOpsList = new ArrayList<>();
-            AtomicReference<Exception> exceptionHolder = new AtomicReference<>();
-
-            for (int i=0 ; i<THREADS_COUNT ; i++) {
-                String key = "key-" + i;
-                CacheOperations cacheOps = new CacheOperations(node1Cache, key, exceptionHolder);
-                cacheOps.start();
-                cacheOpsList.add(cacheOps);
-            }
-            logger.infof("All CacheOperations threads started");
-
-            node2 = createManager();
-            Cache<String, Object> node2Cache = node2.getCache(InfinispanConnectionProvider.REALM_CACHE_NAME);
-            logger.info("Node2Cache started");
-
-            for (CacheOperations cacheOps : cacheOpsList) {
-                cacheOps.stopMe();
-            }
-            for (CacheOperations cacheOps : cacheOpsList) {
-                cacheOps.join();
-            }
-
-            logger.info("All CacheOperations threads stopped");
-
-            Exception ex = exceptionHolder.get();
-            if (ex != null) {
-                Assert.fail("Some exception was thrown. It was: " + ex.getClass().getName() + ": " + ex.getMessage());
-            }
-
-            logger.info("Test finished successfuly");
-        } finally {
-            node2.stop();
-            node1.stop();
-        }
-    }
-
-    private EmbeddedCacheManager createManager() {
-        System.setProperty("java.net.preferIPv4Stack", "true");
-        System.setProperty("jgroups.tcp.port", "53715");
-
-        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
-        gcb = gcb.clusteredDefault();
-        gcb.transport().clusterName("test-clustering");
-        gcb.jmx().domain(InfinispanConnectionProvider.JMX_DOMAIN).enable();
-        EmbeddedCacheManager cacheManager = new DefaultCacheManager(gcb.build());
-
-        ConfigurationBuilder invalidationConfigBuilder = new ConfigurationBuilder();
-        invalidationConfigBuilder.clustering().cacheMode(CacheMode.INVALIDATION_SYNC);
-
-        // Uncomment this to have test fixed!!!
-//        invalidationConfigBuilder.customInterceptors()
-//                .addInterceptor()
-//                .before(NonTransactionalLockingInterceptor.class)
-//                .interceptorClass(StateTransferInterceptor.class);
-
-        Configuration invalidationCacheConfiguration = invalidationConfigBuilder.build();
-        cacheManager.defineConfiguration(InfinispanConnectionProvider.REALM_CACHE_NAME, invalidationCacheConfiguration);
-
-        return cacheManager;
-    }
-
-    private class CacheOperations extends Thread {
-
-        private final Cache<String, Object> cache;
-        private final AtomicBoolean stopped = new AtomicBoolean(false);
-        private final AtomicReference<Exception> exceptionHolder;
-        private final String key;
-
-        public CacheOperations(Cache<String, Object> cache, String key, AtomicReference<Exception> exceptionHolder) {
-            this.cache = cache;
-            this.key = key;
-            this.exceptionHolder = exceptionHolder;
-        }
-
-        @Override
-        public void run() {
-            try {
-                while (!stopped.get()) {
-                    cache.putForExternalRead(key, new Object());
-                    cache.remove(key);
-                }
-            } catch (Exception e) {
-                exceptionHolder.set(e);
-                throw e;
-            }
-        }
-
-        public void stopMe() {
-            stopped.set(true);
-        }
-
-    }
-}
diff --git a/model/jpa/src/main/java/org/keycloak/authorization/jpa/entities/PolicyEntity.java b/model/jpa/src/main/java/org/keycloak/authorization/jpa/entities/PolicyEntity.java
index d7c5d252c545..f4ea7697b9fe 100644
--- a/model/jpa/src/main/java/org/keycloak/authorization/jpa/entities/PolicyEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/authorization/jpa/entities/PolicyEntity.java
@@ -42,6 +42,7 @@
 import org.hibernate.annotations.Fetch;
 import org.hibernate.annotations.FetchMode;
 import org.hibernate.annotations.Nationalized;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.representations.idm.authorization.DecisionStrategy;
 import org.keycloak.representations.idm.authorization.Logic;
 
@@ -63,7 +64,8 @@
                 @NamedQuery(name="findPolicyIdByType", query="select p.id from PolicyEntity p where p.resourceServer.id = :serverId and p.type = :type"),
                 @NamedQuery(name="findPolicyIdByResourceType", query="select p from PolicyEntity p inner join p.config c inner join fetch p.associatedPolicies a where p.resourceServer.id = :serverId and KEY(c) = 'defaultResourceType' and c like :type"),
                 @NamedQuery(name="findPolicyIdByDependentPolices", query="select p.id from PolicyEntity p inner join p.associatedPolicies ap where p.resourceServer.id = :serverId and (ap.resourceServer.id = :serverId and ap.id = :policyId)"),
-                @NamedQuery(name="deletePolicyByResourceServer", query="delete from PolicyEntity p where p.resourceServer.id = :serverId")
+                @NamedQuery(name="deletePolicyByResourceServer", query="delete from PolicyEntity p where p.resourceServer.id = :serverId"),
+                @NamedQuery(name="findDependentPolicyByResourceTypeAndConfig", query="select p.id from PolicyEntity p inner join p.scopes s inner join p.config c inner join p.associatedPolicies ap inner join ap.config ac where p.resourceServer.id = :serverId and (s.name in ('" + AdminPermissionsSchema.VIEW + "', '" + AdminPermissionsSchema.VIEW_MEMBERS + "')) and ap.resourceServer.id = :serverId and ap.type = :associatedPolicyType and (KEY(c) = 'defaultResourceType' and c like :resourceType) and (KEY(ac) = :configKey and ac like :configValue)")
         }
 )
 
diff --git a/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java b/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
index dd4a10b39bf5..35c65a51c4ba 100644
--- a/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
+++ b/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
@@ -24,6 +24,7 @@
 import java.util.Objects;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import jakarta.persistence.EntityManager;
 import jakarta.persistence.FlushModeType;
@@ -31,9 +32,13 @@
 import jakarta.persistence.TypedQuery;
 import jakarta.persistence.criteria.CriteriaBuilder;
 import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Join;
+import jakarta.persistence.criteria.MapJoin;
 import jakarta.persistence.criteria.Predicate;
 import jakarta.persistence.criteria.Root;
 
+import org.hibernate.Session;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.jpa.entities.PolicyEntity;
 import org.keycloak.authorization.model.Policy;
@@ -114,7 +119,8 @@ public Policy findByName(ResourceServer resourceServer, String name) {
         query.setParameter("name", name);
 
         try {
-            return new PolicyAdapter(query.getSingleResult(), entityManager, provider.getStoreFactory());
+            PolicyEntity policy = query.getSingleResult();
+            return provider.getStoreFactory().getPolicyStore().findById(resourceServer, policy.getId());
         } catch (NoResultException ex) {
             return null;
         }
@@ -305,7 +311,6 @@ public List<Policy> findByType(ResourceServer resourceServer, String type) {
 
     @Override
     public List<Policy> findDependentPolicies(ResourceServer resourceServer, String policyId) {
-
         TypedQuery<String> query = entityManager.createNamedQuery("findPolicyIdByDependentPolices", String.class);
 
         query.setFlushMode(FlushModeType.COMMIT);
@@ -322,4 +327,69 @@ public List<Policy> findDependentPolicies(ResourceServer resourceServer, String
         }
         return list;
     }
+
+    @Override
+    public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, String configValue) {
+        return findDependentPolicies(resourceServer, resourceType, associatedPolicyType, configKey, List.of(configValue));
+    }
+
+    @Override
+    public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, List<String> configValues) {
+        String dbProductName = entityManager.unwrap(Session.class).doReturningWork(connection -> connection.getMetaData().getDatabaseProductName());
+
+        if (dbProductName.equals("Oracle")) {
+            Stream<Policy> result = Stream.empty();
+
+            for (String value : configValues) {
+                TypedQuery<String> query = entityManager.createNamedQuery("findDependentPolicyByResourceTypeAndConfig", String.class);
+
+                query.setParameter("serverId", resourceServer.getId());
+                query.setParameter("resourceType", resourceType);
+                query.setParameter("associatedPolicyType", associatedPolicyType);
+                query.setParameter("configKey", configKey);
+                query.setParameter("configValue", "%" + value + "%");
+
+                PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
+
+                result = Stream.concat(result, query.getResultStream().map((id) -> policyStore.findById(resourceServer, id)).filter(Objects::nonNull));
+            }
+
+            return result;
+        }
+
+        CriteriaBuilder cb = entityManager.getCriteriaBuilder();
+        CriteriaQuery<String> query = cb.createQuery(String.class);
+        Root<PolicyEntity> from = query.from(PolicyEntity.class);
+
+        query.select(from.get("id"));
+
+        Join<Object, Object> scope = from.join("scopes");
+        MapJoin<Object, Object, Object> config = from.joinMap("config");
+        Join<Object, Object> associatedPolicy = from.join("associatedPolicies");
+        MapJoin<Object, Object, Object> associatedPolicyConfig = associatedPolicy.joinMap("config");
+
+        List<Predicate> predicates = new LinkedList<>();
+
+        predicates.add(cb.equal(from.get("resourceServer").get("id"), resourceServer.getId()));
+        predicates.add(scope.get("name").in(AdminPermissionsSchema.VIEW, AdminPermissionsSchema.VIEW_MEMBERS));
+        predicates.add(cb.equal(associatedPolicy.get("type"), associatedPolicyType));
+        predicates.add(cb.equal(config.key(), "defaultResourceType"));
+        predicates.add(cb.equal(config.value(), resourceType));
+
+        List<Predicate> configValuePredicates = new LinkedList<>();
+
+        predicates.add(cb.equal(associatedPolicyConfig.key(), configKey));
+
+        for (String value : configValues) {
+            configValuePredicates.add(cb.like(associatedPolicyConfig.value().as(String.class), "%" + value + "%"));
+        }
+
+        predicates.add(cb.or(configValuePredicates.toArray(new Predicate[0])));
+
+        query.where(predicates.toArray(new Predicate[0]));
+
+        PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
+
+        return entityManager.createQuery(query).getResultStream().map((id) -> policyStore.findById(resourceServer, id)).filter(Objects::nonNull);
+    }
 }
diff --git a/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceServerStore.java b/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceServerStore.java
index 1c3c5b9a8b20..75f85115f4a6 100644
--- a/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceServerStore.java
+++ b/model/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAResourceServerStore.java
@@ -74,7 +74,9 @@ public void delete(ClientModel client) {
             query.setParameter("serverId", id);
             List<String> result = query.getResultList();
             for (String policyId : result) {
-                entityManager.remove(entityManager.getReference(PolicyEntity.class, policyId));
+                PolicyEntity policyEntity = entityManager.find(PolicyEntity.class, policyId);
+                policyEntity.getAssociatedPolicies().clear();
+                entityManager.remove(policyEntity);
             }
         }
 
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java
index ce8017e609cc..f19cf1d42c36 100755
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java
@@ -28,6 +28,7 @@
 import org.keycloak.ServerStartupError;
 import org.keycloak.common.util.StackUtil;
 import org.keycloak.common.util.StringPropertyReplacer;
+import org.keycloak.connections.jpa.support.EntityManagerProxy;
 import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
 import org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProviderFactory;
 import org.keycloak.connections.jpa.util.JpaUtils;
@@ -100,7 +101,7 @@ private EntityManager createEntityManager(KeycloakSession session) {
 
             em = emf.createEntityManager(SynchronizationType.SYNCHRONIZED);
         }
-        em = PersistenceExceptionConverter.create(session, em);
+        em = EntityManagerProxy.create(session, em);
         if (!jtaEnabled) {
             session.getTransactionManager().enlist(new JpaKeycloakTransaction(em));
         }
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java
index a6cca6225e5b..a459ebf561ad 100644
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java
@@ -17,97 +17,17 @@
 
 package org.keycloak.connections.jpa;
 
-import org.hibernate.exception.ConstraintViolationException;
-import org.keycloak.models.Constants;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.connections.jpa.support.EntityManagerProxy;
 import org.keycloak.models.ModelException;
-import org.keycloak.models.ModelIllegalStateException;
-
-import jakarta.persistence.EntityExistsException;
-import jakarta.persistence.EntityManager;
-import jakarta.persistence.OptimisticLockException;
-
-import java.lang.reflect.InvocationHandler;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.lang.reflect.Proxy;
-import java.sql.SQLException;
-import java.sql.SQLIntegrityConstraintViolationException;
-import java.util.function.Predicate;
-import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class PersistenceExceptionConverter implements InvocationHandler {
-
-    private static final Pattern WRITE_METHOD_NAMES = Pattern.compile("persist|merge");
-
-    private final EntityManager em;
-    private final boolean batchEnabled;
-    private final int batchSize;
-    private int changeCount = 0;
-
-    public static EntityManager create(KeycloakSession session, EntityManager em) {
-        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(session, em));
-    }
-
-    private PersistenceExceptionConverter(KeycloakSession session, EntityManager em) {
-        batchEnabled = session.getAttributeOrDefault(Constants.STORAGE_BATCH_ENABLED, false);
-        batchSize = session.getAttributeOrDefault(Constants.STORAGE_BATCH_SIZE, 100);
-        this.em = em;
-    }
-
-    @Override
-    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
-        try {
-            flushInBatchIfEnabled(method);
-            return method.invoke(em, args);
-        } catch (InvocationTargetException e) {
-            throw convert(e.getCause());
-        }
-    }
-
-    private void flushInBatchIfEnabled(Method method) {
-        if (batchEnabled) {
-            if (WRITE_METHOD_NAMES.matcher(method.getName()).matches()) {
-                if (changeCount++ > batchSize) {
-                    em.flush();
-                    em.clear();
-                    changeCount = 0;
-                }
-            }
-        }
-    }
+public class PersistenceExceptionConverter {
 
     // For JTA, the database operations are executed during the commit phase of a transaction, and DB exceptions can be propagated differently
     public static ModelException convert(Throwable t) {
-        final Predicate<Throwable> checkDuplicationMessage = throwable -> {
-            final String message = throwable.getCause() != null ? throwable.getCause().getMessage() : throwable.getMessage();
-            return message == null ? false : message.toLowerCase().contains("duplicate");
-        };
-
-        Predicate<Throwable> throwModelDuplicateEx = throwable ->
-                throwable instanceof EntityExistsException
-                || throwable instanceof ConstraintViolationException
-                // SQL state class 23 captures errors like 23505 = UNIQUE VIOLATION et al.
-                // This captures, for example, a BatchUpdateException which is not mapped to the other exception types
-                // https://en.wikipedia.org/wiki/SQLSTATE
-                || (throwable instanceof SQLException bue && bue.getSQLState().startsWith("23"))
-                || throwable instanceof SQLIntegrityConstraintViolationException;
-
-        throwModelDuplicateEx = throwModelDuplicateEx.or(checkDuplicationMessage);
-
-        if (t.getCause() != null && throwModelDuplicateEx.test(t.getCause())) {
-            throw new ModelDuplicateException("Duplicate resource error", t.getCause());
-        } else if (throwModelDuplicateEx.test(t)) {
-            throw new ModelDuplicateException("Duplicate resource error", t);
-        } else if (t instanceof OptimisticLockException) {
-            throw new ModelIllegalStateException("Database operation failed", t);
-        } else {
-            throw new ModelException("Database operation failed", t);
-        }
+        return EntityManagerProxy.convert(t);
     }
 
 }
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
index ec3e4ae24d39..3c585074dfcc 100755
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java
@@ -35,7 +35,6 @@
 import liquibase.snapshot.SnapshotGeneratorFactory;
 import liquibase.statement.SqlStatement;
 import liquibase.statement.core.AddColumnStatement;
-import liquibase.statement.core.CreateDatabaseChangeLogTableStatement;
 import liquibase.statement.core.SetNullableStatement;
 import liquibase.statement.core.UpdateStatement;
 import liquibase.structure.core.Column;
@@ -54,7 +53,6 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.io.Writer;
-import java.lang.reflect.Method;
 import java.sql.Connection;
 import java.sql.SQLException;
 import java.util.ArrayList;
@@ -211,13 +209,11 @@ private void outputChangeLogTableCreationScript(Liquibase liquibase, final Write
         loggingExecutor.comment("* Keycloak database creation script - apply this script to empty DB *");
         loggingExecutor.comment("*********************************************************************" + StreamUtil.getLineSeparator());
 
-        loggingExecutor.execute(new CreateDatabaseChangeLogTableStatement());
+        // DatabaseChangeLogTable is automatically added to the script by Liquibase
         // DatabaseChangeLogLockTable is created before this code is executed and recreated if it does not exist automatically
         // in org.keycloak.connections.jpa.updater.liquibase.lock.CustomLockService.init() called indirectly from
         // KeycloakApplication constructor (search for waitForLock() call). Hence it is not included in the creation script.
 
-        loggingExecutor.comment("*********************************************************************" + StreamUtil.getLineSeparator());
-
         executorService.setExecutor(LiquibaseConstants.JDBC_EXECUTOR, database, oldTemplate);
     }
 
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/UpdatedPostgresDatabase.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/UpdatedPostgresDatabase.java
new file mode 100644
index 000000000000..2e5add267f47
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/UpdatedPostgresDatabase.java
@@ -0,0 +1,54 @@
+package org.keycloak.connections.jpa.updater.liquibase;
+
+import liquibase.GlobalConfiguration;
+import liquibase.database.ObjectQuotingStrategy;
+import liquibase.database.core.PostgresDatabase;
+import liquibase.structure.DatabaseObject;
+import liquibase.structure.core.Catalog;
+import liquibase.structure.core.Schema;
+import liquibase.util.StringUtil;
+
+import java.util.Locale;
+
+/**
+ * Workaround for <a href="https://github.com/keycloak/keycloak/issues/39917">keycloak#39917</a>
+ * Remove it once Liquibase 4.32.0 is used
+ */
+public class UpdatedPostgresDatabase extends PostgresDatabase {
+
+    @Override
+    public int getPriority() {
+        return super.getPriority() + 1; // Always take precedence over factory PostgresDatabase
+    }
+    
+    /**
+     * Use updated version present in Liquibase 4.32.0 - <a href="https://github.com/liquibase/liquibase/blob/v4.32.0/liquibase-standard/src/main/java/liquibase/database/core/PostgresDatabase.java#L300">PostgresDatabase.correctObjectName()</a>
+     */
+    @Override
+    public String correctObjectName(String objectName, Class<? extends DatabaseObject> objectType) {
+        if ((objectName == null) || (quotingStrategy != ObjectQuotingStrategy.LEGACY)) {
+            return super.correctObjectName(objectName, objectType);
+        }
+        //
+        // Check preserve case flag for schema
+        //
+        if (objectType.equals(Schema.class) && Boolean.TRUE.equals(GlobalConfiguration.PRESERVE_SCHEMA_CASE.getCurrentValue())) {
+            return objectName;
+        }
+
+        if (objectType.equals(Catalog.class) && !StringUtil.hasLowerCase(objectName)) {
+            return objectName;
+        }
+
+        if (objectName.contains("-")
+                || hasMixedCase(objectName)
+                || startsWithNumeric(objectName)
+                || isReservedWord(objectName)) {
+            return objectName;
+        } else {
+            return objectName.toLowerCase(Locale.US);
+        }
+    }
+
+
+}
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/CustomChangeLogHistoryService.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/CustomChangeLogHistoryService.java
index a51920b5d26c..22f2cea7d247 100644
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/CustomChangeLogHistoryService.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/conn/CustomChangeLogHistoryService.java
@@ -31,13 +31,21 @@
 import liquibase.ContextExpression;
 import liquibase.Labels;
 import liquibase.change.CheckSum;
+import liquibase.change.ColumnConfig;
 import liquibase.changelog.ChangeSet;
 import liquibase.changelog.RanChangeSet;
 import liquibase.changelog.StandardChangeLogHistoryService;
 import liquibase.database.Database;
 import liquibase.database.core.MySQLDatabase;
 import liquibase.exception.DatabaseException;
+import liquibase.executor.jvm.ChangelogJdbcMdcListener;
 import liquibase.logging.LogFactory;
+import liquibase.snapshot.InvalidExampleException;
+import liquibase.snapshot.SnapshotGeneratorFactory;
+import liquibase.statement.core.AddPrimaryKeyStatement;
+import liquibase.structure.core.PrimaryKey;
+import liquibase.structure.core.Schema;
+import liquibase.structure.core.Table;
 
 /**
  *
@@ -46,19 +54,34 @@
 public class CustomChangeLogHistoryService extends StandardChangeLogHistoryService {
 
     private List<RanChangeSet> ranChangeSetList;
+    private boolean serviceInitialized;
 
     @Override
-    public List<RanChangeSet> getRanChangeSets() throws DatabaseException {
-        Database database = getDatabase();
-        if (! (database instanceof MySQLDatabase)) {
-            return super.getRanChangeSets();
+    public boolean supports(Database database) {
+        return database instanceof MySQLDatabase;
+    }
+
+    @Override
+    public void init() throws DatabaseException {
+        super.init();
+
+        if (serviceInitialized) return;
+
+        serviceInitialized = true;
+
+        if (!existsDatabaseChangelogPK()) {
+            createDatabaseChangelogPK();
         }
+    }
+
+    @Override
+    public List<RanChangeSet> getRanChangeSets() throws DatabaseException {
         if (this.ranChangeSetList == null) {
             String databaseChangeLogTableName = getDatabase().escapeTableName(getLiquibaseCatalogName(), getLiquibaseSchemaName(), getDatabaseChangeLogTableName());
             List<RanChangeSet> ranChangeSetList = new ArrayList<>();
             if (hasDatabaseChangeLogTable()) {
                 LogFactory.getLogger().info("Reading from " + databaseChangeLogTableName);
-                List<Map<String, ?>> results = queryDatabaseChangeLogTable(database);
+                List<Map<String, ?>> results = queryDatabaseChangeLogTable(getDatabase());
                 for (Map rs : results) {
                     String fileName = rs.get("FILENAME").toString();
                     String author = rs.get("AUTHOR").toString();
@@ -117,4 +140,31 @@ private boolean getDatabaseChecksumsCompatible() {
     public int getPriority() {
         return super.getPriority() + 1; // Ensure bigger priority than StandardChangeLogHistoryService
     }
+
+    private boolean existsDatabaseChangelogPK() throws DatabaseException {
+        try {
+            PrimaryKey example = new PrimaryKey();
+            Table table = new Table();
+            table.setSchema(new Schema(getLiquibaseCatalogName(), getLiquibaseSchemaName()));
+            table.setName(getDatabaseChangeLogTableName());
+            example.setTable(table);
+            return SnapshotGeneratorFactory.getInstance().has(example, getDatabase());
+        } catch (InvalidExampleException e) {
+            throw new DatabaseException(e);
+        }
+    }
+
+    private void createDatabaseChangelogPK() throws DatabaseException {
+        AddPrimaryKeyStatement pkStatement = new AddPrimaryKeyStatement(getLiquibaseCatalogName(), getLiquibaseSchemaName(), getDatabaseChangeLogTableName(),
+                ColumnConfig.arrayFromNames("ID, AUTHOR, FILENAME"), "PK_DATABASECHANGELOG");
+        try {
+            ChangelogJdbcMdcListener.execute(getDatabase(), ex -> ex.execute(pkStatement));
+            getDatabase().commit();
+        } catch (DatabaseException e) {
+            // if PK already exists just ignore the exception
+            if (!existsDatabaseChangelogPK()) {
+                throw e;
+            }
+        }
+    }
 }
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelTime.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelTime.java
new file mode 100644
index 000000000000..2ed02eeb536c
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelTime.java
@@ -0,0 +1,84 @@
+package org.keycloak.connections.jpa.updater.liquibase.custom;
+
+import liquibase.exception.CustomChangeException;
+import liquibase.statement.core.DeleteStatement;
+import liquibase.structure.core.Column;
+import org.keycloak.migration.ModelVersion;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Collectors;
+
+/**
+ * Cleanup script for removing duplicated migration model update time in the MIGRATION_MODEL table
+ * See: <a href="https://github.com/keycloak/keycloak/issues/40088">keycloak#40088</a>
+ */
+public class JpaUpdate26_2_6_RemoveDuplicateMigrationModelTime extends CustomKeycloakTask {
+    private final static String MIGRATION_MODEL_TABLE = "MIGRATION_MODEL";
+
+    @Override
+    protected String getTaskId() {
+        return "Delete duplicated records for DB update time in MIGRATION_MODEL table";
+    }
+
+    @Override
+    protected void generateStatementsImpl() throws CustomChangeException {
+        final Map<String, ModelVersion> itemsToDelete = new HashMap<>();
+
+        final String tableName = getTableName(MIGRATION_MODEL_TABLE);
+        final String colId = database.correctObjectName("ID", Column.class);
+        final String colVersion = database.correctObjectName("VERSION", Column.class);
+        final String colUpdateTime = database.correctObjectName("UPDATE_TIME", Column.class);
+
+        final String GET_DUPLICATED_RECORDS = """
+                SELECT m1.%s, m1.%s
+                FROM %s m1
+                WHERE EXISTS (
+                    SELECT m2.%s
+                    FROM %s m2
+                    WHERE m2.%s = m1.%s AND m2.%s <> m1.%s
+                )
+                """.formatted(
+                colId, colVersion,  // SELECT m1.%s, m1.%s  =>  SELECT m1.ID, m1.VERSION
+                tableName,          // FROM %s m1           =>  FROM MIGRATION_MODEL m1
+                colId,              // SELECT m2.%s         =>  SELECT m2.ID
+                tableName,          // FROM %s m2           =>  FROM MIGRATION_MODEL m2
+                // WHERE m2.%s = m1.%s AND m2.%s <> m1.%s   =>  WHERE m2.UPDATE_TIME = m1.UPDATE_TIME AND m2.ID <> m1.ID
+                colUpdateTime, colUpdateTime, colId, colId
+        );
+
+        //noinspection SqlSourceToSinkFlow
+        try (PreparedStatement ps = connection.prepareStatement(GET_DUPLICATED_RECORDS)) {
+            ResultSet resultSet = ps.executeQuery();
+            while (resultSet.next()) {
+                String id = resultSet.getString(1);
+                ModelVersion version = new ModelVersion(resultSet.getString(2));
+                itemsToDelete.put(id, version);
+            }
+        } catch (Exception e) {
+            throw new CustomChangeException(getTaskId() + ": Failed to detect duplicate MIGRATION_MODEL rows", e);
+        }
+
+        // Get ID of the highest Keycloak version with the same update time
+        var highestVersionId = itemsToDelete.entrySet()
+                .stream()
+                .reduce((e1, e2) -> e1.getValue().lessThan(e2.getValue()) ? e2 : e1)
+                .map(Map.Entry::getKey)
+                .orElse(null);
+
+        AtomicInteger i = new AtomicInteger();
+        itemsToDelete.keySet().stream()
+                .filter(f -> !f.equals(highestVersionId))
+                .collect(Collectors.groupingByConcurrent(id -> i.getAndIncrement() / 20, Collectors.toList())) // Split into chunks of at most 20 items
+                .values().stream()
+                .map(ids -> new DeleteStatement(null, null, MIGRATION_MODEL_TABLE)
+                        .setWhere(":name IN (" + ids.stream().map(id -> "?").collect(Collectors.joining(",")) + ")")
+                        .addWhereColumnName(colId)
+                        .addWhereParameters(ids.toArray())
+                )
+                .forEach(statements::add);
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelVersion.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelVersion.java
new file mode 100644
index 000000000000..220b3c88a501
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate26_2_6_RemoveDuplicateMigrationModelVersion.java
@@ -0,0 +1,91 @@
+package org.keycloak.connections.jpa.updater.liquibase.custom;
+
+import liquibase.exception.CustomChangeException;
+import liquibase.statement.core.DeleteStatement;
+import liquibase.structure.core.Column;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Collectors;
+
+/**
+ * Cleanup script for removing duplicated migration model versions in the MIGRATION_MODEL table
+ * See: <a href="https://github.com/keycloak/keycloak/issues/39866">keycloak#39866</a>
+ */
+public class JpaUpdate26_2_6_RemoveDuplicateMigrationModelVersion extends CustomKeycloakTask {
+
+    private final static String MIGRATION_MODEL_TABLE = "MIGRATION_MODEL";
+
+    @Override
+    protected String getTaskId() {
+        return "Delete duplicated records for DB version in MIGRATION_MODEL table";
+    }
+
+    @Override
+    protected void generateStatementsImpl() throws CustomChangeException {
+        Set<String> idsToDelete = new HashSet<>();
+
+        final String tableName = getTableName(MIGRATION_MODEL_TABLE);
+        final String colId = database.correctObjectName("ID", Column.class);
+        final String colVersion = database.correctObjectName("VERSION", Column.class);
+        final String colUpdateTime = database.correctObjectName("UPDATE_TIME", Column.class);
+
+        //noinspection SqlSourceToSinkFlow
+        try (PreparedStatement ps = connection.prepareStatement(getOlderDuplicatedRecords(tableName, colId, colVersion, colUpdateTime))) {
+            ResultSet resultSet = ps.executeQuery();
+            while (resultSet.next()) {
+                idsToDelete.add(resultSet.getString(1));
+            }
+        } catch (Exception e) {
+            throw new CustomChangeException(getTaskId() + ": Failed to detect duplicate MIGRATION_MODEL rows", e);
+        }
+
+        AtomicInteger i = new AtomicInteger();
+        idsToDelete.stream()
+                .collect(Collectors.groupingByConcurrent(id -> i.getAndIncrement() / 20, Collectors.toList())) // Split into chunks of at most 20 items
+                .values().stream()
+                .map(ids -> new DeleteStatement(null, null, MIGRATION_MODEL_TABLE)
+                        .setWhere(":name IN (" + ids.stream().map(id -> "?").collect(Collectors.joining(",")) + ")")
+                        .addWhereColumnName(colId)
+                        .addWhereParameters(ids.toArray())
+                )
+                .forEach(statements::add);
+    }
+
+    /**
+     * Get duplicated records
+     * <p>
+     * If there is VERSION duplication, choose:
+     * <p>
+     * - If UPDATE_TIME is: different -> pick more recent
+     * <p>
+     * - If UPDATE_TIME is: equal -> pick some random
+     */
+    private String getOlderDuplicatedRecords(String tableName, String colId, String colVersion, String colUpdateTime) {
+        return """
+                SELECT m1.%s
+                FROM %s m1
+                WHERE EXISTS (
+                    SELECT m2.%s
+                    FROM %s m2
+                    WHERE m2.%s = m1.%s
+                    AND (
+                        m2.%s > m1.%s
+                        OR (m2.%s = m1.%s AND m2.%s > m1.%s)
+                    )
+                )
+                """.formatted(
+                colId,                  // SELECT m1.%s         => SELECT m1.ID
+                tableName,              // FROM %s m1           => FROM MIGRATION_MODEL m1
+                colId,                  // SELECT m2.%s         => SELECT m2.ID
+                tableName,              // FROM %s              => FROM MIGRATION_MODEL m2
+                colVersion, colVersion, // WHERE m2.%s = m1.%s  => WHERE m2.VERSION = m1.VERSION
+                colUpdateTime, colUpdateTime, // m2.%s > m1.%s  => m2.UPDATE_TIME > m1.UPDATE_TIME
+                // OR (m2.%s = m1.%s AND m2.%s > m1.%s)         => OR (m2.UPDATE_TIME = m1.UPDATE_TIME AND m2.ID > m1.ID)
+                colUpdateTime, colUpdateTime, colId, colId);
+    }
+
+}
diff --git a/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java b/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java
index 4b84cbe7aaa6..44487f4d7fc8 100644
--- a/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java
+++ b/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java
@@ -17,28 +17,33 @@
 
 package org.keycloak.connections.jpa.util;
 
+import jakarta.persistence.PersistenceUnitTransactionType;
 import jakarta.persistence.ValidationMode;
 import org.hibernate.dialect.Dialect;
 import org.hibernate.internal.SessionFactoryImpl;
+import org.hibernate.jpa.boot.spi.PersistenceUnitDescriptor;
+import org.hibernate.jpa.boot.spi.PersistenceXmlParser;
 import org.jboss.logging.Logger;
 import org.hibernate.engine.spi.SessionFactoryImplementor;
 import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
-import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
 import org.hibernate.jpa.boot.spi.Bootstrap;
 import org.keycloak.connections.jpa.entityprovider.JpaEntityProvider;
 import org.keycloak.models.KeycloakSession;
 
 import jakarta.persistence.EntityManager;
 import jakarta.persistence.EntityManagerFactory;
-import jakarta.persistence.spi.PersistenceUnitTransactionType;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
 import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
+import java.util.NoSuchElementException;
 import java.util.Properties;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -56,11 +61,22 @@ public static String getTableNameForNativeQuery(String tableName, EntityManager
         return (schema==null) ? tableName : dialect.openQuote() + schema + dialect.closeQuote() + "." + tableName;
     }
 
+    private static List<ParsedPersistenceXmlDescriptor> transformPersistenceUnits(Collection<PersistenceUnitDescriptor> descriptors) {
+        return descriptors.stream().map(descriptor -> (ParsedPersistenceXmlDescriptor) descriptor).collect(Collectors.toList());
+    }
+
     public static EntityManagerFactory createEntityManagerFactory(KeycloakSession session, String unitName, Map<String, Object> properties, boolean jta) {
         PersistenceUnitTransactionType txType = jta ? PersistenceUnitTransactionType.JTA : PersistenceUnitTransactionType.RESOURCE_LOCAL;
-        List<ParsedPersistenceXmlDescriptor> persistenceUnits = new ArrayList<>(PersistenceXmlParser.locatePersistenceUnits(properties));
+        PersistenceXmlParser parser = PersistenceXmlParser.create(properties);
+        List<URL> urls = parser.getClassLoaderService().locateResources("META-INF/persistence.xml");
 
-        persistenceUnits.add(PersistenceXmlParser.locateIndividualPersistenceUnit(JpaUtils.class.getClassLoader().getResource("default-persistence.xml")));
+        List<ParsedPersistenceXmlDescriptor> persistenceUnits = urls.isEmpty() ? new ArrayList<>() : transformPersistenceUnits(parser.parse(urls).values());
+        ParsedPersistenceXmlDescriptor defaultPersistenceUnit = transformPersistenceUnits(parser.parse(Collections.singletonList(JpaUtils.class.getClassLoader().getResource("default-persistence.xml")), txType)
+                .values())
+                .stream()
+                .findFirst()
+                .orElseThrow(() -> new NoSuchElementException("Cannot find the file 'default-persistence.xml'"));
+        persistenceUnits.add(defaultPersistenceUnit);
 
         for (ParsedPersistenceXmlDescriptor persistenceUnit : persistenceUnits) {
             if (persistenceUnit.getName().equals(unitName)) {
diff --git a/model/jpa/src/main/java/org/keycloak/events/jpa/JpaAdminEventQuery.java b/model/jpa/src/main/java/org/keycloak/events/jpa/JpaAdminEventQuery.java
index b5fed1fad79c..8e42293a436f 100755
--- a/model/jpa/src/main/java/org/keycloak/events/jpa/JpaAdminEventQuery.java
+++ b/model/jpa/src/main/java/org/keycloak/events/jpa/JpaAdminEventQuery.java
@@ -121,14 +121,26 @@ public AdminEventQuery resourcePath(String resourcePath) {
     }
 
     @Override
+    @Deprecated
     public AdminEventQuery fromTime(Date fromTime) {
-        predicates.add(cb.greaterThanOrEqualTo(root.<Long>get("time"), fromTime.getTime()));
+        return fromTime(fromTime.getTime());
+    }
+
+    @Override
+    public AdminEventQuery fromTime(long fromTime) {
+        predicates.add(cb.greaterThanOrEqualTo(root.get("time"), fromTime));
         return this;
     }
 
     @Override
+    @Deprecated
     public AdminEventQuery toTime(Date toTime) {
-        predicates.add(cb.lessThanOrEqualTo(root.<Long>get("time"), toTime.getTime()));
+        return toTime(toTime.getTime());
+    }
+
+    @Override
+    public AdminEventQuery toTime(long toTime) {
+        predicates.add(cb.lessThanOrEqualTo(root.get("time"), toTime));
         return this;
     }
 
diff --git a/model/jpa/src/main/java/org/keycloak/events/jpa/JpaEventQuery.java b/model/jpa/src/main/java/org/keycloak/events/jpa/JpaEventQuery.java
index 74d4b62d382c..768444450eb2 100644
--- a/model/jpa/src/main/java/org/keycloak/events/jpa/JpaEventQuery.java
+++ b/model/jpa/src/main/java/org/keycloak/events/jpa/JpaEventQuery.java
@@ -90,8 +90,14 @@ public EventQuery user(String userId) {
     }
 
     @Override
+    @Deprecated
     public EventQuery fromDate(Date fromDate) {
-        predicates.add(cb.greaterThanOrEqualTo(root.<Long>get("time"), fromDate.getTime()));
+        return fromDate(fromDate.getTime());
+    }
+
+    @Override
+    public EventQuery fromDate(long fromDate) {
+        predicates.add(cb.greaterThanOrEqualTo(root.get("time"), fromDate));
         return this;
     }
 
@@ -103,7 +109,12 @@ public EventQuery toDate(Date toDate) {
         calendar.set(Calendar.MINUTE, 59);
         calendar.set(Calendar.SECOND, 59);
         calendar.set(Calendar.MILLISECOND, 999);
-        predicates.add(cb.lessThanOrEqualTo(root.<Long>get("time"), calendar.getTimeInMillis()));
+        return toDate(calendar.getTimeInMillis());
+    }
+
+    @Override
+    public EventQuery toDate(long toDate) {
+        predicates.add(cb.lessThanOrEqualTo(root.get("time"), toDate));
         return this;
     }
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
index 0593c7e3cef2..0ed3b5f666ed 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
@@ -17,6 +17,12 @@
 
 package org.keycloak.models.jpa;
 
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Predicate;
+import jakarta.persistence.criteria.Root;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.GroupModel;
@@ -38,6 +44,7 @@
 import java.util.Objects;
 import java.util.stream.Stream;
 import jakarta.persistence.LockModeType;
+import org.keycloak.storage.UserStoragePrivateUtil;
 
 import static java.util.Optional.ofNullable;
 import static org.keycloak.common.util.CollectionUtil.collectionEquals;
@@ -82,6 +89,17 @@ public void setName(String name) {
         fireGroupUpdatedEvent();
     }
 
+    @Override
+    public String getDescription() {
+        return group.getDescription();
+    }
+
+    @Override
+    public void setDescription(String description) {
+        group.setDescription(description);
+        fireGroupUpdatedEvent();
+    }
+
     @Override
     public GroupModel getParent() {
         String parentId = this.getParentId();
@@ -136,17 +154,32 @@ public Stream<GroupModel> getSubGroupsStream() {
 
     @Override
     public Stream<GroupModel> getSubGroupsStream(String search, Boolean exact, Integer firstResult, Integer maxResults) {
-        TypedQuery<String> query;
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(builder.equal(root.get("parentId"), group.getId()));
+
+        search = search == null ? "" : search;
+
         if (Boolean.TRUE.equals(exact)) {
-            query = em.createNamedQuery("getGroupIdsByParentAndName", String.class);
+            predicates.add(builder.like(root.get("name"), search));
         } else {
-            query = em.createNamedQuery("getGroupIdsByParentAndNameContaining", String.class);
+            predicates.add(builder.like(builder.lower(root.get("name")), builder.lower(builder.literal("%" + search + "%"))));
         }
-        query.setParameter("realm", realm.getId())
-                .setParameter("parent", group.getId())
-                .setParameter("search", search == null ? "" : search);
 
-        return closing(paginateQuery(query, firstResult, maxResults).getResultStream()
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, (PartialEvaluationStorageProvider) UserStoragePrivateUtil.userLocalStorage(session), realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), firstResult, maxResults).getResultStream()
                 .map(realm::getGroupById)
                 // In concurrent tests, the group might be deleted in another thread, therefore, skip those null values.
                 .filter(Objects::nonNull)
@@ -155,10 +188,22 @@ public Stream<GroupModel> getSubGroupsStream(String search, Boolean exact, Integ
 
     @Override
     public Long getSubGroupsCount() {
-        return em.createNamedQuery("getGroupCountByParent", Long.class)
-                .setParameter("realm", realm.getId())
-                .setParameter("parent", group.getId())
-                .getSingleResult();
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> queryBuilder = builder.createQuery(Long.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(builder.count(root.get("id")));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(builder.equal(root.get("parentId"), group.getId()));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, (PartialEvaluationStorageProvider) UserStoragePrivateUtil.userLocalStorage(session), realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+
+        return em.createQuery(queryBuilder).getSingleResult();
     }
 
     @Override
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaClientProviderFactory.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaClientProviderFactory.java
index 5d3ac8239238..db9a24e43288 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaClientProviderFactory.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaClientProviderFactory.java
@@ -18,6 +18,7 @@
 package org.keycloak.models.jpa;
 
 import org.keycloak.Config;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.Profile;
 import org.keycloak.connections.jpa.JpaConnectionProvider;
 import org.keycloak.models.ClientProvider;
@@ -26,7 +27,6 @@
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.jpa.entities.RealmAttributes;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.saml.SamlConfigAttributes;
 
 import jakarta.persistence.EntityManager;
@@ -70,10 +70,7 @@ public void postInit(KeycloakSessionFactory factory) {
                     if (Objects.equals(attrUpdateEvent.getAttributeName(), RealmAttributes.ADMIN_PERMISSIONS_ENABLED) && Boolean.parseBoolean(attrUpdateEvent.getAttributeValue())) {
                         KeycloakSession keycloakSession = attrUpdateEvent.getKeycloakSession();
                         RealmModel realm = attrUpdateEvent.getRealm();
-
-                        if (realm.getAdminPermissionsClient() != null) return;
-
-                        KeycloakModelUtils.setupAdminPermissionsClient(keycloakSession, realm);
+                        AdminPermissionsSchema.SCHEMA.init(keycloakSession, realm);
                     }
                 }
             });
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
index f5d60cb09f5e..b3fa534ede1f 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
@@ -38,11 +38,15 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.UUID;
 import java.util.function.Function;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+
 import org.hibernate.Session;
 import org.jboss.logging.Logger;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.client.clienttype.ClientTypeManager;
 import org.keycloak.common.Profile;
 import org.keycloak.common.util.Time;
@@ -457,18 +461,16 @@ public boolean removeRole(RoleModel role) {
         // So in any case, native query is not an option. This is not optimal as it executes additional queries but
         // the alternative of clearing the persistence context is not either as we don't know if something currently present
         // in the context is not needed later.
-        Stream<RoleEntity> parentRoles = em.createNamedQuery("getParentRolesOfACompositeRole", RoleEntity.class).setParameter("compositeRole", roleEntity).getResultStream();
-        parentRoles.forEach(parentRole -> parentRole.getCompositeRoles().remove(roleEntity));
-        parentRoles.close();
+
+        roleEntity.getCompositeRoles().forEach(childRole -> childRole.getParentRoles().remove(roleEntity));
+        roleEntity.getParentRoles().forEach(parentRole -> parentRole.getCompositeRoles().remove(roleEntity));
 
         em.createNamedQuery("deleteClientScopeRoleMappingByRole").setParameter("role", roleEntity).executeUpdate();
 
-        em.flush();
         em.remove(roleEntity);
 
         session.getKeycloakSessionFactory().publish(roleRemovedEvent(role));
 
-        em.flush();
         return true;
 
     }
@@ -519,16 +521,29 @@ public GroupModel getGroupById(RealmModel realm, String id) {
 
     @Override
     public GroupModel getGroupByName(RealmModel realm, GroupModel parent, String name) {
-        TypedQuery<String> query = em.createNamedQuery("getGroupIdsByParentAndName", String.class);
-        query.setParameter("search", name);
-        query.setParameter("realm", realm.getId());
-        query.setParameter("parent", parent != null ? parent.getId() : GroupEntity.TOP_PARENT_ID);
-        List<String> entities = query.getResultList();
-        if (entities.isEmpty()) return null;
-        if (entities.size() > 1) throw new IllegalStateException("Should not be more than one Group with same name");
-        String id = query.getResultList().get(0);
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(builder.equal(root.get("parentId"), parent != null ? parent.getId() : GroupEntity.TOP_PARENT_ID));
+        predicates.add(builder.equal(root.get("name"), name));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, null, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        List<String> groups = em.createQuery(queryBuilder).getResultList();
 
-        return session.groups().getGroupById(realm, id);
+        if (groups.isEmpty()) return null;
+        if (groups.size() > 1) throw new IllegalStateException("Should not be more than one Group with same name");
+
+        return session.groups().getGroupById(realm, groups.get(0));
     }
 
     @Override
@@ -560,10 +575,24 @@ public void moveGroup(RealmModel realm, GroupModel group, GroupModel toParent) {
 
     @Override
     public Stream<GroupModel> getGroupsStream(RealmModel realm) {
-        return closing(em.createNamedQuery("getGroupIdsByRealm", String.class)
-                .setParameter("realm", realm.getId())
-                .getResultStream())
-                .map(g -> session.groups().getGroupById(realm, g));
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, null, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(em.createQuery(queryBuilder).getResultStream())
+                .map(g -> session.groups().getGroupById(realm, g))
+                .filter(Objects::nonNull);
     }
 
     @Override
@@ -575,13 +604,26 @@ public Stream<GroupModel> getGroupsStream(RealmModel realm, Stream<String> ids,
             return Stream.empty();
         }
 
-        TypedQuery<String> query = em.createNamedQuery("getGroupIdsByNameContainingFromIdList", String.class)
-                .setParameter("realm", realm.getId())
-                .setParameter("search", search)
-                .setParameter("ids", idsList);
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
 
-        return closing(paginateQuery(query, first, max).getResultStream())
-                .map(g -> session.groups().getGroupById(realm, g)).filter(Objects::nonNull);
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(builder.like(builder.lower(root.get("name")), builder.lower(builder.literal("%" + search + "%"))));
+        predicates.add(root.get("id").in(idsList));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), first, max).getResultStream())
+                .map(g -> session.groups().getGroupById(realm, g))
+                .filter(Objects::nonNull);
     }
 
     @Override
@@ -590,18 +632,30 @@ public Stream<GroupModel> getGroupsStream(RealmModel realm, Stream<String> ids,
             return getGroupsStream(realm, ids);
         }
 
-        List<String> idsList = ids.collect(Collectors.toList());
+        List<String> idsList = ids.toList();
         if (idsList.isEmpty()) {
             return Stream.empty();
         }
 
-        TypedQuery<String> query = em.createNamedQuery("getGroupIdsFromIdList", String.class)
-                .setParameter("realm", realm.getId())
-                .setParameter("ids", idsList);
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
 
+        List<Predicate> predicates = new ArrayList<>();
 
-        return closing(paginateQuery(query, first, max).getResultStream())
-                .map(g -> session.groups().getGroupById(realm, g)).filter(Objects::nonNull);
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(root.get("id").in(idsList));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(em.createQuery(queryBuilder).getResultStream())
+                .map(g -> session.groups().getGroupById(realm, g))
+                .filter(Objects::nonNull);
     }
 
     @Override
@@ -611,39 +665,71 @@ public Stream<GroupModel> getGroupsStream(RealmModel realm, Stream<String> ids)
 
     @Override
     public Long getGroupsCount(RealmModel realm, Stream<String> ids, String search) {
-        TypedQuery<Long> query;
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> queryBuilder = builder.createQuery(Long.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(builder.count(root.get("id")));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+
         if (search != null && !search.isEmpty()) {
-            query = em.createNamedQuery("getGroupCountByNameContainingFromIdList", Long.class)
-                        .setParameter("search", search);
-        } else {
-            query = em.createNamedQuery("getGroupIdsFromIdList", Long.class);
+            predicates.add(builder.like(builder.lower(root.get("name")), builder.lower(builder.literal("%" + search + "%"))));
         }
 
-        return query.setParameter("realm", realm.getId())
-                .setParameter("ids", ids.collect(Collectors.toList()))
-                .getSingleResult();
+        predicates.add(root.get("id").in(ids.toList()));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return em.createQuery(queryBuilder).getSingleResult();
     }
 
     @Override
     public Long getGroupsCount(RealmModel realm, Boolean onlyTopGroups) {
-        if(Objects.equals(onlyTopGroups, Boolean.TRUE)) {
-            return em.createNamedQuery("getGroupCountByParent", Long.class)
-                    .setParameter("realm", realm.getId())
-                    .setParameter("parent", GroupEntity.TOP_PARENT_ID)
-                    .getSingleResult();
-        } else {
-            return em.createNamedQuery("getGroupCount", Long.class)
-                    .setParameter("realm", realm.getId())
-                    .getSingleResult();
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> queryBuilder = builder.createQuery(Long.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(builder.count(root.get("id")));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+
+        if (Objects.equals(onlyTopGroups, Boolean.TRUE)) {
+            predicates.add(builder.equal(root.get("parentId"), GroupEntity.TOP_PARENT_ID));
         }
+
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+
+        return em.createQuery(queryBuilder).getSingleResult();
     }
 
     @Override
     public long getClientsCount(RealmModel realm) {
-        final Long res = em.createNamedQuery("getRealmClientsCount", Long.class)
-          .setParameter("realm", realm.getId())
-          .getSingleResult();
-        return res == null ? 0l : res;
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> queryBuilder = builder.createQuery(Long.class);
+        Root<ClientEntity> root = queryBuilder.from(ClientEntity.class);
+
+        queryBuilder.select(builder.count(root.get("id")));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realmId"), realm.getId()));
+
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.CLIENTS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+
+        return em.createQuery(queryBuilder).getSingleResult();
     }
 
     @Override
@@ -665,18 +751,30 @@ public Stream<GroupModel> getGroupsByRoleStream(RealmModel realm, RoleModel role
 
     @Override
     public Stream<GroupModel> getTopLevelGroupsStream(RealmModel realm, String search, Boolean exact, Integer firstResult, Integer maxResults) {
-        TypedQuery<String> groupsQuery;
-        if(Boolean.TRUE.equals(exact)) {
-            groupsQuery = em.createNamedQuery("getGroupIdsByParentAndName", String.class);
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+        predicates.add(builder.equal(root.get("parentId"), GroupEntity.TOP_PARENT_ID));
+
+        if (Boolean.TRUE.equals(exact)) {
+            predicates.add(builder.like(root.get("name"), search));
         } else {
-            groupsQuery = em.createNamedQuery("getGroupIdsByParentAndNameContaining", String.class);
+            predicates.add(builder.like(builder.lower(root.get("name")), builder.lower(builder.literal("%" + search + "%"))));
         }
 
-        groupsQuery.setParameter("realm", realm.getId())
-            .setParameter("parent", GroupEntity.TOP_PARENT_ID)
-            .setParameter("search", search);
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
 
-        return closing(paginateQuery(groupsQuery, firstResult, maxResults).getResultStream()
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), firstResult, maxResults).getResultStream()
             .map(realm::getGroupById)
             // In concurrent tests, the group might be deleted in another thread, therefore, skip those null values.
             .filter(Objects::nonNull)
@@ -818,12 +916,24 @@ public Stream<ClientModel> getClientsStream(RealmModel realm) {
 
     @Override
     public Stream<ClientModel> getClientsStream(RealmModel realm, Integer firstResult, Integer maxResults) {
-        TypedQuery<String> query = em.createNamedQuery("getClientIdsByRealm", String.class);
+        return closing(getClientIdsStream(realm, firstResult, maxResults).map(id -> new ClientModelLazyDelegate.WithId(session, realm, id)));
+    }
 
-        query.setParameter("realm", realm.getId());
-        Stream<String> clients = paginateQuery(query, firstResult, maxResults).getResultStream();
+    private Stream<String> getClientIdsStream(RealmModel realm, Integer firstResult, Integer maxResults) {
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<ClientEntity> root = queryBuilder.from(ClientEntity.class);
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realmId"), realm.getId()));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.CLIENTS, realm, builder, queryBuilder, root));
+
+        Predicate finalPredicate = builder.and(predicates.toArray(new Predicate[0]));
+        queryBuilder.where(finalPredicate).orderBy(builder.asc(root.get("clientId")));
 
-        return closing(clients.map(id -> (ClientModel) new ClientModelLazyDelegate.WithId(session, realm, id)));
+        return paginateQuery(em.createQuery(queryBuilder), firstResult, maxResults).getResultStream();
     }
 
     @Override
@@ -871,12 +981,22 @@ public ClientModel getClientByClientId(RealmModel realm, String clientId) {
 
     @Override
     public Stream<ClientModel> searchClientsByClientIdStream(RealmModel realm, String clientId, Integer firstResult, Integer maxResults) {
-        TypedQuery<String> query = em.createNamedQuery("searchClientsByClientId", String.class);
-        query.setParameter("clientId", clientId);
-        query.setParameter("realm", realm.getId());
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<ClientEntity> root = queryBuilder.from(ClientEntity.class);
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realmId"), realm.getId()));
+        predicates.add(builder.like(builder.lower(root.get("clientId")), builder.lower(builder.literal("%" + clientId + "%"))));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.CLIENTS, realm, builder, queryBuilder, root));
 
-        Stream<String> results = paginateQuery(query, firstResult, maxResults).getResultStream();
-        return closing(results.map(id -> (ClientModel) new ClientModelLazyDelegate.WithId(session, realm, id)));
+        Predicate finalPredicate = builder.and(predicates.toArray(new Predicate[0]));
+        queryBuilder.where(finalPredicate).orderBy(builder.asc(root.get("clientId")));
+
+        Stream<String> results = paginateQuery(em.createQuery(queryBuilder), firstResult, maxResults).getResultStream();
+        return closing(results.map(id -> new ClientModelLazyDelegate.WithId(session, realm, id)));
     }
 
     @Override
@@ -926,6 +1046,8 @@ public Stream<ClientModel> searchClientsByAttributes(RealmModel realm, Map<Strin
             }
         }
 
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.CLIENTS, realm, builder, queryBuilder, root));
+
         Predicate finalPredicate = builder.and(predicates.toArray(new Predicate[0]));
         queryBuilder.where(finalPredicate).orderBy(builder.asc(root.get("clientId")));
 
@@ -981,13 +1103,7 @@ public Stream<ClientModel> searchClientsByAuthenticationFlowBindingOverrides(Rea
 
     @Override
     public void removeClients(RealmModel realm) {
-        TypedQuery<String> query = em.createNamedQuery("getClientIdsByRealm", String.class);
-        query.setParameter("realm", realm.getId());
-        List<String> clients = query.getResultList();
-        for (String client : clients) {
-            // No need to go through cache. Clients were already invalidated
-            removeClient(realm, client);
-        }
+        closing(getClientIdsStream(realm, -1, -1)).forEach((id) -> removeClient(realm, id));
     }
 
     @Override
@@ -1116,17 +1232,98 @@ public void removeClientScopes(RealmModel realm) {
         realm.getClientScopesStream().map(ClientScopeModel::getId).forEach(id -> this.removeClientScope(realm, id));
     }
 
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByProtocol(RealmModel realm, String protocol)
+    {
+        TypedQuery<ClientScopeEntity> query = em.createNamedQuery("getClientScopesByProtocol",
+                                                                  ClientScopeEntity.class)
+                                                .setParameter("realm", realm.getId())
+                                                .setParameter("protocol", protocol);
+        return query.getResultStream()
+                    .map(entity -> new ClientScopeAdapter(realm, em, session, entity));
+    }
+
+    /**
+     * This method filters clientScopes by specific attributes. To do this, it will generate the sql-statement
+     * dynamically based on the given search-parameters.<br />
+     * This method prevents SQL-Injections by adding dynamic parameters into the SQL-statement and resolves them
+     * later by using the JPA query function {@code query.setParameter(dynamicParamName, actualValue)}.<br/>
+     * Here is an example of a generated statement:
+     * <pre>
+     *     {@code
+     *     SELECT distinct C FROM ClientScopeEntity C
+     *     inner join ClientScopeAttributeEntity CA0 on C.id = CA0.clientScope.id
+     *                                              and CA0.name = :a3e8d01932c104f0ab79441d34884bada
+     *     WHERE C.realmId = :realmId
+     *     and CA0.value = :acedd0bedc7264a2fb524a37814f7aaa1
+     *     }
+     * </pre>
+     *
+     * @param realm     Realm.
+     * @param searchMap a key-value map that holds the attribute names and values to search for.
+     * @param useOr     If the search-params should be combined with or-expressions or and-expressions
+     * @return a stream of clientScopes matching the given criteria
+     */
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByAttributes(RealmModel realm, Map<String, String> searchMap,
+                                                                boolean useOr) {
+        // we build this specific query dynamically, but we enter the parameters as keys to avoid SQL injections.
+        StringBuilder jpql = new StringBuilder("SELECT distinct C FROM ClientScopeEntity C");
+        List<String> keys = new ArrayList<>(searchMap.keySet());
+        Map<String, String> dynamicParameterNameMap = new HashMap<>();
+        Map<String, String> dynamicParameterValueMap = new HashMap<>();
+        StringBuilder whereClauseExtension = new StringBuilder();
+        // I am using an indexed for-loop because I need the index for dynamic jpql references
+        for (int i = 0; i < keys.size(); i++) {
+            String key = keys.get(i);
+            String value = searchMap.get(key);
+            Supplier<String> generateDynamicParameterName = () -> {
+                return "a" /* dynamic params must start with a letter */
+                        + UUID.randomUUID().toString().replaceAll("-","");
+            };
+            final String dynamicParameterName = generateDynamicParameterName.get();
+            final String dynamicParameterValue = generateDynamicParameterName.get();
+            dynamicParameterNameMap.put(dynamicParameterName, key);
+            dynamicParameterValueMap.put(dynamicParameterValue, value);
+            jpql.append('\n')
+                .append("""
+                                inner join ClientScopeAttributeEntity CA%1$s on C.id = CA%1$s.clientScope.id
+                                                                             and CA%1$s.name = :%2$s
+                                """.stripIndent().strip().formatted(i, dynamicParameterName));
+            whereClauseExtension.append('\n');
+            if (useOr) {
+                whereClauseExtension.append("or");
+            }else {
+                whereClauseExtension.append("and");
+            }
+            whereClauseExtension.append(" CA%1$s.value = :%2$s".formatted(i, dynamicParameterValue));
+        }
+
+        jpql.append('\n').append(" WHERE C.realmId = :realmId").append(whereClauseExtension);
+        logger.debugf("Filter for clientScopes with query:\n%s", jpql);
+        TypedQuery<ClientScopeEntity> query = em.createQuery(jpql.toString(), ClientScopeEntity.class);
+        dynamicParameterNameMap.forEach(query::setParameter);
+        dynamicParameterValueMap.forEach(query::setParameter);
+        return query.setParameter("realmId", realm.getId())
+                    .getResultStream().map(scope -> new ClientScopeAdapter(realm, em, session, scope));
+    }
+
     @Override
     public void addClientScopes(RealmModel realm, ClientModel client, Set<ClientScopeModel> clientScopes, boolean defaultScope) {
-        // Defaults to openid-connect
-        String clientProtocol = client.getProtocol() == null ? OIDCLoginProtocol.LOGIN_PROTOCOL : client.getProtocol();
+        List<String> acceptedClientProtocols = KeycloakModelUtils.getAcceptedClientScopeProtocols(client);
 
         Map<String, ClientScopeModel> existingClientScopes = getClientScopes(realm, client, true);
         existingClientScopes.putAll(getClientScopes(realm, client, false));
 
         clientScopes.stream()
-            .filter(clientScope -> ! existingClientScopes.containsKey(clientScope.getName()))
-            .filter(clientScope -> Objects.equals(clientScope.getProtocol(), clientProtocol))
+            .filter(clientScope -> !existingClientScopes.containsKey(clientScope.getName()))
+            .filter(clientScope -> {
+                if (clientScope.getProtocol() == null) {
+                    // set default protocol if not set. Otherwise, we will get a NullPointer
+                    clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+                }
+                return acceptedClientProtocols.contains(clientScope.getProtocol());
+            })
             .forEach(clientScope -> {
                 ClientScopeClientMappingEntity entity = new ClientScopeClientMappingEntity();
                 entity.setClientScopeId(clientScope.getId());
@@ -1161,8 +1358,7 @@ public void addClientScopeToAllClients(RealmModel realm, ClientScopeModel client
 
     @Override
     public Map<String, ClientScopeModel> getClientScopes(RealmModel realm, ClientModel client, boolean defaultScope) {
-        // Defaults to openid-connect
-        String clientProtocol = client.getProtocol() == null ? OIDCLoginProtocol.LOGIN_PROTOCOL : client.getProtocol();
+        List<String> acceptedClientProtocols = KeycloakModelUtils.getAcceptedClientScopeProtocols(client);
 
         TypedQuery<String> query = em.createNamedQuery("clientScopeClientMappingIdsByClient", String.class);
         query.setParameter("clientId", client.getId());
@@ -1171,22 +1367,38 @@ public Map<String, ClientScopeModel> getClientScopes(RealmModel realm, ClientMod
         return closing(query.getResultStream())
                 .map(clientScopeId -> session.clientScopes().getClientScopeById(realm, clientScopeId))
                 .filter(Objects::nonNull)
-                .filter(clientScope -> Objects.equals(clientScope.getProtocol(), clientProtocol))
+                .filter(clientScope -> acceptedClientProtocols.contains(clientScope.getProtocol()))
                 .collect(Collectors.toMap(ClientScopeModel::getName, Function.identity()));
     }
     @Override
     public Stream<GroupModel> searchForGroupByNameStream(RealmModel realm, String search, Boolean exact, Integer first, Integer max) {
-        TypedQuery<String> query;
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<String> queryBuilder = builder.createQuery(String.class);
+        Root<GroupEntity> root = queryBuilder.from(GroupEntity.class);
+
+        queryBuilder.select(root.get("id"));
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("realm"), realm.getId()));
+        predicates.add(builder.equal(root.get("type"), Type.REALM.intValue()));
+
         if (Boolean.TRUE.equals(exact)) {
-            query = em.createNamedQuery("getGroupIdsByName", String.class);
+            predicates.add(builder.equal(root.get("name"), search));
         } else {
-            query = em.createNamedQuery("getGroupIdsByNameContaining", String.class);
+            predicates.add(builder.like(builder.lower(root.get("name")), builder.lower(builder.literal("%" + search + "%"))));
         }
-        query.setParameter("realm", realm.getId())
-                .setParameter("search", search);
-        Stream<String> groups =  paginateQuery(query, first, max).getResultStream();
 
-        return closing(groups.map(id -> session.groups().getGroupById(realm, id)).filter(Objects::nonNull).sorted(GroupModel.COMPARE_BY_NAME).distinct());
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
+        queryBuilder.where(predicates.toArray(new Predicate[0]));
+        queryBuilder.orderBy(builder.asc(root.get("name")));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), first, max).getResultStream()
+                .map(id -> session.groups().getGroupById(realm, id))
+                .filter(Objects::nonNull)
+                .sorted(GroupModel.COMPARE_BY_NAME)
+                .distinct());
     }
 
     @Override
@@ -1219,6 +1431,8 @@ public Stream<GroupModel> searchGroupsByAttributes(RealmModel realm, Map<String,
             predicates.add(builder.and(attrNamePredicate, attrValuePredicate));
         }
 
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.GROUPS, realm, builder, queryBuilder, root));
+
         Predicate finalPredicate = builder.and(predicates.toArray(new Predicate[0]));
         queryBuilder.where(finalPredicate).orderBy(builder.asc(root.get("name")));
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserCredentialStore.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserCredentialStore.java
index f470b171631a..21e234233bee 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserCredentialStore.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserCredentialStore.java
@@ -21,6 +21,7 @@
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.UserCredentialStore;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.jpa.entities.CredentialEntity;
@@ -62,6 +63,7 @@ public JpaUserCredentialStore(KeycloakSession session, EntityManager em) {
     public void updateCredential(RealmModel realm, UserModel user, CredentialModel cred) {
         CredentialEntity entity = em.find(CredentialEntity.class, cred.getId());
         if (!checkCredentialEntity(entity, user)) return;
+        validateDuplicateCredential(realm, user, cred.getUserLabel(), cred.getId());
         entity.setCreatedDate(cred.getCreatedDate());
         entity.setUserLabel(cred.getUserLabel());
         entity.setType(cred.getType());
@@ -138,7 +140,21 @@ public void close() {
 
     }
 
+    private void validateDuplicateCredential(RealmModel realm, UserModel user, String userLabel, String credentialId) {
+        if (userLabel != null) {
+            boolean exists = getStoredCredentialEntities(realm, user)
+                    .anyMatch(existing -> existing.getUserLabel() != null
+                            && existing.getUserLabel().equalsIgnoreCase(userLabel.trim())
+                            && (credentialId == null || !existing.getId().equals(credentialId))); // Exclude self in update
+
+            if (exists) {
+                throw new ModelDuplicateException("Device already exists with the same name", CredentialModel.USER_LABEL);
+            }
+        }
+    }
+
     CredentialEntity createCredentialEntity(RealmModel realm, UserModel user, CredentialModel cred) {
+        validateDuplicateCredential(realm, user, cred.getUserLabel(), null);
         CredentialEntity entity = new CredentialEntity();
         String id = cred.getId() == null ? KeycloakModelUtils.generateId() : cred.getId();
         entity.setId(id);
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserPartialEvaluationProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserPartialEvaluationProvider.java
new file mode 100644
index 000000000000..334a3dc10577
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserPartialEvaluationProvider.java
@@ -0,0 +1,217 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.jpa;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Function;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Expression;
+import jakarta.persistence.criteria.Path;
+import jakarta.persistence.criteria.Predicate;
+import jakarta.persistence.criteria.Root;
+import jakarta.persistence.criteria.Subquery;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.jpa.entities.ResourceEntity;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationContext;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
+import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.jpa.entities.UserGroupMembershipEntity;
+
+/**
+ * A {@link PartialEvaluationStorageProvider} that provides support for partial evaluation when querying {@link UserModel}.
+ */
+public interface JpaUserPartialEvaluationProvider extends PartialEvaluationStorageProvider {
+
+    KeycloakSession getSession();
+    EntityManager getEntityManager();
+
+    @Override
+    default List<Predicate> getFilters(PartialEvaluationContext context) {
+        KeycloakSession session = getSession();
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            // support for FGAP v1, remove once v1 is removed
+            Set<String> userGroups = (Set<String>) session.getAttribute(UserModel.GROUPS);
+
+
+            if (userGroups != null) {
+                return List.of(getFilterByGroupMembership(session, context, userGroups));
+            }
+
+            return List.of();
+        }
+
+        return Optional.ofNullable(getAllowedGroupFilters(context)).map(List::of).orElse(List.of());
+    }
+
+    @Override
+    default List<Predicate> getNegateFilters(PartialEvaluationContext context) {
+        return Optional.ofNullable(getDeniedGroupsFilters(context)).map(List::of).orElse(List.of());
+    }
+
+    private Predicate getAllowedGroupFilters(PartialEvaluationContext context) {
+        Set<String> allowedGroups = context.getAllowedGroups();
+
+        if (allowedGroups.isEmpty()) {
+            return null;
+        }
+
+        if (context.deniedResources().contains(USERS_RESOURCE_TYPE)) {
+            return null;
+        }
+
+        if (context.isResourceTypeAllowed()) {
+            return null;
+        }
+
+        EntityManager em = getEntityManager();
+        CriteriaBuilder cb = em.getCriteriaBuilder();
+
+        if (allowedGroups.contains(GROUPS_RESOURCE_TYPE)) {
+            return cb.exists(createUserMembershipSubquery(context));
+        }
+
+        return cb.exists(createUserMembershipSubquery(context, root -> root.get("groupId").in(allowedGroups)));
+    }
+
+    private Predicate getDeniedGroupsFilters(PartialEvaluationContext context) {
+        CriteriaBuilder cb = context.getCriteriaBuilder();
+        Set<String> allowedGroups = context.getAllowedGroups();
+        Set<String> deniedGroups = context.getDeniedGroups();
+
+        if (deniedGroups.contains(GROUPS_RESOURCE_TYPE)) {
+            // no access granted to group resources
+            Predicate notMembers = cb.not(cb.exists(createUserMembershipSubquery(context)));
+
+            // access denied for the group resource type
+            if (context.isResourceTypeAllowed()) {
+                // access granted to all resources
+                if (allowedGroups.isEmpty()) {
+                    if (context.getDeniedGroupIds().isEmpty()) {
+                        // filter group members but allow
+                        return cb.and(cb.or(notMembers, context.getPath().get("id").in(context.getAllowedResourceIds())));
+                    }
+
+                    return notMembers;
+                }
+
+                Predicate onlySpecificGroups = cb.exists(createUserMembershipSubquery(context, root -> root.get("groupId").in(allowedGroups)));
+                return cb.and(cb.or(notMembers, onlySpecificGroups));
+            }
+
+            return cb.not(cb.exists(createUserMembershipSubquery(context, root -> root.get("groupId").in(context.getDeniedGroupIds()))));
+        }
+
+        if (context.getAllowedResources().isEmpty() && (allowedGroups.isEmpty() || context.deniedResources().contains(USERS_RESOURCE_TYPE))) {
+            return null;
+        }
+
+        if (deniedGroups.isEmpty()) {
+            return null;
+        }
+
+        return cb.not(cb.exists(createUserMembershipSubquery(context, root -> root.get("groupId").in(deniedGroups))));
+    }
+
+    private Subquery<?> createUserMembershipSubquery(PartialEvaluationContext context) {
+        return createUserMembershipSubquery(context, null);
+    }
+
+    private Subquery<?> createUserMembershipSubquery(PartialEvaluationContext context, Function<Root<?>, Predicate> predicate) {
+        EntityManager em = getEntityManager();
+        CriteriaBuilder cb = em.getCriteriaBuilder();
+        CriteriaQuery<?> query = context.criteriaQuery();
+        Subquery<Integer> subquery = query.subquery(Integer.class);
+        Root<?> from = subquery.from(UserGroupMembershipEntity.class);
+
+        subquery.select(cb.literal(1));
+
+        Path<?> root = context.getPath();
+        List<Predicate> finalPredicates = new ArrayList<>();
+
+        if (predicate != null) {
+            finalPredicates.add(predicate.apply(from));
+        }
+
+        finalPredicates.add(cb.equal(from.get("user").get("id"), root.get("id")));
+
+        subquery.where(finalPredicates.toArray(Predicate[]::new));
+
+        return subquery;
+    }
+
+    /**
+     * @deprecated remove once FGAP v1 is removed
+     */
+    @Deprecated
+    private Predicate getFilterByGroupMembership(KeycloakSession session, PartialEvaluationContext context, Set<String> groupIds) {
+        EntityManager em = getEntityManager();
+        CriteriaBuilder cb = em.getCriteriaBuilder();
+        CriteriaQuery<?> query = context.criteriaQuery();
+        Subquery<Integer> subquery = query.subquery(Integer.class);
+        Root<?> from = subquery.from(UserGroupMembershipEntity.class);
+
+        subquery.select(cb.literal(1));
+
+        List<Predicate> subPredicates = new ArrayList<>();
+
+        subPredicates.add(from.get("groupId").in(groupIds));
+
+        Path<?> root = context.getPath();
+
+        subPredicates.add(cb.equal(from.get("user").get("id"), root.get("id")));
+
+        Subquery<Integer> subquery1 = query.subquery(Integer.class);
+
+        subquery1.select(cb.literal(1));
+
+        Root<ResourceEntity> from1 = subquery1.from(ResourceEntity.class);
+
+        List<Predicate> subs = new ArrayList<>();
+
+        Expression<String> groupId = from.get("groupId");
+
+        RealmModel realm = session.getContext().getRealm();
+
+        if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            subs.add(cb.like(from1.get("name"), groupId));
+        } else {
+            subs.add(cb.like(from1.get("name"), cb.concat("group.resource.", groupId)));
+        }
+
+        subquery1.where(subs.toArray(Predicate[]::new));
+
+        subPredicates.add(cb.exists(subquery1));
+
+        subquery.where(subPredicates.toArray(Predicate[]::new));
+
+        return cb.exists(subquery);
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
index 84a63d285e50..3f900113628a 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
@@ -17,7 +17,8 @@
 
 package org.keycloak.models.jpa;
 
-import org.keycloak.authorization.jpa.entities.ResourceEntity;
+import jakarta.persistence.criteria.Path;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.util.Time;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.credential.CredentialModel;
@@ -60,7 +61,6 @@
 import jakarta.persistence.criteria.JoinType;
 import jakarta.persistence.criteria.Predicate;
 import jakarta.persistence.criteria.Root;
-import jakarta.persistence.criteria.Subquery;
 import org.keycloak.storage.jpa.JpaHashUtils;
 import org.keycloak.utils.StringUtil;
 
@@ -85,7 +85,7 @@
  * @version $Revision: 1 $
  */
 @SuppressWarnings("JpaQueryApiInspection")
-public class JpaUserProvider implements UserProvider, UserCredentialStore {
+public class JpaUserProvider implements UserProvider, UserCredentialStore, JpaUserPartialEvaluationProvider {
 
     private static final String EMAIL = "email";
     private static final String EMAIL_VERIFIED = "emailVerified";
@@ -493,9 +493,7 @@ public void preRemove(ClientScopeModel clientScope) {
 
     @Override
     public Stream<UserModel> getGroupMembersStream(RealmModel realm, GroupModel group) {
-        TypedQuery<UserEntity> query = em.createNamedQuery("groupMembership", UserEntity.class);
-        query.setParameter("groupId", group.getId());
-        return closing(query.getResultStream().map(entity -> new UserAdapter(session, realm, em, entity)));
+        return getGroupMembersStream(realm, group, -1, -1);
     }
 
     @Override
@@ -583,16 +581,21 @@ public UserModel getServiceAccount(ClientModel client) {
 
     @Override
     public int getUsersCount(RealmModel realm, boolean includeServiceAccount) {
-        String namedQuery = "getRealmUserCountExcludeServiceAccount";
+        CriteriaBuilder cb = em.getCriteriaBuilder();
+        CriteriaQuery<Long> query = cb.createQuery(Long.class);
+        Root<UserEntity> root = query.from(UserEntity.class);
+
+        List<Predicate> predicates = new ArrayList<>();
+        predicates.add(cb.equal(root.get("realmId"), realm.getId()));
 
-        if (includeServiceAccount) {
-            namedQuery = "getRealmUserCount";
+        if (!includeServiceAccount) {
+            predicates.add(cb.isNull(root.get("serviceAccountClientLink")));
         }
 
-        Object count = em.createNamedQuery(namedQuery)
-                .setParameter("realmId", realm.getId())
-                .getSingleResult();
-        return ((Number)count).intValue();
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, cb, query, root));
+        query.select(cb.count(root)).where(predicates.toArray(Predicate[]::new));
+
+        return em.createQuery(query).getSingleResult().intValue();
     }
 
     @Override
@@ -615,7 +618,7 @@ public int getUsersCount(RealmModel realm, String search) {
         CriteriaQuery<Long> queryBuilder = builder.createQuery(Long.class);
         Root<UserEntity> root = queryBuilder.from(UserEntity.class);
 
-        queryBuilder.select(builder.count(root));
+        queryBuilder.select(builder.countDistinct(root));
 
         List<Predicate> predicates = new ArrayList<>();
 
@@ -625,6 +628,8 @@ public int getUsersCount(RealmModel realm, String search) {
             predicates.add(builder.or(getSearchOptionPredicateArray(stringToSearch, builder, root)));
         }
 
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, builder, queryBuilder, root));
+
         queryBuilder.where(predicates.toArray(Predicate[]::new));
 
         return em.createQuery(queryBuilder).getSingleResult().intValue();
@@ -642,7 +647,7 @@ public int getUsersCount(RealmModel realm, String search, Set<String> groupIds)
         Root<UserGroupMembershipEntity> groupMembership = queryBuilder.from(UserGroupMembershipEntity.class);
         Join<UserGroupMembershipEntity, UserEntity> userJoin = groupMembership.join("user");
 
-        queryBuilder.select(builder.count(userJoin));
+        queryBuilder.select(builder.countDistinct(userJoin));
 
         List<Predicate> predicates = new ArrayList<>();
 
@@ -664,11 +669,12 @@ public int getUsersCount(RealmModel realm, Map<String, String> params) {
         CriteriaBuilder qb = em.getCriteriaBuilder();
         CriteriaQuery<Long> userQuery = qb.createQuery(Long.class);
         Root<UserEntity> from = userQuery.from(UserEntity.class);
-        Expression<Long> count = qb.count(from);
+        Expression<Long> count = qb.countDistinct(from);
 
         userQuery = userQuery.select(count);
         List<Predicate> restrictions = predicates(params, from, Map.of());
         restrictions.add(qb.equal(from.get("realmId"), realm.getId()));
+        restrictions.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, qb, userQuery, from));
 
         userQuery = userQuery.where(restrictions.toArray(Predicate[]::new));
         TypedQuery<Long> query = em.createQuery(userQuery);
@@ -688,12 +694,14 @@ public int getUsersCount(RealmModel realm, Map<String, String> params, Set<Strin
 
         CriteriaQuery<Long> countQuery = cb.createQuery(Long.class);
         Root<UserEntity> root = countQuery.from(UserEntity.class);
-        countQuery.select(cb.count(root));
+        countQuery.select(cb.countDistinct(root));
 
         List<Predicate> restrictions = predicates(params, root, Map.of());
         restrictions.add(cb.equal(root.get("realmId"), realm.getId()));
 
-        groupsWithPermissionsSubquery(countQuery, groupIds, root, restrictions);
+        session.setAttribute(UserModel.GROUPS, groupIds);
+
+        restrictions.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, cb, countQuery, root));
 
         countQuery.where(restrictions.toArray(Predicate[]::new));
         TypedQuery<Long> query = em.createQuery(countQuery);
@@ -704,27 +712,66 @@ public int getUsersCount(RealmModel realm, Map<String, String> params, Set<Strin
 
     @Override
     public Stream<UserModel> getGroupMembersStream(RealmModel realm, GroupModel group, Integer firstResult, Integer maxResults) {
-        TypedQuery<UserEntity> query = em.createNamedQuery("groupMembership", UserEntity.class);
-        query.setParameter("groupId", group.getId());
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<UserEntity> queryBuilder = builder.createQuery(UserEntity.class);
+        Root<UserGroupMembershipEntity> root = queryBuilder.from(UserGroupMembershipEntity.class);
+        Path<UserEntity> userPath = root.get("user");
+
+        queryBuilder.select(userPath);
 
-        return closing(paginateQuery(query, firstResult, maxResults).getResultStream().map(user -> new UserAdapter(session, realm, em, user)));
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("groupId"), group.getId()));
+
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, builder, queryBuilder, userPath));
+
+        queryBuilder.where(predicates.toArray(Predicate[]::new)).orderBy(builder.asc(userPath.get(UserModel.USERNAME)));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), firstResult, maxResults).getResultStream().map(user -> new UserAdapter(session, realm, em, user)));
     }
 
     @Override
     public Stream<UserModel> getGroupMembersStream(RealmModel realm, GroupModel group, String search, Boolean exact, Integer first, Integer max) {
-        TypedQuery<UserEntity> query;
         if (StringUtil.isBlank(search)) {
-            query = em.createNamedQuery("groupMembership", UserEntity.class);
-        } else if (Boolean.TRUE.equals(exact)) {
-            query = em.createNamedQuery("groupMembershipByUser", UserEntity.class);
-            query.setParameter("search", search);
+            return getGroupMembersStream(realm, group, first, max);
+        }
+
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<UserEntity> queryBuilder = builder.createQuery(UserEntity.class);
+        Root<UserGroupMembershipEntity> root = queryBuilder.from(UserGroupMembershipEntity.class);
+        Path<UserEntity> userPath = root.get("user");
+
+        queryBuilder.select(userPath);
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        predicates.add(builder.equal(root.get("groupId"), group.getId()));
+
+        if (Boolean.TRUE.equals(exact)) {
+            predicates.add(builder.and(
+                    builder.or(
+                        builder.equal(userPath.get("username"), search)),
+                        builder.equal(userPath.get("email"), search),
+                        builder.equal(userPath.get("firstName"), search),
+                        builder.equal(userPath.get("lastName"), search)
+                    )
+            );
         } else {
-            query = em.createNamedQuery("groupMembershipByUserContained", UserEntity.class);
-            query.setParameter("search", search.toLowerCase());
+            predicates.add(builder.and(
+                    builder.or(
+                            builder.like(builder.lower(userPath.get("username")), builder.lower(builder.literal("%" + search + "%"))),
+                            builder.like(builder.lower(userPath.get("email")), builder.lower(builder.literal("%" + search + "%"))),
+                            builder.like(builder.lower(userPath.get("firstName")), builder.lower(builder.literal("%" + search + "%"))),
+                            builder.like(builder.lower(userPath.get("lastName")), builder.lower(builder.literal("%" + search + "%")))
+                    )
+            ));
         }
-        query.setParameter("groupId", group.getId());
 
-        return closing(paginateQuery(query, first, max).getResultStream().map(user -> new UserAdapter(session, realm, em, user)));
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, builder, queryBuilder, userPath));
+
+        queryBuilder.where(predicates.toArray(Predicate[]::new)).orderBy(builder.asc(userPath.get(UserModel.USERNAME)));
+
+        return closing(paginateQuery(em.createQuery(queryBuilder), first, max).getResultStream().map(user -> new UserAdapter(session, realm, em, user)));
     }
 
     @Override
@@ -759,13 +806,9 @@ public Stream<UserModel> searchForUserStream(RealmModel realm, Map<String, Strin
 
         predicates.add(builder.equal(root.get("realmId"), realm.getId()));
 
-        Set<String> userGroups = (Set<String>) session.getAttribute(UserModel.GROUPS);
+        predicates.addAll(AdminPermissionsSchema.SCHEMA.applyAuthorizationFilters(session, AdminPermissionsSchema.USERS, this, realm, builder, queryBuilder, root));
 
-        if (userGroups != null) {
-            groupsWithPermissionsSubquery(queryBuilder, userGroups, root, predicates);
-        }
-
-        queryBuilder.where(predicates.toArray(Predicate[]::new)).orderBy(builder.asc(root.get(UserModel.USERNAME)));
+        queryBuilder.distinct(true).where(predicates.toArray(Predicate[]::new)).orderBy(builder.asc(root.get(UserModel.USERNAME)));
 
         TypedQuery<UserEntity> query = em.createQuery(queryBuilder);
 
@@ -1055,37 +1098,13 @@ private List<Predicate> predicates(Map<String, String> attributes, Root<UserEnti
         return predicates;
     }
 
-    @SuppressWarnings("unchecked")
-    private void groupsWithPermissionsSubquery(CriteriaQuery<?> query, Set<String> groupIds, Root<UserEntity> root, List<Predicate> restrictions) {
-        CriteriaBuilder cb = em.getCriteriaBuilder();
-
-        Subquery subquery = query.subquery(String.class);
-
-        Root<UserGroupMembershipEntity> from = subquery.from(UserGroupMembershipEntity.class);
-
-        subquery.select(cb.literal(1));
-
-        List<Predicate> subPredicates = new ArrayList<>();
-
-        subPredicates.add(from.get("groupId").in(groupIds));
-        subPredicates.add(cb.equal(from.get("user").get("id"), root.get("id")));
-
-        Subquery subquery1 = query.subquery(String.class);
-
-        subquery1.select(cb.literal(1));
-        Root from1 = subquery1.from(ResourceEntity.class);
-
-        List<Predicate> subs = new ArrayList<>();
-
-        Expression<String> groupId = from.get("groupId");
-        subs.add(cb.like(from1.get("name"), cb.concat("group.resource.", groupId)));
-
-        subquery1.where(subs.toArray(Predicate[]::new));
-
-        subPredicates.add(cb.exists(subquery1));
-
-        subquery.where(subPredicates.toArray(Predicate[]::new));
+    @Override
+    public KeycloakSession getSession() {
+        return session;
+    }
 
-        restrictions.add(cb.exists(subquery));
+    @Override
+    public EntityManager getEntityManager() {
+        return em;
     }
 }
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
index 095bced508c2..7b7596af3c98 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
@@ -932,7 +932,7 @@ public void setOTPPolicy(OTPPolicy policy) {
 
     @Override
     public WebAuthnPolicy getWebAuthnPolicy() {
-        return getWebAuthnPolicy("");
+        return getWebAuthnPolicy("", WebAuthnPolicyTwoFactorDefaults.get());
     }
 
     @Override
@@ -943,7 +943,7 @@ public void setWebAuthnPolicy(WebAuthnPolicy policy) {
     @Override
     public WebAuthnPolicy getWebAuthnPolicyPasswordless() {
         // We will use some prefix for attributes related to passwordless WebAuthn policy
-        return getWebAuthnPolicy(Constants.WEBAUTHN_PASSWORDLESS_PREFIX);
+        return getWebAuthnPolicy(Constants.WEBAUTHN_PASSWORDLESS_PREFIX, WebAuthnPolicyPasswordlessDefaults.get());
     }
 
     @Override
@@ -952,66 +952,82 @@ public void setWebAuthnPolicyPasswordless(WebAuthnPolicy policy) {
         setWebAuthnPolicy(policy, Constants.WEBAUTHN_PASSWORDLESS_PREFIX);
     }
 
-
-    private WebAuthnPolicy getWebAuthnPolicy(String attributePrefix) {
+    private WebAuthnPolicy getWebAuthnPolicy(String attributePrefix, WebAuthnPolicy defaultConfig) {
         WebAuthnPolicy policy = new WebAuthnPolicy();
 
         // mandatory parameters
         String rpEntityName = getAttribute(RealmAttributes.WEBAUTHN_POLICY_RP_ENTITY_NAME + attributePrefix);
         if (rpEntityName == null || rpEntityName.isEmpty())
-            rpEntityName = Constants.DEFAULT_WEBAUTHN_POLICY_RP_ENTITY_NAME;
+            rpEntityName = defaultConfig.getRpEntityName();
         policy.setRpEntityName(rpEntityName);
 
         String signatureAlgorithmsString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_SIGNATURE_ALGORITHMS + attributePrefix);
-        if (signatureAlgorithmsString == null || signatureAlgorithmsString.isEmpty())
-            signatureAlgorithmsString = Constants.DEFAULT_WEBAUTHN_POLICY_SIGNATURE_ALGORITHMS;
-        List<String> signatureAlgorithms = Arrays.asList(signatureAlgorithmsString.split(","));
+        List<String> signatureAlgorithms = (signatureAlgorithmsString == null || signatureAlgorithmsString.isEmpty())
+                ? defaultConfig.getSignatureAlgorithm()
+                : Arrays.asList(signatureAlgorithmsString.split(","));
         policy.setSignatureAlgorithm(signatureAlgorithms);
 
         // optional parameters
         String rpId = getAttribute(RealmAttributes.WEBAUTHN_POLICY_RP_ID + attributePrefix);
-        if (rpId == null || rpId.isEmpty()) rpId = "";
+        if (rpId == null || rpId.isEmpty()) {
+            rpId = defaultConfig.getRpId();
+        }
         policy.setRpId(rpId);
 
         String attestationConveyancePreference = getAttribute(RealmAttributes.WEBAUTHN_POLICY_ATTESTATION_CONVEYANCE_PREFERENCE + attributePrefix);
-        if (attestationConveyancePreference == null || attestationConveyancePreference.isEmpty())
-            attestationConveyancePreference = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        if (attestationConveyancePreference == null || attestationConveyancePreference.isEmpty()) {
+            attestationConveyancePreference = defaultConfig.getAttestationConveyancePreference();
+        }
         policy.setAttestationConveyancePreference(attestationConveyancePreference);
 
         String authenticatorAttachment = getAttribute(RealmAttributes.WEBAUTHN_POLICY_AUTHENTICATOR_ATTACHMENT + attributePrefix);
-        if (authenticatorAttachment == null || authenticatorAttachment.isEmpty())
-            authenticatorAttachment = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        if (authenticatorAttachment == null || authenticatorAttachment.isEmpty()) {
+            authenticatorAttachment = defaultConfig.getAuthenticatorAttachment();
+        }
         policy.setAuthenticatorAttachment(authenticatorAttachment);
 
         String requireResidentKey = getAttribute(RealmAttributes.WEBAUTHN_POLICY_REQUIRE_RESIDENT_KEY + attributePrefix);
-        if (requireResidentKey == null || requireResidentKey.isEmpty())
-            requireResidentKey = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        if (requireResidentKey == null || requireResidentKey.isEmpty()) {
+            requireResidentKey = defaultConfig.getRequireResidentKey();
+        }
         policy.setRequireResidentKey(requireResidentKey);
 
         String userVerificationRequirement = getAttribute(RealmAttributes.WEBAUTHN_POLICY_USER_VERIFICATION_REQUIREMENT + attributePrefix);
-        if (userVerificationRequirement == null || userVerificationRequirement.isEmpty())
-            userVerificationRequirement = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        if (userVerificationRequirement == null || userVerificationRequirement.isEmpty()) {
+            userVerificationRequirement = defaultConfig.getUserVerificationRequirement();
+        }
         policy.setUserVerificationRequirement(userVerificationRequirement);
 
-        String createTime = getAttribute(RealmAttributes.WEBAUTHN_POLICY_CREATE_TIMEOUT + attributePrefix);
-        if (createTime != null) policy.setCreateTimeout(Integer.parseInt(createTime));
-        else policy.setCreateTimeout(0);
+        String createTimeoutString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_CREATE_TIMEOUT + attributePrefix);
+        int createTimeout = (createTimeoutString != null)
+                ? Integer.parseInt(createTimeoutString)
+                : defaultConfig.getCreateTimeout();
+        policy.setCreateTimeout(createTimeout);
 
-        String avoidSameAuthenticatorRegister = getAttribute(RealmAttributes.WEBAUTHN_POLICY_AVOID_SAME_AUTHENTICATOR_REGISTER + attributePrefix);
-        if (avoidSameAuthenticatorRegister != null) policy.setAvoidSameAuthenticatorRegister(Boolean.parseBoolean(avoidSameAuthenticatorRegister));
+        String avoidSameAuthenticatorRegisterString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_AVOID_SAME_AUTHENTICATOR_REGISTER + attributePrefix);
+        boolean avoidSameAuthenticatorRegister = (avoidSameAuthenticatorRegisterString != null)
+                ? Boolean.parseBoolean(avoidSameAuthenticatorRegisterString)
+                : defaultConfig.isAvoidSameAuthenticatorRegister();
+        policy.setAvoidSameAuthenticatorRegister(avoidSameAuthenticatorRegister);
 
         String acceptableAaguidsString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_ACCEPTABLE_AAGUIDS + attributePrefix);
-        List<String> acceptableAaguids = new ArrayList<>();
-        if (acceptableAaguidsString != null && !acceptableAaguidsString.isEmpty())
-            acceptableAaguids = Arrays.asList(acceptableAaguidsString.split(","));
+        List<String> acceptableAaguids = (acceptableAaguidsString != null && !acceptableAaguidsString.isEmpty())
+                ? Arrays.asList(acceptableAaguidsString.split(","))
+                : defaultConfig.getAcceptableAaguids();
         policy.setAcceptableAaguids(acceptableAaguids);
 
         String extraOriginsString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_EXTRA_ORIGINS + attributePrefix);
-        List<String> extraOrigins = new ArrayList<>();
-        if (extraOriginsString != null && !extraOriginsString.isEmpty())
-            extraOrigins = Arrays.asList(extraOriginsString.split(","));
+        List<String> extraOrigins = (extraOriginsString != null && !extraOriginsString.isEmpty())
+                ? Arrays.asList(extraOriginsString.split(","))
+                : defaultConfig.getExtraOrigins();
         policy.setExtraOrigins(extraOrigins);
 
+        String passkeysEnabledString = getAttribute(RealmAttributes.WEBAUTHN_POLICY_PASSKEYS_ENABLED + attributePrefix);
+        Boolean passKeysEnabled = (passkeysEnabledString != null)
+                ? Boolean.valueOf(passkeysEnabledString)
+                : defaultConfig.isPasskeysEnabled();
+        policy.setPasskeysEnabled(passKeysEnabled);
+
         return policy;
     }
 
@@ -1063,6 +1079,13 @@ private void setWebAuthnPolicy(WebAuthnPolicy policy, String attributePrefix) {
         } else {
             removeAttribute(RealmAttributes.WEBAUTHN_POLICY_EXTRA_ORIGINS + attributePrefix);
         }
+
+        Boolean passkeysEnabled = policy.isPasskeysEnabled();
+        if (passkeysEnabled != null) {
+            setAttribute(RealmAttributes.WEBAUTHN_POLICY_PASSKEYS_ENABLED + attributePrefix, passkeysEnabled.toString());
+        } else {
+            removeAttribute(RealmAttributes.WEBAUTHN_POLICY_PASSKEYS_ENABLED + attributePrefix);
+        }
     }
 
     @Override
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
index eb4e77bb4b74..2a60706e99d3 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
@@ -48,13 +48,9 @@
 @Entity
 @Table(name="CLIENT", uniqueConstraints = {@UniqueConstraint(columnNames = {"REALM_ID", "CLIENT_ID"})})
 @NamedQueries({
-        @NamedQuery(name="getClientsByRealm", query="select client from ClientEntity client where client.realmId = :realm"),
         @NamedQuery(name="getClientById", query="select client from ClientEntity client where client.id = :id and client.realmId = :realm"),
-        @NamedQuery(name="getClientIdsByRealm", query="select client.id from ClientEntity client where client.realmId = :realm order by client.clientId"),
         @NamedQuery(name="getAlwaysDisplayInConsoleClients", query="select client.id from ClientEntity client where client.alwaysDisplayInConsole = true and client.realmId = :realm order by client.clientId"),
         @NamedQuery(name="findClientIdByClientId", query="select client.id from ClientEntity client where client.clientId = :clientId and client.realmId = :realm"),
-        @NamedQuery(name="searchClientsByClientId", query="select client.id from ClientEntity client where lower(client.clientId) like lower(concat('%',:clientId,'%')) and client.realmId = :realm order by client.clientId"),
-        @NamedQuery(name="getRealmClientsCount", query="select count(client) from ClientEntity client where client.realmId = :realm"),
         @NamedQuery(name="findClientByClientId", query="select client from ClientEntity client where client.clientId = :clientId and client.realmId = :realm"),
         @NamedQuery(name="getAllRedirectUrisOfEnabledClients", query="select new map(client as client, r as redirectUri) from ClientEntity client join client.redirectUris r where client.realmId = :realm and client.enabled = true"),
 })
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeEntity.java
index 1c7551adc017..f40adf6e4405 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeEntity.java
@@ -46,7 +46,10 @@
 @Entity
 @Table(name="CLIENT_SCOPE", uniqueConstraints = {@UniqueConstraint(columnNames = {"REALM_ID", "NAME"})})
 @NamedQueries({
-        @NamedQuery(name="getClientScopeIds", query="select scope.id from ClientScopeEntity scope where scope.realmId = :realm")
+        @NamedQuery(name="getClientScopeIds", query="select scope.id from ClientScopeEntity scope where scope.realmId = :realm"),
+        @NamedQuery(name = "getClientScopesByProtocol",
+                    query = "select S from ClientScopeEntity S " +
+                            "where S.realmId = :realm and S.protocol = :protocol")
 })
 public class ClientScopeEntity {
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
index 6627c82d37f3..45ab54873e7e 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
@@ -28,6 +28,7 @@
 import jakarta.persistence.NamedQueries;
 import jakarta.persistence.NamedQuery;
 import jakarta.persistence.Table;
+import jakarta.persistence.Version;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -73,6 +74,10 @@ public class CredentialEntity {
     @Column(name="SALT")
     protected byte[] salt;
 
+    @Version
+    @Column(name="VERSION")
+    private int version;
+
     public String getId() {
         return id;
     }
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/GroupEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/GroupEntity.java
index 5f50bcc23aad..70a994bc5e7a 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/GroupEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/GroupEntity.java
@@ -29,16 +29,6 @@
  */
 @NamedQueries({
         @NamedQuery(name="getGroupIdsByParent", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and u.parentId = :parent order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByParentAndName", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and u.parentId = :parent and u.name = :search order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByParentAndNameContaining", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and u.parentId = :parent and lower(u.name) like lower(concat('%',:search,'%')) order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByRealm", query="select u.id from GroupEntity u where u.realm = :realm  and u.type = 0 order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByNameContaining", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and lower(u.name) like lower(concat('%',:search,'%')) order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByNameContainingFromIdList", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and lower(u.name) like lower(concat('%',:search,'%')) and u.id in :ids order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsByName", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and u.name = :search order by u.name ASC"),
-        @NamedQuery(name="getGroupIdsFromIdList", query="select u.id from GroupEntity u where u.realm = :realm and u.type = 0 and u.id in :ids order by u.name ASC"),
-        @NamedQuery(name="getGroupCountByNameContainingFromIdList", query="select count(u) from GroupEntity u where u.realm = :realm and u.type = 0 and lower(u.name) like lower(concat('%',:search,'%')) and u.id in :ids"),
-        @NamedQuery(name="getGroupCount", query="select count(u) from GroupEntity u where u.realm = :realm and u.type = 0"),
-        @NamedQuery(name="getGroupCountByParent", query="select count(u) from GroupEntity u where u.realm = :realm and u.type = 0 and u.parentId = :parent"),
         @NamedQuery(name="deleteGroupsByRealm", query="delete from GroupEntity g where g.realm = :realm")
 })
 @Entity
@@ -61,6 +51,10 @@ public class GroupEntity {
     @Column(name = "NAME")
     protected String name;
 
+    @Nationalized
+    @Column(name = "DESCRIPTION")
+    protected String description;
+
     @Column(name = "PARENT_GROUP")
     private String parentId;
 
@@ -102,6 +96,14 @@ public void setName(String name) {
         this.name = name;
     }
 
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
     public String getRealm() {
         return realm;
     }
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationEntity.java
index 4ffe1ec05a3f..daf10a637484 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OrganizationEntity.java
@@ -36,17 +36,13 @@
 @Table(name="ORG")
 @Entity
 @NamedQueries({
-        @NamedQuery(name="getByRealm", query="select o from OrganizationEntity o where o.realmId = :realmId order by o.name ASC"),
         @NamedQuery(name="getByOrgName", query="select distinct o from OrganizationEntity o where o.realmId = :realmId AND o.name = :name"),
         @NamedQuery(name="getByDomainName", query="select distinct o from OrganizationEntity o inner join OrganizationDomainEntity d ON o.id = d.organization.id" +
                 " where o.realmId = :realmId AND d.name = :name"),
-        @NamedQuery(name="getByNameOrDomain", query="select distinct o from OrganizationEntity o inner join OrganizationDomainEntity d ON o.id = d.organization.id" +
-                " where o.realmId = :realmId AND (o.name = :search OR d.name = :search) order by o.name ASC"),
-        @NamedQuery(name="getByNameOrDomainContained", query="select distinct o from OrganizationEntity o inner join OrganizationDomainEntity d ON o.id = d.organization.id" +
-                " where o.realmId = :realmId AND (lower(o.name) like concat('%',:search,'%') OR d.name like concat('%',:search,'%')) order by o.name ASC"),
         @NamedQuery(name="getCount", query="select count(o) from OrganizationEntity o where o.realmId = :realmId"),
         @NamedQuery(name="deleteOrganizationsByRealm", query="delete from OrganizationEntity o where o.realmId = :realmId"),
-        @NamedQuery(name="getGroupsByMember", query="select m.groupId from UserGroupMembershipEntity m join GroupEntity g on g.id = m.groupId where g.type = 1 and m.user.id = :userId")
+        @NamedQuery(name="getGroupsByMember", query="select m.groupId from UserGroupMembershipEntity m join GroupEntity g on g.id = m.groupId where g.type = 1 and m.user.id = :userId"),
+        @NamedQuery(name="getGroupsByFederatedMember", query="select m.groupId from FederatedUserGroupMembershipEntity m join GroupEntity g on g.id = m.groupId where g.type = 1 and m.userId = :userId")
 })
 public class OrganizationEntity {
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmAttributes.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmAttributes.java
index 751cdef55b07..5bc56fa08be1 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmAttributes.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmAttributes.java
@@ -51,6 +51,7 @@ public interface RealmAttributes {
     String WEBAUTHN_POLICY_AVOID_SAME_AUTHENTICATOR_REGISTER = "webAuthnPolicyAvoidSameAuthenticatorRegister";
     String WEBAUTHN_POLICY_ACCEPTABLE_AAGUIDS = "webAuthnPolicyAcceptableAaguids";
     String WEBAUTHN_POLICY_EXTRA_ORIGINS = "webAuthnPolicyExtraOrigins";
+    String WEBAUTHN_POLICY_PASSKEYS_ENABLED = "webAuthnPolicyPasskeysEnabled";
 
     String ADMIN_EVENTS_EXPIRATION = "adminEventsExpiration";
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
index d6bd128241ca..b2583d848be6 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
@@ -65,7 +65,6 @@
         @NamedQuery(name="searchForRealmRoles", query="select role from RoleEntity role where role.clientRole = false and role.realmId = :realm and ( lower(role.name) like :search or lower(role.description) like :search ) order by role.name"),
         @NamedQuery(name="getRoleIdsFromIdList", query="select role.id from RoleEntity role where role.realmId = :realm and role.id in :ids order by role.name ASC"),
         @NamedQuery(name="getRoleIdsByNameContainingFromIdList", query="select role.id from RoleEntity role where role.realmId = :realm and lower(role.name) like lower(concat('%',:search,'%')) and role.id in :ids order by role.name ASC"),
-        @NamedQuery(name="getParentRolesOfACompositeRole", query = "select role from RoleEntity role where :compositeRole member of role.compositeRoles"),
 })
 
 public class RoleEntity {
@@ -99,6 +98,9 @@ public class RoleEntity {
     @JoinTable(name = "COMPOSITE_ROLE", joinColumns = @JoinColumn(name = "COMPOSITE"), inverseJoinColumns = @JoinColumn(name = "CHILD_ROLE"))
     private Set<RoleEntity> compositeRoles;
 
+    @ManyToMany(mappedBy = "compositeRoles", fetch = FetchType.LAZY, cascade = {})
+    private Set<RoleEntity> parentRoles;
+
     // Explicitly not using OrphanRemoval as we're handling the removal manually through HQL but at the same time we still
     // want to remove elements from the entity's collection in a manual way. Without this, Hibernate would do a duplicit
     // delete query.
@@ -158,6 +160,17 @@ public Set<RoleEntity> getCompositeRoles() {
         return compositeRoles;
     }
 
+    public Set<RoleEntity> getParentRoles() {
+        if (parentRoles == null) {
+            parentRoles = new HashSet<>();
+        }
+        return parentRoles;
+    }
+
+    public void setParentRoles(Set<RoleEntity> parentRoles) {
+        this.parentRoles = parentRoles;
+    }
+
     public void setCompositeRoles(Set<RoleEntity> compositeRoles) {
         this.compositeRoles = compositeRoles;
     }
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
index 5ab26375646e..42b63e57e8a2 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
@@ -47,8 +47,6 @@
         @NamedQuery(name="getRealmUserByLastName", query="select u from UserEntity u where u.lastName = :lastName and u.realmId = :realmId"),
         @NamedQuery(name="getRealmUserByFirstLastName", query="select u from UserEntity u where u.firstName = :first and u.lastName = :last and u.realmId = :realmId"),
         @NamedQuery(name="getRealmUserByServiceAccount", query="select u from UserEntity u where u.serviceAccountClientLink = :clientInternalId and u.realmId = :realmId"),
-        @NamedQuery(name="getRealmUserCount", query="select count(u) from UserEntity u where u.realmId = :realmId"),
-        @NamedQuery(name="getRealmUserCountExcludeServiceAccount", query="select count(u) from UserEntity u where u.realmId = :realmId and (u.serviceAccountClientLink is null)"),
         @NamedQuery(name="getRealmUsersByAttributeNameAndValue", query="select u from UserEntity u join u.attributes attr " +
                 "where u.realmId = :realmId and attr.name = :name and attr.value = :value"),
         @NamedQuery(name="getRealmUsersByAttributeNameAndLongValue", query="select u from UserEntity u join u.attributes attr " +
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserGroupMembershipEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserGroupMembershipEntity.java
index f97872c2a48e..7d668d782161 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserGroupMembershipEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserGroupMembershipEntity.java
@@ -37,12 +37,6 @@
 @NamedQueries({
         @NamedQuery(name="userMemberOf", query="select m from UserGroupMembershipEntity m where m.user = :user and m.groupId = :groupId"),
         @NamedQuery(name="userGroupMembership", query="select m from UserGroupMembershipEntity m where m.user = :user"),
-        @NamedQuery(name="groupMembership", query="select g.user from UserGroupMembershipEntity g where g.groupId = :groupId order by g.user.username"),
-        @NamedQuery(name="groupMembershipByUser", query="select g.user from UserGroupMembershipEntity g where g.groupId = :groupId and " +
-                "(g.user.username = :search or g.user.email = :search or g.user.firstName = :search or g.user.lastName = :search) order by g.user.username"),
-        @NamedQuery(name="groupMembershipByUserContained", query="select g.user from UserGroupMembershipEntity g where g.groupId = :groupId and " +
-                "(g.user.username like concat('%',:search,'%') or g.user.email like concat('%',:search,'%') or lower(g.user.firstName) like concat('%',:search,'%') or " +
-                "lower(g.user.lastName) like concat('%',:search,'%')) order by g.user.username"),
         @NamedQuery(name="deleteUserGroupMembershipByRealm", query="delete from  UserGroupMembershipEntity mapping where mapping.user IN (select u from UserEntity u where u.realmId=:realmId)"),
         @NamedQuery(name="deleteUserGroupMembershipsByRealmAndLink", query="delete from  UserGroupMembershipEntity mapping where mapping.user IN (select u from UserEntity u where u.realmId=:realmId and u.federationLink=:link)"),
         @NamedQuery(name="deleteUserGroupMembershipsByGroup", query="delete from UserGroupMembershipEntity m where m.groupId = :groupId"),
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaRevokedTokensPersisterProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaRevokedTokensPersisterProvider.java
index c1fe892c9c1f..38e74c26b1cf 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaRevokedTokensPersisterProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaRevokedTokensPersisterProvider.java
@@ -43,9 +43,20 @@ public JpaRevokedTokensPersisterProvider(EntityManager em) {
 
     @Override
     public void revokeToken(String tokenId, long lifetime) {
-        RevokedTokenEntity revokedTokenEntity = new RevokedTokenEntity();
+        RevokedTokenEntity revokedTokenEntity = em.find(RevokedTokenEntity.class, tokenId);
+        long expire = Time.currentTime() + lifetime;
+        if (revokedTokenEntity != null) {
+            // The token has already been revoked.
+            // There shouldn't be much need to update the expiry of the token, let's do it anyway to be on the safe side.
+            if (revokedTokenEntity.getExpire() < expire) {
+                revokedTokenEntity.setExpire(expire);
+            }
+            return;
+        }
+
+        revokedTokenEntity = new RevokedTokenEntity();
         revokedTokenEntity.setId(tokenId);
-        revokedTokenEntity.setExpire(Time.currentTime() + lifetime);
+        revokedTokenEntity.setExpire(expire);
         em.persist(revokedTokenEntity);
     }
 
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaUserSessionPersisterProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaUserSessionPersisterProvider.java
index ec22908cf7e2..373148db5bc7 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaUserSessionPersisterProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/session/JpaUserSessionPersisterProvider.java
@@ -200,6 +200,7 @@ public void onClientRemoved(RealmModel realm, ClientModel client) {
     }
 
     private void onClientRemoved(String clientUUID) {
+        logger.debugf("Client sessions removed for client %s",  clientUUID);
         StorageId clientStorageId = new StorageId(clientUUID);
         if (clientStorageId.isLocal()) {
             em.createNamedQuery("deleteClientSessionsByClient").setParameter("clientId", clientUUID).executeUpdate();
@@ -242,7 +243,7 @@ public void removeExpired(RealmModel realm) {
 
         // prefer client session timeout if set
         int expiredClientOffline = expiredOffline;
-        if (realm.getClientOfflineSessionIdleTimeout() > 0) {
+        if (realm.isOfflineSessionMaxLifespanEnabled() && realm.getClientOfflineSessionIdleTimeout() > 0) {
             expiredClientOffline = Time.currentTime() - realm.getClientOfflineSessionIdleTimeout() - SessionTimeoutHelper.PERIODIC_CLEANER_IDLE_TIMEOUT_WINDOW_SECONDS;
         }
 
@@ -559,7 +560,7 @@ private boolean addClientSessionToAuthenticatedClientSessionsIfPresent(OfflineUs
         AuthenticatedClientSessionModel clientSessAdapter = toAdapter(userSession.getRealm(), null, userSession, clientSessionEntity);
 
         if (clientSessAdapter.getClient() == null) {
-            logger.tracef("Not adding client session %s / %s since client is null", userSession, clientSessAdapter);
+            logger.debugf("Not adding client session %s / %s since client is null", userSession, clientSessAdapter);
             return false;
         }
 
@@ -662,6 +663,10 @@ private AuthenticatedClientSessionModel toAdapter(RealmModel realm, ClientModel
             }
             // can be null if client is not found anymore
             client = realm.getClientById(clientId);
+            if (client == null) {
+                logger.debugf("Client not found for clientId %s clientStorageProvider %s externalClientId %s",
+                        entity.getClientId(), entity.getClientStorageProvider(), entity.getExternalClientId());
+            }
         }
 
         PersistentClientSessionModel model = new PersistentClientSessionModel() {
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentClientSessionEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentClientSessionEntity.java
index 892b8022a580..342a6d4df8d5 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentClientSessionEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentClientSessionEntity.java
@@ -25,6 +25,7 @@
 import jakarta.persistence.NamedQuery;
 import jakarta.persistence.Table;
 import jakarta.persistence.Version;
+import org.hibernate.annotations.DynamicUpdate;
 
 import java.io.Serializable;
 
@@ -50,6 +51,7 @@
 })
 @Table(name="OFFLINE_CLIENT_SESSION")
 @Entity
+@DynamicUpdate
 @IdClass(PersistentClientSessionEntity.Key.class)
 public class PersistentClientSessionEntity {
 
@@ -191,8 +193,8 @@ public boolean equals(Object o) {
 
             if (this.userSessionId != null ? !this.userSessionId.equals(key.userSessionId) : key.userSessionId != null) return false;
             if (this.clientId != null ? !this.clientId.equals(key.clientId) : key.clientId != null) return false;
-            if (this.externalClientId != null ? !this.externalClientId.equals(key.clientId) : key.externalClientId != null) return false;
-            if (this.clientStorageProvider != null ? !this.clientStorageProvider.equals(key.clientId) : key.clientStorageProvider != null) return false;
+            if (this.externalClientId != null ? !this.externalClientId.equals(key.externalClientId) : key.externalClientId != null) return false;
+            if (this.clientStorageProvider != null ? !this.clientStorageProvider.equals(key.clientStorageProvider) : key.clientStorageProvider != null) return false;
             if (this.offline != null ? !this.offline.equals(key.offline) : key.offline != null) return false;
 
             return true;
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentUserSessionEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentUserSessionEntity.java
index c840386d1cf4..8bfbccc70633 100644
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentUserSessionEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/session/PersistentUserSessionEntity.java
@@ -18,6 +18,7 @@
 package org.keycloak.models.jpa.session;
 
 import jakarta.persistence.Version;
+import org.hibernate.annotations.DynamicUpdate;
 import org.keycloak.storage.jpa.KeyUtils;
 
 import jakarta.persistence.Column;
@@ -63,6 +64,7 @@
 })
 @Table(name="OFFLINE_USER_SESSION")
 @Entity
+@DynamicUpdate
 @IdClass(PersistentUserSessionEntity.Key.class)
 public class PersistentUserSessionEntity {
 
diff --git a/model/jpa/src/main/java/org/keycloak/organization/jpa/JpaOrganizationProvider.java b/model/jpa/src/main/java/org/keycloak/organization/jpa/JpaOrganizationProvider.java
index 3ec31d73df13..a3d373f20f6f 100644
--- a/model/jpa/src/main/java/org/keycloak/organization/jpa/JpaOrganizationProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/organization/jpa/JpaOrganizationProvider.java
@@ -60,6 +60,7 @@
 import org.keycloak.models.UserProvider;
 import org.keycloak.models.jpa.entities.GroupAttributeEntity;
 import org.keycloak.models.jpa.entities.GroupEntity;
+import org.keycloak.models.jpa.entities.OrganizationDomainEntity;
 import org.keycloak.models.jpa.entities.OrganizationEntity;
 import org.keycloak.models.jpa.entities.UserEntity;
 import org.keycloak.models.jpa.entities.UserGroupMembershipEntity;
@@ -68,6 +69,7 @@
 import org.keycloak.organization.OrganizationProvider;
 import org.keycloak.representations.idm.MembershipType;
 import org.keycloak.organization.utils.Organizations;
+import org.keycloak.storage.StorageId;
 import org.keycloak.utils.ReservedCharValidator;
 import org.keycloak.utils.StringUtil;
 
@@ -232,28 +234,101 @@ public OrganizationModel getByDomainName(String domain) {
 
     @Override
     public Stream<OrganizationModel> getAllStream(String search, Boolean exact, Integer first, Integer max) {
-        TypedQuery<OrganizationEntity> query;
-        if (StringUtil.isBlank(search)) {
-            query = em.createNamedQuery("getByRealm", OrganizationEntity.class);
-        } else if (Boolean.TRUE.equals(exact)) {
-            query = em.createNamedQuery("getByNameOrDomain", OrganizationEntity.class);
-            query.setParameter("search", search);
-        } else {
-            query = em.createNamedQuery("getByNameOrDomainContained", OrganizationEntity.class);
-            query.setParameter("search", search.toLowerCase());
-        }
-        RealmModel realm = getRealm();
-        query.setParameter("realmId", realm.getId());
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<OrganizationEntity> query = builder.createQuery(OrganizationEntity.class);
+        Root<OrganizationEntity> org = query.from(OrganizationEntity.class);
+
+        Predicate predicate = buildStringSearchPredicate(builder, query, org, search, exact);
 
-        return closing(paginateQuery(query, first, max).getResultStream()
-                .map(entity -> new OrganizationAdapter(session, realm, entity, this)));
+        TypedQuery<OrganizationEntity> typedQuery = buildSearchQuery(builder, query, org, predicate);
+
+        return closing(paginateQuery(typedQuery, first, max).getResultStream()
+                .map(entity -> new OrganizationAdapter(session, getRealm(), entity, this)));
     }
 
     @Override
     public Stream<OrganizationModel> getAllStream(Map<String, String> attributes, Integer first, Integer max) {
         CriteriaBuilder builder = em.getCriteriaBuilder();
-        CriteriaQuery query = builder.createQuery(OrganizationEntity.class);
+        CriteriaQuery<OrganizationEntity> query = builder.createQuery(OrganizationEntity.class);
+        Root<OrganizationEntity> org = query.from(OrganizationEntity.class);
+
+        Predicate predicate = buildAttributeSearchPredicate(builder, query, org, attributes);
+
+
+        TypedQuery<OrganizationEntity> typedQuery = buildSearchQuery(builder, query, org, predicate);
+        return closing(paginateQuery(typedQuery, first, max).getResultStream())
+                .map(entity -> new OrganizationAdapter(session, getRealm(), entity, this));
+    }
+
+    @Override
+    public long count(String search, Boolean exact) {
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> query = builder.createQuery(Long.class);
+        Root<OrganizationEntity> org = query.from(OrganizationEntity.class);
+
+        Predicate predicate = buildStringSearchPredicate(builder, query, org, search, exact);
+
+        TypedQuery<Long> typedQuery = buildCountQuery(builder, query, org, predicate);
+
+        return typedQuery.getSingleResult();
+    }
+
+    @Override
+    public long count(Map<String, String> attributes) {
+        CriteriaBuilder builder = em.getCriteriaBuilder();
+        CriteriaQuery<Long> query = builder.createQuery(Long.class);
         Root<OrganizationEntity> org = query.from(OrganizationEntity.class);
+
+        Predicate predicate = buildAttributeSearchPredicate(builder, query, org, attributes);
+
+
+        TypedQuery<Long> typedQuery = buildCountQuery(builder, query, org, predicate);
+
+        return typedQuery.getSingleResult();
+    }
+
+    private TypedQuery<OrganizationEntity> buildSearchQuery(CriteriaBuilder builder,
+                                                            CriteriaQuery<OrganizationEntity> query,
+                                                            Root<OrganizationEntity> org,
+                                                            Predicate predicate) {
+        return em.createQuery(
+                query.select(org).distinct(true).where(predicate).orderBy(builder.asc(org.get("name"))));
+    }
+
+    private TypedQuery<Long> buildCountQuery(CriteriaBuilder builder, CriteriaQuery<Long> query,
+                                             Root<OrganizationEntity> org, Predicate predicate) {
+        return em.createQuery(query.select(builder.countDistinct(org)).where(predicate));
+    }
+
+    private Predicate buildStringSearchPredicate(CriteriaBuilder builder, CriteriaQuery<?> query, Root<OrganizationEntity> org, String search,
+                                                 Boolean exact) {
+        Root<OrganizationDomainEntity> domain = query.from(OrganizationDomainEntity.class);
+
+        List<Predicate> predicates = new ArrayList<>();
+        RealmModel realm = getRealm();
+        predicates.add(builder.equal(org.get("realmId"), realm.getId()));
+        predicates.add(builder.equal(org.get("id"), domain.get("organization").get("id")));
+
+        Predicate namePredicate;
+        Predicate domainPredicate;
+        if (StringUtil.isBlank(search)) {
+            namePredicate = builder.conjunction();  // constant true
+            domainPredicate = builder.conjunction();
+
+        } else if (Boolean.TRUE.equals(exact)) {
+            namePredicate = builder.equal(org.get("name"), search);
+            domainPredicate = builder.equal(domain.get("name"), search);
+        } else {
+            namePredicate = builder.like(builder.lower(org.get("name")), "%" + search.toLowerCase() + "%");
+            domainPredicate = builder.like(domain.get("name"), "%" + search.toLowerCase() + "%");
+        }
+        predicates.add(builder.or(namePredicate, domainPredicate));
+
+        return builder.and(predicates.toArray(new Predicate[0]));
+    }
+
+    private Predicate buildAttributeSearchPredicate(CriteriaBuilder builder, CriteriaQuery<?> query,
+                                                    Root<OrganizationEntity> org, Map<String, String> attributes) {
         Root<GroupEntity> group = query.from(GroupEntity.class);
 
         List<Predicate> predicates = new ArrayList<>();
@@ -276,10 +351,8 @@ public Stream<OrganizationModel> getAllStream(Map<String, String> attributes, In
             }
         }
 
-        Predicate finalPredicate = builder.and(predicates.toArray(new Predicate[0]));
-        TypedQuery<OrganizationEntity> typedQuery = em.createQuery(query.select(org).where(finalPredicate));
-        return closing(paginateQuery(typedQuery, first, max).getResultStream())
-                .map(entity -> new OrganizationAdapter(session, realm, entity, this));
+        builder.count(builder.and(predicates.toArray(new Predicate[0])));
+        return builder.and(predicates.toArray(new Predicate[0]));
     }
 
     @Override
@@ -379,7 +452,13 @@ public UserModel getMemberById(OrganizationModel organization, String id) {
     @Override
     public Stream<OrganizationModel> getByMember(UserModel member) {
         throwExceptionIfObjectIsNull(member, "User");
-        TypedQuery<String> query = em.createNamedQuery("getGroupsByMember", String.class);
+
+        TypedQuery<String> query;
+        if(StorageId.isLocalStorage(member.getId())) {
+            query = em.createNamedQuery("getGroupsByMember", String.class);
+        } else {
+            query = em.createNamedQuery("getGroupsByFederatedMember", String.class);
+        }
 
         query.setParameter("userId", member.getId());
 
diff --git a/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProvider.java b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProvider.java
new file mode 100644
index 000000000000..8d55973b99cd
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProvider.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration.jpa;
+
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.LockModeType;
+import org.keycloak.storage.configuration.ServerConfigStorageProvider;
+import org.keycloak.storage.configuration.jpa.entity.ServerConfigEntity;
+
+/**
+ * A {@link ServerConfigStorageProvider} that stores its data in the database, using the {@link EntityManager}.
+ */
+public class JpaServerConfigStorageProvider implements ServerConfigStorageProvider {
+
+    private final EntityManager entityManager;
+
+    public JpaServerConfigStorageProvider(EntityManager entityManager) {
+        this.entityManager = Objects.requireNonNull(entityManager);
+    }
+
+    @Override
+    public Optional<String> find(String key) {
+        return Optional.ofNullable(getEntity(key))
+                .map(ServerConfigEntity::getValue);
+    }
+
+    @Override
+    public void store(String key, String value) {
+        var entity = getEntity(key);
+        if (entity == null) {
+            entity = new ServerConfigEntity();
+            entity.setKey(Objects.requireNonNull(key));
+            entity.setValue(Objects.requireNonNull(value));
+            entityManager.persist(entity);
+            return;
+        }
+        entity.setValue(Objects.requireNonNull(value));
+        entityManager.merge(entity);
+    }
+
+    @Override
+    public void remove(String key) {
+        var entity = getEntity(key);
+        if (entity != null) {
+            entityManager.remove(entity);
+        }
+    }
+
+    @Override
+    public String loadOrCreate(String key, Supplier<String> valueGenerator) {
+        var entity = getEntity(key);
+        if (entity != null) {
+            return entity.getValue();
+        }
+        var value = Objects.requireNonNull(valueGenerator.get());
+        entity = new ServerConfigEntity();
+        entity.setKey(Objects.requireNonNull(key));
+        entity.setValue(value);
+        entityManager.persist(entity);
+        return value;
+    }
+
+    @Override
+    public boolean replace(String key, Predicate<String> replacePredicate, Supplier<String> valueGenerator) {
+        Objects.requireNonNull(replacePredicate);
+        Objects.requireNonNull(valueGenerator);
+        var entity = getEntity(key);
+        if (entity == null || !replacePredicate.test(entity.getValue())) {
+            return false;
+        }
+        entity.setValue(valueGenerator.get());
+        entityManager.merge(entity);
+        return true;
+    }
+
+    @Override
+    public void close() {
+        //no-op
+    }
+
+    private ServerConfigEntity getEntity(String key) {
+        // Optimistic is enough to prevent the following scenario (copied from Javadoc):
+        // Transaction T1 reads a row. Another transaction T2 then modifies or deletes that row, before T1 has committed.
+        // Both transactions eventually commit successfully.
+        return entityManager.find(ServerConfigEntity.class, Objects.requireNonNull(key), LockModeType.OPTIMISTIC);
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProviderFactory.java b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProviderFactory.java
new file mode 100644
index 000000000000..94435399aa51
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/JpaServerConfigStorageProviderFactory.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration.jpa;
+
+import java.util.Set;
+
+import jakarta.persistence.EntityManager;
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.Provider;
+import org.keycloak.storage.configuration.ServerConfigStorageProviderFactory;
+
+/**
+ * A {@link ServerConfigStorageProviderFactory} that instantiates {@link JpaServerConfigStorageProvider}.
+ */
+public class JpaServerConfigStorageProviderFactory implements ServerConfigStorageProviderFactory {
+
+    @Override
+    public JpaServerConfigStorageProvider create(KeycloakSession session) {
+        return new JpaServerConfigStorageProvider(getEntityManager(session));
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "jpa";
+    }
+
+    @Override
+    public Set<Class<? extends Provider>> dependsOn() {
+        return Set.of(JpaConnectionProvider.class);
+    }
+
+    private static EntityManager getEntityManager(KeycloakSession session) {
+        return session.getProvider(JpaConnectionProvider.class).getEntityManager();
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/entity/ServerConfigEntity.java b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/entity/ServerConfigEntity.java
new file mode 100644
index 000000000000..83433b40e03b
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/storage/configuration/jpa/entity/ServerConfigEntity.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration.jpa.entity;
+
+import java.util.Objects;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.Version;
+
+/**
+ * A JPA entity to store the key-value configuration.
+ */
+@SuppressWarnings("unused")
+@Table(name = "SERVER_CONFIG")
+@Entity
+public class ServerConfigEntity {
+
+    @Id
+    @Column(name = "SERVER_CONFIG_KEY")
+    private String key;
+
+    @Column(name = "VALUE")
+    private String value;
+
+    @Version
+    @Column(name = "VERSION")
+    private int version;
+
+    public String getKey() {
+        return key;
+    }
+
+    public void setKey(String key) {
+        this.key = key;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public int getVersion() {
+        return version;
+    }
+
+    public void setVersion(int version) {
+        this.version = version;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == null || getClass() != o.getClass()) return false;
+
+        ServerConfigEntity that = (ServerConfigEntity) o;
+        return version == that.version && Objects.equals(key, that.key) && Objects.equals(value, that.value);
+    }
+
+    @Override
+    public int hashCode() {
+        int result = Objects.hashCode(key);
+        result = 31 * result + Objects.hashCode(value);
+        result = 31 * result + version;
+        return result;
+    }
+}
diff --git a/model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java b/model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java
index a45b615c2c3f..db5f7f71c3d5 100644
--- a/model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java
@@ -483,7 +483,7 @@ public Stream<String> getMembershipStream(RealmModel realm, GroupModel group, In
 
         return closing(paginateQuery(query, firstResult, max).getResultStream());
     }
-    
+
     @Override
     public Stream<String> getRoleMembersStream(RealmModel realm, RoleModel role, Integer firstResult, Integer max) {
         TypedQuery<String> query = em.createNamedQuery("fedRoleMembership", String.class);
@@ -564,6 +564,7 @@ public void deleteRoleMapping(RealmModel realm, String userId, RoleModel role) {
     public void updateCredential(RealmModel realm, String userId, CredentialModel cred) {
         FederatedUserCredentialEntity entity = em.find(FederatedUserCredentialEntity.class, cred.getId());
         if (!checkCredentialEntity(entity, userId)) return;
+        validateDuplicateUserCredential(userId, cred.getUserLabel(), cred.getId());
         createIndex(realm, userId);
         entity.setCreatedDate(cred.getCreatedDate());
         entity.setType(cred.getType());
@@ -572,8 +573,26 @@ public void updateCredential(RealmModel realm, String userId, CredentialModel cr
         entity.setUserLabel(cred.getUserLabel());
     }
 
+    /**
+     * Validates if a credential with the same user label already exists for the given user.
+     * Excludes the credential itself if updating an existing one.
+     */
+    private void validateDuplicateUserCredential(String userId, String userLabel, String credentialId) {
+        if (userLabel != null) {
+            boolean exists = getStoredCredentialEntitiesStream(userId)
+                    .anyMatch(existing -> existing.getUserLabel() != null
+                            && existing.getUserLabel().trim().equalsIgnoreCase(userLabel.trim())
+                            && (credentialId == null || !existing.getId().equals(credentialId)));
+
+            if (exists) {
+                throw new ModelDuplicateException("Device already exists with the same name", CredentialModel.USER_LABEL);
+            }
+        }
+    }
+
     @Override
     public CredentialModel createCredential(RealmModel realm, String userId, CredentialModel cred) {
+        validateDuplicateUserCredential(userId, cred.getUserLabel(), null);
         createIndex(realm, userId);
         FederatedUserCredentialEntity entity = new FederatedUserCredentialEntity();
         String id = cred.getId() == null ? KeycloakModelUtils.generateId() : cred.getId();
diff --git a/model/jpa/src/main/java/org/keycloak/storage/jpa/KeyUtils.java b/model/jpa/src/main/java/org/keycloak/storage/jpa/KeyUtils.java
index f86f9fb38d28..6db6287a2f4b 100644
--- a/model/jpa/src/main/java/org/keycloak/storage/jpa/KeyUtils.java
+++ b/model/jpa/src/main/java/org/keycloak/storage/jpa/KeyUtils.java
@@ -29,26 +29,27 @@ public class KeyUtils {
     private static final Logger LOG = Logger.getLogger(KeyUtils.class);
 
     public static final Pattern UUID_PATTERN = Pattern.compile("[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}");
+    public static final Pattern SHORT_ID_PATTERN = Pattern.compile("[0-9A-Za-z_-]{22}");
 
     public static final Pattern EXPECTED_KEY_PATTERN = Pattern.compile(
       UUID_PATTERN.pattern()
       + "|"
-      + "f:" + UUID_PATTERN.pattern() + ":.*"
+      + "f:(" + UUID_PATTERN.pattern() + "|" + SHORT_ID_PATTERN.pattern() + "):.*"
       + "|"
       + LightweightUserAdapter.ID_PREFIX + UUID_PATTERN.pattern()
     );
 
     /**
-     * Returns {@code} true when the key is {@code null} or either a plain UUID or a key formatted as "f:[UUID]:any_string"
+     * Check if a string is a valid key.
      * @param key String representation of the key
-     * @return 
+     * @return true when the key is {@code null} or either a plain UUID or a key formatted as "f:[UUID]:any_string" or "f:[SHORT_ID]:any_string"
      */
     public static boolean isValidKey(String key) {
         return key == null || EXPECTED_KEY_PATTERN.matcher(key).matches();
     }
 
     /**
-     * Logs an warning when the key is not a valid key
+     * Logs a warning when the key is not a valid key
      * @param key String representation of the key
      */
     public static void assertValidKey(String key) throws IllegalArgumentException {
diff --git a/model/jpa/src/main/resources/META-INF/jpa-changelog-2.5.0.xml b/model/jpa/src/main/resources/META-INF/jpa-changelog-2.5.0.xml
index fcadd4ea2a4c..9bce63722cd5 100755
--- a/model/jpa/src/main/resources/META-INF/jpa-changelog-2.5.0.xml
+++ b/model/jpa/src/main/resources/META-INF/jpa-changelog-2.5.0.xml
@@ -27,6 +27,8 @@
 
     <changeSet author="hmlnarik@redhat.com" id="2.5.0-unicode-oracle">
         <validCheckSum>7:e4c7e8f2256210aee71ddc42f538b57a</validCheckSum>
+        <validCheckSum>8:8b6fd445958882efe55deb26fc541a7b</validCheckSum>
+        <validCheckSum>9:3a32bace77c84d7678d035a7f5a8084e</validCheckSum>
         <preConditions onSqlOutput="TEST" onFail="MARK_RAN">
             <dbms type="oracle" />
         </preConditions>
@@ -52,7 +54,7 @@
         <addColumn tableName="COMPONENT_CONFIG">
             <column name="VALUE_NEW" type="NCLOB" />
         </addColumn>
-        <sql>UPDATE COMPONENT_CONFIG SET VALUE_NEW = VALUE, VALUE = NULL</sql>
+        <sql>UPDATE ${database.defaultSchemaName}.COMPONENT_CONFIG SET VALUE_NEW = VALUE, VALUE = NULL</sql>
         <dropColumn tableName="COMPONENT_CONFIG" columnName="VALUE"/>
         <renameColumn tableName="COMPONENT_CONFIG" oldColumnName="VALUE_NEW" newColumnName="VALUE" columnDataType="NCLOB"/>
 <!--
diff --git a/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.0.xml b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.0.xml
new file mode 100644
index 000000000000..3cf7504407e3
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.0.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+  ~ * and other contributors as indicated by the @author tags.
+  ~ *
+  ~ * Licensed under the Apache License, Version 2.0 (the "License");
+  ~ * you may not use this file except in compliance with the License.
+  ~ * You may obtain a copy of the License at
+  ~ *
+  ~ * http://www.apache.org/licenses/LICENSE-2.0
+  ~ *
+  ~ * Unless required by applicable law or agreed to in writing, software
+  ~ * distributed under the License is distributed on an "AS IS" BASIS,
+  ~ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ * See the License for the specific language governing permissions and
+  ~ * limitations under the License.
+  -->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+
+    <changeSet author="keycloak" id="26.2.0-36750">
+        <createTable tableName="SERVER_CONFIG">
+            <column name="SERVER_CONFIG_KEY" type="VARCHAR(255)">
+                <constraints nullable="false" primaryKey="true"/>
+            </column>
+            <column name="VALUE" type="CLOB">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VERSION" type="INT" defaultValueNumeric="0"/>
+        </createTable>
+    </changeSet>
+
+    <changeSet author="keycloak" id="26.2.0-26106">
+        <addColumn tableName="CREDENTIAL">
+            <column name="VERSION" type="INT" defaultValueNumeric="0" />
+        </addColumn>
+        <modifySql dbms="mssql">
+            <!-- ensure that existing rows also get the new values on mssql -->
+            <!-- https://github.com/liquibase/liquibase/issues/4644 -->
+            <replace replace="DEFAULT 0" with="DEFAULT 0 WITH VALUES" />
+        </modifySql>
+    </changeSet>
+
+</databaseChangeLog>
diff --git a/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.6.xml b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.6.xml
new file mode 100644
index 000000000000..98e1c8481ed8
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.2.6.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+  ~ * and other contributors as indicated by the @author tags.
+  ~ *
+  ~ * Licensed under the Apache License, Version 2.0 (the "License");
+  ~ * you may not use this file except in compliance with the License.
+  ~ * You may obtain a copy of the License at
+  ~ *
+  ~ * http://www.apache.org/licenses/LICENSE-2.0
+  ~ *
+  ~ * Unless required by applicable law or agreed to in writing, software
+  ~ * distributed under the License is distributed on an "AS IS" BASIS,
+  ~ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ * See the License for the specific language governing permissions and
+  ~ * limitations under the License.
+  -->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+
+    <changeSet author="keycloak" id="26.2.6-39866-duplicate">
+        <customChange class="org.keycloak.connections.jpa.updater.liquibase.custom.JpaUpdate26_2_6_RemoveDuplicateMigrationModelVersion"/>
+    </changeSet>
+
+    <changeSet author="keycloak" id="26.2.6-39866-uk">
+        <addUniqueConstraint tableName="MIGRATION_MODEL" columnNames="VERSION" constraintName="UK_MIGRATION_VERSION"/>
+    </changeSet>
+
+    <changeSet author="keycloak" id="26.2.6-40088-duplicate">
+        <customChange class="org.keycloak.connections.jpa.updater.liquibase.custom.JpaUpdate26_2_6_RemoveDuplicateMigrationModelTime"/>
+    </changeSet>
+
+    <changeSet author="keycloak" id="26.2.6-40088-uk">
+        <addUniqueConstraint tableName="MIGRATION_MODEL" columnNames="UPDATE_TIME" constraintName="UK_MIGRATION_UPDATE_TIME"/>
+    </changeSet>
+
+</databaseChangeLog>
diff --git a/model/jpa/src/main/resources/META-INF/jpa-changelog-26.3.0.xml b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.3.0.xml
new file mode 100644
index 000000000000..0940c94976cb
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/jpa-changelog-26.3.0.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+  ~ * and other contributors as indicated by the @author tags.
+  ~ *
+  ~ * Licensed under the Apache License, Version 2.0 (the "License");
+  ~ * you may not use this file except in compliance with the License.
+  ~ * You may obtain a copy of the License at
+  ~ *
+  ~ * http://www.apache.org/licenses/LICENSE-2.0
+  ~ *
+  ~ * Unless required by applicable law or agreed to in writing, software
+  ~ * distributed under the License is distributed on an "AS IS" BASIS,
+  ~ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ * See the License for the specific language governing permissions and
+  ~ * limitations under the License.
+  -->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+
+    <changeSet author="keycloak" id="26.3.0-groups-description">
+        <addColumn tableName="KEYCLOAK_GROUP">
+            <column name="DESCRIPTION" type="NVARCHAR(255)" />
+        </addColumn>
+    </changeSet>
+
+</databaseChangeLog>
diff --git a/model/jpa/src/main/resources/META-INF/jpa-changelog-master.xml b/model/jpa/src/main/resources/META-INF/jpa-changelog-master.xml
index 159c233af05a..f217a8f5cef6 100755
--- a/model/jpa/src/main/resources/META-INF/jpa-changelog-master.xml
+++ b/model/jpa/src/main/resources/META-INF/jpa-changelog-master.xml
@@ -85,5 +85,8 @@
     <include file="META-INF/jpa-changelog-25.0.0.xml"/>
     <include file="META-INF/jpa-changelog-26.0.0.xml"/>
     <include file="META-INF/jpa-changelog-26.1.0.xml"/>
+    <include file="META-INF/jpa-changelog-26.2.0.xml"/>
+    <include file="META-INF/jpa-changelog-26.2.6.xml"/>
+    <include file="META-INF/jpa-changelog-26.3.0.xml"/>
 
 </databaseChangeLog>
diff --git a/model/jpa/src/main/resources/META-INF/services/liquibase.database.Database b/model/jpa/src/main/resources/META-INF/services/liquibase.database.Database
index 238e52b6de4e..065c8fb40129 100644
--- a/model/jpa/src/main/resources/META-INF/services/liquibase.database.Database
+++ b/model/jpa/src/main/resources/META-INF/services/liquibase.database.Database
@@ -17,4 +17,5 @@
 
 org.keycloak.connections.jpa.updater.liquibase.PostgresPlusDatabase
 org.keycloak.connections.jpa.updater.liquibase.UpdatedMariaDBDatabase
-org.keycloak.connections.jpa.updater.liquibase.UpdatedMySqlDatabase
\ No newline at end of file
+org.keycloak.connections.jpa.updater.liquibase.UpdatedMySqlDatabase
+org.keycloak.connections.jpa.updater.liquibase.UpdatedPostgresDatabase
\ No newline at end of file
diff --git a/model/jpa/src/main/resources/META-INF/services/org.keycloak.storage.configuration.ServerConfigStorageProviderFactory b/model/jpa/src/main/resources/META-INF/services/org.keycloak.storage.configuration.ServerConfigStorageProviderFactory
new file mode 100644
index 000000000000..3be985df64e4
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/services/org.keycloak.storage.configuration.ServerConfigStorageProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.storage.configuration.jpa.JpaServerConfigStorageProviderFactory
diff --git a/model/jpa/src/main/resources/default-persistence.xml b/model/jpa/src/main/resources/default-persistence.xml
index a1fcb1ae664a..40ff6d60a2c3 100644
--- a/model/jpa/src/main/resources/default-persistence.xml
+++ b/model/jpa/src/main/resources/default-persistence.xml
@@ -89,6 +89,9 @@
         <class>org.keycloak.models.jpa.entities.OrganizationEntity</class>
         <class>org.keycloak.models.jpa.entities.OrganizationDomainEntity</class>
 
+        <!-- Server Configuration -->
+        <class>org.keycloak.storage.configuration.jpa.entity.ServerConfigEntity</class>
+
         <exclude-unlisted-classes>true</exclude-unlisted-classes>
 
         <properties>
diff --git a/model/jpa/src/test/java/org/keycloak/storage/jpa/KeyUtilsTest.java b/model/jpa/src/test/java/org/keycloak/storage/jpa/KeyUtilsTest.java
index 8dce67bd2f31..c44c6d30141e 100644
--- a/model/jpa/src/test/java/org/keycloak/storage/jpa/KeyUtilsTest.java
+++ b/model/jpa/src/test/java/org/keycloak/storage/jpa/KeyUtilsTest.java
@@ -18,6 +18,7 @@
 
 import java.util.UUID;
 import org.junit.Test;
+import org.keycloak.models.utils.KeycloakModelUtils;
 
 import static org.junit.Assert.*;
 
@@ -36,6 +37,10 @@ public void testValidKeys() {
         assertTrue(KeyUtils.isValidKey("f:" + UUID.randomUUID() + ":dsadsada"));
         assertTrue(KeyUtils.isValidKey("f:01234567-1234-1234-aAAa-123456789012:dsadsada"));
         assertTrue(KeyUtils.isValidKey("f:a1234567-1234-1234-aAAa-123456789012:dsadsada"));
+
+        assertTrue(KeyUtils.isValidKey("f:" + KeycloakModelUtils.generateShortId() + ":dsadsada"));
+        assertTrue(KeyUtils.isValidKey("f:22charsValidShort-uuid:dsadsada"));
+        assertTrue(KeyUtils.isValidKey("f:RaQXxaH_SGamVvd-6CBB2w:dsadsada"));
     }
 
     @Test
@@ -44,10 +49,13 @@ public void testInvalidKeys() {
         assertFalse(KeyUtils.isValidKey("0"));
         assertFalse(KeyUtils.isValidKey("01234567-1234-1234-aAAg-123456789012a"));
         assertFalse(KeyUtils.isValidKey("z1234567-1234-1234-aAAa-123456789012"));
+        //short ids should only be used in federated context
+        assertFalse(KeyUtils.isValidKey("22charsValidShort-uuid"));
 
         assertFalse(KeyUtils.isValidKey("f:g1234567-1234-1234-aAAa-123456789012:dsadsada"));
         assertFalse(KeyUtils.isValidKey("g:a1234567-1234-1234-aAAa-123456789012:dsadsada"));
         assertFalse(KeyUtils.isValidKey("f:a1234567-1234-1234-aAAa-123456789012"));
+        assertFalse(KeyUtils.isValidKey("f:short-Id:Invalid-Ch@rs:dsadsada"));
     }
 
 }
diff --git a/model/storage-private/src/main/java/org/keycloak/exportimport/util/ExportUtils.java b/model/storage-private/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
index 2da8215a5c2a..9f9b513e32ec 100755
--- a/model/storage-private/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
+++ b/model/storage-private/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
@@ -255,7 +255,7 @@ public static RealmRepresentation exportRealm(KeycloakSession session, RealmMode
         if (Profile.isFeatureEnabled(Feature.ORGANIZATION) && !options.isPartial()) {
             OrganizationProvider orgProvider = session.getProvider(OrganizationProvider.class);
             orgProvider.getAllStream().map(model -> {
-                OrganizationRepresentation org = ModelToRepresentation.toRepresentation(model);
+                OrganizationRepresentation org = ModelToRepresentation.toRepresentation(model, false);
 
                 orgProvider.getMembersStream(model, (Map<String, String>) null, null, null, null)
                         .forEach(user -> {
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo22_0_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo22_0_0.java
index 86778622cd55..00f5caa3a63a 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo22_0_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo22_0_0.java
@@ -31,7 +31,7 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class MigrateTo22_0_0 implements Migration {
+public class MigrateTo22_0_0 extends RealmMigration {
 
     public static final ModelVersion VERSION = new ModelVersion("22.0.0");
 
@@ -40,16 +40,8 @@ public class MigrateTo22_0_0 implements Migration {
     private static final Logger LOG = Logger.getLogger(MigrateTo22_0_0.class);
 
     @Override
-    public void migrate(KeycloakSession session) {
-        session.realms().getRealmsStream().forEach(realm -> {
-            RealmModel currentRealm = session.getContext().getRealm();
-            session.getContext().setRealm(realm);
-            try {
-                removeHttpChallengeFlow(session, realm);
-            } finally {
-                session.getContext().setRealm(currentRealm);
-            }
-        });
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
+        removeHttpChallengeFlow(session, realm);
         //login, account, email themes are handled by JpaUpdate22_0_0_RemoveRhssoThemes
     }
 
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo23_0_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo23_0_0.java
index c9ec179326f9..f99031c372d3 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo23_0_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo23_0_0.java
@@ -28,10 +28,9 @@
 import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.userprofile.UserProfileProvider;
 
-public class MigrateTo23_0_0 implements Migration {
+public class MigrateTo23_0_0 extends RealmMigration {
 
     private static final Logger LOG = Logger.getLogger(MigrateTo23_0_0.class);
 
@@ -43,30 +42,14 @@ public class MigrateTo23_0_0 implements Migration {
     private static final String UP_COMPONENT_CONFIG_KEY = "kc.user.profile.config";
 
     @Override
-    public void migrate(KeycloakSession session) {
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
-    }
-
-    @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
-
-    private void migrateRealm(KeycloakSession session, RealmModel realm) {
-        KeycloakContext context = session.getContext();
-
-        try {
-            context.setRealm(realm);
-            updateUserProfileConfig(realm);
-            removeRegistrationProfileFormExecution(realm);
-        } finally {
-            context.setRealm(null);
-        }
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
+        updateUserProfileConfig(realm);
+        removeRegistrationProfileFormExecution(realm);
     }
 
     private void updateUserProfileConfig(RealmModel realm) {
         if (realm.getAttribute(USER_PROFILE_ENABLED_PROP, Boolean.FALSE)) {
-            
+
             Optional<ComponentModel> component = realm.getComponentsStream(realm.getId(), UserProfileProvider.class.getName()).findAny();
             if (component.isPresent()) {
                 ComponentModel userProfileComponent = component.get();
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_0.java
index 4e7b20c3d38a..3043661b0640 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_0.java
@@ -22,50 +22,34 @@
 import org.jboss.logging.Logger;
 import org.keycloak.migration.ModelVersion;
 import org.keycloak.models.AuthenticationFlowModel;
-import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.LDAPConstants;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.models.utils.DefaultKeyProviders;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.representations.userprofile.config.UPConfig.UnmanagedAttributePolicy;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.userprofile.UserProfileProvider;
 
-public class MigrateTo24_0_0 implements Migration {
+public class MigrateTo24_0_0 extends RealmMigration {
 
     private static final Logger LOG = Logger.getLogger(MigrateTo24_0_0.class);
     public static final ModelVersion VERSION = new ModelVersion("24.0.0");
     public static final String REALM_USER_PROFILE_ENABLED = "userProfileEnabled";
 
-    @Override
-    public void migrate(KeycloakSession session) {
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
-    }
-
-    @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
 
     @Override
     public ModelVersion getVersion() {
         return VERSION;
     }
 
-    private void migrateRealm(KeycloakSession session, RealmModel realm) {
-        KeycloakContext context = session.getContext();
-        try {
-            context.setRealm(realm);
-            updateUserProfileSettings(session);
-            updateLdapProviderConfig(session);
-            createHS512ComponentModelKey(session);
-            bindFirstBrokerLoginFlow(session);
-        } finally {
-            context.setRealm(null);
-        }
+    @Override
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
+        updateUserProfileSettings(session);
+        updateLdapProviderConfig(session);
+        createHS512ComponentModelKey(session);
+        bindFirstBrokerLoginFlow(session);
     }
 
     private void updateUserProfileSettings(KeycloakSession session) {
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_3.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_3.java
index cbbea545c3d8..62005ab70892 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_3.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo24_0_3.java
@@ -29,28 +29,19 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class MigrateTo24_0_3 implements Migration {
+public class MigrateTo24_0_3 extends RealmMigration {
 
     private static final Logger LOG = Logger.getLogger(MigrateTo24_0_3.class);
 
     public static final ModelVersion VERSION = new ModelVersion("24.0.3");
 
-    @Override
-    public void migrate(KeycloakSession session) {
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
-    }
-
-    @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
-
     @Override
     public ModelVersion getVersion() {
         return VERSION;
     }
 
-    private void migrateRealm(KeycloakSession session, RealmModel realm) {
+    @Override
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
         DefaultRequiredActions.addDeleteCredentialAction(realm);
     }
 }
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo25_0_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo25_0_0.java
index 4888ea8a0eb4..9deba7d15a3a 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo25_0_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo25_0_0.java
@@ -27,12 +27,11 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.idm.RealmRepresentation;
 
 /**
  * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
  */
-public class MigrateTo25_0_0 implements Migration {
+public class MigrateTo25_0_0 extends RealmMigration {
 
     public static final ModelVersion VERSION = new ModelVersion("25.0.0");
 
@@ -51,14 +50,11 @@ public void migrate(KeycloakSession session) {
             session.sessions().migrate(VERSION.toString());
         }
 
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
+        super.migrate(session);
     }
 
     @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
-    protected void migrateRealm(KeycloakSession session, RealmModel realm) {
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
         MigrationProvider migrationProvider = session.getProvider(MigrationProvider.class);
 
         ClientScopeModel basicScope = KeycloakModelUtils.getClientScopeByName(realm, "basic");
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_0_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_0_0.java
index 84c80e64a21c..834626de5909 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_0_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_0_0.java
@@ -18,24 +18,17 @@
 package org.keycloak.migration.migrators;
 
 
-import java.lang.invoke.MethodHandles;
-
-import org.jboss.logging.Logger;
-import org.keycloak.Config;
 import org.keycloak.migration.ModelVersion;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionProvider;
-import org.keycloak.representations.idm.RealmRepresentation;
 
-public class MigrateTo26_0_0 implements Migration {
+public class MigrateTo26_0_0 extends RealmMigration {
 
     public static final ModelVersion VERSION = new ModelVersion("26.0.0");
 
-    private static final Logger LOG = Logger.getLogger(MethodHandles.lookup().lookupClass());
-
     @Override
     public ModelVersion getVersion() {
         return VERSION;
@@ -49,15 +42,11 @@ public void migrate(KeycloakSession session) {
             userSessions.migrate(VERSION.toString());
         }
 
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
+        super.migrate(session);
     }
 
     @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
-
-    private void migrateRealm(KeycloakSession session, RealmModel realm) {
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
         ClientModel adminConsoleClient = realm.getClientByClientId(Constants.ADMIN_CONSOLE_CLIENT_ID);
         if (adminConsoleClient != null) {
             adminConsoleClient.setFullScopeAllowed(true);
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_1_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_1_0.java
index 3227a6798369..3911d648bb10 100644
--- a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_1_0.java
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_1_0.java
@@ -17,39 +17,25 @@
 
 package org.keycloak.migration.migrators;
 
-import java.lang.invoke.MethodHandles;
-import org.jboss.logging.Logger;
 import org.keycloak.migration.MigrationProvider;
 import org.keycloak.migration.ModelVersion;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.RealmRepresentation;
 
 /**
  *
  * @author rmartinc
  */
-public class MigrateTo26_1_0 implements Migration {
+public class MigrateTo26_1_0 extends RealmMigration {
 public static final ModelVersion VERSION = new ModelVersion("26.1.0");
 
-    private static final Logger LOG = Logger.getLogger(MethodHandles.lookup().lookupClass());
-
     @Override
     public ModelVersion getVersion() {
         return VERSION;
     }
 
     @Override
-    public void migrate(KeycloakSession session) {
-        session.realms().getRealmsStream().forEach(realm -> migrateRealm(session, realm));
-    }
-
-    @Override
-    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep, boolean skipUserDependent) {
-        migrateRealm(session, realm);
-    }
-
-    private void migrateRealm(KeycloakSession session, RealmModel realm) {
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
         // add the new service_account scope to the realm
         MigrationProvider migrationProvider = session.getProvider(MigrationProvider.class);
         migrationProvider.addOIDCServiceAccountClientScope(realm);
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_2_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_2_0.java
new file mode 100644
index 000000000000..ae010942f8bc
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_2_0.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.migration.migrators;
+
+import java.util.Collections;
+import java.util.HashMap;
+
+import org.keycloak.migration.ModelVersion;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+
+public class MigrateTo26_2_0 extends RealmMigration {
+
+    public static final ModelVersion VERSION = new ModelVersion("26.2.0");
+
+    @Override
+    public ModelVersion getVersion() {
+        return VERSION;
+    }
+
+    @Override
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
+        // Removes _browser_header.xXSSProtection attribute
+        var headers = new HashMap<>(realm.getBrowserSecurityHeaders());
+        headers.remove("xXSSProtection");
+        realm.setBrowserSecurityHeaders(Collections.unmodifiableMap(headers));
+    }
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_3_0.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_3_0.java
new file mode 100644
index 000000000000..2bf1d26b063a
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/MigrateTo26_3_0.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.migration.migrators;
+
+import org.keycloak.migration.ModelVersion;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.DefaultRequiredActions;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MigrateTo26_3_0 extends RealmMigration {
+
+    public static final ModelVersion VERSION = new ModelVersion("26.3.0");
+
+    @Override
+    public ModelVersion getVersion() {
+        return VERSION;
+    }
+
+
+    @Override
+    public void migrateRealm(KeycloakSession session, RealmModel realm) {
+        DefaultRequiredActions.addIdpLink(realm);
+    }
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/migration/migrators/RealmMigration.java b/model/storage-private/src/main/java/org/keycloak/migration/migrators/RealmMigration.java
new file mode 100644
index 000000000000..c6813e24bba3
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/migration/migrators/RealmMigration.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.migration.migrators;
+
+import org.jboss.logging.Logger;
+import org.keycloak.connections.jpa.support.EntityManagers;
+import org.keycloak.models.KeycloakContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+
+public abstract class RealmMigration implements Migration {
+
+    private static final Logger LOG = Logger.getLogger(RealmMigration.class);
+
+    @Override
+    public void migrate(KeycloakSession session) {
+        session.realms().getRealmsStream().forEach(realm -> {
+            // empty out the persistence context for each realm
+            EntityManagers.flush(session, true);
+            // alternatively could be EntityManagers.runInBatch - but that also changes the
+            // query modes, which I'm not sure is applicable here
+            KeycloakContext context = session.getContext();
+            RealmModel oldRealm = session.getContext().getRealm();
+            RealmModel mutableRealm = session.realms().getRealmByName(realm.getName());
+            try {
+                context.setRealm(mutableRealm);
+                migrateRealm(session, mutableRealm);
+                LOG.infof("migrated realm %s to %s", realm.getName(), getVersion());
+            } finally {
+                context.setRealm(oldRealm);
+            }
+        });
+    }
+
+    @Override
+    public void migrateImport(KeycloakSession session, RealmModel realm, RealmRepresentation rep,
+            boolean skipUserDependent) {
+        migrateRealm(session, realm);
+    }
+
+    public abstract void migrateRealm(KeycloakSession session, RealmModel realm);
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProvider.java b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProvider.java
new file mode 100644
index 000000000000..0a22abb1ad83
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProvider.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.cache;
+
+import org.keycloak.provider.Provider;
+
+public interface CacheCrlProvider extends Provider {
+
+    /**
+     * Clears all the cached CRLs, so they need to be loaded again
+     */
+    void clearCache();
+
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderFactory.java b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderFactory.java
new file mode 100644
index 000000000000..5c1e46b14c25
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderFactory.java
@@ -0,0 +1,23 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.cache;
+
+import org.keycloak.provider.ProviderFactory;
+
+public interface CacheCrlProviderFactory extends ProviderFactory<CacheCrlProvider> {
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderSpi.java b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderSpi.java
new file mode 100644
index 000000000000..c2355080029f
--- /dev/null
+++ b/model/storage-private/src/main/java/org/keycloak/models/cache/CacheCrlProviderSpi.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.cache;
+
+import org.keycloak.provider.Spi;
+
+public class CacheCrlProviderSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "crlCache";
+    }
+
+    @Override
+    public Class<CacheCrlProvider> getProviderClass() {
+        return CacheCrlProvider.class;
+    }
+
+    @Override
+    public Class<CacheCrlProviderFactory> getProviderFactoryClass() {
+        return CacheCrlProviderFactory.class;
+    }
+}
diff --git a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
index 7a4c5f8e549b..7667bd284c3a 100644
--- a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
+++ b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
@@ -125,8 +125,11 @@ private PersistentClientSessionData getData() {
     // Write updated model with latest serialized data
     public PersistentClientSessionModel getUpdatedModel() {
         try {
-            String updatedData = JsonSerialization.writeValueAsString(getData());
-            this.model.setData(updatedData);
+            if (data != null) {
+                // If data hasn't been initialized, it hasn't been touched and is unchanged. So need to deserialize and serialize it
+                String updatedData = JsonSerialization.writeValueAsString(getData());
+                this.model.setData(updatedData);
+            }
         } catch (IOException ioe) {
             throw new ModelException("Error persisting session", ioe);
         }
diff --git a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
index 4bfd326fdbdd..dfa3ab687b44 100644
--- a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
+++ b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
@@ -168,8 +168,11 @@ private PersistentUserSessionData getData() {
     // Write updated model with latest serialized data
     public PersistentUserSessionModel getUpdatedModel() {
         try {
-            String updatedData = JsonSerialization.writeValueAsString(getData());
-            this.model.setData(updatedData);
+            if (data != null) {
+                // If data hasn't been initialized, it hasn't been touched and is unchanged. So need to deserialize and serialize it
+                String updatedData = JsonSerialization.writeValueAsString(getData());
+                this.model.setData(updatedData);
+            }
         } catch (IOException ioe) {
             throw new ModelException("Error persisting session", ioe);
         }
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/ClientScopeStorageManager.java b/model/storage-private/src/main/java/org/keycloak/storage/ClientScopeStorageManager.java
index 439ebbd55617..2e72b6a8cc1c 100644
--- a/model/storage-private/src/main/java/org/keycloak/storage/ClientScopeStorageManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/ClientScopeStorageManager.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.storage;
 
+import java.util.Map;
 import java.util.stream.Stream;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientScopeProvider;
@@ -74,6 +75,17 @@ public void removeClientScopes(RealmModel realm) {
         localStorage().removeClientScopes(realm);
     }
 
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByProtocol(RealmModel realm, String protocol) {
+        return localStorage().getClientScopesByProtocol(realm, protocol);
+    }
+
+    @Override
+    public Stream<ClientScopeModel> getClientScopesByAttributes(RealmModel realm, Map<String, String> searchMap,
+                                                                boolean useOr) {
+        return localStorage().getClientScopesByAttributes(realm, searchMap, useOr);
+    }
+
     @Override
     public void close() {
     }
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/UserStorageManager.java b/model/storage-private/src/main/java/org/keycloak/storage/UserStorageManager.java
index b51258032112..91257ada7918 100755
--- a/model/storage-private/src/main/java/org/keycloak/storage/UserStorageManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/UserStorageManager.java
@@ -29,6 +29,8 @@
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.Function;
+import java.util.function.Predicate;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
@@ -113,7 +115,14 @@ private UserFederatedStorageProvider getFederatedStorage() {
      * @param user
      * @return
      */
-    protected UserModel importValidation(RealmModel realm, UserModel user) {
+    protected UserModel validateUser(RealmModel realm, UserModel user) {
+        if (user == null) {
+            return null;
+        }
+
+        if (user.isFederated()) {
+            user = validateFederatedUser(realm, user);
+        }
 
         if (isReadOnlyOrganizationMember(user)) {
             if (user instanceof CachedUserModel cachedUserModel) {
@@ -122,13 +131,17 @@ protected UserModel importValidation(RealmModel realm, UserModel user) {
             return new ReadOnlyUserModelDelegate(user, false);
         }
 
-        if (user == null || user.getFederationLink() == null) return user;
+        return user;
+    }
+
+    private UserModel validateFederatedUser(RealmModel realm, UserModel user) {
+        if (!user.isFederated()) {
+            return user;
+        }
+
+        UserStorageProviderModel model = getUserStorageProviderModel(realm, user);
 
-        UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
         if (model == null) {
-            // remove linked user with unknown storage provider.
-            logger.debugf("Removed user with federation link of unknown storage provider '%s'", user.getUsername());
-            deleteInvalidUser(realm, user);
             return null;
         }
 
@@ -144,16 +157,57 @@ protected UserModel importValidation(RealmModel realm, UserModel user) {
             return user;
         }
 
-        ImportedUserValidation importedUserValidation = getStorageProviderInstance(model, ImportedUserValidation.class, true);
-        if (importedUserValidation == null) return user;
+        ImportedUserValidation validator = getStorageProviderInstance(model, ImportedUserValidation.class, true);
+
+        if (validator == null) {
+            return user;
+        }
+
+        UserModel validated = validator.validate(realm, user);
 
-        UserModel validated = importedUserValidation.validate(realm, user);
         if (validated == null) {
+            return deleteFederatedUser(realm, user);
+        }
+
+        return validated;
+    }
+
+    private ReadOnlyUserModelDelegate deleteFederatedUser(RealmModel realm, UserModel user) {
+        if (!user.isFederated()) {
+            return null;
+        }
+
+        UserStorageProviderModel model = getUserStorageProviderModel(realm, user);
+
+        if (model == null) {
+            return null;
+        }
+
+        deleteInvalidUserCache(realm, user);
+
+        if (model.isRemoveInvalidUsersEnabled()) {
             deleteInvalidUser(realm, user);
             return null;
-        } else {
-            return validated;
         }
+
+        return new ReadOnlyUserModelDelegate(user, false);
+    }
+
+    private UserStorageProviderModel getUserStorageProviderModel(RealmModel realm, UserModel user) {
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
+
+            if (model == null) {
+                // remove linked user with unknown storage provider.
+                logger.debugf("Removed user with federation link of unknown storage provider '%s'", user.getUsername());
+                deleteInvalidUserCache(realm, user);
+                deleteInvalidUser(realm, user);
+            }
+
+            return model;
+        }
+
+        return null;
     }
 
     private static <T> Stream<T> getCredentialProviders(KeycloakSession session, Class<T> type) {
@@ -204,14 +258,16 @@ public CredentialValidationOutput getUserByCredential(RealmModel realm, Credenti
         return result;
     }
 
-    protected void deleteInvalidUser(final RealmModel realm, final UserModel user) {
-        String userId = user.getId();
-        String userName = user.getUsername();
+    protected void deleteInvalidUserCache(final RealmModel realm, final UserModel user) {
         UserCache userCache = UserStorageUtil.userCache(session);
         if (userCache != null) {
             userCache.evict(realm, user);
         }
+    }
 
+    protected void deleteInvalidUser(final RealmModel realm, final UserModel user) {
+        String userId = user.getId();
+        String userName = user.getUsername();
         // This needs to be running in separate transaction because removing the user may end up with throwing
         // PessimisticLockException which also rollbacks Jpa transaction, hence when it is running in current transaction
         // it will become not usable for all consequent jpa calls. It will end up with Transaction is in rolled back
@@ -219,6 +275,7 @@ protected void deleteInvalidUser(final RealmModel realm, final UserModel user) {
         runJobInTransaction(session.getKeycloakSessionFactory(), session -> {
             RealmModel realmModel = session.realms().getRealm(realm.getId());
             if (realmModel == null) return;
+            session.getContext().setRealm(realm);
             UserModel deletedUser = UserStoragePrivateUtil.userLocalStorage(session).getUserById(realmModel, userId);
             if (deletedUser != null) {
                 try {
@@ -234,9 +291,8 @@ protected void deleteInvalidUser(final RealmModel realm, final UserModel user) {
         });
     }
 
-
     protected Stream<UserModel> importValidation(RealmModel realm, Stream<UserModel> users) {
-        return users.map(user -> importValidation(realm, user)).filter(Objects::nonNull);
+        return users.map(user -> validateUser(realm, user)).filter(Objects::nonNull);
     }
 
     @FunctionalInterface
@@ -377,9 +433,8 @@ public boolean removeUser(RealmModel realm, UserModel user) {
         StorageId storageId = new StorageId(user.getId());
 
         if (storageId.getProviderId() == null) {
-            String federationLink = user.getFederationLink();
-            boolean linkRemoved = federationLink == null || Optional.ofNullable(
-                    getStorageProviderInstance(realm, federationLink, UserRegistrationProvider.class))
+            boolean linkRemoved = !user.isFederated() || Optional.ofNullable(
+                    getStorageProviderInstance(realm, user.getFederationLink(), UserRegistrationProvider.class))
                     .map(provider -> provider.removeUser(realm, user))
                     .orElse(false);
 
@@ -402,7 +457,7 @@ public UserModel getUserById(RealmModel realm, String id) {
         StorageId storageId = new StorageId(id);
         if (storageId.getProviderId() == null) {
             UserModel user = localStorage().getUserById(realm, id);
-            return importValidation(realm, user);
+            return validateUser(realm, user);
         }
 
         UserLookupProvider provider = getStorageProviderInstance(realm, storageId.getProviderId(), UserLookupProvider.class);
@@ -413,28 +468,16 @@ public UserModel getUserById(RealmModel realm, String id) {
 
     @Override
     public UserModel getUserByUsername(RealmModel realm, String username) {
-        UserModel user = localStorage().getUserByUsername(realm, username);
-        if (user != null) {
-            return importValidation(realm, user);
-        }
-
-        return mapEnabledStorageProvidersWithTimeout(realm, UserLookupProvider.class,
-                provider -> provider.getUserByUsername(realm, username)).findFirst().orElse(null);
+        return getUserByAttribute(realm,
+                provider -> provider.getUserByUsername(realm, username),
+                u -> username.equalsIgnoreCase(u.getUsername()));
     }
 
     @Override
     public UserModel getUserByEmail(RealmModel realm, String email) {
-        UserModel user = localStorage().getUserByEmail(realm, email);
-        if (user != null) {
-            user = importValidation(realm, user);
-            // Case when email was changed directly in the userStorage and doesn't correspond anymore to the email from local DB
-            if (user != null && email.equalsIgnoreCase(user.getEmail())) {
-                return user;
-            }
-        }
-
-        return mapEnabledStorageProvidersWithTimeout(realm, UserLookupProvider.class,
-                provider -> provider.getUserByEmail(realm, email)).findFirst().orElse(null);
+        return getUserByAttribute(realm,
+                provider -> provider.getUserByEmail(realm, email),
+                u -> email.equalsIgnoreCase(u.getEmail()));
     }
 
     /** {@link UserLookupProvider} methods implementations end here
@@ -800,7 +843,7 @@ public int getNotBeforeOfUser(RealmModel realm, UserModel user) {
     public UserModel getUserByFederatedIdentity(RealmModel realm, FederatedIdentityModel socialLink) {
         UserModel user = localStorage().getUserByFederatedIdentity(realm, socialLink);
         if (user != null) {
-            return importValidation(realm, user);
+            return validateUser(realm, user);
         }
         if (getFederatedStorage() == null) return null;
         String id = getFederatedStorage().getUserByFederatedIdentity(socialLink, realm);
@@ -984,4 +1027,31 @@ public KeycloakSession getKeycloakSession() {
             }
         });
     }
+
+    private UserModel getUserByAttribute(RealmModel realm, Function<UserLookupProvider, UserModel> loader, Predicate<UserModel> attributeValidator) {
+        // first try the local storage
+        UserModel user = loader.apply(localStorage());
+
+        if (user != null) {
+            // run global user validations
+            UserModel validated = validateUser(realm, user);
+
+            // make sure the attribute is valid
+            if (validated != null && attributeValidator.test(validated)) {
+                return validated;
+            }
+
+            // user or attribute not valid, invalidate cache
+            deleteInvalidUserCache(realm, user);
+        }
+
+        // try to resolve the user from the external storage
+        return tryResolveFederatedUser(realm, loader);
+    }
+
+    private UserModel tryResolveFederatedUser(RealmModel realm, Function<UserLookupProvider, UserModel> loader) {
+        return mapEnabledStorageProvidersWithTimeout(realm, UserLookupProvider.class, loader)
+                .findFirst()
+                .orElse(null);
+    }
 }
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java
index 0577e612635b..62f22cfc66dd 100644
--- a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java
@@ -23,6 +23,7 @@
 import org.keycloak.common.enums.SslRequired;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.component.ComponentModel;
+import org.keycloak.connections.jpa.support.EntityManagers;
 import org.keycloak.deployment.DeployedConfigurationsManager;
 import org.keycloak.exportimport.ExportAdapter;
 import org.keycloak.exportimport.ExportOptions;
@@ -58,12 +59,13 @@
 import org.keycloak.models.UserConsentModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.WebAuthnPolicy;
+import org.keycloak.models.WebAuthnPolicyPasswordlessDefaults;
+import org.keycloak.models.WebAuthnPolicyTwoFactorDefaults;
 import org.keycloak.models.utils.ComponentUtil;
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.models.utils.DefaultKeyProviders;
 import org.keycloak.models.utils.DefaultRequiredActions;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.organization.OrganizationProvider;
 import org.keycloak.organization.validation.OrganizationsValidation;
@@ -124,10 +126,12 @@
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
 import static org.keycloak.models.utils.DefaultRequiredActions.getDefaultRequiredActionCaseInsensitively;
+import static org.keycloak.models.utils.ModelToRepresentation.stripRealmAttributesIncludedAsFields;
 import static org.keycloak.models.utils.RepresentationToModel.createCredentials;
 import static org.keycloak.models.utils.RepresentationToModel.createFederatedIdentities;
 import static org.keycloak.models.utils.RepresentationToModel.createGroups;
@@ -145,6 +149,21 @@ public class DefaultExportImportManager implements ExportImportManager {
     private final KeycloakSession session;
     private static final Logger logger = Logger.getLogger(DefaultExportImportManager.class);
 
+    public static class UserBatcher implements Consumer<KeycloakSession> {
+        private int count;
+
+        @Override
+        public void accept(KeycloakSession session) {
+            // TODO: determine what a good number is here
+            // There actually doesn't seem to be much difference with setting this
+            // higher - the important part is to clear the contexts - which could be even more optimal
+            // as detaching just users and their children
+            if (++count % 64 == 0) {
+                EntityManagers.flush(session, true);
+            }
+        };
+    }
+
     public DefaultExportImportManager(KeycloakSession session) {
         this.session = session;
     }
@@ -173,7 +192,7 @@ public RealmModel importRealm(InputStream requestBody) {
     }
 
     @Override
-    public void importRealm(RealmRepresentation rep, RealmModel newRealm, boolean skipUserDependent) {
+    public void importRealm(RealmRepresentation rep, RealmModel newRealm, Runnable userImport) {
         convertDeprecatedSocialProviders(rep);
         convertDeprecatedApplications(session, rep);
         convertDeprecatedClientTemplates(rep);
@@ -185,16 +204,14 @@ public void importRealm(RealmRepresentation rep, RealmModel newRealm, boolean sk
         if (rep.isUserManagedAccessAllowed() != null) newRealm.setUserManagedAccessAllowed(rep.isUserManagedAccessAllowed());
         if (rep.isBruteForceProtected() != null) newRealm.setBruteForceProtected(rep.isBruteForceProtected());
         if (rep.isPermanentLockout() != null) newRealm.setPermanentLockout(rep.isPermanentLockout());
-        if (rep.getMaxTemporaryLockouts() != null) newRealm.setMaxTemporaryLockouts(rep.getMaxTemporaryLockouts());
+        if (rep.getMaxTemporaryLockouts() != null) newRealm.setMaxTemporaryLockouts(checkNonNegativeNumber(rep.getMaxTemporaryLockouts(),"Maximum temporary lockouts"));
         if (rep.getBruteForceStrategy() != null) newRealm.setBruteForceStrategy(rep.getBruteForceStrategy());
-        if (rep.getMaxFailureWaitSeconds() != null) newRealm.setMaxFailureWaitSeconds(rep.getMaxFailureWaitSeconds());
-        if (rep.getMinimumQuickLoginWaitSeconds() != null)
-            newRealm.setMinimumQuickLoginWaitSeconds(rep.getMinimumQuickLoginWaitSeconds());
-        if (rep.getWaitIncrementSeconds() != null) newRealm.setWaitIncrementSeconds(rep.getWaitIncrementSeconds());
-        if (rep.getQuickLoginCheckMilliSeconds() != null)
-            newRealm.setQuickLoginCheckMilliSeconds(rep.getQuickLoginCheckMilliSeconds());
-        if (rep.getMaxDeltaTimeSeconds() != null) newRealm.setMaxDeltaTimeSeconds(rep.getMaxDeltaTimeSeconds());
-        if (rep.getFailureFactor() != null) newRealm.setFailureFactor(rep.getFailureFactor());
+        if (rep.getMaxFailureWaitSeconds() != null) newRealm.setMaxFailureWaitSeconds(checkNonNegativeNumber(rep.getMaxFailureWaitSeconds(),"Maximum failure wait seconds"));
+        if (rep.getMinimumQuickLoginWaitSeconds() != null) newRealm.setMinimumQuickLoginWaitSeconds(checkNonNegativeNumber(rep.getMinimumQuickLoginWaitSeconds(),"Minimum quick login wait seconds"));
+        if (rep.getWaitIncrementSeconds() != null) newRealm.setWaitIncrementSeconds(checkNonNegativeNumber(rep.getWaitIncrementSeconds(),"Wait increment seconds"));
+        if (rep.getQuickLoginCheckMilliSeconds() != null) newRealm.setQuickLoginCheckMilliSeconds(checkNonNegativeNumber(rep.getQuickLoginCheckMilliSeconds().intValue(), "Quick login check milliseconds"));
+        if (rep.getMaxDeltaTimeSeconds() != null) newRealm.setMaxDeltaTimeSeconds(checkNonNegativeNumber(rep.getMaxDeltaTimeSeconds(),"Maximum delta time seconds"));
+        if (rep.getFailureFactor() != null) newRealm.setFailureFactor(checkNonNegativeNumber(rep.getFailureFactor(),"Failure factor"));
         if (rep.isEventsEnabled() != null) newRealm.setEventsEnabled(rep.isEventsEnabled());
         if (rep.getEnabledEventTypes() != null)
             newRealm.setEnabledEventTypes(new HashSet<>(rep.getEnabledEventTypes()));
@@ -343,7 +360,7 @@ public void importRealm(RealmRepresentation rep, RealmModel newRealm, boolean sk
 
         Map<String, ClientScopeModel> clientScopes = new HashMap<>();
         if (rep.getClientScopes() != null) {
-            clientScopes = createClientScopes(session, rep.getClientScopes(), newRealm);
+            clientScopes = createClientScopes(rep.getClientScopes(), newRealm);
         }
         if (rep.getDefaultDefaultClientScopes() != null) {
             for (String clientScopeName : rep.getDefaultDefaultClientScopes()) {
@@ -441,19 +458,30 @@ public void importRealm(RealmRepresentation rep, RealmModel newRealm, boolean sk
 
         // create users and their role mappings and social mappings
 
-        if (rep.getUsers() != null) {
-            for (UserRepresentation userRep : rep.getUsers()) {
-                createUser(newRealm, userRep);
-            }
-        }
+        if (Optional.ofNullable(rep.getUsers()).filter(l -> !l.isEmpty()).isPresent() ||
+                Optional.ofNullable(rep.getFederatedUsers()).filter(l -> !l.isEmpty()).isPresent()) {
+            // run in a batch to mimic the behavior of directory based import
+            // this is using nested entity managers to keep the parent context clean
+            EntityManagers.runInBatch(session, () -> {
+                UserBatcher onUserAdded = new UserBatcher();
+                if (rep.getUsers() != null) {
+                    for (UserRepresentation userRep : rep.getUsers()) {
+                        createUser(newRealm, userRep);
+                        onUserAdded.accept(session);
+                    }
+                }
 
-        if (rep.getFederatedUsers() != null) {
-            for (UserRepresentation userRep : rep.getFederatedUsers()) {
-                importFederatedUser(session, newRealm, userRep);
-            }
+                if (rep.getFederatedUsers() != null) {
+                    for (UserRepresentation userRep : rep.getFederatedUsers()) {
+                        importFederatedUser(session, newRealm, userRep);
+                        onUserAdded.accept(session);
+                    }
+                }
+            }, true);
         }
 
-        if (!skipUserDependent) {
+        if (userImport != null) {
+            userImport.run();
             importRealmAuthorizationSettings(rep, newRealm, session);
         }
 
@@ -555,10 +583,10 @@ private static Map<String, ClientModel> createClients(KeycloakSession session, R
         return appMap;
     }
 
-    private static Map<String, ClientScopeModel> createClientScopes(KeycloakSession session, List<ClientScopeRepresentation> clientScopes, RealmModel realm) {
+    private static Map<String, ClientScopeModel> createClientScopes(List<ClientScopeRepresentation> clientScopes, RealmModel realm) {
         Map<String, ClientScopeModel> appMap = new HashMap<>();
         for (ClientScopeRepresentation resourceRep : clientScopes) {
-            ClientScopeModel app = RepresentationToModel.createClientScope(session, realm, resourceRep);
+            ClientScopeModel app = RepresentationToModel.createClientScope(realm, resourceRep);
             appMap.put(app.getName(), app);
         }
         return appMap;
@@ -686,7 +714,7 @@ public static void renameRealm(RealmModel realm, String name) {
         String oldName = realm.getName();
 
         ClientModel masterApp = realm.getMasterAdminClient();
-        masterApp.setClientId(KeycloakModelUtils.getMasterRealmAdminApplicationClientId(name));
+        masterApp.setClientId(KeycloakModelUtils.getMasterRealmAdminManagementClientId(name));
         realm.setName(name);
 
         ClientModel adminClient = realm.getClientByClientId(Constants.ADMIN_CONSOLE_CLIENT_ID);
@@ -738,9 +766,8 @@ public void updateRealm(RealmRepresentation rep, RealmModel realm) {
 
         // Import attributes first, so the stuff saved directly on representation (displayName, bruteForce etc) has bigger priority
         if (rep.getAttributes() != null) {
-            Set<String> attrsToRemove = new HashSet<>(realm.getAttributes().keySet());
+            Set<String> attrsToRemove = stripRealmAttributesIncludedAsFields(realm.getAttributes()).keySet();
             attrsToRemove.removeAll(rep.getAttributes().keySet());
-            attrsToRemove.removeAll(ModelToRepresentation.REALM_EXCLUDED_ATTRIBUTES);
 
             for (Map.Entry<String, String> entry : rep.getAttributes().entrySet()) {
                 realm.setAttribute(entry.getKey(), entry.getValue());
@@ -760,16 +787,14 @@ public void updateRealm(RealmRepresentation rep, RealmModel realm) {
         if (rep.isUserManagedAccessAllowed() != null) realm.setUserManagedAccessAllowed(rep.isUserManagedAccessAllowed());
         if (rep.isBruteForceProtected() != null) realm.setBruteForceProtected(rep.isBruteForceProtected());
         if (rep.isPermanentLockout() != null) realm.setPermanentLockout(rep.isPermanentLockout());
-        if (rep.getMaxTemporaryLockouts() != null) realm.setMaxTemporaryLockouts(rep.getMaxTemporaryLockouts());
+        if (rep.getMaxTemporaryLockouts() != null) realm.setMaxTemporaryLockouts(checkNonNegativeNumber(rep.getMaxTemporaryLockouts(),"Maximum temporary lockouts"));
         if (rep.getBruteForceStrategy() != null) realm.setBruteForceStrategy(rep.getBruteForceStrategy());
-        if (rep.getMaxFailureWaitSeconds() != null) realm.setMaxFailureWaitSeconds(rep.getMaxFailureWaitSeconds());
-        if (rep.getMinimumQuickLoginWaitSeconds() != null)
-            realm.setMinimumQuickLoginWaitSeconds(rep.getMinimumQuickLoginWaitSeconds());
-        if (rep.getWaitIncrementSeconds() != null) realm.setWaitIncrementSeconds(rep.getWaitIncrementSeconds());
-        if (rep.getQuickLoginCheckMilliSeconds() != null)
-            realm.setQuickLoginCheckMilliSeconds(rep.getQuickLoginCheckMilliSeconds());
-        if (rep.getMaxDeltaTimeSeconds() != null) realm.setMaxDeltaTimeSeconds(rep.getMaxDeltaTimeSeconds());
-        if (rep.getFailureFactor() != null) realm.setFailureFactor(rep.getFailureFactor());
+        if (rep.getMaxFailureWaitSeconds() != null) realm.setMaxFailureWaitSeconds(checkNonNegativeNumber(rep.getMaxFailureWaitSeconds(),"Maximum failure wait seconds")); 
+        if (rep.getMinimumQuickLoginWaitSeconds() != null) realm.setMinimumQuickLoginWaitSeconds(checkNonNegativeNumber(rep.getMinimumQuickLoginWaitSeconds(),"Minimum quick login wait seconds"));
+        if (rep.getWaitIncrementSeconds() != null) realm.setWaitIncrementSeconds(checkNonNegativeNumber(rep.getWaitIncrementSeconds(),"Wait increment seconds")); 
+        if (rep.getQuickLoginCheckMilliSeconds() != null) realm.setQuickLoginCheckMilliSeconds(checkNonNegativeNumber(rep.getQuickLoginCheckMilliSeconds().intValue(), "Quick login check milliseconds")); 
+        if (rep.getMaxDeltaTimeSeconds() != null) realm.setMaxDeltaTimeSeconds(checkNonNegativeNumber(rep.getMaxDeltaTimeSeconds(),"Maximum delta time seconds"));
+        if (rep.getFailureFactor() != null) realm.setFailureFactor(checkNonNegativeNumber(rep.getFailureFactor(),"Failure factor"));
         if (rep.isRegistrationAllowed() != null) realm.setRegistrationAllowed(rep.isRegistrationAllowed());
         if (rep.isRegistrationEmailAsUsername() != null)
             realm.setRegistrationEmailAsUsername(rep.isRegistrationEmailAsUsername());
@@ -860,11 +885,34 @@ public void updateRealm(RealmRepresentation rep, RealmModel realm) {
         session.clientPolicy().updateRealmModelFromRepresentation(realm, rep);
 
         if (rep.getSmtpServer() != null) {
-            Map<String, String> config = new HashMap(rep.getSmtpServer());
-            if (rep.getSmtpServer().containsKey("password") && ComponentRepresentation.SECRET_VALUE.equals(rep.getSmtpServer().get("password"))) {
-                String passwordValue = realm.getSmtpConfig() != null ? realm.getSmtpConfig().get("password") : null;
-                config.put("password", passwordValue);
+
+            Map<String, String> config = new HashMap<>(rep.getSmtpServer());
+
+            if (!Boolean.parseBoolean(config.get("auth"))) {
+                config.remove("authTokenUrl");
+                config.remove("authTokenScope");
+                config.remove("authTokenClientId");
+                config.remove("authTokenClientSecret");
+                config.remove("password");
+                config.remove("user");
+                config.remove("authType");
+            } else if (config.get("authType") == null || "basic".equals(config.get("authType"))) {
+                if (ComponentRepresentation.SECRET_VALUE.equals(config.get("password"))) {
+                    String passwordValue = realm.getSmtpConfig() != null ? realm.getSmtpConfig().get("password") : null;
+                    config.put("password", passwordValue);
+                }
+                config.remove("authTokenUrl");
+                config.remove("authTokenScope");
+                config.remove("authTokenClientId");
+                config.remove("authTokenClientSecret");
+            } else if ("token".equals(config.get("authType"))) {
+                if (ComponentRepresentation.SECRET_VALUE.equals(config.get("authTokenClientSecret"))) {
+                    String authTokenClientSecretValue = realm.getSmtpConfig() != null ? realm.getSmtpConfig().get("authTokenClientSecret") : null;
+                    config.put("authTokenClientSecret", authTokenClientSecretValue);
+                }
+                config.remove("password");
             }
+
             realm.setSmtpConfig(config);
         }
 
@@ -974,6 +1022,13 @@ public static void convertDeprecatedSocialProviders(UserRepresentation user) {
         user.setSocialLinks(null);
     }
 
+    public static int checkNonNegativeNumber(int value, String name) {
+        if(value < 0) {
+            throw new ModelException(name + " may not be a negative value");
+        }
+        return value;
+    }
+
     private static void convertDeprecatedApplications(KeycloakSession session, RealmRepresentation realm) {
         if (realm.getApplications() != null || realm.getOauthClients() != null) {
             if (realm.getClients() == null) {
@@ -1208,54 +1263,66 @@ public static void importGroups(RealmModel realm, RealmRepresentation rep) {
 
     private static WebAuthnPolicy getWebAuthnPolicyTwoFactor(RealmRepresentation rep) {
         WebAuthnPolicy webAuthnPolicy = new WebAuthnPolicy();
+        WebAuthnPolicy defaultConfig = WebAuthnPolicyTwoFactorDefaults.get();
 
         String webAuthnPolicyRpEntityName = rep.getWebAuthnPolicyRpEntityName();
         if (webAuthnPolicyRpEntityName == null || webAuthnPolicyRpEntityName.isEmpty())
-            webAuthnPolicyRpEntityName = Constants.DEFAULT_WEBAUTHN_POLICY_RP_ENTITY_NAME;
+            webAuthnPolicyRpEntityName = defaultConfig.getRpEntityName();
         webAuthnPolicy.setRpEntityName(webAuthnPolicyRpEntityName);
 
         List<String> webAuthnPolicySignatureAlgorithms = rep.getWebAuthnPolicySignatureAlgorithms();
         if (webAuthnPolicySignatureAlgorithms == null || webAuthnPolicySignatureAlgorithms.isEmpty())
-            webAuthnPolicySignatureAlgorithms = Arrays.asList(Constants.DEFAULT_WEBAUTHN_POLICY_SIGNATURE_ALGORITHMS.split(","));
+            webAuthnPolicySignatureAlgorithms = defaultConfig.getSignatureAlgorithm();
         webAuthnPolicy.setSignatureAlgorithm(webAuthnPolicySignatureAlgorithms);
 
         String webAuthnPolicyRpId = rep.getWebAuthnPolicyRpId();
         if (webAuthnPolicyRpId == null || webAuthnPolicyRpId.isEmpty())
-            webAuthnPolicyRpId = "";
+            webAuthnPolicyRpId = defaultConfig.getRpId();
         webAuthnPolicy.setRpId(webAuthnPolicyRpId);
 
         String webAuthnPolicyAttestationConveyancePreference = rep.getWebAuthnPolicyAttestationConveyancePreference();
         if (webAuthnPolicyAttestationConveyancePreference == null || webAuthnPolicyAttestationConveyancePreference.isEmpty())
-            webAuthnPolicyAttestationConveyancePreference = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyAttestationConveyancePreference = defaultConfig.getAttestationConveyancePreference();
         webAuthnPolicy.setAttestationConveyancePreference(webAuthnPolicyAttestationConveyancePreference);
 
         String webAuthnPolicyAuthenticatorAttachment = rep.getWebAuthnPolicyAuthenticatorAttachment();
         if (webAuthnPolicyAuthenticatorAttachment == null || webAuthnPolicyAuthenticatorAttachment.isEmpty())
-            webAuthnPolicyAuthenticatorAttachment = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyAuthenticatorAttachment = defaultConfig.getAuthenticatorAttachment();
         webAuthnPolicy.setAuthenticatorAttachment(webAuthnPolicyAuthenticatorAttachment);
 
         String webAuthnPolicyRequireResidentKey = rep.getWebAuthnPolicyRequireResidentKey();
         if (webAuthnPolicyRequireResidentKey == null || webAuthnPolicyRequireResidentKey.isEmpty())
-            webAuthnPolicyRequireResidentKey = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyRequireResidentKey = defaultConfig.getRequireResidentKey();
         webAuthnPolicy.setRequireResidentKey(webAuthnPolicyRequireResidentKey);
 
         String webAuthnPolicyUserVerificationRequirement = rep.getWebAuthnPolicyUserVerificationRequirement();
         if (webAuthnPolicyUserVerificationRequirement == null || webAuthnPolicyUserVerificationRequirement.isEmpty())
-            webAuthnPolicyUserVerificationRequirement = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyUserVerificationRequirement = defaultConfig.getUserVerificationRequirement();
         webAuthnPolicy.setUserVerificationRequirement(webAuthnPolicyUserVerificationRequirement);
 
         Integer webAuthnPolicyCreateTimeout = rep.getWebAuthnPolicyCreateTimeout();
-        if (webAuthnPolicyCreateTimeout != null) webAuthnPolicy.setCreateTimeout(webAuthnPolicyCreateTimeout);
-        else webAuthnPolicy.setCreateTimeout(0);
+        if (webAuthnPolicyCreateTimeout == null) {
+            webAuthnPolicyCreateTimeout = defaultConfig.getCreateTimeout();
+        }
+        webAuthnPolicy.setCreateTimeout(webAuthnPolicyCreateTimeout);
 
         Boolean webAuthnPolicyAvoidSameAuthenticatorRegister = rep.isWebAuthnPolicyAvoidSameAuthenticatorRegister();
-        if (webAuthnPolicyAvoidSameAuthenticatorRegister != null) webAuthnPolicy.setAvoidSameAuthenticatorRegister(webAuthnPolicyAvoidSameAuthenticatorRegister);
+        if (webAuthnPolicyAvoidSameAuthenticatorRegister == null) {
+            webAuthnPolicyAvoidSameAuthenticatorRegister = defaultConfig.isAvoidSameAuthenticatorRegister();
+        }
+        webAuthnPolicy.setAvoidSameAuthenticatorRegister(webAuthnPolicyAvoidSameAuthenticatorRegister);
 
         List<String> webAuthnPolicyAcceptableAaguids = rep.getWebAuthnPolicyAcceptableAaguids();
-        if (webAuthnPolicyAcceptableAaguids != null) webAuthnPolicy.setAcceptableAaguids(webAuthnPolicyAcceptableAaguids);
+        if (webAuthnPolicyAcceptableAaguids == null) {
+            webAuthnPolicyAcceptableAaguids = defaultConfig.getAcceptableAaguids();
+        }
+        webAuthnPolicy.setAcceptableAaguids(webAuthnPolicyAcceptableAaguids);
 
         List<String> webAuthnPolicyExtraOrigins = rep.getWebAuthnPolicyExtraOrigins();
-        if (webAuthnPolicyExtraOrigins != null) webAuthnPolicy.setExtraOrigins(webAuthnPolicyExtraOrigins);
+        if (webAuthnPolicyExtraOrigins == null) {
+            webAuthnPolicyExtraOrigins = defaultConfig.getExtraOrigins();
+        }
+        webAuthnPolicy.setExtraOrigins(webAuthnPolicyExtraOrigins);
 
         return webAuthnPolicy;
     }
@@ -1263,54 +1330,72 @@ private static WebAuthnPolicy getWebAuthnPolicyTwoFactor(RealmRepresentation rep
 
     private static WebAuthnPolicy getWebAuthnPolicyPasswordless(RealmRepresentation rep) {
         WebAuthnPolicy webAuthnPolicy = new WebAuthnPolicy();
+        WebAuthnPolicy defaultConfig = WebAuthnPolicyPasswordlessDefaults.get();
 
         String webAuthnPolicyRpEntityName = rep.getWebAuthnPolicyPasswordlessRpEntityName();
         if (webAuthnPolicyRpEntityName == null || webAuthnPolicyRpEntityName.isEmpty())
-            webAuthnPolicyRpEntityName = Constants.DEFAULT_WEBAUTHN_POLICY_RP_ENTITY_NAME;
+            webAuthnPolicyRpEntityName = defaultConfig.getRpEntityName();
         webAuthnPolicy.setRpEntityName(webAuthnPolicyRpEntityName);
 
         List<String> webAuthnPolicySignatureAlgorithms = rep.getWebAuthnPolicyPasswordlessSignatureAlgorithms();
         if (webAuthnPolicySignatureAlgorithms == null || webAuthnPolicySignatureAlgorithms.isEmpty())
-            webAuthnPolicySignatureAlgorithms = Arrays.asList(Constants.DEFAULT_WEBAUTHN_POLICY_SIGNATURE_ALGORITHMS.split(","));
+            webAuthnPolicySignatureAlgorithms = defaultConfig.getSignatureAlgorithm();
         webAuthnPolicy.setSignatureAlgorithm(webAuthnPolicySignatureAlgorithms);
 
         String webAuthnPolicyRpId = rep.getWebAuthnPolicyPasswordlessRpId();
         if (webAuthnPolicyRpId == null || webAuthnPolicyRpId.isEmpty())
-            webAuthnPolicyRpId = "";
+            webAuthnPolicyRpId = defaultConfig.getRpId();
         webAuthnPolicy.setRpId(webAuthnPolicyRpId);
 
         String webAuthnPolicyAttestationConveyancePreference = rep.getWebAuthnPolicyPasswordlessAttestationConveyancePreference();
         if (webAuthnPolicyAttestationConveyancePreference == null || webAuthnPolicyAttestationConveyancePreference.isEmpty())
-            webAuthnPolicyAttestationConveyancePreference = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyAttestationConveyancePreference = defaultConfig.getAttestationConveyancePreference();
         webAuthnPolicy.setAttestationConveyancePreference(webAuthnPolicyAttestationConveyancePreference);
 
         String webAuthnPolicyAuthenticatorAttachment = rep.getWebAuthnPolicyPasswordlessAuthenticatorAttachment();
         if (webAuthnPolicyAuthenticatorAttachment == null || webAuthnPolicyAuthenticatorAttachment.isEmpty())
-            webAuthnPolicyAuthenticatorAttachment = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyAuthenticatorAttachment = defaultConfig.getAuthenticatorAttachment();
         webAuthnPolicy.setAuthenticatorAttachment(webAuthnPolicyAuthenticatorAttachment);
 
         String webAuthnPolicyRequireResidentKey = rep.getWebAuthnPolicyPasswordlessRequireResidentKey();
         if (webAuthnPolicyRequireResidentKey == null || webAuthnPolicyRequireResidentKey.isEmpty())
-            webAuthnPolicyRequireResidentKey = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyRequireResidentKey = defaultConfig.getRequireResidentKey();
         webAuthnPolicy.setRequireResidentKey(webAuthnPolicyRequireResidentKey);
 
         String webAuthnPolicyUserVerificationRequirement = rep.getWebAuthnPolicyPasswordlessUserVerificationRequirement();
         if (webAuthnPolicyUserVerificationRequirement == null || webAuthnPolicyUserVerificationRequirement.isEmpty())
-            webAuthnPolicyUserVerificationRequirement = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+            webAuthnPolicyUserVerificationRequirement = defaultConfig.getUserVerificationRequirement();
         webAuthnPolicy.setUserVerificationRequirement(webAuthnPolicyUserVerificationRequirement);
 
         Integer webAuthnPolicyCreateTimeout = rep.getWebAuthnPolicyPasswordlessCreateTimeout();
-        if (webAuthnPolicyCreateTimeout != null) webAuthnPolicy.setCreateTimeout(webAuthnPolicyCreateTimeout);
-        else webAuthnPolicy.setCreateTimeout(0);
+        if (webAuthnPolicyCreateTimeout == null) {
+            webAuthnPolicyCreateTimeout = defaultConfig.getCreateTimeout();
+        }
+        webAuthnPolicy.setCreateTimeout(webAuthnPolicyCreateTimeout);
 
         Boolean webAuthnPolicyAvoidSameAuthenticatorRegister = rep.isWebAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister();
-        if (webAuthnPolicyAvoidSameAuthenticatorRegister != null) webAuthnPolicy.setAvoidSameAuthenticatorRegister(webAuthnPolicyAvoidSameAuthenticatorRegister);
+        if (webAuthnPolicyAvoidSameAuthenticatorRegister == null) {
+            webAuthnPolicyAvoidSameAuthenticatorRegister = defaultConfig.isAvoidSameAuthenticatorRegister();
+        }
+        webAuthnPolicy.setAvoidSameAuthenticatorRegister(webAuthnPolicyAvoidSameAuthenticatorRegister);
 
         List<String> webAuthnPolicyAcceptableAaguids = rep.getWebAuthnPolicyPasswordlessAcceptableAaguids();
-        if (webAuthnPolicyAcceptableAaguids != null) webAuthnPolicy.setAcceptableAaguids(webAuthnPolicyAcceptableAaguids);
+        if (webAuthnPolicyAcceptableAaguids == null) {
+            webAuthnPolicyAcceptableAaguids = defaultConfig.getAcceptableAaguids();
+        }
+        webAuthnPolicy.setAcceptableAaguids(webAuthnPolicyAcceptableAaguids);
 
         List<String> webAuthnPolicyExtraOrigins = rep.getWebAuthnPolicyPasswordlessExtraOrigins();
-        if (webAuthnPolicyExtraOrigins != null) webAuthnPolicy.setExtraOrigins(webAuthnPolicyExtraOrigins);
+        if (webAuthnPolicyExtraOrigins == null) {
+            webAuthnPolicyExtraOrigins = defaultConfig.getExtraOrigins();
+        }
+        webAuthnPolicy.setExtraOrigins(webAuthnPolicyExtraOrigins);
+
+        Boolean webAuthnPolicyPasswordlessPasskeysEnabled = rep.getWebAuthnPolicyPasswordlessPasskeysEnabled();
+        if (webAuthnPolicyPasswordlessPasskeysEnabled == null) {
+            webAuthnPolicyPasswordlessPasskeysEnabled = defaultConfig.isPasskeysEnabled();
+        }
+        webAuthnPolicy.setPasskeysEnabled(webAuthnPolicyPasswordlessPasskeysEnabled);
 
         return webAuthnPolicy;
     }
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
index 5aef959966c7..c2df3353f4d9 100644
--- a/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultMigrationManager.java
@@ -42,6 +42,8 @@
 import org.keycloak.migration.migrators.MigrateTo25_0_0;
 import org.keycloak.migration.migrators.MigrateTo26_0_0;
 import org.keycloak.migration.migrators.MigrateTo26_1_0;
+import org.keycloak.migration.migrators.MigrateTo26_2_0;
+import org.keycloak.migration.migrators.MigrateTo26_3_0;
 import org.keycloak.migration.migrators.MigrateTo2_0_0;
 import org.keycloak.migration.migrators.MigrateTo2_1_0;
 import org.keycloak.migration.migrators.MigrateTo2_2_0;
@@ -123,6 +125,8 @@ public class DefaultMigrationManager implements MigrationManager {
             new MigrateTo25_0_0(),
             new MigrateTo26_0_0(),
             new MigrateTo26_1_0(),
+            new MigrateTo26_2_0(),
+            new MigrateTo26_3_0(),
     };
 
     private final KeycloakSession session;
diff --git a/model/storage-private/src/main/java/org/keycloak/storage/managers/UserStorageSyncManager.java b/model/storage-private/src/main/java/org/keycloak/storage/managers/UserStorageSyncManager.java
index c2b99b0ffaf1..a7385005f949 100755
--- a/model/storage-private/src/main/java/org/keycloak/storage/managers/UserStorageSyncManager.java
+++ b/model/storage-private/src/main/java/org/keycloak/storage/managers/UserStorageSyncManager.java
@@ -28,8 +28,8 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.KeycloakSessionTask;
-import org.keycloak.models.StorageProviderRealmModel;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.StorageProviderRealmModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.UserStorageProviderFactory;
@@ -109,7 +109,7 @@ public void run(KeycloakSession session) {
                     @Override
                     public SynchronizationResult call() throws Exception {
                         int lastSync = Time.currentTime();
-                        SynchronizationResult result = ((ImportSynchronization)factory).sync(sessionFactory, realmId, provider);
+                        SynchronizationResult result = ((ImportSynchronization) factory).sync(sessionFactory, realmId, provider);
                         if (!result.isIgnored()) {
                             updateLastSyncInterval(sessionFactory, provider, realmId, lastSync);
                         }
@@ -155,7 +155,7 @@ public SynchronizationResult call() throws Exception {
                         // See when we did last sync.
                         int oldLastSync = provider.getLastSync();
                         int lastSync = Time.currentTime();
-                        SynchronizationResult result = ((ImportSynchronization)factory).syncSince(Time.toDate(oldLastSync), sessionFactory, realmId, provider);
+                        SynchronizationResult result = ((ImportSynchronization) factory).syncSince(Time.toDate(oldLastSync), sessionFactory, realmId, provider);
                         if (!result.isIgnored()) {
                             updateLastSyncInterval(sessionFactory, provider, realmId, lastSync);
                         }
@@ -178,13 +178,13 @@ public SynchronizationResult call() throws Exception {
 
     public static void notifyToRefreshPeriodicSyncAll(KeycloakSession session, RealmModel realm, boolean removed) {
         ((StorageProviderRealmModel) realm).getUserStorageProvidersStream().forEachOrdered(fedProvider ->
-           notifyToRefreshPeriodicSync(session, realm, fedProvider, removed));
+                notifyToRefreshPeriodicSync(session, realm, fedProvider, removed));
     }
-    
+
     public static void notifyToRefreshPeriodicSyncSingle(KeycloakSession session, RealmModel realm, ComponentModel component, boolean removed) {
         notifyToRefreshPeriodicSync(session, realm, new UserStorageProviderModel(component), removed);
     }
-    
+
     // Ensure all cluster nodes are notified
     public static void notifyToRefreshPeriodicSync(KeycloakSession session, RealmModel realm, UserStorageProviderModel provider, boolean removed) {
         UserStorageProviderFactory factory = (UserStorageProviderFactory) session.getKeycloakSessionFactory().getProviderFactory(UserStorageProvider.class, provider.getProviderId());
@@ -195,7 +195,7 @@ public static void notifyToRefreshPeriodicSync(KeycloakSession session, RealmMod
         final ClusterProvider cp = session.getProvider(ClusterProvider.class);
         if (cp != null) {
             UserStorageProviderClusterEvent event = UserStorageProviderClusterEvent.createEvent(removed, realm.getId(), provider);
-            cp.notify(USER_STORAGE_TASK_KEY, event, false, ClusterProvider.DCNotify.ALL_DCS);
+            cp.notify(USER_STORAGE_TASK_KEY, event, false);
         }
     }
 
@@ -268,7 +268,7 @@ public void run() {
                         break;
                 }
             } catch (Throwable t) {
-                logger.errorf(t,"Error occurred during %s users-sync in realm %s", //
+                logger.errorf(t, "Error occurred during %s users-sync in realm %s", //
                         syncMode, realm.getName());
             }
         }
diff --git a/model/storage-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/storage-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index 465df451b401..e815bb7beaa6 100644
--- a/model/storage-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/model/storage-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -18,6 +18,7 @@
 org.keycloak.models.cache.CacheUserProviderSpi
 org.keycloak.models.cache.CacheRealmProviderSpi
 org.keycloak.models.cache.CachePublicKeyProviderSpi
+org.keycloak.models.cache.CacheCrlProviderSpi
 org.keycloak.models.dblock.DBLockSpi
 org.keycloak.storage.client.ClientStorageProviderSpi
 org.keycloak.storage.group.GroupStorageProviderSpi
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java b/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java
index 50765380b240..ea458ae197dc 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java
@@ -19,17 +19,19 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
+import org.keycloak.connections.jpa.support.EntityManagers;
 import org.keycloak.exportimport.AbstractFileBasedImportProvider;
 import org.keycloak.exportimport.Strategy;
 import org.keycloak.exportimport.util.ExportImportSessionTask;
 import org.keycloak.exportimport.util.ImportUtils;
+import org.keycloak.exportimport.util.ExportImportSessionTask.Mode;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.platform.Platform;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.KeycloakSessionUtil;
 
 import java.io.File;
 import java.io.IOException;
@@ -37,8 +39,9 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
-import java.util.concurrent.atomic.AtomicBoolean;
-import org.keycloak.services.managers.RealmManager;
+import java.util.Optional;
+
+import org.keycloak.storage.datastore.DefaultExportImportManager;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -98,6 +101,8 @@ public void importModel() throws IOException {
 
             for (String realmName : realmNames) {
                 importRealm(realmName, strategy);
+                Optional.ofNullable(KeycloakSessionUtil.getKeycloakSession())
+                        .ifPresent(session -> EntityManagers.flush(session, true));
             }
         }
         ServicesLogger.LOGGER.importSuccess();
@@ -138,58 +143,37 @@ public void importRealm(final String realmName, final Strategy strategy) throws
         // Import realm first
         InputStream is = parseFile(realmFile);
         final RealmRepresentation realmRep = JsonSerialization.readValue(is, RealmRepresentation.class);
-        final AtomicBoolean realmImported = new AtomicBoolean();
+        if (!realmRep.getRealm().equals(realmName)) {
+            throw new IllegalStateException(String.format("File name / realm name mismatch. %s, contains realm %s. File name should be %s", realmFile.getName(), realmRep.getRealm(), realmRep.getRealm() + "-realm.json"));
+        }
 
-        KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
+        new ExportImportSessionTask() {
 
             @Override
             public void runExportImportTask(KeycloakSession session) {
-                boolean imported = ImportUtils.importRealm(session, realmRep, strategy, true);
-                realmImported.set(imported);
+                ImportUtils.importRealm(session, realmRep, strategy, () -> {
+                    importUsers(realmName, userFiles, false);
+                    importUsers(realmName, federatedUserFiles, true);
+                });
             }
 
-        });
-
-        if (realmImported.get()) {
-            // Import users
-            for (final File userFile : userFiles) {
-                try (InputStream fis = parseFile(userFile)) {
-                    KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-                        @Override
-                        protected void runExportImportTask(KeycloakSession session) throws IOException {
-                            session.getContext().setRealm(session.realms().getRealmByName(realmName));
-                            ImportUtils.importUsersFromStream(session, realmName, JsonSerialization.mapper, fis);
-                            logger.infof("Imported users from %s", userFile.getAbsolutePath());
-                        }
-                    });
-                }
-            }
-            for (final File userFile : federatedUserFiles) {
-                try (InputStream fis = parseFile(userFile)) {
-                    KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-                        @Override
-                        protected void runExportImportTask(KeycloakSession session) throws IOException {
-                            session.getContext().setRealm(session.realms().getRealmByName(realmName));
-                            ImportUtils.importFederatedUsersFromStream(session, realmName, JsonSerialization.mapper, fis);
-                            logger.infof("Imported federated users from %s", userFile.getAbsolutePath());
-                        }
-                    });
-                }
-            }
-        }
-
-        if (realmImported.get()) {
-            // Import authorization and initialize service accounts last, as they require users already in DB
-            KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-
-                @Override
-                public void runExportImportTask(KeycloakSession session) {
-                    session.getContext().setRealm(session.realms().getRealmByName(realmName));
-                    RealmManager realmManager = new RealmManager(session);
-                    realmManager.setupClientServiceAccountsAndAuthorizationOnImport(realmRep, false);
-                }
+        }.runTask(factory);
+    }
 
-            });
+    private void importUsers(final String realmName, File[] userFiles, boolean federated) {
+        for (final File userFile : userFiles) {
+            try (InputStream fis = parseFile(userFile)) {
+                new ExportImportSessionTask() {
+                    @Override
+                    protected void runExportImportTask(KeycloakSession session) throws IOException {
+                        session.getContext().setRealm(session.realms().getRealmByName(realmName));
+                        ImportUtils.importUsersFromStream(session, realmName, JsonSerialization.mapper, fis, federated, new DefaultExportImportManager.UserBatcher());
+                        logger.infof("Imported %susers from %s", federated?"federated ":"", userFile.getAbsolutePath());
+                    }
+                }.runTask(factory, Mode.BATCHED);
+            } catch (IOException e) {
+                throw new RuntimeException("Error during import: " + e.getMessage(), e);
+            }
         }
     }
 
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java b/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java
index 2f664e0e8e81..2325046eb629 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java
@@ -28,6 +28,7 @@
 import org.keycloak.provider.ProviderConfigurationBuilder;
 
 import java.util.List;
+import java.util.Map;
 
 import static org.keycloak.exportimport.ExportImportConfig.DEFAULT_STRATEGY;
 
@@ -45,10 +46,10 @@ public class DirImportProviderFactory implements ImportProviderFactory {
     private Config.Scope config;
 
     @Override
-    public ImportProvider create(KeycloakSession session) {
+    public ImportProvider create(KeycloakSession session, Map<String, String> overrides) {
         Strategy strategy = Enum.valueOf(Strategy.class, System.getProperty(ExportImportConfig.STRATEGY, config.get(STRATEGY, DEFAULT_STRATEGY.toString())));
         String realmName = System.getProperty(ExportImportConfig.REALM_NAME, config.get(REALM_NAME));
-        String dir = System.getProperty(ExportImportConfig.DIR, config.get(DIR));
+        String dir = overrides.getOrDefault(ExportImportConfig.DIR, System.getProperty(ExportImportConfig.DIR, config.get(DIR)));
         return new DirImportProvider(session.getKeycloakSessionFactory(), strategy)
                 .withDir(dir)
                 .withRealmName(realmName);
@@ -73,6 +74,7 @@ public String getId() {
         return PROVIDER_ID;
     }
 
+    @Override
     public List<ProviderConfigProperty> getConfigMetadata() {
         return ProviderConfigurationBuilder.create()
                 .property()
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java
index 6ad575fe661e..aaa70bbf30e5 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java
@@ -19,6 +19,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
+
 import org.jboss.logging.Logger;
 import org.keycloak.exportimport.ExportProvider;
 import org.keycloak.exportimport.util.ExportImportSessionTask;
@@ -26,7 +27,6 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.services.util.ObjectMapperResolver;
@@ -60,41 +60,35 @@ public SingleFileExportProvider withFile(File file) {
 
     @Override
     public void exportModel() {
-        if (realmName != null) {
-            ServicesLogger.LOGGER.realmExportRequested(realmName);
-            exportRealm(realmName);
-        } else {
-            ServicesLogger.LOGGER.fullModelExportRequested();
-            logger.infof("Exporting model into file %s", this.file.getAbsolutePath());
-            KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-
-                @Override
-                protected void runExportImportTask(KeycloakSession session) throws IOException {
+
+        new ExportImportSessionTask() {
+
+            @Override
+            protected void runExportImportTask(KeycloakSession session) throws IOException {
+                if (realmName != null) {
+                    ServicesLogger.LOGGER.realmExportRequested(realmName);
+                    exportRealm(session, realmName);
+                } else {
+                    ServicesLogger.LOGGER.fullModelExportRequested();
+                    logger.infof("Exporting model into file %s", file.getAbsolutePath());
                     Stream<RealmRepresentation> realms = session.realms().getRealmsStream()
                             .peek(realm -> session.getContext().setRealm(realm))
                             .map(realm -> ExportUtils.exportRealm(session, realm, true, true));
 
                     writeToFile(realms);
                 }
-            });
-        }
+            }
+        }.runTask(factory);
         ServicesLogger.LOGGER.exportSuccess();
     }
 
-    private void exportRealm(final String realmName) {
+    private void exportRealm(KeycloakSession session, final String realmName) throws IOException {
         logger.infof("Exporting realm '%s' into file %s", realmName, this.file.getAbsolutePath());
-        KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-
-            @Override
-            protected void runExportImportTask(KeycloakSession session) throws IOException {
-                RealmModel realm = session.realms().getRealmByName(realmName);
-                Objects.requireNonNull(realm, "realm not found by realm name '" + realmName + "'");
-                session.getContext().setRealm(realm);
-                RealmRepresentation realmRep = ExportUtils.exportRealm(session, realm, true, true);
-                writeToFile(realmRep);
-            }
-
-        });
+        RealmModel realm = session.realms().getRealmByName(realmName);
+        Objects.requireNonNull(realm, "realm not found by realm name '" + realmName + "'");
+        session.getContext().setRealm(realm);
+        RealmRepresentation realmRep = ExportUtils.exportRealm(session, realm, true, true);
+        writeToFile(realmRep);
     }
 
     @Override
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java
index 5409635e5012..71d335dd3b74 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java
@@ -25,7 +25,6 @@
 import org.keycloak.exportimport.util.ImportUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.util.JsonSerialization;
 
@@ -54,18 +53,19 @@ public SingleFileImportProvider(KeycloakSessionFactory factory, File file, Strat
         this.strategy = strategy;
     }
 
+    @Override
     public void importModel() throws IOException {
         logger.infof("Full importing from file %s", this.file.getAbsolutePath());
         checkRealmReps();
 
-        KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
+        new ExportImportSessionTask() {
 
             @Override
             protected void runExportImportTask(KeycloakSession session) {
                 ImportUtils.importRealms(session, realmReps.values(), strategy);
             }
 
-        });
+        }.runTask(factory);
     }
 
     @Override
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java
index 79e7f45fe121..792cb8a92feb 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java
@@ -29,6 +29,7 @@
 
 import java.io.File;
 import java.util.List;
+import java.util.Map;
 
 import static org.keycloak.exportimport.ExportImportConfig.DEFAULT_STRATEGY;
 
@@ -47,9 +48,9 @@ public class SingleFileImportProviderFactory implements ImportProviderFactory {
     private Config.Scope config;
 
     @Override
-    public ImportProvider create(KeycloakSession session) {
+    public ImportProvider create(KeycloakSession session, Map<String, String> overrides) {
         Strategy strategy = Enum.valueOf(Strategy.class, System.getProperty(ExportImportConfig.STRATEGY, config.get(STRATEGY, DEFAULT_STRATEGY.toString())));
-        String fileName = System.getProperty(ExportImportConfig.FILE, config.get(FILE));
+        String fileName = overrides.getOrDefault(ExportImportConfig.FILE, System.getProperty(ExportImportConfig.FILE, config.get(FILE)));
         if (fileName == null) {
             throw new IllegalArgumentException("Property " + FILE + " needs to be provided!");
         }
@@ -75,6 +76,7 @@ public String getId() {
         return PROVIDER_ID;
     }
 
+    @Override
     public List<ProviderConfigProperty> getConfigMetadata() {
         return ProviderConfigurationBuilder.create()
                 .property()
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/util/ExportImportSessionTask.java b/model/storage-services/src/main/java/org/keycloak/exportimport/util/ExportImportSessionTask.java
index 0415d667f580..609e3bf208af 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/util/ExportImportSessionTask.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/util/ExportImportSessionTask.java
@@ -17,30 +17,54 @@
 
 package org.keycloak.exportimport.util;
 
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionTask;
-
 import java.io.IOException;
 
+import org.keycloak.connections.jpa.support.EntityManagers;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.utils.KeycloakSessionUtil;
+
 /**
  * Just to wrap {@link IOException}
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public abstract class ExportImportSessionTask implements KeycloakSessionTask {
-
-    @Override
-    public void run(KeycloakSession session) {
-        try {
-            runExportImportTask(session);
-        } catch (IOException ioe) {
-            throw new RuntimeException("Error during export/import: " + ioe.getMessage(), ioe);
+public abstract class ExportImportSessionTask {
+
+    public enum Mode {
+        BATCHED, // turn on batched optimizations - good for read-only and bulk inserts, and flush / clear when done
+        NORMAL
+    }
+
+    public void runTask(KeycloakSessionFactory factory) {
+        runTask(factory, Mode.NORMAL);
+    }
+
+    public void runTask(KeycloakSessionFactory factory, Mode mode) {
+        boolean useExistingSession = ExportImportConfig.isSingleTransaction();
+        KeycloakSession existing = KeycloakSessionUtil.getKeycloakSession();
+        if (useExistingSession && existing != null && existing.getTransactionManager().isActive()) {
+            run(mode, existing);
+        } else {
+            KeycloakModelUtils.runJobInTransaction(factory, session -> this.run(mode, session));
         }
     }
 
-    @Override
-    public boolean useExistingSession() {
-        return true;
+    private void run(Mode mode, KeycloakSession session) {
+        Runnable task = () -> {
+            try {
+                runExportImportTask(session);
+            } catch (IOException ioe) {
+                throw new RuntimeException("Error during export/import: " + ioe.getMessage(), ioe);
+            }
+        };
+        if (mode == Mode.BATCHED) {
+            EntityManagers.runInBatch(session, task, true);
+        } else {
+            task.run();
+        }
     }
 
     protected abstract void runExportImportTask(KeycloakSession session) throws IOException;
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java b/model/storage-services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
index 32a6227bf86a..7a4a201b5887 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
@@ -41,6 +41,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Consumer;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -55,7 +56,7 @@ public static void importRealms(KeycloakSession session, Collection<RealmReprese
         // Import admin realm first
         for (RealmRepresentation realm : realms) {
             if (Config.getAdminRealm().equals(realm.getRealm())) {
-                if (importRealm(session, realm, strategy, false)) {
+                if (importRealm(session, realm, strategy, () -> {})) {
                     masterImported = true;
                 }
             }
@@ -63,7 +64,7 @@ public static void importRealms(KeycloakSession session, Collection<RealmReprese
 
         for (RealmRepresentation realm : realms) {
             if (!Config.getAdminRealm().equals(realm.getRealm())) {
-                importRealm(session, realm, strategy, false);
+                importRealm(session, realm, strategy, () -> {});
             }
         }
 
@@ -86,8 +87,23 @@ public static void importRealms(KeycloakSession session, Collection<RealmReprese
      * @param strategy specifies whether to overwrite or ignore existing realm or user entries
      * @param skipUserDependent If true, then import of any models, which needs users already imported in DB, will be skipped. For example authorization
      * @return newly imported realm (or existing realm if ignoreExisting is true and realm of this name already exists)
+     * @deprecated
      */
+    @Deprecated
     public static boolean importRealm(KeycloakSession session, RealmRepresentation rep, Strategy strategy, boolean skipUserDependent) {
+        return importRealm(session, rep, strategy, skipUserDependent ? null : () -> {});
+    }
+
+    /**
+     * Fully import realm from representation, save it to model and return model of newly created realm
+     *
+     * @param session
+     * @param rep
+     * @param strategy specifies whether to overwrite or ignore existing realm or user entries
+     * @param userImport use null to indicate additional users will not be imported
+     * @return newly imported realm (or existing realm if ignoreExisting is true and realm of this name already exists)
+     */
+    public static boolean importRealm(KeycloakSession session, RealmRepresentation rep, Strategy strategy, Runnable userImport) {
         String realmName = rep.getRealm();
         RealmProvider model = session.realms();
         RealmModel realm = model.getRealmByName(realmName);
@@ -110,27 +126,13 @@ public static boolean importRealm(KeycloakSession session, RealmRepresentation r
         }
 
         RealmManager realmManager = new RealmManager(session);
-        realmManager.importRealm(rep, skipUserDependent);
+        realmManager.importRealm(rep, userImport);
 
         if (System.getProperty(ExportImportConfig.ACTION) != null) {
             logger.infof("Realm '%s' imported", realmName);
         }
-        
-        return true;
-    }
 
-    /**
-     * Fully import realm (or more realms from particular stream)
-     *
-     * @param session
-     * @param mapper
-     * @param is
-     * @param strategy
-     * @throws IOException
-     */
-    public static void importFromStream(KeycloakSession session, ObjectMapper mapper, InputStream is, Strategy strategy) throws IOException {
-        Map<String, RealmRepresentation> realmReps = getRealmsFromStream(mapper, is);
-        importRealms(session, realmReps.values(), strategy);
+        return true;
     }
 
     public static Map<String, RealmRepresentation> getRealmsFromStream(ObjectMapper mapper, InputStream is) throws IOException {
@@ -175,53 +177,11 @@ public static Map<String, RealmRepresentation> getRealmsFromStream(ObjectMapper
 
 
     // Assuming that it's invoked inside transaction
-    public static void importUsersFromStream(KeycloakSession session, String realmName, ObjectMapper mapper, InputStream is) throws IOException {
+    public static void importUsersFromStream(KeycloakSession session, String realmName, ObjectMapper mapper, InputStream is, boolean federated, Consumer<KeycloakSession> onUserCreated) throws IOException {
         RealmProvider model = session.realms();
         JsonFactory factory = mapper.getJsonFactory();
-        JsonParser parser = factory.createJsonParser(is);
-        try {
-            parser.nextToken();
-
-            while (parser.nextToken() == JsonToken.FIELD_NAME) {
-                if ("realm".equals(parser.getText())) {
-                    parser.nextToken();
-                    String currRealmName = parser.getText();
-                    if (!currRealmName.equals(realmName)) {
-                        throw new IllegalStateException("Trying to import users into invalid realm. Realm name: " + realmName + ", Expected realm name: " + currRealmName);
-                    }
-                } else if ("users".equals(parser.getText())) {
-                    parser.nextToken();
-
-                    if (parser.getCurrentToken() == JsonToken.START_ARRAY) {
-                        parser.nextToken();
-                    }
-
-                    // TODO: support for more transactions per single users file (if needed)
-                    List<UserRepresentation> userReps = new ArrayList<UserRepresentation>();
-                    while (parser.getCurrentToken() == JsonToken.START_OBJECT) {
-                        UserRepresentation user = parser.readValueAs(UserRepresentation.class);
-                        userReps.add(user);
-                        parser.nextToken();
-                    }
-
-                    importUsers(session, model, realmName, userReps);
-
-                    if (parser.getCurrentToken() == JsonToken.END_ARRAY) {
-                        parser.nextToken();
-                    }
-                }
-            }
-        } finally {
-            parser.close();
-        }
-    }
-
-    // Assuming that it's invoked inside transaction
-    public static void importFederatedUsersFromStream(KeycloakSession session, String realmName, ObjectMapper mapper, InputStream is) throws IOException {
-        RealmProvider model = session.realms();
-        JsonFactory factory = mapper.getJsonFactory();
-        JsonParser parser = factory.createJsonParser(is);
-        try {
+        RealmModel realm = model.getRealmByName(realmName);
+        try (JsonParser parser = factory.createJsonParser(is)) {
             parser.nextToken();
 
             while (parser.nextToken() == JsonToken.FIELD_NAME) {
@@ -231,44 +191,29 @@ public static void importFederatedUsersFromStream(KeycloakSession session, Strin
                     if (!currRealmName.equals(realmName)) {
                         throw new IllegalStateException("Trying to import users into invalid realm. Realm name: " + realmName + ", Expected realm name: " + currRealmName);
                     }
-                } else if ("federatedUsers".equals(parser.getText())) {
+                } else if ((federated?"federatedUsers":"users").equals(parser.getText())) {
                     parser.nextToken();
 
                     if (parser.getCurrentToken() == JsonToken.START_ARRAY) {
                         parser.nextToken();
                     }
 
-                    // TODO: support for more transactions per single users file (if needed)
-                    List<UserRepresentation> userReps = new ArrayList<UserRepresentation>();
                     while (parser.getCurrentToken() == JsonToken.START_OBJECT) {
                         UserRepresentation user = parser.readValueAs(UserRepresentation.class);
-                        userReps.add(user);
+                        if (federated) {
+                            DefaultExportImportManager.importFederatedUser(session, realm, user);
+                        } else {
+                            RepresentationToModel.createUser(session, realm, user);
+                        }
+                        onUserCreated.accept(session);
                         parser.nextToken();
                     }
 
-                    importFederatedUsers(session, model, realmName, userReps);
-
                     if (parser.getCurrentToken() == JsonToken.END_ARRAY) {
                         parser.nextToken();
                     }
                 }
             }
-        } finally {
-            parser.close();
-        }
-    }
-
-    private static void importUsers(KeycloakSession session, RealmProvider model, String realmName, List<UserRepresentation> userReps) {
-        RealmModel realm = model.getRealmByName(realmName);
-        for (UserRepresentation user : userReps) {
-            RepresentationToModel.createUser(session, realm, user);
-        }
-    }
-
-    private static void importFederatedUsers(KeycloakSession session, RealmProvider model, String realmName, List<UserRepresentation> userReps) {
-        RealmModel realm = model.getRealmByName(realmName);
-        for (UserRepresentation user : userReps) {
-            DefaultExportImportManager.importFederatedUser(session, realm, user);
         }
     }
 
diff --git a/model/storage-services/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java b/model/storage-services/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java
index 8802d3ac556f..7ec33ac62e88 100755
--- a/model/storage-services/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java
@@ -18,21 +18,25 @@
 package org.keycloak.exportimport.util;
 
 import org.jboss.logging.Logger;
+import org.keycloak.connections.jpa.support.EntityManagers;
 import org.keycloak.exportimport.ExportProvider;
 import org.keycloak.exportimport.UsersExportStrategy;
+import org.keycloak.exportimport.util.ExportImportSessionTask.Mode;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.ServicesLogger;
+import org.keycloak.storage.UserStoragePrivateUtil;
 import org.keycloak.storage.UserStorageUtil;
 
 import java.io.IOException;
-import java.util.Collections;
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -44,7 +48,7 @@ public abstract class MultipleStepsExportProvider<T extends MultipleStepsExportP
     protected final KeycloakSessionFactory factory;
 
     private String realmId;
-    private int usersPerFile;
+    private int usersPerFile = 50;
     private UsersExportStrategy usersExportStrategy;
 
     public MultipleStepsExportProvider(KeycloakSessionFactory factory) {
@@ -55,11 +59,17 @@ public MultipleStepsExportProvider(KeycloakSessionFactory factory) {
     public void exportModel() {
         if (realmId != null) {
             ServicesLogger.LOGGER.realmExportRequested(realmId);
-            exportRealm(realmId);
+            exportRealmImpl(realmId);
         } else {
             ServicesLogger.LOGGER.fullModelExportRequested();
-            List<RealmModel> realms = KeycloakModelUtils.runJobInTransactionWithResult(factory, session -> session.realms().getRealmsStream().collect(Collectors.toList()));
-            for (RealmModel realm : realms) {
+            List<RealmModel>[] realms = new List[1];
+            new ExportImportSessionTask() {
+                @Override
+                protected void runExportImportTask(KeycloakSession session) throws IOException {
+                    realms[0] = session.realms().getRealmsStream().collect(Collectors.toList());
+                }
+            }.runTask(factory);
+            for (RealmModel realm : realms[0]) {
                 exportRealmImpl(realm.getName());
             }
         }
@@ -72,6 +82,9 @@ public T withRealmName(String realmName) {
     }
 
     public T withUsersPerFile(int usersPerFile) {
+        if (usersPerFile < 1) {
+            throw new IllegalArgumentException("usersPerFile must be greater than 0");
+        }
         this.usersPerFile = usersPerFile;
         return (T) this;
     }
@@ -81,16 +94,10 @@ public T withUsersExportStrategy(UsersExportStrategy usersExportStrategy) {
         return (T) this;
     }
 
-    public void exportRealm(String realmName) {
-        exportRealmImpl(realmName);
-    }
-
     protected void exportRealmImpl(final String realmName) {
-        final UsersHolder usersHolder = new UsersHolder();
         final boolean exportUsersIntoRealmFile = usersExportStrategy == UsersExportStrategy.REALM_FILE;
-        FederatedUsersHolder federatedUsersHolder = new FederatedUsersHolder();
 
-        KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
+        new ExportImportSessionTask() {
 
             @Override
             protected void runExportImportTask(KeycloakSession session) throws IOException {
@@ -101,86 +108,58 @@ protected void runExportImportTask(KeycloakSession session) throws IOException {
                 logger.info("Realm '" + realmName + "' - data exported");
 
                 // Count total number of users
-                if (!exportUsersIntoRealmFile) {
-                    usersHolder.totalCount = session.users().getUsersCount(realm, true);
+                if (usersExportStrategy != UsersExportStrategy.SKIP && !exportUsersIntoRealmFile) {
+                    Stream<UserModel> users = UserStoragePrivateUtil.userLocalStorage(session).searchForUserStream(realm, Map.of());
+                    exportUsers(realmName, session, realm, users, false);
+
                     if (UserStorageUtil.userFederatedStorage(session) != null) {
-                        federatedUsersHolder.totalCount = UserStorageUtil.userFederatedStorage(session).getStoredUsersCount(realm);
-                    } else {
-                        federatedUsersHolder.totalCount = 0;
+                        Stream<String> federatedUsers = UserStorageUtil.userFederatedStorage(session).getStoredUsersStream(realm, null, null);
+                        exportUsers(realmName, session, realm, federatedUsers, true);
                     }
                 }
             }
 
-        });
+            private <U> void exportUsers(final String realmName, KeycloakSession session, RealmModel realm, Stream<U> users, boolean federated)
+                    throws IOException {
+                final UsersHolder usersHolder = new UsersHolder();
 
-        if (usersExportStrategy != UsersExportStrategy.SKIP && !exportUsersIntoRealmFile) {
-            // We need to export users now
-            usersHolder.currentPageStart = 0;
+                final Integer countPerPage = (usersExportStrategy == UsersExportStrategy.SAME_FILE) ? null : usersPerFile;
 
-            // usersExportStrategy==SAME_FILE  means exporting all users into single file (but separate to realm)
-            final int countPerPage = (usersExportStrategy == UsersExportStrategy.SAME_FILE) ? usersHolder.totalCount : usersPerFile;
+                List<U> usersBatch = new ArrayList<U>();
 
-            while (usersHolder.currentPageStart < usersHolder.totalCount) {
-                if (usersHolder.currentPageStart + countPerPage < usersHolder.totalCount) {
-                    usersHolder.currentPageEnd = usersHolder.currentPageStart + countPerPage;
-                } else {
-                    usersHolder.currentPageEnd = usersHolder.totalCount;
-                }
+                users.forEachOrdered(user -> {
+                    usersBatch.add(user);
 
-                KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-
-                    @Override
-                    protected void runExportImportTask(KeycloakSession session) throws IOException {
-                        RealmModel realm = session.realms().getRealmByName(realmName);
-                        session.getContext().setRealm(realm);
-                        usersHolder.users = session.users()
-                                .searchForUserStream(realm, Collections.emptyMap(), usersHolder.currentPageStart, usersHolder.currentPageEnd - usersHolder.currentPageStart)
-                                .collect(Collectors.toList());
-
-                        writeUsers(realmName + "-users-" + (usersHolder.currentPageStart / countPerPage) + ".json", session, realm, usersHolder.users);
-
-                        logger.info("Users " + usersHolder.currentPageStart + "-" + (usersHolder.currentPageEnd -1) + " exported");
+                    if (countPerPage != null && usersBatch.size() >= countPerPage) {
+                        try {
+                            flushUsers(realmName, session, realm, usersHolder, countPerPage, usersBatch, federated);
+                        } catch (IOException e) {
+                            throw new RuntimeException("Error during export/import: " + e.getMessage(), e);
+                        }
                     }
-
                 });
 
-                usersHolder.currentPageStart = usersHolder.currentPageEnd;
+                if (!usersBatch.isEmpty()) {
+                    flushUsers(realmName, session, realm, usersHolder, countPerPage, usersBatch, federated);
+                }
             }
-        }
-        if (usersExportStrategy != UsersExportStrategy.SKIP && !exportUsersIntoRealmFile) {
-            // We need to export users now
-            federatedUsersHolder.currentPageStart = 0;
 
-            // usersExportStrategy==SAME_FILE  means exporting all users into single file (but separate to realm)
-            final int countPerPage = (usersExportStrategy == UsersExportStrategy.SAME_FILE) ? federatedUsersHolder.totalCount : usersPerFile;
-
-            while (federatedUsersHolder.currentPageStart < federatedUsersHolder.totalCount) {
-                if (federatedUsersHolder.currentPageStart + countPerPage < federatedUsersHolder.totalCount) {
-                    federatedUsersHolder.currentPageEnd = federatedUsersHolder.currentPageStart + countPerPage;
+            private <U> void flushUsers(final String realmName, KeycloakSession session, RealmModel realm,
+                    final UsersHolder usersHolder, final Integer countPerPage, List<U> usersBatch, boolean federated)
+                    throws IOException {
+                if (federated) {
+                    writeFederatedUsers(realmName + "-federated-users-" + usersHolder.file + ".json", session, realm, (List<String>) usersBatch);
                 } else {
-                    federatedUsersHolder.currentPageEnd = federatedUsersHolder.totalCount;
+                    writeUsers(realmName + "-users-" + usersHolder.file + ".json", session, realm, (List<UserModel>) usersBatch);
                 }
-
-                KeycloakModelUtils.runJobInTransaction(factory, new ExportImportSessionTask() {
-
-                    @Override
-                    protected void runExportImportTask(KeycloakSession session) throws IOException {
-                        RealmModel realm = session.realms().getRealmByName(realmName);
-                        session.getContext().setRealm(realm);
-                        federatedUsersHolder.users = UserStorageUtil.userFederatedStorage(session)
-                                .getStoredUsersStream(realm, federatedUsersHolder.currentPageStart, federatedUsersHolder.currentPageEnd - federatedUsersHolder.currentPageStart)
-                                .collect(Collectors.toList());
-
-                        writeFederatedUsers(realmName + "-federated-users-" + (federatedUsersHolder.currentPageStart / countPerPage) + ".json", session, realm, federatedUsersHolder.users);
-
-                        logger.info("Users " + federatedUsersHolder.currentPageStart + "-" + (federatedUsersHolder.currentPageEnd -1) + " exported");
-                    }
-
-                });
-
-                federatedUsersHolder.currentPageStart = federatedUsersHolder.currentPageEnd;
+                int start = countPerPage == null ? 0 : countPerPage * usersHolder.file;
+                logger.infof("%sUsers %s - %s exported", federated ? "Federated " : "", start, start + usersBatch.size() - 1);
+                usersHolder.file++;
+                usersBatch.clear();
+                EntityManagers.flush(session, true);
             }
-        }
+
+        }.runTask(factory, Mode.BATCHED);
     }
 
     protected abstract void writeRealm(String fileName, RealmRepresentation rep) throws IOException;
@@ -189,15 +168,6 @@ protected void runExportImportTask(KeycloakSession session) throws IOException {
     protected abstract void writeFederatedUsers(String fileName, KeycloakSession session, RealmModel realm, List<String> users) throws IOException;
 
     public static class UsersHolder {
-        List<UserModel> users;
-        int totalCount;
-        int currentPageStart;
-        int currentPageEnd;
-    }
-    public static class FederatedUsersHolder {
-        List<String> users;
-        int totalCount;
-        int currentPageStart;
-        int currentPageEnd;
+        int file;
     }
 }
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheRealmAdminProvider.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheRealmAdminProvider.java
new file mode 100644
index 000000000000..6f52ac508ed7
--- /dev/null
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheRealmAdminProvider.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.resources.admin;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
+import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+
+public class ClearCrlCacheRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider  {
+
+    @Override
+    public AdminRealmResourceProvider create(KeycloakSession session) {
+        return this;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "clear-crl-cache";
+    }
+
+    @Override
+    public Object getResource(KeycloakSession session, RealmModel realm, AdminPermissionEvaluator auth, AdminEventBuilder adminEvent) {
+        return new ClearCrlCacheResource(session, auth, adminEvent);
+    }
+}
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheResource.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheResource.java
new file mode 100644
index 000000000000..3757d54876ed
--- /dev/null
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearCrlCacheResource.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.resources.admin;
+
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.cache.CacheCrlProvider;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+
+import jakarta.ws.rs.POST;
+
+public class ClearCrlCacheResource {
+
+    protected final AdminPermissionEvaluator auth;
+    protected final RealmModel realm;
+    private final AdminEventBuilder adminEvent;
+
+    protected final KeycloakSession session;
+
+    public ClearCrlCacheResource(KeycloakSession session, AdminPermissionEvaluator auth, AdminEventBuilder adminEvent) {
+        this.session = session;
+        this.auth = auth;
+        this.realm = session.getContext().getRealm();
+        this.adminEvent = adminEvent;
+    }
+
+    /**
+     * Clear the crl cache (CRLs loaded for X509 authentication)
+     *
+     */
+    @POST
+    public void clearCrlCache() {
+        auth.realm().requireManageRealm();
+
+        CacheCrlProvider cache = session.getProvider(CacheCrlProvider.class);
+        if (cache != null) {
+            cache.clearCache();
+        }
+
+        adminEvent.operation(OperationType.ACTION).resourcePath(session.getContext().getUri()).success();
+    }
+}
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheRealmAdminProvider.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheRealmAdminProvider.java
index f4962d5f37e3..5a6b2b69251e 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheRealmAdminProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class ClearKeysCacheRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider  {
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheResource.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheResource.java
index d72c3e82f7d5..8e64be70242f 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheResource.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearKeysCacheResource.java
@@ -21,7 +21,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.cache.CachePublicKeyProvider;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.core.Context;
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheRealmAdminProvider.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheRealmAdminProvider.java
index 0b3c06e238d9..944025a46d94 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheRealmAdminProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class ClearRealmCacheRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider {
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheResource.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheResource.java
index bd1d2bfd1193..8538bc7dc5ee 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheResource.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearRealmCacheResource.java
@@ -20,7 +20,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.cache.CacheRealmProvider;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.POST;
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheRealmAdminProvider.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheRealmAdminProvider.java
index a078594a3796..15625c6c0f10 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheRealmAdminProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class ClearUserCacheRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider {
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheResource.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheResource.java
index ec4925497d44..2dff198231bb 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheResource.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/ClearUserCacheResource.java
@@ -20,7 +20,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.cache.UserCache;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.POST;
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderRealmAdminProvider.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderRealmAdminProvider.java
index f0750c15f66e..70af9b41e412 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderRealmAdminProvider.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderRealmAdminProvider.java
@@ -23,7 +23,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class UserStorageProviderRealmAdminProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider {
 
diff --git a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderResource.java b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderResource.java
index 3b6f9a91652a..5418ee8e211f 100644
--- a/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderResource.java
+++ b/model/storage-services/src/main/java/org/keycloak/services/resources/admin/UserStorageProviderResource.java
@@ -28,7 +28,7 @@
 import org.keycloak.storage.managers.UserStorageSyncManager;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.managers.LDAPServerCapabilitiesManager;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.UserStorageProviderModel;
 import org.keycloak.storage.ldap.LDAPStorageProvider;
diff --git a/model/storage-services/src/main/resources/META-INF/services/org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory b/model/storage-services/src/main/resources/META-INF/services/org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory
index 9da72501be0b..5bd9b0d23f4e 100644
--- a/model/storage-services/src/main/resources/META-INF/services/org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory
+++ b/model/storage-services/src/main/resources/META-INF/services/org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory
@@ -19,3 +19,4 @@ org.keycloak.services.resources.admin.UserStorageProviderRealmAdminProvider
 org.keycloak.services.resources.admin.ClearUserCacheRealmAdminProvider
 org.keycloak.services.resources.admin.ClearRealmCacheRealmAdminProvider
 org.keycloak.services.resources.admin.ClearKeysCacheRealmAdminProvider
+org.keycloak.services.resources.admin.ClearCrlCacheRealmAdminProvider
diff --git a/model/storage/src/main/java/org/keycloak/credential/UserCredentialManager.java b/model/storage/src/main/java/org/keycloak/credential/UserCredentialManager.java
index ffa5d354862a..af59fce16d9e 100644
--- a/model/storage/src/main/java/org/keycloak/credential/UserCredentialManager.java
+++ b/model/storage/src/main/java/org/keycloak/credential/UserCredentialManager.java
@@ -63,9 +63,8 @@ public boolean isValid(List<CredentialInput> inputs) {
 
         List<CredentialInput> toValidate = new LinkedList<>(inputs);
 
-        String providerId = user.getFederationLink();
-        if (providerId != null) {
-            UserStorageProviderModel model = getStorageProviderModel(realm, providerId);
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
             if (model == null || !model.isEnabled()) return false;
 
             CredentialInputValidator validator = getStorageProviderInstance(model, CredentialInputValidator.class);
@@ -83,10 +82,9 @@ public boolean isValid(List<CredentialInput> inputs) {
     @Override
     public boolean updateCredential(CredentialInput input) {
         if (!StorageId.isLocalStorage(user.getId())) throwExceptionIfInvalidUser(user);
-        String providerId = user.getFederationLink();
 
-        if (providerId != null) {
-            UserStorageProviderModel model = getStorageProviderModel(realm, providerId);
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
             if (model == null || !model.isEnabled()) return false;
 
             CredentialInputUpdater updater = getStorageProviderInstance(model, CredentialInputUpdater.class);
@@ -128,6 +126,25 @@ public Stream<CredentialModel> getStoredCredentialsStream() {
         return getStoreForUser(user).getStoredCredentialsStream(realm, user);
     }
 
+    @Override
+    public Stream<CredentialModel> getFederatedCredentialsStream() {
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
+
+            if (model == null || !model.isEnabled()) {
+                return Stream.empty();
+            }
+
+            CredentialInputUpdater credentialProvider = getStorageProviderInstance(model, CredentialInputUpdater.class);
+
+            if (credentialProvider != null) {
+                return credentialProvider.getCredentials(realm, user);
+            }
+        }
+
+        return Stream.empty();
+    }
+
     @Override
     public Stream<CredentialModel> getStoredCredentialsByTypeStream(String type) {
         return getStoreForUser(user).getStoredCredentialsByTypeStream(realm, user, type);
@@ -155,9 +172,8 @@ public void updateCredentialLabel(String credentialId, String userLabel) {
     @Override
     public void disableCredentialType(String credentialType) {
         if (!StorageId.isLocalStorage(user.getId())) throwExceptionIfInvalidUser(user);
-        String providerId = user.getFederationLink();
-        if (providerId != null) {
-            UserStorageProviderModel model = getStorageProviderModel(realm, providerId);
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
             if (model == null || !model.isEnabled()) return;
 
             CredentialInputUpdater updater = getStorageProviderInstance(model, CredentialInputUpdater.class);
@@ -174,9 +190,8 @@ public void disableCredentialType(String credentialType) {
     @Override
     public Stream<String> getDisableableCredentialTypesStream() {
         Stream<String> types = Stream.empty();
-        String providerId = user.getFederationLink();
-        if (providerId != null) {
-            UserStorageProviderModel model = getStorageProviderModel(realm, providerId);
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
             if (model == null || !model.isEnabled()) return types;
 
             CredentialInputUpdater updater = getStorageProviderInstance(model, CredentialInputUpdater.class);
@@ -220,7 +235,7 @@ public CredentialModel createCredentialThroughProvider(CredentialModel model) {
         return session.getKeycloakSessionFactory()
                 .getProviderFactoriesStream(CredentialProvider.class)
                 .map(f -> session.getProvider(CredentialProvider.class, f.getId()))
-                .filter(provider -> Objects.equals(provider.getType(), model.getType()))
+                .filter(provider -> provider.supportsCredentialType(model))
                 .map(cp -> cp.createCredential(realm, user, cp.getCredentialFromModel(model)))
                 .findFirst()
                 .orElse(null);
@@ -233,9 +248,8 @@ private enum UserStorageCredentialConfigured {
     }
 
     private UserStorageCredentialConfigured isConfiguredThroughUserStorage(RealmModel realm, UserModel user, String type) {
-        String providerId = user.getFederationLink();
-        if (providerId != null) {
-            UserStorageProviderModel model = getStorageProviderModel(realm, providerId);
+        if (user.isFederated()) {
+            UserStorageProviderModel model = getStorageProviderModel(realm, user.getFederationLink());
             if (model == null || !model.isEnabled()) return UserStorageCredentialConfigured.USER_STORAGE_DISABLED;
 
             CredentialInputValidator validator = getStorageProviderInstance(model, CredentialInputValidator.class);
diff --git a/model/storage/src/main/java/org/keycloak/storage/AbstractStorageManager.java b/model/storage/src/main/java/org/keycloak/storage/AbstractStorageManager.java
index 1aa6061322dc..92ebbf56cf4d 100644
--- a/model/storage/src/main/java/org/keycloak/storage/AbstractStorageManager.java
+++ b/model/storage/src/main/java/org/keycloak/storage/AbstractStorageManager.java
@@ -182,7 +182,6 @@ protected StorageProviderModelType getStorageProviderModel(RealmModel realm, Str
         if (componentModel == null) {
             return null;
         }
-
         return toStorageProviderModelTypeFunction.apply(componentModel);
     }
 
diff --git a/model/storage/src/main/java/org/keycloak/storage/CacheableStorageProviderModel.java b/model/storage/src/main/java/org/keycloak/storage/CacheableStorageProviderModel.java
index 5372d99be6b6..c2f9dbdfa798 100644
--- a/model/storage/src/main/java/org/keycloak/storage/CacheableStorageProviderModel.java
+++ b/model/storage/src/main/java/org/keycloak/storage/CacheableStorageProviderModel.java
@@ -219,16 +219,13 @@ public boolean shouldInvalidate(CachedObject cached) {
 
     public static long dailyTimeout(int hour, int minute) {
         Calendar cal = Calendar.getInstance();
-        Calendar cal2 = Calendar.getInstance();
         cal.setTimeInMillis(Time.currentTimeMillis());
-        cal2.setTimeInMillis(Time.currentTimeMillis());
-        cal2.set(Calendar.HOUR_OF_DAY, hour);
-        cal2.set(Calendar.MINUTE, minute);
-        if (cal2.getTimeInMillis() < cal.getTimeInMillis()) {
-            int add = (24 * 60 * 60 * 1000);
-            cal.add(Calendar.MILLISECOND, add);
-        } else {
-            cal = cal2;
+        cal.set(Calendar.HOUR_OF_DAY, hour);
+        cal.set(Calendar.MINUTE, minute);
+        cal.set(Calendar.SECOND, 0);
+        cal.set(Calendar.MILLISECOND, 0);
+        if (cal.getTimeInMillis() < Time.currentTimeMillis()) {
+            cal.add(Calendar.DAY_OF_YEAR, 1);
         }
         return cal.getTimeInMillis();
     }
@@ -238,6 +235,8 @@ public static long dailyEvictionBoundary(int hour, int minute) {
         cal.setTimeInMillis(Time.currentTimeMillis());
         cal.set(Calendar.HOUR_OF_DAY, hour);
         cal.set(Calendar.MINUTE, minute);
+        cal.set(Calendar.SECOND, 0);
+        cal.set(Calendar.MILLISECOND, 0);
         if (cal.getTimeInMillis() > Time.currentTimeMillis()) {
             // if daily evict for today hasn't happened yet set boundary
             // to yesterday's time of eviction
@@ -248,18 +247,18 @@ public static long dailyEvictionBoundary(int hour, int minute) {
 
     public static long weeklyTimeout(int day, int hour, int minute) {
         Calendar cal = Calendar.getInstance();
-        Calendar cal2 = Calendar.getInstance();
         cal.setTimeInMillis(Time.currentTimeMillis());
-        cal2.setTimeInMillis(Time.currentTimeMillis());
-        cal2.set(Calendar.HOUR_OF_DAY, hour);
-        cal2.set(Calendar.MINUTE, minute);
-        cal2.set(Calendar.DAY_OF_WEEK, day);
-        if (cal2.getTimeInMillis() < cal.getTimeInMillis()) {
+        cal.set(Calendar.HOUR_OF_DAY, hour);
+        cal.set(Calendar.MINUTE, minute);
+        cal.set(Calendar.DAY_OF_WEEK, day);
+        cal.set(Calendar.SECOND, 0);
+        cal.set(Calendar.MILLISECOND, 0);
+        if (cal.getTimeInMillis() < Time.currentTimeMillis()) {
             int add = (7 * 24 * 60 * 60 * 1000);
-            cal2.add(Calendar.MILLISECOND, add);
+            cal.add(Calendar.MILLISECOND, add);
         }
 
-        return cal2.getTimeInMillis();
+        return cal.getTimeInMillis();
     }
 
 
diff --git a/model/storage/src/main/java/org/keycloak/storage/UserStorageProvider.java b/model/storage/src/main/java/org/keycloak/storage/UserStorageProvider.java
index 2dd36d41d266..8b149a0eccae 100644
--- a/model/storage/src/main/java/org/keycloak/storage/UserStorageProvider.java
+++ b/model/storage/src/main/java/org/keycloak/storage/UserStorageProvider.java
@@ -34,7 +34,6 @@
  *     <li>{@link org.keycloak.storage.user.UserRegistrationProvider UserRegistrationProvider} - Provide methods for adding users. After implementing it is possible to store registered users in the storage.</li>
  *     <li>{@link org.keycloak.storage.user.UserBulkUpdateProvider UserBulkUpdateProvider} - After implementing it is possible to perform bulk operations on all users from storage (for example, addition of a role to all users).</li>
  *     <li>{@link org.keycloak.storage.user.ImportedUserValidation ImportedUserValidation} - Provider method for validating users within Keycloak local storage that are imported from the storage.</li>
- *     <li>{@link org.keycloak.storage.user.ImportSynchronization ImportSynchronization} - Provider methods for synchronization of the storage with Keycloak local storage. After implementing it is possible to sync users in the Admin console.</li>
  * </ul>
  *
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -49,8 +48,7 @@ public interface UserStorageProvider extends Provider {
      *
      * @param realm
      */
-    default
-    void preRemove(RealmModel realm) {
+    default void preRemove(RealmModel realm) {
 
     }
 
@@ -61,27 +59,24 @@ void preRemove(RealmModel realm) {
      * @param realm
      * @param group
      */
-    default
-    void preRemove(RealmModel realm, GroupModel group) {
+    default void preRemove(RealmModel realm, GroupModel group) {
 
     }
 
     /**
      * Callback when a role is removed.  Allows you to do things like remove a user
      * role mapping in your external store if appropriate
-
+     *
      * @param realm
      * @param role
      */
-    default
-    void preRemove(RealmModel realm, RoleModel role) {
+    default void preRemove(RealmModel realm, RoleModel role) {
 
     }
 
     /**
      * Optional type that can be used by implementations to
      * describe edit mode of user storage
-     *
      */
     enum EditMode {
         /**
@@ -90,12 +85,10 @@ enum EditMode {
         READ_ONLY,
         /**
          * user storage is writable
-         *
          */
         WRITABLE,
         /**
          * updates to user are stored locally and not synced with user storage.
-         *
          */
         UNSYNCED
     }
diff --git a/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderModel.java b/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderModel.java
index 2fa010dcb7cd..fa32e64cb960 100755
--- a/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderModel.java
+++ b/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderModel.java
@@ -33,6 +33,7 @@ public class UserStorageProviderModel extends CacheableStorageProviderModel {
     public static final String FULL_SYNC_PERIOD = "fullSyncPeriod";
     public static final String CHANGED_SYNC_PERIOD = "changedSyncPeriod";
     public static final String LAST_SYNC = "lastSync";
+    public static final String REMOVE_INVALID_USERS_ENABLED = "removeInvalidUsersEnabled";
 
     public UserStorageProviderModel() {
         setProviderType(UserStorageProvider.class.getName());
@@ -46,6 +47,7 @@ public UserStorageProviderModel(ComponentModel copy) {
     private transient Integer changedSyncPeriod;
     private transient Integer lastSync;
     private transient Boolean importEnabled;
+    private transient Boolean removeInvalidUsersEnabled;
 
     public boolean isImportEnabled() {
         if (importEnabled == null) {
@@ -57,7 +59,6 @@ public boolean isImportEnabled() {
             }
         }
         return importEnabled;
-
     }
 
     public void setImportEnabled(boolean flag) {
@@ -116,4 +117,16 @@ public void setLastSync(int lastSync) {
         this.lastSync = lastSync;
         getConfig().putSingle(LAST_SYNC, Integer.toString(lastSync));
     }
+
+    public boolean isRemoveInvalidUsersEnabled() {
+        if (removeInvalidUsersEnabled == null) {
+            String val = getConfig().getFirst(REMOVE_INVALID_USERS_ENABLED);
+            if (val == null) {
+                removeInvalidUsersEnabled = true;
+            } else {
+                removeInvalidUsersEnabled = Boolean.valueOf(val);
+            }
+        }
+        return removeInvalidUsersEnabled;
+    }
 }
diff --git a/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderSpi.java b/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderSpi.java
index 9517b7241b59..e510e2c9612b 100755
--- a/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderSpi.java
+++ b/model/storage/src/main/java/org/keycloak/storage/UserStorageProviderSpi.java
@@ -81,6 +81,8 @@ public Class<? extends ProviderFactory> getProviderFactoryClass() {
                 .name("evictionDay").type(ProviderConfigProperty.STRING_TYPE).add()
                 .property()
                 .name("cacheInvalidBefore").type(ProviderConfigProperty.STRING_TYPE).add()
+                .property()
+                .name("removeInvalidUsersEnabled").type(ProviderConfigProperty.BOOLEAN_TYPE).add()
                 .build();
         commonConfig = Collections.unmodifiableList(config);
     }
diff --git a/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProvider.java b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProvider.java
new file mode 100644
index 000000000000..5303e1c6fc54
--- /dev/null
+++ b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProvider.java
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration;
+
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+
+import org.keycloak.provider.Provider;
+
+/**
+ * A {@link Provider} to store server configuration to be shared between the Keycloak instances.
+ * <p>
+ * This provider is a key-value store where both keys and values are {@link String}.
+ */
+public interface ServerConfigStorageProvider extends Provider {
+
+    /**
+     * Returns the value to which the specified {@code key}.
+     *
+     * @param key The {@code key} whose associated value is to be returned.
+     * @return The value from the specified {@code key}.
+     * @throws NullPointerException if the specified {@code key} is {@code null}.
+     */
+    Optional<String> find(String key);
+
+    /**
+     * Stores the specified {@code value} with the specified {@code key}.
+     * <p>
+     * If the {@code key} exists, its value is updated.
+     *
+     * @param key   The {@code key} with which the specified {@code value} is to be stored.
+     * @param value The {@code value} to be associated with the specified {@code key}.
+     * @throws NullPointerException if the specified {@code key} or {@code value} is {@code null}.
+     */
+    void store(String key, String value);
+
+    /**
+     * Removes the {@code value} specified by the {@code key}.
+     *
+     * @param key The {@code key} whose value is to be removed.
+     * @throws NullPointerException if the specified {@code key} is {@code null}.
+     */
+    void remove(String key);
+
+    /**
+     * Returns the value to which the specified {@code key} or, if not found, stores the value returned by the
+     * {@code valueGenerator}.
+     *
+     * @param key            The {@code key} whose associated value is to be returned or stored.
+     * @param valueGenerator The {@link Supplier} to generate the value if it is not found.
+     * @return The {value stored by the {@code key}, or the value generated by the {@link Supplier}.
+     * @throws NullPointerException if the specified {@code key}, {@code valueGenerator} or {@link Supplier} return
+     *                              value is {@code null}.
+     */
+    String loadOrCreate(String key, Supplier<String> valueGenerator);
+
+    /**
+     * Same as {@code loadOrCreate(key, () -> value)}.
+     *
+     * @see #loadOrCreate(String, Supplier)
+     */
+    default String loadOrCreate(String key, String value) {
+        return loadOrCreate(key, () -> value);
+    }
+
+    /**
+     * Same as {@code replace(key, Objects.requireNonNull(expected)::equals, () -> Objects.requireNonNull(newValue))}.
+     *
+     * @see #replace(String, Predicate, Supplier)
+     */
+    default boolean replace(String key, String expected, String newValue) {
+        return replace(key, Objects.requireNonNull(expected)::equals, () -> Objects.requireNonNull(newValue));
+    }
+
+    /**
+     * Replaces the value specified by {@code key} if the {@link Predicate} return a {@code true} value.
+     *
+     * @param key              The {@code key} whose associated value is to be replaced.
+     * @param replacePredicate The {@link Predicate} to signal if the value should be replaced.
+     * @param valueGenerator   The {@link Supplier} to generate the value if it is should be replaced.
+     * @return {@code true} if the value is replaced, and {@code false} otherwise.
+     */
+    boolean replace(String key, Predicate<String> replacePredicate, Supplier<String> valueGenerator);
+
+}
diff --git a/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProviderFactory.java b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProviderFactory.java
new file mode 100644
index 000000000000..e8a907fbc446
--- /dev/null
+++ b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigStorageProviderFactory.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * A {@link ProviderFactory} to create instances of {@link ServerConfigStorageProvider}
+ */
+public interface ServerConfigStorageProviderFactory extends ProviderFactory<ServerConfigStorageProvider> {
+}
diff --git a/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigurationStorageProviderSpi.java b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigurationStorageProviderSpi.java
new file mode 100644
index 000000000000..1b7af725cdf1
--- /dev/null
+++ b/model/storage/src/main/java/org/keycloak/storage/configuration/ServerConfigurationStorageProviderSpi.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.configuration;
+
+import org.keycloak.provider.Spi;
+
+/**
+ * The {@link Spi} implementation of {@link ServerConfigStorageProvider}.
+ */
+public class ServerConfigurationStorageProviderSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "serverConfig";
+    }
+
+    @Override
+    public Class<ServerConfigStorageProvider> getProviderClass() {
+        return ServerConfigStorageProvider.class;
+    }
+
+    @Override
+    public Class<ServerConfigStorageProviderFactory> getProviderFactoryClass() {
+        return ServerConfigStorageProviderFactory.class;
+    }
+}
diff --git a/model/storage/src/main/java/org/keycloak/storage/user/ImportSynchronization.java b/model/storage/src/main/java/org/keycloak/storage/user/ImportSynchronization.java
index 0206d3cb2ae2..f322aabdea23 100644
--- a/model/storage/src/main/java/org/keycloak/storage/user/ImportSynchronization.java
+++ b/model/storage/src/main/java/org/keycloak/storage/user/ImportSynchronization.java
@@ -22,15 +22,16 @@
 import java.util.Date;
 
 /**
- *
- * This is an optional capability interface that is intended to be implemented by any
- * {@link org.keycloak.storage.UserStorageProvider UserStorageProvider} that supports syncing users to keycloak local
- * storage. You must implement this interface if you want to be able to use sync functionality within the Admin console.
+ * This is an optional capability interface intended to be implemented by any
+ * {@link org.keycloak.storage.UserStorageProviderFactory UserStorageProviderFactory} that supports
+ * syncing users to keycloak local storage.
+ * You must implement this interface if you want to be able to use sync functionality within the Admin console.
  *
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 public interface ImportSynchronization {
     SynchronizationResult sync(KeycloakSessionFactory sessionFactory, String realmId, UserStorageProviderModel model);
+
     SynchronizationResult syncSince(Date lastSync, KeycloakSessionFactory sessionFactory, String realmId, UserStorageProviderModel model);
 }
diff --git a/model/storage/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/storage/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index ce5ebe63eba6..6310544f2b50 100644
--- a/model/storage/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/model/storage/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -17,3 +17,4 @@
 
 org.keycloak.storage.UserStorageProviderSpi
 org.keycloak.storage.federated.UserFederatedStorageProviderSpi
+org.keycloak.storage.configuration.ServerConfigurationStorageProviderSpi
\ No newline at end of file
diff --git a/operator/README.md b/operator/README.md
index 893a2d7b04e8..f9588b2efb56 100644
--- a/operator/README.md
+++ b/operator/README.md
@@ -7,7 +7,7 @@ Also see [Operator guides](https://www.keycloak.org/guides#operator)
 
 ## Activating the Module
 
-When build from the project root directory, this module is only enabled if the installed JDK is 11 or newer. 
+When build from the project root directory, this module is only enabled if the installed JDK is 17 or newer. 
 
 ## Building
 
@@ -84,7 +84,9 @@ kubectl delete -k <previously-used-folder>
 
 ### Testing
 
-Testing allows 2 methods specified in the property `test.operator.deployment` : `local` & `remote`. 
+Testing allows 3 methods specified in the property `test.operator.deployment` : `local_apiserver`, `local` & `remote`. 
+
+`local_apiserver` : the default, where resources will be deployed to a jenvtest controlled api server (not a full kube environment) and the operator will run locally - not all tests can run in this mode. This is the fastest mode of testing as no externally managed kube environment is needed. As long as your test does not need a running Keycloak instance, this level of testing should be applicable.
 
 `local` : resources will be deployed to the local cluster and the operator will run out of the cluster
 
@@ -117,7 +119,7 @@ To avoid skipping tests that are depending on custom Keycloak images, you need t
 And run the tests passing an extra Java property:
 
 ```bash
--Dtest.kc.operator.custom.image=custom-keycloak:latest
+-Dtest.operator.custom.image=custom-keycloak:latest
 ```
 
 ### Testing using a pre-built operator image from a remote registry
diff --git a/operator/pom.xml b/operator/pom.xml
index c6420a96580c..4531d2450806 100644
--- a/operator/pom.xml
+++ b/operator/pom.xml
@@ -16,6 +16,7 @@
 
     <properties>
         <maven.compiler.parameters>true</maven.compiler.parameters>
+        <kc.quarkus.tests.groups>!invalid</kc.quarkus.tests.groups>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <quarkus.container-image.group>keycloak</quarkus.container-image.group>
@@ -89,6 +90,10 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-openshift-client</artifactId>
+        </dependency>
         <dependency>
           <groupId>io.quarkus</groupId>
           <artifactId>quarkus-container-image-docker</artifactId>
@@ -112,6 +117,16 @@
         </dependency>
 
         <!-- Test -->
+        <dependency>
+            <groupId>io.fabric8</groupId>
+            <artifactId>kube-api-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.fabric8</groupId>
+            <artifactId>kube-api-test-client-inject</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-test-common</artifactId>
@@ -127,6 +142,11 @@
             <artifactId>quarkus-junit5-mockito</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-junit5-component</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
@@ -253,9 +273,11 @@
                 </executions>
                 <configuration>
                     <systemPropertyVariables>
+                        <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                         <!-- Used in KeycloakDeploymentTest#testPreconfiguredPodLabels -->
                         <OPERATOR_TEST_LABEL_EXPRESSION>my-value</OPERATOR_TEST_LABEL_EXPRESSION>
                     </systemPropertyVariables>
+                    <groups>${kc.quarkus.tests.groups}</groups>
                 </configuration>
             </plugin>
 
diff --git a/operator/scripts/Dockerfile-custom-image b/operator/scripts/Dockerfile-custom-image
index 786e72233b63..86cd86472418 100644
--- a/operator/scripts/Dockerfile-custom-image
+++ b/operator/scripts/Dockerfile-custom-image
@@ -2,4 +2,4 @@ ARG IMAGE=keycloak
 ARG VERSION=latest
 FROM $IMAGE:$VERSION
 
-RUN /opt/keycloak/bin/kc.sh build --db=postgres --health-enabled=true
+RUN /opt/keycloak/bin/kc.sh build --db=postgres --health-enabled=true --features=rolling-updates
diff --git a/operator/scripts/create-olm-test-catalog.sh b/operator/scripts/create-olm-test-catalog.sh
index 92d8adc90e20..84a4a4f911ad 100755
--- a/operator/scripts/create-olm-test-catalog.sh
+++ b/operator/scripts/create-olm-test-catalog.sh
@@ -19,7 +19,7 @@ mkdir -p $SCRIPT_DIR/../olm/catalog/test-catalog
     --output yaml > test-catalog/operator.yaml
 
   opm render $BUNDLE_IMAGE:$VERSION \
-    --output=yaml >> test-catalog/operator.yaml
+    --output=yaml --skip-tls >> test-catalog/operator.yaml
 
   cat << EOF >> test-catalog/operator.yaml
 ---
diff --git a/operator/scripts/olm-testing.sh b/operator/scripts/olm-testing.sh
index 4e7e7e737fd9..12e1b1e2a234 100755
--- a/operator/scripts/olm-testing.sh
+++ b/operator/scripts/olm-testing.sh
@@ -10,14 +10,15 @@ TARGET_NAMESPACES=${3-$INSTALL_NAMESPACE}
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
 # This version translates to one day for ttl.sh
+REGISTRY=${REGISTRY:-ttl.sh}
 VERSION="86400000.0.0"
 
 # Build Keycloak Docker image (the keycloak tar.gz should already be in the container folder)
 (
   cd $SCRIPT_DIR/../../quarkus/container
   
-  docker build --build-arg KEYCLOAK_DIST=$(ls keycloak-*.tar.gz) . -t "ttl.sh/${UUID}keycloak:${VERSION}"
-  docker push "ttl.sh/${UUID}keycloak:${VERSION}"
+  docker build --build-arg KEYCLOAK_DIST=$(ls keycloak-*.tar.gz) . -t "$REGISTRY/${UUID}keycloak:${VERSION}"
+  docker push "$REGISTRY/${UUID}keycloak:${VERSION}"
 )
 
 # Build the operator Docker image
@@ -25,13 +26,13 @@ VERSION="86400000.0.0"
   cd $SCRIPT_DIR/../../
   ./mvnw clean package -Poperator -pl :keycloak-operator -am \
     -Dquarkus.container-image.build=true \
-    -Dquarkus.container-image.image="ttl.sh/${UUID}keycloak-operator:${VERSION}" \
-    -Dkc.operator.keycloak.image="ttl.sh/${UUID}keycloak:${VERSION}" \
+    -Dquarkus.container-image.image="$REGISTRY/${UUID}keycloak-operator:${VERSION}" \
+    -Dkc.operator.keycloak.image="$REGISTRY/${UUID}keycloak:${VERSION}" \
     -DskipTests
   # JIB patching on images doesn't work reliably with ttl.sh
-  docker push "ttl.sh/${UUID}keycloak-operator:${VERSION}"
+  docker push "$REGISTRY/${UUID}keycloak-operator:${VERSION}"
 )
 
-$SCRIPT_DIR/prepare-olm-test.sh ttl.sh ${VERSION} NONE ${UUID} $TARGET_NAMESPACES
+$SCRIPT_DIR/prepare-olm-test.sh $REGISTRY ${VERSION} NONE ${UUID} $TARGET_NAMESPACES
 
 $SCRIPT_DIR/install-keycloak-operator.sh $INSTALL_NAMESPACE
diff --git a/operator/src/main/java/org/keycloak/operator/Config.java b/operator/src/main/java/org/keycloak/operator/Config.java
index 4f54d14951e5..34b24b164a44 100644
--- a/operator/src/main/java/org/keycloak/operator/Config.java
+++ b/operator/src/main/java/org/keycloak/operator/Config.java
@@ -34,6 +34,7 @@ interface Keycloak {
         String imagePullPolicy();
         boolean startOptimized();
         int pollIntervalSeconds();
+        long updatePodDeadlineSeconds();
 
         ResourceRequirements resources();
         Map<String, String> podLabels();
diff --git a/operator/src/main/java/org/keycloak/operator/Constants.java b/operator/src/main/java/org/keycloak/operator/Constants.java
index 778803b53615..a3f883e341fb 100644
--- a/operator/src/main/java/org/keycloak/operator/Constants.java
+++ b/operator/src/main/java/org/keycloak/operator/Constants.java
@@ -36,6 +36,10 @@ public final class Constants {
     public static final String MANAGED_BY_VALUE = "keycloak-operator";
     public static final String COMPONENT_LABEL = "app.kubernetes.io/component";
     public static final String KEYCLOAK_MIGRATING_ANNOTATION = "operator.keycloak.org/migrating";
+    public static final String KEYCLOAK_RECREATE_UPDATE_ANNOTATION = "operator.keycloak.org/recreate-update";
+    public static final String KEYCLOAK_UPDATE_REASON_ANNOTATION = "operator.keycloak.org/update-reason";
+    public static final String KEYCLOAK_UPDATE_REVISION_ANNOTATION = "operator.keycloak.org/update-revision";
+    public static final String APP_LABEL = "app";
 
     public static final String DEFAULT_LABELS_AS_STRING = "app=keycloak,app.kubernetes.io/managed-by=keycloak-operator";
 
@@ -45,8 +49,7 @@ public final class Constants {
 
     public static final List<ValueOrSecret> DEFAULT_DIST_CONFIG_LIST = List.of(
             new ValueOrSecret("health-enabled", "true"),
-            new ValueOrSecret("cache", "ispn"),
-            new ValueOrSecret("cache-stack", "kubernetes")
+            new ValueOrSecret("cache", "ispn")
     );
 
 
diff --git a/operator/src/main/java/org/keycloak/operator/ContextUtils.java b/operator/src/main/java/org/keycloak/operator/ContextUtils.java
new file mode 100644
index 000000000000..83b79e09e836
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/ContextUtils.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator;
+
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import org.keycloak.operator.controllers.KeycloakDistConfigurator;
+import org.keycloak.operator.controllers.WatchedResources;
+import org.keycloak.operator.update.UpdateType;
+
+import java.util.Optional;
+
+public final class ContextUtils {
+
+    // context keys
+    public static final String OLD_DEPLOYMENT_KEY = "current_stateful_set";
+    public static final String NEW_DEPLOYMENT_KEY = "desired_new_stateful_set";
+    public static final String UPDATE_TYPE_KEY = "update_type";
+    public static final String UPDATE_REASON_KEY = "update_reason";
+    public static final String OPERATOR_CONFIG_KEY = "operator_config";
+    public static final String WATCHED_RESOURCES_KEY = "watched_resources";
+    public static final String DIST_CONFIGURATOR_KEY = "dist_configurator";
+
+    private ContextUtils() {}
+
+
+    public static void storeCurrentStatefulSet(Context<?> context, StatefulSet statefulSet) {
+        context.managedWorkflowAndDependentResourceContext().put(OLD_DEPLOYMENT_KEY, statefulSet);
+    }
+
+    public static Optional<StatefulSet> getCurrentStatefulSet(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().get(OLD_DEPLOYMENT_KEY, StatefulSet.class);
+    }
+
+    public static void storeDesiredStatefulSet(Context<?> context, StatefulSet statefulSet) {
+        context.managedWorkflowAndDependentResourceContext().put(NEW_DEPLOYMENT_KEY, statefulSet);
+    }
+
+    public static StatefulSet getDesiredStatefulSet(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().getMandatory(NEW_DEPLOYMENT_KEY, StatefulSet.class);
+    }
+
+    public static void storeUpdateType(Context<?> context, UpdateType updateType, String reason) {
+        context.managedWorkflowAndDependentResourceContext().put(UPDATE_TYPE_KEY, updateType);
+        context.managedWorkflowAndDependentResourceContext().put(UPDATE_REASON_KEY, reason);
+    }
+
+    public static Optional<UpdateType> getUpdateType(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().get(UPDATE_TYPE_KEY, UpdateType.class);
+    }
+
+    public static String getUpdateReason(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().getMandatory(UPDATE_REASON_KEY, String.class);
+    }
+
+    public static void storeOperatorConfig(Context<?> context, Config operatorConfig) {
+        context.managedWorkflowAndDependentResourceContext().put(OPERATOR_CONFIG_KEY, operatorConfig);
+    }
+
+    public static Config getOperatorConfig(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().getMandatory(OPERATOR_CONFIG_KEY, Config.class);
+    }
+
+    public static void storeWatchedResources(Context<?> context, WatchedResources watchedResources) {
+        context.managedWorkflowAndDependentResourceContext().put(WATCHED_RESOURCES_KEY, watchedResources);
+    }
+
+    public static WatchedResources getWatchedResources(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().getMandatory(WATCHED_RESOURCES_KEY, WatchedResources.class);
+    }
+
+    public static void storeDistConfigurator(Context<?> context, KeycloakDistConfigurator distConfigurator) {
+        context.managedWorkflowAndDependentResourceContext().put(DIST_CONFIGURATOR_KEY, distConfigurator);
+    }
+
+    public static KeycloakDistConfigurator getDistConfigurator(Context<?> context) {
+        return context.managedWorkflowAndDependentResourceContext().getMandatory(DIST_CONFIGURATOR_KEY, KeycloakDistConfigurator.class);
+    }
+}
diff --git a/operator/src/main/java/org/keycloak/operator/Utils.java b/operator/src/main/java/org/keycloak/operator/Utils.java
index 430ca6e5424f..ed2217143eef 100644
--- a/operator/src/main/java/org/keycloak/operator/Utils.java
+++ b/operator/src/main/java/org/keycloak/operator/Utils.java
@@ -17,26 +17,28 @@
 
 package org.keycloak.operator;
 
+import io.fabric8.kubernetes.api.model.ConfigMap;
 import io.fabric8.kubernetes.api.model.Container;
 import io.fabric8.kubernetes.api.model.HasMetadata;
 import io.fabric8.kubernetes.api.model.ResourceRequirements;
+import io.fabric8.kubernetes.api.model.Secret;
 import io.fabric8.kubernetes.client.KubernetesClient;
-import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.processing.event.ResourceID;
-import io.javaoperatorsdk.operator.processing.event.source.informer.InformerEventSource;
+import io.fabric8.kubernetes.client.utils.Serialization;
 import io.quarkus.logging.Log;
-import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 
+import java.math.BigInteger;
 import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.time.ZoneOffset;
 import java.time.ZonedDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.Base64;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -73,13 +75,6 @@ public static Map<String, String> allInstanceLabels(HasMetadata primary) {
         return labels;
     }
 
-    public static <T extends HasMetadata> Optional<T> getByName(Class<T> clazz, Function<Keycloak, String> nameFunction, Keycloak primary, Context<Keycloak> context) {
-        InformerEventSource<T, Keycloak> ies = (InformerEventSource<T, Keycloak>) context
-                .eventSourceRetriever().getResourceEventSourceFor(clazz);
-    
-        return ies.get(new ResourceID(nameFunction.apply(primary), primary.getMetadata().getNamespace()));
-    }
-
     /**
      * Set resources requests/limits for Keycloak container
      * </p>
@@ -111,4 +106,45 @@ public static void addResources(ResourceRequirements resource, Config config, Co
         kcContainer.setResources(resourcesSpec);
     }
 
+    public static <T> String hash(List<T> current) {
+        var messageDigest = getMessageDigest();
+
+        current.stream()
+                .map(Utils::getData)
+                .map(Serialization::asYaml)
+                .map(Utils::utf8Bytes)
+                .forEachOrdered(messageDigest::update);
+
+        return new BigInteger(1, messageDigest.digest()).toString(16);
+    }
+
+    public static String hash(String value) {
+        var messageDigest = getMessageDigest();
+        messageDigest.update(utf8Bytes(value));
+        return new BigInteger(1, messageDigest.digest()).toString(16);
+    }
+
+    private static MessageDigest getMessageDigest() {
+        // Uses a fips compliant hash
+        try {
+            return MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static Object getData(Object object) {
+        if (object instanceof Secret) {
+            return ((Secret) object).getData();
+        }
+        if (object instanceof ConfigMap) {
+            return ((ConfigMap) object).getData();
+        }
+        return object;
+    }
+
+    private static byte[] utf8Bytes(String string) {
+        return string.getBytes(StandardCharsets.UTF_8);
+    }
+
 }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java
index 5d667884de7b..c9786420cf04 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java
@@ -3,8 +3,8 @@
 import io.fabric8.kubernetes.api.model.Secret;
 import io.fabric8.kubernetes.api.model.SecretBuilder;
 import io.fabric8.kubernetes.client.utils.KubernetesResourceUtil;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.api.reconciler.ResourceDiscriminator;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResource;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.GarbageCollected;
 import io.javaoperatorsdk.operator.processing.dependent.Creator;
@@ -20,22 +20,16 @@
 import java.util.Optional;
 import java.util.UUID;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING, resourceDiscriminator = KeycloakAdminSecretDependentResource.NameResourceDiscriminator.class)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakAdminSecretDependentResource extends KubernetesDependentResource<Secret, Keycloak> implements Creator<Secret, Keycloak>, GarbageCollected<Keycloak> {
-    
+
     public static class EnabledCondition implements Condition<Secret, Keycloak> {
         @Override
         public boolean isMet(DependentResource<Secret, Keycloak> dependentResource, Keycloak primary,
                 Context<Keycloak> context) {
-            return Optional.ofNullable(primary.getSpec().getBootstrapAdminSpec()).map(BootstrapAdminSpec::getUser)
-                    .map(BootstrapAdminSpec.User::getSecret).filter(s -> !s.equals(KeycloakAdminSecretDependentResource.getName(primary))).isEmpty();
-        }
-    }
-
-    public static class NameResourceDiscriminator implements ResourceDiscriminator<Secret, Keycloak> {
-        @Override
-        public Optional<Secret> distinguish(Class<Secret> resource, Keycloak primary, Context<Keycloak> context) {
-            return Utils.getByName(Secret.class, KeycloakAdminSecretDependentResource::getName, primary, context);
+            return !hasCustomAdminSecret(primary);
         }
     }
 
@@ -62,4 +56,9 @@ public static String getName(Keycloak keycloak) {
         return KubernetesResourceUtil.sanitizeName(keycloak.getMetadata().getName() + "-initial-admin");
     }
 
+    public static boolean hasCustomAdminSecret(Keycloak keycloak) {
+        return Optional.ofNullable(keycloak.getSpec().getBootstrapAdminSpec()).map(BootstrapAdminSpec::getUser)
+                .map(BootstrapAdminSpec.User::getSecret).filter(s -> !s.equals(KeycloakAdminSecretDependentResource.getName(keycloak))).isPresent();
+    }
+
 }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakController.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakController.java
index 287b469837ae..8c2310601b3d 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakController.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakController.java
@@ -18,55 +18,53 @@
 
 import io.fabric8.kubernetes.api.model.ContainerState;
 import io.fabric8.kubernetes.api.model.ContainerStateWaiting;
+import io.fabric8.kubernetes.api.model.ContainerStatus;
 import io.fabric8.kubernetes.api.model.PodSpec;
 import io.fabric8.kubernetes.api.model.PodStatus;
-import io.fabric8.kubernetes.api.model.Service;
 import io.fabric8.kubernetes.api.model.apps.StatefulSet;
 import io.fabric8.kubernetes.client.readiness.Readiness;
 import io.fabric8.kubernetes.client.utils.KubernetesResourceUtil;
 import io.fabric8.kubernetes.client.utils.Serialization;
-import io.javaoperatorsdk.operator.api.config.informer.InformerConfiguration;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.api.reconciler.ControllerConfiguration;
-import io.javaoperatorsdk.operator.api.reconciler.ErrorStatusHandler;
 import io.javaoperatorsdk.operator.api.reconciler.ErrorStatusUpdateControl;
 import io.javaoperatorsdk.operator.api.reconciler.EventSourceContext;
-import io.javaoperatorsdk.operator.api.reconciler.EventSourceInitializer;
+import io.javaoperatorsdk.operator.api.reconciler.EventSourceUtils;
 import io.javaoperatorsdk.operator.api.reconciler.Reconciler;
 import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import io.javaoperatorsdk.operator.api.reconciler.Workflow;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.Dependent;
 import io.javaoperatorsdk.operator.processing.event.source.EventSource;
-import io.javaoperatorsdk.operator.processing.event.source.informer.InformerEventSource;
-import io.javaoperatorsdk.operator.processing.event.source.informer.Mappers;
 import io.quarkus.logging.Log;
-
+import jakarta.inject.Inject;
 import org.keycloak.common.util.CollectionUtil;
 import org.keycloak.operator.Config;
 import org.keycloak.operator.Constants;
+import org.keycloak.operator.ContextUtils;
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatus;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusAggregator;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpecBuilder;
+import org.keycloak.operator.update.UpdateLogicFactory;
 
-import java.util.HashMap;
+import java.util.Comparator;
 import java.util.List;
-import java.util.Map;
 import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
-import jakarta.inject.Inject;
-
-@ControllerConfiguration(
+@Workflow(
+    explicitInvocation = true,
     dependents = {
+        @Dependent(type = KeycloakDeploymentDependentResource.class, reconcilePrecondition = KeycloakDeploymentDependentResource.ReconcilePrecondition.class),
         @Dependent(type = KeycloakAdminSecretDependentResource.class, reconcilePrecondition = KeycloakAdminSecretDependentResource.EnabledCondition.class),
         @Dependent(type = KeycloakIngressDependentResource.class, reconcilePrecondition = KeycloakIngressDependentResource.EnabledCondition.class),
-        @Dependent(type = KeycloakServiceDependentResource.class, useEventSourceWithName = "serviceSource"),
-        @Dependent(type = KeycloakDiscoveryServiceDependentResource.class, useEventSourceWithName = "serviceSource"),
+        @Dependent(type = KeycloakServiceDependentResource.class),
+        @Dependent(type = KeycloakDiscoveryServiceDependentResource.class),
         @Dependent(type = KeycloakNetworkPolicyDependentResource.class, reconcilePrecondition = KeycloakNetworkPolicyDependentResource.EnabledCondition.class)
     })
-public class KeycloakController implements Reconciler<Keycloak>, EventSourceInitializer<Keycloak>, ErrorStatusHandler<Keycloak> {
+public class KeycloakController implements Reconciler<Keycloak> {
 
     public static final String OPENSHIFT_DEFAULT = "openshift-default";
 
@@ -79,28 +77,15 @@ public class KeycloakController implements Reconciler<Keycloak>, EventSourceInit
     @Inject
     KeycloakDistConfigurator distConfigurator;
 
-    volatile KeycloakDeploymentDependentResource deploymentDependentResource;
-
-    @Override
-    public Map<String, EventSource> prepareEventSources(EventSourceContext<Keycloak> context) {
-        var namespaces = context.getControllerConfiguration().getNamespaces();
-
-        InformerConfiguration<Service> servicesIC = InformerConfiguration
-                .from(Service.class)
-                .withLabelSelector(Constants.DEFAULT_LABELS_AS_STRING)
-                .withNamespaces(namespaces)
-                .withSecondaryToPrimaryMapper(Mappers.fromOwnerReference())
-                .build();
-
-        EventSource servicesEvent = new InformerEventSource<>(servicesIC, context);
-
-        Map<String, EventSource> sources = new HashMap<>();
-        sources.put("serviceSource", servicesEvent);
+    @Inject
+    UpdateLogicFactory updateLogicFactory;
 
-        this.deploymentDependentResource = new KeycloakDeploymentDependentResource(config, watchedResources, distConfigurator);
-        sources.putAll(EventSourceInitializer.nameEventSourcesFromDependentResource(context, this.deploymentDependentResource));
+    @Inject
+    KeycloakUpdateJobDependentResource updateJobDependentResource;
 
-        return sources;
+    @Override
+    public List<EventSource<?, Keycloak>> prepareEventSources(EventSourceContext<Keycloak> context) {
+        return EventSourceUtils.dependentEventSources(context, updateJobDependentResource);
     }
 
     @Override
@@ -131,15 +116,38 @@ public UpdateControl<Keycloak> reconcile(Keycloak kc, Context<Keycloak> context)
         }
 
         if (modifiedSpec) {
-            return UpdateControl.updateResource(kc);
+            // just patch spec using SSA, nothing more
+            Keycloak patchedKc = new KeycloakBuilder()
+                    .withNewMetadata()
+                        .withName(kc.getMetadata().getName())
+                        .withNamespace(kc.getMetadata().getNamespace())
+                    .endMetadata()
+                    .withSpec(kc.getSpec())
+                    .build();
+            return UpdateControl.patchResource(patchedKc);
+        }
+
+        var existingDeployment = context.getSecondaryResource(StatefulSet.class).filter(ss -> ss.hasOwnerReferenceFor(kc)).orElse(null);
+        ContextUtils.storeOperatorConfig(context, config);
+        ContextUtils.storeWatchedResources(context, watchedResources);
+        ContextUtils.storeDistConfigurator(context, distConfigurator);
+        ContextUtils.storeCurrentStatefulSet(context, existingDeployment);
+        ContextUtils.storeDesiredStatefulSet(context, new KeycloakDeploymentDependentResource().desired(kc, context));
+
+        var updateLogic = updateLogicFactory.create(kc, context);
+        var updateLogicControl = updateLogic.decideUpdate();
+        if (updateLogicControl.isPresent()) {
+            Log.debug("--- Reconciliation interrupted due to update logic");
+            return updateLogicControl.get();
         }
 
         // after the spec has possibly been updated, reconcile the StatefulSet
-        this.deploymentDependentResource.reconcile(kc, context);
+        context.managedWorkflowAndDependentResourceContext().reconcileManagedWorkflow();
 
         var statusAggregator = new KeycloakStatusAggregator(kc.getStatus(), kc.getMetadata().getGeneration());
 
-        updateStatus(kc, context.getSecondaryResource(StatefulSet.class).orElse(null), statusAggregator, context);
+        updateStatus(kc, existingDeployment, statusAggregator, context);
+        updateLogic.updateStatus(statusAggregator);
         var status = statusAggregator.build();
 
         Log.debug("--- Reconciliation finished successfully");
@@ -150,7 +158,7 @@ public UpdateControl<Keycloak> reconcile(Keycloak kc, Context<Keycloak> context)
         }
         else {
             kc.setStatus(status);
-            updateControl = UpdateControl.updateStatus(kc);
+            updateControl = UpdateControl.patchStatus(kc);
         }
 
         var statefulSet = context.getSecondaryResource(StatefulSet.class);
@@ -166,14 +174,14 @@ public UpdateControl<Keycloak> reconcile(Keycloak kc, Context<Keycloak> context)
 
     @Override
     public ErrorStatusUpdateControl<Keycloak> updateErrorStatus(Keycloak kc, Context<Keycloak> context, Exception e) {
-        Log.error("--- Error reconciling", e);
+        Log.debug("--- Error reconciling", e);
         KeycloakStatus status = new KeycloakStatusAggregator(kc.getStatus(), kc.getMetadata().getGeneration())
                 .addErrorMessage("Error performing operations:\n" + e.getMessage())
                 .build();
 
         kc.setStatus(status);
 
-        return ErrorStatusUpdateControl.updateStatus(kc);
+        return ErrorStatusUpdateControl.patchStatus(kc);
     }
 
     public static Optional<String> generateOpenshiftHostname(Keycloak keycloak, Context<Keycloak> context) {
@@ -209,7 +217,7 @@ public void updateStatus(Keycloak keycloakCR, StatefulSet existingDeployment, Ke
         if (Optional
                 .ofNullable(existingDeployment.getMetadata().getAnnotations().get(Constants.KEYCLOAK_MIGRATING_ANNOTATION))
                 .map(Boolean::valueOf).orElse(false)) {
-            status.addNotReadyMessage("Performing Keycloak upgrade, scaling down the deployment");
+            status.addNotReadyMessage("Performing Keycloak update, scaling down the deployment");
         } else if (existingDeployment.getStatus() != null
                 && existingDeployment.getStatus().getCurrentRevision() != null
                 && existingDeployment.getStatus().getUpdateRevision() != null
@@ -263,11 +271,12 @@ private void checkForPodErrors(KeycloakStatusAggregator status, Keycloak keycloa
                 .list().getItems().stream()
                 .filter(p -> !Readiness.isPodReady(p)
                         && Optional.ofNullable(p.getStatus()).map(PodStatus::getContainerStatuses).isPresent())
-                .sorted((p1, p2) -> p1.getMetadata().getName().compareTo(p2.getMetadata().getName()))
+                .sorted(Comparator.comparing(p -> p.getMetadata().getName()))
                 .forEachOrdered(p -> {
-                    Optional.of(p.getStatus()).map(s -> s.getContainerStatuses()).stream().flatMap(List::stream)
+                    Optional.of(p.getStatus()).map(PodStatus::getContainerStatuses).stream().flatMap(List::stream)
                             .filter(cs -> !Boolean.TRUE.equals(cs.getReady()))
-                            .sorted((cs1, cs2) -> cs1.getName().compareTo(cs2.getName())).forEachOrdered(cs -> {
+                            .sorted(Comparator.comparing(ContainerStatus::getName))
+                            .forEachOrdered(cs -> {
                                 if (Optional.ofNullable(cs.getState()).map(ContainerState::getWaiting)
                                         .map(ContainerStateWaiting::getReason).map(String::toLowerCase)
                                         .filter(s -> s.contains("err") || s.equals("crashloopbackoff")).isPresent()) {
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java
index f03124ba1420..f936e0978988 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java
@@ -22,7 +22,6 @@
 import io.fabric8.kubernetes.api.model.EnvVarBuilder;
 import io.fabric8.kubernetes.api.model.EnvVarSource;
 import io.fabric8.kubernetes.api.model.EnvVarSourceBuilder;
-import io.fabric8.kubernetes.api.model.PodSpec;
 import io.fabric8.kubernetes.api.model.PodSpecFluent;
 import io.fabric8.kubernetes.api.model.PodTemplateSpec;
 import io.fabric8.kubernetes.api.model.Secret;
@@ -31,25 +30,31 @@
 import io.fabric8.kubernetes.api.model.VolumeMountBuilder;
 import io.fabric8.kubernetes.api.model.apps.StatefulSet;
 import io.fabric8.kubernetes.api.model.apps.StatefulSetBuilder;
-import io.fabric8.kubernetes.api.model.apps.StatefulSetSpec;
 import io.fabric8.kubernetes.client.KubernetesClient;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
-import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependentResourceConfigBuilder;
+import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
+import io.javaoperatorsdk.operator.processing.dependent.workflow.Condition;
 import io.quarkus.logging.Log;
-
 import org.keycloak.operator.Config;
 import org.keycloak.operator.Constants;
+import org.keycloak.operator.ContextUtils;
 import org.keycloak.operator.Utils;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.ValueOrSecret;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.CacheSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HttpManagementSpec;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.ProbeSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.SchedulingSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.Truststore;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.TruststoreSource;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.UnsupportedSpec;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.UpdateSpec;
+import org.keycloak.operator.update.impl.RecreateOnImageChangeUpdateLogic;
 
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
@@ -73,8 +78,13 @@
 import static org.keycloak.operator.crds.v2alpha1.CRDUtils.isTlsConfigured;
 import static org.keycloak.operator.crds.v2alpha1.deployment.spec.TracingSpec.convertTracingAttributesToString;
 
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakDeploymentDependentResource extends CRUDKubernetesDependentResource<StatefulSet, Keycloak> {
 
+    public static final String POD_IP = "POD_IP";
+
     private static final List<String> COPY_ENV = Arrays.asList("HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY");
 
     private static final String ZONE_KEY = "topology.kubernetes.io/zone";
@@ -90,27 +100,25 @@ public class KeycloakDeploymentDependentResource extends CRUDKubernetesDependent
     public static final String KC_TRACING_SERVICE_NAME = "KC_TRACING_SERVICE_NAME";
     public static final String KC_TRACING_RESOURCE_ATTRIBUTES = "KC_TRACING_RESOURCE_ATTRIBUTES";
 
-    static final String JGROUPS_DNS_QUERY_PARAM = "-Djgroups.dns.query=";
-
     public static final String OPTIMIZED_ARG = "--optimized";
 
-    Config operatorConfig;
-
-    WatchedResources watchedResources;
-
-    KeycloakDistConfigurator distConfigurator;
-
     private boolean useServiceCaCrt;
 
-    public KeycloakDeploymentDependentResource(Config operatorConfig, WatchedResources watchedResources, KeycloakDistConfigurator distConfigurator) {
+    // Do not create the deployment before the initial admin secret is created to prevent the deployment from restarting.
+    // Not using native dependsOn as the initial admin secret may not be created by the operator and might be provided by the user,
+    // in which case we want to create the deployment immediately.
+    public static class ReconcilePrecondition implements Condition<StatefulSet, Keycloak> {
+        @Override
+        public boolean isMet(DependentResource<StatefulSet, Keycloak> dependentResource, Keycloak primary, Context<Keycloak> context) {
+            return KeycloakAdminSecretDependentResource.hasCustomAdminSecret(primary)
+                    || context.getSecondaryResourcesAsStream(Secret.class)
+                    .anyMatch(s -> s.getMetadata().getName().equals(KeycloakAdminSecretDependentResource.getName(primary)));
+        }
+    }
+
+    public KeycloakDeploymentDependentResource() {
         super(StatefulSet.class);
-        this.operatorConfig = operatorConfig;
-        this.watchedResources = watchedResources;
-        this.distConfigurator = distConfigurator;
         useServiceCaCrt = Files.exists(Path.of(SERVICE_CA_CRT));
-        this.configureWith(new KubernetesDependentResourceConfigBuilder<StatefulSet>()
-                .withLabelSelector(Constants.DEFAULT_LABELS_AS_STRING)
-                .build());
     }
 
     public void setUseServiceCaCrt(boolean useServiceCaCrt) {
@@ -119,42 +127,63 @@ public void setUseServiceCaCrt(boolean useServiceCaCrt) {
 
     @Override
     public StatefulSet desired(Keycloak primary, Context<Keycloak> context) {
-        StatefulSet baseDeployment = createBaseDeployment(primary, context);
+        Config operatorConfig = ContextUtils.getOperatorConfig(context);
+        WatchedResources watchedResources = ContextUtils.getWatchedResources(context);
+
+        StatefulSet baseDeployment = createBaseDeployment(primary, context, operatorConfig);
         TreeSet<String> allSecrets = new TreeSet<>();
         if (isTlsConfigured(primary)) {
             configureTLS(primary, baseDeployment, allSecrets);
         }
         Container kcContainer = baseDeployment.getSpec().getTemplate().getSpec().getContainers().get(0);
         addTruststores(primary, baseDeployment, kcContainer, allSecrets);
-        addEnvVars(baseDeployment, primary, allSecrets);
+        addEnvVars(baseDeployment, primary, allSecrets, context);
         addResources(primary.getSpec().getResourceRequirements(), operatorConfig, kcContainer);
         Optional.ofNullable(primary.getSpec().getCacheSpec())
-                .ifPresent(c -> configureCache(primary, baseDeployment, kcContainer, c, context.getClient()));
+                .ifPresent(c -> configureCache(baseDeployment, kcContainer, c, context.getClient(), watchedResources));
 
         if (!allSecrets.isEmpty()) {
             watchedResources.annotateDeployment(new ArrayList<>(allSecrets), Secret.class, baseDeployment, context.getClient());
         }
 
-        StatefulSet existingDeployment = context.getSecondaryResource(StatefulSet.class).orElse(null);
-        if (existingDeployment == null) {
-            Log.debug("No existing Deployment found, using the default");
+        // default to the new revision - will be overriden to the old one if needed
+        UpdateSpec.getRevision(primary).ifPresent(rev -> addUpdateRevisionAnnotation(rev, baseDeployment));
+
+        var existingDeployment = ContextUtils.getCurrentStatefulSet(context).orElse(null);
+
+        String serviceName = KeycloakDiscoveryServiceDependentResource.getName(primary);
+        if (existingDeployment != null) {
+            // copy the existing annotations to keep the status consistent
+            CRDUtils.findUpdateReason(existingDeployment).ifPresent(r -> baseDeployment.getMetadata().getAnnotations()
+                    .put(Constants.KEYCLOAK_UPDATE_REASON_ANNOTATION, r));
+            CRDUtils.fetchIsRecreateUpdate(existingDeployment).ifPresent(b -> baseDeployment.getMetadata()
+                    .getAnnotations().put(Constants.KEYCLOAK_RECREATE_UPDATE_ANNOTATION, b.toString()));
+            serviceName = existingDeployment.getSpec().getServiceName();
         }
-        else {
-            Log.debug("Existing Deployment found, handling migration");
 
-            // version 22 changed the match labels, account for older versions
-            if (!existingDeployment.isMarkedForDeletion() && !hasExpectedMatchLabels(existingDeployment, primary)) {
-                context.getClient().resource(existingDeployment).lockResourceVersion().delete();
-                Log.info("Existing Deployment found with old label selector, it will be recreated");
-            }
+        baseDeployment.getSpec().setServiceName(serviceName);
 
-            migrateDeployment(existingDeployment, baseDeployment, context);
+        var updateType = ContextUtils.getUpdateType(context);
+
+        if (existingDeployment == null || updateType.isEmpty()) {
+            return baseDeployment;
         }
 
-        return baseDeployment;
+        // version 22 changed the match labels, account for older versions
+        if (!existingDeployment.isMarkedForDeletion() && !hasExpectedMatchLabels(existingDeployment, primary)) {
+            context.getClient().resource(existingDeployment).lockResourceVersion().delete();
+            Log.info("Existing Deployment found with old label selector, it will be recreated");
+        }
+
+        baseDeployment.getMetadata().getAnnotations().put(Constants.KEYCLOAK_UPDATE_REASON_ANNOTATION, ContextUtils.getUpdateReason(context));
+
+        return switch (updateType.get()) {
+            case ROLLING -> handleRollingUpdate(baseDeployment, context, primary);
+            case RECREATE -> handleRecreateUpdate(existingDeployment, baseDeployment, kcContainer, context);
+        };
     }
 
-    private void configureCache(Keycloak keycloakCR, StatefulSet deployment, Container kcContainer, CacheSpec spec, KubernetesClient client) {
+    private void configureCache(StatefulSet deployment, Container kcContainer, CacheSpec spec, KubernetesClient client, WatchedResources watchedResources) {
         Optional.ofNullable(spec.getConfigMapFile()).ifPresent(configFile -> {
             if (configFile.getName() == null || configFile.getKey() == null) {
                 throw new IllegalStateException("Cache file ConfigMap requires both a name and a key");
@@ -234,7 +263,7 @@ static Optional<PodTemplateSpec> getPodTemplateSpec(Keycloak keycloakCR) {
         return Optional.ofNullable(keycloakCR.getSpec()).map(KeycloakSpec::getUnsupported).map(UnsupportedSpec::getPodTemplate);
     }
 
-    private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak> context) {
+    private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak> context, Config operatorConfig) {
         Map<String, String> labels = Utils.allInstanceLabels(keycloakCR);
         labels.put("app.kubernetes.io/component", "server");
         Map<String, String> schedulingLabels = new LinkedHashMap<>(labels);
@@ -296,11 +325,15 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
                         && (customImage.isPresent() || operatorConfig.keycloak().startOptimized())) {
             containerBuilder.addToArgs(OPTIMIZED_ARG);
         }
-        containerBuilder.addToArgs(0, getJGroupsParameter(keycloakCR));
+        // Set bind address as this is required for JGroups to form a cluster in IPv6 envionments
+        containerBuilder.addToArgs(0, "-Djgroups.bind.address=$(%s)".formatted(POD_IP));
 
         // probes
-        var protocol = isTlsConfigured(keycloakCR) ? "HTTPS" : "HTTP";
+        var protocol = isManagementHttps(keycloakCR) ? "HTTPS" : "HTTP";
         var port = HttpManagementSpec.managementPort(keycloakCR);
+        var readinessOptionalSpec = Optional.ofNullable(keycloakCR.getSpec().getReadinessProbeSpec());
+        var livenessOptionalSpec = Optional.ofNullable(keycloakCR.getSpec().getLivenessProbeSpec());
+        var startupOptionalSpec = Optional.ofNullable(keycloakCR.getSpec().getStartupProbeSpec());
         var relativePath = readConfigurationValue(Constants.KEYCLOAK_HTTP_MANAGEMENT_RELATIVE_PATH_KEY, keycloakCR, context)
                 .or(() -> readConfigurationValue(Constants.KEYCLOAK_HTTP_RELATIVE_PATH_KEY, keycloakCR, context))
                 .map(path -> !path.endsWith("/") ? path + "/" : path)
@@ -308,8 +341,8 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
 
         if (!containerBuilder.hasReadinessProbe()) {
             containerBuilder.withNewReadinessProbe()
-                .withPeriodSeconds(10)
-                .withFailureThreshold(3)
+                .withPeriodSeconds(readinessOptionalSpec.map(ProbeSpec::getProbePeriodSeconds).orElse(10))
+                .withFailureThreshold(readinessOptionalSpec.map(ProbeSpec::getProbeFailureThreshold).orElse(3))
                 .withNewHttpGet()
                 .withScheme(protocol)
                 .withNewPort(port)
@@ -319,8 +352,8 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
         }
         if (!containerBuilder.hasLivenessProbe()) {
             containerBuilder.withNewLivenessProbe()
-                .withPeriodSeconds(10)
-                .withFailureThreshold(3)
+                .withPeriodSeconds(livenessOptionalSpec.map(ProbeSpec::getProbePeriodSeconds).orElse(10))
+                .withFailureThreshold(livenessOptionalSpec.map(ProbeSpec::getProbeFailureThreshold).orElse(3))
                 .withNewHttpGet()
                 .withScheme(protocol)
                 .withNewPort(port)
@@ -330,8 +363,8 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
         }
         if (!containerBuilder.hasStartupProbe()) {
             containerBuilder.withNewStartupProbe()
-                .withPeriodSeconds(1)
-                .withFailureThreshold(600)
+                .withPeriodSeconds(startupOptionalSpec.map(ProbeSpec::getProbePeriodSeconds).orElse(1))
+                .withFailureThreshold(startupOptionalSpec.map(ProbeSpec::getProbeFailureThreshold).orElse(600))
                 .withNewHttpGet()
                 .withScheme(protocol)
                 .withNewPort(port)
@@ -341,7 +374,7 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
         }
 
         // add in ports - there's no merging being done here
-        final StatefulSet baseDeployment = containerBuilder
+        return containerBuilder
             .addNewPort()
                 .withName(Constants.KEYCLOAK_HTTPS_PORT_NAME)
                 .withContainerPort(Constants.KEYCLOAK_HTTPS_PORT)
@@ -358,8 +391,11 @@ private StatefulSet createBaseDeployment(Keycloak keycloakCR, Context<Keycloak>
                 .withProtocol(Constants.KEYCLOAK_SERVICE_PROTOCOL)
             .endPort()
             .endContainer().endSpec().endTemplate().endSpec().build();
+    }
 
-        return baseDeployment;
+    private boolean isManagementHttps(Keycloak keycloakCR) {
+        return isTlsConfigured(keycloakCR) && keycloakCR.getSpec().getAdditionalOptions().stream()
+                .noneMatch(v -> "http-management-scheme".equals(v.getName()) && "http".equals(v.getValue()));
     }
 
     private void handleScheduling(Keycloak keycloakCR, Map<String, String> labels, PodSpecFluent<?> specBuilder) {
@@ -398,11 +434,9 @@ private void handleScheduling(Keycloak keycloakCR, Map<String, String> labels, P
 
     }
 
-    private static String getJGroupsParameter(Keycloak keycloakCR) {
-        return JGROUPS_DNS_QUERY_PARAM + KeycloakDiscoveryServiceDependentResource.getName(keycloakCR) +"." + keycloakCR.getMetadata().getNamespace();
-    }
 
-    private void addEnvVars(StatefulSet baseDeployment, Keycloak keycloakCR, TreeSet<String> allSecrets) {
+    private void addEnvVars(StatefulSet baseDeployment, Keycloak keycloakCR, TreeSet<String> allSecrets, Context<Keycloak> context) {
+        var distConfigurator = ContextUtils.getDistConfigurator(context);
         var firstClasssEnvVars = distConfigurator.configureDistOptions(keycloakCR);
 
         var additionalEnvVars = getDefaultAndAdditionalEnvVars(keycloakCR);
@@ -470,17 +504,18 @@ private static Map<String, String> convertTracingAttributesToMap(Map<String, Env
     private List<EnvVar> getDefaultAndAdditionalEnvVars(Keycloak keycloakCR) {
         // default config values
         List<ValueOrSecret> serverConfigsList = new ArrayList<>(Constants.DEFAULT_DIST_CONFIG_LIST);
+        Set<String> defaultKeys = serverConfigsList.stream().map(ValueOrSecret::getName).collect(Collectors.toSet());
 
         // merge with the CR; the values in CR take precedence
         if (keycloakCR.getSpec().getAdditionalOptions() != null) {
-            Set<String> inCr = keycloakCR.getSpec().getAdditionalOptions().stream().map(v -> v.getName()).collect(Collectors.toSet());
+            Set<String> inCr = keycloakCR.getSpec().getAdditionalOptions().stream().map(ValueOrSecret::getName).collect(Collectors.toSet());
             serverConfigsList.removeIf(v -> inCr.contains(v.getName()));
             serverConfigsList.addAll(keycloakCR.getSpec().getAdditionalOptions());
         }
 
         // set env vars
         List<EnvVar> envVars = serverConfigsList.stream()
-                .map(v -> {
+                .flatMap(v -> {
                     var envBuilder = new EnvVarBuilder().withName(getKeycloakOptionEnvVarName(v.getName()));
                     var secret = v.getSecret();
                     if (secret != null) {
@@ -489,7 +524,14 @@ private List<EnvVar> getDefaultAndAdditionalEnvVars(Keycloak keycloakCR) {
                     } else {
                         envBuilder.withValue(v.getValue());
                     }
-                    return envBuilder.build();
+                    EnvVar mainVar = envBuilder.build();
+                    if (!defaultKeys.contains(v.getName())) {
+                        EnvVar keyVar = new EnvVarBuilder()
+                                .withName("KCKEY_" + mainVar.getName().substring(KeycloakDistConfigurator.KC_PREFIX.length()))
+                                .withValue(v.getName()).build();
+                        return Stream.of(mainVar, keyVar);
+                    }
+                    return Stream.of(mainVar);
                 })
                 .collect(Collectors.toCollection(ArrayList::new));
 
@@ -500,6 +542,9 @@ private List<EnvVar> getDefaultAndAdditionalEnvVars(Keycloak keycloakCR) {
             }
         }
 
+        envVars.add(new EnvVarBuilder().withName(POD_IP).withNewValueFrom().withNewFieldRef()
+                .withFieldPath("status.podIP").withApiVersion("v1").endFieldRef().endValueFrom().build());
+
         return envVars;
     }
 
@@ -507,28 +552,6 @@ public static String getName(Keycloak keycloak) {
         return keycloak.getMetadata().getName();
     }
 
-    public void migrateDeployment(StatefulSet previousDeployment, StatefulSet reconciledDeployment, Context<Keycloak> context) {
-        var previousContainer = Optional.ofNullable(previousDeployment).map(StatefulSet::getSpec)
-                .map(StatefulSetSpec::getTemplate).map(PodTemplateSpec::getSpec).map(PodSpec::getContainers)
-                .flatMap(c -> c.stream().findFirst()).orElse(null);
-        if (previousContainer == null) {
-            return;
-        }
-        var reconciledContainer = reconciledDeployment.getSpec().getTemplate().getSpec().getContainers().get(0);
-
-        if (!previousContainer.getImage().equals(reconciledContainer.getImage())
-                && previousDeployment.getStatus().getReplicas() > 0) {
-            // TODO Check if migration is really needed (e.g. based on actual KC version); https://github.com/keycloak/keycloak/issues/10441
-            Log.info("Detected changed Keycloak image, assuming Keycloak upgrade. Scaling down the deployment to one instance to perform a safe database migration");
-            Log.infof("original image: %s; new image: %s", previousContainer.getImage(), reconciledContainer.getImage());
-
-            reconciledContainer.setImage(previousContainer.getImage());
-            reconciledDeployment.getSpec().setReplicas(0);
-
-            reconciledDeployment.getMetadata().getAnnotations().put(Constants.KEYCLOAK_MIGRATING_ANNOTATION, Boolean.TRUE.toString());
-        }
-    }
-
     protected Optional<String> readConfigurationValue(String key, Keycloak keycloakCR, Context<Keycloak> context) {
         return Optional.ofNullable(keycloakCR.getSpec()).map(KeycloakSpec::getAdditionalOptions)
                 .flatMap(l -> l.stream().filter(sc -> sc.getName().equals(key)).findFirst().map(serverConfigValue -> {
@@ -550,4 +573,36 @@ protected Optional<String> readConfigurationValue(String key, Keycloak keycloakC
         }));
     }
 
+    private static StatefulSet handleRollingUpdate(StatefulSet desired, Context<Keycloak> context, Keycloak primary) {
+        // return the desired stateful set since Kubernetes does a rolling in-place update by default.
+        Log.debug("Performing a rolling update");
+        desired.getMetadata().getAnnotations().put(Constants.KEYCLOAK_RECREATE_UPDATE_ANNOTATION, Boolean.FALSE.toString());
+        return desired;
+    }
+
+    private static StatefulSet handleRecreateUpdate(StatefulSet actual, StatefulSet desired, Container kcContainer,
+            Context<Keycloak> context) {
+        desired.getMetadata().getAnnotations().put(Constants.KEYCLOAK_RECREATE_UPDATE_ANNOTATION, Boolean.TRUE.toString());
+
+        if (Optional.ofNullable(actual.getStatus().getReplicas()).orElse(0) == 0) {
+            Log.debug("Performing a recreate update - scaling up the stateful set");
+
+            // desired state correct as is
+        } else {
+            Log.debug("Performing a recreate update - scaling down the stateful set");
+
+            // keep the old revision and image, mark as migrating, and scale down
+            CRDUtils.getRevision(actual).ifPresent(rev -> addUpdateRevisionAnnotation(rev, desired));
+            desired.getMetadata().getAnnotations().put(Constants.KEYCLOAK_MIGRATING_ANNOTATION, Boolean.TRUE.toString());
+            desired.getSpec().setReplicas(0);
+            var currentImage = RecreateOnImageChangeUpdateLogic.extractImage(actual);
+            kcContainer.setImage(currentImage);
+        }
+        return desired;
+    }
+
+    private static void addUpdateRevisionAnnotation(String revision, StatefulSet toUpdate) {
+        toUpdate.getMetadata().getAnnotations().put(Constants.KEYCLOAK_UPDATE_REVISION_ANNOTATION, revision);
+    }
+
 }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java
index 8ebe25b44d38..66417a5e54a0 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java
@@ -20,8 +20,8 @@
 import io.fabric8.kubernetes.api.model.ServiceBuilder;
 import io.fabric8.kubernetes.api.model.ServiceSpec;
 import io.fabric8.kubernetes.api.model.ServiceSpecBuilder;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.api.reconciler.ResourceDiscriminator;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
 
@@ -29,18 +29,11 @@
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 
-import java.util.Optional;
-
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING, resourceDiscriminator = KeycloakDiscoveryServiceDependentResource.NameResourceDiscriminator.class)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakDiscoveryServiceDependentResource extends CRUDKubernetesDependentResource<Service, Keycloak> {
 
-    public static class NameResourceDiscriminator implements ResourceDiscriminator<Service, Keycloak> {
-        @Override
-        public Optional<Service> distinguish(Class<Service> resource, Keycloak primary, Context<Keycloak> context) {
-            return Utils.getByName(Service.class, KeycloakDiscoveryServiceDependentResource::getName, primary, context);
-        }
-    }
-
     public KeycloakDiscoveryServiceDependentResource() {
         super(Service.class);
     }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDistConfigurator.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDistConfigurator.java
index 777e83f66a59..d4bb917cc16b 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDistConfigurator.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDistConfigurator.java
@@ -57,6 +57,7 @@
 @ApplicationScoped
 public class KeycloakDistConfigurator {
 
+    public static final String KC_PREFIX = "KC_";
     /**
      * Specify first-class citizens fields which should not be added as general server configuration property
      */
@@ -204,7 +205,7 @@ protected void assumeFirstClassCitizens(Keycloak keycloakCR, KeycloakStatusAggre
 
     public static String getKeycloakOptionEnvVarName(String kcConfigName) {
         // TODO make this use impl from Quarkus dist (Configuration.toEnvVarFormat)
-        return "KC_" + replaceNonAlphanumericByUnderscores(kcConfigName).toUpperCase();
+        return KC_PREFIX + replaceNonAlphanumericByUnderscores(kcConfigName).toUpperCase();
     }
 
     private <T> OptionMapper<T> optionMapper(Function<Keycloak, T> optionSpec) {
@@ -262,7 +263,9 @@ public <R> OptionMapper<T> mapOption(String optionName, Function<T, R> optionVal
         protected <R extends Collection<?>> OptionMapper<T> mapOptionFromCollection(String optionName, Function<T, R> optionValueSupplier) {
             return mapOption(optionName, s -> {
                 var value = optionValueSupplier.apply(s);
-                if (value == null) return null;
+                if (value == null) {
+                    return null;
+                }
                 return value.stream().filter(Objects::nonNull).map(String::valueOf).collect(Collectors.joining(","));
             });
         }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakIngressDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakIngressDependentResource.java
index 01d28b4415ce..822cbcc7e11f 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakIngressDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakIngressDependentResource.java
@@ -19,6 +19,7 @@
 import io.fabric8.kubernetes.api.model.networking.v1.Ingress;
 import io.fabric8.kubernetes.api.model.networking.v1.IngressBuilder;
 import io.fabric8.kubernetes.client.KubernetesClientException;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
@@ -39,7 +40,9 @@
 
 import static org.keycloak.operator.crds.v2alpha1.CRDUtils.isTlsConfigured;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakIngressDependentResource extends CRUDKubernetesDependentResource<Ingress, Keycloak> {
 
     private static final Logger LOG = Logger.getLogger(KeycloakIngressDependentResource.class.getName());
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakNetworkPolicyDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakNetworkPolicyDependentResource.java
index f6ba14cb64c6..630d875692c6 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakNetworkPolicyDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakNetworkPolicyDependentResource.java
@@ -26,6 +26,7 @@
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyBuilder;
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyFluent;
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
@@ -46,7 +47,9 @@
 import static org.keycloak.operator.Constants.KEYCLOAK_JGROUPS_PROTOCOL;
 import static org.keycloak.operator.Constants.KEYCLOAK_SERVICE_PROTOCOL;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakNetworkPolicyDependentResource extends CRUDKubernetesDependentResource<NetworkPolicy, Keycloak> {
 
     private static final Logger LOG = Logger.getLogger(KeycloakNetworkPolicyDependentResource.class.getName());
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportController.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportController.java
index dcbda489fa4f..e84b706f7b8e 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportController.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportController.java
@@ -21,49 +21,34 @@
 import io.fabric8.kubernetes.api.model.batch.v1.Job;
 import io.fabric8.kubernetes.client.KubernetesClient;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.api.reconciler.ControllerConfiguration;
-import io.javaoperatorsdk.operator.api.reconciler.ErrorStatusHandler;
 import io.javaoperatorsdk.operator.api.reconciler.ErrorStatusUpdateControl;
-import io.javaoperatorsdk.operator.api.reconciler.EventSourceContext;
-import io.javaoperatorsdk.operator.api.reconciler.EventSourceInitializer;
 import io.javaoperatorsdk.operator.api.reconciler.Reconciler;
 import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import io.javaoperatorsdk.operator.api.reconciler.Workflow;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.Dependent;
-import io.javaoperatorsdk.operator.processing.event.source.EventSource;
 import io.quarkus.logging.Log;
-
+import jakarta.inject.Inject;
 import org.keycloak.operator.Config;
+import org.keycloak.operator.ContextUtils;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportStatus;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportStatusBuilder;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportStatusCondition;
 
-import java.util.Map;
 import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
-import jakarta.inject.Inject;
-
-@ControllerConfiguration(
+@Workflow(
+explicitInvocation = true,
 dependents = {
-    @Dependent(type = KeycloakRealmImportSecretDependentResource.class)
+    @Dependent(type = KeycloakRealmImportJobDependentResource.class, dependsOn = KeycloakRealmImportSecretDependentResource.DEPENDENT_NAME),
+    @Dependent(type = KeycloakRealmImportSecretDependentResource.class, name = KeycloakRealmImportSecretDependentResource.DEPENDENT_NAME)
 })
-public class KeycloakRealmImportController implements Reconciler<KeycloakRealmImport>, ErrorStatusHandler<KeycloakRealmImport>, EventSourceInitializer<KeycloakRealmImport> {
+public class KeycloakRealmImportController implements Reconciler<KeycloakRealmImport> {
 
     @Inject
     Config config;
 
-    @Inject
-    KubernetesClient client;
-
-    volatile KeycloakRealmImportJobDependentResource jobDependentResource;
-
-    @Override
-    public Map<String, EventSource> prepareEventSources(EventSourceContext<KeycloakRealmImport> context) {
-        this.jobDependentResource = new KeycloakRealmImportJobDependentResource(config);
-        return EventSourceInitializer.nameEventSourcesFromDependentResource(context, jobDependentResource);
-    }
-
     @Override
     public UpdateControl<KeycloakRealmImport> reconcile(KeycloakRealmImport realm, Context<KeycloakRealmImport> context) {
         String realmName = realm.getMetadata().getName();
@@ -73,18 +58,19 @@ public UpdateControl<KeycloakRealmImport> reconcile(KeycloakRealmImport realm, C
 
         var statusBuilder = new KeycloakRealmImportStatusBuilder();
 
-        Job existingJob = context.getSecondaryResource(Job.class).orElse(null);
+        Job existingJob = context.getSecondaryResource(Job.class).filter(job -> job.hasOwnerReferenceFor(realm)).orElse(null);
         StatefulSet existingDeployment = context.getClient().resources(StatefulSet.class).inNamespace(realm.getMetadata().getNamespace())
                 .withName(realm.getSpec().getKeycloakCRName()).get();
 
         if (existingDeployment != null) {
-            context.managedDependentResourceContext().put(StatefulSet.class, existingDeployment);
+            ContextUtils.storeOperatorConfig(context, config);
+            ContextUtils.storeCurrentStatefulSet(context, existingDeployment);
             if (getReadyReplicas(existingDeployment) > 0) {
-                jobDependentResource.reconcile(realm, context);
+                context.managedWorkflowAndDependentResourceContext().reconcileManagedWorkflow();
             }
         }
 
-        updateStatus(statusBuilder, realm, existingJob, existingDeployment);
+        updateStatus(statusBuilder, realm, existingJob, existingDeployment, context.getClient());
 
         var status = statusBuilder.build();
 
@@ -95,7 +81,7 @@ public UpdateControl<KeycloakRealmImport> reconcile(KeycloakRealmImport realm, C
             updateControl = UpdateControl.noUpdate();
         } else {
             realm.setStatus(status);
-            updateControl = UpdateControl.updateStatus(realm);
+            updateControl = UpdateControl.patchStatus(realm);
         }
 
         if (status
@@ -110,16 +96,16 @@ public UpdateControl<KeycloakRealmImport> reconcile(KeycloakRealmImport realm, C
 
     @Override
     public ErrorStatusUpdateControl<KeycloakRealmImport> updateErrorStatus(KeycloakRealmImport realm, Context<KeycloakRealmImport> context, Exception e) {
-        Log.error("--- Error reconciling", e);
+        Log.debug("--- Error reconciling", e);
         KeycloakRealmImportStatus status = new KeycloakRealmImportStatusBuilder()
                 .addErrorMessage("Error performing operations:\n" + e.getMessage())
                 .build();
 
         realm.setStatus(status);
-        return ErrorStatusUpdateControl.updateStatus(realm);
+        return ErrorStatusUpdateControl.patchStatus(realm);
     }
 
-    public void updateStatus(KeycloakRealmImportStatusBuilder status, KeycloakRealmImport realmCR, Job existingJob, StatefulSet existingDeployment) {
+    public void updateStatus(KeycloakRealmImportStatusBuilder status, KeycloakRealmImport realmCR, Job existingJob, StatefulSet existingDeployment, KubernetesClient client) {
         if (existingDeployment == null) {
             status.addErrorMessage("No existing Deployment found, waiting for it to be created");
             return;
@@ -144,7 +130,7 @@ public void updateStatus(KeycloakRealmImportStatusBuilder status, KeycloakRealmI
             } else if (oldStatus.getSucceeded() != null && oldStatus.getSucceeded() > 0) {
                 if (!lastReportedStatus.isDone()) {
                     Log.info("Job finished performing a rolling restart of the deployment");
-                    rollingRestart(realmCR); // could be based upon a hash annotation on the deployment instead
+                    rollingRestart(realmCR, client); // could be based upon a hash annotation on the deployment instead
                 }
                 status.addDone();
             } else if (oldStatus.getFailed() != null && oldStatus.getFailed() > 0) {
@@ -161,7 +147,7 @@ private Integer getReadyReplicas(StatefulSet existingDeployment) {
         return Optional.ofNullable(existingDeployment.getStatus()).map(StatefulSetStatus::getReadyReplicas).orElse(0);
     }
 
-    private void rollingRestart(KeycloakRealmImport realmCR) {
+    private void rollingRestart(KeycloakRealmImport realmCR, KubernetesClient client) {
         client.apps().statefulSets()
                 .inNamespace(realmCR.getMetadata().getNamespace())
                 .withName(realmCR.getSpec().getKeycloakCRName())
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportJobDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportJobDependentResource.java
index af9bf6abf08d..ecaa872927a1 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportJobDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportJobDependentResource.java
@@ -30,11 +30,10 @@
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.GarbageCollected;
 import io.javaoperatorsdk.operator.processing.dependent.Creator;
+import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependentResource;
-
-import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependentResourceConfigBuilder;
 import org.keycloak.operator.Config;
-import org.keycloak.operator.Constants;
+import org.keycloak.operator.ContextUtils;
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 import org.keycloak.operator.crds.v2alpha1.realmimport.Placeholder;
@@ -46,21 +45,17 @@
 import static org.keycloak.operator.Utils.addResources;
 import static org.keycloak.operator.controllers.KeycloakDistConfigurator.getKeycloakOptionEnvVarName;
 
+@KubernetesDependent
 public class KeycloakRealmImportJobDependentResource extends KubernetesDependentResource<Job, KeycloakRealmImport> implements Creator<Job, KeycloakRealmImport>, GarbageCollected<KeycloakRealmImport> {
 
-    private final Config config;
-
-    KeycloakRealmImportJobDependentResource(Config config) {
+    KeycloakRealmImportJobDependentResource() {
         super(Job.class);
-        this.config = config;
-        this.configureWith(new KubernetesDependentResourceConfigBuilder<Job>()
-                .withLabelSelector(Constants.DEFAULT_LABELS_AS_STRING)
-                .build());
     }
 
     @Override
     protected Job desired(KeycloakRealmImport primary, Context<KeycloakRealmImport> context) {
-        StatefulSet existingDeployment = context.managedDependentResourceContext().get(StatefulSet.class, StatefulSet.class).orElseThrow();
+        Config config = ContextUtils.getOperatorConfig(context);
+        StatefulSet existingDeployment = ContextUtils.getCurrentStatefulSet(context).orElseThrow();
         Map<String, Placeholder> placeholders = primary.getSpec().getPlaceholders();
         boolean replacePlaceholders = (placeholders != null && !placeholders.isEmpty());
 
@@ -71,7 +66,7 @@ protected Job desired(KeycloakRealmImport primary, Context<KeycloakRealmImport>
         String secretName = KeycloakRealmImportSecretDependentResource.getSecretName(primary);
         String volumeName = KubernetesResourceUtil.sanitizeName(secretName + "-volume");
 
-        buildKeycloakJobContainer(keycloakPodTemplate.getSpec().getContainers().get(0), primary, volumeName, replacePlaceholders);
+        buildKeycloakJobContainer(keycloakPodTemplate.getSpec().getContainers().get(0), primary, volumeName, config);
         keycloakPodTemplate.getSpec().getVolumes().add(buildSecretVolume(volumeName, secretName));
 
         var labels = keycloakPodTemplate.getMetadata().getLabels();
@@ -93,8 +88,6 @@ protected Job desired(KeycloakRealmImport primary, Context<KeycloakRealmImport>
 
         // The Job should not connect to the cache
         envvars.add(new EnvVarBuilder().withName(cacheEnvVarName).withValue("local").build());
-        // The Job doesn't need health to be enabled
-        envvars.add(new EnvVarBuilder().withName(healthEnvVarName).withValue("false").build());
 
         if (replacePlaceholders) {
             for (Map.Entry<String, Placeholder> secret : primary.getSpec().getPlaceholders().entrySet()) {
@@ -140,7 +133,7 @@ private Volume buildSecretVolume(String volumeName, String secretName) {
                 .build();
     }
 
-    private void buildKeycloakJobContainer(Container keycloakContainer, KeycloakRealmImport keycloakRealmImport, String volumeName, boolean replacePlaceholders) {
+    private void buildKeycloakJobContainer(Container keycloakContainer, KeycloakRealmImport keycloakRealmImport, String volumeName, Config config) {
         var importMntPath = "/mnt/realm-import/";
 
         var command = List.of("/bin/bash");
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportSecretDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportSecretDependentResource.java
index 16a0d40e183b..0db50623d940 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportSecretDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakRealmImportSecretDependentResource.java
@@ -3,6 +3,7 @@
 import io.fabric8.kubernetes.api.model.Secret;
 import io.fabric8.kubernetes.api.model.SecretBuilder;
 import io.fabric8.kubernetes.client.utils.KubernetesResourceUtil;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
@@ -11,9 +12,13 @@
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakRealmImportSecretDependentResource extends CRUDKubernetesDependentResource<Secret, KeycloakRealmImport> {
 
+    public static final String DEPENDENT_NAME = "realm-import-secret";
+
     public KeycloakRealmImportSecretDependentResource() {
         super(Secret.class);
     }
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java
index 5aefe119f37a..42cec8eedd18 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java
@@ -17,14 +17,16 @@
 package org.keycloak.operator.controllers;
 
 import java.util.Optional;
+import java.util.HashMap;
+import java.util.Map;
 
 import io.fabric8.kubernetes.api.model.HasMetadata;
 import io.fabric8.kubernetes.api.model.Service;
 import io.fabric8.kubernetes.api.model.ServiceBuilder;
 import io.fabric8.kubernetes.api.model.ServiceSpec;
 import io.fabric8.kubernetes.api.model.ServiceSpecBuilder;
+import io.javaoperatorsdk.operator.api.config.informer.Informer;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
-import io.javaoperatorsdk.operator.api.reconciler.ResourceDiscriminator;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
 import org.keycloak.operator.Constants;
@@ -35,16 +37,11 @@
 
 import static org.keycloak.operator.crds.v2alpha1.CRDUtils.isTlsConfigured;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING, resourceDiscriminator = KeycloakServiceDependentResource.NameResourceDiscriminator.class)
+@KubernetesDependent(
+        informer = @Informer(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+)
 public class KeycloakServiceDependentResource extends CRUDKubernetesDependentResource<Service, Keycloak> {
 
-    public static class NameResourceDiscriminator implements ResourceDiscriminator<Service, Keycloak> {
-        @Override
-        public Optional<Service> distinguish(Class<Service> resource, Keycloak primary, Context<Keycloak> context) {
-            return Utils.getByName(Service.class, KeycloakServiceDependentResource::getServiceName, primary, context);
-        }
-    }
-
     public KeycloakServiceDependentResource() {
         super(Service.class);
     }
@@ -81,11 +78,19 @@ private ServiceSpec getServiceSpec(Keycloak keycloak) {
 
     @Override
     protected Service desired(Keycloak primary, Context<Keycloak> context) {
+
+        Map<String,String> labels = Utils.allInstanceLabels(primary);
+        var optionalSpec = Optional.ofNullable(primary.getSpec().getHttpSpec());
+        optionalSpec.map(HttpSpec::getLabels).ifPresent(labels::putAll);
+
+        Map<String,String> annotations = optionalSpec.map(HttpSpec::getAnnotations).orElse(new HashMap<>());
+
         Service service = new ServiceBuilder()
                 .withNewMetadata()
                 .withName(getServiceName(primary))
                 .withNamespace(primary.getMetadata().getNamespace())
-                .addToLabels(Utils.allInstanceLabels(primary))
+                .addToLabels(labels)
+                .addToAnnotations(annotations)
                 .endMetadata()
                 .withSpec(getServiceSpec(primary))
                 .build();
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/KeycloakUpdateJobDependentResource.java b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakUpdateJobDependentResource.java
new file mode 100644
index 000000000000..30111e1388b3
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/controllers/KeycloakUpdateJobDependentResource.java
@@ -0,0 +1,225 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.controllers;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import io.fabric8.kubernetes.api.model.HasMetadata;
+
+import org.keycloak.operator.Constants;
+import org.keycloak.operator.ContextUtils;
+import org.keycloak.operator.Utils;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+
+import io.fabric8.kubernetes.api.model.ContainerFluent;
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.ObjectMetaBuilder;
+import io.fabric8.kubernetes.api.model.PodSpec;
+import io.fabric8.kubernetes.api.model.PodSpecBuilder;
+import io.fabric8.kubernetes.api.model.Volume;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.api.model.batch.v1.Job;
+import io.fabric8.kubernetes.api.model.batch.v1.JobBuilder;
+import io.fabric8.kubernetes.api.model.batch.v1.JobSpecFluent;
+import io.javaoperatorsdk.operator.api.config.informer.InformerConfiguration;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
+import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependentResourceConfigBuilder;
+import jakarta.enterprise.context.ApplicationScoped;
+
+@ApplicationScoped
+public class KeycloakUpdateJobDependentResource extends CRUDKubernetesDependentResource<Job, Keycloak> {
+
+    // shared volume configuration
+    private static final String WORK_DIR_VOLUME_NAME = "keycloak-update-job-temporary-workdir"; // unlikely to conflict
+    private static final String WORK_DIR_VOLUME_MOUNT_PATH = "/mnt/" + WORK_DIR_VOLUME_NAME; // unlikely to conflict
+    private static final String UPDATES_FILE_PATH = WORK_DIR_VOLUME_MOUNT_PATH + "/updates.json";
+
+    // Annotations
+    public static final String KEYCLOAK_CR_HASH_ANNOTATION = "operator.keycloak.org/keycloak-hash";
+
+    // Label
+    private static final String APP_LABEL_VALUE = "keycloak-update-job";
+    private static final String LABEL_SELECTOR = "app=keycloak-update-job,app.kubernetes.io/managed-by=keycloak-operator";
+
+    // container configuration
+    private static final String INIT_CONTAINER_NAME = "actual";
+    private static final String CONTAINER_NAME = "desired";
+    private static final List<String> INIT_CONTAINER_ARGS = List.of("update-compatibility", "metadata", "--file", UPDATES_FILE_PATH);
+    private static final List<String> CONTAINER_ARGS = List.of("update-compatibility", "check", "--file", UPDATES_FILE_PATH);
+
+    // Job and Pod defaults
+    // Pod is restarted if it fails with an exit code != 0, and we don't want that.
+    private static final int JOB_RETRIES = 0;
+    // Job time to live
+    private static final int JOB_TIME_TO_LIVE_SECONDS = (int) TimeUnit.MINUTES.toSeconds(30);
+
+    public KeycloakUpdateJobDependentResource() {
+        super(Job.class);
+        this.configureWith(new KubernetesDependentResourceConfigBuilder<Job>()
+                .withKubernetesDependentInformerConfig(InformerConfiguration.builder(resourceType())
+                        .withLabelSelector(LABEL_SELECTOR)
+                        .build())
+                .build());
+    }
+
+    @Override
+    public Job desired(Keycloak primary, Context<Keycloak> context) {
+        var builder = new JobBuilder();
+        builder.withMetadata(createMetadata(jobName(primary), primary));
+        var specBuilder = builder.withNewSpec();
+        addPodSpecTemplate(specBuilder, primary, context);
+        // we don't need retries; we use exit code != 1 to signal the update decision.
+        specBuilder.withBackoffLimit(JOB_RETRIES);
+        // Remove the job after 30 minutes.
+        specBuilder.withTtlSecondsAfterFinished(JOB_TIME_TO_LIVE_SECONDS);
+        specBuilder.endSpec();
+        return builder.build();
+    }
+
+    public static boolean isJobFromCurrentKeycloakCr(Job job, Keycloak keycloak) {
+        var annotations = job.getMetadata().getAnnotations();
+        var hash = annotations.get(KEYCLOAK_CR_HASH_ANNOTATION);
+        return job.hasOwnerReferenceFor(keycloak) && Objects.equals(hash, keycloakHash(keycloak));
+    }
+
+    public static String jobName(Keycloak keycloak) {
+        return keycloak.getMetadata().getName() + "-update-job";
+    }
+
+    private static String podName(Keycloak keycloak) {
+        return keycloak.getMetadata().getName() + "-update-pod";
+    }
+
+    private static ObjectMeta createMetadata(String name, Keycloak keycloak) {
+        var builder = new ObjectMetaBuilder();
+        builder.withName(name)
+                .withNamespace(keycloak.getMetadata().getNamespace())
+                .withLabels(getLabels(keycloak))
+                .withAnnotations(Map.of(KEYCLOAK_CR_HASH_ANNOTATION, keycloakHash(keycloak)));
+        return builder.build();
+    }
+
+    private void addPodSpecTemplate(JobSpecFluent<?> builder, Keycloak keycloak, Context<Keycloak> context) {
+        var podTemplate = builder.withNewTemplate();
+        podTemplate.withMetadata(createMetadata(podName(keycloak), keycloak));
+        podTemplate.withSpec(createPodSpec(context));
+        podTemplate.endTemplate();
+    }
+
+    private PodSpec createPodSpec(Context<Keycloak> context) {
+        StatefulSet current = ContextUtils.getCurrentStatefulSet(context).orElseThrow();
+        StatefulSet desired = ContextUtils.getDesiredStatefulSet(context);
+
+        // start off with the desired statefulset state
+        var builder = desired.getSpec().getTemplate().getSpec().edit();
+        builder.withRestartPolicy("Never");
+
+        // remove things we don't want - the main keycloak container, and any sidecars added via the unsupported PodTemplate
+        builder.withContainers();
+
+        // We'll leave the scheduling fields alone - it should be fine to run these jobs where ever the keycloak workload is restricted to,
+        // if there is some corner case we are not considering that would leave the upgrade job unscheduable, we'll address that later
+
+        // mix in the existing state
+        var desiredPullSecrets = Optional.ofNullable(builder.buildImagePullSecrets()).orElse(List.of());
+        current.getSpec().getTemplate().getSpec().getImagePullSecrets().stream().filter(s -> !desiredPullSecrets.contains(s)).forEach(builder::addToImagePullSecrets);
+        // TODO: if the name is the same, but the volume has changed this merging behavior will be inconsistent / incorrect. For example is someone changes which
+        // configmap the cache config is using
+        var desiredVolumes = Optional.ofNullable(builder.buildVolumes()).orElse(List.of()).stream().map(Volume::getName).collect(Collectors.toSet());
+        current.getSpec().getTemplate().getSpec().getVolumes().stream().filter(v -> !desiredVolumes.contains(v.getName())).forEach(builder::addToVolumes);
+        // TODO: what else should get merged - there could be additional stuff from the unsupported PodTemplate
+
+        addInitContainer(builder, current);
+        addContainer(builder, desired);
+        builder.addNewVolume()
+                .withName(WORK_DIR_VOLUME_NAME)
+                .withNewEmptyDir()
+                .endEmptyDir()
+                .endVolume();
+
+        // For test KeycloakDeploymentTest#testDeploymentDurability
+        // it uses a pause image, which never ends.
+        // After this seconds, the job is terminated allowing the test to complete.
+        builder.withActiveDeadlineSeconds(ContextUtils.getOperatorConfig(context).keycloak().updatePodDeadlineSeconds());
+        return builder.build();
+    }
+
+    private static void addInitContainer(PodSpecBuilder builder, StatefulSet current) {
+        var existing = CRDUtils.firstContainerOf(current).orElseThrow();
+        var containerBuilder = builder.addNewInitContainerLike(existing);
+        configureContainer(containerBuilder, INIT_CONTAINER_NAME, INIT_CONTAINER_ARGS);
+        containerBuilder.endInitContainer();
+    }
+
+    private static void addContainer(PodSpecBuilder builder, StatefulSet desired) {
+        var existing = CRDUtils.firstContainerOf(desired).orElseThrow();
+        var containerBuilder = builder.addNewContainerLike(existing);
+        configureContainer(containerBuilder, CONTAINER_NAME, CONTAINER_ARGS);
+        containerBuilder.endContainer();
+    }
+
+    private static void configureContainer(ContainerFluent<?> containerBuilder, String name, List<String> args) {
+        containerBuilder.withName(name);
+        containerBuilder.withArgs(replaceStartWithUpdateCommand(containerBuilder.getArgs(), args));
+
+        var volumeMounts = containerBuilder.buildVolumeMounts();
+        if (volumeMounts != null) {
+            var newVolumeMounts = volumeMounts.stream()
+                    .filter(volumeMount -> !volumeMount.getName().startsWith("kube-api"))
+                    .toList();
+            containerBuilder.withVolumeMounts(newVolumeMounts);
+        }
+
+        // remove restart policy, lifecycle, and probes
+        containerBuilder.withRestartPolicy(null);
+        containerBuilder.withLifecycle(null);
+        containerBuilder.withReadinessProbe(null);
+        containerBuilder.withLivenessProbe(null);
+        containerBuilder.withStartupProbe(null);
+
+        // add the shared volume
+        containerBuilder.addNewVolumeMount()
+                .withName(WORK_DIR_VOLUME_NAME)
+                .withMountPath(WORK_DIR_VOLUME_MOUNT_PATH)
+                .endVolumeMount();
+    }
+
+    private static List<String> replaceStartWithUpdateCommand(List<String> currentArgs, List<String> updateArgs) {
+        // note that using start-dev via the unsupported podTemplate will fail - that is fine as rolling updates shouldn't apply
+        // TODO: reuse ConfigArgConfigSource parsing, so that we don't confuse what the command is
+        return Stream.concat(updateArgs.stream(), currentArgs.stream().filter(arg -> !arg.equals("start"))).toList();
+    }
+
+    private static String keycloakHash(Keycloak keycloak) {
+        return Utils.hash(List.of(keycloak.getSpec()));
+    }
+
+    private static Map<String, String> getLabels(HasMetadata keycloak) {
+        var labels = Utils.allInstanceLabels(keycloak);
+        labels.put(Constants.APP_LABEL, APP_LABEL_VALUE);
+        return labels;
+    }
+}
diff --git a/operator/src/main/java/org/keycloak/operator/controllers/WatchedResources.java b/operator/src/main/java/org/keycloak/operator/controllers/WatchedResources.java
index 76e5b21fab91..2fd353a2716b 100644
--- a/operator/src/main/java/org/keycloak/operator/controllers/WatchedResources.java
+++ b/operator/src/main/java/org/keycloak/operator/controllers/WatchedResources.java
@@ -17,24 +17,17 @@
 
 package org.keycloak.operator.controllers;
 
-import io.fabric8.kubernetes.api.model.ConfigMap;
-import io.fabric8.kubernetes.api.model.HasMetadata;
-import io.fabric8.kubernetes.api.model.Secret;
-import io.fabric8.kubernetes.api.model.apps.StatefulSet;
-import io.fabric8.kubernetes.client.KubernetesClient;
-import io.fabric8.kubernetes.client.utils.Serialization;
-
-import java.math.BigInteger;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
 
+import io.fabric8.kubernetes.api.model.HasMetadata;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.client.KubernetesClient;
 import jakarta.enterprise.context.ApplicationScoped;
+import org.keycloak.operator.Utils;
 
 @ApplicationScoped
 public class WatchedResources {
@@ -53,25 +46,15 @@ public <T extends HasMetadata> void annotateDeployment(List<String> names, Class
         deployment.getMetadata().getAnnotations().put(WatchedResources.KEYCLOAK_MISSING_ANNOTATION_PREFIX + plural,
                 Boolean.valueOf(current.size() < names.size()).toString());
         deployment.getMetadata().getAnnotations().put(WatchedResources.KEYCLOAK_WATCHING_ANNOTATION_PREFIX + plural,
-                names.stream().collect(Collectors.joining(";")));
+                String.join(";", names));
         deployment.getSpec().getTemplate().getMetadata().getAnnotations()
                 .put(WatchedResources.KEYCLOAK_WATCHED_HASH_ANNOTATION_PREFIX + HasMetadata.getKind(type).toLowerCase() + "-hash", getHash(current));
     }
 
-    static Object getData(Object object) {
-        if (object instanceof Secret) {
-            return ((Secret) object).getData();
-        }
-        if (object instanceof ConfigMap) {
-            return ((ConfigMap) object).getData();
-        }
-        return object;
-    }
-
     public boolean hasMissing(StatefulSet deployment) {
         return deployment.getMetadata().getAnnotations().entrySet().stream()
                 .anyMatch(e -> e.getKey().startsWith(WatchedResources.KEYCLOAK_MISSING_ANNOTATION_PREFIX)
-                        && Boolean.valueOf(e.getValue()));
+                        && Boolean.parseBoolean(e.getValue()));
     }
 
     public boolean isWatching(StatefulSet deployment) {
@@ -81,19 +64,7 @@ public boolean isWatching(StatefulSet deployment) {
     }
 
     public <T extends HasMetadata> String getHash(List<T> current) {
-        try {
-            // using hashes as it's more robust than resource versions that can change e.g.
-            // just when adding a label
-            // Uses a fips compliant hash
-            var messageDigest = MessageDigest.getInstance("SHA-256");
-
-            current.stream().map(s -> Serialization.asYaml(getData(s)).getBytes(StandardCharsets.UTF_8))
-                    .forEachOrdered(s -> messageDigest.update(s));
-
-            return new BigInteger(1, messageDigest.digest()).toString(16);
-        } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException(e);
-        }
+        return Utils.hash(current);
     }
 
     private <T extends HasMetadata> List<T> fetch(List<String> names, Class<T> type, String namespace,
@@ -109,4 +80,4 @@ public List<String> getNames(StatefulSet deployment, Class<? extends HasMetadata
                 .map(watching -> watching.split(";")).map(Arrays::asList).orElse(List.of());
     }
 
-}
\ No newline at end of file
+}
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/CRDUtils.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/CRDUtils.java
index 14122d0da752..6dd7abcf2d92 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/CRDUtils.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/CRDUtils.java
@@ -19,11 +19,22 @@
 
 import java.util.Collection;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.function.Predicate;
 import java.util.stream.Stream;
 
+import com.fasterxml.jackson.databind.JsonNode;
+import io.fabric8.kubernetes.api.model.Container;
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.PodSpec;
+import io.fabric8.kubernetes.api.model.PodTemplateSpec;
+import io.fabric8.kubernetes.api.model.Volume;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.api.model.apps.StatefulSetSpec;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
 import org.keycloak.operator.Constants;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakSpec;
@@ -81,4 +92,44 @@ public static Optional<KeycloakSpec> keycloakSpecOf(Keycloak keycloak) {
                 .map(Keycloak::getSpec);
     }
 
+    public static Optional<Container> firstContainerOf(StatefulSet statefulSet) {
+        return Optional.ofNullable(statefulSet)
+                .map(StatefulSet::getSpec)
+                .map(StatefulSetSpec::getTemplate)
+                .map(PodTemplateSpec::getSpec)
+                .map(PodSpec::getContainers)
+                .filter(Predicate.not(List::isEmpty))
+                .map(containers -> containers.get(0));
+    }
+
+    public static <T> JsonNode toJsonNode(T value, Context<Keycloak> context) {
+        final var kubernetesSerialization = context.getClient().getKubernetesSerialization();
+        return kubernetesSerialization.convertValue(value, JsonNode.class);
+    }
+
+    public static Stream<Volume> volumesFromStatefulSet(StatefulSet statefulSet) {
+        return Optional.of(statefulSet)
+                .map(StatefulSet::getSpec)
+                .map(StatefulSetSpec::getTemplate)
+                .map(PodTemplateSpec::getSpec)
+                .map(PodSpec::getVolumes)
+                .stream()
+                .flatMap(Collection::stream);
+    }
+
+    public static Optional<Boolean> fetchIsRecreateUpdate(StatefulSet statefulSet) {
+        var value = statefulSet.getMetadata().getAnnotations().get(Constants.KEYCLOAK_RECREATE_UPDATE_ANNOTATION);
+        return Optional.ofNullable(value).map(Boolean::parseBoolean);
+    }
+
+    public static Optional<String> findUpdateReason(StatefulSet statefulSet) {
+        return Optional.ofNullable(statefulSet.getMetadata().getAnnotations().get(Constants.KEYCLOAK_UPDATE_REASON_ANNOTATION));
+    }
+
+    public static Optional<String> getRevision(StatefulSet statefulSet) {
+        return Optional.ofNullable(statefulSet)
+                .map(StatefulSet::getMetadata)
+                .map(ObjectMeta::getAnnotations)
+                .map(annotations -> annotations.get(Constants.KEYCLOAK_UPDATE_REVISION_ANNOTATION));
+    }
 }
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java
index 40831d873eba..76a9d0ca59e5 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java
@@ -29,6 +29,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HttpSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.IngressSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.NetworkPolicySpec;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.ProbeSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.ProxySpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.SchedulingSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.TracingSpec;
@@ -44,6 +45,7 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonPropertyDescription;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.UpdateSpec;
 
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class KeycloakSpec {
@@ -59,11 +61,11 @@ public class KeycloakSpec {
     private Boolean startOptimized;
 
     @JsonPropertyDescription("Secret(s) that might be used when pulling an image from a private container image registry or repository.")
-    private List<LocalObjectReference> imagePullSecrets;
+    private List<LocalObjectReference> imagePullSecrets = new ArrayList<LocalObjectReference>();
 
     @JsonPropertyDescription("Configuration of the Keycloak server.\n" +
             "expressed as a keys (reference: https://www.keycloak.org/server/all-config) and values that can be either direct values or references to secrets.")
-    private List<ValueOrSecret> additionalOptions; // can't use Set due to a bug in Sundrio https://github.com/sundrio/sundrio/issues/316
+    private List<ValueOrSecret> additionalOptions = new ArrayList<ValueOrSecret>(); // can't use Set due to a bug in Sundrio https://github.com/sundrio/sundrio/issues/316
 
     @JsonProperty("http")
     @JsonPropertyDescription("In this section you can configure Keycloak features related to HTTP and HTTPS")
@@ -130,6 +132,24 @@ public class KeycloakSpec {
     @JsonPropertyDescription("In this section you can configure OpenTelemetry Tracing for Keycloak.")
     private TracingSpec tracingSpec;
 
+    @JsonProperty("update")
+    @JsonPropertyDescription("Configuration related to Keycloak deployment updates.")
+    private UpdateSpec updateSpec;
+
+    @JsonProperty("readinessProbe")
+    @JsonPropertyDescription("Configuration for readiness probe, by default it is 10 for periodSeconds and 3 for failureThreshold")
+    private ProbeSpec readinessProbeSpec;
+
+
+    @JsonProperty("livenessProbe")
+    @JsonPropertyDescription("Configuration for liveness probe, by default it is 10 for periodSeconds and 3 for failureThreshold")
+    private ProbeSpec livenessProbeSpec;
+
+    @JsonProperty("startupProbe")
+    @JsonPropertyDescription("Configuration for startup probe, by default it is 1 for periodSeconds and 600 for failureThreshold")
+    private ProbeSpec startupProbeSpec;
+
+
     public HttpSpec getHttpSpec() {
         return httpSpec;
     }
@@ -303,4 +323,30 @@ public TracingSpec getTracingSpec() {
     public void setTracingSpec(TracingSpec tracingSpec) {
         this.tracingSpec = tracingSpec;
     }
+
+    public UpdateSpec getUpdateSpec() {
+        return updateSpec;
+    }
+
+    public void setUpdateSpec(UpdateSpec updateSpec) {
+        this.updateSpec = updateSpec;
+    }
+
+    public ProbeSpec getLivenessProbeSpec() {return livenessProbeSpec;}
+
+    public void setLivenessProbeSpec(ProbeSpec livenessProbeSpec) {
+        this.livenessProbeSpec = livenessProbeSpec;
+    }
+
+    public ProbeSpec getReadinessProbeSpec() {return readinessProbeSpec;}
+
+    public void setReadinessProbeSpec(ProbeSpec readinessProbeSpec) {
+        this.readinessProbeSpec = readinessProbeSpec;
+    }
+
+    public ProbeSpec getStartupProbeSpec() {return startupProbeSpec;}
+
+    public void setStartupProbeSpec(ProbeSpec startupProbeSpec) {
+        this.startupProbeSpec = startupProbeSpec;
+    }
 }
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatus.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatus.java
index aa9c96044065..5eb24f6b9faa 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatus.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatus.java
@@ -24,14 +24,13 @@
 
 import io.fabric8.kubernetes.model.annotation.LabelSelector;
 import io.fabric8.kubernetes.model.annotation.StatusReplicas;
-import io.javaoperatorsdk.operator.api.ObservedGenerationAware;
 import io.sundr.builder.annotations.Buildable;
 
 /**
  * @author Vaclav Muzikar <vmuzikar@redhat.com>
  */
 @Buildable(editableEnabled = false, builderPackage = "io.fabric8.kubernetes.api.builder", lazyCollectionInitEnabled = false)
-public class KeycloakStatus implements ObservedGenerationAware {
+public class KeycloakStatus {
 
     @LabelSelector
     private String selector;
@@ -77,12 +76,10 @@ public boolean isReady() {
         return findCondition(KeycloakStatusCondition.READY).map(KeycloakStatusCondition::getStatus).orElse(false);
     }
 
-    @Override
     public Long getObservedGeneration() {
         return observedGeneration;
     }
 
-    @Override
     public void setObservedGeneration(Long generation) {
         this.observedGeneration = generation;
     }
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusAggregator.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusAggregator.java
index 892327f16b63..6ba0df3c3aa1 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusAggregator.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusAggregator.java
@@ -35,6 +35,7 @@ public class KeycloakStatusAggregator {
     private final KeycloakStatusCondition readyCondition = new KeycloakStatusCondition();
     private final KeycloakStatusCondition hasErrorsCondition = new KeycloakStatusCondition();
     private final KeycloakStatusCondition rollingUpdate = new KeycloakStatusCondition();
+    private final KeycloakStatusCondition updateType = new KeycloakStatusCondition();
 
     private final List<String> notReadyMessages = new ArrayList<>();
     private final List<String> errorMessages = new ArrayList<>();
@@ -64,7 +65,6 @@ public KeycloakStatusAggregator(KeycloakStatus current, Long generation) {
             existingConditions = Map.of();
         }
 
-        // we're not setting this on the statusBuilder as we're letting the sdk manage that
         observedGeneration = generation;
 
         readyCondition.setType(KeycloakStatusCondition.READY);
@@ -72,6 +72,8 @@ public KeycloakStatusAggregator(KeycloakStatus current, Long generation) {
         hasErrorsCondition.setType(KeycloakStatusCondition.HAS_ERRORS);
 
         rollingUpdate.setType(KeycloakStatusCondition.ROLLING_UPDATE);
+
+        updateType.setType(KeycloakStatusCondition.UPDATE_TYPE);
     }
 
     public KeycloakStatusAggregator addNotReadyMessage(String message) {
@@ -101,6 +103,18 @@ public KeycloakStatusAggregator addRollingUpdateMessage(String message) {
         return this;
     }
 
+    public void addUpdateType(boolean recreate, String message) {
+        updateType.setStatus(recreate);
+        updateType.setObservedGeneration(observedGeneration);
+        updateType.setMessage(message);
+    }
+
+    public void resetUpdateType() {
+        updateType.setStatus(null);
+        updateType.setObservedGeneration(observedGeneration);
+        updateType.setMessage(null);
+    }
+
     /**
      * Apply non-condition changes to the status
      */
@@ -143,8 +157,12 @@ public KeycloakStatus build() {
         updateConditionFromExisting(readyCondition, existingConditions, now);
         updateConditionFromExisting(hasErrorsCondition, existingConditions, now);
         updateConditionFromExisting(rollingUpdate, existingConditions, now);
+        updateConditionFromExisting(updateType, existingConditions, now);
 
-        return statusBuilder.withConditions(List.of(readyCondition, hasErrorsCondition, rollingUpdate)).build();
+        return statusBuilder
+                .withObservedGeneration(observedGeneration)
+                .withConditions(List.of(readyCondition, hasErrorsCondition, rollingUpdate, updateType))
+                .build();
     }
 
     static void updateConditionFromExisting(KeycloakStatusCondition condition, Map<String, KeycloakStatusCondition> existingConditions, String now) {
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusCondition.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusCondition.java
index 3cd58a101d5e..acb69e3465c0 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusCondition.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakStatusCondition.java
@@ -26,4 +26,5 @@ public class KeycloakStatusCondition extends StatusCondition {
     public static final String READY = "Ready";
     public static final String HAS_ERRORS = "HasErrors";
     public static final String ROLLING_UPDATE = "RollingUpdate";
+    public static final String UPDATE_TYPE = "RecreateUpdateUsed";
 }
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/HttpSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/HttpSpec.java
index 1cd6a12c8f2c..263b1e004f92 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/HttpSpec.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/HttpSpec.java
@@ -18,11 +18,14 @@
 package org.keycloak.operator.crds.v2alpha1.deployment.spec;
 
 import java.util.Optional;
+import java.util.Map;
+
+import org.keycloak.operator.Constants;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonPropertyDescription;
+
 import io.sundr.builder.annotations.Buildable;
-import org.keycloak.operator.Constants;
 import org.keycloak.operator.crds.v2alpha1.CRDUtils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakSpec;
@@ -45,6 +48,12 @@ public class HttpSpec {
     @JsonPropertyDescription("The used HTTPS port.")
     private Integer httpsPort = Constants.KEYCLOAK_HTTPS_PORT;
 
+    @JsonPropertyDescription("Annotations to be appended to the Service object")
+    Map<String, String> annotations;
+
+    @JsonPropertyDescription("Labels to be appended to the Service object")
+    Map<String, String> labels;
+
     public String getTlsSecret() {
         return tlsSecret;
     }
@@ -95,4 +104,20 @@ private static Optional<HttpSpec> httpSpec(Keycloak keycloak) {
                 .map(KeycloakSpec::getHttpSpec);
     }
 
+    public Map<String, String> getAnnotations() {
+        return annotations;
+    }
+
+    public void setAnnotations(Map<String, String> annotations) {
+        this.annotations = annotations;
+    }
+
+    public Map<String, String> getLabels() {
+        return labels;
+    }
+
+    public void setLabels(Map<String, String> labels) {
+        this.labels = labels;
+    }
+    
 }
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/NetworkPolicySpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/NetworkPolicySpec.java
index fac1a5151587..48cbb6fbea9a 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/NetworkPolicySpec.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/NetworkPolicySpec.java
@@ -23,6 +23,7 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonPropertyDescription;
+import io.fabric8.generator.annotation.Default;
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer;
 import io.sundr.builder.annotations.Buildable;
 import org.keycloak.operator.Constants;
@@ -41,8 +42,9 @@ public class NetworkPolicySpec {
             "If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.";
 
     @JsonProperty("enabled")
-    @JsonPropertyDescription("Enables or disable the ingress traffic control.")
-    private boolean networkPolicyEnabled = false;
+    @JsonPropertyDescription("Enables or disables the ingress traffic control.")
+    @Default("true")
+    private boolean networkPolicyEnabled = true;
 
     @JsonProperty("http")
     @JsonPropertyDescription(RULE_DESCRIPTION)
@@ -96,7 +98,7 @@ public static Optional<NetworkPolicySpec> networkPolicySpecOf(Keycloak keycloak)
     public static boolean isNetworkPolicyEnabled(Keycloak keycloak) {
         return networkPolicySpecOf(keycloak)
                 .map(NetworkPolicySpec::isNetworkPolicyEnabled)
-                .orElse(false);
+                .orElse(true);
     }
 
     public static String networkPolicyName(Keycloak keycloak) {
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/ProbeSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/ProbeSpec.java
new file mode 100644
index 000000000000..21f873442fde
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/ProbeSpec.java
@@ -0,0 +1,22 @@
+package org.keycloak.operator.crds.v2alpha1.deployment.spec;
+
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.sundr.builder.annotations.Buildable;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@Buildable(editableEnabled = false, builderPackage = "io.fabric8.kubernetes.api.builder")
+public class ProbeSpec {
+
+    @JsonProperty("periodSeconds")
+    private int probePeriodSeconds;
+
+    @JsonProperty("failureThreshold")
+    private int probeFailureThreshold;
+
+    public int getProbeFailureThreshold() {return probeFailureThreshold;}
+    public void setProbeFailureThreshold(int probeFailureThreshold) {this.probeFailureThreshold = probeFailureThreshold;}
+    public int getProbePeriodSeconds() {return probePeriodSeconds;}
+    public void setProbePeriodSeconds(int probePeriodSeconds) {this.probePeriodSeconds = probePeriodSeconds;}
+}
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/TracingSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/TracingSpec.java
index 67aaa7ad3785..7353492a47c5 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/TracingSpec.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/TracingSpec.java
@@ -45,7 +45,7 @@ public class TracingSpec {
     @JsonPropertyDescription("OpenTelemetry sampler to use for tracing (default 'traceidratio'). For more information, check the Tracing guide.")
     private String samplerType;
 
-    @JsonPropertyDescription("OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected double value in interval <0,1).")
+    @JsonPropertyDescription("OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected double value in interval [0,1].")
     private Double samplerRatio;
 
     @JsonPropertyDescription("OpenTelemetry compression method used to compress payloads. If unset, compression is disabled. Possible values are: gzip, none.")
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UnsupportedSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UnsupportedSpec.java
index ff7d81bd5682..523a9c18f49f 100644
--- a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UnsupportedSpec.java
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UnsupportedSpec.java
@@ -31,9 +31,10 @@
 })
 public class UnsupportedSpec {
 
-    @JsonPropertyDescription("You can configure that will be merged with the one configured by default by the operator.\n" +
-            "Use at your own risk, we reserve the possibility to remove/change the way any field gets merged in future releases without notice.\n" +
-            "Reference: https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates")
+    @JsonPropertyDescription("""
+            You can configure that will be merged with the one configured by default by the operator.
+            Use at your own risk, we reserve the possibility to remove/change the way any field gets merged in future releases without notice.
+            Reference: https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates""")
     private PodTemplateSpec podTemplate;
 
     public UnsupportedSpec() {}
@@ -46,7 +47,7 @@ public PodTemplateSpec getPodTemplate() {
         return podTemplate;
     }
 
-    public void setPodTeplate(PodTemplateSpec podTemplate) {
+    public void setPodTemplate(PodTemplateSpec podTemplate) {
         this.podTemplate = podTemplate;
     }
 
diff --git a/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UpdateSpec.java b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UpdateSpec.java
new file mode 100644
index 000000000000..24afa3420469
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/UpdateSpec.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.crds.v2alpha1.deployment.spec;
+
+import java.util.Optional;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonPropertyDescription;
+import io.fabric8.generator.annotation.Default;
+import io.fabric8.generator.annotation.ValidationRule;
+import io.sundr.builder.annotations.Buildable;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakSpec;
+import org.keycloak.operator.update.UpdateStrategy;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@Buildable(editableEnabled = false, builderPackage = "io.fabric8.kubernetes.api.builder")
+@ValidationRule(
+        value = "self.strategy != 'Explicit' || has(self.revision)",
+        message = "The 'revision' field is required when 'Explicit' strategy is used"
+)
+public class UpdateSpec {
+
+    // those are the default, keep them in sync.
+    private static final UpdateStrategy DEFAULT = UpdateStrategy.RECREATE_ON_IMAGE_CHANGE;
+    private static final String DEFAULT_JSON = "RecreateOnImageChange";
+
+    @JsonPropertyDescription("Sets the update strategy to use.")
+    @Default(DEFAULT_JSON)
+    private UpdateStrategy strategy;
+
+    @JsonPropertyDescription("When use the Explicit strategy, the revision signals if a rolling update can be used or not.")
+    private String revision;
+
+    public UpdateStrategy getStrategy() {
+        return strategy;
+    }
+
+    public void setStrategy(UpdateStrategy strategy) {
+        this.strategy = strategy;
+    }
+
+    public String getRevision() {
+        return revision;
+    }
+
+    public void setRevision(String revision) {
+        this.revision = revision;
+    }
+
+    public static UpdateStrategy getUpdateStrategy(Keycloak keycloak) {
+        return CRDUtils.keycloakSpecOf(keycloak)
+                .map(KeycloakSpec::getUpdateSpec)
+                .map(UpdateSpec::getStrategy)
+                .orElse(DEFAULT);
+    }
+
+    public static Optional<String> getRevision(Keycloak keycloak) {
+        return CRDUtils.keycloakSpecOf(keycloak)
+                .map(KeycloakSpec::getUpdateSpec)
+                .map(UpdateSpec::getRevision);
+    }
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/UpdateLogic.java b/operator/src/main/java/org/keycloak/operator/update/UpdateLogic.java
new file mode 100644
index 000000000000..3d5c92beb43a
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/UpdateLogic.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update;
+
+import java.util.Optional;
+
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusAggregator;
+
+/**
+ * An API to implement to handle Keycloak CR updates.
+ * <p>
+ * This interface is invoked all the time before creating the {@link StatefulSet} and it can manipulate the
+ * reconciliation to perform or check other tasks required before the {@link StatefulSet} is created or updated.
+ */
+public interface UpdateLogic {
+
+    /**
+     * It must check is an existing {@link StatefulSet} exists and decided on the {@link UpdateType} to update the
+     * {@link StatefulSet}.
+     * <p>
+     * The method should use {@link org.keycloak.operator.ContextUtils#storeUpdateType(Context, UpdateType, String)} to store
+     * its decision. If no prior {@link StatefulSet} is present, no decision is required and
+     * {@link org.keycloak.operator.ContextUtils#storeUpdateType(Context, UpdateType, String)} must not be invoked.
+     * <p>
+     * Return a non-empty {@link Optional} to interrupt the reconciliation until the next event. The interrupted
+     * prevents the {@link StatefulSet} from being updated.
+     *
+     * @return The {@link UpdateControl} if the reconciliation needs to be interrupted or an empty {@link Optional} if
+     * it can proceed.
+     */
+    Optional<UpdateControl<Keycloak>> decideUpdate();
+
+    /**
+     * Updates the Keycloak CR status.
+     *
+     * @param statusAggregator The {@link KeycloakStatusAggregator} to update.
+     */
+    void updateStatus(KeycloakStatusAggregator statusAggregator);
+
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/UpdateLogicFactory.java b/operator/src/main/java/org/keycloak/operator/update/UpdateLogicFactory.java
new file mode 100644
index 000000000000..25bc423b6451
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/UpdateLogicFactory.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update;
+
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.UpdateSpec;
+import org.keycloak.operator.update.impl.AutoUpdateLogic;
+import org.keycloak.operator.update.impl.ExplicitUpdateLogic;
+import org.keycloak.operator.update.impl.RecreateOnImageChangeUpdateLogic;
+
+/**
+ * The {@link UpdateLogic} factory. It returns an implementation based on the {@link Keycloak} configuration.
+ */
+@ApplicationScoped
+public class UpdateLogicFactory {
+    @Inject
+    KeycloakUpdateJobDependentResource updateJobDependentResource;
+
+    public UpdateLogic create(Keycloak keycloak, Context<Keycloak> context) {
+        var strategy = UpdateSpec.getUpdateStrategy(keycloak);
+        return switch (strategy) {
+            case RECREATE_ON_IMAGE_CHANGE -> new RecreateOnImageChangeUpdateLogic(context, keycloak);
+            case AUTO -> new AutoUpdateLogic(context, keycloak, updateJobDependentResource);
+            case EXPLICIT -> new ExplicitUpdateLogic(context, keycloak);
+        };
+    }
+
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/UpdateStrategy.java b/operator/src/main/java/org/keycloak/operator/update/UpdateStrategy.java
new file mode 100644
index 000000000000..adc5134d5b54
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/UpdateStrategy.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public enum UpdateStrategy {
+
+    @JsonProperty("RecreateOnImageChange")
+    RECREATE_ON_IMAGE_CHANGE,
+
+    @JsonProperty("Auto")
+    AUTO,
+
+    @JsonProperty("Explicit")
+    EXPLICIT
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/UpdateType.java b/operator/src/main/java/org/keycloak/operator/update/UpdateType.java
new file mode 100644
index 000000000000..c02dfdc02fa2
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/UpdateType.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update;
+
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import org.keycloak.operator.controllers.KeycloakDeploymentDependentResource;
+
+/**
+ * Supported update types by {@link KeycloakDeploymentDependentResource}.
+ */
+public enum UpdateType {
+    /**
+     * Shutdown the existing cluster before updating the {@link StatefulSet}.
+     */
+    RECREATE,
+    /**
+     * Updates the {@link StatefulSet} and does a rolling update.
+     */
+    ROLLING
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/impl/AutoUpdateLogic.java b/operator/src/main/java/org/keycloak/operator/update/impl/AutoUpdateLogic.java
new file mode 100644
index 000000000000..ee6fe444ed8a
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/impl/AutoUpdateLogic.java
@@ -0,0 +1,188 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update.impl;
+
+import java.util.Collection;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Stream;
+
+import io.fabric8.kubernetes.api.model.ContainerState;
+import io.fabric8.kubernetes.api.model.ContainerStateTerminated;
+import io.fabric8.kubernetes.api.model.ContainerStatus;
+import io.fabric8.kubernetes.api.model.Pod;
+import io.fabric8.kubernetes.api.model.PodStatus;
+import io.fabric8.kubernetes.api.model.batch.v1.Job;
+import io.fabric8.kubernetes.client.KubernetesClient;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import io.quarkus.logging.Log;
+import org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+
+public class AutoUpdateLogic extends BaseUpdateLogic {
+
+    private final KeycloakUpdateJobDependentResource updateJobResource;
+
+    public AutoUpdateLogic(Context<Keycloak> context, Keycloak keycloak, KeycloakUpdateJobDependentResource updateJobResource) {
+        super(context, keycloak);
+        this.updateJobResource = updateJobResource;
+    }
+
+    @Override
+    Optional<UpdateControl<Keycloak>> onUpdate() {
+        var existingJob = context.getSecondaryResource(Job.class);
+        if (existingJob.isEmpty()) {
+            updateJobResource.reconcile(keycloak, context);
+            Log.debug("Creating Update Job");
+            return Optional.of(UpdateControl.noUpdate());
+        }
+
+        // Keycloak CR may be updated while the job is running; we need to delete and start over.
+        if (!KeycloakUpdateJobDependentResource.isJobFromCurrentKeycloakCr(existingJob.get(), keycloak)) {
+            context.getClient().resource(existingJob.get()).lockResourceVersion().delete();
+            return Optional.of(UpdateControl.noUpdate());
+        }
+
+        if (isJobRunning(existingJob.get())) {
+            Log.debug("Update Job is running. Waiting until terminated.");
+            return Optional.of(UpdateControl.noUpdate());
+        }
+
+        var pod = findPodForJob(context.getClient(), existingJob.get());
+        if (pod.isEmpty()) {
+            // TODO some cases the pod is removed. Do we start over or use recreate update?
+            Log.warn("Pod for Update Job not found.");
+            decideRecreateUpdate("The Pod running update-compatibility command not found.");
+            return Optional.empty();
+        }
+
+        checkUpdateType(pod.get());
+        return Optional.empty();
+    }
+
+    private boolean isJobRunning(Job job) {
+        var status = job.getStatus();
+        Log.debugf("Update Job Status:%n%s", CRDUtils.toJsonNode(status, context).toPrettyString());
+        var completed = Optional.ofNullable(status).stream()
+                .mapMultiToInt((jobStatus, downstream) -> {
+                    if (jobStatus.getSucceeded() != null) {
+                        downstream.accept(jobStatus.getSucceeded());
+                    }
+                    if (jobStatus.getFailed() != null) {
+                        downstream.accept(jobStatus.getFailed());
+                    }
+                }).sum();
+        // we only have a single pod, so completed will be zero if running or 1 if finished.
+        return completed == 0;
+    }
+
+    private void checkUpdateType(Pod pod) {
+        // check init container.
+        var initContainerExitCode = initContainer(pod)
+                .map(AutoUpdateLogic::exitCode);
+        if (initContainerExitCode.isEmpty()) {
+            Log.warn("InitContainer not found for Update Job.");
+            decideRecreateUpdate("InitContainer running update-compatibility command not found. Did it crash? Check update job for details.");
+            return;
+        }
+        if (initContainerExitCode.get() != 0) {
+            if (initContainerExitCode.get() == 4) {
+                Log.warn("Feature 'rolling-update' not enabled.");
+                decideRecreateUpdate("Feature 'rolling-update' not enabled.");
+                return;
+            }
+            Log.warn("InitContainer unexpectedly failed for Update Job.");
+            decideRecreateUpdate("Unexpected update-compatibility command exit code (%s). Check update job for details.".formatted(initContainerExitCode.get()));
+            return;
+        }
+
+        // check container.
+        var containerExitCode = container(pod)
+                .map(AutoUpdateLogic::exitCode);
+        if (containerExitCode.isEmpty()) {
+            Log.warn("Container not found for Update Job.");
+            decideRecreateUpdate("Container running update-compatibility command not found. Did it crash?");
+            return;
+        }
+        switch (containerExitCode.get()) {
+            case 0: {
+                decideRollingUpdate("Compatible changes detected.");
+                return;
+            }
+            case 1: {
+                Log.warn("Container has an unexpected error for Update Job");
+                decideRecreateUpdate("Unexpected update-compatibility command error. Check update job for details.");
+                return;
+            }
+            case 2: {
+                Log.warn("Container has an invalid arguments for Update Job.");
+                decideRecreateUpdate("Invalid arguments in update-compatibility command. Check update job for details.");
+                return;
+            }
+            case 3: {
+                Log.warn("Rolling Update not possible.");
+                decideRecreateUpdate("Incompatible changes detected. Check update job for details.");
+                return;
+            }
+            case 4: {
+                Log.warn("Feature 'rolling-update' not enabled.");
+                decideRecreateUpdate("Feature 'rolling-update' not enabled.");
+                return;
+            }
+            default: {
+                Log.warnf("Unexpected Update Job exit code: %s", containerExitCode.get());
+                decideRecreateUpdate("Unexpected update-compatibility command exit code (%s). Check update job for details.".formatted(containerExitCode.get()));
+            }
+        }
+    }
+
+    public static Optional<Pod> findPodForJob(KubernetesClient client, Job job) {
+        return client.pods()
+                .inNamespace(job.getMetadata().getNamespace())
+                .withLabelSelector(Objects.requireNonNull(job.getSpec().getSelector()))
+                .list()
+                .getItems()
+                .stream()
+                .findFirst();
+    }
+
+    private static Optional<ContainerStatus> initContainer(Pod pod) {
+        return java.util.Optional.ofNullable(pod.getStatus())
+                .map(PodStatus::getInitContainerStatuses)
+                .map(Collection::stream)
+                .flatMap(Stream::findFirst);
+    }
+
+    public static Optional<ContainerStatus> container(Pod pod) {
+        return java.util.Optional.ofNullable(pod.getStatus())
+                .map(PodStatus::getContainerStatuses)
+                .map(Collection::stream)
+                .flatMap(Stream::findFirst);
+    }
+
+    public static int exitCode(ContainerStatus containerStatus) {
+        return Optional.ofNullable(containerStatus)
+                .map(ContainerStatus::getState)
+                .map(ContainerState::getTerminated)
+                .map(ContainerStateTerminated::getExitCode)
+                .orElse(1);
+    }
+
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/impl/BaseUpgradeLogic.java b/operator/src/main/java/org/keycloak/operator/update/impl/BaseUpgradeLogic.java
new file mode 100644
index 000000000000..26e733b33521
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/impl/BaseUpgradeLogic.java
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update.impl;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import io.fabric8.kubernetes.api.model.Container;
+import io.fabric8.kubernetes.api.model.EnvVar;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import io.quarkus.logging.Log;
+import org.keycloak.operator.ContextUtils;
+import org.keycloak.operator.controllers.KeycloakDeploymentDependentResource;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusAggregator;
+import org.keycloak.operator.update.UpdateLogic;
+import org.keycloak.operator.update.UpdateType;
+
+/**
+ * Common {@link UpdateLogic} implementation that checks if the update logic needs to be run.
+ * <p>
+ * The update logic can be skipped if it is the first deployment or if the change is not relevance (like, updating the
+ * number of replicas or annotations).
+ */
+abstract class BaseUpdateLogic implements UpdateLogic {
+
+    protected final Context<Keycloak> context;
+    protected final Keycloak keycloak;
+    private Consumer<KeycloakStatusAggregator> statusConsumer = KeycloakStatusAggregator::resetUpdateType;
+
+    BaseUpdateLogic(Context<Keycloak> context, Keycloak keycloak) {
+        this.context = context;
+        this.keycloak = keycloak;
+    }
+
+    @Override
+    public final Optional<UpdateControl<Keycloak>> decideUpdate() {
+        var existing = ContextUtils.getCurrentStatefulSet(context);
+        if (existing.isEmpty()) {
+            // new deployment, no update needed
+            Log.debug("New deployment - skipping update logic");
+            return Optional.empty();
+        }
+        copyStatusFromExistStatefulSet(existing.get());
+
+        var desiredStatefulSet = ContextUtils.getDesiredStatefulSet(context);
+        var desiredContainer = CRDUtils.firstContainerOf(desiredStatefulSet).orElseThrow(BaseUpdateLogic::containerNotFound);
+        var actualContainer = CRDUtils.firstContainerOf(existing.get()).orElseThrow(BaseUpdateLogic::containerNotFound);
+
+        if (isContainerEquals(actualContainer, desiredContainer)) {
+            // container is equals, no update required
+            Log.debug("No changes detected in the container - skipping update logic");
+            return Optional.empty();
+        }
+
+        return onUpdate();
+    }
+
+    @Override
+    public final void updateStatus(KeycloakStatusAggregator statusAggregator) {
+        statusConsumer.accept(statusAggregator);
+    }
+
+    /**
+     * Concrete update logic should be implemented here.
+     * <p>
+     * Use {@link ContextUtils#getCurrentStatefulSet(Context)} and/or
+     * {@link ContextUtils#getDesiredStatefulSet(Context)} to get the current and the desired {@link StatefulSet},
+     * respectively.
+     * <p>
+     * Use the methods {@link #decideRecreateUpdate(String)} or {@link #decideRollingUpdate(String)} to use one of the available
+     * update logics.
+     *
+     * @return An {@link UpdateControl} if the reconciliation must be interrupted before updating the
+     * {@link StatefulSet}.
+     */
+    abstract Optional<UpdateControl<Keycloak>> onUpdate();
+
+    private void copyStatusFromExistStatefulSet(StatefulSet current) {
+        var maybeRecreate = CRDUtils.fetchIsRecreateUpdate(current);
+        if (maybeRecreate.isEmpty()) {
+            return;
+        }
+        var reason = CRDUtils.findUpdateReason(current).orElseThrow();
+        var recreate = maybeRecreate.get();
+        statusConsumer = statusAggregator -> statusAggregator.addUpdateType(recreate, reason);
+    }
+
+    void decideRollingUpdate(String reason) {
+        Log.debugf("Decided rolling update type. Reason: %s", reason);
+        statusConsumer = status -> status.addUpdateType(false, reason);
+        ContextUtils.storeUpdateType(context, UpdateType.ROLLING, reason);
+    }
+
+    void decideRecreateUpdate(String reason) {
+        Log.debugf("Decided recreate update type. Reason: %s", reason);
+        statusConsumer = status -> status.addUpdateType(true, reason);
+        ContextUtils.storeUpdateType(context, UpdateType.RECREATE, reason);
+    }
+
+    static IllegalStateException containerNotFound() {
+        return new IllegalStateException("Container not found in stateful set.");
+    }
+
+    private static boolean isContainerEquals(Container actual, Container desired) {
+        return isImageEquals(actual, desired) &&
+                isArgsEquals(actual, desired) &&
+                isEnvEquals(actual, desired);
+    }
+
+    private static boolean isImageEquals(Container actual, Container desired) {
+        return isEquals("image", actual.getImage(), desired.getImage());
+    }
+
+    private static boolean isArgsEquals(Container actual, Container desired) {
+        return isEquals("args", actual.getArgs(), desired.getArgs());
+    }
+
+    private static boolean isEnvEquals(Container actual, Container desired) {
+        var actualEnv = envVars(actual);
+        var desiredEnv = envVars(desired);
+        return isEquals("env", actualEnv, desiredEnv);
+    }
+
+    private static Map<String, EnvVar> envVars(Container container) {
+        // The operator only sets value or secrets. Any other combination is from unsupported pod template.
+        return container.getEnv().stream()
+                .filter(envVar -> !envVar.getName().equals(KeycloakDeploymentDependentResource.POD_IP))
+                .collect(Collectors.toMap(EnvVar::getName, Function.identity()));
+    }
+
+    private static <T> boolean isEquals(String key, T actual, T desired) {
+        var isEquals = Objects.equals(actual, desired);
+        if (!isEquals) {
+            Log.debugf("Found difference in container's %s:%nactual:%s%ndesired:%s", key, actual, desired);
+        }
+        return isEquals;
+    }
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/impl/ExplicitUpdateLogic.java b/operator/src/main/java/org/keycloak/operator/update/impl/ExplicitUpdateLogic.java
new file mode 100644
index 000000000000..453b83b72b7c
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/impl/ExplicitUpdateLogic.java
@@ -0,0 +1,42 @@
+package org.keycloak.operator.update.impl;
+
+import java.util.Objects;
+import java.util.Optional;
+
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import org.keycloak.operator.ContextUtils;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.UpdateSpec;
+
+/**
+ * Implements an explicit update logic.
+ * <p>
+ * The decision is controlled by an outside actor using the revision field.
+ */
+public class ExplicitUpdateLogic extends BaseUpdateLogic {
+
+    public ExplicitUpdateLogic(Context<Keycloak> context, Keycloak keycloak) {
+        super(context, keycloak);
+    }
+
+    @Override
+    Optional<UpdateControl<Keycloak>> onUpdate() {
+        var maybeCurrentRevision = CRDUtils.getRevision(ContextUtils.getCurrentStatefulSet(context).orElseThrow());
+
+        if (maybeCurrentRevision.isEmpty()) {
+            decideRecreateUpdate("Explicit strategy configured. Revision annotation not present in stateful set.");
+            return Optional.empty();
+        }
+        // CRD validation ensures the revision is present
+        var desiredRevision = UpdateSpec.getRevision(keycloak).orElseThrow();
+        if (Objects.equals(maybeCurrentRevision.get(), desiredRevision)) {
+            decideRollingUpdate("Explicit strategy configured. Revision matches.");
+            return Optional.empty();
+        }
+
+        decideRecreateUpdate("Explicit strategy configured. Revision (%s) does not match (%s).".formatted(maybeCurrentRevision.get(), desiredRevision));
+        return Optional.empty();
+    }
+}
diff --git a/operator/src/main/java/org/keycloak/operator/update/impl/RecreateOnImageChangeUpdateLogic.java b/operator/src/main/java/org/keycloak/operator/update/impl/RecreateOnImageChangeUpdateLogic.java
new file mode 100644
index 000000000000..b405daf70afc
--- /dev/null
+++ b/operator/src/main/java/org/keycloak/operator/update/impl/RecreateOnImageChangeUpdateLogic.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.update.impl;
+
+import java.util.Objects;
+import java.util.Optional;
+
+import io.fabric8.kubernetes.api.model.Container;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import org.keycloak.operator.ContextUtils;
+import org.keycloak.operator.crds.v2alpha1.CRDUtils;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.update.UpdateType;
+
+/**
+ * Implements Keycloak 26.0 logic.
+ * <p>
+ * It uses a {@link UpdateType#RECREATE} if the image changes; otherwise uses {@link UpdateType#ROLLING}.
+ */
+public class RecreateOnImageChangeUpdateLogic extends BaseUpdateLogic {
+
+    public RecreateOnImageChangeUpdateLogic(Context<Keycloak> context, Keycloak keycloak) {
+        super(context, keycloak);
+    }
+
+    @Override
+    Optional<UpdateControl<Keycloak>> onUpdate() {
+        var currentImage = extractImage(ContextUtils.getCurrentStatefulSet(context).orElseThrow());
+        var desiredImage = extractImage(ContextUtils.getDesiredStatefulSet(context));
+
+        if (Objects.equals(currentImage, desiredImage)) {
+            decideRollingUpdate("Image unchanged.");
+        } else {
+            decideRecreateUpdate("Image changed %s -> %s".formatted(currentImage, desiredImage));
+        }
+        return Optional.empty();
+    }
+
+    public static String extractImage(StatefulSet statefulSet) {
+        return CRDUtils.firstContainerOf(statefulSet)
+                .map(Container::getImage)
+                .orElseThrow(BaseUpdateLogic::containerNotFound);
+    }
+
+}
diff --git a/operator/src/main/resources/application.properties b/operator/src/main/resources/application.properties
index c26236367b7c..85f9b8558e1b 100644
--- a/operator/src/main/resources/application.properties
+++ b/operator/src/main/resources/application.properties
@@ -9,6 +9,8 @@ kc.operator.keycloak.image=${RELATED_IMAGE_KEYCLOAK:quay.io/keycloak/keycloak:ni
 kc.operator.keycloak.image-pull-policy=Always
 kc.operator.keycloak.start-optimized=false
 kc.operator.keycloak.poll-interval-seconds=60
+# Update Pod timeout: 5min
+kc.operator.keycloak.update-pod-deadline-seconds=300
 # Keycloak container default requests/limits resources
 kc.operator.keycloak.resources.requests.memory=1700Mi
 kc.operator.keycloak.resources.limits.memory=2Gi
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/ApiServerHelper.java b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/ApiServerHelper.java
new file mode 100644
index 000000000000..e30e61c7edf1
--- /dev/null
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/ApiServerHelper.java
@@ -0,0 +1,90 @@
+package org.keycloak.operator.testsuite.apiserver;
+
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+
+import org.keycloak.operator.Utils;
+
+import io.fabric8.kubeapitest.KubeAPIServer;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.client.Config;
+import io.fabric8.kubernetes.client.KubernetesClient;
+import io.fabric8.kubernetes.client.KubernetesClientBuilder;
+import io.fabric8.kubernetes.client.informers.ResourceEventHandler;
+
+public class ApiServerHelper {
+
+    private KubeAPIServer kubeApi;
+
+    public ApiServerHelper() {
+        kubeApi = new KubeAPIServer();
+        kubeApi.start();
+    }
+
+    public void stop() {
+        kubeApi.stop();
+    }
+
+    public KubernetesClient createClient(String namespace) {
+        Config config = Config.fromKubeconfig(kubeApi.getKubeConfigYaml());
+        config.setNamespace(namespace);
+        var result = new KubernetesClientBuilder().withConfig(config).build();
+
+        // fake statefulset controller - we don't have to worry about closing this
+        // that will happen automatically when the client is closed
+        result.apps().statefulSets().inAnyNamespace().inform(new ResourceEventHandler<StatefulSet>() {
+
+            @Override
+            public void onAdd(StatefulSet obj) {
+                updateStatefulSet(obj);
+            }
+
+            private void updateStatefulSet(StatefulSet obj) {
+                int specReplicas = obj.getSpec().getReplicas();
+                int statusReplicas = Optional.ofNullable(obj.getStatus().getReplicas()).orElse(0);
+                String revision = Utils.hash(List.of(obj.getSpec())).substring(1);
+                String updateRevision = obj.getStatus().getUpdateRevision();
+
+                if (statusReplicas != specReplicas
+                        || !Objects.equals(revision, updateRevision)
+                        || !Objects.equals(obj.getStatus().getCurrentRevision(), updateRevision)) {
+                    // generate intermediate rolling events
+                    int actualReplicas;
+                    if (!Objects.equals(revision, updateRevision)) { // detected spec change, mimic rolling update
+                        // this is not fully accurate as it's rather recreate than rolling update,
+                        // but thanks to gradual scaling up it emits more events which is closer to the real behavior
+                        actualReplicas = 0;
+                    } else if (specReplicas == 0) { // probably recreate update requested, scaling down the deployment
+                        actualReplicas = Math.max(0, statusReplicas - 1);
+                    } else {
+                        actualReplicas = Math.min(specReplicas, statusReplicas + 1); // otherwise, just scale up
+                    }
+                    obj = result.getKubernetesSerialization().clone(obj);
+                    obj.getStatus().setReplicas(actualReplicas);
+                    obj.getStatus().setReadyReplicas(actualReplicas);
+                    obj.getStatus().setUpdateRevision(revision);
+                    if (actualReplicas == specReplicas) {
+                        obj.getStatus().setCurrentRevision(revision);
+                    }
+                    obj.getMetadata().setResourceVersion(null);
+                    result.resource(obj).updateStatus();
+                }
+            }
+
+            @Override
+            public void onUpdate(StatefulSet oldObj, StatefulSet newObj) {
+                updateStatefulSet(newObj);
+            }
+
+            @Override
+            public void onDelete(StatefulSet obj, boolean deletedFinalStateUnknown) {
+
+            }
+
+        });
+
+        return result;
+    }
+
+}
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/CRDTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/CRDTest.java
similarity index 80%
rename from operator/src/test/java/org/keycloak/operator/testsuite/integration/CRDTest.java
rename to operator/src/test/java/org/keycloak/operator/testsuite/apiserver/CRDTest.java
index c84262843f25..b685b62be1f3 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/CRDTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/CRDTest.java
@@ -15,9 +15,9 @@
  * limitations under the License.
  */
 
-package org.keycloak.operator.testsuite.integration;
+package org.keycloak.operator.testsuite.apiserver;
 
-import io.fabric8.junit.jupiter.api.KubernetesTest;
+import io.fabric8.kubeapitest.junit.EnableKubeAPIServer;
 import io.fabric8.kubernetes.api.model.HasMetadata;
 import io.fabric8.kubernetes.client.KubernetesClient;
 import io.fabric8.kubernetes.client.KubernetesClientException;
@@ -26,6 +26,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusAggregator;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 
@@ -33,12 +34,14 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportBuilder;
+import org.keycloak.operator.testsuite.integration.BaseOperatorTest;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
+import org.keycloak.operator.update.UpdateStrategy;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
-@KubernetesTest
+@EnableKubeAPIServer
 public class CRDTest {
 
     static KubernetesClient client;
@@ -91,6 +94,23 @@ public void testKeycloakWithDefaultReplicas() {
         assertThat(client.resource(kc).create().getSpec().getInstances()).isNull();
     }
 
+    @Test
+    public void testUpdateSpecValidation() {
+        var cr = new KeycloakBuilder()
+                .withNewMetadata()
+                .withName("invalid-keycloak")
+                .endMetadata()
+                .withNewSpec()
+                .withNewUpdateSpec()
+                .withStrategy(UpdateStrategy.EXPLICIT)
+                .endUpdateSpec()
+                .endSpec()
+                .build();
+
+        var eMsg = assertThrows(KubernetesClientException.class, () -> client.resource(cr).create()).getMessage();
+        assertThat(eMsg).contains("spec.update: Invalid value: \"object\": The 'revision' field is required when 'Explicit' strategy is used.");
+    }
+
     private <T extends HasMetadata> void roundTrip(String resourceFile, Class<T> type) {
         // could also test the status, but that is not part of the expected files
         // also to test the status we may need the operator to not be running, which
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/DisabledIfApiServerTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/DisabledIfApiServerTest.java
new file mode 100644
index 000000000000..d362602f0acd
--- /dev/null
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/apiserver/DisabledIfApiServerTest.java
@@ -0,0 +1,15 @@
+package org.keycloak.operator.testsuite.apiserver;
+
+import static java.lang.annotation.ElementType.ANNOTATION_TYPE;
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.ElementType.TYPE;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+@Target({ TYPE, METHOD, ANNOTATION_TYPE })
+@Retention(RUNTIME)
+public @interface DisabledIfApiServerTest {
+
+}
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/BaseOperatorTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/BaseOperatorTest.java
index d9fe8f032b63..f511786c0de4 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/BaseOperatorTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/BaseOperatorTest.java
@@ -17,15 +17,14 @@
 
 package org.keycloak.operator.testsuite.integration;
 
+import io.fabric8.kubernetes.api.model.EnvVar;
 import io.fabric8.kubernetes.api.model.HasMetadata;
 import io.fabric8.kubernetes.api.model.MicroTime;
 import io.fabric8.kubernetes.api.model.NamespaceBuilder;
 import io.fabric8.kubernetes.api.model.Pod;
 import io.fabric8.kubernetes.api.model.Secret;
-import io.fabric8.kubernetes.api.model.Service;
 import io.fabric8.kubernetes.api.model.apps.Deployment;
 import io.fabric8.kubernetes.api.model.apps.StatefulSet;
-import io.fabric8.kubernetes.api.model.batch.v1.Job;
 import io.fabric8.kubernetes.api.model.events.v1.Event;
 import io.fabric8.kubernetes.api.model.rbac.ClusterRoleBinding;
 import io.fabric8.kubernetes.api.model.rbac.RoleBinding;
@@ -41,14 +40,7 @@
 import io.fabric8.kubernetes.client.utils.Serialization;
 import io.javaoperatorsdk.operator.Operator;
 import io.javaoperatorsdk.operator.api.config.BaseConfigurationService;
-import io.javaoperatorsdk.operator.api.config.ControllerConfiguration;
-import io.javaoperatorsdk.operator.api.config.Utils;
-import io.javaoperatorsdk.operator.api.config.dependent.DependentResourceConfigurationResolver;
-import io.javaoperatorsdk.operator.api.config.dependent.DependentResourceSpec;
 import io.javaoperatorsdk.operator.api.reconciler.Reconciler;
-import io.javaoperatorsdk.operator.api.reconciler.dependent.Dependent;
-import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResource;
-import io.javaoperatorsdk.operator.api.reconciler.dependent.DependentResourceFactory;
 import io.quarkiverse.operatorsdk.runtime.QuarkusConfigurationService;
 import io.quarkus.logging.Log;
 import io.quarkus.test.junit.callback.QuarkusTestAfterEachCallback;
@@ -58,15 +50,21 @@
 import org.eclipse.microprofile.config.ConfigProvider;
 import org.jboss.logging.Logger.Level;
 import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.TestInfo;
 import org.keycloak.operator.Constants;
+import org.keycloak.operator.controllers.KeycloakController;
 import org.keycloak.operator.controllers.KeycloakDeploymentDependentResource;
+import org.keycloak.operator.controllers.KeycloakRealmImportController;
+import org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakSpecBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatus;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
+import org.keycloak.operator.testsuite.apiserver.ApiServerHelper;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 import org.opentest4j.TestAbortedException;
 
@@ -86,7 +84,6 @@
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Function;
 import java.util.stream.Collectors;
@@ -102,6 +99,8 @@
 
 public class BaseOperatorTest implements QuarkusTestAfterEachCallback {
 
+  public static final String SLOW = "slow";
+
   public static final String QUARKUS_KUBERNETES_DEPLOYMENT_TARGET = "quarkus.kubernetes.deployment-target";
   public static final String OPERATOR_DEPLOYMENT_PROP = "test.operator.deployment";
   public static final String TARGET_KUBERNETES_GENERATED_YML_FOLDER = "target/kubernetes/";
@@ -112,7 +111,7 @@ public class BaseOperatorTest implements QuarkusTestAfterEachCallback {
   public static final String TEST_RESULTS_DIR = "target/operator-test-results/";
   public static final String POD_LOGS_DIR = TEST_RESULTS_DIR + "pod-logs/";
 
-  public enum OperatorDeployment {local,remote}
+  public enum OperatorDeployment {local_apiserver,local,remote}
 
   protected static OperatorDeployment operatorDeployment;
   protected static QuarkusConfigurationService configuration;
@@ -124,16 +123,26 @@ public enum OperatorDeployment {local,remote}
   private static Operator operator;
   protected static boolean isOpenShift;
 
+  private static ApiServerHelper kubeApi;
+
   @BeforeAll
-  public static void before() throws FileNotFoundException {
+  public static void before(TestInfo testInfo) throws FileNotFoundException {
     configuration = CDI.current().select(QuarkusConfigurationService.class).get();
-    operatorDeployment = ConfigProvider.getConfig().getOptionalValue(OPERATOR_DEPLOYMENT_PROP, OperatorDeployment.class).orElse(OperatorDeployment.local);
+    operatorDeployment = ConfigProvider.getConfig().getOptionalValue(OPERATOR_DEPLOYMENT_PROP, OperatorDeployment.class).orElse(OperatorDeployment.local_apiserver);
+    if (testInfo.getTestClass().map(m -> m.getAnnotation(DisabledIfApiServerTest.class)).isPresent()) {
+      Assumptions.assumeFalse(operatorDeployment == OperatorDeployment.local_apiserver);
+    }
     deploymentTarget = ConfigProvider.getConfig().getOptionalValue(QUARKUS_KUBERNETES_DEPLOYMENT_TARGET, String.class).orElse("kubernetes");
     customImage = ConfigProvider.getConfig().getOptionalValue(OPERATOR_CUSTOM_IMAGE, String.class).orElse(null);
 
     setDefaultAwaitilityTimings();
-    calculateNamespace();
+
+    if (operatorDeployment == OperatorDeployment.local_apiserver) {
+      kubeApi = new ApiServerHelper();
+    }
+
     createK8sClient();
+    createNamespace();
     kubernetesIp = ConfigProvider.getConfig().getOptionalValue(OPERATOR_KUBERNETES_IP, String.class).orElseGet(() -> {
         try {
             return new URL(k8sclient.getConfiguration().getMasterUrl()).getHost();
@@ -143,30 +152,39 @@ public static void before() throws FileNotFoundException {
     });
     Log.info("Creating CRDs");
     createCRDs(k8sclient);
-    createNamespace();
     isOpenShift = isOpenShift(k8sclient);
 
     if (operatorDeployment == OperatorDeployment.remote) {
       createRBACresourcesAndOperatorDeployment();
     } else {
       createOperator();
-      registerReconcilers();
-      operator.start();
     }
 
-    deployDB();
+    if (operatorDeployment == OperatorDeployment.local_apiserver) {
+      deployDBSecret();
+    } else {
+      deployDB();
+    }
   }
 
   @BeforeEach
   public void beforeEach(TestInfo testInfo) {
-    String testClassName = testInfo.getTestClass().map(c -> c.getSimpleName() + ".").orElse("");
-    Log.info("\n------- STARTING: " + testClassName + testInfo.getDisplayName() + "\n"
-            + "------- Namespace: " + namespace + "\n"
-            + "------- Mode: " + ((operatorDeployment == OperatorDeployment.remote) ? "remote" : "local"));
+      if (testInfo.getTestMethod().map(m -> m.getAnnotation(DisabledIfApiServerTest.class)).isPresent()) {
+          Assumptions.assumeTrue(operatorDeployment != OperatorDeployment.local_apiserver);
+      }
+      String testClassName = testInfo.getTestClass().map(c -> c.getSimpleName() + ".").orElse("");
+      Log.info("\n------- STARTING: " + testClassName + testInfo.getDisplayName() + "\n"
+              + "------- Namespace: " + namespace + "\n"
+              + "------- Mode: " + operatorDeployment.name());
   }
 
   private static void createK8sClient() {
-    k8sclient = new KubernetesClientBuilder().withConfig(new ConfigBuilder(Config.autoConfigure(null)).withNamespace(namespace).build()).build();
+      namespace = getNewRandomNamespaceName();
+      if (operatorDeployment == OperatorDeployment.local_apiserver) {
+          k8sclient = kubeApi.createClient(namespace);
+      } else {
+          k8sclient = new KubernetesClientBuilder().withConfig(new ConfigBuilder(Config.autoConfigure(null)).withNamespace(namespace).build()).build();
+      }
   }
 
   private static void createRBACresourcesAndOperatorDeployment() throws FileNotFoundException {
@@ -174,8 +192,11 @@ private static void createRBACresourcesAndOperatorDeployment() throws FileNotFou
     K8sUtils.set(k8sclient, new FileInputStream(TARGET_KUBERNETES_GENERATED_YML_FOLDER + deploymentTarget + ".yml"), obj -> {
         if (obj instanceof ClusterRoleBinding) {
             ((ClusterRoleBinding)obj).getSubjects().forEach(s -> s.setNamespace(namespace));
-        } else if (obj instanceof RoleBinding && "keycloak-operator-view".equals(((RoleBinding)obj).getMetadata().getName())) {
+        } else if (obj instanceof RoleBinding && "keycloak-operator-view".equals(obj.getMetadata().getName())) {
             return null; // exclude this role since it's not present in olm
+        } else if (obj instanceof Deployment) {
+            // set values useful for testing - TODO: could drive this in some way from the test/resource/application.properties
+            ((Deployment)obj).getSpec().getTemplate().getSpec().getContainers().get(0).getEnv().add(new EnvVar("KC_OPERATOR_KEYCLOAK_UPDATE_POD_DEADLINE_SECONDS", "60", null));
         }
         return obj;
     });
@@ -187,7 +208,7 @@ private static void cleanRBACresourcesAndOperatorDeployment() throws FileNotFoun
             .inNamespace(namespace).delete();
   }
 
-  static void createCRDs(KubernetesClient client) throws FileNotFoundException {
+  public static void createCRDs(KubernetesClient client) throws FileNotFoundException {
     K8sUtils.set(client, new FileInputStream(TARGET_KUBERNETES_GENERATED_YML_FOLDER + "keycloaks.k8s.keycloak.org-v1.yml"));
     K8sUtils.set(client, new FileInputStream(TARGET_KUBERNETES_GENERATED_YML_FOLDER + "keycloakrealmimports.k8s.keycloak.org-v1.yml"));
 
@@ -195,17 +216,6 @@ static void createCRDs(KubernetesClient client) throws FileNotFoundException {
     Awaitility.await().pollInterval(100, TimeUnit.MILLISECONDS).untilAsserted(() -> client.resources(KeycloakRealmImport.class).list());
   }
 
-  private static void registerReconcilers() {
-    Log.info("Registering reconcilers for operator : " + operator + " [" + operatorDeployment + "]");
-
-    Instance<Reconciler<? extends HasMetadata>> reconcilers = CDI.current().select(new TypeLiteral<>() {});
-
-    for (Reconciler<?> reconciler : reconcilers) {
-      Log.info("Register and apply : " + reconciler.getClass().getName());
-      operator.register(reconciler, overrider -> overrider.settingNamespace(namespace));
-    }
-  }
-
   private static void createOperator() {
     // create the operator to use the current client / namespace and injected dependent resources
     // to be replaced later with full cdi construction or test mechanics from quarkus operator sdk
@@ -214,25 +224,16 @@ private static void createOperator() {
         public KubernetesClient getKubernetesClient() {
             return k8sclient;
         }
-
-        @Override
-        public DependentResourceFactory dependentResourceFactory() {
-            return new DependentResourceFactory<ControllerConfiguration<?>>() {
-                @Override
-                public DependentResource createFrom(DependentResourceSpec spec,
-                        ControllerConfiguration<?> configuration) {
-                    final var dependentResourceClass = spec.getDependentResourceClass();
-                    // workaround for https://github.com/operator-framework/java-operator-sdk/issues/2010
-                    // create a fresh instance of the dependentresource
-                    CDI.current().destroy(CDI.current().select(dependentResourceClass).get());
-                    DependentResource instance = (DependentResource) CDI.current().select(dependentResourceClass).get();
-                    var context = Utils.contextFor(configuration, dependentResourceClass, Dependent.class);
-                    DependentResourceConfigurationResolver.configure(instance, spec, configuration);
-                    return instance;
-                }
-            };
-        }
     });
+    Log.info("Registering reconcilers for operator : " + operator + " [" + operatorDeployment + "]");
+
+    Instance<Reconciler<? extends HasMetadata>> reconcilers = CDI.current().select(new TypeLiteral<>() {});
+
+    for (Reconciler<?> reconciler : reconcilers) {
+      Log.info("Register and apply : " + reconciler.getClass().getName());
+      operator.register(reconciler, overrider -> overrider.settingNamespace(k8sclient.getNamespace()));
+    }
+    operator.start();
   }
 
   private static void createNamespace() {
@@ -240,10 +241,6 @@ private static void createNamespace() {
     k8sclient.resource(new NamespaceBuilder().withNewMetadata().addToLabels("app","keycloak-test").withName(namespace).endMetadata().build()).create();
   }
 
-  private static void calculateNamespace() {
-    namespace = getNewRandomNamespaceName();
-  }
-
   public static String getNewRandomNamespaceName() {
       return "keycloak-test-" + UUID.randomUUID();
   }
@@ -258,7 +255,7 @@ protected static void deployDB() {
     // Check DB has deployed and ready
     Log.info("Checking Postgres is running");
     Awaitility.await()
-            .untilAsserted(() -> assertThat(k8sclient.apps().statefulSets().inNamespace(namespace).withName(POSTGRESQL_NAME).get().getStatus().getReadyReplicas()).isEqualTo(1));
+            .untilAsserted(() -> assertThat(k8sclient.apps().statefulSets().withName(POSTGRESQL_NAME).get().getStatus().getReadyReplicas()).isEqualTo(1));
   }
 
   protected static void deployDBSecret() {
@@ -268,17 +265,17 @@ protected static void deployDBSecret() {
   protected static void deleteDB() {
     // Delete the Postgres StatefulSet
     Log.infof("Waiting for postgres to be deleted");
-    k8sclient.apps().statefulSets().inNamespace(namespace).withName(POSTGRESQL_NAME).withTimeout(2, TimeUnit.MINUTES).delete();
+    k8sclient.apps().statefulSets().withName(POSTGRESQL_NAME).withTimeout(2, TimeUnit.MINUTES).delete();
   }
 
   // TODO improve this (preferably move to JOSDK)
   protected void savePodLogs() {
     Log.infof("Saving pod logs to %s", POD_LOGS_DIR);
-    for (var pod : k8sclient.pods().inNamespace(namespace).list().getItems()) {
+    for (var pod : k8sclient.pods().list().getItems()) {
       try {
         String podName = pod.getMetadata().getName();
         Log.infof("Processing %s", podName);
-        String podLog = k8sclient.pods().inNamespace(namespace).withName(podName).getLog();
+        String podLog = k8sclient.pods().withName(podName).getLog();
         File file = new File(POD_LOGS_DIR + String.format("%s-%s.txt", namespace, podName)); // using namespace for now, if more tests fail, the log might get overwritten
         file.getAbsoluteFile().getParentFile().mkdirs();
         try (var fw = new FileWriter(file, false)) {
@@ -291,44 +288,42 @@ protected void savePodLogs() {
   }
 
   private static void setDefaultAwaitilityTimings() {
-    Awaitility.setDefaultPollInterval(Duration.ofMillis(500));
-    Awaitility.setDefaultTimeout(Duration.ofSeconds(360));
+    if (operatorDeployment == OperatorDeployment.local_apiserver) {
+        Awaitility.setDefaultPollInterval(Duration.ofMillis(250));
+        Awaitility.setDefaultTimeout(Duration.ofSeconds(60));
+    } else {
+        Awaitility.setDefaultPollInterval(Duration.ofMillis(500));
+        Awaitility.setDefaultTimeout(Duration.ofSeconds(360));
+    }
   }
 
   public void cleanup() {
+      if (operatorDeployment == OperatorDeployment.local_apiserver) {
+          // by default garbage collection is not supported by envtest
+          // so might as well do a namespace per test
+          k8sclient.namespaces().withName(namespace).delete();
+          stopOperator();
+          createNamespace();
+          createOperator();
+          deployDBSecret();
+          return;
+      }
       Log.info("Deleting Keycloak CR");
 
-      // due to https://github.com/operator-framework/java-operator-sdk/issues/2314 we
-      // try to ensure that the operator has processed the delete event from root objects
       // this can be simplified to just the root deletion after we pick up the fix
       // it can be further simplified after https://github.com/fabric8io/kubernetes-client/issues/5838
       // to just a timed foreground deletion
       var roots = List.of(Keycloak.class, KeycloakRealmImport.class);
-      var dependents = List.of(StatefulSet.class, Secret.class, Service.class, Pod.class, Job.class);
-
-      var rootsDeleted = CompletableFuture.allOf(roots.stream()
-              .map(c -> k8sclient.resources(c).informOnCondition(List::isEmpty)).toArray(CompletableFuture[]::new));
-      roots.forEach(c -> k8sclient.resources(c).withGracePeriod(10).delete());
+      roots.forEach(c -> k8sclient.resources(c).delete());
+      // enforce that at least the statefulset / pods are gone
       try {
-          rootsDeleted.get(1, TimeUnit.MINUTES);
+          k8sclient
+                  .apps()
+                  .statefulSets()
+                  .withLabels(Constants.DEFAULT_LABELS).informOnCondition(List::isEmpty).get(20, TimeUnit.SECONDS);
       } catch (Exception e) {
-          // delete event should have arrived quickly because this is a background delete
-          throw new RuntimeException(e);
+          throw KubernetesClientException.launderThrowable(e);
       }
-      dependents.stream().map(c -> k8sclient.resources(c).withLabels(Constants.DEFAULT_LABELS))
-              .forEach(r -> r.withGracePeriod(10).delete());
-      // enforce that the dependents are gone
-      Awaitility.await().during(5, TimeUnit.SECONDS).until(() -> {
-          if (dependents.stream().anyMatch(
-                  c -> !k8sclient.resources(c).withLabels(Constants.DEFAULT_LABELS).list().getItems().isEmpty())) {
-              // the operator must have recreated because it hasn't gotten the keycloak
-              // deleted event, keep cleaning
-              dependents.stream().map(c -> k8sclient.resources(c).withLabels(Constants.DEFAULT_LABELS))
-                      .forEach(r -> r.withGracePeriod(0).delete());
-              return false;
-          }
-          return true;
-      });
   }
 
   @Override
@@ -340,8 +335,8 @@ public void afterEach(QuarkusTestMethodContext context) {
           Method testMethod = context.getTestMethod();
           if (context.getTestStatus().getTestErrorCause() == null
                   || context.getTestStatus().getTestErrorCause() instanceof TestAbortedException
-                  || !Stream.of(context.getTestStatus().getTestErrorCause().getStackTrace())
-                          .anyMatch(ste -> ste.getMethodName().equals(testMethod.getName())
+                  || Stream.of(context.getTestStatus().getTestErrorCause().getStackTrace())
+                          .noneMatch(ste -> ste.getMethodName().equals(testMethod.getName())
                                   && ste.getClassName().equals(testMethod.getDeclaringClass().getName()))) {
               return;
           }
@@ -351,11 +346,15 @@ public void afterEach(QuarkusTestMethodContext context) {
           savePodLogs();
           // provide some helpful entries in the main log as well
           logFailedKeycloaks();
+          k8sclient.resources(Keycloak.class).list().getItems()
+                  .forEach(keycloak -> Log.infof("Keycloak '%s' status:%n%s", keycloak.getMetadata().getName(), Serialization.asYaml(keycloak.getStatus())));
           if (operatorDeployment == OperatorDeployment.remote) {
               log(k8sclient.apps().deployments().withName("keycloak-operator"), Deployment::getStatus, false);
           }
-          logFailed(k8sclient.apps().statefulSets().withName(POSTGRESQL_NAME), StatefulSet::getStatus);
-          k8sclient.pods().withLabel("app", "keycloak-realm-import").list().getItems().stream()
+          if (operatorDeployment != OperatorDeployment.local_apiserver) {
+              logFailed(k8sclient.apps().statefulSets().withName(POSTGRESQL_NAME), StatefulSet::getStatus);
+          }
+          k8sclient.pods().withLabel("app", "keycloak-realm-import").list().getItems()
                   .forEach(pod -> log(k8sclient.pods().resource(pod), Pod::getStatus, false));
       } finally {
           cleanup();
@@ -410,6 +409,13 @@ private void logFailedKeycloaks() {
                                   threadDump(p);
                               });
                   }
+                  var job = k8sclient.batch().v1().jobs()
+                          .inNamespace(kc.getMetadata().getNamespace())
+                          .withName(KeycloakUpdateJobDependentResource.jobName(kc))
+                          .get();
+                  if (job != null) {
+                      Log.warnf("Keycloak Update Job \"%s\" %s", job.getMetadata().getName(), Serialization.asYaml(job.getStatus()));
+                  }
               });
   }
 
@@ -451,7 +457,7 @@ private void logEvents() {
           var entry = grouped.next();
           Log.logf("Normal".equals(entry.getValue().get(0).getType()) ? Level.INFO : Level.WARN,
                   "Event last seen %s repeated %s times - %s", getTime(entry.getValue().get(0)),
-                  entry.getValue().size(), entry.getKey().stream().collect(Collectors.joining(" ")));
+                  entry.getValue().size(), String.join(" ", entry.getKey()));
       }
   }
 
@@ -461,21 +467,43 @@ private static String getTime(Event event) {
 
   @AfterAll
   public static void after() throws FileNotFoundException {
+      if (operatorDeployment == OperatorDeployment.remote) {
+          cleanRBACresourcesAndOperatorDeployment();
+      }
 
-    if (operatorDeployment == OperatorDeployment.local) {
+      if (k8sclient != null) {
+          Log.info("Deleting namespace : " + namespace);
+          assertThat(k8sclient.namespaces().withName(namespace).delete()).isNotEmpty();
+      }
+
+      if (operator != null) {
+          stopOperator();
+          operator = null;
+      }
+
+      if (k8sclient != null) {
+          k8sclient.close();
+          k8sclient = null;
+      }
+
+      if (kubeApi != null) {
+          kubeApi.stop();
+          kubeApi = null;
+      }
+  }
+
+  private static void stopOperator() {
       Log.info("Stopping Operator");
       operator.stop();
 
+      // Avoid issues with Event Informers between tests
+      Log.info("Removing Controllers and application scoped DRs from CDI");
+      Stream.of(KeycloakController.class, KeycloakRealmImportController.class, KeycloakUpdateJobDependentResource.class)
+                      .forEach(c -> CDI.current().destroy(CDI.current().select(c).get()));
+
       Log.info("Creating new K8s Client");
       // create a new client bc operator has closed the old one
       createK8sClient();
-    } else {
-      cleanRBACresourcesAndOperatorDeployment();
-    }
-
-    Log.info("Deleting namespace : " + namespace);
-    assertThat(k8sclient.namespaces().withName(namespace).delete()).isNotEmpty();
-    k8sclient.close();
   }
 
   public static String getCurrentNamespace() {
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/CacheTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/CacheTest.java
index 2505500f31cb..6a46fb99fdae 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/CacheTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/CacheTest.java
@@ -31,6 +31,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusCondition;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.CacheSpecBuilder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
@@ -41,6 +42,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.keycloak.operator.testsuite.utils.K8sUtils.deployKeycloak;
 
+@DisabledIfApiServerTest
 @QuarkusTest
 public class CacheTest extends BaseOperatorTest {
 
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java
index a2cdb29cd7f8..6475fb28b6d3 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java
@@ -38,6 +38,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusCondition;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportStatusCondition;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
@@ -52,6 +53,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.keycloak.operator.controllers.KeycloakDeploymentDependentResource.KC_TRACING_SERVICE_NAME;
 
+@DisabledIfApiServerTest
 @QuarkusTest
 public class ClusteringTest extends BaseOperatorTest {
 
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java
index 07d376172dcf..d65837b96cf9 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java
@@ -34,6 +34,7 @@
 
 import org.awaitility.Awaitility;
 import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.condition.EnabledIfSystemProperty;
 import org.keycloak.operator.Config;
@@ -46,6 +47,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.ValueOrSecret;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.BootstrapAdminSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpecBuilder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.unit.WatchedResourcesTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
@@ -75,6 +77,8 @@
 import static org.keycloak.operator.testsuite.utils.K8sUtils.getResourceFromFile;
 import static org.keycloak.operator.testsuite.utils.K8sUtils.waitForKeycloakToBeReady;
 
+@DisabledIfApiServerTest
+@Tag(BaseOperatorTest.SLOW)
 @QuarkusTest
 public class KeycloakDeploymentTest extends BaseOperatorTest {
 
@@ -208,6 +212,7 @@ public void testConfigInCRTakesPrecedence() {
     @Test
     public void testDeploymentDurability() {
         var kc = getTestKeycloakDeployment(true);
+        KeycloakDeploymentTest.initCustomBootstrapAdminUser(kc);
         var deploymentName = kc.getMetadata().getName();
 
         // create a dummy StatefulSet representing the pre-multiinstance state that we'll be forced to delete
@@ -390,14 +395,19 @@ public void testInitialAdminUser() {
     @Test
     public void testCustomBootstrapAdminUser() {
         var kc = getTestKeycloakDeployment(true);
+        String secretName = initCustomBootstrapAdminUser(kc);
+        assertInitialAdminUser(secretName, kc, true);
+    }
+
+    static String initCustomBootstrapAdminUser(Keycloak kc) {
         String secretName = "my-secret";
         // fluents don't seem to work here because of the inner classes
         kc.getSpec().setBootstrapAdminSpec(new BootstrapAdminSpec());
         kc.getSpec().getBootstrapAdminSpec().setUser(new BootstrapAdminSpec.User());
         kc.getSpec().getBootstrapAdminSpec().getUser().setSecret(secretName);
         k8sclient.resource(new SecretBuilder().withNewMetadata().withName(secretName).endMetadata()
-                .addToStringData("username", "user").addToStringData("password", "pass20rd").build()).create();
-        assertInitialAdminUser(secretName, kc, true);
+                .addToStringData("username", "user").addToStringData("password", "pass20rd").build()).serverSideApply();
+        return secretName;
     }
 
     // Reference curl command:
@@ -585,7 +595,7 @@ public void testHttpRelativePathWithSecretValue() {
     }
 
     @Test
-    public void testUpgradeRecreatesPods() {
+    public void testUpdateRecreatesPods() {
         var kc = getTestKeycloakDeployment(true);
         kc.getSpec().setInstances(3);
         deployKeycloak(k8sclient, kc, true);
@@ -595,9 +605,9 @@ public void testUpgradeRecreatesPods() {
 
         kc.getSpec().setImage(newImage);
 
-        var upgradeCondition = k8sclient.resource(kc).informOnCondition(kcs -> {
+        var updateCondition = k8sclient.resource(kc).informOnCondition(kcs -> {
             try {
-                assertKeycloakStatusCondition(kcs.get(0), KeycloakStatusCondition.READY, false, "Performing Keycloak upgrade");
+                assertKeycloakStatusCondition(kcs.get(0), KeycloakStatusCondition.READY, false, null);
                 return true;
             } catch (AssertionError e) {
                 return false;
@@ -606,7 +616,7 @@ public void testUpgradeRecreatesPods() {
 
         deployKeycloak(k8sclient, kc, false);
         try {
-            upgradeCondition.get(2, TimeUnit.MINUTES);
+            updateCondition.get(2, TimeUnit.MINUTES);
         } catch (InterruptedException | ExecutionException | TimeoutException e) {
             throw new AssertionError(e);
         }
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakIngressTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakIngressTest.java
index 83195960e38b..eeee2a5215b8 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakIngressTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakIngressTest.java
@@ -34,6 +34,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpecBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.IngressSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.IngressSpecBuilder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
 import java.util.Map;
@@ -48,6 +49,7 @@
 @QuarkusTest
 public class KeycloakIngressTest extends BaseOperatorTest {
 
+    @DisabledIfApiServerTest
     @Test
     public void testIngressOnHTTP() {
         var kc = getTestKeycloakDeployment(false);
@@ -76,6 +78,7 @@ public void testIngressOnHTTP() {
         testIngressURLs(baseUrl);
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testIngressOnHTTPSAndProxySettings() {
         var kc = getTestKeycloakDeployment(false);
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakNetworkPolicyTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakNetworkPolicyTest.java
index 89231b32a26e..1db43f5f5b67 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakNetworkPolicyTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakNetworkPolicyTest.java
@@ -25,6 +25,8 @@
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer;
 import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeerBuilder;
 import io.quarkus.test.junit.QuarkusTest;
+
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.keycloak.operator.Constants;
 import org.keycloak.operator.Utils;
@@ -33,11 +35,13 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpecBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.IngressSpecBuilder;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.NetworkPolicySpec;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
 import static org.junit.jupiter.api.Assertions.assertNull;
 
+@Tag(BaseOperatorTest.SLOW)
 @QuarkusTest
 public class KeycloakNetworkPolicyTest extends BaseOperatorTest {
 
@@ -48,6 +52,7 @@ private static NetworkPolicy networkPolicy(Keycloak keycloak) {
                 .get();
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testHttpAndHttps() {
         var kc = create();
@@ -66,6 +71,7 @@ public void testHttpAndHttps() {
         CRAssert.assertManagementInterfaceAccessibleViaService(k8sclient, kc, true, mngtPort);
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testServiceConnectivity() {
         var kc = create();
@@ -125,6 +131,7 @@ public void testServiceConnectivity() {
         }
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testJGroupsConnectivity() {
         var kc = create();
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakServicesTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakServicesTest.java
index 0697a51bc42d..03b9ac93997a 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakServicesTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakServicesTest.java
@@ -31,12 +31,15 @@
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 
 @QuarkusTest
 public class KeycloakServicesTest extends BaseOperatorTest {
     @Test
     public void testMainServiceDurability() {
         var kc = getTestKeycloakDeployment(true);
+        kc.getSpec().getHttpSpec().setLabels(Map.of("foo","bar"));
         K8sUtils.deployKeycloak(k8sclient, kc, true);
         String serviceName = KeycloakServiceDependentResource.getServiceName(kc);
         var serviceSelector = k8sclient.services().inNamespace(namespace).withName(serviceName);
@@ -71,6 +74,7 @@ public void testMainServiceDurability() {
                 .untilAsserted(() -> {
                     var s = serviceSelector.get();
                     assertThat(s.getMetadata().getLabels().entrySet().containsAll(labels.entrySet())).isTrue(); // additional labels should not be overwritten
+                    assertEquals("bar", s.getMetadata().getLabels().get("foo"));
                     // ignoring assigned IP/s and generated config
                     s.getSpec().setClusterIP(null);
                     s.getSpec().setClusterIPs(null);
@@ -79,6 +83,60 @@ public void testMainServiceDurability() {
                 });
     }
 
+    @Test
+    public void testCustomServiceAnnotations() {
+        var kc = getTestKeycloakDeployment(true);
+
+        // set 'a'
+        kc.getSpec().getHttpSpec().setAnnotations(Map.of("a", "b"));
+        K8sUtils.deployKeycloak(k8sclient, kc, true);
+
+        String serviceName = KeycloakServiceDependentResource.getServiceName(kc);
+        var serviceSelector = k8sclient.services().inNamespace(namespace).withName(serviceName);
+
+        Awaitility.await()
+                .ignoreExceptions()
+                .untilAsserted(() -> {
+                    var s = serviceSelector.get();
+                    assertEquals("b", s.getMetadata().getAnnotations().get("a"));
+                });
+
+        // update 'a'
+        kc.getSpec().getHttpSpec().setAnnotations(Map.of("a", "bb"));
+        K8sUtils.deployKeycloak(k8sclient, kc, true);
+
+        Awaitility.await()
+                .ignoreExceptions()
+                .untilAsserted(() -> {
+                    var s = serviceSelector.get();
+                    assertEquals("bb", s.getMetadata().getAnnotations().get("a"));
+                });
+
+        // remove 'a' and add 'c'
+        kc.getSpec().getHttpSpec().setAnnotations(Map.of("c", "d"));
+        K8sUtils.deployKeycloak(k8sclient, kc, true);
+
+        Awaitility.await()
+                .ignoreExceptions()
+                .untilAsserted(() -> {
+                    var s = serviceSelector.get();
+                    assertFalse(s.getMetadata().getAnnotations().containsKey("a"));
+                    assertEquals("d", s.getMetadata().getAnnotations().get("c"));
+                });
+
+        // remove all
+        kc.getSpec().getHttpSpec().setAnnotations(null);
+        K8sUtils.deployKeycloak(k8sclient, kc, true);
+
+        Awaitility.await()
+                .ignoreExceptions()
+                .untilAsserted(() -> {
+                    var s = serviceSelector.get();
+                    assertFalse(s.getMetadata().getAnnotations().containsKey("a"));
+                    assertFalse(s.getMetadata().getAnnotations().containsKey("c"));
+                });
+    }
+
     @Test
     public void testDiscoveryServiceDurability() {
         var kc = getTestKeycloakDeployment(true);
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/PodTemplateTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/PodTemplateTest.java
index 2323f178d54f..4d6517b4c364 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/PodTemplateTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/PodTemplateTest.java
@@ -22,6 +22,8 @@
 import io.fabric8.kubernetes.api.model.NamespaceBuilder;
 import io.fabric8.kubernetes.api.model.PodTemplateSpecBuilder;
 import io.fabric8.kubernetes.api.model.Secret;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.api.model.apps.StatefulSetBuilder;
 import io.fabric8.kubernetes.client.dsl.Resource;
 import io.fabric8.kubernetes.client.utils.Serialization;
 import io.quarkus.logging.Log;
@@ -29,15 +31,20 @@
 
 import org.awaitility.Awaitility;
 import org.junit.jupiter.api.Test;
+import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
 import java.util.Collections;
+import java.util.concurrent.TimeUnit;
 
 import static java.util.concurrent.TimeUnit.MINUTES;
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusCondition.HAS_ERRORS;
+import static org.keycloak.operator.testsuite.utils.K8sUtils.deployKeycloak;
 import static org.keycloak.operator.testsuite.utils.K8sUtils.getResourceFromFile;
 
 @QuarkusTest
@@ -54,6 +61,7 @@ private Resource<Keycloak> getCrSelector() {
                 .withName("example-podtemplate");
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testPodTemplateIsMerged() {
         // Act
@@ -92,7 +100,7 @@ public void testPodTemplateIncorrectName() {
                 .withName("foo")
                 .endMetadata()
                 .build();
-        plainKc.getSpec().getUnsupported().setPodTeplate(podTemplate);
+        plainKc.getSpec().getUnsupported().setPodTemplate(podTemplate);
 
         // Act
         K8sUtils.set(k8sclient, plainKc);
@@ -120,7 +128,7 @@ public void testPodTemplateIncorrectNamespace() {
                     .withNamespace(wrongNamespace)
                     .endMetadata()
                     .build();
-            plainKc.getSpec().getUnsupported().setPodTeplate(podTemplate);
+            plainKc.getSpec().getUnsupported().setPodTemplate(podTemplate);
 
             // Act
             K8sUtils.set(k8sclient, plainKc);
@@ -151,7 +159,7 @@ public void testPodTemplateIncorrectContainerName() {
                 .endContainer()
                 .endSpec()
                 .build();
-        plainKc.getSpec().getUnsupported().setPodTeplate(podTemplate);
+        plainKc.getSpec().getUnsupported().setPodTemplate(podTemplate);
 
         // Act
         K8sUtils.set(k8sclient, plainKc);
@@ -177,7 +185,7 @@ public void testPodTemplateIncorrectDockerImage() {
                 .endContainer()
                 .endSpec()
                 .build();
-        plainKc.getSpec().getUnsupported().setPodTeplate(podTemplate);
+        plainKc.getSpec().getUnsupported().setPodTemplate(podTemplate);
 
         // Act
         K8sUtils.set(k8sclient, plainKc);
@@ -211,7 +219,7 @@ public void testPodTemplateIncorrectImagePullSecretsConfig() {
                 .build();
 
         var plainKc = getEmptyPodTemplateKeycloak();
-        plainKc.getSpec().getUnsupported().setPodTeplate(podTemplate);
+        plainKc.getSpec().getUnsupported().setPodTemplate(podTemplate);
 
         // Act
         K8sUtils.set(k8sclient, plainKc);
@@ -227,4 +235,31 @@ public void testPodTemplateIncorrectImagePullSecretsConfig() {
                 });
     }
 
+    @Test
+    public void testDeploymentUpgrade() {
+        var kc = getTestKeycloakDeployment(true);
+        kc.getSpec().setInstances(2);
+        // all preconditions must be met, otherwise the operator sdk will remove the existing statefulset
+        KeycloakDeploymentTest.initCustomBootstrapAdminUser(kc);
+
+        // create a dummy StatefulSet representing the 26.0 state that we'll be forced to delete
+        StatefulSet statefulSet = new StatefulSetBuilder().withMetadata(kc.getMetadata()).editMetadata()
+                .addToLabels(Utils.allInstanceLabels(kc)).endMetadata().withNewSpec().withNewSelector()
+                .withMatchLabels(Utils.allInstanceLabels(kc)).endSelector().withReplicas(0)
+                .withNewTemplate().withNewMetadata().withLabels(Utils.allInstanceLabels(kc)).endMetadata()
+                .withNewSpec().addNewContainer().withName("pause").withImage("registry.k8s.io/pause:3.1")
+                .endContainer().endSpec().endTemplate().endSpec().build();
+        var ss = k8sclient.resource(statefulSet).create();
+
+        // start will not be successful because the statefulSet is in the way
+        deployKeycloak(k8sclient, kc, false);
+        // once the statefulset is owned by the keycloak it will be picked up by the informer
+        k8sclient.resource(statefulSet).accept(s -> s.addOwnerReference(k8sclient.resource(kc).get()));
+
+        Awaitility.await().atMost(1, TimeUnit.MINUTES).until(() -> k8sclient.resource(statefulSet).get().getSpec().getReplicas() == 2);
+
+        // we don't expect a recreate - that would indicate the operator sdk saw a precondition failing
+        assertEquals(ss.getMetadata().getUid(), k8sclient.resource(statefulSet).get().getMetadata().getUid());
+    }
+
 }
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/RealmImportTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/RealmImportTest.java
index 0d54cae61150..7a5520e70c3c 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/RealmImportTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/RealmImportTest.java
@@ -37,8 +37,8 @@
 import org.keycloak.operator.controllers.KeycloakServiceDependentResource;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
-import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImportBuilder;
 import org.keycloak.operator.crds.v2alpha1.realmimport.Placeholder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.utils.CRAssert;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
 
@@ -59,6 +59,7 @@
 import static org.keycloak.operator.testsuite.utils.K8sUtils.getResourceFromFile;
 import static org.keycloak.operator.testsuite.utils.K8sUtils.inClusterCurl;
 
+@DisabledIfApiServerTest
 @QuarkusTest
 public class RealmImportTest extends BaseOperatorTest {
 
@@ -75,7 +76,7 @@ public void beforeEach(TestInfo testInfo) {
         deleteDB();
         deployDB();
     }
-    
+
     @Override
     public void afterEach(QuarkusTestMethodContext context) {
         super.afterEach(context);
@@ -104,6 +105,7 @@ protected static void deploySmtpSecret() {
         K8sUtils.set(k8sclient, getResourceFromFile("example-smtp-secret.yaml", Secret.class));
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testWorkingRealmImport() {
         // Arrange
@@ -120,6 +122,7 @@ public void testWorkingRealmImport() {
         assertWorkingRealmImport(kc);
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testWorkingRealmImportWithReplacement() {
         // Arrange
@@ -140,10 +143,10 @@ public void testWorkingRealmImportWithReplacement() {
                             "MY_SMTP_SERVER", new Placeholder(new SecretKeySelectorBuilder().withName("keycloak-smtp-secret").withKey("SMTP_SERVER").build())));
             return realmImport;
         });
-        
+
         // Assert
         var envvars = assertWorkingRealmImport(kc);
-        
+
         assertThat(envvars.stream().filter(e -> e.getName().equals("MY_SMTP_PORT")).findAny().get().getValueFrom().getSecretKeyRef().getKey()).isEqualTo("SMTP_PORT");
         assertThat(envvars.stream().filter(e -> e.getName().equals("MY_SMTP_SERVER")).findAny().get().getValueFrom().getSecretKeyRef().getKey()).isEqualTo("SMTP_SERVER");
     }
@@ -180,7 +183,7 @@ private List<EnvVar> assertWorkingRealmImport(Keycloak kc) {
         assertThat(container).isNotNull();
         var envvars = container.getEnv();
         assertThat(envvars.stream().filter(e -> e.getName().equals(getKeycloakOptionEnvVarName("cache"))).findAny().get().getValue()).isEqualTo("local");
-        assertThat(envvars.stream().filter(e -> e.getName().equals(getKeycloakOptionEnvVarName("health-enabled"))).findAny().get().getValue()).isEqualTo("false");
+        assertThat(envvars.stream().filter(e -> e.getName().equals(getKeycloakOptionEnvVarName("health-enabled"))).findAny().isEmpty());
 
         assertThat(job.getSpec().getTemplate().getSpec().getImagePullSecrets().size()).isEqualTo(1);
         assertThat(job.getSpec().getTemplate().getSpec().getImagePullSecrets().get(0).getName()).isEqualTo("my-empty-secret");
@@ -199,7 +202,7 @@ private List<EnvVar> assertWorkingRealmImport(Keycloak kc) {
         });
 
         assertThat(getJobArgs()).contains("build");
-        
+
         return envvars;
     }
 
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/TracingDeploymentTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/TracingDeploymentTest.java
index da0e95e19305..91a28887068f 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/TracingDeploymentTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/TracingDeploymentTest.java
@@ -24,6 +24,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.ValueOrSecret;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.TracingSpec;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.TracingSpecBuilder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 
 import java.util.Map;
 import java.util.Objects;
@@ -34,6 +35,7 @@
 import static org.keycloak.operator.controllers.KeycloakDeploymentDependentResource.KC_TRACING_SERVICE_NAME;
 import static org.keycloak.operator.testsuite.utils.K8sUtils.deployKeycloak;
 
+@DisabledIfApiServerTest
 @QuarkusTest
 public class TracingDeploymentTest extends BaseOperatorTest {
 
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/UpdateTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/UpdateTest.java
new file mode 100644
index 000000000000..b5656ba61966
--- /dev/null
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/UpdateTest.java
@@ -0,0 +1,284 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.operator.testsuite.integration;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.keycloak.operator.testsuite.utils.CRAssert.eventuallyRecreateUpdateStatus;
+import static org.keycloak.operator.testsuite.utils.CRAssert.eventuallyRollingUpdateStatus;
+import static org.keycloak.operator.testsuite.utils.K8sUtils.deployKeycloak;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+import io.fabric8.kubernetes.api.model.Pod;
+import io.fabric8.kubernetes.client.dsl.Gettable;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledIfSystemProperty;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.keycloak.operator.Utils;
+import org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource;
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
+import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusCondition;
+import org.keycloak.operator.crds.v2alpha1.deployment.ValueOrSecret;
+import org.keycloak.operator.crds.v2alpha1.deployment.spec.UpdateSpec;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
+import org.keycloak.operator.testsuite.utils.CRAssert;
+import org.keycloak.operator.update.UpdateStrategy;
+import org.keycloak.operator.update.impl.AutoUpdateLogic;
+
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.batch.v1.Job;
+import io.fabric8.kubernetes.api.model.batch.v1.JobStatus;
+import io.quarkus.test.junit.QuarkusTest;
+
+@Tag(BaseOperatorTest.SLOW)
+@QuarkusTest
+public class UpdateTest extends BaseOperatorTest {
+
+    @ParameterizedTest(name = "testImageChange-{0}")
+    @EnumSource(UpdateStrategy.class)
+    public void testImageChange(UpdateStrategy updateStrategy) throws InterruptedException {
+        Assumptions.assumeTrue(operatorDeployment != OperatorDeployment.local_apiserver || updateStrategy != UpdateStrategy.AUTO);
+        var kc = createInitialDeployment(updateStrategy);
+        var updateCondition = assertUnknownUpdateTypeStatus(kc);
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // changing the image to non-existing will always use the recreate update type.
+        kc.getSpec().setImage("quay.io/keycloak/non-existing-keycloak");
+        disableProbes(kc);
+        updateCondition = switch (updateStrategy) {
+            case AUTO -> eventuallyRecreateUpdateStatus(k8sclient, kc, "Unexpected update-compatibility command");
+            case RECREATE_ON_IMAGE_CHANGE -> eventuallyRecreateUpdateStatus(k8sclient, kc, "Image changed");
+            case EXPLICIT -> eventuallyRollingUpdateStatus(k8sclient, kc, "Explicit strategy configured. Revision matches.");
+        };
+
+        deployKeycloak(k8sclient, kc, false);
+        await(updateCondition);
+
+        if (updateStrategy == UpdateStrategy.AUTO) {
+            assertUpdateJobExists(kc);
+        }
+    }
+
+    @ParameterizedTest(name = "testCacheMaxCount-{0}")
+    @EnumSource(UpdateStrategy.class)
+    public void testCacheMaxCount(UpdateStrategy updateStrategy) throws InterruptedException {
+        Assumptions.assumeTrue(operatorDeployment != OperatorDeployment.local_apiserver || updateStrategy != UpdateStrategy.AUTO);
+        var kc = createInitialDeployment(updateStrategy);
+        var updateCondition = assertUnknownUpdateTypeStatus(kc);
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // changing the local cache max-count should never use the recreate update type
+        kc.getSpec().getAdditionalOptions().add(new ValueOrSecret("cache-embedded-authorization-max-count", "10"));
+
+        updateCondition = switch (updateStrategy) {
+            case AUTO -> eventuallyRollingUpdateStatus(k8sclient, kc, "Compatible changes detected.");
+            case RECREATE_ON_IMAGE_CHANGE -> eventuallyRollingUpdateStatus(k8sclient, kc, "Image unchanged");
+            case EXPLICIT -> eventuallyRollingUpdateStatus(k8sclient, kc, "Explicit strategy configured. Revision matches.");
+        };
+
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        if (updateStrategy == UpdateStrategy.AUTO) {
+            assertUpdateJobExists(kc);
+        }
+    }
+
+    @ParameterizedTest(name = "testOptimizedImage-{0}")
+    @EnumSource(UpdateStrategy.class)
+    @EnabledIfSystemProperty(named = OPERATOR_CUSTOM_IMAGE, matches = ".+")
+    public void testOptimizedImage(UpdateStrategy updateStrategy) throws InterruptedException {
+        Assumptions.assumeTrue(operatorDeployment != OperatorDeployment.local_apiserver || updateStrategy != UpdateStrategy.AUTO);
+        // In GHA, the custom image is an optimized image of the base image.
+        // We should be able to do a zero-downtime update with Auto strategy.
+        var kc = createInitialDeployment(updateStrategy);
+        // use the base image
+        kc.getSpec().setImage(null);
+        var updateCondition = assertUnknownUpdateTypeStatus(kc);
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // use the optimized image, auto strategy should use a rolling update
+        kc.getSpec().setImage(getTestCustomImage());
+        updateCondition = switch (updateStrategy) {
+            case AUTO -> eventuallyRollingUpdateStatus(k8sclient, kc, "Compatible changes detected.");
+            case RECREATE_ON_IMAGE_CHANGE -> eventuallyRecreateUpdateStatus(k8sclient, kc, "Image changed");
+            case EXPLICIT -> eventuallyRollingUpdateStatus(k8sclient, kc, "Explicit strategy configured. Revision matches.");
+        };
+
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        if (updateStrategy == UpdateStrategy.AUTO) {
+            assertUpdateJobExists(kc);
+        }
+    }
+
+    @DisabledIfApiServerTest
+    @EnabledIfSystemProperty(named = OPERATOR_CUSTOM_IMAGE, matches = ".+")
+    @Test
+    public void testNoJobReuse() throws InterruptedException {
+        // In GHA, the custom image is an optimized image of the base image.
+        // We should be able to do a zero-downtime update with Auto strategy.
+        var kc = createInitialDeployment(UpdateStrategy.AUTO);
+        // use the base image
+        kc.getSpec().setImage(null);
+        var updateCondition = assertUnknownUpdateTypeStatus(kc);
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // let's trigger a rolling update
+        updateCondition = eventuallyRollingUpdateStatus(k8sclient, kc, "Compatible changes detected.");
+        kc.getSpec().setImage(getTestCustomImage());
+
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        var job = assertUpdateJobExists(kc);
+        var hash = job.getMetadata().getAnnotations().get(KeycloakUpdateJobDependentResource.KEYCLOAK_CR_HASH_ANNOTATION);
+        assertEquals(0, containerExitCode(job));
+
+        //let's trigger a recreate
+        updateCondition = eventuallyRecreateUpdateStatus(k8sclient, kc, "Unexpected update-compatibility command");
+        // enough to crash the Pod and return exit code != 0
+        kc.getSpec().setImage("quay.io/keycloak/non-existing-keycloak");
+        disableProbes(kc);
+
+        deployKeycloak(k8sclient, kc, false);
+        await(updateCondition);
+
+        job = assertUpdateJobExists(kc);
+        var newHash = job.getMetadata().getAnnotations().get(KeycloakUpdateJobDependentResource.KEYCLOAK_CR_HASH_ANNOTATION);
+        assertNotEquals(hash, newHash);
+        assertNotEquals(0, containerExitCode(job));
+    }
+
+    @Test
+    public void testExplicitStrategy() throws InterruptedException {
+        var kc = createInitialDeployment(UpdateStrategy.EXPLICIT);
+        disableProbes(kc);
+
+        var updateCondition = assertUnknownUpdateTypeStatus(kc);
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // update configuration, revision is updated
+        updateCondition = eventuallyRecreateUpdateStatus(k8sclient, kc, "does not match");
+        kc.getSpec().setAdditionalOptions(List.of(new ValueOrSecret("cache-embedded-authorization-max-count", "10")));
+        kc.getSpec().getUpdateSpec().setRevision("1");
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // update configuration, revision is updated
+        updateCondition = eventuallyRecreateUpdateStatus(k8sclient, kc, "Explicit strategy configured. Revision (1) does not match (2).");
+        kc.getSpec().setAdditionalOptions(List.of(new ValueOrSecret("cache-embedded-authorization-max-count", "11")));
+        kc.getSpec().getUpdateSpec().setRevision("2");
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+
+        // update configuration, revision is unchanged
+        updateCondition = eventuallyRollingUpdateStatus(k8sclient, kc, "Explicit strategy configured. Revision matches.");
+        kc.getSpec().setAdditionalOptions(List.of(new ValueOrSecret("cache-embedded-authorization-max-count", "12")));
+        kc.getSpec().getUpdateSpec().setRevision("2");
+        deployKeycloak(k8sclient, kc, true);
+        await(updateCondition);
+    }
+
+    private Job assertUpdateJobExists(Keycloak keycloak) {
+        var job = k8sclient.batch().v1().jobs()
+                .inNamespace(keycloak.getMetadata().getNamespace())
+                .withName(KeycloakUpdateJobDependentResource.jobName(keycloak))
+                .get();
+        assertNotNull(job);
+        var maybeStatus = Optional.ofNullable(job.getStatus());
+        var finished = maybeStatus.map(JobStatus::getSucceeded).orElse(0) +
+                maybeStatus.map(JobStatus::getFailed).orElse(0);
+        assertEquals(1, finished);
+
+        // check label selector
+        var jobPodName = AutoUpdateLogic.findPodForJob(k8sclient, job)
+                .map(Pod::getMetadata)
+                .map(ObjectMeta::getName)
+                .orElseThrow();
+        var servicePods = k8sclient.pods().inNamespace(namespaceOf(keycloak))
+                .withLabels(Utils.allInstanceLabels(keycloak))
+                .resources()
+                .map(Gettable::get)
+                .map(Pod::getMetadata)
+                .map(ObjectMeta::getName)
+                .toList();
+        assertFalse(servicePods.contains(jobPodName), "pods: " + servicePods + " / job pod: " + jobPodName);
+        return job;
+    }
+
+    private int containerExitCode(Job job) {
+        var maybeExitCode = AutoUpdateLogic.findPodForJob(k8sclient, job)
+                .flatMap(AutoUpdateLogic::container)
+                .map(AutoUpdateLogic::exitCode);
+        assertTrue(maybeExitCode.isPresent());
+        return maybeExitCode.get();
+    }
+
+    private CompletableFuture<Void> assertUnknownUpdateTypeStatus(Keycloak keycloak) {
+        return k8sclient.resource(keycloak).informOnCondition(kcs -> {
+            if (kcs.isEmpty() || kcs.get(0).getStatus() == null) {
+                return false;
+            }
+            try {
+                CRAssert.assertKeycloakStatusCondition(kcs.get(0), KeycloakStatusCondition.UPDATE_TYPE, null);
+                return true;
+            } catch (AssertionError e) {
+                return false;
+            }
+        }).thenAccept(unused -> {});
+    }
+
+    private static Keycloak createInitialDeployment(UpdateStrategy updateStrategy) {
+        var kc = getTestKeycloakDeployment(false);
+        kc.getSpec().setInstances(2);
+        var updateSpec = new UpdateSpec();
+        updateSpec.setStrategy(updateStrategy);
+        if (updateStrategy == UpdateStrategy.EXPLICIT) {
+            updateSpec.setRevision("0");
+        }
+        kc.getSpec().setUpdateSpec(updateSpec);
+        return kc;
+    }
+
+    private static <T> void await(CompletableFuture<T> future) throws InterruptedException {
+        try {
+            future.get(2, TimeUnit.MINUTES);
+        } catch (ExecutionException | TimeoutException e) {
+            throw new AssertionError(e);
+        }
+    }
+}
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/WatchedSecretsTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/WatchedSecretsTest.java
index 79a6366d33ae..0a817c440c80 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/WatchedSecretsTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/WatchedSecretsTest.java
@@ -29,6 +29,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.ValueOrSecret;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HostnameSpecBuilder;
+import org.keycloak.operator.testsuite.apiserver.DisabledIfApiServerTest;
 import org.keycloak.operator.testsuite.unit.WatchedResourcesTest;
 
 import java.util.Base64;
@@ -75,6 +76,7 @@ public void testSecretsAreWatched() {
         });
     }
 
+    @DisabledIfApiServerTest
     @Test
     public void testSecretChangesArePropagated() {
         final String username = "HomerSimpson";
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/unit/CRSerializationTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/unit/CRSerializationTest.java
index 38e8027357ee..9ff22668d7b0 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/unit/CRSerializationTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/unit/CRSerializationTest.java
@@ -37,6 +37,7 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.TransactionsSpec;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
 import org.keycloak.operator.testsuite.utils.K8sUtils;
+import org.keycloak.operator.update.UpdateStrategy;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.emptyString;
@@ -49,6 +50,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 
@@ -100,6 +102,14 @@ public void testDeserialization() {
         HttpManagementSpec managementSpec = keycloak.getSpec().getHttpManagementSpec();
         assertNotNull(managementSpec);
         assertEquals(9003, managementSpec.getPort());
+
+        assertEquals(50,keycloak.getSpec().getReadinessProbeSpec().getProbePeriodSeconds());
+        assertEquals(3,keycloak.getSpec().getReadinessProbeSpec().getProbeFailureThreshold());
+        assertEquals(60,keycloak.getSpec().getLivenessProbeSpec().getProbePeriodSeconds());
+        assertEquals(1,keycloak.getSpec().getLivenessProbeSpec().getProbeFailureThreshold());
+        assertEquals(40,keycloak.getSpec().getStartupProbeSpec().getProbePeriodSeconds());
+        assertEquals(2,keycloak.getSpec().getStartupProbeSpec().getProbeFailureThreshold());
+
     }
 
     @Test
@@ -253,6 +263,33 @@ public void testNetworkPolicy() {
         assertNetworkPolicyRules(networkPolicySpec.getManagementRules());
     }
 
+    @Test
+    public void testUpdateStrategy() {
+        var keycloak = Serialization.unmarshal(this.getClass().getResourceAsStream("/test-serialization-keycloak-cr.yml"), Keycloak.class);
+        var updateSpec = keycloak.getSpec().getUpdateSpec();
+        assertNotNull(updateSpec);
+        var updateStrategy = updateSpec.getStrategy();
+        assertNotNull(updateStrategy);
+        assertEquals(UpdateStrategy.AUTO, updateStrategy);
+    }
+
+    @Test
+    public void testInvalidUpdateStrategy() {
+        var thrown = assertThrows(IllegalArgumentException.class,
+                () -> Serialization.unmarshal(this.getClass().getResourceAsStream("/test-serialization-keycloak-cr-invalid-update.yml"), Keycloak.class));
+        assertTrue(thrown.getMessage().contains("Cannot deserialize value of type `org.keycloak.operator.update.UpdateStrategy` from String \"abc\""));
+    }
+
+    @Test
+    public void testUpdateStrategyRevision() {
+        var keycloak = Serialization.unmarshal(this.getClass().getResourceAsStream("/test-serialization-keycloak-cr.yml"), Keycloak.class);
+        var updateSpec = keycloak.getSpec().getUpdateSpec();
+        assertNotNull(updateSpec);
+        var revision = updateSpec.getRevision();
+        assertNotNull(revision);
+        assertEquals("1", revision);
+    }
+
     private static void assertNetworkPolicyRules(Collection<NetworkPolicyPeer> rules) {
         assertNotNull(rules);
         assertEquals(3, rules.size());
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/unit/KeycloakControllerTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/unit/KeycloakControllerTest.java
index 3fb51fa43fe9..9c6b3c37c5bb 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/unit/KeycloakControllerTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/unit/KeycloakControllerTest.java
@@ -53,9 +53,9 @@ void testCRDefaults() {
         // both the instances and hostname should be updated
         UpdateControl<Keycloak> update = controller.reconcile(kc, mockContext);
 
-        assertTrue(update.isUpdateResource());
-        assertEquals(1, update.getResource().getSpec().getInstances());
-        assertEquals("example-kc-ingress-ns.openshift.com", update.getResource().getSpec().getHostnameSpec().getHostname());
+        assertTrue(update.isPatchResource());
+        assertEquals(1, update.getResource().orElseThrow().getSpec().getInstances());
+        assertEquals("example-kc-ingress-ns.openshift.com", update.getResource().orElseThrow().getSpec().getHostnameSpec().getHostname());
 
         // just the instances should be updated if not openshift-default
         kc = K8sUtils.getDefaultKeycloakDeployment();
@@ -63,9 +63,9 @@ void testCRDefaults() {
         kc.getSpec().setInstances(null);
         kc.getSpec().getHostnameSpec().setHostname(null);
         update = controller.reconcile(kc, mockContext);
-        assertTrue(update.isUpdateResource());
-        assertEquals(1, update.getResource().getSpec().getInstances());
-        assertNull(update.getResource().getSpec().getHostnameSpec().getHostname());
+        assertTrue(update.isPatchResource());
+        assertEquals(1, update.getResource().orElseThrow().getSpec().getInstances());
+        assertNull(update.getResource().orElseThrow().getSpec().getHostnameSpec().getHostname());
     }
 
 }
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/unit/NetworkPolicyLogicTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/unit/NetworkPolicyLogicTest.java
index 11412c9eb2e8..dba235cf8fd3 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/unit/NetworkPolicyLogicTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/unit/NetworkPolicyLogicTest.java
@@ -59,6 +59,18 @@ protected NetworkPolicy desired() {
     @Test
     public void testDefaults() {
         var keycloak = K8sUtils.getDefaultKeycloakDeployment();
+        var controller = new MockKeycloakNetworkPolicy(keycloak);
+        assertTrue(controller.isEnabled());
+        assertTrue(controller.reconciled());
+        assertFalse(controller.deleted());
+        assertEnabledAndGet(keycloak);
+    }
+
+    @Test
+    public void testNetworkPolicyDisabled() {
+        var keycloak = K8sUtils.getDefaultKeycloakDeployment();
+        K8sUtils.disableNetworkPolicy(keycloak);
+
         var controller = new MockKeycloakNetworkPolicy(keycloak);
         assertFalse(controller.isEnabled());
         assertFalse(controller.reconciled());
@@ -165,6 +177,17 @@ private static NetworkPolicy assertEnabledAndGet(Keycloak keycloak) {
         return networkPolicy.get();
     }
 
+    private static void assertDisabled(Keycloak keycloak) {
+        var controller = new MockKeycloakNetworkPolicy(keycloak);
+
+        assertTrue(controller.isEnabled());
+        assertTrue(controller.reconciled());
+        assertFalse(controller.deleted());
+
+        var networkPolicy = controller.getReconciledResource();
+        assertTrue(networkPolicy.isEmpty());
+    }
+
     private static void disableManagement(Keycloak keycloak, boolean legacyOption) {
         if (legacyOption) {
             keycloak.getSpec().getAdditionalOptions().add(new ValueOrSecret("legacy-observability-interface", "true"));
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/unit/PodTemplateTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/unit/PodTemplateTest.java
index f44f77b33bd1..0741d004ee97 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/unit/PodTemplateTest.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/unit/PodTemplateTest.java
@@ -22,6 +22,7 @@
 import io.fabric8.kubernetes.api.model.Container;
 import io.fabric8.kubernetes.api.model.EnvVar;
 import io.fabric8.kubernetes.api.model.IntOrString;
+import io.fabric8.kubernetes.api.model.LocalObjectReference;
 import io.fabric8.kubernetes.api.model.PodTemplateSpec;
 import io.fabric8.kubernetes.api.model.PodTemplateSpecBuilder;
 import io.fabric8.kubernetes.api.model.ProbeBuilder;
@@ -32,11 +33,15 @@
 import io.fabric8.kubernetes.api.model.VolumeMount;
 import io.fabric8.kubernetes.api.model.apps.StatefulSet;
 import io.fabric8.kubernetes.api.model.apps.StatefulSetBuilder;
+import io.fabric8.kubernetes.api.model.apps.StatefulSetSpec;
+import io.fabric8.kubernetes.api.model.batch.v1.Job;
+import io.fabric8.kubernetes.client.KubernetesClient;
 import io.fabric8.kubernetes.client.utils.Serialization;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.dependent.managed.ManagedWorkflowAndDependentResourceContext;
 import io.quarkus.test.InjectMock;
 import io.quarkus.test.junit.QuarkusTest;
-
+import jakarta.inject.Inject;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -45,6 +50,7 @@
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.controllers.KeycloakDeploymentDependentResource;
 import org.keycloak.operator.controllers.KeycloakDistConfigurator;
+import org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource;
 import org.keycloak.operator.controllers.WatchedResources;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakBuilder;
@@ -55,18 +61,22 @@
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.UnsupportedSpec;
 import org.mockito.Mockito;
 
-import java.util.Arrays;
+import java.util.List;
 import java.util.Optional;
 import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
-import jakarta.inject.Inject;
-
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.keycloak.operator.ContextUtils.DIST_CONFIGURATOR_KEY;
+import static org.keycloak.operator.ContextUtils.NEW_DEPLOYMENT_KEY;
+import static org.keycloak.operator.ContextUtils.OLD_DEPLOYMENT_KEY;
+import static org.keycloak.operator.ContextUtils.OPERATOR_CONFIG_KEY;
+import static org.keycloak.operator.ContextUtils.WATCHED_RESOURCES_KEY;
 
 @QuarkusTest
 public class PodTemplateTest {
@@ -82,17 +92,28 @@ public class PodTemplateTest {
 
     KeycloakDeploymentDependentResource deployment;
 
+    @Inject
+    KeycloakUpdateJobDependentResource jobResource;
+
     @BeforeEach
     protected void setup() {
-        this.deployment = new KeycloakDeploymentDependentResource(operatorConfig, watchedResources, distConfigurator);
+        this.deployment = new KeycloakDeploymentDependentResource();
     }
 
     private StatefulSet getDeployment(PodTemplateSpec podTemplate, StatefulSet existingDeployment, Consumer<KeycloakSpecBuilder> additionalSpec) {
-        var kc = new KeycloakBuilder().withNewMetadata().withName("instance").withNamespace("keycloak-ns").endMetadata().build();
-        existingDeployment = new StatefulSetBuilder(existingDeployment).editOrNewSpec().editOrNewSelector()
+        var kc = createKeycloak(podTemplate, additionalSpec);
+
+        existingDeployment = new StatefulSetBuilder(existingDeployment).editOrNewMetadata().endMetadata().editOrNewSpec().editOrNewSelector()
                 .withMatchLabels(Utils.allInstanceLabels(kc))
                 .endSelector().endSpec().build();
 
+        //noinspection unchecked
+        Context<Keycloak> context = mockContext(existingDeployment);
+        return deployment.desired(kc, context);
+    }
+
+    private Keycloak createKeycloak(PodTemplateSpec podTemplate, Consumer<KeycloakSpecBuilder> additionalSpec) {
+        var kc = new KeycloakBuilder().withNewMetadata().withName("instance").withNamespace("keycloak-ns").endMetadata().build();
         var httpSpec = new HttpSpecBuilder().withTlsSecret("example-tls-secret").build();
         var hostnameSpec = new HostnameSpecBuilder().withHostname("example.com").build();
 
@@ -106,11 +127,19 @@ private StatefulSet getDeployment(PodTemplateSpec podTemplate, StatefulSet exist
         }
 
         kc.setSpec(keycloakSpecBuilder.build());
+        return kc;
+    }
 
+    private Context<Keycloak> mockContext(StatefulSet existingDeployment) {
         Context<Keycloak> context = Mockito.mock(Context.class);
-        Mockito.when(context.getSecondaryResource(StatefulSet.class)).thenReturn(Optional.ofNullable(existingDeployment));
-
-        return deployment.desired(kc, context);
+        ManagedWorkflowAndDependentResourceContext managedWorkflowAndDependentResourceContext = Mockito.mock(ManagedWorkflowAndDependentResourceContext.class);
+        Mockito.when(context.managedWorkflowAndDependentResourceContext()).thenReturn(managedWorkflowAndDependentResourceContext);
+        Mockito.when(managedWorkflowAndDependentResourceContext.getMandatory(OLD_DEPLOYMENT_KEY, StatefulSet.class)).thenReturn(existingDeployment);
+        Mockito.when(managedWorkflowAndDependentResourceContext.getMandatory(OPERATOR_CONFIG_KEY, Config.class)).thenReturn(operatorConfig);
+        Mockito.when(managedWorkflowAndDependentResourceContext.getMandatory(WATCHED_RESOURCES_KEY, WatchedResources.class)).thenReturn(watchedResources);
+        Mockito.when(managedWorkflowAndDependentResourceContext.getMandatory(DIST_CONFIGURATOR_KEY, KeycloakDistConfigurator.class)).thenReturn(distConfigurator);
+        Mockito.when(context.getClient()).thenReturn(Mockito.mock(KubernetesClient.class));
+        return context;
     }
 
     private StatefulSet getDeployment(PodTemplateSpec podTemplate, StatefulSet existingDeployment) {
@@ -359,6 +388,19 @@ public void testAnnotationsAreNotMerged() {
         assertThat(podTemplate.getMetadata().getAnnotations()).containsEntry("two", "2");
     }
 
+    @Test
+    public void testHttpManagment() {
+        var result = getDeployment(null, new StatefulSet(),
+                spec -> spec.withAdditionalOptions(new ValueOrSecret("http-management-scheme", "http")))
+                .getSpec()
+                .getTemplate()
+                .getSpec()
+                .getContainers()
+                .get(0);
+
+        assertEquals("HTTP", result.getReadinessProbe().getHttpGet().getScheme());
+    }
+
     @Test
     public void testRelativePathHealthProbes() {
         final Function<String, Container> setUpRelativePath = (path) -> getDeployment(null, new StatefulSet(),
@@ -396,17 +438,21 @@ public void testDefaults() {
         PodTemplateSpec additionalPodTemplate = null;
 
         // Act
-        var podTemplate = getDeployment(additionalPodTemplate).getSpec().getTemplate();
+        StatefulSetSpec spec = getDeployment(additionalPodTemplate).getSpec();
+        var podTemplate = spec.getTemplate();
         var container = podTemplate.getSpec().getContainers().get(0);
 
         // Assert
+        assertThat(spec.getServiceName()).isEqualTo("instance-discovery");
         assertNotNull(container);
         assertThat(container.getArgs()).doesNotContain(KeycloakDeploymentDependentResource.OPTIMIZED_ARG);
+        assertThat(container.getArgs()).contains("-Djgroups.bind.address=$(POD_IP)");
 
         var envVars = container.getEnv();
         assertThat(envVars.stream()).anyMatch(envVar -> envVar.getName().equals(KeycloakDeploymentDependentResource.KC_TRUSTSTORE_PATHS));
         assertThat(envVars.stream()).anyMatch(envVar -> envVar.getName().equals(KeycloakDeploymentDependentResource.KC_TRACING_SERVICE_NAME));
         assertThat(envVars.stream()).anyMatch(envVar -> envVar.getName().equals(KeycloakDeploymentDependentResource.KC_TRACING_RESOURCE_ATTRIBUTES));
+        assertThat(envVars.stream()).anyMatch(envVar -> envVar.getName().equals(KeycloakDeploymentDependentResource.POD_IP));
 
         var readiness = container.getReadinessProbe().getHttpGet();
         assertNotNull(readiness);
@@ -482,6 +528,22 @@ public void testAdditionalOptionTruststorePath() {
                         && envVar.getValue().equals("/something"));
     }
 
+    @Test
+    public void testAdditionalOptionEnvKey() {
+        // Arrange
+        PodTemplateSpec additionalPodTemplate = null;
+
+        // Act
+        var podTemplate = getDeployment(additionalPodTemplate, null,
+                s -> s.addToAdditionalOptions(new ValueOrSecret("log-level-org.package.some_class", "debug")))
+                .getSpec().getTemplate();
+
+        // Assert
+        assertThat(podTemplate.getSpec().getContainers().get(0).getEnv().stream())
+                .anyMatch(envVar -> envVar.getName().equals("KCKEY_LOG_LEVEL_ORG_PACKAGE_SOME_CLASS")
+                        && envVar.getValue().equals("log-level-org.package.some_class"));
+    }
+
     @Test
     public void testImageForceOptimized() {
         // Arrange
@@ -569,14 +631,14 @@ public void testTolerations() {
                 .getSpec().getTemplate();
 
         // Assert
-        assertThat(podTemplate.getSpec().getTolerations()).isEqualTo(Arrays.asList(toleration));
+        assertThat(podTemplate.getSpec().getTolerations()).isEqualTo(List.of(toleration));
 
         podTemplate = getDeployment(new PodTemplateSpecBuilder().withNewSpec().withTolerations(new Toleration()).endSpec().build(), null,
                 s -> s.withNewSchedulingSpec().addToTolerations(toleration).endSchedulingSpec())
                 .getSpec().getTemplate();
 
         // Assert
-        assertThat(podTemplate.getSpec().getTolerations()).isNotEqualTo(Arrays.asList(toleration));
+        assertThat(podTemplate.getSpec().getTolerations()).isNotEqualTo(List.of(toleration));
 
     }
 
@@ -593,14 +655,14 @@ public void testTopologySpreadConstraints() {
                 .getSpec().getTemplate();
 
         // Assert
-        assertThat(podTemplate.getSpec().getTopologySpreadConstraints()).isEqualTo(Arrays.asList(tsc));
+        assertThat(podTemplate.getSpec().getTopologySpreadConstraints()).isEqualTo(List.of(tsc));
 
         podTemplate = getDeployment(new PodTemplateSpecBuilder().withNewSpec().withTopologySpreadConstraints(new TopologySpreadConstraint()).endSpec().build(), null,
                 s -> s.withNewSchedulingSpec().addToTopologySpreadConstraints(tsc).endSchedulingSpec())
                 .getSpec().getTemplate();
 
         // Assert
-        assertThat(podTemplate.getSpec().getTopologySpreadConstraints()).isNotEqualTo(Arrays.asList(tsc));
+        assertThat(podTemplate.getSpec().getTopologySpreadConstraints()).isNotEqualTo(List.of(tsc));
     }
 
     @Test
@@ -628,4 +690,79 @@ public void testAffinity() {
         assertThat(podTemplate.getSpec().getAffinity()).isNotEqualTo(affinity);
     }
 
+    @Test
+    public void testProbe(){
+        PodTemplateSpec additionalPodTemplate = null;
+        var readinessProbe = new ProbeBuilder().withFailureThreshold(1).withPeriodSeconds(2).build();
+        var livenessProbe = new ProbeBuilder().withFailureThreshold(3).withPeriodSeconds(4).build();
+        var startupProbe = new ProbeBuilder().withFailureThreshold(5).withPeriodSeconds(6).build();
+        var readinessPodTemplate = getDeployment(additionalPodTemplate, null,
+                s-> s.withNewReadinessProbeSpec()
+                        .withProbeFailureThreshold(1)
+                        .withProbePeriodSeconds(2)
+                        .endReadinessProbeSpec()).getSpec().getTemplate();
+        assertThat(readinessPodTemplate.getSpec().getContainers().get(0).getReadinessProbe().getPeriodSeconds()).isEqualTo(readinessProbe.getPeriodSeconds());
+        assertThat(readinessPodTemplate.getSpec().getContainers().get(0).getReadinessProbe().getFailureThreshold()).isEqualTo(readinessProbe.getFailureThreshold());
+
+        var livenessPodTemplate = getDeployment(additionalPodTemplate, null,
+                s-> s.withNewLivenessProbeSpec()
+                        .withProbeFailureThreshold(3)
+                        .withProbePeriodSeconds(4)
+                        .endLivenessProbeSpec()).getSpec().getTemplate();
+        assertThat(livenessPodTemplate.getSpec().getContainers().get(0).getLivenessProbe().getPeriodSeconds()).isEqualTo(livenessProbe.getPeriodSeconds());
+        assertThat(livenessPodTemplate.getSpec().getContainers().get(0).getLivenessProbe().getFailureThreshold()).isEqualTo(livenessProbe.getFailureThreshold());
+
+        var startupPodTemplate = getDeployment(additionalPodTemplate, null,
+                s-> s.withNewStartupProbeSpec()
+                        .withProbeFailureThreshold(5)
+                        .withProbePeriodSeconds(6)
+                        .endStartupProbeSpec()).getSpec().getTemplate();
+        assertThat(startupPodTemplate.getSpec().getContainers().get(0).getStartupProbe().getPeriodSeconds()).isEqualTo(startupProbe.getPeriodSeconds());
+        assertThat(startupPodTemplate.getSpec().getContainers().get(0).getStartupProbe().getFailureThreshold()).isEqualTo(startupProbe.getFailureThreshold());
+    }
+
+    private Job getUpdateJob(Consumer<KeycloakSpecBuilder> newSpec, Consumer<KeycloakSpecBuilder> oldSpec, Consumer<StatefulSetBuilder> existingModifier) {
+        // create an existing from the old spec and modifier
+        StatefulSetBuilder existingBuilder = getDeployment(null, null, oldSpec).toBuilder();
+        existingModifier.accept(existingBuilder);
+        StatefulSet existingStatefulSet = existingBuilder.build();
+
+        // determine the desired statefulset state
+        StatefulSetBuilder desired = getDeployment(null, existingStatefulSet, newSpec).toBuilder();
+
+        // setup the mock context
+        Context<Keycloak> context = mockContext(existingStatefulSet);
+        var managedWorkflowAndDependentResourceContext = context.managedWorkflowAndDependentResourceContext();
+        Mockito.when(managedWorkflowAndDependentResourceContext.get(OLD_DEPLOYMENT_KEY, StatefulSet.class)).thenReturn(Optional.of(existingStatefulSet));
+        Mockito.when(managedWorkflowAndDependentResourceContext.getMandatory(NEW_DEPLOYMENT_KEY, StatefulSet.class)).thenReturn(desired.build());
+
+        return jobResource.desired(createKeycloak(null, newSpec), context);
+    }
+
+    @Test
+    public void testUpdateJobSecretHandling() {
+        Job job = getUpdateJob(builder -> {}, builder -> {}, builder -> {});
+        assertEquals(List.of(), job.getSpec().getTemplate().getSpec().getImagePullSecrets());
+
+        LocalObjectReference secret = new LocalObjectReference("secret");
+        Consumer<StatefulSetBuilder> addSecret = builder -> builder.editSpec().editTemplate().editSpec().addToImagePullSecrets(secret).endSpec().endTemplate().endSpec();
+        job = getUpdateJob(builder -> {}, builder -> {}, addSecret);
+        assertEquals(List.of(new LocalObjectReference("secret")), job.getSpec().getTemplate().getSpec().getImagePullSecrets());
+
+        job = getUpdateJob(builder -> builder.addToImagePullSecrets(new LocalObjectReference("new-secret")), builder -> {}, addSecret);
+        assertEquals(List.of(new LocalObjectReference("new-secret"), new LocalObjectReference("secret")), job.getSpec().getTemplate().getSpec().getImagePullSecrets());
+    }
+
+    @Test
+    public void testFieldRemovalForInitContainer() {
+        Job job = getUpdateJob(builder -> {
+        }, builder -> builder.withNewUnsupported().withNewPodTemplate().withNewSpec().addNewContainer()
+                .withRestartPolicy("OnFailure")
+                .withNewLifecycle().withNewPostStart().withNewExec().withCommand("hello").endExec().endPostStart()
+                .endLifecycle().endContainer().endSpec().endPodTemplate().endUnsupported(), builder -> {
+                });
+        assertNull(job.getSpec().getTemplate().getSpec().getInitContainers().get(0).getLifecycle());
+        assertNull(job.getSpec().getTemplate().getSpec().getInitContainers().get(0).getRestartPolicy());
+    }
+
 }
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/utils/CRAssert.java b/operator/src/test/java/org/keycloak/operator/testsuite/utils/CRAssert.java
index f401f87f5a7e..710459a91abe 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/utils/CRAssert.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/utils/CRAssert.java
@@ -17,41 +17,51 @@
 
 package org.keycloak.operator.testsuite.utils;
 
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
 import java.time.Duration;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.Consumer;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 
-import io.fabric8.kubernetes.api.model.Service;
-import io.fabric8.kubernetes.api.model.ServicePort;
-import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicy;
-import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyIngressRule;
-import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer;
-import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPort;
-import io.fabric8.kubernetes.client.KubernetesClient;
-import io.fabric8.kubernetes.client.utils.Serialization;
-import io.quarkus.logging.Log;
 import org.assertj.core.api.ObjectAssert;
 import org.awaitility.Awaitility;
 import org.junit.jupiter.api.Assertions;
 import org.keycloak.operator.Constants;
 import org.keycloak.operator.Utils;
+import org.keycloak.operator.controllers.KeycloakDeploymentDependentResource;
 import org.keycloak.operator.controllers.KeycloakServiceDependentResource;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatus;
 import org.keycloak.operator.crds.v2alpha1.deployment.KeycloakStatusCondition;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.NetworkPolicySpec;
 import org.keycloak.operator.crds.v2alpha1.realmimport.KeycloakRealmImport;
+import org.keycloak.operator.update.impl.RecreateOnImageChangeUpdateLogic;
 
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import io.fabric8.kubernetes.api.model.Service;
+import io.fabric8.kubernetes.api.model.ServicePort;
+import io.fabric8.kubernetes.api.model.apps.StatefulSet;
+import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicy;
+import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyIngressRule;
+import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer;
+import io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPort;
+import io.fabric8.kubernetes.client.KubernetesClient;
+import io.fabric8.kubernetes.client.dsl.RollableScalableResource;
+import io.fabric8.kubernetes.client.informers.ResourceEventHandler;
+import io.fabric8.kubernetes.client.utils.Serialization;
+import io.netty.util.NetUtil;
+import io.quarkus.logging.Log;
 
 /**
  * @author Vaclav Muzikar <vmuzikar@redhat.com>
@@ -62,10 +72,10 @@ public final class CRAssert {
     // ISPN000094 -> merge view
     private static final Pattern CLUSTER_SIZE_PATTERN = Pattern.compile("ISPN00009[34]: [^]]*] \\((\\d+)\\)");
 
-    public static void assertKeycloakStatusCondition(Keycloak kc, String condition, boolean status) {
+    public static void assertKeycloakStatusCondition(Keycloak kc, String condition, Boolean status) {
         assertKeycloakStatusCondition(kc, condition, status, null);
     }
-    public static void assertKeycloakStatusCondition(Keycloak kc, String condition, boolean status, String containedMessage) {
+    public static void assertKeycloakStatusCondition(Keycloak kc, String condition, Boolean status, String containedMessage) {
         Log.debugf("Asserting CR: %s, condition: %s, status: %s, message: %s", kc.getMetadata().getName(), condition, status, containedMessage);
         try {
             assertKeycloakStatusCondition(kc.getStatus(), condition, status, containedMessage, null);
@@ -118,6 +128,7 @@ public static void awaitClusterSize(KubernetesClient client, Keycloak keycloak,
                 .await()
                 .pollInterval(1, TimeUnit.SECONDS)
                 .timeout(Duration.ofMinutes(5))
+                .ignoreExceptions()
                 .untilAsserted(() -> client.pods()
                         .inNamespace(namespaceOf(keycloak))
                         .withLabels(Utils.allInstanceLabels(keycloak))
@@ -197,7 +208,7 @@ public static void assertConnection(KubernetesClient client, String hostname, in
                 "--connect-timeout",
                 "2",
                 "-s",
-                "telnet://%s:%s".formatted(hostname, port));
+                "telnet://%s:%s".formatted(NetUtil.isValidIpV6Address(hostname)?"["+hostname+"]":hostname, port));
         // Relevant exit codes:
         // 28-Operation timeout.
         // 48-Unknown option specified to libcurl (BOGUS=1 is not a valid option, but the connection is successful).
@@ -284,4 +295,69 @@ private static Optional<NetworkPolicyIngressRule> findIngressRuleWithPort(Networ
                 .filter(rule -> rule.getPorts().stream().anyMatch(port -> port.getPort().getIntVal() == rulePort))
                 .findFirst();
     }
+
+    public static CompletableFuture<Void> eventuallyRollingUpdateStatus(KubernetesClient client, Keycloak keycloak, String reason) {
+        var cf1 = client.resource(keycloak).informOnCondition(kcs -> {
+            try {
+                assertKeycloakStatusCondition(kcs.get(0), KeycloakStatusCondition.ROLLING_UPDATE, true, "Rolling out deployment update");
+                return true;
+            } catch (AssertionError e) {
+                return false;
+            }
+        });
+        var cf2 = client.resource(keycloak).informOnCondition(kcs -> {
+            try {
+                assertKeycloakStatusCondition(kcs.get(0), KeycloakStatusCondition.UPDATE_TYPE, false, reason);
+                return true;
+            } catch (AssertionError e) {
+                return false;
+            }
+        });
+        return CompletableFuture.allOf(cf1, cf2);
+    }
+
+    public static CompletableFuture<Void> eventuallyRecreateUpdateStatus(KubernetesClient client, Keycloak keycloak, String reason) {
+        var statefulSetResource = client.apps().statefulSets().withName(KeycloakDeploymentDependentResource.getName(keycloak));
+        String oldImage = RecreateOnImageChangeUpdateLogic.extractImage(statefulSetResource.get()); // assumes a keycloak has already been deployed
+        var cf1 = statefulSetResource.informOnCondition(statefulSets -> {
+            try {
+                StatefulSet ss = statefulSets.get(0);
+                // should scale down using the old image
+                assertTrue(ss.getSpec().getReplicas() == 0 && Objects.equals(RecreateOnImageChangeUpdateLogic.extractImage(ss), oldImage));
+                return true;
+            } catch (Error e) {
+                return false;
+            }
+        });
+
+        List<Consumer<Keycloak>> tests = List.of(
+                kc -> CRAssert.assertKeycloakStatusCondition(kc, KeycloakStatusCondition.READY, false, null),
+                kc -> assertKeycloakStatusCondition(kc, KeycloakStatusCondition.UPDATE_TYPE, true, reason));
+        CompletableFuture<Void> cf2 = new CompletableFuture<Void>();
+        AtomicInteger index = new AtomicInteger();
+
+        client.resource(keycloak).inform(new ResourceEventHandler<Keycloak>() {
+            @Override
+            public void onUpdate(Keycloak oldObj, Keycloak newObj) {
+                while (index.get() < tests.size()) {
+                    try {
+                        tests.get(index.get()).accept(newObj);
+                        index.getAndIncrement();
+                    } catch (Exception e) {
+
+                    }
+                }
+                cf2.complete(null);
+            }
+
+            @Override
+            public void onAdd(Keycloak obj) {
+            }
+
+            @Override
+            public void onDelete(Keycloak obj, boolean deletedFinalStateUnknown) {
+            }
+        });
+        return CompletableFuture.allOf(cf1, cf2);
+    }
 }
diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/utils/K8sUtils.java b/operator/src/test/java/org/keycloak/operator/testsuite/utils/K8sUtils.java
index 09d57ad0219b..a32e77a764aa 100644
--- a/operator/src/test/java/org/keycloak/operator/testsuite/utils/K8sUtils.java
+++ b/operator/src/test/java/org/keycloak/operator/testsuite/utils/K8sUtils.java
@@ -128,7 +128,7 @@ public static String inClusterCurl(KubernetesClient k8sClient, String namespace,
 
     public static CurlResult inClusterCurl(KubernetesClient k8sClient, String namespace, Map<String, String> labels, String... args) {
         Log.infof("Starting cURL in namespace '%s' with labels '%s'", namespace, labels);
-        var podName = "curl-pod-" + UUID.randomUUID();
+        var podName = "curl-pod" + (labels.isEmpty()?"":("-" + UUID.randomUUID()));
         try {
             var builder = new PodBuilder();
             builder.withNewMetadata()
@@ -142,20 +142,22 @@ public static CurlResult inClusterCurl(KubernetesClient k8sClient, String namesp
             try {
                 k8sClient.resource(curlPod).create();
             } catch (KubernetesClientException e) {
-                if (e.getCode() != HttpURLConnection.HTTP_CONFLICT) {
+                if (!labels.isEmpty() || e.getCode() != HttpURLConnection.HTTP_CONFLICT) {
                     throw e;
                 }
             }
 
             ByteArrayOutputStream output = new ByteArrayOutputStream();
 
-            try (ExecWatch watch = k8sClient.pods().resource(curlPod).withReadyWaitTimeout(60000)
+            try (ExecWatch watch = k8sClient.pods().resource(curlPod).withReadyWaitTimeout(15000)
                     .writingOutput(output)
                     .exec(Stream.concat(Stream.of("curl"), Stream.of(args)).toArray(String[]::new))) {
-                var exitCode = watch.exitCode().get(15, TimeUnit.SECONDS);
+                var exitCode = watch.exitCode().get(5, TimeUnit.SECONDS);
                 return new CurlResult(exitCode, output.toString(StandardCharsets.UTF_8));
             } finally {
-                k8sClient.resource(curlPod).delete();
+                if (!labels.isEmpty()) {
+                    k8sClient.resource(curlPod).delete();
+                }
             }
         } catch (Exception ex) {
             throw KubernetesClientException.launderThrowable(ex);
@@ -175,7 +177,12 @@ private static void createCurlContainer(PodBuilder builder) {
 
     public static void enableNetworkPolicy(Keycloak keycloak) {
         var builder = new NetworkPolicySpecBuilder();
-        builder.withNetworkPolicyEnabled(true);
+        keycloak.getSpec().setNetworkPolicySpec(builder.build());
+    }
+
+    public static void disableNetworkPolicy(Keycloak keycloak) {
+        var builder = new NetworkPolicySpecBuilder();
+        builder.withNetworkPolicyEnabled(false);
         keycloak.getSpec().setNetworkPolicySpec(builder.build());
     }
 
diff --git a/operator/src/test/resources/application.properties b/operator/src/test/resources/application.properties
index 680977d3c3c0..bd2a9c1d8449 100644
--- a/operator/src/test/resources/application.properties
+++ b/operator/src/test/resources/application.properties
@@ -6,6 +6,8 @@ quarkus.operator-sdk.start-operator=false
 quarkus.log.level=INFO
 
 kc.operator.keycloak.pod-labels."test.label"=foobar
-kc.operator.keycloak.pod-labels."testLabelWithExpression"=${OPERATOR_TEST_LABEL_EXPRESSION}
+kc.operator.keycloak.pod-labels."testLabelWithExpression"=${OPERATOR_TEST_LABEL_EXPRESSION:default}
 # allow the watching tests to complete more quickly
-kc.operator.keycloak.poll-interval-seconds=10
\ No newline at end of file
+kc.operator.keycloak.poll-interval-seconds=10
+# Update Pod timeout reduced to 1 min for testing
+kc.operator.keycloak.update-pod-deadline-seconds=60
diff --git a/operator/src/test/resources/cache-ispn.xml b/operator/src/test/resources/cache-ispn.xml
index 672e51fa23ff..15460c41c472 100644
--- a/operator/src/test/resources/cache-ispn.xml
+++ b/operator/src/test/resources/cache-ispn.xml
@@ -73,6 +73,14 @@
             <expiration max-idle="3600000"/>
             <memory max-count="1000"/>
         </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <distributed-cache name="actionTokens" owners="2">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/operator/src/test/resources/example-realm.yaml b/operator/src/test/resources/example-realm.yaml
index 98ca6c9042c4..f720d79426f3 100644
--- a/operator/src/test/resources/example-realm.yaml
+++ b/operator/src/test/resources/example-realm.yaml
@@ -1193,7 +1193,6 @@ spec:
       xRobotsTag: none
       xFrameOptions: SAMEORIGIN
       contentSecurityPolicy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
-      xXSSProtection: 1; mode=block
       strictTransportSecurity: max-age=31536000; includeSubDomains
     smtpServer: {}
     eventsEnabled: false
diff --git a/operator/src/test/resources/test-serialization-keycloak-cr-invalid-update.yml b/operator/src/test/resources/test-serialization-keycloak-cr-invalid-update.yml
new file mode 100644
index 000000000000..da29292e0ad3
--- /dev/null
+++ b/operator/src/test/resources/test-serialization-keycloak-cr-invalid-update.yml
@@ -0,0 +1,9 @@
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: test-serialization-kc
+spec:
+  instances: 3
+  image: my-image
+  update:
+    strategy: abc
diff --git a/operator/src/test/resources/test-serialization-keycloak-cr.yml b/operator/src/test/resources/test-serialization-keycloak-cr.yml
index 59c07f4adddc..ba2e3ca666c0 100644
--- a/operator/src/test/resources/test-serialization-keycloak-cr.yml
+++ b/operator/src/test/resources/test-serialization-keycloak-cr.yml
@@ -32,6 +32,15 @@ spec:
     annotations:
       myAnnotation: myValue
       anotherAnnotation: anotherValue
+  readinessProbe:
+    periodSeconds: 50
+    failureThreshold: 3
+  livenessProbe:
+    periodSeconds: 60
+    failureThreshold: 1
+  startupProbe:
+    periodSeconds: 40
+    failureThreshold: 2
   networkPolicy:
     enabled: true
     http:
@@ -123,6 +132,9 @@ spec:
       secret: something
     service:
       secret: else
+  update:
+    strategy: Auto
+    revision: 1
   unsupported:
     podTemplate:
       metadata:
diff --git a/operator/src/test/resources/test-serialization-realmimport-cr.yml b/operator/src/test/resources/test-serialization-realmimport-cr.yml
index f71d6d44aa3c..234f28c5bf5f 100644
--- a/operator/src/test/resources/test-serialization-realmimport-cr.yml
+++ b/operator/src/test/resources/test-serialization-realmimport-cr.yml
@@ -670,6 +670,7 @@ spec:
           saml.authnstatement: 'false'
           display.on.consent.screen: 'false'
           token.response.type.bearer.lower-case: 'false'
+          access.token.header.type.rfc9068: 'false'
           saml.onetimeuse.condition: 'false'
         authenticationFlowBindingOverrides: {}
         fullScopeAllowed: true
@@ -1074,7 +1075,6 @@ spec:
       xRobotsTag: none
       xFrameOptions: SAMEORIGIN
       contentSecurityPolicy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
-      xXSSProtection: 1; mode=block
       strictTransportSecurity: max-age=31536000; includeSubDomains
     smtpServer: {}
     eventsEnabled: false
diff --git a/operator/src/test/resources/token-test-realm.yaml b/operator/src/test/resources/token-test-realm.yaml
index 32e11e15e13a..2870cba305c3 100644
--- a/operator/src/test/resources/token-test-realm.yaml
+++ b/operator/src/test/resources/token-test-realm.yaml
@@ -666,6 +666,7 @@ spec:
           saml.authnstatement: 'false'
           display.on.consent.screen: 'false'
           token.response.type.bearer.lower-case: 'false'
+          access.token.header.type.rfc9068: 'false'
           saml.onetimeuse.condition: 'false'
         authenticationFlowBindingOverrides: {}
         fullScopeAllowed: true
@@ -1070,7 +1071,6 @@ spec:
       xRobotsTag: none
       xFrameOptions: SAMEORIGIN
       contentSecurityPolicy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
-      xXSSProtection: 1; mode=block
       strictTransportSecurity: max-age=31536000; includeSubDomains
     smtpServer: {}
     eventsEnabled: false
diff --git a/pom.xml b/pom.xml
index 3c35c5d995a2..42eea7174fab 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,15 +45,9 @@
 
         <asciidoctor.plugin.version>1.5.8</asciidoctor.plugin.version>
 
-        <jboss.repo.nexusUrl>https://s01.oss.sonatype.org/</jboss.repo.nexusUrl>
-        <jboss.releases.repo.id>jboss-releases-repository</jboss.releases.repo.id>
-        <jboss.releases.repo.name>keycloak</jboss.releases.repo.name>
-        <jboss.releases.repo.url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</jboss.releases.repo.url>
-        <jboss.snapshots.repo.id>jboss-snapshots-repository</jboss.snapshots.repo.id>
-        <jboss.snapshots.repo.url>https://s01.oss.sonatype.org/content/repositories/snapshots/</jboss.snapshots.repo.url>
-
-        <quarkus.version>3.15.2</quarkus.version>
-        <quarkus.build.version>3.15.2</quarkus.build.version>
+        <quarkus.version>3.24.2</quarkus.version>
+        <quarkus.build.version>3.24.2</quarkus.build.version>
+        <jboss-logging-annotations.version>3.0.4.Final</jboss-logging-annotations.version> <!-- keep in sync with the version used by quarkus -->
 
         <project.build-time>${timestamp}</project.build-time>
 
@@ -96,8 +90,9 @@
         <h2.version>2.3.230</h2.version>
         <hibernate-orm.plugin.version>6.2.13.Final</hibernate-orm.plugin.version>
         <hibernate.c3p0.version>6.2.13.Final</hibernate.c3p0.version>
-        <infinispan.version>15.0.11.Final</infinispan.version>
-        <protostream.plugin.version>5.0.12.Final</protostream.plugin.version>
+        <infinispan.version>15.0.16.Final</infinispan.version>
+        <protostream.version>5.0.14.Final</protostream.version> <!-- For the annotation processor: keep in sync with the version shipped with Infinispan -->
+        <protostream.plugin.version>${protostream.version}</protostream.plugin.version>
 
         <!--JAKARTA-->
         <jakarta.mail.version>2.1.1</jakarta.mail.version>
@@ -111,7 +106,8 @@
         <jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version>2.0.1.Final</jboss.spec.javax.xml.bind.jboss-jaxb-api_2.3_spec.version>
         <jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version>2.0.0.Final</jboss.spec.javax.servlet.jsp.jboss-jsp-api_2.3_spec.version>
         <log4j.version>1.2.17</log4j.version>
-        <resteasy.version>6.2.9.Final</resteasy.version>
+        <log4j2-api.version>2.24.3</log4j2-api.version> <!-- Odd name needs to align with Quarkus -->
+        <resteasy.version>6.2.12.Final</resteasy.version>
         <resteasy.undertow.version>${resteasy.version}</resteasy.undertow.version>
         <owasp.html.sanitizer.version>20240325.1</owasp.html.sanitizer.version>
         <slf4j.version>2.0.6</slf4j.version>
@@ -124,7 +120,7 @@
         <undertow.version>${undertow-legacy.version}</undertow.version>
         <undertow-legacy.version>2.2.24.Final</undertow-legacy.version>
         <undertow-jakarta.version>2.3.2.Final</undertow-jakarta.version>
-        <wildfly-elytron.version>2.5.2.Final</wildfly-elytron.version>
+        <wildfly-elytron.version>2.6.4.Final</wildfly-elytron.version>
         <elytron.undertow-server.version>1.9.0.Final</elytron.undertow-server.version>
         <woodstox.version>6.0.3</woodstox.version>
         <wildfly.common.quarkus.aligned.version>1.5.4.Final-format-001</wildfly.common.quarkus.aligned.version>
@@ -134,7 +130,7 @@
         <ua-parser.version>1.5.4</ua-parser.version>
         <org.yaml.snakeyaml.version>2.0</org.yaml.snakeyaml.version>
         <picketbox.version>5.0.3.Final</picketbox.version>
-        <xstream.version>1.4.20</xstream.version>
+        <xstream.version>1.4.21</xstream.version>
         <org.snakeyaml.snakeyaml-engine.version>2.6</org.snakeyaml.snakeyaml-engine.version>
 
         <!-- Others -->
@@ -160,23 +156,23 @@
         <mysql-jdbc.version>8.3.0</mysql-jdbc.version>
         <postgresql.version>17</postgresql.version>
         <postgresql.container>mirror.gcr.io/postgres:${postgresql.version}</postgresql.container>
-        <aurora-postgresql.version>16.1</aurora-postgresql.version>
-        <aws-jdbc-wrapper.version>2.3.1</aws-jdbc-wrapper.version>
-        <postgresql-jdbc.version>42.7.4</postgresql-jdbc.version>
+        <aurora-postgresql.version>16.8</aurora-postgresql.version>
+        <aws-jdbc-wrapper.version>2.5.6</aws-jdbc-wrapper.version>
+        <postgresql-jdbc.version>42.7.7</postgresql-jdbc.version>
         <mariadb.version>11.4</mariadb.version>
         <mariadb.container>mirror.gcr.io/mariadb:${mariadb.version}</mariadb.container>
-        <mariadb-jdbc.version>3.4.1</mariadb-jdbc.version>
+        <mariadb-jdbc.version>3.5.4</mariadb-jdbc.version>
         <mssql.version>2022</mssql.version>
         <mssql.container>mcr.microsoft.com/mssql/server:${mssql.version}-latest</mssql.container>
         <!-- this is the mssql driver version also used in the Quarkus BOM -->
-        <mssql-jdbc.version>12.8.1.jre11</mssql-jdbc.version>
+        <mssql-jdbc.version>12.10.0.jre11</mssql-jdbc.version>
         <oracledb.version>23.5</oracledb.version>
         <oracledb.container>mirror.gcr.io/gvenzl/oracle-free:${oracledb.version}-slim-faststart</oracledb.container>
         <!-- this is the oracle driver version also used in the Quarkus BOM -->
-        <oracle-jdbc.version>23.5.0.24.07</oracle-jdbc.version>
+        <oracle-jdbc.version>23.6.0.24.10</oracle-jdbc.version>
 
         <!-- Test -->
-        <greenmail.version>2.1.0-alpha-1</greenmail.version>
+        <greenmail.version>2.1.3</greenmail.version>
         <jmeter.version>2.10</jmeter.version>
         <junit.version>4.13.2</junit.version>
         <picketlink.version>2.7.0.Final</picketlink.version>
@@ -193,7 +189,7 @@
         <jmeter.plugin.version>1.9.0</jmeter.plugin.version>
         <jmeter.analysis.plugin.version>1.0.4</jmeter.analysis.plugin.version>
         <wildfly.plugin.version>5.0.0.Final</wildfly.plugin.version>
-        <nexus.staging.plugin.version>1.6.13</nexus.staging.plugin.version>
+        <central.publishing.plugin.version>0.7.0</central.publishing.plugin.version>
         <nexus3.staging.plugin.version>1.0.7</nexus3.staging.plugin.version>
         <frontend.plugin.version>1.15.0</frontend.plugin.version>
         <docker.maven.plugin.version>0.40.3</docker.maven.plugin.version>
@@ -216,7 +212,7 @@
         </surefire.system.args>
 
         <!-- webauthn support -->
-        <webauthn4j.version>0.21.5.RELEASE</webauthn4j.version>
+        <webauthn4j.version>0.29.3.RELEASE</webauthn4j.version>
         <org.apache.kerby.kerby-asn1.version>2.0.3</org.apache.kerby.kerby-asn1.version>
 
         <!-- Used to test SAML Galleon feature-pack layers discovery -->
@@ -255,10 +251,13 @@
 
     <distributionManagement>
         <repository>
-            <id>${jboss.releases.repo.id}</id>
-            <name>JBoss Releases Repository</name>
-            <url>${jboss.releases.repo.url}</url>
+            <id>keycloak-publish</id>
+            <url>https://central.sonatype.com/</url>
         </repository>
+        <snapshotRepository>
+            <id>keycloak-publish</id>
+            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+        </snapshotRepository>
     </distributionManagement>
 
     <issueManagement>
@@ -288,6 +287,7 @@
         <module>federation</module>
         <module>services</module>
         <module>themes</module>
+        <module>misc/theme-verifier</module>
         <module>model</module>
         <module>util</module>
         <module>rest</module>
@@ -536,6 +536,16 @@
                 <artifactId>log4j</artifactId>
                 <version>${log4j.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>${log4j2-api.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${log4j2-api.version}</version>
+            </dependency>
             <dependency>
                 <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
                 <artifactId>owasp-java-html-sanitizer</artifactId>
@@ -1098,7 +1108,12 @@
                 <artifactId>keycloak-rest-admin-ui-ext</artifactId>
                 <version>${project.version}</version>
             </dependency>
-
+            <dependency>
+                <groupId>org.keycloak</groupId>
+                <artifactId>keycloak-saml-wildfly-modules</artifactId>
+                <version>${project.version}</version>
+                <type>zip</type>
+            </dependency>
             <dependency>
                 <groupId>org.keycloak</groupId>
                 <artifactId>keycloak-quarkus-dist</artifactId>
@@ -1138,6 +1153,11 @@
                 <version>${project.version}</version>
                 <classifier>classes</classifier>
             </dependency>
+            <dependency>
+                <groupId>org.keycloak.tests</groupId>
+                <artifactId>keycloak-tests-utils-shared</artifactId>
+                <version>${project.version}</version>
+            </dependency>
 
             <dependency>
                 <groupId>org.keycloak</groupId>
@@ -1294,16 +1314,6 @@
     <build>
         <pluginManagement>
             <plugins>
-                <plugin>
-                    <groupId>org.sonatype.plugins</groupId>
-                    <artifactId>nexus-staging-maven-plugin</artifactId>
-                    <version>${nexus.staging.plugin.version}</version>
-                    <extensions>true</extensions>
-                    <configuration>
-                        <serverId>${jboss.releases.repo.id}</serverId>
-                        <nexusUrl>${jboss.repo.nexusUrl}</nexusUrl>
-                    </configuration>
-                </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-shade-plugin</artifactId>
@@ -1613,12 +1623,22 @@
         </profile>
 
         <profile>
-            <id>nexus-staging</id>
+            <id>central-staging</id>
             <build>
                 <plugins>
                     <plugin>
-                        <groupId>org.sonatype.plugins</groupId>
-                        <artifactId>nexus-staging-maven-plugin</artifactId>
+                        <groupId>org.sonatype.central</groupId>
+                        <artifactId>central-publishing-maven-plugin</artifactId>
+                        <version>${central.publishing.plugin.version}</version>
+                        <extensions>true</extensions>
+                        <configuration>
+                            <autoPublish>true</autoPublish>
+                            <checksums>all</checksums>
+                            <deploymentName>keycloak-${project.version}</deploymentName>
+                            <publishingServerId>keycloak-publish</publishingServerId>
+                            <waitUntil>published</waitUntil>
+                            <waitMaxTime>3600</waitMaxTime>
+                        </configuration>
                     </plugin>
                 </plugins>
             </build>
diff --git a/quarkus/CONTRIBUTING.md b/quarkus/CONTRIBUTING.md
index 7bf6aa66cd1e..37666b49fb2c 100644
--- a/quarkus/CONTRIBUTING.md
+++ b/quarkus/CONTRIBUTING.md
@@ -104,7 +104,7 @@ The `kc.sh|bat` script allows you to remotely debug the distribution. For that,
 kc.sh --debug start-dev
 ```
 
-By default, the debug port is available at `8787`.
+By default, the debug port is available at `8787`. Additionally, you can specify IPv4 or bracketed IPv6 addresses with optional ports, e.g. `--debug 127.0.0.1`, `--debug 127.0.0.1:8786`, `--debug [::1]`, `--debug [::1]:8785`. Make sure to exercise caution when setting IP addresses in the `--debug` parameter, since a value such as `--debug 0.0.0.0:8787` will expose the debug port to all network interfaces!
 
 An additional environment variable `DEBUG_SUSPEND` can be set to suspend the JVM, when launched in debug mode. The `DEBUG_SUSPEND` variable supports the following values:
 
diff --git a/quarkus/README.md b/quarkus/README.md
index baf9cf4a87b0..a3466111d068 100644
--- a/quarkus/README.md
+++ b/quarkus/README.md
@@ -59,7 +59,16 @@ For development purposes, you can run the server in development mode instead usi
 This spins up Keycloak using a development database (h2-file) and with insecure HTTP enabled.
 
 ### Running from your IDE
-Alternatively, you can run the server in development mode from your IDE. For that, run the `org.keycloak.quarkus._private.IDELauncher` main class in the `server` directory.
+Alternatively, you can run the server in development mode from your IDE. For that, run the `org.keycloak.Keycloak` main class in the `tests/junit5` directory.
+
+If you have problems starting the server in debug mode, add following environment variables to your run config:
+
+    -Djava.util.logging.manager=org.jboss.logmanager.LogManager
+    -Djava.util.concurrent.ForkJoinPool.common.threadFactory=io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory
+
+Set the `kc.home.dir` environment variable for keeping state between startups:
+    
+    -Dkc.home.dir=.kc 
 
 ## Contributing
 Please make sure to read our [Contribution Guidelines](../CONTRIBUTING.md) before contributing.
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/CachingOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/CachingOptions.java
index afab51aa2d3e..439b1b3fffdf 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/CachingOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/CachingOptions.java
@@ -8,13 +8,18 @@ public class CachingOptions {
 
     public static final String CACHE_CONFIG_FILE_PROPERTY = "cache-config-file";
 
-    private static final String CACHE_EMBEDDED_PREFIX = "cache-embedded";
+    public static final String CACHE_EMBEDDED_PREFIX = "cache-embedded";
     private static final String CACHE_EMBEDDED_MTLS_PREFIX = CACHE_EMBEDDED_PREFIX + "-mtls";
     public static final String CACHE_EMBEDDED_MTLS_ENABLED_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-enabled";
     public static final String CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-key-store-file";
     public static final String CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-key-store-password";
     public static final String CACHE_EMBEDDED_MTLS_TRUSTSTORE_FILE_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-trust-store-file";
     public static final String CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-trust-store-password";
+    public static final String CACHE_EMBEDDED_MTLS_ROTATION_PROPERTY = CACHE_EMBEDDED_MTLS_PREFIX + "-rotation-interval-days";
+    public static final String CACHE_EMBEDDED_NETWORK_BIND_ADDRESS_PROPERTY = CACHE_EMBEDDED_PREFIX + "-network-bind-address";
+    public static final String CACHE_EMBEDDED_NETWORK_BIND_PORT_PROPERTY = CACHE_EMBEDDED_PREFIX + "-network-bind-port";
+    public static final String CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS_PROPERTY = CACHE_EMBEDDED_PREFIX + "-network-external-address";
+    public static final String CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT_PROPERTY = CACHE_EMBEDDED_PREFIX + "-network-external-port";
 
     private static final String CACHE_REMOTE_PREFIX = "cache-remote";
     public static final String CACHE_REMOTE_HOST_PROPERTY = CACHE_REMOTE_PREFIX + "-host";
@@ -26,7 +31,7 @@ public class CachingOptions {
     private static final String CACHE_METRICS_PREFIX = "cache-metrics";
     public static final String CACHE_METRICS_HISTOGRAMS_ENABLED_PROPERTY = CACHE_METRICS_PREFIX + "-histograms-enabled";
 
-    public static final String[] LOCAL_MAX_COUNT_CACHES = new String[]{"authorization", "keys", "realms", "users", };
+    public static final String[] LOCAL_MAX_COUNT_CACHES = new String[]{"authorization", "crl", "keys", "realms", "users", };
 
     public static final String[] CLUSTERED_MAX_COUNT_CACHES = new String[]{"clientSessions", "offlineSessions", "offlineClientSessions", "sessions"};
 
@@ -62,9 +67,9 @@ public String toString() {
     public static final Option<Stack> CACHE_STACK = new OptionBuilder<>("cache-stack", Stack.class)
             .category(OptionCategory.CACHE)
             .strictExpectedValues(false)
-            .description("Define the default stack to use for cluster communication and node discovery.")
-            .defaultValue(Stack.jdbc_ping)
-            .deprecatedValues("Use 'jdbc-ping' instead", Stack.azure, Stack.ec2, Stack.google, Stack.tcp, Stack.udp, Stack.jdbc_ping_udp)
+            .description("Define the default stack to use for cluster communication and node discovery. Defaults to 'jdbc-ping' if not set.")
+            // Do not set a default value here as it would otherwise overwrite an explicit stack chosen in cache config XML
+            .deprecatedValues("Use 'jdbc-ping' instead by leaving it unset", Stack.azure, Stack.ec2, Stack.google, Stack.jdbc_ping_udp, Stack.kubernetes, Stack.tcp, Stack.udp)
             .build();
 
     public static final Option<File> CACHE_CONFIG_FILE = new OptionBuilder<>(CACHE_CONFIG_FILE_PROPERTY, File.class)
@@ -75,14 +80,14 @@ public String toString() {
 
     public static final Option<Boolean> CACHE_EMBEDDED_MTLS_ENABLED = new OptionBuilder<>(CACHE_EMBEDDED_MTLS_ENABLED_PROPERTY, Boolean.class)
             .category(OptionCategory.CACHE)
-            .description("Encrypts the network communication between Keycloak servers.")
-            .defaultValue(Boolean.FALSE)
+            .description("Encrypts the network communication between Keycloak servers. If no additional parameters about a keystore and truststore are provided, ephemeral key pairs and certificates are created and rotated automatically, which is recommended for standard setups.")
+            .defaultValue(Boolean.TRUE)
             .build();
 
     public static final Option<String> CACHE_EMBEDDED_MTLS_KEYSTORE = new OptionBuilder<>(CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY, String.class)
             .category(OptionCategory.CACHE)
             .description("The Keystore file path. The Keystore must contain the certificate to use by the TLS protocol. " +
-                    "By default, it lookup 'cache-mtls-keystore.p12' under conf/ directory.")
+                    "By default, it looks up 'cache-mtls-keystore.p12' under conf/ directory.")
             .build();
 
     public static final Option<String> CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD = new OptionBuilder<>(CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD_PROPERTY, String.class)
@@ -102,6 +107,34 @@ public String toString() {
             .description("The password to access the Truststore.")
             .build();
 
+    public static final Option<Integer> CACHE_EMBEDDED_MTLS_ROTATION = new OptionBuilder<>(CACHE_EMBEDDED_MTLS_ROTATION_PROPERTY, Integer.class)
+            .category(OptionCategory.CACHE)
+            .defaultValue(30)
+            .description("Rotation period in days of automatic JGroups MTLS certificates.")
+            .build();
+
+    public static final Option<String> CACHE_EMBEDDED_NETWORK_BIND_ADDRESS = new OptionBuilder<>(CACHE_EMBEDDED_NETWORK_BIND_ADDRESS_PROPERTY, String.class)
+          .category(OptionCategory.CACHE)
+          .description("IP address used by clustering transport. By default, SITE_LOCAL is used.")
+          .build();
+
+    public static final Option<Integer> CACHE_EMBEDDED_NETWORK_BIND_PORT = new OptionBuilder<>(CACHE_EMBEDDED_NETWORK_BIND_PORT_PROPERTY, Integer.class)
+          .category(OptionCategory.CACHE)
+          .description("The Port the clustering transport will bind to. By default, port 7800 is used.")
+          .build();
+
+    public static final Option<String> CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS = new OptionBuilder<>(CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS_PROPERTY, String.class)
+          .category(OptionCategory.CACHE)
+          .description("IP address that other instances in the cluster should use to contact this node. Set only if it is " +
+                "different to %s, for example when this instance is behind a firewall.".formatted(CACHE_EMBEDDED_NETWORK_BIND_ADDRESS_PROPERTY))
+          .build();
+
+    public static final Option<Integer> CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT = new OptionBuilder<>(CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT_PROPERTY, Integer.class)
+          .category(OptionCategory.CACHE)
+          .description("Port that other instances in the cluster should use to contact this node. Set only if it is different " +
+                "to %s, for example when this instance is behind a firewall".formatted(CACHE_EMBEDDED_NETWORK_BIND_PORT_PROPERTY))
+          .build();
+
     public static final Option<String> CACHE_REMOTE_HOST = new OptionBuilder<>(CACHE_REMOTE_HOST_PROPERTY, String.class)
             .category(OptionCategory.CACHE)
             .description("The hostname of the external Infinispan cluster.")
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
index 8f2d0dc34465..bd719e018b25 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/DatabaseOptions.java
@@ -2,6 +2,11 @@
 
 import org.keycloak.config.database.Database;
 
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
 public class DatabaseOptions {
 
     public static final Option<String> DB_DIALECT = new OptionBuilder<>("db-dialect", String.class)
@@ -82,4 +87,130 @@ public class DatabaseOptions {
             .defaultValue(100)
             .description("The maximum size of the connection pool.")
             .build();
+
+    public static final Option<Boolean> DB_SQL_JPA_DEBUG = new OptionBuilder<>("db-debug-jpql", Boolean.class)
+            .category(OptionCategory.DATABASE)
+            .defaultValue(false)
+            .description("Add JPQL information as comments to SQL statements to debug JPA SQL statement generation.")
+            .build();
+
+    public static final Option<Integer> DB_SQL_LOG_SLOW_QUERIES = new OptionBuilder<>("db-log-slow-queries-threshold", Integer.class)
+            .category(OptionCategory.DATABASE)
+            .description("Log SQL statements slower than the configured threshold with logger org.hibernate.SQL_SLOW and log-level info.")
+            .defaultValue(10000)
+            .build();
+
+    public static final Option<Boolean> DB_ACTIVE_DATASOURCE = new OptionBuilder<>("db-active-<datasource>", Boolean.class)
+            .category(OptionCategory.DATABASE_DATASOURCES)
+            .defaultValue(true)
+            .description("Deactivate specific named datasource <datasource>.")
+            .build();
+
+    public static final Option<String> DB_POSTGRESQL_TARGET_SERVER_TYPE = new OptionBuilder<>("db-postgres-target-server-type", String.class)
+            .category(OptionCategory.DATABASE)
+            .hidden()
+            .build();
+
+    /**
+     * Options that have their sibling for a named datasource
+     * Example: for `db-dialect`, `db-dialect-<datasource>` is created
+     */
+    public static final List<Option<?>> OPTIONS_DATASOURCES = List.of(
+            DatabaseOptions.DB_DIALECT,
+            DatabaseOptions.DB_DRIVER,
+            DatabaseOptions.DB,
+            DatabaseOptions.DB_URL,
+            DatabaseOptions.DB_URL_HOST,
+            DatabaseOptions.DB_URL_DATABASE,
+            DatabaseOptions.DB_URL_PORT,
+            DatabaseOptions.DB_URL_PROPERTIES,
+            DatabaseOptions.DB_USERNAME,
+            DatabaseOptions.DB_PASSWORD,
+            DatabaseOptions.DB_SCHEMA,
+            DatabaseOptions.DB_POOL_INITIAL_SIZE,
+            DatabaseOptions.DB_POOL_MIN_SIZE,
+            DatabaseOptions.DB_POOL_MAX_SIZE
+    );
+
+    /**
+     * In order to avoid ambiguity, we need to have unique option names for wildcard options.
+     * This map controls overriding option name to be unique for wildcard option.
+     */
+    private static final Map<String, String> DATASOURCES_OVERRIDES_SUFFIX = Map.of(
+            DatabaseOptions.DB.getKey(), "-kind", // db-kind
+            DatabaseOptions.DB_URL.getKey(), "-full"  // db-url-full
+    );
+
+    private static final Map<String, Option<?>> cachedDatasourceOptions = new HashMap<>();
+
+
+    /**
+     * Get datasource option containing named datasource mapped to parent DB options.
+     * <p>
+     * We map DB options to named datasource options like:
+     * <ul>
+     *     <li>{@code db-url-host --> db-url-host-<datasource>}</li>
+     *     <li>{@code db-username --> db-username-<datasource>}</li>
+     *     <li>{@code db --> db-kind-<datasource>}</li>
+     * </ul>
+     */
+    @SuppressWarnings("unchecked")
+    public static <T> Optional<Option<T>> getDatasourceOption(Option<T> parentOption) {
+        if (!OPTIONS_DATASOURCES.contains(parentOption)) {
+            return Optional.empty();
+        }
+
+        var key = getKeyForDatasource(parentOption);
+        if (key.isEmpty()) {
+            return Optional.empty();
+        }
+
+        // check if we already created the same option and return it from the cache
+        Option<?> option = cachedDatasourceOptions.get(key.get());
+
+        if (option == null) {
+            var builder = parentOption.toBuilder()
+                    .key(key.get())
+                    .category(OptionCategory.DATABASE_DATASOURCES);
+
+            if (!parentOption.isHidden()) {
+                builder.description("Used for named <datasource>. " + parentOption.getDescription());
+            }
+
+            option = builder.build();
+            cachedDatasourceOptions.put(key.get(), option);
+        }
+        return Optional.of((Option<T>) option);
+    }
+
+    /**
+     * Get mapped datasource key based on DB option {@param option}
+     */
+    public static Optional<String> getKeyForDatasource(Option<?> option) {
+        return getKeyForDatasource(option.getKey());
+    }
+
+    /**
+     * Get mapped datasource key based on DB option {@param option}
+     */
+    public static Optional<String> getKeyForDatasource(String option) {
+        return Optional.of(option)
+                .filter(o -> OPTIONS_DATASOURCES.stream().map(Option::getKey).anyMatch(o::equals))
+                .map(key -> key.concat(DATASOURCES_OVERRIDES_SUFFIX.getOrDefault(key, "")))
+                .map(key -> key.concat("-<datasource>"));
+    }
+
+    /**
+     * Returns datasource option based on DB option {@code option} with actual wildcard value.
+     * It replaces the {@code <datasource>} with actual value in {@code namedProperty}.
+     * <p>
+     * f.e. Consider {@code option}={@link DatabaseOptions#DB_DRIVER}, and {@code namedProperty}=my-store.
+     * <p>
+     * Result: {@code db-driver-my-store}
+     */
+    public static Optional<String> getResultNamedKey(Option<?> option, String namedProperty) {
+        return getKeyForDatasource(option)
+                .map(key -> key.substring(0, key.indexOf("<")))
+                .map(key -> key.concat(namedProperty));
+    }
 }
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/EventOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/EventOptions.java
index ac34b27926a3..02f4c8c1b155 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/EventOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/EventOptions.java
@@ -21,7 +21,7 @@ public class EventOptions {
 
     public static final Option<List<String>> USER_EVENT_METRICS_EVENTS = OptionBuilder.listOptionBuilder("event-metrics-user-events", String.class)
             .category(OptionCategory.EVENTS)
-            .description("Comma-separated list of events to be collected for user event metrics. Reduce the number of metrics. If empty or not set, all events create a metric.")
+            .description("Comma-separated list of events to be collected for user event metrics. This option can be used to reduce the number of metrics created as by default all user events create a metric.")
             .buildTime(false)
             .expectedValues(sortedListOfEvents())
             .deprecatedMetadata(DeprecatedMetadata.deprecateValues("Use `remove_credential` instead of `remove_totp`, and `update_credential` instead of `update_totp` and `update_password`.", "remove_totp", "update_totp", "update_password"))
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/LoggingOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/LoggingOptions.java
index 6e367d38fb76..c8082b7f61e5 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/LoggingOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/LoggingOptions.java
@@ -1,6 +1,5 @@
 package org.keycloak.config;
 
-import io.quarkus.runtime.configuration.MemorySize;
 import org.jboss.logmanager.handlers.SyslogHandler;
 
 import java.io.File;
@@ -66,6 +65,12 @@ public String toString() {
             .caseInsensitiveExpectedValues(true)
             .build();
 
+    public static final Option<Boolean> LOG_ASYNC = new OptionBuilder<>("log-async", Boolean.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(false)
+            .description("Indicates whether to log asynchronously to all handlers.")
+            .build();
+
     public enum Output {
         DEFAULT,
         JSON;
@@ -76,6 +81,16 @@ public String toString() {
         }
     }
 
+    public enum JsonFormat {
+        DEFAULT,
+        ECS;
+
+        @Override
+        public String toString() {
+            return super.toString().toLowerCase(Locale.ROOT);
+        }
+    }
+
     // Console
     public static final Option<Output> LOG_CONSOLE_OUTPUT = new OptionBuilder<>("log-console-output", Output.class)
             .category(OptionCategory.LOGGING)
@@ -98,6 +113,12 @@ public String toString() {
             .defaultValue(DEFAULT_LOG_FORMAT)
             .build();
 
+    public static final Option<JsonFormat> LOG_CONSOLE_JSON_FORMAT = new OptionBuilder<>("log-console-json-format", JsonFormat.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(JsonFormat.DEFAULT)
+            .description("Set the format of the produced JSON.")
+            .build();
+
     public static final Option<Boolean> LOG_CONSOLE_INCLUDE_TRACE = new OptionBuilder<>("log-console-include-trace", Boolean.class)
             .category(OptionCategory.LOGGING)
             .description(format("Include tracing information in the console log. If the '%s' option is specified, this option has no effect.", LOG_CONSOLE_FORMAT.getKey()))
@@ -115,6 +136,19 @@ public String toString() {
             .hidden()
             .build();
 
+    // Console Async
+    public static final Option<Boolean> LOG_CONSOLE_ASYNC = new OptionBuilder<>("log-console-async", Boolean.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(false)
+            .description("Indicates whether to log asynchronously to console. If not set, value from the parent property '%s' is used.".formatted(LOG_ASYNC.getKey()))
+            .build();
+
+    public static final Option<Integer> LOG_CONSOLE_ASYNC_QUEUE_LENGTH = new OptionBuilder<>("log-console-async-queue-length", Integer.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(512)
+            .description("The queue length to use before flushing writing when logging to console.")
+            .build();
+
     // File
     public static final Option<Boolean> LOG_FILE_ENABLED = new OptionBuilder<>("log-file-enabled", Boolean.class)
             .category(OptionCategory.LOGGING)
@@ -142,6 +176,12 @@ public String toString() {
             .defaultValue(DEFAULT_LOG_FORMAT)
             .build();
 
+    public static final Option<JsonFormat> LOG_FILE_JSON_FORMAT = new OptionBuilder<>("log-file-json-format", JsonFormat.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(JsonFormat.DEFAULT)
+            .description("Set the format of the produced JSON.")
+            .build();
+
     public static final Option<Boolean> LOG_FILE_INCLUDE_TRACE = new OptionBuilder<>("log-file-include-trace", Boolean.class)
             .category(OptionCategory.LOGGING)
             .description(format("Include tracing information in the file log. If the '%s' option is specified, this option has no effect.", LOG_FILE_FORMAT.getKey()))
@@ -154,6 +194,19 @@ public String toString() {
             .description("Set the log output to JSON or default (plain) unstructured logging.")
             .build();
 
+    // File async
+    public static final Option<Boolean> LOG_FILE_ASYNC = new OptionBuilder<>("log-file-async", Boolean.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(false)
+            .description("Indicates whether to log asynchronously to file log. If not set, value from the parent property '%s' is used.".formatted(LOG_ASYNC.getKey()))
+            .build();
+
+    public static final Option<Integer> LOG_FILE_ASYNC_QUEUE_LENGTH = new OptionBuilder<>("log-file-async-queue-length", Integer.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(512)
+            .description("The queue length to use before flushing writing when logging to file log.")
+            .build();
+
     // Syslog
     public static final Option<Boolean> LOG_SYSLOG_ENABLED = new OptionBuilder<>("log-syslog-enabled", Boolean.class)
             .category(OptionCategory.LOGGING)
@@ -208,6 +261,12 @@ public String toString() {
             .defaultValue(DEFAULT_LOG_FORMAT)
             .build();
 
+    public static final Option<JsonFormat> LOG_SYSLOG_JSON_FORMAT = new OptionBuilder<>("log-syslog-json-format", JsonFormat.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(JsonFormat.DEFAULT)
+            .description("Set the format of the produced JSON.")
+            .build();
+
     public static final Option<Boolean> LOG_SYSLOG_INCLUDE_TRACE = new OptionBuilder<>("log-syslog-include-trace", Boolean.class)
             .category(OptionCategory.LOGGING)
             .description(format("Include tracing information in the Syslog. If the '%s' option is specified, this option has no effect.", LOG_SYSLOG_FORMAT.getKey()))
@@ -220,4 +279,26 @@ public String toString() {
             .description("Set the Syslog output to JSON or default (plain) unstructured logging.")
             .build();
 
+    // we can use SyslogConfig.CountingFraming type once https://github.com/quarkusio/quarkus/pull/48479 is present
+    public static final String SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT = "protocol-dependent";
+    public static final Option<String> LOG_SYSLOG_COUNTING_FRAMING = new OptionBuilder<>("log-syslog-counting-framing", String.class)
+            .category(OptionCategory.LOGGING)
+            .expectedValues(Boolean.TRUE.toString(), Boolean.FALSE.toString(), SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT)
+            .defaultValue(SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT)
+            .description("If 'true', the message being sent is prefixed with the size of the message. If '%s', the default value is 'true' when '%s' is 'tcp' or 'ssl-tcp', otherwise 'false'."
+                    .formatted(SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT, LOG_SYSLOG_PROTOCOL.getKey()))
+            .build();
+
+    // Syslog async
+    public static final Option<Boolean> LOG_SYSLOG_ASYNC = new OptionBuilder<>("log-syslog-async", Boolean.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(false)
+            .description("Indicates whether to log asynchronously to Syslog. If not set, value from the parent property '%s' is used.".formatted(LOG_ASYNC.getKey()))
+            .build();
+
+    public static final Option<Integer> LOG_SYSLOG_ASYNC_QUEUE_LENGTH = new OptionBuilder<>("log-syslog-async-queue-length", Integer.class)
+            .category(OptionCategory.LOGGING)
+            .defaultValue(512)
+            .description("The queue length to use before flushing writing when logging to Syslog.")
+            .build();
 }
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/ManagementOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/ManagementOptions.java
index e1b8c6e3215a..bb129dbc3408 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/ManagementOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/ManagementOptions.java
@@ -61,7 +61,18 @@ public class ManagementOptions {
             .defaultValue("0.0.0.0")
             .build();
 
+    public enum Scheme {
+        http,
+        inherited
+    }
+
     //HTTPS
+    public static final Option<Scheme> HTTP_MANAGEMENT_SCHEME = new OptionBuilder<>("http-management-scheme", Scheme.class)
+            .category(OptionCategory.MANAGEMENT)
+            .description("Configures the management interface scheme. If 'inherited', the management interface will inherit the HTTPS settings of the main interface. If 'http', the management interface will be accessible via HTTP - it will not inherit HTTPS settings and cannot be configured for HTTPS.")
+            .defaultValue(Scheme.inherited)
+            .build();
+
     public static final Option<HttpOptions.ClientAuth> HTTPS_MANAGEMENT_CLIENT_AUTH = new OptionBuilder<>("https-management-client-auth", HttpOptions.ClientAuth.class)
             .category(OptionCategory.MANAGEMENT)
             .description("Configures the management interface to require/request client authentication. If not given, the value is inherited from HTTP options. " + RELEVANT_MSG)
@@ -84,6 +95,15 @@ public class ManagementOptions {
             .hidden()
             .build();
 
+    public static final Option<String> HTTPS_MANAGEMENT_CERTIFICATES_RELOAD_PERIOD = new OptionBuilder<>("https-management-certificates-reload-period", String.class)
+            .category(OptionCategory.MANAGEMENT)
+            .description("Interval on which to reload key store, trust store, and certificate files referenced by https-management-* options for the management server. " +
+                    "May be a java.time.Duration value, an integer number of seconds, or an integer followed by one of [ms, h, m, s, d]. " +
+                    "Must be greater than 30 seconds. Use -1 to disable. " +
+                    "If not given, the value is inherited from HTTP options. " + RELEVANT_MSG)
+            .defaultValue("1h")
+            .build();
+
     public static final Option<File> HTTPS_MANAGEMENT_CERTIFICATE_FILE = new OptionBuilder<>("https-management-certificate-file", File.class)
             .category(OptionCategory.MANAGEMENT)
             .description("The file path to a server certificate or certificate chain in PEM format for the management server. If not given, the value is inherited from HTTP options. " + RELEVANT_MSG)
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/MetricsOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/MetricsOptions.java
index 8586534dfb67..72f748540281 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/MetricsOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/MetricsOptions.java
@@ -15,4 +15,11 @@ public class MetricsOptions {
             .defaultValue(Boolean.TRUE)
             .hidden() // This is intended to be enabled all the time when global metrics are enabled, therefore this option is hidden
             .build();
+
+    public static final Option<Boolean> INFINISPAN_METRICS_ENABLED = new OptionBuilder<>("infinispan-metrics-enabled", Boolean.class)
+            .category(OptionCategory.METRICS)
+            .description("If Infinispan metrics should be collected and exposed.")
+            .defaultValue(Boolean.FALSE)
+            .hidden()  // Intentional, Infinispan metrics are enabled when '--metrics-enabled' are enabled.
+            .build();
 }
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/Option.java b/quarkus/config-api/src/main/java/org/keycloak/config/Option.java
index e8481a051080..77f241bcfe04 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/Option.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/Option.java
@@ -2,13 +2,9 @@
 
 import java.util.List;
 import java.util.Optional;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 public class Option<T> {
-    public static final Pattern WILDCARD_PLACEHOLDER_PATTERN = Pattern.compile("<.+>");
-
     private final Class<T> type;
     private final String key;
     private final OptionCategory category;
@@ -86,19 +82,24 @@ public Optional<DeprecatedMetadata> getDeprecatedMetadata() {
     }
 
     public Option<T> withRuntimeSpecificDefault(T defaultValue) {
-        return new Option<T>(
-            this.type,
-            this.key,
-            this.category,
-            this.hidden,
-            this.buildTime,
-            this.description,
-            Optional.ofNullable(defaultValue),
-            this.expectedValues,
-            this.strictExpectedValues,
-            this.caseInsensitiveExpectedValues,
-            this.deprecatedMetadata
-        );
+        return toBuilder().defaultValue(defaultValue).build();
+    }
+
+    public OptionBuilder<T> toBuilder() {
+        var builder = new OptionBuilder<>(key, type)
+                .category(category)
+                .buildTime(buildTime)
+                .description(description)
+                .defaultValue(defaultValue)
+                .expectedValues(expectedValues)
+                .strictExpectedValues(strictExpectedValues)
+                .caseInsensitiveExpectedValues(caseInsensitiveExpectedValues)
+                .deprecatedMetadata(deprecatedMetadata);
+
+        if (hidden) {
+            builder.hidden();
+        }
+        return builder;
     }
 
     private static String getDescriptionByCategorySupportLevel(String description, OptionCategory category) {
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/OptionBuilder.java b/quarkus/config-api/src/main/java/org/keycloak/config/OptionBuilder.java
index 713af7be0795..c9e3baa328f8 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/OptionBuilder.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/OptionBuilder.java
@@ -9,13 +9,14 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+@SuppressWarnings({"unchecked", "OptionalUsedAsFieldOrParameterType", "rawtypes"})
 public class OptionBuilder<T> {
 
     private static final List<String> BOOLEAN_TYPE_VALUES = List.of(Boolean.TRUE.toString(), Boolean.FALSE.toString());
 
     private final Class<T> type;
     private final Class<?> auxiliaryType;
-    private final String key;
+    private String key;
     private OptionCategory category;
     private boolean hidden;
     private boolean build;
@@ -50,6 +51,11 @@ private OptionBuilder(String key, Class<T> type, Class<?> auxiliaryType) {
         strictExpectedValues = true;
     }
 
+    OptionBuilder<T> key(String key) {
+        this.key = key;
+        return this;
+    }
+
     public OptionBuilder<T> category(OptionCategory category) {
         this.category = category;
         return this;
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/OptionCategory.java b/quarkus/config-api/src/main/java/org/keycloak/config/OptionCategory.java
index 27998ebc17fb..bf6038c39607 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/OptionCategory.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/OptionCategory.java
@@ -4,6 +4,7 @@ public enum OptionCategory {
     CACHE("Cache", 10, ConfigSupportLevel.SUPPORTED),
     CONFIG("Config", 15, ConfigSupportLevel.SUPPORTED),
     DATABASE("Database", 20, ConfigSupportLevel.SUPPORTED),
+    DATABASE_DATASOURCES("Database - additional datasources", 21, ConfigSupportLevel.PREVIEW),
     TRANSACTION("Transaction",30, ConfigSupportLevel.SUPPORTED),
     FEATURE("Feature", 40, ConfigSupportLevel.SUPPORTED),
     HOSTNAME_V2("Hostname v2", 50, ConfigSupportLevel.SUPPORTED),
@@ -16,7 +17,7 @@ public enum OptionCategory {
     VAULT("Vault", 100, ConfigSupportLevel.SUPPORTED),
     LOGGING("Logging", 110, ConfigSupportLevel.SUPPORTED),
     TRACING("Tracing", 111, ConfigSupportLevel.SUPPORTED),
-    EVENTS("Events", 112, ConfigSupportLevel.PREVIEW),
+    EVENTS("Events", 112, ConfigSupportLevel.SUPPORTED),
     TRUSTSTORE("Truststore", 115, ConfigSupportLevel.SUPPORTED),
     SECURITY("Security", 120, ConfigSupportLevel.SUPPORTED),
     EXPORT("Export", 130, ConfigSupportLevel.SUPPORTED),
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/ProxyOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/ProxyOptions.java
index 56c14f97754d..c4b49cc49ba7 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/ProxyOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/ProxyOptions.java
@@ -13,10 +13,10 @@ public enum Headers {
             .category(OptionCategory.PROXY)
             .description("The proxy headers that should be accepted by the server. Misconfiguration might leave the server exposed to security vulnerabilities. Takes precedence over the deprecated proxy option.")
             .build();
-    
+
     public static final Option<Boolean> PROXY_PROTOCOL_ENABLED = new OptionBuilder<>("proxy-protocol-enabled", Boolean.class)
             .category(OptionCategory.PROXY)
-            .description("Whether the server should use the HA PROXY protocol when serving requests from behind a proxy. When set to true, the remote address returned will be the one from the actual connecting client.")
+            .description("Whether the server should use the HA PROXY protocol when serving requests from behind a proxy. When set to true, the remote address returned will be the one from the actual connecting client. Cannot be enabled when the `proxy-headers` is used.")
             .defaultValue(Boolean.FALSE)
             .build();
 
@@ -34,7 +34,13 @@ public enum Headers {
             .category(OptionCategory.PROXY)
             .defaultValue(Boolean.FALSE)
             .build();
-    
+
+    public static final Option<Boolean> PROXY_TRUSTED_HEADER_ENABLED = new OptionBuilder<>("proxy-trusted-header-enabled", Boolean.class)
+            .category(OptionCategory.PROXY)
+            .defaultValue(Boolean.FALSE)
+            .hidden()
+            .build();
+
     public static final Option<List<String>> PROXY_TRUSTED_ADDRESSES = OptionBuilder.listOptionBuilder("proxy-trusted-addresses", String.class)
             .category(OptionCategory.PROXY)
             .description("A comma separated list of trusted proxy addresses. If set, then proxy headers from other addresses will be ignored. By default all addresses are trusted. A trusted proxy address is specified as an IP address (IPv4 or IPv6) or Classless Inter-Domain Routing (CIDR) notation.")
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/TracingOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/TracingOptions.java
index aa147575704b..5bebe7349397 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/TracingOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/TracingOptions.java
@@ -71,7 +71,7 @@ public class TracingOptions {
 
     public static final Option<Double> TRACING_SAMPLER_RATIO = new OptionBuilder<>("tracing-sampler-ratio", Double.class)
             .category(OptionCategory.TRACING)
-            .description("OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected double value in interval <0,1).")
+            .description("OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected double value in interval [0,1].")
             .defaultValue(1.0d)
             .build();
 
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/TransactionOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/TransactionOptions.java
index a3b29aa45473..0d731feb7d88 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/TransactionOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/TransactionOptions.java
@@ -8,4 +8,19 @@ public class TransactionOptions {
             .buildTime(true)
             .defaultValue(Boolean.FALSE)
             .build();
+
+    public static final Option<Boolean> TRANSACTION_XA_ENABLED_DATASOURCE = new OptionBuilder<>("transaction-xa-enabled-<datasource>", Boolean.class)
+            .category(OptionCategory.TRANSACTION)
+            .description("If set to true, XA for <datasource> datasource will be used.")
+            .buildTime(true)
+            .defaultValue(Boolean.TRUE)
+            .build();
+
+    public static String getNamedTxXADatasource(String namedProperty) {
+        if ("<default>".equals(namedProperty)) {
+            return TRANSACTION_XA_ENABLED.getKey();
+        }
+        var key = TRANSACTION_XA_ENABLED_DATASOURCE.getKey();
+        return key.substring(0, key.indexOf("<")).concat(namedProperty);
+    }
 }
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java b/quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java
index 28ec6fd735f1..ac621d7f2bc9 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java
@@ -13,7 +13,7 @@ public class TruststoreOptions {
 
     public static final Option<HostnameVerificationPolicy> HOSTNAME_VERIFICATION_POLICY = new OptionBuilder<>("tls-hostname-verifier", HostnameVerificationPolicy.class)
             .category(OptionCategory.TRUSTSTORE)
-            .description("The TLS hostname verification policy for out-going HTTPS and SMTP requests.")
+            .description("The TLS hostname verification policy for out-going HTTPS and SMTP requests. ANY should not be used in production.")
             .defaultValue(HostnameVerificationPolicy.DEFAULT)
             .deprecatedValues("STRICT and WILDCARD have been deprecated, use DEFAULT instead.", HostnameVerificationPolicy.STRICT, HostnameVerificationPolicy.WILDCARD)
             .build();
diff --git a/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java b/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java
index 48c3f45e92ef..93f2574a2af7 100644
--- a/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java
+++ b/quarkus/config-api/src/main/java/org/keycloak/config/database/Database.java
@@ -17,14 +17,18 @@
 
 package org.keycloak.config.database;
 
+import io.quarkus.runtime.util.StringUtil;
+import org.keycloak.config.DatabaseOptions;
+import org.keycloak.config.Option;
+
 import java.io.File;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.Optional;
+import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -59,55 +63,35 @@ public static Optional<Vendor> getVendor(String vendor) {
     }
 
     public static Optional<String> getDatabaseKind(String alias) {
-        Vendor vendor = DATABASES.get(alias);
-
-        if (vendor == null) {
-            return Optional.empty();
-        }
-
-        return Optional.of(vendor.databaseKind);
+        return mapValue(alias, vendor -> vendor.databaseKind);
     }
 
-    public static Optional<String> getDefaultUrl(String alias) {
-        Vendor vendor = DATABASES.get(alias);
-
-        if (vendor == null) {
-            return Optional.empty();
-        }
-
-        return Optional.of(vendor.defaultUrl.apply(alias));
+    /**
+     * The {@param namedProperty} represents name of the named datasource if we need to set the URL for additional datasource
+     */
+    public static Optional<String> getDefaultUrl(String namedProperty, String alias) {
+        return getVendor(alias).map(f -> f.defaultUrl.apply(namedProperty, alias));
     }
 
     public static Optional<String> getDriver(String alias, boolean isXaEnabled) {
-        Vendor vendor = DATABASES.get(alias);
-
-        if (vendor == null) {
-            return Optional.empty();
-        }
-
-        if (isXaEnabled) {
-            return Optional.of(vendor.xaDriver);
-        }
-
-        return Optional.of(vendor.nonXaDriver);
+        return mapValue(alias, vendor -> isXaEnabled ? vendor.xaDriver : vendor.nonXaDriver);
     }
 
     public static Optional<String> getDialect(String alias) {
-        Vendor vendor = DATABASES.get(alias);
-
-        if (vendor == null) {
-            return Optional.empty();
-        }
+        return mapValue(alias, vendor -> vendor.dialect.apply(alias));
+    }
 
-        return Optional.of(vendor.dialect.apply(alias));
+    private static <T> Optional<T> mapValue(String alias, Function<Vendor, T> mapper) {
+        return getVendor(alias).map(mapper);
     }
 
+
     /**
      * @return List of aliases of databases
      */
     public static List<String> getDatabaseAliases() {
-        return DATABASES.entrySet().stream()
-                .map(Entry::getKey)
+        return DATABASES.keySet()
+                .stream()
                 .sorted()
                 .collect(Collectors.toList());
     }
@@ -117,15 +101,28 @@ public enum Vendor {
                 "org.h2.jdbcx.JdbcDataSource",
                 "org.h2.Driver",
                 "org.hibernate.dialect.H2Dialect",
-                new Function<>() {
+                new BiFunction<>() {
                     @Override
-                    public String apply(String alias) {
+                    public String apply(String namedProperty, String alias) {
                         if ("dev-file".equalsIgnoreCase(alias)) {
-                            return amendH2("jdbc:h2:file:${kc.home.dir:${kc.db-url-path:" + escapeReplacements(System.getProperty("user.home")) + "}}" + escapeReplacements(File.separator) + "${kc.data.dir:data}"
-                                  + escapeReplacements(File.separator) + "h2" + escapeReplacements(File.separator)
-                                  + "keycloakdb${kc.db-url-properties:}");
+                            var separator = escapeReplacements(File.separator);
+                            return amendH2(new StringBuilder()
+                                    .append("jdbc:h2:file:")
+                                    .append("${kc.db-url-path:${kc.home.dir:%s}}".formatted(escapeReplacements(System.getProperty("user.home"))))
+                                    .append(separator)
+                                    .append("${kc.data.dir:data}")
+                                    .append(separator)
+                                    .append("h2")
+                                    .append(separator)
+                                    .append(getDbName(namedProperty))
+                                    .append(getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty))
+                                    .toString());
                         }
-                        return amendH2("jdbc:h2:mem:keycloakdb${kc.db-url-properties:}");
+                        return amendH2("jdbc:h2:mem:%s%s".formatted(getDbName(namedProperty), getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty)));
+                    }
+
+                    private String getDbName(String namedProperty) {
+                        return StringUtil.isNullOrEmpty(namedProperty) ? "keycloakdb" : "keycloakdb-%s".formatted(namedProperty);
                     }
 
                     private String escapeReplacements(String snippet) {
@@ -183,59 +180,83 @@ private String amendH2(String jdbcUrl) {
                 "com.mysql.cj.jdbc.MysqlXADataSource",
                 "com.mysql.cj.jdbc.Driver",
                 "org.hibernate.dialect.MySQLDialect",
-                "jdbc:mysql://${kc.db-url-host:localhost}:${kc.db-url-port:3306}/${kc.db-url-database:keycloak}${kc.db-url-properties:}",
-                asList("org.keycloak.connections.jpa.updater.liquibase.UpdatedMySqlDatabase")
+                // default URL looks like this: "jdbc:mysql://${kc.db-url-host:localhost}:${kc.db-url-port:3306}/${kc.db-url-database:keycloak}${kc.db-url-properties:}"
+                (namedProperty, alias) -> "jdbc:mysql://%s:%s/%s%s".formatted(
+                        getProperty(DatabaseOptions.DB_URL_HOST, namedProperty, "localhost"),
+                        getProperty(DatabaseOptions.DB_URL_PORT, namedProperty, "3306"),
+                        getProperty(DatabaseOptions.DB_URL_DATABASE, namedProperty, "keycloak"),
+                        getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty)),
+                List.of("org.keycloak.connections.jpa.updater.liquibase.UpdatedMySqlDatabase")
         ),
         MARIADB("mariadb",
                 "org.mariadb.jdbc.MariaDbDataSource",
                 "org.mariadb.jdbc.Driver",
                 "org.hibernate.dialect.MariaDBDialect",
-                "jdbc:mariadb://${kc.db-url-host:localhost}:${kc.db-url-port:3306}/${kc.db-url-database:keycloak}${kc.db-url-properties:}",
-                asList("org.keycloak.connections.jpa.updater.liquibase.UpdatedMariaDBDatabase")
+                // default URL looks like this: "jdbc:mariadb://${kc.db-url-host:localhost}:${kc.db-url-port:3306}/${kc.db-url-database:keycloak}${kc.db-url-properties:}"
+                (namedProperty, alias) -> "jdbc:mariadb://%s:%s/%s%s".formatted(
+                        getProperty(DatabaseOptions.DB_URL_HOST, namedProperty, "localhost"),
+                        getProperty(DatabaseOptions.DB_URL_PORT, namedProperty, "3306"),
+                        getProperty(DatabaseOptions.DB_URL_DATABASE, namedProperty, "keycloak"),
+                        getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty)),
+                List.of("org.keycloak.connections.jpa.updater.liquibase.UpdatedMariaDBDatabase")
         ),
         POSTGRES("postgresql",
                 "org.postgresql.xa.PGXADataSource",
                 "org.postgresql.Driver",
                 "org.hibernate.dialect.PostgreSQLDialect",
-                "jdbc:postgresql://${kc.db-url-host:localhost}:${kc.db-url-port:5432}/${kc.db-url-database:keycloak}${kc.db-url-properties:}",
-                asList("liquibase.database.core.PostgresDatabase", "org.keycloak.connections.jpa.updater.liquibase.PostgresPlusDatabase"),
+                // default URL looks like this: "jdbc:postgresql://${kc.db-url-host:localhost}:${kc.db-url-port:5432}/${kc.db-url-database:keycloak}${kc.db-url-properties:}"
+                (namedProperty, alias) -> "jdbc:postgresql://%s:%s/%s%s".formatted(
+                        getProperty(DatabaseOptions.DB_URL_HOST, namedProperty, "localhost"),
+                        getProperty(DatabaseOptions.DB_URL_PORT, namedProperty, "5432"),
+                        getProperty(DatabaseOptions.DB_URL_DATABASE, namedProperty, "keycloak"),
+                        getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty)),
+                asList("org.keycloak.connections.jpa.updater.liquibase.UpdatedPostgresDatabase", "org.keycloak.connections.jpa.updater.liquibase.PostgresPlusDatabase"),
                 "postgres"
         ),
         MSSQL("mssql",
                 "com.microsoft.sqlserver.jdbc.SQLServerXADataSource",
                 "com.microsoft.sqlserver.jdbc.SQLServerDriver",
                 "org.hibernate.dialect.SQLServerDialect",
-                "jdbc:sqlserver://${kc.db-url-host:localhost}:${kc.db-url-port:1433};databaseName=${kc.db-url-database:keycloak}${kc.db-url-properties:}",
-                asList("org.keycloak.quarkus.runtime.storage.database.liquibase.database.CustomMSSQLDatabase"),
+                // default URL looks like this: "jdbc:sqlserver://${kc.db-url-host:localhost}:${kc.db-url-port:1433};databaseName=${kc.db-url-database:keycloak}${kc.db-url-properties:}"
+                (namedProperty, alias) -> "jdbc:sqlserver://%s:%s;databaseName=%s%s".formatted(
+                        getProperty(DatabaseOptions.DB_URL_HOST, namedProperty, "localhost"),
+                        getProperty(DatabaseOptions.DB_URL_PORT, namedProperty, "1433"),
+                        getProperty(DatabaseOptions.DB_URL_DATABASE, namedProperty, "keycloak"),
+                        getProperty(DatabaseOptions.DB_URL_PROPERTIES, namedProperty)),
+                List.of("org.keycloak.quarkus.runtime.storage.database.liquibase.database.CustomMSSQLDatabase"),
                 "mssql"
         ),
         ORACLE("oracle",
                 "oracle.jdbc.xa.client.OracleXADataSource",
                 "oracle.jdbc.driver.OracleDriver",
                 "org.hibernate.dialect.OracleDialect",
-                "jdbc:oracle:thin:@//${kc.db-url-host:localhost}:${kc.db-url-port:1521}/${kc.db-url-database:keycloak}",
-                asList("liquibase.database.core.OracleDatabase")
+                // default URL looks like this: "jdbc:oracle:thin:@//${kc.db-url-host:localhost}:${kc.db-url-port:1521}/${kc.db-url-database:keycloak}"
+                (namedProperty, alias) -> "jdbc:oracle:thin:@//%s:%s/%s".formatted(
+                        getProperty(DatabaseOptions.DB_URL_HOST, namedProperty, "localhost"),
+                        getProperty(DatabaseOptions.DB_URL_PORT, namedProperty, "1521"),
+                        getProperty(DatabaseOptions.DB_URL_DATABASE, namedProperty, "keycloak")),
+                List.of("liquibase.database.core.OracleDatabase")
         );
 
         final String databaseKind;
         final String xaDriver;
         final String nonXaDriver;
         final Function<String, String> dialect;
-        final Function<String, String> defaultUrl;
+        final BiFunction<String, String, String> defaultUrl;
         final List<String> liquibaseTypes;
         final String[] aliases;
 
         Vendor(String databaseKind, String xaDriver, String nonXaDriver, String dialect, String defaultUrl, List<String> liquibaseTypes,
                String... aliases) {
-            this(databaseKind, xaDriver, nonXaDriver, alias -> dialect, alias -> defaultUrl, liquibaseTypes, aliases);
+            this(databaseKind, xaDriver, nonXaDriver, alias -> dialect, (namedProperty, alias) -> defaultUrl, liquibaseTypes, aliases);
         }
 
-        Vendor(String databaseKind, String xaDriver, String nonXaDriver, String dialect, Function<String, String> defaultUrl,
+        Vendor(String databaseKind, String xaDriver, String nonXaDriver, String dialect, BiFunction<String, String, String> defaultUrl,
                List<String> liquibaseTypes, String... aliases) {
             this(databaseKind, xaDriver, nonXaDriver, alias -> dialect, defaultUrl, liquibaseTypes, aliases);
         }
 
-        Vendor(String databaseKind, String xaDriver, String nonXaDriver, Function<String, String> dialect, Function<String, String> defaultUrl,
+        Vendor(String databaseKind, String xaDriver, String nonXaDriver, Function<String, String> dialect, BiFunction<String, String, String> defaultUrl,
                List<String> liquibaseTypes,
                String... aliases) {
             this.databaseKind = databaseKind;
@@ -244,13 +265,23 @@ private String amendH2(String jdbcUrl) {
             this.dialect = dialect;
             this.defaultUrl = defaultUrl;
             this.liquibaseTypes = liquibaseTypes;
-            this.aliases = aliases.length == 0 ? new String[] { databaseKind } : aliases;
+            this.aliases = aliases.length == 0 ? new String[]{databaseKind} : aliases;
         }
 
         public boolean isOfKind(String dbKind) {
             return databaseKind.equals(dbKind);
         }
 
+        private static String getProperty(Option<?> option, String namedProperty) {
+            return getProperty(option, namedProperty, "");
+        }
+
+        private static String getProperty(Option<?> option, String namedProperty, String defaultValue) {
+            return "${kc.%s:%s}".formatted(StringUtil.isNullOrEmpty(namedProperty) ? option.getKey() :
+                            DatabaseOptions.getResultNamedKey(option, namedProperty).orElseThrow(() -> new IllegalArgumentException("Cannot find the named property")),
+                    defaultValue);
+        }
+
         @Override
         public String toString() {
             return databaseKind.toLowerCase(Locale.ROOT);
diff --git a/quarkus/container/Dockerfile b/quarkus/container/Dockerfile
index 98fa3a202b4d..ed7f6c890433 100644
--- a/quarkus/container/Dockerfile
+++ b/quarkus/container/Dockerfile
@@ -1,6 +1,6 @@
 FROM registry.access.redhat.com/ubi9 AS ubi-micro-build
 
-ENV KEYCLOAK_VERSION 999.0.0-SNAPSHOT
+ARG KEYCLOAK_VERSION=999.0.0-SNAPSHOT
 ARG KEYCLOAK_DIST=https://github.com/keycloak/keycloak/releases/download/$KEYCLOAK_VERSION/keycloak-$KEYCLOAK_VERSION.tar.gz
 
 RUN dnf install -y tar gzip
diff --git a/quarkus/container/README.md b/quarkus/container/README.md
index 0d7b3f7b7524..c10fe87284c8 100644
--- a/quarkus/container/README.md
+++ b/quarkus/container/README.md
@@ -3,6 +3,10 @@ For more information, see the [Running Keycloak in a container guide](https://ww
 
 ## Build the image
 
+It is possible to download the Keycloak distribution from GitHub:
+
+    docker build --build-arg KEYCLOAK_VERSION=<VERSION> -t <YOUR_TAG> .
+
 It is possible to download the Keycloak distribution from a URL:
 
     docker build --build-arg KEYCLOAK_DIST=http://<HOST>:<PORT>/keycloak-<VERSION>.tar.gz -t <YOUR_TAG> .
diff --git a/quarkus/deployment/pom.xml b/quarkus/deployment/pom.xml
index 79829a0c3dbc..981102203d60 100644
--- a/quarkus/deployment/pom.xml
+++ b/quarkus/deployment/pom.xml
@@ -34,30 +34,103 @@
                     <groupId>org.eclipse.sisu</groupId>
                     <artifactId>org.eclipse.sisu.inject</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-utilities</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-arc-deployment</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-arc-dev</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-reactive-routes-deployment</artifactId>
             <exclusions>
-                <!-- Can be removed as part of the https://github.com/keycloak/keycloak/issues/22455 enhancement -->
                 <exclusion>
                     <groupId>io.quarkus</groupId>
                     <artifactId>quarkus-vertx-http-dev-ui-resources</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-assistant-dev</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>io.mvnpm</groupId>
                     <artifactId>importmap</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.maven</groupId>
+                    <artifactId>maven-embedder</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.maven</groupId>
+                    <artifactId>maven-core</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.maven</groupId>
+                    <artifactId>maven-plugin-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.fabric8</groupId>
+                    <artifactId>maven-model-helper</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-bootstrap-maven-resolver</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-codestarts</artifactId>
+                </exclusion>
+                <!-- Exclude transitive dependencies for 'io.quarkus:quarkus-devtools-common' BEGIN -->
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-registry-client</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-utilities</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-base-codestarts</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.codejive</groupId>
+                    <artifactId>java-properties</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-compress</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.smallrye.common</groupId>
+                    <artifactId>smallrye-common-version</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.fasterxml.jackson.dataformat</groupId>
+                    <artifactId>jackson-dataformat-yaml</artifactId>
+                </exclusion>
+                <!-- Exclude transitive dependencies for 'io.quarkus:quarkus-devtools-common' END -->
             </exclusions>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-rest-deployment</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-rest-dev</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
@@ -75,6 +148,14 @@
                     <groupId>io.quarkus</groupId>
                     <artifactId>quarkus-devservices-deployment</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-datasource-dev</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-agroal-dev</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
@@ -172,6 +253,12 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-junit5-internal</artifactId>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-devtools-utilities</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
diff --git a/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/CacheBuildSteps.java b/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/CacheBuildSteps.java
deleted file mode 100644
index 3f82bcb6fe58..000000000000
--- a/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/CacheBuildSteps.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.deployment;
-
-import io.quarkus.arc.deployment.SyntheticBeanBuildItem;
-import io.quarkus.deployment.annotations.BuildProducer;
-import io.quarkus.deployment.annotations.BuildStep;
-import io.quarkus.deployment.annotations.Consume;
-import io.quarkus.deployment.annotations.ExecutionTime;
-import io.quarkus.deployment.annotations.Record;
-import io.quarkus.deployment.logging.LoggingSetupBuildItem;
-import jakarta.enterprise.context.ApplicationScoped;
-import org.keycloak.quarkus.runtime.KeycloakRecorder;
-import org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory;
-
-public class CacheBuildSteps {
-
-    @Consume(ProfileBuildItem.class)
-    @Consume(ConfigBuildItem.class)
-    // Consume LoggingSetupBuildItem.class and record RUNTIME_INIT are necessary to ensure that logging is set up before the caches are initialized.
-    // This is to prevent the class TP in JGroups to pick up the trace logging at start up. While the logs will not appear on the console,
-    // they will still be created and use CPU cycles and create garbage collection.
-    // See: https://issues.redhat.com/browse/JGRP-2130 for the JGroups discussion, and https://github.com/keycloak/keycloak/issues/29129 for the issue Keycloak had with this.
-    @Consume(LoggingSetupBuildItem.class)
-    @Record(ExecutionTime.RUNTIME_INIT)
-    @BuildStep
-    void configureInfinispan(KeycloakRecorder recorder, BuildProducer<SyntheticBeanBuildItem> syntheticBeanBuildItems) {
-        syntheticBeanBuildItems.produce(SyntheticBeanBuildItem.configure(CacheManagerFactory.class)
-                .scope(ApplicationScoped.class)
-                .unremovable()
-                .setRuntimeInit()
-                .runtimeValue(recorder.createCacheInitializer()).done());
-    }
-}
diff --git a/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java b/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java
index 87d5298c041d..8f58ed5e6b97 100644
--- a/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java
+++ b/quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java
@@ -51,12 +51,14 @@
 import io.quarkus.vertx.http.deployment.HttpRootPathBuildItem;
 import io.quarkus.vertx.http.deployment.NonApplicationRootPathBuildItem;
 import io.quarkus.vertx.http.deployment.RouteBuildItem;
-
+import jakarta.persistence.Entity;
+import jakarta.persistence.PersistenceUnitTransactionType;
 import org.eclipse.microprofile.health.Readiness;
 import org.hibernate.cfg.AvailableSettings;
-import org.hibernate.jpa.boot.spi.PersistenceUnitDescriptor;
 import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
-import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
+import org.hibernate.jpa.boot.spi.PersistenceUnitDescriptor;
+import org.hibernate.jpa.boot.spi.PersistenceXmlParser;
+import org.infinispan.protostream.SerializationContextInitializer;
 import org.jboss.jandex.AnnotationInstance;
 import org.jboss.jandex.AnnotationTarget;
 import org.jboss.jandex.AnnotationTransformation;
@@ -83,6 +85,7 @@
 import org.keycloak.config.MetricsOptions;
 import org.keycloak.config.SecurityOptions;
 import org.keycloak.config.TracingOptions;
+import org.keycloak.config.TransactionOptions;
 import org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory;
 import org.keycloak.connections.jpa.JpaConnectionProvider;
 import org.keycloak.connections.jpa.JpaConnectionSpi;
@@ -130,8 +133,6 @@
 import org.keycloak.vault.FilesKeystoreVaultProviderFactory;
 import org.keycloak.vault.FilesPlainTextVaultProviderFactory;
 
-import jakarta.persistence.Entity;
-import jakarta.persistence.spi.PersistenceUnitTransactionType;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -140,13 +141,17 @@
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
+import java.util.NoSuchElementException;
 import java.util.Optional;
 import java.util.Properties;
+import java.util.ServiceLoader;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.jar.JarEntry;
@@ -156,6 +161,7 @@
 import static org.keycloak.connections.jpa.util.JpaUtils.loadSpecificNamedQueries;
 import static org.keycloak.quarkus.runtime.Environment.getCurrentOrCreateFeatureProfile;
 import static org.keycloak.quarkus.runtime.Providers.getProviderManager;
+import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalBooleanKcValue;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalKcValue;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalValue;
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
@@ -305,19 +311,29 @@ void checkJdbcDriver(BuildProducer<JdbcDriverBuildItem> ignore) {
     @BuildStep
     @Produce(CheckMultipleDatasourcesBuildStep.class)
     void checkMultipleDatasourcesUseXA(TransactionManagerBuildTimeConfig transactionManagerConfig, DataSourcesBuildTimeConfig dataSourcesConfig, DataSourcesJdbcBuildTimeConfig jdbcConfig) {
-        if (transactionManagerConfig.unsafeMultipleLastResources
+        Set<String> datasources = dataSourcesConfig.dataSources().keySet();
+        if (datasources.size() > 1) {
+            logger.infof("Multiple datasources are specified: %s", String.join(", ", datasources));
+        }
+
+        if (transactionManagerConfig.unsafeMultipleLastResources()
                 .orElse(UnsafeMultipleLastResourcesMode.DEFAULT) != UnsafeMultipleLastResourcesMode.FAIL) {
             return;
         }
-        long nonXADatasourcesCount = dataSourcesConfig.dataSources().keySet().stream()
-                .map(ds -> jdbcConfig.dataSources().get(ds).jdbc())
-                .filter(jdbc -> jdbc.enabled() && jdbc.transactions() != TransactionIntegration.XA)
-                .count();
-        if (nonXADatasourcesCount > 1) {
-            throwConfigError("Multiple datasources are configured but more than 1 is using non-XA transactions. " +
+
+        List<String> nonXADatasources = datasources.stream()
+                .filter(ds -> !Configuration.isKcPropertyTrue(TransactionOptions.getNamedTxXADatasource(ds)))
+                .filter(ds -> {
+                    var jdbc = jdbcConfig.dataSources().get(ds).jdbc();
+                    return jdbc.enabled() && jdbc.transactions() != TransactionIntegration.XA;
+                })
+                .toList();
+
+        if (nonXADatasources.size() > 1) {
+            throwConfigError("Multiple datasources are configured but more than 1 (%s) is using non-XA transactions. ".formatted(String.join(", ", nonXADatasources)) +
                     "All the datasources except one must must be XA to be able to use Last Resource Commit Optimization (LRCO). " +
                     "Please update your configuration by setting --transaction-xa-enabled=true " +
-                    "and/or quarkus.datasource.<your-datasource-name>.jdbc.transactions=xa.");
+                    "and/or --transaction-xa-enabled-<your-datasource-name>=true.");
         }
     }
 
@@ -399,8 +415,12 @@ void configurePersistenceUnits(HibernateOrmConfig config,
     @Consume(CheckJdbcBuildStep.class)
     @Consume(CheckMultipleDatasourcesBuildStep.class)
     void produceDefaultPersistenceUnit(BuildProducer<PersistenceXmlDescriptorBuildItem> producer) {
-        ParsedPersistenceXmlDescriptor descriptor = PersistenceXmlParser.locateIndividualPersistenceUnit(
-                Thread.currentThread().getContextClassLoader().getResource("default-persistence.xml"));
+        PersistenceXmlParser parser = PersistenceXmlParser.create();
+        PersistenceUnitDescriptor descriptor = parser.parse(Collections.singletonList(parser.getClassLoaderService().locateResource("default-persistence.xml")))
+                .values()
+                .stream()
+                .findAny()
+                .orElseThrow(() -> new NoSuchElementException("Cannot find the file 'default-persistence.xml'"));
 
         producer.produce(new PersistenceXmlDescriptorBuildItem(descriptor));
     }
@@ -429,6 +449,13 @@ private void configureDefaultPersistenceUnitProperties(ParsedPersistenceXmlDescr
         for (Entry<Object, Object> query : loadSpecificNamedQueries(dbKind.toLowerCase()).entrySet()) {
             unitProperties.setProperty(QUERY_PROPERTY_PREFIX + query.getKey(), query.getValue().toString());
         }
+
+        if (getOptionalBooleanKcValue(DatabaseOptions.DB_SQL_JPA_DEBUG.getKey()).orElse(false)) {
+            unitProperties.put("hibernate.use_sql_comments", "true");
+        }
+
+        getOptionalKcValue(DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES.getKey())
+                .ifPresent(v -> unitProperties.put("hibernate.log_slow_query", v));
     }
 
     private void configureDefaultPersistenceUnitEntities(ParsedPersistenceXmlDescriptor descriptor, CombinedIndexBuildItem indexBuildItem,
@@ -525,7 +552,8 @@ private void configureUserDefinedPersistenceUnits(List<PersistenceXmlDescriptorB
         descriptors.stream()
                 .map(PersistenceXmlDescriptorBuildItem::getDescriptor)
                 .map(PersistenceUnitDescriptor::getName)
-                .filter(Predicate.not("keycloak-default"::equals)).forEach((String unitName) -> {
+                .filter(Predicate.not("keycloak-default"::equals))
+                .forEach((String unitName) -> {
                     NamedJpaConnectionProviderFactory factory = new NamedJpaConnectionProviderFactory();
 
                     factory.setUnitName(unitName);
@@ -684,6 +712,15 @@ void configureDevMode(BuildProducer<HotDeploymentWatchedFileBuildItem> hotFiles)
         hotFiles.produce(new HotDeploymentWatchedFileBuildItem("META-INF/keycloak.conf"));
     }
 
+    @Record(ExecutionTime.STATIC_INIT)
+    @BuildStep
+    void configureProtoStreamSchemas(KeycloakRecorder recorder) {
+        var schemas = ServiceLoader.load(SerializationContextInitializer.class).stream()
+                .map(ServiceLoader.Provider::get)
+                .toList();
+        recorder.configureProtoStreamSchemas(schemas);
+    }
+
     private Map<Spi, Map<Class<? extends Provider>, Map<String, ProviderFactory>>> loadFactories(
             Map<String, ProviderFactory> preConfiguredProviders) {
         Config.init(new MicroProfileConfigProvider());
@@ -844,7 +881,7 @@ private static void configureScriptDescriptor(ScriptProviderDescriptor descripto
                     metadata.setCode(StreamUtil.readString(in, StandardCharsets.UTF_8));
                 }
 
-                metadata.setId(new StringBuilder("script").append("-").append(fileName).toString());
+                metadata.setId("script-" + fileName);
 
                 String name = metadata.getName();
 
diff --git a/quarkus/dist/check-dev-dependencies.sh b/quarkus/dist/check-dev-dependencies.sh
new file mode 100755
index 000000000000..a17ce0f2ab7c
--- /dev/null
+++ b/quarkus/dist/check-dev-dependencies.sh
@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+if mvn dependency:tree -Dverbose | grep -E '(-dev:|-devtools-)'; then
+  echo "[WARNING] Detected development dependencies in the build tree."
+fi
\ No newline at end of file
diff --git a/quarkus/dist/pom.xml b/quarkus/dist/pom.xml
index 780df25d7fa3..ce9629067df2 100755
--- a/quarkus/dist/pom.xml
+++ b/quarkus/dist/pom.xml
@@ -111,4 +111,35 @@
         </plugins>
     </build>
 
+    <profiles>
+        <profile>
+            <id>check-dev-dependencies</id>
+            <activation>
+                <os>
+                    <family>unix</family>
+                </os>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>warn-on-dev-dependencies</id>
+                                <phase>validate</phase>
+                                <goals>
+                                    <goal>exec</goal>
+                                </goals>
+                                <configuration>
+                                    <executable>${project.basedir}/check-dev-dependencies.sh</executable>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
 </project>
diff --git a/quarkus/dist/src/main/content/bin/kc.bat b/quarkus/dist/src/main/content/bin/kc.bat
index 437f34e8ceb7..c808a0021a46 100644
--- a/quarkus/dist/src/main/content/bin/kc.bat
+++ b/quarkus/dist/src/main/content/bin/kc.bat
@@ -8,21 +8,22 @@ setlocal
 
 rem Get the program name before using shift as the command modify the variable ~nx0
 if "%OS%" == "Windows_NT" (
-  set PROGNAME=%~nx0%
+    set PROGNAME=%~nx0%
 ) else (
-  set PROGNAME=kc.bat
+    set PROGNAME=kc.bat
 )
 
 if "%OS%" == "Windows_NT" (
-  set "DIRNAME=%~dp0"
+    set "DIRNAME=%~dp0"
 ) else (
-  set DIRNAME=.\
+    set DIRNAME=.\
 )
 
 set SERVER_OPTS=-Djava.util.logging.manager=org.jboss.logmanager.LogManager -Dquarkus-log-max-startup-records=10000 -Dpicocli.disable.closures=true
 
 set DEBUG_MODE=false
 set DEBUG_PORT_VAR=8787
+set DEBUG_ADDRESS=0.0.0.0:%DEBUG_PORT_VAR%
 set DEBUG_SUSPEND_VAR=n
 set CONFIG_ARGS=
 
@@ -33,20 +34,29 @@ if "%KEY%" == "" (
     goto MAIN
 )
 if "%KEY%" == "--debug" (
-  set DEBUG_MODE=true
-  if 1%2 EQU +1%2 (
-     set DEBUG_PORT_VAR=%2
-     shift
-  ) else (
-     set DEBUG_PORT_VAR=8787
-  )
-  shift
-  goto READ-ARGS
+    set DEBUG_MODE=true
+    if 1%2 EQU +1%2 (
+        rem Plain port
+        set DEBUG_ADDRESS=0.0.0.0:%2
+        shift
+    ) else (
+        rem IPv4 or IPv6 address with optional port
+        (echo %2 | findstr /R "[0-9].*\." >nul || echo %2 | findstr /R "\[.*:.*\]" >nul) && (
+            (echo %2 | findstr /R "]:[0-9][0-9]*" >nul || echo %2 | findstr /R "^[0-9].*:[0-9][0-9]*" >nul) && (
+                set DEBUG_ADDRESS=%2
+            ) || (
+                set DEBUG_ADDRESS=%2:%DEBUG_PORT_VAR%
+            )
+            shift
+        )
+    )
+    shift
+    goto READ-ARGS
 )
 if "%KEY%" == "start-dev" (
-  set CONFIG_ARGS=%CONFIG_ARGS% --profile=dev %KEY%
-  shift
-  goto READ-ARGS
+    set CONFIG_ARGS=%CONFIG_ARGS% --profile=dev %KEY%
+    shift
+    goto READ-ARGS
 )
 set "VALUE=%~2"
 set PROBABLY_VALUE=false
@@ -58,25 +68,25 @@ if "%VALUE%" NEQ "" (
     )
 )
 if "%KEY:~0,2%"=="-D" (
-  if %PROBABLY_VALUE%==true (
-    set SERVER_OPTS=%SERVER_OPTS% %KEY%^=%VALUE%
+    if %PROBABLY_VALUE%==true (
+        set SERVER_OPTS=%SERVER_OPTS% %KEY%^=%VALUE%
+        shift
+    ) else (
+        set SERVER_OPTS=%SERVER_OPTS% %KEY%
+    )
     shift
-  ) else (
-    set SERVER_OPTS=%SERVER_OPTS% %KEY%
-  )
-  shift
-  goto READ-ARGS
+    goto READ-ARGS
 )
 if not "%KEY:~0,1%"=="-" (
-  set CONFIG_ARGS=%CONFIG_ARGS% %1
-  shift
-  goto READ-ARGS
+    set CONFIG_ARGS=%CONFIG_ARGS% %1
+    shift
+    goto READ-ARGS
 )
 if %PROBABLY_VALUE%==true (
-  set CONFIG_ARGS=%CONFIG_ARGS% %1 %2
-  shift
+    set CONFIG_ARGS=%CONFIG_ARGS% %1 %2
+    shift
 ) else (
-  set CONFIG_ARGS=%CONFIG_ARGS% %1
+    set CONFIG_ARGS=%CONFIG_ARGS% %1
 )
 shift
 goto READ-ARGS
@@ -86,91 +96,90 @@ goto READ-ARGS
 setlocal EnableDelayedExpansion
 
 if not "x%JAVA_OPTS%" == "x" (
-  echo "JAVA_OPTS already set in environment; overriding default settings"
+    echo "JAVA_OPTS already set in environment; overriding default settings"
 ) else (
-  rem The defaults set up Keycloak with '-XX:+UseG1GC -XX:MinHeapFreeRatio=40 -XX:MaxHeapFreeRatio=70 -XX:GCTimeRatio=12 -XX:AdaptiveSizePolicyWeight=10' which proved to provide a good throughput and efficiency in the total memory allocation and CPU overhead.
-  rem If the memory is not used, it will be freed. See https://developers.redhat.com/blog/2017/04/04/openjdk-and-containers for details.
-  rem To optimize for large heap sizes or for throughput and better response time due to shorter GC pauses, consider ZGC and Shenandoah GC.
-  rem As of KC25 and JDK17, G1GC, ZGC and Shenandoah GC seem to be eager to claim the maximum heap size. Tests showed that ZGC might need additional tuning in reclaiming dead objects.
-  set "JAVA_OPTS=-XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.err.encoding=UTF-8 -Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8 -XX:+ExitOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -XX:+UseG1GC -XX:FlightRecorderOptions=stackdepth=512"
-
-  if "x%JAVA_OPTS_KC_HEAP%" == "x" (
-    if "!KC_RUN_IN_CONTAINER!" == "true" (
-      rem Maximum utilization of the heap is set to 70% of the total container memory
-      rem Initial heap size is set to 50% of the total container memory in order to reduce GC executions
-      set "JAVA_OPTS_KC_HEAP=-XX:MaxRAMPercentage=70 -XX:MinRAMPercentage=70 -XX:InitialRAMPercentage=50"
+    rem The defaults set up Keycloak with '-XX:+UseG1GC -XX:MinHeapFreeRatio=40 -XX:MaxHeapFreeRatio=70 -XX:GCTimeRatio=12 -XX:AdaptiveSizePolicyWeight=10' which proved to provide a good throughput and efficiency in the total memory allocation and CPU overhead.
+    rem If the memory is not used, it will be freed. See https://developers.redhat.com/blog/2017/04/04/openjdk-and-containers for details.
+    rem To optimize for large heap sizes or for throughput and better response time due to shorter GC pauses, consider ZGC and Shenandoah GC.
+    rem As of KC25 and JDK17, G1GC, ZGC and Shenandoah GC seem to be eager to claim the maximum heap size. Tests showed that ZGC might need additional tuning in reclaiming dead objects.
+    set "JAVA_OPTS=-XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.err.encoding=UTF-8 -Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8 -XX:+ExitOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -XX:+UseG1GC -XX:FlightRecorderOptions=stackdepth=512"
+
+    if "x%JAVA_OPTS_KC_HEAP%" == "x" (
+        if "!KC_RUN_IN_CONTAINER!" == "true" (
+            rem Maximum utilization of the heap is set to 70% of the total container memory
+            rem Initial heap size is set to 50% of the total container memory in order to reduce GC executions
+            set "JAVA_OPTS_KC_HEAP=-XX:MaxRAMPercentage=70 -XX:MinRAMPercentage=70 -XX:InitialRAMPercentage=50"
+        ) else (
+            set "JAVA_OPTS_KC_HEAP=-Xms64m -Xmx512m"
+        )
     ) else (
-      set "JAVA_OPTS_KC_HEAP=-Xms64m -Xmx512m"
+        echo "JAVA_OPTS_KC_HEAP already set in environment; overriding default settings"
     )
 
-  ) else (
-    echo "JAVA_OPTS_KC_HEAP already set in environment; overriding default settings"
-  )
-  
-  set "JAVA_OPTS=!JAVA_OPTS! !JAVA_OPTS_KC_HEAP!"
+    set "JAVA_OPTS=!JAVA_OPTS! !JAVA_OPTS_KC_HEAP!"
 )
 
 @REM See also https://github.com/wildfly/wildfly-core/blob/7e5624cf92ebe4b64a4793a8c0b2a340c0d6d363/core-feature-pack/common/src/main/resources/content/bin/common.sh#L57-L60
 if not "x%JAVA_ADD_OPENS%" == "x" (
-  echo "JAVA_ADD_OPENS already set in environment; overriding default settings"
+    echo "JAVA_ADD_OPENS already set in environment; overriding default settings"
 ) else (
-  set "JAVA_ADD_OPENS=--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED"
+    set "JAVA_ADD_OPENS=--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED"
 )
 set "JAVA_OPTS=%JAVA_OPTS% %JAVA_ADD_OPENS%"
 
 @REM Set the default locale for the JVM to English to prevent locale-specific character variations
 if not "x%JAVA_LOCALE%" == "x" (
-  echo "JAVA_LOCALE already set in environment; overriding default settings"
+    echo "JAVA_LOCALE already set in environment; overriding default settings"
 ) else (
-  set "JAVA_LOCALE=-Duser.language=en -Duser.country=US"
+    set "JAVA_LOCALE=-Duser.language=en -Duser.country=US"
 )
 set "JAVA_OPTS=%JAVA_OPTS% %JAVA_LOCALE%"
 
 if not "x%JAVA_OPTS_APPEND%" == "x" (
-  echo "Appending additional Java properties to JAVA_OPTS"
-  set JAVA_OPTS=%JAVA_OPTS% %JAVA_OPTS_APPEND%
+    echo "Appending additional Java properties to JAVA_OPTS"
+    set JAVA_OPTS=%JAVA_OPTS% %JAVA_OPTS_APPEND%
 )
 
 if NOT "x%DEBUG%" == "x" (
-  set DEBUG_MODE=%DEBUG%
+    set DEBUG_MODE=%DEBUG%
 )
 
 if NOT "x%DEBUG_PORT%" == "x" (
-  set DEBUG_PORT_VAR=%DEBUG_PORT%
+    set DEBUG_PORT_VAR=%DEBUG_PORT%
 )
 
 if NOT "x%DEBUG_SUSPEND%" == "x" (
-  set DEBUG_SUSPEND_VAR=%DEBUG_SUSPEND%
+    set DEBUG_SUSPEND_VAR=%DEBUG_SUSPEND%
 )
 
 rem Set debug settings if not already set
 if "%DEBUG_MODE%" == "true" (
-   echo "%JAVA_OPTS%" | findstr /I "\-agentlib:jdwp" > nul
-  if errorlevel == 1 (
-     set JAVA_OPTS=%JAVA_OPTS% -agentlib:jdwp=transport=dt_socket,address=%DEBUG_PORT_VAR%,server=y,suspend=%DEBUG_SUSPEND_VAR%
-  ) else (
-     echo Debug already enabled in JAVA_OPTS, ignoring --debug argument
-  )
+    echo "%JAVA_OPTS%" | findstr /I "\-agentlib:jdwp" > nul
+    if errorlevel == 1 (
+        set JAVA_OPTS=%JAVA_OPTS% -agentlib:jdwp=transport=dt_socket,address=%DEBUG_ADDRESS%,server=y,suspend=%DEBUG_SUSPEND_VAR%
+    ) else (
+        echo Debug already enabled in JAVA_OPTS, ignoring --debug argument
+    )
 )
 
 rem Setup Keycloak specific properties
 set JAVA_OPTS=-Dprogram.name=%PROGNAME% %JAVA_OPTS%
 
 if "x%JAVA%" == "x" (
-  if "x%JAVA_HOME%" == "x" (
-    set JAVA=java
-    echo JAVA_HOME is not set. Unexpected results may occur. 1>&2
-    echo Set JAVA_HOME to the directory of your local JDK to avoid this message. 1>&2
-  ) else (
-    if not exist "%JAVA_HOME%" (
-      echo JAVA_HOME "%JAVA_HOME%" path doesn't exist 1>&2
-      goto END
+    if "x%JAVA_HOME%" == "x" (
+        set JAVA=java
+        echo JAVA_HOME is not set. Unexpected results may occur. 1>&2
+        echo Set JAVA_HOME to the directory of your local JDK to avoid this message. 1>&2
     ) else (
-      if not exist "%JAVA_HOME%\bin\java.exe" (
-        echo "%JAVA_HOME%\bin\java.exe" does not exist 1>&2
+        if not exist "%JAVA_HOME%" (
+        echo JAVA_HOME "%JAVA_HOME%" path doesn't exist 1>&2
         goto END
-      )
-      set "JAVA=%JAVA_HOME%\bin\java"
+    ) else (
+        if not exist "%JAVA_HOME%\bin\java.exe" (
+            echo "%JAVA_HOME%\bin\java.exe" does not exist 1>&2
+            goto END
+        )
+        set "JAVA=%JAVA_HOME%\bin\java"
     )
   )
 )
@@ -196,8 +205,8 @@ if not errorlevel == 1 (
 )
 
 if "%PRINT_ENV%" == "true" (
-  echo Using JAVA_OPTS: !JAVA_OPTS!
-  echo Using JAVA_RUN_OPTS: !JAVA_RUN_OPTS!
+    echo Using JAVA_OPTS: !JAVA_OPTS!
+    echo Using JAVA_RUN_OPTS: !JAVA_RUN_OPTS!
 )
 
 set START_SERVER=true
diff --git a/quarkus/dist/src/main/content/bin/kc.sh b/quarkus/dist/src/main/content/bin/kc.sh
index 9a6e62e2dd2e..9c0b946e8522 100644
--- a/quarkus/dist/src/main/content/bin/kc.sh
+++ b/quarkus/dist/src/main/content/bin/kc.sh
@@ -44,6 +44,7 @@ CLASSPATH_OPTS="'$(abs_path "../lib/quarkus-run.jar")'"
 DEBUG_MODE="${DEBUG:-false}"
 DEBUG_PORT="${DEBUG_PORT:-8787}"
 DEBUG_SUSPEND="${DEBUG_SUSPEND:-n}"
+DEBUG_ADDRESS="0.0.0.0:$DEBUG_PORT"
 
 esceval() {
     printf '%s\n' "$1" | sed "s/'/'\\\\''/g; 1 s/^/'/; $ s/$/'/"
@@ -55,9 +56,20 @@ do
     case "$1" in
       --debug)
           DEBUG_MODE=true
-          if [ -n "$2" ] && expr "$2" : '[0-9]\{0,\}$' >/dev/null; then
-              DEBUG_PORT=$2
-              shift
+          if [ -n "$2" ]; then
+              # Plain port
+              if echo "$2" | grep -Eq '^[0-9]+$'; then
+                  DEBUG_ADDRESS="0.0.0.0:$2"
+                  shift
+              # IPv4 or bracketed IPv6 with optional port
+              elif echo "$2" | grep -Eq '^(([0-9.]+)|(\[[0-9A-Fa-f:]+\]))'; then
+                  if echo "$2" | grep -Eq ':[0-9]+$'; then
+                      DEBUG_ADDRESS="$2"
+                  else
+                      DEBUG_ADDRESS="$2:$DEBUG_PORT"
+                  fi
+                  shift
+              fi
           fi
           ;;
       --)
@@ -142,7 +154,7 @@ fi
 if [ "$DEBUG_MODE" = "true" ]; then
     DEBUG_OPT="$(echo "$JAVA_OPTS" | $GREP "\-agentlib:jdwp")"
     if [ -z "$DEBUG_OPT" ]; then
-        JAVA_OPTS="$JAVA_OPTS -agentlib:jdwp=transport=dt_socket,address=$DEBUG_PORT,server=y,suspend=$DEBUG_SUSPEND"
+        JAVA_OPTS="$JAVA_OPTS -agentlib:jdwp=transport=dt_socket,address=$DEBUG_ADDRESS,server=y,suspend=$DEBUG_SUSPEND"
     else
         echo "Debug already enabled in JAVA_OPTS, ignoring --debug argument"
     fi
@@ -152,7 +164,7 @@ esceval_args() {
   while IFS= read -r entry; do
     result="$result $(esceval "$entry")"
   done
-  echo $result
+  echo "$result"
 }
 
 JAVA_RUN_OPTS=$(echo "$JAVA_OPTS" | xargs printf '%s\n' | esceval_args)
@@ -166,8 +178,8 @@ if [ "$PRINT_ENV" = "true" ]; then
 fi
 
 if [ "$PRE_BUILD" = "true" ]; then
-  eval "'$JAVA'" -Dkc.config.build-and-exit=true $JAVA_RUN_OPTS || exit $?
+  eval "'$JAVA'" -Dkc.config.build-and-exit=true "$JAVA_RUN_OPTS" || exit $?
   JAVA_RUN_OPTS="-Dkc.config.built=true $JAVA_RUN_OPTS"
 fi
 
-eval exec "'$JAVA'" $JAVA_RUN_OPTS
+eval exec "'$JAVA'" "$JAVA_RUN_OPTS"
diff --git a/quarkus/dist/src/main/content/conf/keycloak.conf b/quarkus/dist/src/main/content/conf/keycloak.conf
index 48efbb0bfa42..66e420381d14 100644
--- a/quarkus/dist/src/main/content/conf/keycloak.conf
+++ b/quarkus/dist/src/main/content/conf/keycloak.conf
@@ -25,10 +25,10 @@
 # HTTP
 
 # The file path to a server certificate or certificate chain in PEM format.
-#https-certificate-file=${kc.home.dir}conf/server.crt.pem
+#https-certificate-file=${kc.home.dir}/conf/server.crt.pem
 
 # The file path to a private key in PEM format.
-#https-certificate-key-file=${kc.home.dir}conf/server.key.pem
+#https-certificate-key-file=${kc.home.dir}/conf/server.key.pem
 
 # The proxy address forwarding mode if the server is behind a reverse proxy.
 #proxy=reencrypt
diff --git a/quarkus/runtime/pom.xml b/quarkus/runtime/pom.xml
index 45e163fe0646..20a4178c6b12 100644
--- a/quarkus/runtime/pom.xml
+++ b/quarkus/runtime/pom.xml
@@ -81,7 +81,7 @@
             <exclusions>
                 <exclusion>
                     <groupId>com.oracle.database.jdbc</groupId>
-                    <artifactId>ojdbc11</artifactId>
+                    <artifactId>ojdbc17</artifactId>
                 </exclusion>
                 <exclusion>
                     <groupId>com.oracle.database.nls</groupId>
@@ -646,6 +646,10 @@
             <artifactId>nashorn-core</artifactId>
             <version>${nashorn.version}</version>
         </dependency>
+        <dependency>
+            <groupId>net.java.dev.jna</groupId>
+            <artifactId>jna</artifactId>
+        </dependency>
 
         <dependency>
             <groupId>junit</groupId>
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/Environment.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/Environment.java
index 2957a13f8513..ae41030f60df 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/Environment.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/Environment.java
@@ -31,14 +31,13 @@
 import io.quarkus.runtime.LaunchMode;
 import io.smallrye.config.SmallRyeConfig;
 
-import org.apache.commons.lang3.SystemUtils;
 import org.keycloak.common.Profile;
-import org.keycloak.quarkus.runtime.cli.command.AbstractCommand;
+import org.keycloak.common.util.NetworkUtils;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
-import org.keycloak.quarkus.runtime.configuration.PersistedConfigSource;
 
 public final class Environment {
 
+    private static final String KC_HOME_DIR = "kc.home.dir";
     public static final String NON_SERVER_MODE = "nonserver";
     public static final String PROFILE ="kc.profile";
     public static final String ENV_PROFILE ="KC_PROFILE";
@@ -47,8 +46,6 @@ public final class Environment {
     public static final String PROD_PROFILE_VALUE = "prod";
     public static final String LAUNCH_MODE = "kc.launch.mode";
 
-    private static volatile AbstractCommand parsedCommand;
-
     private Environment() {}
 
     public static Boolean isRebuild() {
@@ -60,7 +57,7 @@ public static Boolean isRuntimeMode() {
     }
 
     public static String getHomeDir() {
-        return System.getProperty("kc.home.dir");
+        return System.getProperty(KC_HOME_DIR);
     }
 
     public static Path getHomePath() {
@@ -108,21 +105,6 @@ public static void setProfile(String profile) {
         }
     }
 
-    /**
-     * Update the profile settings based upon what was set in the system, environment, or optionally persistent values
-     */
-    public static String updateProfile(boolean usePersistent) {
-        String profile = org.keycloak.common.util.Environment.getProfile();
-        if(profile == null && usePersistent) {
-            profile = PersistedConfigSource.getInstance().getValue(org.keycloak.common.util.Environment.PROFILE);
-        }
-        if (profile == null) {
-            profile = Environment.PROD_PROFILE_VALUE;
-        }
-        setProfile(profile);
-        return profile;
-    }
-
     public static boolean isDevMode() {
         if (org.keycloak.common.util.Environment.isDevMode()) {
             return true;
@@ -140,7 +122,7 @@ public static boolean isNonServerMode() {
     }
 
     public static boolean isWindows() {
-        return SystemUtils.IS_OS_WINDOWS;
+        return NetworkUtils.checkForWindows();
     }
 
     public static void forceDevProfile() {
@@ -226,7 +208,7 @@ public static boolean isRebuilt() {
     }
 
     public static void setHomeDir(Path path) {
-        System.setProperty("kc.home.dir", path.toFile().getAbsolutePath());
+        System.setProperty(KC_HOME_DIR, path.toFile().getAbsolutePath());
     }
 
     /**
@@ -246,18 +228,7 @@ public synchronized static Profile getCurrentOrCreateFeatureProfile() {
         return profile;
     }
 
-    /**
-     * Get parsed AbstractCommand we obtained from the CLI
-     */
-    public static Optional<AbstractCommand> getParsedCommand() {
-        return Optional.ofNullable(parsedCommand);
-    }
-
-    public static boolean isParsedCommand(String commandName) {
-        return getParsedCommand().filter(f -> f.getName().equals(commandName)).isPresent();
-    }
-
-    public static void setParsedCommand(AbstractCommand command) {
-        Environment.parsedCommand = command;
+    public static void removeHomeDir() {
+        System.getProperties().remove(KC_HOME_DIR);
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java
index 76d301fd052b..5211e42e8b3e 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakMain.java
@@ -22,22 +22,28 @@
 import static org.keycloak.quarkus.runtime.Environment.isTestLaunchMode;
 import static org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG;
 
-import java.io.PrintWriter;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.ForkJoinPool;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import picocli.CommandLine;
+
+import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.quarkus.runtime.configuration.PersistedConfigSource;
+import org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication;
 
+import io.quarkus.bootstrap.runner.RunnerClassLoader;
+import io.quarkus.arc.Arc;
 import io.quarkus.runtime.ApplicationLifecycleManager;
 import io.quarkus.runtime.Quarkus;
 
 import org.jboss.logging.Logger;
-import org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
+import org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler;
 import org.keycloak.quarkus.runtime.cli.Picocli;
 import org.keycloak.common.Version;
+import org.keycloak.quarkus.runtime.cli.command.AbstractNonServerCommand;
 import org.keycloak.quarkus.runtime.cli.command.DryRunMixin;
 import org.keycloak.quarkus.runtime.cli.command.Start;
 
@@ -51,21 +57,30 @@
 @ApplicationScoped
 public class KeycloakMain implements QuarkusApplication {
 
-    private static final String INFINISPAN_VIRTUAL_THREADS_PROP = "org.infinispan.threads.virtual";
+    private static AbstractNonServerCommand COMMAND;
 
     static {
-        // enable Infinispan and JGroups virtual threads by default
-        if (System.getProperty(INFINISPAN_VIRTUAL_THREADS_PROP) == null) {
-            System.setProperty(INFINISPAN_VIRTUAL_THREADS_PROP, "true");
-        }
+        InfinispanUtils.configureVirtualThreads();
     }
 
     public static void main(String[] args) {
         ensureForkJoinPoolThreadFactoryHasBeenSetToQuarkus();
+        InfinispanUtils.ensureVirtualThreadsParallelism();
 
         System.setProperty("kc.version", Version.VERSION);
 
-        main(args, new Picocli());
+        Picocli picocli;
+        if (!(Thread.currentThread().getContextClassLoader() instanceof RunnerClassLoader)) {
+            picocli = new Picocli() { // embedded launch case, avoid System.exit
+                @Override
+                public void exit(int exitCode) {
+                    Quarkus.asyncExit(exitCode);
+                };
+            };
+        } else {
+            picocli = new Picocli();
+        }
+        main(args, picocli);
     }
 
     public static void main(String[] args, Picocli picocli) {
@@ -76,12 +91,15 @@ public static void main(String[] args, Picocli picocli) {
             picocli.usageException(e.getMessage(), e.getCause());
             return;
         }
-        
+
         if (DryRunMixin.isDryRunBuild() && (cliArgs.contains(DryRunMixin.DRYRUN_OPTION_LONG) || Boolean.valueOf(System.getenv().get(DryRunMixin.KC_DRY_RUN_ENV)))) {
             PersistedConfigSource.getInstance().useDryRunProperties();
         }
 
         if (cliArgs.isEmpty()) {
+            if (Environment.isRebuildCheck()) {
+                return; // nothing to do - not currently caught by the shell scripts
+            }
             cliArgs = new ArrayList<>(cliArgs);
             // default to show help message
             cliArgs.add("-h");
@@ -118,27 +136,23 @@ private static boolean isFastStart(List<String> cliArgs) {
         return cliArgs.size() == 2 && cliArgs.get(0).equals(Start.NAME) && cliArgs.stream().anyMatch(OPTIMIZED_BUILD_OPTION_LONG::equals);
     }
 
-    public static void start(ExecutionExceptionHandler errorHandler, PrintWriter errStream) {
+    public static void start(Picocli picocli, AbstractNonServerCommand command, ExecutionExceptionHandler errorHandler) {
+        COMMAND = command; // it would be nice to not do this statically - start quarkus with an instance of KeycloakMain, rather than a class for example
         try {
             Quarkus.run(KeycloakMain.class, (exitCode, cause) -> {
                 if (cause != null) {
-                    errorHandler.error(errStream,
+                    errorHandler.error(picocli.getErrWriter(),
                             String.format("Failed to start server in (%s) mode", getKeycloakModeFromProfile(org.keycloak.common.util.Environment.getProfile())),
                             cause.getCause());
                 }
-
-                if (Environment.isDistribution()) {
-                    // assume that it is running the distribution
-                    // as we are replacing the default exit handler, we need to force exit
-                    System.exit(exitCode);
-                }
+                picocli.exit(exitCode);
             });
         } catch (Throwable cause) {
-            errorHandler.error(errStream,
+            errorHandler.error(picocli.getErrWriter(),
                     String.format("Unexpected error when starting the server in (%s) mode", getKeycloakModeFromProfile(org.keycloak.common.util.Environment.getProfile())),
                     cause.getCause());
-            System.exit(1);
         }
+        picocli.exit(CommandLine.ExitCode.SOFTWARE);
     }
 
     /**
@@ -146,17 +160,19 @@ public static void start(ExecutionExceptionHandler errorHandler, PrintWriter err
      */
     @Override
     public int run(String... args) throws Exception {
-        int exitCode = ApplicationLifecycleManager.getExitCode();
-
+        if (COMMAND != null) {
+            QuarkusKeycloakApplication application = Arc.container().instance(QuarkusKeycloakApplication.class).get();
+            COMMAND.onStart(application);
+        }
         if (isTestLaunchMode() || isNonServerMode()) {
             // in test mode we exit immediately
             // we should be managing this behavior more dynamically depending on the tests requirements (short/long lived)
-            Quarkus.asyncExit(exitCode);
+            Quarkus.asyncExit(ApplicationLifecycleManager.getExitCode());
         } else {
             Quarkus.waitForExit();
         }
 
-        return exitCode;
+        return ApplicationLifecycleManager.getExitCode();
     }
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java
index c2b9a92e4c9c..d5a48964ce62 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java
@@ -17,27 +17,33 @@
 
 package org.keycloak.quarkus.runtime;
 
+import java.io.File;
+import java.lang.annotation.Annotation;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Stream;
+
 import io.agroal.api.AgroalDataSource;
 import io.quarkus.agroal.DataSource;
 import io.quarkus.arc.Arc;
 import io.quarkus.arc.InstanceHandle;
 import io.quarkus.hibernate.orm.runtime.integration.HibernateOrmIntegrationRuntimeInitListener;
-import io.quarkus.runtime.RuntimeValue;
-import io.quarkus.runtime.ShutdownContext;
 import io.quarkus.runtime.annotations.Recorder;
 import io.vertx.core.Handler;
 import io.vertx.ext.web.RoutingContext;
 import liquibase.Scope;
 import liquibase.servicelocator.ServiceLocator;
 import org.hibernate.cfg.AvailableSettings;
-import org.infinispan.commons.util.FileLookupFactory;
-import org.jboss.logging.Logger;
+import org.infinispan.protostream.SerializationContextInitializer;
 import org.keycloak.Config;
 import org.keycloak.common.Profile;
 import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.common.crypto.CryptoProvider;
 import org.keycloak.common.crypto.FipsMode;
+import org.keycloak.config.DatabaseOptions;
 import org.keycloak.config.TruststoreOptions;
+import org.keycloak.marshalling.Marshalling;
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.provider.Spi;
@@ -45,36 +51,14 @@
 import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
 import org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSessionFactory;
 import org.keycloak.quarkus.runtime.storage.database.liquibase.FastServiceLocator;
-import org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory;
 import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.theme.ClasspathThemeProviderFactory;
 import org.keycloak.truststore.TruststoreBuilder;
 import org.keycloak.userprofile.DeclarativeUserProfileProviderFactory;
 
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.lang.annotation.Annotation;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.BiConsumer;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import static org.keycloak.quarkus.runtime.configuration.Configuration.getKcConfigValue;
-
 @Recorder
 public class KeycloakRecorder {
 
-    public static final String DEFAULT_HEALTH_ENDPOINT = "/health";
-    public static final String DEFAULT_METRICS_ENDPOINT = "/metrics";
-
-    private static final Logger logger = Logger.getLogger(KeycloakRecorder.class);
-
     public void initConfig() {
         Config.init(new MicroProfileConfigProvider());
     }
@@ -125,85 +109,29 @@ public void configSessionFactory(
         QuarkusKeycloakSessionFactory.setInstance(new QuarkusKeycloakSessionFactory(factories, defaultProviders, preConfiguredProviders, themes));
     }
 
-    public RuntimeValue<CacheManagerFactory> createCacheInitializer() {
-        try {
-            CacheManagerFactory cacheManagerFactory = new CacheManagerFactory(getInfinispanConfigFile());
-            return new RuntimeValue<>(cacheManagerFactory);
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    private String getInfinispanConfigFile() {
-        String configFile = getKcConfigValue("spi-connections-infinispan-quarkus-config-file").getValue();
-
-        if (configFile == null) {
-            throw new IllegalArgumentException("Option 'configFile' needs to be specified");
-        }
-
-        Path configPath = Paths.get(configFile);
-        String path;
-
-        if (configPath.toFile().exists()) {
-            path = configPath.toFile().getAbsolutePath();
-        } else {
-            path = configPath.getFileName().toString();
-        }
-
-        logger.debugf("Infinispan configuration file: %s", path);
-
-        InputStream url = FileLookupFactory.newInstance().lookupFile(path, KeycloakRecorder.class.getClassLoader());
-
-        if (url == null) {
-            throw new IllegalArgumentException("Could not load cluster configuration file at [" + configPath + "]");
-        }
-
-        try (BufferedReader reader = new BufferedReader(new InputStreamReader(url))) {
-            return reader.lines().collect(Collectors.joining("\n"));
-        } catch (Exception cause) {
-            throw new RuntimeException("Failed to read clustering configuration from [" + url + "]", cause);
-        }
-    }
-
     public void setDefaultUserProfileConfiguration(UPConfig configuration) {
         DeclarativeUserProfileProviderFactory.setDefaultConfig(configuration);
     }
 
-    public void registerShutdownHook(ShutdownContext shutdownContext) {
-        shutdownContext.addShutdownTask(new Runnable() {
-            @Override
-            public void run() {
-                QuarkusKeycloakSessionFactory.getInstance().close();
-            }
-        });
-    }
-
     public HibernateOrmIntegrationRuntimeInitListener createUserDefinedUnitListener(String name) {
-        return new HibernateOrmIntegrationRuntimeInitListener() {
-            @Override
-            public void contributeRuntimeProperties(BiConsumer<String, Object> propertyCollector) {
-                InstanceHandle<AgroalDataSource> instance = Arc.container().instance(
-                        AgroalDataSource.class, new DataSource() {
-                            @Override public Class<? extends Annotation> annotationType() {
-                                return DataSource.class;
-                            }
-
-                            @Override public String value() {
-                                return name;
-                            }
-                        });
+        return propertyCollector -> {
+            try (InstanceHandle<AgroalDataSource> instance = Arc.container().instance(
+                    AgroalDataSource.class, new DataSource() {
+                        @Override public Class<? extends Annotation> annotationType() {
+                            return DataSource.class;
+                        }
+
+                        @Override public String value() {
+                            return name;
+                        }
+                    })) {
                 propertyCollector.accept(AvailableSettings.DATASOURCE, instance.get());
             }
         };
     }
 
     public HibernateOrmIntegrationRuntimeInitListener createDefaultUnitListener() {
-        return new HibernateOrmIntegrationRuntimeInitListener() {
-            @Override
-            public void contributeRuntimeProperties(BiConsumer<String, Object> propertyCollector) {
-                propertyCollector.accept(AvailableSettings.DEFAULT_SCHEMA, Configuration.getRawValue("kc.db-schema"));
-            }
-        };
+        return propertyCollector -> propertyCollector.accept(AvailableSettings.DEFAULT_SCHEMA, Configuration.getConfigValue(DatabaseOptions.DB_SCHEMA).getValue());
     }
 
     public void setCryptoProvider(FipsMode fipsMode) {
@@ -221,4 +149,8 @@ public void setCryptoProvider(FipsMode fipsMode) {
             throw new RuntimeException("Unexpected error when configuring the crypto provider: " + cryptoProvider, cause);
         }
     }
+
+    public void configureProtoStreamSchemas(List<SerializationContextInitializer> schemas) {
+        Marshalling.setSchemas(schemas);
+    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/QuarkusProfileConfigResolver.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/QuarkusProfileConfigResolver.java
index 056ca56bf29a..da8cbf418d17 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/QuarkusProfileConfigResolver.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/QuarkusProfileConfigResolver.java
@@ -11,7 +11,7 @@ public QuarkusProfileConfigResolver() {
 
     static String getConfig(String key) {
         return Configuration.getRawPersistedProperty(key)
-                .orElse(Configuration.getRawValue(key));
+                .orElse(Configuration.getConfigValue(key).getValue());
     }
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ExecutionExceptionHandler.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ExecutionExceptionHandler.java
index 55455d7b72e2..cbc0f82399c2 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ExecutionExceptionHandler.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ExecutionExceptionHandler.java
@@ -32,38 +32,45 @@
 import picocli.CommandLine;
 import picocli.CommandLine.ParseResult;
 
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Function;
+
 public final class ExecutionExceptionHandler implements CommandLine.IExecutionExceptionHandler {
 
-    private Logger logger;
+    private static Logger logger;
     private boolean verbose;
+    private static Map<String, Function<Throwable, Throwable>> exceptionTransformers = new HashMap<>();
 
     public ExecutionExceptionHandler() {}
 
     @Override
     public int handleExecutionException(Exception cause, CommandLine cmd, ParseResult parseResult) {
-        if (cause instanceof PropertyException) {
+        var exception = handleExceptionTransformers(cause);
+        if (exception instanceof PropertyException) {
             PrintWriter writer = cmd.getErr();
-            writer.println(cmd.getColorScheme().errorText(cause.getMessage()));
-            if (verbose && cause.getCause() != null) {
-                dumpException(writer, cause.getCause());
+            writer.println(cmd.getColorScheme().errorText(exception.getMessage()));
+            if (verbose && exception.getCause() != null) {
+                dumpException(writer, exception.getCause());
             }
-            return ShortErrorMessageHandler.getInvalidInputExitCode(cause, cmd);
+            return ShortErrorMessageHandler.getInvalidInputExitCode(exception, cmd);
         }
         error(cmd.getErr(), "Failed to run '" + parseResult.subcommands().stream()
                 .map(ParseResult::commandSpec)
                 .map(CommandLine.Model.CommandSpec::name)
                 .findFirst()
-                .orElse(Environment.getCommand()) + "' command.", cause);
+                .orElse(Environment.getCommand()) + "' command.", exception);
         return cmd.getCommandSpec().exitCodeOnExecutionException();
     }
 
     public void error(PrintWriter errorWriter, String message, Throwable cause) {
+        var exception = handleExceptionTransformers(cause);
         if (message != null) {
             logError(errorWriter, "ERROR: " + message);
         }
 
-        if (cause != null) {
-            dumpException(errorWriter, cause);
+        if (exception != null) {
+            dumpException(errorWriter, exception);
 
             if (!verbose) {
                 logError(errorWriter, "For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.");
@@ -121,7 +128,7 @@ private void logError(PrintWriter errorWriter, String errorMessage, Throwable ca
         }
     }
 
-    private Logger getLogger() {
+    private static Logger getLogger() {
         if (logger == null) {
             logger = Logger.getLogger(ExecutionExceptionHandler.class);
         }
@@ -131,4 +138,34 @@ private Logger getLogger() {
     public void setVerbose(boolean verbose) {
         this.verbose = verbose;
     }
+
+    public static void addExceptionTransformer(Class<?> fromClass, Function<Throwable, Throwable> transformer) {
+        if (exceptionTransformers.get(fromClass.getName()) != null) {
+            getLogger().warnf("Transformer for the '%s' class is overridden", fromClass.getName());
+        }
+        exceptionTransformers.put(fromClass.getName(), transformer);
+    }
+
+    public static void resetExceptionTransformers() {
+        exceptionTransformers = new HashMap<>();
+    }
+
+    private static Throwable handleExceptionTransformers(Throwable exception) {
+        if (exception == null) {
+            return null;
+        }
+
+        if (exceptionTransformers.isEmpty()) {
+            return exception;
+        }
+
+        var stackTrace = exception.getStackTrace();
+        for (var trace : stackTrace) {
+            var transformer = exceptionTransformers.get(trace.getClassName());
+            if (transformer != null) {
+                return transformer.apply(exception);
+            }
+        }
+        return exception;
+    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Help.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Help.java
index 2b085c5df415..37309f21d7cd 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Help.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Help.java
@@ -161,7 +161,7 @@ private boolean isVisible(OptionSpec option) {
             // do not show options without a description nor hidden
             return false;
         }
-        
+
         if (ALL_OPTIONS) {
             return true;
         }
@@ -172,11 +172,15 @@ private boolean isVisible(OptionSpec option) {
         if (option.group() != null && option.group().heading() != null) {
             category = OptionCategory.fromHeading(removeSuffix(option.group().heading(), ":"));
         }
-        PropertyMapper<?> mapper = getMapper(optionName, category);
+        String kcKey = PropertyMappers.getKcKeyFromCliKey(optionName).orElse(null);
+        if (kcKey == null) {
+            return true;
+        }
+        PropertyMapper<?> mapper = getMapper(kcKey, category);
 
         if (mapper == null) {
-            final var disabledMapper = PropertyMappers.getDisabledMapper(optionName);
-            
+            final var disabledMapper = PropertyMappers.getDisabledMapper(kcKey);
+
             // Show disabled mappers, which do not have a description when they're enabled
             return disabledMapper.flatMap(PropertyMapper::getEnabledWhen).isEmpty();
         }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Picocli.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Picocli.java
index da1507cc8db6..467cc7d6c03b 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Picocli.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/Picocli.java
@@ -19,17 +19,13 @@
 
 import static java.lang.String.format;
 import static org.keycloak.quarkus.runtime.Environment.getProviderFiles;
-import static org.keycloak.quarkus.runtime.Environment.isDevMode;
 import static org.keycloak.quarkus.runtime.Environment.isRebuild;
 import static org.keycloak.quarkus.runtime.Environment.isRebuildCheck;
 import static org.keycloak.quarkus.runtime.Environment.isRebuilt;
 import static org.keycloak.quarkus.runtime.cli.OptionRenderer.decorateDuplicitOptionName;
 import static org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG;
-import static org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource.parseConfigArgs;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.getRawPersistedProperty;
+import static org.keycloak.quarkus.runtime.configuration.Configuration.isUserModifiable;
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
-import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers.maskValue;
 import static picocli.CommandLine.Model.UsageMessageSpec.SECTION_KEY_COMMAND_LIST;
 
 import java.io.File;
@@ -38,19 +34,19 @@
 import java.util.Arrays;
 import java.util.EnumMap;
 import java.util.HashSet;
-import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.Properties;
 import java.util.Set;
-import java.util.function.BiConsumer;
 import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
 import org.keycloak.common.profile.ProfileException;
+import org.keycloak.common.util.CollectionUtil;
 import org.keycloak.config.DeprecatedMetadata;
 import org.keycloak.config.Option;
 import org.keycloak.config.OptionCategory;
@@ -58,16 +54,13 @@
 import org.keycloak.quarkus.runtime.KeycloakMain;
 import org.keycloak.quarkus.runtime.Messages;
 import org.keycloak.quarkus.runtime.cli.command.AbstractCommand;
+import org.keycloak.quarkus.runtime.cli.command.AbstractNonServerCommand;
 import org.keycloak.quarkus.runtime.cli.command.Build;
-import org.keycloak.quarkus.runtime.cli.command.Completion;
 import org.keycloak.quarkus.runtime.cli.command.Main;
-import org.keycloak.quarkus.runtime.cli.command.ShowConfig;
-import org.keycloak.quarkus.runtime.cli.command.StartDev;
 import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.configuration.DisabledMappersInterceptor;
 import org.keycloak.quarkus.runtime.configuration.KcUnmatchedArgumentException;
-import org.keycloak.quarkus.runtime.configuration.KeycloakPropertiesConfigSource;
 import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
 import org.keycloak.quarkus.runtime.configuration.PropertyMappingInterceptor;
 import org.keycloak.quarkus.runtime.configuration.QuarkusPropertiesConfigSource;
@@ -77,6 +70,7 @@
 import io.quarkus.bootstrap.runner.QuarkusEntryPoint;
 import io.quarkus.runtime.LaunchMode;
 import io.smallrye.config.ConfigValue;
+import io.smallrye.mutiny.tuples.Functions.TriConsumer;
 import picocli.CommandLine;
 import picocli.CommandLine.DuplicateOptionAnnotationsException;
 import picocli.CommandLine.Help.Ansi;
@@ -92,7 +86,7 @@
 
 public class Picocli {
 
-    private static final String KC_PROVIDER_FILE_PREFIX = "kc.provider.file.";
+    static final String KC_PROVIDER_FILE_PREFIX = "kc.provider.file.";
     public static final String ARG_PREFIX = "--";
     public static final String ARG_SHORT_PREFIX = "-";
     public static final String NO_PARAM_LABEL = "none";
@@ -102,9 +96,10 @@ private static class IncludeOptions {
         boolean includeBuildTime;
     }
 
-    private ExecutionExceptionHandler errorHandler = new ExecutionExceptionHandler();
+    private final ExecutionExceptionHandler errorHandler = new ExecutionExceptionHandler();
     private Set<PropertyMapper<?>> allowedMappers;
-    private List<String> unrecognizedArgs = new ArrayList<>();
+    private final List<String> unrecognizedArgs = new ArrayList<>();
+    private Optional<AbstractCommand> parsedCommand = Optional.empty();
 
     public void parseAndRun(List<String> cliArgs) {
         // perform two passes over the cli args. First without option validation to determine the current command, then with option validation enabled
@@ -118,17 +113,7 @@ public void parseAndRun(List<String> cliArgs) {
             // recreate the command specifically for the current
             cmd = createCommandLineForCommand(cliArgs, commandLineList);
 
-            int exitCode;
-            if (isRebuildCheck()) {
-                CommandLine currentCommand = null;
-                if (commandLineList.size() > 1) {
-                    currentCommand = commandLineList.get(commandLineList.size() - 1);
-                }
-                exitCode = runReAugmentationIfNeeded(cliArgs, cmd, currentCommand);
-            } else {
-                PropertyMappers.sanitizeDisabledMappers();
-                exitCode = cmd.execute(argArray);
-            }
+            int exitCode = cmd.execute(argArray);
 
             exit(exitCode);
         } catch (ParameterException parEx) {
@@ -168,15 +153,16 @@ public <T> T set(T value) {
                 addHelp(currentSpec);
             }
 
+            AbstractCommand currentCommand = null;
             if (currentSpec != null) {
                 CommandLine commandLine = currentSpec.commandLine();
                 addCommandOptions(cliArgs, commandLine);
 
                 if (commandLine != null && commandLine.getCommand() instanceof AbstractCommand ac) {
-                    // set current parsed command
-                    Environment.setParsedCommand(ac);
+                    currentCommand = ac;
                 }
             }
+            initConfig(currentCommand);
 
             if (isRebuildCheck()) {
                 // build command should be available when running re-aug
@@ -185,6 +171,10 @@ public <T> T set(T value) {
         });
     }
 
+    public Optional<AbstractCommand> getParsedCommand() {
+        return parsedCommand;
+    }
+
     private void catchParameterException(ParameterException parEx, CommandLine cmd, String[] args) {
         int exitCode;
         try {
@@ -202,125 +192,7 @@ public void usageException(String message, Throwable cause) {
     }
 
     public void exit(int exitCode) {
-        if (exitCode != CommandLine.ExitCode.OK && (!Environment.isTestLaunchMode() || isRebuildCheck())) {
-            // hard exit wanted, as build failed and no subsequent command should be executed. no quarkus involved.
-            System.exit(exitCode);
-        }
-    }
-
-    private int runReAugmentationIfNeeded(List<String> cliArgs, CommandLine cmd, CommandLine currentCommand) {
-        int exitCode = 0;
-
-        if (currentCommand == null) {
-            return exitCode; // possible if using --version or the user made a mistake
-        }
-
-        String currentCommandName = currentCommand.getCommandName();
-
-        if (shouldSkipRebuild(cliArgs, currentCommandName)) {
-            return exitCode;
-        }
-
-        // TODO: ensure that the config has not yet been initialized
-        // - there's currently no good way to do that directly on ConfigProviderResolver
-        initProfile(cliArgs, currentCommandName);
-
-        if (requiresReAugmentation(currentCommand)) {
-            PropertyMappers.sanitizeDisabledMappers();
-            exitCode = runReAugmentation(cliArgs, cmd);
-        }
-
-        return exitCode;
-    }
-
-    protected void initProfile(List<String> cliArgs, String currentCommandName) {
-        if (currentCommandName.equals(StartDev.NAME)) {
-            // force the server image to be set with the dev profile
-            Environment.forceDevProfile();
-        } else {
-            Environment.updateProfile(false);
-
-            // override from the cli if specified
-            parseConfigArgs(cliArgs, (k, v) -> {
-                if (k.equals(Main.PROFILE_SHORT_NAME) || k.equals(Main.PROFILE_LONG_NAME)) {
-                    Environment.setProfile(v);
-                }
-            }, ignored -> {});
-        }
-    }
-
-    private static boolean shouldSkipRebuild(List<String> cliArgs, String currentCommandName) {
-        return cliArgs.contains("--help")
-                || cliArgs.contains("-h")
-                || cliArgs.contains("--help-all")
-                || currentCommandName.equals(Build.NAME)
-                || currentCommandName.equals(ShowConfig.NAME)
-                || currentCommandName.equals(Completion.NAME);
-    }
-
-    private static boolean requiresReAugmentation(CommandLine cmdCommand) {
-        Map<String, String> rawPersistedProperties = Configuration.getRawPersistedProperties();
-        if (rawPersistedProperties.isEmpty()) {
-            return true; // no build yet
-        }
-        var current = getNonPersistedBuildTimeOptions();
-
-        // everything but the optimized value must match
-        String key = Configuration.KC_OPTIMIZED;
-        Optional.ofNullable(rawPersistedProperties.get(key)).ifPresentOrElse(value -> current.put(key, value), () -> current.remove(key));
-        return !rawPersistedProperties.equals(current);
-    }
-
-    /**
-     * checks the raw cli input for possible credentials / properties which should be masked,
-     * and masks them.
-     * @return a list of potentially masked properties in CLI format, e.g. `--db-password=*******`
-     * instead of the actual passwords value.
-     */
-    private static List<String> getSanitizedRuntimeCliOptions() {
-        List<String> properties = new ArrayList<>();
-
-        parseConfigArgs(ConfigArgsConfigSource.getAllCliArgs(), new BiConsumer<String, String>() {
-            @Override
-            public void accept(String key, String value) {
-                PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
-
-                if (mapper == null || mapper.isRunTime()) {
-                    properties.add(key + "=" + maskValue(key, value));
-                }
-            }
-        }, arg -> {
-            properties.add(arg);
-        });
-
-        return properties;
-    }
-
-    private static int runReAugmentation(List<String> cliArgs, CommandLine cmd) {
-        if(!isDevMode() && cmd != null) {
-            cmd.getOut().println("Changes detected in configuration. Updating the server image.");
-            if (Configuration.isOptimized()) {
-                checkChangesInBuildOptionsDuringAutoBuild(cmd.getOut());
-            }
-        }
-
-        List<String> configArgsList = new ArrayList<>();
-        configArgsList.add(Build.NAME);
-        parseConfigArgs(cliArgs, (k, v) -> {
-            PropertyMapper<?> mapper = PropertyMappers.getMapper(k);
-
-            if (mapper != null && mapper.isBuildTime()) {
-                configArgsList.add(k + "=" + v);
-            }
-        }, ignored -> {});
-
-        int exitCode = cmd.execute(configArgsList.toArray(new String[0]));
-
-        if(!isDevMode() && exitCode == cmd.getCommandSpec().exitCodeOnSuccess()) {
-            cmd.getOut().printf("Next time you run the server, just run:%n%n\t%s %s %s%n%n", Environment.getCommand(), String.join(" ", getSanitizedRuntimeCliOptions()), OPTIMIZED_BUILD_OPTION_LONG);
-        }
-
-        return exitCode;
+        System.exit(exitCode);
     }
 
     private static boolean wasBuildEverRun() {
@@ -338,7 +210,7 @@ public void validateConfig(List<String> cliArgs, AbstractCommand abstractCommand
             if (arg.contains("=")) {
                 arg = arg.substring(0, arg.indexOf("="));
             }
-            PropertyMapper<?> mapper = PropertyMappers.getMapper(arg);
+            PropertyMapper<?> mapper = PropertyMappers.getMapperByCliKey(arg);
             return mapper != null && mapper.hasWildcard() && allowedMappers.contains(mapper);
         });
         if (!unrecognizedArgs.isEmpty()) {
@@ -355,17 +227,37 @@ public void validateConfig(List<String> cliArgs, AbstractCommand abstractCommand
             return;
         }
 
+        final List<String> ignoredBuildTime = new ArrayList<>();
+
+        if (!options.includeBuildTime) {
+            // check for provider changes, or overrides of existing persisted options
+            // we have to ignore things like the profile properties because the commands set them at runtime
+            checkChangesInBuildOptions((key, oldValue, newValue) -> {
+                if (key.startsWith(KC_PROVIDER_FILE_PREFIX)) {
+                    if (timestampChanged(oldValue, newValue)) {
+                        throw new PropertyException("A provider JAR was updated since the last build, please rebuild for this to be fully utilized.");
+                    }
+                } else if (newValue != null && !isIgnoredPersistedOption(key)
+                        && isUserModifiable(Configuration.getConfigValue(key))
+                        // let quarkus handle this - it's unsupported for direct usage in keycloak
+                        && !key.startsWith(MicroProfileConfigProvider.NS_QUARKUS_PREFIX)) {
+                    ignoredBuildTime.add(key);
+                }
+            });
+        }
+
         final boolean disabledMappersInterceptorEnabled = DisabledMappersInterceptor.isEnabled(); // return to the state before the disable
         try {
             PropertyMappingInterceptor.disable(); // we don't want the mapped / transformed properties, we want what the user effectively supplied
             DisabledMappersInterceptor.disable(); // we want all properties, even disabled ones
 
-            final List<String> ignoredBuildTime = new ArrayList<>();
             final List<String> ignoredRunTime = new ArrayList<>();
-            final Set<String> disabledBuildTime = new HashSet<>();
-            final Set<String> disabledRunTime = new HashSet<>();
-            final Set<String> deprecatedInUse = new HashSet<>();
-            final Set<String> missingOption = new HashSet<>();
+            final Set<String> disabledBuildTime = new LinkedHashSet<>();
+            final Set<String> disabledRunTime = new LinkedHashSet<>();
+            final Set<String> deprecatedInUse = new LinkedHashSet<>();
+            final Set<String> missingOption = new LinkedHashSet<>();
+            final Set<String> ambiguousSpi = new LinkedHashSet<>();
+            final LinkedHashMap<String, String> secondClassOptions = new LinkedHashMap<>();
 
             final Set<PropertyMapper<?>> disabledMappers = new HashSet<>();
             if (options.includeBuildTime) {
@@ -375,64 +267,55 @@ public void validateConfig(List<String> cliArgs, AbstractCommand abstractCommand
                 disabledMappers.addAll(PropertyMappers.getDisabledRuntimeMappers().values());
             }
 
-            checkSpiOptions(options, ignoredBuildTime, ignoredRunTime);
+            var categories = new HashSet<>(abstractCommand.getOptionCategories());
 
-            for (OptionCategory category : abstractCommand.getOptionCategories()) {
-                List<PropertyMapper<?>> mappers = new ArrayList<>(disabledMappers);
+            // first validate the advertised property names
+            // - this allows for efficient resolution of wildcard values and checking spi options
+            Configuration.getPropertyNames().forEach(name -> {
+                if (!name.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX)) {
+                    return; // there are canonical mappings to kc. values - no need to consider alternative forms
+                }
+                if (!options.includeRuntime) {
+                    checkRuntimeSpiOptions(name, ignoredRunTime);
+                }
+                if (PropertyMappers.isMaybeSpiBuildTimeProperty(name)) {
+                    ambiguousSpi.add(name);
+                }
+                PropertyMapper<?> mapper = PropertyMappers.getMapper(name);
+                if (mapper == null) {
+                    return; // TODO: need to look for disabled Wildcard mappers
+                }
+                String from = mapper.forKey(name).getFrom();
+                if (!name.equals(from)) {
+                    ConfigValue value = Configuration.getConfigValue(name);
+                    if (value.getValue() != null && isUserModifiable(value)) {
+                        secondClassOptions.put(name, from);
+                    }
+                }
+                if (!mapper.hasWildcard()) {
+                    return; // non-wildcard options will be validated in the next pass
+                }
+                if (!categories.contains(mapper.getCategory())) {
+                    return; // not of interest to this command
+                    // TODO: due to picking values up from the env and auto-builds, this probably isn't correct
+                    // - the same issue exists with the second pass
+                }
+                validateProperty(abstractCommand, options, ignoredRunTime, disabledBuildTime, disabledRunTime,
+                        deprecatedInUse, missingOption, disabledMappers, mapper, from);
+            });
+
+            // second pass validate any property mapper not seen in the first pass
+            // - this will catch required values, anything missing from the property names, or disabled
+            List<PropertyMapper<?>> mappers = new ArrayList<>(disabledMappers);
+            for (OptionCategory category : categories) {
                 Optional.ofNullable(PropertyMappers.getRuntimeMappers().get(category)).ifPresent(mappers::addAll);
                 Optional.ofNullable(PropertyMappers.getBuildTimeMappers().get(category)).ifPresent(mappers::addAll);
-                for (PropertyMapper<?> mapper : mappers) {
-                    mapper.getKcConfigValues().forEach(configValue -> {
-                        String configValueStr = configValue.getValue();
-
-                        // don't consider missing or anything below standard env properties
-                        if (configValueStr != null && !isUserModifiable(configValue)) {
-                            return;
-                        }
-
-                        if (disabledMappers.contains(mapper)) {
-                            if (!PropertyMappers.isDisabledMapper(mapper.getFrom())) {
-                                return; // we found enabled mapper with the same name
-                            }
-
-                            // only check build-time for a rebuild, we'll check the runtime later
-                            if (configValueStr != null && (!mapper.isRunTime() || !isRebuild())) {
-                                if (PropertyMapper.isCliOption(configValue)) {
-                                    throw new KcUnmatchedArgumentException(abstractCommand.getCommandLine().orElseThrow(), List.of(mapper.getCliFormat()));
-                                } else {
-                                    handleDisabled(mapper.isRunTime() ? disabledRunTime : disabledBuildTime, mapper);
-                                }
-                            }
-                            return;
-                        }
-
-                        if (mapper.isBuildTime() && !options.includeBuildTime) {
-                            String currentValue = getRawPersistedProperty(mapper.getFrom()).orElse(null);
-                            if (!Objects.equals(configValueStr, currentValue)) {
-                                ignoredBuildTime.add(mapper.getFrom());
-                                return;
-                            }
-                        }
-                        if (mapper.isRunTime() && !options.includeRuntime) {
-                            if (configValueStr != null) {
-                                ignoredRunTime.add(mapper.getFrom());
-                            }
-                            return;
-                        }
-                        
-                        if (configValueStr == null) {
-                            if (mapper.isRequired()) {
-                                handleRequired(missingOption, mapper);
-                            }
-                            return;
-                        }
-
-                        mapper.validate(configValue);
+            }
 
-                        mapper.getDeprecatedMetadata().ifPresent(metadata -> {
-                            handleDeprecated(deprecatedInUse, mapper, configValueStr, metadata);
-                        });
-                    });;
+            for (PropertyMapper<?> mapper : mappers) {
+                if (!mapper.hasWildcard()) {
+                    validateProperty(abstractCommand, options, ignoredRunTime, disabledBuildTime, disabledRunTime,
+                            deprecatedInUse, missingOption, disabledMappers, mapper, mapper.getFrom());
                 }
             }
 
@@ -443,8 +326,8 @@ public void validateConfig(List<String> cliArgs, AbstractCommand abstractCommand
                 throw new PropertyException(format("The following build time options have values that differ from what is persisted - the new values will NOT be used until another build is run: %s\n",
                         String.join(", ", ignoredBuildTime)));
             } else if (!ignoredRunTime.isEmpty()) {
-                warn(format("The following run time options were found, but will be ignored during build time: %s\n",
-                        String.join(", ", ignoredRunTime)), getOutWriter());
+                info(format("The following run time options were found, but will be ignored during build time: %s\n",
+                        String.join(", ", ignoredRunTime)));
             }
 
             if (!disabledBuildTime.isEmpty()) {
@@ -456,42 +339,92 @@ public void validateConfig(List<String> cliArgs, AbstractCommand abstractCommand
             if (!deprecatedInUse.isEmpty()) {
                 warn("The following used options or option values are DEPRECATED and will be removed or their behaviour changed in a future release:\n" + String.join("\n", deprecatedInUse) + "\nConsult the Release Notes for details.", getOutWriter());
             }
+            if (!ambiguousSpi.isEmpty()) {
+                warn("The following SPI options are using the legacy format and are not being treated as build time options. Please use the new format with the appropriate -- separators to resolve this ambiguity: " + String.join("\n", ambiguousSpi));
+            }
+            secondClassOptions.forEach((key, firstClass) -> {
+                warn("Please use the first-class option `%s` instead of `%s`".formatted(firstClass, key), getOutWriter());
+            });
         } finally {
             DisabledMappersInterceptor.enable(disabledMappersInterceptorEnabled);
             PropertyMappingInterceptor.enable();
         }
     }
 
-    private static boolean isUserModifiable(ConfigValue configValue) {
-        // This could check as low as SysPropConfigSource DEFAULT_ORDINAL, which is 400
-        // for now we won't validate these as it's not expected for the user to specify options via system properties
-        return configValue.getConfigSourceOrdinal() >= KeycloakPropertiesConfigSource.PROPERTIES_FILE_ORDINAL;
+    static boolean timestampChanged(String oldValue, String newValue) {
+        if (newValue != null && oldValue != null) {
+            long longNewValue = Long.valueOf(newValue);
+            long longOldValue = Long.valueOf(oldValue);
+            // docker commonly truncates to the second at runtime, so we'll allow that special case
+            return ((longNewValue / 1000) * 1000) != longNewValue || ((longOldValue / 1000) * 1000) != longNewValue;
+        }
+        return true;
     }
 
-    private static void checkSpiOptions(IncludeOptions options, final List<String> ignoredBuildTime,
-            final List<String> ignoredRunTime) {
-        for (String key : Configuration.getConfig().getPropertyNames()) {
-            if (!key.startsWith(PropertyMappers.KC_SPI_PREFIX)) {
-                continue;
+    private void validateProperty(AbstractCommand abstractCommand, IncludeOptions options,
+            final List<String> ignoredRunTime, final Set<String> disabledBuildTime, final Set<String> disabledRunTime,
+            final Set<String> deprecatedInUse, final Set<String> missingOption,
+            final Set<PropertyMapper<?>> disabledMappers, PropertyMapper<?> mapper, String from) {
+        ConfigValue configValue = Configuration.getConfigValue(from);
+        String configValueStr = configValue.getValue();
+
+        // don't consider missing or anything below standard env properties
+        if (configValueStr != null && !isUserModifiable(configValue)) {
+            return;
+        }
+
+        if (disabledMappers.contains(mapper)) {
+            if (PropertyMappers.getMapper(from) != null) {
+                return; // we found enabled mapper with the same name
+            }
+
+            // only check build-time for a rebuild, we'll check the runtime later
+            if (configValueStr != null && (!mapper.isRunTime() || !isRebuild())) {
+                if (PropertyMapper.isCliOption(configValue)) {
+                    throw new KcUnmatchedArgumentException(abstractCommand.getCommandLine().orElseThrow(), List.of(mapper.getCliFormat()));
+                } else {
+                    handleDisabled(mapper.isRunTime() ? disabledRunTime : disabledBuildTime, mapper);
+                }
+            }
+            return;
+        }
+
+        if (mapper.isRunTime() && !options.includeRuntime) {
+            if (configValueStr != null) {
+                ignoredRunTime.add(mapper.getFrom());
+            }
+            return;
+        }
+
+        if (configValueStr == null) {
+            if (mapper.isRequired()) {
+                handleRequired(missingOption, mapper);
             }
-            boolean buildTimeOption = PropertyMappers.isSpiBuildTimeProperty(key);
+            return;
+        }
+
+        PropertyMappingInterceptor.enable();
+        try {
+            mapper.validate(configValue);
+        } finally {
+            PropertyMappingInterceptor.disable();
+        }
+
+        mapper.getDeprecatedMetadata().ifPresent(metadata -> handleDeprecated(deprecatedInUse, mapper, configValueStr, metadata));
+    }
 
+    private static void checkRuntimeSpiOptions(String key, final List<String> ignoredRunTime) {
+        if (!key.startsWith(PropertyMappers.KC_SPI_PREFIX)) {
+            return;
+        }
+        boolean buildTimeOption = PropertyMappers.isSpiBuildTimeProperty(key);
+
+        if (!buildTimeOption) {
             ConfigValue configValue = Configuration.getConfigValue(key);
             String configValueStr = configValue.getValue();
 
             // don't consider missing or anything below standard env properties
-            if (configValueStr == null || configValue.getConfigSourceOrdinal() < 300) {
-                continue;
-            }
-
-            if (!options.includeBuildTime) {
-                if (buildTimeOption) {
-                    String currentValue = getRawPersistedProperty(key).orElse(null);
-                    if (!configValueStr.equals(currentValue)) {
-                        ignoredBuildTime.add(key);
-                    }
-                }
-            } else if (!options.includeRuntime && !buildTimeOption) {
+            if (configValueStr != null && isUserModifiable(configValue)) {
                 ignoredRunTime.add(key);
             }
         }
@@ -559,6 +492,16 @@ public void warn(String text) {
         warn(text, getOutWriter());
     }
 
+    public void info(String text) {
+        ColorScheme defaultColorScheme = picocli.CommandLine.Help.defaultColorScheme(Help.Ansi.AUTO);
+        getOutWriter().println(defaultColorScheme.apply("INFO: ", Arrays.asList(Style.fg_green, Style.bold)) + text);
+    }
+
+    public void error(String text) {
+        ColorScheme defaultColorScheme = picocli.CommandLine.Help.defaultColorScheme(Help.Ansi.AUTO);
+        getErrWriter().println(defaultColorScheme.apply(text, Arrays.asList(Style.fg_red, Style.bold)));
+    }
+
     private static void warn(String text, PrintWriter outwriter) {
         ColorScheme defaultColorScheme = picocli.CommandLine.Help.defaultColorScheme(Help.Ansi.AUTO);
         outwriter.println(defaultColorScheme.apply("WARNING: ", Arrays.asList(Style.fg_yellow, Style.bold)) + text);
@@ -580,7 +523,7 @@ public static Properties getNonPersistedBuildTimeOptions() {
                 if (!mapper.isBuildTime()) {
                     return;
                 }
-                name = mapper.getFrom();
+                name = mapper.forKey(name).getFrom();
                 if (properties.containsKey(name)) {
                     return;
                 }
@@ -593,7 +536,7 @@ public static Properties getNonPersistedBuildTimeOptions() {
             }
             ConfigValue value = Configuration.getNonPersistedConfigValue(name);
             if (value.getValue() == null || value.getConfigSourceName() == null
-                    || (quarkus && !value.getConfigSourceName().equals(QuarkusPropertiesConfigSource.NAME))) {
+                    || (quarkus && !value.getConfigSourceName().contains(QuarkusPropertiesConfigSource.NAME))) {
                 // only persist build options resolved from config sources and not default values
                 return;
             }
@@ -639,7 +582,8 @@ public <K> K create(Class<K> cls) throws Exception {
         consumer.accept(spec);
 
         CommandLine cmd = new CommandLine(spec);
-
+        cmd.setExpandAtFiles(false);
+        cmd.setPosixClusteredShortOptionsAllowed(false);
         cmd.setExecutionExceptionHandler(this.errorHandler);
         cmd.setParameterExceptionHandler(new ShortErrorMessageHandler());
         cmd.setHelpFactory(new HelpFactory());
@@ -678,7 +622,7 @@ private IncludeOptions getIncludeOptions(List<String> cliArgs, AbstractCommand a
 
         if (!result.includeBuildTime && !result.includeRuntime) {
             return result;
-        } else if (result.includeRuntime && !result.includeBuildTime && !ShowConfig.NAME.equals(commandName)) {
+        } else if (result.includeRuntime && !result.includeBuildTime) {
             result.includeBuildTime = isRebuilt() || !cliArgs.contains(OPTIMIZED_BUILD_OPTION_LONG);
         } else if (result.includeBuildTime && !result.includeRuntime) {
             result.includeRuntime = isRebuildCheck();
@@ -713,7 +657,9 @@ private void addOptionsToCli(CommandLine commandLine, IncludeOptions includeOpti
 
         addMappedOptionsToArgGroups(commandLine, mappers);
 
-        allowedMappers = mappers.values().stream().flatMap(List::stream).collect(Collectors.toUnmodifiableSet());
+        if (CollectionUtil.isEmpty(allowedMappers)) {
+            allowedMappers = mappers.values().stream().flatMap(List::stream).collect(Collectors.toUnmodifiableSet());
+        }
     }
 
     private static <T extends Map<OptionCategory, List<PropertyMapper<?>>>> void combinePropertyMappers(T origMappers, T additionalMappers) {
@@ -751,28 +697,25 @@ private static void addMappedOptionsToArgGroups(CommandLine commandLine, Map<Opt
                     name = decorateDuplicitOptionName(name);
                 }
 
-                String description = mapper.getDescription();
-
-                if (description == null || cSpec.optionsMap().containsKey(name) || name.endsWith(OPTION_PART_SEPARATOR) || alreadyPresentArgs.contains(name)) {
-                    //when key is already added or has no description, don't add.
+                if (cSpec.optionsMap().containsKey(name) || alreadyPresentArgs.contains(name)) {
+                    //when key is already added, don't add.
                     continue;
                 }
 
                 OptionSpec.Builder optBuilder = OptionSpec.builder(name)
                         .description(getDecoratedOptionDescription(mapper))
-                        .paramLabel(mapper.getParamLabel())
-                        .completionCandidates(new Iterable<String>() {
-                            @Override
-                            public Iterator<String> iterator() {
-                                return mapper.getExpectedValues().iterator();
-                            }
-                        })
+                        .completionCandidates(() -> mapper.getExpectedValues().iterator())
                         .hidden(mapper.isHidden());
 
+                if (mapper.getParamLabel() != null) {
+                    optBuilder.paramLabel(mapper.getParamLabel());
+                }
+
                 if (mapper.getDefaultValue().isPresent()) {
                     optBuilder.defaultValue(Option.getDefaultValueString(mapper.getDefaultValue().get()));
                 }
 
+                optBuilder.arity("1"); // everything requires a value to match configargs parsing
                 if (mapper.getType() != null) {
                     optBuilder.type(mapper.getType());
                     if (mapper.isList()) {
@@ -801,7 +744,7 @@ public Iterator<String> iterator() {
     }
 
     private static String getDecoratedOptionDescription(PropertyMapper<?> mapper) {
-        StringBuilder transformedDesc = new StringBuilder(mapper.getDescription());
+        StringBuilder transformedDesc = new StringBuilder(Optional.ofNullable(mapper.getDescription()).orElse(""));
 
         if (mapper.getType() != Boolean.class && !mapper.getExpectedValues().isEmpty()) {
             List<String> decoratedExpectedValues = mapper.getExpectedValues().stream().map(value -> {
@@ -858,8 +801,8 @@ private static String getDecoratedOptionDescription(PropertyMapper<?> mapper) {
         return transformedDesc.toString();
     }
 
-    public static void println(CommandLine cmd, String message) {
-        cmd.getOut().println(message);
+    public void println(String message) {
+        getOutWriter().println(message);
     }
 
     public static List<String> parseArgs(String[] rawArgs) throws PropertyException {
@@ -889,9 +832,26 @@ public static List<String> parseArgs(String[] rawArgs) throws PropertyException
         return args;
     }
 
-    private static void checkChangesInBuildOptionsDuringAutoBuild(PrintWriter out) {
+    public static void checkChangesInBuildOptionsDuringAutoBuild(PrintWriter out) {
         StringBuilder options = new StringBuilder();
 
+        checkChangesInBuildOptions((key, oldValue, newValue) -> optionChanged(options, key, oldValue, newValue));
+
+        if (options.isEmpty()) {
+            return;
+        }
+        out.println(
+                Ansi.AUTO.string(
+                        new StringBuilder("@|bold,red ")
+                                .append("The previous optimized build will be overridden with the following build options:")
+                                .append(options)
+                                .append("\nTo avoid that, run the 'build' command again and then start the optimized server instance using the '--optimized' flag.")
+                                .append("|@").toString()
+                )
+        );
+    }
+
+    private static void checkChangesInBuildOptions(TriConsumer<String, String, String> valueChanged) {
         var current = getNonPersistedBuildTimeOptions();
         var persisted = Configuration.getRawPersistedProperties();
 
@@ -900,34 +860,21 @@ private static void checkChangesInBuildOptionsDuringAutoBuild(PrintWriter out) {
         current.forEach((key, value) -> {
             String persistedValue = persisted.get(key);
             if (!value.equals(persistedValue)) {
-                optionChanged(options, (String)key, persistedValue, (String)value);
+                valueChanged.accept((String)key, persistedValue, (String)value);
             }
         });
 
         persisted.forEach((key, value) -> {
             if (current.get(key) == null) {
-                optionChanged(options, key, value, null);
+                valueChanged.accept(key, value, null);
             }
         });
-
-        if (options.length() > 0) {
-            out.println(
-                    Ansi.AUTO.string(
-                            new StringBuilder("@|bold,red ")
-                                    .append("The previous optimized build will be overridden with the following build options:")
-                                    .append(options)
-                                    .append("\nTo avoid that, run the 'build' command again and then start the optimized server instance using the '--optimized' flag.")
-                                    .append("|@").toString()
-                    )
-            );
-        }
     }
 
     private static void optionChanged(StringBuilder options, String key, String oldValue, String newValue) {
         // the assumption here is that no build time options need mask handling
         boolean isIgnored = !key.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX)
-                || key.startsWith(KC_PROVIDER_FILE_PREFIX) || key.equals(Configuration.KC_OPTIMIZED)
-                || key.equals(org.keycloak.common.util.Environment.PROFILE);
+                || key.startsWith(KC_PROVIDER_FILE_PREFIX) || isIgnoredPersistedOption(key);
         if (!isIgnored) {
             key = key.substring(3);
             options.append("\n\t- ").append(key).append("=")
@@ -937,12 +884,32 @@ private static void optionChanged(StringBuilder options, String key, String oldV
         }
     }
 
+    private static boolean isIgnoredPersistedOption(String key) {
+        return key.equals(Configuration.KC_OPTIMIZED) || key.equals(org.keycloak.common.util.Environment.PROFILE)
+                || key.equals(LaunchMode.current().getProfileKey());
+    }
+
     public void start() {
-        KeycloakMain.start(errorHandler, getErrWriter());
+        KeycloakMain.start(this, (AbstractNonServerCommand) this.getParsedCommand()
+                .filter(AbstractNonServerCommand.class::isInstance).orElse(null), this.errorHandler);
     }
 
     public void build() throws Throwable {
         QuarkusEntryPoint.main();
     }
 
+    public void initConfig(AbstractCommand command) {
+        if (Configuration.isInitialized()) {
+            throw new IllegalStateException("Config should not be initialized until profile is determined");
+        }
+        this.parsedCommand = Optional.ofNullable(command);
+
+        String profile = parsedCommand.map(AbstractCommand::getInitProfile)
+                .orElseGet(() -> Optional.ofNullable(org.keycloak.common.util.Environment.getProfile())
+                        .orElse(Environment.PROD_PROFILE_VALUE));
+
+        Environment.setProfile(profile);
+        parsedCommand.ifPresent(PropertyMappers::sanitizeDisabledMappers);
+    }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ShortErrorMessageHandler.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ShortErrorMessageHandler.java
index 1b70f2c74a20..8b657dac13e3 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ShortErrorMessageHandler.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/ShortErrorMessageHandler.java
@@ -32,23 +32,21 @@ public int handleParseException(ParameterException ex, String[] args) {
         String errorMessage = ex.getMessage();
         String additionalSuggestion = null;
 
-        if (ex instanceof UnmatchedArgumentException) {
-            UnmatchedArgumentException uae = (UnmatchedArgumentException) ex;
-
+        if (ex instanceof UnmatchedArgumentException uae) {
             String[] unmatched = getUnmatchedPartsByOptionSeparator(uae, "=");
 
             String cliKey = unmatched[0];
 
-            PropertyMapper<?> mapper = PropertyMappers.getMapper(cliKey);
+            PropertyMapper<?> mapper = PropertyMappers.getMapperByCliKey(cliKey);
+
+            Optional<PropertyMapper<?>> disabled = PropertyMappers.getKcKeyFromCliKey(cliKey).flatMap(PropertyMappers::getDisabledMapper);
 
-            final boolean isDisabledOption = mapper == null && PropertyMappers.isDisabledMapper(cliKey);
             final BooleanSupplier isUnknownOption = () -> mapper == null || !(cmd.getCommand() instanceof AbstractCommand);
 
-            if (isDisabledOption) {
-                var enabledWhen = PropertyMappers.getDisabledMapper(cliKey)
-                        .map(PropertyMapper::getEnabledWhen)
-                        .filter(Optional::isPresent)
-                        .map(desc -> format(". %s", desc.get()))
+            if (mapper == null && disabled.isPresent()) {
+                var enabledWhen = disabled
+                        .flatMap(PropertyMapper::getEnabledWhen)
+                        .map(desc -> format(". %s", desc))
                         .orElse("");
 
                 errorMessage = format("Disabled option: '%s'%s", cliKey, enabledWhen);
@@ -72,12 +70,10 @@ public int handleParseException(ParameterException ex, String[] args) {
                     }
                 }
             }
-        } else if (ex instanceof MissingParameterException) {
-            MissingParameterException mpe = (MissingParameterException)ex;
+        } else if (ex instanceof MissingParameterException mpe) {
             if (mpe.getMissing().size() == 1) {
                 ArgSpec spec = mpe.getMissing().get(0);
-                if (spec instanceof OptionSpec) {
-                    OptionSpec option = (OptionSpec)spec;
+                if (spec instanceof OptionSpec option) {
                     errorMessage = getExpectedMessage(option);
                 }
             }
@@ -99,7 +95,7 @@ public int handleParseException(ParameterException ex, String[] args) {
         return getInvalidInputExitCode(ex, cmd);
     }
 
-    static int getInvalidInputExitCode(Exception ex, CommandLine cmd) {
+    static int getInvalidInputExitCode(Throwable ex, CommandLine cmd) {
         return cmd.getExitCodeExceptionMapper() != null
                 ? cmd.getExitCodeExceptionMapper().getExitCode(ex)
                 : cmd.getCommandSpec().exitCodeOnInvalidInput();
@@ -126,8 +122,11 @@ private boolean isCaseInsensitive(OptionSpec option) {
     }
 
     public static String getExpectedValuesMessage(Iterable<String> specCandidates, boolean caseInsensitive) {
-        return specCandidates.iterator().hasNext() ? String.format(" Expected values are%s: %s",
-                caseInsensitive ? " (case insensitive)" : "", String.join(", ", specCandidates)) : "";
+        if (specCandidates == null || !specCandidates.iterator().hasNext()) {
+            return "";
+        }
+        return String.format(" Expected values are%s: %s", caseInsensitive ? " (case insensitive)" : "",
+                String.join(", ", specCandidates));
     }
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractCommand.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractCommand.java
index 6c7926bd9aa9..586a622f3326 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractCommand.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractCommand.java
@@ -22,16 +22,19 @@
 import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
+import java.util.concurrent.Callable;
 
 import org.keycloak.config.OptionCategory;
+import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.cli.Picocli;
 import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
+import org.keycloak.quarkus.runtime.configuration.PersistedConfigSource;
 
 import picocli.CommandLine;
 import picocli.CommandLine.Model.CommandSpec;
 import picocli.CommandLine.Spec;
 
-public abstract class AbstractCommand {
+public abstract class AbstractCommand implements Callable<Integer> {
 
     @Spec
     protected CommandSpec spec; // will be null for "start --optimized"
@@ -45,6 +48,52 @@ protected void executionError(CommandLine cmd, String message, Throwable cause)
         cliExecutionError(cmd, message, cause);
     }
 
+    /**
+     * Get the effective profile used when the config is initialized
+     */
+    public String getInitProfile() {
+        String configuredProfile = org.keycloak.common.util.Environment.getProfile();
+        if (configuredProfile != null) {
+            return configuredProfile; // the profile was already set by the cli or even ENV
+        }
+        if (Environment.isRebuildCheck()) {
+            // builds default to prod, if the profile is not overriden via the cli
+            return Environment.PROD_PROFILE_VALUE;
+        }
+        // otherwise take the default profile, or what is persisted, or ultimately prod
+        return Optional.ofNullable(this.getDefaultProfile())
+                .or(() -> Optional.ofNullable(
+                        PersistedConfigSource.getInstance().getValue(org.keycloak.common.util.Environment.PROFILE)))
+                .orElse(Environment.PROD_PROFILE_VALUE);
+    }
+
+    @Override
+    public Integer call() {
+        return callCommand().orElseGet(() -> {
+            runCommand();
+            return CommandLine.ExitCode.OK;
+        });
+    }
+
+    /**
+     * An alternative to {@link #runCommand()} that allows for returning an exit code.
+     * If the Optional is empty, {@link #runCommand()} will still be called
+     * <br>
+     * see {@link #call()}
+     */
+    protected Optional<Integer> callCommand() {
+        return Optional.empty();
+    }
+
+    /**
+     * If {@link #callCommand()} returns an empty {@link Optional}, then this method will be used to run the command. OK will be returned as the exit code after successful completion.
+     * <br>
+     * see {@link #call()}
+     */
+    protected void runCommand() {
+
+    }
+
     /**
      * Returns true if this command should include runtime options for the CLI.
      */
@@ -80,4 +129,12 @@ public void setPicocli(Picocli picocli) {
         this.picocli = picocli;
     }
 
+    /**
+     * The default profile for the command, or null if the persisted profile should be checked first
+     * @return
+     */
+    protected String getDefaultProfile() {
+        return Environment.PROD_PROFILE_VALUE;
+    }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractNonServerCommand.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractNonServerCommand.java
index dcdf7d43418e..405c31578acf 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractNonServerCommand.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractNonServerCommand.java
@@ -26,19 +26,14 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
-public abstract class AbstractNonServerCommand extends AbstractStartCommand implements Runnable {
+public abstract class AbstractNonServerCommand extends AbstractStartCommand {
 
     @CommandLine.Mixin
-    OptimizedMixin optimizedMixin;
-
-    @CommandLine.Mixin
-    HelpAllMixin helpAllMixin;
+    OptimizedMixin optimizedMixin = new OptimizedMixin();
 
     @Override
-    public void run() {
-        Environment.setProfile(Environment.NON_SERVER_MODE);
-
-        super.run();
+    public String getDefaultProfile() {
+        return Environment.NON_SERVER_MODE;
     }
 
     @Override
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractStartCommand.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractStartCommand.java
index 93238084d9da..c69b1ae9f512 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractStartCommand.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractStartCommand.java
@@ -17,27 +17,111 @@
 
 package org.keycloak.quarkus.runtime.cli.command;
 
-import org.keycloak.config.OptionCategory;
-import org.keycloak.quarkus.runtime.configuration.mappers.HostnameV2PropertyMappers;
-import org.keycloak.quarkus.runtime.configuration.mappers.HttpPropertyMappers;
+import static org.keycloak.quarkus.runtime.Environment.isDevMode;
+import static org.keycloak.quarkus.runtime.Environment.isDevProfile;
+import static org.keycloak.quarkus.runtime.Environment.isRebuildCheck;
+import static org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource.parseConfigArgs;
+import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers.maskValue;
 
+import java.util.ArrayList;
 import java.util.EnumSet;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 import java.util.stream.Collectors;
 
+import org.keycloak.config.OptionCategory;
+import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.cli.Picocli;
+import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.quarkus.runtime.configuration.mappers.HostnameV2PropertyMappers;
+import org.keycloak.quarkus.runtime.configuration.mappers.HttpPropertyMappers;
+import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper;
+import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
+
 import picocli.CommandLine;
 import picocli.CommandLine.Help.Ansi;
 
-import static org.keycloak.quarkus.runtime.Environment.isDevProfile;
+public abstract class AbstractStartCommand extends AbstractCommand {
 
-public abstract class AbstractStartCommand extends AbstractCommand implements Runnable {
     public static final String OPTIMIZED_BUILD_OPTION_LONG = "--optimized";
 
     @CommandLine.Mixin
     DryRunMixin dryRunMixin = new DryRunMixin();
 
+    @CommandLine.Mixin
+    HelpAllMixin helpAllMixin;
+
+    @Override
+    protected Optional<Integer> callCommand() {
+        if (isRebuildCheck()) {
+            if (requiresReAugmentation()) {
+                runReAugmentation();
+            }
+            return Optional.of(CommandLine.ExitCode.OK);
+        }
+        return Optional.empty();
+    }
+
+    static boolean requiresReAugmentation() {
+        Map<String, String> rawPersistedProperties = Configuration.getRawPersistedProperties();
+        if (rawPersistedProperties.isEmpty()) {
+            return true; // no build yet
+        }
+        var current = Picocli.getNonPersistedBuildTimeOptions();
+
+        // everything but the optimized value must match
+        String key = Configuration.KC_OPTIMIZED;
+        Optional.ofNullable(rawPersistedProperties.get(key)).ifPresentOrElse(value -> current.put(key, value), () -> current.remove(key));
+        return !rawPersistedProperties.equals(current);
+    }
+
+    private void runReAugmentation() {
+        if(!isDevMode()) {
+            spec.commandLine().getOut().println("Changes detected in configuration. Updating the server image.");
+            if (Configuration.isOptimized()) {
+                Picocli.checkChangesInBuildOptionsDuringAutoBuild(spec.commandLine().getOut());
+            }
+        }
+
+        directBuild();
+
+        if(!isDevMode()) {
+            spec.commandLine().getOut().printf("Next time you run the server, just run:%n%n\t%s %s %s%n%n", Environment.getCommand(), String.join(" ", getSanitizedRuntimeCliOptions()), OPTIMIZED_BUILD_OPTION_LONG);
+        }
+    }
+
+    public void directBuild() {
+        Build build = new Build();
+        build.dryRunMixin = this.dryRunMixin;
+        build.setPicocli(picocli);
+        build.spec = spec;
+        build.runCommand();
+    }
+
+    /**
+     * checks the raw cli input for possible credentials / properties which should be masked,
+     * and masks them.
+     * @return a list of potentially masked properties in CLI format, e.g. `--db-password=*******`
+     * instead of the actual passwords value.
+     */
+    private static List<String> getSanitizedRuntimeCliOptions() {
+        List<String> properties = new ArrayList<>();
+
+        parseConfigArgs(ConfigArgsConfigSource.getAllCliArgs(), (key, value) -> {
+            PropertyMapper<?> mapper = PropertyMappers.getMapperByCliKey(key);
+
+            if (mapper == null || mapper.isRunTime()) {
+                properties.add(key + "=" + maskValue(value, mapper));
+            }
+        }, properties::add);
+
+        return properties;
+    }
+
     @Override
-    public void run() {
+    protected void runCommand() {
         doBeforeRun();
         validateConfig();
 
@@ -45,11 +129,18 @@ public void run() {
             picocli.getOutWriter().println(Ansi.AUTO.string(
                     "@|bold,red Running the server in development mode. DO NOT use this configuration in production.|@"));
         }
-        if (!Boolean.TRUE.equals(dryRunMixin.dryRun)) {
+        if (shouldStart() && !Boolean.TRUE.equals(dryRunMixin.dryRun)) {
             picocli.start();
         }
     }
-    
+
+    /**
+     * Controls whether the command actually starts the server
+     */
+    protected boolean shouldStart() {
+        return true;
+    }
+
     protected void doBeforeRun() {
 
     }
@@ -57,8 +148,10 @@ protected void doBeforeRun() {
     @Override
     protected void validateConfig() {
         super.validateConfig(); // we want to run the generic validation here first to check for unknown options
-        HttpPropertyMappers.validateConfig();
-        HostnameV2PropertyMappers.validateConfig();
+        if (shouldStart()) { // if not starting, we aren't accepting http requests so no validation needed
+            HttpPropertyMappers.validateConfig();
+            HostnameV2PropertyMappers.validateConfig(picocli);
+        }
     }
 
     @Override
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractUpdatesCommand.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractUpdatesCommand.java
new file mode 100644
index 000000000000..755bf9f822ca
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/AbstractUpdatesCommand.java
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.cli.command;
+
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+import java.util.ServiceLoader;
+
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.compatibility.CompatibilityMetadataProvider;
+import org.keycloak.config.ConfigProviderFactory;
+import org.keycloak.quarkus.runtime.cli.PropertyException;
+import picocli.CommandLine;
+
+public abstract class AbstractUpdatesCommand extends AbstractStartCommand {
+
+    private static final int FEATURE_DISABLED_EXIT_CODE = 4;
+
+    @CommandLine.Mixin
+    OptimizedMixin optimizedMixin = new OptimizedMixin();
+
+    @Override
+    protected boolean shouldStart() {
+        return false;
+    }
+
+    @Override
+    protected Optional<Integer> callCommand() {
+        return super.callCommand().or(() -> {
+            if (!Profile.isAnyVersionOfFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V1)) {
+                printFeatureDisabled();
+                return Optional.of(FEATURE_DISABLED_EXIT_CODE);
+            }
+            loadConfiguration();
+            printPreviewWarning();
+            validateConfig();
+            return Optional.of(executeAction());
+        });
+    }
+
+    abstract int executeAction();
+
+    static void validateFileIsNotDirectory(File file, String option) {
+        if (file.isDirectory()) {
+            throw new PropertyException("Incorrect argument %s. Path '%s' is not a valid file.".formatted(option, file.getAbsolutePath()));
+        }
+    }
+
+    private void printPreviewWarning() {
+        if (Profile.isFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V2) && (Profile.Feature.ROLLING_UPDATES_V2.getType() == Profile.Feature.Type.PREVIEW || Profile.Feature.ROLLING_UPDATES_V2.getType() == Profile.Feature.Type.EXPERIMENTAL)) {
+            picocli.error("Warning! This command is '" + Profile.Feature.ROLLING_UPDATES_V2.getType() + "' and is not recommended for use in production. It may change or be removed at a future release.");
+        }
+    }
+
+    void printFeatureDisabled() {
+        picocli.error("Unable to use this command. None of the versions of the feature '" + Profile.Feature.ROLLING_UPDATES_V1.getUnversionedKey() + "' is enabled.");
+    }
+
+    static Map<String, CompatibilityMetadataProvider> loadAllProviders() {
+        Map<String, CompatibilityMetadataProvider> providers = new HashMap<>();
+        for (var p : ServiceLoader.load(CompatibilityMetadataProvider.class)) {
+            providers.merge(p.getId(), p, (existing, current) -> {
+                if (existing.priority() == current.priority()) {
+                    throw new IllegalArgumentException("Unable to handle two providers with the same id (%s) and priority.".formatted(existing.getId()));
+                }
+                // If a user wants to replace default providers with their own.
+                return existing.priority() < current.priority() ?
+                        current :
+                        existing;
+            });
+        }
+        return providers;
+    }
+
+    private static void loadConfiguration() {
+        // Initialize config
+        var configProvider = ServiceLoader.load(ConfigProviderFactory.class)
+                .stream()
+                .findFirst()
+                .map(ServiceLoader.Provider::get)
+                .flatMap(ConfigProviderFactory::create)
+                .orElseThrow(() -> new RuntimeException("Failed to load Keycloak Configuration"));
+        Config.init(configProvider);
+    }
+
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdmin.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdmin.java
index 5c0caeab415f..0b9e5b537285 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdmin.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdmin.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.quarkus.runtime.cli.command;
 
+import org.keycloak.quarkus.runtime.cli.Picocli;
+
 import picocli.CommandLine.Command;
 import picocli.CommandLine.Option;
 import picocli.CommandLine.ScopeType;
@@ -29,7 +31,7 @@ public class BootstrapAdmin {
     public static final String HEADER = "Commands for bootstrapping admin access";
     public static final String KEYCLOAK_BOOTSTRAP_ADMIN_EXPIRATION_ENV_VAR = "KEYCLOAK_BOOTSTRAP_ADMIN_EXPIRATION";
 
-    @Option(names = { "--no-prompt" }, description = "Run non-interactive without prompting", scope = ScopeType.INHERIT)
+    @Option(arity = "0", paramLabel = Picocli.NO_PARAM_LABEL, names = { "--no-prompt" }, description = "Run non-interactive without prompting", scope = ScopeType.INHERIT)
     boolean noPrompt;
 
     /*@Option(names = {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminService.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminService.java
index 3d3c5adf8045..d330161c4b6c 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminService.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminService.java
@@ -17,8 +17,11 @@
 
 package org.keycloak.quarkus.runtime.cli.command;
 
+import java.util.EnumSet;
+
 import org.keycloak.common.util.IoUtils;
 import org.keycloak.config.BootstrapAdminOptions;
+import org.keycloak.config.OptionCategory;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
@@ -37,18 +40,18 @@ public class BootstrapAdminService extends AbstractNonServerCommand {
     public static final String HEADER = "Add an admin service account";
 
     static class ClientIdOptions {
-        @Option(names = { "--client-id" }, description = "Client id, defaults to "
+        @Option(paramLabel = "id", names = { "--client-id" }, description = "Client id, defaults to "
                 + BootstrapAdminOptions.DEFAULT_TEMP_ADMIN_SERVICE)
         String clientId;
 
-        @Option(names = { "--client-id:env" }, description = "Environment variable name for the client id")
+        @Option(paramLabel = "ID", names = { "--client-id:env" }, description = "Environment variable name for the client id")
         String cliendIdEnv;
     }
 
     @ArgGroup(exclusive = true, multiplicity = "0..1")
     ClientIdOptions clientIdOptions;
 
-    @Option(names = { "--client-secret:env" }, description = "Environment variable name for the client secret")
+    @Option(paramLabel = "SECRET", names = { "--client-secret:env" }, description = "Environment variable name for the client secret")
     String clientSecretEnv;
 
     String clientSecret;
@@ -105,4 +108,9 @@ public void onStart(QuarkusKeycloakApplication application) {
                 .createTemporaryMasterRealmAdminService(clientId, clientSecret, /* bootstrap.expiration, */ session));
     }
 
+    @Override
+    protected EnumSet<OptionCategory> excludedCategories() {
+        return EnumSet.of(OptionCategory.IMPORT, OptionCategory.EXPORT, OptionCategory.BOOTSTRAP_ADMIN);
+    }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminUser.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminUser.java
index aff5278e3c15..ed01f66a68ed 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminUser.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/BootstrapAdminUser.java
@@ -17,8 +17,11 @@
 
 package org.keycloak.quarkus.runtime.cli.command;
 
+import java.util.EnumSet;
+
 import org.keycloak.common.util.IoUtils;
 import org.keycloak.config.BootstrapAdminOptions;
+import org.keycloak.config.OptionCategory;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
@@ -37,18 +40,18 @@ public class BootstrapAdminUser extends AbstractNonServerCommand {
     public static final String HEADER = "Add an admin user with a password";
 
     static class UsernameOptions {
-        @Option(names = { "--username" }, description = "Username of admin user, defaults to "
+        @Option(paramLabel = "username", names = { "--username" }, description = "Username of admin user, defaults to "
                 + BootstrapAdminOptions.DEFAULT_TEMP_ADMIN_USERNAME)
         String username;
 
-        @Option(names = { "--username:env" }, description = "Environment variable name for the admin username")
+        @Option(paramLabel = "USERNAME", names = { "--username:env" }, description = "Environment variable name for the admin username")
         String usernameEnv;
     }
 
     @ArgGroup(exclusive = true, multiplicity = "0..1")
     UsernameOptions usernameOptions;
 
-    @Option(names = { "--password:env" }, description = "Environment variable name for the admin user password")
+    @Option(paramLabel = "PASSWORD", names = { "--password:env" }, description = "Environment variable name for the admin user password")
     String passwordEnv;
 
     String password;
@@ -105,4 +108,9 @@ public void onStart(QuarkusKeycloakApplication application) {
                 .createTemporaryMasterRealmAdminUser(username, password, /* bootstrap.expiration, */ session));
     }
 
+    @Override
+    protected EnumSet<OptionCategory> excludedCategories() {
+        return EnumSet.of(OptionCategory.IMPORT, OptionCategory.EXPORT, OptionCategory.BOOTSTRAP_ADMIN);
+    }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Build.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Build.java
index b5334a9ef82b..c013ac89b93b 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Build.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Build.java
@@ -21,7 +21,6 @@
 import static org.keycloak.config.DatabaseOptions.DB;
 import static org.keycloak.quarkus.runtime.Environment.getHomePath;
 import static org.keycloak.quarkus.runtime.Environment.isDevProfile;
-import static org.keycloak.quarkus.runtime.cli.Picocli.println;
 
 import io.quarkus.runtime.LaunchMode;
 
@@ -58,7 +57,7 @@
                 + "      $ ${PARENT-COMMAND-FULL-NAME:-$PARENTCOMMAND} ${COMMAND-NAME} --metrics-enabled=true%n%n"
                 + "  Change the relative path:%n%n"
                 + "      $ ${PARENT-COMMAND-FULL-NAME:-$PARENTCOMMAND} ${COMMAND-NAME} --http-relative-path=/auth%n")
-public final class Build extends AbstractCommand implements Runnable {
+public final class Build extends AbstractCommand {
 
     public static final String NAME = "build";
 
@@ -69,19 +68,17 @@ public final class Build extends AbstractCommand implements Runnable {
     DryRunMixin dryRunMixin;
 
     @Override
-    public void run() {
-        if (org.keycloak.common.util.Environment.getProfile() == null) {
-            Environment.setProfile(Environment.PROD_PROFILE_VALUE);
-        }
+    protected void runCommand() {
         checkProfileAndDb();
 
-        System.setProperty("quarkus.launch.rebuild", "true");
+        // validate before setting that we're rebuilding so that runtime options are still seen
         PersistedConfigSource.getInstance().runWithDisabled(() -> {
             validateConfig();
             return null;
         });
+        System.setProperty("quarkus.launch.rebuild", "true");
 
-        println(spec.commandLine(), "Updating the configuration and installing your custom providers, if any. Please wait.");
+        picocli.println("Updating the configuration and installing your custom providers, if any. Please wait.");
 
         try {
             configureBuildClassLoader();
@@ -94,8 +91,8 @@ public void run() {
             }
 
             if (!isDevProfile()) {
-                println(spec.commandLine(), "Server configuration updated and persisted. Run the following command to review the configuration:\n");
-                println(spec.commandLine(), "\t" + Environment.getCommand() + " show-config\n");
+                picocli.println("Server configuration updated and persisted. Run the following command to review the configuration:\n");
+                picocli.println("\t" + Environment.getCommand() + " show-config\n");
             }
         } catch (Throwable throwable) {
             executionError(spec.commandLine(), "Failed to update server configuration.", throwable);
@@ -118,7 +115,7 @@ public boolean includeBuildTime() {
 
     private void checkProfileAndDb() {
         if (Environment.isDevProfile()) {
-            String cmd = Environment.getParsedCommand().map(AbstractCommand::getName).orElse(getName());
+            String cmd = picocli.getParsedCommand().map(AbstractCommand::getName).orElse(getName());
             // we allow start-dev, and import|export|bootstrap-admin --profile=dev
             // but not start --profile=dev, nor build --profile=dev
             if (Start.NAME.equals(cmd) || Build.NAME.equals(cmd)) {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Export.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Export.java
index 9bf397c9b4a9..7264af3f17fd 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Export.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Export.java
@@ -29,7 +29,7 @@
 @Command(name = Export.NAME,
         header = "Export data from realms to a file or directory.",
         description = "%nExport data from realms to a file or directory.")
-public final class Export extends AbstractNonServerCommand implements Runnable {
+public final class Export extends AbstractNonServerCommand {
 
     public static final String NAME = "export";
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Import.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Import.java
index cc606a06b9ef..e1a6b53301e0 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Import.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Import.java
@@ -29,7 +29,7 @@
 @Command(name = Import.NAME,
         header = "Import data from a directory or a file.",
         description = "%nImport data from a directory or a file.")
-public final class Import extends AbstractNonServerCommand implements Runnable {
+public final class Import extends AbstractNonServerCommand {
 
     public static final String NAME = "import";
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Main.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Main.java
index 861f9dff0abc..4879695a7a76 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Main.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Main.java
@@ -67,7 +67,8 @@
                 Import.class,
                 ShowConfig.class,
                 Tools.class,
-                BootstrapAdmin.class
+                BootstrapAdmin.class,
+                UpdateCompatibility.class
         })
 public final class Main {
 
@@ -111,4 +112,4 @@ public void setConfigFile(String path) {
         }
         System.setProperty(KeycloakPropertiesConfigSource.KEYCLOAK_CONFIG_FILE_PROP, path);
     }
-}
\ No newline at end of file
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/ShowConfig.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/ShowConfig.java
index ebb17a648504..c69e9232ba6a 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/ShowConfig.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/ShowConfig.java
@@ -21,11 +21,10 @@
 import static org.keycloak.quarkus.runtime.configuration.Configuration.getPropertyNames;
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers.maskValue;
 
+import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
-import java.util.stream.Collectors;
 import java.util.stream.StreamSupport;
 
 import org.keycloak.quarkus.runtime.Environment;
@@ -42,7 +41,7 @@
 @Command(name = "show-config",
         header = "Print out the current configuration.",
         description = "%nPrint out the current configuration.")
-public final class ShowConfig extends AbstractCommand implements Runnable {
+public final class ShowConfig extends AbstractCommand {
 
     public static final String NAME = "show-config";
     private static final List<String> allowedSystemPropertyKeys = List.of(
@@ -55,83 +54,82 @@ public final class ShowConfig extends AbstractCommand implements Runnable {
     String filter;
 
     @Override
-    public void run() {
-        String profile = Environment.updateProfile(true);
-
-        Map<String, Set<String>> properties = getPropertiesByGroup();
-        printRunTimeConfig(properties, profile);
-
-        if (filter.equalsIgnoreCase("all")) {
-            spec.commandLine().getOut().println("Quarkus Configuration:");
-            properties.get(MicroProfileConfigProvider.NS_QUARKUS).stream().sorted()
-                    .forEachOrdered(this::printProperty);
-        }
-
-        Quarkus.asyncExit(0);
+    public String getDefaultProfile() {
+        return null;
     }
 
-    private void printRunTimeConfig(Map<String, Set<String>> properties, String profile) {
-        Set<String> uniqueNames = new HashSet<>();
+    @Override
+    protected void runCommand() {
+        String profile = org.keycloak.common.util.Environment.getProfile();
 
         spec.commandLine().getOut().printf("Current Mode: %s%n", Environment.getKeycloakModeFromProfile(profile));
 
         spec.commandLine().getOut().println("Current Configuration:");
 
-        properties.get(MicroProfileConfigProvider.NS_KEYCLOAK).stream().sorted()
-                .filter(uniqueNames::add)
-                .forEachOrdered(this::printProperty);
-    }
-
-    private static Map<String, Set<String>> getPropertiesByGroup() {
-        Map<String, Set<String>> properties = StreamSupport
-                .stream(getPropertyNames().spliterator(), false)
-                .filter(ShowConfig::filterByGroup)
-                .collect(Collectors.groupingBy(ShowConfig::groupProperties, Collectors.toSet()));
-
-        return properties;
-    }
-
-    private void printProperty(String property) {
-        ConfigValue configValue = getConfigValue(property);
-
-        if (configValue.getValue() == null) {
-            return;
-        }
-
-        if (configValue.getSourceName() == null) {
-            return;
-        }
-
-        String value = configValue.getRawValue();
-
-        if (value == null) {
-            value = configValue.getValue();
-        }
-
-        PropertyMapper<?> mapper = PropertyMappers.getMapper(property);
+        Set<String> uniqueNames = new HashSet<>();
+        List<ConfigValue> quarkusValues = new ArrayList<ConfigValue>();
+        StreamSupport.stream(getPropertyNames().spliterator(), false).forEachOrdered(property -> {
+            ConfigValue configValue = getConfigValue(property);
+
+            if (configValue.getValue() == null) {
+                return;
+            }
+
+            if (configValue.getSourceName() == null) {
+                return;
+            }
+
+            PropertyMapper<?> mapper = PropertyMappers.getMapper(property);
+
+            if (mapper == null && configValue.getSourceName().equals("SysPropConfigSource") && !allowedSystemPropertyKeys.contains(property)) {
+                return; // most system properties are internally used, and not relevant during show-config
+            }
+
+            if (mapper != null) {
+                String from = mapper.forKey(property).getFrom();
+
+                // only report from when it exists
+                if (!property.equals(from)) {
+                    ConfigValue value = getConfigValue(from);
+                    if (value.getValue() != null) {
+                        return;
+                    }
+                    configValue = value;
+                    property = from;
+                }
+            }
+
+            if (!uniqueNames.add(property)) {
+                return;
+            }
+
+            if (property.startsWith(MicroProfileConfigProvider.NS_QUARKUS_PREFIX)) {
+                if (mapper == null) {
+                    quarkusValues.add(configValue);
+                    return;
+                }
+            } else if (!property.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX)) {
+                return;
+            }
+
+            printProperty(property, mapper, configValue);
+        });
 
-        if (mapper == null && configValue.getSourceName().equals("SysPropConfigSource") && !allowedSystemPropertyKeys.contains(property)) {
-            return; // most system properties are internally used, and not relevant during show-config
+        if (filter.equalsIgnoreCase("all")) {
+            spec.commandLine().getOut().println("Quarkus Configuration:");
+            quarkusValues.forEach(v -> printProperty(v.getName(), null, v));
         }
 
-        value = maskValue(configValue.getName(), value, configValue.getConfigSourceName());
-
-        spec.commandLine().getOut().printf("\t%s =  %s (%s)%n", configValue.getName(), value, KeycloakConfigSourceProvider.getConfigSourceDisplayName(configValue.getConfigSourceName()));
+        Quarkus.asyncExit(0);
     }
 
-    private static String groupProperties(String property) {
-        int endIndex = property.indexOf('.');
+    private void printProperty(String property, PropertyMapper<?> mapper, ConfigValue configValue) {
+        String sourceName = configValue.getConfigSourceName();
+        String value = configValue.getValue();
 
-        if (endIndex == -1) {
-            return "";
-        }
-
-        return property.substring(0, endIndex);
-    }
+        value = maskValue(value, sourceName, mapper);
 
-    private static boolean filterByGroup(String property) {
-        return property.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX)
-                || property.startsWith(MicroProfileConfigProvider.NS_QUARKUS_PREFIX);
+        spec.commandLine().getOut().printf("\t%s =  %s (%s)%n", property, value, KeycloakConfigSourceProvider.getConfigSourceDisplayName(sourceName));
     }
 
     @Override
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Start.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Start.java
index 3221d26dcae8..a6f7b67da573 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Start.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/Start.java
@@ -24,7 +24,6 @@
 import org.keycloak.common.profile.ProfileException;
 import org.keycloak.quarkus.runtime.cli.Picocli;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 
 import picocli.CommandLine;
 import picocli.CommandLine.Command;
@@ -37,7 +36,7 @@
         footer = "%nBy default, this command tries to update the server configuration by running a '" + Build.NAME + "' before starting the server. You can disable this behavior by using the '" + OPTIMIZED_BUILD_OPTION_LONG + "' option:%n%n"
                 + "      $ ${PARENT-COMMAND-FULL-NAME:-$PARENTCOMMAND} ${COMMAND-NAME} '" + OPTIMIZED_BUILD_OPTION_LONG + "'%n%n"
                 + "By doing that, the server should start faster based on any previous configuration you have set when manually running the '" + Build.NAME + "' command.")
-public final class Start extends AbstractStartCommand implements Runnable {
+public final class Start extends AbstractStartCommand {
 
     public static final String NAME = "start";
 
@@ -47,12 +46,8 @@ public final class Start extends AbstractStartCommand implements Runnable {
     @CommandLine.Mixin
     ImportRealmMixin importRealmMixin;
 
-    @CommandLine.Mixin
-    HelpAllMixin helpAllMixin;
-
     @Override
     protected void doBeforeRun() {
-        Environment.updateProfile(true);
         if (Environment.isDevProfile()) {
             throw new PropertyException(Messages.devProfileNotAllowedError(NAME));
         }
@@ -71,12 +66,11 @@ public String getName() {
     public static void fastStart(Picocli picocli, boolean dryRun) {
         try {
             Start start = new Start();
-            Environment.setParsedCommand(start);
-            PropertyMappers.sanitizeDisabledMappers();
             start.optimizedMixin.optimized = true;
             start.dryRunMixin.dryRun = dryRun;
             start.setPicocli(picocli);
-            start.run();
+            picocli.initConfig(start);
+            picocli.exit(start.call());
         } catch (PropertyException | ProfileException e) {
             picocli.usageException(e.getMessage(), e.getCause());
         }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/StartDev.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/StartDev.java
index 60af84ae1da7..0a2fee46a9a2 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/StartDev.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/StartDev.java
@@ -17,11 +17,10 @@
 
 package org.keycloak.quarkus.runtime.cli.command;
 
-import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.common.util.Environment;
 
 import picocli.CommandLine;
 import picocli.CommandLine.Command;
-import picocli.CommandLine.Mixin;
 
 @Command(name = StartDev.NAME,
         header = "Start the server in development mode.",
@@ -30,19 +29,21 @@
         },
         footer = "%nDo NOT start the server using this command when deploying to production.%n%n"
                 + "Use '${PARENT-COMMAND-FULL-NAME:-$PARENTCOMMAND} ${COMMAND-NAME} --help-all' to list all available options, including build options.")
-public final class StartDev extends AbstractStartCommand implements Runnable {
+public final class StartDev extends AbstractStartCommand {
 
     public static final String NAME = "start-dev";
 
-    @Mixin
-    HelpAllMixin helpAllMixin;
-
     @CommandLine.Mixin
     ImportRealmMixin importRealmMixin;
 
     @Override
-    protected void doBeforeRun() {
-        Environment.forceDevProfile();
+    public String getInitProfile() {
+        return Environment.DEV_PROFILE_VALUE; // only ever dev - could be a validation instead
+    }
+
+    @Override
+    public String getDefaultProfile() {
+        return Environment.DEV_PROFILE_VALUE;
     }
 
     @Override
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibility.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibility.java
new file mode 100644
index 000000000000..ea00967a1c24
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibility.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.cli.command;
+
+import picocli.CommandLine;
+
+@CommandLine.Command(
+        name = UpdateCompatibility.NAME,
+        description = "[Preview] Tool for configuration compatibility.",
+        subcommands = {
+                UpdateCompatibilityCheck.class,
+                UpdateCompatibilityMetadata.class
+        })
+public final class UpdateCompatibility {
+
+    public static final String NAME = "update-compatibility";
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityCheck.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityCheck.java
new file mode 100644
index 000000000000..853fdbae22bb
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityCheck.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.cli.command;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import java.io.File;
+import java.io.IOException;
+import java.util.Map;
+import org.keycloak.compatibility.CompatibilityResult;
+import org.keycloak.compatibility.Util;
+import org.keycloak.quarkus.runtime.cli.PropertyException;
+import org.keycloak.util.JsonSerialization;
+import picocli.CommandLine;
+
+@CommandLine.Command(
+        name = UpdateCompatibilityCheck.NAME,
+        description = "Checks if the metadata is compatible with the current configuration. A zero exit code means a rolling update is possible between old and the current metadata."
+)
+public class UpdateCompatibilityCheck extends AbstractUpdatesCommand {
+
+    public static final String NAME = "check";
+    public static final String INPUT_OPTION_NAME = "--file";
+    public static final TypeReference<Map<String, Map<String, String>>> METADATA_TYPE_REF = new TypeReference<>() {
+    };
+
+
+    @CommandLine.Option(names = {INPUT_OPTION_NAME}, paramLabel = "FILE",
+            description = "The file path to read the metadata.")
+    String inputFile;
+
+    @Override
+    int executeAction() {
+        var info = readServerInfo();
+        var providers = loadAllProviders();
+        var idIterator = Util.mergeKeySet(info, providers)
+                .sorted()
+                .iterator();
+
+        while (idIterator.hasNext()) {
+            var id = idIterator.next();
+            var provider = providers.get(id);
+            if (provider == null) {
+                picocli.error("[%s] Provider not found. Rolling Update is not available.".formatted(id));
+                return CompatibilityResult.ExitCode.RECREATE.value();
+            }
+
+            var result = provider.isCompatible(Map.copyOf(info.getOrDefault(id, Map.of())));
+            result.endMessage().ifPresent(picocli.getOutWriter()::println);
+
+            if (Util.isNotCompatible(result)) {
+                result.errorMessage().ifPresent(picocli::error);
+                return result.exitCode();
+            }
+        }
+
+        picocli.getOutWriter().println("[OK] Rolling Update is available.");
+        return CompatibilityResult.ExitCode.ROLLING.value();
+    }
+
+    @Override
+    public String getName() {
+        return NAME;
+    }
+
+    @Override
+    public boolean includeRuntime() {
+        return true;
+    }
+
+    @Override
+    protected void validateConfig() {
+        super.validateConfig();
+        validateFileParameter();
+    }
+
+    private void validateFileParameter() {
+        if (inputFile == null || inputFile.isBlank()) {
+            throw new PropertyException("Missing required argument: " + INPUT_OPTION_NAME);
+        }
+        var file = new File(inputFile);
+        if (!file.exists()) {
+            throw new PropertyException("Incorrect argument %s. Path '%s' not found".formatted(INPUT_OPTION_NAME, file.getAbsolutePath()));
+        }
+        validateFileIsNotDirectory(file, INPUT_OPTION_NAME);
+    }
+
+    private Map<String, Map<String, String>> readServerInfo() {
+        var file = new File(inputFile);
+        try {
+            return JsonSerialization.mapper.readValue(file, METADATA_TYPE_REF);
+        } catch (IOException e) {
+            throw new PropertyException("Unable to read file '%s'".formatted(file.getAbsolutePath()), e);
+        }
+    }
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityMetadata.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityMetadata.java
new file mode 100644
index 000000000000..4d88b203f7db
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/cli/command/UpdateCompatibilityMetadata.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.cli.command;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import java.io.File;
+import java.io.IOException;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.keycloak.compatibility.CompatibilityMetadataProvider;
+import org.keycloak.quarkus.runtime.cli.PropertyException;
+import org.keycloak.util.JsonSerialization;
+import picocli.CommandLine;
+
+@CommandLine.Command(
+        name = UpdateCompatibilityMetadata.NAME,
+        description = "Stores the metadata necessary to determine if a configuration is compatible."
+)
+public class UpdateCompatibilityMetadata extends AbstractUpdatesCommand {
+
+    public static final String NAME = "metadata";
+    public static final String OUTPUT_OPTION_NAME = "--file";
+
+    @CommandLine.Option(names = {OUTPUT_OPTION_NAME}, paramLabel = "FILE",
+            description = "The file path to store the metadata. It is stored in the JSON format.")
+    String outputFile;
+
+    @Override
+    int executeAction() {
+        var metadata = loadAllProviders()
+                .values()
+                .stream()
+                .map(Entry::new)
+                .filter(Entry::hasMetadata)
+                .collect(Collectors.toMap(Entry::id, Entry::metadata));
+        printToConsole(metadata);
+        writeToFile(metadata);
+        return 0;
+    }
+
+    @Override
+    public String getName() {
+        return NAME;
+    }
+
+    @Override
+    public boolean includeRuntime() {
+        return true;
+    }
+
+    @Override
+    protected void validateConfig() {
+        super.validateConfig();
+        validateFileParameter();
+    }
+
+    private void validateFileParameter() {
+        if (noOutputFileSet()) {
+            return;
+        }
+        var file = new File(outputFile);
+        if (file.getParentFile() != null && !file.getParentFile().exists() && !file.getParentFile().mkdirs()) {
+            throw new PropertyException("Incorrect argument %s. Unable to create parent directory: %s".formatted(OUTPUT_OPTION_NAME, file.getParentFile().getAbsolutePath()));
+        }
+        validateFileIsNotDirectory(file, OUTPUT_OPTION_NAME);
+    }
+
+    private void printToConsole(Map<String, Map<String, String>> metadata) {
+        try {
+            var json = JsonSerialization.mapper.writerWithDefaultPrettyPrinter().writeValueAsString(metadata);
+            picocli.getOutWriter().println("Metadata:%n%s".formatted(json));
+        } catch (JsonProcessingException e) {
+            throw new PropertyException("Unable to create JSON representation of the metadata", e);
+        }
+    }
+
+    private void writeToFile(Map<String, Map<String, String>> metadata) {
+        if (noOutputFileSet()) {
+            return;
+        }
+        var file = new File(outputFile);
+        try {
+            JsonSerialization.mapper.writeValue(file, metadata);
+        } catch (IOException e) {
+            throw new PropertyException("Unable to write file '%s'".formatted(file.getAbsolutePath()), e);
+        }
+    }
+
+    private boolean noOutputFileSet() {
+        return outputFile == null || outputFile.isBlank();
+    }
+
+    private record Entry(String id, Map<String, String> metadata) {
+
+        Entry(CompatibilityMetadataProvider provider) {
+            this(provider.getId(), provider.metadata());
+        }
+
+        boolean hasMetadata() {
+            return !metadata().isEmpty();
+        }
+    }
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/ConfigArgsConfigSource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/ConfigArgsConfigSource.java
index 8832a69eab7c..cec554a59d85 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/ConfigArgsConfigSource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/ConfigArgsConfigSource.java
@@ -18,8 +18,6 @@
 package org.keycloak.quarkus.runtime.configuration;
 
 import static org.keycloak.quarkus.runtime.cli.Picocli.ARG_SHORT_PREFIX;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR_CHAR;
-import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -33,7 +31,6 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import io.smallrye.config.ConfigValue;
 import io.smallrye.config.PropertiesConfigSource;
 
 import org.keycloak.quarkus.runtime.cli.command.Main;
@@ -77,7 +74,7 @@ public static List<String> getAllCliArgs() {
         if(args == null) {
             return Collections.emptyList();
         }
-        
+
         List<String> result = new ArrayList<String>();
         boolean escaped = false;
         StringBuilder arg = new StringBuilder();
@@ -101,19 +98,8 @@ public static List<String> getAllCliArgs() {
             }
         }
         result.add(arg.toString());
-        
-        return result;
-    }
-
-    @Override
-    public ConfigValue getConfigValue(String propertyName) {
-        ConfigValue value = super.getConfigValue(propertyName);
 
-        if (value != null) {
-            return value;
-        }
-
-        return super.getConfigValue(propertyName.replace(OPTION_PART_SEPARATOR_CHAR, '.'));
+        return result;
     }
 
     private static Map<String, String> parseArguments() {
@@ -122,23 +108,9 @@ private static Map<String, String> parseArguments() {
         parseConfigArgs(getAllCliArgs(), new BiConsumer<String, String>() {
             @Override
             public void accept(String key, String value) {
-                key = NS_KEYCLOAK_PREFIX + key.substring(2);
-
-                properties.put(key, value);
-
-                PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
-
-                if (mapper != null) {
-                    mapper = mapper.forKey(key);
-
-                    String to = mapper.getTo();
-
-                    if (to != null) {
-                        properties.put(mapper.getTo(), value);
-                    }
-
-                    properties.put(mapper.getFrom(), value);
-                }
+                PropertyMappers.getKcKeyFromCliKey(key).ifPresent(s -> {
+                    properties.put(s, value);
+                });
             }
         }, ignored -> {});
 
@@ -164,10 +136,10 @@ public static void parseConfigArgs(List<String> args, BiConsumer<String, String>
                     unaryConsumer.accept(arg);
                     continue;
                 }
-                PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
+                PropertyMapper<?> mapper = PropertyMappers.getMapperByCliKey(key);
                 // the weaknesses here:
                 // - needs to know all of the short name options that accept a value
-                // - does not know all of the picocli parsing rules. picocli will accept -cffile, and short option grouping - that's not accounted for
+                // - Even though We've explicitly disabled PosixClusteredShortOptionsAllowed, it may not know all of the picocli parsing rules.
                 if (mapper != null || SHORT_OPTIONS_ACCEPTING_VALUE.contains(key) || arg.startsWith(SPI_OPTION_PREFIX)) {
                     i++; // consume next as a value to the key
                     value = args.get(i);
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/Configuration.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/Configuration.java
index 071973da28f2..86b6c00eb481 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/Configuration.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/Configuration.java
@@ -23,13 +23,11 @@
 import java.util.Optional;
 import java.util.Properties;
 
+import io.quarkus.runtime.configuration.ConfigUtils;
 import io.smallrye.config.ConfigValue;
 import io.smallrye.config.SmallRyeConfig;
 
-import org.eclipse.microprofile.config.spi.ConfigProviderResolver;
 import org.keycloak.config.Option;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 import org.keycloak.utils.StringUtil;
 
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
@@ -43,6 +41,8 @@ public final class Configuration {
     public static final String OPTION_PART_SEPARATOR = String.valueOf(OPTION_PART_SEPARATOR_CHAR);
     public static final String KC_OPTIMIZED = NS_KEYCLOAK_PREFIX + "optimized";
 
+    private static SmallRyeConfig config;
+
     private Configuration() {
 
     }
@@ -51,10 +51,26 @@ public static boolean isTrue(Option<Boolean> option) {
         return getOptionalBooleanValue(NS_KEYCLOAK_PREFIX + option.getKey()).orElse(false);
     }
 
+    public static boolean isUserModifiable(ConfigValue configValue) {
+        // This could check as low as SysPropConfigSource DEFAULT_ORDINAL, which is 400
+        // for now we won't validate these as it's not expected for the user to specify options via system properties
+        return configValue.getConfigSourceOrdinal() >= KeycloakPropertiesConfigSource.PROPERTIES_FILE_ORDINAL;
+    }
+
+    public static boolean isSet(Option<?> option) {
+        return Optional.ofNullable(getKcConfigValue(option.getKey()))
+                .filter(Configuration::isUserModifiable)
+                .isPresent();
+    }
+
     public static boolean isTrue(String propertyName) {
         return getOptionalBooleanValue(propertyName).orElse(false);
     }
 
+    public static boolean isKcPropertyTrue(String propertyName) {
+        return getOptionalBooleanKcValue(propertyName).orElse(false);
+    }
+
     public static boolean isBlank(Option<?> option) {
         return getOptionalKcValue(option.getKey())
                 .map(StringUtil::isBlank)
@@ -73,8 +89,19 @@ public static boolean equals(Option<?> option, String value) {
                 .isPresent();
     }
 
+    public static boolean isInitialized() {
+        return config != null;
+    }
+
     public static synchronized SmallRyeConfig getConfig() {
-        return (SmallRyeConfig) ConfigProviderResolver.instance().getConfig();
+        if (config == null) {
+            config = ConfigUtils.emptyConfigBuilder().addDiscoveredSources().build();
+        }
+        return config;
+    }
+
+    public static void resetConfig() {
+        config = null;
     }
 
     /**
@@ -88,10 +115,6 @@ public static Map<String, String> getRawPersistedProperties() {
         return PersistedConfigSource.getInstance().getProperties();
     }
 
-    public static String getRawValue(String propertyName) {
-        return getConfig().getRawValue(propertyName);
-    }
-
     public static Iterable<String> getPropertyNames() {
         return getPropertyNames(false);
     }
@@ -136,15 +159,12 @@ public static Optional<Boolean> getOptionalBooleanValue(String name) {
         return getOptionalValue(name).map(Boolean::parseBoolean);
     }
 
-    public static String getMappedPropertyName(String key) {
-        PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
-
-        if (mapper == null) {
-            return key;
-        }
+    public static Optional<Integer> getOptionalIntegerValue(Option<Integer> option) {
+        return getOptionalIntegerValue(option.getKey());
+    }
 
-        // we also need to make sure the target property is available when defined such as when defining alias for provider config (no spi-prefix).
-        return mapper.getTo() == null ? mapper.getFrom() : mapper.getTo();
+    public static Optional<Integer> getOptionalIntegerValue(String propertyName) {
+        return getConfig().getOptionalValue(NS_KEYCLOAK_PREFIX.concat(propertyName), Integer.class);
     }
 
     public static String toEnvVarFormat(String key) {
@@ -156,11 +176,17 @@ public static String toCliFormat(String key) {
     }
 
     public static String toDashCase(String key) {
+        if (key == null) {
+            return null;
+        }
         StringBuilder sb = new StringBuilder(key.length());
         boolean l = false;
 
         for (int i = 0; i < key.length(); i++) {
             char c = key.charAt(i);
+            if (c == ',') {
+                c = '-'; // should not happen, but was allowed by the previous logic
+            }
             if (l && Character.isUpperCase(c)) {
                 sb.append('-');
                 c = Character.toLowerCase(c);
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifacts.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifacts.java
index dbc49654e721..8cd34b2d39ae 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifacts.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifacts.java
@@ -16,21 +16,19 @@
  */
 package org.keycloak.quarkus.runtime.configuration;
 
-import org.keycloak.common.Profile;
-import org.keycloak.config.database.Database;
+import static java.util.Collections.emptySet;
+import static org.keycloak.quarkus.runtime.Environment.getCurrentOrCreateFeatureProfile;
 
 import java.util.Collection;
 import java.util.HashSet;
-
-import org.keycloak.config.HealthOptions;
-import org.keycloak.config.MetricsOptions;
-
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import static java.util.Collections.emptySet;
-import static org.keycloak.quarkus.runtime.Environment.getCurrentOrCreateFeatureProfile;
+import org.keycloak.common.Profile;
+import org.keycloak.config.HealthOptions;
+import org.keycloak.config.MetricsOptions;
+import org.keycloak.config.database.Database;
 
 /**
  * Ignore particular artifacts based on build configuration
@@ -75,7 +73,8 @@ private static Set<String> fips() {
     public static final Set<String> JDBC_H2 = Set.of(
             "io.quarkus:quarkus-jdbc-h2",
             "io.quarkus:quarkus-jdbc-h2-deployment",
-            "com.h2database:h2"
+            "com.h2database:h2",
+            "org.locationtech.jts:jts-core"
     );
 
     public static final Set<String> JDBC_POSTGRES = Set.of(
@@ -105,7 +104,7 @@ private static Set<String> fips() {
     public static final Set<String> JDBC_ORACLE = Set.of(
             "io.quarkus:quarkus-jdbc-oracle",
             "io.quarkus:quarkus-jdbc-oracle-deployment",
-            "com.oracle.database.jdbc:ojdbc11",
+            "com.oracle.database.jdbc:ojdbc17",
             "com.oracle.database.nls:orai18n"
     );
 
@@ -131,10 +130,6 @@ private static Set<String> jdbcDrivers() {
             }
         });
 
-        if (vendorsOfAllDatasources.isEmpty()) {
-            vendorsOfAllDatasources.add(Database.Vendor.H2);
-        }
-
         final Set<String> jdbcArtifacts = vendorsOfAllDatasources.stream()
                 .map(vendor -> switch (vendor) {
                     case H2 -> JDBC_H2;
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcEnvConfigSource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcEnvConfigSource.java
index 4aa0799931b6..dee5d5828750 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcEnvConfigSource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcEnvConfigSource.java
@@ -20,12 +20,18 @@
 import static io.smallrye.config.common.utils.StringUtil.replaceNonAlphanumericByUnderscores;
 import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
 
+import java.util.Collection;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
-import io.smallrye.config.PropertiesConfigSource;
+import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
+import org.keycloak.quarkus.runtime.configuration.mappers.WildcardPropertyMapper;
+
+import io.smallrye.config.EnvConfigSource;
+import io.smallrye.config.PropertiesConfigSource;
 
 // Not extending EnvConfigSource as it's too smart for our own good. It does unnecessary mapping of provided keys
 // leading to e.g. duplicate entries (like kc.db-password and kc.db.password), or incorrectly handling getters due to
@@ -33,47 +39,62 @@
 public class KcEnvConfigSource extends PropertiesConfigSource {
 
     public static final String NAME = "KcEnvVarConfigSource";
+    public static final String KCKEY_PREFIX = "KCKEY_";
 
-    public KcEnvConfigSource() {
-        super(buildProperties(), NAME, 500);
+    static final Map<String, String> ENV_OVERRIDE = new HashMap<String, String>();
+
+    public KcEnvConfigSource(Map<String, String> env) {
+        super(buildProperties(env), NAME, 500);
     }
 
-    private static Map<String, String> buildProperties() {
+    private static Map<String, String> buildProperties(Map<String, String> env) {
         Map<String, String> properties = new HashMap<>();
         String kcPrefix = replaceNonAlphanumericByUnderscores(NS_KEYCLOAK_PREFIX.toUpperCase());
 
-        for (Map.Entry<String, String> entry : System.getenv().entrySet()) {
+        for (Map.Entry<String, String> entry : env.entrySet()) {
             String key = entry.getKey();
             String value = entry.getValue();
+            String transformedKey = null;
 
-            if (key.startsWith(kcPrefix)) {
-                PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
+            if (!key.startsWith(kcPrefix)) {
+                continue;
+            }
+            String baseKey = key.substring(kcPrefix.length());
 
-                if (mapper != null) {
-                    mapper = mapper.forEnvKey(key);
+            String actualKey = env.get(KCKEY_PREFIX + baseKey);
+            if (actualKey != null) {
+                // use the explicit mapping
+                transformedKey = NS_KEYCLOAK_PREFIX + actualKey;
+            } else {
+                // determine the mapping by convention / wildcard handling
+                transformedKey = NS_KEYCLOAK_PREFIX + baseKey.toLowerCase().replace("_", "-");
 
-                    String to = mapper.getTo();
+                PropertyMapper<?> mapper = PropertyMappers.getMapper(transformedKey);
 
-                    if (to != null) {
-                        properties.put(to, value);
-                    }
+                if (mapper != null && mapper.hasWildcard()) {
+                    // special case - wildcards don't follow the default conversion rule
+                    WildcardPropertyMapper<?> wildcardPropertyMapper = (WildcardPropertyMapper<?>) mapper;
 
-                    properties.put(mapper.getFrom(), value);
-                }
-                else {
-                    // most probably an SPI but could be also something else
-                    String transformedKey = NS_KEYCLOAK_PREFIX + key.substring(kcPrefix.length()).toLowerCase().replace("_", "-");
-                    properties.put(transformedKey, value);
+                    transformedKey = wildcardPropertyMapper.getKcKeyForEnvKey(key, transformedKey)
+                            .orElseThrow();
                 }
             }
+            properties.put(transformedKey, value);
         }
 
         return properties;
     }
 
-    @Override
-    // a workaround for https://github.com/smallrye/smallrye-config/issues/1207
-    public String getName() {
-        return NAME;
+    public static Collection<ConfigSource> getConfigSources() {
+        Map<String, String> env = System.getenv();
+
+        if (ENV_OVERRIDE.isEmpty()) {
+            return List.of(new KcEnvConfigSource(env));
+        }
+
+        env = new HashMap<String, String>(env);
+        env.putAll(ENV_OVERRIDE);
+
+        return List.of(new KcEnvConfigSource(env), new EnvConfigSource(ENV_OVERRIDE, EnvConfigSource.ORDINAL + 1));
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcUnmatchedArgumentException.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcUnmatchedArgumentException.java
index 21266b9f49ff..f7b0dc77b3b4 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcUnmatchedArgumentException.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KcUnmatchedArgumentException.java
@@ -40,6 +40,9 @@ public KcUnmatchedArgumentException(CommandLine.UnmatchedArgumentException ex) {
     @Override
     public List<String> getSuggestions() {
         // filter out disabled mappers
-        return super.getSuggestions().stream().filter(f -> !PropertyMappers.isDisabledMapper(f) && !f.endsWith(DUPLICIT_OPTION_SUFFIX)).toList();
+        return super.getSuggestions().stream()
+                .filter(f -> PropertyMappers.getKcKeyFromCliKey(f).filter(PropertyMappers::isDisabledMapper).isEmpty()
+                        && !f.endsWith(DUPLICIT_OPTION_SUFFIX))
+                .toList();
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakConfigSourceProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakConfigSourceProvider.java
index 516f86d36ace..869f0fadef78 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakConfigSourceProvider.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakConfigSourceProvider.java
@@ -17,7 +17,6 @@
 
 package org.keycloak.quarkus.runtime.configuration;
 
-
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -29,16 +28,16 @@
 import io.smallrye.config.SmallRyeConfigBuilder;
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.eclipse.microprofile.config.spi.ConfigSourceProvider;
-import org.keycloak.quarkus.runtime.Environment;
 
 public class KeycloakConfigSourceProvider implements ConfigSourceProvider, ConfigBuilder {
 
     private static final List<ConfigSource> CONFIG_SOURCES = new ArrayList<>();
     private static final Map<String, String> CONFIG_SOURCE_DISPLAY_NAMES = new HashMap<>();
 
-    // we initialize in a static block to avoid discovering the config sources multiple times when starting the application
-    static {
-        initializeSources();
+    public KeycloakConfigSourceProvider() {
+        if (CONFIG_SOURCES.isEmpty()) {
+            initializeSources();
+        }
     }
 
     private static void initializeSources() {
@@ -50,7 +49,7 @@ private static void initializeSources() {
 
         addConfigSources("CLI", List.of(new ConfigArgsConfigSource()));
 
-        addConfigSources("ENV", List.of(new KcEnvConfigSource()));
+        addConfigSources("ENV", KcEnvConfigSource.getConfigSources());
 
         addConfigSources("quarkus.properties", new QuarkusPropertiesConfigSource().getConfigSources(Thread.currentThread().getContextClassLoader()));
 
@@ -61,9 +60,6 @@ private static void initializeSources() {
         if (path != null) {
             addConfigSources(path.getFileName().toString(), inFileSystem.getConfigSources(Thread.currentThread().getContextClassLoader(), path));
         }
-
-        // by enabling this config source we are able to rely on the default settings when running tests
-        addConfigSources("classpath keycloak.conf", new KeycloakPropertiesConfigSource.InClassPath().getConfigSources(Thread.currentThread().getContextClassLoader()));
     }
 
     private static void addConfigSources(String displayName, Collection<ConfigSource> configSources) {
@@ -85,9 +81,6 @@ public static void reload() {
 
     @Override
     public Iterable<ConfigSource> getConfigSources(ClassLoader forClassLoader) {
-        if(Environment.isTestLaunchMode()) {
-            reload();
-        }
         return CONFIG_SOURCES;
     }
 
@@ -100,10 +93,17 @@ public static String getConfigSourceDisplayName(String configSource) {
         if (configSource == null) {
             return "Derived";
         }
+        String name = CONFIG_SOURCE_DISPLAY_NAMES.get(configSource);
+        if (name != null) {
+            return name;
+        }
         if (isKeyStoreConfigSource(configSource)) {
             return "config-keystore";
         }
-        return CONFIG_SOURCE_DISPLAY_NAMES.getOrDefault(configSource, configSource);
+        if (configSource.contains("PropertiesConfigSource") && configSource.contains("!/application.properties")) {
+            return "classpath application.properties";
+        }
+        return configSource; // some other Quarkus configsource
     }
 
     public static boolean isKeyStoreConfigSource(String configSourceName) {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakPropertiesConfigSource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakPropertiesConfigSource.java
index 2c4e71737634..fc3c25b3f35a 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakPropertiesConfigSource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/KeycloakPropertiesConfigSource.java
@@ -17,42 +17,34 @@
 
 package org.keycloak.quarkus.runtime.configuration;
 
+import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
+
 import java.io.File;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URL;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.regex.Pattern;
 
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.eclipse.microprofile.config.spi.ConfigSourceProvider;
 import org.keycloak.quarkus.runtime.Environment;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 
 import io.smallrye.config.AbstractLocationConfigSourceLoader;
 import io.smallrye.config.PropertiesConfigSource;
 import io.smallrye.config.common.utils.ConfigSourceUtil;
 
-import static org.keycloak.quarkus.runtime.configuration.Configuration.getMappedPropertyName;
-import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK;
-import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
-import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_QUARKUS;
-
 /**
  * A configuration source for {@code keycloak.conf}.
  */
 public class KeycloakPropertiesConfigSource extends AbstractLocationConfigSourceLoader {
-    
+
     public static final int PROPERTIES_FILE_ORDINAL = 475;
 
-    private static final Pattern DOT_SPLIT = Pattern.compile("\\.");
     private static final String KEYCLOAK_CONFIG_FILE_ENV = "KC_CONFIG_FILE";
     private static final String KEYCLOAK_CONF_FILE = "keycloak.conf";
     public static final String KEYCLOAK_CONFIG_FILE_PROP = NS_KEYCLOAK_PREFIX + "config.file";
@@ -64,51 +56,7 @@ protected String[] getFileExtensions() {
 
     @Override
     protected ConfigSource loadConfigSource(URL url, int ordinal) throws IOException {
-        // a workaround for https://github.com/smallrye/smallrye-config/issues/1207
-        // replace by the following line when fixed:
-        // return new PropertiesConfigSource(transform(ConfigSourceUtil.urlToMap(url)), url.toString(), ordinal);
-        var cs = new PropertiesConfigSource(transform(ConfigSourceUtil.urlToMap(url)), url.toString(), ordinal) {
-            private String name;
-            @Override
-            public String getName() {
-                return name;
-            }
-            public void setName(String name) {
-                this.name = name;
-            }
-        };
-        cs.setName(url.toString());
-        return cs;
-    }
-
-    public static class InClassPath extends KeycloakPropertiesConfigSource implements ConfigSourceProvider {
-
-        @Override
-        public List<ConfigSource> getConfigSources(final ClassLoader classLoader) {
-            return loadConfigSources("META-INF/" + KEYCLOAK_CONF_FILE, 150, classLoader);
-        }
-
-        @Override
-        protected List<ConfigSource> tryClassPath(URI uri, int ordinal, ClassLoader classLoader) {
-            try {
-                return super.tryClassPath(uri, ordinal, classLoader);
-            } catch (RuntimeException e) {
-                Throwable cause = e.getCause();
-
-                if (cause instanceof NoSuchFileException) {
-                    // configuration step happens before classpath is updated, and it might happen that
-                    // provider JARs are still in classpath index but removed from the providers dir
-                    return Collections.emptyList();
-                }
-
-                throw e;
-            }
-        }
-
-        @Override
-        protected List<ConfigSource> tryFileSystem(final URI uri, final int ordinal) {
-            return Collections.emptyList();
-        }
+        return new PropertiesConfigSource(transform(ConfigSourceUtil.urlToMap(url)), url.toString(), ordinal);
     }
 
     public static class InFileSystem extends KeycloakPropertiesConfigSource implements ConfigSourceProvider {
@@ -136,8 +84,9 @@ protected List<ConfigSource> tryClassPath(final URI uri, final int ordinal, fina
         public Path getConfigurationFile() {
             String filePath = System.getProperty(KEYCLOAK_CONFIG_FILE_PROP);
 
-            if (filePath == null)
+            if (filePath == null) {
                 filePath = System.getenv(KEYCLOAK_CONFIG_FILE_ENV);
+            }
 
             if (filePath == null) {
                 String homeDir = Environment.getHomeDir();
@@ -161,54 +110,12 @@ public Path getConfigurationFile() {
 
     private static Map<String, String> transform(Map<String, String> properties) {
         Map<String, String> result = new HashMap<>(properties.size());
-        properties.keySet().forEach(k -> {
-            String key = transformKey(k);
-            PropertyMapper<?> mapper = PropertyMappers.getMapper(key);
-
-            //TODO: remove explicit checks for spi and feature options once we have proper support in our config mappers
-            if (mapper != null
-                    || key.contains(NS_KEYCLOAK_PREFIX + "spi")
-                    || key.contains(NS_KEYCLOAK_PREFIX + "feature")) {
-                String value = properties.get(k);
-
-                result.put(key, value);
 
-                if (mapper != null && key.charAt(0) != '%') {
-                    result.put(getMappedPropertyName(key), value);
-                }
-            }
+        properties.entrySet().forEach(entry -> {
+            result.put(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + entry.getKey(), entry.getValue());
         });
 
         return result;
     }
 
-    /**
-     * We need a better namespace resolution so that we don't need to add Quarkus extensions manually. Maybe the easiest
-     * path is to just have the "kc" namespace for Keycloak-specific properties.
-     *
-     * @param key the key to transform
-     * @return the same key but prefixed with the namespace
-     */
-    private static String transformKey(String key) {
-        String namespace;
-        String[] keyParts = DOT_SPLIT.split(key);
-        String extension = keyParts[0];
-        String profile = "";
-        String transformed = key;
-
-        if (extension.startsWith("%")) {
-            profile = String.format("%s.", keyParts[0]);
-            extension = keyParts[1];
-            transformed = key.substring(key.indexOf('.') + 1);
-        }
-
-        if (extension.equalsIgnoreCase(NS_QUARKUS)) {
-            return key;
-        } else {
-            namespace = NS_KEYCLOAK;
-        }
-
-        return profile + namespace + "." + transformed;
-
-    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/MicroProfileConfigProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/MicroProfileConfigProvider.java
index 7e5f8c58d1bb..8e516dda3120 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/MicroProfileConfigProvider.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/MicroProfileConfigProvider.java
@@ -19,22 +19,19 @@
 
 import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.toDashCase;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.toEnvVarFormat;
 
 import java.util.Set;
-import java.util.function.Predicate;
 import java.util.stream.Collectors;
 import java.util.stream.StreamSupport;
-import org.apache.commons.lang3.ArrayUtils;
 import org.eclipse.microprofile.config.ConfigProvider;
 
 import org.keycloak.Config;
-import org.keycloak.quarkus.runtime.cli.Picocli;
 
 public class MicroProfileConfigProvider implements Config.ConfigProvider {
 
     public static final String NS_KEYCLOAK = "kc";
     public static final String NS_KEYCLOAK_PREFIX = NS_KEYCLOAK + ".";
+    public static final String SPI_PREFIX = NS_KEYCLOAK_PREFIX + "spi" + OPTION_PART_SEPARATOR;
     public static final String NS_QUARKUS = "quarkus";
     public static final String NS_QUARKUS_PREFIX = "quarkus" + ".";
 
@@ -60,21 +57,21 @@ public String getDefaultProvider(String spi) {
 
     @Override
     public Config.Scope scope(String... scope) {
-        return new MicroProfileScope(scope);
+        return new MicroProfileScope(SPI_PREFIX, scope);
     }
 
     public class MicroProfileScope implements Config.Scope {
 
-        private final String[] scope;
         private final String prefix;
+        private final String separatorPrefix;
 
-        public MicroProfileScope(String... scopes) {
-            this.scope = scopes;
-            StringBuilder prefix = new StringBuilder(NS_KEYCLOAK_PREFIX).append("spi");
+        public MicroProfileScope(String prefix, String... scopes) {
+            StringBuilder prefixBuilder = new StringBuilder(prefix);
             for (String scope : scopes) {
-                prefix.append(OPTION_PART_SEPARATOR).append(scope);
+                prefixBuilder.append(toDashCase(scope)).append(OPTION_PART_SEPARATOR + OPTION_PART_SEPARATOR);
             }
-            this.prefix = prefix.toString();
+            this.separatorPrefix = prefixBuilder.toString();
+            this.prefix = separatorPrefix.replace(OPTION_PART_SEPARATOR + OPTION_PART_SEPARATOR, OPTION_PART_SEPARATOR);
         }
 
         @Override
@@ -124,24 +121,22 @@ public Boolean getBoolean(String key, Boolean defaultValue) {
 
         @Override
         public Config.Scope scope(String... scope) {
-            return new MicroProfileScope(ArrayUtils.addAll(this.scope, scope));
+            return new MicroProfileScope(prefix, scope);
         }
 
         @Override
         public Set<String> getPropertyNames() {
             return StreamSupport.stream(config.getPropertyNames().spliterator(), false)
-                    .filter(new Predicate<String>() {
-                        @Override
-                        public boolean test(String key) {
-                            return key.startsWith(prefix) || key.startsWith(toEnvVarFormat(prefix));
-                        }
-                    })
+                    .filter(key -> key.startsWith(separatorPrefix))
                     .collect(Collectors.toSet());
         }
 
         private <T> T getValue(String key, Class<T> clazz, T defaultValue) {
-            return config.getOptionalValue(toDashCase(prefix.concat(OPTION_PART_SEPARATOR).concat(key.replace('.', '-'))), clazz).orElse(defaultValue);
+            String dashCase = toDashCase(key);
+            return config.getOptionalValue(separatorPrefix.concat(dashCase), clazz)
+                    .or(() -> config.getOptionalValue(prefix.concat(dashCase), clazz)).orElse(defaultValue);
         }
+
     }
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/NestedPropertyMappingInterceptor.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/NestedPropertyMappingInterceptor.java
new file mode 100644
index 000000000000..aeabb161f411
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/NestedPropertyMappingInterceptor.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.quarkus.runtime.configuration;
+
+import java.util.LinkedHashSet;
+import java.util.Optional;
+import java.util.function.Function;
+
+import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
+
+import io.smallrye.config.ConfigSourceInterceptor;
+import io.smallrye.config.ConfigSourceInterceptorContext;
+import io.smallrye.config.ConfigValue;
+import io.smallrye.config.Priorities;
+import jakarta.annotation.Priority;
+
+/**
+ * Some resolution of values that come from PropertyMappers
+ * happens at the ExpressionConfigSourceInterceptor, which is after
+ * property mapping. This interceptor appears just after the expression
+ * interceptor and will restart the context for anything not actively recursing.
+ * This is needed in case the expression contains something that requires property mapping.
+ */
+@Priority(Priorities.LIBRARY + 299)
+public class NestedPropertyMappingInterceptor implements ConfigSourceInterceptor {
+
+    static final ThreadLocal<LinkedHashSet<String>> recursions = new ThreadLocal<>();
+
+    @Override
+    public ConfigValue getValue(ConfigSourceInterceptorContext context, String name) {
+        return resolve(context::restart, context::proceed, name, false);
+    }
+
+    public static ConfigValue proceed(ConfigSourceInterceptorContext context, String name) {
+        return resolve(context::proceed, context::proceed, name, false);
+    }
+
+    private static <T> T resolve(Function<String, T> resolver, Function<String, T> nonRecursiveResolver, String name, boolean startNew) {
+        LinkedHashSet<String> recursing = recursions.get();
+        if (recursing == null && startNew) {
+            recursing = new LinkedHashSet<String>();
+            recursions.set(recursing);
+        }
+        if (recursing != null && recursing.add(name)) {
+            try {
+                return resolver.apply(name);
+            } finally {
+                recursing.remove(name);
+                if (recursing.isEmpty()) {
+                    recursions.set(null);
+                }
+            }
+        }
+        return nonRecursiveResolver.apply(name);
+    }
+
+    public static Optional<String> getResolvingRoot() {
+        return Optional.ofNullable(recursions.get()).filter(s -> !s.isEmpty()).map(s -> s.iterator().next());
+    }
+
+    public static ConfigValue getValueFromPropertyMappers(ConfigSourceInterceptorContext context, String name) {
+        Function<String, ConfigValue> resolver = (n) -> PropertyMappers.getValue(context, n);
+        return resolve(resolver, resolver, name, true);
+    }
+
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PersistedConfigSource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PersistedConfigSource.java
index 1ff7511ab2d9..2a785ebc9bf9 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PersistedConfigSource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PersistedConfigSource.java
@@ -67,21 +67,10 @@ public static PersistedConfigSource getInstance() {
         return INSTANCE;
     }
 
-    @Override
-    public String getName() {
-        return NAME;
-    }
-
     @Override
     public ConfigValue getConfigValue(String propertyName) {
         if (isEnabled()) {
-            ConfigValue value = super.getConfigValue(propertyName);
-
-            if (value != null) {
-                return value;
-            }
-
-            return super.getConfigValue(propertyName.replace(Configuration.OPTION_PART_SEPARATOR_CHAR, '.'));
+            return super.getConfigValue(propertyName);
         }
 
         return null;
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PropertyMappingInterceptor.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PropertyMappingInterceptor.java
index 3d8c983c257d..4ca44fbb4056 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PropertyMappingInterceptor.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/PropertyMappingInterceptor.java
@@ -16,24 +16,25 @@
  */
 package org.keycloak.quarkus.runtime.configuration;
 
-import io.smallrye.config.ConfigSourceInterceptor;
-import io.smallrye.config.ConfigSourceInterceptorContext;
-import io.smallrye.config.ConfigValue;
+import static org.keycloak.quarkus.runtime.Environment.isRebuild;
+
+import java.util.Iterator;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Stream;
+import java.util.stream.StreamSupport;
 
-import io.smallrye.config.Priorities;
-import jakarta.annotation.Priority;
 import org.apache.commons.collections4.IteratorUtils;
-import org.apache.commons.collections4.iterators.FilterIterator;
+import org.keycloak.config.OptionCategory;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
-import org.keycloak.quarkus.runtime.configuration.mappers.WildcardPropertyMapper;
-
-import java.util.Iterator;
-import java.util.List;
-import java.util.Set;
 
-import static org.keycloak.quarkus.runtime.Environment.isRebuild;
+import io.smallrye.config.ConfigSourceInterceptor;
+import io.smallrye.config.ConfigSourceInterceptorContext;
+import io.smallrye.config.ConfigValue;
+import io.smallrye.config.Priorities;
+import jakarta.annotation.Priority;
 
 /**
  * <p>This interceptor is responsible for mapping Keycloak properties to their corresponding properties in Quarkus.
@@ -54,7 +55,6 @@
 public class PropertyMappingInterceptor implements ConfigSourceInterceptor {
 
     private static final ThreadLocal<Boolean> disable = new ThreadLocal<>();
-    private static final ThreadLocal<Boolean> disableAdditionalNames = new ThreadLocal<>();
 
     public static void disable() {
         disable.set(true);
@@ -64,40 +64,80 @@ public static void enable() {
         disable.remove();
     }
 
-    static Iterator<String> filterRuntime(Iterator<String> iter) {
-        if (!isRebuild() && !Environment.isRebuildCheck()) {
-            return iter;
-        }
-        return new FilterIterator<>(iter, item -> !isRuntime(item));
-    }
-
-    static boolean isRuntime(String name) {
-        PropertyMapper<?> mapper = PropertyMappers.getMapper(name);
-        return mapper != null && mapper.isRunTime();
-    }
-
+    /**
+     * Provides a curated iteration of names based upon the mapping logic.
+     * Quarkus logic, such as config mapping, is dependent upon seeing the quarkus
+     * form of the key. We want to expose that here, rather than in the config sources
+     * because we lack a simple way to do name mapping for some sources, such as the
+     * keystore config source.
+     * <p>
+     * We currently expose:
+     * <li>anything based upon a property mapper that has a map to a quarkus property - including
+     * our kc. properties that have defaults.
+     * <li>wildcard key names for wildcard keys that map from a keycloak property (e.g. kc.log-level)
+     *
+     * We selectively exclude:
+     * <li>Config keystore properties at build time
+     */
     @Override
     public Iterator<String> iterateNames(ConfigSourceInterceptorContext context) {
-        // We need to iterate through names to get wildcard option names.
-        // Additionally, wildcardValuesTransformer might also trigger iterateNames.
-        // Hence we need to disable this to prevent infinite recursion.
-        // But we don't want to disable the whole interceptor, as wildcardValuesTransformer
-        // might still need mappers to work.
-        List<String> mappedWildcardNames = List.of();
-        if (!Boolean.TRUE.equals(disableAdditionalNames.get())) {
-            disableAdditionalNames.set(true);
-            try {
-                mappedWildcardNames = PropertyMappers.getWildcardMappers().stream()
-                        .map(WildcardPropertyMapper::getToWithWildcards)
-                        .flatMap(Set::stream)
-                        .toList();
-            } finally {
-                disableAdditionalNames.remove();
+        Iterable<String> iterable = () -> context.iterateNames();
+
+        final Set<PropertyMapper<?>> allMappers = PropertyMappers.getMappers();
+
+        //TODO: this is still not a complete list - things like quarkus.log.console.enabled
+        // come from kc.log - but via a map from, not to.
+        // so we'd need additional logic like the getWildcardMappedFrom case for that
+
+        boolean filterRuntime = isRebuild() || Environment.isRebuildCheck();
+
+        var baseStream = StreamSupport.stream(iterable.spliterator(), false).flatMap(name -> {
+            PropertyMapper<?> mapper = PropertyMappers.getMapper(name);
+
+            if (mapper == null) {
+                return Stream.of(name);
             }
-        }
+            if (filterRuntime && mapper.getCategory() == OptionCategory.CONFIG) {
+                return Stream.of(); // advertising the keystore type causes the keystore to be used early
+            }
+            allMappers.remove(mapper);
 
-        // this could be optimized by filtering the wildcard names in the stream above
-        return filterRuntime(IteratorUtils.chainedIterator(mappedWildcardNames.iterator(), context.iterateNames()));
+            // include additional mappings if we're on the from side of the mapping
+            // as the mapping may not be bi-directional
+
+            if (!mapper.hasWildcard() && name.equals(mapper.getFrom())) {
+                // this is not a wildcard value, but may map to wildcards
+                // the current example is something like log-level=wildcardCat1:level,wildcardCat2:level
+                var wildCard = PropertyMappers.getWildcardMappedFrom(mapper.getOption());
+                if (wildCard != null) {
+                    ConfigValue value = context.proceed(name);
+                    if (value != null && value.getValue() != null) {
+                        return Stream.concat(Stream.of(name), wildCard.getToFromWildcardTransformer(value.getValue()));
+                    }
+                }
+            }
+
+            mapper = mapper.forKey(name);
+
+            if (name.equals(mapper.getFrom())) {
+                // there is a corner case here: -1 for the reload period has no 'to' value.
+                // if that becomes an issue we could use more metadata to perform a full mapping
+                return toDistinctStream(name, mapper.getTo());
+            }
+            return Stream.of(name);
+        });
+
+        // include anything remaining that has a default value
+        var defaultStream = allMappers.stream()
+                .filter(m -> !m.getDefaultValue().isEmpty() && !m.hasWildcard()
+                        && m.getCategory() != OptionCategory.CONFIG) // advertising the keystore type causes the keystore to be used early
+                .flatMap(m -> toDistinctStream(m.getTo()));
+
+        return IteratorUtils.chainedIterator(baseStream.iterator(), defaultStream.iterator());
+    }
+
+    private static Stream<String> toDistinctStream(String... values) {
+        return Stream.of(values).filter(Objects::nonNull).distinct();
     }
 
     @Override
@@ -105,6 +145,8 @@ public ConfigValue getValue(ConfigSourceInterceptorContext context, String name)
         if (Boolean.TRUE.equals(disable.get())) {
             return context.proceed(name);
         }
-        return PropertyMappers.getValue(context, name);
+
+        // Call through NestedPropertyMappingInterceptor to track what we are currently getting the value for
+        return NestedPropertyMappingInterceptor.getValueFromPropertyMappers(context, name);
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/QuarkusPropertiesConfigSource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/QuarkusPropertiesConfigSource.java
index d6b56a61c280..bc50246f26e7 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/QuarkusPropertiesConfigSource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/QuarkusPropertiesConfigSource.java
@@ -21,14 +21,13 @@
 
 import java.io.File;
 import java.io.IOException;
-import java.net.URI;
 import java.net.URL;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
+import java.util.Map;
+
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.eclipse.microprofile.config.spi.ConfigSourceProvider;
 import org.keycloak.quarkus.runtime.Environment;
@@ -43,7 +42,7 @@
 public final class QuarkusPropertiesConfigSource extends AbstractLocationConfigSourceLoader implements ConfigSourceProvider {
 
     private static final String FILE_NAME = "quarkus.properties";
-    public static final String NAME = "QuarkusProperties";
+    public static final String NAME = "KcQuarkusPropertiesConfigSource";
 
     public static Path getConfigurationFile() {
         String homeDir = Environment.getHomeDir();
@@ -59,8 +58,6 @@ public static Path getConfigurationFile() {
         return null;
     }
 
-    private boolean loadingFile;
-
     @Override
     protected String[] getFileExtensions() {
         return new String[] { "properties" };
@@ -68,57 +65,22 @@ protected String[] getFileExtensions() {
 
     @Override
     protected ConfigSource loadConfigSource(URL url, int ordinal) throws IOException {
-        String name = loadingFile ? NAME : (NAME + " " + url);
-        return new PropertiesConfigSource(ConfigSourceUtil.urlToMap(url), name, ordinal) {
-            @Override
-            public String getName() {
-                return name;
-            }
-
-            @Override
-            public String getValue(String propertyName) {
-                if (propertyName.startsWith(NS_QUARKUS)) {
-                    return super.getValue(propertyName);
-                }
-
-                return null;
-            }
-        };
+        Map<String, String> map = ConfigSourceUtil.urlToMap(url);
+        map.keySet().removeIf(k -> !k.startsWith(NS_QUARKUS));
+        return new PropertiesConfigSource(map, NAME, ordinal);
     }
 
     @Override
     public synchronized List<ConfigSource> getConfigSources(final ClassLoader classLoader) {
         List<ConfigSource> configSources = new ArrayList<>();
 
-        configSources.addAll(loadConfigSources("META-INF/services/" + FILE_NAME, 450, classLoader));
-
         Path configFile = getConfigurationFile();
 
         if (configFile != null) {
-            loadingFile = true;
-            try {
-                configSources.addAll(loadConfigSources(configFile.toUri().toString(), KeycloakPropertiesConfigSource.PROPERTIES_FILE_ORDINAL, classLoader));
-            } finally {
-                loadingFile = false;
-            }
+            configSources.addAll(loadConfigSources(configFile.toUri().toString(), KeycloakPropertiesConfigSource.PROPERTIES_FILE_ORDINAL, classLoader));
         }
 
         return configSources;
     }
 
-    @Override
-    protected List<ConfigSource> tryClassPath(URI uri, int ordinal, ClassLoader classLoader) {
-        try {
-            return super.tryClassPath(uri, ordinal, classLoader);
-        } catch (RuntimeException e) {
-            Throwable cause = e.getCause();
-            if (cause instanceof NoSuchFileException) {
-                // configuration step happens before classpath is updated, and it might happen that
-                // provider JARs are still in classpath index but removed from the providers dir
-                return Collections.emptyList();
-            }
-
-            throw e;
-        }
-    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java
index aea9e4936c32..a9aed65de6f4 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/CachingPropertyMappers.java
@@ -1,27 +1,33 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
+import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalKcValue;
+import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
+
 import java.io.File;
+import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
 import java.util.function.BooleanSupplier;
 
-import io.smallrye.config.ConfigSourceInterceptorContext;
 import org.keycloak.common.Profile;
 import org.keycloak.config.CachingOptions;
 import org.keycloak.config.Option;
 import org.keycloak.infinispan.util.InfinispanUtils;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.utils.StringUtil;
 
-import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalKcValue;
-import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
+import com.google.common.base.CaseFormat;
+
+import io.smallrye.config.ConfigSourceInterceptorContext;
 
 final class CachingPropertyMappers {
 
     private static final String REMOTE_HOST_SET = "remote host is set";
-    private static final String MULTI_SITE_OR_EMBEDDED_REMOTE_FEATURE_SET = "feature '%s', '%s' or '%s' is set".formatted(Profile.Feature.MULTI_SITE.getKey(), Profile.Feature.CLUSTERLESS.getKey(), Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey());
+    private static final String MULTI_SITE_OR_EMBEDDED_REMOTE_FEATURE_SET = "feature '%s' or '%s' is set".formatted(Profile.Feature.MULTI_SITE.getKey(), Profile.Feature.CLUSTERLESS.getKey());
     private static final String MULTI_SITE_FEATURE_SET = "feature '%s' or '%s' is set".formatted(Profile.Feature.MULTI_SITE.getKey(), Profile.Feature.CLUSTERLESS.getKey());
 
     private static final String CACHE_STACK_SET_TO_ISPN = "'cache' type is set to '" + CachingOptions.Mechanism.ispn.name() + "'";
@@ -31,90 +37,163 @@ private CachingPropertyMappers() {
 
     public static PropertyMapper<?>[] getClusteringPropertyMappers() {
         List<PropertyMapper<?>> staticMappers = List.of(
-              fromOption(CachingOptions.CACHE)
-                    .paramLabel("type")
-                    .build(),
-              fromOption(CachingOptions.CACHE_STACK)
-                    .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, CACHE_STACK_SET_TO_ISPN)
-                    .to("kc.spi-connections-infinispan-quarkus-stack")
-                    .paramLabel("stack")
-                    .build(),
-              fromOption(CachingOptions.CACHE_CONFIG_FILE)
-                    .mapFrom(CachingOptions.CACHE, (value, context) -> {
-                        if (CachingOptions.Mechanism.local.name().equals(value)) {
-                            return "cache-local.xml";
-                        } else if (CachingOptions.Mechanism.ispn.name().equals(value)) {
-                            return resolveConfigFile("cache-ispn.xml", null);
-                        } else
-                            return null;
-                    })
-                    .to("kc.spi-connections-infinispan-quarkus-config-file")
-                    .transformer(CachingPropertyMappers::resolveConfigFile)
-                    .paramLabel("file")
-                    .build(),
-              fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)
-                    .build(),
-              fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE.withRuntimeSpecificDefault(getDefaultKeystorePathValue()))
-                    .paramLabel("file")
-                    .build(),
-              fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD)
-                    .paramLabel("password")
-                    .isMasked(true)
-                    .build(),
-              fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE.withRuntimeSpecificDefault(getDefaultTruststorePathValue()))
-                    .paramLabel("file")
-                    .build(),
-              fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD)
-                    .paramLabel("password")
-                    .isMasked(true)
-                    .build(),
-              fromOption(CachingOptions.CACHE_REMOTE_HOST)
-                    .paramLabel("hostname")
-                    .addValidateEnabled(CachingPropertyMappers::isRemoteCacheHostEnabled, MULTI_SITE_OR_EMBEDDED_REMOTE_FEATURE_SET)
-                    .isRequired(InfinispanUtils::isRemoteInfinispan, MULTI_SITE_FEATURE_SET)
-                    .build(),
-              fromOption(CachingOptions.CACHE_REMOTE_PORT)
-                    .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
-                    .paramLabel("port")
-                    .build(),
-              fromOption(CachingOptions.CACHE_REMOTE_TLS_ENABLED)
-                    .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
-                    .build(),
-              fromOption(CachingOptions.CACHE_REMOTE_USERNAME)
-                    .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
-                    .validator((value) -> validateCachingOptionIsPresent(CachingOptions.CACHE_REMOTE_USERNAME, CachingOptions.CACHE_REMOTE_PASSWORD))
-                    .paramLabel("username")
-                    .build(),
-              fromOption(CachingOptions.CACHE_REMOTE_PASSWORD)
-                    .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
-                    .validator((value) -> validateCachingOptionIsPresent(CachingOptions.CACHE_REMOTE_PASSWORD, CachingOptions.CACHE_REMOTE_USERNAME))
-                    .paramLabel("password")
-                    .isMasked(true)
-                    .build(),
-              fromOption(CachingOptions.CACHE_METRICS_HISTOGRAMS_ENABLED)
-                    .isEnabled(MetricsPropertyMappers::metricsEnabled, MetricsPropertyMappers.METRICS_ENABLED_MSG)
-                    .build()
-              );
+                fromOption(CachingOptions.CACHE)
+                        .paramLabel("type")
+                        .build(),
+                fromOption(CachingOptions.CACHE_STACK)
+                        .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, CACHE_STACK_SET_TO_ISPN)
+                        .to("kc.spi-cache--embedded--default-stack")
+                        .paramLabel("stack")
+                        .build(),
+                fromOption(CachingOptions.CACHE_CONFIG_FILE)
+                        .mapFrom(CachingOptions.CACHE, (value, context) -> {
+                            if (CachingOptions.Mechanism.local.name().equals(value)) {
+                                return "cache-local.xml";
+                            } else if (CachingOptions.Mechanism.ispn.name().equals(value)) {
+                                return resolveConfigFile("cache-ispn.xml", null);
+                            } else {
+                                return null;
+                            }
+                        })
+                        .to("kc.spi-cache-embedded--default--config-file")
+                        .transformer(CachingPropertyMappers::resolveConfigFile)
+                        .validator(s -> {
+                            if (!Files.exists(Paths.get(resolveConfigFile(s, null)))) {
+                                throw new PropertyException("Cache config file '%s' does not exist in the conf directory".formatted(s));
+                            }
+                        })
+                        .paramLabel("file")
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)
+                        .to("kc.spi-jgroups-mtls--default--enabled")
+                        .isEnabled(CachingPropertyMappers::getDefaultMtlsEnabled, "a TCP based cache-stack is used")
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE.withRuntimeSpecificDefault(getDefaultKeystorePathValue()))
+                        .paramLabel("file")
+                        .to("kc.spi-jgroups-mtls--default--keystore-file")
+                        .isEnabled(() -> Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED), "property '%s' is enabled".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED.getKey()))
+                        .validator(value -> checkValidKeystore(value, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD))
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD)
+                        .paramLabel("password")
+                        .isMasked(true)
+                        .to("kc.spi-jgroups-mtls--default--keystore-password")
+                        .isEnabled(() -> Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED), "property '%s' is enabled".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED.getKey()))
+                        .validator(value -> checkOptionPresent(CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE))
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE.withRuntimeSpecificDefault(getDefaultTruststorePathValue()))
+                        .paramLabel("file")
+                        .to("kc.spi-jgroups-mtls--default--truststore-file")
+                        .isEnabled(() -> Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED), "property '%s' is enabled".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED.getKey()))
+                        .validator(value -> checkValidKeystore(value, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD))
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD)
+                        .paramLabel("password")
+                        .isMasked(true)
+                        .to("kc.spi-jgroups-mtls--default--truststore-password")
+                        .isEnabled(() -> Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED), "property '%s' is enabled".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED.getKey()))
+                        .validator(value -> checkOptionPresent(CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE))
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION)
+                        .paramLabel("days")
+                        .to("kc.spi-jgroups-mtls--default--rotation")
+                        .isEnabled(() -> Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED), "property '%s' is enabled".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED.getKey()))
+                        .validator(CachingPropertyMappers::validateCertificateRotationIsPositive)
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_ADDRESS)
+                        .paramLabel("address")
+                        .to("kc.spi-cache-embedded--default--network-bind-address")
+                        .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, "Infinispan clustered embedded is enabled")
+                        .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_NETWORK_BIND_PORT)
+                       .paramLabel("port")
+                       .to("kc.spi-cache-embedded--default--network-bind-port")
+                       .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, "Infinispan clustered embedded is enabled")
+                       .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_ADDRESS)
+                       .paramLabel("address")
+                       .to("kc.spi-cache-embedded--default--network-external-address")
+                       .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, "Infinispan clustered embedded is enabled")
+                       .build(),
+                fromOption(CachingOptions.CACHE_EMBEDDED_NETWORK_EXTERNAL_PORT)
+                       .paramLabel("port")
+                       .isEnabled(CachingPropertyMappers::cacheSetToInfinispan, "Infinispan clustered embedded is enabled")
+                       .to("kc.spi-cache-embedded--default--network-external-port")
+                       .build(),
+                fromOption(CachingOptions.CACHE_REMOTE_HOST)
+                        .paramLabel("hostname")
+                        .to("kc.spi-cache-remote--default--hostname")
+                        .addValidateEnabled(CachingPropertyMappers::isRemoteCacheHostEnabled, MULTI_SITE_OR_EMBEDDED_REMOTE_FEATURE_SET)
+                        .isRequired(InfinispanUtils::isRemoteInfinispan, MULTI_SITE_FEATURE_SET)
+                        .build(),
+                fromOption(CachingOptions.CACHE_REMOTE_PORT)
+                        .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
+                        .to("kc.spi-cache-remote--default--port")
+                        .paramLabel("port")
+                        .build(),
+                fromOption(CachingOptions.CACHE_REMOTE_TLS_ENABLED)
+                        .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
+                        .to("kc.spi-cache-remote--default--tls-enabled")
+                        .build(),
+                fromOption(CachingOptions.CACHE_REMOTE_USERNAME)
+                        .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
+                        .to("kc.spi-cache-remote--default--username")
+                        .validator((value) -> validateCachingOptionIsPresent(CachingOptions.CACHE_REMOTE_USERNAME, CachingOptions.CACHE_REMOTE_PASSWORD))
+                        .paramLabel("username")
+                        .build(),
+                fromOption(CachingOptions.CACHE_REMOTE_PASSWORD)
+                        .isEnabled(CachingPropertyMappers::remoteHostSet, CachingPropertyMappers.REMOTE_HOST_SET)
+                        .to("kc.spi-cache-remote--default--password")
+                        .validator((value) -> validateCachingOptionIsPresent(CachingOptions.CACHE_REMOTE_PASSWORD, CachingOptions.CACHE_REMOTE_USERNAME))
+                        .paramLabel("password")
+                        .isMasked(true)
+                        .build(),
+                fromOption(CachingOptions.CACHE_METRICS_HISTOGRAMS_ENABLED)
+                        .isEnabled(MetricsPropertyMappers::metricsEnabled, MetricsPropertyMappers.METRICS_ENABLED_MSG)
+                        .to("kc.spi-cache-embedded--default--metrics-histograms-enabled")
+                        .build()
+        );
 
         int numMappers = staticMappers.size() + CachingOptions.LOCAL_MAX_COUNT_CACHES.length + CachingOptions.CLUSTERED_MAX_COUNT_CACHES.length;
         List<PropertyMapper<?>> mappers = new ArrayList<>(numMappers);
         mappers.addAll(staticMappers);
 
-        for (String cache : CachingOptions.LOCAL_MAX_COUNT_CACHES)
+        for (String cache : CachingOptions.LOCAL_MAX_COUNT_CACHES) {
             mappers.add(maxCountOpt(cache, () -> true, ""));
+        }
 
-        for (String cache : CachingOptions.CLUSTERED_MAX_COUNT_CACHES)
+        for (String cache : CachingOptions.CLUSTERED_MAX_COUNT_CACHES) {
             mappers.add(maxCountOpt(cache, InfinispanUtils::isEmbeddedInfinispan, "embedded Infinispan clusters configured"));
+        }
 
         return mappers.toArray(new PropertyMapper[0]);
     }
 
+    private static boolean getDefaultMtlsEnabled() {
+        if (!cacheSetToInfinispan()) {
+            return false;
+        }
+        Optional<String> cacheStackOptional = getOptionalKcValue(CachingOptions.CACHE_STACK);
+        if (cacheStackOptional.isEmpty()) {
+            return true;
+        }
+        String cacheStack = cacheStackOptional.get();
+        return !(cacheStack.equals("udp") || cacheStack.equals("jdbc-ping-udp"));
+    }
+
     private static boolean remoteHostSet() {
         return getOptionalKcValue(CachingOptions.CACHE_REMOTE_HOST_PROPERTY).isPresent();
     }
 
     private static boolean cacheSetToInfinispan() {
+        if (InfinispanUtils.isRemoteInfinispan()) {
+            return false;
+        }
+
         Optional<String> cache = getOptionalKcValue(CachingOptions.CACHE);
+        if (cache.isEmpty() && !Environment.isDevMode()) {
+            return true;
+        }
         return cache.isPresent() && cache.get().equals(CachingOptions.Mechanism.ispn.name());
     }
 
@@ -156,13 +235,14 @@ private static String getDefaultTruststorePathValue() {
 
     private static PropertyMapper<?> maxCountOpt(String cacheName, BooleanSupplier isEnabled, String enabledWhen) {
         return fromOption(CachingOptions.maxCountOption(cacheName))
-              .isEnabled(isEnabled, enabledWhen)
-              .paramLabel("max-count")
-              .build();
+                .isEnabled(isEnabled, enabledWhen)
+                .paramLabel("max-count")
+                .to("kc.spi-cache-embedded--default--%s-max-count".formatted(CaseFormat.LOWER_CAMEL.to(CaseFormat.LOWER_HYPHEN, cacheName)))
+                .build();
     }
 
     private static boolean isRemoteCacheHostEnabled() {
-        return InfinispanUtils.isRemoteInfinispan() || Profile.isFeatureEnabled(Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE);
+        return InfinispanUtils.isRemoteInfinispan();
     }
 
     private static void validateCachingOptionIsPresent(Option<?> optionSet, Option<?> optionRequired) {
@@ -170,4 +250,32 @@ private static void validateCachingOptionIsPresent(Option<?> optionSet, Option<?
             throw new PropertyException("The option '%s' is required when '%s' is set.".formatted(optionRequired.getKey(), optionSet.getKey()));
         }
     }
+
+    private static void checkValidKeystore(String store, Option<String> option, Option<String> requiredOption) {
+        checkOptionPresent(option, requiredOption);
+        if (!new File(store).exists()) {
+            throw new IllegalArgumentException("The '%s' file '%s' does not exist.".formatted(option.getKey(), store));
+        }
+    }
+
+    private static void checkOptionPresent(Option<String> option, Option<String> requiredOption) {
+        if (getOptionalKcValue(requiredOption).isPresent()) {
+            return;
+        }
+        throw new PropertyException("The option '%s' requires '%s' to be enabled.".formatted(option.getKey(), requiredOption.getKey()));
+    }
+
+    private static void validateCertificateRotationIsPositive(String value) {
+        value = value.trim();
+        if (StringUtil.isBlank(value)) {
+            throw new PropertyException("Option '%s' must not be empty.".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION.getKey()));
+        }
+        try {
+            if (Integer.parseInt(value) <= 0) {
+                throw new NumberFormatException();
+            }
+        } catch (NumberFormatException unused) {
+            throw new PropertyException("JGroups MTLS certificate rotation in '%s' option must positive.".formatted(CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION.getKey()));
+        }
+    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ConfigKeystorePropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ConfigKeystorePropertyMappers.java
index e5f3c6657c7f..0f3fcdf2a744 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ConfigKeystorePropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ConfigKeystorePropertyMappers.java
@@ -1,15 +1,15 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
 import io.smallrye.config.ConfigSourceInterceptorContext;
-import io.smallrye.config.ConfigValue;
 import org.keycloak.config.ConfigKeystoreOptions;
+import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
 
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
-final class ConfigKeystorePropertyMappers {
+public final class ConfigKeystorePropertyMappers {
     private static final String SMALLRYE_KEYSTORE_PATH = "smallrye.config.source.keystore.kc-default.path";
     private static final String SMALLRYE_KEYSTORE_PASSWORD = "smallrye.config.source.keystore.kc-default.password";
 
@@ -38,18 +38,16 @@ public static PropertyMapper<?>[] getConfigKeystorePropertyMappers() {
     }
 
     private static String validatePath(String option, ConfigSourceInterceptorContext context) {
-        ConfigValue path = context.proceed(SMALLRYE_KEYSTORE_PATH);
-        boolean isPasswordDefined = context.proceed(SMALLRYE_KEYSTORE_PASSWORD) != null;
-
-        if (path == null) {
-            throw new IllegalArgumentException("config-keystore must be specified");
+        if (option == null) {
+            return null;
         }
+        boolean isPasswordDefined = context.proceed(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + ConfigKeystoreOptions.CONFIG_KEYSTORE_PASSWORD.getKey()) != null;
 
         if (!isPasswordDefined) {
             throw new IllegalArgumentException("config-keystore-password must be specified");
         }
 
-        final Path realPath = Path.of(path.getValue()).toAbsolutePath().normalize();
+        final Path realPath = Path.of(option).toAbsolutePath().normalize();
         if (!Files.exists(realPath)) {
             throw new IllegalArgumentException("config-keystore path does not exist: " + realPath);
         }
@@ -58,12 +56,10 @@ private static String validatePath(String option, ConfigSourceInterceptorContext
     }
 
     private static String validatePassword(String option, ConfigSourceInterceptorContext context) {
-        boolean isPasswordDefined = context.proceed(SMALLRYE_KEYSTORE_PASSWORD).getValue() != null;
-        boolean isPathDefined = context.proceed(SMALLRYE_KEYSTORE_PATH) != null;
-
-        if (!isPasswordDefined) {
-            throw new IllegalArgumentException("config-keystore-password must be specified");
+        if (option == null) {
+            return null;
         }
+        boolean isPathDefined = context.proceed(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + ConfigKeystoreOptions.CONFIG_KEYSTORE.getKey()) != null;
 
         if (!isPathDefined) {
             throw new IllegalArgumentException("config-keystore must be specified");
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java
index cd0b67ac2313..986ffce47c4c 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/DatabasePropertyMappers.java
@@ -2,22 +2,39 @@
 
 import io.quarkus.datasource.common.runtime.DatabaseKind;
 import io.smallrye.config.ConfigSourceInterceptorContext;
-
+import io.smallrye.config.ConfigValue;
+import org.jboss.logging.Logger;
 import org.keycloak.config.DatabaseOptions;
+import org.keycloak.config.Option;
+import org.keycloak.config.OptionBuilder;
 import org.keycloak.config.TransactionOptions;
 import org.keycloak.config.database.Database;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.utils.StringUtil;
 
-import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
-
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+
+import static org.keycloak.config.DatabaseOptions.DB;
+import static org.keycloak.config.DatabaseOptions.OPTIONS_DATASOURCES;
+import static org.keycloak.config.DatabaseOptions.getDatasourceOption;
+import static org.keycloak.config.DatabaseOptions.getKeyForDatasource;
+import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
+import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
 final class DatabasePropertyMappers {
+    private static final Logger log = Logger.getLogger(DatabasePropertyMappers.class);
 
-    private DatabasePropertyMappers(){}
+    private DatabasePropertyMappers() {
+    }
 
     public static PropertyMapper<?>[] getDatabasePropertyMappers() {
-        return new PropertyMapper[] {
+        var mappers = new PropertyMapper<?>[]{
                 fromOption(DatabaseOptions.DB_DIALECT)
                         .mapFrom(DatabaseOptions.DB, DatabasePropertyMappers::transformDialect)
                         .build(),
@@ -36,30 +53,29 @@ public static PropertyMapper<?>[] getDatabasePropertyMappers() {
                         .mapFrom(DatabaseOptions.DB, DatabasePropertyMappers::getDatabaseUrl)
                         .paramLabel("jdbc-url")
                         .build(),
+                fromOption(DatabaseOptions.DB_POSTGRESQL_TARGET_SERVER_TYPE)
+                        .to("quarkus.datasource.jdbc.additional-jdbc-properties.targetServerType")
+                        .mapFrom(DatabaseOptions.DB, DatabasePropertyMappers::getPostgresqlTargetServerType)
+                        .isEnabled(() -> getPostgresqlTargetServerType(Configuration.getConfigValue(DB).getValue(), null) != null)
+                        .build(),
                 fromOption(DatabaseOptions.DB_URL_HOST)
-                        .to("kc.db-url-host")
                         .paramLabel("hostname")
                         .build(),
                 fromOption(DatabaseOptions.DB_URL_DATABASE)
-                        .to("kc.db-url-database")
                         .paramLabel("dbname")
                         .build(),
                 fromOption(DatabaseOptions.DB_URL_PORT)
-                        .to("kc.db-url-port")
                         .paramLabel("port")
                         .build(),
                 fromOption(DatabaseOptions.DB_URL_PROPERTIES)
-                        .to("kc.db-url-properties")
                         .paramLabel("properties")
                         .build(),
                 fromOption(DatabaseOptions.DB_USERNAME)
                         .to("quarkus.datasource.username")
-                        .transformer(DatabasePropertyMappers::resolveUsername)
                         .paramLabel("username")
                         .build(),
                 fromOption(DatabaseOptions.DB_PASSWORD)
                         .to("quarkus.datasource.password")
-                        .transformer(DatabasePropertyMappers::resolvePassword)
                         .paramLabel("password")
                         .isMasked(true)
                         .build(),
@@ -71,51 +87,83 @@ public static PropertyMapper<?>[] getDatabasePropertyMappers() {
                         .paramLabel("size")
                         .build(),
                 fromOption(DatabaseOptions.DB_POOL_MIN_SIZE)
+                        .mapFrom(DatabaseOptions.DB, DatabasePropertyMappers::transformMinPoolSize)
                         .to("quarkus.datasource.jdbc.min-size")
-                        .transformer(DatabasePropertyMappers::transformMinPoolSize)
                         .paramLabel("size")
                         .build(),
                 fromOption(DatabaseOptions.DB_POOL_MAX_SIZE)
                         .to("quarkus.datasource.jdbc.max-size")
                         .paramLabel("size")
+                        .build(),
+                fromOption(DatabaseOptions.DB_SQL_JPA_DEBUG)
+                        .to("kc." + DatabaseOptions.DB_SQL_JPA_DEBUG.getKey())
+                        .build(),
+                fromOption(DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES)
+                        .to("kc." + DatabaseOptions.DB_SQL_LOG_SLOW_QUERIES.getKey())
+                        .paramLabel("milliseconds")
+                        .build(),
+                fromOption(DatabaseOptions.DB_ACTIVE_DATASOURCE)
+                        .to("quarkus.datasource.\"<datasource>\".active")
+                        .build(),
+                fromOption(DB_URL_PATH)
                         .build()
         };
-    }
 
-    private static String getDatabaseUrl(String value, ConfigSourceInterceptorContext c) {
-        return Database.getDefaultUrl(value).orElse(null);
+        return appendDatasourceMappers(mappers, Map.of(
+                // Inherit options from the DB mappers
+                DatabaseOptions.DB_POOL_INITIAL_SIZE, mapper -> mapper.mapFrom(DatabaseOptions.DB_POOL_INITIAL_SIZE),
+                DatabaseOptions.DB_POOL_MAX_SIZE, mapper -> mapper.mapFrom(DatabaseOptions.DB_POOL_MAX_SIZE)
+        ));
     }
 
-    private static String getXaOrNonXaDriver(String value, ConfigSourceInterceptorContext context) {
-        Optional<String> xaEnabledConfigValue = Configuration.getOptionalKcValue(TransactionOptions.TRANSACTION_XA_ENABLED);
-        boolean isXaEnabled = xaEnabledConfigValue.map(Boolean::parseBoolean).orElse(false);
+    private static final Option<String> DB_URL_PATH = new OptionBuilder<>("db-url-path", String.class)
+            .hidden()
+            .description("Used for internal purposes of H2 database.")
+            .build();
 
-        return Database.getDriver(value, isXaEnabled).orElse(null);
-    }
+    private static String getPostgresqlTargetServerType(String db, ConfigSourceInterceptorContext context) {
+        Database.Vendor vendor = Database.getVendor(db).orElse(null);
+        if (vendor != Database.Vendor.POSTGRES) {
+            return null;
+        }
 
-    private static String toDatabaseKind(String db, ConfigSourceInterceptorContext context) {
-        return Database.getDatabaseKind(db).orElse(null);
-    }
+        String dbDriver = Configuration.getConfigValue(DatabaseOptions.DB_DRIVER).getValue();
+        String dbUrl = Configuration.getConfigValue(DatabaseOptions.DB_URL).getValue();
+        String dbUrlProperties = Configuration.getConfigValue(DatabaseOptions.DB_URL_PROPERTIES).getValue();
 
-    private static String resolveUsername(String value, ConfigSourceInterceptorContext context) {
-        if (isDevModeDatabase(context)) {
-            return "sa";
+        if (!Objects.equals(Database.getDriver(db, true).orElse(null), dbDriver) &&
+                !Objects.equals(Database.getDriver(db, false).orElse(null), dbDriver)) {
+            // Custom JDBC-Driver, for example, AWS JDBC Wrapper.
+            return null;
+        }
+        if (dbUrlProperties != null && dbUrl != null && dbUrl.contains("${kc.db-url-properties:}") && dbUrlProperties.contains("targetServerType")) {
+            // targetServerType already set to same or different value in db-url-properties, ignore
+            return null;
+        }
+        if (dbUrl != null && dbUrl.contains("targetServerType")) {
+            // targetServerType already set to same or different value in db-url, ignore
+            return null;
         }
+        log.debug("setting targetServerType for PostgreSQL to 'primary'");
+        return "primary";
+    }
 
-        return value;
+    private static String getDatabaseUrl(String name, String value, ConfigSourceInterceptorContext c) {
+        return Database.getDefaultUrl(name, value).orElse(null);
     }
 
-    private static String resolvePassword(String value, ConfigSourceInterceptorContext context) {
-        if (isDevModeDatabase(context)) {
-            return "password";
-        }
+    private static String getXaOrNonXaDriver(String name, String value, ConfigSourceInterceptorContext context) {
+        var key = StringUtil.isNotBlank(name) ? TransactionOptions.getNamedTxXADatasource(name) : TransactionOptions.TRANSACTION_XA_ENABLED.getKey();
+        boolean isXaEnabled = Configuration.isKcPropertyTrue(key);
+        return Database.getDriver(value, isXaEnabled).orElse(null);
+    }
 
-        return value;
+    private static String toDatabaseKind(String db, ConfigSourceInterceptorContext context) {
+        return Database.getDatabaseKind(db).orElse(null);
     }
 
-    private static boolean isDevModeDatabase(ConfigSourceInterceptorContext context) {
-        String db = Configuration.getConfig().getConfigValue("kc.db").getValue();
-        return Database.getDatabaseKind(db).filter(DatabaseKind.H2::equals).isPresent();
+    private static boolean isDevModeDatabase(String database) {
+        return Database.getDatabaseKind(database).filter(DatabaseKind.H2::equals).isPresent();
     }
 
     private static String transformDialect(String db, ConfigSourceInterceptorContext context) {
@@ -126,7 +174,74 @@ private static String transformDialect(String db, ConfigSourceInterceptorContext
      * For H2 databases we must ensure that the min-pool size is at least one so that the DB is not shutdown until the
      * Agroal connection pool is closed on Keycloak shutdown.
      */
-    private static String transformMinPoolSize(String min, ConfigSourceInterceptorContext context) {
-        return isDevModeDatabase(context) && (min == null || "0".equals(min)) ? "1" : min;
+    private static String transformMinPoolSize(String database, ConfigSourceInterceptorContext context) {
+        Supplier<String> getParentPoolMinSize = () -> Optional.ofNullable(context.proceed(NS_KEYCLOAK_PREFIX + DatabaseOptions.DB_POOL_MIN_SIZE.getKey()))
+                .map(ConfigValue::getValue)
+                .orElse(null);
+        return isDevModeDatabase(database) ? "1" : getParentPoolMinSize.get();
+    }
+
+    // Datasources
+
+    /**
+     * Automatically create mappers for datasource options
+     */
+    private static PropertyMapper<?>[] appendDatasourceMappers(PropertyMapper<?>[] mappers, Map<Option<?>, Consumer<PropertyMapper.Builder<?>>> transformDatasourceMappers) {
+        List<PropertyMapper<?>> datasourceMappers = new ArrayList<>(OPTIONS_DATASOURCES.size() + mappers.length);
+
+        for (var parent : mappers) {
+            var parentOption = parent.getOption();
+
+            var datasourceOption = getDatasourceOption(parentOption);
+            if (datasourceOption.isEmpty()) {
+                log.debugf("No datasource option found for '%s'", parentOption.getKey());
+                continue;
+            }
+
+            var created = fromOption(datasourceOption.get())
+                    .isMasked(parent.isMask())
+                    .transformer(parent.getMapper());
+
+            if (parent.getMapFrom() != null) {
+                var wildcardMapFromOption = getKeyForDatasource(parent.getMapFrom())
+                        .orElseThrow(() -> new IllegalArgumentException("Option '%s' in mapFrom() method for mapper '%s' does not have any associated wildcard option".formatted(parent.getMapFrom(), datasourceOption.get().getKey())));
+                created.wildcardMapFrom(wildcardMapFromOption, parent.getParentMapper() != null ? (name, value, context) -> parent.getParentMapper().map(name, value, context) : null);
+            }
+
+            if (parent.getParamLabel() != null) {
+                created.paramLabel(parent.getParamLabel());
+            }
+
+            var transformedTo = transformDatasourceTo(parent.getTo());
+            if (transformedTo != null) {
+                created.to(transformedTo);
+            }
+
+            var customTransformer = transformDatasourceMappers.get(parent.getOption());
+            if (customTransformer != null) {
+                customTransformer.accept(created);
+            }
+
+            datasourceMappers.add(created.build());
+        }
+
+        datasourceMappers.addAll(List.of(mappers));
+
+        return datasourceMappers.toArray(new PropertyMapper[0]);
+    }
+
+    private static String transformDatasourceTo(String to) {
+        if (StringUtil.isBlank(to)) {
+            return null;
+        }
+
+        if (to.startsWith("quarkus.datasource.")) {
+            return to.replaceFirst("quarkus\\.datasource\\.", "quarkus.datasource.\"<datasource>\".");
+        } else if (to.startsWith("kc.db-")) {
+            return to.concat("-<datasource>");
+        } else {
+            log.warnf("Cannot determine how to map datasource option to '%s'", to);
+        }
+        return to;
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/EventPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/EventPropertyMappers.java
index 8f0f4de24993..2dcd7ff580f7 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/EventPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/EventPropertyMappers.java
@@ -18,16 +18,16 @@ private EventPropertyMappers(){}
     public static PropertyMapper<?>[] getMetricsPropertyMappers() {
         return new PropertyMapper[] {
                 fromOption(USER_EVENT_METRICS_ENABLED)
-                        .to("kc.spi-events-listener-micrometer-user-event-metrics-enabled")
+                        .to("kc.spi-events-listener--micrometer-user-event-metrics--enabled")
                         .isEnabled(EventPropertyMappers::userEventsMetricsEnabled, METRICS_ENABLED_MSG + " and feature " + Profile.Feature.USER_EVENT_METRICS.getKey() + " is enabled")
                         .build(),
                 fromOption(USER_EVENT_METRICS_TAGS)
-                        .to("kc.spi-events-listener-micrometer-user-event-metrics-tags")
+                        .to("kc.spi-events-listener--micrometer-user-event-metrics--tags")
                         .paramLabel("tags")
                         .isEnabled(EventPropertyMappers::userEventsMetricsTags, "user event metrics are enabled")
                         .build(),
                 fromOption(USER_EVENT_METRICS_EVENTS)
-                        .to("kc.spi-events-listener-micrometer-user-event-metrics-events")
+                        .to("kc.spi-events-listener--micrometer-user-event-metrics--events")
                         .paramLabel("events")
                         .isEnabled(EventPropertyMappers::userEventsMetricsTags, "user event metrics are enabled")
                         .build(),
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ExportPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ExportPropertyMappers.java
index 3986c9a54e1c..9edbeac248ff 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ExportPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ExportPropertyMappers.java
@@ -33,7 +33,7 @@
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
 public final class ExportPropertyMappers {
-    private static final String EXPORTER_PROPERTY = "kc.spi-export-exporter";
+    private static final String EXPORTER_PROPERTY = "kc.spi-export--exporter";
     private static final String SINGLE_FILE = "singleFile";
     private static final String DIR = "dir";
 
@@ -48,30 +48,30 @@ public static PropertyMapper<?>[] getMappers() {
                         .paramLabel("file")
                         .build(),
                 fromOption(ExportOptions.FILE)
-                        .to("kc.spi-export-single-file-file")
+                        .to("kc.spi-export--single-file--file")
                         .paramLabel("file")
                         .build(),
                 fromOption(ExportOptions.DIR)
-                        .to("kc.spi-export-dir-dir")
+                        .to("kc.spi-export--dir--dir")
                         .paramLabel("dir")
                         .build(),
                 fromOption(ExportOptions.REALM)
-                        .to("kc.spi-export-single-file-realm-name")
+                        .to("kc.spi-export--single-file--realm-name")
                         .isEnabled(ExportPropertyMappers::isSingleFileProvider)
                         .paramLabel("realm")
                         .build(),
                 fromOption(ExportOptions.REALM)
-                        .to("kc.spi-export-dir-realm-name")
+                        .to("kc.spi-export--dir--realm-name")
                         .isEnabled(ExportPropertyMappers::isDirProvider)
                         .paramLabel("realm")
                         .build(),
                 fromOption(ExportOptions.USERS)
-                        .to("kc.spi-export-dir-users-export-strategy")
+                        .to("kc.spi-export--dir--users-export-strategy")
                         .addValidator(ExportPropertyMappers::validateUsersUsage)
                         .paramLabel("strategy")
                         .build(),
                 fromOption(ExportOptions.USERS_PER_FILE)
-                        .to("kc.spi-export-dir-users-per-file")
+                        .to("kc.spi-export--dir--users-per-file")
                         .isEnabled(ExportPropertyMappers::isDirProvider)
                         .paramLabel("number")
                         .build()
@@ -121,8 +121,8 @@ private static String transformExporter(String option, ConfigSourceInterceptorCo
             return exporter.getValue();
         }
 
-        var file = Configuration.getOptionalValue("kc.spi-export-single-file-file").map(f -> SINGLE_FILE);
-        var dir = Configuration.getOptionalValue("kc.spi-export-dir-dir")
+        var file = Configuration.getOptionalValue("kc.spi-export--single-file--file").map(f -> SINGLE_FILE);
+        var dir = Configuration.getOptionalValue("kc.spi-export--dir--dir")
                 .or(() -> Configuration.getOptionalValue("kc.dir"))
                 .map(f -> DIR);
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HealthPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HealthPropertyMappers.java
index 630fbf7aa98d..4a5edd9a65f2 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HealthPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HealthPropertyMappers.java
@@ -12,7 +12,8 @@ private HealthPropertyMappers(){}
     public static PropertyMapper<?>[] getHealthPropertyMappers() {
         return new PropertyMapper[] {
                 fromOption(HealthOptions.HEALTH_ENABLED)
-                        .to("quarkus.smallrye-health.extensions.enabled")
+                        // no need to map to a quarkus option, this option exists to
+                        // to control artifact / extension inclusion. Quarkus will default to enabled
                         .build()
         };
     }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HostnameV2PropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HostnameV2PropertyMappers.java
index 004a8847c765..a8fb427bdd7c 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HostnameV2PropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HostnameV2PropertyMappers.java
@@ -2,18 +2,24 @@
 
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
+import java.net.MalformedURLException;
+import java.net.URL;
 import java.util.Arrays;
 import java.util.List;
+import java.util.function.Consumer;
 import java.util.stream.Stream;
 
-import org.jboss.logging.Logger;
 import org.keycloak.common.Profile;
 import org.keycloak.config.HostnameV2Options;
+import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.cli.Picocli;
+import org.keycloak.config.ProxyOptions;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.utils.SecureContextResolver;
 
 public final class HostnameV2PropertyMappers {
-    
-    private static final Logger LOGGER = Logger.getLogger(PropertyMappers.class);
+
+    private static final String CONTEXT_WARNING = "the server is running in an insecure context. Secure contexts are required for full functionality, including cross-origin cookies.";
     private static final List<String> REMOVED_OPTIONS = Arrays.asList("hostname-admin-url", "hostname-path", "hostname-port", "hostname-strict-backchannel", "hostname-url", "proxy", "hostname-strict-https");
 
     private HostnameV2PropertyMappers(){}
@@ -21,26 +27,82 @@ private HostnameV2PropertyMappers(){}
     public static PropertyMapper<?>[] getHostnamePropertyMappers() {
         return Stream.of(
                 fromOption(HostnameV2Options.HOSTNAME)
-                        .to("kc.spi-hostname-v2-hostname")
+                        .to("kc.spi-hostname--v2--hostname")
                         .paramLabel("hostname|URL"),
                 fromOption(HostnameV2Options.HOSTNAME_ADMIN)
-                        .to("kc.spi-hostname-v2-hostname-admin")
+                        .to("kc.spi-hostname--v2--hostname-admin")
                         .paramLabel("URL"),
                 fromOption(HostnameV2Options.HOSTNAME_BACKCHANNEL_DYNAMIC)
-                        .to("kc.spi-hostname-v2-hostname-backchannel-dynamic"),
+                        .to("kc.spi-hostname--v2--hostname-backchannel-dynamic"),
                 fromOption(HostnameV2Options.HOSTNAME_STRICT)
-                        .to("kc.spi-hostname-v2-hostname-strict"),
+                        .to("kc.spi-hostname--v2--hostname-strict"),
                 fromOption(HostnameV2Options.HOSTNAME_DEBUG)
         )
         .map(b -> b.isEnabled(() -> Profile.isFeatureEnabled(Profile.Feature.HOSTNAME_V2), "hostname:v2 feature is enabled").build())
         .toArray(s -> new PropertyMapper<?>[s]);
     }
-    
-    public static void validateConfig() {
+
+    public static void validateConfig(Picocli picocli) {
+        validateConfig(picocli::warn);
+    }
+
+    public static void validateConfig(Consumer<String> warn) {
         List<String> inUse = REMOVED_OPTIONS.stream().filter(s -> Configuration.getOptionalKcValue(s).isPresent()).toList();
-        
+
         if (!inUse.isEmpty()) {
-            LOGGER.errorf("Hostname v1 options %s are still in use, please review your configuration", inUse);
+            warn.accept("Hostname v1 options %s are still in use, please review your configuration".formatted(inUse));
+        }
+        boolean isProd = Environment.PROD_PROFILE_VALUE.equals(org.keycloak.common.util.Environment.getProfile());
+        boolean httpsEnabled = HttpPropertyMappers.isHttpsEnabled();
+        String host = Configuration.getConfigValue(HostnameV2Options.HOSTNAME).getValue();
+        String proxyHeaders = Configuration.getConfigValue(ProxyOptions.PROXY_HEADERS).getValue();
+        if (host != null && validateFullHostname(httpsEnabled, isProd, host, proxyHeaders, warn)) {
+            return;
+        }
+        if (httpsEnabled) {
+            return; // must be re-encrypt or passthrough. if passthrough, proxy headers must not be set
+        }
+        // should be edge
+        if (proxyHeaders != null) {
+            return;
+        }
+        if (isProd) {
+            String warning = CONTEXT_WARNING + " Also if you are using a proxy, requests from the proxy to the server will fail CORS checks with 403s because the wrong origin will be determined. Make sure `proxy-headers` are configured properly.";
+            if (host == null) {
+                warn.accept("With HTTPS not enabled, `proxy-headers` unset, and `hostname-strict=false`, " + warning);
+            } else if (!SecureContextResolver.isLocal(host)) {
+                warn.accept("Likely misconfiguration detected. With HTTPS not enabled, `proxy-headers` unset, and a non-URL `hostname`, " + warning);
+            } // else warn on prod
+        }
+    }
+
+    static boolean validateFullHostname(boolean httpsEnabled, boolean isProd, String host, String proxyHeaders, Consumer<String> warn) {
+        try {
+            URL url = new URL(host);
+
+            if (!url.getProtocol().toUpperCase().equals("HTTPS")) {
+                if (isProd) {
+                    if (!SecureContextResolver.isLocal(url.getHost())) {
+                        warn.accept("Likely misconfiguration detected. `hostname` is configured to use HTTP instead of HTTPS, " + CONTEXT_WARNING);
+
+                        // TODO: any hostname-admin specific validation?
+
+                    } // else warn on prod?
+                    if (httpsEnabled) {
+                        warn.accept("Likely misconfiguration detected. HTTPS is enabled on the server, but `hostname` specifies HTTP.");
+                    }
+                }
+            } else if (proxyHeaders == null) {
+                if (!httpsEnabled) {
+                    // edge case
+                    warn.accept("Likely misconfiguration detected. When using an edge proxy, you must use `proxy-headers`.");
+                }
+                // else might be allowable if HOST is overwritten
+            }
+
+            return true;
+        } catch (MalformedURLException e) {
+            return false;
         }
     }
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HttpPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HttpPropertyMappers.java
index b058a69d7112..7519c1b74d9f 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HttpPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HttpPropertyMappers.java
@@ -1,7 +1,6 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
 import io.quarkus.runtime.util.ClassPathUtils;
-import io.quarkus.vertx.http.runtime.CertificateConfig;
 import io.quarkus.vertx.http.runtime.options.TlsUtils;
 import io.smallrye.config.ConfigSourceInterceptorContext;
 
@@ -10,16 +9,17 @@
 import org.keycloak.config.SecurityOptions;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.Messages;
+import org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
 
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
-import java.util.List;
 import java.util.Optional;
 
+import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalKcValue;
+import static org.keycloak.quarkus.runtime.configuration.Configuration.getOptionalValue;
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
 public final class HttpPropertyMappers {
@@ -28,12 +28,33 @@ public final class HttpPropertyMappers {
     private static final String QUARKUS_HTTPS_CERT_KEY_FILES = "quarkus.http.ssl.certificate.key-files";
     private static final String QUARKUS_HTTPS_KEY_STORE_FILE = "quarkus.http.ssl.certificate.key-store-file";
     private static final String QUARKUS_HTTPS_TRUST_STORE_FILE = "quarkus.http.ssl.certificate.trust-store-file";
-    private static final String QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE = "quarkus.http.ssl.certificate.trust-store-file-type";
+    public static final String QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE = "quarkus.http.ssl.certificate.trust-store-file-type";
     private static final String QUARKUS_HTTPS_KEY_STORE_FILE_TYPE = "quarkus.http.ssl.certificate.key-store-file-type";
 
     private HttpPropertyMappers(){}
 
+    // Transform runtime exceptions obtained from Quarkus to ours with a relevant message
+    private static void setCustomExceptionTransformer() {
+        ExecutionExceptionHandler.addExceptionTransformer(TlsUtils.class, exception -> {
+            if (exception instanceof IOException ioe) {
+                return new PropertyException("Failed to load 'https-trust-store' or 'https-key-' material: " + ioe.getClass().getSimpleName() + " " + ioe.getMessage(), ioe);
+            } else if (exception instanceof IllegalArgumentException iae) {
+                if (iae.getMessage().contains(QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE)) {
+                    return new PropertyException("Unable to determine 'https-trust-store-type' automatically. " +
+                            "Adjust the file extension or specify the property.", iae);
+                } else if (iae.getMessage().contains(QUARKUS_HTTPS_KEY_STORE_FILE_TYPE)) {
+                    return new PropertyException("Unable to determine 'https-key-store-type' automatically. " +
+                            "Adjust the file extension or specify the property.", iae);
+                } else {
+                    return new PropertyException(iae.getMessage(), iae);
+                }
+            }
+            return exception;
+        });
+    }
+
     public static PropertyMapper<?>[] getHttpPropertyMappers() {
+        setCustomExceptionTransformer();
         return new PropertyMapper[] {
                 fromOption(HttpOptions.HTTP_ENABLED)
                         .to("quarkus.http.insecure-requests")
@@ -72,8 +93,7 @@ public static PropertyMapper<?>[] getHttpPropertyMappers() {
                         .build(),
                 fromOption(HttpOptions.HTTPS_CERTIFICATES_RELOAD_PERIOD)
                         .to("quarkus.http.ssl.certificate.reload-period")
-                        // -1 means no reload
-                        .transformer((value, context) -> "-1".equals(value) ? null : value)
+                        .transformer(HttpPropertyMappers::transformNegativeReloadPeriod)
                         .paramLabel("reload period")
                         .build(),
                 fromOption(HttpOptions.HTTPS_CERTIFICATE_FILE)
@@ -115,7 +135,6 @@ public static PropertyMapper<?>[] getHttpPropertyMappers() {
                 fromOption(HttpOptions.HTTPS_TRUST_STORE_TYPE)
                         .mapFrom(SecurityOptions.FIPS_MODE, HttpPropertyMappers::resolveKeyStoreType)
                         .to(QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE)
-                        .transformer(HttpPropertyMappers::resolveKeyStoreType)
                         .paramLabel("type")
                         .build(),
                 fromOption(HttpOptions.HTTP_MAX_QUEUED_REQUESTS)
@@ -138,57 +157,16 @@ public static PropertyMapper<?>[] getHttpPropertyMappers() {
     }
 
     public static void validateConfig() {
-        boolean enabled = isHttpEnabled(Configuration.getOptionalKcValue(HttpOptions.HTTP_ENABLED.getKey()).orElse(null));
-        Optional<String> certFile = Configuration.getOptionalValue(QUARKUS_HTTPS_CERT_FILES);
-        Optional<String> keystoreFile = Configuration.getOptionalValue(QUARKUS_HTTPS_KEY_STORE_FILE);
-        if (!enabled && certFile.isEmpty() && keystoreFile.isEmpty()) {
+        boolean enabled = isHttpEnabled(getOptionalKcValue(HttpOptions.HTTP_ENABLED.getKey()).orElse(null));
+        if (!enabled && !isHttpsEnabled()) {
             throw new PropertyException(Messages.httpsConfigurationNotSet());
         }
+    }
 
-        CertificateConfig config = new CertificateConfig();
-
-        config.trustStoreFile = Configuration.getOptionalValue(QUARKUS_HTTPS_TRUST_STORE_FILE).map(Paths::get);
-        config.trustStorePassword = Configuration.getOptionalKcValue(HttpOptions.HTTPS_TRUST_STORE_PASSWORD.getKey());
-        config.trustStoreFileType = Configuration.getOptionalValue(QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE);
-        config.trustStoreProvider = Configuration.getOptionalValue("quarkus.http.ssl.certificate.trust-store-provider");
-        config.trustStoreCertAlias = Configuration.getOptionalValue("quarkus.http.ssl.certificate.trust-store-cert-alias");
-        config.trustStoreFiles = Optional.empty();
-
-        config.keyStoreFile = keystoreFile.map(Paths::get);
-        config.keyStorePassword = Configuration.getOptionalKcValue(HttpOptions.HTTPS_KEY_STORE_PASSWORD.getKey());
-        config.keyStoreFileType = Configuration.getOptionalValue(QUARKUS_HTTPS_KEY_STORE_FILE_TYPE);
-        config.keyStoreProvider = Configuration.getOptionalValue("quarkus.http.ssl.certificate.key-store-provider");
-        config.keyStoreAlias = Configuration.getOptionalValue("quarkus.http.ssl.certificate.key-store-alias");
-        config.keyStoreAliasPassword = Configuration.getOptionalValue("quarkus.http.ssl.certificate.key-store-alias-password");
-        config.keyStoreAliasPasswordKey = Configuration.getOptionalValue("quarkus.http.ssl.certificate.key-store-alias-password-key");
-        config.keyStoreKeyAlias = Configuration.getOptionalValue("quarkus.http.ssl.certificate.key-store-key-alias");
-        
-        config.keyFiles = Configuration.getOptionalValue(QUARKUS_HTTPS_CERT_KEY_FILES).map(Paths::get).map(List::of);
-        config.files = certFile.map(Paths::get).map(List::of);
-
-        try {
-            TlsUtils.computeTrustOptions(config, config.trustStorePassword);
-        } catch (IOException e) {
-            throw new PropertyException("Failed to load 'https-trust-store' material: " + e.getClass().getSimpleName() + " " + e.getMessage(), e);
-        } catch (IllegalArgumentException e) {
-            if (e.getMessage().contains(QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE)) {
-                throw new PropertyException("Unable to determine 'https-trust-store-type' automatically. " +
-                        "Adjust the file extension or specify the property.", e);
-            }
-            throw new PropertyException(e.getMessage(), e);
-        }
-
-        try {
-            TlsUtils.computeKeyStoreOptions(config, config.keyStorePassword, config.keyStoreAliasPassword);
-        } catch (IOException e) {
-            throw new PropertyException("Failed to load 'https-key-' material: " + e.getClass().getSimpleName() + " " + e.getMessage(), e);
-        } catch (IllegalArgumentException e) {
-            if (e.getMessage().contains(QUARKUS_HTTPS_KEY_STORE_FILE_TYPE)) {
-                throw new PropertyException("Unable to determine 'https-key-store-type' automatically. " +
-                        "Adjust the file extension or specify the property.", e);
-            }
-            throw new PropertyException(e.getMessage(), e);
-        }
+    public static boolean isHttpsEnabled() {
+        Optional<String> certFile = getOptionalValue(QUARKUS_HTTPS_CERT_FILES);
+        Optional<String> keystoreFile = getOptionalValue(QUARKUS_HTTPS_KEY_STORE_FILE);
+        return certFile.isPresent() || keystoreFile.isPresent();
     }
 
     private static String transformPath(String value, ConfigSourceInterceptorContext context) {
@@ -199,6 +177,11 @@ private static String getHttpEnabledTransformer(String value, ConfigSourceInterc
         return isHttpEnabled(value) ? "enabled" : "disabled";
     }
 
+    static String transformNegativeReloadPeriod(String value, ConfigSourceInterceptorContext context) {
+        // -1 means no reload
+        return "-1".equals(value) ? null : value;
+    }
+
     private static boolean isHttpEnabled(String value) {
         if (Environment.isDevMode() || Environment.isNonServerMode()) {
             return true;
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ImportPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ImportPropertyMappers.java
index 78d3330b1858..01bd0072d9ff 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ImportPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ImportPropertyMappers.java
@@ -31,7 +31,7 @@
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
 public final class ImportPropertyMappers {
-    private static final String IMPORTER_PROPERTY = "kc.spi-import-importer";
+    private static final String IMPORTER_PROPERTY = "kc.spi-import--importer";
     private static final String SINGLE_FILE = "singleFile";
     private static final String DIR = "dir";
 
@@ -46,20 +46,20 @@ public static PropertyMapper<?>[] getMappers() {
                         .paramLabel("file")
                         .build(),
                 fromOption(ImportOptions.FILE)
-                        .to("kc.spi-import-single-file-file")
+                        .to("kc.spi-import--single-file--file")
                         .paramLabel("file")
                         .build(),
                 fromOption(ImportOptions.DIR)
-                        .to("kc.spi-import-dir-dir")
+                        .to("kc.spi-import--dir--dir")
                         .paramLabel("dir")
                         .build(),
                 fromOption(ImportOptions.OVERRIDE)
-                        .to("kc.spi-import-single-file-strategy")
+                        .to("kc.spi-import--single-file--strategy")
                         .transformer(ImportPropertyMappers::transformOverride)
                         .isEnabled(ImportPropertyMappers::isSingleFileProvider)
                         .build(),
                 fromOption(ImportOptions.OVERRIDE)
-                        .to("kc.spi-import-dir-strategy")
+                        .to("kc.spi-import--dir--strategy")
                         .transformer(ImportPropertyMappers::transformOverride)
                         .isEnabled(ImportPropertyMappers::isDirProvider)
                         .build(),
@@ -107,8 +107,8 @@ private static String transformImporter(String option, ConfigSourceInterceptorCo
             return importer.getValue();
         }
 
-        var file = getOptionalValue("kc.spi-import-single-file-file").map(f -> SINGLE_FILE);
-        var dir = getOptionalValue("kc.spi-import-dir-dir")
+        var file = getOptionalValue("kc.spi-import--single-file--file").map(f -> SINGLE_FILE);
+        var dir = getOptionalValue("kc.spi-import--dir--dir")
                 .or(() -> getOptionalValue("kc.dir"))
                 .map(f -> DIR);
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/LoggingPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/LoggingPropertyMappers.java
index 8caa7d10ab39..d6dd5082a39f 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/LoggingPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/LoggingPropertyMappers.java
@@ -1,15 +1,25 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
 import static org.keycloak.config.LoggingOptions.DEFAULT_LOG_FORMAT;
+import static org.keycloak.config.LoggingOptions.LOG_CONSOLE_ENABLED;
+import static org.keycloak.config.LoggingOptions.LOG_FILE_ENABLED;
+import static org.keycloak.config.LoggingOptions.LOG_SYSLOG_ENABLED;
+import static org.keycloak.config.LoggingOptions.SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT;
+import static org.keycloak.quarkus.runtime.configuration.Configuration.isSet;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.isTrue;
 import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.fromOption;
 
 import java.io.File;
-import java.util.List;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.function.BiFunction;
 import java.util.logging.Level;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import io.quarkus.runtime.configuration.MemorySizeConverter;
@@ -29,18 +39,23 @@ public final class LoggingPropertyMappers {
     private static final String SYSLOG_ENABLED_MSG = "Syslog is activated";
     private static final String DEFAULT_ROOT_LOG_LEVEL = toLevel(LoggingOptions.LOG_LEVEL.getDefaultValue().orElseThrow().get(0)).getName();
 
+    private final static Map<String, Map<String, String>> rootLogLevels = new HashMap<String, Map<String,String>>();
+
     private LoggingPropertyMappers() {
     }
 
     public static PropertyMapper<?>[] getMappers() {
+        rootLogLevels.clear(); // reset the cached root log level and categories
         PropertyMapper<?>[] defaultMappers = new PropertyMapper[]{
                 fromOption(LoggingOptions.LOG)
                         .paramLabel("<handler>")
                         .build(),
+                fromOption(LoggingOptions.LOG_ASYNC)
+                        .build(),
                 // Console
                 fromOption(LoggingOptions.LOG_CONSOLE_OUTPUT)
                         .isEnabled(LoggingPropertyMappers::isConsoleEnabled, CONSOLE_ENABLED_MSG)
-                        .to("quarkus.log.console.json")
+                        .to("quarkus.log.console.json.enabled")
                         .paramLabel("output")
                         .transformer(LoggingPropertyMappers::resolveLogOutput)
                         .build(),
@@ -56,6 +71,11 @@ public static PropertyMapper<?>[] getMappers() {
                         .paramLabel("format")
                         .transformer((value, ctx) -> addTracingInfo(value, LoggingOptions.LOG_CONSOLE_INCLUDE_TRACE))
                         .build(),
+                fromOption(LoggingOptions.LOG_CONSOLE_JSON_FORMAT)
+                        .isEnabled(LoggingPropertyMappers::isConsoleJsonEnabled, "%s and output is set to 'json'".formatted(CONSOLE_ENABLED_MSG))
+                        .to("quarkus.log.console.json.log-format")
+                        .paramLabel("format")
+                        .build(),
                 fromOption(LoggingOptions.LOG_CONSOLE_INCLUDE_TRACE)
                         .isEnabled(() -> LoggingPropertyMappers.isConsoleEnabled() && TracingPropertyMappers.isTracingEnabled(),
                                 "Console log handler and Tracing is activated")
@@ -68,6 +88,17 @@ public static PropertyMapper<?>[] getMappers() {
                         .mapFrom(LoggingOptions.LOG, LoggingPropertyMappers.resolveLogHandler(LoggingOptions.DEFAULT_LOG_HANDLER.name()))
                         .to("quarkus.log.console.enable")
                         .build(),
+                // Console async
+                fromOption(LoggingOptions.LOG_CONSOLE_ASYNC)
+                        .mapFrom(LoggingOptions.LOG_ASYNC)
+                        .isEnabled(LoggingPropertyMappers::isConsoleEnabled, CONSOLE_ENABLED_MSG)
+                        .to("quarkus.log.console.async")
+                        .build(),
+                fromOption(LoggingOptions.LOG_CONSOLE_ASYNC_QUEUE_LENGTH)
+                        .isEnabled(LoggingPropertyMappers::isConsoleAsyncEnabled, "%s and asynchronous logging is enabled".formatted(CONSOLE_ENABLED_MSG))
+                        .to("quarkus.log.console.async.queue-length")
+                        .paramLabel("queue-length")
+                        .build(),
                 // File
                 fromOption(LoggingOptions.LOG_FILE_ENABLED)
                         .mapFrom(LoggingOptions.LOG, LoggingPropertyMappers.resolveLogHandler("file"))
@@ -91,16 +122,32 @@ public static PropertyMapper<?>[] getMappers() {
                         .paramLabel("format")
                         .transformer((value, ctx) -> addTracingInfo(value, LoggingOptions.LOG_FILE_INCLUDE_TRACE))
                         .build(),
+                fromOption(LoggingOptions.LOG_FILE_JSON_FORMAT)
+                        .isEnabled(LoggingPropertyMappers::isFileJsonEnabled, FILE_ENABLED_MSG + " and output is set to 'json'")
+                        .to("quarkus.log.file.json.log-format")
+                        .paramLabel("format")
+                        .build(),
                 fromOption(LoggingOptions.LOG_FILE_INCLUDE_TRACE)
                         .isEnabled(() -> LoggingPropertyMappers.isFileEnabled() && TracingPropertyMappers.isTracingEnabled(),
                                 "File log handler and Tracing is activated")
                         .build(),
                 fromOption(LoggingOptions.LOG_FILE_OUTPUT)
                         .isEnabled(LoggingPropertyMappers::isFileEnabled, FILE_ENABLED_MSG)
-                        .to("quarkus.log.file.json")
+                        .to("quarkus.log.file.json.enabled")
                         .paramLabel("output")
                         .transformer(LoggingPropertyMappers::resolveLogOutput)
                         .build(),
+                // File async
+                fromOption(LoggingOptions.LOG_FILE_ASYNC)
+                        .mapFrom(LoggingOptions.LOG_ASYNC)
+                        .isEnabled(LoggingPropertyMappers::isFileEnabled, FILE_ENABLED_MSG)
+                        .to("quarkus.log.file.async")
+                        .build(),
+                fromOption(LoggingOptions.LOG_FILE_ASYNC_QUEUE_LENGTH)
+                        .isEnabled(LoggingPropertyMappers::isFileAsyncEnabled, "%s and asynchronous logging is enabled".formatted(FILE_ENABLED_MSG))
+                        .to("quarkus.log.file.async.queue-length")
+                        .paramLabel("queue-length")
+                        .build(),
                 // Log level
                 fromOption(LoggingOptions.LOG_LEVEL)
                         .to("quarkus.log.level")
@@ -112,7 +159,7 @@ public static PropertyMapper<?>[] getMappers() {
                         .to("quarkus.log.category.\"<categories>\".level")
                         .validator(LoggingPropertyMappers::validateCategoryLogLevel)
                         .wildcardKeysTransformer(LoggingPropertyMappers::getConfiguredLogCategories)
-                        .transformer((v,c) -> toLevel(v).getName())
+                        .transformer((v,c) -> v == null ? null : toLevel(v).getName())
                         .wildcardMapFrom(LoggingOptions.LOG_LEVEL, LoggingPropertyMappers::resolveCategoryLogLevelFromParentLogLevelOption) // a fallback to log-level
                         .paramLabel("level")
                         .build(),
@@ -159,31 +206,97 @@ public static PropertyMapper<?>[] getMappers() {
                         .paramLabel("format")
                         .transformer((value, ctx) -> addTracingInfo(value, LoggingOptions.LOG_SYSLOG_INCLUDE_TRACE))
                         .build(),
+                fromOption(LoggingOptions.LOG_SYSLOG_JSON_FORMAT)
+                        .isEnabled(LoggingPropertyMappers::isSyslogJsonEnabled, SYSLOG_ENABLED_MSG + " and output is set to 'json'")
+                        .to("quarkus.log.syslog.json.log-format")
+                        .paramLabel("format")
+                        .build(),
                 fromOption(LoggingOptions.LOG_SYSLOG_INCLUDE_TRACE)
                         .isEnabled(() -> LoggingPropertyMappers.isSyslogEnabled() && TracingPropertyMappers.isTracingEnabled(),
                                 "Syslog handler and Tracing is activated")
                         .build(),
                 fromOption(LoggingOptions.LOG_SYSLOG_OUTPUT)
                         .isEnabled(LoggingPropertyMappers::isSyslogEnabled, SYSLOG_ENABLED_MSG)
-                        .to("quarkus.log.syslog.json")
+                        .to("quarkus.log.syslog.json.enabled")
                         .paramLabel("output")
                         .transformer(LoggingPropertyMappers::resolveLogOutput)
                         .build(),
+                fromOption(LoggingOptions.LOG_SYSLOG_COUNTING_FRAMING)
+                        .isEnabled(LoggingPropertyMappers::isSyslogEnabled, SYSLOG_ENABLED_MSG)
+                        .transformer(LoggingPropertyMappers::resolveSyslogCountingFraming)
+                        .to("quarkus.log.syslog.use-counting-framing")
+                        .paramLabel("strategy")
+                        .build(),
+                // Syslog async
+                fromOption(LoggingOptions.LOG_SYSLOG_ASYNC)
+                        .mapFrom(LoggingOptions.LOG_ASYNC)
+                        .isEnabled(LoggingPropertyMappers::isSyslogEnabled, SYSLOG_ENABLED_MSG)
+                        .to("quarkus.log.syslog.async")
+                        .build(),
+                fromOption(LoggingOptions.LOG_SYSLOG_ASYNC_QUEUE_LENGTH)
+                        .isEnabled(LoggingPropertyMappers::isSyslogAsyncEnabled, "%s and asynchronous logging is enabled".formatted(SYSLOG_ENABLED_MSG))
+                        .to("quarkus.log.syslog.async.queue-length")
+                        .paramLabel("queue-length")
+                        .build(),
         };
 
         return defaultMappers;
     }
 
     public static boolean isConsoleEnabled() {
-        return isTrue(LoggingOptions.LOG_CONSOLE_ENABLED);
+        return isHandlerEnabled(LoggingOptions.Handler.console);
+    }
+
+    public static boolean isConsoleAsyncEnabled() {
+        return isHandlerAsyncEnabled(LoggingOptions.Handler.console);
+    }
+
+    public static boolean isConsoleJsonEnabled() {
+        return isConsoleEnabled() && isTrue("quarkus.log.console.json.enabled");
     }
 
     public static boolean isFileEnabled() {
-        return isTrue(LoggingOptions.LOG_FILE_ENABLED);
+        return isHandlerEnabled(LoggingOptions.Handler.file);
+    }
+
+    public static boolean isFileAsyncEnabled() {
+        return isHandlerAsyncEnabled(LoggingOptions.Handler.file);
+    }
+
+    public static boolean isFileJsonEnabled() {
+        return isFileEnabled() && isTrue("quarkus.log.file.json.enabled");
     }
 
     public static boolean isSyslogEnabled() {
-        return isTrue(LoggingOptions.LOG_SYSLOG_ENABLED);
+        return isHandlerEnabled(LoggingOptions.Handler.syslog);
+    }
+
+    public static boolean isSyslogAsyncEnabled() {
+        return isHandlerAsyncEnabled(LoggingOptions.Handler.syslog);
+    }
+
+    public static boolean isSyslogJsonEnabled() {
+        return isSyslogEnabled() && isTrue("quarkus.log.syslog.json.enabled");
+    }
+
+    private static boolean isHandlerEnabled(LoggingOptions.Handler handler) {
+        return switch (handler) {
+            case console -> isTrue(LOG_CONSOLE_ENABLED);
+            case file -> isTrue(LOG_FILE_ENABLED);
+            case syslog -> isTrue(LOG_SYSLOG_ENABLED);
+        };
+    }
+
+    private static boolean isHandlerAsyncEnabled(LoggingOptions.Handler handler) {
+        if (!isHandlerEnabled(handler)) {
+            return false;
+        }
+        var property = switch (handler) {
+            case console -> LoggingOptions.LOG_CONSOLE_ASYNC;
+            case file -> LoggingOptions.LOG_FILE_ASYNC;
+            case syslog -> LoggingOptions.LOG_SYSLOG_ASYNC;
+        };
+        return isSet(property) ? isTrue(property) : isTrue(LoggingOptions.LOG_ASYNC);
     }
 
     private static BiFunction<String, ConfigSourceInterceptorContext, String> resolveLogHandler(String handler) {
@@ -213,6 +326,9 @@ private static CategoryLevel validateLogLevel(String level) {
             categoryLevel = parts[0];
         } else if (parts.length == 2) {
             category = parts[0];
+            if (!WildcardPropertyMapper.isValidWildcardValue(category)) {
+                throw new PropertyException("logging category '%s' is not valid".formatted(category));
+            }
             categoryLevel = parts[1];
         } else {
             throw new PropertyException(Messages.invalidLogCategoryFormat(level));
@@ -227,21 +343,11 @@ private static CategoryLevel validateLogLevel(String level) {
     }
 
     private static String resolveRootLogLevel(String value, ConfigSourceInterceptorContext configSourceInterceptorContext) {
-        for (CategoryLevel categoryLevel : parseLogLevels(value)) {
-            if (categoryLevel.category == null) {
-                return categoryLevel.levelName;
-            }
-        }
-        return DEFAULT_ROOT_LOG_LEVEL; // defaults are not resolved in the mapper if transformer is present, so doing it explicitly here
+        return parseRootLogLevel(value).getOrDefault(null, DEFAULT_ROOT_LOG_LEVEL); // defaults are not resolved in the mapper if transformer is present, so doing it explicitly here
     }
 
-    private static Set<String> getConfiguredLogCategories(Set<String> categories) {
-        for (CategoryLevel categoryLevel : parseLogLevels(Configuration.getKcConfigValue("log-level").getValue())) {
-            if (categoryLevel.category != null) {
-                categories.add(categoryLevel.category);
-            }
-        }
-        return categories;
+    private static Set<String> getConfiguredLogCategories(String value, Set<String> categories) {
+        return parseRootLogLevel(value).keySet().stream().filter(Objects::nonNull).collect(Collectors.toCollection(LinkedHashSet::new));
     }
 
     private static void validateCategoryLogLevel(String logLevel) {
@@ -253,25 +359,17 @@ private static void validateCategoryLogLevel(String logLevel) {
     }
 
     private static String resolveCategoryLogLevelFromParentLogLevelOption(String category, String parentLogLevelValue, ConfigSourceInterceptorContext context) {
-        String rootLevel = DEFAULT_ROOT_LOG_LEVEL;
-        for (CategoryLevel categoryLevel : parseLogLevels(parentLogLevelValue)) {
-            if (category.equals(categoryLevel.category)) {
-                return categoryLevel.levelName;
-            } else if (categoryLevel.category == null) {
-                rootLevel = categoryLevel.levelName;
-            }
-        }
-        return rootLevel;
+        return parseRootLogLevel(parentLogLevelValue).get(category);
     }
 
-    private static List<CategoryLevel> parseLogLevels(String value) {
-        if (value == null) {
-            return List.of();
+    private static Map<String, String> parseRootLogLevel(String values) {
+        if (values == null) {
+            return Map.of(); // if no value is present, we do not cache the result
         }
-
-        return Stream.of(value.split(","))
+        // it's possible to have more than one root if not reset during tests, or we are unexpectedly parsing the default
+        return rootLogLevels.computeIfAbsent(values, key -> Stream.of(values.split(","))
                 .map(LoggingPropertyMappers::validateLogLevel)
-                .toList();
+                .collect(Collectors.toMap(CategoryLevel::category, CategoryLevel::levelName, (s1, s2) -> s1, LinkedHashMap::new)));
     }
 
     private static String resolveLogOutput(String value, ConfigSourceInterceptorContext context) {
@@ -284,7 +382,7 @@ private static String resolveLogOutput(String value, ConfigSourceInterceptorCont
      */
     private static String addTracingInfo(String value, Option<Boolean> includeTraceOption) {
         var isTracingEnabled = TracingPropertyMappers.isTracingEnabled();
-        var includeTrace = Configuration.isTrue(includeTraceOption);
+        var includeTrace = isTrue(includeTraceOption);
         var isChangedLogFormat = !DEFAULT_LOG_FORMAT.equals(value);
 
         if (!isTracingEnabled || !includeTrace || isChangedLogFormat) {
@@ -306,4 +404,20 @@ private static void validateSyslogMaxLength(String value) {
             throw new PropertyException(String.format("Invalid value for option '--log-syslog-max-length': %s", e.getMessage()));
         }
     }
+
+    // Workaround BEGIN - for https://github.com/keycloak/keycloak/issues/39893
+    // Remove once the https://github.com/quarkusio/quarkus/issues/48036 is included in Keycloak as Quarkus might handle it on its own
+    private static String resolveSyslogCountingFraming(String value, ConfigSourceInterceptorContext context) {
+        if (SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT.equals(value)) {
+            return Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_PROTOCOL)
+                    .map(protocol -> switch (protocol) {
+                        case "tcp", "ssl-tcp" -> Boolean.TRUE.toString();
+                        case "udp" -> Boolean.FALSE.toString();
+                        default -> throw new PropertyException("Invalid Syslog protocol: " + protocol);
+                    })
+                    .orElse(Boolean.FALSE.toString());
+        }
+        return value;
+    }
+    // Workaround END
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ManagementPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ManagementPropertyMappers.java
index c4d1bc941c7d..ac69fe333f89 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ManagementPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ManagementPropertyMappers.java
@@ -19,9 +19,8 @@
 import org.keycloak.config.HealthOptions;
 import org.keycloak.config.HttpOptions;
 import org.keycloak.config.ManagementOptions;
+import org.keycloak.config.ManagementOptions.Scheme;
 import org.keycloak.config.MetricsOptions;
-import org.keycloak.quarkus.runtime.Messages;
-import org.keycloak.quarkus.runtime.cli.PropertyException;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 
 import static org.keycloak.config.ManagementOptions.LEGACY_OBSERVABILITY_INTERFACE;
@@ -30,6 +29,8 @@
 
 public class ManagementPropertyMappers {
 
+    private static final String HTTP_MANAGEMENT_SCHEME_IS_INHERITED = "http-management-scheme is inherited";
+
     private ManagementPropertyMappers() {
     }
 
@@ -56,47 +57,60 @@ public static PropertyMapper<?>[] getManagementPropertyMappers() {
                         .paramLabel("host")
                         .build(),
                 // HTTPS
+                fromOption(ManagementOptions.HTTP_MANAGEMENT_SCHEME)
+                        .paramLabel("scheme")
+                        .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_CLIENT_AUTH)
-                        .mapFrom(HttpOptions.HTTPS_CLIENT_AUTH)
+                        .mapFrom(HttpOptions.HTTPS_CLIENT_AUTH) // we can't check inherited because this is a build time option
                         .to("quarkus.management.ssl.client-auth")
                         .paramLabel("auth")
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_CIPHER_SUITES)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_CIPHER_SUITES)
                         .to("quarkus.management.ssl.cipher-suites")
                         .paramLabel("ciphers")
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_PROTOCOLS)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_PROTOCOLS)
                         .to("quarkus.management.ssl.protocols")
                         .paramLabel("protocols")
                         .build(),
+                fromOption(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATES_RELOAD_PERIOD)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
+                        .mapFrom(HttpOptions.HTTPS_CERTIFICATES_RELOAD_PERIOD)
+                        .to("quarkus.management.ssl.certificate.reload-period")
+                        .transformer(HttpPropertyMappers::transformNegativeReloadPeriod)
+                        .paramLabel("reload period")
+                        .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_FILE)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_CERTIFICATE_FILE)
                         .to("quarkus.management.ssl.certificate.files")
-                        .validator(value -> validateTlsProperties())
                         .paramLabel("file")
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_KEY_FILE)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_CERTIFICATE_KEY_FILE)
                         .to("quarkus.management.ssl.certificate.key-files")
-                        .validator(value -> validateTlsProperties())
                         .paramLabel("file")
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_KEY_STORE_FILE)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_KEY_STORE_FILE)
                         .to("quarkus.management.ssl.certificate.key-store-file")
-                        .validator(value -> validateTlsProperties())
                         .paramLabel("file")
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_KEY_STORE_PASSWORD)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_KEY_STORE_PASSWORD)
                         .to("quarkus.management.ssl.certificate.key-store-password")
-                        .validator(value -> validateTlsProperties())
                         .paramLabel("password")
                         .isMasked(true)
                         .build(),
                 fromOption(ManagementOptions.HTTPS_MANAGEMENT_KEY_STORE_TYPE)
+                        .isEnabled(ManagementPropertyMappers::isInheritedScheme, HTTP_MANAGEMENT_SCHEME_IS_INHERITED)
                         .mapFrom(HttpOptions.HTTPS_KEY_STORE_TYPE)
                         .to("quarkus.management.ssl.certificate.key-store-file-type")
                         .paramLabel("type")
@@ -116,19 +130,23 @@ private static String managementEnabledTransformer() {
         return Boolean.toString(isManagementEnabled());
     }
 
-    public static boolean isManagementTlsEnabled() {
-        var key = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_KEY_FILE.getKey());
-        var cert = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_FILE.getKey());
-        if (key.isPresent() && cert.isPresent()) return true;
-
-        var keystore = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_KEY_STORE_FILE.getKey());
-        return keystore.isPresent();
+    public static boolean isInheritedScheme() {
+        return !Scheme.http.name()
+                .equals(Configuration.getKcConfigValue(ManagementOptions.HTTP_MANAGEMENT_SCHEME.getKey()).getValue());
     }
 
-    private static void validateTlsProperties() {
-        var isHttpEnabled = Configuration.isTrue(HttpOptions.HTTP_ENABLED);
-        if (!isHttpEnabled && !isManagementTlsEnabled()) {
-            throw new PropertyException(Messages.httpsConfigurationNotSet());
+    public static boolean isManagementTlsEnabled() {
+        if (isInheritedScheme()) {
+            var key = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_KEY_FILE.getKey());
+            var cert = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_CERTIFICATE_FILE.getKey());
+            if (key.isPresent() && cert.isPresent()) {
+                return true;
+            }
+
+            var keystore = Configuration.getOptionalKcValue(ManagementOptions.HTTPS_MANAGEMENT_KEY_STORE_FILE.getKey());
+            return keystore.isPresent();
         }
+        return false;
     }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/MetricsPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/MetricsPropertyMappers.java
index bb7763462d86..3dfce14864f9 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/MetricsPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/MetricsPropertyMappers.java
@@ -18,7 +18,12 @@ public static PropertyMapper<?>[] getMetricsPropertyMappers() {
                         .to("quarkus.micrometer.enabled")
                         .build(),
                 fromOption(MetricsOptions.PASSWORD_VALIDATION_COUNTER_ENABLED)
-                        .to("kc.spi-credential-keycloak-password-metrics-enabled")
+                        .to("kc.spi-credential--keycloak-password--metrics-enabled")
+                        .isEnabled(MetricsPropertyMappers::metricsEnabled, "metrics are enabled")
+                        .build(),
+                fromOption(MetricsOptions.INFINISPAN_METRICS_ENABLED)
+                        .mapFrom(MetricsOptions.METRICS_ENABLED)
+                        .to("kc.spi-cache-embedded--default--metrics-enabled")
                         .isEnabled(MetricsPropertyMappers::metricsEnabled, "metrics are enabled")
                         .build()
         };
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
index bb23e383431e..69a83b848c09 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
@@ -17,12 +17,9 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
 import static java.util.Optional.ofNullable;
-import static org.keycloak.config.Option.WILDCARD_PLACEHOLDER_PATTERN;
-import static org.keycloak.quarkus.runtime.Environment.isRebuild;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR;
-import static org.keycloak.quarkus.runtime.configuration.Configuration.OPTION_PART_SEPARATOR_CHAR;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.toCliFormat;
 import static org.keycloak.quarkus.runtime.configuration.Configuration.toEnvVarFormat;
+import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
 
 import java.util.Iterator;
 import java.util.List;
@@ -33,14 +30,8 @@
 import java.util.function.BiFunction;
 import java.util.function.BooleanSupplier;
 import java.util.function.Consumer;
-import java.util.function.Function;
 import java.util.stream.Stream;
 
-import io.smallrye.config.ConfigSourceInterceptorContext;
-import io.smallrye.config.ConfigValue;
-import io.smallrye.config.ConfigValue.ConfigValueBuilder;
-import io.smallrye.config.ExpressionConfigSourceInterceptor;
-import io.smallrye.config.Expressions;
 import org.keycloak.config.DeprecatedMetadata;
 import org.keycloak.config.Option;
 import org.keycloak.config.OptionCategory;
@@ -48,21 +39,26 @@
 import org.keycloak.quarkus.runtime.cli.PropertyException;
 import org.keycloak.quarkus.runtime.cli.ShortErrorMessageHandler;
 import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.configuration.KcEnvConfigSource;
 import org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider;
-import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
+import org.keycloak.quarkus.runtime.configuration.NestedPropertyMappingInterceptor;
 import org.keycloak.utils.StringUtil;
 
+import io.smallrye.config.ConfigSourceInterceptorContext;
+import io.smallrye.config.ConfigValue;
+import io.smallrye.config.ConfigValue.ConfigValueBuilder;
+import io.smallrye.config.ExpressionConfigSourceInterceptor;
+import io.smallrye.config.Expressions;
+
 public class PropertyMapper<T> {
 
     protected final Option<T> option;
     private final String to;
     private BooleanSupplier enabled;
     private String enabledWhen;
-    private final BiFunction<String, ConfigSourceInterceptorContext, String> mapper;
+    private final ValueMapper mapper;
     private final String mapFrom;
-    private final BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper;
+    private final ValueMapper parentMapper;
     private final boolean mask;
     private final String paramLabel;
     private final String envVarFormat;
@@ -73,19 +69,20 @@ public class PropertyMapper<T> {
     private final String requiredWhen;
     private final String from;
 
-    PropertyMapper(PropertyMapper<T> mapper, String from, String to, BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper) {
-        this(mapper.option, to, mapper.enabled, mapper.enabledWhen, mapper.mapper, mapper.mapFrom, parentMapper,
+    private final String namedProperty;
+
+    PropertyMapper(PropertyMapper<T> mapper, String from, String to, String mapFrom, String namedProperty, ValueMapper parentMapper) {
+        this(mapper.option, to, mapper.enabled, mapper.enabledWhen, mapper.mapper, mapFrom, parentMapper,
                 mapper.paramLabel, mapper.mask, mapper.validator, mapper.description, mapper.required,
-                mapper.requiredWhen, from);
+                mapper.requiredWhen, from, namedProperty);
     }
 
     PropertyMapper(Option<T> option, String to, BooleanSupplier enabled, String enabledWhen,
-                   BiFunction<String, ConfigSourceInterceptorContext, String> mapper,
-                   String mapFrom, BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper,
+                   ValueMapper mapper, String mapFrom, ValueMapper parentMapper,
                    String paramLabel, boolean mask, BiConsumer<PropertyMapper<T>, ConfigValue> validator,
-                   String description, BooleanSupplier required, String requiredWhen, String from) {
+                   String description, BooleanSupplier required, String requiredWhen, String from, String namedProperty) {
         this.option = option;
-        this.from = from == null ? MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + this.option.getKey() : from;
+        this.from = from == null ? NS_KEYCLOAK_PREFIX + this.option.getKey() : from;
         this.to = to == null ? getFrom() : to;
         this.enabled = enabled;
         this.enabledWhen = enabledWhen;
@@ -100,32 +97,23 @@ public class PropertyMapper<T> {
         this.validator = validator;
         this.description = description;
         this.parentMapper = parentMapper;
-    }
-
-    ConfigValue getConfigValue(ConfigSourceInterceptorContext context) {
-        return getConfigValue(to, context);
+        this.namedProperty = namedProperty;
     }
 
     ConfigValue getConfigValue(String name, ConfigSourceInterceptorContext context) {
         String from = getFrom();
 
-        if (to != null && to.endsWith(OPTION_PART_SEPARATOR)) {
-            // in case mapping is based on prefixes instead of full property names
-            from = name.replace(to.substring(0, to.lastIndexOf('.')), from.substring(0, from.lastIndexOf(OPTION_PART_SEPARATOR_CHAR)));
-        }
-
-        if ((isRebuild() || Environment.isRebuildCheck()) && isRunTime()) {
-            // during re-aug do not resolve the server runtime properties and avoid they included by quarkus in the default value config source
-            return ConfigValue.builder().withName(name).build();
-        }
-
         // try to obtain the value for the property we want to map first
-        ConfigValue config = convertValue(context.proceed(from));
+        // we don't want the NestedPropertyMappingInterceptor to restart the chain here, so we force a proceed
+        // this ensures that mapFrom transformers, and regular transformers are applied exclusively - not chained
+        ConfigValue config = convertValue(NestedPropertyMappingInterceptor.proceed(context, from));
 
         boolean parentValue = false;
         if (mapFrom != null && (config == null || config.getValue() == null)) {
             // if the property we want to map depends on another one, we use the value from the other property to call the mapper
-            config = Configuration.getKcConfigValue(mapFrom);
+            // not getting the value directly from SmallRye Config to avoid the risk of infinite recursion when Config is initializing
+            String mapFromWithPrefix = NS_KEYCLOAK_PREFIX + mapFrom;
+            config = context.restart(mapFromWithPrefix);
             parentValue = true;
         }
 
@@ -210,7 +198,9 @@ public OptionCategory getCategory() {
         return this.option.getCategory();
     }
 
-    public boolean isHidden() { return this.option.isHidden(); }
+    public boolean isHidden() {
+        return this.option.isHidden() || this.getDescription() == null;
+    }
 
     public boolean isBuildTime() {
         return this.option.isBuildTime();
@@ -240,6 +230,14 @@ boolean isMask() {
         return mask;
     }
 
+    ValueMapper getParentMapper() {
+        return parentMapper;
+    }
+
+    ValueMapper getMapper() {
+        return mapper;
+    }
+
     public Optional<DeprecatedMetadata> getDeprecatedMetadata() {
         return option.getDeprecatedMetadata();
     }
@@ -252,14 +250,19 @@ public boolean hasWildcard() {
         return false;
     }
 
+    public Optional<String> getNamedProperty() {
+        return Optional.ofNullable(namedProperty);
+    }
+
     private ConfigValue transformValue(String name, ConfigValue configValue, ConfigSourceInterceptorContext context, boolean parentValue) {
         String value = configValue.getValue();
         String mappedValue = value;
 
         boolean mapped = false;
-        var theMapper = parentValue ? this.parentMapper : this.mapper;
+        // fall back to the transformer when no mapper is explicitly specified in .mapFrom()
+        var theMapper = parentValue && parentMapper != null ? this.parentMapper : this.mapper;
         if (theMapper != null && (!name.equals(getFrom()) || parentValue)) {
-            mappedValue = theMapper.apply(value, context);
+            mappedValue = theMapper.map(getNamedProperty().orElse(null), value, context);
             mapped = true;
         }
 
@@ -270,7 +273,7 @@ private ConfigValue transformValue(String name, ConfigValue configValue, ConfigS
                     name).getValue();
         }
 
-        if (value == null && mappedValue == null) {
+        if (mappedValue == null) {
             return null;
         }
 
@@ -278,6 +281,10 @@ private ConfigValue transformValue(String name, ConfigValue configValue, ConfigS
             return configValue;
         }
 
+        if (!isBuildTime() && Environment.isRebuild()) {
+            value = null; // prevent quarkus from recording these raw values as runtime defaults
+        }
+
         // by unsetting the ordinal this will not be seen as directly modified by the user
         return configValue.from().withName(name).withValue(mappedValue).withRawValue(value).withConfigSourceOrdinal(0).build();
     }
@@ -295,7 +302,7 @@ public interface ValueMapper {
         String map(String name, String value, ConfigSourceInterceptorContext context);
     }
 
-    private final class ContextWrapper implements ConfigSourceInterceptorContext {
+    private static final class ContextWrapper implements ConfigSourceInterceptorContext {
         private final ConfigSourceInterceptorContext context;
         private final ConfigValue value;
 
@@ -327,9 +334,9 @@ public static class Builder<T> {
 
         private final Option<T> option;
         private String to;
-        private BiFunction<String, ConfigSourceInterceptorContext, String> mapper;
+        private ValueMapper mapper;
         private String mapFrom = null;
-        private BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper;
+        private ValueMapper parentMapper;
         private boolean isMasked = false;
         private BooleanSupplier isEnabled = () -> true;
         private String enabledWhen = "";
@@ -338,7 +345,7 @@ public static class Builder<T> {
         private String description;
         private BooleanSupplier isRequired = () -> false;
         private String requiredWhen = "";
-        private Function<Set<String>, Set<String>> wildcardKeysTransformer;
+        private BiFunction<String, Set<String>, Set<String>> wildcardKeysTransformer;
         private ValueMapper wildcardMapFrom;
 
         public Builder(Option<T> option) {
@@ -359,6 +366,10 @@ public Builder<T> to(String to) {
          * The value passed into the transformer may be null if the property has no value set, and no default
          */
         public Builder<T> transformer(BiFunction<String, ConfigSourceInterceptorContext, String> mapper) {
+            return transformer((name, value, context) -> mapper.apply(value, context));
+        }
+
+        public Builder<T> transformer(ValueMapper mapper) {
             this.mapper = mapper;
             return this;
         }
@@ -374,6 +385,10 @@ public Builder<T> mapFrom(Option<?> mapFrom) {
         }
 
         public Builder<T> mapFrom(Option<?> mapFrom, BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper) {
+            return mapFrom(mapFrom, (name, value, context) -> parentMapper.apply(value, context));
+        }
+
+        public Builder<T> mapFrom(Option<?> mapFrom, ValueMapper parentMapper) {
             this.mapFrom = mapFrom.getKey();
             this.parentMapper = parentMapper;
             return this;
@@ -464,13 +479,18 @@ public Builder<T> addValidateEnabled(BooleanSupplier isEnabled, String enabledWh
             return this;
         }
 
-        public Builder<T> wildcardKeysTransformer(Function<Set<String>, Set<String>> wildcardValuesTransformer) {
+        public Builder<T> wildcardKeysTransformer(BiFunction<String, Set<String>, Set<String>> wildcardValuesTransformer) {
             this.wildcardKeysTransformer = wildcardValuesTransformer;
             return this;
         }
 
         public Builder<T> wildcardMapFrom(Option<?> mapFrom, ValueMapper function) {
-            this.mapFrom = mapFrom.getKey();
+            wildcardMapFrom(mapFrom.getKey(), function);
+            return this;
+        }
+
+        public Builder<T> wildcardMapFrom(String mapFrom, ValueMapper function) {
+            this.mapFrom = mapFrom;
             this.wildcardMapFrom = function;
             return this;
         }
@@ -479,15 +499,13 @@ public PropertyMapper<T> build() {
             if (paramLabel == null && Boolean.class.equals(option.getType())) {
                 paramLabel = Boolean.TRUE + "|" + Boolean.FALSE;
             }
-            // The wildcard pattern (e.g. log-level-<category>) is matching only a-z, 0-0 and dots. For env vars, dots are replaced by underscores.
-            var fromWildcardMatcher = WILDCARD_PLACEHOLDER_PATTERN.matcher(option.getKey());
-            if (fromWildcardMatcher.find()) {
-                return new WildcardPropertyMapper<>(option, to, isEnabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, isMasked, validator, description, isRequired, requiredWhen, fromWildcardMatcher, wildcardKeysTransformer, wildcardMapFrom);
+            if (option.getKey().contains(WildcardPropertyMapper.WILDCARD_FROM_START)) {
+                return new WildcardPropertyMapper<>(option, to, isEnabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, isMasked, validator, description, isRequired, requiredWhen, wildcardKeysTransformer, wildcardMapFrom);
             }
             if (wildcardKeysTransformer != null || wildcardMapFrom != null) {
                 throw new AssertionError("Wildcard operations not expected with non-wildcard mapper");
             }
-            return new PropertyMapper<>(option, to, isEnabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, isMasked, validator, description, isRequired, requiredWhen, null);
+            return new PropertyMapper<>(option, to, isEnabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, isMasked, validator, description, isRequired, requiredWhen, null, null);
         }
     }
 
@@ -569,25 +587,6 @@ String getOptionAndSourceMessage(ConfigValue configValue) {
                 KeycloakConfigSourceProvider.getConfigSourceDisplayName(configValue.getConfigSourceName()));
     }
 
-    /**
-     * Get all Keycloak config values for the mapper. A multivalued config option is a config option that
-     * has a wildcard in its name, e.g. log-level-<category>.
-     *
-     * @return a list of config values where the key is the resolved wildcard (e.g. category) and the value is the config value
-     */
-    public List<ConfigValue> getKcConfigValues() {
-        return List.of(Configuration.getConfigValue(getFrom()));
-    }
-
-    /**
-     * Returns a new PropertyMapper tailored for the given env var key.
-     * This is currently useful in {@link WildcardPropertyMapper} where "to" and "from" fields need to include a specific
-     * wildcard key.
-     */
-    public PropertyMapper<?> forEnvKey(String key) {
-        return this;
-    }
-
     /**
      * Returns a new PropertyMapper tailored for the given key.
      * This is currently useful in {@link WildcardPropertyMapper} where "to" and "from" fields need to include a specific
@@ -597,4 +596,8 @@ public PropertyMapper<?> forKey(String key) {
         return this;
     }
 
+    String getMapFrom() {
+        return mapFrom;
+    }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappers.java
index 56c4885a3e4e..ee914a182f52 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappers.java
@@ -2,19 +2,20 @@
 
 import io.smallrye.config.ConfigSourceInterceptorContext;
 import io.smallrye.config.ConfigValue;
-
 import jakarta.ws.rs.core.MultivaluedHashMap;
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.CollectionUtil;
 import org.keycloak.config.ConfigSupportLevel;
+import org.keycloak.config.Option;
 import org.keycloak.config.OptionCategory;
 import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.cli.Picocli;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
 import org.keycloak.quarkus.runtime.cli.command.AbstractCommand;
-import org.keycloak.quarkus.runtime.cli.command.Build;
 import org.keycloak.quarkus.runtime.cli.command.ShowConfig;
 import org.keycloak.quarkus.runtime.configuration.DisabledMappersInterceptor;
 import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
+import org.keycloak.quarkus.runtime.configuration.NestedPropertyMappingInterceptor;
 import org.keycloak.quarkus.runtime.configuration.PersistedConfigSource;
 
 import java.util.ArrayList;
@@ -24,15 +25,14 @@
 import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.function.BiConsumer;
 import java.util.Set;
-import java.util.function.Predicate;
 import java.util.stream.Collectors;
 
-import static org.keycloak.quarkus.runtime.Environment.isParsedCommand;
 import static org.keycloak.quarkus.runtime.Environment.isRebuild;
 import static org.keycloak.quarkus.runtime.Environment.isRebuildCheck;
 import static org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider.isKeyStoreConfigSource;
@@ -77,10 +77,17 @@ public static void reset() {
 
     public static ConfigValue getValue(ConfigSourceInterceptorContext context, String name) {
         PropertyMapper<?> mapper = getMapper(name);
-        // during re-aug do not resolve the server runtime properties and avoid they included by quarkus in the default value config source
-        if ((isRebuild() || Environment.isRebuildCheck()) && isKeycloakRuntime(name, mapper)) {
+
+        // During re-aug do not resolve server runtime properties and avoid they included by quarkus in the default value config source.
+        //
+        // The special handling of log properties is because some logging runtime properties are requested during build time
+        // and we need to resolve them. That should be fine as they are generally not considered security sensitive.
+        // See https://github.com/quarkusio/quarkus/pull/42157
+        if (isRebuild() && isKeycloakRuntime(name, mapper)
+                && !NestedPropertyMappingInterceptor.getResolvingRoot().orElse(name).startsWith("quarkus.log.")) {
             return ConfigValue.builder().withName(name).build();
         }
+
         if (mapper == null) {
             return context.proceed(name);
         }
@@ -88,9 +95,15 @@ public static ConfigValue getValue(ConfigSourceInterceptorContext context, Strin
     }
 
     public static boolean isSpiBuildTimeProperty(String name) {
+        // we can't require the new property formant until we're ok with a breaking change
+        //return name.startsWith(KC_SPI_PREFIX) && (name.endsWith("--provider") || name.endsWith("--enabled") || name.endsWith("--provider-default"));
         return name.startsWith(KC_SPI_PREFIX) && (name.endsWith("-provider") || name.endsWith("-enabled") || name.endsWith("-provider-default"));
     }
 
+    public static boolean isMaybeSpiBuildTimeProperty(String name) {
+        return isSpiBuildTimeProperty(name) && !name.contains("--");
+    }
+
     private static boolean isKeycloakRuntime(String name, PropertyMapper<?> mapper) {
         if (mapper == null) {
             return name.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK) && !isSpiBuildTimeProperty(name);
@@ -123,18 +136,15 @@ public static Map<String, PropertyMapper<?>> getDisabledBuildTimeMappers() {
     /**
      * Removes all disabled mappers from the runtime/buildtime mappers
      */
-    public static void sanitizeDisabledMappers() {
-        MAPPERS.sanitizeDisabledMappers();
+    public static void sanitizeDisabledMappers(AbstractCommand command) {
+        MAPPERS.sanitizeDisabledMappers(command);
     }
 
-    public static String maskValue(String property, String value) {
-        return maskValue(property, value, null);
+    public static String maskValue(String value, PropertyMapper<?> mapper) {
+        return maskValue(value, null, mapper);
     }
 
-    public static String maskValue(String property, String value, String configSourceName) {
-        property = removeProfilePrefixIfNeeded(property);
-        PropertyMapper<?> mapper = getMapper(property);
-
+    public static String maskValue(String value, String configSourceName, PropertyMapper<?> mapper) {
         if ((configSourceName != null && isKeyStoreConfigSource(configSourceName) || (mapper != null && mapper.isMask()))) {
             return VALUE_MASK;
         }
@@ -142,16 +152,7 @@ public static String maskValue(String property, String value, String configSourc
         return value;
     }
 
-    private static String removeProfilePrefixIfNeeded(String property) {
-        if(property.startsWith("%")) {
-            String profilePrefix = property.substring(0, property.indexOf(".") +1);
-            property = property.split(profilePrefix)[1];
-        }
-        return property;
-    }
-
     private static PropertyMapper<?> getMapperOrDefault(String property, PropertyMapper<?> defaultMapper, OptionCategory category) {
-        property = removeProfilePrefixIfNeeded(property);
         final var mappers = new ArrayList<>(MAPPERS.getOrDefault(property, Collections.emptyList()));
         if (category != null) {
             mappers.removeIf(m -> !m.getCategory().equals(category));
@@ -175,14 +176,33 @@ public static PropertyMapper<?> getMapper(String property) {
         return getMapper(property, null);
     }
 
+    public static PropertyMapper<?> getMapperByCliKey(String cliKey) {
+        return getKcKeyFromCliKey(cliKey).map(PropertyMappers::getMapper).orElse(null);
+    }
+
+    public static Optional<String> getKcKeyFromCliKey(String cliKey) {
+        if (!cliKey.startsWith(Picocli.ARG_PREFIX)) {
+            return Optional.empty();
+        }
+        return Optional.ofNullable(
+                MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + cliKey.substring(Picocli.ARG_PREFIX.length()));
+    }
+
+    /**
+     * @return a mutable copy of all known mappers
+     */
     public static Set<PropertyMapper<?>> getMappers() {
-        return MAPPERS.values().stream().flatMap(Collection::stream).collect(Collectors.toSet());
+        return MAPPERS.values().stream().flatMap(Collection::stream).collect(Collectors.toCollection(LinkedHashSet::new));
     }
 
     public static Set<WildcardPropertyMapper<?>> getWildcardMappers() {
         return MAPPERS.getWildcardMappers();
     }
 
+    public static WildcardPropertyMapper<?> getWildcardMappedFrom(Option<?> from) {
+        return MAPPERS.wildcardMapFrom.get(from.getKey());
+    }
+
     public static boolean isSupported(PropertyMapper<?> mapper) {
         ConfigSupportLevel supportLevel = mapper.getCategory().getSupportLevel();
         return supportLevel.equals(ConfigSupportLevel.SUPPORTED) || supportLevel.equals(ConfigSupportLevel.DEPRECATED);
@@ -201,19 +221,11 @@ public static Optional<PropertyMapper<?>> getDisabledMapper(String property) {
     }
 
     public static boolean isDisabledMapper(String property) {
-        final Predicate<String> isDisabledMapper = (p) -> getDisabledMapper(p).isPresent() && getMapper(p) == null;
-
-        if (property.startsWith("%")) {
-            return isDisabledMapper.test(property.substring(property.indexOf('.') + 1));
-        }
-        return isDisabledMapper.test(property);
+        return getDisabledMapper(property).isPresent() && getMapper(property) == null;
     }
 
-    private static Set<PropertyMapper<?>> filterDeniedCategories(List<PropertyMapper<?>> mappers) {
-        final var allowedCategories = Environment.getParsedCommand()
-                .map(AbstractCommand::getOptionCategories)
-                .map(EnumSet::copyOf)
-                .orElseGet(() -> EnumSet.allOf(OptionCategory.class));
+    private static Set<PropertyMapper<?>> filterDeniedCategories(List<PropertyMapper<?>> mappers, AbstractCommand command) {
+        final var allowedCategories = EnumSet.copyOf(command.getOptionCategories());
 
         return mappers.stream().filter(f -> allowedCategories.contains(f.getCategory())).collect(Collectors.toSet());
     }
@@ -225,7 +237,9 @@ private static class MappersConfig extends MultivaluedHashMap<String, PropertyMa
 
         private final Map<String, PropertyMapper<?>> disabledBuildTimeMappers = new HashMap<>();
         private final Map<String, PropertyMapper<?>> disabledRuntimeMappers = new HashMap<>();
+
         private final Set<WildcardPropertyMapper<?>> wildcardMappers = new HashSet<>();
+        private final Map<String, WildcardPropertyMapper<?>> wildcardMapFrom = new HashMap<>();
 
         public void addAll(PropertyMapper<?>[] mappers) {
             for (PropertyMapper<?> mapper : mappers) {
@@ -245,14 +259,24 @@ private static void addMapperByStage(PropertyMapper<?> mapper, Map<OptionCategor
 
         public void addMapper(PropertyMapper<?> mapper) {
             if (mapper.hasWildcard()) {
+                if (mapper.getMapFrom() != null) {
+                    wildcardMapFrom.put(mapper.getMapFrom(), (WildcardPropertyMapper<?>) mapper);
+                }
                 wildcardMappers.add((WildcardPropertyMapper<?>)mapper);
+            } else {
+                handleMapper(mapper, this::add);
             }
-            handleMapper(mapper, this::add);
         }
 
         public void removeMapper(PropertyMapper<?> mapper) {
-            wildcardMappers.remove(mapper);
-            handleMapper(mapper, this::remove);
+            if (mapper.hasWildcard()) {
+                wildcardMappers.remove(mapper);
+                if (mapper.getFrom() != null) {
+                    wildcardMapFrom.remove(mapper.getMapFrom());
+                }
+            } else {
+                handleMapper(mapper, this::remove);
+            }
         }
 
         private void remove(String key, PropertyMapper<?> mapper) {
@@ -263,18 +287,29 @@ private void remove(String key, PropertyMapper<?> mapper) {
         }
 
         @Override
+        @SuppressWarnings({"rawtypes", "unchecked"})
         public List<PropertyMapper<?>> get(Object key) {
-            // First check if the requested option matches any wildcard mappers
+            // First check the base mappings
             String strKey = (String) key;
-            List ret = wildcardMappers.stream()
-                    .filter(m -> m.matchesWildcardOptionName(strKey))
-                    .toList();
-            if (!ret.isEmpty()) {
+
+            List ret = super.get(key);
+            if (ret != null) {
                 return ret;
             }
 
-            // If no wildcard mappers match, check for exact matches
-            return super.get(key);
+            // TODO: we may want to introduce a prefix tree here as we add more wildcardMappers
+            // for now we'll just limit ourselves to searching wildcards when we see a quarkus or
+            // keycloak key
+            if (strKey.startsWith(MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX) || strKey.startsWith(MicroProfileConfigProvider.NS_QUARKUS_PREFIX)) {
+                ret = wildcardMappers.stream()
+                        .filter(m -> m.matchesWildcardOptionName(strKey))
+                        .toList();
+                if (!ret.isEmpty()) {
+                    return ret;
+                }
+            }
+
+            return null;
         }
 
         @Override
@@ -286,9 +321,7 @@ public Set<WildcardPropertyMapper<?>> getWildcardMappers() {
             return Collections.unmodifiableSet(wildcardMappers);
         }
 
-        public void sanitizeDisabledMappers() {
-            if (Environment.getParsedCommand().isEmpty()) return; // do not sanitize when no command is present
-
+        public void sanitizeDisabledMappers(AbstractCommand command) {
             DisabledMappersInterceptor.runWithDisabled(() -> { // We need to have the whole configuration available
 
                 // Initialize profile in order to check state of features. Disable Persisted CS for re-augmentation
@@ -301,22 +334,22 @@ public void sanitizeDisabledMappers() {
                 sanitizeMappers(buildTimeMappers, disabledBuildTimeMappers);
                 sanitizeMappers(runtimeTimeMappers, disabledRuntimeMappers);
 
-                assertDuplicatedMappers();
+                assertDuplicatedMappers(command);
             });
         }
 
-        private void assertDuplicatedMappers() {
+        private void assertDuplicatedMappers(AbstractCommand command) {
             final var duplicatedMappers = entrySet().stream()
                     .filter(e -> CollectionUtil.isNotEmpty(e.getValue()))
                     .filter(e -> e.getValue().size() > 1)
                     .toList();
 
-            final var isBuildPhase = isRebuild() || isRebuildCheck() || isParsedCommand(Build.NAME);
-            final var allowedForCommand = isParsedCommand(ShowConfig.NAME);
+            final var isBuildPhase = isRebuild() || isRebuildCheck() || command.includeBuildTime();
+            final var allowedForCommand = ShowConfig.NAME.equals(command.getName());
 
             if (!duplicatedMappers.isEmpty()) {
                 duplicatedMappers.forEach(f -> {
-                    final var filteredMappers = filterDeniedCategories(f.getValue());
+                    final var filteredMappers = filterDeniedCategories(f.getValue(), command);
 
                     if (filteredMappers.size() > 1) {
                         final var areBuildTimeMappers = filteredMappers.stream().anyMatch(PropertyMapper::isBuildTime);
@@ -363,10 +396,17 @@ private static void sanitizeMappers(Map<OptionCategory, List<PropertyMapper<?>>>
         private static void handleMapper(PropertyMapper<?> mapper, BiConsumer<String, PropertyMapper<?>> operation) {
             operation.accept(mapper.getFrom(), mapper);
             if (!mapper.getFrom().equals(mapper.getTo())) {
-                operation.accept(mapper.getTo(), mapper);
+                String to = mapper.getTo();
+                operation.accept(to, mapper);
+                if (to.startsWith(KC_SPI_PREFIX)) {
+                    if (!mapper.getTo().contains("--")) {
+                        throw new IllegalStateException("Mapper should use the new form of the SPI option with the `--` separator: " + to);
+                    }
+                    String legacyTo = mapper.getTo().replace("--", "-");
+                    operation.accept(legacyTo, mapper);
+                }
             }
-            operation.accept(mapper.getCliFormat(), mapper);
-            operation.accept(mapper.getEnvVarFormat(), mapper);
         }
     }
+
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ProxyPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ProxyPropertyMappers.java
index 111b7c813d14..15fc59fca2ea 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ProxyPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ProxyPropertyMappers.java
@@ -21,6 +21,11 @@ public static PropertyMapper<?>[] getProxyPropertyMappers() {
                         .build(),
                 fromOption(ProxyOptions.PROXY_PROTOCOL_ENABLED)
                         .to("quarkus.http.proxy.use-proxy-protocol")
+                        .validator(v -> {
+                            if (Boolean.parseBoolean(v) && Configuration.getOptionalKcValue(ProxyOptions.PROXY_HEADERS).isPresent()) {
+                                throw new PropertyException("proxy protocol cannot be enabled when using the `proxy-headers` option");
+                            }
+                        })
                         .build(),
                 fromOption(ProxyOptions.PROXY_FORWARDED_HOST)
                         .to("quarkus.http.proxy.enable-forwarded-host")
@@ -34,6 +39,10 @@ public static PropertyMapper<?>[] getProxyPropertyMappers() {
                         .to("quarkus.http.proxy.allow-x-forwarded")
                         .mapFrom(ProxyOptions.PROXY_HEADERS, (v, c) -> proxyEnabled(ProxyOptions.Headers.xforwarded, v, c))
                         .build(),
+                fromOption(ProxyOptions.PROXY_TRUSTED_HEADER_ENABLED)
+                        .to("quarkus.http.proxy.enable-trusted-proxy-header")
+                        .mapFrom(ProxyOptions.PROXY_HEADERS, (v, c) -> proxyEnabled(null, v, c))
+                        .build(),
                 fromOption(ProxyOptions.PROXY_TRUSTED_ADDRESSES)
                         .to("quarkus.http.proxy.trusted-proxies")
                         .validator(ProxyPropertyMappers::validateAddress)
@@ -42,7 +51,7 @@ public static PropertyMapper<?>[] getProxyPropertyMappers() {
                         .build()
         };
     }
-    
+
     private static void validateAddress(String address) {
         if (Inet.parseCidrAddress(address) != null) {
             return;
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TracingPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TracingPropertyMappers.java
index 439e50d04d54..30bb58ceb814 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TracingPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TracingPropertyMappers.java
@@ -18,7 +18,6 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
 import org.keycloak.common.Profile;
-import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.utils.StringUtil;
@@ -113,11 +112,12 @@ private static void validateRatio(String value) {
 
         try {
             var ratio = Double.parseDouble(value);
-            if (ratio <= 0.0 || ratio > 1.0) {
+            // note: 0.0 is a legal value, see https://quarkus.io/guides/opentelemetry-tracing#sampler
+            if (ratio < 0.0 || ratio > 1.0) {
                 throw new NumberFormatException();
             }
         } catch (NumberFormatException e) {
-            throw new PropertyException("Ratio in 'tracing-sampler-ratio' option must be a double value in interval <0,1).");
+            throw new PropertyException("Ratio in 'tracing-sampler-ratio' option must be a double value in interval [0,1].");
         }
     }
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TransactionPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TransactionPropertyMappers.java
index 483c9505bf6d..cf0ddfbe30e3 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TransactionPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TransactionPropertyMappers.java
@@ -8,14 +8,16 @@
 
 public class TransactionPropertyMappers {
 
-    private static final String QUARKUS_TXPROP_TARGET = "quarkus.datasource.jdbc.transactions";
-
     private TransactionPropertyMappers(){}
 
     public static PropertyMapper<?>[] getTransactionPropertyMappers() {
         return new PropertyMapper[] {
                 fromOption(TransactionOptions.TRANSACTION_XA_ENABLED)
-                        .to(QUARKUS_TXPROP_TARGET)
+                        .to("quarkus.datasource.jdbc.transactions")
+                        .transformer(TransactionPropertyMappers::getQuarkusTransactionsValue)
+                        .build(),
+                fromOption(TransactionOptions.TRANSACTION_XA_ENABLED_DATASOURCE)
+                        .to("quarkus.datasource.\"<datasource>\".jdbc.transactions")
                         .transformer(TransactionPropertyMappers::getQuarkusTransactionsValue)
                         .build()
         };
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TruststorePropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TruststorePropertyMappers.java
index 3fddf74d5cbe..8f3231a91312 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TruststorePropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TruststorePropertyMappers.java
@@ -13,7 +13,7 @@ public static PropertyMapper<?>[] getMappers() {
                         .build(),
                 fromOption(TruststoreOptions.HOSTNAME_VERIFICATION_POLICY)
                         .paramLabel(TruststoreOptions.HOSTNAME_VERIFICATION_POLICY.getKey())
-                        .to("kc.spi-truststore-file-hostname-verification-policy")
+                        .to("kc.spi-truststore--file--hostname-verification-policy")
                         .build(),
         };
     }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java
index 1cc4d33f574c..7f5abb83e795 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/VaultPropertyMappers.java
@@ -15,19 +15,19 @@ public static PropertyMapper<?>[] getVaultPropertyMappers() {
                         .paramLabel("provider")
                         .build(),
                 fromOption(VaultOptions.VAULT_DIR)
-                        .to("kc.spi-vault-file-dir")
+                        .to("kc.spi-vault--file--dir")
                         .paramLabel("dir")
                         .build(),
                 fromOption(VaultOptions.VAULT_FILE)
-                        .to("kc.spi-vault-keystore-file")
+                        .to("kc.spi-vault--keystore--file")
                         .paramLabel("file")
                         .build(),
                 fromOption(VaultOptions.VAULT_PASS)
-                        .to("kc.spi-vault-keystore-pass")
+                        .to("kc.spi-vault--keystore--pass")
                         .paramLabel("pass")
                         .build(),
                 fromOption(VaultOptions.VAULT_TYPE)
-                        .to("kc.spi-vault-keystore-type")
+                        .to("kc.spi-vault--keystore--type")
                         .paramLabel("type")
                         .build()
         };
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java
index 79dac11c4b37..885dfd9224a4 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/WildcardPropertyMapper.java
@@ -1,59 +1,61 @@
 package org.keycloak.quarkus.runtime.configuration.mappers;
 
-import static org.keycloak.config.Option.WILDCARD_PLACEHOLDER_PATTERN;
-import static org.keycloak.quarkus.runtime.cli.Picocli.ARG_PREFIX;
-
-import java.util.List;
+import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.BiConsumer;
 import java.util.function.BiFunction;
 import java.util.function.BooleanSupplier;
-import java.util.function.Function;
-import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
-import java.util.stream.StreamSupport;
+import java.util.stream.Stream;
 
+import org.keycloak.config.LoggingOptions;
 import org.keycloak.config.Option;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
-import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
 
-import io.smallrye.config.ConfigSourceInterceptorContext;
 import io.smallrye.config.ConfigValue;
 
+import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX;
+import static org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider.NS_QUARKUS_PREFIX;
+
 public class WildcardPropertyMapper<T> extends PropertyMapper<T> {
 
-    private final Matcher fromWildcardMatcher;
-    private final Pattern fromWildcardPattern;
-    private final Pattern envVarNameWildcardPattern;
-    private Matcher toWildcardMatcher;
-    private Pattern toWildcardPattern;
-    private final Function<Set<String>, Set<String>> wildcardKeysTransformer;
+    public static final String WILDCARD_FROM_START = "<";
+
+    private static final Pattern valueValidator = Pattern.compile("[\\[\\]\\$\\-._a-zA-Z0-9]+");
+
+    private final BiFunction<String, Set<String>, Set<String>> wildcardKeysTransformer;
     private final ValueMapper wildcardMapFrom;
 
-    public WildcardPropertyMapper(Option<T> option, String to, BooleanSupplier enabled, String enabledWhen,
-            BiFunction<String, ConfigSourceInterceptorContext, String> mapper,
-            String mapFrom, BiFunction<String, ConfigSourceInterceptorContext, String> parentMapper,
+    private final String fromPrefix;
+    private String toPrefix;
+    private String toSuffix;
+    private Character replacementChar = null;
+
+    public WildcardPropertyMapper(Option<T> option, String to, BooleanSupplier enabled, String enabledWhen, ValueMapper mapper, String mapFrom, ValueMapper parentMapper,
             String paramLabel, boolean mask, BiConsumer<PropertyMapper<T>, ConfigValue> validator,
-            String description, BooleanSupplier required, String requiredWhen, Matcher fromWildcardMatcher, Function<Set<String>, Set<String>> wildcardKeysTransformer, ValueMapper wildcardMapFrom) {
-        super(option, to, enabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, mask, validator, description, required, requiredWhen, null);
+            String description, BooleanSupplier required, String requiredWhen, BiFunction<String, Set<String>, Set<String>> wildcardKeysTransformer, ValueMapper wildcardMapFrom) {
+        super(option, to, enabled, enabledWhen, mapper, mapFrom, parentMapper, paramLabel, mask, validator, description, required, requiredWhen, null, null);
         this.wildcardMapFrom = wildcardMapFrom;
-        this.fromWildcardMatcher = fromWildcardMatcher;
-        // Includes handling for both "--" prefix for CLI options and "kc." prefix
-        this.fromWildcardPattern = Pattern.compile("(?:" + ARG_PREFIX + "|kc\\.)" + fromWildcardMatcher.replaceFirst("([\\\\\\\\.a-zA-Z0-9]+)"));
 
-        // Not using toEnvVarFormat because it would process the whole string incl the <...> wildcard.
-        Matcher envVarMatcher = WILDCARD_PLACEHOLDER_PATTERN.matcher(option.getKey().toUpperCase().replace("-", "_"));
-        this.envVarNameWildcardPattern = Pattern.compile("KC_" + envVarMatcher.replaceFirst("([_A-Z0-9]+)"));
+        this.fromPrefix = getFrom().substring(0, getFrom().indexOf(WILDCARD_FROM_START));
+        if (!getFrom().endsWith(">")) {
+            throw new IllegalArgumentException("Invalid wildcard from format. Wildcard must be at the end of the option.");
+        }
+
+        if (option == LoggingOptions.LOG_LEVEL_CATEGORY) {
+            replacementChar = '.';
+        }
 
         if (to != null) {
-            toWildcardMatcher = WILDCARD_PLACEHOLDER_PATTERN.matcher(to);
-            if (!toWildcardMatcher.find()) {
-                throw new IllegalArgumentException("Attempted to map a wildcard option to a non-wildcard option");
+            if (!to.startsWith(NS_QUARKUS_PREFIX) && !to.startsWith(NS_KEYCLOAK_PREFIX)) {
+                throw new IllegalArgumentException("Wildcards should map to Quarkus or Keycloak options (option '%s' mapped to '%s'). If not, PropertyMappers logic will need adjusted".formatted(option.getKey(), to));
             }
-
-            this.toWildcardPattern = Pattern.compile(toWildcardMatcher.replaceFirst("([\\\\\\\\.a-zA-Z0-9]+)"));
+            this.toPrefix = to.substring(0, to.indexOf(WILDCARD_FROM_START));
+            int lastIndexOf = to.lastIndexOf(">");
+            if (lastIndexOf == -1) {
+                throw new IllegalArgumentException("Invalid wildcard map to.");
+            }
+            this.toSuffix = to.substring(lastIndexOf + 1, to.length());
         }
 
         this.wildcardKeysTransformer = wildcardKeysTransformer;
@@ -65,64 +67,50 @@ public boolean hasWildcard() {
     }
 
     String getTo(String wildcardKey) {
-        return toWildcardMatcher.replaceFirst(wildcardKey);
+        return toPrefix + wildcardKey + toSuffix;
     }
 
-    String getFrom(String wildcardKey) {
-        return MicroProfileConfigProvider.NS_KEYCLOAK_PREFIX + fromWildcardMatcher.replaceFirst(wildcardKey);
+    public String getFrom(String wildcardKey) {
+        return fromPrefix + wildcardKey;
     }
 
-    @Override
-    public List<ConfigValue> getKcConfigValues() {
-        return this.getWildcardKeys().stream().map(v -> Configuration.getConfigValue(getFrom(v))).toList();
-    }
-
-    public Set<String> getWildcardKeys() {
-        // this is not optimal
-        // TODO find an efficient way to get all values that match the wildcard
-        Set<String> values = StreamSupport.stream(Configuration.getPropertyNames().spliterator(), false)
-                .map(n -> getMappedKey(n, false))
-                .filter(Optional::isPresent)
-                .map(Optional::get)
-                .collect(Collectors.toSet());
-
-        if (wildcardKeysTransformer != null) {
-            return wildcardKeysTransformer.apply(values);
+    public Stream<String> getToFromWildcardTransformer(String value) {
+        if (wildcardKeysTransformer == null) {
+            return Stream.empty();
         }
-
-        return values;
+        return wildcardKeysTransformer.apply(value, new HashSet<String>()).stream().map(this::getTo);
     }
 
-    /**
-     * Returns a mapped key for the given option name if a relevant mapping is available, or empty otherwise.
-     * Currently, it only attempts to extract the wildcard key from the given option name.
-     * E.g. for the option "log-level-<category>" and the option name "log-level-io.quarkus",
-     * the wildcard value would be "io.quarkus".
-     */
-    private Optional<String> getMappedKey(String originalKey, boolean tryTo) {
-        Matcher matcher = fromWildcardPattern.matcher(originalKey);
-        if (matcher.matches()) {
-            return Optional.of(matcher.group(1));
-        }
-
-        if (tryTo && toWildcardPattern != null) {
-            matcher = toWildcardPattern.matcher(originalKey);
-            if (matcher.matches()) {
-                return Optional.of(matcher.group(1));
-            }
+    @Override
+    public PropertyMapper<?> forKey(String key) {
+        String wildcardValue = extractWildcardValue(key).orElseThrow();
+        String to = getTo(wildcardValue);
+        String from = getFrom(wildcardValue);
+        String mapFrom = getMapFrom();
+        // resolve even the mapFrom() value
+        if (mapFrom != null && mapFrom.contains(WILDCARD_FROM_START)) {
+            mapFrom = mapFrom.substring(0, mapFrom.indexOf(WILDCARD_FROM_START)).concat(wildcardValue);
         }
 
-        return Optional.empty();
+        return new PropertyMapper<T>(this, from, to, mapFrom, wildcardValue,
+                wildcardMapFrom == null ? null : (name, v, context) -> wildcardMapFrom.map(wildcardValue, v, context));
     }
 
-    public Set<String> getToWithWildcards() {
-        if (toWildcardMatcher == null) {
-            return Set.of();
+    private Optional<String> extractWildcardValue(String key) {
+        String result = null;
+        if (key.startsWith(fromPrefix)) {
+            result = key.substring(fromPrefix.length());
+        } else if (key.startsWith(toPrefix) && key.endsWith(toSuffix)) {
+            // TODO: this presumes that the quarkus value is quoted
+            result = key.substring(toPrefix.length(), key.length() - toSuffix.length());
         }
+        // TODO: it would be nice to warn the user for property file or env entries that look
+        // like they should be wildcards, but aren't allowed
+        return Optional.ofNullable(result).filter(WildcardPropertyMapper::isValidWildcardValue);
+    }
 
-        return getWildcardKeys().stream()
-                .map(v -> toWildcardMatcher.replaceFirst(v))
-                .collect(Collectors.toSet());
+    public static boolean isValidWildcardValue(String result) {
+        return valueValidator.matcher(result).matches();
     }
 
     /**
@@ -130,31 +118,17 @@ public Set<String> getToWithWildcards() {
      * E.g. check if "log-level-io.quarkus" matches the wildcard pattern "log-level-<category>".
      */
     public boolean matchesWildcardOptionName(String name) {
-        return fromWildcardPattern.matcher(name).matches() || envVarNameWildcardPattern.matcher(name).matches()
-                || (toWildcardPattern != null && toWildcardPattern.matcher(name).matches());
+        return extractWildcardValue(name).isPresent();
     }
 
-    @Override
-    public PropertyMapper<?> forEnvKey(String key) {
-        Matcher matcher = envVarNameWildcardPattern.matcher(key);
-        if (!matcher.matches()) {
-            throw new IllegalStateException("Env var '" + key + "' does not match the expected pattern '" + envVarNameWildcardPattern + "'");
+    public Optional<String> getKcKeyForEnvKey(String envKey, String transformedKey) {
+        if (transformedKey.startsWith(fromPrefix)) {
+            if (replacementChar != null) {
+                return Optional.ofNullable(getFrom(envKey.substring(fromPrefix.length()).toLowerCase().replace('_', replacementChar)));
+            }
+            return Optional.of(transformedKey);
         }
-        String value = matcher.group(1);
-        final String wildcardValue = value.toLowerCase().replace("_", "."); // we opiniotatedly convert env var names to CLI format with dots
-        return forWildcardValue(wildcardValue);
-    }
-
-    private PropertyMapper<?> forWildcardValue(final String wildcardValue) {
-        String to = getTo(wildcardValue);
-        String from = getFrom(wildcardValue);
-        return new PropertyMapper<T>(this, from, to, wildcardMapFrom == null ? null : (v, context) -> wildcardMapFrom.map(wildcardValue, v, context));
-    }
-
-    @Override
-    public PropertyMapper<?> forKey(String key) {
-        final String wildcardValue = getMappedKey(key, true).orElseThrow();
-        return forWildcardValue(wildcardValue);
+        return Optional.empty();
     }
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/QuarkusKeycloakSessionFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/QuarkusKeycloakSessionFactory.java
index 13ae7cdb536c..01f8cd3256dc 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/QuarkusKeycloakSessionFactory.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/QuarkusKeycloakSessionFactory.java
@@ -29,7 +29,7 @@
 import org.keycloak.provider.Spi;
 import org.keycloak.quarkus.runtime.themes.QuarkusJarThemeProviderFactory;
 import org.keycloak.services.DefaultKeycloakSessionFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.theme.ClasspathThemeProviderFactory;
 
 public final class QuarkusKeycloakSessionFactory extends DefaultKeycloakSessionFactory {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java
index b3ca09965901..85d6a296f8db 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java
@@ -21,8 +21,6 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.platform.Platform;
-import org.keycloak.quarkus.runtime.Environment;
-import org.keycloak.quarkus.runtime.cli.command.AbstractNonServerCommand;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
 import org.keycloak.quarkus.runtime.configuration.PropertyMappingInterceptor;
@@ -50,11 +48,6 @@ void onStartupEvent(@Observes StartupEvent event) {
         QuarkusPlatform platform = (QuarkusPlatform) Platform.getPlatform();
         platform.started();
         startup();
-        Environment.getParsedCommand().ifPresent(ac -> {
-            if (ac instanceof AbstractNonServerCommand) {
-                ((AbstractNonServerCommand)ac).onStart(this);
-            }
-        });
     }
 
     void onShutdownEvent(@Observes ShutdownEvent event) {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/KeycloakTracingCustomizer.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/KeycloakTracingCustomizer.java
index 8b08fa019f25..5667bf47231e 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/KeycloakTracingCustomizer.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/KeycloakTracingCustomizer.java
@@ -22,6 +22,7 @@
 import io.opentelemetry.api.trace.SpanBuilder;
 import io.opentelemetry.api.trace.Tracer;
 import io.opentelemetry.context.Context;
+import io.opentelemetry.context.Scope;
 import jakarta.enterprise.inject.spi.CDI;
 import org.apache.commons.lang3.StringUtils;
 import org.jboss.resteasy.reactive.common.model.ResourceClass;
@@ -60,17 +61,23 @@ public void handle(ResteasyReactiveRequestContext requestContext) {
             spanBuilder.setAttribute("code.namespace", className);
             Span span = spanBuilder.startSpan();
             requestContext.setProperty("span", span);
+            requestContext.setProperty("scope", span.makeCurrent());
         }
     }
 
     private static class EndHandler implements ServerRestHandler {
         @Override
         public void handle(ResteasyReactiveRequestContext requestContext) {
+            Scope scope = (Scope) requestContext.getProperty("scope");
+            if (scope != null) {
+                scope.close();
+                requestContext.removeProperty("scope");
+            }
             Span span = (Span) requestContext.getProperty("span");
             if (span != null) {
                 span.end();
+                requestContext.removeProperty("span");
             }
-            requestContext.removeProperty("span");
         }
     }
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/QuarkusHttpRequest.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/QuarkusHttpRequest.java
index 80fcf9bfaac0..06feca32a248 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/QuarkusHttpRequest.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/resteasy/QuarkusHttpRequest.java
@@ -34,8 +34,10 @@
 import org.jboss.resteasy.reactive.server.core.ResteasyReactiveRequestContext;
 import org.jboss.resteasy.reactive.server.core.multipart.FormData;
 import org.jboss.resteasy.reactive.server.multipart.FormValue;
+import org.keycloak.config.ProxyOptions;
 import org.keycloak.http.FormPartValue;
 import org.keycloak.http.HttpRequest;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.integration.jaxrs.EmptyMultivaluedMap;
 import org.keycloak.services.FormPartValueImpl;
 
@@ -54,13 +56,17 @@ public <R> QuarkusHttpRequest(ResteasyReactiveRequestContext context) {
 
     @Override
     public String getHttpMethod() {
-        if (context == null) return null;
+        if (context == null) {
+            return null;
+        }
         return context.getMethod();
     }
 
     @Override
     public MultivaluedMap<String, String> getDecodedFormParameters() {
-        if (context == null) return null;
+        if (context == null) {
+            return null;
+        }
         FormData parameters = context.getFormData();
 
         if (parameters == null || !parameters.iterator().hasNext()) {
@@ -86,7 +92,9 @@ public MultivaluedMap<String, String> getDecodedFormParameters() {
 
     @Override
     public MultivaluedMap<String, FormPartValue> getMultiPartFormParameters() {
-        if (context == null) return null;
+        if (context == null) {
+            return null;
+        }
         FormData formData = context.getFormData();
 
         if (formData == null) {
@@ -122,7 +130,9 @@ public MultivaluedMap<String, FormPartValue> getMultiPartFormParameters() {
 
     @Override
     public HttpHeaders getHttpHeaders() {
-        if (context == null) return null;
+        if (context == null) {
+            return null;
+        }
         return context.getHttpHeaders();
     }
 
@@ -151,7 +161,16 @@ public X509Certificate[] getClientCertificateChain() {
 
     @Override
     public UriInfo getUri() {
-        if (context == null) return null;
+        if (context == null) {
+            return null;
+        }
         return context.getUriInfo();
     }
+
+    @Override
+    public boolean isProxyTrusted() {
+        boolean noTrustedProxies = Configuration.getOptionalKcValue(ProxyOptions.PROXY_TRUSTED_ADDRESSES).isEmpty();
+        return noTrustedProxies
+                || Boolean.parseBoolean(this.getHttpHeaders().getHeaderString("X-Forwarded-Trusted-Proxy"));
+    }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/logging/KeycloakLogFilter.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/logging/KeycloakLogFilter.java
new file mode 100644
index 000000000000..da106fe846b0
--- /dev/null
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/logging/KeycloakLogFilter.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.logging;
+
+import io.quarkus.logging.LoggingFilter;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+import org.keycloak.common.util.MultiSiteUtils;
+
+import java.util.Objects;
+import java.util.logging.Filter;
+import java.util.logging.Level;
+import java.util.logging.LogRecord;
+import java.util.regex.Pattern;
+
+/**
+ * @author Alexander Schwartz
+ */
+@LoggingFilter(name = "keycloak-filter")
+public final class KeycloakLogFilter implements Filter {
+
+    // avoid logging ISPN000312 for sessions, offlineSessions, clientSessions and offlineClientSessions caches only.
+    private static final Pattern ISPN000312_PATTERN = Pattern.compile(
+            "^\\[Context=(" + String.join("|", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME) + ")] ISPN000312: .*");
+
+    @Override
+    public boolean isLoggable(LogRecord record) {
+        // The ARJUNA012125 messages are logged and then thrown.
+        // As those messages might later be caught and handled, this is an antipattern so we prevent logging them.
+        // https://narayana.zulipchat.com/#narrow/channel/323714-users/topic/Message.20.22ARJUNA012125.22.20implements.20log-and-throw.20antipattern
+        if (Objects.equals(record.getLevel(), Level.WARNING) && record.getLoggerName().equals("com.arjuna.ats.arjuna") && record.getMessage().startsWith("ARJUNA012125:")) {
+            return false;
+        }
+
+        if (MultiSiteUtils.isPersistentSessionsEnabled()) {
+            // Suppress messages for ISPN000312 as there shouldn't be a warning as this is expected as user and client sessions have only a single owner.
+            // https://github.com/keycloak/keycloak/issues/39816
+            if (Objects.equals(record.getLevel(), Level.WARNING) && record.getLoggerName().equals("org.infinispan.CLUSTER") && ISPN000312_PATTERN.matcher(record.getMessage()).matches()) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/ConstantsDebugHostname.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/ConstantsDebugHostname.java
index e70db068d031..a8233d3b2112 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/ConstantsDebugHostname.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/ConstantsDebugHostname.java
@@ -16,44 +16,36 @@
  */
 package org.keycloak.quarkus.runtime.services.resources;
 
+import java.util.stream.Stream;
+
+import org.keycloak.config.HostnameV2Options;
+import org.keycloak.config.HttpOptions;
+import org.keycloak.config.ProxyOptions;
+
 public class ConstantsDebugHostname {
-    public static final String[] RELEVANT_HEADERS = new String[] {
-            "Host",
-            "Forwarded",
+    public static final String[] X_FORWARDED_PROXY_HEADERS = new String[] {
             "X-Forwarded-Host",
             "X-Forwarded-Proto",
             "X-Forwarded-Port",
             "X-Forwarded-For"
     };
 
-    public static final String[] RELEVANT_OPTIONS = {
-            "hostname",
-            "hostname-url",
-            "hostname-admin",
-            "hostname-admin-url",
-            "hostname-strict",
-            "hostname-strict-backchannel",
-            "hostname-strict-https",
-            "hostname-path",
-            "hostname-port",
-            "proxy",
-            "proxy-headers",
-            "http-enabled",
-            "http-relative-path",
-            "http-port",
-            "https-port"
-    };
+    public static final String FORWARDED_PROXY_HEADER = "Forwarded";
+
+    public static final String[] RELEVANT_HEADERS = Stream
+            .concat(Stream.of("Host", FORWARDED_PROXY_HEADER), Stream.of(X_FORWARDED_PROXY_HEADERS))
+            .toArray(String[]::new);
 
     public static final String[] RELEVANT_OPTIONS_V2 = {
-            "hostname",
-            "hostname-admin",
-            "hostname-backchannel-dynamic",
-            "hostname-strict",
-            "proxy-headers",
-            "http-enabled",
-            "http-relative-path",
-            "http-port",
-            "https-port"
+            HostnameV2Options.HOSTNAME.getKey(),
+            HostnameV2Options.HOSTNAME_ADMIN.getKey(),
+            HostnameV2Options.HOSTNAME_BACKCHANNEL_DYNAMIC.getKey(),
+            HostnameV2Options.HOSTNAME_STRICT.getKey(),
+            ProxyOptions.PROXY_HEADERS.getKey(),
+            HttpOptions.HTTP_ENABLED.getKey(),
+            HttpOptions.HTTP_RELATIVE_PATH.getKey(),
+            HttpOptions.HTTP_PORT.getKey(),
+            HttpOptions.HTTPS_PORT.getKey()
     };
 
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/DebugHostnameSettingsResource.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/DebugHostnameSettingsResource.java
index 60787282837d..01b9ea6e8cfa 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/DebugHostnameSettingsResource.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/DebugHostnameSettingsResource.java
@@ -16,35 +16,44 @@
  */
 package org.keycloak.quarkus.runtime.services.resources;
 
-import io.quarkus.resteasy.reactive.server.EndpointDisabled;
-import jakarta.ws.rs.GET;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.PathParam;
-import jakarta.ws.rs.Produces;
-import jakarta.ws.rs.core.Context;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.ext.Provider;
-import org.keycloak.common.Profile;
+import java.io.IOException;
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+
+import org.keycloak.common.util.UriUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.quarkus.runtime.configuration.mappers.HostnameV2PropertyMappers;
 import org.keycloak.services.Urls;
 import org.keycloak.services.cors.Cors;
 import org.keycloak.theme.FreeMarkerException;
 import org.keycloak.theme.Theme;
 import org.keycloak.theme.freemarker.FreeMarkerProvider;
 import org.keycloak.urls.UrlType;
+import org.keycloak.utils.SecureContextResolver;
 
-import java.io.IOException;
-import java.net.URI;
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.TreeMap;
+import io.quarkus.resteasy.reactive.server.EndpointDisabled;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.Provider;
 
 @Provider
 @Path("/realms")
@@ -62,7 +71,7 @@ public class DebugHostnameSettingsResource {
     public DebugHostnameSettingsResource() {
 
         this.allConfigPropertiesMap = new LinkedHashMap<>();
-        String[] relevantOptions = Profile.isFeatureEnabled(Profile.Feature.HOSTNAME_V2) ? ConstantsDebugHostname.RELEVANT_OPTIONS_V2 : ConstantsDebugHostname.RELEVANT_OPTIONS;
+        String[] relevantOptions = ConstantsDebugHostname.RELEVANT_OPTIONS_V2;
         for (String key : relevantOptions) {
             addOption(key);
         }
@@ -81,22 +90,26 @@ public String debug(final @PathParam("realmName") String realmName) throws IOExc
 
         FreeMarkerProvider freeMarkerProvider = keycloakSession.getProvider(FreeMarkerProvider.class);
 
+        List<String> configWarnings = new ArrayList<String>();
+        HostnameV2PropertyMappers.validateConfig(configWarnings::add);
+
         URI frontendUri = keycloakSession.getContext().getUri(UrlType.FRONTEND).getBaseUri();
         URI backendUri = keycloakSession.getContext().getUri(UrlType.BACKEND).getBaseUri();
         URI adminUri = keycloakSession.getContext().getUri(UrlType.ADMIN).getBaseUri();
 
-        String frontendTestUrl = getTest(realmModel, frontendUri);
-        String backendTestUrl = getTest(realmModel, backendUri);
-        String adminTestUrl = getTest(realmModel, adminUri);
+        String frontendTestUrl = getTest(realmModel, frontendUri, true);
+        String backendTestUrl = getTest(realmModel, backendUri, false);
+        String adminTestUrl = getTest(realmModel, adminUri, false);
 
         Map<String, Object> attributes = new HashMap<>();
+        attributes.put("configWarnings", configWarnings);
         attributes.put("frontendUrl", frontendUri.toString());
         attributes.put("backendUrl", backendUri.toString());
         attributes.put("adminUrl", adminUri.toString());
 
         attributes.put("realm", realmModel.getName());
         attributes.put("realmUrl", realmModel.getAttribute("frontendUrl"));
-        attributes.put("implVersion", Profile.isFeatureEnabled(Profile.Feature.HOSTNAME_V2) ? "V2" : "V1");
+        attributes.put("implVersion", "V2");
 
         attributes.put("frontendTestUrl", frontendTestUrl);
         attributes.put("backendTestUrl", backendTestUrl);
@@ -117,22 +130,52 @@ public String debug(final @PathParam("realmName") String realmName) throws IOExc
     @GET
     @Path("/{realmName}/" + DEFAULT_PATH_SUFFIX + "/" + PATH_FOR_TEST_CORS_IN_HEADERS)
     @Produces(MediaType.TEXT_PLAIN)
-    public Response test(final @PathParam("realmName") String realmName) {
-        Response.ResponseBuilder builder = Response.ok(PATH_FOR_TEST_CORS_IN_HEADERS + "-OK");
-        String origin = keycloakSession.getContext().getRequestHeaders().getHeaderString(Cors.ORIGIN_HEADER);
-        builder.header(Cors.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+    public Response test(final @PathParam("realmName") String realmName, @DefaultValue("false") @QueryParam("frontEnd") boolean frontEnd) {
+        String text = "OK";
+        String corsOrigin = keycloakSession.getContext().getRequestHeaders().getHeaderString(Cors.ORIGIN_HEADER);
+        URI requestUri = keycloakSession.getContext().getUri().getRequestUri();
+        String requestOrigin = UriUtils.getOrigin(requestUri);
+        URI frontendUri = keycloakSession.getContext().getUri(UrlType.FRONTEND).getBaseUri();
+
+        if (frontEnd) {
+            boolean originMatches = requestOrigin.equals(UriUtils.getOrigin(frontendUri));
+            HttpHeaders requestHeaders = keycloakSession.getContext().getRequestHeaders();
+            boolean fowarded = requestHeaders.getHeaderString(ConstantsDebugHostname.FORWARDED_PROXY_HEADER) != null;
+            boolean xfowarded = Stream.of(ConstantsDebugHostname.X_FORWARDED_PROXY_HEADERS)
+                    .map(requestHeaders::getHeaderString).anyMatch(Objects::nonNull);
+
+            if (!originMatches) { // might fail CORS checks
+                text = "Default origin check failing, request hostname does not match frontend hostname. Please check you proxy settings.";
+                if (!keycloakSession.getContext().getHttpRequest().isProxyTrusted()) {
+                    text += " Note the proxy is not trusted.";
+                }
+                if (!fowarded && !xfowarded) {
+                    text += " No proxy headers are set on the request.";
+                }
+            }
+
+            boolean https = requestUri.getScheme().equals("https");
+            if (https) {
+                // if reencrypt, then proxy headers may need set
+                // if passthrough, then proxy headers should not be set
+
+                // TODO: not sure if there is great way to do this. Would likely need to check that a connection to the frontend uses the same
+                // cert as what is coming in on this request
+            } else if (!SecureContextResolver.isSecureContext(keycloakSession)) {
+                text += " Non-secure context detected - Keycloak will not function properly when accessed over http at a non-localhost host.";
+            }
+        }
+
+        Response.ResponseBuilder builder = Response.ok(text);
+        builder.header(Cors.ACCESS_CONTROL_ALLOW_ORIGIN, corsOrigin);
         builder.header(Cors.ACCESS_CONTROL_ALLOW_METHODS, "GET");
         return builder.build();
     }
 
     private void addOption(String key) {
-        String rawValue = Configuration.getRawValue("kc." + key);
-        if (rawValue != null && !rawValue.isEmpty()) {
-            this.allConfigPropertiesMap.put(key, rawValue);
-        }
+        Configuration.getOptionalKcValue(key).ifPresent(value -> this.allConfigPropertiesMap.put(key, value));
     }
 
-
     private Map<String, String> getHeaders() {
         Map<String, String> headers = new TreeMap<>();
         HttpHeaders requestHeaders = keycloakSession.getContext().getRequestHeaders();
@@ -149,9 +192,10 @@ private void addProxyHeader(String header, Map<String, String> proxyHeaders, Htt
         }
     }
 
-    private String getTest(RealmModel realmModel, URI baseUri) {
+    private String getTest(RealmModel realmModel, URI baseUri, boolean frontEnd) {
         return Urls.realmBase(baseUri)
                    .path("/{realmName}/{debugHostnameSettingsPath}/{pathForTestCORSInHeaders}")
+                   .queryParam("frontEnd", frontEnd)
                    .build(realmModel.getName(), DEFAULT_PATH_SUFFIX, PATH_FOR_TEST_CORS_IN_HEADERS)
                    .toString();
     }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/AbstractJpaConnectionProviderFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/AbstractJpaConnectionProviderFactory.java
index 6166689b6a3b..eda2fad728ac 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/AbstractJpaConnectionProviderFactory.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/jpa/AbstractJpaConnectionProviderFactory.java
@@ -28,8 +28,9 @@
 import jakarta.persistence.SynchronizationType;
 import org.hibernate.internal.SessionFactoryImpl;
 import org.keycloak.Config;
+import org.keycloak.config.DatabaseOptions;
 import org.keycloak.connections.jpa.JpaConnectionProviderFactory;
-import org.keycloak.connections.jpa.PersistenceExceptionConverter;
+import org.keycloak.connections.jpa.support.EntityManagerProxy;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
@@ -59,7 +60,7 @@ public Connection getConnection() {
 
     @Override
     public String getSchema() {
-        String schema = Configuration.getRawValue("kc.db-schema");
+        String schema = Configuration.getConfigValue(DatabaseOptions.DB_SCHEMA).getValue();
         if (schema != null && schema.contains("-") && ! Boolean.parseBoolean(System.getProperty(GlobalConfiguration.PRESERVE_SCHEMA_CASE.getKey()))) {
             System.setProperty(GlobalConfiguration.PRESERVE_SCHEMA_CASE.getKey(), "true");
             logger.warnf("The passed schema '%s' contains a dash. Setting liquibase config option PRESERVE_SCHEMA_CASE to true. See https://github.com/keycloak/keycloak/issues/20870 for more information.", schema);
@@ -108,7 +109,7 @@ public String value() {
     }
 
     protected EntityManager createEntityManager(EntityManagerFactory emf, KeycloakSession session) {
-        EntityManager entityManager = PersistenceExceptionConverter.create(session, emf.createEntityManager(SynchronizationType.SYNCHRONIZED));
+        EntityManager entityManager = EntityManagerProxy.create(session, emf.createEntityManager(SynchronizationType.SYNCHRONIZED));
 
         entityManager.setFlushMode(FlushModeType.AUTO);
 
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/liquibase/QuarkusJpaUpdaterProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/liquibase/QuarkusJpaUpdaterProvider.java
index 4a5321393875..4688fc2310f4 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/liquibase/QuarkusJpaUpdaterProvider.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/database/liquibase/QuarkusJpaUpdaterProvider.java
@@ -57,7 +57,6 @@
 import liquibase.snapshot.SnapshotGeneratorFactory;
 import liquibase.statement.SqlStatement;
 import liquibase.statement.core.AddColumnStatement;
-import liquibase.statement.core.CreateDatabaseChangeLogTableStatement;
 import liquibase.statement.core.SetNullableStatement;
 import liquibase.statement.core.UpdateStatement;
 import liquibase.structure.core.Column;
@@ -145,7 +144,7 @@ protected void updateChangeSet(KeycloakLiquibase liquibase, Writer exportWriter)
 
             // create DEPLOYMENT_ID column if it doesn't exist
             if (!hasDeploymentIdColumn) {
-                ChangeLogHistoryService changelogHistoryService = ChangeLogHistoryServiceFactory.getInstance().getChangeLogService(database);
+                ChangeLogHistoryService changelogHistoryService = getChangeLogHistoryService().getChangeLogService(database);
                 changelogHistoryService.generateDeploymentId();
                 String deploymentId = changelogHistoryService.getDeploymentId();
 
@@ -213,13 +212,11 @@ private void outputChangeLogTableCreationScript(Liquibase liquibase, final Write
         loggingExecutor.comment("* Keycloak database creation script - apply this script to empty DB *");
         loggingExecutor.comment("*********************************************************************" + StreamUtil.getLineSeparator());
 
-        loggingExecutor.execute(new CreateDatabaseChangeLogTableStatement());
+        // DatabaseChangeLogTable is automatically added to the script by Liquibase
         // DatabaseChangeLogLockTable is created before this code is executed and recreated if it does not exist automatically
         // in org.keycloak.connections.jpa.updater.liquibase.lock.CustomLockService.init() called indirectly from
         // KeycloakApplication constructor (search for waitForLock() call). Hence it is not included in the creation script.
 
-        loggingExecutor.comment("*********************************************************************" + StreamUtil.getLineSeparator());
-
         executorService.setExecutor(LiquibaseConstants.JDBC_EXECUTOR, database, oldTemplate);
     }
 
@@ -284,7 +281,11 @@ protected Status validateChangeSet(KeycloakLiquibase liquibase, String changelog
 
     private void resetLiquibaseServices(KeycloakLiquibase liquibase) {
         liquibase.resetServices();
-        ChangeLogHistoryServiceFactory.getInstance().register(new CustomChangeLogHistoryService());
+        getChangeLogHistoryService().register(new CustomChangeLogHistoryService());
+    }
+
+    private ChangeLogHistoryServiceFactory getChangeLogHistoryService() {
+        return Scope.getCurrentScope().getSingleton(ChangeLogHistoryServiceFactory.class);
     }
 
     private List<ChangeSet> getLiquibaseUnrunChangeSets(Liquibase liquibase) {
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/CacheManagerFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/CacheManagerFactory.java
deleted file mode 100644
index b41ece36df90..000000000000
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/CacheManagerFactory.java
+++ /dev/null
@@ -1,636 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.storage.infinispan;
-
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
-import java.util.function.Function;
-import java.util.function.Supplier;
-import java.util.stream.Stream;
-
-import io.agroal.api.AgroalDataSource;
-import io.micrometer.core.instrument.Metrics;
-import io.quarkus.arc.Arc;
-import jakarta.persistence.EntityManager;
-
-import org.infinispan.client.hotrod.RemoteCache;
-import org.infinispan.client.hotrod.RemoteCacheManager;
-import org.infinispan.client.hotrod.RemoteCacheManagerAdmin;
-import org.infinispan.client.hotrod.impl.ConfigurationProperties;
-import org.infinispan.commons.dataconversion.MediaType;
-import org.infinispan.commons.internal.InternalCacheNames;
-import org.infinispan.commons.util.concurrent.CompletableFutures;
-import org.infinispan.configuration.cache.CacheMode;
-import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.configuration.cache.HashConfiguration;
-import org.infinispan.configuration.cache.PersistenceConfigurationBuilder;
-import org.infinispan.configuration.global.GlobalConfiguration;
-import org.infinispan.configuration.global.ShutdownHookBehavior;
-import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
-import org.infinispan.configuration.parsing.ParserRegistry;
-import org.infinispan.manager.DefaultCacheManager;
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.infinispan.metrics.config.MicrometerMeterRegisterConfigurationBuilder;
-import org.infinispan.persistence.remote.configuration.ExhaustedAction;
-import org.infinispan.persistence.remote.configuration.RemoteStoreConfigurationBuilder;
-import org.infinispan.protostream.descriptors.FileDescriptor;
-import org.infinispan.query.remote.client.ProtobufMetadataManagerConstants;
-import org.infinispan.remoting.transport.jgroups.EmbeddedJGroupsChannelConfigurator;
-import org.infinispan.remoting.transport.jgroups.JGroupsTransport;
-import org.jboss.logging.Logger;
-import org.jgroups.conf.ProtocolConfiguration;
-import org.jgroups.protocols.JDBC_PING2;
-import org.jgroups.protocols.TCP_NIO2;
-import org.jgroups.protocols.UDP;
-import org.jgroups.util.TLS;
-import org.jgroups.util.TLSClientAuth;
-import org.keycloak.common.Profile;
-import org.keycloak.common.util.MultiSiteUtils;
-import org.keycloak.config.CachingOptions;
-import org.keycloak.config.MetricsOptions;
-import org.keycloak.connections.jpa.JpaConnectionProvider;
-import org.keycloak.connections.jpa.util.JpaUtils;
-import org.keycloak.infinispan.util.InfinispanUtils;
-import org.keycloak.marshalling.KeycloakIndexSchemaUtil;
-import org.keycloak.marshalling.KeycloakModelSchema;
-import org.keycloak.marshalling.Marshalling;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.query.ClientSessionQueries;
-import org.keycloak.models.sessions.infinispan.query.UserSessionQueries;
-import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanAuthenticationSessionProviderFactory;
-import org.keycloak.models.sessions.infinispan.remote.RemoteUserLoginFailureProviderFactory;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
-
-import javax.net.ssl.SSLContext;
-import javax.sql.DataSource;
-
-import static org.infinispan.configuration.global.TransportConfiguration.STACK;
-import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_FILE_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_REMOTE_HOST_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_REMOTE_PASSWORD_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_REMOTE_PORT_PROPERTY;
-import static org.keycloak.config.CachingOptions.CACHE_REMOTE_USERNAME_PROPERTY;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.CLUSTERED_CACHE_NAMES;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.USER_SESSION_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.WORK_CACHE_NAME;
-import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.skipSessionsCacheIfRequired;
-import static org.wildfly.security.sasl.util.SaslMechanismInformation.Names.SCRAM_SHA_512;
-
-public class CacheManagerFactory {
-
-    private static final Logger logger = Logger.getLogger(CacheManagerFactory.class);
-
-    private final CompletableFuture<EmbeddedCacheManager> cacheManagerFuture;
-    private final CompletableFuture<RemoteCacheManager> remoteCacheManagerFuture;
-    private final Function<EntityManager, EmbeddedCacheManager> jdbcCacheManagerFunction;
-    private volatile EmbeddedCacheManager cacheManager;
-
-    public CacheManagerFactory(String config) {
-        ConfigurationBuilderHolder builder = new ParserRegistry().parse(config);
-        if (!isJdbcPingRequired(builder)) {
-            cacheManagerFuture = CompletableFuture.supplyAsync(() -> startEmbeddedCacheManager(builder, null));
-            jdbcCacheManagerFunction = null;
-        } else {
-            cacheManagerFuture = null;
-            jdbcCacheManagerFunction = em -> startEmbeddedCacheManager(builder, em);
-        }
-
-        if (InfinispanUtils.isRemoteInfinispan()) {
-            logger.debug("Remote Cache feature is enabled");
-            this.remoteCacheManagerFuture = CompletableFuture.supplyAsync(this::startRemoteCacheManager);
-        } else {
-            logger.debug("Remote Cache feature is disabled");
-            this.remoteCacheManagerFuture = CompletableFutures.completedNull();
-        }
-    }
-
-    private static boolean isJdbcPingRequired(ConfigurationBuilderHolder builder) {
-        if (InfinispanUtils.isRemoteInfinispan())
-            return false;
-
-        var transportConfig = builder.getGlobalConfigurationBuilder().transport();
-        if (transportConfig.getTransport() == null)
-            return false;
-
-        String transportStack = Configuration.getRawValue("kc.cache-stack");
-        if (transportStack != null && !isJdbcPingStack(transportStack))
-            return false;
-
-        var stackXmlAttribute = transportConfig.defaultTransport().attributes().attribute(STACK);
-        return !stackXmlAttribute.isModified() || isJdbcPingStack(stackXmlAttribute.get());
-    }
-
-    public EmbeddedCacheManager getOrCreateEmbeddedCacheManager(KeycloakSession keycloakSession) {
-        if (cacheManagerFuture != null)
-            return join(cacheManagerFuture);
-
-        if (cacheManager == null) {
-           synchronized (this) {
-              if (cacheManager == null) {
-                  EntityManager em = keycloakSession.getProvider(JpaConnectionProvider.class).getEntityManager();
-                  cacheManager = jdbcCacheManagerFunction.apply(em);
-              }
-           }
-        }
-        return cacheManager;
-    }
-
-    public RemoteCacheManager getOrCreateRemoteCacheManager() {
-        return join(remoteCacheManagerFuture);
-    }
-
-    private static <T> T join(Future<T> future) {
-        try {
-            return future.get(getStartTimeout(), TimeUnit.SECONDS);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            return null;
-        } catch (ExecutionException | TimeoutException e) {
-            throw new RuntimeException("Failed to start embedded or remote cache manager", e);
-        }
-    }
-
-    private RemoteCacheManager startRemoteCacheManager() {
-        logger.info("Starting Infinispan remote cache manager (Hot Rod Client)");
-        String cacheRemoteHost = requiredStringProperty(CACHE_REMOTE_HOST_PROPERTY);
-        Integer cacheRemotePort = Configuration.getOptionalKcValue(CACHE_REMOTE_PORT_PROPERTY)
-                .map(Integer::parseInt)
-                .orElse(ConfigurationProperties.DEFAULT_HOTROD_PORT);
-
-        org.infinispan.client.hotrod.configuration.ConfigurationBuilder builder = new org.infinispan.client.hotrod.configuration.ConfigurationBuilder();
-        builder.addServer().host(cacheRemoteHost).port(cacheRemotePort);
-        builder.connectionPool().maxActive(16).exhaustedAction(org.infinispan.client.hotrod.configuration.ExhaustedAction.CREATE_NEW);
-
-        if (isRemoteTLSEnabled()) {
-            builder.security().ssl()
-                    .enable()
-                    .sslContext(createSSLContext())
-                    .sniHostName(cacheRemoteHost);
-        }
-
-        if (isRemoteAuthenticationEnabled()) {
-            builder.security().authentication()
-                    .enable()
-                    .username(requiredStringProperty(CACHE_REMOTE_USERNAME_PROPERTY))
-                    .password(requiredStringProperty(CACHE_REMOTE_PASSWORD_PROPERTY))
-                    .realm("default")
-                    .saslMechanism(SCRAM_SHA_512);
-        }
-
-        Marshalling.configure(builder);
-
-        if (shouldCreateRemoteCaches()) {
-            createRemoteCaches(builder);
-        }
-
-        var remoteCacheManager = new RemoteCacheManager(builder.build());
-
-        // update the schema before trying to access the caches
-        updateProtoSchema(remoteCacheManager);
-
-        // establish connection to all caches
-        if (isStartEagerly()) {
-            skipSessionsCacheIfRequired(Arrays.stream(CLUSTERED_CACHE_NAMES)).forEach(remoteCacheManager::getCache);
-        }
-        return remoteCacheManager;
-    }
-
-    private static void createRemoteCaches(org.infinispan.client.hotrod.configuration.ConfigurationBuilder builder) {
-        // fall back for distributed caches if not defined
-        logger.warn("Creating remote cache in external Infinispan server. It should not be used in production!");
-        var baseConfig = defaultRemoteCacheBuilder().build();
-
-        skipSessionsCacheIfRequired(Arrays.stream(CLUSTERED_CACHE_NAMES))
-                .forEach(name -> builder.remoteCache(name).configuration(baseConfig.toStringConfiguration(name)));
-    }
-
-    private static ConfigurationBuilder defaultRemoteCacheBuilder() {
-        var builder = new ConfigurationBuilder();
-        builder.clustering().cacheMode(CacheMode.DIST_SYNC);
-        builder.encoding().mediaType(MediaType.APPLICATION_PROTOSTREAM);
-        return builder;
-    }
-
-    private void updateProtoSchema(RemoteCacheManager remoteCacheManager) {
-        var key = KeycloakModelSchema.INSTANCE.getProtoFileName();
-        var current = KeycloakModelSchema.INSTANCE.getProtoFile();
-
-        RemoteCache<String, String> protostreamMetadataCache = remoteCacheManager.getCache(InternalCacheNames.PROTOBUF_METADATA_CACHE_NAME);
-        var stored = protostreamMetadataCache.getWithMetadata(key);
-        if (stored == null) {
-            if (protostreamMetadataCache.putIfAbsent(key, current) == null) {
-                logger.info("Infinispan ProtoStream schema uploaded for the first time.");
-            } else {
-                logger.info("Failed to update Infinispan ProtoStream schema. Assumed it was updated by other Keycloak server.");
-            }
-            checkForProtoSchemaErrors(protostreamMetadataCache);
-            return;
-        }
-        if (Objects.equals(stored.getValue(), current)) {
-            logger.info("Infinispan ProtoStream schema is up to date!");
-            return;
-        }
-        if (protostreamMetadataCache.replaceWithVersion(key, current, stored.getVersion())) {
-            logger.info("Infinispan ProtoStream schema successful updated.");
-            reindexCaches(remoteCacheManager, stored.getValue(), current);
-        } else {
-            logger.info("Failed to update Infinispan ProtoStream schema. Assumed it was updated by other Keycloak server.");
-        }
-        checkForProtoSchemaErrors(protostreamMetadataCache);
-    }
-
-    private void checkForProtoSchemaErrors(RemoteCache<String, String> protostreamMetadataCache) {
-        String errors = protostreamMetadataCache.get(ProtobufMetadataManagerConstants.ERRORS_KEY_SUFFIX);
-        if (errors != null) {
-            for (String errorFile : errors.split("\n")) {
-                logger.errorf("%nThere was an error in proto file: %s%nError message: %s%nCurrent proto schema: %s%n",
-                        errorFile,
-                        protostreamMetadataCache.get(errorFile + ProtobufMetadataManagerConstants.ERRORS_KEY_SUFFIX),
-                        protostreamMetadataCache.get(errorFile));
-            }
-        }
-    }
-
-    private static void reindexCaches(RemoteCacheManager remoteCacheManager, String oldSchema, String newSchema) {
-        var oldPS = KeycloakModelSchema.parseProtoSchema(oldSchema);
-        var newPS = KeycloakModelSchema.parseProtoSchema(newSchema);
-        var admin = remoteCacheManager.administration();
-
-        if (isEntityChanged(oldPS, newPS, RemoteUserLoginFailureProviderFactory.PROTO_ENTITY)) {
-            updateSchemaAndReIndexCache(admin, LOGIN_FAILURE_CACHE_NAME);
-        }
-
-        if (isEntityChanged(oldPS, newPS, RemoteInfinispanAuthenticationSessionProviderFactory.PROTO_ENTITY)) {
-            updateSchemaAndReIndexCache(admin, AUTHENTICATION_SESSIONS_CACHE_NAME);
-        }
-
-        if (isEntityChanged(oldPS, newPS, ClientSessionQueries.CLIENT_SESSION)) {
-            updateSchemaAndReIndexCache(admin, CLIENT_SESSION_CACHE_NAME);
-            updateSchemaAndReIndexCache(admin, OFFLINE_CLIENT_SESSION_CACHE_NAME);
-        }
-
-        if (isEntityChanged(oldPS, newPS, UserSessionQueries.USER_SESSION)) {
-            updateSchemaAndReIndexCache(admin, USER_SESSION_CACHE_NAME);
-            updateSchemaAndReIndexCache(admin, OFFLINE_USER_SESSION_CACHE_NAME);
-        }
-    }
-
-    private static boolean isEntityChanged(FileDescriptor oldSchema, FileDescriptor newSchema, String entity) {
-        var v1 = KeycloakModelSchema.findEntity(oldSchema, entity);
-        var v2 = KeycloakModelSchema.findEntity(newSchema, entity);
-        return v1.isPresent() && v2.isPresent() && KeycloakIndexSchemaUtil.isIndexSchemaChanged(v1.get(), v2.get());
-    }
-
-    private static void updateSchemaAndReIndexCache(RemoteCacheManagerAdmin admin, String cacheName) {
-        admin.updateIndexSchema(cacheName);
-        admin.reindexCache(cacheName);
-    }
-
-    private EmbeddedCacheManager startEmbeddedCacheManager(ConfigurationBuilderHolder builder, EntityManager em) {
-        logger.info("Starting Infinispan embedded cache manager");
-
-        // We must disable the Infinispan default ShutdownHook as we manage the EmbeddedCacheManager lifecycle explicitly
-        // with #shutdown and multiple calls to EmbeddedCacheManager#stop can lead to Exceptions being thrown
-        builder.getGlobalConfigurationBuilder().shutdown().hookBehavior(ShutdownHookBehavior.DONT_REGISTER);
-
-        if (Configuration.isTrue(MetricsOptions.METRICS_ENABLED)) {
-            builder.getGlobalConfigurationBuilder().addModule(MicrometerMeterRegisterConfigurationBuilder.class);
-            builder.getGlobalConfigurationBuilder().module(MicrometerMeterRegisterConfigurationBuilder.class).meterRegistry(Metrics.globalRegistry);
-            builder.getGlobalConfigurationBuilder().cacheContainer().statistics(true);
-            builder.getGlobalConfigurationBuilder().metrics().namesAsTags(true);
-            if (Configuration.isTrue(CachingOptions.CACHE_METRICS_HISTOGRAMS_ENABLED)) {
-                builder.getGlobalConfigurationBuilder().metrics().histograms(true);
-            }
-            builder.getNamedConfigurationBuilders().forEach((s, configurationBuilder) -> configurationBuilder.statistics().enabled(true));
-        }
-
-        Marshalling.configure(builder.getGlobalConfigurationBuilder());
-        if (InfinispanUtils.isRemoteInfinispan()) {
-            var builders = builder.getNamedConfigurationBuilders();
-            // remove all distributed caches
-            logger.debug("Removing all distributed caches.");
-            for (String cacheName : CLUSTERED_CACHE_NAMES) {
-               if (hasRemoteStore(builders.get(cacheName))) {
-                   logger.warnf("remote-store configuration detected for cache '%s'. Explicit cache configuration ignored when using '%s' or '%s' Features.", cacheName, Profile.Feature.CLUSTERLESS.getKey(), Profile.Feature.MULTI_SITE.getKey());
-               }
-               builders.remove(cacheName);
-            }
-            // Disable JGroups, not required when the data is stored in the Remote Cache.
-            // The existing caches are local and do not require JGroups to work properly.
-            builder.getGlobalConfigurationBuilder().nonClusteredDefault();
-        } else {
-            // embedded mode!
-            if (builder.getNamedConfigurationBuilders().entrySet().stream().anyMatch(c -> c.getValue().clustering().cacheMode().isClustered())) {
-                configureTransportStack(builder, em);
-                configureRemoteStores(builder);
-            }
-            configureCacheMaxCount(builder, CachingOptions.CLUSTERED_MAX_COUNT_CACHES);
-            configureSessionsCaches(builder);
-            validateWorkCacheConfiguration(builder);
-        }
-        configureCacheMaxCount(builder, CachingOptions.LOCAL_MAX_COUNT_CACHES);
-        checkForRemoteStores(builder);
-
-        return new DefaultCacheManager(builder, isStartEagerly());
-    }
-
-    private static boolean isRemoteTLSEnabled() {
-        return Configuration.isTrue(CachingOptions.CACHE_REMOTE_TLS_ENABLED);
-    }
-
-    private static boolean isRemoteAuthenticationEnabled() {
-        return Configuration.getOptionalKcValue(CACHE_REMOTE_USERNAME_PROPERTY).isPresent() ||
-                Configuration.getOptionalKcValue(CACHE_REMOTE_PASSWORD_PROPERTY).isPresent();
-    }
-
-    private static boolean shouldCreateRemoteCaches() {
-        return Boolean.getBoolean("kc.cache-remote-create-caches");
-    }
-
-    private static SSLContext createSSLContext() {
-        try {
-            // uses the default Java Runtime TrustStore, or the one generated by Keycloak (see org.keycloak.truststore.TruststoreBuilder)
-            var sslContext = SSLContext.getInstance("TLS");
-            sslContext.init(null, null, null);
-            return sslContext;
-        } catch (NoSuchAlgorithmException | KeyManagementException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    private static boolean isStartEagerly() {
-        // eagerly starts caches by default
-        return Boolean.parseBoolean(System.getProperty("kc.cache-ispn-start-eagerly", Boolean.TRUE.toString()));
-    }
-
-    private static int getStartTimeout() {
-        return Integer.getInteger("kc.cache-ispn-start-timeout", 120);
-    }
-
-    private static void configureTransportStack(ConfigurationBuilderHolder builder, EntityManager em) {
-        var transportConfig = builder.getGlobalConfigurationBuilder().transport();
-        if (Configuration.isTrue(CachingOptions.CACHE_EMBEDDED_MTLS_ENABLED)) {
-            validateTlsAvailable(transportConfig.build());
-            var tls = new TLS()
-                  .enabled(true)
-                  .setKeystorePath(requiredStringProperty(CACHE_EMBEDDED_MTLS_KEYSTORE_FILE_PROPERTY))
-                  .setKeystorePassword(requiredStringProperty(CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD_PROPERTY))
-                  .setKeystoreType("pkcs12")
-                  .setTruststorePath(requiredStringProperty(CACHE_EMBEDDED_MTLS_TRUSTSTORE_FILE_PROPERTY))
-                  .setTruststorePassword(requiredStringProperty(CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD_PROPERTY))
-                  .setTruststoreType("pkcs12")
-                  .setClientAuth(TLSClientAuth.NEED)
-                  .setProtocols(new String[]{"TLSv1.3"});
-            transportConfig.addProperty(JGroupsTransport.SOCKET_FACTORY, tls.createSocketFactory());
-            logger.info("MTLS enabled for communications for embedded caches");
-        }
-
-        String transportStack = Configuration.getRawValue("kc.cache-stack");
-        if (transportStack != null && !transportStack.isBlank() && !isJdbcPingStack(transportStack)) {
-            warnDeprecatedStack(transportStack);
-            transportConfig.defaultTransport().stack(transportStack);
-            return;
-        }
-
-        var stackXmlAttribute = transportConfig.defaultTransport().attributes().attribute(STACK);
-        // If the user has explicitly defined a transport stack that is not jdbc-ping or jdbc-ping-udp, return
-        if (stackXmlAttribute.isModified() && !isJdbcPingStack(stackXmlAttribute.get())) {
-            warnDeprecatedStack(stackXmlAttribute.get());
-            return;
-        }
-
-        var stackName = transportStack != null ?
-              transportStack :
-              stackXmlAttribute.isModified() ? stackXmlAttribute.get() : "jdbc-ping";
-        warnDeprecatedStack(stackName);
-
-        var udp = stackName.endsWith("udp");
-
-        var tableName = JpaUtils.getTableNameForNativeQuery("JGROUPS_PING", em);
-        var attributes = Map.of(
-              // Leave initialize_sql blank as table is already created by Keycloak
-              "initialize_sql", "",
-              // Explicitly specify clear and select_all SQL to ensure "cluster_name" column is used, as the default
-              // "cluster" cannot be used with Oracle DB as it's a reserved word.
-              "clear_sql", String.format("DELETE from %s WHERE cluster_name=?", tableName),
-              "delete_single_sql", String.format("DELETE from %s WHERE address=?", tableName),
-              "insert_single_sql", String.format("INSERT INTO %s values (?, ?, ?, ?, ?)", tableName),
-              "select_all_pingdata_sql", String.format("SELECT address, name, ip, coord FROM %s WHERE cluster_name=?", tableName),
-              "remove_all_data_on_view_change", "true",
-              "register_shutdown_hook", "false",
-              "stack.combine", "REPLACE",
-              "stack.position", udp ? "PING" : "MPING"
-        );
-        var stack = List.of(new ProtocolConfiguration(JDBC_PING2.class.getSimpleName(), attributes));
-        builder.addJGroupsStack(new EmbeddedJGroupsChannelConfigurator(stackName, stack, null), udp ? "udp" : "tcp");
-
-        Supplier<DataSource> dataSourceSupplier = Arc.container().select(AgroalDataSource.class)::get;
-        transportConfig.addProperty(JGroupsTransport.DATA_SOURCE, dataSourceSupplier);
-        transportConfig.defaultTransport().stack(stackName);
-    }
-
-    private static void warnDeprecatedStack(String stackName) {
-        switch (stackName) {
-            case "jdbc-ping-udp":
-            case "tcp":
-            case "udp":
-            case "azure":
-            case "ec2":
-            case "google":
-                Logger.getLogger(CacheManagerFactory.class).warnf("Stack '%s' is deprecated. We recommend to use 'jdbc-ping' instead", stackName);
-        }
-    }
-
-    private static boolean isJdbcPingStack(String stackName) {
-        return "jdbc-ping".equals(stackName) || "jdbc-ping-udp".equals(stackName);
-    }
-
-    private static void validateTlsAvailable(GlobalConfiguration config) {
-        var stackName = config.transport().stack();
-        if (stackName == null) {
-            // unable to validate
-            return;
-        }
-        for (var protocol : config.transport().jgroups().configurator(stackName).getProtocolStack()) {
-            var name = protocol.getProtocolName();
-            if (name.equals(UDP.class.getSimpleName()) ||
-                    name.equals(UDP.class.getName()) ||
-                    name.equals(TCP_NIO2.class.getSimpleName()) ||
-                    name.equals(TCP_NIO2.class.getName())) {
-                throw new RuntimeException("Cache TLS is not available with protocol " + name);
-            }
-        }
-
-    }
-
-    private static void configureRemoteStores(ConfigurationBuilderHolder builder) {
-        //if one of remote store command line parameters is defined, some other are required, otherwise assume it'd configured via xml only
-        if (Configuration.getOptionalKcValue(CACHE_REMOTE_HOST_PROPERTY).isPresent()) {
-
-            String cacheRemoteHost = requiredStringProperty(CACHE_REMOTE_HOST_PROPERTY);
-            Integer cacheRemotePort = Configuration.getOptionalKcValue(CACHE_REMOTE_PORT_PROPERTY)
-                    .map(Integer::parseInt)
-                    .orElse(ConfigurationProperties.DEFAULT_HOTROD_PORT);
-
-            SSLContext sslContext = createSSLContext();
-
-            Arrays.stream(CLUSTERED_CACHE_NAMES).forEach(cacheName -> {
-                PersistenceConfigurationBuilder persistenceCB = builder.getNamedConfigurationBuilders().get(cacheName).persistence();
-
-                //if specified via command line -> cannot be defined in the xml file
-                if (!persistenceCB.stores().isEmpty()) {
-                    throw new RuntimeException(String.format("Remote store for cache '%s' is already configured via CLI parameters. It should not be present in the XML file.", cacheName));
-                }
-
-                var storeBuilder = persistenceCB.addStore(RemoteStoreConfigurationBuilder.class);
-                storeBuilder
-                        .rawValues(true)
-                        .shared(true)
-                        .segmented(false)
-                        .remoteCacheName(cacheName)
-                        .connectionPool()
-                            .maxActive(16)
-                            .exhaustedAction(ExhaustedAction.CREATE_NEW)
-                        .addServer()
-                        .host(cacheRemoteHost)
-                        .port(cacheRemotePort);
-
-                if (isRemoteTLSEnabled()) {
-                    storeBuilder.remoteSecurity()
-                            .ssl()
-                            .enable()
-                            .sslContext(sslContext)
-                            .sniHostName(cacheRemoteHost);
-                }
-
-                if (isRemoteAuthenticationEnabled()) {
-                    storeBuilder.remoteSecurity()
-                            .authentication()
-                            .enable()
-                            .username(requiredStringProperty(CACHE_REMOTE_USERNAME_PROPERTY))
-                            .password(requiredStringProperty(CACHE_REMOTE_PASSWORD_PROPERTY))
-                            .realm("default")
-                            .saslMechanism(SCRAM_SHA_512);
-                }
-            });
-        }
-    }
-
-    private static void checkForRemoteStores(ConfigurationBuilderHolder builder) {
-        if (Profile.isFeatureEnabled(Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE) && Profile.isFeatureEnabled(Profile.Feature.MULTI_SITE)) {
-            logger.fatalf("Feature %s is now deprecated.%nFor multi-site (cross-dc) support, enable only %s.",
-                    Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey(), Profile.Feature.MULTI_SITE.getKey());
-            throw new RuntimeException("The features " + Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey() + " and " + Profile.Feature.MULTI_SITE.getKey() + " must not be enabled at the same time.");
-        }
-        if (Profile.isFeatureEnabled(Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE) && Profile.isFeatureEnabled(Profile.Feature.CLUSTERLESS)) {
-            logger.fatalf("Feature %s is now deprecated.%nFor multi-site (cross-dc) support, enable only %s.",
-                    Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey(), Profile.Feature.CLUSTERLESS.getKey());
-            throw new RuntimeException("The features " + Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey() + " and " + Profile.Feature.CLUSTERLESS.getKey() + " must not be enabled at the same time.");
-        }
-        if (!Profile.isFeatureEnabled(Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE)) {
-            if (builder.getNamedConfigurationBuilders().values().stream().anyMatch(CacheManagerFactory::hasRemoteStore)) {
-                logger.fatalf("Remote stores are not supported for embedded caches as feature %s is not enabled. This feature is disabled by default as it is now deprecated.%nFor keeping user sessions across restarts, use feature %s which is enabled by default.%nFor multi-site (cross-dc) support, enable %s.",
-                        Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey(), Profile.Feature.PERSISTENT_USER_SESSIONS.getKey(), Profile.Feature.MULTI_SITE.getKey());
-                throw new RuntimeException("Remote store is not supported as feature " + Profile.Feature.CACHE_EMBEDDED_REMOTE_STORE.getKey() + " is not enabled.");
-            }
-        }
-    }
-
-    private static void configureSessionsCaches(ConfigurationBuilderHolder builder) {
-        Stream.of(USER_SESSION_CACHE_NAME, CLIENT_SESSION_CACHE_NAME, OFFLINE_USER_SESSION_CACHE_NAME, OFFLINE_CLIENT_SESSION_CACHE_NAME)
-                .forEach(cacheName -> {
-                    var configurationBuilder = builder.getNamedConfigurationBuilders().get(cacheName);
-                    if (MultiSiteUtils.isPersistentSessionsEnabled()) {
-                        if (configurationBuilder.memory().maxCount() == -1) {
-                            logger.infof("Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for %s to 10000 entries.", cacheName);
-                            configurationBuilder.memory().maxCount(10000);
-                        }
-                        /* The number of owners for these caches then need to be set to `1` to avoid backup owners with inconsistent data.
-                         As primary owner evicts a key based on its locally evaluated maxCount setting, it wouldn't tell the backup owner about this, and then the backup owner would be left with a soon-to-be-outdated key.
-                         While a `remove` is forwarded to the backup owner regardless if the key exists on the primary owner, a `computeIfPresent` is not, and it would leave a backup owner with an outdated key.
-                         With the number of owners set to `1`, there will be no backup owners, so this is the setting to choose with persistent sessions enabled to ensure consistent data in the caches. */
-                        configurationBuilder.clustering().hash().numOwners(1);
-                    } else {
-                        if (configurationBuilder.memory().maxCount() != -1) {
-                            logger.warnf("Persistent user sessions disabled and memory limit found in configuration for cache %s. This might be a misconfiguration! Update your Infinispan configuration to remove this message.", cacheName);
-                        }
-                        if (configurationBuilder.memory().maxCount() == 10000 && (cacheName.equals(USER_SESSION_CACHE_NAME) || cacheName.equals(CLIENT_SESSION_CACHE_NAME))) {
-                            logger.warnf("Persistent user sessions disabled and memory limit is set to default value 10000. Ignoring cache limits to avoid losing sessions for cache %s.", cacheName);
-                            configurationBuilder.memory().maxCount(-1);
-                        }
-                        if (configurationBuilder.clustering().hash().attributes().attribute(HashConfiguration.NUM_OWNERS).get() == 1
-                                && configurationBuilder.persistence().stores().isEmpty()) {
-                            logger.warnf("Number of owners is one for cache %s, and no persistence is configured. This might be a misconfiguration as you will lose data when a single node is restarted!", cacheName);
-                        }
-                    }
-                });
-    }
-
-    private static void configureCacheMaxCount(ConfigurationBuilderHolder holder, String[] caches) {
-        for (String cache : caches) {
-            String propKey = CachingOptions.cacheMaxCountProperty(cache);
-            Configuration.getOptionalKcValue(propKey)
-                  .map(Integer::parseInt)
-                  .ifPresent(maxCount -> holder.getNamedConfigurationBuilders()
-                        .get(cache)
-                        .memory()
-                        .maxCount(maxCount)
-                  );
-        }
-    }
-
-    private static void validateWorkCacheConfiguration(ConfigurationBuilderHolder builder) {
-        var cacheBuilder  = builder.getNamedConfigurationBuilders().get(WORK_CACHE_NAME);
-        if (cacheBuilder == null) {
-            throw new RuntimeException("Unable to start Keycloak. '%s' cache is missing".formatted(WORK_CACHE_NAME));
-        }
-        if (builder.getGlobalConfigurationBuilder().cacheContainer().transport().getTransport() == null) {
-            // non-clustered, Keycloak started in dev mode?
-            return;
-        }
-        var cacheMode = cacheBuilder.clustering().cacheMode();
-        if (!cacheMode.isReplicated()) {
-            throw new RuntimeException("Unable to start Keycloak. '%s' cache must be replicated but is %s".formatted(WORK_CACHE_NAME, cacheMode.friendlyCacheModeString().toLowerCase()));
-        }
-    }
-
-    private static String requiredStringProperty(String propertyName) {
-        return Configuration.getOptionalKcValue(propertyName).orElseThrow(() -> new RuntimeException("Property " + propertyName + " required but not specified"));
-    }
-
-    private static boolean hasRemoteStore(ConfigurationBuilder builder) {
-        return builder.persistence().stores().stream().anyMatch(RemoteStoreConfigurationBuilder.class::isInstance);
-    }
-}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusCacheManagerProvider.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusCacheManagerProvider.java
deleted file mode 100644
index 9527b9aa4965..000000000000
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusCacheManagerProvider.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.storage.infinispan;
-
-import io.quarkus.arc.Arc;
-import org.keycloak.Config;
-import org.keycloak.cluster.ManagedCacheManagerProvider;
-import org.keycloak.models.KeycloakSession;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public final class QuarkusCacheManagerProvider implements ManagedCacheManagerProvider {
-
-    @Override
-    public <C> C getEmbeddedCacheManager(KeycloakSession keycloakSession, Config.Scope config) {
-        return (C) Arc.container().instance(CacheManagerFactory.class).get().getOrCreateEmbeddedCacheManager(keycloakSession);
-    }
-
-    @Override
-    public <C> C getRemoteCacheManager(Config.Scope config) {
-        return (C) Arc.container().instance(CacheManagerFactory.class).get().getOrCreateRemoteCacheManager();
-    }
-}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusInfinispanConnectionFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusInfinispanConnectionFactory.java
deleted file mode 100644
index 0168a4b9366e..000000000000
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/storage/infinispan/QuarkusInfinispanConnectionFactory.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.storage.infinispan;
-
-import org.infinispan.manager.EmbeddedCacheManager;
-import org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory;
-import org.keycloak.provider.ProviderConfigProperty;
-import org.keycloak.provider.ProviderConfigurationBuilder;
-
-import java.util.List;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class QuarkusInfinispanConnectionFactory extends DefaultInfinispanConnectionProviderFactory {
-
-    @Override
-    protected EmbeddedCacheManager initContainerManaged(EmbeddedCacheManager cacheManager) {
-        EmbeddedCacheManager result = super.initContainerManaged(cacheManager);
-        // force closing the cache manager when stopping the provider
-        // we probably want to refactor the default impl a bit to support this use case
-        containerManaged = false;
-        return result;
-    }
-
-    @Override
-    public int order() {
-        return 100;
-    }
-
-    @Override
-    public String getId() {
-        return "quarkus";
-    }
-
-    @Override
-    public List<ProviderConfigProperty> getConfigMetadata() {
-        return ProviderConfigurationBuilder.create()
-                .property()
-                .name("site-name")
-                .helpText("Site name for multi-site deployments")
-                .type("string")
-                .add()
-                .build();
-    }
-}
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/OTelHttpClientFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/OTelHttpClientFactory.java
index 16162e6f7d3c..05201a1bed77 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/OTelHttpClientFactory.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/tracing/OTelHttpClientFactory.java
@@ -60,7 +60,7 @@ protected HttpClientBuilder newHttpClientBuilder() {
 
     @Override
     public void init(Config.Scope config) {
-        super.init(config.scope("connectionsHttpClient", "default"));
+        super.init(Config.scope("connectionsHttpClient", "default"));
     }
 
     @Override
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesKeystoreVaultProviderFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesKeystoreVaultProviderFactory.java
index ee68678922c1..6a2712098d0d 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesKeystoreVaultProviderFactory.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesKeystoreVaultProviderFactory.java
@@ -18,6 +18,7 @@
 package org.keycloak.quarkus.runtime.vault;
 
 import org.keycloak.Config;
+import org.keycloak.config.VaultOptions;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 
@@ -33,6 +34,6 @@ public String getId() {
 
     @Override
     public boolean isSupported(Config.Scope config) {
-        return getId().equals(Configuration.getRawValue("kc.vault"));
+        return getId().equals(Configuration.getConfigValue(VaultOptions.VAULT).getValue());
     }
 }
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesPlainTextVaultProviderFactory.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesPlainTextVaultProviderFactory.java
index f1d873fa4ba0..31a3bb373598 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesPlainTextVaultProviderFactory.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/vault/FilesPlainTextVaultProviderFactory.java
@@ -18,6 +18,7 @@
 package org.keycloak.quarkus.runtime.vault;
 
 import org.keycloak.Config;
+import org.keycloak.config.VaultOptions;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
 
@@ -33,6 +34,6 @@ public String getId() {
 
     @Override
     public boolean isSupported(Config.Scope config) {
-        return getId().equals(Configuration.getRawValue("kc.vault"));
+        return getId().equals(Configuration.getConfigValue(VaultOptions.VAULT).getValue());
     }
 }
diff --git a/quarkus/runtime/src/main/resources/META-INF/keycloak.conf b/quarkus/runtime/src/main/resources/META-INF/keycloak.conf
deleted file mode 100644
index 4d564c626b70..000000000000
--- a/quarkus/runtime/src/main/resources/META-INF/keycloak.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-# Default and non-production grade database vendor
-%dev.db=dev-file
-
-# Default, and insecure, and non-production grade configuration for the development profile
-%dev.http-enabled=true
-%dev.hostname-strict=false
-%dev.hostname-strict-https=false
-%dev.cache=local
-%dev.spi-theme-cache-themes=false
-%dev.spi-theme-cache-templates=false
-%dev.spi-theme-static-max-age=-1
-
-# The default configuration when running in import or export mode
-%nonserver.http-enabled=true
-%nonserver.http-server-enabled=false
-%nonserver.hostname-strict=false
-%nonserver.hostname-strict-https=false
-%nonserver.cache=local
-
-#logging defaults
-log-console-output=default
-log-file=${kc.home.dir:default}${file.separator}data${file.separator}log${file.separator}keycloak.log
diff --git a/quarkus/runtime/src/main/resources/META-INF/services/io.smallrye.config.ConfigSourceInterceptor b/quarkus/runtime/src/main/resources/META-INF/services/io.smallrye.config.ConfigSourceInterceptor
index 2e1b58293be1..8856d3d62bbe 100644
--- a/quarkus/runtime/src/main/resources/META-INF/services/io.smallrye.config.ConfigSourceInterceptor
+++ b/quarkus/runtime/src/main/resources/META-INF/services/io.smallrye.config.ConfigSourceInterceptor
@@ -16,4 +16,5 @@
 #
 
 org.keycloak.quarkus.runtime.configuration.PropertyMappingInterceptor
+org.keycloak.quarkus.runtime.configuration.NestedPropertyMappingInterceptor
 org.keycloak.quarkus.runtime.configuration.DisabledMappersInterceptor
\ No newline at end of file
diff --git a/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.cluster.ManagedCacheManagerProvider b/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.cluster.ManagedCacheManagerProvider
deleted file mode 100644
index e0488026ff01..000000000000
--- a/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.cluster.ManagedCacheManagerProvider
+++ /dev/null
@@ -1,18 +0,0 @@
-#
-# Copyright 2021 Red Hat, Inc. and/or its affiliates
-# and other contributors as indicated by the @author tags.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-org.keycloak.quarkus.runtime.storage.infinispan.QuarkusCacheManagerProvider
\ No newline at end of file
diff --git a/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory b/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory
deleted file mode 100644
index fec4d5c4bdd8..000000000000
--- a/quarkus/runtime/src/main/resources/META-INF/services/org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# /*
-#  * Copyright 2021  Red Hat, Inc. and/or its affiliates
-#  * and other contributors as indicated by the @author tags.
-#  *
-#  * Licensed under the Apache License, Version 2.0 (the "License");
-#  * you may not use this file except in compliance with the License.
-#  * You may obtain a copy of the License at
-#  *
-#  * http://www.apache.org/licenses/LICENSE-2.0
-#  *
-#  * Unless required by applicable law or agreed to in writing, software
-#  * distributed under the License is distributed on an "AS IS" BASIS,
-#  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  * See the License for the specific language governing permissions and
-#  * limitations under the License.
-#  */
-#
-
-org.keycloak.quarkus.runtime.storage.infinispan.QuarkusInfinispanConnectionFactory
\ No newline at end of file
diff --git a/quarkus/runtime/src/main/resources/META-INF/services/quarkus.properties b/quarkus/runtime/src/main/resources/META-INF/services/quarkus.properties
deleted file mode 100644
index 637fe419c5cb..000000000000
--- a/quarkus/runtime/src/main/resources/META-INF/services/quarkus.properties
+++ /dev/null
@@ -1,30 +0,0 @@
-#
-# Copyright 2021 Red Hat, Inc. and/or its affiliates
-# and other contributors as indicated by the @author tags.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# Default options that rely on Quarkus specific options and lacking proper support in Keycloak
-
-# Logging configuration. INFO is the default level for most of the categories
-quarkus.log.min-level=TRACE
-quarkus.log.category."org.jboss.resteasy.resteasy_jaxrs.i18n".level=WARN
-quarkus.log.category."org.infinispan.transaction.lookup.JBossStandaloneJTAManagerLookup".level=WARN
-
-#jndi needed for LDAP lookups
-quarkus.naming.enable-jndi=true
-
-# HTTP limits configuration - reverse-engineered from Wildfly
-quarkus.http.limits.max-initial-line-length=32779
-quarkus.http.limits.max-header-size=65535
diff --git a/quarkus/runtime/src/main/resources/application.properties b/quarkus/runtime/src/main/resources/application.properties
index e698033009a5..1532430b230b 100644
--- a/quarkus/runtime/src/main/resources/application.properties
+++ b/quarkus/runtime/src/main/resources/application.properties
@@ -5,9 +5,6 @@ quarkus.http.root-path=/
 quarkus.application.name=Keycloak
 quarkus.banner.enabled=false
 
-# Disable health checks from extensions, since we provide our own (default is true)
-quarkus.smallrye-health.extensions.enabled=false
-
 # Enables metrics from other extensions if metrics is enabled
 quarkus.datasource.metrics.enabled=${quarkus.micrometer.enabled:false}
 
@@ -33,6 +30,18 @@ quarkus.log.category."io.quarkus.arc.processor.IndexClassLookupUtils".level=off
 quarkus.log.category."io.quarkus.hibernate.orm.deployment.HibernateOrmProcessor".level=warn
 quarkus.log.category."io.quarkus.deployment.steps.ReflectiveHierarchyStep".level=error
 
+# SqlExceptionHelper will log-and-throw error messages.
+# As those messages might later be caught and handled, this is an antipattern so we prevent logging them
+# https://hibernate.zulipchat.com/#narrow/channel/132096-hibernate-user/topic/Feature.20Request.3A.20Disable.20logging.20of.20SqlExceptionHelper.20for
+quarkus.log.category."org.hibernate.engine.jdbc.spi.SqlExceptionHelper".level=off
+
+quarkus.log.console.filter=keycloak-filter
+quarkus.log.file.filter=keycloak-filter
+quarkus.log.syslog.filter=keycloak-filter
+
+# Enable logging for slow queries
+quarkus.log.category."org.hibernate.SQL_SLOW".level=info
+
 quarkus.transaction-manager.enable-recovery=true
 # Set default directory name for the location of the transaction logs
 quarkus.transaction-manager.object-store.directory=${kc.home.dir:default}${file.separator}data${file.separator}transaction-logs
@@ -41,4 +50,37 @@ quarkus.transaction-manager.object-store.directory=${kc.home.dir:default}${file.
 quarkus.http.limits.max-form-attribute-size=131072
 
 # Configure the content-types that should be recognized as file parts when processing multipart form requests
-quarkus.http.body.multipart.file-content-types=application/octet-stream
\ No newline at end of file
+quarkus.http.body.multipart.file-content-types=application/octet-stream
+
+# Logging configuration. INFO is the default level for most of the categories
+quarkus.log.min-level=TRACE
+quarkus.log.category."org.jboss.resteasy.resteasy_jaxrs.i18n".level=WARN
+quarkus.log.category."org.infinispan.transaction.lookup.JBossStandaloneJTAManagerLookup".level=WARN
+
+#jndi needed for LDAP lookups
+quarkus.naming.enable-jndi=true
+
+# HTTP limits configuration - reverse-engineered from Wildfly
+quarkus.http.limits.max-initial-line-length=32779
+quarkus.http.limits.max-header-size=65535
+
+# Default and non-production grade database vendor
+%dev.kc.db=dev-file
+
+# Default, and insecure, and non-production grade configuration for the development profile
+%dev.kc.http-enabled=true
+%dev.kc.hostname-strict=false
+%dev.kc.cache=local
+%dev.kc.spi-theme--cache-themes=false
+%dev.kc.spi-theme--cache-templates=false
+%dev.kc.spi-theme--static-max-age=-1
+
+# The default configuration when running in import or export mode
+%nonserver.kc.http-enabled=true
+%nonserver.kc.http-server-enabled=false
+%nonserver.kc.hostname-strict=false
+%nonserver.kc.cache=local
+
+#logging defaults
+kc.log-console-output=default
+kc.log-file=${kc.home.dir:default}${file.separator}data${file.separator}log${file.separator}keycloak.log
diff --git a/quarkus/runtime/src/main/resources/cache-ispn.xml b/quarkus/runtime/src/main/resources/cache-ispn.xml
index 169e07d1823f..40439990141f 100644
--- a/quarkus/runtime/src/main/resources/cache-ispn.xml
+++ b/quarkus/runtime/src/main/resources/cache-ispn.xml
@@ -77,6 +77,14 @@
             <expiration max-idle="3600000"/>
             <memory max-count="1000"/>
         </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <distributed-cache name="actionTokens" owners="2">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/quarkus/runtime/src/main/resources/cache-local.xml b/quarkus/runtime/src/main/resources/cache-local.xml
index d17a94116d5a..fa9001d42288 100644
--- a/quarkus/runtime/src/main/resources/cache-local.xml
+++ b/quarkus/runtime/src/main/resources/cache-local.xml
@@ -79,6 +79,14 @@
             <expiration max-idle="3600000"/>
             <memory max-count="1000"/>
         </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <local-cache name="actionTokens">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/quarkus/runtime/src/main/resources/theme-resources/templates/debug-hostname-settings.ftl b/quarkus/runtime/src/main/resources/theme-resources/templates/debug-hostname-settings.ftl
index 54db3e0832d0..10fa3fcb61c3 100755
--- a/quarkus/runtime/src/main/resources/theme-resources/templates/debug-hostname-settings.ftl
+++ b/quarkus/runtime/src/main/resources/theme-resources/templates/debug-hostname-settings.ftl
@@ -28,6 +28,12 @@
 
 <body>
 
+    <ul>
+    <#list configWarnings as warning>
+        <li>${warning}</li>
+    </#list>
+    </ul>
+
     <table>
         <tr>
             <th>URL</th>
@@ -109,7 +115,7 @@
                 if (xhr.readyState == 4) {
                     clearTimeout(timeout);
                     if (xhr.status == 200) {
-                        document.getElementById(responseId).textContent='OK';
+                        document.getElementById(responseId).textContent=xhr.response;
                     } else {
                         document.getElementById(responseId).textContent='FAILED';
                     }
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java
index f9b051f1855d..394e1469beb5 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java
@@ -19,6 +19,7 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
@@ -26,19 +27,27 @@
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
+import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
-import java.util.List;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.Map;
 import java.util.Properties;
+import java.util.function.Consumer;
 import java.util.stream.Stream;
 
+import org.apache.commons.io.FileUtils;
 import org.junit.Ignore;
 import org.junit.Test;
+import org.keycloak.config.LoggingOptions;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.KeycloakMain;
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-import org.keycloak.quarkus.runtime.configuration.test.AbstractConfigurationTest;
+import org.keycloak.quarkus.runtime.cli.command.AbstractCommand;
+import org.keycloak.quarkus.runtime.configuration.AbstractConfigurationTest;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider;
 
 import io.smallrye.config.SmallRyeConfig;
 import picocli.CommandLine;
@@ -92,9 +101,10 @@ public void start() {
         }
 
         @Override
-        protected void initProfile(List<String> cliArgs, String currentCommandName) {
-            super.initProfile(cliArgs, currentCommandName);
-            config = createConfig();
+        public void initConfig(AbstractCommand command) {
+            KeycloakConfigSourceProvider.reload();
+            super.initConfig(command);
+            config = Configuration.getConfig();
         }
 
         @Override
@@ -107,22 +117,62 @@ public void build() throws Throwable {
 
     NonRunningPicocli pseudoLaunch(String... args) {
         NonRunningPicocli nonRunningPicocli = new NonRunningPicocli();
-        ConfigArgsConfigSource.setCliArgs(args);
-        nonRunningPicocli.config = createConfig();
         KeycloakMain.main(args, nonRunningPicocli);
         return nonRunningPicocli;
     }
 
+    @Test
+    public void testUnbuiltHelp() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("bootstrap-admin");
+        assertTrue(nonRunningPicocli.getErrString().contains("Missing required subcommand"));
+    }
+
+    @Test
+    public void testProfileForHelp() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("-pf=dev", "bootstrap-admin", "-h");
+        assertEquals("dev", nonRunningPicocli.config.getConfigValue("kc.profile").getValue());
+    }
+
+    @Test
+    public void testCleanStartDev() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev");
+        assertFalse(nonRunningPicocli.getOutString(), nonRunningPicocli.getOutString().toUpperCase().contains("WARN"));
+        assertFalse(nonRunningPicocli.getOutString(), nonRunningPicocli.getOutString().toUpperCase().contains("ERROR"));
+    }
+
     @Test
     public void testNegativeArgument() {
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertEquals("1h",
                 nonRunningPicocli.config.getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
+        assertEquals("1h",
+                nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
 
+        onAfter();
         nonRunningPicocli = pseudoLaunch("start-dev", "--https-certificates-reload-period=-1");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertNull(nonRunningPicocli.config.getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
+        assertNull(nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
+    }
+
+    @Test
+    public void testNegativeArgumentMgmtInterfaceCertReload() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertEquals("1h",
+                nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--https-management-certificates-reload-period=-1");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertNull(nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--https-certificates-reload-period=5m");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertEquals("5m",
+                nonRunningPicocli.config.getConfigValue("quarkus.management.ssl.certificate.reload-period").getValue());
     }
 
     @Test
@@ -205,7 +255,7 @@ public void failUnknownOptionWhitespaceSeparatorNotShowingValue() {
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.getErrString(), containsString(Help.defaultColorScheme(Help.Ansi.AUTO)
                 .errorText("Unknown option: '--db-pasword'")
-                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-driver, --db"));
+                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-debug-jpql, --db-log-slow-queries-threshold, --db-driver, --db"));
     }
 
     @Test
@@ -214,7 +264,7 @@ public void failUnknownOptionEqualsSeparatorNotShowingValue() {
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.getErrString(), containsString(Help.defaultColorScheme(Help.Ansi.AUTO)
                 .errorText("Unknown option: '--db-pasword'")
-                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-driver, --db"));
+                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-debug-jpql, --db-log-slow-queries-threshold, --db-driver, --db"));
     }
 
     @Test
@@ -224,22 +274,7 @@ public void failWithFirstOptionOnMultipleUnknownOptions() {
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.getErrString(), containsString(Help.defaultColorScheme(Help.Ansi.AUTO)
                 .errorText("Unknown option: '--db-pasword'")
-                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-driver, --db"));
-    }
-
-    @Test
-    public void httpStoreTypeValidation() {
-        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--https-key-store-file=not-there.ks", "--hostname-strict=false");
-        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
-        assertThat(nonRunningPicocli.getErrString(), containsString("Unable to determine 'https-key-store-type' automatically. Adjust the file extension or specify the property"));
-
-        nonRunningPicocli = pseudoLaunch("start", "--https-key-store-file=not-there.ks", "--hostname-strict=false", "--https-key-store-type=jdk");
-        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
-        assertThat(nonRunningPicocli.getErrString(), containsString("Failed to load 'https-key-' material: NoSuchFileException not-there.ks"));
-
-        nonRunningPicocli = pseudoLaunch("start", "--https-trust-store-file=not-there.jks", "--https-key-store-file=not-there.ks", "--hostname-strict=false", "--https-key-store-type=jdk");
-        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
-        assertThat(nonRunningPicocli.getErrString(), containsString("No trust store password provided"));
+                + "\nPossible solutions: --db-url, --db-url-host, --db-url-database, --db-url-port, --db-url-properties, --db-username, --db-password, --db-schema, --db-pool-initial-size, --db-pool-min-size, --db-pool-max-size, --db-debug-jpql, --db-log-slow-queries-threshold, --db-driver, --db"));
     }
 
     @Test
@@ -253,6 +288,13 @@ public void testShowConfigHidesSystemProperties() {
         });
     }
 
+    @Test
+    public void testShowConfigDisplaysPrimaryValue() {
+        build("build", "--db=postgres");
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("show-config");
+        assertThat(nonRunningPicocli.getOutString(), containsString("postgres (Persisted)"));
+    }
+
     @Test
     public void failSingleParamWithSpace() {
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--db postgres");
@@ -277,7 +319,7 @@ public void spiRuntimeWarnWithBuild() {
 
     @Test
     public void failBuildDev() {
-        NonRunningPicocli nonRunningPicocli = pseudoLaunch("--profile=dev", "build");
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("--profile=dev", "build", "--verbose");
         assertThat(nonRunningPicocli.getErrString(), containsString("You can not 'build' the server in development mode."));
         assertEquals(CommandLine.ExitCode.SOFTWARE, nonRunningPicocli.exitCode);
     }
@@ -296,6 +338,14 @@ public void failIfOptimizedUsedForFirstStartupExport() {
         assertThat(nonRunningPicocli.getErrString(), containsString("The '--optimized' flag was used for first ever server start."));
     }
 
+    @Test
+    public void optimizedExport() {
+        build("build", "--db=dev-file");
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("export", "--optimized", "--dir=data");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
     @Test
     public void testReaugFromProdToDev() {
         build("build", "--db=dev-file");
@@ -304,22 +354,31 @@ public void testReaugFromProdToDev() {
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--hostname=name", "--http-enabled=true");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertTrue(nonRunningPicocli.reaug);
-        assertEquals("dev", nonRunningPicocli.buildProps.getProperty(org.keycloak.common.util.Environment.PROFILE));;
+        assertEquals("dev", nonRunningPicocli.buildProps.getProperty(org.keycloak.common.util.Environment.PROFILE));
     }
 
     /**
      * Runs a fake build to setup the state of the persisted build properties
      */
-    private void build(String... args) {
+    private NonRunningPicocli build(String... args) {
+        return build(out -> {
+            assertFalse(out, out.contains("first-class"));
+            assertFalse(out, out.toUpperCase().contains("WARN"));
+        }, args);
+    }
+
+    @SuppressWarnings({"unchecked", "rawtypes"})
+    private NonRunningPicocli build(Consumer<String> outChecker, String... args) {
         if (Stream.of(args).anyMatch("start-dev"::equals)) {
             Environment.setRebuildCheck(); // auto-build
         }
         NonRunningPicocli nonRunningPicocli = pseudoLaunch(args);
-        assertTrue(nonRunningPicocli.reaug);
-        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
-        assertFalse(nonRunningPicocli.getOutString(), nonRunningPicocli.getOutString().contains("ignored"));
+        assertTrue(nonRunningPicocli.getErrString(), nonRunningPicocli.reaug);
+        assertEquals(nonRunningPicocli.getErrString(), CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        outChecker.accept(nonRunningPicocli.getOutString());
         onAfter();
         addPersistedConfigValues((Map)nonRunningPicocli.buildProps);
+        return nonRunningPicocli;
     }
 
     @Test
@@ -374,13 +433,13 @@ public void testNoReaugFromDevToDevExport() {
 
     @Test
     public void testReaugFromDevToProdExport() {
-        build("start-dev");
+        build("start-dev", "-v");
 
         Environment.setRebuildCheck(); // will be reset by the system properties logic
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("export", "--db=dev-file", "--file=file");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertTrue(nonRunningPicocli.reaug);
-        assertEquals("prod", nonRunningPicocli.buildProps.getProperty(org.keycloak.common.util.Environment.PROFILE));;
+        assertEquals("prod", nonRunningPicocli.buildProps.getProperty(org.keycloak.common.util.Environment.PROFILE));
     }
 
     @Test
@@ -402,7 +461,7 @@ public void fastStartOptimizedSucceeds() {
         System.setProperty("kc.hostname-strict", "false");
 
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--optimized");
-        assertEquals(Integer.MAX_VALUE, nonRunningPicocli.exitCode); // "running" state
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
     }
 
     @Test
@@ -419,6 +478,9 @@ public void wildcardLevelForCategory() {
         var value = nonRunningPicocli.config.getConfigValue("quarkus.log.category.\"org.keycloak\".level");
         assertEquals("quarkus.log.category.\"org.keycloak\".level", value.getName());
         assertEquals("WARN", value.getValue());
+        value = nonRunningPicocli.config.getConfigValue("quarkus.log.category.\"org.keycloak1\".level");
+        assertEquals("quarkus.log.category.\"org.keycloak1\".level", value.getName());
+        assertNull(value.getValue());
     }
 
     @Test
@@ -428,6 +490,9 @@ public void wildcardLevelFromParent() {
         var value = nonRunningPicocli.config.getConfigValue("quarkus.log.category.\"org.keycloak\".level");
         assertEquals("quarkus.log.category.\"org.keycloak\".level", value.getName());
         assertEquals("WARN", value.getValue());
+        value = nonRunningPicocli.config.getConfigValue("quarkus.log.category.\"org.keycloak1\".level");
+        assertEquals("quarkus.log.category.\"org.keycloak1\".level", value.getName());
+        assertNull(value.getValue());
     }
 
     @Test
@@ -451,14 +516,365 @@ public void syslogMaxLengthMemorySize() {
         NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-max-length=60k");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertEquals("60k", nonRunningPicocli.config.getConfigValue("quarkus.log.syslog.max-length").getValue());
+        onAfter();
 
         nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog");
         assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.log.syslog.max-length").getValue(), nullValue());
+        onAfter();
 
         nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-max-length=wrong");
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.getErrString(), containsString(
                 "Invalid value for option '--log-syslog-max-length': value wrong not in correct format (regular expression): [0-9]+[BbKkMmGgTtPpEeZzYy]?"));
     }
+
+    @Test
+    public void syslogCountingFraming() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-counting-framing=TRUE");
+        assertThat(nonRunningPicocli.exitCode, is(CommandLine.ExitCode.USAGE));
+        assertThat(nonRunningPicocli.getErrString(), containsString(
+                "Invalid value for option '--log-syslog-counting-framing': TRUE. Expected values are: true, false, protocol-dependent"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-counting-framing=true");
+        assertThat(nonRunningPicocli.exitCode, is(CommandLine.ExitCode.OK));
+        assertThat(nonRunningPicocli.config.getConfigValue("quarkus.log.syslog.use-counting-framing").getValue(), is("true"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-counting-framing=false");
+        assertThat(nonRunningPicocli.exitCode, is(CommandLine.ExitCode.OK));
+        assertThat(nonRunningPicocli.config.getConfigValue("quarkus.log.syslog.use-counting-framing").getValue(), is("false"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-protocol=ssl-tcp", "--log-syslog-counting-framing=protocol-dependent");
+        assertThat(nonRunningPicocli.exitCode, is(CommandLine.ExitCode.OK));
+        assertThat(nonRunningPicocli.config.getConfigValue("quarkus.log.syslog.use-counting-framing").getValue(), is("true"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-counting-framing=wrong");
+        assertThat(nonRunningPicocli.exitCode, is(CommandLine.ExitCode.USAGE));
+        assertThat(nonRunningPicocli.getErrString(), containsString(
+                "Invalid value for option '--log-syslog-counting-framing': wrong. Expected values are: true, false, protocol-dependent"));
+    }
+
+    @Test
+    public void providerChanged() {
+        build("build", "--db=dev-file");
+
+        addPersistedConfigValues(Map.of(Picocli.KC_PROVIDER_FILE_PREFIX + "fake", "value"));
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--optimized");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertTrue(nonRunningPicocli.getErrString().contains("A provider JAR was updated since the last build, please rebuild for this to be fully utilized."));
+    }
+
+    @Test
+    public void buildOptionChangedWithOptimized() {
+        build("build", "--db=dev-file");
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--optimized", "--db=dev-mem");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertTrue(nonRunningPicocli.getErrString().contains("Build time option: '--db' not usable with pre-built image and --optimized"));
+    }
+
+    @Test
+    public void buildOptionWithOptimized() {
+        build("build", "--metrics-enabled=true", "--db=dev-file");
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--optimized", "--http-enabled=true", "--hostname-strict=false");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void testHiddenCliConfigValueWithNoDescription() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--db-dialect=user-defined");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertEquals("user-defined", nonRunningPicocli.config.getConfigValue("kc.db-dialect").getValue());
+    }
+
+    @Test
+    public void buildDBWithOptimized() {
+        build("build", "--db=mariadb");
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("import", "--optimized", "--dir=./", "--override=false");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void logConsoleJsonFormatDisabled() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log-console-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-console-json-format'. Available only when Console log handler is activated and output is set to 'json'"));
+    }
+
+    @Test
+    public void logConsoleJsonFormat() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log-console-output=json", "--log-console-json-format=invalid");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--log-console-json-format': invalid. Expected values are: default, ecs"));
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log-console-output=json", "--log-console-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void logFileJsonFormatDisabled() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=file", "--log-file-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-file-json-format'. Available only when File log handler is activated and output is set to 'json'"));
+    }
+
+    @Test
+    public void logFileJsonFormat() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log-console-output=json", "--log-console-json-format=invalid");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--log-console-json-format': invalid. Expected values are: default, ecs"));
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log-console-output=json", "--log-console-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void logSyslogJsonFormatDisabled() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-syslog-json-format'. Available only when Syslog is activated and output is set to 'json'"));
+    }
+
+    @Test
+    public void logSyslogJsonFormat() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-output=json", "--log-syslog-json-format=invalid");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--log-syslog-json-format': invalid. Expected values are: default, ecs"));
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=syslog", "--log-syslog-output=json", "--log-syslog-json-format=ecs");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void proxyProtolNotAllowedWithProxyHeaders() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--proxy-headers=forwarded", "--proxy-protocol-enabled=true");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString(" protocol cannot be enabled when using the `proxy-headers` option"));
+    }
+
+    @Test
+    public void hostnameProxyValidation() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--hostname=foo", "--http-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("Likely misconfiguration detected"));
+    }
+
+    @Test
+    public void hostnameProxyValidationStrictFalse() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--hostname-strict=false", "--http-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("With HTTPS not enabled"));
+    }
+
+    @Test
+    public void hostnameValidationHttp() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--hostname=http://host", "--http-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("Likely misconfiguration detected"));
+    }
+
+    @Test
+    public void derivedPropertyUsage() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--hostname=localhost", "--spi-hostname-v2-hostname=second-class");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("Please use the first-class option `kc.hostname` instead of `kc.spi-hostname-v2-hostname`"));
+    }
+
+    @Test
+    public void testAmbiguousSpiOption() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--spi-x-y-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("The following SPI options are using the legacy format and are not being treated as build time options. Please use the new format with the appropriate -- separators to resolve this ambiguity: kc.spi-x-y-enabled"));
+    }
+
+    @Test
+    public void testAmbiguousSpiOptionBuild() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("build", "--db=dev-file", "--spi-x-y-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getOutString(), containsString("The following SPI options are using the legacy format and are not being treated as build time options. Please use the new format with the appropriate -- separators to resolve this ambiguity: kc.spi-x-y-enabled"));
+    }
+
+    @Test
+    public void testDerivedShowConfig() {
+        NonRunningPicocli nonRunningPicocli = build("build", "--metrics-enabled=true", "--features=user-event-metrics", "--event-metrics-user-enabled=true", "--db=dev-file");
+
+        nonRunningPicocli = pseudoLaunch("show-config");
+        // first class kc form should show up
+        assertThat(nonRunningPicocli.getOutString(), containsString("kc.event-metrics-user-enabled"));
+        // second class kc form should not
+        assertThat(nonRunningPicocli.getOutString(), not(containsString("kc.spi-events-listener-micrometer-user-event-metrics-enabled")));
+    }
+
+    @Test
+    public void logAsyncDisabledParent() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=file", "--log-console-async=true");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-console-async'. Available only when Console log handler is activated"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=console", "--log-file-async=true");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-file-async'. Available only when File log handler is activated"));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=file", "--log-syslog-async=true");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-syslog-async'. Available only when Syslog is activated"));
+    }
+
+    @Test
+    public void logAsyncGlobal() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log-async=true", "--log-console-async=false", "--log-console-async-queue-length=222");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-console-async-queue-length'. Available only when Console log handler is activated"));
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log-async=true", "--log-console-async-queue-length=222");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=console,file", "--log-async=true", "--log-console-async=false", "--log-console-async-queue-length=222");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-console-async-queue-length'. Available only when Console log handler is activated"));
+        onAfter();
+
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=console,file", "--log-async=true", "--log-console-async=false", "--log-file-async-queue-length=222");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    @Test
+    public void logAsyncConsoleDisabledOptions() {
+        assertLogAsyncHandlerDisabledOptions(LoggingOptions.Handler.file, LoggingOptions.Handler.console, "Console log handler");
+    }
+
+    @Test
+    public void logAsyncFileDisabledOptions() {
+        assertLogAsyncHandlerDisabledOptions(LoggingOptions.Handler.console, LoggingOptions.Handler.file, "File log handler");
+    }
+
+    @Test
+    public void logAsyncSyslogDisabledOptions() {
+        assertLogAsyncHandlerDisabledOptions(LoggingOptions.Handler.console, LoggingOptions.Handler.syslog, "Syslog");
+    }
+
+    private void assertLogAsyncHandlerDisabledOptions(LoggingOptions.Handler logHandler, LoggingOptions.Handler logHandlerOptions, String logHandlerFullName) {
+        var logHandlerName = logHandler.toString();
+        var logHandlerOptionsName = logHandlerOptions.toString();
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--log=%s".formatted(logHandlerName), "--log-%s-async-queue-length=invalid".formatted(logHandlerOptionsName));
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--log-%s-async-queue-length': 'invalid' is not an int".formatted(logHandlerOptionsName)));
+
+        onAfter();
+        nonRunningPicocli = pseudoLaunch("start-dev", "--log=%s".formatted(logHandlerName), "--log-%s-async-queue-length=768".formatted(logHandlerOptionsName));
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--log-%s-async-queue-length'. Available only when %s is activated and asynchronous logging is enabled".formatted(logHandlerOptionsName, logHandlerFullName)));
+
+    }
+
+    @Test
+    public void logAsyncConsoleInvalidValues() {
+        assertLogAsyncHandlerInvalidValues(LoggingOptions.Handler.console);
+    }
+
+    @Test
+    public void logAsyncFileInvalidValues() {
+        assertLogAsyncHandlerInvalidValues(LoggingOptions.Handler.file);
+    }
+
+    @Test
+    public void logAsyncSyslogInvalidValues() {
+        assertLogAsyncHandlerInvalidValues(LoggingOptions.Handler.syslog);
+    }
+
+    @Test
+    public void timestampChanged() {
+        assertTrue(Picocli.timestampChanged("12345", null));
+        assertTrue(Picocli.timestampChanged("12345", "12346"));
+        assertTrue(Picocli.timestampChanged("12000", "12346"));
+        // new is truncated - should not be a change
+        assertFalse(Picocli.timestampChanged("12345", "12000"));
+    }
+
+    @Test
+    public void quarkusRuntimeChangeNoError() throws IOException {
+        Path conf = Paths.get("src/test/resources/");
+        Path tmp = Paths.get("target/home-tmp");
+        FileUtils.copyDirectory(conf.toFile(), tmp.toFile());
+        Files.delete(tmp.resolve("conf/quarkus.properties"));
+        Environment.setHomeDir(tmp);
+        try {
+            build("build", "--db=dev-file");
+        } finally {
+            Environment.setHomeDir(conf);
+        }
+
+        var nonRunningPicocli = pseudoLaunch("start", "--optimized", "--http-enabled=true", "--hostname=foo");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+    }
+
+    protected void assertLogAsyncHandlerInvalidValues(LoggingOptions.Handler handler) {
+        var handlerName = handler.toString();
+
+        var nonRunningPicocli = pseudoLaunch("start-dev", "--log=%s".formatted(handlerName), "--log-%s-async=true".formatted(handlerName), "--log-%s-async-queue-length=invalid".formatted(handlerName));
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--log-%s-async-queue-length': 'invalid' is not an int".formatted(handlerName)));
+    }
+
+    @Test
+    public void testUnaryBooleanFails() {
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--health-enabled");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Option '--health-enabled' (true|false) expects a single value. Expected values are: true, false"));
+    }
+
+    @Test
+    public void datasourcesNotAllowedChar(){
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev","--db-kind-<default>=postgres");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Unknown option: '--db-kind-<default>'"));
+    }
+
+    @Test
+    public void updateCommandValidation(){
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("update-compatibility","check");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Missing required argument: --file"));
+    }
+
+    @Test
+    public void errorSpiBuildtimeChanged() {
+        putEnvVar("KC_SPI_EVENTS_LISTENER__PROVIDER", "jboss-logging");
+        build("build", "--db=dev-file");
+
+        putEnvVar("KC_SPI_EVENTS_LISTENER__PROVIDER", "new-jboss-logging");
+
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start", "--optimized", "--http-enabled=true", "--hostname-strict=false");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("The following build time options have values that differ from what is persisted - the new values will NOT be used until another build is run: kc.spi-events-listener--provider"));
+    }
+
+    @Test
+    public void spiAmbiguousSpiAutoBuild() {
+        putEnvVar("KC_SPI_EVENTS_LISTENER_PROVIDER", "jboss-logging");
+        NonRunningPicocli nonRunningPicocli = build(out -> assertThat(out, containsString("The following SPI options")), "build", "--db=dev-file");
+
+        Environment.setRebuildCheck(); // auto-build
+        putEnvVar("KC_SPI_EVENTS_LISTENER_PROVIDER", "new-jboss-logging");
+        nonRunningPicocli = pseudoLaunch("start", "--http-enabled=true", "--hostname-strict=false");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertTrue(nonRunningPicocli.reaug);
+        assertThat(nonRunningPicocli.getOutString(), containsString("The following SPI options"));
+    }
 }
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/AbstractConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/AbstractConfigurationTest.java
new file mode 100644
index 000000000000..c9d0bb86422d
--- /dev/null
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/AbstractConfigurationTest.java
@@ -0,0 +1,153 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.configuration;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.CoreMatchers.nullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.file.Paths;
+import java.util.Map;
+import java.util.Properties;
+import java.util.function.Function;
+
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler;
+import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
+
+import io.smallrye.config.ConfigValue;
+import io.smallrye.config.ConfigValue.ConfigValueBuilder;
+import io.smallrye.config.SmallRyeConfig;
+
+public abstract class AbstractConfigurationTest {
+
+    private static final Properties SYSTEM_PROPERTIES = (Properties) System.getProperties().clone();
+
+    public static void putEnvVar(String name, String value) {
+        assertNotNull(name);
+        assertNotNull(value);
+        KcEnvConfigSource.ENV_OVERRIDE.put(name, value);
+    }
+
+    public static void putEnvVars(Map<String, String> map) {
+        map.forEach(ConfigurationTest::putEnvVar);
+    }
+
+    @SuppressWarnings("unchecked")
+    public static void removeEnvVar(String name) {
+        assertTrue(KcEnvConfigSource.ENV_OVERRIDE.remove(name) != null);
+    }
+
+    public static void setSystemProperty(String key, String value, Runnable runnable) {
+        System.setProperty(key, value);
+        try {
+            runnable.run();
+        } finally {
+            System.clearProperty(key);
+        }
+    }
+
+    @BeforeClass
+    public static void resetConfiguration() {
+        System.setProperties((Properties) SYSTEM_PROPERTIES.clone());
+        Environment.setHomeDir(Paths.get("src/test/resources/"));
+
+        KcEnvConfigSource.ENV_OVERRIDE.clear();
+
+        PropertyMappers.reset();
+        ConfigArgsConfigSource.setCliArgs();
+        PersistedConfigSource.getInstance().getConfigValueProperties().clear();
+        Profile.reset();
+        Configuration.resetConfig();
+        ExecutionExceptionHandler.resetExceptionTransformers();
+    }
+
+    @After
+    public void onAfter() {
+        resetConfiguration();
+    }
+
+    @AfterClass
+    public static void afterAll() {
+        Environment.removeHomeDir();
+    }
+
+    protected static Config.Scope initConfig(String... scope) {
+        Config.init(new MicroProfileConfigProvider(createConfig()));
+        return Config.scope(scope);
+    }
+
+    static protected SmallRyeConfig createConfig() {
+        Configuration.resetConfig();
+        KeycloakConfigSourceProvider.reload();
+        Environment.getCurrentOrCreateFeatureProfile();
+        return Configuration.getConfig();
+    }
+
+    protected void assertConfig(String key, String expectedValue, boolean isExternal) {
+        Function<String, ConfigValue> getConfig = isExternal ? Configuration::getConfigValue : Configuration::getKcConfigValue;
+        var value = getConfig.apply(key).getValue();
+        assertThat(String.format("Value is null for key '%s'", key), value, notNullValue());
+        assertThat(String.format("Different value for key '%s'", key), value, is(expectedValue));
+    }
+
+    protected void assertConfig(String key, String expectedValue) {
+        assertConfig(key, expectedValue, false);
+    }
+
+    protected void assertConfig(Map<String, String> expectedValues) {
+        expectedValues.forEach(this::assertConfig);
+    }
+
+    protected void assertExternalConfig(String key, String expectedValue) {
+        assertConfig(key, expectedValue, true);
+    }
+
+    protected void assertExternalConfig(Map<String, String> expectedValues) {
+        expectedValues.forEach(this::assertExternalConfig);
+    }
+
+    protected void assertConfigNull(String key, boolean isExternal) {
+        Function<String, ConfigValue> getConfig = isExternal ? Configuration::getConfigValue : Configuration::getKcConfigValue;
+        assertThat(String.format("We expect that the value is null for key '%s'", key), getConfig.apply(key).getValue(), nullValue());
+    }
+
+    protected void assertConfigNull(String key) {
+        assertConfigNull(key, false);
+    }
+
+    protected void assertExternalConfigNull(String key) {
+        assertConfigNull(key, true);
+    }
+
+    protected static void addPersistedConfigValues(Map<String, String> values) {
+        var configValueProps = PersistedConfigSource.getInstance().getConfigValueProperties();
+        values.forEach((k, v) -> configValueProps.put(k,
+                new ConfigValueBuilder().withName(k).withValue(v).withRawValue(v)
+                        .withConfigSourceName(PersistedConfigSource.getInstance().getName())
+                        .withConfigSourceOrdinal(PersistedConfigSource.getInstance().getOrdinal()).build()));
+    }
+}
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ConfigurationTest.java
similarity index 76%
rename from quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ConfigurationTest.java
rename to quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ConfigurationTest.java
index 30d99a2c14ab..f9c25c4fb63b 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ConfigurationTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ConfigurationTest.java
@@ -15,22 +15,22 @@
  * limitations under the License.
  */
 
-package org.keycloak.quarkus.runtime.configuration.test;
+package org.keycloak.quarkus.runtime.configuration;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
-import static org.keycloak.quarkus.runtime.Environment.isWindows;
 
-import java.nio.file.FileSystem;
+import java.io.File;
 import java.nio.file.FileSystems;
-import java.nio.file.Path;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+import java.util.stream.StreamSupport;
 
 import io.smallrye.config.SmallRyeConfig;
 import org.hibernate.dialect.H2Dialect;
@@ -45,11 +45,12 @@
 import org.junit.Test;
 import org.keycloak.Config;
 import org.keycloak.config.CachingOptions;
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-
+import org.keycloak.quarkus.runtime.configuration.mappers.HttpPropertyMappers;
 import org.keycloak.quarkus.runtime.Environment;
 import org.keycloak.quarkus.runtime.vault.FilesKeystoreVaultProviderFactory;
 import org.keycloak.quarkus.runtime.vault.FilesPlainTextVaultProviderFactory;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderSpi;
+import org.keycloak.spi.infinispan.impl.embedded.DefaultCacheEmbeddedConfigProviderFactory;
 import org.mariadb.jdbc.MariaDbDataSource;
 import org.postgresql.xa.PGXADataSource;
 
@@ -63,6 +64,14 @@ public void testCamelCase() {
         assertEquals(value, "foobar");
     }
 
+    @Test
+    public void testCamelCaseNewFormat() {
+        putEnvVar("KC_SPI_CAMEL_CASE_SCOPE__CAMEL_CASE_PROP", "foobar");
+        initConfig();
+        String value = Config.scope("camelCaseScope").get("camelCaseProp");
+        assertEquals(value, "foobar");
+    }
+
     @Test
     public void testEnvVarPriorityOverPropertiesFile() {
         putEnvVar("KC_SPI_HOSTNAME_DEFAULT_FRONTEND_URL", "http://envvar.unittest");
@@ -82,13 +91,13 @@ public void testEnvVarAvailableFromPropertyNames() {
         Config.Scope config = initConfig("vault", FilesPlainTextVaultProviderFactory.ID);
         assertEquals("/foo/bar", config.get("dir"));
         assertTrue(config.getPropertyNames()
-                .contains("kc.spi-vault-".concat(FilesPlainTextVaultProviderFactory.ID).concat("-dir")));
+                .contains("kc.spi-vault--".concat(FilesPlainTextVaultProviderFactory.ID).concat("--dir")));
 
         putEnvVar("KC_VAULT_TYPE", "JKS");
         config = initConfig("vault", FilesKeystoreVaultProviderFactory.ID);
         assertEquals("JKS", config.get("type"));
         assertTrue(config.getPropertyNames()
-                .contains("kc.spi-vault-".concat(FilesKeystoreVaultProviderFactory.ID).concat("-type")));
+                .contains("kc.spi-vault--".concat(FilesKeystoreVaultProviderFactory.ID).concat("--type")));
     }
 
     @Test
@@ -117,15 +126,11 @@ public void testDefaultValue() {
     }
 
     @Test
-    public void testKeycloakProfilePropertySubstitution() {
-        System.setProperty(org.keycloak.common.util.Environment.PROFILE, "user-profile");
-        assertEquals("http://filepropprofile.unittest", initConfig("hostname", "default").get("frontendUrl"));
-    }
-
-    @Test
-    public void testQuarkusProfilePropertyStillWorks() {
-        System.setProperty("quarkus.profile", "user-profile");
-        assertEquals("http://filepropprofile.unittest", initConfig("hostname", "default").get("frontendUrl"));
+    public void testProfiledPropertyExposure() {
+        ConfigArgsConfigSource.setCliArgs("");
+        SmallRyeConfig config = createConfig();
+        // the "nope" profile is not active, the property should not be advertised
+        assertTrue(StreamSupport.stream(config.getPropertyNames().spliterator(), false).noneMatch("quarkus.http.proxy.proxy-address-forwarding"::equals));
     }
 
     @Test
@@ -150,6 +155,27 @@ public void testSpiConfigurationUsingCommandLineArguments() {
         assertEquals("http://c.jwk.url", initConfig("client-registration", "openid-connect").get("static-jwk-url"));
     }
 
+    @Test
+    public void testExpressionEnvValue() {
+        putEnvVar("KC_HOSTNAME_STRICT", "false");
+        putEnvVar("MY_EXPRESSION", "${KC_HOSTNAME_STRICT}");
+        ConfigArgsConfigSource.setCliArgs("");
+        var config = createConfig();
+        // with the env variable set, we should get the same value either way
+        assertEquals("false", config.getConfigValue("KC_HOSTNAME_STRICT").getValue());
+        assertEquals("false", config.getConfigValue("MY_EXPRESSION").getValue());
+
+        // without the env variable set, the expression should use the missing env variable
+        removeEnvVar("KC_HOSTNAME_STRICT");
+        ConfigArgsConfigSource.setCliArgs("");
+        config = createConfig();
+        // check that we get the mapped default value
+        assertEquals("true", config.getConfigValue("kc.hostname-strict").getValue());
+        // check that we don't get the mapped value
+        assertNull(config.getConfigValue("MY_EXPRESSION").getValue());
+        assertNull(config.getConfigValue("KC_HOSTNAME_STRICT").getValue());
+    }
+
     @Test
     public void testResolveTransformedValue() {
         ConfigArgsConfigSource.setCliArgs("");
@@ -164,7 +190,6 @@ public void testResolveTransformedValue() {
     public void testPropertyNamesFromConfig() {
         ConfigArgsConfigSource.setCliArgs("--spi-client-registration-openid-connect-static-jwk-url=http://c.jwk.url");
         Config.Scope config = initConfig("client-registration", "openid-connect");
-        assertEquals(1, config.getPropertyNames().size());
         assertEquals("http://c.jwk.url", config.get("static-jwk-url"));
 
         ConfigArgsConfigSource.setCliArgs("--vault-dir=secrets");
@@ -180,18 +205,15 @@ public void testPropertyNamesFromConfig() {
         ConfigArgsConfigSource.setCliArgs();
         System.setProperty("kc.spi-client-registration-openid-connect-static-jwk-url", "http://c.jwk.url");
         config = initConfig("client-registration", "openid-connect");
-        assertEquals(1, config.getPropertyNames().size());
         assertEquals("http://c.jwk.url", config.get("static-jwk-url"));
 
         ConfigArgsConfigSource.setCliArgs();
         System.getProperties().remove("kc.spi-client-registration-openid-connect-static-jwk-url");
         putEnvVar("KC_SPI_CLIENT_REGISTRATION_OPENID_CONNECT_STATIC_JWK_URL", "http://c.jwk.url/from-env");
         config = initConfig("client-registration", "openid-connect");
-        assertEquals(2, config.getPropertyNames().size()); // transformed name is coming from KcEnvVarConfigSource, raw env var name is coming from EnvVarConfigSource
         assertEquals("http://c.jwk.url/from-env", config.get("static-jwk-url"));
     }
 
-
     @Test
     public void testPropertyMapping() {
         ConfigArgsConfigSource.setCliArgs("--db=mariadb", "--db-url=jdbc:mariadb://localhost/keycloak");
@@ -207,7 +229,7 @@ public void testDatabaseUrlProperties() {
         assertEquals(MariaDBDialect.class.getName(), config.getConfigValue("kc.db-dialect").getValue());
         assertEquals("jdbc:mariadb:aurora://foo/bar?a=1&b=2", config.getConfigValue("quarkus.datasource.jdbc.url").getValue());
     }
-    
+
     @Test
     public void testExpansionDisabled() {
         ConfigArgsConfigSource.setCliArgs("--db=mysql");
@@ -223,13 +245,7 @@ public void testDatabaseDefaults() {
         assertEquals(H2Dialect.class.getName(), config.getConfigValue("kc.db-dialect").getValue());
         assertEquals(Driver.class.getName(), config.getConfigValue("quarkus.datasource.jdbc.driver").getValue());
 
-        // JDBC location treated as file:// URI
-        final String userHomeUri = Path.of(System.getProperty("user.home"))
-                .toUri()
-                .toString()
-                .replaceFirst(isWindows() ? "file:///" : "file://", "");
-
-        assertEquals("jdbc:h2:file:" + userHomeUri + "data/h2/keycloakdb;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0", config.getConfigValue("quarkus.datasource.jdbc.url").getValue());
+        assertEquals("jdbc:h2:file:" + Environment.getHomeDir() + "/data/h2/keycloakdb;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0", config.getConfigValue("quarkus.datasource.jdbc.url").getValue());
 
         ConfigArgsConfigSource.setCliArgs("--db=dev-mem");
         config = createConfig();
@@ -239,7 +255,8 @@ public void testDatabaseDefaults() {
 
         ConfigArgsConfigSource.setCliArgs("--db=dev-mem", "--db-username=other");
         config = createConfig();
-        assertEquals("sa", config.getConfigValue("quarkus.datasource.username").getValue());
+        // we allow changing username by default
+        assertEquals("other", config.getConfigValue("quarkus.datasource.username").getValue());
         // should be untransformed
         assertEquals("other", config.getConfigValue("kc.db-username").getValue());
 
@@ -337,14 +354,31 @@ public void testDatabaseProperties() {
         config = createConfig();
         assertEquals("test-schema", config.getConfigValue("kc.db-schema").getValue());
         assertEquals("test-schema", config.getConfigValue("kc.db-schema").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--db=postgres");
+        config = createConfig();
+        assertEquals("primary", config.getConfigValue("quarkus.datasource.jdbc.additional-jdbc-properties.targetServerType").getValue());
+
+
+        ConfigArgsConfigSource.setCliArgs("--db=postgres", "--db-url-properties=?targetServerType=any");
+        config = createConfig();
+        assertNull(config.getConfigValue("quarkus.datasource.jdbc.additional-jdbc-properties.targetServerType").getValue());
+        assertEquals("jdbc:postgresql://localhost:5432/keycloak?targetServerType=any", config.getConfigValue("quarkus.datasource.jdbc.url").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--db=postgres", "--db-driver=software.amazon.jdbc.Driver");
+        config = createConfig();
+        assertNull(config.getConfigValue("quarkus.datasource.jdbc.additional-jdbc-properties.targetServerType").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--db=postgres", "--db-url=jdbc:postgresql://localhost:5432/keycloak?targetServerType=any");
+        config = createConfig();
+        assertNull(config.getConfigValue("quarkus.datasource.jdbc.additional-jdbc-properties.targetServerType").getValue());
     }
 
     // KEYCLOAK-15632
     @Test
     public void testNestedDatabaseProperties() {
-        System.setProperty("kc.home.dir", "/tmp/kc/bin/../");
         SmallRyeConfig config = createConfig();
-        assertEquals("jdbc:h2:file:/tmp/kc/bin/..//data/keycloakdb", config.getConfigValue("quarkus.datasource.foo").getValue());
+        assertEquals("jdbc:h2:file:"+Environment.getHomeDir()+"/data/keycloakdb", config.getConfigValue("quarkus.datasource.foo").getValue());
 
         Assert.assertEquals("foo-def-suffix", config.getConfigValue("quarkus.datasource.bar").getValue());
 
@@ -364,18 +398,22 @@ public void testNestedDatabaseProperties() {
     @Test
     public void testClusterConfig() {
         // Cluster enabled by default, but disabled for the "dev" profile
-        Assert.assertEquals("cache-ispn.xml", initConfig("connectionsInfinispan", "quarkus").get("configFile"));
+        String conf = Environment.getHomeDir() + File.separator + "conf" + File.separator;
+        Assert.assertEquals(conf + "cache-ispn.xml", cacheEmbeddedConfiguration().get(DefaultCacheEmbeddedConfigProviderFactory.CONFIG));
 
         // If explicitly set, then it is always used regardless of the profile
         System.clearProperty(org.keycloak.common.util.Environment.PROFILE);
         ConfigArgsConfigSource.setCliArgs("--cache-config-file=cluster-foo.xml");
 
-        Assert.assertEquals("cluster-foo.xml", initConfig("connectionsInfinispan", "quarkus").get("configFile"));
+        Assert.assertEquals(conf + "cluster-foo.xml", cacheEmbeddedConfiguration().get(DefaultCacheEmbeddedConfigProviderFactory.CONFIG));
         System.setProperty(org.keycloak.common.util.Environment.PROFILE, "dev");
-        Assert.assertEquals("cluster-foo.xml", initConfig("connectionsInfinispan", "quarkus").get("configFile"));
+        Assert.assertEquals(conf + "cluster-foo.xml", cacheEmbeddedConfiguration().get(DefaultCacheEmbeddedConfigProviderFactory.CONFIG));
+
+        ConfigArgsConfigSource.setCliArgs("");
+        Assert.assertEquals("cache-local.xml", cacheEmbeddedConfiguration().get(DefaultCacheEmbeddedConfigProviderFactory.CONFIG));
 
         ConfigArgsConfigSource.setCliArgs("--cache-stack=foo");
-        Assert.assertEquals("foo", initConfig("connectionsInfinispan", "quarkus").get("stack"));
+        Assert.assertEquals("foo", cacheEmbeddedConfiguration().get(DefaultCacheEmbeddedConfigProviderFactory.STACK));
     }
 
     @Test
@@ -406,12 +444,6 @@ public void testDatabaseDriverSetExplicitly() {
         assertEquals("enabled", config.getConfigValue("quarkus.datasource.jdbc.transactions").getValue());
     }
 
-    @Test
-    public void testDatabaseDialectSetExplicitly() {
-        ConfigArgsConfigSource.setCliArgs("--db-dialect=user-defined");
-        assertEquals("user-defined", createConfig().getRawValue("kc.db-dialect"));
-    }
-
     @Test
     public void testTransactionTypeChangesDriver() {
         ConfigArgsConfigSource.setCliArgs("--db=mssql", "--transaction-xa-enabled=false");
@@ -431,12 +463,10 @@ public void testTransactionTypeChangesDriver() {
 
     @Test
     public void testResolveHealthOption() {
-        ConfigArgsConfigSource.setCliArgs("--health-enabled=true");
-        SmallRyeConfig config = createConfig();
-        assertEquals("true", config.getConfigValue("quarkus.smallrye-health.extensions.enabled").getValue());
         ConfigArgsConfigSource.setCliArgs("");
-        config = createConfig();
-        assertEquals("false", config.getConfigValue("quarkus.smallrye-health.extensions.enabled").getValue());
+        SmallRyeConfig config = createConfig();
+        // default to null when the extension is effectively removed
+        assertNull(config.getConfigValue("quarkus.smallrye-health.extensions.enabled").getValue());
     }
 
     @Test
@@ -466,7 +496,7 @@ public void testResolvePropertyFromDefaultProfile() {
     public void testKeystoreConfigSource() {
         // Add properties manually
         Map<String, String> properties = new HashMap<>();
-        properties.put("smallrye.config.source.keystore.kc-default.path", "keystore");
+        properties.put("smallrye.config.source.keystore.kc-default.path", "conf/keystore");
         properties.put("smallrye.config.source.keystore.kc-default.password", "secret");
 
         SmallRyeConfig config = new SmallRyeConfigBuilder()
@@ -481,11 +511,7 @@ public void testKeystoreConfigSource() {
 
     @Test
     public void testKeystoreConfigSourcePropertyMapping() {
-        SmallRyeConfig config = new SmallRyeConfigBuilder()
-                .addDefaultInterceptors()
-                .addDiscoveredSources()
-                .build();
-
+        SmallRyeConfig config = createConfig();
         assertEquals(config.getConfigValue("smallrye.config.source.keystore.kc-default.password").getValue(),config.getConfigValue("kc.config-keystore-password").getValue());
         // Properties are loaded from the file - secret can be obtained only if the mapping works correctly
         ConfigValue secret = config.getConfigValue("my.secret");
@@ -495,11 +521,23 @@ public void testKeystoreConfigSourcePropertyMapping() {
     @Test
     public void testReloadPeriod() {
         ConfigArgsConfigSource.setCliArgs("");
-        assertEquals("1h", createConfig().getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
+        initConfig();
+        assertExternalConfig(Map.of(
+                "quarkus.http.ssl.certificate.reload-period", "1h",
+                "quarkus.management.ssl.certificate.reload-period", "1h"
+        ));
+
         ConfigArgsConfigSource.setCliArgs("--https-certificates-reload-period=-1");
-        assertNull(createConfig().getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
+        initConfig();
+        assertExternalConfigNull("quarkus.http.ssl.certificate.reload-period");
+        assertExternalConfigNull("quarkus.management.ssl.certificate.reload-period");
+
         ConfigArgsConfigSource.setCliArgs("--https-certificates-reload-period=2h");
-        assertEquals("2h", createConfig().getConfigValue("quarkus.http.ssl.certificate.reload-period").getValue());
+        initConfig();
+        assertExternalConfig(Map.of(
+                "quarkus.http.ssl.certificate.reload-period", "2h",
+                "quarkus.management.ssl.certificate.reload-period", "2h"
+        ));
     }
 
     @Test
@@ -513,6 +551,15 @@ public void testHttpsPaths() {
         assertEquals(expected, createConfig().getConfigValue("quarkus.http.ssl.certificate.files").getValue());
     }
 
+    @Test
+    public void testHttpTrustStoreType() {
+        ConfigArgsConfigSource.setCliArgs("--fips-mode=strict");
+        assertEquals("BCFKS", createConfig().getConfigValue(HttpPropertyMappers.QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE).getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--https-trust-store-type=jks");
+        assertEquals("jks", createConfig().getConfigValue(HttpPropertyMappers.QUARKUS_HTTPS_TRUST_STORE_FILE_TYPE).getValue());
+    }
+
     @Test
     public void testCacheMaxCount() {
         int maxCount = 500;
@@ -521,8 +568,9 @@ public void testCacheMaxCount() {
               .collect(Collectors.toSet());
 
         StringBuilder sb = new StringBuilder();
-        for (String cache : maxCountCaches)
+        for (String cache : maxCountCaches) {
             sb.append(" --").append(CachingOptions.cacheMaxCountProperty(cache)).append("=").append(maxCount);
+        }
 
         String args = sb.toString();
         ConfigArgsConfigSource.setCliArgs(args.split(" "));
@@ -535,33 +583,45 @@ public void testCacheMaxCount() {
     }
 
     @Test
-    public void testWildcardCliOptionCanBeMappedToQuarkusOption() {
-        ConfigArgsConfigSource.setCliArgs("--log-level-org.keycloak=trace");
+    public void testDirectWildcardTo() {
+        // the mapping to for a wildcard property shouldn't be to anything
+        ConfigArgsConfigSource.setCliArgs("");
         SmallRyeConfig config = createConfig();
-        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
-        assertEquals("INFO", config.getConfigValue("quarkus.log.category.\"io.quarkus\".level").getValue());
-        assertEquals("INFO", config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
+        assertNull(config.getConfigValue("quarkus.log.category.\"<categories>\".level").getValue());
     }
 
     @Test
-    public void testWildcardEnvVarOptionCanBeMappedToQuarkusOption() {
-        putEnvVar("KC_LOG_LEVEL_IO_QUARKUS", "trace");
+    public void testKeycloakConfQuarkusPropertyNotUsed() {
+        ConfigArgsConfigSource.setCliArgs("");
+        SmallRyeConfig config = createConfig();
+        assertNull(config.getConfigValue("quarkus.management.ssl.cipher-suites").getValue());
+        assertNotNull(config.getConfigValue("kc.quarkus.management.ssl.cipher-suites").getValue());
+    }
+
+    @Test
+    public void testQuarkusPropertiesNamesFiltered() {
         SmallRyeConfig config = createConfig();
-        assertEquals("INFO", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
-        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"io.quarkus\".level").getValue());
-        assertEquals("INFO", config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
+        assertTrue(StreamSupport.stream(config.getPropertyNames().spliterator(), false).noneMatch("not.quarkus"::equals));
     }
 
     @Test
-    public void testWildcardOptionFromConfigFile() {
-        putEnvVar("SOME_CATEGORY_LOG_LEVEL", "debug");
+    public void testQuarkusLogPropDependentUponKeycloak() {
+        Environment.setRebuildCheck(); // will be reset by the system properties logic
+        ConfigArgsConfigSource.setCliArgs("--log-level=something:debug");
         SmallRyeConfig config = createConfig();
-        assertEquals("DEBUG", config.getConfigValue("quarkus.log.category.\"io.k8s\".level").getValue());
+        assertEquals("DEBUG", config.getConfigValue("quarkus.log.category.\"something\".level").getValue());
     }
 
     @Test
-    public void testWildcardPropertiesDontMatchEnvVarsFormat() {
+    public void testOverrideDefaultQuarkusPropertiesViaEnv() {
+        // we have a default defined in application.properties
+        putEnvVar("QUARKUS_HTTP_LIMITS_MAX_HEADER_SIZE", "200k");
+        ConfigArgsConfigSource.setCliArgs("");
         SmallRyeConfig config = createConfig();
-        assertEquals("INFO", config.getConfigValue("quarkus.log.category.\"io.quarkus\".level").getValue());
+        assertEquals("200k", config.getConfigValue("quarkus.http.limits.max-header-size").getValue());
+    }
+
+    private static Config.Scope cacheEmbeddedConfiguration() {
+        return initConfig(CacheEmbeddedConfigProviderSpi.SPI_NAME, DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID);
     }
 }
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/DatasourcesConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/DatasourcesConfigurationTest.java
new file mode 100644
index 000000000000..b289dcf9231b
--- /dev/null
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/DatasourcesConfigurationTest.java
@@ -0,0 +1,439 @@
+package org.keycloak.quarkus.runtime.configuration;
+
+import io.smallrye.config.Expressions;
+import io.smallrye.config.SmallRyeConfig;
+import org.h2.jdbcx.JdbcDataSource;
+import org.hibernate.dialect.H2Dialect;
+import org.hibernate.dialect.MariaDBDialect;
+import org.hibernate.dialect.PostgreSQLDialect;
+import org.junit.Test;
+import org.keycloak.quarkus.runtime.Environment;
+import org.mariadb.jdbc.MariaDbDataSource;
+import org.postgresql.xa.PGXADataSource;
+
+import java.util.Map;
+
+import static org.hamcrest.CoreMatchers.hasItem;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+public class DatasourcesConfigurationTest extends AbstractConfigurationTest {
+
+    @Test
+    public void defaultDatasource() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-default=mariadb", "--db=postgres");
+        initConfig();
+
+        assertConfig("db-kind-default", "mariadb");
+        assertConfig("db", "postgres");
+        assertExternalConfig("quarkus.datasource.\"default\".db-kind", "mariadb");
+        assertExternalConfig("quarkus.datasource.db-kind", "postgresql");
+
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-some<other>datasource=mssql");
+        initConfig();
+
+        // KC value is present as CLI is available data source
+        assertConfig("db-kind-some<other>datasource", "mssql");
+        assertExternalConfigNull("quarkus.datasource.\"some<other>datasource\".db-kind");
+    }
+
+    @Test
+    public void propertyMapping() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-user-store=mariadb", "--db-url-full-user-store=jdbc:mariadb://localhost/keycloak");
+
+        initConfig();
+
+        assertConfig("db-dialect-user-store", MariaDBDialect.class.getName());
+        assertExternalConfig("quarkus.datasource.\"user-store\".jdbc.url", "jdbc:mariadb://localhost/keycloak");
+    }
+
+    @Test
+    public void driverSetExplicitly() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-user-store=mssql", "--db-url-full-user-store=jdbc:sqlserver://localhost/keycloak");
+        System.setProperty("kc.db-driver-user-store", "com.microsoft.sqlserver.jdbc.SQLServerDriver");
+        System.setProperty("kc.transaction-xa-enabled-user-store", "false");
+        assertTrue(ConfigArgsConfigSource.getAllCliArgs().contains("--db-kind-user-store=mssql"));
+
+        initConfig();
+
+        assertConfig("db-kind-user-store", "mssql");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"user-store\".jdbc.url", "jdbc:sqlserver://localhost/keycloak",
+                "quarkus.datasource.\"user-store\".db-kind", "mssql",
+                "quarkus.datasource.\"user-store\".jdbc.driver", "com.microsoft.sqlserver.jdbc.SQLServerDriver",
+                "quarkus.datasource.\"user-store\".jdbc.transactions", "enabled")
+        );
+    }
+
+    @Test
+    public void urlProperties() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-customstore=mariadb", "--db-url-full-customstore=jdbc:mariadb:aurora://foo/bar?a=1&b=2");
+
+        initConfig();
+
+        assertConfig("db-dialect-customstore", MariaDBDialect.class.getName());
+        assertExternalConfig("quarkus.datasource.\"customstore\".jdbc.url", "jdbc:mariadb:aurora://foo/bar?a=1&b=2");
+    }
+
+    @Test
+    public void expansionDisabled() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-store=mysql");
+        SmallRyeConfig config = createConfig();
+        String value = Expressions.withoutExpansion(() -> config.getConfigValue("quarkus.datasource.\"store\".jdbc.url").getValue());
+        assertEquals("jdbc:mysql://${kc.db-url-host-store:localhost}:${kc.db-url-port-store:3306}/${kc.db-url-database-store:keycloak}${kc.db-url-properties-store:}", value);
+
+        assertExternalConfig("quarkus.datasource.\"store\".jdbc.url", "jdbc:mysql://localhost:3306/keycloak");
+    }
+
+    @Test
+    public void defaults() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-store=dev-file");
+        initConfig();
+        assertConfig("db-dialect-store", H2Dialect.class.getName());
+        // XA datasource is the default
+        assertExternalConfig("quarkus.datasource.\"store\".jdbc.driver", JdbcDataSource.class.getName());
+        assertExternalConfig("quarkus.datasource.\"store\".jdbc.url", "jdbc:h2:file:" + Environment.getHomeDir() + "/data/h2/keycloakdb-store;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-store=dev-mem");
+        initConfig();
+        assertConfig("db-dialect-store", H2Dialect.class.getName());
+        assertExternalConfig("quarkus.datasource.\"store\".jdbc.url", "jdbc:h2:mem:keycloakdb-store;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0");
+        assertExternalConfig("quarkus.datasource.\"store\".db-kind", "h2");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-clients=dev-mem", "--db-username-clients=other");
+        initConfig();
+        assertExternalConfig("quarkus.datasource.\"clients\".username", "other");
+        assertConfig("db-username-clients", "other");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-tigers=dev-mem");
+        initConfig();
+        assertExternalConfigNull("quarkus.datasource.\"tigers\".username");
+        assertExternalConfigNull("quarkus.datasource.\"tigers\".password");
+        assertConfigNull("db-username-tigers");
+        assertConfigNull("db-password-tigers");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-users=postgres", "--db-username-users=other");
+        initConfig();
+        assertExternalConfig("quarkus.datasource.\"users\".username", "other");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-some-store=postgres");
+        initConfig();
+        // username  or password should not be set, either as the quarkus or kc property
+        assertExternalConfigNull("quarkus.datasource.\"some-store\".username");
+        assertExternalConfigNull("quarkus.datasource.\"some-store\".password");
+        assertConfigNull("db-username-some-store");
+        assertConfigNull("db-password-some-store");
+    }
+
+    @Test
+    public void datasourceEnabled() {
+        ConfigArgsConfigSource.setCliArgs("");
+        initConfig();
+        assertConfig("db-active-store", "true");
+        assertExternalConfig("quarkus.datasource.\"store\".active", "true");
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-active-store=false");
+        initConfig();
+        assertConfig("db-active-store", "false");
+        assertExternalConfig("quarkus.datasource.\"store\".active", "false");
+    }
+
+    @Test
+    public void datasourceKindProperties() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-my-store=postgres", "--db-url-full-my-store=jdbc:postgresql://localhost/keycloak", "--db-username-my-store=postgres");
+        initConfig();
+
+        assertConfig("db-dialect-my-store", "org.hibernate.dialect.PostgreSQLDialect");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"my-store\".jdbc.url", "jdbc:postgresql://localhost/keycloak",
+                "quarkus.datasource.\"my-store\".db-kind", "postgresql",
+                "quarkus.datasource.\"my-store\".username", "postgres"
+        ));
+    }
+
+    @Test
+    public void propertiesGetApplied() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-asdf=postgres");
+        initConfig();
+        assertConfig("db-dialect-asdf", "org.hibernate.dialect.PostgreSQLDialect");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"asdf\".jdbc.url", "jdbc:postgresql://localhost:5432/keycloak",
+                "quarkus.datasource.\"asdf\".db-kind", "postgresql"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-asdf=postgres", "--db-url-host-asdf=myhost", "--db-url-port-asdf=5432", "--db-url-database-asdf=kcdb", "--db-url-properties-asdf=?foo=bar");
+        initConfig();
+        assertConfig("db-dialect-asdf", "org.hibernate.dialect.PostgreSQLDialect");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"asdf\".jdbc.url", "jdbc:postgresql://myhost:5432/kcdb?foo=bar",
+                "quarkus.datasource.\"asdf\".db-kind", "postgresql"
+        ));
+        onAfter();
+    }
+
+
+    @Test
+    public void removeSpaceFromValue() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-store=postgres      ");
+        initConfig();
+
+        assertConfig("db-dialect-store", "org.hibernate.dialect.PostgreSQLDialect");
+        assertExternalConfig("quarkus.datasource.\"store\".db-kind", "postgresql");
+        assertThat(Configuration.getConfigValue("quarkus.datasource.\"store\".db-kind").getRawValue(), is("postgres"));
+    }
+
+    @Test
+    public void defaultDbPortGetApplied() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-realms=mssql", "--db-url-host-realms=myhost", "--db-url-database-realms=kcdb", "--db-url-port-realms=1234", "--db-url-properties-realms=?foo=bar");
+        initConfig();
+
+        assertConfig("db-dialect-realms", "org.hibernate.dialect.SQLServerDialect");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"realms\".jdbc.url", "jdbc:sqlserver://myhost:1234;databaseName=kcdb?foo=bar",
+                "quarkus.datasource.\"realms\".db-kind", "mssql"
+        ));
+    }
+
+    @Test
+    public void setDbUrlOverridesDefaultDataSource() {
+        ConfigArgsConfigSource.setCliArgs("--db-kind-my-super-duper-store=mariadb", "--db-url-host-my-super-duper-store=myhost", "--db-url-full-my-super-duper-store=jdbc:mariadb://localhost/keycloak");
+        initConfig();
+
+        assertConfig("db-dialect-my-super-duper-store", "org.hibernate.dialect.MariaDBDialect");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"my-super-duper-store\".jdbc.url", "jdbc:mariadb://localhost/keycloak",
+                "quarkus.datasource.\"my-super-duper-store\".db-kind", "mariadb"
+        ));
+    }
+
+    @Test
+    public void datasourceProperties() {
+        System.setProperty("kc.db-url-properties-clients", ";;test=test;test1=test1");
+        System.setProperty("kc.db-url-path", "test-dir");
+        System.setProperty("kc.transaction-xa-enabled-clients", "true");
+        ConfigArgsConfigSource.setCliArgs("--db-kind-clients=dev-file");
+
+        initConfig();
+
+        assertConfig("db-dialect-clients", H2Dialect.class.getName());
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"clients\".jdbc.url", "jdbc:h2:file:test-dir/data/h2/keycloakdb-clients;;test=test;test1=test1;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0",
+                "quarkus.datasource.\"clients\".jdbc.transactions", "xa"
+        ));
+
+        ConfigArgsConfigSource.setCliArgs("");
+        initConfig();
+        assertConfig("db-dialect-clients", H2Dialect.class.getName());
+        assertExternalConfig("quarkus.datasource.\"clients\".jdbc.url", "jdbc:h2:file:test-dir/data/h2/keycloakdb-clients;;test=test;test1=test1;NON_KEYWORDS=VALUE;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=0");
+        onAfter();
+
+        System.setProperty("kc.db-url-properties-users", "?test=test&test1=test1");
+        System.setProperty("kc.transaction-xa-enabled-users", "true");
+        ConfigArgsConfigSource.setCliArgs("--db-kind-users=mariadb");
+        initConfig();
+
+        assertConfig("db-dialect-users", MariaDBDialect.class.getName());
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"users\".jdbc.url", "jdbc:mariadb://localhost:3306/keycloak?test=test&test1=test1",
+                "quarkus.datasource.\"users\".jdbc.driver", MariaDbDataSource.class.getName()
+        ));
+        onAfter();
+
+        System.setProperty("kc.db-url-properties-elephants", "?test=test&test1=test1");
+        System.setProperty("kc.transaction-xa-enabled-elephants", "true");
+        ConfigArgsConfigSource.setCliArgs("--db-kind-elephants=postgres");
+
+        initConfig();
+        assertConfig("db-dialect-elephants", PostgreSQLDialect.class.getName());
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"elephants\".jdbc.url", "jdbc:postgresql://localhost:5432/keycloak?test=test&test1=test1",
+                "quarkus.datasource.\"elephants\".jdbc.driver", PGXADataSource.class.getName()
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-schema-lions=test-schema");
+        initConfig();
+        assertConfig("db-schema-lions", "test-schema");
+    }
+
+    // KEYCLOAK-15632
+    @Test
+    public void nestedDatasourceProperties() {
+        initConfig();
+        assertExternalConfig("quarkus.datasource.foo", "jdbc:h2:file:" + Environment.getHomeDir() + "/data/keycloakdb");
+        assertExternalConfig("quarkus.datasource.bar", "foo-def-suffix");
+
+        System.setProperty("kc.prop5", "val5");
+        initConfig();
+        assertExternalConfig("quarkus.datasource.bar", "foo-val5-suffix");
+
+        System.setProperty("kc.prop4", "val4");
+        initConfig();
+        assertExternalConfig("quarkus.datasource.bar", "foo-val4");
+
+        System.setProperty("kc.prop3", "val3");
+        initConfig();
+        assertExternalConfig("quarkus.datasource.bar", "foo-val3");
+    }
+
+    @Test
+    public void poolSizeDefault() {
+        ConfigArgsConfigSource.setCliArgs("");
+        initConfig();
+
+        assertConfigNull("db-pool-initial-size-clients");
+        assertConfig(Map.of(
+                "db-pool-min-size-clients", "1",
+                "db-pool-max-size-clients", "100"
+        ));
+
+        assertExternalConfigNull("quarkus.datasource.\"clients\".jdbc.initial-size");
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"clients\".jdbc.min-size", "1",
+                "quarkus.datasource.\"clients\".jdbc.max-size", "100"
+        ));
+    }
+
+    @Test
+    public void poolSizeH2() {
+        ConfigArgsConfigSource.setCliArgs("--db-pool-min-size-clients=5", "--db-pool-initial-size-clients=10", "--db-pool-max-size-clients=15");
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-pool-min-size-clients", "5",
+                "db-pool-initial-size-clients", "10",
+                "db-pool-max-size-clients", "15"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"clients\".jdbc.min-size", "5",
+                "quarkus.datasource.\"clients\".jdbc.initial-size", "10",
+                "quarkus.datasource.\"clients\".jdbc.max-size", "15"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-pool-initial-size-clients=10");
+        initConfig();
+        assertConfig(Map.of(
+                "db-pool-min-size-clients", "1", // set 1 for H2
+                "db-pool-initial-size-clients", "10"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db-kind-clients=mysql", "--db-pool-initial-size-clients=16");
+        initConfig();
+        assertConfig(Map.of(
+                "db-pool-min-size-clients", "1", // set default value (1) for H2 default datasource
+                "db-pool-initial-size-clients", "16"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--db=postgres", "--db-kind-clients=mysql", "--db-pool-initial-size-clients=10");
+        initConfig();
+        assertConfig("db-pool-initial-size-clients", "10");
+        assertConfigNull("db-pool-min-size-clients"); // set null for non-H2 default datasource
+    }
+
+    @Test
+    public void poolSizeNonDefaultDbKind() {
+        ConfigArgsConfigSource.setCliArgs("-db-kind-store=postgres", "--db-pool-min-size-store=5", "--db-pool-initial-size-store=10", "--db-pool-max-size=15");
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-pool-min-size-store", "5",
+                "db-pool-initial-size-store", "10",
+                "db-pool-max-size-store", "15"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"store\".jdbc.min-size", "5",
+                "quarkus.datasource.\"store\".jdbc.initial-size", "10",
+                "quarkus.datasource.\"store\".jdbc.max-size", "15"
+        ));
+    }
+
+    @Test
+    public void poolSizeInherit() {
+        ConfigArgsConfigSource.setCliArgs("--db-pool-min-size=25", "--db-pool-initial-size=50", "--db-pool-max-size=115", "--db-kind-users=mssql");
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-pool-min-size", "25",
+                "db-pool-min-size-users", "25",
+                "db-pool-initial-size", "50",
+                "db-pool-initial-size-users", "50",
+                "db-pool-max-size", "115",
+                "db-pool-max-size-users", "115"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.jdbc.min-size", "25",
+                "quarkus.datasource.\"users\".jdbc.min-size", "25",
+                "quarkus.datasource.jdbc.initial-size", "50",
+                "quarkus.datasource.\"users\".jdbc.initial-size", "50",
+                "quarkus.datasource.jdbc.max-size", "115",
+                "quarkus.datasource.\"users\".jdbc.max-size", "115"
+        ));
+    }
+
+    @Test
+    public void envVarsHandling() {
+        putEnvVars(Map.of(
+                "KC_DB_KIND_USER_STORE", "postgres",
+                "KC_DB_URL_FULL_USER_STORE", "jdbc:postgresql://localhost/KEYCLOAK",
+                "KC_DB_USERNAME_USER_STORE", "my-username",
+                "KC_DB_KIND_MY_STORE", "mariadb"
+        ));
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-kind-user-store", "postgres",
+                "db-url-full-user-store", "jdbc:postgresql://localhost/KEYCLOAK",
+                "db-username-user-store", "my-username",
+                "db-kind-my-store", "mariadb"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"user-store\".db-kind", "postgresql",
+                "quarkus.datasource.\"user-store\".jdbc.url", "jdbc:postgresql://localhost/KEYCLOAK",
+                "quarkus.datasource.\"user-store\".username", "my-username",
+                "quarkus.datasource.\"my-store\".db-kind", "mariadb"
+        ));
+
+        assertThat(Configuration.getPropertyNames(), hasItem("quarkus.datasource.\"my-store\".db-kind"));
+        assertThat(Configuration.getPropertyNames(), not(hasItem("quarkus.datasource.\"my.store\".db-kind")));
+    }
+
+    @Test
+    public void envVarsSpecialChars() {
+        putEnvVars(Map.of(
+                "KC_USER_STORE_DB_KIND", "mariadb",
+                "KCKEY_USER_STORE_DB_KIND", "db-kind-user_store$something",
+                "KC_CLIENT_STORE_PW", "password",
+                "KCKEY_CLIENT_STORE_PW", "db-password-client.store_123"
+        ));
+        initConfig();
+
+        assertConfig(Map.of(
+                "db-kind-user_store$something", "mariadb",
+                "db-password-client.store_123", "password"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.datasource.\"user_store$something\".db-kind", "mariadb",
+                "quarkus.datasource.\"client.store_123\".password", "password"
+        ));
+    }
+}
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/FeaturePropertyMappersTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/FeaturePropertyMappersTest.java
similarity index 97%
rename from quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/FeaturePropertyMappersTest.java
rename to quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/FeaturePropertyMappersTest.java
index b3d8ab62b566..331b42dd5e7a 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/FeaturePropertyMappersTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/FeaturePropertyMappersTest.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-package org.keycloak.quarkus.runtime.configuration.test;
+package org.keycloak.quarkus.runtime.configuration;
 
 import org.junit.Test;
 import org.keycloak.common.Profile.Feature;
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/IgnoredArtifactsTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifactsTest.java
similarity index 80%
rename from quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/IgnoredArtifactsTest.java
rename to quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifactsTest.java
index d92379b4fa57..b5bb07e8364b 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/IgnoredArtifactsTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/IgnoredArtifactsTest.java
@@ -15,9 +15,8 @@
  * limitations under the License.
  */
 
-package org.keycloak.quarkus.runtime.configuration.test;
+package org.keycloak.quarkus.runtime.configuration;
 
-import org.hamcrest.CoreMatchers;
 import org.junit.Test;
 import org.keycloak.common.Profile;
 import org.keycloak.common.profile.PropertiesProfileConfigResolver;
@@ -30,6 +29,7 @@
 import org.keycloak.quarkus.runtime.configuration.IgnoredArtifacts;
 
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Properties;
 import java.util.Set;
@@ -37,8 +37,8 @@
 import java.util.stream.Stream;
 
 import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertTrue;
 import static org.keycloak.quarkus.runtime.configuration.IgnoredArtifacts.JDBC_H2;
 import static org.keycloak.quarkus.runtime.configuration.IgnoredArtifacts.JDBC_MARIADB;
 import static org.keycloak.quarkus.runtime.configuration.IgnoredArtifacts.JDBC_MSSQL;
@@ -72,7 +72,7 @@ public void fipsEnabled() {
 
     @Test
     public void jdbcH2() {
-        assertJdbc("h2", JDBC_H2);
+        assertJdbc("dev-file", JDBC_H2);
     }
 
     @Test
@@ -100,15 +100,15 @@ public void jdbcPostgres() {
         assertJdbc("postgres", JDBC_POSTGRES);
     }
 
-    // default ignored JDBC artifacts specified in quarkus.properties
-    private static final Set<String> IGNORED_JDBC_FROM_PROPS = Stream.of(JDBC_MARIADB, JDBC_POSTGRES)
+    // default not ignored JDBC artifacts specified in quarkus.properties
+    private static final Set<String> NOT_IGNORED_JDBC_FROM_PROPS = Stream.of(JDBC_MARIADB, JDBC_POSTGRES)
             .flatMap(Collection::stream)
             .collect(Collectors.toSet());
 
     @Test
     public void multipleDatasources() {
         // initialize the test with a default database
-        ConfigArgsConfigSource.setCliArgs("--db=dev-file");
+        ConfigArgsConfigSource.setCliArgs("");
         createConfig();
 
         var defaultDS = Configuration.getOptionalValue("quarkus.datasource.db-kind");
@@ -123,27 +123,29 @@ public void multipleDatasources() {
         assertThat(catStoreDS.isPresent(), is(true));
         assertThat(catStoreDS.get(), is("postgresql"));
 
-        assertJdbc("h2", JDBC_H2);
+        assertNotIgnored("dev-file", JDBC_H2);
     }
 
-    private void assertJdbc(String vendor, Set<String> notIgnored) {
-        var notIgnoredWithDefaults = new HashSet<>(notIgnored);
-        notIgnoredWithDefaults.addAll(IGNORED_JDBC_FROM_PROPS);
-
-        setSystemProperty(NS_KEYCLOAK_PREFIX + DatabaseOptions.DB.getKey(), vendor, () -> {
-            final var resultArtifacts = IgnoredArtifacts.getDefaultIgnoredArtifacts();
-            assertThat(String.format("Ignored artifacts does not comply with the specified artifacts for '%s' JDBC driver", vendor),
-                    resultArtifacts,
-                    not(CoreMatchers.hasItems(notIgnoredWithDefaults.toArray(new String[0]))));
-
-            final var includedArtifacts = new HashSet<>(IgnoredArtifacts.JDBC_DRIVERS);
-            includedArtifacts.removeAll(notIgnoredWithDefaults);
-            assertThat("Ignored artifacts does not contain items for the other JDBC drivers",
-                    resultArtifacts,
-                    CoreMatchers.hasItems(includedArtifacts.toArray(new String[0])));
+    private void assertJdbc(String db, Set<String> notIgnored) {
+        setSystemProperty(NS_KEYCLOAK_PREFIX + DatabaseOptions.DB.getKey(), db, () -> {
+            assertNotIgnored(db, notIgnored);
         });
     }
 
+    private void assertNotIgnored(String db, Set<String> notIgnored) {
+        var notIgnoredWithDefaults = new HashSet<>(notIgnored);
+        notIgnoredWithDefaults.addAll(NOT_IGNORED_JDBC_FROM_PROPS);
+
+        final var actualIgnoredArtifacts = IgnoredArtifacts.getDefaultIgnoredArtifacts();
+        assertTrue(String.format("Ignored artifacts does not comply with the specified artifacts for '%s' JDBC driver",
+                db), Collections.disjoint(actualIgnoredArtifacts, notIgnored));
+
+        final var allIgnoredArtifacts = new HashSet<>(IgnoredArtifacts.JDBC_DRIVERS);
+        allIgnoredArtifacts.removeAll(notIgnoredWithDefaults);
+        assertThat("Ignored artifacts does not contain items for the other JDBC drivers",
+                actualIgnoredArtifacts.containsAll(allIgnoredArtifacts));
+    }
+
     @Test
     public void health() {
         assertIgnoredArtifacts(IgnoredArtifacts.HEALTH, HealthOptions.HEALTH_ENABLED);
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/LoggingConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/LoggingConfigurationTest.java
new file mode 100644
index 000000000000..2638282e3bde
--- /dev/null
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/LoggingConfigurationTest.java
@@ -0,0 +1,495 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.configuration;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.keycloak.config.LoggingOptions.DEFAULT_LOG_FORMAT;
+import static org.keycloak.config.LoggingOptions.DEFAULT_SYSLOG_OUTPUT;
+import static org.keycloak.config.LoggingOptions.SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT;
+
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.StreamSupport;
+
+import org.hamcrest.CoreMatchers;
+import org.junit.Test;
+import org.keycloak.config.LoggingOptions;
+import org.keycloak.quarkus.runtime.Environment;
+import org.keycloak.quarkus.runtime.cli.PropertyException;
+import io.smallrye.config.SmallRyeConfig;
+
+public class LoggingConfigurationTest extends AbstractConfigurationTest {
+
+    @Test
+    public void logHandlerConfig() {
+        ConfigArgsConfigSource.setCliArgs("--log=console,file");
+        SmallRyeConfig config = createConfig();
+        assertEquals("true", config.getConfigValue("quarkus.log.console.enable").getValue());
+        assertEquals("true", config.getConfigValue("quarkus.log.file.enable").getValue());
+        assertEquals("false", config.getConfigValue("quarkus.log.syslog.enable").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--log=file");
+        SmallRyeConfig config2 = createConfig();
+        assertEquals("false", config2.getConfigValue("quarkus.log.console.enable").getValue());
+        assertEquals("true", config2.getConfigValue("quarkus.log.file.enable").getValue());
+        assertEquals("false", config2.getConfigValue("quarkus.log.syslog.enable").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--log=console");
+        SmallRyeConfig config3 = createConfig();
+        assertEquals("true", config3.getConfigValue("quarkus.log.console.enable").getValue());
+        assertEquals("false", config3.getConfigValue("quarkus.log.file.enable").getValue());
+        assertEquals("false", config3.getConfigValue("quarkus.log.syslog.enable").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--log=console,syslog");
+        SmallRyeConfig config5 = createConfig();
+        assertEquals("true", config5.getConfigValue("quarkus.log.console.enable").getValue());
+        assertEquals("false", config5.getConfigValue("quarkus.log.file.enable").getValue());
+        assertEquals("true", config5.getConfigValue("quarkus.log.syslog.enable").getValue());
+
+        ConfigArgsConfigSource.setCliArgs("--log=syslog");
+        SmallRyeConfig config6 = createConfig();
+        assertEquals("false", config6.getConfigValue("quarkus.log.console.enable").getValue());
+        assertEquals("false", config6.getConfigValue("quarkus.log.file.enable").getValue());
+        assertEquals("true", config6.getConfigValue("quarkus.log.syslog.enable").getValue());
+    }
+
+    @Test
+    public void syslogDefaults() {
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-syslog-enabled", "false",
+                "log-syslog-endpoint", "localhost:514",
+                "log-syslog-type", "rfc5424",
+                "log-syslog-app-name", "keycloak",
+                "log-syslog-protocol", "tcp",
+                "log-syslog-format", DEFAULT_LOG_FORMAT,
+                "log-syslog-output", DEFAULT_SYSLOG_OUTPUT.toString(),
+                "log-syslog-counting-framing", SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT
+        ));
+        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
+
+        assertExternalConfig(Map.of(
+                "quarkus.log.syslog.enable", "false",
+                "quarkus.log.syslog.endpoint", "localhost:514",
+                "quarkus.log.syslog.syslog-type", "rfc5424",
+                "quarkus.log.syslog.app-name", "keycloak",
+                "quarkus.log.syslog.protocol", "tcp",
+                "quarkus.log.syslog.use-counting-framing", "true",
+                "quarkus.log.syslog.format", DEFAULT_LOG_FORMAT,
+                "quarkus.log.syslog.json.enabled", "false"
+        ));
+
+        // The default max-length attribute is set in the org.jboss.logmanager.handlers.SyslogHandler if not specified in config
+        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
+    }
+
+    @Test
+    public void syslogDifferentValues() {
+        putEnvVars(Map.of(
+                "KC_LOG", "syslog",
+                "KC_LOG_SYSLOG_ENDPOINT", "192.168.0.42:515",
+                "KC_LOG_SYSLOG_TYPE", "rfc3164",
+                "KC_LOG_SYSLOG_MAX_LENGTH", "4096",
+                "KC_LOG_SYSLOG_APP_NAME", "keycloak2",
+                "KC_LOG_SYSLOG_PROTOCOL", "udp",
+                "KC_LOG_SYSLOG_COUNTING_FRAMING", "false",
+                "KC_LOG_SYSLOG_FORMAT", "some format",
+                "KC_LOG_SYSLOG_OUTPUT", "json"
+        ));
+
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-syslog-enabled", "true",
+                "log-syslog-endpoint", "192.168.0.42:515",
+                "log-syslog-type", "rfc3164",
+                "log-syslog-max-length", "4096",
+                "log-syslog-app-name", "keycloak2",
+                "log-syslog-protocol", "udp",
+                "log-syslog-counting-framing", "false",
+                "log-syslog-format", "some format",
+                "log-syslog-output", "json"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.log.syslog.enable", "true",
+                "quarkus.log.syslog.endpoint", "192.168.0.42:515",
+                "quarkus.log.syslog.syslog-type", "rfc3164",
+                "quarkus.log.syslog.max-length", "4096",
+                "quarkus.log.syslog.app-name", "keycloak2",
+                "quarkus.log.syslog.protocol", "udp",
+                "quarkus.log.syslog.use-counting-framing", "false",
+                "quarkus.log.syslog.format", "some format",
+                "quarkus.log.syslog.json.enabled", "true"
+        ));
+    }
+
+    @Test
+    public void syslogMaxLength() {
+        // RFC3164
+        putEnvVar("KC_LOG_SYSLOG_TYPE", "rfc3164");
+        initConfig();
+
+        assertConfig("log-syslog-type", "rfc3164");
+        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
+        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
+
+        // RFC5424
+        putEnvVar("KC_LOG_SYSLOG_TYPE", "rfc5424");
+        initConfig();
+
+        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
+        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
+
+        // Specific max-length
+        removeEnvVar("KC_LOG_SYSLOG_TYPE");
+        putEnvVar("KC_LOG_SYSLOG_MAX_LENGTH", "512");
+        initConfig();
+
+        assertConfig("log-syslog-max-length", "512");
+        assertExternalConfig("quarkus.log.syslog.max-length", "512");
+    }
+
+    @Test
+    public void syslogCountingFraming() {
+        assertSyslogCountingFramingProtocolDependent("tcp", true);
+        assertSyslogCountingFramingProtocolDependent("udp", false);
+        assertSyslogCountingFramingProtocolDependent("ssl-tcp", true);
+        try {
+            assertSyslogCountingFramingProtocolDependent("error", false);
+            fail("Wrong protocol name should throw an error");
+        } catch (PropertyException expected) {
+            assertThat(expected.getMessage(), containsString("Invalid Syslog protocol: error"));
+        }
+    }
+
+    protected void assertSyslogCountingFramingProtocolDependent(String protocol, boolean expectedCountingFraming) {
+        putEnvVars(Map.of(
+                "KC_LOG", "syslog",
+                "KC_LOG_SYSLOG_PROTOCOL", protocol
+        ));
+
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-syslog-enabled", "true",
+                "log-syslog-protocol", protocol,
+                "log-syslog-counting-framing", SYSLOG_COUNTING_FRAMING_PROTOCOL_DEPENDENT
+        ));
+        assertExternalConfig(Map.of(
+                "quarkus.log.syslog.enable", "true",
+                "quarkus.log.syslog.protocol", protocol,
+                "quarkus.log.syslog.use-counting-framing", Boolean.toString(expectedCountingFraming)
+        ));
+        onAfter();
+    }
+
+    @Test
+    public void logLevelsHandlers() {
+        putEnvVars(Map.of(
+                "KC_LOG_LEVEL", "debug",
+                "KC_LOG_CONSOLE_LEVEL", "info",
+                "KC_LOG_SYSLOG_LEVEL", "trace",
+                "KC_LOG_FILE_LEVEL", "debug"
+        ));
+
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-level", "debug",
+                "log-console-level", "info",
+                "log-syslog-level", "trace",
+                "log-file-level", "debug"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.log.level", "DEBUG",
+                "quarkus.log.console.level", "INFO",
+                "quarkus.log.syslog.level", "TRACE",
+                "quarkus.log.file.level", "DEBUG"
+        ));
+    }
+
+    @Test
+    public void logLevelTakesPrecedenceOverCategoryLevel() {
+        ConfigArgsConfigSource.setCliArgs("--log-level=org.keycloak:error");
+        SmallRyeConfig config = createConfig();
+        assertEquals("INFO", config.getConfigValue("quarkus.log.level").getValue());
+        assertEquals("ERROR", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
+
+        onAfter();
+        ConfigArgsConfigSource.setCliArgs("--log-level=org.keycloak:error", "--log-level-org.keycloak=trace");
+        config = createConfig();
+        assertEquals("INFO", config.getConfigValue("quarkus.log.level").getValue());
+        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
+    }
+
+    @Test
+    public void unknownCategoryLevelIsResolvedFromRootLevel() {
+        ConfigArgsConfigSource.setCliArgs("--log-level=warn,org.keycloak:error", "--log-level-org.keycloak=trace");
+        SmallRyeConfig config = createConfig();
+        assertEquals("WARN", config.getConfigValue("quarkus.log.level").getValue());
+        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
+        assertNull(config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
+    }
+
+    @Test
+    public void jsonDefaultFormat() {
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-console-json-format", "default",
+                "log-file-json-format", "default",
+                "log-syslog-json-format", "default"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.log.console.json.log-format", "default",
+                "quarkus.log.file.json.log-format", "default",
+                "quarkus.log.syslog.json.log-format", "default"
+        ));
+    }
+
+    @Test
+    public void jsonEcsFormat() {
+        putEnvVars(Map.of(
+                "KC_LOG_CONSOLE_OUTPUT", "json",
+                "KC_LOG_CONSOLE_JSON_FORMAT", "ecs",
+                "KC_LOG_FILE_OUTPUT", "json",
+                "KC_LOG_FILE_JSON_FORMAT", "ecs",
+                "KC_LOG_SYSLOG_OUTPUT", "json",
+                "KC_LOG_SYSLOG_JSON_FORMAT", "ecs"
+        ));
+
+        initConfig();
+
+        assertConfig(Map.of(
+                "log-console-output", "json",
+                "log-console-json-format", "ecs",
+                "log-file-output", "json",
+                "log-file-json-format", "ecs",
+                "log-syslog-output", "json",
+                "log-syslog-json-format", "ecs"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.log.console.json.enabled", "true",
+                "quarkus.log.console.json.log-format", "ecs",
+                "quarkus.log.file.json.enabled", "true",
+                "quarkus.log.file.json.log-format", "ecs",
+                "quarkus.log.syslog.json.enabled", "true",
+                "quarkus.log.syslog.json.log-format", "ecs"
+        ));
+    }
+
+    @Test
+    public void testWildcardCliOptionCanBeMappedToQuarkusOption() {
+        ConfigArgsConfigSource.setCliArgs("--log-level-org.keycloak=trace");
+        SmallRyeConfig config = createConfig();
+        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
+        assertNull(config.getConfigValue("quarkus.log.category.\"io.quarkus\".level").getValue());
+        assertNull(config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
+    }
+
+    @Test
+    public void testWildcardEnvVarOptionCanBeMappedToQuarkusOption() {
+        putEnvVar("KC_LOG_LEVEL_IO_QUARKUS", "trace");
+        SmallRyeConfig config = createConfig();
+        // the default quarkus kc mapping should not be present
+        Set<String> keys = StreamSupport.stream(config.getPropertyNames().spliterator(), false).collect(Collectors.toSet());
+        assertFalse(keys.contains("kc.log.level.\"io.quarkus"));
+        assertFalse(keys.contains("kc.log.level.io-quarkus"));
+        // the default quarkus mapping should be
+        assertNull(config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
+        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"io.quarkus\".level").getValue());
+        assertTrue(keys.contains("kc.log-level-io.quarkus"));
+        assertNull(config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
+    }
+
+    @Test
+    public void testWildcardOptionFromConfigFile() {
+        putEnvVar("SOME_CATEGORY_LOG_LEVEL", "debug");
+        SmallRyeConfig config = createConfig();
+        assertEquals("DEBUG", config.getConfigValue("quarkus.log.category.\"io.k8s\".level").getValue());
+    }
+
+    @Test
+    public void testLogLevelWithUnderscore() {
+        ConfigArgsConfigSource.setCliArgs("--log-level=error,reproducer.not_ok:debug");
+        SmallRyeConfig config = createConfig();
+        assertEquals("DEBUG", config.getConfigValue("quarkus.log.category.\"reproducer.not_ok\".level").getValue());
+        Set<String> keys = StreamSupport.stream(config.getPropertyNames().spliterator(), false).collect(Collectors.toSet());
+        assertTrue(keys.contains("quarkus.log.category.\"reproducer.not_ok\".level"));
+    }
+
+    @Test
+    public void testLogLevelWithUnderscoreEnv() {
+        putEnvVar("KC_1", "debug");
+        putEnvVar("KCKEY_1", "log-level-reproducer.not_ok");
+        SmallRyeConfig config = createConfig();
+        assertEquals("DEBUG", config.getConfigValue("quarkus.log.category.\"reproducer.not_ok\".level").getValue());
+        Set<String> keys = StreamSupport.stream(config.getPropertyNames().spliterator(), false).collect(Collectors.toSet());
+        assertTrue(keys.contains("quarkus.log.category.\"reproducer.not_ok\".level"));
+    }
+
+    @Test(expected = PropertyException.class)
+    public void testInvalidLogLevel() {
+        ConfigArgsConfigSource.setCliArgs("--log-level=reproducer.not^ok:debug");
+        createConfig();
+    }
+
+    @Test
+    public void testNestedBuildTimeLogging() {
+        Environment.setRebuildCheck(); // will be reset by the system properties logic
+        ConfigArgsConfigSource.setCliArgs("");
+        assertEquals("true", createConfig().getConfigValue("quarkus.log.console.enable").getValue());
+    }
+
+    @Test
+    public void asyncDefaults() {
+        initConfig();
+
+        boolean defaultEnabled = false;
+        int defaultQueueLength = 512;
+
+        for (var handler : LoggingOptions.Handler.values()) {
+            assertAsyncProperties(handler, defaultEnabled, defaultQueueLength);
+        }
+    }
+
+    @Test
+    public void asyncProperties() {
+        boolean enabled = true;
+        int queueLength = 1024;
+
+        for (var handler : LoggingOptions.Handler.values()) {
+            setAsyncProperties(handler, enabled, queueLength);
+        }
+
+        initConfig();
+
+        for (var handler : LoggingOptions.Handler.values()) {
+            assertAsyncProperties(handler, enabled, queueLength);
+        }
+    }
+
+    @Test
+    public void asyncPropertiesIndividual() {
+        setAsyncProperties(LoggingOptions.Handler.console, true, 768);
+        setAsyncProperties(LoggingOptions.Handler.file, false, 1523);
+        setAsyncProperties(LoggingOptions.Handler.syslog, true, 888);
+
+        initConfig();
+
+        assertAsyncProperties(LoggingOptions.Handler.console, true, 768);
+        assertAsyncProperties(LoggingOptions.Handler.file, false, 1523);
+        assertAsyncProperties(LoggingOptions.Handler.syslog, true, 888);
+    }
+
+    @Test
+    public void asyncGlobalProperty() {
+        putEnvVar("KC_LOG_ASYNC", "true");
+
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, true);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, true);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, true);
+
+        onAfter();
+
+        putEnvVar("KC_LOG_ASYNC", "false");
+
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, false);
+    }
+
+    @Test
+    public void asyncGlobalPropertyOverrides() {
+        putEnvVar("KC_LOG_ASYNC", "true");
+        setAsyncLoggingEnabled(LoggingOptions.Handler.console, false);
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, true);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, true);
+
+        setAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, true);
+
+        setAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, true);
+
+        onAfter();
+
+        putEnvVar("KC_LOG_ASYNC", "false");
+        setAsyncLoggingEnabled(LoggingOptions.Handler.console, true);
+        initConfig();
+
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.console, true);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.file, false);
+        assertAsyncLoggingEnabled(LoggingOptions.Handler.syslog, false);
+
+    }
+
+    protected void setAsyncLoggingEnabled(LoggingOptions.Handler handler, Boolean enabled) {
+        // default values
+        setAsyncProperties(handler, enabled, 512);
+    }
+
+    protected void setAsyncProperties(LoggingOptions.Handler handler, Boolean enabled, Integer queueLength) {
+        var handlerName = handler.name();
+        putEnvVars(Map.of(
+                "KC_LOG_%s_ASYNC".formatted(handlerName), enabled.toString(),
+                "KC_LOG_%s_ASYNC_QUEUE_LENGTH".formatted(handlerName), queueLength.toString()
+                ));
+    }
+
+    protected void assertAsyncLoggingEnabled(LoggingOptions.Handler handler, Boolean expectedEnabled) {
+        var handlerName = handler.toString();
+        assertConfig("log-%s-async".formatted(handlerName), expectedEnabled.toString());
+        assertExternalConfig("quarkus.log.%s.async".formatted(handlerName), expectedEnabled.toString());
+    }
+
+    protected void assertAsyncProperties(LoggingOptions.Handler handler, Boolean enabled, Integer queueLength) {
+        assertAsyncLoggingEnabled(handler, enabled);
+
+        var handlerName = handler.toString();
+        assertConfig("log-%s-async-queue-length".formatted(handlerName), queueLength.toString());
+        assertExternalConfig("quarkus.log.%s.async.queue-length".formatted(handlerName), queueLength.toString());
+    }
+}
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ManagementConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ManagementConfigurationTest.java
similarity index 89%
rename from quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ManagementConfigurationTest.java
rename to quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ManagementConfigurationTest.java
index 76e3a98cee8f..22f4321b1a04 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/ManagementConfigurationTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/ManagementConfigurationTest.java
@@ -14,10 +14,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.quarkus.runtime.configuration.test;
+package org.keycloak.quarkus.runtime.configuration;
 
 import org.junit.Test;
+import org.keycloak.quarkus.runtime.cli.command.Build;
 import org.keycloak.quarkus.runtime.configuration.mappers.ManagementPropertyMappers;
+import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 
 import java.util.Map;
 
@@ -188,6 +190,27 @@ public void managementDefaultHttps() {
         assertManagementHttpsEnabled(true);
     }
 
+    @Test
+    public void managementSchemeHttp() {
+        makeInterfaceOccupied();
+        putEnvVars(Map.of(
+                "KC_HTTPS_CERTIFICATE_FILE", "/some/path/srv.crt.pem",
+                "KC_HTTPS_CERTIFICATE_KEY_FILE", "/some/path/srv.key.pem",
+                "KC_HTTP_MANAGEMENT_SCHEME", "http"
+        ));
+
+        initConfig();
+        PropertyMappers.sanitizeDisabledMappers(new Build());
+
+        assertConfig(Map.of(
+                "https-certificate-file", "/some/path/srv.crt.pem",
+                "https-certificate-key-file", "/some/path/srv.key.pem"
+        ));
+        assertConfigNull("https-management-certificate-file");
+        assertManagementEnabled(true);
+        assertManagementHttpsEnabled(false);
+    }
+
     @Test
     public void managementDefaultHttpsManagementProps() {
         makeInterfaceOccupied();
@@ -230,6 +253,18 @@ public void managementDefaultHttpsKeyDisabled() {
         assertManagementHttpsEnabled(false);
     }
 
+    @Test
+    public void managementDefaultHttpsCertificatesReload() {
+        makeInterfaceOccupied();
+        putEnvVar("KC_HTTPS_CERTIFICATES_RELOAD_PERIOD", "2d");
+
+        initConfig();
+
+        assertConfig("https-management-certificates-reload-period", "2d");
+        assertManagementEnabled(true);
+        assertManagementHttpsEnabled(false);
+    }
+
     @Test
     public void managementEnabledDefaultHttpsKeystore(){
         makeInterfaceOccupied();
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/TracingConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/TracingConfigurationTest.java
similarity index 99%
rename from quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/TracingConfigurationTest.java
rename to quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/TracingConfigurationTest.java
index 5268e34cdd01..daf00699ba09 100644
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/TracingConfigurationTest.java
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/TracingConfigurationTest.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-package org.keycloak.quarkus.runtime.configuration.test;
+package org.keycloak.quarkus.runtime.configuration;
 
 import io.quarkus.opentelemetry.runtime.config.build.SamplerType;
 import org.junit.Test;
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappersTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappersTest.java
new file mode 100644
index 000000000000..ba1d753fe3c6
--- /dev/null
+++ b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMappersTest.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.configuration.mappers;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+public class PropertyMappersTest {
+
+    @Test
+    public void testIsSpiBuildTimeProperty() {
+        // Should return true for valid SPI build-time properties
+        assertTrue(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar--provider"));
+        assertTrue(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar--enabled"));
+        assertTrue(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar--provider-default"));
+
+        // return false for non-build time properties
+        //assertFalse(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar-provider"));
+        //assertFalse(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar-enabled"));
+        //assertFalse(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar-provider-default"));
+        assertFalse(PropertyMappers.isSpiBuildTimeProperty("some.other.property"));
+        assertFalse(PropertyMappers.isSpiBuildTimeProperty("kc.spi.foo.bar"));
+    }
+}
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/AbstractConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/AbstractConfigurationTest.java
deleted file mode 100644
index c80e0d129a7a..000000000000
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/AbstractConfigurationTest.java
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.configuration.test;
-
-import io.quarkus.runtime.LaunchMode;
-import io.quarkus.runtime.configuration.ConfigUtils;
-import io.smallrye.config.ConfigValue;
-import io.smallrye.config.SmallRyeConfig;
-import io.smallrye.config.SmallRyeConfigProviderResolver;
-import io.smallrye.config.ConfigValue.ConfigValueBuilder;
-
-import org.eclipse.microprofile.config.ConfigProvider;
-import org.eclipse.microprofile.config.spi.ConfigProviderResolver;
-import org.junit.After;
-import org.junit.BeforeClass;
-import org.keycloak.Config;
-import org.keycloak.common.Profile;
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
-import org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider;
-import org.keycloak.quarkus.runtime.configuration.MicroProfileConfigProvider;
-import org.keycloak.quarkus.runtime.configuration.PersistedConfigSource;
-import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
-
-import java.lang.reflect.Field;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Properties;
-import java.util.function.Function;
-
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.CoreMatchers.notNullValue;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-public abstract class AbstractConfigurationTest {
-
-    private static final Properties SYSTEM_PROPERTIES = (Properties) System.getProperties().clone();
-    private static final Map<String, String> ENVIRONMENT_VARIABLES = new HashMap<>(System.getenv());
-
-    @SuppressWarnings("unchecked")
-    public static void putEnvVar(String name, String value) {
-        Map<String, String> env = System.getenv();
-        Field field = null;
-        try {
-            field = env.getClass().getDeclaredField("m");
-            field.setAccessible(true);
-            ((Map<String, String>) field.get(env)).put(name, value);
-        } catch (Exception cause) {
-            throw new RuntimeException("Failed to update environment variables", cause);
-        } finally {
-            if (field != null) {
-                field.setAccessible(false);
-            }
-        }
-    }
-
-    public static void putEnvVars(Map<String, String> map) {
-        map.forEach(ConfigurationTest::putEnvVar);
-    }
-
-    @SuppressWarnings("unchecked")
-    public static void removeEnvVar(String name) {
-        Map<String, String> env = System.getenv();
-        Field field = null;
-        try {
-            field = env.getClass().getDeclaredField("m");
-            field.setAccessible(true);
-            ((Map<String, String>) field.get(env)).remove(name);
-        } catch (Exception cause) {
-            throw new RuntimeException("Failed to update environment variables", cause);
-        } finally {
-            if (field != null) {
-                field.setAccessible(false);
-            }
-        }
-    }
-
-    public static void setSystemProperty(String key, String value, Runnable runnable) {
-        System.setProperty(key, value);
-        createConfig();
-        try {
-            runnable.run();
-        } finally {
-            System.clearProperty(key);
-        }
-    }
-
-    @BeforeClass
-    public static void resetConfiguration() {
-        System.setProperties((Properties) SYSTEM_PROPERTIES.clone());
-
-        for (String name : new HashMap<>(System.getenv()).keySet()) {
-            if (!ENVIRONMENT_VARIABLES.containsKey(name)) {
-                removeEnvVar(name);
-            }
-        }
-        ENVIRONMENT_VARIABLES.forEach((key, value) -> {
-            if (!System.getenv(key).equals(value)) {
-                putEnvVar(key, value);
-            }
-        });
-
-        SmallRyeConfigProviderResolver.class.cast(ConfigProviderResolver.instance()).releaseConfig(ConfigProvider.getConfig());
-        PropertyMappers.reset();
-        ConfigArgsConfigSource.setCliArgs();
-        PersistedConfigSource.getInstance().getConfigValueProperties().clear();
-        Profile.reset();
-        ConfigProviderResolver.setInstance(null);
-    }
-
-    @After
-    public void onAfter() {
-        resetConfiguration();
-    }
-
-    protected Config.Scope initConfig(String... scope) {
-        Config.init(new MicroProfileConfigProvider(createConfig()));
-        return Config.scope(scope);
-    }
-
-    static protected SmallRyeConfig createConfig() {
-        KeycloakConfigSourceProvider.reload();
-        // older versions of quarkus implicitly picked up this config, now we
-        // must set it manually
-        SmallRyeConfig config = ConfigUtils.configBuilder(true, LaunchMode.NORMAL).build();
-        SmallRyeConfigProviderResolver resolver = new SmallRyeConfigProviderResolver();
-        resolver.registerConfig(config, Thread.currentThread().getContextClassLoader());
-        ConfigProviderResolver.setInstance(resolver);
-        return config;
-    }
-
-    protected void assertConfig(String key, String expectedValue, boolean isExternal) {
-        Function<String, ConfigValue> getConfig = isExternal ? Configuration::getConfigValue : Configuration::getKcConfigValue;
-        var value = getConfig.apply(key).getValue();
-        assertThat(String.format("Value is null for key '%s'", key), value, notNullValue());
-        assertThat(String.format("Different value for key '%s'", key), value, is(expectedValue));
-    }
-
-    protected void assertConfig(String key, String expectedValue) {
-        assertConfig(key, expectedValue, false);
-    }
-
-    protected void assertConfig(Map<String, String> expectedValues) {
-        expectedValues.forEach(this::assertConfig);
-    }
-
-    protected void assertExternalConfig(String key, String expectedValue) {
-        assertConfig(key, expectedValue, true);
-    }
-
-    protected void assertExternalConfig(Map<String, String> expectedValues) {
-        expectedValues.forEach(this::assertExternalConfig);
-    }
-
-    protected static void addPersistedConfigValues(Map<String, String> values) {
-        var configValueProps = PersistedConfigSource.getInstance().getConfigValueProperties();
-        values.forEach((k, v) -> configValueProps.put(k,
-                new ConfigValueBuilder().withName(k).withValue(v).withRawValue(v)
-                        .withConfigSourceName(PersistedConfigSource.getInstance().getName())
-                        .withConfigSourceOrdinal(PersistedConfigSource.getInstance().getOrdinal()).build()));
-    }
-}
diff --git a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/LoggingConfigurationTest.java b/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/LoggingConfigurationTest.java
deleted file mode 100644
index b4affc4f6557..000000000000
--- a/quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/test/LoggingConfigurationTest.java
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.configuration.test;
-
-import io.smallrye.config.SmallRyeConfig;
-import org.hamcrest.CoreMatchers;
-import org.junit.Test;
-import org.keycloak.config.LoggingOptions;
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-import org.keycloak.quarkus.runtime.configuration.Configuration;
-
-import java.util.Map;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.keycloak.config.LoggingOptions.DEFAULT_LOG_FORMAT;
-import static org.keycloak.config.LoggingOptions.DEFAULT_SYSLOG_OUTPUT;
-
-public class LoggingConfigurationTest extends AbstractConfigurationTest {
-
-    @Test
-    public void logHandlerConfig() {
-        ConfigArgsConfigSource.setCliArgs("--log=console,file");
-        SmallRyeConfig config = createConfig();
-        assertEquals("true", config.getConfigValue("quarkus.log.console.enable").getValue());
-        assertEquals("true", config.getConfigValue("quarkus.log.file.enable").getValue());
-        assertEquals("false", config.getConfigValue("quarkus.log.syslog.enable").getValue());
-
-        ConfigArgsConfigSource.setCliArgs("--log=file");
-        SmallRyeConfig config2 = createConfig();
-        assertEquals("false", config2.getConfigValue("quarkus.log.console.enable").getValue());
-        assertEquals("true", config2.getConfigValue("quarkus.log.file.enable").getValue());
-        assertEquals("false", config2.getConfigValue("quarkus.log.syslog.enable").getValue());
-
-        ConfigArgsConfigSource.setCliArgs("--log=console");
-        SmallRyeConfig config3 = createConfig();
-        assertEquals("true", config3.getConfigValue("quarkus.log.console.enable").getValue());
-        assertEquals("false", config3.getConfigValue("quarkus.log.file.enable").getValue());
-        assertEquals("false", config3.getConfigValue("quarkus.log.syslog.enable").getValue());
-
-        ConfigArgsConfigSource.setCliArgs("--log=console,syslog");
-        SmallRyeConfig config5 = createConfig();
-        assertEquals("true", config5.getConfigValue("quarkus.log.console.enable").getValue());
-        assertEquals("false", config5.getConfigValue("quarkus.log.file.enable").getValue());
-        assertEquals("true", config5.getConfigValue("quarkus.log.syslog.enable").getValue());
-
-        ConfigArgsConfigSource.setCliArgs("--log=syslog");
-        SmallRyeConfig config6 = createConfig();
-        assertEquals("false", config6.getConfigValue("quarkus.log.console.enable").getValue());
-        assertEquals("false", config6.getConfigValue("quarkus.log.file.enable").getValue());
-        assertEquals("true", config6.getConfigValue("quarkus.log.syslog.enable").getValue());
-    }
-
-    @Test
-    public void syslogDefaults() {
-        initConfig();
-
-        assertConfig(Map.of(
-                "log-syslog-enabled", "false",
-                "log-syslog-endpoint", "localhost:514",
-                "log-syslog-type", "rfc5424",
-                "log-syslog-app-name", "keycloak",
-                "log-syslog-protocol", "tcp",
-                "log-syslog-format", DEFAULT_LOG_FORMAT,
-                "log-syslog-output", DEFAULT_SYSLOG_OUTPUT.toString()
-        ));
-        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
-
-        assertExternalConfig(Map.of(
-                "quarkus.log.syslog.enable", "false",
-                "quarkus.log.syslog.endpoint", "localhost:514",
-                "quarkus.log.syslog.syslog-type", "rfc5424",
-                "quarkus.log.syslog.app-name", "keycloak",
-                "quarkus.log.syslog.protocol", "tcp",
-                "quarkus.log.syslog.format", DEFAULT_LOG_FORMAT,
-                "quarkus.log.syslog.json", "false"
-        ));
-
-        // The default max-length attribute is set in the org.jboss.logmanager.handlers.SyslogHandler if not specified in config
-        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
-    }
-
-    @Test
-    public void syslogDifferentValues() {
-        putEnvVars(Map.of(
-                "KC_LOG", "syslog",
-                "KC_LOG_SYSLOG_ENDPOINT", "192.168.0.42:515",
-                "KC_LOG_SYSLOG_TYPE", "rfc3164",
-                "KC_LOG_SYSLOG_MAX_LENGTH", "4096",
-                "KC_LOG_SYSLOG_APP_NAME", "keycloak2",
-                "KC_LOG_SYSLOG_PROTOCOL", "udp",
-                "KC_LOG_SYSLOG_FORMAT", "some format",
-                "KC_LOG_SYSLOG_OUTPUT", "json"
-        ));
-
-        initConfig();
-
-        assertConfig(Map.of(
-                "log-syslog-enabled", "true",
-                "log-syslog-endpoint", "192.168.0.42:515",
-                "log-syslog-type", "rfc3164",
-                "log-syslog-max-length", "4096",
-                "log-syslog-app-name", "keycloak2",
-                "log-syslog-protocol", "udp",
-                "log-syslog-format", "some format",
-                "log-syslog-output", "json"
-        ));
-
-        assertExternalConfig(Map.of(
-                "quarkus.log.syslog.enable", "true",
-                "quarkus.log.syslog.endpoint", "192.168.0.42:515",
-                "quarkus.log.syslog.syslog-type", "rfc3164",
-                "quarkus.log.syslog.max-length", "4096",
-                "quarkus.log.syslog.app-name", "keycloak2",
-                "quarkus.log.syslog.protocol", "udp",
-                "quarkus.log.syslog.format", "some format",
-                "quarkus.log.syslog.json", "true"
-        ));
-    }
-
-    @Test
-    public void syslogMaxLength() {
-        // RFC3164
-        putEnvVar("KC_LOG_SYSLOG_TYPE", "rfc3164");
-        initConfig();
-
-        assertConfig("log-syslog-type", "rfc3164");
-        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
-        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
-
-        // RFC5424
-        putEnvVar("KC_LOG_SYSLOG_TYPE", "rfc5424");
-        initConfig();
-
-        assertThat(Configuration.getOptionalKcValue(LoggingOptions.LOG_SYSLOG_MAX_LENGTH).orElse(null), CoreMatchers.nullValue());
-        assertThat(Configuration.getOptionalValue("quarkus.log.syslog.max-length").orElse(null), CoreMatchers.nullValue());
-
-        // Specific max-length
-        removeEnvVar("KC_LOG_SYSLOG_TYPE");
-        putEnvVar("KC_LOG_SYSLOG_MAX_LENGTH", "512");
-        initConfig();
-
-        assertConfig("log-syslog-max-length", "512");
-        assertExternalConfig("quarkus.log.syslog.max-length", "512");
-    }
-
-    @Test
-    public void logLevelsHandlers() {
-        putEnvVars(Map.of(
-                "KC_LOG_LEVEL", "debug",
-                "KC_LOG_CONSOLE_LEVEL", "info",
-                "KC_LOG_SYSLOG_LEVEL", "trace",
-                "KC_LOG_FILE_LEVEL", "debug"
-        ));
-
-        initConfig();
-
-        assertConfig(Map.of(
-                "log-level", "debug",
-                "log-console-level", "info",
-                "log-syslog-level", "trace",
-                "log-file-level", "debug"
-        ));
-
-        assertExternalConfig(Map.of(
-                "quarkus.log.level", "DEBUG",
-                "quarkus.log.console.level", "INFO",
-                "quarkus.log.syslog.level", "TRACE",
-                "quarkus.log.file.level", "DEBUG"
-        ));
-    }
-
-    @Test
-    public void logLevelTakesPrecedenceOverCategoryLevel() {
-        ConfigArgsConfigSource.setCliArgs("--log-level=org.keycloak:error");
-        SmallRyeConfig config = createConfig();
-        assertEquals("INFO", config.getConfigValue("quarkus.log.level").getValue());
-        assertEquals("ERROR", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
-
-        ConfigArgsConfigSource.setCliArgs("--log-level=org.keycloak:error", "--log-level-org.keycloak=trace");
-        config = createConfig();
-        assertEquals("INFO", config.getConfigValue("quarkus.log.level").getValue());
-        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
-    }
-
-    @Test
-    public void unknownCategoryLevelIsResolvedFromRootLevel() {
-        ConfigArgsConfigSource.setCliArgs("--log-level=warn,org.keycloak:error", "--log-level-org.keycloak=trace");
-        SmallRyeConfig config = createConfig();
-        assertEquals("WARN", config.getConfigValue("quarkus.log.level").getValue());
-        assertEquals("TRACE", config.getConfigValue("quarkus.log.category.\"org.keycloak\".level").getValue());
-        assertEquals("WARN", config.getConfigValue("quarkus.log.category.\"foo.bar\".level").getValue());
-    }
-}
diff --git a/quarkus/runtime/src/test/resources/META-INF/keycloak.conf b/quarkus/runtime/src/test/resources/META-INF/keycloak.conf
deleted file mode 100644
index f2ee6129cf1a..000000000000
--- a/quarkus/runtime/src/test/resources/META-INF/keycloak.conf
+++ /dev/null
@@ -1,9 +0,0 @@
-spi-hostname-default-frontend-url = ${keycloak.frontendUrl:http://filepropdefault.unittest}
-%user-profile.spi-hostname-default-frontend-url = http://filepropprofile.unittest
-log-level=${SOME_LOG_LEVEL:info}
-log-level-io.k8s=${SOME_CATEGORY_LOG_LEVEL}
-KC_LOG_LEVEL_IO_QUARKUS=trace
-config-keystore=src/test/resources/keystore
-config-keystore-password=secret
-
-quarkus.log.file.path=random/path
\ No newline at end of file
diff --git a/quarkus/runtime/src/test/resources/META-INF/services/quarkus.properties b/quarkus/runtime/src/test/resources/META-INF/services/quarkus.properties
deleted file mode 100644
index 95d0635596bb..000000000000
--- a/quarkus/runtime/src/test/resources/META-INF/services/quarkus.properties
+++ /dev/null
@@ -1,15 +0,0 @@
-# Default options that rely on Quarkus specific options and lacking proper support in Keycloak
-
-# Logging configuration. INFO is the default level for most of the categories
-quarkus.log.min-level=TRACE
-quarkus.log.level = INFO
-quarkus.log.category."org.jboss.resteasy.resteasy_jaxrs.i18n".level=WARN
-quarkus.log.category."org.infinispan.transaction.lookup.JBossStandaloneJTAManagerLookup".level=WARN
-
-# For test nested properties
-quarkus.datasource.foo = jdbc:h2:file:${kc.home.dir:${kc.db.url.path:~}}/data/keycloakdb
-quarkus.datasource.bar = foo-${kc.prop3:${kc.prop4:${kc.prop5:def}-suffix}}
-
-# test multiple datasources db-kind
-quarkus.datasource.dog-store.db-kind=mariadb
-quarkus.datasource.cat-store.db-kind=postgresql
\ No newline at end of file
diff --git a/quarkus/runtime/src/test/resources/conf/keycloak.conf b/quarkus/runtime/src/test/resources/conf/keycloak.conf
new file mode 100644
index 000000000000..c8bd9b1d8ae1
--- /dev/null
+++ b/quarkus/runtime/src/test/resources/conf/keycloak.conf
@@ -0,0 +1,11 @@
+spi-hostname-default-frontend-url = ${keycloak.frontendUrl:http://filepropdefault.unittest}
+log-level=${SOME_LOG_LEVEL:info}
+log-level-io.k8s=${SOME_CATEGORY_LOG_LEVEL}
+KC_LOG_LEVEL_IO_QUARKUS=trace
+config-keystore=src/test/resources/conf/keystore
+config-keystore-password=secret
+
+#quarkus option should not be used
+quarkus.management.ssl.cipher-suites=foo
+
+%nope.proxy-headers=forwarded
\ No newline at end of file
diff --git a/quarkus/runtime/src/test/resources/keystore b/quarkus/runtime/src/test/resources/conf/keystore
similarity index 100%
rename from quarkus/runtime/src/test/resources/keystore
rename to quarkus/runtime/src/test/resources/conf/keystore
diff --git a/quarkus/runtime/src/test/resources/conf/quarkus.properties b/quarkus/runtime/src/test/resources/conf/quarkus.properties
new file mode 100644
index 000000000000..7baeeca7e371
--- /dev/null
+++ b/quarkus/runtime/src/test/resources/conf/quarkus.properties
@@ -0,0 +1,17 @@
+# Default options that rely on Quarkus specific options and lacking proper support in Keycloak
+
+# Logging configuration. INFO is the default level for most of the categories
+quarkus.log.min-level=TRACE
+quarkus.log.level = INFO
+quarkus.log.category."org.jboss.resteasy.resteasy_jaxrs.i18n".level=WARN
+quarkus.log.category."org.infinispan.transaction.lookup.JBossStandaloneJTAManagerLookup".level=WARN
+
+# For test nested properties
+quarkus.datasource.foo = jdbc:h2:file:${kc.home.dir:${kc.db.url.path:~}}/data/keycloakdb
+quarkus.datasource.bar = foo-${kc.prop3:${kc.prop4:${kc.prop5:def}-suffix}}
+
+# test multiple datasources db-kind
+quarkus.datasource.dog-store.db-kind=mariadb
+quarkus.datasource.cat-store.db-kind=postgresql
+
+not.quarkus=value
\ No newline at end of file
diff --git a/quarkus/runtime/src/test/resources/providers/README b/quarkus/runtime/src/test/resources/providers/README
new file mode 100644
index 000000000000..1efa38a04179
--- /dev/null
+++ b/quarkus/runtime/src/test/resources/providers/README
@@ -0,0 +1 @@
+Needed for the directory to not be empty. We could put actual jar files in here to better exercise the config logic.
\ No newline at end of file
diff --git a/quarkus/server/pom.xml b/quarkus/server/pom.xml
index 9a666d5ffe5d..876875b135ac 100644
--- a/quarkus/server/pom.xml
+++ b/quarkus/server/pom.xml
@@ -19,9 +19,11 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-quarkus-server</artifactId>
         </dependency>
+        <!-- Only necessary for proper Maven build order - if explicitly added, deployment JARs will not be part of /lib/deployment folder -->
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-quarkus-server-deployment</artifactId>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
@@ -31,19 +33,6 @@
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
         </dependency>
-        <!-- Necessary for proper execution of IDELauncher -->
-        <!-- Can be removed as part of the https://github.com/keycloak/keycloak/issues/22455 enhancement -->
-        <dependency>
-            <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-vertx-http-dev-ui-resources</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <!-- this dependency is necessary to start the IDELauncher -->
-        <dependency>
-            <groupId>com.oracle.database.jdbc</groupId>
-            <artifactId>ojdbc11</artifactId>
-            <scope>provided</scope>
-        </dependency>
         <dependency>
             <groupId>io.mvnpm</groupId>
             <artifactId>importmap</artifactId>
diff --git a/quarkus/server/src/main/java/org/keycloak/quarkus/_private/IDELauncher.java b/quarkus/server/src/main/java/org/keycloak/quarkus/_private/IDELauncher.java
deleted file mode 100644
index 86d4dcea5a24..000000000000
--- a/quarkus/server/src/main/java/org/keycloak/quarkus/_private/IDELauncher.java
+++ /dev/null
@@ -1,59 +0,0 @@
-package org.keycloak.quarkus._private;
-
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.keycloak.quarkus.runtime.KeycloakMain;
-import org.keycloak.quarkus.runtime.cli.Picocli;
-
-import io.quarkus.runtime.Quarkus;
-
-/**
- * <p>This main class should be used to start the server in dev mode for development purposes. By running this class,
- * developers should be able to mimic any server behavior and configuration as if they were using the CLI.
- *
- * <p>There are some limitations during development such as:
- *
- * <ul>
- *     <li>Transient dependencies from the keycloak server extension (runtime module) are not eligible for hot-reload</li>
- *     <li>Code changes such as changing the structure of classes (e.g.: new/change methods) should still require a JVM restart</li>
- * </ul>
- *
- * <p>Despite the limitations, it should be possible to debug the extension (e.g.: deployment steps) as well as perform changes at runtime
- * without having to restart the JVM.
- *
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class IDELauncher {
-
-    public static void main(String[] args) {
-        if (System.getProperty("java.util.logging.manager") == null) {
-            System.setProperty("java.util.logging.manager", "org.jboss.logmanager.LogManager");
-        }
-
-        if (System.getProperty("picocli.disable.closures") == null) {
-            System.setProperty("picocli.disable.closures", "true");
-        }
-
-        if (System.getProperty("java.util.concurrent.ForkJoinPool.common.threadFactory") == null) {
-            System.setProperty("java.util.concurrent.ForkJoinPool.common.threadFactory", "io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory");
-        }
-
-        List<String> devArgs = new ArrayList<>(Picocli.parseArgs(args));
-
-        if (System.getProperty("kc.home.dir") == null) {
-            // direct the auto-created files to the target folder, so they are cleaned by "mvn clean"
-            // users can still provide a different folder by setting the property when starting it from their IDE.
-            Path path = Paths.get(System.getProperty("user.dir"), "target", "kc");
-            System.setProperty("kc.home.dir", path.toAbsolutePath().toString());
-        }
-
-        if (devArgs.isEmpty()) {
-            devArgs.add("start-dev");
-        }
-
-        Quarkus.run(KeycloakMain.class, devArgs.toArray(new String[devArgs.size()]));
-    }
-}
diff --git a/quarkus/tests/integration/pom.xml b/quarkus/tests/integration/pom.xml
index cf576b50efb0..88708fda875d 100644
--- a/quarkus/tests/integration/pom.xml
+++ b/quarkus/tests/integration/pom.xml
@@ -89,7 +89,7 @@
         </dependency>
         <dependency>
             <groupId>com.oracle.database.jdbc</groupId>
-            <artifactId>ojdbc11</artifactId>
+            <artifactId>ojdbc17</artifactId>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/quarkus/tests/integration/src/test-providers/java/org/keycloak/it/resource/realm/TestRealmResource.java b/quarkus/tests/integration/src/test-providers/java/org/keycloak/it/resource/realm/TestRealmResource.java
index d21228ca0eb4..ecd6b0e1ba9d 100644
--- a/quarkus/tests/integration/src/test-providers/java/org/keycloak/it/resource/realm/TestRealmResource.java
+++ b/quarkus/tests/integration/src/test-providers/java/org/keycloak/it/resource/realm/TestRealmResource.java
@@ -40,8 +40,10 @@ public class TestRealmResource implements RealmResourceProvider {
     protected static final Logger logger = Logger.getLogger(TestRealmResource.class);
 
     final InfinispanConnectionProvider infinispanConnectionProvider;
+    final KeycloakSession session;
 
     public TestRealmResource(KeycloakSession session) {
+        this.session = session;
         this.infinispanConnectionProvider = session.getProvider(InfinispanConnectionProvider.class);
     }
 
@@ -50,6 +52,16 @@ public Object getResource() {
         return this;
     }
 
+    @Path("trusted")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response trustedResponse() throws Exception {
+        if (session.getContext().getHttpRequest().isProxyTrusted()) {
+            return Response.ok("{}", MediaType.APPLICATION_JSON).build();
+        }
+        return Response.noContent().build();
+    }
+
     @Path("slow")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
@@ -66,8 +78,9 @@ public Response slowResource() throws Exception {
     @Produces(MediaType.APPLICATION_JSON)
     public Response cacheConfig(@PathParam("cache") String cacheName) {
         Cache<?, ?> cache = infinispanConnectionProvider.getCache(cacheName, false);
-        if (cache == null)
+        if (cache == null) {
             return Response.status(Response.Status.NOT_FOUND).build();
+        }
 
         StringBuilderWriter out = new StringBuilderWriter();
         try (ConfigurationWriter writer = ConfigurationWriter.to(out)
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BootstrapAdminDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BootstrapAdminDistTest.java
index 1fdad54dc139..b65cca723e75 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BootstrapAdminDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BootstrapAdminDistTest.java
@@ -63,7 +63,7 @@ void failEnvNotSet(LaunchResult result) {
     void createAdmin(LaunchResult result) {
         assertTrue(result.getErrorOutput().isEmpty(), result.getErrorOutput());
     }
-    
+
     @Test
     @Launch({ "start-dev", "--bootstrap-admin-password=MY_PASSWORD" })
     void createAdminWithCliOptions(LaunchResult result) {
@@ -94,12 +94,12 @@ void createAndUseSericeAccountAdmin(KeycloakDistribution dist) throws Exception
         assertTrue(result.getErrorOutput().isEmpty(), result.getErrorOutput());
 
         rawDist.setManualStop(true);
-        rawDist.run("start-dev", "--log-level=debug");
+        rawDist.run("start-dev");
 
         CLIResult adminResult = rawDist.kcadm("get", "clients", "--server", "http://localhost:8080", "--realm", "master", "--client", "admin", "--secret", "admin123");
-        
+
         assertEquals(0, adminResult.exitCode());
         assertTrue(adminResult.getOutput().contains("clientId"));
     }
-    
+
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BuildAndStartDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BuildAndStartDistTest.java
index 29907a834a16..4e908278759a 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BuildAndStartDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/BuildAndStartDistTest.java
@@ -61,7 +61,7 @@ void testBuildAndStart(KeycloakDistribution dist) {
         cliResult.assertBuild();
         cliResult = rawDist.run("start", OPTIMIZED_BUILD_OPTION_LONG);
         cliResult.assertNoBuild();
-        assertTrue(cliResult.getErrorOutput().isBlank());
+        assertTrue(cliResult.getErrorOutput().isBlank(), cliResult.getErrorOutput());
         // running start without optimized flag should not cause a build
         cliResult = rawDist.run("start");
         cliResult.assertNoBuild();
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/CacheEmbeddedMtlsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/CacheEmbeddedMtlsDistTest.java
new file mode 100644
index 000000000000..137d3cc23f91
--- /dev/null
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/CacheEmbeddedMtlsDistTest.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.it.cli.dist;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Arrays;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.config.CachingOptions;
+import org.keycloak.config.Option;
+import org.keycloak.it.junit5.extension.DistributionTest;
+import org.keycloak.it.junit5.extension.DryRun;
+import org.keycloak.it.junit5.extension.RawDistOnly;
+import org.keycloak.it.utils.KeycloakDistribution;
+
+@DistributionTest
+public class CacheEmbeddedMtlsDistTest {
+
+    @DryRun
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    public void testCacheEmbeddedMtlsDisabled(KeycloakDistribution dist) {
+        for (var option : Arrays.asList(
+                CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE,
+                CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE,
+                CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD,
+                CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD,
+                CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION
+        )) {
+            var result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=false", "--%s=1".formatted(option.getKey()));
+            result.assertError("Disabled option: '--%s'. Available only when property 'cache-embedded-mtls-enabled' is enabled".formatted(option.getKey()));
+        }
+    }
+
+    @DryRun
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    public void testCacheEmbeddedMtlsFileValidation(KeycloakDistribution dist) {
+        doFileAndPasswordValidation(dist, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE, CachingOptions.CACHE_EMBEDDED_MTLS_KEYSTORE_PASSWORD);
+        doFileAndPasswordValidation(dist, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE, CachingOptions.CACHE_EMBEDDED_MTLS_TRUSTSTORE_PASSWORD);
+    }
+
+    @DryRun
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    public void testCacheEmbeddedMtlsFileExistsValidation(KeycloakDistribution dist) throws IOException {
+        var result = dist.run(
+              "start-dev",
+              "--cache=ispn",
+              "--cache-embedded-mtls-enabled=true",
+              "--cache-embedded-mtls-key-store-file=keystore.p12",
+              "--cache-embedded-mtls-key-store-password=password",
+              "--cache-embedded-mtls-trust-store-file=truststore.p12",
+              "--cache-embedded-mtls-trust-store-password=password"
+              );
+        result.assertError("The 'cache-embedded-mtls-key-store-file' file 'keystore.p12' does not exist");
+
+        File keystore = Util.createTempFile("key", ".p12");
+        result = dist.run(
+              "start-dev",
+              "--cache=ispn",
+              "--cache-embedded-mtls-enabled=true",
+              "--cache-embedded-mtls-key-store-file=%s".formatted(keystore.getAbsolutePath()),
+              "--cache-embedded-mtls-key-store-password=password",
+              "--cache-embedded-mtls-trust-store-file=truststore.p12",
+              "--cache-embedded-mtls-trust-store-password=password"
+        );
+        result.assertError("The 'cache-embedded-mtls-trust-store-file' file 'truststore.p12' does not exist");
+    }
+
+    @DryRun
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    public void testCacheEmbeddedMtlsValidation(KeycloakDistribution dist) {
+        var key = CachingOptions.CACHE_EMBEDDED_MTLS_ROTATION.getKey();
+        // test zero
+        var result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true", "--%s=0".formatted(key));
+        result.assertError("JGroups MTLS certificate rotation in '%s' option must positive.".formatted(key));
+
+        // test negative
+        result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true", "--%s=-1".formatted(key));
+        result.assertError("JGroups MTLS certificate rotation in '%s' option must positive.".formatted(key));
+
+        // test blank
+        result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true", "--%s=".formatted(key));
+        result.assertError("Invalid value for option '--%s': '' is not an int".formatted(key));
+    }
+
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    public void testCacheEmbeddedMtlsEnabled(KeycloakDistribution dist) {
+        var result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true");
+        result.assertMessage("JGroups JDBC_PING discovery enabled.");
+        result.assertMessage("JGroups Encryption enabled (mTLS).");
+    }
+
+    private void doFileAndPasswordValidation(KeycloakDistribution dist, Option<String> fileOption, Option<String> passwordOption) {
+        var result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true", "--%s=file".formatted(fileOption.getKey()));
+        result.assertError("The option '%s' requires '%s' to be enabled.".formatted(fileOption.getKey(), passwordOption.getKey()));
+
+        result = dist.run("start-dev", "--cache=ispn", "--cache-embedded-mtls-enabled=true", "--%s=secret".formatted(passwordOption.getKey()));
+        result.assertError("The option '%s' requires '%s' to be enabled.".formatted(passwordOption.getKey(), fileOption.getKey()));
+    }
+}
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ClusterConfigDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ClusterConfigDistTest.java
index 93d47fa32a4e..1b5f9fff099d 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ClusterConfigDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ClusterConfigDistTest.java
@@ -47,6 +47,47 @@ void changeClusterSetting(CLIResult result) {
         result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
     }
 
+    @Test
+    @Launch({ "start-dev", "--cache=ispn", "--cache-embedded-network-bind-address=127.0.0.1","--cache-embedded-network-bind-port=7801", "--cache-embedded-network-external-address=127.0.0.2", "--cache-embedded-network-external-port=7802"})
+    void changeBindAndExternalAddress(CLIResult result) {
+        result.assertClusteredCache();
+        result.assertMessage("physical addresses are `[127.0.0.2:7802]`");
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
+    }
+
+    @Test
+    @Launch({ "start-dev", "--cache=ispn", "--cache-embedded-network-bind-address=127.0.0.1", "-Djgroups.bind.address=127.0.0.2", "-Djgroups.bind_addr=127.0.0.3"})
+    void testJGroupsBindAddressPropertyAlsoExists(CLIResult result) {
+        result.assertClusteredCache();
+        result.assertMessage("Conflicting system property 'jgroups.bind.address' and CLI arg 'cache-embedded-network-bind-address' set, utilising CLI value '127.0.0.1'");
+        result.assertMessage("Conflicting system property 'jgroups.bind_addr' and CLI arg 'cache-embedded-network-bind-address' set, utilising CLI value '127.0.0.1'");
+        result.assertMessage("physical addresses are `[127.0.0.1:7800]`");
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
+    }
+
+    @Test
+    @Launch({ "start-dev", "--cache=ispn", "-Djgroups.bind.address=127.0.0.2", "-Djgroups.bind.port=7801"})
+    void testJGroupsBindAddressProperty(CLIResult result) {
+        result.assertClusteredCache();
+        result.assertMessage("physical addresses are `[127.0.0.2:7801]`");
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
+    }
+
+    @Test
+    @Launch({ "start-dev", "--cache=ispn", "--cache-embedded-network-bind-address=match-address:127.0.0.*"})
+    void testBindSiteMatches(CLIResult result) {
+        result.assertClusteredCache();
+        result.assertMessage("physical addresses are `[127.0.0.");
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
+    }
+
+    @Test
+    @Launch({ "start-dev", "--cache=ispn", "--cache-embedded-network-bind-address=SITE_LOCAL"})
+    void testBindSiteLocal(CLIResult result) {
+        result.assertClusteredCache();
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`");
+    }
+
     @Test
     @Launch({ "start-dev", "--cache=ispn", "--cache-stack=jdbc-ping-udp"})
     void testJdbcPingTCP(CLIResult result) {
@@ -63,7 +104,7 @@ void warnDeprecatedCloudStack(CLIResult result) {
     @Test
     @Launch({ "start-dev", "--cache-config-file=invalid" })
     void failInvalidClusterConfig(CLIResult result) {
-        result.assertError("ERROR: Could not load cluster configuration file");
+        result.assertError("Cache config file 'invalid' does not exist in the conf directory");
     }
 
     @Test
@@ -117,6 +158,13 @@ void testCustomCacheStackInConfigFile(CLIResult result) {
         result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `encrypt-udp`");
     }
 
+    @Test
+    @BeforeStartDistribution(ConfigureCacheUsingAsyncEncryption.class)
+    @Launch({"start", "--cache-config-file=cache-ispn-asym-enc.xml", "--http-enabled=true", "--hostname-strict=false", "--cache-embedded-mtls-enabled=false"})
+    void testCustomCacheStackInConfigFileNotDev(CLIResult result) {
+        result.assertMessage("ISPN000078: Starting JGroups channel `ISPN` with stack `encrypt-udp`");
+    }
+
     public static class ConfigureCacheUsingAsyncEncryption implements Consumer<KeycloakDistribution> {
 
         @Override
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ExportDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ExportDistTest.java
index bcfe7ed92cd5..3997a471e142 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ExportDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ExportDistTest.java
@@ -17,12 +17,17 @@
 
 package org.keycloak.it.cli.dist;
 
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.file.Path;
+
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.keycloak.it.junit5.extension.CLIResult;
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.RawDistOnly;
 import org.keycloak.it.utils.KeycloakDistribution;
+import org.keycloak.it.utils.RawKeycloakDistribution;
 
 @RawDistOnly(reason = "Containers are immutable")
 @DistributionTest(defaultOptions = "--db=dev-file")
@@ -53,4 +58,17 @@ void testExport(KeycloakDistribution dist) {
         cliResult.assertMessage("Realm 'master' - data exported");
 
     }
+
+    @Test
+    void testExportRealmFGAPEnabled(KeycloakDistribution dist) {
+        RawKeycloakDistribution rawDist = dist.unwrap(RawKeycloakDistribution.class);
+        Path importDir = rawDist.getDistPath().resolve("data").resolve("import");
+        assertTrue(importDir.toFile().mkdirs());
+        dist.copyOrReplaceFileFromClasspath("/fgap-realm.json", importDir.resolve("fgap-realm.json"));
+        rawDist.run("start-dev","-v", "--import-realm", "--features=admin-fine-grained-authz:v2");
+        rawDist.stop();
+        CLIResult cliResult = rawDist.run("export", "--realm=fgap", "--dir=" + importDir.toAbsolutePath(), "--features=admin-fine-grained-authz:v2");
+        cliResult.assertMessage("Export of realm 'fgap' requested.");
+        cliResult.assertMessage("Export finished successfully");
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FeaturesDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FeaturesDistTest.java
index 48786ae6855c..a93f0913b12c 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FeaturesDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FeaturesDistTest.java
@@ -17,6 +17,7 @@
 import org.keycloak.quarkus.runtime.cli.command.StartDev;
 
 import java.util.Arrays;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 import static org.hamcrest.CoreMatchers.containsString;
@@ -31,6 +32,11 @@ public class FeaturesDistTest {
 
     private static final String PREVIEW_FEATURES_EXPECTED_LOG = "Preview features enabled: " + Arrays.stream(Profile.Feature.values())
             .filter(feature -> feature.getType() == Profile.Feature.Type.PREVIEW)
+            .filter(feature -> {
+                Set<Profile.Feature> versions = Profile.getFeatureVersions(feature.getUnversionedKey());
+                if (versions.size() == 1) return true;
+                return versions.iterator().next().getVersion() == feature.getVersion();
+            })
             .map(Profile.Feature::getVersionedKey)
             .sorted()
             .collect(Collectors.joining(", "));
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java
index 76ccb91d0649..76aac0de43ea 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java
@@ -29,7 +29,6 @@
 import org.keycloak.it.utils.RawKeycloakDistribution;
 
 import io.quarkus.test.junit.main.Launch;
-import io.quarkus.test.junit.main.LaunchResult;
 
 @DistributionTest(keepAlive = true, defaultOptions = { "--db=dev-file", "--features=fips", "--http-enabled=true", "--hostname-strict=false", "--log-level=org.keycloak.common.crypto.CryptoIntegration:trace" })
 @RawDistOnly(reason = "Containers are immutable")
@@ -149,8 +148,7 @@ void testHttpsPkcs12TrustStoreInNonApprovedMode(KeycloakDistribution dist) {
 
             CLIResult cliResult = dist.run("--verbose", "start", "--fips-mode=non-strict", "--https-key-store-password=passwordpassword",
                     "--https-trust-store-file=" + truststorePath, "--https-trust-store-password=passwordpassword");
-            cliResult.assertError("Unable to determine 'https-trust-store-type' automatically. Adjust the file extension or specify the property.");
-
+            cliResult.assertMessage("Unable to determine 'https-trust-store-type' automatically. Adjust the file extension or specify the property.");
             dist.stop();
 
             dist.copyOrReplaceFileFromClasspath("/server.keystore.pkcs12", Path.of("conf", "server.p12"));
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HelpCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HelpCommandDistTest.java
index c90bfa2f28d9..73d1ffbb2bf1 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HelpCommandDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HelpCommandDistTest.java
@@ -35,6 +35,9 @@
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.RawDistOnly;
 import org.keycloak.it.utils.KeycloakDistribution;
+import org.keycloak.quarkus.runtime.cli.command.BootstrapAdmin;
+import org.keycloak.quarkus.runtime.cli.command.BootstrapAdminService;
+import org.keycloak.quarkus.runtime.cli.command.BootstrapAdminUser;
 import org.keycloak.quarkus.runtime.cli.command.Build;
 import org.keycloak.quarkus.runtime.cli.command.Export;
 import org.keycloak.quarkus.runtime.cli.command.Import;
@@ -42,6 +45,9 @@
 import org.keycloak.quarkus.runtime.cli.command.StartDev;
 
 import io.quarkus.test.junit.main.Launch;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibility;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibilityCheck;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibilityMetadata;
 
 @DistributionTest
 @RawDistOnly(reason = "Verifying the help message output doesn't need long spin-up of docker dist tests.")
@@ -133,6 +139,54 @@ void testImportHelpAll(CLIResult cliResult) {
         assertHelp(cliResult);
     }
 
+    @Test
+    @Launch({ BootstrapAdmin.NAME, "--help" })
+    void testBootstrapAdmin(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ BootstrapAdmin.NAME, BootstrapAdminUser.NAME, "--help" })
+    void testBootstrapAdminUser(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ BootstrapAdmin.NAME, BootstrapAdminService.NAME, "--help" })
+    void testBootstrapAdminService(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ UpdateCompatibility.NAME, "--help" })
+    void testUpdateCompatibilityHelp(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ UpdateCompatibility.NAME, UpdateCompatibilityMetadata.NAME, "--help" })
+    void testUpdateCompatibilityMetadataHelp(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ UpdateCompatibility.NAME, UpdateCompatibilityMetadata.NAME, "--help-all" })
+    void testUpdateCompatibilityMetadataHelpAll(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, "--help" })
+    void testUpdateCompatibilityCheckHelp(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
+    @Test
+    @Launch({ UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, "--help-all" })
+    void testUpdateCompatibilityCheckHelpAll(CLIResult cliResult) {
+        assertHelp(cliResult);
+    }
+
     @Test
     public void testHelpDoesNotStartReAugJvm(KeycloakDistribution dist) {
         for (String helpCmd : List.of("-h", "--help", "--help-all")) {
@@ -157,7 +211,7 @@ private void assertHelp(CLIResult cliResult) {
         // normalize the output to prevent changes around the feature toggles or events to mark the output to differ
         String output = cliResult.getOutput()
                 .replaceAll("((Disables|Enables) a set of one or more features. Possible values are: )[^.]{30,}", "$1<...>")
-                .replaceAll("(create a metric. Possible values are:)[^.]{30,}.(Available|only|when|user|event|metrics|are|enabled.| )*", "$1<...>");
+                .replaceAll("(create a metric.\\s+Possible values are:)[^.]{30,}.(Available|only|when|user|event|metrics|are|enabled.| )*", "$1<...>");
 
         String osName = System.getProperty("os.name");
         if(osName.toLowerCase(Locale.ROOT).contains("windows")) {
@@ -171,7 +225,7 @@ private void assertHelp(CLIResult cliResult) {
 
         try {
             Approvals.verify(output);
-        } catch (AssertionError cause) {
+        } catch (Error cause) {
             if ("true".equals(System.getenv(REPLACE_EXPECTED))) {
                 try {
                     FileUtils.write(Approvals.createApprovalNamer().getApprovedFile(".txt"), output,
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HttpDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HttpDistTest.java
index dfbb056d22f7..f5a52ac82101 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HttpDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HttpDistTest.java
@@ -17,13 +17,17 @@
 
 package org.keycloak.it.cli.dist;
 
+import io.quarkus.test.junit.main.Launch;
 import org.junit.jupiter.api.Test;
+import org.keycloak.it.junit5.extension.CLIResult;
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.RawDistOnly;
 import org.keycloak.it.junit5.extension.TestProvider;
 import org.keycloak.it.resource.realm.TestRealmResourceTestProvider;
 import org.keycloak.it.utils.KeycloakDistribution;
+import org.keycloak.it.utils.RawKeycloakDistribution;
 
+import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.CompletableFuture;
@@ -31,12 +35,8 @@
 import static io.restassured.RestAssured.when;
 import static org.hamcrest.CoreMatchers.hasItem;
 import static org.hamcrest.CoreMatchers.not;
-import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
 
-import io.quarkus.test.junit.main.Launch;
-import io.quarkus.test.junit.main.LaunchResult;
-
 /**
  * @author Vaclav Muzikar <vmuzikar@redhat.com>
  */
@@ -62,7 +62,30 @@ public void maxQueuedRequestsTest(KeycloakDistribution dist) {
     
     @Test
     @Launch({"start-dev", "--https-certificates-reload-period=wrong"})
-    public void testHttpCertificateReloadPeriod(LaunchResult result) {
-        assertThat(result.getErrorOutput(), containsString("Text cannot be parsed to a Duration"));
+    public void testHttpCertificateReloadPeriod(CLIResult result) {
+        result.assertError("Text cannot be parsed to a Duration");
+    }
+
+    @Test
+    public void httpStoreTypeValidation(KeycloakDistribution dist) {
+        CLIResult result = dist.run("start", "--https-key-store-file=not-there.ks", "--hostname-strict=false");
+        result.assertExitCode(-1);
+        result.assertMessage("ERROR: Unable to determine 'https-key-store-type' automatically. Adjust the file extension or specify the property");
+
+        result = dist.run("start", "--https-trust-store-file=not-there.ks", "--hostname-strict=false");
+        result.assertExitCode(-1);
+        result.assertMessage("ERROR: Unable to determine 'https-trust-store-type' automatically. Adjust the file extension or specify the property");
+
+        result = dist.run("start", "--https-key-store-file=not-there.ks", "--hostname-strict=false", "--https-key-store-type=jdk");
+        result.assertExitCode(-1);
+        result.assertMessage("ERROR: Failed to load 'https-trust-store' or 'https-key-' material: NoSuchFileException not-there.ks");
+
+        dist.copyOrReplaceFileFromClasspath("/server.keystore.pkcs12", Path.of("conf", "server.p12"));
+        RawKeycloakDistribution rawDist = dist.unwrap(RawKeycloakDistribution.class);
+        Path truststorePath = rawDist.getDistPath().resolve("conf").resolve("server.p12").toAbsolutePath();
+
+        result = dist.run("start", "--https-trust-store-file=" + truststorePath, "--hostname-strict=false");
+        result.assertExitCode(-1);
+        result.assertMessage("ERROR: No trust store password provided");
     }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java
index 93b2eb5582b8..7699dd7ae0ca 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java
@@ -18,7 +18,13 @@
 package org.keycloak.it.cli.dist;
 
 import java.io.File;
+import java.io.FileWriter;
 import java.io.IOException;
+import java.util.UUID;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
 
 import org.junit.jupiter.api.MethodOrderer;
 import org.junit.jupiter.api.Tag;
@@ -65,4 +71,54 @@ void testImport(KeycloakDistribution dist) throws IOException {
         cliResult = dist.run("import");
         cliResult.assertError("Must specify either --dir or --file options.");
     }
+
+    @Test
+    void testImportLargeUserCount(KeycloakDistribution dist) throws Exception {
+        File dir = new File("target");
+
+        CLIResult cliResult = dist.run("export", "--realm=master", "--dir=" + dir.getAbsolutePath());
+        cliResult.assertMessage("Export of realm 'master' requested.");
+        cliResult.assertMessage("Export finished successfully");
+
+        createUserFile(dir.getAbsolutePath());
+
+        ExecutorService ex = Executors.newFixedThreadPool(1);
+        Future<CLIResult> result = ex.submit(() -> dist.run("import", "--dir=" + dir.getAbsolutePath()));
+        try {
+            cliResult = result.get(20, TimeUnit.SECONDS);
+            cliResult.assertMessage("Realm 'master' imported");
+            cliResult.assertMessage("Import finished successfully");
+            cliResult.assertMessage("master-users-0.json");
+        } finally {
+            ex.shutdownNow();
+        }
+    }
+
+    void createUserFile(String dir) throws IOException {
+        FileWriter writer = new FileWriter(dir + "/master-users-0.json");
+        writer.write("{\n" + "  \"realm\" : \"master\",\n" + "  \"users\" : [\n");
+
+        for (int i = 0; i < 10000; i++) {
+            if (i > 0) {
+                writer.write("\n,");
+            }
+            writer.write("{\n"
+                    + "    \"id\" : \""+UUID.randomUUID()+"\",\n"
+                    + "    \"username\" : \"bob"+i+"\",\n"
+                    + "    \"emailVerified\" : false,\n"
+                    + "    \"createdTimestamp\" : 1741358612691,\n"
+                    + "    \"enabled\" : true,\n"
+                    + "    \"totp\" : false,\n"
+                    + "    \"credentials\" : [ ],\n"
+                    + "    \"disableableCredentialTypes\" : [ ],\n"
+                    + "    \"requiredActions\" : [ ],\n"
+                    + "    \"realmRoles\" : [ ],\n"
+                    + "    \"notBefore\" : 0,\n"
+                    + "    \"groups\" : [ ]\n"
+                    + "  }");
+        }
+
+        writer.write(" ]\n" + "}");
+        writer.close();
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/JavaOptsScriptTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/JavaOptsScriptTest.java
index 9fc28421a933..79f36ce540c3 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/JavaOptsScriptTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/JavaOptsScriptTest.java
@@ -129,7 +129,7 @@ void testPicocliClosuresDisabled(LaunchResult result) {
     void testKcHomeDirPathFormat(LaunchResult result) {
         String output = result.getOutput();
         assertThat(output, containsString("kc.home.dir="));
-        assertThat(output, matchesPattern("(?s).*kc\\.home\\.dir=\"[A-Z]:/.*?/keycloak/quarkus/tests/integration/target/kc-tests/keycloak-\\d+\\.\\d+\\.\\d+.*?/bin/\\.\\.\".*"));
+        assertThat(output, matchesPattern("(?s).*kc\\.home\\.dir=\"[A-Z]:/.*/target/kc-tests/keycloak-\\d+\\.\\d+\\.\\d+.*?/bin/\\.\\.\".*"));
     }
 
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/LoggingDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/LoggingDistTest.java
index bb39dce9597c..bfdfcf335116 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/LoggingDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/LoggingDistTest.java
@@ -31,6 +31,7 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 
+import org.hamcrest.CoreMatchers;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.keycloak.config.LoggingOptions;
@@ -41,6 +42,7 @@
 import org.keycloak.it.utils.KeycloakDistribution;
 import org.keycloak.it.utils.RawDistRootPath;
 import org.keycloak.it.utils.RawKeycloakDistribution;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.testcontainers.shaded.org.apache.commons.io.FileUtils;
 
 import io.quarkus.deployment.util.FileUtil;
@@ -245,6 +247,25 @@ void categoryLogLevel(CLIResult cliResult) {
         assertThat(output, not(containsString("INFO  [io.quarkus")));
     }
 
+    @Test
+    @Launch({"start-dev", "--log=console,file", "--log-console-output=json", "--log-console-json-format=ecs", "--log-file-output=json", "--log-file-json-format=ecs"})
+    void ecsFormat(CLIResult cliResult, RawDistRootPath path) {
+        var output = cliResult.getOutput();
+
+        assertThat(output, containsString("ecs.version"));
+        assertThat(output, containsString("@timestamp"));
+
+        String data = readDefaultFileLog(path);
+        assertThat(data, containsString("ecs.version"));
+        assertThat(data, containsString("@timestamp"));
+    }
+
+    @Test
+    @Launch({"start-dev", "--log-async=true"})
+    void asyncLogging(CLIResult cliResult) {
+        cliResult.assertStartedDevMode();
+    }
+
     protected static String readDefaultFileLog(RawDistRootPath path) {
         Path logFilePath = Paths.get(path.getDistRootPath() + File.separator + LoggingOptions.DEFAULT_LOG_PATH);
         File logFile = new File(logFilePath.toString());
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ManagementHttpsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ManagementHttpsDistTest.java
index 1562c0140531..c5ec68bb0afb 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ManagementHttpsDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ManagementHttpsDistTest.java
@@ -62,4 +62,25 @@ public void simpleHttpsStartDev(LaunchResult result) {
         when().get(url + "/metrics").then()
                 .statusCode(200);
     }
+
+    @Test
+    @Launch({"start-dev", "--http-management-scheme=http"})
+    public void simpleHttpStartDev(LaunchResult result) {
+        CLIResult cliResult = (CLIResult) result;
+        var url = "http://localhost:9000";
+        cliResult.assertMessage("Management interface listening on http://0.0.0.0:9000");
+
+        when().get(url).then()
+                .statusCode(200)
+                .and()
+                .body(is("Keycloak Management Interface"));
+        when().get(url + "/health").then()
+                .statusCode(200);
+        when().get(url + "/health/live").then()
+                .statusCode(200);
+        when().get(url + "/health/ready").then()
+                .statusCode(200);
+        when().get(url + "/metrics").then()
+                .statusCode(200);
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/MetricsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/MetricsDistTest.java
index 986534e2852d..68ff32f68b7c 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/MetricsDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/MetricsDistTest.java
@@ -20,6 +20,7 @@
 import static io.restassured.RestAssured.given;
 import static io.restassured.RestAssured.when;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.matchesPattern;
 import static org.hamcrest.Matchers.not;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
@@ -30,6 +31,7 @@
 
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
+import org.keycloak.it.junit5.extension.CLIResult;
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.utils.KeycloakDistribution;
 
@@ -57,7 +59,10 @@ void testMetricsEndpointNotEnabled(KeycloakDistribution distribution) {
 
     @Test
     @Launch({ "start-dev", "--metrics-enabled=true" })
-    void testMetricsEndpoint() {
+    void testMetricsEndpoint(CLIResult cliResult) {
+        // See https://github.com/keycloak/keycloak/issues/36927
+        cliResult.assertNoMessage("A MeterFilter is being configured after a Meter has been registered to this registry.");
+
         // Send one request to populate some of the HTTP metrics that are not available on an instance on startup
         when().get("/metrics").then()
                 .statusCode(200);
@@ -126,6 +131,21 @@ void testMetricsEndpointWithCacheMetricsHistograms() {
 
     }
 
+    @Test
+    @Launch({ "start-dev", "--metrics-enabled=true", "--tracing-enabled=true" })
+    void testMetricsEndpointWithCacheMetricsHistogramsAndExemplars(KeycloakDistribution distribution) {
+        runClientCredentialGrantWithUnknownClientId(distribution);
+
+        distribution.setRequestPort(9000);
+        // Exemplars are only present when metrics and traces are enabled
+        given().accept("application/openmetrics-text; version=1.0.0; charset=utf-8");
+        when().get("/metrics").then()
+                .statusCode(200)
+                // http_server_requests_seconds_count{method="GET",outcome="CLIENT_ERROR",status="404",uri="NOT_FOUND"} 7.0 # {span_id="59fb88a687095d04",trace_id="a4d15d4deaa6f6ee7ac2da092f292925"} 1.0 1743780073.651
+                .body(matchesPattern("(?s).*http_server_requests_seconds_count.*,trace_id=.*"));
+
+    }
+
     @Test
     @Launch({ "start-dev", "--metrics-enabled=true", "--features=user-event-metrics", "--event-metrics-user-enabled=true" })
     void testMetricsEndpointWithUserEventMetrics(KeycloakDistribution distribution) {
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/OptionsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/OptionsDistTest.java
index 43d773ff95d8..940dde7c3655 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/OptionsDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/OptionsDistTest.java
@@ -20,8 +20,6 @@
 import java.nio.file.Paths;
 
 import io.quarkus.test.junit.main.Launch;
-import io.quarkus.test.junit.main.LaunchResult;
-import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.MethodOrderer;
 import org.junit.jupiter.api.Order;
 import org.junit.jupiter.api.Test;
@@ -33,8 +31,6 @@
 import org.keycloak.it.junit5.extension.WithEnvVars;
 import org.keycloak.it.utils.KeycloakDistribution;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.keycloak.quarkus.runtime.cli.command.Main.CONFIG_FILE_LONG_NAME;
 
 @DistributionTest
@@ -45,44 +41,44 @@ public class OptionsDistTest {
     @Test
     @Order(1)
     @Launch({"build", "--db=invalid"})
-    public void failInvalidOptionValue(LaunchResult result) {
-        Assertions.assertTrue(result.getErrorOutput().contains("Invalid value for option '--db': invalid. Expected values are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres"));
+    public void failInvalidOptionValue(CLIResult result) {
+        result.assertError("Invalid value for option '--db': invalid. Expected values are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres");
     }
 
     @DryRun
     @Test
     @Order(2)
     @Launch({"start", "--db=dev-file", "--test=invalid"})
-    public void testServerDoesNotStartIfValidationFailDuringReAugStart(LaunchResult result) {
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Unknown option: '--test'")).count());
+    public void testServerDoesNotStartIfValidationFailDuringReAugStart(CLIResult result) {
+        result.assertError("Unknown option: '--test'");
     }
 
     @DryRun
     @Test
     @Order(3)
     @Launch({"start", "--db=dev-file", "--log=console", "--log-file-output=json", "--http-enabled=true", "--hostname-strict=false"})
-    public void testServerDoesNotStartIfDisabledFileLogOption(LaunchResult result) {
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Disabled option: '--log-file-output'. Available only when File log handler is activated")).count());
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Possible solutions: --log, --log-console-output, --log-console-level, --log-console-format, --log-console-color, --log-level")).count());
+    public void testServerDoesNotStartIfDisabledFileLogOption(CLIResult result) {
+        result.assertError("Disabled option: '--log-file-output'. Available only when File log handler is activated");
+        result.assertError("--log, --log-async, --log-console-output, --log-console-level, --log-console-format, --log-console-color, --log-console-async, --log-level, --log-level-<category>");
     }
 
     @DryRun
     @Test
     @Order(4)
     @Launch({"start", "--db=dev-file", "--log=file", "--log-file-output=json", "--http-enabled=true", "--hostname-strict=false"})
-    public void testServerStartIfEnabledFileLogOption(LaunchResult result) {
-        assertEquals(0, result.getErrorStream().stream().filter(s -> s.contains("Disabled option: '--log-file-output'. Available only when File log handler is activated")).count());
+    public void testServerStartIfEnabledFileLogOption(CLIResult result) {
+        result.assertNoError("Disabled option: '--log-file-output'. Available only when File log handler is activated");
     }
 
     @Test
     @Order(5)
-    @WithEnvVars({"KC_LOG", "console", "KC_LOG_CONSOLE_COLOR", "true", "KC_LOG_FILE", "something-env", "KC_HTTP_ENABLED", "true", "KC_HOSTNAME_STRICT", "false"})
+    @WithEnvVars({"KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__EXPECT_CONTINUE_ENABLED", "true", "KC_LOG", "console", "KC_LOG_FILE", "something-env", "KC_HTTP_ENABLED", "true", "KC_HOSTNAME_STRICT", "false"})
     @Launch({"start", "--db=dev-file"})
     public void testSettingEnvVars(CLIResult cliResult) {
         cliResult.assertMessage("The following used run time options are UNAVAILABLE and will be ignored during build time:");
         cliResult.assertMessage("- log-file: Available only when File log handler is activated.");
-        cliResult.assertMessage("quarkus.log.console.color");
-        cliResult.assertMessage("config property is deprecated and should not be used anymore");
+        cliResult.assertNoMessage("kc.spi-connections-http-client"); // no info/warning expected
+        cliResult.assertStarted();
     }
 
     @DryRun
@@ -101,55 +97,48 @@ public void testExpressionsInConfigFile(KeycloakDistribution distribution) {
         result.assertMessage("- log-syslog-app-name: Available only when Syslog is activated.");
     }
 
-    @Test
-    @Order(7)
-    @Launch({"start", "--db=dev-file", "--cache-embedded-mtls-enabled=true", "--http-enabled=true", "--hostname-strict=false"})
-    public void testCacheEmbeddedMtlsEnabled(LaunchResult result) {
-        assertTrue(result.getOutputStream().stream().anyMatch(s -> s.contains("Property cache-embedded-mtls-key-store-file required but not specified")));
-    }
-
     // Start-dev should be executed as last tests - build is done for development mode
 
     @DryRun
     @Test
-    @Order(8)
+    @Order(7)
     @Launch({"start-dev", "--test=invalid"})
-    public void testServerDoesNotStartIfValidationFailDuringReAugStartDev(LaunchResult result) {
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Unknown option: '--test'")).count());
+    public void testServerDoesNotStartIfValidationFailDuringReAugStartDev(CLIResult result) {
+        result.assertError("Unknown option: '--test'");
     }
 
     @DryRun
     @Test
-    @Order(9)
+    @Order(8)
     @Launch({"start-dev", "--log=console", "--log-file-output=json"})
-    public void testServerDoesNotStartDevIfDisabledFileLogOption(LaunchResult result) {
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Disabled option: '--log-file-output'. Available only when File log handler is activated")).count());
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Possible solutions: --log, --log-console-output, --log-console-level, --log-console-format, --log-console-color, --log-level")).count());
+    public void testServerDoesNotStartDevIfDisabledFileLogOption(CLIResult result) {
+        result.assertError("Disabled option: '--log-file-output'. Available only when File log handler is activated");
+        result.assertError("Possible solutions: --log, --log-async, --log-console-output, --log-console-level, --log-console-format, --log-console-color, --log-console-async, --log-level, --log-level-<category>");
     }
 
     @DryRun
     @Test
-    @Order(10)
+    @Order(9)
     @Launch({"start-dev", "--log=file", "--log-file-output=json", "--log-console-color=true"})
-    public void testServerStartDevIfEnabledFileLogOption(LaunchResult result) {
-        assertEquals(0, result.getErrorStream().stream().filter(s -> s.contains("Disabled option: '--log-file-output'. Available only when File log handler is activated")).count());
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Disabled option: '--log-console-color'. Available only when Console log handler is activated")).count());
-        assertEquals(1, result.getErrorStream().stream().filter(s -> s.contains("Possible solutions: --log, --log-file, --log-file-level, --log-file-format, --log-file-output, --log-level")).count());
+    public void testServerStartDevIfEnabledFileLogOption(CLIResult result) {
+        result.assertNoError("Disabled option: '--log-file-output'. Available only when File log handler is activated");
+        result.assertError("Disabled option: '--log-console-color'. Available only when Console log handler is activated");
+        result.assertError("Possible solutions: --log, --log-async, --log-file, --log-file-level, --log-file-format, --log-file-json-format, --log-file-output, --log-file-async, --log-level, --log-level-<category>");
     }
 
     @DryRun
     @Test
     @Order(10)
     @Launch({"start-dev", "--cache-remote-host=localhost"})
-    public void testCacheRemoteHostWithoutMultiSite(LaunchResult result) {
-        assertErrorStreamContains(result, "cache-remote-host available only when feature 'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set");
+    public void testCacheRemoteHostWithoutMultiSite(CLIResult result) {
+        result.assertError( "cache-remote-host available only when feature 'multi-site' or 'clusterless' is set");
     }
 
     @DryRun
     @Test
     @Order(11)
     @Launch({"start-dev", "--cache-remote-port=11222"})
-    public void testCacheRemotePortWithoutCacheRemoteHost(LaunchResult result) {
+    public void testCacheRemotePortWithoutCacheRemoteHost(CLIResult result) {
         assertDisabledDueToMissingRemoteHost(result, "--cache-remote-port");
     }
 
@@ -157,7 +146,7 @@ public void testCacheRemotePortWithoutCacheRemoteHost(LaunchResult result) {
     @Test
     @Order(12)
     @Launch({"start-dev", "--cache-remote-username=user"})
-    public void testCacheRemoteUsernameWithoutCacheRemoteHost(LaunchResult result) {
+    public void testCacheRemoteUsernameWithoutCacheRemoteHost(CLIResult result) {
         assertDisabledDueToMissingRemoteHost(result, "--cache-remote-username");
     }
 
@@ -165,7 +154,7 @@ public void testCacheRemoteUsernameWithoutCacheRemoteHost(LaunchResult result) {
     @Test
     @Order(13)
     @Launch({"start-dev", "--cache-remote-password=pass"})
-    public void testCacheRemotePasswordWithoutCacheRemoteHost(LaunchResult result) {
+    public void testCacheRemotePasswordWithoutCacheRemoteHost(CLIResult result) {
         assertDisabledDueToMissingRemoteHost(result, "--cache-remote-password");
     }
 
@@ -173,7 +162,7 @@ public void testCacheRemotePasswordWithoutCacheRemoteHost(LaunchResult result) {
     @Test
     @Order(14)
     @Launch({"start-dev", "--cache-remote-tls-enabled=false"})
-    public void testCacheRemoteTlsEnabledWithoutCacheRemoteHost(LaunchResult result) {
+    public void testCacheRemoteTlsEnabledWithoutCacheRemoteHost(CLIResult result) {
         assertDisabledDueToMissingRemoteHost(result, "--cache-remote-tls-enabled");
     }
 
@@ -181,31 +170,27 @@ public void testCacheRemoteTlsEnabledWithoutCacheRemoteHost(LaunchResult result)
     @Test
     @Order(15)
     @Launch({"start-dev", "--features=multi-site"})
-    public void testMultiSiteWithoutCacheRemoteHost(LaunchResult result) {
-        assertErrorStreamContains(result, "- cache-remote-host: Required when feature 'multi-site' or 'clusterless' is set.");
+    public void testMultiSiteWithoutCacheRemoteHost(CLIResult result) {
+        result.assertError("- cache-remote-host: Required when feature 'multi-site' or 'clusterless' is set.");
     }
 
     @DryRun
     @Test
     @Order(16)
     @Launch({"start-dev", "--features=multi-site", "--cache-remote-host=localhost", "--cache-remote-username=user"})
-    public void testCacheRemoteUsernameWithoutCacheRemotePassword(LaunchResult result) {
-        assertErrorStreamContains(result, "The option 'cache-remote-password' is required when 'cache-remote-username' is set.");
+    public void testCacheRemoteUsernameWithoutCacheRemotePassword(CLIResult result) {
+        result.assertError("The option 'cache-remote-password' is required when 'cache-remote-username' is set.");
     }
 
     @DryRun
     @Test
     @Order(17)
     @Launch({"start-dev", "--features=multi-site", "--cache-remote-host=localhost", "--cache-remote-password=secret"})
-    public void testCacheRemotePasswordWithoutCacheRemoteUsername(LaunchResult result) {
-        assertErrorStreamContains(result, "The option 'cache-remote-username' is required when 'cache-remote-password' is set.");
-    }
-
-    private static void assertDisabledDueToMissingRemoteHost(LaunchResult result, String option) {
-        assertErrorStreamContains(result, "Disabled option: '%s'. Available only when remote host is set".formatted(option));
+    public void testCacheRemotePasswordWithoutCacheRemoteUsername(CLIResult result) {
+        result.assertError("The option 'cache-remote-username' is required when 'cache-remote-password' is set.");
     }
 
-    private static void assertErrorStreamContains(LaunchResult result, String msg) {
-        assertTrue(result.getErrorStream().stream().anyMatch(s -> s.contains(msg)));
+    private static void assertDisabledDueToMissingRemoteHost(CLIResult result, String option) {
+        result.assertError("Disabled option: '%s'. Available only when remote host is set".formatted(option));
     }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyHostnameV2DistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyHostnameV2DistTest.java
index 72062e64d003..9c7a76f570fa 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyHostnameV2DistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyHostnameV2DistTest.java
@@ -29,7 +29,9 @@
 import org.keycloak.it.junit5.extension.CLIResult;
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.RawDistOnly;
+import org.keycloak.it.junit5.extension.TestProvider;
 import org.keycloak.it.junit5.extension.WithEnvVars;
+import org.keycloak.it.resource.realm.TestRealmResourceTestProvider;
 import org.keycloak.it.utils.KeycloakDistribution;
 import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
 
@@ -61,24 +63,33 @@ public void testSchemeAndPortFromRequestWhenNoProxySet() {
         assertForwardedHeaderIsIgnored();
         assertXForwardedHeadersAreIgnored();
     }
-    
+
     @Test
     void testTrustedProxiesWithoutProxyHeaders(KeycloakDistribution distribution) {
         CLIResult result = distribution.run("start-dev", "--proxy-trusted-addresses=1.0.0.0");
         result.assertError("proxy-trusted-addresses available only when proxy-headers is set");
     }
-    
+
     @Test
     void testTrustedProxiesWithInvalidAddress(KeycloakDistribution distribution) {
         CLIResult result = distribution.run("start-dev", "--proxy-headers=xforwarded", "--proxy-trusted-addresses=1.0.0.0:8080");
         result.assertError("1.0.0.0:8080 is not a valid IP address (IPv4 or IPv6) nor valid CIDR notation.");
     }
-    
+
     @Test
     @Launch({ "start-dev", "--hostname-strict=false", "--proxy-headers=xforwarded", "--proxy-trusted-addresses=1.0.0.0" })
+    @TestProvider(TestRealmResourceTestProvider.class)
     public void testProxyNotTrusted() {
         assertForwardedHeaderIsIgnored();
         assertForwardedHeaderIsIgnored();
+        given().header("X-Forwarded-Host", "test:123").when().get("http://mykeycloak.org:8080/realms/master/test-resources/trusted").then().statusCode(204);
+    }
+
+    @Test
+    @Launch({ "start-dev", "--hostname-strict=false", "--proxy-headers=xforwarded", "--proxy-trusted-addresses=127.0.0.1,0:0:0:0:0:0:0:1" })
+    @TestProvider(TestRealmResourceTestProvider.class)
+    public void testProxyTrusted() {
+        given().header("X-Forwarded-Host", "test:123").when().get("http://mykeycloak.org:8080/realms/master/test-resources/trusted").then().statusCode(200);
     }
 
     @Test
@@ -86,9 +97,9 @@ public void testProxyNotTrusted() {
     public void testForwardedProxyHeaders(LaunchResult result) {
         assertForwardedHeader();
         assertXForwardedHeadersAreIgnored();
-        
+
         CLIResult cliResult = (CLIResult)result;
-        cliResult.assertNoMessage(NOT_ADDRESS);
+        cliResult.assertMessage(NOT_ADDRESS); // non-ip addresses are still reported as the client ip
         cliResult.assertMessage(ADDRESS);
     }
 
@@ -117,9 +128,9 @@ private void assertForwardedHeaderIsIgnored() {
     }
 
     private void assertXForwardedHeaders() {
-        given().header("X-Forwarded-Host", "test").when().get("http://mykeycloak.org:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:8080/admin"));
-        given().header("X-Forwarded-Host", "test").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:8080/admin"));
-        given().header("X-Forwarded-Host", "test").when().get("https://localhost:8443").then().header(HttpHeaders.LOCATION, containsString("https://test:8443/admin"));
+        given().header("X-Forwarded-Host", "test:123").when().get("http://mykeycloak.org:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:123/admin"));
+        given().header("X-Forwarded-Host", "test:123").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:123/admin"));
+        given().header("X-Forwarded-Host", "test:123").when().get("https://localhost:8443").then().header(HttpHeaders.LOCATION, containsString("https://test:123/admin"));
         given().header("X-Forwarded-Proto", "https").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("https://localhost/admin"));
         given().header("X-Forwarded-Proto", "https").header("X-Forwarded-Port", "8443").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("https://localhost:8443/admin"));
     }
@@ -140,4 +151,4 @@ private void assertFrontEndUrl(String requestBaseUrl, String expectedBaseUrl) {
         Assert.assertEquals(expectedBaseUrl + "realms/master/protocol/openid-connect/auth", getServerMetadata(requestBaseUrl)
                 .getAuthorizationEndpoint());
     }
-}
\ No newline at end of file
+}
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesAutoBuildDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesAutoBuildDistTest.java
index 055db79c7b9c..e2e1cac10732 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesAutoBuildDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesAutoBuildDistTest.java
@@ -112,7 +112,7 @@ void testWrappedBuildPropertyTriggersBuildButGetsIgnoredWhenSetByQuarkus(CLIResu
     @Launch({ "start" })
     @Order(9)
     void nonXADatasourceFailsToStart(CLIResult cliResult) {
-        cliResult.assertError("Multiple datasources are configured but more than 1 is using non-XA transactions.");
+        cliResult.assertError("Multiple datasources are configured but more than 1 (user-store3, <default>) is using non-XA transactions.");
     }
 
     @Test
@@ -144,45 +144,43 @@ public void accept(KeycloakDistribution distribution) {
     public static class AddAdditionalDatasource implements Consumer<KeycloakDistribution> {
         @Override
         public void accept(KeycloakDistribution distribution) {
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.db-kind", "h2");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.username","sa");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.jdbc.url","jdbc:h2:mem:user-store;DB_CLOSE_DELAY=-1");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.jdbc.transactions", "xa");
+            distribution.setProperty("db-kind-user-store", "dev-mem");
+            distribution.setProperty("db-username-user-store", "sa");
+            distribution.setProperty("db-url-full-user-store", "jdbc:h2:mem:user-store;DB_CLOSE_DELAY=-1");
         }
     }
 
     public static class AddAdditionalDatasource2 implements Consumer<KeycloakDistribution> {
         @Override
         public void accept(KeycloakDistribution distribution) {
-            distribution.setQuarkusProperty("quarkus.datasource.user-store2.db-kind", "h2");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store2.db-transactions", "enabled");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store2.username","sa");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store2.jdbc.url","jdbc:h2:mem:user-store2;DB_CLOSE_DELAY=-1");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store2.jdbc.transactions", "xa");
+            distribution.setProperty("db-kind-user-store2", "dev-mem");
+            distribution.setProperty("transaction-xa-enabled-user-store2", "true");
+            distribution.setProperty("db-username-user-store2", "sa");
+            distribution.setProperty("db-url-full-user-store2", "jdbc:h2:mem:user-store2;DB_CLOSE_DELAY=-1");
         }
     }
 
     public static class AddNonXADatasource implements Consumer<KeycloakDistribution> {
         @Override
         public void accept(KeycloakDistribution distribution) {
-            distribution.setQuarkusProperty("quarkus.datasource.user-store3.db-kind", "h2");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store3.db-transactions", "enabled");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store3.username","sa");
-            distribution.setQuarkusProperty("quarkus.datasource.user-store3.jdbc.url","jdbc:h2:mem:user-store2;DB_CLOSE_DELAY=-1");
+            distribution.setProperty("db-kind-user-store3", "dev-mem");
+            distribution.setProperty("transaction-xa-enabled-user-store3", "false");
+            distribution.setProperty("db-username-user-store3", "sa");
+            distribution.setProperty("db-url-full-user-store3", "jdbc:h2:mem:user-store2;DB_CLOSE_DELAY=-1");
         }
     }
 
     public static class ChangeAdditionalDatasourceUsername implements Consumer<KeycloakDistribution> {
         @Override
         public void accept(KeycloakDistribution distribution) {
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.username","foo");
+            distribution.setProperty("db-username-user-store", "foo");
         }
     }
 
     public static class ChangeAdditionalDatasourceDbKind implements Consumer<KeycloakDistribution> {
         @Override
         public void accept(KeycloakDistribution distribution) {
-            distribution.setQuarkusProperty("quarkus.datasource.user-store.db-kind","h2");
+            distribution.setProperty("db-kind-user-store", "dev-mem");
         }
     }
 
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesDistTest.java
index 4d4c1a1bacb0..46d5261b6dbf 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/QuarkusPropertiesDistTest.java
@@ -34,6 +34,7 @@
 import org.keycloak.it.junit5.extension.DryRun;
 import org.keycloak.it.junit5.extension.KeepServerAlive;
 import org.keycloak.it.junit5.extension.RawDistOnly;
+import org.keycloak.it.junit5.extension.WithEnvVars;
 import org.keycloak.it.utils.KeycloakDistribution;
 
 import java.util.Optional;
@@ -42,9 +43,9 @@
 import static io.restassured.RestAssured.when;
 import static org.hamcrest.Matchers.containsString;
 import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG;
 
 @DistributionTest(reInstall = DistributionTest.ReInstall.NEVER, defaultOptions = "--db=dev-file")
+@WithEnvVars({"KC_CACHE", "local"}) // avoid flakey port conflicts
 @RawDistOnly(reason = "Containers are immutable")
 @Tag(DistributionTest.WIN)
 @TestMethodOrder(OrderAnnotation.class)
@@ -187,8 +188,9 @@ void testInvalidSmallRyeKeyStorePathPropertyWin(CLIResult cliResult) {
             "--config-keystore=../../../../src/test/resources/keystore", "--config-keystore-password=secret" })
     @Order(12)
     void testSmallRyeKeyStoreConfigSource(CLIResult cliResult) {
-        // keytool -importpass -alias kc.log-level -keystore keystore -storepass secret -storetype PKCS12 -v (with "debug" as the stored password)
-        cliResult.assertMessage("DEBUG");
+        // keytool -importpass -alias kc.log-level -keystore keystore -storepass secret -storetype PKCS12 -v (with "org.keycloak.timer:debug" as the stored password)
+        cliResult.assertNoMessage("DEBUG [org.keycloak.services");
+        cliResult.assertMessage("DEBUG [org.keycloak.timer");
         cliResult.assertStarted();
     }
 
@@ -200,7 +202,8 @@ void testSmallRyeKeyStoreConfigSource(CLIResult cliResult) {
             "--https-certificate-key-file=/tmp/kc/bin/../conf/server.key.pem" })
     @Order(13)
     void testHttpCertsPathTransformer(CLIResult cliResult) {
-        cliResult.assertError("Failed to load 'https-key-' material: NoSuchFileException /tmp/kc/bin/../conf/server.crt.pem");
+        cliResult.assertExitCode(1);
+        cliResult.assertMessage("Failed to load 'https-trust-store' or 'https-key-' material: NoSuchFileException");
     }
 
     @Test
@@ -211,7 +214,8 @@ void testHttpCertsPathTransformer(CLIResult cliResult) {
             "--https-certificate-key-file=C:\\tmp\\kc\\bin\\..\\conf/server.key.pem" })
     @Order(14)
     void testHttpCertsPathTransformerOnWindows(CLIResult cliResult) {
-        cliResult.assertError("Failed to load 'https-key-' material: NoSuchFileException C:\\tmp\\kc\\bin\\..\\conf\\server.crt.pem");
+        cliResult.assertExitCode(1);
+        cliResult.assertMessage("ERROR: Failed to load 'https-trust-store' or 'https-key-' material: NoSuchFileException C:");
     }
 
     public static class AddConsoleHandlerFromQuarkusProps implements Consumer<KeycloakDistribution> {
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java
index 9a10758153d1..daada491a81f 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ShowConfigCommandDistTest.java
@@ -13,6 +13,7 @@
 import org.keycloak.quarkus.runtime.cli.command.ShowConfig;
 import org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers;
 
+import java.nio.file.Path;
 import java.nio.file.Paths;
 
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -86,11 +87,33 @@ void testSmallRyeKeyStoreConfigSource(KeycloakDistribution distribution) {
 
     @Test
     @Launch({ ShowConfig.NAME })
-    @WithEnvVars({"KC_DB_PASSWORD", "secret-pass"})
+    @WithEnvVars({"KC_DB_PASSWORD", "secret-pass", "KC_LOG_LEVEL_FOO_BAR", "trace"})
     void testNoDuplicitEnvVarEntries(LaunchResult result) {
         String output = result.getOutput();
         assertThat(output, containsString("kc.db-password =  " + PropertyMappers.VALUE_MASK));
+        assertThat(output, containsString("kc.log-level-foo.bar"));
+        assertThat(output, not(containsString("kc.log.")));
         assertThat(output, not(containsString("kc.db.password")));
         assertThat(output, not(containsString("secret-pass")));
     }
+
+    @Test
+    @RawDistOnly(reason = "Containers are immutable")
+    void testConfigSourceNames(KeycloakDistribution distribution) {
+        CLIResult result = distribution.run("build");
+        result.assertBuild();
+
+        distribution.setEnvVar("KC_LOG", "file");
+        distribution.copyOrReplaceFile(Paths.get("src/test/resources/ShowConfigCommandTest/quarkus.properties"), Path.of("conf", "quarkus.properties"));
+
+        result = distribution.run(String.format("%s=%s", CONFIG_FILE_LONG_NAME, Paths.get("src/test/resources/ShowConfigCommandTest/keycloak-keystore.conf").toAbsolutePath().normalize()), ShowConfig.NAME, "all");
+
+        result.assertMessage("(CLI)");
+        result.assertMessage("(ENV)");
+        result.assertMessage("(quarkus.properties)");
+        result.assertMessage("(Persisted)");
+        result.assertMessage("(config-keystore)");
+        result.assertMessage("(classpath application.properties)");
+        result.assertMessage("(keycloak-keystore.conf)");
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartAutoBuildDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartAutoBuildDistTest.java
index eda82239269c..2ff719aae100 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartAutoBuildDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartAutoBuildDistTest.java
@@ -149,4 +149,32 @@ void testSpiAutoBuild(KeycloakDistribution dist) {
         cliResult.assertStartedDevMode();
     }
 
+    @Test
+    @Order(11)
+    void testLogLevelNotPeristed(KeycloakDistribution dist) {
+        CLIResult cliResult = dist.run("start", "--db=dev-file", "--log-level=org.hibernate.SQL:debug", "--http-enabled=true", "--hostname-strict=false");
+        cliResult.assertMessage("DEBUG [org.hibernate.SQL]");
+        cliResult.assertStarted();
+        dist.stop();
+
+        // logging runtime defaults should not be used
+        cliResult = dist.run("start", "--db=dev-file", "--http-enabled=true", "--hostname-strict=false");
+        cliResult.assertNoMessage("DEBUG [org.hibernate.SQL]");
+        cliResult.assertStarted();
+    }
+
+    @Test
+    @Order(12)
+    void testLogLevelWildcardNotPeristed(KeycloakDistribution dist) {
+        CLIResult cliResult = dist.run("start-dev", "--log-level-org.hibernate.SQL=debug");
+        cliResult.assertMessage("DEBUG [org.hibernate.SQL]");
+        cliResult.assertStartedDevMode();
+        dist.stop();
+
+        // logging runtime defaults should not be used
+        cliResult = dist.run("start-dev");
+        cliResult.assertNoMessage("DEBUG [org.hibernate.SQL]");
+        cliResult.assertStartedDevMode();
+    }
+
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartCommandDistTest.java
index 4461f99f9f2d..aaf42eaa5b97 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartCommandDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartCommandDistTest.java
@@ -76,12 +76,12 @@ void errorSpiBuildtimeAtRuntime(KeycloakDistribution dist) {
         CLIResult cliResult = dist.run("build",  "--db=dev-file");
         cliResult.assertBuild();
 
-        cliResult = dist.run("start", "--optimized", "--http-enabled=true", "--hostname-strict=false", "--spi-events-listener-jboss-logging-enabled=false");
-        cliResult.assertError("The following build time options have values that differ from what is persisted - the new values will NOT be used until another build is run: kc.spi-events-listener-jboss-logging-enabled");
+        cliResult = dist.run("start", "--optimized", "--http-enabled=true", "--hostname-strict=false", "--spi-events-listener--jboss-logging--enabled=false");
+        cliResult.assertError("The following build time options have values that differ from what is persisted - the new values will NOT be used until another build is run: kc.spi-events-listener--jboss-logging--enabled");
     }
 
     @DryRun
-    @WithEnvVars({"KC_SPI_EVENTS_LISTENER_JBOSS_LOGGING_ENABLED", "false"})
+    @WithEnvVars({"KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__ENABLED", "false"})
     @Test
     @RawDistOnly(reason = "Containers are immutable")
     void noErrorSpiBuildtimeNotChanged(KeycloakDistribution dist) {
@@ -96,7 +96,7 @@ void noErrorSpiBuildtimeNotChanged(KeycloakDistribution dist) {
     @Test
     @Launch({ "--profile=dev", "start",  "--db=dev-file" })
     void failUsingDevProfile(CLIResult cliResult) {
-        assertTrue(cliResult.getErrorOutput().contains("ERROR: You can not 'start' the server in development mode. Please re-build the server first, using 'kc.sh build' for the default production mode."),
+        assertTrue(cliResult.getErrorOutput().contains("You can not 'start' the server in development mode. Please re-build the server first, using 'kc.sh build' for the default production mode."),
                 () -> "The Output:\n" + cliResult.getErrorOutput() + "doesn't contains the expected string.");
     }
 
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartDevCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartDevCommandDistTest.java
index 631f3df181e1..a5cf729ab740 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartDevCommandDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/StartDevCommandDistTest.java
@@ -22,8 +22,6 @@
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.TestMethodOrder;
-import org.junit.jupiter.api.condition.DisabledOnOs;
-import org.junit.jupiter.api.condition.OS;
 import org.keycloak.it.junit5.extension.CLIResult;
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.DryRun;
@@ -34,6 +32,7 @@
 import java.io.File;
 import java.nio.file.Paths;
 
+import static org.junit.Assert.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @DistributionTest
@@ -47,6 +46,9 @@ public class StartDevCommandDistTest {
     @Launch({ "start-dev" })
     void testDevModeWarning(CLIResult cliResult) {
         cliResult.assertStartedDevMode();
+        String out = cliResult.getOutput().toUpperCase();
+        assertFalse(out.contains("WARN"));
+        assertFalse(out.contains("ERROR"));
     }
 
     @DryRun
@@ -62,6 +64,8 @@ void testStartDevShouldStartTwoJVMs(CLIResult cliResult) {
         cliResult.assertMessageWasShownExactlyNumberOfTimes("Listening for transport dt_socket at address:", 2);
         cliResult.assertStartedDevMode();
         cliResult.assertMessage("passkeys");
+        // ensure consistency with build-time properties
+        cliResult.assertNoMessage("Build time property cannot");
     }
 
     @DryRun
@@ -80,13 +84,15 @@ void testVerboseAfterCommand(CLIResult cliResult) {
     }
 
     @Test
-    @DisabledOnOs(value = { OS.LINUX, OS.MAC }, disabledReason = "A drive letter in URI can cause a problem.")
     void testConfigKeystoreAbsolutePath(KeycloakDistribution dist) {
         CLIResult cliResult = dist.run("start-dev", "--config-keystore=" + Paths.get("src/test/resources/keystore").toAbsolutePath().normalize(),
                 "--config-keystore-password=secret");
 
-        cliResult.assertMessage("DEBUG [org.hibernate");
-        cliResult.assertMessage("DEBUG [org.keycloak");
+        // keytool -importpass -alias kc.log-level -keystore keystore -storepass secret -storetype PKCS12 -v (with "org.keycloak.timer:debug" as the stored password)
+        cliResult.assertNoMessage("DEBUG [org.keycloak.services");
+        cliResult.assertMessage("DEBUG [org.keycloak.timer");
+        cliResult.assertNoMessage("DEBUG [org.hibernate");
+
         cliResult.assertMessage("Listening on:");
         cliResult.assertStartedDevMode();
     }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/TracingDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/TracingDistTest.java
index 3151bcfc7ffd..6e1a6397a867 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/TracingDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/TracingDistTest.java
@@ -40,6 +40,10 @@ private void assertTracingEnabled(CLIResult result) {
     private void assertTracingDisabled(CLIResult result) {
         result.assertMessage("opentelemetry");
         result.assertNoMessage("service.name=\"keycloak\"");
+        assertSamplingDisabled(result);
+    }
+
+    private void assertSamplingDisabled(CLIResult result) {
         result.assertNoMessage("Failed to export spans.");
         result.assertNoMessage("Connection refused: localhost/127.0.0.1:4317");
     }
@@ -101,6 +105,16 @@ void enabled(LaunchResult result) {
         cliResult.assertMessage("traceId=, parentId=, spanId=, sampled=");
     }
 
+    @Test
+    @Launch({"start", "--hostname-strict=false", "--http-enabled=true", "--optimized", "--tracing-sampler-ratio=0.0", "--log-level=io.opentelemetry:fine"})
+    void samplingDisabledViaRatioZero(LaunchResult result) {
+        CLIResult cliResult = (CLIResult) result;
+
+        cliResult.assertStarted();
+        assertTracingEnabled(cliResult);
+        assertSamplingDisabled(cliResult);
+    }
+
     @Test
     @Launch({"start", "--hostname-strict=false", "--http-enabled=true", "--optimized", "--tracing-endpoint=http://endpoint:8888", "--log-level=io.opentelemetry:fine"})
     void differentEndpoint(LaunchResult result) {
@@ -143,11 +157,11 @@ void unknownProtocol(LaunchResult result) {
     }
 
     @Test
-    @Launch({"start", "--hostname-strict=false", "--http-enabled=true", "--optimized", "--tracing-sampler-ratio=0.0"})
+    @Launch({"start", "--hostname-strict=false", "--http-enabled=true", "--optimized", "--tracing-sampler-ratio=1.1"})
     void wrongSamplerRatio(LaunchResult result) {
         CLIResult cliResult = (CLIResult) result;
 
-        cliResult.assertError("Ratio in 'tracing-sampler-ratio' option must be a double value in interval <0,1).");
+        cliResult.assertError("Ratio in 'tracing-sampler-ratio' option must be a double value in interval [0,1].");
     }
 
     @Test
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/UpdateCommandDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/UpdateCommandDistTest.java
new file mode 100644
index 000000000000..898ff23afeff
--- /dev/null
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/UpdateCommandDistTest.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.it.cli.dist;
+
+import io.quarkus.test.junit.main.Launch;
+import java.io.File;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+import org.keycloak.common.Version;
+import org.keycloak.compatibility.CompatibilityResult;
+import org.keycloak.compatibility.KeycloakCompatibilityMetadataProvider;
+import org.keycloak.infinispan.compatibility.CachingCompatibilityMetadataProvider;
+import org.keycloak.it.junit5.extension.CLIResult;
+import org.keycloak.it.junit5.extension.DistributionTest;
+import org.keycloak.it.junit5.extension.RawDistOnly;
+import org.keycloak.it.utils.KeycloakDistribution;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibility;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibilityCheck;
+import org.keycloak.quarkus.runtime.cli.command.UpdateCompatibilityMetadata;
+import org.keycloak.util.JsonSerialization;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.keycloak.it.cli.dist.Util.createTempFile;
+
+@DistributionTest
+@RawDistOnly(reason = "Requires creating JSON file to be available between containers")
+public class UpdateCommandDistTest {
+
+    private static final String DISABLE_FEATURE = "--features-disabled=rolling-updates";
+
+    @Test
+    @Launch({UpdateCompatibility.NAME, UpdateCompatibilityMetadata.NAME, DISABLE_FEATURE})
+    public void testFeatureNotEnabled(CLIResult cliResult) {
+        cliResult.assertError("Unable to use this command. None of the versions of the feature 'rolling-updates' is enabled.");
+    }
+
+    @Test
+    @Launch({UpdateCompatibility.NAME})
+    public void testMissingSubCommand(CLIResult cliResult) {
+        cliResult.assertError("Missing required subcommand");
+    }
+
+    @Test
+    @Launch({UpdateCompatibility.NAME, UpdateCompatibilityMetadata.NAME})
+    public void testMissingOptionOnSave(CLIResult cliResult) {
+        cliResult.assertNoMessage("Missing required argument");
+    }
+
+    @Test
+    @Launch({UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME})
+    public void testMissingOptionOnCheck(CLIResult cliResult) {
+        cliResult.assertError("Missing required argument: " + UpdateCompatibilityCheck.INPUT_OPTION_NAME);
+    }
+
+    @Test
+    public void testCompatible(KeycloakDistribution distribution) throws IOException {
+        var jsonFile = createTempFile("compatible", ".json");
+        var result = distribution.run(UpdateCompatibility.NAME, UpdateCompatibilityMetadata.NAME, UpdateCompatibilityMetadata.OUTPUT_OPTION_NAME, jsonFile.getAbsolutePath());
+        result.assertMessage("Metadata:");
+        assertEquals(0, result.exitCode());
+
+        var info = JsonSerialization.mapper.readValue(jsonFile, UpdateCompatibilityCheck.METADATA_TYPE_REF);
+        assertEquals(Version.VERSION, info.get(KeycloakCompatibilityMetadataProvider.ID).get("version"));
+        assertEquals(org.infinispan.commons.util.Version.getVersion(), info.get(CachingCompatibilityMetadataProvider.ID).get("version"));
+        assertEquals(org.jgroups.Version.printVersion(), info.get(CachingCompatibilityMetadataProvider.ID).get("jgroupsVersion"));
+
+        result = distribution.run(UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, UpdateCompatibilityCheck.INPUT_OPTION_NAME, jsonFile.getAbsolutePath());
+        result.assertExitCode(CompatibilityResult.ExitCode.ROLLING.value());
+        result.assertMessage("[OK] Rolling Update is available.");
+        result.assertNoError("Rolling Update is not available.");
+    }
+
+    @Test
+    public void testWrongVersions(KeycloakDistribution distribution) throws IOException {
+        var jsonFile = createTempFile("wrong-versions", ".json");
+
+        // incompatible keycloak version
+        var info = new HashMap<String, Map<String, String>>();
+        info.put(KeycloakCompatibilityMetadataProvider.ID, Map.of("version", "0.0.0.Final"));
+        info.put(CachingCompatibilityMetadataProvider.ID, Map.of(
+                "version", org.infinispan.commons.util.Version.getVersion(),
+                "persistence", "true",
+                "mode", "embedded",
+                "jgroupsVersion", org.jgroups.Version.printVersion()
+        ));
+        JsonSerialization.mapper.writeValue(jsonFile, info);
+
+        var result = distribution.run(UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, UpdateCompatibilityCheck.INPUT_OPTION_NAME, jsonFile.getAbsolutePath());
+        result.assertExitCode(CompatibilityResult.ExitCode.RECREATE.value());
+        result.assertError("[%s] Rolling Update is not available. '%s.version' is incompatible: 0.0.0.Final -> %s.".formatted(KeycloakCompatibilityMetadataProvider.ID, KeycloakCompatibilityMetadataProvider.ID, Version.VERSION));
+
+        // incompatible infinispan version
+        info.put(KeycloakCompatibilityMetadataProvider.ID, Map.of("version", Version.VERSION));
+        info.put(CachingCompatibilityMetadataProvider.ID, Map.of(
+                "version", "0.0.0.Final",
+                "persistence", "true",
+                "mode", "embedded",
+                "jgroupsVersion", org.jgroups.Version.printVersion()
+        ));
+        JsonSerialization.mapper.writeValue(jsonFile, info);
+
+        // incompatible jgroups version
+        result = distribution.run(UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, UpdateCompatibilityCheck.INPUT_OPTION_NAME, jsonFile.getAbsolutePath());
+        result.assertExitCode(CompatibilityResult.ExitCode.RECREATE.value());
+        result.assertError("[%s] Rolling Update is not available. '%s.version' is incompatible: 0.0.0.Final -> %s.".formatted(CachingCompatibilityMetadataProvider.ID, CachingCompatibilityMetadataProvider.ID, org.infinispan.commons.util.Version.getVersion())); // incompatible infinispan version
+
+        info.put(KeycloakCompatibilityMetadataProvider.ID, Map.of("version", Version.VERSION));
+        info.put(CachingCompatibilityMetadataProvider.ID, Map.of(
+                "version", org.infinispan.commons.util.Version.getVersion(),
+                "persistence", "true",
+                "mode", "embedded",
+                "jgroupsVersion", "0.0.0.Final"
+        ));
+        JsonSerialization.mapper.writeValue(jsonFile, info);
+
+        result = distribution.run(UpdateCompatibility.NAME, UpdateCompatibilityCheck.NAME, UpdateCompatibilityCheck.INPUT_OPTION_NAME, jsonFile.getAbsolutePath());
+        result.assertExitCode(CompatibilityResult.ExitCode.RECREATE.value());
+        result.assertError("[%s] Rolling Update is not available. '%s.jgroupsVersion' is incompatible: 0.0.0.Final -> %s.".formatted(CachingCompatibilityMetadataProvider.ID, CachingCompatibilityMetadataProvider.ID, org.jgroups.Version.printVersion()));
+    }
+}
+
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/Util.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/Util.java
new file mode 100644
index 000000000000..4003156865f1
--- /dev/null
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/Util.java
@@ -0,0 +1,12 @@
+package org.keycloak.it.cli.dist;
+
+import java.io.File;
+import java.io.IOException;
+
+public class Util {
+    static File createTempFile(String prefix, String suffix) throws IOException {
+        var file = File.createTempFile(prefix, suffix);
+        file.deleteOnExit();
+        return file;
+    }
+}
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/BasicDatabaseTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/BasicDatabaseTest.java
index 3a2193cdffa8..1fba633ce796 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/BasicDatabaseTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/BasicDatabaseTest.java
@@ -17,14 +17,30 @@
 
 package org.keycloak.it.storage.database;
 
+import io.quarkus.logging.Log;
+import io.quarkus.test.junit.main.Launch;
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.junit.jupiter.api.MethodOrderer;
 import org.junit.jupiter.api.Order;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.TestMethodOrder;
 import org.keycloak.it.junit5.extension.CLIResult;
+import org.keycloak.it.utils.RawDistRootPath;
 import org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand;
 
-import io.quarkus.test.junit.main.Launch;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static org.apache.commons.lang3.StringUtils.countMatches;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
 
 @TestMethodOrder(MethodOrderer.OrderAnnotation.class)
 public abstract class BasicDatabaseTest {
@@ -37,7 +53,7 @@ protected void testSuccessful(CLIResult cliResult) {
 
     @Test
     @Launch({ "start", AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG, "--http-enabled=true", "--hostname-strict=false", "--db-username=wrong" })
-    void testWrongUsername(CLIResult cliResult) {
+    protected void testWrongUsername(CLIResult cliResult) {
         cliResult.assertMessage("ERROR: Failed to obtain JDBC connection");
         assertWrongUsername(cliResult);
     }
@@ -46,7 +62,7 @@ void testWrongUsername(CLIResult cliResult) {
 
     @Test
     @Launch({ "start", AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG, "--http-enabled=true", "--hostname-strict=false", "--db-password=wrong" })
-    void testWrongPassword(CLIResult cliResult) {
+    protected void testWrongPassword(CLIResult cliResult) {
         cliResult.assertMessage("ERROR: Failed to obtain JDBC connection");
         assertWrongPassword(cliResult);
     }
@@ -69,4 +85,33 @@ void testImportSucceeds(CLIResult cliResult) {
         cliResult.assertMessage("Realm 'master' imported");
         cliResult.assertMessage("Import finished successfully");
     }
+
+    public void assertManualDbInitialization(CLIResult cliResult, RawDistRootPath rawDistRootPath) {
+        cliResult.assertMessage("Database not initialized, please initialize database with");
+
+        var output = readKeycloakDbUpdateScript(rawDistRootPath);
+
+        assertThat(output, notNullValue());
+        assertThat(output, containsString("Create Database Change Log Table"));
+
+        var outputLowerCase = output.toLowerCase();
+        var count = countMatches(outputLowerCase, "create table public.databasechangelog") + countMatches(outputLowerCase, "create table keycloak.databasechangelog");
+        assertThat(count, is(1));
+    }
+
+    protected static String readKeycloakDbUpdateScript(RawDistRootPath path) {
+        final String defaultScriptName = "keycloak-database-update.sql";
+        Path scriptPath = Paths.get(path.getDistRootPath() + File.separator + "bin" + File.separator + defaultScriptName);
+        File script = new File(scriptPath.toString());
+        assertThat(String.format("Script '%s' does not exist!", defaultScriptName), script.isFile(), is(true));
+
+        try {
+            var result = FileUtils.readFileToString(script, Charset.defaultCharset());
+            Log.infof("Deleting Keycloak DB update script '%s'", defaultScriptName);
+            Files.delete(scriptPath);
+            return result;
+        } catch (IOException e) {
+            throw new AssertionError(String.format("Cannot read or delete script '%s'", defaultScriptName), e);
+        }
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/ExternalInfinispanTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/ExternalInfinispanTest.java
index 0a03e9335f7f..e9ddf079f52e 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/ExternalInfinispanTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/ExternalInfinispanTest.java
@@ -44,7 +44,7 @@ public class ExternalInfinispanTest {
             "--cache-remote-username=keycloak",
             "--cache-remote-password=Password1!",
             "--cache-remote-tls-enabled=false",
-            "--spi-connections-infinispan-quarkus-site-name=ISPN",
+            "--spi-cache-embedded-default-site-name=ISPN",
             "--spi-load-balancer-check-remote-poll-interval=500",
             "-Dkc.cache-remote-create-caches=true",
             "--verbose"
@@ -62,7 +62,7 @@ void testLoadBalancerCheckFailureWithMultiSite() {
             "--cache-remote-username=keycloak",
             "--cache-remote-password=Password1!",
             "--cache-remote-tls-enabled=false",
-            "--spi-connections-infinispan-quarkus-site-name=ISPN",
+            "--spi-cache-embedded-default-site-name=ISPN",
             "--spi-load-balancer-check-remote-poll-interval=500",
             "-Dkc.cache-remote-create-caches=true",
             "--verbose"
@@ -93,6 +93,17 @@ private void runLoadBalancerCheckFailureTest() {
             "--verbose"
     })
     void testSiteNameAsSystemProperty(CLIResult cliResult) {
-        cliResult.assertMessage("System property jboss.site.name is in use. Use --spi-connections-infinispan-quarkus-site-name config option instead");
+        cliResult.assertMessage("System property jboss.site.name is in use. Use --spi-cache-embedded-default-site-name config option instead");
+    }
+
+    @Test
+    @Launch({
+            "start-dev",
+            "--cache=ispn",
+            "-Djboss.node.name=ISPN",
+            "--verbose"
+    })
+    void testNodeNameAsSystemProperty(CLIResult cliResult) {
+        cliResult.assertMessage("System property jboss.node.name is in use. Use --spi-cache-embedded-default-node-name config option instead");
     }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/OracleTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/OracleTest.java
index 0c109f526658..4a6b60d11557 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/OracleTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/OracleTest.java
@@ -46,7 +46,7 @@ public static class CopyOracleJdbcDriver implements Consumer<KeycloakDistributio
         @Override
         public void accept(KeycloakDistribution distribution) {
             RawKeycloakDistribution rawDist = distribution.unwrap(RawKeycloakDistribution.class);
-            rawDist.copyProvider("com.oracle.database.jdbc", "ojdbc11");
+            rawDist.copyProvider("com.oracle.database.jdbc", "ojdbc17");
             rawDist.copyProvider("com.oracle.database.nls", "orai18n");
         }
     }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/DatasourcesDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/DatasourcesDistTest.java
new file mode 100644
index 000000000000..4bfb3b2d94c4
--- /dev/null
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/DatasourcesDistTest.java
@@ -0,0 +1,40 @@
+package org.keycloak.it.storage.database.dist;
+
+import io.quarkus.test.junit.main.Launch;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.keycloak.it.junit5.extension.CLIResult;
+import org.keycloak.it.junit5.extension.DistributionTest;
+import org.keycloak.it.junit5.extension.RawDistOnly;
+import org.keycloak.it.junit5.extension.WithEnvVars;
+import picocli.CommandLine;
+
+@DistributionTest
+@RawDistOnly(reason = "Containers are immutable")
+@Tag(DistributionTest.STORAGE)
+public class DatasourcesDistTest {
+
+    @Test
+    @Launch({"start-dev", "--db-kind-users=postgres", "--db-kind-clients=postgres", "--transaction-xa-enabled-users=false"})
+    public void multipleNonXaDatasources(CLIResult result) {
+        result.assertNoMessage("Multiple datasources are specified:"); // log handlers are not initialized yet, so only the error should be visible
+        result.assertExitCode(CommandLine.ExitCode.SOFTWARE);
+        result.assertError("Multiple datasources are configured but more than 1 (<default>, users) is using non-XA transactions.");
+    }
+
+    @Test
+    @Launch({"build", "--db-kind-users=postgres", "--db-kind-clients=mariadb"})
+    public void multipleDatasourcesPrint(CLIResult result) {
+        result.assertMessage("Multiple datasources are specified: clients, <default>, users");
+        result.assertBuild();
+    }
+
+    @Test
+    @WithEnvVars({"KC_DB_KIND_USERS", "postgres", "KC_DB_KIND_MY_AWESOME_CLIENTS", "mariadb"})
+    @Launch({"build"})
+    public void specifiedViaEnvVars(CLIResult result) {
+        result.assertMessage("Multiple datasources are specified: <default>, my-awesome-clients, users");
+        result.assertBuild();
+    }
+
+}
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MariaDBDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MariaDBDistTest.java
index 101957b73089..e409eacad778 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MariaDBDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MariaDBDistTest.java
@@ -23,6 +23,7 @@
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.WithDatabase;
 import org.keycloak.it.storage.database.MariaDBTest;
+import org.keycloak.it.utils.RawDistRootPath;
 import org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand;
 
 import io.quarkus.test.junit.main.Launch;
@@ -39,4 +40,11 @@ protected void testSuccessful(CLIResult result) {
         super.testSuccessful(result);
     }
 
+    @Tag(DistributionTest.STORAGE)
+    @Test
+    @Launch({"start", AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG, "--spi-connections-jpa-quarkus-migration-strategy=manual", "--spi-connections-jpa-quarkus-initialize-empty=false", "--http-enabled=true", "--hostname-strict=false",})
+    public void testKeycloakDbUpdateScript(CLIResult cliResult, RawDistRootPath rawDistRootPath) {
+        assertManualDbInitialization(cliResult, rawDistRootPath);
+    }
+
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MySQLDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MySQLDistTest.java
index d7779cb798be..53b2d50d25f7 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MySQLDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/MySQLDistTest.java
@@ -6,6 +6,7 @@
 import org.keycloak.it.junit5.extension.DistributionTest;
 import org.keycloak.it.junit5.extension.WithDatabase;
 import org.keycloak.it.storage.database.MySQLTest;
+import org.keycloak.it.utils.RawDistRootPath;
 import org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand;
 
 import io.quarkus.test.junit.main.Launch;
@@ -21,4 +22,11 @@ public class MySQLDistTest extends MySQLTest {
     protected void testSuccessful(CLIResult result) {
         super.testSuccessful(result);
     }
+
+    @Tag(DistributionTest.STORAGE)
+    @Test
+    @Launch({"start", AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG, "--spi-connections-jpa-quarkus-migration-strategy=manual", "--spi-connections-jpa-quarkus-initialize-empty=false", "--http-enabled=true", "--hostname-strict=false",})
+    public void testKeycloakDbUpdateScript(CLIResult cliResult, RawDistRootPath rawDistRootPath) {
+        assertManualDbInitialization(cliResult, rawDistRootPath);
+    }
 }
diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/PostgreSQLDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/PostgreSQLDistTest.java
index 3a7c2c31d640..fdc30ab8c1f5 100644
--- a/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/PostgreSQLDistTest.java
+++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/storage/database/dist/PostgreSQLDistTest.java
@@ -28,6 +28,8 @@
 import org.keycloak.it.storage.database.PostgreSQLTest;
 
 import io.quarkus.test.junit.main.Launch;
+import org.keycloak.it.utils.RawDistRootPath;
+import org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand;
 
 @DistributionTest(removeBuildOptionsAfterBuild = true)
 @WithDatabase(alias = "postgres")
@@ -39,4 +41,11 @@ public class PostgreSQLDistTest extends PostgreSQLTest {
     public void testDbOptionFromPersistedConfigSource(CLIResult cliResult) {
         assertThat(cliResult.getOutput(),containsString("postgres (Persisted)"));
     }
+
+    @Tag(DistributionTest.STORAGE)
+    @Test
+    @Launch({"start", AbstractStartCommand.OPTIMIZED_BUILD_OPTION_LONG, "--spi-connections-jpa-quarkus-migration-strategy=manual", "--spi-connections-jpa-quarkus-initialize-empty=false", "--http-enabled=true", "--hostname-strict=false",})
+    public void testKeycloakDbUpdateScript(CLIResult cliResult, RawDistRootPath rawDistRootPath) {
+        assertManualDbInitialization(cliResult, rawDistRootPath);
+    }
 }
diff --git a/quarkus/tests/integration/src/test/resources/ExternalInfinispan/kcb-infinispan-cache-remote-store-config.xml b/quarkus/tests/integration/src/test/resources/ExternalInfinispan/kcb-infinispan-cache-remote-store-config.xml
index 79725b47180f..213f4f6d215b 100644
--- a/quarkus/tests/integration/src/test/resources/ExternalInfinispan/kcb-infinispan-cache-remote-store-config.xml
+++ b/quarkus/tests/integration/src/test/resources/ExternalInfinispan/kcb-infinispan-cache-remote-store-config.xml
@@ -222,6 +222,14 @@
             <expiration max-idle="3600000"/>
             <memory max-count="1000"/>
         </local-cache>
+        <local-cache name="crl" simple-cache="true" statistics="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <distributed-cache name="actionTokens" owners="2" statistics="true">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/quarkus/tests/integration/src/test/resources/ShowConfigCommandTest/quarkus.properties b/quarkus/tests/integration/src/test/resources/ShowConfigCommandTest/quarkus.properties
new file mode 100644
index 000000000000..f06f8bcf6c50
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/ShowConfigCommandTest/quarkus.properties
@@ -0,0 +1 @@
+quarkus.key=value
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/cache-ispn-asym-enc.xml b/quarkus/tests/integration/src/test/resources/cache-ispn-asym-enc.xml
index b4ab5f782679..afef438e3726 100644
--- a/quarkus/tests/integration/src/test/resources/cache-ispn-asym-enc.xml
+++ b/quarkus/tests/integration/src/test/resources/cache-ispn-asym-enc.xml
@@ -85,6 +85,14 @@
             <expiration max-idle="3600000"/>
             <memory max-count="1000"/>
         </local-cache>
+        <local-cache name="crl">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <distributed-cache name="actionTokens" owners="2">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/quarkus/tests/integration/src/test/resources/fgap-realm.json b/quarkus/tests/integration/src/test/resources/fgap-realm.json
new file mode 100644
index 000000000000..ee652c450310
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/fgap-realm.json
@@ -0,0 +1,2685 @@
+{
+  "id" : "ee647898-02d3-43d8-ab16-afa8189e3c1b",
+  "realm" : "fgap",
+  "displayName" : "",
+  "displayNameHtml" : "",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 300,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "bruteForceStrategy" : "MULTIPLE",
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "1e9e453a-3534-427d-bcec-2f1da3301731",
+      "name" : "superadmin",
+      "description" : "",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "ee647898-02d3-43d8-ab16-afa8189e3c1b",
+      "attributes" : { }
+    }, {
+      "id" : "10b9800f-c6a7-4132-9cbd-933a9c0aba54",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "ee647898-02d3-43d8-ab16-afa8189e3c1b",
+      "attributes" : { }
+    }, {
+      "id" : "9a17b9fd-d5a4-4a3f-9aef-6e06c3813609",
+      "name" : "default-roles-fgap",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "manage-account", "view-profile" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "ee647898-02d3-43d8-ab16-afa8189e3c1b",
+      "attributes" : { }
+    }, {
+      "id" : "0a5d5dd4-80f4-4a89-bbc5-05c25c324548",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "ee647898-02d3-43d8-ab16-afa8189e3c1b",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "realm-management" : [ {
+        "id" : "44ebd573-80cc-4aac-94cc-7b5fed5a5752",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "5dce09b9-ff5d-47a2-89b3-aaa6fa3723da",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "8a205519-8d79-4981-8ec0-1850ead78fbd",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "88241730-ac87-4fbe-9354-f5ba62749644",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "7bb7d38b-34f9-41a1-8f04-b971fc5fdfcc",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "a02238fc-aa0e-4d61-a03b-c688223d789f",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "8f54306c-250f-46fd-be3a-2a623ddb2501",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "d5067def-2a9b-49ed-9569-a3e7e299cb37",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "47c161b1-8423-4d54-9cc8-3822b6b98b06",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "ab7c58e2-72d6-4ae6-b8c4-45e30e45d804",
+        "name" : "realm-admin",
+        "description" : "${role_realm-admin}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "view-users", "view-clients", "impersonation", "create-client", "manage-authorization", "query-users", "view-identity-providers", "manage-users", "query-groups", "view-realm", "manage-events", "query-realms", "query-clients", "view-events", "manage-identity-providers", "manage-realm", "manage-clients", "view-authorization" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "28a2119a-515e-4e42-9c68-cc48382f6e81",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "10f6be92-e13c-48d6-9201-14cdfc3a7bfd",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "f79e9d10-54e2-4f78-86f3-cd553bd11882",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "cfb4ef5a-8880-4dc2-86d7-2cf903aeeef4",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "2288eaa3-27e9-4ea3-9d92-a27664538831",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "9a25915a-cbc4-478c-b1c2-11b70a3938e8",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "ee43ee4a-a796-4983-829e-3adb8bd59588",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "7ddd9536-894b-48f8-89bc-9b92e7b1c2c4",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      }, {
+        "id" : "bd013748-9aa8-4678-be35-52e879c62853",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+        "attributes" : { }
+      } ],
+      "admin-permissions" : [ {
+        "id" : "d10b91dc-e3fd-4830-b3eb-fbc49282a7a1",
+        "name" : "uma_protection",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "f47487ff-83c0-4113-9085-96daa13c2e17",
+        "attributes" : { }
+      } ],
+      "security-admin-console" : [ ],
+      "admin-cli" : [ ],
+      "account-console" : [ ],
+      "broker" : [ {
+        "id" : "ab9a5187-f944-47a1-a2c2-e45d366b1fdb",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c45e8514-ac85-44fc-af1e-62c5ba695404",
+        "attributes" : { }
+      } ],
+      "account" : [ {
+        "id" : "8fdd6711-036f-48db-84bc-f91e81cdfd6b",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "08fcc9da-a1f2-40ba-84e4-2fd2a8beed56",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "cb580bf8-051e-490b-9f31-064b8212c3ec",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "03e91924-a7e8-4037-9c93-951493d6f56e",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "fdf93c8b-596d-475b-bfb6-6fd2a7b9e33f",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "85566558-6b07-446e-8a2d-158c24f955b2",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "929a2029-ce4e-401d-8d0b-99eb49ede4f4",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      }, {
+        "id" : "8521116c-cf8f-4286-974d-f5bbd8028bfe",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ {
+    "id" : "2ebd7f6a-fdc8-484d-a1d0-5b00cdfe3aa6",
+    "name" : "AT",
+    "path" : "/AT",
+    "subGroups" : [ ],
+    "attributes" : { },
+    "realmRoles" : [ ],
+    "clientRoles" : { }
+  }, {
+    "id" : "01628061-335b-45da-932d-10e9861581f5",
+    "name" : "DE",
+    "path" : "/DE",
+    "subGroups" : [ ],
+    "attributes" : { },
+    "realmRoles" : [ ],
+    "clientRoles" : { }
+  }, {
+    "id" : "0e267e53-749f-4a04-802d-3b806dc3cb76",
+    "name" : "DUA",
+    "path" : "/DUA",
+    "subGroups" : [ {
+      "id" : "8dd52d49-d70f-47a8-b799-aec00104fde8",
+      "name" : "AT-DUA",
+      "path" : "/DUA/AT-DUA",
+      "parentId" : "0e267e53-749f-4a04-802d-3b806dc3cb76",
+      "subGroups" : [ ],
+      "attributes" : { },
+      "realmRoles" : [ ],
+      "clientRoles" : { }
+    }, {
+      "id" : "16fa4dc9-55f7-4d07-9080-87cfee74c6f5",
+      "name" : "DE-DUA",
+      "path" : "/DUA/DE-DUA",
+      "parentId" : "0e267e53-749f-4a04-802d-3b806dc3cb76",
+      "subGroups" : [ ],
+      "attributes" : { },
+      "realmRoles" : [ ],
+      "clientRoles" : { }
+    }, {
+      "id" : "922706c6-68af-47d8-9551-a32c92c858f8",
+      "name" : "UK-DUA",
+      "path" : "/DUA/UK-DUA",
+      "parentId" : "0e267e53-749f-4a04-802d-3b806dc3cb76",
+      "subGroups" : [ ],
+      "attributes" : { },
+      "realmRoles" : [ ],
+      "clientRoles" : { }
+    } ],
+    "attributes" : { },
+    "realmRoles" : [ ],
+    "clientRoles" : {
+      "realm-management" : [ "query-groups", "query-clients", "query-users" ]
+    }
+  }, {
+    "id" : "2ca5b429-4d90-4952-9412-fa1c1d857f2a",
+    "name" : "UK",
+    "path" : "/UK",
+    "subGroups" : [ ],
+    "attributes" : { },
+    "realmRoles" : [ ],
+    "clientRoles" : { }
+  } ],
+  "defaultRole" : {
+    "id" : "9a17b9fd-d5a4-4a3f-9aef-6e06c3813609",
+    "name" : "default-roles-fgap",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "ee647898-02d3-43d8-ab16-afa8189e3c1b"
+  },
+  "adminPermissionsClient" : {
+    "id" : "f47487ff-83c0-4113-9085-96daa13c2e17",
+    "clientId" : "admin-permissions"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "9786d2ca-6e00-4e5e-ae18-338ddc8106c6",
+    "username" : "at-dua-0",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805607623,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "8e62d04c-e44c-481e-b44b-35782f2e3d37",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805631751,
+      "secretData" : "{\"value\":\"5MSlZysmkGxviggmq3KooUoIH6/SM6JmO835Kwm5lqQ=\",\"salt\":\"5uHrZc1/GXBV8JBfHA8TSA==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/AT-DUA" ]
+  }, {
+    "id" : "b2155c27-016e-45c4-a52a-3d1d6eb13554",
+    "username" : "at-dua-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805613636,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "bcfa8d6a-1ae8-443c-abbb-e3202859a83f",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805622493,
+      "secretData" : "{\"value\":\"DIjtUGeu+GXY07IHfvPHdgNlM9cAIwDyD1NSYu+QKgA=\",\"salt\":\"9WnseqpK6lhz3FeS6EKkzQ==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/AT-DUA" ]
+  }, {
+    "id" : "b464242c-06bc-488a-b2f8-00d06d57775f",
+    "username" : "at-user-0",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805572107,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/AT" ]
+  }, {
+    "id" : "657b97e5-3404-4b96-a092-6fa26f188a53",
+    "username" : "at-user-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805578209,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/AT" ]
+  }, {
+    "id" : "65c2365a-8b03-4c6e-9c46-d6d9e9b9fc78",
+    "username" : "at-user-2",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805599455,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/AT" ]
+  }, {
+    "id" : "02b79415-b1ec-4925-bc51-aa6f1d407735",
+    "username" : "de-dua-0",
+    "firstName" : "de-dua-0",
+    "lastName" : "d",
+    "email" : "de-dua-0@fgap.com",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805490979,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "17db31f1-23cd-4dcb-8e51-087990a56e8e",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805650789,
+      "secretData" : "{\"value\":\"ebBNhoeR2mBwDYriHKv9wl0OtlK5gxNQKQfKbWDdnBE=\",\"salt\":\"AdxCCTnp/6HUoBOI6UofxA==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/DE-DUA" ]
+  }, {
+    "id" : "0f817451-047c-4aea-bba9-8adbc6a5a13f",
+    "username" : "de-dua-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805497839,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "3a2b59b1-7c32-4666-bfb1-5146c22ca73b",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805664705,
+      "secretData" : "{\"value\":\"cyqenxAdX+jXsh+uZ5A+ad4OxVuMytzuLINprYilZPU=\",\"salt\":\"k+gFlxs3t0PphjyOkmbzJw==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/DE-DUA" ]
+  }, {
+    "id" : "c4dbf75b-4134-4fa4-ad14-21f790987456",
+    "username" : "de-user-0",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805450207,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DE" ]
+  }, {
+    "id" : "f8eca38f-e5c1-4c16-9417-fed056de2e67",
+    "username" : "de-user-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805457226,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DE" ]
+  }, {
+    "id" : "49e09fde-27da-4cd9-9fe3-2452317de37e",
+    "username" : "de-user-2",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805463925,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DE" ]
+  }, {
+    "id" : "f28e425f-794a-42f5-9b01-821009c4eac9",
+    "username" : "service-account-admin-permissions",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743808501834,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "admin-permissions",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "clientRoles" : {
+      "admin-permissions" : [ "uma_protection" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "97f85715-a852-4ba5-9c9a-0cfabd61ef9a",
+    "username" : "uk-dua-0",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805549803,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "b2e3961c-e7c0-43a1-a8be-e6109002ce15",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805688654,
+      "secretData" : "{\"value\":\"HNX8ziKwU78TsQJRbJekPyuchUAb5QuVcWM82zdMp7E=\",\"salt\":\"+18TIMAq4a/Jdrxensoz4w==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/UK-DUA" ]
+  }, {
+    "id" : "13eb16fc-deea-44e3-b431-a5a3f18598b4",
+    "username" : "uk-dua-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805558506,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "f167a08f-f7a2-4fcf-8b8f-150157184936",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1743805700815,
+      "secretData" : "{\"value\":\"JGwr39/68ZxcEZVkWIvh/1opfIuJq2Uk5HcoolfZa7U=\",\"salt\":\"1RlibyY8kAgrGNUPrU5rTA==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/DUA/UK-DUA" ]
+  }, {
+    "id" : "65c0c2f1-9640-48ad-84eb-cee8d4ed242d",
+    "username" : "uk-user-0",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805517953,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/UK" ]
+  }, {
+    "id" : "6da12c8d-30fc-4e60-925f-1f16bf14c524",
+    "username" : "uk-user-1",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805524876,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/UK" ]
+  }, {
+    "id" : "5ae65259-b16c-4962-94f5-637c93072c90",
+    "username" : "uk-user-2",
+    "emailVerified" : false,
+    "createdTimestamp" : 1743805530104,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-fgap" ],
+    "notBefore" : 0,
+    "groups" : [ "/UK" ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "c6e9a2e9-cade-4748-a81d-21dc075d6d0b",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/fgap/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/fgap/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "6119cfad-e01d-4c5d-91f1-c3c8af93308d",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/fgap/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/fgap/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "eb77707a-cecc-4849-a68f-63a4aef11b9d",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "27891593-45b9-4671-913f-a22b5a4f1a3d",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "client.use.lightweight.access.token.enabled" : "true",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "f47487ff-83c0-4113-9085-96daa13c2e17",
+    "clientId" : "admin-permissions",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "KvcV6z3wlZLxmcj1EACnmBJVR4z12DCW",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : true,
+    "authorizationServicesEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "client.secret.creation.time" : "1743808500"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "service_account" ],
+    "optionalClientScopes" : [ ],
+    "authorizationSettings" : {
+      "allowRemoteResourceManagement" : true,
+      "policyEnforcementMode" : "ENFORCING",
+      "resources" : [ {
+        "name" : "Clients",
+        "type" : "Clients",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "view"
+        }, {
+          "name" : "map-roles-client-scope"
+        }, {
+          "name" : "map-roles"
+        }, {
+          "name" : "configure"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "map-roles-composite"
+        } ]
+      }, {
+        "name" : "Roles",
+        "type" : "Roles",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "map-role-composite"
+        }, {
+          "name" : "map-role-client-scope"
+        }, {
+          "name" : "map-role"
+        } ]
+      }, {
+        "name" : "Groups",
+        "type" : "Groups",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-members"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "manage-membership"
+        }, {
+          "name" : "view-members"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "impersonate-members"
+        } ]
+      }, {
+        "name" : "Users",
+        "type" : "Users",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-group-membership"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "impersonate"
+        }, {
+          "name" : "map-roles"
+        }, {
+          "name" : "manage"
+        } ]
+      }, {
+        "name" : "01628061-335b-45da-932d-10e9861581f5",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-members"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "manage-membership"
+        }, {
+          "name" : "view-members"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "impersonate-members"
+        } ]
+      }, {
+        "name" : "2ca5b429-4d90-4952-9412-fa1c1d857f2a",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-members"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "manage-membership"
+        }, {
+          "name" : "view-members"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "impersonate-members"
+        } ]
+      }, {
+        "name" : "2ebd7f6a-fdc8-484d-a1d0-5b00cdfe3aa6",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-members"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "manage-membership"
+        }, {
+          "name" : "view-members"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "impersonate-members"
+        } ]
+      }, {
+        "name" : "0e267e53-749f-4a04-802d-3b806dc3cb76",
+        "ownerManagedAccess" : false,
+        "attributes" : { },
+        "uris" : [ ],
+        "scopes" : [ {
+          "name" : "manage-members"
+        }, {
+          "name" : "view"
+        }, {
+          "name" : "manage-membership"
+        }, {
+          "name" : "view-members"
+        }, {
+          "name" : "manage"
+        }, {
+          "name" : "impersonate-members"
+        } ]
+      } ],
+      "policies" : [ {
+        "name" : "Allow UK DUA",
+        "description" : "",
+        "type" : "group",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "groups" : "[{\"path\":\"/DUA/UK-DUA\",\"extendChildren\":false}]",
+          "groupsClaim" : ""
+        }
+      }, {
+        "name" : "Allow DE DUA",
+        "description" : "",
+        "type" : "group",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "groups" : "[{\"path\":\"/DUA/DE-DUA\",\"extendChildren\":false}]",
+          "groupsClaim" : ""
+        }
+      }, {
+        "name" : "Only super admins",
+        "description" : "",
+        "type" : "role",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "fetchRoles" : "true",
+          "roles" : "[{\"id\":\"superadmin\",\"required\":false}]"
+        }
+      }, {
+        "name" : "Allow AT DUA",
+        "description" : "",
+        "type" : "group",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "groups" : "[{\"path\":\"/DUA/AT-DUA\",\"extendChildren\":false}]",
+          "groupsClaim" : ""
+        }
+      }, {
+        "name" : "Allow manage DE users",
+        "description" : "",
+        "type" : "scope",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "defaultResourceType" : "Groups",
+          "resources" : "[\"01628061-335b-45da-932d-10e9861581f5\"]",
+          "scopes" : "[\"manage-members\",\"view-members\",\"impersonate-members\"]",
+          "applyPolicies" : "[\"Allow DE DUA\"]"
+        }
+      }, {
+        "name" : "Allow manage UK users",
+        "description" : "",
+        "type" : "scope",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "defaultResourceType" : "Groups",
+          "resources" : "[\"2ca5b429-4d90-4952-9412-fa1c1d857f2a\"]",
+          "scopes" : "[\"manage-members\",\"view-members\",\"impersonate-members\"]",
+          "applyPolicies" : "[\"Allow UK DUA\"]"
+        }
+      }, {
+        "name" : "Allow manage AT users",
+        "description" : "",
+        "type" : "scope",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "defaultResourceType" : "Groups",
+          "resources" : "[\"2ebd7f6a-fdc8-484d-a1d0-5b00cdfe3aa6\"]",
+          "scopes" : "[\"manage-members\",\"view-members\",\"impersonate-members\"]",
+          "applyPolicies" : "[\"Allow AT DUA\"]"
+        }
+      }, {
+        "name" : "Do not allow DUA users",
+        "description" : "",
+        "type" : "scope",
+        "logic" : "POSITIVE",
+        "decisionStrategy" : "UNANIMOUS",
+        "config" : {
+          "defaultResourceType" : "Groups",
+          "resources" : "[\"0e267e53-749f-4a04-802d-3b806dc3cb76\"]",
+          "scopes" : "[\"manage-members\",\"view-members\",\"impersonate-members\"]",
+          "applyPolicies" : "[\"Only super admins\"]"
+        }
+      } ],
+      "scopes" : [ {
+        "name" : "manage-group-membership"
+      }, {
+        "name" : "map-roles-client-scope"
+      }, {
+        "name" : "configure"
+      }, {
+        "name" : "map-role"
+      }, {
+        "name" : "view-members"
+      }, {
+        "name" : "manage"
+      }, {
+        "name" : "impersonate-members"
+      }, {
+        "name" : "manage-members"
+      }, {
+        "name" : "view"
+      }, {
+        "name" : "manage-membership"
+      }, {
+        "name" : "impersonate"
+      }, {
+        "name" : "map-role-composite"
+      }, {
+        "name" : "map-roles"
+      }, {
+        "name" : "map-role-client-scope"
+      }, {
+        "name" : "map-roles-composite"
+      } ],
+      "decisionStrategy" : "UNANIMOUS",
+      "authorizationSchema" : {
+        "resourceTypes" : {
+          "Clients" : {
+            "type" : "Clients",
+            "scopes" : [ "map-roles-composite", "manage", "map-roles", "map-roles-client-scope", "view" ],
+            "scopeAliases" : { }
+          },
+          "Users" : {
+            "type" : "Users",
+            "scopes" : [ "manage", "map-roles", "view", "manage-group-membership", "impersonate" ],
+            "scopeAliases" : {
+              "view" : [ "view-members" ],
+              "manage" : [ "manage-members" ]
+            },
+            "groupType" : "Groups"
+          },
+          "Groups" : {
+            "type" : "Groups",
+            "scopes" : [ "manage", "view-members", "view", "manage-membership", "manage-members" ],
+            "scopeAliases" : { }
+          },
+          "Roles" : {
+            "type" : "Roles",
+            "scopes" : [ "map-role-client-scope", "map-role-composite", "map-role" ],
+            "scopeAliases" : { }
+          }
+        }
+      }
+    }
+  }, {
+    "id" : "c45e8514-ac85-44fc-af1e-62c5ba695404",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "true",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "bdf95b24-708b-42fc-92cd-a06694669e60",
+    "clientId" : "realm-management",
+    "name" : "${client_realm-management}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "true",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "8ec9ba6a-9703-410d-a8b1-d017da02660c",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/fgap/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/fgap/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "client.use.lightweight.access.token.enabled" : "true",
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "ab4ac585-3cb2-4c3c-9551-2ac304288c79",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "033f8c74-412c-4e98-82b0-87aabdc5603e",
+    "name" : "service_account",
+    "description" : "Specific scope for a client enabled for service accounts",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "05115273-6c8d-4892-b066-d5d0cd9b148c",
+      "name" : "Client IP Address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientAddress",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientAddress",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "430762dd-f83b-4a93-b6b5-bf774719d6a3",
+      "name" : "Client Host",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientHost",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientHost",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "8fbf030f-e463-4b33-8fa6-e048ab2ab1a5",
+      "name" : "Client ID",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "client_id",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "client_id",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "b246777b-65ff-43d5-a037-b138ff29c849",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "b859c53e-a359-41c2-aa5a-e996cd07d964",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "ce525038-7f54-4e82-b477-398039b84e74",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "5048c614-e899-44c3-b545-e124836259de",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "0ac1725b-1d4f-4e5e-bdb8-43c3a98d4a62",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "6af737bd-f24b-41ee-86da-b915f318aad2",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "introspection.token.claim" : "true",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  }, {
+    "id" : "da742774-7a1b-414d-87fd-a90fcb90188d",
+    "name" : "basic",
+    "description" : "OpenID Connect scope for add all basic claims to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "6085a6aa-ac25-47dc-8c2c-a38e9281672a",
+      "name" : "auth_time",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "AUTH_TIME",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "auth_time",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "386d2cbf-0592-4d7c-baf4-e6beaefa301c",
+      "name" : "sub",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-sub-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "0f217a36-350a-4469-b28f-68cf093a7797",
+    "name" : "organization",
+    "description" : "Additional claims about the organization a subject belongs to",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${organizationScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "c23eee58-e332-4ab8-95a9-38cd945a50e2",
+      "name" : "organization",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-organization-membership-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "organization",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "977a45d4-124e-494c-987c-c1b69914c95a",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "be4c06e5-ac2e-4e8d-80a7-b58341c4cf91",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "88ac3d31-49dd-4171-9e97-e093382cf67f",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "consent.screen.text" : "",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "a21605d4-33b2-47ea-81dd-1c33268b89d4",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "05d05635-595c-4904-b1f9-b54956b0bee5",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "6c1a8232-dedc-4484-afd3-85dc4755e12b",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "eb002b33-db61-4bb7-a424-7db4d346d0a7",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "2fbe14d2-f868-4c2e-88ca-5737d1285ef9",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "e49f9df4-6985-4dfd-a134-8b4debb80d7f",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "2b4bbee7-bcef-42cb-9964-83258abbaf7a",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "bc8214dc-0bdb-403e-9343-6babb1a67419",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "d8441fe9-21e6-45c0-83f9-9f414a8d814d",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "f413a6c0-df88-4096-8a0a-a3cd417c106f",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "db9faa6f-3fe4-4be7-9c1c-68f7cb69046f",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "d2467129-abff-4fd4-9d0e-25c2e92390ba",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "694d5ee1-f98a-4130-9804-1a3764b5f362",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "f6397df9-2da1-4cc2-acaf-a26c61ee2188",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ceda502b-72a4-4b4b-8bcb-a6da4eda1985",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "56dbd2ae-d386-4a02-b5d9-7d3d64719b1b",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "497b01e9-5fd5-4bfb-ace9-db8b98645248",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "54599f24-425f-4ee8-8d2d-36819a5d0f9a",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "63ec3262-5c01-4165-ac91-c9a0a102ad7b",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "9a8a9b85-d4bf-4494-9736-49458624f3e1",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "4561c046-46af-4317-bc74-6abc57b7ac1e",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  }, {
+    "id" : "e1030494-ab8b-449d-958e-8819cb32907c",
+    "name" : "roles",
+    "description" : "OpenID Connect scope for add user roles to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "consent.screen.text" : "${rolesScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "6b4174fb-402e-40a1-ae15-53276e3c61f5",
+      "name" : "client roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-client-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute" : "foo",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "resource_access.${client_id}.roles",
+        "jsonType.label" : "String",
+        "multivalued" : "true"
+      }
+    }, {
+      "id" : "b00a7d68-8158-4140-b7ca-cf5ea37f8298",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    }, {
+      "id" : "9e34052d-29fd-4e36-98fe-31a41b9a7ccc",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute" : "foo",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "realm_access.roles",
+        "jsonType.label" : "String",
+        "multivalued" : "true"
+      }
+    } ]
+  }, {
+    "id" : "95ecec8e-9a00-4fb7-8864-8c0c3eb127ba",
+    "name" : "saml_organization",
+    "description" : "Organization Membership",
+    "protocol" : "saml",
+    "attributes" : {
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "df58b5c9-57ea-4b5e-995a-5ee7f2fe16f2",
+      "name" : "organization",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-organization-membership-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ]
+  }, {
+    "id" : "eee6ec77-cc8e-43e5-8518-4b7d715db199",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "0f2c8b83-93f2-49c1-9f69-95b513a3c4ef",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "8f7bfed9-9278-4a29-b824-0c1233bd4977",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "role_list", "saml_organization", "profile", "email", "roles", "web-origins", "acr", "basic" ],
+  "defaultOptionalClientScopes" : [ "offline_access", "address", "phone", "microprofile-jwt", "organization" ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "d8ed147b-a91a-4682-861a-df3fd3899375",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "3dfaed7e-7ef3-4733-bdb7-7eef06edbd16",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-role-list-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-user-attribute-mapper", "oidc-usermodel-property-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper" ]
+      }
+    }, {
+      "id" : "c6b75964-b0f0-49ac-8b00-7a56c0448688",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "986dbe1c-db42-43cc-a222-cd28147c87db",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "24300042-46e8-49d2-8c07-1ecbc0e65c83",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "53313273-52b4-41f0-9198-63702a6e4c96",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "saml-user-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper", "saml-role-list-mapper" ]
+      }
+    }, {
+      "id" : "fa91f2b7-4f4b-4d6c-ab2e-ef09ebe83eae",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    }, {
+      "id" : "a93ed832-8852-478e-87c3-cf9807ee0dcd",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    } ],
+    "org.keycloak.userprofile.UserProfileProvider" : [ {
+      "id" : "caf100e1-f733-4557-af59-d656d8a06b43",
+      "providerId" : "declarative-user-profile",
+      "subComponents" : { },
+      "config" : {
+        "kc.user.profile.config" : [ "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"annotations\":{},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}]}" ]
+      }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "cf9ce0d9-4d42-4817-8c6f-f6ad182c1e51",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "2a7abc6b-084c-4646-8ff0-0e8252a99a52" ],
+        "secret" : [ "-fuZbRC-7EdJDFV0_M2g7hf95XIiIzBL4wTRkakqVTsalXOeHZD2Mry1LJOiyYv0hh1AV14JxAFKDmyOQCT67vlgHh0TJAWyDER93grVJ4SDjz6eVlHqeE2oQ_NWtrsAy-Wd28vKcf1ATSK19um5FUfa373BpZ7RW4ZRNaZsYfY" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    }, {
+      "id" : "9dd49a5c-69f3-4cdd-9709-121262f17ac0",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEowIBAAKCAQEAuJBbPWE4AVL917gdjSFRD++zlr1dPC2o9drII7/6gD9A5r9oGgbtusWsk7K1KMNCGhJpDWiBO3aJ9Auu+Fo4YLROWRCUOvrO93/cLo9IHD36DpA7LYUIcMUjWQv6kOXd3KnyHKdWA08niZIPv6x/X08P7cI8q+dTo6IIOxfK4OHci3lolMP6qHPobjBiR1W4200EwS0kB+QR3aW36chMdmJHHrQBUd5xEe16R6gT3OvktDVRHO1PHha1eFxV+vyh82Aq36WCRFKk8Dpf5B1M8Tnh6rl1wlHrBk+nsfnBa8LnpGMyEVVL3+0T7M5qq1c0lEroJvCyyYHeKfFcMtiCTQIDAQABAoIBAAcB61NS+yJ8IuL+lksMlK+jUFeTVgeZ/89h4KjdOg1Ssxii9AVoKPBaXzlcyil2v6F0yUqDvF0xHLJiG5RJyXIAHPXSitMLp2SlrqSRg4SxZIQ9o3mQrDR36Uxd7fdAoW7zTU8bZvxWLfA4iWK9XmxHq+YN/2nsrQ2XJXMOh4EiEZls4PSMPt8xCKeIiM0HXZaJrgaMfg6i4sdGYJl12uWH3CSp9eCVqu3IAMat8pFV+LBuvNnmU0EHOxIehVJcUuH0Q60e73l8kmuE2EE4ffYhkzQt1umZ7jVDsGEnRD9I3i4jF+Jy93qZTW/rzaECQhE2gwanQVKi0rOrmvbxPIECgYEA9OjAPUsZ4485CbKvxEJ/bF8yA0R/ufAkS9nkIdgXy17n9ZUsLaSOeuZTCyZA/jYJtdeUt8F/sC6nRhDiRLAEet0OoLWSKUuhSjXlsfBINGSvxBFzCHiY8fzIbbQzKclbzVH/ta++s6AF6rGnHtEqJx0Q9o0iIy103iuQvciq2g0CgYEAwOwEskab1tB7XJncf0gdYLtEivbwnbH2ywIqhIYgCD+jDU3ELuW6WZcHYTO+d54KvyR02GDkxcxlOrvpm4F4pa9kG0+i60wqgchYzCbYtXjDDtKNb8NiwdTfsJa28akj0mrd6aBu67XrlM0wikovNI2qvS+vwr4ZjtMgE+FDeUECgYAHAMjOd+FLooLNBjEEeapPHQG/GixU0ssW6Cof1aAIjrQvT46t13DDjuZ9ASEGo+DvNDTqdDwEe7EIzd7KfAYExWFvswF08Nax2oyw4+AMr3xfLOiPK3OkJ8hLasWzwjA/1MJtHZNka4T/ywiuVujPqYMcqbh6LQiUecZvxtcr2QKBgEXImeJKvDA19YmHdkTsNwQ4eRCzRlIkf5rrS6noQkn5iudTC/XSz1d81ASLDQiDuGtvqnxigB40UyGtu1Cuwo9cJB/k7I+kW3PanpQqMRVje1svOk4FJQHsGIXt3nsHrZd9ZIwPpk/I3FBU8Iv1TaH65JnOWAtfbCtHn0DRqPCBAoGBAO80EVXE6xVMirIAA5XYr8MLqqZBO2MpATweyaCsB/gBZWERDAd0Yn3JFKWnkaxP0oel9Ba/NYxounY9LE+rAbR360VG1eUvS1cQKuq9CtoiNDD7Al7PSFz5az65/u8Fi1arcQuGkyj/8zgap88efT8lFrMzrj+JdvO3vIcc3gP/" ],
+        "keyUse" : [ "SIG" ],
+        "certificate" : [ "MIIClzCCAX8CBgGWAuZyZDANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARib3NoMB4XDTI1MDQwNDIyMjExOVoXDTM1MDQwNDIyMjI1OVowDzENMAsGA1UEAwwEYm9zaDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALiQWz1hOAFS/de4HY0hUQ/vs5a9XTwtqPXayCO/+oA/QOa/aBoG7brFrJOytSjDQhoSaQ1ogTt2ifQLrvhaOGC0TlkQlDr6zvd/3C6PSBw9+g6QOy2FCHDFI1kL+pDl3dyp8hynVgNPJ4mSD7+sf19PD+3CPKvnU6OiCDsXyuDh3It5aJTD+qhz6G4wYkdVuNtNBMEtJAfkEd2lt+nITHZiRx60AVHecRHtekeoE9zr5LQ1URztTx4WtXhcVfr8ofNgKt+lgkRSpPA6X+QdTPE54eq5dcJR6wZPp7H5wWvC56RjMhFVS9/tE+zOaqtXNJRK6CbwssmB3inxXDLYgk0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAOP/Hc1AZjHit9aJZBYovcs0rwtQk0wlr/Gn/d0YUjqSt3uEOIxACaBh/G4e9IxxO524OLvJljiOh8sSBApUIkkjvbrIqsVIxX32D8AN6jj/NJBprbwPAplkLgqt0BBZS8+Rq7EfQyhZ8OYAfJEXb9POfvTKhtoX/9rT/nfI8CyxH81szBcSV66CkV7EZJ0SM1+w0h4Sji4jmOLN3NqeIwXOi5Ife6Lw+p7Q/zEMZQn3XC99/H8iGlDi64IVivFqn4xG9pensu2F/WDywLvlu27haDoMdrEApnWe16YNRERxzFEfmXbCcmOoY6zWDyOutbsP1AG+kvNaJZRNdw882bA==" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "86fbdced-2773-4fbb-8ed6-cded93c7e99a",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEogIBAAKCAQEAlBThejElEkWT7UF/7hfCY8fjxgeQKh7jvwpMBetquVa4aaJHXES9+n4UAPNI5aSl4yQMwaoMn7WVMGLnDV0lmtVKxScSca7Sg9Y9HRcMccyUDTeTmFEsIEIZlj+/ciPHcPXfQo6h1g1Ggp7cqL25gTmVsEiDDIKm4WvdXgxM0kRhxudzBDQ/pKT3HQ8DDajT5MytsK9vvEjKH1S8O1fWjciDm5aGJSyGHHst+KNjnrBUJjPg03YjGF/gCUPiPQLYjOyJscPs0J58X6YkHlQdDHmeTYoILSPy+B7DmwHvCMigL/MWJOirNuhVlBVsl57/spDW+Hi1AD4CiFtKKvIOzwIDAQABAoIBAAqYkefN83KiwuqDuNU/IvxD1eMaMHErI63MXVNBHLJlZ627XHLYQmXVtrW4stsn1Gzz6+vBsMSO2D2Nni3hH+s73u1LlfDHiy2+20GlIBFWi7OEag3IpSkrwav0JM1UjRViqpaXITJxYb3AA1cZuFfsWG80SRhQkwNnVgBAThDvktg4PTiuCs9ptmxHk18CzLXo5yNlrw99LwCA+H0Bwa+alrEO9xVJJjhD7U3JMQZB329TeSNMjghUPWJeDBUaGiPgDCkxW8RuFFNGZJwQQybl4Oyj8Am/+/BDYfVPLXhiwR9JbFVt/P5o76eUSoMyBG/snZ8l7M1xYwVAVTk4qYUCgYEAw5uV44o2y829saGLdWqxePUbMJlAwJgcPhlILiaze/asyYuLWvXHnqJyiomZ2BrvVR6y2UHPOB5HYyzwhhceQUwPp9pS8sYutLcn5I4PJbAS3lsLknFXioFkyyOR3WIdcyY8zDIkCzgfXKbTsWCFDDFVDlH6jhrAyg767arzXxsCgYEAwczthwT9PBQEBaPNKOLMykner8MSusJxy4BqA3pNdppCcTtFN6wsnx9MDaeCzMCnmfHrLo8FbCSwNYhsqkkX62e4fvdEKRTmJPzgoDe0PH2QKoGHBVKMMyuezMi3BU9r59fCe7AYlrF2Ss+eCb5mspK6DEzhdDQBr3IRwMdnpl0CgYAoySsyu6H7UtXn0NhETk/c+baGpp3SyqSw6hKb1OP9yAx1JcyT1cWetR6O9mwGnG8k33bJSCiN+fpGmps4Sl+7m8Fz7Vj4WAxrD/mYdWqBIDp+9JrwGQP41EwQ80S51XhwhxuMNDRBxpz7c6mWRZrYVPz4NG267acfOoplvgxq2wKBgAGb0dztDa0R/XaOhYVxXIHRWyfaVq12L7ugtUCSI1J4tVR7SXfM1hH8EIWMfml0r+93MpyQU1sycsP+/efr82bg1Yc4RjiRE9f6wWKTE8vsvuWbbaN9q+xA0HCiueIxZpPmFpcwPwQBNRop3wX1rqSM0z6G5NgyFlF+gOc4wIOBAoGAaSiaHfyTYrSCwCTZoBWcLyDW1hlDOgLbGAbaLUyD5a9ogwLF2mU/2518+AFNU0y+fn7/FzF9/uqPtvaD9sjeY+Cb+On5pRckwCIXwMyd/Y7YVx08lq0QV/QHRGBi+Gy5uW+MppB321eIOw6+ykRtuVMMoVK95q8kS0UIdeKiGjY=" ],
+        "keyUse" : [ "ENC" ],
+        "certificate" : [ "MIIClzCCAX8CBgGWAuZz1zANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARib3NoMB4XDTI1MDQwNDIyMjExOVoXDTM1MDQwNDIyMjI1OVowDzENMAsGA1UEAwwEYm9zaDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJQU4XoxJRJFk+1Bf+4XwmPH48YHkCoe478KTAXrarlWuGmiR1xEvfp+FADzSOWkpeMkDMGqDJ+1lTBi5w1dJZrVSsUnEnGu0oPWPR0XDHHMlA03k5hRLCBCGZY/v3Ijx3D130KOodYNRoKe3Ki9uYE5lbBIgwyCpuFr3V4MTNJEYcbncwQ0P6Sk9x0PAw2o0+TMrbCvb7xIyh9UvDtX1o3Ig5uWhiUshhx7LfijY56wVCYz4NN2Ixhf4AlD4j0C2IzsibHD7NCefF+mJB5UHQx5nk2KCC0j8vgew5sB7wjIoC/zFiToqzboVZQVbJee/7KQ1vh4tQA+AohbSiryDs8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEADCs7y9DT8+tRvMtoESFHY6S1B6Pk6q8f+YCuXPd5VTrvA9nL5+ExLsdCrS5B81WjefN0ngPOPy2s1gTDgCw5NyW6I7Bqf60axH5l+y5Umo0IbjdAtmq8Lb8YRGqvTel4gJ/ZX5HLLkvyPEaNkwFNVNHa6yHcrnzxS808v+F2DrlvcPDT0s1sWvE4WVLTC712qntJsX9i3yb8WOqtRY3vQEdv67MxFvxTsmrf6rYpIal9dPOc1R+5V8F/kwLN3o/ihrvxJ4GcBAedjEGeiTQUMCSaMR32z3K9Y5wDj9dFcq9gw27B3q1I6vRb4A+Oy1oXplCLBAYAujilbN0WAIJtvw==" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    }, {
+      "id" : "f1a2cb1c-316b-43f7-8f6f-a2269d860811",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "6a835ddf-5514-4bb8-a337-c6233f5cd1f4" ],
+        "secret" : [ "y-1diVvG_ifu5U-BD1SmCA" ],
+        "priority" : [ "100" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "7f3bca34-6ded-4981-9c6d-b39581ec0949",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1f6e7a11-6273-41a5-bb56-f2b502a2a4f5",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "77962ca5-8004-44ff-8fc2-0aeaa4299442",
+    "alias" : "Browser - Conditional Organization",
+    "description" : "Flow to determine if the organization identity-first login is to be used",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "organization",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "b23d1943-e5cb-4fcc-aafa-891fa5481b68",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "b67150f5-6192-43bc-9c7a-4de541066c95",
+    "alias" : "First Broker Login - Conditional Organization",
+    "description" : "Flow to determine if the authenticator that adds organization members is to be used",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "idp-add-organization-member",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7a1542fc-ffd5-4a9e-8e40-e21522663365",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "3e844f66-ada7-43a7-8ef9-c47d1109f31a",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "ca097066-2554-490c-9262-8acc0dd09c1f",
+    "alias" : "Organization",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional Organization",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "c6aa9361-fd5e-443b-8cc6-04ada45877a7",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "38b8f028-208a-4f49-b66c-c9131f3dd16e",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "4166caee-846c-42e9-adb7-d2af49e08db3",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "3ed4b7bd-5495-4ea6-9c3f-7f0d31708b99",
+    "alias" : "browser",
+    "description" : "Browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 26,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Organization",
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "cbcd226f-697f-4ac6-ba55-024536eb75bb",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "5996c01c-0c46-4ef2-be75-9396f147791f",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "de9f2cbf-1b47-4d3a-b182-b66c6088818f",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "7a5a4379-5bd9-46b2-870f-beda0b1864b6",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 50,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First Broker Login - Conditional Organization",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "37a8aa38-9b3c-41d4-b494-c3822cca2bf9",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "13b8f7b6-a656-4828-aa7c-974a3ae1bcf3",
+    "alias" : "registration",
+    "description" : "Registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "08020d82-e9c9-4dc5-bec1-8b7bb1169f53",
+    "alias" : "registration form",
+    "description" : "Registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-terms-and-conditions",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 70,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "bd4bbe8b-9812-4149-9962-eb323ebc7235",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "2c585025-c006-4b22-a4c5-896d1a2708e4",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "17879a73-fc56-43f0-ae99-10d3b57d4c6a",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "85fa981e-6c3b-4868-8fd1-a528a779840c",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_PROFILE",
+    "name" : "Verify Profile",
+    "providerId" : "VERIFY_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 90,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "clientOfflineSessionMaxLifespan" : "0",
+    "oauth2DevicePollingInterval" : "5",
+    "clientSessionIdleTimeout" : "0",
+    "clientOfflineSessionIdleTimeout" : "0",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false",
+    "cibaExpiresIn" : "120",
+    "oauth2DeviceCodeLifespan" : "600",
+    "saml.signature.algorithm" : "",
+    "parRequestUriLifespan" : "60",
+    "clientSessionMaxLifespan" : "0",
+    "frontendUrl" : "",
+    "acr.loa.map" : "{}"
+  },
+  "keycloakVersion" : "999.0.0-SNAPSHOT",
+  "userManagedAccessAllowed" : false,
+  "organizationsEnabled" : false,
+  "verifiableCredentialsEnabled" : false,
+  "adminPermissionsEnabled" : true,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+}
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/keystore b/quarkus/tests/integration/src/test/resources/keystore
index ad5c4a32ac1f..0cb283cb23cd 100644
Binary files a/quarkus/tests/integration/src/test/resources/keystore and b/quarkus/tests/integration/src/test/resources/keystore differ
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdmin.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdmin.approved.txt
new file mode 100644
index 000000000000..d8b849bd01a5
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdmin.approved.txt
@@ -0,0 +1,18 @@
+Commands for bootstrapping admin access
+
+Usage:
+
+kc.sh bootstrap-admin [OPTIONS] [COMMAND]
+
+Commands for bootstrapping admin access
+
+Options:
+
+-h, --help           This help message.
+--no-prompt          Run non-interactive without prompting
+-v, --verbose        Print out error details when running this command.
+
+Commands:
+
+  user     Add an admin user with a password
+  service  Add an admin service account
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminService.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminService.approved.txt
new file mode 100644
index 000000000000..5413171dd235
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminService.approved.txt
@@ -0,0 +1,252 @@
+Add an admin service account
+
+Usage:
+
+kc.sh bootstrap-admin service [OPTIONS]
+
+Add an admin service account
+
+Options:
+
+--client-id <id>     Client id, defaults to temp-admin
+--client-id:env <ID> Environment variable name for the client id
+--client-secret:env <SECRET>
+                     Environment variable name for the client secret
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--no-prompt          Run non-interactive without prompting
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+-v, --verbose        Print out error details when running this command.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+
+Tracing:
+
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminUser.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminUser.approved.txt
new file mode 100644
index 000000000000..1c6871973ff7
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBootstrapAdminUser.approved.txt
@@ -0,0 +1,254 @@
+Add an admin user with a password
+
+Usage:
+
+kc.sh bootstrap-admin user [OPTIONS]
+
+Add an admin user with a password
+
+Options:
+
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--no-prompt          Run non-interactive without prompting
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+--password:env <PASSWORD>
+                     Environment variable name for the admin user password
+--username <username>
+                     Username of admin user, defaults to temp-admin
+--username:env <USERNAME>
+                     Environment variable name for the admin username
+-v, --verbose        Print out error details when running this command.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+
+Tracing:
+
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBuildHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBuildHelp.approved.txt
index 7a4a024d8ede..6ec640018de2 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBuildHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testBuildHelp.approved.txt
@@ -26,10 +26,24 @@ Database:
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
 
+Database - additional datasources (Preview):
+
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testDefaultToHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testDefaultToHelp.approved.txt
index 6ded000f0905..fbcfc440d4ec 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testDefaultToHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testDefaultToHelp.approved.txt
@@ -30,6 +30,13 @@ Commands:
   bootstrap-admin         Commands for bootstrapping admin access
     user                  Add an admin user with a password
     service               Add an admin service account
+  update-compatibility    [Preview] Tool for configuration compatibility.
+    check                 Checks if the metadata is compatible with the current
+                            configuration. A zero exit code means a rolling
+                            update is possible between old and the current
+                            metadata.
+    metadata              Stores the metadata necessary to determine if a
+                            configuration is compatible.
 
 Examples:
 
@@ -53,4 +60,4 @@ Examples:
 production.
 
 Use "kc.sh start --help" for the available options when starting the server.
-Use "kc.sh <command> --help" for more information about other commands.
\ No newline at end of file
+Use "kc.sh <command> --help" for more information about other commands.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
index 73786b2bab4b..4bdffa6a02db 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
@@ -29,8 +29,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -59,10 +65,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -80,15 +137,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -98,12 +172,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -122,6 +197,12 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -159,8 +240,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
index 031afe59c33e..efb5c13812ff 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
@@ -29,8 +29,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -59,10 +65,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -80,15 +137,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -98,12 +172,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -122,6 +197,16 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -133,6 +218,10 @@ Logging:
                      Include tracing information in the console log. If the 'log-console-format'
                        option is specified, this option has no effect. Default: true. Available
                        only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
 --log-console-level <level>
                      Set the log level for the console handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -146,6 +235,14 @@ Logging:
                        handler is activated.
 --log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                        only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
 --log-file-format <format>
                      Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                        SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
@@ -154,6 +251,10 @@ Logging:
                      Include tracing information in the file log. If the 'log-file-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
 --log-file-level <level>
                      Set the log level for the file handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -176,6 +277,20 @@ Logging:
 --log-syslog-app-name <name>
                      Set the app name used when formatting the message in RFC5424 format. Default:
                        keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
 --log-syslog-endpoint <host:port>
                      Set the IP address and port of the Syslog server. Default: localhost:514.
                        Available only when Syslog is activated.
@@ -186,6 +301,10 @@ Logging:
                      Include tracing information in the Syslog. If the 'log-syslog-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
 --log-syslog-level <level>
                      Set the log level for the Syslog handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -234,7 +353,7 @@ Tracing:
                        is enabled.
 --tracing-sampler-ratio <ratio>
                      OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
-                       double value in interval <0,1). Default: 1.0. Available only when Tracing is
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                        enabled.
 --tracing-sampler-type <type>
                      OpenTelemetry sampler to use for tracing. Possible values are: always_on,
@@ -246,18 +365,18 @@ Tracing:
                        the 'tracing-resource-attributes' property. Default: keycloak. Available
                        only when Tracing is enabled.
 
-Events (Preview):
+Events:
 
 --event-metrics-user-enabled <true|false>
-                     Preview: Create metrics based on user events. Default: false. Available only
-                       when metrics are enabled and feature user-event-metrics is enabled.
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
 --event-metrics-user-events <events>
-                     Preview: Comma-separated list of events to be collected for user event
-                       metrics. Reduce the number of metrics. If empty or not set, all events
-                       create a metric. Possible values are:<...>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
 --event-metrics-user-tags <tags>
-                     Preview: Comma-separated list of tags to be collected for user event metrics.
-                       By default only 'realm' is enabled to avoid a high metrics cardinality.
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
                        Possible values are: realm, idp, clientId. Default: realm. Available only
                        when user event metrics are enabled.
 
@@ -265,8 +384,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelp.approved.txt
index 6ded000f0905..fbcfc440d4ec 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelp.approved.txt
@@ -30,6 +30,13 @@ Commands:
   bootstrap-admin         Commands for bootstrapping admin access
     user                  Add an admin user with a password
     service               Add an admin service account
+  update-compatibility    [Preview] Tool for configuration compatibility.
+    check                 Checks if the metadata is compatible with the current
+                            configuration. A zero exit code means a rolling
+                            update is possible between old and the current
+                            metadata.
+    metadata              Stores the metadata necessary to determine if a
+                            configuration is compatible.
 
 Examples:
 
@@ -53,4 +60,4 @@ Examples:
 production.
 
 Use "kc.sh start --help" for the available options when starting the server.
-Use "kc.sh <command> --help" for more information about other commands.
\ No newline at end of file
+Use "kc.sh <command> --help" for more information about other commands.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelpShort.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelpShort.approved.txt
index 6ded000f0905..fbcfc440d4ec 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelpShort.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testHelpShort.approved.txt
@@ -30,6 +30,13 @@ Commands:
   bootstrap-admin         Commands for bootstrapping admin access
     user                  Add an admin user with a password
     service               Add an admin service account
+  update-compatibility    [Preview] Tool for configuration compatibility.
+    check                 Checks if the metadata is compatible with the current
+                            configuration. A zero exit code means a rolling
+                            update is possible between old and the current
+                            metadata.
+    metadata              Stores the metadata necessary to determine if a
+                            configuration is compatible.
 
 Examples:
 
@@ -53,4 +60,4 @@ Examples:
 production.
 
 Use "kc.sh start --help" for the available options when starting the server.
-Use "kc.sh <command> --help" for more information about other commands.
\ No newline at end of file
+Use "kc.sh <command> --help" for more information about other commands.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
index 0bd8ce473e07..928c7d9189cc 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
@@ -29,8 +29,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -59,10 +65,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -80,15 +137,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -98,12 +172,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -122,6 +197,12 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -159,8 +240,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
index 4b1a91557c31..031e9e1f6b3c 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
@@ -29,8 +29,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -59,10 +65,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -80,15 +137,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -98,12 +172,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -122,6 +197,16 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -133,6 +218,10 @@ Logging:
                      Include tracing information in the console log. If the 'log-console-format'
                        option is specified, this option has no effect. Default: true. Available
                        only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
 --log-console-level <level>
                      Set the log level for the console handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -146,6 +235,14 @@ Logging:
                        handler is activated.
 --log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                        only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
 --log-file-format <format>
                      Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                        SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
@@ -154,6 +251,10 @@ Logging:
                      Include tracing information in the file log. If the 'log-file-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
 --log-file-level <level>
                      Set the log level for the file handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -176,6 +277,20 @@ Logging:
 --log-syslog-app-name <name>
                      Set the app name used when formatting the message in RFC5424 format. Default:
                        keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
 --log-syslog-endpoint <host:port>
                      Set the IP address and port of the Syslog server. Default: localhost:514.
                        Available only when Syslog is activated.
@@ -186,6 +301,10 @@ Logging:
                      Include tracing information in the Syslog. If the 'log-syslog-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
 --log-syslog-level <level>
                      Set the log level for the Syslog handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -234,7 +353,7 @@ Tracing:
                        is enabled.
 --tracing-sampler-ratio <ratio>
                      OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
-                       double value in interval <0,1). Default: 1.0. Available only when Tracing is
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                        enabled.
 --tracing-sampler-type <type>
                      OpenTelemetry sampler to use for tracing. Possible values are: always_on,
@@ -246,18 +365,18 @@ Tracing:
                        the 'tracing-resource-attributes' property. Default: keycloak. Available
                        only when Tracing is enabled.
 
-Events (Preview):
+Events:
 
 --event-metrics-user-enabled <true|false>
-                     Preview: Create metrics based on user events. Default: false. Available only
-                       when metrics are enabled and feature user-event-metrics is enabled.
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
 --event-metrics-user-events <events>
-                     Preview: Comma-separated list of events to be collected for user event
-                       metrics. Reduce the number of metrics. If empty or not set, all events
-                       create a metric. Possible values are:<...>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
 --event-metrics-user-tags <tags>
-                     Preview: Comma-separated list of tags to be collected for user event metrics.
-                       By default only 'realm' is enabled to avoid a high metrics cardinality.
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
                        Possible values are: realm, idp, clientId. Default: realm. Available only
                        when user event metrics are enabled.
 
@@ -265,8 +384,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
index ac67357b03ff..76fceac57670 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
@@ -32,22 +32,10 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
---cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
---cache-embedded-mtls-key-store-file <file>
-                     The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
---cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
---cache-embedded-mtls-trust-store-file <file>
-                     The Truststore file path. It should contain the trusted certificates or the
-                       Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
---cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -65,8 +53,8 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the users cache.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 
 Config:
 
@@ -83,8 +71,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -113,10 +107,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -223,15 +268,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -241,12 +303,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -267,7 +330,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -288,6 +352,12 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -325,8 +395,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
index cf88f503d6ea..936d9178e9b5 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
@@ -32,22 +32,51 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
 --cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
 --cache-embedded-mtls-key-store-file <file>
                      The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
 --cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-file <file>
                      The Truststore file path. It should contain the trusted certificates or the
                        Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -68,8 +97,8 @@ Cache:
                        Available only when metrics are enabled.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 --cache-remote-password <password>
                      The password for the authentication to the external Infinispan cluster. It is
                        optional if connecting to an unsecure external Infinispan cluster. If the
@@ -89,10 +118,10 @@ Cache:
                        only when remote host is set.
 --cache-stack <stack>
                      Define the default stack to use for cluster communication and node discovery.
-                       Possible values are: jdbc-ping, kubernetes, jdbc-ping-udp (deprecated), tcp
-                       (deprecated), udp (deprecated), ec2 (deprecated), azure (deprecated), google
-                       (deprecated), or a custom one. Default: jdbc-ping. Available only when
-                       'cache' type is set to 'ispn'.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
 
 Config:
 
@@ -109,8 +138,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -139,10 +174,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -258,15 +344,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -276,12 +379,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -302,7 +406,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -323,6 +428,16 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -334,6 +449,10 @@ Logging:
                      Include tracing information in the console log. If the 'log-console-format'
                        option is specified, this option has no effect. Default: true. Available
                        only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
 --log-console-level <level>
                      Set the log level for the console handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -347,6 +466,14 @@ Logging:
                        handler is activated.
 --log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                        only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
 --log-file-format <format>
                      Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                        SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
@@ -355,6 +482,10 @@ Logging:
                      Include tracing information in the file log. If the 'log-file-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
 --log-file-level <level>
                      Set the log level for the file handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -377,6 +508,20 @@ Logging:
 --log-syslog-app-name <name>
                      Set the app name used when formatting the message in RFC5424 format. Default:
                        keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
 --log-syslog-endpoint <host:port>
                      Set the IP address and port of the Syslog server. Default: localhost:514.
                        Available only when Syslog is activated.
@@ -387,6 +532,10 @@ Logging:
                      Include tracing information in the Syslog. If the 'log-syslog-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
 --log-syslog-level <level>
                      Set the log level for the Syslog handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -435,7 +584,7 @@ Tracing:
                        is enabled.
 --tracing-sampler-ratio <ratio>
                      OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
-                       double value in interval <0,1). Default: 1.0. Available only when Tracing is
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                        enabled.
 --tracing-sampler-type <type>
                      OpenTelemetry sampler to use for tracing. Possible values are: always_on,
@@ -447,18 +596,18 @@ Tracing:
                        the 'tracing-resource-attributes' property. Default: keycloak. Available
                        only when Tracing is enabled.
 
-Events (Preview):
+Events:
 
 --event-metrics-user-enabled <true|false>
-                     Preview: Create metrics based on user events. Default: false. Available only
-                       when metrics are enabled and feature user-event-metrics is enabled.
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
 --event-metrics-user-events <events>
-                     Preview: Comma-separated list of events to be collected for user event
-                       metrics. Reduce the number of metrics. If empty or not set, all events
-                       create a metric. Possible values are:<...>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
 --event-metrics-user-tags <tags>
-                     Preview: Comma-separated list of tags to be collected for user event metrics.
-                       By default only 'realm' is enabled to avoid a high metrics cardinality.
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
                        Possible values are: realm, idp, clientId. Default: realm. Available only
                        when user event metrics are enabled.
 
@@ -466,8 +615,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
index a2d53dce64f2..71cfbf9a4bbc 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
@@ -33,22 +33,51 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
 --cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
 --cache-embedded-mtls-key-store-file <file>
                      The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
 --cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-file <file>
                      The Truststore file path. It should contain the trusted certificates or the
                        Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -66,14 +95,14 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the users cache.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 --cache-stack <stack>
                      Define the default stack to use for cluster communication and node discovery.
-                       Possible values are: jdbc-ping, kubernetes, jdbc-ping-udp (deprecated), tcp
-                       (deprecated), udp (deprecated), ec2 (deprecated), azure (deprecated), google
-                       (deprecated), or a custom one. Default: jdbc-ping. Available only when
-                       'cache' type is set to 'ispn'.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
 
 Config:
 
@@ -90,8 +119,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -120,10 +155,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -230,15 +316,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -248,12 +351,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -274,7 +378,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -295,6 +400,12 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -332,8 +443,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
index 09170950b3cc..a6a46914aedf 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
@@ -33,22 +33,51 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
 --cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
 --cache-embedded-mtls-key-store-file <file>
                      The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
 --cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-file <file>
                      The Truststore file path. It should contain the trusted certificates or the
                        Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -69,8 +98,8 @@ Cache:
                        Available only when metrics are enabled.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 --cache-remote-password <password>
                      The password for the authentication to the external Infinispan cluster. It is
                        optional if connecting to an unsecure external Infinispan cluster. If the
@@ -90,10 +119,10 @@ Cache:
                        only when remote host is set.
 --cache-stack <stack>
                      Define the default stack to use for cluster communication and node discovery.
-                       Possible values are: jdbc-ping, kubernetes, jdbc-ping-udp (deprecated), tcp
-                       (deprecated), udp (deprecated), ec2 (deprecated), azure (deprecated), google
-                       (deprecated), or a custom one. Default: jdbc-ping. Available only when
-                       'cache' type is set to 'ispn'.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
 
 Config:
 
@@ -110,8 +139,14 @@ Database:
                        deprecated, you should explicitly specify the db instead. Possible values
                        are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
                        dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
 --db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
                        driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -140,10 +175,61 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Transaction:
 
 --transaction-xa-enabled <true|false>
                      If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
 
 Feature:
 
@@ -259,15 +345,32 @@ Management:
                        The path must start with a '/'. If not given, the value is inherited from
                        HTTP options. Relevant only when something is exposed on the management
                        interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-client-auth <auth>
                      Configures the management interface to require/request client authentication.
                        If not given, the value is inherited from HTTP options. Relevant only when
@@ -277,12 +380,13 @@ Management:
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 --legacy-observability-interface <true|false>
                      DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
                        server (not recommended). If set to true, the management interface is
@@ -303,7 +407,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -324,6 +429,16 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -335,6 +450,10 @@ Logging:
                      Include tracing information in the console log. If the 'log-console-format'
                        option is specified, this option has no effect. Default: true. Available
                        only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
 --log-console-level <level>
                      Set the log level for the console handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -348,6 +467,14 @@ Logging:
                        handler is activated.
 --log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                        only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
 --log-file-format <format>
                      Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                        SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
@@ -356,6 +483,10 @@ Logging:
                      Include tracing information in the file log. If the 'log-file-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
 --log-file-level <level>
                      Set the log level for the file handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -378,6 +509,20 @@ Logging:
 --log-syslog-app-name <name>
                      Set the app name used when formatting the message in RFC5424 format. Default:
                        keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
 --log-syslog-endpoint <host:port>
                      Set the IP address and port of the Syslog server. Default: localhost:514.
                        Available only when Syslog is activated.
@@ -388,6 +533,10 @@ Logging:
                      Include tracing information in the Syslog. If the 'log-syslog-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
 --log-syslog-level <level>
                      Set the log level for the Syslog handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -436,7 +585,7 @@ Tracing:
                        is enabled.
 --tracing-sampler-ratio <ratio>
                      OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
-                       double value in interval <0,1). Default: 1.0. Available only when Tracing is
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                        enabled.
 --tracing-sampler-type <type>
                      OpenTelemetry sampler to use for tracing. Possible values are: always_on,
@@ -448,18 +597,18 @@ Tracing:
                        the 'tracing-resource-attributes' property. Default: keycloak. Available
                        only when Tracing is enabled.
 
-Events (Preview):
+Events:
 
 --event-metrics-user-enabled <true|false>
-                     Preview: Create metrics based on user events. Default: false. Available only
-                       when metrics are enabled and feature user-event-metrics is enabled.
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
 --event-metrics-user-events <events>
-                     Preview: Comma-separated list of events to be collected for user event
-                       metrics. Reduce the number of metrics. If empty or not set, all events
-                       create a metric. Possible values are:<...>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
 --event-metrics-user-tags <tags>
-                     Preview: Comma-separated list of tags to be collected for user event metrics.
-                       By default only 'realm' is enabled to avoid a high metrics cardinality.
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
                        Possible values are: realm, idp, clientId. Default: realm. Available only
                        when user event metrics are enabled.
 
@@ -467,8 +616,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
index f13f3a34d311..9243e3f43409 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
@@ -33,22 +33,51 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
 --cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
 --cache-embedded-mtls-key-store-file <file>
                      The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
 --cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-file <file>
                      The Truststore file path. It should contain the trusted certificates or the
                        Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -66,14 +95,14 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the users cache.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 --cache-stack <stack>
                      Define the default stack to use for cluster communication and node discovery.
-                       Possible values are: jdbc-ping, kubernetes, jdbc-ping-udp (deprecated), tcp
-                       (deprecated), udp (deprecated), ec2 (deprecated), azure (deprecated), google
-                       (deprecated), or a custom one. Default: jdbc-ping. Available only when
-                       'cache' type is set to 'ispn'.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
 
 Config:
 
@@ -86,6 +115,12 @@ Config:
 
 Database:
 
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -114,6 +149,46 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Hostname v2:
 
 --hostname <hostname|URL>
@@ -195,25 +270,43 @@ Management:
 --http-management-port <port>
                      Port of the management interface. Relevant only when something is exposed on
                        the management interface - see the guide for details. Default: 9000.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-key-store-file <file>
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 
 Proxy:
 
@@ -224,7 +317,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -244,6 +338,12 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -275,8 +375,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
index ca8614313ab9..ef6b274656f3 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
@@ -33,22 +33,51 @@ Cache:
                      The maximum number of entries that can be stored in-memory by the
                        clientSessions cache. Available only when embedded Infinispan clusters
                        configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
 --cache-embedded-keys-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the keys cache.
 --cache-embedded-mtls-enabled <true|false>
-                     Encrypts the network communication between Keycloak servers. Default: false.
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
 --cache-embedded-mtls-key-store-file <file>
                      The Keystore file path. The Keystore must contain the certificate to use by
-                       the TLS protocol. By default, it lookup 'cache-mtls-keystore.p12' under
-                       conf/ directory.
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
 --cache-embedded-mtls-key-store-password <password>
-                     The password to access the Keystore.
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-file <file>
                      The Truststore file path. It should contain the trusted certificates or the
                        Certificate Authority that signed the certificates. By default, it lookup
-                       'cache-mtls-truststore.p12' under conf/ directory.
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
 --cache-embedded-mtls-trust-store-password <password>
-                     The password to access the Truststore.
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
 --cache-embedded-offline-client-sessions-max-count <max-count>
                      The maximum number of entries that can be stored in-memory by the
                        offlineClientSessions cache. Available only when embedded Infinispan
@@ -69,8 +98,8 @@ Cache:
                        Available only when metrics are enabled.
 --cache-remote-host <hostname>
                      The hostname of the external Infinispan cluster. Available only when feature
-                       'multi-site', 'clusterless' or 'cache-embedded-remote-store' is set.
-                       Required when feature 'multi-site' or 'clusterless' is set.
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
 --cache-remote-password <password>
                      The password for the authentication to the external Infinispan cluster. It is
                        optional if connecting to an unsecure external Infinispan cluster. If the
@@ -90,10 +119,10 @@ Cache:
                        only when remote host is set.
 --cache-stack <stack>
                      Define the default stack to use for cluster communication and node discovery.
-                       Possible values are: jdbc-ping, kubernetes, jdbc-ping-udp (deprecated), tcp
-                       (deprecated), udp (deprecated), ec2 (deprecated), azure (deprecated), google
-                       (deprecated), or a custom one. Default: jdbc-ping. Available only when
-                       'cache' type is set to 'ispn'.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
 
 Config:
 
@@ -106,6 +135,12 @@ Config:
 
 Database:
 
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
 --db-password <password>
                      The password of the database user.
 --db-pool-initial-size <size>
@@ -134,6 +169,46 @@ Database:
 --db-username <username>
                      The username of the database user.
 
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
 Hostname v2:
 
 --hostname <hostname|URL>
@@ -224,25 +299,43 @@ Management:
 --http-management-port <port>
                      Port of the management interface. Relevant only when something is exposed on
                        the management interface - see the guide for details. Default: 9000.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
 --https-management-certificate-file <file>
                      The file path to a server certificate or certificate chain in PEM format for
                        the management server. If not given, the value is inherited from HTTP
                        options. Relevant only when something is exposed on the management interface
-                       - see the guide for details.
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
 --https-management-certificate-key-file <file>
                      The file path to a private key in PEM format for the management server. If not
                        given, the value is inherited from HTTP options. Relevant only when
-                       something is exposed on the management interface - see the guide for details.
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
 --https-management-key-store-file <file>
                      The key store which holds the certificate information instead of specifying
                        separate files for the management server. If not given, the value is
                        inherited from HTTP options. Relevant only when something is exposed on the
-                       management interface - see the guide for details.
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
 --https-management-key-store-password <password>
                      The password of the key store file for the management server. If not given,
                        the value is inherited from HTTP options. Relevant only when something is
                        exposed on the management interface - see the guide for details. Default:
-                       password.
+                       password. Available only when http-management-scheme is inherited.
 
 Proxy:
 
@@ -253,7 +346,8 @@ Proxy:
 --proxy-protocol-enabled <true|false>
                      Whether the server should use the HA PROXY protocol when serving requests from
                        behind a proxy. When set to true, the remote address returned will be the
-                       one from the actual connecting client. Default: false.
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
 --proxy-trusted-addresses <trusted proxies>
                      A comma separated list of trusted proxy addresses. If set, then proxy headers
                        from other addresses will be ignored. By default all addresses are trusted.
@@ -273,6 +367,16 @@ Logging:
 
 --log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                        are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
 --log-console-color <true|false>
                      Enable or disable colors when logging to console. Default: false. Available
                        only when Console log handler is activated.
@@ -284,6 +388,10 @@ Logging:
                      Include tracing information in the console log. If the 'log-console-format'
                        option is specified, this option has no effect. Default: true. Available
                        only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
 --log-console-level <level>
                      Set the log level for the console handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -297,6 +405,14 @@ Logging:
                        handler is activated.
 --log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                        only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
 --log-file-format <format>
                      Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                        SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
@@ -305,6 +421,10 @@ Logging:
                      Include tracing information in the file log. If the 'log-file-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
 --log-file-level <level>
                      Set the log level for the file handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -327,6 +447,20 @@ Logging:
 --log-syslog-app-name <name>
                      Set the app name used when formatting the message in RFC5424 format. Default:
                        keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
 --log-syslog-endpoint <host:port>
                      Set the IP address and port of the Syslog server. Default: localhost:514.
                        Available only when Syslog is activated.
@@ -337,6 +471,10 @@ Logging:
                      Include tracing information in the Syslog. If the 'log-syslog-format' option
                        is specified, this option has no effect. Default: true. Available only when
                        Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
 --log-syslog-level <level>
                      Set the log level for the Syslog handler. It specifies the most verbose log
                        level for logs shown in the output. It respects levels specified in the
@@ -379,22 +517,22 @@ Tracing:
                        is enabled.
 --tracing-sampler-ratio <ratio>
                      OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
-                       double value in interval <0,1). Default: 1.0. Available only when Tracing is
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                        enabled.
 --tracing-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'tracing-resource-attributes' property. Default: keycloak. Available
                        only when Tracing is enabled.
 
-Events (Preview):
+Events:
 
 --event-metrics-user-events <events>
-                     Preview: Comma-separated list of events to be collected for user event
-                       metrics. Reduce the number of metrics. If empty or not set, all events
-                       create a metric. Possible values are:<...>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
 --event-metrics-user-tags <tags>
-                     Preview: Comma-separated list of tags to be collected for user event metrics.
-                       By default only 'realm' is enabled to avoid a high metrics cardinality.
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
                        Possible values are: realm, idp, clientId. Default: realm. Available only
                        when user event metrics are enabled.
 
@@ -402,8 +540,8 @@ Truststore:
 
 --tls-hostname-verifier <tls-hostname-verifier>
                      The TLS hostname verification policy for out-going HTTPS and SMTP requests.
-                       Possible values are: ANY, WILDCARD (deprecated), STRICT (deprecated),
-                       DEFAULT. Default: DEFAULT.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
 --truststore-paths <truststore-paths>
                      List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                        directories containing those files that will be used as a system truststore.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt
new file mode 100644
index 000000000000..c54afd31a2cf
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelp.approved.txt
@@ -0,0 +1,476 @@
+
+Usage:
+
+kc.sh update-compatibility check [OPTIONS]
+Checks if the metadata is compatible with the current configuration. A zero
+exit code means a rolling update is possible between old and the current
+metadata.
+
+Options:
+
+--file <FILE>        The file path to read the metadata.
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+-v, --verbose        Print out error details when running this command.
+
+Cache:
+
+--cache <type>       Defines the cache mechanism for high-availability. By default in production
+                       mode, a 'ispn' cache is used to create a cluster between multiple server
+                       nodes. By default in development mode, a 'local' cache disables clustering
+                       and is intended for development and testing purposes. Possible values are:
+                       ispn, local. Default: ispn.
+--cache-config-file <file>
+                     Defines the file from which cache configuration should be loaded from. The
+                       configuration file is relative to the 'conf/' directory.
+--cache-embedded-authorization-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       authorization cache.
+--cache-embedded-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       clientSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
+--cache-embedded-keys-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the keys cache.
+--cache-embedded-mtls-enabled <true|false>
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
+--cache-embedded-mtls-key-store-file <file>
+                     The Keystore file path. The Keystore must contain the certificate to use by
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
+--cache-embedded-mtls-key-store-password <password>
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-file <file>
+                     The Truststore file path. It should contain the trusted certificates or the
+                       Certificate Authority that signed the certificates. By default, it lookup
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-password <password>
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
+--cache-embedded-offline-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineClientSessions cache. Available only when embedded Infinispan
+                       clusters configured.
+--cache-embedded-offline-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-realms-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the realms cache.
+--cache-embedded-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the sessions
+                       cache. Available only when embedded Infinispan clusters configured.
+--cache-embedded-users-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the users cache.
+--cache-remote-host <hostname>
+                     The hostname of the external Infinispan cluster. Available only when feature
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
+--cache-stack <stack>
+                     Define the default stack to use for cluster communication and node discovery.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Hostname v2:
+
+--hostname <hostname|URL>
+                     Address at which is the server exposed. Can be a full URL, or just a hostname.
+                       When only hostname is provided, scheme, port and context path are resolved
+                       from the request. Available only when hostname:v2 feature is enabled.
+--hostname-admin <URL>
+                     Address for accessing the administration console. Use this option if you are
+                       exposing the administration console using a reverse proxy on a different
+                       address than specified in the 'hostname' option. Available only when
+                       hostname:v2 feature is enabled.
+--hostname-backchannel-dynamic <true|false>
+                     Enables dynamic resolving of backchannel URLs, including hostname, scheme,
+                       port and context path. Set to true if your application accesses Keycloak via
+                       a private network. If set to true, 'hostname' option needs to be specified
+                       as a full URL. Default: false. Available only when hostname:v2 feature is
+                       enabled.
+--hostname-debug <true|false>
+                     Toggles the hostname debug page that is accessible at
+                       /realms/master/hostname-debug. Default: false. Available only when hostname:
+                       v2 feature is enabled.
+--hostname-strict <true|false>
+                     Disables dynamically resolving the hostname from request headers. Should
+                       always be set to true in production, unless your reverse proxy overwrites
+                       the Host header. If enabled, the 'hostname' option needs to be specified.
+                       Default: true. Available only when hostname:v2 feature is enabled.
+
+HTTP(S):
+
+--http-enabled <true|false>
+                     Enables the HTTP listener. Enabled by default in development mode. Typically
+                       not enabled in production unless the server is fronted by a TLS termination
+                       proxy. Default: false.
+--http-host <host>   The HTTP Host. Default: 0.0.0.0.
+--http-max-queued-requests <requests>
+                     Maximum number of queued HTTP requests. Use this to shed load in an overload
+                       situation. Excess requests will return a "503 Server not Available" response.
+--http-pool-max-threads <threads>
+                     The maximum number of threads. If this is not specified then it will be
+                       automatically sized to the greater of 4 * the number of available processors
+                       and 50. For example if there are 4 processors the max threads will be 50. If
+                       there are 48 processors it will be 192.
+--http-port <port>   The used HTTP port. Default: 8080.
+--http-relative-path <path>
+                     Set the path relative to '/' for serving resources. The path must start with a
+                       '/'. Default: /.
+--https-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format.
+--https-certificate-key-file <file>
+                     The file path to a private key in PEM format.
+--https-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-* options. May be a java.time.Duration value, an integer
+                       number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must
+                       be greater than 30 seconds. Use -1 to disable. Default: 1h.
+--https-cipher-suites <ciphers>
+                     The cipher suites to use. If none is given, a reasonable default is selected.
+--https-client-auth <auth>
+                     Configures the server to require/request client authentication. Possible
+                       values are: none, request, required. Default: none.
+--https-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files.
+--https-key-store-password <password>
+                     The password of the key store file. Default: password.
+--https-key-store-type <type>
+                     The type of the key store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+--https-port <port>  The used HTTPS port. Default: 8443.
+--https-protocols <protocols>
+                     The list of protocols to explicitly enable. Default: TLSv1.3,TLSv1.2.
+--https-trust-store-file <file>
+                     The trust store which holds the certificate information of the certificates to
+                       trust.
+--https-trust-store-password <password>
+                     The password of the trust store file.
+--https-trust-store-type <type>
+                     The type of the trust store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+
+Health:
+
+--health-enabled <true|false>
+                     If the server should expose health check endpoints. If enabled, health checks
+                       are available at the '/health', '/health/ready' and '/health/live'
+                       endpoints. Default: false.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Metrics:
+
+--metrics-enabled <true|false>
+                     If the server should expose metrics. If enabled, metrics are available at the
+                       '/metrics' endpoint. Default: false.
+
+Proxy:
+
+--proxy-headers <headers>
+                     The proxy headers that should be accepted by the server. Misconfiguration
+                       might leave the server exposed to security vulnerabilities. Takes precedence
+                       over the deprecated proxy option. Possible values are: forwarded, xforwarded.
+--proxy-protocol-enabled <true|false>
+                     Whether the server should use the HA PROXY protocol when serving requests from
+                       behind a proxy. When set to true, the remote address returned will be the
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
+--proxy-trusted-addresses <trusted proxies>
+                     A comma separated list of trusted proxy addresses. If set, then proxy headers
+                       from other addresses will be ignored. By default all addresses are trusted.
+                       A trusted proxy address is specified as an IP address (IPv4 or IPv6) or
+                       Classless Inter-Domain Routing (CIDR) notation. Available only when
+                       proxy-headers is set.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+
+Tracing:
+
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
+
+Security:
+
+--fips-mode <mode>   Sets the FIPS mode. If 'non-strict' is set, FIPS is enabled but on
+                       non-approved mode. For full FIPS compliance, set 'strict' to run on approved
+                       mode. This option defaults to 'disabled' when 'fips' feature is disabled,
+                       which is by default. This option defaults to 'non-strict' when 'fips'
+                       feature is enabled. Possible values are: non-strict, strict. Default:
+                       disabled.
+
+Bootstrap Admin:
+
+--bootstrap-admin-client-id <client id>
+                     Client id for the temporary bootstrap admin service account. Used only when
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
+--bootstrap-admin-client-secret <client secret>
+                     Client secret for the temporary bootstrap admin service account. Used only
+                       when the master realm is created. Use a non-CLI configuration option for
+                       this option if possible.
+--bootstrap-admin-password <password>
+                     Temporary bootstrap admin password. Used only when the master realm is
+                       created. Use a non-CLI configuration option for this option if possible.
+--bootstrap-admin-username <username>
+                     Temporary bootstrap admin username. Used only when the master realm is
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt
new file mode 100644
index 000000000000..973525ae3540
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt
@@ -0,0 +1,649 @@
+
+Usage:
+
+kc.sh update-compatibility check [OPTIONS]
+Checks if the metadata is compatible with the current configuration. A zero
+exit code means a rolling update is possible between old and the current
+metadata.
+
+Options:
+
+--file <FILE>        The file path to read the metadata.
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+-v, --verbose        Print out error details when running this command.
+
+Cache:
+
+--cache <type>       Defines the cache mechanism for high-availability. By default in production
+                       mode, a 'ispn' cache is used to create a cluster between multiple server
+                       nodes. By default in development mode, a 'local' cache disables clustering
+                       and is intended for development and testing purposes. Possible values are:
+                       ispn, local. Default: ispn.
+--cache-config-file <file>
+                     Defines the file from which cache configuration should be loaded from. The
+                       configuration file is relative to the 'conf/' directory.
+--cache-embedded-authorization-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       authorization cache.
+--cache-embedded-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       clientSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
+--cache-embedded-keys-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the keys cache.
+--cache-embedded-mtls-enabled <true|false>
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
+--cache-embedded-mtls-key-store-file <file>
+                     The Keystore file path. The Keystore must contain the certificate to use by
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
+--cache-embedded-mtls-key-store-password <password>
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-file <file>
+                     The Truststore file path. It should contain the trusted certificates or the
+                       Certificate Authority that signed the certificates. By default, it lookup
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-password <password>
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
+--cache-embedded-offline-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineClientSessions cache. Available only when embedded Infinispan
+                       clusters configured.
+--cache-embedded-offline-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-realms-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the realms cache.
+--cache-embedded-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the sessions
+                       cache. Available only when embedded Infinispan clusters configured.
+--cache-embedded-users-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the users cache.
+--cache-metrics-histograms-enabled <true|false>
+                     Enable histograms for metrics for the embedded caches. Default: false.
+                       Available only when metrics are enabled.
+--cache-remote-host <hostname>
+                     The hostname of the external Infinispan cluster. Available only when feature
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
+--cache-remote-password <password>
+                     The password for the authentication to the external Infinispan cluster. It is
+                       optional if connecting to an unsecure external Infinispan cluster. If the
+                       option is specified, 'cache-remote-username' is required as well. Available
+                       only when remote host is set.
+--cache-remote-port <port>
+                     The port of the external Infinispan cluster. Default: 11222. Available only
+                       when remote host is set.
+--cache-remote-tls-enabled <true|false>
+                     Enable TLS support to communicate with a secured remote Infinispan server.
+                       Recommended to be enabled in production. Default: true. Available only when
+                       remote host is set.
+--cache-remote-username <username>
+                     The username for the authentication to the external Infinispan cluster. It is
+                       optional if connecting to an unsecure external Infinispan cluster. If the
+                       option is specified, 'cache-remote-password' is required as well. Available
+                       only when remote host is set.
+--cache-stack <stack>
+                     Define the default stack to use for cluster communication and node discovery.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Hostname v2:
+
+--hostname <hostname|URL>
+                     Address at which is the server exposed. Can be a full URL, or just a hostname.
+                       When only hostname is provided, scheme, port and context path are resolved
+                       from the request. Available only when hostname:v2 feature is enabled.
+--hostname-admin <URL>
+                     Address for accessing the administration console. Use this option if you are
+                       exposing the administration console using a reverse proxy on a different
+                       address than specified in the 'hostname' option. Available only when
+                       hostname:v2 feature is enabled.
+--hostname-backchannel-dynamic <true|false>
+                     Enables dynamic resolving of backchannel URLs, including hostname, scheme,
+                       port and context path. Set to true if your application accesses Keycloak via
+                       a private network. If set to true, 'hostname' option needs to be specified
+                       as a full URL. Default: false. Available only when hostname:v2 feature is
+                       enabled.
+--hostname-debug <true|false>
+                     Toggles the hostname debug page that is accessible at
+                       /realms/master/hostname-debug. Default: false. Available only when hostname:
+                       v2 feature is enabled.
+--hostname-strict <true|false>
+                     Disables dynamically resolving the hostname from request headers. Should
+                       always be set to true in production, unless your reverse proxy overwrites
+                       the Host header. If enabled, the 'hostname' option needs to be specified.
+                       Default: true. Available only when hostname:v2 feature is enabled.
+
+HTTP(S):
+
+--http-enabled <true|false>
+                     Enables the HTTP listener. Enabled by default in development mode. Typically
+                       not enabled in production unless the server is fronted by a TLS termination
+                       proxy. Default: false.
+--http-host <host>   The HTTP Host. Default: 0.0.0.0.
+--http-max-queued-requests <requests>
+                     Maximum number of queued HTTP requests. Use this to shed load in an overload
+                       situation. Excess requests will return a "503 Server not Available" response.
+--http-metrics-histograms-enabled <true|false>
+                     Enables a histogram with default buckets for the duration of HTTP server
+                       requests. Default: false. Available only when metrics are enabled.
+--http-metrics-slos <list of buckets>
+                     Service level objectives for HTTP server requests. Use this instead of the
+                       default histogram, or use it in combination to add additional buckets.
+                       Specify a list of comma-separated values defined in milliseconds. Example
+                       with buckets from 5ms to 10s: 5,10,25,50,250,500,1000,2500,5000,10000
+                       Available only when metrics are enabled.
+--http-pool-max-threads <threads>
+                     The maximum number of threads. If this is not specified then it will be
+                       automatically sized to the greater of 4 * the number of available processors
+                       and 50. For example if there are 4 processors the max threads will be 50. If
+                       there are 48 processors it will be 192.
+--http-port <port>   The used HTTP port. Default: 8080.
+--http-relative-path <path>
+                     Set the path relative to '/' for serving resources. The path must start with a
+                       '/'. Default: /.
+--https-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format.
+--https-certificate-key-file <file>
+                     The file path to a private key in PEM format.
+--https-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-* options. May be a java.time.Duration value, an integer
+                       number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must
+                       be greater than 30 seconds. Use -1 to disable. Default: 1h.
+--https-cipher-suites <ciphers>
+                     The cipher suites to use. If none is given, a reasonable default is selected.
+--https-client-auth <auth>
+                     Configures the server to require/request client authentication. Possible
+                       values are: none, request, required. Default: none.
+--https-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files.
+--https-key-store-password <password>
+                     The password of the key store file. Default: password.
+--https-key-store-type <type>
+                     The type of the key store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+--https-port <port>  The used HTTPS port. Default: 8443.
+--https-protocols <protocols>
+                     The list of protocols to explicitly enable. Default: TLSv1.3,TLSv1.2.
+--https-trust-store-file <file>
+                     The trust store which holds the certificate information of the certificates to
+                       trust.
+--https-trust-store-password <password>
+                     The password of the trust store file.
+--https-trust-store-type <type>
+                     The type of the trust store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+
+Health:
+
+--health-enabled <true|false>
+                     If the server should expose health check endpoints. If enabled, health checks
+                       are available at the '/health', '/health/ready' and '/health/live'
+                       endpoints. Default: false.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Metrics:
+
+--metrics-enabled <true|false>
+                     If the server should expose metrics. If enabled, metrics are available at the
+                       '/metrics' endpoint. Default: false.
+
+Proxy:
+
+--proxy-headers <headers>
+                     The proxy headers that should be accepted by the server. Misconfiguration
+                       might leave the server exposed to security vulnerabilities. Takes precedence
+                       over the deprecated proxy option. Possible values are: forwarded, xforwarded.
+--proxy-protocol-enabled <true|false>
+                     Whether the server should use the HA PROXY protocol when serving requests from
+                       behind a proxy. When set to true, the remote address returned will be the
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
+--proxy-trusted-addresses <trusted proxies>
+                     A comma separated list of trusted proxy addresses. If set, then proxy headers
+                       from other addresses will be ignored. By default all addresses are trusted.
+                       A trusted proxy address is specified as an IP address (IPv4 or IPv6) or
+                       Classless Inter-Domain Routing (CIDR) notation. Available only when
+                       proxy-headers is set.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-include-trace <true|false>
+                     Include tracing information in the console log. If the 'log-console-format'
+                       option is specified, this option has no effect. Default: true. Available
+                       only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
+                       only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
+--log-file-format <format>
+                     Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
+                       SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
+                       activated.
+--log-file-include-trace <true|false>
+                     Include tracing information in the file log. If the 'log-file-format' option
+                       is specified, this option has no effect. Default: true. Available only when
+                       File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
+--log-file-level <level>
+                     Set the log level for the file handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when File log handler is activated.
+--log-file-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when File log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+--log-syslog-app-name <name>
+                     Set the app name used when formatting the message in RFC5424 format. Default:
+                       keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
+--log-syslog-endpoint <host:port>
+                     Set the IP address and port of the Syslog server. Default: localhost:514.
+                       Available only when Syslog is activated.
+--log-syslog-format <format>
+                     Set a format specific to Syslog entries. Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Syslog is activated.
+--log-syslog-include-trace <true|false>
+                     Include tracing information in the Syslog. If the 'log-syslog-format' option
+                       is specified, this option has no effect. Default: true. Available only when
+                       Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
+--log-syslog-level <level>
+                     Set the log level for the Syslog handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Syslog is activated.
+--log-syslog-max-length <max-length>
+                     Set the maximum length, in bytes, of the message allowed to be sent. The
+                       length includes the header and the message. If not set, the default value is
+                       2048 when 'log-syslog-type' is rfc5424 (default) and 1024 when
+                       'log-syslog-type' is rfc3164. Available only when Syslog is activated.
+--log-syslog-output <output>
+                     Set the Syslog output to JSON or default (plain) unstructured logging.
+                       Possible values are: default, json. Default: default. Available only when
+                       Syslog is activated.
+--log-syslog-protocol <protocol>
+                     Set the protocol used to connect to the Syslog server. Possible values are:
+                       tcp, udp, ssl-tcp. Default: tcp. Available only when Syslog is activated.
+--log-syslog-type <type>
+                     Set the Syslog type used to format the sent message. Possible values are:
+                       rfc5424, rfc3164. Default: rfc5424. Available only when Syslog is activated.
+
+Tracing:
+
+--tracing-compression <method>
+                     OpenTelemetry compression method used to compress payloads. If unset,
+                       compression is disabled. Possible values are: gzip, none. Default: none.
+                       Available only when Tracing is enabled.
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+--tracing-endpoint <url>
+                     OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
+                       Available only when Tracing is enabled.
+--tracing-jdbc-enabled <true|false>
+                     Enables the OpenTelemetry JDBC tracing. Default: true. Available only when
+                       Tracing is enabled.
+--tracing-protocol <protocol>
+                     OpenTelemetry protocol used for the telemetry data. Possible values are: grpc,
+                       http/protobuf. Default: grpc. Available only when Tracing is enabled.
+--tracing-resource-attributes <attributes>
+                     OpenTelemetry resource attributes present in the exported trace to
+                       characterize the telemetry producer. Values in format 'key1=val1,key2=val2'.
+                       For more information, check the Tracing guide. Available only when Tracing
+                       is enabled.
+--tracing-sampler-ratio <ratio>
+                     OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
+                       enabled.
+--tracing-sampler-type <type>
+                     OpenTelemetry sampler to use for tracing. Possible values are: always_on,
+                       always_off, traceidratio, parentbased_always_on, parentbased_always_off,
+                       parentbased_traceidratio. Default: traceidratio. Available only when Tracing
+                       is enabled.
+--tracing-service-name <name>
+                     OpenTelemetry service name. Takes precedence over 'service.name' defined in
+                       the 'tracing-resource-attributes' property. Default: keycloak. Available
+                       only when Tracing is enabled.
+
+Events:
+
+--event-metrics-user-enabled <true|false>
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
+--event-metrics-user-events <events>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
+--event-metrics-user-tags <tags>
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
+                       Possible values are: realm, idp, clientId. Default: realm. Available only
+                       when user event metrics are enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
+
+Security:
+
+--fips-mode <mode>   Sets the FIPS mode. If 'non-strict' is set, FIPS is enabled but on
+                       non-approved mode. For full FIPS compliance, set 'strict' to run on approved
+                       mode. This option defaults to 'disabled' when 'fips' feature is disabled,
+                       which is by default. This option defaults to 'non-strict' when 'fips'
+                       feature is enabled. Possible values are: non-strict, strict. Default:
+                       disabled.
+
+Bootstrap Admin:
+
+--bootstrap-admin-client-id <client id>
+                     Client id for the temporary bootstrap admin service account. Used only when
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
+--bootstrap-admin-client-secret <client secret>
+                     Client secret for the temporary bootstrap admin service account. Used only
+                       when the master realm is created. Use a non-CLI configuration option for
+                       this option if possible.
+--bootstrap-admin-password <password>
+                     Temporary bootstrap admin password. Used only when the master realm is
+                       created. Use a non-CLI configuration option for this option if possible.
+--bootstrap-admin-username <username>
+                     Temporary bootstrap admin username. Used only when the master realm is
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityHelp.approved.txt
new file mode 100644
index 000000000000..b9a116ebd404
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityHelp.approved.txt
@@ -0,0 +1,18 @@
+
+Usage:
+
+kc.sh update-compatibility [OPTIONS] [COMMAND]
+[Preview] Tool for configuration compatibility.
+
+Options:
+
+-h, --help           This help message.
+-v, --verbose        Print out error details when running this command.
+
+Commands:
+
+  check     Checks if the metadata is compatible with the current
+              configuration. A zero exit code means a rolling update is
+              possible between old and the current metadata.
+  metadata  Stores the metadata necessary to determine if a configuration is
+              compatible.
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt
new file mode 100644
index 000000000000..786b57b0bef0
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelp.approved.txt
@@ -0,0 +1,474 @@
+
+Usage:
+
+kc.sh update-compatibility metadata [OPTIONS]
+Stores the metadata necessary to determine if a configuration is compatible.
+
+Options:
+
+--file <FILE>        The file path to store the metadata. It is stored in the JSON format.
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+-v, --verbose        Print out error details when running this command.
+
+Cache:
+
+--cache <type>       Defines the cache mechanism for high-availability. By default in production
+                       mode, a 'ispn' cache is used to create a cluster between multiple server
+                       nodes. By default in development mode, a 'local' cache disables clustering
+                       and is intended for development and testing purposes. Possible values are:
+                       ispn, local. Default: ispn.
+--cache-config-file <file>
+                     Defines the file from which cache configuration should be loaded from. The
+                       configuration file is relative to the 'conf/' directory.
+--cache-embedded-authorization-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       authorization cache.
+--cache-embedded-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       clientSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
+--cache-embedded-keys-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the keys cache.
+--cache-embedded-mtls-enabled <true|false>
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
+--cache-embedded-mtls-key-store-file <file>
+                     The Keystore file path. The Keystore must contain the certificate to use by
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
+--cache-embedded-mtls-key-store-password <password>
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-file <file>
+                     The Truststore file path. It should contain the trusted certificates or the
+                       Certificate Authority that signed the certificates. By default, it lookup
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-password <password>
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
+--cache-embedded-offline-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineClientSessions cache. Available only when embedded Infinispan
+                       clusters configured.
+--cache-embedded-offline-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-realms-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the realms cache.
+--cache-embedded-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the sessions
+                       cache. Available only when embedded Infinispan clusters configured.
+--cache-embedded-users-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the users cache.
+--cache-remote-host <hostname>
+                     The hostname of the external Infinispan cluster. Available only when feature
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
+--cache-stack <stack>
+                     Define the default stack to use for cluster communication and node discovery.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Hostname v2:
+
+--hostname <hostname|URL>
+                     Address at which is the server exposed. Can be a full URL, or just a hostname.
+                       When only hostname is provided, scheme, port and context path are resolved
+                       from the request. Available only when hostname:v2 feature is enabled.
+--hostname-admin <URL>
+                     Address for accessing the administration console. Use this option if you are
+                       exposing the administration console using a reverse proxy on a different
+                       address than specified in the 'hostname' option. Available only when
+                       hostname:v2 feature is enabled.
+--hostname-backchannel-dynamic <true|false>
+                     Enables dynamic resolving of backchannel URLs, including hostname, scheme,
+                       port and context path. Set to true if your application accesses Keycloak via
+                       a private network. If set to true, 'hostname' option needs to be specified
+                       as a full URL. Default: false. Available only when hostname:v2 feature is
+                       enabled.
+--hostname-debug <true|false>
+                     Toggles the hostname debug page that is accessible at
+                       /realms/master/hostname-debug. Default: false. Available only when hostname:
+                       v2 feature is enabled.
+--hostname-strict <true|false>
+                     Disables dynamically resolving the hostname from request headers. Should
+                       always be set to true in production, unless your reverse proxy overwrites
+                       the Host header. If enabled, the 'hostname' option needs to be specified.
+                       Default: true. Available only when hostname:v2 feature is enabled.
+
+HTTP(S):
+
+--http-enabled <true|false>
+                     Enables the HTTP listener. Enabled by default in development mode. Typically
+                       not enabled in production unless the server is fronted by a TLS termination
+                       proxy. Default: false.
+--http-host <host>   The HTTP Host. Default: 0.0.0.0.
+--http-max-queued-requests <requests>
+                     Maximum number of queued HTTP requests. Use this to shed load in an overload
+                       situation. Excess requests will return a "503 Server not Available" response.
+--http-pool-max-threads <threads>
+                     The maximum number of threads. If this is not specified then it will be
+                       automatically sized to the greater of 4 * the number of available processors
+                       and 50. For example if there are 4 processors the max threads will be 50. If
+                       there are 48 processors it will be 192.
+--http-port <port>   The used HTTP port. Default: 8080.
+--http-relative-path <path>
+                     Set the path relative to '/' for serving resources. The path must start with a
+                       '/'. Default: /.
+--https-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format.
+--https-certificate-key-file <file>
+                     The file path to a private key in PEM format.
+--https-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-* options. May be a java.time.Duration value, an integer
+                       number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must
+                       be greater than 30 seconds. Use -1 to disable. Default: 1h.
+--https-cipher-suites <ciphers>
+                     The cipher suites to use. If none is given, a reasonable default is selected.
+--https-client-auth <auth>
+                     Configures the server to require/request client authentication. Possible
+                       values are: none, request, required. Default: none.
+--https-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files.
+--https-key-store-password <password>
+                     The password of the key store file. Default: password.
+--https-key-store-type <type>
+                     The type of the key store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+--https-port <port>  The used HTTPS port. Default: 8443.
+--https-protocols <protocols>
+                     The list of protocols to explicitly enable. Default: TLSv1.3,TLSv1.2.
+--https-trust-store-file <file>
+                     The trust store which holds the certificate information of the certificates to
+                       trust.
+--https-trust-store-password <password>
+                     The password of the trust store file.
+--https-trust-store-type <type>
+                     The type of the trust store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+
+Health:
+
+--health-enabled <true|false>
+                     If the server should expose health check endpoints. If enabled, health checks
+                       are available at the '/health', '/health/ready' and '/health/live'
+                       endpoints. Default: false.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Metrics:
+
+--metrics-enabled <true|false>
+                     If the server should expose metrics. If enabled, metrics are available at the
+                       '/metrics' endpoint. Default: false.
+
+Proxy:
+
+--proxy-headers <headers>
+                     The proxy headers that should be accepted by the server. Misconfiguration
+                       might leave the server exposed to security vulnerabilities. Takes precedence
+                       over the deprecated proxy option. Possible values are: forwarded, xforwarded.
+--proxy-protocol-enabled <true|false>
+                     Whether the server should use the HA PROXY protocol when serving requests from
+                       behind a proxy. When set to true, the remote address returned will be the
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
+--proxy-trusted-addresses <trusted proxies>
+                     A comma separated list of trusted proxy addresses. If set, then proxy headers
+                       from other addresses will be ignored. By default all addresses are trusted.
+                       A trusted proxy address is specified as an IP address (IPv4 or IPv6) or
+                       Classless Inter-Domain Routing (CIDR) notation. Available only when
+                       proxy-headers is set.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+
+Tracing:
+
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
+
+Security:
+
+--fips-mode <mode>   Sets the FIPS mode. If 'non-strict' is set, FIPS is enabled but on
+                       non-approved mode. For full FIPS compliance, set 'strict' to run on approved
+                       mode. This option defaults to 'disabled' when 'fips' feature is disabled,
+                       which is by default. This option defaults to 'non-strict' when 'fips'
+                       feature is enabled. Possible values are: non-strict, strict. Default:
+                       disabled.
+
+Bootstrap Admin:
+
+--bootstrap-admin-client-id <client id>
+                     Client id for the temporary bootstrap admin service account. Used only when
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
+--bootstrap-admin-client-secret <client secret>
+                     Client secret for the temporary bootstrap admin service account. Used only
+                       when the master realm is created. Use a non-CLI configuration option for
+                       this option if possible.
+--bootstrap-admin-password <password>
+                     Temporary bootstrap admin password. Used only when the master realm is
+                       created. Use a non-CLI configuration option for this option if possible.
+--bootstrap-admin-username <username>
+                     Temporary bootstrap admin username. Used only when the master realm is
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt
new file mode 100644
index 000000000000..5d6bb8fa0f84
--- /dev/null
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt
@@ -0,0 +1,647 @@
+
+Usage:
+
+kc.sh update-compatibility metadata [OPTIONS]
+Stores the metadata necessary to determine if a configuration is compatible.
+
+Options:
+
+--file <FILE>        The file path to store the metadata. It is stored in the JSON format.
+-h, --help           This help message.
+--help-all           This same help message but with additional options.
+--optimized          Use this option to achieve an optimal startup time if you have previously
+                       built a server image using the 'build' command.
+-v, --verbose        Print out error details when running this command.
+
+Cache:
+
+--cache <type>       Defines the cache mechanism for high-availability. By default in production
+                       mode, a 'ispn' cache is used to create a cluster between multiple server
+                       nodes. By default in development mode, a 'local' cache disables clustering
+                       and is intended for development and testing purposes. Possible values are:
+                       ispn, local. Default: ispn.
+--cache-config-file <file>
+                     Defines the file from which cache configuration should be loaded from. The
+                       configuration file is relative to the 'conf/' directory.
+--cache-embedded-authorization-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       authorization cache.
+--cache-embedded-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       clientSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-crl-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the crl cache.
+--cache-embedded-keys-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the keys cache.
+--cache-embedded-mtls-enabled <true|false>
+                     Encrypts the network communication between Keycloak servers. If no additional
+                       parameters about a keystore and truststore are provided, ephemeral key pairs
+                       and certificates are created and rotated automatically, which is recommended
+                       for standard setups. Default: true. Available only when a TCP based
+                       cache-stack is used.
+--cache-embedded-mtls-key-store-file <file>
+                     The Keystore file path. The Keystore must contain the certificate to use by
+                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
+                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
+                       is enabled.
+--cache-embedded-mtls-key-store-password <password>
+                     The password to access the Keystore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-rotation-interval-days <days>
+                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
+                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-file <file>
+                     The Truststore file path. It should contain the trusted certificates or the
+                       Certificate Authority that signed the certificates. By default, it lookup
+                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
+                       property 'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-mtls-trust-store-password <password>
+                     The password to access the Truststore. Available only when property
+                       'cache-embedded-mtls-enabled' is enabled.
+--cache-embedded-network-bind-address <address>
+                     IP address used by clustering transport. By default, SITE_LOCAL is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-bind-port <port>
+                     The Port the clustering transport will bind to. By default, port 7800 is used.
+                       Available only when Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-address <address>
+                     IP address that other instances in the cluster should use to contact this
+                       node. Set only if it is different to cache-embedded-network-bind-address,
+                       for example when this instance is behind a firewall. Available only when
+                       Infinispan clustered embedded is enabled.
+--cache-embedded-network-external-port <port>
+                     Port that other instances in the cluster should use to contact this node. Set
+                       only if it is different to cache-embedded-network-bind-port, for example
+                       when this instance is behind a firewall Available only when Infinispan
+                       clustered embedded is enabled.
+--cache-embedded-offline-client-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineClientSessions cache. Available only when embedded Infinispan
+                       clusters configured.
+--cache-embedded-offline-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the
+                       offlineSessions cache. Available only when embedded Infinispan clusters
+                       configured.
+--cache-embedded-realms-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the realms cache.
+--cache-embedded-sessions-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the sessions
+                       cache. Available only when embedded Infinispan clusters configured.
+--cache-embedded-users-max-count <max-count>
+                     The maximum number of entries that can be stored in-memory by the users cache.
+--cache-metrics-histograms-enabled <true|false>
+                     Enable histograms for metrics for the embedded caches. Default: false.
+                       Available only when metrics are enabled.
+--cache-remote-host <hostname>
+                     The hostname of the external Infinispan cluster. Available only when feature
+                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
+                       'clusterless' is set.
+--cache-remote-password <password>
+                     The password for the authentication to the external Infinispan cluster. It is
+                       optional if connecting to an unsecure external Infinispan cluster. If the
+                       option is specified, 'cache-remote-username' is required as well. Available
+                       only when remote host is set.
+--cache-remote-port <port>
+                     The port of the external Infinispan cluster. Default: 11222. Available only
+                       when remote host is set.
+--cache-remote-tls-enabled <true|false>
+                     Enable TLS support to communicate with a secured remote Infinispan server.
+                       Recommended to be enabled in production. Default: true. Available only when
+                       remote host is set.
+--cache-remote-username <username>
+                     The username for the authentication to the external Infinispan cluster. It is
+                       optional if connecting to an unsecure external Infinispan cluster. If the
+                       option is specified, 'cache-remote-password' is required as well. Available
+                       only when remote host is set.
+--cache-stack <stack>
+                     Define the default stack to use for cluster communication and node discovery.
+                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
+                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
+                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
+                       a custom one. Available only when 'cache' type is set to 'ispn'.
+
+Config:
+
+--config-keystore <config-keystore>
+                     Specifies a path to the KeyStore Configuration Source.
+--config-keystore-password <config-keystore-password>
+                     Specifies a password to the KeyStore Configuration Source.
+--config-keystore-type <config-keystore-type>
+                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.
+
+Database:
+
+--db <vendor>        The database vendor. In production mode the default value of 'dev-file' is
+                       deprecated, you should explicitly specify the db instead. Possible values
+                       are: dev-file, dev-mem, mariadb, mssql, mysql, oracle, postgres. Default:
+                       dev-file.
+--db-debug-jpql <true|false>
+                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
+                       generation. Default: false.
+--db-driver <driver> The fully qualified class name of the JDBC driver. If not set, a default
+                       driver is set accordingly to the chosen database.
+--db-log-slow-queries-threshold <milliseconds>
+                     Log SQL statements slower than the configured threshold with logger org.
+                       hibernate.SQL_SLOW and log-level info. Default: 10000.
+--db-password <password>
+                     The password of the database user.
+--db-pool-initial-size <size>
+                     The initial size of the connection pool.
+--db-pool-max-size <size>
+                     The maximum size of the connection pool. Default: 100.
+--db-pool-min-size <size>
+                     The minimal size of the connection pool.
+--db-schema <schema> The database schema to be used.
+--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
+                       selected database vendor. For instance, if using 'postgres', the default
+                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
+--db-url-database <dbname>
+                     Sets the database name of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-host <hostname>
+                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
+                       `db-url` option is set, this option is ignored.
+--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
+                       option is set, this option is ignored.
+--db-url-properties <properties>
+                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
+                       set the properties accordingly to the format expected by the database
+                       vendor, as well as appending the right character at the beginning of this
+                       property value. If the `db-url` option is set, this option is ignored.
+--db-username <username>
+                     The username of the database user.
+
+Database - additional datasources (Preview):
+
+--db-active-<datasource> <true|false>
+                     Preview: Deactivate specific named datasource <datasource>. Default: true.
+--db-driver-<datasource> <driver>
+                     Preview: Used for named <datasource>. The fully qualified class name of the
+                       JDBC driver. If not set, a default driver is set accordingly to the chosen
+                       database.
+--db-kind-<datasource> <vendor>
+                     Preview: Used for named <datasource>. The database vendor. In production mode
+                       the default value of 'dev-file' is deprecated, you should explicitly specify
+                       the db instead. Possible values are: dev-file, dev-mem, mariadb, mssql,
+                       mysql, oracle, postgres. Default: dev-file.
+--db-password-<datasource> <password>
+                     Preview: Used for named <datasource>. The password of the database user.
+--db-pool-initial-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The initial size of the connection pool.
+--db-pool-max-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The maximum size of the connection pool.
+                       Default: 100.
+--db-pool-min-size-<datasource> <size>
+                     Preview: Used for named <datasource>. The minimal size of the connection pool.
+--db-schema-<datasource> <schema>
+                     Preview: Used for named <datasource>. The database schema to be used.
+--db-url-database-<datasource> <dbname>
+                     Preview: Used for named <datasource>. Sets the database name of the default
+                       JDBC URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-full-<datasource> <jdbc-url>
+                     Preview: Used for named <datasource>. The full database JDBC URL. If not
+                       provided, a default URL is set based on the selected database vendor. For
+                       instance, if using 'postgres', the default JDBC URL would be 'jdbc:
+                       postgresql://localhost/keycloak'.
+--db-url-host-<datasource> <hostname>
+                     Preview: Used for named <datasource>. Sets the hostname of the default JDBC
+                       URL of the chosen vendor. If the `db-url` option is set, this option is
+                       ignored.
+--db-url-port-<datasource> <port>
+                     Preview: Used for named <datasource>. Sets the port of the default JDBC URL of
+                       the chosen vendor. If the `db-url` option is set, this option is ignored.
+--db-url-properties-<datasource> <properties>
+                     Preview: Used for named <datasource>. Sets the properties of the default JDBC
+                       URL of the chosen vendor. Make sure to set the properties accordingly to the
+                       format expected by the database vendor, as well as appending the right
+                       character at the beginning of this property value. If the `db-url` option is
+                       set, this option is ignored.
+--db-username-<datasource> <username>
+                     Preview: Used for named <datasource>. The username of the database user.
+
+Transaction:
+
+--transaction-xa-enabled <true|false>
+                     If set to true, XA datasources will be used. Default: false.
+--transaction-xa-enabled-<datasource> <true|false>
+                     If set to true, XA for <datasource> datasource will be used. Default: true.
+
+Feature:
+
+--features <feature> Enables a set of one or more features. Possible values are: <...>.
+--features-disabled <feature>
+                     Disables a set of one or more features. Possible values are: <...>.
+
+Hostname v2:
+
+--hostname <hostname|URL>
+                     Address at which is the server exposed. Can be a full URL, or just a hostname.
+                       When only hostname is provided, scheme, port and context path are resolved
+                       from the request. Available only when hostname:v2 feature is enabled.
+--hostname-admin <URL>
+                     Address for accessing the administration console. Use this option if you are
+                       exposing the administration console using a reverse proxy on a different
+                       address than specified in the 'hostname' option. Available only when
+                       hostname:v2 feature is enabled.
+--hostname-backchannel-dynamic <true|false>
+                     Enables dynamic resolving of backchannel URLs, including hostname, scheme,
+                       port and context path. Set to true if your application accesses Keycloak via
+                       a private network. If set to true, 'hostname' option needs to be specified
+                       as a full URL. Default: false. Available only when hostname:v2 feature is
+                       enabled.
+--hostname-debug <true|false>
+                     Toggles the hostname debug page that is accessible at
+                       /realms/master/hostname-debug. Default: false. Available only when hostname:
+                       v2 feature is enabled.
+--hostname-strict <true|false>
+                     Disables dynamically resolving the hostname from request headers. Should
+                       always be set to true in production, unless your reverse proxy overwrites
+                       the Host header. If enabled, the 'hostname' option needs to be specified.
+                       Default: true. Available only when hostname:v2 feature is enabled.
+
+HTTP(S):
+
+--http-enabled <true|false>
+                     Enables the HTTP listener. Enabled by default in development mode. Typically
+                       not enabled in production unless the server is fronted by a TLS termination
+                       proxy. Default: false.
+--http-host <host>   The HTTP Host. Default: 0.0.0.0.
+--http-max-queued-requests <requests>
+                     Maximum number of queued HTTP requests. Use this to shed load in an overload
+                       situation. Excess requests will return a "503 Server not Available" response.
+--http-metrics-histograms-enabled <true|false>
+                     Enables a histogram with default buckets for the duration of HTTP server
+                       requests. Default: false. Available only when metrics are enabled.
+--http-metrics-slos <list of buckets>
+                     Service level objectives for HTTP server requests. Use this instead of the
+                       default histogram, or use it in combination to add additional buckets.
+                       Specify a list of comma-separated values defined in milliseconds. Example
+                       with buckets from 5ms to 10s: 5,10,25,50,250,500,1000,2500,5000,10000
+                       Available only when metrics are enabled.
+--http-pool-max-threads <threads>
+                     The maximum number of threads. If this is not specified then it will be
+                       automatically sized to the greater of 4 * the number of available processors
+                       and 50. For example if there are 4 processors the max threads will be 50. If
+                       there are 48 processors it will be 192.
+--http-port <port>   The used HTTP port. Default: 8080.
+--http-relative-path <path>
+                     Set the path relative to '/' for serving resources. The path must start with a
+                       '/'. Default: /.
+--https-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format.
+--https-certificate-key-file <file>
+                     The file path to a private key in PEM format.
+--https-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-* options. May be a java.time.Duration value, an integer
+                       number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must
+                       be greater than 30 seconds. Use -1 to disable. Default: 1h.
+--https-cipher-suites <ciphers>
+                     The cipher suites to use. If none is given, a reasonable default is selected.
+--https-client-auth <auth>
+                     Configures the server to require/request client authentication. Possible
+                       values are: none, request, required. Default: none.
+--https-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files.
+--https-key-store-password <password>
+                     The password of the key store file. Default: password.
+--https-key-store-type <type>
+                     The type of the key store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+--https-port <port>  The used HTTPS port. Default: 8443.
+--https-protocols <protocols>
+                     The list of protocols to explicitly enable. Default: TLSv1.3,TLSv1.2.
+--https-trust-store-file <file>
+                     The trust store which holds the certificate information of the certificates to
+                       trust.
+--https-trust-store-password <password>
+                     The password of the trust store file.
+--https-trust-store-type <type>
+                     The type of the trust store file. If not given, the type is automatically
+                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
+                       no value is set, it defaults to 'BCFKS'.
+
+Health:
+
+--health-enabled <true|false>
+                     If the server should expose health check endpoints. If enabled, health checks
+                       are available at the '/health', '/health/ready' and '/health/live'
+                       endpoints. Default: false.
+
+Management:
+
+--http-management-port <port>
+                     Port of the management interface. Relevant only when something is exposed on
+                       the management interface - see the guide for details. Default: 9000.
+--http-management-relative-path <path>
+                     Set the path relative to '/' for serving resources from management interface.
+                       The path must start with a '/'. If not given, the value is inherited from
+                       HTTP options. Relevant only when something is exposed on the management
+                       interface - see the guide for details. Default: /.
+--http-management-scheme <scheme>
+                     Configures the management interface scheme. If 'inherited', the management
+                       interface will inherit the HTTPS settings of the main interface. If 'http',
+                       the management interface will be accessible via HTTP - it will not inherit
+                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
+                       http, inherited. Default: inherited.
+--https-management-certificate-file <file>
+                     The file path to a server certificate or certificate chain in PEM format for
+                       the management server. If not given, the value is inherited from HTTP
+                       options. Relevant only when something is exposed on the management interface
+                       - see the guide for details. Available only when http-management-scheme is
+                       inherited.
+--https-management-certificate-key-file <file>
+                     The file path to a private key in PEM format for the management server. If not
+                       given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Available only when http-management-scheme is inherited.
+--https-management-certificates-reload-period <reload period>
+                     Interval on which to reload key store, trust store, and certificate files
+                       referenced by https-management-* options for the management server. May be a
+                       java.time.Duration value, an integer number of seconds, or an integer
+                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
+                       to disable. If not given, the value is inherited from HTTP options. Relevant
+                       only when something is exposed on the management interface - see the guide
+                       for details. Default: 1h. Available only when http-management-scheme is
+                       inherited.
+--https-management-client-auth <auth>
+                     Configures the management interface to require/request client authentication.
+                       If not given, the value is inherited from HTTP options. Relevant only when
+                       something is exposed on the management interface - see the guide for
+                       details. Possible values are: none, request, required. Default: none.
+--https-management-key-store-file <file>
+                     The key store which holds the certificate information instead of specifying
+                       separate files for the management server. If not given, the value is
+                       inherited from HTTP options. Relevant only when something is exposed on the
+                       management interface - see the guide for details. Available only when
+                       http-management-scheme is inherited.
+--https-management-key-store-password <password>
+                     The password of the key store file for the management server. If not given,
+                       the value is inherited from HTTP options. Relevant only when something is
+                       exposed on the management interface - see the guide for details. Default:
+                       password. Available only when http-management-scheme is inherited.
+--legacy-observability-interface <true|false>
+                     DEPRECATED. If metrics/health endpoints should be exposed on the main HTTP
+                       server (not recommended). If set to true, the management interface is
+                       disabled. Default: false.
+
+Metrics:
+
+--metrics-enabled <true|false>
+                     If the server should expose metrics. If enabled, metrics are available at the
+                       '/metrics' endpoint. Default: false.
+
+Proxy:
+
+--proxy-headers <headers>
+                     The proxy headers that should be accepted by the server. Misconfiguration
+                       might leave the server exposed to security vulnerabilities. Takes precedence
+                       over the deprecated proxy option. Possible values are: forwarded, xforwarded.
+--proxy-protocol-enabled <true|false>
+                     Whether the server should use the HA PROXY protocol when serving requests from
+                       behind a proxy. When set to true, the remote address returned will be the
+                       one from the actual connecting client. Cannot be enabled when the
+                       `proxy-headers` is used. Default: false.
+--proxy-trusted-addresses <trusted proxies>
+                     A comma separated list of trusted proxy addresses. If set, then proxy headers
+                       from other addresses will be ignored. By default all addresses are trusted.
+                       A trusted proxy address is specified as an IP address (IPv4 or IPv6) or
+                       Classless Inter-Domain Routing (CIDR) notation. Available only when
+                       proxy-headers is set.
+
+Vault:
+
+--vault <provider>   Enables a vault provider. Possible values are: file, keystore.
+--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
+                       given directory.
+--vault-file <file>  Path to the keystore file.
+--vault-pass <pass>  Password for the vault keystore.
+--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.
+
+Logging:
+
+--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
+                       are: console, file, syslog. Default: console.
+--log-async <true|false>
+                     Indicates whether to log asynchronously to all handlers. Default: false.
+--log-console-async <true|false>
+                     Indicates whether to log asynchronously to console. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Console log handler is activated.
+--log-console-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to console.
+                       Default: 512. Available only when Console log handler is activated and
+                       asynchronous logging is enabled.
+--log-console-color <true|false>
+                     Enable or disable colors when logging to console. Default: false. Available
+                       only when Console log handler is activated.
+--log-console-format <format>
+                     The format of unstructured console log entries. If the format has spaces in
+                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
+--log-console-include-trace <true|false>
+                     Include tracing information in the console log. If the 'log-console-format'
+                       option is specified, this option has no effect. Default: true. Available
+                       only when Console log handler and Tracing is activated.
+--log-console-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Console log handler is activated and
+                       output is set to 'json'.
+--log-console-level <level>
+                     Set the log level for the console handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Console log handler is activated.
+--log-console-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when Console log
+                       handler is activated.
+--log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
+                       only when File log handler is activated.
+--log-file-async <true|false>
+                     Indicates whether to log asynchronously to file log. If not set, value from
+                       the parent property 'log-async' is used. Default: false. Available only when
+                       File log handler is activated.
+--log-file-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to file log.
+                       Default: 512. Available only when File log handler is activated and
+                       asynchronous logging is enabled.
+--log-file-format <format>
+                     Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
+                       SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
+                       activated.
+--log-file-include-trace <true|false>
+                     Include tracing information in the file log. If the 'log-file-format' option
+                       is specified, this option has no effect. Default: true. Available only when
+                       File log handler and Tracing is activated.
+--log-file-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when File log handler is activated and
+                       output is set to 'json'.
+--log-file-level <level>
+                     Set the log level for the file handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when File log handler is activated.
+--log-file-output <output>
+                     Set the log output to JSON or default (plain) unstructured logging. Possible
+                       values are: default, json. Default: default. Available only when File log
+                       handler is activated.
+--log-level <category:level>
+                     The log level of the root category or a comma-separated list of individual
+                       categories and their levels. For the root category, you don't need to
+                       specify a category. Default: info.
+--log-level-<category> <level>
+                     The log level of a category. Takes precedence over the 'log-level' option.
+                       Possible values are (case insensitive): off, fatal, error, warn, info,
+                       debug, trace, all.
+--log-syslog-app-name <name>
+                     Set the app name used when formatting the message in RFC5424 format. Default:
+                       keycloak. Available only when Syslog is activated.
+--log-syslog-async <true|false>
+                     Indicates whether to log asynchronously to Syslog. If not set, value from the
+                       parent property 'log-async' is used. Default: false. Available only when
+                       Syslog is activated.
+--log-syslog-async-queue-length <queue-length>
+                     The queue length to use before flushing writing when logging to Syslog.
+                       Default: 512. Available only when Syslog is activated and asynchronous
+                       logging is enabled.
+--log-syslog-counting-framing <strategy>
+                     If 'true', the message being sent is prefixed with the size of the message. If
+                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
+                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
+                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
+                       is activated.
+--log-syslog-endpoint <host:port>
+                     Set the IP address and port of the Syslog server. Default: localhost:514.
+                       Available only when Syslog is activated.
+--log-syslog-format <format>
+                     Set a format specific to Syslog entries. Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
+                       -5p [%c] (%t) %s%e%n. Available only when Syslog is activated.
+--log-syslog-include-trace <true|false>
+                     Include tracing information in the Syslog. If the 'log-syslog-format' option
+                       is specified, this option has no effect. Default: true. Available only when
+                       Syslog handler and Tracing is activated.
+--log-syslog-json-format <format>
+                     Set the format of the produced JSON. Possible values are: default, ecs.
+                       Default: default. Available only when Syslog is activated and output is set
+                       to 'json'.
+--log-syslog-level <level>
+                     Set the log level for the Syslog handler. It specifies the most verbose log
+                       level for logs shown in the output. It respects levels specified in the
+                       'log-level' option, which represents the maximal verbosity for the whole
+                       logging system. For more information, check the Logging guide. Possible
+                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
+                       all. Default: all. Available only when Syslog is activated.
+--log-syslog-max-length <max-length>
+                     Set the maximum length, in bytes, of the message allowed to be sent. The
+                       length includes the header and the message. If not set, the default value is
+                       2048 when 'log-syslog-type' is rfc5424 (default) and 1024 when
+                       'log-syslog-type' is rfc3164. Available only when Syslog is activated.
+--log-syslog-output <output>
+                     Set the Syslog output to JSON or default (plain) unstructured logging.
+                       Possible values are: default, json. Default: default. Available only when
+                       Syslog is activated.
+--log-syslog-protocol <protocol>
+                     Set the protocol used to connect to the Syslog server. Possible values are:
+                       tcp, udp, ssl-tcp. Default: tcp. Available only when Syslog is activated.
+--log-syslog-type <type>
+                     Set the Syslog type used to format the sent message. Possible values are:
+                       rfc5424, rfc3164. Default: rfc5424. Available only when Syslog is activated.
+
+Tracing:
+
+--tracing-compression <method>
+                     OpenTelemetry compression method used to compress payloads. If unset,
+                       compression is disabled. Possible values are: gzip, none. Default: none.
+                       Available only when Tracing is enabled.
+--tracing-enabled <true|false>
+                     Enables the OpenTelemetry tracing. Default: false. Available only when
+                       'opentelemetry' feature is enabled.
+--tracing-endpoint <url>
+                     OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
+                       Available only when Tracing is enabled.
+--tracing-jdbc-enabled <true|false>
+                     Enables the OpenTelemetry JDBC tracing. Default: true. Available only when
+                       Tracing is enabled.
+--tracing-protocol <protocol>
+                     OpenTelemetry protocol used for the telemetry data. Possible values are: grpc,
+                       http/protobuf. Default: grpc. Available only when Tracing is enabled.
+--tracing-resource-attributes <attributes>
+                     OpenTelemetry resource attributes present in the exported trace to
+                       characterize the telemetry producer. Values in format 'key1=val1,key2=val2'.
+                       For more information, check the Tracing guide. Available only when Tracing
+                       is enabled.
+--tracing-sampler-ratio <ratio>
+                     OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
+                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
+                       enabled.
+--tracing-sampler-type <type>
+                     OpenTelemetry sampler to use for tracing. Possible values are: always_on,
+                       always_off, traceidratio, parentbased_always_on, parentbased_always_off,
+                       parentbased_traceidratio. Default: traceidratio. Available only when Tracing
+                       is enabled.
+--tracing-service-name <name>
+                     OpenTelemetry service name. Takes precedence over 'service.name' defined in
+                       the 'tracing-resource-attributes' property. Default: keycloak. Available
+                       only when Tracing is enabled.
+
+Events:
+
+--event-metrics-user-enabled <true|false>
+                     Create metrics based on user events. Default: false. Available only when
+                       metrics are enabled and feature user-event-metrics is enabled.
+--event-metrics-user-events <events>
+                     Comma-separated list of events to be collected for user event metrics. This
+                       option can be used to reduce the number of metrics created as by default all
+                       user events create a metric. Possible values are:<...>
+--event-metrics-user-tags <tags>
+                     Comma-separated list of tags to be collected for user event metrics. By
+                       default only 'realm' is enabled to avoid a high metrics cardinality.
+                       Possible values are: realm, idp, clientId. Default: realm. Available only
+                       when user event metrics are enabled.
+
+Truststore:
+
+--tls-hostname-verifier <tls-hostname-verifier>
+                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
+                       ANY should not be used in production. Possible values are: ANY, WILDCARD
+                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
+--truststore-paths <truststore-paths>
+                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
+                       directories containing those files that will be used as a system truststore.
+
+Security:
+
+--fips-mode <mode>   Sets the FIPS mode. If 'non-strict' is set, FIPS is enabled but on
+                       non-approved mode. For full FIPS compliance, set 'strict' to run on approved
+                       mode. This option defaults to 'disabled' when 'fips' feature is disabled,
+                       which is by default. This option defaults to 'non-strict' when 'fips'
+                       feature is enabled. Possible values are: non-strict, strict. Default:
+                       disabled.
+
+Bootstrap Admin:
+
+--bootstrap-admin-client-id <client id>
+                     Client id for the temporary bootstrap admin service account. Used only when
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
+--bootstrap-admin-client-secret <client secret>
+                     Client secret for the temporary bootstrap admin service account. Used only
+                       when the master realm is created. Use a non-CLI configuration option for
+                       this option if possible.
+--bootstrap-admin-password <password>
+                     Temporary bootstrap admin password. Used only when the master realm is
+                       created. Use a non-CLI configuration option for this option if possible.
+--bootstrap-admin-username <username>
+                     Temporary bootstrap admin username. Used only when the master realm is
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/junit5/pom.xml b/quarkus/tests/junit5/pom.xml
index 7d9b450c896e..8514d2476191 100644
--- a/quarkus/tests/junit5/pom.xml
+++ b/quarkus/tests/junit5/pom.xml
@@ -108,7 +108,7 @@
         </dependency>
         <dependency>
             <groupId>com.oracle.database.jdbc</groupId>
-            <artifactId>ojdbc11</artifactId>
+            <artifactId>ojdbc17</artifactId>
         </dependency>
         <dependency>
             <groupId>com.oracle.database.nls</groupId>
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java b/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java
index 05ef4570c87d..29563eaa517f 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java
@@ -114,6 +114,9 @@ public Keycloak start(List<String> rawArgs) {
             }
 
             List<String> args = new ArrayList<>(rawArgs);
+            if (args.isEmpty()) {
+                args.add("start-dev");
+            }
 
             addOptionIfNotSet(args, HttpOptions.HTTP_ENABLED, true);
             addOptionIfNotSet(args, HttpOptions.HTTP_PORT);
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLIResult.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLIResult.java
index f27be8a094fd..8e195c1b758d 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLIResult.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLIResult.java
@@ -85,6 +85,10 @@ default void assertNoError(String msg) {
                 getErrorOutput(), not(containsString(msg)));
     }
 
+    default void assertExitCode(int code) {
+        assertThat("Exit codes do not match: ", exitCode(), is(code));
+    }
+
     default void assertMessage(String message) {
         assertThat(getOutput(), containsString(message));
     }
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLITestExtension.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLITestExtension.java
index aa3e2b8e1799..7af0555ffb25 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLITestExtension.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/CLITestExtension.java
@@ -36,8 +36,8 @@
 import org.keycloak.quarkus.runtime.cli.command.Start;
 import org.keycloak.quarkus.runtime.cli.command.StartDev;
 import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
 import org.keycloak.quarkus.runtime.configuration.KeycloakPropertiesConfigSource;
-import org.keycloak.quarkus.runtime.configuration.test.TestConfigArgsConfigSource;
 import org.keycloak.quarkus.runtime.integration.QuarkusPlatform;
 
 import java.io.IOException;
@@ -198,7 +198,9 @@ private void reset(DistributionTest distConfig, ExtensionContext context) {
         HashMap props = getStore(context).remove(SYS_PROPS, HashMap.class);
         System.getProperties().clear();
         System.getProperties().putAll(props);
-        TestConfigArgsConfigSource.setCliArgs(new String[0]);
+        // TODO: for in-vm tests this is not all that it takes to reset static state
+        // may want to call AbstractConfigurationTest.resetConfiguration
+        Configuration.resetConfig();
         if (databaseContainer != null && databaseContainer.isRunning()) {
             databaseContainer.stop();
             databaseContainer = null;
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/KeycloakDistributionDecorator.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/KeycloakDistributionDecorator.java
index 10ed34646227..a0acac6436ff 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/KeycloakDistributionDecorator.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/junit5/extension/KeycloakDistributionDecorator.java
@@ -138,6 +138,7 @@ public  <D extends KeycloakDistribution> D unwrap(Class<D> type) {
         }
 
         if (type.isInstance(delegate)) {
+            //noinspection unchecked
             return (D) delegate;
         }
 
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/DockerKeycloakDistribution.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/DockerKeycloakDistribution.java
index 72114a3d2e16..c5793a7d6c66 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/DockerKeycloakDistribution.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/DockerKeycloakDistribution.java
@@ -2,6 +2,7 @@
 
 import com.github.dockerjava.api.DockerClient;
 import com.github.dockerjava.api.exception.NotFoundException;
+import io.quarkus.bootstrap.utils.BuildToolHelper;
 import io.restassured.RestAssured;
 import org.jboss.logging.Logger;
 import org.keycloak.common.Version;
@@ -16,8 +17,10 @@
 import org.testcontainers.images.builder.ImageFromDockerfile;
 import org.testcontainers.utility.DockerImageName;
 import org.testcontainers.utility.LazyFuture;
+import org.testcontainers.utility.MountableFile;
 
-import java.io.File;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.time.Duration;
 import java.util.HashMap;
 import java.util.List;
@@ -33,9 +36,16 @@ private static class BackupConsumer implements Consumer<OutputFrame> {
 
         final ToStringConsumer stdOut = new ToStringConsumer();
         final ToStringConsumer stdErr = new ToStringConsumer();
+        final Consumer<OutputFrame> customLogConsumer;
+        public BackupConsumer(Consumer<OutputFrame> customLogConsumer) {
+            this.customLogConsumer = customLogConsumer;
+        }
 
         @Override
         public void accept(OutputFrame t) {
+            if (customLogConsumer != null) {
+                customLogConsumer.accept(t);
+            }
             if (t.getType() == OutputType.STDERR) {
                 stdErr.accept(t);
             } else if (t.getType() == OutputType.STDOUT) {
@@ -46,6 +56,8 @@ public void accept(OutputFrame t) {
 
     private static final Logger LOGGER = Logger.getLogger(DockerKeycloakDistribution.class);
 
+    public static final int STARTUP_TIMEOUT_SECONDS = 120;
+
     private final boolean debug;
     private final boolean manualStop;
     private final int requestPort;
@@ -55,20 +67,27 @@ public void accept(OutputFrame t) {
 
     private String stdout = "";
     private String stderr = "";
-    private BackupConsumer backupConsumer = new BackupConsumer();
-    private final File dockerScriptFile = new File("../../container/ubi-null.sh");
-
+    private BackupConsumer backupConsumer;
+    private Consumer<OutputFrame> customLogConsumer;
     private GenericContainer<?> keycloakContainer = null;
     private String containerId = null;
 
     private final Executor parallelReaperExecutor = Executors.newSingleThreadExecutor();
     private final Map<String, String> envVars = new HashMap<>();
+    private final LazyFuture<String> image;
+
+    private final Map<MountableFile, String> copyToContainer = new HashMap<>();
 
     public DockerKeycloakDistribution(boolean debug, boolean manualStop, int requestPort, int[] exposedPorts) {
+        this(debug, manualStop, requestPort, exposedPorts, null);
+    }
+
+    public DockerKeycloakDistribution(boolean debug, boolean manualStop, int requestPort, int[] exposedPorts, LazyFuture<String> image) {
         this.debug = debug;
         this.manualStop = manualStop;
         this.requestPort = requestPort;
         this.exposedPorts = IntStream.of(exposedPorts).boxed().toArray(Integer[]::new);
+        this.image = image == null ? createImage(false) : image;
     }
 
     @Override
@@ -76,37 +95,54 @@ public void setEnvVar(String name, String value) {
         this.envVars.put(name, value);
     }
 
+    public void setCustomLogConsumer(Consumer<OutputFrame> customLogConsumer) {
+        this.customLogConsumer = customLogConsumer;
+    }
+
     private GenericContainer<?> getKeycloakContainer() {
-        File distributionFile = new File("../../dist/" + File.separator + "target" + File.separator + "keycloak-" + Version.VERSION + ".tar.gz");
+        return new GenericContainer<>(image)
+                .withEnv(envVars)
+                .withExposedPorts(exposedPorts)
+                .withStartupAttempts(1)
+                .withStartupTimeout(Duration.ofSeconds(STARTUP_TIMEOUT_SECONDS))
+                .waitingFor(Wait.forListeningPorts(8080));
+    }
 
-        if (!distributionFile.exists()) {
-            distributionFile = Maven.resolveArtifact("org.keycloak", "keycloak-quarkus-dist").toFile();
-        }
+    public static LazyFuture<String> createImage(boolean failIfDockerFileMissing) {
+        Path quarkusModule = Maven.getKeycloakQuarkusModulePath();
+        var distributionFile = quarkusModule.resolve(Path.of("dist", "target", "keycloak-" + Version.VERSION + ".tar.gz"))
+                .toFile();
+
+//        In current Dockerfile we support only tar.gz keycloak distribution, this module, however. does not have this
+//        dependency. Adding the dependency breaks our CI as tar.gz files are not part of CI build archive.
+//        Adding tar.gz files to archive would double the size of each build archive.
+//        Therefore, for now, we support only building the image from the target folder of this module.
+//        if (!distributionFile.exists()) {
+//            distributionFile = Maven.resolveArtifact("org.keycloak", "keycloak-quarkus-dist").toFile();
+//        }
 
         if (!distributionFile.exists()) {
             throw new RuntimeException("Distribution archive " + distributionFile.getAbsolutePath() +" doesn't exist");
         }
+        LOGGER.infof("Building a new docker image from distribution: %s", distributionFile.getAbsoluteFile());
 
-        File dockerFile = new File("../../container/Dockerfile");
-        LazyFuture<String> image;
+        var dockerFile = quarkusModule.resolve(Path.of("container", "Dockerfile"))
+                .toFile();
+        var ubiNullScript = quarkusModule.resolve(Path.of("container", "ubi-null.sh"))
+                .toFile();
 
         if (dockerFile.exists()) {
-            image = new ImageFromDockerfile("keycloak-under-test", false)
+            return new ImageFromDockerfile("keycloak-under-test", false)
                     .withFileFromFile("keycloak.tar.gz", distributionFile)
-                    .withFileFromFile("ubi-null.sh", dockerScriptFile)
+                    .withFileFromFile("ubi-null.sh", ubiNullScript)
                     .withFileFromFile("Dockerfile", dockerFile)
                     .withBuildArg("KEYCLOAK_DIST", "keycloak.tar.gz");
-            toString();
         } else {
-            image = new RemoteDockerImage(DockerImageName.parse("quay.io/keycloak/keycloak"));
+            if (failIfDockerFileMissing) {
+                throw new RuntimeException("Docker file %s not found".formatted(dockerFile.getAbsolutePath()));
+            }
+            return new RemoteDockerImage(DockerImageName.parse("quay.io/keycloak/keycloak"));
         }
-
-        return new GenericContainer<>(image)
-                .withEnv(envVars)
-                .withExposedPorts(exposedPorts)
-                .withStartupAttempts(1)
-                .withStartupTimeout(Duration.ofSeconds(120))
-                .waitingFor(Wait.forListeningPorts(8080));
     }
 
     @Override
@@ -117,10 +153,12 @@ public CLIResult run(List<String> arguments) {
             this.stdout = "";
             this.stderr = "";
             this.containerId = null;
-            this.backupConsumer = new BackupConsumer();
+            this.backupConsumer = new BackupConsumer(customLogConsumer);
 
             keycloakContainer = getKeycloakContainer();
 
+            copyToContainer.forEach(keycloakContainer::withCopyFileToContainer);
+
             keycloakContainer
                     .withLogConsumer(backupConsumer)
                     .withCommand(arguments.toArray(new String[0]))
@@ -158,6 +196,19 @@ public void setRequestPort(int port) {
         }
     }
 
+    public void copyProvider(String groupId, String artifactId) {
+        Path providerPath = Maven.resolveArtifact(groupId, artifactId);
+        if (!Files.isRegularFile(providerPath)) {
+            throw new RuntimeException("Failed to copy JAR file to 'providers' directory; " + providerPath + " is not a file");
+        }
+
+        copyToContainer.put(MountableFile.forHostPath(providerPath), "/opt/keycloak/providers/" + providerPath.getFileName());
+    }
+
+    public void copyConfigFile(Path configFilePath) {
+        copyToContainer.put(MountableFile.forHostPath(configFilePath), "/opt/keycloak/conf/" + configFilePath.getFileName());
+    }
+
     // After the web server is responding we are still producing some logs that got checked in the tests
     private void waitForStableOutput() {
         int retry = 10;
@@ -174,7 +225,7 @@ private void waitForStableOutput() {
                 String newLastLine = splitted[splitted.length - 1];
 
                 retry -= 1;
-                stableOutput = lastLine.equals(newLastLine) | (retry <= 0);
+                stableOutput = lastLine.equals(newLastLine) || (retry <= 0);
                 lastLine = newLastLine;
             } else {
                 stableOutput = true;
@@ -224,7 +275,7 @@ public void run() {
                 };
                 parallelReaperExecutor.execute(reaper);
             } catch (Exception cause) {
-                throw new RuntimeException("Failed to schecdule the removal of the container", cause);
+                throw new RuntimeException("Failed to schedule the removal of the container", cause);
             }
         }
     }
@@ -292,4 +343,12 @@ public void clearEnv() {
         this.envVars.clear();
     }
 
+    public int getMappedPort(int port) {
+        if (keycloakContainer == null || !keycloakContainer.isRunning()) {
+            throw new IllegalStateException("KeycloakContainer is not running.");
+        }
+
+        return keycloakContainer.getMappedPort(port);
+    }
+
 }
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/Maven.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/Maven.java
index d166915949f2..a5743b75b821 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/Maven.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/Maven.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.it.utils;
 
+import java.net.URISyntaxException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
@@ -46,11 +47,7 @@ public final class Maven {
 
     public static Path resolveArtifact(String groupId, String artifactId) {
         try {
-            Path classPathDir = Paths.get(Thread.currentThread().getContextClassLoader().getResource(".").toURI());
-            Path projectDir = BuildToolHelper.getProjectDir(classPathDir);
-            BootstrapMavenContext ctx = new BootstrapMavenContext(
-                    BootstrapMavenContext.config().setPreferPomsFromWorkspace(true).setWorkspaceModuleParentHierarchy(true)
-                            .setCurrentProject(projectDir.toString()));
+            BootstrapMavenContext ctx = bootstrapCurrentMavenContext();
             LocalProject project = ctx.getCurrentProject();
             RepositorySystem repositorySystem = ctx.getRepositorySystem();
             List<RemoteRepository> remoteRepositories = ctx.getRemoteRepositories();
@@ -128,4 +125,30 @@ public boolean accept(DependencyNode node, List<DependencyNode> parents) {
 
         return artifactResults.get(0).getArtifact();
     }
+
+    public static Path getKeycloakQuarkusModulePath() {
+        // Find keycloak-parent module first
+        BootstrapMavenContext ctx = null;
+        try {
+            ctx = bootstrapCurrentMavenContext();
+        } catch (BootstrapMavenException | URISyntaxException e) {
+            throw new RuntimeException("Failed bootstrap maven context", e);
+        }
+        for (LocalProject m = ctx.getCurrentProject(); m != null; m = m.getLocalParent()) {
+            if ("keycloak-parent".equals(m.getArtifactId())) {
+                // When found, advance to quarkus module
+                return m.getDir().resolve("quarkus");
+            }
+        }
+
+        throw new RuntimeException("Failed to find keycloak-parent module.");
+    }
+
+    private static BootstrapMavenContext bootstrapCurrentMavenContext() throws BootstrapMavenException, URISyntaxException {
+        Path classPathDir = Paths.get(Thread.currentThread().getContextClassLoader().getResource(".").toURI());
+        Path projectDir = BuildToolHelper.getProjectDir(classPathDir);
+        return new BootstrapMavenContext(
+                BootstrapMavenContext.config().setPreferPomsFromWorkspace(true).setWorkspaceModuleParentHierarchy(true)
+                        .setCurrentProject(projectDir.toString()));
+    }
 }
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/RawKeycloakDistribution.java b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/RawKeycloakDistribution.java
index 4824dae38851..5a73ecc36760 100644
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/RawKeycloakDistribution.java
+++ b/quarkus/tests/junit5/src/main/java/org/keycloak/it/utils/RawKeycloakDistribution.java
@@ -51,7 +51,6 @@
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.X509TrustManager;
@@ -85,8 +84,6 @@ public final class RawKeycloakDistribution implements KeycloakDistribution {
     private Process keycloak;
     private int exitCode = -1;
     private final Path distPath;
-    private final List<String> outputStream = Collections.synchronizedList(new ArrayList<>());
-    private final List<String> errorStream = Collections.synchronizedList(new ArrayList<>());
     private boolean manualStop;
     private String relativePath;
     private int httpPort;
@@ -99,7 +96,7 @@ public final class RawKeycloakDistribution implements KeycloakDistribution {
     private ExecutorService outputExecutor;
     private boolean inited = false;
     private final Map<String, String> envVars = new HashMap<>();
-    private OutputConsumer outputConsumer;
+    private final OutputConsumer outputConsumer;
 
     public RawKeycloakDistribution(boolean debug, boolean manualStop, boolean enableTls, boolean reCreate, boolean removeBuildOptionsAfterBuild, int requestPort) {
         this(debug, manualStop, enableTls, reCreate, removeBuildOptionsAfterBuild, requestPort, new DefaultOutputConsumer());
@@ -115,7 +112,7 @@ public RawKeycloakDistribution(boolean debug, boolean manualStop, boolean enable
         this.distPath = prepareDistribution();
         this.outputConsumer = outputConsumer;
     }
-    
+
     public CLIResult kcadm(String... arguments) throws IOException {
     	return kcadm(Arrays.asList(arguments));
     }
@@ -215,7 +212,6 @@ public void stop() {
 
                 keycloak.destroy();
                 keycloak.waitFor(DEFAULT_SHUTDOWN_TIMEOUT_SECONDS, TimeUnit.SECONDS);
-                exitCode = keycloak.exitValue();
             } catch (Exception cause) {
                 destroyDescendantsOnWindows(keycloak, true);
                 keycloak.destroyForcibly();
@@ -224,6 +220,10 @@ public void stop() {
             }
         }
 
+        if (keycloak != null) {
+            exitCode = keycloak.exitValue();
+        }
+
         shutdownOutputExecutor();
     }
 
@@ -232,10 +232,19 @@ private void destroyDescendantsOnWindows(Process parent, boolean force) {
             return;
         }
 
+        List<ProcessHandle> descendants = parent.descendants().toList();
+        if (descendants.isEmpty()) {
+            return;
+        }
+        
+        LOG.debugf("Found %d descendant processes to terminate", descendants.size());
         CompletableFuture<?> allProcesses = CompletableFuture.completedFuture(null);
 
-        for (ProcessHandle process : parent.descendants().toList()) {
+        // Terminate all processes
+        for (ProcessHandle process : descendants) {
             if (force) {
+                LOG.warn("Using forcible termination of descendant processes after normal termination failed");
+                LOG.debugf("Forcibly terminating process %s", process.pid());
                 process.destroyForcibly();
             } else {
                 process.destroy();
@@ -244,19 +253,18 @@ private void destroyDescendantsOnWindows(Process parent, boolean force) {
             allProcesses = CompletableFuture.allOf(allProcesses, process.onExit());
         }
 
+        // Wait for all processes to exit according to Java
         try {
             allProcesses.get(DEFAULT_SHUTDOWN_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+            LOG.debugf("All descendant processes terminated according to Java");
         } catch (Exception cause) {
             throw new RuntimeException("Failed to terminate descendants processes", cause);
         }
 
         try {
-            // TODO: remove this. do not ask why, but on Windows we are here even though the process was previously terminated
-            // without this pause, tests re-installing dist before tests should fail
-            // looks like pausing the current thread let windows to cleanup processes?
-            // more likely it is env dependent
-            Thread.sleep(500);
+            Thread.sleep(2000);
         } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
         }
     }
 
@@ -390,16 +398,11 @@ private void threadDump() {
     }
 
     private long getStartTimeout() {
-        return TimeUnit.SECONDS.toMillis(120);
+        return TimeUnit.SECONDS.toMillis(Long.getLong("keycloak.distribution.start.timeout", 120L));
     }
 
     private HostnameVerifier createInsecureHostnameVerifier() {
-        return new HostnameVerifier() {
-            @Override
-            public boolean verify(String s, SSLSession sslSession) {
-                return true;
-            }
-        };
+        return (s, sslSession) -> true;
     }
 
     private SSLSocketFactory createInsecureSslSocketFactory() throws IOException {
@@ -511,7 +514,7 @@ private void readOutput() {
     private void readOutput(Process process, OutputConsumer outputConsumer) {
         try (
                 BufferedReader outStream = new BufferedReader(new InputStreamReader(process.getInputStream()));
-                BufferedReader errStream = new BufferedReader(new InputStreamReader(process.getErrorStream()));
+                BufferedReader errStream = new BufferedReader(new InputStreamReader(process.getErrorStream()))
         ) {
             while (process.isAlive()) {
                 readStream(outStream, outputConsumer, false);
@@ -574,22 +577,12 @@ public void setEnvVar(String name, String value) {
 
     @Override
     public void removeProperty(String name) {
-        updateProperties(new Consumer<Properties>() {
-            @Override
-            public void accept(Properties properties) {
-                properties.remove(name);
-            }
-        }, distPath.resolve("conf").resolve("keycloak.conf").toFile());
+        updateProperties(properties -> properties.remove(name), distPath.resolve("conf").resolve("keycloak.conf").toFile());
     }
 
     @Override
     public void setQuarkusProperty(String key, String value) {
-        updateProperties(new Consumer<Properties>() {
-            @Override
-            public void accept(Properties properties) {
-                properties.put(key, value);
-            }
-        }, getQuarkusPropertiesFile());
+        updateProperties(properties -> properties.put(key, value), getQuarkusPropertiesFile());
     }
 
     @Override
@@ -637,18 +630,31 @@ public void copyProvider(String groupId, String artifactId) {
 
     private static void copyProvider(Path distPath, String groupId, String artifactId) {
         try {
-            Files.copy(Maven.resolveArtifact(groupId, artifactId), distPath.resolve("providers").resolve(artifactId + ".jar"));
+            Path providerPath = Maven.resolveArtifact(groupId, artifactId);
+            if (!Files.isRegularFile(providerPath)) {
+                throw new RuntimeException("Failed to copy JAR file to 'providers' directory; " + providerPath + " is not a file");
+            }
+
+            Files.copy(providerPath, distPath.resolve("providers").resolve(artifactId + ".jar"));
         } catch (IOException cause) {
             throw new RuntimeException("Failed to copy JAR file to 'providers' directory", cause);
         }
     }
 
+    public void copyConfigFile(Path configFilePath) {
+        try {
+            Files.copy(configFilePath, distPath.resolve("conf").resolve(configFilePath.getFileName()));
+        } catch (IOException cause) {
+            throw new RuntimeException("Failed to copy config file [" + configFilePath + "] to 'conf' directory", cause);
+        }
+    }
+
     private void updateProperties(Consumer<Properties> propertiesConsumer, File propertiesFile) {
         Properties properties = new Properties();
 
         if (propertiesFile.exists()) {
             try (
-                FileInputStream in = new FileInputStream(propertiesFile);
+                FileInputStream in = new FileInputStream(propertiesFile)
             ) {
 
                 properties.load(in);
@@ -709,7 +715,7 @@ public <D extends KeycloakDistribution> D unwrap(Class<D> type) {
         }
 
         if (type.isInstance(this)) {
-            return (D) this;
+            return type.cast(type);
         }
 
         throw new IllegalArgumentException("Not a " + type + " type");
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestConfigArgsConfigSource.java b/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestConfigArgsConfigSource.java
deleted file mode 100644
index 6c6d599eb70b..000000000000
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestConfigArgsConfigSource.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.configuration.test;
-
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-
-public class TestConfigArgsConfigSource extends ConfigArgsConfigSource {
-
-}
diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestKeycloakConfigSourceProvider.java b/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestKeycloakConfigSourceProvider.java
deleted file mode 100644
index b7476f4e4aa0..000000000000
--- a/quarkus/tests/junit5/src/main/java/org/keycloak/quarkus/runtime/configuration/test/TestKeycloakConfigSourceProvider.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.quarkus.runtime.configuration.test;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.function.Function;
-import java.util.function.Supplier;
-import java.util.stream.Collectors;
-import java.util.stream.StreamSupport;
-import org.eclipse.microprofile.config.spi.ConfigSource;
-import org.keycloak.quarkus.runtime.configuration.ConfigArgsConfigSource;
-import org.keycloak.quarkus.runtime.configuration.KeycloakConfigSourceProvider;
-
-public class TestKeycloakConfigSourceProvider extends KeycloakConfigSourceProvider {
-
-    private static final Map<Class<? extends ConfigSource>, Supplier<? extends ConfigSource>> REPLACEABLE_CONFIG_SOURCES = new HashMap<>();
-
-    static {
-        REPLACEABLE_CONFIG_SOURCES.put(ConfigArgsConfigSource.class, TestConfigArgsConfigSource::new);
-    }
-
-    @Override
-    public Iterable<ConfigSource> getConfigSources(ClassLoader forClassLoader) {
-        reload();
-        return StreamSupport.stream(super.getConfigSources(forClassLoader).spliterator(), false)
-                .map(new Function<ConfigSource, ConfigSource>() {
-                    @Override
-                    public ConfigSource apply(ConfigSource configSource) {
-                        return REPLACEABLE_CONFIG_SOURCES.getOrDefault(configSource.getClass(), () -> configSource).get();
-                    }
-                }).collect(Collectors.toList());
-    }
-}
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtProvider.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtProvider.java
index 225de0906165..aa4a92cccadb 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtProvider.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtProvider.java
@@ -9,7 +9,7 @@
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProviderFactory;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public final class AdminExtProvider implements AdminRealmResourceProviderFactory, AdminRealmResourceProvider, EnvironmentDependentProviderFactory {
     public AdminRealmResourceProvider create(KeycloakSession session) {
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtResource.java
index e517bfc7288b..00875db0b553 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AdminExtResource.java
@@ -3,7 +3,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Path;
 
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AuthenticationManagementResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AuthenticationManagementResource.java
index 8c457d7ac0d7..dcd88e510cf8 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AuthenticationManagementResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AuthenticationManagementResource.java
@@ -34,7 +34,7 @@
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 
 public class AuthenticationManagementResource extends RoleMappingResource {
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableEventListenersResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableEventListenersResource.java
index 5e2fe0a50d12..5dbdda3efd6a 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableEventListenersResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableEventListenersResource.java
@@ -33,7 +33,7 @@
 import org.keycloak.events.EventListenerProvider;
 import org.keycloak.events.EventListenerProviderFactory;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public class AvailableEventListenersResource {
 
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableRoleMappingResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableRoleMappingResource.java
index 81264d67d0fb..0155866a50f1 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableRoleMappingResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/AvailableRoleMappingResource.java
@@ -1,5 +1,6 @@
 package org.keycloak.admin.ui.rest;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
@@ -21,7 +22,9 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
 import org.keycloak.admin.ui.rest.model.ClientRole;
 import org.keycloak.admin.ui.rest.model.RoleMapper;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.GroupModel;
@@ -30,14 +33,14 @@
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserProvider;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
-import static org.keycloak.services.resources.admin.permissions.ClientPermissionManagement.MAP_ROLES_CLIENT_SCOPE;
-import static org.keycloak.services.resources.admin.permissions.ClientPermissionManagement.MAP_ROLES_COMPOSITE_SCOPE;
-import static org.keycloak.services.resources.admin.permissions.ClientPermissionManagement.MAP_ROLES_SCOPE;
-import static org.keycloak.services.resources.admin.permissions.RolePermissionManagement.MAP_ROLE_CLIENT_SCOPE_SCOPE;
-import static org.keycloak.services.resources.admin.permissions.RolePermissionManagement.MAP_ROLE_COMPOSITE_SCOPE;
-import static org.keycloak.services.resources.admin.permissions.RolePermissionManagement.MAP_ROLE_SCOPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_COMPOSITE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_COMPOSITE;
 
 public class AvailableRoleMappingResource extends RoleMappingResource {
     public AvailableRoleMappingResource(KeycloakSession session, RealmModel realm, AdminPermissionEvaluator auth) {
@@ -66,18 +69,20 @@ public final List<ClientRole> listAvailableClientScopeRoleMappings(@PathParam("i
         @DefaultValue("0") int first, @QueryParam("max") @DefaultValue("10") int max, @QueryParam("search") @DefaultValue("") String search) {
         ClientScopeModel scopeModel = this.realm.getClientScopeById(id);
         if (scopeModel == null) {
-            throw new NotFoundException("Could not find client scope");
+            if (auth.clients().canListClientScopes()) throw new NotFoundException("Could not find client scope");
+            else throw new ForbiddenException();
         } else {
-            if(this.auth.clients().canManage() || !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
-                this.auth.clients().requireManage();
+            if (auth.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
                 Stream<String> excludedRoleIds = scopeModel.getScopeMappingsStream().filter(RoleModel::isClientRole).map(RoleModel::getId);
                 return searchForClientRolesByExcludedIds(realm, search, first, max, excludedRoleIds);
-            } else {
-                this.auth.clients().requireView(scopeModel);
-                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_CLIENT_SCOPE_SCOPE, MAP_ROLES_CLIENT_SCOPE);
+            }
+            if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                auth.clients().requireView(scopeModel);
+                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_CLIENT_SCOPE, MAP_ROLES_CLIENT_SCOPE);
                 scopeModel.getScopeMappingsStream().forEach(role -> roleIds.remove(role.getId()));
                 return searchForClientRolesByIds(realm, roleIds.stream(), search, first, max);
             }
+            return Collections.emptyList();
         }
     }
 
@@ -103,18 +108,20 @@ public final List<ClientRole> listAvailableClientRoleMappings(@PathParam("id")
         @DefaultValue("0") int first, @QueryParam("max") @DefaultValue("10") int max, @QueryParam("search") @DefaultValue("") String search) {
         ClientModel client = this.realm.getClientById(id);
         if (client == null) {
-            throw new NotFoundException("Could not find client");
+            if (auth.clients().canList()) throw new NotFoundException("Could not find client");
+            else throw new ForbiddenException();
         } else {
-            if(this.auth.clients().canManage() || !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
-                this.auth.clients().requireManage();
+            if (auth.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
                 Stream<String> excludedRoleIds = Stream.concat(client.getScopeMappingsStream(), client.getRolesStream()).filter(RoleModel::isClientRole).map(RoleModel::getId);
                 return searchForClientRolesByExcludedIds(realm, search, first, max, excludedRoleIds);
-            } else {
-                this.auth.clients().requireView(client);
-                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_CLIENT_SCOPE_SCOPE, MAP_ROLES_CLIENT_SCOPE);
+            }
+            if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                auth.clients().requireView(client);
+                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_CLIENT_SCOPE, MAP_ROLES_CLIENT_SCOPE);
                 Stream.concat(client.getScopeMappingsStream(), client.getRolesStream()).forEach(role -> roleIds.remove(role.getId()));
                 return searchForClientRolesByIds(realm, roleIds.stream(), search, first, max);
             }
+            return Collections.emptyList();
         }
     }
 
@@ -140,18 +147,20 @@ public final List<ClientRole> listAvailableGroupRoleMappings(@PathParam("id")  S
         @DefaultValue("0") int first, @QueryParam("max") @DefaultValue("10") int max, @QueryParam("search") @DefaultValue("") String search) {
         GroupModel group = this.realm.getGroupById(id);
         if (group == null) {
-            throw new NotFoundException("Could not find group");
+            if (auth.groups().canList()) throw new NotFoundException("Could not find group");
+            else throw new ForbiddenException();
         } else {
-            if(this.auth.users().canManage() || !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
-                this.auth.users().requireManage();
+            if (auth.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
                 Stream<String> excludedRoleIds = group.getRoleMappingsStream().filter(RoleModel::isClientRole).map(RoleModel::getId);
                 return searchForClientRolesByExcludedIds(realm, search, first, max, excludedRoleIds);
-            } else {
-                this.auth.groups().requireView(group);
-                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_SCOPE, MAP_ROLES_SCOPE);
+            }
+            if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                auth.groups().requireView(group);
+                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE, MAP_ROLES);
                 group.getRoleMappingsStream().forEach(role -> roleIds.remove(role.getId()));
                 return searchForClientRolesByIds(realm, roleIds.stream(), search, first, max);
             }
+            return Collections.emptyList();
         }
     }
 
@@ -181,16 +190,20 @@ public final List<ClientRole> listAvailableUserRoleMappings(@PathParam("id") Str
             if (auth.users().canQuery()) throw new NotFoundException("User not found");
             else throw new ForbiddenException();
         } else {
-            if (this.auth.users().canManage() || !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
-                this.auth.users().requireManage();
+            if (auth.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
                 Stream<String> excludedRoleIds = userModel.getRoleMappingsStream().filter(RoleModel::isClientRole).map(RoleModel::getId);
                 return searchForClientRolesByExcludedIds(realm, search, first, max, excludedRoleIds);
-            } else {
-                this.auth.users().requireView(userModel);
-                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_SCOPE, MAP_ROLES_SCOPE);
+            }
+            if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                auth.users().requireView(userModel);
+                if (!auth.users().canMapRoles(userModel)) {
+                    return Collections.emptyList();
+                }
+                Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE, MAP_ROLES);
                 userModel.getRoleMappingsStream().forEach(role -> roleIds.remove(role.getId()));
                 return searchForClientRolesByIds(realm, roleIds.stream(), search, first, max);
             }
+            return Collections.emptyList();
         }
     }
 
@@ -214,20 +227,26 @@ public final List<ClientRole> listAvailableUserRoleMappings(@PathParam("id") Str
     )
     public final List<ClientRole> listAvailableRoleMappings(@PathParam("id") String id, @QueryParam("first") @DefaultValue("0") int first,
             @QueryParam("max") @DefaultValue("10") int max, @QueryParam("search") @DefaultValue("") String search) {
-        if (this.auth.users().canManage() || !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
-            this.auth.users().requireManage();
+        if (auth.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
             return searchForClientRolesByExcludedIds(realm, search, first, max, Stream.of(id));
-        } else {
-            Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_COMPOSITE_SCOPE, MAP_ROLES_COMPOSITE_SCOPE);
+        }
+        if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            Set<String> roleIds = getRoleIdsWithPermissions(MAP_ROLE_COMPOSITE, MAP_ROLES_COMPOSITE);
             roleIds.remove(id);
             return searchForClientRolesByIds(realm, roleIds.stream(), search, first, max);
         }
+        return Collections.emptyList();
     }
 
     private Set<String> getRoleIdsWithPermissions(String roleResourceScope, String clientResourceScope) {
-        Set<String> roleIds = this.auth.roles().getRolesWithPermission(roleResourceScope);
-        Set<String> clientIds = this.auth.clients().getClientsWithPermission(clientResourceScope);
-        clientIds.stream().flatMap(cid -> realm.getClientById(cid).getRolesStream()).forEach(role -> roleIds.add(role.getId()));
+        Set<String> roleIds;
+        if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) && canPerformOnAllClients(clientResourceScope)) {
+            roleIds = session.clients().getClientsStream(realm).flatMap(client -> client.getRolesStream()).map(RoleModel::getId).collect(Collectors.toSet());
+        } else {
+            roleIds = this.auth.roles().getRoleIdsByScope(roleResourceScope);
+            Set<String> clientIds = this.auth.clients().getClientIdsByScope(clientResourceScope);
+            clientIds.stream().flatMap(cid -> realm.getClientById(cid).getRolesStream()).forEach(role -> roleIds.add(role.getId()));
+        }
         return roleIds;
     }
 
@@ -240,4 +259,17 @@ private List<ClientRole> searchForClientRolesByExcludedIds(RealmModel realm, Str
         Stream<RoleModel> result = session.roles().searchForClientRolesStream(realm, search, excludedIds, first, max);
         return result.map(role -> RoleMapper.convertToModel(role, realm)).collect(Collectors.toList());
     }
+
+    private boolean canPerformOnAllClients(String scope) {
+        switch (scope) {
+            case MAP_ROLES:
+                return auth.clients().canMapRoles(null);
+            case MAP_ROLES_COMPOSITE:
+                return auth.clients().canMapCompositeRoles(null);
+            case MAP_ROLES_CLIENT_SCOPE:
+                return auth.clients().canMapClientScopeRoles(null);
+            default:
+                return false;
+        }
+    }
 }
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java
index 12c70a8a4b16..ff253d4f5ff8 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java
@@ -17,6 +17,8 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
 import org.jboss.logging.Logger;
 import org.keycloak.admin.ui.rest.model.BruteUser;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.common.Profile;
 import org.keycloak.common.util.Time;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
@@ -25,8 +27,11 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.UserPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.UserPermissionEvaluator;
+import org.keycloak.userprofile.UserProfile;
+import org.keycloak.userprofile.UserProfileContext;
+import org.keycloak.userprofile.UserProfileProvider;
 import org.keycloak.utils.SearchQueryUtils;
 
 public class BruteForceUsersResource {
@@ -144,29 +149,35 @@ public final Stream<BruteUser> searchUser(@QueryParam("search") String search,
     private Stream<BruteUser> searchForUser(Map<String, String> attributes, RealmModel realm, UserPermissionEvaluator usersEvaluator, Boolean briefRepresentation, Integer firstResult, Integer maxResults, Boolean includeServiceAccounts) {
         attributes.put(UserModel.INCLUDE_SERVICE_ACCOUNT, includeServiceAccounts.toString());
 
-        if (!auth.users().canView()) {
-            Set<String> groupModels = auth.groups().getGroupsWithViewPermission();
-
-            if (!groupModels.isEmpty()) {
-                session.setAttribute(UserModel.GROUPS, groupModels);
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            Set<String> groupIds = auth.groups().getGroupIdsWithViewPermission();
+            if (!groupIds.isEmpty()) {
+                session.setAttribute(UserModel.GROUPS, groupIds);
             }
         }
 
-        Stream<UserModel> userModels = session.users().searchForUserStream(realm, attributes, firstResult, maxResults);
-        return toRepresentation(realm, usersEvaluator, briefRepresentation, userModels);
+        return toRepresentation(realm, usersEvaluator, briefRepresentation, session.users().searchForUserStream(realm, attributes, firstResult, maxResults));
     }
 
     private Stream<BruteUser> toRepresentation(RealmModel realm, UserPermissionEvaluator usersEvaluator,
             Boolean briefRepresentation, Stream<UserModel> userModels) {
         boolean briefRepresentationB = briefRepresentation != null && briefRepresentation;
-        boolean canViewGlobal = usersEvaluator.canView();
 
-        usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
-        return userModels.filter(user -> canViewGlobal || usersEvaluator.canView(user)).map(user -> {
+        if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
+            userModels = userModels.filter(usersEvaluator::canView);
+            usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
+        }
+
+        UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
+
+        return userModels.map(user -> {
+            UserProfile profile = provider.create(UserProfileContext.USER_API, user);
+            UserRepresentation rep = profile.toRepresentation();
             UserRepresentation userRep = briefRepresentationB ?
-                    ModelToRepresentation.toBriefRepresentation(user) :
-                    ModelToRepresentation.toRepresentation(session, realm, user);
-            userRep.setAccess(usersEvaluator.getAccess(user));
+                    ModelToRepresentation.toBriefRepresentation(user, rep, false) :
+                    ModelToRepresentation.toRepresentation(session, realm, user, rep, false);
+            userRep.setAccess(usersEvaluator.getAccessForListing(user));
             return userRep;
         }).map(this::getBruteForceStatus);
     }
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/EffectiveRoleMappingResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/EffectiveRoleMappingResource.java
index 421f8413be6f..5a5519931273 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/EffectiveRoleMappingResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/EffectiveRoleMappingResource.java
@@ -25,7 +25,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import static org.keycloak.admin.ui.rest.model.RoleMapper.convertToModel;
 
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/RoleMappingResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/RoleMappingResource.java
index 138a051efb8b..e6c7924dd22b 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/RoleMappingResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/RoleMappingResource.java
@@ -2,7 +2,7 @@
 
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 public abstract class RoleMappingResource {
     protected final KeycloakSession session;
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/SessionsResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/SessionsResource.java
index 94161bd561aa..c16dc75702ba 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/SessionsResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/SessionsResource.java
@@ -1,5 +1,6 @@
 package org.keycloak.admin.ui.rest;
 
+import jakarta.ws.rs.Path;
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.media.Content;
@@ -15,7 +16,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.light.LightweightUserAdapter;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DefaultValue;
@@ -91,12 +92,55 @@ public Stream<SessionRepresentation> realmSessions(@QueryParam("type") @DefaultV
             return Stream.<SessionRepresentation>builder().build();
         });
 
+        return applySearch(search, result).distinct().skip(first).limit(max);
+    }
+
+    @GET
+    @Path("client")
+    @Consumes({"application/json"})
+    @Produces({"application/json"})
+    @Operation(
+            summary = "List all sessions of the passed client containing regular and offline",
+            description = "This endpoint returns a list of sessions and the clients that have been used including offline tokens"
+    )
+    @APIResponse(
+            responseCode = "200",
+            description = "",
+            content = {@Content(
+                    schema = @Schema(
+                            implementation = SessionRepresentation.class,
+                            type = SchemaType.ARRAY
+                    )
+            )}
+    )
+    public Stream<SessionRepresentation> clientSessions(@QueryParam("clientId") final String clientId,
+                                                        @QueryParam("type") @DefaultValue("ALL") final SessionType type,
+                                                        @QueryParam("search") @DefaultValue("") final String search, @QueryParam("first")
+                                                        @DefaultValue("0") int first, @QueryParam("max") @DefaultValue("10") int max) {
+        ClientModel clientModel = realm.getClientById(clientId);
+        auth.clients().requireView(clientModel);
+
+        Stream<SessionRepresentation> result = Stream.<SessionRepresentation>builder().build();
+        if (type == ALL || type == REGULAR) {
+            result = Stream.concat(result, session.sessions()
+                    .getUserSessionsStream(clientModel.getRealm(), clientModel).map(s -> toRepresentation(s, REGULAR)));
+        }
+        if (type == ALL || type == OFFLINE) {
+            result = Stream.concat(result, session.sessions()
+                    .getOfflineUserSessionsStream(clientModel.getRealm(), clientModel, null, null)
+                    .map(s -> toRepresentation(s, OFFLINE)));
+        }
+
+        return applySearch(search, result).distinct().skip(first).limit(max);
+    }
+
+    private static Stream<SessionRepresentation> applySearch(String search, Stream<SessionRepresentation> result) {
         if (!StringUtil.isBlank(search)) {
             String searchTrimmed = search.trim();
             result = result.filter(s -> s.getUsername().contains(searchTrimmed) || s.getIpAddress().contains(searchTrimmed)
-                                        || s.getClients().values().stream().anyMatch(c -> c.contains(searchTrimmed)));
+                    || s.getClients().values().stream().anyMatch(c -> c.contains(searchTrimmed)));
         }
-        return result.distinct().skip(first).limit(max);
+        return result;
     }
 
     private static SessionRepresentation toRepresentation(UserSessionModel session, SessionType type) {
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmResource.java
index 43f70a314a9e..3e13f6bee9a0 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmResource.java
@@ -33,7 +33,7 @@
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 import org.keycloak.services.resources.admin.RealmAdminResource;
 import org.keycloak.services.resources.admin.UserProfileResource;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.storage.UserStorageProviderModel;
 
 import jakarta.ws.rs.Consumes;
diff --git a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmsResource.java b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmsResource.java
index 01c03c28f0f1..5b23783b10dc 100644
--- a/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmsResource.java
+++ b/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmsResource.java
@@ -17,9 +17,9 @@
 import org.keycloak.admin.ui.rest.model.RealmNameRepresentation;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.RealmsPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.RealmsPermissionEvaluator;
 
 public class UIRealmsResource {
 
diff --git a/saml-core-api/src/main/java/org/keycloak/dom/saml/v2/mdattr/EntityAttributes.java b/saml-core-api/src/main/java/org/keycloak/dom/saml/v2/mdattr/EntityAttributes.java
index 45de268d4162..d09fe6d32530 100644
--- a/saml-core-api/src/main/java/org/keycloak/dom/saml/v2/mdattr/EntityAttributes.java
+++ b/saml-core-api/src/main/java/org/keycloak/dom/saml/v2/mdattr/EntityAttributes.java
@@ -50,12 +50,12 @@ public List<AssertionType> getAssertion() {
         return assertion;
     }
 
-    public void addAssertion(AssertionType attributeType) {
-        assertion.add(attributeType);
+    public void addAssertion(AssertionType assertionType) {
+        assertion.add(assertionType);
     }
 
-    public void removeAssertion(AttributeType attributeType) {
-        assertion.remove(attributeType);
+    public void removeAssertion(AssertionType assertionType) {
+        assertion.remove(assertionType);
     }
 
 }
diff --git a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
index 81c3ee1c7c2c..516ef4f79c1c 100755
--- a/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
+++ b/saml-core/src/main/java/org/keycloak/saml/BaseSAML2BindingBuilder.java
@@ -426,7 +426,7 @@ public URI generateRedirectUri(String samlParameterName, String redirectUri, Doc
                 rawQuery = rawQuery.substring(pos + 1);
             }
             Signature signature = signatureAlgorithm.createSignature();
-            byte[] sig = new byte[0];
+            byte[] sig = null;
             try {
                 signature.initSign(signingKeyPair.getPrivate());
                 signature.update(rawQuery.getBytes(GeneralConstants.SAML_CHARSET));
diff --git a/saml-core/src/main/java/org/keycloak/saml/SPMetadataDescriptor.java b/saml-core/src/main/java/org/keycloak/saml/SPMetadataDescriptor.java
index ff786d685302..4d886264fee3 100755
--- a/saml-core/src/main/java/org/keycloak/saml/SPMetadataDescriptor.java
+++ b/saml-core/src/main/java/org/keycloak/saml/SPMetadataDescriptor.java
@@ -19,7 +19,9 @@
 
 import java.net.URI;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
+import java.util.ListIterator;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -45,9 +47,17 @@
 public class SPMetadataDescriptor {
 
     public static EntityDescriptorType buildSPDescriptor(URI loginBinding, URI logoutBinding, URI assertionEndpoint, URI logoutEndpoint,
-                                                         boolean wantAuthnRequestsSigned, boolean wantAssertionsSigned, boolean wantAssertionsEncrypted,
-                                                         String entityId, String nameIDPolicyFormat, List<KeyDescriptorType> signingCerts, List<KeyDescriptorType> encryptionCerts)
-    {
+            boolean wantAuthnRequestsSigned, boolean wantAssertionsSigned, boolean wantAssertionsEncrypted,
+            String entityId, String nameIDPolicyFormat, List<KeyDescriptorType> signingCerts, List<KeyDescriptorType> encryptionCerts) {
+        return buildSPDescriptor(Collections.singletonList(new EndpointType(loginBinding, assertionEndpoint)),
+                Collections.singletonList(new EndpointType(logoutBinding, logoutEndpoint)),
+                wantAuthnRequestsSigned, wantAssertionsSigned, wantAssertionsEncrypted, entityId, nameIDPolicyFormat, signingCerts, encryptionCerts);
+    }
+
+    public static EntityDescriptorType buildSPDescriptor(List<EndpointType> assertionConsumerServices, List<EndpointType> singleLogoutServices,
+            boolean wantAuthnRequestsSigned, boolean wantAssertionsSigned, boolean wantAssertionsEncrypted,
+            String entityId, String nameIDPolicyFormat, List<KeyDescriptorType> signingCerts,
+            List<KeyDescriptorType> encryptionCerts) {
         EntityDescriptorType entityDescriptor = new EntityDescriptorType(entityId);
         entityDescriptor.setID(IDGenerator.create("ID_"));
 
@@ -55,7 +65,7 @@ public static EntityDescriptorType buildSPDescriptor(URI loginBinding, URI logou
         spSSODescriptor.setAuthnRequestsSigned(wantAuthnRequestsSigned);
         spSSODescriptor.setWantAssertionsSigned(wantAssertionsSigned);
         spSSODescriptor.addNameIDFormat(nameIDPolicyFormat);
-        spSSODescriptor.addSingleLogoutService(new EndpointType(logoutBinding, logoutEndpoint));
+        singleLogoutServices.forEach(spSSODescriptor::addSingleLogoutService);
 
         if (wantAuthnRequestsSigned && signingCerts != null) {
             for (KeyDescriptorType key: signingCerts) {
@@ -69,10 +79,13 @@ public static EntityDescriptorType buildSPDescriptor(URI loginBinding, URI logou
             }
         }
 
-        IndexedEndpointType assertionConsumerEndpoint = new IndexedEndpointType(loginBinding, assertionEndpoint);
-        assertionConsumerEndpoint.setIsDefault(true);
-        assertionConsumerEndpoint.setIndex(1);
-        spSSODescriptor.addAssertionConsumerService(assertionConsumerEndpoint);
+        for (ListIterator<EndpointType> iter = assertionConsumerServices.listIterator(); iter.hasNext(); ) {
+            EndpointType endpoint = iter.next();
+            IndexedEndpointType assertionConsumerService = new IndexedEndpointType(endpoint.getBinding(), endpoint.getLocation());
+            assertionConsumerService.setIndex(iter.nextIndex());
+            assertionConsumerService.setIsDefault(iter.nextIndex() == 1 ? Boolean.TRUE : null);
+            spSSODescriptor.addAssertionConsumerService(assertionConsumerService);
+        }
 
         entityDescriptor.addChoiceType(new EntityDescriptorType.EDTChoiceType(Arrays.asList(new EntityDescriptorType.EDTDescriptorChoiceType(spSSODescriptor))));
 
diff --git a/saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java b/saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java
index b0d61d8491cf..1e7a85ca8d03 100755
--- a/saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java
+++ b/saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java
@@ -37,7 +37,6 @@
 import javax.xml.stream.events.Attribute;
 import javax.xml.stream.events.Characters;
 import javax.xml.stream.events.Comment;
-import javax.xml.stream.events.EndElement;
 import javax.xml.stream.events.Namespace;
 import javax.xml.stream.events.StartElement;
 import javax.xml.stream.events.XMLEvent;
@@ -67,7 +66,7 @@ public class TransformerUtil {
 
     private static final PicketLinkLogger logger = PicketLinkLoggerFactory.getLogger();
 
-    private static TransformerFactory transformerFactory;
+    private static volatile TransformerFactory transformerFactory;
 
     /**
      * Get the Default Transformer
@@ -102,32 +101,38 @@ public static Transformer getTransformer() throws ConfigurationException {
      */
     public static TransformerFactory getTransformerFactory() throws TransformerFactoryConfigurationError {
         if (transformerFactory == null) {
-            boolean tccl_jaxp = SystemPropertiesUtil.getSystemProperty(GeneralConstants.TCCL_JAXP, "false")
-                    .equalsIgnoreCase("true");
-            ClassLoader prevTCCL = SecurityActions.getTCCL();
-            try {
-                if (tccl_jaxp) {
-                    SecurityActions.setTCCL(TransformerUtil.class.getClassLoader());
-                }
-                transformerFactory = TransformerFactory.newInstance();
-                try {
-                    transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-                } catch (TransformerConfigurationException ignored) {
-                    // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
-                    logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
-                }
-                try {
-                    transformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_DTD, "");
-
-                    transformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
-                } catch (Exception ignored) {
-                    // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
-                    logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
-                }
-
-            } finally {
-                if (tccl_jaxp) {
-                    SecurityActions.setTCCL(prevTCCL);
+            synchronized (TransformerUtil.class) {
+                if (transformerFactory == null) {
+                    boolean tccl_jaxp = SystemPropertiesUtil.getSystemProperty(GeneralConstants.TCCL_JAXP, "false")
+                            .equalsIgnoreCase("true");
+                    ClassLoader prevTCCL = SecurityActions.getTCCL();
+                    TransformerFactory localTransformerFactory;
+                    try {
+                        if (tccl_jaxp) {
+                            SecurityActions.setTCCL(TransformerUtil.class.getClassLoader());
+                        }
+                        localTransformerFactory = TransformerFactory.newInstance();
+                        try {
+                            localTransformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+                        } catch (TransformerConfigurationException ignored) {
+                            // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
+                            logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
+                        }
+                        try {
+                            localTransformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_DTD, "");
+
+                            localTransformerFactory.setAttribute(FixXMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+                        } catch (Exception ignored) {
+                            // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
+                            logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
+                        }
+
+                    } finally {
+                        if (tccl_jaxp) {
+                            SecurityActions.setTCCL(prevTCCL);
+                        }
+                    }
+                    transformerFactory = localTransformerFactory;
                 }
             }
         }
@@ -447,4 +452,4 @@ public CustomHolder(Document document, boolean bool) {
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/mdattr/SAMLEntityAttributesParser.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/mdattr/SAMLEntityAttributesParser.java
index dabafddddbec..d28636b9a163 100644
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/mdattr/SAMLEntityAttributesParser.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/mdattr/SAMLEntityAttributesParser.java
@@ -1,7 +1,5 @@
 package org.keycloak.saml.processing.core.parsers.saml.mdattr;
 
-import java.io.Serializable;
-
 import javax.xml.stream.XMLEventReader;
 import javax.xml.stream.events.StartElement;
 
@@ -13,7 +11,7 @@
 import org.keycloak.saml.processing.core.parsers.saml.metadata.AbstractStaxSamlMetadataParser;
 import org.keycloak.saml.processing.core.parsers.saml.metadata.SAMLMetadataQNames;
 
-public class SAMLEntityAttributesParser extends AbstractStaxSamlMetadataParser<EntityAttributes> implements Serializable {
+public class SAMLEntityAttributesParser extends AbstractStaxSamlMetadataParser<EntityAttributes> {
     private static final SAMLEntityAttributesParser INSTANCE = new SAMLEntityAttributesParser();
 
     private SAMLEntityAttributesParser() {
@@ -43,4 +41,4 @@ protected void processSubElement(XMLEventReader xmlEventReader, EntityAttributes
                 throw LOGGER.parserUnknownTag(StaxParserUtil.getElementName(elementDetail), elementDetail.getLocation());
         }
     }
-}
\ No newline at end of file
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/metadata/SAMLEncryptionMethodParser.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/metadata/SAMLEncryptionMethodParser.java
index 36dd3ed97702..971b6505257c 100644
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/metadata/SAMLEncryptionMethodParser.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/metadata/SAMLEncryptionMethodParser.java
@@ -37,7 +37,7 @@ protected void processSubElement(XMLEventReader xmlEventReader, EncryptionMethod
             case KEY_SIZE:
                 {
                     StaxParserUtil.advance(xmlEventReader);
-                    BigInteger keySize = BigInteger.valueOf(Long.valueOf(StaxParserUtil.getElementText(xmlEventReader)));
+                    BigInteger keySize = BigInteger.valueOf(Long.parseLong(StaxParserUtil.getElementText(xmlEventReader)));
 
                     EncryptionMethodType.EncryptionMethod encMethod = target.getEncryptionMethod();
                     if (encMethod == null) {
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/util/SAML11ParserUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/util/SAML11ParserUtil.java
index 6f93ecdb3674..56e7ca9a3525 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/util/SAML11ParserUtil.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/util/SAML11ParserUtil.java
@@ -545,7 +545,7 @@ public static KeyInfoType parseKeyInfo(XMLEventReader xmlEventReader) throws Par
             if (xmlEvent instanceof EndElement) {
                 tag = StaxParserUtil.getElementName((EndElement) xmlEvent);
                 if (tag.equals(WSTrustConstants.XMLDSig.KEYINFO)) {
-                    xmlEvent = StaxParserUtil.getNextEndElement(xmlEventReader);
+                    StaxParserUtil.getNextEndElement(xmlEventReader);
                     break;
                 } else
                     throw logger.parserUnknownEndElement(tag, xmlEvent.getLocation());
@@ -606,7 +606,7 @@ public static RSAKeyValueType parseRSAKeyValue(XMLEventReader xmlEventReader) th
             if (xmlEvent instanceof EndElement) {
                 tag = StaxParserUtil.getElementName((EndElement) xmlEvent);
                 if (tag.equals(WSTrustConstants.XMLDSig.RSA_KEYVALUE)) {
-                    xmlEvent = StaxParserUtil.getNextEndElement(xmlEventReader);
+                    StaxParserUtil.getNextEndElement(xmlEventReader);
                     break;
                 } else
                     throw logger.parserUnknownEndElement(tag, xmlEvent.getLocation());
@@ -805,4 +805,4 @@ public static SAML11AuthorizationDecisionQueryType parseSAML11AuthorizationDecis
         }
         return query;
     }
-}
\ No newline at end of file
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtil.java
new file mode 100644
index 000000000000..d274f84237aa
--- /dev/null
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtil.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.saml.processing.core.saml.v2.util;
+
+import org.keycloak.saml.common.constants.JBossSAMLConstants;
+import org.keycloak.saml.common.exceptions.ConfigurationException;
+import org.keycloak.saml.common.util.TransformerUtil;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+import java.io.StringWriter;
+import java.util.Optional;
+
+/**
+ * Utility class to manipulate SAML ArtifactResponse and embedded Response.
+ * @author Thibault Morin (https://tmorin.github.io)
+ */
+public final class ArtifactResponseUtil {
+
+    private ArtifactResponseUtil() {
+    }
+
+    /**
+     * Convert the Document to a string.
+     * <p>
+     * The Response shall match the namespace "urn:oasis:names:tc:SAML:2.0:protocol" and the element "Response".
+     *
+     * @param document the Document to convert
+     * @return the Document as a string
+     */
+    public static Optional<String> convertResponseToString(Document document) {
+        return extractResponseElement(document).map(ArtifactResponseUtil::nodeToString);
+    }
+
+    /**
+     * Convert a Node to a string.
+     *
+     * @param node the Node to convert
+     * @return the Node as a string
+     */
+    static String nodeToString(Node node) {
+        try {
+            final StringWriter writer = new StringWriter();
+            TransformerUtil.getTransformer().transform(new DOMSource(node), new StreamResult(writer));
+            return writer.getBuffer().toString();
+        } catch (ConfigurationException | TransformerException e) {
+            throw new IllegalStateException("Error converting node to string", e);
+        }
+    }
+
+    /**
+     * Extract the Response element from the Document.
+     *
+     * @param document the Document to extract the Response element from
+     * @return the Response element
+     */
+    static Optional<Element> extractResponseElement(Document document) {
+        // extract from the ArtifactResponse the embedded Response
+        final NodeList responseNodeList = document.getElementsByTagNameNS(
+                JBossSAMLConstants.RESPONSE__PROTOCOL.getNsUri().get(),
+                JBossSAMLConstants.RESPONSE__PROTOCOL.get()
+        );
+
+        // leave early if there is no embedded Response
+        if (responseNodeList.getLength() != 1) {
+            return Optional.empty();
+        }
+
+        // convert the embedded Response to a string and then to a base64 serialized string
+        final Node responseNode = responseNodeList.item(0);
+
+        // leave early if the response node is not an Element
+        if (responseNode.getNodeType() != Node.ELEMENT_NODE) {
+            return Optional.empty();
+        }
+
+        // return the response node as an Element
+        return Optional.of((Element) responseNode);
+    }
+
+}
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SAMLMetadataUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SAMLMetadataUtil.java
index 660b96c0438a..576f5c056ec3 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SAMLMetadataUtil.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/SAMLMetadataUtil.java
@@ -16,9 +16,12 @@
  */
 package org.keycloak.saml.processing.core.saml.v2.util;
 
+import java.io.StringWriter;
+import java.security.KeyPair;
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.function.Function;
+import javax.xml.crypto.dsig.CanonicalizationMethod;
 import org.keycloak.dom.saml.v2.metadata.EntitiesDescriptorType;
 import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
 import org.keycloak.dom.saml.v2.metadata.IDPSSODescriptorType;
@@ -26,13 +29,19 @@
 import org.keycloak.dom.saml.v2.metadata.KeyTypes;
 import org.keycloak.dom.saml.v2.metadata.SPSSODescriptorType;
 import org.keycloak.dom.saml.v2.metadata.SSODescriptorType;
+import org.keycloak.saml.SignatureAlgorithm;
 import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
 import org.keycloak.saml.common.exceptions.ConfigurationException;
 import org.keycloak.saml.common.exceptions.ParsingException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
 import org.keycloak.saml.common.util.StaxParserUtil;
+import org.keycloak.saml.common.util.StaxUtil;
+import org.keycloak.saml.processing.api.saml.v2.sig.SAML2Signature;
 import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
+import org.keycloak.saml.processing.core.saml.v2.common.IDGenerator;
+import org.keycloak.saml.processing.core.saml.v2.writers.SAMLMetadataWriter;
 import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
+import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
@@ -163,4 +172,36 @@ public static String removeUTF8BOM(String s) {
         }
         return s;
     }
+
+    public static String writeEntityDescriptorType(EntityDescriptorType type) throws ProcessingException {
+        final StringWriter sw = new StringWriter();
+        final SAMLMetadataWriter writer = new SAMLMetadataWriter(StaxUtil.getXMLStreamWriter(sw));
+        writer.writeEntityDescriptor(type);
+        return sw.toString();
+    }
+
+    public static String signEntityDescriptorType(EntityDescriptorType type, SignatureAlgorithm sigAlg,
+            String kid, X509Certificate certificate, KeyPair keyPair) throws ProcessingException, ConfigurationException, ParsingException {
+        if (type.getID() == null) {
+            type.setID(IDGenerator.create("ID_"));
+        }
+
+        // write descriptor to XML
+        final String descriptor = writeEntityDescriptorType(type);
+
+        // create the document from the XML
+        final Document metadataDocument = DocumentUtil.getDocument(descriptor);
+        final SAML2Signature signatureHelper = new SAML2Signature();
+        signatureHelper.setSignatureMethod(sigAlg.getXmlSignatureMethod());
+        signatureHelper.setDigestMethod(sigAlg.getXmlSignatureDigestMethod());
+        signatureHelper.setX509Certificate(certificate);
+
+        final Node nextSibling = metadataDocument.getDocumentElement().getFirstChild();
+        signatureHelper.setNextSibling(nextSibling);
+
+        // sign the document
+        signatureHelper.signSAMLDocument(metadataDocument, kid, keyPair, CanonicalizationMethod.EXCLUSIVE);
+
+        return DocumentUtil.getDocumentAsString(metadataDocument);
+    }
 }
diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/XMLTimeUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/XMLTimeUtil.java
index 3545d6c7ebe0..332d2c3c5589 100755
--- a/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/XMLTimeUtil.java
+++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/saml/v2/util/XMLTimeUtil.java
@@ -190,7 +190,7 @@ public static Duration parseAsDuration(String timeValue) {
             if (timeValue.startsWith("P")) {
                 return factory.newDuration(timeValue);
             } else {
-                return factory.newDuration(Long.valueOf(timeValue));
+                return factory.newDuration(Long.parseLong(timeValue));
             }
         } catch (Exception e) {
             throw logger.samlMetaDataFailedToCreateCacheDuration(timeValue);
diff --git a/saml-core/src/test/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtilTest.java b/saml-core/src/test/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtilTest.java
new file mode 100644
index 000000000000..27e6e40b71f6
--- /dev/null
+++ b/saml-core/src/test/java/org/keycloak/saml/processing/core/saml/v2/util/ArtifactResponseUtilTest.java
@@ -0,0 +1,109 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.saml.processing.core.saml.v2.util;
+
+import junit.framework.TestCase;
+import org.junit.Assert;
+import org.keycloak.saml.common.util.DocumentUtil;
+import org.keycloak.saml.processing.api.saml.v2.request.SAML2Request;
+import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+
+import java.io.InputStream;
+import java.util.Optional;
+
+/**
+ * @author Thibault Morin (https://tmorin.github.io)
+ */
+public class ArtifactResponseUtilTest extends TestCase {
+
+    public void testConvertResponseToString() throws Exception {
+        InputStream artifactResponseAsInputStream = ArtifactResponseUtilTest.class.getResourceAsStream(
+                "saml20-artifact-response-assertion-signed.xml"
+        );
+        Assert.assertNotNull(artifactResponseAsInputStream);
+
+        InputStream expectedResponseAsInputStream = ArtifactResponseUtilTest.class.getResourceAsStream(
+                "saml20-response-assertion-signed.xml"
+        );
+        Assert.assertNotNull(expectedResponseAsInputStream);
+        String expectedResponseAsString = new String(expectedResponseAsInputStream.readAllBytes());
+
+        // transform the InputStream to a SAMLDocumentHolder to get the Document as implemented in org.keycloak.broker.saml.SAMLEndpoint
+        SAMLDocumentHolder saml2ObjectFromDocument = SAML2Request.getSAML2ObjectFromStream(artifactResponseAsInputStream);
+        Assert.assertNotNull(saml2ObjectFromDocument);
+
+        // the value shall be present
+        Optional<String> optionalString = ArtifactResponseUtil.convertResponseToString(saml2ObjectFromDocument.getSamlDocument());
+        Assert.assertTrue(optionalString.isPresent());
+
+        // the value shall be equal to the expected value
+        Assert.assertEquals(expectedResponseAsString, optionalString.get());
+    }
+
+    public void testNodeToString() throws Exception {
+        String documentAstring = "<foo><bar>VALUE</bar></foo>";
+
+        // create a document
+        Document document = DocumentUtil.getDocument(documentAstring);
+        Assert.assertNotNull(document);
+
+        // transform the document to a string
+        String transformedDocument = ArtifactResponseUtil.nodeToString(document);
+
+        // assert the transformed document is equal to the original document
+        Assert.assertEquals(documentAstring, transformedDocument);
+    }
+
+    public void testExtractResponseElement() throws Exception {
+        InputStream artifactResponseAsInputStream = ArtifactResponseUtilTest.class.getResourceAsStream(
+                "saml20-artifact-response-assertion-signed.xml"
+        );
+        Assert.assertNotNull(artifactResponseAsInputStream);
+
+        // transform the InputStream to a SAMLDocumentHolder to get the Document as implemented in org.keycloak.broker.saml.SAMLEndpoint
+        SAMLDocumentHolder saml2ObjectFromDocument = SAML2Request.getSAML2ObjectFromStream(artifactResponseAsInputStream);
+
+        // the element shall be present
+        Optional<Element> optionalElement = ArtifactResponseUtil.extractResponseElement(saml2ObjectFromDocument.getSamlDocument());
+        Assert.assertTrue(optionalElement.isPresent());
+    }
+
+    public void testExtractResponseElementWhenResponseNotFound() throws Exception {
+        InputStream artifactResponseAsInputStream = ArtifactResponseUtilTest.class.getResourceAsStream(
+                "saml20-artifact-response-assertion-signed.xml"
+        );
+        Assert.assertNotNull(artifactResponseAsInputStream);
+
+        // transform the InputStream to a SAMLDocumentHolder to get the Document as implemented in org.keycloak.broker.saml.SAMLEndpoint
+        SAMLDocumentHolder saml2ObjectFromDocument = SAML2Request.getSAML2ObjectFromStream(artifactResponseAsInputStream);
+
+        // get the Response element and remove it
+        Node responseNode = saml2ObjectFromDocument.getSamlDocument().getElementsByTagNameNS(
+                "urn:oasis:names:tc:SAML:2.0:protocol",
+                "Response"
+        ).item(0);
+        responseNode.getParentNode().removeChild(responseNode);
+
+        // the element shall be absent
+        Optional<Element> optionalElement = ArtifactResponseUtil.extractResponseElement(saml2ObjectFromDocument.getSamlDocument());
+        Assert.assertTrue(optionalElement.isEmpty());
+    }
+}
diff --git a/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-artifact-response-assertion-signed.xml b/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-artifact-response-assertion-signed.xml
new file mode 100644
index 000000000000..91880aaaa2e1
--- /dev/null
+++ b/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-artifact-response-assertion-signed.xml
@@ -0,0 +1 @@
+<samlp:ArtifactResponse xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="ID_a21e5852-5277-440f-b3c3-48057c8047c7" InResponseTo="ID_13fe208a-a2a0-4c51-83b6-2f6a37e8eb89" IssueInstant="2025-02-05T13:55:10.383Z" Version="2.0"><saml:Issuer>https://idp.local:8091/auth/realms/master</saml:Issuer><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#ID_a21e5852-5277-440f-b3c3-48057c8047c7"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>e8FEfpWTZvuv0HrH8p/YUN1FiX+p0UUH20jh7A19pc4=</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>HMvNBbI60O81JJTUZLZg3LxMnl8YQHLSisANtSjin008hNDLXkz6Idh8eCb5gW4+vTvHr2wEaqCKtMiLKxa17/c7xGWuJ76bwXutj77iYp1boPLtkCTbWBa2l518NoMRjXAyXGpGEfM8BOxX6O4e81b/0L3KyGhmwC+qBe//0sVBPgYgODM5idAdrm2wdqFbLzTkuHtp8QNFfEVEUX5cIHohy3kO8t0ruaAAj0QnSrAyGhKUGqpUVIHonueF8f7X2RNcbv28KDxu5E7HsxfGALvjn1HB9DoGdBOQ7rc0NmYChzz0oUqvPS0EZrTOsYYgpLxJuoGjijvgYXEbsHO54w==</dsig:SignatureValue><dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>MIICmzCCAYMCBgGU1kvuCzANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjUwMjA1MTMyNjI3WhcNMzUwMjA1MTMyODA3WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgZGg8M5krIincdU/QYvkp2hUNYdum3O2svg92vH62u/wvoH6+NtLF68acQk37gC50905HOyHX9xa7gsVr14qQaIrBsoJfVUYrN2AXrqrlgmlwp7+XD5bmbkpzzrIVk7P3PX1YiZ/Ji21PbpJ9ZMcXTxF+l0c8sctqyIQ1KpHb6gVKnrZgbAC69RhWBSIKB+6pPiOOs1ZurX1Tp9WJZYyk3j8rAZpO/S9NFgw8qjARCC/jpQWF17JpadoDYNl/iM8NIYQZQk0XKYSuynyNUSmIlqtwLzxiXZzwnzsAD74DROVaTqRLzU5lqxkTyGteAHf8Az+JvwDpO3ZZIdjgDXVFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKobCjvangzlplMZu0rPrjFOcHm/Jl9+93YcFaNgEHFh3sWGnLiNa8BoBiiwukW0xHh0wJpCyJm/k00Bn2m+J4z+krp7QsbxZgDMivvCJvsbYNa4vcMQOb102dPRzNzaXCqo5NSb6RA1k+77yAsQuwA/7h4BCmADGCtKe7OIF8KEXKhpnKxQJfFFTSAovbZznYcrxhi5DbOPn1w07HW4l3kAQb4ay2iCf7afIy0ZvLdTUollMbz441jzn5t8Z5x2V1wZp0yWFOiZsbbNsEp5K4ogN4BjBl94yIWGoXYoetSAdXa+r5WgVF+uWYHkLMCefPQrfNm3IftuLLeKTxGr+4w=</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo></dsig:Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><samlp:Response Destination="https://sp.local:8081/auth/realms/master/broker/keycloak_idp_artifact/endpoint" ID="ID_0b8b5b93-ee79-41c4-a8be-a8ad859ab008" InResponseTo="ID_5c50fb09-3613-418a-a98f-97b76f1b8fee" IssueInstant="2025-02-05T13:55:10.382Z" Version="2.0"><saml:Issuer>https://idp.local:8091/auth/realms/master</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="ID_6c90c9b0-105e-4917-b927-5a4d4e7a9f6d" IssueInstant="2025-02-05T13:55:10.382Z" Version="2.0"><saml:Issuer>https://idp.local:8091/auth/realms/master</saml:Issuer><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#ID_6c90c9b0-105e-4917-b927-5a4d4e7a9f6d"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>YLnBHO1NQhnmVGQV3++qAEyyn/I7YAv+7krXfFsJzU8=</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>Lh3xGY5zO0GWJ/S41j1N3ibvtDn/ARXvlYsEbNqsWjjXpanEipY3JjXud1z7lTZL7WGCZ3mAj7t6hxmyRRnWDADBtlodpKnj74mkVE+gJdESCi/ZldR4Q3Xid1+kZOwmvY1qHutdcKcHReGw9hAbkVHtX1a7Ca4tjKXwZQPTNx1jccJ1/4Pyu17OBLbRPJsYSaxhMKp4x8Cye+/40GSVtcyFHfh4Zn2uollBf+rUOXWogsshxU8yRpIq8vszHFVt606mA1JS5zHqf4hfT5T7iq/+osV80bmgcRYOE0abubH1sve7CEumDGUrEde9eSTh7hnWmzGImQHgpMmLe+60xA==</dsig:SignatureValue><dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>MIICmzCCAYMCBgGU1kvuCzANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjUwMjA1MTMyNjI3WhcNMzUwMjA1MTMyODA3WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgZGg8M5krIincdU/QYvkp2hUNYdum3O2svg92vH62u/wvoH6+NtLF68acQk37gC50905HOyHX9xa7gsVr14qQaIrBsoJfVUYrN2AXrqrlgmlwp7+XD5bmbkpzzrIVk7P3PX1YiZ/Ji21PbpJ9ZMcXTxF+l0c8sctqyIQ1KpHb6gVKnrZgbAC69RhWBSIKB+6pPiOOs1ZurX1Tp9WJZYyk3j8rAZpO/S9NFgw8qjARCC/jpQWF17JpadoDYNl/iM8NIYQZQk0XKYSuynyNUSmIlqtwLzxiXZzwnzsAD74DROVaTqRLzU5lqxkTyGteAHf8Az+JvwDpO3ZZIdjgDXVFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKobCjvangzlplMZu0rPrjFOcHm/Jl9+93YcFaNgEHFh3sWGnLiNa8BoBiiwukW0xHh0wJpCyJm/k00Bn2m+J4z+krp7QsbxZgDMivvCJvsbYNa4vcMQOb102dPRzNzaXCqo5NSb6RA1k+77yAsQuwA/7h4BCmADGCtKe7OIF8KEXKhpnKxQJfFFTSAovbZznYcrxhi5DbOPn1w07HW4l3kAQb4ay2iCf7afIy0ZvLdTUollMbz441jzn5t8Z5x2V1wZp0yWFOiZsbbNsEp5K4ogN4BjBl94yIWGoXYoetSAdXa+r5WgVF+uWYHkLMCefPQrfNm3IftuLLeKTxGr+4w=</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo></dsig:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">G-e5c3849d-0b29-4462-b404-1724c576f5a1</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="ID_5c50fb09-3613-418a-a98f-97b76f1b8fee" NotOnOrAfter="2025-02-05T13:56:08.382Z" Recipient="https://sp.local:8081/auth/realms/master/broker/keycloak_idp_artifact/endpoint"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-02-05T13:55:08.382Z" NotOnOrAfter="2025-02-05T13:56:08.382Z"><saml:AudienceRestriction><saml:Audience>https://sp.local:8081/auth/realms/master</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-02-05T13:55:10.382Z" SessionIndex="c11a17f7-4f54-4078-a072-d0374e3d16d3::6ea713e9-0f72-4567-8640-efc9dba18d86" SessionNotOnOrAfter="2025-02-05T23:55:10.382Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">uma_authorization</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account-links</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">default-roles-master</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">offline_access</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">view-profile</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response></samlp:ArtifactResponse>
\ No newline at end of file
diff --git a/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-response-assertion-signed.xml b/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-response-assertion-signed.xml
new file mode 100644
index 000000000000..ca6adf25d33b
--- /dev/null
+++ b/saml-core/src/test/resources/org/keycloak/saml/processing/core/saml/v2/util/saml20-response-assertion-signed.xml
@@ -0,0 +1 @@
+<samlp:Response Destination="https://sp.local:8081/auth/realms/master/broker/keycloak_idp_artifact/endpoint" ID="ID_0b8b5b93-ee79-41c4-a8be-a8ad859ab008" InResponseTo="ID_5c50fb09-3613-418a-a98f-97b76f1b8fee" IssueInstant="2025-02-05T13:55:10.382Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.local:8091/auth/realms/master</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="ID_6c90c9b0-105e-4917-b927-5a4d4e7a9f6d" IssueInstant="2025-02-05T13:55:10.382Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>https://idp.local:8091/auth/realms/master</saml:Issuer><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#ID_6c90c9b0-105e-4917-b927-5a4d4e7a9f6d"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>YLnBHO1NQhnmVGQV3++qAEyyn/I7YAv+7krXfFsJzU8=</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>Lh3xGY5zO0GWJ/S41j1N3ibvtDn/ARXvlYsEbNqsWjjXpanEipY3JjXud1z7lTZL7WGCZ3mAj7t6hxmyRRnWDADBtlodpKnj74mkVE+gJdESCi/ZldR4Q3Xid1+kZOwmvY1qHutdcKcHReGw9hAbkVHtX1a7Ca4tjKXwZQPTNx1jccJ1/4Pyu17OBLbRPJsYSaxhMKp4x8Cye+/40GSVtcyFHfh4Zn2uollBf+rUOXWogsshxU8yRpIq8vszHFVt606mA1JS5zHqf4hfT5T7iq/+osV80bmgcRYOE0abubH1sve7CEumDGUrEde9eSTh7hnWmzGImQHgpMmLe+60xA==</dsig:SignatureValue><dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>MIICmzCCAYMCBgGU1kvuCzANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjUwMjA1MTMyNjI3WhcNMzUwMjA1MTMyODA3WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgZGg8M5krIincdU/QYvkp2hUNYdum3O2svg92vH62u/wvoH6+NtLF68acQk37gC50905HOyHX9xa7gsVr14qQaIrBsoJfVUYrN2AXrqrlgmlwp7+XD5bmbkpzzrIVk7P3PX1YiZ/Ji21PbpJ9ZMcXTxF+l0c8sctqyIQ1KpHb6gVKnrZgbAC69RhWBSIKB+6pPiOOs1ZurX1Tp9WJZYyk3j8rAZpO/S9NFgw8qjARCC/jpQWF17JpadoDYNl/iM8NIYQZQk0XKYSuynyNUSmIlqtwLzxiXZzwnzsAD74DROVaTqRLzU5lqxkTyGteAHf8Az+JvwDpO3ZZIdjgDXVFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKobCjvangzlplMZu0rPrjFOcHm/Jl9+93YcFaNgEHFh3sWGnLiNa8BoBiiwukW0xHh0wJpCyJm/k00Bn2m+J4z+krp7QsbxZgDMivvCJvsbYNa4vcMQOb102dPRzNzaXCqo5NSb6RA1k+77yAsQuwA/7h4BCmADGCtKe7OIF8KEXKhpnKxQJfFFTSAovbZznYcrxhi5DbOPn1w07HW4l3kAQb4ay2iCf7afIy0ZvLdTUollMbz441jzn5t8Z5x2V1wZp0yWFOiZsbbNsEp5K4ogN4BjBl94yIWGoXYoetSAdXa+r5WgVF+uWYHkLMCefPQrfNm3IftuLLeKTxGr+4w=</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo></dsig:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">G-e5c3849d-0b29-4462-b404-1724c576f5a1</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="ID_5c50fb09-3613-418a-a98f-97b76f1b8fee" NotOnOrAfter="2025-02-05T13:56:08.382Z" Recipient="https://sp.local:8081/auth/realms/master/broker/keycloak_idp_artifact/endpoint"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-02-05T13:55:08.382Z" NotOnOrAfter="2025-02-05T13:56:08.382Z"><saml:AudienceRestriction><saml:Audience>https://sp.local:8081/auth/realms/master</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-02-05T13:55:10.382Z" SessionIndex="c11a17f7-4f54-4078-a072-d0374e3d16d3::6ea713e9-0f72-4567-8640-efc9dba18d86" SessionNotOnOrAfter="2025-02-05T23:55:10.382Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">uma_authorization</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account-links</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">default-roles-master</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">offline_access</saml:AttributeValue></saml:Attribute><saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">view-profile</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>
\ No newline at end of file
diff --git a/server-spi-private/pom.xml b/server-spi-private/pom.xml
index f4fc61ab3e3b..ffb097b13f0d 100755
--- a/server-spi-private/pom.xml
+++ b/server-spi-private/pom.xml
@@ -41,7 +41,16 @@
             <artifactId>jakarta.transaction-api</artifactId>
             <scope>provided</scope>
         </dependency>
-
+        <dependency>
+            <groupId>jakarta.persistence</groupId>
+            <artifactId>jakarta.persistence-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.orm</groupId>
+            <artifactId>hibernate-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>io.quarkus.resteasy.reactive</groupId>
             <artifactId>resteasy-reactive-common</artifactId>
diff --git a/server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
index 1a9d41ad7491..2c69e72cbd15 100755
--- a/server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
+++ b/server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
@@ -149,6 +149,15 @@ public interface AbstractAuthenticationFlowContext {
      */
     void success();
 
+    /**
+     * Mark the current execution as successful and the auth session sets the
+     * credential type in the authentication session as the last credential used
+     * to authenticate the user.
+     *
+     * @param credentialType The credential used to authenticate the user
+     */
+    void success(String credentialType);
+
     /**
      * Aborts the current flow
      *
diff --git a/server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
index e14e66a16935..5806e1c62c60 100755
--- a/server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.authentication;
 
+import java.util.Collections;
+import java.util.Set;
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.provider.ConfiguredProvider;
 
@@ -45,6 +47,15 @@ public interface ConfigurableAuthenticatorFactory extends ConfiguredProvider {
      */
     String getReferenceCategory();
 
+    /**
+     * Optional categories that this authenticator can have (for example passkeys in username/form).
+     * Optional categories are not taken into account by LoA.
+     * @return Set of extra optional categories, empty by default
+     */
+    default Set<String> getOptionalReferenceCategories() {
+        return Collections.emptySet();
+    }
+
     /**
      * Is this authenticator configurable?
      *
diff --git a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java
index 66baf9f8596d..6d1f02968371 100755
--- a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java
+++ b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java
@@ -41,6 +41,7 @@ public interface RequiredActionContext {
     enum Status {
         CHALLENGE,
         SUCCESS,
+        CANCELLED,
         IGNORE,
         FAILURE
     }
@@ -149,6 +150,11 @@ default void failure() {
      */
     void success();
 
+    /**
+     * Mark this action as cancelled. Can be only used in AIA
+     */
+    void cancel();
+
     /**
      * Ignore this required action and go onto the next, or complete the flow.
      *
diff --git a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
index 4a624eefa7a0..8b2cd299cf1f 100755
--- a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
@@ -17,11 +17,16 @@
 
 package org.keycloak.authentication;
 
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredActionConfigModel;
+import org.keycloak.policy.MaxAuthAgePasswordPolicyProviderFactory;
 import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
 import org.keycloak.provider.ProviderFactory;
+import org.keycloak.userprofile.ValidationException;
+import org.keycloak.validate.ValidationError;
 
 import java.util.List;
 
@@ -33,6 +38,22 @@
  */
 public interface RequiredActionFactory extends ProviderFactory<RequiredActionProvider> {
 
+    List<ProviderConfigProperty> MAX_AUTH_AGE_CONFIG_PROPERTIES = getMaxAuthAgePropertyConfig();
+
+    static List<ProviderConfigProperty> getMaxAuthAgePropertyConfig() {
+        return ProviderConfigurationBuilder.create()
+                .property()
+                .name(Constants.MAX_AUTH_AGE_KEY)
+                .label("Maximum Age of Authentication")
+                .helpText("Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate. " +
+                        "This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user " +
+                        "himself updates his password in the account console.")
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .defaultValue(MaxAuthAgePasswordPolicyProviderFactory.DEFAULT_MAX_AUTH_AGE)
+                .add()
+                .build();
+    }
+
     /**
      * Display text used in admin console to reference this required action
      *
@@ -58,13 +79,37 @@ default boolean isConfigurable() {
         return configMetadata != null && !configMetadata.isEmpty();
     }
 
+    @Override
+    default List<ProviderConfigProperty> getConfigMetadata() {
+        return List.copyOf(MAX_AUTH_AGE_CONFIG_PROPERTIES);
+    }
+
     /**
      * Allows users to validate the provided configuration for this required action. Users can throw a {@link org.keycloak.models.ModelValidationException} to indicate that the configuration is invalid.
+     * Defaults validating max_auth_age value.
      *
      * @param session
      * @param realm
      * @param model
      */
     default void validateConfig(KeycloakSession session, RealmModel realm, RequiredActionConfigModel model) {
+        if (model.getConfigValue(Constants.MAX_AUTH_AGE_KEY) == null) {
+            return;
+        }
+
+        int parsedMaxAuthAge;
+        try {
+            parsedMaxAuthAge = parseMaxAuthAge(model);
+        } catch (NumberFormatException ex) {
+            throw new ValidationException(new ValidationError(getId(), Constants.MAX_AUTH_AGE_KEY, "error-invalid-value"));
+        }
+
+        if (parsedMaxAuthAge < 0) {
+            throw new ValidationException(new ValidationError(getId(), Constants.MAX_AUTH_AGE_KEY, "error-number-out-of-range-too-small", 0));
+        }
+    }
+
+    static int parseMaxAuthAge(RequiredActionConfigModel model) throws NumberFormatException {
+        return Integer.parseInt(model.getConfigValue(Constants.MAX_AUTH_AGE_KEY));
     }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
index 5ea665a2b697..d1c254d75425 100755
--- a/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
@@ -18,9 +18,16 @@
 package org.keycloak.authentication;
 
 import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredActionConfigModel;
+import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.provider.Provider;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.utils.RequiredActionHelper;
+
+
 
 /**
  * RequiredAction provider.  Required actions are one-time actions that a user must perform before they are logged in.
@@ -29,6 +36,7 @@
  * @version $Revision: 1 $
  */
 public interface RequiredActionProvider extends Provider {
+
     /**
      * Determines what type of support is provided for application-initiated
      * actions.
@@ -77,9 +85,53 @@ default void initiatedActionCanceled(KeycloakSession session, AuthenticationSess
      */
     void processAction(RequiredActionContext context);
 
+
     /**
-     * Defines the max time after a user login, after which re-authentication is requested for an AIA. 0 means that re-authentication is always requested.
+     * @deprecated in favor of {@link #getMaxAuthAge(KeycloakSession)} to support individual configuration of max auth age for all required actions. This method has no effect anymore.
      *
+     * Defines the max time after a user login, after which re-authentication is requested for an AIA. 0 means that re-authentication is always requested.
+     * On default uses configured max_auth_age value from the required action config. If not configured, it uses the default max_auth_age value from the KeycloakConstants class.
+     */
+    @Deprecated(since = "26.3.0", forRemoval = true)
+    default int getMaxAuthAge() {
+        return Constants.KC_ACTION_MAX_AGE;
+    }
+
+    /**
+     * Defines the max time after a user login, after which re-authentication is requested for an AIA. 0 means that re-authentication is always requested.
+     * On default uses configured max_auth_age value from the required action config. If not configured, it uses the default max_auth_age value from the KeycloakConstants class.
      */
-    default int getMaxAuthAge() { return Constants.KC_ACTION_MAX_AGE; }
+    default int getMaxAuthAge(KeycloakSession session) {
+        if (session == null) {
+            // session is null, support for legacy implementation, fallback to default maxAuthAge
+            return Constants.KC_ACTION_MAX_AGE;
+        }
+
+        KeycloakContext keycloakContext = session.getContext();
+        RealmModel realm = keycloakContext.getRealm();
+        int maxAge;
+
+        // try required action config
+        AuthenticationSessionModel authSession = keycloakContext.getAuthenticationSession();
+        if (authSession != null) {
+
+            // we need to figure out the alias for the current required action
+            String providerId = authSession.getClientNote(Constants.KC_ACTION);
+            RequiredActionProviderModel requiredAction = RequiredActionHelper.getRequiredActionByProviderId(realm, providerId);
+
+            if (requiredAction != null) {
+                RequiredActionConfigModel configModel = realm.getRequiredActionConfigByAlias(requiredAction.getAlias());
+                if (configModel != null && configModel.containsConfigKey(Constants.MAX_AUTH_AGE_KEY)) {
+                    maxAge = RequiredActionFactory.parseMaxAuthAge(configModel);
+                    if (maxAge >= 0) {
+                        return maxAge;
+                    }
+                }
+            }
+        }
+
+        // fallback to default
+        return Constants.KC_ACTION_MAX_AGE;
+    }
+
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/AdminPermissionsSchema.java b/server-spi-private/src/main/java/org/keycloak/authorization/AdminPermissionsSchema.java
deleted file mode 100644
index e44e81d300fa..000000000000
--- a/server-spi-private/src/main/java/org/keycloak/authorization/AdminPermissionsSchema.java
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.authorization;
-
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-
-import org.keycloak.authorization.model.Resource;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.authorization.model.Scope;
-import org.keycloak.authorization.store.StoreFactory;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelValidationException;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.AuthorizationSchema;
-import org.keycloak.representations.idm.authorization.ResourceType;
-import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
-
-public class AdminPermissionsSchema extends AuthorizationSchema {
-
-    public static final String USERS_RESOURCE_TYPE = "Users";
-    public static final ResourceType USERS = new ResourceType(USERS_RESOURCE_TYPE, Set.of("manage"));
-    public static final AdminPermissionsSchema SCHEMA = new AdminPermissionsSchema();
-
-    private AdminPermissionsSchema() {
-        super(Map.of(USERS_RESOURCE_TYPE, USERS));
-    }
-
-    public Resource getOrCreateResource(KeycloakSession session, ResourceServer resourceServer, String type, String id) {
-        if (!supportsAuthorizationSchema(session, resourceServer)) {
-            return null;
-        }
-
-        String resourceName = null;
-
-        if (USERS.getType().equals(type)) {
-            resourceName = resolveUser(session, id);
-        }
-
-        if (resourceName == null) {
-            throw new IllegalStateException("Could not map resource object with type [" + type + "] and id [" + id + "]");
-        }
-
-        return getOrCreateResource(session, resourceServer, resourceName);
-    }
-
-    public boolean isSupportedPolicyType(KeycloakSession session, ResourceServer resourceServer, String type) {
-        if (!supportsAuthorizationSchema(session, resourceServer)) {
-            return true;
-        }
-
-        return !type.equals("resource");
-    }
-
-    private boolean supportsAuthorizationSchema(KeycloakSession session, ResourceServer resourceServer) {
-        RealmModel realm = session.getContext().getRealm();
-
-        if (!realm.isAdminPermissionsEnabled()) {
-            return false;
-        }
-
-        return isAdminPermissionClient(realm, resourceServer.getId());
-    }
-
-    private boolean isAdminPermissionClient(RealmModel realm, String id) {
-        return realm.getAdminPermissionsClient() != null && realm.getAdminPermissionsClient().getId().equals(id);
-    }
-
-    public void throwExceptionIfAdminPermissionClient(KeycloakSession session, String id) {
-        if (isAdminPermissionClient(session.getContext().getRealm(), id)) {
-            throw new ModelValidationException("Not supported for this client.");
-        }
-    }
-
-    private Resource getOrCreateResource(KeycloakSession session, ResourceServer resourceServer, String id) {
-        StoreFactory storeFactory = getStoreFactory(session);
-        Resource resource = storeFactory.getResourceStore().findByName(resourceServer, id);
-
-        if (resource == null) {
-            return storeFactory.getResourceStore().create(resourceServer, id, resourceServer.getClientId());
-        }
-
-        return resource;
-    }
-
-    private String resolveUser(KeycloakSession session, String id) {
-        RealmModel realm = session.getContext().getRealm();
-        UserModel user = session.users().getUserById(realm, id);
-
-        if (user == null) {
-            user = session.users().getUserByUsername(realm, id);
-        }
-
-        return user == null ? null : user.getId();
-    }
-
-    private StoreFactory getStoreFactory(KeycloakSession session) {
-        AuthorizationProvider authzProvider = session.getProvider(AuthorizationProvider.class);
-        return authzProvider.getStoreFactory();
-    }
-
-    public void throwExceptionIfResourceTypeOrScopesNotProvided(KeycloakSession session, ResourceServer resourceServer, AbstractPolicyRepresentation rep) {
-        if (!supportsAuthorizationSchema(session, resourceServer)) {
-            return;
-        }
-        if (rep instanceof ScopePermissionRepresentation) {
-            if (rep.getResourceType() == null || SCHEMA.getResourceTypes().get(rep.getResourceType()) == null) {
-                throw new ModelValidationException("Resource type not provided.");
-            }
-            if (rep.getScopes() == null || rep.getScopes().isEmpty()) {
-                throw new ModelValidationException("Scopes not provided.");
-            }
-        }
-    }
-
-    public Scope getScope(KeycloakSession session, ResourceServer resourceServer, String resourceType, String id) {
-        StoreFactory storeFactory = getStoreFactory(session);
-
-        Scope scope = Optional.ofNullable(storeFactory.getScopeStore().findById(resourceServer, id))
-            .or(() -> Optional.ofNullable(storeFactory.getScopeStore().findByName(resourceServer, id)))
-            .orElseThrow(() -> new ModelValidationException(String.format("Scope [%s] does not exist.", id)));
-
-        if (supportsAuthorizationSchema(session, resourceServer)) {
-            //validations for schema
-            if (!SCHEMA.getResourceTypes().get(resourceType).getScopes().contains(scope.getName())) {
-                throw new ModelValidationException(String.format("Scope %s was not found for resource type %s.", scope.getName(), resourceType));
-            }
-        }
-
-        return scope;
-    }
-}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java b/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
index c385d9816aa0..2632614e4bca 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
@@ -26,6 +26,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.model.PermissionTicket;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
@@ -42,14 +43,11 @@
 import org.keycloak.authorization.store.ScopeStore;
 import org.keycloak.authorization.store.StoreFactory;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelValidationException;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.cache.authorization.CachedStoreFactoryProvider;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.provider.Provider;
 import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.AuthorizationSchema;
-import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
 
 /**
  * <p>The main contract here is the creation of {@link org.keycloak.authorization.permission.evaluator.PermissionEvaluator} instances.  Usually
@@ -172,8 +170,9 @@ public RealmModel getRealm() {
         return realm;
     }
 
-    public PolicyEvaluator getPolicyEvaluator() {
-        return policyEvaluator;
+    public PolicyEvaluator getPolicyEvaluator(ResourceServer resourceServer) {
+        PolicyEvaluator schemaPolicyEvaluator = AdminPermissionsSchema.SCHEMA.getPolicyEvaluator(keycloakSession, resourceServer);
+        return schemaPolicyEvaluator == null ? policyEvaluator : schemaPolicyEvaluator;
     }
 
     @Override
@@ -299,9 +298,9 @@ public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation
                 AdminPermissionsSchema.SCHEMA.throwExceptionIfResourceTypeOrScopesNotProvided(keycloakSession, resourceServer, representation);
                 Set<String> resources = representation.getResources();
 
-                if (resources != null) {
+                if (resources != null && !resources.isEmpty()) {
                     representation.setResources(resources.stream().map(id -> {
-                        Resource resource = AdminPermissionsSchema.SCHEMA.getOrCreateResource(keycloakSession, resourceServer, representation.getResourceType(), id);
+                        Resource resource = AdminPermissionsSchema.SCHEMA.getOrCreateResource(keycloakSession, resourceServer, representation.getType(), representation.getResourceType(), id);
 
                         if (resource == null) {
                             resource = storeFactory.getResourceStore().findById(resourceServer, id);
@@ -347,7 +346,11 @@ public Policy create(ResourceServer resourceServer, AbstractPolicyRepresentation
                     }).collect(Collectors.toSet()));
                 }
 
-                return RepresentationToModel.toModel(representation, AuthorizationProvider.this, policyStore.create(resourceServer, representation));
+                Policy policy = RepresentationToModel.toModel(representation, AuthorizationProvider.this, policyStore.create(resourceServer, representation));
+
+                AdminPermissionsSchema.SCHEMA.addUResourceTypeResource(keycloakSession, resourceServer, policy, representation.getResourceType());
+
+                return policy;
             }
 
             @Override
@@ -439,6 +442,16 @@ public List<Policy> findDependentPolicies(ResourceServer resourceServer, String
                 return policyStore.findDependentPolicies(resourceServer, id);
             }
 
+            @Override
+            public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, String configValue) {
+                return policyStore.findDependentPolicies(resourceServer, resourceType, associatedPolicyType, configKey, configValue);
+            }
+
+            @Override
+            public Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, List<String> configValues) {
+                return policyStore.findDependentPolicies(resourceServer, resourceType, associatedPolicyType, configKey, configValues);
+            }
+
             @Override
             public void findByResourceType(ResourceServer resourceServer, String type, Consumer<Policy> policyConsumer) {
                 policyStore.findByResourceType(resourceServer, type, policyConsumer);
@@ -465,17 +478,18 @@ public void delete(String id) {
                 Resource resource = findById(null, id);
                 StoreFactory storeFactory = AuthorizationProvider.this.getStoreFactory();
                 PermissionTicketStore ticketStore = storeFactory.getPermissionTicketStore();
-                List<PermissionTicket> permissions = ticketStore.findByResource(resource.getResourceServer(), resource);
+                ResourceServer resourceServer = resource.getResourceServer();
+                List<PermissionTicket> permissions = ticketStore.findByResource(resourceServer, resource);
 
                 for (PermissionTicket permission : permissions) {
                     ticketStore.delete(permission.getId());
                 }
 
                 PolicyStore policyStore = storeFactory.getPolicyStore();
-                List<Policy> policies = policyStore.findByResource(resource.getResourceServer(), resource);
+                List<Policy> policies = policyStore.findByResource(resourceServer, resource);
 
                 for (Policy policyModel : policies) {
-                    if (policyModel.getResources().size() == 1) {
+                    if (policyModel.getResources().size() == 1 && !AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(realm, resourceServer.getId())) {
                         policyStore.delete(policyModel.getId());
                     } else {
                         policyModel.removeResource(resource);
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/AdminPermissionsSchema.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/AdminPermissionsSchema.java
new file mode 100644
index 000000000000..642343135259
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/AdminPermissionsSchema.java
@@ -0,0 +1,534 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authorization.fgap;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Path;
+import jakarta.persistence.criteria.Predicate;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.fgap.evaluation.FGAPPolicyEvaluator;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluator;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.model.Scope;
+import org.keycloak.authorization.policy.evaluation.PolicyEvaluator;
+import org.keycloak.authorization.fgap.evaluation.partial.PartialEvaluationStorageProvider;
+import org.keycloak.authorization.store.ResourceStore;
+import org.keycloak.authorization.store.ScopeStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientModel.ClientRemovedEvent;
+import org.keycloak.models.ClientProvider;
+import org.keycloak.models.Constants;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.GroupModel.GroupRemovedEvent;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.ModelValidationException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.UserRemovedEvent;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.models.utils.RepresentationToModel;
+import org.keycloak.provider.ProviderEvent;
+import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.AuthorizationSchema;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceType;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.ScopeRepresentation;
+
+public class AdminPermissionsSchema extends AuthorizationSchema {
+
+    public static final String CLIENTS_RESOURCE_TYPE = "Clients";
+    public static final String GROUPS_RESOURCE_TYPE = "Groups";
+    public static final String ROLES_RESOURCE_TYPE = "Roles";
+    public static final String USERS_RESOURCE_TYPE = "Users";
+
+    // common scopes
+    public static final String MANAGE = "manage";
+    public static final String VIEW = "view";
+
+    // client specific scopes
+    public static final String MAP_ROLES = "map-roles";
+    public static final String MAP_ROLES_CLIENT_SCOPE = "map-roles-client-scope";
+    public static final String MAP_ROLES_COMPOSITE = "map-roles-composite";
+
+    // group specific scopes
+    public static final String MANAGE_MEMBERSHIP = "manage-membership";
+    public static final String MANAGE_MEMBERS = "manage-members";
+    public static final String VIEW_MEMBERS = "view-members";
+    public static final String IMPERSONATE_MEMBERS = "impersonate-members";
+
+    // role specific scopes
+    public static final String MAP_ROLE = "map-role";
+    public static final String MAP_ROLE_CLIENT_SCOPE = "map-role-client-scope";
+    public static final String MAP_ROLE_COMPOSITE = "map-role-composite";
+
+    // user specific scopes
+    public static final String IMPERSONATE = "impersonate";
+
+    public static final String MANAGE_GROUP_MEMBERSHIP = "manage-group-membership";
+
+    public static final ResourceType CLIENTS = new ResourceType(CLIENTS_RESOURCE_TYPE, Set.of(MANAGE, MAP_ROLES, MAP_ROLES_CLIENT_SCOPE, MAP_ROLES_COMPOSITE, VIEW));
+    public static final ResourceType GROUPS = new ResourceType(GROUPS_RESOURCE_TYPE, Set.of(MANAGE, VIEW, MANAGE_MEMBERSHIP, MANAGE_MEMBERS, VIEW_MEMBERS, IMPERSONATE_MEMBERS));
+    public static final ResourceType ROLES = new ResourceType(ROLES_RESOURCE_TYPE, Set.of(MAP_ROLE, MAP_ROLE_CLIENT_SCOPE, MAP_ROLE_COMPOSITE));
+    public static final ResourceType USERS = new ResourceType(USERS_RESOURCE_TYPE, Set.of(MANAGE, VIEW, IMPERSONATE, MAP_ROLES, MANAGE_GROUP_MEMBERSHIP), Map.of(VIEW, Set.of(VIEW_MEMBERS), MANAGE, Set.of(MANAGE_MEMBERS), IMPERSONATE, Set.of(IMPERSONATE_MEMBERS)), GROUPS.getType());
+    private static final String SKIP_EVALUATION = "kc.authz.fgap.skip";
+    public static final AdminPermissionsSchema SCHEMA = new AdminPermissionsSchema();
+
+    private final PartialEvaluator partialEvaluator = new PartialEvaluator();
+    private final PolicyEvaluator policyEvaluator = new FGAPPolicyEvaluator();
+
+    private AdminPermissionsSchema() {
+        super(Map.of(
+            CLIENTS_RESOURCE_TYPE, CLIENTS,
+            GROUPS_RESOURCE_TYPE, GROUPS,
+            ROLES_RESOURCE_TYPE, ROLES,
+            USERS_RESOURCE_TYPE, USERS
+        ));
+    }
+
+    public Resource getOrCreateResource(KeycloakSession session, ResourceServer resourceServer, String policyType, String resourceType, String id) {
+        if (!supportsAuthorizationSchema(session, resourceServer)) {
+            return null;
+        }
+
+        StoreFactory storeFactory = getStoreFactory(session);
+        ResourceStore resourceStore = storeFactory.getResourceStore();
+        Resource resource = resourceStore.findById(resourceServer, id);
+
+        if (resource != null) {
+            return resource;
+        }
+
+        String name;
+
+        switch (resourceType) {
+            case CLIENTS_RESOURCE_TYPE -> name = resolveClient(session, id).map(ClientModel::getId).orElse(resourceType);
+            case GROUPS_RESOURCE_TYPE -> name = resolveGroup(session, id).map(GroupModel::getId).orElse(resourceType);
+            case ROLES_RESOURCE_TYPE -> name = resolveRole(session, id).map(RoleModel::getId).orElse(resourceType);
+            case USERS_RESOURCE_TYPE -> name = resolveUser(session, id).map(UserModel::getId).orElse(resourceType);
+
+            default -> throw new IllegalStateException("Resource type [" + resourceType + "] not found.");
+        }
+
+        resource = resourceStore.findByName(resourceServer, name);
+
+        if (resource == null) {
+            resource = resourceStore.create(resourceServer, name, resourceServer.getClientId());
+            ScopeStore scopeStore = storeFactory.getScopeStore();
+            resource.updateScopes(getResourceTypes().get(resourceType).getScopes().stream().map(scopeName -> {
+                Scope findByName = scopeStore.findByName(resourceServer, scopeName);
+                if (findByName == null) throw new ModelException("No scopes found.");
+                return findByName;
+            }).collect(Collectors.toSet()));
+        }
+
+        return resource;
+    }
+
+    public Resource getResourceTypeResource(KeycloakSession session, ResourceServer resourceServer, String resourceType) {
+        if (!supportsAuthorizationSchema(session, resourceServer)) {
+            return null;
+        }
+
+        if (resourceType == null) {
+            return null;
+        }
+
+        ResourceType type = getResourceTypes().get(resourceType);
+
+        if (type == null) {
+            return null;
+        }
+
+        ResourceStore resourceStore = getStoreFactory(session).getResourceStore();
+
+        return resourceStore.findByName(resourceServer, type.getType());
+    }
+
+    public boolean isSupportedPolicyType(KeycloakSession session, ResourceServer resourceServer, String type) {
+        if (!supportsAuthorizationSchema(session, resourceServer)) {
+            return true;
+        }
+
+        return !type.equals("resource");
+    }
+
+    public boolean isAdminPermissionClient(RealmModel realm, String id) {
+        return realm.getAdminPermissionsClient() != null && realm.getAdminPermissionsClient().getId().equals(id);
+    }
+
+    private boolean supportsAuthorizationSchema(KeycloakSession session, ResourceServer resourceServer) {
+        RealmModel realm = session.getContext().getRealm();
+
+        if (!isAdminPermissionsEnabled(realm)) {
+            return false;
+        }
+
+        return isAdminPermissionClient(realm, resourceServer.getId());
+    }
+
+    public void throwExceptionIfAdminPermissionClient(KeycloakSession session, String id) {
+        if (isAdminPermissionClient(session.getContext().getRealm(), id)) {
+            throw new ModelValidationException("Not supported for this client.");
+        }
+    }
+
+    private Optional<GroupModel> resolveGroup(KeycloakSession session, String id) {
+        RealmModel realm = session.getContext().getRealm();
+
+        return Optional.ofNullable(session.groups().getGroupById(realm, id));
+    }
+
+    private Optional<RoleModel> resolveRole(KeycloakSession session, String id) {
+        RealmModel realm = session.getContext().getRealm();
+        RoleModel role = session.roles().getRoleById(realm, id);
+
+        return Optional.ofNullable(role);
+    }
+
+    private Optional<UserModel> resolveUser(KeycloakSession session, String id) {
+        RealmModel realm = session.getContext().getRealm();
+        UserModel user = session.users().getUserById(realm, id);
+
+        if (user == null) {
+            user = session.users().getUserByUsername(realm, id);
+        }
+
+        return Optional.ofNullable(user);
+    }
+
+    private Optional<ClientModel> resolveClient(KeycloakSession session, String id) {
+        RealmModel realm = session.getContext().getRealm();
+        ClientModel client = session.clients().getClientById(realm, id);
+
+        if (client == null) {
+            client = session.clients().getClientByClientId(realm, id);
+        }
+
+        return Optional.ofNullable(client);
+    }
+
+    private StoreFactory getStoreFactory(KeycloakSession session) {
+        AuthorizationProvider authzProvider = session.getProvider(AuthorizationProvider.class);
+        return authzProvider.getStoreFactory();
+    }
+
+    public void throwExceptionIfResourceTypeOrScopesNotProvided(KeycloakSession session, ResourceServer resourceServer, AbstractPolicyRepresentation rep) {
+        if (!supportsAuthorizationSchema(session, resourceServer)) {
+            return;
+        }
+        if (rep instanceof ScopePermissionRepresentation) {
+            if (rep.getResourceType() == null || SCHEMA.getResourceTypes().get(rep.getResourceType()) == null) {
+                throw new ModelValidationException("Resource type not provided.");
+            }
+            if (rep.getScopes() == null || rep.getScopes().isEmpty()) {
+                throw new ModelValidationException("Scopes not provided.");
+            }
+        }
+    }
+
+    public Scope getScope(KeycloakSession session, ResourceServer resourceServer, String resourceType, String id) {
+        StoreFactory storeFactory = getStoreFactory(session);
+
+        Scope scope = Optional.ofNullable(storeFactory.getScopeStore().findById(resourceServer, id))
+            .or(() -> Optional.ofNullable(storeFactory.getScopeStore().findByName(resourceServer, id)))
+            .orElseThrow(() -> new ModelValidationException(String.format("Scope [%s] does not exist.", id)));
+
+        if (supportsAuthorizationSchema(session, resourceServer)) {
+            //validations for schema
+            if (!SCHEMA.getResourceTypes().get(resourceType).getScopes().contains(scope.getName())) {
+                throw new ModelValidationException(String.format("Scope %s was not found for resource type %s.", scope.getName(), resourceType));
+            }
+        }
+
+        return scope;
+    }
+
+    public void init(KeycloakSession session, RealmModel realm) {
+        ClientProvider clients = session.clients();
+        ClientModel client = realm.getAdminPermissionsClient();
+
+        if (client != null) {
+            return;
+        }
+
+        client = clients.addClient(realm, Constants.ADMIN_PERMISSIONS_CLIENT_ID);
+        client.setProtocol("openid-connect");
+
+        realm.setAdminPermissionsClient(client);
+
+        ResourceServer resourceServer = RepresentationToModel.createResourceServer(client, session, false);
+        ResourceServerRepresentation resourceServerRep = ModelToRepresentation.toRepresentation(resourceServer, client);
+
+        //create all scopes defined in the schema
+        //there is no way how to map scopes to the resourceType, we need to collect all scopes from all resourceTypes 
+        Set<ScopeRepresentation> scopes = SCHEMA.getResourceTypes().values().stream()
+                .flatMap((resourceType) -> resourceType.getScopes().stream())
+                .map(ScopeRepresentation::new)
+                .collect(Collectors.toSet());//collecting to set to get rid of duplicities
+
+        resourceServerRep.setScopes(List.copyOf(scopes));
+
+        //create 'all-resource' resources defined in the schema
+        resourceServerRep.setResources(SCHEMA.getResourceTypes().keySet().stream()
+                .map(type -> {
+                    ResourceRepresentation resource = new ResourceRepresentation(type, SCHEMA.getResourceTypes().get(type).getScopes().toArray(String[]::new));
+                    resource.setType(type);
+                    return resource;
+                }).collect(Collectors.toList()));
+
+        RepresentationToModel.toModel(resourceServerRep, session.getProvider(AuthorizationProvider.class), client);
+    }
+
+    public boolean isAdminPermissionsEnabled(RealmModel realm) {
+        return Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2) && realm != null && realm.isAdminPermissionsEnabled();
+    }
+
+    public AuthorizationSchema getAuthorizationSchema(ClientModel client) {
+        if (isAdminPermissionsEnabled(client.getRealm()) && 
+            isAdminPermissionClient(client.getRealm(), client.getId())) {
+            return SCHEMA;
+        }
+        return null;
+    }
+
+    // for updates
+    public void removeResource(Resource resource, Policy policy, AuthorizationProvider authorization) {
+        ResourceServer resourceServer = resource.getResourceServer();
+
+        if (isAdminPermissionClient(authorization.getRealm(), resourceServer.getId())) {
+            // for admin permissions remove resource in the FGAP context (if resource is becoming on orphan, we remove the resource from DB)
+            if (getResourceTypes().get(resource.getName()) == null) {
+                List<Policy> policies = authorization.getStoreFactory().getPolicyStore().findByResource(resourceServer, resource);
+                // if there is single resource remaining delete it
+                if (policies.size() == 1 && policy.equals(policies.get(0))) {
+                    authorization.getStoreFactory().getResourceStore().delete(resource.getId());
+                } else {
+                    policy.removeResource(resource);
+                }
+            }
+        } else {
+            policy.removeResource(resource);
+        }
+    }
+
+    //for deletion
+    public void removeOrphanResources(Policy policy, AuthorizationProvider authorization) {
+        if (isAdminPermissionClient(authorization.getRealm(), policy.getResourceServer().getId())) {
+            Set<Resource> resources = policy.getResources();
+            for (Resource resource : resources) {
+                if (getResourceTypes().get(resource.getName()) == null) {
+                    List<Policy> policies = authorization.getStoreFactory().getPolicyStore().findByResource(policy.getResourceServer(), resource);
+                    // if there is single resource remaining delete it
+                    if (policies.size() == 1 && policy.equals(policies.get(0))) {
+                        authorization.getStoreFactory().getResourceStore().delete(resource.getId());
+                    }
+                }
+            }
+        }
+    }
+
+    public String getResourceName(KeycloakSession session, Policy policy, Resource resource) {
+        ResourceServer resourceServer = policy.getResourceServer();
+
+        if (supportsAuthorizationSchema(session, resourceServer)) {
+            return getResourceName(session, resourceServer, policy.getResourceType(), resource.getName());
+        }
+
+        return resource.getDisplayName();
+    }
+
+    public String getResourceName(KeycloakSession session, ResourceServer resourceServer, String resourceType, String resourceName) {
+        if (resourceType == null) {
+            return resourceName;
+        }
+
+        if (supportsAuthorizationSchema(session, resourceServer)) {
+            switch (resourceType) {
+                case CLIENTS_RESOURCE_TYPE -> {
+                    return resolveClient(session, resourceName).map(ClientModel::getClientId).orElse(resourceType);
+                }
+                case GROUPS_RESOURCE_TYPE -> {
+                    return resolveGroup(session, resourceName).map(GroupModel::getName).orElse(resourceType);
+                }
+                case ROLES_RESOURCE_TYPE -> {
+                    return resolveRole(session, resourceName).map(RoleModel::getName).orElse(resourceType);
+                }
+                case USERS_RESOURCE_TYPE -> {
+                    return resolveUser(session, resourceName).map(UserModel::getUsername).orElse(resourceType);
+                }
+                default -> throw new IllegalStateException("Resource type [" + resourceType + "] not found.");
+            }
+        }
+
+        return resourceName;
+    }
+
+    public void addUResourceTypeResource(KeycloakSession session, ResourceServer resourceServer, Policy policy, String resourceType) {
+        Resource resourceTypeResource = getResourceTypeResource(session, resourceServer, resourceType);
+
+        if (resourceTypeResource != null) {
+            Set<Resource> resources = policy.getResources();
+
+            if (resources.isEmpty()) {
+                policy.addResource(resourceTypeResource);
+            } else if (resources.size() > 1) {
+                policy.removeResource(resourceTypeResource);
+            }
+        }
+    }
+
+    public void removeResourceObject(AuthorizationProvider authorization, ProviderEvent event) {
+        if (!isAdminPermissionsEnabled(authorization.getRealm()) || authorization.getRealm().getAdminPermissionsClient() == null) return;
+
+        String id;
+        if (event instanceof UserRemovedEvent userRemovedEvent) {
+            id = userRemovedEvent.getUser().getId();
+        } else if (event instanceof ClientRemovedEvent clientRemovedEvent) {
+            id = clientRemovedEvent.getClient().getId();
+        } else if (event instanceof GroupRemovedEvent groupRemovedEvent) {
+            id = groupRemovedEvent.getGroup().getId();
+        } else if (event instanceof RoleRemovedEvent roleRemovedEvent) {
+            id = roleRemovedEvent.getRole().getId();
+        } else {
+            return;
+        }
+
+        ResourceServer server = authorization.getStoreFactory().getResourceServerStore().findByClient(authorization.getRealm().getAdminPermissionsClient());
+
+        Resource resource = authorization.getStoreFactory().getResourceStore().findByName(server, id);
+        if (resource != null) {
+            List<Policy> permissions = authorization.getStoreFactory().getPolicyStore().findByResource(server, resource);
+            //remove object from permission if there is more than one resource, remove the permission if there is only the removed object
+            for (Policy permission : permissions) {
+                if (permission.getResources().size() == 1) {
+                    authorization.getStoreFactory().getPolicyStore().delete(permission.getId());
+                } else {
+                    permission.removeResource(resource);
+                }
+            }
+
+            //remove the resource associated with the object
+            authorization.getStoreFactory().getResourceStore().delete(resource.getId());
+        }
+    }
+
+    public List<Predicate> applyAuthorizationFilters(KeycloakSession session, ResourceType resourceType, RealmModel realm, CriteriaBuilder builder, CriteriaQuery<?> queryBuilder, Path<?> path) {
+        return applyAuthorizationFilters(session, resourceType, null, realm, builder, queryBuilder, path);
+    }
+
+    public List<Predicate> applyAuthorizationFilters(KeycloakSession session, ResourceType resourceType, PartialEvaluationStorageProvider evaluator, RealmModel realm, CriteriaBuilder builder, CriteriaQuery<?> queryBuilder, Path<?> path) {
+        return partialEvaluator.getPredicates(session, resourceType, evaluator, realm, builder, queryBuilder, path);
+    }
+
+    public PolicyEvaluator getPolicyEvaluator(KeycloakSession session, ResourceServer resourceServer) {
+        if (resourceServer == null) {
+            return null;
+        }
+
+        RealmModel realm = session.getContext().getRealm();
+
+        if (isAdminPermissionClient(realm, resourceServer.getId())) {
+            return policyEvaluator;
+        }
+
+        return null;
+    }
+
+    public Set<String> getScopeAliases(String resourceType, Scope scope) {
+        ResourceType type = getResourceTypes().get(resourceType);
+        Set<String> aliases = type.getScopeAliases().get(scope.getName());
+
+        if (aliases == null) {
+            aliases = new HashSet<>();
+            for (Entry<String, Set<String>> entry : type.getScopeAliases().entrySet()) {
+                if (entry.getValue().contains(scope.getName())) {
+                    aliases.add(entry.getKey());
+                }
+            }
+        }
+
+        return aliases;
+    }
+
+    /**
+     * <p>Disables authorization and evaluation of permissions for realm resource types when executing the given {@code runnable}
+     * in the context of the given {@code session}.
+     *
+     * <p>This method should be used whenever a code block should be executed without any evaluation or filtering based on
+     * the permissions set to a realm. For instance, when caching realm resources where access enforcement does not apply.
+     *
+     * @param session the session. If {@code null}, authorization is enabled when executing the code block
+     * @param runnable the runnable to execute
+     */
+    public static void runWithoutAuthorization(KeycloakSession session, Runnable runnable) {
+        if (isSkipEvaluation(session)) {
+            runnable.run();
+            return;
+        }
+
+        try {
+            session.setAttribute(SKIP_EVALUATION, Boolean.TRUE.toString());
+            runnable.run();
+        } finally {
+            session.removeAttribute(SKIP_EVALUATION);
+        }
+    }
+
+    /**
+     * Returns if authorization is disabled in the context of the given {@code session} at the moment that this method is called.
+     *
+     * @param session the session
+     * @return {@code true} if authorization is disabled. Otherwise, returns {@code false}.
+     * Otherwise, {@code false}.
+     * @see AdminPermissionsSchema#runWithoutAuthorization(KeycloakSession, Runnable)
+     */
+    public static boolean isSkipEvaluation(KeycloakSession session) {
+        if (session == null) {
+            return true;
+        }
+
+        RealmModel realm = session.getContext().getRealm();
+
+        if (realm == null) {
+            return true;
+        }
+
+        if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            return true;
+        }
+
+        return Boolean.parseBoolean(session.getAttributeOrDefault(SKIP_EVALUATION, Boolean.FALSE.toString()));
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPDecision.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPDecision.java
new file mode 100644
index 000000000000..cad93c0233f8
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPDecision.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import org.keycloak.authorization.Decision;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.Scope;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.Evaluation;
+
+class FGAPDecision implements Decision<Evaluation> {
+
+    private final Decision<Evaluation> decision;
+    private final Map<Scope, Set<Resource>> scopesGrantedByResource = new HashMap<>();
+
+    FGAPDecision(Decision<Evaluation> decision) {
+        this.decision = decision;
+    }
+
+    @Override
+    public void onDecision(Evaluation evaluation) {
+        decision.onDecision(new FGAPEvaluation(evaluation, scopesGrantedByResource));
+    }
+
+    @Override
+    public void onError(Throwable cause) {
+        decision.onError(cause);
+    }
+
+    @Override
+    public void onComplete() {
+        decision.onComplete();
+    }
+
+    @Override
+    public void onComplete(ResourcePermission permission) {
+        decision.onComplete(permission);
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPEvaluation.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPEvaluation.java
new file mode 100644
index 000000000000..f12507a6772f
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPEvaluation.java
@@ -0,0 +1,185 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.SCHEMA;
+
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.Decision.Effect;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.Scope;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.Evaluation;
+import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.policy.evaluation.Realm;
+
+class FGAPEvaluation implements Evaluation {
+
+    private final Evaluation evaluation;
+    private final Map<Scope, Set<Resource>> scopesGrantedByResource;
+
+    FGAPEvaluation(Evaluation evaluation, Map<Scope, Set<Resource>> scopesGrantedByResource) {
+        this.evaluation = evaluation;
+        this.scopesGrantedByResource = scopesGrantedByResource;
+    }
+
+    @Override
+    public boolean isGranted(Policy grantedPolicy, Scope grantedScope) {
+        ResourcePermission permission = getPermission();
+        String resourceType = permission.getResourceType();
+
+        if (resourceType == null) {
+            return false;
+        }
+
+        Set<Scope> policyScopes = grantedPolicy.getScopes();
+
+        if (isForResourceType(grantedPolicy, resourceType) && policyScopes.contains(grantedScope)) {
+            scopesGrantedByResource.computeIfAbsent(grantedScope, k -> new HashSet<>()).addAll(grantedPolicy.getResources());
+            return true;
+        }
+
+        Set<String> aliases = SCHEMA.getScopeAliases(resourceType, grantedScope);
+
+        if (aliases.isEmpty()) {
+            return false;
+        }
+
+        boolean granted = policyScopes.stream().map(Scope::getName).anyMatch(aliases::contains);
+
+        if (granted) {
+            scopesGrantedByResource.computeIfAbsent(grantedScope, k -> new HashSet<>()).addAll(grantedPolicy.getResources());
+        }
+
+        return granted;
+    }
+
+    @Override
+    public boolean isDenied(Policy deniedPolicy, Scope deniedScope) {
+        ResourcePermission permission = getPermission();
+        String resourceType = permission.getResourceType();
+
+        if (resourceType == null) {
+            return false;
+        }
+
+        if (isForSpecificResource(deniedPolicy)) {
+            // denied by a permission that maps to a specific resource
+            return true;
+        }
+
+        if (isForResourceType(deniedPolicy, resourceType)) {
+            // checks if the scope was not granted by a permission that maps to all resources
+            return !isGranted(permission.getResource(), deniedScope);
+        }
+
+        Set<String> aliases = SCHEMA.getScopeAliases(resourceType, deniedScope);
+
+        if (aliases.isEmpty()) {
+            return false;
+        }
+
+        for (Scope scope : deniedPolicy.getScopes()) {
+            if (aliases.contains(scope.getName())) {
+                return !isGranted(deniedScope);
+            }
+        }
+
+        return false;
+    }
+
+    @Override
+    public ResourcePermission getPermission() {
+        return evaluation.getPermission();
+    }
+
+    @Override
+    public EvaluationContext getContext() {
+        return evaluation.getContext();
+    }
+
+    @Override
+    public Policy getPolicy() {
+        return evaluation.getPolicy();
+    }
+
+    @Override
+    public Realm getRealm() {
+        return evaluation.getRealm();
+    }
+
+    @Override
+    public AuthorizationProvider getAuthorizationProvider() {
+        return evaluation.getAuthorizationProvider();
+    }
+
+    @Override
+    public void grant() {
+        evaluation.grant();
+    }
+
+    @Override
+    public void deny() {
+        evaluation.deny();
+    }
+
+    @Override
+    public void denyIfNoEffect() {
+        evaluation.denyIfNoEffect();
+    }
+
+    @Override
+    public Policy getParentPolicy() {
+        return evaluation.getParentPolicy();
+    }
+
+    @Override
+    public Effect getEffect() {
+        return evaluation.getEffect();
+    }
+
+    @Override
+    public void setEffect(Effect effect) {
+        evaluation.setEffect(effect);
+    }
+
+    private boolean isForResourceType(Policy policy, String resourceType) {
+        return policy.getResourceType().equals(resourceType);
+    }
+
+    private boolean isForSpecificResource(Policy policy) {
+        return !policy.getResources().contains(getResourceTypeResource(policy, policy.getResourceType()));
+    }
+
+    private boolean isGranted(Resource resource, Scope scope) {
+        return scopesGrantedByResource.getOrDefault(scope, Set.of()).stream().anyMatch(resource::equals);
+    }
+
+    private boolean isGranted(Scope scope) {
+        return !scopesGrantedByResource.getOrDefault(scope, Set.of()).isEmpty();
+    }
+
+    private Resource getResourceTypeResource(Policy policy, String resourceType) {
+        return SCHEMA.getResourceTypeResource(getAuthorizationProvider().getKeycloakSession(), policy.getResourceServer(), resourceType);
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPPolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPPolicyEvaluator.java
new file mode 100644
index 000000000000..769a2ccfbd70
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/FGAPPolicyEvaluator.java
@@ -0,0 +1,95 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2025 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+
+import java.util.Map;
+import java.util.function.Consumer;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.Decision;
+import org.keycloak.authorization.Decision.Effect;
+import org.keycloak.authorization.fgap.evaluation.partial.ResourceTypePolicyEvaluator;
+import org.keycloak.authorization.fgap.evaluation.partial.UserResourceTypePolicyEvaluator;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.DefaultPolicyEvaluator;
+import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.policy.evaluation.PolicyEvaluator;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.ResourceStore;
+import org.keycloak.authorization.store.StoreFactory;
+
+/**
+ * A {@link PolicyEvaluator} specific for evaluating permisions in the context of the {@link org.keycloak.common.Profile.Feature#ADMIN_FINE_GRAINED_AUTHZ_V2} feature.
+ */
+public final class FGAPPolicyEvaluator extends DefaultPolicyEvaluator {
+
+    private final Map<String, ? extends ResourceTypePolicyEvaluator> resourceTypePolicyEvaluators = Map.of(USERS_RESOURCE_TYPE, new UserResourceTypePolicyEvaluator());
+
+    @Override
+    public void evaluate(ResourcePermission permission, AuthorizationProvider authorizationProvider, EvaluationContext executionContext, Decision decision, Map<Policy, Map<Object, Effect>> decisionCache) {
+        super.evaluate(permission, authorizationProvider, executionContext, new FGAPDecision(decision), decisionCache);
+    }
+
+    @Override
+    protected void evaluateResourcePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        super.evaluateResourcePolicies(permission, authorization, policyConsumer);
+
+        String resourceType = permission.getResourceType();
+
+        if (resourceType == null) {
+            return;
+        }
+
+        ResourceTypePolicyEvaluator resourceTypePolicyEvaluator = resourceTypePolicyEvaluators.get(resourceType);
+
+        if (resourceTypePolicyEvaluator == null) {
+            return;
+        }
+
+        resourceTypePolicyEvaluator.evaluate(permission, authorization, policyConsumer);
+    }
+
+    @Override
+    protected void evaluateResourceTypePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        String resourceType = permission.getResourceType();
+        Resource resource = permission.getResource();
+
+        if (resourceType == null || resource.getName().equals(permission.getResourceType())) {
+            return;
+        }
+
+        StoreFactory storeFactory = authorization.getStoreFactory();
+        ResourceStore resourceStore = storeFactory.getResourceStore();
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+        ResourceServer resourceServer = permission.getResourceServer();
+
+        Resource resourceTypeResource = resourceStore.findByName(resourceServer, resourceType);
+        policyStore.findByResource(resourceServer, resourceTypeResource, policyConsumer);
+    }
+
+    @Override
+    protected void evaluateScopePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        // do not evaluate permissions for individual scopes
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationContext.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationContext.java
new file mode 100644
index 000000000000..fdc92f355f79
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationContext.java
@@ -0,0 +1,135 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import static java.util.function.Predicate.not;
+
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Path;
+import org.keycloak.representations.idm.authorization.ResourceType;
+
+/**
+ * An {@link PartialEvaluationContext} instance provides access to contextual information when building a query for realm
+ * resources of a given {@link ResourceType}.
+ */
+public final class PartialEvaluationContext {
+
+    private final ResourceType resourceType;
+    private CriteriaQuery<?> criteriaQuery;
+    private Path<?> path;
+    private PartialEvaluationStorageProvider storage;
+    private CriteriaBuilder criteriaBuilder;
+    private final Set<String> allowedResources;
+    private final Set<String> deniedResources;
+    private Set<String> allowedGroups = Set.of();
+    private Set<String> deniedGroups = Set.of();
+
+    public PartialEvaluationContext(PartialEvaluationStorageProvider storage, CriteriaBuilder criteriaBuilder, CriteriaQuery<?> criteriaQuery, Path<?> path) {
+        this(null, Set.of(), Set.of(), storage, criteriaBuilder, criteriaQuery, path);
+    }
+
+    public PartialEvaluationContext(ResourceType resourceType, Set<String> allowedResources, Set<String> deniedResources, PartialEvaluationStorageProvider storage, CriteriaBuilder criteriaBuilder, CriteriaQuery<?> criteriaQuery, Path<?> path) {
+        this.allowedResources = allowedResources;
+        this.deniedResources = deniedResources;
+        this.storage = storage;
+        this.criteriaBuilder = criteriaBuilder;
+        this.criteriaQuery = criteriaQuery;
+        this.path = path;
+        this.resourceType = resourceType;
+    }
+
+    public boolean isResourceTypeAllowed() {
+        return allowedResources.contains(resourceType.getType());
+    }
+
+    public Set<String> getAllowedResourceIds() {
+        return allowedResources.stream().filter(not(resourceType.getType()::equals)).collect(Collectors.toSet());
+    }
+
+    public Set<String> getDeniedGroupIds() {
+        return deniedGroups.stream().filter(not(resourceType.getGroupType()::equals)).collect(Collectors.toSet());
+    }
+
+    public void setAllowedGroups(Set<String> allowedGroups) {
+        this.allowedGroups = allowedGroups;
+    }
+
+    public void setDeniedGroups(Set<String> deniedGroups) {
+        this.deniedGroups = deniedGroups;
+    }
+
+    public Set<String> getDeniedGroups() {
+        return deniedGroups;
+    }
+
+    public Set<String> getAllowedGroups() {
+        return allowedGroups;
+    }
+
+    public Set<String> getAllowedResources() {
+        return allowedResources;
+    }
+
+    public Path<?> getPath() {
+        return path;
+    }
+
+    public Set<String> deniedResources() {
+        return deniedResources;
+    }
+
+    public CriteriaQuery<?> criteriaQuery() {
+        return criteriaQuery;
+    }
+
+    public CriteriaBuilder getCriteriaBuilder() {
+        return criteriaBuilder;
+    }
+
+    public ResourceType getResourceType() {
+        return resourceType;
+    }
+
+    public PartialEvaluationStorageProvider getStorage() {
+        return storage;
+    }
+
+    public Set<String> getDeniedResources() {
+        return deniedResources;
+    }
+
+    public void setStorage(PartialEvaluationStorageProvider storage) {
+        this.storage = storage;
+    }
+
+    public void setCriteriaBuilder(CriteriaBuilder criteriaBuilder) {
+        this.criteriaBuilder = criteriaBuilder;
+    }
+
+    public void setCriteriaQuery(CriteriaQuery<?> criteriaQuery) {
+        this.criteriaQuery = criteriaQuery;
+    }
+
+    public void setPath(Path<?> path) {
+        this.path = path;
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationPolicyProvider.java
new file mode 100644
index 000000000000..b77ec7689a3e
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationPolicyProvider.java
@@ -0,0 +1,64 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2025 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import java.util.stream.Stream;
+
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.authorization.ResourceType;
+
+/**
+ * {@link PolicyProvider} types can implement this interface if they support to partially evaluate the permissions
+ * that should apply to a given subject, a {@link UserModel}, when calculating the realm resources they have access in the context of the
+ * {@link org.keycloak.common.Profile.Feature#ADMIN_FINE_GRAINED_AUTHZ} feature.
+ */
+public interface PartialEvaluationPolicyProvider {
+
+    /**
+     * Returns a list of {@link Policy} instances representing the permissions that apply to a given {@code subject} when
+     * partially evaluating the realm resources that can be accessed.
+     *
+     * @param session the session
+     * @param resourceType the type of the resource
+     * @param subject the subject
+     * @return the permissions that apply to the given {@code subject}
+     */
+    Stream<Policy> getPermissions(KeycloakSession session, ResourceType resourceType, UserModel subject);
+
+    /**
+     * If partial evaluation is supported for the given {@code policy}.
+     *
+     * @param policy the policy
+     * @return {@code true} if supported. Otherwise, returns {@code false}
+     */
+    boolean supports(Policy policy);
+
+    /**
+     * Evaluate if the given {@code policy} grants access to the given {@code subject}.
+     *
+     * @param session the session
+     * @param policy the policy
+     * @param subject the subject
+     * @return {@code true} if access is granted. Otherwise, returns {@code false}
+     */
+    boolean evaluate(KeycloakSession session, Policy policy, UserModel subject);
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationStorageProvider.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationStorageProvider.java
new file mode 100644
index 000000000000..a2ef2a308de1
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluationStorageProvider.java
@@ -0,0 +1,51 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2025 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import java.util.List;
+
+import jakarta.persistence.criteria.Predicate;
+
+/**
+ * If a realm has the {@link org.keycloak.common.Profile.Feature#ADMIN_FINE_GRAINED_AUTHZ} feature enabled,
+ * realm resources storage providers can implement this interface if they want to apply custom predicates to queries
+ * to filter their results based on the permissions available from the realm.
+ */
+public interface PartialEvaluationStorageProvider {
+
+    /**
+     * A callback method that will be called when building queries for realm resources to grant access to resources. It returns a list of
+     * {@link Predicate} instances representing the filters that should be applied to queries
+     * when querying realm resources.
+     *
+     * @param evaluationContext the evaluation context.
+     * @return the list of predicates
+     */
+    List<Predicate> getFilters(PartialEvaluationContext evaluationContext);
+
+    /**
+     * A callback method that will be called when building queries for realm resources to deny access to resources. It returns a list of
+     * {@link Predicate} instances representing the filters that should be applied to queries
+     * when querying realm resources.
+     *
+     * @param context the evaluation context.
+     * @return the list of predicates
+     */
+    List<Predicate> getNegateFilters(PartialEvaluationContext context);
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluator.java
new file mode 100644
index 000000000000..aab1eac95efc
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/PartialEvaluator.java
@@ -0,0 +1,292 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.isSkipEvaluation;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.Path;
+import jakarta.persistence.criteria.Predicate;
+import org.keycloak.Config;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.ResourceType;
+
+public final class PartialEvaluator {
+
+    private static final String NO_ID = "none";
+    private static final String ID_FIELD = "id";
+    private static final String PARTIAL_EVALUATION_CONTEXT_CACHE = "kc.authz.fgap.partial.evaluation.cache";
+
+    public List<Predicate> getPredicates(KeycloakSession session, ResourceType resourceType, PartialEvaluationStorageProvider storage, RealmModel realm, CriteriaBuilder builder, CriteriaQuery<?> queryBuilder, Path<?> path) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            // feature not enabled, if a storage evaluator is provided try to resolve any filter from there
+            return storage == null ? List.of() : storage.getFilters(new PartialEvaluationContext(storage, builder, queryBuilder, path));
+        }
+
+        UserModel adminUser = session.getContext().getUser();
+
+        if (shouldSkipPartialEvaluation(session, adminUser, resourceType)) {
+            // only run partial evaluation if the admin user does not have view-* or manage-* role for specified resourceType or has any query-* role
+            return List.of();
+        }
+
+        // collect the result from the partial evaluation so that the filters can be applied
+        PartialEvaluationContext context = runEvaluation(session, adminUser, resourceType, storage, builder, queryBuilder, path);
+
+        return buildPredicates(context);
+    }
+
+    private PartialEvaluationContext runEvaluation(KeycloakSession session, UserModel adminUser, ResourceType resourceType, PartialEvaluationStorageProvider storage, CriteriaBuilder builder, CriteriaQuery<?> queryBuilder, Path<?> path) {
+        Map<String, Map<String, PartialEvaluationContext>> cache = session.getAttributeOrDefault(PARTIAL_EVALUATION_CONTEXT_CACHE, Map.of());
+
+        if (cache.getOrDefault(adminUser.getId(), Map.of()).containsKey(resourceType.getType())) {
+            PartialEvaluationContext evaluationContext = cache.get(adminUser.getId()).get(resourceType.getType());
+            evaluationContext.setStorage(storage);
+            evaluationContext.setCriteriaBuilder(builder);
+            evaluationContext.setCriteriaQuery(queryBuilder);
+            evaluationContext.setPath(path);
+            return evaluationContext;
+        }
+
+        Set<String> allowedResources = new HashSet<>();
+        Set<String> deniedResources = new HashSet<>();
+        List<PartialEvaluationPolicyProvider> policyProviders = getPartialEvaluationPolicyProviders(session);
+
+        for (PartialEvaluationPolicyProvider policyProvider : policyProviders) {
+            policyProvider.getPermissions(session, resourceType, adminUser).forEach(permission -> {
+                Set<String> ids = permission.getResourceNames();
+                Set<Policy> policies = permission.getAssociatedPolicies();
+
+                for (Policy policy : policies) {
+                    PartialEvaluationPolicyProvider provider = getPartialEvaluationPolicyProvider(policy, policyProviders);
+
+                    if (provider == null) {
+                        continue;
+                    }
+
+                    boolean granted = provider.evaluate(session, policy, adminUser);
+
+                    if (Logic.NEGATIVE.equals(policy.getLogic())) {
+                        granted = !granted;
+                    }
+
+                    if (granted) {
+                        allowedResources.addAll(ids);
+                    } else {
+                        deniedResources.addAll(ids);
+                    }
+                }
+            });
+        }
+
+        allowedResources.removeAll(deniedResources);
+
+        PartialEvaluationContext context = createEvaluationContext(session, resourceType, allowedResources, deniedResources, storage, builder, queryBuilder, path, adminUser);
+
+        if (cache.isEmpty()) {
+            cache = new HashMap<>();
+        }
+
+        cache.computeIfAbsent(adminUser.getId(), s -> new HashMap<>()).computeIfAbsent(resourceType.getType(), s -> context);
+
+        if (session.getAttribute(PARTIAL_EVALUATION_CONTEXT_CACHE) == null) {
+            session.setAttribute(PARTIAL_EVALUATION_CONTEXT_CACHE, cache);
+        }
+
+        return cache.get(adminUser.getId()).get(resourceType.getType());
+    }
+
+    private List<Predicate> buildPredicates(PartialEvaluationContext context) {
+        List<Predicate> storageFilters = getStorageFilters(context);
+        CriteriaBuilder builder = context.getCriteriaBuilder();
+        Path<?> path = context.getPath();
+
+        if (isDenied(storageFilters, context)) {
+            // do not return any result because there is no filter from the evaluator, and access is denied for the resource type
+            return List.of(builder.equal(path.get(ID_FIELD), NO_ID));
+        }
+
+        Set<String> deniedIds = context.getDeniedResources();
+        ResourceType resourceType = context.getResourceType();
+
+        if (deniedIds.contains(resourceType.getType())) {
+            // do not filter by id if access is granted to the resource type
+            deniedIds = Set.of();
+        }
+
+        List<Predicate> predicates = new ArrayList<>();
+
+        if (!deniedIds.isEmpty()) {
+            // add filters to remove denied resources from the result set
+            predicates.add(builder.not(path.get(ID_FIELD).in(deniedIds)));
+        }
+
+        List<Predicate> storageNegateFilters = getStorageNegateFilters(context);
+
+        // add filters from the storage that deny access to resources
+        predicates.addAll(storageNegateFilters);
+
+        Set<String> allowedResourceIds = context.getAllowedResources();
+
+        if (allowedResourceIds.contains(resourceType.getType())) {
+            // do not filter by id if access is granted to the resource type
+            allowedResourceIds = Set.of();
+        }
+
+        if (allowedResourceIds.isEmpty()) {
+            // no resources granted, return any predicates created until now
+            predicates.addAll(storageFilters);
+            return predicates;
+        }
+
+        if (storageFilters.isEmpty()) {
+            // no filter from the evaluator, filter based on the resources that were granted
+            predicates.add(builder.and(path.get(ID_FIELD).in(allowedResourceIds)));
+        } else {
+            // there are filters from the evaluator, the resources granted will be a returned using a or condition
+            List<Predicate> orPredicates = new ArrayList<>(storageFilters);
+            orPredicates.add(path.get(ID_FIELD).in(allowedResourceIds));
+            predicates.add(builder.or(orPredicates.toArray(new Predicate[0])));
+        }
+
+        return predicates;
+    }
+
+    private PartialEvaluationContext createEvaluationContext(KeycloakSession session, ResourceType resourceType, Set<String> allowedResources, Set<String> deniedResources, PartialEvaluationStorageProvider storage, CriteriaBuilder builder, CriteriaQuery<?> queryBuilder, Path<?> path, UserModel adminUser) {
+        PartialEvaluationContext context = new PartialEvaluationContext(resourceType, allowedResources, deniedResources, storage, builder, queryBuilder, path);
+        String groupType = resourceType.getGroupType();
+
+        if (groupType != null) {
+            // if the resource type has support for groups, evaluate permissions for the group
+            ResourceType groupResourceType = AdminPermissionsSchema.SCHEMA.getResourceTypes().get(groupType);
+
+            if (groupResourceType == null) {
+                return context;
+            }
+
+            PartialEvaluationContext evaluateGroups = runEvaluation(session, adminUser, groupResourceType, storage, builder, queryBuilder, path);
+            context.setAllowedGroups(evaluateGroups.getAllowedResources());
+            context.setDeniedGroups(evaluateGroups.getDeniedResources());
+        }
+
+        return context;
+    }
+
+    private List<Predicate> getStorageFilters(PartialEvaluationContext context) {
+        PartialEvaluationStorageProvider storage = context.getStorage();
+        return storage == null ? List.of() : storage.getFilters(context);
+    }
+
+    private List<Predicate> getStorageNegateFilters(PartialEvaluationContext context) {
+        PartialEvaluationStorageProvider storage = context.getStorage();
+        return storage == null ? List.of() : storage.getNegateFilters(context);
+    }
+
+    private boolean isDenied(List<Predicate> storageFilters, PartialEvaluationContext context) {
+        return context.getAllowedResources().isEmpty() && storageFilters.isEmpty();
+    }
+
+    private List<PartialEvaluationPolicyProvider> getPartialEvaluationPolicyProviders(KeycloakSession session) {
+        return session.getAllProviders(PolicyProvider.class).stream()
+                .filter(provider -> provider instanceof PartialEvaluationPolicyProvider)
+                .map(PartialEvaluationPolicyProvider.class::cast)
+                .toList();
+    }
+
+    private PartialEvaluationPolicyProvider getPartialEvaluationPolicyProvider(Policy policy, List<PartialEvaluationPolicyProvider> policyProviders) {
+        return policyProviders.stream()
+                .filter((p) -> p.supports(policy))
+                .findAny()
+                .orElse(null);
+    }
+
+    private boolean shouldSkipPartialEvaluation(KeycloakSession session, UserModel user, ResourceType resourceType) {
+        if (user == null) {
+            return true;
+        }
+
+        if (isSkipEvaluation(session)) {
+            return true;
+        }
+
+        ClientModel client = getRealmManagementClient(session);
+
+        if (client == null) {
+            return true;
+        }
+
+        if (resourceType.equals(AdminPermissionsSchema.USERS) || resourceType.equals(AdminPermissionsSchema.GROUPS)) {
+            return user.hasRole(client.getRole(AdminRoles.VIEW_USERS)) || user.hasRole(client.getRole(AdminRoles.MANAGE_USERS)) || !hasAnyQueryAdminRole(client, user);
+        } else if (resourceType.equals(AdminPermissionsSchema.CLIENTS)) {
+            return user.hasRole(client.getRole(AdminRoles.VIEW_CLIENTS)) || user.hasRole(client.getRole(AdminRoles.MANAGE_CLIENTS)) || !hasAnyQueryAdminRole(client, user);
+        }
+
+        return false;
+    }
+
+    private ClientModel getRealmManagementClient(KeycloakSession session) {
+        RealmModel realm = session.getContext().getRealm();
+
+        if (realm == null) {
+            return null;
+        }
+
+        if (realm.getName().equals(Config.getAdminRealm())) {
+            return session.clients().getClientByClientId(realm, realm.getMasterAdminClient().getClientId());
+        }
+
+        return realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+    }
+
+    private boolean hasAnyQueryAdminRole(ClientModel client, UserModel user) {
+        boolean result = false;
+        for (String adminRole : List.of(AdminRoles.QUERY_CLIENTS, AdminRoles.QUERY_GROUPS, AdminRoles.QUERY_USERS)) {
+            RoleModel role = client.getRole(adminRole);
+
+            if (role == null) {
+                continue;
+            }
+
+            if (user.hasRole(role)) {
+                result = true;
+                break;
+            }
+        }
+
+        return result;
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/ResourceTypePolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/ResourceTypePolicyEvaluator.java
new file mode 100644
index 000000000000..38681454f050
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/ResourceTypePolicyEvaluator.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import java.util.function.Consumer;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.permission.ResourcePermission;
+
+/**
+ * An interface that should be implemented to provide additional logic when evaluating permissions for a specific resource type.
+ */
+public interface ResourceTypePolicyEvaluator {
+
+    /**
+     * Evaluates the given {@code permission} based on its {@link ResourcePermission#getResourceType()}.
+     *
+     * @param permission the permission
+     * @param authorization the authorization provider
+     * @param policyConsumer the policy consumer or evaluator
+     */
+    void evaluate(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer);
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/UserResourceTypePolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/UserResourceTypePolicyEvaluator.java
new file mode 100644
index 000000000000..04368d33bba6
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/fgap/evaluation/partial/UserResourceTypePolicyEvaluator.java
@@ -0,0 +1,112 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2025 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.fgap.evaluation.partial;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+
+import java.util.HashSet;
+import java.util.Set;
+import java.util.function.Consumer;
+import java.util.stream.Stream;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.ResourceStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+
+public final class UserResourceTypePolicyEvaluator implements ResourceTypePolicyEvaluator {
+
+    @Override
+    public void evaluate(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        UserModel user = resolveUser(permission, authorization);
+
+        if (user != null) {
+            evaluateGroupMembershipPermissions(permission, user, authorization, policyConsumer);
+        }
+    }
+
+    private UserModel resolveUser(ResourcePermission permission, AuthorizationProvider authorization) {
+        RealmModel realm = authorization.getRealm();
+        KeycloakSession session = authorization.getKeycloakSession();
+        String resourceType = permission.getResourceType();
+
+        if (resourceType == null) {
+            return null;
+        }
+
+        Resource resource = permission.getResource();
+
+        if (resource == null) {
+            return null;
+        }
+
+        ResourceServer resourceServer = resource.getResourceServer();
+        String userName = AdminPermissionsSchema.SCHEMA.getResourceName(session, resourceServer, resourceType, resource.getName());
+
+        if (userName == null) {
+            return null;
+        }
+
+        return session.users().getUserByUsername(realm, userName);
+    }
+
+    private void evaluateGroupMembershipPermissions(ResourcePermission permission, UserModel user, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        StoreFactory storeFactory = authorization.getStoreFactory();
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+        ResourceStore resourceStore = storeFactory.getResourceStore();
+        ResourceServer resourceServer = permission.getResourceServer();
+
+        evaluateHierarchy(user, group -> {
+            Resource groupResource = resourceStore.findByName(resourceServer, group.getId());
+
+            if (groupResource != null) {
+                policyStore.findByResource(resourceServer, groupResource, policyConsumer);
+            }
+        });
+
+        Stream<GroupModel> groups = user.getGroupsStream();
+
+        if (groups.findAny().isPresent()) {
+            KeycloakSession session = authorization.getKeycloakSession();
+            Resource resourceTypeResource = AdminPermissionsSchema.SCHEMA.getResourceTypeResource(session, resourceServer, GROUPS_RESOURCE_TYPE);
+            policyStore.findByResource(resourceServer, resourceTypeResource, policyConsumer);
+        }
+    }
+
+    private void evaluateHierarchy(UserModel user, Consumer<GroupModel> eval) {
+        user.getGroupsStream().forEach(group -> evaluateHierarchy(eval, group, new HashSet<>()));
+    }
+
+    private void evaluateHierarchy(Consumer<GroupModel> eval, GroupModel group, Set<GroupModel> visited) {
+        if (visited.contains(group)) return;
+        eval.accept(group);
+        visited.add(group);
+        if (group.getParent() == null) return;
+        evaluateHierarchy(eval, group.getParent(), visited);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java b/server-spi-private/src/main/java/org/keycloak/authorization/identity/UserModelIdentity.java
similarity index 96%
rename from services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/identity/UserModelIdentity.java
index 271338ec131b..20af8363fd90 100644
--- a/services/src/main/java/org/keycloak/authorization/common/UserModelIdentity.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/identity/UserModelIdentity.java
@@ -14,17 +14,16 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.authorization.common;
+package org.keycloak.authorization.identity;
+
+import java.util.Map;
 
 import org.keycloak.authorization.attribute.Attributes;
-import org.keycloak.authorization.identity.Identity;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 
-import java.util.Map;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java
index 26040ac0b2c0..52adfc420801 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java
@@ -22,7 +22,9 @@
 import org.keycloak.representations.idm.authorization.Logic;
 
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * Represents an authorization policy and all the configuration associated with it.
@@ -31,7 +33,7 @@
  */
 public interface Policy {
 
-    public static enum FilterOption {
+    enum FilterOption {
         ID("id"),
         PERMISSION("permission"),
         OWNER("owner"),
@@ -166,6 +168,15 @@ public String getName() {
      */
     Set<Resource> getResources();
 
+    /**
+     * Returns the name of the {@link Resource} instances where this policy applies.
+     *
+     * @return a set with all names of resource instances where this policy applies. Or an empty set if there is no resource associated with this policy
+     */
+    default Set<String> getResourceNames() {
+        return getResources().stream().map(Resource::getName).collect(Collectors.toSet());
+    }
+
     /**
      * Returns the {@link Scope} instances where this policy applies.
      *
@@ -188,4 +199,16 @@ public String getName() {
     void addResource(Resource resource);
 
     void removeResource(Resource resource);
+
+    default String getResourceType() {
+        return Optional.ofNullable(getConfig()).orElse(Map.of()).get("defaultResourceType");
+    }
+
+    default void setResourceType(String resourceType) {
+        Map<String, String> config = getConfig();
+
+        if (config != null) {
+            putConfig("defaultResourceType", resourceType);
+        }
+    }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceWrapper.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceWrapper.java
new file mode 100644
index 000000000000..9f4c738b462a
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceWrapper.java
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.authorization.model;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+
+public class ResourceWrapper implements Resource {
+
+    private final Resource resource;
+    private final String name;
+    private final ResourceServer resourceServer;
+    private final Set<Scope> scopes;
+    private final String id;
+
+    public ResourceWrapper(String name, Set<Scope> scopes, ResourceServer resourceServer) {
+        this(null, name, scopes, resourceServer);
+    }
+
+    public ResourceWrapper(String id, String name, Set<Scope> scopes, ResourceServer resourceServer) {
+        this.id = id;
+        this.name = name;
+        this.scopes = scopes;
+        this.resourceServer = resourceServer;
+        this.resource = null;
+    }
+
+    @Override
+    public String getId() {
+        return Optional.ofNullable(resource).map(Resource::getId).orElse(id);
+    }
+
+    @Override
+    public String getName() {
+        return Optional.ofNullable(resource).map(Resource::getName).orElse(name);
+    }
+
+    @Override
+    public void setName(String name) {
+    }
+
+    @Override
+    public String getDisplayName() {
+        return Optional.ofNullable(resource).map(Resource::getDisplayName).orElse(null);
+    }
+
+    @Override
+    public void setDisplayName(String name) {
+    }
+
+    @Override
+    public Set<String> getUris() {
+        return Optional.ofNullable(resource).map(Resource::getUris).orElse(Set.of());
+    }
+
+    @Override
+    public void updateUris(Set<String> uri) {
+    }
+
+    @Override
+    public String getType() {
+        return Optional.ofNullable(resource).map(Resource::getType).orElse(null);
+    }
+
+    @Override
+    public void setType(String type) {
+    }
+
+    @Override
+    public List<Scope> getScopes() {
+        return Optional.ofNullable(resource).map(Resource::getScopes).orElse(scopes.stream().toList());
+    }
+
+    @Override
+    public String getIconUri() {
+        return Optional.ofNullable(resource).map(Resource::getIconUri).orElse(null);
+    }
+
+    @Override
+    public void setIconUri(String iconUri) {
+    }
+
+    @Override
+    public ResourceServer getResourceServer() {
+        return resourceServer;
+    }
+
+    @Override
+    public String getOwner() {
+        return Optional.ofNullable(resource).map(Resource::getOwner).orElse(resourceServer.getId());
+    }
+
+    @Override
+    public boolean isOwnerManagedAccess() {
+        return Optional.ofNullable(resource).map(Resource::isOwnerManagedAccess).orElse(false);
+    }
+
+    @Override
+    public void setOwnerManagedAccess(boolean ownerManagedAccess) {
+    }
+
+    @Override
+    public void updateScopes(Set<Scope> scopes) {
+    }
+
+    @Override
+    public Map<String, List<String>> getAttributes() {
+        return Optional.ofNullable(resource).map(Resource::getAttributes).orElse(Map.of());
+    }
+
+    @Override
+    public String getSingleAttribute(String name) {
+        return getAttributes().getOrDefault(name, List.of()).stream().findFirst().orElse(null);
+    }
+
+    @Override
+    public List<String> getAttribute(String name) {
+        return getAttributes().getOrDefault(name, List.of());
+    }
+
+    @Override
+    public void setAttribute(String name, List<String> values) {
+    }
+
+    @Override
+    public void removeAttribute(String name) {
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/permission/Permissions.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/Permissions.java
index 20d4d6937896..67dbc1be6e83 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/permission/Permissions.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/permission/Permissions.java
@@ -124,6 +124,13 @@ public static ResourcePermission createResourcePermissions(Resource resource,
         Set<Scope> scopes = resolveScopes(resource, resourceServer, requestedScopes, authorization);
         return new ResourcePermission(resource, scopes, resourceServer, request.getClaims());
     }
+
+    public static ResourcePermission createResourcePermissions(String resourceType, Resource resource,
+                                                               ResourceServer resourceServer, Collection<Scope> requestedScopes,
+                                                               AuthorizationProvider authorization, AuthorizationRequest request) {
+        Set<Scope> scopes = resolveScopes(resource, resourceServer, requestedScopes, authorization);
+        return new ResourcePermission(resourceType, resource, scopes, resourceServer, request.getClaims());
+    }
     
     public static Set<Scope> resolveScopes(Resource resource, ResourceServer resourceServer,
             Collection<Scope> requestedScopes, AuthorizationProvider authorization) {
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
index 1794e9e54fae..edc7e06deb9b 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
@@ -41,19 +41,29 @@ public class ResourcePermission {
 
     private final Resource resource;
     private final Collection<Scope> scopes;
+    private final String resourceType;
     private ResourceServer resourceServer;
     private Map<String, Set<String>> claims;
     private boolean granted;
 
     public ResourcePermission(Resource resource, Collection<Scope> scopes, ResourceServer resourceServer) {
-        this(resource, scopes, resourceServer, null);
+        this(null, resource, scopes, resourceServer, null);
+    }
+
+    public ResourcePermission(String resourceType, Resource resource, Collection<Scope> scopes, ResourceServer resourceServer) {
+        this(resourceType, resource, scopes, resourceServer, null);
     }
 
     public ResourcePermission(Resource resource, ResourceServer resourceServer, Map<String, ? extends Collection<String>> claims) {
-        this(resource, new LinkedHashSet<>(), resourceServer, claims);
+        this(null, resource, new LinkedHashSet<>(), resourceServer, claims);
     }
 
     public ResourcePermission(Resource resource, Collection<Scope> scopes, ResourceServer resourceServer, Map<String, ? extends Collection<String>> claims) {
+        this(null, resource, scopes, resourceServer, claims);
+    }
+
+    public ResourcePermission(String resourceType, Resource resource, Collection<Scope> scopes, ResourceServer resourceServer, Map<String, ? extends Collection<String>> claims) {
+        this.resourceType = resourceType;
         this.resource = resource;
         this.scopes = scopes;
         this.resourceServer = resourceServer;
@@ -65,6 +75,10 @@ public ResourcePermission(Resource resource, Collection<Scope> scopes, ResourceS
         }
     }
 
+    public String getResourceType() {
+        return resourceType;
+    }
+
     /**
      * Returns the resource to which this permission applies.
      *
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
index febe24a7f670..4da1f2107e3c 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
@@ -43,6 +43,10 @@ public PermissionEvaluator from(Collection<ResourcePermission> permissions, Eval
         return new IterablePermissionEvaluator(permissions.iterator(), evaluationContext, authorizationProvider);
     }
 
+    public PermissionEvaluator from(Collection<ResourcePermission> permissions, ResourceServer resourceServer, EvaluationContext evaluationContext) {
+        return new IterablePermissionEvaluator(permissions.iterator(), resourceServer, evaluationContext, authorizationProvider);
+    }
+
     public PermissionEvaluator from(EvaluationContext evaluationContext, ResourceServer resourceServer, AuthorizationRequest request) {
         return new UnboundedPermissionEvaluator(evaluationContext, authorizationProvider, resourceServer, request);
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
index 563cdb1a4e31..652b7bff3a78 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
@@ -43,12 +43,18 @@ class IterablePermissionEvaluator implements PermissionEvaluator {
     private final EvaluationContext executionContext;
     private final PolicyEvaluator policyEvaluator;
     private final AuthorizationProvider authorizationProvider;
+    private final ResourceServer resourceServer;
 
-    IterablePermissionEvaluator(Iterator<ResourcePermission> permissions, EvaluationContext executionContext, AuthorizationProvider authorizationProvider) {
+    IterablePermissionEvaluator(Iterator<ResourcePermission> permissions, ResourceServer resourceServer, EvaluationContext executionContext, AuthorizationProvider authorizationProvider) {
         this.permissions = permissions;
+        this.resourceServer = resourceServer;
         this.executionContext = executionContext;
         this.authorizationProvider = authorizationProvider;
-        this.policyEvaluator = authorizationProvider.getPolicyEvaluator();
+        this.policyEvaluator = authorizationProvider.getPolicyEvaluator(resourceServer);
+    }
+
+    IterablePermissionEvaluator(Iterator<ResourcePermission> permissions, EvaluationContext executionContext, AuthorizationProvider authorizationProvider) {
+        this(permissions, null, executionContext, authorizationProvider);
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/UnboundedPermissionEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/UnboundedPermissionEvaluator.java
index 78cb38bd5cd5..3ce1909d0e1b 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/UnboundedPermissionEvaluator.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/UnboundedPermissionEvaluator.java
@@ -31,7 +31,7 @@ public class UnboundedPermissionEvaluator implements PermissionEvaluator {
             AuthorizationRequest request) {
         this.executionContext = executionContext;
         this.authorizationProvider = authorizationProvider;
-        this.policyEvaluator = authorizationProvider.getPolicyEvaluator();
+        this.policyEvaluator = authorizationProvider.getPolicyEvaluator(resourceServer);
         this.resourceServer = resourceServer;
         this.request = request;
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/AbstractDecisionCollector.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/AbstractDecisionCollector.java
index 8d88206794ea..3eff4f48e22a 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/AbstractDecisionCollector.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/AbstractDecisionCollector.java
@@ -30,12 +30,12 @@
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public abstract class AbstractDecisionCollector implements Decision<DefaultEvaluation> {
+public abstract class AbstractDecisionCollector implements Decision<Evaluation> {
 
     protected final Map<ResourcePermission, Result> results = new LinkedHashMap<>();
 
     @Override
-    public void onDecision(DefaultEvaluation evaluation) {
+    public void onDecision(Evaluation evaluation) {
         Policy parentPolicy = evaluation.getParentPolicy();
         ResourcePermission permission = evaluation.getPermission();
 
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionPermissionCollector.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionPermissionCollector.java
index 0ed8ab60f266..b5662cf9c3c9 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionPermissionCollector.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionPermissionCollector.java
@@ -76,11 +76,12 @@ public void onComplete(Result result) {
                 Set<Scope> policyScopes = policy.getScopes();
                 Set<Resource> policyResources = policy.getResources();
                 boolean containsResource = policyResources.contains(resource);
+                Evaluation evaluation = result.getEvaluation();
 
                 if (isGranted(policyResult)) {
                     if (isScopePermission(policy)) {
                         for (Scope scope : requestedScopes) {
-                            if (policyScopes.contains(scope)) {
+                            if (evaluation.isGranted(policy, scope)) {
                                 grantedScopes.add(scope);
                                 // we need to grant any scope granted by a permission in case it is not explicitly
                                 // associated with the resource. For instance, resources inheriting scopes from parent resources.
@@ -109,6 +110,12 @@ public void onComplete(Result result) {
                         // resource or if the permission applies to any resource associated with the scopes
                         if (containsResource || policyResources.isEmpty()) {
                             deniedScopes.addAll(policyScopes);
+                        } else {
+                            for (Scope scope : requestedScopes) {
+                                if (evaluation.isDenied(policy, scope)) {
+                                    deniedScopes.add(scope);
+                                }
+                            }
                         }
                     }
                     if (!anyDeny) {
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
index 82273359fe60..537f5549b8a6 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
@@ -118,6 +118,7 @@ public AuthorizationProvider getAuthorizationProvider() {
         return authorizationProvider;
     }
 
+    @Override
     public Policy getParentPolicy() {
         return this.parentPolicy;
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
index c695d7fbc63f..4f1215c3b0af 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
@@ -68,24 +68,11 @@ public void evaluate(ResourcePermission permission, AuthorizationProvider author
         Resource resource = permission.getResource();
 
         if (resource != null) {
-            policyStore.findByResource(resourceServer, resource, policyConsumer);
-
-            if (resource.getType() != null) {
-                policyStore.findByResourceType(resourceServer, resource.getType(), policyConsumer);
-
-                if (!resource.getOwner().equals(resourceServer.getClientId())) {
-                    for (Resource typedResource : resourceStore.findByType(resourceServer, resource.getType())) {
-                        policyStore.findByResource(resourceServer, typedResource, policyConsumer);
-                    }
-                }
-            }
+            evaluateResourcePolicies(permission, authorizationProvider, policyConsumer);
+            evaluateResourceTypePolicies(permission, authorizationProvider, policyConsumer);
         }
 
-        Collection<Scope> scopes = permission.getScopes();
-
-        if (!scopes.isEmpty()) {
-            policyStore.findByScopes(resourceServer, null, new LinkedList<>(scopes), policyConsumer);
-        }
+        evaluateScopePolicies(permission, authorizationProvider, policyConsumer);
 
         if (verified.get()) {
             decision.onComplete(permission);
@@ -97,6 +84,44 @@ public void evaluate(ResourcePermission permission, AuthorizationProvider author
         }
     }
 
+    protected void evaluateResourcePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        StoreFactory storeFactory = authorization.getStoreFactory();
+        PolicyStore policyStore = storeFactory.getPolicyStore();
+        ResourceServer resourceServer = permission.getResourceServer();
+        Resource resource = permission.getResource();
+        policyStore.findByResource(resourceServer, resource, policyConsumer);
+    }
+
+    protected void evaluateResourceTypePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        Resource resource = permission.getResource();
+
+        if (resource.getType() != null) {
+            StoreFactory storeFactory = authorization.getStoreFactory();
+            PolicyStore policyStore = storeFactory.getPolicyStore();
+            ResourceServer resourceServer = permission.getResourceServer();
+
+            policyStore.findByResourceType(resourceServer, resource.getType(), policyConsumer);
+
+            if (!resource.getOwner().equals(resourceServer.getClientId())) {
+                ResourceStore resourceStore = storeFactory.getResourceStore();
+
+                for (Resource typedResource : resourceStore.findByType(resourceServer, resource.getType())) {
+                    policyStore.findByResource(resourceServer, typedResource, policyConsumer);
+                }
+            }
+        }
+    }
+
+    protected void evaluateScopePolicies(ResourcePermission permission, AuthorizationProvider authorization, Consumer<Policy> policyConsumer) {
+        Collection<Scope> scopes = permission.getScopes();
+
+        if (!scopes.isEmpty()) {
+            PolicyStore policyStore = authorization.getStoreFactory().getPolicyStore();
+            ResourceServer resourceServer = permission.getResourceServer();
+            policyStore.findByScopes(resourceServer, null, new LinkedList<>(scopes), policyConsumer);
+        }
+    }
+
     private void grantAndComplete(ResourcePermission permission, AuthorizationProvider authorizationProvider,
             EvaluationContext executionContext, Decision decision) {
         DefaultEvaluation evaluation = new DefaultEvaluation(permission, executionContext, decision, authorizationProvider);
@@ -106,7 +131,7 @@ private void grantAndComplete(ResourcePermission permission, AuthorizationProvid
         decision.onComplete(permission);
     }
 
-    private Consumer<Policy> createPolicyEvaluator(ResourcePermission permission, AuthorizationProvider authorizationProvider, EvaluationContext executionContext, Decision decision, AtomicBoolean verified, Map<Policy, Map<Object, Decision.Effect>> decisionCache) {
+    protected Consumer<Policy> createPolicyEvaluator(ResourcePermission permission, AuthorizationProvider authorizationProvider, EvaluationContext executionContext, Decision decision, AtomicBoolean verified, Map<Policy, Map<Object, Decision.Effect>> decisionCache) {
         return parentPolicy -> {
             PolicyProvider policyProvider = authorizationProvider.getProvider(parentPolicy.getType());
 
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
index 874a1d6fc3fa..3a7fd6be644b 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
@@ -21,6 +21,7 @@
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.Decision.Effect;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 
@@ -77,7 +78,36 @@ public interface Evaluation {
      */
     void denyIfNoEffect();
 
+    /**
+     * Returns the parent policy (a permission) of the policy being evaluated.
+     *
+     * @return the parent policy
+     */
+    Policy getParentPolicy();
+
     Effect getEffect();
 
     void setEffect(Effect effect);
+
+    /**
+     * If the given scope should be granted when the given {@code grantedPolicy} is granting access to a resource or a specific scope.
+     *
+     * @param grantedPolicy the policy granting access
+     * @param grantedScope the scope that should be granted
+     * @return {@code true} if the scope is granted. Otherwise, returns {@code false}
+     */
+    default boolean isGranted(Policy grantedPolicy, Scope grantedScope) {
+        return grantedPolicy.getScopes().contains(grantedScope);
+    }
+
+    /**
+     * If the given scope should not be granted when the given {@code deniedPolicy} denies access to a resource or a specific scope.
+     *
+     * @param deniedPolicy the policy granting access
+     * @param deniedScope the scope that should be granted
+     * @return {@code true} if the scope is granted. Otherwise, returns {@code false}
+     */
+    default boolean isDenied(Policy deniedPolicy, Scope deniedScope) {
+        return false;
+    }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
index 1de8db6fd3f3..d7df7cce1fdf 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
@@ -22,12 +22,16 @@
 import java.util.Map;
 
 import org.keycloak.authorization.store.syncronization.ClientApplicationSynchronizer;
+import org.keycloak.authorization.store.syncronization.GroupSynchronizer;
 import org.keycloak.authorization.store.syncronization.RealmSynchronizer;
+import org.keycloak.authorization.store.syncronization.RoleSynchronizer;
 import org.keycloak.authorization.store.syncronization.Synchronizer;
 import org.keycloak.authorization.store.syncronization.UserSynchronizer;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ClientModel.ClientRemovedEvent;
+import org.keycloak.models.GroupModel.GroupRemovedEvent;
 import org.keycloak.models.RealmModel.RealmRemovedEvent;
+import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;
 import org.keycloak.models.UserModel.UserRemovedEvent;
 import org.keycloak.provider.ProviderEvent;
 import org.keycloak.provider.ProviderFactory;
@@ -48,6 +52,8 @@ default void registerSynchronizationListeners(KeycloakSessionFactory factory) {
         synchronizers.put(ClientRemovedEvent.class, new ClientApplicationSynchronizer());
         synchronizers.put(RealmRemovedEvent.class, new RealmSynchronizer());
         synchronizers.put(UserRemovedEvent.class, new UserSynchronizer());
+        synchronizers.put(GroupRemovedEvent.class, new GroupSynchronizer());
+        synchronizers.put(RoleRemovedEvent.class, new RoleSynchronizer());
 
         factory.register(event -> {
             try {
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
index 5fc5988a6783..bf3197b67a90 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
@@ -21,6 +21,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.function.Consumer;
+import java.util.stream.Stream;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
@@ -187,4 +188,8 @@ default List<Policy> findByScopes(ResourceServer resourceServer, Resource resour
      * @return a list of policies that depends on the a policy with the given identifier
      */
     List<Policy> findDependentPolicies(ResourceServer resourceServer, String id);
+
+    Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, String configValue);
+
+    Stream<Policy> findDependentPolicies(ResourceServer resourceServer, String resourceType, String associatedPolicyType, String configKey, List<String> configValues);
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
index 969e92ec4ece..272866e83eb5 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
@@ -22,6 +22,7 @@
 import java.util.Map;
 import java.util.Set;
 
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
@@ -43,6 +44,8 @@ public void synchronize(ClientRemovedEvent event, KeycloakSessionFactory factory
         ProviderFactory<AuthorizationProvider> providerFactory = factory.getProviderFactory(AuthorizationProvider.class);
         AuthorizationProvider authorizationProvider = providerFactory.create(event.getKeycloakSession());
 
+        AdminPermissionsSchema.SCHEMA.removeResourceObject(authorizationProvider, event);
+
         removeFromClientPolicies(event, authorizationProvider);
     }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/GroupSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/GroupSynchronizer.java
new file mode 100644
index 000000000000..1e6ff68ec52f
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/GroupSynchronizer.java
@@ -0,0 +1,18 @@
+package org.keycloak.authorization.store.syncronization;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.models.GroupModel.GroupRemovedEvent;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderFactory;
+
+public class GroupSynchronizer implements Synchronizer<GroupRemovedEvent> {
+
+    @Override
+    public void synchronize(GroupRemovedEvent event, KeycloakSessionFactory factory) {
+        ProviderFactory<AuthorizationProvider> providerFactory = factory.getProviderFactory(AuthorizationProvider.class);
+        AuthorizationProvider authorizationProvider = providerFactory.create(event.getKeycloakSession());
+
+        AdminPermissionsSchema.SCHEMA.removeResourceObject(authorizationProvider, event);
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RoleSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RoleSynchronizer.java
new file mode 100644
index 000000000000..6d7828ed3efb
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RoleSynchronizer.java
@@ -0,0 +1,18 @@
+package org.keycloak.authorization.store.syncronization;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;
+import org.keycloak.provider.ProviderFactory;
+
+public class RoleSynchronizer implements Synchronizer<RoleRemovedEvent> {
+
+    @Override
+    public void synchronize(RoleRemovedEvent event, KeycloakSessionFactory factory) {
+        ProviderFactory<AuthorizationProvider> providerFactory = factory.getProviderFactory(AuthorizationProvider.class);
+        AuthorizationProvider authorizationProvider = providerFactory.create(event.getKeycloakSession());
+
+        AdminPermissionsSchema.SCHEMA.removeResourceObject(authorizationProvider, event);
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
index 36b19e423d14..8d812ed1c4c1 100644
--- a/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
+++ b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
@@ -18,14 +18,11 @@
 package org.keycloak.authorization.store.syncronization;
 
 import java.util.EnumMap;
-import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.PermissionTicket;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
 import org.keycloak.authorization.store.PermissionTicketStore;
 import org.keycloak.authorization.store.PolicyStore;
 import org.keycloak.authorization.store.ResourceStore;
@@ -34,7 +31,6 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserModel.UserRemovedEvent;
 import org.keycloak.provider.ProviderFactory;
-import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -46,6 +42,8 @@ public void synchronize(UserRemovedEvent event, KeycloakSessionFactory factory)
         ProviderFactory<AuthorizationProvider> providerFactory = factory.getProviderFactory(AuthorizationProvider.class);
         AuthorizationProvider authorizationProvider = providerFactory.create(event.getKeycloakSession());
 
+        AdminPermissionsSchema.SCHEMA.removeResourceObject(authorizationProvider, event);
+
         removeFromUserPermissionTickets(event, authorizationProvider);
         removeUserResources(event, authorizationProvider);
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
index e07bfb284c11..3c3fad2b7e2b 100755
--- a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
@@ -16,11 +16,13 @@
  */
 package org.keycloak.broker.provider;
 
+import org.jboss.logging.Logger;
 import org.keycloak.common.util.Base64Url;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.IdentityProviderSyncMode;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -30,6 +32,7 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriInfo;
+
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -42,6 +45,15 @@
  */
 public abstract class AbstractIdentityProvider<C extends IdentityProviderModel> implements IdentityProvider<C> {
 
+    protected static final Logger logger = Logger.getLogger(AbstractIdentityProvider.class);
+
+    // The clientSession note flag to indicate that email or username provided by identityProvider was changed on updateProfile page
+    public static final String UPDATE_PROFILE_EMAIL_CHANGED = "UPDATE_PROFILE_EMAIL_CHANGED";
+    public static final String UPDATE_PROFILE_USERNAME_CHANGED = "UPDATE_PROFILE_USERNAME_CHANGED";
+
+    // clientSession.note flag specifies if we imported new user to keycloak (true) or we just linked to an existing keycloak user (false)
+    public static final String BROKER_REGISTERED_NEW_USER = "BROKER_REGISTERED_NEW_USER";
+
     public static final String ACCOUNT_LINK_URL = "account-link-url";
     protected final KeycloakSession session;
     private final C config;
@@ -159,7 +171,44 @@ public void importNewUser(KeycloakSession session, RealmModel realm, UserModel u
 
     @Override
     public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context) {
+        updateEmail(user, context);
+    }
+
+    protected void updateEmail(UserModel user, BrokeredIdentityContext context) {
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+        // Could be the case during external-internal token exchange
+        if (authSession == null) return;
+
+        boolean isNewUser = Boolean.parseBoolean(authSession.getAuthNote(BROKER_REGISTERED_NEW_USER));
+
+        if (isNewUser || IdentityProviderSyncMode.FORCE.equals(getConfig().getSyncMode())) {
+            if (Boolean.parseBoolean(authSession.getAuthNote(UPDATE_PROFILE_EMAIL_CHANGED))) {
+                // user updated the email and needs verification
+                user.setEmailVerified(false);
+                return;
+            }
 
+            setEmailVerified(user, context);
+            user.setEmail(context.getEmail());
+        }
+    }
+
+    protected void setEmailVerified(UserModel user, BrokeredIdentityContext context) {
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+        boolean isNewUser = Boolean.parseBoolean(authSession.getAuthNote(BROKER_REGISTERED_NEW_USER));
+        String federatedEmail = context.getEmail();
+        String localEmail = user.getEmail();
+
+        if (isNewUser || federatedEmail != null && !federatedEmail.equalsIgnoreCase(localEmail)) {
+            IdentityProviderModel config = context.getIdpConfig();
+            boolean trustEmail = config.isTrustEmail();
+
+            if (logger.isTraceEnabled()) {
+                logger.tracef("Email %s verified automatically after updating user '%s' through Identity provider '%s' ", trustEmail ? "" : "not", user.getUsername(), config.getAlias());
+            }
+
+            user.setEmailVerified(trustEmail);
+        }
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
index 9dc289bcbcef..72f8eef38885 100755
--- a/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
+++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
@@ -65,7 +65,7 @@ private void registerConfigSyncEventListenerOnce(KeycloakSessionFactory factory)
                 if (keycloakSessionFactory != factory) {
                     keycloakSessionFactory = factory;
 
-                    LOG.infof("Registering %s", ConfigSyncEventListener.class);
+                    LOG.debugf("Registering %s", ConfigSyncEventListener.class);
                     factory.register(new ConfigSyncEventListener());
                 }
             }
diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
index 61e02ee10a87..4299b051a796 100755
--- a/server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
+++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
@@ -62,6 +62,10 @@ public BrokeredIdentityContext(String id, IdentityProviderModel idpConfig) {
         this.idpConfig = idpConfig;
     }
 
+    public BrokeredIdentityContext(IdentityProviderModel idpConfig) {
+        this.idpConfig = idpConfig;
+    }
+
     public String getId() {
         return id;
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/ExchangeExternalToken.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/ExchangeExternalToken.java
index 5a07d167b0b2..2449739c9e6c 100644
--- a/server-spi-private/src/main/java/org/keycloak/broker/provider/ExchangeExternalToken.java
+++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/ExchangeExternalToken.java
@@ -16,11 +16,11 @@
  */
 package org.keycloak.broker.provider;
 
-import org.keycloak.broker.provider.BrokeredIdentityContext;
-import org.keycloak.events.EventBuilder;
 import org.keycloak.models.UserSessionModel;
 
 import jakarta.ws.rs.core.MultivaluedMap;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
 
 /**
  * Exchange a token crafted by this provider for a local realm token.
@@ -30,7 +30,7 @@
  */
 public interface ExchangeExternalToken {
     boolean isIssuer(String issuer, MultivaluedMap<String, String> params);
-    BrokeredIdentityContext exchangeExternal(EventBuilder event, MultivaluedMap<String, String> params);
+    BrokeredIdentityContext exchangeExternal(TokenExchangeProvider tokenExchangeProvider, TokenExchangeContext tokenExchangeContext);
 
     void exchangeExternalComplete(UserSessionModel userSession, BrokeredIdentityContext context, MultivaluedMap<String, String> params);
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
index a9b462e43624..70af2af55089 100755
--- a/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
@@ -84,7 +84,7 @@ interface AuthenticationCallback {
          *
          * @return see description
          */
-        Response error(String message);
+        Response error(IdentityProviderModel idpConfig, String message);
     }
 
     C getConfig();
diff --git a/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java
index 2b9b7f53034a..4d786be6a258 100644
--- a/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java
@@ -78,9 +78,15 @@ public interface ClusterProvider extends Provider {
      * @param event
      * @param ignoreSender if true, then sender node itself won't receive the notification
      * @param dcNotify Specify which DCs to notify. See {@link DCNotify} enum values for more info
+     * @deprecated use {@link ClusterProvider#notify(String, ClusterEvent, boolean)} instead. {@link DCNotify} is deprecated. For removal in Keycloak 27.
      */
+    @Deprecated(since = "26.3", forRemoval = true)
     void notify(String taskKey, ClusterEvent event, boolean ignoreSender, DCNotify dcNotify);
 
+    default void notify(String taskKey, ClusterEvent event, boolean ignoreSender) {
+        notify(taskKey, event, ignoreSender, DCNotify.ALL_DCS);
+    }
+
     /**
      * An alternative to {@link #notify(String, ClusterEvent, boolean, DCNotify)} that sends multiple events in a single
      * network call.
@@ -89,11 +95,23 @@ public interface ClusterProvider extends Provider {
      * given {@code taskKey}
      *
      * @see #notify(String, ClusterEvent, boolean, DCNotify)
+     * @deprecated use {@link ClusterProvider#notify(String, Collection, boolean)} instead. {@link DCNotify} is deprecated. For removal in Keycloak 27.
      */
+    @Deprecated(since = "26.3", forRemoval = true)
     default void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender, DCNotify dcNotify) {
         events.forEach(event -> notify(taskKey, event, ignoreSender, dcNotify));
     }
 
+    default void notify(String taskKey, Collection<? extends ClusterEvent> events, boolean ignoreSender) {
+        events.forEach(event -> notify(taskKey, event, ignoreSender, DCNotify.ALL_DCS));
+    }
+
+    /**
+     * This is now used only in deprecated methods.
+     * All methods that are using this enum have a Javadoc suggesting alternative.
+     * @deprecated For removal in Keycloak 27.
+     */
+    @Deprecated(since = "26.3", forRemoval = true)
     enum DCNotify {
         /** Send message to all cluster nodes in all DCs **/
         ALL_DCS,
@@ -102,7 +120,7 @@ enum DCNotify {
         LOCAL_DC_ONLY,
 
         /** Send message to all cluster nodes in all datacenters, but NOT to this datacenter. Option "ignoreSender" of method {@link #notify} will be ignored as sender is ignored anyway due it is in this datacenter **/
-        ALL_BUT_LOCAL_DC
+         ALL_BUT_LOCAL_DC
     }
 
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/cluster/ManagedCacheManagerProvider.java b/server-spi-private/src/main/java/org/keycloak/cluster/ManagedCacheManagerProvider.java
deleted file mode 100644
index 3f9cbb3c91ac..000000000000
--- a/server-spi-private/src/main/java/org/keycloak/cluster/ManagedCacheManagerProvider.java
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright 2019 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.cluster;
-
-import org.keycloak.Config;
-import org.keycloak.models.KeycloakSession;
-
-/**
- * A Service Provider Interface (SPI) that allows to plug-in an embedded or remote cache manager instance.
- *
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface ManagedCacheManagerProvider {
-
-    <C> C getEmbeddedCacheManager(KeycloakSession keycloakSession, Config.Scope config);
-
-    /**
-     * @return A RemoteCacheManager if the features {@link org.keycloak.common.Profile.Feature#CLUSTERLESS} or {@link org.keycloak.common.Profile.Feature#MULTI_SITE}  is enabled, {@code null} otherwise.
-     */
-    <C> C getRemoteCacheManager(Config.Scope config);
-}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/AggregatedCompatibilityResult.java b/server-spi-private/src/main/java/org/keycloak/compatibility/AggregatedCompatibilityResult.java
new file mode 100644
index 000000000000..ef55cd33d090
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/AggregatedCompatibilityResult.java
@@ -0,0 +1,44 @@
+package org.keycloak.compatibility;
+
+import java.util.HashSet;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+record AggregatedCompatibilityResult(Set<CompatibilityResult> compatibilityResults) implements CompatibilityResult {
+
+    public AggregatedCompatibilityResult(CompatibilityResult compatibilityResult) {
+        this(new HashSet<>());
+        this.compatibilityResults.add(compatibilityResult);
+    }
+
+    public AggregatedCompatibilityResult add(CompatibilityResult a) {
+        compatibilityResults.add(a);
+        return this;
+    }
+
+    @Override
+    public int exitCode() {
+        return compatibilityResults.stream()
+                .anyMatch(r -> r.exitCode() == ExitCode.RECREATE.value())
+                ? ExitCode.RECREATE.value() : ExitCode.ROLLING.value();
+    }
+
+    @Override
+    public Optional<String> errorMessage() {
+        StringBuilder sb = new StringBuilder("Aggregated incompatible results:\n");
+        for (CompatibilityResult result : compatibilityResults) {
+            sb.append(result.errorMessage()).append("\n");
+        }
+        return Optional.of(sb.toString());
+    }
+
+    @Override
+    public Optional<Set<String>> incompatibleAttributes() {
+        return Optional.of(compatibilityResults.stream()
+                .filter(r -> ProviderIncompatibleResult.class.isAssignableFrom(r.getClass()))
+                .map(ProviderIncompatibleResult.class::cast)
+                .flatMap(r -> r.incompatibleAttributes().orElse(Set.of()).stream())
+                .collect(Collectors.toSet()));
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityMetadataProvider.java b/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityMetadataProvider.java
new file mode 100644
index 000000000000..d53405ed5499
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityMetadataProvider.java
@@ -0,0 +1,56 @@
+package org.keycloak.compatibility;
+
+import java.util.Map;
+
+/**
+ * Provides the metadata used by the "update-compatibility" command.
+ * <p>
+ * Implementations should return all metadata required to determine if it is possible to update from one Keycloak
+ * deployment to another in a compatible manner. Metadata key/value pairs may be added or removed in a subsequent
+ * version, so it's necessary for implementations to handle missing metadata gracefully.
+ * <p>
+ * The {@link CompatibilityResult} determines if a rolling update is possible. Factory methods are present with default
+ * implementations of {@link CompatibilityResult}.
+ */
+public interface CompatibilityMetadataProvider {
+
+    int DEFAULT_PRIORITY = 1;
+
+    /**
+     * Provides the metadata to be persisted.
+     * <p>
+     * If an empty {@link Map} is returned, no information about this implementation will be persisted. A {@code null}
+     * return value is not supported, and it will interrupt the process.
+     *
+     * @return The metadata required by this provider to determine if a rolling update is possible.
+     */
+    Map<String, String> metadata();
+
+    /**
+     * It compares the current metadata with {@code other} from another deployment.
+     * <p>
+     * The default implementation will allow a rolling update if the metadata from the current server is equal to the
+     * {@code other}. Implementations can overwrite this method as required.
+     *
+     * @param other The other deployment metadata. It only contains the metadata from this implementation.
+     * @return The {@link CompatibilityResult} with the outcome.
+     * @see CompatibilityResult
+     */
+    default CompatibilityResult isCompatible(Map<String, String> other) {
+        return Util.isCompatible(getId(), other, metadata());
+    }
+
+    /**
+     * @return The priority. Only relevant is multiple implementation has the same {@link #getId()} and/or to replace
+     * the default implementation shipped in Keycloak.
+     */
+    default int priority() {
+        return DEFAULT_PRIORITY;
+    }
+
+    /**
+     * @return The ID of this implementation. It should be unique as implementation with the same ID and priority is not
+     * valid.
+     */
+    String getId();
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityResult.java b/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityResult.java
new file mode 100644
index 000000000000..b660b6353632
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/CompatibilityResult.java
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.compatibility;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+
+/**
+ * The result of {@link CompatibilityMetadataProvider#isCompatible(Map)}.
+ * <p>
+ * It is composed by the exit code (to help building scripts around this tool as it is easier than parsing logs), and an
+ * optional error message.
+ */
+public interface CompatibilityResult {
+
+    /**
+     * @return The exit code to use to signal the compatibility result.
+     */
+    int exitCode();
+
+    /**
+     * @return An optional error message explaining what caused the incompatibility.
+     */
+    default Optional<String> errorMessage() {
+        return Optional.empty();
+    }
+
+    /**
+     * @return An optional message after the check is finished.
+     */
+    default Optional<String> endMessage() {
+        return Optional.empty();
+    }
+
+    default Optional<Set<String>> incompatibleAttributes() {return Optional.empty();}
+
+    static CompatibilityResult providerCompatible(String providerId) {
+        return new ProviderCompatibleResult(Objects.requireNonNull(providerId));
+    }
+
+    static CompatibilityResult incompatibleAttribute(String providerId, String attribute, String previousValue, String currentValue) {
+        return new ProviderIncompatibleResult(Objects.requireNonNull(providerId), Objects.requireNonNull(attribute),
+                previousValue, currentValue);
+    }
+
+    enum ExitCode {
+        ROLLING(0),
+        // see picocli.CommandLine.ExitCode
+        // 1 -> software error
+        // 2 -> usage error
+        RECREATE(3);
+        // 4 -> feature 'rolling-updates' disabled
+
+        final int exitCode;
+
+        ExitCode(int exitCode) {
+            this.exitCode = exitCode;
+        }
+
+        public int value() {
+            return exitCode;
+        }
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderCompatibleResult.java b/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderCompatibleResult.java
new file mode 100644
index 000000000000..43c5f3438d22
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderCompatibleResult.java
@@ -0,0 +1,19 @@
+package org.keycloak.compatibility;
+
+import java.util.Optional;
+
+/**
+ * Internal class to signal that the provider is compatible with the previous metadata.
+ */
+record ProviderCompatibleResult(String providerId) implements CompatibilityResult {
+
+    @Override
+    public int exitCode() {
+        return ExitCode.ROLLING.value();
+    }
+
+    @Override
+    public Optional<String> endMessage() {
+        return Optional.of("[%s] Provider is compatible.".formatted(providerId));
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderIncompatibleResult.java b/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderIncompatibleResult.java
new file mode 100644
index 000000000000..1ead1e7899d7
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/ProviderIncompatibleResult.java
@@ -0,0 +1,27 @@
+package org.keycloak.compatibility;
+
+import java.util.Optional;
+import java.util.Set;
+
+/**
+ * Internal class to signal that the provider is not compatible with the previous metadata.
+ * <p>
+ * It provides information about the provider's ID and the attribute previous and current values.
+ */
+record ProviderIncompatibleResult(String providerId, String attribute, String previousValue,
+                                  String currentValue) implements CompatibilityResult {
+    @Override
+    public int exitCode() {
+        return ExitCode.RECREATE.value();
+    }
+
+    @Override
+    public Optional<String> errorMessage() {
+        return Optional.of("[%s] Rolling Update is not available. '%s.%s' is incompatible: %s -> %s.".formatted(providerId, providerId, attribute, previousValue, currentValue));
+    }
+
+    @Override
+    public Optional<Set<String>> incompatibleAttributes() {
+        return Optional.of(Set.of(attribute));
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/compatibility/Util.java b/server-spi-private/src/main/java/org/keycloak/compatibility/Util.java
new file mode 100644
index 000000000000..95dfcb094a5f
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/compatibility/Util.java
@@ -0,0 +1,44 @@
+package org.keycloak.compatibility;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Stream;
+
+public final class Util {
+
+    private Util() {
+    }
+
+    public static <T> Stream<T> mergeKeySet(Map<T, ?> map1, Map<T, ?> map2) {
+        return Stream.concat(
+                map1.keySet().stream(),
+                map2.keySet().stream()
+        ).distinct();
+    }
+
+    public static CompatibilityResult isCompatible(String provider, Map<String, String> old, Map<String, String> current) {
+        return mergeKeySet(old, current)
+                .sorted()
+                .map(key -> compare(provider, key, old.get(key), current.get(key)))
+                .filter(Util::isNotCompatible)
+                .reduce((a, b) -> {
+                    if (! (a instanceof AggregatedCompatibilityResult)) {
+                        a = new AggregatedCompatibilityResult(a);
+                    }
+
+                    return ((AggregatedCompatibilityResult) a).add(b);
+                })
+                .orElse(CompatibilityResult.providerCompatible(provider));
+    }
+
+    public static boolean isNotCompatible(CompatibilityResult result) {
+        return result.exitCode() != CompatibilityResult.ExitCode.ROLLING.value();
+    }
+
+    private static CompatibilityResult compare(String provider, String key, String old, String current) {
+        return Objects.equals(old, current) ?
+                CompatibilityResult.providerCompatible(provider) :
+                CompatibilityResult.incompatibleAttribute(provider, key, old, current);
+    }
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagerProxy.java b/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagerProxy.java
new file mode 100644
index 000000000000..6f329240c1b3
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagerProxy.java
@@ -0,0 +1,148 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.connections.jpa.support;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+import java.sql.SQLException;
+import java.sql.SQLIntegrityConstraintViolationException;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.regex.Pattern;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.ModelIllegalStateException;
+
+import jakarta.persistence.EntityExistsException;
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.FlushModeType;
+import jakarta.persistence.OptimisticLockException;
+import jakarta.persistence.Query;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class EntityManagerProxy {
+
+    private static final Pattern WRITE_METHOD_NAMES = Pattern.compile("persist|merge");
+
+    private EntityManager em;
+    private final boolean batchEnabled;
+    private final int batchSize;
+    private int changeCount = 0;
+
+    public static EntityManager create(KeycloakSession session, EntityManager em) {
+        // the alternative to this tracking is to have a method on the session for
+        // getting the in use providers - not something that will create all providers
+        EntityManagerProxy converter = new EntityManagerProxy(session, em);
+        Set<EntityManagerProxy> entityManagerProxies = session.getAttribute(EntityManagers.ENTITY_MANAGER_PROXIES, Set.class);
+        if (entityManagerProxies == null) {
+            entityManagerProxies = new HashSet<>();
+            session.setAttribute(EntityManagers.ENTITY_MANAGER_PROXIES, entityManagerProxies);
+        }
+        entityManagerProxies.add(converter);
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, converter::invoke);
+    }
+
+    private EntityManagerProxy(KeycloakSession session, EntityManager em) {
+        batchEnabled = session.getAttributeOrDefault(Constants.STORAGE_BATCH_ENABLED, false);
+        batchSize = session.getAttributeOrDefault(Constants.STORAGE_BATCH_SIZE, 100);
+        this.em = em;
+    }
+
+    void setEntityManager(EntityManager manager) {
+        this.em = manager;
+    }
+
+    EntityManager getEntityManager() {
+        return this.em;
+    }
+
+    private Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        boolean batched = EntityManagers.isBatchMode();
+        try {
+            flushInBatchIfEnabled(method);
+            Object result = method.invoke(em, args);
+            if (batched && result instanceof Query query) {
+                // TODO: it would be safer if there were a way to validate
+                // if this or disabling persist/detach where correct for a given batch
+                // and types were correct
+                query.setFlushMode(FlushModeType.COMMIT);
+            }
+            return result;
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    private void flushInBatchIfEnabled(Method method) {
+        if (batchEnabled) {
+            if (WRITE_METHOD_NAMES.matcher(method.getName()).matches()) {
+                if (changeCount++ > batchSize) {
+                    em.flush();
+                    em.clear();
+                    changeCount = 0;
+                }
+            }
+        }
+    }
+
+    // For JTA, the database operations are executed during the commit phase of a transaction, and DB exceptions can be propagated differently
+    public static ModelException convert(Throwable t) {
+        final Predicate<Throwable> checkDuplicationMessage = throwable -> {
+            final String message = throwable.getCause() != null ? throwable.getCause().getMessage() : throwable.getMessage();
+            return message == null ? false : message.toLowerCase().contains("duplicate");
+        };
+
+        Predicate<Throwable> throwModelDuplicateEx = throwable ->
+                throwable instanceof EntityExistsException
+                || throwable instanceof ConstraintViolationException
+                || isSqlStateClass23(throwable)
+                || throwable instanceof SQLIntegrityConstraintViolationException;
+
+        throwModelDuplicateEx = throwModelDuplicateEx.or(checkDuplicationMessage);
+
+        if (t.getCause() != null && throwModelDuplicateEx.test(t.getCause())) {
+            throw new ModelDuplicateException("Duplicate resource error", t.getCause());
+        } else if (throwModelDuplicateEx.test(t)) {
+            throw new ModelDuplicateException("Duplicate resource error", t);
+        } else if (t instanceof OptimisticLockException) {
+            throw new ModelIllegalStateException("Database operation failed", t);
+        } else {
+            throw new ModelException("Database operation failed", t);
+        }
+    }
+
+    /**
+     * SQL state class 23 captures errors like 23505 = UNIQUE VIOLATION et al.
+     * This captures, for example, a BatchUpdateException which is not mapped to the other exception types
+     * https://en.wikipedia.org/wiki/SQLSTATE
+     */
+    private static boolean isSqlStateClass23(Throwable t) {
+        return t instanceof SQLException bue
+            && bue.getSQLState() != null
+            && bue.getSQLState().startsWith("23");
+    }
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagers.java b/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagers.java
new file mode 100644
index 000000000000..f20e216b164b
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/connections/jpa/support/EntityManagers.java
@@ -0,0 +1,134 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.connections.jpa.support;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Consumer;
+import java.util.stream.Stream;
+
+import org.hibernate.Session;
+import org.keycloak.models.KeycloakSession;
+
+import jakarta.persistence.EntityManager;
+
+public class EntityManagers {
+
+    static final String ENTITY_MANAGER_PROXIES = "ENTITY_MANAGER_PROXIES";
+
+    private static final ThreadLocal<Boolean> batchMode = new ThreadLocal<Boolean>();
+
+    static void runInBatchMode(Runnable runnable) {
+        boolean isBatched = isBatchMode();
+        batchMode.set(true);
+        try {
+            runnable.run();
+        } finally {
+            if (!isBatched) {
+                batchMode.remove();
+            }
+        }
+    }
+
+    public static boolean isBatchMode() {
+        return Boolean.TRUE.equals(batchMode.get());
+    }
+
+    static void forEachEntityManager(KeycloakSession session, Consumer<EntityManager> op) {
+        try {
+            getEntityManagerProxies(session).map(EntityManagerProxy::getEntityManager)
+                    .filter(EntityManager::isOpen).forEach(op);
+        } catch (Exception e) {
+            // this was run directly on the unproxied entitymanagers, so the exception will need converted
+            throw EntityManagerProxy.convert(e);
+        }
+    }
+
+    static Stream<EntityManagerProxy> getEntityManagerProxies(KeycloakSession session) {
+        return Optional.ofNullable((Set<EntityManagerProxy>) session.getAttribute(ENTITY_MANAGER_PROXIES, Set.class))
+                .map(Set::stream).orElse(Stream.of());
+    }
+
+    /**
+     * Flush and optionally clear all the currently in use {@link EntityManager}s
+     */
+    public static void flush(KeycloakSession session, boolean clear) {
+        forEachEntityManager(session, em -> {
+            em.flush(); // TODO: avoid if read-only
+            if (clear) {
+                em.clear();
+            }
+        });
+    }
+
+    /**
+     * Run the operation in batch mode with a pre-flush.
+     * <p>
+     * It is desirable to use nestedEntityManagers=true to keep the existing context free of newly created entities.
+     * <p>
+     * flush and detach operations are NOT automatically inhibited in batch mode. For even greater performance, and
+     * statement level batching by Hibernate, you may use the {@link #isBatchMode()} to conditionally not perform those
+     * operations - however keep in mind that especially when running with nestedEntityManagers=false, the current
+     * persistence context will accumulate anything that is not detached.
+     * <p>
+     * WARNING: Any queries run while batching will be in COMMIT mode, so they cannot see non-flushed changes made
+     * within the batch. Most of Keycloak's JPA code however persists and flushes together.
+     *
+     * @param nestedEntityManagers - if true run with isolated EntityManagers WARNING: Any entities passed into the task that
+     *   that will get persisted must not already be associated with an open EntityManager.
+     */
+    public static void runInBatch(KeycloakSession session, Runnable runnable, boolean nestedEntityManagers) {
+        Map<EntityManagerProxy, Session> previous = new HashMap<EntityManagerProxy, Session>();
+
+        flush(session, false); // make sure the state entering the batch processing is committed
+
+        // create a localized entitymanager with a shared transaction coordinator, so nothing is left behind
+        if (nestedEntityManagers) {
+            getEntityManagerProxies(session).forEach(p -> {
+                Session em = p.getEntityManager().unwrap(Session.class);
+                Session derived = em.sessionWithOptions().connection().openSession();
+                previous.put(p, em);
+                p.setEntityManager(derived);
+            });
+        }
+
+        try {
+            runInBatchMode(runnable);
+            if (nestedEntityManagers) {
+                flush(session, true);
+            }
+        } finally {
+            // restablish the old entitymanagers
+            if (nestedEntityManagers) {
+                getEntityManagerProxies(session).forEach(p -> {
+                    EntityManager current = p.getEntityManager();
+                    EntityManager old = previous.get(p);
+                    if (old != null) {
+                        if (current.isOpen()) {
+                            current.close();
+                        }
+                        p.setEntityManager(old);
+                    } // else - created during the batch run, so it's enough that it was flushed / cleared
+                });
+            }
+        }
+    }
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/constants/Oid4VciConstants.java b/server-spi-private/src/main/java/org/keycloak/constants/Oid4VciConstants.java
new file mode 100644
index 000000000000..07b64bf75fc1
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/constants/Oid4VciConstants.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.constants;
+
+/**
+ * @author Pascal Knüppel
+ */
+public final class Oid4VciConstants {
+
+    public static final String OID4VC_PROTOCOL = "oid4vc";
+
+    public static final String C_NONCE_LIFETIME_IN_SECONDS = "vc.c-nonce-lifetime-seconds";
+
+    public static final String CREDENTIAL_SUBJECT = "credentialSubject";
+
+    private Oid4VciConstants() {
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/cookie/CookieType.java b/server-spi-private/src/main/java/org/keycloak/cookie/CookieType.java
index ba3f74be6d10..0dccb50b0099 100644
--- a/server-spi-private/src/main/java/org/keycloak/cookie/CookieType.java
+++ b/server-spi-private/src/main/java/org/keycloak/cookie/CookieType.java
@@ -20,7 +20,7 @@ public final class CookieType {
             .build();
 
     public static final CookieType AUTH_SESSION_ID_HASH = CookieType.create("KC_AUTH_SESSION_HASH")
-            .scope(CookieScope.INTERNAL_JS)
+            .scope(CookieScope.FEDERATION_JS)
             .defaultMaxAge(60)
             .build();
 
diff --git a/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProvider.java b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProvider.java
new file mode 100644
index 000000000000..ba6e2838ea84
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProvider.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crl;
+
+import org.keycloak.provider.Provider;
+
+import java.security.GeneralSecurityException;
+import java.security.cert.X509CRL;
+import java.util.concurrent.Callable;
+
+/**
+ * Crl Storage Provider interface
+ *
+ * @author rmartinc
+ */
+public interface CrlStorageProvider extends Provider {
+
+    /**
+     * Returns the CRL for this key from cache or loading from the loader.
+     * @param key The key for the CRL
+     * @param loader The loader to get if the CRL is not in cache
+     * @return The X509CRL placed in the cache
+     * @throws GeneralSecurityException
+     */
+    X509CRL get(String key, Callable<X509CRL> loader) throws GeneralSecurityException;
+
+    /**
+     * Refreshes the CRL in the cache for this key.
+     * @param key The key for the CRL
+     * @param loader The loader to get the CRL
+     * @return true if refreshed or false if not
+     * @throws GeneralSecurityException
+     */
+    boolean refreshCache(String key, Callable<X509CRL> loader) throws GeneralSecurityException;
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProviderFactory.java
new file mode 100644
index 000000000000..44799c134e19
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageProviderFactory.java
@@ -0,0 +1,24 @@
+
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.crl;
+
+import org.keycloak.provider.ProviderFactory;
+
+public interface CrlStorageProviderFactory extends ProviderFactory<CrlStorageProvider> {
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageSpi.java b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageSpi.java
new file mode 100644
index 000000000000..972696b757ba
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/crl/CrlStorageSpi.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.crl;
+
+import org.keycloak.provider.Spi;
+
+public class CrlStorageSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "crlStorage";
+    }
+
+    @Override
+    public Class<CrlStorageProvider> getProviderClass() {
+        return CrlStorageProvider.class;
+    }
+
+    @Override
+    public Class<CrlStorageProviderFactory> getProviderFactoryClass() {
+        return CrlStorageProviderFactory.class;
+    }
+
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/events/Details.java b/server-spi-private/src/main/java/org/keycloak/events/Details.java
index 08cf96bf5c8c..881633254ad4 100755
--- a/server-spi-private/src/main/java/org/keycloak/events/Details.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/Details.java
@@ -40,6 +40,7 @@ public interface Details {
     String AUTH_METHOD = "auth_method";
     String IDENTITY_PROVIDER = "identity_provider";
     String IDENTITY_PROVIDER_USERNAME = "identity_provider_identity";
+    String IDENTITY_PROVIDER_BROKER_SESSION_ID = "identity_provider_broker_session_id";
     String REGISTER_METHOD = "register_method";
     String USERNAME = "username";
     String FIRST_NAME = "first_name";
@@ -50,6 +51,8 @@ public interface Details {
     String UPDATED_LAST_NAME = PREF_UPDATED + "last_name";
     String REMEMBER_ME = "remember_me";
     String TOKEN_ID = "token_id";
+    String TOKEN_TYPE = "token_type";
+    String TOKEN_ISSUED_FOR = "token_issued_for";
     String ORG_ID = "org_id";
     String REFRESH_TOKEN_ID = "refresh_token_id";
     String REFRESH_TOKEN_TYPE = "refresh_token_type";
@@ -60,11 +63,14 @@ public interface Details {
     String REASON = "reason";
     String GRANTED_CLIENT = "granted_client";
     String REVOKED_CLIENT = "revoked_client";
+    String TOKEN_EXCHANGE_REVOKED_CLIENTS = "token_exchange_revoked_clients";
     String AUDIENCE = "audience";
     String PERMISSION = "permission";
     String SCOPE = "scope";
     String REQUESTED_ISSUER = "requested_issuer";
     String REQUESTED_SUBJECT = "requested_subject";
+    String REQUESTED_TOKEN_TYPE = "requested_token_type";
+    String SUBJECT_TOKEN_CLIENT_ID = "subject_token_client_id";
     String RESTART_AFTER_TIMEOUT = "restart_after_timeout";
     String REDIRECTED_TO_CLIENT = "redirected_to_client";
     String LOGIN_RETRY = "login_retry";
@@ -102,4 +108,7 @@ public interface Details {
     String LOGOUT_TRIGGERED_BY_REQUIRED_ACTION = "logout_triggered_by_required_action";
     String ACCESS_TOKEN_EXPIRATION_TIME = "access_token_expiration_time";
     String AGE_OF_REFRESH_TOKEN = "age_of_refresh_token";
+
+    String CLIENT_POLICY_ERROR = "client_policy_error";
+    String CLIENT_POLICY_ERROR_DETAIL = "client_policy_error_detail";
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/events/Event.java b/server-spi-private/src/main/java/org/keycloak/events/Event.java
index b43f76a529cc..009482bada72 100644
--- a/server-spi-private/src/main/java/org/keycloak/events/Event.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/Event.java
@@ -110,6 +110,11 @@ public void setSessionId(String sessionId) {
         this.sessionId = maxLength(sessionId, 255);
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
@@ -134,6 +139,7 @@ public void setDetails(Map<String, String> details) {
         this.details = details;
     }
 
+    @Override
     public Event clone() {
         Event clone = new Event();
         clone.id = id;
diff --git a/server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java b/server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java
index a466ab84dc52..07e5663798e9 100755
--- a/server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java
@@ -60,7 +60,7 @@ public class EventBuilder {
 
     public EventBuilder(RealmModel realm, KeycloakSession session, ClientConnection clientConnection) {
         this(realm, session);
-        ipAddress(clientConnection.getRemoteAddr());
+        ipAddress(clientConnection.getRemoteHost());
     }
 
     public EventBuilder(RealmModel realm, KeycloakSession session) {
@@ -236,6 +236,7 @@ public void error(String error) {
         send(this.storeImmediately == null ? true : this.storeImmediately);
     }
 
+    @Override
     public EventBuilder clone() {
         return new EventBuilder(session, store, listeners, realm, event.clone());
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/events/EventQuery.java b/server-spi-private/src/main/java/org/keycloak/events/EventQuery.java
index db8aa707abfa..3c0cce8eba5e 100644
--- a/server-spi-private/src/main/java/org/keycloak/events/EventQuery.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/EventQuery.java
@@ -56,19 +56,35 @@ public interface EventQuery {
     EventQuery user(String userId);
 
     /**
-     * Search events that are newer than {@code fromDate}
+     * Search events that are on or after {@code fromDate}
      * @param fromDate date
      * @return this object for method chaining
      */
+    @Deprecated
     EventQuery fromDate(Date fromDate);
 
     /**
-     * Search events that are older than {@code toDate}
+     * Search events that are on or after {@code fromDate}
+     * @param fromDate from timestamp
+     * @return this object for method chaining
+     */
+    EventQuery fromDate(long fromDate);
+
+    /**
+     * Search events that are on or before {@code toDate}
      * @param toDate date
      * @return this object for method chaining
      */
+    @Deprecated
     EventQuery toDate(Date toDate);
 
+    /**
+     * Search events that are on or before {@code toDate}
+     * @param toDate to timestamp
+     * @return this object for method chaining
+     */
+    EventQuery toDate(long toDate);
+
     /**
      * Search events from ipAddress
      * @param ipAddress ip
diff --git a/server-spi-private/src/main/java/org/keycloak/events/EventType.java b/server-spi-private/src/main/java/org/keycloak/events/EventType.java
index 16697c51412b..882816ce67b7 100755
--- a/server-spi-private/src/main/java/org/keycloak/events/EventType.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/EventType.java
@@ -113,8 +113,8 @@ public enum EventType implements EnumWithStableIndex {
 
     IDENTITY_PROVIDER_LINK_ACCOUNT(29, true),
     IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR(0x10000 + IDENTITY_PROVIDER_LINK_ACCOUNT.getStableIndex(), true),
-    IDENTITY_PROVIDER_LOGIN(30, false),
-    IDENTITY_PROVIDER_LOGIN_ERROR(0x10000 + IDENTITY_PROVIDER_LOGIN.getStableIndex(), false),
+    IDENTITY_PROVIDER_LOGIN(30, true),
+    IDENTITY_PROVIDER_LOGIN_ERROR(0x10000 + IDENTITY_PROVIDER_LOGIN.getStableIndex(), true),
     IDENTITY_PROVIDER_FIRST_LOGIN(31, true),
     IDENTITY_PROVIDER_FIRST_LOGIN_ERROR(0x10000 + IDENTITY_PROVIDER_FIRST_LOGIN.getStableIndex(), true),
     IDENTITY_PROVIDER_POST_LOGIN(32, true),
diff --git a/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
index a750aa153ee3..6d5d91756762 100644
--- a/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
@@ -18,8 +18,6 @@
 package org.keycloak.events.admin;
 
 import java.util.Date;
-import java.util.List;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 /**
@@ -96,21 +94,39 @@ public interface AdminEventQuery {
     AdminEventQuery resourcePath(String resourcePath);
 
     /**
-     * Search by events after the specified time
+     * Search by events on or after the specified time
      * 
      * @param fromTime from date
      * @return <code>this</code> for method chaining
      */
+    @Deprecated
     AdminEventQuery fromTime(Date fromTime);
 
     /**
-     * Search by events before the specified time
+     * Search by events on or after the specified timestamp
+     *
+     * @param fromTime from timestamp
+     * @return <code>this</code> for method chaining
+     */
+    AdminEventQuery fromTime(long fromTime);
+
+    /**
+     * Search by events on or before the specified time
      * 
      * @param toTime to date
      * @return <code>this</code> for method chaining
      */
+    @Deprecated
     AdminEventQuery toTime(Date toTime);
 
+    /**
+     * Search by events on or before the specified timestamp
+     *
+     * @param toTime to timestamp
+     * @return <code>this</code> for method chaining
+     */
+    AdminEventQuery toTime(long toTime);
+
     /**
      * Used for pagination
      * 
diff --git a/server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java
index 76613aef3b24..2a1001899c0d 100644
--- a/server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java
+++ b/server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java
@@ -54,6 +54,11 @@ public void setUserId(String userId) {
         this.userId = userId;
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return ipAddress;
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
index 2bced0c5ceb8..06db428e0dcc 100644
--- a/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
@@ -17,10 +17,21 @@
 
 package org.keycloak.exportimport;
 
+import java.util.Map;
+
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.provider.ProviderFactory;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public interface ImportProviderFactory extends ProviderFactory<ImportProvider> {
+
+    ImportProvider create(KeycloakSession session, Map<String, String> overrides);
+
+    @Override
+    default ImportProvider create(KeycloakSession session) {
+        return create(session, Map.of());
+    }
+
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
index 9fbc1ed0ffc2..d1501fce6962 100755
--- a/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
@@ -56,7 +56,7 @@ public interface LoginFormsProvider extends Provider {
 
     Response createForm(String form);
 
-    String getMessage(String message);
+    String getMessage(String message, Object... parameters);
 
     Response createLoginUsernamePassword();
 
diff --git a/server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java b/server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java
index 1eaa1ba0afea..47e070e53252 100755
--- a/server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java
+++ b/server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java
@@ -111,6 +111,10 @@ public boolean lessThan(ModelVersion version) {
         return false;
     }
 
+    public boolean hasSameMajorMinor(ModelVersion v2) {
+        return major == v2.major && minor == v2.minor;
+    }
+
     @Override
     public boolean equals(Object obj) {
         if (!(obj instanceof ModelVersion)) {
diff --git a/server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java b/server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java
index 528b58d5e560..ea30f83ab7f2 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.models;
 
+import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -25,47 +26,46 @@
  */
 public class AdminRoles {
 
-    public static String APP_SUFFIX = "-realm";
+    public static final String APP_SUFFIX = "-realm";
 
-    public static String ADMIN = "admin";
+    public static final String ADMIN = "admin";
 
     // for admin client local to each realm
-    public static String REALM_ADMIN = "realm-admin";
+    public static final String REALM_ADMIN = "realm-admin";
 
-    public static String CREATE_REALM = "create-realm";
-    public static String CREATE_CLIENT = "create-client";
+    public static final String CREATE_REALM = "create-realm";
+    public static final String CREATE_CLIENT = "create-client";
 
-    public static String VIEW_REALM = "view-realm";
-    public static String VIEW_USERS = "view-users";
-    public static String VIEW_CLIENTS = "view-clients";
-    public static String VIEW_EVENTS = "view-events";
-    public static String VIEW_IDENTITY_PROVIDERS = "view-identity-providers";
-    public static String VIEW_AUTHORIZATION = "view-authorization";
+    public static final String VIEW_REALM = "view-realm";
+    public static final String VIEW_USERS = "view-users";
+    public static final String VIEW_CLIENTS = "view-clients";
+    public static final String VIEW_EVENTS = "view-events";
+    public static final String VIEW_IDENTITY_PROVIDERS = "view-identity-providers";
+    public static final String VIEW_AUTHORIZATION = "view-authorization";
 
-    public static String MANAGE_REALM = "manage-realm";
-    public static String MANAGE_USERS = "manage-users";
-    public static String MANAGE_IDENTITY_PROVIDERS = "manage-identity-providers";
-    public static String MANAGE_CLIENTS = "manage-clients";
-    public static String MANAGE_EVENTS = "manage-events";
-    public static String MANAGE_AUTHORIZATION = "manage-authorization";
+    public static final String MANAGE_REALM = "manage-realm";
+    public static final String MANAGE_USERS = "manage-users";
+    public static final String MANAGE_IDENTITY_PROVIDERS = "manage-identity-providers";
+    public static final String MANAGE_CLIENTS = "manage-clients";
+    public static final String MANAGE_EVENTS = "manage-events";
+    public static final String MANAGE_AUTHORIZATION = "manage-authorization";
 
-    public static String QUERY_USERS = "query-users";
-    public static String QUERY_CLIENTS = "query-clients";
-    public static String QUERY_REALMS = "query-realms";
-    public static String QUERY_GROUPS = "query-groups";
+    public static final String QUERY_USERS = "query-users";
+    public static final String QUERY_CLIENTS = "query-clients";
+    public static final String QUERY_REALMS = "query-realms";
+    public static final String QUERY_GROUPS = "query-groups";
+
+    public static final String IMPERSONATION = "impersonation";
 
     public static String[] ALL_REALM_ROLES = {CREATE_CLIENT, VIEW_REALM, VIEW_USERS, VIEW_CLIENTS, VIEW_EVENTS, VIEW_IDENTITY_PROVIDERS, VIEW_AUTHORIZATION, MANAGE_REALM, MANAGE_USERS, MANAGE_CLIENTS, MANAGE_EVENTS, MANAGE_IDENTITY_PROVIDERS, MANAGE_AUTHORIZATION, QUERY_USERS, QUERY_CLIENTS, QUERY_REALMS, QUERY_GROUPS};
     public static String[] ALL_QUERY_ROLES = {QUERY_USERS, QUERY_CLIENTS, QUERY_REALMS, QUERY_GROUPS};
 
     public static Set<String> ALL_ROLES = new HashSet<>();
     static {
-        for (String name : ALL_REALM_ROLES) {
-            ALL_ROLES.add(name);
-        }
-        ALL_ROLES.add(ImpersonationConstants.IMPERSONATION_ROLE);
+        ALL_ROLES.addAll(Arrays.asList(ALL_REALM_ROLES));
+        ALL_ROLES.add(IMPERSONATION);
         ALL_ROLES.add(ADMIN);
         ALL_ROLES.add(CREATE_REALM);
-        ALL_ROLES.add(CREATE_CLIENT);
         ALL_ROLES.add(REALM_ADMIN);
     }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java b/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
index d39eb9dacfb5..05858e21df3c 100644
--- a/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
@@ -28,7 +28,6 @@ public enum BrowserSecurityHeaders {
     CONTENT_SECURITY_POLICY_REPORT_ONLY("contentSecurityPolicyReportOnly", "Content-Security-Policy-Report-Only", ""),
     X_CONTENT_TYPE_OPTIONS("xContentTypeOptions", "X-Content-Type-Options", "nosniff"),
     X_ROBOTS_TAG("xRobotsTag", "X-Robots-Tag", "none"),
-    X_XSS_PROTECTION("xXSSProtection", "X-XSS-Protection", "1; mode=block"),
     STRICT_TRANSPORT_SECURITY("strictTransportSecurity", "Strict-Transport-Security", "max-age=31536000; includeSubDomains"),
     REFERRER_POLICY("referrerPolicy", "Referrer-Policy", "no-referrer");
 
@@ -65,7 +64,6 @@ public String getDefaultValue() {
         dh.put(CONTENT_SECURITY_POLICY_REPORT_ONLY.getKey(), CONTENT_SECURITY_POLICY_REPORT_ONLY.getDefaultValue());
         dh.put(X_CONTENT_TYPE_OPTIONS.getKey(), X_CONTENT_TYPE_OPTIONS.getDefaultValue());
         dh.put(X_ROBOTS_TAG.getKey(), X_ROBOTS_TAG.getDefaultValue());
-        dh.put(X_XSS_PROTECTION.getKey(), X_XSS_PROTECTION.getDefaultValue());
         dh.put(STRICT_TRANSPORT_SECURITY.getKey(), STRICT_TRANSPORT_SECURITY.getDefaultValue());
         dh.put(REFERRER_POLICY.getKey(), REFERRER_POLICY.getDefaultValue());
 
diff --git a/server-spi-private/src/main/java/org/keycloak/models/Constants.java b/server-spi-private/src/main/java/org/keycloak/models/Constants.java
index f108f4e256c3..917b8469d21c 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/Constants.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/Constants.java
@@ -70,6 +70,11 @@ public final class Constants {
     public static final String DEFAULT_WEBAUTHN_POLICY_RP_ENTITY_NAME = "keycloak";
     // it stands for optional parameter not specified in WebAuthn
     public static final String DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED = "not specified";
+    public static final String WEBAUTHN_POLICY_OPTION_REQUIRED = "required";
+    public static final String WEBAUTHN_POLICY_OPTION_PREFERED = "preferred";
+    public static final String WEBAUTHN_POLICY_OPTION_DISCOURAGED = "discouraged";
+    public static final String WEBAUTHN_POLICY_OPTION_YES = "Yes";
+    public static final String WEBAUTHN_POLICY_OPTION_NO = "No";
 
     // Prefix used for the realm attributes and other places
     public static final String WEBAUTHN_PASSWORDLESS_PREFIX = "Passwordless";
@@ -87,6 +92,8 @@ public final class Constants {
     public static final String KC_ACTION = "kc_action";
 
     public static final String KC_ACTION_PARAMETER = "kc_action_parameter";
+    // parameter used by some actions to skip executing it if a credential for that type already exists for the user
+    public static final String KC_ACTION_PARAMETER_SKIP_IF_EXISTS = "skip_if_exists";
     public static final String KC_ACTION_STATUS = "kc_action_status";
     public static final String KC_ACTION_EXECUTING = "kc_action_executing";
     /**
@@ -95,6 +102,8 @@ public final class Constants {
      */
     public static final String KC_ACTION_ENFORCED = "kc_action_enforced";
     public static final int KC_ACTION_MAX_AGE = 300;
+    public static final String MAX_AUTH_AGE_KEY = "max_auth_age";
+
 
     public static final String IS_AIA_REQUEST = "IS_AIA_REQUEST";
     public static final String AIA_SILENT_CANCEL = "silent_cancel";
@@ -104,6 +113,7 @@ public final class Constants {
     public static final String SKIP_LINK = "skipLink";
     public static final String TEMPLATE_ATTR_ACTION_URI = "actionUri";
     public static final String TEMPLATE_ATTR_REQUIRED_ACTIONS = "requiredActions";
+    public static final String IGNORE_ACCEPT_LANGUAGE_HEADER = "IGNORE_ACCEPT_LANGUAGE_HEADER";
 
     // Prefix for user attributes used in various "context"data maps
     public static final String USER_ATTRIBUTES_PREFIX = "user.attributes.";
@@ -186,8 +196,27 @@ public final class Constants {
     //attribute name used to mark a client as realm client
     public static final String REALM_CLIENT = "realm_client";
 
-    //attribute name used to mark a temporary admin user/service account as temporary
-    public static final String IS_TEMP_ADMIN_ATTR_NAME = "is_temporary_admin";
-
     public static final String ADMIN_PERMISSIONS_CLIENT_ID = "admin-permissions";
+
+    // Note used to store the authentication flow requested
+    public static final String REQUESTED_AUTHENTICATION_FLOW = "requested-authentication-flow";
+
+    public static final String AUTHENTICATION_FLOW_LEVEL_OF_AUTHENTICATION = "authentication-flow-level-of-authentication";
+
+    // Note used to store the acr values if it is matched by client policy condition
+    public static final String CLIENT_POLICY_REQUESTED_ACR = "client-policy-requested-acr";
+
+    //attribute name used to set clients from requested audience in standard token exchange
+    public static final String REQUESTED_AUDIENCE_CLIENTS = "req-aud-clients";
+    // claim used in refresh token to know the requested audience
+    public static final String REQUESTED_AUDIENCE = "req-aud";
+    // Note in clientSessionContext specifying token grant type used
+    public static final String GRANT_TYPE = OAuth2Constants.GRANT_TYPE;
+    // Note in client session to know the subject client
+    public static final String TOKEN_EXCHANGE_SUBJECT_CLIENT = "token_exchange_subject_client";
+
+    // Note in transient userSession specifying that it was created from "persistent" user session for the temporary purpose. The values of this note could be "online" and "offline"
+    public static final String CREATED_FROM_PERSISTENT = "created_from_persistent";
+    public static final String CREATED_FROM_PERSISTENT_ONLINE = "online";
+    public static final String CREATED_FROM_PERSISTENT_OFFLINE = "offline";
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java b/server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java
index 6072dd93d073..6ca57d1ce25b 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.models;
 
+import static org.keycloak.models.AdminRoles.IMPERSONATION;
+
 import org.keycloak.Config;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
@@ -25,8 +27,6 @@
  * @version $Revision: 1 $
  */
 public class ImpersonationConstants {
-    public static String IMPERSONATION_ROLE = "impersonation";
-
 
     public static void setupMasterRealmRole(RealmProvider model, RealmModel realm) {
         RealmModel adminRealm;
@@ -39,10 +39,10 @@ public static void setupMasterRealmRole(RealmProvider model, RealmModel realm) {
             adminRealm = model.getRealmByName(Config.getAdminRealm());
             adminRole = adminRealm.getRole(AdminRoles.ADMIN);
         }
-        ClientModel realmAdminApp = adminRealm.getClientByClientId(KeycloakModelUtils.getMasterRealmAdminApplicationClientId(realm.getName()));
-        if (realmAdminApp.getRole(IMPERSONATION_ROLE) != null) return;
-        RoleModel impersonationRole = realmAdminApp.addRole(IMPERSONATION_ROLE);
-        impersonationRole.setDescription("${role_" + IMPERSONATION_ROLE + "}");
+        ClientModel realmAdminApp = adminRealm.getClientByClientId(KeycloakModelUtils.getMasterRealmAdminManagementClientId(realm.getName()));
+        if (realmAdminApp.getRole(IMPERSONATION) != null) return;
+        RoleModel impersonationRole = realmAdminApp.addRole(IMPERSONATION);
+        impersonationRole.setDescription("${role_" + IMPERSONATION + "}");
         adminRole.addCompositeRole(impersonationRole);
     }
 
@@ -50,9 +50,9 @@ public static void setupRealmRole(RealmModel realm) {
         if (realm.getName().equals(Config.getAdminRealm())) { return; } // don't need to do this for master realm
         String realmAdminApplicationClientId = Constants.REALM_MANAGEMENT_CLIENT_ID;
         ClientModel realmAdminApp = realm.getClientByClientId(realmAdminApplicationClientId);
-        if (realmAdminApp.getRole(IMPERSONATION_ROLE) != null) return;
-        RoleModel impersonationRole = realmAdminApp.addRole(IMPERSONATION_ROLE);
-        impersonationRole.setDescription("${role_" + IMPERSONATION_ROLE + "}");
+        if (realmAdminApp.getRole(IMPERSONATION) != null) return;
+        RoleModel impersonationRole = realmAdminApp.addRole(IMPERSONATION);
+        impersonationRole.setDescription("${role_" + IMPERSONATION + "}");
         RoleModel adminRole = realmAdminApp.getRole(AdminRoles.REALM_ADMIN);
         adminRole.addCompositeRole(impersonationRole);
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java b/server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java
index 075a1d232daa..3fd7ccfc5d6e 100644
--- a/server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java
@@ -48,6 +48,7 @@ public class LDAPConstants {
     public static final String CONNECTION_URL = "connectionUrl";
     public static final String BASE_DN = "baseDn"; // used for tests only
     public static final String USERS_DN = "usersDn";
+    public static final String RELATIVE_CREATE_DN = "relativeCreateDn";
     public static final String BIND_DN = "bindDn";
     public static final String BIND_CREDENTIAL = "bindCredential";
 
@@ -119,6 +120,7 @@ public class LDAPConstants {
     public static final String GROUP_OF_UNIQUE_NAMES = "groupOfUniqueNames";
     public static final String USER_ACCOUNT_CONTROL = "userAccountControl";
     public static final String PWD_LAST_SET = "pwdLastSet";
+    public static final String PWD_CHANGED_TIME = "pwdChangedTime";
     public static final String MSDS_USER_ACCOUNT_DISABLED = "msDS-UserAccountDisabled";
     public static final String MSDS_USER_PASSWORD_NOTREQD = "msDS-UserPasswordNotRequired";
     public static final String MSDS_USER_PASSWORD_EXPIRED = "msDS-UserPasswordExpired"; // read-only
diff --git a/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyPasswordlessDefaults.java b/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyPasswordlessDefaults.java
new file mode 100644
index 000000000000..4e359b1ab77b
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyPasswordlessDefaults.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models;
+
+/**
+ * Default values for the WebAuthn configuration when used as passwordless.
+ *
+ * @author rmartinc
+ */
+public class WebAuthnPolicyPasswordlessDefaults extends WebAuthnPolicyTwoFactorDefaults {
+
+    public static WebAuthnPolicy get() {
+        return new WebAuthnPolicyPasswordlessDefaults();
+    }
+
+    WebAuthnPolicyPasswordlessDefaults() {
+        super();
+        this.requireResidentKey = Constants.WEBAUTHN_POLICY_OPTION_YES;
+        this.userVerificationRequirement = Constants.WEBAUTHN_POLICY_OPTION_REQUIRED;
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyTwoFactorDefaults.java b/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyTwoFactorDefaults.java
new file mode 100644
index 000000000000..fa8bbe07baf5
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/models/WebAuthnPolicyTwoFactorDefaults.java
@@ -0,0 +1,113 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models;
+
+import java.util.Collections;
+import java.util.List;
+import org.keycloak.storage.ReadOnlyException;
+
+/**
+ * Default values for the WebAuthn configuration when used as Two Factor.
+ *
+ * @author rmartinc
+ */
+public class WebAuthnPolicyTwoFactorDefaults extends WebAuthnPolicy {
+
+    public static WebAuthnPolicy get() {
+        return new WebAuthnPolicyTwoFactorDefaults();
+    }
+
+    WebAuthnPolicyTwoFactorDefaults() {
+        this.rpEntityName = Constants.DEFAULT_WEBAUTHN_POLICY_RP_ENTITY_NAME;
+        this.signatureAlgorithms = List.of(Constants.DEFAULT_WEBAUTHN_POLICY_SIGNATURE_ALGORITHMS.split(","));
+        this.rpId = "";
+        this.attestationConveyancePreference = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        this.authenticatorAttachment = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        this.requireResidentKey = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        this.userVerificationRequirement = Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+        this.createTimeout = 0;
+        this.avoidSameAuthenticatorRegister = false;
+        this.acceptableAaguids = Collections.emptyList();
+        this.extraOrigins = Collections.emptyList();
+        this.passkeysEnabled = null;
+    }
+
+    @Override
+    public void setRpEntityName(String rpEntityName) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setSignatureAlgorithm(List<String> signatureAlgorithms) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setRpId(String rpId) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setAttestationConveyancePreference(String attestationConveyancePreference) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setAuthenticatorAttachment(String authenticatorAttachment) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setRequireResidentKey(String requireResidentKey) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setUserVerificationRequirement(String userVerificationRequirement) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setCreateTimeout(int createTimeout) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setAvoidSameAuthenticatorRegister(boolean avoidSameAuthenticatorRegister) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setAcceptableAaguids(List<String> acceptableAaguids) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setExtraOrigins(List<String> extraOrigins) {
+        throwReadOnlyException();
+    }
+
+    @Override
+    public void setPasskeysEnabled(Boolean passkeysEnabled) {
+        throwReadOnlyException();
+    }
+
+    private void throwReadOnlyException() {
+        throw new ReadOnlyException("Default WebAuthnPolicy!");
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/models/oid4vci/CredentialScopeModel.java b/server-spi-private/src/main/java/org/keycloak/models/oid4vci/CredentialScopeModel.java
new file mode 100644
index 000000000000..1dd68ce56974
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/models/oid4vci/CredentialScopeModel.java
@@ -0,0 +1,489 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.models.oid4vci;
+
+import org.keycloak.constants.Oid4VciConstants;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Stream;
+
+import static org.keycloak.constants.Oid4VciConstants.OID4VC_PROTOCOL;
+
+/**
+ * This class acts as delegate for a {@link ClientScopeModel} implementation and adds additional functionality for
+ * OpenId4VC credentials
+ *
+ * @author Pascal Knüppel
+ */
+public class CredentialScopeModel implements ClientScopeModel {
+
+
+    public static final String SD_JWT_VISIBLE_CLAIMS_DEFAULT = "id,iat,nbf,exp,jti";
+    public static final int SD_JWT_DECOYS_DEFAULT = 10;
+    public static final String FORMAT_DEFAULT = "vc+sd-jwt";
+    public static final String HASH_ALGORITHM_DEFAULT = "SHA-256";
+    public static final String TOKEN_TYPE_DEFAULT = "JWS";
+    public static final int EXPIRY_IN_SECONDS_DEFAULT = 31536000;
+    public static final String CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT = "jwk";
+
+    /**
+     * the credential configuration id as provided in the metadata endpoint
+     */
+    public static final String ISSUER_DID = "vc.issuer_did";
+    public static final String CONFIGURATION_ID = "vc.credential_configuration_id";
+    public static final String CREDENTIAL_IDENTIFIER = "vc.credential_identifier";
+    public static final String FORMAT = "vc.format";
+    public static final String EXPIRY_IN_SECONDS = "vc.expiry_in_seconds";
+    public static final String VCT = "vc.verifiable_credential_type";
+
+    /**
+     * the value that is added into the "types"-attribute of a verifiable credential
+     */
+    public static final String TYPES = "vc.supported_credential_types";
+
+    /**
+     * the value that is entered into the "@contexts"-attribute of a verifiable credential
+     */
+    public static final String CONTEXTS = "vc.credential_contexts";
+
+    /**
+     * if the credential is only meant for specific signing algorithms the global default list can be overridden here.
+     * The global default list is retrieved from the available keys in the realm.
+     */
+    public static final String SIGNING_ALG_VALUES_SUPPORTED = "vc.proof_signing_alg_values_supported";
+
+    /**
+     * if the credential is only meant for specific cryptographic binding algorithms the global default list can be
+     * overridden here. The global default list is retrieved from the available keys in the realm.
+     */
+    public static final String CRYPTOGRAPHIC_BINDING_METHODS = "vc.cryptographic_binding_methods_supported";
+
+    /**
+     * an optional configuration that can be used to select a specific key for signing the credential
+     */
+    public static final String SIGNING_KEY_ID = "vc.signing_key_id";
+
+    /**
+     * an optional attribute for the metadata endpoint
+     */
+    public static final String VC_DISPLAY = "vc.display";
+
+    /**
+     * this attribute holds a customizable value for the number of decoys to use in a SD-JWT credential
+     */
+    public static final String SD_JWT_NUMBER_OF_DECOYS = "vc.sd_jwt.number_of_decoys";
+
+    /**
+     * an optional attribute that tells us which attributes should be added into the SD-JWT body.
+     */
+    public static final String SD_JWT_VISIBLE_CLAIMS = "vc.credential_build_config.sd_jwt.visible_claims";
+
+    /**
+     * an optional configuration that can be used to select a specific hash algorithm
+     */
+    public static final String HASH_ALGORITHM = "vc.credential_build_config.hash_algorithm";
+
+    /**
+     * this attribute holds the 'typ' value that will be added into the JWS header of the credential.
+     */
+    public static final String TOKEN_JWS_TYPE = "vc.credential_build_config.token_jws_type";
+
+    /**
+     * this configuration property can be used to enforce specific claims to be included in the metadata, if they
+     * would normally not and vice versa
+     */
+    public static final String INCLUDE_IN_METADATA = "vc.include_in_metadata";
+
+
+    /**
+     * the actual object that is represented by this scope
+     */
+    private final ClientScopeModel clientScope;
+
+    public CredentialScopeModel(ClientScopeModel clientScope) {
+        this.clientScope = clientScope;
+        assert OID4VC_PROTOCOL.equals(clientScope.getProtocol());
+    }
+
+    public String getIssuerDid() {
+        return clientScope.getAttribute(ISSUER_DID);
+    }
+
+    public void setIssuerDid(String issuerDid) {
+        clientScope.setAttribute(ISSUER_DID, issuerDid);
+    }
+
+    public String getScope() {
+        return clientScope.getName();
+    }
+
+    public String getCredentialConfigurationId() {
+        return Optional.ofNullable(clientScope.getAttribute(CONFIGURATION_ID)).orElse(getName());
+    }
+
+    public void setCredentialConfigurationId(String credentialConfigurationId) {
+        clientScope.setAttribute(CONFIGURATION_ID, Optional.ofNullable(credentialConfigurationId).orElse(getName()));
+    }
+
+    public String getCredentialIdentifier() {
+        return Optional.ofNullable(clientScope.getAttribute(CREDENTIAL_IDENTIFIER)).orElse(getName());
+    }
+
+    public void setCredentialIdentifier(String credentialIdentifier) {
+        clientScope.setAttribute(CREDENTIAL_IDENTIFIER, Optional.ofNullable(credentialIdentifier).orElse(getName()));
+    }
+
+    public String getFormat() {
+        return Optional.ofNullable(clientScope.getAttribute(FORMAT)).orElse(FORMAT_DEFAULT);
+    }
+
+    public void setFormat(String credentialFormat) {
+        clientScope.setAttribute(FORMAT, Optional.ofNullable(credentialFormat).orElse(FORMAT_DEFAULT));
+    }
+
+    public Integer getExpiryInSeconds() {
+        return Optional.ofNullable(clientScope.getAttribute(EXPIRY_IN_SECONDS)).map(Integer::parseInt)
+                       .orElse(EXPIRY_IN_SECONDS_DEFAULT);
+    }
+
+    public void setExpiryInSeconds(Integer expiryInSeconds) {
+        clientScope.setAttribute(EXPIRY_IN_SECONDS,
+                                 Optional.ofNullable(expiryInSeconds).map(String::valueOf)
+                                         .orElse(String.valueOf(EXPIRY_IN_SECONDS_DEFAULT)));
+    }
+
+    public int getSdJwtNumberOfDecoys() {
+        return Optional.ofNullable(clientScope.getAttribute(SD_JWT_NUMBER_OF_DECOYS)).map(Integer::parseInt)
+                       .orElse(SD_JWT_DECOYS_DEFAULT);
+    }
+
+    public void setSdJwtNumberOfDecoys(Integer sdJwtNumberOfDecoys) {
+        clientScope.setAttribute(SD_JWT_NUMBER_OF_DECOYS,
+                                 Optional.ofNullable(sdJwtNumberOfDecoys).map(String::valueOf)
+                                         .orElse(String.valueOf(SD_JWT_DECOYS_DEFAULT)));
+    }
+
+    public String getVct() {
+        return Optional.ofNullable(clientScope.getAttribute(VCT)).orElse(getName());
+    }
+
+    public void setVct(String vct) {
+        clientScope.setAttribute(VCT, Optional.ofNullable(vct).orElse(getName()));
+    }
+
+    public String getTokenJwsType() {
+        return Optional.ofNullable(clientScope.getAttribute(TOKEN_JWS_TYPE)).orElse(TOKEN_TYPE_DEFAULT);
+    }
+
+    public void setTokenJwsType(String tokenJwsType) {
+        clientScope.setAttribute(TOKEN_JWS_TYPE, Optional.ofNullable(tokenJwsType).orElse(TOKEN_TYPE_DEFAULT));
+    }
+
+    public String getSigningKeyId() {
+        return clientScope.getAttribute(SIGNING_KEY_ID);
+    }
+
+    public void setSigningKeyId(String signingKeyId) {
+        clientScope.setAttribute(SIGNING_KEY_ID, signingKeyId);
+    }
+
+    public String getHashAlgorithm() {
+        return Optional.ofNullable(clientScope.getAttribute(HASH_ALGORITHM)).orElse(HASH_ALGORITHM_DEFAULT);
+    }
+
+    public void setHashAlgorithm(String hashAlgorithm) {
+        clientScope.setAttribute(HASH_ALGORITHM, hashAlgorithm);
+    }
+
+    public List<String> getSupportedCredentialTypes() {
+        return Optional.ofNullable(clientScope.getAttribute(TYPES))
+                       .map(s -> s.split(","))
+                       .map(Arrays::asList)
+                       .orElse(Collections.singletonList(getName()));
+    }
+
+    public void setSupportedCredentialTypes(String supportedCredentialTypes) {
+        clientScope.setAttribute(TYPES, Optional.ofNullable(supportedCredentialTypes).orElse(getName()));
+    }
+
+    public void setSupportedCredentialTypes(List<String> supportedCredentialTypes) {
+        clientScope.setAttribute(TYPES, String.join(",", supportedCredentialTypes));
+    }
+
+    public List<String> getVcContexts() {
+        return Optional.ofNullable(clientScope.getAttribute(CONTEXTS))
+                       .map(s -> s.split(","))
+                       .map(Arrays::asList)
+                       .orElse(Collections.singletonList(getName()));
+    }
+
+    public void setVcContexts(String vcContexts) {
+        clientScope.setAttribute(CONTEXTS, Optional.ofNullable(vcContexts).orElse(getName()));
+    }
+
+    public void setVcContexts(List<String> vcContexts) {
+        clientScope.setAttribute(CONTEXTS, String.join(",", vcContexts));
+    }
+
+    public List<String> getSigningAlgsSupported() {
+        return Optional.ofNullable(clientScope.getAttribute(SIGNING_ALG_VALUES_SUPPORTED))
+                       .map(s -> s.split(","))
+                       .map(Arrays::asList)
+                       .orElse(Collections.emptyList());
+    }
+
+    public void setSigningAlgsSupported(String signingAlgsSupported) {
+        clientScope.setAttribute(SIGNING_ALG_VALUES_SUPPORTED, signingAlgsSupported);
+    }
+
+    public void setSigningAlgsSupported(List<String> signingAlgsSupported) {
+        clientScope.setAttribute(SIGNING_ALG_VALUES_SUPPORTED,
+                                 String.join(",", signingAlgsSupported));
+    }
+
+    public List<String> getCryptographicBindingMethods() {
+        return Optional.ofNullable(clientScope.getAttribute(CRYPTOGRAPHIC_BINDING_METHODS))
+                       .map(s -> s.split(","))
+                       .map(Arrays::asList)
+                       .orElse(Collections.emptyList());
+    }
+
+    public void setCryptographicBindingMethods(String cryptographicBindingMethods) {
+        clientScope.setAttribute(CRYPTOGRAPHIC_BINDING_METHODS, cryptographicBindingMethods);
+    }
+
+    public void setCryptographicBindingMethods(List<String> cryptographicBindingMethods) {
+        clientScope.setAttribute(CRYPTOGRAPHIC_BINDING_METHODS,
+                                 String.join(",", cryptographicBindingMethods));
+    }
+
+    public List<String> getSdJwtVisibleClaims() {
+        return Optional.ofNullable(clientScope.getAttribute(SD_JWT_VISIBLE_CLAIMS))
+                       .map(s -> s.split(","))
+                       .map(Arrays::asList)
+                       .orElse(List.of(SD_JWT_VISIBLE_CLAIMS_DEFAULT.split(",")));
+    }
+
+    public void setSdJwtVisibleClaims(String sdJwtVisibleClaims) {
+        clientScope.setAttribute(SD_JWT_VISIBLE_CLAIMS, Optional.ofNullable(sdJwtVisibleClaims)
+                                                                .orElse(SD_JWT_VISIBLE_CLAIMS_DEFAULT));
+    }
+
+    public void setSdJwtVisibleClaims(List<String> sdJwtVisibleClaims) {
+        clientScope.setAttribute(SD_JWT_VISIBLE_CLAIMS,
+                                 String.join(",", sdJwtVisibleClaims));
+    }
+
+    public String getVcDisplay() {
+        return clientScope.getAttribute(VC_DISPLAY);
+    }
+
+    public void setVcDisplay(String vcDisplay) {
+        clientScope.setAttribute(VC_DISPLAY, vcDisplay);
+    }
+
+    @Override
+    public String getId() {
+        return clientScope.getId();
+    }
+
+    @Override
+    public String getName() {
+        return clientScope.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        clientScope.setName(name);
+    }
+
+    @Override
+    public RealmModel getRealm() {
+        return clientScope.getRealm();
+    }
+
+    @Override
+    public String getDescription() {
+        return clientScope.getDescription();
+    }
+
+    @Override
+    public void setDescription(String description) {
+        clientScope.setDescription(description);
+    }
+
+    @Override
+    public String getProtocol() {
+        return clientScope.getProtocol();
+    }
+
+    @Override
+    public void setProtocol(String protocol) {
+        clientScope.setProtocol(protocol);
+    }
+
+    @Override
+    public void setAttribute(String name, String value) {
+        clientScope.setAttribute(name, value);
+    }
+
+    @Override
+    public void removeAttribute(String name) {
+        clientScope.removeAttribute(name);
+    }
+
+    @Override
+    public String getAttribute(String name) {
+        return clientScope.getAttribute(name);
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+        return clientScope.getAttributes();
+    }
+
+    @Override
+    public boolean isDisplayOnConsentScreen() {
+        return clientScope.isDisplayOnConsentScreen();
+    }
+
+    @Override
+    public void setDisplayOnConsentScreen(boolean displayOnConsentScreen) {
+        clientScope.setDisplayOnConsentScreen(displayOnConsentScreen);
+    }
+
+    @Override
+    public String getConsentScreenText() {
+        return clientScope.getConsentScreenText();
+    }
+
+    @Override
+    public void setConsentScreenText(String consentScreenText) {
+        clientScope.setConsentScreenText(consentScreenText);
+    }
+
+    @Override
+    public String getGuiOrder() {
+        return clientScope.getGuiOrder();
+    }
+
+    @Override
+    public void setGuiOrder(String guiOrder) {
+        clientScope.setGuiOrder(guiOrder);
+    }
+
+    @Override
+    public boolean isIncludeInTokenScope() {
+        return clientScope.isIncludeInTokenScope();
+    }
+
+    @Override
+    public void setIncludeInTokenScope(boolean includeInTokenScope) {
+        clientScope.setIncludeInTokenScope(includeInTokenScope);
+    }
+
+    @Override
+    public boolean isDynamicScope() {
+        return clientScope.isDynamicScope();
+    }
+
+    @Override
+    public void setIsDynamicScope(boolean isDynamicScope) {
+        clientScope.setIsDynamicScope(isDynamicScope);
+    }
+
+    @Override
+    public String getDynamicScopeRegexp() {
+        return clientScope.getDynamicScopeRegexp();
+    }
+
+    public Stream<Oid4vcProtocolMapperModel> getOid4vcProtocolMappersStream() {
+        return clientScope.getProtocolMappersStream().filter(pm -> {
+            return Oid4VciConstants.OID4VC_PROTOCOL.equals(pm.getProtocol());
+        }).map(Oid4vcProtocolMapperModel::new);
+    }
+
+    @Override
+    public Stream<ProtocolMapperModel> getProtocolMappersStream() {
+        return clientScope.getProtocolMappersStream();
+    }
+
+    @Override
+    public ProtocolMapperModel addProtocolMapper(ProtocolMapperModel model) {
+        return clientScope.addProtocolMapper(model);
+    }
+
+    @Override
+    public void removeProtocolMapper(ProtocolMapperModel mapping) {
+        clientScope.removeProtocolMapper(mapping);
+    }
+
+    @Override
+    public void updateProtocolMapper(ProtocolMapperModel mapping) {
+        clientScope.updateProtocolMapper(mapping);
+    }
+
+    @Override
+    public ProtocolMapperModel getProtocolMapperById(String id) {
+        return clientScope.getProtocolMapperById(id);
+    }
+
+    @Override
+    public ProtocolMapperModel getProtocolMapperByName(String protocol, String name) {
+        return clientScope.getProtocolMapperByName(protocol, name);
+    }
+
+    @Override
+    public Stream<RoleModel> getScopeMappingsStream() {
+        return clientScope.getScopeMappingsStream();
+    }
+
+    @Override
+    public Stream<RoleModel> getRealmScopeMappingsStream() {
+        return clientScope.getRealmScopeMappingsStream();
+    }
+
+    @Override
+    public void addScopeMapping(RoleModel role) {
+        clientScope.addScopeMapping(role);
+    }
+
+    @Override
+    public void deleteScopeMapping(RoleModel role) {
+        clientScope.deleteScopeMapping(role);
+    }
+
+    @Override
+    public boolean hasDirectScope(RoleModel role) {
+        return clientScope.hasDirectScope(role);
+    }
+
+    @Override
+    public boolean hasScope(RoleModel role) {
+        return clientScope.hasScope(role);
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/models/oid4vci/Oid4vcProtocolMapperModel.java b/server-spi-private/src/main/java/org/keycloak/models/oid4vci/Oid4vcProtocolMapperModel.java
new file mode 100644
index 000000000000..9062427fb07e
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/models/oid4vci/Oid4vcProtocolMapperModel.java
@@ -0,0 +1,148 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.models.oid4vci;
+
+import org.keycloak.models.ProtocolMapperModel;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * This class acts as delegate for a {@link ProtocolMapperModel} implementation and adds additional functionality for
+ * OpenId4VC credentials
+ *
+ * @author Pascal Knüppel
+ */
+public class Oid4vcProtocolMapperModel extends ProtocolMapperModel {
+
+    public static final String PATH = "claim.name"; // TODO discuss if we can rename this.
+                                                         //      Renaming it would break existing installations
+    public static final String MANDATORY = "vc.mandatory";
+    public static final String DISPLAY = "vc.display";
+
+    private final ProtocolMapperModel protocolMapper;
+
+    public Oid4vcProtocolMapperModel(ProtocolMapperModel protocolMapper) {
+        this.protocolMapper = protocolMapper;
+    }
+
+    /**
+     * @return the path of the attribute where it can be extracted
+     */
+    public List<String> getPath()
+    {
+        return Optional.ofNullable(protocolMapper.getConfig().get(PATH))
+                       .map(s -> s.split("\\."))
+                       .map(Arrays::asList)
+                       .orElse(Collections.emptyList());
+    }
+
+    public void setPath(List<String> path) {
+        protocolMapper.getConfig().put(PATH, Optional.ofNullable(path)
+                                                     .map(l -> String.join(".", l))
+                                                     .orElse(null));
+    }
+
+    public boolean isMandatory()
+    {
+        return Optional.ofNullable(protocolMapper.getConfig().get(MANDATORY)).map(Boolean::valueOf).orElse(false);
+    }
+
+    public void setMandatory(Boolean mandatory)
+    {
+        if (mandatory == null) {
+            protocolMapper.getConfig().remove(MANDATORY);
+        }else {
+            protocolMapper.getConfig().put(MANDATORY, String.valueOf(mandatory));
+        }
+    }
+
+    public String getDisplay()
+    {
+        return protocolMapper.getConfig().get(DISPLAY);
+    }
+
+    public void setDisplay(String display)
+    {
+        protocolMapper.getConfig().put(DISPLAY, display);
+    }
+
+    @Override
+    public String getId() {
+        return protocolMapper.getId();
+    }
+
+    @Override
+    public void setId(String id) {
+        protocolMapper.setId(id);
+    }
+
+    @Override
+    public String getName() {
+        return protocolMapper.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        protocolMapper.setName(name);
+    }
+
+    @Override
+    public String getProtocol() {
+        return protocolMapper.getProtocol();
+    }
+
+    @Override
+    public void setProtocol(String protocol) {
+        protocolMapper.setProtocol(protocol);
+    }
+
+    @Override
+    public String getProtocolMapper() {
+        return protocolMapper.getProtocolMapper();
+    }
+
+    @Override
+    public void setProtocolMapper(String protocolMapper) {
+        this.protocolMapper.setProtocolMapper(protocolMapper);
+    }
+
+    @Override
+    public Map<String, String> getConfig() {
+        return protocolMapper.getConfig();
+    }
+
+    @Override
+    public void setConfig(Map<String, String> config) {
+        protocolMapper.setConfig(config);
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        return protocolMapper.equals(obj);
+    }
+
+    @Override
+    public int hashCode() {
+        return protocolMapper.hashCode();
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/AuthenticationFlowResolver.java b/server-spi-private/src/main/java/org/keycloak/models/utils/AuthenticationFlowResolver.java
index 3caa54c3ae44..446ffb65c9d7 100644
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/AuthenticationFlowResolver.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/AuthenticationFlowResolver.java
@@ -20,6 +20,8 @@
 import org.keycloak.models.AuthenticationFlowBindings;
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.ModelException;
 import org.keycloak.sessions.AuthenticationSessionModel;
 
 /**
@@ -33,6 +35,19 @@ public class AuthenticationFlowResolver {
     public static AuthenticationFlowModel resolveBrowserFlow(AuthenticationSessionModel authSession) {
         AuthenticationFlowModel flow = null;
         ClientModel client = authSession.getClient();
+
+        // check if specific flow has been requested
+        String requestedFlowAlias = authSession.getAuthNote(Constants.REQUESTED_AUTHENTICATION_FLOW);
+        if (requestedFlowAlias != null){
+            flow = authSession.getRealm().getFlowByAlias(requestedFlowAlias);
+            // validate flow exists
+            if (flow == null){
+                throw new ModelException("Client " + client.getClientId() + " has requested browser flow " + requestedFlowAlias + ", but this flow does not exist.");
+            } else {
+                return flow;
+            }
+        }
+
         String clientFlow = client.getAuthenticationFlowBindingOverride(AuthenticationFlowBindings.BROWSER_BINDING);
         if (clientFlow != null) {
             flow = authSession.getRealm().getAuthenticationFlowById(clientFlow);
@@ -47,6 +62,19 @@ public static AuthenticationFlowModel resolveBrowserFlow(AuthenticationSessionMo
     public static AuthenticationFlowModel resolveDirectGrantFlow(AuthenticationSessionModel authSession) {
         AuthenticationFlowModel flow = null;
         ClientModel client = authSession.getClient();
+
+        // check if specific flow has been requested
+        String requestedFlowAlias = authSession.getAuthNote(Constants.REQUESTED_AUTHENTICATION_FLOW);
+        if (requestedFlowAlias != null){
+            flow = authSession.getRealm().getFlowByAlias(requestedFlowAlias);
+            // validate flow exists
+            if (flow == null){
+                throw new ModelException("Client " + client.getClientId() + " has requested browser flow " + requestedFlowAlias + ", but this flow does not exist.");
+            } else {
+                return flow;
+            }
+        }
+
         String clientFlow = client.getAuthenticationFlowBindingOverride(AuthenticationFlowBindings.DIRECT_GRANT_BINDING);
         if (clientFlow != null) {
             flow = authSession.getRealm().getAuthenticationFlowById(clientFlow);
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
index e216f530d0b6..dc9d60647a85 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
@@ -351,8 +351,8 @@ public static void browserFlow(RealmModel realm, boolean migrate) {
         AuthenticationFlowModel conditionalOTP = new AuthenticationFlowModel();
         conditionalOTP.setTopLevel(false);
         conditionalOTP.setBuiltIn(true);
-        conditionalOTP.setAlias("Browser - Conditional OTP");
-        conditionalOTP.setDescription("Flow to determine if the OTP is required for the authentication");
+        conditionalOTP.setAlias("Browser - Conditional 2FA");
+        conditionalOTP.setDescription("Flow to determine if any 2FA is required for the authentication");
         conditionalOTP.setProviderId("basic-flow");
         conditionalOTP = realm.addAuthenticationFlow(conditionalOTP);
         execution = new AuthenticationExecutionModel();
@@ -377,12 +377,37 @@ public static void browserFlow(RealmModel realm, boolean migrate) {
         // otp processing
         execution = new AuthenticationExecutionModel();
         execution.setParentFlow(conditionalOTP.getId());
-        execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
+        execution.setRequirement(AuthenticationExecutionModel.Requirement.ALTERNATIVE);
+        if (migrate && hasCredentialType(realm, RequiredCredentialModel.TOTP.getType())) {
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
+        }
         execution.setAuthenticator("auth-otp-form");
         execution.setPriority(20);
         execution.setAuthenticatorFlow(false);
         realm.addAuthenticatorExecution(execution);
 
+        // webauthn as disabled
+        if (Profile.isFeatureEnabled(Profile.Feature.WEB_AUTHN)) {
+            execution = new AuthenticationExecutionModel();
+            execution.setParentFlow(conditionalOTP.getId());
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED);
+            execution.setAuthenticator("webauthn-authenticator");
+            execution.setPriority(30);
+            execution.setAuthenticatorFlow(false);
+            realm.addAuthenticatorExecution(execution);
+        }
+
+        // recovery-codes as disabled
+        if (Profile.isFeatureEnabled(Profile.Feature.RECOVERY_CODES)) {
+            execution = new AuthenticationExecutionModel();
+            execution.setParentFlow(conditionalOTP.getId());
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED);
+            execution.setAuthenticator("auth-recovery-authn-code-form");
+            execution.setPriority(40);
+            execution.setAuthenticatorFlow(false);
+            realm.addAuthenticatorExecution(execution);
+        }
+
         addOrganizationBrowserFlowStep(realm, browser);
     }
 
@@ -597,8 +622,8 @@ public static void firstBrokerLoginFlow(RealmModel realm, boolean migrate) {
         AuthenticationFlowModel conditionalOTP = new AuthenticationFlowModel();
         conditionalOTP.setTopLevel(false);
         conditionalOTP.setBuiltIn(true);
-        conditionalOTP.setAlias("First broker login - Conditional OTP");
-        conditionalOTP.setDescription("Flow to determine if the OTP is required for the authentication");
+        conditionalOTP.setAlias("First broker login - Conditional 2FA");
+        conditionalOTP.setDescription("Flow to determine if any 2FA is required for the authentication");
         conditionalOTP.setProviderId("basic-flow");
         conditionalOTP = realm.addAuthenticationFlow(conditionalOTP);
         execution = new AuthenticationExecutionModel();
@@ -638,12 +663,37 @@ public static void firstBrokerLoginFlow(RealmModel realm, boolean migrate) {
 
         execution = new AuthenticationExecutionModel();
         execution.setParentFlow(conditionalOTP.getId());
-        execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
+        execution.setRequirement(AuthenticationExecutionModel.Requirement.ALTERNATIVE);
+        if (migrate && hasCredentialType(realm, RequiredCredentialModel.TOTP.getType())) {
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
+        }
         execution.setAuthenticator("auth-otp-form");
         execution.setPriority(20);
         execution.setAuthenticatorFlow(false);
         realm.addAuthenticatorExecution(execution);
 
+        // webauthn as disabled
+        if (Profile.isFeatureEnabled(Profile.Feature.WEB_AUTHN)) {
+            execution = new AuthenticationExecutionModel();
+            execution.setParentFlow(conditionalOTP.getId());
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED);
+            execution.setAuthenticator("webauthn-authenticator");
+            execution.setPriority(30);
+            execution.setAuthenticatorFlow(false);
+            realm.addAuthenticatorExecution(execution);
+        }
+
+        // recovery-codes as disabled
+        if (Profile.isFeatureEnabled(Profile.Feature.RECOVERY_CODES)) {
+            execution = new AuthenticationExecutionModel();
+            execution.setParentFlow(conditionalOTP.getId());
+            execution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED);
+            execution.setAuthenticator("auth-recovery-authn-code-form");
+            execution.setPriority(40);
+            execution.setAuthenticatorFlow(false);
+            realm.addAuthenticatorExecution(execution);
+        }
+
         addOrganizationFirstBrokerFlowStep(realm, firstBrokerLogin);
     }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
index eb12522bb4c6..a1ccd53a5489 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
@@ -83,7 +83,8 @@ public enum Action {
         CONFIGURE_RECOVERY_AUTHN_CODES(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name(), DefaultRequiredActions::addRecoveryAuthnCodesAction, () -> isFeatureEnabled(Profile.Feature.RECOVERY_CODES)),
         WEBAUTHN_REGISTER("webauthn-register", DefaultRequiredActions::addWebAuthnRegisterAction, () -> isFeatureEnabled(Profile.Feature.WEB_AUTHN)),
         WEBAUTHN_PASSWORDLESS_REGISTER("webauthn-register-passwordless", DefaultRequiredActions::addWebAuthnPasswordlessRegisterAction, () -> isFeatureEnabled(Profile.Feature.WEB_AUTHN)),
-        VERIFY_USER_PROFILE(UserModel.RequiredAction.VERIFY_PROFILE.name(), DefaultRequiredActions::addVerifyProfile);
+        VERIFY_USER_PROFILE(UserModel.RequiredAction.VERIFY_PROFILE.name(), DefaultRequiredActions::addVerifyProfile),
+        IDP_LINK_ACCOUNT("idp_link", DefaultRequiredActions::addIdpLink);
 
         private final String alias;
         private final Consumer<RealmModel> addAction;
@@ -186,14 +187,14 @@ public static void addTermsAndConditionsAction(RealmModel realm) {
 
     public static void addVerifyProfile(RealmModel realm) {
         if (realm.getRequiredActionProviderByAlias(UserModel.RequiredAction.VERIFY_PROFILE.name()) == null) {
-            RequiredActionProviderModel termsAndConditions = new RequiredActionProviderModel();
-            termsAndConditions.setEnabled(true);
-            termsAndConditions.setAlias(UserModel.RequiredAction.VERIFY_PROFILE.name());
-            termsAndConditions.setName("Verify Profile");
-            termsAndConditions.setProviderId(UserModel.RequiredAction.VERIFY_PROFILE.name());
-            termsAndConditions.setDefaultAction(false);
-            termsAndConditions.setPriority(90);
-            realm.addRequiredActionProvider(termsAndConditions);
+            RequiredActionProviderModel verifyProfile = new RequiredActionProviderModel();
+            verifyProfile.setEnabled(true);
+            verifyProfile.setAlias(UserModel.RequiredAction.VERIFY_PROFILE.name());
+            verifyProfile.setName("Verify Profile");
+            verifyProfile.setProviderId(UserModel.RequiredAction.VERIFY_PROFILE.name());
+            verifyProfile.setDefaultAction(false);
+            verifyProfile.setPriority(100);
+            realm.addRequiredActionProvider(verifyProfile);
         }
     }
 
@@ -218,10 +219,23 @@ public static void addDeleteCredentialAction(RealmModel realm) {
             deleteCredential.setName("Delete Credential");
             deleteCredential.setProviderId("delete_credential");
             deleteCredential.setDefaultAction(false);
-            deleteCredential.setPriority(100);
+            deleteCredential.setPriority(110);
             realm.addRequiredActionProvider(deleteCredential);
         }
     }
+    
+    public static void addIdpLink(RealmModel realm) {
+        if (realm.getRequiredActionProviderByAlias("idp_link") == null) {
+            RequiredActionProviderModel idpLink = new RequiredActionProviderModel();
+            idpLink.setEnabled(true);
+            idpLink.setAlias("idp_link");
+            idpLink.setName("Linking Identity Provider");
+            idpLink.setProviderId("idp_link");
+            idpLink.setDefaultAction(false);
+            idpLink.setPriority(120);
+            realm.addRequiredActionProvider(idpLink);
+        }
+    }
 
     public static void addUpdateLocaleAction(RealmModel realm) {
         if (realm.getRequiredActionProviderByAlias("update_user_locale") == null) {
@@ -247,7 +261,7 @@ public static void addUpdateEmailAction(RealmModel realm) {
 
         if (!isRequiredActionActive) {
             RequiredActionProviderModel updateEmail = new RequiredActionProviderModel();
-            updateEmail.setEnabled(true);
+            updateEmail.setEnabled(false);
             updateEmail.setAlias(PROVIDER_ID);
             updateEmail.setName("Update Email");
             updateEmail.setProviderId(PROVIDER_ID);
@@ -273,7 +287,7 @@ public static void addRecoveryAuthnCodesAction(RealmModel realm) {
             recoveryCodes.setName("Recovery Authentication Codes");
             recoveryCodes.setProviderId(PROVIDER_ID);
             recoveryCodes.setDefaultAction(false);
-            recoveryCodes.setPriority(70);
+            recoveryCodes.setPriority(130);
             realm.addRequiredActionProvider(recoveryCodes);
         }
     }
@@ -294,7 +308,7 @@ public static void addWebAuthnRegisterAction(RealmModel realm) {
             webauthnRegister.setName("Webauthn Register");
             webauthnRegister.setProviderId(PROVIDER_ID);
             webauthnRegister.setDefaultAction(false);
-            webauthnRegister.setPriority(70);
+            webauthnRegister.setPriority(80);
             realm.addRequiredActionProvider(webauthnRegister);
         }
     }
@@ -315,7 +329,7 @@ public static void addWebAuthnPasswordlessRegisterAction(RealmModel realm) {
             webauthnRegister.setName("Webauthn Register Passwordless");
             webauthnRegister.setProviderId(PROVIDER_ID);
             webauthnRegister.setDefaultAction(false);
-            webauthnRegister.setPriority(80);
+            webauthnRegister.setPriority(90);
             realm.addRequiredActionProvider(webauthnRegister);
         }
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java b/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
index d8767a11bee7..30b139ca8d76 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
@@ -20,7 +20,6 @@
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.Config.Scope;
-import org.keycloak.authorization.AdminPermissionsSchema;
 import org.keycloak.broker.social.SocialIdentityProvider;
 import org.keycloak.broker.social.SocialIdentityProviderFactory;
 import org.keycloak.common.util.CertificateUtils;
@@ -29,6 +28,7 @@
 import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.component.ComponentModel;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.deployment.DeployedConfigurationsManager;
 import org.keycloak.models.AccountRoles;
@@ -66,6 +66,7 @@
 import jakarta.transaction.SystemException;
 import jakarta.transaction.Transaction;
 import javax.crypto.spec.SecretKeySpec;
+import java.math.BigInteger;
 import java.security.Key;
 import java.security.KeyPair;
 import java.security.PrivateKey;
@@ -73,6 +74,7 @@
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Base64;
+import java.util.Calendar;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
@@ -86,12 +88,6 @@
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.common.Profile;
-import org.keycloak.representations.idm.authorization.ResourceRepresentation;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-import org.keycloak.representations.idm.authorization.ScopeRepresentation;
 
 import static org.keycloak.utils.StreamsUtil.closing;
 
@@ -112,6 +108,8 @@ public final class KeycloakModelUtils {
     public static final String GROUP_PATH_ESCAPE = "~";
     private static final char CLIENT_ROLE_SEPARATOR = '.';
 
+    public static final int MAX_CLIENT_LOOKUPS_DURING_ROLE_RESOLVE = 25;
+
     private KeycloakModelUtils() {
     }
 
@@ -223,8 +221,14 @@ public static String getPemFromCertificate(X509Certificate certificate) {
     }
 
     public static CertificateRepresentation generateKeyPairCertificate(String subject) {
-        KeyPair keyPair = KeyUtils.generateRsaKeyPair(2048);
-        X509Certificate certificate = CertificateUtils.generateV1SelfSignedCertificate(keyPair, subject);
+        Calendar calendar = Calendar.getInstance();
+        calendar.add(Calendar.YEAR, 3);
+        return generateKeyPairCertificate(subject, 4096, calendar);
+    }
+
+    public static CertificateRepresentation generateKeyPairCertificate(String subject, int keysize, Calendar endDate) {
+        KeyPair keyPair = KeyUtils.generateRsaKeyPair(keysize);
+        X509Certificate certificate = CertificateUtils.generateV1SelfSignedCertificate(keyPair, subject, BigInteger.valueOf(System.currentTimeMillis()), endDate.getTime());
 
         String privateKeyPem = PemUtils.encodeKey(keyPair.getPrivate());
         String certPem = PemUtils.encodeCertificate(certificate);
@@ -300,11 +304,14 @@ public static boolean searchFor(RoleModel role, RoleModel composite, Set<String>
     }
 
     /**
-     * Try to find user by username or email for authentication
+     * If "Login with email" is enabled and the given username contains '@',
+     * attempts to find the user by email for authentication.
      *
-     * @param realm    realm
-     * @param username username or email of user
-     * @return found user
+     * Otherwise, or if not found, attempts to find the user by username.
+     *
+     * @param realm the realm to search within
+     * @param username the username or email of the user
+     * @return the found user if present; otherwise, {@code null}
      */
     public static UserModel findUserByNameOrEmail(KeycloakSession session, RealmModel realm, String username) {
         if (realm.isLoginWithEmailAllowed() && username.indexOf('@') != -1) {
@@ -336,7 +343,7 @@ public static void runJobInTransaction(KeycloakSessionFactory factory, KeycloakC
         runJobInTransactionWithResult(factory, context, session -> {
             task.run(session);
             return null;
-        }, task.useExistingSession(), task.getTaskName());
+        }, task.getTaskName());
     }
 
     /**
@@ -426,7 +433,7 @@ private static void cloneContextToSession(final KeycloakContext origContext, fin
      * @return The return value from the callable
      */
     public static <V> V runJobInTransactionWithResult(KeycloakSessionFactory factory, final KeycloakSessionTaskWithResult<V> callable) {
-        return runJobInTransactionWithResult(factory, null, callable, false, "Non-HTTP task");
+        return runJobInTransactionWithResult(factory, null, callable, "Non-HTTP task");
     }
 
     /**
@@ -435,18 +442,13 @@ public static <V> V runJobInTransactionWithResult(KeycloakSessionFactory factory
      * @param factory The session factory
      * @param context The context from the previous session to use
      * @param callable The callable to execute
-     * @param useExistingSession if the existing session should be used
      * @param taskName Name of the task. Can be useful for logging purposes
      * @return The return value from the callable
      */
     public static <V> V runJobInTransactionWithResult(KeycloakSessionFactory factory, KeycloakContext context, final KeycloakSessionTaskWithResult<V> callable,
-                                                      boolean useExistingSession, String taskName) {
+                                                      String taskName) {
         V result;
         KeycloakSession existing = KeycloakSessionUtil.getKeycloakSession();
-        if (useExistingSession && existing != null && existing.getTransactionManager().isActive()) {
-            return callable.run(existing);
-        }
-
         try (KeycloakSession session = factory.create()) {
             RequestContextHelper.getContext(session).setContextMessage(taskName);
             session.getTransactionManager().begin();
@@ -590,7 +592,7 @@ public String get(String key) {
         }
     }
 
-    public static String getMasterRealmAdminApplicationClientId(String realmName) {
+    public static String getMasterRealmAdminManagementClientId(String realmName) {
         return realmName + "-realm";
     }
 
@@ -935,8 +937,10 @@ public static RoleModel getRoleFromString(RealmModel realm, String roleName) {
         }
 
         // Check client roles for all possible splits by dot
+        int counter = 0;
         int scopeIndex = roleName.lastIndexOf(CLIENT_ROLE_SEPARATOR);
-        while (scopeIndex >= 0) {
+        while (scopeIndex >= 0 && counter < MAX_CLIENT_LOOKUPS_DURING_ROLE_RESOLVE) {
+            counter++;
             String appName = roleName.substring(0, scopeIndex);
             ClientModel client = realm.getClientByClientId(appName);
             if (client != null) {
@@ -946,6 +950,10 @@ public static RoleModel getRoleFromString(RealmModel realm, String roleName) {
 
             scopeIndex = roleName.lastIndexOf(CLIENT_ROLE_SEPARATOR, scopeIndex - 1);
         }
+        if (counter >= MAX_CLIENT_LOOKUPS_DURING_ROLE_RESOLVE) {
+            logger.warnf("Not able to retrieve role model from the role name '%s'. Please use shorter role names with the limited amount of dots, roleName", roleName.length() > 100 ? roleName.substring(0, 100) + "..." : roleName);
+            return null;
+        }
 
         // determine if roleName is a realm role
         return realm.getRole(roleName);
@@ -1168,8 +1176,12 @@ public static int getSecretLengthByAuthenticationType(String clientAuthenticator
         if (clientAuthenticatorType != null)
             switch (clientAuthenticatorType) {
                 case AUTH_TYPE_CLIENT_SECRET_JWT: {
-                    if (Algorithm.HS384.equals(signingAlg)) return SecretGenerator.SECRET_LENGTH_384_BITS;
-                    if (Algorithm.HS512.equals(signingAlg)) return SecretGenerator.SECRET_LENGTH_512_BITS;
+                    if (Algorithm.HS384.equals(signingAlg))
+                        return SecretGenerator.equivalentEntropySize(SecretGenerator.SECRET_LENGTH_384_BITS, SecretGenerator.ALPHANUM.length);
+                    else if (Algorithm.HS512.equals(signingAlg))
+                        return SecretGenerator.equivalentEntropySize(SecretGenerator.SECRET_LENGTH_512_BITS, SecretGenerator.ALPHANUM.length);
+                    else
+                        return SecretGenerator.equivalentEntropySize(SecretGenerator.SECRET_LENGTH_256_BITS, SecretGenerator.ALPHANUM.length);
                 }
             }
         return SecretGenerator.SECRET_LENGTH_256_BITS;
@@ -1191,34 +1203,6 @@ public static void setDefaultGroups(KeycloakSession session, RealmModel realm, S
         });
     }
 
-    public static boolean isAdminPermissionsEnabled(RealmModel realm) {
-        return Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2) && realm.isAdminPermissionsEnabled();
-    }
-
-    public static void setupAdminPermissionsClient(KeycloakSession session, RealmModel realm) {
-        ClientModel client = session.clients().addClient(realm, Constants.ADMIN_PERMISSIONS_CLIENT_ID);
-        realm.setAdminPermissionsClient(client);
-
-        ResourceServer resourceServer = RepresentationToModel.createResourceServer(client, session, false);
-        ResourceServerRepresentation resourceServerRep = ModelToRepresentation.toRepresentation(resourceServer, client);
-
-        //create all scopes defined in the schema
-        //there is no way how to map scopes to the resourceType, we need to collect all scopes from all resourceTypes 
-        Set<ScopeRepresentation> scopes = AdminPermissionsSchema.SCHEMA.getResourceTypes().values().stream()
-                .flatMap((resourceType) -> resourceType.getScopes().stream())
-                .map(scope -> new ScopeRepresentation(scope))
-                .collect(Collectors.toSet());//collecting to set to get rid of duplicities
-
-        resourceServerRep.setScopes(List.copyOf(scopes));
-
-        //create 'all-resource' resources defined in the schema
-        resourceServerRep.setResources(AdminPermissionsSchema.SCHEMA.getResourceTypes().keySet().stream()
-                .map(type -> new ResourceRepresentation(type))
-                .collect(Collectors.toList()));
-
-        RepresentationToModel.toModel(resourceServerRep, session.getProvider(AuthorizationProvider.class), client);
-    }
-
     /**
      * <p>Runs the given {@code operation} within the scope of the given @{target} realm.
      *
@@ -1245,4 +1229,17 @@ public static <T> T runOnRealm(KeycloakSession session, RealmModel target, Funct
             context.setRealm(currentRealm);
         }
     }
+
+    /**
+     * @return the list of protocols accepted for the given client.
+     */
+    public static List<String> getAcceptedClientScopeProtocols(ClientModel client) {
+        List<String> acceptedClientProtocols;
+        if (client.getProtocol() == null || "openid-connect".equals(client.getProtocol())) {
+            acceptedClientProtocols = List.of("openid-connect", Oid4VciConstants.OID4VC_PROTOCOL);
+        }else {
+            acceptedClientProtocols = List.of(client.getProtocol());
+        }
+        return acceptedClientProtocols;
+    }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java b/server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
index d9b09c73c3e9..5a9a5d3917aa 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
@@ -18,12 +18,13 @@
 package org.keycloak.models.utils;
 
 import static java.util.Optional.ofNullable;
+import static org.keycloak.models.UserModel.IS_TEMP_ADMIN_ATTR_NAME;
 import static org.keycloak.models.utils.StripSecretsUtils.stripSecrets;
 
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.authentication.otp.OTPApplicationProvider;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.AuthorizationProviderFactory;
 import org.keycloak.authorization.model.PermissionTicket;
@@ -49,14 +50,15 @@
 import org.keycloak.models.light.LightweightUserAdapter;
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.representations.account.CredentialMetadataRepresentation;
+import org.keycloak.representations.account.LocalizedMessage;
 import org.keycloak.representations.idm.*;
 import org.keycloak.representations.idm.authorization.*;
 import org.keycloak.storage.StorageId;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.utils.StringUtil;
 
-import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -69,7 +71,6 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 import static org.keycloak.models.light.LightweightUserAdapter.isLightweightUser;
-import static org.keycloak.models.Constants.IS_TEMP_ADMIN_ATTR_NAME;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -118,6 +119,7 @@ public class ModelToRepresentation {
         REALM_EXCLUDED_ATTRIBUTES.add("webAuthnPolicyCreateTimeoutPasswordless");
         REALM_EXCLUDED_ATTRIBUTES.add("webAuthnPolicyAvoidSameAuthenticatorRegisterPasswordless");
         REALM_EXCLUDED_ATTRIBUTES.add("webAuthnPolicyAcceptableAaguidsPasswordless");
+        REALM_EXCLUDED_ATTRIBUTES.add("webAuthnPolicyPasskeysEnabledPasswordless");
 
         REALM_EXCLUDED_ATTRIBUTES.add(Constants.CLIENT_POLICIES);
         REALM_EXCLUDED_ATTRIBUTES.add(Constants.CLIENT_PROFILES);
@@ -149,6 +151,7 @@ public static GroupRepresentation toRepresentation(GroupModel group, boolean ful
         GroupRepresentation rep = new GroupRepresentation();
         rep.setId(group.getId());
         rep.setName(group.getName());
+        rep.setDescription(group.getDescription());
         rep.setPath(buildGroupPath(group));
         rep.setParentId(group.getParentId());
         if (!full) return rep;
@@ -173,10 +176,6 @@ public static GroupRepresentation toRepresentation(GroupModel group, boolean ful
         return rep;
     }
 
-    public static Stream<GroupModel> searchGroupModelsByAttributes(KeycloakSession session, RealmModel realm, Map<String,String> attributes, Integer first, Integer max) {
-        return session.groups().searchGroupsByAttributes(realm, attributes, first, max);
-    }
-
     @Deprecated
     public static Stream<GroupRepresentation> toGroupHierarchy(KeycloakSession session, RealmModel realm, boolean full) {
         return session.groups().getTopLevelGroupsStream(realm, null, null)
@@ -224,16 +223,28 @@ private static boolean groupMatchesSearchOrIsPathElement(GroupModel group, Strin
         return group.getSubGroupsStream().findAny().isPresent();
     }
 
-
     public static UserRepresentation toRepresentation(KeycloakSession session, RealmModel realm, UserModel user) {
-        UserRepresentation rep = new UserRepresentation();
+        return toRepresentation(session, realm, user, new UserRepresentation(), true);
+    }
+
+    public static UserRepresentation toRepresentation(KeycloakSession session, RealmModel realm, UserModel user, UserRepresentation rep, boolean setUserAttributes) {
         rep.setId(user.getId());
-        rep.setUsername(user.getUsername());
+        if (setUserAttributes) {
+            rep.setUsername(user.getUsername());
+        }
         rep.setCreatedTimestamp(user.getCreatedTimestamp());
-        rep.setLastName(user.getLastName());
-        rep.setFirstName(user.getFirstName());
-        rep.setEmail(user.getEmail());
-        rep.setEnabled(user.isEnabled());
+        if (setUserAttributes) {
+            rep.setLastName(user.getLastName());
+        }
+        if (setUserAttributes) {
+            rep.setFirstName(user.getFirstName());
+        }
+        if (setUserAttributes) {
+            rep.setEmail(user.getEmail());
+        }
+        if (rep.isEnabled() == null) {
+            rep.setEnabled(user.isEnabled());
+        }
         rep.setEmailVerified(user.isEmailVerified());
         rep.setTotp(user.credentialManager().isConfiguredFor(OTPCredentialModel.TYPE));
         rep.setDisableableCredentialTypes(user.credentialManager()
@@ -242,37 +253,51 @@ public static UserRepresentation toRepresentation(KeycloakSession session, Realm
         rep.setNotBefore(isLightweightUser(user) ? ((LightweightUserAdapter) user).getCreatedTimestamp().intValue() : session.users().getNotBeforeOfUser(realm, user));
         rep.setRequiredActions(user.getRequiredActionsStream().collect(Collectors.toList()));
 
-        Map<String, List<String>> attributes = user.getAttributes();
-        Map<String, List<String>> copy = null;
+        if (setUserAttributes) {
+            Map<String, List<String>> attributes = user.getAttributes();
+            Map<String, List<String>> copy = null;
 
-        if (attributes != null) {
-            copy = new HashMap<>(attributes);
-            copy.remove(UserModel.LAST_NAME);
-            copy.remove(UserModel.FIRST_NAME);
-            copy.remove(UserModel.EMAIL);
-            copy.remove(UserModel.USERNAME);
-        }
-        if (attributes != null && !copy.isEmpty()) {
-            Map<String, List<String>> attrs = new HashMap<>(copy);
-            rep.setAttributes(attrs);
+            if (attributes != null) {
+                copy = new HashMap<>(attributes);
+                copy.remove(UserModel.LAST_NAME);
+                copy.remove(UserModel.FIRST_NAME);
+                copy.remove(UserModel.EMAIL);
+                copy.remove(UserModel.USERNAME);
+            }
+            if (attributes != null && !copy.isEmpty()) {
+                Map<String, List<String>> attrs = new HashMap<>(copy);
+                rep.setAttributes(attrs);
+            }
         }
 
         return rep;
     }
 
     public static UserRepresentation toBriefRepresentation(UserModel user) {
-        UserRepresentation rep = new UserRepresentation();
+        return toBriefRepresentation(user, new UserRepresentation(), true);
+    }
+
+    public static UserRepresentation toBriefRepresentation(UserModel user, UserRepresentation rep, boolean setUserAttributes) {
         rep.setId(user.getId());
-        rep.setUsername(user.getUsername());
+        if (setUserAttributes) {
+            rep.setUsername(user.getUsername());
+        }
         rep.setCreatedTimestamp(user.getCreatedTimestamp());
-        rep.setLastName(user.getLastName());
-        rep.setFirstName(user.getFirstName());
-        rep.setEmail(user.getEmail());
-        rep.setEnabled(user.isEnabled());
+        if (setUserAttributes) {
+            rep.setLastName(user.getLastName());
+        }
+        if (setUserAttributes) {
+            rep.setFirstName(user.getFirstName());
+        }
+        if (setUserAttributes) {
+            rep.setEmail(user.getEmail());
+        }
+        if (rep.isEnabled() == null) {
+            rep.setEnabled(user.isEnabled());
+        }
         rep.setEmailVerified(user.isEmailVerified());
         rep.setFederationLink(user.getFederationLink());
         addAttributeToBriefRep(user, rep, IS_TEMP_ADMIN_ATTR_NAME);
-
         return rep;
     }
 
@@ -288,6 +313,7 @@ private static void addAttributeToBriefRep(UserModel user, UserRepresentation us
 
     public static EventRepresentation toRepresentation(Event event) {
         EventRepresentation rep = new EventRepresentation();
+        rep.setId(event.getId());
         rep.setTime(event.getTime());
         rep.setType(event.getType().toString());
         rep.setRealmId(event.getRealmId());
@@ -302,6 +328,7 @@ public static EventRepresentation toRepresentation(Event event) {
 
     public static AdminEventRepresentation toRepresentation(AdminEvent adminEvent) {
         AdminEventRepresentation rep = new AdminEventRepresentation();
+        rep.setId(adminEvent.getId());
         rep.setTime(adminEvent.getTime());
         rep.setRealmId(adminEvent.getRealmId());
         if (adminEvent.getAuthDetails() != null) {
@@ -488,6 +515,7 @@ public static RealmRepresentation toRepresentation(KeycloakSession session, Real
         rep.setWebAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister(webAuthnPolicy.isAvoidSameAuthenticatorRegister());
         rep.setWebAuthnPolicyPasswordlessAcceptableAaguids(webAuthnPolicy.getAcceptableAaguids());
         rep.setWebAuthnPolicyPasswordlessExtraOrigins(webAuthnPolicy.getExtraOrigins());
+        rep.setWebAuthnPolicyPasswordlessPasskeysEnabled(webAuthnPolicy.isPasskeysEnabled());
 
         CibaConfig cibaPolicy = realm.getCibaPolicy();
         Map<String, String> attrMap = ofNullable(rep.getAttributes()).orElse(new HashMap<>());
@@ -542,7 +570,10 @@ public static RealmRepresentation toRepresentation(KeycloakSession session, Real
         }
 
         rep.setInternationalizationEnabled(realm.isInternationalizationEnabled());
-        rep.setSupportedLocales(realm.getSupportedLocalesStream().collect(Collectors.toSet()));
+        Set<String> supportedLocales = realm.getSupportedLocalesStream().collect(Collectors.toSet());
+        if (!supportedLocales.isEmpty()) {
+            rep.setSupportedLocales(supportedLocales);
+        }
         rep.setDefaultLocale(realm.getDefaultLocale());
         if (internal) {
             exportAuthenticationFlows(session, realm, rep);
@@ -669,28 +700,27 @@ public static CredentialRepresentation toRepresentation(CredentialModel cred) {
         rep.setCreatedDate(cred.getCreatedDate());
         rep.setSecretData(cred.getSecretData());
         rep.setCredentialData(cred.getCredentialData());
+        rep.setFederationLink(cred.getFederationLink());
         return rep;
     }
 
+    private static LocalizedMessage toLocalizedMessage(CredentialMetadata.LocalizedMessage message) {
+        if (message == null) {
+            return null;
+        }
+        String[] parameters = message.getParameters() != null
+                ? Arrays.stream(message.getParameters()).map(Object::toString).toArray(String[]::new)
+                : null;
+        return new LocalizedMessage(message.getKey(), parameters);
+    }
+
     public static CredentialMetadataRepresentation toRepresentation(CredentialMetadata credentialMetadata) {
         CredentialMetadataRepresentation rep = new CredentialMetadataRepresentation();
 
         rep.setCredential(ModelToRepresentation.toRepresentation(credentialMetadata.getCredentialModel()));
-        try {
-            rep.setInfoMessage(credentialMetadata.getInfoMessage() == null ? null : JsonSerialization.writeValueAsString(credentialMetadata.getInfoMessage()));
-        } catch (IOException e) {
-            LOG.warn("unable to serialize model information, skipping info message", e);
-        }
-        try {
-            rep.setWarningMessageDescription(credentialMetadata.getWarningMessageDescription() == null ? null : JsonSerialization.writeValueAsString(credentialMetadata.getWarningMessageDescription()));
-        } catch (IOException e) {
-            LOG.warn("unable to serialize model information, skipping warning message desc", e);
-        }
-        try {
-            rep.setWarningMessageTitle(credentialMetadata.getWarningMessageTitle() == null ? null : JsonSerialization.writeValueAsString(credentialMetadata.getWarningMessageTitle()));
-        } catch (IOException e) {
-            LOG.warn("unable to serialize model information, skipping warning message title", e);
-        }
+        rep.setInfoMessage(toLocalizedMessage(credentialMetadata.getInfoMessage()));
+        rep.setWarningMessageDescription(toLocalizedMessage(credentialMetadata.getWarningMessageDescription()));
+        rep.setWarningMessageTitle(toLocalizedMessage(credentialMetadata.getWarningMessageTitle()));
         return rep;
     }
 
@@ -1055,22 +1085,11 @@ public static ResourceServerRepresentation toRepresentation(ResourceServer model
         server.setAllowRemoteResourceManagement(model.isAllowRemoteResourceManagement());
         server.setPolicyEnforcementMode(model.getPolicyEnforcementMode());
         server.setDecisionStrategy(model.getDecisionStrategy());
-        server.setAuthorizationSchema(getAuthorizationSchema(client));
+        server.setAuthorizationSchema(AdminPermissionsSchema.SCHEMA.getAuthorizationSchema(client));
 
         return server;
     }
 
-    private static AuthorizationSchema getAuthorizationSchema(ClientModel client) {
-        if (!KeycloakModelUtils.isAdminPermissionsEnabled(client.getRealm())) {
-            return null;
-        }
-        ClientModel adminPermissionsClient = client.getRealm().getAdminPermissionsClient();
-        if (adminPermissionsClient == null || ! client.getClientId().equals(adminPermissionsClient.getClientId())) {
-            return null;
-        }
-        return AdminPermissionsSchema.SCHEMA;
-    }
-
     public static <R extends AbstractPolicyRepresentation> R toRepresentation(Policy policy, AuthorizationProvider authorization) {
         return toRepresentation(policy, authorization, false, true);
     }
@@ -1326,15 +1345,10 @@ public static RequiredActionConfigRepresentation toRepresentation(RequiredAction
     }
 
     public static OrganizationRepresentation toRepresentation(OrganizationModel model) {
-        OrganizationRepresentation rep = toBriefRepresentation(model,false);
-        if (rep == null) {
-            return null;
-        }
-        rep.setAttributes(model.getAttributes());
-        return rep;
+        return toRepresentation(model, true);
     }
 
-    public static OrganizationRepresentation toBriefRepresentation(OrganizationModel model, Boolean briefRepresentation) {
+    public static OrganizationRepresentation toRepresentation(OrganizationModel model, boolean briefRepresentation) {
         if (model == null) {
             return null;
         }
@@ -1342,7 +1356,7 @@ public static OrganizationRepresentation toBriefRepresentation(OrganizationModel
         rep.setId(model.getId());
         rep.setName(model.getName());
         rep.setAlias(model.getAlias());
-        if (briefRepresentation) {
+        if (!briefRepresentation) {
             rep.setAttributes(model.getAttributes());
         }
         rep.setEnabled(model.isEnabled());
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java b/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
index bb0a49ced9e8..6b8a7da11127 100755
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
@@ -18,9 +18,11 @@
 package org.keycloak.models.utils;
 
 import java.io.IOException;
+import java.util.AbstractMap;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
+import java.util.LinkedHashMap;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.ListIterator;
@@ -38,6 +40,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.OAuth2Constants;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.AuthorizationProviderFactory;
 import org.keycloak.authorization.model.PermissionTicket;
@@ -130,6 +133,7 @@
 import org.keycloak.utils.StringUtil;
 
 import static java.util.Optional.ofNullable;
+import static org.keycloak.models.OrganizationDomainModel.ANY_DOMAIN;
 import static org.keycloak.protocol.saml.util.ArtifactBindingUtils.computeArtifactBindingIdentifierString;
 
 public class RepresentationToModel {
@@ -138,8 +142,8 @@ public class RepresentationToModel {
     public static final String OIDC = "openid-connect";
 
 
-    public static void importRealm(KeycloakSession session, RealmRepresentation rep, RealmModel newRealm, boolean skipUserDependent) {
-        session.getProvider(DatastoreProvider.class).getExportImportManager().importRealm(rep, newRealm, skipUserDependent);
+    public static void importRealm(KeycloakSession session, RealmRepresentation rep, RealmModel newRealm, Runnable userImport) {
+        session.getProvider(DatastoreProvider.class).getExportImportManager().importRealm(rep, newRealm, userImport);
     }
 
     public static void importRoles(RolesRepresentation realmRoles, RealmModel realm) {
@@ -633,25 +637,28 @@ public static void updateClientProtocolMappers(ClientRepresentation rep, ClientM
 
     public static void updateClientScopes(ClientRepresentation resourceRep, ClientModel client) {
         if (resourceRep.getDefaultClientScopes() != null || resourceRep.getOptionalClientScopes() != null) {
-            // First remove all default/built in client scopes
-            for (ClientScopeModel clientScope : client.getClientScopes(true).values()) {
-                client.removeClientScope(clientScope);
-            }
-
-            // First remove all default/built in client scopes
-            for (ClientScopeModel clientScope : client.getClientScopes(false).values()) {
-                client.removeClientScope(clientScope);
+            // first collect all the desired scopes
+            LinkedHashMap<String, Boolean> allScopes = new LinkedHashMap<String, Boolean>();
+            Optional.ofNullable(resourceRep.getOptionalClientScopes()).ifPresent(scopes -> scopes.forEach(scope -> allScopes.put(scope, false)));
+            Optional.ofNullable(resourceRep.getDefaultClientScopes()).ifPresent(scopes -> scopes.forEach(scope -> allScopes.put(scope, true)));
+
+            // next determine what already exists
+            Map<Map.Entry<String, Boolean>, ClientScopeModel> existing = new HashMap<Map.Entry<String,Boolean>, ClientScopeModel>();
+            client.getClientScopes(false).entrySet().stream().forEach(entry -> existing.put(new AbstractMap.SimpleEntry<String, Boolean>(entry.getKey(), false), entry.getValue()));
+            client.getClientScopes(true).entrySet().stream().forEach(entry -> existing.put(new AbstractMap.SimpleEntry<String, Boolean>(entry.getKey(), true), entry.getValue()));
+
+            // remove anything that isn't desired - this includes client scopes that are toggling the default flag
+            for (Entry<Entry<String, Boolean>, ClientScopeModel> entry : existing.entrySet()) {
+                if (Optional.ofNullable(allScopes.get(entry.getKey().getKey())).filter(entry.getKey().getValue()::equals).isEmpty()) {
+                    client.removeClientScope(entry.getValue());
+                }
             }
-        }
 
-        if (resourceRep.getDefaultClientScopes() != null) {
-            for (String clientScopeName : resourceRep.getDefaultClientScopes()) {
-                addClientScopeToClient(client.getRealm(), client, clientScopeName, true);
-            }
-        }
-        if (resourceRep.getOptionalClientScopes() != null) {
-            for (String clientScopeName : resourceRep.getOptionalClientScopes()) {
-                addClientScopeToClient(client.getRealm(), client, clientScopeName, false);
+            // finally add in all the desired
+            for (Map.Entry<String, Boolean> entry : allScopes.entrySet()) {
+                if (!existing.containsKey(entry)) {
+                    addClientScopeToClient(client.getRealm(), client, entry.getKey(), entry.getValue());
+                }
             }
         }
     }
@@ -700,7 +707,7 @@ private static String generateProtocolNameKey(String protocol, String name) {
     // CLIENT SCOPES
 
 
-    public static ClientScopeModel createClientScope(KeycloakSession session, RealmModel realm, ClientScopeRepresentation resourceRep) {
+    public static ClientScopeModel createClientScope(RealmModel realm, ClientScopeRepresentation resourceRep) {
         logger.debugv("Create client scope: {0}", resourceRep.getName());
 
         ClientScopeModel clientScope = resourceRep.getId() != null ? realm.addClientScope(resourceRep.getId(), resourceRep.getName()) : realm.addClientScope(resourceRep.getName());
@@ -731,7 +738,6 @@ public static void updateClientScope(ClientScopeRepresentation rep, ClientScopeM
         if (rep.getName() != null) resource.setName(rep.getName());
         if (rep.getDescription() != null) resource.setDescription(rep.getDescription());
 
-
         if (rep.getProtocol() != null) resource.setProtocol(rep.getProtocol());
 
         if (rep.getAttributes() != null) {
@@ -742,9 +748,6 @@ public static void updateClientScope(ClientScopeRepresentation rep, ClientScopeM
 
     }
 
-    // Scope mappings
-
-
     // Users
 
     public static UserModel createUser(KeycloakSession session, RealmModel newRealm, UserRepresentation userRep) {
@@ -1178,7 +1181,7 @@ private static Policy importPolicies(AuthorizationProvider authorization, Resour
             if (applyPolicies != null && !applyPolicies.isEmpty()) {
                 PolicyStore policyStore = storeFactory.getPolicyStore();
                 try {
-                    List<String> policies = (List<String>) JsonSerialization.readValue(applyPolicies, List.class);
+                    List<String> policies = JsonSerialization.readValue(applyPolicies, List.class);
                     Set<String> policyIds = new HashSet<>();
 
                     for (String policyName : policies) {
@@ -1230,6 +1233,7 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
         model.setDescription(representation.getDescription());
         model.setDecisionStrategy(representation.getDecisionStrategy());
         model.setLogic(representation.getLogic());
+        model.setResourceType(representation.getResourceType());
 
         Set resources = representation.getResources();
         Set scopes = representation.getScopes();
@@ -1248,6 +1252,8 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
                         throw new RuntimeException(e);
                     }
                 }
+
+                representation.setResources(resources);
             }
 
             if (scopes == null) {
@@ -1260,6 +1266,8 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
                         throw new RuntimeException(e);
                     }
                 }
+
+                representation.setScopes(scopes);
             }
 
             if (policies == null) {
@@ -1272,6 +1280,8 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
                         throw new RuntimeException(e);
                     }
                 }
+
+                representation.setPolicies(policies);
             }
 
             model.setConfig(policy.getConfig());
@@ -1279,9 +1289,9 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
 
         StoreFactory storeFactory = authorization.getStoreFactory();
 
-        updateResources(resources, model, storeFactory);
-        updateScopes(scopes, model, storeFactory);
-        updateAssociatedPolicies(policies, model, storeFactory);
+        updateResources(representation, model, authorization);
+        updateScopes(representation, model, storeFactory);
+        updateAssociatedPolicies(representation, model, storeFactory);
 
         PolicyProviderFactory provider = authorization.getProviderFactory(model.getType());
 
@@ -1303,152 +1313,178 @@ public static Policy toModel(AbstractPolicyRepresentation representation, Author
         return model;
     }
 
-    private static void updateScopes(Set<String> scopeIds, Policy policy, StoreFactory storeFactory) {
-        if (scopeIds != null) {
-            if (scopeIds.isEmpty()) {
-                for (Scope scope : new HashSet<Scope>(policy.getScopes())) {
-                    policy.removeScope(scope);
-                }
-                return;
+    private static void updateScopes(AbstractPolicyRepresentation representation, Policy policy, StoreFactory storeFactory) {
+        Set<String> scopeIds = representation.getScopes();
+
+        if (scopeIds == null) {
+            return;
+        }
+
+        if (scopeIds.isEmpty()) {
+            for (Scope scope : new HashSet<Scope>(policy.getScopes())) {
+                policy.removeScope(scope);
             }
-            ResourceServer resourceServer = policy.getResourceServer();
-            for (String scopeId : scopeIds) {
-                boolean hasScope = false;
+            return;
+        }
+        ResourceServer resourceServer = policy.getResourceServer();
+        for (String scopeId : scopeIds) {
+            boolean hasScope = false;
 
-                for (Scope scopeModel : new HashSet<Scope>(policy.getScopes())) {
-                    if (scopeModel.getId().equals(scopeId) || scopeModel.getName().equals(scopeId)) {
-                        hasScope = true;
-                    }
+            for (Scope scopeModel : new HashSet<Scope>(policy.getScopes())) {
+                if (scopeModel.getId().equals(scopeId) || scopeModel.getName().equals(scopeId)) {
+                    hasScope = true;
                 }
-                if (!hasScope) {
-                    Scope scope = storeFactory.getScopeStore().findById(resourceServer, scopeId);
+            }
+            if (!hasScope) {
+                Scope scope = storeFactory.getScopeStore().findById(resourceServer, scopeId);
 
+                if (scope == null) {
+                    scope = storeFactory.getScopeStore().findByName(resourceServer, scopeId);
                     if (scope == null) {
-                        scope = storeFactory.getScopeStore().findByName(resourceServer, scopeId);
-                        if (scope == null) {
-                            throw new RuntimeException("Scope with id or name [" + scopeId + "] does not exist");
-                        }
+                        throw new RuntimeException("Scope with id or name [" + scopeId + "] does not exist");
                     }
-
-                    policy.addScope(scope);
                 }
+
+                policy.addScope(scope);
             }
+        }
 
-            for (Scope scopeModel : new HashSet<Scope>(policy.getScopes())) {
-                boolean hasScope = false;
+        for (Scope scopeModel : new HashSet<Scope>(policy.getScopes())) {
+            boolean hasScope = false;
 
-                for (String scopeId : scopeIds) {
-                    if (scopeModel.getId().equals(scopeId) || scopeModel.getName().equals(scopeId)) {
-                        hasScope = true;
-                    }
-                }
-                if (!hasScope) {
-                    policy.removeScope(scopeModel);
+            for (String scopeId : scopeIds) {
+                if (scopeModel.getId().equals(scopeId) || scopeModel.getName().equals(scopeId)) {
+                    hasScope = true;
                 }
             }
+            if (!hasScope) {
+                policy.removeScope(scopeModel);
+            }
         }
 
         policy.removeConfig("scopes");
     }
 
-    private static void updateAssociatedPolicies(Set<String> policyIds, Policy policy, StoreFactory storeFactory) {
+    private static void updateAssociatedPolicies(AbstractPolicyRepresentation representation, Policy policy, StoreFactory storeFactory) {
         ResourceServer resourceServer = policy.getResourceServer();
+        Set<String> policyIds = representation.getPolicies();
 
-        if (policyIds != null) {
-            if (policyIds.isEmpty()) {
-                for (Policy associated: new HashSet<Policy>(policy.getAssociatedPolicies())) {
-                    policy.removeAssociatedPolicy(associated);
-                }
-                return;
+        if (policyIds == null) {
+            return;
+        }
+
+        if (policyIds.isEmpty()) {
+            for (Policy associated: new HashSet<Policy>(policy.getAssociatedPolicies())) {
+                policy.removeAssociatedPolicy(associated);
             }
+            return;
+        }
 
-            PolicyStore policyStore = storeFactory.getPolicyStore();
+        PolicyStore policyStore = storeFactory.getPolicyStore();
 
-            for (String policyId : policyIds) {
-                boolean hasPolicy = false;
+        for (String policyId : policyIds) {
+            boolean hasPolicy = false;
 
-                for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
-                    if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
-                        hasPolicy = true;
-                    }
+            for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
+                if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
+                    hasPolicy = true;
                 }
+            }
 
-                if (!hasPolicy) {
-                    Policy associatedPolicy = policyStore.findById(resourceServer, policyId);
+            if (!hasPolicy) {
+                Policy associatedPolicy = policyStore.findById(resourceServer, policyId);
 
+                if (associatedPolicy == null) {
+                    associatedPolicy = policyStore.findByName(resourceServer, policyId);
                     if (associatedPolicy == null) {
-                        associatedPolicy = policyStore.findByName(resourceServer, policyId);
-                        if (associatedPolicy == null) {
-                            throw new RuntimeException("Policy with id or name [" + policyId + "] does not exist");
-                        }
+                        throw new RuntimeException("Policy with id or name [" + policyId + "] does not exist");
                     }
-
-                    policy.addAssociatedPolicy(associatedPolicy);
                 }
+
+                policy.addAssociatedPolicy(associatedPolicy);
             }
+        }
 
-            for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
-                boolean hasPolicy = false;
+        for (Policy policyModel : new HashSet<Policy>(policy.getAssociatedPolicies())) {
+            boolean hasPolicy = false;
 
-                for (String policyId : policyIds) {
-                    if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
-                        hasPolicy = true;
-                    }
-                }
-                if (!hasPolicy) {
-                    policy.removeAssociatedPolicy(policyModel);
+            for (String policyId : policyIds) {
+                if (policyModel.getId().equals(policyId) || policyModel.getName().equals(policyId)) {
+                    hasPolicy = true;
                 }
             }
+            if (!hasPolicy) {
+                policy.removeAssociatedPolicy(policyModel);
+            }
         }
 
         policy.removeConfig("applyPolicies");
     }
 
-    private static void updateResources(Set<String> resourceIds, Policy policy, StoreFactory storeFactory) {
-        if (resourceIds != null) {
-            if (resourceIds.isEmpty()) {
-                for (Resource resource : new HashSet<>(policy.getResources())) {
-                    policy.removeResource(resource);
-                }
+    private static void updateResources(AbstractPolicyRepresentation representation, Policy policy, AuthorizationProvider authorization) {
+        Set<String> resourceIds = representation.getResources();
+
+        if (resourceIds == null) {
+            return;
+        }
+
+        StoreFactory storeFactory = authorization.getStoreFactory();
+        KeycloakSession session = authorization.getKeycloakSession();
+        ResourceServer resourceServer = policy.getResourceServer();
+
+        if (resourceIds.isEmpty()) {
+            for (Resource resource : new HashSet<>(policy.getResources())) {
+                AdminPermissionsSchema.SCHEMA.removeResource(resource, policy, authorization);
             }
-            ResourceServer resourceServer = policy.getResourceServer();
+        }
 
-            for (String resourceId : resourceIds) {
-                boolean hasResource = false;
-                for (Resource resourceModel : new HashSet<>(policy.getResources())) {
-                    if (resourceModel.getId().equals(resourceId) || resourceModel.getName().equals(resourceId)) {
-                        hasResource = true;
-                    }
+        resourceIds = resourceIds.stream().map(id -> {
+            Resource resource = AdminPermissionsSchema.SCHEMA.getOrCreateResource(session, resourceServer, policy.getType(), policy.getResourceType(), id);
+
+            if (resource == null) {
+                return id;
+            }
+
+            return resource.getId();
+        }).collect(Collectors.toSet());
+
+        for (String resourceId : resourceIds) {
+            boolean hasResource = false;
+            for (Resource resourceModel : new HashSet<>(policy.getResources())) {
+                if (resourceModel.getId().equals(resourceId) || resourceModel.getName().equals(resourceId)) {
+                    hasResource = true;
                 }
-                if (!hasResource && !"".equals(resourceId)) {
-                    Resource resource = storeFactory.getResourceStore().findById(resourceServer, resourceId);
+            }
+            if (!hasResource && !"".equals(resourceId)) {
+                Resource resource = storeFactory.getResourceStore().findById(resourceServer, resourceId);
 
+                if (resource == null) {
+                    resource = storeFactory.getResourceStore().findByName(resourceServer, resourceId);
                     if (resource == null) {
-                        resource = storeFactory.getResourceStore().findByName(resourceServer, resourceId);
-                        if (resource == null) {
-                            throw new RuntimeException("Resource with id or name [" + resourceId + "] does not exist or is not owned by the resource server");
-                        }
+                        throw new RuntimeException("Resource with id or name [" + resourceId + "] does not exist or is not owned by the resource server");
                     }
-
-                    policy.addResource(resource);
                 }
+
+                policy.addResource(resource);
             }
+        }
 
-            for (Resource resourceModel : new HashSet<>(policy.getResources())) {
-                boolean hasResource = false;
+        for (Resource resourceModel : new HashSet<>(policy.getResources())) {
+            boolean hasResource = false;
 
-                for (String resourceId : resourceIds) {
-                    if (resourceModel.getId().equals(resourceId) || resourceModel.getName().equals(resourceId)) {
-                        hasResource = true;
-                    }
+            for (String resourceId : resourceIds) {
+                if (resourceModel.getId().equals(resourceId) || resourceModel.getName().equals(resourceId)) {
+                    hasResource = true;
                 }
+            }
 
-                if (!hasResource) {
-                    policy.removeResource(resourceModel);
-                }
+            if (!hasResource) {
+                AdminPermissionsSchema.SCHEMA.removeResource(resourceModel, policy, authorization);
             }
         }
 
+        AdminPermissionsSchema.SCHEMA.addUResourceTypeResource(session, resourceServer, policy, representation.getResourceType());
+
         policy.removeConfig("resources");
     }
 
@@ -1669,7 +1705,7 @@ private static void updateOrganizationBroker(IdentityProviderRepresentation repr
 
             if (StringUtil.isBlank(domain)) {
                 representation.getConfig().remove(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
-            } else if (org.getDomains().map(OrganizationDomainModel::getName).noneMatch(domain::equals)) {
+            } else if (!ANY_DOMAIN.equals(domain) && org.getDomains().map(OrganizationDomainModel::getName).noneMatch(domain::equals)) {
                 throw new IllegalArgumentException("Domain does not match any domain from the organization");
             }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/SessionTimeoutHelper.java b/server-spi-private/src/main/java/org/keycloak/models/utils/SessionTimeoutHelper.java
index b52d185822ed..ccf46f6e4c4d 100644
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/SessionTimeoutHelper.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/SessionTimeoutHelper.java
@@ -46,7 +46,7 @@ public class SessionTimeoutHelper {
     /**
      * The maximum time difference, which will be still tolerated when checking userSession idle timeout with periodic cleaner threads.
      *
-     * Just the sessions, with the timeout bigger than this value are considered really time-outed and can be garbage-collected (Considering the cross-dc
+     * Just the sessions, with the timeout bigger than this value are considered really time-outed and can be garbage-collected (Considering the multi-site
      * environment and the fact that some session updates on different DC can be postponed and seen on current DC with some delay).
      *
      * See {@link #PERIODIC_TASK_INTERVAL_SECONDS} and {@link #IDLE_TIMEOUT_WINDOW_SECONDS}
diff --git a/server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java b/server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
index 04703d98be53..cae4cb6529fc 100644
--- a/server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
@@ -134,6 +134,7 @@ protected static IdentityProviderRepresentation stripBroker(IdentityProviderRepr
 
     private static RealmRepresentation stripRealm(RealmRepresentation rep) {
         stripFromMap(rep.getSmtpServer(), "password");
+        stripFromMap(rep.getSmtpServer(), "authTokenClientSecret");
         return rep;
     }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/policy/AgePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/AgePasswordPolicyProvider.java
index c8e9c58b40e7..be1e641d4aa9 100644
--- a/server-spi-private/src/main/java/org/keycloak/policy/AgePasswordPolicyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/AgePasswordPolicyProvider.java
@@ -42,8 +42,7 @@ public AgePasswordPolicyProvider(KeycloakSession session) {
 
     @Override
     public PolicyError validate(String user, String password) {
-        RealmModel realm = session.getContext().getRealm();
-        return validate(realm, session.users().getUserByUsername(realm, user), password);
+        return null;
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/policy/NotContainsUsernamePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/NotContainsUsernamePasswordPolicyProvider.java
index 7d1e020b4864..b23060bb76ad 100644
--- a/server-spi-private/src/main/java/org/keycloak/policy/NotContainsUsernamePasswordPolicyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/NotContainsUsernamePasswordPolicyProvider.java
@@ -36,7 +36,7 @@ public PolicyError validate(String username, String password) {
         if (username == null) {
             return null;
         }
-        return password.contains(username) ? new PolicyError(ERROR_MESSAGE) : null;
+        return password.toLowerCase().contains(username.toLowerCase()) ? new PolicyError(ERROR_MESSAGE) : null;
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/policy/NotEmailPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/NotEmailPasswordPolicyProvider.java
index ae0e711d9307..45335fa46f28 100644
--- a/server-spi-private/src/main/java/org/keycloak/policy/NotEmailPasswordPolicyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/NotEmailPasswordPolicyProvider.java
@@ -42,7 +42,7 @@ public PolicyError validate(String email, String password) {
         if (email == null) {
             return null;
         }
-        return email.equals(password) ? POLICY_ERROR : null;
+        return email.equalsIgnoreCase(password) ? POLICY_ERROR : null;
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
index f08edab0d6d3..993c8b0f7743 100644
--- a/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
@@ -39,7 +39,7 @@ public PolicyError validate(String username, String password) {
         if (username == null) {
             return null;
         }
-        return username.equals(password) ? new PolicyError(ERROR_MESSAGE) : null;
+        return username.equalsIgnoreCase(password) ? new PolicyError(ERROR_MESSAGE) : null;
     }
 
     @Override
diff --git a/server-spi-private/src/main/java/org/keycloak/policy/RecoveryCodesWarningThresholdPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/RecoveryCodesWarningThresholdPasswordPolicyProviderFactory.java
index 7dd6b15a7175..7e76c1a397c9 100644
--- a/server-spi-private/src/main/java/org/keycloak/policy/RecoveryCodesWarningThresholdPasswordPolicyProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/RecoveryCodesWarningThresholdPasswordPolicyProviderFactory.java
@@ -29,7 +29,10 @@
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ *
+ * @deprecated Please use rather the recovery codes required action to configure warning threshold for recovery codes. This password policy may be removed in the future versions.
  */
+@Deprecated
 public class RecoveryCodesWarningThresholdPasswordPolicyProviderFactory implements PasswordPolicyProviderFactory, PasswordPolicyProvider, EnvironmentDependentProviderFactory {
 
     private KeycloakSession session;
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
index af56344f6e61..661ab1034c26 100755
--- a/server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
@@ -24,6 +24,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.provider.ProviderEvent;
 import org.keycloak.provider.ProviderEventListener;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
 
 import java.util.Objects;
 import java.util.Set;
@@ -96,7 +97,12 @@ else if (!nonDefaultClientScopes.isEmpty())
             newClients.forEach(addNonDefault);
     }
 
-    protected abstract void addDefaults(ClientModel realm);
+    protected abstract void addDefaults(ClientModel clientModel);
+
+    @Override
+    public void addClientScopeDefaults(ClientScopeRepresentation clientModel) {
+        // do nothing
+    }
 
     @Override
     public void close() {
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
index 56af0a8b388d..d748aff4de11 100755
--- a/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
@@ -24,6 +24,8 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+
 import java.util.Map;
 
 /**
@@ -59,4 +61,8 @@ public interface LoginProtocolFactory extends ProviderFactory<LoginProtocol> {
      */
     void setupClientDefaults(ClientRepresentation rep, ClientModel newClient);
 
+    /**
+     * Add default values to {@link ClientScopeRepresentation}s that refer to the specific login-protocol
+     */
+    void addClientScopeDefaults(ClientScopeRepresentation clientModel);
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/OIDCConfigAttributes.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/OIDCConfigAttributes.java
index ed0ccbb9e226..c85f68242a2c 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/OIDCConfigAttributes.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/OIDCConfigAttributes.java
@@ -64,6 +64,7 @@ public final class OIDCConfigAttributes {
     public static final String PKCE_CODE_CHALLENGE_METHOD = "pkce.code.challenge.method";
 
     public static final String TOKEN_ENDPOINT_AUTH_SIGNING_ALG = "token.endpoint.auth.signing.alg";
+    public static final String TOKEN_ENDPOINT_AUTH_SIGNING_MAX_EXP = "token.endpoint.auth.signing.max.exp";
 
     public static final String BACKCHANNEL_LOGOUT_URL = "backchannel.logout.url";
 
@@ -77,6 +78,8 @@ public final class OIDCConfigAttributes {
 
     public static final String USE_LOWER_CASE_IN_TOKEN_RESPONSE = "token.response.type.bearer.lower-case";
 
+    public static final String USE_RFC9068_ACCESS_TOKEN_HEADER_TYPE = "access.token.header.type.rfc9068";
+
     public static final String ID_TOKEN_AS_DETACHED_SIGNATURE  = "id.token.as.detached.signature";
 
     public static final String AUTHORIZATION_SIGNED_RESPONSE_ALG = "authorization.signed.response.alg";
@@ -86,6 +89,9 @@ public final class OIDCConfigAttributes {
     public static final String FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED = "frontchannel.logout.session.required";
 
     public static final String POST_LOGOUT_REDIRECT_URIS = "post.logout.redirect.uris";
+    
+    public static final String STANDARD_TOKEN_EXCHANGE_ENABLED = "standard.token.exchange.enabled";
+    public static final String STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED = "standard.token.exchange.enableRefreshRequestedTokenType";
 
     private OIDCConfigAttributes() {
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeContext.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeContext.java
index f93e86acfece..bd20c7b1a1d9 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeContext.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeContext.java
@@ -41,7 +41,6 @@ public class TokenExchangeContext {
     private final KeycloakSession session;
     private final MultivaluedMap<String, String> formParams;
 
-    // TODO: resolve deps issue and use correct types
     private final Cors cors;
     private final Object tokenManager;
 
@@ -49,12 +48,15 @@ public class TokenExchangeContext {
     private final RealmModel realm;
     private final EventBuilder event;
 
-    private ClientConnection clientConnection;
-    private HttpHeaders headers;
-    private Map<String, String> clientAuthAttributes;
+    private final ClientConnection clientConnection;
+    private final HttpHeaders headers;
+    private final Map<String, String> clientAuthAttributes;
 
     private final Params params = new Params();
 
+    // Reason why the particular tokenExchange provider cannot be supported
+    private String unsupportedReason;
+
     public TokenExchangeContext(KeycloakSession session,
             MultivaluedMap<String, String> formParams,
             Cors cors,
@@ -121,6 +123,14 @@ public Params getParams() {
         return params;
     }
 
+    public String getUnsupportedReason() {
+        return unsupportedReason;
+    }
+
+    public void setUnsupportedReason(String unsupportedReason) {
+        this.unsupportedReason = unsupportedReason;
+    }
+
     public class Params {
 
         public String getActorToken() {
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeProvider.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeProvider.java
index f5608cedd67e..c9ab17301c01 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenExchangeProvider.java
@@ -44,4 +44,10 @@ public interface TokenExchangeProvider extends Provider {
      */
     Response exchange(TokenExchangeContext context);
 
+    /**
+     * @return version of the token-exchange provider. Could be useful by various components (like for example identity-providers), which need to interact with the token-exchange provider
+     * to doublecheck if it should have a "legacy" behaviour (for older version of token-exchange provider) or a "new" behaviour
+     */
+    int getVersion();
+
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
index 32af14d2f75e..582a20cbfbc4 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantType.java
@@ -26,6 +26,7 @@
 import java.util.Map;
 import java.util.Set;
 
+import org.keycloak.OAuth2Constants;
 import org.keycloak.common.ClientConnection;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
@@ -81,6 +82,7 @@ public static class Context {
         protected EventBuilder event;
         protected Cors cors;
         protected Object tokenManager;
+        protected String grantType;
 
         public Context(KeycloakSession session, Object clientConfig, Map<String, String> clientAuthAttributes,
                 MultivaluedMap<String, String> formParams, EventBuilder event, Cors cors, Object tokenManager) {
@@ -97,22 +99,7 @@ public Context(KeycloakSession session, Object clientConfig, Map<String, String>
             this.event = event;
             this.cors = cors;
             this.tokenManager = tokenManager;
-        }
-
-        public Context(Context context) {
-            this.session = context.session;
-            this.realm = context.realm;
-            this.client = context.client;
-            this.clientConfig = context.clientConfig;
-            this.clientConnection = context.clientConnection;
-            this.clientAuthAttributes = context.clientAuthAttributes;
-            this.request = context.request;
-            this.response = context.response;
-            this.headers = context.headers;
-            this.formParams = context.formParams;
-            this.event = context.event;
-            this.cors = context.cors;
-            this.tokenManager = context.tokenManager;
+            this.grantType = formParams.getFirst(OAuth2Constants.GRANT_TYPE);
         }
 
         public void setFormParams(MultivaluedHashMap<String, String> formParams) {
@@ -182,6 +169,10 @@ public KeycloakSession getSession() {
         public Object getTokenManager() {
             return tokenManager;
         }
+
+        public String getGrantType() {
+            return grantType;
+        }
     }
 
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeFactory.java
index 5793956f0832..020613d55cc5 100644
--- a/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeFactory.java
@@ -26,4 +26,9 @@
  */
 public interface OAuth2GrantTypeFactory extends ProviderFactory<OAuth2GrantType> {
 
+    /**
+     * @return usually like 3-letters shortcut of specific grants. It can be useful for example in the tokens when the amount of characters should be limited and hence using full grant name
+     * is not ideal. Shortcut should be unique across grants.
+     */
+    String getShortcut();
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/services/clientpolicy/condition/ClientPolicyConditionProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/services/clientpolicy/condition/ClientPolicyConditionProviderFactory.java
index 620a788b39a8..1a36a6d670fa 100644
--- a/server-spi-private/src/main/java/org/keycloak/services/clientpolicy/condition/ClientPolicyConditionProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/services/clientpolicy/condition/ClientPolicyConditionProviderFactory.java
@@ -19,9 +19,13 @@
 
 import org.keycloak.Config;
 import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
 import org.keycloak.provider.ConfiguredProvider;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.provider.ProviderFactory;
+import org.keycloak.representations.idm.ClientPolicyConditionRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
 
 /**
  * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
@@ -32,4 +36,15 @@ public interface ClientPolicyConditionProviderFactory extends ProviderFactory<Cl
     default boolean isSupported(Config.Scope config) {
         return Profile.isFeatureEnabled(Profile.Feature.CLIENT_POLICIES);
     }
+
+    /**
+     * Called before a Client Policy is created or updated.  Allows you to validate the configuration
+     *
+     * @param session
+     * @param realm
+     * @param conditionRepresentation
+     * @throws ClientPolicyException
+     */
+    default void validateConfiguration(KeycloakSession session, RealmModel realm, ClientPolicyConditionRepresentation conditionRepresentation) throws ClientPolicyException {
+    }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java b/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
index 7acb0e9adee6..25daf46cfec5 100755
--- a/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
+++ b/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
@@ -22,7 +22,6 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.ResponseBuilder;
 
-import org.keycloak.common.util.Resteasy;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.provider.Provider;
diff --git a/server-spi-private/src/main/java/org/keycloak/storage/ExportImportManager.java b/server-spi-private/src/main/java/org/keycloak/storage/ExportImportManager.java
index f9dd452eb05c..6b628462fefc 100644
--- a/server-spi-private/src/main/java/org/keycloak/storage/ExportImportManager.java
+++ b/server-spi-private/src/main/java/org/keycloak/storage/ExportImportManager.java
@@ -33,7 +33,7 @@
  * @author Alexander Schwartz
  */
 public interface ExportImportManager {
-    void importRealm(RealmRepresentation rep, RealmModel newRealm, boolean skipUserDependent);
+    void importRealm(RealmRepresentation rep, RealmModel newRealm, Runnable userImport);
 
     PartialImportResults partialImportRealm(RealmModel realm, InputStream requestBody);
 
diff --git a/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerFactory.java b/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerFactory.java
new file mode 100644
index 000000000000..7d0a2121e9b4
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerFactory.java
@@ -0,0 +1,10 @@
+package org.keycloak.theme;
+
+import org.keycloak.models.ThemeManager;
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ */
+public interface ThemeManagerFactory extends ProviderFactory<ThemeManager> {
+  void clearCache();
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerSpi.java b/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerSpi.java
new file mode 100644
index 000000000000..7760baca8508
--- /dev/null
+++ b/server-spi-private/src/main/java/org/keycloak/theme/ThemeManagerSpi.java
@@ -0,0 +1,29 @@
+package org.keycloak.theme;
+
+import org.keycloak.models.ThemeManager;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+public class ThemeManagerSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "themeManager";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return ThemeManager.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return ThemeManagerFactory.class;
+    }
+}
diff --git a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
index 6ff94bc5de93..c19643661916 100644
--- a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
+++ b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultAttributes.java
@@ -111,7 +111,11 @@ public boolean isReadOnly(String name) {
     private boolean isReadableOrWritableDuringRegistration(String name) {
         if (context.equals(UserProfileContext.REGISTRATION) && isRequired(name)) {
             // in context of registration, username or email (email as username) cannot be readonly otherwise registration is not possible
-            return UserModel.EMAIL.equals(name) || UserModel.USERNAME.equals(name);
+            if (UserModel.EMAIL.equals(name)) {
+                RealmModel realm = session.getContext().getRealm();
+                return realm.isRegistrationEmailAsUsername();
+            }
+            return UserModel.USERNAME.equals(name);
         }
         return false;
     }
@@ -295,12 +299,14 @@ public Map<String, List<String>> getReadable() {
                 continue;
             }
 
-            if (!isReadableOrWritableDuringRegistration(name)) {
-                AttributeContext attributeContext = createAttributeContext(metadata);
+            if (isReadableOrWritableDuringRegistration(name)) {
+                continue;
+            }
 
-                if (!metadata.canView(attributeContext) || !metadata.isSelected(attributeContext)) {
-                    attributes.remove(name);
-                }
+            AttributeContext attributeContext = createAttributeContext(metadata);
+
+            if (!metadata.canView(attributeContext) || !metadata.isSelected(attributeContext)) {
+                attributes.remove(name);
             }
         }
 
@@ -340,7 +346,7 @@ private Map<String, AttributeMetadata> configureMetadata(List<AttributeMetadata>
     }
 
     private Map<String, AttributeMetadata> getUserStorageProviderMetadata(UserProfileMetadata profileMetadata) {
-        if (user == null || (StorageId.isLocalStorage(user.getId()) && user.getFederationLink() == null)) {
+        if (user == null || (StorageId.isLocalStorage(user.getId()) && !user.isFederated())) {
             // new user or not a user from a storage provider other than local
             return Collections.emptyMap();
         }
@@ -561,6 +567,19 @@ public Map<String, List<String>> getUnmanagedAttributes() {
         return unmanagedAttributes;
     }
 
+    @Override
+    public Map<String, Object> getAnnotations(String name) {
+        AttributeMetadata metadata = getMetadata(name);
+
+        if (metadata == null) {
+            return Collections.emptyMap();
+        }
+
+        AttributeContext context = createAttributeContext(metadata);
+
+        return metadata.getAnnotations(context);
+    }
+
     protected AttributeMetadata createUnmanagedAttributeMetadata(String name) {
         return new AttributeMetadata(name, Integer.MAX_VALUE) {
             final UnmanagedAttributePolicy unmanagedAttributePolicy = upConfig.getUnmanagedAttributePolicy();
diff --git a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultUserProfile.java b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultUserProfile.java
index 4abd78dbf7c7..bb1a88af2046 100644
--- a/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultUserProfile.java
+++ b/server-spi-private/src/main/java/org/keycloak/userprofile/DefaultUserProfile.java
@@ -19,6 +19,8 @@
 
 package org.keycloak.userprofile;
 
+import static org.keycloak.models.UserModel.DISABLED_REASON;
+import static org.keycloak.models.UserModel.IS_TEMP_ADMIN_ATTR_NAME;
 import static org.keycloak.userprofile.UserProfileUtil.createUserProfileMetadata;
 import static org.keycloak.userprofile.UserProfileUtil.isRootAttribute;
 
@@ -39,6 +41,7 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.AbstractUserRepresentation;
+import org.keycloak.services.managers.BruteForceProtector;
 import org.keycloak.storage.ReadOnlyException;
 import org.keycloak.utils.StringUtil;
 
@@ -245,6 +248,21 @@ public <R extends AbstractUserRepresentation> R toRepresentation() {
             }
         }
 
+        setAttributeIfExists(user, DISABLED_REASON, attributesRep);
+        setAttributeIfExists(user, IS_TEMP_ADMIN_ATTR_NAME, attributesRep);
+
+        RealmModel realm = session.getContext().getRealm();
+
+        if (realm.isBruteForceProtected() && !attributesRep.containsKey(DISABLED_REASON)) {
+            BruteForceProtector protector = session.getProvider(BruteForceProtector.class);
+            boolean lockedOut = protector.isPermanentlyLockedOut(session, realm, user);
+
+            if (lockedOut) {
+                rep.setEnabled(false);
+                attributesRep.put(DISABLED_REASON, List.of(BruteForceProtector.DISABLED_BY_PERMANENT_LOCKOUT));
+            }
+        }
+
         rep.setId(user.getId());
         rep.setAttributes(attributesRep.isEmpty() ? null : attributesRep);
         rep.setUserProfileMetadata(createUserProfileMetadata(session, this));
@@ -273,4 +291,14 @@ private <R extends AbstractUserRepresentation> R createUserRepresentation() {
 
         return rep;
     }
+
+    private void setAttributeIfExists(UserModel user, String name, Map<String, List<String>> attributes) {
+        List<String> values = user.getAttributes().get(name);
+
+        if (values == null) {
+            return;
+        }
+
+        attributes.put(name, values);
+    }
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/userprofile/UserProfileUtil.java b/server-spi-private/src/main/java/org/keycloak/userprofile/UserProfileUtil.java
index 6c28ddd784e4..233b8514bcb5 100644
--- a/server-spi-private/src/main/java/org/keycloak/userprofile/UserProfileUtil.java
+++ b/server-spi-private/src/main/java/org/keycloak/userprofile/UserProfileUtil.java
@@ -155,12 +155,14 @@ private static UserProfileAttributeMetadata toRestMetadata(AttributeMetadata am,
             group = am.getAttributeGroupMetadata().getName();
         }
 
+        Attributes attributes = profile.getAttributes();
+
         return new UserProfileAttributeMetadata(am.getName(),
                 am.getAttributeDisplayName(),
-                profile.getAttributes().isRequired(am.getName()),
-                profile.getAttributes().isReadOnly(am.getName()),
+                attributes.isRequired(am.getName()),
+                attributes.isReadOnly(am.getName()),
                 group,
-                am.getAnnotations(),
+                attributes.getAnnotations(am.getName()),
                 toValidatorMetadata(am, session),
                 am.isMultivalued());
     }
diff --git a/server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java b/server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java
index e97cd3c8f80e..39038889dd6a 100755
--- a/server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java
+++ b/server-spi-private/src/main/java/org/keycloak/utils/CredentialHelper.java
@@ -33,8 +33,12 @@
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
+import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
 import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.util.JsonSerialization;
 
+import java.io.IOException;
+import java.util.List;
 import java.util.Objects;
 
 /**
@@ -47,16 +51,6 @@ public class CredentialHelper {
 
     private static final Logger logger = Logger.getLogger(CredentialHelper.class);
 
-    public static void setRequiredCredential(KeycloakSession session, String type, RealmModel realm) {
-        AuthenticationExecutionModel.Requirement requirement = AuthenticationExecutionModel.Requirement.REQUIRED;
-        setOrReplaceAuthenticationRequirement(session, realm, type, requirement, null);
-    }
-
-    public static void setAlternativeCredential(KeycloakSession session, String type, RealmModel realm) {
-        AuthenticationExecutionModel.Requirement requirement = AuthenticationExecutionModel.Requirement.ALTERNATIVE;
-        setOrReplaceAuthenticationRequirement(session, realm, type, requirement, null);
-    }
-
     public static void setOrReplaceAuthenticationRequirement(KeycloakSession session, RealmModel realm, String type, AuthenticationExecutionModel.Requirement requirement, AuthenticationExecutionModel.Requirement currentRequirement) {
         realm.getAuthenticationFlowsStream().forEach(flow -> realm.getAuthenticationExecutionsStream(flow.getId())
                 .filter(exe -> {
@@ -79,15 +73,15 @@ public static void setOrReplaceAuthenticationRequirement(KeycloakSession session
                 }));
     }
 
-     public static ConfigurableAuthenticatorFactory getConfigurableAuthenticatorFactory(KeycloakSession session, String providerId) {
-         ConfigurableAuthenticatorFactory factory = (AuthenticatorFactory)session.getKeycloakSessionFactory().getProviderFactory(Authenticator.class, providerId);
-         if (factory == null) {
-             factory = (FormActionFactory)session.getKeycloakSessionFactory().getProviderFactory(FormAction.class, providerId);
-         }
-         if (factory == null) {
-             factory = (ClientAuthenticatorFactory)session.getKeycloakSessionFactory().getProviderFactory(ClientAuthenticator.class, providerId);
-         }
-         return factory;
+    public static ConfigurableAuthenticatorFactory getConfigurableAuthenticatorFactory(KeycloakSession session, String providerId) {
+        ConfigurableAuthenticatorFactory factory = (AuthenticatorFactory)session.getKeycloakSessionFactory().getProviderFactory(Authenticator.class, providerId);
+        if (factory == null) {
+            factory = (FormActionFactory)session.getKeycloakSessionFactory().getProviderFactory(FormAction.class, providerId);
+        }
+        if (factory == null) {
+            factory = (ClientAuthenticatorFactory)session.getKeycloakSessionFactory().getProviderFactory(ClientAuthenticator.class, providerId);
+        }
+        return factory;
     }
 
     /**
@@ -115,14 +109,24 @@ public static boolean createOTPCredential(KeycloakSession session, RealmModel re
         return user.credentialManager().isValid(credential);
     }
 
-    public static void deleteOTPCredential(KeycloakSession session, RealmModel realm, UserModel user, String credentialId) {
-        CredentialProvider otpCredentialProvider = session.getProvider(CredentialProvider.class, "keycloak-otp");
-        boolean removed = otpCredentialProvider.deleteCredential(realm, user, credentialId);
+    /**
+     * Create RecoveryCodes credential either in userStorage or local storage (Keycloak DB)
+     */
+    public static void createRecoveryCodesCredential(KeycloakSession session, RealmModel realm, UserModel user, RecoveryAuthnCodesCredentialModel credentialModel, List<String> generatedCodes) {
+        var recoveryCodeCredentialProvider = session.getProvider(CredentialProvider.class, "keycloak-recovery-authn-codes");
+        String recoveryCodesJson;
+        try {
+            recoveryCodesJson =  JsonSerialization.writeValueAsString(generatedCodes);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+        UserCredentialModel recoveryCodesCredential = new UserCredentialModel("", credentialModel.getType(), recoveryCodesJson);
 
-        // This can usually happened when credential is stored in the userStorage. Propagate to "disable" credential in the userStorage
-        if (!removed) {
-            logger.debug("Removing OTP credential from userStorage");
-            user.credentialManager().disableCredentialType(OTPCredentialModel.TYPE);
+        boolean userStorageCreated = user.credentialManager().updateCredential(recoveryCodesCredential);
+        if (userStorageCreated) {
+            logger.debugf("Created RecoveryCodes credential for user '%s' in the user storage", user.getUsername());
+        } else {
+            recoveryCodeCredentialProvider.createCredential(realm, user, credentialModel);
         }
     }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/utils/EmailValidationUtil.java b/server-spi-private/src/main/java/org/keycloak/utils/EmailValidationUtil.java
index ecf34c89998b..7bd32e234415 100644
--- a/server-spi-private/src/main/java/org/keycloak/utils/EmailValidationUtil.java
+++ b/server-spi-private/src/main/java/org/keycloak/utils/EmailValidationUtil.java
@@ -40,7 +40,7 @@ public class EmailValidationUtil {
 
 
     public static boolean isValidEmail(String value) {
-        return isValidEmail(value, Config.scope("user-profile-declarative-user-profile").getInt(MAX_EMAIL_LOCAL_PART_LENGTH, MAX_LOCAL_PART_LENGTH));
+        return isValidEmail(value, Config.scope("user-profile", "declarative-user-profile").getInt(MAX_EMAIL_LOCAL_PART_LENGTH, MAX_LOCAL_PART_LENGTH));
     }
 
     public static boolean isValidEmail(String value, int maxEmailLocalPartLength) {
diff --git a/server-spi-private/src/main/java/org/keycloak/utils/StreamsUtil.java b/server-spi-private/src/main/java/org/keycloak/utils/StreamsUtil.java
index 96eeeeeb524c..d49cd70c2f5f 100644
--- a/server-spi-private/src/main/java/org/keycloak/utils/StreamsUtil.java
+++ b/server-spi-private/src/main/java/org/keycloak/utils/StreamsUtil.java
@@ -142,4 +142,19 @@ public int characteristics() {
             }
         }, false);
     }
+
+    /**
+     * This works around a bug in JDK 21 (but no longer in JDK 24) where a sorted stream has all its elements processed
+     * when used inside of a flatmap and a terminal operation like limit() is used outside of it.
+     * See StreamUtilTests.testSortedInsideOfFlatMapShouldRespectTerminalOperation for an example.
+     * Possible <a href="https://bugs.openjdk.org/browse/JDK-8196106">JDK-8196106</a> as the reference to the bug.
+     *
+     * @param <T> The type of the stream
+     * @param originalStream The original stream
+     * @return The stream that is lazily evaluating
+     */
+    public static <T> Stream<T> prepareSortedStreamToWorkInsideOfFlatMapWithTerminalOperations(Stream<T> originalStream) {
+        return StreamSupport.stream(originalStream.spliterator(), false);
+    }
+
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/validate/validators/UriValidator.java b/server-spi-private/src/main/java/org/keycloak/validate/validators/UriValidator.java
index f114ae85e80b..244797c5214a 100644
--- a/server-spi-private/src/main/java/org/keycloak/validate/validators/UriValidator.java
+++ b/server-spi-private/src/main/java/org/keycloak/validate/validators/UriValidator.java
@@ -163,7 +163,7 @@ public boolean validateUri(URI uri, String inputHint, ValidationContext context,
         // This cannot be moved higher because it acts on differently based on environment (e.g. sometimes it checks
         // scheme, sometimes it doesn't).
         if (requireValidUrl && valid) {
-            URL ignored = uri.toURL(); // throws an exception
+            uri.toURL(); // throws an exception
         }
 
         return valid;
diff --git a/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index 98fdd114f4d2..f7acfb1b0458 100755
--- a/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -56,6 +56,7 @@ org.keycloak.email.EmailSenderSpi
 org.keycloak.email.EmailTemplateSpi
 org.keycloak.executors.ExecutorsSpi
 org.keycloak.theme.ThemeSpi
+org.keycloak.theme.ThemeManagerSpi
 org.keycloak.tracing.TracingSpi
 org.keycloak.truststore.TruststoreSpi
 org.keycloak.connections.httpclient.HttpClientSpi
@@ -80,6 +81,7 @@ org.keycloak.transaction.TransactionManagerLookupSpi
 org.keycloak.credential.hash.PasswordHashSpi
 org.keycloak.credential.CredentialSpi
 org.keycloak.keys.PublicKeyStorageSpi
+org.keycloak.crl.CrlStorageSpi
 org.keycloak.keys.KeySpi
 org.keycloak.storage.DatastoreSpi
 org.keycloak.storage.role.RoleStorageProviderSpi
diff --git a/server-spi-private/src/test/java/org/keycloak/models/BrowserSecurityHeadersTest.java b/server-spi-private/src/test/java/org/keycloak/models/BrowserSecurityHeadersTest.java
index cb88f12d0289..a6948c7ae698 100644
--- a/server-spi-private/src/test/java/org/keycloak/models/BrowserSecurityHeadersTest.java
+++ b/server-spi-private/src/test/java/org/keycloak/models/BrowserSecurityHeadersTest.java
@@ -10,7 +10,6 @@
 import static org.keycloak.models.BrowserSecurityHeaders.X_CONTENT_TYPE_OPTIONS;
 import static org.keycloak.models.BrowserSecurityHeaders.X_FRAME_OPTIONS;
 import static org.keycloak.models.BrowserSecurityHeaders.X_ROBOTS_TAG;
-import static org.keycloak.models.BrowserSecurityHeaders.X_XSS_PROTECTION;
 import static org.keycloak.models.BrowserSecurityHeaders.realmDefaultHeaders;
 
 import java.util.Arrays;
@@ -52,7 +51,6 @@ public void testDefaultHeaders() {
                 CONTENT_SECURITY_POLICY_REPORT_ONLY,
                 X_CONTENT_TYPE_OPTIONS,
                 X_ROBOTS_TAG,
-                X_XSS_PROTECTION,
                 STRICT_TRANSPORT_SECURITY,
                 REFERRER_POLICY
         );
diff --git a/server-spi-private/src/test/java/org/keycloak/models/KeycloakModelUtilsTest.java b/server-spi-private/src/test/java/org/keycloak/models/KeycloakModelUtilsTest.java
index 0407257b96bd..bb77431d81da 100644
--- a/server-spi-private/src/test/java/org/keycloak/models/KeycloakModelUtilsTest.java
+++ b/server-spi-private/src/test/java/org/keycloak/models/KeycloakModelUtilsTest.java
@@ -25,9 +25,13 @@
 
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
 import java.util.stream.Stream;
+
+import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RealmModelDelegate;
 
 /**
  * @author <a href="mailto:daniel.fesenmeyer@bosch.io">Daniel Fesenmeyer</a>
@@ -67,6 +71,30 @@ public void parseClientRoleQualifier() {
         assertParsedRoleQualifier(clientIdAndRoleName, "my.client.id", "role-name");
     }
 
+    // Tests that count of client lookups during KeycloakModelUtils.getRoleFromString is limited (to prevent issues like DoS or OOM in case that incorrect configuration of the role mapper was provided)
+    @Test
+    public void testLimitCountOfClientLookupsDuringGetRoleFromString() {
+        AtomicInteger counter = new AtomicInteger(0);
+
+        RealmModel realm = new RealmModelDelegate(null) {
+
+            @Override
+            public ClientModel getClientByClientId(String clientId) {
+                counter.incrementAndGet();
+                return null;
+            }
+        };
+
+        String badRoleName = ".";
+        for (int i = 0 ; i < 16 ; i++) {
+            badRoleName = badRoleName + badRoleName;
+        }
+        Assert.assertEquals(65536, badRoleName.length());
+
+        Assert.assertNull(KeycloakModelUtils.getRoleFromString(realm, badRoleName));
+        Assert.assertEquals(KeycloakModelUtils.MAX_CLIENT_LOOKUPS_DURING_ROLE_RESOLVE, counter.get());
+    }
+
     @Test
     public void testSplitEscapedPath() {
         assertArrayEquals(new String[]{"parent", "child"}, KeycloakModelUtils.splitPath("/parent/child", true));
@@ -115,6 +143,7 @@ private static class GroupAdapterTest implements GroupModel {
         static boolean escapeSlashes = false;
 
         private String name;
+        private String description;
         private GroupModel parent;
 
         public GroupAdapterTest(String name, GroupModel parent) {
@@ -137,6 +166,16 @@ public void setName(String name) {
             this.name = name;
         }
 
+        @Override
+        public String getDescription() {
+            return description;
+        }
+
+        @Override
+        public void setDescription(String description) {
+            this.description = description;
+        }
+
         @Override
         public void setSingleAttribute(String name, String value) {
         }
diff --git a/server-spi-private/src/test/java/org/keycloak/policy/NotEmailPasswordPolicyProviderTest.java b/server-spi-private/src/test/java/org/keycloak/policy/NotEmailPasswordPolicyProviderTest.java
new file mode 100644
index 000000000000..ae78749461c1
--- /dev/null
+++ b/server-spi-private/src/test/java/org/keycloak/policy/NotEmailPasswordPolicyProviderTest.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.policy;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.keycloak.policy.NotEmailPasswordPolicyProvider;
+
+public class NotEmailPasswordPolicyProviderTest {
+
+    @Test
+    public void test() {
+        Assert.assertNull(new NotEmailPasswordPolicyProvider(null).validate("email", "password"));
+    }
+
+    @Test
+    public void testEquals() {
+        Assert.assertNotNull(new NotEmailPasswordPolicyProvider(null).validate("email", "email"));
+    }
+
+    @Test
+    public void testEqualsIgnoreCase() {
+        Assert.assertNotNull(new NotEmailPasswordPolicyProvider(null).validate("email", "EMAIL"));
+    }
+}
diff --git a/server-spi-private/src/test/java/org/keycloak/utils/StreamsUtilTest.java b/server-spi-private/src/test/java/org/keycloak/utils/StreamsUtilTest.java
index 9719a4451ebb..bf8161669c4f 100644
--- a/server-spi-private/src/test/java/org/keycloak/utils/StreamsUtilTest.java
+++ b/server-spi-private/src/test/java/org/keycloak/utils/StreamsUtilTest.java
@@ -101,4 +101,37 @@ public void testLimitOnClosingStream() {
         Assert.assertEquals(1, numberOfFetchedElements.get());
     }
 
+    @Test
+    public void testSortedInsideOfFlatMapShouldRespectTerminalOperation() {
+        AtomicInteger numberOfFetchedElements = new AtomicInteger();
+
+        Stream.of(new Object())
+                .flatMap(
+                        o -> Stream.of(1, 2, 3).peek(integer -> numberOfFetchedElements.incrementAndGet()))
+                .limit(1).forEach(NOOP);
+
+        Assert.assertEquals(1, numberOfFetchedElements.get());
+
+        numberOfFetchedElements.set(0);
+
+        Stream.of(new Object())
+                .flatMap(
+                        o -> Stream.of(1, 2, 3).sorted().peek(integer -> numberOfFetchedElements.incrementAndGet()))
+                .limit(1).forEach(NOOP);
+
+        // Expect actually 1, but always delivery 3 on JDK 21, but will work on JDK 24
+        // Assert.assertEquals(1, numberOfFetchedElements.get());
+
+        numberOfFetchedElements.set(0);
+
+        Stream.of(new Object())
+                .flatMap(
+                        o -> StreamsUtil.prepareSortedStreamToWorkInsideOfFlatMapWithTerminalOperations(Stream.of(1, 2, 3).sorted()).peek(integer -> numberOfFetchedElements.incrementAndGet()))
+                .limit(1).forEach(NOOP);
+
+        // With the workaround it is only 1 as expected
+        Assert.assertEquals(1, numberOfFetchedElements.get());
+
+    }
+
 }
diff --git a/server-spi/src/main/java/org/keycloak/component/ComponentModel.java b/server-spi/src/main/java/org/keycloak/component/ComponentModel.java
index 81d742781a4f..4fcbf7af8df5 100755
--- a/server-spi/src/main/java/org/keycloak/component/ComponentModel.java
+++ b/server-spi/src/main/java/org/keycloak/component/ComponentModel.java
@@ -99,12 +99,12 @@ public String get(String key, String defaultValue) {
 
     public int get(String key, int defaultValue) {
         String s = get(key);
-        return s != null ? Integer.valueOf(s) : defaultValue;
+        return s != null ? Integer.parseInt(s) : defaultValue;
     }
 
     public long get(String key, long defaultValue) {
         String s = get(key);
-        return s != null ? Long.valueOf(s) : defaultValue;
+        return s != null ? Long.parseLong(s) : defaultValue;
     }
 
     public boolean get(String key, boolean defaultValue) {
diff --git a/server-spi/src/main/java/org/keycloak/component/PrioritizedComponentModel.java b/server-spi/src/main/java/org/keycloak/component/PrioritizedComponentModel.java
index 2355184e5ab8..268921273fb0 100644
--- a/server-spi/src/main/java/org/keycloak/component/PrioritizedComponentModel.java
+++ b/server-spi/src/main/java/org/keycloak/component/PrioritizedComponentModel.java
@@ -41,7 +41,7 @@ public PrioritizedComponentModel() {
     public static int parsePriority(ComponentModel component) {
         String priority = component.getConfig().getFirst(PRIORITY);
         if (priority == null) return 0;
-        return Integer.valueOf(priority);
+        return Integer.parseInt(priority);
 
     }
 
diff --git a/server-spi/src/main/java/org/keycloak/credential/CredentialInputUpdater.java b/server-spi/src/main/java/org/keycloak/credential/CredentialInputUpdater.java
index 7414fbc18ff9..a4cf343a9d38 100644
--- a/server-spi/src/main/java/org/keycloak/credential/CredentialInputUpdater.java
+++ b/server-spi/src/main/java/org/keycloak/credential/CredentialInputUpdater.java
@@ -39,4 +39,15 @@ public interface CredentialInputUpdater {
      * @return a non-null {@link Stream} of credential types.
      */
     Stream<String> getDisableableCredentialTypesStream(RealmModel realm, UserModel user);
+
+    /**
+     * Returns a stream of {@link CredentialModel} instances managed by this provider for the given {@code user}.
+     *
+     * @param realm the realm
+     * @param user the user
+     * @return the credentials managed by this provider for the given {@code user}
+     */
+    default Stream<CredentialModel> getCredentials(RealmModel realm, UserModel user) {
+        return Stream.empty();
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/credential/CredentialModel.java b/server-spi/src/main/java/org/keycloak/credential/CredentialModel.java
index 0bf591a19981..2884e658b6b8 100755
--- a/server-spi/src/main/java/org/keycloak/credential/CredentialModel.java
+++ b/server-spi/src/main/java/org/keycloak/credential/CredentialModel.java
@@ -26,7 +26,6 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import org.keycloak.common.util.Base64;
 import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.util.JsonSerialization;
 
 /**
@@ -59,6 +58,7 @@ public class CredentialModel implements Serializable {
     public static final String CLIENT_CERT = "cert";
     public static final String KERBEROS = "kerberos";
 
+    public static final String USER_LABEL = "userLabel";
 
     private String id;
     private String type;
@@ -68,6 +68,8 @@ public class CredentialModel implements Serializable {
     private String secretData;
     private String credentialData;
 
+    private String federationLink;
+
     public CredentialModel shallowClone() {
         CredentialModel res = new CredentialModel();
         res.id = id;
@@ -76,6 +78,7 @@ public CredentialModel shallowClone() {
         res.createdDate = createdDate;
         res.secretData = secretData;
         res.credentialData = credentialData;
+        res.federationLink = federationLink;
         return res;
     }
 
@@ -296,6 +299,14 @@ public void setConfig(MultivaluedHashMap<String, String> config) {
         writeProperty("config", config, false);
     }
 
+    public void setFederationLink(String federationLink) {
+        this.federationLink = federationLink;
+    }
+
+    public String getFederationLink() {
+        return federationLink;
+    }
+
     private Map<String, Object> readMapFromJson(boolean secret) {
         String jsonStr = secret ? secretData : credentialData;
         if (jsonStr == null) {
diff --git a/server-spi/src/main/java/org/keycloak/credential/CredentialProvider.java b/server-spi/src/main/java/org/keycloak/credential/CredentialProvider.java
index 05fe6631ccb3..1856a7888854 100644
--- a/server-spi/src/main/java/org/keycloak/credential/CredentialProvider.java
+++ b/server-spi/src/main/java/org/keycloak/credential/CredentialProvider.java
@@ -53,4 +53,12 @@ default CredentialMetadata getCredentialMetadata(T credentialModel, CredentialTy
         credentialMetadata.setCredentialModel(credentialModel);
         return credentialMetadata;
     }
+
+    default boolean supportsCredentialType(CredentialModel credential) {
+        return supportsCredentialType(credential.getType());
+    }
+
+    default boolean supportsCredentialType(String type) {
+        return getType().equals(type);
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/http/HttpRequest.java b/server-spi/src/main/java/org/keycloak/http/HttpRequest.java
index 8e48721c4f5d..548593ec1c54 100644
--- a/server-spi/src/main/java/org/keycloak/http/HttpRequest.java
+++ b/server-spi/src/main/java/org/keycloak/http/HttpRequest.java
@@ -74,4 +74,13 @@ public interface HttpRequest {
      * @return the {@link UriInfo} for the current path
      */
     UriInfo getUri();
+
+    /**
+     * Returns false if the server is configured for trusted proxies and the
+     * request is from an untrusted source.
+     *
+     * @return false if the server is configured for trusted proxies and the
+     * request is from an untrusted source.
+     */
+    boolean isProxyTrusted();
 }
diff --git a/server-spi/src/main/java/org/keycloak/locale/LocaleSelectorProvider.java b/server-spi/src/main/java/org/keycloak/locale/LocaleSelectorProvider.java
index c957ef686ee9..c8824e6d8102 100644
--- a/server-spi/src/main/java/org/keycloak/locale/LocaleSelectorProvider.java
+++ b/server-spi/src/main/java/org/keycloak/locale/LocaleSelectorProvider.java
@@ -41,4 +41,8 @@ default Locale resolveLocale(RealmModel realm, UserModel user, Theme.Type themeT
         return resolveLocale(realm, user);
     }
 
+    default Locale resolveLocale(RealmModel realm, UserModel user, boolean ignoreAcceptLanguageHeader) {
+        return resolveLocale(realm, user);
+    }
+
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java b/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
index 9ac322ee77b8..8677b99e4d61 100644
--- a/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
@@ -39,8 +39,12 @@ public interface AuthenticatedClientSessionModel extends CommonClientSessionMode
 
     default int getStarted() {
         String started = getNote(STARTED_AT_NOTE);
-        // Fallback to 0 if "started" note is not available. This can happen for the offline sessions migrated from old version where "startedAt" note was not yet available
-        return started == null ? 0 : Integer.parseInt(started);
+        if (started == null) {
+            // Note can be null for offline sessions migrated from old version where "startedAt" note was not yet available
+            // Fallback to user session started for offline or 0
+            return getUserSession().isOffline() ? getUserSessionStarted() : 0;
+        }
+        return Integer.parseInt(started);
     }
 
     default int getUserSessionStarted() {
diff --git a/server-spi/src/main/java/org/keycloak/models/ClientProvider.java b/server-spi/src/main/java/org/keycloak/models/ClientProvider.java
index 1459d278cc75..e43e61af592d 100644
--- a/server-spi/src/main/java/org/keycloak/models/ClientProvider.java
+++ b/server-spi/src/main/java/org/keycloak/models/ClientProvider.java
@@ -19,10 +19,8 @@
 import org.keycloak.provider.Provider;
 import org.keycloak.storage.client.ClientLookupProvider;
 
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 /**
@@ -105,19 +103,19 @@ default ClientModel addClient(RealmModel realm, String clientId) {
     void removeClients(RealmModel realm);
 
     /**
-     * Assign clientScopes to the client. Add as default scopes (if parameter 'defaultScope' is true) 
+     * Assign clientScopes to the client. Add as default scopes (if parameter 'defaultScope' is true)
      * or optional scopes (if parameter 'defaultScope' is false)
-     * 
+     *
      * @param realm Realm.
      * @param client Client.
      * @param clientScopes to be assigned
-     * @param defaultScope if true the scopes are assigned as default, or optional in case of false 
+     * @param defaultScope if true the scopes are assigned as default, or optional in case of false
      */
     void addClientScopes(RealmModel realm, ClientModel client, Set<ClientScopeModel> clientScopes, boolean defaultScope);
 
     /**
-     * Unassign clientScope from the client. 
-     * 
+     * Unassign clientScope from the client.
+     *
      * @param realm Realm.
      * @param client Client.
      * @param clientScope to be unassigned
@@ -144,4 +142,5 @@ default ClientModel addClient(RealmModel realm, String clientId) {
      */
     @Deprecated
     Map<ClientModel, Set<String>> getAllRedirectUrisOfEnabledClients(RealmModel realm);
+
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/ClientScopeModel.java b/server-spi/src/main/java/org/keycloak/models/ClientScopeModel.java
index 3cdc02eedab3..6d17e448c465 100755
--- a/server-spi/src/main/java/org/keycloak/models/ClientScopeModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/ClientScopeModel.java
@@ -28,6 +28,11 @@
  */
 public interface ClientScopeModel extends ProtocolMapperContainerModel, ScopeContainerModel, OrderedModel {
 
+    /**
+     * The character separator used to specify values when the client scope is dynamic. For instance, {@code <scope>:<value>}.
+     */
+    String VALUE_SEPARATOR = ":";
+
     interface ClientScopeRemovedEvent extends ProviderEvent {
         ClientScopeModel getClientScope();
 
diff --git a/server-spi/src/main/java/org/keycloak/models/ClientScopeProvider.java b/server-spi/src/main/java/org/keycloak/models/ClientScopeProvider.java
index f147acd3f07e..b8bd71762473 100644
--- a/server-spi/src/main/java/org/keycloak/models/ClientScopeProvider.java
+++ b/server-spi/src/main/java/org/keycloak/models/ClientScopeProvider.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.models;
 
+import java.util.Map;
 import java.util.stream.Stream;
 import org.keycloak.provider.Provider;
 import org.keycloak.storage.clientscope.ClientScopeLookupProvider;
@@ -34,7 +35,7 @@ public interface ClientScopeProvider extends Provider, ClientScopeLookupProvider
 
     /**
      * Creates new client scope with given {@code name} to the given realm.
-     * Spaces in {@code name} will be replaced by underscore so that scope name 
+     * Spaces in {@code name} will be replaced by underscore so that scope name
      * can be used as value of scope parameter. The internal ID will be created automatically.
      * @param realm Realm owning this client scope.
      * @param name String name of the client scope.
@@ -47,7 +48,7 @@ default ClientScopeModel addClientScope(RealmModel realm, String name) {
 
     /**
      * Creates new client scope with given internal ID and {@code name} to the given realm.
-     * Spaces in {@code name} will be replaced by underscore so that scope name 
+     * Spaces in {@code name} will be replaced by underscore so that scope name
      * can be used as value of scope parameter.
      * @param realm Realm owning this client scope.
      * @param id Internal ID of the client scope or {@code null} if one is to be created by the underlying store
@@ -73,4 +74,21 @@ default ClientScopeModel addClientScope(RealmModel realm, String name) {
      * @param realm Realm.
      */
     void removeClientScopes(RealmModel realm);
+
+    /**
+     * Must retrieve all client scopes of the given realm that are use the given protocol.
+     *
+     * @param realm    the realm to retrieve the client scopes from.
+     * @param protocol the protocol expected from the clientScope
+     */
+    Stream<ClientScopeModel> getClientScopesByProtocol(RealmModel realm, String protocol);
+
+    /**
+     * Allows us to filter for scopes by specific attributes
+     *
+     * @param realm     Realm.
+     * @param searchMap a key-value map that holds the attribute names and values to search for.
+     * @param useOr     If the search-params should be combined with or-expressions or and-expressions
+     */
+    Stream<ClientScopeModel> getClientScopesByAttributes(RealmModel realm, Map<String, String> searchMap, boolean useOr);
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/ClientSessionContext.java b/server-spi/src/main/java/org/keycloak/models/ClientSessionContext.java
index e613ebcbcb60..13ea3f42a428 100644
--- a/server-spi/src/main/java/org/keycloak/models/ClientSessionContext.java
+++ b/server-spi/src/main/java/org/keycloak/models/ClientSessionContext.java
@@ -40,6 +40,11 @@ public interface ClientSessionContext {
      */
     Stream<ClientScopeModel> getClientScopesStream();
 
+    /**
+     * @return true if offline token is requested
+     */
+    boolean isOfflineTokenRequested();
+
     /**
      * Returns all roles including composite ones as a stream.
      * @return Stream of {@link RoleModel}. Never returns {@code null}.
diff --git a/server-spi/src/main/java/org/keycloak/models/GroupModel.java b/server-spi/src/main/java/org/keycloak/models/GroupModel.java
index 22d3ab97a743..2652d3502237 100755
--- a/server-spi/src/main/java/org/keycloak/models/GroupModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/GroupModel.java
@@ -193,6 +193,10 @@ public String getPreviousPath() {
 
     void setName(String name);
 
+    String getDescription();
+
+    void setDescription(String description);
+
     /**
      * Set single value of specified attribute. Remove all other existing values
      *
diff --git a/server-spi/src/main/java/org/keycloak/models/IdentityProviderStorageProvider.java b/server-spi/src/main/java/org/keycloak/models/IdentityProviderStorageProvider.java
index 42ef3d8086f7..0d411405e236 100644
--- a/server-spi/src/main/java/org/keycloak/models/IdentityProviderStorageProvider.java
+++ b/server-spi/src/main/java/org/keycloak/models/IdentityProviderStorageProvider.java
@@ -198,7 +198,7 @@ default Stream<IdentityProviderModel> getForLogin(FetchMode mode, String organiz
      * otherwise.
      */
     default boolean isIdentityFederationEnabled() {
-        return count() > 0;
+        return getAllStream(Map.of(), 0, 1).findFirst().isPresent();
     }
 
     /**
diff --git a/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java b/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
index bc862f746f85..04d9b9f8bdcf 100755
--- a/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
+++ b/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
@@ -87,6 +87,10 @@ default Locale resolveLocale(UserModel user, Theme.Type themeType) {
         return resolveLocale(user);
     }
 
+    default Locale resolveLocale(UserModel user, boolean ignoreAcceptLanguageHeader) {
+        return resolveLocale(user);
+    }
+
     /**
      * Get current AuthenticationSessionModel, can be null out of the AuthenticationSession context.
      *
@@ -110,7 +114,20 @@ default Locale resolveLocale(UserModel user, Theme.Type themeType) {
 
     void setUserSession(UserSessionModel session);
 
+    /**
+     * Returns a {@link Token} representing the bearer token used to authenticate and authorize the current request.
+     *
+     * @return the bearer token
+     */
     Token getBearerToken();
 
     void setBearerToken(Token token);
+
+    /**
+     * Returns the {@link UserModel} bound to this context. The user is first resolved from the {@link #getBearerToken()} set to this
+     * context, if any. Otherwise, it will be resolved from the {@link #getUserSession()} set to this context, if any.
+     *
+     * @return the {@link UserModel} bound to this context.
+     */
+    UserModel getUser();
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/KeycloakSessionTask.java b/server-spi/src/main/java/org/keycloak/models/KeycloakSessionTask.java
index 429a9cb02a41..72330cf6319d 100644
--- a/server-spi/src/main/java/org/keycloak/models/KeycloakSessionTask.java
+++ b/server-spi/src/main/java/org/keycloak/models/KeycloakSessionTask.java
@@ -26,10 +26,6 @@ public interface KeycloakSessionTask {
 
     void run(KeycloakSession session);
 
-    default boolean useExistingSession() {
-        return false;
-    }
-
     /**
      * @return Details about the task. Can be useful for logging purposes
      */
diff --git a/server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java b/server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java
index c5e5f4222b28..95413ff0dafe 100644
--- a/server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java
+++ b/server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java
@@ -24,6 +24,12 @@ public class ModelDuplicateException extends ModelException {
 
     private String duplicateFieldName;
 
+    /**
+     * Default constructor
+     *
+     * @deprecated use a variant with a message instead
+     */
+    @Deprecated
     public ModelDuplicateException() {
     }
 
diff --git a/server-spi/src/main/java/org/keycloak/models/OrganizationDomainModel.java b/server-spi/src/main/java/org/keycloak/models/OrganizationDomainModel.java
index 45db1facbaef..c9a1ea3d44f0 100644
--- a/server-spi/src/main/java/org/keycloak/models/OrganizationDomainModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/OrganizationDomainModel.java
@@ -26,6 +26,12 @@
  */
 public class OrganizationDomainModel implements Serializable {
 
+    /**
+     * Value used to link an identity provider with all domains from the organization. If the user's email domain matches
+     * any of the organization domains, automatic redirection to the identity will be performed.
+     */
+    public static final String ANY_DOMAIN = "ANY";
+
     private final String name;
     private final boolean verified;
 
diff --git a/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java b/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
index b60011af64ba..67deb28a280d 100755
--- a/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
+++ b/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.models;
 
+import org.jboss.logging.Logger;
 import org.keycloak.policy.PasswordPolicyConfigException;
 import org.keycloak.policy.PasswordPolicyProvider;
 
@@ -31,6 +32,8 @@
  */
 public class PasswordPolicy implements Serializable {
 
+    protected static final Logger logger = Logger.getLogger(PasswordPolicy.class);
+
     public static final String HASH_ALGORITHM_ID = "hashAlgorithm";
 
     public static final String HASH_ITERATIONS_ID = "hashIterations";
@@ -39,8 +42,10 @@ public class PasswordPolicy implements Serializable {
 
     public static final String FORCE_EXPIRED_ID = "forceExpiredPasswordChange";
 
+    @Deprecated
     public static final int RECOVERY_CODES_WARNING_THRESHOLD_DEFAULT = 4;
 
+    @Deprecated
     public static final String RECOVERY_CODES_WARNING_THRESHOLD_ID = "recoveryCodesWarningThreshold";
 
     public static final String MAX_AUTH_AGE_ID = "maxAuthAge";
@@ -115,8 +120,10 @@ public int getDaysToExpirePassword() {
         }
     }
 
+    @Deprecated
     public int getRecoveryCodesWarningThreshold() {
         if (policyConfig.containsKey(RECOVERY_CODES_WARNING_THRESHOLD_ID)) {
+            logger.warnf("It is deprecated to use Warning Threshold password policy. Please use the configuration on Recovery Authentication Codes required action instead.");
             return getPolicyConfig(RECOVERY_CODES_WARNING_THRESHOLD_ID);
         } else {
             return 4;
diff --git a/server-spi/src/main/java/org/keycloak/models/RealmModel.java b/server-spi/src/main/java/org/keycloak/models/RealmModel.java
index b2bc786a54ba..a2246a18f16e 100755
--- a/server-spi/src/main/java/org/keycloak/models/RealmModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/RealmModel.java
@@ -149,6 +149,17 @@ default Boolean getAttribute(String name, Boolean defaultValue) {
         String v = getAttribute(name);
         return v != null && !v.isEmpty() ? Boolean.valueOf(v) : defaultValue;
     }
+    default <V extends Enum<V>> V getAttribute(String name, Class<V> enumClass, V defaultValue) {
+        String value = getAttribute(name);
+        if (value == null) {
+            return defaultValue;
+        }
+        try {
+            return Enum.valueOf(enumClass, value);
+        } catch (IllegalArgumentException e) {
+            return defaultValue;
+        }
+    }
     Map<String, String> getAttributes();
 
     //--- brute force settings
diff --git a/server-spi/src/main/java/org/keycloak/models/SingleUseObjectProvider.java b/server-spi/src/main/java/org/keycloak/models/SingleUseObjectProvider.java
index cebc878c328b..4126e0d3e0f4 100644
--- a/server-spi/src/main/java/org/keycloak/models/SingleUseObjectProvider.java
+++ b/server-spi/src/main/java/org/keycloak/models/SingleUseObjectProvider.java
@@ -51,7 +51,7 @@ public interface SingleUseObjectProvider extends Provider {
 
     /**
      * This method returns data just if removal was successful. Implementation should guarantee that "remove" is single-use. So if
-     * 2 threads (even on different cluster nodes or on different cross-dc nodes) calls "remove(123)" concurrently, then just one of them
+     * 2 threads (even on different cluster nodes or on different multi-site nodes) calls "remove(123)" concurrently, then just one of them
      * is allowed to succeed and return data back. It can't happen that both will succeed.
      *
      * @param key String
diff --git a/server-spi/src/main/java/org/keycloak/models/SubjectCredentialManager.java b/server-spi/src/main/java/org/keycloak/models/SubjectCredentialManager.java
index 2ad85d3cbcd2..4787b15a2615 100644
--- a/server-spi/src/main/java/org/keycloak/models/SubjectCredentialManager.java
+++ b/server-spi/src/main/java/org/keycloak/models/SubjectCredentialManager.java
@@ -80,6 +80,24 @@ default boolean isValid(CredentialInput... inputs) {
      */
     Stream<CredentialModel> getStoredCredentialsStream();
 
+    /**
+     * Returns a stream consisting of the federated credentials.
+     *
+     * @return a stream consisting of the federated credentials
+     */
+    default Stream<CredentialModel> getFederatedCredentialsStream() {
+        return Stream.empty();
+    }
+
+    /**
+     * Returns a stream consisting of both local and federated credentials.
+     *
+     * @return a stream of both local and federated credentials
+     */
+    default Stream<CredentialModel> getCredentials() {
+        return Stream.concat(getStoredCredentialsStream(), getFederatedCredentialsStream());
+    }
+
     /**
      * Read stored credentials by type as a stream.
      */
diff --git a/server-spi/src/main/java/org/keycloak/models/ThemeManager.java b/server-spi/src/main/java/org/keycloak/models/ThemeManager.java
index da0cce2d539f..267546a82568 100644
--- a/server-spi/src/main/java/org/keycloak/models/ThemeManager.java
+++ b/server-spi/src/main/java/org/keycloak/models/ThemeManager.java
@@ -1,11 +1,12 @@
 package org.keycloak.models;
 
+import org.keycloak.provider.Provider;
 import org.keycloak.theme.Theme;
 
 import java.io.IOException;
 import java.util.Set;
 
-public interface ThemeManager {
+public interface ThemeManager extends Provider {
 
     /**
      * Returns the theme for the specified type. The theme is determined by the theme selector.
diff --git a/server-spi/src/main/java/org/keycloak/models/UserModel.java b/server-spi/src/main/java/org/keycloak/models/UserModel.java
index 211e06f884fd..5148838b3706 100755
--- a/server-spi/src/main/java/org/keycloak/models/UserModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/UserModel.java
@@ -45,6 +45,8 @@ public interface UserModel extends RoleMapperModel {
     String SEARCH = "keycloak.session.realm.users.query.search";
     String EXACT = "keycloak.session.realm.users.query.exact";
     String DISABLED_REASON = "disabledReason";
+    //attribute name used to mark a temporary admin user/service account as temporary
+    String IS_TEMP_ADMIN_ATTR_NAME = "is_temporary_admin";
 
     Comparator<UserModel> COMPARE_BY_USERNAME = Comparator.comparing(UserModel::getUsername, String.CASE_INSENSITIVE_ORDER);
 
diff --git a/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java b/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
index 9693debbbe8e..934da3c2a5c8 100755
--- a/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
@@ -51,6 +51,11 @@ public interface UserSessionModel {
 
     String getLoginUsername();
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     String getIpAddress();
 
     String getAuthMethod();
diff --git a/server-spi/src/main/java/org/keycloak/models/WebAuthnPolicy.java b/server-spi/src/main/java/org/keycloak/models/WebAuthnPolicy.java
index a9cbbd3ade3f..72456f2a981a 100644
--- a/server-spi/src/main/java/org/keycloak/models/WebAuthnPolicy.java
+++ b/server-spi/src/main/java/org/keycloak/models/WebAuthnPolicy.java
@@ -41,6 +41,7 @@ public class WebAuthnPolicy implements Serializable {
     protected boolean avoidSameAuthenticatorRegister = false;
     protected List<String> acceptableAaguids;
     protected List<String> extraOrigins;
+    protected Boolean passkeysEnabled; // only used for passwordless
 
     public WebAuthnPolicy() {
     }
@@ -139,4 +140,12 @@ public List<String> getExtraOrigins(){
     public void setExtraOrigins(List<String> extraOrigins) {
         this.extraOrigins = extraOrigins;
     }
+
+    public Boolean isPasskeysEnabled() {
+        return passkeysEnabled;
+    }
+
+    public void setPasskeysEnabled(Boolean passkeysEnabled) {
+        this.passkeysEnabled = passkeysEnabled;
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/credential/PasswordCredentialModel.java b/server-spi/src/main/java/org/keycloak/models/credential/PasswordCredentialModel.java
index b086565d7b4b..2f24244e92b1 100644
--- a/server-spi/src/main/java/org/keycloak/models/credential/PasswordCredentialModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/credential/PasswordCredentialModel.java
@@ -1,5 +1,7 @@
 package org.keycloak.models.credential;
 
+import static org.keycloak.utils.StringUtil.isBlank;
+
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.models.credential.dto.PasswordCredentialData;
 import org.keycloak.models.credential.dto.PasswordSecretData;
@@ -48,9 +50,9 @@ public static PasswordCredentialModel createFromValues(String algorithm, byte[]
 
     public static PasswordCredentialModel createFromCredentialModel(CredentialModel credentialModel) {
         try {
-            PasswordCredentialData credentialData = JsonSerialization.readValue(credentialModel.getCredentialData(),
+            PasswordCredentialData credentialData = isBlank(credentialModel.getCredentialData()) ? null : JsonSerialization.readValue(credentialModel.getCredentialData(),
                     PasswordCredentialData.class);
-            PasswordSecretData secretData = JsonSerialization.readValue(credentialModel.getSecretData(), PasswordSecretData.class);
+            PasswordSecretData secretData = isBlank(credentialModel.getSecretData()) ? null : JsonSerialization.readValue(credentialModel.getSecretData(), PasswordSecretData.class);
             PasswordCredentialModel passwordCredentialModel = new PasswordCredentialModel(credentialData, secretData);
             passwordCredentialModel.setCreatedDate(credentialModel.getCreatedDate());
             passwordCredentialModel.setCredentialData(credentialModel.getCredentialData());
diff --git a/server-spi/src/main/java/org/keycloak/models/credential/RecoveryAuthnCodesCredentialModel.java b/server-spi/src/main/java/org/keycloak/models/credential/RecoveryAuthnCodesCredentialModel.java
index 5bbd84aae2ce..305d7f570b9a 100644
--- a/server-spi/src/main/java/org/keycloak/models/credential/RecoveryAuthnCodesCredentialModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/credential/RecoveryAuthnCodesCredentialModel.java
@@ -4,6 +4,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 
+import org.keycloak.common.util.Base64;
 import org.keycloak.credential.CredentialMetadata;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.models.PasswordPolicy;
@@ -64,10 +65,10 @@ public static RecoveryAuthnCodesCredentialModel createFromValues(List<String> or
         try {
             List<RecoveryAuthnCodeRepresentation> recoveryCodes = IntStream.range(0, originalGeneratedCodes.size())
                     .mapToObj(i -> new RecoveryAuthnCodeRepresentation(i + 1,
-                            RecoveryAuthnCodesUtils.hashRawCode(originalGeneratedCodes.get(i))))
+                            Base64.encodeBytes(RecoveryAuthnCodesUtils.hashRawCode(originalGeneratedCodes.get(i)))))
                     .collect(Collectors.toList());
             secretData = new RecoveryAuthnCodesSecretData(recoveryCodes);
-            credentialData = new RecoveryAuthnCodesCredentialData(RecoveryAuthnCodesUtils.NUM_HASH_ITERATIONS,
+            credentialData = new RecoveryAuthnCodesCredentialData(null,
                     RecoveryAuthnCodesUtils.NOM_ALGORITHM_TO_HASH, recoveryCodes.size(), recoveryCodes.size());
             model = new RecoveryAuthnCodesCredentialModel(credentialData, secretData);
             model.setCredentialData(JsonSerialization.writeValueAsString(credentialData));
diff --git a/server-spi/src/main/java/org/keycloak/models/credential/dto/RecoveryAuthnCodesCredentialData.java b/server-spi/src/main/java/org/keycloak/models/credential/dto/RecoveryAuthnCodesCredentialData.java
index 3470f51828f7..4f4a5bd7fe8c 100644
--- a/server-spi/src/main/java/org/keycloak/models/credential/dto/RecoveryAuthnCodesCredentialData.java
+++ b/server-spi/src/main/java/org/keycloak/models/credential/dto/RecoveryAuthnCodesCredentialData.java
@@ -5,14 +5,14 @@
 
 public class RecoveryAuthnCodesCredentialData {
 
-    private final int hashIterations;
+    private final Integer hashIterations;
     private final String algorithm;
 
     private int totalCodes;
     private int remainingCodes;
 
     @JsonCreator
-    public RecoveryAuthnCodesCredentialData(@JsonProperty("hashIterations") int hashIterations,
+    public RecoveryAuthnCodesCredentialData(@JsonProperty("hashIterations") Integer hashIterations,
             @JsonProperty("algorithm") String algorithm, @JsonProperty("remaining") int remainingCodes,
                                             @JsonProperty("total") int totalCodes) {
         this.hashIterations = hashIterations;
@@ -21,7 +21,7 @@ public RecoveryAuthnCodesCredentialData(@JsonProperty("hashIterations") int hash
         this.totalCodes = totalCodes;
     }
 
-    public int getHashIterations() {
+    public Integer getHashIterations() {
         return hashIterations;
     }
 
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java b/server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java
index 6cfda6768e0c..8e747621737e 100644
--- a/server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java
+++ b/server-spi/src/main/java/org/keycloak/models/utils/RecoveryAuthnCodesUtils.java
@@ -1,11 +1,19 @@
 package org.keycloak.models.utils;
 
+import java.io.IOException;
+import java.security.MessageDigest;
+import java.util.Optional;
 import java.util.function.Supplier;
+
+import org.jboss.logging.Logger;
 import org.keycloak.common.util.Base64;
 import org.keycloak.common.util.SecretGenerator;
+import org.keycloak.credential.CredentialModel;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.crypto.JavaAlgorithm;
 import org.keycloak.jose.jws.crypto.HashUtils;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
 
 import java.nio.charset.StandardCharsets;
 import java.util.List;
@@ -15,27 +23,32 @@
 
 public class RecoveryAuthnCodesUtils {
 
-    private static final int QUANTITY_OF_CODES_TO_GENERATE = 12;
+    private static final Logger logger = Logger.getLogger(RecoveryAuthnCodesUtils.class);
+
+    public static final int QUANTITY_OF_CODES_TO_GENERATE = 12;
     private static final int CODE_LENGTH = 12;
     public static final char[] UPPERNUM = "ABCDEFGHIJKLMNPQRSTUVWXYZ123456789".toCharArray();
     private static final SecretGenerator SECRET_GENERATOR = SecretGenerator.getInstance();
-    public static final String NOM_ALGORITHM_TO_HASH = Algorithm.RS512;
-    public static final int NUM_HASH_ITERATIONS = 1;
+    public static final String NOM_ALGORITHM_TO_HASH = JavaAlgorithm.SHA512;
     public static final String RECOVERY_AUTHN_CODES_INPUT_DEFAULT_ERROR_MESSAGE = "recovery-codes-error-invalid";
     public static final String FIELD_RECOVERY_CODE_IN_BROWSER_FLOW = "recoveryCodeInput";
 
-    public static String hashRawCode(String rawGeneratedCode) {
+    public static byte[] hashRawCode(String rawGeneratedCode) {
         Objects.requireNonNull(rawGeneratedCode, "rawGeneratedCode cannot be null");
-
-        byte[] rawCodeHashedAsBytes = HashUtils.hash(JavaAlgorithm.getJavaAlgorithmForHash(NOM_ALGORITHM_TO_HASH),
-                rawGeneratedCode.getBytes(StandardCharsets.UTF_8));
-
-        return Base64.encodeBytes(rawCodeHashedAsBytes);
+        // If we allow the algorithm to be truly configurable, we should make sure that it works
+        // with both `SHA-512` as well as `RS512` (which was used in the versions prior to 26.2)
+        return HashUtils.hash(NOM_ALGORITHM_TO_HASH, rawGeneratedCode.getBytes(StandardCharsets.UTF_8));
     }
 
     public static boolean verifyRecoveryCodeInput(String rawInputRecoveryCode, String hashedSavedRecoveryCode) {
-        String hashedInputBackupCode = hashRawCode(rawInputRecoveryCode);
-        return (hashedInputBackupCode.equals(hashedSavedRecoveryCode));
+        byte[] hashedInputBackupCode = hashRawCode(rawInputRecoveryCode);
+        try {
+            byte[] savedCode = Base64.decode(hashedSavedRecoveryCode);
+            return MessageDigest.isEqual(hashedInputBackupCode, savedCode);
+        } catch (IOException ioe) {
+            logger.warnf("Error when decoding saved recovery code", ioe);
+            return false;
+        }
     }
 
     public static List<String> generateRawCodes() {
@@ -43,4 +56,17 @@ public static List<String> generateRawCodes() {
         return Stream.generate(code).limit(QUANTITY_OF_CODES_TO_GENERATE).collect(Collectors.toList());
     }
 
+    /**
+     * Checks the user storage for the credential. If not found it will look for the credential in the local storage
+     *
+     * @param user - User model
+     * @return - a optional  credential model
+     */
+    public static Optional<CredentialModel> getCredential(UserModel user) {
+        return user.credentialManager()
+                .getFederatedCredentialsStream()
+                .filter(c -> RecoveryAuthnCodesCredentialModel.TYPE.equals(c.getType()))
+                .findFirst()
+                .or(() -> user.credentialManager().getStoredCredentialsByTypeStream(RecoveryAuthnCodesCredentialModel.TYPE).findFirst());
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/organization/OrganizationProvider.java b/server-spi/src/main/java/org/keycloak/organization/OrganizationProvider.java
index ab40c2d7cf93..b117f49689ba 100644
--- a/server-spi/src/main/java/org/keycloak/organization/OrganizationProvider.java
+++ b/server-spi/src/main/java/org/keycloak/organization/OrganizationProvider.java
@@ -96,13 +96,36 @@ default Stream<OrganizationModel> getAllStream() {
     /**
      * Returns all organizations in the realm filtered according to the specified parameters.
      *
-     * @param attributes a {@code Map} containig the attributes (name/value) that must match organization attributes.
+     * @param attributes a {@code Map} containing the attributes (name/value) that must match organization attributes.
      * @param first the position of the first result to be processed (pagination offset). Ignored if negative or {@code null}.
      * @param max the maximum number of results to be returned. Ignored if negative or {@code null}.
      * @return a {@link Stream} of the matched organizations. Never returns {@code null}.
      */
     Stream<OrganizationModel> getAllStream(Map<String, String> attributes, Integer first, Integer max);
 
+    /**
+     * Returns the number of organizations in the realm filtered according to the specified parameters.
+     *
+     * @param search a {@code String} representing either an organization name or domain.
+     * @param exact if {@code true}, the organizations will be searched using exact match for the {@code search} param - i.e.
+     *              either the organization name or one of its domains must match exactly the {@code search} param. If false,
+     *              the method returns all organizations whose name or (domains) partially match the {@code search} param.
+     * @return the number matched organizations.
+     */
+    default long count(String search, Boolean exact) {
+        return getAllStream(search, exact, null, null).count();
+    }
+
+    /**
+     * Returns the number of organizations in the realm filtered according to the specified parameters.
+     *
+     * @param attributes a {@code Map} containing the attributes (name/value) that must match organization attributes.
+     * @return the number matched organizations.
+     */
+    default long count(Map<String, String> attributes) {
+        return getAllStream(attributes, null, null).count();
+    }
+
     /**
      * Removes the given organization from the realm together with the data associated with it, e.g. its members etc.
      *
diff --git a/server-spi/src/main/java/org/keycloak/provider/ProviderConfigPropertyNameNotUniqueException.java b/server-spi/src/main/java/org/keycloak/provider/ProviderConfigPropertyNameNotUniqueException.java
new file mode 100644
index 000000000000..f2e49e2c45ef
--- /dev/null
+++ b/server-spi/src/main/java/org/keycloak/provider/ProviderConfigPropertyNameNotUniqueException.java
@@ -0,0 +1,15 @@
+package org.keycloak.provider;
+
+import org.keycloak.models.ModelException;
+
+/**
+ * Exception thrown when a provider configuration property name is not unique.
+ * This is used to indicate that a property with the same name already exists
+ * in the configuration, which violates the uniqueness constraint.
+ */
+public class ProviderConfigPropertyNameNotUniqueException extends ModelException {
+
+  public ProviderConfigPropertyNameNotUniqueException(String message) {
+    super(message);
+  }
+}
diff --git a/server-spi/src/main/java/org/keycloak/provider/ProviderConfigurationBuilder.java b/server-spi/src/main/java/org/keycloak/provider/ProviderConfigurationBuilder.java
index 8bbd4666b77b..20a2176c67d2 100644
--- a/server-spi/src/main/java/org/keycloak/provider/ProviderConfigurationBuilder.java
+++ b/server-spi/src/main/java/org/keycloak/provider/ProviderConfigurationBuilder.java
@@ -18,8 +18,10 @@
 package org.keycloak.provider;
 
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Set;
 
 /**
  * Builds a list of ProviderConfigProperty instances.
@@ -30,6 +32,7 @@
 public class ProviderConfigurationBuilder {
 
     private List<ProviderConfigProperty> properties = new LinkedList<>();
+    private Set<String> propertyNames = new HashSet<>();
 
     private ProviderConfigurationBuilder() {
     }
@@ -43,7 +46,7 @@ public ProviderConfigPropertyBuilder property() {
     }
 
     public ProviderConfigurationBuilder property(ProviderConfigProperty property) {
-        properties.add(property);
+        add(property);
         return this;
     }
 
@@ -51,13 +54,13 @@ public ProviderConfigurationBuilder property(String name, String label, String h
         ProviderConfigProperty property = new ProviderConfigProperty(name, label, helpText, type, defaultValue);
         property.setOptions(options);
         property.setSecret(secret);
-        properties.add(property);
+        add(property);
         return this;
     }
     public ProviderConfigurationBuilder property(String name, String label, String helpText, String type, Object defaultValue, List<String> options) {
         ProviderConfigProperty property = new ProviderConfigProperty(name, label, helpText, type, defaultValue);
         property.setOptions(options);
-        properties.add(property);
+        add(property);
         return this;
     }
 
@@ -195,10 +198,18 @@ public ProviderConfigurationBuilder add() {
             property.setOptions(options);
             property.setSecret(secret);
             property.setRequired(required);
-            ProviderConfigurationBuilder.this.properties.add(property);
+            ProviderConfigurationBuilder.this.add(property);
             return ProviderConfigurationBuilder.this;
         }
 
     }
 
+  private boolean add(ProviderConfigProperty property) {
+    String name = property.getName();
+    if (!propertyNames.add(name)) {
+      throw new ProviderConfigPropertyNameNotUniqueException("ProviderConfigProperty with name '" + name + "' already exists.");
+    }
+    return properties.add(property);
+  }
+
 }
diff --git a/server-spi/src/main/java/org/keycloak/services/clientpolicy/ClientPolicyEvent.java b/server-spi/src/main/java/org/keycloak/services/clientpolicy/ClientPolicyEvent.java
index 4cc8779a6213..a9ab46a42174 100644
--- a/server-spi/src/main/java/org/keycloak/services/clientpolicy/ClientPolicyEvent.java
+++ b/server-spi/src/main/java/org/keycloak/services/clientpolicy/ClientPolicyEvent.java
@@ -51,6 +51,7 @@ public enum ClientPolicyEvent {
     DEVICE_AUTHORIZATION_REQUEST,
     DEVICE_TOKEN_REQUEST,
     DEVICE_TOKEN_RESPONSE,
+    TOKEN_EXCHANGE_REQUEST,
     RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST,
     RESOURCE_OWNER_PASSWORD_CREDENTIALS_RESPONSE,
 
diff --git a/server-spi/src/main/java/org/keycloak/sessions/AuthenticationSessionProvider.java b/server-spi/src/main/java/org/keycloak/sessions/AuthenticationSessionProvider.java
index 9414070417c4..d3a0f18fb758 100644
--- a/server-spi/src/main/java/org/keycloak/sessions/AuthenticationSessionProvider.java
+++ b/server-spi/src/main/java/org/keycloak/sessions/AuthenticationSessionProvider.java
@@ -18,7 +18,6 @@
 package org.keycloak.sessions;
 
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.provider.Provider;
 
@@ -98,8 +97,10 @@ public interface AuthenticationSessionProvider extends Provider {
      * @param compoundId {@code AuthenticationSessionCompoundId} The method has no effect if {@code null}.
      * @param authNotesFragment {@code Map<String, String>} Map with authNote values.
      * Auth note is removed if the corresponding value in the map is {@code null}. Map itself can't be {@code null}.
+     * @deprecated For removal in Keycloak 27
      */
-    void updateNonlocalSessionAuthNotes(AuthenticationSessionCompoundId compoundId, Map<String, String> authNotesFragment);
+    @Deprecated(since = "26.3", forRemoval = true)
+    default void updateNonlocalSessionAuthNotes(AuthenticationSessionCompoundId compoundId, Map<String, String> authNotesFragment) {}
 
     default void migrate(String modelVersion) {
     }
diff --git a/server-spi/src/main/java/org/keycloak/theme/Theme.java b/server-spi/src/main/java/org/keycloak/theme/Theme.java
index e01bdf3be312..b3f5396102d4 100755
--- a/server-spi/src/main/java/org/keycloak/theme/Theme.java
+++ b/server-spi/src/main/java/org/keycloak/theme/Theme.java
@@ -30,7 +30,8 @@
  */
 public interface Theme {
 
-    public static final String ACCOUNT_RESOURCE_PROVIDER_KEY = "accountResourceProvider";
+    String ACCOUNT_RESOURCE_PROVIDER_KEY = "accountResourceProvider";
+    String CONTENT_HASH_PATTERN = "contentHashPattern";
 
     enum Type { LOGIN, ACCOUNT, ADMIN, EMAIL, WELCOME, COMMON };
 
@@ -83,4 +84,22 @@ enum Type { LOGIN, ACCOUNT, ADMIN, EMAIL, WELCOME, COMMON };
 
     Properties getProperties() throws IOException;
 
+    /**
+     * Check if the given path contains a content hash.
+     * If a resource is requested from this path, and it has a content hash, this guarantees that if the file
+     * exists in two versions of the theme, it will contain the same contents.
+     * With this guarantee, a different version of Keycloak can return the same contents even if a caller asks for
+     * a different version of Keycloak.
+     *
+     * @param path path to check for a content hash
+     */
+    default boolean hasContentHash(String path) throws IOException {
+        Object contentHashPattern = getProperties().get(CONTENT_HASH_PATTERN);
+        if (contentHashPattern != null) {
+            return path.matches(contentHashPattern.toString());
+        } else {
+            return false;
+        }
+    }
+
 }
diff --git a/server-spi/src/main/java/org/keycloak/urls/UrlType.java b/server-spi/src/main/java/org/keycloak/urls/UrlType.java
index b9367162b2ac..460423e2a253 100644
--- a/server-spi/src/main/java/org/keycloak/urls/UrlType.java
+++ b/server-spi/src/main/java/org/keycloak/urls/UrlType.java
@@ -2,6 +2,11 @@
 
 public enum UrlType {
 
-    FRONTEND, BACKEND, ADMIN, LOCAL_ADMIN
+    FRONTEND, BACKEND, ADMIN,
+    /**
+     * @deprecated to be removed
+     */
+    @Deprecated
+    LOCAL_ADMIN
 
 }
diff --git a/server-spi/src/main/java/org/keycloak/userprofile/AttributeMetadata.java b/server-spi/src/main/java/org/keycloak/userprofile/AttributeMetadata.java
index 016e0ec7f322..17ce4994fffd 100644
--- a/server-spi/src/main/java/org/keycloak/userprofile/AttributeMetadata.java
+++ b/server-spi/src/main/java/org/keycloak/userprofile/AttributeMetadata.java
@@ -24,6 +24,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
 
@@ -52,7 +53,7 @@ public class AttributeMetadata {
     private Map<String, Object> annotations;
     private int guiOrder;
     private boolean multivalued;
-
+    private Function<AttributeContext, Map<String, Object>> annotationDecorator = (c) -> c.getMetadata().getAnnotations();
 
     AttributeMetadata(String attributeName, int guiOrder) {
         this(attributeName, guiOrder, ALWAYS_TRUE, ALWAYS_TRUE, ALWAYS_TRUE, ALWAYS_TRUE);
@@ -225,6 +226,7 @@ public AttributeMetadata clone() {
             cloned.setAttributeGroupMetadata(attributeGroupMetadata.clone());
         }
         cloned.setMultivalued(multivalued);
+        cloned.setAnnotationDecorator(annotationDecorator);
         return cloned;
     }
 
@@ -270,4 +272,13 @@ public AttributeMetadata setValidators(List<AttributeValidatorMetadata> validato
         this.validators = validators;
         return this;
     }
+
+    public Map<String, Object> getAnnotations(AttributeContext context) {
+        return annotationDecorator.apply(context);
+    }
+
+    public AttributeMetadata setAnnotationDecorator(Function<AttributeContext, Map<String, Object>> annotationDecorator) {
+        this.annotationDecorator = annotationDecorator;
+        return this;
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/userprofile/Attributes.java b/server-spi/src/main/java/org/keycloak/userprofile/Attributes.java
index a55da0e31bcc..cd63955a7eee 100644
--- a/server-spi/src/main/java/org/keycloak/userprofile/Attributes.java
+++ b/server-spi/src/main/java/org/keycloak/userprofile/Attributes.java
@@ -26,6 +26,7 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.function.Consumer;
+import java.util.function.Function;
 
 import org.keycloak.validate.ValidationError;
 
@@ -168,4 +169,24 @@ default String getFirst(String name) {
      * @return a map with any unmanaged attribute
      */
     Map<String, List<String>> getUnmanagedAttributes();
+
+    /**
+     * <p>Returns the annotations for an attribute with the given {@code name}.
+     *
+     * <p>The annotations returned by this method might differ from those returned directly from
+     * the {@link AttributeMetadata#getAnnotations()} if the implementation supports annotations
+     * being resolved dynamically based on contextual data. See {@link AttributeMetadata#setAnnotationDecorator(Function)}.
+     *
+     * @param name the name of the attribute
+     * @return the annotations
+     */
+    default Map<String, Object> getAnnotations(String name) {
+        AttributeMetadata metadata = getMetadata(name);
+
+        if (metadata == null) {
+            return Collections.emptyMap();
+        }
+
+        return metadata.getAnnotations();
+    }
 }
diff --git a/server-spi/src/main/java/org/keycloak/userprofile/UserProfileContext.java b/server-spi/src/main/java/org/keycloak/userprofile/UserProfileContext.java
index 947571fcbae5..b1344ee20d07 100644
--- a/server-spi/src/main/java/org/keycloak/userprofile/UserProfileContext.java
+++ b/server-spi/src/main/java/org/keycloak/userprofile/UserProfileContext.java
@@ -68,7 +68,7 @@ public enum UserProfileContext {
      * In this context, a user profile is managed by themselves when updating their email through an application initiated action.
      * In this context, only the {@link UserModel#EMAIL} attribute is supported.
      */
-    UPDATE_EMAIL(false, true, false, Set.of(UserModel.EMAIL)::contains);
+    UPDATE_EMAIL(false, true, true, Set.of(UserModel.EMAIL)::contains);
 
     private final boolean resetEmailVerified;
     private final Predicate<String> attributeSelector;
diff --git a/server-spi/src/main/java/org/keycloak/utils/KeycloakSessionUtil.java b/server-spi/src/main/java/org/keycloak/utils/KeycloakSessionUtil.java
index a2010503b8e0..f4504f543132 100644
--- a/server-spi/src/main/java/org/keycloak/utils/KeycloakSessionUtil.java
+++ b/server-spi/src/main/java/org/keycloak/utils/KeycloakSessionUtil.java
@@ -18,10 +18,14 @@
 package org.keycloak.utils;
 
 import org.keycloak.common.util.Resteasy;
+import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
 
 public class KeycloakSessionUtil {
 
+    private static final String NO_REALM = "no_realm_found_in_session";
+
     private KeycloakSessionUtil() {
 
     }
@@ -46,4 +50,26 @@ public static KeycloakSession setKeycloakSession(KeycloakSession session) {
         return Resteasy.pushContext(KeycloakSession.class, session);
     }
 
+    public static String getRealmNameFromContext(KeycloakSession session) {
+        if(session == null) {
+            return NO_REALM;
+        }
+
+        KeycloakContext context = session.getContext();
+        if(context == null) {
+            return NO_REALM;
+        }
+
+        RealmModel realm = context.getRealm();
+        if (realm == null) {
+            return NO_REALM;
+        }
+
+        if(realm.getName() != null) {
+            return realm.getName();
+        } else {
+            return NO_REALM;
+        }
+    }
+
 }
diff --git a/server-spi/src/test/java/org/keycloak/models/credential/RecoveryCodesUnitTest.java b/server-spi/src/test/java/org/keycloak/models/credential/RecoveryCodesUnitTest.java
new file mode 100644
index 000000000000..d742a3c9531c
--- /dev/null
+++ b/server-spi/src/test/java/org/keycloak/models/credential/RecoveryCodesUnitTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.models.credential;
+
+import org.jboss.logging.Logger;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.keycloak.common.util.Time;
+import org.keycloak.models.utils.RecoveryAuthnCodesUtils;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class RecoveryCodesUnitTest {
+
+    private static final Logger logger = Logger.getLogger(RecoveryCodesUnitTest.class);
+
+    @Test
+    public void testBasicVerification() {
+        Assert.assertTrue(RecoveryAuthnCodesUtils.verifyRecoveryCodeInput("L9RRAUWYKARB", "OnOEi8vsNqnI2s6t2IxU2+A+KrzWAVpR9AHExeQgDzTuoiU1qPzFsOpFIy8wb6EtPEGHKj0ehgHyTbuBTyChhg=="));
+        Assert.assertFalse(RecoveryAuthnCodesUtils.verifyRecoveryCodeInput("L9RRAUWYKARC", "OnOEi8vsNqnI2s6t2IxU2+A+KrzWAVpR9AHExeQgDzTuoiU1qPzFsOpFIy8wb6EtPEGHKj0ehgHyTbuBTyChhg=="));
+    }
+
+    @Ignore
+    @Test
+    public void testPerf() {
+        testPerf("Successful code verifications", () ->
+                Assert.assertTrue(RecoveryAuthnCodesUtils.verifyRecoveryCodeInput("L9RRAUWYKARB", "OnOEi8vsNqnI2s6t2IxU2+A+KrzWAVpR9AHExeQgDzTuoiU1qPzFsOpFIy8wb6EtPEGHKj0ehgHyTbuBTyChhg=="))
+        );
+        testPerf("Failed code verifications 1", () ->
+                Assert.assertFalse(RecoveryAuthnCodesUtils.verifyRecoveryCodeInput("L9RRAUWYKARC", "OnOEi8vsNqnI2s6t2IxU2+A+KrzWAVpR9AHExeQgDzTuoiU1qPzFsOpFIy8wb6EtPEGHKj0ehgHyTbuBTyChhg=="))
+        );
+        testPerf("Failed code verifications 2", () ->
+                Assert.assertFalse(RecoveryAuthnCodesUtils.verifyRecoveryCodeInput("A8CWGYUIUILP", "OnOEi8vsNqnI2s6t2IxU2+A+KrzWAVpR9AHExeQgDzTuoiU1qPzFsOpFIy8wb6EtPEGHKj0ehgHyTbuBTyChhg=="))
+        );
+    }
+
+    private void testPerf(String prefix, Runnable task) {
+        long start = Time.currentTimeMillis();
+        int count = 10000000;
+        for (int i = 0 ; i < count ; i++) {
+            task.run();
+        }
+        logger.infof("Task '%s' took %d ms", prefix, Time.currentTimeMillis() - start);
+    }
+}
diff --git a/server-spi/src/test/java/org/keycloak/provider/ProviderConfigurationBuilderTest.java b/server-spi/src/test/java/org/keycloak/provider/ProviderConfigurationBuilderTest.java
new file mode 100644
index 000000000000..af8ea5a901d8
--- /dev/null
+++ b/server-spi/src/test/java/org/keycloak/provider/ProviderConfigurationBuilderTest.java
@@ -0,0 +1,65 @@
+package org.keycloak.provider;
+
+import java.util.List;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class ProviderConfigurationBuilderTest {
+
+  @Test
+  public void testAddProperty() {
+    ProviderConfigurationBuilder builder = ProviderConfigurationBuilder.create();
+
+    builder.property()
+        .name("property1")
+        .label("Property 1")
+        .helpText("Help text for property 1")
+        .type("string")
+        .defaultValue("default1")
+        .add();
+
+    builder.property()
+        .name("property2")
+        .label("Property 2")
+        .helpText("Help text for property 2")
+        .type("int")
+        .defaultValue(10)
+        .add();
+
+    List<ProviderConfigProperty> properties = builder.build();
+
+    Assert.assertEquals(2, properties.size());
+    Assert.assertEquals("property1", properties.get(0).getName());
+    Assert.assertEquals("Property 1", properties.get(0).getLabel());
+    Assert.assertEquals("default1", properties.get(0).getDefaultValue());
+
+    Assert.assertEquals("property2", properties.get(1).getName());
+    Assert.assertEquals(10, properties.get(1).getDefaultValue());
+  }
+
+  @Test
+  public void testDuplicatePropertyNameThrowsException() {
+    ProviderConfigurationBuilder builder = ProviderConfigurationBuilder.create();
+
+    builder.property()
+        .name("property1")
+        .label("Property 1")
+        .helpText("Help text for property 1")
+        .type("string")
+        .defaultValue("default1")
+        .add();
+
+    ProviderConfigPropertyNameNotUniqueException exception = Assert.assertThrows(
+        ProviderConfigPropertyNameNotUniqueException.class,
+        () -> builder.property()
+            .name("property1")
+            .label("Duplicate Property 1")
+            .helpText("Help text for duplicate property 1")
+            .type("string")
+            .defaultValue("default2")
+            .add()
+    );
+
+    Assert.assertEquals("ProviderConfigProperty with name 'property1' already exists.", exception.getMessage());
+  }
+}
diff --git a/services/pom.xml b/services/pom.xml
index 34bd11c7c0e1..d09fc4b0517b 100755
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -265,6 +265,13 @@
                     <compilerArgument>
                         -AgeneratedTranslationFilesPath=${project.build.directory}/generated-translation-files
                     </compilerArgument>
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>org.jboss.logging</groupId>
+                            <artifactId>jboss-logging-processor</artifactId>
+                            <version>${jboss-logging-annotations.version}</version>
+                        </path>
+                    </annotationProcessorPaths>
                 </configuration>
             </plugin>
             <plugin>
@@ -277,6 +284,14 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <systemPropertyVariables>
+                        <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
+                    </systemPropertyVariables>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
diff --git a/services/src/main/java/org/keycloak/WebAuthnConstants.java b/services/src/main/java/org/keycloak/WebAuthnConstants.java
index b0f6846549ba..96046742dd18 100644
--- a/services/src/main/java/org/keycloak/WebAuthnConstants.java
+++ b/services/src/main/java/org/keycloak/WebAuthnConstants.java
@@ -45,6 +45,7 @@ public interface WebAuthnConstants {
     String IS_USER_IDENTIFIED = "isUserIdentified";
     String USER_VERIFICATION = "userVerification";
     String TRANSPORTS = "transports";
+    String ENABLE_WEBAUTHN_CONDITIONAL_UI = "enableWebAuthnConditionalUI";
 
     String IS_SET_RETRY = "isSetRetry";
     String SHOULD_DISPLAY_AUTHENTICATORS = "shouldDisplayAuthenticators";
@@ -52,12 +53,6 @@ public interface WebAuthnConstants {
     // key for storing onto AuthenticationSessionModel's Attribute challenge generated by RP(keycloak)
     String AUTH_CHALLENGE_NOTE = "WEBAUTH_CHALLENGE";
 
-    // option values on WebAuth API
-    String OPTION_REQUIRED = "required";
-    String OPTION_PREFERED = "preferred";
-    String OPTION_DISCOURAGED = "discouraged";
-    String OPTION_NOT_SPECIFIED = "";
-
     /* WebAuthn events */
 
     // Event key for credential id generated by navigator.credentials.create()
diff --git a/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java b/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java
index 7c5cd8f2e759..99ae7db8cc3f 100755
--- a/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java
+++ b/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java
@@ -17,8 +17,10 @@
 
 package org.keycloak.authentication;
 
+import jakarta.ws.rs.core.MultivaluedMap;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
+import org.keycloak.authentication.authenticators.util.AcrStore;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
 import org.keycloak.authentication.authenticators.client.ClientAuthUtil;
@@ -68,6 +70,7 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
+import org.keycloak.utils.StringUtil;
 
 import java.io.IOException;
 import java.net.URI;
@@ -87,6 +90,7 @@ public class AuthenticationProcessor {
     public static final String LAST_PROCESSED_EXECUTION = "last.processed.execution";
     public static final String CURRENT_FLOW_PATH = "current.flow.path";
     public static final String FORKED_FROM = "forked.from";
+    public static final String LAST_AUTHN_CREDENTIAL = "last.authn.credential";
 
     public static final String BROKER_SESSION_ID = "broker.session.id";
     public static final String BROKER_USER_ID = "broker.user.id";
@@ -306,6 +310,11 @@ public static String getClientData(KeycloakSession session, AuthenticationSessio
         return clientData.encode();
     }
 
+    private String getSignedAuthSessionId() {
+        AuthenticationSessionManager authenticationSessionManager = new AuthenticationSessionManager(session);
+        return authenticationSessionManager.signAndEncodeToBase64AuthSessionId(getAuthenticationSession().getParentSession().getId());
+    }
+
     public URI getRefreshUrl(boolean authSessionIdParam) {
         UriBuilder uriBuilder = LoginActionsService.loginActionsBaseUrl(getUriInfo())
                 .path(AuthenticationProcessor.this.flowPath)
@@ -313,7 +322,7 @@ public URI getRefreshUrl(boolean authSessionIdParam) {
                 .queryParam(Constants.TAB_ID, getAuthenticationSession().getTabId())
                 .queryParam(Constants.CLIENT_DATA, getClientData());
         if (authSessionIdParam) {
-            uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getAuthenticationSession().getParentSession().getId());
+            uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getSignedAuthSessionId());
         }
         return uriBuilder
                 .build(getRealm().getName());
@@ -398,6 +407,14 @@ public ClientAuthenticator getClientAuthenticator() {
 
         @Override
         public void success() {
+            success(null);
+        }
+
+        @Override
+        public void success(String credentialType) {
+            if (credentialType != null) {
+                getAuthenticationSession().setAuthNote(LAST_AUTHN_CREDENTIAL, credentialType);
+            }
             this.status = FlowStatus.SUCCESS;
         }
 
@@ -596,15 +613,23 @@ public LoginFormsProvider form() {
 
         @Override
         public URI getActionUrl(String code) {
-            UriBuilder uriBuilder = LoginActionsService.loginActionsBaseUrl(getUriInfo())
+            UriInfo uriInfo = getUriInfo();
+            UriBuilder uriBuilder = LoginActionsService.loginActionsBaseUrl(uriInfo)
                     .path(AuthenticationProcessor.this.flowPath)
                     .queryParam(LoginActionsService.SESSION_CODE, code)
                     .queryParam(Constants.EXECUTION, getExecution().getId())
                     .queryParam(Constants.CLIENT_ID, getAuthenticationSession().getClient().getClientId())
                     .queryParam(Constants.TAB_ID, getAuthenticationSession().getTabId())
                     .queryParam(Constants.CLIENT_DATA, getClientData());
-            if (getUriInfo().getQueryParameters().containsKey(LoginActionsService.AUTH_SESSION_ID)) {
-                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getAuthenticationSession().getParentSession().getId());
+            MultivaluedMap<String, String> queryParameters = uriInfo.getQueryParameters();
+            String token = queryParameters.getFirst(Constants.TOKEN);
+
+            if (StringUtil.isNotBlank(token)) {
+                uriBuilder.queryParam(Constants.TOKEN, token);
+            }
+
+            if (queryParameters.containsKey(LoginActionsService.AUTH_SESSION_ID)) {
+                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getSignedAuthSessionId());
             }
             return uriBuilder
                     .build(getRealm().getName());
@@ -619,7 +644,7 @@ public URI getActionTokenUrl(String tokenString) {
                     .queryParam(Constants.TAB_ID, getAuthenticationSession().getTabId())
                     .queryParam(Constants.CLIENT_DATA, getClientData());
             if (getUriInfo().getQueryParameters().containsKey(LoginActionsService.AUTH_SESSION_ID)) {
-                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getAuthenticationSession().getParentSession().getId());
+                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getSignedAuthSessionId());
             }
             return uriBuilder
                     .build(getRealm().getName());
@@ -634,7 +659,7 @@ public URI getRefreshExecutionUrl() {
                     .queryParam(Constants.TAB_ID, getAuthenticationSession().getTabId())
                     .queryParam(Constants.CLIENT_DATA, getClientData());
             if (getUriInfo().getQueryParameters().containsKey(LoginActionsService.AUTH_SESSION_ID)) {
-                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getAuthenticationSession().getParentSession().getId());
+                uriBuilder.queryParam(LoginActionsService.AUTH_SESSION_ID, getSignedAuthSessionId());
             }
             return uriBuilder
                     .build(getRealm().getName());
@@ -1119,7 +1144,7 @@ public static ClientSessionContext attachSession(AuthenticationSessionModel auth
             if (userSession == null) {
                 UserSessionModel.SessionPersistenceState persistenceState = UserSessionModel.SessionPersistenceState.fromString(authSession.getClientNote(AuthenticationManager.USER_SESSION_PERSISTENT_STATE));
 
-                userSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, authSession.getAuthenticatedUser(), username, connection.getRemoteAddr(), authSession.getProtocol()
+                userSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, authSession.getAuthenticatedUser(), username, connection.getRemoteHost(), authSession.getProtocol()
                         , remember, brokerSessionId, brokerUserId, persistenceState);
 
                 if (isLightweightUser(userSession.getUser())) {
@@ -1127,7 +1152,7 @@ public static ClientSessionContext attachSession(AuthenticationSessionModel auth
                     lua.setOwningUserSessionId(userSession.getId());
                 }
             } else if (userSession.getUser() == null || !AuthenticationManager.isSessionValid(realm, userSession)) {
-                userSession.restartSession(realm, authSession.getAuthenticatedUser(), username, connection.getRemoteAddr(), authSession.getProtocol()
+                userSession.restartSession(realm, authSession.getAuthenticatedUser(), username, connection.getRemoteHost(), authSession.getProtocol()
                         , remember, brokerSessionId, brokerUserId);
             } else {
                 // We have existing userSession even if it wasn't attached to authenticator. Could happen if SSO authentication was ignored (eg. prompt=login) and in some other cases.
@@ -1146,13 +1171,20 @@ public static ClientSessionContext attachSession(AuthenticationSessionModel auth
             event.detail(Details.REMEMBER_ME, "true");
         }
 
-        final int clientSessions = userSession.getAuthenticatedClientSessions().size();
-        ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(session, userSession, authSession);
-        if (clientSessions == 0 && userSession.getStarted() == userSession.getLastSessionRefresh()
-                && TokenUtil.hasScope(clientSessionCtx.getScopeString(), OAuth2Constants.OFFLINE_ACCESS)) {
-            // user session is just created, empty and the first access was for offline token, set the note
-            clientSessionCtx.getClientSession().setNote(FIRST_OFFLINE_ACCESS, Boolean.TRUE.toString());
+        ClientSessionContext clientSessionCtx;
+        if (userSession.getStarted() == userSession.getLastSessionRefresh()) {
+            // calling getAuthenticatedClientSessions() will pull all client sessions and is therefore expensive.
+            // The nested ifs try to avoid the common case when the session already exists for some time and this is then called.
+            final int clientSessions = userSession.getAuthenticatedClientSessions().size();
+            clientSessionCtx = TokenManager.attachAuthenticationSession(session, userSession, authSession);
+            if (clientSessions == 0 && TokenUtil.hasScope(clientSessionCtx.getScopeString(), OAuth2Constants.OFFLINE_ACCESS)) {
+                // user session is just created, empty and the first access was for offline token, set the note
+                clientSessionCtx.getClientSession().setNote(FIRST_OFFLINE_ACCESS, Boolean.TRUE.toString());
+            } else {
+                clientSessionCtx.getClientSession().removeNote(FIRST_OFFLINE_ACCESS);
+            }
         } else {
+            clientSessionCtx = TokenManager.attachAuthenticationSession(session, userSession, authSession);
             clientSessionCtx.getClientSession().removeNote(FIRST_OFFLINE_ACCESS);
         }
 
@@ -1185,6 +1217,8 @@ public void validateUser(UserModel authenticatedUser) {
     }
 
     protected Response authenticationComplete() {
+        new AcrStore(session, authenticationSession).setAuthFlowLevelAuthenticatedToCurrentRequest();
+
         // attachSession(); // Session will be attached after requiredActions + consents are finished.
         AuthenticationManager.setClientScopesInSession(session, authenticationSession);
 
@@ -1209,7 +1243,6 @@ public AuthenticationProcessor.Result createClientAuthenticatorContext(Authentic
         return new Result(model, clientAuthenticator, executions);
     }
 
-
     // This takes care of CRUD of FormMessage to the authenticationSession, so that message can be displayed on the forms in different HTTP request
     private class ForwardedFormMessageStore {
 
diff --git a/services/src/main/java/org/keycloak/authentication/AuthenticatorUtil.java b/services/src/main/java/org/keycloak/authentication/AuthenticatorUtil.java
index c678cb33dbd0..d63f80dd777e 100755
--- a/services/src/main/java/org/keycloak/authentication/AuthenticatorUtil.java
+++ b/services/src/main/java/org/keycloak/authentication/AuthenticatorUtil.java
@@ -21,6 +21,7 @@
 import org.keycloak.authentication.actiontoken.ActionTokenContext;
 import org.keycloak.authentication.actiontoken.DefaultActionToken;
 import org.keycloak.common.ClientConnection;
+import org.keycloak.common.Profile;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
@@ -34,6 +35,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.utils.StringUtil;
@@ -197,14 +199,28 @@ private static void logoutOtherSessions(KeycloakSession session, RealmModel real
                 .filter(s -> !Objects.equals(s.getId(), authSession.getParentSession().getId()))
                 .collect(Collectors.toList()) // collect to avoid concurrent modification as backchannelLogout removes the user sessions.
                 .forEach(s -> {
-                    AuthenticationManager.backchannelLogout(session, realm, s, session.getContext().getUri(),
-                            conn, req.getHttpHeaders(), true);
-
-                    event.event(EventType.LOGOUT)
-                            .session(s)
-                            .user(s.getUser())
-                            .success();
+                    backchannelLogout(session, realm, conn, req, event, s);
                 });
+
+        if (!Profile.isFeatureEnabled(Profile.Feature.LOGOUT_ALL_SESSIONS_V1)) {
+            session.sessions().getOfflineUserSessionsStream(realm, user)
+                    .filter(s -> !Objects.equals(s.getId(), authSession.getParentSession().getId()))
+                    .collect(Collectors.toList()) // collect to avoid concurrent modification as backchannelLogout removes the user sessions.
+                    .forEach(s -> {
+                        backchannelLogout(session, realm, conn, req, event, s);
+                    });
+        }
+
+    }
+
+    private static void backchannelLogout(KeycloakSession session, RealmModel realm, ClientConnection conn, HttpRequest req, EventBuilder event, UserSessionModel s) {
+        AuthenticationManager.backchannelLogout(session, realm, s, session.getContext().getUri(),
+                conn, req.getHttpHeaders(), true);
+
+        event.clone().event(EventType.LOGOUT)
+                .session(s)
+                .user(s.getUser())
+                .success();
     }
 
     /**
diff --git a/services/src/main/java/org/keycloak/authentication/DefaultAuthenticationFlow.java b/services/src/main/java/org/keycloak/authentication/DefaultAuthenticationFlow.java
index dd53d3d8d5b4..8451f8d79752 100755
--- a/services/src/main/java/org/keycloak/authentication/DefaultAuthenticationFlow.java
+++ b/services/src/main/java/org/keycloak/authentication/DefaultAuthenticationFlow.java
@@ -357,7 +357,8 @@ boolean isConditionalSubflowDisabled(AuthenticationExecutionModel model) {
     }
 
     private boolean isConditionalAuthenticator(AuthenticationExecutionModel model) {
-        return !model.isAuthenticatorFlow() && model.getAuthenticator() != null && createAuthenticator(getAuthenticatorFactory(model)) instanceof ConditionalAuthenticator;
+        return !model.isAuthenticatorFlow() && model.getAuthenticator() != null && model.isEnabled()
+                && createAuthenticator(getAuthenticatorFactory(model)) instanceof ConditionalAuthenticator;
     }
 
     private AuthenticatorFactory getAuthenticatorFactory(AuthenticationExecutionModel model) {
diff --git a/services/src/main/java/org/keycloak/authentication/RequiredActionContextResult.java b/services/src/main/java/org/keycloak/authentication/RequiredActionContextResult.java
index 03c7517503fb..0f4676ec8160 100755
--- a/services/src/main/java/org/keycloak/authentication/RequiredActionContextResult.java
+++ b/services/src/main/java/org/keycloak/authentication/RequiredActionContextResult.java
@@ -145,6 +145,11 @@ public void success() {
 
     }
 
+    @Override
+    public void cancel() {
+        status = Status.CANCELLED;
+    }
+
     @Override
     public void ignore() {
         status = Status.IGNORE;
diff --git a/services/src/main/java/org/keycloak/authentication/actiontoken/DefaultActionToken.java b/services/src/main/java/org/keycloak/authentication/actiontoken/DefaultActionToken.java
index fd37b9bca4b3..3ebdd54a8757 100644
--- a/services/src/main/java/org/keycloak/authentication/actiontoken/DefaultActionToken.java
+++ b/services/src/main/java/org/keycloak/authentication/actiontoken/DefaultActionToken.java
@@ -21,7 +21,6 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.keycloak.TokenVerifier.Predicate;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.Time;
 import org.keycloak.models.SingleUseObjectValueModel;
 import org.keycloak.models.DefaultActionTokenKey;
 import org.keycloak.models.KeycloakSession;
@@ -159,7 +158,7 @@ public String serialize(KeycloakSession session, RealmModel realm, UriInfo uri)
 
         this
           .issuedNow()
-          .id(getActionVerificationNonce().toString())
+          .id(UUID.randomUUID().toString())
           .issuer(issuerUri)
           .audience(issuerUri);
 
diff --git a/services/src/main/java/org/keycloak/authentication/actiontoken/TokenUtils.java b/services/src/main/java/org/keycloak/authentication/actiontoken/TokenUtils.java
index bdaa80415c00..71badbb04edc 100644
--- a/services/src/main/java/org/keycloak/authentication/actiontoken/TokenUtils.java
+++ b/services/src/main/java/org/keycloak/authentication/actiontoken/TokenUtils.java
@@ -19,6 +19,11 @@
 import org.keycloak.TokenVerifier;
 import org.keycloak.TokenVerifier.Predicate;
 import org.keycloak.representations.JsonWebToken;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 import java.util.function.BooleanSupplier;
 
 /**
@@ -82,4 +87,25 @@ public static <T extends JsonWebToken> Predicate<T> onlyIf(java.util.function.Pr
     public static <T extends JsonWebToken> Predicate<? super T>[] predicates(Predicate<? super T>... predicate) {
         return predicate;
     }
+
+    /**
+     * Check that all requested audiences from parameter "requestedAudience" are available in the accessToken. If some are missing, return the missing audiences.
+     * Assumption is, that token does not contain any additional audiences, which is true for example during token-exchange
+     *
+     * @param token token to check
+     * @param requestedAudience requested audiences
+     * @return set of audiences, which are requested, but are missing from the token
+     */
+    public static Set<String> checkRequestedAudiences(JsonWebToken token, List<String> requestedAudience) {
+        if (requestedAudience != null && (token.getAudience() == null ||
+                token.getAudience().length < requestedAudience.size())) {
+            final Set<String> missingAudience = new HashSet<>(requestedAudience);
+            if (token.getAudience() != null) {
+                missingAudience.removeAll(Set.of(token.getAudience()));
+            }
+            return missingAudience;
+        } else {
+            return Collections.emptySet();
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/actiontoken/idpverifyemail/IdpVerifyAccountLinkActionTokenHandler.java b/services/src/main/java/org/keycloak/authentication/actiontoken/idpverifyemail/IdpVerifyAccountLinkActionTokenHandler.java
index debd603ea100..0b745bf4fb8b 100644
--- a/services/src/main/java/org/keycloak/authentication/actiontoken/idpverifyemail/IdpVerifyAccountLinkActionTokenHandler.java
+++ b/services/src/main/java/org/keycloak/authentication/actiontoken/idpverifyemail/IdpVerifyAccountLinkActionTokenHandler.java
@@ -25,23 +25,23 @@
 import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
+import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.SingleUseObjectProvider;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.services.Urls;
 import org.keycloak.services.managers.AuthenticationSessionManager;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.sessions.AuthenticationSessionCompoundId;
 import org.keycloak.sessions.AuthenticationSessionModel;
 
-import java.util.Collections;
-import java.util.stream.Stream;
-
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
 
+import java.util.Map;
+
 /**
  * Action token handler for verification of e-mail address.
  * @author hmlnarik
@@ -103,9 +103,10 @@ public Response handleToken(IdpVerifyAccountLinkActionToken token, ActionTokenCo
                     authSession.getClient().getClientId(), authSession.getTabId(), AuthenticationProcessor.getClientData(session, authSession));
             String confirmUri = builder.build(realm.getName()).toString();
 
-            return session.getProvider(LoginFormsProvider.class)
-                    .setAuthenticationSession(authSession)
-                    .setSuccess(Messages.CONFIRM_ACCOUNT_LINKING, token.getIdentityProviderUsername(), token.getIdentityProviderAlias())
+            LoginFormsProvider forms = session.getProvider(LoginFormsProvider.class);
+            return forms.setAuthenticationSession(authSession)
+                    .setAttribute("messageHeader", forms.getMessage(Messages.CONFIRM_ACCOUNT_LINKING, token.getIdentityProviderUsername(), token.getIdentityProviderAlias()))
+                    .setSuccess(Messages.CONFIRM_ACCOUNT_LINKING_BODY, token.getIdentityProviderUsername(), token.getIdentityProviderAlias())
                     .setAttribute(Constants.TEMPLATE_ATTR_ACTION_URI, confirmUri)
                     .createInfoPage();
         }
@@ -123,14 +124,10 @@ public Response handleToken(IdpVerifyAccountLinkActionToken token, ActionTokenCo
 
             if (authSession != null) {
                 authSession.setAuthNote(IdpEmailVerificationAuthenticator.VERIFY_ACCOUNT_IDP_USERNAME, token.getIdentityProviderUsername());
-            } else {
-
-                session.authenticationSessions().updateNonlocalSessionAuthNotes(
-                        compoundId,
-                  Collections.singletonMap(IdpEmailVerificationAuthenticator.VERIFY_ACCOUNT_IDP_USERNAME, token.getIdentityProviderUsername())
-                );
             }
 
+            setUserVerifiedSingleObject(token, realm, session, user);
+
             return session.getProvider(LoginFormsProvider.class)
                     .setAuthenticationSession(authSession)
                     .setSuccess(Messages.IDENTITY_PROVIDER_LINK_SUCCESS, token.getIdentityProviderAlias(), token.getIdentityProviderUsername())
@@ -143,6 +140,33 @@ public Response handleToken(IdpVerifyAccountLinkActionToken token, ActionTokenCo
         return tokenContext.brokerFlow(null, null, authSession.getAuthNote(AuthenticationProcessor.CURRENT_FLOW_PATH));
     }
 
+    private void setUserVerifiedSingleObject(IdpVerifyAccountLinkActionToken token, RealmModel realm, KeycloakSession session, UserModel user) {
+        int singleObjectLifespan = realm.getActionTokenGeneratedByUserLifespan();
+        String userId = user.getId();
+        String idpAlias = token.getIdentityProviderAlias();
+        session.singleUseObjects().put(getUserVerifiedSingleObjectKey(userId, idpAlias), singleObjectLifespan, Map.of());
+    }
+
+    public static boolean runIfUserVerified(KeycloakSession session, UserModel user, IdentityProviderModel broker, Runnable runnable) {
+        if (user == null) {
+            return false;
+        }
+
+        SingleUseObjectProvider singleObjects = session.singleUseObjects();
+        String singleObjectKey = getUserVerifiedSingleObjectKey(user.getId(), broker.getAlias());
+        boolean isUserVerified = singleObjects.remove(singleObjectKey) != null;
+
+        if (isUserVerified) {
+            runnable.run();
+        }
+
+        return isUserVerified;
+    }
+
+    private static String getUserVerifiedSingleObjectKey(String userId, String idpAlias) {
+        return "kc.brokering.user.verified." + userId  + "." + idpAlias;
+    }
+
     private Response sendEmailAlreadyVerified(KeycloakSession session, EventBuilder event, UserModel user) {
         event.user(user).error(Errors.EMAIL_ALREADY_VERIFIED);
         return session.getProvider(LoginFormsProvider.class)
diff --git a/services/src/main/java/org/keycloak/authentication/actiontoken/inviteorg/InviteOrgActionTokenHandler.java b/services/src/main/java/org/keycloak/authentication/actiontoken/inviteorg/InviteOrgActionTokenHandler.java
index da297146c7a0..93faf6594221 100644
--- a/services/src/main/java/org/keycloak/authentication/actiontoken/inviteorg/InviteOrgActionTokenHandler.java
+++ b/services/src/main/java/org/keycloak/authentication/actiontoken/inviteorg/InviteOrgActionTokenHandler.java
@@ -37,7 +37,6 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.organization.OrganizationProvider;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.utils.RedirectUtils;
 import org.keycloak.services.Urls;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.messages.Messages;
@@ -117,6 +116,7 @@ public Response handleToken(InviteOrgActionToken token, ActionTokenContext<Invit
             return session.getProvider(LoginFormsProvider.class)
                     .setAuthenticationSession(authSession)
                     .setInfo(Messages.ORG_MEMBER_ALREADY, user.getUsername())
+                    .setAttribute("pageRedirectUri", organization.getRedirectUrl())
                     .createInfoPage();
         }
 
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/broker/AbstractIdpAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/broker/AbstractIdpAuthenticator.java
index b8207cb5f491..d5b5c2937fb1 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/broker/AbstractIdpAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/broker/AbstractIdpAuthenticator.java
@@ -44,15 +44,9 @@ public abstract class AbstractIdpAuthenticator implements Authenticator {
     // The clientSession note with all the info about existing user
     public static final String EXISTING_USER_INFO = "EXISTING_USER_INFO";
 
-    // The clientSession note flag to indicate that email provided by identityProvider was changed on updateProfile page
-    public static final String UPDATE_PROFILE_EMAIL_CHANGED = "UPDATE_PROFILE_EMAIL_CHANGED";
-
     // The clientSession note flag to indicate that updateProfile page will be always displayed even if "updateProfileOnFirstLogin" is off
     public static final String ENFORCE_UPDATE_PROFILE = "ENFORCE_UPDATE_PROFILE";
 
-    // clientSession.note flag specifies if we imported new user to keycloak (true) or we just linked to an existing keycloak user (false)
-    public static final String BROKER_REGISTERED_NEW_USER = "BROKER_REGISTERED_NEW_USER";
-
     // Set after firstBrokerLogin is successfully finished and contains the providerId of the provider, whose 'first-broker-login' flow was just finished
     public static final String FIRST_BROKER_LOGIN_SUCCESS = "FIRST_BROKER_LOGIN_SUCCESS";
 
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpConfirmLinkAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpConfirmLinkAuthenticator.java
index abaff35f11c8..57b3c1808f7c 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpConfirmLinkAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpConfirmLinkAuthenticator.java
@@ -30,6 +30,7 @@
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.sessions.CommonClientSessionModel;
 
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.Response;
@@ -50,10 +51,19 @@ protected void authenticateImpl(AuthenticationFlowContext context, SerializedBro
             return;
         }
 
+        // hide the review button if the idp review execution was not successfully executed before
+        boolean hideReviewButton = authSession.getExecutionStatus().entrySet().stream()
+                .filter(entry -> CommonClientSessionModel.ExecutionStatus.SUCCESS.equals(entry.getValue()))
+                .map(entry -> context.getRealm().getAuthenticationExecutionById(entry.getKey()))
+                .filter(exec -> IdpReviewProfileAuthenticatorFactory.PROVIDER_ID.equals(exec.getAuthenticator()))
+                .findAny()
+                .isEmpty();
+
         ExistingUserInfo duplicationInfo = ExistingUserInfo.deserialize(existingUserInfo);
         Response challenge = context.form()
                 .setStatus(Response.Status.OK)
                 .setAttribute(LoginFormsProvider.IDENTITY_PROVIDER_BROKER_CONTEXT, brokerContext)
+                .setAttribute("hideReviewButton", hideReviewButton ? Boolean.TRUE : null)
                 .setError(Messages.FEDERATED_IDENTITY_CONFIRM_LINK_MESSAGE, duplicationInfo.getDuplicateAttributeName(), duplicationInfo.getDuplicateAttributeValue())
                 .createIdpLinkConfirmLinkPage();
         context.challenge(challenge);
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpCreateUserIfUniqueAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpCreateUserIfUniqueAuthenticator.java
index 34f6c6750c22..b011579f1816 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpCreateUserIfUniqueAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpCreateUserIfUniqueAuthenticator.java
@@ -25,6 +25,7 @@
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.models.AuthenticatorConfigModel;
+import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -36,6 +37,9 @@
 import java.util.List;
 import java.util.Map;
 
+import static org.keycloak.authentication.actiontoken.idpverifyemail.IdpVerifyAccountLinkActionTokenHandler.runIfUserVerified;
+import static org.keycloak.broker.provider.AbstractIdentityProvider.BROKER_REGISTERED_NEW_USER;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -67,18 +71,19 @@ protected void authenticateImpl(AuthenticationFlowContext context, SerializedBro
             return;
         }
 
-        ExistingUserInfo duplication = brokerContext.getIdpConfig().isTransientUsers() ? null : checkExistingUser(context, username, serializedCtx, brokerContext);
+        IdentityProviderModel broker = brokerContext.getIdpConfig();
+        ExistingUserInfo duplication = broker.isTransientUsers() ? null : checkExistingUser(context, username, serializedCtx, brokerContext);
 
         UserModel federatedUser = null;
-        if (brokerContext.getIdpConfig().isTransientUsers()) {
+        if (broker.isTransientUsers()) {
             logger.debugf("Transient brokering requested. Recording user details for account '%s' and from identity provider '%s' .",
-                    username, brokerContext.getIdpConfig().getAlias());
+                    username, broker.getAlias());
 
             federatedUser = new LightweightUserAdapter(session, context.getAuthenticationSession().getParentSession().getId());
             federatedUser.setUsername(username);
         } else if (duplication == null) {
             logger.debugf("No duplication detected. Creating account for user '%s' and linking with identity provider '%s' .",
-                    username, brokerContext.getIdpConfig().getAlias());
+                    username, broker.getAlias());
 
             federatedUser = session.users().addUser(realm, username);
         }
@@ -103,7 +108,17 @@ protected void authenticateImpl(AuthenticationFlowContext context, SerializedBro
             context.setUser(federatedUser);
             context.getAuthenticationSession().setAuthNote(BROKER_REGISTERED_NEW_USER, "true");
             context.success();
-        } else {
+        } else if (duplication != null) {
+            UserModel user = session.users().getUserById(realm, duplication.getExistingUserId());
+
+            if (runIfUserVerified(session, user, broker,
+                    () -> {
+                        context.setUser(user);
+                        context.success();
+                    })) {
+                return;
+            }
+
             logger.debugf("Duplication detected. There is already existing user with %s '%s' .",
                     duplication.getDuplicateAttributeName(), duplication.getDuplicateAttributeValue());
 
@@ -121,9 +136,10 @@ protected void authenticateImpl(AuthenticationFlowContext context, SerializedBro
                         .removeDetail(Details.AUTH_METHOD)
                         .removeDetail(Details.AUTH_TYPE)
                         .error(Errors.FEDERATED_IDENTITY_EXISTS);
-            } else {
-                context.attempted();
+                return;
             }
+
+            context.attempted();
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpEmailVerificationAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpEmailVerificationAuthenticator.java
index 0f9e74b486b1..10edd4d03578 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpEmailVerificationAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpEmailVerificationAuthenticator.java
@@ -23,6 +23,7 @@
 import org.keycloak.authentication.AuthenticationProcessor;
 import org.keycloak.authentication.actiontoken.idpverifyemail.IdpVerifyAccountLinkActionToken;
 import org.keycloak.authentication.authenticators.broker.util.SerializedBrokeredIdentityContext;
+import org.keycloak.broker.provider.AbstractIdentityProvider;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
 import org.keycloak.common.util.Time;
 import org.keycloak.email.EmailException;
@@ -70,6 +71,13 @@ protected void authenticateImpl(AuthenticationFlowContext context, SerializedBro
             return;
         }
 
+        if (Boolean.parseBoolean(context.getAuthenticationSession().getAuthNote(AbstractIdentityProvider.UPDATE_PROFILE_USERNAME_CHANGED))
+                || Boolean.parseBoolean(context.getAuthenticationSession().getAuthNote(AbstractIdentityProvider.UPDATE_PROFILE_EMAIL_CHANGED))) {
+            logger.debug("Email or username changed on review. Ignoring email verification authenticator.");
+            context.attempted();
+            return;
+        }
+
         if (Objects.equals(authSession.getAuthNote(VERIFY_ACCOUNT_IDP_USERNAME), brokerContext.getUsername())) {
             UserModel existingUser = getExistingUser(session, realm, authSession);
 
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java
index 469ce861e988..49a292c113ff 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/broker/IdpReviewProfileAuthenticator.java
@@ -20,6 +20,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.authentication.AuthenticationFlowContext;
 import org.keycloak.authentication.authenticators.broker.util.SerializedBrokeredIdentityContext;
+import org.keycloak.broker.provider.AbstractIdentityProvider;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventBuilder;
@@ -201,12 +202,21 @@ public String getFederationLink() {
         UserProfile profile = profileProvider.create(UserProfileContext.IDP_REVIEW, attributes, updatedProfile);
 
         try {
-            String oldEmail = userCtx.getEmail();
-
             profile.update((attributeName, userModel, oldValue) -> {
-                if (attributeName.equals(UserModel.EMAIL)) {
-                    context.getAuthenticationSession().setAuthNote(UPDATE_PROFILE_EMAIL_CHANGED, "true");
-                    event.clone().event(EventType.UPDATE_EMAIL).detail(Details.CONTEXT, UserProfileContext.IDP_REVIEW.name()).detail(Details.PREVIOUS_EMAIL, oldEmail).detail(Details.UPDATED_EMAIL, profile.getAttributes().getFirst(UserModel.EMAIL)).success();
+                if (attributeName.equals(UserModel.USERNAME)) {
+                    context.getAuthenticationSession().setAuthNote(AbstractIdentityProvider.UPDATE_PROFILE_USERNAME_CHANGED, "true");
+                    event.clone().event(EventType.UPDATE_PROFILE)
+                            .detail(Details.CONTEXT, UserProfileContext.IDP_REVIEW.name())
+                            .detail(Details.PREF_PREVIOUS + UserModel.USERNAME, oldValue)
+                            .detail(Details.PREF_UPDATED + UserModel.USERNAME, profile.getAttributes().getFirst(UserModel.USERNAME))
+                            .success();
+                } else if (attributeName.equals(UserModel.EMAIL)) {
+                    context.getAuthenticationSession().setAuthNote(AbstractIdentityProvider.UPDATE_PROFILE_EMAIL_CHANGED, "true");
+                    event.clone().event(EventType.UPDATE_EMAIL)
+                            .detail(Details.CONTEXT, UserProfileContext.IDP_REVIEW.name())
+                            .detail(Details.PREVIOUS_EMAIL, oldValue)
+                            .detail(Details.UPDATED_EMAIL, profile.getAttributes().getFirst(UserModel.EMAIL))
+                            .success();
                 }
             });
         } catch (ValidationException pve) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
index b34a04a0e88c..91fd8af74cd9 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
@@ -25,6 +25,8 @@
 import org.keycloak.models.UserModel;
 
 import jakarta.ws.rs.core.MultivaluedMap;
+import org.keycloak.sessions.AuthenticationSessionModel;
+
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
@@ -327,10 +329,9 @@ private boolean containsConditionalOtpConfig(Map config) {
 
     @Override
     public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
-        if (!isOTPRequired(session, realm, user)) {
-            user.removeRequiredAction(UserModel.RequiredAction.CONFIGURE_TOTP);
-        } else if (user.getRequiredActionsStream().noneMatch(UserModel.RequiredAction.CONFIGURE_TOTP.name()::equals)) {
-            user.addRequiredAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
+        AuthenticationSessionModel authenticationSession = session.getContext().getAuthenticationSession();
+        if (isOTPRequired(session, realm, user) && !authenticationSession.getRequiredActions().contains(UserModel.RequiredAction.CONFIGURE_TOTP.name())) {
+            authenticationSession.addRequiredAction(UserModel.RequiredAction.CONFIGURE_TOTP);
         }
     }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/CookieAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/CookieAuthenticator.java
index ed1f0ae1fba9..b1efecfc5fa4 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/CookieAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/CookieAuthenticator.java
@@ -29,7 +29,6 @@
 import org.keycloak.organization.protocol.mappers.oidc.OrganizationScope;
 import org.keycloak.organization.utils.Organizations;
 import org.keycloak.protocol.LoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.sessions.AuthenticationSessionModel;
@@ -123,9 +122,7 @@ private boolean isOrganizationContext(AuthenticationFlowContext context) {
         KeycloakSession session = context.getSession();
 
         if (Organizations.isEnabledAndOrganizationsPresent(session)) {
-            AuthenticationSessionModel authSession = context.getAuthenticationSession();
-            String requestedScopes = authSession.getClientNote(OIDCLoginProtocol.SCOPE_PARAM);
-            return OrganizationScope.valueOfScope(requestedScopes) != null;
+            return OrganizationScope.valueOfScope(session) != null;
         }
 
         return false;
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java
index ee0876c1132d..9bf44062c00e 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java
@@ -75,7 +75,8 @@ public void authenticate(AuthenticationFlowContext context) {
     }
 
     protected void redirect(AuthenticationFlowContext context, String providerId) {
-        redirect(context, providerId, null);
+        String loginHint = context.getAuthenticationSession().getClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM);
+        redirect(context, providerId, loginHint);
     }
 
     protected void redirect(AuthenticationFlowContext context, String providerId, String loginHint) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java
index 9989bfd9a58f..aca527d1000c 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java
@@ -116,7 +116,7 @@ public void validateOTP(AuthenticationFlowContext context) {
             context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
             return;
         }
-        context.success();
+        context.success(OTPCredentialModel.TYPE);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticator.java
index 7e50428adfc9..0908c1845013 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticator.java
@@ -26,6 +26,7 @@
 
 import jakarta.ws.rs.core.Response;
 
+@Deprecated(since = "26.3", forRemoval = true)
 public class PasskeysConditionalUIAuthenticator extends WebAuthnPasswordlessAuthenticator {
 
     public PasskeysConditionalUIAuthenticator(KeycloakSession session) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticatorFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticatorFactory.java
index 15f54a97ec95..3b072b0f37c4 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticatorFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasskeysConditionalUIAuthenticatorFactory.java
@@ -26,7 +26,11 @@
 
 /**
  * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
+ * @deprecated Factory is deprecated as passkeys are now integrated with the
+ * default username authenticators. It will be removed in future versions
+ * when the passkeys feature become supported.
  */
+@Deprecated(since = "26.3", forRemoval = true)
 public class PasskeysConditionalUIAuthenticatorFactory extends WebAuthnPasswordlessAuthenticatorFactory implements EnvironmentDependentProviderFactory {
 
     public static final String PROVIDER_ID = "passkeys-authenticator";
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java
index 1f62f4ddc480..7213dee34da5 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordForm.java
@@ -32,19 +32,29 @@
 
 public class PasswordForm extends UsernamePasswordForm implements CredentialValidator<PasswordCredentialProvider> {
 
+    public PasswordForm(KeycloakSession session) {
+        super(session);
+    }
+
+    @Override
     protected boolean validateForm(AuthenticationFlowContext context, MultivaluedMap<String, String> formData) {
         return validatePassword(context, context.getUser(), formData, false);
     }
 
     @Override
     public void authenticate(AuthenticationFlowContext context) {
+        if (alreadyAuthenticatedUsingPasswordlessCredential(context)) {
+            context.success();
+            return;
+        }
         Response challengeResponse = context.form().createLoginPassword();
         context.challenge(challengeResponse);
     }
 
     @Override
     public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
-        return user.credentialManager().isConfiguredFor(getCredentialProvider(session).getType());
+        return user.credentialManager().isConfiguredFor(getCredentialProvider(session).getType())
+                || alreadyAuthenticatedUsingPasswordlessCredential(session.getContext().getAuthenticationSession());
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordFormFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordFormFactory.java
index 1a02b7b19ea7..fbd1fbf193a4 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordFormFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/PasswordFormFactory.java
@@ -35,11 +35,10 @@
 public class PasswordFormFactory implements AuthenticatorFactory {
 
     public static final String PROVIDER_ID = "auth-password-form";
-    public static final PasswordForm SINGLETON = new PasswordForm();
 
     @Override
     public Authenticator create(KeycloakSession session) {
-        return SINGLETON;
+        return new PasswordForm(session);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java
index ac90479a8040..f3042d2d34d4 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java
@@ -4,6 +4,7 @@
 import org.keycloak.authentication.AuthenticationFlowError;
 import org.keycloak.authentication.Authenticator;
 import org.keycloak.authentication.authenticators.util.AuthenticatorUtils;
+import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.events.Details;
@@ -18,6 +19,7 @@
 import org.keycloak.models.utils.FormMessage;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.storage.ReadOnlyException;
 
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.Response;
@@ -27,6 +29,9 @@
 
 public class RecoveryAuthnCodesFormAuthenticator implements Authenticator {
 
+    public static final String GENERATED_RECOVERY_AUTHN_CODES_NOTE = "RecoveryAuthnCodes.generatedRecoveryAuthnCodes";
+    public static final String GENERATED_AT_NOTE = "RecoveryAuthnCodes.generatedAt";
+
     public RecoveryAuthnCodesFormAuthenticator(KeycloakSession keycloakSession) {
     }
 
@@ -37,9 +42,10 @@ public void authenticate(AuthenticationFlowContext context) {
 
     @Override
     public void action(AuthenticationFlowContext context) {
-        context.getEvent().detail(Details.CREDENTIAL_TYPE, RecoveryAuthnCodesCredentialModel.TYPE);
+        context.getEvent().detail(Details.CREDENTIAL_TYPE, RecoveryAuthnCodesCredentialModel.TYPE)
+                .user(context.getUser());
         if (isRecoveryAuthnCodeInputValid(context)) {
-            context.success();
+            context.success(RecoveryAuthnCodesCredentialModel.TYPE);
         }
     }
 
@@ -73,8 +79,7 @@ private boolean isRecoveryAuthnCodeInputValid(AuthenticationFlowContext authnFlo
                 authnFlowContext.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, responseChallenge);
             } else {
                 result = true;
-                Optional<CredentialModel> optUserCredentialFound = authenticatedUser.credentialManager().getStoredCredentialsByTypeStream(
-                        RecoveryAuthnCodesCredentialModel.TYPE).findFirst();
+                Optional<CredentialModel> optUserCredentialFound = RecoveryAuthnCodesUtils.getCredential(authenticatedUser);
                 RecoveryAuthnCodesCredentialModel recoveryCodeCredentialModel = null;
                 if (optUserCredentialFound.isPresent()) {
                     recoveryCodeCredentialModel = RecoveryAuthnCodesCredentialModel
@@ -85,7 +90,7 @@ private boolean isRecoveryAuthnCodeInputValid(AuthenticationFlowContext authnFlo
                     }
                 }
                 if (recoveryCodeCredentialModel == null || recoveryCodeCredentialModel.allCodesUsed()) {
-                    authenticatedUser.addRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES);
+                    addRequiredAction(authnFlowContext);
                 }
             }
         }
@@ -95,6 +100,15 @@ private boolean isRecoveryAuthnCodeInputValid(AuthenticationFlowContext authnFlo
         return result;
     }
 
+    protected void addRequiredAction(AuthenticationFlowContext authnFlowContext) {
+        try {
+            authnFlowContext.getUser().addRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES);
+        } catch (ReadOnlyException e) {
+            // user is read-only, at least add the action to the auth session
+            authnFlowContext.getAuthenticationSession().addRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES);
+        }
+    }
+
     protected boolean isDisabledByBruteForce(AuthenticationFlowContext authnFlowContext, UserModel authenticatedUser) {
         String bruteForceError;
         Response challengeResponse;
@@ -149,7 +163,9 @@ public boolean configuredFor(KeycloakSession session, RealmModel realm, UserMode
     @Override
     public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
         AuthenticationSessionModel authenticationSession = session.getContext().getAuthenticationSession();
-        authenticationSession.addRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
+        if (!authenticationSession.getRequiredActions().contains(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name())) {
+            authenticationSession.addRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
+        }
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/SpnegoAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/SpnegoAuthenticator.java
index 8e26117c9b05..e5492ca53c2d 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/SpnegoAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/SpnegoAuthenticator.java
@@ -105,7 +105,7 @@ public void authenticate(AuthenticationFlowContext context) {
                     context.getAuthenticationSession().setUserSessionNote(entry.getKey(), entry.getValue());
                 }
             }
-            context.success();
+            context.success(UserCredentialModel.KERBEROS);
         } else if (output.getAuthStatus() == CredentialValidationOutput.Status.CONTINUE) {
             String spnegoResponseToken = (String) output.getState().get(KerberosConstants.RESPONSE_TOKEN);
             Response challenge =  challengeNegotiation(context, spnegoResponseToken);
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java
index 0e2d15d294d0..b8fc0eafd681 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameForm.java
@@ -34,6 +34,14 @@
 
 public final class UsernameForm extends UsernamePasswordForm {
 
+    public UsernameForm() {
+        super();
+    }
+
+    public UsernameForm(KeycloakSession session) {
+        super(session);
+    }
+
     @Override
     public void authenticate(AuthenticationFlowContext context) {
         if (context.getUser() != null) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameFormFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameFormFactory.java
index 5da492ebfe63..ab0526c41e05 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameFormFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernameFormFactory.java
@@ -17,13 +17,17 @@
 
 package org.keycloak.authentication.authenticators.browser;
 
+import java.util.Collections;
+import java.util.Set;
 import org.keycloak.Config;
 import org.keycloak.authentication.Authenticator;
 import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.common.Profile;
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.provider.ProviderConfigProperty;
 
 import java.util.List;
@@ -35,11 +39,10 @@
 public class UsernameFormFactory implements AuthenticatorFactory {
 
     public static final String PROVIDER_ID = "auth-username-form";
-    public static final UsernameForm SINGLETON = new UsernameForm();
 
     @Override
     public Authenticator create(KeycloakSession session) {
-        return SINGLETON;
+        return new UsernameForm(session);
     }
 
     @Override
@@ -67,10 +70,18 @@ public String getReferenceCategory() {
         return PasswordCredentialModel.TYPE;
     }
 
+    @Override
+    public Set<String> getOptionalReferenceCategories() {
+        return Profile.isFeatureEnabled(Profile.Feature.PASSKEYS)
+                ? Collections.singleton(WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                : AuthenticatorFactory.super.getOptionalReferenceCategories();
+    }
+
     @Override
     public boolean isConfigurable() {
         return false;
     }
+
     public static final AuthenticationExecutionModel.Requirement[] REQUIREMENT_CHOICES = {
             AuthenticationExecutionModel.Requirement.REQUIRED
     };
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java
index ffb916e90c80..7807ccf5fdee 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java
@@ -17,12 +17,16 @@
 
 package org.keycloak.authentication.authenticators.browser;
 
+import org.keycloak.WebAuthnConstants;
 import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationProcessor;
 import org.keycloak.authentication.Authenticator;
 import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.services.managers.AuthenticationManager;
 
@@ -36,23 +40,48 @@
  */
 public class UsernamePasswordForm extends AbstractUsernameFormAuthenticator implements Authenticator {
 
+    protected final WebAuthnConditionalUIAuthenticator webauthnAuth;
+
+    public UsernamePasswordForm() {
+        webauthnAuth = null;
+    }
+
+    public UsernamePasswordForm(KeycloakSession session) {
+        webauthnAuth = new WebAuthnConditionalUIAuthenticator(session, (context) -> createLoginForm(context.form()));
+    }
+
     @Override
     public void action(AuthenticationFlowContext context) {
         MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
         if (formData.containsKey("cancel")) {
             context.cancelLogin();
             return;
-        }
-        if (!validateForm(context, formData)) {
+        } else if (webauthnAuth != null && webauthnAuth.isPasskeysEnabled()
+                && (formData.containsKey(WebAuthnConstants.AUTHENTICATOR_DATA) || formData.containsKey(WebAuthnConstants.ERROR))) {
+            // webauth form submission, try to action using the webauthn authenticator
+            webauthnAuth.action(context);
+            return;
+        } else if (!validateForm(context, formData)) {
+            // normal username and form authenticator
             return;
         }
-        context.success();
+        context.success(PasswordCredentialModel.TYPE);
     }
 
     protected boolean validateForm(AuthenticationFlowContext context, MultivaluedMap<String, String> formData) {
         return validateUserAndPassword(context, formData);
     }
 
+    protected boolean alreadyAuthenticatedUsingPasswordlessCredential(AuthenticationFlowContext context) {
+        return alreadyAuthenticatedUsingPasswordlessCredential(context.getAuthenticationSession());
+    }
+
+    protected boolean alreadyAuthenticatedUsingPasswordlessCredential(AuthenticationSessionModel authSession) {
+        // check if the authentication was already done using passwordless via passkeys
+        return webauthnAuth != null && webauthnAuth.isPasskeysEnabled() && webauthnAuth.getCredentialType().equals(
+                authSession.getAuthNote(AuthenticationProcessor.LAST_AUTHN_CREDENTIAL));
+    }
+
     @Override
     public void authenticate(AuthenticationFlowContext context) {
         MultivaluedMap<String, String> formData = new MultivaluedHashMap<>();
@@ -61,6 +90,12 @@ public void authenticate(AuthenticationFlowContext context) {
         String rememberMeUsername = AuthenticationManager.getRememberMeUsername(context.getSession());
 
         if (context.getUser() != null) {
+            if (alreadyAuthenticatedUsingPasswordlessCredential(context)) {
+                // if already authenticated using passwordless webauthn just success
+                context.success();
+                return;
+            }
+
             LoginFormsProvider form = context.form();
             form.setAttribute(LoginFormsProvider.USERNAME_HIDDEN, true);
             form.setAttribute(LoginFormsProvider.REGISTRATION_DISABLED, true);
@@ -75,6 +110,10 @@ public void authenticate(AuthenticationFlowContext context) {
                     formData.add("rememberMe", "on");
                 }
             }
+            // setup webauthn data when the user is not already selected
+            if (webauthnAuth != null && webauthnAuth.isPasskeysEnabled()) {
+                webauthnAuth.fillContextForm(context);
+            }
         }
         Response challengeResponse = challenge(context, formData);
         context.challenge(challengeResponse);
@@ -88,11 +127,19 @@ public boolean requiresUser() {
     protected Response challenge(AuthenticationFlowContext context, MultivaluedMap<String, String> formData) {
         LoginFormsProvider forms = context.form();
 
-        if (formData.size() > 0) forms.setFormData(formData);
+        if (!formData.isEmpty()) forms.setFormData(formData);
 
         return forms.createLoginUsernamePassword();
     }
 
+    @Override
+    protected Response challenge(AuthenticationFlowContext context, String error, String field) {
+        if (context.getUser() == null && webauthnAuth != null && webauthnAuth.isPasskeysEnabled()) {
+            // setup webauthn data when the user is not already selected
+            webauthnAuth.fillContextForm(context);
+        }
+        return super.challenge(context, error, field);
+    }
 
     @Override
     public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordFormFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordFormFactory.java
index c425f9ec44ce..40131d51386f 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordFormFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordFormFactory.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.authentication.authenticators.browser;
 
+import java.util.Collections;
 import org.keycloak.Config;
 import org.keycloak.authentication.Authenticator;
 import org.keycloak.authentication.AuthenticatorFactory;
@@ -27,6 +28,9 @@
 import org.keycloak.provider.ProviderConfigProperty;
 
 import java.util.List;
+import java.util.Set;
+import org.keycloak.common.Profile;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -35,11 +39,10 @@
 public class UsernamePasswordFormFactory implements AuthenticatorFactory {
 
     public static final String PROVIDER_ID = "auth-username-password-form";
-    public static final UsernamePasswordForm SINGLETON = new UsernamePasswordForm();
 
     @Override
     public Authenticator create(KeycloakSession session) {
-        return SINGLETON;
+        return new UsernamePasswordForm(session);
     }
 
     @Override
@@ -67,6 +70,13 @@ public String getReferenceCategory() {
         return PasswordCredentialModel.TYPE;
     }
 
+    @Override
+    public Set<String> getOptionalReferenceCategories() {
+        return Profile.isFeatureEnabled(Profile.Feature.PASSKEYS)
+                ? Collections.singleton(WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                : AuthenticatorFactory.super.getOptionalReferenceCategories();
+    }
+
     @Override
     public boolean isConfigurable() {
         return false;
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnAuthenticator.java
index 1110957438fb..f1b53fc2d422 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnAuthenticator.java
@@ -43,12 +43,14 @@
 import org.keycloak.events.Errors;
 import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.forms.login.freemarker.model.WebAuthnAuthenticatorsBean;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.WebAuthnPolicy;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.utils.StringUtil;
 
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.Response;
@@ -66,13 +68,21 @@
 public class WebAuthnAuthenticator implements Authenticator, CredentialValidator<WebAuthnCredentialProvider> {
 
     private static final Logger logger = Logger.getLogger(WebAuthnAuthenticator.class);
-    private KeycloakSession session;
+    protected final KeycloakSession session;
 
     public WebAuthnAuthenticator(KeycloakSession session) {
         this.session = session;
     }
 
+    @Override
     public void authenticate(AuthenticationFlowContext context) {
+        LoginFormsProvider form = fillContextForm(context);
+        if (form != null) {
+            context.challenge(form.createLoginWebAuthn());
+        }
+    }
+
+    public LoginFormsProvider fillContextForm(AuthenticationFlowContext context) {
         LoginFormsProvider form = context.form();
  
         Challenge challenge = new DefaultChallenge();
@@ -92,7 +102,7 @@ public void authenticate(AuthenticationFlowContext context) {
             WebAuthnAuthenticatorsBean authenticators = new WebAuthnAuthenticatorsBean(context.getSession(), context.getRealm(), user, getCredentialType());
             if (authenticators.getAuthenticators().isEmpty()) {
                 // require the user to register webauthn authenticator
-                return;
+                return null;
             }
             isUserIdentified = true;
             form.setAttribute(WebAuthnConstants.ALLOWED_AUTHENTICATORS, authenticators);
@@ -107,7 +117,7 @@ public void authenticate(AuthenticationFlowContext context) {
         form.setAttribute(WebAuthnConstants.USER_VERIFICATION, userVerificationRequirement);
         form.setAttribute(WebAuthnConstants.SHOULD_DISPLAY_AUTHENTICATORS, shouldDisplayAuthenticators(context));
 
-        context.challenge(form.createLoginWebAuthn());
+        return form;
     }
 
     protected WebAuthnPolicy getWebAuthnPolicy(AuthenticationFlowContext context) {
@@ -129,6 +139,7 @@ protected boolean shouldDisplayAuthenticators(AuthenticationFlowContext context)
         return context.getUser() != null;
     }
 
+    @Override
     public void action(AuthenticationFlowContext context) {
         MultivaluedMap<String, String> params = context.getHttpRequest().getDecodedFormParameters();
 
@@ -136,11 +147,19 @@ public void action(AuthenticationFlowContext context) {
 
         // receive error from navigator.credentials.get()
         String errorMsgFromWebAuthnApi = params.getFirst(WebAuthnConstants.ERROR);
-        if (errorMsgFromWebAuthnApi != null && !errorMsgFromWebAuthnApi.isEmpty()) {
+        if (StringUtil.isNotBlank(errorMsgFromWebAuthnApi)) {
             setErrorResponse(context, WEBAUTHN_ERROR_API_GET, errorMsgFromWebAuthnApi);
             return;
         }
 
+        if (StringUtil.isBlank(params.getFirst(WebAuthnConstants.CREDENTIAL_ID))
+                || StringUtil.isBlank(params.getFirst(WebAuthnConstants.CLIENT_DATA_JSON))
+                || StringUtil.isBlank(params.getFirst(WebAuthnConstants.AUTHENTICATOR_DATA))
+                || StringUtil.isBlank(params.getFirst(WebAuthnConstants.SIGNATURE))) {
+            setErrorResponse(context, WEBAUTHN_ERROR_API_GET, "Missing compulsory webauthn parameters");
+            return;
+        }
+
         String baseUrl = UriUtils.getOrigin(context.getUriInfo().getBaseUri());
         String rpId = getRpID(context);
 
@@ -156,7 +175,7 @@ public void action(AuthenticationFlowContext context) {
         final String userHandle = params.getFirst(WebAuthnConstants.USER_HANDLE);
         final String userId;
         // existing User Handle means that the authenticator used Resident Key supported public key credential
-        if (userHandle == null || userHandle.isEmpty()) {
+        if (StringUtil.isBlank(userHandle)) {
             // Resident Key not supported public key credential was used
             // so rely on the user set in a previous step (if available)
             if (context.getUser() != null) {
@@ -191,10 +210,17 @@ public void action(AuthenticationFlowContext context) {
 
         boolean isUVFlagChecked = false;
         String userVerificationRequirement = getWebAuthnPolicy(context).getUserVerificationRequirement();
-        if (WebAuthnConstants.OPTION_REQUIRED.equals(userVerificationRequirement)) isUVFlagChecked = true;
+        if (Constants.WEBAUTHN_POLICY_OPTION_REQUIRED.equals(userVerificationRequirement)) isUVFlagChecked = true;
 
         UserModel user = session.users().getUserById(context.getRealm(), userId);
 
+        if (user == null) {
+            context.getEvent()
+                    .detail(WebAuthnConstants.AUTHENTICATED_USER_ID, userId);
+            setErrorResponse(context, WEBAUTHN_ERROR_USER_NOT_FOUND, null);
+            return;
+        }
+
         AuthenticationRequest authenticationRequest = new AuthenticationRequest(
                 credentialId,
                 authenticatorData,
@@ -227,24 +253,30 @@ public void action(AuthenticationFlowContext context) {
             context.getEvent()
                 .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, isUVChecked)
                 .detail(WebAuthnConstants.PUBKEY_CRED_ID_ATTR, encodedCredentialID);
-            context.success();
+            context.success(getCredentialType());
         } else {
             context.getEvent()
                 .detail(WebAuthnConstants.AUTHENTICATED_USER_ID, userId)
                 .detail(WebAuthnConstants.PUBKEY_CRED_ID_ATTR, encodedCredentialID);
             setErrorResponse(context, WEBAUTHN_ERROR_USER_NOT_FOUND, null);
-            context.cancelLogin();
+            /*
+             * Previously, we called context.cancelLogin() here, but this gave potential attackers
+             * information about existing user accounts. To avoid that, we just return here.
+             */
         }
     }
 
+    @Override
     public boolean requiresUser() {
         return true;
     }
 
+    @Override
     public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
         return user.credentialManager().isConfiguredFor(getCredentialType());
     }
 
+    @Override
     public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
         // ask the user to do required action to register webauthn authenticator
         AuthenticationSessionModel authenticationSession = session.getContext().getAuthenticationSession();
@@ -253,10 +285,12 @@ public void setRequiredActions(KeycloakSession session, RealmModel realm, UserMo
         }
     }
 
+    @Override
     public List<RequiredActionFactory> getRequiredActions(KeycloakSession session) {
         return Collections.singletonList((WebAuthnRegisterFactory)session.getKeycloakSessionFactory().getProviderFactory(RequiredActionProvider.class, WebAuthnRegisterFactory.PROVIDER_ID));
     }
 
+    @Override
     public void close() {
         // NOP
     }
@@ -266,7 +300,7 @@ public WebAuthnCredentialProvider getCredentialProvider(KeycloakSession session)
         return (WebAuthnCredentialProvider)session.getProvider(CredentialProvider.class, WebAuthnCredentialProviderFactory.PROVIDER_ID);
     }
 
-    private void setErrorResponse(AuthenticationFlowContext context, final String errorCase, final String errorMessage) {
+    protected void setErrorResponse(AuthenticationFlowContext context, final String errorCase, final String errorMessage) {
         Response errorResponse = null;
         switch (errorCase) {
         case WEBAUTHN_ERROR_REGISTRATION:
@@ -316,7 +350,7 @@ private void setErrorResponse(AuthenticationFlowContext context, final String er
         }
     }
 
-    private Response createErrorResponse(AuthenticationFlowContext context, final String errorCase) {
+    protected Response createErrorResponse(AuthenticationFlowContext context, final String errorCase) {
         LoginFormsProvider provider = context.form().setError(errorCase, "");
         UserModel user = context.getUser();
         if (user != null) {
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnConditionalUIAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnConditionalUIAuthenticator.java
new file mode 100644
index 000000000000..6f4578d5ce2c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnConditionalUIAuthenticator.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authentication.authenticators.browser;
+
+import jakarta.ws.rs.core.Response;
+import java.util.function.Function;
+import org.keycloak.WebAuthnConstants;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.common.Profile;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class WebAuthnConditionalUIAuthenticator extends WebAuthnPasswordlessAuthenticator {
+
+    private final Function<AuthenticationFlowContext, Response> errorChallenge;
+
+    public WebAuthnConditionalUIAuthenticator(KeycloakSession session, Function<AuthenticationFlowContext, Response> errorChallenge) {
+        super(session);
+        this.errorChallenge = errorChallenge;
+    }
+
+    @Override
+    public LoginFormsProvider fillContextForm(AuthenticationFlowContext context) {
+        context.form().setAttribute(WebAuthnConstants.ENABLE_WEBAUTHN_CONDITIONAL_UI, Boolean.TRUE);
+        return super.fillContextForm(context);
+    }
+
+    @Override
+    protected Response createErrorResponse(AuthenticationFlowContext context, final String errorCase) {
+        // the passkey failed, show error and maintain passkeys
+        context.form().setError(errorCase, "");
+        context.form().setAttribute(WebAuthnConstants.ENABLE_WEBAUTHN_CONDITIONAL_UI, Boolean.TRUE);
+        fillContextForm(context);
+        return errorChallenge.apply(context);
+    }
+
+    public boolean isPasskeysEnabled() {
+        return Profile.isFeatureEnabled(Profile.Feature.PASSKEYS) &&
+                Boolean.TRUE.equals(session.getContext().getRealm().getWebAuthnPolicyPasswordless().isPasskeysEnabled());
+    }
+}
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticator.java
index 3e2cd5e759e1..615e944ac57d 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticator.java
@@ -21,6 +21,8 @@
 import java.util.Collections;
 import java.util.List;
 
+import jakarta.ws.rs.core.MultivaluedMap;
+import org.keycloak.WebAuthnConstants;
 import org.keycloak.authentication.AuthenticationFlowContext;
 import org.keycloak.authentication.RequiredActionFactory;
 import org.keycloak.authentication.RequiredActionProvider;
@@ -33,7 +35,9 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.WebAuthnPolicy;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.utils.StringUtil;
 
 /**
  * Authenticator for WebAuthn authentication with passwordless credential. This class is temporary and will be likely
@@ -85,4 +89,34 @@ public boolean requiresUser() {
         return false;
     }
 
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
+        if (formData.containsKey("cancel")) {
+            context.cancelLogin();
+            return;
+        }
+
+        String username = formData.getFirst(AuthenticationManager.FORM_USERNAME);
+        if (StringUtil.isNotBlank(username)) {
+            // user entered a username directly, check if user exists
+            boolean validUsername = validateUsername(context, formData, username);
+            if (!validUsername) {
+                context.attempted();
+                return;
+            }
+        } else if (!formData.containsKey(WebAuthnConstants.USER_HANDLE)) {
+            // user submitted an empty form without webauthn credential selection
+            context.attempted();
+            return;
+        }
+
+        // user selected a webauthn credential, proceed with webauthn authentication
+        super.action(context);
+    }
+
+    protected boolean validateUsername(AuthenticationFlowContext context, MultivaluedMap<String, String> formData, String username) {
+        return new UsernameForm().validateUser(context, formData);
+    }
+
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientAuthenticator.java
index 72d4becc9332..37ff40620776 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientAuthenticator.java
@@ -18,19 +18,7 @@
 package org.keycloak.authentication.authenticators.client;
 
 
-import java.security.PublicKey;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 import jakarta.ws.rs.core.Response;
-
 import org.keycloak.OAuthErrorException;
 import org.keycloak.authentication.AuthenticationFlowError;
 import org.keycloak.authentication.ClientAuthenticationFlowContext;
@@ -42,13 +30,18 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
-import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
-import org.keycloak.protocol.oidc.par.endpoints.ParEndpoint;
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.services.ServicesLogger;
-import org.keycloak.services.Urls;
+
+import java.security.PublicKey;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 import static org.keycloak.models.TokenManager.DEFAULT_VALIDATOR;
 
@@ -113,13 +106,7 @@ public void authenticateClient(ClientAuthenticationFlowContext context) {
                 throw new RuntimeException("Signature on JWT token failed validation");
             }
 
-            // Allow both "issuer" or "token-endpoint" as audience
-            List<String> expectedAudiences = getExpectedAudiences(context, realm);
-
-            if (!token.hasAnyAudience(expectedAudiences)) {
-                throw new RuntimeException("Token audience doesn't match domain. Expected audiences are any of " + expectedAudiences
-                        + " but audience from token is '" + Arrays.asList(token.getAudience()) + "'");
-            }
+            validator.validateTokenAudience(context, realm, token);
 
             validator.validateToken();
             validator.validateTokenReuse();
@@ -208,16 +195,4 @@ public Set<String> getProtocolAuthenticatorMethods(String loginProtocol) {
             return Collections.emptySet();
         }
     }
-
-    private List<String> getExpectedAudiences(ClientAuthenticationFlowContext context, RealmModel realm) {
-        String issuerUrl = Urls.realmIssuer(context.getUriInfo().getBaseUri(), realm.getName());
-        String tokenUrl = OIDCLoginProtocolService.tokenUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
-        String tokenIntrospectUrl = OIDCLoginProtocolService.tokenIntrospectionUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
-        String parEndpointUrl = ParEndpoint.parUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
-        List<String> expectedAudiences = new ArrayList<>(Arrays.asList(issuerUrl, tokenUrl, tokenIntrospectUrl, parEndpointUrl));
-        String backchannelAuthenticationUrl = CibaGrantType.authorizationUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
-        expectedAudiences.add(backchannelAuthenticationUrl);
-
-        return expectedAudiences;
-    }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientSecretAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientSecretAuthenticator.java
index 070688440570..45d1f8d72fd1 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientSecretAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientSecretAuthenticator.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.authentication.authenticators.client;
 
+import jakarta.ws.rs.core.Response;
 import org.keycloak.authentication.AuthenticationFlowError;
 import org.keycloak.authentication.ClientAuthenticationFlowContext;
 import org.keycloak.crypto.ClientSignatureVerifierProvider;
@@ -26,14 +27,10 @@
 import org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.services.ServicesLogger;
-import org.keycloak.services.Urls;
 
-import jakarta.ws.rs.core.Response;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -114,13 +111,7 @@ public void authenticateClient(ClientAuthenticationFlowContext context) {
             }
             // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
             // JWT contents and verification in client_secret_jwt is the same as in private_key_jwt
-
-            // Allow both "issuer" or "token-endpoint" as audience
-            String issuerUrl = Urls.realmIssuer(context.getUriInfo().getBaseUri(), realm.getName());
-            String tokenUrl = OIDCLoginProtocolService.tokenUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
-            if (!token.hasAudience(issuerUrl) && !token.hasAudience(tokenUrl)) {
-                throw new RuntimeException("Token audience doesn't match domain. Realm issuer is '" + issuerUrl + "' but audience from token is '" + Arrays.asList(token.getAudience()).toString() + "'");
-            }
+            validator.validateTokenAudience(context, realm, token);
 
             validator.validateToken();
             validator.validateTokenReuse();
@@ -199,7 +190,6 @@ public Requirement[] getRequirementChoices() {
     @Override
     public String getHelpText() {
         return "Validates client based on signed JWT issued by client and signed with the Client Secret";
-
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java
index 457295ac0f40..dd821fa1fbf3 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java
@@ -19,7 +19,9 @@
 
 package org.keycloak.authentication.authenticators.client;
 
-import java.util.Optional;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
 
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.MultivaluedMap;
@@ -35,8 +37,15 @@
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.SingleUseObjectProvider;
+import org.keycloak.protocol.LoginProtocol;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
+import org.keycloak.protocol.oidc.OIDCProviderConfig;
+import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
+import org.keycloak.protocol.oidc.par.endpoints.ParEndpoint;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.services.Urls;
 
 /**
  * Common validation for JWT client authentication with private_key_jwt or with client_secret
@@ -176,6 +185,10 @@ public void validateToken() {
             throw new RuntimeException("Token is not active");
         }
 
+        if ((token.getExp() == null || token.getExp() <= 0) && (token.getIat() == null || token.getIat() <= 0)) {
+            throw new RuntimeException("Token cannot be validated. Neither the exp nor the iat claim are present.");
+        }
+
         // KEYCLOAK-2986, token-timeout or token-expiration in keycloak.json might not be used
         if (token.getExp() == null || token.getExp() <= 0) { // in case of "exp" not exist
             if (token.getIat() + ALLOWED_CLOCK_SKEW + 10 < currentTime) { // consider "exp" = 10, client's clock delays from Keycloak's clock
@@ -192,12 +205,50 @@ public void validateToken() {
         }
     }
 
+    private long calculateLifespanInSeconds()  {
+        if ((token.getExp() == null || token.getExp() <= 0) && (token.getIat() == null || token.getIat() <= 0)) {
+            throw new RuntimeException("Token cannot be validated. Neither the exp nor the iat claim are present.");
+        }
+
+        // rfc7523 marks exp as required and iat as optional: https://datatracker.ietf.org/doc/html/rfc7523#section-3
+        if (token.getExp() == null || token.getExp() <= 0) {
+            // exp not present but iat present, just allow a short period of time from iat (10s)
+            final long lifespan = token.getIat() + ALLOWED_CLOCK_SKEW + 10 - currentTime;
+            if (lifespan <= 0) {
+                throw new RuntimeException("Token is not active");
+            }
+            return lifespan;
+        } else if (token.getIat() == null || token.getIat() <= 0) {
+            // iat not present but exp present, the max-exp should not be exceeded
+            final int maxExp = OIDCAdvancedConfigWrapper.fromClientModel(client).getTokenEndpointAuthSigningMaxExp();
+            final long lifespan = token.getExp() - currentTime;
+            if (lifespan > maxExp) {
+                throw new RuntimeException("Token expiration is too far in the future and iat claim not present in token");
+            }
+            return lifespan;
+        } else {
+            // both iat and exp present, the token is just allowed to be used max-age as much
+            if (token.getIat() - ALLOWED_CLOCK_SKEW > currentTime) {
+                throw new RuntimeException("Token was issued in the future");
+            }
+            final int maxExp = OIDCAdvancedConfigWrapper.fromClientModel(client).getTokenEndpointAuthSigningMaxExp();
+            final long lifespan = Math.min(token.getExp() - currentTime, maxExp);
+            if (lifespan <= 0) {
+                throw new RuntimeException("Token is not active");
+            }
+            if (currentTime > token.getIat() + maxExp) {
+                throw new RuntimeException("Token was issued too far in the past to be used now");
+            }
+            return lifespan;
+        }
+    }
+
     public void validateTokenReuse() {
         if (token == null) throw new IllegalStateException("Incorrect usage. Variable 'token' is null. Need to read token first before validateToken reuse");
         if (client == null) throw new IllegalStateException("Incorrect usage. Variable 'client' is null. Need to validate client first before validateToken reuse");
 
         SingleUseObjectProvider singleUseCache = context.getSession().singleUseObjects();
-        long lifespanInSecs = Math.max(Optional.ofNullable(token.getExp()).orElse(0L) - currentTime, 10);
+        long lifespanInSecs = calculateLifespanInSeconds();
         if (singleUseCache.putIfAbsent(token.getId(), lifespanInSecs)) {
             logger.tracef("Added token '%s' to single-use cache. Lifespan: %d seconds, client: %s", token.getId(), lifespanInSecs, client.getClientId());
 
@@ -207,6 +258,37 @@ public void validateTokenReuse() {
         }
     }
 
+    public void validateTokenAudience(ClientAuthenticationFlowContext context, RealmModel realm, JsonWebToken token) {
+        List<String> expectedAudiences = getExpectedAudiences(context, realm);
+        if (!token.hasAnyAudience(expectedAudiences)) {
+            throw new RuntimeException("Token audience doesn't match domain. Expected audiences are any of " + expectedAudiences
+                    + " but audience from token is '" + Arrays.asList(token.getAudience()) + "'");
+        }
+
+        if (!isAllowMultipleAudiencesForJwtClientAuthentication(context) && token.getAudience().length > 1) {
+            throw new RuntimeException("Multiple audiences not allowed in the JWT token for client authentication");
+        }
+    }
+
+    private boolean isAllowMultipleAudiencesForJwtClientAuthentication(ClientAuthenticationFlowContext context) {
+        OIDCLoginProtocol loginProtocol = (OIDCLoginProtocol) context.getSession().getProvider(LoginProtocol.class, OIDCLoginProtocol.LOGIN_PROTOCOL);
+        OIDCProviderConfig config = loginProtocol.getConfig();
+        return config.isAllowMultipleAudiencesForJwtClientAuthentication();
+    }
+
+    private List<String> getExpectedAudiences(ClientAuthenticationFlowContext context, RealmModel realm) {
+
+        String issuerUrl = Urls.realmIssuer(context.getUriInfo().getBaseUri(), realm.getName());
+        String tokenUrl = OIDCLoginProtocolService.tokenUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
+        String tokenIntrospectUrl = OIDCLoginProtocolService.tokenIntrospectionUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
+        String parEndpointUrl = ParEndpoint.parUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
+        List<String> expectedAudiences = new ArrayList<>(Arrays.asList(issuerUrl, tokenUrl, tokenIntrospectUrl, parEndpointUrl));
+        String backchannelAuthenticationUrl = CibaGrantType.authorizationUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
+        expectedAudiences.add(backchannelAuthenticationUrl);
+
+        return expectedAudiences;
+    }
+
     public ClientAuthenticationFlowContext getContext() {
         return context;
     }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/resetcred/ResetCredentialEmail.java b/services/src/main/java/org/keycloak/authentication/authenticators/resetcred/ResetCredentialEmail.java
index 0e14e3eeed95..2f388def0fd5 100755
--- a/services/src/main/java/org/keycloak/authentication/authenticators/resetcred/ResetCredentialEmail.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/resetcred/ResetCredentialEmail.java
@@ -30,13 +30,21 @@
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
-import org.keycloak.models.*;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.AuthenticatorConfigModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.FormMessage;
 import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
 import org.keycloak.services.ServicesLogger;
+import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.sessions.AuthenticationSessionCompoundId;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.storage.StorageId;
 
 import java.util.*;
 import jakarta.ws.rs.core.Response;
@@ -53,6 +61,8 @@ public class ResetCredentialEmail implements Authenticator, AuthenticatorFactory
     private static final Logger logger = Logger.getLogger(ResetCredentialEmail.class);
 
     public static final String PROVIDER_ID = "reset-credential-email";
+    public static final String FORCE_LOGIN = "force-login";
+    public static final String FEDERATED_OPTION = "only-federated";
 
     @Override
     public void authenticate(AuthenticationFlowContext context) {
@@ -70,6 +80,10 @@ public void authenticate(AuthenticationFlowContext context) {
         String actionTokenUserId = authenticationSession.getAuthNote(DefaultActionTokenKey.ACTION_TOKEN_USER_ID);
         if (actionTokenUserId != null && Objects.equals(user.getId(), actionTokenUserId)) {
             logger.debugf("Forget-password triggered when reauthenticating user after authentication via action token. Skipping " + PROVIDER_ID + " screen and using user '%s' ", user.getUsername());
+            if (forceLogin(context.getAuthenticatorConfig(), user)) {
+                // force end of auth session after the required actions
+                context.getAuthenticationSession().setAuthNote(AuthenticationManager.END_AFTER_REQUIRED_ACTIONS, "true");
+            }
             context.success();
             return;
         }
@@ -107,14 +121,12 @@ public void authenticate(AuthenticationFlowContext context) {
             context.forkWithSuccessMessage(new FormMessage(Messages.EMAIL_SENT));
         } catch (EmailException e) {
             event.clone().event(EventType.SEND_RESET_PASSWORD)
+                    .detail(Details.REASON, e.getMessage())
                     .detail(Details.USERNAME, username)
                     .user(user)
                     .error(Errors.EMAIL_SEND_FAILED);
             ServicesLogger.LOGGER.failedToSendPwdResetEmail(e);
-            Response challenge = context.form()
-                    .setError(Messages.EMAIL_SENT_ERROR)
-                    .createErrorPage(Response.Status.INTERNAL_SERVER_ERROR);
-            context.failure(AuthenticationFlowError.INTERNAL_ERROR, challenge);
+            context.forkWithSuccessMessage(new FormMessage(Messages.EMAIL_SENT));
         }
     }
 
@@ -159,7 +171,7 @@ public String getReferenceCategory() {
 
     @Override
     public boolean isConfigurable() {
-        return false;
+        return true;
     }
 
     public static final AuthenticationExecutionModel.Requirement[] REQUIREMENT_CHOICES = {
@@ -183,7 +195,24 @@ public String getHelpText() {
 
     @Override
     public List<ProviderConfigProperty> getConfigProperties() {
-        return null;
+        return ProviderConfigurationBuilder.create()
+                .property()
+                .name(FORCE_LOGIN)
+                .label("Force login after reset")
+                .helpText(
+                        """
+                        If this property is true, the user needs to login again after the reset credentials.
+                        If this property is false, the user will be automatically logged in after the succesful
+                        reset credentials when the same authentication session is used.
+                        If this property is only-federated (default), only federated users will be forced to login again,
+                        users stored in the internal database will be logged in if using the same authentication session.
+                        """
+                )
+                .type(ProviderConfigProperty.LIST_TYPE)
+                .options(Arrays.asList(Boolean.TRUE.toString(), Boolean.FALSE.toString(), FEDERATED_OPTION))
+                .defaultValue(FEDERATED_OPTION)
+                .add()
+                .build();
     }
 
     @Override
@@ -210,4 +239,19 @@ public void postInit(KeycloakSessionFactory factory) {
     public String getId() {
         return PROVIDER_ID;
     }
+
+    private boolean forceLogin(AuthenticatorConfigModel config, UserModel user) {
+        final String forceLogin = config != null? config.getConfig().get(FORCE_LOGIN) : null;
+        if (forceLogin == null || FEDERATED_OPTION.equalsIgnoreCase(forceLogin)) {
+            // default is only-federated, return true only for federated users
+            return !StorageId.isLocalStorage(user.getId()) || user.isFederated();
+        } else if (Boolean.TRUE.toString().equalsIgnoreCase(forceLogin)) {
+            return Boolean.TRUE;
+        } else if (Boolean.FALSE.toString().equalsIgnoreCase(forceLogin)) {
+            return Boolean.FALSE;
+        } else {
+            logger.warnf("Invalid value for force-login option: %s", forceLogin);
+            throw new AuthenticationFlowException("Invalid value for force-login option: " + forceLogin, AuthenticationFlowError.INTERNAL_ERROR);
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/sessionlimits/UserSessionLimitsAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/sessionlimits/UserSessionLimitsAuthenticator.java
index 8e933d67dff2..a457297ab28a 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/sessionlimits/UserSessionLimitsAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/sessionlimits/UserSessionLimitsAuthenticator.java
@@ -79,10 +79,19 @@ public void authenticate(AuthenticationFlowContext context) {
                 logger.infof("Too many session in this realm for the current user. Session count: %s", userSessionCountForRealm);
                 String eventDetails = String.format("Realm session limit exceeded. Realm: %s, Realm limit: %s. Session count: %s, User id: %s",
                         context.getRealm().getName(), userRealmLimit, userSessionCountForRealm, context.getUser().getId());
-                handleLimitExceeded(context, userSessionsForRealm, eventDetails, userRealmLimit);
+
+                var removedClientSessions = handleLimitExceeded(context, userSessionsForClient, eventDetails, userClientLimit);
+                if (exceedsLimit(userSessionCountForRealm - removedClientSessions.size(), userRealmLimit))
+                {
+                    List<UserSessionModel> remainingSessionsToBeRemoved = userSessionsForRealm
+                            .stream()
+                            .filter(userSessionModel -> !removedClientSessions.contains(userSessionModel))
+                            .collect(Collectors.toList());
+                    handleLimitExceeded(context, remainingSessionsToBeRemoved, eventDetails, userRealmLimit);
+                }
             } // otherwise if the user is still allowed to create a new session in the realm, check if this applies for this specific client as well.
             else if (newClientSession && exceedsLimit(userSessionCountForClient, userClientLimit)) {
-                logger.infof("Too many sessions related to the current client for this user. Session count: %s", userSessionCountForRealm);
+                logger.infof("Too many sessions related to the current client for this user. Session count: %s", userSessionCountForClient);
                 String eventDetails = String.format("Client session limit exceeded. Realm: %s, Client limit: %s. Session count: %s, User id: %s",
                         context.getRealm().getName(), userClientLimit, userSessionCountForClient, context.getUser().getId());
                 handleLimitExceeded(context, userSessionsForClient, eventDetails, userClientLimit);
@@ -148,7 +157,10 @@ public void close() {
 
     }
 
-    private void handleLimitExceeded(AuthenticationFlowContext context, List<UserSessionModel> userSessions, String eventDetails, long limit) {
+    /**
+     * @return A list of logged-out user sessions, if any.
+     */
+    private List<UserSessionModel> handleLimitExceeded(AuthenticationFlowContext context, List<UserSessionModel> userSessions, String eventDetails, long limit) {
         switch (behavior) {
             case UserSessionLimitsAuthenticatorFactory.DENY_NEW_SESSION:
                 logger.info("Denying new session");
@@ -160,17 +172,22 @@ private void handleLimitExceeded(AuthenticationFlowContext context, List<UserSes
                 context.getEvent().error(Errors.GENERIC_AUTHENTICATION_ERROR);
                 Response challenge = context.form().setError(errorMessage).createErrorPage(Response.Status.FORBIDDEN);
                 context.failure(AuthenticationFlowError.GENERIC_AUTHENTICATION_ERROR, challenge, eventDetails, errorMessage);
-                break;
+                return Collections.emptyList();
 
             case UserSessionLimitsAuthenticatorFactory.TERMINATE_OLDEST_SESSION:
                 logger.info("Terminating oldest session");
-                logoutOldestSessions(userSessions, limit);
+                var removedSessions = logoutOldestSessions(userSessions, limit);
                 context.success();
-                break;
+                return removedSessions;
         }
+
+        return Collections.emptyList();
     }
 
-    private void logoutOldestSessions(List<UserSessionModel> userSessions, long limit) {
+    /**
+     * @return A list of logged-out user sessions, if any.
+     */
+    private List<UserSessionModel> logoutOldestSessions(List<UserSessionModel> userSessions, long limit) {
         long numberOfSessionsThatNeedToBeLoggedOut = getNumberOfSessionsThatNeedToBeLoggedOut(userSessions.size(), limit);
         if (numberOfSessionsThatNeedToBeLoggedOut == 1) {
             logger.info("Logging out oldest session");
@@ -178,10 +195,16 @@ private void logoutOldestSessions(List<UserSessionModel> userSessions, long limi
             logger.infof("Logging out oldest %s sessions", numberOfSessionsThatNeedToBeLoggedOut);
         }
 
-        userSessions
+        List<UserSessionModel> userSessionsToBeRemoved = userSessions
             .stream()
             .sorted(Comparator.comparingInt(UserSessionModel::getLastSessionRefresh))
             .limit(numberOfSessionsThatNeedToBeLoggedOut)
-            .forEach(userSession -> AuthenticationManager.backchannelLogout(session, userSession, true));
+            .toList();
+
+        for (UserSessionModel userSession : userSessionsToBeRemoved) {
+            AuthenticationManager.backchannelLogout(session, userSession, true);
+        }
+
+        return userSessionsToBeRemoved;
     }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/util/AcrStore.java b/services/src/main/java/org/keycloak/authentication/authenticators/util/AcrStore.java
index d1278f08087f..f0e73650c13e 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/util/AcrStore.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/util/AcrStore.java
@@ -188,6 +188,17 @@ public void setLevelAuthenticatedToCurrentRequest(int level) {
         authSession.setAuthNote(Constants.LEVEL_OF_AUTHENTICATION, String.valueOf(level));
     }
 
+    /**
+     * Set level to the current authentication session if an auth flow loa is present and is higher then the current loa
+     */
+    public void setAuthFlowLevelAuthenticatedToCurrentRequest() {
+        if (authSession.getAuthNote(Constants.AUTHENTICATION_FLOW_LEVEL_OF_AUTHENTICATION) != null) {
+            int authFlowLoa = Integer.parseInt(authSession.getAuthNote(Constants.AUTHENTICATION_FLOW_LEVEL_OF_AUTHENTICATION));
+            if (getLevelOfAuthenticationFromCurrentAuthentication() < authFlowLoa) {
+                setLevelAuthenticatedToCurrentRequest(authFlowLoa);
+            }
+        }
+    }
 
     private void setLevelAuthenticatedToMap(int level) {
         Map<Integer, Integer> levels = getCurrentAuthenticatedLevelsMap();
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticator.java
index 4cda4e9a5ef7..7f4886f67ffb 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticator.java
@@ -66,6 +66,7 @@ public abstract class AbstractX509ClientCertificateAuthenticator implements Auth
     public static final String TIMESTAMP_VALIDATION = "x509-cert-auth.timestamp-validation-enabled";
     public static final String SERIALNUMBER_HEX = "x509-cert-auth.serialnumber-hex-enabled";
     public static final String CRL_RELATIVE_PATH = "x509-cert-auth.crl-relative-path";
+    public static final String CRL_ABORT_IF_NON_UPDATED = "x509-cert-auth-crl-abort-if-non-updated";
     public static final String OCSPRESPONDER_URI = "x509-cert-auth.ocsp-responder-uri";
     public static final String OCSPRESPONDER_CERTIFICATE = "x509-cert-auth.ocsp-responder-certificate";
     public static final String MAPPING_SOURCE_SELECTION = "x509-cert-auth.mapping-source-selection";
@@ -115,6 +116,7 @@ static CertificateValidator.CertificateValidatorBuilder fromConfig(KeycloakSessi
                         .mode(config.getCertificatePolicyMode().getMode())
                         .parse(config.getCertificatePolicy())
                     .revocation()
+                        .crlAbortIfNonUpdated(config.getCrlAbortIfNonUpdated())
                         .cRLEnabled(config.getCRLEnabled())
                         .cRLDPEnabled(config.getCRLDistributionPointEnabled())
                         .cRLrelativePath(config.getCRLRelativePath())
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticatorFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticatorFactory.java
index 8b38faff4f03..9828f9c609d9 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticatorFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/x509/AbstractX509ClientCertificateAuthenticatorFactory.java
@@ -173,6 +173,16 @@ public abstract class AbstractX509ClientCertificateAuthenticatorFactory implemen
                 "Multiple CRLs can be included, however it can affect performance as the certificate will be checked against all listed CRLs."
         );
 
+        ProviderConfigProperty cRLAbortIfNonUpdated = new ProviderConfigProperty();
+        cRLAbortIfNonUpdated.setType(BOOLEAN_TYPE);
+        cRLAbortIfNonUpdated.setName(CRL_ABORT_IF_NON_UPDATED);
+        cRLAbortIfNonUpdated.setDefaultValue(Boolean.TRUE.toString());
+        cRLAbortIfNonUpdated.setLabel("CRL abort if non updated");
+        cRLAbortIfNonUpdated.setHelpText("A CRL conforming RFC 5280 must include a next update time that marks when the CRL will be updated. " +
+                "If this option is true, the authentication fails when the CRL is outdated and cannot be updated. " +
+                "If false, the authentication continues when the CRL cannot be updated after the next update time."
+        );
+
         ProviderConfigProperty oCspCheckingEnabled = new ProviderConfigProperty();
         oCspCheckingEnabled.setType(BOOLEAN_TYPE);
         oCspCheckingEnabled.setName(ENABLE_OCSP);
@@ -248,6 +258,7 @@ public abstract class AbstractX509ClientCertificateAuthenticatorFactory implemen
                 crlCheckingEnabled,
                 crlDPEnabled,
                 cRLRelativePath,
+                cRLAbortIfNonUpdated,
                 oCspCheckingEnabled,
                 ocspFailOpen,
                 ocspResponderUri,
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/x509/CertificateValidator.java b/services/src/main/java/org/keycloak/authentication/authenticators/x509/CertificateValidator.java
index 31f3db0c7dbb..a9ad5dd93358 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/x509/CertificateValidator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/x509/CertificateValidator.java
@@ -21,7 +21,6 @@
 import static org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator.CERTIFICATE_POLICY_MODE_ANY;
 
 import java.io.ByteArrayInputStream;
-import java.io.DataInputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -48,6 +47,7 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Date;
 import java.util.HashSet;
 import java.util.Hashtable;
 import java.util.LinkedList;
@@ -73,6 +73,7 @@
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.httpclient.HttpClientProvider;
+import org.keycloak.crl.CrlStorageProvider;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.truststore.TruststoreProvider;
@@ -238,10 +239,10 @@ public static class CRLListLoader extends CRLLoaderImpl {
 
         private final List<CRLLoaderImpl> delegates;
 
-        public CRLListLoader(KeycloakSession session, String cRLConfigValue) {
+        public CRLListLoader(KeycloakSession session, String cRLConfigValue, boolean abortIfNonUpdated) {
             String[] delegatePaths = Constants.CFG_DELIMITER_PATTERN.split(cRLConfigValue);
             this.delegates = Arrays.stream(delegatePaths)
-                    .map(cRLPath -> new CRLFileLoader(session, cRLPath))
+                    .map(cRLPath -> new CRLFileLoader(session, cRLPath, abortIfNonUpdated))
                     .collect(Collectors.toList());
         }
 
@@ -261,16 +262,16 @@ public static class CRLFileLoader extends CRLLoaderImpl {
         private final KeycloakSession session;
         private final String cRLPath;
         private final LdapContext ldapContext;
+        private final boolean abortIfNonUpdated;
 
-        public CRLFileLoader(KeycloakSession session, String cRLPath) {
-            this.session = session;
-            this.cRLPath = cRLPath;
-            ldapContext = new LdapContext();
+        public CRLFileLoader(KeycloakSession session, String cRLPath, boolean abortIfNonUpdated) {
+            this(session, cRLPath, abortIfNonUpdated, new LdapContext());
         }
 
-        public CRLFileLoader(KeycloakSession session, String cRLPath, LdapContext ldapContext) {
+        public CRLFileLoader(KeycloakSession session, String cRLPath, boolean abortIfNonUpdated, LdapContext ldapContext) {
             this.session = session;
             this.cRLPath = cRLPath;
+            this.abortIfNonUpdated = abortIfNonUpdated;
             this.ldapContext = ldapContext;
 
             if (ldapContext == null)
@@ -278,37 +279,53 @@ public CRLFileLoader(KeycloakSession session, String cRLPath, LdapContext ldapCo
         }
 
         public Collection<X509CRL> getX509CRLs() throws GeneralSecurityException {
-            CertificateFactory cf = CertificateFactory.getInstance("X.509");
-            Collection<X509CRL> crlColl = null;
+            if (cRLPath == null) {
+                throw new GeneralSecurityException("Unable to load CRL because no crl path is defined");
+            }
 
-            if (cRLPath != null) {
-                if (cRLPath.startsWith("http") || cRLPath.startsWith("https")) {
-                    // load CRL using remote URI
-                    try {
-                        crlColl = loadFromURI(cf, new URI(cRLPath));
-                    } catch (URISyntaxException e) {
-                        logger.error(e.getMessage());
-                    }
-                } else if (cRLPath.startsWith("ldap")) {
-                    // load CRL from LDAP
-                    try {
-                        crlColl = loadCRLFromLDAP(cf, new URI(cRLPath));
-                    } catch(URISyntaxException e) {
-                        logger.error(e.getMessage());
-                    }
-                } else {
-                    // load CRL from file
-                    crlColl = loadCRLFromFile(cf, cRLPath);
+            CrlStorageProvider crlCache = session.getProvider(CrlStorageProvider.class);
+            final X509CRL crl = crlCache.get(cRLPath, this::loadCRL);
+
+            if (crl == null) {
+                throw new GeneralSecurityException(String.format("Unable to load CRL from \"%s\"", cRLPath));
+            }
+
+            if (crl.getNextUpdate() != null && crl.getNextUpdate().compareTo(new Date(Time.currentTimeMillis())) < 0) {
+                final String message = String.format("CRL from '%s' is not refreshed. Next update is %s.", cRLPath, crl.getNextUpdate());
+                logger.warn(message);
+                if (abortIfNonUpdated) {
+                    throw new GeneralSecurityException(message);
                 }
             }
-            if (crlColl == null || crlColl.size() == 0) {
-                String message = String.format("Unable to load CRL from \"%s\"", cRLPath);
-                throw new GeneralSecurityException(message);
+
+            return Collections.singletonList(crl);
+        }
+
+        private X509CRL loadCRL() throws GeneralSecurityException {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            X509CRL crl = null;
+            if (cRLPath.startsWith("http") || cRLPath.startsWith("https")) {
+                // load CRL using remote URI
+                try {
+                    crl = loadFromURI(cf, new URI(cRLPath));
+                } catch (URISyntaxException e) {
+                    logger.error(e.getMessage());
+                }
+            } else if (cRLPath.startsWith("ldap")) {
+                // load CRL from LDAP
+                try {
+                    crl = loadCRLFromLDAP(cf, new URI(cRLPath));
+                } catch (URISyntaxException e) {
+                    logger.error(e.getMessage());
+                }
+            } else {
+                // load CRL from file
+                crl = loadCRLFromFile(cf, cRLPath);
             }
-            return crlColl;
+            return crl;
         }
 
-        private Collection<X509CRL> loadFromURI(CertificateFactory cf, URI remoteURI) throws GeneralSecurityException {
+        private X509CRL loadFromURI(CertificateFactory cf, URI remoteURI) throws GeneralSecurityException {
             try {
                 logger.debugf("Loading CRL from %s", remoteURI.toString());
 
@@ -317,10 +334,8 @@ private Collection<X509CRL> loadFromURI(CertificateFactory cf, URI remoteURI) th
                 get.setHeader("Pragma", "no-cache");
                 get.setHeader("Cache-Control", "no-cache, no-store");
                 try (CloseableHttpResponse response = httpClient.execute(get)) {
-                    try {
-                        InputStream content = response.getEntity().getContent();
-                        X509CRL crl = loadFromStream(cf, content);
-                        return Collections.singleton(crl);
+                    try (InputStream content = response.getEntity().getContent()) {
+                        return loadFromStream(cf, content);
                     } finally {
                         EntityUtils.consumeQuietly(response.getEntity());
                     }
@@ -329,11 +344,11 @@ private Collection<X509CRL> loadFromURI(CertificateFactory cf, URI remoteURI) th
             catch(IOException ex) {
                 logger.errorf(ex.getMessage());
             }
-            return Collections.emptyList();
+            return null;
 
         }
 
-        private Collection<X509CRL> loadCRLFromLDAP(CertificateFactory cf, URI remoteURI) throws GeneralSecurityException {
+        private X509CRL loadCRLFromLDAP(CertificateFactory cf, URI remoteURI) throws GeneralSecurityException {
             Hashtable<String, String> env = new Hashtable<>(2);
             env.put(Context.INITIAL_CONTEXT_FACTORY, ldapContext.getLdapFactoryClassName());
             env.put(Context.PROVIDER_URL, remoteURI.toString());
@@ -347,8 +362,9 @@ private Collection<X509CRL> loadCRLFromLDAP(CertificateFactory cf, URI remoteURI
                     if (data == null || data.length == 0) {
                         throw new CertificateException(String.format("Failed to download CRL from \"%s\"", remoteURI.toString()));
                     }
-                    X509CRL crl = loadFromStream(cf, new ByteArrayInputStream(data));
-                    return Collections.singleton(crl);
+                    try (InputStream is = new ByteArrayInputStream(data)) {
+                        return loadFromStream(cf, is);
+                    }
                 } finally {
                     ctx.close();
                 }
@@ -358,10 +374,10 @@ private Collection<X509CRL> loadCRLFromLDAP(CertificateFactory cf, URI remoteURI
                 logger.error(e.getMessage());
             }
 
-            return Collections.emptyList();
+            return null;
         }
 
-        private Collection<X509CRL> loadCRLFromFile(CertificateFactory cf, String relativePath) throws GeneralSecurityException {
+        private X509CRL loadCRLFromFile(CertificateFactory cf, String relativePath) throws GeneralSecurityException {
             try {
                 String configDir = System.getProperty("jboss.server.config.dir");
                 if (configDir != null) {
@@ -373,8 +389,7 @@ private Collection<X509CRL> loadCRLFromFile(CertificateFactory cf, String relati
                             throw new IOException(String.format("Unable to read CRL from \"%s\"", f.getAbsolutePath()));
                         }
                         try (FileInputStream is = new FileInputStream(f.getAbsolutePath())) {
-                            X509CRL crl = loadFromStream(cf, is);
-                            return Collections.singleton(crl);
+                            return loadFromStream(cf, is);
                         }
                     }
                 }
@@ -382,13 +397,11 @@ private Collection<X509CRL> loadCRLFromFile(CertificateFactory cf, String relati
             catch(IOException ex) {
                 logger.errorf(ex.getMessage());
             }
-            return Collections.emptyList();
+            return null;
         }
+
         private X509CRL loadFromStream(CertificateFactory cf, InputStream is) throws IOException, CRLException {
-            DataInputStream dis = new DataInputStream(is);
-            X509CRL crl = (X509CRL)cf.generateCRL(dis);
-            dis.close();
-            return crl;
+            return (X509CRL) cf.generateCRL(is);
         }
     }
 
@@ -399,6 +412,7 @@ private X509CRL loadFromStream(CertificateFactory cf, InputStream is) throws IOE
     List<String> _certificatePolicy;
     String _certificatePolicyMode;
     boolean _crlCheckingEnabled;
+    boolean _crlAbortIfNonUpdated;
     boolean _crldpEnabled;
     CRLLoaderImpl _crlLoader;
     boolean _ocspEnabled;
@@ -414,6 +428,7 @@ protected CertificateValidator(X509Certificate[] certChain,
                          int keyUsageBits, List<String> extendedKeyUsage,
                                    List<String> certificatePolicy, String certificatePolicyMode,
                                    boolean cRLCheckingEnabled,
+                                   boolean cRLAbortIfNonUpdated,
                                    boolean cRLDPCheckingEnabled,
                                    CRLLoaderImpl crlLoader,
                                    boolean oCSPCheckingEnabled,
@@ -428,6 +443,7 @@ protected CertificateValidator(X509Certificate[] certChain,
         _certificatePolicy = certificatePolicy;
         _certificatePolicyMode = certificatePolicyMode;
         _crlCheckingEnabled = cRLCheckingEnabled;
+        _crlAbortIfNonUpdated = cRLAbortIfNonUpdated;
         _crldpEnabled = cRLDPCheckingEnabled;
         _crlLoader = crlLoader;
         _ocspEnabled = oCSPCheckingEnabled;
@@ -510,7 +526,7 @@ private static void validateExtendedKeyUsage(X509Certificate[] certs, List<Strin
 
 
     private static void validatePolicy(X509Certificate[] certs, List<String> expectedPolicies, String policyCheckMode) throws GeneralSecurityException {
-        if (expectedPolicies == null || expectedPolicies.size() == 0) {
+        if (expectedPolicies == null || expectedPolicies.isEmpty()) {
             logger.debug("Certificate Policy validation is not enabled.");
             return;
         }
@@ -748,7 +764,7 @@ else if (rs.getRevocationStatus() == OCSPProvider.RevocationStatus.REVOKED) {
 
     private static void checkRevocationStatusUsingCRL(X509Certificate[] certs, CRLLoaderImpl crLoader, KeycloakSession session) throws GeneralSecurityException {
         Collection<X509CRL> crlColl = crLoader.getX509CRLs();
-        if (crlColl != null && crlColl.size() > 0) {
+        if (crlColl != null && !crlColl.isEmpty()) {
             for (X509CRL it : crlColl) {
                 CRLUtils.check(certs, it, session);
             }
@@ -765,15 +781,15 @@ private static List<String> getCRLDistributionPoints(X509Certificate cert) {
         return new ArrayList<>();
     }
 
-    private static void checkRevocationStatusUsingCRLDistributionPoints(X509Certificate[] certs, KeycloakSession session) throws GeneralSecurityException {
+    private static void checkRevocationStatusUsingCRLDistributionPoints(X509Certificate[] certs, KeycloakSession session, boolean abortIfNonUpdated) throws GeneralSecurityException {
 
         List<String> distributionPoints = getCRLDistributionPoints(certs[0]);
-        if (distributionPoints == null || distributionPoints.size() == 0) {
+        if (distributionPoints == null || distributionPoints.isEmpty()) {
             throw new GeneralSecurityException("Could not find any CRL distribution points in the certificate, unable to check the certificate revocation status using CRL/DP.");
         }
         for (String dp : distributionPoints) {
             logger.tracef("CRL Distribution point: \"%s\"", dp);
-            checkRevocationStatusUsingCRL(certs, new CRLFileLoader(session, dp), session);
+            checkRevocationStatusUsingCRL(certs, new CRLFileLoader(session, dp, abortIfNonUpdated), session);
         }
     }
 
@@ -785,7 +801,7 @@ public CertificateValidator checkRevocationStatus() throws GeneralSecurityExcept
             if (!_crldpEnabled) {
                 checkRevocationStatusUsingCRL(_certChain, _crlLoader, session);
             } else {
-                checkRevocationStatusUsingCRLDistributionPoints(_certChain, session);
+                checkRevocationStatusUsingCRLDistributionPoints(_certChain, session, _crlAbortIfNonUpdated);
             }
         }
         if (_ocspEnabled) {
@@ -808,6 +824,7 @@ public static class CertificateValidatorBuilder {
         List<String> _certificatePolicy;
         String _certificatePolicyMode;
         boolean _crlCheckingEnabled;
+        boolean _crlAbortIfNonUpdated;
         boolean _crldpEnabled;
         CRLLoaderImpl _crlLoader;
         boolean _ocspEnabled;
@@ -954,6 +971,11 @@ protected RevocationStatusCheckBuilder(CertificateValidatorBuilder parent) {
                 _parent = parent;
             }
 
+            public RevocationStatusCheckBuilder crlAbortIfNonUpdated(boolean abortIfNonUpdated) {
+                _crlAbortIfNonUpdated = abortIfNonUpdated;
+                return this;
+            }
+
             public GotCRL cRLEnabled(boolean value) {
                 _crlCheckingEnabled = value;
                 return new GotCRL();
@@ -975,7 +997,7 @@ public GotOCSP oCSPEnabled(boolean value) {
             public class GotCRLDP {
                 public GotCRLRelativePath cRLrelativePath(String value) {
                     if (value != null)
-                        _crlLoader = new CRLListLoader(session, value);
+                        _crlLoader = new CRLListLoader(session, value, _crlAbortIfNonUpdated);
                     return new GotCRLRelativePath();
                 }
 
@@ -1071,11 +1093,11 @@ public TrustValidationBuilder trustValidation() {
 
         public CertificateValidator build(X509Certificate[] certs) {
             if (_crlLoader == null) {
-                 _crlLoader = new CRLFileLoader(session, "");
+                 _crlLoader = new CRLFileLoader(session, "", _crlAbortIfNonUpdated);
             }
             return new CertificateValidator(certs, _keyUsageBits, _extendedKeyUsage,
                     _certificatePolicy, _certificatePolicyMode,
-                    _crlCheckingEnabled, _crldpEnabled, _crlLoader, _ocspEnabled, _ocspFailOpen,
+                    _crlCheckingEnabled, _crlAbortIfNonUpdated, _crldpEnabled, _crlLoader, _ocspEnabled, _ocspFailOpen,
                     new BouncyCastleOCSPChecker(session, _responderUri, _responderCert), session, _timestampValidationEnabled, _trustValidationEnabled);
         }
     }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509AuthenticatorConfigModel.java b/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509AuthenticatorConfigModel.java
index 0a087e5c59de..7fe0106a9999 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509AuthenticatorConfigModel.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509AuthenticatorConfigModel.java
@@ -161,6 +161,15 @@ public X509AuthenticatorConfigModel setCRLRelativePath(String path) {
         return this;
     }
 
+    public boolean getCrlAbortIfNonUpdated() {
+        return Boolean.parseBoolean(getConfig().get(CRL_ABORT_IF_NON_UPDATED));
+    }
+
+    public X509AuthenticatorConfigModel setCrlAbortIfNonUpdated(boolean crlAbortIfNonUpdated) {
+        getConfig().put(CRL_ABORT_IF_NON_UPDATED, Boolean.toString(crlAbortIfNonUpdated));
+        return this;
+    }
+
     public String getOCSPResponder() {
         return getConfig().getOrDefault(OCSPRESPONDER_URI, null);
     }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509ClientCertificateAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509ClientCertificateAuthenticator.java
index 9d753192cbf0..6ff376d5f130 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509ClientCertificateAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/x509/X509ClientCertificateAuthenticator.java
@@ -34,6 +34,7 @@
 import org.keycloak.events.Errors;
 import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.FormMessage;
 import org.keycloak.services.ServicesLogger;
@@ -179,7 +180,7 @@ public void authenticate(AuthenticationFlowContext context) {
             }
             else {
                 // Bypass the confirmation page and log the user in
-                context.success();
+                context.success(UserCredentialModel.CLIENT_CERT);
             }
         }
         catch(Exception e) {
@@ -269,7 +270,7 @@ public void action(AuthenticationFlowContext context) {
         }
         if (context.getUser() != null) {
             recordX509CertificateAuditDataViaContextEvent(context);
-            context.success();
+            context.success(UserCredentialModel.CLIENT_CERT);
             return;
         }
         context.attempted();
diff --git a/services/src/main/java/org/keycloak/authentication/forms/RegistrationRecaptcha.java b/services/src/main/java/org/keycloak/authentication/forms/RegistrationRecaptcha.java
index c9aff990847b..5b0a88aecb11 100755
--- a/services/src/main/java/org/keycloak/authentication/forms/RegistrationRecaptcha.java
+++ b/services/src/main/java/org/keycloak/authentication/forms/RegistrationRecaptcha.java
@@ -47,6 +47,7 @@ public class RegistrationRecaptcha extends AbstractRegistrationRecaptcha {
 
     // option keys
     public static final String SECRET_KEY = "secret.key";
+    public static final String OLD_SECRET = "secret";
 
     @Override
     public String getDisplayType() {
@@ -68,7 +69,8 @@ public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
 
     @Override
     protected boolean validateConfig(Map<String, String> config) {
-        return !(StringUtil.isNullOrEmpty(config.get(SITE_KEY)) || StringUtil.isNullOrEmpty(config.get(SECRET_KEY)));
+        return !StringUtil.isNullOrEmpty(config.get(SITE_KEY)) &&
+                (!StringUtil.isNullOrEmpty(config.get(SECRET_KEY)) || !StringUtil.isNullOrEmpty(config.get(OLD_SECRET)));
     }
 
     @Override
@@ -78,9 +80,20 @@ protected boolean validate(ValidationContext context, String captcha, Map<String
 
         HttpPost post = new HttpPost("https://www." + getRecaptchaDomain(config) + "/recaptcha/api/siteverify");
         List<NameValuePair> formparams = new LinkedList<>();
-        formparams.add(new BasicNameValuePair("secret", config.get(SECRET_KEY)));
+        String secret = config.get(SECRET_KEY);
+        if (StringUtil.isNullOrEmpty(secret)) {
+            // migrate old config name to the new one
+            secret = config.get(OLD_SECRET);
+            if (!StringUtil.isNullOrEmpty(secret)) {
+                config.put(SECRET_KEY, secret);
+                config.remove(OLD_SECRET);
+            }
+        }
+        formparams.add(new BasicNameValuePair("secret", secret));
         formparams.add(new BasicNameValuePair("response", captcha));
-        formparams.add(new BasicNameValuePair("remoteip", context.getConnection().getRemoteAddr()));
+        if (context.getConnection().getRemoteAddr() != null) {
+            formparams.add(new BasicNameValuePair("remoteip", context.getConnection().getRemoteAddr()));
+        }
 
         try {
             UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, StandardCharsets.UTF_8);
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/DeleteAccount.java b/services/src/main/java/org/keycloak/authentication/requiredactions/DeleteAccount.java
index 347bc91eedbf..7e0eb53c1871 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/DeleteAccount.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/DeleteAccount.java
@@ -17,10 +17,7 @@
 
 package org.keycloak.authentication.requiredactions;
 
-import java.util.Objects;
-
 import jakarta.ws.rs.ForbiddenException;
-
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.authentication.AuthenticationProcessor;
@@ -41,9 +38,15 @@
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserManager;
 import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.managers.AuthenticationSessionManager;
 import org.keycloak.services.messages.Messages;
+import org.keycloak.sessions.AuthenticationSessionModel;
 
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
 public class DeleteAccount implements RequiredActionProvider, RequiredActionFactory {
 
   public static final String PROVIDER_ID = "delete_account";
@@ -52,7 +55,7 @@ public class DeleteAccount implements RequiredActionProvider, RequiredActionFact
 
   private static final Logger logger = Logger.getLogger(DeleteAccount.class);
 
-  @Override
+    @Override
   public String getDisplayText() {
     return "Delete Account";
   }
@@ -94,7 +97,7 @@ public void processAction(RequiredActionContext context) {
             .detail(Details.USERNAME, user.getUsername())
             .success();
 
-        cleanSession(context, RequiredActionContext.KcActionStatus.SUCCESS);
+        removeAuthenticationSession(context, session);
 
         context.challenge(context.form()
             .setAttribute("messageHeader", "")
@@ -182,7 +185,17 @@ public boolean isOneTimeAction() {
   }
 
   @Override
-  public int getMaxAuthAge() {
+  public int getMaxAuthAge(KeycloakSession session) {
     return 0;
   }
+
+  @Override
+  public List<ProviderConfigProperty> getConfigMetadata() {
+      return Collections.emptyList();
+  }
+
+  private void removeAuthenticationSession(RequiredActionContext context, KeycloakSession session) {
+    AuthenticationSessionModel authSession = context.getAuthenticationSession();
+    new AuthenticationSessionManager(session).removeAuthenticationSession(authSession.getRealm(), authSession, true);
+  }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/RecoveryAuthnCodesAction.java b/services/src/main/java/org/keycloak/authentication/requiredactions/RecoveryAuthnCodesAction.java
index b133293b9b07..55d0762b8376 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/RecoveryAuthnCodesAction.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/RecoveryAuthnCodesAction.java
@@ -1,8 +1,7 @@
 package org.keycloak.authentication.requiredactions;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
 import org.keycloak.Config;
 import org.keycloak.authentication.AuthenticatorUtil;
 import org.keycloak.authentication.CredentialRegistrator;
@@ -10,21 +9,29 @@
 import org.keycloak.authentication.RequiredActionContext;
 import org.keycloak.authentication.RequiredActionFactory;
 import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.authentication.authenticators.browser.RecoveryAuthnCodesFormAuthenticator;
 import org.keycloak.common.Profile;
-import org.keycloak.credential.RecoveryAuthnCodesCredentialProviderFactory;
-import org.keycloak.credential.CredentialProvider;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredActionConfigModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
-
-import jakarta.ws.rs.core.MultivaluedMap;
-import jakarta.ws.rs.core.Response;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.userprofile.ValidationException;
+import org.keycloak.validate.ValidationError;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Stream;
+
+import static org.keycloak.utils.CredentialHelper.createRecoveryCodesCredential;
 
 public class RecoveryAuthnCodesAction implements RequiredActionProvider, RequiredActionFactory, EnvironmentDependentProviderFactory, CredentialRegistrator {
 
@@ -34,6 +41,26 @@ public class RecoveryAuthnCodesAction implements RequiredActionProvider, Require
     public static final String PROVIDER_ID = UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name();
     private static final RecoveryAuthnCodesAction INSTANCE = new RecoveryAuthnCodesAction();
 
+    private static final List<ProviderConfigProperty> CONFIG_PROPERTIES;
+
+    public static final String WARNING_THRESHOLD = "warning_threshold";
+
+    public static final int RECOVERY_CODES_WARNING_THRESHOLD_DEFAULT = 4;
+
+    static {
+        List<ProviderConfigProperty> properties = ProviderConfigurationBuilder.create() //
+                .property() //
+                .name(WARNING_THRESHOLD) //
+                .label("Warning Threshold") //
+                .helpText("When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will recommend him to setup new set of recovery codes.")
+                .type(ProviderConfigProperty.INTEGER_TYPE) //
+                .defaultValue(RECOVERY_CODES_WARNING_THRESHOLD_DEFAULT) //
+                .add() //
+                .build();
+
+        CONFIG_PROPERTIES = properties;
+    }
+
     @Override
     public String getId() {
         return PROVIDER_ID;
@@ -86,31 +113,33 @@ public void requiredActionChallenge(RequiredActionContext context) {
     public void processAction(RequiredActionContext reqActionContext) {
         EventBuilder event = reqActionContext.getEvent();
         event.event(EventType.UPDATE_CREDENTIAL);
-
-        CredentialProvider recoveryCodeCredentialProvider;
         MultivaluedMap<String, String> httpReqParamsMap;
-        Long generatedAtTime;
-        String generatedUserLabel;
-
-        recoveryCodeCredentialProvider = reqActionContext.getSession().getProvider(CredentialProvider.class,
-                RecoveryAuthnCodesCredentialProviderFactory.PROVIDER_ID);
 
         event.detail(Details.CREDENTIAL_TYPE, RecoveryAuthnCodesCredentialModel.TYPE);
 
         httpReqParamsMap = reqActionContext.getHttpRequest().getDecodedFormParameters();
-        List<String> generatedCodes = new ArrayList<>(
-                Arrays.asList(httpReqParamsMap.getFirst(FIELD_GENERATED_RECOVERY_AUTHN_CODES_HIDDEN).split(",")));
-        generatedAtTime = Long.parseLong(httpReqParamsMap.getFirst(FIELD_GENERATED_AT_HIDDEN));
-        generatedUserLabel = httpReqParamsMap.getFirst(FIELD_USER_LABEL_HIDDEN);
+        final String generatedCodesString = httpReqParamsMap.getFirst(FIELD_GENERATED_RECOVERY_AUTHN_CODES_HIDDEN);
+        final String generatedAtTimeString = httpReqParamsMap.getFirst(FIELD_GENERATED_AT_HIDDEN);
+        final String generatedUserLabel = httpReqParamsMap.getFirst(FIELD_USER_LABEL_HIDDEN);
+
+        if (!generatedAtTimeString.equals(reqActionContext.getAuthenticationSession().getAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_AT_NOTE))
+                || !generatedCodesString.equals(reqActionContext.getAuthenticationSession().getAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_RECOVERY_AUTHN_CODES_NOTE))) {
+            // authn codes have been tampered, sent them again
+            requiredActionChallenge(reqActionContext);
+            return;
+        }
 
-        RecoveryAuthnCodesCredentialModel credentialModel = createFromValues(generatedCodes, generatedAtTime, generatedUserLabel);
+        reqActionContext.getAuthenticationSession().removeAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_AT_NOTE);
+        reqActionContext.getAuthenticationSession().removeAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_RECOVERY_AUTHN_CODES_NOTE);
+
+        List<String> generatedCodes = Arrays.asList(generatedCodesString.split(","));
+        RecoveryAuthnCodesCredentialModel credentialModel = createFromValues(generatedCodes, Long.valueOf(generatedAtTimeString), generatedUserLabel);
 
         if ("on".equals(httpReqParamsMap.getFirst("logout-sessions"))) {
             AuthenticatorUtil.logoutOtherSessions(reqActionContext);
         }
 
-        recoveryCodeCredentialProvider.createCredential(reqActionContext.getRealm(), reqActionContext.getUser(),
-                credentialModel);
+        createRecoveryCodesCredential(reqActionContext.getSession(), reqActionContext.getRealm(), reqActionContext.getUser(), credentialModel, generatedCodes);
 
         reqActionContext.success();
     }
@@ -128,4 +157,32 @@ public void close() {
     public boolean isSupported(Config.Scope config) {
         return Profile.isFeatureEnabled(Profile.Feature.RECOVERY_CODES);
     }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        return Stream.concat(
+                List.copyOf(CONFIG_PROPERTIES).stream(),
+                RequiredActionFactory.super.getConfigMetadata().stream()
+        ).toList();
+    }
+
+    @Override
+    public void validateConfig(KeycloakSession session, RealmModel realm, RequiredActionConfigModel model) {
+        RequiredActionFactory.super.validateConfig(session, realm, model);
+
+        int parsedMaxAuthAge;
+        try {
+            parsedMaxAuthAge = parseWarningThreshold(model);
+        } catch (Exception ex) {
+            throw new ValidationException(new ValidationError(getId(), WARNING_THRESHOLD, "error-invalid-value"));
+        }
+
+        if (parsedMaxAuthAge < 0) {
+            throw new ValidationException(new ValidationError(getId(), WARNING_THRESHOLD, "error-number-out-of-range-too-small", 0));
+        }
+    }
+
+    private int parseWarningThreshold(RequiredActionConfigModel model) throws NumberFormatException {
+        return Integer.parseInt(model.getConfigValue(WARNING_THRESHOLD));
+    }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateEmail.java b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateEmail.java
index 5aa3eb2666cb..67a218a04773 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateEmail.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateEmail.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.authentication.requiredactions;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
@@ -46,9 +47,12 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.models.utils.FormMessage;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
+import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.services.Urls;
 import org.keycloak.services.validation.Validation;
 import org.keycloak.sessions.AuthenticationSessionModel;
@@ -62,6 +66,16 @@ public class UpdateEmail implements RequiredActionProvider, RequiredActionFactor
 
     private static final Logger logger = Logger.getLogger(UpdateEmail.class);
 
+    public static boolean isEnabled(RealmModel realm) {
+        if (!Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL)) {
+            return false;
+        }
+
+        RequiredActionProviderModel model = realm.getRequiredActionProviderByAlias(RequiredAction.UPDATE_EMAIL.name());
+
+        return model != null && model.isEnabled();
+    }
+
     @Override
     public InitiatedActionSupport initiatedActionSupport() {
         return InitiatedActionSupport.SUPPORTED;
@@ -79,11 +93,16 @@ public void evaluateTriggers(RequiredActionContext context) {
 
     @Override
     public void requiredActionChallenge(RequiredActionContext context) {
-        context.challenge(context.form().createResponse(UserModel.RequiredAction.UPDATE_EMAIL));
+        if (isEnabled(context.getRealm())) {
+            context.challenge(context.form().createResponse(UserModel.RequiredAction.UPDATE_EMAIL));
+        }
     }
 
     @Override
     public void processAction(RequiredActionContext context) {
+        if (!isEnabled(context.getRealm())) {
+            return;
+        }
         MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
         String newEmail = formData.getFirst(UserModel.EMAIL);
 
@@ -199,6 +218,17 @@ public String getId() {
         return UserModel.RequiredAction.UPDATE_EMAIL.name();
     }
 
+    @Override
+    public int getMaxAuthAge(KeycloakSession session) {
+        // always require re-authentication
+        return 0;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        return Collections.emptyList();
+    }
+
     @Override
     public boolean isSupported(Config.Scope config) {
         return Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL);
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdatePassword.java b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdatePassword.java
index c1e97b6aea26..dd5e810f261c 100755
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdatePassword.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdatePassword.java
@@ -41,21 +41,14 @@
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.RequiredActionConfigModel;
-import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.models.utils.FormMessage;
-import org.keycloak.policy.MaxAuthAgePasswordPolicyProviderFactory;
 import org.keycloak.provider.ProviderConfigProperty;
-import org.keycloak.provider.ProviderConfigurationBuilder;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.validation.Validation;
 import org.keycloak.sessions.AuthenticationSessionModel;
-import org.keycloak.userprofile.ValidationException;
-import org.keycloak.utils.RequiredActionHelper;
-import org.keycloak.validate.ValidationError;
 
 import java.util.List;
 import java.util.concurrent.TimeUnit;
@@ -68,45 +61,11 @@ public class UpdatePassword implements RequiredActionProvider, RequiredActionFac
 
     private static final Logger logger = Logger.getLogger(UpdatePassword.class);
 
-    private static final List<ProviderConfigProperty> CONFIG_PROPERTIES;
-
-    public static final String MAX_AUTH_AGE_KEY = "max_auth_age";
-
-    static {
-        List<ProviderConfigProperty> properties = ProviderConfigurationBuilder.create() //
-                .property() //
-                .name(MAX_AUTH_AGE_KEY) //
-                .label("Maximum Age of Authentication") //
-                .helpText("Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate. " + //
-                        "This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user " + //
-                        "himself updates his password in the account console. When the 'Maximum Authentication Age' password policy is used in the realm, it's value has " + //
-                        "precedence over the value configured here.") //
-                .type(ProviderConfigProperty.STRING_TYPE) //
-                .defaultValue(MaxAuthAgePasswordPolicyProviderFactory.DEFAULT_MAX_AUTH_AGE) //
-                .add() //
-                .build();
-
-        CONFIG_PROPERTIES = properties;
-    }
-
-    private final KeycloakSession session;
-
     @Override
     public InitiatedActionSupport initiatedActionSupport() {
         return InitiatedActionSupport.SUPPORTED;
     }
 
-    /**
-     * @deprecated use {@link #UpdatePassword(KeycloakSession)} instead
-     */
-    @Deprecated
-    public UpdatePassword() {
-        this(null);
-    }
-
-    public UpdatePassword(KeycloakSession session) {
-        this.session = session;
-    }
 
     @Override
     public void evaluateTriggers(RequiredActionContext context) {
@@ -197,7 +156,6 @@ public void processAction(RequiredActionContext context) {
                     .setError(me.getMessage(), me.getParameters())
                     .createResponse(UserModel.RequiredAction.UPDATE_PASSWORD);
             context.challenge(challenge);
-            return;
         } catch (Exception ape) {
             errorEvent.detail(Details.REASON, ape.getMessage()).error(Errors.PASSWORD_REJECTED);
             deprecatedErrorEvent.detail(Details.REASON, ape.getMessage()).error(Errors.PASSWORD_REJECTED);
@@ -206,7 +164,6 @@ public void processAction(RequiredActionContext context) {
                     .setError(ape.getMessage())
                     .createResponse(UserModel.RequiredAction.UPDATE_PASSWORD);
             context.challenge(challenge);
-            return;
         }
     }
 
@@ -217,7 +174,7 @@ public void close() {
 
     @Override
     public RequiredActionProvider create(KeycloakSession session) {
-        return new UpdatePassword(session);
+        return new UpdatePassword();
     }
 
     @Override
@@ -247,11 +204,10 @@ public boolean isOneTimeAction() {
     }
 
     @Override
-    public int getMaxAuthAge() {
-
+    public int getMaxAuthAge(KeycloakSession session) {
         if (session == null) {
             // session is null, support for legacy implementation, fallback to default maxAuthAge
-            return MaxAuthAgePasswordPolicyProviderFactory.DEFAULT_MAX_AUTH_AGE;
+            return Constants.KC_ACTION_MAX_AGE;
         }
 
         // try password policy
@@ -262,51 +218,8 @@ public int getMaxAuthAge() {
             return maxAge;
         }
 
-        // try required action config
-        AuthenticationSessionModel authSession = keycloakContext.getAuthenticationSession();
-        if (authSession != null) {
-
-            // we need to figure out the alias for the current required action
-            String providerId = authSession.getClientNote(Constants.KC_ACTION);
-            RequiredActionProviderModel requiredAction = RequiredActionHelper.getRequiredActionByProviderId(realm, providerId);
-
-            if (requiredAction != null) {
-                RequiredActionConfigModel configModel = realm.getRequiredActionConfigByAlias(requiredAction.getAlias());
-                if (configModel != null && configModel.containsConfigKey(MAX_AUTH_AGE_KEY)) {
-                    maxAge = parseMaxAuthAge(configModel);
-                    if (maxAge >= 0) {
-                        return maxAge;
-                    }
-                }
-            }
-        }
-
-        // fallback to default
-        return MaxAuthAgePasswordPolicyProviderFactory.DEFAULT_MAX_AUTH_AGE;
-    }
-
-
-    @Override
-    public List<ProviderConfigProperty> getConfigMetadata() {
-        return List.copyOf(CONFIG_PROPERTIES);
-    }
-
-    @Override
-    public void validateConfig(KeycloakSession session, RealmModel realm, RequiredActionConfigModel model) {
+        return RequiredActionProvider.super.getMaxAuthAge(session);
 
-        int parsedMaxAuthAge;
-        try {
-            parsedMaxAuthAge = parseMaxAuthAge(model);
-        } catch (Exception ex) {
-            throw new ValidationException(new ValidationError(getId(), MAX_AUTH_AGE_KEY, "error-invalid-value"));
-        }
-
-        if (parsedMaxAuthAge < 0) {
-            throw new ValidationException(new ValidationError(getId(), MAX_AUTH_AGE_KEY, "error-number-out-of-range-too-small", 0));
-        }
-    }
 
-    private int parseMaxAuthAge(RequiredActionConfigModel model) throws NumberFormatException {
-        return Integer.parseInt(model.getConfigValue(MAX_AUTH_AGE_KEY));
     }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateTotp.java b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateTotp.java
index 34f3cb076fea..f06bab529aac 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateTotp.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/UpdateTotp.java
@@ -32,6 +32,7 @@
 import org.keycloak.events.EventType;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.OTPPolicy;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.Constants;
@@ -116,10 +117,23 @@ public void processAction(RequiredActionContext context) {
             AuthenticatorUtil.logoutOtherSessions(context);
         }
 
-        if (!CredentialHelper.createOTPCredential(context.getSession(), context.getRealm(), context.getUser(), challengeResponse, credentialModel)) {
+        try {
+            if (!CredentialHelper.createOTPCredential(context.getSession(), context.getRealm(), context.getUser(), challengeResponse, credentialModel)) {
+                Response challenge = context.form()
+                        .setAttribute("mode", mode)
+                        .addError(new FormMessage(Validation.FIELD_OTP_CODE, Messages.INVALID_TOTP))
+                        .createResponse(UserModel.RequiredAction.CONFIGURE_TOTP);
+                context.challenge(challenge);
+                return;
+            }
+        } catch (ModelDuplicateException e) {
+            String field = switch (e.getDuplicateFieldName()) {
+                case CredentialModel.USER_LABEL ->  Validation.FIELD_OTP_LABEL;
+                default -> null;
+            };
             Response challenge = context.form()
                     .setAttribute("mode", mode)
-                    .addError(new FormMessage(Validation.FIELD_OTP_CODE, Messages.INVALID_TOTP))
+                    .addError(new FormMessage(field, e.getMessage()))
                     .createResponse(UserModel.RequiredAction.CONFIGURE_TOTP);
             context.challenge(challenge);
             return;
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java b/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java
index df910c22b67a..3d4590214f17 100755
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java
@@ -17,9 +17,17 @@
 
 package org.keycloak.authentication.requiredactions;
 
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriBuilderException;
+import jakarta.ws.rs.core.UriInfo;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
-import org.keycloak.authentication.*;
+import org.keycloak.authentication.AuthenticationProcessor;
+import org.keycloak.authentication.InitiatedActionSupport;
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.authentication.RequiredActionFactory;
+import org.keycloak.authentication.RequiredActionProvider;
 import org.keycloak.authentication.actiontoken.verifyemail.VerifyEmailActionToken;
 import org.keycloak.common.util.Time;
 import org.keycloak.email.EmailException;
@@ -29,16 +37,20 @@
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
 import org.keycloak.forms.login.LoginFormsProvider;
-import org.keycloak.models.*;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
 import org.keycloak.protocol.AuthorizationEndpointBase;
 import org.keycloak.services.Urls;
+import org.keycloak.services.messages.Messages;
 import org.keycloak.services.validation.Validation;
 
 import org.keycloak.sessions.AuthenticationSessionCompoundId;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import java.util.Objects;
 import java.util.concurrent.TimeUnit;
-import jakarta.ws.rs.core.*;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -53,8 +65,18 @@ public void evaluateTriggers(RequiredActionContext context) {
             logger.debug("User is required to verify email");
         }
     }
+
+    @Override
+    public InitiatedActionSupport initiatedActionSupport() {
+        return InitiatedActionSupport.SUPPORTED;
+    }
+
     @Override
     public void requiredActionChallenge(RequiredActionContext context) {
+        process(context, true);
+    }
+
+    private void process(RequiredActionContext context, boolean isChallenge) {
         AuthenticationSessionModel authSession = context.getAuthenticationSession();
 
         if (context.getUser().isEmailVerified()) {
@@ -70,14 +92,15 @@ public void requiredActionChallenge(RequiredActionContext context) {
         }
 
         LoginFormsProvider loginFormsProvider = context.form();
+        loginFormsProvider.setAuthenticationSession(context.getAuthenticationSession());
         Response challenge;
         authSession.setClientNote(AuthorizationEndpointBase.APP_INITIATED_FLOW, null);
 
         // Do not allow resending e-mail by simple page refresh, i.e. when e-mail sent, it should be resent properly via email-verification endpoint
-        if (! Objects.equals(authSession.getAuthNote(Constants.VERIFY_EMAIL_KEY), email)) {
+        if (!Objects.equals(authSession.getAuthNote(Constants.VERIFY_EMAIL_KEY), email) && !(isCurrentActionTriggeredFromAIA(context) && isChallenge)) {
             authSession.setAuthNote(Constants.VERIFY_EMAIL_KEY, email);
             EventBuilder event = context.getEvent().clone().event(EventType.SEND_VERIFY_EMAIL).detail(Details.EMAIL, email);
-            challenge = sendVerifyEmail(context.getSession(), loginFormsProvider, context.getUser(), context.getAuthenticationSession(), event);
+            challenge = sendVerifyEmail(context, event);
         } else {
             challenge = loginFormsProvider.createResponse(UserModel.RequiredAction.VERIFY_EMAIL);
         }
@@ -85,6 +108,9 @@ public void requiredActionChallenge(RequiredActionContext context) {
         context.challenge(challenge);
     }
 
+    private boolean isCurrentActionTriggeredFromAIA(RequiredActionContext context) {
+        return Objects.equals(context.getAuthenticationSession().getClientNote(Constants.KC_ACTION), getId());
+    }
 
     @Override
     public void processAction(RequiredActionContext context) {
@@ -93,7 +119,7 @@ public void processAction(RequiredActionContext context) {
         // This will allow user to re-send email again
         context.getAuthenticationSession().removeAuthNote(Constants.VERIFY_EMAIL_KEY);
 
-        requiredActionChallenge(context);
+        process(context, false);
     }
 
 
@@ -128,9 +154,12 @@ public String getId() {
         return UserModel.RequiredAction.VERIFY_EMAIL.name();
     }
 
-    private Response sendVerifyEmail(KeycloakSession session, LoginFormsProvider forms, UserModel user, AuthenticationSessionModel authSession, EventBuilder event) throws UriBuilderException, IllegalArgumentException {
-        RealmModel realm = session.getContext().getRealm();
-        UriInfo uriInfo = session.getContext().getUri();
+    private Response sendVerifyEmail(RequiredActionContext context, EventBuilder event) throws UriBuilderException, IllegalArgumentException {
+        RealmModel realm = context.getRealm();
+        UriInfo uriInfo = context.getUriInfo();
+        UserModel user = context.getUser();
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+        KeycloakSession session = context.getSession();
 
         int validityInSecs = realm.getActionTokenGeneratedByUserLifespan(VerifyEmailActionToken.TOKEN_TYPE);
         int absoluteExpirationInSecs = Time.currentTime() + validityInSecs;
@@ -150,11 +179,17 @@ private Response sendVerifyEmail(KeycloakSession session, LoginFormsProvider for
               .setUser(user)
               .sendVerifyEmail(link, expirationInMinutes);
             event.success();
+            return context.form().createResponse(UserModel.RequiredAction.VERIFY_EMAIL);
         } catch (EmailException e) {
+            event.clone().event(EventType.SEND_VERIFY_EMAIL)
+                    .detail(Details.REASON, e.getMessage())
+                    .user(user)
+                    .error(Errors.EMAIL_SEND_FAILED);
             logger.error("Failed to send verification email", e);
-            event.error(Errors.EMAIL_SEND_FAILED);
+            context.failure(Messages.EMAIL_SENT_ERROR);
+            return context.form()
+                    .setError(Messages.EMAIL_SENT_ERROR)
+                    .createErrorPage(Response.Status.INTERNAL_SERVER_ERROR);
         }
-
-        return forms.createResponse(UserModel.RequiredAction.VERIFY_EMAIL);
     }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegister.java b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegister.java
index 504cab185397..275d6fe18bad 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegister.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegister.java
@@ -18,7 +18,7 @@
 
 package org.keycloak.authentication.requiredactions;
 
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.CertPathTrustworthinessValidator;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.CertPathTrustworthinessVerifier;
 import org.keycloak.authentication.RequiredActionContext;
 import org.keycloak.credential.WebAuthnPasswordlessCredentialProviderFactory;
 import org.keycloak.models.KeycloakSession;
@@ -32,8 +32,8 @@
  */
 public class WebAuthnPasswordlessRegister extends WebAuthnRegister {
 
-    public WebAuthnPasswordlessRegister(KeycloakSession session, CertPathTrustworthinessValidator certPathtrustValidator) {
-        super(session, certPathtrustValidator);
+    public WebAuthnPasswordlessRegister(KeycloakSession session, CertPathTrustworthinessVerifier certPathtrustVerifier) {
+        super(session, certPathtrustVerifier);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegisterFactory.java b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegisterFactory.java
index 451890a84e2c..5265eba022b3 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegisterFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnPasswordlessRegisterFactory.java
@@ -18,7 +18,7 @@
 
 package org.keycloak.authentication.requiredactions;
 
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.CertPathTrustworthinessValidator;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.CertPathTrustworthinessVerifier;
 import org.keycloak.models.KeycloakSession;
 
 /**
@@ -29,8 +29,8 @@ public class WebAuthnPasswordlessRegisterFactory extends WebAuthnRegisterFactory
     public static final String PROVIDER_ID = "webauthn-register-passwordless";
 
     @Override
-    protected WebAuthnRegister createProvider(KeycloakSession session, CertPathTrustworthinessValidator trustValidator) {
-        return new WebAuthnPasswordlessRegister(session, trustValidator);
+    protected WebAuthnRegister createProvider(KeycloakSession session, CertPathTrustworthinessVerifier trustVerifier) {
+        return new WebAuthnPasswordlessRegister(session, trustVerifier);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java
index bc68acf2ca52..9bfa00eaf7dc 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java
@@ -52,6 +52,7 @@
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.WebAuthnPolicy;
@@ -71,14 +72,14 @@
 import com.webauthn4j.data.RegistrationParameters;
 import com.webauthn4j.server.ServerProperty;
 import com.webauthn4j.util.exception.WebAuthnException;
-import com.webauthn4j.validator.attestation.statement.androidkey.AndroidKeyAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.statement.androidsafetynet.AndroidSafetyNetAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.statement.none.NoneAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.statement.packed.PackedAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.statement.tpm.TPMAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.statement.u2f.FIDOU2FAttestationStatementValidator;
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.CertPathTrustworthinessValidator;
-import com.webauthn4j.validator.attestation.trustworthiness.self.DefaultSelfAttestationTrustworthinessValidator;
+import com.webauthn4j.verifier.attestation.statement.androidkey.AndroidKeyAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.statement.androidsafetynet.AndroidSafetyNetAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.statement.none.NoneAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.statement.packed.PackedAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.statement.tpm.TPMAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.statement.u2f.FIDOU2FAttestationStatementVerifier;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.CertPathTrustworthinessVerifier;
+import com.webauthn4j.verifier.attestation.trustworthiness.self.DefaultSelfAttestationTrustworthinessVerifier;
 
 import static org.keycloak.WebAuthnConstants.REG_ERR_DETAIL_LABEL;
 import static org.keycloak.WebAuthnConstants.REG_ERR_LABEL;
@@ -92,12 +93,12 @@ public class WebAuthnRegister implements RequiredActionProvider, CredentialRegis
     private static final String WEB_AUTHN_TITLE_ATTR = "webAuthnTitle";
     private static final Logger logger = Logger.getLogger(WebAuthnRegister.class);
 
-    private KeycloakSession session;
-    private CertPathTrustworthinessValidator certPathtrustValidator;
+    private final KeycloakSession session;
+    private final CertPathTrustworthinessVerifier certPathtrustVerifier;
 
-    public WebAuthnRegister(KeycloakSession session, CertPathTrustworthinessValidator certPathtrustValidator) {
+    public WebAuthnRegister(KeycloakSession session, CertPathTrustworthinessVerifier certPathtrustVerifier) {
         this.session = session;
-        this.certPathtrustValidator = certPathtrustValidator;
+        this.certPathtrustVerifier = certPathtrustVerifier;
     }
 
     @Override
@@ -107,7 +108,14 @@ public InitiatedActionSupport initiatedActionSupport() {
 
     @Override
     public void requiredActionChallenge(RequiredActionContext context) {
+        String actionParameter = context.getAuthenticationSession().getClientNote(Constants.KC_ACTION_PARAMETER);
         UserModel userModel = context.getUser();
+        if (Constants.KC_ACTION_PARAMETER_SKIP_IF_EXISTS.equals(actionParameter)
+                && userModel.credentialManager().getStoredCredentialsByTypeStream(getCredentialType()).findAny().isPresent()) {
+            context.success();
+            return;
+        }
+
         // Use standard UTF-8 charset to get bytes from string.
         // Otherwise the platform's default charset is used and it might cause problems later when
         // decoded on different system.
@@ -237,7 +245,7 @@ public void processAction(RequiredActionContext context) {
         Challenge challenge = new DefaultChallenge(context.getAuthenticationSession().getAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE));
         ServerProperty serverProperty = new ServerProperty(allOrigins, rpId, challenge, null);
         // check User Verification by considering a malicious user might modify the result of calling WebAuthn API
-        boolean isUserVerificationRequired = policy.getUserVerificationRequirement().equals(WebAuthnConstants.OPTION_REQUIRED);
+        boolean isUserVerificationRequired = policy.getUserVerificationRequirement().equals(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
 
         final String transportsParam = params.getFirst(WebAuthnConstants.TRANSPORTS);
 
@@ -261,7 +269,7 @@ public void processAction(RequiredActionContext context) {
             // parse
             RegistrationData registrationData = webAuthnRegistrationManager.parse(registrationRequest);
             // validate
-            webAuthnRegistrationManager.validate(registrationData, registrationParameters);
+            webAuthnRegistrationManager.verify(registrationData, registrationParameters);
 
             showInfoAfterWebAuthnApiCreate(registrationData);
 
@@ -311,15 +319,15 @@ public void processAction(RequiredActionContext context) {
     protected WebAuthnRegistrationManager createWebAuthnRegistrationManager() {
         return new WebAuthnRegistrationManager(
                 Arrays.asList(
-                        new NoneAttestationStatementValidator(),
-                        new PackedAttestationStatementValidator(),
-                        new TPMAttestationStatementValidator(),
-                        new AndroidKeyAttestationStatementValidator(),
-                        new AndroidSafetyNetAttestationStatementValidator(),
-                        new FIDOU2FAttestationStatementValidator()
-                ), this.certPathtrustValidator,
-                new DefaultSelfAttestationTrustworthinessValidator(),
-                Collections.emptyList(), // Custom Registration Validator is not supported
+                        new NoneAttestationStatementVerifier(),
+                        new PackedAttestationStatementVerifier(),
+                        new TPMAttestationStatementVerifier(),
+                        new AndroidKeyAttestationStatementVerifier(),
+                        new AndroidSafetyNetAttestationStatementVerifier(),
+                        new FIDOU2FAttestationStatementVerifier()
+                ), this.certPathtrustVerifier,
+                new DefaultSelfAttestationTrustworthinessVerifier(),
+                Collections.emptyList(), // Custom Registration Verifier is not supported
                 new ObjectConverter()
                 );
     }
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegisterFactory.java b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegisterFactory.java
index 8cac929d297f..c579c07585ed 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegisterFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegisterFactory.java
@@ -16,7 +16,11 @@
 
 package org.keycloak.authentication.requiredactions;
 
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.CertPathTrustworthinessValidator;
+import com.webauthn4j.anchor.KeyStoreTrustAnchorRepository;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.CertPathTrustworthinessVerifier;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.DefaultCertPathTrustworthinessVerifier;
+import com.webauthn4j.verifier.attestation.trustworthiness.certpath.NullCertPathTrustworthinessVerifier;
+
 import org.keycloak.Config;
 import org.keycloak.Config.Scope;
 import org.keycloak.authentication.RequiredActionFactory;
@@ -27,11 +31,6 @@
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.truststore.TruststoreProvider;
 
-import com.webauthn4j.anchor.KeyStoreTrustAnchorsProvider;
-import com.webauthn4j.anchor.TrustAnchorsResolverImpl;
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.NullCertPathTrustworthinessValidator;
-import com.webauthn4j.validator.attestation.trustworthiness.certpath.TrustAnchorCertPathTrustworthinessValidator;
-
 public class WebAuthnRegisterFactory implements RequiredActionFactory, EnvironmentDependentProviderFactory {
 
     public static final String PROVIDER_ID = "webauthn-register";
@@ -41,19 +40,17 @@ public RequiredActionProvider create(KeycloakSession session) {
         WebAuthnRegister webAuthnRegister = null;
         TruststoreProvider truststoreProvider = session.getProvider(TruststoreProvider.class);
         if (truststoreProvider == null || truststoreProvider.getTruststore() == null) {
-            webAuthnRegister = createProvider(session, new NullCertPathTrustworthinessValidator());
+            webAuthnRegister = createProvider(session, new NullCertPathTrustworthinessVerifier());
         } else {
-            KeyStoreTrustAnchorsProvider trustAnchorsProvider = new KeyStoreTrustAnchorsProvider();
-            trustAnchorsProvider.setKeyStore(truststoreProvider.getTruststore());
-            TrustAnchorsResolverImpl resolverImpl = new TrustAnchorsResolverImpl(trustAnchorsProvider);
-            TrustAnchorCertPathTrustworthinessValidator trustValidator = new TrustAnchorCertPathTrustworthinessValidator(resolverImpl);
-            webAuthnRegister = createProvider(session, trustValidator);
+            KeyStoreTrustAnchorRepository keyStoreTrustAnchorRepository = new KeyStoreTrustAnchorRepository(truststoreProvider.getTruststore());
+            DefaultCertPathTrustworthinessVerifier trustVerifier = new DefaultCertPathTrustworthinessVerifier(keyStoreTrustAnchorRepository);
+            webAuthnRegister = createProvider(session, trustVerifier);
         }
         return webAuthnRegister;
     }
 
-    protected WebAuthnRegister createProvider(KeycloakSession session, CertPathTrustworthinessValidator trustValidator) {
-         return new WebAuthnRegister(session, trustValidator);
+    protected WebAuthnRegister createProvider(KeycloakSession session, CertPathTrustworthinessVerifier trustVerifier) {
+         return new WebAuthnRegister(session, trustVerifier);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/util/CredentialDeleteHelper.java b/services/src/main/java/org/keycloak/authentication/requiredactions/util/CredentialDeleteHelper.java
index 8c5b437750a9..f9bb7958dc9e 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/util/CredentialDeleteHelper.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/util/CredentialDeleteHelper.java
@@ -60,6 +60,15 @@ public class CredentialDeleteHelper {
     public static CredentialModel removeCredential(KeycloakSession session, UserModel user, String credentialId, Supplier<Integer> currentLoAProvider) {
         CredentialModel credential = user.credentialManager().getStoredCredentialById(credentialId);
         if (credential == null) {
+            if (user.isFederated()) {
+                credential = user.credentialManager().getFederatedCredentialsStream().filter(c -> credentialId.equals(c.getId())).findAny().orElse(null);
+                if (credential != null) {
+                    String type = credential.getType();
+                    checkIfCanBeRemoved(session, user, type, currentLoAProvider);
+                    user.credentialManager().disableCredentialType(type);
+                    return null;
+                }
+            }
             // Backwards compatibility with account console 1 - When stored credential is not found, it may be federated credential.
             // In this case, it's ID needs to be something like "otp-id", which is returned by account REST GET endpoint as a placeholder
             // for federated credentials (See CredentialHelper.createUserStorageCredentialRepresentation )
@@ -78,7 +87,7 @@ public static CredentialModel removeCredential(KeycloakSession session, UserMode
 
     private static void checkIfCanBeRemoved(KeycloakSession session, UserModel user, String credentialType, Supplier<Integer> currentLoAProvider) {
         CredentialProvider credentialProvider = AuthenticatorUtil.getCredentialProviders(session)
-                .filter(credentialProvider1 -> credentialType.equals(credentialProvider1.getType()))
+                .filter(credentialProvider1 -> credentialProvider1.supportsCredentialType(credentialType))
                 .findAny().orElse(null);
         if (credentialProvider == null) {
             logger.warnf("Credential provider %s not found", credentialType);
diff --git a/services/src/main/java/org/keycloak/authentication/requiredactions/util/UserUpdateProfileContext.java b/services/src/main/java/org/keycloak/authentication/requiredactions/util/UserUpdateProfileContext.java
index dea0d6799943..424add2817a5 100644
--- a/services/src/main/java/org/keycloak/authentication/requiredactions/util/UserUpdateProfileContext.java
+++ b/services/src/main/java/org/keycloak/authentication/requiredactions/util/UserUpdateProfileContext.java
@@ -20,7 +20,8 @@
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Stream;
-import org.keycloak.common.Profile;
+
+import org.keycloak.authentication.requiredactions.UpdateEmail;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.userprofile.UserProfileContext;
@@ -60,7 +61,7 @@ public void setUsername(String username) {
 
     @Override
     public boolean isEditEmailAllowed() {
-        return !Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL);
+        return !UpdateEmail.isEnabled(realm);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/authorization/admin/AuthorizationService.java b/services/src/main/java/org/keycloak/authorization/admin/AuthorizationService.java
index c8dc0acc540f..2872be385aad 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/AuthorizationService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/AuthorizationService.java
@@ -28,7 +28,7 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PermissionService.java b/services/src/main/java/org/keycloak/authorization/admin/PermissionService.java
index 0ae1a82b07f3..8458ad910287 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PermissionService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PermissionService.java
@@ -27,7 +27,7 @@
 import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java
index 7c81b83ce396..148432477b86 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyEvaluationService.java
@@ -25,11 +25,13 @@
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Produces;
@@ -44,6 +46,7 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuthErrorException;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.admin.representation.PolicyEvaluationResponseBuilder;
 import org.keycloak.authorization.attribute.Attributes;
@@ -51,12 +54,14 @@
 import org.keycloak.authorization.common.KeycloakIdentity;
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.model.ResourceWrapper;
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.Permissions;
 import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.evaluation.DecisionPermissionCollector;
 import org.keycloak.authorization.policy.evaluation.EvaluationContext;
 import org.keycloak.authorization.policy.evaluation.Result;
+import org.keycloak.authorization.store.ResourceStore;
 import org.keycloak.authorization.store.ScopeStore;
 import org.keycloak.authorization.store.StoreFactory;
 import org.keycloak.models.ClientModel;
@@ -79,7 +84,7 @@
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.sessions.AuthenticationSessionModel;
 
 /**
@@ -111,7 +116,7 @@ public class PolicyEvaluationService {
         @APIResponse(responseCode = "500", description = "Internal Server Error")
     })
     public Response evaluate(PolicyEvaluationRequest evaluationRequest) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         CloseableKeycloakIdentity identity = createIdentity(evaluationRequest);
         try {
             AuthorizationRequest request = new AuthorizationRequest();
@@ -131,7 +136,7 @@ public Response evaluate(PolicyEvaluationRequest evaluationRequest) {
 
             request.setClaims(claims);
 
-            return Response.ok(PolicyEvaluationResponseBuilder.build(evaluate(evaluationRequest, createEvaluationContext(evaluationRequest, identity), request), resourceServer, authorization, identity)).build();
+            return Response.ok(PolicyEvaluationResponseBuilder.build(evaluate(evaluationRequest, createEvaluationContext(evaluationRequest, identity), request), resourceServer, authorization, identity, evaluationRequest)).build();
         } catch (Exception e) {
             logger.error("Error while evaluating permissions", e);
             throw new ErrorResponseException(OAuthErrorException.SERVER_ERROR, "Error while evaluating permissions.", Status.INTERNAL_SERVER_ERROR);
@@ -142,12 +147,16 @@ public Response evaluate(PolicyEvaluationRequest evaluationRequest) {
 
     private EvaluationDecisionCollector evaluate(PolicyEvaluationRequest evaluationRequest, EvaluationContext evaluationContext, AuthorizationRequest request) {
         List<ResourcePermission> permissions = createPermissions(evaluationRequest, evaluationContext, authorization, request);
+        EvaluationDecisionCollector decision = new EvaluationDecisionCollector(authorization, resourceServer, request);
 
         if (permissions.isEmpty()) {
-            return authorization.evaluators().from(evaluationContext, resourceServer, request).evaluate(new EvaluationDecisionCollector(authorization, resourceServer, request));
+            if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(authorization.getRealm())) {
+                return decision;
+            }
+            return authorization.evaluators().from(evaluationContext, resourceServer, request).evaluate(decision);
         }
 
-        return authorization.evaluators().from(permissions, evaluationContext).evaluate(new EvaluationDecisionCollector(authorization, resourceServer, request));
+        return authorization.evaluators().from(permissions, resourceServer, evaluationContext).evaluate(decision);
     }
 
     private EvaluationContext createEvaluationContext(PolicyEvaluationRequest representation, KeycloakIdentity identity) {
@@ -174,16 +183,42 @@ public Attributes getAttributes() {
     }
 
     private List<ResourcePermission> createPermissions(PolicyEvaluationRequest representation, EvaluationContext evaluationContext, AuthorizationProvider authorization, AuthorizationRequest request) {
-        return representation.getResources().stream().flatMap((Function<ResourceRepresentation, Stream<ResourcePermission>>) resource -> {
+        List<ResourceRepresentation> requestedResources = representation.getResources();
+
+        if (AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(authorization.getRealm(), resourceServer.getId())) {
+            if (requestedResources.isEmpty()) {
+                throw new BadRequestException("No resources provided");
+            }
+
+            if (representation.getResourceType() == null) {
+                throw new BadRequestException("No resource type provided");
+            }
+
+            if (representation.getUserId() == null) {
+                throw new BadRequestException("No user provided");
+            }
+        }
+
+        return requestedResources.stream().flatMap((Function<ResourceRepresentation, Stream<ResourcePermission>>) resource -> {
             StoreFactory storeFactory = authorization.getStoreFactory();
             if (resource == null) {
                 resource = new ResourceRepresentation();
             }
 
-            Set<ScopeRepresentation> givenScopes = resource.getScopes();
+            Set<ScopeRepresentation> givenScopes = new HashSet<>(Optional.ofNullable(resource.getScopes()).orElse(Set.of()));
+
+            if (givenScopes.isEmpty()) {
+                Resource resourceType = AdminPermissionsSchema.SCHEMA.getResourceTypeResource(authorization.getKeycloakSession(), resourceServer, representation.getResourceType());
 
-            if (givenScopes == null) {
-                givenScopes = new HashSet<>();
+                if (resourceType != null) {
+                    givenScopes.addAll(resourceType.getScopes().stream().map(new Function<Scope, ScopeRepresentation>() {
+                        @Override
+                        public ScopeRepresentation apply(Scope scope) {
+                            return new ScopeRepresentation(scope.getName());
+                        }
+                    }).collect(Collectors.toSet()));
+                    resource.setScopes(givenScopes);
+                }
             }
 
             ScopeStore scopeStore = storeFactory.getScopeStore();
@@ -192,26 +227,47 @@ private List<ResourcePermission> createPermissions(PolicyEvaluationRequest repre
 
             if (resource.getId() != null) {
                 Resource resourceModel = storeFactory.getResourceStore().findById(resourceServer, resource.getId());
+                if (resourceModel == null) {
+                    return Stream.empty();
+                }
                 return new ArrayList<>(Arrays.asList(
                         Permissions.createResourcePermissions(resourceModel, resourceServer, scopes, authorization, request))).stream();
-            } else if (resource.getType() != null) {
-                return storeFactory.getResourceStore().findByType(resourceServer, resource.getType()).stream().map(resource1 -> Permissions.createResourcePermissions(resource1,
-                        resourceServer, scopes, authorization, request));
             } else {
-                if (scopes.isEmpty()) {
-                    return Stream.empty();
-                }
+                ResourceStore resourceStore = storeFactory.getResourceStore();
 
-                List<Resource> resources = storeFactory.getResourceStore().findByScopes(resourceServer, scopes);
+                if (resource.getName() != null) {
+                    Resource resourceModel = resourceStore.findByName(resourceServer, resource.getName());
+                    List<ResourcePermission> permissions = new ArrayList<>();
+                    String resourceType = representation.getResourceType();
 
-                if (resources.isEmpty()) {
-                    return scopes.stream().map(scope -> new ResourcePermission(null, new ArrayList<>(Arrays.asList(scope)), resourceServer));
+                    if (resourceModel != null) {
+                        permissions.add(Permissions.createResourcePermissions(resourceType, resourceModel, resourceServer, scopes, authorization, request));
+                    } else if (AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(authorization.getRealm(), resourceServer.getId())) {
+                        permissions.add(Permissions.createResourcePermissions(resourceType, new ResourceWrapper(resource.getName(), scopes, resourceServer), resourceServer, scopes, authorization, request));
+                    }
+
+                    if (!permissions.isEmpty()) {
+                        return permissions.stream();
+                    }
+                } else if (resource.getType() != null) {
+                    return resourceStore.findByType(resourceServer, resource.getType()).stream().map(resource1 -> Permissions.createResourcePermissions(resource1,
+                            resourceServer, scopes, authorization, request));
                 }
+            }
 
+            if (scopes.isEmpty()) {
+                return Stream.empty();
+            }
+
+            List<Resource> resources = storeFactory.getResourceStore().findByScopes(resourceServer, scopes);
 
-                return resources.stream().map(resource12 -> Permissions.createResourcePermissions(resource12, resourceServer,
-                        scopes, authorization, request));
+            if (resources.isEmpty()) {
+                return scopes.stream().map(scope -> new ResourcePermission(null, new ArrayList<>(Arrays.asList(scope)), resourceServer));
             }
+
+
+            return resources.stream().map(resource12 -> Permissions.createResourcePermissions(resource12, resourceServer,
+                    scopes, authorization, request));
         }).collect(Collectors.toList());
     }
 
@@ -312,13 +368,27 @@ private CloseableKeycloakIdentity createIdentity(PolicyEvaluationRequest represe
             accessToken.setRealmAccess(new AccessToken.Access());
         }
 
-        if (representation.getRoleIds() != null && !representation.getRoleIds().isEmpty()) {
-            if (accessToken.getRealmAccess() == null) {
-                accessToken.setRealmAccess(new AccessToken.Access());
-            }
-            AccessToken.Access realmAccess = accessToken.getRealmAccess();
+        if (accessToken.getRealmAccess() == null) {
+            accessToken.setRealmAccess(new AccessToken.Access());
+        }
 
+        AccessToken.Access realmAccess = accessToken.getRealmAccess();
+        if (representation.getRoleIds() != null && !representation.getRoleIds().isEmpty()) {
             representation.getRoleIds().forEach(realmAccess::addRole);
+        } else {
+            UserModel user = keycloakSession.users().getUserById(realm, representation.getUserId());
+
+            if (user != null) {
+                AccessToken finalAccessToken = accessToken;
+                user.getRoleMappingsStream().forEach(roleModel -> {
+                    if (roleModel.isClientRole()) {
+                        ClientModel client = (ClientModel) roleModel.getContainer();
+                        finalAccessToken.addAccess(client.getClientId()).addRole(roleModel.getName());
+                    } else {
+                        realmAccess.addRole(roleModel.getName());
+                    }
+                });
+            }
         }
 
         return new CloseableKeycloakIdentity(accessToken, keycloakSession, userSession);
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
index d97309b9ab69..36c440f700dd 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
@@ -31,6 +31,7 @@
 import jakarta.ws.rs.core.Response.Status;
 
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
@@ -39,13 +40,14 @@
 import org.keycloak.authorization.store.StoreFactory;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
 import org.keycloak.representations.idm.authorization.PolicyRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ScopeRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 import org.keycloak.util.JsonSerialization;
 
@@ -74,7 +76,7 @@ public PolicyResourceService(Policy policy, ResourceServer resourceServer, Autho
     @NoCache
     public Response update(String payload) {
         if (auth != null) {
-            this.auth.realm().requireManageAuthorization();
+            this.auth.realm().requireManageAuthorization(resourceServer);
         }
 
         AbstractPolicyRepresentation representation = doCreateRepresentation(payload);
@@ -96,7 +98,7 @@ public Response update(String payload) {
     @DELETE
     public Response delete() {
         if (auth != null) {
-            this.auth.realm().requireManageAuthorization();
+            this.auth.realm().requireManageAuthorization(resourceServer);
         }
 
         if (policy == null) {
@@ -126,7 +128,7 @@ public Response delete() {
     @NoCache
     public Response findById(@QueryParam("fields") String fields) {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         if (policy == null) {
@@ -150,7 +152,7 @@ protected AbstractPolicyRepresentation toRepresentation(Policy policy, String fi
     @NoCache
     public Response getDependentPolicies() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         if (policy == null) {
@@ -176,7 +178,7 @@ public Response getDependentPolicies() {
     @NoCache
     public Response getScopes() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         if (policy == null) {
@@ -199,18 +201,21 @@ public Response getScopes() {
     @NoCache
     public Response getResources() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         if (policy == null) {
             return Response.status(Status.NOT_FOUND).build();
         }
 
+        KeycloakSession session = authorization.getKeycloakSession();
+
         return Response.ok(policy.getResources().stream().map(resource -> {
             ResourceRepresentation representation = new ResourceRepresentation();
 
             representation.setId(resource.getId());
             representation.setName(resource.getName());
+            representation.setDisplayName(AdminPermissionsSchema.SCHEMA.getResourceName(session, policy, resource));
 
             return representation;
         }).collect(Collectors.toList())).build();
@@ -222,7 +227,7 @@ public Response getResources() {
     @NoCache
     public Response getAssociatedPolicies() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         if (policy == null) {
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
index dcb6e60585c9..091dcacd8425 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
@@ -43,7 +43,7 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.jboss.resteasy.reactive.NoCache;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
@@ -67,8 +67,9 @@
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.StringUtil;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -121,7 +122,7 @@ protected Object doCreatePolicyResource(Policy policy) {
     @APIResponse(responseCode = "201", description = "Created")
     public Response create(String payload) {
         if (auth != null) {
-            this.auth.realm().requireManageAuthorization();
+            this.auth.realm().requireManageAuthorization(resourceServer);
         }
 
         AbstractPolicyRepresentation representation = doCreateRepresentation(payload);
@@ -173,7 +174,7 @@ public Policy create(AbstractPolicyRepresentation representation) {
     })
     public Response findByName(@QueryParam("name") String name, @QueryParam("fields") String fields) {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         StoreFactory storeFactory = authorization.getStoreFactory();
@@ -204,6 +205,7 @@ public Response findByName(@QueryParam("name") String name, @QueryParam("fields"
     public Response findAll(@QueryParam("policyId") String id,
                             @QueryParam("name") String name,
                             @QueryParam("type") String type,
+                            @QueryParam("resourceType") String resourceType,
                             @QueryParam("resource") String resource,
                             @QueryParam("scope") String scope,
                             @QueryParam("permission") Boolean permission,
@@ -212,7 +214,7 @@ public Response findAll(@QueryParam("policyId") String id,
                             @QueryParam("first") Integer firstResult,
                             @QueryParam("max") Integer maxResult) {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         Map<Policy.FilterOption, String[]> search = new EnumMap<>(Policy.FilterOption.class);
@@ -285,6 +287,10 @@ public Response findAll(@QueryParam("policyId") String id,
             search.put(Policy.FilterOption.PERMISSION, new String[] {permission.toString()});
         }
 
+        if (StringUtil.isNotBlank(resourceType)) {
+            search.put(Policy.FilterOption.CONFIG, new String[] {"defaultResourceType", resourceType});
+        }
+
         return Response.ok(
                 doSearch(firstResult, maxResult, fields, search))
                 .build();
@@ -312,7 +318,7 @@ protected List<Object> doSearch(Integer firstResult, Integer maxResult, String f
     )
     public Response findPolicyProviders() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         return Response.ok(
@@ -334,7 +340,7 @@ public Response findPolicyProviders() {
     @Path("evaluate")
     public PolicyEvaluationService getPolicyEvaluateResource() {
         if (auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
 
         return new PolicyEvaluationService(this.resourceServer, this.authorization, this.auth);
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeResourceService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeResourceService.java
index d440547d8310..5b5bcfb6f0d9 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeResourceService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeResourceService.java
@@ -23,7 +23,7 @@
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 import org.keycloak.util.JsonSerialization;
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeService.java
index b0bd7b5fa1e8..1306df8aed2a 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyTypeService.java
@@ -29,7 +29,7 @@
 import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 import org.keycloak.util.JsonSerialization;
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/ResourceServerService.java b/services/src/main/java/org/keycloak/authorization/admin/ResourceServerService.java
index d8a1fc422ece..73ff44fd9933 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/ResourceServerService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/ResourceServerService.java
@@ -34,7 +34,7 @@
 
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.events.admin.OperationType;
@@ -52,7 +52,7 @@
 import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -79,7 +79,7 @@ public ResourceServerService(AuthorizationProvider authorization, ResourceServer
     public ResourceServer create(boolean newClient) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
 
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
 
         UserModel serviceAccount = this.session.users().getServiceAccount(client);
 
@@ -103,7 +103,7 @@ public ResourceServer create(boolean newClient) {
     public Response update(ResourceServerRepresentation server) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
 
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         this.resourceServer.setAllowRemoteResourceManagement(server.isAllowRemoteResourceManagement());
         this.resourceServer.setPolicyEnforcementMode(server.getPolicyEnforcementMode());
         this.resourceServer.setDecisionStrategy(server.getDecisionStrategy());
@@ -114,7 +114,7 @@ public Response update(ResourceServerRepresentation server) {
     public void delete() {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
 
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         //need to create representation before the object is deleted to be able to get lazy loaded fields
         ResourceServerRepresentation rep = ModelToRepresentation.toRepresentation(resourceServer, client);
         authorization.getStoreFactory().getResourceServerStore().delete(client);
@@ -124,7 +124,7 @@ public void delete() {
     @GET
     @Produces(MediaType.APPLICATION_JSON)
     public ResourceServerRepresentation findById() {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         return toRepresentation(this.resourceServer, this.client);
     }
 
@@ -133,7 +133,7 @@ public ResourceServerRepresentation findById() {
     @Produces(MediaType.APPLICATION_JSON)
     public ResourceServerRepresentation exportSettings() {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         return ModelToRepresentation.toResourceServerRepresentation(session, client);
     }
 
@@ -143,7 +143,7 @@ public ResourceServerRepresentation exportSettings() {
     @APIResponse(responseCode = "204", description = "No Content")
     public Response importSettings(ResourceServerRepresentation rep) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
 
         rep.setClientId(client.getId());
 
@@ -171,7 +171,7 @@ public PolicyService getPolicyResource() {
 
     @Path("/permission")
     public PermissionService getPermissionTypeResource() {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         return new PermissionService(this.resourceServer, this.authorization, this.auth, adminEvent);
     }
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java b/services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java
index 4cde75222505..94c350c6e409 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/ResourceSetService.java
@@ -53,7 +53,7 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.OAuthErrorException;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
@@ -77,7 +77,7 @@
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -375,7 +375,7 @@ public Response getAttributes(@PathParam("resource-id") String id) {
         @APIResponse(responseCode = "204", description = "No Content")
     })
     public Response find(@QueryParam("name") String name) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         StoreFactory storeFactory = authorization.getStoreFactory();
 
         if (name == null) {
@@ -526,13 +526,13 @@ protected Collection<Map.Entry<String, Resource>> getPaths() {
 
     private void requireView() {
         if (this.auth != null) {
-            this.auth.realm().requireViewAuthorization();
+            this.auth.realm().requireViewAuthorization(resourceServer);
         }
     }
 
     private void requireManage() {
         if (this.auth != null) {
-            this.auth.realm().requireManageAuthorization();
+            this.auth.realm().requireManageAuthorization(resourceServer);
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/ScopeService.java b/services/src/main/java/org/keycloak/authorization/admin/ScopeService.java
index 7cc59805f332..c83226fb05cc 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/ScopeService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/ScopeService.java
@@ -23,7 +23,7 @@
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.jboss.resteasy.reactive.NoCache;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
@@ -41,7 +41,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
@@ -92,7 +92,7 @@ public ScopeService(KeycloakSession session, ResourceServer resourceServer, Auth
     @Produces(MediaType.APPLICATION_JSON)
     public Response create(ScopeRepresentation scope) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, resourceServer.getId());
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         Scope model = toModel(scope, this.resourceServer, authorization);
 
         scope.setId(model.getId());
@@ -108,7 +108,7 @@ public Response create(ScopeRepresentation scope) {
     @Produces(MediaType.APPLICATION_JSON)
     public Response update(@PathParam("scope-id") String id, ScopeRepresentation scope) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, resourceServer.getId());
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         scope.setId(id);
         StoreFactory storeFactory = authorization.getStoreFactory();
         Scope model = storeFactory.getScopeStore().findById(resourceServer, scope.getId());
@@ -128,7 +128,7 @@ public Response update(@PathParam("scope-id") String id, ScopeRepresentation sco
     @DELETE
     public Response delete(@PathParam("scope-id") String id) {
         AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, resourceServer.getId());
-        this.auth.realm().requireManageAuthorization();
+        this.auth.realm().requireManageAuthorization(resourceServer);
         StoreFactory storeFactory = authorization.getStoreFactory();
         Scope scope = storeFactory.getScopeStore().findById(resourceServer, id);
         if (scope == null) {
@@ -174,7 +174,7 @@ public Response delete(@PathParam("scope-id") String id) {
         @APIResponse(responseCode = "404", description = "Not found")
     })
     public Response findById(@PathParam("scope-id") String id) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         Scope model = this.authorization.getStoreFactory().getScopeStore().findById(resourceServer, id);
 
         if (model == null) {
@@ -196,7 +196,7 @@ public Response findById(@PathParam("scope-id") String id) {
         @APIResponse(responseCode = "404", description = "Not found")
     })
     public Response getResources(@PathParam("scope-id") String id) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         StoreFactory storeFactory = this.authorization.getStoreFactory();
         Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
 
@@ -226,7 +226,7 @@ public Response getResources(@PathParam("scope-id") String id) {
         @APIResponse(responseCode = "404", description = "Not found")
     })
     public Response getPermissions(@PathParam("scope-id") String id) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         StoreFactory storeFactory = this.authorization.getStoreFactory();
         Scope model = storeFactory.getScopeStore().findById(resourceServer, id);
 
@@ -260,7 +260,7 @@ public Response getPermissions(@PathParam("scope-id") String id) {
         @APIResponse(responseCode = "400", description = "Bad Request")
     })
     public Response find(@QueryParam("name") String name) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
         StoreFactory storeFactory = authorization.getStoreFactory();
 
         if (name == null) {
@@ -283,7 +283,7 @@ public Stream<ScopeRepresentation> findAll(@QueryParam("scopeId") String id,
                             @QueryParam("name") String name,
                             @QueryParam("first") Integer firstResult,
                             @QueryParam("max") Integer maxResult) {
-        this.auth.realm().requireViewAuthorization();
+        this.auth.realm().requireViewAuthorization(resourceServer);
 
         Map<Scope.FilterOption, String[]> search = new EnumMap<>(Scope.FilterOption.class);
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/representation/FGAPPolicyEvaluationResponseBuilder.java b/services/src/main/java/org/keycloak/authorization/admin/representation/FGAPPolicyEvaluationResponseBuilder.java
new file mode 100644
index 000000000000..2d45abe56774
--- /dev/null
+++ b/services/src/main/java/org/keycloak/authorization/admin/representation/FGAPPolicyEvaluationResponseBuilder.java
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authorization.admin.representation;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.Decision.Effect;
+import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.model.Scope;
+import org.keycloak.authorization.policy.evaluation.Result;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionEffect;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationRequest;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse.PolicyResultRepresentation;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ScopeRepresentation;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+class FGAPPolicyEvaluationResponseBuilder {
+
+    static PolicyEvaluationResponse build(EvaluationDecisionCollector decision, ResourceServer resourceServer, AuthorizationProvider authorization, PolicyEvaluationRequest request) {
+        PolicyEvaluationResponse response = new PolicyEvaluationResponse();
+        Collection<Result> results = decision.getResults();
+
+        if (results.isEmpty()) {
+            response.setResults(List.of());
+            response.setStatus(DecisionEffect.DENY);
+            return response;
+        }
+
+        Result result = results.iterator().next();
+        PolicyEvaluationResponse.EvaluationResultRepresentation rep = new PolicyEvaluationResponse.EvaluationResultRepresentation();
+
+        if (Effect.PERMIT.equals(result.getEffect())) {
+            response.setStatus(DecisionEffect.PERMIT);
+            rep.setStatus(DecisionEffect.PERMIT);
+        } else {
+            response.setStatus(DecisionEffect.DENY);
+            rep.setStatus(DecisionEffect.DENY);
+        }
+
+        Resource resource = result.getPermission().getResource();
+        ResourceRepresentation resourceRep = new ResourceRepresentation();
+
+        resourceRep.setId(resource.getId());
+        resourceRep.setName(resource.getName());
+
+        rep.setResource(resourceRep);
+
+        rep.setScopes(result.getPermission().getScopes().stream().map(scope -> {
+            ScopeRepresentation representation = new ScopeRepresentation();
+
+            representation.setId(scope.getId());
+            representation.setName(scope.getName());
+
+            return representation;
+        }).collect(Collectors.toList()));
+
+        Set<PolicyResultRepresentation> policies = new HashSet<>();
+
+        for (Result.PolicyResult policy : result.getResults()) {
+            PolicyResultRepresentation policyRep = toRepresentation(policy);
+
+            if (Effect.PERMIT.equals(policy.getEffect())) {
+                policyRep.setStatus(DecisionEffect.PERMIT);
+            } else {
+                policyRep.setStatus(DecisionEffect.DENY);
+            }
+
+            policyRep.setScopes(policy.getPolicy().getScopes().stream().map(Scope::getName).collect(Collectors.toSet()));
+            policyRep.setResourceType(policy.getPolicy().getResourceType());
+
+            policies.add(policyRep);
+        }
+
+        rep.setPolicies(policies);
+
+        Set<ScopeRepresentation> scopes = result.getPermission().getScopes().stream().map(ModelToRepresentation::toRepresentation).collect(Collectors.toSet());
+
+        if (DecisionEffect.PERMIT.equals(rep.getStatus())) {
+            rep.setAllowedScopes(scopes);
+        } else {
+            rep.setDeniedScopes(scopes);
+        }
+
+        rep.getAllowedScopes().removeAll(rep.getDeniedScopes());
+        rep.getDeniedScopes().addAll(request.getResources().get(0).getScopes());
+        rep.getDeniedScopes().removeAll(rep.getAllowedScopes());
+
+        String resourceName = AdminPermissionsSchema.SCHEMA.getResourceName(authorization.getKeycloakSession(), resourceServer, request.getResourceType(), rep.getResource().getName());
+
+        rep.getResource().setName(resourceName + " with scopes " + rep.getScopes().stream().flatMap((Function<ScopeRepresentation, Stream<?>>) scopeRepresentation -> Stream.of(scopeRepresentation.getName())).sorted().toList());
+        rep.getPolicies().addAll(rep.getPolicies());
+
+        response.setResults(List.of(rep));
+
+        return response;
+    }
+
+    private static PolicyResultRepresentation toRepresentation(Result.PolicyResult result) {
+        PolicyResultRepresentation policyResultRep = new PolicyResultRepresentation();
+
+        PolicyRepresentation representation = new PolicyRepresentation();
+        Policy policy = result.getPolicy();
+
+        representation.setId(policy.getId());
+        representation.setName(policy.getName());
+        representation.setType(policy.getType());
+        representation.setDecisionStrategy(policy.getDecisionStrategy());
+        representation.setDescription(policy.getDescription());
+
+        representation.setResources(policy.getResources().stream().map(Resource::getName).collect(Collectors.toSet()));
+
+        Set<String> scopeNames = policy.getScopes().stream().map(Scope::getName).collect(Collectors.toSet());
+
+        representation.setScopes(scopeNames);
+
+        policyResultRep.setPolicy(representation);
+
+        if (result.getEffect() == Effect.DENY) {
+            policyResultRep.setStatus(DecisionEffect.DENY);
+            policyResultRep.setScopes(representation.getScopes());
+        } else {
+            policyResultRep.setStatus(DecisionEffect.PERMIT);
+        }
+
+        policyResultRep.setAssociatedPolicies(result.getAssociatedPolicies().stream().map(FGAPPolicyEvaluationResponseBuilder::toRepresentation).toList());
+
+        return policyResultRep;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java b/services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
index 9e7824b8bf9b..15ed662fdb87 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
@@ -16,9 +16,10 @@
  */
 package org.keycloak.authorization.admin.representation;
 
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.Decision;
-import org.keycloak.authorization.admin.PolicyEvaluationService;
+import org.keycloak.authorization.admin.PolicyEvaluationService.EvaluationDecisionCollector;
 import org.keycloak.authorization.common.KeycloakIdentity;
 import org.keycloak.authorization.model.PermissionTicket;
 import org.keycloak.authorization.model.Policy;
@@ -31,6 +32,7 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.authorization.DecisionEffect;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationRequest;
 import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse;
 import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse.PolicyResultRepresentation;
 import org.keycloak.representations.idm.authorization.PolicyRepresentation;
@@ -38,11 +40,11 @@
 import org.keycloak.representations.idm.authorization.ScopeRepresentation;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.Comparator;
 import java.util.EnumMap;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -55,7 +57,11 @@
  * @version $Revision: 1 $
  */
 public class PolicyEvaluationResponseBuilder {
-    public static PolicyEvaluationResponse build(PolicyEvaluationService.EvaluationDecisionCollector decision, ResourceServer resourceServer, AuthorizationProvider authorization, KeycloakIdentity identity) {
+    public static PolicyEvaluationResponse build(EvaluationDecisionCollector decision, ResourceServer resourceServer, AuthorizationProvider authorization, KeycloakIdentity identity, PolicyEvaluationRequest request) {
+        if (AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(authorization.getRealm(), resourceServer.getId())) {
+            return FGAPPolicyEvaluationResponseBuilder.build(decision, resourceServer, authorization, request);
+        }
+
         PolicyEvaluationResponse response = new PolicyEvaluationResponse();
         List<PolicyEvaluationResponse.EvaluationResultRepresentation> resultsRep = new ArrayList<>();
         AccessToken accessToken = identity.getAccessToken();
@@ -115,7 +121,7 @@ public static PolicyEvaluationResponse build(PolicyEvaluationService.EvaluationD
                 return representation;
             }).collect(Collectors.toList()));
 
-            List<PolicyEvaluationResponse.PolicyResultRepresentation> policies = new ArrayList<>();
+            Set<PolicyEvaluationResponse.PolicyResultRepresentation> policies = new HashSet<>();
 
             for (Result.PolicyResult policy : result.getResults()) {
                 PolicyResultRepresentation policyRep = toRepresentation(policy, authorization);
@@ -150,29 +156,23 @@ public static PolicyEvaluationResponse build(PolicyEvaluationService.EvaluationD
             List<ScopeRepresentation> scopes = result.getScopes();
 
             if (DecisionEffect.PERMIT.equals(result.getStatus())) {
-                result.setAllowedScopes(scopes);
+                result.setAllowedScopes(new HashSet<>(scopes));
             }
 
             if (resource.getId() != null) {
                 if (!scopes.isEmpty()) {
-                    result.getResource().setName(evaluationResultRepresentation.getResource().getName() + " with scopes " + scopes.stream().flatMap((Function<ScopeRepresentation, Stream<?>>) scopeRepresentation -> Arrays.asList(scopeRepresentation.getName()).stream()).collect(Collectors.toList()));
+                    result.getResource().setName(evaluationResultRepresentation.getResource().getName() + " with scopes " + scopes.stream().flatMap((Function<ScopeRepresentation, Stream<?>>) scopeRepresentation -> Stream.of(scopeRepresentation.getName())).toList());
                 } else {
                     result.getResource().setName(evaluationResultRepresentation.getResource().getName());
                 }
             } else {
-                result.getResource().setName("Any Resource with Scopes " + scopes.stream().flatMap((Function<ScopeRepresentation, Stream<?>>) scopeRepresentation -> Arrays.asList(scopeRepresentation.getName()).stream()).collect(Collectors.toList()));
+                result.getResource().setName("Any Resource with Scopes " + scopes.stream().flatMap((Function<ScopeRepresentation, Stream<?>>) scopeRepresentation -> Stream.of(scopeRepresentation.getName())).toList());
             }
 
-            List<PolicyEvaluationResponse.PolicyResultRepresentation> policies = result.getPolicies();
-
-            for (PolicyEvaluationResponse.PolicyResultRepresentation policy : new ArrayList<>(evaluationResultRepresentation.getPolicies())) {
-                if (!policies.contains(policy)) {
-                    policies.add(policy);
-                }
-            }
+            result.getPolicies().addAll(evaluationResultRepresentation.getPolicies());
         });
 
-        response.setResults(groupedResults.values().stream().collect(Collectors.toList()));
+        response.setResults(new ArrayList<>(groupedResults.values()));
 
         return response;
     }
diff --git a/services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java b/services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
index 08482ab57a84..b8fd2558d124 100644
--- a/services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
+++ b/services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
@@ -314,7 +314,7 @@ private AuthorizationResponse createAuthorizationResponse(KeycloakIdentity ident
         if (accessToken.getSessionState() == null) {
             // Create temporary (request-scoped) transient session
             UserModel user = TokenManager.lookupUserFromStatelessToken(keycloakSession, realm, accessToken);
-            userSessionModel = new UserSessionManager(keycloakSession).createUserSession(KeycloakModelUtils.generateId(), realm, user, user.getUsername(), request.getClientConnection().getRemoteAddr(),
+            userSessionModel = new UserSessionManager(keycloakSession).createUserSession(KeycloakModelUtils.generateId(), realm, user, user.getUsername(), request.getClientConnection().getRemoteHost(),
                     ServiceAccountConstants.CLIENT_AUTH, false, null, null, UserSessionModel.SessionPersistenceState.TRANSIENT);
         } else {
             userSessionModel = sessions.getUserSession(realm, accessToken.getSessionState());
@@ -347,7 +347,7 @@ private AuthorizationResponse createAuthorizationResponse(KeycloakIdentity ident
             authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(keycloakSession.getContext().getUri().getBaseUri(), realm.getName()));
 
             AuthenticationManager.setClientScopesInSession(keycloakSession, authSession);
-            clientSessionCtx = TokenManager.attachAuthenticationSession(keycloakSession, userSessionModel, authSession);
+            clientSessionCtx = TokenManager.attachAuthenticationSession(keycloakSession, userSessionModel, authSession, true);
         } else {
             clientSessionCtx = DefaultClientSessionContext.fromClientSessionScopeParameter(clientSession, keycloakSession);
         }
@@ -673,13 +673,13 @@ private void resolveResourcePermission(KeycloakAuthorizationRequest request,
                     permission.setResourceId(serverResource.getId());
                     addPermission(request, resourceServer, authorization, permissionsToEvaluate, limit, requestedScopesModel, serverResource);
                 }
-            }
-        }
 
-        if (permissionsToEvaluate.isEmpty()) {
-            CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(request.getCors(), "invalid_resource", "Resource with id [" + resourceId + "] does not exist.", Status.BAD_REQUEST);
-            fireErrorEvent(request.getEvent(), Errors.INVALID_REQUEST, invalidResourceException);
-            throw invalidResourceException;
+                if (permissionsToEvaluate.isEmpty()) {
+                    CorsErrorResponseException invalidResourceException = new CorsErrorResponseException(request.getCors(), "invalid_resource", "Resource with id [" + resourceId + "] does not exist.", Status.BAD_REQUEST);
+                    fireErrorEvent(request.getEvent(), Errors.INVALID_REQUEST, invalidResourceException);
+                    throw invalidResourceException;
+                }
+            }
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/authorization/common/KeycloakIdentity.java b/services/src/main/java/org/keycloak/authorization/common/KeycloakIdentity.java
index 62c418c6dc2d..ab55e183fd54 100644
--- a/services/src/main/java/org/keycloak/authorization/common/KeycloakIdentity.java
+++ b/services/src/main/java/org/keycloak/authorization/common/KeycloakIdentity.java
@@ -306,8 +306,14 @@ private UserModel getUserFromToken() {
             return TokenManager.lookupUserFromStatelessToken(keycloakSession, realm, accessToken);
         }
 
+        // Avoid further loookup if verified userSession already set in the context
+        UserSessionModel userSession = keycloakSession.getContext().getUserSession();
+        if (userSession != null && accessToken.getSessionState().equals(userSession.getId())) {
+            return userSession.getUser();
+        }
+
         UserSessionProvider sessions = keycloakSession.sessions();
-        UserSessionModel userSession = sessions.getUserSession(realm, accessToken.getSessionState());
+        userSession = sessions.getUserSession(realm, accessToken.getSessionState());
 
         if (userSession == null) {
             userSession = sessions.getOfflineUserSession(realm, accessToken.getSessionState());
diff --git a/services/src/main/java/org/keycloak/authorization/protection/introspect/RPTIntrospectionProvider.java b/services/src/main/java/org/keycloak/authorization/protection/introspect/RPTIntrospectionProvider.java
index e0b1cae37122..8e883d70d2a0 100644
--- a/services/src/main/java/org/keycloak/authorization/protection/introspect/RPTIntrospectionProvider.java
+++ b/services/src/main/java/org/keycloak/authorization/protection/introspect/RPTIntrospectionProvider.java
@@ -43,7 +43,7 @@
  *
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class RPTIntrospectionProvider extends AccessTokenIntrospectionProvider {
+public class RPTIntrospectionProvider extends AccessTokenIntrospectionProvider<AccessToken> {
 
     protected static final Logger LOGGER = Logger.getLogger(RPTIntrospectionProvider.class);
 
@@ -52,13 +52,13 @@ public RPTIntrospectionProvider(KeycloakSession session) {
     }
 
     @Override
-    public Response introspect(String token, EventBuilder eventBuilder) {
+    public Response introspect(String tokenStr, EventBuilder eventBuilder) {
+        this.eventBuilder = eventBuilder;
         LOGGER.debug("Introspecting requesting party token");
         try {
-            AccessToken accessToken = verifyAccessToken(token, eventBuilder, true);
             ObjectNode tokenMetadata;
-
-            if (accessToken != null) {
+            if (introspectionChecks(tokenStr)) {
+                AccessToken accessToken = this.token;
                 AccessToken metadata = new AccessToken();
 
                 metadata.id(accessToken.getId());
@@ -85,13 +85,13 @@ public Response introspect(String token, EventBuilder eventBuilder) {
 
                     tokenMetadata.putPOJO("permissions", permissions);
                 }
+                tokenMetadata.put("active", true);
+                eventBuilder.success();
             } else {
                 tokenMetadata = JsonSerialization.createObjectNode();
-                eventBuilder.error(Errors.TOKEN_INTROSPECTION_FAILED);
+                tokenMetadata.put("active", false);
             }
 
-            tokenMetadata.put("active", accessToken != null);
-
             return Response.ok(JsonSerialization.writeValueAsBytes(tokenMetadata)).type(MediaType.APPLICATION_JSON_TYPE).build();
         } catch (Exception e) {
             eventBuilder.detail(Details.REASON, e.getMessage());
diff --git a/services/src/main/java/org/keycloak/authorization/protection/policy/UserManagedPermissionService.java b/services/src/main/java/org/keycloak/authorization/protection/policy/UserManagedPermissionService.java
index dbde40afabf2..158ba88322c1 100644
--- a/services/src/main/java/org/keycloak/authorization/protection/policy/UserManagedPermissionService.java
+++ b/services/src/main/java/org/keycloak/authorization/protection/policy/UserManagedPermissionService.java
@@ -124,7 +124,7 @@ public Response find(@QueryParam("name") String name,
                          @QueryParam("scope") String scope,
                          @QueryParam("first") Integer firstResult,
                          @QueryParam("max") Integer maxResult) {
-        return  delegate.findAll(null, name, "uma", resource, scope, true, identity.getId(), null, firstResult, maxResult);
+        return  delegate.findAll(null, name, "uma", null, resource, scope, true, identity.getId(), null, firstResult, maxResult);
     }
 
     private Policy getPolicy(@PathParam("policyId") String policyId) {
diff --git a/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProvider.java b/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProvider.java
new file mode 100755
index 000000000000..f2ce8cf672ad
--- /dev/null
+++ b/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProvider.java
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oauth;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider;
+import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
+import org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+
+import java.io.IOException;
+
+public class OAuth2IdentityProvider extends AbstractOAuth2IdentityProvider<OAuth2IdentityProviderConfig> {
+
+    public OAuth2IdentityProvider(KeycloakSession session, OAuth2IdentityProviderConfig config) {
+        super(session, config);
+    }
+
+    @Override
+    protected String getDefaultScopes() {
+        return "";
+    }
+
+    @Override
+    protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
+        BrokeredIdentityContext identity = new BrokeredIdentityContext(getConfig());
+
+        if (accessToken != null) {
+            JsonNode userInfo = fetchUserProfile(accessToken);
+
+            AbstractJsonUserAttributeMapper.storeUserProfileForMapper(identity, userInfo, getConfig().getAlias());
+
+            String id = getJsonProperty(userInfo, getConfig().getUserIDClaim());
+            identity.setId(id);
+
+            String givenName = getJsonProperty(userInfo, getConfig().getGivenNameClaim());
+
+            if (givenName != null) {
+                identity.setFirstName(givenName);
+            }
+
+            String familyName = getJsonProperty(userInfo, getConfig().getFamilyNameClaim());
+
+            if (familyName != null) {
+                identity.setLastName(familyName);
+            }
+
+            if (givenName == null && familyName == null) {
+                String name = getJsonProperty(userInfo, getConfig().getFullNameClaim());
+                identity.setName(name);
+            }
+
+            String email = getJsonProperty(userInfo, getConfig().getEmailClaim());
+            identity.setEmail(email);
+
+            identity.setBrokerUserId(getConfig().getAlias() + "." + id);
+
+            String preferredUsername = getJsonProperty(userInfo, getConfig().getUserNameClaim());
+
+            if (preferredUsername == null) {
+                preferredUsername = email;
+            }
+
+            if (preferredUsername == null) {
+                preferredUsername = id;
+            }
+
+            identity.setUsername(preferredUsername);
+        }
+
+        return identity;
+    }
+
+    @Override
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        // Supporting only introspection-endpoint validation for now
+        validateExternalTokenWithIntrospectionEndpoint(tokenExchangeContext);
+
+        return exchangeExternalUserInfoValidationOnly(tokenExchangeContext.getEvent(), tokenExchangeContext.getFormParams());
+    }
+
+    private JsonNode fetchUserProfile(String accessToken) {
+        String userInfoUrl = getConfig().getUserInfoUrl();
+
+        try (SimpleHttp.Response response = executeRequest(userInfoUrl, SimpleHttp.doGet(userInfoUrl, session)
+                .header(HttpHeaders.AUTHORIZATION, "Bearer " + accessToken)
+                .header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON))) {
+            String contentType = response.getFirstHeader(HttpHeaders.CONTENT_TYPE);
+            MediaType contentMediaType;
+
+            try {
+                contentMediaType = MediaType.valueOf(contentType);
+            } catch (IllegalArgumentException ex) {
+                contentMediaType = null;
+            }
+
+            if (contentMediaType == null || contentMediaType.isWildcardSubtype() || contentMediaType.isWildcardType()) {
+                throw new RuntimeException("Unsupported content-type [" + contentType + "] in response from [" + userInfoUrl + "].");
+            }
+
+            if (!MediaType.APPLICATION_JSON_TYPE.isCompatible(contentMediaType)) {
+                throw new RuntimeException("Unsupported content-type [" + contentType + "] in response from [" + userInfoUrl + "].");
+            }
+
+            return response.asJson();
+        } catch (Exception e) {
+            throw new IdentityBrokerException("Error while fetching user profile", e);
+        }
+    }
+
+    private SimpleHttp.Response executeRequest(String url, SimpleHttp request) throws IOException {
+        SimpleHttp.Response response = request.asResponse();
+        int status = response.getStatus();
+
+        if (Response.Status.fromStatusCode(status).getFamily() != Response.Status.Family.SUCCESSFUL) {
+            logger.warnf("User profile endpoint (%s) returned an error (%d): %s", url, status, response.asString());
+            throw new RuntimeException("Unexpected response from user profile endpoint");
+        }
+
+        return  response;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProviderFactory.java b/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProviderFactory.java
new file mode 100755
index 000000000000..4de3e5960233
--- /dev/null
+++ b/services/src/main/java/org/keycloak/broker/oauth/OAuth2IdentityProviderFactory.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oauth;
+
+import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
+import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
+import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.StringUtil;
+
+import java.io.IOException;
+import java.util.Map;
+
+public class OAuth2IdentityProviderFactory extends AbstractIdentityProviderFactory<OAuth2IdentityProvider> {
+
+    public static final String PROVIDER_ID = "oauth2";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String getName() {
+        return "OAuth v2";
+    }
+
+    @Override
+    public OAuth2IdentityProvider create(KeycloakSession session, IdentityProviderModel model) {
+        return new OAuth2IdentityProvider(session, createConfig(model));
+    }
+
+    @Override
+    public IdentityProviderModel createConfig() {
+        return createConfig(null);
+    }
+
+    private OAuth2IdentityProviderConfig createConfig(IdentityProviderModel model) {
+        return new OAuth2IdentityProviderConfig(model) {
+            @Override
+            public void validate(RealmModel realm) {
+                if (StringUtil.isBlank(getUserInfoUrl())) {
+                    throw new IllegalArgumentException("User Info URL not provided");
+                }
+
+                if (StringUtil.isBlank(getUserIDClaim())) {
+                    throw new IllegalArgumentException("User ID Claim not provided");
+                }
+
+                if (StringUtil.isBlank(getUserNameClaim())) {
+                    throw new IllegalArgumentException("User Name Claim not provided");
+                }
+                if (StringUtil.isBlank(getEmailClaim())) {
+                    throw new IllegalArgumentException("User Email Claim not provided");
+                }
+
+                super.validate(realm);
+            }
+        };
+    }
+
+    @Override
+    public Map<String, String> parseConfig(KeycloakSession session, String rawConfig) {
+        OIDCConfigurationRepresentation rep;
+        try {
+            rep = JsonSerialization.readValue(rawConfig, OIDCConfigurationRepresentation.class);
+        } catch (IOException e) {
+            throw new RuntimeException("failed to load openid connect metadata", e);
+        }
+        OIDCIdentityProviderConfig config = new OIDCIdentityProviderConfig();
+        config.setIssuer(rep.getIssuer());
+        config.setAuthorizationUrl(rep.getAuthorizationEndpoint());
+        config.setTokenUrl(rep.getTokenEndpoint());
+        config.setUserInfoUrl(rep.getUserinfoEndpoint());
+
+        // Introspection URL may or may not be available in the configuration. It is mentioned in RFC8414 , but not in the OIDC discovery specification.
+        // Hence some servers may not add it to their well-known responses
+        if (rep.getIntrospectionEndpoint() != null) {
+            config.setTokenIntrospectionUrl(rep.getIntrospectionEndpoint());
+        }
+        return config.getConfig();
+    }
+}
diff --git a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java
index eb8c390ce021..b7b16084a9c3 100755
--- a/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java
@@ -19,6 +19,7 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.jboss.logging.Logger;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.crypto.KeyType;
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.http.HttpRequest;
@@ -55,18 +56,25 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.oidc.AccessTokenIntrospectionProviderFactory;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
 import org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint;
+import org.keycloak.protocol.oidc.endpoints.TokenIntrospectionEndpoint;
 import org.keycloak.protocol.oidc.utils.PkceUtils;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.oidc.TokenMetadataRepresentation;
 import org.keycloak.services.ErrorPage;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.Urls;
 import org.keycloak.services.managers.ClientSessionCode;
 import org.keycloak.services.messages.Messages;
+import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.urls.UrlType;
 import org.keycloak.utils.StringUtil;
 import org.keycloak.vault.VaultStringSecret;
 
@@ -449,7 +457,7 @@ public SimpleHttp authenticateTokenRequest(final SimpleHttp tokenRequest) {
 
     protected JsonWebToken generateToken() {
         JsonWebToken jwt = new JsonWebToken();
-        jwt.id(KeycloakModelUtils.generateId());
+        jwt.id(SecretGenerator.getInstance().generateSecureID());
         jwt.type(OAuth2Constants.JWT);
         jwt.issuer(getConfig().getClientId());
         jwt.subject(getConfig().getClientId());
@@ -526,11 +534,11 @@ public Response authResponse(@QueryParam(AbstractOAuth2IdentityProvider.OAUTH2_P
                     if (error.equals(ACCESS_DENIED)) {
                         return callback.cancelled(providerConfig);
                     } else if (error.equals(OAuthErrorException.LOGIN_REQUIRED) || error.equals(OAuthErrorException.INTERACTION_REQUIRED)) {
-                        return callback.error(error);
+                        return callback.error(providerConfig, error);
                     } else if (error.equals(OAuthErrorException.TEMPORARILY_UNAVAILABLE) && Constants.AUTHENTICATION_EXPIRED_MESSAGE.equals(errorDescription)) {
                         return callback.retryLogin(this.provider, authSession);
                     } else {
-                        return callback.error(Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+                        return callback.error(providerConfig, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
                     }
                 }
 
@@ -655,6 +663,7 @@ protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
 
     protected BrokeredIdentityContext validateExternalTokenThroughUserInfo(EventBuilder event, String subjectToken, String subjectTokenType) {
         event.detail("validation_method", "user info");
+
         SimpleHttp.Response response = null;
         int status = 0;
         try {
@@ -705,21 +714,158 @@ public boolean isIssuer(String issuer, MultivaluedMap<String, String> params) {
         return requestedIssuer.equals(getConfig().getAlias());
     }
 
-
-    final public BrokeredIdentityContext exchangeExternal(EventBuilder event, MultivaluedMap<String, String> params) {
+    @Override
+    final public BrokeredIdentityContext exchangeExternal(TokenExchangeProvider tokenExchangeProvider, TokenExchangeContext tokenExchangeContext) {
         if (!supportsExternalExchange()) return null;
-        BrokeredIdentityContext context = exchangeExternalImpl(event, params);
+
+        BrokeredIdentityContext context;
+        int teVersion = tokenExchangeProvider.getVersion();
+        switch (teVersion) {
+            case 1:
+                context = exchangeExternalTokenV1Impl(tokenExchangeContext.getEvent(), tokenExchangeContext.getFormParams());
+                break;
+            case 2:
+                context = exchangeExternalTokenV2Impl(tokenExchangeContext);
+                break;
+            default:
+                throw new IllegalArgumentException("Unsupported token exchange version " + teVersion);
+        }
+
         if (context != null) {
             context.setIdp(this);
         }
         return context;
     }
 
-    protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, MultivaluedMap<String, String> params) {
+    /**
+     * Usage with token-exchange V1
+     *
+     * @param event event builder
+     * @param params parameters of the token-exchange request
+     * @return brokered identity context with the details about user from the IDP
+     */
+    protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event, MultivaluedMap<String, String> params) {
         return exchangeExternalUserInfoValidationOnly(event, params);
 
     }
 
+    /**
+     * Usage with external-internal token-exchange v2.
+     *
+     * @param tokenExchangeContext data about token-exchange request
+     * @return brokered identity context with the details about user from the IDP
+     */
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        // Needs to be properly implemented for every provider to make sure it verifies external-token in appropriate way to validate user and also if the external-token
+        // was issued to the proper audience
+        throw new UnsupportedOperationException("Not yet supported to verify the external token of the identity provider " + getConfig().getAlias());
+    }
+
+    /**
+     * Called usually during external-internal token exchange for validation of external token, which is the token issued by the IDP.
+     * The validation of external token is done by calling OAuth2 introspection endpoint on the IDP side and validate if the response contains all the necessary claims
+     * and token is authorized for the token exchange (including validating of claims like aud from introspection response)
+     *
+     * @param tokenExchangeContext token exchange context with the external token (subject token) and other details related to token exchange
+     * @throws ErrorResponseException in case that validation failed for any reason
+     */
+    protected void validateExternalTokenWithIntrospectionEndpoint(TokenExchangeContext tokenExchangeContext) {
+        EventBuilder event = tokenExchangeContext.getEvent();
+
+        TokenMetadataRepresentation tokenMetadata = sendTokenIntrospectionRequest(tokenExchangeContext.getParams().getSubjectToken(), event);
+
+        boolean clientValid = false;
+        String tokenClientId = tokenMetadata.getClientId();
+        List<String> tokenAudiences = null;
+        if (tokenClientId != null && tokenClientId.equals(getConfig().getClientId())) {
+            // Consider external token valid if issued to same client, which was configured as the client on IDP side
+            clientValid = true;
+        } else if (tokenMetadata.getAudience() != null && tokenMetadata.getAudience().length > 0) {
+            tokenAudiences = Arrays.stream(tokenMetadata.getAudience()).toList();
+            if (tokenAudiences.contains(getConfig().getClientId())) {
+                // Consider external token valid if client configured as the IDP client included in token audience
+                clientValid = true;
+            } else {
+                // Consider valid introspection also if token contains audience where URL is Keycloak server (either as issuer or as token-endpoint URL).
+                // Aligned with https://datatracker.ietf.org/doc/html/rfc7523#section-3 - point 3
+                UriInfo frontendUriInfo = session.getContext().getUri(UrlType.FRONTEND);
+                UriInfo backendUriInfo = session.getContext().getUri(UrlType.BACKEND);
+                RealmModel realm = session.getContext().getRealm();
+                String realmIssuer = Urls.realmIssuer(frontendUriInfo.getBaseUri(), realm.getName());
+                String realmTokenUrl = RealmsResource.protocolUrl(backendUriInfo).clone()
+                        .path(OIDCLoginProtocolService.class, "token")
+                        .build(realm.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL).toString();
+                if (tokenAudiences.contains(realmIssuer) || tokenAudiences.contains(realmTokenUrl)) {
+                    clientValid = true;
+                }
+            }
+        }
+        if (!clientValid) {
+            logger.debugf("Token not authorized for token exchange. Token client Id: %s, Token audiences: %s", tokenClientId, tokenAudiences);
+            throwErrorResponse(event, Errors.INVALID_TOKEN, OAuthErrorException.INVALID_TOKEN, "Token not authorized for token exchange");
+        }
+    }
+
+    /**
+     * Send introspection request as specified in the OAuth2 token introspection specification. It requires
+     *
+     * @param idpAccessToken access token issued by the IDP
+     * @param event event builder
+     * @return token metadata in case that token introspection was successful and token is valid and active
+     * @throws ErrorResponseException in case that introspection response was not correct for any reason (other status than 200) or the token was not active
+     */
+    protected TokenMetadataRepresentation sendTokenIntrospectionRequest(String idpAccessToken, EventBuilder event) {
+        String introspectionEndointUrl = getConfig().getTokenIntrospectionUrl();
+        if (introspectionEndointUrl == null) {
+            throwErrorResponse(event, Errors.INVALID_CONFIG, OAuthErrorException.INVALID_REQUEST, "Introspection endpoint not configured for IDP");
+        }
+
+        try {
+
+            // Supporting only access-tokens for now
+            SimpleHttp introspectionRequest = SimpleHttp.doPost(introspectionEndointUrl, session)
+                    .param(TokenIntrospectionEndpoint.PARAM_TOKEN, idpAccessToken)
+                    .param(TokenIntrospectionEndpoint.PARAM_TOKEN_TYPE_HINT, AccessTokenIntrospectionProviderFactory.ACCESS_TOKEN_TYPE);
+            introspectionRequest = authenticateTokenRequest(introspectionRequest);
+
+            try (SimpleHttp.Response introspectionResponse = introspectionRequest.asResponse()) {
+                int status = introspectionResponse.getStatus();
+
+                if (status != 200) {
+                    try {
+                        logger.warnf("Failed to invoke introspection endpoint. Status: %d, Introspection response details: %s", status, introspectionResponse.asString());
+                    } catch (Exception ioe) {
+                        logger.warnf("Failed to invoke introspection endpoint. Status: %d", status);
+                    }
+                    throwErrorResponse(event, Errors.INVALID_REQUEST, OAuthErrorException.INVALID_REQUEST, "Introspection endpoint call failure. Introspection response status: " + status);
+                }
+
+                TokenMetadataRepresentation tokenMetadata = null;
+                try {
+                    tokenMetadata = introspectionResponse.asJson(TokenMetadataRepresentation.class);
+                } catch (IOException e) {
+                    throwErrorResponse(event, Errors.INVALID_TOKEN, OAuthErrorException.INVALID_TOKEN, "Invalid format of the introspection response");
+                }
+
+                if (!tokenMetadata.isActive()) {
+                    throwErrorResponse(event, Errors.INVALID_TOKEN, OAuthErrorException.INVALID_TOKEN, "Token not active");
+                }
+
+                return tokenMetadata;
+            }
+        } catch (IOException e) {
+            logger.debug("Failed to invoke introspection endpoint", e);
+            throwErrorResponse(event, Errors.INVALID_TOKEN, OAuthErrorException.INVALID_TOKEN, "Failed to invoke introspection endpoint");
+            return null; // Unreachable
+        }
+    }
+
+    private void throwErrorResponse(EventBuilder event, String eventError, String oauthError, String errorDetails) {
+        event.detail(Details.REASON, errorDetails);
+        event.error(eventError);
+        throw new ErrorResponseException(oauthError, errorDetails, Response.Status.BAD_REQUEST);
+    }
+
     protected BrokeredIdentityContext exchangeExternalUserInfoValidationOnly(EventBuilder event, MultivaluedMap<String, String> params) {
         String subjectToken = params.getFirst(OAuth2Constants.SUBJECT_TOKEN);
         if (subjectToken == null) {
@@ -749,5 +895,8 @@ public void exchangeExternalComplete(UserSessionModel userSession, BrokeredIdent
 
     }
 
-
+    @Override
+    public boolean supportsLongStateParameter() {
+        return !getConfig().isRequiresShortStateParameter();
+    }
 }
diff --git a/services/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProvider.java
index b1de891e74f7..139bed7f1246 100755
--- a/services/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProvider.java
@@ -138,7 +138,7 @@ public SimpleHttp generateTokenRequest(String authorizationCode) {
     }
 
     @Override
-    protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, MultivaluedMap<String, String> params) {
+    protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event, MultivaluedMap<String, String> params) {
         String subjectToken = params.getFirst(OAuth2Constants.SUBJECT_TOKEN);
         if (subjectToken == null) {
             event.detail(Details.REASON, OAuth2Constants.SUBJECT_TOKEN + " param unset");
diff --git a/services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java b/services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java
index b1a13b60ae9d..00c659a9663c 100644
--- a/services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java
@@ -21,9 +21,9 @@
 import org.keycloak.OAuth2Constants;
 import org.keycloak.common.enums.SslRequired;
 import org.keycloak.models.IdentityProviderModel;
-import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.IDToken;
 
 import java.util.Arrays;
 
@@ -34,9 +34,13 @@ public class OAuth2IdentityProviderConfig extends IdentityProviderModel {
 
     public static final String PKCE_ENABLED = "pkceEnabled";
     public static final String PKCE_METHOD = "pkceMethod";
+    public static final String TOKEN_ENDPOINT_URL = "tokenUrl";
+    public static final String TOKEN_INTROSPECTION_URL = "tokenIntrospectionUrl";
 
     public static final String JWT_X509_HEADERS_ENABLED = "jwtX509HeadersEnabled";
 
+    public static final String REQUIRES_SHORT_STATE_PARAMETER = "requiresShortStateParameter";
+
     public OAuth2IdentityProviderConfig(IdentityProviderModel model) {
         super(model);
     }
@@ -54,11 +58,11 @@ public void setAuthorizationUrl(String authorizationUrl) {
     }
 
     public String getTokenUrl() {
-        return getConfig().get("tokenUrl");
+        return getConfig().get(TOKEN_ENDPOINT_URL);
     }
 
     public void setTokenUrl(String tokenUrl) {
-        getConfig().put("tokenUrl", tokenUrl);
+        getConfig().put(TOKEN_ENDPOINT_URL, tokenUrl);
     }
 
     public String getUserInfoUrl() {
@@ -69,6 +73,14 @@ public void setUserInfoUrl(String userInfoUrl) {
         getConfig().put("userInfoUrl", userInfoUrl);
     }
 
+    public String getTokenIntrospectionUrl() {
+        return getConfig().get(TOKEN_INTROSPECTION_URL);
+    }
+
+    public void setTokenIntrospectionUrl(String introspectionEndpointUrl) {
+        getConfig().put(TOKEN_INTROSPECTION_URL, introspectionEndpointUrl);
+    }
+
     public String getClientId() {
         return getConfig().get("clientId");
     }
@@ -125,6 +137,14 @@ public String getPrompt() {
         return getConfig().get("prompt");
     }
 
+    public boolean isRequiresShortStateParameter() {
+        return Boolean.parseBoolean(getConfig().get(REQUIRES_SHORT_STATE_PARAMETER));
+    }
+
+    public void setRequiresShortStateParameter(boolean requiresShortStateParameter) {
+        getConfig().put(REQUIRES_SHORT_STATE_PARAMETER, String.valueOf(requiresShortStateParameter));
+    }
+
     public String getForwardParameters() {
         return getConfig().get("forwardParameters");
     }
@@ -178,6 +198,30 @@ public void setJwtX509HeadersEnabled(boolean enabled) {
         getConfig().put(JWT_X509_HEADERS_ENABLED, String.valueOf(enabled));
     }
 
+    public String getUserIDClaim() {
+        return getConfig().getOrDefault("userIDClaim", IDToken.SUBJECT);
+    }
+
+    public String getUserNameClaim() {
+        return getConfig().getOrDefault("userNameClaim", IDToken.PREFERRED_USERNAME);
+    }
+
+    public String getFullNameClaim() {
+        return getConfig().getOrDefault("fullNameClaim", IDToken.NAME);
+    }
+
+    public String getGivenNameClaim() {
+        return getConfig().getOrDefault("givenNameClaim", IDToken.GIVEN_NAME);
+    }
+
+    public String getFamilyNameClaim() {
+        return getConfig().getOrDefault("familyNameClaim", IDToken.FAMILY_NAME);
+    }
+
+    public String getEmailClaim() {
+        return getConfig().getOrDefault("emailClaim", IDToken.EMAIL);
+    }
+
     @Override
     public void validate(RealmModel realm) {
         SslRequired sslRequired = realm.getSslRequired();
@@ -185,7 +229,7 @@ public void validate(RealmModel realm) {
         checkUrl(sslRequired, getAuthorizationUrl(), "authorization_url");
         checkUrl(sslRequired, getTokenUrl(), "token_url");
         checkUrl(sslRequired, getUserInfoUrl(), "userinfo_url");
-
+        checkUrl(sslRequired, getTokenIntrospectionUrl(), "tokenIntrospection_url");
 
         if (isPkceEnabled()) {
             String pkceMethod = getPkceMethod();
diff --git a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
index 9509bf54fd64..84591004987c 100755
--- a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java
@@ -53,6 +53,7 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.JsonWebToken;
@@ -82,7 +83,9 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 
 /**
  * @author Pedro Igor
@@ -240,6 +243,7 @@ protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, Clie
 
                 }
                 model.setToken(response);
+                session.users().updateFederatedIdentity(authorizedClient.getRealm(), tokenSubject, model);
                 tokenResponse = newResponse;
             } else if (exp != null) {
                 tokenResponse.setExpiresIn(exp - currentTime);
@@ -257,6 +261,38 @@ protected Response exchangeStoredToken(UriInfo uriInfo, EventBuilder event, Clie
         }
     }
 
+    @Override
+    protected BrokeredIdentityContext validateExternalTokenThroughUserInfo(EventBuilder event, String subjectToken, String subjectTokenType) {
+        BrokeredIdentityContext context = super.validateExternalTokenThroughUserInfo(event, subjectToken, subjectTokenType);
+
+        if (context != null && (OAuth2Constants.ID_TOKEN_TYPE.equals(subjectTokenType) ||
+            (OAuth2Constants.ACCESS_TOKEN_TYPE.equals(subjectTokenType) && getConfig().isAccessTokenJwt()))) {
+
+            JsonWebToken parsedToken;
+            try {
+                parsedToken = validateToken(subjectToken, true);
+            } catch (IdentityBrokerException e) {
+                logger.debug("Unable to validate token for exchange", e);
+                event.detail(Details.REASON, "token validation failure");
+                event.error(Errors.INVALID_TOKEN);
+                throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "invalid token", Response.Status.BAD_REQUEST);
+            }
+
+            boolean idTokenType = OAuth2Constants.ID_TOKEN_TYPE.equals(subjectTokenType);
+
+            if (idTokenType) {
+                context.getContextData().put(VALIDATED_ID_TOKEN, parsedToken);
+            } else {
+                context.getContextData().put(KeycloakOIDCIdentityProvider.VALIDATED_ACCESS_TOKEN, parsedToken);
+            }
+            context.getContextData().put(EXCHANGE_PROVIDER, getConfig().getAlias());
+            context.setIdp(this);
+            return context;
+        }
+
+        return context;
+    }
+
     protected void processAccessTokenResponse(BrokeredIdentityContext context, AccessTokenResponse response) {
         // Don't verify audience on accessToken as it may not be there. It was verified on IDToken already
         if (getConfig().isAccessTokenJwt()) {
@@ -395,7 +431,7 @@ public BrokeredIdentityContext getFederatedIdentity(String response) {
 
         try {
             BrokeredIdentityContext identity = extractIdentity(tokenResponse, accessToken, idToken);
-            
+
             if (!identity.getId().equals(idToken.getSubject())) {
                 throw new IdentityBrokerException("Mismatch between the subject in the id_token and the subject from the user_info endpoint");
             }
@@ -429,7 +465,7 @@ public BrokeredIdentityContext getFederatedIdentity(String response) {
             if (!getConfig().isDisableNonce()) {
                 identity.getContextData().put(BROKER_NONCE_PARAM, idToken.getOtherClaims().get(OIDCLoginProtocol.NONCE_PARAM));
             }
-            
+
             if (getConfig().isStoreToken()) {
                 if (tokenResponse.getExpiresIn() > 0) {
                     long accessTokenExpiration = Time.currentTime() + tokenResponse.getExpiresIn();
@@ -547,7 +583,7 @@ protected BrokeredIdentityContext extractIdentity(AccessTokenResponse tokenRespo
         }
         if (tokenResponse != null) identity.getContextData().put(FEDERATED_ACCESS_TOKEN_RESPONSE, tokenResponse);
         if (tokenResponse != null) processAccessTokenResponse(identity, tokenResponse);
-        
+
         return identity;
     }
 
@@ -708,7 +744,7 @@ protected JsonWebToken validateToken(String encodedToken, boolean ignoreAudience
         if (!ignoreAudience && !token.hasAudience(getConfig().getClientId())) {
             throw new IdentityBrokerException("Wrong audience from token.");
         }
-        
+
         if (!ignoreAudience && (token.getIssuedFor() != null && !getConfig().getClientId().equals(token.getIssuedFor()))) {
             throw new IdentityBrokerException("Token issued for does not match client id");
         }
@@ -752,7 +788,7 @@ public boolean isIssuer(String issuer, MultivaluedMap<String, String> params) {
         String requestedIssuer = params == null ? null : params.getFirst(OAuth2Constants.SUBJECT_ISSUER);
         if (requestedIssuer == null) requestedIssuer = issuer;
         if (requestedIssuer.equals(getConfig().getAlias())) return true;
-        
+
         String trustedIssuers = getConfig().getIssuer();
 
         if (trustedIssuers != null && trustedIssuers.length() > 0) {
@@ -764,7 +800,7 @@ public boolean isIssuer(String issuer, MultivaluedMap<String, String> params) {
                 }
             }
         }
-        
+
         return false;
     }
 
@@ -803,19 +839,19 @@ protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
         AbstractJsonUserAttributeMapper.storeUserProfileForMapper(identity, userInfo, getConfig().getAlias());
 
         identity.setId(id);
-        
+
         if (givenName != null) {
             identity.setFirstName(givenName);
         }
-        
+
         if (familyName != null) {
             identity.setLastName(familyName);
         }
-        
+
         if (givenName == null && familyName == null) {
             identity.setName(name);
         }
-        
+
         identity.setEmail(email);
 
         identity.setBrokerUserId(getConfig().getAlias() + "." + id);
@@ -864,7 +900,7 @@ final protected BrokeredIdentityContext validateJwt(EventBuilder event, String s
         }
 
         try {
-            if (!isTokenTypeSupported(parsedToken)) {
+            if (!getConfig().isDisableTypeClaimCheck() && !isTokenTypeSupported(parsedToken)) {
                 throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "token type not supported", Response.Status.BAD_REQUEST);
             }
             boolean idTokenType = OAuth2Constants.ID_TOKEN_TYPE.equals(subjectTokenType);
@@ -898,7 +934,7 @@ protected boolean isTokenTypeSupported(JsonWebToken parsedToken) {
     }
 
     @Override
-    protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, MultivaluedMap<String, String> params) {
+    protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event, MultivaluedMap<String, String> params) {
         if (!supportsExternalExchange()) return null;
         String subjectToken = params.getFirst(OAuth2Constants.SUBJECT_TOKEN);
         if (subjectToken == null) {
@@ -921,6 +957,14 @@ protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, Multi
         }
     }
 
+    @Override
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        // Supporting only introspection-endpoint validation for now
+        validateExternalTokenWithIntrospectionEndpoint(tokenExchangeContext);
+
+        return exchangeExternalUserInfoValidationOnly(tokenExchangeContext.getEvent(), tokenExchangeContext.getFormParams());
+    }
+
     @Override
     protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
         UriBuilder uriBuilder = super.createAuthorizationUrl(request);
@@ -944,7 +988,7 @@ protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
     @Override
     public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, BrokeredIdentityContext context) {
         AuthenticationSessionModel authenticationSession = session.getContext().getAuthenticationSession();
-        
+
         if (authenticationSession == null || getConfig().isDisableNonce()) {
             // no interacting with the brokered OP, likely doing token exchanges or no nonce
             return;
@@ -972,4 +1016,29 @@ public boolean reloadKeys() {
         }
         return false;
     }
+
+    @Override
+    protected void setEmailVerified(UserModel user, BrokeredIdentityContext context) {
+        OIDCIdentityProviderConfig config = getConfig();
+        Map<String, Object> contextData = context.getContextData();
+        JsonWebToken token = (JsonWebToken) Optional.ofNullable(contextData.get(VALIDATED_ID_TOKEN))
+                .orElseGet(() -> contextData.get(VALIDATED_ACCESS_TOKEN));
+        Boolean emailVerified = getEmailVerifiedClaim(token);
+
+        if (!config.isTrustEmail() || emailVerified == null) {
+            // fallback to the default behavior if trust is disabled or there is no email_verified claim
+            super.setEmailVerified(user, context);
+            return;
+        }
+
+        user.setEmailVerified(emailVerified);
+    }
+
+    private Boolean getEmailVerifiedClaim(JsonWebToken token) {
+        if (token == null) {
+            return null;
+        }
+
+        return (Boolean) token.getOtherClaims().get(IDToken.EMAIL_VERIFIED);
+    }
 }
diff --git a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java
index 3ddc7ecd422d..090875195b37 100755
--- a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java
@@ -168,6 +168,18 @@ public int getAllowedClockSkew() {
         }
     }
 
+    public boolean isDisableTypeClaimCheck() {
+        return Boolean.parseBoolean(getConfig().get("disableTypeClaimCheck"));
+    }
+
+    public void setDisableTypeClaimCheck(boolean disableTypeClaimCheck) {
+        if (disableTypeClaimCheck) {
+            getConfig().put("disableTypeClaimCheck", Boolean.TRUE.toString());
+        } else {
+            getConfig().remove("disableTypeClaimCheck");
+        }
+    }
+
     @Override
     public void validate(RealmModel realm) {
         super.validate(realm);
diff --git a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderFactory.java b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderFactory.java
index f11fad4c6e1e..e6b32bc3964f 100755
--- a/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderFactory.java
+++ b/services/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderFactory.java
@@ -75,6 +75,12 @@ protected static Map<String, String> parseOIDCConfig(KeycloakSession session, St
             config.setUseJwksUrl(true);
             config.setJwksUrl(rep.getJwksUri());
         }
+
+        // Introspection URL may or may not be available in the configuration. It is available in RFC8414 , but not in the OIDC discovery specification.
+        // Hence some servers may not add it to their well-known responses
+        if (rep.getIntrospectionEndpoint() != null) {
+            config.setTokenIntrospectionUrl(rep.getIntrospectionEndpoint());
+        }
         return config.getConfig();
     }
 
diff --git a/services/src/main/java/org/keycloak/broker/provider/IdpLinkAction.java b/services/src/main/java/org/keycloak/broker/provider/IdpLinkAction.java
new file mode 100644
index 000000000000..4c9060a32a08
--- /dev/null
+++ b/services/src/main/java/org/keycloak/broker/provider/IdpLinkAction.java
@@ -0,0 +1,229 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.broker.provider;
+
+import java.io.IOException;
+import java.util.Collections;
+
+import jakarta.ws.rs.core.Response;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.authentication.InitiatedActionSupport;
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.authentication.RequiredActionFactory;
+import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.events.EventType;
+import org.keycloak.forms.login.LoginFormsProvider;
+import org.keycloak.models.AccountRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.FormMessage;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.managers.ClientSessionCode;
+import org.keycloak.services.resources.IdentityBrokerService;
+import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.util.JsonSerialization;
+
+import static org.keycloak.services.resources.IdentityBrokerService.LINKING_IDENTITY_PROVIDER;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class IdpLinkAction implements RequiredActionProvider, RequiredActionFactory {
+
+    protected static final Logger logger = Logger.getLogger(IdpLinkAction.class);
+
+    public static final String PROVIDER_ID = "idp_link";
+
+    // Authentication session note indicating that client-initiated account linking was triggered from this action
+    public static final String KC_ACTION_LINKING_IDENTITY_PROVIDER = "kc_action_linking_identity_provider";
+
+    // Authentication session notes with the status of IDP linking and with the error from IDP linking (idp_link_error filled just in case that status is "error")
+    public static final String IDP_LINK_STATUS = "idp_link_status";
+    public static final String IDP_LINK_ERROR = "idp_link_error";
+
+    @Override
+    public RequiredActionProvider create(KeycloakSession session) {
+        return this;
+    }
+
+    @Override
+    public InitiatedActionSupport initiatedActionSupport() {
+        return InitiatedActionSupport.SUPPORTED;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+
+    @Override
+    public void evaluateTriggers(RequiredActionContext context) {
+
+    }
+
+    @Override
+    public void requiredActionChallenge(RequiredActionContext context) {
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+        UserModel user = context.getUser();
+        ClientModel client = authSession.getClient();
+        EventBuilder event = context.getEvent().clone();
+        event.event(EventType.FEDERATED_IDENTITY_LINK);
+
+        String identityProviderAlias = authSession.getClientNote(Constants.KC_ACTION_PARAMETER);
+        if (identityProviderAlias == null) {
+            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
+            context.ignore();
+            return;
+        }
+        event.detail(Details.IDENTITY_PROVIDER, identityProviderAlias);
+        IdentityProviderModel identityProviderModel = session.identityProviders().getByAlias(identityProviderAlias);
+        if (identityProviderModel == null) {
+            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
+            context.ignore();
+            return;
+        }
+
+        // Check role
+        ClientModel accountService = realm.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID);
+        RoleModel manageAccountRole = accountService.getRole(AccountRoles.MANAGE_ACCOUNT);
+        if (!user.hasRole(manageAccountRole) || !client.hasScope(manageAccountRole)) {
+            RoleModel linkRole = accountService.getRole(AccountRoles.MANAGE_ACCOUNT_LINKS);
+            if (!user.hasRole(linkRole) || !client.hasScope(linkRole)) {
+                event.error(Errors.NOT_ALLOWED);
+                context.ignore();
+                return;
+            }
+        }
+
+        String idpDisplayName = KeycloakModelUtils.getIdentityProviderDisplayName(session, identityProviderModel);
+        Response challenge = context.form()
+                .setAttribute("idpDisplayName", idpDisplayName)
+                .createForm("link-idp-action.ftl");
+        context.challenge(challenge);
+    }
+
+    @Override
+    public void processAction(RequiredActionContext context) {
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+        ClientModel client = authSession.getClient();
+
+        if (!Boolean.parseBoolean(authSession.getAuthNote(IdpLinkAction.KC_ACTION_LINKING_IDENTITY_PROVIDER))) {
+            // User confirmed IDP linking. We can redirect to IDP
+            String identityProviderAlias = authSession.getClientNote(Constants.KC_ACTION_PARAMETER);
+
+            ClientSessionCode<AuthenticationSessionModel> clientSessionCode = new ClientSessionCode<>(session, realm, authSession);
+            clientSessionCode.setAction(AuthenticationSessionModel.Action.AUTHENTICATE.name());
+            String noteValue = authSession.getParentSession().getId() + client.getClientId() + identityProviderAlias;
+            authSession.setAuthNote(LINKING_IDENTITY_PROVIDER, noteValue);
+            authSession.setAuthNote(KC_ACTION_LINKING_IDENTITY_PROVIDER, "true");
+
+            IdentityBrokerService brokerService = new IdentityBrokerService(session);
+            Response response = brokerService.performClientInitiatedAccountLogin(identityProviderAlias, clientSessionCode);
+            context.challenge(response);
+        } else {
+            // User already authenticated with IDP
+            EventBuilder event = context.getEvent();
+            event.event(EventType.FEDERATED_IDENTITY_LINK);
+
+            // Status is supposed to be set by IdentityBrokerService
+            String statusNote = authSession.getAuthNote(IdpLinkAction.IDP_LINK_STATUS);
+            if (statusNote == null) {
+                removeAuthNotes(authSession);
+                logger.warn("Not found IDP_LINK_STATUS even if redirect to IDP was already triggered");
+                context.failure(Errors.INVALID_REQUEST);
+                return;
+            }
+            RequiredActionContext.KcActionStatus status = RequiredActionContext.KcActionStatus.valueOf(statusNote);
+            switch (status) {
+                case SUCCESS:
+                    context.success();
+                    break;
+                case CANCELLED:
+                    context.cancel();
+                    break;
+                case ERROR:
+                    String error = authSession.getAuthNote(IDP_LINK_ERROR);
+                    errorPage(context, error);
+                    break;
+                default:
+                    throw new IllegalStateException("Unknown status in the note idp_link_status: " + status);
+            }
+            removeAuthNotes(authSession);
+        }
+    }
+
+    private void removeAuthNotes(AuthenticationSessionModel authSession) {
+        authSession.removeAuthNote(IdpLinkAction.KC_ACTION_LINKING_IDENTITY_PROVIDER);
+        authSession.removeAuthNote(IdpLinkAction.IDP_LINK_STATUS);
+        authSession.removeAuthNote(IdpLinkAction.IDP_LINK_ERROR);
+    }
+
+    private void errorPage(RequiredActionContext context, String serializedError) {
+        FormMessage formMessage;
+        try {
+            formMessage = JsonSerialization.readValue(serializedError, FormMessage.class);
+        } catch (IOException ioe) {
+            throw new RuntimeException("Unexpected error when deserialization of error: " + serializedError);
+        }
+        Response response = context.getSession().getProvider(LoginFormsProvider.class)
+                .setAuthenticationSession(context.getAuthenticationSession())
+                .setUser(context.getUser())
+                .setErrors(Collections.singletonList(formMessage))
+                .createErrorPage(Response.Status.BAD_REQUEST);
+        context.getEvent().error(formMessage.getMessage());
+        context.challenge(response);
+    }
+
+    @Override
+    public String getDisplayText() {
+        return "Linking Identity Provider";
+    }
+
+    @Override
+    public void close() {
+
+    }
+}
diff --git a/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java b/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java
index c547271719e9..b351e4126587 100755
--- a/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java
+++ b/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java
@@ -63,12 +63,11 @@
 import org.keycloak.saml.common.constants.JBossSAMLConstants;
 import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
 import org.keycloak.saml.common.exceptions.ConfigurationException;
-import org.keycloak.saml.common.exceptions.ParsingException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
 import org.keycloak.saml.common.util.DocumentUtil;
-import org.keycloak.saml.processing.api.saml.v2.request.SAML2Request;
 import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
 import org.keycloak.saml.processing.core.saml.v2.constants.X500SAMLProfileConstants;
+import org.keycloak.saml.processing.core.saml.v2.util.ArtifactResponseUtil;
 import org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil;
 import org.keycloak.saml.processing.core.util.XMLEncryptionUtil;
 import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
@@ -121,7 +120,6 @@
 import org.keycloak.services.util.CacheControlUtil;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.utils.StringUtil;
-import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
 
@@ -471,15 +469,28 @@ protected Response handleSamlArt(String samlArt, String relayState, String clien
                     return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.INVALID_REQUEST);
                 }
 
+                // extract the SAML Response from the original SAML ArtifactResponse
+                Optional<String>  optionalEmbeddedResponseAsString = ArtifactResponseUtil.convertResponseToString(
+                        samlDocumentHolder.getSamlDocument()
+                );
+
+                // leave early if the embedded Response cannot be converted to string
+                if(optionalEmbeddedResponseAsString.isEmpty()) {
+                    logger.error("artifact binding failed: the embedded Response cannot be converted to string");
+                    event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
+                    event.detail(Details.REASON, Errors.INVALID_SAML_ARTIFACT_RESPONSE);
+                    event.error(Errors.INVALID_REQUEST);
+                    return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, Messages.INVALID_REQUEST);
+                }
+
                 // convert the embedded SAML response to a base64 serialized string
-                Document embeddedResponseAsDoc = SAML2Request.convert(embeddedResponse);
-                String embeddedResponseAsString = DocumentUtil.getDocumentAsString(embeddedResponseAsDoc);
+                String embeddedResponseAsString = optionalEmbeddedResponseAsString.get();
                 logger.debugf("embeddedResponseAsString %s", embeddedResponseAsString);
                 String embeddedResponseAsBase64 =  PostBindingUtil.base64Encode(embeddedResponseAsString);
 
                 // continue the flow with POST binding
                 return execute(null, embeddedResponseAsBase64, null, relayState, clientId);
-            } catch (IOException | ConfigurationException | ProcessingException | ParsingException e) {
+            } catch (IOException e) {
                 logger.error("artifact binding failed", e);
                 event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
                 event.detail(Details.REASON, Errors.INVALID_SAML_ARTIFACT_RESPONSE);
@@ -531,11 +542,11 @@ protected Response handleLoginResponse(String samlResponse, SAMLDocumentHolder h
                     if (Constants.AUTHENTICATION_EXPIRED_MESSAGE.equals(statusMessage)) {
                         return callback.retryLogin(provider, authSession);
                     } else {
-                        return callback.error(statusMessage);
+                        return callback.error(config, statusMessage);
                     }
                 }
                 if (responseType.getAssertions() == null || responseType.getAssertions().isEmpty()) {
-                    return callback.error(Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+                    return callback.error(config, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
                 }
 
                 boolean assertionIsEncrypted = AssertionUtil.isAssertionEncrypted(responseType);
@@ -594,11 +605,11 @@ protected Response handleLoginResponse(String samlResponse, SAMLDocumentHolder h
                 final boolean signatureNotValid = signed && config.isValidateSignature() && !AssertionUtil.isSignatureValid(assertionElement, getIDPKeyLocator());
                 final boolean hasNoSignatureWhenRequired = ! signed && config.isValidateSignature() && ! containsUnencryptedSignature(holder);
 
-                if (!isArtifactBinding && (assertionSignatureNotExistsWhenRequired || signatureNotValid || hasNoSignatureWhenRequired)) {
+                if (assertionSignatureNotExistsWhenRequired || signatureNotValid || hasNoSignatureWhenRequired) {
                     logger.error("validation failed");
                     event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
                     event.error(Errors.INVALID_SIGNATURE);
-                    return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.INVALID_REQUESTER);
+                    return ErrorPage.error(session, authSession, Response.Status.BAD_REQUEST, Messages.IDENTITY_PROVIDER_INVALID_SIGNATURE);
                 }
 
                 if (AssertionUtil.isIdEncrypted(responseType)) {
@@ -892,24 +903,40 @@ protected String getBindingType() {
     }
 
     protected class ArtifactBinding extends Binding {
+
+        private boolean unencryptedSignaturesVerified = false;
+
         @Override
         protected boolean containsUnencryptedSignature(SAMLDocumentHolder documentHolder) {
+            if (unencryptedSignaturesVerified) {
+                return true;
+            }
             NodeList nl = documentHolder.getSamlDocument().getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
             return (nl != null && nl.getLength() > 0);
         }
 
         @Override
         protected void verifySignature(String key, SAMLDocumentHolder documentHolder) throws VerificationException {
-            if ((! containsUnencryptedSignature(documentHolder)) && (documentHolder.getSamlObject() instanceof ResponseType)) {
-                ResponseType responseType = (ResponseType) documentHolder.getSamlObject();
-                List<ResponseType.RTChoiceType> assertions = responseType.getAssertions();
-                if (! assertions.isEmpty() ) {
+            if (unencryptedSignaturesVerified) {
+                // this is the second pass and signatures were already verified in the artifact response time
+                return;
+            }
+            if (!containsUnencryptedSignature(documentHolder)) {
+                List<ResponseType.RTChoiceType> assertions = null;
+                if (documentHolder.getSamlObject() instanceof ResponseType responseType) {
+                    assertions = responseType.getAssertions();
+                } else if (documentHolder.getSamlObject() instanceof ArtifactResponseType artifactResponseType
+                        && artifactResponseType.getAny() instanceof ResponseType responseType) {
+                    assertions = responseType.getAssertions();
+                }
+                if (assertions != null && !assertions.isEmpty() ) {
                     // Only relax verification if the response is an authnresponse and contains (encrypted/plaintext) assertion.
                     // In that case, signature is validated on assertion element
                     return;
                 }
             }
             SamlProtocolUtils.verifyDocumentSignature(documentHolder.getSamlDocument(), getIDPKeyLocator());
+            unencryptedSignaturesVerified = true; // mark signatures as verified
         }
 
         @Override
diff --git a/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java b/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java
index 0407f812d0e8..74961b469e48 100755
--- a/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java
@@ -29,11 +29,13 @@
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.KeyWrapper;
 import org.keycloak.dom.saml.v2.assertion.AssertionType;
 import org.keycloak.dom.saml.v2.assertion.AuthnStatementType;
 import org.keycloak.dom.saml.v2.assertion.NameIDType;
 import org.keycloak.dom.saml.v2.assertion.SubjectType;
 import org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType;
+import org.keycloak.dom.saml.v2.metadata.EndpointType;
 import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
 import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
 import org.keycloak.dom.saml.v2.metadata.KeyTypes;
@@ -75,13 +77,10 @@
 import org.keycloak.saml.common.exceptions.ConfigurationException;
 import org.keycloak.saml.common.exceptions.ParsingException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
-import org.keycloak.saml.common.util.DocumentUtil;
-import org.keycloak.saml.common.util.StaxUtil;
 import org.keycloak.saml.processing.api.saml.v2.request.SAML2Request;
 import org.keycloak.saml.processing.api.saml.v2.response.SAML2Response;
-import org.keycloak.saml.processing.api.saml.v2.sig.SAML2Signature;
 import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
-import org.keycloak.saml.processing.core.saml.v2.writers.SAMLMetadataWriter;
+import org.keycloak.saml.processing.core.saml.v2.util.SAMLMetadataUtil;
 import org.keycloak.saml.processing.core.util.KeycloakKeySamlExtensionGenerator;
 import org.keycloak.saml.validators.DestinationValidator;
 import org.keycloak.sessions.AuthenticationSessionModel;
@@ -89,19 +88,15 @@
 
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
-import org.w3c.dom.Node;
 
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
-import javax.xml.crypto.dsig.CanonicalizationMethod;
 import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.stream.XMLStreamWriter;
-
-import java.io.StringWriter;
 import java.net.URI;
 import java.security.KeyPair;
+import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -363,17 +358,6 @@ private JaxrsSAML2BindingBuilder buildLogoutBinding(KeycloakSession session, Use
     public Response export(UriInfo uriInfo, RealmModel realm, String format) {
         try
         {
-            URI authnResponseBinding = JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri();
-
-            if (getConfig().isPostBindingAuthnRequest()) {
-                authnResponseBinding = JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri();
-            }
-
-            URI logoutBinding = JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri();
-
-            if (getConfig().isPostBindingLogout()) {
-                logoutBinding = JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri();
-            }
             URI endpoint = uriInfo.getBaseUriBuilder()
                     .path("realms").path(realm.getName())
                     .path("broker")
@@ -381,6 +365,20 @@ public Response export(UriInfo uriInfo, RealmModel realm, String format) {
                     .path("endpoint")
                     .build();
 
+            List<EndpointType> assertionConsumerServices = getConfig().isPostBindingAuthnRequest()
+                    ? List.of(new EndpointType(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.getUri(), endpoint))
+                    : List.of(new EndpointType(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.getUri(), endpoint));
+
+            List<EndpointType> singleLogoutServices = getConfig().isPostBindingLogout()
+                    ? List.of(new EndpointType(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(), endpoint))
+                    : List.of(new EndpointType(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(), endpoint),
+                            new EndpointType(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(), endpoint));
+
             boolean wantAuthnRequestsSigned = getConfig().isWantAuthnRequestsSigned();
             boolean wantAssertionsSigned = getConfig().isWantAssertionsSigned();
             boolean wantAssertionsEncrypted = getConfig().isWantAssertionsEncrypted();
@@ -424,13 +422,8 @@ public Response export(UriInfo uriInfo, RealmModel realm, String format) {
                     })
                     .collect(Collectors.toList());
 
-            // Prepare the metadata descriptor model
-            StringWriter sw = new StringWriter();
-            XMLStreamWriter writer = StaxUtil.getXMLStreamWriter(sw);
-            SAMLMetadataWriter metadataWriter = new SAMLMetadataWriter(writer);
-
             EntityDescriptorType entityDescriptor = SPMetadataDescriptor.buildSPDescriptor(
-                authnResponseBinding, logoutBinding, endpoint, endpoint,
+                assertionConsumerServices, singleLogoutServices,
                 wantAuthnRequestsSigned, wantAssertionsSigned, wantAssertionsEncrypted,
                 entityId, nameIDPolicyFormat, signingKeys, encryptionKeys);
 
@@ -472,31 +465,18 @@ public Response export(UriInfo uriInfo, RealmModel realm, String format) {
                 });
             }
 
-            // Write the metadata and export it to a string
-            metadataWriter.writeEntityDescriptor(entityDescriptor);
-
-            String descriptor = sw.toString();
+            String descriptor;
 
             // Metadata signing
-            if (getConfig().isSignSpMetadata())
-            {
-                KeyManager.ActiveRsaKey activeKey = session.keys().getActiveRsaKey(realm);
-                X509Certificate certificate = activeKey.getCertificate();
-                String keyName = getConfig().getXmlSigKeyInfoKeyNameTransformer().getKeyName(activeKey.getKid(), certificate);
-                KeyPair keyPair = new KeyPair(activeKey.getPublicKey(), activeKey.getPrivateKey());
-
-                Document metadataDocument = DocumentUtil.getDocument(descriptor);
-                SAML2Signature signatureHelper = new SAML2Signature();
-                signatureHelper.setSignatureMethod(getSignatureAlgorithm().getXmlSignatureMethod());
-                signatureHelper.setDigestMethod(getSignatureAlgorithm().getXmlSignatureDigestMethod());
-                signatureHelper.setX509Certificate(certificate);
+            if (getConfig().isSignSpMetadata()) {
+                KeyWrapper keyWrapper = session.keys().getActiveKey(realm, KeyUse.SIG, Algorithm.RS256);
+                X509Certificate certificate = keyWrapper.getCertificate();
+                String keyName = getConfig().getXmlSigKeyInfoKeyNameTransformer().getKeyName(keyWrapper.getKid(), certificate);
+                KeyPair keyPair = new KeyPair(certificate.getPublicKey(), (PrivateKey) keyWrapper.getPrivateKey());;
 
-                Node nextSibling = metadataDocument.getDocumentElement().getFirstChild();
-                signatureHelper.setNextSibling(nextSibling);
-
-                signatureHelper.signSAMLDocument(metadataDocument, keyName, keyPair, CanonicalizationMethod.EXCLUSIVE);
-
-                descriptor = DocumentUtil.getDocumentAsString(metadataDocument);
+                descriptor = SAMLMetadataUtil.signEntityDescriptorType(entityDescriptor, getSignatureAlgorithm(), keyName, certificate, keyPair);
+            } else {
+                descriptor = SAMLMetadataUtil.writeEntityDescriptorType(entityDescriptor);
             }
 
             return Response.ok(descriptor, MediaType.APPLICATION_XML_TYPE).build();
diff --git a/services/src/main/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProvider.java b/services/src/main/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProvider.java
new file mode 100644
index 000000000000..ecf032b42d22
--- /dev/null
+++ b/services/src/main/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProvider.java
@@ -0,0 +1,76 @@
+package org.keycloak.compatibility;
+
+import java.util.Map;
+
+import org.keycloak.common.Profile;
+import org.keycloak.common.Version;
+import org.keycloak.migration.ModelVersion;
+
+/**
+ * A {@link CompatibilityMetadataProvider} implementation to provide the Keycloak version.
+ */
+public class KeycloakCompatibilityMetadataProvider implements CompatibilityMetadataProvider {
+
+    public static final String ID = "keycloak";
+    public static final String VERSION_KEY = "version";
+    private final String version;
+
+    public KeycloakCompatibilityMetadataProvider() {
+        this(Version.VERSION);
+    }
+
+    public KeycloakCompatibilityMetadataProvider(String version) {
+        this.version = version;
+    }
+
+    @Override
+    public Map<String, String> metadata() {
+        return Map.of(VERSION_KEY, version);
+    }
+
+    @Override
+    public CompatibilityResult isCompatible(Map<String, String> other) {
+        CompatibilityResult equalComparison = CompatibilityMetadataProvider.super.isCompatible(other);
+
+        // If V2 feature is enabled, we consider versions upgradable in a rolling way if the other is a previous micro release
+        if (!Util.isNotCompatible(equalComparison) || !Profile.isFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V2)) {
+            return equalComparison;
+        }
+
+
+        // We need to make sure the previous version is not null
+        String otherVersion = other.get(VERSION_KEY);
+        if (otherVersion == null)
+            return equalComparison;
+
+        // Check if only version attribute is incompatible we don't want to allow rolling update if some other metadata didn't match
+        boolean versionMismatch = equalComparison.incompatibleAttributes()
+                .map(erroredAttributes -> erroredAttributes.size() == 1 && erroredAttributes.iterator().next().equals(VERSION_KEY))
+                .orElse(false);
+
+        if (!versionMismatch) {
+            return equalComparison;
+        }
+
+        ModelVersion otherModelVersion = new ModelVersion(otherVersion);
+        ModelVersion currentModelVersion = new ModelVersion(version);
+
+        // Check we are in the same major.minor release stream
+        if (!currentModelVersion.hasSameMajorMinor(otherModelVersion)) {
+            return equalComparison;
+        }
+
+        int otherMicro = otherModelVersion.getMicro();
+        int currentMicro = currentModelVersion.getMicro();
+
+        // Make sure we are updating to a newer or the same micro release and do not allow rolling rollback
+        return currentMicro < otherMicro ?
+                equalComparison :
+                CompatibilityResult.providerCompatible(ID);
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java b/services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java
index 2f3925633b82..6c87b731bac7 100755
--- a/services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java
+++ b/services/src/main/java/org/keycloak/connections/httpclient/DefaultHttpClientFactory.java
@@ -176,7 +176,6 @@ private void lazyInit(KeycloakSession session) {
                     int maxPooledPerRoute = config.getInt("max-pooled-per-route", 64);
                     int connectionPoolSize = config.getInt("connection-pool-size", 128);
                     long connectionTTL = config.getLong("connection-ttl-millis", -1L);
-                    boolean reuseConnections = config.getBoolean("reuse-connections", true);
                     long maxConnectionIdleTime = config.getLong("max-connection-idle-time-millis", 900000L);
                     boolean disableCookies = config.getBoolean("disable-cookies", true);
                     String clientKeystore = config.get("client-keystore");
@@ -185,7 +184,7 @@ private void lazyInit(KeycloakSession session) {
                     boolean disableTrustManager = config.getBoolean("disable-trust-manager", false);
 
                     boolean expectContinueEnabled = getBooleanConfigWithSysPropFallback("expect-continue-enabled", false);
-                    boolean resuseConnections = getBooleanConfigWithSysPropFallback("reuse-connections", true);
+                    boolean reuseConnections = getBooleanConfigWithSysPropFallback("reuse-connections", true);
 
                     // optionally configure proxy mappings
                     // direct SPI config (e.g. via standalone.xml) takes precedence over env vars
@@ -209,13 +208,12 @@ private void lazyInit(KeycloakSession session) {
                             .establishConnectionTimeout(establishConnectionTimeout, TimeUnit.MILLISECONDS)
                             .maxPooledPerRoute(maxPooledPerRoute)
                             .connectionPoolSize(connectionPoolSize)
-                            .reuseConnections(reuseConnections)
                             .connectionTTL(connectionTTL, TimeUnit.MILLISECONDS)
                             .maxConnectionIdleTime(maxConnectionIdleTime, TimeUnit.MILLISECONDS)
                             .disableCookies(disableCookies)
                             .proxyMappings(proxyMappings)
                             .expectContinueEnabled(expectContinueEnabled)
-                            .reuseConnections(resuseConnections);
+                            .reuseConnections(reuseConnections);
 
                     TruststoreProvider truststoreProvider = session.getProvider(TruststoreProvider.class);
                     boolean disableTruststoreProvider = truststoreProvider == null || truststoreProvider.getTruststore() == null;
@@ -366,4 +364,8 @@ private String getEnvVarValue(String name) {
         return value;
     }
 
+    // For testing purposes
+    public Config.Scope getConfig() {
+        return config;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java b/services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java
index 33b58a0d3aac..98e03de52fe7 100755
--- a/services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java
+++ b/services/src/main/java/org/keycloak/connections/httpclient/HttpClientBuilder.java
@@ -274,10 +274,6 @@ public CloseableHttpClient build() {
 
             if (disableCookies) builder.disableCookieManagement();
 
-            if (!reuseConnections) {
-                builder.setConnectionReuseStrategy(new NoConnectionReuseStrategy());
-            }
-
             return builder.build();
         } catch (Exception e) {
             throw new RuntimeException(e);
diff --git a/services/src/main/java/org/keycloak/cookie/DefaultCookieProvider.java b/services/src/main/java/org/keycloak/cookie/DefaultCookieProvider.java
index 051b5efa0a37..a09c89aa7a27 100644
--- a/services/src/main/java/org/keycloak/cookie/DefaultCookieProvider.java
+++ b/services/src/main/java/org/keycloak/cookie/DefaultCookieProvider.java
@@ -18,6 +18,7 @@ public class DefaultCookieProvider implements CookieProvider {
     private final CookiePathResolver pathResolver;
 
     private final boolean secure;
+    private boolean warned;
 
     private final Map<String, Cookie> cookies;
 
@@ -33,10 +34,6 @@ public DefaultCookieProvider(KeycloakSession session) {
             logger.tracef("Received cookies: %s, path: %s", String.join(", ", this.cookies.keySet()), context.getUri().getRequestUri().getRawPath());
         }
 
-        if (!secure) {
-            logger.warnf("Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests");
-        }
-
         expireOldUnusedCookies();
     }
 
@@ -73,6 +70,32 @@ public void set(CookieType cookieType, String value, int maxAge) {
         session.getContext().getHttpResponse().setCookieIfAbsent(newCookie);
 
         logger.tracef("Setting cookie: name: %s, path: %s, same-site: %s, secure: %s, http-only: %s, max-age: %d", name, path, sameSite, secure, httpOnly, maxAge);
+
+        if (!secure && !warned) {
+            warned = true;
+
+            StringBuilder warning = new StringBuilder("Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests.");
+
+            String forwarded = session.getContext().getRequestHeaders().getHeaderString("Forwarded");
+            String xForwarded = session.getContext().getRequestHeaders().getHeaderString("X-Forwarded-Proto");
+
+            // if we are getting here then:
+            //   if passthrough or reencrypt, proxy-headers may be misconfigured
+            //   if edge, then proxy-headers should be set (there's hostname validation for this) but they are not set by the proxy server
+            //   not proxied, and not https (there's hostname validation for this)
+
+            if (forwarded != null || xForwarded != null) {
+                if (session.getContext().getHttpRequest().isProxyTrusted()) {
+                    warning.append(" Please review your proxy settings as the request appears to have originated from a proxy.");
+                } else {
+                    warning.append(" This is likely due to the proxy not being trusted.");
+                }
+            } else {
+                warning.append(" Please review whether this direct HTTP usage is expected.");
+            }
+
+            logger.warnf(warning.toString());
+        }
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java b/services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java
index f5c3ac62836a..be34460db0ef 100644
--- a/services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java
+++ b/services/src/main/java/org/keycloak/credential/OTPCredentialProvider.java
@@ -16,6 +16,8 @@
  */
 package org.keycloak.credential;
 
+import java.util.List;
+
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.common.util.Time;
@@ -64,7 +66,7 @@ public OTPCredentialModel getCredentialFromModel(CredentialModel model) {
 
     @Override
     public boolean supportsCredentialType(String credentialType) {
-        return getType().equals(credentialType);
+        return List.of(OTPCredentialModel.TYPE, OTPCredentialModel.TOTP, OTPCredentialModel.HOTP).contains(credentialType);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java b/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
index 36b4ccdb25d0..fe31a83fdd5d 100644
--- a/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
+++ b/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
@@ -22,6 +22,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.Time;
 import org.keycloak.credential.hash.PasswordHashProvider;
+import org.keycloak.models.AbstractKeycloakTransaction;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.PasswordPolicy;
@@ -29,6 +30,7 @@
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.policy.PasswordPolicyManagerProvider;
 import org.keycloak.policy.PolicyError;
 
@@ -279,13 +281,43 @@ private void rehashPasswordIfRequired(KeycloakSession session, RealmModel realm,
         }
 
         if (!provider.policyCheck(passwordPolicy, password)) {
-            int iterations = passwordPolicy != null ? passwordPolicy.getHashIterations() : -1;
+            final int iterations = passwordPolicy != null ? passwordPolicy.getHashIterations() : -1;
+            final String hashAlgorithm = passwordPolicy != null ? passwordPolicy.getHashAlgorithm() : null;
+            // Refresh the password in a different transaction, do not fail if there is a model exception on current modifications due to concurrent logins.
+            // Also do not start it as a nested transaction, as the current transaction might have auto-migrated the credential.
+            // see: JpaUserCredentialStore#toModel for the on-the-fly migration of the salt column
+            session.getTransactionManager().enlistAfterCompletion(new AbstractKeycloakTransaction() {
+                @Override
+                protected void commitImpl() {
+                    try {
+                        KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), session.getContext(),
+                                (KeycloakSession s) -> refreshPassword(s, hashAlgorithm, iterations, input.getChallengeResponse(),
+                                        password.getId(), password.getCreatedDate(), password.getUserLabel(), user.getId()));
+                    } catch (ModelException e) {
+                        logger.info("Error re-hashing the password in a different transaction", e);
+                    }
+                }
+
+                @Override
+                protected void rollbackImpl() {
+
+                }
+            });
+        }
+    }
 
-            PasswordCredentialModel newPassword = provider.encodedCredential(input.getChallengeResponse(), iterations);
-            newPassword.setId(password.getId());
-            newPassword.setCreatedDate(password.getCreatedDate());
-            newPassword.setUserLabel(password.getUserLabel());
-            user.credentialManager().updateStoredCredential(newPassword);
+    private static void refreshPassword(KeycloakSession s, String hashAlgorithm, int iterations, String challenge,
+            String passwordId, Long passwordDate, String passwordLabel, String userId) {
+        PasswordCredentialModel newPassword = ((hashAlgorithm != null)
+                ? s.getProvider(PasswordHashProvider.class, hashAlgorithm)
+                : s.getProvider(PasswordHashProvider.class))
+                .encodedCredential(challenge, iterations);
+        newPassword.setId(passwordId);
+        newPassword.setCreatedDate(passwordDate);
+        newPassword.setUserLabel(passwordLabel);
+        UserModel userModel = s.users().getUserById(s.getContext().getRealm(), userId);
+        if (userModel != null) {
+            userModel.credentialManager().updateStoredCredential(newPassword);
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/credential/RecoveryAuthnCodesCredentialProvider.java b/services/src/main/java/org/keycloak/credential/RecoveryAuthnCodesCredentialProvider.java
index b0e051386752..bcc8b2df95d7 100644
--- a/services/src/main/java/org/keycloak/credential/RecoveryAuthnCodesCredentialProvider.java
+++ b/services/src/main/java/org/keycloak/credential/RecoveryAuthnCodesCredentialProvider.java
@@ -1,14 +1,17 @@
 package org.keycloak.credential;
 
 import org.jboss.logging.Logger;
+import org.keycloak.authentication.requiredactions.RecoveryAuthnCodesAction;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
 import org.keycloak.models.credential.dto.RecoveryAuthnCodeRepresentation;
 import org.keycloak.models.credential.dto.RecoveryAuthnCodesCredentialData;
 import org.keycloak.models.utils.RecoveryAuthnCodesUtils;
 import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.RequiredActionHelper;
 
 import java.io.IOException;
 import java.util.Objects;
@@ -119,6 +122,12 @@ public boolean isValid(RealmModel realm, UserModel user, CredentialInput credent
     }
 
     protected int getWarningThreshold() {
-        return session.getContext().getRealm().getPasswordPolicy().getRecoveryCodesWarningThreshold();
+        RealmModel realm = session.getContext().getRealm();
+        RequiredActionProviderModel requiredAction = RequiredActionHelper.getRequiredActionByProviderId(realm, RecoveryAuthnCodesAction.PROVIDER_ID);
+        if (requiredAction != null && requiredAction.getConfig().containsKey(RecoveryAuthnCodesAction.WARNING_THRESHOLD)) {
+            return Integer.parseInt(requiredAction.getConfig().get(RecoveryAuthnCodesAction.WARNING_THRESHOLD));
+        } else {
+            return session.getContext().getRealm().getPasswordPolicy().getRecoveryCodesWarningThreshold();
+        }
     }
 }
diff --git a/services/src/main/java/org/keycloak/credential/WebAuthnCredentialProvider.java b/services/src/main/java/org/keycloak/credential/WebAuthnCredentialProvider.java
index d24dfe6b0e44..4d3bb7c8fa48 100644
--- a/services/src/main/java/org/keycloak/credential/WebAuthnCredentialProvider.java
+++ b/services/src/main/java/org/keycloak/credential/WebAuthnCredentialProvider.java
@@ -31,8 +31,8 @@
 import com.webauthn4j.server.ServerProperty;
 import com.webauthn4j.util.AssertUtil;
 import com.webauthn4j.util.exception.WebAuthnException;
-import com.webauthn4j.validator.OriginValidatorImpl;
-import com.webauthn4j.validator.exception.BadOriginException;
+import com.webauthn4j.verifier.OriginVerifierImpl;
+import com.webauthn4j.verifier.exception.BadOriginException;
 import jakarta.annotation.Nonnull;
 import org.jboss.logging.Logger;
 import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
@@ -209,7 +209,7 @@ public boolean isValid(RealmModel realm, UserModel user, CredentialInput input)
                             authenticator,
                             context.getAuthenticationParameters().isUserVerificationRequired()
                     );
-                    webAuthnAuthenticationManager.validate(authenticationData, authenticationParameters);
+                    webAuthnAuthenticationManager.verify(authenticationData, authenticationParameters);
 
 
                     logger.debugv("response.getAuthenticatorData().getFlags() = {0}", authenticationData.getAuthenticatorData().getFlags());
@@ -246,9 +246,9 @@ protected WebAuthnAuthenticationManager getWebAuthnAuthenticationManager() {
                 .map(Origin::new)
                 .collect(Collectors.toSet());
         WebAuthnAuthenticationManager webAuthnAuthenticationManager = new WebAuthnAuthenticationManager();
-        webAuthnAuthenticationManager.getAuthenticationDataValidator().setOriginValidator(new OriginValidatorImpl(){
+        webAuthnAuthenticationManager.getAuthenticationDataVerifier().setOriginVerifier(new OriginVerifierImpl() {
             @Override
-            protected void validate(@Nonnull CollectedClientData collectedClientData,
+            protected void verify(@Nonnull CollectedClientData collectedClientData,
                                     @Nonnull ServerProperty serverProperty) {
                 AssertUtil.notNull(collectedClientData, "collectedClientData must not be null");
                 AssertUtil.notNull(serverProperty, "serverProperty must not be null");
diff --git a/services/src/main/java/org/keycloak/device/DeviceRepresentationProviderImpl.java b/services/src/main/java/org/keycloak/device/DeviceRepresentationProviderImpl.java
index 02e8354196f2..b1d90ae654ff 100644
--- a/services/src/main/java/org/keycloak/device/DeviceRepresentationProviderImpl.java
+++ b/services/src/main/java/org/keycloak/device/DeviceRepresentationProviderImpl.java
@@ -85,7 +85,7 @@ public DeviceRepresentation deviceRepresentation() {
             }
 
             current.setOsVersion(osVersion);
-            current.setIpAddress(context.getConnection().getRemoteAddr());
+            current.setIpAddress(context.getConnection().getRemoteHost());
             current.setMobile(userAgent.toLowerCase().contains("mobile"));
 
             deviceRepresentation = current;
diff --git a/services/src/main/java/org/keycloak/email/DefaultEmailAuthenticator.java b/services/src/main/java/org/keycloak/email/DefaultEmailAuthenticator.java
new file mode 100644
index 000000000000..4392dd13265c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/email/DefaultEmailAuthenticator.java
@@ -0,0 +1,19 @@
+package org.keycloak.email;
+
+import jakarta.mail.MessagingException;
+import jakarta.mail.Transport;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Map;
+
+public class DefaultEmailAuthenticator implements EmailAuthenticator {
+
+    @Override
+    public void connect(KeycloakSession session, Map<String, String> config, Transport transport) throws EmailException {
+        try {
+            transport.connect();
+        } catch (MessagingException e) {
+            throw new EmailException("Non authenticated connect failed", e);
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java b/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java
index 2e74a6b523b8..eea69eb9051b 100644
--- a/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java
+++ b/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java
@@ -24,7 +24,6 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.truststore.JSSETruststoreConfigurator;
-import org.keycloak.vault.VaultStringSecret;
 
 import jakarta.mail.Address;
 import jakarta.mail.MessagingException;
@@ -55,9 +54,12 @@ public class DefaultEmailSenderProvider implements EmailSenderProvider {
     private static final Logger logger = Logger.getLogger(DefaultEmailSenderProvider.class);
     private static final String SUPPORTED_SSL_PROTOCOLS = getSupportedSslProtocols();
 
+    private final Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> authenticators;
+
     private final KeycloakSession session;
 
-    public DefaultEmailSenderProvider(KeycloakSession session) {
+    public DefaultEmailSenderProvider(KeycloakSession session, Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> authenticators) {
+        this.authenticators = authenticators;
         this.session = session;
     }
 
@@ -72,114 +74,169 @@ public void send(Map<String, String> config, UserModel user, String subject, Str
 
     @Override
     public void send(Map<String, String> config, String address, String subject, String textBody, String htmlBody) throws EmailException {
-        Transport transport = null;
-        try {
+        Session session = Session.getInstance(buildEmailProperties(config));
 
-            Properties props = new Properties();
+        Message message = buildMessage(session, address, subject, config, buildMultipartBody(textBody, htmlBody));
 
-            if (config.containsKey("host")) {
-                props.setProperty("mail.smtp.host", config.get("host"));
-            }
+        try(Transport transport = session.getTransport("smtp")) {
 
-            boolean auth = "true".equals(config.get("auth"));
-            boolean ssl = "true".equals(config.get("ssl"));
-            boolean starttls = "true".equals(config.get("starttls"));
+            EmailAuthenticator selectedAuthenticator = selectAuthenticatorBasedOnConfig(config);
+            selectedAuthenticator.connect(this.session, config, transport);
 
-            if (config.containsKey("port") && config.get("port") != null) {
-                props.setProperty("mail.smtp.port", config.get("port"));
-            }
+            transport.sendMessage(message, new InternetAddress[]{new InternetAddress(address)});
 
-            if (auth) {
-                props.setProperty("mail.smtp.auth", "true");
-            }
+        } catch (Exception e) {
+            ServicesLogger.LOGGER.failedToSendEmail(e);
+            throw new EmailException("Error when attempting to send the email to the server. More information is available in the server log.", e);
+        }
+    }
 
-            if (ssl) {
-                props.setProperty("mail.smtp.ssl.enable", "true");
-            }
+    private Properties buildEmailProperties(Map<String, String> config) throws EmailException {
+        Properties props = new Properties();
 
-            if (starttls) {
-                props.setProperty("mail.smtp.starttls.enable", "true");
-            }
+        if (config.containsKey("host")) {
+            props.setProperty("mail.smtp.host", config.get("host"));
+        }
 
-            if (ssl || starttls || auth){
-                props.put("mail.smtp.ssl.protocols", SUPPORTED_SSL_PROTOCOLS);
+        if (config.containsKey("port") && config.get("port") != null) {
+            props.setProperty("mail.smtp.port", config.get("port"));
+        }
 
-                setupTruststore(props);
-            }
+        if (isAuthConfigured(config)) {
+            props.setProperty("mail.smtp.auth", "true");
+        }
 
-            props.setProperty("mail.smtp.timeout", "10000");
-            props.setProperty("mail.smtp.connectiontimeout", "10000");
+        if (isAuthTypeTokenConfigured(config)) {
+            props.put("mail.smtp.auth.mechanisms", "XOAUTH2");
+        }
 
-            String from = config.get("from");
-            if (from == null) {
-                throw new EmailException("No sender address configured in the realm settings for emails");
-            }
+        if (isDebugEnabled(config)) {
+            props.put("mail.debug", "true");
+        }
 
-            String fromDisplayName = config.get("fromDisplayName");
-            String replyTo = config.get("replyTo");
-            String replyToDisplayName = config.get("replyToDisplayName");
-            String envelopeFrom = config.get("envelopeFrom");
+        if (isSslConfigured(config)) {
+            props.setProperty("mail.smtp.ssl.enable", "true");
+        }
 
-            Session session = Session.getInstance(props);
+        if (isStarttlsConfigured(config)) {
+            props.setProperty("mail.smtp.starttls.enable", "true");
+        }
 
-            Multipart multipart = new MimeMultipart("alternative");
+        if (isSslConfigured(config) || isStarttlsConfigured(config) || isAuthConfigured(config)) {
+            props.put("mail.smtp.ssl.protocols", SUPPORTED_SSL_PROTOCOLS);
 
-            if (textBody != null) {
-                MimeBodyPart textPart = new MimeBodyPart();
-                textPart.setText(textBody, "UTF-8");
-                multipart.addBodyPart(textPart);
-            }
+            setupTruststore(props);
+        }
 
-            if (htmlBody != null) {
-                MimeBodyPart htmlPart = new MimeBodyPart();
-                htmlPart.setContent(htmlBody, "text/html; charset=UTF-8");
-                multipart.addBodyPart(htmlPart);
-            }
+        props.setProperty("mail.smtp.timeout", "10000");
+        props.setProperty("mail.smtp.connectiontimeout", "10000");
+        props.setProperty("mail.smtp.writetimeout", "10000");
+
+        String envelopeFrom = config.get("envelopeFrom");
+        if (isNotBlank(envelopeFrom)) {
+            props.setProperty("mail.smtp.from", envelopeFrom);
+        }
+
+        String from = config.get("from");
+        if (from == null) {
+            throw new EmailException("No sender address configured in the realm settings for emails");
+        }
+
+        // Specify 'mail.from' as InternetAddress.getLocalAddress() would otherwise do a InetAddress.getCanonicalHostName
+        // and add this as a mail header. This would both be slow, and would reveal internal IP addresses that we don't want.
+        // https://jakarta.ee/specifications/mail/2.0/jakarta-mail-spec-2.0#a823
+        props.setProperty("mail.from", from);
+
+        return props;
+    }
+
+    private Message buildMessage(Session session, String address, String subject, Map<String, String> config, Multipart multipart) throws EmailException {
+
+        String from = config.get("from");
+        if (from == null) {
+            throw new EmailException("No sender address configured in the realm settings for emails");
+        }
+        String fromDisplayName = config.get("fromDisplayName");
+        String replyTo = config.get("replyTo");
+        String replyToDisplayName = config.get("replyToDisplayName");
 
+        try {
             Message msg = new MimeMessage(session);
             msg.setFrom(toInternetAddress(from, fromDisplayName));
-
             msg.setReplyTo(new Address[]{toInternetAddress(from, fromDisplayName)});
 
             if (isNotBlank(replyTo)) {
                 msg.setReplyTo(new Address[]{toInternetAddress(replyTo, replyToDisplayName)});
             }
 
-            if (isNotBlank(envelopeFrom)) {
-                props.setProperty("mail.smtp.from", envelopeFrom);
-            }
-
             msg.setHeader("To", address);
             msg.setSubject(MimeUtility.encodeText(subject, StandardCharsets.UTF_8.name(), null));
             msg.setContent(multipart);
             msg.saveChanges();
             msg.setSentDate(new Date());
 
-            transport = session.getTransport("smtp");
-            if (auth) {
-                try (VaultStringSecret vaultStringSecret = this.session.vault().getStringSecret(config.get("password"))) {
-                    transport.connect(config.get("user"), vaultStringSecret.get().orElse(config.get("password")));
-                }
-            } else {
-                transport.connect();
+            return msg;
+        } catch (UnsupportedEncodingException e) {
+            throw new EmailException("Failed to encode email address", e);
+        } catch (AddressException e) {
+            throw new EmailException("Invalid email address format", e);
+        } catch (MessagingException e) {
+            throw new EmailException("MessagingException occurred", e);
+        }
+    }
+
+    private Multipart buildMultipartBody(String textBody, String htmlBody) throws EmailException {
+        Multipart multipart = new MimeMultipart("alternative");
+
+        try {
+            if (textBody != null) {
+                MimeBodyPart textPart = new MimeBodyPart();
+                textPart.setText(textBody, "UTF-8");
+                multipart.addBodyPart(textPart);
             }
-            transport.sendMessage(msg, new InternetAddress[]{new InternetAddress(address)});
-        } catch (EmailException e) {
-            throw e;
-        } catch (Exception e) {
-            ServicesLogger.LOGGER.failedToSendEmail(e);
-            throw new EmailException("Error when attempting to send the email to the server. More information is available in the server log.", e);
-        } finally {
-            if (transport != null) {
-                try {
-                    transport.close();
-                } catch (MessagingException e) {
-                    logger.warn("Failed to close transport", e);
-                }
+
+            if (htmlBody != null) {
+                MimeBodyPart htmlPart = new MimeBodyPart();
+                htmlPart.setContent(htmlBody, "text/html; charset=UTF-8");
+                multipart.addBodyPart(htmlPart);
             }
+        } catch (MessagingException e) {
+            throw new EmailException("Error encoding email body parts", e);
+        }
+
+        return multipart;
+    }
+
+    private EmailAuthenticator selectAuthenticatorBasedOnConfig(Map<String, String> config) {
+        if(isAuthConfigured(config)) {
+            String authType = config.getOrDefault("authType", "basic");
+            return authenticators.get(EmailAuthenticator.AuthenticatorType.valueOf(authType.toUpperCase()));
         }
+
+        return authenticators.get(EmailAuthenticator.AuthenticatorType.NONE);
+    }
+
+    private static boolean isStarttlsConfigured(Map<String, String> config) {
+        return "true".equals(config.get("starttls"));
+    }
+
+    private static boolean isSslConfigured(Map<String, String> config) {
+        return "true".equals(config.get("ssl"));
+    }
+
+    private static boolean isDebugEnabled(Map<String, String> config) {
+        return "true".equals(config.get("debug"));
+    }
+
+    private boolean isAuthConfigured(Map<String, String> config) {
+        return "true".equals(config.get("auth"));
     }
 
+    private boolean isAuthTypeTokenConfigured(Map<String, String> config) {
+        return "token".equals(config.get("authType"));
+    }
+
+
     protected InternetAddress toInternetAddress(String email, String displayName) throws UnsupportedEncodingException, AddressException, EmailException {
         if (email == null || "".equals(email.trim())) {
             throw new EmailException("Please provide a valid address", null);
@@ -203,8 +260,7 @@ private void setupTruststore(Properties props) {
             if (configurator.getProvider().getPolicy() == HostnameVerificationPolicy.ANY) {
                 props.setProperty("mail.smtp.ssl.trust", "*");
                 props.put("mail.smtp.ssl.checkserveridentity", Boolean.FALSE.toString()); // this should be the default but seems to be impl specific, so set it explicitly just to be sure
-            }
-            else {
+            } else {
                 props.put("mail.smtp.ssl.checkserveridentity", Boolean.TRUE.toString());
             }
         }
diff --git a/services/src/main/java/org/keycloak/email/DefaultEmailSenderProviderFactory.java b/services/src/main/java/org/keycloak/email/DefaultEmailSenderProviderFactory.java
index 08bec51e7f1f..cad3f41ec431 100644
--- a/services/src/main/java/org/keycloak/email/DefaultEmailSenderProviderFactory.java
+++ b/services/src/main/java/org/keycloak/email/DefaultEmailSenderProviderFactory.java
@@ -21,18 +21,26 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public class DefaultEmailSenderProviderFactory implements EmailSenderProviderFactory {
 
+    private final Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> emailAuthenticators = new ConcurrentHashMap<>();
+
     @Override
     public EmailSenderProvider create(KeycloakSession session) {
-        return new DefaultEmailSenderProvider(session);
+        return new DefaultEmailSenderProvider(session, emailAuthenticators);
     }
 
     @Override
     public void init(Config.Scope config) {
+        emailAuthenticators.put(EmailAuthenticator.AuthenticatorType.NONE, new DefaultEmailAuthenticator());
+        emailAuthenticators.put(EmailAuthenticator.AuthenticatorType.BASIC, new PasswordAuthEmailAuthenticator());
+        emailAuthenticators.put(EmailAuthenticator.AuthenticatorType.TOKEN, new TokenAuthEmailAuthenticator());
     }
 
     @Override
@@ -41,6 +49,7 @@ public void postInit(KeycloakSessionFactory factory) {
 
     @Override
     public void close() {
+        emailAuthenticators.clear();
     }
 
     @Override
@@ -48,4 +57,7 @@ public String getId() {
         return "default";
     }
 
+    public Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> getEmailAuthenticators() {
+        return emailAuthenticators;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/email/EmailAuthenticator.java b/services/src/main/java/org/keycloak/email/EmailAuthenticator.java
new file mode 100644
index 000000000000..808929951307
--- /dev/null
+++ b/services/src/main/java/org/keycloak/email/EmailAuthenticator.java
@@ -0,0 +1,19 @@
+package org.keycloak.email;
+
+import jakarta.mail.Transport;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Map;
+
+public interface EmailAuthenticator {
+
+    void connect(KeycloakSession session, Map<String, String> config, Transport transport) throws EmailException;
+
+    enum AuthenticatorType {
+        NONE,
+        BASIC,
+        TOKEN
+    }
+}
+
+
diff --git a/services/src/main/java/org/keycloak/email/PasswordAuthEmailAuthenticator.java b/services/src/main/java/org/keycloak/email/PasswordAuthEmailAuthenticator.java
new file mode 100644
index 000000000000..634841a7cc19
--- /dev/null
+++ b/services/src/main/java/org/keycloak/email/PasswordAuthEmailAuthenticator.java
@@ -0,0 +1,21 @@
+package org.keycloak.email;
+
+import jakarta.mail.MessagingException;
+import jakarta.mail.Transport;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.vault.VaultStringSecret;
+
+import java.util.Map;
+
+public class PasswordAuthEmailAuthenticator implements EmailAuthenticator {
+
+    @Override
+    public void connect(KeycloakSession session, Map<String, String> config, Transport transport) throws EmailException {
+        try (VaultStringSecret vaultStringSecret = session.vault().getStringSecret(config.get("password"))) {
+            transport.connect(config.get("user"), vaultStringSecret.get().orElse(config.get("password")));
+        } catch (MessagingException e) {
+            throw new EmailException("Password based SMTP connect failed", e);
+        }
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/email/TokenAuthEmailAuthenticator.java b/services/src/main/java/org/keycloak/email/TokenAuthEmailAuthenticator.java
new file mode 100644
index 000000000000..297af519d384
--- /dev/null
+++ b/services/src/main/java/org/keycloak/email/TokenAuthEmailAuthenticator.java
@@ -0,0 +1,140 @@
+package org.keycloak.email;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.mail.AuthenticationFailedException;
+import jakarta.mail.MessagingException;
+import jakarta.mail.Transport;
+import org.jboss.logging.Logger;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.utils.KeycloakSessionUtil;
+import org.keycloak.vault.VaultStringSecret;
+
+import java.io.IOException;
+import java.time.LocalDateTime;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class TokenAuthEmailAuthenticator implements EmailAuthenticator {
+
+    private static final Logger logger = Logger.getLogger(TokenAuthEmailAuthenticator.class);
+    public static final int FALLBACK_EXPIRES_AT_IN_SECONDS = 60;
+
+    private final Map<String, TokenAuthEmailAuthenticator.TokenStoreEntry> tokenStore = new ConcurrentHashMap<>();
+
+    @Override
+    public void connect(KeycloakSession session, Map<String, String> config, Transport transport) throws EmailException {
+        try {
+            String token = gatherValidToken(session, config);
+
+            transport.connect(config.get("user"), token);
+
+        } catch (AuthenticationFailedException e) {
+
+            this.tokenStore.remove(session.getContext().getRealm().getId());
+            logger.debugf("AuthenticationFailed-Exception for SMTP in realm %s failed response was %s, will try again", KeycloakSessionUtil.getRealmNameFromContext(session), e.getMessage());
+
+            String token = gatherValidToken(session, config);
+
+            try {
+                transport.connect(config.get("user"), token);
+            } catch (MessagingException ex) {
+                logger.warnf("Retry after AuthenticationFailed-Exception for SMTP in realm %s failed response was %s", KeycloakSessionUtil.getRealmNameFromContext(session), ex);
+                throw new EmailException("Retry after AuthenticationFailed-Exception for SMTP failed.", ex);
+            }
+
+        } catch (MessagingException e) {
+            throw new EmailException("Connect failed for SMTP " + KeycloakSessionUtil.getRealmNameFromContext(session), e);
+        }
+    }
+
+    private String gatherValidToken(KeycloakSession session, Map<String, String> config) throws EmailException {
+        try (VaultStringSecret vaultStringSecret = session.vault().getStringSecret(config.get("authTokenClientSecret"))) {
+            String authTokenClientSecret = vaultStringSecret.get().orElse(config.get("authTokenClientSecret"));
+            String authTokenUrl = config.get("authTokenUrl");
+            String authTokenClientId = config.get("authTokenClientId");
+            String authTokenScope = config.get("authTokenScope");
+            int authTokenClientSecretHash = authTokenClientSecret.hashCode();
+
+            TokenStoreEntry tokenStoreEntry = this.tokenStore.get(session.getContext().getRealm().getId());
+            if (isValidAuthToken(authTokenUrl, authTokenScope, authTokenClientId, authTokenClientSecretHash, tokenStoreEntry)) {
+                return tokenStoreEntry.token;
+            }
+
+            synchronized (this.tokenStore) {
+                if (isValidAuthToken(authTokenUrl, authTokenScope, authTokenClientId, authTokenClientSecretHash, tokenStoreEntry)) {
+                    return tokenStoreEntry.token;
+                }
+
+                JsonNode response = fetchTokenViaHTTP(session, authTokenUrl, authTokenScope, authTokenClientId, authTokenClientSecret);
+
+                Optional<String> maybeToken = getAccessToken(session, response);
+                Optional<LocalDateTime> maybeExpiresAt = getExpiresIn(session, response);
+
+                if (maybeToken.isPresent()) {
+                    String token = maybeToken.get();
+                    this.tokenStore.put(session.getContext().getRealm().getId(),
+                            new TokenStoreEntry(
+                                    maybeExpiresAt.orElse(LocalDateTime.now().plusSeconds(FALLBACK_EXPIRES_AT_IN_SECONDS)),
+                                    authTokenUrl,
+                                    authTokenScope,
+                                    authTokenClientId,
+                                    authTokenClientSecretHash,
+                                    token));
+                    return token;
+                } else {
+                    throw new EmailException("No access token found in token-response for SMTP");
+                }
+            }
+        } catch (IOException e) {
+            throw new EmailException("Failed to gather valid token for SMTP", e);
+        }
+    }
+
+    private static boolean isValidAuthToken(String authTokenUrl, String authTokenScope, String authTokenClientId, int authTokenHash, TokenStoreEntry tokenStoreEntry) {
+        return tokenStoreEntry != null
+                && authTokenUrl != null && authTokenUrl.equals(tokenStoreEntry.url)
+                && authTokenScope != null && authTokenScope.equals(tokenStoreEntry.scope)
+                && authTokenClientId != null && authTokenClientId.equals(tokenStoreEntry.clientId)
+                && authTokenHash == tokenStoreEntry.clientSecretHash
+                && tokenStoreEntry.expiration_at.plusSeconds(30).isAfter(LocalDateTime.now());
+    }
+
+    private Optional<String> getAccessToken(KeycloakSession session, JsonNode response) {
+        if (response.has("access_token")) {
+            return Optional.of(response.get("access_token").asText());
+        } else {
+            logger.warnf("Got no access_token from response for SMTP auth in realm %s, response was %s", KeycloakSessionUtil.getRealmNameFromContext(session), response);
+            return Optional.empty();
+        }
+    }
+
+    private Optional<LocalDateTime> getExpiresIn(KeycloakSession session, JsonNode response) {
+        //token-lifetime, must be given beside the token because token can be opaque (must not be a jwt token)
+        if (response.has("expires_in")) {
+            String expiresIn = response.get("expires_in").asText();
+            return Optional.of(LocalDateTime.now().plusSeconds(Long.parseLong(expiresIn)));
+        } else {
+            logger.warnf("Got no expires_in from response for SMTP auth in realm %s, response was %s", KeycloakSessionUtil.getRealmNameFromContext(session), response.asText());
+            return Optional.of((LocalDateTime.now().plusSeconds(FALLBACK_EXPIRES_AT_IN_SECONDS)));
+        }
+    }
+
+    private JsonNode fetchTokenViaHTTP(KeycloakSession session, String authTokenUrl, String authTokenScope, String authTokenClientId, String authTokenClientSecret) throws IOException {
+        return SimpleHttp.doPost(authTokenUrl, session)
+                .param("client_id", authTokenClientId)
+                .param("client_secret", authTokenClientSecret)
+                .param("scope", authTokenScope)
+                .param("grant_type", "client_credentials").asJson();
+    }
+
+    record TokenStoreEntry(
+            LocalDateTime expiration_at,
+            String url,
+            String scope,
+            String clientId,
+            int clientSecretHash,
+            String token) {
+    }
+}
diff --git a/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java b/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java
index 73694ee884aa..70af64ade585 100755
--- a/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java
+++ b/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java
@@ -18,6 +18,7 @@
 package org.keycloak.email.freemarker;
 
 import java.io.IOException;
+import java.text.Bidi;
 import java.text.MessageFormat;
 import java.util.Collections;
 import java.util.HashMap;
@@ -35,6 +36,7 @@
 import org.keycloak.events.Event;
 import org.keycloak.events.EventType;
 import org.keycloak.forms.login.freemarker.model.UrlBean;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakUriInfo;
 import org.keycloak.models.OrganizationModel;
@@ -199,7 +201,7 @@ protected void addLinkInfoIntoAttributes(String link, long expirationInMinutes,
         attributes.put("link", link);
         attributes.put("linkExpiration", expirationInMinutes);
         try {
-            Locale locale = session.getContext().resolveLocale(user, getTheme().getType());
+            Locale locale = session.getContext().resolveLocale(user, Boolean.parseBoolean(String.valueOf(attributes.get(Constants.IGNORE_ACCEPT_LANGUAGE_HEADER))));
             attributes.put("linkExpirationFormatter", new LinkExpirationFormatterMethod(getTheme().getMessages(locale), locale));
         } catch (IOException e) {
             throw new EmailException("Failed to template email", e);
@@ -213,11 +215,17 @@ public void send(String subjectFormatKey, String bodyTemplate, Map<String, Objec
 
     protected EmailTemplate processTemplate(String subjectKey, List<Object> subjectAttributes, String template, Map<String, Object> attributes) throws EmailException {
         try {
-            Theme theme = getTheme();
-            Locale locale = session.getContext().resolveLocale(user, theme.getType());
+            Locale locale = session.getContext().resolveLocale(user, Boolean.parseBoolean(String.valueOf(attributes.get(Constants.IGNORE_ACCEPT_LANGUAGE_HEADER))));
             attributes.put("locale", locale);
 
+            Theme theme = getTheme();
             Properties messages = theme.getEnhancedMessages(realm, locale);
+
+            String currentLanguageTag = locale.getLanguage();
+            String currentLanguage = messages.getProperty("locale_" + currentLanguageTag, currentLanguageTag);
+            boolean isLtr = new Bidi(currentLanguage, Bidi.DIRECTION_DEFAULT_LEFT_TO_RIGHT).isLeftToRight();
+            attributes.put("ltr", isLtr);
+
             attributes.put("msg", new MessageFormatterMethod(locale, messages));
 
             attributes.put("properties", theme.getProperties());
diff --git a/services/src/main/java/org/keycloak/email/freemarker/beans/AdminEventBean.java b/services/src/main/java/org/keycloak/email/freemarker/beans/AdminEventBean.java
index 6dae05d76024..cb21dabae8be 100644
--- a/services/src/main/java/org/keycloak/email/freemarker/beans/AdminEventBean.java
+++ b/services/src/main/java/org/keycloak/email/freemarker/beans/AdminEventBean.java
@@ -25,7 +25,7 @@
  * @author <a href="mailto:giriraj.sharma27@gmail.com">Giriraj Sharma</a>
  */
 public class AdminEventBean {
-    
+
     private AdminEvent adminEvent;
 
     public AdminEventBean(AdminEvent adminEvent) {
@@ -44,10 +44,15 @@ public String getClient() {
         return adminEvent.getAuthDetails().getClientId();
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return adminEvent.getAuthDetails().getIpAddress();
     }
-    
+
     public String getResourcePath() {
         return adminEvent.getResourcePath();
     }
diff --git a/services/src/main/java/org/keycloak/email/freemarker/beans/EventBean.java b/services/src/main/java/org/keycloak/email/freemarker/beans/EventBean.java
index 4edb6e242037..a57581f34ecf 100644
--- a/services/src/main/java/org/keycloak/email/freemarker/beans/EventBean.java
+++ b/services/src/main/java/org/keycloak/email/freemarker/beans/EventBean.java
@@ -46,6 +46,11 @@ public String getClient() {
         return event.getClientId();
     }
 
+    /**
+     * Note: will not be an address when a proxy does not provide a valid one
+     *
+     * @return the ip address
+     */
     public String getIpAddress() {
         return event.getIpAddress();
     }
diff --git a/services/src/main/java/org/keycloak/email/freemarker/beans/ProfileBean.java b/services/src/main/java/org/keycloak/email/freemarker/beans/ProfileBean.java
index 0399fc6afadd..bd4737914132 100755
--- a/services/src/main/java/org/keycloak/email/freemarker/beans/ProfileBean.java
+++ b/services/src/main/java/org/keycloak/email/freemarker/beans/ProfileBean.java
@@ -19,17 +19,16 @@
 import org.jboss.logging.Logger;
 import org.keycloak.forms.login.freemarker.model.OrganizationBean;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.organization.OrganizationProvider;
 import org.keycloak.representations.userprofile.config.UPAttribute;
 import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.userprofile.UserProfileProvider;
 
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.function.Function;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -39,7 +38,7 @@ public class ProfileBean {
 
     private static final Logger logger = Logger.getLogger(ProfileBean.class);
 
-    private UserModel user;
+    private final UserModel user;
     private final KeycloakSession session;
     private final Map<String, String> attributes = new HashMap<>();
     private List<OrganizationBean> organizations;
@@ -90,9 +89,15 @@ public Map<String, String> getAttributes() {
 
     public List<OrganizationBean> getOrganizations() {
         if (organizations == null) {
-            organizations = session.getProvider(OrganizationProvider.class).getByMember(user)
-                    .map(o -> new OrganizationBean(o, user))
-                    .toList();
+            final var organizationsProvider = session.getProvider(OrganizationProvider.class);
+            if (organizationsProvider == null) {
+                organizations = Collections.emptyList();
+            }
+            else {
+                organizations = organizationsProvider.getByMember(user)
+                        .map(o -> new OrganizationBean(o, user))
+                        .toList();
+            }
         }
         return organizations;
     }
diff --git a/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProvider.java b/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProvider.java
index 88d83589ec48..362ff92ba134 100755
--- a/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProvider.java
+++ b/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProvider.java
@@ -44,16 +44,19 @@ public class JBossLoggingEventListenerProvider implements EventListenerProvider
     private final Logger.Level errorLevel;
     private final boolean sanitize;
     private final Character quotes;
+    private final boolean includeRepresentation;
     private final EventListenerTransaction tx = new EventListenerTransaction(this::logAdminEvent, this::logEvent);
 
     public JBossLoggingEventListenerProvider(KeycloakSession session, Logger logger,
-            Logger.Level successLevel, Logger.Level errorLevel, Character quotes, boolean sanitize) {
+            Logger.Level successLevel, Logger.Level errorLevel, Character quotes,
+            boolean sanitize, boolean includeRepresentation) {
         this.session = session;
         this.logger = logger;
         this.successLevel = successLevel;
         this.errorLevel = errorLevel;
         this.sanitize = sanitize;
         this.quotes = quotes;
+        this.includeRepresentation = includeRepresentation;
         this.session.getTransactionManager().enlistAfterCompletion(tx);
     }
 
@@ -80,7 +83,7 @@ private void sanitize(StringBuilder sb, String str) {
         }
     }
 
-    private void logEvent(Event event) {
+    protected void logEvent(Event event) {
         Logger.Level level = event.getError() != null ? errorLevel : successLevel;
 
         if (logger.isEnabled(level)) {
@@ -137,7 +140,7 @@ private void logEvent(Event event) {
         }
     }
 
-    private void logAdminEvent(AdminEvent adminEvent, boolean includeRepresentation) {
+    protected void logAdminEvent(AdminEvent adminEvent, boolean realmIncludeRepresentation) {
         Logger.Level level = adminEvent.getError() != null ? errorLevel : successLevel;
 
         if (logger.isEnabled(level)) {
@@ -174,6 +177,11 @@ private void logAdminEvent(AdminEvent adminEvent, boolean includeRepresentation)
                 }
             }
 
+            if (realmIncludeRepresentation && includeRepresentation && adminEvent.getRepresentation() != null) {
+                sb.append(", representation=");
+                sanitize(sb, adminEvent.getRepresentation());
+            }
+
             if(logger.isTraceEnabled()) {
                 setKeycloakContext(sb);
             }
diff --git a/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProviderFactory.java b/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProviderFactory.java
index 78b1ad3df9c0..eaa900ddfbd5 100755
--- a/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProviderFactory.java
+++ b/services/src/main/java/org/keycloak/events/log/JBossLoggingEventListenerProviderFactory.java
@@ -42,10 +42,11 @@ public class JBossLoggingEventListenerProviderFactory implements EventListenerPr
     private Logger.Level errorLevel;
     private boolean sanitize;
     private Character quotes;
+    private boolean includeRepresentation;
 
     @Override
     public EventListenerProvider create(KeycloakSession session) {
-        return new JBossLoggingEventListenerProvider(session, logger, successLevel, errorLevel, quotes, sanitize);
+        return new JBossLoggingEventListenerProvider(session, logger, successLevel, errorLevel, quotes, sanitize, includeRepresentation);
     }
 
     @Override
@@ -59,6 +60,7 @@ public void init(Config.Scope config) {
             quotesString = "\"";
         }
         quotes = quotesString.equals("none")? null : quotesString.charAt(0);
+        includeRepresentation = config.getBoolean("include-representation", false);
     }
 
     @Override
@@ -109,6 +111,15 @@ public List<ProviderConfigProperty> getConfigMetadata() {
                 .helpText("The quotes to use for values, it should be one character like \" or '. Use \"none\" if quotes are not needed.")
                 .defaultValue("\"")
                 .add()
+                .property()
+                .name("include-representation")
+                .type("boolean")
+                .helpText("""
+                          When "true" the "representation" field with the JSON admin object is also added to the message.
+                          The realm should be also configured to include representation for the admin events.
+                          """)
+                .defaultValue("false")
+                .add()
                 .build();
     }
 }
diff --git a/services/src/main/java/org/keycloak/exportimport/ExportImportConfig.java b/services/src/main/java/org/keycloak/exportimport/ExportImportConfig.java
index 1b6dfed29586..4aa135c475d9 100644
--- a/services/src/main/java/org/keycloak/exportimport/ExportImportConfig.java
+++ b/services/src/main/java/org/keycloak/exportimport/ExportImportConfig.java
@@ -31,6 +31,8 @@ public class ExportImportConfig {
     public static final String ACTION_EXPORT = "export";
     public static final String ACTION_IMPORT = "import";
 
+    public static final String SINGLE_TRANSACTION = PREFIX + "single-transaction";
+
     public static final String PROVIDER = PREFIX + "provider";
     public static final String PROVIDER_DEFAULT = "dir";
 
@@ -61,15 +63,15 @@ public class ExportImportConfig {
     public static String getAction() {
         return System.getProperty(ACTION);
     }
-    
+
     public static String getStrategy() {
         return System.getProperty(STRATEGY);
     }
-    
+
     public static String setStrategy(Strategy strategy) {
         return System.setProperty(STRATEGY, strategy.toString());
     }
-    
+
     public static Optional<String> getDir() {
         return Optional.ofNullable(System.getProperty(DIR));
     }
@@ -106,9 +108,18 @@ public static boolean isReplacePlaceholders() {
     public static void setReplacePlaceholders(boolean replacePlaceholders) {
         System.setProperty(REPLACE_PLACEHOLDERS, String.valueOf(replacePlaceholders));
     }
-    
+
     public static void reset() {
         Stream.of(FILE, DIR, ACTION, STRATEGY, REPLACE_PLACEHOLDERS)
                 .forEach(prop -> System.getProperties().remove(prop));
     }
+
+    public static void setSingleTransaction(boolean b) {
+        System.setProperty(SINGLE_TRANSACTION, String.valueOf(b));
+    }
+
+    public static boolean isSingleTransaction() {
+        return Optional.ofNullable(System.getProperty(SINGLE_TRANSACTION)).map(Boolean::valueOf).orElse(Boolean.TRUE);
+    }
+
 }
diff --git a/services/src/main/java/org/keycloak/exportimport/ExportImportManager.java b/services/src/main/java/org/keycloak/exportimport/ExportImportManager.java
index 02479e4eaa05..3a3a68e37231 100644
--- a/services/src/main/java/org/keycloak/exportimport/ExportImportManager.java
+++ b/services/src/main/java/org/keycloak/exportimport/ExportImportManager.java
@@ -29,9 +29,10 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
-import java.util.function.Supplier;
 import java.util.stream.Stream;
 
 import static org.keycloak.exportimport.ExportImportConfig.PROVIDER;
@@ -48,7 +49,7 @@ public class ExportImportManager {
     private final KeycloakSession session;
 
     private ExportProvider exportProvider;
-    private ImportProvider importProvider;
+    private List<ImportProvider> importProviders = List.of();
 
     public ExportImportManager(KeycloakSession session) {
         this.sessionFactory = session.getKeycloakSessionFactory();
@@ -69,34 +70,22 @@ public ExportImportManager(KeycloakSession session) {
             }
         } else if (ExportImportConfig.ACTION_IMPORT.equals(exportImportAction)) {
             String providerId = System.getProperty(PROVIDER, Config.scope("import").get("importer", PROVIDER_DEFAULT));
-            importProvider = session.getProvider(ImportProvider.class, providerId);
+            ImportProvider importProvider = session.getProvider(ImportProvider.class, providerId);
             if (importProvider == null) {
                 throw new RuntimeException("Import provider '" + providerId + "' not found");
             }
+            importProviders = List.of(importProvider);
         } else if (ExportImportConfig.getDir().isPresent()) { // import at startup
             ExportImportConfig.setStrategy(Strategy.IGNORE_EXISTING);
             ExportImportConfig.setReplacePlaceholders(true);
             // enables logging of what is imported
             ExportImportConfig.setAction(ExportImportConfig.ACTION_IMPORT);
+            importProviders = getStartupImportProviders();
         }
     }
 
     public boolean isImportMasterIncluded() {
-        if (importProvider != null) {
-            try {
-                return importProvider.isMasterRealmExported();
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        } else {
-            return isImportMasterIncludedAtStartup();
-        }
-        
-    }
-    
-    boolean isImportMasterIncludedAtStartup() {
-        return getStartupImportProviders().map(Supplier::get)
-                .anyMatch(provider -> {
+        return importProviders.stream().anyMatch(provider -> {
                     try {
                         return provider.isMasterRealmExported();
                     } catch (IOException e) {
@@ -110,19 +99,7 @@ public boolean isRunExport() {
     }
 
     public void runImport() {
-        if (importProvider != null) {
-            try {
-                importProvider.importModel();
-            } catch (IOException e) {
-                throw new RuntimeException("Failed to run import", e);
-            }
-        } else {
-            runImportAtStartup();
-        }
-    }
-    
-    public void runImportAtStartup() {
-        getStartupImportProviders().map(Supplier::get).forEach(ip -> {
+        importProviders.forEach(ip -> {
             try {
                 ip.importModel();
             } catch (IOException e) {
@@ -131,21 +108,20 @@ public void runImportAtStartup() {
         });
     }
 
-    private Stream<Supplier<ImportProvider>> getStartupImportProviders() {
+    private List<ImportProvider> getStartupImportProviders() {
         var dirProp = ExportImportConfig.getDir();
         if (dirProp.isEmpty()) {
-            return Stream.empty();
+            return List.of();
         }
         String dir = dirProp.get();
-        
+
         Stream<ProviderFactory> factories = sessionFactory.getProviderFactoriesStream(ImportProvider.class);
 
         return factories.flatMap(factory -> {
             String providerId = factory.getId();
 
             if ("dir".equals(providerId)) {
-                Supplier<ImportProvider> func = () -> session.getProvider(ImportProvider.class, providerId);
-                return Stream.of(func);
+                return Stream.of(session.getProvider(ImportProvider.class, providerId));
             }
             if ("singleFile".equals(providerId)) {
                 Set<String> filesToImport = new HashSet<>();
@@ -168,23 +144,13 @@ private Stream<Supplier<ImportProvider>> getStartupImportProviders() {
 
                     filesToImport.add(file.getAbsolutePath());
                 }
-                
-                return filesToImport.stream().map(file -> () -> {
-                    // we need a new session to pickup the static system property
-                    // file setting - it is picked up by the provider only at create time
-                    // this will eventually need to be consolidated with the master existance check
-                    // to prevent double parsing
-                    KeycloakSession newSession = session.getKeycloakSessionFactory().create();
-                    try {
-                        ExportImportConfig.setFile(file);
-                        return newSession.getProvider(ImportProvider.class, providerId);
-                    } finally {
-                        newSession.close();
-                    }
-                });
+
+                if (factory instanceof ImportProviderFactory) {
+                    return filesToImport.stream().map(file -> ((ImportProviderFactory)factory).create(session, Map.of(ExportImportConfig.FILE, file)));
+                }
             }
             return Stream.empty();
-        });
+        }).toList();
     }
 
     public void runExport() {
diff --git a/services/src/main/java/org/keycloak/forms/login/freemarker/FreeMarkerLoginFormsProvider.java b/services/src/main/java/org/keycloak/forms/login/freemarker/FreeMarkerLoginFormsProvider.java
index 186271c3be3a..bd1cca95a35b 100755
--- a/services/src/main/java/org/keycloak/forms/login/freemarker/FreeMarkerLoginFormsProvider.java
+++ b/services/src/main/java/org/keycloak/forms/login/freemarker/FreeMarkerLoginFormsProvider.java
@@ -27,6 +27,7 @@
 import org.keycloak.authentication.AuthenticationProcessor;
 import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
 import org.keycloak.authentication.authenticators.browser.OTPFormAuthenticator;
+import org.keycloak.authentication.authenticators.browser.RecoveryAuthnCodesFormAuthenticator;
 import org.keycloak.authentication.forms.RegistrationPage;
 import org.keycloak.authentication.requiredactions.util.UpdateProfileContext;
 import org.keycloak.authentication.requiredactions.util.UserUpdateProfileContext;
@@ -62,6 +63,7 @@
 import org.keycloak.forms.login.freemarker.model.UrlBean;
 import org.keycloak.forms.login.freemarker.model.VerifyProfileBean;
 import org.keycloak.forms.login.freemarker.model.X509ConfirmBean;
+import org.keycloak.http.HttpRequest;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
@@ -196,6 +198,9 @@ public Response createResponse(UserModel.RequiredAction action) {
             case VERIFY_EMAIL:
                 UpdateProfileContext userBasedContext1 = new UserUpdateProfileContext(realm, user);
                 attributes.put("user", new ProfileBean(userBasedContext1, formData));
+                if (authenticationSession.getAuthNote(Constants.VERIFY_EMAIL_KEY) != null) {
+                    attributes.put("verifyEmail", authenticationSession.getAuthNote(Constants.VERIFY_EMAIL_KEY));
+                }
                 actionMessage = Messages.VERIFY_EMAIL;
                 page = LoginFormsPages.LOGIN_VERIFY_EMAIL;
                 break;
@@ -257,7 +262,11 @@ protected Response createResponse(LoginFormsPages page) {
                 attributes.put("totp", totpBean);
                 break;
             case LOGIN_RECOVERY_AUTHN_CODES_CONFIG:
-                attributes.put("recoveryAuthnCodesConfigBean", new RecoveryAuthnCodesBean());
+                // generate the recovery codes and assign to the auth session
+                RecoveryAuthnCodesBean recoveryAuthnCodesBean = new RecoveryAuthnCodesBean();
+                attributes.put("recoveryAuthnCodesConfigBean", recoveryAuthnCodesBean);
+                authenticationSession.setAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_RECOVERY_AUTHN_CODES_NOTE, recoveryAuthnCodesBean.getGeneratedRecoveryAuthnCodesAsString());
+                authenticationSession.setAuthNote(RecoveryAuthnCodesFormAuthenticator.GENERATED_AT_NOTE, Long.toString(recoveryAuthnCodesBean.getGeneratedAt()));
                 break;
             case LOGIN_RECOVERY_AUTHN_CODES_INPUT:
                 attributes.put("recoveryAuthnCodesInputBean", new RecoveryAuthnCodeInputLoginBean(session, realm, user));
@@ -459,8 +468,8 @@ protected void handleMessages(Locale locale, Properties messagesBundle) {
     }
 
     @Override
-    public String getMessage(String message) {
-        return formatMessage(new FormMessage(null, message));
+    public String getMessage(String message, Object... parameters) {
+        return formatMessage(new FormMessage(null, message, parameters));
     }
 
     /**
@@ -545,6 +554,14 @@ protected void createCommonAttributes(Theme theme, Locale locale, Properties mes
 
                 if (authenticationSession != null && authenticationSession.getAuthNote(Constants.KEY) != null) {
                     b.queryParam(Constants.KEY, authenticationSession.getAuthNote(Constants.KEY));
+                } else {
+                    HttpRequest request = session.getContext().getHttpRequest();
+                    MultivaluedMap<String, String> queryParameters = request.getUri().getQueryParameters();
+
+                    if (queryParameters != null && queryParameters.getFirst(Constants.TOKEN) != null) {
+                        // changing locale should forward the action token
+                        b.queryParam(Constants.TOKEN, queryParameters.getFirst(Constants.TOKEN));
+                    }
                 }
 
                 final var localeBean = new LocaleBean(realm, locale, b, messagesBundle);
@@ -588,6 +605,9 @@ protected Response processTemplate(Theme theme, String templateName, Locale loca
             if (!attributes.containsKey("templateName")) {
                 attributes.put("templateName", templateName);
             }
+
+            attributes.put("pageId", templateName.substring(0, templateName.length() - 4));
+
             String result = freeMarker.processTemplate(attributes, templateName, theme);
             Response.ResponseBuilder builder = Response.status(status == null ? Response.Status.OK : status).type(MediaType.TEXT_HTML_UTF_8_TYPE).language(locale).entity(result);
             for (Map.Entry<String, String> entry : httpResponseHeaders.entrySet()) {
diff --git a/services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java b/services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java
index 478757af9a3a..cdfe335691be 100644
--- a/services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java
+++ b/services/src/main/java/org/keycloak/forms/login/freemarker/model/RecoveryAuthnCodeInputLoginBean.java
@@ -5,16 +5,18 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
+import org.keycloak.models.utils.RecoveryAuthnCodesUtils;
+
+import java.util.Optional;
 
 public class RecoveryAuthnCodeInputLoginBean {
 
     private final int codeNumber;
 
     public RecoveryAuthnCodeInputLoginBean(KeycloakSession session, RealmModel realm, UserModel user) {
-        CredentialModel credentialModel = user.credentialManager().getStoredCredentialsByTypeStream(RecoveryAuthnCodesCredentialModel.TYPE)
-                                                 .findFirst().get();
+        Optional<CredentialModel> credentialModelOpt = RecoveryAuthnCodesUtils.getCredential(user);
 
-        RecoveryAuthnCodesCredentialModel recoveryCodeCredentialModel = RecoveryAuthnCodesCredentialModel.createFromCredentialModel(credentialModel);
+        RecoveryAuthnCodesCredentialModel recoveryCodeCredentialModel = RecoveryAuthnCodesCredentialModel.createFromCredentialModel(credentialModelOpt.get());
 
         this.codeNumber = recoveryCodeCredentialModel.getNextRecoveryAuthnCode().get().getNumber();
     }
diff --git a/services/src/main/java/org/keycloak/forms/login/freemarker/model/TotpLoginBean.java b/services/src/main/java/org/keycloak/forms/login/freemarker/model/TotpLoginBean.java
index 5f6f70ffd24c..8c455c9f3972 100644
--- a/services/src/main/java/org/keycloak/forms/login/freemarker/model/TotpLoginBean.java
+++ b/services/src/main/java/org/keycloak/forms/login/freemarker/model/TotpLoginBean.java
@@ -27,6 +27,7 @@
 import org.keycloak.credential.OTPCredentialProvider;
 import org.keycloak.credential.OTPCredentialProviderFactory;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.OTPPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
@@ -40,6 +41,7 @@ public class TotpLoginBean {
 
     private final String selectedCredentialId;
     private final List<OTPCredential> userOtpCredentials;
+    private OTPPolicy policy;
 
     public TotpLoginBean(KeycloakSession session, RealmModel realm, UserModel user, String selectedCredentialId) {
 
@@ -57,6 +59,7 @@ public TotpLoginBean(KeycloakSession session, RealmModel realm, UserModel user,
         }
 
         this.selectedCredentialId = selectedCredentialId;
+        this.policy = realm.getOTPPolicy();
     }
 
 
@@ -68,6 +71,9 @@ public String getSelectedCredentialId() {
         return selectedCredentialId;
     }
 
+    public OTPPolicy getPolicy() {
+        return policy;
+    }
 
     public static class OTPCredential {
 
diff --git a/services/src/main/java/org/keycloak/headers/DefaultSecurityHeadersProvider.java b/services/src/main/java/org/keycloak/headers/DefaultSecurityHeadersProvider.java
index 385446435688..aa49f89f4cfe 100644
--- a/services/src/main/java/org/keycloak/headers/DefaultSecurityHeadersProvider.java
+++ b/services/src/main/java/org/keycloak/headers/DefaultSecurityHeadersProvider.java
@@ -87,7 +87,6 @@ public void addHeaders(ContainerRequestContext requestContext, ContainerResponse
     private void addGenericHeaders(MultivaluedMap<String, Object> headers) {
         addHeader(BrowserSecurityHeaders.STRICT_TRANSPORT_SECURITY, headers);
         addHeader(BrowserSecurityHeaders.X_CONTENT_TYPE_OPTIONS, headers);
-        addHeader(BrowserSecurityHeaders.X_XSS_PROTECTION, headers);
         addHeader(BrowserSecurityHeaders.REFERRER_POLICY, headers);
     }
 
@@ -95,7 +94,6 @@ private void addRestHeaders(MultivaluedMap<String, Object> headers) {
         addHeader(BrowserSecurityHeaders.STRICT_TRANSPORT_SECURITY, headers);
         addHeader(BrowserSecurityHeaders.X_FRAME_OPTIONS, headers);
         addHeader(BrowserSecurityHeaders.X_CONTENT_TYPE_OPTIONS, headers);
-        addHeader(BrowserSecurityHeaders.X_XSS_PROTECTION, headers);
         addHeader(BrowserSecurityHeaders.REFERRER_POLICY, headers);
     }
 
@@ -145,7 +143,7 @@ private boolean isEmptyMediaTypeAllowed(ContainerRequestContext requestContext,
             }
             int status = responseContext.getStatus();
             if (status == 201 || status == 204 ||
-                status == 301 || status == 302 || status == 303 || status == 307 || status == 308 ||
+                status == 301 || status == 302 || status == 303 || status == 304 || status == 307 || status == 308 ||
                 status == 400 || status == 401 || status == 403 || status == 404) {
                 return true;
             }
diff --git a/services/src/main/java/org/keycloak/jose/jws/DefaultTokenManager.java b/services/src/main/java/org/keycloak/jose/jws/DefaultTokenManager.java
index d99927def230..4efefe2d3eda 100644
--- a/services/src/main/java/org/keycloak/jose/jws/DefaultTokenManager.java
+++ b/services/src/main/java/org/keycloak/jose/jws/DefaultTokenManager.java
@@ -19,6 +19,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.Token;
 import org.keycloak.TokenCategory;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.crypto.CekManagementProvider;
@@ -39,16 +40,19 @@
 import org.keycloak.keys.loader.PublicKeyStorageManager;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientSessionContext;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.TokenManager;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.ProtocolMapperUtils;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.LogoutTokenMapper;
 import org.keycloak.representations.LogoutToken;
+import org.keycloak.services.util.DefaultClientSessionContext;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
 
@@ -238,6 +242,11 @@ public String encodeAndEncrypt(Token token) {
 
     private String type(TokenCategory category) {
         switch (category) {
+            case ACCESS:
+                ClientModel client = session.getContext().getClient();
+                return client != null && OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRfc9068AccessTokenHeaderType()
+                    ? TokenUtil.TOKEN_TYPE_JWT_ACCESS_TOKEN
+                    : "JWT";
             case LOGOUT:
                 return TokenUtil.TOKEN_TYPE_JWT_LOGOUT_TOKEN;
             default:
@@ -341,7 +350,7 @@ private String getEncryptAlgorithm(String clientAttribute, String defaultValue)
     public LogoutToken initLogoutToken(ClientModel client, UserModel user,
                                        AuthenticatedClientSessionModel clientSession) {
         LogoutToken token = new LogoutToken();
-        token.id(KeycloakModelUtils.generateId());
+        token.id(SecretGenerator.getInstance().generateSecureID());
         token.issuedNow();
         // From the spec "OpenID Connect Back-Channel Logout 1.0 incorporating errata set 1" at https://openid.net/specs/openid-connect-backchannel-1_0.html
         // "OPs are encouraged to use short expiration times in Logout Tokens, preferably at most two minutes in the future [...]"
@@ -359,6 +368,16 @@ public LogoutToken initLogoutToken(ClientModel client, UserModel user,
         }
         token.setSubject(user.getId());
 
+        // adjust the subject in the logout token in case we have an PairwiseSubMapper
+        ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionScopeParameter(clientSession, session);
+        ProtocolMapperUtils
+            .getSortedProtocolMappers(session, clientSessionCtx)
+            .filter(mapperEntry -> mapperEntry.getValue() instanceof LogoutTokenMapper)
+            .forEach(mapperEntry -> {
+                LogoutTokenMapper mapper = (LogoutTokenMapper) mapperEntry.getValue();
+                mapper.transformLogoutToken(token, mapperEntry.getKey(), session, clientSession.getUserSession(), clientSessionCtx);
+            });
+
         return token;
     }
 }
diff --git a/services/src/main/java/org/keycloak/locale/DefaultLocaleSelectorProvider.java b/services/src/main/java/org/keycloak/locale/DefaultLocaleSelectorProvider.java
index 20a63121aee6..33a4cb51da9d 100644
--- a/services/src/main/java/org/keycloak/locale/DefaultLocaleSelectorProvider.java
+++ b/services/src/main/java/org/keycloak/locale/DefaultLocaleSelectorProvider.java
@@ -43,11 +43,11 @@ public DefaultLocaleSelectorProvider(KeycloakSession session) {
 
     @Override
     public Locale resolveLocale(RealmModel realm, UserModel user) {
-        return resolveLocale(realm, user, null);
+        return resolveLocale(realm, user, false);
     }
 
     @Override
-    public Locale resolveLocale(RealmModel realm, UserModel user, Theme.Type themeType) {
+    public Locale resolveLocale(RealmModel realm, UserModel user, boolean ignoreAcceptLanguageHeader) {
         HttpHeaders requestHeaders = session.getContext().getRequestHeaders();
         AuthenticationSessionModel session = this.session.getContext().getAuthenticationSession();
 
@@ -55,7 +55,7 @@ public Locale resolveLocale(RealmModel realm, UserModel user, Theme.Type themeTy
             return Locale.ENGLISH;
         }
 
-        Locale userLocale = getUserLocale(realm, session, user, requestHeaders, themeType);
+        Locale userLocale = getUserLocale(realm, session, user, requestHeaders, ignoreAcceptLanguageHeader);
         if (userLocale != null) {
             return userLocale;
         }
@@ -68,7 +68,7 @@ public Locale resolveLocale(RealmModel realm, UserModel user, Theme.Type themeTy
         return Locale.ENGLISH;
     }
 
-    private Locale getUserLocale(RealmModel realm, AuthenticationSessionModel session, UserModel user, HttpHeaders requestHeaders, Theme.Type themeType) {
+    private Locale getUserLocale(RealmModel realm, AuthenticationSessionModel session, UserModel user, HttpHeaders requestHeaders, boolean ignoreAcceptLanguageHeader) {
         Locale locale;
 
         locale = getUserSelectedLocale(realm, session);
@@ -81,10 +81,6 @@ private Locale getUserLocale(RealmModel realm, AuthenticationSessionModel sessio
             return locale;
         }
 
-        if(Theme.Type.EMAIL.equals(themeType)) {
-            return null;
-        }
-
         locale = getClientSelectedLocale(realm, session);
         if (locale != null) {
             return locale;
@@ -95,7 +91,7 @@ private Locale getUserLocale(RealmModel realm, AuthenticationSessionModel sessio
             return locale;
         }
 
-        locale = getAcceptLanguageHeaderLocale(realm, requestHeaders);
+        locale = getAcceptLanguageHeaderLocale(realm, requestHeaders, ignoreAcceptLanguageHeader);
         if (locale != null) {
             return locale;
         }
@@ -151,7 +147,12 @@ private Locale getLocaleCookieSelection(RealmModel realm, HttpHeaders httpHeader
         return findLocale(realm, localeCookie);
     }
 
-    private Locale getAcceptLanguageHeaderLocale(RealmModel realm, HttpHeaders httpHeaders) {
+    private Locale getAcceptLanguageHeaderLocale(RealmModel realm, HttpHeaders httpHeaders, boolean ignoreAcceptLanguageHeader) {
+
+        if (ignoreAcceptLanguageHeader) {
+            return null;
+        }
+
         if (httpHeaders == null) {
             return null;
         }
diff --git a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationIdentityProvidersResource.java b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationIdentityProvidersResource.java
index 4634f30c022e..890d3209141a 100644
--- a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationIdentityProvidersResource.java
+++ b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationIdentityProvidersResource.java
@@ -32,7 +32,13 @@
 import java.util.stream.Stream;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.eclipse.microprofile.openapi.annotations.parameters.RequestBody;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.models.IdentityProviderModel;
@@ -69,8 +75,16 @@ public OrganizationIdentityProvidersResource(KeycloakSession session, Organizati
     @Operation(summary = "Adds the identity provider with the specified id to the organization",
         description = "Adds, or associates, an existing identity provider with the organization. If no identity provider is found, " +
                 "or if it is already associated with the organization, an error response is returned")
+    @RequestBody(description = "Payload should contain only id or alias of the identity provider to be associated with the organization " + 
+                "(id or alias with or without quotes). Surrounding whitespace characters will be trimmed.", required = true)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response addIdentityProvider(String id) {
-        id = id.replaceAll("^\"|\"$", ""); // fixes https://github.com/keycloak/keycloak/issues/34401
+        id = id.trim().replaceAll("^\"|\"$", ""); // fixes https://github.com/keycloak/keycloak/issues/34401
         
         try {
             IdentityProviderModel identityProvider = session.identityProviders().getByIdOrAlias(id);
@@ -94,6 +108,9 @@ public Response addIdentityProvider(String id) {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Returns all identity providers associated with the organization")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = IdentityProviderRepresentation.class, type = SchemaType.ARRAY)))
+    })
     public Stream<IdentityProviderRepresentation> getIdentityProviders() {
         return organization.getIdentityProviders().map(this::toRepresentation);
     }
@@ -106,6 +123,10 @@ public Stream<IdentityProviderRepresentation> getIdentityProviders() {
     @Operation(summary = "Returns the identity provider associated with the organization that has the specified alias",
         description = "Searches for an identity provider with the given alias. If one is found and is associated with the " +
                 "organization, it is returned. Otherwise, an error response with status NOT_FOUND is returned")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = IdentityProviderRepresentation.class))),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public IdentityProviderRepresentation getIdentityProvider(@PathParam("alias") String alias) {
         IdentityProviderModel broker = session.identityProviders().getByAlias(alias);
 
@@ -123,6 +144,11 @@ public IdentityProviderRepresentation getIdentityProvider(@PathParam("alias") St
     @Operation(summary = "Removes the identity provider with the specified alias from the organization",
         description = "Breaks the association between the identity provider and the organization. The provider itself is not deleted. " +
                 "If no provider is found, or if it is not currently associated with the org, an error response is returned")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Response delete(@PathParam("alias") String alias) {
         IdentityProviderModel broker = session.identityProviders().getByAlias(alias);
 
diff --git a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationMemberResource.java b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationMemberResource.java
index fe5fb887bdfd..3f8250966208 100644
--- a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationMemberResource.java
+++ b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationMemberResource.java
@@ -37,8 +37,14 @@
 import jakarta.ws.rs.core.Response.Status;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.parameters.RequestBody;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.events.admin.OperationType;
@@ -82,8 +88,15 @@ public OrganizationMemberResource(KeycloakSession session, OrganizationModel org
     @Operation(summary = "Adds the user with the specified id as a member of the organization", description = "Adds, or associates, " +
             "an existing user with the organization. If no user is found, or if it is already associated with the organization, " +
             "an error response is returned")
+    @RequestBody(description = "Payload should contain only id of the user to be added to the organization (UUID with or without quotes). " +
+            "Surrounding whitespace characters will be trimmed.", required = true)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response addMember(String id) {
-        id = id.replaceAll("^\"|\"$", ""); // fixes https://github.com/keycloak/keycloak/issues/34401
+        id = id.trim().replaceAll("^\"|\"$", ""); // fixes https://github.com/keycloak/keycloak/issues/34401
         
         UserModel user = session.users().getUserById(realm, id);
 
@@ -114,6 +127,12 @@ public Response addMember(String id) {
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Invites an existing user or sends a registration link to a new user, based on the provided e-mail address.",
             description = "If the user with the given e-mail address exists, it sends an invitation link, otherwise it sends a registration link.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "409", description = "Conflict"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response inviteUser(@FormParam("email") String email,
                                @FormParam("firstName") String firstName,
                                @FormParam("lastName") String lastName) {
@@ -125,6 +144,11 @@ public Response inviteUser(@FormParam("email") String email,
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Invites an existing user to the organization, using the specified user id")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response inviteExistingUser(@FormParam("id") String id) {
         return new OrganizationInvitationResource(session, organization, adminEvent).inviteExistingUser(id);
     }
@@ -134,6 +158,9 @@ public Response inviteExistingUser(@FormParam("id") String id) {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation( summary = "Returns a paginated list of organization members filtered according to the specified parameters")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = MemberRepresentation.class, type = SchemaType.ARRAY)))
+    })
     public Stream<MemberRepresentation> search(
             @Parameter(description = "A String representing either a member's username, e-mail, first name, or last name.") @QueryParam("search") String search,
             @Parameter(description = "Boolean which defines whether the param 'search' must match exactly or not") @QueryParam("exact") Boolean exact,
@@ -162,6 +189,10 @@ public Stream<MemberRepresentation> search(
     @Operation( summary = "Returns the member of the organization with the specified id", description = "Searches for a" +
             "user with the given id. If one is found, and is currently a member of the organization, returns it. Otherwise," +
             "an error response with status NOT_FOUND is returned")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = MemberRepresentation.class))),
+        @APIResponse(responseCode = "400", description = "Bad Request")
+    })
     public MemberRepresentation get(@PathParam("member-id") String memberId) {
         if (StringUtil.isBlank(memberId)) {
             throw ErrorResponse.error("id cannot be null", Status.BAD_REQUEST);
@@ -176,6 +207,10 @@ public MemberRepresentation get(@PathParam("member-id") String memberId) {
     @Operation(summary = "Removes the user with the specified id from the organization", description = "Breaks the association " +
             "between the user and organization. The user itself is deleted in case the membership is managed, otherwise the user is not deleted. " +
             "If no user is found, or if they are not a member of the organization, an error response is returned")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request")
+    })
     public Response delete(@PathParam("member-id") String memberId) {
         if (StringUtil.isBlank(memberId)) {
             throw ErrorResponse.error("id cannot be null", Status.BAD_REQUEST);
@@ -202,14 +237,22 @@ public Response delete(@PathParam("member-id") String memberId) {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Returns the organizations associated with the user that has the specified id")
-    public Stream<OrganizationRepresentation> getOrganizations(@PathParam("member-id") String memberId) {
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = OrganizationRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "400", description = "Bad Request")
+    })
+    public Stream<OrganizationRepresentation> getOrganizations(
+            @PathParam("member-id") String memberId,
+            @Parameter(description = "if false, return the full representation. Otherwise, only the basic fields are returned.")
+            @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation) {
         if (StringUtil.isBlank(memberId)) {
             throw ErrorResponse.error("id cannot be null", Status.BAD_REQUEST);
         }
 
         UserModel member = getUser(memberId);
 
-        return provider.getByMember(member).map(ModelToRepresentation::toRepresentation);
+        return provider.getByMember(member)
+                .map(model -> ModelToRepresentation.toRepresentation(model, briefRepresentation));
     }
 
     @Path("count")
@@ -218,6 +261,9 @@ public Stream<OrganizationRepresentation> getOrganizations(@PathParam("member-id
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation( summary = "Returns number of members in the organization.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = Long.class)))
+    })
     public Long count() {
         return provider.getMembersCount(organization);
     }
diff --git a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationResource.java b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationResource.java
index 2b439dc001c1..fefeb22e4c9e 100644
--- a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationResource.java
+++ b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationResource.java
@@ -28,6 +28,10 @@
 import jakarta.ws.rs.core.Response.Status;
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.events.admin.OperationType;
@@ -45,6 +49,8 @@
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
 
+import java.util.Objects;
+
 @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "")
 public class OrganizationResource {
 
@@ -65,13 +71,20 @@ public OrganizationResource(KeycloakSession session, OrganizationModel organizat
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Returns the organization representation")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = OrganizationRepresentation.class)))
+    })
     public OrganizationRepresentation get() {
-        return ModelToRepresentation.toRepresentation(organization);
+        return ModelToRepresentation.toRepresentation(organization, false);
     }
 
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Deletes the organization")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request")
+    })
     public Response delete() {
         boolean removed = provider.remove(organization);
         if (removed) {
@@ -86,7 +99,18 @@ public Response delete() {
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Updates the organization")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response update(OrganizationRepresentation organizationRep) {
+        // attempt to change organization name to an existing organization name
+        if (!Objects.equals(organization.getName(), organizationRep.getName()) &&
+                provider.getAllStream(organizationRep.getName(), true, -1, -1).findAny().isPresent()) {
+            throw ErrorResponse.error("A organization with the same name already exists.", Status.CONFLICT);
+        }
+
         try {
             OrganizationsValidation.validateUrl(organizationRep.getRedirectUrl());
             RepresentationToModel.toModel(organizationRep, organization);
diff --git a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationsResource.java b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationsResource.java
index c73e447211dd..bf9451d1f6cb 100644
--- a/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationsResource.java
+++ b/services/src/main/java/org/keycloak/organization/admin/resource/OrganizationsResource.java
@@ -33,8 +33,13 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -54,7 +59,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.utils.ReservedCharValidator;
 import org.keycloak.utils.SearchQueryUtils;
 import org.keycloak.utils.StringUtil;
@@ -86,6 +91,11 @@ public OrganizationsResource(KeycloakSession session, AdminPermissionEvaluator a
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation( summary = "Creates a new organization")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Response create(OrganizationRepresentation organization) {
         auth.realm().requireManageRealm();
         Organizations.checkEnabled(provider);
@@ -128,13 +138,18 @@ public Response create(OrganizationRepresentation organization) {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Returns a paginated list of organizations filtered according to the specified parameters")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = OrganizationRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<OrganizationRepresentation> search(
             @Parameter(description = "A String representing either an organization name or domain") @QueryParam("search") String search,
             @Parameter(description = "A query to search for custom attributes, in the format 'key1:value2 key2:value2'") @QueryParam("q") String searchQuery,
             @Parameter(description = "Boolean which defines whether the param 'search' must match exactly or not") @QueryParam("exact") Boolean exact,
             @Parameter(description = "The position of the first result to be processed (pagination offset)") @QueryParam("first") @DefaultValue("0") Integer first,
             @Parameter(description = "The maximum number of results to be returned - defaults to 10") @QueryParam("max") @DefaultValue("10") Integer max,
-            @Parameter(description = "if true, return the full representation. Otherwise, only the basic fields are returned.") @QueryParam("briefRepresentation") @DefaultValue("false") boolean briefRepresentation
+            @Parameter(description = "if false, return the full representation. Otherwise, only the basic fields are returned.") @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation
     ) {
         auth.realm().requireManageRealm();
         Organizations.checkEnabled(provider);
@@ -142,9 +157,9 @@ public Stream<OrganizationRepresentation> search(
         // check if are searching orgs by attribute.
         if (StringUtil.isNotBlank(searchQuery)) {
             Map<String, String> attributes = SearchQueryUtils.getFields(searchQuery);
-            return provider.getAllStream(attributes, first, max).map(model -> ModelToRepresentation.toBriefRepresentation(model, briefRepresentation));
+            return provider.getAllStream(attributes, first, max).map(model -> ModelToRepresentation.toRepresentation(model, briefRepresentation));
         } else {
-            return provider.getAllStream(search, exact, first, max).map(model -> ModelToRepresentation.toBriefRepresentation(model, briefRepresentation));
+            return provider.getAllStream(search, exact, first, max).map(model -> ModelToRepresentation.toRepresentation(model, briefRepresentation));
         }
     }
 
@@ -171,13 +186,46 @@ public OrganizationResource get(@PathParam("org-id") String orgId) {
         return new OrganizationResource(session, organizationModel, adminEvent);
     }
 
+    /**
+     * Returns the organizations counts.
+     *
+     * @return
+     */
+    @GET
+    @NoCache
+    @Path("count")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
+    @Operation(summary = "Returns the organizations counts.")
+    public long getOrganizationCount(
+            @Parameter(description = "A String representing either an organization name or domain") @QueryParam("search") String search,
+            @Parameter(description = "A query to search for custom attributes, in the format 'key1:value2 key2:value2'") @QueryParam("q") String searchQuery,
+            @Parameter(description = "Boolean which defines whether the param 'search' must match exactly or not") @QueryParam("exact") Boolean exact
+    ) {
+        auth.realm().requireManageRealm();
+        Organizations.checkEnabled(provider);
+
+        if (StringUtil.isNotBlank(searchQuery)) {
+            Map<String, String> attributes = SearchQueryUtils.getFields(searchQuery);
+            return provider.count(attributes);
+        }
+        return provider.count(search, exact);
+    }
+
     @Path("members/{member-id}/organizations")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ORGANIZATIONS)
     @Operation(summary = "Returns the organizations associated with the user that has the specified id")
-    public Stream<OrganizationRepresentation> getOrganizations(@PathParam("member-id") String memberId) {
-        return new OrganizationMemberResource(session, null, adminEvent).getOrganizations(memberId);
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = OrganizationRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "400", description = "Bad Request")
+    })
+    public Stream<OrganizationRepresentation> getOrganizations(
+            @PathParam("member-id") String memberId,
+            @Parameter(description = "if false, return the full representation. Otherwise, only the basic fields are returned.")
+            @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation) {
+        return new OrganizationMemberResource(session, null, adminEvent).getOrganizations(memberId, briefRepresentation);
     }
 }
diff --git a/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticator.java b/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticator.java
index a8c268f9659f..b791480fe46f 100644
--- a/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticator.java
+++ b/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticator.java
@@ -18,9 +18,12 @@
 package org.keycloak.organization.authentication.authenticators.browser;
 
 import static org.keycloak.authentication.AuthenticatorUtil.isSSOAuthentication;
+import static org.keycloak.models.OrganizationDomainModel.ANY_DOMAIN;
+import static org.keycloak.models.utils.KeycloakModelUtils.findUserByNameOrEmail;
 import static org.keycloak.organization.utils.Organizations.getEmailDomain;
 import static org.keycloak.organization.utils.Organizations.isEnabledAndOrganizationsPresent;
 import static org.keycloak.organization.utils.Organizations.resolveHomeBroker;
+import static org.keycloak.utils.StringUtil.isNotBlank;
 
 import java.util.List;
 import java.util.Map;
@@ -29,24 +32,29 @@
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
+import jakarta.ws.rs.core.MultivaluedHashMap;
 import jakarta.ws.rs.core.MultivaluedMap;
-import org.keycloak.OAuth2Constants;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.WebAuthnConstants;
 import org.keycloak.authentication.AuthenticationFlowContext;
 import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.FlowStatus;
 import org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticator;
+import org.keycloak.authentication.authenticators.browser.WebAuthnConditionalUIAuthenticator;
 import org.keycloak.email.freemarker.beans.ProfileBean;
 import org.keycloak.forms.login.LoginFormsProvider;
 import org.keycloak.forms.login.freemarker.model.AuthenticationContextBean;
 import org.keycloak.forms.login.freemarker.model.IdentityProviderBean;
 import org.keycloak.http.HttpRequest;
+import org.keycloak.models.AuthenticatorConfigModel;
 import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.OrganizationDomainModel;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.OrganizationModel.IdentityProviderRedirectMode;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.UserProvider;
 import org.keycloak.models.utils.FormMessage;
 import org.keycloak.organization.OrganizationProvider;
 import org.keycloak.organization.forms.login.freemarker.model.OrganizationAwareAuthenticationContextBean;
@@ -54,14 +62,19 @@
 import org.keycloak.organization.forms.login.freemarker.model.OrganizationAwareRealmBean;
 import org.keycloak.organization.protocol.mappers.oidc.OrganizationScope;
 import org.keycloak.organization.utils.Organizations;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.sessions.AuthenticationSessionModel;
 
 public class OrganizationAuthenticator extends IdentityProviderAuthenticator {
 
+    private static final String LOGIN_HINT_ALREADY_HANDLED = "loginHintAlreadyHandled";
+
     private final KeycloakSession session;
+    private final WebAuthnConditionalUIAuthenticator webauthnAuth;
 
     public OrganizationAuthenticator(KeycloakSession session) {
         this.session = session;
+        this.webauthnAuth = new WebAuthnConditionalUIAuthenticator(session, (context) -> createLoginForm(context));
     }
 
     @Override
@@ -73,6 +86,16 @@ public void authenticate(AuthenticationFlowContext context) {
             return;
         }
 
+        String loginHint = session.getContext().getAuthenticationSession().getClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM);
+
+        if (isNotBlank(loginHint) && !"true".equals(context.getAuthenticationSession().getClientNote(LOGIN_HINT_ALREADY_HANDLED))) {
+            UserModel user = resolveUser(context, loginHint);
+            context.setUser(user);
+
+            // set auth note to true to handle login_hint only once, we don't want to handle it again after a flow restart
+            context.getAuthenticationSession().setClientNote(LOGIN_HINT_ALREADY_HANDLED, "true");
+        }
+
         OrganizationModel organization = Organizations.resolveOrganization(session);
 
         if (organization == null) {
@@ -89,6 +112,17 @@ public void authenticate(AuthenticationFlowContext context) {
     public void action(AuthenticationFlowContext context) {
         HttpRequest request = context.getHttpRequest();
         MultivaluedMap<String, String> parameters = request.getDecodedFormParameters();
+
+        // check if it's a webauthn submission and perform the webauth login
+        if (webauthnAuth.isPasskeysEnabled() && (parameters.containsKey(WebAuthnConstants.AUTHENTICATOR_DATA)
+                || parameters.containsKey(WebAuthnConstants.ERROR))) {
+            webauthnAuth.action(context);
+            if (FlowStatus.SUCCESS != context.getStatus()) {
+                // if failure doing webauthn authentication return error; continue if success checking organizations
+                return;
+            }
+        }
+
         String username = parameters.getFirst(UserModel.USERNAME);
         RealmModel realm = context.getRealm();
         UserModel user = resolveUser(context, username);
@@ -99,14 +133,27 @@ public void action(AuthenticationFlowContext context) {
             if (shouldUserSelectOrganization(context, user)) {
                 return;
             }
+
+            if (isMembershipRequired(context, null, user)) {
+                return;
+            }
+
+            clearAuthenticationSession(context);
             // request does not map to any organization, go to the next step/sub-flow
             context.attempted();
             return;
         }
 
+        // remember the organization during the lifetime of the authentication session
+        AuthenticationSessionModel authenticationSession = context.getAuthenticationSession();
+        authenticationSession.setAuthNote(OrganizationModel.ORGANIZATION_ATTRIBUTE, organization.getId());
         // make sure the organization is set to the session to make it available to templates
         session.getContext().setOrganization(organization);
 
+        if (isMembershipRequired(context, organization, user)) {
+            return;
+        }
+
         if (tryRedirectBroker(context, organization, user, username, domain)) {
             return;
         }
@@ -122,7 +169,7 @@ public void action(AuthenticationFlowContext context) {
             return;
         }
 
-        if (isSSOAuthentication(context.getAuthenticationSession())) {
+        if (isSSOAuthentication(authenticationSession)) {
             // if re-authenticating in the scope of an organization
             context.success();
         } else {
@@ -138,14 +185,15 @@ public boolean configuredFor(KeycloakSession session, RealmModel realm, UserMode
     private OrganizationModel resolveOrganization(UserModel user, String domain) {
         KeycloakContext context = session.getContext();
         HttpRequest request = context.getHttpRequest();
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
         MultivaluedMap<String, String> parameters = request.getDecodedFormParameters();
+        // parameter from the organization selection page
         List<String> alias = parameters.getOrDefault(OrganizationModel.ORGANIZATION_ATTRIBUTE, List.of());
-        AuthenticationSessionModel authSession = context.getAuthenticationSession();
 
         if (alias.isEmpty()) {
             OrganizationModel organization = Organizations.resolveOrganization(session, user, domain);
 
-            if (organization != null) {
+            if (isSSOAuthentication(authSession) && organization != null) {
                 // make sure the organization selected by the user is available from the client session when running mappers and issuing tokens
                 authSession.setClientNote(OrganizationModel.ORGANIZATION_ATTRIBUTE, organization.getId());
             }
@@ -167,20 +215,18 @@ private OrganizationModel resolveOrganization(UserModel user, String domain) {
     }
 
     private boolean shouldUserSelectOrganization(AuthenticationFlowContext context, UserModel user) {
-        OrganizationProvider provider = getOrganizationProvider();
-        AuthenticationSessionModel authSession = context.getAuthenticationSession();
-        String rawScope = authSession.getClientNote(OAuth2Constants.SCOPE);
-        OrganizationScope scope = OrganizationScope.valueOfScope(rawScope);
-
-        if (!OrganizationScope.ANY.equals(scope) || user == null) {
+        if (user == null || !OrganizationScope.ANY.equals(OrganizationScope.valueOfScope(session))) {
             return false;
         }
 
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
+
         if (authSession.getClientNote(OrganizationModel.ORGANIZATION_ATTRIBUTE) != null) {
             // organization already selected
             return false;
         }
 
+        OrganizationProvider provider = getOrganizationProvider();
         Stream<OrganizationModel> organizations = provider.getByMember(user);
 
         if (organizations.count() > 1) {
@@ -195,6 +241,7 @@ public Map<String, Object> apply(Map<String, Object> attributes) {
                     return attributes;
                 }
             });
+            clearAuthenticationSession(context);
             context.challenge(form.createForm("select-organization.ftl"));
             return true;
         }
@@ -216,6 +263,8 @@ private boolean tryRedirectBroker(AuthenticationFlowContext context, Organizatio
             return true;
         }
 
+        domain = domain == null ? getEmailDomain(user) : domain;
+
         return redirect(context, organization, username, domain);
     }
 
@@ -224,18 +273,26 @@ private boolean redirect(AuthenticationFlowContext context, OrganizationModel or
             return false;
         }
 
-        List<IdentityProviderModel> brokers = organization.getIdentityProviders().toList();
+        // first look for an IDP that matches exactly the specified domain (case-insensitive)
+        IdentityProviderModel idp = organization.getIdentityProviders()
+                .filter(broker -> IdentityProviderRedirectMode.EMAIL_MATCH.isSet(broker) &&
+                    domain.equalsIgnoreCase(broker.getConfig().get(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE))).findFirst().orElse(null);
 
-        for (IdentityProviderModel broker : brokers) {
-            if (IdentityProviderRedirectMode.EMAIL_MATCH.isSet(broker)) {
-                String idpDomain = broker.getConfig().get(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
+        if (idp != null) {
+            // redirect the user using the broker that matches the specified domain
+            redirect(context, idp.getAlias(), username);
+            return true;
+        }
 
-                if (domain.equals(idpDomain)) {
-                    // redirect the user using the broker that matches the email domain
-                    redirect(context, broker.getAlias(), username);
-                    return true;
-                }
-            }
+        // look for an idp that can match any of the org domains
+        idp = organization.getIdentityProviders().filter(IdentityProviderRedirectMode.EMAIL_MATCH::isSet)
+                .filter(broker -> ANY_DOMAIN.equals(broker.getConfig().get(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE)))
+                .filter(broker -> organization.getDomains().map(OrganizationDomainModel::getName).anyMatch(domain::equals))
+                .findFirst().orElse(null);
+
+        if (idp != null) {
+            redirect(context, idp.getAlias(), username);
+            return true;
         }
 
         return false;
@@ -250,10 +307,11 @@ private UserModel resolveUser(AuthenticationFlowContext context, String username
             return null;
         }
 
-        UserProvider users = session.users();
         RealmModel realm = session.getContext().getRealm();
-        UserModel user = Optional.ofNullable(users.getUserByEmail(realm, username)).orElseGet(() -> users.getUserByUsername(realm, username));
+        UserModel user = findUserByNameOrEmail(session, realm, username);
 
+        // make sure the organization will be resolved based on the username provided
+        clearAuthenticationSession(context);
         context.setUser(user);
 
         return user;
@@ -293,23 +351,17 @@ private void unknownUserChallenge(AuthenticationFlowContext context, Organizatio
     }
 
     private void initialChallenge(AuthenticationFlowContext context) {
+        AuthenticationSessionModel authenticationSession = context.getAuthenticationSession();
         UserModel user = context.getUser();
 
         if (user == null) {
-            // the default challenge won't show any broker but just the identity-first login page and the option to try a different authentication mechanism
-            LoginFormsProvider form = context.form()
-                    .setAttributeMapper(attributes -> {
-                        attributes.computeIfPresent("social",
-                                (key, bean) -> new OrganizationAwareIdentityProviderBean((IdentityProviderBean) bean, false, true)
-                        );
-                        attributes.computeIfPresent("auth",
-                                (key, bean) -> new OrganizationAwareAuthenticationContextBean((AuthenticationContextBean) bean, false)
-                        );
-                        return attributes;
-                    });
+            // setup webauthn data when the user is not already selected
+            if (webauthnAuth.isPasskeysEnabled()) {
+                webauthnAuth.fillContextForm(context);
+            }
 
-            context.challenge(form.createLoginUsername());
-        } else if (isSSOAuthentication(context.getAuthenticationSession())) {
+            context.challenge(createLoginForm(context));
+        } else if (isSSOAuthentication(authenticationSession)) {
             if (shouldUserSelectOrganization(context, user)) {
                 return;
             }
@@ -322,6 +374,28 @@ private void initialChallenge(AuthenticationFlowContext context) {
         }
     }
 
+    private Response createLoginForm(AuthenticationFlowContext context) {
+        // the default challenge won't show any broker but just the identity-first login page and the option to try a different authentication mechanism
+        LoginFormsProvider form = context.form()
+                .setAttributeMapper(attributes -> {
+                    attributes.computeIfPresent("social",
+                            (key, bean) -> new OrganizationAwareIdentityProviderBean((IdentityProviderBean) bean, false, true)
+                    );
+                    attributes.computeIfPresent("auth",
+                            (key, bean) -> new OrganizationAwareAuthenticationContextBean((AuthenticationContextBean) bean, false)
+                    );
+                    return attributes;
+                });
+
+        String loginHint = context.getAuthenticationSession().getClientNote(OIDCLoginProtocol.LOGIN_HINT_PARAM);
+
+        if (loginHint != null) {
+            form.setFormData(new MultivaluedHashMap<>(Map.of(UserModel.USERNAME, loginHint)));
+        }
+
+        return form.createLoginUsername();
+    }
+
     private boolean hasPublicBrokers(OrganizationModel organization) {
         return organization.getIdentityProviders().anyMatch(Predicate.not(IdentityProviderModel::isHideOnLogin));
     }
@@ -329,4 +403,58 @@ private boolean hasPublicBrokers(OrganizationModel organization) {
     private OrganizationProvider getOrganizationProvider() {
         return session.getProvider(OrganizationProvider.class);
     }
+
+    private boolean isRequiresMembership(AuthenticationFlowContext context) {
+        return Boolean.parseBoolean(getConfig(context).getOrDefault(OrganizationAuthenticatorFactory.REQUIRES_USER_MEMBERSHIP, Boolean.FALSE.toString()));
+    }
+
+    private Map<String, String> getConfig(AuthenticationFlowContext context) {
+        return Optional.ofNullable(context.getAuthenticatorConfig()).map(AuthenticatorConfigModel::getConfig).orElse(Map.of());
+    }
+
+    private void clearAuthenticationSession(AuthenticationFlowContext context) {
+        AuthenticationSessionModel authenticationSession = context.getAuthenticationSession();
+        authenticationSession.removeAuthNote(OrganizationModel.ORGANIZATION_ATTRIBUTE);
+    }
+
+    private boolean isMembershipRequired(AuthenticationFlowContext context, OrganizationModel organization, UserModel user) {
+        if (user == null || !isRequiresMembership(context)) {
+            return false;
+        }
+
+        if (organization == null) {
+            OrganizationScope scope = OrganizationScope.valueOfScope(session);
+
+            if (OrganizationScope.SINGLE.equals(scope)) {
+                organization = scope.resolveOrganizations(session).findAny().orElse(null);
+            }
+        }
+
+        if (organization != null && organization.isMember(user)) {
+            return false;
+        }
+
+        // do not show try another way
+        context.setAuthenticationSelections(List.of());
+
+        LoginFormsProvider form = context.form();
+        String errorMessage;
+        String failureMessage;
+
+        if (organization == null) {
+            errorMessage = "notMemberOfAnyOrganization";
+            failureMessage = "User " + user.getUsername() + " not a member of any organization";
+            form.setError(errorMessage);
+        } else {
+            errorMessage = "notMemberOfOrganization";
+            failureMessage = "User " + user.getUsername() + " not a member of organization " + organization.getAlias();
+            form.setError(errorMessage, organization.getName());
+        }
+
+        context.failure(AuthenticationFlowError.GENERIC_AUTHENTICATION_ERROR,
+                form.createErrorPage(Response.Status.FORBIDDEN),
+                failureMessage, errorMessage);
+
+        return true;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticatorFactory.java b/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticatorFactory.java
index b3231f798d28..8f79ce35f94c 100644
--- a/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticatorFactory.java
+++ b/services/src/main/java/org/keycloak/organization/authentication/authenticators/browser/OrganizationAuthenticatorFactory.java
@@ -17,7 +17,11 @@
 
 package org.keycloak.organization.authentication.authenticators.browser;
 
+import static org.keycloak.provider.ProviderConfigProperty.BOOLEAN_TYPE;
+
+import java.util.Collections;
 import java.util.List;
+import java.util.Set;
 
 import org.keycloak.Config.Scope;
 import org.keycloak.authentication.Authenticator;
@@ -25,6 +29,7 @@
 import org.keycloak.common.Profile;
 import org.keycloak.common.Profile.Feature;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.provider.ProviderConfigProperty;
 
@@ -34,6 +39,7 @@
 public class OrganizationAuthenticatorFactory extends IdentityProviderAuthenticatorFactory implements EnvironmentDependentProviderFactory {
 
     public static final String ID = "organization";
+    public static final String REQUIRES_USER_MEMBERSHIP = "requiresUserMembership";
 
     @Override
     public String getId() {
@@ -61,7 +67,14 @@ public boolean isSupported(Scope config) {
     }
 
     @Override
-    public List<ProviderConfigProperty> getConfigProperties() { // org identity-first login
-        return List.of();
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return Collections.singletonList(new ProviderConfigProperty(REQUIRES_USER_MEMBERSHIP, "Requires user membership", "Enforces that users authenticating in the scope of an organization are members. If not a member, the user won't be able to proceed authenticating to the realm", BOOLEAN_TYPE, null));
+    }
+
+    @Override
+    public Set<String> getOptionalReferenceCategories() {
+        return Profile.isFeatureEnabled(Profile.Feature.PASSKEYS)
+                ? Collections.singleton(WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                : super.getOptionalReferenceCategories();
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationMembershipMapper.java b/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationMembershipMapper.java
index 3e5f1137c62a..9e468afc5ca8 100644
--- a/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationMembershipMapper.java
+++ b/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationMembershipMapper.java
@@ -36,6 +36,7 @@
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
@@ -122,8 +123,8 @@ protected void setClaim(IDToken token, ProtocolMapperModel model, UserSessionMod
         KeycloakContext context = session.getContext();
         RealmModel realm = context.getRealm();
         ProtocolMapperModel effectiveModel = getEffectiveModel(session, realm, model);
-
-        Object claim = resolveValue(effectiveModel, organizations.toList());
+        UserModel user = userSession.getUser();
+        Object claim = resolveValue(effectiveModel, user, organizations.toList());
 
         if (claim == null) {
             return;
@@ -133,18 +134,17 @@ protected void setClaim(IDToken token, ProtocolMapperModel model, UserSessionMod
     }
 
     private Stream<OrganizationModel> resolveFromRequestedScopes(KeycloakSession session, UserSessionModel userSession, ClientSessionContext context) {
-        String rawScopes = context.getScopeString();
-        OrganizationScope scope = OrganizationScope.valueOfScope(rawScopes);
+        String rawScopes = context.getScopeString(true);
+        OrganizationScope scope = OrganizationScope.valueOfScope(session, rawScopes);
 
         if (scope == null) {
             return Stream.empty();
         }
 
         return scope.resolveOrganizations(userSession.getUser(), rawScopes, session);
-
     }
 
-    private Object resolveValue(ProtocolMapperModel model, List<OrganizationModel> organizations) {
+    private Object resolveValue(ProtocolMapperModel model, UserModel user, List<OrganizationModel> organizations) {
         if (organizations.isEmpty()) {
             return null;
         }
@@ -156,7 +156,7 @@ private Object resolveValue(ProtocolMapperModel model, List<OrganizationModel> o
         Map<String, Map<String, Object>> value = new HashMap<>();
 
         for (OrganizationModel o : organizations) {
-            if (o == null || !o.isEnabled()) {
+            if (o == null || !o.isEnabled() || user == null || !o.isMember(user)) {
                 continue;
             }
 
diff --git a/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationScope.java b/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationScope.java
index 9db91d93f989..43a819383fd0 100644
--- a/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationScope.java
+++ b/services/src/main/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationScope.java
@@ -17,14 +17,15 @@
 
 package org.keycloak.organization.protocol.mappers.oidc;
 
+import static org.keycloak.models.ClientScopeModel.VALUE_SEPARATOR;
 import static org.keycloak.organization.utils.Organizations.getProvider;
+import static org.keycloak.utils.StringUtil.isBlank;
 
-import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
-import java.util.function.BiFunction;
 import java.util.function.Predicate;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -36,13 +37,14 @@
 import org.keycloak.models.ClientScopeDecorator;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientSessionContext;
-import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OrganizationModel;
+import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.organization.utils.Organizations;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
 import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.utils.StringUtil;
 
 /**
@@ -65,7 +67,7 @@ public enum OrganizationScope {
                 return getProvider(session).getByMember(user);
             },
             (organizations) -> true,
-            (current, previous) -> valueOfScope(current) == null ? previous : current),
+            (session, current, previous) -> valueOfScope(session, current) == null ? previous : current),
 
     /**
      * Maps to a specific organization the user is a member. When this scope is requested by clients, only the
@@ -73,8 +75,8 @@ public enum OrganizationScope {
      */
     SINGLE(StringUtil::isNotBlank,
             (user, scopes, session) -> {
-                OrganizationModel organization = parseScopeParameter(scopes)
-                        .map(OrganizationScope::parseScopeValue)
+                OrganizationModel organization = parseScopeParameter(session, scopes)
+                        .map((String scope) -> parseScopeValue(session, scope))
                         .map(alias -> getProvider(session).getByAlias(alias))
                         .filter(Objects::nonNull)
                         .findAny()
@@ -91,12 +93,12 @@ public enum OrganizationScope {
                 return Stream.empty();
             },
             (organizations) -> organizations.findAny().isPresent(),
-            (current, previous) -> {
+            (session, current, previous) -> {
                 if (current.equals(previous)) {
                     return current;
                 }
 
-                if (OrganizationScope.ALL.equals(valueOfScope(current))) {
+                if (OrganizationScope.ALL.equals(valueOfScope(session, current))) {
                     return previous;
                 }
 
@@ -136,19 +138,22 @@ public enum OrganizationScope {
                 return organizations.stream().filter(o -> o.getId().equals(orgId));
             },
             (organizations) -> true,
-            (current, previous) -> {
+            (session, current, previous) -> {
                 if (current.equals(previous)) {
                     return current;
                 }
 
-                if (OrganizationScope.ALL.equals(valueOfScope(current))) {
+                if (OrganizationScope.ALL.equals(valueOfScope(session, current))) {
                     return previous;
                 }
 
                 return null;
             });
 
-    private static final Pattern SCOPE_PATTERN = Pattern.compile(OIDCLoginProtocolFactory.ORGANIZATION + ":*".replace("*", "(.*)"));
+    private static final String ORGANIZATION_SCOPES_SESSION_ATTRIBUTE = "kc.org.client.scope";
+    private static final String UNSUPPORTED_ORGANIZATION_SCOPES_ATTRIBUTE = "kc.org.client.scope.unsupported";
+    private static final Pattern SCOPE_PATTERN = Pattern.compile("(.*)" + VALUE_SEPARATOR + "(.*)");
+    private static final String EMPTY_SCOPE = "";
 
     /**
      * <p>Resolves the value of the scope from its raw format. For instance, {@code organization:<value>} will resolve to {@code <value>}.
@@ -158,7 +163,7 @@ public enum OrganizationScope {
     private final Predicate<String> valueMatcher;
 
     /**
-     * Resolves the organizations based on the values of the scope.
+     * Resolves the organizations of the user based on the values of the scope.
      */
     private final TriFunction<UserModel, String, KeycloakSession, Stream<OrganizationModel>> valueResolver;
 
@@ -170,9 +175,9 @@ public enum OrganizationScope {
     /**
      * Resolves the name of the scope when requesting a scope using a different format.
      */
-    private final BiFunction<String, String, String> nameResolver;
+    private final TriFunction<KeycloakSession, String, String, String> nameResolver;
 
-    OrganizationScope(Predicate<String> valueMatcher, TriFunction<UserModel, String, KeycloakSession, Stream<OrganizationModel>> valueResolver, Predicate<Stream<OrganizationModel>> valueValidator, BiFunction<String, String, String> nameResolver) {
+    OrganizationScope(Predicate<String> valueMatcher, TriFunction<UserModel, String, KeycloakSession, Stream<OrganizationModel>> valueResolver, Predicate<Stream<OrganizationModel>> valueValidator, TriFunction<KeycloakSession, String, String, String> nameResolver) {
         this.valueMatcher = valueMatcher;
         this.valueResolver = valueResolver;
         this.valueValidator = valueValidator;
@@ -185,13 +190,33 @@ public enum OrganizationScope {
      * @param user the user. Can be {@code null} depending on how the scope resolves its value.
      * @param scope the string referencing the scope
      * @param session the session
-     * @return the organizations mapped to the given {@code user}. Or an empty stream if no organizations were mapped from the {@code scope} parameter.
+     * @return the organizations mapped from the {@code scope} parameter. Or an empty stream if no organizations were mapped from the parameter.
      */
     public Stream<OrganizationModel> resolveOrganizations(UserModel user, String scope, KeycloakSession session) {
-        if (scope == null) {
-            return Stream.empty();
-        }
-        return valueResolver.apply(user, scope, session).filter(OrganizationModel::isEnabled);
+        return valueResolver.apply(user, Optional.ofNullable(scope).orElse(EMPTY_SCOPE), session).filter(OrganizationModel::isEnabled);
+    }
+
+    /**
+     * Returns a stream of {@link OrganizationScope} instances based on the scopes from the {@code AuthenticationSessionModel} associated
+     * with the given {@code session} and where the given {@code user} is a member.
+     *
+     * @param user the user. Can be {@code null} depending on how the scope resolves its value.
+     * @param session the session
+     * @return the organizations mapped from the {@code scope} parameter. Or an empty stream if no organizations were mapped from the parameter.
+     */
+    public Stream<OrganizationModel> resolveOrganizations(UserModel user, KeycloakSession session) {
+        return resolveOrganizations(user, getRequestedScopes(session), session);
+    }
+
+    /**
+     * Returns a stream of {@link OrganizationScope} instances based on the scopes from the {@code AuthenticationSessionModel} associated
+     * with the given {@code session}.
+     *
+     * @param session the session
+     * @return the organizations mapped from the {@code scope} parameter. Or an empty stream if no organizations were mapped from the parameter.
+     */
+    public Stream<OrganizationModel> resolveOrganizations(KeycloakSession session) {
+        return resolveOrganizations(null, session);
     }
 
     /**
@@ -203,24 +228,16 @@ public Stream<OrganizationModel> resolveOrganizations(UserModel user, String sco
      * @return the {@link ClientScopeModel}
      */
     public ClientScopeModel toClientScope(String name, UserModel user, KeycloakSession session) {
-        OrganizationScope scope = valueOfScope(name);
+        OrganizationScope scope = valueOfScope(session, name);
 
         if (scope == null) {
             return null;
         }
 
-        KeycloakContext context = session.getContext();
-        ClientModel client = context.getClient();
-        ClientScopeModel orgScope = getOrganizationClientScope(client, session);
-
-        if (orgScope == null) {
-            return null;
-        }
-
         Stream<OrganizationModel> organizations = scope.resolveOrganizations(user, name, session);
 
         if (valueValidator.test(organizations)) {
-            return new ClientScopeDecorator(orgScope, name);
+            return new ClientScopeDecorator(resolveClientScope(session, name), name);
         }
 
         return null;
@@ -237,9 +254,9 @@ public ClientScopeModel toClientScope(String name, UserModel user, KeycloakSessi
      * @param previous the previous name of this scope
      * @return the name of the scope
      */
-    public String resolveName(Set<String> scopes, String previous) {
+    public String resolveName(KeycloakSession session, Set<String> scopes, String previous) {
         for (String scope : scopes) {
-            String resolved = nameResolver.apply(scope, previous);
+            String resolved = nameResolver.apply(session, scope, previous);
 
             if (resolved == null) {
                 continue;
@@ -257,14 +274,11 @@ public String resolveName(Set<String> scopes, String previous) {
      * @param rawScope the string referencing the scope
      * @return the organization scope that maps the given {@code rawScope}
      */
-    public static OrganizationScope valueOfScope(String rawScope) {
-        if (rawScope == null) {
-            return null;
-        }
-        return parseScopeParameter(rawScope)
+    public static OrganizationScope valueOfScope(KeycloakSession session, String rawScope) {
+        return parseScopeParameter(session, Optional.ofNullable(rawScope).orElse(EMPTY_SCOPE))
                 .map(s -> {
                     for (OrganizationScope scope : values()) {
-                        if (scope.valueMatcher.test(parseScopeValue(s))) {
+                        if (scope.valueMatcher.test(parseScopeValue(session, s))) {
                             return scope;
                         }
                     }
@@ -274,41 +288,135 @@ public static OrganizationScope valueOfScope(String rawScope) {
                 .orElse(null);
     }
 
-    private static String parseScopeValue(String scope) {
-        if (!hasOrganizationScope(scope)) {
-            return null;
+    /**
+     * Returns a {@link OrganizationScope} instance based on the scopes from the {@code AuthenticationSessionModel} associated
+     * with the given {@code session}.
+     *
+     * @param session the session
+     * @return the organization scope that maps the given {@code rawScope}
+     */
+    public static OrganizationScope valueOfScope(KeycloakSession session) {
+        OrganizationScope value = session.getAttribute(OrganizationScope.class.getName(), OrganizationScope.class);
+
+        if (value != null) {
+            return value;
         }
 
-        if (scope.equals(OIDCLoginProtocolFactory.ORGANIZATION)) {
-            return "";
+        value = valueOfScope(session, getRequestedScopes(session));
+
+        if (value != null) {
+            session.setAttribute(OrganizationScope.class.getName(), value);
+        }
+
+        return value;
+    }
+
+    private static String getRequestedScopes(KeycloakSession session) {
+        AuthenticationSessionModel authSession = session.getContext().getAuthenticationSession();
+
+        if (authSession == null) {
+            return EMPTY_SCOPE;
+        }
+
+        String requestedScopes = authSession.getClientNote(OIDCLoginProtocol.SCOPE_PARAM);
+
+        return Optional.ofNullable(requestedScopes).orElse(EMPTY_SCOPE);
+    }
+
+    private static String parseScopeValue(KeycloakSession session, String scope) {
+        ClientScopeModel clientScope = resolveClientScope(session, scope);
+
+        if (clientScope != null) {
+            if (scope.equals(clientScope.getName())) {
+                return "";
+            }
         }
 
         Matcher matcher = SCOPE_PATTERN.matcher(scope);
 
         if (matcher.matches()) {
-            return matcher.group(1);
+            return matcher.group(2);
         }
 
         return null;
     }
 
-    private ClientScopeModel getOrganizationClientScope(ClientModel client, KeycloakSession session) {
-        if (!Organizations.isEnabledAndOrganizationsPresent(session)) {
+    private static Stream<String> parseScopeParameter(KeycloakSession session, String rawScope) {
+        return TokenManager.parseScopeParameter(rawScope)
+                .filter(scope -> resolveClientScope(session, scope) != null);
+    }
+
+    private static ClientScopeModel resolveClientScope(KeycloakSession session, String scope) {
+        if (isBlank(scope)) {
             return null;
         }
 
-        Map<String, ClientScopeModel> scopes = new HashMap<>(client.getClientScopes(true));
-        scopes.putAll(client.getClientScopes(false));
+        ClientModel client = session.getContext().getClient();
 
-        return scopes.get(OIDCLoginProtocolFactory.ORGANIZATION);
-    }
+        if (client == null) {
+            return null;
+        }
+
+        if (session.getAttributeOrDefault(UNSUPPORTED_ORGANIZATION_SCOPES_ATTRIBUTE, Set.of()).contains(scope)) {
+            // scope already processed and does not support mapping organizations
+            return null;
+        }
+
+        Set<ClientScopeModel> organizationScopes = session.getAttributeOrDefault(ORGANIZATION_SCOPES_SESSION_ATTRIBUTE, Set.of());
+
+        for (ClientScopeModel clientScope : organizationScopes) {
+            if (scope.equals(clientScope.getName()) || scope.startsWith(clientScope.getName() + VALUE_SEPARATOR)) {
+                // scope already processed and supports organizations
+                return clientScope;
+            }
+        }
+
+        Matcher matcher = SCOPE_PATTERN.matcher(scope);
+
+        if (matcher.matches()) {
+            scope = matcher.group(1);
+        }
+
+        ClientScopeModel clientScope = getClientScope(client, scope);
+
+        if (clientScope != null) {
+            Stream<String> mappers = clientScope.getProtocolMappersStream().map(ProtocolMapperModel::getProtocolMapper);
+
+            if (mappers.noneMatch(OrganizationMembershipMapper.PROVIDER_ID::equals)) {
+                Set<String> nonOrganizationScopes = session.getAttributeOrDefault(UNSUPPORTED_ORGANIZATION_SCOPES_ATTRIBUTE, Set.of());
+
+                if (nonOrganizationScopes.isEmpty()) {
+                    nonOrganizationScopes = new HashSet<>();
+                }
+
+                // scope does not support organizations, cache the scope in this session to avoid processing it again
+                nonOrganizationScopes.add(scope);
+                session.setAttribute(UNSUPPORTED_ORGANIZATION_SCOPES_ATTRIBUTE, nonOrganizationScopes);
+
+                return null;
+            }
 
-    private static boolean hasOrganizationScope(String scope) {
-        return scope != null && scope.contains(OIDCLoginProtocolFactory.ORGANIZATION);
+            organizationScopes = session.getAttributeOrDefault(ORGANIZATION_SCOPES_SESSION_ATTRIBUTE, Set.of());
+
+            if (organizationScopes.isEmpty()) {
+                organizationScopes = new HashSet<>();
+            }
+
+            organizationScopes.add(clientScope);
+            // scope supports organizations, cache the scope in this session to avoid processing it again
+            session.setAttribute(ORGANIZATION_SCOPES_SESSION_ATTRIBUTE, organizationScopes);
+        }
+
+        return clientScope;
     }
 
-    private static Stream<String> parseScopeParameter(String rawScope) {
-        return TokenManager.parseScopeParameter(rawScope)
-                .filter(OrganizationScope::hasOrganizationScope);
+    private static ClientScopeModel getClientScope(ClientModel client, String scope) {
+        ClientScopeModel clientScope = client.getClientScopes(false).get(scope);
+
+        if (clientScope == null) {
+            clientScope = client.getClientScopes(true).get(scope);
+        }
+
+        return clientScope;
     }
 }
diff --git a/services/src/main/java/org/keycloak/organization/utils/Organizations.java b/services/src/main/java/org/keycloak/organization/utils/Organizations.java
index 1cfd6adcb5ee..be0d0aa53009 100644
--- a/services/src/main/java/org/keycloak/organization/utils/Organizations.java
+++ b/services/src/main/java/org/keycloak/organization/utils/Organizations.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.organization.utils;
 
+import static java.util.Optional.of;
 import static java.util.Optional.ofNullable;
 
 import jakarta.ws.rs.core.MultivaluedMap;
@@ -27,8 +28,8 @@
 import java.util.Objects;
 import java.util.Optional;
 import java.util.function.Consumer;
+import java.util.stream.Stream;
 
-import org.keycloak.OAuth2Constants;
 import org.keycloak.TokenVerifier;
 import org.keycloak.authentication.actiontoken.inviteorg.InviteOrgActionToken;
 import org.keycloak.common.Profile;
@@ -40,7 +41,9 @@
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.GroupModel.Type;
 import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.OrganizationDomainModel;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -170,6 +173,13 @@ public static String getEmailDomain(String email) {
         return email.substring(domainSeparator + 1);
     }
 
+    public static String getEmailDomain(UserModel user) {
+        if (user == null) {
+            return null;
+        }
+        return getEmailDomain(user.getEmail());
+    }
+
     public static OrganizationModel resolveOrganization(KeycloakSession session) {
         return resolveOrganization(session, null, null);
     }
@@ -179,15 +189,18 @@ public static OrganizationModel resolveOrganization(KeycloakSession session, Use
     }
 
     public static OrganizationModel resolveOrganization(KeycloakSession session, UserModel user, String domain) {
-        if (!session.getContext().getRealm().isOrganizationsEnabled()) {
+        KeycloakContext context = session.getContext();
+        RealmModel realm = context.getRealm();
+
+        if (!realm.isOrganizationsEnabled()) {
             return null;
         }
 
-        Optional<OrganizationModel> organization = Optional.ofNullable(session.getContext().getOrganization());
+        OrganizationModel current = context.getOrganization();
 
-        if (organization.isPresent()) {
+        if (current != null) {
             // resolved from current keycloak session
-            return organization.get();
+            return current;
         }
 
         OrganizationProvider provider = getProvider(session);
@@ -196,41 +209,44 @@ public static OrganizationModel resolveOrganization(KeycloakSession session, Use
             return null;
         }
 
-        AuthenticationSessionModel authSession = session.getContext().getAuthenticationSession();
+        AuthenticationSessionModel authSession = context.getAuthenticationSession();
 
         if (authSession != null) {
-            String rawScopes = authSession.getClientNote(OAuth2Constants.SCOPE);
-            OrganizationScope scope = OrganizationScope.valueOfScope(rawScopes);
-
+            OrganizationScope scope = OrganizationScope.valueOfScope(session);
             List<OrganizationModel> organizations = ofNullable(authSession.getAuthNote(OrganizationModel.ORGANIZATION_ATTRIBUTE))
                     .map(provider::getById)
                     .map(List::of)
-                    .orElseGet(() -> scope == null ? List.of() : scope.resolveOrganizations(user, rawScopes, session).toList());
+                    .orElseGet(() -> scope == null ? List.of() : scope.resolveOrganizations(user, session).toList());
 
             if (organizations.size() == 1) {
-                // single organization mapped from authentication session
-                return organizations.get(0);
-            } else if (scope != null && user != null) {
-                // organization scope requested but no user and no single organization mapped from the scope
+                OrganizationModel organization = organizations.get(0);
+
+                if (user == null) {
+                    return organization;
+                }
+
+                // make sure the user still maps to the organization from the authentication session
+                if (organization.isMember(user) || matchesOrganizationDomain(organization, user, domain)) {
+                    return organization;
+                }
+
                 return null;
+            } else if (scope != null && user != null) {
+                return resolveUserOrganization(organizations, user, domain).orElse(null);
             }
         }
 
-        organization = ofNullable(user).stream().flatMap(provider::getByMember)
-                .filter(o -> o.isEnabled() && provider.isManagedMember(o, user))
-                .findAny();
-
-        if (organization.isPresent()) {
-            return organization.get();
-        }
+        List<OrganizationModel> organizations = ofNullable(user).stream()
+                .flatMap(provider::getByMember)
+                .filter(OrganizationModel::isEnabled)
+                .toList();
 
-        if (user != null && domain == null) {
-            domain = getEmailDomain(user.getEmail());
+        if (organizations.size() == 1) {
+            return organizations.get(0);
         }
 
-        return ofNullable(domain)
-                .map(provider::getByDomainName)
-                .orElse(null);
+        return resolveUserOrganization(organizations, user, domain)
+                .orElseGet(() -> resolveOrganizationByDomain(user, domain, provider));
     }
 
     public static OrganizationProvider getProvider(KeycloakSession session) {
@@ -262,4 +278,46 @@ public static boolean isReadOnlyOrganizationMember(KeycloakSession session, User
                 .anyMatch((org) -> (organizationProvider.isEnabled() && org.isManaged(delegate) && !org.isEnabled()) ||
                         (!organizationProvider.isEnabled() && org.isManaged(delegate)));
     }
+
+    private static boolean matchesOrganizationDomain(OrganizationModel organization, UserModel user, String domain) {
+        if (organization == null) {
+            return false;
+        }
+
+        String emailDomain = Optional.ofNullable(domain).orElseGet(() -> getEmailDomain(user));
+
+        if (emailDomain == null) {
+            return false;
+        }
+
+        Stream<OrganizationDomainModel> domains = organization.getDomains();
+
+        return domains.map(OrganizationDomainModel::getName).anyMatch(emailDomain::equals);
+    }
+
+    private static OrganizationModel resolveOrganizationByDomain(UserModel user, String domain, OrganizationProvider provider) {
+        if (user != null && domain == null) {
+            domain = getEmailDomain(user);
+        }
+
+        return ofNullable(domain)
+                .map(provider::getByDomainName)
+                .orElse(null);
+    }
+
+    private static Optional<OrganizationModel> resolveUserOrganization(List<OrganizationModel> organizations, UserModel user, String domain) {
+        OrganizationModel orgByDomain = null;
+
+        for (OrganizationModel o : organizations) {
+            if (o.isManaged(user)) {
+                return of(o);
+            }
+
+            if (matchesOrganizationDomain(o, user, domain)) {
+                orgByDomain = o;
+            }
+        }
+
+        return ofNullable(orgByDomain);
+    }
 }
diff --git a/services/src/main/java/org/keycloak/organization/validator/OrganizationMemberValidator.java b/services/src/main/java/org/keycloak/organization/validator/OrganizationMemberValidator.java
index 1abace7b377f..6b8196abff27 100644
--- a/services/src/main/java/org/keycloak/organization/validator/OrganizationMemberValidator.java
+++ b/services/src/main/java/org/keycloak/organization/validator/OrganizationMemberValidator.java
@@ -18,6 +18,7 @@
 package org.keycloak.organization.validator;
 
 import static java.util.Optional.ofNullable;
+import static org.keycloak.models.OrganizationDomainModel.ANY_DOMAIN;
 import static org.keycloak.organization.utils.Organizations.resolveHomeBroker;
 import static org.keycloak.validate.BuiltinValidators.emailValidator;
 
@@ -64,7 +65,8 @@ protected void doValidate(Object value, String inputHint, ValidationContext cont
         UserModel user = attributeContext.getUser();
         OrganizationModel organization = Organizations.resolveOrganization(session, user);
 
-        if (organization == null) {
+        // skip validation if we are not able to resolve org, or if user is not a member and the context is not IDP_REVIEW.
+        if (organization == null || (user != null && !UserProfileContext.IDP_REVIEW.equals(attributeContext.getContext()) && !organization.isMember(user))) {
             return;
         }
 
@@ -109,7 +111,7 @@ private void validateEmailDomain(String email, String inputHint, ValidationConte
         if (UserProfileContext.IDP_REVIEW.equals(attributeContext.getContext())) {
             expectedDomains = resolveExpectedDomainsWhenReviewingFederatedUserProfile(organization, attributeContext);
         } else if (organization.isManaged(user)) {
-            expectedDomains = resolveExpectedDomainsForManagedUser(context, user);
+            expectedDomains = resolveExpectedDomainsForManagedUser(organization, context, user);
         } else {
             // no validation happens for unmanaged users as they are realm users linked to an organization
             return;
@@ -123,7 +125,7 @@ private void validateEmailDomain(String email, String inputHint, ValidationConte
         context.addError(new ValidationError(ID, inputHint, "Email domain does not match any domain from the organization"));
     }
 
-    private static Set<String> resolveExpectedDomainsForManagedUser(ValidationContext context, UserModel user) {
+    private static Set<String> resolveExpectedDomainsForManagedUser(OrganizationModel organization, ValidationContext context, UserModel user) {
         List<IdentityProviderModel> brokers = resolveHomeBroker(context.getSession(), user);
 
         if (brokers.isEmpty()) {
@@ -134,8 +136,10 @@ private static Set<String> resolveExpectedDomainsForManagedUser(ValidationContex
 
         for (IdentityProviderModel broker : brokers) {
             String domain = broker.getConfig().get(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
-
-            if (domain != null) {
+            if (ANY_DOMAIN.equals(domain)) {
+                organization.getDomains().map(OrganizationDomainModel::getName).forEach(domains::add);
+            }
+            else if (domain != null) {
                 domains.add(domain);
             }
         }
@@ -165,6 +169,9 @@ private static Set<String> resolveExpectedDomainsWhenReviewingFederatedUserProfi
 
         // expect the email domain to match the domain set to the broker or none if not set
         String brokerDomain = broker.getConfig().get(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
+        if (ANY_DOMAIN.equals(brokerDomain)) {
+            return organization.getDomains().map(OrganizationDomainModel::getName).collect(Collectors.toSet());
+        }
         return  ofNullable(brokerDomain).map(Set::of).orElse(Set.of());
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/AuthorizationEndpointBase.java b/services/src/main/java/org/keycloak/protocol/AuthorizationEndpointBase.java
index a0a918d8dcdc..9c91fe9f500b 100755
--- a/services/src/main/java/org/keycloak/protocol/AuthorizationEndpointBase.java
+++ b/services/src/main/java/org/keycloak/protocol/AuthorizationEndpointBase.java
@@ -197,6 +197,9 @@ protected AuthenticationSessionModel createAuthenticationSession(ClientModel cli
                         rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(realm, userSessionId);
                     }
                     authSession = rootAuthSession.createAuthenticationSession(client);
+                    // set auth session cookies because they can be missing if recovered from identity cookie
+                    manager.setAuthSessionCookie(rootAuthSession.getId());
+                    manager.setAuthSessionIdHashCookie(rootAuthSession.getId());
                     logger.debugf("Sent request to authz endpoint. We don't have root authentication session with ID '%s' but we have userSession." +
                             "Re-created root authentication session with same ID. Client is: %s . New authentication session tab ID: %s", userSessionId, client.getClientId(), authSession.getTabId());
                 }
diff --git a/services/src/main/java/org/keycloak/protocol/ProtocolMapperUtils.java b/services/src/main/java/org/keycloak/protocol/ProtocolMapperUtils.java
index 3955b7c01540..0db29f7da605 100755
--- a/services/src/main/java/org/keycloak/protocol/ProtocolMapperUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/ProtocolMapperUtils.java
@@ -101,13 +101,14 @@ public class ProtocolMapperUtils {
             } else {
                 continue;
             }
-            propertyName = Character.toLowerCase(propertyName.charAt(0)) + propertyName.substring(1);
-            ACCESSORS.put(propertyName, method);
+            ACCESSORS.put(getLowerCasedProperty(propertyName), method);
         }
     }
 
     public static String getUserModelValue(UserModel user, String propertyName) {
-        Method m = ACCESSORS.get(propertyName);
+        // To support existing configurations, we accept property names starting with both upper and lower case
+        // as earlier versions of Keycloak where applying this behavior.
+        Method m = ACCESSORS.get(getLowerCasedProperty(propertyName));
         if (m == null) {
             return null;
         }
@@ -121,6 +122,10 @@ public static String getUserModelValue(UserModel user, String propertyName) {
         return null;
     }
 
+    private static String getLowerCasedProperty(String propertyName) {
+        return Character.toLowerCase(propertyName.charAt(0)) + propertyName.substring(1);
+    }
+
     /**
      * Find the builtin locale mapper.
      *
diff --git a/services/src/main/java/org/keycloak/protocol/docker/DockerAuthV2Protocol.java b/services/src/main/java/org/keycloak/protocol/docker/DockerAuthV2Protocol.java
index ae8619f7e090..9528a39a4ef9 100644
--- a/services/src/main/java/org/keycloak/protocol/docker/DockerAuthV2Protocol.java
+++ b/services/src/main/java/org/keycloak/protocol/docker/DockerAuthV2Protocol.java
@@ -2,6 +2,7 @@
 
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.server.jaxrs.ResponseBuilderImpl;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
 import org.keycloak.jose.jws.JWSBuilder;
@@ -12,7 +13,6 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.ClientData;
 import org.keycloak.protocol.LoginProtocol;
 import org.keycloak.protocol.ProtocolMapperUtils;
@@ -95,7 +95,7 @@ public Response authenticated(final AuthenticationSessionModel authSession, fina
         final ClientModel client = clientSession.getClient();
 
         DockerResponseToken responseToken = new DockerResponseToken()
-                .id(KeycloakModelUtils.generateId())
+                .id(SecretGenerator.getInstance().generateSecureID())
                 .type(TokenUtil.TOKEN_TYPE_BEARER)
                 .issuer(authSession.getClientNote(DockerAuthV2Protocol.ISSUER))
                 .subject(userSession.getUser().getUsername())
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProvider.java b/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProvider.java
deleted file mode 100644
index 0eced4d9e7b1..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProvider.java
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc;
-
-import jakarta.ws.rs.Consumes;
-import jakarta.ws.rs.DELETE;
-import jakarta.ws.rs.POST;
-import jakarta.ws.rs.PUT;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.PathParam;
-import jakarta.ws.rs.Produces;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
-import org.jboss.logging.Logger;
-import org.keycloak.models.KeycloakSession;
-import static org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider.VC_KEY;
-import org.keycloak.protocol.oid4vc.model.OID4VCClient;
-import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.services.ErrorResponseException;
-import org.keycloak.services.clientregistration.AbstractClientRegistrationProvider;
-import org.keycloak.services.clientregistration.DefaultClientRegistrationContext;
-
-import java.net.URI;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
-import java.util.stream.Collectors;
-
-
-/**
- * Provides the client-registration functionality for OID4VC-clients.
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class OID4VCClientRegistrationProvider extends AbstractClientRegistrationProvider {
-
-    private static final Logger LOGGER = Logger.getLogger(OID4VCClientRegistrationProvider.class);
-
-    public OID4VCClientRegistrationProvider(KeycloakSession session) {
-        super(session);
-    }
-
-    @POST
-    @Consumes(MediaType.APPLICATION_JSON)
-    @Produces(MediaType.APPLICATION_JSON)
-    public Response createOID4VCClient(OID4VCClient client) {
-        ClientRepresentation clientRepresentation = toClientRepresentation(client);
-        validate(clientRepresentation);
-
-        ClientRepresentation cr = create(
-                new DefaultClientRegistrationContext(session, clientRepresentation, this));
-        URI uri = session.getContext().getUri().getAbsolutePathBuilder().path(cr.getClientId()).build();
-        return Response.created(uri).entity(cr).build();
-    }
-
-    @PUT
-    @Path("{clientId}")
-    @Consumes(MediaType.APPLICATION_JSON)
-    @Produces(MediaType.APPLICATION_JSON)
-    public Response updateOID4VCClient(@PathParam("clientId") String clientDid, OID4VCClient client) {
-        client.setClientDid(clientDid);
-        ClientRepresentation clientRepresentation = toClientRepresentation(client);
-        validate(clientRepresentation);
-        clientRepresentation = update(clientDid,
-                new DefaultClientRegistrationContext(session, clientRepresentation, this));
-        return Response.ok(clientRepresentation).build();
-    }
-
-    @DELETE
-    @Path("{clientId}")
-    public Response deleteOID4VCClient(@PathParam("clientId") String clientDid) {
-        delete(clientDid);
-        return Response.noContent().build();
-    }
-
-    /**
-     * Validates the clientRepresentation to fulfill the requirement of an OID4VC client
-     */
-    public static void validate(ClientRepresentation client) {
-        String did = client.getClientId();
-        if (did == null) {
-            throw new ErrorResponseException("no_did", "A client did needs to be configured for OID4VC clients",
-                    Response.Status.BAD_REQUEST);
-        }
-        if (!did.startsWith("did:")) {
-            throw new ErrorResponseException("invalid_did", "The client id is not a did.",
-                    Response.Status.BAD_REQUEST);
-        }
-    }
-
-    /**
-     * Translate an incoming {@link OID4VCClient} into a keycloak native {@link ClientRepresentation}.
-     *
-     * @param oid4VCClient pojo, containing the oid4vc client parameters
-     * @return a clientRepresentation
-     */
-    protected static ClientRepresentation toClientRepresentation(OID4VCClient oid4VCClient) {
-        ClientRepresentation clientRepresentation = new ClientRepresentation();
-        clientRepresentation.setProtocol(OID4VCLoginProtocolFactory.PROTOCOL_ID);
-
-        clientRepresentation.setId(Optional.ofNullable(oid4VCClient.getId()).orElse(UUID.randomUUID().toString()));
-        clientRepresentation.setClientId(oid4VCClient.getClientDid());
-        // only add non-null parameters
-        Optional.ofNullable(oid4VCClient.getDescription()).ifPresent(clientRepresentation::setDescription);
-        Optional.ofNullable(oid4VCClient.getName()).ifPresent(clientRepresentation::setName);
-
-
-        Map<String, String> clientAttributes = oid4VCClient.getSupportedVCTypes()
-                .stream()
-                .map(SupportedCredentialConfiguration::toDotNotation)
-                .flatMap(dotNotated -> dotNotated.entrySet().stream())
-                .collect(Collectors.toMap(entry -> VC_KEY + "." + entry.getKey(), Map.Entry::getValue, (e1, e2) -> e1));
-
-        if (!clientAttributes.isEmpty()) {
-            clientRepresentation.setAttributes(clientAttributes);
-        }
-
-
-        LOGGER.debugf("Generated client representation {}.", clientRepresentation);
-        return clientRepresentation;
-    }
-
-    public static OID4VCClient fromClientAttributes(String clientId, Map<String, String> clientAttributes) {
-
-        OID4VCClient oid4VCClient = new OID4VCClient()
-                .setClientDid(clientId);
-
-        Set<String> supportedCredentialIds = new HashSet<>();
-        Map<String, String> attributes = new HashMap<>();
-        clientAttributes
-                .entrySet()
-                .forEach(entry -> {
-                    if (!entry.getKey().startsWith(VC_KEY)) {
-                        return;
-                    }
-                    String key = entry.getKey().substring((VC_KEY + ".").length());
-                    supportedCredentialIds.add(key.split("\\.")[0]);
-                    attributes.put(key, entry.getValue());
-                });
-
-
-        List<SupportedCredentialConfiguration> supportedCredentialConfigurations = supportedCredentialIds
-                .stream()
-                .map(id -> SupportedCredentialConfiguration.fromDotNotation(id, attributes))
-                .toList();
-
-        return oid4VCClient.setSupportedVCTypes(supportedCredentialConfigurations);
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderFactory.java
deleted file mode 100644
index f63cb0fdd246..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderFactory.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc;
-
-import org.keycloak.Config;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.provider.ProviderConfigProperty;
-import org.keycloak.services.clientregistration.ClientRegistrationProvider;
-import org.keycloak.services.clientregistration.ClientRegistrationProviderFactory;
-
-import java.util.List;
-
-/**
- * Implementation of the {@link ClientRegistrationProviderFactory} to integrate the OID4VC protocols with
- * Keycloak's client-registration.
- * <p>
- * {@see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html}
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class OID4VCClientRegistrationProviderFactory implements ClientRegistrationProviderFactory, OID4VCEnvironmentProviderFactory {
-
-    @Override
-    public ClientRegistrationProvider create(KeycloakSession session) {
-        return new OID4VCClientRegistrationProvider(session);
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-        // no config required
-    }
-
-    @Override
-    public void postInit(KeycloakSessionFactory factory) {
-        // nothing to do post init
-    }
-
-    @Override
-    public void close() {
-        // no resources to close
-    }
-
-    @Override
-    public String getId() {
-        return OID4VCLoginProtocolFactory.PROTOCOL_ID;
-    }
-
-    @Override
-    public List<ProviderConfigProperty> getConfigMetadata() {
-        return List.of();
-    }
-}
\ No newline at end of file
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java
index 39f06976316f..386292dd3683 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/OID4VCLoginProtocolFactory.java
@@ -22,9 +22,11 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ProtocolMapperModel;
@@ -36,7 +38,9 @@
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCSubjectIdMapper;
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCTargetRoleMapper;
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCUserAttributeMapper;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
 
 /**
  * Factory for creating all OID4VC related endpoints and the default mappers.
@@ -47,7 +51,7 @@ public class OID4VCLoginProtocolFactory implements LoginProtocolFactory, OID4VCE
 
     private static final Logger LOGGER = Logger.getLogger(OID4VCLoginProtocolFactory.class);
 
-    public static final String PROTOCOL_ID = "oid4vc";
+    public static final String PROTOCOL_ID = Oid4VciConstants.OID4VC_PROTOCOL;
 
     private static final String CLIENT_ROLES_MAPPER = "client-roles";
     private static final String USERNAME_MAPPER = "username";
@@ -60,7 +64,7 @@ public class OID4VCLoginProtocolFactory implements LoginProtocolFactory, OID4VCE
 
     @Override
     public void init(Config.Scope config) {
-        builtins.put(CLIENT_ROLES_MAPPER, OID4VCTargetRoleMapper.create("id", "client roles"));
+        builtins.put(CLIENT_ROLES_MAPPER, OID4VCTargetRoleMapper.create("client roles"));
         builtins.put(SUBJECT_ID_MAPPER, OID4VCSubjectIdMapper.create("subject id", "id"));
         builtins.put(USERNAME_MAPPER, OID4VCUserAttributeMapper.create(USERNAME_MAPPER, "username", "username", false));
         builtins.put(EMAIL_MAPPER, OID4VCUserAttributeMapper.create(EMAIL_MAPPER, "email", "email", false));
@@ -113,6 +117,31 @@ public void setupClientDefaults(ClientRepresentation rep, ClientModel newClient)
         //no-op
     }
 
+    @Override
+    public void addClientScopeDefaults(ClientScopeRepresentation clientScope) {
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.CONFIGURATION_ID, k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.CREDENTIAL_IDENTIFIER,
+                                                    k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.TYPES, k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.CONTEXTS, k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.VCT, k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.ISSUER_DID, k -> clientScope.getName());
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.FORMAT,
+                                                    k -> CredentialScopeModel.FORMAT_DEFAULT);
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS,
+                                                    k -> CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT);
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.SD_JWT_NUMBER_OF_DECOYS,
+                                                    k -> String.valueOf(CredentialScopeModel.SD_JWT_DECOYS_DEFAULT));
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.SD_JWT_VISIBLE_CLAIMS,
+                                                    k -> CredentialScopeModel.SD_JWT_VISIBLE_CLAIMS_DEFAULT);
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.HASH_ALGORITHM,
+                                                    k -> CredentialScopeModel.HASH_ALGORITHM_DEFAULT);
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.TOKEN_JWS_TYPE,
+                                                    k -> CredentialScopeModel.TOKEN_TYPE_DEFAULT);
+        clientScope.getAttributes().computeIfAbsent(CredentialScopeModel.EXPIRY_IN_SECONDS,
+                                                    k -> String.valueOf(CredentialScopeModel.EXPIRY_IN_SECONDS_DEFAULT));
+    }
+
     @Override
     public LoginProtocol create(KeycloakSession session) {
         return null;
@@ -123,4 +152,11 @@ public String getId() {
         return PROTOCOL_ID;
     }
 
+    /**
+     * defines the option-order in the admin-ui
+     */
+    @Override
+    public int order() {
+        return OIDCLoginProtocolFactory.UI_ORDER - 20;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
index c18003baf1c5..0ca149d73262 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
@@ -33,45 +33,50 @@
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.component.ComponentFactory;
 import org.keycloak.component.ComponentModel;
+import org.keycloak.events.Errors;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.ProtocolMapperContainerModel;
-import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
-import org.keycloak.protocol.oid4vc.OID4VCClientRegistrationProvider;
 import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilderFactory;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandler;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.JwtCNonceHandler;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidator;
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper;
-import org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory;
-import org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService;
+import org.keycloak.protocol.oid4vc.issuance.signing.CredentialSigner;
 import org.keycloak.protocol.oid4vc.model.CredentialOfferURI;
 import org.keycloak.protocol.oid4vc.model.CredentialRequest;
 import org.keycloak.protocol.oid4vc.model.CredentialResponse;
 import org.keycloak.protocol.oid4vc.model.CredentialsOffer;
 import org.keycloak.protocol.oid4vc.model.ErrorResponse;
 import org.keycloak.protocol.oid4vc.model.ErrorType;
-import org.keycloak.protocol.oid4vc.model.OID4VCClient;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.NonceResponse;
 import org.keycloak.protocol.oid4vc.model.OfferUriType;
 import org.keycloak.protocol.oid4vc.model.PreAuthorizedCode;
 import org.keycloak.protocol.oid4vc.model.PreAuthorizedGrant;
+import org.keycloak.protocol.oid4vc.model.Proof;
 import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantType;
 import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
 import org.keycloak.protocol.oidc.utils.OAuth2Code;
 import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
-import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.services.CorsErrorResponseException;
 import org.keycloak.services.cors.Cors;
@@ -92,12 +97,6 @@
 import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import static org.keycloak.protocol.oid4vc.model.Format.JWT_VC;
-import static org.keycloak.protocol.oid4vc.model.Format.LDP_VC;
-import static org.keycloak.protocol.oid4vc.model.Format.SD_JWT_VC;
-import static org.keycloak.protocol.oid4vc.model.Format.SUPPORTED_FORMATS;
 
 /**
  * Provides the (REST-)endpoints required for the OID4VCI protocol.
@@ -115,6 +114,7 @@ public class OID4VCIssuerEndpoint {
     private static final String CODE_LIFESPAN_REALM_ATTRIBUTE_KEY = "preAuthorizedCodeLifespanS";
     private static final int DEFAULT_CODE_LIFESPAN_S = 30;
 
+    public static final String NONCE_PATH = "nonce";
     public static final String CREDENTIAL_PATH = "credential";
     public static final String CREDENTIAL_OFFER_PATH = "credential-offer/";
     public static final String RESPONSE_TYPE_IMG_PNG = "image/png";
@@ -126,40 +126,31 @@ public class OID4VCIssuerEndpoint {
     // lifespan of the preAuthorizedCodes in seconds
     private final int preAuthorizedCodeLifeSpan;
 
-    /**
-     * Locatable credential builder map
-     */
-    private final Map<String, CredentialBuilder> credentialBuilders;
+    // constant for the OID4VCI enabled attribute key
+    private static final String OID4VCI_ENABLED_ATTRIBUTE_KEY = "oid4vci.enabled";
 
     /**
-     * Key shall be strings, as configured credential of the same format can
-     * have different configs. Like decoy, visible claims,
-     * time requirements (iat, exp, nbf, ...).
-     * <p>
-     * Credentials with same configs can share a default entry with locator= format.
-     * <p>
-     * Credentials in need of special configuration can provide another signer with specific
-     * locator=format::type::vc_config_id
-     * <p>
-     * The providerId of the signing service factory is still the format.
+     * Credential builders are responsible for initiating the production of
+     * credentials in a specific format. Their output is an appropriate credential
+     * representation to be signed by a credential signer of the same format.
+     * <p></p>
+     * Due to technical constraints, we explicitly load credential builders into
+     * this map for they are configurable components. The key of the map is the
+     * credential {@link Format} associated with the builder. The matching credential
+     * signer is directly loaded from the Keycloak container.
      */
-    private final Map<String, VerifiableCredentialsSigningService> signingServices;
-
-    private final boolean isIgnoreScopeCheck;
+    private final Map<String, CredentialBuilder> credentialBuilders;
 
     public OID4VCIssuerEndpoint(KeycloakSession session,
                                 Map<String, CredentialBuilder> credentialBuilders,
-                                Map<String, VerifiableCredentialsSigningService> signingServices,
                                 AppAuthManager.BearerTokenAuthenticator authenticator,
-                                TimeProvider timeProvider, int preAuthorizedCodeLifeSpan,
-                                boolean isIgnoreScopeCheck) {
+                                TimeProvider timeProvider,
+                                int preAuthorizedCodeLifeSpan) {
         this.session = session;
         this.bearerTokenAuthenticator = authenticator;
         this.timeProvider = timeProvider;
         this.credentialBuilders = credentialBuilders;
-        this.signingServices = signingServices;
         this.preAuthorizedCodeLifeSpan = preAuthorizedCodeLifeSpan;
-        this.isIgnoreScopeCheck = isIgnoreScopeCheck;
     }
 
     public OID4VCIssuerEndpoint(KeycloakSession keycloakSession) {
@@ -170,26 +161,9 @@ public OID4VCIssuerEndpoint(KeycloakSession keycloakSession) {
         this.credentialBuilders = loadCredentialBuilders(session);
 
         RealmModel realm = keycloakSession.getContext().getRealm();
-        this.signingServices = new HashMap<>();
-        realm.getComponentsStream(realm.getId(), VerifiableCredentialsSigningService.class.getName())
-                .forEach(cm -> addServiceFromComponent(signingServices, keycloakSession, cm));
-
         this.preAuthorizedCodeLifeSpan = Optional.ofNullable(realm.getAttribute(CODE_LIFESPAN_REALM_ATTRIBUTE_KEY))
                 .map(Integer::valueOf)
                 .orElse(DEFAULT_CODE_LIFESPAN_S);
-        this.isIgnoreScopeCheck = false;
-    }
-
-    private void addServiceFromComponent(Map<String, VerifiableCredentialsSigningService> signingServices, KeycloakSession keycloakSession, ComponentModel componentModel) {
-        ProviderFactory<VerifiableCredentialsSigningService> factory = keycloakSession
-                .getKeycloakSessionFactory()
-                .getProviderFactory(VerifiableCredentialsSigningService.class, componentModel.getProviderId());
-        if (factory instanceof VCSigningServiceProviderFactory sspf) {
-            VerifiableCredentialsSigningService verifiableCredentialsSigningService = sspf.create(keycloakSession, componentModel);
-            signingServices.put(verifiableCredentialsSigningService.locator(), verifiableCredentialsSigningService);
-        } else {
-            throw new IllegalArgumentException(String.format("The component %s is not a VerifiableCredentialsSigningServiceProviderFactory", componentModel.getProviderId()));
-        }
     }
 
     /**
@@ -199,25 +173,68 @@ private void addServiceFromComponent(Map<String, VerifiableCredentialsSigningSer
      */
     private Map<String, CredentialBuilder> loadCredentialBuilders(KeycloakSession keycloakSession) {
         KeycloakSessionFactory keycloakSessionFactory = keycloakSession.getKeycloakSessionFactory();
-        RealmModel realm = keycloakSession.getContext().getRealm();
-        Stream<ComponentModel> componentModels = realm.getComponentsStream(
-                realm.getId(), CredentialBuilder.class.getName());
-
-        return componentModels.map(componentModel -> {
-                    ProviderFactory<CredentialBuilder> providerFactory = keycloakSessionFactory
-                            .getProviderFactory(CredentialBuilder.class, componentModel.getProviderId());
-
-                    if (!(providerFactory instanceof ComponentFactory<?, ?>)) {
-                        throw new IllegalArgumentException(String.format(
-                                "Component %s is unexpectedly not a ComponentFactory",
-                                componentModel.getProviderId()
-                        ));
-                    }
+        return keycloakSessionFactory.getProviderFactoriesStream(CredentialBuilder.class)
+                                     .map(factory -> (CredentialBuilderFactory) factory)
+                                     .map(factory -> factory.create(keycloakSession, null))
+                                     .collect(Collectors.toMap(CredentialBuilder::getSupportedFormat,
+                                                               credentialBuilder ->  credentialBuilder));
+    }
 
-                    var componentFactory = (ComponentFactory<CredentialBuilder, CredentialBuilder>) providerFactory;
-                    return componentFactory.create(keycloakSession, componentModel);
-                })
-                .collect(Collectors.toMap(CredentialBuilder::getSupportedFormat, component -> component));
+    /**
+     * Validates whether the authenticated client is enabled for OID4VCI features.
+     * <p>
+     * If the client is not enabled, this method logs the status and throws a
+     * {@link CorsErrorResponseException} with an appropriate error message.
+     * </p>
+     *
+     * @throws CorsErrorResponseException if the client is not enabled for OID4VCI.
+     */
+    private void checkClientEnabled() {
+        AuthenticatedClientSessionModel clientSession = getAuthenticatedClientSession();
+        ClientModel client = clientSession.getClient();
+
+        boolean oid4vciEnabled = Boolean.parseBoolean(client.getAttributes().get(OID4VCI_ENABLED_ATTRIBUTE_KEY));
+
+        if (!oid4vciEnabled) {
+            LOGGER.debugf("Client '%s' is not enabled for OID4VCI features.", client.getClientId());
+            throw new CorsErrorResponseException(
+                    cors,
+                    Errors.INVALID_CLIENT,
+                    "Client not enabled for OID4VCI",
+                    Response.Status.FORBIDDEN
+            );
+        }
+
+        LOGGER.debugf("Client '%s' is enabled for OID4VCI features.", client.getClientId());
+    }
+
+    /**
+     * Generates a unique notification ID for use in CredentialResponse.
+     *
+     * @return a unique string identifier
+     */
+    private String generateNotificationId() {
+        return SecretGenerator.getInstance().randomString();
+    }
+    
+    /**
+     * the OpenId4VCI nonce-endpoint
+     *
+     * @return a short-lived c_nonce value that must be presented in key-bound proofs at the credential endpoint.
+     * @see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-nonce-endpoint
+     * @see https://datatracker.ietf.org/doc/html/draft-demarco-nonce-endpoint#name-nonce-response
+     */
+    @POST
+    @Produces({MediaType.APPLICATION_JSON})
+    @Path(NONCE_PATH)
+    public Response getCNonce() {
+        CNonceHandler cNonceHandler = session.getProvider(CNonceHandler.class);
+        NonceResponse nonceResponse = new NonceResponse();
+        String sourceEndpoint = OID4VCIssuerWellKnownProvider.getNonceEndpoint(session.getContext());
+        String audience = OID4VCIssuerWellKnownProvider.getCredentialsEndpoint(session.getContext());
+        String nonce = cNonceHandler.buildCNonce(List.of(audience), Map.of(JwtCNonceHandler.SOURCE_ENDPOINT, sourceEndpoint));
+        nonceResponse.setNonce(nonce);
+        return Response.ok().header(HttpHeaders.CACHE_CONTROL, "no-store").entity(nonceResponse).build();
     }
 
     /**
@@ -230,6 +247,15 @@ public Response getCredentialOfferURI(@QueryParam("credential_configuration_id")
 
         AuthenticatedClientSessionModel clientSession = getAuthenticatedClientSession();
 
+        // Initialize CORS configuration and validate if the client is enabled for OID4VCI
+        cors = Cors.builder()
+                .auth()
+                .allowedMethods("GET")
+                .auth()
+                .exposedHeaders(Cors.ACCESS_CONTROL_ALLOW_METHODS);
+
+        checkClientEnabled();
+
         Map<String, SupportedCredentialConfiguration> credentialsMap = OID4VCIssuerWellKnownProvider.getSupportedCredentials(session);
         LOGGER.debugf("Get an offer for %s", vcId);
         if (!credentialsMap.containsKey(vcId)) {
@@ -238,13 +264,7 @@ public Response getCredentialOfferURI(@QueryParam("credential_configuration_id")
             throw new BadRequestException(getErrorResponse(ErrorType.INVALID_CREDENTIAL_REQUEST));
         }
         SupportedCredentialConfiguration supportedCredentialConfiguration = credentialsMap.get(vcId);
-        String format = supportedCredentialConfiguration.getFormat();
 
-        // check that the user is allowed to get such credential
-        if (getClientsOfScope(supportedCredentialConfiguration.getScope(), format).isEmpty()) {
-            LOGGER.debugf("No OID4VP-Client supporting type %s registered.", supportedCredentialConfiguration.getScope());
-            throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_TYPE));
-        }
         // calculate the expiration of the preAuthorizedCode. The sessionCode will also expire at that time.
         int expiration = timeProvider.currentTimeSeconds() + preAuthorizedCodeLifeSpan;
         String preAuthorizedCode = generateAuthorizationCodeForClientSession(expiration, clientSession);
@@ -317,20 +337,25 @@ public Response getCredentialOffer(@PathParam("sessionCode") String sessionCode)
                 .build();
     }
 
-    private void checkScope(CredentialRequest credentialRequestVO) {
+    private void checkScope(CredentialScopeModel requestedCredential) {
         AuthenticatedClientSessionModel clientSession = getAuthenticatedClientSession();
         String vcIssuanceFlow = clientSession.getNote(PreAuthorizedCodeGrantType.VC_ISSUANCE_FLOW);
+
         if (vcIssuanceFlow == null || !vcIssuanceFlow.equals(PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE)) {
-            // authz code flow
-            ClientModel client = clientSession.getClient();
-            String credentialIdentifier = credentialRequestVO.getCredentialIdentifier();
-            String scope = client.getAttributes().get("vc." + credentialIdentifier + ".scope"); // following credential identifier in client attribute
             AccessToken accessToken = bearerTokenAuthenticator.authenticate().getToken();
-            if (Arrays.stream(accessToken.getScope().split(" ")).sequential().noneMatch(i -> i.equals(scope))) {
-                LOGGER.debugf("Scope check failure: credentialIdentifier = %s, required scope = %s, scope in access token = %s.", credentialIdentifier, scope, accessToken.getScope());
-                throw new CorsErrorResponseException(cors, ErrorType.UNSUPPORTED_CREDENTIAL_TYPE.toString(), "Scope check failure", Response.Status.BAD_REQUEST);
+            if (Arrays.stream(accessToken.getScope().split(" "))
+                    .noneMatch(tokenScope -> tokenScope.equals(requestedCredential.getScope()))) {
+                LOGGER.debugf("Scope check failure: required scope = %s, " +
+                                      "scope in access token = %s.",
+                              requestedCredential.getName(), accessToken.getScope());
+                throw new CorsErrorResponseException(cors,
+                        ErrorType.UNSUPPORTED_CREDENTIAL_TYPE.toString(),
+                        "Scope check failure",
+                        Response.Status.BAD_REQUEST);
             } else {
-                LOGGER.debugf("Scope check success: credentialIdentifier = %s, required scope = %s, scope in access token = %s.", credentialIdentifier, scope, accessToken.getScope());
+                LOGGER.debugf("Scope check success: required scope = %s, #" +
+                                      "scope in access token = %s.",
+                              requestedCredential.getScope(), accessToken.getScope());
             }
         } else {
             clientSession.removeNote(PreAuthorizedCodeGrantType.VC_ISSUANCE_FLOW);
@@ -353,94 +378,43 @@ public Response requestCredential(
         // do first to fail fast on auth
         AuthenticationManager.AuthResult authResult = getAuthResult();
 
-        if (!isIgnoreScopeCheck) {
-            checkScope(credentialRequestVO);
-        }
+        // checkClientEnabled call after authentication
+        checkClientEnabled();
 
-        // Both Format and identifier are optional.
-        // If the credential_identifier is present, Format can't be present. But this implementation will
-        // tolerate the presence of both, waiting for clarity in specifications.
-        // This implementation will privilege the presence of the credential config identifier.
-        String requestedCredentialId = credentialRequestVO.getCredentialIdentifier();
-        String requestedFormat = credentialRequestVO.getFormat();
+        // Both credential_configuration_id and credential_identifier are optional.
+        // If the credential_configuration_id is present, credential_identifier can't be present.
+        // But this implementation will tolerate the presence of both, waiting for clarity in specifications.
+        // This implementation will privilege the presence of the credential_configuration_id.
+        String requestedCredentialConfigurationId = credentialRequestVO.getCredentialConfigurationId();
+        String requestedCredentialIdentifier = credentialRequestVO.getCredentialIdentifier();
 
         // Check if at least one of both is available.
-        if (requestedCredentialId == null && requestedFormat == null) {
-            LOGGER.debugf("Missing both configuration id and requested format. At least one shall be specified.");
-            throw new BadRequestException(getErrorResponse(ErrorType.MISSING_CREDENTIAL_CONFIG_AND_FORMAT));
+        if (requestedCredentialConfigurationId == null && requestedCredentialIdentifier == null) {
+            LOGGER.debugf("Missing both credential_configuration_id and credential_identifier. " +
+                    "At least one must be specified.");
+            throw new BadRequestException(getErrorResponse(ErrorType.MISSING_CREDENTIAL_IDENTIFIER_AND_CONFIGURATION_ID));
         }
 
-        Map<String, SupportedCredentialConfiguration> supportedCredentials = OID4VCIssuerWellKnownProvider.getSupportedCredentials(this.session);
+        CredentialScopeModel requestedCredential = credentialRequestVO.findCredentialScope(session).orElseThrow(() -> {
+            LOGGER.debugf("Credential for request '%s' not found.",
+                          credentialRequestVO.toString());
+            return new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_TYPE));
+        });
 
-        // resolve from identifier first
-        SupportedCredentialConfiguration supportedCredentialConfiguration = null;
-        if (requestedCredentialId != null) {
-            supportedCredentialConfiguration = supportedCredentials.get(requestedCredentialId);
-            if (supportedCredentialConfiguration == null) {
-                LOGGER.debugf("Credential with configuration id %s not found.", requestedCredentialId);
-                throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_TYPE));
-            }
-            // Then for format. We know spec does not allow both parameter. But we are tolerant if you send both
-            // Was found by id, check that the format matches.
-            if (requestedFormat != null && !requestedFormat.equals(supportedCredentialConfiguration.getFormat())) {
-                LOGGER.debugf("Credential with configuration id %s does not support requested format %s, but supports %s.", requestedCredentialId, requestedFormat, supportedCredentialConfiguration.getFormat());
-                throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_FORMAT));
-            }
-        }
+        checkScope(requestedCredential);
 
-        if (supportedCredentialConfiguration == null && requestedFormat != null) {
-            // Search by format
-            supportedCredentialConfiguration = getSupportedCredentialConfiguration(credentialRequestVO, supportedCredentials, requestedFormat);
-            if (supportedCredentialConfiguration == null) {
-                LOGGER.debugf("Credential with requested format %s, not supported.", requestedFormat);
-                throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_FORMAT));
-            }
-        }
+        SupportedCredentialConfiguration supportedCredential =
+                OID4VCIssuerWellKnownProvider.toSupportedCredentialConfiguration(session, requestedCredential);
 
-        CredentialResponse responseVO = new CredentialResponse();
+        Object theCredential = getCredential(authResult, supportedCredential, credentialRequestVO);
 
-        Object theCredential = getCredential(authResult, supportedCredentialConfiguration, credentialRequestVO);
-        if (SUPPORTED_FORMATS.contains(requestedFormat)) {
-            responseVO.setCredential(theCredential);
-        } else {
-            throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_TYPE));
-        }
+        CredentialResponse responseVO = new CredentialResponse();
+        responseVO
+                    .addCredential(theCredential)
+                    .setNotificationId(generateNotificationId());
         return Response.ok().entity(responseVO).build();
     }
 
-    private SupportedCredentialConfiguration getSupportedCredentialConfiguration(CredentialRequest credentialRequestVO, Map<String, SupportedCredentialConfiguration> supportedCredentials, String requestedFormat) {
-        // 1. Format resolver
-        List<SupportedCredentialConfiguration> configs = supportedCredentials.values().stream()
-                .filter(supportedCredential -> Objects.equals(supportedCredential.getFormat(), requestedFormat))
-                .collect(Collectors.toList());
-
-        List<SupportedCredentialConfiguration> matchingConfigs;
-
-        switch (requestedFormat) {
-            case SD_JWT_VC:
-                // Resolve from vct for sd-jwt
-                matchingConfigs = configs.stream()
-                        .filter(supportedCredential -> Objects.equals(supportedCredential.getVct(), credentialRequestVO.getVct()))
-                        .collect(Collectors.toList());
-                break;
-            case JWT_VC:
-            case LDP_VC:
-                // Will detach this when each format provides logic on how to resolve from definition.
-                matchingConfigs = configs.stream()
-                        .filter(supportedCredential -> Objects.equals(supportedCredential.getCredentialDefinition(), credentialRequestVO.getCredentialDefinition()))
-                        .collect(Collectors.toList());
-                break;
-            default:
-                throw new BadRequestException(getErrorResponse(ErrorType.UNSUPPORTED_CREDENTIAL_FORMAT));
-        }
-
-        if (matchingConfigs.isEmpty()) {
-            throw new BadRequestException(getErrorResponse(ErrorType.MISSING_CREDENTIAL_CONFIG));
-        }
-
-        return matchingConfigs.iterator().next();
-    }
-
     private AuthenticatedClientSessionModel getAuthenticatedClientSession() {
         AuthenticationManager.AuthResult authResult = getAuthResult();
         UserSessionModel userSessionModel = authResult.getSession();
@@ -475,17 +449,20 @@ private AuthenticationManager.AuthResult getAuthResult(WebApplicationException e
      * @param credentialRequestVO the credential request
      * @return the signed credential
      */
-    private Object getCredential(AuthenticationManager.AuthResult authResult, SupportedCredentialConfiguration credentialConfig, CredentialRequest credentialRequestVO) {
+    private Object getCredential(AuthenticationManager.AuthResult authResult,
+                                 SupportedCredentialConfiguration credentialConfig,
+                                 CredentialRequest credentialRequestVO) {
 
-        List<OID4VCClient> clients = getClientsOfScope(credentialConfig.getScope(), credentialConfig.getFormat());
+        // Get the client scope model from the credential configuration
+        CredentialScopeModel credentialScopeModel = getClientScopeModel(credentialConfig);
 
-        List<OID4VCMapper> protocolMappers = getProtocolMappers(clients)
-                .stream()
+        // Get the protocol mappers from the client scope
+        List<OID4VCMapper> protocolMappers = credentialScopeModel.getProtocolMappersStream()
                 .map(pm -> {
                     if (session.getProvider(ProtocolMapper.class, pm.getProtocolMapper()) instanceof OID4VCMapper mapperFactory) {
                         ProtocolMapper protocolMapper = mapperFactory.create(session);
                         if (protocolMapper instanceof OID4VCMapper oid4VCMapper) {
-                            oid4VCMapper.setMapperModel(pm);
+                            oid4VCMapper.setMapperModel(pm, credentialScopeModel.getFormat());
                             return oid4VCMapper;
                         }
                     }
@@ -497,32 +474,36 @@ private Object getCredential(AuthenticationManager.AuthResult authResult, Suppor
 
         VCIssuanceContext vcIssuanceContext = getVCToSign(protocolMappers, credentialConfig, authResult, credentialRequestVO);
 
-        String fullyQualifiedConfigKey = VerifiableCredentialsSigningService.locator(credentialConfig.getFormat(), credentialConfig.deriveType(), credentialConfig.deriveConfiId());
-        String formatAndTypeKey = VerifiableCredentialsSigningService.locator(credentialConfig.getFormat(), credentialConfig.deriveType(), null);
-        String formatOnlyKey = VerifiableCredentialsSigningService.locator(credentialConfig.getFormat(), null, null);
+        // Enforce key binding prior to signing if necessary
+        enforceKeyBindingIfProofProvided(vcIssuanceContext);
 
-        // Search from specific to general config.
-        VerifiableCredentialsSigningService signingService = signingServices.getOrDefault(
-                fullyQualifiedConfigKey,
-                signingServices.getOrDefault(
-                        formatAndTypeKey,
-                        signingServices.get(formatOnlyKey))
-        );
+        // Retrieve matching credential signer
+        CredentialSigner<?> credentialSigner = session.getProvider(CredentialSigner.class,
+                                                                   credentialConfig.getFormat());
 
-        return Optional.ofNullable(signingService)
-                .map(service -> service.signCredential(vcIssuanceContext))
+        return Optional.ofNullable(credentialSigner)
+                .map(signer -> signer.signCredential(
+                        vcIssuanceContext.getCredentialBody(),
+                        credentialConfig.getCredentialBuildConfig()
+                ))
                 .orElseThrow(() -> new BadRequestException(
-                        String.format("No signer found for specific config '%s' or '%s' or format '%s'.", fullyQualifiedConfigKey, formatAndTypeKey, formatOnlyKey)
+                        String.format("No signer found for format '%s'.", credentialConfig.getFormat())
                 ));
     }
 
-    private List<ProtocolMapperModel> getProtocolMappers(List<OID4VCClient> oid4VCClients) {
+    private CredentialScopeModel getClientScopeModel(SupportedCredentialConfiguration credentialConfig) {
+        // Get the current client from the session
+        ClientModel clientModel = session.getContext().getClient();
 
-        return oid4VCClients.stream()
-                .map(OID4VCClient::getClientDid)
-                .map(this::getClient)
-                .flatMap(ProtocolMapperContainerModel::getProtocolMappersStream)
-                .toList();
+        // Get the client scope that matches the credentialConfig scope
+        Map<String, ClientScopeModel> clientScopes = clientModel.getClientScopes(false);
+        ClientScopeModel clientScopeModel = clientScopes.get(credentialConfig.getScope());
+
+        if (clientScopeModel == null) {
+            throw new BadRequestException("Client scope not found for the specified scope: " + credentialConfig.getScope());
+        }
+
+        return new CredentialScopeModel(clientScopeModel);
     }
 
     private String generateCodeForSession(int expiration, AuthenticatedClientSessionModel clientSession) {
@@ -568,33 +549,6 @@ private Response getErrorResponse(ErrorType errorType) {
                 .build();
     }
 
-    // Return all {@link  OID4VCClient}s that support the given scope and format
-    // Scope might be different from vct. In the case of sd-jwt for example
-    private List<OID4VCClient> getClientsOfScope(String vcScope, String format) {
-        LOGGER.debugf("Retrieve all clients of scope %s, supporting format %s", vcScope, format);
-
-        if (Optional.ofNullable(vcScope).filter(scope -> !scope.isEmpty()).isEmpty()) {
-            throw new BadRequestException("No VerifiableCredential-Scope was provided in the request.");
-        }
-
-        // Since clients are not bound to specific VC definitions, they can all
-        // potentially define protocol mappers to source data.
-        return getOID4VCClientsFromSession();
-    }
-
-    private ClientModel getClient(String clientId) {
-        return session.clients().getClientByClientId(session.getContext().getRealm(), clientId);
-    }
-
-    private List<OID4VCClient> getOID4VCClientsFromSession() {
-        return session.clients().getClientsStream(session.getContext().getRealm())
-                .filter(clientModel -> clientModel.getProtocol() != null)
-                .filter(clientModel -> clientModel.getProtocol()
-                        .equals(OID4VCLoginProtocolFactory.PROTOCOL_ID))
-                .map(clientModel -> OID4VCClientRegistrationProvider.fromClientAttributes(clientModel.getClientId(), clientModel.getAttributes()))
-                .toList();
-    }
-
     // builds the unsigned credential by applying all protocol mappers.
     private VCIssuanceContext getVCToSign(List<OID4VCMapper> protocolMappers, SupportedCredentialConfiguration credentialConfig,
                                           AuthenticationManager.AuthResult authResult, CredentialRequest credentialRequestVO) {
@@ -605,22 +559,18 @@ private VCIssuanceContext getVCToSign(List<OID4VCMapper> protocolMappers, Suppor
 
         Map<String, Object> subjectClaims = new HashMap<>();
         protocolMappers
-                .stream()
-                .filter(mapper -> mapper.isScopeSupported(credentialConfig.getScope()))
                 .forEach(mapper -> mapper.setClaimsForSubject(subjectClaims, authResult.getSession()));
 
         subjectClaims.forEach((key, value) -> vc.getCredentialSubject().setClaims(key, value));
 
         protocolMappers
-                .stream()
-                .filter(mapper -> mapper.isScopeSupported(credentialConfig.getScope()))
                 .forEach(mapper -> mapper.setClaimsForCredential(vc, authResult.getSession()));
 
         LOGGER.debugf("The credential to sign is: %s", vc);
 
         // Build format-specific credential
-        CredentialBody credentialBody = findCredentialBuilder(credentialConfig)
-                .buildCredentialBody(vc, credentialConfig.getCredentialBuildConfig());
+        CredentialBody credentialBody = this.findCredentialBuilder(credentialConfig)
+                                            .buildCredentialBody(vc, credentialConfig.getCredentialBuildConfig());
 
         return new VCIssuanceContext()
                 .setAuthResult(authResult)
@@ -629,6 +579,32 @@ private VCIssuanceContext getVCToSign(List<OID4VCMapper> protocolMappers, Suppor
                 .setCredentialRequest(credentialRequestVO);
     }
 
+    /**
+     * Enforce key binding: Validate proof and bind associated key to credential in issuance context.
+     */
+    private void enforceKeyBindingIfProofProvided(VCIssuanceContext vcIssuanceContext) {
+        Proof proof = vcIssuanceContext.getCredentialRequest().getProof();
+        if (proof == null) {
+            LOGGER.debugf("No proof provided, skipping key binding");
+            return;
+        }
+
+        String proofType = proof.getProofType();
+
+        ProofValidator proofValidator = session.getProvider(ProofValidator.class, proofType);
+        if (proofValidator == null) {
+            throw new BadRequestException(String.format("Unable to validate proofs of type %s", proofType));
+        }
+
+        // Validate proof and bind public key to credential
+        try {
+            Optional.ofNullable(proofValidator.validateProof(vcIssuanceContext))
+                    .ifPresent(jwk -> vcIssuanceContext.getCredentialBody().addKeyBinding(jwk));
+        } catch (VCIssuerException e) {
+            throw new BadRequestException("Could not validate provided proof", e);
+        }
+    }
+
     private CredentialBuilder findCredentialBuilder(SupportedCredentialConfiguration credentialConfig) {
         String format = credentialConfig.getFormat();
         CredentialBuilder credentialBuilder = credentialBuilders.get(format);
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java
index 2728ec81d493..fae80ad145ee 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerWellKnownProvider.java
@@ -18,28 +18,27 @@
 package org.keycloak.protocol.oid4vc.issuance;
 
 import jakarta.ws.rs.core.UriInfo;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.crypto.KeyWrapper;
 import org.keycloak.models.KeyManager;
 import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.protocol.oid4vc.OID4VCClientRegistrationProvider;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
-import org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory;
-import org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder;
 import org.keycloak.protocol.oid4vc.model.CredentialIssuer;
-import org.keycloak.protocol.oid4vc.model.OID4VCClient;
 import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.services.Urls;
 import org.keycloak.urls.UrlType;
 import org.keycloak.wellknown.WellKnownProvider;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.jboss.logging.Logger;
 
-import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.stream.Collectors;
 
 /**
@@ -51,7 +50,11 @@
  */
 public class OID4VCIssuerWellKnownProvider implements WellKnownProvider {
 
-    private final KeycloakSession keycloakSession;
+    public static final String VC_KEY = "vc";
+
+    private static final Logger LOGGER = Logger.getLogger(OID4VCIssuerWellKnownProvider.class);
+
+    protected final KeycloakSession keycloakSession;
 
     public OID4VCIssuerWellKnownProvider(KeycloakSession keycloakSession) {
         this.keycloakSession = keycloakSession;
@@ -64,64 +67,95 @@ public void close() {
 
     @Override
     public Object getConfig() {
-        return new CredentialIssuer()
-                .setCredentialIssuer(getIssuer(keycloakSession.getContext()))
-                .setCredentialEndpoint(getCredentialsEndpoint(keycloakSession.getContext()))
+        KeycloakContext context = keycloakSession.getContext();
+        CredentialIssuer issuer = new CredentialIssuer()
+                .setCredentialIssuer(getIssuer(context))
+                .setCredentialEndpoint(getCredentialsEndpoint(context))
+                .setNonceEndpoint(getNonceEndpoint(context))
+                .setDeferredCredentialEndpoint(getDeferredCredentialEndpoint(context))
                 .setCredentialsSupported(getSupportedCredentials(keycloakSession))
-                .setAuthorizationServers(List.of(getIssuer(keycloakSession.getContext())));
+                .setAuthorizationServers(List.of(getIssuer(context)))
+                .setCredentialResponseEncryption(getCredentialResponseEncryption(keycloakSession))
+                .setBatchCredentialIssuance(getBatchCredentialIssuance(keycloakSession))
+                .setSignedMetadata(getSignedMetadata(keycloakSession));
+        return issuer;
+    }
+
+    private static String getDeferredCredentialEndpoint(KeycloakContext context) {
+        return getIssuer(context) + "/protocol/" + OID4VCLoginProtocolFactory.PROTOCOL_ID + "/deferred_credential";
+    }
+
+    private CredentialIssuer.CredentialResponseEncryption getCredentialResponseEncryption(KeycloakSession session) {
+        RealmModel realm = session.getContext().getRealm();
+        String algs = realm.getAttribute("credential_response_encryption.alg_values_supported");
+        String encs = realm.getAttribute("credential_response_encryption.enc_values_supported");
+        String required = realm.getAttribute("credential_response_encryption.encryption_required");
+        if (algs != null && encs != null && required != null) {
+            try {
+                ObjectMapper mapper = new ObjectMapper();
+                return new CredentialIssuer.CredentialResponseEncryption()
+                        .setAlgValuesSupported(mapper.readValue(algs, new TypeReference<List<String>>() {
+                        }))
+                        .setEncValuesSupported(mapper.readValue(encs, new TypeReference<List<String>>() {
+                        }))
+                        .setEncryptionRequired(Boolean.parseBoolean(required));
+            } catch (Exception e) {
+                LOGGER.warnf(e, "Failed to parse credential_response_encryption fields from realm attributes.");
+            }
+        }
+        return null;
+    }
+
+    private CredentialIssuer.BatchCredentialIssuance getBatchCredentialIssuance(KeycloakSession session) {
+        RealmModel realm = session.getContext().getRealm();
+        String batchSize = realm.getAttribute("batch_credential_issuance.batch_size");
+        if (batchSize != null) {
+            try {
+                return new CredentialIssuer.BatchCredentialIssuance()
+                        .setBatchSize(Integer.parseInt(batchSize));
+            } catch (Exception e) {
+                LOGGER.warnf(e, "Failed to parse batch_credential_issuance.batch_size from realm attributes.");
+            }
+        }
+        return null;
+    }
 
+    private String getSignedMetadata(KeycloakSession session) {
+        RealmModel realm = session.getContext().getRealm();
+        return realm.getAttribute("signed_metadata");
     }
 
     /**
      * Return the supported credentials from the current session.
-     * It will take into account the configured {@link VerifiableCredentialsSigningService}'s and there supported format
+     * It will take into account the configured {@link CredentialBuilder}'s and there supported format
      * and the credentials supported by the clients available in the session.
      */
     public static Map<String, SupportedCredentialConfiguration> getSupportedCredentials(KeycloakSession keycloakSession) {
+        List<String> globalSupportedSigningAlgorithms = getSupportedSignatureAlgorithms(keycloakSession);
 
         RealmModel realm = keycloakSession.getContext().getRealm();
-        List<String> supportedFormats = realm.getComponentsStream(realm.getId(), VerifiableCredentialsSigningService.class.getName())
-                .map(cm ->
-                        keycloakSession
-                                .getKeycloakSessionFactory()
-                                .getProviderFactory(VerifiableCredentialsSigningService.class, cm.getProviderId())
-                )
-                .filter(VCSigningServiceProviderFactory.class::isInstance)
-                .map(VCSigningServiceProviderFactory.class::cast)
-                .map(VCSigningServiceProviderFactory::supportedFormat)
-                .toList();
-
-        // Retrieve signature algorithms
-        List<String> supportedAlgorithms = getSupportedSignatureAlgorithms(keycloakSession);
-
-        // Retrieving attributes from client definition.
-        // This will be removed when token production is migrated.
-        Map<String, SupportedCredentialConfiguration> clientAttributes = keycloakSession.getContext()
-                .getRealm()
-                .getClientsStream()
-                .filter(cm -> cm.getProtocol() != null)
-                .filter(cm -> cm.getProtocol().equals(OID4VCLoginProtocolFactory.PROTOCOL_ID))
-                .map(cm -> OID4VCClientRegistrationProvider.fromClientAttributes(cm.getClientId(), cm.getAttributes()))
-                .map(OID4VCClient::getSupportedVCTypes)
-                .flatMap(List::stream)
-                .filter(sc -> supportedFormats.contains(sc.getFormat()))
-                .distinct()
-                .peek(sc -> sc.setCredentialSigningAlgValuesSupported(supportedAlgorithms))
-                .collect(Collectors.toMap(SupportedCredentialConfiguration::getId, sc -> sc, (sc1, sc2) -> sc1));
-
-
-        // Retrieving attributes from the realm
-        Map<String, SupportedCredentialConfiguration> realmAttr = fromRealmAttributes(realm.getAttributes())
-                .stream()
-                .filter(sc -> supportedFormats.contains(sc.getFormat()))
-                .distinct()
-                .peek(sc -> sc.setCredentialSigningAlgValuesSupported(supportedAlgorithms))
-                .collect(Collectors.toMap(SupportedCredentialConfiguration::getId, sc -> sc, (sc1, sc2) -> sc1));
+        Map<String, SupportedCredentialConfiguration> supportedCredentialConfigurations =
+                keycloakSession.clientScopes()
+                               .getClientScopesByProtocol(realm, Oid4VciConstants.OID4VC_PROTOCOL)
+                               .map(CredentialScopeModel::new)
+                               .map(clientScope -> {
+                                   return SupportedCredentialConfiguration.parse(keycloakSession,
+                                                                                 clientScope,
+                                                                                 globalSupportedSigningAlgorithms
+                                   );
+                               })
+                               .collect(Collectors.toMap(SupportedCredentialConfiguration::getId, sc -> sc, (sc1, sc2) -> sc1));
 
         // Aggregating attributes. Having realm attributes take preference.
-        Map<String, SupportedCredentialConfiguration> aggregatedAttr = new HashMap<>(clientAttributes);
-        aggregatedAttr.putAll(realmAttr);
-        return aggregatedAttr;
+        return supportedCredentialConfigurations;
+    }
+
+    public static SupportedCredentialConfiguration toSupportedCredentialConfiguration(KeycloakSession keycloakSession,
+                                                                                      CredentialScopeModel credentialModel) {
+        List<String> globalSupportedSigningAlgorithms = getSupportedSignatureAlgorithms(keycloakSession);
+        return SupportedCredentialConfiguration.parse(keycloakSession,
+                                                      credentialModel,
+                                                      globalSupportedSigningAlgorithms);
     }
 
     /**
@@ -134,6 +168,14 @@ public static String getIssuer(KeycloakContext context) {
 
     }
 
+    /**
+     * Return the nonce endpoint address
+     */
+    public static String getNonceEndpoint(KeycloakContext context) {
+        return getIssuer(context) + "/protocol/" + OID4VCLoginProtocolFactory.PROTOCOL_ID + "/" +
+                OID4VCIssuerEndpoint.NONCE_PATH;
+    }
+
     /**
      * Return the credentials endpoint address
      */
@@ -141,27 +183,6 @@ public static String getCredentialsEndpoint(KeycloakContext context) {
         return getIssuer(context) + "/protocol/" + OID4VCLoginProtocolFactory.PROTOCOL_ID + "/" + OID4VCIssuerEndpoint.CREDENTIAL_PATH;
     }
 
-    public static final String VC_KEY = "vc";
-
-    public static List<SupportedCredentialConfiguration> fromRealmAttributes(Map<String, String> realmAttributes) {
-
-        Set<String> supportedCredentialIds = new HashSet<>();
-        Map<String, String> attributes = new HashMap<>();
-        realmAttributes.forEach((entryKey, value) -> {
-            if (!entryKey.startsWith(VC_KEY)) {
-                return;
-            }
-            String key = entryKey.substring((VC_KEY + ".").length());
-            supportedCredentialIds.add(key.split("\\.")[0]);
-            attributes.put(key, value);
-        });
-
-        return supportedCredentialIds
-                .stream()
-                .map(id -> SupportedCredentialConfiguration.fromDotNotation(id, attributes))
-                .toList();
-    }
-
     public static List<String> getSupportedSignatureAlgorithms(KeycloakSession session) {
         RealmModel realm = session.getContext().getRealm();
         KeyManager keyManager = session.keys();
@@ -173,4 +194,5 @@ public static List<String> getSupportedSignatureAlgorithms(KeycloakSession sessi
                 .distinct()
                 .collect(Collectors.toList());
     }
+
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBody.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBody.java
index 4095d816a6a9..b3b0d162700a 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBody.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBody.java
@@ -17,10 +17,17 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import org.keycloak.jose.jwk.JWK;
+
 /**
  * Incomplete representations of format-specific credentials.
  *
  * @author <a href="mailto:Ingrid.Kamga@adorsys.com">Ingrid Kamga</a>
  */
 public interface CredentialBody {
+
+    /**
+     * Bind the credential to a public key prior to signing.
+     */
+    void addKeyBinding(JWK jwk) throws CredentialBuilderException;
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilder.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilder.java
index 42a950dd021a..b1e6373d76c8 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilder.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilder.java
@@ -40,7 +40,7 @@ default void close() {
      * The credential is built incompletely, intended that it would be signed externally.
      * </p>
      *
-     * @param verifiableCredential an internal representation of the credential
+     * @param verifiableCredential  an internal representation of the credential
      * @param credentialBuildConfig additional configurations for building the credential
      * @return the built verifiable credential of the specific format, ready to be signed
      */
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactory.java
index dc890da79004..c9a8aaad7e58 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactory.java
@@ -31,6 +31,16 @@ public interface CredentialBuilderFactory extends
         ComponentFactory<CredentialBuilder, CredentialBuilder>,
         OID4VCEnvironmentProviderFactory {
 
+    /**
+     * Returns the credential format supported by the credential builder.
+     */
+    String getSupportedFormat();
+
+    @Override
+    default String getId() {
+        return getSupportedFormat();
+    }
+
     @Override
     default void init(Config.Scope config) {
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderUtils.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderUtils.java
index 00d8f00c66b9..a0bbfb24ad07 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderUtils.java
@@ -17,8 +17,6 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 
 import java.net.URI;
@@ -27,7 +25,6 @@
 
 public class CredentialBuilderUtils {
 
-    private static final String ISSUER_DID_REALM_ATTRIBUTE_KEY = "issuerDid";
     private static final String ID_TEMPLATE = "urn:uuid:%s";
 
     // retrieve the credential id from the given VC or generate one.
@@ -36,9 +33,4 @@ public static String createCredentialId(VerifiableCredential verifiableCredentia
                 .orElse(URI.create(String.format(ID_TEMPLATE, UUID.randomUUID())))
                 .toString();
     }
-
-    public static Optional<String> getIssuerDid(KeycloakSession keycloakSession) {
-        RealmModel realm = keycloakSession.getContext().getRealm();
-        return Optional.ofNullable(realm.getAttribute(ISSUER_DID_REALM_ATTRIBUTE_KEY));
-    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBody.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBody.java
index 267c048de1ec..6218f6f8a179 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBody.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBody.java
@@ -17,7 +17,9 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import org.jboss.logging.Logger;
 import org.keycloak.crypto.SignatureSignerContext;
+import org.keycloak.jose.jwk.JWK;
 import org.keycloak.jose.jws.JWSBuilder;
 
 /**
@@ -25,12 +27,18 @@
  */
 public class JwtCredentialBody implements CredentialBody {
 
+    private static final Logger LOGGER = Logger.getLogger(JwtCredentialBody.class);
+
     private final JWSBuilder.EncodingBuilder jwsEncodingBuilder;
 
     public JwtCredentialBody(JWSBuilder.EncodingBuilder jwsEncodingBuilder) {
         this.jwsEncodingBuilder = jwsEncodingBuilder;
     }
 
+    public void addKeyBinding(JWK jwk) throws CredentialBuilderException {
+        LOGGER.warnf("Key binding is not yet implemented for JWT credentials");
+    }
+
     public String sign(SignatureSignerContext signatureSignerContext) {
         return jwsEncodingBuilder.sign(signatureSignerContext);
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilder.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilder.java
index e965c71e8a2e..a0b47ccf4016 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilder.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilder.java
@@ -24,7 +24,6 @@
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.representations.JsonWebToken;
 
-import java.net.URI;
 import java.time.Instant;
 import java.util.Optional;
 
@@ -33,11 +32,9 @@ public class JwtCredentialBuilder implements CredentialBuilder {
     private static final String VC_CLAIM_KEY = "vc";
     private static final String ID_CLAIM_KEY = "id";
 
-    private final String credentialIssuer;
     private final TimeProvider timeProvider;
 
-    public JwtCredentialBuilder(String credentialIssuer, TimeProvider timeProvider) {
-        this.credentialIssuer = credentialIssuer;
+    public JwtCredentialBuilder(TimeProvider timeProvider) {
         this.timeProvider = timeProvider;
     }
 
@@ -52,7 +49,7 @@ public JwtCredentialBody buildCredentialBody(
             CredentialBuildConfig credentialBuildConfig
     ) throws CredentialBuilderException {
         // Populate the issuer field of the VC
-        verifiableCredential.setIssuer(URI.create(credentialIssuer));
+        verifiableCredential.setIssuer(credentialBuildConfig.getCredentialIssuer());
 
         // Get the issuance date from the credential. Since nbf is mandatory, we set it to the current time if not
         // provided
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderFactory.java
index be3ae2e751eb..2eaf5ceb66c5 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderFactory.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import java.util.ArrayList;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.protocol.oid4vc.issuance.OffsetTimeProvider;
@@ -30,8 +31,10 @@
  */
 public class JwtCredentialBuilderFactory implements CredentialBuilderFactory {
 
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<>();
+
     @Override
-    public String getId() {
+    public String getSupportedFormat() {
         return Format.JWT_VC;
     }
 
@@ -42,14 +45,11 @@ public String getHelpText() {
 
     @Override
     public List<ProviderConfigProperty> getConfigProperties() {
-        return null;
+        return configProperties;
     }
 
     @Override
     public CredentialBuilder create(KeycloakSession session, ComponentModel model) {
-        String credentialIssuer = CredentialBuilderUtils.getIssuerDid(session)
-                .orElseThrow(() -> new CredentialBuilderException("No issuerDid configured."));
-
-        return new JwtCredentialBuilder(credentialIssuer, new OffsetTimeProvider());
+        return new JwtCredentialBuilder(new OffsetTimeProvider());
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBody.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBody.java
index 295417c42851..b42ac12176da 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBody.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBody.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import org.jboss.logging.Logger;
+import org.keycloak.jose.jwk.JWK;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 
 /**
@@ -24,12 +26,17 @@
  */
 public class LDCredentialBody implements CredentialBody {
 
+    private static final Logger LOGGER = Logger.getLogger(LDCredentialBody.class);
     private final VerifiableCredential verifiableCredential;
 
     public LDCredentialBody(VerifiableCredential verifiableCredential) {
         this.verifiableCredential = verifiableCredential;
     }
 
+    public void addKeyBinding(JWK jwk) throws CredentialBuilderException {
+        LOGGER.warnf("Key binding is not yet implemented for LDP credentials");
+    }
+
     public VerifiableCredential getVerifiableCredential() {
         return verifiableCredential;
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilder.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilder.java
index fcd8219a6aa8..32021c3368b4 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilder.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilder.java
@@ -31,10 +31,7 @@
  */
 public class LDCredentialBuilder implements CredentialBuilder {
 
-    private final String credentialIssuer;
-
-    public LDCredentialBuilder(String credentialIssuer) {
-        this.credentialIssuer = credentialIssuer;
+    public LDCredentialBuilder() {
     }
 
     @Override
@@ -49,7 +46,7 @@ public LDCredentialBody buildCredentialBody(
     ) throws CredentialBuilderException {
         // The default credential format is basically this format,
         // so not much is to be done.
-        verifiableCredential.setIssuer(URI.create(credentialIssuer));
+        verifiableCredential.setIssuer(credentialBuildConfig.getCredentialIssuer());
         return new LDCredentialBody(verifiableCredential);
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilderFactory.java
index d9d818d56a1f..777a5fbb0288 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilderFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/LDCredentialBuilderFactory.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import java.util.ArrayList;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.protocol.oid4vc.model.Format;
@@ -29,8 +30,10 @@
  */
 public class LDCredentialBuilderFactory implements CredentialBuilderFactory {
 
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<>();
+
     @Override
-    public String getId() {
+    public String getSupportedFormat() {
         return Format.LDP_VC;
     }
 
@@ -41,14 +44,11 @@ public String getHelpText() {
 
     @Override
     public List<ProviderConfigProperty> getConfigProperties() {
-        return null;
+        return configProperties;
     }
 
     @Override
     public CredentialBuilder create(KeycloakSession session, ComponentModel model) {
-        String credentialIssuer = CredentialBuilderUtils.getIssuerDid(session)
-                .orElseThrow(() -> new CredentialBuilderException("No issuerDid configured."));
-
-        return new LDCredentialBuilder(credentialIssuer);
+        return new LDCredentialBuilder();
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBody.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBody.java
index 975b4817ad7f..caeae0dccf18 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBody.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBody.java
@@ -19,6 +19,7 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.keycloak.crypto.SignatureSignerContext;
+import org.keycloak.jose.jwk.JWK;
 import org.keycloak.sdjwt.SdJwt;
 import org.keycloak.util.JsonSerialization;
 
@@ -30,6 +31,7 @@
 public class SdJwtCredentialBody implements CredentialBody {
 
     private static final String CNF_CLAIM = "cnf";
+    private static final String JWK_CLAIM = "jwk";
 
     private final SdJwt.Builder sdJwtBuilder;
     private final Map<String, Object> claimSet;
@@ -39,8 +41,12 @@ public SdJwtCredentialBody(SdJwt.Builder sdJwtBuilder, Map<String, Object> claim
         this.claimSet = claimSet;
     }
 
-    public void addCnfClaim(Object cnf) {
-        claimSet.put(CNF_CLAIM, cnf);
+    public void addKeyBinding(JWK jwk) throws CredentialBuilderException {
+        claimSet.put(CNF_CLAIM, Map.of(JWK_CLAIM, jwk));
+    }
+
+    public Map<String, Object> getClaimSet() {
+        return claimSet;
     }
 
     public String sign(SignatureSignerContext signatureSignerContext) {
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilder.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilder.java
index 745d410e68df..e299ceeadc47 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilder.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilder.java
@@ -34,10 +34,7 @@ public class SdJwtCredentialBuilder implements CredentialBuilder {
     public static final String ISSUER_CLAIM = "iss";
     public static final String VERIFIABLE_CREDENTIAL_TYPE_CLAIM = "vct";
 
-    private final String credentialIssuer;
-
-    public SdJwtCredentialBuilder(String credentialIssuer) {
-        this.credentialIssuer = credentialIssuer;
+    public SdJwtCredentialBuilder() {
     }
 
     @Override
@@ -58,7 +55,7 @@ public SdJwtCredentialBody buildCredentialBody(
         DisclosureSpec.Builder disclosureSpecBuilder = DisclosureSpec.builder();
         claimSet.entrySet()
                 .stream()
-                .filter(entry -> !credentialBuildConfig.getVisibleClaims().contains(entry.getKey()))
+                .filter(entry -> !credentialBuildConfig.getSdJwtVisibleClaims().contains(entry.getKey()))
                 .forEach(entry -> {
                     if (entry instanceof List<?> listValue) {
                         // FIXME: Unreachable branch. The intent was probably to check `entry.getValue()`,
@@ -75,7 +72,7 @@ public SdJwtCredentialBody buildCredentialBody(
                 });
 
         // Populate configured fields (necessarily visible)
-        claimSet.put(ISSUER_CLAIM, credentialIssuer);
+        claimSet.put(ISSUER_CLAIM, credentialBuildConfig.getCredentialIssuer());
         claimSet.put(VERIFIABLE_CREDENTIAL_TYPE_CLAIM, credentialBuildConfig.getCredentialType());
 
         // jti, nbf, iat and exp are all optional. So need to be set by a protocol mapper if needed.
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderFactory.java
index 44667c13076c..fd3f7736b031 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderFactory.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
 
+import java.util.ArrayList;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
@@ -30,8 +31,10 @@
  */
 public class SdJwtCredentialBuilderFactory implements CredentialBuilderFactory {
 
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<>();
+
     @Override
-    public String getId() {
+    public String getSupportedFormat() {
         return Format.SD_JWT_VC;
     }
 
@@ -42,16 +45,11 @@ public String getHelpText() {
 
     @Override
     public List<ProviderConfigProperty> getConfigProperties() {
-        return null;
+        return configProperties;
     }
 
     @Override
     public CredentialBuilder create(KeycloakSession session, ComponentModel model) {
-        // Use the credential issuer URI advertised on the metadata endpoint by default.
-        // An issuer DID configured at the realm level overrides that value.
-        String credentialIssuer = CredentialBuilderUtils.getIssuerDid(session)
-                .orElse(OID4VCIssuerWellKnownProvider.getIssuer(session.getContext()));
-
-        return new SdJwtCredentialBuilder(credentialIssuer);
+        return new SdJwtCredentialBuilder();
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AbstractProofValidator.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AbstractProofValidator.java
new file mode 100644
index 000000000000..64b954a25ff9
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/AbstractProofValidator.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.common.VerificationException;
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.SignatureProvider;
+import org.keycloak.crypto.SignatureVerifierContext;
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jwk.JWKParser;
+import org.keycloak.jose.jwk.OKPPublicJWK;
+import org.keycloak.models.KeycloakSession;
+
+public abstract class AbstractProofValidator implements ProofValidator {
+
+    protected final KeycloakSession keycloakSession;
+
+    protected AbstractProofValidator(KeycloakSession keycloakSession) {
+        this.keycloakSession = keycloakSession;
+    }
+
+    protected SignatureVerifierContext getVerifier(JWK jwk, String jwsAlgorithm) throws VerificationException {
+        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class, jwsAlgorithm);
+        KeyWrapper keyWrapper = getKeyWrapper(jwk, jwsAlgorithm);
+        keyWrapper.setUse(KeyUse.SIG);
+        return signatureProvider.verifier(keyWrapper);
+    }
+
+    private KeyWrapper getKeyWrapper(JWK jwk, String algorithm) {
+        KeyWrapper keyWrapper = new KeyWrapper();
+        keyWrapper.setType(jwk.getKeyType());
+
+        // Use the algorithm provided by the caller, and not the one inside the jwk (if any)
+        // As jws validation will also check that one against the value "none"
+        keyWrapper.setAlgorithm(algorithm);
+
+        // Set the curve if any
+        if (jwk.getOtherClaims().get(OKPPublicJWK.CRV) != null) {
+            keyWrapper.setCurve((String) jwk.getOtherClaims().get(OKPPublicJWK.CRV));
+        }
+
+        JWKParser parser = JWKParser.create(jwk);
+        keyWrapper.setPublicKey(parser.toPublicKey());
+        return keyWrapper;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandler.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandler.java
new file mode 100644
index 000000000000..c73b55189e5a
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandler.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import jakarta.annotation.Nullable;
+import org.keycloak.common.VerificationException;
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Pascal Knüppel
+ */
+public interface CNonceHandler extends Provider {
+
+    /**
+     * used to build a cNonce in any style. For jwt-based cNonces we will additionally require the audience-values that
+     * should be added into the cNonce
+     *
+     * @param audiences         the audiences for jwt-based cNonces
+     * @param additionalDetails additional attributes that might be required to build the cNonce and that are handler
+     *                          specific
+     * @return the cNonce in string representation
+     */
+    public String buildCNonce(List<String> audiences, @Nullable Map<String, Object> additionalDetails);
+
+    /**
+     * must verify the validity of a cNonce value that has been issued by the {@link #buildCNonce(List, Map)} method.
+     *
+     * @param cNonce            the cNonce to validate
+     * @param audiences         the expected audiences for jwt-based cNonces
+     * @param additionalDetails additional attributes that might be required to build the cNonce and that are handler
+     *                          specific
+     */
+    public void verifyCNonce(String cNonce, List<String> audiences, @Nullable Map<String, Object> additionalDetails) throws VerificationException;
+
+    @Override
+    default void close() {
+        // do nothing
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerFactory.java
new file mode 100644
index 000000000000..6cd502c31b36
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerFactory.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author Pascal Knüppel
+ */
+public interface CNonceHandlerFactory extends ProviderFactory<CNonceHandler> {
+
+    @Override
+    default void init(Config.Scope config) {
+        // do nothing
+    }
+
+    @Override
+    default void postInit(KeycloakSessionFactory factory) {
+        // do nothing
+    }
+
+    @Override
+    default void close() {
+        // do nothing
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerSpi.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerSpi.java
new file mode 100644
index 000000000000..21303490189e
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/CNonceHandlerSpi.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class CNonceHandlerSpi implements Spi {
+
+    public static final String SPI_NAME = "oid4vci-c-nonce-spi";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return SPI_NAME;
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return CNonceHandler.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return CNonceHandlerFactory.class;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandler.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandler.java
new file mode 100644
index 000000000000..3edf5bd6069f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandler.java
@@ -0,0 +1,199 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import jakarta.annotation.Nullable;
+import org.keycloak.TokenVerifier;
+import org.keycloak.common.VerificationException;
+import org.keycloak.common.util.Base64;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.SignatureProvider;
+import org.keycloak.crypto.SignatureSignerContext;
+import org.keycloak.crypto.SignatureVerifierContext;
+import org.keycloak.jose.jws.JWSBuilder;
+import org.keycloak.models.KeycloakContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.constants.Oid4VciConstants;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.model.JwtCNonce;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.saml.RandomSecret;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Random;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class JwtCNonceHandler implements CNonceHandler {
+
+    public static final String SOURCE_ENDPOINT = "source_endpoint";
+
+    public static final int NONCE_DEFAULT_LENGTH = 50;
+
+    public static final int NONCE_LENGTH_RANDOM_OFFSET = 15;
+
+    private static final Logger logger = LoggerFactory.getLogger(JwtCNonceHandler.class);
+
+    private final KeycloakSession keycloakSession;
+
+    private final KeyWrapper signingKey;
+
+    public JwtCNonceHandler(KeycloakSession keycloakSession) {
+        this.keycloakSession = keycloakSession;
+        this.signingKey = selectSigningKey(keycloakSession.getContext().getRealm());
+    }
+
+    @Override
+    public String buildCNonce(List<String> audiences, Map<String, Object> additionalDetails) {
+        RealmModel realm = keycloakSession.getContext().getRealm();
+        final String issuer = OID4VCIssuerWellKnownProvider.getIssuer(keycloakSession.getContext());
+        // TODO discussion about the attribute name to use
+        final Integer nonceLifetimeMillis = realm.getAttribute(Oid4VciConstants.C_NONCE_LIFETIME_IN_SECONDS, 60);
+        audiences = Optional.ofNullable(audiences).orElseGet(Collections::emptyList);
+        final Instant now = Instant.now();
+        final long expiresAt = now.plus(nonceLifetimeMillis, ChronoUnit.SECONDS).getEpochSecond();
+        final int nonceLength = NONCE_DEFAULT_LENGTH + new Random().nextInt(NONCE_LENGTH_RANDOM_OFFSET);
+        // this generated value itself is basically just a salt-value for the generated token, which itself is the nonce.
+        final String strongSalt = Base64.encodeBytes(RandomSecret.createRandomSecret(nonceLength));
+
+        JsonWebToken jwtCNonce = new JwtCNonce().salt(strongSalt)
+                                                .issuer(issuer)
+                                                .audience(audiences.toArray(String[]::new))
+                                                .exp(expiresAt);
+        Optional.ofNullable(additionalDetails).ifPresent(map -> {
+            map.forEach(jwtCNonce::setOtherClaims);
+        });
+
+        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class,
+                                                                          signingKey.getAlgorithm());
+        SignatureSignerContext signatureSignerContext = signatureProvider.signer(signingKey);
+        return new JWSBuilder().jsonContent(jwtCNonce).sign(signatureSignerContext);
+    }
+
+    @Override
+    public void verifyCNonce(String cNonce, List<String> audiences, @Nullable Map<String, Object> additionalDetails)
+            throws VerificationException {
+        if (cNonce == null) {
+            throw new VerificationException("c_nonce is required");
+        }
+        TokenVerifier<JsonWebToken> verifier = TokenVerifier.create(cNonce, JsonWebToken.class);
+        KeycloakContext keycloakContext = keycloakSession.getContext();
+        List<TokenVerifier.Predicate<JsonWebToken>> verifiers = //
+                new ArrayList<>(List.of(jwt -> {
+                                            String expectedIssuer = OID4VCIssuerWellKnownProvider.getIssuer(keycloakContext);
+                                            if (!expectedIssuer.equals(jwt.getIssuer())) {
+                                                String message = String.format(
+                                                    "c_nonce issuer did not match: %s(expected) != %s(actual)",
+                                                    expectedIssuer, jwt.getIssuer());
+                                                throw new VerificationException(message);
+                                            }
+                                            return true;
+                                        }, jwt -> {
+                                            List<String> actualValue = Optional.ofNullable(jwt.getAudience())
+                                                                               .map(Arrays::asList)
+                                                                               .orElse(List.of());
+                                            return checkAttributeEquality("aud", audiences, actualValue);
+                                        },jwt -> {
+                                            String salt = Optional.ofNullable(jwt.getOtherClaims())
+                                                                   .map(m -> String.valueOf(m.get("salt")))
+                                                                   .orElse(null);
+                                            final int saltLength = Optional.ofNullable(salt).map(String::length)
+                                                                            .orElse(0);
+                                            if (saltLength < NONCE_DEFAULT_LENGTH){
+                                                String message = String.format(
+                                                    "c_nonce-salt is not of expected length: %s(actual) < %s(expected)",
+                                                    saltLength, NONCE_DEFAULT_LENGTH);
+                                                throw new VerificationException(message);
+                                            }
+                                            return true;
+                                        },
+                                        jwt -> {
+                                            Long exp = jwt.getExp();
+                                            if (exp == null) {
+                                                throw new VerificationException("c_nonce has no expiration time");
+                                            }
+                                            long now = Instant.now().getEpochSecond();
+                                            if (exp < now) {
+                                                String message = String.format(
+                                                        "c_nonce not valid: %s(exp) < %s(now)",
+                                                        exp,
+                                                        now);
+                                                throw new VerificationException(message);
+                                            }
+                                            return true;
+                                        }));
+        Optional.ofNullable(additionalDetails).ifPresent(map -> {
+            map.forEach((key, object) -> {
+                verifiers.add(jwt -> {
+                    Object actualValue = Optional.ofNullable(jwt.getOtherClaims())
+                                                 .map(claimMap -> claimMap.get(key))
+                                                 .orElse(null);
+                    return checkAttributeEquality(key, object, actualValue);
+                });
+            });
+        });
+        verifier.withChecks(verifiers.toArray(new TokenVerifier.Predicate[0]));
+        SignatureVerifierContext signatureVerifier = keycloakSession.getProvider(SignatureProvider.class,
+                                                                                 signingKey.getAlgorithm())
+                                                                    .verifier(signingKey);
+        verifier.verifierContext(signatureVerifier);
+        verifier.verify(); // throws a VerificationException on failure
+    }
+
+    protected boolean checkAttributeEquality(String key, Object object, Object actualValue) throws VerificationException {
+        boolean isEqual = Objects.equals(object, actualValue);
+        if (!isEqual) {
+            String message = String.format(
+                    "c_nonce: expected '%s' to be equal to '%s' but actual value was '%s'",
+                    key,
+                    object,
+                    actualValue);
+            throw new VerificationException(message);
+        }
+        return isEqual;
+    }
+
+    protected KeyWrapper selectSigningKey(RealmModel realm) {
+        KeyWrapper signingKey;
+        try {
+            signingKey = keycloakSession.keys().getActiveKey(realm, KeyUse.SIG, Algorithm.ES256);
+        } catch (RuntimeException ex) {
+            logger.debug("Failed to find active ES256 signing key for realm {}. Falling back to RSA...",
+                         realm.getName());
+            logger.debug(ex.getMessage(), ex);
+            // use RSA only as fallback since the preferred algorithm by OpenID4VC is elliptic curve
+            signingKey = keycloakSession.keys().getActiveKey(realm, KeyUse.SIG, Algorithm.RS256);
+        }
+        return signingKey;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandlerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandlerFactory.java
new file mode 100644
index 000000000000..c4a906354290
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtCNonceHandlerFactory.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class JwtCNonceHandlerFactory implements CNonceHandlerFactory {
+
+    public static final String PROVIDER_ID = "oid4vci-jwt-c-nonce-builder";
+
+    @Override
+    public CNonceHandler create(KeycloakSession session) {
+        return new JwtCNonceHandler(session);
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidator.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidator.java
new file mode 100644
index 000000000000..72d6c3ed652a
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidator.java
@@ -0,0 +1,226 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.common.VerificationException;
+import org.keycloak.crypto.SignatureVerifierContext;
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jws.JWSHeader;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.models.KeycloakContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
+import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
+import org.keycloak.protocol.oid4vc.model.JwtProof;
+import org.keycloak.protocol.oid4vc.model.Proof;
+import org.keycloak.protocol.oid4vc.model.ProofType;
+import org.keycloak.protocol.oid4vc.model.ProofTypeJWT;
+import org.keycloak.protocol.oid4vc.model.ProofTypesSupported;
+import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * Validates the conformance and authenticity of presented JWT proofs.
+ *
+ * @see "https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type"
+ */
+public class JwtProofValidator extends AbstractProofValidator {
+
+    public static final String PROOF_JWT_TYP = "openid4vci-proof+jwt";
+    private static final String CRYPTOGRAPHIC_BINDING_METHOD_JWK = "jwk";
+
+    protected JwtProofValidator(KeycloakSession keycloakSession) {
+        super(keycloakSession);
+    }
+
+    @Override
+    public String getProofType() {
+        return ProofType.JWT;
+    }
+
+    public JWK validateProof(VCIssuanceContext vcIssuanceContext) throws VCIssuerException {
+        try {
+            return validateJwtProof(vcIssuanceContext);
+        } catch (JWSInputException | VerificationException | IOException e) {
+            throw new VCIssuerException("Could not validate proof", e);
+        }
+    }
+
+    /*
+     * Validates a proof provided by the client if any.
+     *
+     * Returns null if there is no need to include a key binding in the credential
+     *
+     * Return the JWK to be included as key binding in the JWK if the provided proof was correctly validated
+     *
+     * @param vcIssuanceContext
+     * @return
+     * @throws VCIssuerException
+     * @throws JWSInputException
+     * @throws VerificationException
+     * @throws IllegalStateException: is credential type badly configured
+     * @throws IOException
+     */
+    private JWK validateJwtProof(VCIssuanceContext vcIssuanceContext) throws VCIssuerException, JWSInputException, VerificationException, IOException {
+
+        Optional<Proof> optionalProof = getProofFromContext(vcIssuanceContext);
+
+        if (optionalProof.isEmpty() || !(optionalProof.get() instanceof JwtProof)) {
+            return null; // No proof support
+        }
+
+        JwtProof proof = (JwtProof) optionalProof.get();
+
+        // Check key binding config for jwt. Only type supported.
+        checkCryptographicKeyBinding(vcIssuanceContext);
+
+        JWSInput jwsInput = getJwsInput(proof);
+        JWSHeader jwsHeader = jwsInput.getHeader();
+        validateJwsHeader(vcIssuanceContext, jwsHeader);
+
+        JWK jwk = Optional.ofNullable(jwsHeader.getKey())
+                .orElseThrow(() -> new VCIssuerException("Missing binding key. Make sure provided JWT contains the jwk jwsHeader claim."));
+
+        // Parsing the Proof as an access token shall work, as a proof is a strict subset of an access token.
+        AccessToken proofPayload = JsonSerialization.readValue(jwsInput.getContent(), AccessToken.class);
+        validateProofPayload(vcIssuanceContext, proofPayload);
+
+        SignatureVerifierContext signatureVerifierContext = getVerifier(jwk, jwsHeader.getAlgorithm().name());
+        if (signatureVerifierContext == null) {
+            throw new VCIssuerException("No verifier configured for " + jwsHeader.getAlgorithm());
+        }
+        if (!signatureVerifierContext.verify(jwsInput.getEncodedSignatureInput().getBytes(StandardCharsets.UTF_8), jwsInput.getSignature())) {
+            throw new VCIssuerException("Could not verify signature of provided proof");
+        }
+
+        return jwk;
+    }
+
+    private void checkCryptographicKeyBinding(VCIssuanceContext vcIssuanceContext) {
+        // Make sure we are dealing with a jwk proof.
+        if (vcIssuanceContext.getCredentialConfig().getCryptographicBindingMethodsSupported() == null ||
+                !vcIssuanceContext.getCredentialConfig().getCryptographicBindingMethodsSupported().contains(CRYPTOGRAPHIC_BINDING_METHOD_JWK)) {
+            throw new IllegalStateException("This SD-JWT implementation only supports jwk as cryptographic binding method");
+        }
+    }
+
+    private Optional<Proof> getProofFromContext(VCIssuanceContext vcIssuanceContext) throws VCIssuerException {
+        return Optional.ofNullable(vcIssuanceContext.getCredentialConfig())
+                .map(SupportedCredentialConfiguration::getProofTypesSupported)
+                .flatMap(proofTypesSupported -> {
+                    Optional.ofNullable(proofTypesSupported.getSupportedProofTypes().get("jwt"))
+                            .orElseThrow(() -> new VCIssuerException("SD-JWT supports only jwt proof type."));
+
+                    Proof proofObject = vcIssuanceContext.getCredentialRequest().getProof();
+                    if (proofObject == null) {
+                        throw new VCIssuerException("Credential configuration requires a proof of type: " + ProofType.JWT);
+                    }
+
+                    if (!(proofObject instanceof JwtProof)) {
+                        throw new VCIssuerException("Wrong proof type. Expected JwtProof, but got: " + proofObject.getClass().getSimpleName());
+                    }
+
+                    Proof proof = (Proof) proofObject;
+                    if (!Objects.equals(proof.getProofType(), ProofType.JWT)) {
+                        throw new VCIssuerException("Wrong proof type");
+                    }
+
+                    return Optional.of(proof);
+                });
+    }
+
+    private JWSInput getJwsInput(JwtProof proof) throws JWSInputException {
+        return new JWSInput(proof.getJwt());
+    }
+
+    /**
+     * As we limit accepted algorithm to the ones listed by the issuer, we can omit checking for "none"
+     * The Algorithm enum class does not list the none value anyway.
+     *
+     * @param vcIssuanceContext
+     * @param jwsHeader
+     * @throws VCIssuerException
+     */
+    private void validateJwsHeader(VCIssuanceContext vcIssuanceContext, JWSHeader jwsHeader) throws VCIssuerException {
+        Optional.ofNullable(jwsHeader.getAlgorithm())
+                .orElseThrow(() -> new VCIssuerException("Missing jwsHeader claim alg"));
+
+        // As we limit accepted algorithm to the ones listed by the server, we can omit checking for "none"
+        // The Algorithm enum class does not list the none value anyway.
+        Optional.ofNullable(vcIssuanceContext.getCredentialConfig())
+                .map(SupportedCredentialConfiguration::getProofTypesSupported)
+                .map(ProofTypesSupported::getSupportedProofTypes)
+                .map(proofTypeData -> proofTypeData.get("jwt"))
+                .map(ProofTypesSupported.SupportedProofTypeData::getSigningAlgorithmsSupported)
+                .filter(supportedAlgs -> supportedAlgs.contains(jwsHeader.getAlgorithm().name()))
+                .orElseThrow(() -> new VCIssuerException("Proof signature algorithm not supported: " + jwsHeader.getAlgorithm().name()));
+
+        Optional.ofNullable(jwsHeader.getType())
+                .filter(type -> Objects.equals(PROOF_JWT_TYP, type))
+                .orElseThrow(() -> new VCIssuerException("JWT type must be: " + PROOF_JWT_TYP));
+
+        // KeyId shall not be present alongside the jwk.
+        Optional.ofNullable(jwsHeader.getKeyId())
+                .ifPresent(keyId -> {
+                    throw new VCIssuerException("KeyId not expected in this JWT. Use the jwk claim instead.");
+                });
+    }
+
+    private void validateProofPayload(VCIssuanceContext vcIssuanceContext, AccessToken proofPayload)
+            throws VCIssuerException, VerificationException {
+        // azp is the id of the client, as mentioned in the access token used to request the credential.
+        // Token provided from user is obtained with a clientId that support the oidc login protocol.
+        // oid4vci client doesn't. But it is the client needed at the credential endpoint.
+        //        String azp = vcIssuanceContext.getAuthResult().getToken().getIssuedFor();
+        //        Optional.ofNullable(proofPayload.getIssuer())
+        //                .filter(proofIssuer -> Objects.equals(azp, proofIssuer))
+        //                .orElseThrow(() -> new VCIssuerException("Issuer claim must be null for preauthorized code else the clientId of the client making the request: " + azp));
+
+        // The audience of the proof MUST be the Credential Issuer Identifier.
+        // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type
+        String credentialIssuer = OID4VCIssuerWellKnownProvider.getIssuer(keycloakSession.getContext());
+        Optional.ofNullable(proofPayload.getAudience()) // Ensure null-safety with Optional
+                .map(Arrays::asList) // Convert to List<String>
+                .filter(audiences -> audiences.contains(credentialIssuer)) // Check if the issuer is in the audience list
+                .orElseThrow(() -> new VCIssuerException(
+                        "Proof not produced for this audience. Audience claim must be: " + credentialIssuer + " but are " + Arrays.asList(proofPayload.getAudience())));
+
+        // Validate mandatory iat.
+        // I do not understand the rationale behind requiring an issue time if we are not checking expiration.
+        Optional.ofNullable(proofPayload.getIat())
+                .orElseThrow(() -> new VCIssuerException("Missing proof issuing time. iat claim must be provided."));
+
+        KeycloakContext keycloakContext = keycloakSession.getContext();
+        CNonceHandler cNonceHandler = keycloakSession.getProvider(CNonceHandler.class);
+        cNonceHandler.verifyCNonce(proofPayload.getNonce(),
+                                   List.of(OID4VCIssuerWellKnownProvider.getCredentialsEndpoint(keycloakContext)),
+                                   Map.of(JwtCNonceHandler.SOURCE_ENDPOINT,
+                                          OID4VCIssuerWellKnownProvider.getNonceEndpoint(keycloakContext)));
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorFactory.java
new file mode 100644
index 000000000000..1e20375ba84c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/JwtProofValidatorFactory.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.ProofType;
+
+public class JwtProofValidatorFactory implements ProofValidatorFactory {
+
+    @Override
+    public String getId() {
+        return ProofType.JWT;
+    }
+
+    @Override
+    public ProofValidator create(KeycloakSession session) {
+        return new JwtProofValidator(session);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidator.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidator.java
new file mode 100644
index 000000000000..a0739e839478
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidator.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
+import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
+import org.keycloak.provider.Provider;
+
+public interface ProofValidator extends Provider {
+
+    @Override
+    default void close() {
+    }
+
+    String getProofType();
+
+    /**
+     * Validates a client-provided key binding proof.
+     *
+     * @param vcIssuanceContext the issuance context with credential request and config
+     * @return the JWK to bind to the credential
+     */
+    JWK validateProof(VCIssuanceContext vcIssuanceContext) throws VCIssuerException;
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorFactory.java
new file mode 100644
index 000000000000..9cd13dfbbc8f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorFactory.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oid4vc.OID4VCEnvironmentProviderFactory;
+import org.keycloak.provider.ProviderFactory;
+
+public interface ProofValidatorFactory extends ProviderFactory<ProofValidator>, OID4VCEnvironmentProviderFactory {
+
+    // Most concrete factories wouldn't have to implement the methods below,
+    // hence we provide empty default implementations for convenience.
+
+    @Override
+    default void init(Config.Scope config) {
+    }
+
+    @Override
+    default void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    default void close() {
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorSpi.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorSpi.java
new file mode 100644
index 000000000000..c0f4a554297a
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/keybinding/ProofValidatorSpi.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.keybinding;
+
+import org.keycloak.provider.Spi;
+
+/**
+ * Spi implementation of the creation of {@link ProofValidator}
+ *
+ * @author <a href="mailto:Ingrid.Kamga@adorsys.com">Ingrid Kamga</a>
+ */
+public class ProofValidatorSpi implements Spi {
+    private static final String NAME = "proofValidator";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return NAME;
+    }
+
+    @Override
+    public Class<ProofValidator> getProviderClass() {
+        return ProofValidator.class;
+    }
+
+    @Override
+    public Class<ProofValidatorFactory> getProviderFactoryClass() {
+        return ProofValidatorFactory.class;
+    }
+}
+
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java
index dc6dcccea3e0..1559990e5149 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCContextMapper.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
@@ -27,6 +28,7 @@
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 
 /**
@@ -57,6 +59,21 @@ protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    /**
+     * this claim is not added by default to the metadata
+     */
+    @Override
+    public boolean includeInMetadata() {
+        return Optional.ofNullable(mapperModel.getConfig().get(CredentialScopeModel.INCLUDE_IN_METADATA))
+                       .map(Boolean::parseBoolean)
+                       .orElse(false);
+    }
+
+    @Override
+    public List<String> getMetadataAttributePath() {
+        return List.of(TYPE_KEY);
+    }
+
     public void setClaimsForCredential(VerifiableCredential verifiableCredential,
                                        UserSessionModel userSessionModel) {
         // remove duplicates
@@ -92,4 +109,4 @@ public ProtocolMapper create(KeycloakSession session) {
     public String getId() {
         return MAPPER_ID;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCGeneratedIdMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCGeneratedIdMapper.java
index 9cca842c775a..5ba3b591fc99 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCGeneratedIdMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCGeneratedIdMapper.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.apache.commons.collections4.ListUtils;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
@@ -37,14 +39,13 @@
 public class OID4VCGeneratedIdMapper extends OID4VCMapper {
 
     public static final String MAPPER_ID = "oid4vc-generated-id-mapper";
-    public static final String SUBJECT_PROPERTY_CONFIG_KEY = "subjectProperty";
     private static final String SUBJECT_PROPERTY_CONFIG_KEY_DEFAULT = "id";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
 
     static {
         ProviderConfigProperty idPropertyNameConfig = new ProviderConfigProperty();
-        idPropertyNameConfig.setName(SUBJECT_PROPERTY_CONFIG_KEY);
+        idPropertyNameConfig.setName(CLAIM_NAME);
         idPropertyNameConfig.setLabel("ID Property Name");
         idPropertyNameConfig.setHelpText("Name of the property to contain the generated id.");
         idPropertyNameConfig.setDefaultValue(SUBJECT_PROPERTY_CONFIG_KEY_DEFAULT);
@@ -57,6 +58,24 @@ protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    /**
+     * this claim is not added by default to the metadata
+     */
+    @Override
+    public boolean includeInMetadata() {
+        return Optional.ofNullable(mapperModel.getConfig().get(CredentialScopeModel.INCLUDE_IN_METADATA))
+                       .map(Boolean::parseBoolean)
+                       .orElse(false);
+    }
+
+    @Override
+    public List<String> getMetadataAttributePath() {
+        String property = Optional.ofNullable(mapperModel.getConfig())
+                                  .map(config -> config.get(CLAIM_NAME))
+                                  .orElse(SUBJECT_PROPERTY_CONFIG_KEY_DEFAULT);
+        return ListUtils.union(getAttributePrefix(), List.of(property));
+    }
+
     public void setClaimsForCredential(VerifiableCredential verifiableCredential,
                                        UserSessionModel userSessionModel) {
         // nothing to do for the mapper.
@@ -64,12 +83,10 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
 
     @Override
     public void setClaimsForSubject(Map<String, Object> claims, UserSessionModel userSessionModel) {
-        String property = Optional.ofNullable(mapperModel.getConfig())
-                .map(config -> config.get(SUBJECT_PROPERTY_CONFIG_KEY))
-                .orElse(SUBJECT_PROPERTY_CONFIG_KEY_DEFAULT);
-
         // Assign a generated ID
-        claims.put(property, String.format("urn:uuid:%s", UUID.randomUUID()));
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
+        claims.put(propertyName, String.format("urn:uuid:%s", UUID.randomUUID()));
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCIssuedAtTimeClaimMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCIssuedAtTimeClaimMapper.java
index 1484032d4d82..e86655b68638 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCIssuedAtTimeClaimMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCIssuedAtTimeClaimMapper.java
@@ -16,12 +16,15 @@
  */
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
 import org.keycloak.protocol.oid4vc.model.CredentialSubject;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.provider.ProviderConfigProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
@@ -47,9 +50,6 @@ public class OID4VCIssuedAtTimeClaimMapper extends OID4VCMapper {
 
     public static final String MAPPER_ID = "oid4vc-issued-at-time-claim-mapper";
 
-    // Omit value if defaults to "iat"
-    public static final String SUBJECT_PROPERTY_CONFIG_KEY = "subjectProperty";
-
     // We will use the java.time.temporal.ChronoUnit enum values to help flatten down the time.
     // Omit property if no truncation.
     public static final String TRUNCATE_TO_TIME_UNIT_KEY = "truncateToTimeUnit";
@@ -59,10 +59,11 @@ public class OID4VCIssuedAtTimeClaimMapper extends OID4VCMapper {
     public static final String VALUE_SOURCE = "valueSource";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
+    private static final Logger log = LoggerFactory.getLogger(OID4VCIssuedAtTimeClaimMapper.class);
 
     static {
         ProviderConfigProperty subjectPropertyNameConfig = new ProviderConfigProperty();
-        subjectPropertyNameConfig.setName(SUBJECT_PROPERTY_CONFIG_KEY);
+        subjectPropertyNameConfig.setName(CLAIM_NAME);
         subjectPropertyNameConfig.setLabel("Time Claim Name");
         subjectPropertyNameConfig.setHelpText("Name of this time claim. Default is iat");
         subjectPropertyNameConfig.setType(ProviderConfigProperty.STRING_TYPE);
@@ -92,8 +93,29 @@ protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    /**
+     * this claim is not added by default to the metadata
+     */
+    @Override
+    public boolean includeInMetadata() {
+        return Optional.ofNullable(mapperModel.getConfig().get(CredentialScopeModel.INCLUDE_IN_METADATA))
+                       .map(Boolean::parseBoolean)
+                       .orElse(false);
+    }
+
     public void setClaimsForCredential(VerifiableCredential verifiableCredential,
                                        UserSessionModel userSessionModel) {
+        // Set the value
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
+        if (propertyName == null) {
+            log.error("Invalid configuration: missing config-property '{}' for mapper '{}' of type '{}'. Mapper is ignored.",
+                      CLAIM_NAME,
+                      mapperModel.getName(),
+                      MAPPER_ID);
+            return;
+        }
+
         Instant iat = Optional.ofNullable(mapperModel.getConfig())
                 .flatMap(config -> Optional.ofNullable(config.get(VALUE_SOURCE)))
                 .filter(valueSource -> Objects.equals(valueSource, "COMPUTE"))
@@ -104,15 +126,11 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
         // truncate is possible. Return iat if not.
         Instant iatTrunc = Optional.ofNullable(mapperModel.getConfig())
                 .flatMap(config -> Optional.ofNullable(config.get(TRUNCATE_TO_TIME_UNIT_KEY)))
-                .filter(i -> i.isEmpty())
+                .filter(String::isEmpty)
                 .map(ChronoUnit::valueOf)
                 .map(iat::truncatedTo)
                 .orElse(iat);
 
-        // Set the value
-        String propertyName = Optional.ofNullable(mapperModel.getConfig())
-                .map(config -> config.get(SUBJECT_PROPERTY_CONFIG_KEY))
-                .orElse("iat");
         CredentialSubject credentialSubject = verifiableCredential.getCredentialSubject();
         credentialSubject.setClaims(propertyName, iatTrunc.getEpochSecond());
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java
index 67ff39da5eee..4b060533d8a4 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCMapper.java
@@ -17,18 +17,22 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.apache.commons.collections4.ListUtils;
 import org.keycloak.Config;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.protocol.ProtocolMapper;
 import org.keycloak.protocol.oid4vc.OID4VCEnvironmentProviderFactory;
 import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.protocol.oid4vc.model.Format;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.provider.ProviderConfigProperty;
 
 import java.util.ArrayList;
-import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -41,23 +45,11 @@
  */
 public abstract class OID4VCMapper implements ProtocolMapper, OID4VCEnvironmentProviderFactory {
 
-    protected static final String SUPPORTED_CREDENTIALS_KEY = "supportedCredentialTypes";
-
-    protected ProtocolMapperModel mapperModel;
-
+    public static final String CLAIM_NAME = "claim.name";
+    public static final String USER_ATTRIBUTE_KEY = "userAttribute";
     private static final List<ProviderConfigProperty> OID4VC_CONFIG_PROPERTIES = new ArrayList<>();
-
-    static {
-        ProviderConfigProperty supportedCredentialsConfig = new ProviderConfigProperty();
-        supportedCredentialsConfig.setType(ProviderConfigProperty.STRING_TYPE);
-        supportedCredentialsConfig.setLabel("Supported Credential Types");
-        supportedCredentialsConfig.setDefaultValue("VerifiableCredential");
-        supportedCredentialsConfig.setHelpText(
-                "Types of Credentials to apply the mapper. Needs to be a comma-separated list.");
-        supportedCredentialsConfig.setName(SUPPORTED_CREDENTIALS_KEY);
-        OID4VC_CONFIG_PROPERTIES.clear();
-        OID4VC_CONFIG_PROPERTIES.add(supportedCredentialsConfig);
-    }
+    protected ProtocolMapperModel mapperModel;
+    protected String format;
 
     protected abstract List<ProviderConfigProperty> getIndividualConfigProperties();
 
@@ -66,11 +58,43 @@ public List<ProviderConfigProperty> getConfigProperties() {
         return Stream.concat(OID4VC_CONFIG_PROPERTIES.stream(), getIndividualConfigProperties().stream()).toList();
     }
 
-    public OID4VCMapper setMapperModel(ProtocolMapperModel mapperModel) {
+    public OID4VCMapper setMapperModel(ProtocolMapperModel mapperModel, String format) {
         this.mapperModel = mapperModel;
+        this.format = format;
         return this;
     }
 
+    /**
+     * some specific claims should not be added into the metadata. Examples are jti, sub, iss etc. Since we have the
+     * possibility to add these credentials with specific claims we should also be able to exclude these specific
+     * attributes from the metadata
+     */
+    public boolean includeInMetadata() {
+        return Optional.ofNullable(mapperModel.getConfig().get(CredentialScopeModel.INCLUDE_IN_METADATA))
+                       .map(Boolean::parseBoolean)
+                       .orElse(true);
+    }
+
+    /**
+     * must return ordered list of attribute-names as they are added into the credential. This is required for the
+     * metadata endpoint to add the appropriate path-attributes into the claim's description.
+     *
+     * @return the attribute path that is being mapped into the credential
+     */
+    public List<String> getMetadataAttributePath() {
+        final String claimName = mapperModel.getConfig().get(CLAIM_NAME);
+        final String userAttributeName = mapperModel.getConfig().get(USER_ATTRIBUTE_KEY);
+        return ListUtils.union(getAttributePrefix(),
+                               List.of(Optional.ofNullable(claimName).orElse(userAttributeName)));
+    }
+
+    protected List<String> getAttributePrefix() {
+        return switch (Optional.ofNullable(format).orElse("")) {
+            case Format.JWT_VC, Format.LDP_VC -> List.of(Oid4VciConstants.CREDENTIAL_SUBJECT);
+            default -> Collections.emptyList();
+        };
+    }
+
     @Override
     public String getProtocol() {
         return OID4VCLoginProtocolFactory.PROTOCOL_ID;
@@ -94,20 +118,6 @@ public void postInit(KeycloakSessionFactory keycloakSessionFactory) {
     public void close() {
     }
 
-    /**
-     * Checks if the mapper supports the given credential type. Allows to configure them not only per client, but also per VC Type.
-     *
-     * @param credentialScope type of the VerifiableCredential that should be checked
-     * @return true if it is supported
-     */
-    public boolean isScopeSupported(String credentialScope) {
-        var optionalScopes = Optional.ofNullable(mapperModel.getConfig().get(SUPPORTED_CREDENTIALS_KEY));
-        if (optionalScopes.isEmpty()) {
-            return false;
-        }
-        return Arrays.asList(optionalScopes.get().split(",")).contains(credentialScope);
-    }
-
     /**
      * Set the claims to credential, like f.e. the context
      */
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCStaticClaimMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCStaticClaimMapper.java
index 49250da8dbd2..d6b3c149420e 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCStaticClaimMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCStaticClaimMapper.java
@@ -36,14 +36,13 @@ public class OID4VCStaticClaimMapper extends OID4VCMapper {
 
     public static final String MAPPER_ID = "oid4vc-static-claim-mapper";
 
-    public static final String SUBJECT_PROPERTY_CONFIG_KEY = "subjectProperty";
     public static final String STATIC_CLAIM_KEY = "staticValue";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
 
     static {
         ProviderConfigProperty subjectPropertyNameConfig = new ProviderConfigProperty();
-        subjectPropertyNameConfig.setName(SUBJECT_PROPERTY_CONFIG_KEY);
+        subjectPropertyNameConfig.setName(CLAIM_NAME);
         subjectPropertyNameConfig.setLabel("Static Claim Property Name");
         subjectPropertyNameConfig.setHelpText("Name of the property to contain the static value.");
         subjectPropertyNameConfig.setType(ProviderConfigProperty.STRING_TYPE);
@@ -69,7 +68,8 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
 
     @Override
     public void setClaimsForSubject(Map<String, Object> claims, UserSessionModel userSessionModel) {
-        String propertyName = mapperModel.getConfig().get(SUBJECT_PROPERTY_CONFIG_KEY);
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
         String staticValue = mapperModel.getConfig().get(STATIC_CLAIM_KEY);
         claims.put(propertyName, staticValue);
     }
@@ -93,4 +93,4 @@ public ProtocolMapper create(KeycloakSession session) {
     public String getId() {
         return MAPPER_ID;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCSubjectIdMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCSubjectIdMapper.java
index 9fffe4518443..1801cdcd1f89 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCSubjectIdMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCSubjectIdMapper.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.apache.commons.collections4.ListUtils;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.UserSessionModel;
@@ -39,13 +40,12 @@
 public class OID4VCSubjectIdMapper extends OID4VCMapper {
 
     public static final String MAPPER_ID = "oid4vc-subject-id-mapper";
-    public static final String ID_KEY = "subjectIdProperty";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
 
     static {
         ProviderConfigProperty idPropertyNameConfig = new ProviderConfigProperty();
-        idPropertyNameConfig.setName(ID_KEY);
+        idPropertyNameConfig.setName(CLAIM_NAME);
         idPropertyNameConfig.setLabel("ID Property Name");
         idPropertyNameConfig.setHelpText("Name of the property to contain the id.");
         idPropertyNameConfig.setDefaultValue("id");
@@ -58,12 +58,16 @@ protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    @Override
+    public List<String> getMetadataAttributePath() {
+        return ListUtils.union(getAttributePrefix(), List.of("id"));
+    }
+
     public static ProtocolMapperModel create(String name, String subjectId) {
         var mapperModel = new ProtocolMapperModel();
         mapperModel.setName(name);
         Map<String, String> configMap = new HashMap<>();
-        configMap.put(ID_KEY, subjectId);
-        configMap.put(SUPPORTED_CREDENTIALS_KEY, "VerifiableCredential");
+        configMap.put(CLAIM_NAME, subjectId);
         mapperModel.setConfig(configMap);
         mapperModel.setProtocol(OID4VCLoginProtocolFactory.PROTOCOL_ID);
         mapperModel.setProtocolMapper(MAPPER_ID);
@@ -77,7 +81,11 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
 
     @Override
     public void setClaimsForSubject(Map<String, Object> claims, UserSessionModel userSessionModel) {
-        claims.put("id", mapperModel.getConfig().getOrDefault(ID_KEY, String.format("urn:uuid:%s", UUID.randomUUID())));
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
+        claims.put(propertyName,
+                   mapperModel.getConfig().getOrDefault(OID4VCMapper.CLAIM_NAME,
+                                                        String.format("urn:uuid:%s", UUID.randomUUID())));
     }
 
     @Override
@@ -99,4 +107,4 @@ public ProtocolMapper create(KeycloakSession session) {
     public String getId() {
         return MAPPER_ID;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTargetRoleMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTargetRoleMapper.java
index 2ba10c1ec794..b6847ca516f0 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTargetRoleMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTargetRoleMapper.java
@@ -17,7 +17,8 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.apache.commons.collections4.ListUtils;
 import org.jboss.logging.Logger;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
@@ -29,12 +30,14 @@
 import org.keycloak.protocol.oid4vc.model.Role;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.util.JsonSerialization;
 
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 
@@ -46,17 +49,15 @@
 public class OID4VCTargetRoleMapper extends OID4VCMapper {
 
     private static final Logger LOGGER = Logger.getLogger(OID4VCTargetRoleMapper.class);
-    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
 
+    public static final String DEFAULT_CLAIM_NAME = "roles";
     public static final String MAPPER_ID = "oid4vc-target-role-mapper";
-    public static final String SUBJECT_PROPERTY_CONFIG_KEY = "subjectProperty";
-    public static final String CLIENT_CONFIG_KEY = "clientId";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
 
     static {
         ProviderConfigProperty subjectPropertyNameConfig = new ProviderConfigProperty();
-        subjectPropertyNameConfig.setName(SUBJECT_PROPERTY_CONFIG_KEY);
+        subjectPropertyNameConfig.setName(CLAIM_NAME);
         subjectPropertyNameConfig.setLabel("Roles Property Name");
         subjectPropertyNameConfig.setHelpText("Property to add the roles to in the credential subject.");
         subjectPropertyNameConfig.setDefaultValue("roles");
@@ -64,11 +65,28 @@ public class OID4VCTargetRoleMapper extends OID4VCMapper {
         CONFIG_PROPERTIES.add(subjectPropertyNameConfig);
     }
 
+    private final KeycloakSession keycloakSession;
+
+    public OID4VCTargetRoleMapper() {
+        this.keycloakSession = null;
+    }
+
+    public OID4VCTargetRoleMapper(KeycloakSession keycloakSession) {
+        this.keycloakSession = keycloakSession;
+    }
+
     @Override
     protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    @Override
+    public List<String> getMetadataAttributePath() {
+        return ListUtils.union(getAttributePrefix(),
+                               List.of(Optional.ofNullable(mapperModel.getConfig().get(CLAIM_NAME))
+                                               .orElse(DEFAULT_CLAIM_NAME)));
+    }
+
     @Override
     public String getDisplayType() {
         return "Target-Role Mapper";
@@ -79,12 +97,11 @@ public String getHelpText() {
         return "Map the assigned role to the credential subject, providing the client id as the target.";
     }
 
-    public static ProtocolMapperModel create(String clientId, String name) {
+    public static ProtocolMapperModel create(String name) {
         var mapperModel = new ProtocolMapperModel();
         mapperModel.setName(name);
         Map<String, String> configMap = new HashMap<>();
-        configMap.put(SUBJECT_PROPERTY_CONFIG_KEY, "roles");
-        configMap.put(CLIENT_CONFIG_KEY, clientId);
+        configMap.put(CLAIM_NAME, DEFAULT_CLAIM_NAME);
         mapperModel.setConfig(configMap);
         mapperModel.setProtocol(OID4VCLoginProtocolFactory.PROTOCOL_ID);
         mapperModel.setProtocolMapper(MAPPER_ID);
@@ -93,7 +110,7 @@ public static ProtocolMapperModel create(String clientId, String name) {
 
     @Override
     public ProtocolMapper create(KeycloakSession session) {
-        return new OID4VCTargetRoleMapper();
+        return new OID4VCTargetRoleMapper(session);
     }
 
     @Override
@@ -110,34 +127,50 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
     @Override
     public void setClaimsForSubject(Map<String, Object> claims,
                                     UserSessionModel userSessionModel) {
-        String client = mapperModel.getConfig().get(CLIENT_CONFIG_KEY);
-        String propertyName = mapperModel.getConfig().get(SUBJECT_PROPERTY_CONFIG_KEY);
-        ClientModel clientModel = userSessionModel.getRealm().getClientByClientId(client);
-        if (clientModel == null || !clientModel.getProtocol().equals(OID4VCLoginProtocolFactory.PROTOCOL_ID)) {
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
+        ClientModel clientModel = keycloakSession.getContext().getClient();
+        if (clientModel == null) {
+            LOGGER.warnf("Client %s not found.", clientModel.getClientId());
             return;
         }
 
-        ClientRoleModel clientRoleModel = new ClientRoleModel(clientModel.getClientId(),
-                userSessionModel.getUser().getClientRoleMappingsStream(clientModel).toList());
+        // Retrieve only the roles assigned to the user for this specific client
+        List<RoleModel> userRoles = userSessionModel.getUser().getClientRoleMappingsStream(clientModel).toList();
+        if (userRoles.isEmpty()) {
+            LOGGER.debugf("No roles assigned to client '%s'. Skipping claim assignment.",
+                          clientModel.getClientId());
+            return;
+        }
+
+        // Create ClientRoleModel and convert to roles claim
+        ClientRoleModel clientRoleModel = new ClientRoleModel(clientModel.getClientId(), userRoles);
         Role rolesClaim = toRolesClaim(clientRoleModel);
         if (rolesClaim.getNames().isEmpty()) {
+            LOGGER.debugf("No valid role names found for client '%s'. Skipping claim assignment.",
+                          clientModel.getClientId());
             return;
         }
-        var modelMap = OBJECT_MAPPER.convertValue(toRolesClaim(clientRoleModel), Map.class);
 
-        if (claims.containsKey(propertyName)) {
-            if (claims.get(propertyName) instanceof Set rolesProperty) {
+        Map<String, Object> modelMap = JsonSerialization.mapper.convertValue(rolesClaim, new TypeReference<>() {});
+
+        Object existingProperty = claims.get(propertyName);
+        if (existingProperty == null) {
+            Set<Map<String, Object>> roles = new HashSet<>();
+            roles.add(modelMap);
+            claims.put(propertyName, roles);
+        } else if (existingProperty instanceof Set<?> rawSet) {
+            if (rawSet.stream().allMatch(item -> item instanceof Map<?, ?>)) {
+                @SuppressWarnings("unchecked")
+                Set<Map<String, Object>> rolesProperty = (Set<Map<String, Object>>) rawSet;
                 rolesProperty.add(modelMap);
-                claims.put(propertyName, rolesProperty);
             } else {
-                LOGGER.warnf("Incompatible types for property %s. The mapper will not set the roles for client %s",
-                        propertyName, client);
+                LOGGER.warnf("Claim '%s' contains incompatible types. Expected Set<Map<String, Object>>, found '%s'. Skipping role assignment for client '%s'.",
+                        propertyName, existingProperty.getClass().getSimpleName(), clientModel.getClientId());
             }
         } else {
-            // needs to be mutable
-            Set roles = new HashSet();
-            roles.add(modelMap);
-            claims.put(propertyName, roles);
+            LOGGER.warnf("Claim '%s' is of type '%s', expected Set. Skipping role assignment for client '%s'.",
+                    propertyName, existingProperty.getClass().getSimpleName(), clientModel.getClientId());
         }
     }
 
@@ -167,4 +200,4 @@ public List<RoleModel> getRoleModels() {
             return roleModels;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTypeMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTypeMapper.java
index e1c66ddf077c..f532b304645d 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTypeMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCTypeMapper.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.protocol.oid4vc.issuance.mappers;
 
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
@@ -57,6 +58,21 @@ protected List<ProviderConfigProperty> getIndividualConfigProperties() {
         return CONFIG_PROPERTIES;
     }
 
+    /**
+     * this claim is not added by default to the metadata
+     */
+    @Override
+    public boolean includeInMetadata() {
+        return Optional.ofNullable(mapperModel.getConfig().get(CredentialScopeModel.INCLUDE_IN_METADATA))
+                       .map(Boolean::parseBoolean)
+                       .orElse(false);
+    }
+
+    @Override
+    public List<String> getMetadataAttributePath() {
+        return List.of("type");
+    }
+
     public void setClaimsForCredential(VerifiableCredential verifiableCredential,
                                        UserSessionModel userSessionModel) {
         // remove duplicates
@@ -92,4 +108,4 @@ public ProtocolMapper create(KeycloakSession session) {
     public String getId() {
         return MAPPER_ID;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCUserAttributeMapper.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCUserAttributeMapper.java
index f796d27cae98..0df73f1c8ff3 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCUserAttributeMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/mappers/OID4VCUserAttributeMapper.java
@@ -43,17 +43,16 @@
 public class OID4VCUserAttributeMapper extends OID4VCMapper {
 
     public static final String MAPPER_ID = "oid4vc-user-attribute-mapper";
-    public static final String SUBJECT_PROPERTY_CONFIG_KEY = "subjectProperty";
-    public static final String USER_ATTRIBUTE_KEY = "userAttribute";
     public static final String AGGREGATE_ATTRIBUTES_KEY = "aggregateAttributes";
 
     private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = new ArrayList<>();
 
     static {
         ProviderConfigProperty subjectPropertyNameConfig = new ProviderConfigProperty();
-        subjectPropertyNameConfig.setName(SUBJECT_PROPERTY_CONFIG_KEY);
-        subjectPropertyNameConfig.setLabel("Attribute Property Name");
-        subjectPropertyNameConfig.setHelpText("Property to add the user attribute to in the credential subject.");
+        subjectPropertyNameConfig.setName(CLAIM_NAME);
+        subjectPropertyNameConfig.setLabel("Claim Name");
+        subjectPropertyNameConfig.setHelpText("The name of the claim added to the credential subject that is extracted " +
+                                                      "from the user attributes.");
         subjectPropertyNameConfig.setType(ProviderConfigProperty.STRING_TYPE);
         CONFIG_PROPERTIES.add(subjectPropertyNameConfig);
 
@@ -87,7 +86,8 @@ public void setClaimsForCredential(VerifiableCredential verifiableCredential,
 
     @Override
     public void setClaimsForSubject(Map<String, Object> claims, UserSessionModel userSessionModel) {
-        String propertyName = mapperModel.getConfig().get(SUBJECT_PROPERTY_CONFIG_KEY);
+        List<String> attributePath = getMetadataAttributePath();
+        String propertyName = attributePath.get(attributePath.size() - 1);
         String userAttribute = mapperModel.getConfig().get(USER_ATTRIBUTE_KEY);
         boolean aggregateAttributes = Optional.ofNullable(mapperModel.getConfig().get(AGGREGATE_ATTRIBUTES_KEY))
                 .map(Boolean::parseBoolean).orElse(false);
@@ -105,7 +105,7 @@ public static ProtocolMapperModel create(String mapperName, String userAttribute
         var mapperModel = new ProtocolMapperModel();
         mapperModel.setName(mapperName);
         Map<String, String> configMap = new HashMap<>();
-        configMap.put(SUBJECT_PROPERTY_CONFIG_KEY, propertyName);
+        configMap.put(CLAIM_NAME, propertyName);
         configMap.put(USER_ATTRIBUTE_KEY, userAttribute);
         configMap.put(AGGREGATE_ATTRIBUTES_KEY, Boolean.toString(aggregateAttributes));
         mapperModel.setConfig(configMap);
@@ -133,4 +133,4 @@ public ProtocolMapper create(KeycloakSession session) {
     public String getId() {
         return MAPPER_ID;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/AbstractCredentialSigner.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/AbstractCredentialSigner.java
new file mode 100644
index 000000000000..c429040bb565
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/AbstractCredentialSigner.java
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.SignatureProvider;
+import org.keycloak.crypto.SignatureSignerContext;
+import org.keycloak.models.KeyManager;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+
+public abstract class AbstractCredentialSigner<T> implements CredentialSigner<T> {
+
+    protected final KeycloakSession keycloakSession;
+
+    protected AbstractCredentialSigner(KeycloakSession keycloakSession) {
+        this.keycloakSession = keycloakSession;
+    }
+
+    /**
+     * Reconstruct a signer matching a credential build configuration.
+     */
+    protected SignatureSignerContext getSigner(CredentialBuildConfig credentialBuildConfig) {
+        if (credentialBuildConfig.getSigningAlgorithm() == null) {
+            throw new CredentialSignerException(String.format(
+                    "A signing algorithm must be configured for credential %s",
+                    credentialBuildConfig.getCredentialId()
+            ));
+        }
+
+        // 1. Will return the active key if `signingKeyId` is null.
+        // 2. `signingKeyId` as header can be confusing if there is any key rotation,
+        //    as key ids have to be immutable. It can lead to different keys being exposed
+        //    under the same id. We give the ability to override with a custom kid if configured.
+        KeyWrapper signingKey = getKeyWithKidSubstitute(
+                credentialBuildConfig.getSigningKeyId(),
+                credentialBuildConfig.getSigningAlgorithm(),
+                credentialBuildConfig.getOverrideKeyId()
+        );
+
+        SignatureProvider signatureProvider = keycloakSession
+                .getProvider(SignatureProvider.class, credentialBuildConfig.getSigningAlgorithm());
+
+        return signatureProvider.signer(signingKey);
+    }
+
+    /**
+     * Returns the key stored under keyId, or the active key for the given jws algorithm.
+     * Additionally, the function clones the key retrieved from Keycloak, replacing the original
+     * key ID by the substitute one if provided. This makes it possible to have a custom kid header
+     * when producing JSON web signatures.
+     */
+    protected KeyWrapper getKeyWithKidSubstitute(String keyId, String algorithm, String keyIdSubstitute) {
+        KeyWrapper signingKey = getKey(keyId, algorithm);
+        if (signingKey == null) {
+            throw new CredentialSignerException(
+                    String.format("No key for id %s and algorithm %s available.", keyId, algorithm));
+        }
+
+        if (keyIdSubstitute != null) {
+            // We need to clone the key first, to not change the kid of the original key
+            // so that the next request still can find it.
+            signingKey = signingKey.cloneKey();
+            signingKey.setKid(keyIdSubstitute);
+        }
+
+        return signingKey;
+    }
+
+    /**
+     * Returns the key stored under keyId, or the active key for the given jws algorithm.
+     */
+    protected KeyWrapper getKey(String keyId, String algorithm) {
+        RealmModel realm = keycloakSession.getContext().getRealm();
+        KeyManager keys = keycloakSession.keys();
+
+        if (keyId == null) {
+            // Allow the signer to work with the active key if keyId is null
+            // And we still have to figure out how to proceed with key rotation
+            return keys.getActiveKey(realm, KeyUse.SIG, algorithm);
+        }
+
+        return keys.getKey(realm, keyId, KeyUse.SIG, algorithm);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSigner.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSigner.java
new file mode 100644
index 000000000000..3b28819e4af4
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSigner.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+import org.keycloak.provider.Provider;
+
+/**
+ * Interface to be used for signing verifiable credentials.
+ */
+public interface CredentialSigner<T> extends Provider {
+
+    @Override
+    default void close() {
+    }
+
+    /**
+     * Takes a verifiable credential and signs it according to the implementation.
+     * Depending on the type of the CredentialSigner, it will return a signed representation
+     * of the credential that be returned at the credential request endpoint.
+     *
+     * @param credentialBody        a partially built credential representation, awaiting to be signed
+     * @param credentialBuildConfig additional configurations for building the credential
+     * @return a signed representation
+     */
+    T signCredential(CredentialBody credentialBody, CredentialBuildConfig credentialBuildConfig)
+            throws CredentialSignerException;
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerException.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerException.java
new file mode 100644
index 000000000000..eecc392681c2
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerException.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+/**
+ * Exception to be thrown if credentials signing does fail
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class CredentialSignerException extends RuntimeException {
+
+    public CredentialSignerException(String message) {
+        super(message);
+    }
+
+    public CredentialSignerException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerFactory.java
new file mode 100644
index 000000000000..a5dae5cffa01
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerFactory.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oid4vc.OID4VCEnvironmentProviderFactory;
+import org.keycloak.provider.ProviderFactory;
+
+public interface CredentialSignerFactory
+        extends ProviderFactory<CredentialSigner<?>>, OID4VCEnvironmentProviderFactory {
+
+    /**
+     * Returns the credential format supported by the credential signer.
+     */
+    String getSupportedFormat();
+
+    @Override
+    default String getId() {
+        return getSupportedFormat();
+    }
+
+    @Override
+    default void init(Config.Scope config) {
+    }
+
+    @Override
+    default void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    default void close() {
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerSpi.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerSpi.java
new file mode 100644
index 000000000000..1cfce61c74da
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/CredentialSignerSpi.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.Spi;
+
+/**
+ * Spi implementation of the creation of {@link CredentialSigner}
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ */
+public class CredentialSignerSpi implements Spi {
+    private static final String NAME = "credentialSigner";
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return NAME;
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return CredentialSigner.class;
+    }
+
+    @Override
+    public Class<CredentialSignerFactory> getProviderFactoryClass() {
+        return CredentialSignerFactory.class;
+    }
+}
+
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSigner.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSigner.java
new file mode 100644
index 000000000000..53230ca93a04
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSigner.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBody;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+
+/**
+ * {@link CredentialSigner} implementing the JWT_VC format. It returns the signed JWT-Credential as a String.
+ * <p></p>
+ * {@see https://identity.foundation/jwt-vc-presentation-profile/}
+ */
+public class JwtCredentialSigner extends AbstractCredentialSigner<String> {
+
+    private static final Logger LOGGER = Logger.getLogger(JwtCredentialSigner.class);
+
+    public JwtCredentialSigner(KeycloakSession keycloakSession) {
+        super(keycloakSession);
+    }
+
+    @Override
+    public String signCredential(CredentialBody credentialBody, CredentialBuildConfig credentialBuildConfig)
+            throws CredentialSignerException {
+        if (!(credentialBody instanceof JwtCredentialBody jwtCredentialBody)) {
+            throw new CredentialSignerException("Credential body unexpectedly not of type JwtCredentialBody");
+        }
+
+        LOGGER.debugf("Sign credentials to jwt-vc format.");
+        return jwtCredentialBody.sign(getSigner(credentialBuildConfig));
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSignerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSignerFactory.java
new file mode 100644
index 000000000000..13be6067944c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtCredentialSignerFactory.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.Format;
+
+public class JwtCredentialSignerFactory implements CredentialSignerFactory {
+
+    @Override
+    public String getSupportedFormat() {
+        return Format.JWT_VC;
+    }
+
+    @Override
+    public CredentialSigner<String> create(KeycloakSession session) {
+        return new JwtCredentialSigner(session);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtProofBasedSigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtProofBasedSigningService.java
deleted file mode 100644
index 2ba55c6dfdbd..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtProofBasedSigningService.java
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-import java.util.Objects;
-import java.util.Optional;
-
-import org.jboss.logging.Logger;
-import org.keycloak.common.VerificationException;
-import org.keycloak.crypto.SignatureVerifierContext;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jws.JWSHeader;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
-import org.keycloak.protocol.oid4vc.model.Proof;
-import org.keycloak.protocol.oid4vc.model.ProofType;
-import org.keycloak.protocol.oid4vc.model.ProofTypeJWT;
-import org.keycloak.protocol.oid4vc.model.ProofTypesSupported;
-import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * Common signing service logic to handle proofs.
- *
- * @author <a href="mailto:francis.pouatcha@adorsys.com">Francis Pouatcha</a>
- */
-public abstract class JwtProofBasedSigningService<T> extends SigningService<T> {
-
-    private static final Logger LOGGER = Logger.getLogger(JwtProofBasedSigningService.class);
-    private static final String CRYPTOGRAPHIC_BINDING_METHOD_JWK = "jwk";
-    public static final String PROOF_JWT_TYP="openid4vci-proof+jwt";
-
-    protected JwtProofBasedSigningService(KeycloakSession keycloakSession, String keyId, String format, String type) {
-        super(keycloakSession, keyId, format, type);
-    }
-
-    /*
-     * Validates a proof provided by the client if any.
-     *
-     * Returns null if there is no need to include a key binding in the credential
-     *
-     * Return the JWK to be included as key binding in the JWK if the provided proof was correctly validated
-     *
-     * @param vcIssuanceContext
-     * @return
-     * @throws VCIssuerException
-     * @throws JWSInputException
-     * @throws VerificationException
-     * @throws IllegalStateException: is credential type badly configured
-     * @throws IOException
-     */
-    protected JWK validateProof(VCIssuanceContext vcIssuanceContext) throws VCIssuerException, JWSInputException, VerificationException, IOException {
-
-        Optional<Proof> optionalProof = getProofFromContext(vcIssuanceContext);
-
-        if (optionalProof.isEmpty()) {
-            return null; // No proof support
-        }
-
-        // Check key binding config for jwt. Only type supported.
-        checkCryptographicKeyBinding(vcIssuanceContext);
-
-        JWSInput jwsInput = getJwsInput(optionalProof.get());
-        JWSHeader jwsHeader = jwsInput.getHeader();
-        validateJwsHeader(vcIssuanceContext, jwsHeader);
-
-        JWK jwk = Optional.ofNullable(jwsHeader.getKey())
-                .orElseThrow(() -> new VCIssuerException("Missing binding key. Make sure provided JWT contains the jwk jwsHeader claim."));
-
-        // Parsing the Proof as an access token shall work, as a proof is a strict subset of an access token.
-        AccessToken proofPayload = JsonSerialization.readValue(jwsInput.getContent(), AccessToken.class);
-        validateProofPayload(vcIssuanceContext, proofPayload);
-
-        SignatureVerifierContext signatureVerifierContext = getVerifier(jwk, jwsHeader.getAlgorithm().name());
-        if (signatureVerifierContext == null) {
-            throw new VCIssuerException("No verifier configured for " + jwsHeader.getAlgorithm());
-        }
-        if (!signatureVerifierContext.verify(jwsInput.getEncodedSignatureInput().getBytes(StandardCharsets.UTF_8), jwsInput.getSignature())) {
-            throw new VCIssuerException("Could not verify provided proof");
-        }
-
-        return jwk;
-    }
-
-    private void checkCryptographicKeyBinding(VCIssuanceContext vcIssuanceContext){
-        // Make sure we are dealing with a jwk proof.
-        if (vcIssuanceContext.getCredentialConfig().getCryptographicBindingMethodsSupported() == null ||
-                !vcIssuanceContext.getCredentialConfig().getCryptographicBindingMethodsSupported().contains(CRYPTOGRAPHIC_BINDING_METHOD_JWK)) {
-            throw new IllegalStateException("This SD-JWT implementation only supports jwk as cryptographic binding method");
-        }
-    }
-
-    private Optional<Proof> getProofFromContext(VCIssuanceContext vcIssuanceContext) throws VCIssuerException {
-        return Optional.ofNullable(vcIssuanceContext.getCredentialConfig())
-                .map(SupportedCredentialConfiguration::getProofTypesSupported)
-                .flatMap(proofTypesSupported -> {
-                    Optional.ofNullable(proofTypesSupported.getJwt())
-                            .orElseThrow(() -> new VCIssuerException("SD-JWT supports only jwt proof type."));
-
-                    Proof proof = Optional.ofNullable(vcIssuanceContext.getCredentialRequest().getProof())
-                            .orElseThrow(() -> new VCIssuerException("Credential configuration requires a proof of type: " + ProofType.JWT));
-
-                    if (!Objects.equals(proof.getProofType(), ProofType.JWT)) {
-                        throw new VCIssuerException("Wrong proof type");
-                    }
-
-                    return Optional.of(proof);
-                });
-    }
-
-    private JWSInput getJwsInput(Proof proof) throws JWSInputException {
-        return new JWSInput(proof.getJwt());
-    }
-
-    /**
-     * As we limit accepted algorithm to the ones listed by the issuer, we can omit checking for "none"
-     * The Algorithm enum class does not list the none value anyway.
-     *
-     * @param vcIssuanceContext
-     * @param jwsHeader
-     * @throws VCIssuerException
-     */
-    private void validateJwsHeader(VCIssuanceContext vcIssuanceContext, JWSHeader jwsHeader) throws VCIssuerException {
-        Optional.ofNullable(jwsHeader.getAlgorithm())
-                .orElseThrow(() -> new VCIssuerException("Missing jwsHeader claim alg"));
-
-        // As we limit accepted algorithm to the ones listed by the server, we can omit checking for "none"
-        // The Algorithm enum class does not list the none value anyway.
-        Optional.ofNullable(vcIssuanceContext.getCredentialConfig())
-                .map(SupportedCredentialConfiguration::getProofTypesSupported)
-                .map(ProofTypesSupported::getJwt)
-                .map(ProofTypeJWT::getProofSigningAlgValuesSupported)
-                .filter(supportedAlgs -> supportedAlgs.contains(jwsHeader.getAlgorithm().name()))
-                .orElseThrow(() -> new VCIssuerException("Proof signature algorithm not supported: " + jwsHeader.getAlgorithm().name()));
-
-        Optional.ofNullable(jwsHeader.getType())
-                .filter(type -> Objects.equals(PROOF_JWT_TYP, type))
-                .orElseThrow(() -> new VCIssuerException("JWT type must be: " + PROOF_JWT_TYP));
-
-        // KeyId shall not be present alongside the jwk.
-        Optional.ofNullable(jwsHeader.getKeyId())
-                .ifPresent(keyId -> {
-                    throw new VCIssuerException("KeyId not expected in this JWT. Use the jwk claim instead.");
-                });
-    }
-
-    private void validateProofPayload(VCIssuanceContext vcIssuanceContext, AccessToken proofPayload) throws VCIssuerException {
-        // azp is the id of the client, as mentioned in the access token used to request the credential.
-        // Token provided from user is obtained with a clientId that support the oidc login protocol.
-        // oid4vci client doesn't. But it is the client needed at the credential endpoint.
-        //        String azp = vcIssuanceContext.getAuthResult().getToken().getIssuedFor();
-        //        Optional.ofNullable(proofPayload.getIssuer())
-        //                .filter(proofIssuer -> Objects.equals(azp, proofIssuer))
-        //                .orElseThrow(() -> new VCIssuerException("Issuer claim must be null for preauthorized code else the clientId of the client making the request: " + azp));
-
-        // The audience of the proof MUST be the Credential Issuer Identifier.
-        // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-jwt-proof-type
-        String credentialIssuer = OID4VCIssuerWellKnownProvider.getIssuer(keycloakSession.getContext());
-        Optional.ofNullable(proofPayload.getAudience()) // Ensure null-safety with Optional
-                .map(Arrays::asList) // Convert to List<String>
-                .filter(audiences -> audiences.contains(credentialIssuer)) // Check if the issuer is in the audience list
-                .orElseThrow(() -> new VCIssuerException(
-                        "Proof not produced for this audience. Audience claim must be: " + credentialIssuer + " but are " + Arrays.asList(proofPayload.getAudience())));
-
-        // Validate mandatory iat.
-        // I do not understand the rationale behind requiring an issue time if we are not checking expiration.
-        Optional.ofNullable(proofPayload.getIat())
-                .orElseThrow(() -> new VCIssuerException("Missing proof issuing time. iat claim must be provided."));
-
-        // Check cNonce matches.
-        // If the token endpoint provides a c_nonce, we would like this:
-        // - stored in the access token
-        // - having the same validity as the access token.
-        Optional.ofNullable(vcIssuanceContext.getAuthResult().getToken().getNonce())
-                        .ifPresent(
-                                cNonce -> {
-                                    Optional.ofNullable(proofPayload.getNonce())
-                                            .filter(nonce -> Objects.equals(cNonce, nonce))
-                                            .orElseThrow(() -> new VCIssuerException("Missing or wrong nonce value. Please provide nonce returned by the issuer if any."));
-
-                                    // We expect the expiration to be identical to the token expiration. We assume token expiration has been checked by AuthManager,
-                                    // So no_op
-                                }
-                        );
-
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningService.java
deleted file mode 100644
index 2c1c3a26ea67..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningService.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.jboss.logging.Logger;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.SignatureProvider;
-import org.keycloak.crypto.SignatureSignerContext;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBody;
-import org.keycloak.protocol.oid4vc.model.Format;
-
-/**
- * {@link VerifiableCredentialsSigningService} implementing the JWT_VC format. It returns a string, containing the
- * Signed JWT-Credential
- * {@see https://identity.foundation/jwt-vc-presentation-profile/}
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class JwtSigningService extends SigningService<String> {
-
-    private static final Logger LOGGER = Logger.getLogger(JwtSigningService.class);
-
-
-    private final SignatureSignerContext signatureSignerContext;
-
-
-    public JwtSigningService(KeycloakSession keycloakSession, String keyId, String algorithmType) {
-        super(keycloakSession, keyId, Format.JWT_VC, algorithmType);
-
-        KeyWrapper signingKey = getKey(keyId, algorithmType);
-        if (signingKey == null) {
-            throw new SigningServiceException(String.format("No key for id %s and algorithm %s available.", keyId, algorithmType));
-        }
-        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class, algorithmType);
-        signatureSignerContext = signatureProvider.signer(signingKey);
-
-        LOGGER.debugf("Successfully initiated the JWT Signing Service with algorithm %s.", algorithmType);
-    }
-
-    @Override
-    public String signCredential(VCIssuanceContext vcIssuanceContext) {
-        LOGGER.debugf("Sign credentials to jwt-vc format.");
-
-        CredentialBody credentialBody = vcIssuanceContext.getCredentialBody();
-        if (!(credentialBody instanceof JwtCredentialBody jwtCredentialBody)) {
-            throw new VCIssuerException("Credential body unexpectedly not of type JwtCredentialBody");
-        }
-
-        return jwtCredentialBody.sign(signatureSignerContext);
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningServiceProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningServiceProviderFactory.java
deleted file mode 100644
index 0f75a700c1f8..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/JwtSigningServiceProviderFactory.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.component.ComponentModel;
-import org.keycloak.component.ComponentValidationException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.provider.ConfigurationValidationHelper;
-import org.keycloak.provider.ProviderConfigProperty;
-
-import java.util.List;
-
-
-/**
- * Provider Factory to create {@link  JwtSigningService}s
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class JwtSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
-
-    public static final String SUPPORTED_FORMAT = Format.JWT_VC;
-    private static final String HELP_TEXT = "Issues JWT-VCs following the specification of https://identity.foundation/jwt-vc-presentation-profile/.";
-
-    @Override
-    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
-
-        String keyId = model.get(SigningProperties.KEY_ID.getKey());
-        String algorithmType = model.get(SigningProperties.ALGORITHM_TYPE.getKey());
-
-        return new JwtSigningService(session, keyId, algorithmType);
-    }
-
-    @Override
-    public String getHelpText() {
-        return HELP_TEXT;
-    }
-
-    @Override
-    public List<ProviderConfigProperty> getConfigProperties() {
-        return VCSigningServiceProviderFactory.configurationBuilder()
-                .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
-                .build();
-    }
-
-    @Override
-    public String getId() {
-        return SUPPORTED_FORMAT;
-    }
-
-    @Override
-    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
-        ConfigurationValidationHelper.check(model)
-                .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty());
-    }
-
-    @Override
-    public String supportedFormat() {
-        return SUPPORTED_FORMAT;
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSigner.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSigner.java
new file mode 100644
index 000000000000..a0e09bdf9ac9
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSigner.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.jboss.logging.Logger;
+import org.keycloak.common.util.Base64;
+import org.keycloak.crypto.SignatureSignerContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.TimeProvider;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.signing.vcdm.Ed255192018Suite;
+import org.keycloak.protocol.oid4vc.issuance.signing.vcdm.LinkedDataCryptographicSuite;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+import org.keycloak.protocol.oid4vc.model.vcdm.LdProof;
+
+import java.io.IOException;
+import java.time.Instant;
+import java.util.Date;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * {@link CredentialSigner} implementing the JWT_VC format. It returns the signed JWT-Credential as a String.
+ * <p></p>
+ * {@see https://identity.foundation/jwt-vc-presentation-profile/}
+ */
+public class LDCredentialSigner extends AbstractCredentialSigner<VerifiableCredential> {
+
+    private static final Logger LOGGER = Logger.getLogger(LDCredentialSigner.class);
+
+    public static final String PROOF_PURPOSE_ASSERTION = "assertionMethod";
+    public static final String PROOF_KEY = "proof";
+
+    private final TimeProvider timeProvider;
+
+    public LDCredentialSigner(KeycloakSession keycloakSession, TimeProvider timeProvider) {
+        super(keycloakSession);
+        this.timeProvider = timeProvider;
+    }
+
+    @Override
+    public VerifiableCredential signCredential(CredentialBody credentialBody, CredentialBuildConfig credentialBuildConfig)
+            throws CredentialSignerException {
+        if (!(credentialBody instanceof LDCredentialBody ldCredentialBody)) {
+            throw new CredentialSignerException("Credential body unexpectedly not of type LDCredentialBody");
+        }
+
+        LOGGER.debugf("Sign credentials to ldp-vc format.");
+        return addProof(
+                ldCredentialBody.getVerifiableCredential(),
+                credentialBuildConfig
+        );
+    }
+
+    private LinkedDataCryptographicSuite getLinkedDataCryptographicSuite(CredentialBuildConfig credentialBuildConfig) {
+        String ldpProofType = credentialBuildConfig.getLdpProofType();
+        SignatureSignerContext signer = getSigner(credentialBuildConfig);
+
+        if (Objects.equals(ldpProofType, Ed255192018Suite.PROOF_TYPE)) {
+            return new Ed255192018Suite(signer);
+        }
+
+        throw new CredentialSignerException(String.format("Proof Type %s is not supported.", ldpProofType));
+    }
+
+    // add the signed proof to the credential.
+    private VerifiableCredential addProof(
+            VerifiableCredential verifiableCredential,
+            CredentialBuildConfig credentialBuildConfig) {
+        String keyId = Optional.ofNullable(credentialBuildConfig.getOverrideKeyId())
+                .orElse(credentialBuildConfig.getSigningKeyId());
+
+        LinkedDataCryptographicSuite suite = getLinkedDataCryptographicSuite(credentialBuildConfig);
+        byte[] signature = suite.getSignature(verifiableCredential);
+
+        LdProof ldProof = new LdProof();
+        ldProof.setProofPurpose(PROOF_PURPOSE_ASSERTION);
+        ldProof.setType(suite.getProofType());
+        ldProof.setCreated(Date.from(Instant.ofEpochSecond(timeProvider.currentTimeSeconds())));
+        ldProof.setVerificationMethod(keyId);
+
+        try {
+            var proofValue = Base64.encodeBytes(signature, Base64.URL_SAFE);
+            ldProof.setProofValue(proofValue);
+            verifiableCredential.setAdditionalProperties(PROOF_KEY, ldProof);
+            return verifiableCredential;
+        } catch (IOException e) {
+            throw new CredentialSignerException("Was not able to encode the signature.", e);
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSignerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSignerFactory.java
new file mode 100644
index 000000000000..90f5b03b9c72
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDCredentialSignerFactory.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.OffsetTimeProvider;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+
+public class LDCredentialSignerFactory implements CredentialSignerFactory {
+
+    @Override
+    public String getSupportedFormat() {
+        return Format.LDP_VC;
+    }
+
+    @Override
+    public CredentialSigner<VerifiableCredential> create(KeycloakSession session) {
+        return new LDCredentialSigner(session, new OffsetTimeProvider());
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningService.java
deleted file mode 100644
index e1be9b81fe17..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningService.java
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-
-import org.keycloak.common.util.Base64;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.SignatureProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.TimeProvider;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.signing.vcdm.Ed255192018Suite;
-import org.keycloak.protocol.oid4vc.issuance.signing.vcdm.LinkedDataCryptographicSuite;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
-import org.keycloak.protocol.oid4vc.model.vcdm.LdProof;
-
-import java.io.IOException;
-import java.time.Instant;
-import java.util.Date;
-import java.util.Optional;
-
-/**
- * {@link VerifiableCredentialsSigningService} implementing the LDP_VC format. It returns a Verifiable Credential,
- * containing the created LDProof.
- * <p>
- * {@see https://www.w3.org/TR/vc-data-model/}
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class LDSigningService extends SigningService<VerifiableCredential> {
-
-    private final LinkedDataCryptographicSuite linkedDataCryptographicSuite;
-    private final TimeProvider timeProvider;
-    private final String keyId;
-
-    public LDSigningService(KeycloakSession keycloakSession, String keyId, String algorithmType, String ldpType, TimeProvider timeProvider, Optional<String> kid) {
-        super(keycloakSession, keyId, Format.LDP_VC, algorithmType);
-        this.timeProvider = timeProvider;
-        this.keyId = kid.orElse(keyId);
-        KeyWrapper signingKey = getKey(keyId, algorithmType);
-        if (signingKey == null) {
-            throw new SigningServiceException(String.format("No key for id %s and algorithm %s available.", keyId, algorithmType));
-        }
-        // set the configured kid if present.
-        if (kid.isPresent()) {
-            // we need to clone the key first, to not change the kid of the original key so that the next request still can find it.
-            signingKey = signingKey.cloneKey();
-            signingKey.setKid(keyId);
-        }
-        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class, algorithmType);
-
-        linkedDataCryptographicSuite = switch (ldpType) {
-            case Ed255192018Suite.PROOF_TYPE ->
-                    new Ed255192018Suite(signatureProvider.signer(signingKey));
-            default -> throw new SigningServiceException(String.format("Proof Type %s is not supported.", ldpType));
-        };
-    }
-
-    @Override
-    public VerifiableCredential signCredential(VCIssuanceContext vcIssuanceContext) {
-        CredentialBody credentialBody = vcIssuanceContext.getCredentialBody();
-        if (!(credentialBody instanceof LDCredentialBody ldCredentialBody)) {
-            throw new VCIssuerException("Credential body unexpectedly not of type LDCredentialBody");
-        }
-
-        return addProof(ldCredentialBody.getVerifiableCredential());
-    }
-
-    // add the signed proof to the credential.
-    private VerifiableCredential addProof(VerifiableCredential verifiableCredential) {
-
-        byte[] signature = linkedDataCryptographicSuite.getSignature(verifiableCredential);
-
-        LdProof ldProof = new LdProof();
-        ldProof.setProofPurpose("assertionMethod");
-        ldProof.setType(linkedDataCryptographicSuite.getProofType());
-        ldProof.setCreated(Date.from(Instant.ofEpochSecond(timeProvider.currentTimeSeconds())));
-        ldProof.setVerificationMethod(keyId);
-
-        try {
-            var proofValue = Base64.encodeBytes(signature, Base64.URL_SAFE);
-            ldProof.setProofValue(proofValue);
-            verifiableCredential.setAdditionalProperties("proof", ldProof);
-            return verifiableCredential;
-        } catch (IOException e) {
-            throw new SigningServiceException("Was not able to encode the signature.", e);
-        }
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningServiceProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningServiceProviderFactory.java
deleted file mode 100644
index f1de5e24db97..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/LDSigningServiceProviderFactory.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.component.ComponentModel;
-import org.keycloak.component.ComponentValidationException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.protocol.oid4vc.issuance.OffsetTimeProvider;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.provider.ConfigurationValidationHelper;
-import org.keycloak.provider.ProviderConfigProperty;
-
-import java.util.List;
-import java.util.Optional;
-
-/**
- * Provider Factory to create {@link  LDSigningService}s
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class LDSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
-    public static final String SUPPORTED_FORMAT = Format.LDP_VC;
-    private static final String HELP_TEXT = "Issues Verifiable Credentials in the W3C Data Model, using Linked-Data Proofs. See https://www.w3.org/TR/vc-data-model/";
-
-    @Override
-    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
-        String keyId = model.get(SigningProperties.KEY_ID.getKey());
-        String proofType = model.get(SigningProperties.PROOF_TYPE.getKey());
-        String algorithmType = model.get(SigningProperties.ALGORITHM_TYPE.getKey());
-        Optional<String> kid = Optional.ofNullable(model.get(SigningProperties.KID_HEADER.getKey()));
-        return new LDSigningService(session, keyId, algorithmType, proofType, new OffsetTimeProvider(), kid);
-    }
-
-    @Override
-    public String getHelpText() {
-        return HELP_TEXT;
-    }
-
-    @Override
-    public List<ProviderConfigProperty> getConfigProperties() {
-        return VCSigningServiceProviderFactory.configurationBuilder()
-            .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
-            .property(SigningProperties.PROOF_TYPE.asConfigProperty())
-            .property(SigningProperties.KID_HEADER.asConfigProperty())
-            .build();
-    }
-
-    @Override
-    public String getId() {
-        return SUPPORTED_FORMAT.toString();
-    }
-
-    @Override
-    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
-        ConfigurationValidationHelper.check(model)
-            .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
-            .checkRequired(SigningProperties.PROOF_TYPE.asConfigProperty());
-    }
-
-    @Override
-    public String supportedFormat() {
-        return SUPPORTED_FORMAT;
-    }
-
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSigner.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSigner.java
new file mode 100644
index 000000000000..227d4b678a63
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSigner.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBody;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+
+/**
+ * {@link CredentialSigner} implementing the SD_JWT_VC format. It returns the signed SD-JWT as a String.
+ * <p>
+ * {@see https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html}
+ * {@see https://www.ietf.org/archive/id/draft-fett-oauth-selective-disclosure-jwt-02.html}
+ */
+public class SdJwtCredentialSigner extends AbstractCredentialSigner<String> {
+
+    private static final Logger LOGGER = Logger.getLogger(SdJwtCredentialSigner.class);
+
+    public SdJwtCredentialSigner(KeycloakSession keycloakSession) {
+        super(keycloakSession);
+    }
+
+    @Override
+    public String signCredential(CredentialBody credentialBody, CredentialBuildConfig credentialBuildConfig)
+            throws CredentialSignerException {
+        if (!(credentialBody instanceof SdJwtCredentialBody sdJwtCredentialBody)) {
+            throw new CredentialSignerException("Credential body unexpectedly not of type SdJwtCredentialBody");
+        }
+
+        LOGGER.debugf("Sign credentials to sd-jwt format.");
+        return sdJwtCredentialBody.sign(getSigner(credentialBuildConfig));
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSignerFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSignerFactory.java
new file mode 100644
index 000000000000..751d6b8a4bbc
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtCredentialSignerFactory.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.issuance.signing;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.model.Format;
+
+public class SdJwtCredentialSignerFactory implements CredentialSignerFactory {
+
+    @Override
+    public String getSupportedFormat() {
+        return Format.SD_JWT_VC;
+    }
+
+    @Override
+    public CredentialSigner<String> create(KeycloakSession session) {
+        return new SdJwtCredentialSigner(session);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningService.java
deleted file mode 100644
index c408b223af3e..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningService.java
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.jboss.logging.Logger;
-import org.keycloak.common.VerificationException;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.SignatureProvider;
-import org.keycloak.crypto.SignatureSignerContext;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jws.JWSInputException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBody;
-import org.keycloak.protocol.oid4vc.model.CredentialConfigId;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredentialType;
-
-import java.io.IOException;
-import java.util.Map;
-import java.util.Optional;
-
-/**
- * {@link VerifiableCredentialsSigningService} implementing the SD_JWT_VC format. It returns a String, containing
- * the signed SD-JWT
- * <p>
- * {@see https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html}
- * {@see https://www.ietf.org/archive/id/draft-fett-oauth-selective-disclosure-jwt-02.html}
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class SdJwtSigningService extends JwtProofBasedSigningService<String> {
-
-    private static final Logger LOGGER = Logger.getLogger(SdJwtSigningService.class);
-
-    private static final String JWK_CLAIM = "jwk";
-
-    private final SignatureSignerContext signatureSignerContext;
-
-    private final CredentialConfigId vcConfigId;
-
-    // See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-6
-    // vct sort of additional category for sd-jwt.
-    private final VerifiableCredentialType vct;
-
-    public SdJwtSigningService(KeycloakSession keycloakSession, String keyId, String algorithmType, Optional<String> kid, VerifiableCredentialType credentialType, CredentialConfigId vcConfigId) {
-        super(keycloakSession, keyId, Format.SD_JWT_VC, algorithmType);
-        this.vcConfigId = vcConfigId;
-        this.vct = credentialType;
-
-        // If a config id is defined, a vct must be defined.
-        // Also validated in: org.keycloak.protocol.oid4vc.issuance.signing.SdJwtSigningServiceProviderFactory.validateSpecificConfiguration
-        if (this.vcConfigId != null && this.vct == null) {
-            throw new SigningServiceException(String.format("Missing vct for credential config id %s.", vcConfigId));
-        }
-
-        // Will return the active key if key id is null.
-        KeyWrapper signingKey = getKey(keyId, algorithmType);
-        if (signingKey == null) {
-            throw new SigningServiceException(String.format("No key for id %s and algorithm %s available.", keyId, algorithmType));
-        }
-        // keyId header can be confusing if there is any key rotation, as key ids have to be immutable. It can lead
-        // to different keys being exposed under the same id.
-        // set the configured kid if present.
-        if (kid.isPresent()) {
-            // we need to clone the key first, to not change the kid of the original key so that the next request still can find it.
-            signingKey = signingKey.cloneKey();
-            signingKey.setKid(keyId);
-        }
-
-        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class, algorithmType);
-        signatureSignerContext = signatureProvider.signer(signingKey);
-
-        LOGGER.debugf("Successfully initiated the SD-JWT Signing Service with algorithm %s.", algorithmType);
-    }
-
-    @Override
-    public String signCredential(VCIssuanceContext vcIssuanceContext) throws VCIssuerException {
-
-        CredentialBody credentialBody = vcIssuanceContext.getCredentialBody();
-        if (!(credentialBody instanceof SdJwtCredentialBody sdJwtCredentialBody)) {
-            throw new VCIssuerException("Credential body unexpectedly not of type SdJwtCredentialBody");
-        }
-
-        JWK jwk;
-        try {
-            // null returned is a valid result. Means no key binding will be included.
-            jwk = validateProof(vcIssuanceContext);
-        } catch (JWSInputException | VerificationException | IOException e) {
-            throw new VCIssuerException("Can not verify proof", e);
-        }
-
-        // add the key binding if any
-        if (jwk != null) {
-            sdJwtCredentialBody.addCnfClaim(Map.of(JWK_CLAIM, jwk));
-        }
-
-        return sdJwtCredentialBody.sign(signatureSignerContext);
-    }
-
-    @Override
-    public String locator() {
-        return VerifiableCredentialsSigningService.locator(format, vct, vcConfigId);
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningServiceProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningServiceProviderFactory.java
deleted file mode 100644
index d53db75b06fe..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SdJwtSigningServiceProviderFactory.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.component.ComponentModel;
-import org.keycloak.component.ComponentValidationException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.protocol.oid4vc.model.CredentialConfigId;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredentialType;
-import org.keycloak.provider.ConfigurationValidationHelper;
-import org.keycloak.provider.ProviderConfigProperty;
-
-import java.util.List;
-import java.util.Optional;
-
-/**
- * Provider Factory to create {@link  SdJwtSigningService}s
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class SdJwtSigningServiceProviderFactory implements VCSigningServiceProviderFactory {
-
-    public static final String SUPPORTED_FORMAT = Format.SD_JWT_VC;
-    private static final String HELP_TEXT = "Issues SD-JWT-VCs following the specification of https://drafts.oauth.net/oauth-sd-jwt-vc/draft-ietf-oauth-sd-jwt-vc.html.";
-
-    @Override
-    public VerifiableCredentialsSigningService create(KeycloakSession session, ComponentModel model) {
-        String keyId = model.get(SigningProperties.KEY_ID.getKey());
-        String algorithmType = model.get(SigningProperties.ALGORITHM_TYPE.getKey());
-        Optional<String> kid = Optional.ofNullable(model.get(SigningProperties.KID_HEADER.getKey()));
-
-        // Store vct as a conditional attribute of the signing service.
-        // But is vcConfigId is provided, vct must be provided as well.
-        String vct = model.get(SigningProperties.VC_VCT.getKey());
-        String vcConfigId = model.get(SigningProperties.VC_CONFIG_ID.getKey());
-
-        return new SdJwtSigningService(session, keyId, algorithmType, kid,
-                VerifiableCredentialType.from(vct), CredentialConfigId.from(vcConfigId));
-    }
-
-    @Override
-    public String getHelpText() {
-        return HELP_TEXT;
-    }
-
-    @Override
-    public List<ProviderConfigProperty> getConfigProperties() {
-        return VCSigningServiceProviderFactory.configurationBuilder()
-                .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty())
-                .property(SigningProperties.KID_HEADER.asConfigProperty())
-                .property(SigningProperties.VC_VCT.asConfigProperty())
-                .property(SigningProperties.VC_CONFIG_ID.asConfigProperty())
-                .build();
-    }
-
-    @Override
-    public String getId() {
-        return SUPPORTED_FORMAT;
-    }
-
-    @Override
-    public void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
-        ConfigurationValidationHelper helper = ConfigurationValidationHelper.check(model)
-                .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty());
-        // Make sure VCT is set if vc config id is set.
-        if (model.get(SigningProperties.VC_CONFIG_ID.getKey()) != null) {
-            helper.checkRequired(SigningProperties.VC_VCT.asConfigProperty());
-        }
-    }
-
-    @Override
-    public String supportedFormat() {
-        return SUPPORTED_FORMAT;
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningProperties.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningProperties.java
deleted file mode 100644
index 49a2793cbdd2..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningProperties.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.crypto.Algorithm;
-import org.keycloak.provider.ProviderConfigProperty;
-
-/**
- * Properties for configuring the {@link VerifiableCredentialsSigningService}'s
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public enum SigningProperties {
-
-    ISSUER_DID("issuerDid", "Did of the issuer.", "Provide the DID of the issuer. Needs to match the provided key material.", ProviderConfigProperty.STRING_TYPE, null),
-    KEY_ID("keyId", "Id of the signing key.", "The id of the key to be used for signing credentials. The key needs to be provided as a realm key.", ProviderConfigProperty.STRING_TYPE, null),
-    // keyId header can be confusing if there is any key rotation, as key ids have to be immutable. It can lead
-    // to different keys being exposed under the same id.
-    KID_HEADER("kidHeader", "Kid to be set for the JWT.", "The kid to be set in the jwt-header. Depending on the did-schema, the pure key-id might not be enough and can be overwritten here.", ProviderConfigProperty.STRING_TYPE, null),
-    PROOF_TYPE("proofType", "Type of the LD-Proof.", "The type of LD-Proofs to be created. Needs to fit the provided signing key.", ProviderConfigProperty.STRING_TYPE, null),
-    ALGORITHM_TYPE("algorithmType", "Type of the signing algorithm.", "The type of the algorithm to be used for signing. Needs to fit the provided signing key.", ProviderConfigProperty.STRING_TYPE, Algorithm.RS256),
-    TOKEN_TYPE("tokenType", "Type of the token.", "The type of the token to be created.  Will be used as `typ` claim in the JWT-Header.", ProviderConfigProperty.STRING_TYPE, "JWT"),
-    DECOYS("decoys", "Number of decoys to be added.", "The number of decoys to be added to the SD-JWT.", ProviderConfigProperty.STRING_TYPE, 0),
-    HASH_ALGORITHM("hashAlgorithm", "Hash algorithm for SD-JWTs.", "The hash algorithm to be used for the SD-JWTs.", ProviderConfigProperty.STRING_TYPE, "sha-256"),
-    VISIBLE_CLAIMS("visibleClaims", "Visible claims of the SD-JWT.", "List of claims to stay disclosed in the SD-JWT.", ProviderConfigProperty.MULTIVALUED_STRING_TYPE, null),
-    VC_CONFIG_ID("vcConfigId", "Credential configuration identifier", "The identifier of this credential configuration", ProviderConfigProperty.STRING_TYPE, null),
-    VC_VCT("vct", "Credential Type", "The type of this credential", ProviderConfigProperty.STRING_TYPE, null);
-
-    private final String key;
-    private final String label;
-    private final String helpText;
-    private final String type;
-    private final Object defaultValue;
-
-    SigningProperties(String key, String label, String helpText, String type, Object defaultValue) {
-        this.key = key;
-        this.label = label;
-        this.helpText = helpText;
-        this.type = type;
-        this.defaultValue = defaultValue;
-    }
-
-
-    public ProviderConfigProperty asConfigProperty() {
-        return new ProviderConfigProperty(key, label, helpText, type, defaultValue);
-    }
-
-    public String getKey() {
-        return key;
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningService.java
deleted file mode 100644
index ab18be852c47..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningService.java
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.common.VerificationException;
-import org.keycloak.crypto.KeyUse;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.SignatureProvider;
-import org.keycloak.crypto.SignatureVerifierContext;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jwk.JWKParser;
-import org.keycloak.jose.jwk.OKPPublicJWK;
-import org.keycloak.models.KeycloakSession;
-
-/**
- * Abstract base class to provide the Signing Services common functionality
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public abstract class SigningService<T> implements VerifiableCredentialsSigningService<T> {
-
-    protected final KeycloakSession keycloakSession;
-    protected final String keyId;
-
-    // values of the type field are defined by the implementing service. Could f.e. the security suite for ldp_vc or the algorithm to be used for jwt_vc
-    protected final String type;
-
-    // As the type is not identical to the format, we use the format as a factory to
-    // instantiate provider.
-    protected final String format;
-
-    protected SigningService(KeycloakSession keycloakSession, String keyId, String format, String type) {
-        this.keycloakSession = keycloakSession;
-        this.keyId = keyId;
-        this.format = format;
-        this.type = type;
-    }
-
-    @Override
-    public String locator() {
-        // Future implementation might consider credential type or even configuration specific signers.
-        // See: org.keycloak.protocol.oid4vc.issuance.signing.SdJwtSigningService.locator
-        return  VerifiableCredentialsSigningService.locator(format, null, null);
-    }
-
-    /**
-     * Returns the key stored under kid, or the active key for the given jws algorithm,
-     *
-     * @param kid
-     * @param algorithm
-     * @return
-     */
-    protected KeyWrapper getKey(String kid, String algorithm) {
-        // Allow the service to work with the active key if keyId is null
-        // And we still have to figure out how to proceed with key rotation
-        if (keyId == null) {
-            return keycloakSession.keys().getActiveKey(keycloakSession.getContext().getRealm(), KeyUse.SIG, algorithm);
-        }
-        return keycloakSession.keys().getKey(keycloakSession.getContext().getRealm(), kid, KeyUse.SIG, algorithm);
-    }
-
-    protected SignatureVerifierContext getVerifier(JWK jwk, String jwsAlgorithm) throws VerificationException {
-        SignatureProvider signatureProvider = keycloakSession.getProvider(SignatureProvider.class, jwsAlgorithm);
-        return signatureProvider.verifier(getKeyWrapper(jwk, jwsAlgorithm, KeyUse.SIG));
-    }
-
-    private KeyWrapper getKeyWrapper(JWK jwk, String algorithm, KeyUse keyUse) {
-        KeyWrapper keyWrapper = new KeyWrapper();
-        keyWrapper.setType(jwk.getKeyType());
-
-        // Use the algorithm provided by the caller, and not the one inside the jwk (if any)
-        // As jws validation will also check that one against the value "none"
-        keyWrapper.setAlgorithm(algorithm);
-
-        // Set the curve if any
-        if (jwk.getOtherClaims().get(OKPPublicJWK.CRV) != null) {
-            keyWrapper.setCurve((String) jwk.getOtherClaims().get(OKPPublicJWK.CRV));
-        }
-
-        keyWrapper.setUse(keyUse);
-        JWKParser parser = JWKParser.create(jwk);
-        keyWrapper.setPublicKey(parser.toPublicKey());
-        return keyWrapper;
-    }
-
-    @Override
-    public void close() {
-        // no-op
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningServiceException.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningServiceException.java
deleted file mode 100644
index 765698b7e652..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/SigningServiceException.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-/**
- * Exception to be thrown if credentials signing does fail
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class SigningServiceException extends RuntimeException {
-
-    public SigningServiceException(String message) {
-        super(message);
-    }
-
-    public SigningServiceException(String message, Throwable cause) {
-        super(message, cause);
-    }
-}
\ No newline at end of file
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceProviderFactory.java
deleted file mode 100644
index afed33575dee..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceProviderFactory.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.Config;
-import org.keycloak.common.Profile;
-import org.keycloak.component.ComponentFactory;
-import org.keycloak.component.ComponentModel;
-import org.keycloak.component.ComponentValidationException;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.protocol.oid4vc.OID4VCEnvironmentProviderFactory;
-import org.keycloak.provider.ConfigurationValidationHelper;
-import org.keycloak.provider.ProviderConfigurationBuilder;
-
-/**
- * Provider Factory to create {@link  VerifiableCredentialsSigningService}s
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public interface VCSigningServiceProviderFactory extends ComponentFactory<VerifiableCredentialsSigningService, VerifiableCredentialsSigningService>, OID4VCEnvironmentProviderFactory {
-
-    static ProviderConfigurationBuilder configurationBuilder() {
-        return ProviderConfigurationBuilder.create()
-                // I do believe the ALGORITHM_TYPE need to be mandatory instead. As the keyId might change with key rotation.
-                // If keyId is not set, service can always work with active key.
-                .property(SigningProperties.ALGORITHM_TYPE.asConfigProperty());
-    }
-
-    @Override
-    default void validateConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException {
-        ConfigurationValidationHelper.check(model)
-                .checkRequired(SigningProperties.ALGORITHM_TYPE.asConfigProperty());
-        validateSpecificConfiguration(session, realm, model);
-    }
-
-
-    @Override
-    default void close() {
-        // no-op
-    }
-
-    @Override
-    default void init(Config.Scope config) {
-        // no-op
-    }
-
-    @Override
-    default void postInit(KeycloakSessionFactory factory) {
-        // no-op
-    }
-
-    @Override
-    default boolean isSupported(Config.Scope config) {
-        return Profile.isFeatureEnabled(Profile.Feature.OID4VC_VCI);
-    }
-
-    /**
-     * Should validate potential implementation specific configuration of the factory.
-     */
-    void validateSpecificConfiguration(KeycloakSession session, RealmModel realm, ComponentModel model) throws ComponentValidationException;
-
-    /**
-     * Should return the credentials format supported by the signing service.
-     *
-     * @return the format
-     */
-    String supportedFormat();
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceSpi.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceSpi.java
deleted file mode 100644
index 75aa04df80fb..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VCSigningServiceSpi.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.provider.Provider;
-import org.keycloak.provider.ProviderFactory;
-import org.keycloak.provider.Spi;
-
-/**
- * Spi implementation of the creation of {@link  VerifiableCredentialsSigningService}
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class VCSigningServiceSpi implements Spi {
-    private static final String NAME = "vcSigningService";
-
-    @Override
-    public boolean isInternal() {
-        return true;
-    }
-
-    @Override
-    public String getName() {
-        return NAME;
-    }
-
-    @Override
-    public Class<? extends Provider> getProviderClass() {
-        return VerifiableCredentialsSigningService.class;
-    }
-
-    @Override
-    public Class<? extends ProviderFactory> getProviderFactoryClass() {
-        return VCSigningServiceProviderFactory.class;
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VerifiableCredentialsSigningService.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VerifiableCredentialsSigningService.java
deleted file mode 100644
index c2fe449e0ccd..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/VerifiableCredentialsSigningService.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.issuance.signing;
-
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuerException;
-import org.keycloak.protocol.oid4vc.model.CredentialConfigId;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredentialType;
-import org.keycloak.provider.Provider;
-
-/**
- * Interface to be used for signing verifiable credentials.
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public interface VerifiableCredentialsSigningService<T> extends Provider {
-    /**
-     * Takes a verifiable credential and signs it according to the implementation.
-     * Depending on the type of the SigningService, it will return a signed representation of the credential
-     *
-     * @param vcIssuanceContext verifiable credential to sign and context info
-     * @return a signed representation
-     */
-    T signCredential(VCIssuanceContext vcIssuanceContext) throws VCIssuerException;
-
-    /**
-     * Returns the identifier of this service instance, can be either the format alone,
-     * or the combination between format, credential type and credential configuration id.
-     */
-    String locator();
-
-    String LOCATION_SEPARATOR = "::";
-
-    /**
-     * We are forcing a structure with 3 components. format::type::configId. We assume format is always set, as
-     * implementation of this interface always know their format.
-     *
-     * @param format
-     * @param credentialType
-     * @param vcConfigId
-     * @return
-     */
-    static String locator(String format, VerifiableCredentialType credentialType, CredentialConfigId vcConfigId){
-        return (format == null ? "" : format) + LOCATION_SEPARATOR +
-                (credentialType == null ? "" : credentialType.getValue()) + LOCATION_SEPARATOR +
-                (vcConfigId == null ? "" : vcConfigId.getValue());
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018Suite.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018Suite.java
index ad23535b4b38..22ff84e489b7 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018Suite.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/signing/vcdm/Ed255192018Suite.java
@@ -35,7 +35,7 @@
 import jakarta.json.JsonObject;
 import jakarta.json.JsonValue;
 import org.keycloak.crypto.SignatureSignerContext;
-import org.keycloak.protocol.oid4vc.issuance.signing.SigningServiceException;
+import org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerException;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.util.JsonSerialization;
 
@@ -102,14 +102,14 @@ private byte[] transform(VerifiableCredential verifiableCredential) {
                 return writer.toString()
                         .getBytes(StandardCharsets.UTF_8);
             } else {
-                throw new SigningServiceException("Was not able to get the expanded json.");
+                throw new CredentialSignerException("Was not able to get the expanded json.");
             }
         } catch (JsonProcessingException e) {
-            throw new SigningServiceException("Was not able to serialize the credential", e);
+            throw new CredentialSignerException("Was not able to serialize the credential", e);
         } catch (JsonLdError e) {
-            throw new SigningServiceException("Was not able to create a JsonLD Document from the serialized string.", e);
+            throw new CredentialSignerException("Was not able to create a JsonLD Document from the serialized string.", e);
         } catch (UnsupportedContentException | IOException | RdfWriterException e) {
-            throw new SigningServiceException("Was not able to canonicalize the json-ld.", e);
+            throw new CredentialSignerException("Was not able to canonicalize the json-ld.", e);
         }
 
     }
@@ -119,7 +119,7 @@ private byte[] digest(byte[] transformedData) {
             MessageDigest md = MessageDigest.getInstance("SHA-256");
             return md.digest(transformedData);
         } catch (NoSuchAlgorithmException e) {
-            throw new SigningServiceException("Algorithm SHA-256 not supported.", e);
+            throw new CredentialSignerException("Algorithm SHA-256 not supported.", e);
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claim.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claim.java
index e66c5687298e..e4f77b0df9fe 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claim.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claim.java
@@ -16,42 +16,108 @@
  */
 package org.keycloak.protocol.oid4vc.model;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.oid4vci.Oid4vcProtocolMapperModel;
+import org.keycloak.protocol.ProtocolMapper;
+import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.StringUtil;
 
 import java.util.List;
+import java.util.Optional;
 
 /**
  * Holding metadata on a claim of verifiable credential.
  * <p>
- * See: <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#appendix-A.2.2">openid-4-verifiable-credential-issuance-1_0.html#appendix-A.2.2</a>
+ * See: <a
+ * href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#appendix-A.2.2">openid-4-verifiable-credential-issuance-1_0.html#appendix-A.2.2</a>
  *
  * @author <a href="mailto:francis.pouatcha@adorsys.com">Francis Pouatcha</a>
  */
+@JsonIgnoreProperties(ignoreUnknown = true)
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class Claim {
+
+    /**
+     * the claims name, which is not part of the underlying JSON structure
+     */
+    @JsonIgnore
+    private String name;
+
+    @JsonProperty("path")
+    private List<String> path;
+
     @JsonProperty("mandatory")
     private Boolean mandatory;
-    @JsonProperty("value_type")
-    private String valueType;
+
     @JsonProperty("display")
     private List<ClaimDisplay> display;
 
-    public Boolean getMandatory() {
-        return mandatory;
+    public static Optional<Claim> parse(KeycloakSession keycloakSession,
+                                        String credentialFormat,
+                                        Oid4vcProtocolMapperModel protocolMapper) {
+        try {
+            Claim claim = new Claim();
+            ProtocolMapper protocolMapperImpl = keycloakSession.getProvider(ProtocolMapper.class,
+                                                                            protocolMapper.getProtocolMapper());
+            if (!(protocolMapperImpl instanceof OID4VCMapper)) {
+                return Optional.empty();
+            }
+            OID4VCMapper mapper = (OID4VCMapper) protocolMapperImpl;
+            mapper.setMapperModel(protocolMapper, credentialFormat);
+
+            if (!mapper.includeInMetadata()) {
+                return Optional.empty();
+            }
+
+            claim.setName(String.join(".", mapper.getMetadataAttributePath()));
+
+            claim.setPath(mapper.getMetadataAttributePath());
+            claim.setMandatory(protocolMapper.isMandatory());
+
+            String displayString = protocolMapper.getDisplay();
+            if (StringUtil.isNotBlank(displayString)) {
+                TypeReference<List<ClaimDisplay>> typeReference = new TypeReference<>() {};
+                List<ClaimDisplay> claimDisplayList = JsonSerialization.mapper.readValue(displayString, typeReference);
+                claim.setDisplay(claimDisplayList);
+            }
+
+            return Optional.of(claim);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
     }
 
-    public Claim setMandatory(Boolean mandatory) {
-        this.mandatory = mandatory;
+    public String getName() {
+        return name;
+    }
+
+    public Claim setName(String name) {
+        this.name = name;
+        return this;
+    }
+
+    public List<String> getPath() {
+        return path;
+    }
+
+    public Claim setPath(List<String> path) {
+        this.path = path;
         return this;
     }
 
-    public String getValueType() {
-        return valueType;
+    public boolean isMandatory() {
+        return Optional.ofNullable(mandatory).orElse(false);
     }
 
-    public Claim setValueType(String valueType) {
-        this.valueType = valueType;
+    public Claim setMandatory(Boolean mandatory) {
+        this.mandatory = mandatory;
         return this;
     }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ClaimDisplay.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ClaimDisplay.java
index 83c9ca5a6226..7fc2baed97d0 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ClaimDisplay.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ClaimDisplay.java
@@ -18,6 +18,10 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.keycloak.util.JsonSerialization;
+
+import java.util.Objects;
 
 /**
  *
@@ -48,4 +52,30 @@ public ClaimDisplay setLocale(String locale) {
         this.locale = locale;
         return this;
     }
+
+    @Override
+    public final boolean equals(Object object) {
+
+        if (!(object instanceof ClaimDisplay that)) {
+            return false;
+        }
+
+        return Objects.equals(name, that.name) && Objects.equals(locale, that.locale);
+    }
+
+    @Override
+    public int hashCode() {
+        int result = Objects.hashCode(name);
+        result = 31 * result + Objects.hashCode(locale);
+        return result;
+    }
+
+    @Override
+    public String toString() {
+        try {
+            return JsonSerialization.mapper.writeValueAsString(this);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claims.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claims.java
index 308295a2dea3..ab295899c848 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claims.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Claims.java
@@ -16,15 +16,27 @@
  */
 package org.keycloak.protocol.oid4vc.model;
 
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
-import java.util.HashMap;
+import java.util.ArrayList;
+import java.util.Optional;
 
 /**
  * @author <a href="mailto:francis.pouatcha@adorsys.com">Francis Pouatcha</a>
  */
-public class Claims extends HashMap<String, Claim> {
+public class Claims extends ArrayList<Claim> {
+
+    public static Claims parse(KeycloakSession keycloakSession, CredentialScopeModel credentialScope) {
+        Claims claims = new Claims();
+        credentialScope.getOid4vcProtocolMappersStream().forEach(protocolMapper -> {
+            Optional<Claim> claim = Claim.parse(keycloakSession, credentialScope.getFormat(), protocolMapper);
+            claim.ifPresent(claims::add);
+        });
+        return claims;
+    }
 
     public String toJsonString(){
         try {
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialBuildConfig.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialBuildConfig.java
index a7ef23e34581..504944538b1f 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialBuildConfig.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialBuildConfig.java
@@ -17,17 +17,14 @@
 
 package org.keycloak.protocol.oid4vc.model;
 
-import java.util.Arrays;
-import java.util.HashMap;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+
 import java.util.List;
-import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 
-import static org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration.CREDENTIAL_BUILD_CONFIG_KEY;
-import static org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration.DOT_SEPARATOR;
-import static org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration.VERIFIABLE_CREDENTIAL_TYPE_KEY;
-
 /**
  * Define credential-specific configurations for its builder.
  *
@@ -42,16 +39,79 @@ public class CredentialBuildConfig {
     private static final String VISIBLE_CLAIMS_KEY = "visible_claims";
     private static final String NUMBER_OF_DECOYS_KEY = "decoys";
 
+    private static final String SIGNING_KEY_ID_KEY = "signing_key_id";
+    private static final String OVERRIDE_KEY_ID_KEY = "override_key_id";
+    private static final String SIGNING_ALGORITHM_KEY = "signing_algorithm";
+    private static final String LDP_PROOF_TYPE_KEY = "ldp_proof_type";
+
+    private String credentialIssuer;
 
-    // This is saved here to facilitate dot notation reconstruction
     private String credentialId;
 
+    //-- Proper building configuration fields --//
+
+    // The vct field to be used for the SD-JWT.
     private String credentialType;
+
+    // The type of the token to be created.
+    // Will be used as `typ` claim in the JWT-Header.
     private String tokenJwsType;
+
+    // The hash algorithm to be used for the SD-JWTs.
     private String hashAlgorithm;
-    private List<String> visibleClaims;
+
+    // List of claims to stay disclosed in the SD-JWT.
+    private List<String> sdJwtVisibleClaims;
+
+    // The number of decoys to be added to the SD-JWT.
     private Integer numberOfDecoys;
 
+    //-- Signing configuration fields --//
+
+    // The id of the key to be used for signing credentials.
+    // The key needs to be provided as a realm key.
+    private String signingKeyId;
+
+    // An alternative kid to take precedence.
+    // Depending on the did-schema, the above signingKeyId
+    // might not be enough and can be overwritten here.
+    private String overrideKeyId;
+
+    // The type of the algorithm to be used for signing.
+    // Needs to fit the provided signing key.
+    private String signingAlgorithm;
+
+    // The type of LD-Proofs to be created.
+    // Needs to fit the provided signing key.
+    private String ldpProofType;
+
+    public static CredentialBuildConfig parse(KeycloakSession keycloakSession,
+                                              SupportedCredentialConfiguration credentialConfiguration,
+                                              CredentialScopeModel credentialModel) {
+        final String credentialIssuer = Optional.ofNullable(credentialModel.getIssuerDid()).orElse(
+                OID4VCIssuerWellKnownProvider.getIssuer(keycloakSession.getContext()));
+
+        return new CredentialBuildConfig().setCredentialIssuer(credentialIssuer)
+                                          .setCredentialId(credentialConfiguration.getId())
+                                          .setCredentialType(credentialConfiguration.getVct())
+                                          .setTokenJwsType(credentialModel.getTokenJwsType())
+                                          .setNumberOfDecoys(credentialModel.getSdJwtNumberOfDecoys())
+                                          .setSigningKeyId(credentialModel.getSigningKeyId())
+                                          .setSigningAlgorithm(credentialConfiguration.getCredentialSigningAlgValuesSupported()
+                                                                                      .get(0))
+                                          .setHashAlgorithm(credentialModel.getHashAlgorithm())
+                                          .setSdJwtVisibleClaims(credentialModel.getSdJwtVisibleClaims());
+    }
+
+    public String getCredentialIssuer() {
+        return credentialIssuer;
+    }
+
+    public CredentialBuildConfig setCredentialIssuer(String credentialIssuer) {
+        this.credentialIssuer = credentialIssuer;
+        return this;
+    }
+
     public String getCredentialId() {
         return credentialId;
     }
@@ -79,12 +139,12 @@ public CredentialBuildConfig setHashAlgorithm(String hashAlgorithm) {
         return this;
     }
 
-    public List<String> getVisibleClaims() {
-        return visibleClaims;
+    public List<String> getSdJwtVisibleClaims() {
+        return sdJwtVisibleClaims;
     }
 
-    public CredentialBuildConfig setVisibleClaims(List<String> visibleClaims) {
-        this.visibleClaims = visibleClaims;
+    public CredentialBuildConfig setSdJwtVisibleClaims(List<String> sdJwtVisibleClaims) {
+        this.sdJwtVisibleClaims = sdJwtVisibleClaims;
         return this;
     }
 
@@ -106,78 +166,75 @@ public CredentialBuildConfig setCredentialType(String credentialType) {
         return this;
     }
 
-    public Map<String, String> toDotNotation() {
-        Map<String, String> dotNotation = new HashMap<>();
-
-        // vct is skipped because it is not expected nester under CREDENTIAL_BUILD_CONFIG_KEY
-
-        String prefix = getDotNotationPrefix(credentialId);
-
-        Optional.ofNullable(tokenJwsType)
-                .ifPresent(tokenJwsType -> dotNotation.put(prefix + TOKEN_JWS_TYPE_KEY, tokenJwsType));
-        Optional.ofNullable(hashAlgorithm)
-                .ifPresent(hashAlgorithm -> dotNotation.put(prefix + HASH_ALGORITHM_KEY, hashAlgorithm));
-
-        Optional.ofNullable(numberOfDecoys)
-                .ifPresent(numberOfDecoys ->
-                        dotNotation.put(prefix + NUMBER_OF_DECOYS_KEY, String.valueOf(numberOfDecoys)));
-
-        Optional.ofNullable(visibleClaims)
-                .ifPresent(claims -> dotNotation.put(prefix + VISIBLE_CLAIMS_KEY,
-                        String.join(MULTIVALUED_STRING_SEPARATOR, claims)));
-
-        return dotNotation;
+    public String getSigningKeyId() {
+        return signingKeyId;
     }
 
-    public static CredentialBuildConfig fromDotNotation(String credentialId, Map<String, String> dotNotated) {
-        String prefix = getDotNotationPrefix(credentialId);
-        if (dotNotated.keySet().stream().noneMatch(key -> key.startsWith(prefix))) {
-            return null;
-        }
-
-        // Start populating config
-
-        CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
-                .setCredentialId(credentialId);
-
-        // No need to redefine `vct` under CREDENTIAL_BUILD_CONFIG_KEY
-
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + VERIFIABLE_CREDENTIAL_TYPE_KEY))
-                .ifPresent(credentialBuildConfig::setCredentialType);
+    public CredentialBuildConfig setSigningKeyId(String signingKeyId) {
+        this.signingKeyId = signingKeyId;
+        return this;
+    }
 
-        // These other fields are nested under CREDENTIAL_BUILD_CONFIG_KEY
+    public String getOverrideKeyId() {
+        return overrideKeyId;
+    }
 
-        Optional.ofNullable(dotNotated.get(prefix + TOKEN_JWS_TYPE_KEY))
-                .ifPresent(credentialBuildConfig::setTokenJwsType);
-        Optional.ofNullable(dotNotated.get(prefix + HASH_ALGORITHM_KEY))
-                .ifPresent(credentialBuildConfig::setHashAlgorithm);
+    public CredentialBuildConfig setOverrideKeyId(String overrideKeyId) {
+        this.overrideKeyId = overrideKeyId;
+        return this;
+    }
 
-        Optional.ofNullable(dotNotated.get(prefix + NUMBER_OF_DECOYS_KEY))
-                .map(Integer::parseInt)
-                .ifPresent(credentialBuildConfig::setNumberOfDecoys);
+    public String getSigningAlgorithm() {
+        return signingAlgorithm;
+    }
 
-        Optional.ofNullable(dotNotated.get(prefix + VISIBLE_CLAIMS_KEY))
-                .map(cbms -> cbms.split(MULTIVALUED_STRING_SEPARATOR))
-                .map(Arrays::asList)
-                .ifPresent(credentialBuildConfig::setVisibleClaims);
+    public CredentialBuildConfig setSigningAlgorithm(String signingAlgorithm) {
+        this.signingAlgorithm = signingAlgorithm;
+        return this;
+    }
 
-        return credentialBuildConfig;
+    public String getLdpProofType() {
+        return ldpProofType;
     }
 
-    private static String getDotNotationPrefix(String credentialId) {
-        return credentialId + DOT_SEPARATOR + CREDENTIAL_BUILD_CONFIG_KEY + DOT_SEPARATOR;
+    public CredentialBuildConfig setLdpProofType(String ldpProofType) {
+        this.ldpProofType = ldpProofType;
+        return this;
     }
 
     @Override
     public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
         CredentialBuildConfig that = (CredentialBuildConfig) o;
-        return Objects.equals(credentialId, that.credentialId) && Objects.equals(credentialType, that.credentialType) && Objects.equals(tokenJwsType, that.tokenJwsType) && Objects.equals(hashAlgorithm, that.hashAlgorithm) && Objects.equals(visibleClaims, that.visibleClaims) && Objects.equals(numberOfDecoys, that.numberOfDecoys);
+        return Objects.equals(credentialId, that.credentialId) && Objects.equals(credentialType,
+                                                                                 that.credentialType) && Objects.equals(
+                tokenJwsType,
+                that.tokenJwsType) && Objects.equals(hashAlgorithm, that.hashAlgorithm) && Objects.equals(
+                sdJwtVisibleClaims,
+                that.sdJwtVisibleClaims) && Objects.equals(
+                numberOfDecoys,
+                that.numberOfDecoys) && Objects.equals(signingKeyId, that.signingKeyId) && Objects.equals(overrideKeyId,
+                                                                                                          that.overrideKeyId) && Objects.equals(
+                signingAlgorithm,
+                that.signingAlgorithm) && Objects.equals(ldpProofType, that.ldpProofType);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(credentialType, tokenJwsType, hashAlgorithm, visibleClaims, numberOfDecoys, credentialId);
+        return Objects.hash(credentialId,
+                            credentialType,
+                            tokenJwsType,
+                            hashAlgorithm,
+                            sdJwtVisibleClaims,
+                            numberOfDecoys,
+                            signingKeyId,
+                            overrideKeyId,
+                            signingAlgorithm,
+                            ldpProofType);
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialDefinition.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialDefinition.java
index 05383eb564a0..bc21ae233840 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialDefinition.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialDefinition.java
@@ -18,11 +18,11 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
-import org.keycloak.util.JsonSerialization;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 
 /**
  * Pojo to represent a CredentialDefinition for internal handling
@@ -35,7 +35,18 @@ public class CredentialDefinition {
     @JsonProperty("@context")
     private List<String> context;
     private List<String> type = new ArrayList<>();
-    private CredentialSubject credentialSubject = new CredentialSubject();
+
+    public static CredentialDefinition parse(CredentialScopeModel credentialModel) {
+        List<String> contexts = Optional.of(credentialModel.getVcContexts())
+                                        .filter(list -> !list.isEmpty())
+                                        .orElseGet(() -> new ArrayList<>(List.of(credentialModel.getName())));
+        List<String> types = Optional.ofNullable(credentialModel.getSupportedCredentialTypes())
+                                     .filter(list -> !list.isEmpty())
+                                     .orElseGet(() -> new ArrayList<>(List.of(credentialModel.getName())));
+
+        return new CredentialDefinition().setContext(contexts)
+                                         .setType(types);
+    }
 
     public List<String> getContext() {
         return context;
@@ -54,29 +65,4 @@ public CredentialDefinition setType(List<String> type) {
         this.type = type;
         return this;
     }
-
-    public CredentialSubject getCredentialSubject() {
-        return credentialSubject;
-    }
-
-    public CredentialDefinition setCredentialSubject(CredentialSubject credentialSubject) {
-        this.credentialSubject = credentialSubject;
-        return this;
-    }
-
-    public String toJsonString() {
-        try {
-            return JsonSerialization.writeValueAsString(this);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public static CredentialDefinition fromJsonString(String jsonString) {
-        try {
-            return JsonSerialization.readValue(jsonString, CredentialDefinition.class);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialIssuer.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialIssuer.java
index db3c048e5f82..77ed8a3ff919 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialIssuer.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialIssuer.java
@@ -21,12 +21,13 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
 /**
  * Represents a credentials issuer according to the OID4VCI Credentials Issuer Metadata
- * {@see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-issuer-metadata}
+ * {@see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-credential-issuer-metadata}
  *
  * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
  */
@@ -39,19 +40,32 @@ public class CredentialIssuer {
     @JsonProperty("credential_endpoint")
     private String credentialEndpoint;
 
+    @JsonProperty("nonce_endpoint")
+    private String nonceEndpoint;
+
+    @JsonProperty("deferred_credential_endpoint")
+    private String deferredCredentialEndpoint;
+
     @JsonProperty("authorization_servers")
     private List<String> authorizationServers;
 
-    @JsonProperty("batch_credential_endpoint")
-    private String batchCredentialEndpoint;
-
     @JsonProperty("notification_endpoint")
     private String notificationEndpoint;
 
+    @JsonProperty("credential_response_encryption")
+    private CredentialResponseEncryption credentialResponseEncryption;
+
+    @JsonProperty("batch_credential_issuance")
+    private BatchCredentialIssuance batchCredentialIssuance;
+
+    @JsonProperty("signed_metadata")
+    private String signedMetadata;
+
     @JsonProperty("credential_configurations_supported")
     private Map<String, SupportedCredentialConfiguration> credentialsSupported;
 
-    private DisplayObject display;
+    @JsonProperty("display")
+    private List<DisplayObject> display;
 
     public String getCredentialIssuer() {
         return credentialIssuer;
@@ -71,30 +85,21 @@ public CredentialIssuer setCredentialEndpoint(String credentialEndpoint) {
         return this;
     }
 
-    public String getBatchCredentialEndpoint() {
-        return batchCredentialEndpoint;
-    }
-
-    public CredentialIssuer setBatchCredentialEndpoint(String batchCredentialEndpoint) {
-        this.batchCredentialEndpoint = batchCredentialEndpoint;
-        return this;
-    }
-
-    public Map<String, SupportedCredentialConfiguration> getCredentialsSupported() {
-        return credentialsSupported;
+    public String getNonceEndpoint() {
+        return nonceEndpoint;
     }
 
-    public CredentialIssuer setCredentialsSupported(Map<String, SupportedCredentialConfiguration> credentialsSupported) {
-        this.credentialsSupported = Collections.unmodifiableMap(credentialsSupported);
+    public CredentialIssuer setNonceEndpoint(String nonceEndpoint) {
+        this.nonceEndpoint = nonceEndpoint;
         return this;
     }
 
-    public DisplayObject getDisplay() {
-        return display;
+    public String getDeferredCredentialEndpoint() {
+        return deferredCredentialEndpoint;
     }
 
-    public CredentialIssuer setDisplay(DisplayObject display) {
-        this.display = display;
+    public CredentialIssuer setDeferredCredentialEndpoint(String deferredCredentialEndpoint) {
+        this.deferredCredentialEndpoint = deferredCredentialEndpoint;
         return this;
     }
 
@@ -115,5 +120,112 @@ public CredentialIssuer setNotificationEndpoint(String notificationEndpoint) {
         this.notificationEndpoint = notificationEndpoint;
         return this;
     }
-}
 
+    public CredentialResponseEncryption getCredentialResponseEncryption() {
+        return credentialResponseEncryption;
+    }
+
+    public CredentialIssuer setCredentialResponseEncryption(CredentialResponseEncryption credentialResponseEncryption) {
+        this.credentialResponseEncryption = credentialResponseEncryption;
+        return this;
+    }
+
+    public BatchCredentialIssuance getBatchCredentialIssuance() {
+        return batchCredentialIssuance;
+    }
+
+    public CredentialIssuer setBatchCredentialIssuance(BatchCredentialIssuance batchCredentialIssuance) {
+        this.batchCredentialIssuance = batchCredentialIssuance;
+        return this;
+    }
+
+    public String getSignedMetadata() {
+        return signedMetadata;
+    }
+
+    public CredentialIssuer setSignedMetadata(String signedMetadata) {
+        this.signedMetadata = signedMetadata;
+        return this;
+    }
+
+    public Map<String, SupportedCredentialConfiguration> getCredentialsSupported() {
+        return credentialsSupported;
+    }
+
+    public CredentialIssuer setCredentialsSupported(Map<String, SupportedCredentialConfiguration> credentialsSupported) {
+        if (credentialsSupported == null) {
+            throw new IllegalArgumentException("credentialsSupported cannot be null");
+        }
+        this.credentialsSupported = Collections.unmodifiableMap(new HashMap<>(credentialsSupported));
+        return this;
+    }
+
+    public List<DisplayObject> getDisplay() {
+        return display;
+    }
+
+    public CredentialIssuer setDisplay(List<DisplayObject> display) {
+        this.display = display;
+        return this;
+    }
+
+    /**
+     * Represents the credential_response_encryption metadata parameter.
+     */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class CredentialResponseEncryption {
+        @JsonProperty("alg_values_supported")
+        private List<String> algValuesSupported;
+
+        @JsonProperty("enc_values_supported")
+        private List<String> encValuesSupported;
+
+        @JsonProperty("encryption_required")
+        private Boolean encryptionRequired;
+
+        public List<String> getAlgValuesSupported() {
+            return algValuesSupported;
+        }
+
+        public CredentialResponseEncryption setAlgValuesSupported(List<String> algValuesSupported) {
+            this.algValuesSupported = algValuesSupported;
+            return this;
+        }
+
+        public List<String> getEncValuesSupported() {
+            return encValuesSupported;
+        }
+
+        public CredentialResponseEncryption setEncValuesSupported(List<String> encValuesSupported) {
+            this.encValuesSupported = encValuesSupported;
+            return this;
+        }
+
+        public Boolean getEncryptionRequired() {
+            return encryptionRequired;
+        }
+
+        public CredentialResponseEncryption setEncryptionRequired(Boolean encryptionRequired) {
+            this.encryptionRequired = encryptionRequired;
+            return this;
+        }
+    }
+
+    /**
+     * Represents the batch_credential_issuance metadata parameter.
+     */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class BatchCredentialIssuance {
+        @JsonProperty("batch_size")
+        private Integer batchSize;
+
+        public Integer getBatchSize() {
+            return batchSize;
+        }
+
+        public BatchCredentialIssuance setBatchSize(Integer batchSize) {
+            this.batchSize = batchSize;
+            return this;
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialRequest.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialRequest.java
index 492e6d7260f6..fe5e15e602c2 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialRequest.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialRequest.java
@@ -19,6 +19,16 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.util.JsonSerialization;
+
+import java.util.Map;
+import java.util.Optional;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 
 /**
  * Represents a  CredentialRequest according to OID4VCI
@@ -29,30 +39,24 @@
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class CredentialRequest {
 
-    private String format;
+    @JsonProperty("credential_configuration_id")
+    private String credentialConfigurationId;
 
     @JsonProperty("credential_identifier")
     private String credentialIdentifier;
 
+    @JsonProperty("proof")
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.PROPERTY, property = "proof_type")
+    @JsonSubTypes({
+            @JsonSubTypes.Type(value = JwtProof.class, name = ProofType.JWT),
+            @JsonSubTypes.Type(value = LdpVpProof.class, name = ProofType.LD_PROOF)
+    })
     private Proof proof;
 
-    // I have the choice of either defining format specific fields here, or adding a generic structure,
-    // opening room for spamming the server. I will prefer having format specific fields.
-    private String vct;
-
     // See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-format-identifier-3
     @JsonProperty("credential_definition")
     private CredentialDefinition credentialDefinition;
 
-    public String getFormat() {
-        return format;
-    }
-
-    public CredentialRequest setFormat(String format) {
-        this.format = format;
-        return this;
-    }
-
     public String getCredentialIdentifier() {
         return credentialIdentifier;
     }
@@ -62,21 +66,21 @@ public CredentialRequest setCredentialIdentifier(String credentialIdentifier) {
         return this;
     }
 
-    public Proof getProof() {
-        return proof;
+    public String getCredentialConfigurationId() {
+        return credentialConfigurationId;
     }
 
-    public CredentialRequest setProof(Proof proof) {
-        this.proof = proof;
+    public CredentialRequest setCredentialConfigurationId(String credentialConfigurationId) {
+        this.credentialConfigurationId = credentialConfigurationId;
         return this;
     }
 
-    public String getVct() {
-        return vct;
+    public Proof getProof() {
+        return proof;
     }
 
-    public CredentialRequest setVct(String vct) {
-        this.vct = vct;
+    public CredentialRequest setProof(Proof proof) {
+        this.proof = proof;
         return this;
     }
 
@@ -88,4 +92,30 @@ public CredentialRequest setCredentialDefinition(CredentialDefinition credential
         this.credentialDefinition = credentialDefinition;
         return this;
     }
+
+    public Optional<CredentialScopeModel> findCredentialScope(KeycloakSession keycloakSession) {
+        Map<String, String> searchAttributeMap =
+                Optional.ofNullable(credentialConfigurationId)
+                        .map(credentialIdentifier -> {
+                            return Map.of(CredentialScopeModel.CONFIGURATION_ID, credentialConfigurationId);
+                        }).orElseGet(() -> {
+                            return Map.of(CredentialScopeModel.CREDENTIAL_IDENTIFIER, credentialIdentifier);
+                        });
+
+        RealmModel currentRealm = keycloakSession.getContext().getRealm();
+        final boolean useOrExpression = false;
+        return keycloakSession.clientScopes()
+                              .getClientScopesByAttributes(currentRealm, searchAttributeMap, useOrExpression)
+                              .map(CredentialScopeModel::new)
+                              .findAny();
+    }
+
+    @Override
+    public String toString() {
+        try {
+            return JsonSerialization.mapper.writeValueAsString(this);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponse.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponse.java
index d5d78973f08f..292e75ca98db 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponse.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/CredentialResponse.java
@@ -19,6 +19,11 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.keycloak.util.JsonSerialization;
+
+import java.util.ArrayList;
+import java.util.List;
 
 /**
  * Represents a CredentialResponse according to the OID4VCI Spec
@@ -29,42 +34,38 @@
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class CredentialResponse {
 
-    // concrete type depends on the format
-    private Object credential;
-
-    @JsonProperty("c_nonce")
-    private String cNonce;
+    @JsonProperty("credentials")
+    private List<Credential> credentials;
 
-    @JsonProperty("c_nonce_expires_in")
-    private String cNonceExpiresIn;
+    @JsonProperty("transaction_id")
+    private String transactionId;
 
     @JsonProperty("notification_id")
     private String notificationId;
 
-    public Object getCredential() {
-        return credential;
+    public List<Credential> getCredentials() {
+        return credentials;
     }
 
-    public CredentialResponse setCredential(Object credential) {
-        this.credential = credential;
+    public CredentialResponse setCredentials(List<Credential> credentials) {
+        this.credentials = credentials;
         return this;
     }
 
-    public String getcNonce() {
-        return cNonce;
-    }
-
-    public CredentialResponse setcNonce(String cNonce) {
-        this.cNonce = cNonce;
+    public CredentialResponse addCredential(Object credential) {
+        if (this.credentials == null) {
+            this.credentials = new ArrayList<>();
+        }
+        this.credentials.add(new Credential().setCredential(credential));
         return this;
     }
 
-    public String getcNonceExpiresIn() {
-        return cNonceExpiresIn;
+    public String getTransactionId() {
+        return transactionId;
     }
 
-    public CredentialResponse setcNonceExpiresIn(String cNonceExpiresIn) {
-        this.cNonceExpiresIn = cNonceExpiresIn;
+    public CredentialResponse setTransactionId(String transactionId) {
+        this.transactionId = transactionId;
         return this;
     }
 
@@ -76,4 +77,23 @@ public CredentialResponse setNotificationId(String notificationId) {
         this.notificationId = notificationId;
         return this;
     }
-}
\ No newline at end of file
+
+
+    /**
+     * Inner class to represent a single credential object within the credentials array.
+     */
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class Credential {
+        @JsonProperty("credential")
+        private Object credential;
+
+        public Object getCredential() {
+            return credential;
+        }
+
+        public Credential setCredential(Object credential) {
+            this.credential = credential;
+            return this;
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/DisplayObject.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/DisplayObject.java
index df51baf4ad6a..d55a91a07ec6 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/DisplayObject.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/DisplayObject.java
@@ -20,9 +20,16 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.StringUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
+import java.util.List;
 
 /**
  * Represents a DisplayObject, as used in the OID4VCI Credentials Issuer Metadata
@@ -38,6 +45,8 @@
 )
 public class DisplayObject {
 
+    private static final Logger LOGGER = LoggerFactory.getLogger(DisplayObject.class);
+
     @JsonIgnore
     private static final String NAME_KEY = "name";
     @JsonIgnore
@@ -69,6 +78,23 @@ public class DisplayObject {
     @JsonProperty(DisplayObject.TEXT_COLOR_KEY)
     private String textColor;
 
+    public static List<DisplayObject> parse(CredentialScopeModel credentialScope) {
+        String display = credentialScope.getVcDisplay();
+        if (StringUtil.isBlank(display)) {
+            return null;
+        }
+        TypeReference<List<DisplayObject>> typeReference = new TypeReference<>() {};
+        try {
+            return JsonSerialization.mapper.readValue(display, typeReference);
+        } catch (JsonProcessingException e) {
+            // lets say we have an invalid value we should not kill the whole execution if just the display value is
+            // broken
+            LOGGER.debug(e.getMessage(), e);
+            LOGGER.info(String.format("Failed to parse display-metadata for credential: %s", credentialScope.getName()),
+                        e.getMessage());
+            return null;
+        }
+    }
 
     public String getName() {
         return name;
@@ -165,4 +191,13 @@ public int hashCode() {
         result = 31 * result + (getTextColor() != null ? getTextColor().hashCode() : 0);
         return result;
     }
+
+    @Override
+    public String toString() {
+        try {
+            return JsonSerialization.mapper.writeValueAsString(this);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorResponse.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorResponse.java
index 5e336ac00fa8..f10e66d4f25e 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorResponse.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorResponse.java
@@ -33,12 +33,6 @@ public class ErrorResponse {
     @JsonProperty("error_description")
     private String errorDescription;
 
-    @JsonProperty("c_nonce")
-    private String cNonce;
-
-    @JsonProperty("c_nonce_expires_in")
-    private long cNonceExpiresIn;
-
     public ErrorType getError() {
         return error;
     }
@@ -56,22 +50,4 @@ public ErrorResponse setErrorDescription(String errorDescription) {
         this.errorDescription = errorDescription;
         return this;
     }
-
-    public String getcNonce() {
-        return cNonce;
-    }
-
-    public ErrorResponse setcNonce(String cNonce) {
-        this.cNonce = cNonce;
-        return this;
-    }
-
-    public long getcNonceExpiresIn() {
-        return cNonceExpiresIn;
-    }
-
-    public ErrorResponse setcNonceExpiresIn(long cNonceExpiresIn) {
-        this.cNonceExpiresIn = cNonceExpiresIn;
-        return this;
-    }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorType.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorType.java
index 5cb13c3644a9..5241df30711c 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorType.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ErrorType.java
@@ -33,7 +33,7 @@ public enum ErrorType {
     INVALID_PROOF("invalid_proof"),
     INVALID_ENCRYPTION_PARAMETER("invalid_encryption_parameters"),
     MISSING_CREDENTIAL_CONFIG("missing_credential_config"),
-    MISSING_CREDENTIAL_CONFIG_AND_FORMAT("missing_credential_config_format");
+    MISSING_CREDENTIAL_IDENTIFIER_AND_CONFIGURATION_ID("missing_credential_identifier_and_configuration_id");
 
     private final String value;
 
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtCNonce.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtCNonce.java
new file mode 100644
index 000000000000..e3b8af17529e
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtCNonce.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.model;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.keycloak.representations.JsonWebToken;
+
+/**
+ * @author Pascal Knüppel
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class JwtCNonce extends JsonWebToken {
+
+    /**
+     * cryptographically strong random string that serves as salt for the otherwise predictable c_nonce values
+     */
+    @JsonProperty("salt")
+    private String salt;
+
+    public String getSalt() {
+        return salt;
+    }
+
+    public JwtCNonce salt(String salt) {
+        this.salt = salt;
+        return this;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtProof.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtProof.java
new file mode 100644
index 000000000000..3f7435124690
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/JwtProof.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.model;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * JWT Proof for Credential Request in OID4VCI (Section 8.2.1.1).
+ * Represents a signed JWT for holder binding.
+ *
+ * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ * @see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request">OID4VCI Credential Request</a>
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class JwtProof implements Proof {
+
+    @JsonProperty("proof_type")
+    private final String proofType = ProofType.JWT;
+
+    @JsonProperty("jwt")
+    private String jwt;
+
+    public JwtProof() {
+    }
+
+    public JwtProof(String jwt) {
+        this.jwt = jwt;
+    }
+
+    @Override
+    public String getProofType() {
+        return proofType;
+    }
+
+    public String getJwt() {
+        return jwt;
+    }
+
+    public JwtProof setJwt(String jwt) {
+        this.jwt = jwt;
+        return this;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/LdpVpProof.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/LdpVpProof.java
new file mode 100644
index 000000000000..5f278f2522e5
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/LdpVpProof.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oid4vc.model;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * LDP-VP Proof for Credential Request in OID4VCI (Section 8.2.1.1).
+ * Represents a JSON-LD Verifiable Presentation for holder binding.
+ *
+ * @see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request">OID4VCI Credential Request</a>
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class LdpVpProof implements Proof {
+
+    @JsonProperty("proof_type")
+    private final String proofType = ProofType.LD_PROOF;
+
+    @JsonProperty("ldp_vp")
+    private Object ldpVp;
+
+    public LdpVpProof() {
+    }
+
+    public LdpVpProof(Object ldpVp) {
+        this.ldpVp = ldpVp;
+    }
+
+    @Override
+    public String getProofType() {
+        return proofType;
+    }
+
+    public Object getLdpVp() {
+        return ldpVp;
+    }
+
+    public LdpVpProof setLdpVp(Object ldpVp) {
+        this.ldpVp = ldpVp;
+        return this;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/NonceResponse.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/NonceResponse.java
new file mode 100644
index 000000000000..79e0670982df
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/NonceResponse.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oid4vc.model;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * NonceResponse as defined in
+ * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-nonce-response
+ *
+ * @author Pascal Knüppel
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class NonceResponse {
+
+    /**
+     * String containing a nonce to be used when creating a proof of possession of the key proof. This value MUST be
+     * unpredictable.
+     */
+    @JsonProperty("c_nonce")
+    private String nonce;
+
+    /**
+     * @see #nonce
+     */
+    public String getNonce() {
+        return nonce;
+    }
+
+    /**
+     * @see #nonce
+     */
+    public void setNonce(String nonce) {
+        this.nonce = nonce;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/OID4VCClient.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/OID4VCClient.java
deleted file mode 100644
index 996314ca5183..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/OID4VCClient.java
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.protocol.oid4vc.model;
-
-import java.util.Collections;
-import java.util.List;
-
-/**
- * Pojo, containing all information required to create a VCClient.
- *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
- */
-public class OID4VCClient {
-
-    /**
-     * Id of the client.
-     */
-    private String id;
-
-    /**
-     * Did of the target/client, will be used as client-id
-     */
-    private String clientDid;
-    /**
-     * Comma-separated list of supported credentials types
-     */
-    private List<SupportedCredentialConfiguration> supportedVCTypes;
-    /**
-     * Description of the client, will f.e. be displayed in the admin-console
-     */
-    private String description;
-    /**
-     * Human-readable name of the client
-     */
-    private String name;
-
-    public OID4VCClient() {
-    }
-
-    public OID4VCClient(String id, String clientDid, List<SupportedCredentialConfiguration> supportedVCTypes, String description, String name) {
-        this.id = id;
-        this.clientDid = clientDid;
-        this.supportedVCTypes = supportedVCTypes;
-        this.description = description;
-        this.name = name;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public OID4VCClient setId(String id) {
-        this.id = id;
-        return this;
-    }
-
-    public String getClientDid() {
-        return clientDid;
-    }
-
-    public OID4VCClient setClientDid(String clientDid) {
-        this.clientDid = clientDid;
-        return this;
-    }
-
-    public List<SupportedCredentialConfiguration> getSupportedVCTypes() {
-        return supportedVCTypes;
-    }
-
-    public OID4VCClient setSupportedVCTypes(List<SupportedCredentialConfiguration> supportedVCTypes) {
-        this.supportedVCTypes = Collections.unmodifiableList(supportedVCTypes);
-        return this;
-    }
-
-    public String getDescription() {
-        return description;
-    }
-
-    public OID4VCClient setDescription(String description) {
-        this.description = description;
-        return this;
-    }
-
-    public String getName() {
-        return name;
-    }
-
-    public OID4VCClient setName(String name) {
-        this.name = name;
-        return this;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (!(o instanceof OID4VCClient that)) return false;
-
-        if (getId() != null ? !getId().equals(that.getId()) : that.getId() != null) return false;
-        if (getClientDid() != null ? !getClientDid().equals(that.getClientDid()) : that.getClientDid() != null)
-            return false;
-        if (getSupportedVCTypes() != null ? !getSupportedVCTypes().equals(that.getSupportedVCTypes()) : that.getSupportedVCTypes() != null)
-            return false;
-        if (getDescription() != null ? !getDescription().equals(that.getDescription()) : that.getDescription() != null)
-            return false;
-        return getName() != null ? getName().equals(that.getName()) : that.getName() == null;
-    }
-
-    @Override
-    public int hashCode() {
-        int result = getId() != null ? getId().hashCode() : 0;
-        result = 31 * result + (getClientDid() != null ? getClientDid().hashCode() : 0);
-        result = 31 * result + (getSupportedVCTypes() != null ? getSupportedVCTypes().hashCode() : 0);
-        result = 31 * result + (getDescription() != null ? getDescription().hashCode() : 0);
-        result = 31 * result + (getName() != null ? getName().hashCode() : 0);
-        return result;
-    }
-}
\ No newline at end of file
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/PreAuthorizedCode.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/PreAuthorizedCode.java
index 13a9c88bb813..54b42b5dd719 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/PreAuthorizedCode.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/PreAuthorizedCode.java
@@ -37,9 +37,6 @@ public class PreAuthorizedCode {
     @JsonProperty("tx_code")
     private TxCode txCode;
 
-    @JsonProperty("interval")
-    private long interval;
-
     @JsonProperty("authorization_server")
     private String authorizationServer;
 
@@ -61,15 +58,6 @@ public PreAuthorizedCode setTxCode(TxCode txCode) {
         return this;
     }
 
-    public long getInterval() {
-        return interval;
-    }
-
-    public PreAuthorizedCode setInterval(long interval) {
-        this.interval = interval;
-        return this;
-    }
-
     public String getAuthorizationServer() {
         return authorizationServer;
     }
@@ -83,11 +71,11 @@ public PreAuthorizedCode setAuthorizationServer(String authorizationServer) {
     public boolean equals(Object o) {
         if (this == o) return true;
         if (!(o instanceof PreAuthorizedCode that)) return false;
-        return getInterval() == that.getInterval() && Objects.equals(getPreAuthorizedCode(), that.getPreAuthorizedCode()) && Objects.equals(getTxCode(), that.getTxCode()) && Objects.equals(getAuthorizationServer(), that.getAuthorizationServer());
+        return Objects.equals(getPreAuthorizedCode(), that.getPreAuthorizedCode()) && Objects.equals(getTxCode(), that.getTxCode()) && Objects.equals(getAuthorizationServer(), that.getAuthorizationServer());
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(getPreAuthorizedCode(), getTxCode(), getInterval(), getAuthorizationServer());
+        return Objects.hash(getPreAuthorizedCode(), getTxCode(), getAuthorizationServer());
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Proof.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Proof.java
index 93228c771ab8..8e72d41b64db 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/Proof.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/Proof.java
@@ -17,63 +17,14 @@
 
 package org.keycloak.protocol.oid4vc.model;
 
-import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 /**
- * Proof to be used in the Credential Request(to allow holder binding) according to OID4VCI
- * {@see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request}
+ * Interface for proof types in OID4VCI Credential Request (Section 8.2.1.1).
  *
- * @author <a href="https://github.com/wistefan">Stefan Wiedemann</a>
+ * @see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request">OID4VCI Credential Request</a>
  */
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class Proof {
-
+public interface Proof {
     @JsonProperty("proof_type")
-    private String proofType;
-
-    @JsonProperty("jwt")
-    private String jwt;
-
-    @JsonProperty("cwt")
-    private String cwt;
-
-    @JsonProperty("ldp_vp")
-    private Object ldpVp;
-
-    public String getProofType() {
-        return proofType;
-    }
-
-    public Proof setProofType(String proofType) {
-        this.proofType = proofType;
-        return this;
-    }
-
-    public String getJwt() {
-        return jwt;
-    }
-
-    public Proof setJwt(String jwt) {
-        this.jwt = jwt;
-        return this;
-    }
-
-    public String getCwt() {
-        return cwt;
-    }
-
-    public Proof setCwt(String cwt) {
-        this.cwt = cwt;
-        return this;
-    }
-
-    public Object getLdpVp() {
-        return ldpVp;
-    }
-
-    public Proof setLdpVp(Object ldpVp) {
-        this.ldpVp = ldpVp;
-        return this;
-    }
+    String getProofType();
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofType.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofType.java
index 792f20188de2..b38093b4ffff 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofType.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofType.java
@@ -27,6 +27,5 @@ public final class ProofType {
 
     public static final String JWT = "jwt";
     public static final String LD_PROOF = "ldp_vp";
-    public static final String CWT = "cwt";
 
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypeCWT.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypeCWT.java
deleted file mode 100644
index dd06b1a03ba3..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypeCWT.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.protocol.oid4vc.model;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Objects;
-
-/**
- * See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-cwt-proof-type
- *
- * @author <a href="mailto:francis.pouatcha@adorsys.com">Francis Pouatcha</a>
- */
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class ProofTypeCWT {
-
-    @JsonProperty("proof_signing_alg_values_supported")
-    private List<Integer> proofSigningAlgValuesSupported;
-
-    @JsonProperty("proof_alg_values_supported")
-    private List<Integer> proofAlgValuesSupported;
-
-    @JsonProperty("proof_crv_values_supported")
-    private List<Integer> proofCrvValuesSupported;
-
-    public List<Integer> getProofSigningAlgValuesSupported() {
-        return proofSigningAlgValuesSupported;
-    }
-
-    public ProofTypeCWT setProofSigningAlgValuesSupported(List<Integer> proofSigningAlgValuesSupported) {
-        this.proofSigningAlgValuesSupported = proofSigningAlgValuesSupported;
-        return this;
-    }
-
-    public List<Integer> getProofAlgValuesSupported() {
-        return proofAlgValuesSupported;
-    }
-
-    public ProofTypeCWT setProofAlgValuesSupported(List<Integer> proofAlgValuesSupported) {
-        this.proofAlgValuesSupported = proofAlgValuesSupported;
-        return this;
-    }
-
-    public List<Integer> getProofCrvValuesSupported() {
-        return proofCrvValuesSupported;
-    }
-
-    public ProofTypeCWT setProofCrvValuesSupported(List<Integer> proofCrvValuesSupported) {
-        this.proofCrvValuesSupported = proofCrvValuesSupported;
-        return this;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-        ProofTypeCWT that = (ProofTypeCWT) o;
-        return Objects.equals(proofSigningAlgValuesSupported, that.proofSigningAlgValuesSupported) && Objects.equals(proofAlgValuesSupported, that.proofAlgValuesSupported) && Objects.equals(proofCrvValuesSupported, that.proofCrvValuesSupported);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(proofSigningAlgValuesSupported, proofAlgValuesSupported, proofCrvValuesSupported);
-    }
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypesSupported.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypesSupported.java
index d232ff35ee25..95cdc058a892 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypesSupported.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/ProofTypesSupported.java
@@ -16,11 +16,19 @@
  */
 package org.keycloak.protocol.oid4vc.model;
 
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonAnySetter;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidator;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 
 /**
@@ -30,42 +38,42 @@
  */
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class ProofTypesSupported {
-    @JsonProperty("jwt")
-    private ProofTypeJWT jwt;
-    @JsonProperty("cwt")
-    private ProofTypeCWT cwt;
 
-    @JsonProperty("ldp_vp")
-    private ProofTypeLdpVp ldpVp;
+    protected Map<String, SupportedProofTypeData> supportedProofTypes = new HashMap<>();
 
-    public ProofTypeJWT getJwt() {
-        return jwt;
+    public static ProofTypesSupported parse(KeycloakSession keycloakSession,
+                                            List<String> globalSupportedSigningAlgorithms) {
+        ProofTypesSupported proofTypesSupported = new ProofTypesSupported();
+        keycloakSession.getAllProviders(ProofValidator.class).forEach(proofValidator -> {
+            String type = proofValidator.getProofType();
+            KeyAttestationRequired keyAttestationRequired = null; // TODO
+            SupportedProofTypeData supportedProofTypeData = new SupportedProofTypeData(globalSupportedSigningAlgorithms,
+                                                                                       keyAttestationRequired);
+            proofTypesSupported.getSupportedProofTypes().put(type, supportedProofTypeData);
+        });
+        return proofTypesSupported;
     }
 
-    public ProofTypesSupported setJwt(ProofTypeJWT jwt) {
-        this.jwt = jwt;
-        return this;
-    }
-
-    public ProofTypeCWT getCwt() {
-        return cwt;
-    }
-
-    public ProofTypesSupported setCwt(ProofTypeCWT cwt) {
-        this.cwt = cwt;
-        return this;
+    public static ProofTypesSupported fromJsonString(String jsonString) {
+        try {
+            return JsonSerialization.readValue(jsonString, ProofTypesSupported.class);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
     }
 
-    public ProofTypeLdpVp getLdpVp() {
-        return ldpVp;
+    @JsonAnyGetter
+    public Map<String, SupportedProofTypeData> getSupportedProofTypes() {
+        return supportedProofTypes;
     }
 
-    public ProofTypesSupported setLdpVp(ProofTypeLdpVp ldpVp) {
-        this.ldpVp = ldpVp;
+    @JsonAnySetter
+    public ProofTypesSupported setSupportedProofTypes(String name, SupportedProofTypeData value) {
+        supportedProofTypes.put(name, value);
         return this;
     }
 
-    public String toJsonString(){
+    public String toJsonString() {
         try {
             return JsonSerialization.writeValueAsString(this);
         } catch (IOException e) {
@@ -73,24 +81,122 @@ public String toJsonString(){
         }
     }
 
-    public static ProofTypesSupported fromJsonString(String jsonString){
-        try {
-            return JsonSerialization.readValue(jsonString, ProofTypesSupported.class);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
+    @Override
+    public final boolean equals(Object o) {
+        if (!(o instanceof ProofTypesSupported that)) {
+            return false;
         }
+        return Objects.equals(supportedProofTypes, that.supportedProofTypes);
     }
 
     @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-        ProofTypesSupported that = (ProofTypesSupported) o;
-        return Objects.equals(jwt, that.jwt) && Objects.equals(cwt, that.cwt) && Objects.equals(ldpVp, that.ldpVp);
+    public int hashCode() {
+        return Objects.hashCode(supportedProofTypes);
     }
 
-    @Override
-    public int hashCode() {
-        return Objects.hash(jwt, cwt, ldpVp);
+    public static class SupportedProofTypeData {
+
+        @JsonProperty("proof_signing_alg_values_supported")
+        private List<String> signingAlgorithmsSupported;
+
+        @JsonProperty("key_attestations_required")
+        private KeyAttestationRequired keyAttestationRequired;
+
+        public SupportedProofTypeData() {
+        }
+
+        public SupportedProofTypeData(List<String> signingAlgorithmsSupported,
+                                      KeyAttestationRequired keyAttestationRequired) {
+            this.signingAlgorithmsSupported = signingAlgorithmsSupported;
+            this.keyAttestationRequired = keyAttestationRequired;
+        }
+
+        public List<String> getSigningAlgorithmsSupported() {
+            return signingAlgorithmsSupported;
+        }
+
+        public SupportedProofTypeData setSigningAlgorithmsSupported(List<String> signingAlgorithmsSupported) {
+            this.signingAlgorithmsSupported = signingAlgorithmsSupported;
+            return this;
+        }
+
+        public KeyAttestationRequired getKeyAttestationRequired() {
+            return keyAttestationRequired;
+        }
+
+        public SupportedProofTypeData setKeyAttestationRequired(KeyAttestationRequired keyAttestationRequired) {
+            this.keyAttestationRequired = keyAttestationRequired;
+            return this;
+        }
+
+        @Override
+        public final boolean equals(Object o) {
+            if (!(o instanceof SupportedProofTypeData that)) {
+                return false;
+            }
+
+            return Objects.equals(signingAlgorithmsSupported,
+                                  that.signingAlgorithmsSupported) && Objects.equals(keyAttestationRequired,
+                                                                                     that.keyAttestationRequired);
+        }
+
+        @Override
+        public int hashCode() {
+            int result = Objects.hashCode(signingAlgorithmsSupported);
+            result = 31 * result + Objects.hashCode(keyAttestationRequired);
+            return result;
+        }
+    }
+
+    public static class KeyAttestationRequired {
+
+        @JsonProperty("key_storage")
+        private List<String> keyStorage = new ArrayList<>();
+
+        @JsonProperty("user_authentication")
+        private List<String> userAuthentication = new ArrayList<>();
+
+        public KeyAttestationRequired() {
+        }
+
+        public KeyAttestationRequired(List<String> keyStorage, List<String> userAuthentication) {
+            this.keyStorage = keyStorage;
+            this.userAuthentication = userAuthentication;
+        }
+
+        public List<String> getKeyStorage() {
+            return keyStorage;
+        }
+
+        public KeyAttestationRequired setKeyStorage(List<String> keyStorage) {
+            this.keyStorage = keyStorage;
+            return this;
+        }
+
+        public List<String> getUserAuthentication() {
+            return userAuthentication;
+        }
+
+        public KeyAttestationRequired setUserAuthentication(List<String> userAuthentication) {
+            this.userAuthentication = userAuthentication;
+            return this;
+        }
+
+        @Override
+        public final boolean equals(Object o) {
+            if (!(o instanceof KeyAttestationRequired that)) {
+                return false;
+            }
+
+            return Objects.equals(keyStorage, that.keyStorage) && Objects.equals(userAuthentication,
+                                                                                 that.userAuthentication);
+        }
+
+        @Override
+        public int hashCode() {
+            int result = Objects.hashCode(keyStorage);
+            result = 31 * result + Objects.hashCode(userAuthentication);
+            return result;
+        }
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredentialConfiguration.java b/services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredentialConfiguration.java
index 297d494a0a5f..2fe077a45986 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredentialConfiguration.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/model/SupportedCredentialConfiguration.java
@@ -19,15 +19,14 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import org.apache.commons.collections4.ListUtils;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.KeycloakSession;
 
-import java.util.Arrays;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.stream.Collectors;
 
 /**
  * A supported credential, as used in the Credentials Issuer Metadata in OID4VCI
@@ -45,8 +44,6 @@ public class SupportedCredentialConfiguration {
     @JsonIgnore
     private static final String CRYPTOGRAPHIC_BINDING_METHODS_SUPPORTED_KEY = "cryptographic_binding_methods_supported";
     @JsonIgnore
-    private static final String CRYPTOGRAPHIC_SUITES_SUPPORTED_KEY = "cryptographic_suites_supported";
-    @JsonIgnore
     private static final String CREDENTIAL_SIGNING_ALG_VALUES_SUPPORTED_KEY = "credential_signing_alg_values_supported";
     @JsonIgnore
     private static final String DISPLAY_KEY = "display";
@@ -72,9 +69,6 @@ public class SupportedCredentialConfiguration {
     @JsonProperty(CRYPTOGRAPHIC_BINDING_METHODS_SUPPORTED_KEY)
     private List<String> cryptographicBindingMethodsSupported;
 
-    @JsonProperty(CRYPTOGRAPHIC_SUITES_SUPPORTED_KEY)
-    private List<String> cryptographicSuitesSupported;
-
     @JsonProperty(CREDENTIAL_SIGNING_ALG_VALUES_SUPPORTED_KEY)
     private List<String> credentialSigningAlgValuesSupported;
 
@@ -98,20 +92,69 @@ public class SupportedCredentialConfiguration {
     @JsonIgnore
     private CredentialBuildConfig credentialBuildConfig;
 
-    public String getFormat() {
-        return format;
+    /**
+     * @param credentialScope                  The scope that holds the credentials configuration
+     * @param globalSupportedSigningAlgorithms added as a parameter to avoid reading the global config from the session
+     *                                         for each credential
+     * @return the credentials configuration that was entered into the ClientScope
+     */
+    public static SupportedCredentialConfiguration parse(KeycloakSession keycloakSession,
+                                                         CredentialScopeModel credentialScope,
+                                                         List<String> globalSupportedSigningAlgorithms) {
+        SupportedCredentialConfiguration credentialConfiguration = new SupportedCredentialConfiguration();
+
+        String credentialConfigurationId = Optional.ofNullable(credentialScope.getCredentialConfigurationId())
+                                                   .orElse(credentialScope.getName());
+        credentialConfiguration.setId(credentialConfigurationId);
+
+        credentialConfiguration.setScope(credentialScope.getName());
+
+        String format = Optional.ofNullable(credentialScope.getFormat()).orElse(Format.SD_JWT_VC);
+        credentialConfiguration.setFormat(format);
+
+        String vct = Optional.ofNullable(credentialScope.getVct()).orElse(credentialScope.getName());
+        credentialConfiguration.setVct(vct);
+
+        CredentialDefinition credentialDefinition = CredentialDefinition.parse(credentialScope);
+        credentialConfiguration.setCredentialDefinition(credentialDefinition);
+
+         ProofTypesSupported proofTypesSupported = ProofTypesSupported.parse(keycloakSession,
+                                                                             globalSupportedSigningAlgorithms);
+         credentialConfiguration.setProofTypesSupported(proofTypesSupported);
+
+        List<String> signingAlgsSupported = credentialScope.getSigningAlgsSupported();
+        signingAlgsSupported = signingAlgsSupported.isEmpty() ? globalSupportedSigningAlgorithms :
+                // if the config has listed different algorithms than supported by keycloak we must use the
+                // intersection of the configuration with the actual supported algorithms.
+                ListUtils.intersection(signingAlgsSupported, globalSupportedSigningAlgorithms);
+        credentialConfiguration.setCredentialSigningAlgValuesSupported(signingAlgsSupported);
+
+        // TODO resolve value dynamically from provider implementations?
+        String bindingMethodsSupported = CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT;
+        credentialConfiguration.setCryptographicBindingMethodsSupported(List.of(bindingMethodsSupported));
+
+        credentialConfiguration.setDisplay(DisplayObject.parse(credentialScope));
+
+        CredentialBuildConfig credentialBuildConfig = CredentialBuildConfig.parse(keycloakSession,
+                                                                                  credentialConfiguration,
+                                                                                  credentialScope);
+        credentialConfiguration.setCredentialBuildConfig(credentialBuildConfig);
+
+        Claims claims = Claims.parse(keycloakSession, credentialScope);
+        credentialConfiguration.setClaims(claims);
+
+        return credentialConfiguration;
     }
 
     /**
-     * Return the verifiable credential type. Sort of confusing in the specification.
-     * For sdjwt, we have a "vct" claim.
-     *   See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-6
-     *
-     * For iso mdl (not yet supported) we have a "doctype"
-     *   See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-5
-     *
-     * For jwt_vc and ldp_vc, we will be inferring from the "credential_definition"
-     *   See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-3
+     * Return the verifiable credential type. Sort of confusing in the specification. For sdjwt, we have a "vct" claim.
+     * See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-6
+     * <p>
+     * For iso mdl (not yet supported) we have a "doctype" See:
+     * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-5
+     * <p>
+     * For jwt_vc and ldp_vc, we will be inferring from the "credential_definition" See:
+     * https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-credential-request-3
      *
      * @return
      */
@@ -126,6 +169,10 @@ public CredentialConfigId deriveConfiId() {
         return CredentialConfigId.from(id);
     }
 
+    public String getFormat() {
+        return format;
+    }
+
     public SupportedCredentialConfiguration setFormat(String format) {
         this.format = format;
         return this;
@@ -149,15 +196,6 @@ public SupportedCredentialConfiguration setCryptographicBindingMethodsSupported(
         return this;
     }
 
-    public List<String> getCryptographicSuitesSupported() {
-        return cryptographicSuitesSupported;
-    }
-
-    public SupportedCredentialConfiguration setCryptographicSuitesSupported(List<String> cryptographicSuitesSupported) {
-        this.cryptographicSuitesSupported = Collections.unmodifiableList(cryptographicSuitesSupported);
-        return this;
-    }
-
     public List<DisplayObject> getDisplay() {
         return display;
     }
@@ -172,9 +210,6 @@ public String getId() {
     }
 
     public SupportedCredentialConfiguration setId(String id) {
-        if (id.contains(".")) {
-            throw new IllegalArgumentException("dots are not supported as part of the supported credentials id.");
-        }
         this.id = id;
         return this;
     }
@@ -233,90 +268,16 @@ public SupportedCredentialConfiguration setCredentialBuildConfig(CredentialBuild
         return this;
     }
 
-    public Map<String, String> toDotNotation() {
-        Map<String, String> dotNotation = new HashMap<>();
-        Optional.ofNullable(format).ifPresent(format -> dotNotation.put(id + DOT_SEPARATOR + FORMAT_KEY, format));
-        Optional.ofNullable(vct).ifPresent(vct -> dotNotation.put(id + DOT_SEPARATOR + VERIFIABLE_CREDENTIAL_TYPE_KEY, vct));
-        Optional.ofNullable(scope).ifPresent(scope -> dotNotation.put(id + DOT_SEPARATOR + SCOPE_KEY, scope));
-        Optional.ofNullable(cryptographicBindingMethodsSupported).ifPresent(types ->
-                dotNotation.put(id + DOT_SEPARATOR + CRYPTOGRAPHIC_BINDING_METHODS_SUPPORTED_KEY, String.join(",", cryptographicBindingMethodsSupported)));
-        Optional.ofNullable(cryptographicSuitesSupported).ifPresent(types ->
-                dotNotation.put(id + DOT_SEPARATOR + CRYPTOGRAPHIC_SUITES_SUPPORTED_KEY, String.join(",", cryptographicSuitesSupported)));
-        Optional.ofNullable(cryptographicSuitesSupported).ifPresent(types ->
-                dotNotation.put(id + DOT_SEPARATOR + CREDENTIAL_SIGNING_ALG_VALUES_SUPPORTED_KEY, String.join(",", credentialSigningAlgValuesSupported)));
-        Optional.ofNullable(claims).ifPresent(c -> dotNotation.put(id + DOT_SEPARATOR + CLAIMS_KEY, c.toJsonString()));
-        Optional.ofNullable(credentialDefinition).ifPresent(cdef -> dotNotation.put(id + DOT_SEPARATOR + CREDENTIAL_DEFINITION_KEY, cdef.toJsonString()));
-
-        Optional.ofNullable(display)
-                .ifPresent(d -> d.stream()
-                        .filter(Objects::nonNull)
-                        .forEach(o -> dotNotation.put(id + DOT_SEPARATOR + DISPLAY_KEY + DOT_SEPARATOR + d.indexOf(o), o.toJsonString())));
-
-        Optional.ofNullable(proofTypesSupported)
-                .ifPresent(p -> dotNotation.put(id + DOT_SEPARATOR + PROOF_TYPES_SUPPORTED_KEY, p.toJsonString()));
-
-        Optional.ofNullable(credentialBuildConfig)
-                .ifPresent(p -> dotNotation.putAll(credentialBuildConfig.toDotNotation()));
-
-        return dotNotation;
-    }
-
-    public static SupportedCredentialConfiguration fromDotNotation(String credentialId, Map<String, String> dotNotated) {
-
-        SupportedCredentialConfiguration supportedCredentialConfiguration = new SupportedCredentialConfiguration().setId(credentialId);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + FORMAT_KEY)).ifPresent(supportedCredentialConfiguration::setFormat);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + VERIFIABLE_CREDENTIAL_TYPE_KEY)).ifPresent(supportedCredentialConfiguration::setVct);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + SCOPE_KEY)).ifPresent(supportedCredentialConfiguration::setScope);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + CRYPTOGRAPHIC_BINDING_METHODS_SUPPORTED_KEY))
-                .map(cbms -> cbms.split(","))
-                .map(Arrays::asList)
-                .ifPresent(supportedCredentialConfiguration::setCryptographicBindingMethodsSupported);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + CRYPTOGRAPHIC_SUITES_SUPPORTED_KEY))
-                .map(css -> css.split(","))
-                .map(Arrays::asList)
-                .ifPresent(supportedCredentialConfiguration::setCryptographicSuitesSupported);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + CREDENTIAL_SIGNING_ALG_VALUES_SUPPORTED_KEY))
-                .map(css -> css.split(","))
-                .map(Arrays::asList)
-                .ifPresent(supportedCredentialConfiguration::setCredentialSigningAlgValuesSupported);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + CLAIMS_KEY))
-                .map(Claims::fromJsonString)
-                .ifPresent(supportedCredentialConfiguration::setClaims);
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + CREDENTIAL_DEFINITION_KEY))
-                .map(CredentialDefinition::fromJsonString)
-                .ifPresent(supportedCredentialConfiguration::setCredentialDefinition);
-
-        String displayKeyPrefix = credentialId + DOT_SEPARATOR + DISPLAY_KEY + DOT_SEPARATOR;
-        List<DisplayObject> displayList = dotNotated.entrySet().stream()
-                .filter(entry -> entry.getKey().startsWith(displayKeyPrefix))
-                .sorted(Map.Entry.comparingByKey())
-                .map(entry -> DisplayObject.fromJsonString(entry.getValue()))
-                .collect(Collectors.toList());
-
-        if (!displayList.isEmpty()){
-            supportedCredentialConfiguration.setDisplay(displayList);
-        }
-
-        Optional.ofNullable(dotNotated.get(credentialId + DOT_SEPARATOR + PROOF_TYPES_SUPPORTED_KEY))
-                .map(ProofTypesSupported::fromJsonString)
-                .ifPresent(supportedCredentialConfiguration::setProofTypesSupported);
-
-        Optional.ofNullable(CredentialBuildConfig.fromDotNotation(credentialId, dotNotated))
-                .ifPresent(supportedCredentialConfiguration::setCredentialBuildConfig);
-
-        return supportedCredentialConfiguration;
-    }
-
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || getClass() != o.getClass()) return false;
         SupportedCredentialConfiguration that = (SupportedCredentialConfiguration) o;
-        return Objects.equals(id, that.id) && Objects.equals(format, that.format) && Objects.equals(scope, that.scope) && Objects.equals(cryptographicBindingMethodsSupported, that.cryptographicBindingMethodsSupported) && Objects.equals(cryptographicSuitesSupported, that.cryptographicSuitesSupported) && Objects.equals(credentialSigningAlgValuesSupported, that.credentialSigningAlgValuesSupported) && Objects.equals(display, that.display) && Objects.equals(vct, that.vct) && Objects.equals(credentialDefinition, that.credentialDefinition) && Objects.equals(proofTypesSupported, that.proofTypesSupported) && Objects.equals(claims, that.claims) && Objects.equals(credentialBuildConfig, that.credentialBuildConfig);
+        return Objects.equals(id, that.id) && Objects.equals(format, that.format) && Objects.equals(scope, that.scope) && Objects.equals(cryptographicBindingMethodsSupported, that.cryptographicBindingMethodsSupported) && Objects.equals(credentialSigningAlgValuesSupported, that.credentialSigningAlgValuesSupported) && Objects.equals(display, that.display) && Objects.equals(vct, that.vct) && Objects.equals(credentialDefinition, that.credentialDefinition) && Objects.equals(proofTypesSupported, that.proofTypesSupported) && Objects.equals(claims, that.claims) && Objects.equals(credentialBuildConfig, that.credentialBuildConfig);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(id, format, scope, cryptographicBindingMethodsSupported, cryptographicSuitesSupported, credentialSigningAlgValuesSupported, display, vct, credentialDefinition, proofTypesSupported, claims, credentialBuildConfig);
+        return Objects.hash(id, format, scope, cryptographicBindingMethodsSupported, credentialSigningAlgValuesSupported, display, vct, credentialDefinition, proofTypesSupported, claims, credentialBuildConfig);
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java
index 05da2818211e..4fa7be26b03e 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java
@@ -40,6 +40,7 @@
 import org.keycloak.representations.AccessToken;
 import org.keycloak.services.Urls;
 import org.keycloak.services.util.DefaultClientSessionContext;
+import org.keycloak.services.util.UserSessionUtil;
 import org.keycloak.tracing.TracingAttributes;
 import org.keycloak.tracing.TracingProvider;
 import org.keycloak.util.JsonSerialization;
@@ -50,12 +51,19 @@
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class AccessTokenIntrospectionProvider implements TokenIntrospectionProvider {
+public class AccessTokenIntrospectionProvider<T extends AccessToken> implements TokenIntrospectionProvider {
 
-    private final KeycloakSession session;
-    private final TokenManager tokenManager;
-    private final RealmModel realm;
+    protected final KeycloakSession session;
+    protected final TokenManager tokenManager;
+    protected final RealmModel realm;
     private static final Logger logger = Logger.getLogger(AccessTokenIntrospectionProvider.class);
+    protected EventBuilder eventBuilder;
+
+    // Those are set after successfully verified
+    protected T token;
+    protected ClientModel client;
+    protected UserSessionModel userSession;
+    protected UserModel user;
 
     public AccessTokenIntrospectionProvider(KeycloakSession session) {
         this.session = session;
@@ -64,17 +72,15 @@ public AccessTokenIntrospectionProvider(KeycloakSession session) {
     }
 
     @Override
-    public Response introspect(String token, EventBuilder eventBuilder) {
+    public Response introspect(String tokenStr, EventBuilder eventBuilder) {
+        this.eventBuilder = eventBuilder;
         AccessToken accessToken = null;
         try {
-            accessToken = verifyAccessToken(token, eventBuilder, false);
-            UserSessionModel userSession = tokenManager.getValidUserSessionIfTokenIsValid(session, realm, accessToken, eventBuilder);
-
-            ClientModel client = session.getContext().getClient();
+            ClientModel authenticatedClient = session.getContext().getClient();
 
             ObjectNode tokenMetadata;
-            if (userSession != null) {
-                accessToken = transformAccessToken(accessToken, userSession);
+            if (introspectionChecks(tokenStr)) {
+                accessToken = transformAccessToken(this.token, userSession);
 
                 tokenMetadata = JsonSerialization.createObjectNode(accessToken);
                 tokenMetadata.put("client_id", accessToken.getIssuedFor());
@@ -91,6 +97,7 @@ public Response introspect(String token, EventBuilder eventBuilder) {
                         UserModel userModel = userSession.getUser();
                         if (userModel != null) {
                             tokenMetadata.put("username", userModel.getUsername());
+                            eventBuilder.user(userModel);
                         }
                     }
                 }
@@ -102,19 +109,18 @@ public Response introspect(String token, EventBuilder eventBuilder) {
                 }
 
                 tokenMetadata.put(OAuth2Constants.TOKEN_TYPE, accessToken.getType());
-
+                tokenMetadata.put("active", true);
+                eventBuilder.success();
             } else {
                 tokenMetadata = JsonSerialization.createObjectNode();
                 logger.debug("Keycloak token introspection return false");
-                eventBuilder.error(Errors.TOKEN_INTROSPECTION_FAILED);
+                tokenMetadata.put("active", false);
             }
 
-            tokenMetadata.put("active", userSession != null);
-
             // if consumer requests application/jwt return a JWT representation of the introspection contents in an jwt field
             if (accessToken != null) {
                 boolean isJwtRequest = org.keycloak.utils.MediaType.APPLICATION_JWT.equals(session.getContext().getRequestHeaders().getHeaderString(HttpHeaders.ACCEPT));
-                if (isJwtRequest && Boolean.parseBoolean(client.getAttribute(Constants.SUPPORT_JWT_CLAIM_IN_INTROSPECTION_RESPONSE_ENABLED))) {
+                if (isJwtRequest && Boolean.parseBoolean(authenticatedClient.getAttribute(Constants.SUPPORT_JWT_CLAIM_IN_INTROSPECTION_RESPONSE_ENABLED))) {
                     // consumers can use this to convert an opaque token into an JWT based token
                     tokenMetadata.put("jwt", session.tokens().encode(accessToken));
                 }
@@ -165,37 +171,123 @@ private AccessToken getAccessTokenFromStoredData(AccessToken token) {
         return newToken;
     }
 
-    protected AccessToken verifyAccessToken(String token, EventBuilder eventBuilder, boolean validateSession) {
+    /**
+     * Performs introspection checks related to token, client, userSession, user etc. If some of the checks failed, this method is supposed to already set an error event.
+     * If all the checks are successful, the instance variables are supposed to be set
+     *
+     * @return true just if all the checks are working
+     */
+    protected boolean introspectionChecks(String tokenStr) {
+        if (!verifyToken(tokenStr)) {
+            return false;
+        }
+        if (!verifyClient()) {
+            return false;
+        }
+
+        eventBuilder.session(this.token.getSessionId());
+        UserSessionUtil.UserSessionValidationResult result = verifyUserSession();
+        if (result.getError() != null) {
+            logger.debugf( "Introspection access token for " + token.getIssuedFor() + " client: " + result.getError());
+            eventBuilder.detail(Details.REASON,  "Introspection access token for " + token.getIssuedFor() + " client: " + result.getError());
+            eventBuilder.error(result.getError());
+            return false;
+        } else {
+            this.userSession = result.getUserSession();
+        }
 
+        this.user = userSession.getUser();
+        eventBuilder.user(user);
+        if (!TokenManager.isUserValid(session, realm, token, userSession.getUser())) {
+            logger.debugf("Could not find valid user from user session " + userSession.getId());
+            eventBuilder.detail(Details.REASON, "Could not find valid user from user session " + userSession.getId());
+            eventBuilder.error(user == null ? Errors.USER_NOT_FOUND : Errors.USER_DISABLED);
+            return false;
+        }
+
+        if (!verifyTokenReuse()) {
+            return false;
+        }
+
+        return true;
+    }
+
+    protected boolean verifyToken(String tokenStr) {
         try {
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(token, AccessToken.class)
+            TokenVerifier<T> verifier = TokenVerifier.create(tokenStr, getTokenClass())
                     .realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
 
             SignatureVerifierContext verifierContext = session.getProvider(SignatureProvider.class, verifier.getHeader().getAlgorithm().name()).verifier(verifier.getHeader().getKeyId());
             verifier.verifierContext(verifierContext);
 
-            AccessToken accessToken = verifier.verify().getToken();
+            this.token = verifier.verify().getToken();
+            eventBuilder.detail(Details.TOKEN_ID, token.getId());
+            eventBuilder.detail(Details.TOKEN_TYPE, token.getType());
 
             var tracing = session.getProvider(TracingProvider.class);
             var span = tracing.getCurrentSpan();
             if (span.isRecording()) {
-                span.setAttribute(TracingAttributes.TOKEN_ISSUER, accessToken.getIssuer());
-                span.setAttribute(TracingAttributes.TOKEN_SID, accessToken.getSessionId());
-                span.setAttribute(TracingAttributes.TOKEN_ID, accessToken.getId());
-            }
-
-            if (validateSession) {
-                return tokenManager.checkTokenValidForIntrospection(session, realm, verifier.verify().getToken(), eventBuilder);
+                span.setAttribute(TracingAttributes.TOKEN_ISSUER, token.getIssuer());
+                span.setAttribute(TracingAttributes.TOKEN_SID, token.getSessionId());
+                span.setAttribute(TracingAttributes.TOKEN_ID, token.getId());
             }
 
-            return accessToken;
+            return true;
         } catch (VerificationException e) {
             logger.debugf("Introspection access token : JWT check failed: %s", e.getMessage());
             eventBuilder.detail(Details.REASON,"Access token JWT check failed");
-            return null;
+            eventBuilder.error(Errors.INVALID_TOKEN);
+            return false;
         }
     }
 
+
+    protected Class<T> getTokenClass() {
+        return (Class<T>) AccessToken.class;
+    }
+
+    protected boolean verifyClient() {
+        eventBuilder.detail(Details.TOKEN_ISSUED_FOR, token.getIssuedFor());
+        ClientModel client = realm.getClientByClientId(token.getIssuedFor());
+        if (client == null) {
+            logger.debugf("Introspection access token : client with clientId %s does not exist", token.getIssuedFor() );
+            eventBuilder.detail(Details.REASON, String.format("Could not find client for %s", token.getIssuedFor()));
+            eventBuilder.error(Errors.CLIENT_NOT_FOUND);
+            return false;
+        } else {
+            if (!client.isEnabled()) {
+                logger.debugf("Introspection access token : client with clientId %s is disabled", token.getIssuedFor() );
+                eventBuilder.detail(Details.REASON, String.format("Client with clientId %s is disabled", token.getIssuedFor()));
+                eventBuilder.error(Errors.CLIENT_DISABLED);
+                return false;
+            } else {
+
+                try {
+                    TokenVerifier.createWithoutSignature(token)
+                            .withChecks(TokenManager.NotBeforeCheck.forModel(client), TokenVerifier.IS_ACTIVE, new TokenManager.TokenRevocationCheck(session))
+                            .verify();
+                    this.client = client;
+                    return true;
+                } catch (VerificationException e) {
+                    logger.debugf("Introspection access token for %s client: JWT check failed: %s", token.getIssuedFor(), e.getMessage());
+                    eventBuilder.detail(Details.REASON, "Introspection access token for " + token.getIssuedFor() +" client: JWT check failed");
+                    eventBuilder.error(Errors.INVALID_TOKEN);
+                    return false;
+                }
+            }
+        }
+    }
+
+
+    protected UserSessionUtil.UserSessionValidationResult verifyUserSession() {
+        return UserSessionUtil.findValidSessionForAccessToken(session, realm, token, client, (invalidUserSession -> {}));
+    }
+
+
+    protected boolean verifyTokenReuse() {
+        return true;
+    }
+
     @Override
     public void close() {
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProvider.java
deleted file mode 100644
index 0de5c8d792e0..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProvider.java
+++ /dev/null
@@ -1,741 +0,0 @@
-/*
- *  Copyright 2021 Red Hat, Inc. and/or its affiliates
- *  and other contributors as indicated by the @author tags.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-package org.keycloak.protocol.oidc;
-
-import org.jboss.logging.Logger;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.OAuthErrorException;
-import org.keycloak.broker.provider.BrokeredIdentityContext;
-import org.keycloak.broker.provider.ExchangeExternalToken;
-import org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken;
-import org.keycloak.broker.provider.IdentityBrokerException;
-import org.keycloak.broker.provider.IdentityProvider;
-import org.keycloak.broker.provider.IdentityProviderMapper;
-import org.keycloak.broker.provider.IdentityProviderMapperSyncModeDelegate;
-import org.keycloak.common.ClientConnection;
-import org.keycloak.common.Profile;
-import org.keycloak.common.constants.ServiceAccountConstants;
-import org.keycloak.common.util.Base64Url;
-import org.keycloak.events.Details;
-import org.keycloak.events.Errors;
-import org.keycloak.events.EventBuilder;
-import org.keycloak.events.EventType;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientSessionContext;
-import org.keycloak.models.FederatedIdentityModel;
-import org.keycloak.models.IdentityProviderMapperModel;
-import org.keycloak.models.IdentityProviderModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.light.LightweightUserAdapter;
-import org.keycloak.protocol.LoginProtocol;
-import org.keycloak.protocol.LoginProtocolFactory;
-import org.keycloak.protocol.oidc.endpoints.TokenEndpoint.TokenExchangeSamlProtocol;
-import org.keycloak.protocol.saml.SamlClient;
-import org.keycloak.protocol.saml.SamlProtocol;
-import org.keycloak.protocol.saml.SamlService;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.JsonWebToken;
-import org.keycloak.saml.common.constants.GeneralConstants;
-import org.keycloak.services.CorsErrorResponseException;
-import org.keycloak.services.Urls;
-import org.keycloak.services.cors.Cors;
-import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.services.managers.AuthenticationSessionManager;
-import org.keycloak.services.managers.BruteForceProtector;
-import org.keycloak.services.managers.UserSessionManager;
-import org.keycloak.services.resources.IdentityBrokerService;
-import org.keycloak.services.resources.admin.AdminAuth;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
-import org.keycloak.services.validation.Validation;
-import org.keycloak.sessions.AuthenticationSessionModel;
-import org.keycloak.sessions.RootAuthenticationSessionModel;
-import org.keycloak.util.TokenUtil;
-
-import static org.keycloak.authentication.authenticators.util.AuthenticatorUtils.getDisabledByBruteForceEventError;
-import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_CLIENT;
-import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_ID;
-import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_USERNAME;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.MultivaluedMap;
-import jakarta.ws.rs.core.Response;
-
-/**
- * Default token exchange implementation
- *
- * @author <a href="mailto:dmitryt@backbase.com">Dmitry Telegin</a>
- */
-public class DefaultTokenExchangeProvider implements TokenExchangeProvider {
-
-    private static final Logger logger = Logger.getLogger(DefaultTokenExchangeProvider.class);
-
-    private TokenExchangeContext.Params params;
-    private MultivaluedMap<String, String> formParams;
-    private KeycloakSession session;
-    private Cors cors;
-    private RealmModel realm;
-    private ClientModel client;
-    private EventBuilder event;
-    private ClientConnection clientConnection;
-    private HttpHeaders headers;
-    private TokenManager tokenManager;
-    private Map<String, String> clientAuthAttributes;
-
-    @Override
-    public boolean supports(TokenExchangeContext context) {
-        return true;
-    }
-
-    @Override
-    public Response exchange(TokenExchangeContext context) {
-        this.params = context.getParams();
-        this.formParams = context.getFormParams();
-        this.session = context.getSession();
-        this.cors = context.getCors();
-        this.realm = context.getRealm();
-        this.client = context.getClient();
-        this.event = context.getEvent();
-        this.clientConnection = context.getClientConnection();
-        this.headers = context.getHeaders();
-        this.tokenManager = (TokenManager)context.getTokenManager();
-        this.clientAuthAttributes = context.getClientAuthAttributes();
-        return tokenExchange();
-    }
-
-    @Override
-    public void close() {
-    }
-
-    protected Response tokenExchange() {
-
-        UserModel tokenUser = null;
-        UserSessionModel tokenSession = null;
-        AccessToken token = null;
-
-        String subjectToken = formParams.getFirst(OAuth2Constants.SUBJECT_TOKEN);
-        if (subjectToken != null) {
-            String subjectTokenType = formParams.getFirst(OAuth2Constants.SUBJECT_TOKEN_TYPE);
-            String realmIssuerUrl = Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName());
-            String subjectIssuer = formParams.getFirst(OAuth2Constants.SUBJECT_ISSUER);
-
-            if (subjectIssuer == null && OAuth2Constants.JWT_TOKEN_TYPE.equals(subjectTokenType)) {
-                try {
-                    JWSInput jws = new JWSInput(subjectToken);
-                    JsonWebToken jwt = jws.readJsonContent(JsonWebToken.class);
-                    subjectIssuer = jwt.getIssuer();
-                } catch (JWSInputException e) {
-                    event.detail(Details.REASON, "unable to parse jwt subject_token");
-                    event.error(Errors.INVALID_TOKEN);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token type, must be access token", Response.Status.BAD_REQUEST);
-
-                }
-            }
-
-            if (subjectIssuer != null && !realmIssuerUrl.equals(subjectIssuer)) {
-                event.detail(OAuth2Constants.SUBJECT_ISSUER, subjectIssuer);
-                return exchangeExternalToken(subjectIssuer, subjectToken);
-
-            }
-
-            if (subjectTokenType != null && !subjectTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE)) {
-                event.detail(Details.REASON, "subject_token supports access tokens only");
-                event.error(Errors.INVALID_TOKEN);
-                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token type, must be access token", Response.Status.BAD_REQUEST);
-
-            }
-
-            AuthenticationManager.AuthResult authResult = AuthenticationManager.verifyIdentityToken(session, realm, session.getContext().getUri(), clientConnection, true, true, null, false, subjectToken, headers);
-            if (authResult == null) {
-                event.detail(Details.REASON, "subject_token validation failure");
-                event.error(Errors.INVALID_TOKEN);
-                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token", Response.Status.BAD_REQUEST);
-            }
-
-            tokenUser = authResult.getUser();
-            tokenSession = authResult.getSession();
-            token = authResult.getToken();
-        }
-
-        String requestedSubject = formParams.getFirst(OAuth2Constants.REQUESTED_SUBJECT);
-        boolean disallowOnHolderOfTokenMismatch = true;
-
-        if (requestedSubject != null) {
-            event.detail(Details.REQUESTED_SUBJECT, requestedSubject);
-            UserModel requestedUser = session.users().getUserByUsername(realm, requestedSubject);
-            if (requestedUser == null) {
-                requestedUser = session.users().getUserById(realm, requestedSubject);
-            }
-
-            if (requestedUser == null) {
-                // We always returned access denied to avoid username fishing
-                event.detail(Details.REASON, "requested_subject not found");
-                event.error(Errors.NOT_ALLOWED);
-                throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-
-            }
-
-            if (token != null) {
-                event.detail(Details.IMPERSONATOR, tokenUser.getUsername());
-                // for this case, the user represented by the token, must have permission to impersonate.
-                AdminAuth auth = new AdminAuth(realm, token, tokenUser, client);
-                if (!AdminPermissions.evaluator(session, realm, auth).users().canImpersonate(requestedUser, client)) {
-                    event.detail(Details.REASON, "subject not allowed to impersonate");
-                    event.error(Errors.NOT_ALLOWED);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-                }
-            } else {
-                // no token is being exchanged, this is a direct exchange.  Client must be authenticated, not public, and must be allowed
-                // to impersonate
-                if (client.isPublicClient()) {
-                    event.detail(Details.REASON, "public clients not allowed");
-                    event.error(Errors.NOT_ALLOWED);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-
-                }
-                if (!AdminPermissions.management(session, realm).users().canClientImpersonate(client, requestedUser)) {
-                    event.detail(Details.REASON, "client not allowed to impersonate");
-                    event.error(Errors.NOT_ALLOWED);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-                }
-
-                // see https://issues.redhat.com/browse/KEYCLOAK-5492
-                disallowOnHolderOfTokenMismatch = false;
-            }
-
-            tokenSession = new UserSessionManager(session).createUserSession(realm, requestedUser, requestedUser.getUsername(), clientConnection.getRemoteAddr(), "impersonate", false, null, null);
-            if (tokenUser != null) {
-                tokenSession.setNote(IMPERSONATOR_ID.toString(), tokenUser.getId());
-                tokenSession.setNote(IMPERSONATOR_USERNAME.toString(), tokenUser.getUsername());
-            }
-
-            tokenUser = requestedUser;
-        }
-
-        String requestedIssuer = formParams.getFirst(OAuth2Constants.REQUESTED_ISSUER);
-        if (requestedIssuer == null) {
-            return exchangeClientToClient(tokenUser, tokenSession, token, disallowOnHolderOfTokenMismatch);
-        } else {
-            try {
-                return exchangeToIdentityProvider(tokenUser, tokenSession, requestedIssuer);
-            } finally {
-                if (subjectToken == null) { // we are naked! So need to clean up user session
-                    try {
-                        session.sessions().removeUserSession(realm, tokenSession);
-                    } catch (Exception ignore) {
-
-                    }
-                }
-            }
-         }
-    }
-
-    protected Response exchangeToIdentityProvider(UserModel targetUser, UserSessionModel targetUserSession, String requestedIssuer) {
-        event.detail(Details.REQUESTED_ISSUER, requestedIssuer);
-        IdentityProviderModel providerModel = session.identityProviders().getByAlias(requestedIssuer);
-        if (providerModel == null) {
-            event.detail(Details.REASON, "unknown requested_issuer");
-            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid issuer", Response.Status.BAD_REQUEST);
-        }
-
-        IdentityProvider<?> provider = IdentityBrokerService.getIdentityProvider(session, requestedIssuer);
-        if (!(provider instanceof ExchangeTokenToIdentityProviderToken)) {
-            event.detail(Details.REASON, "exchange unsupported by requested_issuer");
-            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Issuer does not support token exchange", Response.Status.BAD_REQUEST);
-        }
-        if (!AdminPermissions.management(session, realm).idps().canExchangeTo(client, providerModel)) {
-            event.detail(Details.REASON, "client not allowed to exchange for requested_issuer");
-            event.error(Errors.NOT_ALLOWED);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-        }
-        Response response = ((ExchangeTokenToIdentityProviderToken)provider).exchangeFromToken(session.getContext().getUri(), event, client, targetUserSession, targetUser, formParams);
-        return cors.add(Response.fromResponse(response));
-
-    }
-
-    protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel targetUserSession,
-            AccessToken token, boolean disallowOnHolderOfTokenMismatch) {
-        String requestedTokenType = formParams.getFirst(OAuth2Constants.REQUESTED_TOKEN_TYPE);
-        if (requestedTokenType == null) {
-            requestedTokenType = OAuth2Constants.REFRESH_TOKEN_TYPE;
-        } else if (!requestedTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE) &&
-                !requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE) &&
-                !requestedTokenType.equals(OAuth2Constants.SAML2_TOKEN_TYPE)) {
-            event.detail(Details.REASON, "requested_token_type unsupported");
-            event.error(Errors.INVALID_REQUEST);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
-
-        }
-
-        List<String> audienceParams = params.getAudience();
-        ClientModel tokenHolder = token == null ? null : realm.getClientByClientId(token.getIssuedFor());
-        List<ClientModel> targetAudienceClients = new ArrayList<>();
-
-        if (audienceParams != null) {
-            for (String audience : audienceParams) {
-                ClientModel targetClient = realm.getClientByClientId(audience);
-                if (targetClient == null) {
-                    event.detail(Details.REASON, "audience not found");
-                    event.detail(Details.AUDIENCE, audience);
-                    event.error(Errors.CLIENT_NOT_FOUND);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Audience not found", Response.Status.BAD_REQUEST);
-                } else {
-                    targetAudienceClients.add(targetClient);
-                }
-            }
-        }
-
-        for (ClientModel targetClient : targetAudienceClients) {
-            if (targetClient.isConsentRequired()) {
-                event.detail(Details.REASON, "audience requires consent");
-                event.detail(Details.AUDIENCE, targetClient.getClientId());
-                event.error(Errors.CONSENT_DENIED);
-                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires user consent", Response.Status.BAD_REQUEST);
-            }
-            if (!targetClient.isEnabled()) {
-                event.detail(Details.REASON, "audience client disabled");
-                event.detail(Details.AUDIENCE, targetClient.getClientId());
-                event.error(Errors.CLIENT_DISABLED);
-                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client disabled", Response.Status.BAD_REQUEST);
-            }
-        }
-
-
-        // Assume client itself is audience in case audience parameter not provided
-        if (targetAudienceClients.isEmpty()) {
-            targetAudienceClients.add(client);
-        }
-
-        for (ClientModel targetClient : targetAudienceClients) {
-            boolean isClientTheAudience = targetClient.equals(client);
-            if (isClientTheAudience) {
-                if (client.isPublicClient()) {
-                    // public clients can only exchange on to themselves if they are the token holder
-                    forbiddenIfClientIsNotTokenHolder(disallowOnHolderOfTokenMismatch, tokenHolder);
-                } else if (!client.equals(tokenHolder)) {
-                    // confidential clients can only exchange to themselves if they are within the token audience
-                    forbiddenIfClientIsNotWithinTokenAudience(token, tokenHolder);
-                }
-            } else {
-                if (client.isPublicClient()) {
-                    // public clients can not exchange tokens from other client
-                    forbiddenIfClientIsNotTokenHolder(disallowOnHolderOfTokenMismatch, tokenHolder);
-                }
-                if (!AdminPermissions.management(session, realm).clients().canExchangeTo(client, targetClient, token)) {
-                    event.detail(Details.REASON, "client not allowed to exchange to audience");
-                    event.detail(Details.AUDIENCE, targetClient.getClientId());
-                    event.error(Errors.NOT_ALLOWED);
-                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-                }
-            }
-        }
-
-        ClientModel targetClient = targetAudienceClients.get(0);
-        // TODO Remove once more audiences are properly supported
-        if (targetAudienceClients.size() > 1) {
-            logger.warnf("Only one value of audience parameter currently supported for token exchange. Using audience '%s' and ignoring the other audiences provided", targetClient.getClientId());
-        }
-
-        String scope = formParams.getFirst(OAuth2Constants.SCOPE);
-        if (token != null && token.getScope() != null && scope == null) {
-            scope = token.getScope();
-
-            Set<String> targetClientScopes = new HashSet<String>();
-            targetClientScopes.addAll(targetClient.getClientScopes(true).keySet());
-            targetClientScopes.addAll(targetClient.getClientScopes(false).keySet());
-            //from return scope remove scopes that are not default or optional scopes for targetClient
-            scope = Arrays.stream(scope.split(" ")).filter(s -> "openid".equals(s) || (targetClientScopes.contains(Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES) ? s.split(":")[0] : s))).collect(Collectors.joining(" "));
-        } else if (token != null && token.getScope() != null) {
-            String subjectTokenScopes = token.getScope();
-            if (Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES)) {
-                Set<String> subjectTokenScopesSet = Arrays.stream(subjectTokenScopes.split(" ")).map(s -> s.split(":")[0]).collect(Collectors.toSet());
-                scope = Arrays.stream(scope.split(" ")).filter(sc -> subjectTokenScopesSet.contains(sc.split(":")[0])).collect(Collectors.joining(" "));
-            } else {
-                Set<String> subjectTokenScopesSet = Arrays.stream(subjectTokenScopes.split(" ")).collect(Collectors.toSet());
-                scope = Arrays.stream(scope.split(" ")).filter(sc -> subjectTokenScopesSet.contains(sc)).collect(Collectors.joining(" "));
-            }
-
-            Set<String> targetClientScopes = new HashSet<String>();
-            targetClientScopes.addAll(targetClient.getClientScopes(true).keySet());
-            targetClientScopes.addAll(targetClient.getClientScopes(false).keySet());
-            //from return scope remove scopes that are not default or optional scopes for targetClient
-            scope = Arrays.stream(scope.split(" ")).filter(s -> "openid".equals(s) || (targetClientScopes.contains(Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES) ? s.split(":")[0] : s))).collect(Collectors.joining(" "));
-        }
-
-        try {
-            session.getContext().setClient(targetClient);
-            switch (requestedTokenType) {
-                case OAuth2Constants.ACCESS_TOKEN_TYPE:
-                case OAuth2Constants.REFRESH_TOKEN_TYPE:
-                    return exchangeClientToOIDCClient(targetUser, targetUserSession, requestedTokenType, targetClient, scope);
-                case OAuth2Constants.SAML2_TOKEN_TYPE:
-                    return exchangeClientToSAML2Client(targetUser, targetUserSession, requestedTokenType, targetClient);
-            }
-        } finally {
-            session.getContext().setClient(client);
-        }
-
-        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
-    }
-
-    private void forbiddenIfClientIsNotWithinTokenAudience(AccessToken token, ClientModel tokenHolder) {
-        if (token != null && !token.hasAudience(client.getClientId())) {
-            event.detail(Details.REASON, "client is not within the token audience");
-            event.error(Errors.NOT_ALLOWED);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client is not within the token audience", Response.Status.FORBIDDEN);
-        }
-    }
-
-    private void forbiddenIfClientIsNotTokenHolder(boolean disallowOnHolderOfTokenMismatch, ClientModel tokenHolder) {
-        if (disallowOnHolderOfTokenMismatch && !client.equals(tokenHolder)) {
-            event.detail(Details.REASON, "client is not the token holder");
-            event.error(Errors.NOT_ALLOWED);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client is not the holder of the token", Response.Status.FORBIDDEN);
-        }
-    }
-
-    private AuthenticationSessionModel createSessionModel(UserSessionModel targetUserSession, RootAuthenticationSessionModel rootAuthSession, UserModel targetUser, ClientModel client, String scope) {
-        AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(client);
-        authSession.setAuthenticatedUser(targetUser);
-        authSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
-        authSession.setClientNote(OIDCLoginProtocol.SCOPE_PARAM, scope);
-        return authSession;
-    }
-
-    protected Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType,
-                                                  ClientModel targetClient, String scope) {
-        RootAuthenticationSessionModel rootAuthSession = new AuthenticationSessionManager(session).createAuthenticationSession(realm, false);
-        AuthenticationSessionModel authSession = createSessionModel(targetUserSession, rootAuthSession, targetUser, targetClient, scope);
-
-        if (targetUserSession == null) {
-            // if no session is associated with a subject_token, a transient session is created to only allow building a token to the audience
-            targetUserSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, targetUser, targetUser.getUsername(),
-                    clientConnection.getRemoteAddr(), ServiceAccountConstants.CLIENT_AUTH, false, null, null, UserSessionModel.SessionPersistenceState.TRANSIENT);
-        }
-
-        event.session(targetUserSession);
-
-        AuthenticationManager.setClientScopesInSession(session, authSession);
-        ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(this.session, targetUserSession, authSession);
-
-        if (!AuthenticationManager.isClientSessionValid(realm, client, targetUserSession, targetUserSession.getAuthenticatedClientSessionByClient(client.getId()))) {
-            // create the requester client session if needed
-            AuthenticationSessionModel clientAuthSession = createSessionModel(targetUserSession, rootAuthSession, targetUser, client, scope);
-            TokenManager.attachAuthenticationSession(this.session, targetUserSession, clientAuthSession);
-        }
-
-        updateUserSessionFromClientAuth(targetUserSession);
-
-        TokenManager.AccessTokenResponseBuilder responseBuilder = tokenManager.responseBuilder(realm, targetClient, event, this.session, targetUserSession, clientSessionCtx)
-                .generateAccessToken();
-        responseBuilder.getAccessToken().issuedFor(client.getClientId());
-
-        if (targetClient != null && !targetClient.equals(client)) {
-            responseBuilder.getAccessToken().addAudience(targetClient.getClientId());
-        }
-
-        if (formParams.containsKey(OAuth2Constants.REQUESTED_SUBJECT)) {
-            // if "impersonation", store the client that originated the impersonated user session
-            targetUserSession.setNote(IMPERSONATOR_CLIENT.toString(), client.getId());
-        }
-
-        if (targetUserSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT) {
-            responseBuilder.getAccessToken().setSessionId(null);
-        }
-
-        String issuedTokenType;
-        if (requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
-                && OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRefreshToken()
-                && targetUserSession.getPersistenceState() != UserSessionModel.SessionPersistenceState.TRANSIENT) {
-            responseBuilder.generateRefreshToken();
-            responseBuilder.getRefreshToken().issuedFor(client.getClientId());
-            issuedTokenType = OAuth2Constants.REFRESH_TOKEN_TYPE;
-        } else {
-            issuedTokenType = OAuth2Constants.ACCESS_TOKEN_TYPE;
-        }
-
-        String scopeParam = clientSessionCtx.getClientSession().getNote(OAuth2Constants.SCOPE);
-        if (TokenUtil.isOIDCRequest(scopeParam)) {
-            responseBuilder.generateIDToken().generateAccessTokenHash();
-        }
-
-        AccessTokenResponse res = responseBuilder.build();
-        res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, issuedTokenType);
-
-        event.detail(Details.AUDIENCE, targetClient.getClientId())
-            .user(targetUser);
-
-        event.success();
-
-        return cors.add(Response.ok(res, MediaType.APPLICATION_JSON_TYPE));
-    }
-
-    protected Response exchangeClientToSAML2Client(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType, ClientModel targetClient) {
-        // Create authSession with target SAML 2.0 client and authenticated user
-        LoginProtocolFactory factory = (LoginProtocolFactory) session.getKeycloakSessionFactory()
-                .getProviderFactory(LoginProtocol.class, SamlProtocol.LOGIN_PROTOCOL);
-        SamlService samlService = (SamlService) factory.createProtocolEndpoint(session, event);
-        AuthenticationSessionModel authSession = samlService.getOrCreateLoginSessionForIdpInitiatedSso(session, realm,
-                targetClient, null);
-        if (authSession == null) {
-            logger.error("SAML assertion consumer url not set up");
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires assertion consumer url set up", Response.Status.BAD_REQUEST);
-        }
-
-        authSession.setAuthenticatedUser(targetUser);
-
-        event.session(targetUserSession);
-
-        AuthenticationManager.setClientScopesInSession(session, authSession);
-        ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(this.session, targetUserSession,
-                authSession);
-
-        updateUserSessionFromClientAuth(targetUserSession);
-
-        // Create SAML 2.0 Assertion Response
-        SamlClient samlClient = new SamlClient(targetClient);
-        SamlProtocol samlProtocol = new TokenExchangeSamlProtocol(samlClient).setEventBuilder(event).setHttpHeaders(headers).setRealm(realm)
-                .setSession(session).setUriInfo(session.getContext().getUri());
-
-        Response samlAssertion = samlProtocol.authenticated(authSession, targetUserSession, clientSessionCtx);
-        if (samlAssertion.getStatus() != 200) {
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Can not get SAML 2.0 token", Response.Status.BAD_REQUEST);
-        }
-        String xmlString = (String) samlAssertion.getEntity();
-        String encodedXML = Base64Url.encode(xmlString.getBytes(GeneralConstants.SAML_CHARSET));
-
-        int assertionLifespan = samlClient.getAssertionLifespan();
-
-        AccessTokenResponse res = new AccessTokenResponse();
-        res.setToken(encodedXML);
-        res.setTokenType("Bearer");
-        res.setExpiresIn(assertionLifespan <= 0 ? realm.getAccessCodeLifespan() : assertionLifespan);
-        res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, requestedTokenType);
-
-        event.detail(Details.AUDIENCE, targetClient.getClientId())
-            .user(targetUser);
-
-        event.success();
-
-        return cors.add(Response.ok(res, MediaType.APPLICATION_JSON_TYPE));
-    }
-
-    protected Response exchangeExternalToken(String subjectIssuer, String subjectToken) {
-        // try to find the IDP whose alias matches the issuer or the subject issuer in the form params.
-        ExternalExchangeContext externalExchangeContext = this.locateExchangeExternalTokenByAlias(subjectIssuer);
-
-        if (externalExchangeContext == null) {
-            event.error(Errors.INVALID_ISSUER);
-            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
-        }
-        if (!AdminPermissions.management(session, realm).idps().canExchangeTo(client, externalExchangeContext.idpModel())) {
-            event.detail(Details.REASON, "client not allowed to exchange subject_issuer");
-            event.error(Errors.NOT_ALLOWED);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
-        }
-        BrokeredIdentityContext context = externalExchangeContext.provider().exchangeExternal(event, formParams);
-        if (context == null) {
-            event.error(Errors.INVALID_ISSUER);
-            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
-        }
-
-        UserModel user = importUserFromExternalIdentity(context);
-
-        UserSessionModel userSession = new UserSessionManager(session).createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteAddr(), "external-exchange", false, null, null);
-        externalExchangeContext.provider().exchangeExternalComplete(userSession, context, formParams);
-
-        // this must exist so that we can obtain access token from user session if idp's store tokens is off
-        userSession.setNote(IdentityProvider.EXTERNAL_IDENTITY_PROVIDER, externalExchangeContext.idpModel().getAlias());
-        userSession.setNote(IdentityProvider.FEDERATED_ACCESS_TOKEN, subjectToken);
-
-        context.addSessionNotesToUserSession(userSession);
-
-        return exchangeClientToClient(user, userSession, null, false);
-    }
-
-    protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext context) {
-        IdentityProviderModel identityProviderConfig = context.getIdpConfig();
-
-        String providerId = identityProviderConfig.getAlias();
-
-        context.getIdp().preprocessFederatedIdentity(session, realm, context);
-        Set<IdentityProviderMapperModel> mappers = session.identityProviders().getMappersByAliasStream(context.getIdpConfig().getAlias())
-                .collect(Collectors.toSet());
-        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
-        for (IdentityProviderMapperModel mapper : mappers) {
-            IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
-            target.preprocessFederatedIdentity(session, realm, mapper, context);
-        }
-
-        UserModel user = null;
-        if (! context.getIdpConfig().isTransientUsers()) {
-            FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(providerId, context.getId(),
-                    context.getUsername(), context.getToken());
-
-            user = this.session.users().getUserByFederatedIdentity(realm, federatedIdentityModel);
-        }
-
-        if (user == null || context.getIdpConfig().isTransientUsers()) {
-
-            logger.debugf("Federated user not found for provider '%s' and broker username '%s'.", providerId, context.getUsername());
-
-            String username = context.getModelUsername();
-            if (username == null) {
-                if (this.realm.isRegistrationEmailAsUsername() && !Validation.isBlank(context.getEmail())) {
-                    username = context.getEmail();
-                } else if (context.getUsername() == null) {
-                    username = context.getIdpConfig().getAlias() + "." + context.getId();
-                } else {
-                    username = context.getUsername();
-                }
-            }
-            username = username.trim();
-            context.setModelUsername(username);
-            if (context.getEmail() != null && !realm.isDuplicateEmailsAllowed()) {
-                UserModel existingUser = session.users().getUserByEmail(realm, context.getEmail());
-                if (existingUser != null) {
-                    event.error(Errors.FEDERATED_IDENTITY_EXISTS);
-                    throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "User already exists", Response.Status.BAD_REQUEST);
-                }
-            }
-
-            UserModel existingUser = session.users().getUserByUsername(realm, username);
-            if (existingUser != null) {
-                event.error(Errors.FEDERATED_IDENTITY_EXISTS);
-                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "User already exists", Response.Status.BAD_REQUEST);
-            }
-
-            if (context.getIdpConfig().isTransientUsers()) {
-                String authSessionId = context.getAuthenticationSession() != null && context.getAuthenticationSession().getParentSession() != null
-                                       ? context.getAuthenticationSession().getParentSession().getId() : null;
-                user = new LightweightUserAdapter(session, realm, authSessionId);
-            } else {
-                user = session.users().addUser(realm, username);
-            }
-            user.setEnabled(true);
-            user.setEmail(context.getEmail());
-            user.setFirstName(context.getFirstName());
-            user.setLastName(context.getLastName());
-
-
-            if (! context.getIdpConfig().isTransientUsers()) {
-                FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(context.getIdpConfig().getAlias(), context.getId(),
-                        context.getModelUsername(), context.getToken());
-                session.users().addFederatedIdentity(realm, user, federatedIdentityModel);
-            }
-
-            context.getIdp().importNewUser(session, realm, user, context);
-
-            for (IdentityProviderMapperModel mapper : mappers) {
-                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
-                target.importNewUser(session, realm, user, mapper, context);
-            }
-
-            if (context.getIdpConfig().isTrustEmail() && !Validation.isBlank(user.getEmail())) {
-                logger.debugf("Email verified automatically after registration of user '%s' through Identity provider '%s' ", user.getUsername(), context.getIdpConfig().getAlias());
-                user.setEmailVerified(true);
-            }
-
-            event.clone()
-                    .event(EventType.REGISTER)
-                    .user(user.getId())
-                    .detail(Details.REGISTER_METHOD, "token-exchange")
-                    .detail(Details.EMAIL, user.getEmail())
-                    .detail(Details.IDENTITY_PROVIDER, providerId)
-                    .success();
-        } else {
-            if (!user.isEnabled()) {
-                event.error(Errors.USER_DISABLED);
-                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "Invalid Token", Response.Status.BAD_REQUEST);
-            }
-
-            String bruteForceError = getDisabledByBruteForceEventError(session.getProvider(BruteForceProtector.class), session, realm, user);
-            if (bruteForceError != null) {
-                event.error(bruteForceError);
-                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "Invalid Token", Response.Status.BAD_REQUEST);
-            }
-
-            context.getIdp().updateBrokeredUser(session, realm, user, context);
-
-            for (IdentityProviderMapperModel mapper : mappers) {
-                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
-                IdentityProviderMapperSyncModeDelegate.delegateUpdateBrokeredUser(session, realm, user, mapper, context, target);
-            }
-        }
-
-        // make sure user attributes are updated based on attributes set to the context
-        for (Map.Entry<String, List<String>> attr : context.getAttributes().entrySet().stream().sorted(Map.Entry.comparingByKey()).toList()) {
-            if (!UserModel.USERNAME.equalsIgnoreCase(attr.getKey())) {
-                user.setAttribute(attr.getKey(), attr.getValue());
-            }
-        }
-
-        return user;
-    }
-
-    // TODO: move to utility class
-    private void updateUserSessionFromClientAuth(UserSessionModel userSession) {
-        for (Map.Entry<String, String> attr : clientAuthAttributes.entrySet()) {
-            userSession.setNote(attr.getKey(), attr.getValue());
-        }
-    }
-
-    record ExternalExchangeContext (ExchangeExternalToken provider, IdentityProviderModel idpModel) {};
-
-    private ExternalExchangeContext locateExchangeExternalTokenByAlias(String alias) {
-        try {
-            IdentityProvider<?> idp = IdentityBrokerService.getIdentityProvider(session, alias);
-
-            if (idp instanceof ExchangeExternalToken external) {
-                IdentityProviderModel model = session.identityProviders().getByAlias(alias);
-                return new ExternalExchangeContext(external, model);
-            }
-        } catch (IdentityBrokerException ignore) {
-        }
-
-        return session.identityProviders().getAllStream().map(idpModel -> {
-            IdentityProvider<?> idp = IdentityBrokerService.getIdentityProvider(session, idpModel.getAlias());
-
-            if (idp instanceof ExchangeExternalToken external && external.isIssuer(alias, formParams)) {
-                return new ExternalExchangeContext(external, idpModel);
-            }
-
-            return null;
-        }).filter(Objects::nonNull).findFirst().orElse(null);
-    }
-
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProviderFactory.java
deleted file mode 100644
index 88d56743269a..000000000000
--- a/services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProviderFactory.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- *  Copyright 2021 Red Hat, Inc. and/or its affiliates
- *  and other contributors as indicated by the @author tags.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-package org.keycloak.protocol.oidc;
-
-import org.keycloak.Config;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-
-/**
- * Default token exchange provider factory
- *
- * @author <a href="mailto:dmitryt@backbase.com">Dmitry Telegin</a>
- */
-public class DefaultTokenExchangeProviderFactory implements TokenExchangeProviderFactory {
-
-    @Override
-    public TokenExchangeProvider create(KeycloakSession session) {
-        return new DefaultTokenExchangeProvider();
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void postInit(KeycloakSessionFactory factory) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return "default";
-    }
-
-}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java
index 08a9c8e88551..e6524b3bc5a0 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java
@@ -17,13 +17,13 @@
 
 package org.keycloak.protocol.oidc;
 
+import static org.keycloak.protocol.oidc.OIDCConfigAttributes.USE_RFC9068_ACCESS_TOKEN_HEADER_TYPE;
 import static org.keycloak.protocol.oidc.OIDCConfigAttributes.USE_LOWER_CASE_IN_TOKEN_RESPONSE;
 
 import org.keycloak.authentication.authenticators.client.X509ClientAuthenticator;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
 import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.services.util.DPoPUtil;
 import org.keycloak.utils.StringUtil;
 
 import java.util.ArrayList;
@@ -36,6 +36,8 @@
  */
 public class OIDCAdvancedConfigWrapper extends AbstractClientConfigWrapper {
 
+    public static enum TokenExchangeRefreshTokenEnabled {NO, SAME_SESSION};
+
     private OIDCAdvancedConfigWrapper(ClientModel client, ClientRepresentation clientRep) {
         super(client,clientRep);
     }
@@ -212,8 +214,16 @@ public boolean isUseLowerCaseInTokenResponse() {
         return Boolean.parseBoolean(getAttribute(USE_LOWER_CASE_IN_TOKEN_RESPONSE, "false"));
     }
 
-    public void setUseLowerCaseInTokenResponse(boolean useRefreshToken) {
-        setAttribute(USE_LOWER_CASE_IN_TOKEN_RESPONSE, String.valueOf(useRefreshToken));
+    public void setUseLowerCaseInTokenResponse(boolean useLowerCaseInTokenResponse) {
+        setAttribute(USE_LOWER_CASE_IN_TOKEN_RESPONSE, String.valueOf(useLowerCaseInTokenResponse));
+    }
+
+    public boolean isUseRfc9068AccessTokenHeaderType() {
+        return Boolean.parseBoolean(getAttribute(USE_RFC9068_ACCESS_TOKEN_HEADER_TYPE, "false"));
+    }
+
+    public void setUseRfc9068AccessTokenHeaderType(boolean useRfc9068AccessTokenHeaderType) {
+        setAttribute(USE_RFC9068_ACCESS_TOKEN_HEADER_TYPE, String.valueOf(useRfc9068AccessTokenHeaderType));
     }
 
     /**
@@ -230,6 +240,30 @@ public void setUseRefreshTokenForClientCredentialsGrant(boolean enable) {
         setAttribute(OIDCConfigAttributes.USE_REFRESH_TOKEN_FOR_CLIENT_CREDENTIALS_GRANT, val);
     }
 
+    public boolean isStandardTokenExchangeEnabled() {
+        String val = getAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_ENABLED, "false");
+        return Boolean.parseBoolean(val);
+    }
+    
+    public void setStandardTokenExchangeEnabled(boolean enable) {
+        String val = String.valueOf(enable);
+        setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_ENABLED, val);
+    }
+
+    public TokenExchangeRefreshTokenEnabled getStandardTokenExchangeRefreshEnabled() {
+        final String value = getAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED);
+        try {
+            return value == null? TokenExchangeRefreshTokenEnabled.NO : TokenExchangeRefreshTokenEnabled.valueOf(value);
+        } catch (IllegalArgumentException e) {
+            return TokenExchangeRefreshTokenEnabled.NO;
+        }
+    }
+
+    public void setStandardTokenExchangeRefreshEnabled(TokenExchangeRefreshTokenEnabled enable) {
+        setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED,
+                enable == null || enable == TokenExchangeRefreshTokenEnabled.NO? null : enable.name());
+    }
+
     public String getTlsClientAuthSubjectDn() {
         return getAttribute(X509ClientAuthenticator.ATTR_SUBJECT_DN);
      }
@@ -310,6 +344,26 @@ public void setTokenEndpointAuthSigningAlg(String algName) {
         setAttribute(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, algName);
     }
 
+    public int getTokenEndpointAuthSigningMaxExp() {
+        final String value = getAttribute(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_MAX_EXP);
+        try {
+            final int maxExp = Integer.parseInt(value);
+            if (maxExp > 0) {
+                return maxExp;
+            }
+        } catch (NumberFormatException e) {
+            // ignore and return default value
+        }
+        return 60; // default to 60s
+    }
+
+    public void setTokenEndpointAuthSigningMaxExp(int maxExp) {
+        if (maxExp <= 0) {
+            throw new IllegalArgumentException("Maximum expiration is a positive number in seconds");
+        }
+        setAttribute(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_MAX_EXP, String.valueOf(maxExp));
+    }
+
     public String getBackchannelLogoutUrl() {
         return getAttribute(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL);
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocol.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocol.java
index b74df93990f0..89ee96675b4e 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocol.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocol.java
@@ -292,6 +292,9 @@ public Response authenticated(AuthenticationSessionModel authSession, UserSessio
             try {
                 session.clientPolicy().triggerOnEvent(new ImplicitHybridTokenResponse(authSession, clientSessionCtx, responseBuilder));
             } catch (ClientPolicyException cpe) {
+                event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+                event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+                event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
                 event.error(cpe.getError());
                 new AuthenticationSessionManager(session).removeTabIdInAuthenticationSession(realm, authSession);
                 redirectUri.addParam(OAuth2Constants.ERROR_DESCRIPTION, cpe.getError());
@@ -312,6 +315,12 @@ public Response authenticated(AuthenticationSessionModel authSession, UserSessio
                 redirectUri.addParam(OAuth2Constants.TOKEN_TYPE, res.getTokenType());
                 redirectUri.addParam(OAuth2Constants.EXPIRES_IN, String.valueOf(res.getExpiresIn()));
             }
+
+            boolean offlineTokenRequested = clientSessionCtx.isOfflineTokenRequested();
+            if (!responseType.isImplicitFlow() && offlineTokenRequested) {
+                // Allow creating offline token early, so the tokens issued from authz-enpdpoint can lookup offline-user-session if used before code-to-token request
+                responseBuilder.createOrUpdateOfflineSession();
+            }
         }
 
         return buildRedirectUri(redirectUri, authSession, userSession, clientSessionCtx);
@@ -525,9 +534,12 @@ protected boolean isReAuthRequiredForKcAction(UserSessionModel userSession, Auth
         if (userSession != null && authSession.getClientNote(Constants.KC_ACTION) != null) {
             String providerId = authSession.getClientNote(Constants.KC_ACTION);
             RequiredActionProvider requiredActionProvider = this.session.getProvider(RequiredActionProvider.class, providerId);
+            if (requiredActionProvider == null) {
+                return false;
+            }
             String authTime = userSession.getNote(AuthenticationManager.AUTH_TIME);
             int authTimeInt = authTime == null ? 0 : Integer.parseInt(authTime);
-            int maxAgeInt = requiredActionProvider.getMaxAuthAge();
+            int maxAgeInt = requiredActionProvider.getMaxAuthAge(session);
             return authTimeInt + maxAgeInt < Time.currentTime();
         } else {
             return false;
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java
index f535ec63321e..fbbee59da913 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java
@@ -67,6 +67,11 @@
 public class OIDCLoginProtocolFactory extends AbstractLoginProtocolFactory {
     private static final Logger logger = Logger.getLogger(OIDCLoginProtocolFactory.class);
 
+    /**
+     * determines the order in which the login protocols are displayed in the dropdown boxes in the UI
+     */
+    public static final int UI_ORDER = 100;
+
     public static final String USERNAME = "username";
     public static final String EMAIL = "email";
     public static final String EMAIL_VERIFIED = "email verified";
@@ -115,11 +120,21 @@ public class OIDCLoginProtocolFactory extends AbstractLoginProtocolFactory {
     public static final String CONFIG_OIDC_REQ_PARAMS_MAX_OVERALL_SIZE = "add-req-params-max-overall-size";
     public static final String CONFIG_OIDC_REQ_PARAMS_FAIL_FAST = "add-req-params-fail-fast";
 
+    /**
+     * @deprecated To be removed in Keycloak 27
+     */
+    public static final String CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION = "allow-multiple-audiences-for-jwt-client-authentication";
+
     private OIDCProviderConfig providerConfig;
 
     @Override
     public void init(Config.Scope config) {
         this.providerConfig = new OIDCProviderConfig(config);
+        if (this.providerConfig.isAllowMultipleAudiencesForJwtClientAuthentication()) {
+            logger.warnf("It is allowed to have multiple audiences for the JWT client authentication. This option is not recommended and will be removed in one of the future releases."
+                    + " It is recommended to update your OAuth/OIDC clients to rather use single audience in the JWT token used for the client authentication.");
+        }
+
         initBuiltIns();
     }
 
@@ -532,4 +547,11 @@ public void setupClientDefaults(ClientRepresentation rep, ClientModel newClient)
         }
     }
 
+    /**
+     * defines the option-order in the admin-ui
+     */
+    @Override
+    public int order() {
+        return UI_ORDER;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
index 293387bccd27..fe3fb4bb5616 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
@@ -54,6 +54,8 @@
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
 
+import static jakarta.ws.rs.core.HttpHeaders.CONTENT_TYPE;
+
 /**
  * Resource class for the oauth/openid connect token service
  *
@@ -195,7 +197,7 @@ public Response getVersionPreflight() {
 
     @GET
     @Path("certs")
-    @Produces(MediaType.APPLICATION_JSON)
+    @Produces({MediaType.APPLICATION_JSON, org.keycloak.utils.MediaType.APPLICATION_JWKS})
     @NoCache
     public Response certs() {
         checkSsl();
@@ -203,7 +205,15 @@ public Response certs() {
         JSONWebKeySet keySet = JWKSServerUtils.getRealmJwks(session, realm);
 
         Response.ResponseBuilder responseBuilder = Response.ok(keySet).cacheControl(CacheControlUtil.getDefaultCacheControl());
-        return Cors.builder().allowedOrigins("*").auth().add(responseBuilder);
+
+        boolean isJwksRequest = org.keycloak.utils.MediaType.APPLICATION_JWKS.equals(this.headers.getHeaderString(HttpHeaders.ACCEPT));
+        if (isJwksRequest) {
+            responseBuilder.header(CONTENT_TYPE, org.keycloak.utils.MediaType.APPLICATION_JWKS);
+        } else {
+            responseBuilder.header(CONTENT_TYPE, MediaType.APPLICATION_JSON);
+        }
+
+        return Cors.builder().allowAllOrigins().auth().add(responseBuilder);
     }
 
     @Path("userinfo")
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCProviderConfig.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCProviderConfig.java
index 3f542c13a730..b2009dd43d38 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCProviderConfig.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCProviderConfig.java
@@ -48,12 +48,26 @@ public class OIDCProviderConfig {
      */
     private final int additionalReqParamsMaxOverallSize;
 
+    /**
+     * @deprecated to be removed in Keycloak 27
+     */
+    public static final boolean DEFAULT_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION = false;
+
+    /**
+     * Whether to allow multiple audiences for JWT client authentication
+     * @deprecated To be removed in Keycloak 27
+     */
+    private final boolean allowMultipleAudiencesForJwtClientAuthentication;
+
+
 
     public OIDCProviderConfig(Config.Scope config) {
         this.additionalReqParamsMaxNumber = config.getInt(OIDCLoginProtocolFactory.CONFIG_OIDC_REQ_PARAMS_MAX_NUMBER, DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_NUMBER);
         this.additionalReqParamsMaxSize = config.getInt(OIDCLoginProtocolFactory.CONFIG_OIDC_REQ_PARAMS_MAX_SIZE, DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_SIZE);
         this.additionalReqParamsMaxOverallSize = config.getInt(OIDCLoginProtocolFactory.CONFIG_OIDC_REQ_PARAMS_MAX_OVERALL_SIZE, DEFAULT_ADDITIONAL_REQ_PARAMS_MAX_OVERALL_SIZE);
         this.additionalReqParamsFailFast = config.getBoolean(OIDCLoginProtocolFactory.CONFIG_OIDC_REQ_PARAMS_FAIL_FAST, DEFAULT_ADDITIONAL_REQ_PARAMS_FAIL_FAST);
+
+        this.allowMultipleAudiencesForJwtClientAuthentication = config.getBoolean(OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, DEFAULT_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION);
     }
 
     public int getAdditionalReqParamsMaxNumber() {
@@ -71,4 +85,8 @@ public boolean isAdditionalReqParamsFailFast() {
     public int getAdditionalReqParamsMaxOverallSize() {
         return additionalReqParamsMaxOverallSize;
     }
+
+    public boolean isAllowMultipleAudiencesForJwtClientAuthentication() {
+        return allowMultipleAudiencesForJwtClientAuthentication;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java
index 623f8a214da3..17708c38b06e 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCWellKnownProvider.java
@@ -33,8 +33,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint;
 import org.keycloak.protocol.oidc.endpoints.TokenEndpoint;
-import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantType;
-import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
+import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
 import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
 import org.keycloak.protocol.oidc.grants.device.endpoints.DeviceEndpoint;
 import org.keycloak.protocol.oidc.par.endpoints.ParEndpoint;
@@ -73,8 +72,6 @@
  */
 public class OIDCWellKnownProvider implements WellKnownProvider {
 
-    public final List<String> DEFAULT_GRANT_TYPES_SUPPORTED;
-
     public static final List<String> DEFAULT_RESPONSE_TYPES_SUPPORTED = list(OAuth2Constants.CODE, OIDCResponseType.NONE, OIDCResponseType.ID_TOKEN, OIDCResponseType.TOKEN, "id_token token", "code id_token", "code token", "code id_token token");
 
     public static final List<String> DEFAULT_SUBJECT_TYPES_SUPPORTED = list("public", "pairwise");
@@ -98,25 +95,7 @@ public class OIDCWellKnownProvider implements WellKnownProvider {
     private final Map<String, Object> openidConfigOverride;
     private final boolean includeClientScopes;
 
-    public OIDCWellKnownProvider(KeycloakSession session) {
-        this(session, null, true);
-    }
-
     public OIDCWellKnownProvider(KeycloakSession session, Map<String, Object> openidConfigOverride, boolean includeClientScopes) {
-        DEFAULT_GRANT_TYPES_SUPPORTED = Stream.of(OAuth2Constants.AUTHORIZATION_CODE,
-                OAuth2Constants.IMPLICIT, OAuth2Constants.REFRESH_TOKEN, OAuth2Constants.PASSWORD, OAuth2Constants.CLIENT_CREDENTIALS,
-                OAuth2Constants.CIBA_GRANT_TYPE).collect(Collectors.toList());
-        if (Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE)) {
-            DEFAULT_GRANT_TYPES_SUPPORTED.add(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
-        }
-
-        if (Profile.isFeatureEnabled(Profile.Feature.DEVICE_FLOW)) {
-            DEFAULT_GRANT_TYPES_SUPPORTED.add(OAuth2Constants.DEVICE_CODE_GRANT_TYPE);
-        }
-        if (Profile.isFeatureEnabled(Profile.Feature.OID4VC_VCI)) {
-            DEFAULT_GRANT_TYPES_SUPPORTED.add(PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE);
-        }
-
         this.session = session;
         this.openidConfigOverride = openidConfigOverride;
         this.includeClientScopes = includeClientScopes;
@@ -167,7 +146,7 @@ public Object getConfig() {
         config.setResponseTypesSupported(DEFAULT_RESPONSE_TYPES_SUPPORTED);
         config.setSubjectTypesSupported(DEFAULT_SUBJECT_TYPES_SUPPORTED);
         config.setResponseModesSupported(DEFAULT_RESPONSE_MODES_SUPPORTED);
-        config.setGrantTypesSupported(DEFAULT_GRANT_TYPES_SUPPORTED);
+        config.setGrantTypesSupported(getGrantTypesSupported());
         config.setAcrValuesSupported(getAcrValuesSupported(realm));
 
         config.setPromptValuesSupported(getPromptValuesSupported(realm));
@@ -295,6 +274,16 @@ private List<String> getSupportedContentEncryptionAlgorithms() {
         return getSupportedAlgorithms(ContentEncryptionProvider.class, false);
     }
 
+    private List<String> getGrantTypesSupported() {
+        Stream<String> supportedGrantTypes = session.getKeycloakSessionFactory().getProviderFactoriesStream(OAuth2GrantType.class)
+                    .map(ProviderFactory::getId);
+
+        // Implicit not available as OAuth2GrantType implementation, but should be included. It is served from OIDC authentication endpoint directly
+        return Stream.concat(supportedGrantTypes, Stream.of(OAuth2Constants.IMPLICIT))
+                .sorted()
+                .collect(Collectors.toList());
+    }
+
     private List<String> getAcrValuesSupported(RealmModel realm) {
         // Values explicitly set on the realm mapping
         Map<String, Integer> realmAcrLoaMap = AcrUtils.getAcrLoaMap(realm);
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/RefreshTokenIntrospectionProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/RefreshTokenIntrospectionProvider.java
index 23c675b86d73..b0e8d6b721de 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/RefreshTokenIntrospectionProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/RefreshTokenIntrospectionProvider.java
@@ -17,14 +17,63 @@
  */
 package org.keycloak.protocol.oidc;
 
+import org.jboss.logging.Logger;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.representations.RefreshToken;
+import org.keycloak.services.util.UserSessionUtil;
+import org.keycloak.util.TokenUtil;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public class RefreshTokenIntrospectionProvider extends AccessTokenIntrospectionProvider {
+public class RefreshTokenIntrospectionProvider extends AccessTokenIntrospectionProvider<RefreshToken> {
+
+    private static final Logger logger = Logger.getLogger(RefreshTokenIntrospectionProvider.class);
 
     public RefreshTokenIntrospectionProvider(KeycloakSession session) {
         super(session);
     }
+
+    @Override
+    protected Class<RefreshToken> getTokenClass() {
+        return RefreshToken.class;
+    }
+
+    @Override
+    protected UserSessionUtil.UserSessionValidationResult verifyUserSession() {
+        return UserSessionUtil.findValidSessionForRefreshToken(session, realm, token, client, (invalidUserSession -> {}));
+    }
+
+    @Override
+    protected boolean verifyTokenReuse() {
+
+        String tokenType = token.getType();
+        if (realm.isRevokeRefreshToken()
+                && (tokenType.equals(TokenUtil.TOKEN_TYPE_REFRESH) || tokenType.equals(TokenUtil.TOKEN_TYPE_OFFLINE))
+                && !validateTokenReuse()) {
+            logger.debugf("Introspection access token for %s client: failed to validate Token reuse for introspection", token.getIssuedFor());
+            eventBuilder.detail(Details.REASON, "Realm revoke refresh token, token type is "+tokenType+ " and token is not eligible for introspection");
+            eventBuilder.error(Errors.INVALID_TOKEN);
+            return false;
+        }
+
+        return true;
+    }
+
+    private boolean validateTokenReuse() {
+        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
+
+        try {
+            tokenManager.validateTokenReuse(session, realm, token, clientSession, false);
+            return true;
+        } catch (
+                OAuthErrorException e) {
+            logger.debug("validateTokenReuseForIntrospection is false", e);
+            return false;
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java b/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
index a9e7f383f4f4..4fd1ec568ec0 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java
@@ -22,6 +22,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
 import org.keycloak.common.Profile.Feature;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
@@ -64,6 +65,8 @@
 import org.keycloak.organization.protocol.mappers.oidc.OrganizationScope;
 import org.keycloak.protocol.ProtocolMapper;
 import org.keycloak.protocol.ProtocolMapperUtils;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
 import org.keycloak.protocol.oidc.mappers.TokenIntrospectionTokenMapper;
 import org.keycloak.protocol.oidc.mappers.OIDCAccessTokenMapper;
 import org.keycloak.protocol.oidc.mappers.OIDCAccessTokenResponseMapper;
@@ -99,6 +102,7 @@
 
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -192,14 +196,8 @@ public TokenValidation validateToken(KeycloakSession session, UriInfo uriInfo, C
         ClientModel client = session.getContext().getClient();
         AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
 
-        // Can theoretically happen in cross-dc environment. Try to see if userSession with our client is available in remoteCache
         if (clientSession == null) {
-            userSession = session.sessions().getUserSessionIfClientExists(realm, userSession.getId(), offline, client.getId());
-            if (userSession != null) {
-                clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
-            } else {
-                throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "Session doesn't have required client", "Session doesn't have required client");
-            }
+            throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "Session doesn't have required client", "Session doesn't have required client");
         }
 
         if (!AuthenticationManager.isClientSessionValid(realm, client, userSession, clientSession)) {
@@ -242,6 +240,7 @@ public TokenValidation validateToken(KeycloakSession session, UriInfo uriInfo, C
         if (oldToken.getNonce() != null) {
             clientSessionCtx.setAttribute(OIDCLoginProtocol.NONCE_PARAM, oldToken.getNonce());
         }
+        clientSessionCtx.setAttribute(Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN);
 
         // recreate token.
         AccessToken newToken = createClientAccessToken(session, realm, client, user, userSession, clientSessionCtx);
@@ -249,98 +248,6 @@ public TokenValidation validateToken(KeycloakSession session, UriInfo uriInfo, C
         return new TokenValidation(user, userSession, clientSessionCtx, newToken);
     }
 
-    /**
-     * Checks if the token is valid.
-     *
-     * @param session
-     * @param realm
-     * @param token
-     * @return
-     */
-    public AccessToken checkTokenValidForIntrospection(KeycloakSession session, RealmModel realm, AccessToken token, EventBuilder eventBuilder) {
-        return getValidUserSessionIfTokenIsValid(session, realm, token, eventBuilder) != null ? token : null;
-    }
-
-    /**
-     * Checks if the token is valid and return a valid user session.
-     *
-     * @param session
-     * @param realm
-     * @param token
-     * @return
-     */
-    public UserSessionModel getValidUserSessionIfTokenIsValid(KeycloakSession session, RealmModel realm, AccessToken token, EventBuilder eventBuilder) {
-        if (token == null) {
-            return null;
-        }
-        ClientModel client = realm.getClientByClientId(token.getIssuedFor());
-        if (client == null) {
-            logger.debugf("Introspection access token : client with clientId %s does not exist", token.getIssuedFor() );
-            eventBuilder.detail(Details.REASON, String.format("Could not find client for %s", token.getIssuedFor()));
-            return null;
-        } else if (!client.isEnabled()) {
-            logger.debugf("Introspection access token : client with clientId %s is disabled", token.getIssuedFor() );
-            eventBuilder.detail(Details.REASON, String.format("Client with clientId %s is disabled", token.getIssuedFor()));
-            return null;
-        }
-
-        try {
-            TokenVerifier.createWithoutSignature(token)
-                    .withChecks(NotBeforeCheck.forModel(client), TokenVerifier.IS_ACTIVE, new TokenRevocationCheck(session))
-                    .verify();
-        } catch (VerificationException e) {
-            logger.debugf("Introspection access token for %s client: JWT check failed: %s", token.getIssuedFor(), e.getMessage());
-            eventBuilder.detail(Details.REASON, "Introspection access token for "+token.getIssuedFor() +" client: JWT check failed");
-            return null;
-        }
-
-        UserSessionModel userSession;
-        try {
-            userSession = UserSessionUtil.findValidSession(session, realm, token, eventBuilder, client);
-        } catch (Exception e) {
-            logger.debugf( "Introspection access token for " + token.getIssuedFor() + " client:" + e.getMessage());
-            eventBuilder.detail(Details.REASON,  "Introspection access token for " + token.getIssuedFor() + " client:" + e.getMessage());
-            return null;
-        }
-
-        if (!isUserValid(session, realm, token, userSession.getUser())) {
-            logger.debugf("Could not find valid user from user");
-            eventBuilder.detail(Details.REASON, "Could not find valid user from user");
-            return null;
-        }
-
-        String tokenType = token.getType();
-        if (realm.isRevokeRefreshToken()
-                && (tokenType.equals(TokenUtil.TOKEN_TYPE_REFRESH) || tokenType.equals(TokenUtil.TOKEN_TYPE_OFFLINE))
-                && !validateTokenReuseForIntrospection(session, realm, token)) {
-            logger.debugf("Introspection access token for %s client: failed to validate Token reuse for introspection", token.getIssuedFor());
-            eventBuilder.detail(Details.REASON, "Realm revoke refresh token, token type is "+tokenType+ " and token is not eligible for introspection");
-            return null;
-        }
-        return userSession;
-    }
-
-    private boolean validateTokenReuseForIntrospection(KeycloakSession session, RealmModel realm, AccessToken token) {
-        UserSessionModel userSession = null;
-        if (token.getType().equals(TokenUtil.TOKEN_TYPE_REFRESH)) {
-            userSession = session.sessions().getUserSession(realm, token.getSessionId());
-        } else {
-            UserSessionManager sessionManager = new UserSessionManager(session);
-            userSession = sessionManager.findOfflineUserSession(realm, token.getSessionId());
-        }
-
-        ClientModel client = realm.getClientByClientId(token.getIssuedFor());
-        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
-
-        try {
-            validateTokenReuse(session, realm, token, clientSession, false);
-            return true;
-        } catch (OAuthErrorException e) {
-            logger.debug("validateTokenReuseForIntrospection is false",e);
-            return false;
-        }
-    }
-
     public static boolean isUserValid(KeycloakSession session, RealmModel realm, AccessToken token, UserModel user) {
         if (user == null) {
             logger.debugf("User does not exists");
@@ -399,7 +306,7 @@ public AccessTokenResponseBuilder refreshAccessToken(KeycloakSession session, Ur
         if (scopeParameter != null && ! scopeParameter.isEmpty()) {
             Set<String> scopeParamScopes = Arrays.stream(scopeParameter.split(" ")).collect(Collectors.toSet());
             oldTokenScope = Arrays.stream(oldTokenScope.split(" "))
-                    .map(transformScopes(scopeParamScopes))
+                    .map(transformScopes(session, scopeParamScopes))
                     .filter(Objects::nonNull)
                     .collect(Collectors.joining(" "));
         }
@@ -422,6 +329,15 @@ public AccessTokenResponseBuilder refreshAccessToken(KeycloakSession session, Ur
             validation.newToken.setAuthorization(refreshToken.getAuthorization());
         }
 
+        final Collection<String> requestedAud = (Collection<String>) refreshToken.getOtherClaims().get(Constants.REQUESTED_AUDIENCE);
+        if (requestedAud != null) {
+            validation.clientSessionCtx.setAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS,
+                    requestedAud.stream()
+                            .map(clientId -> session.clients().getClientByClientId(realm, clientId))
+                            .filter(Objects::nonNull)
+                            .toArray(ClientModel[]::new));
+        }
+
         AccessTokenResponseBuilder responseBuilder = responseBuilder(realm, authorizedClient, event, session,
             validation.userSession, validation.clientSessionCtx).offlineToken( TokenUtil.TOKEN_TYPE_OFFLINE.equals(refreshToken.getType())).accessToken(validation.newToken);
         if (clientConfig.isUseRefreshToken()) {
@@ -444,15 +360,15 @@ public AccessTokenResponseBuilder refreshAccessToken(KeycloakSession session, Ur
         return responseBuilder;
     }
 
-    private Function<String, String> transformScopes(Set<String> requestedScopes) {
+    private Function<String, String> transformScopes(KeycloakSession session, Set<String> requestedScopes) {
         return scope -> {
             if (requestedScopes.contains(scope)) {
                 return scope;
             }
 
             if (Profile.isFeatureEnabled(Feature.ORGANIZATION)) {
-                OrganizationScope oldScope = OrganizationScope.valueOfScope(scope);
-                return oldScope == null ? null : oldScope.resolveName(requestedScopes, scope);
+                OrganizationScope oldScope = OrganizationScope.valueOfScope(session, scope);
+                return oldScope == null ? null : oldScope.resolveName(session, requestedScopes, scope);
             }
 
             return null;
@@ -490,7 +406,7 @@ private void validateTokenReuseForRefresh(KeycloakSession session, RealmModel re
     }
 
     // Will throw OAuthErrorException if validation fails
-    private void validateTokenReuse(KeycloakSession session, RealmModel realm, AccessToken refreshToken, AuthenticatedClientSessionModel clientSession, boolean refreshFlag) throws OAuthErrorException {
+    public void validateTokenReuse(KeycloakSession session, RealmModel realm, AccessToken refreshToken, AuthenticatedClientSessionModel clientSession, boolean refreshFlag) throws OAuthErrorException {
         int startupTime = session.getProvider(UserSessionProvider.class).getStartupTime(realm);
         String key = getReuseIdKey(refreshToken);
         String refreshTokenId = clientSession.getRefreshToken(key);
@@ -550,8 +466,11 @@ public RefreshToken verifyRefreshToken(KeycloakSession session, RealmModel realm
             }
 
             if (Profile.isFeatureEnabled(Profile.Feature.DPOP)) {
-                DPoP dPoP = (DPoP) session.getAttribute(DPoPUtil.DPOP_SESSION_ATTRIBUTE);
-                if (client.isPublicClient() && (OIDCAdvancedConfigWrapper.fromClientModel(client).isUseDPoP() || dPoP != null )) {
+                if (DPoPUtil.isDPoPToken(refreshToken)) {
+                    DPoP dPoP = (DPoP) session.getAttribute(DPoPUtil.DPOP_SESSION_ATTRIBUTE);
+                    if (dPoP == null) {
+                        throw new OAuthErrorException(OAuthErrorException.INVALID_GRANT, "DPoP proof is missing");
+                    }
                     try {
                         DPoPUtil.validateBinding(refreshToken, dPoP);
                     } catch (VerificationException ex) {
@@ -602,8 +521,12 @@ public AccessToken createClientAccessToken(KeycloakSession session, RealmModel r
         return token;
     }
 
-
     public static ClientSessionContext attachAuthenticationSession(KeycloakSession session, UserSessionModel userSession, AuthenticationSessionModel authSession) {
+        return attachAuthenticationSession(session, userSession, authSession, false);
+    }
+
+    public static ClientSessionContext attachAuthenticationSession(KeycloakSession session, UserSessionModel userSession,
+            AuthenticationSessionModel authSession, boolean createTransientIfMissing) {
         ClientModel client = authSession.getClient();
 
         AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
@@ -612,6 +535,10 @@ public static ClientSessionContext attachAuthenticationSession(KeycloakSession s
             // session exists but not active so re-start it
             clientSession.restartClientSession();
         } else if (clientSession == null) {
+            if (createTransientIfMissing && userSession.getPersistenceState() != UserSessionModel.SessionPersistenceState.TRANSIENT) {
+                // create a transient session for the missing client session
+                userSession = UserSessionUtil.createTransientUserSession(session, userSession);
+            }
             clientSession = session.sessions().createClientSession(realm, client, userSession);
         }
 
@@ -711,6 +638,10 @@ public static Stream<ClientScopeModel> getRequestedClientScopes(KeycloakSession
             return clientScopes;
         }
 
+        // skip scopes that were explicitly requested using the dynamic scope format
+        // we don't want dynamic and default client scopes duplicated
+        clientScopes = clientScopes.filter(scope -> !scopeParam.contains(scope.getName() + ClientScopeModel.VALUE_SEPARATOR));
+
         Map<String, ClientScopeModel> allOptionalScopes = client.getClientScopes(false);
 
         // Add optional client scopes requested by scope parameter
@@ -722,20 +653,24 @@ public static Stream<ClientScopeModel> getRequestedClientScopes(KeycloakSession
                                 return scope;
                             }
 
-                            return tryResolveDynamicClientScope(session, scopeParam, client, user, name);
+                            return tryResolveDynamicClientScope(session, scopeParam, user, name);
                         })
                         .filter(Objects::nonNull),
                 clientScopes).distinct();
     }
 
-    private static ClientScopeModel tryResolveDynamicClientScope(KeycloakSession session, String scopeParam, ClientModel client, UserModel user, String name) {
+    private static ClientScopeModel tryResolveDynamicClientScope(KeycloakSession session, String scopeParam, UserModel user, String name) {
         if (Profile.isFeatureEnabled(Feature.ORGANIZATION)) {
-            OrganizationScope orgScope = OrganizationScope.valueOfScope(scopeParam);
+            OrganizationScope orgScope = OrganizationScope.valueOfScope(session, scopeParam);
 
             if (orgScope == null) {
                 return null;
             }
 
+            if (user != null && orgScope.resolveOrganizations(user, scopeParam, session).findAny().isEmpty()) {
+                return null;
+            }
+
             return orgScope.toClientScope(name, user, session);
         }
 
@@ -840,13 +775,20 @@ public static boolean verifyConsentStillAvailable(KeycloakSession session, UserM
 
     public AccessToken transformAccessToken(KeycloakSession session, AccessToken token,
                                             UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
-        return ProtocolMapperUtils.getSortedProtocolMappers(session, clientSessionCtx, mapper -> mapper.getValue() instanceof OIDCAccessTokenMapper)
+        AccessToken accessToken = ProtocolMapperUtils.getSortedProtocolMappers(session, clientSessionCtx, mapper -> mapper.getValue() instanceof OIDCAccessTokenMapper)
                 .collect(new TokenCollector<AccessToken>(token) {
                     @Override
                     protected AccessToken applyMapper(AccessToken token, Map.Entry<ProtocolMapperModel, ProtocolMapper> mapper) {
                         return ((OIDCAccessTokenMapper) mapper.getValue()).transformAccessToken(token, mapper.getKey(), session, userSession, clientSessionCtx);
                     }
                 });
+        final ClientModel[] requestedAudienceClients = clientSessionCtx.getAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, ClientModel[].class);
+        if (requestedAudienceClients != null) {
+            restrictRequestedAudience(accessToken, Arrays.stream(requestedAudienceClients)
+                    .map(ClientModel::getClientId)
+                    .collect(Collectors.toSet()));
+        }
+        return accessToken;
     }
 
     public AccessTokenResponse transformAccessTokenResponse(KeycloakSession session, AccessTokenResponse accessTokenResponse,
@@ -1024,7 +966,11 @@ protected IDToken applyMapper(IDToken token, Map.Entry<ProtocolMapperModel, Prot
     protected AccessToken initToken(KeycloakSession session, RealmModel realm, ClientModel client, UserModel user, UserSessionModel userSession,
                                     ClientSessionContext clientSessionCtx, UriInfo uriInfo) {
         AccessToken token = new AccessToken();
-        token.id(KeycloakModelUtils.generateId());
+
+        TokenContextEncoderProvider encoder = session.getProvider(TokenContextEncoderProvider.class);
+        AccessTokenContext tokenCtx = encoder.getTokenContextFromClientSessionContext(clientSessionCtx, SecretGenerator.getInstance().generateSecureID());
+        token.id(encoder.encodeTokenId(tokenCtx));
+
         token.type(formatTokenType(client, token));
         if (UserSessionModel.SessionPersistenceState.TRANSIENT.equals(userSession.getPersistenceState())) {
             token.subject(user.getId());
@@ -1092,8 +1038,11 @@ private Long getTokenExpiration(RealmModel realm, ClientModel client, UserSessio
             expiration = Time.currentTimeMillis() + TimeUnit.SECONDS.toMillis(tokenLifespan);
         }
 
+        final boolean offline = userSession.isOffline() || offlineTokenRequested ||
+                (userSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT &&
+                Constants.CREATED_FROM_PERSISTENT_OFFLINE.equals(userSession.getNote(Constants.CREATED_FROM_PERSISTENT)));
         long sessionExpires = SessionExpirationUtils.calculateClientSessionMaxLifespanTimestamp(
-                userSession.isOffline() || offlineTokenRequested, userSession.isRememberMe(),
+                offline, userSession.isRememberMe(),
                 TimeUnit.SECONDS.toMillis(clientSession.getStarted()), TimeUnit.SECONDS.toMillis(userSession.getStarted()),
                 realm, client);
         expiration = sessionExpires > 0? Math.min(expiration, sessionExpires) : expiration;
@@ -1156,6 +1105,7 @@ public AccessTokenResponseBuilder accessToken(AccessToken accessToken) {
             this.responseTokenType = formatTokenType(client, accessToken);
             return this;
         }
+
         public AccessTokenResponseBuilder refreshToken(RefreshToken refreshToken) {
             this.refreshToken = refreshToken;
             return this;
@@ -1183,8 +1133,7 @@ public AccessTokenResponseBuilder generateRefreshToken() {
                 throw new IllegalStateException("accessToken not set");
             }
 
-            ClientScopeModel offlineAccessScope = KeycloakModelUtils.getClientScopeByName(realm, OAuth2Constants.OFFLINE_ACCESS);
-            boolean offlineTokenRequested = offlineAccessScope==null ? false : clientSessionCtx.getClientScopeIds().contains(offlineAccessScope.getId());
+            boolean offlineTokenRequested = clientSessionCtx.isOfflineTokenRequested();
             generateRefreshToken(offlineTokenRequested);
             refreshToken.setScope(clientSessionCtx.getScopeString(true));
             if (realm.isRevokeRefreshToken()) {
@@ -1220,26 +1169,36 @@ private void generateRefreshToken(boolean offlineTokenRequested) {
             AuthenticatedClientSessionModel clientSession = clientSessionCtx.getClientSession();
             final AccessToken.Confirmation confirmation = getConfirmation(clientSession, accessToken);
             refreshToken = new RefreshToken(accessToken, confirmation);
-            refreshToken.id(KeycloakModelUtils.generateId());
+            refreshToken.id(SecretGenerator.getInstance().generateSecureID());
             refreshToken.issuedNow();
             clientSession.setTimestamp(refreshToken.getIat().intValue());
             UserSessionModel userSession = clientSession.getUserSession();
             userSession.setLastSessionRefresh(refreshToken.getIat().intValue());
             if (offlineTokenRequested) {
-                UserSessionManager sessionManager = new UserSessionManager(session);
-                if (!sessionManager.isOfflineTokenAllowed(clientSessionCtx)) {
-                    event.detail(Details.REASON, "Offline tokens not allowed for the user or client");
-                    event.error(Errors.NOT_ALLOWED);
-                    throw new ErrorResponseException(Errors.NOT_ALLOWED, "Offline tokens not allowed for the user or client", Response.Status.BAD_REQUEST);
-                }
                 refreshToken.type(TokenUtil.TOKEN_TYPE_OFFLINE);
                 if (realm.isOfflineSessionMaxLifespanEnabled()) {
                     refreshToken.exp(getExpiration(true));
                 }
-                sessionManager.createOrUpdateOfflineSession(clientSessionCtx.getClientSession(), userSession);
+                createOrUpdateOfflineSession();
             } else {
                 refreshToken.exp(getExpiration(false));
             }
+            final ClientModel[] resquestedAudienceClients = clientSessionCtx.getAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, ClientModel[].class);
+            if (resquestedAudienceClients != null) {
+                refreshToken.getOtherClaims().put(Constants.REQUESTED_AUDIENCE, Arrays.stream(resquestedAudienceClients)
+                        .map(ClientModel::getClientId)
+                        .collect(Collectors.toSet()));
+            }
+        }
+
+        public void createOrUpdateOfflineSession() {
+            UserSessionManager sessionManager = new UserSessionManager(session);
+            if (!sessionManager.isOfflineTokenAllowed(clientSessionCtx)) {
+                event.detail(Details.REASON, "Offline tokens not allowed for the user or client");
+                event.error(Errors.NOT_ALLOWED);
+                throw new ErrorResponseException(Errors.NOT_ALLOWED, "Offline tokens not allowed for the user or client", Response.Status.BAD_REQUEST);
+            }
+            sessionManager.createOrUpdateOfflineSession(clientSessionCtx.getClientSession(), userSession);
         }
 
        /**
@@ -1279,7 +1238,7 @@ public AccessTokenResponseBuilder generateIDToken(boolean isIdTokenAsDetachedSig
                 throw new IllegalStateException("accessToken not set");
             }
             idToken = new IDToken();
-            idToken.id(KeycloakModelUtils.generateId());
+            idToken.id(SecretGenerator.getInstance().generateSecureID());
             idToken.type(TokenUtil.TOKEN_TYPE_ID);
             idToken.subject(userSession.getUser().getId());
             idToken.audience(client.getClientId());
@@ -1418,6 +1377,16 @@ private String formatTokenType(ClientModel client, AccessToken accessToken) {
         return tokenType;
     }
 
+    private AccessToken restrictRequestedAudience(AccessToken accessToken, Set<String> audience) {
+        if (accessToken.getAudience() != null) {
+            final Set<String> audienceToSet = new HashSet<>(audience);
+            audienceToSet.retainAll(Set.of(accessToken.getAudience()));
+            accessToken.audience(audienceToSet.toArray(String[]::new));
+            accessToken.getResourceAccess().keySet().removeIf(clientId -> !audienceToSet.contains(clientId));
+        }
+        return accessToken;
+    }
+
     public static class NotBeforeCheck implements TokenVerifier.Predicate<JsonWebToken> {
 
         private final int notBefore;
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java
new file mode 100644
index 000000000000..5b0d9a4f384c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/AccessTokenContext.java
@@ -0,0 +1,153 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import java.util.Objects;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * Some context info about the token
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AccessTokenContext {
+
+    private final SessionType sessionType;
+    private final TokenType tokenType;
+    private final String grantType;
+    private final String rawTokenId;
+
+    public enum SessionType {
+        // Regular online user session with valid client session
+        ONLINE("on", false, true, false, false),
+
+        // Regular offline user session with valid client session
+        OFFLINE("of", false, false, true, false),
+
+        // Transient user session
+        TRANSIENT("tr", true, false, false, false),
+
+        // Regular online user session with transient client session (Client session may not need to exist)
+        ONLINE_TRANSIENT_CLIENT("nt", false, true, false, true),
+
+        // Regular offline user session with transient client session (Client session may not need to exist)
+        OFFLINE_TRANSIENT_CLIENT("ft", false, false, true, true),
+
+        // Unknown type. Perhaps token coming from older Keycloak version than 26.2.0. No need to support transientClientSession as this was added in 26.2 with standard token-exchange
+        UNKNOWN("un", true, true, true, false);
+
+        private final String shortcut;
+        private final boolean allowTransientUserSession;
+        private final boolean allowLookupOnlineUserSession;
+        private final boolean allowLookupOfflineUserSession;
+        private final boolean allowTransientClientSession;
+
+        SessionType(String shortcut, boolean allowTransientUserSession, boolean allowLookupOnlineUserSession, boolean allowLookupOfflineUserSession, boolean allowTransientClientSession) {
+            this.shortcut = shortcut;
+            this.allowTransientUserSession = allowTransientUserSession;
+            this.allowLookupOnlineUserSession = allowLookupOnlineUserSession;
+            this.allowLookupOfflineUserSession = allowLookupOfflineUserSession;
+            this.allowTransientClientSession = allowTransientClientSession;
+        }
+
+        public String getShortcut() {
+            return shortcut;
+        }
+
+        public boolean isAllowTransientUserSession() {
+            return allowTransientUserSession;
+        }
+
+        public boolean isAllowLookupOnlineUserSession() {
+            return allowLookupOnlineUserSession;
+        }
+
+        public boolean isAllowLookupOfflineUserSession() {
+            return allowLookupOfflineUserSession;
+        }
+
+        public boolean isAllowTransientClientSession() {
+            return allowTransientClientSession;
+        }
+    }
+
+    public enum TokenType {
+        REGULAR("rt"),
+        LIGHTWEIGHT("lt"),
+        UNKNOWN("un");
+
+        private final String shortcut;
+
+        TokenType(String shortcut) {
+            this.shortcut = shortcut;
+        }
+
+        public String getShortcut() {
+            return shortcut;
+        }
+    }
+
+    @JsonCreator
+    public AccessTokenContext(@JsonProperty("sessionType") SessionType sessionType, @JsonProperty("tokenType") TokenType tokenType, @JsonProperty("grantType") String grantType, @JsonProperty("rawTokenId") String rawTokenId) {
+        Objects.requireNonNull(sessionType, "Null sessionType not allowed");
+        Objects.requireNonNull(tokenType, "Null tokenType not allowed");
+        Objects.requireNonNull(grantType, "Null grantType not allowed");
+        Objects.requireNonNull(grantType, "Null rawTokenId not allowed");
+        this.sessionType = sessionType;
+        this.tokenType = tokenType;
+        this.grantType = grantType;
+        this.rawTokenId = rawTokenId;
+    }
+
+    public SessionType getSessionType() {
+        return sessionType;
+    }
+
+    public TokenType getTokenType() {
+        return tokenType;
+    }
+
+    public String getGrantType() {
+        return grantType;
+    }
+
+    public String getRawTokenId() {
+        return rawTokenId;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        return obj instanceof AccessTokenContext that &&
+                sessionType == that.sessionType &&
+                tokenType == that.tokenType &&
+                Objects.equals(grantType, that.grantType) &&
+                Objects.equals(rawTokenId, that.rawTokenId);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(sessionType, tokenType, grantType, rawTokenId);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java
new file mode 100644
index 000000000000..01bf708af244
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProvider.java
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DefaultTokenContextEncoderProvider implements TokenContextEncoderProvider {
+
+    public static final String UNKNOWN = "na";
+
+    private final KeycloakSession session;
+    private final DefaultTokenContextEncoderProviderFactory factory;
+
+    public DefaultTokenContextEncoderProvider(KeycloakSession session,
+                                              DefaultTokenContextEncoderProviderFactory factory) {
+        this.session = session;
+        this.factory = factory;
+    }
+
+    @Override
+    public AccessTokenContext getTokenContextFromClientSessionContext(ClientSessionContext clientSessionContext, String rawTokenId) {
+        AccessTokenContext.SessionType sessionType;
+        UserSessionModel userSession = clientSessionContext.getClientSession().getUserSession();
+        if (userSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT) {
+            String createdFromPersistent = userSession.getNote(Constants.CREATED_FROM_PERSISTENT);
+            if (createdFromPersistent != null) {
+                sessionType = Constants.CREATED_FROM_PERSISTENT_OFFLINE.equals(createdFromPersistent) ? AccessTokenContext.SessionType.OFFLINE_TRANSIENT_CLIENT : AccessTokenContext.SessionType.ONLINE_TRANSIENT_CLIENT;
+            } else {
+                sessionType = AccessTokenContext.SessionType.TRANSIENT;
+            }
+        } else {
+            sessionType = clientSessionContext.isOfflineTokenRequested() ? AccessTokenContext.SessionType.OFFLINE : AccessTokenContext.SessionType.ONLINE;
+        }
+
+        boolean useLightweightToken = AbstractOIDCProtocolMapper.getShouldUseLightweightToken(session);
+        AccessTokenContext.TokenType tokenType = useLightweightToken ? AccessTokenContext.TokenType.LIGHTWEIGHT : AccessTokenContext.TokenType.REGULAR;
+
+        String grantType = clientSessionContext.getAttribute(Constants.GRANT_TYPE, String.class);
+        if (grantType == null) {
+            grantType = UNKNOWN;
+        }
+
+        return new AccessTokenContext(sessionType, tokenType, grantType, rawTokenId);
+    }
+
+    @Override
+    public AccessTokenContext getTokenContextFromTokenId(String encodedTokenId) {
+        int indexOf = encodedTokenId.indexOf(':');
+        if (indexOf == -1) {
+            return new AccessTokenContext(AccessTokenContext.SessionType.UNKNOWN, AccessTokenContext.TokenType.UNKNOWN, UNKNOWN, encodedTokenId);
+        } else {
+            String encodedContext = encodedTokenId.substring(0, indexOf);
+            String rawId = encodedTokenId.substring(indexOf + 1);
+
+            if (encodedContext.length() != 6) {
+                throw new IllegalArgumentException("Incorrect token id: '" + encodedTokenId + "'. Expected length of 6.");
+            }
+
+            // First 2 chars are "sessionType", next 2 chars "tokenType", last 2 chars "grantType"
+            String stShortcut = encodedContext.substring(0, 2);
+            String ttShortcut = encodedContext.substring(2, 4);
+            String gtShortcut = encodedContext.substring(4, 6);
+
+            AccessTokenContext.SessionType st = factory.getSessionTypeByShortcut(stShortcut);
+            if (st == null) {
+                throw new IllegalArgumentException("Incorrect token id: " + encodedTokenId + ". Unknown value '" + stShortcut + "' for session type");
+            }
+            AccessTokenContext.TokenType tt = factory.getTokenTypeByShortcut(ttShortcut);
+            if (tt == null) {
+                throw new IllegalArgumentException("Incorrect token id: " + encodedTokenId + ". Unknown value '" + ttShortcut + "' for token type");
+            }
+            String gt = factory.getGrantTypeByShortcut(gtShortcut);
+            if (gt == null) {
+                throw new IllegalArgumentException("Incorrect token id: " + encodedTokenId + ". Unknown value '" + gtShortcut + "' for grant type");
+            }
+
+            return new AccessTokenContext(st, tt, gt, rawId);
+        }
+    }
+
+    @Override
+    public String encodeTokenId(AccessTokenContext tokenContext) {
+        if (tokenContext.getSessionType() == AccessTokenContext.SessionType.UNKNOWN) {
+            throw new IllegalStateException("Cannot encode token with unknown sessionType");
+        }
+        if (tokenContext.getTokenType() == AccessTokenContext.TokenType.UNKNOWN) {
+            throw new IllegalStateException("Cannot encode token with unknown tokenType");
+        }
+
+        String grantShort = factory.getShortcutByGrantType(tokenContext.getGrantType());
+        if (grantShort == null) {
+            throw new IllegalStateException("Cannot encode token with unknown grantType: " + tokenContext.getGrantType());
+        }
+
+        return tokenContext.getSessionType().getShortcut() +
+                tokenContext.getTokenType().getShortcut() +
+                grantShort +
+                ':' + tokenContext.getRawTokenId();
+    }
+
+    @Override
+    public void close() {
+
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderFactory.java
new file mode 100644
index 000000000000..54df0d22eb2a
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderFactory.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
+import org.keycloak.protocol.oidc.grants.OAuth2GrantTypeFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DefaultTokenContextEncoderProviderFactory implements TokenContextEncoderProviderFactory {
+
+    private KeycloakSessionFactory sessionFactory;
+    private Map<String, AccessTokenContext.SessionType> sessionTypesByShortcut;
+    private Map<String, AccessTokenContext.TokenType> tokenTypesByShortcut;
+    Map<String, String> grantsByShortcuts;
+    Map<String, String> grantsToShortcuts;
+
+    @Override
+    public TokenContextEncoderProvider create(KeycloakSession session) {
+        return new DefaultTokenContextEncoderProvider(session, this);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        sessionTypesByShortcut = new HashMap<>();
+        for (AccessTokenContext.SessionType st : AccessTokenContext.SessionType.values()) {
+            sessionTypesByShortcut.put(st.getShortcut(), st);
+        }
+        sessionTypesByShortcut = Collections.unmodifiableMap(sessionTypesByShortcut);
+
+        tokenTypesByShortcut = new HashMap<>();
+        for (AccessTokenContext.TokenType tt : AccessTokenContext.TokenType.values()) {
+            tokenTypesByShortcut.put(tt.getShortcut(), tt);
+        }
+        tokenTypesByShortcut = Collections.unmodifiableMap(tokenTypesByShortcut);
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        this.sessionFactory = factory;
+        grantsByShortcuts = new ConcurrentHashMap<>();
+        grantsToShortcuts = new ConcurrentHashMap<>();
+
+        factory.getProviderFactoriesStream(OAuth2GrantType.class)
+                .forEach((factory1) -> {
+                    OAuth2GrantTypeFactory gtf = (OAuth2GrantTypeFactory) factory1;
+                    String grantName = gtf.getId();
+                    String grantShortcut = gtf.getShortcut();
+                    grantsByShortcuts.put(grantShortcut, grantName);
+                    grantsToShortcuts.put(grantName, grantShortcut);
+                });
+        grantsByShortcuts.put(DefaultTokenContextEncoderProvider.UNKNOWN, DefaultTokenContextEncoderProvider.UNKNOWN);
+        grantsToShortcuts.put(DefaultTokenContextEncoderProvider.UNKNOWN, DefaultTokenContextEncoderProvider.UNKNOWN);
+
+        // Validation if there are not duplicated shortcuts (for example when introducing new grant impl...)
+        if (grantsByShortcuts.size() != grantsToShortcuts.size()) {
+            throw new IllegalStateException("Different lengths of maps. grantsByShortcuts.size=" + grantsByShortcuts.size() + ", grantsToShortcuts.size=" + grantsToShortcuts.size() +
+                    ". Make sure that there is no OAuth2GrantType implementation with same ID or shortcut like other grants");
+        }
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    protected AccessTokenContext.SessionType getSessionTypeByShortcut(String sessionTypeShortcut) {
+        return sessionTypesByShortcut.get(sessionTypeShortcut);
+    }
+
+    protected AccessTokenContext.TokenType getTokenTypeByShortcut(String tokenTypeShortcut) {
+        return tokenTypesByShortcut.get(tokenTypeShortcut);
+    }
+
+    protected String getShortcutByGrantType(String grantType) {
+        String grantShortcut = grantsToShortcuts.get(grantType);
+        if (grantShortcut == null) {
+            // Refresh maps in case new grant type was deployed
+            OAuth2GrantTypeFactory factory = (OAuth2GrantTypeFactory) sessionFactory.getProviderFactory(OAuth2GrantType.class, grantType);
+            if (factory != null) {
+                String shortcut = factory.getShortcut();
+                grantsByShortcuts.put(shortcut, grantType);
+                grantsToShortcuts.put(grantType, shortcut);
+            }
+            grantShortcut = grantsToShortcuts.get(grantType);
+        }
+        return grantShortcut;
+    }
+
+    protected String getGrantTypeByShortcut(String shortcut) {
+        String grantType = grantsByShortcuts.get(shortcut);
+        if (grantType == null) {
+            // Refresh maps in case new grant type was deployed
+            sessionFactory.getProviderFactoriesStream(OAuth2GrantType.class)
+                    .map(fct -> (OAuth2GrantTypeFactory) fct)
+                    .filter(fct -> shortcut.equals(fct.getShortcut()))
+                    .map(OAuth2GrantTypeFactory::getId)
+                    .findFirst()
+                    .ifPresent(newGrantType -> {
+                        grantsByShortcuts.put(shortcut, newGrantType);
+                        grantsToShortcuts.put(newGrantType, shortcut);
+                    });
+            grantType = grantsByShortcuts.get(shortcut);
+        }
+        return grantType;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProvider.java
new file mode 100644
index 000000000000..907a6eb83250
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProvider.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.provider.Provider;
+
+/**
+ * Provides ability to encode some context into access token ID, so this information can be later retrieved from the token without the need to use some proprietary/non-standard claims.
+ * For example token context can contain info whether it is lightweight access token or regular token, whether it is coming from online session or offline session etc.
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface TokenContextEncoderProvider extends Provider {
+
+    AccessTokenContext getTokenContextFromClientSessionContext(ClientSessionContext clientSessionContext, String rawTokenId);
+
+    AccessTokenContext getTokenContextFromTokenId(String encodedTokenId);
+
+    String encodeTokenId(AccessTokenContext tokenContext);
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProviderFactory.java
new file mode 100644
index 000000000000..252184a21e89
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderProviderFactory.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface TokenContextEncoderProviderFactory extends ProviderFactory<TokenContextEncoderProvider> {
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderSpi.java b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderSpi.java
new file mode 100644
index 000000000000..52e77fb306d1
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/encode/TokenContextEncoderSpi.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class TokenContextEncoderSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "tokenContextEncoder";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return TokenContextEncoderProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return TokenContextEncoderProviderFactory.class;
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java
index 4252682533a5..714c91bdf507 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java
@@ -47,6 +47,7 @@
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
 import org.keycloak.services.clientpolicy.context.PreAuthorizationRequestContext;
+import org.keycloak.services.managers.AuthenticationSessionManager;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.resources.LoginActionsService;
 import org.keycloak.services.util.CacheControlUtil;
@@ -137,6 +138,10 @@ private Response process(final MultivaluedMap<String, String> params) {
         try {
             session.clientPolicy().triggerOnEvent(new PreAuthorizationRequestContext(clientId, params));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorPageException(session, authenticationSession, cpe.getErrorStatus(), cpe.getErrorDetail());
         }
         checkClient(clientId);
@@ -193,13 +198,19 @@ private Response process(final MultivaluedMap<String, String> params) {
             request.setDpopJkt(dpopJkt);
         }
 
+        authenticationSession = createAuthenticationSession(client, request.getState());
+
         try {
-            session.clientPolicy().triggerOnEvent(new AuthorizationRequestContext(parsedResponseType, request, redirectUri, params));
+            session.clientPolicy().triggerOnEvent(new AuthorizationRequestContext(parsedResponseType, request, redirectUri, params, authenticationSession));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
+            new AuthenticationSessionManager(session).removeAuthenticationSession(realm, authenticationSession, false);
             return redirectErrorToClient(parsedResponseMode, cpe.getError(), cpe.getErrorDetail());
         }
 
-        authenticationSession = createAuthenticationSession(client, request.getState());
         updateAuthenticationSession();
 
         // So back button doesn't work
@@ -366,6 +377,7 @@ private void updateAuthenticationSession() {
             }
         }).min().ifPresent(loa -> authenticationSession.setClientNote(Constants.REQUESTED_LEVEL_OF_AUTHENTICATION, String.valueOf(loa)));
 
+
         if (request.getAdditionalReqParams() != null) {
             for (String paramName : request.getAdditionalReqParams().keySet()) {
                 authenticationSession.setClientNote(LOGIN_SESSION_NOTE_ADDITIONAL_REQ_PARAMS_PREFIX + paramName, request.getAdditionalReqParams().get(paramName));
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
index bb5964826d4b..3ec1f21f95db 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
@@ -39,6 +39,7 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -410,9 +411,20 @@ private Response doBrowserLogout(AuthenticationSessionModel logoutSession) {
             try {
                 userSession = session.sessions().getUserSession(realm, userSessionIdFromIdToken);
 
+                if (userSession == null) {
+                    userSession = session.sessions().getOfflineUserSession(realm, userSessionIdFromIdToken);
+                }
+
                 if (userSession == null) {
                     event.event(EventType.LOGOUT);
                     event.error(Errors.SESSION_EXPIRED);
+                    KeycloakContext context = session.getContext();
+                    AuthenticationSessionModel authSession = context.getAuthenticationSession();
+
+                    if (authSession != null) {
+                        // no valid session, make sure the current root auth session is also deleted and restart cookies
+                        new AuthenticationSessionManager(session).removeAuthenticationSession(authSession.getRealm(), authSession, true);
+                    }
                 } else {
                     Integer idTokenIssuedAt = Integer.parseInt(idTokenIssuedAtStr);
                     checkTokenIssuedAt(idTokenIssuedAt, userSession);
@@ -490,6 +502,10 @@ private Response logoutToken() {
             session.clientPolicy().triggerOnEvent(new LogoutRequestContext(form));
             refreshToken = form.getFirst(OAuth2Constants.REFRESH_TOKEN);
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
index 8c4c474fd2cb..908381a06cff 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenIntrospectionEndpoint.java
@@ -17,6 +17,7 @@
 package org.keycloak.protocol.oidc.endpoints;
 
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.events.Details;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.common.ClientConnection;
 import org.keycloak.events.Errors;
@@ -102,16 +103,15 @@ public Response introspect() {
             session.clientPolicy().triggerOnEvent(new TokenIntrospectContext(formParams));
             token = formParams.getFirst(PARAM_TOKEN);
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw throwErrorResponseException(Errors.INVALID_REQUEST, cpe.getErrorDetail(), Status.BAD_REQUEST);
         }
 
         try {
-
-            Response response = provider.introspect(token, event);
-
-            this.event.success();
-
-            return response;
+            return provider.introspect(token, event);
         } catch (ErrorResponseException ere) {
             throw ere;
         } catch (Exception e) {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
index e01912d3408c..79438475a896 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenRevocationEndpoint.java
@@ -17,7 +17,10 @@
 
 package org.keycloak.protocol.oidc.endpoints;
 
+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.List;
+import java.util.Map;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.OPTIONS;
@@ -37,6 +40,7 @@
 import org.keycloak.http.HttpRequest;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.SingleUseObjectProvider;
@@ -100,6 +104,9 @@ public Response revoke() {
         try {
             session.clientPolicy().triggerOnEvent(new TokenRevokeContext(formParams));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
@@ -124,6 +131,9 @@ public Response revoke() {
         try {
             session.clientPolicy().triggerOnEvent(new TokenRevokeResponseContext(formParams));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
@@ -256,6 +266,9 @@ private void revokeClientSession() {
             AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
             if (clientSession != null) {
                 TokenManager.dettachClientSession(clientSession);
+
+                revokeTokenExchangeSession(userSession);
+
                 // TODO: Might need optimization to prevent loading client sessions from cache in getAuthenticatedClientSessions()
                 if (userSession.getAuthenticatedClientSessions().isEmpty()) {
                     session.sessions().removeUserSession(realm, userSession);
@@ -269,5 +282,29 @@ private void revokeAccessToken() {
         int currentTime = Time.currentTime();
         long lifespanInSecs = Math.max(token.getExp() - currentTime + 1, 10);
         singleUseStore.put(token.getId() + SingleUseObjectProvider.REVOKED_KEY, lifespanInSecs, Collections.emptyMap());
+        revokeTokenExchangeSession();
+    }
+
+    private void revokeTokenExchangeSession() {
+        if (token.getSessionId() != null) {
+            UserSessionModel userSession = session.sessions().getUserSession(realm, token.getSessionId());
+            if (userSession != null) {
+                revokeTokenExchangeSession(userSession);
+            }
+        }
+    }
+
+    private void revokeTokenExchangeSession(UserSessionModel userSession) {
+        Map<String, AuthenticatedClientSessionModel> clientSessionModelMap = userSession.getAuthenticatedClientSessions();
+        List<String> revokedClients = new ArrayList<>();
+        clientSessionModelMap.forEach((key, clientSessionModel) -> {
+            if (clientSessionModel.getNote(Constants.TOKEN_EXCHANGE_SUBJECT_CLIENT + token.getIssuedFor()) != null) {
+                revokedClients.add(clientSessionModel.getClient().getClientId());
+                TokenManager.dettachClientSession(clientSessionModel);
+            }
+        });
+        if (!revokedClients.isEmpty()) {
+            event.detail(Details.TOKEN_EXCHANGE_REVOKED_CLIENTS, String.join(",", revokedClients));
+        }
     }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java
index c62c7bc871e6..5a6dcd3039ac 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java
@@ -22,7 +22,6 @@
 import org.keycloak.TokenCategory;
 import org.keycloak.TokenVerifier;
 import org.keycloak.common.ClientConnection;
-import org.keycloak.common.Profile;
 import org.keycloak.common.VerificationException;
 import org.keycloak.crypto.ContentEncryptionProvider;
 import org.keycloak.crypto.CekManagementProvider;
@@ -52,7 +51,6 @@
 import org.keycloak.protocol.oidc.TokenManager;
 import org.keycloak.protocol.oidc.TokenManager.NotBeforeCheck;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.dpop.DPoP;
 import org.keycloak.services.Urls;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.context.UserInfoRequestContext;
@@ -159,16 +157,20 @@ public Response issueUserInfoPost() {
     private Response issueUserInfo() {
         cors.allowAllOrigins();
 
+        EventBuilder event = new EventBuilder(realm, session, clientConnection)
+                .event(EventType.USER_INFO_REQUEST)
+                .detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN);
+
         try {
             session.clientPolicy().triggerOnEvent(new UserInfoRequestContext(tokenForUserInfo));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw error.error(cpe.getError()).errorDescription(cpe.getErrorDetail()).status(cpe.getErrorStatus()).build();
         }
 
-        EventBuilder event = new EventBuilder(realm, session, clientConnection)
-                .event(EventType.USER_INFO_REQUEST)
-                .detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN);
-
         if (tokenForUserInfo.getToken() == null) {
             event.detail(Details.REASON, "Missing token");
             event.error(Errors.INVALID_TOKEN);
@@ -181,6 +183,8 @@ private Response issueUserInfo() {
             TokenVerifier<AccessToken> verifier = TokenVerifier.create(tokenForUserInfo.getToken(), AccessToken.class).withDefaultChecks()
                     .realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
 
+            verifier = DPoPUtil.withDPoPVerifier(verifier, realm, new DPoPUtil.Validator(session).request(request).uriInfo(session.getContext().getUri()).accessToken(tokenForUserInfo.getToken()));
+
             SignatureVerifierContext verifierContext = session.getProvider(SignatureProvider.class, verifier.getHeader().getAlgorithm().name()).verifier(verifier.getHeader().getKeyId());
             verifier.verifierContext(verifierContext);
 
@@ -229,7 +233,14 @@ private Response issueUserInfo() {
             throw error.invalidToken("Client disabled");
         }
 
-        UserSessionModel userSession = UserSessionUtil.findValidSession(session, realm, token, event, clientModel, error);
+        event.session(token.getSessionId());
+        UserSessionUtil.UserSessionValidationResult userSessionValidation = UserSessionUtil.findValidSessionForAccessToken(session, realm, token, clientModel, (invalidUserSession -> {}));
+        if (userSessionValidation.getError() != null) {
+            event.error(userSessionValidation.getError());
+            throw error.invalidToken(userSessionValidation.getError());
+        }
+
+        UserSessionModel userSession = userSessionValidation.getUserSession();
 
         UserModel userModel = userSession.getUser();
         if (userModel == null) {
@@ -256,20 +267,6 @@ private Response issueUserInfo() {
             }
         }
 
-        if (Profile.isFeatureEnabled(Profile.Feature.DPOP)) {
-            if (OIDCAdvancedConfigWrapper.fromClientModel(clientModel).isUseDPoP() || DPoPUtil.DPOP_TOKEN_TYPE.equals(token.getType())) {
-                try {
-                    DPoP dPoP = new DPoPUtil.Validator(session).request(request).uriInfo(session.getContext().getUri()).validate();
-                    DPoPUtil.validateBinding(token, dPoP);
-                } catch (VerificationException ex) {
-                    String errorMessage = "DPoP proof and token binding verification failed";
-                    event.detail(Details.REASON, errorMessage + ": " + ex.getMessage());
-                    event.error(Errors.NOT_ALLOWED);
-                    throw error.invalidToken(errorMessage);
-                }
-            }
-        }
-
         // Existence of authenticatedClientSession for our client already handled before
         AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(clientModel.getId());
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantType.java
index a2af5662a041..90b3f2476f93 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantType.java
@@ -40,7 +40,6 @@
 import org.keycloak.protocol.oidc.utils.OAuth2Code;
 import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
 import org.keycloak.protocol.oidc.utils.PkceUtils;
-import org.keycloak.representations.dpop.DPoP;
 import org.keycloak.services.CorsErrorResponseException;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.context.TokenRequestContext;
@@ -182,6 +181,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new TokenRequestContext(formParams, parseResult));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_GRANT, cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantTypeFactory.java
index cd4a5ddd8a23..82a9751ee1ba 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/AuthorizationCodeGrantTypeFactory.java
@@ -29,11 +29,18 @@
  */
 public class AuthorizationCodeGrantTypeFactory implements OAuth2GrantTypeFactory {
 
+    public static final String GRANT_SHORTCUT = "ac";
+
     @Override
     public String getId() {
         return OAuth2Constants.AUTHORIZATION_CODE;
     }
 
+    @Override
+    public String getShortcut() {
+        return GRANT_SHORTCUT;
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new AuthorizationCodeGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantType.java
index c8056472669e..458ef9c20e19 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantType.java
@@ -29,6 +29,7 @@
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
@@ -115,22 +116,25 @@ public Response process(Context context) {
         }
 
         UserSessionModel userSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, clientUser, clientUsername,
-                clientConnection.getRemoteAddr(), ServiceAccountConstants.CLIENT_AUTH, false, null, null, sessionPersistenceState);
+                clientConnection.getRemoteHost(), ServiceAccountConstants.CLIENT_AUTH, false, null, null, sessionPersistenceState);
         event.session(userSession);
 
         AuthenticationManager.setClientScopesInSession(session, authSession);
         ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(session, userSession, authSession);
+        clientSessionCtx.setAttribute(Constants.GRANT_TYPE, context.getGrantType());
 
         // Notes about client details
         userSession.setNote(ServiceAccountConstants.CLIENT_ID_SESSION_NOTE, client.getClientId()); // This is for backwards compatibility
         userSession.setNote(ServiceAccountConstants.CLIENT_ID, client.getClientId());
         userSession.setNote(ServiceAccountConstants.CLIENT_HOST, clientConnection.getRemoteHost());
-        userSession.setNote(ServiceAccountConstants.CLIENT_ADDRESS, clientConnection.getRemoteAddr());
+        userSession.setNote(ServiceAccountConstants.CLIENT_ADDRESS, clientConnection.getRemoteHost());
 
         try {
             session.clientPolicy().triggerOnEvent(new ServiceAccountTokenRequestContext(formParams, clientSessionCtx.getClientSession()));
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
@@ -149,6 +153,7 @@ public Response process(Context context) {
             }
         } else {
             responseBuilder.getAccessToken().setSessionId(null);
+            event.session((String) null);
         }
 
         checkAndBindMtlsHoKToken(responseBuilder, useRefreshToken);
@@ -161,7 +166,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new ServiceAccountTokenResponseContext(formParams, clientSessionCtx.getClientSession(), responseBuilder));
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantTypeFactory.java
index cd72faad7554..84ee1f43d131 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ClientCredentialsGrantTypeFactory.java
@@ -35,6 +35,11 @@ public String getId() {
         return OAuth2Constants.CLIENT_CREDENTIALS;
     }
 
+    @Override
+    public String getShortcut() {
+        return "cc";
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new ClientCredentialsGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
index eaf936d710ad..b82ac2e8c5e3 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/OAuth2GrantTypeBase.java
@@ -21,13 +21,7 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.Response;
-
-import java.util.Map;
-import java.util.Objects;
-import java.util.function.Function;
-
 import org.jboss.logging.Logger;
-
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.authentication.AuthenticationProcessor;
@@ -42,6 +36,7 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -61,6 +56,10 @@
 import org.keycloak.services.util.MtlsHoKTokenUtil;
 import org.keycloak.util.TokenUtil;
 
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Function;
+
 /**
  * Base class for OAuth 2.0 grant types
  *
@@ -105,6 +104,7 @@ protected void setContext(Context context) {
 
     protected Response createTokenResponse(UserModel user, UserSessionModel userSession, ClientSessionContext clientSessionCtx,
         String scopeParam, boolean code, Function<TokenManager.AccessTokenResponseBuilder, ClientPolicyContext> clientPolicyContextGenerator) {
+        clientSessionCtx.setAttribute(Constants.GRANT_TYPE, context.getGrantType());
         AccessToken token = tokenManager.createClientAccessToken(session, realm, client, user, userSession, clientSessionCtx);
 
         TokenManager.AccessTokenResponseBuilder responseBuilder = tokenManager
@@ -129,7 +129,9 @@ protected Response createTokenResponse(UserModel user, UserSessionModel userSess
             try {
                 session.clientPolicy().triggerOnEvent(clientPolicyContextGenerator.apply(responseBuilder));
             } catch (ClientPolicyException cpe) {
-                event.detail(Details.REASON, cpe.getErrorDetail());
+                event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+                event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+                event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
                 event.error(cpe.getError());
                 throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
             }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantTypeFactory.java
index fcf4db0414af..5160270f7079 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/PermissionGrantTypeFactory.java
@@ -35,6 +35,11 @@ public String getId() {
         return OAuth2Constants.UMA_GRANT_TYPE;
     }
 
+    @Override
+    public String getShortcut() {
+        return "pg";
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new PermissionGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java
index 28dd5bfd8069..2e9609cc561a 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantType.java
@@ -29,6 +29,7 @@
 import org.keycloak.events.EventType;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.protocol.oidc.utils.OAuth2Code;
 import org.keycloak.protocol.oidc.utils.OAuth2CodeParser;
@@ -78,7 +79,7 @@ public Response process(Context context) {
         ClientSessionContext sessionContext = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession,
                 OAuth2Constants.SCOPE_OPENID, session);
         clientSession.setNote(VC_ISSUANCE_FLOW, PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE);
-
+        sessionContext.setAttribute(Constants.GRANT_TYPE, PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE);
 
         // set the client as retrieved from the pre-authorized session
         session.getContext().setClient(result.getClientSession().getClient());
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantTypeFactory.java
index be13b00bd43b..e3a318e592ed 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/PreAuthorizedCodeGrantTypeFactory.java
@@ -55,6 +55,11 @@ public String getId() {
         return GRANT_TYPE;
     }
 
+    @Override
+    public String getShortcut() {
+        return "pc";
+    }
+
     @Override
     public boolean isSupported(Config.Scope config) {
         return Profile.isFeatureEnabled(Profile.Feature.OID4VC_VCI);
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
index 8f48f2535cf2..9da60dc1ac47 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantType.java
@@ -24,7 +24,6 @@
 
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
-import org.keycloak.common.Profile;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
@@ -63,7 +62,9 @@ public Response process(Context context) {
             session.clientPolicy().triggerOnEvent(new TokenRefreshContext(formParams));
             refreshToken = formParams.getFirst(OAuth2Constants.REFRESH_TOKEN);
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
@@ -98,7 +99,9 @@ public Response process(Context context) {
                 throw new CorsErrorResponseException(cors, e.getError(), e.getDescription(), Response.Status.BAD_REQUEST);
             }
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantTypeFactory.java
index 586a65dbfb36..12887d734342 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/RefreshTokenGrantTypeFactory.java
@@ -30,11 +30,18 @@
  */
 public class RefreshTokenGrantTypeFactory implements OAuth2GrantTypeFactory {
 
+    public static final String GRANT_SHORTCUT = "rt";
+
     @Override
     public String getId() {
         return OAuth2Constants.REFRESH_TOKEN;
     }
 
+    @Override
+    public String getShortcut() {
+        return GRANT_SHORTCUT;
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new RefreshTokenGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
index c0583327505a..7b17b7a621db 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantType.java
@@ -31,6 +31,7 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.utils.AuthenticationFlowResolver;
@@ -81,7 +82,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new ResourceOwnerPasswordCredentialsContext(formParams));
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
@@ -130,6 +133,7 @@ public Response process(Context context) {
         AuthenticationManager.setClientScopesInSession(session, authSession);
 
         ClientSessionContext clientSessionCtx = processor.attachSession();
+        clientSessionCtx.setAttribute(Constants.GRANT_TYPE, context.getGrantType());
         UserSessionModel userSession = processor.getUserSession();
         updateUserSessionFromClientAuth(userSession);
 
@@ -154,7 +158,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new ResourceOwnerPasswordCredentialsResponseContext(formParams, clientSessionCtx, responseBuilder));
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantTypeFactory.java
index 05b2e4f089d6..e17bc1bf5255 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ResourceOwnerPasswordCredentialsGrantTypeFactory.java
@@ -35,6 +35,11 @@ public String getId() {
         return OAuth2Constants.PASSWORD;
     }
 
+    @Override
+    public String getShortcut() {
+        return "ro";
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new ResourceOwnerPasswordCredentialsGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantType.java
index b334f1d7331e..d806bdcae16f 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantType.java
@@ -23,10 +23,15 @@
 import jakarta.ws.rs.core.Response;
 
 import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
 import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
 import org.keycloak.protocol.oidc.TokenExchangeContext;
 import org.keycloak.protocol.oidc.TokenExchangeProvider;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.context.TokenExchangeRequestContext;
 
 /**
  * OAuth 2.0 Authorization Code Grant
@@ -57,14 +62,34 @@ public Response process(Context context) {
                 tokenManager,
                 clientAuthAttributes);
 
-        return session.getKeycloakSessionFactory()
+        TokenExchangeProvider tokenExchangeProvider = session.getKeycloakSessionFactory()
                 .getProviderFactoriesStream(TokenExchangeProvider.class)
                 .sorted((f1, f2) -> f2.order() - f1.order())
                 .map(f -> session.getProvider(TokenExchangeProvider.class, f.getId()))
                 .filter(p -> p.supports(exchange))
                 .findFirst()
-                .orElseThrow(() -> new InternalServerErrorException("No token exchange provider available"))
-                .exchange(exchange);
+                .orElseThrow(() -> {
+                    if (exchange.getUnsupportedReason() != null) {
+                        event.detail(Details.REASON, exchange.getUnsupportedReason());
+                        event.error(Errors.INVALID_REQUEST);
+                        return new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, exchange.getUnsupportedReason(), Response.Status.BAD_REQUEST);
+                    } else {
+                        return new InternalServerErrorException("No token exchange provider available");
+                    }
+                });
+
+        try {
+            //trigger if there is a supported token exchange provider
+            session.clientPolicy().triggerOnEvent(new TokenExchangeRequestContext(exchange));
+        } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
+            throw new CorsErrorResponseException(cors, cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
+        }
+
+        return tokenExchangeProvider.exchange(exchange);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantTypeFactory.java
index b171dfaa558e..3645377750bc 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/TokenExchangeGrantTypeFactory.java
@@ -37,6 +37,11 @@ public String getId() {
         return OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE;
     }
 
+    @Override
+    public String getShortcut() {
+        return "te";
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new TokenExchangeGrantType();
@@ -44,7 +49,8 @@ public OAuth2GrantType create(KeycloakSession session) {
 
     @Override
     public boolean isSupported(Config.Scope config) {
-        return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE);
+        return     Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE)
+                || Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE_STANDARD_V2);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
index 099de7175414..b8537ec2f982 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantType.java
@@ -24,10 +24,8 @@
 import jakarta.ws.rs.core.UriBuilder;
 
 import org.jboss.logging.Logger;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.authentication.AuthenticationProcessor;
-import org.keycloak.common.Profile;
 import org.keycloak.common.util.Time;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
@@ -35,7 +33,6 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientSessionContext;
-import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OAuth2DeviceCodeModel;
 import org.keycloak.models.UserConsentModel;
 import org.keycloak.models.UserModel;
@@ -44,14 +41,12 @@
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
 import org.keycloak.protocol.oidc.TokenManager;
-import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
 import org.keycloak.protocol.oidc.grants.OAuth2GrantTypeBase;
 import org.keycloak.protocol.oidc.grants.ciba.channel.CIBAAuthenticationRequest;
 import org.keycloak.protocol.oidc.grants.ciba.clientpolicy.context.BackchannelTokenRequestContext;
 import org.keycloak.protocol.oidc.grants.ciba.clientpolicy.context.BackchannelTokenResponseContext;
 import org.keycloak.protocol.oidc.grants.ciba.endpoints.CibaRootEndpoint;
 import org.keycloak.protocol.oidc.grants.device.DeviceGrantType;
-import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.services.CorsErrorResponseException;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.Urls;
@@ -145,6 +140,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new BackchannelTokenRequestContext(request, formParams));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_GRANT, cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantTypeFactory.java
index b24a39b393c9..ab6fd013f6b5 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/CibaGrantTypeFactory.java
@@ -34,11 +34,18 @@
  */
 public class CibaGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
 
+    public static final String GRANT_SHORTCUT = "ci";
+
     @Override
     public String getId() {
         return OAuth2Constants.CIBA_GRANT_TYPE;
     }
 
+    @Override
+    public String getShortcut() {
+        return GRANT_SHORTCUT;
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new CibaGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
index f41f357e1994..4b47c80f020d 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/ciba/endpoints/BackchannelAuthenticationEndpoint.java
@@ -19,6 +19,7 @@
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.events.Details;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
@@ -179,7 +180,7 @@ private CIBAAuthenticationRequest authorizeClient(MultivaluedMap<String, String>
                     Response.Status.BAD_REQUEST);
         }
         if (!TokenManager.isValidScope(session, scope, client, user)) {
-            throw new ErrorResponseException(OAuthErrorException.INVALID_REQUEST, "Invalid scopes: " + scope,
+            throw new ErrorResponseException(OAuthErrorException.INVALID_SCOPE, "Invalid scopes: " + scope,
                     Response.Status.BAD_REQUEST);
         }
         request.setScope(scope);
@@ -232,6 +233,10 @@ private CIBAAuthenticationRequest authorizeClient(MultivaluedMap<String, String>
         try {
             session.clientPolicy().triggerOnEvent(new BackchannelAuthenticationRequestContext(endpointRequest, request, params));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantType.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantType.java
index bd4c89ada3fa..da8fc0ad0d9c 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantType.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantType.java
@@ -163,6 +163,17 @@ public static OAuth2DeviceCodeModel getDeviceByDeviceCode(KeycloakSession sessio
         return deviceCodeModel;
     }
 
+    public static boolean isDeviceCodeDeniedForDeviceVerificationFlow(KeycloakSession session, RealmModel realm, AuthenticationSessionModel authSession) {
+        if (DeviceGrantType.isOAuth2DeviceVerificationFlow(authSession)) {
+            String verifiedUserCode = authSession.getClientNote(DeviceGrantType.OAUTH2_DEVICE_VERIFIED_USER_CODE);
+            OAuth2DeviceCodeModel deviceCodeModel = DeviceEndpoint.getDeviceByUserCode(session, realm, verifiedUserCode);
+            if (deviceCodeModel != null) {
+                return deviceCodeModel.isDenied();
+            }
+        }
+        return false;
+    }
+
     public static void removeDeviceByDeviceCode(KeycloakSession session, String deviceCode) {
         SingleUseObjectProvider singleUseStore = session.singleUseObjects();
         singleUseStore.remove(OAuth2DeviceCodeModel.createKey(deviceCode));
@@ -322,7 +333,9 @@ public Response process(Context context) {
         try {
             session.clientPolicy().triggerOnEvent(new DeviceTokenRequestContext(deviceCodeModel, formParams));
         } catch (ClientPolicyException cpe) {
-            event.detail(Details.REASON, cpe.getErrorDetail());
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
             event.error(cpe.getError());
             throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_GRANT, cpe.getErrorDetail(),
                 Response.Status.BAD_REQUEST);
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantTypeFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantTypeFactory.java
index bf8791ae6a50..6b2f226513ca 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantTypeFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/DeviceGrantTypeFactory.java
@@ -34,11 +34,18 @@
  */
 public class DeviceGrantTypeFactory implements OAuth2GrantTypeFactory, EnvironmentDependentProviderFactory {
 
+    public static final String GRANT_SHORTCUT = "dg";
+
     @Override
     public String getId() {
         return OAuth2Constants.DEVICE_CODE_GRANT_TYPE;
     }
 
+    @Override
+    public String getShortcut() {
+        return GRANT_SHORTCUT;
+    }
+
     @Override
     public OAuth2GrantType create(KeycloakSession session) {
         return new DeviceGrantType();
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/endpoints/DeviceEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/endpoints/DeviceEndpoint.java
index 42b7a046b749..6123c7d56f58 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/grants/device/endpoints/DeviceEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/grants/device/endpoints/DeviceEndpoint.java
@@ -151,6 +151,10 @@ public Response handleDeviceRequest() {
         try {
             session.clientPolicy().triggerOnEvent(new DeviceAuthorizationRequestContext(request, httpRequest.getDecodedFormParameters()));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractOIDCProtocolMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractOIDCProtocolMapper.java
index 98bb964e2074..d479903073b6 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractOIDCProtocolMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractOIDCProtocolMapper.java
@@ -81,7 +81,7 @@ public AccessToken transformUserInfoToken(AccessToken token, ProtocolMapperModel
         return token;
     }
 
-    boolean getShouldUseLightweightToken(KeycloakSession session) {
+    public static boolean getShouldUseLightweightToken(KeycloakSession session) {
         Object attributeValue = session.getAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED);
         return Boolean.parseBoolean(session.getContext().getClient().getAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED)) || (attributeValue != null && (boolean) attributeValue);
     }
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractPairwiseSubMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractPairwiseSubMapper.java
index fd9389644b55..662de7b07ce3 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractPairwiseSubMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractPairwiseSubMapper.java
@@ -13,6 +13,7 @@
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.IDToken;
+import org.keycloak.representations.LogoutToken;
 
 import java.util.ArrayList;
 import java.util.LinkedList;
@@ -23,7 +24,7 @@
  *
  * @author <a href="mailto:martin.hardselius@gmail.com">Martin Hardselius</a>
  */
-public abstract class AbstractPairwiseSubMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper {
+public abstract class AbstractPairwiseSubMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper, LogoutTokenMapper {
     public static final String PROVIDER_ID_SUFFIX = "-pairwise-sub-mapper";
 
     public abstract String getIdPrefix();
@@ -82,6 +83,11 @@ public AccessToken transformIntrospectionToken(AccessToken token, ProtocolMapper
         return token;
     }
 
+    @Override
+    public LogoutToken transformLogoutToken(LogoutToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
+        setLogoutTokenSubject(token, generateSub(mappingModel, getSectorIdentifier(clientSessionCtx.getClientSession().getClient(), mappingModel), userSession.getUser().getId()));
+        return token;
+    }
     @Override
     public AccessToken transformUserInfoToken(AccessToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
         setUserInfoTokenSubject(token, generateSub(mappingModel, getSectorIdentifier(clientSessionCtx.getClientSession().getClient(), mappingModel), userSession.getUser().getId()));
@@ -96,6 +102,10 @@ protected void setAccessTokenSubject(IDToken token, String pairwiseSub) {
         token.setSubject(pairwiseSub);
     }
 
+    protected void setLogoutTokenSubject(LogoutToken token, String pairwiseSub) {
+        token.setSubject(pairwiseSub);
+    }
+
     protected void setUserInfoTokenSubject(IDToken token, String pairwiseSub) {
         token.getOtherClaims().put("sub", pairwiseSub);
     }
@@ -130,4 +140,4 @@ public final void validateConfig(KeycloakSession session, RealmModel realm, Prot
     public final String getId() {
         return "oidc-" + getIdPrefix() + PROVIDER_ID_SUFFIX;
     }
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractUserRoleMappingMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractUserRoleMappingMapper.java
index dbd61ed4428c..6b9491f74f9e 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractUserRoleMappingMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AbstractUserRoleMappingMapper.java
@@ -38,7 +38,7 @@
  *
  * @author <a href="mailto:thomas.darimont@gmail.com">Thomas Darimont</a>
  */
-abstract class AbstractUserRoleMappingMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper {
+public abstract class AbstractUserRoleMappingMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper, TokenIntrospectionTokenMapper {
 
     @Override
     public int getPriority() {
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java
index c65e321cf381..fca2f0ffc8c0 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/AudienceProtocolMapper.java
@@ -41,7 +41,7 @@ public class AudienceProtocolMapper extends AbstractOIDCProtocolMapper implement
     private static final String INCLUDED_CLIENT_AUDIENCE_LABEL = "included.client.audience.label";
     private static final String INCLUDED_CLIENT_AUDIENCE_HELP_TEXT = "included.client.audience.tooltip";
 
-    private static final String INCLUDED_CUSTOM_AUDIENCE = "included.custom.audience";
+    public static final String INCLUDED_CUSTOM_AUDIENCE = "included.custom.audience";
     private static final String INCLUDED_CUSTOM_AUDIENCE_LABEL = "included.custom.audience.label";
     private static final String INCLUDED_CUSTOM_AUDIENCE_HELP_TEXT = "included.custom.audience.tooltip";
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/LogoutTokenMapper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/LogoutTokenMapper.java
new file mode 100644
index 000000000000..f9838bc47fc2
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/LogoutTokenMapper.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.protocol.oidc.mappers;
+
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.representations.LogoutToken;
+
+/**
+ * @author <a href="mailto:steffen@ritters.email">Steffen Ritter</a>
+ */
+public interface LogoutTokenMapper {
+
+    LogoutToken transformLogoutToken(LogoutToken token, ProtocolMapperModel mappingModel, KeycloakSession session, UserSessionModel userSession, ClientSessionContext clientSessionCtx);
+
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java
index 40fff27e8db3..6ba4d19bfe70 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java
@@ -18,6 +18,7 @@
 package org.keycloak.protocol.oidc.par.endpoints;
 
 import jakarta.ws.rs.core.MultivaluedMap;
+import org.keycloak.events.Details;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.common.Profile;
@@ -26,8 +27,6 @@
 import org.keycloak.headers.SecurityHeadersProvider;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.SingleUseObjectProvider;
-import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
 import org.keycloak.protocol.oidc.endpoints.AuthorizationEndpointChecker;
 import org.keycloak.protocol.oidc.endpoints.request.AuthorizationEndpointRequest;
@@ -155,6 +154,10 @@ public Response request() {
         try {
             session.clientPolicy().triggerOnEvent(new PushedAuthorizationRequestContext(authorizationRequest, decodedFormParameters));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw throwErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
 
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java
new file mode 100644
index 000000000000..9d82de3ea9c0
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/AbstractTokenExchangeProvider.java
@@ -0,0 +1,462 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import org.jboss.logging.Logger;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.ExchangeExternalToken;
+import org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.provider.IdentityProvider;
+import org.keycloak.broker.provider.IdentityProviderMapper;
+import org.keycloak.broker.provider.IdentityProviderMapperSyncModeDelegate;
+import org.keycloak.common.ClientConnection;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.events.EventType;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.light.LightweightUserAdapter;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
+import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.Urls;
+import org.keycloak.services.cors.Cors;
+import org.keycloak.services.managers.BruteForceProtector;
+import org.keycloak.services.managers.UserSessionManager;
+import org.keycloak.services.resources.IdentityBrokerService;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.services.validation.Validation;
+import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.sessions.RootAuthenticationSessionModel;
+
+import static org.keycloak.authentication.authenticators.util.AuthenticatorUtils.getDisabledByBruteForceEventError;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+
+/**
+ * Base token exchange implementation. For now for both V1 and V2 token exchange (may change in the follow-up commits)
+ *
+ * @author <a href="mailto:dmitryt@backbase.com">Dmitry Telegin</a>
+ */
+public abstract class AbstractTokenExchangeProvider implements TokenExchangeProvider {
+
+    private static final Logger logger = Logger.getLogger(AbstractTokenExchangeProvider.class);
+
+    protected TokenExchangeContext.Params params;
+    protected MultivaluedMap<String, String> formParams;
+    protected KeycloakSession session;
+    protected Cors cors;
+    protected RealmModel realm;
+    protected ClientModel client;
+    protected EventBuilder event;
+    protected ClientConnection clientConnection;
+    protected HttpHeaders headers;
+    protected TokenManager tokenManager;
+    protected Map<String, String> clientAuthAttributes;
+    protected TokenExchangeContext context;
+
+    @Override
+    public Response exchange(TokenExchangeContext context) {
+        this.params = context.getParams();
+        this.formParams = context.getFormParams();
+        this.session = context.getSession();
+        this.cors = context.getCors();
+        this.realm = context.getRealm();
+        this.client = context.getClient();
+        this.event = context.getEvent();
+        this.clientConnection = context.getClientConnection();
+        this.headers = context.getHeaders();
+        this.tokenManager = (TokenManager)context.getTokenManager();
+        this.clientAuthAttributes = context.getClientAuthAttributes();
+        this.context = context;
+        return tokenExchange();
+    }
+
+    @Override
+    public void close() {
+    }
+
+    protected abstract Response tokenExchange();
+
+    /**
+     * Is it the request for external-internal token exchange?
+     */
+    protected boolean isExternalInternalTokenExchangeRequest(TokenExchangeContext context) {
+        String subjectToken = context.getParams().getSubjectToken();
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+        EventBuilder event = context.getEvent();
+
+        if (subjectToken != null) {
+            String subjectTokenType = context.getParams().getSubjectTokenType();
+            String realmIssuerUrl = Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName());
+            String subjectIssuer = getSubjectIssuer(context, subjectToken, subjectTokenType);
+
+            if (subjectIssuer != null && !realmIssuerUrl.equals(subjectIssuer)) {
+                event.detail(OAuth2Constants.SUBJECT_ISSUER, subjectIssuer);
+                return true;
+            }
+        }
+        return false;
+    }
+
+    protected String getSubjectIssuer(TokenExchangeContext context, String subjectToken, String subjectTokenType) {
+        String subjectIssuer = context.getFormParams().getFirst(OAuth2Constants.SUBJECT_ISSUER);
+        if (subjectIssuer != null) return subjectIssuer;
+
+        if (OAuth2Constants.JWT_TOKEN_TYPE.equals(subjectTokenType)) {
+            try {
+                JWSInput jws = new JWSInput(subjectToken);
+                JsonWebToken jwt = jws.readJsonContent(JsonWebToken.class);
+                return jwt.getIssuer();
+            } catch (JWSInputException e) {
+                context.getEvent().detail(Details.REASON, "unable to parse jwt subject_token");
+                context.getEvent().error(Errors.INVALID_TOKEN);
+                throw new CorsErrorResponseException(context.getCors(), OAuthErrorException.INVALID_REQUEST, "Invalid token type, must be access token", Response.Status.BAD_REQUEST);
+            }
+        } else {
+            return null;
+        }
+    }
+
+    protected Response exchangeToIdentityProvider(UserModel targetUser, UserSessionModel targetUserSession, String requestedIssuer) {
+        event.detail(Details.REQUESTED_ISSUER, requestedIssuer);
+        IdentityProviderModel providerModel = session.identityProviders().getByAlias(requestedIssuer);
+        if (providerModel == null) {
+            event.detail(Details.REASON, "unknown requested_issuer");
+            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid issuer", Response.Status.BAD_REQUEST);
+        }
+
+        IdentityProvider<?> provider = IdentityBrokerService.getIdentityProvider(session, requestedIssuer);
+        if (!(provider instanceof ExchangeTokenToIdentityProviderToken)) {
+            event.detail(Details.REASON, "exchange unsupported by requested_issuer");
+            event.error(Errors.UNKNOWN_IDENTITY_PROVIDER);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Issuer does not support token exchange", Response.Status.BAD_REQUEST);
+        }
+        if (!AdminPermissions.management(session, realm).idps().canExchangeTo(client, providerModel)) {
+            event.detail(Details.REASON, "client not allowed to exchange for requested_issuer");
+            event.error(Errors.NOT_ALLOWED);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+        }
+        Response response = ((ExchangeTokenToIdentityProviderToken)provider).exchangeFromToken(session.getContext().getUri(), event, client, targetUserSession, targetUser, formParams);
+        return cors.add(Response.fromResponse(response));
+
+    }
+
+    protected abstract String getRequestedTokenType();
+
+    protected List<ClientModel> getTargetAudienceClients() {
+        List<String> audienceParams = params.getAudience();
+        List<ClientModel> targetAudienceClients = new ArrayList<>();
+        if (audienceParams != null) {
+            for (String audience : audienceParams) {
+                ClientModel targetClient = realm.getClientByClientId(audience);
+                if (targetClient == null) {
+                    event.detail(Details.REASON, "audience not found");
+                    event.detail(Details.AUDIENCE, audience);
+                    event.error(Errors.CLIENT_NOT_FOUND);
+                    throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Audience not found", Response.Status.BAD_REQUEST);
+                } else {
+                    targetAudienceClients.add(targetClient);
+                }
+            }
+        }
+        // Assume client itself is audience in case audience parameter not provided
+        if (targetAudienceClients.isEmpty()) {
+            targetAudienceClients.add(client);
+        }
+        return targetAudienceClients;
+    }
+
+    protected abstract void validateAudience(AccessToken token, boolean disallowOnHolderOfTokenMismatch, List<ClientModel> targetAudienceClients);
+
+    protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel targetUserSession,
+            AccessToken token, boolean disallowOnHolderOfTokenMismatch) {
+
+        String requestedTokenType = getRequestedTokenType();
+        event.detail(Details.REQUESTED_TOKEN_TYPE, requestedTokenType);
+        List<ClientModel> targetAudienceClients = getTargetAudienceClients();
+        validateAudience(token, disallowOnHolderOfTokenMismatch, targetAudienceClients);
+        String scope = getRequestedScope(token, targetAudienceClients);
+
+        try {
+            setClientToContext(targetAudienceClients);
+            if (getSupportedOAuthResponseTokenTypes().contains(requestedTokenType))
+                return exchangeClientToOIDCClient(targetUser, targetUserSession, requestedTokenType, targetAudienceClients, scope, token);
+            else if (OAuth2Constants.SAML2_TOKEN_TYPE.equals(requestedTokenType)) {
+                return exchangeClientToSAML2Client(targetUser, targetUserSession, requestedTokenType, targetAudienceClients);
+            }
+        } finally {
+            session.getContext().setClient(client);
+        }
+
+        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
+    }
+
+    protected void forbiddenIfClientIsNotWithinTokenAudience(AccessToken token) {
+        if (token != null && !token.hasAudience(client.getClientId())) {
+            event.detail(Details.REASON, "client is not within the token audience");
+            event.error(Errors.NOT_ALLOWED);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client is not within the token audience", Response.Status.FORBIDDEN);
+        }
+    }
+
+    protected void forbiddenIfClientIsNotTokenHolder(boolean disallowOnHolderOfTokenMismatch, ClientModel tokenHolder) {
+        if (disallowOnHolderOfTokenMismatch && !client.equals(tokenHolder)) {
+            event.detail(Details.REASON, "client is not the token holder");
+            event.error(Errors.NOT_ALLOWED);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client is not the holder of the token", Response.Status.FORBIDDEN);
+        }
+    }
+
+    protected abstract List<String> getSupportedOAuthResponseTokenTypes();
+
+    protected AuthenticationSessionModel createSessionModel(UserSessionModel targetUserSession, RootAuthenticationSessionModel rootAuthSession, UserModel targetUser, ClientModel client, String scope) {
+        AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(client);
+        authSession.setAuthenticatedUser(targetUser);
+        authSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
+        authSession.setClientNote(OIDCLoginProtocol.SCOPE_PARAM, scope);
+        return authSession;
+    }
+
+    protected abstract String getRequestedScope(AccessToken token, List<ClientModel> targetAudienceClients);
+
+    protected void setClientToContext(List<ClientModel> targetAudienceClients) {
+        // The client requesting exchange is set in the context
+        session.getContext().setClient(client);
+    }
+
+    protected abstract Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType,
+                                                  List<ClientModel> targetAudienceClients, String scope, AccessToken subjectToken);
+
+    protected abstract Response exchangeClientToSAML2Client(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType, List<ClientModel> targetAudienceClients);
+
+    protected Response exchangeExternalToken(String subjectIssuer, String subjectToken) {
+        // try to find the IDP whose alias matches the issuer or the subject issuer in the form params.
+        ExternalExchangeContext externalExchangeContext = this.locateExchangeExternalTokenByAlias(subjectIssuer);
+
+        if (externalExchangeContext == null) {
+            event.error(Errors.INVALID_ISSUER);
+            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
+        }
+        if (!AdminPermissions.management(session, realm).idps().canExchangeTo(client, externalExchangeContext.idpModel())) {
+            event.detail(Details.REASON, "client not allowed to exchange subject_issuer");
+            event.error(Errors.NOT_ALLOWED);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+        }
+        BrokeredIdentityContext context = externalExchangeContext.provider().exchangeExternal(this, this.context);
+        if (context == null) {
+            event.error(Errors.INVALID_ISSUER);
+            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
+        }
+
+        UserModel user = importUserFromExternalIdentity(context);
+
+        UserSessionModel userSession = new UserSessionManager(session).createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteHost(), "external-exchange", false, null, null);
+        externalExchangeContext.provider().exchangeExternalComplete(userSession, context, formParams);
+
+        // this must exist so that we can obtain access token from user session if idp's store tokens is off
+        userSession.setNote(IdentityProvider.EXTERNAL_IDENTITY_PROVIDER, externalExchangeContext.idpModel().getAlias());
+        userSession.setNote(IdentityProvider.FEDERATED_ACCESS_TOKEN, subjectToken);
+
+        context.addSessionNotesToUserSession(userSession);
+
+        return exchangeClientToClient(user, userSession, null, false);
+    }
+
+    protected UserModel importUserFromExternalIdentity(BrokeredIdentityContext context) {
+        IdentityProviderModel identityProviderConfig = context.getIdpConfig();
+
+        String providerId = identityProviderConfig.getAlias();
+
+        context.getIdp().preprocessFederatedIdentity(session, realm, context);
+        Set<IdentityProviderMapperModel> mappers = session.identityProviders().getMappersByAliasStream(context.getIdpConfig().getAlias())
+                .collect(Collectors.toSet());
+        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
+        for (IdentityProviderMapperModel mapper : mappers) {
+            IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+            target.preprocessFederatedIdentity(session, realm, mapper, context);
+        }
+
+        UserModel user = null;
+        if (!context.getIdpConfig().isTransientUsers()) {
+            FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(providerId, context.getId(),
+                    context.getUsername(), context.getToken());
+
+            user = this.session.users().getUserByFederatedIdentity(realm, federatedIdentityModel);
+        }
+
+        if (user == null || context.getIdpConfig().isTransientUsers()) {
+
+            logger.debugf("Federated user not found for provider '%s' and broker username '%s'.", providerId, context.getUsername());
+
+            String username = context.getModelUsername();
+            if (username == null) {
+                if (this.realm.isRegistrationEmailAsUsername() && !Validation.isBlank(context.getEmail())) {
+                    username = context.getEmail();
+                } else if (context.getUsername() == null) {
+                    username = context.getIdpConfig().getAlias() + "." + context.getId();
+                } else {
+                    username = context.getUsername();
+                }
+            }
+            username = username.trim();
+            context.setModelUsername(username);
+            if (context.getEmail() != null && !realm.isDuplicateEmailsAllowed()) {
+                UserModel existingUser = session.users().getUserByEmail(realm, context.getEmail());
+                if (existingUser != null) {
+                    event.error(Errors.FEDERATED_IDENTITY_EXISTS);
+                    throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "User already exists", Response.Status.BAD_REQUEST);
+                }
+            }
+
+            UserModel existingUser = session.users().getUserByUsername(realm, username);
+            if (existingUser != null) {
+                event.error(Errors.FEDERATED_IDENTITY_EXISTS);
+                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "User already exists", Response.Status.BAD_REQUEST);
+            }
+
+            if (context.getIdpConfig().isTransientUsers()) {
+                String authSessionId = context.getAuthenticationSession() != null && context.getAuthenticationSession().getParentSession() != null
+                                       ? context.getAuthenticationSession().getParentSession().getId() : null;
+                user = new LightweightUserAdapter(session, realm, authSessionId);
+            } else {
+                user = session.users().addUser(realm, username);
+            }
+            user.setEnabled(true);
+            user.setEmail(context.getEmail());
+            user.setFirstName(context.getFirstName());
+            user.setLastName(context.getLastName());
+
+
+            if (! context.getIdpConfig().isTransientUsers()) {
+                FederatedIdentityModel federatedIdentityModel = new FederatedIdentityModel(context.getIdpConfig().getAlias(), context.getId(),
+                        context.getModelUsername(), context.getToken());
+                session.users().addFederatedIdentity(realm, user, federatedIdentityModel);
+            }
+
+            context.getIdp().importNewUser(session, realm, user, context);
+
+            for (IdentityProviderMapperModel mapper : mappers) {
+                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+                target.importNewUser(session, realm, user, mapper, context);
+            }
+
+            if (context.getIdpConfig().isTrustEmail() && !Validation.isBlank(user.getEmail())) {
+                logger.debugf("Email verified automatically after registration of user '%s' through Identity provider '%s' ", user.getUsername(), context.getIdpConfig().getAlias());
+                user.setEmailVerified(true);
+            }
+
+            event.clone()
+                    .event(EventType.REGISTER)
+                    .user(user.getId())
+                    .detail(Details.REGISTER_METHOD, "token-exchange")
+                    .detail(Details.EMAIL, user.getEmail())
+                    .detail(Details.IDENTITY_PROVIDER, providerId)
+                    .success();
+        } else {
+            if (!user.isEnabled()) {
+                event.error(Errors.USER_DISABLED);
+                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "Invalid Token", Response.Status.BAD_REQUEST);
+            }
+
+            String bruteForceError = getDisabledByBruteForceEventError(session.getProvider(BruteForceProtector.class), session, realm, user);
+            if (bruteForceError != null) {
+                event.error(bruteForceError);
+                throw new CorsErrorResponseException(cors, Errors.INVALID_TOKEN, "Invalid Token", Response.Status.BAD_REQUEST);
+            }
+
+            context.getIdp().updateBrokeredUser(session, realm, user, context);
+
+            for (IdentityProviderMapperModel mapper : mappers) {
+                IdentityProviderMapper target = (IdentityProviderMapper)sessionFactory.getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
+                IdentityProviderMapperSyncModeDelegate.delegateUpdateBrokeredUser(session, realm, user, mapper, context, target);
+            }
+        }
+
+        // make sure user attributes are updated based on attributes set to the context
+        for (Map.Entry<String, List<String>> attr : context.getAttributes().entrySet().stream().sorted(Map.Entry.comparingByKey()).toList()) {
+            if (!UserModel.USERNAME.equalsIgnoreCase(attr.getKey())) {
+                user.setAttribute(attr.getKey(), attr.getValue());
+            }
+        }
+
+        return user;
+    }
+
+    // TODO: move to utility class
+    protected void updateUserSessionFromClientAuth(UserSessionModel userSession) {
+        for (Map.Entry<String, String> attr : clientAuthAttributes.entrySet()) {
+            userSession.setNote(attr.getKey(), attr.getValue());
+        }
+    }
+
+    protected record ExternalExchangeContext (ExchangeExternalToken provider, IdentityProviderModel idpModel) {};
+
+    protected ExternalExchangeContext locateExchangeExternalTokenByAlias(String alias) {
+        try {
+            IdentityProvider<?> idp = IdentityBrokerService.getIdentityProvider(session, alias);
+
+            if (idp instanceof ExchangeExternalToken external) {
+                IdentityProviderModel model = session.identityProviders().getByAlias(alias);
+                return new ExternalExchangeContext(external, model);
+            }
+        } catch (IdentityBrokerException ignore) {
+        }
+
+        return session.identityProviders().getAllStream().map(idpModel -> {
+            IdentityProvider<?> idp = IdentityBrokerService.getIdentityProvider(session, idpModel.getAlias());
+
+            if (idp instanceof ExchangeExternalToken external && external.isIssuer(alias, formParams)) {
+                return new ExternalExchangeContext(external, idpModel);
+            }
+
+            return null;
+        }).filter(Objects::nonNull).findFirst().orElse(null);
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProvider.java
new file mode 100644
index 000000000000..e3842a3cf643
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProvider.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import jakarta.ws.rs.core.Response;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityProvider;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.managers.UserSessionManager;
+
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Provider for external-internal token exchange
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalToInternalTokenExchangeProvider extends StandardTokenExchangeProvider {
+
+    @Override
+    public boolean supports(TokenExchangeContext context) {
+        return (isExternalInternalTokenExchangeRequest(context));
+    }
+
+    @Override
+    public int getVersion() {
+        return 2;
+    }
+
+    @Override
+    protected Response tokenExchange() {
+        String subjectToken = context.getParams().getSubjectToken();
+        String subjectTokenType = context.getParams().getSubjectTokenType();
+        String subjectIssuer = getSubjectIssuer(this.context, subjectToken, subjectTokenType);
+        return exchangeExternalToken(subjectIssuer, subjectToken);
+    }
+
+    @Override
+    protected List<String> getSupportedOAuthResponseTokenTypes() {
+        return Arrays.asList(OAuth2Constants.ACCESS_TOKEN_TYPE, OAuth2Constants.ID_TOKEN_TYPE);
+    }
+
+    @Override
+    protected String getRequestedTokenType() {
+        String requestedTokenType = params.getRequestedTokenType();
+        if (requestedTokenType == null) {
+            requestedTokenType = OAuth2Constants.ACCESS_TOKEN_TYPE;
+            return requestedTokenType;
+        }
+        if (getSupportedOAuthResponseTokenTypes().contains(requestedTokenType)) {
+            return requestedTokenType;
+        }
+
+        event.detail(Details.REASON, "requested_token_type unsupported");
+        event.error(Errors.INVALID_REQUEST);
+        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
+    }
+
+    protected Response exchangeExternalToken(String subjectIssuer, String subjectToken) {
+        // try to find the IDP whose alias matches the issuer or the subject issuer in the form params.
+        ExternalExchangeContext externalExchangeContext = this.locateExchangeExternalTokenByAlias(subjectIssuer);
+
+        if (externalExchangeContext == null) {
+            event.error(Errors.INVALID_ISSUER);
+            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
+        }
+        BrokeredIdentityContext context = externalExchangeContext.provider().exchangeExternal(this, this.context);
+        if (context == null) {
+            event.error(Errors.INVALID_ISSUER);
+            throw new CorsErrorResponseException(cors, Errors.INVALID_ISSUER, "Invalid " + OAuth2Constants.SUBJECT_ISSUER + " parameter", Response.Status.BAD_REQUEST);
+        }
+
+        UserModel user = importUserFromExternalIdentity(context);
+
+        UserSessionModel userSession = new UserSessionManager(session).createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteHost(), "external-exchange", false, null, null);
+        externalExchangeContext.provider().exchangeExternalComplete(userSession, context, formParams);
+
+        // this must exist so that we can obtain access token from user session if idp's store tokens is off
+        userSession.setNote(IdentityProvider.EXTERNAL_IDENTITY_PROVIDER, externalExchangeContext.idpModel().getAlias());
+        userSession.setNote(IdentityProvider.FEDERATED_ACCESS_TOKEN, subjectToken);
+
+        context.addSessionNotesToUserSession(userSession);
+
+        return exchangeClientToClient(user, userSession, null, false);
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProviderFactory.java
new file mode 100644
index 000000000000..f95765b86547
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/ExternalToInternalTokenExchangeProviderFactory.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
+import org.keycloak.protocol.oidc.TokenExchangeProviderFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+
+/**
+ * Provider factory for external-internal token exchange
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalToInternalTokenExchangeProviderFactory implements TokenExchangeProviderFactory, EnvironmentDependentProviderFactory {
+
+    @Override
+    public TokenExchangeProvider create(KeycloakSession session) {
+        return new ExternalToInternalTokenExchangeProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "external-internal";
+    }
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE_EXTERNAL_INTERNAL_V2);
+    }
+
+    @Override
+    public int order() {
+        // Bigger priority than V1, so it has preference if both V1 and V2 enabled. Also bigger priority than "standard", so it can verify if request is from external-token
+        return 20;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProvider.java
new file mode 100644
index 000000000000..e3b3dc996b18
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProvider.java
@@ -0,0 +1,365 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.authentication.actiontoken.TokenUtils;
+import org.keycloak.common.Profile;
+import org.keycloak.common.util.CollectionUtil;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.models.AuthenticatedClientSessionModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
+import org.keycloak.rar.AuthorizationRequestContext;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.managers.AuthenticationSessionManager;
+import org.keycloak.services.util.AuthorizationContextUtil;
+import org.keycloak.services.util.UserSessionUtil;
+import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.sessions.RootAuthenticationSessionModel;
+import org.keycloak.util.TokenUtil;
+
+/**
+ * Provider for internal-internal token exchange, which is compliant with the token exchange specification https://datatracker.ietf.org/doc/html/rfc8693
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class StandardTokenExchangeProvider extends AbstractTokenExchangeProvider {
+
+    @Override
+    public int getVersion() {
+        return 2;
+    }
+
+    @Override
+    public boolean supports(TokenExchangeContext context) {
+        // Subject impersonation request
+        String requestedSubject = context.getFormParams().getFirst(OAuth2Constants.REQUESTED_SUBJECT);
+        if (requestedSubject != null) {
+            context.setUnsupportedReason("Parameter 'requested_subject' is not supported for standard token exchange");
+            return false;
+        }
+
+        // Internal-external token exchange
+        String requestedIssuer = context.getFormParams().getFirst(OAuth2Constants.REQUESTED_ISSUER);
+        if (requestedIssuer != null) {
+            context.setUnsupportedReason("Parameter 'requested_issuer' is not supported for standard token exchange");
+            return false;
+        }
+
+        // External-internal token exchange
+        String subjectIssuer = context.getFormParams().getFirst(OAuth2Constants.SUBJECT_ISSUER);
+        if (subjectIssuer != null) {
+            context.setUnsupportedReason("Parameter 'subject_issuer' is not supported for standard token exchange");
+            return false;
+        }
+
+        if(!OIDCAdvancedConfigWrapper.fromClientModel(context.getClient()).isStandardTokenExchangeEnabled()) {
+            context.setUnsupportedReason("Standard token exchange is not enabled for the requested client");
+            return false;
+        }
+
+        String subjectToken = context.getParams().getSubjectToken();
+        if (subjectToken == null) {
+            context.setUnsupportedReason("Parameter 'subject_token' required for standard token exchange");
+            return false;
+        }
+
+        String subjectTokenType = context.getParams().getSubjectTokenType();
+        if (subjectTokenType == null) {
+            context.setUnsupportedReason("Parameter 'subject_token_type' required for standard token exchange");
+            return false;
+        }
+
+        if (!subjectTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE)) {
+            context.setUnsupportedReason("Parameter 'subject_token' supports access tokens only");
+            return false;
+        }
+
+        return true;
+    }
+
+    @Override
+    protected Response tokenExchange() {
+
+        String subjectToken = context.getParams().getSubjectToken();
+
+        event.detail(Details.REQUESTED_TOKEN_TYPE, context.getParams().getRequestedTokenType());
+
+        AuthenticationManager.AuthResult authResult = AuthenticationManager.verifyIdentityToken(session, realm, session.getContext().getUri(), clientConnection, true, true, null, false, subjectToken, context.getHeaders());
+        if (authResult == null) {
+            event.detail(Details.REASON, "subject_token validation failure");
+            event.error(Errors.INVALID_TOKEN);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token", Response.Status.BAD_REQUEST);
+        }
+
+        UserModel tokenUser = authResult.getUser();
+        UserSessionModel tokenSession = authResult.getSession();
+        AccessToken token = authResult.getToken();
+
+        event.user(tokenUser);
+        event.detail(Details.USERNAME, tokenUser.getUsername());
+        if (tokenSession.getPersistenceState() != UserSessionModel.SessionPersistenceState.TRANSIENT) {
+            event.session(tokenSession);
+        }
+        event.detail(Details.SUBJECT_TOKEN_CLIENT_ID, token.getIssuedFor());
+
+        return exchangeClientToClient(tokenUser, tokenSession, token, true);
+    }
+
+    @Override
+    protected void validateAudience(AccessToken token, boolean disallowOnHolderOfTokenMismatch, List<ClientModel> targetAudienceClients) {
+        ClientModel tokenHolder = token == null ? null : realm.getClientByClientId(token.getIssuedFor());
+
+        if (client.isPublicClient()) {
+            String errorMessage = "Public client is not allowed to exchange token";
+            event.detail(Details.REASON, errorMessage);
+            event.error(Errors.INVALID_CLIENT);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, errorMessage, Response.Status.BAD_REQUEST);
+        }
+
+        for (ClientModel targetClient : targetAudienceClients) {
+            if (!targetClient.isEnabled()) {
+                event.detail(Details.REASON, "audience client disabled");
+                event.detail(Details.AUDIENCE, targetClient.getClientId());
+                event.error(Errors.CLIENT_DISABLED);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client disabled", Response.Status.BAD_REQUEST);
+            }
+        }
+
+        //reject if the requester-client is not in the audience of the subject token
+        if (!client.equals(tokenHolder)) {
+            forbiddenIfClientIsNotWithinTokenAudience(token);
+        }
+    }
+
+    protected void validateConsents(UserModel targetUser, ClientSessionContext clientSessionCtx) {
+        if (!TokenManager.verifyConsentStillAvailable(session, targetUser, client, clientSessionCtx.getClientScopesStream())) {
+            event.detail(Details.REASON, "Missing consents for Token Exchange in client " + client.getClientId());
+            event.error(Errors.CONSENT_DENIED);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_SCOPE,
+                    "Missing consents for Token Exchange in client " + client.getClientId(), Response.Status.BAD_REQUEST);
+        }
+    }
+
+    // For now, include "scope" parameter as is
+    @Override
+    protected String getRequestedScope(AccessToken token, List<ClientModel> targetAudienceClients) {
+        String scope = formParams.getFirst(OAuth2Constants.SCOPE);
+
+        boolean validScopes;
+        if (Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES)) {
+            AuthorizationRequestContext authorizationRequestContext = AuthorizationContextUtil.getAuthorizationRequestContextFromScopes(session, scope);
+            validScopes = TokenManager.isValidScope(session, scope, authorizationRequestContext, client, null);
+        } else {
+            validScopes = TokenManager.isValidScope(session, scope, client, null);
+        }
+
+        if (!validScopes) {
+            String errorMessage = "Invalid scopes: " + scope;
+            event.detail(Details.REASON, errorMessage);
+            event.error(Errors.INVALID_REQUEST);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_SCOPE, errorMessage, Response.Status.BAD_REQUEST);
+        }
+
+        return scope;
+    }
+
+    @Override
+    protected Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType,
+                                                  List<ClientModel> targetAudienceClients, String scope, AccessToken subjectToken) {
+        RootAuthenticationSessionModel rootAuthSession = new AuthenticationSessionManager(session).createAuthenticationSession(realm, false);
+        AuthenticationSessionModel authSession = createSessionModel(targetUserSession, rootAuthSession, targetUser, client, scope);
+        boolean isOfflineSession = targetUserSession.isOffline();
+
+        if (targetUserSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT || isOfflineSession) {
+            // if no session is associated with the subject_token or it is offline, check no online session is needed
+            if (OAuth2Constants.REFRESH_TOKEN_TYPE.equals(requestedTokenType)) {
+                event.detail(Details.REASON, "Refresh token not valid as requested_token_type because creating a new session is needed");
+                event.error(Errors.INVALID_REQUEST);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST,
+                        "Refresh token not valid as requested_token_type because creating a new session is needed", Response.Status.BAD_REQUEST);
+            }
+
+            // create a transient session now for the token exchange
+            if (isOfflineSession) {
+                targetUserSession = UserSessionUtil.createTransientUserSession(session, targetUserSession);
+            }
+        }
+
+        final boolean newClientSessionCreated = targetUserSession.getPersistenceState() != UserSessionModel.SessionPersistenceState.TRANSIENT
+                && targetUserSession.getAuthenticatedClientSessionByClient(client.getId()) == null;
+
+        try {
+            ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(this.session, targetUserSession, authSession,
+                    !OAuth2Constants.REFRESH_TOKEN_TYPE.equals(requestedTokenType)); // create transient session if needed except for refresh
+
+            if (requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
+                    && clientSessionCtx.getClientScopesStream().filter(s -> OAuth2Constants.OFFLINE_ACCESS.equals(s.getName())).findAny().isPresent()) {
+                event.detail(Details.REASON, "Scope offline_access not allowed for token exchange");
+                event.error(Errors.INVALID_REQUEST);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST,
+                        "Scope offline_access not allowed for token exchange", Response.Status.BAD_REQUEST);
+            }
+
+            updateUserSessionFromClientAuth(targetUserSession);
+
+            if (params.getAudience() != null && !targetAudienceClients.isEmpty()) {
+                clientSessionCtx.setAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, targetAudienceClients.toArray(ClientModel[]::new));
+            }
+
+            validateConsents(targetUser, clientSessionCtx);
+            clientSessionCtx.setAttribute(Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+            TokenContextEncoderProvider encoder = session.getProvider(TokenContextEncoderProvider.class);
+
+            if (subjectToken != null) {
+                AccessTokenContext subjectTokenContext = encoder.getTokenContextFromTokenId(subjectToken.getId());
+
+                //copy subject client from the client session notes if the subject token used has already been exchanged
+                if (OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE.equals(subjectTokenContext.getGrantType())) {
+                    ClientModel subjectClient = session.clients().getClientByClientId(realm, subjectToken.getIssuedFor());
+                    if (subjectClient != null) {
+                        AuthenticatedClientSessionModel subjectClientSession = targetUserSession.getAuthenticatedClientSessionByClient(subjectClient.getId());
+                        if (subjectClientSession != null) {
+                            subjectClientSession.getNotes().entrySet().stream()
+                                    .filter(note -> note.getKey().startsWith(Constants.TOKEN_EXCHANGE_SUBJECT_CLIENT))
+                                    .forEach(note -> clientSessionCtx.getClientSession().setNote(note.getKey(), note.getValue()));
+                        }
+                    }
+                }
+
+                //store client id of the subject token
+                clientSessionCtx.getClientSession().setNote(Constants.TOKEN_EXCHANGE_SUBJECT_CLIENT + subjectToken.getIssuedFor(), subjectToken.getId());
+            }
+
+            TokenManager.AccessTokenResponseBuilder responseBuilder = tokenManager.responseBuilder(realm, client, event, session,
+                    clientSessionCtx.getClientSession().getUserSession(), clientSessionCtx).generateAccessToken();
+
+            checkRequestedAudiences(responseBuilder);
+
+            if (targetUserSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT && !isOfflineSession) {
+                responseBuilder.getAccessToken().setSessionId(null);
+                event.session((String) null);
+            }
+
+            if (OAuth2Constants.REFRESH_TOKEN_TYPE.equals(requestedTokenType)) {
+                responseBuilder.generateRefreshToken();
+            }
+
+            AccessTokenResponse res;
+            if (OAuth2Constants.ID_TOKEN_TYPE.equals(requestedTokenType)) {
+                // Using the id-token inside "access_token" parameter as per description of "access_token" parameter under https://datatracker.ietf.org/doc/html/rfc8693#name-successful-response
+                res = responseBuilder.generateIDToken().build();
+                res.setToken(res.getIdToken());
+                res.setIdToken(null);
+                res.setTokenType(TokenUtil.TOKEN_TYPE_NA);
+            } else {
+                String scopeParam = params.getScope();
+                if (TokenUtil.isOIDCRequest(scopeParam)) {
+                    responseBuilder.generateIDToken().generateAccessTokenHash();
+                }
+                res = responseBuilder.build();
+            }
+
+            res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, requestedTokenType);
+
+            if (responseBuilder.getAccessToken().getAudience() != null) {
+                event.detail(Details.AUDIENCE, CollectionUtil.join(List.of(responseBuilder.getAccessToken().getAudience()), " "));
+            }
+            event.success();
+
+            return cors.add(Response.ok(res, MediaType.APPLICATION_JSON_TYPE));
+        } catch (RuntimeException e) {
+            // Cleanup client-session if created in this request
+            if (newClientSessionCreated) {
+                targetUserSession.removeAuthenticatedClientSessions(Set.of(client.getId()));
+            }
+
+            throw e;
+        }
+    }
+
+    @Override
+    protected Response exchangeClientToSAML2Client(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType, List<ClientModel> targetAudienceClients) {
+        event.detail(Details.REASON, "requested_token_type unsupported");
+        event.error(Errors.INVALID_REQUEST);
+        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
+    }
+
+    protected void checkRequestedAudiences(TokenManager.AccessTokenResponseBuilder responseBuilder) {
+        Set<String> missingAudience = TokenUtils.checkRequestedAudiences(responseBuilder.getAccessToken(), params.getAudience());
+        if (!missingAudience.isEmpty()) {
+            final String missingAudienceString = CollectionUtil.join(missingAudience);
+            event.detail(Details.REASON, "Requested audience not available: " + missingAudienceString);
+            event.error(Errors.INVALID_REQUEST);
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST,
+                    "Requested audience not available: " + missingAudienceString, Response.Status.BAD_REQUEST);
+        }
+    }
+
+    @Override
+    protected List<String> getSupportedOAuthResponseTokenTypes() {
+        return Arrays.asList(OAuth2Constants.ACCESS_TOKEN_TYPE, OAuth2Constants.ID_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE);
+    }
+
+    @Override
+    protected String getRequestedTokenType() {
+        String requestedTokenType = params.getRequestedTokenType();
+        if (requestedTokenType == null) {
+            requestedTokenType = OAuth2Constants.ACCESS_TOKEN_TYPE;
+            return requestedTokenType;
+        }
+        if (requestedTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE)
+                || requestedTokenType.equals(OAuth2Constants.ID_TOKEN_TYPE)
+                || requestedTokenType.equals(OAuth2Constants.SAML2_TOKEN_TYPE)) {
+            return requestedTokenType;
+        }
+        OIDCAdvancedConfigWrapper oidcClient = OIDCAdvancedConfigWrapper.fromClientModel(client);
+        if (requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
+                && oidcClient.isUseRefreshToken()
+                && oidcClient.getStandardTokenExchangeRefreshEnabled() != OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.NO) {
+            return requestedTokenType;
+        }
+
+        event.detail(Details.REASON, "requested_token_type unsupported");
+        event.error(Errors.INVALID_REQUEST);
+        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProviderFactory.java
new file mode 100644
index 000000000000..f944c866de66
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/StandardTokenExchangeProviderFactory.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
+import org.keycloak.protocol.oidc.TokenExchangeProviderFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+
+/**
+ * Provider factory for internal-internal token exchange, which is compliant with the token exchange specification https://datatracker.ietf.org/doc/html/rfc8693
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class StandardTokenExchangeProviderFactory implements TokenExchangeProviderFactory, EnvironmentDependentProviderFactory {
+
+    @Override
+    public TokenExchangeProvider create(KeycloakSession session) {
+        return new StandardTokenExchangeProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "standard";
+    }
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE_STANDARD_V2);
+    }
+
+    @Override
+    public int order() {
+        // Bigger priority than V1, so it has preference if both V1 and V2 enabled
+        return 10;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProvider.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProvider.java
new file mode 100644
index 000000000000..2a5cf9d1dbe5
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProvider.java
@@ -0,0 +1,427 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.jboss.logging.Logger;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.common.ClientConnection;
+import org.keycloak.common.Profile;
+import org.keycloak.common.util.Base64Url;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.LoginProtocol;
+import org.keycloak.protocol.LoginProtocolFactory;
+import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.protocol.oidc.endpoints.TokenEndpoint;
+import org.keycloak.protocol.saml.SamlClient;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.protocol.saml.SamlService;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.saml.common.constants.GeneralConstants;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.cors.Cors;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.managers.AuthenticationSessionManager;
+import org.keycloak.services.managers.UserSessionManager;
+import org.keycloak.services.resources.admin.AdminAuth;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.sessions.AuthenticationSessionModel;
+import org.keycloak.sessions.RootAuthenticationSessionModel;
+import org.keycloak.util.TokenUtil;
+
+import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_CLIENT;
+import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_ID;
+import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_USERNAME;
+
+/**
+ * V1 token exchange provider. Supports all token exchange types (standard, federated, subject impersonation)
+ *
+ * @author <a href="mailto:dmitryt@backbase.com">Dmitry Telegin</a>
+ */
+public class V1TokenExchangeProvider extends AbstractTokenExchangeProvider {
+
+    private static final Logger logger = Logger.getLogger(V1TokenExchangeProvider.class);
+
+    @Override
+    public int getVersion() {
+        return 1;
+    }
+
+    @Override
+    public boolean supports(TokenExchangeContext context) {
+        return true;
+    }
+
+    protected Response tokenExchange() {
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+        ClientConnection clientConnection = context.getClientConnection();
+        Cors cors = context.getCors();
+        ClientModel client = context.getClient();
+        EventBuilder event = context.getEvent();
+
+        UserModel tokenUser = null;
+        UserSessionModel tokenSession = null;
+        AccessToken token = null;
+
+        String subjectToken = context.getParams().getSubjectToken();
+        if (subjectToken != null) {
+            String subjectTokenType = context.getParams().getSubjectTokenType();
+            if (isExternalInternalTokenExchangeRequest(this.context)) {
+                String subjectIssuer = getSubjectIssuer(this.context, subjectToken, subjectTokenType);
+                return exchangeExternalToken(subjectIssuer, subjectToken);
+            }
+
+            if (subjectTokenType != null && !subjectTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE)) {
+                event.detail(Details.REASON, "subject_token supports access tokens only");
+                event.error(Errors.INVALID_TOKEN);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token type, must be access token", Response.Status.BAD_REQUEST);
+
+            }
+
+            AuthenticationManager.AuthResult authResult = AuthenticationManager.verifyIdentityToken(session, realm, session.getContext().getUri(), clientConnection, true, true, null, false, subjectToken, context.getHeaders());
+            if (authResult == null) {
+                event.detail(Details.REASON, "subject_token validation failure");
+                event.error(Errors.INVALID_TOKEN);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Invalid token", Response.Status.BAD_REQUEST);
+            }
+
+            tokenUser = authResult.getUser();
+            tokenSession = authResult.getSession();
+            token = authResult.getToken();
+        }
+
+        String requestedSubject = context.getFormParams().getFirst(OAuth2Constants.REQUESTED_SUBJECT);
+        boolean disallowOnHolderOfTokenMismatch = true;
+
+        if (requestedSubject != null) {
+            event.detail(Details.REQUESTED_SUBJECT, requestedSubject);
+            UserModel requestedUser = session.users().getUserByUsername(realm, requestedSubject);
+            if (requestedUser == null) {
+                requestedUser = session.users().getUserById(realm, requestedSubject);
+            }
+
+            if (requestedUser == null) {
+                // We always returned access denied to avoid username fishing
+                event.detail(Details.REASON, "requested_subject not found");
+                event.error(Errors.NOT_ALLOWED);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+
+            }
+
+            if (token != null) {
+                event.detail(Details.IMPERSONATOR, tokenUser.getUsername());
+                // for this case, the user represented by the token, must have permission to impersonate.
+                AdminAuth auth = new AdminAuth(realm, token, tokenUser, client);
+                if (!AdminPermissions.evaluator(session, realm, auth).users().canImpersonate(requestedUser, client)) {
+                    event.detail(Details.REASON, "subject not allowed to impersonate");
+                    event.error(Errors.NOT_ALLOWED);
+                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+                }
+            } else {
+                // no token is being exchanged, this is a direct exchange.  Client must be authenticated, not public, and must be allowed
+                // to impersonate
+                if (client.isPublicClient()) {
+                    event.detail(Details.REASON, "public clients not allowed");
+                    event.error(Errors.NOT_ALLOWED);
+                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+
+                }
+                if (!AdminPermissions.management(session, realm).users().canClientImpersonate(client, requestedUser)) {
+                    event.detail(Details.REASON, "client not allowed to impersonate");
+                    event.error(Errors.NOT_ALLOWED);
+                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+                }
+
+                // see https://issues.redhat.com/browse/KEYCLOAK-5492
+                disallowOnHolderOfTokenMismatch = false;
+            }
+
+            tokenSession = new UserSessionManager(session).createUserSession(realm, requestedUser, requestedUser.getUsername(), clientConnection.getRemoteHost(), "impersonate", false, null, null);
+            if (tokenUser != null) {
+                tokenSession.setNote(IMPERSONATOR_ID.toString(), tokenUser.getId());
+                tokenSession.setNote(IMPERSONATOR_USERNAME.toString(), tokenUser.getUsername());
+            }
+
+            tokenUser = requestedUser;
+        }
+
+        String requestedIssuer = context.getFormParams().getFirst(OAuth2Constants.REQUESTED_ISSUER);
+        if (requestedIssuer == null) {
+            return exchangeClientToClient(tokenUser, tokenSession, token, disallowOnHolderOfTokenMismatch);
+        } else {
+            try {
+                return exchangeToIdentityProvider(tokenUser, tokenSession, requestedIssuer);
+            } finally {
+                if (subjectToken == null) { // we are naked! So need to clean up user session
+                    try {
+                        session.sessions().removeUserSession(realm, tokenSession);
+                    } catch (Exception ignore) {
+
+                    }
+                }
+            }
+        }
+    }
+
+    @Override
+    protected String getRequestedTokenType() {
+        String requestedTokenType = context.getParams().getRequestedTokenType();
+        if (requestedTokenType == null) {
+            requestedTokenType = OAuth2Constants.REFRESH_TOKEN_TYPE;
+            return requestedTokenType;
+        }
+        if (requestedTokenType.equals(OAuth2Constants.ACCESS_TOKEN_TYPE)
+                || requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
+                || requestedTokenType.equals(OAuth2Constants.SAML2_TOKEN_TYPE)) {
+            return requestedTokenType;
+        }
+
+        event.detail(Details.REASON, "requested_token_type unsupported");
+        event.error(Errors.INVALID_REQUEST);
+        throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "requested_token_type unsupported", Response.Status.BAD_REQUEST);
+    }
+
+    @Override
+    protected void validateAudience(AccessToken token, boolean disallowOnHolderOfTokenMismatch, List<ClientModel> targetAudienceClients) {
+        ClientModel tokenHolder = token == null ? null : realm.getClientByClientId(token.getIssuedFor());
+        for (ClientModel targetClient : targetAudienceClients) {
+            if (targetClient.isConsentRequired()) {
+                event.detail(Details.REASON, "audience requires consent");
+                event.detail(Details.AUDIENCE, targetClient.getClientId());
+                event.error(Errors.CONSENT_DENIED);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires user consent", Response.Status.BAD_REQUEST);
+            }
+            if (!targetClient.isEnabled()) {
+                event.detail(Details.REASON, "audience client disabled");
+                event.detail(Details.AUDIENCE, targetClient.getClientId());
+                event.error(Errors.CLIENT_DISABLED);
+                throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client disabled", Response.Status.BAD_REQUEST);
+            }
+            boolean isClientTheAudience = targetClient.equals(client);
+            if (isClientTheAudience) {
+                if (client.isPublicClient()) {
+                    // public clients can only exchange on to themselves if they are the token holder
+                    forbiddenIfClientIsNotTokenHolder(disallowOnHolderOfTokenMismatch, tokenHolder);
+                } else if (!client.equals(tokenHolder)) {
+                    // confidential clients can only exchange to themselves if they are within the token audience
+                    forbiddenIfClientIsNotWithinTokenAudience(token);
+                }
+            } else {
+                if (client.isPublicClient()) {
+                    // public clients can not exchange tokens from other client
+                    forbiddenIfClientIsNotTokenHolder(disallowOnHolderOfTokenMismatch, tokenHolder);
+                }
+                if (!AdminPermissions.management(session, realm).clients().canExchangeTo(client, targetClient, token)) {
+                    event.detail(Details.REASON, "client not allowed to exchange to audience");
+                    event.detail(Details.AUDIENCE, targetClient.getClientId());
+                    event.error(Errors.NOT_ALLOWED);
+                    throw new CorsErrorResponseException(cors, OAuthErrorException.ACCESS_DENIED, "Client not allowed to exchange", Response.Status.FORBIDDEN);
+                }
+            }
+        }
+    }
+
+    @Override
+    protected List<String> getSupportedOAuthResponseTokenTypes() {
+        return Arrays.asList(OAuth2Constants.ACCESS_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE);
+    }
+
+    @Override
+    protected String getRequestedScope(AccessToken token, List<ClientModel> targetAudienceClients) {
+        ClientModel targetClient = targetAudienceClients.get(0);
+        // TODO Remove once more audiences are properly supported
+        if (targetAudienceClients.size() > 1) {
+            logger.warnf("Only one value of audience parameter currently supported for token exchange. Using audience '%s' and ignoring the other audiences provided", targetClient.getClientId());
+        }
+
+        String scope = formParams.getFirst(OAuth2Constants.SCOPE);
+        if (token != null && token.getScope() != null && scope == null) {
+            scope = token.getScope();
+
+            Set<String> targetClientScopes = new HashSet<String>();
+            targetClientScopes.addAll(targetClient.getClientScopes(true).keySet());
+            targetClientScopes.addAll(targetClient.getClientScopes(false).keySet());
+            //from return scope remove scopes that are not default or optional scopes for targetClient
+            scope = Arrays.stream(scope.split(" ")).filter(s -> "openid".equals(s) || (targetClientScopes.contains(Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES) ? s.split(":")[0] : s))).collect(Collectors.joining(" "));
+        } else if (token != null && token.getScope() != null) {
+            String subjectTokenScopes = token.getScope();
+            if (Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES)) {
+                Set<String> subjectTokenScopesSet = Arrays.stream(subjectTokenScopes.split(" ")).map(s -> s.split(":")[0]).collect(Collectors.toSet());
+                scope = Arrays.stream(scope.split(" ")).filter(sc -> subjectTokenScopesSet.contains(sc.split(":")[0])).collect(Collectors.joining(" "));
+            } else {
+                Set<String> subjectTokenScopesSet = Arrays.stream(subjectTokenScopes.split(" ")).collect(Collectors.toSet());
+                scope = Arrays.stream(scope.split(" ")).filter(sc -> subjectTokenScopesSet.contains(sc)).collect(Collectors.joining(" "));
+            }
+
+            Set<String> targetClientScopes = new HashSet<String>();
+            targetClientScopes.addAll(targetClient.getClientScopes(true).keySet());
+            targetClientScopes.addAll(targetClient.getClientScopes(false).keySet());
+            //from return scope remove scopes that are not default or optional scopes for targetClient
+            scope = Arrays.stream(scope.split(" ")).filter(s -> "openid".equals(s) || (targetClientScopes.contains(Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES) ? s.split(":")[0] : s))).collect(Collectors.joining(" "));
+        }
+        return scope;
+    }
+
+    @Override
+    protected void setClientToContext(List<ClientModel> targetAudienceClients) {
+        ClientModel targetClient = getTargetClient(targetAudienceClients);
+        session.getContext().setClient(targetClient);
+    }
+
+    protected ClientModel getTargetClient(List<ClientModel> targetAudienceClients) {
+        // Make just first client into consideration in V1
+        return targetAudienceClients.get(0);
+    }
+
+    @Override
+    protected Response exchangeClientToOIDCClient(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType,
+                                                  List<ClientModel> targetAudienceClients, String scope, AccessToken subjectToken) {
+        ClientModel targetClient = getTargetClient(targetAudienceClients);
+        RootAuthenticationSessionModel rootAuthSession = new AuthenticationSessionManager(session).createAuthenticationSession(realm, false);
+        AuthenticationSessionModel authSession = createSessionModel(targetUserSession, rootAuthSession, targetUser, targetClient, scope);
+
+        AuthenticationManager.setClientScopesInSession(session, authSession);
+        ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(this.session, targetUserSession, authSession);
+
+        if (!AuthenticationManager.isClientSessionValid(realm, client, targetUserSession, targetUserSession.getAuthenticatedClientSessionByClient(client.getId()))) {
+            // create the requester client session if needed
+            AuthenticationSessionModel clientAuthSession = createSessionModel(targetUserSession, rootAuthSession, targetUser, client, scope);
+            TokenManager.attachAuthenticationSession(this.session, targetUserSession, clientAuthSession);
+        }
+
+        updateUserSessionFromClientAuth(targetUserSession);
+
+        TokenManager.AccessTokenResponseBuilder responseBuilder = tokenManager.responseBuilder(realm, targetClient, event, this.session, targetUserSession, clientSessionCtx)
+                .generateAccessToken();
+        responseBuilder.getAccessToken().issuedFor(client.getClientId());
+
+        if (targetClient != null && !targetClient.equals(client)) {
+            responseBuilder.getAccessToken().addAudience(targetClient.getClientId());
+        }
+
+        if (formParams.containsKey(OAuth2Constants.REQUESTED_SUBJECT)) {
+            // if "impersonation", store the client that originated the impersonated user session
+            targetUserSession.setNote(IMPERSONATOR_CLIENT.toString(), client.getId());
+        }
+
+        if (targetUserSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT) {
+            responseBuilder.getAccessToken().setSessionId(null);
+        }
+
+        String issuedTokenType;
+        if (requestedTokenType.equals(OAuth2Constants.REFRESH_TOKEN_TYPE)
+                && OIDCAdvancedConfigWrapper.fromClientModel(client).isUseRefreshToken()
+                && targetUserSession.getPersistenceState() != UserSessionModel.SessionPersistenceState.TRANSIENT) {
+            responseBuilder.generateRefreshToken();
+            responseBuilder.getRefreshToken().issuedFor(client.getClientId());
+            issuedTokenType = OAuth2Constants.REFRESH_TOKEN_TYPE;
+        } else {
+            issuedTokenType = OAuth2Constants.ACCESS_TOKEN_TYPE;
+        }
+
+        String scopeParam = clientSessionCtx.getClientSession().getNote(OAuth2Constants.SCOPE);
+        if (TokenUtil.isOIDCRequest(scopeParam)) {
+            responseBuilder.generateIDToken().generateAccessTokenHash();
+        }
+
+        AccessTokenResponse res = responseBuilder.build();
+        res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, issuedTokenType);
+
+        event.detail(Details.AUDIENCE, targetClient.getClientId())
+                .user(targetUser);
+
+        event.success();
+
+        return cors.add(Response.ok(res, MediaType.APPLICATION_JSON_TYPE));
+    }
+
+    @Override
+    protected Response exchangeClientToSAML2Client(UserModel targetUser, UserSessionModel targetUserSession, String requestedTokenType, List<ClientModel> targetAudienceClients) {
+        ClientModel targetClient = getTargetClient(targetAudienceClients);
+
+        // Create authSession with target SAML 2.0 client and authenticated user
+        LoginProtocolFactory factory = (LoginProtocolFactory) session.getKeycloakSessionFactory()
+                .getProviderFactory(LoginProtocol.class, SamlProtocol.LOGIN_PROTOCOL);
+        SamlService samlService = (SamlService) factory.createProtocolEndpoint(session, event);
+        AuthenticationSessionModel authSession = samlService.getOrCreateLoginSessionForIdpInitiatedSso(session, realm,
+                targetClient, null);
+        if (authSession == null) {
+            logger.error("SAML assertion consumer url not set up");
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires assertion consumer url set up", Response.Status.BAD_REQUEST);
+        }
+
+        authSession.setAuthenticatedUser(targetUser);
+
+        event.session(targetUserSession);
+
+        AuthenticationManager.setClientScopesInSession(session, authSession);
+        ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(this.session, targetUserSession,
+                authSession);
+
+        updateUserSessionFromClientAuth(targetUserSession);
+
+        // Create SAML 2.0 Assertion Response
+        SamlClient samlClient = new SamlClient(targetClient);
+        SamlProtocol samlProtocol = new TokenEndpoint.TokenExchangeSamlProtocol(samlClient).setEventBuilder(event).setHttpHeaders(headers).setRealm(realm)
+                .setSession(session).setUriInfo(session.getContext().getUri());
+
+        Response samlAssertion = samlProtocol.authenticated(authSession, targetUserSession, clientSessionCtx);
+        if (samlAssertion.getStatus() != 200) {
+            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, "Can not get SAML 2.0 token", Response.Status.BAD_REQUEST);
+        }
+        String xmlString = (String) samlAssertion.getEntity();
+        String encodedXML = Base64Url.encode(xmlString.getBytes(GeneralConstants.SAML_CHARSET));
+
+        int assertionLifespan = samlClient.getAssertionLifespan();
+
+        AccessTokenResponse res = new AccessTokenResponse();
+        res.setToken(encodedXML);
+        res.setTokenType("Bearer");
+        res.setExpiresIn(assertionLifespan <= 0 ? realm.getAccessCodeLifespan() : assertionLifespan);
+        res.setOtherClaims(OAuth2Constants.ISSUED_TOKEN_TYPE, requestedTokenType);
+
+        event.detail(Details.AUDIENCE, targetClient.getClientId())
+                .user(targetUser);
+
+        event.success();
+
+        return cors.add(Response.ok(res, MediaType.APPLICATION_JSON_TYPE));
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProviderFactory.java b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProviderFactory.java
new file mode 100644
index 000000000000..8dca85263c0f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/protocol/oidc/tokenexchange/V1TokenExchangeProviderFactory.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package org.keycloak.protocol.oidc.tokenexchange;
+
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.protocol.oidc.TokenExchangeProvider;
+import org.keycloak.protocol.oidc.TokenExchangeProviderFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+
+/**
+ * V1 token exchange provider factory. Supports all token exchange types (standard, federated, subject impersonation)
+ *
+ * @author <a href="mailto:dmitryt@backbase.com">Dmitry Telegin</a>
+ */
+public class V1TokenExchangeProviderFactory implements TokenExchangeProviderFactory, EnvironmentDependentProviderFactory {
+
+    @Override
+    public TokenExchangeProvider create(KeycloakSession session) {
+        return new V1TokenExchangeProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java b/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
index 9b54ad27026c..9f5741fb5f74 100644
--- a/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/utils/AcrUtils.java
@@ -119,6 +119,8 @@ private static List<String> getAcrValues(String claimsParam, String acrValuesPar
                         if (!essential || acrClaim.isEssential()) {
                             if (acrClaim.getValues() != null) {
                                 acrValues.addAll(acrClaim.getValues());
+                            } else if (acrClaim.getValue() != null) {
+                                acrValues.add(acrClaim.getValue());
                             }
                         }
                     }
diff --git a/services/src/main/java/org/keycloak/protocol/saml/IDPMetadataDescriptor.java b/services/src/main/java/org/keycloak/protocol/saml/IDPMetadataDescriptor.java
index 410de32d98f0..328c65bc6dc6 100644
--- a/services/src/main/java/org/keycloak/protocol/saml/IDPMetadataDescriptor.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/IDPMetadataDescriptor.java
@@ -24,17 +24,20 @@
 import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
 import org.keycloak.dom.saml.v2.metadata.KeyTypes;
 
-import java.io.StringWriter;
 import java.net.URI;
+import java.security.KeyPair;
+import java.security.PrivateKey;
 import java.util.Arrays;
 import java.util.List;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.stream.XMLStreamWriter;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.saml.SignatureAlgorithm;
 import org.keycloak.saml.common.exceptions.ProcessingException;
-import org.keycloak.saml.processing.core.saml.v2.writers.SAMLMetadataWriter;
-import org.keycloak.saml.common.util.StaxUtil;
+import org.keycloak.saml.common.exceptions.ConfigurationException;
+import org.keycloak.saml.common.exceptions.ParsingException;
+import org.keycloak.saml.processing.core.saml.v2.util.SAMLMetadataUtil;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
@@ -55,13 +58,16 @@
 public class IDPMetadataDescriptor {
 
     public static String getIDPDescriptor(URI loginPostEndpoint, URI loginRedirectEndpoint, URI logoutEndpoint,
-        URI artifactResolutionService, String entityId, boolean wantAuthnRequestsSigned, List<Element> signingCerts)
-        throws ProcessingException
-    {
-      
-        StringWriter sw = new StringWriter();
-        XMLStreamWriter writer = StaxUtil.getXMLStreamWriter(sw);
-        SAMLMetadataWriter metadataWriter = new SAMLMetadataWriter(writer);
+            URI artifactResolutionService, String entityId, boolean wantAuthnRequestsSigned, List<Element> signingCerts)
+            throws ProcessingException {
+        return getIDPDescriptor(null, null, loginPostEndpoint, loginRedirectEndpoint, logoutEndpoint,
+                artifactResolutionService, entityId, wantAuthnRequestsSigned, signingCerts);
+    }
+
+    public static String getIDPDescriptor(KeyWrapper keyWrapper, SignatureAlgorithm sigAlg,
+            URI loginPostEndpoint, URI loginRedirectEndpoint, URI logoutEndpoint,
+            URI artifactResolutionService, String entityId, boolean wantAuthnRequestsSigned, List<Element> signingCerts)
+            throws ProcessingException {
 
         EntityDescriptorType entityDescriptor = new EntityDescriptorType(entityId);
 
@@ -94,10 +100,18 @@ public static String getIDPDescriptor(URI loginPostEndpoint, URI loginRedirectEn
         }
 
         entityDescriptor.addChoiceType(new EntityDescriptorType.EDTChoiceType(Arrays.asList(new EntityDescriptorType.EDTDescriptorChoiceType(spIDPDescriptor))));
-      
-        metadataWriter.writeEntityDescriptor(entityDescriptor);
 
-        return sw.toString();
+        if (sigAlg != null && keyWrapper != null && keyWrapper.getCertificate() != null && keyWrapper.getPrivateKey() != null) {
+            try {
+                return SAMLMetadataUtil.signEntityDescriptorType(entityDescriptor, sigAlg, keyWrapper.getKid(),
+                        keyWrapper.getCertificate(),
+                        new KeyPair(keyWrapper.getCertificate().getPublicKey(), (PrivateKey) keyWrapper.getPrivateKey()));
+            } catch (ConfigurationException | ParsingException e) {
+                throw new ProcessingException("Cannot sign IDP metadata with key " + keyWrapper.getKid(), e);
+            }
+        } else {
+            return SAMLMetadataUtil.writeEntityDescriptorType(entityDescriptor);
+        }
     }
 
     public static Element buildKeyInfoElement(String keyName, String pemEncodedCertificate)
diff --git a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
index 68a1b64388c3..525f2c164fb4 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
@@ -364,29 +364,46 @@ public static boolean isLogoutPostBindingForInitiator(UserSessionModel session)
         return SamlProtocol.SAML_POST_BINDING.equals(note);
     }
 
-    protected boolean isLogoutPostBindingForClient(AuthenticatedClientSessionModel clientSession) {
+    public static String getLogoutBindingTypeForClientSession(AuthenticatedClientSessionModel clientSession) {
         ClientModel client = clientSession.getClient();
         SamlClient samlClient = new SamlClient(client);
         String logoutPostUrl = client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE);
         String logoutRedirectUrl = client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE);
+        String logoutArtifactUrl = client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE);
 
-        if (logoutPostUrl == null || logoutPostUrl.trim().isEmpty()) {
-            // if we don't have a redirect uri either, return true and default to the admin url + POST binding
-            return (logoutRedirectUrl == null || logoutRedirectUrl.trim().isEmpty());
+        boolean postUrlSet = !(logoutPostUrl == null || logoutPostUrl.trim().isEmpty());
+        boolean redirectUrlSet = !(logoutRedirectUrl == null || logoutRedirectUrl.trim().isEmpty());
+        boolean artifactUrlSet = !(logoutArtifactUrl == null || logoutArtifactUrl.trim().isEmpty());
+
+        // client configured to force post binding and postUrl for logout is set
+        if (samlClient.forcePostBinding() && postUrlSet) {
+            return SAML_POST_BINDING;
+        }
+
+        // client configured to force artifact binding and artifactUrl for logout is set
+        if (samlClient.forceArtifactBinding() && artifactUrlSet) {
+            return SAML_ARTIFACT_BINDING;
         }
 
-        if (samlClient.forcePostBinding()) {
-            return true; // configured to force a post binding and post binding logout url is not null
+        final String bindingType = clientSession.getNote(SAML_BINDING);
+
+        // if the login binding was artifact and url set, return artifact
+        if (SAML_ARTIFACT_BINDING.equals(bindingType) && artifactUrlSet) {
+            return SAML_ARTIFACT_BINDING;
         }
 
-        String bindingType = clientSession.getNote(SAML_BINDING);
+        // if the login binding was POST and url set, return POST
+        if (SAML_POST_BINDING.equals(bindingType) && postUrlSet) {
+            return SAML_POST_BINDING;
+        }
 
-        // if the login binding was POST, return true
-        if (SAML_POST_BINDING.equals(bindingType))
-            return true;
+        // fall back to post binding if no redirect URL
+        if (!redirectUrlSet && (postUrlSet || samlClient.forcePostBinding())) {
+            return SAML_POST_BINDING;
+        }
 
-        // true if we don't have a redirect binding url, so use post binding, false for redirect binding
-        return (logoutRedirectUrl == null || logoutRedirectUrl.trim().isEmpty());
+        // Default to Redirect
+        return SAML_REDIRECT_BINDING;
     }
 
     protected String getNameIdFormat(SamlClient samlClient, AuthenticationSessionModel authSession) {
@@ -665,7 +682,7 @@ public static String getLogoutServiceUrl(KeycloakSession session, ClientModel cl
             // we do not allow this URL to be set through the management URL (it is a purely backend-oriented URL)
             logoutServiceUrl = client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE);
             return logoutServiceUrl == null || logoutServiceUrl.trim().equals("") ? null : logoutServiceUrl;
-        } else if (!backChannelLogout && useArtifactForLogout(client)) {
+        } else if (!backChannelLogout && (SAML_ARTIFACT_BINDING.equals(bindingType) || useArtifactForLogout(client))) {
             // backchannel logout doesn't support sending artifacts
             logoutServiceUrl = client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE);
         } else if (SAML_POST_BINDING.equals(bindingType)) {
@@ -680,7 +697,8 @@ public static String getLogoutServiceUrl(KeycloakSession session, ClientModel cl
             return null;
         return ResourceAdminManager.resolveUri(session, client.getRootUrl(), logoutServiceUrl);
     }
-    
+
+
     public static boolean useArtifactForLogout(ClientModel client) {
         return new SamlClient(client).forceArtifactBinding()
                 && client.getAttribute(SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE) != null;
@@ -691,15 +709,15 @@ public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedCl
         ClientModel client = clientSession.getClient();
         SamlClient samlClient = new SamlClient(client);
         try {
-            boolean postBinding = isLogoutPostBindingForClient(clientSession);
-            String bindingUri = getLogoutServiceUrl(session, client, postBinding ? SAML_POST_BINDING : SAML_REDIRECT_BINDING, false);
+            String logoutBindingType = getLogoutBindingTypeForClientSession(clientSession);
+            String bindingUri = getLogoutServiceUrl(session, client, logoutBindingType, false);
             if (bindingUri == null) {
                 logger.warnf("Failed to logout client %s, skipping this client.  Please configure the logout service url in the admin console for your client applications.", client.getClientId());
                 return null;
             }
 
             NodeGenerator[] extensions = new NodeGenerator[]{};
-            if (!postBinding) {
+            if (!SAML_POST_BINDING.equals(logoutBindingType)) {
                 if (samlClient.requiresRealmSignature() && samlClient.addExtensionsElementWithKeyInfo()) {
                     KeyManager.ActiveRsaKey keys = session.keys().getActiveRsaKey(realm);
                     String keyName = samlClient.getXmlSigKeyInfoKeyNameTransformer().getKeyName(keys.getKid(), keys.getCertificate());
@@ -707,17 +725,16 @@ public Response frontchannelLogout(UserSessionModel userSession, AuthenticatedCl
                 }
             }
             LogoutRequestType logoutRequest = createLogoutRequest(bindingUri, clientSession, client, extensions);
-            JaxrsSAML2BindingBuilder binding = createBindingBuilder(samlClient, "true".equals(clientSession.getNote(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get())));
+            JaxrsSAML2BindingBuilder binding = createBindingBuilder(samlClient, SAML_ARTIFACT_BINDING.equals(logoutBindingType));
 
             //If this session uses artifact binding, send an artifact instead of the LogoutRequest
-            if ("true".equals(clientSession.getNote(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get()))
-                    && useArtifactForLogout(client)) {
+            if (SAML_ARTIFACT_BINDING.equals(logoutBindingType)) {
                 clientSession.setAction(CommonClientSessionModel.Action.LOGGING_OUT.name());
                 return buildArtifactAuthenticatedResponse(clientSession, bindingUri, logoutRequest, binding);
             }
 
             Document samlDocument = SAML2Request.convert(logoutRequest);
-            if (postBinding) {
+            if (SAML_POST_BINDING.equals(logoutBindingType)) {
                 // This is POST binding, hence KeyID is included in dsig:KeyInfo/dsig:KeyName, no need to add <samlp:Extensions> element
                 return binding.postBinding(samlDocument).request(bindingUri);
             } else {
@@ -1025,7 +1042,7 @@ protected Response buildLogoutArtifactResponse(UserSessionModel userSession,
             throw new ProcessingException(e);
         }
     }
-    
+
     protected String buildArtifactAndStoreResponse(SAML2Object statusResponseType, UserSessionModel userSession) throws ArtifactResolverProcessingException, ConfigurationException, ProcessingException {
         String clientIdThatInitiatedLogout = userSession.getNote(SAML_LOGOUT_INITIATOR_CLIENT_ID);
         userSession.removeNote(SAML_LOGOUT_INITIATOR_CLIENT_ID);
@@ -1037,7 +1054,7 @@ protected String buildArtifactAndStoreResponse(SAML2Object statusResponseType, U
 
         return buildArtifactAndStoreResponse(statusResponseType, clientSessionModel);
     }
-    
+
     protected String buildArtifactAndStoreResponse(SAML2Object saml2Object, AuthenticatedClientSessionModel clientSessionModel) throws ArtifactResolverProcessingException, ProcessingException, ConfigurationException {
         String entityId = RealmsResource.realmBaseUrl(uriInfo).build(realm.getName()).toString();
         ArtifactResponseType artifactResponseType = SamlProtocolUtils.buildArtifactResponse(saml2Object, SAML2NameIDBuilder.value(getResponseIssuer(realm)).build());
@@ -1050,7 +1067,7 @@ protected String buildArtifactAndStoreResponse(SAML2Object saml2Object, Authenti
         notes.put(USER_SESSION_ID, clientSessionModel.getUserSession().getId());
         notes.put(CLIENT_SESSION_ID, clientSessionModel.getClient().getId());
         getSingleUseStore().put(artifact, realm.getAccessCodeLifespan(), notes);
-        
+
         return artifact;
     }
 
diff --git a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
index 7ac3d9f7fcac..61a83ad3ea3f 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
@@ -29,6 +29,7 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.AbstractLoginProtocolFactory;
 import org.keycloak.protocol.LoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
 import org.keycloak.protocol.saml.mappers.AttributeStatementHelper;
 import org.keycloak.organization.protocol.mappers.saml.OrganizationMembershipMapper;
 import org.keycloak.protocol.saml.mappers.RoleListMapper;
@@ -193,4 +194,11 @@ public void setupClientDefaults(ClientRepresentation clientRep, ClientModel newC
         client.setArtifactBindingIdentifierFrom(clientRep.getClientId());
     }
 
+    /**
+     * defines the option-order in the admin-ui
+     */
+    @Override
+    public int order() {
+        return OIDCLoginProtocolFactory.UI_ORDER - 10;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/protocol/saml/SamlService.java b/services/src/main/java/org/keycloak/protocol/saml/SamlService.java
index b5bc7de639f3..e0b8529f834d 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/SamlService.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/SamlService.java
@@ -266,6 +266,10 @@ protected Response triggerSamlEvent(ClientPolicyContext ctx) {
             try {
                 session.clientPolicy().triggerOnEvent(ctx);
             } catch (ClientPolicyException cpe) {
+                event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+                event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+                event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+                event.error(cpe.getError());
                 logger.warnf("Error in client policies processing the request: %s - %s", cpe.getError(), cpe.getErrorDetail());
                 return error(session, null, Response.Status.BAD_REQUEST, Messages.INVALID_REQUEST);
             }
@@ -587,8 +591,7 @@ protected Response logoutRequest(LogoutRequestType logoutRequest, ClientModel cl
 
                     //artifact binding state must be attached to the user session upon logout, as authenticated session
                     //no longer exists when the LogoutResponse message is sent
-                    if ("true".equals(clientSession.getNote(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get()))
-                            && SamlProtocol.useArtifactForLogout(client)){
+                    if (SamlProtocol.SAML_ARTIFACT_BINDING.equals(SamlProtocol.getLogoutBindingTypeForClientSession(clientSession))){
                         clientSession.setAction(AuthenticationSessionModel.Action.LOGGING_OUT.name());
                         userSession.setNote(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get(), "true");
                         userSession.setNote(SamlProtocol.SAML_LOGOUT_INITIATOR_CLIENT_ID, client.getId());
@@ -914,8 +917,10 @@ public String getDescriptor() throws Exception {
 
     public static String getIDPMetadataDescriptor(UriInfo uriInfo, KeycloakSession session, RealmModel realm) {
         try {
-            List<Element> signingKeys = session.keys().getKeysStream(realm, KeyUse.SIG, Algorithm.RS256)
+            List<KeyWrapper> keys = session.keys().getKeysStream(realm, KeyUse.SIG, Algorithm.RS256)
                     .sorted(SamlService::compareKeys)
+                    .collect(Collectors.toList());
+            List<Element> signingKeys = keys.stream()
                     .map(key -> {
                         try {
                             return IDPMetadataDescriptor
@@ -927,6 +932,8 @@ public static String getIDPMetadataDescriptor(UriInfo uriInfo, KeycloakSession s
                     .collect(Collectors.toList());
 
             return IDPMetadataDescriptor.getIDPDescriptor(
+                keys.isEmpty()? null : keys.iterator().next(),
+                realm.getAttribute(SamlConfigAttributes.SAML_SIGNATURE_ALGORITHM, SignatureAlgorithm.class, null),
                 RealmsResource.protocolUrl(uriInfo).build(realm.getName(), SamlProtocol.LOGIN_PROTOCOL),
                 RealmsResource.protocolUrl(uriInfo).build(realm.getName(), SamlProtocol.LOGIN_PROTOCOL),
                 RealmsResource.protocolUrl(uriInfo).build(realm.getName(), SamlProtocol.LOGIN_PROTOCOL),
diff --git a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeNameIdMapper.java b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeNameIdMapper.java
index 67e7d01d8be2..db5e3c964adc 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeNameIdMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeNameIdMapper.java
@@ -21,6 +21,8 @@ public class UserAttributeNameIdMapper extends AbstractSAMLProtocolMapper implem
         property.setName(ProtocolMapperUtils.USER_ATTRIBUTE);
         property.setLabel(ProtocolMapperUtils.USER_MODEL_ATTRIBUTE_LABEL);
         property.setHelpText(ProtocolMapperUtils.USER_MODEL_ATTRIBUTE_HELP_TEXT);
+        property.setType(ProviderConfigProperty.USER_PROFILE_ATTRIBUTE_LIST_TYPE);
+        property.setRequired(Boolean.TRUE);
         configProperties.add(property);
     }
 
diff --git a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeStatementMapper.java b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeStatementMapper.java
index 89723cac19ad..fe011f373204 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeStatementMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserAttributeStatementMapper.java
@@ -47,6 +47,7 @@ public class UserAttributeStatementMapper extends AbstractSAMLProtocolMapper imp
         property.setLabel(ProtocolMapperUtils.USER_MODEL_ATTRIBUTE_LABEL);
         property.setHelpText(ProtocolMapperUtils.USER_MODEL_ATTRIBUTE_HELP_TEXT);
         property.setType(ProviderConfigProperty.USER_PROFILE_ATTRIBUTE_LIST_TYPE);
+        property.setRequired(Boolean.TRUE);
         configProperties.add(property);
         AttributeStatementHelper.setConfigProperties(configProperties);
 
diff --git a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserPropertyAttributeStatementMapper.java b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserPropertyAttributeStatementMapper.java
index 8523f0ac0ee9..3f248df6038b 100755
--- a/services/src/main/java/org/keycloak/protocol/saml/mappers/UserPropertyAttributeStatementMapper.java
+++ b/services/src/main/java/org/keycloak/protocol/saml/mappers/UserPropertyAttributeStatementMapper.java
@@ -45,6 +45,7 @@ public class UserPropertyAttributeStatementMapper extends AbstractSAMLProtocolMa
         property.setLabel(ProtocolMapperUtils.USER_MODEL_PROPERTY_LABEL);
         property.setHelpText(ProtocolMapperUtils.USER_MODEL_PROPERTY_HELP_TEXT);
         property.setType(ProviderConfigProperty.USER_PROFILE_ATTRIBUTE_LIST_TYPE);
+        property.setRequired(Boolean.TRUE);
         configProperties.add(property);
         AttributeStatementHelper.setConfigProperties(configProperties);
 
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
index e32816a565bb..41072d455283 100755
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
@@ -32,6 +32,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.representations.JsonWebToken;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.theme.Theme;
 import org.keycloak.tracing.TracingAttributes;
@@ -161,8 +162,8 @@ public Locale resolveLocale(UserModel user) {
     }
 
     @Override
-    public Locale resolveLocale(UserModel user, Theme.Type themeType) {
-        return session.getProvider(LocaleSelectorProvider.class).resolveLocale(getRealm(), user, themeType);
+    public Locale resolveLocale(UserModel user, boolean ignoreAcceptLanguageHeader) {
+        return session.getProvider(LocaleSelectorProvider.class).resolveLocale(getRealm(), user, ignoreAcceptLanguageHeader);
     }
 
     @Override
@@ -287,4 +288,25 @@ public void setBearerToken(Token token) {
     public Token getBearerToken() {
         return bearerToken;
     }
+
+    @Override
+    public UserModel getUser() {
+        UserModel user = null;
+
+        if (bearerToken instanceof JsonWebToken jwt) {
+            String issuer = jwt.getIssuer();
+            String realmName = issuer.substring(issuer.lastIndexOf("/") + 1);
+            RealmModel realm = session.realms().getRealmByName(realmName);
+
+            if (realm != null) {
+                user = session.users().getUserById(realm, jwt.getSubject());
+            }
+        }
+
+        if (user == null) {
+            user = userSession == null ? null : userSession.getUser();
+        }
+
+        return user;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
index 16cfed6e8994..b76f8f9268ef 100644
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
@@ -81,7 +81,6 @@ public abstract class DefaultKeycloakSession implements KeycloakSession {
     private DatastoreProvider datastoreProvider;
     private final KeycloakContext context;
     private KeyManager keyManager;
-    private ThemeManager themeManager;
     private TokenManager tokenManager;
     private VaultTranscriber vaultTranscriber;
     private ClientPolicyManager clientPolicyManager;
@@ -314,10 +313,7 @@ public KeyManager keys() {
 
     @Override
     public ThemeManager theme() {
-        if (themeManager == null) {
-            themeManager = factory.getThemeManagerFactory().create(this);
-        }
-        return themeManager;
+        return this.getProvider(ThemeManager.class);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakSessionFactory.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakSessionFactory.java
index e816ee0c491e..30cb49cf515a 100755
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakSessionFactory.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakSessionFactory.java
@@ -42,6 +42,7 @@
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.ThemeManager;
 import org.keycloak.provider.EnvironmentDependentProviderFactory;
 import org.keycloak.provider.InvalidationHandler;
 import org.keycloak.provider.KeycloakDeploymentInfo;
@@ -53,8 +54,8 @@
 import org.keycloak.provider.ProviderManagerDeployer;
 import org.keycloak.provider.ProviderManagerRegistry;
 import org.keycloak.provider.Spi;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
-import org.keycloak.theme.DefaultThemeManagerFactory;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.theme.ThemeManagerFactory;
 
 public abstract class DefaultKeycloakSessionFactory implements KeycloakSessionFactory, ProviderManagerDeployer {
 
@@ -65,8 +66,6 @@ public abstract class DefaultKeycloakSessionFactory implements KeycloakSessionFa
     protected volatile Map<Class<? extends Provider>, Map<String, ProviderFactory>> factoriesMap = new HashMap<>();
     protected CopyOnWriteArrayList<ProviderEventListener> listeners = new CopyOnWriteArrayList<>();
 
-    private final DefaultThemeManagerFactory themeManagerFactory = new DefaultThemeManagerFactory();
-
     // TODO: Likely should be changed to int and use Time.currentTime() to be compatible with all our "time" reps
     protected long serverStartupTimestamp;
 
@@ -139,14 +138,14 @@ protected void initProviderFactories(boolean updateComponentFactory, Map<Class<?
         Stack<ProviderFactory> recursionPrevention = new Stack<>();
 
         for(Map.Entry<Class<? extends Provider>, Map<String, ProviderFactory>>  f : factories.entrySet()) {
-            if (initializedProviders.contains(f.getKey())) {
-                continue;
-            }
             initializeProviders(f.getKey(), factories, initializedProviders, recursionPrevention);
         }
     }
 
-    private void initializeProviders(Class<? extends Provider> provider, Map<Class<? extends Provider>, Map<String, ProviderFactory>> factories, Set<Class<? extends Provider>> intializedProviders, Stack<ProviderFactory> recursionPrevention) {
+    private void initializeProviders(Class<? extends Provider> provider, Map<Class<? extends Provider>, Map<String, ProviderFactory>> factories, Set<Class<? extends Provider>> initializedProviders, Stack<ProviderFactory> recursionPrevention) {
+        if (initializedProviders.contains(provider)) {
+            return;
+        }
         for (ProviderFactory<?> factory : factories.get(provider).values()) {
             if (factory == componentFactoryPF)
                 continue;
@@ -159,14 +158,14 @@ private void initializeProviders(Class<? extends Provider> provider, Map<Class<?
                 }
                 Map<String, ProviderFactory> f = factories.get(providerDep);
                 if (f == null) {
-                    throw new RuntimeException("No provider factories exists for provider " + providerDep.getSimpleName());
+                    throw new RuntimeException("No provider factories exists for provider " + providerDep.getSimpleName() + " required by " + factory.getClass().getName() + " (" + factory.getId() + ")");
                 }
                 recursionPrevention.push(factory);
-                initializeProviders(providerDep, factories, intializedProviders, recursionPrevention);
+                initializeProviders(providerDep, factories, initializedProviders, recursionPrevention);
                 recursionPrevention.pop();
             }
             factory.postInit(this);
-            intializedProviders.add(provider);
+            initializedProviders.add(provider);
         }
     }
 
@@ -222,7 +221,7 @@ public void deploy(ProviderManager pm) {
         initProviderFactories(cfChanged, deployed);
 
         if (pm.getInfo().hasThemes() || pm.getInfo().hasThemeResources()) {
-            themeManagerFactory.clearCache();
+            ((ThemeManagerFactory)getProviderFactory(ThemeManager.class)).clearCache();
         }
     }
 
@@ -263,10 +262,6 @@ public void undeploy(ProviderManager pm) {
         }
     }
 
-    protected DefaultThemeManagerFactory getThemeManagerFactory() {
-        return themeManagerFactory;
-    }
-
     protected void checkProvider() {
         // make sure to recreated the default providers map
         provider.clear();
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakTransactionManager.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakTransactionManager.java
index 2e01ae5dcb7b..d27cb87ce61a 100755
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakTransactionManager.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakTransactionManager.java
@@ -118,50 +118,51 @@ public void commit() {
         }
 
         TracingProvider tracing = session.getProvider(TracingProvider.class);
-
-        RuntimeException exception = null;
-        for (KeycloakTransaction tx : prepare) {
-            try {
-                commitWithTracing(tx, tracing);
-            } catch (RuntimeException e) {
-                exception = exception == null ? e : exception;
-            }
-        }
-        if (exception != null) {
-            rollback(exception);
-            return;
-        }
-        for (KeycloakTransaction tx : transactions) {
-            try {
-                commitWithTracing(tx, tracing);
-            } catch (RuntimeException e) {
-                exception = exception == null ? e : exception;
-            }
-        }
-
-        // Don't commit "afterCompletion" if commit of some main transaction failed
-        if (exception == null) {
-            for (KeycloakTransaction tx : afterCompletion) {
+        tracing.trace(DefaultKeycloakTransactionManager.class, "commit", span -> {
+            RuntimeException exception = null;
+            for (KeycloakTransaction tx : prepare) {
                 try {
                     commitWithTracing(tx, tracing);
                 } catch (RuntimeException e) {
                     exception = exception == null ? e : exception;
                 }
             }
-        } else {
-            for (KeycloakTransaction tx : afterCompletion) {
+            if (exception != null) {
+                rollback(exception);
+                return;
+            }
+            for (KeycloakTransaction tx : transactions) {
                 try {
-                    tx.rollback();
+                    commitWithTracing(tx, tracing);
                 } catch (RuntimeException e) {
-                    ServicesLogger.LOGGER.exceptionDuringRollback(e);
+                    exception = exception == null ? e : exception;
                 }
             }
-        }
 
-        active = false;
-        if (exception != null) {
-            throw exception;
-        }
+            // Don't commit "afterCompletion" if commit of some main transaction failed
+            if (exception == null) {
+                for (KeycloakTransaction tx : afterCompletion) {
+                    try {
+                        commitWithTracing(tx, tracing);
+                    } catch (RuntimeException e) {
+                        exception = exception == null ? e : exception;
+                    }
+                }
+            } else {
+                for (KeycloakTransaction tx : afterCompletion) {
+                    try {
+                        tx.rollback();
+                    } catch (RuntimeException e) {
+                        ServicesLogger.LOGGER.exceptionDuringRollback(e);
+                    }
+                }
+            }
+
+            active = false;
+            if (exception != null) {
+                throw exception;
+            }
+        });
     }
 
     private static void commitWithTracing(KeycloakTransaction tx, TracingProvider tracing) {
diff --git a/services/src/main/java/org/keycloak/services/ServicesLogger.java b/services/src/main/java/org/keycloak/services/ServicesLogger.java
index 82abd5587738..f4cc2260c16a 100644
--- a/services/src/main/java/org/keycloak/services/ServicesLogger.java
+++ b/services/src/main/java/org/keycloak/services/ServicesLogger.java
@@ -70,18 +70,6 @@ public interface ServicesLogger extends BasicLogger {
     @Message(id=5, value="Unable to import realm %s from %s.")
     void unableToImportRealm(@Cause Throwable t, String realmName, String from);
 
-    @LogMessage(level = INFO)
-    @Message(id=6, value="Importing users from '%s'")
-    void imprtingUsersFrom(Object from);
-
-    @LogMessage(level = ERROR)
-    @Message(id=7, value="Failed to load 'keycloak-add-user.json'")
-    void failedToLoadUsers(@Cause Throwable t);
-
-    @LogMessage(level = ERROR)
-    @Message(id=8, value="Failed to add user %s to realm %s: realm not found")
-    void addUserFailedRealmNotFound(String user, String realm);
-
     @LogMessage(level = INFO)
     @Message(id=9, value="Added user '%s' to realm '%s'")
     void addUserSuccess(String user, String realm);
@@ -89,7 +77,7 @@ public interface ServicesLogger extends BasicLogger {
     @LogMessage(level = ERROR)
     @Message(id=10, value="Failed to add user '%s' to realm '%s': user with username exists")
     void addUserFailedUserExists(String user, String realm);
-    
+
     @LogMessage(level = ERROR)
     @Message(id=11, value="Failed to add user '%s' to realm '%s'")
     void addUserFailed(@Cause Throwable t, String user, String realm);
@@ -472,11 +460,11 @@ public interface ServicesLogger extends BasicLogger {
     @LogMessage(level = WARN)
     @Message(id=108, value="URI '%s' doesn't match any trustedHost or trustedDomain")
     void uriDoesntMatch(String uri);
-    
+
     @LogMessage(level = ERROR)
     @Message(id=109, value="Failed to add client '%s' to realm '%s': client with client ID exists")
     void addClientFailedClientExists(String clientId, String realm);
-    
+
     @LogMessage(level = WARN)
     @Message(id=110, value="Environment variable '%s' is deprecated, use '%s' instead")
     void usingDeprecatedEnvironmentVariable(String deprecated, String supported);
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/ClientPoliciesUtil.java b/services/src/main/java/org/keycloak/services/clientpolicy/ClientPoliciesUtil.java
index 5dd947aedf4e..54956d72643a 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/ClientPoliciesUtil.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/ClientPoliciesUtil.java
@@ -39,6 +39,8 @@
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.idm.ClientPoliciesRepresentation;
 import org.keycloak.representations.idm.ClientPolicyConditionConfigurationRepresentation;
 import org.keycloak.representations.idm.ClientPolicyConditionRepresentation;
@@ -49,6 +51,7 @@
 import org.keycloak.representations.idm.ClientProfilesRepresentation;
 import org.keycloak.securityprofile.SecurityProfileProvider;
 import org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProvider;
+import org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory;
 import org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProvider;
 import org.keycloak.util.JsonSerialization;
 
@@ -531,6 +534,9 @@ static private List<ClientPolicyRepresentation> validatePolicies(KeycloakSession
                     if (Profile.isFeatureEnabled(Profile.Feature.CLIENT_POLICIES) && !isValidCondition(session, condition.getConditionProviderId())) {
                         throw new ClientPolicyException("Policy " + proposedPolicyRep.getName() + " contains invalid condition " + condition.getConditionProviderId());
                     }
+                    if (Profile.isFeatureEnabled(Profile.Feature.CLIENT_POLICIES)) {
+                        validateConditionConfig(session, condition);
+                    }
                     policyRep.getConditions().add(condition);
                 }
             }
@@ -597,6 +603,30 @@ private static boolean isValidCondition(KeycloakSession session, String conditio
         return false;
     }
 
+    private static void validateConditionConfig(KeycloakSession session, ClientPolicyConditionRepresentation conditionRep) throws ClientPolicyException {
+        ClientPolicyConditionProviderFactory factory = getClientPolicyConditionFactory(session, conditionRep.getConditionProviderId());
+        try {
+            factory.validateConfiguration(session, session.getContext().getRealm(), conditionRep);
+        }
+        catch (ClientPolicyException e) {
+            throw new ClientPolicyException("Invalid " + conditionRep.getConditionProviderId() + " configuration - " + e.getMessage());
+        }
+    }
+
+    private static ClientPolicyConditionProviderFactory getClientPolicyConditionFactory(KeycloakSession session, String providerId) {
+        Class<? extends Provider> provider = session.getProviderClass(ClientPolicyConditionProvider.class.getName());
+        if (provider == null) {
+            throw new IllegalArgumentException("Invalid provider type '" + ClientPolicyConditionProvider.class.getName() + "'");
+        }
+
+        ProviderFactory<? extends Provider> f = session.getKeycloakSessionFactory().getProviderFactory(provider, providerId);
+        if (f == null) {
+            throw new IllegalArgumentException("No such provider '" + providerId + "'");
+        }
+
+        return (ClientPolicyConditionProviderFactory) f;
+    }
+
     static String getClientProfilesJsonString(RealmModel realm) {
         return realm.getAttribute(Constants.CLIENT_PROFILES);
     }
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrCondition.java
new file mode 100644
index 000000000000..d29f2c4c9865
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrCondition.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.condition;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.utils.AcrUtils;
+import org.keycloak.representations.idm.ClientPolicyConditionConfigurationRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.ClientPolicyVote;
+import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
+
+import java.util.List;
+
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class AcrCondition extends AbstractClientPolicyConditionProvider<AcrCondition.Configuration> {
+
+    public AcrCondition(KeycloakSession session) {
+        super(session);
+    }
+
+    public static class Configuration extends ClientPolicyConditionConfigurationRepresentation {
+
+        @JsonProperty("acr-property")
+        protected String acrProperty;
+
+        public String getAcrProperty() {
+            return acrProperty;
+        }
+
+        public void setAcrProperty(String acrProperty) {
+            this.acrProperty = acrProperty;
+        }
+    }
+
+    @Override
+    public Class<Configuration> getConditionConfigurationClass() {
+        return Configuration.class;
+    }
+
+    @Override
+    public String getProviderId() {
+        return AnyClientConditionFactory.PROVIDER_ID;
+    }
+
+    @Override
+    public ClientPolicyVote applyPolicy(ClientPolicyContext context) throws ClientPolicyException {
+        if (context.getEvent() == ClientPolicyEvent.AUTHORIZATION_REQUEST) {
+            AuthorizationRequestContext authorizationRequestContext = ((AuthorizationRequestContext) context);
+            if (containsAcr(authorizationRequestContext)) {
+                authorizationRequestContext.getAuthenticationSession().setAuthNote(Constants.CLIENT_POLICY_REQUESTED_ACR, configuration.getAcrProperty());
+                return ClientPolicyVote.YES;
+            }
+            else {
+                return ClientPolicyVote.NO;
+            }
+        }
+        return ClientPolicyVote.ABSTAIN;
+    }
+
+    private boolean containsAcr(AuthorizationRequestContext context) {
+        List<String> acrValues = AcrUtils.getAcrValues(context.getAuthorizationEndpointRequest().getClaims(), context.getAuthorizationEndpointRequest().getAcr(), session.getContext().getClient());
+        return acrValues != null && !acrValues.isEmpty() && acrValues.contains(configuration.getAcrProperty());
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrConditionFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrConditionFactory.java
new file mode 100644
index 000000000000..53a9cf3ab61b
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/AcrConditionFactory.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.condition;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class AcrConditionFactory extends AbstractClientPolicyConditionProviderFactory {
+
+    public static final String PROVIDER_ID = "acr-condition";
+
+    public static final String ACR_PROPERTY = "acr-property";
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    static {
+        ProviderConfigProperty property = new ProviderConfigProperty(ACR_PROPERTY, "ACR",
+                "ACR to be requested to satisfy the condition",
+                ProviderConfigProperty.STRING_TYPE, null);
+        configProperties.add(property);
+    }
+
+    @Override
+    public ClientPolicyConditionProvider create(KeycloakSession session) {
+        return new AcrCondition(session);
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "The condition is satisfied when configured acr value is requested";
+    }
+
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientProtocolCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientProtocolCondition.java
index c606e197a002..e88d35585640 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientProtocolCondition.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientProtocolCondition.java
@@ -58,7 +58,7 @@ public ClientProtocolCondition(KeycloakSession session) {
 
     @Override
     public String getProviderId() {
-        return ClientAccessTypeConditionFactory.PROVIDER_ID;
+        return ClientProtocolConditionFactory.PROVIDER_ID;
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesCondition.java
index 0c1da6b1df5a..30fb2c6307c4 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesCondition.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesCondition.java
@@ -28,6 +28,7 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
 import org.keycloak.protocol.oidc.endpoints.request.AuthorizationEndpointRequest;
 import org.keycloak.protocol.oidc.grants.ciba.channel.CIBAAuthenticationRequest;
 import org.keycloak.protocol.oidc.grants.ciba.clientpolicy.context.BackchannelAuthenticationRequestContext;
@@ -40,6 +41,7 @@
 import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
 import org.keycloak.services.clientpolicy.context.ServiceAccountTokenRequestContext;
 import org.keycloak.services.clientpolicy.context.ServiceAccountTokenResponseContext;
+import org.keycloak.services.clientpolicy.context.TokenExchangeRequestContext;
 import org.keycloak.services.clientpolicy.context.TokenRequestContext;
 import org.keycloak.services.clientpolicy.context.TokenResponseContext;
 
@@ -113,6 +115,9 @@ public ClientPolicyVote applyPolicy(ClientPolicyContext context) throws ClientPo
             case BACKCHANNEL_TOKEN_RESPONSE:
                 if (isScopeMatched(((BackchannelTokenResponseContext)context).getParsedRequest())) return ClientPolicyVote.YES;
                 return ClientPolicyVote.NO;
+            case TOKEN_EXCHANGE_REQUEST:
+                if (isScopeMatched(((TokenExchangeRequestContext) context).getTokenExchangeContext())) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
             default:
                 return ClientPolicyVote.ABSTAIN;
         }
@@ -133,6 +138,11 @@ private boolean isScopeMatched(CIBAAuthenticationRequest request) {
         return isScopeMatched(request.getScope(), session.getContext().getRealm().getClientByClientId(request.getClient().getClientId()));
     }
 
+    private boolean isScopeMatched(TokenExchangeContext context) {
+        if (context == null) return false;
+        return isScopeMatched(context.getParams().getScope(), context.getClient());
+    }
+
     private boolean isScopeMatched(String explicitScopes, ClientModel client) {
         if (explicitScopes == null) explicitScopes = "";
         Collection<String> explicitSpecifiedScopes = new HashSet<>(Arrays.asList(explicitScopes.split(" ")));
@@ -148,22 +158,28 @@ private boolean isScopeMatched(String explicitScopes, ClientModel client) {
             expectedScopes.forEach(i -> logger.tracev("expected scope = {0}", i));
         }
 
-        boolean isDefaultScope = ClientScopesConditionFactory.DEFAULT.equals(configuration.getType());
+        switch (configuration.getType()) {
+            case ClientScopesConditionFactory.DEFAULT:
+                expectedScopes.retainAll(defaultScopes);
+                return !expectedScopes.isEmpty();
 
-        if (isDefaultScope) {
-            expectedScopes.retainAll(defaultScopes); // may change expectedScopes so that it has needed to be instantiated.
-            return expectedScopes.isEmpty() ? false : true;
-        } else {
-            explicitSpecifiedScopes.retainAll(expectedScopes);
-            explicitSpecifiedScopes.retainAll(optionalScopes);
-            if (!explicitSpecifiedScopes.isEmpty()) {
+            case ClientScopesConditionFactory.OPTIONAL:
+                explicitSpecifiedScopes.retainAll(expectedScopes);
+                explicitSpecifiedScopes.retainAll(optionalScopes);
                 if (logger.isTraceEnabled()) {
                     explicitSpecifiedScopes.forEach(i->logger.tracev("matched scope = {0}", i));
                 }
-                return true;
-            }
+                return !explicitSpecifiedScopes.isEmpty();
+
+            case ClientScopesConditionFactory.ANY:
+                explicitSpecifiedScopes.retainAll(expectedScopes);
+                explicitSpecifiedScopes.retainAll(optionalScopes);
+                expectedScopes.retainAll(defaultScopes);
+                return !expectedScopes.isEmpty() || !explicitSpecifiedScopes.isEmpty();
+
+            default:
+                return false;
         }
-        return false;
     }
 
     private Set<String> getScopesForMatching() {
@@ -171,5 +187,4 @@ private Set<String> getScopesForMatching() {
         if (scopes == null) return null;
         return new HashSet<>(scopes);
     }
-
-}
\ No newline at end of file
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesConditionFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesConditionFactory.java
index e16b5e74e022..56b192cc0a93 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesConditionFactory.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesConditionFactory.java
@@ -22,8 +22,13 @@
 import java.util.List;
 
 import org.keycloak.OAuth2Constants;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
 import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.idm.ClientPolicyConditionRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.util.JsonSerialization;
 
 /**
  * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
@@ -36,6 +41,7 @@ public class ClientScopesConditionFactory extends AbstractClientPolicyConditionP
     public static final String TYPE = "type";
     public static final String DEFAULT = "Default";
     public static final String OPTIONAL = "Optional";
+    public static final String ANY = "Any";
 
     private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
 
@@ -46,9 +52,10 @@ public class ClientScopesConditionFactory extends AbstractClientPolicyConditionP
         configProperties.add(property);
         property = new ProviderConfigProperty(TYPE, "Scope Type",
                 "If set to 'Default', condition evaluates to true if client has some default scopes of the values specified by the 'Expected Scopes' property. " +
-                        "If set to 'Optional', condition evaluates to true if client has some optional scopes of the values specified by the 'Expected Scopes' property and at the same time, the scope were used as a value of 'scope' parameter in the request",
+                        "If set to 'Optional', condition evaluates to true if client has some optional scopes of the values specified by the 'Expected Scopes' property and at the same time, the scope were used as a value of 'scope' parameter in the request. " +
+                        "If set to 'Any', condition evaluates to true if either of the 'Default' or 'Optional' conditions is satisfied.",
                 ProviderConfigProperty.LIST_TYPE, OPTIONAL);
-        property.setOptions(Arrays.asList(DEFAULT, OPTIONAL));
+        property.setOptions(Arrays.asList(DEFAULT, OPTIONAL, ANY));
         configProperties.add(property);
     }
 
@@ -71,4 +78,13 @@ public String getHelpText() {
     public List<ProviderConfigProperty> getConfigProperties() {
         return configProperties;
     }
-}
\ No newline at end of file
+
+    @Override
+    public void validateConfiguration(KeycloakSession session, RealmModel realm, ClientPolicyConditionRepresentation conditionRepresentation) throws ClientPolicyException {
+        ClientScopesCondition.Configuration configuration = JsonSerialization.mapper.convertValue(conditionRepresentation.getConfiguration(), ClientScopesCondition.Configuration.class);
+
+        if (configuration.getScopes() != null && !realm.getClientScopesStream().map(ClientScopeModel::getName).toList().containsAll(configuration.getScopes())) {
+            throw new ClientPolicyException("Client scopes not allowed: " +  configuration.getScopes());
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientUpdaterSourceHostsCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientUpdaterSourceHostsCondition.java
index ead4c7be0812..4a379084898c 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientUpdaterSourceHostsCondition.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientUpdaterSourceHostsCondition.java
@@ -85,7 +85,11 @@ public ClientPolicyVote applyPolicy(ClientPolicyContext context) throws ClientPo
     private boolean isHostMatched() {
         String hostAddress = session.getContext().getConnection().getRemoteAddr();
 
-        logger.tracev("Verifying remote host = {0}", hostAddress);
+        logger.tracev("Verifying remote host = {0}", session.getContext().getConnection().getRemoteHost());
+
+        if (hostAddress == null) {
+            return false;
+        }
 
         List<String> trustedHosts = getTrustedHosts();
         List<String> trustedDomains = getTrustedDomains();
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeCondition.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeCondition.java
new file mode 100644
index 000000000000..1b8e5e9976e9
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeCondition.java
@@ -0,0 +1,119 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.condition;
+
+import com.fasterxml.jackson.annotation.JsonAlias;
+import org.jboss.logging.Logger;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.utils.OIDCResponseType;
+import org.keycloak.representations.idm.ClientPolicyConditionConfigurationRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.ClientPolicyVote;
+import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano/a>
+ */
+public class GrantTypeCondition extends AbstractClientPolicyConditionProvider<GrantTypeCondition.Configuration> {
+
+    private static final Logger logger = Logger.getLogger(GrantTypeCondition.class);
+
+    public GrantTypeCondition(KeycloakSession session) {
+        super(session);
+    }
+
+    @Override
+    public Class<Configuration> getConditionConfigurationClass() {
+        return Configuration.class;
+    }
+
+    public static class Configuration extends ClientPolicyConditionConfigurationRepresentation {
+
+        @JsonAlias("grant_types")
+        protected List<String> grantTypes;
+
+        public List<String> getGrantTypes() {
+            return grantTypes;
+        }
+
+        public void setGrantTypes(List<String> grantTypes) {
+            this.grantTypes = grantTypes;
+        }
+    }
+
+    @Override
+    public String getProviderId() {
+        return ClientScopesConditionFactory.PROVIDER_ID;
+    }
+
+    @Override
+    public ClientPolicyVote applyPolicy(ClientPolicyContext context) throws ClientPolicyException {
+
+        switch (context.getEvent()) {
+            case AUTHORIZATION_REQUEST:
+                if (isGrantMatching((AuthorizationRequestContext)context)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            case TOKEN_REFRESH:
+                if (isGrantMatching(OAuth2Constants.REFRESH_TOKEN)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            case RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST:
+                if (isGrantMatching(OAuth2Constants.PASSWORD)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            case SERVICE_ACCOUNT_TOKEN_REQUEST:
+                if (isGrantMatching(OAuth2Constants.CLIENT_CREDENTIALS)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            case TOKEN_EXCHANGE_REQUEST:
+                if (isGrantMatching(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            case DEVICE_TOKEN_REQUEST:
+                if (isGrantMatching(OAuth2Constants.DEVICE_CODE_GRANT_TYPE)) return ClientPolicyVote.YES;
+                return ClientPolicyVote.NO;
+            default:
+                return ClientPolicyVote.ABSTAIN;
+        }
+    }
+
+    private boolean isGrantMatching(AuthorizationRequestContext request) {
+        if (request == null) return false;
+        try {
+            OIDCResponseType parsedResponseType = OIDCResponseType.parse(request.getAuthorizationEndpointRequest().getResponseType());
+            if (parsedResponseType.hasResponseType(OIDCResponseType.CODE)) {
+                return isGrantMatching(OAuth2Constants.AUTHORIZATION_CODE);
+            }
+            else if (parsedResponseType.isImplicitFlow()) {
+                return isGrantMatching(OAuth2Constants.IMPLICIT);
+            }
+            else if (parsedResponseType.isImplicitOrHybridFlow()) {
+                return isGrantMatching(OAuth2Constants.AUTHORIZATION_CODE) || isGrantMatching(OAuth2Constants.IMPLICIT);
+            }
+            else {
+                return false;
+            }
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    private boolean isGrantMatching(String grantType) {
+        return configuration.getGrantTypes() != null && configuration.getGrantTypes().contains(grantType);
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeConditionFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeConditionFactory.java
new file mode 100644
index 000000000000..7ee40dcece06
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/condition/GrantTypeConditionFactory.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.condition;
+
+import org.keycloak.OAuth2Constants;
+import org.keycloak.common.Profile;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.grants.OAuth2GrantType;
+import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderFactory;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class GrantTypeConditionFactory extends AbstractClientPolicyConditionProviderFactory {
+
+    public static final String PROVIDER_ID = "grant-type";
+    public static final String GRANT_TYPES = "grant_types";
+
+    @Override
+    public GrantTypeCondition create(KeycloakSession session) {
+        return new GrantTypeCondition(session);
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "The condition checks that the grant type used is one of those in the configured list.";
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        List<ProviderConfigProperty> configProperties = new ArrayList<>();
+        addCommonConfigProperties(configProperties);
+
+        ProviderConfigProperty property = new ProviderConfigProperty(GRANT_TYPES, "Grant Types",
+                "The condition evaluates to true if the current grant type is one of those in the list",
+                ProviderConfigProperty.MULTIVALUED_LIST_TYPE, null);
+
+        List<String> DEFAULT_GRANT_TYPES_SUPPORTED = Stream.of(OAuth2Constants.AUTHORIZATION_CODE,  OAuth2Constants.IMPLICIT, OAuth2Constants.REFRESH_TOKEN, OAuth2Constants.PASSWORD, OAuth2Constants.CLIENT_CREDENTIALS).collect(Collectors.toList());
+        if (Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE_STANDARD_V2)) {
+            DEFAULT_GRANT_TYPES_SUPPORTED.add(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+        }
+        if (Profile.isFeatureEnabled(Profile.Feature.DEVICE_FLOW)) {
+            DEFAULT_GRANT_TYPES_SUPPORTED.add(OAuth2Constants.DEVICE_CODE_GRANT_TYPE);
+        }
+
+        property.setOptions(DEFAULT_GRANT_TYPES_SUPPORTED);
+        configProperties.add(property);
+
+        return configProperties;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/context/AuthorizationRequestContext.java b/services/src/main/java/org/keycloak/services/clientpolicy/context/AuthorizationRequestContext.java
index fc340f6ba826..cc1a0e736e9e 100644
--- a/services/src/main/java/org/keycloak/services/clientpolicy/context/AuthorizationRequestContext.java
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/context/AuthorizationRequestContext.java
@@ -24,6 +24,7 @@
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
 import org.keycloak.services.clientpolicy.ClientPolicyContext;
 import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+import org.keycloak.sessions.AuthenticationSessionModel;
 
 /**
  * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
@@ -35,14 +36,18 @@ public class AuthorizationRequestContext implements ClientPolicyContext {
     private final String redirectUri;
     private final MultivaluedMap<String, String> requestParameters;
 
+    private final AuthenticationSessionModel authenticationSession;
+
     public AuthorizationRequestContext(OIDCResponseType parsedResponseType,
-            AuthorizationEndpointRequest request,
-            String redirectUri,
-            MultivaluedMap<String, String> requestParameters) {
+        AuthorizationEndpointRequest request,
+        String redirectUri,
+        MultivaluedMap<String, String> requestParameters,
+        AuthenticationSessionModel authenticationSession) {
         this.parsedResponseType = parsedResponseType;
         this.request = request;
         this.redirectUri = redirectUri;
         this.requestParameters = requestParameters;
+        this.authenticationSession = authenticationSession;
     }
 
     @Override
@@ -69,4 +74,8 @@ public MultivaluedMap<String, String> getRequestParameters() {
     public boolean isParRequest() {
         return requestParameters.containsKey(OIDCLoginProtocol.REQUEST_URI_PARAM);
     }
+
+    public AuthenticationSessionModel getAuthenticationSession() {
+        return authenticationSession;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/context/TokenExchangeRequestContext.java b/services/src/main/java/org/keycloak/services/clientpolicy/context/TokenExchangeRequestContext.java
new file mode 100644
index 000000000000..6f175e2eccd5
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/context/TokenExchangeRequestContext.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.context;
+
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class TokenExchangeRequestContext implements ClientPolicyContext {
+
+    private final TokenExchangeContext tokenExchangeContext;
+
+    public TokenExchangeRequestContext(TokenExchangeContext tokenExchangeContext) {
+        this.tokenExchangeContext = tokenExchangeContext;
+    }
+
+    @Override
+    public ClientPolicyEvent getEvent() {
+        return ClientPolicyEvent.TOKEN_EXCHANGE_REQUEST;
+    }
+
+
+    public TokenExchangeContext getTokenExchangeContext() {
+        return tokenExchangeContext;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutor.java b/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutor.java
new file mode 100644
index 000000000000..946b58e22244
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutor.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.executor;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import org.keycloak.authentication.authenticators.util.AcrStore;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.representations.idm.ClientPolicyExecutorConfigurationRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyContext;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+import org.keycloak.services.clientpolicy.ClientPolicyException;
+import org.keycloak.services.clientpolicy.context.AuthorizationRequestContext;
+import org.keycloak.sessions.AuthenticationSessionModel;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class AuthenticationFlowSelectorExecutor implements ClientPolicyExecutorProvider<AuthenticationFlowSelectorExecutor.Configuration> {
+
+    private Configuration configuration;
+
+    public AuthenticationFlowSelectorExecutor() {
+    }
+
+    @Override
+    public void setupConfiguration(Configuration config) {
+        this.configuration = config;
+    }
+
+    @Override
+    public Class<Configuration> getExecutorConfigurationClass() {
+        return Configuration.class;
+    }
+
+    public static class Configuration extends ClientPolicyExecutorConfigurationRepresentation {
+        @JsonProperty("auth-flow-alias")
+        protected String authFlowAlias;
+
+        @JsonProperty("auth-flow-loa")
+        protected Integer authFlowLoa;
+
+        public String getAuthFlowAlias() {
+            return authFlowAlias;
+        }
+
+        public void setAuthFlowAlias(String authFlowAlias) {
+            this.authFlowAlias = authFlowAlias;
+        }
+
+        public Integer getAuthFlowLoa() {
+            return authFlowLoa;
+        }
+
+        public void setAuthFlowLoa(Integer authFlowLoa) {
+            this.authFlowLoa = authFlowLoa;
+        }
+    }
+
+    @Override
+    public String getProviderId() {
+        return PKCEEnforcerExecutorFactory.PROVIDER_ID;
+    }
+
+    @Override
+    public void executeOnEvent(ClientPolicyContext context) throws ClientPolicyException {
+        if (context.getEvent() == ClientPolicyEvent.AUTHORIZATION_REQUEST) {
+            AuthorizationRequestContext authorizationRequestContext = (AuthorizationRequestContext) context;
+            executeOnAuthorizationRequest(authorizationRequestContext.getAuthenticationSession());
+        }
+    }
+
+    private void executeOnAuthorizationRequest(AuthenticationSessionModel authSession) {
+        if (configuration.getAuthFlowAlias() != null) {
+            authSession.setAuthNote(Constants.REQUESTED_AUTHENTICATION_FLOW, configuration.getAuthFlowAlias());
+            // auth flow selected via acr condition
+            if (configuration.getAuthFlowLoa() != null) {
+                authSession.setAuthNote(Constants.AUTHENTICATION_FLOW_LEVEL_OF_AUTHENTICATION, String.valueOf(configuration.getAuthFlowLoa()));
+            }
+        }
+    }
+
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutorFactory.java b/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutorFactory.java
new file mode 100644
index 000000000000..ef1d8ad4559c
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientpolicy/executor/AuthenticationFlowSelectorExecutorFactory.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.clientpolicy.executor;
+
+import org.keycloak.Config.Scope;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class AuthenticationFlowSelectorExecutorFactory implements ClientPolicyExecutorProviderFactory  {
+
+    public static final String PROVIDER_ID = "auth-flow-enforcer";
+
+    public static final String AUTH_FLOW_ALIAS = "auth-flow-alias";
+    public static final String AUTH_FLOW_LOA = "auth-flow-loa";
+
+    private static final ProviderConfigProperty AUTH_FLOW_ALIAS_PROPERTY = new ProviderConfigProperty(
+            AUTH_FLOW_ALIAS, "Auth Flow Alias", "Insert the alias of the authentication flow",
+            ProviderConfigProperty.STRING_TYPE, null);
+
+    private static final ProviderConfigProperty AUTH_FLOW_LOA_PROPERTY = new ProviderConfigProperty(
+            AUTH_FLOW_LOA, "Auth Flow Loa", "Insert the loa to enforce when the selected authentication flow is executed",
+            ProviderConfigProperty.INTEGER_TYPE, 1);
+
+    @Override
+    public AuthenticationFlowSelectorExecutor create(KeycloakSession session) {
+        return new AuthenticationFlowSelectorExecutor();
+    }
+
+    @Override
+    public void init(Scope config) {
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "";
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return Arrays.asList(AUTH_FLOW_ALIAS_PROPERTY, AUTH_FLOW_LOA_PROPERTY);
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java b/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
index 4b134556b82a..fa0e43b1ac06 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
@@ -26,6 +26,8 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+
+import org.keycloak.events.Details;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventType;
 import org.keycloak.models.ClientInitialAccessModel;
@@ -122,6 +124,10 @@ public ClientRepresentation create(ClientRegistrationContext context) {
         } catch (ModelDuplicateException e) {
             throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client Identifier in use", Response.Status.BAD_REQUEST);
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
     }
@@ -195,6 +201,10 @@ public ClientRepresentation update(String clientId, ClientRegistrationContext co
             session.getContext().setClient(client);
             session.clientPolicy().triggerOnEvent(new DynamicClientUpdatedContext(session, client, auth.getJwt(), client.getRealm()));
         } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
         ClientRegistrationPolicyManager.triggerAfterUpdate(context, registrationAuth, client);
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java
index cac1035bb97d..9d6d82d06c75 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java
@@ -17,6 +17,9 @@
 
 package org.keycloak.services.clientregistration;
 
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
 import org.keycloak.Config;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.authentication.AuthenticationProcessor;
@@ -25,20 +28,13 @@
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.AdminRoles;
-import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientInitialAccessModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientSessionContext;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.UserSessionProvider;
 import org.keycloak.protocol.oidc.utils.AuthorizeClientUtil;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.JsonWebToken;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.context.DynamicClientRegisterContext;
@@ -48,18 +44,14 @@
 import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyException;
 import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyManager;
 import org.keycloak.services.clientregistration.policy.RegistrationAuth;
-import org.keycloak.services.util.DefaultClientSessionContext;
+import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.util.TokenUtil;
 
-import jakarta.ws.rs.WebApplicationException;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.Response;
-import org.keycloak.utils.RoleResolveUtil;
-
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -71,7 +63,7 @@ public class ClientRegistrationAuth {
     private final EventBuilder event;
 
     private RealmModel realm;
-    private JsonWebToken jwt;
+    private AccessToken jwt;
     private ClientInitialAccessModel initialAccessModel;
     private String kid;
     private String token;
@@ -122,7 +114,7 @@ public String getKid() {
         return kid;
     }
 
-    public JsonWebToken getJwt() {
+    public AccessToken getJwt() {
         return jwt;
     }
 
@@ -165,8 +157,14 @@ public RegistrationAuth requireCreate(ClientRegistrationContext context) {
         try {
             session.clientPolicy().triggerOnEvent(new DynamicClientRegisterContext(context, jwt, realm));
             ClientRegistrationPolicyManager.triggerBeforeRegister(context, registrationAuth);
-        } catch (ClientRegistrationPolicyException | ClientPolicyException crpe) {
+        } catch (ClientRegistrationPolicyException crpe) {
             throw forbidden(crpe.getMessage());
+        } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
+            throw forbidden(cpe.getMessage());
         }
 
         return registrationAuth;
@@ -212,8 +210,14 @@ public void requireView(ClientModel client, boolean allowPublicClient) {
             try {
                 session.clientPolicy().triggerOnEvent(new DynamicClientViewContext(session, client, jwt, realm));
                 ClientRegistrationPolicyManager.triggerBeforeView(session, provider, authType, client);
-            } catch (ClientRegistrationPolicyException | ClientPolicyException crpe) {
+            } catch (ClientRegistrationPolicyException crpe) {
                 throw forbidden(crpe.getMessage());
+            } catch (ClientPolicyException cpe) {
+                event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+                event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+                event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+                event.error(cpe.getError());
+                throw forbidden(cpe.getMessage());
             }
         } else {
             throw unauthorized("Not authorized to view client. Not valid token or client credentials provided.");
@@ -231,8 +235,14 @@ public RegistrationAuth requireUpdate(ClientRegistrationContext context, ClientM
         try {
             session.clientPolicy().triggerOnEvent(new DynamicClientUpdateContext(context, client, jwt, realm));
             ClientRegistrationPolicyManager.triggerBeforeUpdate(context, regAuth, client);
-        } catch (ClientRegistrationPolicyException | ClientPolicyException crpe) {
+        } catch (ClientRegistrationPolicyException crpe) {
             throw forbidden(crpe.getMessage());
+        } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
+            throw forbidden(cpe.getMessage());
         }
 
         return regAuth;
@@ -244,8 +254,14 @@ public void requireDelete(ClientModel client) {
         try {
             session.clientPolicy().triggerOnEvent(new DynamicClientUnregisterContext(session, client, jwt, realm));
             ClientRegistrationPolicyManager.triggerBeforeRemove(session, provider, chainType, client);
-        } catch (ClientRegistrationPolicyException | ClientPolicyException crpe) {
+        } catch (ClientRegistrationPolicyException crpe) {
             throw forbidden(crpe.getMessage());
+        } catch (ClientPolicyException cpe) {
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
+            throw forbidden(cpe.getMessage());
         }
     }
 
@@ -293,75 +309,28 @@ public ClientInitialAccessModel getInitialAccessModel() {
 
     private boolean hasRole(String... roles) {
         try {
-
-            //support for lightweight access token
-            if (jwt.getSubject() == null) {
-                String sid = (String) jwt.getOtherClaims().get("sid");
-                if (sid != null) {
-                    final String issuedFor = jwt.getIssuedFor();
-                    UserSessionProvider sessions = session.sessions();
-                    UserSessionModel userSession = sessions.getUserSession(realm, sid);
-                    if (userSession == null) {
-                        userSession = sessions.getOfflineUserSession(realm, sid);
-                    }
-
-                    if (userSession != null) {
-                        //get client session
-                        ClientModel client = realm.getClientByClientId(issuedFor);
-                        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
-
-                        //set realm roles
-                        ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, (String) jwt.getOtherClaims().get("scope"), session);
-                        Map<String, AccessToken.Access> resourceAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx);
-
-                        Map<String, Map<String, List<String>>> resourceAccessMap = new HashMap<>();
-                        resourceAccess.forEach((key, access) ->
-                                resourceAccessMap.put(key, Map.of("roles", new ArrayList<>(access.getRoles())))
-                        );
-                        jwt.setSubject(userSession.getUser().getId());
-                        jwt.getOtherClaims().put("resource_access", resourceAccessMap);
-                    }
-                }
-            }
+            AuthenticationManager.resolveLightweightAccessTokenRoles(session, jwt, session.getContext().getRealm());
             return hasRoleInToken(roles);
-
         } catch (Throwable t) {
             return false;
         }
     }
 
     private boolean hasRoleInToken(String[] role) {
-        Map<String, Object> otherClaims = jwt.getOtherClaims();
-        if (otherClaims != null) {
-            Map<String, Map<String, List<String>>> resourceAccess = (Map<String, Map<String, List<String>>>) jwt.getOtherClaims().get("resource_access");
-            if (resourceAccess == null) {
-                return false;
-            }
-
-            List<String> roles = null;
+        Map<String, AccessToken.Access> resourceAccess = jwt.getResourceAccess();
+        if (resourceAccess == null) {
+            return false;
+        }
 
-            Map<String, List<String>> map;
-            if (realm.getName().equals(Config.getAdminRealm())) {
-                map = resourceAccess.get(realm.getMasterAdminClient().getClientId());
-            } else {
-                map = resourceAccess.get(Constants.REALM_MANAGEMENT_CLIENT_ID);
-            }
+        String clientId = realm.getName().equals(Config.getAdminRealm())
+                ? realm.getMasterAdminClient().getClientId()
+                : Constants.REALM_MANAGEMENT_CLIENT_ID;
 
-            if (map != null) {
-                roles = map.get("roles");
-            }
+        Set<String> roles = Optional.ofNullable(resourceAccess.get(clientId))
+                .map(AccessToken.Access::getRoles)
+                .orElse(Collections.emptySet());
 
-            if (roles == null) {
-                return false;
-            }
-
-            for (String r : role) {
-                if (roles.contains(r)) {
-                    return true;
-                }
-            }
-        }
-        return false;
+        return Arrays.stream(role).anyMatch(roles::contains);
     }
 
     private boolean authenticatePublicClient(ClientModel client) {
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
index 78e93d3d0bdf..8236aafff322 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
@@ -20,7 +20,7 @@
 import org.keycloak.TokenCategory;
 import org.keycloak.TokenVerifier;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.Time;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.crypto.SignatureSignerContext;
 import org.keycloak.crypto.SignatureProvider;
 import org.keycloak.crypto.SignatureVerifierContext;
@@ -29,8 +29,8 @@
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.TokenManager.TokenRevocationCheck;
+import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.services.Urls;
 import org.keycloak.services.clientregistration.policy.RegistrationAuth;
@@ -70,7 +70,7 @@ public static String updateRegistrationAccessToken(KeycloakSession session, Clie
     }
 
     public static String updateRegistrationAccessToken(KeycloakSession session, RealmModel realm, ClientModel client, RegistrationAuth registrationAuth) {
-        String id = KeycloakModelUtils.generateId();
+        String id = SecretGenerator.getInstance().generateSecureID();
         client.setRegistrationToken(id);
 
         RegistrationAccessToken regToken = new RegistrationAccessToken();
@@ -90,9 +90,9 @@ public static TokenVerification verifyToken(KeycloakSession session, RealmModel
         }
 
         String kid;
-        JsonWebToken jwt;
+        AccessToken jwt;
         try {
-            TokenVerifier<JsonWebToken> verifier = TokenVerifier.create(token, JsonWebToken.class)
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(token, AccessToken.class)
                     .withChecks(new TokenVerifier.RealmUrlCheck(getIssuer(session, realm)), TokenVerifier.IS_ACTIVE, new TokenRevocationCheck(session));
 
             SignatureVerifierContext verifierContext = session.getProvider(SignatureProvider.class, verifier.getHeader().getAlgorithm().name()).verifier(verifier.getHeader().getKeyId());
@@ -136,10 +136,10 @@ private static String getIssuer(KeycloakSession session, RealmModel realm) {
     protected static class TokenVerification {
 
         private final String kid;
-        private final JsonWebToken jwt;
+        private final AccessToken jwt;
         private final RuntimeException error;
 
-        public static TokenVerification success(String kid, JsonWebToken jwt) {
+        public static TokenVerification success(String kid, AccessToken jwt) {
             return new TokenVerification(kid, jwt, null);
         }
 
@@ -147,7 +147,7 @@ public static TokenVerification error(RuntimeException error) {
             return new TokenVerification(null,null, error);
         }
 
-        private TokenVerification(String kid, JsonWebToken jwt, RuntimeException error) {
+        private TokenVerification(String kid, AccessToken jwt, RuntimeException error) {
             this.kid = kid;
             this.jwt = jwt;
             this.error = error;
@@ -157,7 +157,7 @@ public String getKid() {
             return kid;
         }
 
-        public JsonWebToken getJwt() {
+        public AccessToken getJwt() {
             return jwt;
         }
 
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/oidc/DescriptionConverter.java b/services/src/main/java/org/keycloak/services/clientregistration/oidc/DescriptionConverter.java
index f87c675c2bbb..647e5aa11bf3 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/oidc/DescriptionConverter.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/oidc/DescriptionConverter.java
@@ -33,6 +33,7 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCClientSecretConfigWrapper;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.mappers.PairwiseSubMapperHelper;
 import org.keycloak.protocol.oidc.utils.AuthorizeClientUtil;
@@ -120,6 +121,7 @@ public static ClientRepresentation toInternal(KeycloakSession session, OIDCClien
                 client.setServiceAccountsEnabled(oidcGrantTypes.contains(OAuth2Constants.CLIENT_CREDENTIALS));
                 setOidcGrantEnabled(client, CibaConfig.OIDC_CIBA_GRANT_ENABLED, oidcGrantTypes.contains(OAuth2Constants.CIBA_GRANT_TYPE));
                 setOidcGrantEnabled(client, OAuth2DeviceConfig.OAUTH2_DEVICE_AUTHORIZATION_GRANT_ENABLED, oidcGrantTypes.contains(OAuth2Constants.DEVICE_CODE_GRANT_TYPE));
+                setOidcGrantEnabled(client, OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_ENABLED, oidcGrantTypes.contains(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE));
                 client.setAuthorizationServicesEnabled(oidcGrantTypes.contains(OAuth2Constants.UMA_GRANT_TYPE));
                 configWrapper.setUseRefreshToken(oidcGrantTypes.contains(OAuth2Constants.REFRESH_TOKEN));
             }
@@ -132,6 +134,9 @@ public static ClientRepresentation toInternal(KeycloakSession session, OIDCClien
         if ("none".equals(authMethod)) {
             client.setClientAuthenticatorType("none");
             client.setPublicClient(Boolean.TRUE);
+            if (oidcGrantTypes != null && oidcGrantTypes.contains(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)) {
+                throw new ClientRegistrationException("Token Exchange cannot be enabled in a public client");
+            }
         } else {
             ClientAuthenticatorFactory clientAuthFactory;
             if (authMethod == null) {
@@ -532,9 +537,13 @@ private static List<String> getOIDCGrantTypes(ClientRepresentation client) {
         if (client.getAuthorizationServicesEnabled() != null && client.getAuthorizationServicesEnabled()) {
             grantTypes.add(OAuth2Constants.UMA_GRANT_TYPE);
         }
-        if (OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseRefreshToken()) {
+        OIDCAdvancedConfigWrapper oidcClient = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
+        if (oidcClient.isUseRefreshToken()) {
             grantTypes.add(OAuth2Constants.REFRESH_TOKEN);
         }
+        if (!client.isPublicClient() && oidcClient.isStandardTokenExchangeEnabled()) {
+            grantTypes.add(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+        }
         return grantTypes;
     }
 
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/ClientScopesClientRegistrationPolicyFactory.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/ClientScopesClientRegistrationPolicyFactory.java
index 96bb5acfdf66..50fc6b4cf9dd 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/ClientScopesClientRegistrationPolicyFactory.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/ClientScopesClientRegistrationPolicyFactory.java
@@ -23,6 +23,7 @@
 import java.util.stream.Collectors;
 
 import org.keycloak.component.ComponentModel;
+import org.keycloak.component.ComponentValidationException;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
@@ -96,6 +97,14 @@ public List<ProviderConfigProperty> getConfigProperties() {
         return getConfigProperties(null);
     }
 
+    @Override
+    public void validateConfiguration(KeycloakSession session, RealmModel realm, ComponentModel config) throws ComponentValidationException {
+        List<String> allowedScopesConfig = config.getConfig().getList(ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES);
+        if (!getClientScopes(session).containsAll(allowedScopesConfig)) {
+            throw new ComponentValidationException("Client scopes not allowed: " + allowedScopesConfig);
+        }
+    }
+
     @Override
     public String getId() {
         return PROVIDER_ID;
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
index 65d26fbc661e..3d8145e1ae57 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicy.java
@@ -97,29 +97,34 @@ protected void verifyHost() throws ClientRegistrationPolicyException {
 
         String hostAddress = session.getContext().getConnection().getRemoteAddr();
 
-        verifyHost(hostAddress);
-    }
+        logger.debugf("Verifying remote host : %s", session.getContext().getConnection().getRemoteHost());
 
-    protected void verifyHost(String hostAddress) throws ClientRegistrationPolicyException {
-        logger.debugf("Verifying remote host : %s", hostAddress);
+        if (!verifyHost(hostAddress)) {
+            ServicesLogger.LOGGER.failedToVerifyRemoteHost(session.getContext().getConnection().getRemoteHost());
+            throw new ClientRegistrationPolicyException("Host not trusted.");
+        }
+    }
 
+    protected boolean verifyHost(String hostAddress) {
+        if (hostAddress == null) {
+            return false;
+        }
         List<String> trustedHosts = getTrustedHosts();
         List<String> trustedDomains = getTrustedDomains();
 
         // Verify trustedHosts by their IP addresses
         String verifiedHost = verifyHostInTrustedHosts(hostAddress, trustedHosts);
         if (verifiedHost != null) {
-            return;
+            return true;
         }
 
         // Verify domains if hostAddress hostname belongs to the domain. This assumes proper DNS setup
         verifiedHost = verifyHostInTrustedDomains(hostAddress, trustedDomains);
         if (verifiedHost != null) {
-            return;
+            return true;
         }
 
-        ServicesLogger.LOGGER.failedToVerifyRemoteHost(hostAddress);
-        throw new ClientRegistrationPolicyException("Host not trusted.");
+        return false;
     }
 
 
diff --git a/services/src/main/java/org/keycloak/services/cors/DefaultCors.java b/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
index d33488ab71bf..ae85a0ee0b03 100755
--- a/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
+++ b/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
@@ -27,6 +27,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.common.util.CollectionUtil;
+import org.keycloak.common.util.UriUtils;
 import org.keycloak.http.HttpResponse;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
@@ -42,6 +43,7 @@ public class DefaultCors implements Cors {
 
     private final HttpRequest request;
     private final HttpResponse response;
+    private final KeycloakSession session;
     private ResponseBuilder builder;
     private Set<String> allowedOrigins;
     private Set<String> allowedMethods;
@@ -51,6 +53,7 @@ public class DefaultCors implements Cors {
     private boolean auth;
 
     DefaultCors(KeycloakSession session) {
+        this.session = session;
         this.request = session.getContext().getHttpRequest();
         this.response = session.getContext().getHttpResponse();
     }
@@ -137,7 +140,8 @@ public void add() {
         }
 
         if (!preflight && (allowedOrigins == null || (!allowedOrigins.contains(origin) && !allowedOrigins.contains(ACCESS_CONTROL_ALLOW_ORIGIN_WILDCARD)))) {
-            if (logger.isDebugEnabled()) {
+            String requestOrigin = UriUtils.getOrigin(session.getContext().getUri().getRequestUri());
+            if (!origin.equals(requestOrigin) && logger.isDebugEnabled()) {
                 logger.debugv("Invalid CORS request: origin {0} not in allowed origins {1}", origin, allowedOrigins);
             }
             return;
diff --git a/services/src/main/java/org/keycloak/services/error/KeycloakErrorHandler.java b/services/src/main/java/org/keycloak/services/error/KeycloakErrorHandler.java
index b147997b20d8..4f5decdb18fd 100644
--- a/services/src/main/java/org/keycloak/services/error/KeycloakErrorHandler.java
+++ b/services/src/main/java/org/keycloak/services/error/KeycloakErrorHandler.java
@@ -94,6 +94,8 @@ public static Response getResponse(KeycloakSession session, Throwable throwable)
             error.setError(getErrorCode(throwable));
             if (throwable.getCause() instanceof ModelException) {
                 error.setErrorDescription(throwable.getMessage());
+            } if (throwable instanceof ModelDuplicateException) {
+                error.setErrorDescription(throwable.getMessage());
             } else if (throwable instanceof JsonProcessingException || throwable.getCause() instanceof JsonProcessingException) {
                 error.setErrorDescription("Cannot parse the JSON");
             } else if (isServerError) {
@@ -153,6 +155,10 @@ private static String getErrorCode(Throwable throwable) {
             return OAuthErrorException.INVALID_REQUEST;
         }
 
+        if (cause instanceof ModelDuplicateException || throwable instanceof ModelDuplicateException) {
+            return "conflict";
+        }
+
         if (throwable instanceof WebApplicationException && throwable.getMessage() != null) {
             return throwable.getMessage();
         }
@@ -188,6 +194,7 @@ private static Map<String, Object> initAttributes(KeycloakSession session, Realm
         final var localeBean =  new LocaleBean(realm, locale, session.getContext().getUri().getRequestUriBuilder(), messagesBundle);
         final var lang = realm.isInternationalizationEnabled() ? localeBean.getCurrentLanguageTag() : Locale.ENGLISH.toLanguageTag();
 
+        attributes.put("pageId", "error");
         attributes.put("statusCode", responseStatus.getStatusCode());
 
         attributes.put("realm", realm);
diff --git a/services/src/main/java/org/keycloak/services/managers/AppAuthManager.java b/services/src/main/java/org/keycloak/services/managers/AppAuthManager.java
index af7fc98751ad..2c5f453b1db5 100755
--- a/services/src/main/java/org/keycloak/services/managers/AppAuthManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/AppAuthManager.java
@@ -19,6 +19,7 @@
 import jakarta.ws.rs.NotAuthorizedException;
 
 import org.keycloak.common.ClientConnection;
+import org.keycloak.common.Profile;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
@@ -28,6 +29,7 @@
 import jakarta.ws.rs.core.UriInfo;
 import org.keycloak.util.TokenUtil;
 
+import java.util.List;
 import java.util.regex.Pattern;
 
 /**
@@ -66,9 +68,17 @@ private static String extractTokenStringFromAuthHeader(String authHeader) {
             return null;
         }
 
-        String bearerPart = split[0];
-        if (!bearerPart.equalsIgnoreCase(BEARER) && !bearerPart.equalsIgnoreCase(TokenUtil.TOKEN_TYPE_DPOP)){
-            return null;
+        String typeString = split[0];
+
+        if (!Profile.isFeatureEnabled(Profile.Feature.DPOP)) {
+            if (!typeString.equalsIgnoreCase(BEARER)) {
+                return null;
+            }
+        } else {
+            // "Bearer" is case-insensitive for historical reasons. "DPoP" is case-sensitive to follow the spec.
+            if (!typeString.equalsIgnoreCase(BEARER) && !typeString.equals(TokenUtil.TOKEN_TYPE_DPOP)){
+                return null;
+            }
         }
 
         String tokenString = split[1];
@@ -86,6 +96,14 @@ private static String extractTokenStringFromAuthHeader(String authHeader) {
      * @return the token string or {@literal null} if the Authorization header is not of type Bearer, or the token string is missing.
      */
     public static String extractAuthorizationHeaderTokenOrReturnNull(HttpHeaders headers) {
+        // error if including more than one Authorization header
+        List<String> authHeaders = headers.getRequestHeaders().get(HttpHeaders.AUTHORIZATION);
+        if (authHeaders == null || authHeaders.isEmpty()) {
+            return null;
+        }
+        if (authHeaders.size() != 1) {
+            throw new NotAuthorizedException(BEARER);
+        }
         String authHeader = headers.getRequestHeaders().getFirst(HttpHeaders.AUTHORIZATION);
         return extractTokenStringFromAuthHeader(authHeader);
     }
diff --git a/services/src/main/java/org/keycloak/services/managers/ApplianceBootstrap.java b/services/src/main/java/org/keycloak/services/managers/ApplianceBootstrap.java
index 35e7dc27362d..3bab2d2c745c 100755
--- a/services/src/main/java/org/keycloak/services/managers/ApplianceBootstrap.java
+++ b/services/src/main/java/org/keycloak/services/managers/ApplianceBootstrap.java
@@ -38,7 +38,7 @@
 import org.keycloak.userprofile.UserProfileProvider;
 import org.keycloak.utils.StringUtil;
 
-import static org.keycloak.models.Constants.IS_TEMP_ADMIN_ATTR_NAME;
+import static org.keycloak.models.UserModel.IS_TEMP_ADMIN_ATTR_NAME;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -62,6 +62,7 @@ public boolean isNewInstall() {
 
     public boolean isNoMasterUser() {
         RealmModel realm = session.realms().getRealmByName(Config.getAdminRealm());
+        session.getContext().setRealm(realm);
         return session.users().getUsersCount(realm) == 0;
     }
 
diff --git a/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java b/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
index 3146a493854e..9c31b052ff85 100755
--- a/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
@@ -77,6 +77,8 @@
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
 import org.keycloak.rar.AuthorizationDetails;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.services.ErrorResponseException;
@@ -89,6 +91,8 @@
 import org.keycloak.services.resources.LoginActionsService;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.services.util.AuthorizationContextUtil;
+import org.keycloak.services.util.DefaultClientSessionContext;
+import org.keycloak.services.util.UserSessionUtil;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.sessions.CommonClientSessionModel;
 import org.keycloak.sessions.RootAuthenticationSessionModel;
@@ -99,6 +103,7 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
+import org.keycloak.utils.RoleResolveUtil;
 import java.net.URI;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
@@ -113,6 +118,7 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -555,7 +561,7 @@ private static Response backchannelLogoutClientSession(KeycloakSession session,
 
     private static Response frontchannelLogoutClientSession(KeycloakSession session, RealmModel realm,
       AuthenticatedClientSessionModel clientSession, AuthenticationSessionModel logoutAuthSession,
-      UriInfo uriInfo, HttpHeaders headers) {
+      UriInfo uriInfo, HttpHeaders headers, EventBuilder event) {
         UserSessionModel userSession = clientSession.getUserSession();
         ClientModel client = clientSession.getClient();
 
@@ -572,6 +578,11 @@ private static Response frontchannelLogoutClientSession(KeycloakSession session,
         try {
             session.clientPolicy().triggerOnEvent(new LogoutRequestContext());
         } catch (ClientPolicyException cpe) {
+            event.event(EventType.LOGOUT);
+            event.detail(Details.REASON, Details.CLIENT_POLICY_ERROR);
+            event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+            event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+            event.error(cpe.getError());
             throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), cpe.getErrorStatus());
         }
 
@@ -686,7 +697,7 @@ public static Response browserLogout(KeycloakSession session,
         return finishBrowserLogout(session, realm, userSession, uriInfo, connection, headers);
     }
 
-    private static Response browserLogoutAllClients(UserSessionModel userSession, KeycloakSession session, RealmModel realm, HttpHeaders headers, UriInfo uriInfo, AuthenticationSessionModel logoutAuthSession) {
+    private static Response browserLogoutAllClients(UserSessionModel userSession, KeycloakSession session, RealmModel realm, HttpHeaders headers, UriInfo uriInfo, AuthenticationSessionModel logoutAuthSession, EventBuilder event) {
         Map<Boolean, List<AuthenticatedClientSessionModel>> acss = userSession.getAuthenticatedClientSessions().values().stream()
           .filter(clientSession -> !Objects.equals(AuthenticationSessionModel.Action.LOGGED_OUT.name(), clientSession.getAction())
                                 && !Objects.equals(AuthenticationSessionModel.Action.LOGGING_OUT.name(), clientSession.getAction()))
@@ -698,7 +709,7 @@ private static Response browserLogoutAllClients(UserSessionModel userSession, Ke
 
         final List<AuthenticatedClientSessionModel> redirectClients = acss.get(true) == null ? Collections.emptyList() : acss.get(true);
         for (AuthenticatedClientSessionModel nextRedirectClient : redirectClients) {
-            Response response = frontchannelLogoutClientSession(session, realm, nextRedirectClient, logoutAuthSession, uriInfo, headers);
+            Response response = frontchannelLogoutClientSession(session, realm, nextRedirectClient, logoutAuthSession, uriInfo, headers, event);
             if (response != null) {
                 return response;
             }
@@ -710,8 +721,8 @@ private static Response browserLogoutAllClients(UserSessionModel userSession, Ke
     public static Response finishBrowserLogout(KeycloakSession session, RealmModel realm, UserSessionModel userSession, UriInfo uriInfo, ClientConnection connection, HttpHeaders headers) {
         final AuthenticationSessionManager asm = new AuthenticationSessionManager(session);
         AuthenticationSessionModel logoutAuthSession = createOrJoinLogoutSession(session, realm, asm, userSession, true, false);
-
-        Response response = browserLogoutAllClients(userSession, session, realm, headers, uriInfo, logoutAuthSession);
+        EventBuilder event = new EventBuilder(realm, session, connection);
+        Response response = browserLogoutAllClients(userSession, session, realm, headers, uriInfo, logoutAuthSession, event);
         if (response != null) {
             return response;
         }
@@ -723,14 +734,12 @@ public static Response finishBrowserLogout(KeycloakSession session, RealmModel r
         expireRememberMeCookie(session);
 
         String method = userSession.getNote(KEYCLOAK_LOGOUT_PROTOCOL);
-        EventBuilder event = new EventBuilder(realm, session, connection);
         LoginProtocol protocol = session.getProvider(LoginProtocol.class, method);
         protocol.setRealm(realm)
                 .setHttpHeaders(headers)
                 .setUriInfo(uriInfo)
                 .setEventBuilder(event);
 
-
         response = protocol.finishBrowserLogout(userSession, logoutAuthSession);
 
         // It may be possible that there are some client sessions that are still in LOGGING_OUT state
@@ -778,7 +787,7 @@ public static void finishUnconfirmedUserSession(KeycloakSession session, RealmMo
 
     public static IdentityCookieToken createIdentityToken(KeycloakSession keycloakSession, RealmModel realm, UserModel user, UserSessionModel session, String issuer) {
         IdentityCookieToken token = new IdentityCookieToken();
-        token.id(KeycloakModelUtils.generateId());
+        token.id(SecretGenerator.getInstance().generateSecureID());
         token.issuedNow();
         token.subject(user.getId());
         token.issuer(issuer);
@@ -1123,11 +1132,6 @@ private static UserConsentModel getEffectiveGrantedConsent(KeycloakSession sessi
         }
     }
 
-    public static Response actionRequired(final KeycloakSession session, final AuthenticationSessionModel authSession,
-            final HttpRequest request, final EventBuilder event) {
-        return actionRequired(session, authSession, request, event, new HashSet<>());
-    }
-
     private static Response actionRequired(final KeycloakSession session, final AuthenticationSessionModel authSession,
             final HttpRequest request, final EventBuilder event, Set<String> ignoredActions) {
         final var realm = authSession.getRealm();
@@ -1253,13 +1257,14 @@ public static RequiredActionProvider createRequiredAction(RequiredActionContextR
 
     protected static Response executionActions(KeycloakSession session, AuthenticationSessionModel authSession,
             HttpRequest request, EventBuilder event, RealmModel realm, UserModel user, Set<String> ignoredActions) {
-        final var kcAction = authSession.getClientNote(Constants.KC_ACTION);
-        final var firstApplicableRequiredAction =
+        final String kcAction = authSession.getClientNote(Constants.KC_ACTION);
+        final RequiredActionProviderModel firstApplicableRequiredAction =
                 getFirstApplicableRequiredAction(realm, authSession, user, kcAction, ignoredActions);
+        boolean kcActionExecution = kcAction != null && kcAction.equals(firstApplicableRequiredAction.getProviderId());
 
         if (firstApplicableRequiredAction != null) {
             return executeAction(session, authSession, firstApplicableRequiredAction, request, event, realm, user,
-                    kcAction != null, ignoredActions);
+                    kcActionExecution, ignoredActions);
         }
 
         return null;
@@ -1317,9 +1322,7 @@ else if (context.getStatus() == RequiredActionContext.Status.CHALLENGE) {
             return context.getChallenge();
         }
         else if (context.getStatus() == RequiredActionContext.Status.IGNORE) {
-            authSession.getAuthenticatedUser().removeRequiredAction(factory.getId());
-            authSession.removeRequiredAction(factory.getId());
-            setKcActionStatus(factory.getId(), RequiredActionContext.KcActionStatus.SUCCESS, authSession);
+            setKcActionStatus(factory.getId(), RequiredActionContext.KcActionStatus.ERROR, authSession);
             ignoredActions.add(factory.getId());
             return nextActionAfterAuthentication(session, authSession, session.getContext().getConnection(), request, session.getContext().getUri(), event, ignoredActions);
         }
@@ -1358,7 +1361,7 @@ private static List<RequiredActionProviderModel> getApplicableRequiredActionsSor
         nonInitiatedActionAliases.addAll(user.getRequiredActionsStream().toList());
         nonInitiatedActionAliases.addAll(authSession.getRequiredActions());
 
-        final var applicableNonInitiatedActions = nonInitiatedActionAliases.stream()
+        final Map<String, RequiredActionProviderModel> applicableNonInitiatedActions = nonInitiatedActionAliases.stream()
                 .map(alias -> getApplicableRequiredAction(realm, alias))
                 .filter(Objects::nonNull)
                 .filter(model -> !ignoredActions.contains(model.getProviderId()))
@@ -1377,17 +1380,14 @@ private static List<RequiredActionProviderModel> getApplicableRequiredActionsSor
             }
         }
 
-        final Map<String, RequiredActionProviderModel> applicableActions;
-        if (kcAction != null) {
-            applicableActions = new HashMap<>(applicableNonInitiatedActions);
-            applicableActions.put(kcAction.getAlias(), kcAction);
-        } else {
-            applicableActions = applicableNonInitiatedActions;
-        }
-
-        final var applicableActionsSorted = applicableActions.values().stream()
+        final List<RequiredActionProviderModel> applicableActionsSorted = applicableNonInitiatedActions.values().stream()
                 .sorted(RequiredActionProviderModel.RequiredActionComparator.SINGLETON)
-                .toList();
+                .collect(Collectors.toList());
+
+        // Insert "kc_action" as last action (unless present in required actions)
+        if (kcAction != null && !applicableNonInitiatedActions.containsKey(kcActionAlias)) {
+            applicableActionsSorted.add(kcAction);
+        }
 
         if (logger.isDebugEnabled()) {
             logger.debugv("applicable required actions (sorted): {0}",
@@ -1451,6 +1451,11 @@ public void success() {
                 throw new RuntimeException("Not allowed to call success() within evaluateTriggers()");
             }
 
+            @Override
+            public void cancel() {
+                throw new RuntimeException("Not allowed to call cancel() within evaluateTriggers()");
+            }
+
             @Override
             public void ignore() {
                 throw new RuntimeException("Not allowed to call ignore() within evaluateTriggers()");
@@ -1508,72 +1513,56 @@ public static AuthResult verifyIdentityToken(KeycloakSession session, RealmModel
                 }
             }
 
-            UserSessionModel userSession = null;
-            UserModel user = null;
-            if (token.getSessionState() == null) {
-                user = TokenManager.lookupUserFromStatelessToken(session, realm, token);
-                if (!TokenManager.isUserValid(session, realm, token, user)) {
-                    return null;
-                }
-            } else {
-                userSession = session.sessions().getUserSession(realm, token.getSessionState());
-                if (userSession != null) {
-                    user = userSession.getUser();
-                    if (!TokenManager.isUserValid(session, realm, token, user)) {
-                        return null;
-                    }
-                }
-            }
-
             KeycloakContext context = session.getContext();
+            Consumer<UserSessionModel> invalidUserSessionCallback = (userSession) -> {
+                // Ignored for offline session for now?
+                if (userSession.isOffline()) return;
+
+                String userSessionId = userSession.getId();
+                KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), context, newSession -> {
+                    RealmModel realmModel = newSession.realms().getRealm(realm.getId());
+                    UserSessionModel userSessionModel = newSession.sessions().getUserSession(realmModel, userSessionId);
+                    backchannelLogout(newSession, realmModel, userSessionModel, uriInfo, connection, headers, true);
+                });
+                // remove the user session here so that the external persistent session tx becomes aware of the removal that happened
+                // during the backchannel logout.
+                session.sessions().removeUserSession(realm, userSession);
+            };
 
-            if (token.getSessionState() != null && !isSessionValid(realm, userSession)) {
-                // Check if accessToken was for the offline session.
-                if (!isCookie) {
-                    UserSessionModel offlineUserSession = session.sessions().getOfflineUserSession(realm, token.getSessionState());
-                    if (isSessionValid(realm, offlineUserSession)) {
-                        user = offlineUserSession.getUser();
-                        ClientModel client = realm.getClientByClientId(token.getIssuedFor());
-                        if (!isClientValid(offlineUserSession, client, token)) {
-                            return null;
-                        }
-                        context.setUserSession(offlineUserSession);
-                        context.setClient(client);
-                        context.setBearerToken(token);
-                        return new AuthResult(user, offlineUserSession, token, client);
-                    }
-                }
-
-
-                if (userSession != null) {
-                    String userSessionId = userSession.getId();
-                    KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), context, newSession -> {
-                        RealmModel realmModel = newSession.realms().getRealm(realm.getId());
-                        UserSessionModel userSessionModel = newSession.sessions().getUserSession(realmModel, userSessionId);
-                        backchannelLogout(newSession, realmModel, userSessionModel, uriInfo, connection, headers, true);
-                    });
-                    // remove the user session here so that the external persistent session tx becomes aware of the removal that happened
-                    // during the backchannel logout.
-                    session.sessions().removeUserSession(realm, userSession);
-                }
-                logger.debug("User session not active");
-                return null;
-            }
-
+            UserSessionModel userSession = null;
+            ClientModel client = null;
             session.setAttribute("state_checker", token.getOtherClaims().get("state_checker"));
 
-            ClientModel client;
             if (isCookie) {
-                client = null;
+                UserSessionUtil.UserSessionValidationResult validationResult = UserSessionUtil.findValidSessionForIdentityCookie(session, realm, token, invalidUserSessionCallback);
+                if (validationResult.getError() != null) {
+                    return null;
+                }
+                userSession = validationResult.getUserSession();
             } else {
                 client = realm.getClientByClientId(token.getIssuedFor());
+                if (client == null) {
+                    return null;
+                }
+                UserSessionUtil.UserSessionValidationResult validationResult = UserSessionUtil.findValidSessionForAccessToken(session, realm, token, client, invalidUserSessionCallback);
+                if (validationResult.getError() != null) {
+                    return null;
+                }
+                userSession = validationResult.getUserSession();
                 if (!isClientValid(userSession, client, token)) {
                     return null;
                 }
+            }
+
+            UserModel user = userSession.getUser();
+            if (!TokenManager.isUserValid(session, realm, token, user)) {
+                return null;
+            }
+
+            if (!isCookie) {
                 context.setClient(client);
                 context.setBearerToken(token);
             }
-
             context.setUserSession(userSession);
 
             return new AuthResult(user, userSession, token, client);
@@ -1606,6 +1595,34 @@ private static boolean isClientValid(UserSessionModel userSession, ClientModel c
         return true;
     }
 
+    public static void resolveLightweightAccessTokenRoles(KeycloakSession session, AccessToken accessToken, RealmModel realm) {
+        final String issuedFor = accessToken.getIssuedFor();
+        ClientModel client = realm.getClientByClientId(issuedFor);
+        if(client == null) {
+            return;
+        }
+
+        TokenContextEncoderProvider encoder = session.getProvider(TokenContextEncoderProvider.class);
+        AccessTokenContext subjectTokenContext = encoder.getTokenContextFromTokenId(accessToken.getId());
+        boolean isAccessTokenLightweight = AccessTokenContext.TokenType.LIGHTWEIGHT.equals(subjectTokenContext.getTokenType());
+        if (isAccessTokenLightweight || accessToken.getSubject() == null || (accessToken.getSessionId() == null && accessToken.getResourceAccess().isEmpty() && accessToken.getRealmAccess() == null)) {
+            //get user session
+            UserSessionModel userSession = UserSessionUtil.findValidSessionForAccessToken(session,realm, accessToken, client, (invalidUserSession -> {})).getUserSession();
+
+            if (userSession != null) {
+                //get client session
+                AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
+                //set realm roles
+                ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, accessToken.getScope(), session);
+                AccessToken.Access realmAccess = RoleResolveUtil.getResolvedRealmRoles(session, clientSessionCtx, false);
+                Map<String, AccessToken.Access> clientAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx);
+                accessToken.subject(userSession.getUser().getId());
+                accessToken.setRealmAccess(realmAccess);
+                accessToken.setResourceAccess(clientAccess);
+            }
+        }
+    }
+
     public enum AuthenticationStatus {
         SUCCESS, ACCOUNT_TEMPORARILY_DISABLED, ACCOUNT_DISABLED, ACTIONS_REQUIRED, INVALID_USER, INVALID_CREDENTIALS, MISSING_PASSWORD, MISSING_TOTP, FAILED
     }
diff --git a/services/src/main/java/org/keycloak/services/managers/AuthenticationSessionManager.java b/services/src/main/java/org/keycloak/services/managers/AuthenticationSessionManager.java
index 440d2894dd2c..0200e584e7f4 100644
--- a/services/src/main/java/org/keycloak/services/managers/AuthenticationSessionManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/AuthenticationSessionManager.java
@@ -209,7 +209,7 @@ private String validateAuthSessionIdSignature(String authSessionId, String signa
         return null;
     }
 
-    private String signAndEncodeToBase64AuthSessionId(String authSessionId) {
+    public String signAndEncodeToBase64AuthSessionId(String authSessionId) {
         SignatureProvider signatureProvider = session.getProvider(SignatureProvider.class, Constants.INTERNAL_SIGNATURE_ALGORITHM);
         SignatureSignerContext signer = signatureProvider.signer();
         StringBuilder buffer = new StringBuilder();
@@ -326,7 +326,7 @@ public AuthenticationSessionModel getAuthenticationSessionByIdAndClient(RealmMod
 
     public AuthenticationSessionModel getAuthenticationSessionByEncodedIdAndClient(RealmModel realm, String encodedAuthSesionId, ClientModel client, String tabId) {
         String decodedAuthSessionId = decodeBase64AndValidateSignature(encodedAuthSesionId, true);
-        return getAuthenticationSessionByIdAndClient(realm, decodedAuthSessionId, client, tabId);
+        return decodedAuthSessionId==null ? null : getAuthenticationSessionByIdAndClient(realm, decodedAuthSessionId, client, tabId);
     }
 
     public UserSessionModel getUserSessionFromAuthenticationCookie(RealmModel realm) {
diff --git a/services/src/main/java/org/keycloak/services/managers/DefaultBruteForceProtector.java b/services/src/main/java/org/keycloak/services/managers/DefaultBruteForceProtector.java
index ee2e76ea3c71..337d7bc6a956 100644
--- a/services/src/main/java/org/keycloak/services/managers/DefaultBruteForceProtector.java
+++ b/services/src/main/java/org/keycloak/services/managers/DefaultBruteForceProtector.java
@@ -213,7 +213,7 @@ protected void processLogin(RealmModel realm, UserModel user, ClientConnection c
             if (success) {
                 success(s, realm, user.getId());
             } else {
-                failure(s, realm, user.getId(), clientConnection.getRemoteAddr(), Time.currentTimeMillis());
+                failure(s, realm, user.getId(), clientConnection.getRemoteHost(), Time.currentTimeMillis());
             }
         }));
     }
@@ -250,8 +250,12 @@ public boolean isPermanentlyLockedOut(KeycloakSession session, RealmModel realm,
 
     @Override
     public void cleanUpPermanentLockout(KeycloakSession session, RealmModel realm, UserModel user) {
-        if (DISABLED_BY_PERMANENT_LOCKOUT.equals(user.getFirstAttribute(DISABLED_REASON))) {
+        if (DISABLED_BY_PERMANENT_LOCKOUT.equals(user.getFirstAttribute(DISABLED_REASON)) || isPermanentlyLockedOut(session, realm, user)) {
             user.removeAttribute(DISABLED_REASON);
+
+            if (!isTemporarilyDisabled(session, realm, user)) {
+                session.loginFailures().removeUserLoginFailure(realm, user.getId());
+            }
         }
     }
 
@@ -295,6 +299,11 @@ public X509Certificate[] getClientCertificateChain() {
         public UriInfo getUri() {
             return uriInfo;
         }
+
+        @Override
+        public boolean isProxyTrusted() {
+            return true;
+        }
     }
 
     private static class BruteForceHttpResponse implements HttpResponse {
diff --git a/services/src/main/java/org/keycloak/services/managers/RealmManager.java b/services/src/main/java/org/keycloak/services/managers/RealmManager.java
index c1aedc2ab64e..70826f28adca 100755
--- a/services/src/main/java/org/keycloak/services/managers/RealmManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/RealmManager.java
@@ -19,9 +19,11 @@
 import jakarta.ws.rs.ClientErrorException;
 import jakarta.ws.rs.core.Response;
 import org.keycloak.Config;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.Profile;
 import org.keycloak.common.enums.SslRequired;
 import org.keycloak.common.util.Encode;
+import org.keycloak.connections.jpa.support.EntityManagers;
 import org.keycloak.events.EventListenerProvider;
 import org.keycloak.events.EventListenerProviderFactory;
 import org.keycloak.models.AbstractKeycloakTransaction;
@@ -32,6 +34,7 @@
 import org.keycloak.models.Constants;
 import org.keycloak.models.ImpersonationConstants;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.OTPPolicy;
 import org.keycloak.models.ProtocolMapperModel;
@@ -174,7 +177,7 @@ private void setupOfflineTokens(RealmModel realm, RealmRepresentation realmRep)
     }
 
     protected void createDefaultClientScopes(RealmModel realm) {
-        DefaultClientScopes.createDefaultClientScopes(session, realm, true);
+        EntityManagers.runInBatch(session, () -> DefaultClientScopes.createDefaultClientScopes(session, realm, true), false);
     }
 
     protected void setupAdminConsole(RealmModel realm) {
@@ -327,7 +330,7 @@ public void setupMasterAdminManagement(RealmModel realm) {
         // Need to refresh masterApp for current realm
         String adminRealmName = Config.getAdminRealm();
         RealmModel adminRealm = model.getRealmByName(adminRealmName);
-        ClientModel masterApp = adminRealm.getClientByClientId(KeycloakModelUtils.getMasterRealmAdminApplicationClientId(realm.getName()));
+        ClientModel masterApp = adminRealm.getClientByClientId(KeycloakModelUtils.getMasterRealmAdminManagementClientId(realm.getName()));
         if (masterApp == null) {
             createMasterAdminManagement(realm);
             return;
@@ -353,7 +356,7 @@ private void createMasterAdminManagement(RealmModel realm) {
         }
         adminRole.setDescription("${role_"+AdminRoles.ADMIN+"}");
 
-        ClientModel realmAdminApp = KeycloakModelUtils.createManagementClient(adminRealm, KeycloakModelUtils.getMasterRealmAdminApplicationClientId(realm.getName()));
+        ClientModel realmAdminApp = KeycloakModelUtils.createManagementClient(adminRealm, KeycloakModelUtils.getMasterRealmAdminManagementClientId(realm.getName()));
         // No localized name for now
         realmAdminApp.setName(realm.getName() + " Realm");
         realm.setMasterAdminClient(realmAdminApp);
@@ -524,14 +527,24 @@ public void setupBrokerService(RealmModel realm) {
     }
 
     public RealmModel importRealm(RealmRepresentation rep) {
-        return importRealm(rep, false);
+        return importRealm(rep, () -> {});
     }
 
 
     /**
      * if "skipUserDependent" is true, then import of any models, which needs users already imported in DB, will be skipped. For example authorization
+     * @deprecated use {@link #importRealm(RealmRepresentation, Runnable)}
      */
+    @Deprecated
     public RealmModel importRealm(RealmRepresentation rep, boolean skipUserDependent) {
+        return importRealm(rep, skipUserDependent ? null : () -> {});
+    }
+
+    /**
+     * @param userImport if null, then import of any models, which needs users already imported in DB, will be skipped. For example authorization
+     */
+    public RealmModel importRealm(RealmRepresentation rep, Runnable userImport) {
+        boolean skipUserDependent = userImport == null;
         String id = rep.getId();
         if (id == null || id.trim().isEmpty()) {
             id = KeycloakModelUtils.generateId();
@@ -541,6 +554,9 @@ public RealmModel importRealm(RealmRepresentation rep, boolean skipUserDependent
         if (StringUtil.isBlank(rep.getRealm())) {
             throw new ModelException("Realm name cannot be empty");
         }
+        if (session.realms().getRealmByName(rep.getRealm()) != null) {
+            throw new ModelDuplicateException("Realm " + rep.getRealm() + " already exists");
+        }
 
         RealmModel realm = model.createRealm(id, rep.getRealm());
         RealmModel currentRealm = session.getContext().getRealm();
@@ -568,7 +584,7 @@ public RealmModel importRealm(RealmRepresentation rep, boolean skipUserDependent
                     realm.setAdminPermissionsClient(client);
                     RepresentationToModel.createResourceServer(client, session, false);
                 } else if (Boolean.TRUE.equals(rep.isAdminPermissionsEnabled())) {
-                    KeycloakModelUtils.setupAdminPermissionsClient(session, realm);
+                    AdminPermissionsSchema.SCHEMA.init(session, realm);
                 }
             }
 
@@ -606,7 +622,7 @@ public RealmModel importRealm(RealmRepresentation rep, boolean skipUserDependent
                 createDefaultClientScopes(realm);
             }
 
-            RepresentationToModel.importRealm(session, rep, realm, skipUserDependent);
+            RepresentationToModel.importRealm(session, rep, realm, userImport);
 
             setupClientServiceAccountsAndAuthorizationOnImport(rep, skipUserDependent);
 
@@ -694,7 +710,7 @@ private boolean postponeMasterClientSetup(RealmRepresentation rep) {
     }
 
     private boolean hasRealmAdminManagementClient(RealmRepresentation rep) {
-        String realmAdminClientId =  Config.getAdminRealm().equals(rep.getRealm()) ?  KeycloakModelUtils.getMasterRealmAdminApplicationClientId(rep.getRealm()) : getRealmAdminClientId(rep);
+        String realmAdminClientId =  Config.getAdminRealm().equals(rep.getRealm()) ?  KeycloakModelUtils.getMasterRealmAdminManagementClientId(rep.getRealm()) : getRealmAdminClientId(rep);
         return hasClient(rep, realmAdminClientId);
     }
 
diff --git a/services/src/main/java/org/keycloak/services/managers/ResourceAdminManager.java b/services/src/main/java/org/keycloak/services/managers/ResourceAdminManager.java
index d247d619b726..28346bcfaf77 100755
--- a/services/src/main/java/org/keycloak/services/managers/ResourceAdminManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/ResourceAdminManager.java
@@ -193,12 +193,17 @@ protected Response sendBackChannelLogoutRequestToClientUri(ClientModel resource,
                                                               AuthenticatedClientSessionModel clientSessionModel, String managementUrl) {
         UserModel user = clientSessionModel.getUserSession().getUser();
 
-        LogoutToken logoutToken = session.tokens().initLogoutToken(resource, user, clientSessionModel);
-        String token = session.tokens().encode(logoutToken);
-        if (logger.isDebugEnabled())
-            logger.debugv("logout resource {0} url: {1} sessionIds: ", resource.getClientId(), managementUrl);
         HttpPost post = null;
+        ClientModel previousClient = session.getContext().getClient();
         try {
+            session.getContext().setClient(resource);
+
+            LogoutToken logoutToken = session.tokens().initLogoutToken(resource, user, clientSessionModel);
+            String token = session.tokens().encode(logoutToken);
+            if (logger.isDebugEnabled()) {
+                logger.debugv("logout resource {0} url: {1} sessionIds: ", resource.getClientId(), managementUrl);
+            }
+
             post = new HttpPost(managementUrl);
             List<NameValuePair> parameters = new LinkedList<>();
             if (logoutToken != null) {
@@ -223,6 +228,7 @@ protected Response sendBackChannelLogoutRequestToClientUri(ClientModel resource,
             ServicesLogger.LOGGER.logoutFailed(e, resource.getClientId());
             return Response.serverError().build();
         } finally {
+            session.getContext().setClient(previousClient);
             if (post != null) {
                 post.reset();
             }
diff --git a/services/src/main/java/org/keycloak/services/messages/Messages.java b/services/src/main/java/org/keycloak/services/messages/Messages.java
index 17f31b89acf0..544becaabf05 100755
--- a/services/src/main/java/org/keycloak/services/messages/Messages.java
+++ b/services/src/main/java/org/keycloak/services/messages/Messages.java
@@ -215,6 +215,8 @@ public class Messages {
 
     public static final String CONFIRM_ACCOUNT_LINKING = "confirmAccountLinking";
 
+    public static final String CONFIRM_ACCOUNT_LINKING_BODY = "confirmAccountLinkingBody";
+
     public static final String CONFIRM_EMAIL_ADDRESS_VERIFICATION = "confirmEmailAddressVerification";
 
     public static final String CONFIRM_EXECUTION_OF_ACTIONS = "confirmExecutionOfActions";
diff --git a/services/src/main/java/org/keycloak/services/resources/IdentityBrokerService.java b/services/src/main/java/org/keycloak/services/resources/IdentityBrokerService.java
index 40fd5c6a575b..2279cf7bf6d7 100755
--- a/services/src/main/java/org/keycloak/services/resources/IdentityBrokerService.java
+++ b/services/src/main/java/org/keycloak/services/resources/IdentityBrokerService.java
@@ -18,8 +18,10 @@
 
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authentication.RequiredActionContext;
 import org.keycloak.authentication.authenticators.broker.IdpConfirmOverrideLinkAuthenticator;
 import org.keycloak.broker.provider.ExchangeTokenToIdentityProviderToken;
+import org.keycloak.broker.provider.IdpLinkAction;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.authentication.AuthenticationProcessor;
@@ -86,7 +88,6 @@
 import org.keycloak.services.managers.ClientSessionCode;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.cors.Cors;
-import org.keycloak.services.resources.account.AccountConsole;
 import org.keycloak.services.util.AuthenticationFlowURLHelper;
 import org.keycloak.services.util.BrowserHistoryHelper;
 import org.keycloak.services.util.CacheControlUtil;
@@ -123,6 +124,8 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import static org.keycloak.broker.provider.AbstractIdentityProvider.BROKER_REGISTERED_NEW_USER;
+
 /**
  * <p></p>
  *
@@ -131,7 +134,7 @@
 public class IdentityBrokerService implements IdentityProvider.AuthenticationCallback {
 
     // Authentication session note, which references identity provider that is currently linked
-    private static final String LINKING_IDENTITY_PROVIDER = "LINKING_IDENTITY_PROVIDER";
+    public static final String LINKING_IDENTITY_PROVIDER = "LINKING_IDENTITY_PROVIDER";
 
     private static final Logger logger = Logger.getLogger(IdentityBrokerService.class);
 
@@ -208,12 +211,14 @@ public Response clientIntiatedAccountLinkingPreflight(@PathParam("provider_alias
     @GET
     @NoCache
     @Path("/{provider_alias}/link")
+    @Deprecated
     public Response clientInitiatedAccountLinking(@PathParam("provider_alias") String providerAlias,
                                                   @QueryParam("redirect_uri") String redirectUri,
                                                   @QueryParam("client_id") String clientId,
                                                   @QueryParam("nonce") String nonce,
                                                   @QueryParam("hash") String hash
     ) {
+        logger.warnf("Calling deprecated endpoint for client-initiated account linking. This endpoint will be removed in the future. Please use application initiated action (AIA) idp_link instead");
         this.event.event(EventType.CLIENT_INITIATED_ACCOUNT_LINKING);
         checkRealm();
         ClientModel client = checkClient(clientId);
@@ -314,6 +319,7 @@ public Response clientInitiatedAccountLinking(@PathParam("provider_alias") Strin
         }
 
         AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(client);
+        authSession.setAuthenticatedUser(userSession.getUser());
 
         // Refresh the cookie
         new AuthenticationSessionManager(session).setAuthSessionCookie(userSession.getId());
@@ -329,6 +335,10 @@ public Response clientInitiatedAccountLinking(@PathParam("provider_alias") Strin
         event.detail(Details.CODE_ID, userSession.getId());
         event.success();
 
+        return performClientInitiatedAccountLogin(providerAlias, clientSessionCode);
+    }
+
+    public Response performClientInitiatedAccountLogin(String providerAlias, ClientSessionCode<AuthenticationSessionModel> clientSessionCode) {
         try {
             IdentityProvider<?> identityProvider = getIdentityProvider(session, providerAlias);
             Response response = identityProvider.performLogin(createAuthenticationRequest(identityProvider, providerAlias, clientSessionCode));
@@ -337,16 +347,16 @@ public Response clientInitiatedAccountLinking(@PathParam("provider_alias") Strin
                 if (isDebugEnabled()) {
                     logger.debugf("Identity provider [%s] is going to send a request [%s].", identityProvider, response);
                 }
+
                 return response;
             }
         } catch (IdentityBrokerException e) {
-            return redirectToErrorPage(authSession, Response.Status.INTERNAL_SERVER_ERROR, Messages.COULD_NOT_SEND_AUTHENTICATION_REQUEST, e, providerAlias);
+            return redirectToErrorPage(clientSessionCode.getClientSession(), Response.Status.INTERNAL_SERVER_ERROR, Messages.COULD_NOT_SEND_AUTHENTICATION_REQUEST, e, providerAlias);
         } catch (Exception e) {
-            return redirectToErrorPage(authSession, Response.Status.INTERNAL_SERVER_ERROR, Messages.UNEXPECTED_ERROR_HANDLING_REQUEST, e, providerAlias);
+            return redirectToErrorPage(clientSessionCode.getClientSession(), Response.Status.INTERNAL_SERVER_ERROR, Messages.UNEXPECTED_ERROR_HANDLING_REQUEST, e, providerAlias);
         }
 
-        return redirectToErrorPage(authSession, Response.Status.INTERNAL_SERVER_ERROR, Messages.COULD_NOT_PROCEED_WITH_AUTHENTICATION_REQUEST);
-
+        return redirectToErrorPage(clientSessionCode.getClientSession(), Response.Status.INTERNAL_SERVER_ERROR, Messages.COULD_NOT_PROCEED_WITH_AUTHENTICATION_REQUEST);
     }
 
 
@@ -554,7 +564,8 @@ public Response authenticated(BrokeredIdentityContext context) {
         this.event.event(EventType.IDENTITY_PROVIDER_LOGIN)
                 .detail(Details.REDIRECT_URI, authenticationSession.getRedirectUri())
                 .detail(Details.IDENTITY_PROVIDER, providerAlias)
-                .detail(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername());
+                .detail(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername())
+                .detail(Details.IDENTITY_PROVIDER_BROKER_SESSION_ID, context.getBrokerSessionId());
 
         UserModel federatedUser = this.session.users().getUserByFederatedIdentity(this.realmModel, federatedIdentityModel);
         boolean shouldMigrateId = false;
@@ -565,10 +576,9 @@ public Response authenticated(BrokeredIdentityContext context) {
             shouldMigrateId = true;
         }
 
-        // Check if federatedUser is already authenticated (this means linking social into existing federatedUser account)
-        UserSessionModel userSession = new AuthenticationSessionManager(session).getUserSession(authenticationSession);
-        if (shouldPerformAccountLinking(authenticationSession, userSession, providerAlias)) {
-            return performAccountLinking(authenticationSession, userSession, context, federatedIdentityModel, federatedUser);
+        // Check if linking was requested (for example by kc_action) or if we're authenticating
+        if (isDoingAccountLinking(authenticationSession, true, providerAlias)) {
+            return performAccountLinking(authenticationSession, context, federatedIdentityModel, federatedUser);
         }
 
         if (federatedUser == null) {
@@ -721,12 +731,13 @@ private Response afterFirstBrokerLogin(AuthenticationSessionModel authSession) {
             }
 
 
-            String isRegisteredNewUser = authSession.getAuthNote(AbstractIdpAuthenticator.BROKER_REGISTERED_NEW_USER);
+            String isRegisteredNewUser = authSession.getAuthNote(BROKER_REGISTERED_NEW_USER);
             if (Boolean.parseBoolean(isRegisteredNewUser)) {
 
                 logger.debugf("Registered new user '%s' after first login with identity provider '%s'. Identity provider username is '%s' . ", federatedUser.getUsername(), providerAlias, context.getUsername());
 
-                context.getIdp().importNewUser(session, realmModel, federatedUser, context);
+                IdentityProvider idp = context.getIdp();
+                idp.importNewUser(session, realmModel, federatedUser, context);
                 KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
                 session.identityProviders().getMappersByAliasStream(providerAlias).forEach(mapper -> {
                     IdentityProviderMapper target = (IdentityProviderMapper) sessionFactory
@@ -734,10 +745,7 @@ private Response afterFirstBrokerLogin(AuthenticationSessionModel authSession) {
                     target.importNewUser(session, realmModel, federatedUser, mapper, context);
                 });
 
-                if (context.getIdpConfig().isTrustEmail() && !Validation.isBlank(federatedUser.getEmail()) && !Boolean.parseBoolean(authSession.getAuthNote(AbstractIdpAuthenticator.UPDATE_PROFILE_EMAIL_CHANGED))) {
-                    logger.debugf("Email verified automatically after registration of user '%s' through Identity provider '%s' ", federatedUser.getUsername(), context.getIdpConfig().getAlias());
-                    federatedUser.setEmailVerified(true);
-                }
+                idp.updateBrokeredUser(session, realmModel, federatedUser, context);
 
                 event.clone()
                         .event(EventType.REGISTER)
@@ -879,7 +887,8 @@ private Response finishBrokerAuthentication(BrokeredIdentityContext context, Use
         authSession.setUserSessionNote(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername());
 
         event.detail(Details.IDENTITY_PROVIDER, providerAlias)
-                .detail(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername());
+                .detail(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername())
+                .detail(Details.IDENTITY_PROVIDER_BROKER_SESSION_ID, context.getBrokerSessionId());
 
         if (isDebugEnabled()) {
             logger.debugf("Performing local authentication for user [%s].", federatedUser);
@@ -904,23 +913,26 @@ private Response finishBrokerAuthentication(BrokeredIdentityContext context, Use
     @Override
     public Response cancelled(IdentityProviderModel idpConfig) {
         AuthenticationSessionModel authSession = session.getContext().getAuthenticationSession();
+        event.detail(Details.IDENTITY_PROVIDER, idpConfig.getAlias());
 
-        String idpDisplayName = KeycloakModelUtils.getIdentityProviderDisplayName(session, idpConfig);
-        Response accountManagementFailedLinking = checkAccountManagementFailedLinking(authSession, Messages.ACCESS_DENIED_WHEN_IDP_AUTH, idpDisplayName);
-        if (accountManagementFailedLinking != null) {
-            return accountManagementFailedLinking;
+        // Check if linking was requested (for example by kc_action) or if we're authenticating
+        if (isDoingAccountLinking(authSession, true, idpConfig.getAlias())) {
+            authSession.setAuthNote(IdpLinkAction.IDP_LINK_STATUS, RequiredActionContext.KcActionStatus.CANCELLED.name());
+            return redirectAfterIDPLinking(authSession);
         }
-
+        String idpDisplayName = KeycloakModelUtils.getIdentityProviderDisplayName(session, idpConfig);
         return browserAuthentication(authSession, Messages.ACCESS_DENIED_WHEN_IDP_AUTH, idpDisplayName);
     }
 
     @Override
-    public Response error(String message) {
+    public Response error(IdentityProviderModel idpConfig, String message) {
         AuthenticationSessionModel authSession = session.getContext().getAuthenticationSession();
+        event.detail(Details.IDENTITY_PROVIDER, idpConfig.getAlias());
 
-        Response accountManagementFailedLinking = checkAccountManagementFailedLinking(authSession, message);
-        if (accountManagementFailedLinking != null) {
-            return accountManagementFailedLinking;
+        // Check if linking was requested (for example by kc_action) or if we're authenticating
+        UserSessionModel userSession = new AuthenticationSessionManager(session).getUserSession(authSession);
+        if (isDoingAccountLinking(authSession, true, idpConfig.getAlias())) {
+            return redirectToErrorWhenLinkingFailed(authSession, message);
         }
 
         Response passiveLoginErrorReturned = checkPassiveLoginError(authSession, message);
@@ -932,18 +944,19 @@ public Response error(String message) {
     }
 
 
-    private boolean shouldPerformAccountLinking(AuthenticationSessionModel authSession, UserSessionModel userSession, String providerAlias) {
+    private boolean isDoingAccountLinking(AuthenticationSessionModel authSession, boolean checkProviderAlias, String providerAlias) {
         String noteFromSession = authSession.getAuthNote(LINKING_IDENTITY_PROVIDER);
         if (noteFromSession == null) {
             return false;
         }
 
         boolean linkingValid;
-        if (userSession == null) {
-            linkingValid = false;
-        } else {
-            String expectedNote = userSession.getId() + authSession.getClient().getClientId() + providerAlias;
+        if (checkProviderAlias) {
+            String expectedNote = authSession.getParentSession().getId() + authSession.getClient().getClientId() + providerAlias;
             linkingValid = expectedNote.equals(noteFromSession);
+        } else {
+            String expectedNotePrefix = authSession.getParentSession().getId() + authSession.getClient().getClientId();
+            linkingValid = noteFromSession.startsWith(expectedNotePrefix);
         }
 
         if (linkingValid) {
@@ -955,18 +968,18 @@ private boolean shouldPerformAccountLinking(AuthenticationSessionModel authSessi
     }
 
 
-    private Response performAccountLinking(AuthenticationSessionModel authSession, UserSessionModel userSession, BrokeredIdentityContext context, FederatedIdentityModel newModel, UserModel federatedUser) {
-        logger.debugf("Will try to link identity provider [%s] to user [%s]", context.getIdpConfig().getAlias(), userSession.getUser().getUsername());
-
+    private Response performAccountLinking(AuthenticationSessionModel authSession, BrokeredIdentityContext context, FederatedIdentityModel newModel, UserModel federatedUser) {
         this.event.event(EventType.FEDERATED_IDENTITY_LINK);
 
-
-
-        UserModel authenticatedUser = userSession.getUser();
+        UserModel authenticatedUser = authSession.getAuthenticatedUser();
         authSession.setAuthenticatedUser(authenticatedUser);
 
+        logger.debugf("Will try to link identity provider [%s] to user [%s]", context.getIdpConfig().getAlias(), authenticatedUser.getUsername());
+
         if (federatedUser != null && !authenticatedUser.getId().equals(federatedUser.getId())) {
-            return redirectToErrorWhenLinkingFailed(authSession, Messages.IDENTITY_PROVIDER_ALREADY_LINKED, context.getIdpConfig().getAlias());
+            logger.debugf("Cannot link user '%s' to identity provider '%s' . Other user '%s' already linked with the identity provider", authenticatedUser.getUsername(), context.getIdpConfig().getAlias(), federatedUser.getUsername());
+            String idpDisplayName = KeycloakModelUtils.getIdentityProviderDisplayName(session, context.getIdpConfig());
+            return redirectToErrorWhenLinkingFailed(authSession, Messages.IDENTITY_PROVIDER_ALREADY_LINKED, idpDisplayName);
         }
 
         if (!authenticatedUser.hasRole(this.realmModel.getClientByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getRole(AccountRoles.MANAGE_ACCOUNT))) {
@@ -998,37 +1011,77 @@ private Response performAccountLinking(AuthenticationSessionModel authSession, U
 
         context.getIdp().authenticationFinished(authSession, context);
 
-        AuthenticationManager.setClientScopesInSession(session, authSession);
-        TokenManager.attachAuthenticationSession(session, userSession, authSession);
-
         if (isDebugEnabled()) {
             logger.debugf("Linking account [%s] from identity provider [%s] to user [%s].", newModel, context.getIdpConfig().getAlias(), authenticatedUser);
         }
 
-        this.event.user(authenticatedUser)
-                .detail(Details.USERNAME, authenticatedUser.getUsername())
-                .detail(Details.IDENTITY_PROVIDER, newModel.getIdentityProvider())
-                .detail(Details.IDENTITY_PROVIDER_USERNAME, newModel.getUserName())
-                .success();
-
         // we do this to make sure that the parent IDP is logged out when this user session is complete.
         // But for the case when userSession was previously authenticated with broker1 and now is linked to another broker2, we shouldn't override broker1 notes with the broker2 for sure.
         // Maybe broker logout should be rather always skiped in case of broker-linking
-        if (userSession.getNote(Details.IDENTITY_PROVIDER) == null) {
+        UserSessionModel userSession = new AuthenticationSessionManager(session).getUserSession(authSession);
+        if (userSession != null && userSession.getNote(Details.IDENTITY_PROVIDER) == null) {
             userSession.setNote(Details.IDENTITY_PROVIDER, context.getIdpConfig().getAlias());
             userSession.setNote(Details.IDENTITY_PROVIDER_USERNAME, context.getUsername());
         }
 
-        return Response.status(302).location(UriBuilder.fromUri(authSession.getRedirectUri()).build()).build();
-    }
+        authSession.setAuthNote(IdpLinkAction.IDP_LINK_STATUS, RequiredActionContext.KcActionStatus.SUCCESS.name());
 
+        if (!Boolean.parseBoolean(authSession.getAuthNote(IdpLinkAction.KC_ACTION_LINKING_IDENTITY_PROVIDER))) {
+            // Legacy client-initiated account linking
 
-    private Response redirectToErrorWhenLinkingFailed(AuthenticationSessionModel authSession, String message, Object... parameters) {
-        if (authSession.getClient() != null && authSession.getClient().getClientId().equals(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID)) {
-            return redirectToAccountErrorPage(authSession, message, parameters);
+            // In legacy client-initiated account linking, the userSession should exists before linking was started, however it might be expired during the time when user is authenticating to the IDP
+            if (userSession == null) {
+                return redirectToErrorWhenLinkingFailed(authSession, Messages.BROKER_LINKING_SESSION_EXPIRED);
+            }
+
+            AuthenticationManager.setClientScopesInSession(session, authSession);
+            TokenManager.attachAuthenticationSession(session, userSession, authSession);
+
+            this.event.user(authenticatedUser)
+                    .detail(Details.USERNAME, authenticatedUser.getUsername())
+                    .detail(Details.IDENTITY_PROVIDER, newModel.getIdentityProvider())
+                    .detail(Details.IDENTITY_PROVIDER_USERNAME, newModel.getUserName())
+                    .success();
+        }
+        return redirectAfterIDPLinking(authSession);
+    }
+
+    private Response redirectAfterIDPLinking(AuthenticationSessionModel authSession) {
+        URI redirect;
+        if (Boolean.parseBoolean(authSession.getAuthNote(IdpLinkAction.KC_ACTION_LINKING_IDENTITY_PROVIDER))) {
+            // Redirect to idp_link action to finish the flow properly
+            ClientSessionCode<AuthenticationSessionModel> clientSessionCode = new ClientSessionCode<>(session, realmModel, authSession);
+            clientSessionCode.setAction(AuthenticationSessionModel.Action.REQUIRED_ACTIONS.name());
+            String sessionCode = clientSessionCode.getOrGenerateCode();
+
+            authSession.setAction(AuthenticationSessionModel.Action.REQUIRED_ACTIONS.name());
+            return new LoginActionsService(session, event).requiredActionPOST(null,
+                    sessionCode,
+                    authSession.getClientNote(Constants.KC_ACTION),
+                    authSession.getClient().getClientId(),
+                    AuthenticationProcessor.getClientData(session, authSession),
+                    authSession.getTabId()
+                    );
         } else {
-            return redirectToErrorPage(authSession, Response.Status.BAD_REQUEST, message, parameters); // Should rather redirect to app instead and display error here?
+            // Legacy client-initiated account linking
+            redirect = UriBuilder.fromUri(authSession.getRedirectUri()).build();
         }
+        return Response.status(302).location(redirect).build();
+    }
+
+
+    private Response redirectToErrorWhenLinkingFailed(AuthenticationSessionModel authSession, String error, Object... parameters) {
+        FormMessage errorMessage = new FormMessage(error, parameters);
+        String serializedError;
+        try {
+            serializedError = JsonSerialization.writeValueAsString(errorMessage);
+        } catch (IOException ioe) {
+            throw new RuntimeException(ioe);
+        }
+
+        authSession.setAuthNote(IdpLinkAction.IDP_LINK_STATUS, RequiredActionContext.KcActionStatus.ERROR.name());
+        authSession.setAuthNote(IdpLinkAction.IDP_LINK_ERROR, serializedError);
+        return redirectAfterIDPLinking(authSession);
     }
 
 
@@ -1059,7 +1112,6 @@ private void updateFederatedIdentity(BrokeredIdentityContext context, UserModel
     }
 
     private void setBasicUserAttributes(BrokeredIdentityContext context, UserModel federatedUser) {
-        setDiffAttrToConsumer(federatedUser.getEmail(), context.getEmail(), email -> setEmail(context, federatedUser, email), true);
         setDiffAttrToConsumer(federatedUser.getFirstName(), context.getFirstName(), federatedUser::setFirstName, false);
         setDiffAttrToConsumer(federatedUser.getLastName(), context.getLastName(), federatedUser::setLastName, false);
     }
@@ -1071,18 +1123,6 @@ private void setDiffAttrToConsumer(String actualValue, String newValue, Consumer
         }
     }
 
-    private void setEmail(BrokeredIdentityContext context, UserModel federatedUser, String newEmail) {
-        federatedUser.setEmail(newEmail);
-        // change email verified depending on if it is trusted or not
-        if (context.getIdpConfig().isTrustEmail() && !Boolean.parseBoolean(context.getAuthenticationSession().getAuthNote(AbstractIdpAuthenticator.UPDATE_PROFILE_EMAIL_CHANGED))) {
-            logger.tracef("Email verified automatically after updating user '%s' through Identity provider '%s' ", federatedUser.getUsername(), context.getIdpConfig().getAlias());
-            federatedUser.setEmailVerified(true);
-        } else {
-            logger.tracef("Email verified reset to false after updating user '%s' through Identity provider '%s' ", federatedUser.getUsername(), context.getIdpConfig().getAlias());
-            federatedUser.setEmailVerified(false);
-        }
-    }
-
     private void migrateFederatedIdentityId(BrokeredIdentityContext context, UserModel federatedUser) {
         FederatedIdentityModel identityModel = this.session.users().getFederatedIdentity(this.realmModel, federatedUser, context.getIdpConfig().getAlias());
         FederatedIdentityModel migratedIdentityModel = new FederatedIdentityModel(identityModel, context.getId());
@@ -1148,9 +1188,9 @@ private AuthenticationSessionModel parseSessionCode(String code, String clientId
 
             AuthenticationSessionModel authSession = checks.getAuthenticationSession();
             if (authSession != null) {
-                // Check if error happened during login or during linking from account management
-                Response accountManagementFailedLinking = checkAccountManagementFailedLinking(authSession, Messages.STALE_CODE_ACCOUNT);
-                if (accountManagementFailedLinking != null) {
+                // Check if error happened during login or during linking from some application like account console
+                if (isDoingAccountLinking(authSession, false, null)) {
+                    Response accountManagementFailedLinking = redirectToErrorWhenLinkingFailed(authSession, Messages.STALE_CODE_ACCOUNT);
                     throw new WebApplicationException(accountManagementFailedLinking);
                 } else {
                     Response errorResponse = checks.getResponse();
@@ -1171,21 +1211,6 @@ private AuthenticationSessionModel parseSessionCode(String code, String clientId
         }
     }
 
-    private Response checkAccountManagementFailedLinking(AuthenticationSessionModel authSession, String error, Object... parameters) {
-        UserSessionModel userSession = new AuthenticationSessionManager(session).getUserSession(authSession);
-        if (userSession != null && authSession.getClient() != null) {
-
-            this.event.event(EventType.FEDERATED_IDENTITY_LINK);
-            UserModel user = userSession.getUser();
-            this.event.user(user);
-            this.event.detail(Details.USERNAME, user.getUsername());
-
-            return redirectToAccountErrorPage(authSession, error, parameters);
-        } else {
-            return null;
-        }
-    }
-
     /**
      * Checks if specified message matches one of the passive login error messages and if it does builds a response that
      * redirects the error back to the client.
@@ -1254,21 +1279,6 @@ private Response redirectToErrorPage(AuthenticationSessionModel authSession, Res
         throw new ErrorPageException(this.session, authSession, status, message, parameters);
     }
 
-    private Response redirectToAccountErrorPage(AuthenticationSessionModel authSession, String message, Object ... parameters) {
-        fireErrorEvent(message);
-
-        FormMessage errorMessage = new FormMessage(message, parameters);
-        try {
-            String serializedError = JsonSerialization.writeValueAsString(errorMessage);
-            authSession.setAuthNote(AccountConsole.ACCOUNT_MGMT_FORWARDED_ERROR_NOTE, serializedError);
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-
-        URI accountServiceUri = UriBuilder.fromUri(authSession.getRedirectUri()).queryParam(Constants.TAB_ID, authSession.getTabId()).build();
-        return Response.status(302).location(accountServiceUri).build();
-    }
-
 
     protected Response browserAuthentication(AuthenticationSessionModel authSession, String errorMessage, Object... parameters) {
         this.event.event(EventType.LOGIN);
diff --git a/services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java b/services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java
index 90f62adf598e..56eb4d6bee66 100644
--- a/services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java
+++ b/services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java
@@ -20,38 +20,23 @@
 import org.keycloak.Config;
 import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.config.ConfigProviderFactory;
+import org.keycloak.exportimport.ExportImportConfig;
 import org.keycloak.exportimport.ExportImportManager;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.KeycloakSessionTask;
-import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserProvider;
 import org.keycloak.models.dblock.DBLockManager;
 import org.keycloak.models.dblock.DBLockProvider;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.PostMigrationEvent;
-import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.platform.Platform;
 import org.keycloak.platform.PlatformProvider;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.services.ServicesLogger;
 import org.keycloak.services.managers.ApplianceBootstrap;
-import org.keycloak.services.managers.RealmManager;
 import org.keycloak.transaction.JtaTransactionManagerLookup;
-import org.keycloak.util.JsonSerialization;
 
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.util.List;
 import java.util.NoSuchElementException;
 import java.util.ServiceLoader;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-
 import jakarta.transaction.SystemException;
 import jakarta.transaction.Transaction;
 import jakarta.ws.rs.core.Application;
@@ -113,10 +98,11 @@ public void run(KeycloakSession session) {
     }
 
     protected void shutdown() {
-        if (sessionFactory != null)
+        if (sessionFactory != null) {
             sessionFactory.close();
+        }
     }
-    
+
     private static class BootstrapState {
         ExportImportManager exportImportManager;
         boolean newInstall;
@@ -151,21 +137,25 @@ public void run(KeycloakSession session) {
                 var exportImportManager = bootstrapState.exportImportManager = new ExportImportManager(session);
                 bootstrapState.newInstall = applianceBootstrap.isNewInstall();
                 if (bootstrapState.newInstall) {
-                    if (!exportImportManager.isImportMasterIncluded()) {
-                        applianceBootstrap.createMasterRealm();
+                    boolean existing = ExportImportConfig.isSingleTransaction();
+                    ExportImportConfig.setSingleTransaction(true);
+                    try {
+                        if (!exportImportManager.isImportMasterIncluded()) {
+                            applianceBootstrap.createMasterRealm();
+                        }
+                        // these are also running in the initial bootstrap transaction - if there is a problem, the server won't be initialized at all
+                        exportImportManager.runImport();
+                        createTemporaryAdmin(session);
+                    } finally {
+                        ExportImportConfig.setSingleTransaction(existing);
                     }
-                    // these are also running in the initial bootstrap transaction - if there is a problem, the server won't be initialized at all
-                    exportImportManager.runImport();
-                    createTemporaryAdmin(session);
-                } 
+                }
             }
         });
 
         if (!bootstrapState.newInstall) {
             bootstrapState.exportImportManager.runImport();
         }
-        
-        importAddUser();
 
         return bootstrapState.exportImportManager;
     }
@@ -192,86 +182,4 @@ public static KeycloakSessionFactory getSessionFactory() {
         return sessionFactory;
     }
 
-    public void importRealm(RealmRepresentation rep, String from) {
-        boolean exists = false;
-        try (KeycloakSession session = sessionFactory.create()) {
-            session.getTransactionManager().begin();
-
-            try {
-                RealmManager manager = new RealmManager(session);
-
-                if (rep.getId() != null && manager.getRealm(rep.getId()) != null) {
-                    ServicesLogger.LOGGER.realmExists(rep.getRealm(), from);
-                    exists = true;
-                }
-
-                if (manager.getRealmByName(rep.getRealm()) != null) {
-                    ServicesLogger.LOGGER.realmExists(rep.getRealm(), from);
-                    exists = true;
-                }
-                if (!exists) {
-                    RealmModel realm = manager.importRealm(rep);
-                    ServicesLogger.LOGGER.importedRealm(realm.getName(), from);
-                }
-            } catch (Throwable t) {
-                session.getTransactionManager().setRollbackOnly();
-                throw t;
-            }
-        } catch (Throwable t) {
-            if (!exists) {
-                ServicesLogger.LOGGER.unableToImportRealm(t, rep.getRealm(), from);
-            }
-        }
-    }
-
-    public void importAddUser() {
-        String configDir = System.getProperty("jboss.server.config.dir");
-        if (configDir != null) {
-            File addUserFile = new File(configDir + File.separator + "keycloak-add-user.json");
-            if (addUserFile.isFile()) {
-                ServicesLogger.LOGGER.imprtingUsersFrom(addUserFile);
-
-                List<RealmRepresentation> realms;
-                try {
-                    realms = JsonSerialization.readValue(new FileInputStream(addUserFile), new TypeReference<List<RealmRepresentation>>() {
-                    });
-                } catch (IOException e) {
-                    ServicesLogger.LOGGER.failedToLoadUsers(e);
-                    return;
-                }
-
-                for (RealmRepresentation realmRep : realms) {
-                    for (UserRepresentation userRep : realmRep.getUsers()) {
-                        try {
-                            KeycloakModelUtils.runJobInTransaction(sessionFactory, session -> {
-                                RealmModel realm = session.realms().getRealmByName(realmRep.getRealm());
-
-                                if (realm == null) {
-                                    ServicesLogger.LOGGER.addUserFailedRealmNotFound(userRep.getUsername(), realmRep.getRealm());
-                                }
-                                session.getContext().setRealm(realm);
-
-                                UserProvider users = session.users();
-
-                                if (users.getUserByUsername(realm, userRep.getUsername()) != null) {
-                                    ServicesLogger.LOGGER.notCreatingExistingUser(userRep.getUsername());
-                                } else {
-                                    UserModel user = RepresentationToModel.createUser(session, realm, userRep);
-                                    ServicesLogger.LOGGER.addUserSuccess(userRep.getUsername(), realmRep.getRealm());
-                                }
-                            });
-                        } catch (ModelDuplicateException e) {
-                            ServicesLogger.LOGGER.addUserFailedUserExists(userRep.getUsername(), realmRep.getRealm());
-                        } catch (Throwable t) {
-                            ServicesLogger.LOGGER.addUserFailed(t, userRep.getUsername(), realmRep.getRealm());
-                        }
-                    }
-                }
-
-                if (!addUserFile.delete()) {
-                    ServicesLogger.LOGGER.failedToDeleteFile(addUserFile.getAbsolutePath());
-                }
-            }
-        }
-    }
 }
diff --git a/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java b/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
index 7cece59f8f2a..dc6725934616 100755
--- a/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
+++ b/services/src/main/java/org/keycloak/services/resources/LoginActionsService.java
@@ -55,7 +55,6 @@
 import org.keycloak.events.EventType;
 import org.keycloak.exceptions.TokenNotActiveException;
 import org.keycloak.models.KeycloakContext;
-import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.SingleUseObjectKeyModel;
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.ClientModel;
@@ -77,6 +76,7 @@
 import org.keycloak.protocol.LoginProtocol;
 import org.keycloak.protocol.LoginProtocol.Error;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.grants.device.DeviceGrantType;
 import org.keycloak.protocol.oidc.utils.OIDCResponseMode;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
 import org.keycloak.protocol.oidc.utils.RedirectUtils;
@@ -760,7 +760,12 @@ public Response registerPage(@QueryParam(AUTH_SESSION_ID) String authSessionId,
                                  @QueryParam(Constants.EXECUTION) String execution,
                                  @QueryParam(Constants.CLIENT_ID) String clientId,
                                  @QueryParam(Constants.CLIENT_DATA) String clientData,
-                                 @QueryParam(Constants.TAB_ID) String tabId) {
+                                 @QueryParam(Constants.TAB_ID) String tabId,
+                                 @QueryParam(Constants.TOKEN) String tokenString) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ORGANIZATION) && tokenString != null) {
+            //this call should extract orgId from token and set the organization to the session context
+            preHandleActionToken(tokenString);
+        }
         return registerRequest(authSessionId, code, execution, clientId,  tabId,clientData);
     }
 
@@ -907,7 +912,8 @@ protected Response brokerLoginFlow(String authSessionId, String code, String exe
         }
 
         event.detail(Details.IDENTITY_PROVIDER, identityProviderAlias)
-                .detail(Details.IDENTITY_PROVIDER_USERNAME, brokerContext.getUsername());
+                .detail(Details.IDENTITY_PROVIDER_USERNAME, brokerContext.getUsername())
+                .detail(Details.IDENTITY_PROVIDER_BROKER_SESSION_ID, brokerContext.getBrokerSessionId());
 
         event.success();
 
@@ -1019,6 +1025,11 @@ public Response processConsent() {
             return response;
         }
 
+        if (DeviceGrantType.isDeviceCodeDeniedForDeviceVerificationFlow(session, realm, authSession)) {
+            event.error(Errors.REJECTED_BY_USER);
+            return DeviceGrantType.denyOAuth2DeviceAuthorization(authSession, Error.CONSENT_DENIED, session);
+        }
+
         UserConsentModel grantedConsent = UserConsentManager.getConsentByClient(session, realm, user, client.getId());
         if (grantedConsent == null) {
             grantedConsent = new UserConsentModel(client);
@@ -1163,7 +1174,7 @@ public void ignore() {
         if (isCancelAppInitiatedAction(factory.getId(), authSession, context)) {
             provider.initiatedActionCanceled(session, authSession);
             AuthenticationManager.setKcActionStatus(factory.getId(), RequiredActionContext.KcActionStatus.CANCELLED, authSession);
-            context.success();
+            context.cancel();
         } else {
             provider.processAction(context);
         }
@@ -1172,7 +1183,14 @@ public void ignore() {
             authSession.setAuthNote(AuthenticationProcessor.LAST_PROCESSED_EXECUTION, action);
         }
 
-        if (context.getStatus() == RequiredActionContext.Status.SUCCESS) {
+        if (context.getStatus() == RequiredActionContext.Status.CANCELLED) {
+            event.clone().error(Errors.REJECTED_BY_USER);
+            initLoginEvent(authSession);
+            event.event(EventType.LOGIN);
+            authSession.removeAuthNote(AuthenticationProcessor.CURRENT_AUTHENTICATION_EXECUTION);
+            AuthenticationManager.setKcActionStatus(factory.getId(), RequiredActionContext.KcActionStatus.CANCELLED, authSession);
+            response = AuthenticationManager.nextActionAfterAuthentication(session, authSession, clientConnection, request, session.getContext().getUri(), event);
+        } else if (context.getStatus() == RequiredActionContext.Status.SUCCESS) {
             event.clone().success();
             initLoginEvent(authSession);
             event.event(EventType.LOGIN);
diff --git a/services/src/main/java/org/keycloak/services/resources/PublicRealmResource.java b/services/src/main/java/org/keycloak/services/resources/PublicRealmResource.java
index a1b182e5b748..12321bad8531 100755
--- a/services/src/main/java/org/keycloak/services/resources/PublicRealmResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/PublicRealmResource.java
@@ -80,7 +80,7 @@ public Response accountPreflight() {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     public PublishedRealmRepresentation getRealm() {
-        Cors.builder().allowedOrigins(Cors.ACCESS_CONTROL_ALLOW_ORIGIN_WILDCARD).auth().add();
+        Cors.builder().allowAllOrigins().auth().add();
         return realmRep(session, realm, session.getContext().getUri());
     }
 
diff --git a/services/src/main/java/org/keycloak/services/resources/RealmsResource.java b/services/src/main/java/org/keycloak/services/resources/RealmsResource.java
index 7542f27133c1..8cdc43ca6c28 100755
--- a/services/src/main/java/org/keycloak/services/resources/RealmsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/RealmsResource.java
@@ -240,7 +240,7 @@ public Response getWellKnown(final @PathParam("realm") String name,
 
         if (wellKnown != null) {
             ResponseBuilder responseBuilder = Response.ok(wellKnown.getConfig()).cacheControl(CacheControlUtil.noCache());
-            return Cors.builder().allowedOrigins("*").auth().add(responseBuilder);
+            return Cors.builder().allowAllOrigins().auth().add(responseBuilder);
         }
 
         throw new NotFoundException();
diff --git a/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java b/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java
index 72581b34c22d..96c8eff498e4 100644
--- a/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java
+++ b/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java
@@ -43,6 +43,8 @@
 import org.keycloak.protocol.ClientData;
 import org.keycloak.protocol.LoginProtocol;
 import org.keycloak.protocol.RestartLoginCookie;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.utils.RedirectUtils;
 import org.keycloak.services.ErrorPage;
 import org.keycloak.services.ServicesLogger;
 import org.keycloak.services.managers.AuthenticationManager;
@@ -448,6 +450,19 @@ protected Response restartAuthenticationSessionFromCookie(RootAuthenticationSess
                 flowPath = LoginActionsService.AUTHENTICATE_PATH;
             }
 
+            //set redirect uri and other notes from client data parameter
+            try {
+                ClientData clientData = ClientData.decodeClientDataFromParameter(clientDataString);
+                if (RedirectUtils.verifyRedirectUri(session, clientData.getRedirectUri(), authSession.getClient()) != null) {
+                    authSession.setRedirectUri(clientData.getRedirectUri());
+                    authSession.setClientNote(OIDCLoginProtocol.RESPONSE_TYPE_PARAM, clientData.getResponseType());
+                    authSession.setClientNote(OIDCLoginProtocol.RESPONSE_MODE_PARAM, clientData.getResponseMode());
+                    authSession.setClientNote(OIDCLoginProtocol.STATE_PARAM, clientData.getState());
+                }
+            } catch (Exception e) {
+                logger.debugf(e, "ClientData parameter in invalid format. ClientData parameter was %s", clientDataString);
+            }
+
             String clientData = AuthenticationProcessor.getClientData(session, authSession);
             URI redirectUri = getLastExecutionUrl(flowPath, null, authSession.getTabId(), clientData);
             logger.debugf("Authentication session restart from cookie succeeded. Redirecting to %s", redirectUri);
diff --git a/services/src/main/java/org/keycloak/services/resources/ThemeResource.java b/services/src/main/java/org/keycloak/services/resources/ThemeResource.java
index 707efd6d6c26..eb481b4b89d5 100644
--- a/services/src/main/java/org/keycloak/services/resources/ThemeResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/ThemeResource.java
@@ -17,12 +17,18 @@
 package org.keycloak.services.resources;
 
 import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
 import jakarta.ws.rs.OPTIONS;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriInfo;
+import org.jboss.logging.Logger;
+import org.keycloak.common.Profile;
 import org.keycloak.common.Version;
 import org.keycloak.common.util.MimeTypeUtil;
 import org.keycloak.encoding.ResourceEncodingHelper;
@@ -42,13 +48,16 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.Properties;
 import java.util.Set;
+import java.util.regex.Pattern;
 
 import static java.util.stream.Collectors.toList;
 import static java.util.stream.Collectors.toSet;
@@ -62,6 +71,9 @@
 @Path("/resources")
 public class ThemeResource {
 
+    private static final Logger log = Logger.getLogger(ThemeResource.class);
+    private static final Pattern RESOURCE_TAG_PATTERN = Pattern.compile("[0-9a-z]{5}");
+
     @Context
     private KeycloakSession session;
 
@@ -76,15 +88,73 @@ public class ThemeResource {
      */
     @GET
     @Path("/{version}/{themeType}/{themeName}/{path:.*}")
-    public Response getResource(@PathParam("version") String version, @PathParam("themeType") String themeType, @PathParam("themeName") String themeName, @PathParam("path") String path) {
+    public Response getResource(@PathParam("version") String version, @PathParam("themeType") String themeType, @PathParam("themeName") String themeName, @PathParam("path") String path, @HeaderParam(HttpHeaders.IF_NONE_MATCH) String etag, @Context UriInfo uriInfo) {
         final Optional<Theme.Type> type = getThemeType(themeType);
-        if (!version.equals(Version.RESOURCES_VERSION) || type.isEmpty()) {
+
+        if (!version.equals(Version.RESOURCES_VERSION) && !Profile.isFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V2)) {
+            return Response.status(Response.Status.NOT_FOUND).build();
+        }
+
+        if (type.isEmpty()) {
             return Response.status(Response.Status.NOT_FOUND).build();
         }
 
         try {
             String contentType = MimeTypeUtil.getContentType(path);
             Theme theme = session.theme().getTheme(themeName, type.get());
+
+            boolean hasContentHash = theme.hasContentHash(path);
+
+            if (Profile.isFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V2)) {
+
+                String base = uriInfo.getBaseUri().getPath();
+                base = base.substring(0, base.length() - 1);
+                if (!RESOURCE_TAG_PATTERN.matcher(version).matches()) {
+                    // This prevents open or half-open redirects to other URLs later, or is accepting any version
+                    log.debugf("Illegal version passed, returning a 404: %s", uriInfo.getRequestUri().getPath());
+                    return Response.status(Response.Status.NOT_FOUND).build();
+                }
+
+                if (!version.equals(Version.RESOURCES_VERSION) && !hasContentHash) {
+                    // If it is not the right version, and it does not have a content hash, redirect.
+                    // If it is not the right version, but it has a content hash, continue to see if it exists.
+
+                    // A simpler way to check for encoded URL characters would be to retrieve the raw values.
+                    // Unfortunately, RESTEasy doesn't support this, and UrlInfo will throw an IllegalArgumentException.
+                    if (!uriInfo.getRequestUri().toURL().getPath().startsWith(base + UriBuilder.fromResource(ThemeResource.class)
+                            .path("/{version}/{themeType}/{themeName}/{path}").build(version,themeType, themeName, path).getPath())) {
+                        // This prevents half-open redirects
+                        log.debugf("No URL encoding should be necessary for the path, returning a 404: %s", uriInfo.getRequestUri().getPath());
+                        return Response.status(Response.Status.NOT_FOUND).build();
+                    }
+
+                    URI redirectUri = UriBuilder.fromResource(ThemeResource.class)
+                            .path("/{version}/{themeType}/{themeName}/{path}")
+                            .replaceQuery(uriInfo.getRequestUri().getRawQuery())
+                            // The 'path' can contain slashes, so encoding of slashes is set to false
+                            .build(new Object[]{Version.RESOURCES_VERSION, themeType, themeName, path}, false);
+                    if (!redirectUri.normalize().equals(redirectUri)) {
+                        // This prevents half-open redirects
+                        log.debugf("Redirect URL should not require normalization, returning a 404: %s", redirectUri.toString());
+                        return Response.status(Response.Status.NOT_FOUND).build();
+                    }
+
+                    // The redirect will lead the browser to a resource that it then (when retrieved successfully) can cache again.
+                    // This assumes that it is better to try to some content even if it is outdated or too new, instead of returning a 404.
+                    // This should usually work for images, CSS or (simple) JavaScript referenced in the login theme that needs to be
+                    // loaded while the rolling restart is progressing.
+                    return Response.temporaryRedirect(redirectUri)
+                            .build();
+                }
+
+                if (hasContentHash && Objects.equals(etag, Version.RESOURCES_VERSION)) {
+                    // We delivered this resource earlier, and its etag matches the resource version, so it has not changed
+                    return Response.notModified()
+                            .header(HttpHeaders.ETAG, Version.RESOURCES_VERSION)
+                            .cacheControl(CacheControlUtil.getDefaultCacheControl()).build();
+                }
+            }
+
             ResourceEncodingProvider encodingProvider = session.theme().isCacheEnabled() ? ResourceEncodingHelper.getResourceEncodingProvider(session, contentType) : null;
 
             InputStream resource;
@@ -96,6 +166,13 @@ public Response getResource(@PathParam("version") String version, @PathParam("th
 
             if (resource != null) {
                 Response.ResponseBuilder rb = Response.ok(resource).type(contentType).cacheControl(CacheControlUtil.getDefaultCacheControl());
+
+                if (Profile.isFeatureEnabled(Profile.Feature.ROLLING_UPDATES_V2)){
+                    if (hasContentHash) {
+                        // All items with a content hash receive an etag, so we can then provide a not-modified response later
+                        rb.header(HttpHeaders.ETAG, Version.RESOURCES_VERSION);
+                    }
+                }
                 if (encodingProvider != null) {
                     rb.encoding(encodingProvider.getEncoding());
                 }
@@ -154,7 +231,7 @@ public Response getLocalizationTexts(@PathParam("realm") String realmName, @Quer
                     new KeySource((String) e.getKey(), (String) e.getValue())).collect(toList());
         }
 
-        return Cors.builder().allowedOrigins("*").auth().add(Response.ok(result));
+        return Cors.builder().allowAllOrigins().auth().add(Response.ok(result));
     }
 
     private static Optional<Theme.Type> getThemeType(String themeType) {
diff --git a/services/src/main/java/org/keycloak/services/resources/WelcomeResource.java b/services/src/main/java/org/keycloak/services/resources/WelcomeResource.java
index baccb354a466..1cf1d1288348 100755
--- a/services/src/main/java/org/keycloak/services/resources/WelcomeResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/WelcomeResource.java
@@ -106,8 +106,8 @@ public Response createUser() {
         if (!shouldBootstrap()) {
             return createWelcomePage(null, null);
         } else {
-            if (!isLocal()) {
-                ServicesLogger.LOGGER.rejectedNonLocalAttemptToCreateInitialUser(session.getContext().getConnection().getRemoteAddr());
+            if (!isLocal(session)) {
+                ServicesLogger.LOGGER.rejectedNonLocalAttemptToCreateInitialUser(session.getContext().getConnection().getRemoteHost());
                 throw new WebApplicationException(Response.Status.BAD_REQUEST);
             }
 
@@ -179,7 +179,7 @@ private Response createWelcomePage(String successMessage, String errorMessage) {
             Theme theme = getTheme();
 
             if(Objects.isNull(theme)) {
-                logger.error("Theme is null please check the \"--spi-theme-default\" parameter");
+                logger.error("Theme is null please check the \"--spi-theme--default\" parameter");
                 errorMessage = "The theme is null";
                 ResponseBuilder rb = Response.status(Status.BAD_REQUEST)
                         .entity(errorMessage)
@@ -210,7 +210,7 @@ private Response createWelcomePage(String successMessage, String errorMessage) {
             map.put("resourcesPath", "resources/" + Version.RESOURCES_VERSION + "/" + theme.getType().toString().toLowerCase() +"/" + theme.getName());
             map.put("resourcesCommonPath", "resources/" + Version.RESOURCES_VERSION + "/" + commonPath);
 
-            boolean isLocal = isLocal();
+            boolean isLocal = isLocal(session);
             map.put("localUser", isLocal);
 
             if (bootstrap) {
@@ -269,7 +269,7 @@ private boolean shouldBootstrap() {
         return shouldBootstrap.get();
     }
 
-    private boolean isLocal() {
+    public static boolean isLocal(KeycloakSession session) {
         ClientConnection clientConnection = session.getContext().getConnection();
         String remoteAddress = clientConnection.getRemoteAddr();
         String localAddress = clientConnection.getLocalAddr();
@@ -277,7 +277,7 @@ private boolean isLocal() {
         HttpHeaders headers = request.getHttpHeaders();
         String xForwardedFor = headers.getHeaderString("X-Forwarded-For");
         String forwarded = headers.getHeaderString("Forwarded");
-        logger.debugf("Checking WelcomePage. Remote address: %s, Local address: %s, X-Forwarded-For header: %s, Forwarded header: %s", remoteAddress.toString(), localAddress.toString(), xForwardedFor, forwarded);
+        logger.debugf("Checking isLocal. Remote address: %s, Local address: %s, X-Forwarded-For header: %s, Forwarded header: %s", remoteAddress, localAddress, xForwardedFor, forwarded);
 
         // Consider that welcome page accessed locally just if it was accessed really through "localhost" URL and without loadbalancer (x-forwarded-for and forwarded header is empty).
         return xForwardedFor == null && forwarded == null && SecureContextResolver.isLocalAddress(remoteAddress) && SecureContextResolver.isLocalAddress(localAddress);
diff --git a/services/src/main/java/org/keycloak/services/resources/account/AccountConsole.java b/services/src/main/java/org/keycloak/services/resources/account/AccountConsole.java
index 3ba533170051..c27c13288d61 100644
--- a/services/src/main/java/org/keycloak/services/resources/account/AccountConsole.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/AccountConsole.java
@@ -11,9 +11,13 @@
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.authentication.requiredactions.DeleteAccount;
+import org.keycloak.authentication.requiredactions.UpdateEmail;
 import org.keycloak.common.Profile;
 import org.keycloak.common.Version;
 import org.keycloak.common.util.Environment;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.IdentityProviderStorageProvider;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.utils.PkceUtils;
 import org.keycloak.utils.SecureContextResolver;
@@ -22,7 +26,6 @@
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
@@ -59,15 +62,13 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 /**
  * Created by st on 29/03/17.
  */
 public class AccountConsole implements AccountResourceProvider {
 
-    // Used when some other context (ie. IdentityBrokerService) wants to forward error to account management and display it here
-    public static final String ACCOUNT_MGMT_FORWARDED_ERROR_NOTE = "ACCOUNT_MGMT_FORWARDED_ERROR";
-
     private final Pattern bundleParamPattern = Pattern.compile("(\\{\\s*(\\d+)\\s*\\})");
 
     protected final KeycloakSession session;
@@ -184,6 +185,7 @@ private Response renderAccountConsole() throws IOException, FreeMarkerException
         });
 
         map.put("isAuthorizationEnabled", Profile.isFeatureEnabled(Profile.Feature.AUTHORIZATION));
+        map.put("isLinkedAccountsEnabled", isLinkedAccountsEnabled(user));
 
         boolean deleteAccountAllowed = false;
         boolean isViewGroupsEnabled = false;
@@ -201,8 +203,7 @@ private Response renderAccountConsole() throws IOException, FreeMarkerException
         map.put("isOid4VciEnabled", realm.isVerifiableCredentialsEnabled());
 
         map.put("updateEmailFeatureEnabled", Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL));
-        RequiredActionProviderModel updateEmailActionProvider = realm.getRequiredActionProviderByAlias(UserModel.RequiredAction.UPDATE_EMAIL.name());
-        map.put("updateEmailActionEnabled", updateEmailActionProvider != null && updateEmailActionProvider.isEnabled());
+        map.put("updateEmailActionEnabled", UpdateEmail.isEnabled(realm));
 
         final var devServerUrl = Environment.isDevMode() ? System.getenv(ViteManifest.ACCOUNT_VITE_URL) : null;
 
@@ -264,6 +265,9 @@ private Response redirectToLogin(String path) {
         UriBuilder uriBuilder = UriBuilder.fromUri(OIDCLoginProtocolService.authUrl(session.getContext().getUri()).build(realm.getName()).toString())
                 .queryParam(OAuth2Constants.CLIENT_ID, Constants.ACCOUNT_CONSOLE_CLIENT_ID)
                 .queryParam(OAuth2Constants.REDIRECT_URI, targetUri)
+                // dummy state param to make it usable with secure-session client policy.
+                // Once bootstrapped the account-console frontend will send the actual state with the authorize request.
+                .queryParam(OAuth2Constants.STATE, UUID.randomUUID().toString())
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CODE_CHALLENGE, pkceChallenge)
                 .queryParam(OAuth2Constants.CODE_CHALLENGE_METHOD, OAuth2Constants.PKCE_METHOD_S256);
@@ -271,10 +275,20 @@ private Response redirectToLogin(String path) {
         if (!queryParameters.isEmpty()) {
             String error = queryParameters.getFirst(OAuth2Constants.ERROR);
             if (error != null) {
-                try {
-                    return renderAccountConsole();
-                } catch (IOException | FreeMarkerException e) {
-                    throw new ServerErrorException(Status.INTERNAL_SERVER_ERROR);
+                String state = queryParameters.getFirst(OAuth2Constants.STATE);
+                if (state != null) {
+                    // Omit the "state" parameter to make sure that account console displays the error (it may not be shown due the keycloak.js, which will not be able to find the "callback data" in the browser callbackStorage)
+                    URI url = session.getContext().getUri(UrlType.FRONTEND)
+                            .getRequestUriBuilder()
+                            .replaceQueryParam(OAuth2Constants.STATE, null)
+                            .build();
+                    return Response.status(302).location(url).build();
+                } else {
+                    try {
+                        return renderAccountConsole();
+                    } catch (IOException | FreeMarkerException e) {
+                        throw new ServerErrorException(Status.INTERNAL_SERVER_ERROR);
+                    }
                 }
             }
             String scope = queryParameters.getFirst(OIDCLoginProtocol.SCOPE_PARAM);
@@ -369,4 +383,20 @@ private String[] getReferrer() {
 
         return new String[]{referrer, referrerName, referrerUri};
     }
+
+    private boolean isLinkedAccountsEnabled(UserModel user) {
+        if (user == null) {
+            return false;
+        }
+
+        IdentityProviderStorageProvider identityProviders = session.identityProviders();
+        Stream<IdentityProviderModel> realmBrokers = identityProviders.getAllStream(Map.of(
+                IdentityProviderModel.ENABLED, "true",
+                IdentityProviderModel.ORGANIZATION_ID, ""), 0, 1);
+        Stream<IdentityProviderModel> linkedBrokers = session.users().getFederatedIdentitiesStream(realm, user)
+                .map(FederatedIdentityModel::getIdentityProvider)
+                .map(identityProviders::getByAlias);
+
+        return Stream.concat(realmBrokers, linkedBrokers).findAny().isPresent();
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/resources/account/AccountCredentialResource.java b/services/src/main/java/org/keycloak/services/resources/account/AccountCredentialResource.java
index 3e96a8b455c2..f97ef2e5c30c 100644
--- a/services/src/main/java/org/keycloak/services/resources/account/AccountCredentialResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/AccountCredentialResource.java
@@ -22,6 +22,7 @@
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.SubjectCredentialManager;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.utils.ModelToRepresentation;
@@ -179,8 +180,9 @@ public Stream<CredentialContainer> credentialTypes(@QueryParam(TYPE) String type
 
         Set<String> enabledCredentialTypes = getEnabledCredentialTypes();
 
-        Stream<CredentialModel> modelsStream = includeUserCredentials ? user.credentialManager().getStoredCredentialsStream() : Stream.empty();
-        List<CredentialModel> models = modelsStream.collect(Collectors.toList());
+        SubjectCredentialManager credentialManager = user.credentialManager();
+        Stream<CredentialModel> modelsStream = includeUserCredentials ? credentialManager.getCredentials() : Stream.empty();
+        List<CredentialModel> models = modelsStream.toList();
 
         Function<CredentialProvider, CredentialContainer> toCredentialContainer = (credentialProvider) -> {
             CredentialTypeMetadataContext ctx = CredentialTypeMetadataContext.builder()
@@ -192,8 +194,8 @@ public Stream<CredentialContainer> credentialTypes(@QueryParam(TYPE) String type
 
             if (includeUserCredentials) {
                 List<CredentialModel> modelsOfType = models.stream()
-                        .filter(credentialModel -> credentialProvider.getType().equals(credentialModel.getType()))
-                        .collect(Collectors.toList());
+                        .filter(credentialProvider::supportsCredentialType)
+                        .toList();
 
 
                 List<CredentialMetadata> credentialMetadataList = modelsOfType.stream()
@@ -228,7 +230,7 @@ public Stream<CredentialContainer> credentialTypes(@QueryParam(TYPE) String type
         };
 
         return AuthenticatorUtil.getCredentialProviders(session)
-                .filter(p -> type == null || Objects.equals(p.getType(), type))
+                .filter(p -> type == null || p.supportsCredentialType(type))
                 .filter(p -> enabledCredentialTypes.contains(p.getType()))
                 .map(toCredentialContainer)
                 .filter(Objects::nonNull)
@@ -246,7 +248,7 @@ private Set<String> getEnabledCredentialTypes() {
                                 .map(exe -> (AuthenticatorFactory) session.getKeycloakSessionFactory()
                                         .getProviderFactory(Authenticator.class, exe.getAuthenticator()))
                                 .filter(Objects::nonNull)
-                                .map(AuthenticatorFactory::getReferenceCategory)
+                                .flatMap(authFact -> Stream.concat(Stream.of(authFact.getReferenceCategory()), authFact.getOptionalReferenceCategories().stream()))
                                 .filter(Objects::nonNull)
                 ).collect(Collectors.toSet());
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java b/services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java
index 07bb76552cd9..4e09c10b8ffa 100644
--- a/services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java
@@ -16,9 +16,6 @@
  */
 package org.keycloak.services.resources.account;
 
-import jakarta.ws.rs.OPTIONS;
-import jakarta.ws.rs.core.Response;
-import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.http.HttpResponse;
@@ -37,7 +34,6 @@
 import org.keycloak.services.managers.Auth;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.resource.AccountResourceProvider;
-import org.keycloak.services.util.UserSessionUtil;
 import org.keycloak.theme.Theme;
 
 import jakarta.ws.rs.HttpMethod;
@@ -99,16 +95,6 @@ public Object getAccountService() {
         }
     }
 
-    // Remove once Quarkus is upgraded to 3.15.3, or reconsidered to use this approach
-    // See https://github.com/keycloak/keycloak/issues/36009
-    @OPTIONS
-    @Path("{any:.*}")
-    @Operation(hidden = true)
-    public Response preFlight() {
-        return new CorsPreflightService().preflight();
-    }
-    // remove until here
-
     @Path("{version : v\\d[0-9a-zA-Z_\\-]*}")
     @Produces(MediaType.APPLICATION_JSON)
     public Object getVersionedAccountRestService(final @PathParam("version") String version) {
@@ -135,8 +121,6 @@ private AccountRestService getAccountRestService(ClientModel client, String vers
 
         AccessToken accessToken = authResult.getToken();
 
-        UserSessionUtil.checkTokenIssuedAt(client.getRealm(), accessToken, authResult.getSession(), event, authResult.getClient());
-
         if (accessToken.getAudience() == null || accessToken.getResourceAccess(client.getClientId()) == null) {
             // transform for introspection to get the required claims
             AccessTokenIntrospectionProvider provider = (AccessTokenIntrospectionProvider) session.getProvider(TokenIntrospectionProvider.class,
diff --git a/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java b/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
index 451d9c430e3c..998b57290583 100755
--- a/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/AccountRestService.java
@@ -227,6 +227,7 @@ public ResourcesService resources() {
 
     @Path("supportedLocales")
     @GET
+    @Produces(MediaType.APPLICATION_JSON)
     public List<String> supportedLocales() {
         return auth.getRealm().getSupportedLocalesStream().collect(Collectors.toList());
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java b/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
index d21610282ddf..855c7a907694 100644
--- a/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/account/LinkedAccountsResource.java
@@ -17,10 +17,9 @@
 package org.keycloak.services.resources.account;
 
 import java.io.IOException;
-import java.net.URI;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
+import java.text.MessageFormat;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -65,6 +64,7 @@
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.validation.Validation;
 import org.keycloak.theme.Theme;
+import org.keycloak.utils.BrokerUtil;
 import org.keycloak.utils.StreamsUtil;
 
 import static org.keycloak.models.Constants.ACCOUNT_CONSOLE_CLIENT_ID;
@@ -229,6 +229,12 @@ private FederatedIdentityModel getIdentity(Stream<FederatedIdentityModel> identi
                 .findFirst().orElse(null);
     }
 
+    /**
+     * Creating URL, which can be used to redirect to link identity provider with currently authenticated user
+     *
+     * @deprecated It is recommended to trigger linking identity provider account with the use of "idp_link" kc_action.
+     * @return response
+     */
     @GET
     @Path("/{providerAlias}")
     @Produces(MediaType.APPLICATION_JSON)
@@ -236,7 +242,10 @@ private FederatedIdentityModel getIdentity(Stream<FederatedIdentityModel> identi
     public Response buildLinkedAccountURI(@PathParam("providerAlias") String providerAlias,
                                      @QueryParam("redirectUri") String redirectUri) {
         auth.require(AccountRoles.MANAGE_ACCOUNT);
-
+        logger.warnf("Using deprecated endpoint of Account REST service for linking user '%s' in the realm '%s' to identity provider '%s'. It is recommended to use application initiated actions (AIA) for linking identity provider with the user.",
+                user.getUsername(),
+                realm.getName(),
+                providerAlias);
         if (redirectUri == null) {
             ErrorResponse.error(Messages.INVALID_REDIRECT_URI, Response.Status.BAD_REQUEST);
         }
@@ -250,25 +259,7 @@ public Response buildLinkedAccountURI(@PathParam("providerAlias") String provide
         }
 
         try {
-            String nonce = UUID.randomUUID().toString();
-            MessageDigest md = MessageDigest.getInstance("SHA-256");
-            String input = nonce + auth.getSession().getId() +  ACCOUNT_CONSOLE_CLIENT_ID + providerAlias;
-            byte[] check = md.digest(input.getBytes(StandardCharsets.UTF_8));
-            String hash = Base64Url.encode(check);
-            URI linkUri = Urls.identityProviderLinkRequest(this.session.getContext().getUri().getBaseUri(), providerAlias, realm.getName());
-            linkUri = UriBuilder.fromUri(linkUri)
-                    .queryParam("nonce", nonce)
-                    .queryParam("hash", hash)
-                    // need to use "account-console" client because IdentityBrokerService authenticates user using cookies
-                    // the regular "account" client is used only for REST calls therefore cookies authentication cannot be used
-                    .queryParam("client_id", ACCOUNT_CONSOLE_CLIENT_ID)
-                    .queryParam("redirect_uri", redirectUri)
-                    .build();
-
-            AccountLinkUriRepresentation rep = new AccountLinkUriRepresentation();
-            rep.setAccountLinkUri(linkUri);
-            rep.setHash(hash);
-            rep.setNonce(nonce);
+            AccountLinkUriRepresentation rep = BrokerUtil.createClientInitiatedLinkURI(ACCOUNT_CONSOLE_CLIENT_ID, redirectUri, providerAlias, realm.getName(), auth.getSession().getId(), this.session.getContext().getUri().getBaseUri());
 
             return Cors.builder().auth().allowedOrigins(auth.getToken()).add(Response.ok(rep));
         } catch (Exception spe) {
@@ -302,7 +293,7 @@ public Response removeLinkedAccount(@PathParam("providerAlias") String providerA
         }
 
         // Removing last social provider is not possible if you don't have other possibility to authenticate
-        if (!(session.users().getFederatedIdentitiesStream(realm, user).count() > 1 || user.getFederationLink() != null || isPasswordSet())) {
+        if (!(session.users().getFederatedIdentitiesStream(realm, user).count() > 1 || user.isFederated() || isPasswordSet())) {
             throw ErrorResponse.error(translateErrorMessage(Messages.FEDERATED_IDENTITY_REMOVING_LAST_PROVIDER), Response.Status.BAD_REQUEST);
         }
 
@@ -337,9 +328,11 @@ private String checkCommonPreconditions(String providerAlias) {
         return null;
     }
 
-    private String translateErrorMessage(String errorCode) {
+    private String translateErrorMessage(String errorCode, Object... params) {
         try {
-            return session.theme().getTheme(Theme.Type.ACCOUNT).getMessages(session.getContext().resolveLocale(user)).getProperty(errorCode);
+            Locale locale = session.getContext().resolveLocale(user);
+            String pattern = session.theme().getTheme(Theme.Type.ACCOUNT).getMessages(locale).getProperty(errorCode);
+            return new MessageFormat(pattern, locale).format(params, new StringBuffer(), null).toString();
         } catch (IOException e) {
             return errorCode;
         }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/AdminConsole.java b/services/src/main/java/org/keycloak/services/resources/admin/AdminConsole.java
index 615e83f08b1b..c0d943a623b7 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/AdminConsole.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/AdminConsole.java
@@ -67,7 +67,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import static org.keycloak.models.Constants.IS_TEMP_ADMIN_ATTR_NAME;
+import static org.keycloak.models.UserModel.IS_TEMP_ADMIN_ATTR_NAME;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/AdminEventBuilder.java b/services/src/main/java/org/keycloak/services/resources/admin/AdminEventBuilder.java
index 35b1d2c280a8..04cc44258045 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/AdminEventBuilder.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/AdminEventBuilder.java
@@ -57,7 +57,7 @@ public class AdminEventBuilder {
     private EventStoreProvider store;
 
     public AdminEventBuilder(RealmModel realm, AdminAuth auth, KeycloakSession session, ClientConnection clientConnection) {
-        this(realm, auth, session, clientConnection.getRemoteAddr(), null);
+        this(realm, auth, session, clientConnection.getRemoteHost(), null);
     }
 
     private AdminEventBuilder(RealmModel realm, AdminAuth auth, KeycloakSession session, String ipAddress, AdminEvent adminEvent) {
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/AdminRoot.java b/services/src/main/java/org/keycloak/services/resources/admin/AdminRoot.java
index 26b24b265cd8..4921b0fe2a23 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/AdminRoot.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/AdminRoot.java
@@ -19,7 +19,6 @@
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.jboss.logging.Logger;
 import org.keycloak.http.HttpRequest;
-import org.keycloak.http.HttpResponse;
 import jakarta.ws.rs.NotFoundException;
 import jakarta.ws.rs.NotAuthorizedException;
 import org.keycloak.common.Profile;
@@ -27,6 +26,7 @@
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakUriInfo;
 import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.oidc.TokenManager;
 import org.keycloak.representations.AccessToken;
@@ -34,8 +34,9 @@
 import org.keycloak.services.managers.AppAuthManager;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.RealmManager;
+import org.keycloak.services.resources.WelcomeResource;
 import org.keycloak.services.resources.admin.info.ServerInfoAdminResource;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.theme.Theme;
 import org.keycloak.urls.UrlType;
 
@@ -93,15 +94,31 @@ public static UriBuilder adminBaseUrl(UriBuilder base) {
     @GET
     @Operation(hidden = true)
     public Response masterRealmAdminConsoleRedirect() {
+        KeycloakUriInfo adminUriInfo = session.getContext().getUri(UrlType.ADMIN);
+        if (shouldRedirect(adminUriInfo)) {
+            RealmModel master = new RealmManager(session).getKeycloakAdminstrationRealm();
+            return Response.status(302).location(
+                    adminUriInfo.getBaseUriBuilder().path(AdminRoot.class).path(AdminRoot.class, "getAdminConsole").path("/").build(master.getName())
+            ).build();
+        }
+        return Response.status(Response.Status.NOT_FOUND).build();
+    }
 
+    boolean shouldRedirect(KeycloakUriInfo adminUriInfo) {
         if (!isAdminConsoleEnabled()) {
-            return Response.status(Response.Status.NOT_FOUND).build();
+            return false;
+        }
+        KeycloakUriInfo frontEndUriInfo = session.getContext().getUri();
+        String frontEndUrl = frontEndUriInfo.getBaseUri().toString();
+        String adminUrl = adminUriInfo.getBaseUri().toString();
+
+        if (adminUrl.equals(frontEndUrl)) {
+            return true; // admin is the same as front-end, we're not leaking information
         }
+        String requestUrl = frontEndUriInfo.getRequestUri().toString();
 
-        RealmModel master = new RealmManager(session).getKeycloakAdminstrationRealm();
-        return Response.status(302).location(
-                session.getContext().getUri(UrlType.ADMIN).getBaseUriBuilder().path(AdminRoot.class).path(AdminRoot.class, "getAdminConsole").path("/").build(master.getName())
-        ).build();
+        // if we're using the admin url or are local, it's also safe to redirect
+        return requestUrl.startsWith(adminUrl) || WelcomeResource.isLocal(session);
     }
 
     /**
@@ -190,6 +207,8 @@ protected AdminAuth authenticateRealmAdminRequest(HttpHeaders headers) {
             throw new NotAuthorizedException("Bearer");
         }
 
+        session.getContext().setBearerToken(authResult.getToken());
+
         return new AdminAuth(realm, authResult.getToken(), authResult.getUser(), authResult.getClient());
     }
 
@@ -275,10 +294,6 @@ public Object getServerInfo() {
         return new ServerInfoAdminResource(session);
     }
 
-    private HttpResponse getHttpResponse() {
-        return session.getContext().getHttpResponse();
-    }
-
     private HttpRequest getHttpRequest() {
         return session.getContext().getHttpRequest();
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/AttackDetectionResource.java b/services/src/main/java/org/keycloak/services/resources/admin/AttackDetectionResource.java
index aeb735e76dd2..59d494e4fbea 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/AttackDetectionResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/AttackDetectionResource.java
@@ -31,7 +31,7 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.services.managers.BruteForceProtector;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.GET;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java b/services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java
index 9415592c8536..a7256913365f 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java
@@ -64,7 +64,7 @@
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.userprofile.ValidationException;
 import org.keycloak.utils.CredentialHelper;
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java
index 9adb4dea7951..e86c235aa789 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientAttributeCertificateResource.java
@@ -17,10 +17,13 @@
 
 package org.keycloak.services.resources.admin;
 
+import com.google.common.base.Strings;
+import jakarta.ws.rs.QueryParam;
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
+import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
 import jakarta.ws.rs.NotAcceptableException;
 import jakarta.ws.rs.NotFoundException;
@@ -42,7 +45,7 @@
 import org.keycloak.representations.idm.CertificateRepresentation;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.util.CertificateInfoHelper;
 
 import jakarta.ws.rs.BadRequestException;
@@ -59,8 +62,10 @@
 import java.nio.charset.StandardCharsets;
 import java.security.KeyStore;
 import java.security.PrivateKey;
+import java.security.UnrecoverableKeyException;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
+import java.util.Calendar;
 import java.util.Set;
 import java.util.stream.Collectors;
 
@@ -76,6 +81,8 @@ public class ClientAttributeCertificateResource {
     public static final String PUBLIC_KEY_PEM = "Public Key PEM";
     public static final String JSON_WEB_KEY_SET = "JSON Web Key Set";
 
+    private static final Logger logger = Logger.getLogger(ClientAttributeCertificateResource.class);
+
     protected final RealmModel realm;
     private final AdminPermissionEvaluator auth;
     protected final ClientModel client;
@@ -145,8 +152,6 @@ public CertificateRepresentation generate() {
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_ATTRIBUTE_CERTIFICATE)
     @Operation( summary = "Upload certificate and eventually private key")
     public CertificateRepresentation uploadJks() throws IOException {
-        auth.clients().requireConfigure(client);
-
         try {
             CertificateRepresentation info = updateCertFromRequest();
             adminEvent.operation(OperationType.ACTION).resourcePath(session.getContext().getUri()).representation(info).success();
@@ -169,8 +174,6 @@ public CertificateRepresentation uploadJks() throws IOException {
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_ATTRIBUTE_CERTIFICATE)
     @Operation( summary = "Upload only certificate, not private key")
     public CertificateRepresentation uploadJksCertificate() throws IOException {
-        auth.clients().requireConfigure(client);
-
         try {
             CertificateRepresentation info = updateCertFromRequest();
             adminEvent.operation(OperationType.ACTION).resourcePath(session.getContext().getUri()).representation(info).success();
@@ -190,6 +193,18 @@ private CertificateRepresentation updateCertFromRequest() throws IOException {
         }
         String keystoreFormat = keystoreFormatPart.asString();
         FormPartValue inputParts = uploadForm.getFirst("file");
+
+        boolean fileEmpty = false;
+        try {
+            fileEmpty = inputParts == null || Strings.isNullOrEmpty(inputParts.asString());
+        } catch (Exception e) {
+            // ignore
+        }
+
+        if (fileEmpty) {
+            throw new BadRequestException("file cannot be empty");
+        }
+
         if (keystoreFormat.equals(CERTIFICATE_PEM)) {
             String pem = StreamUtil.readString(inputParts.asInputStream(), StandardCharsets.UTF_8);
             pem = PemUtils.removeBeginEnd(pem);
@@ -232,13 +247,18 @@ private CertificateRepresentation updateCertFromRequest() throws IOException {
             KeyStore keyStore = CryptoIntegration.getProvider().getKeyStore(KeystoreFormat.valueOf(keystoreFormat));
             keyStore.load(inputParts.asInputStream(), storePassword);
             try {
-                privateKey = (PrivateKey)keyStore.getKey(keyAlias, keyPassword);
+                privateKey = (PrivateKey) keyStore.getKey(keyAlias, keyPassword);
             } catch (Exception e) {
                 // ignore
             }
-            certificate = (X509Certificate)keyStore.getCertificate(keyAlias);
+            certificate = (X509Certificate) keyStore.getCertificate(keyAlias);
         } catch (Exception e) {
-            throw new RuntimeException(e);
+            logger.error("Error loading keystore", e);
+            if (e.getCause() instanceof UnrecoverableKeyException keyException) {
+                throw new BadRequestException(keyException.getMessage());
+            } else {
+                throw new BadRequestException("error loading keystore");
+            }
         }
 
         if (privateKey != null) {
@@ -322,7 +342,15 @@ public byte[] generateAndGetKeystore(@Parameter(description = "Keystore configur
             throw new ErrorResponseException("password-missing", "Need to specify a store password for jks generation and download", Response.Status.BAD_REQUEST);
         }
 
-        CertificateRepresentation info = KeycloakModelUtils.generateKeyPairCertificate(client.getClientId());
+        CertificateRepresentation info;
+        if (config.getKeySize() <= 0 || config.getValidity() <= 0) {
+            info = KeycloakModelUtils.generateKeyPairCertificate(client.getClientId());
+        }
+        else {
+            Calendar calendar = Calendar.getInstance();
+            calendar.add(Calendar.YEAR, config.getValidity());
+            info = KeycloakModelUtils.generateKeyPairCertificate(client.getClientId(), config.getKeySize(), calendar);
+        }
         byte[] rtn = getKeystore(config, info.getPrivateKey(), info.getCertificate());
 
         info.setPrivateKey(null);
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
index 7a267e31f1e3..80e624511613 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
@@ -34,7 +34,7 @@
 import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
 import org.keycloak.services.clientregistration.ClientRegistrationTokenUtils;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientPoliciesResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientPoliciesResource.java
index 2d14666ac909..265ca5ba0764 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientPoliciesResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientPoliciesResource.java
@@ -38,7 +38,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "")
 public class ClientPoliciesResource {
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientProfilesResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientProfilesResource.java
index 58f2ccb4dfc7..9c39787e17c7 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientProfilesResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientProfilesResource.java
@@ -39,7 +39,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "")
 public class ClientProfilesResource {
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
index fc1f15ee5c3b..6a097a4bc994 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientRegistrationPolicyResource.java
@@ -31,7 +31,7 @@
 import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy;
 import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
index 97ef31244363..44e1e182ac17 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
@@ -24,6 +24,7 @@
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.OAuthErrorException;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.admin.AuthorizationService;
 import org.keycloak.client.clienttype.ClientTypeException;
 import org.keycloak.common.ClientConnection;
@@ -70,9 +71,9 @@
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.managers.ResourceAdminManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.utils.ProfileHelper;
 import org.keycloak.utils.ReservedCharValidator;
 import org.keycloak.validation.ValidationUtil;
@@ -241,6 +242,8 @@ public void deleteClient() {
             throw new NotFoundException("Could not find client");
         }
 
+        AdminPermissionsSchema.SCHEMA.throwExceptionIfAdminPermissionClient(session, client.getId());
+
         try {
             session.clientPolicy().triggerOnEvent(new AdminClientUnregisterContext(client, auth.adminAuth()));
         } catch (ClientPolicyException cpe) {
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java
index 5e4b24d2b58a..0c09a67102c0 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java
@@ -26,7 +26,7 @@
 
 import jakarta.ws.rs.NotFoundException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.models.ClientModel;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateResource.java
index 13166e82dd99..52768129ba34 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateResource.java
@@ -19,14 +19,22 @@
 
 import static org.keycloak.protocol.ProtocolMapperUtils.isEnabled;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.function.BiFunction;
+import java.util.Set;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.NotFoundException;
 import jakarta.ws.rs.Path;
@@ -40,10 +48,14 @@
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authentication.actiontoken.TokenUtils;
 import org.keycloak.common.ClientConnection;
+import org.keycloak.common.util.CollectionUtil;
+import org.keycloak.common.util.TriFunction;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
@@ -59,7 +71,7 @@
 import org.keycloak.services.managers.AuthenticationSessionManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.sessions.RootAuthenticationSessionModel;
 
@@ -89,7 +101,6 @@ public ClientScopeEvaluateResource(KeycloakSession session, UriInfo uriInfo, Rea
         this.clientConnection = clientConnection;
     }
 
-
     /**
      *
      * @param scopeParam
@@ -112,7 +123,6 @@ public ClientScopeEvaluateScopeMappingsResource scopeMappings(@QueryParam("scope
         return new ClientScopeEvaluateScopeMappingsResource(session, roleContainer, auth, client, scopeParam);
     }
 
-
     /**
      * Return list of all protocol mappers, which will be used when generating tokens issued for particular client. This means
      * protocol mappers assigned to this client directly and protocol mappers assigned to all client scopes of this client.
@@ -124,8 +134,12 @@ public ClientScopeEvaluateScopeMappingsResource scopeMappings(@QueryParam("scope
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Return list of all protocol mappers, which will be used when generating tokens issued for particular client.",
+    @Operation(summary = "Return list of all protocol mappers, which will be used when generating tokens issued for particular client.",
             description = "This means protocol mappers assigned to this client directly and protocol mappers assigned to all client scopes of this client.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ProtocolMapperEvaluationRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<ProtocolMapperEvaluationRepresentation> getGrantedProtocolMappers(@QueryParam("scope") String scopeParam) {
         auth.clients().requireView(client);
 
@@ -135,7 +149,6 @@ public Stream<ProtocolMapperEvaluationRepresentation> getGrantedProtocolMappers(
                     .map(current -> toProtocolMapperEvaluationRepresentation(current, mapperContainer)));
     }
 
-
     private ProtocolMapperEvaluationRepresentation toProtocolMapperEvaluationRepresentation(ProtocolMapperModel mapper,
                                                                                             ClientScopeModel mapperContainer) {
         ProtocolMapperEvaluationRepresentation rep = new ProtocolMapperEvaluationRepresentation();
@@ -167,7 +180,11 @@ private ProtocolMapperEvaluationRepresentation toProtocolMapperEvaluationReprese
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Create JSON with payload of example user info")
+    @Operation(summary = "Create JSON with payload of example user info")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = Map.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
         auth.clients().requireView(client);
 
@@ -175,7 +192,7 @@ public Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String s
 
         logger.debugf("generateExampleUserinfo invoked. User: %s", user.getUsername());
 
-        return sessionAware(user, scopeParam, (userSession, clientSessionCtx) -> {
+        return sessionAware(user, scopeParam, "", (userSession, clientSessionCtx, audienceClients) -> {
             AccessToken userInfo = new AccessToken();
             TokenManager tokenManager = new TokenManager();
 
@@ -194,19 +211,31 @@ public Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String s
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Create JSON with payload of example id token")
-    public IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
+    @Operation(summary = "Create JSON with payload of example id token")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = IDToken.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
+    public IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience) {
         auth.clients().requireView(client);
 
         UserModel user = getUserModel(userId);
 
-        logger.debugf("generateExampleIdToken invoked. User: %s, Scope param: %s", user.getUsername(), scopeParam);
+        logger.debugf("generateExampleIdToken invoked. User: %s, Scope param: %s, Target Audience: %s", user.getUsername(), scopeParam);
 
-        return sessionAware(user, scopeParam, (userSession, clientSessionCtx) ->
+        return sessionAware(user, scopeParam, audience, (userSession, clientSessionCtx, audienceClients) ->
         {
             TokenManager tokenManager = new TokenManager();
-            return tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx)
-                    .generateAccessToken().generateIDToken().getIdToken();
+            TokenManager.AccessTokenResponseBuilder response = tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx)
+                    .generateAccessToken().generateIDToken();
+            IDToken idToken = response.getIdToken();
+
+            // Retrieve accessToken just to check the audience
+            AccessToken accessToken = response.getAccessToken();
+            validateAudience(accessToken, audienceClients);
+
+            return idToken;
         });
     }
 
@@ -220,24 +249,32 @@ public IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @Q
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Create JSON with payload of example access token")
-    public AccessToken generateExampleAccessToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId) {
+    @Operation(summary = "Create JSON with payload of example access token")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = AccessToken.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
+    public AccessToken generateExampleAccessToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience) {
         auth.clients().requireView(client);
 
         UserModel user = getUserModel(userId);
 
-        logger.debugf("generateExampleAccessToken invoked. User: %s, Scope param: %s", user.getUsername(), scopeParam);
+        logger.debugf("generateExampleAccessToken invoked. User: %s, Scope param: %s, Target Audience: %s", user.getUsername(), scopeParam, audience);
 
-        return sessionAware(user, scopeParam, (userSession, clientSessionCtx) ->
+        return sessionAware(user, scopeParam, audience, (userSession, clientSessionCtx, audienceClients) ->
         {
             TokenManager tokenManager = new TokenManager();
-            return tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx)
+            AccessToken accessToken =  tokenManager.responseBuilder(realm, client, null, session, userSession, clientSessionCtx)
                     .generateAccessToken().getAccessToken();
+            validateAudience(accessToken, audienceClients);
+            return accessToken;
         });
     }
 
-    private<R> R sessionAware(UserModel user, String scopeParam, BiFunction<UserSessionModel, ClientSessionContext,R> function) {
+    private<R> R sessionAware(UserModel user, String scopeParam, String audienceParam, TriFunction<UserSessionModel, ClientSessionContext, ClientModel[], R> function) {
         AuthenticationSessionModel authSession = null;
+        UserSessionModel userSession = null;
         AuthenticationSessionManager authSessionManager = new AuthenticationSessionManager(session);
 
         try {
@@ -249,18 +286,50 @@ private<R> R sessionAware(UserModel user, String scopeParam, BiFunction<UserSess
             authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(uriInfo.getBaseUri(), realm.getName()));
             authSession.setClientNote(OIDCLoginProtocol.SCOPE_PARAM, scopeParam);
 
-            UserSessionModel userSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, user, user.getUsername(),
-                    clientConnection.getRemoteAddr(), "example-auth", false, null, null, UserSessionModel.SessionPersistenceState.TRANSIENT);
+            userSession = new UserSessionManager(session).createUserSession(authSession.getParentSession().getId(), realm, user, user.getUsername(),
+                    clientConnection.getRemoteHost(), "example-auth", false, null, null, UserSessionModel.SessionPersistenceState.PERSISTENT);
 
             AuthenticationManager.setClientScopesInSession(session, authSession);
             ClientSessionContext clientSessionCtx = TokenManager.attachAuthenticationSession(session, userSession, authSession);
 
-            return function.apply(userSession, clientSessionCtx);
+            ClientModel[] audienceClients = getClients(audienceParam);
+            if (audienceClients.length > 0) {
+                clientSessionCtx.setAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, audienceClients);
+            }
+
+            return function.apply(userSession, clientSessionCtx, audienceClients);
 
         } finally {
             if (authSession != null) {
                 authSessionManager.removeAuthenticationSession(realm, authSession, false);
             }
+            if (userSession != null) {
+                session.sessions().removeUserSession(realm, userSession);
+            }
+        }
+    }
+
+    private ClientModel[] getClients(String clientsStr) {
+        List<ClientModel> clients = new ArrayList<>();
+        if(clientsStr != null && !clientsStr.isEmpty()) {
+            for (String clientId : clientsStr.split("\\s+")) {
+                ClientModel client = realm.getClientByClientId(clientId);
+                if (client != null) {
+                    clients.add(client);
+                }
+            }
+        }
+        return clients.toArray(ClientModel[]::new);
+    }
+    
+    private void validateAudience(AccessToken accessToken, ClientModel[] requestedAudience) {
+        List<String> requestedAudienceClientIds = Stream.of(requestedAudience)
+                .map(ClientModel::getClientId)
+                .collect(Collectors.toList());
+        Set<String> missingAudience = TokenUtils.checkRequestedAudiences(accessToken, requestedAudienceClientIds);
+        if (!missingAudience.isEmpty()) {
+            String missingAudienceStr = CollectionUtil.join(missingAudience);
+            throw new NotFoundException("Requested audience not available: " + missingAudienceStr);
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateScopeMappingsResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateScopeMappingsResource.java
index 1f4094301c6f..4a53366ac0cb 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateScopeMappingsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeEvaluateScopeMappingsResource.java
@@ -28,7 +28,12 @@
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.models.ClientModel;
@@ -40,7 +45,7 @@
 import org.keycloak.protocol.oidc.TokenManager;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -63,7 +68,6 @@ public ClientScopeEvaluateScopeMappingsResource(KeycloakSession session, RoleCon
         this.scopeParam = scopeParam;
     }
 
-
     /**
      * Get effective scope mapping of all roles of particular role container, which this client is defacto allowed to have in the accessToken issued for him.
      *
@@ -77,13 +81,16 @@ public ClientScopeEvaluateScopeMappingsResource(KeycloakSession session, RoleCon
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Get effective scope mapping of all roles of particular role container, which this client is defacto allowed to have in the accessToken issued for him.",
+    @Operation(summary = "Get effective scope mapping of all roles of particular role container, which this client is defacto allowed to have in the accessToken issued for him.",
             description = "This contains scope mappings, which this client has directly, as well as scope mappings, which are granted to all client scopes, which are linked with this client.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getGrantedScopeMappings() {
         return getGrantedRoles(session).map(ModelToRepresentation::toBriefRepresentation);
     }
 
-
     /**
      * Get roles, which this client doesn't have scope for and can't have them in the accessToken issued for him. Defacto all the
      * other roles of particular role container, which are not in {@link #getGrantedScopeMappings()}
@@ -95,7 +102,11 @@ public Stream<RoleRepresentation> getGrantedScopeMappings() {
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENTS)
-    @Operation( summary = "Get roles, which this client doesn't have scope for and can't have them in the accessToken issued for him.", description = "Defacto all the other roles of particular role container, which are not in {@link #getGrantedScopeMappings()}")
+    @Operation(summary = "Get roles, which this client doesn't have scope for and can't have them in the accessToken issued for him.", description = "Defacto all the other roles of particular role container, which are not in {@link #getGrantedScopeMappings()}")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getNotGrantedScopeMappings() {
         Set<RoleModel> grantedRoles = getGrantedRoles(session).collect(Collectors.toSet());
 
@@ -104,9 +115,6 @@ public Stream<RoleRepresentation> getNotGrantedScopeMappings() {
                 .map(ModelToRepresentation::toBriefRepresentation);
     }
 
-
-
-
     private Stream<RoleModel> getGrantedRoles(KeycloakSession session) {
         if (client.isFullScopeAllowed()) {
             return roleContainer.getRolesStream();
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeResource.java
index 9874783c23b5..2312eda04ccc 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopeResource.java
@@ -18,6 +18,10 @@
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -26,18 +30,22 @@
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.ModelIllegalStateException;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
+import org.keycloak.protocol.LoginProtocol;
+import org.keycloak.protocol.LoginProtocolFactory;
+import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.saml.common.util.StringUtil;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
@@ -50,7 +58,9 @@
 
 import java.util.Arrays;
 import java.util.Optional;
+import java.util.Set;
 import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 
 /**
@@ -77,7 +87,6 @@ public ClientScopeResource(RealmModel realm, AdminPermissionEvaluator auth, Clie
         this.clientScope = clientScope;
         this.session = session;
         this.adminEvent = adminEvent.resource(ResourceType.CLIENT_SCOPE);
-
     }
 
     @Path("protocol-mappers")
@@ -108,10 +117,20 @@ public ScopeMappedResource getScopeMappedResource() {
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_SCOPES)
     @Operation(summary = "Update the client scope")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response update(final ClientScopeRepresentation rep) {
         auth.clients().requireManageClientScopes();
         validateDynamicScopeUpdate(rep);
         try {
+            LoginProtocolFactory loginProtocolFactory = //
+                    (LoginProtocolFactory) session.getKeycloakSessionFactory().getProviderFactory(LoginProtocol.class,
+                                                                                                  clientScope.getProtocol());
+            Optional.ofNullable(loginProtocolFactory).ifPresent(lp -> lp.addClientScopeDefaults(rep));
             RepresentationToModel.updateClientScope(rep, clientScope);
             adminEvent.operation(OperationType.UPDATE).resourcePath(session.getContext().getUri()).representation(rep).success();
 
@@ -124,7 +143,6 @@ public Response update(final ClientScopeRepresentation rep) {
         }
     }
 
-
     /**
      * Get representation of the client scope
      *
@@ -135,10 +153,13 @@ public Response update(final ClientScopeRepresentation rep) {
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_SCOPES)
     @Operation(summary = "Get representation of the client scope")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ClientScopeRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public ClientScopeRepresentation getClientScope() {
         auth.clients().requireView(clientScope);
 
-
         return ModelToRepresentation.toRepresentation(clientScope);
     }
 
@@ -149,8 +170,13 @@ public ClientScopeRepresentation getClientScope() {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_SCOPES)
     @Operation(summary = "Delete the client scope")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response deleteClientScope() {
-
         auth.clients().requireManage(clientScope);
         long clientScopesCount =  Arrays.stream(realm.getClientScopesStream().toArray()).count();
         if (clientScopesCount > 1) {
@@ -213,9 +239,21 @@ public static void validateClientScopeName(String name) throws ErrorResponseExce
         }
     }
 
-    public static void validateClientScopeProtocol(String protocol)throws ErrorResponseException{
-        if(protocol==null || (!protocol.equals("openid-connect") && !protocol.equals("saml"))) throw ErrorResponse.error("Unexpected protocol",Response.Status.BAD_REQUEST);
+    public static void validateClientScopeProtocol(KeycloakSession session, String protocol)
+            throws ErrorResponseException {
+        KeycloakSessionFactory sessionFactory = session.getKeycloakSessionFactory();
+        Set<String> acceptedProtocols = sessionFactory.getProviderFactoriesStream(LoginProtocol.class)
+                                                      .map(type -> (LoginProtocolFactory) type)
+                                                      .map(LoginProtocolFactory::getId)
+                                                      .collect(Collectors.toSet());
+        // the OID4VC protocol is not registered to prevent it from being displayed in the client-details ui
+        acceptedProtocols.add(OID4VCLoginProtocolFactory.PROTOCOL_ID);
+
+        if (protocol == null || !acceptedProtocols.contains(protocol)) {
+            throw ErrorResponse.error("Unexpected protocol", Response.Status.BAD_REQUEST);
+        }
     }
+
     /**
      * Makes sure that an update that makes a Client Scope Dynamic is rejected if the Client Scope is assigned to a client
      * as a default scope.
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopesResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopesResource.java
index ca98ce5d75a7..8f184ab006d2 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientScopesResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientScopesResource.java
@@ -17,7 +17,12 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -29,10 +34,12 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
+import org.keycloak.protocol.LoginProtocol;
+import org.keycloak.protocol.LoginProtocolFactory;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
@@ -43,6 +50,8 @@
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
+
+import java.util.Optional;
 import java.util.stream.Stream;
 
 /**
@@ -77,7 +86,11 @@ public ClientScopesResource(KeycloakSession session, AdminPermissionEvaluator au
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_SCOPES)
-    @Operation( summary = "Get client scopes belonging to the realm Returns a list of client scopes belonging to the realm")
+    @Operation(summary = "Get client scopes belonging to the realm Returns a list of client scopes belonging to the realm")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ClientScopeRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<ClientScopeRepresentation> getClientScopes() {
         auth.clients().requireListClientScopes();
 
@@ -98,18 +111,27 @@ public Stream<ClientScopeRepresentation> getClientScopes() {
     @Consumes(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.CLIENT_SCOPES)
-    @Operation( summary = "Create a new client scope Client Scope’s name must be unique!")
+    @Operation(summary = "Create a new client scope Client Scope’s name must be unique!")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response createClientScope(ClientScopeRepresentation rep) {
         auth.clients().requireManageClientScopes();
         ClientScopeResource.validateClientScopeName(rep.getName());
-        ClientScopeResource.validateClientScopeProtocol(rep.getProtocol());
+        ClientScopeResource.validateClientScopeProtocol(session, rep.getProtocol());
         ClientScopeResource.validateDynamicClientScope(rep);
         try {
-            ClientScopeModel clientModel = RepresentationToModel.createClientScope(session, realm, rep);
+            LoginProtocolFactory loginProtocolFactory = //
+                    (LoginProtocolFactory) session.getKeycloakSessionFactory().getProviderFactory(LoginProtocol.class,
+                                                                                                  rep.getProtocol());
+            Optional.ofNullable(loginProtocolFactory).ifPresent(lp -> lp.addClientScopeDefaults(rep));
+            ClientScopeModel clientScope = RepresentationToModel.createClientScope(realm, rep);
 
-            adminEvent.operation(OperationType.CREATE).resourcePath(session.getContext().getUri(), clientModel.getId()).representation(rep).success();
+            adminEvent.operation(OperationType.CREATE).resourcePath(session.getContext().getUri(), clientScope.getId()).representation(rep).success();
 
-            return Response.created(session.getContext().getUri().getAbsolutePathBuilder().path(clientModel.getId()).build()).build();
+            return Response.created(session.getContext().getUri().getAbsolutePathBuilder().path(clientScope.getId()).build()).build();
         } catch (ModelDuplicateException e) {
             throw ErrorResponse.exists("Client Scope " + rep.getName() + " already exists");
         }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientTypesResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientTypesResource.java
index 3b5b6fc92fec..474fb9c8127a 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientTypesResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientTypesResource.java
@@ -38,7 +38,7 @@
 import org.keycloak.client.clienttype.ClientTypeException;
 import org.keycloak.client.clienttype.ClientTypeManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientsResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientsResource.java
index 16197cd3d101..de4b22dc9dda 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientsResource.java
@@ -23,6 +23,7 @@
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.admin.AuthorizationService;
 import org.keycloak.client.clienttype.ClientTypeException;
 import org.keycloak.common.Profile;
@@ -34,7 +35,6 @@
 import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.ModelValidationException;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
@@ -46,7 +46,7 @@
 import org.keycloak.services.managers.ClientManager;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.utils.SearchQueryUtils;
 import org.keycloak.validation.ValidationUtil;
 
@@ -119,7 +119,7 @@ public Stream<ClientRepresentation> getClients(@Parameter(description = "filter
                                                  @Parameter(description = "the max results to return") @QueryParam("max") Integer maxResults) {
         auth.clients().requireList();
 
-        boolean canView = auth.clients().canView();
+        boolean canView = AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm) || auth.clients().canView();
         Stream<ClientModel> clientModels = Stream.empty();
 
         if (searchQuery != null) {
@@ -138,7 +138,11 @@ public Stream<ClientRepresentation> getClients(@Parameter(description = "filter
         } else {
             ClientModel client = realm.getClientByClientId(clientId);
             if (client != null) {
-                clientModels = Stream.of(client);
+                if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+                    clientModels = Stream.of(client).filter(auth.clients()::canView);
+                } else {
+                    clientModels = Stream.of(client);
+                }
             }
         }
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ComponentResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ComponentResource.java
index 2b5c3db6130f..f0a60e589a1f 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ComponentResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ComponentResource.java
@@ -42,7 +42,7 @@
 import org.keycloak.representations.idm.ConfigPropertyRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.Consumes;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java b/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
index 3f7f2e1debd6..79ba1589de30 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
@@ -21,6 +21,7 @@
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.Profile;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.events.admin.OperationType;
@@ -38,9 +39,9 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.utils.GroupUtils;
 import org.keycloak.utils.ProfileHelper;
 
@@ -172,13 +173,26 @@ public Stream<GroupRepresentation> getSubGroups(
             @Parameter(description = "Boolean which defines whether the params \"search\" must match exactly or not") @QueryParam("exact") Boolean exact,
             @Parameter(description = "The position of the first result to be returned (pagination offset).") @QueryParam("first") @DefaultValue("0") Integer first,
             @Parameter(description = "The maximum number of results that are to be returned. Defaults to 10") @QueryParam("max") @DefaultValue("10") Integer max,
-            @Parameter(description = "Boolean which defines whether brief groups representations are returned or not (default: false)") @QueryParam("briefRepresentation") @DefaultValue("false") Boolean briefRepresentation) {
+            @Parameter(description = "Boolean which defines whether brief groups representations are returned or not (default: false)") @QueryParam("briefRepresentation") @DefaultValue("false") Boolean briefRepresentation,
+            @Parameter(description = "Boolean which defines whether to return the count of subgroups for each subgroup of this group (default: true") @QueryParam("subGroupsCount") @DefaultValue("true") Boolean subGroupsCount) {
         this.auth.groups().requireView(group);
-        boolean canViewGlobal = auth.groups().canView();
-        return paginatedStream(
-            group.getSubGroupsStream(search, exact, -1, -1)
-            .filter(g -> canViewGlobal || auth.groups().canView(g)), first, max)
-            .map(g -> GroupUtils.populateSubGroupCount(g, GroupUtils.toRepresentation(auth.groups(), g, !briefRepresentation)));
+
+        Stream<GroupModel> stream = group.getSubGroupsStream(search, exact, -1, -1);
+
+        if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            stream = stream.filter(auth.groups()::canView);
+        }
+
+        return paginatedStream(stream, first, max)
+            .map(g -> {
+                GroupRepresentation rep = GroupUtils.toRepresentation(auth.groups(), g, !briefRepresentation);
+
+                if (subGroupsCount) {
+                    return GroupUtils.populateSubGroupCount(g, rep);
+                }
+
+                return rep;
+            });
     }
 
     /**
@@ -204,7 +218,7 @@ public Response addChild(GroupRepresentation rep) {
 
         try {
             Response.ResponseBuilder builder = Response.status(204);
-            GroupModel child = null;
+            GroupModel child;
             if (rep.getId() != null) {
                 child = realm.getGroupById(rep.getId());
                 if (child == null) {
@@ -264,6 +278,8 @@ public static void updateGroup(GroupRepresentation rep, GroupModel model, RealmM
                 model.removeAttribute(attr);
             }
         }
+
+        model.setDescription(rep.getDescription());
     }
 
     @Path("role-mappings")
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/GroupsResource.java b/services/src/main/java/org/keycloak/services/resources/admin/GroupsResource.java
index 82fa59a9115a..692b98a634d7 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/GroupsResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/GroupsResource.java
@@ -36,8 +36,12 @@
 import jakarta.ws.rs.core.Response.Status;
 import org.eclipse.microprofile.openapi.annotations.Operation;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
@@ -45,13 +49,12 @@
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.organization.utils.Organizations;
 import org.keycloak.representations.idm.GroupRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.GroupPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.GroupPermissionEvaluator;
 import org.keycloak.utils.GroupUtils;
 import org.keycloak.utils.SearchQueryUtils;
 
@@ -91,14 +94,15 @@ public Stream<GroupRepresentation> getGroups(@QueryParam("search") String search
                                                  @QueryParam("first") Integer firstResult,
                                                  @QueryParam("max") Integer maxResults,
                                                  @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation,
-                                                 @QueryParam("populateHierarchy") @DefaultValue("true") boolean populateHierarchy) {
+                                                 @QueryParam("populateHierarchy") @DefaultValue("true") boolean populateHierarchy,
+                                                 @Parameter(description = "Boolean which defines whether to return the count of subgroups for each group (default: true") @QueryParam("subGroupsCount") @DefaultValue("true") Boolean subGroupsCount) {
         GroupPermissionEvaluator groupsEvaluator = auth.groups();
         groupsEvaluator.requireList();
 
         Stream<GroupModel> stream;
         if (Objects.nonNull(searchQuery)) {
             Map<String, String> attributes = SearchQueryUtils.getFields(searchQuery);
-            stream = ModelToRepresentation.searchGroupModelsByAttributes(session, realm, attributes, firstResult, maxResults);
+            stream = session.groups().searchGroupsByAttributes(realm, attributes, firstResult, maxResults);
         } else if (Objects.nonNull(search)) {
             stream = session.groups().searchForGroupByNameStream(realm, search.trim(), exact, firstResult, maxResults);
         } else {
@@ -106,12 +110,22 @@ public Stream<GroupRepresentation> getGroups(@QueryParam("search") String search
         }
 
         if (populateHierarchy) {
-            return GroupUtils.populateGroupHierarchyFromSubGroups(session, realm, stream, !briefRepresentation, groupsEvaluator);
+            return GroupUtils.populateGroupHierarchyFromSubGroups(session, realm, stream, !briefRepresentation, groupsEvaluator, subGroupsCount);
         }
-        boolean canViewGlobal = groupsEvaluator.canView();
-        return stream
-            .filter(g -> canViewGlobal || groupsEvaluator.canView(g))
-            .map(g -> GroupUtils.populateSubGroupCount(g, GroupUtils.toRepresentation(groupsEvaluator, g, !briefRepresentation)));
+
+        if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            stream = stream.filter(groupsEvaluator::canView);
+        }
+
+        return stream.map(g -> {
+            GroupRepresentation rep = GroupUtils.toRepresentation(groupsEvaluator, g, !briefRepresentation);
+
+            if (subGroupsCount) {
+                return GroupUtils.populateSubGroupCount(g, rep);
+            }
+
+            return rep;
+        });
     }
 
     /**
@@ -170,6 +184,10 @@ public Map<String, Long> getGroupCount(@QueryParam("search") String search,
      */
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
+    @APIResponses(value = {
+            @APIResponse(responseCode = "201", description = "Created"),
+            @APIResponse(responseCode = "204", description = "No Content")
+    })
     @Tag(name = KeycloakOpenAPI.Admin.Tags.GROUPS)
     @Operation( summary = "create or add a top level realm groupSet or create child.",
         description = "This will update the group and set the parent if it exists. Create it and set the parent if the group doesn’t exist.")
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/IdentityProviderResource.java b/services/src/main/java/org/keycloak/services/resources/admin/IdentityProviderResource.java
index 51852202f6c5..ebeb64221fc2 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/IdentityProviderResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/IdentityProviderResource.java
@@ -50,9 +50,9 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.IdentityBrokerService;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.utils.ProfileHelper;
 
 import jakarta.ws.rs.Consumes;
@@ -444,6 +444,10 @@ public ManagementPermissionReference getManagementPermissions() {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         this.auth.realm().requireViewIdentityProviders();
 
+        if (identityProviderModel == null) {
+            throw new jakarta.ws.rs.NotFoundException();
+        }
+
         AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
         if (!permissions.idps().isPermissionsEnabled(identityProviderModel)) {
             return new ManagementPermissionReference();
@@ -477,6 +481,11 @@ public ManagementPermissionReference setManagementPermissionsEnabled(ManagementP
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         this.auth.realm().requireManageIdentityProviders();
         AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+
+        if (identityProviderModel == null) {
+            throw new jakarta.ws.rs.NotFoundException();
+        }
+
         permissions.idps().setPermissionsEnabled(identityProviderModel, ref.isEnabled());
         if (ref.isEnabled()) {
             return toMgmtRef(identityProviderModel, permissions);
@@ -493,6 +502,11 @@ public ManagementPermissionReference setManagementPermissionsEnabled(ManagementP
     @Operation(summary = "Reaload keys for the identity provider if the provider supports it, \"true\" is returned if reload was performed, \"false\" if not.")
     public boolean reloadKeys() {
         this.auth.realm().requireManageIdentityProviders();
+
+        if (identityProviderModel == null) {
+            throw new jakarta.ws.rs.NotFoundException();
+        }
+
         IdentityProvider<?> provider = IdentityBrokerService.getIdentityProvider(session, identityProviderModel.getAlias());
         return provider.reloadKeys();
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/IdentityProvidersResource.java b/services/src/main/java/org/keycloak/services/resources/admin/IdentityProvidersResource.java
index 943db7d23849..6628540c7435 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/IdentityProvidersResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/IdentityProvidersResource.java
@@ -41,7 +41,7 @@
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.utils.ReservedCharValidator;
 
 import jakarta.ws.rs.BadRequestException;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/KeyResource.java b/services/src/main/java/org/keycloak/services/resources/admin/KeyResource.java
index 112188b09ba5..a43b33689898 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/KeyResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/KeyResource.java
@@ -28,7 +28,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.representations.idm.KeysMetadataRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Produces;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ProtocolMappersResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ProtocolMappersResource.java
index 1f01a303aee4..6867486dbe7a 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ProtocolMappersResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ProtocolMappersResource.java
@@ -41,7 +41,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
index 7b22c63ad5d0..b045168dc030 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
@@ -16,24 +16,11 @@
  */
 package org.keycloak.services.resources.admin;
 
-import static org.keycloak.util.JsonSerialization.readValue;
-
-import java.io.InputStream;
-import java.security.cert.X509Certificate;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
+import com.fasterxml.jackson.core.type.TypeReference;
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.Consumes;
-import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.FormParam;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.NotFoundException;
@@ -48,12 +35,14 @@
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
 import jakarta.ws.rs.core.StreamingOutput;
-
-import com.fasterxml.jackson.core.type.TypeReference;
-
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -66,6 +55,7 @@
 import org.keycloak.common.Profile;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.PemUtils;
+import org.keycloak.email.EmailAuthenticator;
 import org.keycloak.email.EmailTemplateProvider;
 import org.keycloak.events.EventQuery;
 import org.keycloak.events.EventStoreProvider;
@@ -111,9 +101,10 @@
 import org.keycloak.services.managers.ResourceAdminManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.admin.ext.AdminRealmResourceProvider;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.services.util.DateUtil;
 import org.keycloak.storage.DatastoreProvider;
 import org.keycloak.storage.ExportImportManager;
 import org.keycloak.storage.StoreSyncEvent;
@@ -121,6 +112,18 @@
 import org.keycloak.utils.ProfileHelper;
 import org.keycloak.utils.ReservedCharValidator;
 
+import java.io.InputStream;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import static org.keycloak.util.JsonSerialization.readValue;
+
 /**
  * Base resource class for the admin REST api of one realm
  *
@@ -131,6 +134,7 @@
 @Extension(name = KeycloakOpenAPI.Profiles.ADMIN, value = "")
 public class RealmAdminResource {
     protected static final Logger logger = Logger.getLogger(RealmAdminResource.class);
+
     protected final AdminPermissionEvaluator auth;
     protected final RealmModel realm;
     private final AdminEventBuilder adminEvent;
@@ -160,7 +164,12 @@ public RealmAdminResource(KeycloakSession session, AdminPermissionEvaluator auth
     @POST
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Base path for importing clients under this realm.")
+    @Operation(summary = "Base path for importing clients under this realm.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = ClientRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public ClientRepresentation convertClientDescription(String description) {
         auth.clients().requireManage();
 
@@ -235,7 +244,11 @@ public RealmLocalizationResource getLocalization() {
     @Produces(MediaType.APPLICATION_JSON)
     @Path("default-default-client-scopes")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get realm default client scopes.  Only name and ids are returned.")
+    @Operation(summary = "Get realm default client scopes. Only name and ids are returned.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = ClientScopeRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<ClientScopeRepresentation> getDefaultDefaultClientScopes() {
         return getDefaultClientScopes(true);
     }
@@ -252,12 +265,16 @@ private Stream<ClientScopeRepresentation> getDefaultClientScopes(boolean default
         });
     }
 
-
     @PUT
     @NoCache
     @Path("default-default-client-scopes/{clientScopeId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void addDefaultDefaultClientScope(@PathParam("clientScopeId") String clientScopeId) {
         addDefaultClientScope(clientScopeId,true);
     }
@@ -274,12 +291,16 @@ private void addDefaultClientScope(String clientScopeId, boolean defaultScope) {
         adminEvent.operation(OperationType.CREATE).resource(ResourceType.CLIENT_SCOPE).resourcePath(session.getContext().getUri()).success();
     }
 
-
     @DELETE
     @NoCache
     @Path("default-default-client-scopes/{clientScopeId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void removeDefaultDefaultClientScope(@PathParam("clientScopeId") String clientScopeId) {
         auth.clients().requireManageClientScopes();
 
@@ -292,7 +313,6 @@ public void removeDefaultDefaultClientScope(@PathParam("clientScopeId") String c
         adminEvent.operation(OperationType.DELETE).resource(ResourceType.CLIENT_SCOPE).resourcePath(session.getContext().getUri()).success();
     }
 
-
     /**
      * Get realm optional client scopes.  Only name and ids are returned.
      *
@@ -303,7 +323,11 @@ public void removeDefaultDefaultClientScope(@PathParam("clientScopeId") String c
     @Produces(MediaType.APPLICATION_JSON)
     @Path("default-optional-client-scopes")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get realm optional client scopes.  Only name and ids are returned.")
+    @Operation(summary = "Get realm optional client scopes. Only name and ids are returned.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = ClientScopeRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<ClientScopeRepresentation> getDefaultOptionalClientScopes() {
         return getDefaultClientScopes(false);
     }
@@ -313,6 +337,11 @@ public Stream<ClientScopeRepresentation> getDefaultOptionalClientScopes() {
     @Path("default-optional-client-scopes/{clientScopeId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void addDefaultOptionalClientScope(@PathParam("clientScopeId") String clientScopeId) {
         addDefaultClientScope(clientScopeId, false);
     }
@@ -322,6 +351,11 @@ public void addDefaultOptionalClientScope(@PathParam("clientScopeId") String cli
     @Path("default-optional-client-scopes/{clientScopeId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void removeDefaultOptionalClientScope(@PathParam("clientScopeId") String clientScopeId) {
         removeDefaultDefaultClientScope(clientScopeId);
     }
@@ -372,7 +406,11 @@ public RoleContainerResource getRoleContainerResource() {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get the top-level representation of the realm It will not include nested information like User and Client representations.")
+    @Operation(summary = "Get the top-level representation of the realm It will not include nested information like User and Client representations.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = RealmRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public RealmRepresentation getRealm() {
         if (auth.realm().canViewRealm()) {
             return ModelToRepresentation.toRepresentation(session, realm, false);
@@ -407,8 +445,16 @@ public RealmRepresentation getRealm() {
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Update the top-level information of the realm Any user, roles or client information in the representation will be ignored.",
+    @Operation(summary = "Update the top-level information of the realm Any user, roles or client information in the representation will be ignored.",
             description = "This will only update top-level attributes of the realm.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "409", description = "Conflict"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response updateRealm(final RealmRepresentation rep) {
         auth.realm().requireManageRealm();
 
@@ -485,7 +531,13 @@ public Response updateRealm(final RealmRepresentation rep) {
      */
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Delete the realm")
+    @Operation(summary = "Delete the realm")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteRealm() {
         auth.realm().requireManageRealm();
 
@@ -520,6 +572,10 @@ public UsersResource users() {
     @Path("users-management-permissions")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public ManagementPermissionReference getUserMgmtPermissions() {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         auth.realm().requireViewRealm();
@@ -530,7 +586,6 @@ public ManagementPermissionReference getUserMgmtPermissions() {
         } else {
             return new ManagementPermissionReference();
         }
-
     }
 
     @PUT
@@ -540,6 +595,10 @@ public ManagementPermissionReference getUserMgmtPermissions() {
     @Path("users-management-permissions")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public ManagementPermissionReference setUsersManagementPermissionsEnabled(ManagementPermissionReference ref) {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         auth.realm().requireManageRealm();
@@ -604,7 +663,11 @@ public RoleByIdResource rolesById() {
     @Produces(MediaType.APPLICATION_JSON)
     @POST
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Push the realm's revocation policy to any client that has an admin url associated with it.")
+    @Operation(summary = "Push the realm's revocation policy to any client that has an admin url associated with it.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = GlobalRequestResult.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public GlobalRequestResult pushRevocation() {
         auth.realm().requireManageRealm();
 
@@ -614,7 +677,7 @@ public GlobalRequestResult pushRevocation() {
     }
 
     /**
-     * Removes all user sessions.  Any client that has an admin url will also be told to invalidate any sessions
+     * Removes all user sessions. Any client that has an admin url will also be told to invalidate any sessions
      * they have.
      *
      */
@@ -622,7 +685,11 @@ public GlobalRequestResult pushRevocation() {
     @POST
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Removes all user sessions.", description = "Any client that has an admin url will also be told to invalidate any sessions they have.")
+    @Operation(summary = "Removes all user sessions.", description = "Any client that has an admin url will also be told to invalidate any sessions they have.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = GlobalRequestResult.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public GlobalRequestResult logoutAll() {
         auth.users().requireManage();
 
@@ -641,7 +708,12 @@ public GlobalRequestResult logoutAll() {
     @Path("sessions/{session}")
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Remove a specific user session.", description = "Any client that has an admin url will also be told to invalidate this particular session.")
+    @Operation(summary = "Remove a specific user session.", description = "Any client that has an admin url will also be told to invalidate this particular session.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteSession(@PathParam("session") String sessionId, @DefaultValue("false") @QueryParam("isOffline") boolean offline) {
         auth.users().requireManage();
 
@@ -670,8 +742,12 @@ public void deleteSession(@PathParam("session") String sessionId, @DefaultValue(
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get client session stats Returns a JSON map.",
+    @Operation(summary = "Get client session stats Returns a JSON map.",
         description = "The key is the client id, the value is the number of sessions that currently are active with that client. Only clients that actually have a session associated with them will be in this map.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<Map<String, String>> getClientSessionStats() {
         auth.realm().requireViewRealm();
 
@@ -723,7 +799,11 @@ public Stream<Map<String, String>> getClientSessionStats() {
     @Path("events/config")
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get the events provider configuration Returns JSON object with events provider configuration")
+    @Operation(summary = "Get the events provider configuration Returns JSON object with events provider configuration")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = RealmEventsConfigRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public RealmEventsConfigRepresentation getRealmEventsConfig() {
         auth.realm().requireViewEvents();
 
@@ -750,6 +830,10 @@ public RealmEventsConfigRepresentation getRealmEventsConfig() {
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation( description = "Update the events provider Change the events provider and/or its configuration")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void updateRealmEventsConfig(final RealmEventsConfigRepresentation rep) {
         auth.realm().requireManageEvents();
 
@@ -775,6 +859,7 @@ public void updateRealmEventsConfig(final RealmEventsConfigRepresentation rep) {
      * @param dateFrom From date
      * @param firstResult Paging offset
      * @param maxResults Maximum results size (defaults to 100)
+     * @param direction The direction to sort events by (asc or desc)
      * @return
      */
     @Path("events")
@@ -782,15 +867,21 @@ public void updateRealmEventsConfig(final RealmEventsConfigRepresentation rep) {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get events Returns all events, or filters them based on URL query parameters listed here")
+    @Operation(summary = "Get events Returns all events, or filters them based on URL query parameters listed here")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = EventRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<EventRepresentation> getEvents(@Parameter(description = "The types of events to return") @QueryParam("type") List<String> types,
                                                  @Parameter(description = "App or oauth client name") @QueryParam("client") String client,
                                                  @Parameter(description = "User id") @QueryParam("user") String user,
-                                                 @Parameter(description = "From date") @QueryParam("dateFrom") String dateFrom,
-                                                 @Parameter(description = "To date") @QueryParam("dateTo") String dateTo,
+                                                 @Parameter(description = "From (inclusive) date (yyyy-MM-dd) or time in Epoch timestamp millis (number of milliseconds since January 1, 1970, 00:00:00 GMT)") @QueryParam("dateFrom") String dateFrom,
+                                                 @Parameter(description = "To (inclusive) date (yyyy-MM-dd) or time in Epoch timestamp millis (number of milliseconds since January 1, 1970, 00:00:00 GMT)") @QueryParam("dateTo") String dateTo,
                                                  @Parameter(description = "IP Address") @QueryParam("ipAddress") String ipAddress,
                                                  @Parameter(description = "Paging offset") @QueryParam("first") Integer firstResult,
-                                                 @Parameter(description = "Maximum results size (defaults to 100)") @QueryParam("max") Integer maxResults) {
+                                                 @Parameter(description = "Maximum results size (defaults to 100)") @QueryParam("max") Integer maxResults,
+                                                 @Parameter(description = "The direction to sort events by (asc or desc)") @QueryParam("direction") String direction) {
         auth.realm().requireViewEvents();
 
         EventStoreProvider eventStore = session.getProvider(EventStoreProvider.class);
@@ -813,30 +904,35 @@ public Stream<EventRepresentation> getEvents(@Parameter(description = "The types
         }
 
         if(dateFrom != null) {
-            SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd");
-            Date from = null;
             try {
-                from = df.parse(dateFrom);
-            } catch (ParseException e) {
-                throw new BadRequestException("Invalid value for 'Date(From)', expected format is yyyy-MM-dd");
+                query.fromDate(DateUtil.toStartOfDay(dateFrom));
+            } catch (Throwable t) {
+                throw new BadRequestException("Invalid value for 'dateFrom', expected format is yyyy-MM-dd or an Epoch timestamp");
             }
-            query.fromDate(from);
         }
 
         if(dateTo != null) {
-            SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd");
-            Date to = null;
             try {
-                to = df.parse(dateTo);
-            } catch (ParseException e) {
-                throw new BadRequestException("Invalid value for 'Date(To)', expected format is yyyy-MM-dd");
+                query.toDate(DateUtil.toEndOfDay(dateTo));
+            } catch (Throwable t) {
+                throw new BadRequestException("Invalid value for 'dateTo', expected format is yyyy-MM-dd or an Epoch timestamp");
             }
-            query.toDate(to);
         }
 
         if (ipAddress != null) {
             query.ipAddress(ipAddress);
         }
+
+        if (direction != null) {
+            if ("asc".equals(direction)) {
+                query.orderByAscTime();
+            } else if ("desc".equals(direction)) {
+                query.orderByDescTime();
+            } else {
+                throw new BadRequestException("Invalid value for sortDirection, expected value is asc or desc");
+            }
+        }
+
         if (firstResult != null) {
             query.firstResult(firstResult);
         }
@@ -864,6 +960,8 @@ public Stream<EventRepresentation> getEvents(@Parameter(description = "The types
      * @param dateFrom
      * @param firstResult
      * @param maxResults Maximum results size (defaults to 100)
+     * @param resourceTypes
+     * @param direction The direction to sort events by (asc or desc)
      * @return
      */
     @Path("admin-events")
@@ -871,13 +969,21 @@ public Stream<EventRepresentation> getEvents(@Parameter(description = "The types
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get admin events Returns all admin events, or filters events based on URL query parameters listed here")
+    @Operation(summary = "Get admin events Returns all admin events, or filters events based on URL query parameters listed here")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = AdminEventRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<AdminEventRepresentation> getEvents(@QueryParam("operationTypes") List<String> operationTypes, @QueryParam("authRealm") String authRealm, @QueryParam("authClient") String authClient,
                                                     @Parameter(description = "user id") @QueryParam("authUser") String authUser, @QueryParam("authIpAddress") String authIpAddress,
-                                                    @QueryParam("resourcePath") String resourcePath, @QueryParam("dateFrom") String dateFrom,
-                                                    @QueryParam("dateTo") String dateTo, @QueryParam("first") Integer firstResult,
+                                                    @QueryParam("resourcePath") String resourcePath,
+                                                    @Parameter(description = "From (inclusive) date (yyyy-MM-dd) or time in Epoch timestamp millis (number of milliseconds since January 1, 1970, 00:00:00 GMT)") @QueryParam("dateFrom") String dateFrom,
+                                                    @Parameter(description = "To (inclusive) date (yyyy-MM-dd) or time in Epoch timestamp millis (number of milliseconds since January 1, 1970, 00:00:00 GMT)") @QueryParam("dateTo") String dateTo,
+                                                    @QueryParam("first") Integer firstResult,
                                                     @Parameter(description = "Maximum results size (defaults to 100)") @QueryParam("max") Integer maxResults,
-                                                    @QueryParam("resourceTypes") List<String> resourceTypes) {
+                                                    @QueryParam("resourceTypes") List<String> resourceTypes,
+                                                    @Parameter(description = "The direction to sort events by (asc or desc)") @QueryParam("direction") String direction) {
         auth.realm().requireViewEvents();
 
         EventStoreProvider eventStore = session.getProvider(EventStoreProvider.class);
@@ -919,28 +1025,30 @@ public Stream<AdminEventRepresentation> getEvents(@QueryParam("operationTypes")
             query.resourceType(t);
         }
 
-
-
         if(dateFrom != null) {
-            SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd");
-            Date from = null;
             try {
-                from = df.parse(dateFrom);
-            } catch (ParseException e) {
-                throw new BadRequestException("Invalid value for 'Date(From)', expected format is yyyy-MM-dd");
+                query.fromTime(DateUtil.toStartOfDay(dateFrom));
+            } catch (Throwable t) {
+                throw new BadRequestException("Invalid value for 'dateFrom', expected format is yyyy-MM-dd or an Epoch timestamp");
             }
-            query.fromTime(from);
         }
 
         if(dateTo != null) {
-            SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd");
-            Date to = null;
             try {
-                to = df.parse(dateTo);
-            } catch (ParseException e) {
-                throw new BadRequestException("Invalid value for 'Date(To)', expected format is yyyy-MM-dd");
+                query.toTime(DateUtil.toEndOfDay(dateTo));
+            } catch (Throwable t) {
+                throw new BadRequestException("Invalid value for 'dateTo', expected format is yyyy-MM-dd or an Epoch timestamp");
+            }
+        }
+
+        if (direction != null) {
+            if ("asc".equals(direction)) {
+                query.orderByAscTime();
+            } else if ("desc".equals(direction)) {
+                query.orderByDescTime();
+            } else {
+                throw new BadRequestException("Invalid value for sortDirection, expected value is asc or desc");
             }
-            query.toTime(to);
         }
 
         if (firstResult != null) {
@@ -962,7 +1070,11 @@ public Stream<AdminEventRepresentation> getEvents(@QueryParam("operationTypes")
     @Path("events")
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Delete all events")
+    @Operation(summary = "Delete all events")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void clearEvents() {
         auth.realm().requireManageEvents();
 
@@ -977,7 +1089,11 @@ public void clearEvents() {
     @Path("admin-events")
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Delete all admin events")
+    @Operation(summary = "Delete all admin events")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void clearAdminEvents() {
         auth.realm().requireManageEvents();
 
@@ -998,7 +1114,11 @@ public void clearAdminEvents() {
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     @Deprecated
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Test SMTP connection with current logged in user")
+    @Operation(summary = "Test SMTP connection with current logged in user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response testSMTPConnection(final @Parameter(description = "SMTP server configuration") @FormParam("config") String config) throws Exception {
         Map<String, String> settings = readValue(config, new TypeReference<Map<String, String>>() {
         });
@@ -1011,25 +1131,44 @@ public Response testSMTPConnection(final @Parameter(description = "SMTP server c
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response testSMTPConnection(Map<String, String> settings) throws Exception {
+        auth.realm().requireManageRealm();
         try {
             UserModel user = auth.adminAuth().getUser();
             if (user.getEmail() == null) {
                 throw ErrorResponse.error("Logged in user does not have an e-mail.", Response.Status.INTERNAL_SERVER_ERROR);
             }
-            if (ComponentRepresentation.SECRET_VALUE.equals(settings.get("password"))) {
+            if (ComponentRepresentation.SECRET_VALUE.equals(settings.get("password"))
+                    && reuseConfiguredAuthenticationForSmtp(settings, EmailAuthenticator.AuthenticatorType.BASIC)) {
                 settings.put("password", realm.getSmtpConfig().get("password"));
             }
+            if (ComponentRepresentation.SECRET_VALUE.equals(settings.get("authTokenClientSecret"))
+                    && reuseConfiguredAuthenticationForSmtp(settings, EmailAuthenticator.AuthenticatorType.TOKEN)) {
+                settings.put("authTokenClientSecret", realm.getSmtpConfig().get("authTokenClientSecret"));
+            }
             session.getProvider(EmailTemplateProvider.class).sendSmtpTestEmail(settings, user);
         } catch (Exception e) {
-            e.printStackTrace();
-            logger.errorf("Failed to send email \n %s", e.getCause());
+            logger.errorf(e, "Failed to send email \n %s", e.getCause());
             throw ErrorResponse.error("Failed to send email", Response.Status.INTERNAL_SERVER_ERROR);
         }
 
         return Response.noContent().build();
     }
 
+    private boolean reuseConfiguredAuthenticationForSmtp(Map<String, String> settings, EmailAuthenticator.AuthenticatorType type) {
+        // just reuse the configured authentication if the same authenticator, host, port and user are passed
+        return Boolean.parseBoolean(settings.get("auth")) && Boolean.parseBoolean(realm.getSmtpConfig().get("auth"))
+                && settings.getOrDefault("authType", EmailAuthenticator.AuthenticatorType.BASIC.name()).equalsIgnoreCase(type.name())
+                && realm.getSmtpConfig().getOrDefault("authType", EmailAuthenticator.AuthenticatorType.BASIC.name()).equalsIgnoreCase(type.name())
+                && Objects.equals(settings.getOrDefault("host", ""), realm.getSmtpConfig().getOrDefault("host", ""))
+                && Objects.equals(settings.getOrDefault("port", "25"), realm.getSmtpConfig().getOrDefault("port", "25"))
+                && Objects.equals(settings.getOrDefault("user", ""), realm.getSmtpConfig().getOrDefault("user", ""));
+    }
+
     @Path("identity-provider")
     public IdentityProvidersResource getIdentityProviderResource() {
         return new IdentityProvidersResource(realm, session, this.auth, adminEvent);
@@ -1045,17 +1184,27 @@ public IdentityProvidersResource getIdentityProviderResource() {
     @Produces(MediaType.APPLICATION_JSON)
     @Path("default-groups")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Get group hierarchy.  Only name and ids are returned.")
+    @Operation(summary = "Get group hierarchy.  Only name and ids are returned.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = GroupRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<GroupRepresentation> getDefaultGroups() {
         auth.realm().requireViewRealm();
 
         return realm.getDefaultGroupsStream().map(ModelToRepresentation::groupToBriefRepresentation);
     }
+
     @PUT
     @NoCache
     @Path("default-groups/{groupId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void addDefaultGroup(@PathParam("groupId") String groupId) {
         auth.realm().requireManageRealm();
 
@@ -1074,6 +1223,11 @@ public void addDefaultGroup(@PathParam("groupId") String groupId) {
     @Path("default-groups/{groupId}")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void removeDefaultGroup(@PathParam("groupId") String groupId) {
         auth.realm().requireManageRealm();
 
@@ -1087,19 +1241,22 @@ public void removeDefaultGroup(@PathParam("groupId") String groupId) {
         adminEvent.operation(OperationType.DELETE).resource(ResourceType.GROUP).resourcePath(session.getContext().getUri()).success();
     }
 
-
     @Path("groups")
     public GroupsResource getGroups() {
-        return   new GroupsResource(realm, session, this.auth, adminEvent);
+        return  new GroupsResource(realm, session, this.auth, adminEvent);
     }
 
-
     @GET
     @Path("group-by-path/{path: .*}")
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = GroupRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public GroupRepresentation getGroupByPath(@PathParam("path") String path) {
         GroupModel found = KeycloakModelUtils.findGroupByPath(session, realm, path);
         if (found == null) {
@@ -1120,7 +1277,12 @@ public GroupRepresentation getGroupByPath(@PathParam("path") String path) {
     @Produces(MediaType.APPLICATION_JSON)
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Partial import from a JSON file to an existing realm.")
+    @Operation(summary = "Partial import from a JSON file to an existing realm.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = PartialImportResults.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response partialImport(InputStream requestBody) {
         auth.realm().requireManageRealm();
         try {
@@ -1130,7 +1292,7 @@ public Response partialImport(InputStream requestBody) {
                         AdminEventBuilder adminEventClone = adminEvent.clone(kcSession);
                         // calling a static method to avoid using the wrong instances
                         return getPartialImportResults(requestBody, kcSession, realmClone, adminEventClone);
-                    }, false, "Partial import in realm " + realm.getName())
+                    }, "Partial import in realm " + realm.getName())
             ).build();
         } catch (ModelDuplicateException e) {
             throw ErrorResponse.exists(e.getLocalizedMessage());
@@ -1174,9 +1336,13 @@ private static void fireUpdateEvent(PartialImportResult result, AdminEventBuilde
     @Produces(MediaType.APPLICATION_JSON)
     @POST
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Partial export of existing realm into a JSON file.")
+    @Operation(summary = "Partial export of existing realm into a JSON file.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = RealmRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Response partialExport(@QueryParam("exportGroupsAndRoles") Boolean exportGroupsAndRoles,
-                                                     @QueryParam("exportClients") Boolean exportClients) {
+                                  @QueryParam("exportClients") Boolean exportClients) {
         auth.realm().requireManageRealm();
 
         boolean groupsAndRolesExported = exportGroupsAndRoles != null && exportGroupsAndRoles;
@@ -1222,6 +1388,10 @@ public KeyResource keys() {
     @Produces(jakarta.ws.rs.core.MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<String> getCredentialRegistrators(){
         auth.realm().requireViewRealm();
         return session.getContext().getRealm().getRequiredActionProvidersStream()
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmLocalizationResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmLocalizationResource.java
index eb4e884736be..26b1c3b49d65 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmLocalizationResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmLocalizationResource.java
@@ -20,15 +20,19 @@
 import com.fasterxml.jackson.core.type.TypeReference;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.keycloak.http.FormPartValue;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.RealmModel;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -50,7 +54,7 @@
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.MultivaluedMap;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.utils.StringUtil;
 
@@ -72,6 +76,11 @@ public RealmLocalizationResource(KeycloakSession session, AdminPermissionEvaluat
     @Consumes(MediaType.TEXT_PLAIN)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void saveRealmLocalizationText(@PathParam("locale") String locale, @PathParam("key") String key,
             String text) {
         this.auth.realm().requireManageRealm();
@@ -92,8 +101,12 @@ public void saveRealmLocalizationText(@PathParam("locale") String locale, @PathP
     @Path("{locale}")
     @Consumes(MediaType.MULTIPART_FORM_DATA)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
-    @Operation( summary = "Import localization from uploaded JSON file")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Import localization from uploaded JSON file")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void createOrUpdateRealmLocalizationTextsFromFile(@PathParam("locale") String locale) {
         this.auth.realm().requireManageRealm();
 
@@ -116,7 +129,10 @@ public void createOrUpdateRealmLocalizationTextsFromFile(@PathParam("locale") St
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
-    @APIResponse(responseCode = "204", description = "No Content")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void createOrUpdateRealmLocalizationTexts(@PathParam("locale") String locale,
             Map<String, String> localizationTexts) {
         this.auth.realm().requireManageRealm();
@@ -127,6 +143,11 @@ public void createOrUpdateRealmLocalizationTexts(@PathParam("locale") String loc
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteRealmLocalizationTexts(@PathParam("locale") String locale) {
         this.auth.realm().requireManageRealm();
         if(!realm.removeRealmLocalizationTexts(locale)) {
@@ -138,6 +159,11 @@ public void deleteRealmLocalizationTexts(@PathParam("locale") String locale) {
     @DELETE
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteRealmLocalizationText(@PathParam("locale") String locale, @PathParam("key") String key) {
         this.auth.realm().requireManageRealm();
         if (!session.realms().deleteLocalizationText(realm, locale, key)) {
@@ -149,6 +175,10 @@ public void deleteRealmLocalizationText(@PathParam("locale") String locale, @Pat
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = String.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<String> getRealmLocalizationLocales() {
         auth.requireAnyAdminRole();
 
@@ -160,6 +190,10 @@ public Stream<String> getRealmLocalizationLocales() {
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Map<String, String> getRealmLocalizationTexts(@PathParam("locale") String locale,
             @Deprecated @QueryParam("useRealmDefaultLocaleFallback") Boolean useFallback) {
         if (!AdminPermissions.realms(session, auth.adminAuth()).isAdmin()) {
@@ -186,6 +220,11 @@ public Map<String, String> getRealmLocalizationTexts(@PathParam("locale") String
     @Produces(MediaType.TEXT_PLAIN)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public String getRealmLocalizationText(@PathParam("locale") String locale, @PathParam("key") String key) {
         auth.requireAnyAdminRole();
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
index 118341f4ea1f..60bd09166ad7 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java
@@ -17,9 +17,13 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -40,8 +44,8 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.storage.DatastoreProvider;
 import org.keycloak.storage.ExportImportManager;
 
@@ -108,6 +112,10 @@ public RealmsAdminResource(KeycloakSession session, AdminAuth auth, TokenManager
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation(summary = "Get accessible realms Returns a list of accessible realms. The list is filtered based on what realms the caller is allowed to view.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = RealmRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RealmRepresentation> getRealms(@DefaultValue("false") @QueryParam("briefRepresentation") boolean briefRepresentation) {
         Stream<RealmRepresentation> realms = session.realms().getRealmsStream()
                 .map(realm -> toRealmRep(realm, briefRepresentation))
@@ -136,7 +144,13 @@ protected RealmRepresentation toRealmRep(RealmModel realm, boolean briefRep) {
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.REALMS_ADMIN)
     @Operation(summary = "Import a realm. Imports a realm from a full representation of that realm.", description = "Realm name must be unique.")
-    @APIResponse(responseCode = "201", description = "Created")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response importRealm(InputStream requestBody) {
         AdminPermissions.realms(session, auth).requireCreateRealm();
 
@@ -159,17 +173,15 @@ public Response importRealm(InputStream requestBody) {
                     .success();
 
             return Response.created(location).build();
-        } catch (ModelDuplicateException e) {
-            logger.error("Conflict detected", e);
-            if (session.getTransactionManager().isActive()) session.getTransactionManager().setRollbackOnly();
-            throw ErrorResponse.exists("Conflict detected. See logs for details");
         } catch (PasswordPolicyNotMetException e) {
             logger.error("Password policy not met for user " + e.getUsername(), e);
-            if (session.getTransactionManager().isActive()) session.getTransactionManager().setRollbackOnly();
             throw ErrorResponse.error("Password policy not met. See logs for details", Response.Status.BAD_REQUEST);
-        } catch (ModelIllegalStateException e) {
-            logger.error(e.getMessage(), e);
-            throw ErrorResponse.error(e.getMessage(), Response.Status.INTERNAL_SERVER_ERROR);
+        } catch (ModelIllegalStateException mise) {
+            logger.error(mise.getMessage(), mise);
+            throw ErrorResponse.error(mise.getMessage(), Response.Status.INTERNAL_SERVER_ERROR);
+        } catch (ModelDuplicateException mde) {
+            logger.error("Conflict detected", mde);
+            throw ErrorResponse.exists(mde.getMessage());
         } catch (ModelException e) {
             throw ErrorResponse.error(e.getMessage(), Response.Status.BAD_REQUEST);
         }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleByIdResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleByIdResource.java
index b5ffed3b061d..5df25ffad291 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleByIdResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleByIdResource.java
@@ -17,9 +17,13 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -35,9 +39,9 @@
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.utils.ProfileHelper;
 
 import jakarta.ws.rs.Consumes;
@@ -90,9 +94,12 @@ public RoleByIdResource(KeycloakSession session, AdminPermissionEvaluator auth,
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Get a specific role's representation")
+    @Operation(summary = "Get a specific role's representation")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public RoleRepresentation getRole(final @Parameter(description = "id of role") @PathParam("role-id") String id) {
-
         RoleModel roleModel = getRoleModel(id);
         auth.roles().requireView(roleModel);
         return getRole(roleModel);
@@ -115,7 +122,12 @@ protected RoleModel getRoleModel(String id) {
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Delete the role")
+    @Operation(summary = "Delete the role")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void deleteRole(final @Parameter(description = "id of role") @PathParam("role-id") String id) {
         if (realm.getDefaultRole() == null) {
             logger.warnf("Default role for realm with id '%s' doesn't exist.", realm.getId());
@@ -147,7 +159,11 @@ public void deleteRole(final @Parameter(description = "id of role") @PathParam("
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Update the role")
+    @Operation(summary = "Update the role")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void updateRole(final @Parameter(description = "id of role") @PathParam("role-id") String id, final RoleRepresentation rep) {
         RoleModel role = getRoleModel(id);
         auth.roles().requireManage(role);
@@ -172,8 +188,11 @@ public void updateRole(final @Parameter(description = "id of role") @PathParam("
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Make the role a composite role by associating some child roles")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Make the role a composite role by associating some child roles")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void addComposites(final @PathParam("role-id") String id, List<RoleRepresentation> roles) {
         RoleModel role = getRoleModel(id);
         auth.roles().requireManage(role);
@@ -193,7 +212,11 @@ public void addComposites(final @PathParam("role-id") String id, List<RoleRepres
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Get role's children Returns a set of role's children provided the role is a composite.")
+    @Operation(summary = "Get role's children Returns a set of role's children provided the role is a composite.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getRoleComposites(final @PathParam("role-id") String id,
                                                         final @QueryParam("search") String search,
                                                         final @QueryParam("first") Integer first,
@@ -222,7 +245,11 @@ public Stream<RoleRepresentation> getRoleComposites(final @PathParam("role-id")
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Get realm-level roles that are in the role's composite")
+    @Operation(summary = "Get realm-level roles that are in the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-id") String id) {
         RoleModel role = getRoleModel(id);
         auth.roles().requireView(role);
@@ -241,7 +268,12 @@ public Stream<RoleRepresentation> getRealmRoleComposites(final @PathParam("role-
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Get client-level roles for the client that are in the role's composite")
+    @Operation(summary = "Get client-level roles for the client that are in the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<RoleRepresentation> getClientRoleComposites(final @PathParam("role-id") String id,
                                                                 final @PathParam("clientUuid") String clientUuid) {
 
@@ -264,7 +296,11 @@ public Stream<RoleRepresentation> getClientRoleComposites(final @PathParam("role
     @DELETE
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Remove a set of roles from the role's composite")
+    @Operation(summary = "Remove a set of roles from the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void deleteComposites(final @Parameter(description = "Role id") @PathParam("role-id") String id,
                                  @Parameter(description = "A set of roles to be removed") List<RoleRepresentation> roles) {
         RoleModel role = getRoleModel(id);
@@ -284,7 +320,11 @@ public void deleteComposites(final @Parameter(description = "Role id") @PathPara
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @Operation(summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public ManagementPermissionReference getManagementPermissions(final @PathParam("role-id") String id) {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         RoleModel role = getRoleModel(id);
@@ -318,7 +358,11 @@ public static ManagementPermissionReference toMgmtRef(RoleModel role, AdminPermi
     @Consumes(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES_BY_ID)
-    @Operation( summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @Operation(summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public ManagementPermissionReference setManagementPermissionsEnabled(final @PathParam("role-id") String id, ManagementPermissionReference ref) {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         RoleModel role = getRoleModel(id);
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
index 904af7af532a..6568a65f147c 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
@@ -18,9 +18,13 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.resteasy.reactive.NoCache;
 import org.keycloak.common.Profile;
@@ -42,9 +46,9 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.utils.ProfileHelper;
 
 import jakarta.ws.rs.BadRequestException;
@@ -105,7 +109,11 @@ public RoleContainerResource(KeycloakSession session, UriInfo uriInfo, RealmMode
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Get all roles for the realm or client")
+    @Operation(summary = "Get all roles for the realm or client")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getRoles(@QueryParam("search") @DefaultValue("") String search,
                                                @QueryParam("first") Integer firstResult,
                                                @QueryParam("max") Integer maxResults,
@@ -137,7 +145,14 @@ public Stream<RoleRepresentation> getRoles(@QueryParam("search") @DefaultValue("
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Create a new role for the realm or client")
+    @Operation(summary = "Create a new role for the realm or client")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public Response createRole(final RoleRepresentation rep) {
         auth.roles().requireManage(roleContainer);
 
@@ -223,7 +238,12 @@ public Response createRole(final RoleRepresentation rep) {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Get a role by name")
+    @Operation(summary = "Get a role by name")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public RoleRepresentation getRole(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName) {
         auth.roles().requireView(roleContainer);
 
@@ -244,7 +264,13 @@ public RoleRepresentation getRole(final @Parameter(description = "role's name (n
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Delete a role by name")
+    @Operation(summary = "Delete a role by name")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteRole(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName) {
         auth.roles().requireManage(roleContainer);
         RoleModel role = roleContainer.getRole(roleName);
@@ -277,7 +303,13 @@ public void deleteRole(final @Parameter(description = "role's name (not id!)") @
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Update a role by name")
+    @Operation(summary = "Update a role by name")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "409", description = "Conflict")
+    })
     public Response updateRole(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName, final RoleRepresentation rep) {
         auth.roles().requireManage(roleContainer);
         RoleModel role = roleContainer.getRole(roleName);
@@ -311,8 +343,12 @@ public Response updateRole(final @Parameter(description = "role's name (not id!)
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Add a composite to the role")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Add a composite to the role")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void addComposites(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName, List<RoleRepresentation> roles) {
         auth.roles().requireManage(roleContainer);
         RoleModel role = roleContainer.getRole(roleName);
@@ -333,7 +369,12 @@ public void addComposites(final @Parameter(description = "role's name (not id!)"
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Get composites of the role")
+    @Operation(summary = "Get composites of the role")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<RoleRepresentation> getRoleComposites(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName) {
         auth.roles().requireView(roleContainer);
         RoleModel role = roleContainer.getRole(roleName);
@@ -354,7 +395,12 @@ public Stream<RoleRepresentation> getRoleComposites(final @Parameter(description
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Get realm-level roles of the role's composite")
+    @Operation(summary = "Get realm-level roles of the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<RoleRepresentation> getRealmRoleComposites(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName) {
         auth.roles().requireView(roleContainer);
         RoleModel role = roleContainer.getRole(roleName);
@@ -376,7 +422,12 @@ public Stream<RoleRepresentation> getRealmRoleComposites(final @Parameter(descri
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Get client-level roles for the client that are in the role's composite")
+    @Operation(summary = "Get client-level roles for the client that are in the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<RoleRepresentation> getClientRoleComposites(final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName,
                                                                 final @PathParam("client-uuid") String clientUuid) {
         auth.roles().requireView(roleContainer);
@@ -403,7 +454,12 @@ public Stream<RoleRepresentation> getClientRoleComposites(final @Parameter(descr
     @DELETE
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Remove roles from the role's composite")
+    @Operation(summary = "Remove roles from the role's composite")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void deleteComposites(
                                    final @Parameter(description = "role's name (not id!)") @PathParam("role-name") String roleName,
                                    @Parameter(description = "roles to remove") List<RoleRepresentation> roles) {
@@ -428,7 +484,12 @@ public void deleteComposites(
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @Operation(summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public ManagementPermissionReference getManagementPermissions(final @PathParam("role-name") String roleName) {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         auth.roles().requireView(roleContainer);
@@ -457,7 +518,12 @@ public ManagementPermissionReference getManagementPermissions(final @PathParam("
     @Consumes(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @Operation(summary = "Return object stating whether role Authorization permissions have been initialized or not and a reference")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = ManagementPermissionReference.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public ManagementPermissionReference setManagementPermissionsEnabled(final @PathParam("role-name") String roleName, ManagementPermissionReference ref) {
         ProfileHelper.requireFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
         auth.roles().requireManage(roleContainer);
@@ -490,7 +556,12 @@ public ManagementPermissionReference setManagementPermissionsEnabled(final @Path
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Returns a stream of users that have the specified role name.")
+    @Operation(summary = "Returns a stream of users that have the specified role name.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = UserRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<UserRepresentation> getUsersInRole(final @Parameter(description = "the role name.") @PathParam("role-name") String roleName,
                                                     @Parameter(description = "Boolean which defines whether brief representations are returned (default: false)") @QueryParam("briefRepresentation") Boolean briefRepresentation,
                                                     @Parameter(description = "first result to return. Ignored if negative or {@code null}.") @QueryParam("first") Integer firstResult,
@@ -527,7 +598,12 @@ public Stream<UserRepresentation> getUsersInRole(final @Parameter(description =
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLES)
-    @Operation( summary = "Returns a stream of groups that have the specified role name")
+    @Operation(summary = "Returns a stream of groups that have the specified role name")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = UserRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<GroupRepresentation> getGroupsInRole(final @Parameter(description = "the role name.") @PathParam("role-name") String roleName,
                                                     @Parameter(description = "first result to return. Ignored if negative or {@code null}.") @QueryParam("first") Integer firstResult,
                                                     @Parameter(description = "maximum number of results to return. Ignored if negative or {@code null}.") @QueryParam("max") Integer maxResults,
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java
index 38caaa2e46ca..e115e414240b 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java
@@ -17,9 +17,13 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -43,7 +47,7 @@
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.storage.ReadOnlyException;
 
 import jakarta.ws.rs.Consumes;
@@ -124,7 +128,11 @@ public RoleMapperResource(KeycloakSession session,
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Get role mappings")
+    @Operation(summary = "Get role mappings")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = MappingsRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public MappingsRepresentation getRoleMappings() {
         viewPermission.require();
 
@@ -168,7 +176,11 @@ public MappingsRepresentation getRoleMappings() {
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Get realm-level role mappings")
+    @Operation(summary = "Get realm-level role mappings")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getRealmRoleMappings() {
         viewPermission.require();
 
@@ -189,7 +201,11 @@ public Stream<RoleRepresentation> getRealmRoleMappings() {
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Get effective realm-level role mappings This will recurse all composite roles to get the result.")
+    @Operation(summary = "Get effective realm-level role mappings This will recurse all composite roles to get the result.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getCompositeRealmRoleMappings(@Parameter(description = "if false, return roles with their attributes") @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation) {
         viewPermission.require();
 
@@ -210,7 +226,11 @@ public Stream<RoleRepresentation> getCompositeRealmRoleMappings(@Parameter(descr
     @Produces(MediaType.APPLICATION_JSON)
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Get realm-level roles that can be mapped")
+    @Operation(summary = "Get realm-level roles that can be mapped")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "", content = @Content(schema = @Schema(implementation = RoleRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<RoleRepresentation> getAvailableRealmRoleMappings() {
         viewPermission.require();
 
@@ -229,8 +249,14 @@ public Stream<RoleRepresentation> getAvailableRealmRoleMappings() {
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Add realm-level role mappings to the user")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Add realm-level role mappings to the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public void addRealmRoleMappings(@Parameter(description = "Roles to add") List<RoleRepresentation> roles) {
         managePermission.require();
 
@@ -267,7 +293,14 @@ public void addRealmRoleMappings(@Parameter(description = "Roles to add") List<R
     @DELETE
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.ROLE_MAPPER)
-    @Operation( summary = "Delete realm-level role mappings")
+    @Operation(summary = "Delete realm-level role mappings")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error")
+    })
     public void deleteRealmRoleMappings(List<RoleRepresentation> roles) {
         managePermission.require();
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleResource.java
index fba5835f4e41..e6c5fea35d3f 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleResource.java
@@ -25,7 +25,7 @@
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.NotFoundException;
 import jakarta.ws.rs.core.UriInfo;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java
index 7c01b71b221f..896282c41d4d 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedClientResource.java
@@ -35,7 +35,7 @@
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java
index b319a5fd73db..2bdf06bfa390 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ScopeMappedResource.java
@@ -36,7 +36,7 @@
 import org.keycloak.representations.idm.MappingsRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.util.ScopeMappedUtil;
 
 import jakarta.ws.rs.Consumes;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/UserProfileResource.java b/services/src/main/java/org/keycloak/services/resources/admin/UserProfileResource.java
index 8d5342de9b68..80ef5a6db6d2 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/UserProfileResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/UserProfileResource.java
@@ -33,6 +33,7 @@
 import org.eclipse.microprofile.openapi.annotations.media.Content;
 import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 
 import org.keycloak.component.ComponentValidationException;
@@ -43,7 +44,7 @@
 import org.keycloak.representations.idm.UserProfileMetadata;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.userprofile.UserProfile;
 import org.keycloak.userprofile.UserProfileContext;
 import org.keycloak.userprofile.UserProfileProvider;
@@ -71,6 +72,10 @@ public UserProfileResource(KeycloakSession session, AdminPermissionEvaluator aut
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation(description = "Get the configuration for the user profile")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UPConfig.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public UPConfig getConfiguration() {
         auth.requireAnyAdminRole();
         return session.getProvider(UserProfileProvider.class).getConfiguration();
@@ -81,6 +86,10 @@ public UPConfig getConfiguration() {
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation(description = "Get the UserProfileMetadata from the configuration")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UserProfileMetadata.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public UserProfileMetadata getMetadata() {
         auth.requireAnyAdminRole();
         UserProfile profile = session.getProvider(UserProfileProvider.class).create(UserProfileContext.USER_API, Collections.emptyMap());
@@ -92,7 +101,10 @@ public UserProfileMetadata getMetadata() {
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation(description = "Set the configuration for the user profile")
-    @APIResponse(responseCode = "200", content = @Content(schema = @Schema(implementation = UPConfig.class)))
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UPConfig.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Response update(UPConfig config) {
         auth.realm().requireManageRealm();
         return Response.ok(setAndGetConfiguration(config)).type(MediaType.APPLICATION_JSON).build();
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java b/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java
index f4667cdde60d..844849c36f81 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java
@@ -17,9 +17,13 @@
 package org.keycloak.services.resources.admin;
 
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
 import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
@@ -82,7 +86,7 @@
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.resources.KeycloakOpenAPI;
 import org.keycloak.services.resources.LoginActionsService;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 import org.keycloak.services.validation.Validation;
 import org.keycloak.storage.ReadOnlyException;
 import org.keycloak.userprofile.UserProfile;
@@ -176,7 +180,14 @@ public UserResource(KeycloakSession session, UserModel user, AdminPermissionEval
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Update the user")
+    @Operation(summary = "Update the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public Response updateUser(final UserRepresentation rep) {
 
         auth.users().requireManage(user);
@@ -315,7 +326,6 @@ public static void updateUserFromRep(UserProfile profile, UserModel user, UserRe
         }
     }
 
-
     /**
      * Get representation of the user
      *
@@ -325,7 +335,11 @@ public static void updateUserFromRep(UserProfile profile, UserModel user, UserRe
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get representation of the user")
+    @Operation(summary = "Get representation of the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UserRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public UserRepresentation getUser(
             @Parameter(description = "Indicates if the user profile metadata should be added to the response") @QueryParam("userProfileMetadata") boolean userProfileMetadata
     ) {
@@ -340,9 +354,6 @@ public UserRepresentation getUser(
             rep.setFederatedIdentities(reps);
         }
 
-        if (session.getProvider(BruteForceProtector.class).isTemporarilyDisabled(session, realm, user)) {
-            rep.setEnabled(false);
-        }
         rep.setAccess(auth.users().getAccess(user));
 
         if (!userProfileMetadata) {
@@ -362,7 +373,12 @@ public UserRepresentation getUser(
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Impersonate the user")
+    @Operation(summary = "Impersonate the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Map<String, Object> impersonate() {
         ProfileHelper.requireFeature(Profile.Feature.IMPERSONATION);
 
@@ -389,7 +405,7 @@ public Map<String, Object> impersonate() {
         }
         EventBuilder event = new EventBuilder(realm, session, clientConnection);
 
-        UserSessionModel userSession = new UserSessionManager(session).createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteAddr(), "impersonate", false, null, null);
+        UserSessionModel userSession = new UserSessionManager(session).createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteHost(), "impersonate", false, null, null);
 
         UserModel adminUser = auth.adminAuth().getUser();
         String impersonatorId = adminUser.getId();
@@ -422,7 +438,11 @@ public Map<String, Object> impersonate() {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get sessions associated with the user")
+    @Operation(summary = "Get sessions associated with the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UserSessionRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<UserSessionRepresentation> getSessions() {
         auth.users().requireView(user);
         return session.sessions().getUserSessionsStream(realm, user).map(ModelToRepresentation::toRepresentation);
@@ -438,7 +458,12 @@ public Stream<UserSessionRepresentation> getSessions() {
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get offline sessions associated with the user and client")
+    @Operation(summary = "Get offline sessions associated with the user and client")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UserSessionRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public Stream<UserSessionRepresentation> getOfflineSessions(final @PathParam("clientUuid") String clientUuid) {
         auth.users().requireView(user);
         ClientModel client = realm.getClientById(clientUuid);
@@ -460,7 +485,11 @@ public Stream<UserSessionRepresentation> getOfflineSessions(final @PathParam("cl
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get social logins associated with the user")
+    @Operation(summary = "Get social logins associated with the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = FederatedIdentityRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<FederatedIdentityRepresentation> getFederatedIdentity() {
         auth.users().requireView(user);
         return getFederatedIdentities(user);
@@ -483,7 +512,12 @@ private Stream<FederatedIdentityRepresentation> getFederatedIdentities(UserModel
     @POST
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Add a social login provider to the user")
+    @Operation(summary = "Add a social login provider to the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public Response addFederatedIdentity(final @Parameter(description = "Social login provider id") @PathParam("provider") String provider, FederatedIdentityRepresentation rep) {
         auth.users().requireManage(user);
         if (session.users().getFederatedIdentity(realm, user, provider) != null) {
@@ -505,7 +539,12 @@ public Response addFederatedIdentity(final @Parameter(description = "Social logi
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Remove a social login provider from user")
+    @Operation(summary = "Remove a social login provider from user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void removeFederatedIdentity(final @Parameter(description = "Social login provider id") @PathParam("provider") String provider) {
         auth.users().requireManage(user);
         if (!session.users().removeFederatedIdentity(realm, user, provider)) {
@@ -524,7 +563,11 @@ public void removeFederatedIdentity(final @Parameter(description = "Social login
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get consents granted by the user")
+    @Operation(summary = "Get consents granted by the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<Map<String, Object>> getConsents() {
         auth.users().requireView(user);
 
@@ -594,7 +637,12 @@ private Map<String, Object> toConsent(UserConsentModel consent, Set<ClientModel>
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Revoke consent and offline tokens for particular client from user")
+    @Operation(summary = "Revoke consent and offline tokens for particular client from user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void revokeConsent(final @Parameter(description = "Client id") @PathParam("client") String clientId) {
         auth.users().requireManage(user);
 
@@ -619,8 +667,11 @@ public void revokeConsent(final @Parameter(description = "Client id") @PathParam
     @Path("logout")
     @POST
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Remove all user sessions associated with the user Also send notification to all clients that have an admin URL to invalidate the sessions for the particular user.")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Remove all user sessions associated with the user Also send notification to all clients that have an admin URL to invalidate the sessions for the particular user.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void logout() {
         auth.users().requireManage(user);
 
@@ -641,7 +692,12 @@ public void logout() {
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Delete the user")
+    @Operation(summary = "Delete the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Response deleteUser() {
         auth.users().requireManage(user);
 
@@ -670,7 +726,11 @@ public RoleMapperResource getRoleMappings() {
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Disable all credentials for a user of a specific type")
+    @Operation(summary = "Disable all credentials for a user of a specific type")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public void disableCredentialType(List<String> credentialTypes) {
         auth.users().requireManage(user);
         if (credentialTypes == null) return;
@@ -689,7 +749,13 @@ public void disableCredentialType(List<String> credentialTypes) {
     @PUT
     @Consumes(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Set up a new password for the user.")
+    @Operation(summary = "Set up a new password for the user.")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public void resetPassword(@Parameter(description = "The representation must contain a rawPassword with the plain-text password") CredentialRepresentation cred) {
         auth.users().requireManage(user);
         if (cred == null || cred.getValue() == null) {
@@ -729,21 +795,24 @@ public void resetPassword(@Parameter(description = "The representation must cont
         adminEvent.operation(OperationType.ACTION).resourcePath(session.getContext().getUri()).success();
     }
 
-
     @GET
     @Path("credentials")
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
-    public Stream<CredentialRepresentation> credentials(){
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = CredentialRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
+    public Stream<CredentialRepresentation> credentials() {
         auth.users().requireView(user);
-        return user.credentialManager().getStoredCredentialsStream()
+
+        return user.credentialManager().getCredentials()
                 .map(ModelToRepresentation::toRepresentation)
                 .peek(credentialRepresentation -> credentialRepresentation.setSecretData(null));
     }
 
-
     /**
      * Return credential types, which are provided by the user storage where user is stored. Returned values can contain for example "password", "otp" etc.
      * This will always return empty list for "local" users, which are not backed by any user storage
@@ -755,7 +824,11 @@ public Stream<CredentialRepresentation> credentials(){
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Return credential types, which are provided by the user storage where user is stored.", description = "Returned values can contain for example \"password\", \"otp\" etc. This will always return empty list for \"local\" users, which are not backed by any user storage")
+    @Operation(summary = "Return credential types, which are provided by the user storage where user is stored.", description = "Returned values can contain for example \"password\", \"otp\" etc. This will always return empty list for \"local\" users, which are not backed by any user storage")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = String.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<String> getConfiguredUserStorageCredentialTypes() {
         // changed to "requireView" as per issue #20783
         auth.users().requireView(user);
@@ -771,7 +844,12 @@ public Stream<String> getConfiguredUserStorageCredentialTypes() {
     @DELETE
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Remove a credential for a user")
+    @Operation(summary = "Remove a credential for a user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void removeCredential(final @PathParam("credentialId") String credentialId) {
         auth.users().requireManage(user);
         CredentialModel credential = user.credentialManager().getStoredCredentialById(credentialId);
@@ -791,7 +869,12 @@ public void removeCredential(final @PathParam("credentialId") String credentialI
     @Consumes(MediaType.TEXT_PLAIN)
     @Path("credentials/{credentialId}/userLabel")
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Update a credential label for a user")
+    @Operation(summary = "Update a credential label for a user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void setCredentialUserLabel(final @PathParam("credentialId") String credentialId, String userLabel) {
         auth.users().requireManage(user);
         CredentialModel credential = user.credentialManager().getStoredCredentialById(credentialId);
@@ -800,6 +883,12 @@ public void setCredentialUserLabel(final @PathParam("credentialId") String crede
             if (auth.users().canQuery()) throw new NotFoundException("Credential not found");
             else throw new ForbiddenException();
         }
+
+        if (userLabel == null || userLabel.trim().isEmpty()) {
+            throw new ErrorResponseException("missingCredentialLabel", "Credential label must not be empty", Status.BAD_REQUEST);
+
+        }
+
         user.credentialManager().updateCredentialLabel(credentialId, userLabel);
     }
 
@@ -810,8 +899,12 @@ public void setCredentialUserLabel(final @PathParam("credentialId") String crede
     @Path("credentials/{credentialId}/moveToFirst")
     @POST
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Move a credential to a first position in the credentials list of the user")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Move a credential to a first position in the credentials list of the user")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void moveCredentialToFirst(final @Parameter(description = "The credential to move") @PathParam("credentialId") String credentialId){
         moveCredentialAfter(credentialId, null);
     }
@@ -824,8 +917,12 @@ public void moveCredentialToFirst(final @Parameter(description = "The credential
     @Path("credentials/{credentialId}/moveAfter/{newPreviousCredentialId}")
     @POST
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Move a credential to a position behind another credential")
-    @APIResponse(responseCode = "204", description = "No Content")
+    @Operation(summary = "Move a credential to a position behind another credential")
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void moveCredentialAfter(final @Parameter(description = "The credential to move") @PathParam("credentialId") String credentialId,
                                     final @Parameter(description = "The credential that will be the previous element in the list. If set to null, the moved credential will be the first element in the list.") @PathParam("newPreviousCredentialId") String newPreviousCredentialId){
         auth.users().requireManage(user);
@@ -859,6 +956,13 @@ public void moveCredentialAfter(final @Parameter(description = "The credential t
             summary = "Send an email to the user with a link they can click to reset their password.",
             description = "The redirectUri and clientId parameters are optional. The default for the redirect is the account client. This endpoint has been deprecated.  Please use the execute-actions-email passing a list with UPDATE_PASSWORD within it.",
             deprecated = true)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public Response resetPasswordEmail(@Parameter(description = "redirect uri") @QueryParam(OIDCLoginProtocol.REDIRECT_URI_PARAM) String redirectUri,
                                        @Parameter(description = "client id") @QueryParam(OIDCLoginProtocol.CLIENT_ID_PARAM) String clientId) {
         List<String> actions = new LinkedList<>();
@@ -889,6 +993,13 @@ public Response resetPasswordEmail(@Parameter(description = "redirect uri") @Que
             summary = "Send an email to the user with a link they can click to execute particular actions.",
             description = "An email contains a link the user can click to perform a set of required actions. The redirectUri and clientId parameters are optional. If no redirect is given, then there will be no link back to click after actions have completed. Redirect uri must be a valid uri for the particular clientId."
     )
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public Response executeActionsEmail(@Parameter(description = "Redirect uri") @QueryParam(OIDCLoginProtocol.REDIRECT_URI_PARAM) String redirectUri,
                                         @Parameter(description = "Client id") @QueryParam(OIDCLoginProtocol.CLIENT_ID_PARAM) String clientId,
                                         @Parameter(description = "Number of seconds after which the generated token expires") @QueryParam("lifespan") Integer lifespan,
@@ -909,12 +1020,13 @@ public Response executeActionsEmail(@Parameter(description = "Redirect uri") @Qu
             builder.queryParam("key", token.serialize(session, realm, session.getContext().getUri()));
 
             String link = builder.build(realm.getName()).toString();
-
+            
             this.session.getProvider(EmailTemplateProvider.class)
-              .setAttribute(Constants.TEMPLATE_ATTR_REQUIRED_ACTIONS, token.getRequiredActions())
-              .setRealm(realm)
-              .setUser(user)
-              .sendExecuteActions(link, TimeUnit.SECONDS.toMinutes(result.lifespan));
+                    .setAttribute(Constants.TEMPLATE_ATTR_REQUIRED_ACTIONS, token.getRequiredActions())
+                    .setAttribute(Constants.IGNORE_ACCEPT_LANGUAGE_HEADER, true)
+                    .setRealm(realm)
+                    .setUser(user)
+                    .sendExecuteActions(link, TimeUnit.SECONDS.toMinutes(result.lifespan));
 
             //audit.user(user).detail(Details.EMAIL, user.getEmail()).detail(Details.CODE_ID, accessCode.getCodeId()).success();
 
@@ -947,6 +1059,12 @@ public Response executeActionsEmail(@Parameter(description = "Redirect uri") @Qu
             summary = "Send an email-verification email to the user An email contains a link the user can click to verify their email address.",
             description = "The redirectUri, clientId and lifespan parameters are optional. The default for the redirect is the account client. The default for the lifespan is 12 hours"
     )
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public Response sendVerifyEmail(
             @Parameter(description = "Redirect uri") @QueryParam(OIDCLoginProtocol.REDIRECT_URI_PARAM) String redirectUri,
             @Parameter(description = "Client id") @QueryParam(OIDCLoginProtocol.CLIENT_ID_PARAM) String clientId,
@@ -985,12 +1103,16 @@ public Response sendVerifyEmail(
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = GroupRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Stream<GroupRepresentation> groupMembership(@QueryParam("search") String search,
                                                        @QueryParam("first") Integer firstResult,
                                                        @QueryParam("max") Integer maxResults,
                                                        @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation) {
         auth.users().requireView(user);
-        return user.getGroupsStream(search, firstResult, maxResults).map(g -> ModelToRepresentation.toRepresentation(g, !briefRepresentation));
+        return user.getGroupsStream(search, firstResult, maxResults).filter(auth.groups()::canView).map(g -> ModelToRepresentation.toRepresentation(g, !briefRepresentation));
     }
 
     @GET
@@ -999,6 +1121,10 @@ public Stream<GroupRepresentation> groupMembership(@QueryParam("search") String
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Map<String, Long> getGroupMembershipCount(@QueryParam("search") String search) {
         auth.users().requireView(user);
         Long results;
@@ -1018,6 +1144,13 @@ public Map<String, Long> getGroupMembershipCount(@QueryParam("search") String se
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "400", description = "Bad Request"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found"),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     public void removeMembership(@PathParam("groupId") String groupId) {
         auth.users().requireManageGroupMembership(user);
 
@@ -1053,6 +1186,11 @@ public void removeMembership(@PathParam("groupId") String groupId) {
     @NoCache
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "204", description = "No Content"),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "404", description = "Not Found")
+    })
     public void joinGroup(@PathParam("groupId") String groupId) {
         auth.users().requireManageGroupMembership(user);
         GroupModel group = session.groups().getGroupById(realm, groupId);
@@ -1079,6 +1217,10 @@ public void joinGroup(@PathParam("groupId") String groupId) {
     @Produces(MediaType.APPLICATION_JSON)
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation()
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK"),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     public Map<String, List<String>> getUnmanagedAttributes() {
         auth.users().requireView(user);
         UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java b/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
index df4c26f56130..65b0294d0c5e 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
@@ -16,12 +16,19 @@
  */
 package org.keycloak.services.resources.admin;
 
+import java.util.Arrays;
 import org.eclipse.microprofile.openapi.annotations.Operation;
+import org.eclipse.microprofile.openapi.annotations.enums.SchemaType;
 import org.eclipse.microprofile.openapi.annotations.extensions.Extension;
+import org.eclipse.microprofile.openapi.annotations.media.Content;
+import org.eclipse.microprofile.openapi.annotations.media.Schema;
 import org.eclipse.microprofile.openapi.annotations.parameters.Parameter;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponse;
+import org.eclipse.microprofile.openapi.annotations.responses.APIResponses;
 import org.eclipse.microprofile.openapi.annotations.tags.Tag;
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.reactive.NoCache;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.common.ClientConnection;
 import org.keycloak.common.Profile;
 import org.keycloak.events.admin.OperationType;
@@ -39,13 +46,15 @@
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.policy.PasswordPolicyNotMetException;
+import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.ErrorResponse;
 import org.keycloak.services.ErrorResponseException;
 import org.keycloak.services.resources.KeycloakOpenAPI;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.UserPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.UserPermissionEvaluator;
 import org.keycloak.userprofile.UserProfile;
+import org.keycloak.userprofile.UserProfileContext;
 import org.keycloak.userprofile.UserProfileProvider;
 import org.keycloak.utils.SearchQueryUtils;
 
@@ -121,8 +130,15 @@ public UsersResource(KeycloakSession session, AdminPermissionEvaluator auth, Adm
      */
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "201", description = "Created"),
+        @APIResponse(responseCode = "400", description = "Bad Request", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden"),
+        @APIResponse(responseCode = "409", description = "Conflict", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class))),
+        @APIResponse(responseCode = "500", description = "Internal Server Error", content = @Content(schema = @Schema(implementation = ErrorRepresentation.class)))
+    })
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Create a new user Username must be unique.")
+    @Operation(summary = "Create a new user Username must be unique.")
     public Response createUser(final UserRepresentation rep) {
         // first check if user has manage rights
         try {
@@ -175,7 +191,7 @@ public Response createUser(final UserRepresentation rep) {
     }
 
     private boolean canCreateGroupMembers(UserRepresentation rep) {
-        if (!Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+        if (!Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) && !Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
             return false;
         }
 
@@ -250,8 +266,12 @@ public UserResource user(final @PathParam("user-id") String id) {
     @GET
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = UserRepresentation.class, type = SchemaType.ARRAY))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
-    @Operation( summary = "Get users Returns a stream of users, filtered according to query parameters.")
+    @Operation(summary = "Get users Returns a stream of users, filtered according to query parameters.")
     public Stream<UserRepresentation> getUsers(
             @Parameter(description = "A String contained in username, first or last name, or email. Default search behavior is prefix-based (e.g., foo or foo*). Use *foo* for infix search and \"foo\" for exact search.") @QueryParam("search") String search,
             @Parameter(description = "A String contained in lastName, or the complete lastName, if param \"exact\" is true") @QueryParam("lastName") String last,
@@ -281,10 +301,10 @@ public Stream<UserRepresentation> getUsers(
         Stream<UserModel> userModels = Stream.empty();
         if (search != null) {
             if (search.startsWith(SEARCH_ID_PARAMETER)) {
-                UserModel userModel =
-                        session.users().getUserById(realm, search.substring(SEARCH_ID_PARAMETER.length()).trim());
-                if (userModel != null) {
-                    userModels = Stream.of(userModel);
+                String[] userIds = search.substring(SEARCH_ID_PARAMETER.length()).trim().split("\\s+");
+                userModels = Arrays.stream(userIds).map(id -> session.users().getUserById(realm, id)).filter(Objects::nonNull);
+                if (AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+                    userModels = userModels.filter(userPermissionEvaluator::canView);
                 }
             } else {
                 Map<String, String> attributes = new HashMap<>();
@@ -292,6 +312,10 @@ public Stream<UserRepresentation> getUsers(
                 if (enabled != null) {
                     attributes.put(UserModel.ENABLED, enabled.toString());
                 }
+                if (emailVerified != null) {
+                    attributes.put(UserModel.EMAIL_VERIFIED, emailVerified.toString());
+                }
+
                 return searchForUser(attributes, realm, userPermissionEvaluator, briefRepresentation, firstResult,
                         maxResults, false);
             }
@@ -353,18 +377,27 @@ public Stream<UserRepresentation> getUsers(
      * {@code email} or {@code username} those criteria are matched against their
      * respective fields on a user entity. Combined with a logical and.
      *
-     * @param search   arbitrary search string for all the fields below. Default search behavior is prefix-based (e.g., <code>foo</code> or <code>foo*</code>). Use <code>*foo*</code> for infix search and <code>"foo"</code> for exact search.
-     * @param last     last name filter
-     * @param first    first name filter
-     * @param email    email filter
-     * @param username username filter
+     * @param search A String contained in username, first or last name, or email. Default search behavior is prefix-based (e.g., <code>foo</code> or <code>foo*</code>). Use <code>*foo*</code> for infix search and <code>"foo"</code> for exact search.
+     * @param last A String contained in lastName, or the complete lastName, if param "exact" is true
+     * @param first A String contained in firstName, or the complete firstName, if param "exact" is true
+     * @param email A String contained in email, or the complete email, if param "exact" is true
+     * @param username A String contained in username, or the complete username, if param "exact" is true
+     * @param emailVerified whether the email has been verified
+     * @param idpAlias The alias of an Identity Provider linked to the user
+     * @param idpUserId The userId at an Identity Provider linked to the user
      * @param enabled Boolean representing if user is enabled or not
+     * @param exact Boolean which defines whether the params "last", "first", "email" and "username" must match exactly
+     * @param searchQuery A query to search for custom attributes, in the format 'key1:value2 key2:value2'
      * @return the number of users that match the given criteria
      */
     @Path("count")
     @GET
     @NoCache
     @Produces(MediaType.APPLICATION_JSON)
+    @APIResponses(value = {
+        @APIResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = Integer.class))),
+        @APIResponse(responseCode = "403", description = "Forbidden")
+    })
     @Tag(name = KeycloakOpenAPI.Admin.Tags.USERS)
     @Operation(
             summary = "Returns the number of users that match the given criteria.",
@@ -373,29 +406,47 @@ public Stream<UserRepresentation> getUsers(
                     "2. If {@code search} is specified other criteria such as {@code last} will be ignored even though you set them. The {@code search} string will be matched against the first and last name, the username and the email of a user. <p> " +
                     "3. If {@code search} is unspecified but any of {@code last}, {@code first}, {@code email} or {@code username} those criteria are matched against their respective fields on a user entity. Combined with a logical and.")
     public Integer getUsersCount(
-            @Parameter(description = "arbitrary search string for all the fields below. Default search behavior is prefix-based (e.g., foo or foo*). Use *foo* for infix search and \"foo\" for exact search.") @QueryParam("search") String search,
-            @Parameter(description = "last name filter") @QueryParam("lastName") String last,
-            @Parameter(description = "first name filter") @QueryParam("firstName") String first,
-            @Parameter(description = "email filter") @QueryParam("email") String email,
-            @QueryParam("emailVerified") Boolean emailVerified,
-            @Parameter(description = "username filter") @QueryParam("username") String username,
+            @Parameter(description = "A String contained in username, first or last name, or email. Default search behavior is prefix-based (e.g., foo or foo*). Use *foo* for infix search and \"foo\" for exact search.") @QueryParam("search") String search,
+            @Parameter(description = "A String contained in lastName, or the complete lastName, if param \"exact\" is true") @QueryParam("lastName") String last,
+            @Parameter(description = "A String contained in firstName, or the complete firstName, if param \"exact\" is true") @QueryParam("firstName") String first,
+            @Parameter(description = "A String contained in email, or the complete email, if param \"exact\" is true") @QueryParam("email") String email,
+            @Parameter(description = "A String contained in username, or the complete username, if param \"exact\" is true") @QueryParam("username") String username,
+            @Parameter(description = "whether the email has been verified") @QueryParam("emailVerified") Boolean emailVerified,
+            @Parameter(description = "The alias of an Identity Provider linked to the user") @QueryParam("idpAlias") String idpAlias,
+            @Parameter(description = "The userId at an Identity Provider linked to the user") @QueryParam("idpUserId") String idpUserId,
             @Parameter(description = "Boolean representing if user is enabled or not") @QueryParam("enabled") Boolean enabled,
-            @QueryParam("q") String searchQuery) {
+            @Parameter(description = "Boolean which defines whether the params \"last\", \"first\", \"email\" and \"username\" must match exactly") @QueryParam("exact") Boolean exact,
+            @Parameter(description = "A query to search for custom attributes, in the format 'key1:value2 key2:value2'") @QueryParam("q") String searchQuery) {
         UserPermissionEvaluator userPermissionEvaluator = auth.users();
         userPermissionEvaluator.requireQuery();
 
         Map<String, String> searchAttributes = searchQuery == null
                 ? Collections.emptyMap()
                 : SearchQueryUtils.getFields(searchQuery);
-
         if (search != null) {
             if (search.startsWith(SEARCH_ID_PARAMETER)) {
                 UserModel userModel = session.users().getUserById(realm, search.substring(SEARCH_ID_PARAMETER.length()).trim());
                 return userModel != null && userPermissionEvaluator.canView(userModel) ? 1 : 0;
-            } else if (userPermissionEvaluator.canView()) {
-                return session.users().getUsersCount(realm, search.trim());
+            }
+
+            Map<String, String> parameters = new HashMap<>();
+            parameters.put(UserModel.SEARCH, search.trim());
+
+            if (enabled != null) {
+                parameters.put(UserModel.ENABLED, enabled.toString());
+            }
+            if (emailVerified != null) {
+                parameters.put(UserModel.EMAIL_VERIFIED, emailVerified.toString());
+            }
+
+            if (userPermissionEvaluator.canView()) {
+                return session.users().getUsersCount(realm, parameters);
             } else {
-                return session.users().getUsersCount(realm, search.trim(), auth.groups().getGroupsWithViewPermission());
+                if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                    return session.users().getUsersCount(realm, parameters, auth.groups().getGroupIdsWithViewPermission());
+                } else {
+                    return session.users().getUsersCount(realm, parameters);
+                }
             }
         } else if (last != null || first != null || email != null || username != null || emailVerified != null || enabled != null || !searchAttributes.isEmpty()) {
             Map<String, String> parameters = new HashMap<>();
@@ -414,20 +465,37 @@ public Integer getUsersCount(
             if (emailVerified != null) {
                 parameters.put(UserModel.EMAIL_VERIFIED, emailVerified.toString());
             }
+            if (idpAlias != null) {
+                parameters.put(UserModel.IDP_ALIAS, idpAlias);
+            }
+            if (idpUserId != null) {
+                parameters.put(UserModel.IDP_USER_ID, idpUserId);
+            }
             if (enabled != null) {
                 parameters.put(UserModel.ENABLED, enabled.toString());
             }
+            if (exact != null) {
+                parameters.put(UserModel.EXACT, exact.toString());
+            }
             parameters.putAll(searchAttributes);
 
             if (userPermissionEvaluator.canView()) {
                 return session.users().getUsersCount(realm, parameters);
             } else {
-                return session.users().getUsersCount(realm, parameters, auth.groups().getGroupsWithViewPermission());
+                if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                    return session.users().getUsersCount(realm, parameters, auth.groups().getGroupIdsWithViewPermission());
+                } else {
+                    return session.users().getUsersCount(realm, parameters);
+                }
             }
         } else if (userPermissionEvaluator.canView()) {
             return session.users().getUsersCount(realm);
         } else {
-            return session.users().getUsersCount(realm, auth.groups().getGroupsWithViewPermission());
+            if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+                return session.users().getUsersCount(realm, auth.groups().getGroupIdsWithViewPermission());
+            } else {
+                return session.users().getUsersCount(realm);
+            }
         }
     }
 
@@ -445,29 +513,35 @@ public UserProfileResource userProfile() {
     private Stream<UserRepresentation> searchForUser(Map<String, String> attributes, RealmModel realm, UserPermissionEvaluator usersEvaluator, Boolean briefRepresentation, Integer firstResult, Integer maxResults, Boolean includeServiceAccounts) {
         attributes.put(UserModel.INCLUDE_SERVICE_ACCOUNT, includeServiceAccounts.toString());
 
-        if (!auth.users().canView()) {
-            Set<String> groupModels = auth.groups().getGroupsWithViewPermission();
-
-            if (!groupModels.isEmpty()) {
-                session.setAttribute(UserModel.GROUPS, groupModels);
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            Set<String> groupIds = auth.groups().getGroupIdsWithViewPermission();
+            if (!groupIds.isEmpty()) {
+                session.setAttribute(UserModel.GROUPS, groupIds);
             }
         }
 
-        Stream<UserModel> userModels = session.users().searchForUserStream(realm, attributes, firstResult, maxResults);
-        return toRepresentation(realm, usersEvaluator, briefRepresentation, userModels);
+        return toRepresentation(realm, usersEvaluator, briefRepresentation, session.users().searchForUserStream(realm, attributes, firstResult, maxResults));
     }
 
     private Stream<UserRepresentation> toRepresentation(RealmModel realm, UserPermissionEvaluator usersEvaluator, Boolean briefRepresentation, Stream<UserModel> userModels) {
         boolean briefRepresentationB = briefRepresentation != null && briefRepresentation;
-        boolean canViewGlobal = usersEvaluator.canView();
 
-        usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
-        return userModels.filter(user -> canViewGlobal || usersEvaluator.canView(user))
+        if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+            usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
+            userModels = userModels.filter(usersEvaluator::canView);
+            usersEvaluator.grantIfNoPermission(session.getAttribute(UserModel.GROUPS) != null);
+        }
+
+        UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
+
+        return userModels
                 .map(user -> {
-                    UserRepresentation userRep = briefRepresentationB
-                            ? ModelToRepresentation.toBriefRepresentation(user)
-                            : ModelToRepresentation.toRepresentation(session, realm, user);
-                    userRep.setAccess(usersEvaluator.getAccess(user));
+                    UserProfile profile = provider.create(UserProfileContext.USER_API, user);
+                    UserRepresentation rep = profile.toRepresentation();
+                    UserRepresentation userRep = briefRepresentationB ?
+                            ModelToRepresentation.toBriefRepresentation(user, rep, false) :
+                            ModelToRepresentation.toRepresentation(session, realm, user, rep, false);
+                    userRep.setAccess(usersEvaluator.getAccessForListing(user));
                     return userRep;
                 });
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ext/AdminRealmResourceProvider.java b/services/src/main/java/org/keycloak/services/resources/admin/ext/AdminRealmResourceProvider.java
index 8ca009acec3d..440a91d4921f 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ext/AdminRealmResourceProvider.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ext/AdminRealmResourceProvider.java
@@ -22,7 +22,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.provider.Provider;
 import org.keycloak.services.resources.admin.AdminEventBuilder;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionEvaluator;
 
 /**
  * <p>A {@link AdminRealmResourceProvider} creates JAX-RS <emphasis>sub-resource</emphasis> instances for paths relative
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionEvaluator.java
similarity index 95%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionEvaluator.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionEvaluator.java
index 19abaf4f93ae..83bf1985143c 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionEvaluator.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionEvaluator.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.services.resources.admin.AdminAuth;
 
@@ -26,6 +26,7 @@ public interface AdminPermissionEvaluator {
     RealmPermissionEvaluator realm();
 
     void requireAnyAdminRole();
+    boolean hasOneAdminRole(String... adminRoles);
 
     AdminAuth adminAuth();
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionManagement.java
similarity index 93%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionManagement.java
index b35e5b40995f..343b7a295af6 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissionManagement.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.ResourceServer;
@@ -29,7 +29,7 @@ public interface AdminPermissionManagement {
     public static final String VIEW_SCOPE = "view";
     public static final String TOKEN_EXCHANGE ="token-exchange";
 
-    ClientModel getRealmManagementClient();
+    ClientModel getRealmPermissionsClient();
 
     AuthorizationProvider authz();
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissions.java
new file mode 100644
index 000000000000..912baa2bf1d6
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissions.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.common.Profile;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderEventManager;
+import org.keycloak.services.resources.admin.AdminAuth;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class AdminPermissions {
+
+
+    public static AdminPermissionEvaluator evaluator(KeycloakSession session, RealmModel realm, AdminAuth auth) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            return new MgmtPermissionsV2(session, realm, auth);
+        }
+        return new MgmtPermissions(session, realm, auth);
+    }
+    public static AdminPermissionEvaluator evaluator(KeycloakSession session, RealmModel realm, RealmModel adminsRealm, UserModel admin) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            return new MgmtPermissionsV2(session, adminsRealm, admin);
+        }
+        return new MgmtPermissions(session, realm, adminsRealm, admin);
+    }
+
+    public static RealmsPermissionEvaluator realms(KeycloakSession session, AdminAuth auth) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            return new MgmtPermissionsV2(session, auth);
+        }
+        return new MgmtPermissions(session, auth);
+    }
+
+    public static AdminPermissionManagement management(KeycloakSession session, RealmModel realm) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+             return new MgmtPermissionsV2(session, realm);
+        }
+        return new MgmtPermissions(session, realm);
+    }
+
+    public static void registerListener(ProviderEventManager manager) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+            manager.register(event -> {
+                if (event instanceof RoleContainerModel.RoleRemovedEvent) {
+                    RoleContainerModel.RoleRemovedEvent cast = (RoleContainerModel.RoleRemovedEvent) event;
+                    RoleModel role = cast.getRole();
+                    RealmModel realm;
+                    if (role.getContainer() instanceof ClientModel) {
+                        realm = ((ClientModel) role.getContainer()).getRealm();
+
+                    } else {
+                        realm = (RealmModel) role.getContainer();
+                    }
+                    management(cast.getKeycloakSession(), realm).roles().setPermissionsEnabled(role, false);
+                } else if (event instanceof ClientModel.ClientRemovedEvent) {
+                    ClientModel.ClientRemovedEvent cast = (ClientModel.ClientRemovedEvent) event;
+                    management(cast.getKeycloakSession(), cast.getClient().getRealm()).clients().setPermissionsEnabled(cast.getClient(), false);
+                } else if (event instanceof GroupModel.GroupRemovedEvent) {
+                    GroupModel.GroupRemovedEvent cast = (GroupModel.GroupRemovedEvent) event;
+                    management(cast.getKeycloakSession(), cast.getRealm()).groups().setPermissionsEnabled(cast.getGroup(), false);
+                }
+            });
+        }
+    }
+
+
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionEvaluator.java
new file mode 100644
index 000000000000..017c148e0134
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionEvaluator.java
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
+
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface ClientPermissionEvaluator {
+    boolean isPermissionsEnabled(ClientModel client);
+
+    void setPermissionsEnabled(ClientModel client, boolean enable);
+
+    /**
+     * Throws ForbiddenException if {@link #canListClientScopes()} returns {@code false}.
+     */
+    void requireListClientScopes();
+
+    /**
+     * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
+     */
+    boolean canManage();
+
+    /**
+     * Throws ForbiddenException if {@link #canManage()} returns {@code false}.
+     */
+    void requireManage();
+
+    /**
+     * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
+     */
+    boolean canManageClientScopes();
+
+    /**
+     * Throws ForbiddenException if {@link #canManageClientScopes()} returns {@code false}.
+     */
+    void requireManageClientScopes();
+
+    /**
+     * Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} or {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} roles.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#VIEW}.
+     */
+    boolean canView();
+
+    /**
+     * Returns {@code true} if {@link #canView()} returns {@code true}.
+     * <p/>
+     * Or if the caller has at least one of the {@link AdminRoles#QUERY_CLIENTS} role.
+     * <p/>
+     * V1: or {@link AdminRoles#QUERY_USERS} roles.
+     */
+    boolean canList();
+
+    /**
+     * Returns {@code true} if {@link #canView()} returns {@code true}.
+     */
+    boolean canViewClientScopes();
+
+    /**
+     * Throws ForbiddenException if {@link #canList()} returns {@code false}.
+     */
+    void requireList();
+
+    /**
+     * Returns {@code true} if {@link #canView()} returns {@code true}.
+     * <p/>
+     * Or if the caller has {@link AdminRoles#QUERY_CLIENTS} role.
+     */
+    boolean canListClientScopes();
+
+    /**
+     * Returns {@code true} if {@link #canView()} returns {@code true}.
+     */
+    void requireView();
+
+    /**
+     * Returns {@code true} if {@link #canViewClientScopes()} returns {@code true}.
+     */
+    void requireViewClientScopes();
+
+    /**
+     * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
+     * <p/>
+     * Or if the caller has a permission to {@link AdminPermissionManagement#MANAGE_SCOPE} the client.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MANAGE} all clients.
+     */
+    boolean canManage(ClientModel client);
+
+    /**
+     * Returns {@code true} if {@link #canManage(ClientModel)} returns {@code true}.
+     * <p/>
+     * Or if the caller has a permission to {@link ClientPermissionManagement#CONFIGURE_SCOPE} the client.
+     * <p/>
+     * For V2 only: the call is redirected to {@code canManage(ClientModel)}.
+     */
+    boolean canConfigure(ClientModel client);
+
+    /**
+     * Throws ForbiddenException if {@link #canConfigure(ClientModel)} returns {@code false}.
+     * <p/>
+     * For V2 only: the call is redirected to {@code requireManage(ClientModel)}.
+     */
+    void requireConfigure(ClientModel client);
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(ClientModel)}  returns {@code false}.
+     */
+    void requireManage(ClientModel client);
+
+    /**
+     * Returns {@code true} if {@link #canView()} or {@link #canConfigure(ClientModel)} returns {@code true}.
+     * <p/>
+     * Or if the caller has a permission to {@link AdminPermissionManagement#VIEW_SCOPE} the client.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#VIEW} all clients.
+     */
+    boolean canView(ClientModel client);
+
+    /**
+     * Throws ForbiddenException if {@link #canView(ClientModel)}  returns {@code false}.
+     */
+    void requireView(ClientModel client);
+
+    /**
+     * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} role.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE}.
+     */
+    boolean canManage(ClientScopeModel clientScope);
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(ClientScopeModel)} returns {@code false}.
+     */
+    void requireManage(ClientScopeModel clientScope);
+
+    /**
+     * Returns {@code true} if the caller has at least one of the {@link org.keycloak.models.AdminRoles#VIEW_CLIENTS} or {@link org.keycloak.models.AdminRoles#MANAGE_CLIENTS} roles.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#VIEW}.
+     */
+    boolean canView(ClientScopeModel clientScope);
+
+    /**
+     * Throws ForbiddenException if {@link #canView(ClientScopeModel)} returns {@code false}.
+     */
+    void requireView(ClientScopeModel clientScope);
+
+    /**
+     * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_SCOPE} for the client.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES} for all clients.
+     */
+    boolean canMapRoles(ClientModel client);
+
+    /**
+     * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_COMPOSITE_SCOPE} for the client.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES_COMPOSITE} for all clients.
+     */
+    boolean canMapCompositeRoles(ClientModel client);
+
+    /**
+     * Returns {@code true} if the caller has a permission to {@link ClientPermissionManagement#MAP_ROLES_CLIENT_SCOPE} for the client.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link AdminPermissionsSchema#MAP_ROLES_CLIENT_SCOPE} for all clients.
+     */
+    boolean canMapClientScopeRoles(ClientModel client);
+
+    Map<String, Boolean> getAccess(ClientModel client);
+
+    /**
+     * Returns the IDs of the clients that the current user can perform based on {@code scope}.
+     *
+     * @return Stream of IDs of clients with {@code scope} permission.
+     */
+    Set<String> getClientIdsByScope(String scope);
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionManagement.java
similarity index 97%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionManagement.java
index 75dd57ab485d..337c8a990dd1 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionManagement.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java
similarity index 96%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java
index 603c5cbadaa5..47043edb551a 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java
@@ -14,9 +14,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.jboss.logging.Logger;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.common.ClientModelIdentity;
 import org.keycloak.authorization.common.DefaultEvaluationContext;
@@ -26,6 +27,7 @@
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.store.PolicyStore;
 import org.keycloak.authorization.store.ResourceStore;
 import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
@@ -47,7 +49,8 @@
 
 import jakarta.ws.rs.ForbiddenException;
 
-import static org.keycloak.services.resources.admin.permissions.AdminPermissionManagement.TOKEN_EXCHANGE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
+import static org.keycloak.services.resources.admin.fgap.AdminPermissionManagement.TOKEN_EXCHANGE;
 
 /**
  * Manages default policies for all users.
@@ -63,6 +66,7 @@ class ClientPermissions implements ClientPermissionEvaluator,  ClientPermissionM
     protected final AuthorizationProvider authz;
     protected final MgmtPermissions root;
     protected final ResourceStore resourceStore;
+    protected final PolicyStore policyStore;
 
     private static final String RESOURCE_NAME_PREFIX = "client.resource.";
 
@@ -73,8 +77,10 @@ public ClientPermissions(KeycloakSession session, RealmModel realm, Authorizatio
         this.root = root;
         if (authz != null) {
             resourceStore = authz.getStoreFactory().getResourceStore();
+            policyStore = authz.getStoreFactory().getPolicyStore();
         } else {
             resourceStore = null;
+            policyStore = null;
         }
     }
 
@@ -658,13 +664,14 @@ public boolean canMapClientScopeRoles(ClientModel client) {
     public Map<String, Boolean> getAccess(ClientModel client) {
         Map<String, Boolean> map = new HashMap<>();
         map.put("view", canView(client));
-        map.put("manage", StorageId.isLocalStorage(client) && canManage(client));
-        map.put("configure", StorageId.isLocalStorage(client) && canConfigure(client));
+        boolean isAdminPermissionsClient = AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(realm, client.getId());
+        map.put("manage", !isAdminPermissionsClient && StorageId.isLocalStorage(client) && canManage(client));
+        map.put("configure", !isAdminPermissionsClient && StorageId.isLocalStorage(client) && canConfigure(client));
         return map;
     }
 
     @Override
-    public Set<String> getClientsWithPermission(String scope) {
+    public Set<String> getClientIdsByScope(String scope) {
         if (!root.isAdminSameRealm()) {
             return Collections.emptySet();
         }
@@ -688,7 +695,7 @@ public Set<String> getClientsWithPermission(String scope) {
 
     private boolean hasPermission(Resource resource, String scope) {
         ResourceServer server = root.realmResourceServer();
-        Collection<Permission> permissions = root.evaluatePermission(new ResourcePermission(resource, resource.getScopes(), server), server);
+        Collection<Permission> permissions = root.evaluatePermission(new ResourcePermission(CLIENTS_RESOURCE_TYPE, resource, resource.getScopes(), server), server);
         for (Permission permission : permissions) {
             for (String s : permission.getScopes()) {
                 if (scope.equals(s)) {
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionsV2.java
new file mode 100644
index 000000000000..8e57521908de
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissionsV2.java
@@ -0,0 +1,200 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.services.resources.admin.fgap.ModelRecord.ClientModelRecord;
+
+import java.util.Map;
+import java.util.Set;
+
+class ClientPermissionsV2 extends ClientPermissions {
+
+    private final FineGrainedAdminPermissionEvaluator eval;
+
+    ClientPermissionsV2(KeycloakSession session, RealmModel realm, AuthorizationProvider authz, MgmtPermissionsV2 root) {
+        super(session, realm, authz, root);
+        this.eval = new FineGrainedAdminPermissionEvaluator(session, root, resourceStore, policyStore);
+    }
+
+    @Override
+    public boolean canList() {
+        return root.hasOneAdminRole(AdminRoles.QUERY_CLIENTS) || canView();
+    }
+
+    @Override
+    public void requireConfigure(ClientModel client) {
+        //redirecting call to manage for V2
+        super.requireManage(client);
+    }
+
+    @Override
+    public boolean canConfigure(ClientModel client) {
+        //redirecting call to manage for V2
+        return canManage(client);
+    }
+
+    @Override
+    public boolean canManage(ClientModel client) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(client), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canManage() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(null), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canView(ClientModel client) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS, AdminRoles.VIEW_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(client), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public boolean canView() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS, AdminRoles.VIEW_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(null), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public boolean canMapRoles(ClientModel client) {
+        return eval.hasPermission(new ClientModelRecord(client), null, AdminPermissionsSchema.MAP_ROLES);
+    }
+
+    @Override
+    public boolean canMapCompositeRoles(ClientModel client) {
+        return eval.hasPermission(new ClientModelRecord(client), null, AdminPermissionsSchema.MAP_ROLES_COMPOSITE);
+    }
+
+    @Override
+    public boolean canMapClientScopeRoles(ClientModel client) {
+        return eval.hasPermission(new ClientModelRecord(client), null, AdminPermissionsSchema.MAP_ROLES_CLIENT_SCOPE);
+    }
+
+    @Override
+    public boolean canManageClientScopes() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(null), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canManage(ClientScopeModel clientScope) {
+        return canManageClientScopes();
+    }
+
+    @Override
+    public boolean canView(ClientScopeModel clientScope) {
+        if (root.hasOneAdminRole(AdminRoles.VIEW_CLIENTS, AdminRoles.MANAGE_CLIENTS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new ClientModelRecord(null), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public Set<String> getClientIdsByScope(String scope) {
+        return eval.getIdsByScope(CLIENTS_RESOURCE_TYPE, scope);
+    }
+
+    @Override
+    public boolean canExchangeTo(ClientModel authorizedClient, ClientModel to, AccessToken token) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy exchangeToPermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapRolesPermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapRolesClientScopePermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapRolesCompositePermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy managePermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy configurePermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy viewPermission(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public boolean isPermissionsEnabled(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public void setPermissionsEnabled(ClientModel client, boolean enable) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Resource resource(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Map<String, String> getPermissions(ClientModel client) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/FineGrainedAdminPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/FineGrainedAdminPermissionEvaluator.java
new file mode 100644
index 000000000000..51ee4def4e23
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/FineGrainedAdminPermissionEvaluator.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.model.ResourceWrapper;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.ResourceStore;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.representations.idm.authorization.Permission;
+
+class FineGrainedAdminPermissionEvaluator {
+    private final KeycloakSession session;
+    private final MgmtPermissions root;
+    private final ResourceStore resourceStore;
+    private final PolicyStore policyStore;
+
+    FineGrainedAdminPermissionEvaluator(KeycloakSession session, MgmtPermissions root, ResourceStore resourceStore, PolicyStore policyStore) {
+        this.session = session;
+        this.root = root;
+        this.resourceStore = resourceStore;
+        this.policyStore = policyStore;
+    }
+
+    boolean hasPermission(ModelRecord model, EvaluationContext context, String scope) {
+        return hasPermission(model.getId(), model.getResourceType(), context, scope);
+    }
+
+    boolean hasPermission(String modelId, String resourceType, EvaluationContext context, String scope) {
+        if (!root.isAdminSameRealm()) {
+            return false;
+        }
+
+        ResourceServer server = root.realmResourceServer();
+
+        if (server == null) {
+            return false;
+        }
+
+        Resource resourceTypeResource = AdminPermissionsSchema.SCHEMA.getResourceTypeResource(session, server, resourceType);
+        Resource resource = modelId == null ? resourceTypeResource : resourceStore.findByName(server, modelId);
+
+        if (modelId != null && resource == null) {
+            resource = new ResourceWrapper(modelId, modelId, new HashSet<>(resourceTypeResource.getScopes()), server);
+        }
+
+        Collection<Permission> permissions = (context == null) ?
+                root.evaluatePermission(new ResourcePermission(resourceType, resource, resource.getScopes(), server), server) :
+                root.evaluatePermission(new ResourcePermission(resourceType, resource, resource.getScopes(), server), server, context);
+
+        for (Permission permission : permissions) {
+            if (permission.getResourceId().equals(resource.getId())) {
+                if (permission.getScopes().contains(scope)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    Set<String> getIdsByScope(String resourceType, String scope) {
+        if (!root.isAdminSameRealm()) {
+            return Collections.emptySet();
+        }
+
+        ResourceServer server = root.realmResourceServer();
+
+        if (server == null) {
+            return Collections.emptySet();
+        }
+
+        return policyStore.findByResourceType(server, resourceType).stream()
+                .flatMap((Function<Policy, Stream<Resource>>) policy -> policy.getResources().stream())
+                .filter(resource -> hasPermission(resource.getName(), resourceType, null, scope))
+                .map(Resource::getName)
+                .collect(Collectors.toSet());
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionEvaluator.java
new file mode 100644
index 000000000000..433c17546da9
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionEvaluator.java
@@ -0,0 +1,144 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.GroupModel;
+
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface GroupPermissionEvaluator {
+
+    /**
+     * Returns {@code true} if the caller has at least one of {@link AdminRoles#QUERY_GROUPS},
+     * {@link AdminRoles#MANAGE_USERS} or {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * For V2 only: Also if it has a permission to {@link AdminPermissionsSchema#VIEW} or
+     * {@link AdminPermissionsSchema#MANAGE} groups.
+     */
+    boolean canList();
+
+    /**
+     * Throws ForbiddenException if {@link #canList()} returns {@code false}.
+     */
+    void requireList();
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE} the group.
+     */
+    boolean canManage(GroupModel group);
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(GroupModel)} returns {@code false}.
+     */
+    void requireManage(GroupModel group);
+
+    /**
+     * Returns {@code true} if the caller has one of {@link AdminRoles#MANAGE_USERS} or
+     * {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW} the group.
+     */
+    boolean canView(GroupModel group);
+
+    /**
+     * Throws ForbiddenException if {@link #canView(GroupModel)} returns {@code false}.
+     */
+    void requireView(GroupModel group);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * For V2 only: Also if it has permission to {@link AdminPermissionsSchema#MANAGE} groups.
+     */
+    boolean canManage();
+
+    /**
+     * Throws ForbiddenException if {@link #canManage()} returns {@code false}.
+     */
+    void requireManage();
+
+    /**
+     * Returns {@code true} if the caller has one of {@link AdminRoles#MANAGE_USERS} or 
+     * {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW} groups.
+     */
+    boolean canView();
+
+    /**
+     * Throws ForbiddenException if {@link #canView()} returns {@code false}.
+     */
+    void requireView();
+
+    /**
+     * Throws ForbiddenException if {@link #canViewMembers(GroupModel)} returns {@code false}.
+     */
+    void requireViewMembers(GroupModel group);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE_MEMBERS} of the group.
+     */
+    boolean canManageMembers(GroupModel group);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE_MEMBERSHIP} of the group.
+     */
+    boolean canManageMembership(GroupModel group);
+
+    /**
+     * Returns {@code true} if the caller has one of {@link AdminRoles#MANAGE_USERS} or 
+     * {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW_MEMBERS} of the group.
+     */
+    boolean canViewMembers(GroupModel group);
+
+    /**
+     * Throws ForbiddenException if {@link #canManageMembership(GroupModel)} returns {@code false}.
+     */
+    void requireManageMembership(GroupModel group);
+
+    /**
+     * Throws ForbiddenException if {@link #canManageMembership(GroupModel)} returns {@code false}.
+     */
+    void requireManageMembers(GroupModel group);
+
+    /**
+     * Returns Map with information what access the caller for the provided group has.
+     */
+    Map<String, Boolean> getAccess(GroupModel group);
+
+    /**
+     * If {@link UserPermissionEvaluator#canView()} evaluates to {@code true}, returns empty set.
+     * 
+     * @return Stream of IDs of groups with view permission.
+     */
+    Set<String> getGroupIdsWithViewPermission();
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionManagement.java
similarity index 96%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionManagement.java
index 2ec602c54bfc..bad7de3648c8 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionManagement.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissions.java
similarity index 93%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissions.java
index b32bc01c2b15..2f4e08222442 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissions.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
@@ -53,9 +53,9 @@ class GroupPermissions implements GroupPermissionEvaluator, GroupPermissionManag
     private static final String RESOURCE_NAME_PREFIX = "group.resource.";
 
     private final AuthorizationProvider authz;
-    private final MgmtPermissions root;
-    private final ResourceStore resourceStore;
-    private final PolicyStore policyStore;
+    protected final MgmtPermissions root;
+    protected final ResourceStore resourceStore;
+    protected final PolicyStore policyStore;
 
     GroupPermissions(AuthorizationProvider authz, MgmtPermissions root) {
         this.authz = authz;
@@ -73,7 +73,6 @@ private static String getGroupResourceName(GroupModel group) {
         return RESOURCE_NAME_PREFIX + group.getId();
     }
 
-
     private static String getManagePermissionGroup(GroupModel group) {
         return "manage.permission.group." + group.getId();
     }
@@ -147,7 +146,7 @@ private void initialize(GroupModel group) {
 
     @Override
     public boolean canList() {
-        return canView() || root.hasOneAdminRole(AdminRoles.VIEW_USERS, AdminRoles.MANAGE_USERS, AdminRoles.QUERY_GROUPS);
+        return root.hasOneAdminRole(AdminRoles.QUERY_GROUPS) || canView();
     }
 
     @Override
@@ -273,7 +272,7 @@ public void requireView(GroupModel group) {
 
     @Override
     public boolean canManage() {
-        return root.users().canManageDefault();
+        return root.hasOneAdminRole(AdminRoles.MANAGE_USERS);
     }
 
     @Override
@@ -282,9 +281,10 @@ public void requireManage() {
             throw new ForbiddenException();
         }
     }
+
     @Override
     public boolean canView() {
-        return root.users().canViewDefault();
+        return root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS);
     }
 
     @Override
@@ -295,24 +295,8 @@ public void requireView() {
     }
 
     @Override
-    public boolean getGroupsWithViewPermission(GroupModel group) {
-        if (root.users().canView() || root.users().canManage()) {
-            return true;
-        }
-
-        if (!root.isAdminSameRealm()) {
-            return false;
-        }
-
-        ResourceServer server = root.realmResourceServer();
-        if (server == null) return false;
-
-        return hasPermission(group, VIEW_MEMBERS_SCOPE, MANAGE_MEMBERS_SCOPE);
-    }
-
-    @Override
-    public Set<String> getGroupsWithViewPermission() {
-        if (root.users().canView() || root.users().canManage()) return Collections.emptySet();
+    public Set<String> getGroupIdsWithViewPermission() {
+        if (root.users().canView()) return Collections.emptySet();
 
         if (!root.isAdminSameRealm()) {
             return Collections.emptySet();
@@ -337,7 +321,7 @@ public Set<String> getGroupsWithViewPermission() {
 
     @Override
     public void requireViewMembers(GroupModel group) {
-        if (!getGroupsWithViewPermission(group)) {
+        if (!canViewMembers(group)) {
             throw new ForbiddenException();
         }
     }
@@ -353,7 +337,7 @@ public boolean canViewMembers(GroupModel group) {
         ResourceServer server = root.realmResourceServer();
         if (server == null) return false;
 
-        return hasPermission(group, VIEW_MEMBERS_SCOPE);
+        return hasPermission(group, VIEW_MEMBERS_SCOPE, MANAGE_MEMBERS_SCOPE);
     }
 
     @Override
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionsV2.java
new file mode 100644
index 000000000000..1b88aa9a5563
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/GroupPermissionsV2.java
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import java.util.Map;
+import java.util.Set;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resources.admin.fgap.ModelRecord.GroupModelRecord;
+
+class GroupPermissionsV2 extends GroupPermissions {
+
+    private final FineGrainedAdminPermissionEvaluator eval;
+
+    GroupPermissionsV2(KeycloakSession session, AuthorizationProvider authz, MgmtPermissions root) {
+        super(authz, root);
+        this.eval = new FineGrainedAdminPermissionEvaluator(session, root, resourceStore, policyStore);
+    }
+
+    @Override
+    public boolean canView() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(null), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public boolean canView(GroupModel group) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(group), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public boolean canManage() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(null), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canManage(GroupModel group) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(group), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canViewMembers(GroupModel group) {
+        if (root.hasOneAdminRole(AdminRoles.VIEW_USERS, AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(group), null, AdminPermissionsSchema.VIEW_MEMBERS);
+    }
+
+    @Override
+    public boolean canManageMembers(GroupModel group) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(group), null, AdminPermissionsSchema.MANAGE_MEMBERS);
+    }
+
+    @Override
+    public boolean canManageMembership(GroupModel group) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new GroupModelRecord(group), null, AdminPermissionsSchema.MANAGE_MEMBERSHIP);
+    }
+
+    @Override
+    public Set<String> getGroupIdsWithViewPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public boolean isPermissionsEnabled(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public void setPermissionsEnabled(GroupModel group, boolean enable) {
+       throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy viewMembersPermission(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy manageMembersPermission(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy manageMembershipPermission(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy viewPermission(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy managePermission(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Resource resource(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Map<String, String> getPermissions(GroupModel group) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/Helper.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/Helper.java
similarity index 98%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/Helper.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/Helper.java
index 84b5a632fc8c..9bf12fdf0a8c 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/Helper.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/Helper.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissionManagement.java
similarity index 96%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissionManagement.java
index a5b595dfea21..9afb2dba371b 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissionManagement.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissions.java
similarity index 97%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissions.java
index b56559b09e85..ae2e25b21687 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/IdentityProviderPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissions.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.jboss.logging.Logger;
 import org.keycloak.authorization.AuthorizationProvider;
@@ -37,7 +37,7 @@
 import java.util.Map;
 import java.util.Set;
 
-import static org.keycloak.services.resources.admin.permissions.AdminPermissionManagement.TOKEN_EXCHANGE;
+import static org.keycloak.services.resources.admin.fgap.AdminPermissionManagement.TOKEN_EXCHANGE;
 
 /**
  * Manages default policies for identity providers.
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissions.java
similarity index 82%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissions.java
index 5c7a0d2ee4a0..5a6cd59310e8 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissions.java
@@ -14,48 +14,39 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.AuthorizationProviderFactory;
 import org.keycloak.authorization.common.DefaultEvaluationContext;
 import org.keycloak.authorization.common.KeycloakIdentity;
-import org.keycloak.authorization.common.UserModelIdentity;
 import org.keycloak.authorization.identity.Identity;
+import org.keycloak.authorization.identity.UserModelIdentity;
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.evaluation.EvaluationContext;
 import org.keycloak.common.Profile;
-import org.keycloak.events.EventBuilder;
-import org.keycloak.events.EventType;
 import org.keycloak.models.AdminRoles;
-import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientSessionContext;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.UserSessionProvider;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.authorization.Permission;
+import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.resources.admin.AdminAuth;
 
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
-import java.util.Map;
 
 import jakarta.ws.rs.ForbiddenException;
-import org.keycloak.services.util.DefaultClientSessionContext;
-import org.keycloak.services.util.UserSessionUtil;
-import org.keycloak.utils.RoleResolveUtil;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -82,7 +73,7 @@ class MgmtPermissions implements AdminPermissionEvaluator, AdminPermissionManage
         this.session = session;
         this.realm = realm;
         KeycloakSessionFactory keycloakSessionFactory = session.getKeycloakSessionFactory();
-        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) {
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
             AuthorizationProviderFactory factory = (AuthorizationProviderFactory) keycloakSessionFactory.getProviderFactory(AuthorizationProvider.class);
             this.authz = factory.create(session, realm);
         }
@@ -108,28 +99,8 @@ class MgmtPermissions implements AdminPermissionEvaluator, AdminPermissionManage
     }
 
     private void initIdentity(KeycloakSession session, AdminAuth auth) {
-        final String issuedFor = auth.getToken().getIssuedFor();
         AccessToken accessToken = auth.getToken();
-        ClientModel client = adminsRealm.getClientByClientId(issuedFor);
-        //support for lightweight access token and transient session
-        boolean isAlwaysUseLightweightAccessToken = Boolean.parseBoolean(client.getAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED));
-        if (isAlwaysUseLightweightAccessToken || accessToken.getSubject() == null || (accessToken.getSessionId() == null && accessToken.getResourceAccess().isEmpty() && accessToken.getRealmAccess() == null)) {
-            //get user session
-            EventBuilder event = new EventBuilder(adminsRealm, session);
-            event.event(EventType.INTROSPECT_TOKEN);
-            UserSessionModel userSession = UserSessionUtil.findValidSession(session, adminsRealm, accessToken, event, client);
-
-            if (userSession != null) {
-                //get client session
-                AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
-                //set realm roles
-                ClientSessionContext clientSessionCtx = DefaultClientSessionContext.fromClientSessionAndScopeParameter(clientSession, auth.getToken().getScope(), session);
-                AccessToken.Access realmAccess = RoleResolveUtil.getResolvedRealmRoles(session, clientSessionCtx, false);
-                Map<String, AccessToken.Access> clientAccess = RoleResolveUtil.getAllResolvedClientRoles(session, clientSessionCtx);
-                accessToken.setRealmAccess(realmAccess);
-                accessToken.setResourceAccess(clientAccess);
-            }
-        }
+        AuthenticationManager.resolveLightweightAccessTokenRoles(session, accessToken, adminsRealm);
         this.identity = new KeycloakIdentity(accessToken, session, adminsRealm);
     }
 
@@ -148,15 +119,12 @@ private void initIdentity(KeycloakSession session, AdminAuth auth) {
     }
 
     @Override
-    public ClientModel getRealmManagementClient() {
-        ClientModel client = null;
+    public ClientModel getRealmPermissionsClient() {
         if (realm.getName().equals(Config.getAdminRealm())) {
-            client = realm.getClientByClientId(Config.getAdminRealm() + "-realm");
+            return realm.getClientByClientId(Config.getAdminRealm() + "-realm");
         } else {
-            client = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-
+            return realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
         }
-        return client;
     }
 
     @Override
@@ -164,8 +132,6 @@ public AuthorizationProvider authz() {
         return authz;
     }
 
-
-
     @Override
     public void requireAnyAdminRole() {
         if (!hasAnyAdminRole()) {
@@ -181,8 +147,8 @@ public boolean hasAnyAdminRole(RealmModel realm) {
         return hasOneAdminRole(realm, AdminRoles.ALL_REALM_ROLES);
     }
 
+    @Override
     public boolean hasOneAdminRole(String... adminRoles) {
-        RealmModel realm = this.realm;
         return hasOneAdminRole(realm, adminRoles);
     }
 
@@ -239,7 +205,7 @@ public UserPermissions users() {
     @Override
     public RealmPermissions realm() {
         if (realmPermissions != null) return realmPermissions;
-        realmPermissions = new RealmPermissions(session, realm, authz, this);
+        realmPermissions = new RealmPermissions(this);
         return realmPermissions;
     }
 
@@ -276,7 +242,7 @@ public ResourceServer resourceServer(ClientModel client) {
     public ResourceServer realmResourceServer() {
         if (authz == null) return null;
         if (realmResourceServer != null) return realmResourceServer;
-        ClientModel client = getRealmManagementClient();
+        ClientModel client = getRealmPermissionsClient();
         if (client == null) return null;
         realmResourceServer = authz.getStoreFactory().getResourceServerStore().findByClient(client);
         return realmResourceServer;
@@ -286,7 +252,7 @@ public ResourceServer realmResourceServer() {
     public ResourceServer initializeRealmResourceServer() {
         if (authz == null) return null;
         if (realmResourceServer != null) return realmResourceServer;
-        ClientModel client = getRealmManagementClient();
+        ClientModel client = getRealmPermissionsClient();
         if (client == null) return null;
         realmResourceServer = authz.getStoreFactory().getResourceServerStore().findByClient(client);
         if (realmResourceServer == null) {
@@ -357,6 +323,10 @@ public Collection<Permission> evaluatePermission(ResourcePermission permission,
         return evaluatePermission(permission, resourceServer, new DefaultEvaluationContext(identity, session));
     }
 
+    public Collection<Permission> evaluatePermission(List<ResourcePermission> permission, ResourceServer resourceServer) {
+        return evaluatePermission(permission, resourceServer, new DefaultEvaluationContext(identity, session));
+    }
+
     public Collection<Permission> evaluatePermission(ResourcePermission permission, ResourceServer resourceServer, EvaluationContext context) {
         return evaluatePermission(Arrays.asList(permission), resourceServer, context);
     }
@@ -374,7 +344,7 @@ public Collection<Permission> evaluatePermission(List<ResourcePermission> permis
         RealmModel oldRealm = session.getContext().getRealm();
         try {
             session.getContext().setRealm(realm);
-            return authz.evaluators().from(permissions, context).evaluate(resourceServer, null);
+            return authz.evaluators().from(permissions, resourceServer, context).evaluate(resourceServer, null);
         } finally {
             session.getContext().setRealm(oldRealm);
         }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissionsV2.java
new file mode 100644
index 000000000000..4e9fe051c28b
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/MgmtPermissionsV2.java
@@ -0,0 +1,92 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.resources.admin.AdminAuth;
+
+class MgmtPermissionsV2 extends MgmtPermissions {
+
+    private ClientPermissionsV2 clientPermissions;
+
+    private GroupPermissionsV2 groupPermissions;
+
+    private RolePermissionsV2 rolePermissions;
+
+    private UserPermissionsV2 userPermissions;
+
+    private RealmPermissionsV2 realmPermissions;
+
+    public MgmtPermissionsV2(KeycloakSession session, RealmModel realm) {
+        super(session, realm);
+    }
+
+    public MgmtPermissionsV2(KeycloakSession session, RealmModel realm, AdminAuth auth) {
+        super(session, realm, auth);
+    }
+
+    public MgmtPermissionsV2(KeycloakSession session, AdminAuth auth) {
+        super(session, auth);
+    }
+
+    public MgmtPermissionsV2(KeycloakSession session, RealmModel adminsRealm, UserModel admin) {
+        super(session, adminsRealm, admin);
+    }
+
+    @Override
+    public ClientModel getRealmPermissionsClient() {
+        return realm.getAdminPermissionsClient();
+    }
+
+    @Override
+    public RealmPermissions realm() {
+        if (realmPermissions != null) return realmPermissions;
+        realmPermissions = new RealmPermissionsV2(this);
+        return realmPermissions;
+    }
+
+    @Override
+    public GroupPermissions groups() {
+        if (groupPermissions != null) return groupPermissions;
+        groupPermissions = new GroupPermissionsV2(session, authz, this);
+        return groupPermissions;
+    }
+
+    @Override
+    public RolePermissions roles() {
+        if (rolePermissions != null) return rolePermissions;
+        rolePermissions = new RolePermissionsV2(session, realm, authz, this);
+        return rolePermissions;
+    }
+
+    @Override
+    public UserPermissions users() {
+        if (userPermissions != null) return userPermissions;
+        userPermissions = new UserPermissionsV2(session, authz, this);
+        return userPermissions;
+    }
+
+    @Override
+    public ClientPermissions clients() {
+        if (clientPermissions != null) return clientPermissions;
+        clientPermissions = new ClientPermissionsV2(session, realm, authz, this);
+        return clientPermissions;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/ModelRecord.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ModelRecord.java
new file mode 100644
index 000000000000..43e5c1f520a2
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/ModelRecord.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+
+sealed interface ModelRecord {
+
+    record ClientModelRecord(ClientModel client) implements ModelRecord {
+        @Override
+        public String getResourceType() {
+            return AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
+        }
+
+        @Override
+        public String getId() {
+            return client == null ? null : client.getId();
+        }
+    }
+
+    record GroupModelRecord(GroupModel group) implements ModelRecord {
+        @Override
+        public String getResourceType() {
+            return AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+        }
+
+        @Override
+        public String getId() {
+            return group == null ? null : group.getId();
+        }
+    }
+
+    record RoleModelRecord(RoleModel role) implements ModelRecord {
+        @Override
+        public String getResourceType() {
+            return AdminPermissionsSchema.ROLES_RESOURCE_TYPE;
+        }
+
+        @Override
+        public String getId() {
+            return role == null ? null : role.getId();
+        }
+    }
+
+    record UserModelRecord(UserModel user) implements ModelRecord {
+        @Override
+        public String getResourceType() {
+            return AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+        }
+
+        @Override
+        public String getId() {
+            return user == null ? null : user.getId();
+        }
+    }
+
+    String getId();
+    String getResourceType();
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmAuth.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmAuth.java
similarity index 95%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmAuth.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmAuth.java
index 2834db5275bd..4e84afb25003 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmAuth.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmAuth.java
@@ -15,11 +15,10 @@
  * limitations under the License.
  */
 
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ImpersonationConstants;
 import org.keycloak.services.resources.admin.AdminAuth;
 
 import jakarta.ws.rs.ForbiddenException;
@@ -111,7 +110,7 @@ private String getManageRole(AdminAuth.Resource resource) {
             case IDENTITY_PROVIDER:
                 return AdminRoles.MANAGE_IDENTITY_PROVIDERS;
             case IMPERSONATION:
-                return ImpersonationConstants.IMPERSONATION_ROLE;
+                return AdminRoles.IMPERSONATION;
             case AUTHORIZATION:
                 return AdminRoles.MANAGE_AUTHORIZATION;
             default:
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionEvaluator.java
similarity index 79%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissionEvaluator.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionEvaluator.java
index a80ff577dac1..2a2ca11ee79f 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissionEvaluator.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionEvaluator.java
@@ -14,7 +14,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.model.ResourceServer;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -41,13 +43,13 @@ public interface RealmPermissionEvaluator {
 
     void requireManageIdentityProviders();
 
-    boolean canManageAuthorization();
+    boolean canManageAuthorization(ResourceServer resourceServer);
 
-    boolean canViewAuthorization();
+    boolean canViewAuthorization(ResourceServer resourceServer);
 
-    void requireManageAuthorization();
+    void requireManageAuthorization(ResourceServer resourceServer);
 
-    void requireViewAuthorization();
+    void requireViewAuthorization(ResourceServer resourceServer);
 
     boolean canManageEvents();
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissions.java
similarity index 80%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissions.java
index fc6823fdfe84..77413f6cf371 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissions.java
@@ -14,38 +14,24 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
-import org.jboss.logging.Logger;
-import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.models.AdminRoles;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-
 import jakarta.ws.rs.ForbiddenException;
 
 /**
- * Manages default policies for all users.
- *
- *
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 class RealmPermissions implements RealmPermissionEvaluator {
-    private static final Logger logger = Logger.getLogger(RealmPermissions.class);
-    protected final KeycloakSession session;
-    protected final RealmModel realm;
-    protected final AuthorizationProvider authz;
+
     protected final MgmtPermissions root;
 
-    public RealmPermissions(KeycloakSession session, RealmModel realm, AuthorizationProvider authz, MgmtPermissions root) {
-        this.session = session;
-        this.realm = realm;
-        this.authz = authz;
+    public RealmPermissions(MgmtPermissions root) {
         this.root = root;
     }
 
-
     public boolean canManageRealmDefault() {
         return root.hasOneAdminRole(AdminRoles.MANAGE_REALM);
 
@@ -62,11 +48,11 @@ public boolean canViewIdentityProvidersDefault() {
         return root.hasOneAdminRole(AdminRoles.MANAGE_IDENTITY_PROVIDERS, AdminRoles.VIEW_IDENTITY_PROVIDERS);
     }
 
-    public boolean canManageAuthorizationDefault() {
+    public boolean canManageAuthorizationDefault(ResourceServer resourceServer) {
         return root.hasOneAdminRole(AdminRoles.MANAGE_AUTHORIZATION, AdminRoles.MANAGE_CLIENTS);
 
     }
-    public boolean canViewAuthorizationDefault() {
+    public boolean canViewAuthorizationDefault(ResourceServer resourceServer) {
         return root.hasOneAdminRole(AdminRoles.MANAGE_AUTHORIZATION, AdminRoles.VIEW_AUTHORIZATION);
     }
     public boolean canManageEventsDefault() {
@@ -88,7 +74,6 @@ public void requireViewRealmNameList() {
         }
     }
 
-
     @Override
     public boolean canManageRealm() {
         return canManageRealmDefault();
@@ -139,24 +124,24 @@ public void requireManageIdentityProviders() {
 
 
     @Override
-    public boolean canManageAuthorization() {
-        return canManageAuthorizationDefault();
+    public boolean canManageAuthorization(ResourceServer resourceServer) {
+        return canManageAuthorizationDefault(resourceServer);
     }
 
     @Override
-    public boolean canViewAuthorization() {
-        return canViewAuthorizationDefault();
+    public boolean canViewAuthorization(ResourceServer resourceServer) {
+        return canViewAuthorizationDefault(resourceServer);
     }
 
     @Override
-    public void requireManageAuthorization() {
-        if (!canManageAuthorization()) {
+    public void requireManageAuthorization(ResourceServer resourceServer) {
+        if (!canManageAuthorization(resourceServer)) {
             throw new ForbiddenException();
         }
     }
     @Override
-    public void requireViewAuthorization() {
-        if (!canViewAuthorization()) {
+    public void requireViewAuthorization(ResourceServer resourceServer) {
+        if (!canViewAuthorization(resourceServer)) {
             throw new ForbiddenException();
         }
     }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionsV2.java
new file mode 100644
index 000000000000..b3e331df4571
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmPermissionsV2.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.models.ClientModel;
+
+class RealmPermissionsV2 extends RealmPermissions {
+
+    public RealmPermissionsV2(MgmtPermissions root) {
+        super(root);
+    }
+
+    @Override
+    public boolean canManageAuthorizationDefault(ResourceServer resourceServer) {
+        if (resourceServer == null) {
+            return super.canManageAuthorizationDefault(resourceServer);
+        }
+
+        return root.clients().canManage(getClient(resourceServer));
+    }
+
+    @Override
+    public boolean canViewAuthorizationDefault(ResourceServer resourceServer) {
+        if (resourceServer == null) {
+            return super.canViewAuthorizationDefault(resourceServer);
+        }
+
+        return root.clients().canView(getClient(resourceServer));
+    }
+
+    private ClientModel getClient(ResourceServer resourceServer) {
+        ClientModel client = root.session.clients().getClientById(root.realm, resourceServer.getId());
+        return client;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmsPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmsPermissionEvaluator.java
similarity index 94%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmsPermissionEvaluator.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmsPermissionEvaluator.java
index 5286d103d1f4..8932bbb858ed 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmsPermissionEvaluator.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RealmsPermissionEvaluator.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.models.RealmModel;
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionEvaluator.java
new file mode 100644
index 000000000000..b110dec6bc83
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionEvaluator.java
@@ -0,0 +1,150 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface RolePermissionEvaluator {
+
+    /**
+     * Returns {@code true} if {@link #canView(RoleContainerModel)} returns {@code true}.
+     * <p/>
+     * Or if the role is a realm role, then it returns {@code true} if {@link RealmPermissionEvaluator#canViewRealm()} returns true
+     * or if the caller has at least one of the {@link org.keycloak.models.AdminRoles#QUERY_USERS}, {@link org.keycloak.models.AdminRoles#QUERY_USERS},
+     * {@link org.keycloak.models.AdminRoles#QUERY_CLIENTS}, {@link org.keycloak.models.AdminRoles#QUERY_REALMS}, {@link org.keycloak.models.AdminRoles#QUERY_GROUPS} roles.
+     * <p/>
+     */
+    boolean canList(RoleContainerModel container);
+
+    /**
+     * Throws ForbiddenException if {@link #canList(RoleContainerModel)} returns {@code false}.
+     */
+    void requireList(RoleContainerModel container);
+
+
+    /**
+     * Returns {@code true} if the caller has {@link org.keycloak.models.AdminRoles#MANAGE_USERS} role and
+     * {@link RolePermissions#checkAdminRoles(RoleModel)} returns {@code true}.
+     * <p/>
+     * Or if the role is a client role and {@link ClientPermissions#canMapRoles(ClientModel)} returns {@code true}.
+     * <p/>
+     * Or if the caller has permission to {@link RolePermissionManagement#MAP_ROLE_SCOPE} and {@link RolePermissions#checkAdminRoles(RoleModel)} returns {@code true}.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link RolePermissionManagement#MAP_ROLE_SCOPE} all roles.
+     */
+    boolean canMapRole(RoleModel role);
+
+    /**
+     * Throws ForbiddenException if {@link #canMapRole(RoleModel)} returns {@code false}.
+     */
+    void requireMapRole(RoleModel role);
+
+    /**
+     * If the role is a realm role, it returns {@code true} if {@link RealmPermissions#canManageRealm()} returns {@code true}.
+     * <p/>
+     * If the role is a client role, it returns {@code true} if {@link ClientPermissions#canConfigure(ClientModel)} returns {@code true}.
+     */
+    boolean canManage(RoleModel role);
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(RoleModel)} returns {@code false}.
+     */
+    void requireManage(RoleModel role);
+
+    /**
+     * If the role is a realm role, it returns {@code true} if {@link RealmPermissions#canViewRealm()} returns {@code true}.
+     * <p/>
+     * If the role is a client role, it returns {@code true} if {@link ClientPermissions#canView(ClientModel)} returns {@code true}.
+     */
+    boolean canView(RoleModel role);
+
+    /**
+     * Throws ForbiddenException if {@link #canView(RoleModel)} returns {@code false}.
+     */
+    void requireView(RoleModel role);
+
+    /**
+     * Returns {@code true} if {@link ClientPermissions#canManageClientsDefault()} returns {@code true}.
+     * <p/>
+     * Or if the role is a client role and {@link ClientPermissions#canMapClientScopeRoles(ClientModel)} returns {@code true}.
+     * <p/>
+     * Or if the caller has permission to {@link RolePermissionManagement#MAP_ROLE_CLIENT_SCOPE_SCOPE}.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link RolePermissionManagement#MAP_ROLE_CLIENT_SCOPE_SCOPE} all roles.
+     */
+    boolean canMapClientScope(RoleModel role);
+
+    /**
+     * Throws ForbiddenException if {@link #canMapClientScope(RoleModel)} returns {@code false}.
+     */
+    void requireMapClientScope(RoleModel role);
+
+    /**
+     * Returns {@code true} if {@link RolePermissions#canManageDefault(RoleModel)} and {@link RolePermissions#checkAdminRoles(RoleModel)} returns {@code true}.
+     * <p/>
+     * Or if the role is a client role and {@link ClientPermissions#canMapCompositeRoles(ClientModel)} returns {@code true}.
+     * <p/>
+     * Or if the caller has permission to {@link RolePermissionManagement#MAP_ROLE_COMPOSITE_SCOPE} and {@link RolePermissions#checkAdminRoles(RoleModel)} returns {@code true}.
+     * <p/>
+     * For V2 only: Also if the caller has a permission to {@link RolePermissionManagement#MAP_ROLE_COMPOSITE_SCOPE} all roles.
+     */
+    boolean canMapComposite(RoleModel role);
+
+    /**
+     * Throws ForbiddenException if {@link #canMapComposite(RoleModel)} returns {@code false}.
+     */
+    void requireMapComposite(RoleModel role);
+
+    /**
+     * If the role is a realm role, it returns {@code true} if {@link RealmPermissions#canManageRealm()} returns {@code true}.
+     * <p/>
+     * If the role is a client role, it returns {@code true} if {@link ClientPermissions#canConfigure(ClientModel)} returns {@code true}.
+     */
+    boolean canManage(RoleContainerModel container);
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(RoleContainerModel)} returns {@code false}.
+     */
+    void requireManage(RoleContainerModel container);
+
+    /**
+     * If the role is a realm role, it returns {@code true} if {@link RealmPermissions#canViewRealm()} returns {@code true}.
+     * <p/>
+     * If the role is a client role, it returns {@code true} if {@link ClientPermissions#canView(ClientModel)} returns {@code true}.
+     */
+    boolean canView(RoleContainerModel container);
+
+    /**
+     * Throws ForbiddenException if {@link #canView(RoleContainerModel)} returns {@code false}.
+     */
+    void requireView(RoleContainerModel container);
+
+    /**
+     * Returns the IDs of the roles that the current user can perform based on {@code scope}.
+     *
+     * @return Stream of IDs of roles with {@code scope} permission.
+     */
+    Set<String> getRoleIdsByScope(String scope);
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionManagement.java
similarity index 96%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionManagement.java
index 977e109d3e4c..3ed65655de86 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionManagement.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissions.java
similarity index 94%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissions.java
index f8a976c10438..003be46cd168 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissions.java
@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
@@ -24,10 +24,10 @@
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.model.Scope;
 import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.store.PolicyStore;
 import org.keycloak.authorization.store.ResourceStore;
 import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ImpersonationConstants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
@@ -54,7 +54,8 @@ class RolePermissions implements RolePermissionEvaluator, RolePermissionManageme
     protected final RealmModel realm;
     protected final AuthorizationProvider authz;
     protected final MgmtPermissions root;
-    private final ResourceStore resourceStore;
+    protected final ResourceStore resourceStore;
+    protected final PolicyStore policyStore;
     private static final String RESOURCE_NAME_PREFIX = "role.resource.";
 
     public RolePermissions(KeycloakSession session, RealmModel realm, AuthorizationProvider authz, MgmtPermissions root) {
@@ -64,8 +65,10 @@ public RolePermissions(KeycloakSession session, RealmModel realm, AuthorizationP
         this.root = root;
         if (authz != null) {
             resourceStore = authz.getStoreFactory().getResourceStore();
+            policyStore = authz.getStoreFactory().getPolicyStore();
         } else {
             resourceStore = null;
+            policyStore = null;
         }
     }
 
@@ -150,7 +153,7 @@ private boolean checkAdminRoles(RoleModel role) {
         if (AdminRoles.ALL_ROLES.contains(role.getName())) {
             if (root.admin().hasRole(role)) return true;
 
-            ClientModel adminClient = root.getRealmManagementClient();
+            ClientModel adminClient = root.getRealmPermissionsClient();
             // is this an admin role in 'realm-management' client of the realm we are managing?
             if (adminClient.equals(role.getContainer())) {
                 // if this is realm admin role, then check to see if admin has similar permissions
@@ -179,13 +182,15 @@ private boolean checkAdminRoles(RoleModel role) {
                 } else if (role.getName().equals(AdminRoles.QUERY_GROUPS)) {
                     return true;
                 } else if (role.getName().equals(AdminRoles.MANAGE_AUTHORIZATION)) {
-                    if (!root.realm().canManageAuthorization()) {
+                    ResourceServer resourceServer = getResourceServer(role);
+                    if (!root.realm().canManageAuthorization(resourceServer)) {
                         return adminConflictMessage(role);
                     } else {
                         return true;
                     }
                 } else if (role.getName().equals(AdminRoles.VIEW_AUTHORIZATION)) {
-                    if (!root.realm().canViewAuthorization()) {
+                    ResourceServer resourceServer = getResourceServer(role);
+                    if (!root.realm().canViewAuthorization(resourceServer)) {
                         return adminConflictMessage(role);
                     } else {
                         return true;
@@ -238,7 +243,7 @@ private boolean checkAdminRoles(RoleModel role) {
                     } else {
                         return true;
                     }
-                } else if (role.getName().equals(ImpersonationConstants.IMPERSONATION_ROLE)) {
+                } else if (role.getName().equals(AdminRoles.IMPERSONATION)) {
                     if (!root.users().canImpersonate()) {
                         return adminConflictMessage(role);
                     } else {
@@ -299,7 +304,7 @@ private boolean adminConflictMessage(RoleModel role) {
      */
     @Override
     public boolean canMapRole(RoleModel role) {
-        if (root.users().canManageDefault()) return checkAdminRoles(role);
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) return checkAdminRoles(role);
         if (!root.isAdminSameRealm()) {
             return false;
         }
@@ -514,20 +519,20 @@ private ClientModel getRoleClient(RoleModel role) {
         if (role.getContainer() instanceof ClientModel) {
             client = (ClientModel)role.getContainer();
         } else {
-            client = root.getRealmManagementClient();
+            client = root.getRealmPermissionsClient();
         }
         return client;
     }
 
     @Override
     public Policy manageUsersPolicy(ResourceServer server) {
-        RoleModel role = root.getRealmManagementClient().getRole(AdminRoles.MANAGE_USERS);
+        RoleModel role = root.getRealmPermissionsClient().getRole(AdminRoles.MANAGE_USERS);
         return rolePolicy(server, role);
     }
 
     @Override
     public Policy viewUsersPolicy(ResourceServer server) {
-        RoleModel role = root.getRealmManagementClient().getRole(AdminRoles.VIEW_USERS);
+        RoleModel role = root.getRealmPermissionsClient().getRole(AdminRoles.VIEW_USERS);
         return rolePolicy(server, role);
     }
 
@@ -540,7 +545,7 @@ public Policy rolePolicy(ResourceServer server, RoleModel role) {
     }
 
     @Override
-    public Set<String> getRolesWithPermission(String scope) {
+    public Set<String> getRoleIdsByScope(String scope) {
         if (!root.isAdminSameRealm()) {
             return Collections.emptySet();
         }
@@ -654,4 +659,13 @@ private String getMapCompositePermissionName(RoleModel role) {
     private static String getRoleResourceName(RoleModel role) {
         return "role.resource." + role.getId();
     }
+
+    private ResourceServer getResourceServer(RoleModel role) {
+        ResourceServer resourceServer = null;
+        if (role.isClientRole()) {
+            RoleContainerModel container = role.getContainer();
+            resourceServer = session.getProvider(AuthorizationProvider.class).getStoreFactory().getResourceServerStore().findById(container.getId());
+        }
+        return resourceServer;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionsV2.java
new file mode 100644
index 000000000000..b0bf3a33b90e
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/RolePermissionsV2.java
@@ -0,0 +1,173 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.services.resources.admin.fgap;
+
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.ROLES_RESOURCE_TYPE;
+
+import java.util.Map;
+import java.util.Set;
+import org.keycloak.Config;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.services.resources.admin.fgap.ModelRecord.RoleModelRecord;
+
+class RolePermissionsV2 extends RolePermissions {
+
+    private final FineGrainedAdminPermissionEvaluator eval;
+
+    RolePermissionsV2(KeycloakSession session, RealmModel realm, AuthorizationProvider authz, MgmtPermissions root) {
+        super(session, realm, authz, root);
+        this.eval = new FineGrainedAdminPermissionEvaluator(session, root, resourceStore, policyStore);
+    }
+
+    private boolean hasMasterAdminRole() {
+        RealmModel masterRealm = root.adminsRealm().getName().equals(Config.getAdminRealm()) ? 
+                root.adminsRealm(): 
+                session.realms().getRealmByName(Config.getAdminRealm());
+
+        RoleModel adminRole = masterRealm.getRole(AdminRoles.ADMIN);
+        return root.admin().hasRole(adminRole);
+    }
+
+    @Override
+    public boolean canMapRole(RoleModel role) {
+        if (AdminRoles.ALL_ROLES.contains(role.getName()) && !hasMasterAdminRole()) {
+            return false;
+        }
+
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        if (role.getContainer() instanceof ClientModel clientModel) {
+            if (root.clients().canMapRoles(clientModel)) {
+                return true;
+            }
+        }
+
+        return eval.hasPermission(new RoleModelRecord(role), null, AdminPermissionsSchema.MAP_ROLE);
+    }
+
+    @Override
+    public boolean canMapComposite(RoleModel role) {
+        if (AdminRoles.ALL_ROLES.contains(role.getName()) && !hasMasterAdminRole()) {
+            return false;
+        }
+
+        if (role.getContainer() instanceof ClientModel clientModel) {
+            if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
+                return true;
+            }
+            if (root.clients().canMapCompositeRoles(clientModel)) {
+                return true;
+            }
+        } else {
+            if (root.hasOneAdminRole(AdminRoles.MANAGE_REALM)) {
+                return true;
+            }
+        }
+
+        return eval.hasPermission(new RoleModelRecord(role), null, AdminPermissionsSchema.MAP_ROLE_COMPOSITE);
+    }
+
+    @Override
+    public boolean canMapClientScope(RoleModel role) {
+        if (role.getContainer() instanceof ClientModel clientModel) {
+            if (root.hasOneAdminRole(AdminRoles.MANAGE_CLIENTS)) {
+                return true;
+            }
+            if (root.clients().canMapClientScopeRoles(clientModel)) {
+                return true;
+            }
+        } else {
+            if (root.hasOneAdminRole(AdminRoles.MANAGE_REALM)) {
+                return true;
+            }
+        }
+
+        return eval.hasPermission(new RoleModelRecord(role), null, AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE);
+    }
+
+    @Override
+    public Set<String> getRoleIdsByScope(String scope) {
+        return eval.getIdsByScope(ROLES_RESOURCE_TYPE, scope);
+    }
+
+    @Override
+    public boolean isPermissionsEnabled(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public void setPermissionsEnabled(RoleModel role, boolean enable) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Map<String, String> getPermissions(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapRolePermission(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapCompositePermission(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapClientScopePermission(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Resource resource(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public ResourceServer resourceServer(RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy manageUsersPolicy(ResourceServer server) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy viewUsersPolicy(ResourceServer server) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy rolePolicy(ResourceServer server, RoleModel role) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionEvaluator.java
new file mode 100644
index 000000000000..dfa6a49fddc2
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionEvaluator.java
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.ImpersonationConstants;
+import org.keycloak.models.UserModel;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserPermissionEvaluator {
+
+    /**
+     * Throws ForbiddenException if {@link #canManage()} returns {@code false}.
+     */
+    void requireManage();
+
+    /**
+     * Throws ForbiddenException if {@link #canManage(UserModel)} returns {@code false}.
+     */
+    void requireManage(UserModel user);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE} users.
+     */
+    boolean canManage();
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE} the user.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE_MEMBERS}
+     * of the group chain the user is associated with.
+     */
+    boolean canManage(UserModel user);
+
+    /**
+     * Throws ForbiddenException if {@link #canQuery()} returns {@code false}.
+     */
+    void requireQuery();
+
+    /**
+     * Returns {@code true} if the caller has at least one of {@link AdminRoles#QUERY_USERS},
+     * {@link AdminRoles#MANAGE_USERS} or {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW} users.
+     */
+    boolean canQuery();
+
+    /**
+     * Throws ForbiddenException if {@link #canView()} returns {@code false}.
+     */
+    void requireView();
+
+    /**
+     * Throws ForbiddenException if {@link #canView(UserModel)} returns {@code false}.
+     */
+    void requireView(UserModel user);
+
+    /**
+     * Returns {@code true} if the caller has one of {@link AdminRoles#MANAGE_USERS} or
+     * {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW} users.
+     */
+    boolean canView();
+
+    /**
+     * Returns {@code true} if the caller has at least one of {@link AdminRoles#MANAGE_USERS} or
+     * {@link AdminRoles#VIEW_USERS} roles.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW} the user.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#VIEW_MEMBERS}
+     * of the group chain the user is associated with.
+     */
+    boolean canView(UserModel user);
+
+    /**
+     * Throws ForbiddenException if {@link #canImpersonate(UserModel, ClientModel)} returns {@code false}.
+     */
+    void requireImpersonate(UserModel user);
+
+    /**
+     * Returns {@code true} if the caller has the {@link ImpersonationConstants#IMPERSONATION_ROLE}.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#IMPERSONATE} users.
+     */
+    boolean canImpersonate();
+
+    /**
+     * Returns {@code true} if the caller has the {@link ImpersonationConstants#IMPERSONATION_ROLE}.
+     * <p/>
+     * NOTE: If requester is provided, it's clientId is added to evaluation context.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#IMPERSONATE} the user.
+     */
+    boolean canImpersonate(UserModel user, ClientModel requester);
+
+    /**
+     * Returns Map with information what access the caller for the provided user has.
+     */
+    Map<String, Boolean> getAccess(UserModel user);
+
+    /**
+     * Returns Map with information what access the caller for the provided user has when listing users.
+     */
+    Map<String, Boolean> getAccessForListing(UserModel user);
+
+    /**
+     * Throws ForbiddenException if {@link #canMapRoles(UserModel)} returns {@code false}.
+     */
+    void requireMapRoles(UserModel user);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MAP_ROLES} of the user.
+     */
+    boolean canMapRoles(UserModel user);
+
+    /**
+     * Throws ForbiddenException if {@link #canManageGroupMembership(UserModel)} returns {@code false}.
+     */
+    void requireManageGroupMembership(UserModel user);
+
+    /**
+     * Returns {@code true} if the caller has {@link AdminRoles#MANAGE_USERS} role.
+     * <p/>
+     * Or if it has a permission to {@link AdminPermissionsSchema#MANAGE_GROUP_MEMBERSHIP} of the user.
+     */
+    boolean canManageGroupMembership(UserModel user);
+
+    @Deprecated
+    boolean isImpersonatable(UserModel user, ClientModel requester);
+    @Deprecated
+    void grantIfNoPermission(boolean grantIfNoPermission);
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionManagement.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionManagement.java
similarity index 94%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionManagement.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionManagement.java
index 0ac8431b207e..49454801d3f7 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionManagement.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionManagement.java
@@ -14,12 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 
 import java.util.Map;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissions.java
similarity index 94%
rename from services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissions.java
rename to services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissions.java
index e6d9bf0a720a..23cb734b3cf3 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissions.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissions.java
@@ -14,13 +14,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.keycloak.services.resources.admin.permissions;
+package org.keycloak.services.resources.admin.fgap;
 
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.common.ClientModelIdentity;
 import org.keycloak.authorization.common.DefaultEvaluationContext;
-import org.keycloak.authorization.common.UserModelIdentity;
 import org.keycloak.authorization.identity.Identity;
+import org.keycloak.authorization.identity.UserModelIdentity;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.Resource;
 import org.keycloak.authorization.model.ResourceServer;
@@ -32,7 +32,6 @@
 import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.GroupModel;
-import org.keycloak.models.ImpersonationConstants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserModel;
 import org.keycloak.representations.idm.authorization.Permission;
@@ -71,11 +70,11 @@ class UserPermissions implements UserPermissionEvaluator, UserPermissionManageme
     private static final String VIEW_PERMISSION_USERS = "view.permission.users";
     private static final String USERS_RESOURCE = "Users";
 
-    private final KeycloakSession session;
+    protected final KeycloakSession session;
     private final AuthorizationProvider authz;
-    private final MgmtPermissions root;
-    private final PolicyStore policyStore;
-    private final ResourceStore resourceStore;
+    protected final MgmtPermissions root;
+    protected final PolicyStore policyStore;
+    protected final ResourceStore resourceStore;
     private boolean grantIfNoPermission = false;
 
     UserPermissions(KeycloakSession session, AuthorizationProvider authz, MgmtPermissions root) {
@@ -177,10 +176,6 @@ public void setPermissionsEnabled(boolean enable) {
         }
     }
 
-    public boolean canManageDefault() {
-        return root.hasOneAdminRole(AdminRoles.MANAGE_USERS);
-    }
-
     @Override
     public Resource resource() {
         ResourceServer server = root.realmResourceServer();
@@ -235,7 +230,7 @@ public Policy userImpersonatedPermission() {
      */
     @Override
     public boolean canManage() {
-        if (canManageDefault()) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
             return true;
         }
 
@@ -274,7 +269,7 @@ public void requireManage(UserModel user) {
 
     @Override
     public boolean canQuery() {
-        return canView() || root.hasOneAdminRole(AdminRoles.QUERY_USERS);
+        return root.hasOneAdminRole(AdminRoles.QUERY_USERS) || canView();
     }
 
     @Override
@@ -299,7 +294,7 @@ public void requireQuery() {
      */
     @Override
     public boolean canView() {
-        if (canViewDefault() || canManageDefault()) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS)) {
             return true;
         }
 
@@ -413,7 +408,7 @@ public boolean isImpersonatable(UserModel user) {
 
     @Override
     public boolean canImpersonate() {
-        if (root.hasOneAdminRole(ImpersonationConstants.IMPERSONATION_ROLE)) return true;
+        if (root.hasOneAdminRole(AdminRoles.IMPERSONATION)) return true;
 
         Identity identity = root.identity;
 
@@ -442,6 +437,11 @@ public Map<String, Boolean> getAccess(UserModel user) {
         return map;
     }
 
+    @Override
+    public Map<String, Boolean> getAccessForListing(UserModel user) {
+        return Map.of("manage", canManage(user));
+    }
+
     @Override
     public boolean canMapRoles(UserModel user) {
         if (canManage(user)) return true;
@@ -487,7 +487,7 @@ public void requireManageGroupMembership(UserModel user) {
 
     }
 
-    private boolean hasPermission(String... scopes) {
+    protected boolean hasPermission(String... scopes) {
         return hasPermission(null, scopes);
     }
 
@@ -585,15 +585,11 @@ private boolean evaluateHierarchy(Predicate<GroupModel> eval, GroupModel group,
 
     private boolean canManageByGroup(UserModel user) {
         if (authz == null) return false;
-        return evaluateHierarchy(user, (group) -> root.groups().canManageMembers(group));
-
-    }
-    private boolean canViewByGroup(UserModel user) {
-        if (authz == null) return false;
-        return evaluateHierarchy(user, (group) -> root.groups().getGroupsWithViewPermission(group));
+        return evaluateHierarchy(user, root.groups()::canManageMembers);
     }
 
-    public boolean canViewDefault() {
-        return root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS);
+    protected boolean canViewByGroup(UserModel user) {
+        if (authz == null) return false;
+        return evaluateHierarchy(user, root.groups()::canViewMembers);
     }
 }
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java
new file mode 100644
index 000000000000..549fc4def43f
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java
@@ -0,0 +1,215 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.services.resources.admin.fgap;
+
+import java.util.List;
+import java.util.Map;
+
+import jakarta.ws.rs.ForbiddenException;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.common.DefaultEvaluationContext;
+import org.keycloak.authorization.identity.UserModelIdentity;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.resources.admin.fgap.ModelRecord.UserModelRecord;
+
+class UserPermissionsV2 extends UserPermissions {
+
+    private final FineGrainedAdminPermissionEvaluator eval;
+
+    UserPermissionsV2(KeycloakSession session, AuthorizationProvider authz, MgmtPermissionsV2 root) {
+        super(session, authz, root);
+        this.eval = new FineGrainedAdminPermissionEvaluator(session, root, resourceStore, policyStore);
+    }
+
+    @Override
+    public boolean canQuery() {
+        return root.hasOneAdminRole(AdminRoles.QUERY_USERS) || canView();
+    }
+
+    @Override
+    public void requireQuery() {
+        if (!canQuery()) {
+            throw new ForbiddenException();
+        }
+    }
+
+    @Override
+    public boolean canView(UserModel user) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public boolean canView() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS, AdminRoles.VIEW_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(null), null, AdminPermissionsSchema.VIEW);
+    }
+
+    @Override
+    public void requireView(UserModel user) {
+        if (!canView(user)) {
+            throw new ForbiddenException();
+        }
+    }
+
+    @Override
+    public void requireView() {
+        if (!(canView())) {
+            throw new ForbiddenException();
+        }
+    }
+
+    @Override
+    public boolean canManage(UserModel user) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public boolean canManage() {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(null), null, AdminPermissionsSchema.MANAGE);
+    }
+
+    @Override
+    public void requireManage(UserModel user) {
+        if (!canManage(user)) {
+            throw new ForbiddenException();
+        }
+    }
+
+    @Override
+    public void requireManage() {
+        if (!canManage()) {
+            throw new ForbiddenException();
+        }
+    }
+
+    @Override
+    public boolean canImpersonate(UserModel user, ClientModel requester) {
+        if (root.hasOneAdminRole(AdminRoles.IMPERSONATION)) {
+            return true;
+        }
+
+        DefaultEvaluationContext context = requester == null ? null :
+                new DefaultEvaluationContext(new UserModelIdentity(root.realm, user), Map.of("kc.client.id", List.of(requester.getClientId())), session);
+
+        return eval.hasPermission(new UserModelRecord(user), context, AdminPermissionsSchema.IMPERSONATE);
+    }
+
+    @Override
+    public boolean canMapRoles(UserModel user) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.MAP_ROLES);
+    }
+
+    @Override
+    public boolean canManageGroupMembership(UserModel user) {
+        if (root.hasOneAdminRole(AdminRoles.MANAGE_USERS)) {
+            return true;
+        }
+
+        return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP);
+    }
+
+    // todo this method should be removed and replaced by canImpersonate(user, client); once V1 is removed
+    @Override
+    public boolean canClientImpersonate(ClientModel client, UserModel user) {
+        return canImpersonate(user, client);
+    }
+
+    @Override
+    public boolean isImpersonatable(UserModel user, ClientModel requester) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public boolean isImpersonatable(UserModel user) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public boolean isPermissionsEnabled() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public void setPermissionsEnabled(boolean enable) {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Map<String, String> getPermissions() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Resource resource() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy managePermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy viewPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy manageGroupMembershipPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy mapRolesPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy adminImpersonatingPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+
+    @Override
+    public Policy userImpersonatedPermission() {
+        throw new UnsupportedOperationException("Not supported in V2");
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/info/ServerInfoAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/info/ServerInfoAdminResource.java
index 609aece9aa25..8ae5388a3707 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/info/ServerInfoAdminResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/info/ServerInfoAdminResource.java
@@ -52,6 +52,7 @@
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperTypeRepresentation;
 import org.keycloak.representations.info.ClientInstallationRepresentation;
+import org.keycloak.representations.info.CpuInfoRepresentation;
 import org.keycloak.representations.info.CryptoInfoRepresentation;
 import org.keycloak.representations.info.FeatureRepresentation;
 import org.keycloak.representations.info.FeatureType;
@@ -110,6 +111,7 @@ public ServerInfoAdminResource(KeycloakSession session) {
     public ServerInfoRepresentation getInfo() {
         ServerInfoRepresentation info = new ServerInfoRepresentation();
         info.setSystemInfo(SystemInfoRepresentation.create(session.getKeycloakSessionFactory().getServerStartupTimestamp(), Version.VERSION));
+        info.setCpuInfo(CpuInfoRepresentation.create());
         info.setMemoryInfo(MemoryInfoRepresentation.create());
         info.setProfileInfo(createProfileInfo());
         info.setFeatures(createFeatureRepresentations());
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java
deleted file mode 100644
index 2b3dd29e8784..000000000000
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/AdminPermissions.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.services.resources.admin.permissions;
-
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.GroupModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleContainerModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.provider.ProviderEvent;
-import org.keycloak.provider.ProviderEventListener;
-import org.keycloak.provider.ProviderEventManager;
-import org.keycloak.services.resources.admin.AdminAuth;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class AdminPermissions {
-
-
-    public static AdminPermissionEvaluator evaluator(KeycloakSession session, RealmModel realm, AdminAuth auth) {
-        return new MgmtPermissions(session, realm, auth);
-    }
-    public static AdminPermissionEvaluator evaluator(KeycloakSession session, RealmModel realm, RealmModel adminsRealm, UserModel admin) {
-        return new MgmtPermissions(session, realm, adminsRealm, admin);
-    }
-
-    public static RealmsPermissionEvaluator realms(KeycloakSession session, AdminAuth auth) {
-        return new MgmtPermissions(session, auth);
-    }
-
-    public static RealmsPermissionEvaluator realms(KeycloakSession session, RealmModel adminsRealm, UserModel admin) {
-        return new MgmtPermissions(session, adminsRealm, admin);
-    }
-
-    public static AdminPermissionManagement management(KeycloakSession session, RealmModel realm) {
-        return new MgmtPermissions(session, realm);
-    }
-
-    public static void registerListener(ProviderEventManager manager) {
-        manager.register(new ProviderEventListener() {
-            @Override
-            public void onEvent(ProviderEvent event) {
-                if (event instanceof RoleContainerModel.RoleRemovedEvent) {
-                    RoleContainerModel.RoleRemovedEvent cast = (RoleContainerModel.RoleRemovedEvent)event;
-                    RoleModel role = cast.getRole();
-                    RealmModel realm;
-                    if (role.getContainer() instanceof ClientModel) {
-                        realm = ((ClientModel)role.getContainer()).getRealm();
-
-                    } else {
-                        realm = (RealmModel)role.getContainer();
-                    }
-                    management(cast.getKeycloakSession(), realm).roles().setPermissionsEnabled(role, false);
-                } else if (event instanceof ClientModel.ClientRemovedEvent) {
-                    ClientModel.ClientRemovedEvent cast = (ClientModel.ClientRemovedEvent)event;
-                    management(cast.getKeycloakSession(), cast.getClient().getRealm()).clients().setPermissionsEnabled(cast.getClient(), false);
-                } else if (event instanceof GroupModel.GroupRemovedEvent) {
-                    GroupModel.GroupRemovedEvent cast = (GroupModel.GroupRemovedEvent)event;
-                    management(cast.getKeycloakSession(), cast.getRealm()).groups().setPermissionsEnabled(cast.getGroup(), false);
-                }
-            }
-        });
-    }
-
-
-}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java
deleted file mode 100644
index ad3f94f90003..000000000000
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/ClientPermissionEvaluator.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.services.resources.admin.permissions;
-
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientScopeModel;
-
-import java.util.Map;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public interface ClientPermissionEvaluator {
-    boolean isPermissionsEnabled(ClientModel client);
-
-    void setPermissionsEnabled(ClientModel client, boolean enable);
-
-    void requireListClientScopes();
-
-    boolean canManage();
-
-    void requireManage();
-
-    boolean canManageClientScopes();
-
-    void requireManageClientScopes();
-
-    boolean canView();
-
-    boolean canList();
-
-    boolean canViewClientScopes();
-
-    void requireList();
-
-    boolean canListClientScopes();
-
-    void requireView();
-
-    void requireViewClientScopes();
-
-    boolean canManage(ClientModel client);
-
-    boolean canConfigure(ClientModel client);
-
-    void requireConfigure(ClientModel client);
-
-    void requireManage(ClientModel client);
-
-    boolean canView(ClientModel client);
-
-    void requireView(ClientModel client);
-
-    boolean canManage(ClientScopeModel clientScope);
-
-    void requireManage(ClientScopeModel clientScope);
-
-    boolean canView(ClientScopeModel clientScope);
-
-    void requireView(ClientScopeModel clientScope);
-
-    boolean canMapRoles(ClientModel client);
-
-    boolean canMapCompositeRoles(ClientModel client);
-
-    boolean canMapClientScopeRoles(ClientModel client);
-
-    Map<String, Boolean> getAccess(ClientModel client);
-
-    Set<String> getClientsWithPermission(String scope);
-}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java
deleted file mode 100644
index c90eba237d56..000000000000
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/GroupPermissionEvaluator.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.services.resources.admin.permissions;
-
-import org.keycloak.models.GroupModel;
-
-import java.util.Map;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public interface GroupPermissionEvaluator {
-    boolean canList();
-
-    void requireList();
-
-    boolean canManage(GroupModel group);
-
-    void requireManage(GroupModel group);
-
-    boolean canView(GroupModel group);
-
-    void requireView(GroupModel group);
-
-    boolean canManage();
-
-    void requireManage();
-
-    boolean canView();
-
-    void requireView();
-
-    boolean getGroupsWithViewPermission(GroupModel group);
-
-    void requireViewMembers(GroupModel group);
-
-    boolean canManageMembers(GroupModel group);
-
-    boolean canManageMembership(GroupModel group);
-    
-    boolean canViewMembers(GroupModel group);
-    
-    void requireManageMembership(GroupModel group);
-
-    void requireManageMembers(GroupModel group);
-
-    Map<String, Boolean> getAccess(GroupModel group);
-
-    Set<String> getGroupsWithViewPermission();
-}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionEvaluator.java
deleted file mode 100644
index 501d163595d6..000000000000
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissionEvaluator.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.services.resources.admin.permissions;
-
-import org.keycloak.models.RoleContainerModel;
-import org.keycloak.models.RoleModel;
-
-import java.util.Set;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public interface RolePermissionEvaluator {
-    boolean canList(RoleContainerModel container);
-
-    void requireList(RoleContainerModel container);
-
-    boolean canMapRole(RoleModel role);
-    void requireMapRole(RoleModel role);
-
-    boolean canManage(RoleModel role);
-
-    void requireManage(RoleModel role);
-
-    boolean canView(RoleModel role);
-
-    void requireView(RoleModel role);
-
-    boolean canMapClientScope(RoleModel role);
-    void requireMapClientScope(RoleModel role);
-
-    boolean canMapComposite(RoleModel role);
-    void requireMapComposite(RoleModel role);
-
-    boolean canManage(RoleContainerModel container);
-
-    void requireManage(RoleContainerModel container);
-
-    boolean canView(RoleContainerModel container);
-
-    void requireView(RoleContainerModel container);
-
-    Set<String> getRolesWithPermission(String scope);
-}
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java b/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java
deleted file mode 100644
index 35e06caf3c3a..000000000000
--- a/services/src/main/java/org/keycloak/services/resources/admin/permissions/UserPermissionEvaluator.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.services.resources.admin.permissions;
-
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.UserModel;
-
-import java.util.Map;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public interface UserPermissionEvaluator {
-    void requireManage();
-    void requireManage(UserModel user);
-    boolean canManage();
-    boolean canManage(UserModel user);
-
-    void requireQuery();
-    boolean canQuery();
-
-    void requireView();
-    void requireView(UserModel user);
-    boolean canView();
-    boolean canView(UserModel user);
-
-    void requireImpersonate(UserModel user);
-    boolean canImpersonate();
-    boolean canImpersonate(UserModel user, ClientModel requester);
-    boolean isImpersonatable(UserModel user, ClientModel requester);
-
-    Map<String, Boolean> getAccess(UserModel user);
-
-    void requireMapRoles(UserModel user);
-    boolean canMapRoles(UserModel user);
-
-    void requireManageGroupMembership(UserModel user);
-    boolean canManageGroupMembership(UserModel user);
-    void grantIfNoPermission(boolean grantIfNoPermission);
-}
diff --git a/services/src/main/java/org/keycloak/services/util/AuthenticationFlowURLHelper.java b/services/src/main/java/org/keycloak/services/util/AuthenticationFlowURLHelper.java
index 7bdb3361432f..fdfdaebc2395 100644
--- a/services/src/main/java/org/keycloak/services/util/AuthenticationFlowURLHelper.java
+++ b/services/src/main/java/org/keycloak/services/util/AuthenticationFlowURLHelper.java
@@ -56,6 +56,7 @@ public Response showPageExpired(AuthenticationSessionModel authSession) {
 
         logger.debugf("Redirecting to 'page expired' now. Will use last step URL: %s", lastStepUrl);
 
+        LocaleUtil.processLocaleParam(session, realm, authSession);
         return session.getProvider(LoginFormsProvider.class).setAuthenticationSession(authSession)
                 .setActionUri(lastStepUrl)
                 .setExecution(getExecutionId(authSession))
diff --git a/services/src/main/java/org/keycloak/services/util/DPoPUtil.java b/services/src/main/java/org/keycloak/services/util/DPoPUtil.java
index 176280f90b6d..59915a642042 100644
--- a/services/src/main/java/org/keycloak/services/util/DPoPUtil.java
+++ b/services/src/main/java/org/keycloak/services/util/DPoPUtil.java
@@ -23,17 +23,20 @@
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.function.BooleanSupplier;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriBuilder;
 import jakarta.ws.rs.core.UriInfo;
 
 import org.apache.commons.codec.binary.Hex;
-import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.TokenVerifier;
@@ -52,9 +55,11 @@
 import org.keycloak.jose.jwk.JWK;
 import org.keycloak.jose.jws.JWSHeader;
 import org.keycloak.jose.jws.crypto.HashUtils;
+import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientSessionContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.SingleUseObjectProvider;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.ProtocolMapper;
@@ -74,6 +79,7 @@
 import org.keycloak.services.CorsErrorResponseException;
 import org.keycloak.services.cors.Cors;
 import org.keycloak.util.JWKSUtils;
+import org.keycloak.util.TokenUtil;
 
 import static org.keycloak.utils.StringUtil.isNotBlank;
 
@@ -88,7 +94,7 @@ public class DPoPUtil {
     public static final String DPOP_SCHEME = "DPoP";
     public final static String DPOP_SESSION_ATTRIBUTE = "dpop";
 
-    public static enum Mode {
+    public enum Mode {
         ENABLED,
         OPTIONAL,
         DISABLED
@@ -96,7 +102,7 @@ public static enum Mode {
 
     public static final String DPOP_HTTP_HEADER = "DPoP";
     private static final String DPOP_JWT_HEADER_TYPE = "dpop+jwt";
-    private static final String DPOP_ATH_ALG = "RS256";
+    public static final String DPOP_ATH_ALG = "RS256";
 
     public static final Set<String> DPOP_SUPPORTED_ALGS = Stream.of(
         Algorithm.ES256,
@@ -147,43 +153,33 @@ public static Optional<DPoP> retrieveDPoPHeaderIfPresent(KeycloakSession keycloa
                                                              OIDCAdvancedConfigWrapper clientConfig,
                                                              EventBuilder event,
                                                              Cors cors) {
-        boolean isDPoPSupported = Profile.isFeatureEnabled(Profile.Feature.DPOP);
-        if (!isDPoPSupported) {
-            return Optional.empty();
-        }
-
-        HttpRequest request = keycloakSession.getContext().getHttpRequest();
-        final boolean isClientRequiresDpop = clientConfig != null && clientConfig.isUseDPoP();
-        final boolean isDpopHeaderPresent = request.getHttpHeaders().getHeaderString(DPoPUtil.DPOP_HTTP_HEADER) != null;
-        if (!isClientRequiresDpop && !isDpopHeaderPresent) {
-            return Optional.empty();
-        }
-
-        try {
-            DPoP dPoP = new DPoPUtil.Validator(keycloakSession).request(request).uriInfo(keycloakSession.getContext().getUri()).validate();
-            keycloakSession.setAttribute(DPoPUtil.DPOP_SESSION_ATTRIBUTE, dPoP);
-            return Optional.of(dPoP);
-        } catch (VerificationException ex) {
-            event.detail(Details.REASON, ex.getMessage());
-            event.error(Errors.INVALID_DPOP_PROOF);
-            throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_REQUEST, ex.getMessage(), Response.Status.BAD_REQUEST);
-        }
+        return retrieveDPoPHeaderIfPresent(keycloakSession, event, cors, ()-> {
+            HttpRequest request = keycloakSession.getContext().getHttpRequest();
+            final boolean isClientRequiresDpop = clientConfig != null && clientConfig.isUseDPoP();
+            final boolean isDpopHeaderPresent = request.getHttpHeaders().getHeaderString(DPoPUtil.DPOP_HTTP_HEADER) != null;
+            return !isClientRequiresDpop && !isDpopHeaderPresent;
+        });
     }
 
     public static Optional<DPoP> retrieveDPoPHeaderIfPresent(KeycloakSession keycloakSession,
                                                              EventBuilder event,
                                                              Cors cors) {
-        boolean isDPoPSupported = Profile.isFeatureEnabled(Profile.Feature.DPOP);
-        if (!isDPoPSupported) {
-            return Optional.empty();
-        }
+        return retrieveDPoPHeaderIfPresent(keycloakSession, event, cors, ()-> {
+            HttpRequest request = keycloakSession.getContext().getHttpRequest();
+            final boolean isDpopHeaderPresent = request.getHttpHeaders().getHeaderString(DPoPUtil.DPOP_HTTP_HEADER) != null;
+            return !isDpopHeaderPresent;
+        });
+    }
 
-        HttpRequest request = keycloakSession.getContext().getHttpRequest();
-        final boolean isDpopHeaderPresent = request.getHttpHeaders().getHeaderString(DPoPUtil.DPOP_HTTP_HEADER) != null;
-        if (!isDpopHeaderPresent) {
+    private static Optional<DPoP> retrieveDPoPHeaderIfPresent(KeycloakSession keycloakSession,
+                                                              EventBuilder event,
+                                                              Cors cors,
+                                                              BooleanSupplier isDPoPNotApplicableRequest) {
+        if (!Profile.isFeatureEnabled(Profile.Feature.DPOP) || isDPoPNotApplicableRequest.getAsBoolean()) {
             return Optional.empty();
         }
 
+        HttpRequest request = keycloakSession.getContext().getHttpRequest();
         try {
             DPoP dPoP = new DPoPUtil.Validator(keycloakSession).request(request).uriInfo(keycloakSession.getContext().getUri()).validate();
             keycloakSession.setAttribute(DPoPUtil.DPOP_SESSION_ATTRIBUTE, dPoP);
@@ -197,7 +193,7 @@ public static Optional<DPoP> retrieveDPoPHeaderIfPresent(KeycloakSession keycloa
     
     private static DPoP validateDPoP(KeycloakSession session, URI uri, String method, String token, String accessToken, int lifetime, int clockSkew) throws VerificationException {
 
-        if (token == null || token.trim().equals("")) {
+        if (token == null || token.trim().isEmpty()) {
             throw new VerificationException("DPoP proof is missing");
         }
 
@@ -261,6 +257,43 @@ private static DPoP validateDPoP(KeycloakSession session, URI uri, String method
 
     }
 
+    private static final Pattern WHITESPACES = Pattern.compile("\\s+");
+
+    public static TokenVerifier<AccessToken> withDPoPVerifier(TokenVerifier<AccessToken> verifier, RealmModel realm, DPoPUtil.Validator validator) {
+        if (Profile.isFeatureEnabled(Profile.Feature.DPOP)) {
+            verifier = verifier.tokenType(List.of(TokenUtil.TOKEN_TYPE_BEARER, TokenUtil.TOKEN_TYPE_DPOP))
+                    .withChecks(token -> {
+                        String[] split = WHITESPACES.split(validator.authHeader);
+                        String typeString = split[0];
+                        if (!typeString.equals(TokenUtil.TOKEN_TYPE_DPOP) && DPoPUtil.DPOP_TOKEN_TYPE.equals(token.getType())) {
+                            throw new VerificationException("The access token type is DPoP but Authorization Header is not DPoP");
+                        }
+                        if (typeString.equals(TokenUtil.TOKEN_TYPE_DPOP) && !DPoPUtil.DPOP_TOKEN_TYPE.equals(token.getType())) {
+                            throw new VerificationException("The access token type is not DPoP but Authorization Header is DPoP");
+                        }
+                        ClientModel clientModel = realm.getClientByClientId(token.getIssuedFor());
+                        if (clientModel == null) {
+                            throw new VerificationException("Client not found");
+                        }
+                        if (OIDCAdvancedConfigWrapper.fromClientModel(clientModel).isUseDPoP() && !typeString.equals(TokenUtil.TOKEN_TYPE_DPOP)) {
+                            throw new VerificationException("This client requires DPoP, but no DPoP Authorization header is present");
+                        }
+                        if (typeString.equals(TokenUtil.TOKEN_TYPE_DPOP)) {
+                            if (validator.accessToken == null) {
+                                throw new VerificationException("Access Token not set for validator");
+                            }
+                            DPoP dPoP = validator.validate();
+                            DPoPUtil.validateBinding(token, dPoP);
+                            if (!Objects.equals(token.getConfirmation().getKeyThumbprint(), dPoP.getThumbprint())) {
+                                throw new VerificationException("DPoP Proof public key thumbprint does not match dpop_jkt");
+                            }
+                        }
+                        return true;
+                    });
+        }
+        return verifier;
+    }
+
     public static void validateBinding(AccessToken token, DPoP dPoP) throws VerificationException {
         try {
             TokenVerifier.createWithoutSignature(token)
@@ -273,20 +306,6 @@ public static void validateBinding(AccessToken token, DPoP dPoP) throws Verifica
         }
     }
 
-    public static void bindToken(AccessToken token, String thumbprint) {
-        AccessToken.Confirmation confirmation = token.getConfirmation();
-
-        if (confirmation == null) {
-            confirmation = new AccessToken.Confirmation();
-            token.setConfirmation(confirmation);
-        }
-
-        confirmation.setKeyThumbprint(thumbprint);
-    }
-
-    public static void bindToken(AccessToken token, DPoP dPoP) {
-        bindToken(token, dPoP.getThumbprint());
-    }
 
     public static void validateDPoPJkt(String dpopJkt, KeycloakSession session, EventBuilder event, Cors cors) {
         if (dpopJkt == null) {
@@ -310,6 +329,10 @@ public static void validateDPoPJkt(String dpopJkt, KeycloakSession session, Even
 
     }
 
+    public static boolean isDPoPToken(AccessToken refreshToken) {
+        return refreshToken.getConfirmation() != null && refreshToken.getConfirmation().getKeyThumbprint() != null;
+    }
+
     private static class DPoPClaimsCheck implements TokenVerifier.Predicate<DPoP> {
 
         static final TokenVerifier.Predicate<DPoP> INSTANCE = new DPoPClaimsCheck();
@@ -426,7 +449,7 @@ public boolean test(DPoP t) throws DPoPVerificationException {
 
     private static class DPoPAccessTokenHashCheck implements TokenVerifier.Predicate<DPoP> {
 
-        private String hash;
+        private final String hash;
 
         public DPoPAccessTokenHashCheck(String tokenString) {
             hash = HashUtils.accessTokenHash(DPOP_ATH_ALG, tokenString, true);
@@ -487,6 +510,7 @@ public static class Validator {
         private String method;
         private String dPoP;
         private String accessToken;
+        private String authHeader;
         private int clockSkew = DEFAULT_ALLOWED_CLOCK_SKEW;
         private int lifetime = DEFAULT_PROOF_LIFETIME;
 
@@ -500,6 +524,7 @@ public Validator request(HttpRequest request) {
             this.uri = request.getUri().getAbsolutePath();
             this.method = request.getHttpMethod();
             this.dPoP = request.getHttpHeaders().getHeaderString(DPOP_HTTP_HEADER);
+            this.authHeader = request.getHttpHeaders().getHeaderString(HttpHeaders.AUTHORIZATION);
             return this;
         }
 
diff --git a/services/src/main/java/org/keycloak/services/util/DateUtil.java b/services/src/main/java/org/keycloak/services/util/DateUtil.java
new file mode 100644
index 000000000000..1ba134b2ad12
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/util/DateUtil.java
@@ -0,0 +1,39 @@
+package org.keycloak.services.util;
+
+import java.time.LocalDate;
+import java.time.LocalTime;
+import java.time.ZoneOffset;
+
+public class DateUtil {
+
+    /**
+     * Parses a string timestamp or date to an Epoch timestamp in milliseconds (number of milliseconds since January 1, 1970, 00:00:00 GMT);
+     * if the date is a ISO-8601 extended local date format, the time at the beginning of the day is returned.
+     *
+     * @param date the date in ISO-8601 extended local date format
+     * @return Epoch time for the start of the day
+     */
+    public static long toStartOfDay(String date) {
+        if (date.indexOf('-') != -1) {
+            return LocalDate.parse(date).atStartOfDay().toInstant(ZoneOffset.UTC).toEpochMilli();
+        } else {
+            return Long.parseLong(date);
+        }
+    }
+
+    /**
+     * Parses a string timestamp or date to an Epoch timestamp in milliseconds (number of milliseconds since January 1, 1970, 00:00:00 GMT);
+     * if the date is a ISO-8601 extended local date format, the time at the end of the day is returned.
+     *
+     * @param date the date in ISO-8601 extended local date format
+     * @return Epoch time for the end of the day
+     */
+    public static long toEndOfDay(String date) {
+        if (date.indexOf('-') != -1) {
+            return LocalDate.parse(date).atTime(LocalTime.MAX).toInstant(ZoneOffset.UTC).toEpochMilli();
+        } else {
+            return Long.parseLong(date);
+        }
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/util/DefaultClientSessionContext.java b/services/src/main/java/org/keycloak/services/util/DefaultClientSessionContext.java
index e4ffb72f4502..d31c033e7a85 100644
--- a/services/src/main/java/org/keycloak/services/util/DefaultClientSessionContext.java
+++ b/services/src/main/java/org/keycloak/services/util/DefaultClientSessionContext.java
@@ -17,8 +17,8 @@
 
 package org.keycloak.services.util;
 
+import java.util.Arrays;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -33,10 +33,12 @@
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ClientSessionContext;
+import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.RoleUtils;
 import org.keycloak.protocol.ProtocolMapperUtils;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
@@ -129,6 +131,16 @@ public Stream<ClientScopeModel> getClientScopesStream() {
         return allowedClientScopes.stream();
     }
 
+    @Override
+    public boolean isOfflineTokenRequested() {
+        Boolean offlineAccessRequested = getAttribute(OAuth2Constants.OFFLINE_ACCESS, Boolean.class);
+        if (offlineAccessRequested != null) return offlineAccessRequested;
+
+        ClientScopeModel offlineAccessScope = KeycloakModelUtils.getClientScopeByName(clientSession.getRealm(), OAuth2Constants.OFFLINE_ACCESS);
+        offlineAccessRequested = offlineAccessScope == null ? false : getClientScopeIds().contains(offlineAccessScope.getId());
+        setAttribute(OAuth2Constants.OFFLINE_ACCESS, offlineAccessRequested);
+        return offlineAccessRequested;
+    }
 
     @Override
     public Stream<RoleModel> getRolesStream() {
@@ -265,6 +277,14 @@ private boolean isClientScopePermittedForUser(ClientScopeModel clientScope) {
         // Expand (resolve composite roles)
         clientScopeRoles = RoleUtils.expandCompositeRoles(clientScopeRoles);
 
+        //remove roles that are not contained in requested audience
+        if (attributes.get(Constants.REQUESTED_AUDIENCE_CLIENTS) != null) {
+            final Set<String> requestedClientIdsFromAudience = Arrays.stream(getAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, ClientModel[].class))
+                    .map(ClientModel::getId)
+                    .collect(Collectors.toSet());
+            clientScopeRoles.removeIf(role-> role.isClientRole() && !requestedClientIdsFromAudience.contains(role.getContainerId()));
+        }
+
         // Check if expanded roles of clientScope has any intersection with expanded roles of user. If not, it is not permitted
         clientScopeRoles.retainAll(getUserRoles());
         return !clientScopeRoles.isEmpty();
diff --git a/services/src/main/java/org/keycloak/services/util/UserSessionUtil.java b/services/src/main/java/org/keycloak/services/util/UserSessionUtil.java
index fbeb72be930a..8041dd482f08 100644
--- a/services/src/main/java/org/keycloak/services/util/UserSessionUtil.java
+++ b/services/src/main/java/org/keycloak/services/util/UserSessionUtil.java
@@ -1,119 +1,283 @@
 package org.keycloak.services.util;
 
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Objects;
+import java.util.function.Consumer;
 
 import org.jboss.logging.Logger;
 import org.keycloak.common.ClientConnection;
+import org.keycloak.common.Profile;
 import org.keycloak.common.constants.ServiceAccountConstants;
 import org.keycloak.events.Errors;
-import org.keycloak.events.EventBuilder;
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
 import org.keycloak.models.ImpersonationSessionNote;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.UserSessionModelDelegate;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
 import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.RefreshToken;
 import org.keycloak.services.Urls;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.sessions.AuthenticationSessionModel;
 import org.keycloak.sessions.RootAuthenticationSessionModel;
-import org.keycloak.utils.OAuth2Error;
+import org.keycloak.util.TokenUtil;
 
 public class UserSessionUtil {
 
     private static final Logger logger = Logger.getLogger(UserSessionUtil.class);
 
-    public static UserSessionModel findValidSession(KeycloakSession session, RealmModel realm, AccessToken token, EventBuilder event, ClientModel client) {
-        OAuth2Error error = new OAuth2Error().json(false).realm(realm);
-        return findValidSession(session, realm, token, event, client, error);
+    public static UserSessionValidationResult findValidSessionForIdentityCookie(KeycloakSession session, RealmModel realm, AccessToken token, Consumer<UserSessionModel> invalidSessionCallback) {
+        return findValidSession(session, realm, token,  null, AccessTokenContext.SessionType.ONLINE, false, true, invalidSessionCallback);
     }
 
-    public static UserSessionModel findValidSession(KeycloakSession session, RealmModel realm,
-            AccessToken token, EventBuilder event, ClientModel client, OAuth2Error error) {
+
+    public static UserSessionValidationResult findValidSessionForRefreshToken(KeycloakSession session, RealmModel realm, RefreshToken token, ClientModel client, Consumer<UserSessionModel> invalidSessionCallback) {
+        AccessTokenContext.SessionType sessionType;
+        if (TokenUtil.TOKEN_TYPE_OFFLINE.equals(token.getType())) {
+            sessionType = AccessTokenContext.SessionType.OFFLINE;
+        } else if (TokenUtil.TOKEN_TYPE_REFRESH.equals(token.getType())) {
+            sessionType = AccessTokenContext.SessionType.ONLINE;
+        } else {
+            return UserSessionValidationResult.error(Errors.INVALID_TOKEN_TYPE);
+        }
+
+        return findValidSession(session, realm, token, client, sessionType, Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE), false, invalidSessionCallback);
+    }
+
+
+    public static UserSessionValidationResult findValidSessionForAccessToken(KeycloakSession session, RealmModel realm, AccessToken token, ClientModel client, Consumer<UserSessionModel> invalidSessionCallback) {
+        AccessTokenContext accessTokenContext = session.getProvider(TokenContextEncoderProvider.class).getTokenContextFromTokenId(token.getId());
+        AccessTokenContext.SessionType sessionType = accessTokenContext.getSessionType();
+        return findValidSession(session, realm, token, client, sessionType, Profile.isFeatureEnabled(Profile.Feature.TOKEN_EXCHANGE), false, invalidSessionCallback);
+    }
+
+    /**
+     * Find valid user session (online or offline according to which one is allowed) and performs all the needed checks on it. Like checking if the userSession is valid and if clientSession is attached to it and
+     * if userSession (and clientSession) are started earlier than the token.
+     *
+     * User session will be set to KeycloakContext if successfully found and verified
+     *
+     * @param session must be not null
+     * @param realm must be not null
+     * @param token must be not null
+     * @param client must be not null unless "skipCheckClient" is true
+     * @param sessionType sessionType from the token. It allows to hint whether session can be looked-up as "online" session or as offline session. Also whether it is allowed to have transient user session or "link" transient client session to the found userSession
+     * @param allowImpersonationFallback If true, it is possible to have impersonationCallback in which case the client is not required to be present in the userSession as long as the userSession was involved in impersonation
+     * @param skipCheckClient whether the method should skip lookup of clientSession from userSession. Usually when the passed token is not linked to any client (EG. identity cookie)
+     * @param invalidSessionCallback Callback, which is invoked when user session is found, but validation of this userSession failed. Callback not called when userSession not found or when all valiation successful
+     * @return userSession with all the successful validations OR error. Result should never contain both session and error. The error contains the error code from {@link Errors}, so it can be directly used in the error event
+     */
+    private static UserSessionValidationResult findValidSession(KeycloakSession session, RealmModel realm,
+                                                    AccessToken token, ClientModel client,
+                                                    AccessTokenContext.SessionType sessionType, boolean allowImpersonationFallback, boolean skipCheckClient, Consumer<UserSessionModel> invalidSessionCallback) {
+        logger.tracef("Lookup user session with the sessionType '%s'. Token session id: %s", sessionType, token.getSessionId());
         if (token.getSessionId() == null) {
-            return createTransientSessionForClient(session, realm, token, client, event);
+            if (sessionType.isAllowTransientUserSession()) {
+                return createTransientSessionForClient(session, realm, token, client);
+            } else {
+                return UserSessionValidationResult.error(Errors.USER_SESSION_NOT_FOUND);
+            }
         }
 
         var userSessionProvider = session.sessions();
-        UserSessionModel userSession = userSessionProvider.getUserSessionIfClientExists(realm, token.getSessionId(), false, client.getId());
-        if (userSession == null) {
-            // also try to resolve sessions created during token exchange when the user is impersonated
-            userSession = getUserSessionWithImpersonatorClient(session, realm, token.getSessionId(), false, client.getId());
+
+        UserSessionModel userSession = null;
+        if (sessionType.isAllowLookupOnlineUserSession()) {
+            AuthenticatedClientSessionModel clientSession = null;
+            if (skipCheckClient || sessionType.isAllowTransientClientSession()) {
+                userSession = userSessionProvider.getUserSession(realm, token.getSessionId());
+            } else {
+                userSession = userSessionProvider.getUserSessionIfClientExists(realm, token.getSessionId(), false, client.getId());
+                if (userSession != null) {
+                    clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
+                    if (!checkTokenIssuedAt(token, clientSession)) {
+                        return UserSessionValidationResult.error(Errors.INVALID_TOKEN, userSession, invalidSessionCallback);
+                    }
+                }
+                if (userSession == null && allowImpersonationFallback) {
+                    // also try to resolve sessions created during token exchange when the user is impersonated
+                    userSession = getUserSessionWithImpersonatorClient(session, realm, token.getSessionId(), false, client.getId());
+                }
+            }
+
+            if (AuthenticationManager.isSessionValid(realm, userSession)) {
+                if (!checkTokenIssuedAt(token, userSession)) {
+                    return UserSessionValidationResult.error(Errors.INVALID_TOKEN, userSession, invalidSessionCallback);
+                }
+
+                if (sessionType.isAllowTransientClientSession()) {
+                    userSession = createTransientSessionForClient(session, userSession, client);
+                    return UserSessionValidationResult.validSession(session, userSession);
+                } else {
+                    return UserSessionValidationResult.validSession(session, userSession);
+                }
+
+            }
         }
 
-        UserSessionModel offlineUserSession;
-        if (AuthenticationManager.isSessionValid(realm, userSession)) {
-            checkTokenIssuedAt(realm, token, userSession, event, client);
-            event.session(userSession);
-            return userSession;
-        } else {
-            offlineUserSession = userSessionProvider.getUserSessionIfClientExists(realm, token.getSessionId(), true, client.getId());
+        UserSessionModel offlineUserSession = null;
+        if (sessionType.isAllowLookupOfflineUserSession()) {
+            AuthenticatedClientSessionModel offlineClientSession = null;
+            if (sessionType.isAllowTransientClientSession()) {
+                offlineUserSession = userSessionProvider.getOfflineUserSession(realm, token.getSessionId());
+            } else {
+                offlineUserSession = userSessionProvider.getUserSessionIfClientExists(realm, token.getSessionId(), true, client.getId());
+                if (offlineUserSession != null) {
+                    offlineClientSession = offlineUserSession.getAuthenticatedClientSessionByClient(client.getId());
+                    if (!checkTokenIssuedAt(token, offlineClientSession)) {
+                        return UserSessionValidationResult.error(Errors.INVALID_TOKEN, offlineUserSession, invalidSessionCallback);
+                    }
+                }
+            }
+
             if (AuthenticationManager.isSessionValid(realm, offlineUserSession)) {
-                checkTokenIssuedAt(realm, token, offlineUserSession, event, client);
-                event.session(offlineUserSession);
-                return offlineUserSession;
+                if (!checkTokenIssuedAt(token, offlineUserSession)) {
+                    return UserSessionValidationResult.error(Errors.INVALID_TOKEN, offlineUserSession, invalidSessionCallback);
+                }
+
+                if (sessionType.isAllowTransientClientSession()) {
+                    offlineUserSession = createTransientSessionForClient(session, offlineUserSession, client);
+                    return UserSessionValidationResult.validSession(session, offlineUserSession);
+                } else {
+                    return UserSessionValidationResult.validSession(session, offlineUserSession);
+                }
             }
         }
 
         if (userSession == null && offlineUserSession == null) {
-            logger.debug("User session not found or doesn't have client attached on it");
-            event.error(Errors.USER_SESSION_NOT_FOUND);
-            throw error.invalidToken("User session not found or doesn't have client attached on it");
+            logger.debugf("User session '%s' not found or doesn't have client attached on it", token.getSessionId());
+            return UserSessionValidationResult.error(Errors.USER_SESSION_NOT_FOUND);
+        }
+
+        logger.debugf("Session '%s' expired", token.getSessionId());
+        return UserSessionValidationResult.error(Errors.SESSION_EXPIRED, userSession != null ? userSession : offlineUserSession, invalidSessionCallback);
+    }
+
+
+    public static UserSessionModel createTransientUserSession(KeycloakSession session, UserSessionModel userSession) {
+        if (userSession.getPersistenceState() == UserSessionModel.SessionPersistenceState.TRANSIENT) {
+            throw new IllegalArgumentException("Not expected to invoke this method with the transient session");
         }
 
-        event.session(Objects.requireNonNullElse(userSession, offlineUserSession));
+        UserSessionModel transientSession = new UserSessionManager(session).createUserSession(userSession.getId(), userSession.getRealm(),
+                userSession.getUser(), userSession.getLoginUsername(), userSession.getIpAddress(), userSession.getAuthMethod(), userSession.isRememberMe(),
+                userSession.getBrokerSessionId(), userSession.getBrokerUserId(), UserSessionModel.SessionPersistenceState.TRANSIENT);
+        userSession.getNotes().entrySet().forEach(e -> transientSession.setNote(e.getKey(), e.getValue()));
+
+        String noteValue = userSession.isOffline() ? Constants.CREATED_FROM_PERSISTENT_OFFLINE : Constants.CREATED_FROM_PERSISTENT_ONLINE;
+        transientSession.setNote(Constants.CREATED_FROM_PERSISTENT, noteValue);
+
+        // Use "started" time from the original session
+        return new UserSessionModelDelegate(transientSession) {
+
+            @Override
+            public int getStarted() {
+                return userSession.getStarted();
+            }
 
-        logger.debug("Session expired");
-        event.error(Errors.SESSION_EXPIRED);
-        throw error.invalidToken("Session expired");
+        };
     }
 
-    private static UserSessionModel createTransientSessionForClient(KeycloakSession session, RealmModel realm, AccessToken token, ClientModel client, EventBuilder event) {
-        OAuth2Error error = new OAuth2Error().json(false).realm(realm);
+    private static void attachAuthenticationSession(KeycloakSession session, UserSessionModel userSession, ClientModel client) {
+        RootAuthenticationSessionModel rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(userSession.getRealm());
+        AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(client);
+        authSession.setAuthenticatedUser(userSession.getUser());
+        authSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), userSession.getRealm().getName()));
+        AuthenticationManager.setClientScopesInSession(session, authSession);
+        TokenManager.attachAuthenticationSession(session, userSession, authSession);
+    }
+
+    private static UserSessionModel createTransientSessionForClient(KeycloakSession session, UserSessionModel userSession, ClientModel client) {
+        UserSessionModel transientSession = createTransientUserSession(session, userSession);
+        attachAuthenticationSession(session, transientSession, client);
+        return transientSession;
+    }
+
+    private static UserSessionValidationResult createTransientSessionForClient(KeycloakSession session, RealmModel realm, AccessToken token, ClientModel client) {
         // create a transient session
         UserModel user = TokenManager.lookupUserFromStatelessToken(session, realm, token);
         if (user == null) {
             logger.debug("Transient User not found");
-            event.error(Errors.USER_NOT_FOUND);
-            throw error.invalidToken("User not found");
+            return UserSessionValidationResult.error(Errors.USER_NOT_FOUND);
         }
+        if (!user.isEnabled()) {
+            logger.debugf("User '%s' disabled", user.getUsername());
+            return UserSessionValidationResult.error(Errors.USER_DISABLED);
+        }
+
         ClientConnection clientConnection = session.getContext().getConnection();
-        UserSessionModel userSession = new UserSessionManager(session).createUserSession(KeycloakModelUtils.generateId(), realm, user, user.getUsername(), clientConnection.getRemoteAddr(),
+        UserSessionModel userSession = new UserSessionManager(session).createUserSession(KeycloakModelUtils.generateId(), realm, user, user.getUsername(), clientConnection.getRemoteHost(),
                 ServiceAccountConstants.CLIENT_AUTH, false, null, null, UserSessionModel.SessionPersistenceState.TRANSIENT);
         // attach an auth session for the client
-        RootAuthenticationSessionModel rootAuthSession = session.authenticationSessions().createRootAuthenticationSession(realm);
-        AuthenticationSessionModel authSession = rootAuthSession.createAuthenticationSession(client);
-        authSession.setAuthenticatedUser(userSession.getUser());
-        authSession.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        authSession.setClientNote(OIDCLoginProtocol.ISSUER, Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
-        AuthenticationManager.setClientScopesInSession(session, authSession);
-        TokenManager.attachAuthenticationSession(session, userSession, authSession);
-        return userSession;
+        attachAuthenticationSession(session, userSession, client);
+        return UserSessionValidationResult.validSession(session, userSession);
     }
 
-    public static void checkTokenIssuedAt(RealmModel realm, AccessToken token, UserSessionModel userSession, EventBuilder event, ClientModel client) {
-        OAuth2Error error = new OAuth2Error().json(false).realm(realm);
+    private static boolean checkTokenIssuedAt(AccessToken token, UserSessionModel userSession) {
         if (token.isIssuedBeforeSessionStart(userSession.getStarted())) {
             logger.debug("Stale token for user session");
-            event.error(Errors.INVALID_TOKEN);
-            throw error.invalidToken("Stale token");
+            return false;
+        } else {
+            return true;
         }
+    }
 
-        AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(client.getId());
-        if (clientSession != null && token.isIssuedBeforeSessionStart(clientSession.getStarted())) {
+    private static boolean checkTokenIssuedAt(AccessToken token, AuthenticatedClientSessionModel clientSession) {
+        if (token.isIssuedBeforeSessionStart(clientSession.getStarted())) {
             logger.debug("Stale token for client session");
-            event.error(Errors.INVALID_TOKEN);
-            throw error.invalidToken("Stale token");
+            return false;
+        } else {
+            return true;
         }
     }
 
     public static UserSessionModel getUserSessionWithImpersonatorClient(KeycloakSession session, RealmModel realm, String userSessionId, boolean offline, String clientUUID) {
         return session.sessions().getUserSessionWithPredicate(realm, userSessionId, offline, userSession -> Objects.equals(clientUUID, userSession.getNote(ImpersonationSessionNote.IMPERSONATOR_CLIENT.toString())));
     }
+
+
+    public static class UserSessionValidationResult {
+        private final UserSessionModel userSession;
+        private final String error;
+
+        private static UserSessionValidationResult validSession(KeycloakSession session, UserSessionModel userSession) {
+            session.getContext().setUserSession(userSession);
+            return new UserSessionValidationResult(userSession, null);
+        }
+
+        private static UserSessionValidationResult error(String error) {
+            return new UserSessionValidationResult(null, error);
+        }
+
+        private static UserSessionValidationResult error(String error, UserSessionModel invalidUserSession, Consumer<UserSessionModel> invalidSessionCallback) {
+            invalidSessionCallback.accept(invalidUserSession);
+            return new UserSessionValidationResult(null, error);
+        }
+
+        // Should be only called by static creators
+        private UserSessionValidationResult(UserSessionModel userSession, String error) {
+            this.userSession = userSession;
+            this.error = error;
+        }
+
+        public UserSessionModel getUserSession() {
+            return userSession;
+        }
+
+        public String getError() {
+            return error;
+        }
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/x509/AbstractClientCertificateFromHttpHeadersLookup.java b/services/src/main/java/org/keycloak/services/x509/AbstractClientCertificateFromHttpHeadersLookup.java
index 47aa0a9290a8..a4c945ec2180 100644
--- a/services/src/main/java/org/keycloak/services/x509/AbstractClientCertificateFromHttpHeadersLookup.java
+++ b/services/src/main/java/org/keycloak/services/x509/AbstractClientCertificateFromHttpHeadersLookup.java
@@ -18,6 +18,7 @@
 
 package org.keycloak.services.x509;
 
+import org.apache.http.client.methods.HttpHead;
 import org.jboss.logging.Logger;
 import org.keycloak.http.HttpRequest;
 import org.keycloak.common.util.PemException;
@@ -69,7 +70,9 @@ static String getHeaderValue(HttpRequest httpRequest, String headerName) {
 
     private static String trimDoubleQuotes(String quotedString) {
 
-        if (quotedString == null) return null;
+        if (quotedString == null) {
+            return null;
+        }
 
         int len = quotedString.length();
         if (len > 1 && quotedString.charAt(0) == '"' &&
@@ -83,7 +86,6 @@ private static String trimDoubleQuotes(String quotedString) {
     protected abstract X509Certificate decodeCertificateFromPem(String pem) throws PemException;
 
     protected X509Certificate getCertificateFromHttpHeader(HttpRequest request, String httpHeader) throws GeneralSecurityException {
-
         String encodedCertificate = getHeaderValue(request, httpHeader);
 
         // Remove double quotes
@@ -114,27 +116,35 @@ protected X509Certificate getCertificateFromHttpHeader(HttpRequest request, Stri
 
 
     @Override
-    public X509Certificate[] getCertificateChain(HttpRequest httpRequest) throws GeneralSecurityException {
+    public final X509Certificate[] getCertificateChain(HttpRequest httpRequest) throws GeneralSecurityException {
+        if (!httpRequest.isProxyTrusted()) {
+            logger.warnf("HTTP header \"%s\" is not trusted", sslClientCertHttpHeader);
+            return null;
+        }
         List<X509Certificate> chain = new ArrayList<>();
 
         // Get the client certificate
         X509Certificate cert = getCertificateFromHttpHeader(httpRequest, sslClientCertHttpHeader);
         if (cert != null) {
-            chain.add(cert);
-            // Get the certificate of the client certificate chain
-            for (int i = 0; i < certificateChainLength; i++) {
-                try {
-                    String s = String.format("%s_%s", sslCertChainHttpHeaderPrefix, i);
-                    cert = getCertificateFromHttpHeader(httpRequest, s);
-                    if (cert != null) {
-                        chain.add(cert);
-                    }
-                }
-                catch(GeneralSecurityException e) {
-                    logger.warn(e.getMessage(), e);
+            buildChain(httpRequest, chain, cert);
+        }
+        return chain.toArray(new X509Certificate[0]);
+    }
+
+    protected void buildChain(HttpRequest httpRequest, List<X509Certificate> chain, X509Certificate cert) {
+        chain.add(cert);
+        // Get the certificate of the client certificate chain
+        for (int i = 0; i < certificateChainLength; i++) {
+            try {
+                String s = String.format("%s_%s", sslCertChainHttpHeaderPrefix, i);
+                cert = getCertificateFromHttpHeader(httpRequest, s);
+                if (cert != null) {
+                    chain.add(cert);
                 }
             }
+            catch(GeneralSecurityException e) {
+                logger.warn(e.getMessage(), e);
+            }
         }
-        return chain.toArray(new X509Certificate[0]);
     }
 }
diff --git a/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookup.java b/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookup.java
index 1b7c5d6fc3da..f7c6ad7d2aa9 100644
--- a/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookup.java
+++ b/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookup.java
@@ -1,7 +1,6 @@
 package org.keycloak.services.x509;
 
 import java.nio.charset.StandardCharsets;
-import java.security.GeneralSecurityException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
@@ -32,7 +31,7 @@
  * The NGINX Provider extract end user X.509 certificate send during TLS mutual authentication,
  * and forwarded in an http header.
  *
- * NGINX configuration must have : 
+ * NGINX configuration must have :
  * <code>
  * server {
  *    ...
@@ -59,6 +58,7 @@ public class NginxProxySslClientCertificateLookup extends AbstractClientCertific
     private static final Logger log = Logger.getLogger(NginxProxySslClientCertificateLookup.class);
 
     private final boolean isTruststoreLoaded;
+    private final boolean certIsUrlEncoded;
     private final Set<X509Certificate> trustedRootCerts;
     private final Set<X509Certificate> intermediateCerts;
 
@@ -68,7 +68,8 @@ public NginxProxySslClientCertificateLookup(String sslClientCertHttpHeader,
                                                 int certificateChainLength,
                                                 Set<X509Certificate> intermediateCerts,
                                                 Set<X509Certificate> trustedRootCerts,
-                                                boolean isTruststoreLoaded
+                                                boolean isTruststoreLoaded,
+                                                boolean certIsUrlEncoded
                                                 ) {
         super(sslClientCertHttpHeader, sslCertChainHttpHeaderPrefix, certificateChainLength);
 
@@ -77,6 +78,7 @@ public NginxProxySslClientCertificateLookup(String sslClientCertHttpHeader,
       this.intermediateCerts = intermediateCerts;
       this.trustedRootCerts = trustedRootCerts;
       this.isTruststoreLoaded = isTruststoreLoaded;
+      this.certIsUrlEncoded = certIsUrlEncoded;
 
         if (!this.isTruststoreLoaded) {
             log.warn("Keycloak Truststore is null or empty, but it's required for NGINX x509cert-lookup provider");
@@ -108,7 +110,9 @@ protected X509Certificate decodeCertificateFromPem(String pem) throws PemExcepti
             log.warn("End user TLS Certificate is NULL! ");
             return null;
         }
-        pem = java.net.URLDecoder.decode(pem, StandardCharsets.UTF_8);
+        if (certIsUrlEncoded) {
+            pem = java.net.URLDecoder.decode(pem, StandardCharsets.UTF_8);
+        }
 
         if (pem.startsWith(PemUtils.BEGIN_CERT)) {
             pem = removeBeginEnd(pem);
@@ -118,32 +122,24 @@ protected X509Certificate decodeCertificateFromPem(String pem) throws PemExcepti
     }
 
     @Override
-    public X509Certificate[] getCertificateChain(HttpRequest httpRequest) throws GeneralSecurityException {
-        List<X509Certificate> chain = new ArrayList<>();
-
-        // Get the client certificate
-        X509Certificate clientCert = getCertificateFromHttpHeader(httpRequest, sslClientCertHttpHeader);
-
-        if (clientCert != null) {
-            log.debugf("End user certificate found : Subject DN=[%s]  SerialNumber=[%s]", clientCert.getSubjectX500Principal(), clientCert.getSerialNumber());
-
-            // Rebuilding the end user certificate chain using Keycloak Truststore
-            X509Certificate[] certChain = buildChain(clientCert);
-            if (certChain == null || certChain.length == 0) {
-                log.info("Impossible to rebuild end user cert chain : client certificate authentication will fail." );
-                chain.add(clientCert);
-            } else {
-                for (X509Certificate caCert : certChain) {
-                    chain.add(caCert);
-                    log.debugf("Rebuilded user cert chain DN : %s", caCert.getSubjectX500Principal());
-                }
+    protected void buildChain(HttpRequest httpRequest, List<X509Certificate> chain, X509Certificate clientCert) {
+        log.debugf("End user certificate found : Subject DN=[%s]  SerialNumber=[%s]", clientCert.getSubjectX500Principal(), clientCert.getSerialNumber());
+
+        // Rebuilding the end user certificate chain using Keycloak Truststore
+        X509Certificate[] certChain = buildChain(clientCert);
+        if (certChain == null || certChain.length == 0) {
+            log.info("Impossible to rebuild end user cert chain : client certificate authentication will fail." );
+            chain.add(clientCert);
+        } else {
+            for (X509Certificate caCert : certChain) {
+                chain.add(caCert);
+                log.debugf("Rebuilded user cert chain DN : %s", caCert.getSubjectX500Principal());
             }
         }
-        return chain.toArray(new X509Certificate[0]);
     }
 
     /**
-     *  As NGINX cannot actually send the CA Chain in http header(s), 
+     *  As NGINX cannot actually send the CA Chain in http header(s),
      *  we are rebuilding here the end user certificate chain with Keycloak truststore.
      *  <br>
      *  Please note that Keycloak truststore must contain root and intermediate CA's certificates.
diff --git a/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookupFactory.java b/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookupFactory.java
index 99fdfc57f638..c44d95ba0877 100644
--- a/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookupFactory.java
+++ b/services/src/main/java/org/keycloak/services/x509/NginxProxySslClientCertificateLookupFactory.java
@@ -29,8 +29,12 @@ public class NginxProxySslClientCertificateLookupFactory extends AbstractClientC
 
     protected static final String TRUST_PROXY_VERIFICATION = "trust-proxy-verification";
 
+    protected static final String CERT_IS_URL_ENCODED = "cert-is-url-encoded";
+
     protected boolean trustProxyVerification;
 
+    protected boolean certIsUrlEncoded;
+
     private volatile boolean isTruststoreLoaded;
 
     private Set<X509Certificate> trustedRootCerts;
@@ -42,6 +46,8 @@ public void init(Config.Scope config) {
         super.init(config);
         this.trustProxyVerification = config.getBoolean(TRUST_PROXY_VERIFICATION, false);
         logger.tracev("{0}: ''{1}''", TRUST_PROXY_VERIFICATION, trustProxyVerification);
+        this.certIsUrlEncoded = config.getBoolean(CERT_IS_URL_ENCODED, true);
+        logger.tracev("{0}: ''{1}''", CERT_IS_URL_ENCODED, certIsUrlEncoded);
         this.isTruststoreLoaded = false;
         this.trustedRootCerts = ConcurrentHashMap.newKeySet();
         this.intermediateCerts = ConcurrentHashMap.newKeySet();
@@ -53,10 +59,10 @@ public X509ClientCertificateLookup create(KeycloakSession session) {
         loadKeycloakTrustStore(session);
         if (trustProxyVerification) {
             return new NginxProxyTrustedClientCertificateLookup(sslClientCertHttpHeader,
-                    sslChainHttpHeaderPrefix, certificateChainLength);
+                    sslChainHttpHeaderPrefix, certificateChainLength, certIsUrlEncoded);
         } else {
             return new NginxProxySslClientCertificateLookup(sslClientCertHttpHeader,
-                    sslChainHttpHeaderPrefix, certificateChainLength, intermediateCerts, trustedRootCerts, isTruststoreLoaded);
+                    sslChainHttpHeaderPrefix, certificateChainLength, intermediateCerts, trustedRootCerts, isTruststoreLoaded, certIsUrlEncoded);
         }
     }
 
diff --git a/services/src/main/java/org/keycloak/services/x509/NginxProxyTrustedClientCertificateLookup.java b/services/src/main/java/org/keycloak/services/x509/NginxProxyTrustedClientCertificateLookup.java
index bd5ea75390f9..fed3c49918d6 100644
--- a/services/src/main/java/org/keycloak/services/x509/NginxProxyTrustedClientCertificateLookup.java
+++ b/services/src/main/java/org/keycloak/services/x509/NginxProxyTrustedClientCertificateLookup.java
@@ -39,10 +39,15 @@ public class NginxProxyTrustedClientCertificateLookup extends AbstractClientCert
 
     private static final Logger log = Logger.getLogger(NginxProxyTrustedClientCertificateLookup.class);
 
+    private final boolean certIsUrlEncoded;
+
     public NginxProxyTrustedClientCertificateLookup(String sslCientCertHttpHeader,
                                                 String sslCertChainHttpHeaderPrefix,
-                                                int certificateChainLength) {
+                                                int certificateChainLength,
+                                                boolean certIsUrlEncoded) {
         super(sslCientCertHttpHeader, sslCertChainHttpHeaderPrefix, certificateChainLength);
+
+        this.certIsUrlEncoded = certIsUrlEncoded;
     }
 
     @Override
@@ -67,7 +72,9 @@ protected X509Certificate decodeCertificateFromPem(String pem) throws PemExcepti
             log.warn("End user TLS Certificate is NULL! ");
             return null;
         }
-        pem = java.net.URLDecoder.decode(pem, StandardCharsets.UTF_8);
+        if (certIsUrlEncoded) {
+            pem = java.net.URLDecoder.decode(pem, StandardCharsets.UTF_8);
+        }
 
 
         return PemUtils.decodeCertificate(pem);
diff --git a/services/src/main/java/org/keycloak/social/facebook/FacebookIdentityProvider.java b/services/src/main/java/org/keycloak/social/facebook/FacebookIdentityProvider.java
index fec20aa69c62..fc26c1a4514a 100755
--- a/services/src/main/java/org/keycloak/social/facebook/FacebookIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/social/facebook/FacebookIdentityProvider.java
@@ -19,6 +19,10 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
 import org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider;
 import org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
@@ -27,7 +31,11 @@
 import org.keycloak.broker.social.SocialIdentityProvider;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
 import org.keycloak.saml.common.util.StringUtil;
+import org.keycloak.services.ErrorResponseException;
+
+import java.io.IOException;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -37,6 +45,7 @@ public class FacebookIdentityProvider extends AbstractOAuth2IdentityProvider<Fac
 	public static final String AUTH_URL = "https://graph.facebook.com/oauth/authorize";
 	public static final String TOKEN_URL = "https://graph.facebook.com/oauth/access_token";
 	public static final String PROFILE_URL = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";
+    public static final String DEBUG_TOKEN_URL = "https://graph.facebook.com/debug_token";
 	public static final String DEFAULT_SCOPE = "email";
 	protected static final String PROFILE_URL_FIELDS_SEPARATOR = ",";
 
@@ -60,6 +69,29 @@ protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
 		}
 	}
 
+    private void verifyToken(String accessToken) throws IOException {
+        JsonNode response = SimpleHttp.doGet(DEBUG_TOKEN_URL, session)
+                .header(HttpHeaders.AUTHORIZATION, "Bearer " + getConfig().getClientId() + "|" + getConfig().getClientSecret())
+                .param("input_token", accessToken)
+                .asJson();
+
+        JsonNode errorNode = response.get("error");
+        if (errorNode != null) {
+            String errorMessage = getJsonProperty(errorNode, "message");
+            throw new RuntimeException("Error message:  " + errorMessage);
+        }
+
+        JsonNode dataNode = response.get("data");
+        if (dataNode == null || dataNode.isNull()) {
+            throw new RuntimeException("Invalid token debug response: 'data' field is missing.");
+        }
+
+        String appId = getJsonProperty(dataNode, "app_id");
+        if (!getConfig().getClientId().equals(appId)) {
+            throw new RuntimeException("Client ID does not match the app_id in the access token debug response.");
+        }
+    }
+
 	@Override
 	protected boolean supportsExternalExchange() {
 		return true;
@@ -108,7 +140,22 @@ protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
 		return user;
 	}
 
-	@Override
+    @Override
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        String subjectToken = tokenExchangeContext.getFormParams().getFirst(OAuth2Constants.SUBJECT_TOKEN);
+        if (subjectToken == null) {
+            throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "token not set", Response.Status.BAD_REQUEST);
+        }
+        try {
+            verifyToken(subjectToken);
+            return doGetFederatedIdentity(subjectToken);
+        }
+        catch (Exception e) {
+            throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, e.getMessage(), Response.Status.BAD_REQUEST);
+        }
+    }
+
+    @Override
 	protected String getDefaultScopes() {
 		return DEFAULT_SCOPE;
 	}
diff --git a/services/src/main/java/org/keycloak/social/github/GitHubIdentityProvider.java b/services/src/main/java/org/keycloak/social/github/GitHubIdentityProvider.java
index 85d9fd5e1f54..1aba16d4d15d 100755
--- a/services/src/main/java/org/keycloak/social/github/GitHubIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/social/github/GitHubIdentityProvider.java
@@ -19,7 +19,13 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import jakarta.ws.rs.core.Response;
+
+import java.io.IOException;
 import java.util.Iterator;
+import java.util.Map;
+
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
 import org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider;
 import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper;
@@ -29,6 +35,9 @@
 import org.keycloak.broker.social.SocialIdentityProvider;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
+import org.keycloak.services.ErrorResponseException;
+import org.keycloak.util.BasicAuthHelper;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -48,8 +57,10 @@ public class GitHubIdentityProvider extends AbstractOAuth2IdentityProvider imple
     public static final String TOKEN_URL = DEFAULT_TOKEN_URL;
 
     public static final String DEFAULT_API_URL = "https://api.github.com";
+    public static final String APPLICATIONS_FRAGMENT = "/applications";
     public static final String PROFILE_FRAGMENT = "/user";
     public static final String EMAIL_FRAGMENT = "/user/emails";
+    public static final String DEFAULT_APPLICATIONS_URL = DEFAULT_API_URL + APPLICATIONS_FRAGMENT;
     public static final String DEFAULT_PROFILE_URL = DEFAULT_API_URL + PROFILE_FRAGMENT;
     public static final String DEFAULT_EMAIL_URL = DEFAULT_API_URL + EMAIL_FRAGMENT;
     /** @deprecated Use {@link #DEFAULT_PROFILE_URL} instead. */
@@ -153,7 +164,6 @@ protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
                     if (user.getEmail() == null) {
                         user.setEmail(searchEmail(accessToken));
                     }
-
                     return user;
 		} catch (Exception e) {
 			throw new IdentityBrokerException("Profile could not be retrieved from the github endpoint", e);
@@ -190,7 +200,45 @@ private String searchEmail(String accessToken) {
 		}
 	}
 
-	@Override
+    private void verifyToken(String accessToken) throws IOException {
+        String tokenUrl = DEFAULT_APPLICATIONS_URL + "/" + getConfig().getClientId() + "/token";
+        SimpleHttp.Response response = SimpleHttp.doPost(tokenUrl, session)
+                .header("Authorization",  BasicAuthHelper.createHeader(getConfig().getClientId(), getConfig().getClientSecret()))
+                .json(Map.of("access_token", accessToken)).asResponse();
+
+        JsonNode jsonNodeResponse = response.asJson();
+        if (response.getStatus() != 200) {
+            String errorMessage = getJsonProperty(jsonNodeResponse, "message");
+            throw new RuntimeException("Error message: " + errorMessage);
+        }
+
+        JsonNode appNode = jsonNodeResponse.get("app");
+        if (appNode == null || appNode.isNull()) {
+            throw new RuntimeException("Invalid token check response: 'app' field is missing.");
+        }
+
+        String clientId = getJsonProperty(appNode, "client_id");
+        if (!getConfig().getClientId().equals(clientId)) {
+            throw new RuntimeException("Client ID does not match the client_id in the access token check response.");
+        }
+    }
+
+    @Override
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        String subjectToken = tokenExchangeContext.getFormParams().getFirst(OAuth2Constants.SUBJECT_TOKEN);
+        if (subjectToken == null) {
+            throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "token not set", Response.Status.BAD_REQUEST);
+        }
+        try {
+            verifyToken(subjectToken);
+            return doGetFederatedIdentity(subjectToken);
+        }
+        catch (Exception e) {
+            throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, e.getMessage(), Response.Status.BAD_REQUEST);
+        }
+    }
+
+    @Override
 	protected String getDefaultScopes() {
 		return DEFAULT_SCOPE;
 	}
diff --git a/services/src/main/java/org/keycloak/social/gitlab/GitLabIdentityProvider.java b/services/src/main/java/org/keycloak/social/gitlab/GitLabIdentityProvider.java
index d91f73b7930c..8e9b2aa83452 100755
--- a/services/src/main/java/org/keycloak/social/gitlab/GitLabIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/social/gitlab/GitLabIdentityProvider.java
@@ -90,7 +90,7 @@ public boolean isIssuer(String issuer, MultivaluedMap<String, String> params) {
 
 
 	@Override
-	protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, MultivaluedMap<String, String> params) {
+	protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event, MultivaluedMap<String, String> params) {
 		return exchangeExternalUserInfoValidationOnly(event, params);
 	}
 
diff --git a/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java b/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java
index 9ef583b696db..5b0df5c008c4 100755
--- a/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java
+++ b/services/src/main/java/org/keycloak/social/google/GoogleIdentityProvider.java
@@ -16,22 +16,31 @@
  */
 package org.keycloak.social.google;
 
+import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.ws.rs.core.Response;
 import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
 import org.keycloak.broker.oidc.OIDCIdentityProvider;
 import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
 import org.keycloak.broker.provider.AuthenticationRequest;
 import org.keycloak.broker.provider.BrokeredIdentityContext;
 import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.broker.social.SocialIdentityProvider;
 import org.keycloak.common.ClientConnection;
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
 import org.keycloak.events.EventBuilder;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oidc.TokenExchangeContext;
 import org.keycloak.representations.JsonWebToken;
 
 import jakarta.ws.rs.core.MultivaluedMap;
 import jakarta.ws.rs.core.UriBuilder;
-import java.util.Arrays;
+import org.keycloak.services.ErrorResponseException;
+
+import java.util.List;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -41,6 +50,7 @@ public class GoogleIdentityProvider extends OIDCIdentityProvider implements Soci
     public static final String AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
     public static final String TOKEN_URL = "https://oauth2.googleapis.com/token";
     public static final String PROFILE_URL = "https://openidconnect.googleapis.com/v1/userinfo";
+    public static final String TOKEN_INFO_URL = "https://oauth2.googleapis.com/tokeninfo";
     public static final String DEFAULT_SCOPE = "openid profile email";
 
     private static final String OIDC_PARAMETER_HOSTED_DOMAINS = "hd";
@@ -64,7 +74,7 @@ protected String getUserInfoUrl() {
         String uri = super.getUserInfoUrl();
         if (((GoogleIdentityProviderConfig)getConfig()).isUserIp()) {
             ClientConnection connection = session.getContext().getConnection();
-            if (connection != null) {
+            if (connection != null && connection.getRemoteAddr() != null) {
                 uri = KeycloakUriBuilder.fromUri(super.getUserInfoUrl()).queryParam("userIp", connection.getRemoteAddr()).build().toString();
             }
 
@@ -87,10 +97,32 @@ public boolean isIssuer(String issuer, MultivaluedMap<String, String> params) {
 
 
     @Override
-    protected BrokeredIdentityContext exchangeExternalImpl(EventBuilder event, MultivaluedMap<String, String> params) {
+    protected BrokeredIdentityContext exchangeExternalTokenV1Impl(EventBuilder event, MultivaluedMap<String, String> params) {
         return exchangeExternalUserInfoValidationOnly(event, params);
     }
 
+    @Override
+    protected BrokeredIdentityContext exchangeExternalTokenV2Impl(TokenExchangeContext tokenExchangeContext) {
+        try {
+            JsonNode tokenInfo = SimpleHttp.doGet(TOKEN_INFO_URL, session)
+                    .header("Authorization", "Bearer " + tokenExchangeContext.getParams().getSubjectToken())
+                    .asJson();
+            if (tokenInfo == null || !tokenInfo.has(JsonWebToken.AUD) || !tokenInfo.get(JsonWebToken.AUD).asText().equals(getConfig().getClientId())) {
+                logger.tracef("Invalid response or unmatching audience from the token-info endpoint from Google. Expected audience '%s' . Token info response: %s", getConfig().getClientId(), tokenInfo);
+                EventBuilder event = tokenExchangeContext.getEvent();
+                event.detail(Details.REASON, "Google token validation failed");
+                event.error(Errors.INVALID_TOKEN);
+                throw new ErrorResponseException(OAuthErrorException.INVALID_TOKEN, "Google token validation failed", Response.Status.BAD_REQUEST);
+            }
+        } catch (ErrorResponseException ere) {
+            throw ere;
+        } catch (Exception e) {
+            throw new IdentityBrokerException("Could not verify token info from google.", e);
+        }
+
+        return exchangeExternalUserInfoValidationOnly(tokenExchangeContext.getEvent(), tokenExchangeContext.getFormParams());
+    }
+
     @Override
     protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
         UriBuilder uriBuilder = super.createAuthorizationUrl(request);
@@ -112,8 +144,9 @@ protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
     protected JsonWebToken validateToken(final String encodedToken, final boolean ignoreAudience) {
         JsonWebToken token = super.validateToken(encodedToken, ignoreAudience);
         String hostedDomain = ((GoogleIdentityProviderConfig) getConfig()).getHostedDomain();
+        boolean anyHostedDomain = hostedDomain == null || "*".equals(hostedDomain);
 
-        if (hostedDomain == null) {
+        if (anyHostedDomain) {
             return token;
         }
 
@@ -123,7 +156,7 @@ protected JsonWebToken validateToken(final String encodedToken, final boolean ig
             throw new IdentityBrokerException("Identity token does not contain hosted domain parameter.");
         }
 
-        if (hostedDomain.equals("*") || Arrays.asList(hostedDomain.split(",")).contains(receivedHdParam))  {
+        if (List.of(hostedDomain.split(",")).contains(receivedHdParam))  {
             return token;
         }
 
diff --git a/services/src/main/java/org/keycloak/social/instagram/InstagramIdentityProviderFactory.java b/services/src/main/java/org/keycloak/social/instagram/InstagramIdentityProviderFactory.java
index 53e8e59fa3b1..b6e2023a5491 100755
--- a/services/src/main/java/org/keycloak/social/instagram/InstagramIdentityProviderFactory.java
+++ b/services/src/main/java/org/keycloak/social/instagram/InstagramIdentityProviderFactory.java
@@ -16,16 +16,20 @@
  */
 package org.keycloak.social.instagram;
 
+import org.keycloak.Config.Scope;
 import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
 import org.keycloak.broker.social.SocialIdentityProviderFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.common.Profile.Feature;
 import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
 
 /**
  * @author Pedro Igor
  */
-public class InstagramIdentityProviderFactory extends AbstractIdentityProviderFactory<InstagramIdentityProvider> implements SocialIdentityProviderFactory<InstagramIdentityProvider> {
+public class InstagramIdentityProviderFactory extends AbstractIdentityProviderFactory<InstagramIdentityProvider> implements SocialIdentityProviderFactory<InstagramIdentityProvider>, EnvironmentDependentProviderFactory {
 
     public static final String PROVIDER_ID = "instagram";
 
@@ -48,4 +52,9 @@ public OAuth2IdentityProviderConfig createConfig() {
     public String getId() {
         return PROVIDER_ID;
     }
+
+    @Override
+    public boolean isSupported(Scope config) {
+        return Profile.isFeatureEnabled(Feature.INSTAGRAM_BROKER);
+    }
 }
diff --git a/services/src/main/java/org/keycloak/theme/DefaultThemeManager.java b/services/src/main/java/org/keycloak/theme/DefaultThemeManager.java
index 8de64e7f86fa..d60d93de8398 100755
--- a/services/src/main/java/org/keycloak/theme/DefaultThemeManager.java
+++ b/services/src/main/java/org/keycloak/theme/DefaultThemeManager.java
@@ -102,6 +102,10 @@ public void clearCache() {
         factory.clearCache();
     }
 
+    @Override
+    public void close() {
+    }
+
     private Theme loadTheme(String name, Theme.Type type) {
         Theme theme = findTheme(name, type);
         if (theme == null) {
@@ -158,17 +162,27 @@ private boolean processImportedTheme(List<Theme> themes, Theme theme, String ori
 
     private static class ExtendingTheme implements Theme {
 
-        private List<Theme> themes;
-        private Set<ThemeResourceProvider> themeResourceProviders;
+        private final List<Theme> themes;
+        private final Set<ThemeResourceProvider> themeResourceProviders;
 
         private Properties properties;
 
-        private ConcurrentHashMap<String, ConcurrentHashMap<Locale, Map<Locale, Properties>>> messages =
+        private final ConcurrentHashMap<String, ConcurrentHashMap<Locale, Map<Locale, Properties>>> messages =
                 new ConcurrentHashMap<>();
 
+        private Pattern compiledContentHashPattern;
+
         public ExtendingTheme(List<Theme> themes, Set<ThemeResourceProvider> themeResourceProviders) {
             this.themes = themes;
             this.themeResourceProviders = themeResourceProviders;
+            try {
+                Object contentHashPattern = getProperties().get(CONTENT_HASH_PATTERN);
+                if (contentHashPattern != null) {
+                    compiledContentHashPattern = Pattern.compile(contentHashPattern.toString());
+                }
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
         }
 
         @Override
@@ -246,6 +260,11 @@ public Properties getEnhancedMessages(RealmModel realm, Locale locale) throws IO
             return LocaleUtil.enhancePropertiesWithRealmLocalizationTexts(realm, locale, messagesByLocale);
         }
 
+        @Override
+        public boolean hasContentHash(String path) throws IOException {
+            return compiledContentHashPattern != null && compiledContentHashPattern.matcher(path).matches();
+        }
+
         private Map<Locale, Properties> getMessagesByLocale(String baseBundlename, Locale locale) throws IOException {
             if (messages.get(baseBundlename) == null || messages.get(baseBundlename).get(locale) == null) {
                 Locale parent = getParent(locale);
diff --git a/services/src/main/java/org/keycloak/theme/DefaultThemeManagerFactory.java b/services/src/main/java/org/keycloak/theme/DefaultThemeManagerFactory.java
index 3969c5d3314b..ded9637ef2cb 100644
--- a/services/src/main/java/org/keycloak/theme/DefaultThemeManagerFactory.java
+++ b/services/src/main/java/org/keycloak/theme/DefaultThemeManagerFactory.java
@@ -20,6 +20,7 @@
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.ThemeManager;
 
 import java.util.concurrent.ConcurrentHashMap;
@@ -27,7 +28,7 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class DefaultThemeManagerFactory {
+public class DefaultThemeManagerFactory implements ThemeManagerFactory {
 
     private static final Logger log = Logger.getLogger(DefaultThemeManagerFactory.class);
 
@@ -39,10 +40,28 @@ public DefaultThemeManagerFactory() {
         }
     }
 
+    @Override
     public ThemeManager create(KeycloakSession session) {
         return new DefaultThemeManager(this, session);
     }
 
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
     public Theme getCachedTheme(String name, Theme.Type type) {
         if (themeCache != null) {
             DefaultThemeManagerFactory.ThemeKey key = DefaultThemeManagerFactory.ThemeKey.get(name, type);
@@ -73,6 +92,7 @@ public boolean isCacheEnabled() {
         return themeCache != null;
     }
 
+    @Override
     public void clearCache() {
         if (themeCache != null) {
             themeCache.clear();
diff --git a/services/src/main/java/org/keycloak/theme/beans/LocaleBean.java b/services/src/main/java/org/keycloak/theme/beans/LocaleBean.java
index 99b2cdac1af0..7b91a07d2848 100755
--- a/services/src/main/java/org/keycloak/theme/beans/LocaleBean.java
+++ b/services/src/main/java/org/keycloak/theme/beans/LocaleBean.java
@@ -21,10 +21,11 @@
 
 import jakarta.ws.rs.core.UriBuilder;
 
+import java.text.Bidi;
 import java.text.Collator;
 import java.util.List;
 import java.util.Properties;
-import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
 
 /**
@@ -32,18 +33,16 @@
  */
 public class LocaleBean {
 
-    private static final Set<String> RTL_LANGUAGE_CODES =
-            Set.of("ar", "dv", "fa", "ha", "he", "iw", "ji", "ps", "sd", "ug", "ur", "yi");
-
-    private String current;
-    private String currentLanguageTag;
-    private boolean rtl; // right-to-left language
-    private List<Locale> supported;
+    private final String current;
+    private final String currentLanguageTag;
+    private final boolean rtl; // right-to-left language
+    private final List<Locale> supported;
+    private static final ConcurrentHashMap<String, Boolean> bidiMap = new ConcurrentHashMap<>();
 
     public LocaleBean(RealmModel realm, java.util.Locale current, UriBuilder uriBuilder, Properties messages) {
         this.currentLanguageTag = current.toLanguageTag();
         this.current = messages.getProperty("locale_" + this.currentLanguageTag, this.currentLanguageTag);
-        this.rtl = RTL_LANGUAGE_CODES.contains(current.getLanguage());
+        this.rtl = !isLeftToRight(this.current);
 
         Collator collator = Collator.getInstance(current);
         collator.setStrength(Collator.PRIMARY); // ignore case and accents
@@ -58,6 +57,20 @@ public LocaleBean(RealmModel realm, java.util.Locale current, UriBuilder uriBuil
                 .collect(Collectors.toList());
     }
 
+    protected static boolean isLeftToRight(String current) {
+        // Some languages that are RTL have an English name in Java locales, like 'dv' aka Divehi as stated in
+        // https://github.com/keycloak/keycloak/issues/33833#issuecomment-2446965307.
+        // Still, this solution seems to be good enough for now. Any exceptions would be added when those translations arise,
+        // as each localization file can contain a `locale_xx' property with the wanted translation.
+        //
+        // Adding the ICU library was discarded at the time to avoid an additional dependency and due to its special license.
+        // This might be reconsidered in the future if there are more scenarios.
+        //
+        // As the most likely alternative, a translation could in the future define RTL, its language name, and then this can be used instead.
+
+        return bidiMap.computeIfAbsent(current, l -> new Bidi(l, Bidi.DIRECTION_DEFAULT_LEFT_TO_RIGHT).isLeftToRight());
+    }
+
     public String getCurrent() {
         return current;
     }
@@ -79,9 +92,9 @@ public List<Locale> getSupported() {
 
     public static class Locale {
 
-        private String languageTag;
-        private String label;
-        private String url;
+        private final String languageTag;
+        private final String label;
+        private final String url;
 
         public Locale(String languageTag, String label, String url) {
             this.languageTag = languageTag;
diff --git a/services/src/main/java/org/keycloak/transaction/JtaTransactionWrapper.java b/services/src/main/java/org/keycloak/transaction/JtaTransactionWrapper.java
index 0254b89ab9f1..6a4a4a5b23b4 100644
--- a/services/src/main/java/org/keycloak/transaction/JtaTransactionWrapper.java
+++ b/services/src/main/java/org/keycloak/transaction/JtaTransactionWrapper.java
@@ -66,12 +66,13 @@ public JtaTransactionWrapper(KeycloakSession session, TransactionManager tm) {
     }
 
     public void handleException(Throwable e) {
+        logger.debug(getDetailedMessage("Exception during transaction operation."), e);
+
         if (e instanceof RollbackException) {
             e = e.getCause() != null ? e.getCause() : e;
         }
         final Throwable finalE = e;
 
-        logger.error(getDetailedMessage("Exception during transaction operation."));
         session.getKeycloakSessionFactory().getProviderFactoriesStream(ExceptionConverter.class)
                 .map(factory -> ((ExceptionConverter) factory).convert(finalE))
                 .filter(Objects::nonNull)
diff --git a/services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java b/services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java
index 3bbc12dc5aab..6904797f41f6 100755
--- a/services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java
+++ b/services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java
@@ -17,15 +17,12 @@
 
 package org.keycloak.truststore;
 
-import org.keycloak.common.enums.HostnameVerificationPolicy;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-
-import java.security.cert.X509Certificate;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
-import javax.net.ssl.X509TrustManager;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
 
 /**
  * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
@@ -76,22 +73,6 @@ public TrustManager[] getTrustManagers() {
             return null;
         }
 
-        if (getProvider().getPolicy() == HostnameVerificationPolicy.ANY) {
-            return new TrustManager[] {
-                    new X509TrustManager() {
-                        public X509Certificate[] getAcceptedIssuers() {
-                            return new X509Certificate[0];
-                        }
-
-                        public void checkClientTrusted(X509Certificate[] certs, String authType) {
-                        }
-
-                        public void checkServerTrusted(X509Certificate[] certs, String authType) {
-                        }
-                    }
-            };
-        }
-
         if (tm == null) {
             synchronized (this) {
                 if (tm == null) {
diff --git a/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProviderFactory.java b/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProviderFactory.java
index b9e0feb5e0e7..bfde60eaab6d 100644
--- a/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProviderFactory.java
+++ b/services/src/main/java/org/keycloak/userprofile/DeclarativeUserProfileProviderFactory.java
@@ -28,12 +28,14 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 import org.keycloak.Config;
 import org.keycloak.Config.Scope;
 import org.keycloak.authentication.requiredactions.TermsAndConditions;
+import org.keycloak.authentication.requiredactions.UpdateEmail;
 import org.keycloak.common.Profile;
 import org.keycloak.common.Profile.Feature;
 import org.keycloak.component.AmphibianProviderFactory;
@@ -42,13 +44,14 @@
 import org.keycloak.models.KeycloakContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredActionProviderModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.organization.validator.OrganizationMemberValidator;
 import org.keycloak.provider.ProviderConfigProperty;
 import org.keycloak.provider.ProviderConfigurationBuilder;
+import org.keycloak.representations.userprofile.config.UPAttribute;
+import org.keycloak.representations.userprofile.config.UPAttributePermissions;
 import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.userprofile.config.UPConfigUtils;
@@ -57,7 +60,6 @@
 import org.keycloak.userprofile.validator.DuplicateEmailValidator;
 import org.keycloak.userprofile.validator.DuplicateUsernameValidator;
 import org.keycloak.userprofile.validator.EmailExistsAsUsernameValidator;
-import org.keycloak.userprofile.validator.ImmutableAttributeValidator;
 import org.keycloak.userprofile.validator.ReadOnlyAttributeUnchangedValidator;
 import org.keycloak.userprofile.validator.RegistrationEmailAsUsernameEmailValueValidator;
 import org.keycloak.userprofile.validator.RegistrationEmailAsUsernameUsernameValueValidator;
@@ -67,6 +69,7 @@
 import org.keycloak.validate.ValidatorConfig;
 import org.keycloak.validate.validators.EmailValidator;
 
+import static java.util.Optional.ofNullable;
 import static org.keycloak.common.util.ObjectUtil.isBlank;
 import static org.keycloak.userprofile.DefaultAttributes.READ_ONLY_ATTRIBUTE_KEY;
 import static org.keycloak.userprofile.UserProfileContext.ACCOUNT;
@@ -149,7 +152,17 @@ private static boolean editEmailCondition(AttributeContext c) {
             return true;
         }
 
-        if (Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL)) {
+        if (UpdateEmail.isEnabled(realm)) {
+            if (UPDATE_PROFILE.equals(c.getContext())) {
+                if (!isNewUser(c)) {
+                    if (c.getUser().getEmail() == null || c.getUser().getEmail().isEmpty()) {
+                        // allow to set email via UPDATE_PROFILE if the email is not set for the user
+                        return true;
+                    }
+                } else if (UserModel.EMAIL.equals(c.getAttribute().getKey()) && c.getAttribute().getValue().isEmpty()) {
+                    return true;
+                }
+            }
             return !(UPDATE_PROFILE.equals(c.getContext()) || ACCOUNT.equals(c.getContext()));
         }
 
@@ -167,12 +180,24 @@ private static boolean readEmailCondition(AttributeContext c) {
             return true;
         }
 
-        if (Profile.isFeatureEnabled(Profile.Feature.UPDATE_EMAIL)) {
+        KeycloakSession session = c.getSession();
+
+        if (UpdateEmail.isEnabled(session.getContext().getRealm())) {
+            if (UPDATE_PROFILE.equals(c.getContext())) {
+                if (!isNewUser(c)) {
+                    if (c.getUser().getEmail() == null || c.getUser().getEmail().isEmpty()) {
+                        // show email field in UPDATE_PROFILE page if the email is not set for the user
+                        return true;
+                    }
+                } else if (UserModel.EMAIL.equals(c.getAttribute().getKey()) && c.getAttribute().getValue().isEmpty()) {
+                    return true;
+                }
+            }
             return !UPDATE_PROFILE.equals(context);
         }
 
         if (UPDATE_PROFILE.equals(context)) {
-            RealmModel realm = c.getSession().getContext().getRealm();
+            RealmModel realm = session.getContext().getRealm();
 
             if (realm.isRegistrationEmailAsUsername()) {
                 return realm.isEditUsernameAllowed();
@@ -389,6 +414,9 @@ private UserProfileMetadata createRegistrationUserCreationProfile(AttributeValid
         metadata.getAttribute(UserModel.EMAIL).get(0).addValidators(Collections.singletonList(
                 new AttributeValidatorMetadata(RegistrationEmailAsUsernameEmailValueValidator.ID)));
 
+        metadata.addAttribute(UserModel.LOCALE, -1, DeclarativeUserProfileProviderFactory::isInternationalizationEnabled, DeclarativeUserProfileProviderFactory::isInternationalizationEnabled)
+                .setRequired(AttributeMetadata.ALWAYS_FALSE);
+
         return metadata;
     }
 
@@ -409,7 +437,8 @@ private UserProfileMetadata createDefaultProfile(UserProfileContext context, Att
                         new AttributeValidatorMetadata(DuplicateEmailValidator.ID),
                         new AttributeValidatorMetadata(EmailExistsAsUsernameValidator.ID),
                         new AttributeValidatorMetadata(EmailValidator.ID, ValidatorConfig.builder().config(EmailValidator.IGNORE_EMPTY_VALUE, true).build()))
-                .setAttributeDisplayName("${email}");
+                .setAttributeDisplayName("${email}")
+                .setAnnotationDecorator(DeclarativeUserProfileProviderFactory::getEmailAnnotationDecorator);
 
         List<AttributeValidatorMetadata> readonlyValidators = new ArrayList<>();
 
@@ -482,7 +511,7 @@ private void initDefaultConfiguration(Scope config) {
         // The user-defined configuration is always parsed during init and should be avoided as much as possible
         // If no user-defined configuration is set, the system default configuration must have been set
         // In Quarkus, the system default configuration is set at build time for optimization purposes
-        UPConfig defaultConfig = Optional.ofNullable(config.get("configFile"))
+        UPConfig defaultConfig = ofNullable(config.get("configFile"))
                 .map(Paths::get)
                 .map(UPConfigUtils::parseConfig)
                 .orElse(PARSED_DEFAULT_RAW_CONFIG);
@@ -495,4 +524,39 @@ private void initDefaultConfiguration(Scope config) {
         PARSED_DEFAULT_RAW_CONFIG = null;
         setDefaultConfig(defaultConfig);
     }
+
+    private static Map<String, Object> getEmailAnnotationDecorator(AttributeContext c) {
+        AttributeMetadata m = c.getMetadata();
+        Map<String, Object> rawAnnotations = Optional.ofNullable(m.getAnnotations()).orElse(Map.of());
+
+        KeycloakSession session = c.getSession();
+        KeycloakContext context = session.getContext();
+
+        if (UpdateEmail.isEnabled(context.getRealm())) {
+            UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
+            UPConfig upConfig = provider.getConfiguration();
+            UPAttribute attribute = upConfig.getAttribute(UserModel.EMAIL);
+            UPAttributePermissions permissions = attribute.getPermissions();
+
+            if (permissions == null) {
+                return rawAnnotations;
+            }
+
+            Set<String> writePermissions = permissions.getEdit();
+            boolean isWritable = writePermissions.contains(UPConfigUtils.ROLE_USER);
+            RealmModel realm = context.getRealm();
+
+            if ((realm.isRegistrationEmailAsUsername() && !realm.isEditUsernameAllowed()) || !isWritable) {
+                return rawAnnotations;
+            }
+
+            Map<String, Object> annotations = new HashMap<>(rawAnnotations);
+
+            annotations.put("kc.required.action.supported", isWritable);
+
+            return annotations;
+        }
+
+        return rawAnnotations;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/utils/BrokerUtil.java b/services/src/main/java/org/keycloak/utils/BrokerUtil.java
new file mode 100644
index 000000000000..05b947074d14
--- /dev/null
+++ b/services/src/main/java/org/keycloak/utils/BrokerUtil.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.utils;
+
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.UUID;
+
+import jakarta.ws.rs.core.UriBuilder;
+import org.keycloak.common.util.Base64Url;
+import org.keycloak.representations.account.AccountLinkUriRepresentation;
+import org.keycloak.services.Urls;
+
+/**
+ * TODO: Remove this class once support for "client initiated account linking" is removed (Probably Keycloak 27)
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class BrokerUtil {
+
+    public static AccountLinkUriRepresentation createClientInitiatedLinkURI(String clientId, String redirectUri, String identityProviderAlias, String realmName, String userSessionId, URI serverBaseUri) {
+        try {
+            String nonce = UUID.randomUUID().toString();
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
+            String input = nonce + userSessionId + clientId + identityProviderAlias;
+            byte[] check = md.digest(input.getBytes(StandardCharsets.UTF_8));
+            String hash = Base64Url.encode(check);
+            URI linkUri = Urls.identityProviderLinkRequest(serverBaseUri, identityProviderAlias, realmName);
+            linkUri = UriBuilder.fromUri(linkUri)
+                    .queryParam("nonce", nonce)
+                    .queryParam("hash", hash)
+                    .queryParam("client_id", clientId)
+                    .queryParam("redirect_uri", redirectUri)
+                    .build();
+
+            AccountLinkUriRepresentation rep = new AccountLinkUriRepresentation();
+            rep.setAccountLinkUri(linkUri);
+            rep.setHash(hash);
+            rep.setNonce(nonce);
+            return rep;
+        } catch (NoSuchAlgorithmException nsae) {
+            throw new RuntimeException(nsae);
+        }
+    }
+}
diff --git a/services/src/main/java/org/keycloak/utils/CRLUtils.java b/services/src/main/java/org/keycloak/utils/CRLUtils.java
index 1e8995dd6892..466b11df08fd 100644
--- a/services/src/main/java/org/keycloak/utils/CRLUtils.java
+++ b/services/src/main/java/org/keycloak/utils/CRLUtils.java
@@ -31,7 +31,6 @@
 import javax.security.auth.x500.X500Principal;
 
 import org.jboss.logging.Logger;
-import org.keycloak.common.util.BouncyIntegration;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.truststore.TruststoreProvider;
 
@@ -74,13 +73,12 @@ public static void check(X509Certificate[] certs, X509CRL crl, KeycloakSession s
         // Try to find the CRL issuer certificate in the truststore
         if (crlSignatureCertificate == null) {
             log.tracef("Not found CRL issuer '%s' in the CA chain of the certificate. Fallback to lookup CRL issuer in the truststore", crlIssuerPrincipal);
-            crlSignatureCertificate = findCRLSignatureCertificateInTruststore(session, certs, crl);
+            findCRLSignatureCertificateInTruststore(session, certs, crl);
+        } else {
+            // Verify signature on CRL with the previous found certificate
+            crl.verify(crlSignatureCertificate.getPublicKey());
         }
 
-        // Verify signature on CRL
-        // TODO: It will be nice to cache CRLs and also verify their signatures just once at the time when CRL is loaded, rather than in every request
-        crl.verify(crlSignatureCertificate.getPublicKey());
-
         // Finally check if
         if (crl.isRevoked(certs[0])) {
             String message = String.format("Certificate has been revoked, certificate's subject: %s", certs[0].getSubjectDN().getName());
diff --git a/services/src/main/java/org/keycloak/utils/GroupUtils.java b/services/src/main/java/org/keycloak/utils/GroupUtils.java
index 8a63af9e6b6b..68343a2f0597 100644
--- a/services/src/main/java/org/keycloak/utils/GroupUtils.java
+++ b/services/src/main/java/org/keycloak/utils/GroupUtils.java
@@ -4,12 +4,14 @@
 import java.util.Map;
 import java.util.Optional;
 import java.util.stream.Stream;
+
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.services.resources.admin.permissions.GroupPermissionEvaluator;
+import org.keycloak.services.resources.admin.fgap.GroupPermissionEvaluator;
 
 
 
@@ -24,28 +26,40 @@ public class GroupUtils {
      * @param groups The groups that we want to populate the hierarchy for
      * @return A stream of groups that contain all relevant groups from the root down with no extra siblings
      */
-    public static Stream<GroupRepresentation> populateGroupHierarchyFromSubGroups(KeycloakSession session, RealmModel realm, Stream<GroupModel> groups, boolean full, GroupPermissionEvaluator groupEvaluator) {
+    public static Stream<GroupRepresentation> populateGroupHierarchyFromSubGroups(KeycloakSession session, RealmModel realm, Stream<GroupModel> groups, boolean full, GroupPermissionEvaluator groupEvaluator, boolean subGroupsCount) {
         Map<String, GroupRepresentation> groupIdToGroups = new HashMap<>();
         groups.forEach(group -> {
-            //TODO GROUPS do permissions work in such a way that if you can view the children you can definitely view the parents?
-            if(!groupEvaluator.canView() && !groupEvaluator.canView(group)) return;
+
+            if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+                //TODO GROUPS do permissions work in such a way that if you can view the children you can definitely view the parents?
+                if (!groupEvaluator.canView() && !groupEvaluator.canView(group)) return;
+            }
 
             GroupRepresentation currGroup = toRepresentation(groupEvaluator, group, full);
-            populateSubGroupCount(group, currGroup);
+
+            if (subGroupsCount) {
+                populateSubGroupCount(group, currGroup);
+            }
+
             groupIdToGroups.putIfAbsent(currGroup.getId(), currGroup);
 
             while(currGroup.getParentId() != null) {
                 GroupModel parentModel = session.groups().getGroupById(realm, currGroup.getParentId());
 
-                //TODO GROUPS not sure if this is even necessary but if somehow you can't view the parent we need to remove the child and move on
-                if(!groupEvaluator.canView() && !groupEvaluator.canView(parentModel)) {
-                    groupIdToGroups.remove(currGroup.getId());
-                    break;
-                }
+                if (!AdminPermissionsSchema.SCHEMA.isAdminPermissionsEnabled(realm)) {
+                    //TODO GROUPS not sure if this is even necessary but if somehow you can't view the parent we need to remove the child and move on
+                    if(!groupEvaluator.canView() && !groupEvaluator.canView(parentModel)) {
+                        groupIdToGroups.remove(currGroup.getId());
+                        break;
+                    }                }
 
                 GroupRepresentation parent = groupIdToGroups.computeIfAbsent(currGroup.getParentId(),
                     id -> toRepresentation(groupEvaluator, parentModel, full));
-                populateSubGroupCount(parentModel, parent);
+
+                if (subGroupsCount) {
+                    populateSubGroupCount(parentModel, parent);
+                }
+
                 GroupRepresentation finalCurrGroup = currGroup;
 
                 // check the parent for existing subgroups that match the group we're currently operating on and merge them if needed
@@ -84,14 +98,4 @@ public static GroupRepresentation toRepresentation(GroupPermissionEvaluator grou
         rep.setAccess(groupsEvaluator.getAccess(groupTree));
         return rep;
     }
-
-    private static boolean groupMatchesSearchOrIsPathElement(GroupModel group, String search) {
-        if (StringUtil.isBlank(search)) {
-            return true;
-        }
-        if (group.getName().contains(search)) {
-            return true;
-        }
-        return group.getSubGroupsStream().findAny().isPresent();
-    }
 }
diff --git a/services/src/main/java/org/keycloak/utils/MediaType.java b/services/src/main/java/org/keycloak/utils/MediaType.java
index b992b3dc7039..5f8111dcd70b 100644
--- a/services/src/main/java/org/keycloak/utils/MediaType.java
+++ b/services/src/main/java/org/keycloak/utils/MediaType.java
@@ -38,6 +38,7 @@ public class MediaType {
     public static final jakarta.ws.rs.core.MediaType APPLICATION_FORM_URLENCODED_TYPE = jakarta.ws.rs.core.MediaType.APPLICATION_FORM_URLENCODED_TYPE;
 
     public static final String APPLICATION_JWT = "application/jwt";
+    public static final String APPLICATION_JWKS = "application/jwk-set+json";
     public static final jakarta.ws.rs.core.MediaType APPLICATION_JWT_TYPE = new jakarta.ws.rs.core.MediaType("application", "jwt");
 
     public static final String APPLICATION_XML = jakarta.ws.rs.core.MediaType.APPLICATION_XML;
diff --git a/services/src/main/java/org/keycloak/utils/SecureContextResolver.java b/services/src/main/java/org/keycloak/utils/SecureContextResolver.java
index fcb8703f12d8..93c104c83ee4 100644
--- a/services/src/main/java/org/keycloak/utils/SecureContextResolver.java
+++ b/services/src/main/java/org/keycloak/utils/SecureContextResolver.java
@@ -58,10 +58,14 @@ static boolean isSecureContext(URI uri, Supplier<DeviceRepresentation> deviceRep
             return false;
         }
 
-        if (isLocalAddress(host)) {
-            return true;
-        }
+        return isLocal(host);
+    }
+
+    public static boolean isLocal(String host) {
+        return isLocalHost(host) || isLocalAddress(host);
+    }
 
+    public static boolean isLocalHost(String host) {
         if (host.equals("localhost") || host.equals("localhost.")) {
             return true;
         }
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory b/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
index fb61a458049b..4d30a6a459c4 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
@@ -28,3 +28,4 @@ org.keycloak.authentication.requiredactions.DeleteCredentialAction
 org.keycloak.authentication.requiredactions.VerifyUserProfile
 org.keycloak.authentication.requiredactions.RecoveryAuthnCodesAction
 org.keycloak.authentication.requiredactions.UpdateEmail
+org.keycloak.broker.provider.IdpLinkAction
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
index fb2123ec3ce5..ef9d27f7455d 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
@@ -17,4 +17,5 @@
 
 org.keycloak.broker.oidc.OIDCIdentityProviderFactory
 org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory
-org.keycloak.broker.saml.SAMLIdentityProviderFactory
\ No newline at end of file
+org.keycloak.broker.saml.SAMLIdentityProviderFactory
+org.keycloak.broker.oauth.OAuth2IdentityProviderFactory
\ No newline at end of file
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider b/services/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider
new file mode 100644
index 000000000000..ad7659c48acf
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.compatibility.CompatibilityMetadataProvider
@@ -0,0 +1 @@
+org.keycloak.compatibility.KeycloakCompatibilityMetadataProvider
\ No newline at end of file
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandlerFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandlerFactory
new file mode 100644
index 000000000000..0bfd4c9a9d08
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandlerFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.protocol.oid4vc.issuance.keybinding.JwtCNonceHandlerFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidatorFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidatorFactory
new file mode 100644
index 000000000000..e24c119a6832
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidatorFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2024 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.protocol.oid4vc.issuance.keybinding.JwtProofValidatorFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerFactory
new file mode 100644
index 000000000000..aa9ddda6db02
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerFactory
@@ -0,0 +1,20 @@
+#
+# Copyright 2024 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.protocol.oid4vc.issuance.signing.LDCredentialSignerFactory
+org.keycloak.protocol.oid4vc.issuance.signing.JwtCredentialSignerFactory
+org.keycloak.protocol.oid4vc.issuance.signing.SdJwtCredentialSignerFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory
deleted file mode 100644
index 3221ba289172..000000000000
--- a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceProviderFactory
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# Copyright 2024 Red Hat, Inc. and/or its affiliates
-# and other contributors as indicated by the @author tags.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-org.keycloak.protocol.oid4vc.issuance.signing.JwtSigningServiceProviderFactory
-org.keycloak.protocol.oid4vc.issuance.signing.SdJwtSigningServiceProviderFactory
-org.keycloak.protocol.oid4vc.issuance.signing.LDSigningServiceProviderFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.TokenExchangeProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.TokenExchangeProviderFactory
index 8ec88198b16a..a405a8166ce2 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.TokenExchangeProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.TokenExchangeProviderFactory
@@ -1,2 +1,3 @@
-org.keycloak.protocol.oidc.DefaultTokenExchangeProviderFactory
-
+org.keycloak.protocol.oidc.tokenexchange.V1TokenExchangeProviderFactory
+org.keycloak.protocol.oidc.tokenexchange.StandardTokenExchangeProviderFactory
+org.keycloak.protocol.oidc.tokenexchange.ExternalToInternalTokenExchangeProviderFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.encode.TokenContextEncoderProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.encode.TokenContextEncoderProviderFactory
new file mode 100644
index 000000000000..8263029ac219
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.protocol.oidc.encode.TokenContextEncoderProviderFactory
@@ -0,0 +1,20 @@
+#
+# Copyright 2025 Red Hat, Inc. and/or its affiliates
+#  and other contributors as indicated by the @author tags.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+#
+#
+
+org.keycloak.protocol.oidc.encode.DefaultTokenContextEncoderProviderFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/services/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index 90e697c3bac4..ce422e996ea0 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/services/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -25,10 +25,13 @@ org.keycloak.services.x509.X509ClientCertificateLookupSpi
 org.keycloak.protocol.oidc.ext.OIDCExtSPI
 org.keycloak.protocol.saml.preprocessor.SamlAuthenticationPreprocessorSpi
 org.keycloak.encoding.ResourceEncodingSpi
+org.keycloak.protocol.oidc.encode.TokenContextEncoderSpi
 org.keycloak.protocol.oidc.grants.ciba.channel.AuthenticationChannelSpi
 org.keycloak.protocol.oidc.grants.ciba.resolvers.CIBALoginUserResolverSpi
 org.keycloak.protocol.oidc.rar.AuthorizationRequestParserSpi
 org.keycloak.services.resources.admin.ext.AdminRealmResourceSpi
 org.keycloak.theme.freemarker.FreeMarkerSPI
-org.keycloak.protocol.oid4vc.issuance.signing.VCSigningServiceSpi
 org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilderSpi
+org.keycloak.protocol.oid4vc.issuance.keybinding.ProofValidatorSpi
+org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerSpi
+org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandlerSpi
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
index cd2130119516..6c4b5a6ac6f6 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.condition.ClientPolicyConditionProviderFactory
@@ -8,3 +8,5 @@ org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceRolesConditionFa
 org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory
 org.keycloak.services.clientpolicy.condition.ClientProtocolConditionFactory
 org.keycloak.services.clientpolicy.condition.ClientAttributesConditionFactory
+org.keycloak.services.clientpolicy.condition.AcrConditionFactory
+org.keycloak.services.clientpolicy.condition.GrantTypeConditionFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
index 5b017e62559b..cdc5651e9723 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientpolicy.executor.ClientPolicyExecutorProviderFactory
@@ -28,3 +28,4 @@ org.keycloak.services.clientpolicy.executor.SecureRedirectUrisEnforcerExecutorFa
 org.keycloak.services.clientpolicy.executor.SamlSecureClientUrisExecutorFactory
 org.keycloak.services.clientpolicy.executor.SamlAvoidRedirectBindingExecutorFactory
 org.keycloak.services.clientpolicy.executor.SamlSignatureEnforcerExecutorFactory
+org.keycloak.services.clientpolicy.executor.AuthenticationFlowSelectorExecutorFactory
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.ClientRegistrationProviderFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.ClientRegistrationProviderFactory
index eb55687c2384..5fa53cb48edb 100755
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.ClientRegistrationProviderFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.ClientRegistrationProviderFactory
@@ -19,4 +19,3 @@ org.keycloak.services.clientregistration.DefaultClientRegistrationProviderFactor
 org.keycloak.services.clientregistration.oidc.OIDCClientRegistrationProviderFactory
 org.keycloak.services.clientregistration.AdapterInstallationClientRegistrationProviderFactory
 org.keycloak.protocol.saml.clientregistration.EntityDescriptorClientRegistrationProviderFactory
-org.keycloak.protocol.oid4vc.OID4VCClientRegistrationProviderFactory
\ No newline at end of file
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.theme.ThemeManagerFactory b/services/src/main/resources/META-INF/services/org.keycloak.theme.ThemeManagerFactory
new file mode 100644
index 000000000000..b47cff8b94c8
--- /dev/null
+++ b/services/src/main/resources/META-INF/services/org.keycloak.theme.ThemeManagerFactory
@@ -0,0 +1 @@
+org.keycloak.theme.DefaultThemeManagerFactory
diff --git a/services/src/test/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProviderTest.java b/services/src/test/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProviderTest.java
new file mode 100644
index 000000000000..2c80484b5795
--- /dev/null
+++ b/services/src/test/java/org/keycloak/compatibility/KeycloakCompatibilityMetadataProviderTest.java
@@ -0,0 +1,104 @@
+package org.keycloak.compatibility;
+
+import org.junit.Test;
+import org.keycloak.common.Profile;
+import org.keycloak.common.profile.ProfileConfigResolver;
+
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.keycloak.compatibility.KeycloakCompatibilityMetadataProvider.VERSION_KEY;
+
+public class KeycloakCompatibilityMetadataProviderTest {
+
+    @Test
+    public void testMicroVersionUpgradeWorksWithRollingUpdateV2() {
+        // Enable V2 feature
+        Profile.configure(new ProfileConfigResolver() {
+            @Override
+            public Profile.ProfileName getProfileName() {
+                return null;
+            }
+
+            @Override
+            public FeatureConfig getFeatureConfig(String feature) {
+                return Profile.Feature.ROLLING_UPDATES_V2.getVersionedKey().equals(feature) ? FeatureConfig.ENABLED : FeatureConfig.UNCONFIGURED;
+            }
+        });
+
+        // Make compatibility provider return hardcoded version as we are not able to test this in integration tests with micro versions equal to 0
+        KeycloakCompatibilityMetadataProvider compatibilityProvider = new KeycloakCompatibilityMetadataProvider("999.999.999-Final");
+
+        // Test compatible
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.999-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.998-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.999-Final1")));
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.1-Final")));
+
+        // Test incompatible
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.1000-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.998.999-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "998.999.999-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.998.998-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "998.999.998-Final")));
+
+        Profile.reset();
+    }
+
+    @Test
+    public void testRollingUpgradesV1() {
+        Profile.configure();
+
+        // Make compatibility provider return hardcoded version so we can subtract and add to any of major.minor.micro number
+        KeycloakCompatibilityMetadataProvider compatibilityProvider = new KeycloakCompatibilityMetadataProvider("999.999.999-Final") ;
+
+        // Test compatible
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.999-Final")));
+
+        // Test incompatible
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.998-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.999-Final1")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.997-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.1000-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.998.999-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "998.999.999-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.998.998-Final")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "998.999.998-Final")));
+    }
+
+    @Test
+    public void testRollingUpgradeRefusedWithOtherMetadataNotEquals() {
+        // Enable V2 feature
+        Profile.configure(new ProfileConfigResolver() {
+            @Override
+            public Profile.ProfileName getProfileName() {
+                return null;
+            }
+
+            @Override
+            public FeatureConfig getFeatureConfig(String feature) {
+                return Profile.Feature.ROLLING_UPDATES_V2.getVersionedKey().equals(feature) ? FeatureConfig.ENABLED : FeatureConfig.UNCONFIGURED;
+            }
+        });
+
+        // Make compatibility provider return hardcoded version as we are not able to test this in integration tests with micro versions equal to 0
+        KeycloakCompatibilityMetadataProvider compatibilityProvider = new KeycloakCompatibilityMetadataProvider("999.999.999-Final") {
+            @Override
+            public Map<String, String> metadata() {
+                return Map.of(VERSION_KEY, "999.999.999-Final",
+                        "key2", "value2");
+            }
+        };
+
+        // Test compatible
+        assertCompatibility(CompatibilityResult.ExitCode.ROLLING, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.998-Final", "key2", "value2")));
+
+        // Test incompatible
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.998-Final", "key2", "different-value")));
+        assertCompatibility(CompatibilityResult.ExitCode.RECREATE, compatibilityProvider.isCompatible(Map.of(VERSION_KEY, "999.999.998-Final")));
+    }
+
+    private void assertCompatibility(CompatibilityResult.ExitCode expected, CompatibilityResult actual) {
+        assertEquals("Expected compatibility result was " + expected, expected.exitCode, actual.exitCode());
+    }
+}
diff --git a/services/src/test/java/org/keycloak/events/log/JBossLoggingEventListenerProviderTest.java b/services/src/test/java/org/keycloak/events/log/JBossLoggingEventListenerProviderTest.java
new file mode 100644
index 000000000000..47ad24b94973
--- /dev/null
+++ b/services/src/test/java/org/keycloak/events/log/JBossLoggingEventListenerProviderTest.java
@@ -0,0 +1,287 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.events.log;
+
+import java.io.StringWriter;
+import java.io.Writer;
+import java.net.URI;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Consumer;
+import java.util.logging.Handler;
+import java.util.logging.Level;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.jboss.logmanager.Logger;
+import org.jboss.logmanager.formatters.PatternFormatter;
+import org.jboss.logmanager.handlers.WriterHandler;
+import org.jboss.resteasy.mock.MockHttpRequest;
+import org.junit.Test;
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.crypto.CryptoProvider;
+import org.keycloak.events.EventListenerProvider;
+import org.keycloak.events.admin.AdminEvent;
+import org.keycloak.events.admin.AuthDetails;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resteasy.HttpRequestImpl;
+import org.keycloak.services.resteasy.ResteasyKeycloakSession;
+import org.keycloak.services.resteasy.ResteasyKeycloakSessionFactory;
+import org.keycloak.utils.ScopeUtil;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class JBossLoggingEventListenerProviderTest {
+
+    @Test
+    public void testAdminDefaultSuccessNoLog() {
+        AdminEvent adminEvent = createEvent();
+        test(adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.emptyString());
+        });
+    }
+
+    @Test
+    public void testAdminDefaultSuccessInfo() {
+        AdminEvent adminEvent = createEvent();
+        test(Map.of("success-level", "info"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("INFO "));
+            assertAdminEvent(adminEvent, message);
+        });
+    }
+
+    @Test
+    public void testAdminDefaultErrorWarn() {
+        AdminEvent adminEvent = createEvent("error");
+        test(adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message);
+        });
+    }
+
+    @Test
+    public void testAdminDefaultErrorError() {
+        AdminEvent adminEvent = createEvent("error");
+        test(Map.of("error-level", "error"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("ERROR "));
+            assertAdminEvent(adminEvent, message);
+        });
+    }
+
+    @Test
+    public void testAdminSanitized() {
+        AdminEvent adminEvent = createEvent("error\twith\r\nspaces and \"quote");
+        test(adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            adminEvent.setError("error with  spaces and \\\"quote");
+            assertAdminEvent(adminEvent, message);
+        });
+    }
+
+    @Test
+    public void testAdminNoSanitized() {
+        AdminEvent adminEvent = createEvent("error\twith\r\nspaces and \"quote");
+        test(Map.of("sanitize", "false"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message);
+        });
+    }
+
+    @Test
+    public void testAdminOtherQuote() {
+        AdminEvent adminEvent = createEvent("error\twith\r\nspaces and \"quote");
+        test(Map.of("quotes", "'"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            adminEvent.setError("error with  spaces and \"quote");
+            assertAdminEvent(adminEvent, message, "'");
+        });
+    }
+
+    @Test
+    public void testAdminNoQuote() {
+        AdminEvent adminEvent = createEvent("error\twith\r\nspaces and \"quote");
+        test(Map.of("quotes", "none"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            adminEvent.setError("error with  spaces and \"quote");
+            assertAdminEvent(adminEvent, message, "");
+        });
+    }
+
+    @Test
+    public void testAdminNoQuoteNoSanitize() {
+        AdminEvent adminEvent = createEvent("error\twith\r\nspaces and \"quote");
+        test(Map.of("quotes", "none", "sanitize", "false"), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message, "");
+        });
+    }
+
+    @Test
+    public void testAdminDetails() {
+        AdminEvent adminEvent = createEvent("error");
+        adminEvent.setDetails(Map.of("detail1", "value1", "detail2", "value2"));
+        test(Map.of(), adminEvent, false, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message);
+            assertAdminEventKey(message, "detail1", "value1");
+            assertAdminEventKey(message, "detail2", "value2");
+        });
+    }
+
+    @Test
+    public void testAdminRepresentation() {
+        AdminEvent adminEvent = createEvent("error");
+        adminEvent.setRepresentation("{\"claim\": \"value\"}");
+        test(Map.of("include-representation", "true"), adminEvent, true, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message);
+            assertAdminEventKey(message, "representation", "{\\\"claim\\\": \\\"value\\\"}");
+        });
+    }
+
+    @Test
+    public void testAdminNoRepresentation() {
+        AdminEvent adminEvent = createEvent("error");
+        adminEvent.setRepresentation("{\"claim\": \"value\"}");
+        test(Map.of(), adminEvent, true, message -> {
+            MatcherAssert.assertThat(message, Matchers.startsWith("WARN "));
+            assertAdminEvent(adminEvent, message);
+            assertAdminEventKeyNotPresent(message, "representation");
+        });
+    }
+
+    private static void test(AdminEvent adminEvent, boolean includeRepresentation, Consumer<String> assertMessage) {
+        test(Map.of(), adminEvent, includeRepresentation, assertMessage);
+    }
+
+    private static void test(Map<String, String> config, AdminEvent adminEvent, boolean includeRepresentation, Consumer<String> assertMessage) {
+        KeycloakSession session = createSession(config);
+        Logger logger = Logger.getLogger("org.keycloak.events");
+        StringWriter sw = new StringWriter();
+        Handler handler = addhandler(logger, sw);
+        try {
+            JBossLoggingEventListenerProvider prov = (JBossLoggingEventListenerProvider) session.getProvider(
+                    EventListenerProvider.class, JBossLoggingEventListenerProviderFactory.ID);
+            prov.logAdminEvent(adminEvent, includeRepresentation);
+
+            assertMessage.accept(sw.toString());
+        } finally {
+            logger.removeHandler(handler);
+        }
+    }
+
+    private static KeycloakSession createSession(Map<String, String> config) {
+        HttpRequest httpRequest = new HttpRequestImpl(MockHttpRequest.create("GET", URI.create("https://keycloak.org/"), URI.create("https://keycloak.org")));
+        Profile.defaults();
+        CryptoIntegration.init(CryptoProvider.class.getClassLoader());
+        Config.init(new Config.ConfigProvider() {
+            @Override
+            public String getProvider(String spi) {
+                return null;
+            }
+
+            @Override
+            public String getDefaultProvider(String spi) {
+                return null;
+            }
+
+            @Override
+            public Config.Scope scope(String... scope) {
+                if (scope.length == 2 && "eventsListener".equals(scope[0]) && JBossLoggingEventListenerProviderFactory.ID.equals(scope[1])) {
+                    return ScopeUtil.createScope(config);
+                }
+                return ScopeUtil.createScope(new HashMap<>());
+            }
+        });
+        ResteasyKeycloakSessionFactory sessionFactory = new ResteasyKeycloakSessionFactory();
+        sessionFactory.init();
+        KeycloakSession session = new ResteasyKeycloakSession(sessionFactory);
+        session.getContext().setHttpRequest(httpRequest);
+
+        return session;
+    }
+
+    private static Handler addhandler(Logger logger, Writer writer) {
+        WriterHandler handler = new WriterHandler();
+        handler.setWriter(writer);
+        handler.setLevel(Level.ALL);
+        handler.setAutoFlush(true);
+        handler.setFormatter(new PatternFormatter("%p %m%n")); // just level and message
+        logger.addHandler(handler);
+
+        return handler;
+    }
+
+    private static AdminEvent createEvent() {
+        return createEvent(null);
+    }
+
+    private static AdminEvent createEvent(String error) {
+        AdminEvent adminEvent = new AdminEvent();
+        adminEvent.setId("id");
+        adminEvent.setOperationType(OperationType.UPDATE);
+        AuthDetails authDetails = new AuthDetails();
+        authDetails.setRealmId("realm-id");
+        authDetails.setRealmName("realm-name");
+        authDetails.setClientId("client-id");
+        authDetails.setUserId("user-id");
+        authDetails.setIpAddress("localhost");
+        adminEvent.setAuthDetails(authDetails);
+        adminEvent.setResourceType(ResourceType.USER);
+        adminEvent.setResourcePath("resource-path");
+        adminEvent.setError(error);
+        return adminEvent;
+    }
+
+    private static void assertAdminEvent(AdminEvent adminEvent, String message) {
+        assertAdminEvent(adminEvent, message, "\"");
+    }
+
+    private static void assertAdminEvent(AdminEvent adminEvent, String message, String quote) {
+        assertAdminEventKey(message, "operationType", adminEvent.getOperationType().name(), quote);
+        assertAdminEventKey(message, "realmId", adminEvent.getAuthDetails().getRealmId(), quote);
+        assertAdminEventKey(message, "realmName", adminEvent.getAuthDetails().getRealmName(), quote);
+        assertAdminEventKey(message, "clientId", adminEvent.getAuthDetails().getClientId(), quote);
+        assertAdminEventKey(message, "userId", adminEvent.getAuthDetails().getUserId(), quote);
+        assertAdminEventKey(message, "ipAddress", adminEvent.getAuthDetails().getIpAddress(), quote);
+        assertAdminEventKey(message, "resourceType", adminEvent.getResourceTypeAsString(), quote);
+        assertAdminEventKey(message, "resourcePath", adminEvent.getResourcePath(), quote);
+        if (adminEvent.getError() != null) {
+            assertAdminEventKey(message, "error", adminEvent.getError(), quote);
+        } else {
+            assertAdminEventKeyNotPresent(message, "error");
+        }
+    }
+
+    private static void assertAdminEventKey(String message, String key, String value) {
+        assertAdminEventKey(message, key, value, "\"");
+    }
+
+    private static void assertAdminEventKey(String message, String key, String value, String quote) {
+        MatcherAssert.assertThat(message, Matchers.containsString(" " + key + "=" + quote + value + quote));
+    }
+
+    private static void assertAdminEventKeyNotPresent(String message, String key) {
+        MatcherAssert.assertThat(message, Matchers.not(Matchers.containsString(" " + key + "=\"")));
+    }
+}
diff --git a/services/src/test/java/org/keycloak/exportimport/ExportImportManagerTest.java b/services/src/test/java/org/keycloak/exportimport/ExportImportManagerTest.java
index 6b22706ed933..ee87a326d739 100644
--- a/services/src/test/java/org/keycloak/exportimport/ExportImportManagerTest.java
+++ b/services/src/test/java/org/keycloak/exportimport/ExportImportManagerTest.java
@@ -13,30 +13,37 @@
 import org.keycloak.provider.Provider;
 import org.keycloak.services.DefaultKeycloakContext;
 import org.keycloak.services.DefaultKeycloakSession;
+import org.keycloak.services.DefaultKeycloakSessionFactory;
 
 public class ExportImportManagerTest {
-    
+
     @After
     public void reset() {
         ExportImportConfig.reset();
     }
-    
+
     @Test
     public void testImportOnStartup() {
         ExportImportConfig.setDir("/some/dir");
-        new ExportImportManager(new DefaultKeycloakSession(null) {
+        new ExportImportManager(new DefaultKeycloakSession(new DefaultKeycloakSessionFactory() {
+
+            @Override
+            public KeycloakSession create() {
+                return null;
+            }
+        }) {
 
             @Override
             protected DefaultKeycloakContext createKeycloakContext(KeycloakSession session) {
                 return null;
             }
-            
+
         });
         assertEquals(ExportImportConfig.ACTION_IMPORT, ExportImportConfig.getAction());
         assertEquals(Strategy.IGNORE_EXISTING.toString(), ExportImportConfig.getStrategy());
         assertTrue(ExportImportConfig.isReplacePlaceholders());
     }
-    
+
     @Test
     public void testImport() {
         ExportImportConfig.setAction(ExportImportConfig.ACTION_IMPORT);
@@ -46,28 +53,28 @@ public void testImport() {
             protected DefaultKeycloakContext createKeycloakContext(KeycloakSession session) {
                 return null;
             }
-            
+
             @Override
             public <T extends Provider> T getProvider(Class<T> clazz, String id) {
                 return (T) new ImportProvider() {
-                    
+
                     @Override
                     public void close() {
-                        
+
                     }
-                    
+
                     @Override
                     public boolean isMasterRealmExported() throws IOException {
                         return false;
                     }
-                    
+
                     @Override
                     public void importModel() throws IOException {
-                        
+
                     }
                 };
             }
-            
+
         });
         assertEquals(ExportImportConfig.ACTION_IMPORT, ExportImportConfig.getAction());
         assertNull(ExportImportConfig.getStrategy());
diff --git a/services/src/test/java/org/keycloak/protocol/ProtocolFactoryTest.java b/services/src/test/java/org/keycloak/protocol/ProtocolFactoryTest.java
new file mode 100644
index 000000000000..b6de16cc3fde
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/ProtocolFactoryTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
+import org.keycloak.protocol.saml.SamlProtocolFactory;
+
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.ServiceLoader;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class ProtocolFactoryTest {
+
+    /**
+     * this test makes sure that the LoginProtocolFactories represent the expected order in the UI for selection. The
+     * order-value is used to sort the protocol-selections in the drop-down boxes in the UI and openid-connect should be
+     * always set as default
+     */
+    @Test
+    public void testOrderOfLoginProtocolFactories() {
+        Iterator<LoginProtocolFactory> iterator = ServiceLoader.load(LoginProtocolFactory.class).iterator();
+
+        Map<Integer, LoginProtocolFactory> factories = new LinkedHashMap<>();
+        int numberOfImplementations = 0;
+        LoginProtocolFactory factory;
+        while (iterator.hasNext()) {
+            factory = iterator.next();
+            factories.put(factory.order(), factory);
+            numberOfImplementations++;
+        }
+        Assert.assertEquals("No two LoginProtocolFactories must have the same order number",
+                            numberOfImplementations, factories.size());
+        Assert.assertEquals("The OIDCLoginProtocolFactory should always come first!",
+                            OIDCLoginProtocolFactory.class,
+                            factories.get(OIDCLoginProtocolFactory.UI_ORDER).getClass());
+        Assert.assertEquals(SamlProtocolFactory.class,
+                            factories.get(OIDCLoginProtocolFactory.UI_ORDER - 10).getClass());
+        Assert.assertEquals(OID4VCLoginProtocolFactory.class,
+                            factories.get(OIDCLoginProtocolFactory.UI_ORDER - 20).getClass());
+    }
+}
diff --git a/services/src/test/java/org/keycloak/protocol/ProtocolMapperUtilsTest.java b/services/src/test/java/org/keycloak/protocol/ProtocolMapperUtilsTest.java
index 922e21f1f4be..51c9787395ff 100644
--- a/services/src/test/java/org/keycloak/protocol/ProtocolMapperUtilsTest.java
+++ b/services/src/test/java/org/keycloak/protocol/ProtocolMapperUtilsTest.java
@@ -42,7 +42,9 @@ public boolean isEmailVerified() {
         };
 
         Assert.assertEquals("theo", ProtocolMapperUtils.getUserModelValue(useModel, "username"));
+        Assert.assertEquals("theo", ProtocolMapperUtils.getUserModelValue(useModel, "Username"));
         Assert.assertEquals("true", ProtocolMapperUtils.getUserModelValue(useModel, "emailVerified"));
+        Assert.assertNull(ProtocolMapperUtils.getUserModelValue(useModel, "emailverified"));
         Assert.assertNull(ProtocolMapperUtils.getUserModelValue(useModel, "unknown"));
     }
 }
diff --git a/services/src/test/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderTest.java b/services/src/test/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderTest.java
deleted file mode 100644
index 793729c3daee..000000000000
--- a/services/src/test/java/org/keycloak/protocol/oid4vc/OID4VCClientRegistrationProviderTest.java
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.protocol.oid4vc;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
-import org.keycloak.protocol.oid4vc.model.DisplayObject;
-import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.protocol.oid4vc.model.OID4VCClient;
-import org.keycloak.protocol.oid4vc.model.ProofTypeJWT;
-import org.keycloak.protocol.oid4vc.model.ProofTypesSupported;
-import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
-
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-
-@RunWith(Parameterized.class)
-public class OID4VCClientRegistrationProviderTest {
-
-    @Parameterized.Parameters(name = "{0}")
-    public static Collection<Object[]> parameters() {
-        return Arrays.asList(new Object[][]{
-                {
-                        "Single Supported Credential with format and single-type.",
-                        Map.of(
-                                "vc.credential-id.format", Format.JWT_VC,
-                                "vc.credential-id.scope", "VerifiableCredential"),
-                        new OID4VCClient(null, "did:web:test.org",
-                                List.of(new SupportedCredentialConfiguration()
-                                        .setId("credential-id")
-                                        .setFormat(Format.JWT_VC)
-                                        .setScope("VerifiableCredential")),
-                                null, null)
-                },
-                {
-                        "Single Supported Credential with format and multi-type.",
-                        Map.of(
-                                "vc.credential-id.format", Format.JWT_VC,
-                                "vc.credential-id.scope", "AnotherCredential"),
-                        new OID4VCClient(null, "did:web:test.org",
-                                List.of(new SupportedCredentialConfiguration()
-                                        .setId("credential-id")
-                                        .setFormat(Format.JWT_VC)
-                                        .setScope("AnotherCredential")),
-                                null, null)
-                },
-                {
-                        "Single Supported Credential with format, multi-type and a display object.",
-                        Map.of(
-                                "vc.credential-id.format", Format.JWT_VC,
-                                "vc.credential-id.scope", "AnotherCredential",
-                                "vc.credential-id.display.0", "{\"name\":\"Another\",\"locale\":\"en\"}"),
-                        new OID4VCClient(null, "did:web:test.org",
-                                List.of(new SupportedCredentialConfiguration()
-                                        .setId("credential-id")
-                                        .setFormat(Format.JWT_VC)
-                                        .setDisplay(Arrays.asList(new DisplayObject().setLocale("en").setName("Another")))
-                                        .setScope("AnotherCredential")),
-                                null, null)
-                },
-                {
-                        "Multiple Supported Credentials.",
-                        Map.of(
-                                "vc.first-id.format", Format.JWT_VC,
-                                "vc.first-id.scope", "AnotherCredential",
-                                "vc.first-id.display.0", "{\"name\":\"First\",\"locale\":\"en\"}",
-                                "vc.second-id.format", Format.SD_JWT_VC,
-                                "vc.second-id.scope", "MyType",
-                                "vc.second-id.display.0", "{\"name\":\"Second Credential\",\"locale\":\"de\"}",
-                                "vc.second-id.proof_types_supported","{\"jwt\":{\"proof_signing_alg_values_supported\":[\"ES256\"]}}"),
-                        new OID4VCClient(null, "did:web:test.org",
-                                List.of(new SupportedCredentialConfiguration()
-                                                .setId("first-id")
-                                                .setFormat(Format.JWT_VC)
-                                                .setDisplay(Arrays.asList(new DisplayObject().setLocale("en").setName("First")))
-                                                .setScope("AnotherCredential"),
-                                        new SupportedCredentialConfiguration()
-                                                .setId("second-id")
-                                                .setFormat(Format.SD_JWT_VC)
-                                                .setDisplay(Arrays.asList(new DisplayObject().setLocale("de").setName("Second Credential")))
-                                                .setScope("MyType")
-                                                .setProofTypesSupported(new ProofTypesSupported().setJwt(new ProofTypeJWT().setProofSigningAlgValuesSupported(Arrays.asList("ES256"))))),
-                                null, null)
-                },
-                {
-                        "Single Supported Credential with credential build config.",
-                        Map.of(
-                                "vc.credential-id.format", Format.JWT_VC,
-                                "vc.credential-id.scope", "VerifiableCredential",
-                                "vc.credential-id.credential_build_config.token_jws_type", "JWT"
-                        ),
-                        new OID4VCClient(null, "did:web:test.org",
-                                List.of(new SupportedCredentialConfiguration()
-                                        .setId("credential-id")
-                                        .setFormat(Format.JWT_VC)
-                                        .setScope("VerifiableCredential")
-                                        .setCredentialBuildConfig(
-                                                new CredentialBuildConfig()
-                                                        .setCredentialId("credential-id")
-                                                        .setTokenJwsType("JWT"))),
-                                null, null)
-                },
-        });
-    }
-
-    private Map<String, String> clientAttributes;
-    private OID4VCClient oid4VCClient;
-
-    public OID4VCClientRegistrationProviderTest(String name, Map<String, String> clientAttributes, OID4VCClient oid4VCClient) {
-        this.clientAttributes = clientAttributes;
-        this.oid4VCClient = oid4VCClient;
-    }
-
-    @Test
-    public void testToClientRepresentation() {
-        Map<String, String> translatedAttributes = OID4VCClientRegistrationProvider.toClientRepresentation(oid4VCClient).getAttributes();
-
-        assertEquals("The client should have been translated into the correct clientRepresentation.", clientAttributes.entrySet().size(), translatedAttributes.size());
-        clientAttributes.forEach((key, value) ->
-                assertEquals("The client should have been translated into the correct clientRepresentation.", clientAttributes.get(key), translatedAttributes.get(key)));
-    }
-
-    @Test
-    public void testFromClientAttributes() {
-        assertEquals("The client should have been correctly build from the client representation",
-                oid4VCClient,
-                OID4VCClientRegistrationProvider.fromClientAttributes("did:web:test.org", clientAttributes));
-    }
-
-}
diff --git a/services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactoryTest.java b/services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactoryTest.java
new file mode 100644
index 000000000000..5b8996b0917e
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/oid4vc/issuance/credentialbuilder/CredentialBuilderFactoryTest.java
@@ -0,0 +1,49 @@
+package org.keycloak.protocol.oid4vc.issuance.credentialbuilder;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+
+import java.util.List;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.keycloak.common.Profile;
+import org.keycloak.common.Profile.Feature;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.crypto.CryptoProvider;
+import org.keycloak.common.profile.CommaSeparatedListProfileConfigResolver;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resteasy.ResteasyKeycloakSession;
+import org.keycloak.services.resteasy.ResteasyKeycloakSessionFactory;
+
+public class CredentialBuilderFactoryTest {
+
+    private static KeycloakSession session;
+
+    @BeforeClass
+    public static void beforeClass() {
+        Profile.configure(new CommaSeparatedListProfileConfigResolver(Feature.OID4VC_VCI.getVersionedKey(), ""));
+        CryptoIntegration.init(CryptoProvider.class.getClassLoader());
+        ResteasyKeycloakSessionFactory factory = new ResteasyKeycloakSessionFactory();
+        factory.init();
+        session = new ResteasyKeycloakSession(factory);
+    }
+
+    @Test
+    public void testVerifyNonNullConfigProperties() {
+        List<CredentialBuilderFactory> credentialBuilderFactories = session
+            .getKeycloakSessionFactory()
+            .getProviderFactoriesStream(CredentialBuilder.class)
+            .filter(CredentialBuilderFactory.class::isInstance)
+            .map(CredentialBuilderFactory.class::cast)
+            .toList();
+
+        assertThat(credentialBuilderFactories, is(not(empty())));
+
+        for (CredentialBuilderFactory credentialBuilderFactory : credentialBuilderFactories) {
+            assertThat(credentialBuilderFactory.getConfigProperties(), notNullValue());
+        }
+    }
+}
diff --git a/services/src/test/java/org/keycloak/protocol/oid4vc/model/ClaimsTest.java b/services/src/test/java/org/keycloak/protocol/oid4vc/model/ClaimsTest.java
index a9d012eb2a9d..a4e33a01a94d 100644
--- a/services/src/test/java/org/keycloak/protocol/oid4vc/model/ClaimsTest.java
+++ b/services/src/test/java/org/keycloak/protocol/oid4vc/model/ClaimsTest.java
@@ -16,10 +16,7 @@
  */
 package org.keycloak.protocol.oid4vc.model;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonNode;
 import org.junit.Test;
-import org.keycloak.util.JsonSerialization;
 
 import static org.junit.Assert.*;
 
@@ -28,39 +25,34 @@
  */
 public class ClaimsTest {
 
-    @Test
-    public void toJsonString() throws JsonProcessingException {
-        Claims claims = new Claims();
-        claims.put("firstName", new Claim());
-        claims.put("lastName", new Claim());
-        claims.put("email", new Claim());
-        String jsonString = claims.toJsonString();
-        JsonNode jsonNode = JsonSerialization.mapper.readTree(jsonString);
-        assertNotNull(jsonNode.get("firstName"));
-        assertNotNull(jsonNode.get("lastName"));
-        assertNotNull(jsonNode.get("email"));
-    }
-
     @Test
     public void fromJsonString() {
-        final String serializeForm = "{ \"firstName\": {}, \"lastName\": {}, \"email\": {} }";
+        final String serializeForm = "[{\"path\": [\"given_name\"], \"mandatory\": true," +
+                    "\"display\": [{\"name\": \"First Name\", \"locale\": \"en-EN\"}]}," +
+                "{\"path\": [\"family_name\"], \"mandatory\": false," +
+                    "\"display\": [{\"name\": \"Nachname\", \"locale\": \"de-DE\"}]}," +
+                "{\"path\": [\"email\"], \"mandatory\": true," +
+                    "\"display\": [{\"name\": \"E-Mail\", \"locale\": \"en-EN\"}]}]";
         Claims claims = Claims.fromJsonString(serializeForm);
         assertNotNull(claims);
-        assertNotNull(claims.get("firstName"));
-        assertNotNull(claims.get("lastName"));
-        assertNotNull(claims.get("email"));
-    }
+        assertEquals(3, claims.size());
+        assertEquals(1, claims.get(0).getPath().size());
+        assertEquals("given_name", claims.get(0).getPath().get(0));
+        assertTrue(claims.get(0).isMandatory());
+        assertEquals(1, claims.get(0).getDisplay().size());
+        assertEquals("First Name", claims.get(0).getDisplay().get(0).getName());
+        assertEquals("en-EN", claims.get(0).getDisplay().get(0).getLocale());
 
-    @Test
-    public void fromJsonStringDeepClaim() {
-        final String serializeForm = "{ \"firstName\": {\"mandatory\":false}, \"lastName\": {\"mandatory\":false}, \"email\": {\"mandatory\":true} }";
-        Claims claims = Claims.fromJsonString(serializeForm);
-        assertNotNull(claims);
-        assertNotNull(claims.get("firstName"));
-        assertFalse(claims.get("firstName").getMandatory());
-        assertNotNull(claims.get("lastName"));
-        assertFalse(claims.get("lastName").getMandatory());
-        assertNotNull(claims.get("email"));
-        assertTrue(claims.get("email").getMandatory());
+        assertEquals(1, claims.get(1).getPath().size());
+        assertEquals("family_name", claims.get(1).getPath().get(0));
+        assertFalse(claims.get(1).isMandatory());
+        assertEquals("Nachname", claims.get(1).getDisplay().get(0).getName());
+        assertEquals("de-DE", claims.get(1).getDisplay().get(0).getLocale());
+
+        assertEquals(1, claims.get(2).getPath().size());
+        assertEquals("email", claims.get(2).getPath().get(0));
+        assertTrue(claims.get(2).isMandatory());
+        assertEquals("E-Mail", claims.get(2).getDisplay().get(0).getName());
+        assertEquals("en-EN", claims.get(2).getDisplay().get(0).getLocale());
     }
 }
diff --git a/services/src/test/java/org/keycloak/protocol/oid4vc/model/ProofSerializationTest.java b/services/src/test/java/org/keycloak/protocol/oid4vc/model/ProofSerializationTest.java
index 857a2f713635..c920520c99ca 100644
--- a/services/src/test/java/org/keycloak/protocol/oid4vc/model/ProofSerializationTest.java
+++ b/services/src/test/java/org/keycloak/protocol/oid4vc/model/ProofSerializationTest.java
@@ -30,7 +30,7 @@ public class ProofSerializationTest {
     public void testSerializeProof() throws JsonProcessingException {
         ObjectMapper objectMapper = new ObjectMapper();
         String proofStr = " { \"proof_type\": \"jwt\", \"jwt\": \"ewogICJhbGciOiAiRVMyNTYiLAogICJ0eXAiOiAib3BlbmlkNHZjaS1wcm9vZitqd3QiLAogICJqd2siOiB7CiAgICAia3R5IjogIkVDIiwKICAgICJjcnYiOiAiUC0yNTYiLAogICAgIngiOiAiWEdkNU9GU1pwc080VkRRTUZrR3Z0TDVHU2FXWWE3SzBrNGhxUUdLbFBjWSIsCiAgICAieSI6ICJiSXFDaGhoVDdfdnYtYmhuRmVuREljVzVSUjRKTS1nME5sUi1qZGlHemNFIgogIH0KfQo.ewogICJpc3MiOiAib2lkNHZjaS1jbGllbnQiLAogICJhdWQiOiAiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy9tYXN0ZXIiLAogICJpYXQiOiAxNzE4OTU5MzY5LAogICJub25jZSI6ICJOODAxTEpVam1qQ1FDMUpzTm5lTllXWFpqZHQ2UEZSd01pNkpoTTU1OF9JIgp9Cg.mKKrkRkG1BfOzgsKwcZhop74EHflzHslO_NFOloKPnZ-ms6t0SnsTNDQjM_o4FBQAgtv_fnFEWRgnkNIa34gvQ\" } ";
-        Proof proof = objectMapper.readValue(proofStr, Proof.class);
+        Proof proof = objectMapper.readValue(proofStr, JwtProof.class);
         assertEquals(ProofType.JWT, proof.getProofType());
     }
 }
diff --git a/services/src/test/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderTest.java b/services/src/test/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderTest.java
new file mode 100644
index 000000000000..5716f8cca3fd
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/oidc/encode/DefaultTokenContextEncoderProviderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.protocol.oidc.encode;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DefaultTokenContextEncoderProviderTest {
+
+    private DefaultTokenContextEncoderProvider provider;
+
+    @Before
+    public void before() {
+        DefaultTokenContextEncoderProviderFactory factory = new DefaultTokenContextEncoderProviderFactory();
+        factory.init(null);
+        factory.grantsByShortcuts = new HashMap<>();
+        factory.grantsByShortcuts.put("ro", OAuth2Constants.PASSWORD);
+        factory.grantsByShortcuts.put("cc", OAuth2Constants.CLIENT_CREDENTIALS);
+        factory.grantsByShortcuts.put(DefaultTokenContextEncoderProvider.UNKNOWN, DefaultTokenContextEncoderProvider.UNKNOWN);
+        factory.grantsToShortcuts = factory.grantsByShortcuts.entrySet()
+                .stream()
+                .collect(Collectors.toMap(Map.Entry::getValue, Map.Entry::getKey));
+        provider = new DefaultTokenContextEncoderProvider(null, factory);
+    }
+
+    @Test
+    public void testSuccessClientCredentialsToken() {
+        String tokenId = "trltcc:1234";
+        AccessTokenContext ctx = provider.getTokenContextFromTokenId(tokenId);
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.LIGHTWEIGHT);
+        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.CLIENT_CREDENTIALS);
+        Assert.assertEquals(ctx.getRawTokenId(), "1234");
+
+        Assert.assertEquals(tokenId, provider.encodeTokenId(ctx));
+    }
+
+    @Test
+    public void testSuccessOfflineToken() {
+        String tokenId = "ofrtro:5678";
+        AccessTokenContext ctx = provider.getTokenContextFromTokenId(tokenId);
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.OFFLINE);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR);
+        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.PASSWORD);
+        Assert.assertEquals(ctx.getRawTokenId(), "5678");
+
+        Assert.assertEquals(tokenId, provider.encodeTokenId(ctx));
+    }
+
+    @Test
+    public void testJsonSerialization() throws IOException {
+        String tokenId = "trltcc:1234";
+        AccessTokenContext ctx = provider.getTokenContextFromTokenId(tokenId);
+
+        String s = JsonSerialization.writeValueAsString(ctx);
+        AccessTokenContext deserialized = JsonSerialization.readValue(s, AccessTokenContext.class);
+        Assert.assertEquals(ctx, deserialized);
+    }
+
+    @Test
+    public void testIncorrectGrantType() {
+        try {
+            String tokenId = "ofrtac:5678";
+            AccessTokenContext ctx = provider.getTokenContextFromTokenId(tokenId);
+            Assert.fail("Not expected to success due incorrect grant type");
+        } catch (RuntimeException iae) {
+            // ignored
+        }
+    }
+
+    @Test
+    public void testUnknownGrantType() {
+        String tokenId = "onrtna:5678";
+        AccessTokenContext ctx = provider.getTokenContextFromTokenId(tokenId);
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.ONLINE);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR);
+        Assert.assertEquals(ctx.getGrantType(), DefaultTokenContextEncoderProvider.UNKNOWN);
+        Assert.assertEquals(ctx.getRawTokenId(), "5678");
+
+        Assert.assertEquals(tokenId, provider.encodeTokenId(ctx));
+    }
+
+    @Test
+    public void testOldToken() {
+        AccessTokenContext ctx = provider.getTokenContextFromTokenId("1234");
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.UNKNOWN);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.UNKNOWN);
+        Assert.assertEquals(ctx.getGrantType(), DefaultTokenContextEncoderProvider.UNKNOWN);
+        Assert.assertEquals(ctx.getRawTokenId(), "1234");
+
+        try {
+            provider.encodeTokenId(ctx);
+            Assert.fail("Should not be possible to encode from ctx with unknown types");
+        } catch (IllegalStateException expected) {
+            // ignore
+        }
+    }
+}
diff --git a/services/src/test/java/org/keycloak/protocol/saml/SamlProtocolTest.java b/services/src/test/java/org/keycloak/protocol/saml/SamlProtocolTest.java
new file mode 100644
index 000000000000..cf7bd89b90ea
--- /dev/null
+++ b/services/src/test/java/org/keycloak/protocol/saml/SamlProtocolTest.java
@@ -0,0 +1,2269 @@
+package org.keycloak.protocol.saml;
+
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+import org.jboss.resteasy.core.ResteasyContext;
+import org.jboss.resteasy.mock.MockHttpRequest;
+import org.jboss.resteasy.specimpl.ResteasyUriInfo;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.keycloak.common.Profile;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.crypto.CryptoProvider;
+import org.keycloak.common.enums.SslRequired;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.keys.DefaultKeyManager;
+import org.keycloak.models.*;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.services.DefaultKeycloakSessionFactory;
+import org.keycloak.services.resteasy.HttpRequestImpl;
+import org.keycloak.services.resteasy.ResteasyKeycloakSessionFactory;
+import org.keycloak.services.resteasy.ResteasyKeycloakSession;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.KeyStatus;
+import org.keycloak.crypto.KeyType;
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.Algorithm;
+import java.net.URI;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Stream;
+
+import static  org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+
+public class SamlProtocolTest {
+
+    static {
+        try {
+            KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA");
+            rsa.initialize(2048);
+            rsaKeyPair = rsa.generateKeyPair();
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+    private static final KeyPair rsaKeyPair;
+
+    // reference RedirectUtilsTest
+    private static KeycloakSession session;
+
+    @BeforeClass
+    public static void beforeClass() {
+        HttpRequest httpRequest = new HttpRequestImpl(MockHttpRequest.create("GET", URI.create("https://keycloak.org/"), URI.create("https://keycloak.org")));
+        ResteasyContext.getContextDataMap().put(HttpRequest.class, httpRequest);
+        Profile.defaults();
+        CryptoIntegration.init(CryptoProvider.class.getClassLoader());
+        DefaultKeycloakSessionFactory sessionFactory = new ResteasyKeycloakSessionFactory();
+        sessionFactory.init();
+        session = new ResteasyKeycloakSession(sessionFactory) {
+            @Override
+            public KeyManager keys() {
+                return new DefaultKeyManager(null) {
+                    @Override
+                    public ActiveRsaKey getActiveRsaKey(RealmModel realm) {
+                        KeyWrapper key = new KeyWrapper();
+                        key.setProviderId("dummy");
+                        key.setKid("1234");
+                        key.setAlgorithm(Algorithm.RS256);
+                        key.setType(KeyType.RSA);
+                        key.setUse(KeyUse.SIG);
+                        key.setStatus(KeyStatus.ACTIVE);
+                        key.setPrivateKey(rsaKeyPair.getPrivate());
+                        key.setPublicKey(rsaKeyPair.getPublic());
+                        return new ActiveRsaKey(key);
+                    }
+                };
+            }
+        };
+        session.getContext().setHttpRequest(httpRequest);
+    }
+
+
+    @Test
+    public void testGetLogoutServiceUrl() {
+        TestClientModel client = new TestClientModel();
+
+        String logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_ARTIFACT_BINDING, false);
+        assertNull( logoutServiceUrl);
+
+        client.defineSetLogoutUrls(true, true, true, true);
+        logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_ARTIFACT_BINDING, false);
+        assertEquals("saml-logout-artifact-attribute", logoutServiceUrl);
+
+        logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_ARTIFACT_BINDING, true);
+        assertEquals(logoutServiceUrl, "saml-logout-redirect-attribute");
+
+        logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_SOAP_BINDING, false);
+        assertEquals(logoutServiceUrl, "saml-logout-soap-attribute");
+
+        logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_POST_BINDING, false);
+        assertEquals(logoutServiceUrl, "saml-logout-post-attribute");
+
+        logoutServiceUrl = SamlProtocol.getLogoutServiceUrl(session, client, SamlProtocol.SAML_REDIRECT_BINDING, false);
+        assertEquals(logoutServiceUrl, "saml-logout-redirect-attribute");
+
+    }
+
+    @Test
+    public void testGetLogoutBindingTypeForClientSession() {
+        TestClientModel client = new TestClientModel();
+        UserSessionModel userSession = new TestUserSessionModel();
+        AuthenticatedClientSessionModel clientSession = new TestAuthenticatedClientSessionModel(client, userSession);
+
+        // default REDIRECT
+        String bindingType = SamlProtocol.getLogoutBindingTypeForClientSession(clientSession);
+        assertEquals(SamlProtocol.SAML_REDIRECT_BINDING, bindingType);
+
+        // default to POST if forced with no url
+        client.setForcePostBinding(true);
+        assertEquals(SamlProtocol.SAML_REDIRECT_BINDING, bindingType);
+
+        client.setForcePostBinding(false);
+        clientSession.setNote(SamlProtocol.SAML_BINDING, SamlProtocol.SAML_ARTIFACT_BINDING);
+        client.defineSetLogoutUrls(false, false, true, false);
+        bindingType = SamlProtocol.getLogoutBindingTypeForClientSession(clientSession);
+        clientSession.removeNote(SamlProtocol.SAML_BINDING);
+        assertEquals(SamlProtocol.SAML_ARTIFACT_BINDING, bindingType);
+
+        client.defineSetLogoutUrls(true, false, false, false);
+        bindingType = SamlProtocol.getLogoutBindingTypeForClientSession(clientSession);
+        assertEquals(SamlProtocol.SAML_POST_BINDING, bindingType);
+
+        client.defineSetLogoutUrls(false, false, false, true);
+        bindingType = SamlProtocol.getLogoutBindingTypeForClientSession(clientSession);
+        assertEquals(SamlProtocol.SAML_REDIRECT_BINDING, bindingType);
+
+        client.setForceArtifactBinding(true);
+        client.defineSetLogoutUrls(false, false, true, false);
+        bindingType = SamlProtocol.getLogoutBindingTypeForClientSession(clientSession);
+        assertEquals(SamlProtocol.SAML_ARTIFACT_BINDING, bindingType);
+    }
+
+    @Test
+    public void frontchannelLogoutSignsLogoutRequestsEvenThoughArtifactWasUsed() {
+        TestClientModel client = new TestClientModel();
+        // dont force a binding and fallback to redirect behaviour
+        client.setForceArtifactBinding(false);
+        client.setForcePostBinding(false);
+        client.defineSetLogoutUrls(false, false, false, true);
+
+        RealmModel realm = new TestRealmModel();
+        UriInfo uriInfo = new ResteasyUriInfo("http://localhost:8080", "/");
+
+        SamlProtocol protocol = new SamlProtocol();
+        protocol.setSession(session);
+        protocol.setUriInfo(uriInfo);
+        protocol.setRealm(realm);
+
+        UserSessionModel userSession = new TestUserSessionModel();
+        AuthenticatedClientSessionModel clientSession = new TestAuthenticatedClientSessionModel(client, userSession);
+        // store, that Artifact binding hsa been used for login
+        clientSession.setNote(SamlProtocol.SAML_BINDING, SamlProtocol.SAML_ARTIFACT_BINDING);
+
+        try (Response response = protocol.frontchannelLogout(userSession, clientSession)) {
+            assertEquals(302, response.getStatus());
+            assertThat(response.getHeaderString("location"), containsString("&Signature="));
+        }
+    }
+
+    private class TestRealmModel implements RealmModel {
+        @Override
+        public String getId() {
+            return null;
+        }
+
+        @Override
+        public String getName() {
+            return "test-realm";
+        }
+
+        @Override
+        public void setName(String name) {
+
+        }
+
+        @Override
+        public String getDisplayName() {
+            return null;
+        }
+
+        @Override
+        public void setDisplayName(String displayName) {
+
+        }
+
+        @Override
+        public String getDisplayNameHtml() {
+            return null;
+        }
+
+        @Override
+        public void setDisplayNameHtml(String displayNameHtml) {
+
+        }
+
+        @Override
+        public boolean isEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public SslRequired getSslRequired() {
+            return null;
+        }
+
+        @Override
+        public void setSslRequired(SslRequired sslRequired) {
+
+        }
+
+        @Override
+        public boolean isRegistrationAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setRegistrationAllowed(boolean registrationAllowed) {
+
+        }
+
+        @Override
+        public boolean isRegistrationEmailAsUsername() {
+            return false;
+        }
+
+        @Override
+        public void setRegistrationEmailAsUsername(boolean registrationEmailAsUsername) {
+
+        }
+
+        @Override
+        public boolean isRememberMe() {
+            return false;
+        }
+
+        @Override
+        public void setRememberMe(boolean rememberMe) {
+
+        }
+
+        @Override
+        public boolean isEditUsernameAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setEditUsernameAllowed(boolean editUsernameAllowed) {
+
+        }
+
+        @Override
+        public boolean isUserManagedAccessAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setUserManagedAccessAllowed(boolean userManagedAccessAllowed) {
+
+        }
+
+        @Override
+        public void setAttribute(String name, String value) {
+
+        }
+
+        @Override
+        public void removeAttribute(String name) {
+
+        }
+
+        @Override
+        public String getAttribute(String name) {
+            return null;
+        }
+
+        @Override
+        public Map<String, String> getAttributes() {
+            return null;
+        }
+
+        @Override
+        public boolean isBruteForceProtected() {
+            return false;
+        }
+
+        @Override
+        public void setBruteForceProtected(boolean value) {
+
+        }
+
+        @Override
+        public boolean isPermanentLockout() {
+            return false;
+        }
+
+        @Override
+        public void setPermanentLockout(boolean val) {
+
+        }
+
+        @Override
+        public int getMaxTemporaryLockouts() {
+            return 0;
+        }
+
+        @Override
+        public void setMaxTemporaryLockouts(int val) {
+
+        }
+
+        @Override
+        public RealmRepresentation.BruteForceStrategy getBruteForceStrategy() {
+            return null;
+        }
+
+        @Override
+        public void setBruteForceStrategy(RealmRepresentation.BruteForceStrategy val) {
+
+        }
+
+        @Override
+        public int getMaxFailureWaitSeconds() {
+            return 0;
+        }
+
+        @Override
+        public void setMaxFailureWaitSeconds(int val) {
+
+        }
+
+        @Override
+        public int getWaitIncrementSeconds() {
+            return 0;
+        }
+
+        @Override
+        public void setWaitIncrementSeconds(int val) {
+
+        }
+
+        @Override
+        public int getMinimumQuickLoginWaitSeconds() {
+            return 0;
+        }
+
+        @Override
+        public void setMinimumQuickLoginWaitSeconds(int val) {
+
+        }
+
+        @Override
+        public long getQuickLoginCheckMilliSeconds() {
+            return 0;
+        }
+
+        @Override
+        public void setQuickLoginCheckMilliSeconds(long val) {
+
+        }
+
+        @Override
+        public int getMaxDeltaTimeSeconds() {
+            return 0;
+        }
+
+        @Override
+        public void setMaxDeltaTimeSeconds(int val) {
+
+        }
+
+        @Override
+        public int getFailureFactor() {
+            return 0;
+        }
+
+        @Override
+        public void setFailureFactor(int failureFactor) {
+
+        }
+
+        @Override
+        public boolean isVerifyEmail() {
+            return false;
+        }
+
+        @Override
+        public void setVerifyEmail(boolean verifyEmail) {
+
+        }
+
+        @Override
+        public boolean isLoginWithEmailAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setLoginWithEmailAllowed(boolean loginWithEmailAllowed) {
+
+        }
+
+        @Override
+        public boolean isDuplicateEmailsAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setDuplicateEmailsAllowed(boolean duplicateEmailsAllowed) {
+
+        }
+
+        @Override
+        public boolean isResetPasswordAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setResetPasswordAllowed(boolean resetPasswordAllowed) {
+
+        }
+
+        @Override
+        public String getDefaultSignatureAlgorithm() {
+            return null;
+        }
+
+        @Override
+        public void setDefaultSignatureAlgorithm(String defaultSignatureAlgorithm) {
+
+        }
+
+        @Override
+        public boolean isRevokeRefreshToken() {
+            return false;
+        }
+
+        @Override
+        public void setRevokeRefreshToken(boolean revokeRefreshToken) {
+
+        }
+
+        @Override
+        public int getRefreshTokenMaxReuse() {
+            return 0;
+        }
+
+        @Override
+        public void setRefreshTokenMaxReuse(int revokeRefreshTokenCount) {
+
+        }
+
+        @Override
+        public int getSsoSessionIdleTimeout() {
+            return 0;
+        }
+
+        @Override
+        public void setSsoSessionIdleTimeout(int seconds) {
+
+        }
+
+        @Override
+        public int getSsoSessionMaxLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setSsoSessionMaxLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getSsoSessionIdleTimeoutRememberMe() {
+            return 0;
+        }
+
+        @Override
+        public void setSsoSessionIdleTimeoutRememberMe(int seconds) {
+
+        }
+
+        @Override
+        public int getSsoSessionMaxLifespanRememberMe() {
+            return 0;
+        }
+
+        @Override
+        public void setSsoSessionMaxLifespanRememberMe(int seconds) {
+
+        }
+
+        @Override
+        public int getOfflineSessionIdleTimeout() {
+            return 0;
+        }
+
+        @Override
+        public void setOfflineSessionIdleTimeout(int seconds) {
+
+        }
+
+        @Override
+        public int getAccessTokenLifespan() {
+            return 0;
+        }
+
+        @Override
+        public boolean isOfflineSessionMaxLifespanEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setOfflineSessionMaxLifespanEnabled(boolean offlineSessionMaxLifespanEnabled) {
+
+        }
+
+        @Override
+        public int getOfflineSessionMaxLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setOfflineSessionMaxLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getClientSessionIdleTimeout() {
+            return 0;
+        }
+
+        @Override
+        public void setClientSessionIdleTimeout(int seconds) {
+
+        }
+
+        @Override
+        public int getClientSessionMaxLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setClientSessionMaxLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getClientOfflineSessionIdleTimeout() {
+            return 0;
+        }
+
+        @Override
+        public void setClientOfflineSessionIdleTimeout(int seconds) {
+
+        }
+
+        @Override
+        public int getClientOfflineSessionMaxLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setClientOfflineSessionMaxLifespan(int seconds) {
+
+        }
+
+        @Override
+        public void setAccessTokenLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getAccessTokenLifespanForImplicitFlow() {
+            return 0;
+        }
+
+        @Override
+        public void setAccessTokenLifespanForImplicitFlow(int seconds) {
+
+        }
+
+        @Override
+        public int getAccessCodeLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setAccessCodeLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getAccessCodeLifespanUserAction() {
+            return 0;
+        }
+
+        @Override
+        public void setAccessCodeLifespanUserAction(int seconds) {
+
+        }
+
+        @Override
+        public OAuth2DeviceConfig getOAuth2DeviceConfig() {
+            return null;
+        }
+
+        @Override
+        public CibaConfig getCibaPolicy() {
+            return null;
+        }
+
+        @Override
+        public ParConfig getParPolicy() {
+            return null;
+        }
+
+        @Override
+        public Map<String, Integer> getUserActionTokenLifespans() {
+            return null;
+        }
+
+        @Override
+        public int getAccessCodeLifespanLogin() {
+            return 0;
+        }
+
+        @Override
+        public void setAccessCodeLifespanLogin(int seconds) {
+
+        }
+
+        @Override
+        public int getActionTokenGeneratedByAdminLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setActionTokenGeneratedByAdminLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getActionTokenGeneratedByUserLifespan() {
+            return 0;
+        }
+
+        @Override
+        public void setActionTokenGeneratedByUserLifespan(int seconds) {
+
+        }
+
+        @Override
+        public int getActionTokenGeneratedByUserLifespan(String actionTokenType) {
+            return 0;
+        }
+
+        @Override
+        public void setActionTokenGeneratedByUserLifespan(String actionTokenType, Integer seconds) {
+
+        }
+
+        @Override
+        public Stream<RequiredCredentialModel> getRequiredCredentialsStream() {
+            return null;
+        }
+
+        @Override
+        public void addRequiredCredential(String cred) {
+
+        }
+
+        @Override
+        public PasswordPolicy getPasswordPolicy() {
+            return null;
+        }
+
+        @Override
+        public void setPasswordPolicy(PasswordPolicy policy) {
+
+        }
+
+        @Override
+        public OTPPolicy getOTPPolicy() {
+            return null;
+        }
+
+        @Override
+        public void setOTPPolicy(OTPPolicy policy) {
+
+        }
+
+        @Override
+        public WebAuthnPolicy getWebAuthnPolicy() {
+            return null;
+        }
+
+        @Override
+        public void setWebAuthnPolicy(WebAuthnPolicy policy) {
+
+        }
+
+        @Override
+        public WebAuthnPolicy getWebAuthnPolicyPasswordless() {
+            return null;
+        }
+
+        @Override
+        public void setWebAuthnPolicyPasswordless(WebAuthnPolicy policy) {
+
+        }
+
+        @Override
+        public RoleModel getRoleById(String id) {
+            return null;
+        }
+
+        @Override
+        public Stream<GroupModel> getDefaultGroupsStream() {
+            return null;
+        }
+
+        @Override
+        public void addDefaultGroup(GroupModel group) {
+
+        }
+
+        @Override
+        public void removeDefaultGroup(GroupModel group) {
+
+        }
+
+        @Override
+        public Stream<ClientModel> getClientsStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientModel> getClientsStream(Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public Long getClientsCount() {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientModel> getAlwaysDisplayInConsoleClientsStream() {
+            return null;
+        }
+
+        @Override
+        public ClientModel addClient(String name) {
+            return null;
+        }
+
+        @Override
+        public ClientModel addClient(String id, String clientId) {
+            return null;
+        }
+
+        @Override
+        public boolean removeClient(String id) {
+            return false;
+        }
+
+        @Override
+        public ClientModel getClientById(String id) {
+            return null;
+        }
+
+        @Override
+        public ClientModel getClientByClientId(String clientId) {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientModel> searchClientByClientIdStream(String clientId, Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientModel> searchClientByAttributes(Map<String, String> attributes, Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientModel> searchClientByAuthenticationFlowBindingOverrides(Map<String, String> overrides, Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public void updateRequiredCredentials(Set<String> creds) {
+
+        }
+
+        @Override
+        public Map<String, String> getBrowserSecurityHeaders() {
+            return null;
+        }
+
+        @Override
+        public void setBrowserSecurityHeaders(Map<String, String> headers) {
+
+        }
+
+        @Override
+        public Map<String, String> getSmtpConfig() {
+            return null;
+        }
+
+        @Override
+        public void setSmtpConfig(Map<String, String> smtpConfig) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getBrowserFlow() {
+            return null;
+        }
+
+        @Override
+        public void setBrowserFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getRegistrationFlow() {
+            return null;
+        }
+
+        @Override
+        public void setRegistrationFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getDirectGrantFlow() {
+            return null;
+        }
+
+        @Override
+        public void setDirectGrantFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getResetCredentialsFlow() {
+            return null;
+        }
+
+        @Override
+        public void setResetCredentialsFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getClientAuthenticationFlow() {
+            return null;
+        }
+
+        @Override
+        public void setClientAuthenticationFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getDockerAuthenticationFlow() {
+            return null;
+        }
+
+        @Override
+        public void setDockerAuthenticationFlow(AuthenticationFlowModel flow) {
+
+        }
+
+        @Override
+        public AuthenticationFlowModel getFirstBrokerLoginFlow() {
+            return null;
+        }
+
+        @Override
+        public Stream<AuthenticationFlowModel> getAuthenticationFlowsStream() {
+            return null;
+        }
+
+        @Override
+        public AuthenticationFlowModel getFlowByAlias(String alias) {
+            return null;
+        }
+
+        @Override
+        public AuthenticationFlowModel addAuthenticationFlow(AuthenticationFlowModel model) {
+            return null;
+        }
+
+        @Override
+        public AuthenticationFlowModel getAuthenticationFlowById(String id) {
+            return null;
+        }
+
+        @Override
+        public void removeAuthenticationFlow(AuthenticationFlowModel model) {
+
+        }
+
+        @Override
+        public void updateAuthenticationFlow(AuthenticationFlowModel model) {
+
+        }
+
+        @Override
+        public Stream<AuthenticationExecutionModel> getAuthenticationExecutionsStream(String flowId) {
+            return null;
+        }
+
+        @Override
+        public AuthenticationExecutionModel getAuthenticationExecutionById(String id) {
+            return null;
+        }
+
+        @Override
+        public AuthenticationExecutionModel getAuthenticationExecutionByFlowId(String flowId) {
+            return null;
+        }
+
+        @Override
+        public AuthenticationExecutionModel addAuthenticatorExecution(AuthenticationExecutionModel model) {
+            return null;
+        }
+
+        @Override
+        public void updateAuthenticatorExecution(AuthenticationExecutionModel model) {
+
+        }
+
+        @Override
+        public void removeAuthenticatorExecution(AuthenticationExecutionModel model) {
+
+        }
+
+        @Override
+        public Stream<AuthenticatorConfigModel> getAuthenticatorConfigsStream() {
+            return null;
+        }
+
+        @Override
+        public AuthenticatorConfigModel addAuthenticatorConfig(AuthenticatorConfigModel model) {
+            return null;
+        }
+
+        @Override
+        public void updateAuthenticatorConfig(AuthenticatorConfigModel model) {
+
+        }
+
+        @Override
+        public void removeAuthenticatorConfig(AuthenticatorConfigModel model) {
+
+        }
+
+        @Override
+        public AuthenticatorConfigModel getAuthenticatorConfigById(String id) {
+            return null;
+        }
+
+        @Override
+        public AuthenticatorConfigModel getAuthenticatorConfigByAlias(String alias) {
+            return null;
+        }
+
+        @Override
+        public Stream<RequiredActionProviderModel> getRequiredActionProvidersStream() {
+            return null;
+        }
+
+        @Override
+        public RequiredActionProviderModel addRequiredActionProvider(RequiredActionProviderModel model) {
+            return null;
+        }
+
+        @Override
+        public void updateRequiredActionProvider(RequiredActionProviderModel model) {
+
+        }
+
+        @Override
+        public void removeRequiredActionProvider(RequiredActionProviderModel model) {
+
+        }
+
+        @Override
+        public RequiredActionProviderModel getRequiredActionProviderById(String id) {
+            return null;
+        }
+
+        @Override
+        public RequiredActionProviderModel getRequiredActionProviderByAlias(String alias) {
+            return null;
+        }
+
+        @Override
+        public Stream<IdentityProviderModel> getIdentityProvidersStream() {
+            return null;
+        }
+
+        @Override
+        public IdentityProviderModel getIdentityProviderByAlias(String alias) {
+            return null;
+        }
+
+        @Override
+        public void addIdentityProvider(IdentityProviderModel identityProvider) {
+
+        }
+
+        @Override
+        public void removeIdentityProviderByAlias(String alias) {
+
+        }
+
+        @Override
+        public void updateIdentityProvider(IdentityProviderModel identityProvider) {
+
+        }
+
+        @Override
+        public Stream<IdentityProviderMapperModel> getIdentityProviderMappersStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<IdentityProviderMapperModel> getIdentityProviderMappersByAliasStream(String brokerAlias) {
+            return null;
+        }
+
+        @Override
+        public IdentityProviderMapperModel addIdentityProviderMapper(IdentityProviderMapperModel model) {
+            return null;
+        }
+
+        @Override
+        public void removeIdentityProviderMapper(IdentityProviderMapperModel mapping) {
+
+        }
+
+        @Override
+        public void updateIdentityProviderMapper(IdentityProviderMapperModel mapping) {
+
+        }
+
+        @Override
+        public IdentityProviderMapperModel getIdentityProviderMapperById(String id) {
+            return null;
+        }
+
+        @Override
+        public IdentityProviderMapperModel getIdentityProviderMapperByName(String brokerAlias, String name) {
+            return null;
+        }
+
+        @Override
+        public ComponentModel addComponentModel(ComponentModel model) {
+            return null;
+        }
+
+        @Override
+        public ComponentModel importComponentModel(ComponentModel model) {
+            return null;
+        }
+
+        @Override
+        public void updateComponent(ComponentModel component) {
+
+        }
+
+        @Override
+        public void removeComponent(ComponentModel component) {
+
+        }
+
+        @Override
+        public void removeComponents(String parentId) {
+
+        }
+
+        @Override
+        public Stream<ComponentModel> getComponentsStream(String parentId, String providerType) {
+            return null;
+        }
+
+        @Override
+        public Stream<ComponentModel> getComponentsStream(String parentId) {
+            return null;
+        }
+
+        @Override
+        public Stream<ComponentModel> getComponentsStream() {
+            return null;
+        }
+
+        @Override
+        public ComponentModel getComponent(String id) {
+            return null;
+        }
+
+        @Override
+        public String getLoginTheme() {
+            return null;
+        }
+
+        @Override
+        public void setLoginTheme(String name) {
+
+        }
+
+        @Override
+        public String getAccountTheme() {
+            return null;
+        }
+
+        @Override
+        public void setAccountTheme(String name) {
+
+        }
+
+        @Override
+        public String getAdminTheme() {
+            return null;
+        }
+
+        @Override
+        public void setAdminTheme(String name) {
+
+        }
+
+        @Override
+        public String getEmailTheme() {
+            return null;
+        }
+
+        @Override
+        public void setEmailTheme(String name) {
+
+        }
+
+        @Override
+        public int getNotBefore() {
+            return 0;
+        }
+
+        @Override
+        public void setNotBefore(int notBefore) {
+
+        }
+
+        @Override
+        public boolean isEventsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setEventsEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public long getEventsExpiration() {
+            return 0;
+        }
+
+        @Override
+        public void setEventsExpiration(long expiration) {
+
+        }
+
+        @Override
+        public Stream<String> getEventsListenersStream() {
+            return null;
+        }
+
+        @Override
+        public void setEventsListeners(Set<String> listeners) {
+
+        }
+
+        @Override
+        public Stream<String> getEnabledEventTypesStream() {
+            return null;
+        }
+
+        @Override
+        public void setEnabledEventTypes(Set<String> enabledEventTypes) {
+
+        }
+
+        @Override
+        public boolean isAdminEventsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setAdminEventsEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public boolean isAdminEventsDetailsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setAdminEventsDetailsEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public ClientModel getMasterAdminClient() {
+            return null;
+        }
+
+        @Override
+        public void setMasterAdminClient(ClientModel client) {
+
+        }
+
+        @Override
+        public RoleModel getDefaultRole() {
+            return null;
+        }
+
+        @Override
+        public void setDefaultRole(RoleModel role) {
+
+        }
+
+        @Override
+        public ClientModel getAdminPermissionsClient() {
+            return null;
+        }
+
+        @Override
+        public void setAdminPermissionsClient(ClientModel client) {
+
+        }
+
+        @Override
+        public boolean isIdentityFederationEnabled() {
+            return false;
+        }
+
+        @Override
+        public boolean isInternationalizationEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setInternationalizationEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public Stream<String> getSupportedLocalesStream() {
+            return null;
+        }
+
+        @Override
+        public void setSupportedLocales(Set<String> locales) {
+
+        }
+
+        @Override
+        public String getDefaultLocale() {
+            return null;
+        }
+
+        @Override
+        public void setDefaultLocale(String locale) {
+
+        }
+
+        @Override
+        public GroupModel createGroup(String id, String name, GroupModel toParent) {
+            return null;
+        }
+
+        @Override
+        public GroupModel getGroupById(String id) {
+            return null;
+        }
+
+        @Override
+        public Stream<GroupModel> getGroupsStream() {
+            return null;
+        }
+
+        @Override
+        public Long getGroupsCount(Boolean onlyTopGroups) {
+            return null;
+        }
+
+        @Override
+        public Long getGroupsCountByNameContaining(String search) {
+            return null;
+        }
+
+        @Override
+        public Stream<GroupModel> getTopLevelGroupsStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<GroupModel> getTopLevelGroupsStream(Integer first, Integer max) {
+            return null;
+        }
+
+        @Override
+        public boolean removeGroup(GroupModel group) {
+            return false;
+        }
+
+        @Override
+        public void moveGroup(GroupModel group, GroupModel toParent) {
+
+        }
+
+        @Override
+        public Stream<ClientScopeModel> getClientScopesStream() {
+            return null;
+        }
+
+        @Override
+        public ClientScopeModel addClientScope(String name) {
+            return null;
+        }
+
+        @Override
+        public ClientScopeModel addClientScope(String id, String name) {
+            return null;
+        }
+
+        @Override
+        public boolean removeClientScope(String id) {
+            return false;
+        }
+
+        @Override
+        public ClientScopeModel getClientScopeById(String id) {
+            return null;
+        }
+
+        @Override
+        public void addDefaultClientScope(ClientScopeModel clientScope, boolean defaultScope) {
+
+        }
+
+        @Override
+        public void removeDefaultClientScope(ClientScopeModel clientScope) {
+
+        }
+
+        @Override
+        public void createOrUpdateRealmLocalizationTexts(String locale, Map<String, String> localizationTexts) {
+
+        }
+
+        @Override
+        public boolean removeRealmLocalizationTexts(String locale) {
+            return false;
+        }
+
+        @Override
+        public Map<String, Map<String, String>> getRealmLocalizationTexts() {
+            return null;
+        }
+
+        @Override
+        public Map<String, String> getRealmLocalizationTextsByLocale(String locale) {
+            return null;
+        }
+
+        @Override
+        public Stream<ClientScopeModel> getDefaultClientScopesStream(boolean defaultScope) {
+            return null;
+        }
+
+        @Override
+        public ClientInitialAccessModel createClientInitialAccessModel(int expiration, int count) {
+            return null;
+        }
+
+        @Override
+        public ClientInitialAccessModel getClientInitialAccessModel(String id) {
+            return null;
+        }
+
+        @Override
+        public void removeClientInitialAccessModel(String id) {
+
+        }
+
+        @Override
+        public Stream<ClientInitialAccessModel> getClientInitialAccesses() {
+            return null;
+        }
+
+        @Override
+        public void decreaseRemainingCount(ClientInitialAccessModel clientInitialAccess) {
+
+        }
+
+        @Override
+        public RoleModel getRole(String name) {
+            return null;
+        }
+
+        @Override
+        public RoleModel addRole(String name) {
+            return null;
+        }
+
+        @Override
+        public RoleModel addRole(String id, String name) {
+            return null;
+        }
+
+        @Override
+        public boolean removeRole(RoleModel role) {
+            return false;
+        }
+
+        @Override
+        public Stream<RoleModel> getRolesStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> getRolesStream(Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> searchForRolesStream(String search, Integer first, Integer max) {
+            return null;
+        }
+
+        @Override
+        public void setFirstBrokerLoginFlow(org.keycloak.models.AuthenticationFlowModel flow) {}
+
+        @Override
+        public boolean isOrganizationsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setOrganizationsEnabled(boolean organizationsEnabled) {}
+
+        @Override
+        public boolean isAdminPermissionsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setAdminPermissionsEnabled(boolean adminPermissionsEnabled) {
+            // noop
+        }
+
+        @Override
+        public boolean isVerifiableCredentialsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setVerifiableCredentialsEnabled(boolean verifiableCredentialsEnabled) {
+            // noop
+        }
+
+        @Override
+        public RequiredActionConfigModel getRequiredActionConfigById(String id) {
+            return null;
+        }
+
+        @Override
+        public RequiredActionConfigModel getRequiredActionConfigByAlias(String alias) {
+            return null;
+        }
+
+        @Override
+        public void removeRequiredActionProviderConfig(RequiredActionConfigModel model) {}
+
+        @Override
+        public void updateRequiredActionConfig(RequiredActionConfigModel model) {}
+
+        @Override
+        public Stream<RequiredActionConfigModel> getRequiredActionConfigsStream() {
+            return null;
+        }
+    }
+
+    private class TestAuthenticatedClientSessionModel implements AuthenticatedClientSessionModel {
+        private ClientModel client;
+        private UserSessionModel userSession;
+
+        private Map<String, String> notes;
+        public TestAuthenticatedClientSessionModel(ClientModel client, UserSessionModel userSession) {
+            this.client = client;
+            this.userSession = userSession;
+            notes = new HashMap<>();
+        }
+
+        @Override
+        public String getId() {
+            return null;
+        }
+
+        @Override
+        public int getTimestamp() {
+            return 0;
+        }
+
+        @Override
+        public void setTimestamp(int timestamp) {
+
+        }
+
+        @Override
+        public void detachFromUserSession() {
+
+        }
+
+        @Override
+        public UserSessionModel getUserSession() {
+            return userSession;
+        }
+
+        @Override
+        public String getCurrentRefreshToken() {
+            return null;
+        }
+
+        @Override
+        public void setCurrentRefreshToken(String currentRefreshToken) {
+
+        }
+
+        @Override
+        public int getCurrentRefreshTokenUseCount() {
+            return 0;
+        }
+
+        @Override
+        public void setCurrentRefreshTokenUseCount(int currentRefreshTokenUseCount) {
+
+        }
+
+        @Override
+        public String getNote(String name) {
+            return notes.get(name);
+        }
+
+        @Override
+        public void setNote(String name, String value) {
+            notes.put(name, value);
+        }
+
+        @Override
+        public void removeNote(String name) {
+            notes.remove(name);
+        }
+
+        @Override
+        public Map<String, String> getNotes() {
+            return notes;
+        }
+
+        @Override
+        public String getRedirectUri() {
+            return null;
+        }
+
+        @Override
+        public void setRedirectUri(String uri) {
+
+        }
+
+        @Override
+        public RealmModel getRealm() {
+            return null;
+        }
+
+        @Override
+        public ClientModel getClient() {
+            return client;
+        }
+
+        @Override
+        public String getAction() {
+            return null;
+        }
+
+        @Override
+        public void setAction(String action) {
+
+        }
+
+        @Override
+        public String getProtocol() {
+            return null;
+        }
+
+        @Override
+        public void setProtocol(String method) {
+
+        }
+    }
+
+    private class TestUserSessionModel implements UserSessionModel {
+        @Override
+        public String getId() {
+            return null;
+        }
+
+        @Override
+        public RealmModel getRealm() {
+            return null;
+        }
+
+        @Override
+        public String getBrokerSessionId() {
+            return null;
+        }
+
+        @Override
+        public String getBrokerUserId() {
+            return null;
+        }
+
+        @Override
+        public UserModel getUser() {
+            return null;
+        }
+
+        @Override
+        public String getLoginUsername() {
+            return null;
+        }
+
+        @Override
+        public String getIpAddress() {
+            return null;
+        }
+
+        @Override
+        public String getAuthMethod() {
+            return null;
+        }
+
+        @Override
+        public boolean isRememberMe() {
+            return false;
+        }
+
+        @Override
+        public int getStarted() {
+            return 0;
+        }
+
+        @Override
+        public int getLastSessionRefresh() {
+            return 0;
+        }
+
+        @Override
+        public void setLastSessionRefresh(int seconds) {
+
+        }
+
+        @Override
+        public boolean isOffline() {
+            return false;
+        }
+
+        @Override
+        public Map<String, AuthenticatedClientSessionModel> getAuthenticatedClientSessions() {
+            return null;
+        }
+
+        @Override
+        public void removeAuthenticatedClientSessions(Collection<String> removedClientUUIDS) {
+
+        }
+
+        @Override
+        public String getNote(String name) {
+            return null;
+        }
+
+        @Override
+        public void setNote(String name, String value) {
+
+        }
+
+        @Override
+        public void removeNote(String name) {
+
+        }
+
+        @Override
+        public Map<String, String> getNotes() {
+            return null;
+        }
+
+        @Override
+        public UserSessionModel.State getState() {
+            return null;
+        }
+
+        @Override
+        public void setState(UserSessionModel.State state) {
+
+        }
+
+        @Override
+        public void restartSession(RealmModel realm, UserModel user, String loginUsername, String ipAddress, String authMethod, boolean rememberMe, String brokerSessionId, String brokerUserId) {
+
+        }
+    }
+
+    private class TestClientModel implements ClientModel {
+
+        private boolean forceArtifactBinding = false;
+
+        private boolean forcePostBinding = false;
+
+        private boolean logoutPostUrlSet = false;
+
+        private boolean logoutSoapUrlSet = false;
+
+        private boolean logoutArtifactUrlSet = false;
+
+        private boolean logoutRedirectUrlSet = false;
+
+        public void defineSetLogoutUrls(boolean post, boolean soap, boolean artifact, boolean redirect) {
+            logoutPostUrlSet = post;
+            logoutArtifactUrlSet = artifact;
+            logoutRedirectUrlSet = redirect;
+            logoutSoapUrlSet = soap;
+        }
+
+        public void setForceArtifactBinding(boolean forceArtifactBinding) {
+            this.forceArtifactBinding = forceArtifactBinding;
+        }
+
+        public void setForcePostBinding(boolean forcePostBinding) {
+            this.forcePostBinding = forcePostBinding;
+        }
+
+        @Override
+        public void updateClient() {
+
+        }
+
+        @Override
+        public String getId() {
+            return null;
+        }
+
+        @Override
+        public String getClientId() {
+            return null;
+        }
+
+        @Override
+        public void setClientId(String clientId) {
+
+        }
+
+        @Override
+        public String getName() {
+            return null;
+        }
+
+        @Override
+        public void setName(String name) {
+
+        }
+
+        @Override
+        public String getDescription() {
+            return null;
+        }
+
+        @Override
+        public void setDescription(String description) {
+
+        }
+
+        @Override
+        public boolean isEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setEnabled(boolean enabled) {
+
+        }
+
+        @Override
+        public boolean isAlwaysDisplayInConsole() {
+            return false;
+        }
+
+        @Override
+        public void setAlwaysDisplayInConsole(boolean alwaysDisplayInConsole) {
+
+        }
+
+        @Override
+        public boolean isSurrogateAuthRequired() {
+            return false;
+        }
+
+        @Override
+        public void setSurrogateAuthRequired(boolean surrogateAuthRequired) {
+
+        }
+
+        @Override
+        public Set<String> getWebOrigins() {
+            return null;
+        }
+
+        @Override
+        public void setWebOrigins(Set<String> webOrigins) {
+
+        }
+
+        @Override
+        public void addWebOrigin(String webOrigin) {
+
+        }
+
+        @Override
+        public void removeWebOrigin(String webOrigin) {
+
+        }
+
+        @Override
+        public Set<String> getRedirectUris() {
+            return null;
+        }
+
+        @Override
+        public void setRedirectUris(Set<String> redirectUris) {
+
+        }
+
+        @Override
+        public void addRedirectUri(String redirectUri) {
+
+        }
+
+        @Override
+        public void removeRedirectUri(String redirectUri) {
+
+        }
+
+        @Override
+        public String getManagementUrl() {
+            return null;
+        }
+
+        @Override
+        public void setManagementUrl(String url) {
+
+        }
+
+        @Override
+        public String getRootUrl() {
+            return null;
+        }
+
+        @Override
+        public void setRootUrl(String url) {
+
+        }
+
+        @Override
+        public String getBaseUrl() {
+            return null;
+        }
+
+        @Override
+        public void setBaseUrl(String url) {
+
+        }
+
+        @Override
+        public boolean isBearerOnly() {
+            return false;
+        }
+
+        @Override
+        public void setBearerOnly(boolean only) {
+
+        }
+
+        @Override
+        public int getNodeReRegistrationTimeout() {
+            return 0;
+        }
+
+        @Override
+        public void setNodeReRegistrationTimeout(int timeout) {
+
+        }
+
+        @Override
+        public String getClientAuthenticatorType() {
+            return null;
+        }
+
+        @Override
+        public void setClientAuthenticatorType(String clientAuthenticatorType) {
+
+        }
+
+        @Override
+        public boolean validateSecret(String secret) {
+            return false;
+        }
+
+        @Override
+        public String getSecret() {
+            return null;
+        }
+
+        @Override
+        public void setSecret(String secret) {
+
+        }
+
+        @Override
+        public String getRegistrationToken() {
+            return null;
+        }
+
+        @Override
+        public void setRegistrationToken(String registrationToken) {
+
+        }
+
+        @Override
+        public String getProtocol() {
+            return null;
+        }
+
+        @Override
+        public void setProtocol(String protocol) {
+
+        }
+
+        @Override
+        public void setAttribute(String name, String value) {
+
+        }
+
+        @Override
+        public void removeAttribute(String name) {
+
+        }
+
+        @Override
+        public String getAttribute(String name) {
+            if (SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE.equals(name) && logoutArtifactUrlSet) {
+                return "saml-logout-artifact-attribute";
+            }
+            if (SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE.equals(name) && logoutPostUrlSet) {
+                return "saml-logout-post-attribute";
+            }
+            if (SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE.equals(name) && logoutRedirectUrlSet) {
+                return "saml-logout-redirect-attribute";
+            }
+            if (SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE.equals(name) && logoutSoapUrlSet) {
+                return "saml-logout-soap-attribute";
+            }
+            if (SamlConfigAttributes.SAML_FORCE_POST_BINDING.equals(name)) {
+                return forcePostBinding ? "true" : "false";
+            }
+            if (SamlConfigAttributes.SAML_ARTIFACT_BINDING.equals(name)) {
+                return forceArtifactBinding ? "true" : "false";
+            }
+            if (SamlConfigAttributes.SAML_SERVER_SIGNATURE.equals(name)) {
+                return "true";
+            }
+
+            return null;
+        }
+
+        @Override
+        public Map<String, String> getAttributes() {
+            return null;
+        }
+
+        @Override
+        public String getAuthenticationFlowBindingOverride(String binding) {
+            return null;
+        }
+
+        @Override
+        public Map<String, String> getAuthenticationFlowBindingOverrides() {
+            return null;
+        }
+
+        @Override
+        public void removeAuthenticationFlowBindingOverride(String binding) {
+
+        }
+
+        @Override
+        public void setAuthenticationFlowBindingOverride(String binding, String flowId) {
+
+        }
+
+        @Override
+        public boolean isFrontchannelLogout() {
+            return false;
+        }
+
+        @Override
+        public void setFrontchannelLogout(boolean flag) {
+
+        }
+
+        @Override
+        public boolean isFullScopeAllowed() {
+            return false;
+        }
+
+        @Override
+        public void setFullScopeAllowed(boolean value) {
+
+        }
+
+        @Override
+        public boolean isPublicClient() {
+            return false;
+        }
+
+        @Override
+        public void setPublicClient(boolean flag) {
+
+        }
+
+        @Override
+        public boolean isConsentRequired() {
+            return false;
+        }
+
+        @Override
+        public void setConsentRequired(boolean consentRequired) {
+
+        }
+
+        @Override
+        public boolean isStandardFlowEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setStandardFlowEnabled(boolean standardFlowEnabled) {
+
+        }
+
+        @Override
+        public boolean isImplicitFlowEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setImplicitFlowEnabled(boolean implicitFlowEnabled) {
+
+        }
+
+        @Override
+        public boolean isDirectAccessGrantsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setDirectAccessGrantsEnabled(boolean directAccessGrantsEnabled) {
+
+        }
+
+        @Override
+        public boolean isServiceAccountsEnabled() {
+            return false;
+        }
+
+        @Override
+        public void setServiceAccountsEnabled(boolean serviceAccountsEnabled) {
+
+        }
+
+        @Override
+        public RealmModel getRealm() {
+            return null;
+        }
+
+        @Override
+        public void addClientScope(ClientScopeModel clientScope, boolean defaultScope) {
+
+        }
+
+        @Override
+        public void addClientScopes(Set<ClientScopeModel> clientScopes, boolean defaultScope) {
+
+        }
+
+        @Override
+        public void removeClientScope(ClientScopeModel clientScope) {
+
+        }
+
+        @Override
+        public Map<String, ClientScopeModel> getClientScopes(boolean defaultScope) {
+            return null;
+        }
+
+        @Override
+        public int getNotBefore() {
+            return 0;
+        }
+
+        @Override
+        public void setNotBefore(int notBefore) {
+
+        }
+
+        @Override
+        public Map<String, Integer> getRegisteredNodes() {
+            return null;
+        }
+
+        @Override
+        public void registerNode(String nodeHost, int registrationTime) {
+
+        }
+
+        @Override
+        public void unregisterNode(String nodeHost) {
+
+        }
+
+        @Override
+        public Stream<ProtocolMapperModel> getProtocolMappersStream() {
+            return null;
+        }
+
+        @Override
+        public ProtocolMapperModel addProtocolMapper(ProtocolMapperModel model) {
+            return null;
+        }
+
+        @Override
+        public void removeProtocolMapper(ProtocolMapperModel mapping) {
+
+        }
+
+        @Override
+        public void updateProtocolMapper(ProtocolMapperModel mapping) {
+
+        }
+
+        @Override
+        public ProtocolMapperModel getProtocolMapperById(String id) {
+            return null;
+        }
+
+        @Override
+        public ProtocolMapperModel getProtocolMapperByName(String protocol, String name) {
+            return null;
+        }
+
+        @Override
+        public RoleModel getRole(String name) {
+            return null;
+        }
+
+        @Override
+        public RoleModel addRole(String name) {
+            return null;
+        }
+
+        @Override
+        public RoleModel addRole(String id, String name) {
+            return null;
+        }
+
+        @Override
+        public boolean removeRole(RoleModel role) {
+            return false;
+        }
+
+        @Override
+        public Stream<RoleModel> getRolesStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> getRolesStream(Integer firstResult, Integer maxResults) {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> searchForRolesStream(String search, Integer first, Integer max) {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> getScopeMappingsStream() {
+            return null;
+        }
+
+        @Override
+        public Stream<RoleModel> getRealmScopeMappingsStream() {
+            return null;
+        }
+
+        @Override
+        public void addScopeMapping(RoleModel role) {
+
+        }
+
+        @Override
+        public void deleteScopeMapping(RoleModel role) {
+
+        }
+
+        @Override
+        public boolean hasScope(RoleModel role) {
+            return false;
+        }
+    };
+
+}
diff --git a/services/src/test/java/org/keycloak/services/DefaultKeycloakSessionFactoryTest.java b/services/src/test/java/org/keycloak/services/DefaultKeycloakSessionFactoryTest.java
index 3a8db0a6c5db..d3322b038395 100644
--- a/services/src/test/java/org/keycloak/services/DefaultKeycloakSessionFactoryTest.java
+++ b/services/src/test/java/org/keycloak/services/DefaultKeycloakSessionFactoryTest.java
@@ -10,9 +10,13 @@
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.provider.Spi;
+import org.keycloak.vault.VaultProvider;
+
+import static org.junit.Assert.assertFalse;
 
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 
 public class DefaultKeycloakSessionFactoryTest {
 
@@ -30,6 +34,41 @@ public void after() {
         Config.init(new Config.SystemPropertiesConfigProvider());
     }
 
+    @Test
+    public void testProviderInitialization() {
+        DefaultKeycloakSessionFactory factory = new DefaultKeycloakSessionFactory() {
+
+            @Override
+            public KeycloakSession create() {
+                return null;
+            }
+        };
+
+        Map<String, ProviderFactory> dependants = Map.of("two", new DummyProviderFactory("two", 2) {
+            @Override
+            public Set<Class<? extends Provider>> dependsOn() {
+                return Set.of(VaultProvider.class);
+            }
+        }, "one", new DummyProviderFactory("one", 0) {
+            @Override
+            public Set<Class<? extends Provider>> dependsOn() {
+                return Set.of(VaultProvider.class);
+            }
+        });
+
+        Map<String, ProviderFactory> vault = Map.of("three", new DummyVaultProviderFactory("three", 3) {
+            boolean init;
+
+            @Override
+            public void postInit(KeycloakSessionFactory factory) {
+                assertFalse(init);
+                init = true;
+            }
+        });
+
+        factory.initProviderFactories(false, Map.of(Provider.class, dependants, VaultProvider.class, vault));
+    }
+
     @Test
     public void defaultProviderFromConfigTest() {
         Map<String, ProviderFactory> map = new HashMap<>(Map.of(
@@ -90,18 +129,34 @@ public Config.Scope scope(String... scope) {
         }
     }
 
-    private class DummyProviderFactory implements ProviderFactory {
-
-        private String id;
-        private int order;
+    private class DummyProviderFactory extends SimpleProviderFactory<Provider> {
 
         public DummyProviderFactory(String id, int order) {
+            super(id, order);
+        }
+
+    }
+
+    private class DummyVaultProviderFactory extends SimpleProviderFactory<VaultProvider> {
+
+        public DummyVaultProviderFactory(String id, int order) {
+            super(id, order);
+        }
+
+    }
+
+    private class SimpleProviderFactory<T extends Provider> implements ProviderFactory<T> {
+
+        String id;
+        int order;
+
+        public SimpleProviderFactory(String id, int order) {
             this.id = id;
             this.order = order;
         }
 
         @Override
-        public Provider create(KeycloakSession session) {
+        public T create(KeycloakSession session) {
             return null;
         }
 
diff --git a/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java
index a73de6c98353..a8ebe068edb2 100644
--- a/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java
+++ b/services/src/test/java/org/keycloak/services/clientregistration/policy/impl/TrustedHostClientRegistrationPolicyTest.java
@@ -16,6 +16,9 @@
  */
 package org.keycloak.services.clientregistration.policy.impl;
 
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
 import org.junit.Assert;
 import org.junit.BeforeClass;
 import org.junit.Test;
@@ -51,8 +54,8 @@ public void testLocalhostName() {
         ComponentModel model = createComponentModel("localhost");
         TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
 
-        policy.verifyHost("127.0.0.1");
-        Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+        assertTrue(policy.verifyHost("127.0.0.1"));
+        assertFalse(policy.verifyHost("10.0.0.1"));
         policy.checkURLTrusted("https://localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
         Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://otherhost",
                 policy.getTrustedHosts(), policy.getTrustedDomains()));
@@ -64,8 +67,8 @@ public void testLocalhostDomain() {
         ComponentModel model = createComponentModel("*.localhost");
         TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
 
-        policy.verifyHost("127.0.0.1");
-        Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+        assertTrue(policy.verifyHost("127.0.0.1"));
+        assertFalse(policy.verifyHost("10.0.0.1"));
         policy.checkURLTrusted("https://localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
         policy.checkURLTrusted("https://other.localhost", policy.getTrustedHosts(), policy.getTrustedDomains());
         Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://otherlocalhost",
@@ -78,8 +81,8 @@ public void testLocalhostIP() {
         ComponentModel model = createComponentModel("127.0.0.1");
         TrustedHostClientRegistrationPolicy policy = (TrustedHostClientRegistrationPolicy) factory.create(session, model);
 
-        policy.verifyHost("127.0.0.1");
-        Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.verifyHost("10.0.0.1"));
+        assertTrue(policy.verifyHost("127.0.0.1"));
+        assertFalse(policy.verifyHost("10.0.0.1"));
         policy.checkURLTrusted("https://127.0.0.1", policy.getTrustedHosts(), policy.getTrustedDomains());
         Assert.assertThrows(ClientRegistrationPolicyException.class, () -> policy.checkURLTrusted("https://localhost",
                 policy.getTrustedHosts(), policy.getTrustedDomains()));
diff --git a/services/src/test/java/org/keycloak/services/resteasy/HttpRequestImpl.java b/services/src/test/java/org/keycloak/services/resteasy/HttpRequestImpl.java
index 04310c924f9c..b56ba499dcee 100644
--- a/services/src/test/java/org/keycloak/services/resteasy/HttpRequestImpl.java
+++ b/services/src/test/java/org/keycloak/services/resteasy/HttpRequestImpl.java
@@ -123,4 +123,9 @@ public UriInfo getUri() {
         }
         return delegate.getUri();
     }
+
+    @Override
+    public boolean isProxyTrusted() {
+        return true;
+    }
 }
diff --git a/services/src/test/java/org/keycloak/theme/beans/LocaleBeanTest.java b/services/src/test/java/org/keycloak/theme/beans/LocaleBeanTest.java
new file mode 100644
index 000000000000..cb7b134b7642
--- /dev/null
+++ b/services/src/test/java/org/keycloak/theme/beans/LocaleBeanTest.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.theme.beans;
+
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.Test;
+
+import java.util.Locale;
+import java.util.Set;
+
+/**
+ * @author Alexander Schwartz
+ */
+public class LocaleBeanTest {
+
+    private static final Set<String> RTL_LANGUAGE_CODES =
+            Set.of("ar", "dv", "fa", "ha", "he", "iw", "ji", "ps", "sd", "ug", "ur", "yi");
+
+    private static final Set<String> LTR_LANGUAGE_CODES =
+            Set.of("en", "de");
+
+    @Test
+    public void verifyRtl() {
+        for (String rtlLanguageCode : RTL_LANGUAGE_CODES) {
+            MatcherAssert.assertThat(LocaleBean.isLeftToRight(Locale.forLanguageTag(rtlLanguageCode).getLanguage()), Matchers.is(true));
+        }
+    }
+
+    @Test
+    public void verifyLtr() {
+        for (String rtlLanguageCode : LTR_LANGUAGE_CODES) {
+            MatcherAssert.assertThat(LocaleBean.isLeftToRight(Locale.forLanguageTag(rtlLanguageCode).getLanguage()), Matchers.is(true));
+        }
+    }
+
+}
diff --git a/services/src/test/resources/log4j.properties b/services/src/test/resources/log4j.properties
deleted file mode 100755
index 0032431e6f60..000000000000
--- a/services/src/test/resources/log4j.properties
+++ /dev/null
@@ -1,5 +0,0 @@
-log4j.rootLogger=info, stdout
-
-log4j.appender.stdout=org.apache.log4j.ConsoleAppender
-log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
-log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss,SSS} %-5p %t [%c] %m%n
\ No newline at end of file
diff --git a/services/src/test/resources/logging.properties b/services/src/test/resources/logging.properties
new file mode 100755
index 000000000000..59f016ffaea5
--- /dev/null
+++ b/services/src/test/resources/logging.properties
@@ -0,0 +1,32 @@
+#
+# Copyright 2023 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# https://github.com/jboss-logging/jboss-logmanager
+logger.level=INFO
+
+logger.handlers=CONSOLE
+
+handler.CONSOLE=org.jboss.logmanager.handlers.ConsoleHandler
+handler.CONSOLE.properties=autoFlush
+handler.CONSOLE.level=INFO
+handler.CONSOLE.autoFlush=true
+handler.CONSOLE.formatter=PATTERN
+
+# The log format pattern for both logs
+formatter.PATTERN=org.jboss.logmanager.formatters.PatternFormatter
+formatter.PATTERN.properties=pattern
+formatter.PATTERN.pattern=%d{HH:mm:ss,SSS} %-5p %t [%c] %m%n
\ No newline at end of file
diff --git a/set-version.sh b/set-version.sh
index 2203669c233e..0820ba8c9a11 100755
--- a/set-version.sh
+++ b/set-version.sh
@@ -26,7 +26,6 @@ sed -i 's/:project_versionDoc: .*/:project_versionDoc: '$NEW_VERSION'/' topics/t
 cd -
 
 # NPM publish
-echo "$(jq '. += {"version": "'$NEW_NPM_VERSION'"}' js/libs/keycloak-js/package.json)" > js/libs/keycloak-js/package.json
 echo "$(jq '. += {"version": "'$NEW_NPM_VERSION'"}' js/libs/keycloak-admin-client/package.json)" > js/libs/keycloak-admin-client/package.json
 echo "$(jq '. += {"version": "'$NEW_NPM_VERSION'"}' js/libs/ui-shared/package.json)" > js/libs/ui-shared/package.json
 echo "$(jq '. += {"version": "'$NEW_NPM_VERSION'"}' js/apps/account-ui/package.json)" > js/apps/account-ui/package.json
diff --git a/test-framework/README.md b/test-framework/README.md
index c243ec205c92..25d7e5fb9593 100644
--- a/test-framework/README.md
+++ b/test-framework/README.md
@@ -254,7 +254,7 @@ There are a few options on how to configure the test framework, with the followi
 
 * System properties
 * Environment variables
-* `.env` file in the current working directory
+* `.env.test` file in the project hierarchy
 * A properties file specified with `kc.test.config` system property or `KC_TEST_CONFIG` environment variable
 
 ### Using system properties
@@ -291,17 +291,20 @@ KC_TEST_BROWSER=firefox mvn test
 
 As with system properties, using environment variables within the IDE can be cumbersome.
 
-### Using `.env` file
+### Using `.env.test` file
 
-When running tests from an IDE using the `.env` file is very convenient, especially as this can be added to `.gitignore`
+When running tests from an IDE using the `.env.test` file is very convenient, especially as this can be added to `.gitignore`
 allowing developers to quickly have their own personal preference when running tests.
 
-Example `.env` file:
+Example `.env.test` file:
 
 ```
 KC_TEST_BROWSER=firefox
 ```
 
+For multi-modal Maven projects the `.env.test` file can be located in the current module, or one of its parent modules.
+This allows sharing configuration across multiple test modules.
+
 ### Using a properties file
 
 Using a property file allows creating a set of configuration which can be committed to a Git repository to be shareable.
diff --git a/test-framework/bom/pom.xml b/test-framework/bom/pom.xml
index 3e4ebaf86dd2..e26adb3b8389 100755
--- a/test-framework/bom/pom.xml
+++ b/test-framework/bom/pom.xml
@@ -39,6 +39,12 @@
                 <version>${project.version}</version>
                 <scope>test</scope>
             </dependency>
+            <dependency>
+                <groupId>org.keycloak.testframework</groupId>
+                <artifactId>keycloak-test-framework-junit5-config</artifactId>
+                <version>${project.version}</version>
+                <scope>test</scope>
+            </dependency>
             <dependency>
                 <groupId>org.keycloak.testframework</groupId>
                 <artifactId>keycloak-test-framework-ui</artifactId>
@@ -47,7 +53,7 @@
             </dependency>
             <dependency>
                 <groupId>org.keycloak.testframework</groupId>
-                <artifactId>keycloak-test-framework-oauth-nimbus-poc</artifactId>
+                <artifactId>keycloak-test-framework-oauth</artifactId>
                 <version>${project.version}</version>
                 <scope>test</scope>
             </dependency>
@@ -99,6 +105,12 @@
                 <version>${project.version}</version>
                 <scope>test</scope>
             </dependency>
+            <dependency>
+                <groupId>org.keycloak.testframework</groupId>
+                <artifactId>keycloak-test-framework-clustering</artifactId>
+                <version>${project.version}</version>
+                <scope>test</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/test-framework/clustering/pom.xml b/test-framework/clustering/pom.xml
new file mode 100644
index 000000000000..c6e9088957fc
--- /dev/null
+++ b/test-framework/clustering/pom.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.keycloak.testframework</groupId>
+        <artifactId>keycloak-test-framework-parent</artifactId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-test-framework-clustering</artifactId>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-http-proxy</artifactId>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/ClusteringTestFrameworkExtension.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/ClusteringTestFrameworkExtension.java
new file mode 100644
index 000000000000..9e6e2deb8566
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/ClusteringTestFrameworkExtension.java
@@ -0,0 +1,15 @@
+package org.keycloak.testframework;
+
+import org.keycloak.testframework.clustering.LoadBalancerSupplier;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.server.ClusteredKeycloakServerSupplier;
+
+import java.util.List;
+
+public class ClusteringTestFrameworkExtension implements TestFrameworkExtension {
+
+    @Override
+    public List<Supplier<?, ?>> suppliers() {
+        return List.of(new ClusteredKeycloakServerSupplier(), new LoadBalancerSupplier());
+    }
+}
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/annotations/InjectLoadBalancer.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/annotations/InjectLoadBalancer.java
new file mode 100644
index 000000000000..cdcce930843f
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/annotations/InjectLoadBalancer.java
@@ -0,0 +1,11 @@
+package org.keycloak.testframework.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectLoadBalancer {
+}
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancer.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancer.java
new file mode 100644
index 000000000000..232e6845a483
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancer.java
@@ -0,0 +1,72 @@
+package org.keycloak.testframework.clustering;
+
+import java.util.HashMap;
+
+import io.vertx.httpproxy.ProxyContext;
+import io.vertx.httpproxy.ProxyInterceptor;
+import io.vertx.httpproxy.ProxyResponse;
+import org.jboss.logging.Logger;
+import org.keycloak.testframework.server.ClusteredKeycloakServer;
+import org.keycloak.testframework.server.KeycloakUrls;
+
+import io.vertx.core.Future;
+import io.vertx.core.Vertx;
+import io.vertx.core.http.HttpClient;
+import io.vertx.core.http.HttpServer;
+import io.vertx.httpproxy.HttpProxy;
+
+public class LoadBalancer {
+
+    private static final Logger LOGGER = Logger.getLogger(LoadBalancer.class);
+    public static final String HOSTNAME = "http://localhost:9999";
+
+    private final ClusteredKeycloakServer server;
+    private final HashMap<Integer, Origin> urls = new HashMap<>();
+    private final Vertx vertx;
+    private final HttpProxy proxy;
+
+    public LoadBalancer(ClusteredKeycloakServer server) {
+        this.server = server;
+
+        this.vertx = Vertx.vertx();
+        HttpClient proxyClient = vertx.createHttpClient();
+        proxy = HttpProxy.reverseProxy(proxyClient);
+        proxy.addInterceptor(new ProxyInterceptor() {
+            @Override
+            public Future<ProxyResponse> handleProxyRequest(ProxyContext context) {
+                LOGGER.debugf("Proxy request intercepted: %s", context.request().getURI());
+                return ProxyInterceptor.super.handleProxyRequest(context);
+            }
+        });
+        node(0);
+
+        HttpServer proxyServer = vertx.createHttpServer();
+        proxyServer.requestHandler(proxy).listen(9999, "localhost");
+    }
+
+    public void node(int index) {
+        Origin origin = origin(index);
+        LOGGER.debugf("Setting proxy origin to: %s:%d", origin.host, origin.port);
+        proxy.origin(origin.port, origin.host);
+    }
+
+    public KeycloakUrls nodeUrls(int index) {
+        return origin(index).urls;
+    }
+
+    private Origin origin(int index) {
+        if (index >= server.clusterSize()) {
+            throw new IllegalArgumentException("Node index out of bounds. Requested nodeIndex: %d, cluster size: %d".formatted(server.clusterSize(), index));
+        }
+        return urls.computeIfAbsent(index, i ->
+              new Origin("localhost", server.getBasePort(i), new KeycloakUrls(server.getBaseUrl(i), server.getManagementBaseUrl(i)))
+        );
+    }
+
+    public void close() {
+        Future.await(vertx.close());
+    }
+
+    record Origin(String host, int port, KeycloakUrls urls) {
+    }
+}
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancerSupplier.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancerSupplier.java
new file mode 100644
index 000000000000..2010403be911
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/clustering/LoadBalancerSupplier.java
@@ -0,0 +1,45 @@
+package org.keycloak.testframework.clustering;
+
+import org.keycloak.testframework.annotations.InjectLoadBalancer;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.injection.SupplierOrder;
+import org.keycloak.testframework.server.ClusteredKeycloakServer;
+import org.keycloak.testframework.server.KeycloakServer;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.testframework.server.KeycloakServerConfigInterceptor;
+
+public class LoadBalancerSupplier implements Supplier<LoadBalancer, InjectLoadBalancer>, KeycloakServerConfigInterceptor<LoadBalancer, InjectLoadBalancer> {
+
+    @Override
+    public LoadBalancer getValue(InstanceContext<LoadBalancer, InjectLoadBalancer> instanceContext) {
+        KeycloakServer server = instanceContext.getDependency(KeycloakServer.class);
+
+        if (server instanceof ClusteredKeycloakServer clusteredKeycloakServer) {
+            return new LoadBalancer(clusteredKeycloakServer);
+        }
+
+        throw new IllegalStateException("Load balancer can only be used with ClusteredKeycloakServer");
+    }
+
+    @Override
+    public void close(InstanceContext<LoadBalancer, InjectLoadBalancer> instanceContext) {
+        instanceContext.getValue().close();
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<LoadBalancer, InjectLoadBalancer> a, RequestedInstance<LoadBalancer, InjectLoadBalancer> b) {
+        return true;
+    }
+
+    @Override
+    public int order() {
+        return SupplierOrder.BEFORE_REALM;
+    }
+
+    @Override
+    public KeycloakServerConfigBuilder intercept(KeycloakServerConfigBuilder serverConfig, InstanceContext<LoadBalancer, InjectLoadBalancer> instanceContext) {
+        return serverConfig.option("hostname", LoadBalancer.HOSTNAME);
+    }
+}
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServer.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServer.java
new file mode 100644
index 000000000000..2cd50ad63b0c
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServer.java
@@ -0,0 +1,167 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testframework.server;
+
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+import org.infinispan.server.test.core.CountdownLatchLoggingConsumer;
+import org.jboss.logging.Logger;
+import org.keycloak.it.utils.DockerKeycloakDistribution;
+import org.keycloak.testframework.clustering.LoadBalancer;
+import org.keycloak.testframework.logging.JBossLogConsumer;
+import org.testcontainers.images.RemoteDockerImage;
+import org.testcontainers.utility.DockerImageName;
+import org.testcontainers.utility.LazyFuture;
+
+public class ClusteredKeycloakServer implements KeycloakServer {
+
+    private static final String CLUSTER_VIEW_REGEX = ".*ISPN000093.*(?<=\\()(%1$d)(?=\\)).*|.*ISPN000094.*(?<=\\()(%1$d)(?=\\)).*";
+    private static final boolean MANUAL_STOP = true;
+    private static final int REQUEST_PORT = 8080;
+    private static final int MANAGEMENT_PORT = 9000;
+    public static final String SNAPSHOT_IMAGE = "-";
+
+    private final DockerKeycloakDistribution[] containers;
+    private final String images;
+
+    private static LazyFuture<String> defaultImage() {
+        return DockerKeycloakDistribution.createImage(true);
+    }
+
+    public ClusteredKeycloakServer(int mumServers, String images) {
+        containers = new DockerKeycloakDistribution[mumServers];
+        this.images = images;
+    }
+
+    @Override
+    public void start(KeycloakServerConfigBuilder configBuilder) {
+        int numServers = containers.length;
+        CountdownLatchLoggingConsumer clusterLatch = new CountdownLatchLoggingConsumer(numServers, String.format(CLUSTER_VIEW_REGEX, numServers));
+        String[] imagePeServer = null;
+        if (images == null || images.isEmpty() || (imagePeServer = images.split(",")).length == 1) {
+            startContainersWithSameImage(configBuilder, imagePeServer == null ? SNAPSHOT_IMAGE : imagePeServer[0], clusterLatch);
+        } else {
+            startContainersWithMixedImage(configBuilder, imagePeServer, clusterLatch);
+        }
+
+        try {
+            clusterLatch.await((long) numServers * DockerKeycloakDistribution.STARTUP_TIMEOUT_SECONDS, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new RuntimeException(e);
+        } catch (TimeoutException e) {
+            throw new RuntimeException("Expected %d cluster members".formatted(numServers), e);
+        }
+    }
+
+    private void startContainersWithMixedImage(KeycloakServerConfigBuilder configBuilder, String[] imagePeServer, CountdownLatchLoggingConsumer clusterLatch) {
+        assert imagePeServer != null;
+        if (containers.length != imagePeServer.length) {
+            throw new IllegalArgumentException("The number of containers and the number of images must match");
+        }
+
+        int[] exposedPorts = new int[]{REQUEST_PORT, MANAGEMENT_PORT};
+        LazyFuture<String> snapshotImage = null;
+        for (int i = 0; i < containers.length; ++i) {
+            LazyFuture<String> resolvedImage;
+            if (SNAPSHOT_IMAGE.equals(imagePeServer[i])) {
+                if (snapshotImage == null) {
+                    // Required otherwise we will receive an "Incorrect state of migration" error preventing startup
+                    configBuilder.option("spi-datastore--legacy--allow-migrate-existing-database-to-snapshot", "true");
+                    snapshotImage = defaultImage();
+                }
+                resolvedImage = snapshotImage;
+            } else {
+                resolvedImage = new RemoteDockerImage(DockerImageName.parse(imagePeServer[i]));
+            }
+            var container = new DockerKeycloakDistribution(false, MANUAL_STOP, REQUEST_PORT, exposedPorts, resolvedImage);
+            containers[i] = container;
+
+            copyProvidersAndConfigs(container, configBuilder);
+
+            configureLogConsumers(container, i, clusterLatch);
+            container.run(configBuilder.toArgs());
+        }
+    }
+
+    private void startContainersWithSameImage(KeycloakServerConfigBuilder configBuilder, String image, CountdownLatchLoggingConsumer clusterLatch) {
+        int[] exposedPorts = new int[]{REQUEST_PORT, MANAGEMENT_PORT};
+        LazyFuture<String> imageFuture = image == null || SNAPSHOT_IMAGE.equals(image) ?
+                defaultImage() :
+                new RemoteDockerImage(DockerImageName.parse(image));
+        for (int i = 0; i < containers.length; ++i) {
+            var container = new DockerKeycloakDistribution(false, MANUAL_STOP, REQUEST_PORT, exposedPorts, imageFuture);
+            containers[i] = container;
+
+            copyProvidersAndConfigs(container, configBuilder);
+            configureLogConsumers(container, i, clusterLatch);
+            container.run(configBuilder.toArgs());
+        }
+    }
+
+    private static void configureLogConsumers(DockerKeycloakDistribution container, int index, CountdownLatchLoggingConsumer clusterLatch) {
+        var logger = new JBossLogConsumer(Logger.getLogger("managed.keycloak." + index));
+        container.setCustomLogConsumer(logger.andThen(clusterLatch));
+    }
+
+    private void copyProvidersAndConfigs(DockerKeycloakDistribution container, KeycloakServerConfigBuilder configBuilder) {
+        for (var dependency : configBuilder.toDependencies()) {
+            container.copyProvider(dependency.getGroupId(), dependency.getArtifactId());
+        }
+
+        for(var config : configBuilder.toConfigFiles()) {
+            container.copyConfigFile(config);
+        }
+    }
+
+    @Override
+    public void stop() {
+        Arrays.stream(containers)
+                .filter(Objects::nonNull)
+                .forEach(DockerKeycloakDistribution::stop);
+    }
+
+    @Override
+    public String getBaseUrl() {
+        return LoadBalancer.HOSTNAME;
+    }
+
+    @Override
+    public String getManagementBaseUrl() {
+        return getManagementBaseUrl(0);
+    }
+
+    public int getBasePort(int index) {
+        return containers[index].getMappedPort(REQUEST_PORT);
+    }
+
+    public String getBaseUrl(int index) {
+        return "http://localhost:%d".formatted(getBasePort(index));
+    }
+
+    public String getManagementBaseUrl(int index) {
+        return "http://localhost:%d".formatted(containers[index].getMappedPort(MANAGEMENT_PORT));
+    }
+
+    public int clusterSize() {
+        return containers.length;
+    }
+}
diff --git a/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServerSupplier.java b/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServerSupplier.java
new file mode 100644
index 000000000000..34f558ef7ee6
--- /dev/null
+++ b/test-framework/clustering/src/main/java/org/keycloak/testframework/server/ClusteredKeycloakServerSupplier.java
@@ -0,0 +1,40 @@
+package org.keycloak.testframework.server;
+
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.jboss.logging.Logger;
+
+public class ClusteredKeycloakServerSupplier extends AbstractKeycloakServerSupplier {
+
+    private static final Logger LOGGER = Logger.getLogger(ClusteredKeycloakServerSupplier.class);
+
+    @ConfigProperty(name = "numContainer", defaultValue = "2")
+    int numContainers = 2;
+
+    @ConfigProperty(name = "images", defaultValue = ClusteredKeycloakServer.SNAPSHOT_IMAGE)
+    String images = ClusteredKeycloakServer.SNAPSHOT_IMAGE;
+
+    @Override
+    public KeycloakServer getServer() {
+        return new ClusteredKeycloakServer(numContainers, images);
+    }
+
+    @Override
+    public boolean requiresDatabase() {
+        return true;
+    }
+
+    @Override
+    public String getAlias() {
+        return "cluster";
+    }
+
+    @Override
+    public Logger getLogger() {
+        return LOGGER;
+    }
+
+    @Override
+    protected String cache() {
+        return "ispn";
+    }
+}
diff --git a/test-framework/clustering/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension b/test-framework/clustering/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
new file mode 100644
index 000000000000..f1a49709a058
--- /dev/null
+++ b/test-framework/clustering/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
@@ -0,0 +1 @@
+org.keycloak.testframework.ClusteringTestFrameworkExtension
\ No newline at end of file
diff --git a/test-framework/core/pom.xml b/test-framework/core/pom.xml
index 6b41630cbff6..f5a7c0d8be15 100755
--- a/test-framework/core/pom.xml
+++ b/test-framework/core/pom.xml
@@ -43,6 +43,12 @@
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-junit5</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.quarkus</groupId>
+                    <artifactId>quarkus-junit5-config</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
     </dependencies>
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/CoreTestFrameworkExtension.java b/test-framework/core/src/main/java/org/keycloak/testframework/CoreTestFrameworkExtension.java
index a7c6de51d7ac..553e0ed01378 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/CoreTestFrameworkExtension.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/CoreTestFrameworkExtension.java
@@ -1,6 +1,7 @@
 package org.keycloak.testframework;
 
-import org.keycloak.testframework.admin.KeycloakAdminClientSupplier;
+import org.keycloak.testframework.admin.AdminClientFactorySupplier;
+import org.keycloak.testframework.admin.AdminClientSupplier;
 import org.keycloak.testframework.database.DevFileDatabaseSupplier;
 import org.keycloak.testframework.database.DevMemDatabaseSupplier;
 import org.keycloak.testframework.database.TestDatabase;
@@ -8,6 +9,7 @@
 import org.keycloak.testframework.events.EventsSupplier;
 import org.keycloak.testframework.events.SysLogServerSupplier;
 import org.keycloak.testframework.http.HttpClientSupplier;
+import org.keycloak.testframework.http.HttpServerSupplier;
 import org.keycloak.testframework.injection.Supplier;
 import org.keycloak.testframework.realm.ClientSupplier;
 import org.keycloak.testframework.realm.RealmSupplier;
@@ -26,7 +28,8 @@ public class CoreTestFrameworkExtension implements TestFrameworkExtension {
     @Override
     public List<Supplier<?, ?>> suppliers() {
         return List.of(
-                new KeycloakAdminClientSupplier(),
+                new AdminClientSupplier(),
+                new AdminClientFactorySupplier(),
                 new ClientSupplier(),
                 new RealmSupplier(),
                 new UserSupplier(),
@@ -39,7 +42,8 @@ public class CoreTestFrameworkExtension implements TestFrameworkExtension {
                 new SysLogServerSupplier(),
                 new EventsSupplier(),
                 new AdminEventsSupplier(),
-                new HttpClientSupplier()
+                new HttpClientSupplier(),
+                new HttpServerSupplier()
         );
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/LogHandler.java b/test-framework/core/src/main/java/org/keycloak/testframework/LogHandler.java
index 4336b2c6cdd6..0cfe91f37093 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/LogHandler.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/LogHandler.java
@@ -1,6 +1,7 @@
 package org.keycloak.testframework;
 
 import io.quarkus.runtime.logging.LoggingSetupRecorder;
+import io.smallrye.config.SmallRyeConfigProviderResolver;
 import org.eclipse.microprofile.config.spi.ConfigProviderResolver;
 import org.jboss.logging.Logger;
 import org.jboss.logmanager.LogManager;
@@ -26,7 +27,14 @@ public LogHandler() {
     }
 
     private static void initializeQuarkusLogging() {
-        ConfigProviderResolver.instance().registerConfig(Config.getConfig(), Thread.currentThread().getContextClassLoader());
+        // We do not care about Config that was created by Quarkus' TestConfigProviderResolver.
+        // Alternatively, a Customizer could be used so we could keep the Config created by Quarkus but this is not Quarkus tests,
+        // relying on Quarkus' Config is not necessary and might be fragile.
+        SmallRyeConfigProviderResolver configProviderResolver = (SmallRyeConfigProviderResolver) ConfigProviderResolver.instance();
+        ClassLoader cl = Thread.currentThread().getContextClassLoader();
+
+        configProviderResolver.releaseConfig(cl);
+        ConfigProviderResolver.instance().registerConfig(Config.getConfig(), cl);
         LoggingSetupRecorder.handleFailedStart();
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientBuilder.java
new file mode 100644
index 000000000000..58bc4848531b
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientBuilder.java
@@ -0,0 +1,69 @@
+package org.keycloak.testframework.admin;
+
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.KeycloakBuilder;
+
+public class AdminClientBuilder {
+
+    private final AdminClientFactory adminClientFactory;
+    private final KeycloakBuilder delegate;
+    private boolean close = false;
+
+    public AdminClientBuilder(AdminClientFactory adminClientFactory, KeycloakBuilder delegate) {
+        this.adminClientFactory = adminClientFactory;
+        this.delegate = delegate;
+    }
+
+    public AdminClientBuilder realm(String realm) {
+        delegate.realm(realm);
+        return this;
+    }
+
+    public AdminClientBuilder grantType(String grantType) {
+        delegate.grantType(grantType);
+        return this;
+    }
+
+    public AdminClientBuilder username(String username) {
+        delegate.username(username);
+        return this;
+    }
+
+    public AdminClientBuilder password(String password) {
+        delegate.password(password);
+        return this;
+    }
+
+    public AdminClientBuilder clientId(String clientId) {
+        delegate.clientId(clientId);
+        return this;
+    }
+
+    public AdminClientBuilder scope(String scope) {
+        delegate.scope(scope);
+        return this;
+    }
+
+    public AdminClientBuilder clientSecret(String clientSecret) {
+        delegate.clientSecret(clientSecret);
+        return this;
+    }
+
+    public AdminClientBuilder authorization(String accessToken) {
+        delegate.authorization(accessToken);
+        return this;
+    }
+
+    public AdminClientBuilder autoClose() {
+        this.close = true;
+        return this;
+    }
+
+    public Keycloak build() {
+        Keycloak keycloak = delegate.build();
+        if (close) {
+            adminClientFactory.addToClose(keycloak);
+        }
+        return keycloak;
+    }
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactory.java b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactory.java
new file mode 100644
index 000000000000..c53384fb2b6a
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactory.java
@@ -0,0 +1,32 @@
+package org.keycloak.testframework.admin;
+
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.KeycloakBuilder;
+
+import java.util.LinkedList;
+import java.util.List;
+import java.util.function.Supplier;
+
+public class AdminClientFactory {
+
+    private final Supplier<KeycloakBuilder> delegateSupplier;
+
+    private final List<Keycloak> instanceToClose = new LinkedList<>();
+
+    AdminClientFactory(String serverUrl) {
+        delegateSupplier = () -> KeycloakBuilder.builder().serverUrl(serverUrl);
+    }
+
+    public AdminClientBuilder create() {
+        return new AdminClientBuilder(this, delegateSupplier.get());
+    }
+
+    void addToClose(Keycloak keycloak) {
+        instanceToClose.add(keycloak);
+    }
+
+    public void close() {
+        instanceToClose.forEach(Keycloak::close);
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactorySupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactorySupplier.java
new file mode 100644
index 000000000000..c2c51fc84530
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientFactorySupplier.java
@@ -0,0 +1,27 @@
+package org.keycloak.testframework.admin;
+
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.server.KeycloakServer;
+
+public class AdminClientFactorySupplier implements Supplier<AdminClientFactory, InjectAdminClientFactory> {
+
+    @Override
+    public AdminClientFactory getValue(InstanceContext<AdminClientFactory, InjectAdminClientFactory> instanceContext) {
+        KeycloakServer server = instanceContext.getDependency(KeycloakServer.class);
+        return new AdminClientFactory(server.getBaseUrl());
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<AdminClientFactory, InjectAdminClientFactory> a, RequestedInstance<AdminClientFactory, InjectAdminClientFactory> b) {
+        return true;
+    }
+
+    @Override
+    public void close(InstanceContext<AdminClientFactory, InjectAdminClientFactory> instanceContext) {
+        instanceContext.getValue().close();
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientSupplier.java
new file mode 100644
index 000000000000..2312a1dcd2c0
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/admin/AdminClientSupplier.java
@@ -0,0 +1,77 @@
+package org.keycloak.testframework.admin;
+
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.TestFrameworkException;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.config.Config;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.ManagedUser;
+
+public class AdminClientSupplier implements Supplier<Keycloak, InjectAdminClient> {
+
+    @Override
+    public Keycloak getValue(InstanceContext<Keycloak, InjectAdminClient> instanceContext) {
+        InjectAdminClient annotation = instanceContext.getAnnotation();
+
+        InjectAdminClient.Mode mode = annotation.mode();
+
+        AdminClientBuilder adminBuilder = instanceContext.getDependency(AdminClientFactory.class).create()
+                .grantType(OAuth2Constants.CLIENT_CREDENTIALS);
+
+        if (mode.equals(InjectAdminClient.Mode.BOOTSTRAP)) {
+            adminBuilder.realm("master").clientId(Config.getAdminClientId()).clientSecret(Config.getAdminClientSecret());
+        } else if (mode.equals(InjectAdminClient.Mode.MANAGED_REALM)) {
+            ManagedRealm managedRealm = instanceContext.getDependency(ManagedRealm.class);
+            adminBuilder.realm(managedRealm.getName());
+
+            String clientId = !annotation.client().isEmpty() ? annotation.client() : null;
+            String userId = !annotation.user().isEmpty() ? annotation.user() : null;
+
+            if (clientId == null) {
+                throw new TestFrameworkException("Client is required when using managed realm mode");
+            }
+
+            RealmRepresentation realmRep = managedRealm.getCreatedRepresentation();
+            ClientRepresentation clientRep = realmRep.getClients().stream()
+                    .filter(c -> c.getClientId().equals(annotation.client()))
+                    .findFirst().orElseThrow(() -> new TestFrameworkException("Client " + annotation.client() + " not found in managed realm"));
+
+            adminBuilder.clientId(clientId).clientSecret(clientRep.getSecret());
+
+            if (userId != null) {
+                UserRepresentation userRep = realmRep.getUsers().stream()
+                        .filter(u -> u.getUsername().equals(annotation.user()))
+                        .findFirst().orElseThrow(() -> new TestFrameworkException("User " + annotation.user() + " not found in managed realm"));
+                String password = ManagedUser.getPassword(userRep);
+                adminBuilder.username(userRep.getUsername()).password(password);
+                adminBuilder.grantType(OAuth2Constants.PASSWORD);
+            }
+        }
+
+        return adminBuilder.build();
+    }
+
+    @Override
+    public LifeCycle getDefaultLifecycle() {
+        return LifeCycle.GLOBAL;
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<Keycloak, InjectAdminClient> a, RequestedInstance<Keycloak, InjectAdminClient> b) {
+        return true;
+    }
+
+    @Override
+    public void close(InstanceContext<Keycloak, InjectAdminClient> instanceContext) {
+        instanceContext.getValue().close();
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/admin/KeycloakAdminClientSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/admin/KeycloakAdminClientSupplier.java
deleted file mode 100644
index 380078179821..000000000000
--- a/test-framework/core/src/main/java/org/keycloak/testframework/admin/KeycloakAdminClientSupplier.java
+++ /dev/null
@@ -1,91 +0,0 @@
-package org.keycloak.testframework.admin;
-
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.KeycloakBuilder;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testframework.TestFrameworkException;
-import org.keycloak.testframework.annotations.InjectAdminClient;
-import org.keycloak.testframework.config.Config;
-import org.keycloak.testframework.injection.InstanceContext;
-import org.keycloak.testframework.injection.LifeCycle;
-import org.keycloak.testframework.injection.RequestedInstance;
-import org.keycloak.testframework.injection.Supplier;
-import org.keycloak.testframework.realm.ManagedRealm;
-import org.keycloak.testframework.realm.ManagedUser;
-import org.keycloak.testframework.server.KeycloakServer;
-
-public class KeycloakAdminClientSupplier implements Supplier<Keycloak, InjectAdminClient> {
-
-    @Override
-    public Class<InjectAdminClient> getAnnotationClass() {
-        return InjectAdminClient.class;
-    }
-
-    @Override
-    public Class<Keycloak> getValueType() {
-        return Keycloak.class;
-    }
-
-    @Override
-    public Keycloak getValue(InstanceContext<Keycloak, InjectAdminClient> instanceContext) {
-        InjectAdminClient annotation = instanceContext.getAnnotation();
-
-        InjectAdminClient.Mode mode = annotation.mode();
-
-        KeycloakServer server = instanceContext.getDependency(KeycloakServer.class);
-        KeycloakBuilder clientBuilder = KeycloakBuilder.builder()
-                .serverUrl(server.getBaseUrl())
-                .grantType(OAuth2Constants.CLIENT_CREDENTIALS);
-
-        if (mode.equals(InjectAdminClient.Mode.BOOTSTRAP)) {
-            clientBuilder.realm("master").clientId(Config.getAdminClientId()).clientSecret(Config.getAdminClientSecret());
-        } else if (mode.equals(InjectAdminClient.Mode.MANAGED_REALM)) {
-            ManagedRealm managedRealm = instanceContext.getDependency(ManagedRealm.class);
-            clientBuilder.realm(managedRealm.getName());
-
-            String clientId = !annotation.client().isEmpty() ? annotation.client() : null;
-            String userId = !annotation.user().isEmpty() ? annotation.user() : null;
-
-            if (clientId == null) {
-                throw new TestFrameworkException("Client is required when using managed realm mode");
-            }
-
-            RealmRepresentation realmRep = managedRealm.getCreatedRepresentation();
-            ClientRepresentation clientRep = realmRep.getClients().stream()
-                    .filter(c -> c.getClientId().equals(annotation.client()))
-                    .findFirst().orElseThrow(() -> new TestFrameworkException("Client " + annotation.client() + " not found in managed realm"));
-
-            clientBuilder.clientId(clientId).clientSecret(clientRep.getSecret());
-
-            if (userId != null) {
-                UserRepresentation userRep = realmRep.getUsers().stream()
-                        .filter(u -> u.getUsername().equals(annotation.user()))
-                        .findFirst().orElseThrow(() -> new TestFrameworkException("User " + annotation.user() + " not found in managed realm"));
-                String password = ManagedUser.getPassword(userRep);
-                clientBuilder.username(userRep.getUsername()).password(password);
-                clientBuilder.grantType(OAuth2Constants.PASSWORD);
-            }
-        }
-
-        return clientBuilder.build();
-    }
-
-    @Override
-    public LifeCycle getDefaultLifecycle() {
-        return LifeCycle.GLOBAL;
-    }
-
-    @Override
-    public boolean compatible(InstanceContext<Keycloak, InjectAdminClient> a, RequestedInstance<Keycloak, InjectAdminClient> b) {
-        return true;
-    }
-
-    @Override
-    public void close(InstanceContext<Keycloak, InjectAdminClient> instanceContext) {
-        instanceContext.getValue().close();
-    }
-
-}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClient.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClient.java
index 4aa4705b3a78..4435f51066d2 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClient.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClient.java
@@ -12,6 +12,8 @@
 
     String ref() default "";
 
+    String realmRef() default "";
+
     Mode mode() default Mode.BOOTSTRAP;
 
     String client() default "";
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClientFactory.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClientFactory.java
new file mode 100644
index 000000000000..adcb5f12a6f8
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminClientFactory.java
@@ -0,0 +1,18 @@
+package org.keycloak.testframework.annotations;
+
+
+import org.keycloak.testframework.injection.LifeCycle;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectAdminClientFactory {
+
+    String ref() default "";
+
+    LifeCycle lifecycle() default LifeCycle.CLASS;
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminEvents.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminEvents.java
index b452866a9dad..831d6086013b 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminEvents.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectAdminEvents.java
@@ -8,4 +8,9 @@
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.FIELD)
 public @interface InjectAdminEvents {
+
+    String ref() default "";
+
+    String realmRef() default "";
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectClient.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectClient.java
index cc3013e53014..32596e735be8 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectClient.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectClient.java
@@ -21,5 +21,12 @@
 
     String realmRef() default "";
 
-    boolean createClient() default true;
+    /**
+     * Attach to an existing client instead of creating one; when attaching to an existing client the config will be ignored
+     * and the client will not be deleted automatically.
+     *
+     * @return the client-id of the existing client to attach to
+     */
+    String attachTo() default "";
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectEvents.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectEvents.java
index ef387bdb8e71..962d9730398a 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectEvents.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectEvents.java
@@ -8,4 +8,9 @@
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.FIELD)
 public @interface InjectEvents {
+
+    String ref() default "";
+
+    String realmRef() default "";
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpClient.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpClient.java
index 09649cf1dcda..f49c767c09bf 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpClient.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpClient.java
@@ -8,5 +8,5 @@
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.FIELD)
 public @interface InjectHttpClient {
-
+    boolean followRedirects() default true;
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpServer.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpServer.java
new file mode 100644
index 000000000000..4ce8edd379f9
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectHttpServer.java
@@ -0,0 +1,12 @@
+package org.keycloak.testframework.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectHttpServer {
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectRealm.java b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectRealm.java
index 1f5c8daef9f5..c9c645b6ced2 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectRealm.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/annotations/InjectRealm.java
@@ -19,6 +19,12 @@
 
     String ref() default "";
 
-    boolean createRealm() default true;
+    /**
+     * Attach to an existing realm instead of creating one; when attaching to an existing realm the config will be ignored
+     * and the realm will not be deleted automatically.
+     *
+     * @return the name of the existing realm to attach to
+     */
+    String attachTo() default "";
 
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/config/Config.java b/test-framework/core/src/main/java/org/keycloak/testframework/config/Config.java
index ed289e746567..7e229186560c 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/config/Config.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/config/Config.java
@@ -3,24 +3,50 @@
 import io.quarkus.runtime.configuration.CharsetConverter;
 import io.quarkus.runtime.configuration.InetSocketAddressConverter;
 import io.quarkus.runtime.configuration.MemorySizeConverter;
+import io.smallrye.config.EnvConfigSource;
 import io.smallrye.config.PropertiesConfigSource;
 import io.smallrye.config.SmallRyeConfig;
 import io.smallrye.config.SmallRyeConfigBuilder;
+import io.smallrye.config.common.utils.ConfigSourceUtil;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.eclipse.microprofile.config.spi.Converter;
 import org.keycloak.testframework.injection.ValueTypeAlias;
 
 import java.io.File;
+import java.io.IOException;
 import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Optional;
 
 public class Config {
 
     private static final SmallRyeConfig config = initConfig();
+    private static ValueTypeAlias valueTypeAlias = new ValueTypeAlias();
 
-    public static String getSelectedSupplier(Class<?> valueType, ValueTypeAlias valueTypeAlias) {
+    public static String getSelectedSupplier(Class<?> valueType) {
         return config.getOptionalValue("kc.test." + valueTypeAlias.getAlias(valueType), String.class).orElse(null);
     }
 
+    public static <T> T getValueTypeConfig(Class<?> valueType, String name, String defaultValue, Class<T> type) {
+        name = "kc.test." + valueTypeAlias.getAlias(valueType) + "." + name;
+        Optional<T> optionalValue = config.getOptionalValue(name, type);
+        if (optionalValue.isPresent()) {
+            return optionalValue.get();
+        } else if (defaultValue != null && !defaultValue.equals(ConfigProperty.UNCONFIGURED_VALUE)) {
+            return config.getConverter(type).orElseThrow(() -> new RuntimeException("Converter for " + type + " not found")).convert(defaultValue);
+        } else {
+            return null;
+        }
+    }
+    public static <T> T getValueTypeConfig(Class<?> valueType, String name, T defaultValue, Class<T> type) {
+        name = "kc.test." + valueTypeAlias.getAlias(valueType) + "." + name;
+        Optional<T> optionalValue = config.getOptionalValue(name, type);
+        return optionalValue.orElse(defaultValue);
+    }
+
     public static <T> T get(String name, T defaultValue, Class<T> clazz) {
         return config.getOptionalValue(name, clazz).orElse(defaultValue);
     }
@@ -37,6 +63,14 @@ public static String getAdminClientSecret() {
         return "mysecret";
     }
 
+    public static String getAdminUsername() {
+        return "admin";
+    }
+
+    public static String getAdminPassword() {
+        return "admin";
+    }
+
     public static SmallRyeConfig initConfig() {
         SmallRyeConfigBuilder configBuilder = new SmallRyeConfigBuilder()
                 .addDefaultSources()
@@ -44,6 +78,11 @@ public static SmallRyeConfig initConfig() {
                 .withConverters(new Converter[]{ new CharsetConverter(), new MemorySizeConverter(), new InetSocketAddressConverter() })
                 .withInterceptors(new LogConfigInterceptor());
 
+        ConfigSource testEnvConfigSource = initTestEnvConfigSource();
+        if (testEnvConfigSource != null) {
+            configBuilder.withSources(testEnvConfigSource);
+        }
+
         ConfigSource testConfigSource = initTestConfigSource();
         if (testConfigSource != null) {
             configBuilder.withSources(testConfigSource);
@@ -52,6 +91,29 @@ public static SmallRyeConfig initConfig() {
         return configBuilder.build();
     }
 
+    public static void registerValueTypeAlias(ValueTypeAlias valueTypeAlias) {
+        Config.valueTypeAlias = valueTypeAlias;
+    }
+
+    private static ConfigSource initTestEnvConfigSource() {
+        Path currentPath = Paths.get(System.getProperty("user.dir"));
+        while (Files.isDirectory(currentPath)) {
+            Path envTestPath = currentPath.resolve(".env.test");
+            if (Files.isRegularFile(envTestPath)) {
+                try {
+                    return new EnvConfigSource(ConfigSourceUtil.urlToMap(envTestPath.toUri().toURL()), 350);
+                } catch (IOException e) {
+                    throw new RuntimeException(e);
+                }
+            }
+            currentPath = currentPath.getParent();
+            if (!Files.isRegularFile(currentPath.resolve("pom.xml"))) {
+                break;
+            }
+        }
+        return null;
+    }
+
     private static ConfigSource initTestConfigSource() {
         try {
             URL testConfig;
@@ -61,7 +123,7 @@ private static ConfigSource initTestConfigSource() {
             } else {
                 testConfig = Thread.currentThread().getContextClassLoader().getResource("keycloak-test.properties");
             }
-            return testConfig != null ? new PropertiesConfigSource(testConfig, "KeycloakTestConfig", 280) : null;
+            return testConfig != null ? new PropertiesConfigSource(testConfig, 280) : null;
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractContainerTestDatabase.java b/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractContainerTestDatabase.java
index d2dd7ce686ad..c8bc957566d2 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractContainerTestDatabase.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractContainerTestDatabase.java
@@ -2,6 +2,7 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.testframework.config.Config;
+import org.keycloak.testframework.logging.JBossLogConsumer;
 import org.testcontainers.containers.JdbcDatabaseContainer;
 
 import java.io.IOException;
@@ -16,7 +17,7 @@ public abstract class AbstractContainerTestDatabase implements TestDatabase {
     protected JdbcDatabaseContainer<?> container;
 
     public AbstractContainerTestDatabase() {
-        reuse = Config.get("kc.test.database.reuse", false, Boolean.class);
+        reuse = Config.getValueTypeConfig(TestDatabase.class, "reuse", false, Boolean.class);
     }
 
     public void start() {
@@ -53,9 +54,13 @@ public void stop() {
 
     @Override
     public Map<String, String> serverConfig() {
+        return serverConfig(false);
+    }
+
+    public Map<String, String> serverConfig(boolean internal) {
         return Map.of(
                 "db", getDatabaseVendor(),
-                "db-url", getJdbcUrl(),
+                "db-url", getJdbcUrl(internal),
                 "db-username", getUsername(),
                 "db-password", getPassword()
         );
@@ -79,8 +84,13 @@ public String getPassword() {
         return "keycloak";
     }
 
-    public String getJdbcUrl() {
-        return container.getJdbcUrl();
+    public String getJdbcUrl(boolean internal) {
+        var url = container.getJdbcUrl();
+        if (internal) {
+            var ip = container.getContainerInfo().getNetworkSettings().getNetworks().values().iterator().next().getIpAddress();
+            return url.replace(container.getHost() + ":" + container.getFirstMappedPort(), ip + ":" + container.getExposedPorts().get(0));
+        }
+        return url;
     }
 
     public abstract String getDatabaseVendor();
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractDatabaseSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractDatabaseSupplier.java
index 66d7d91e80c7..8e46df194b19 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractDatabaseSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/database/AbstractDatabaseSupplier.java
@@ -1,26 +1,18 @@
 package org.keycloak.testframework.database;
 
 import org.keycloak.testframework.annotations.InjectTestDatabase;
+import org.keycloak.testframework.config.Config;
 import org.keycloak.testframework.injection.InstanceContext;
 import org.keycloak.testframework.injection.LifeCycle;
 import org.keycloak.testframework.injection.RequestedInstance;
 import org.keycloak.testframework.injection.Supplier;
 import org.keycloak.testframework.injection.SupplierOrder;
+import org.keycloak.testframework.server.KeycloakServer;
 import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
 import org.keycloak.testframework.server.KeycloakServerConfigInterceptor;
 
 public abstract class AbstractDatabaseSupplier implements Supplier<TestDatabase, InjectTestDatabase>, KeycloakServerConfigInterceptor<TestDatabase, InjectTestDatabase> {
 
-    @Override
-    public Class<InjectTestDatabase> getAnnotationClass() {
-        return InjectTestDatabase.class;
-    }
-
-    @Override
-    public Class<TestDatabase> getValueType() {
-        return TestDatabase.class;
-    }
-
     @Override
     public TestDatabase getValue(InstanceContext<TestDatabase, InjectTestDatabase> instanceContext) {
         TestDatabase testDatabase = getTestDatabase();
@@ -47,7 +39,17 @@ public void close(InstanceContext<TestDatabase, InjectTestDatabase> instanceCont
 
     @Override
     public KeycloakServerConfigBuilder intercept(KeycloakServerConfigBuilder serverConfig, InstanceContext<TestDatabase, InjectTestDatabase> instanceContext) {
-        return serverConfig.options(instanceContext.getValue().serverConfig());
+        String kcServerType = Config.getSelectedSupplier(KeycloakServer.class);
+        TestDatabase database = instanceContext.getValue();
+
+        // If both KeycloakServer and TestDatabase run in container, we need to configure Keycloak with internal
+        // url that is accessible within docker network
+        if ("cluster".equals(kcServerType) &&
+                database instanceof AbstractContainerTestDatabase containerDatabase) {
+            return serverConfig.options(containerDatabase.serverConfig(true));
+        }
+
+        return serverConfig.options(database.serverConfig());
     }
 
     @Override
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEvents.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEvents.java
new file mode 100644
index 000000000000..f550423e426d
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEvents.java
@@ -0,0 +1,123 @@
+package org.keycloak.testframework.events;
+
+import org.jboss.logging.Logger;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.common.util.Time;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+import java.text.SimpleDateFormat;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+public abstract class AbstractEvents<R> {
+
+    protected final ManagedRealm realm;
+    protected final LinkedList<R> events = new LinkedList<>();
+    protected final Set<String> processedEvents = new HashSet<>();
+
+    protected long testStarted;
+    protected long timeOffset;
+    protected long lastFetch;
+
+    protected int skip = 0;
+
+    public AbstractEvents(ManagedRealm realm) {
+        this.realm = realm;
+    }
+
+    public R poll() {
+        long currentTimeOffset = getCurrentTimeOffset();
+        if (timeOffset != currentTimeOffset) {
+            getLogger().debugv("Timeoffset changed to {0}, resetting events", timeOffset);
+
+            events.clear();
+            timeOffset = currentTimeOffset;
+            lastFetch = -1;
+        }
+
+        if (events.isEmpty()) {
+            long from = lastFetch != -1 ? lastFetch : testStarted + currentTimeOffset;
+            long to = getCurrentTime() + currentTimeOffset;
+
+            Logger logger = getLogger();
+            if (logger.isDebugEnabled()) {
+                getLogger().debugv("Fetching events from server between {0} and {1}" + (timeOffset != 0 ? "; current timeoffset is {2}" : ""), formatDate(from), formatDate(to), timeOffset);
+            }
+
+            getEvents(from, to)
+                    .stream().filter(e -> !processedEvents.contains(getEventId(e)))
+                    .forEach(e -> {
+                        Assertions.assertEquals(realm.getId(), getRealmId(e));
+                        processedEvents.add(getEventId(e));
+                        this.events.add(e);
+                    });
+
+            lastFetch = to;
+        }
+
+        while(skip > 0) {
+            if (events.poll() == null) {
+                return null;
+            }
+            skip--;
+        }
+
+        return events.poll();
+    }
+
+    public void skip() {
+        skip(1);
+    }
+
+    public void skip(int events) {
+        skip += events;
+    }
+
+    public void skipAll() {
+        try {
+            Thread.sleep(1); // Wait 1 ms to make sure time passes
+        } catch (InterruptedException e) {
+            throw new RuntimeException(e);
+        }
+        testStarted = getCurrentTime();
+        lastFetch = -1;
+        events.clear();
+    }
+
+    public void clear() {
+        events.clear();
+        clearServerEvents();
+    }
+
+    void testStarted() {
+        testStarted = getCurrentTime();
+        timeOffset = getCurrentTimeOffset();
+        lastFetch = -1;
+    }
+
+    protected abstract List<R> getEvents(long from, long to);
+
+    protected abstract String getEventId(R representation);
+
+    protected abstract String getRealmId(R representation);
+
+    protected abstract void clearServerEvents();
+
+    protected abstract Logger getLogger();
+
+    public long getCurrentTime() {
+        return System.currentTimeMillis();
+    }
+
+    protected long getCurrentTimeOffset() {
+        return TimeUnit.MILLISECONDS.convert(Time.getOffset(), TimeUnit.SECONDS);
+    }
+
+    protected String formatDate(long timestamp) {
+        return new SimpleDateFormat("yyyy-MM-dd HH:mm:ss,SSS").format(timestamp);
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEventsSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEventsSupplier.java
new file mode 100644
index 000000000000..c435df8da3de
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/AbstractEventsSupplier.java
@@ -0,0 +1,45 @@
+package org.keycloak.testframework.events;
+
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.injection.SupplierHelpers;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfigInterceptor;
+
+import java.lang.annotation.Annotation;
+
+@SuppressWarnings("rawtypes")
+public abstract class AbstractEventsSupplier<E extends AbstractEvents, A extends Annotation> implements Supplier<E, A>, RealmConfigInterceptor<E, A> {
+
+    @Override
+    public E getValue(InstanceContext<E, A> instanceContext) {
+        String realmRef = SupplierHelpers.getAnnotationField(instanceContext.getAnnotation(), "realmRef");
+        ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class, realmRef);
+        return createValue(realm);
+    }
+
+    @Override
+    public LifeCycle getDefaultLifecycle() {
+        return LifeCycle.GLOBAL;
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<E, A> a, RequestedInstance<E, A> b) {
+        return true;
+    }
+
+    @Override
+    public void onBeforeEach(InstanceContext<E, A> instanceContext) {
+        instanceContext.getValue().testStarted();
+    }
+
+    @Override
+    public void close(InstanceContext<E, A> instanceContext) {
+        instanceContext.getValue().clear();
+    }
+
+    protected abstract E createValue(ManagedRealm realm);
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventAssertion.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventAssertion.java
new file mode 100644
index 000000000000..f12b9b76fd4b
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventAssertion.java
@@ -0,0 +1,156 @@
+package org.keycloak.testframework.events;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.hamcrest.MatcherAssert;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.common.util.reflections.Reflections;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.AuthDetailsRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+public class AdminEventAssertion {
+
+    private final AdminEventRepresentation event;
+    private final boolean expectSuccess;
+
+    protected AdminEventAssertion(AdminEventRepresentation event, boolean expectSuccess) {
+        Assertions.assertNotNull(event, "Event was null");
+        Assertions.assertNotNull(event.getId(), "Event id was null");
+        this.event = event;
+        this.expectSuccess = expectSuccess;
+    }
+
+    public static AdminEventAssertion assertSuccess(AdminEventRepresentation event) {
+        Assertions.assertFalse(event.getOperationType().endsWith("_ERROR"), "Expected successful event");
+        return new AdminEventAssertion(event, true)
+                .assertEventId()
+                .assertValidOperationType();
+    }
+
+    public static AdminEventAssertion assertError(AdminEventRepresentation event) {
+        Assertions.assertTrue(event.getOperationType().endsWith("_ERROR"), "Expected error event");
+        return new AdminEventAssertion(event, false)
+                .assertEventId()
+                .assertValidOperationType();
+    }
+
+    public static AdminEventAssertion assertEvent(AdminEventRepresentation event, OperationType operationType, String resourcePath, Object representation, ResourceType resourceType) {
+        return assertSuccess(event)
+                .operationType(operationType)
+                .resourcePath(resourcePath)
+                .representation(representation)
+                .resourceType(resourceType);
+    }
+
+    public static AdminEventAssertion assertEvent(AdminEventRepresentation event, OperationType operationType, String resourcePath, ResourceType resourceType) {
+        return assertSuccess(event)
+                .operationType(operationType)
+                .resourcePath(resourcePath)
+                .resourceType(resourceType);
+    }
+
+    public AdminEventAssertion operationType(OperationType operationType) {
+        Assertions.assertEquals(operationType.name(), getOperationType());
+        return this;
+    }
+
+    public AdminEventAssertion auth(String expectedRealmId, String expectedClientId, String expectedUserId) {
+        AuthDetailsRepresentation authDetails = event.getAuthDetails();
+        Assertions.assertEquals(expectedRealmId, authDetails.getRealmId());
+        Assertions.assertEquals(expectedClientId, authDetails.getClientId());
+        Assertions.assertEquals(expectedUserId, authDetails.getUserId());
+        return this;
+    }
+
+    public AdminEventAssertion resourceType(ResourceType expectedResourceType) {
+        Assertions.assertEquals(expectedResourceType.name(), event.getResourceType());
+        return this;
+    }
+
+    public AdminEventAssertion resourcePath(String... expectedResourcePath) {
+        Assertions.assertEquals(String.join("/", expectedResourcePath), event.getResourcePath());
+        return this;
+    }
+
+    public AdminEventAssertion representation(Object expectedRep) {
+        String actualRepresentation = event.getRepresentation();
+        if (expectedRep == null) {
+            Assertions.assertNull(event.getRepresentation());
+        } else {
+            try {
+                if (expectedRep instanceof List) {
+                    // List of roles. All must be available in actual representation
+                    List<RoleRepresentation> expectedRoles = (List<RoleRepresentation>) expectedRep;
+                    List<RoleRepresentation> actualRoles = JsonSerialization.readValue(new ByteArrayInputStream(actualRepresentation.getBytes()), new TypeReference<>() {});
+
+                    Map<String, String> expectedRolesMap = new HashMap<>();
+                    for (RoleRepresentation role : expectedRoles) {
+                        expectedRolesMap.put(role.getId(), role.getName());
+                    }
+
+                    Map<String, String> actualRolesMap = new HashMap<>();
+                    for (RoleRepresentation role : actualRoles) {
+                        actualRolesMap.put(role.getId(), role.getName());
+                    }
+                    Assertions.assertEquals(expectedRolesMap, actualRolesMap);
+
+                } else if (expectedRep instanceof Map<?, ?> expectedRepMap) {
+                    Map<?, ?> actualRepMap = JsonSerialization.readValue(actualRepresentation, Map.class);
+                    for (Map.Entry<?, ?> entry : expectedRepMap.entrySet()) {
+                        Object expectedValue = entry.getValue();
+                        if (expectedValue != null) {
+                            Object actualValue = actualRepMap.get(entry.getKey());
+                            Assertions.assertEquals(expectedValue, actualValue, "Map item with key '" + entry.getKey() + "' not equal.");
+                        }
+                    }
+                } else {
+                    Object actualRep = JsonSerialization.readValue(actualRepresentation, expectedRep.getClass());
+
+                    // Reflection-based comparing for other types - compare the non-null fields of "expected" representation with the "actual" representation from the event
+                    for (Method method : Reflections.getAllDeclaredMethods(expectedRep.getClass())) {
+                        if (method.getParameterCount() == 0 && (method.getName().startsWith("get") || method.getName().startsWith("is"))) {
+                            Object expectedValue = Reflections.invokeMethod(method, expectedRep);
+                            if (expectedValue != null) {
+                                Object actualValue = Reflections.invokeMethod(method, actualRep);
+                                Assertions.assertEquals(expectedValue, actualValue, "Property method '" + method.getName() + "' of representation not equal.");
+                            }
+                        }
+                    }
+                }
+            } catch (IOException ioe) {
+                throw new RuntimeException(ioe);
+            }
+        }
+        return this;
+    }
+
+    private AdminEventAssertion assertEventId() {
+        MatcherAssert.assertThat(event.getId(), EventMatchers.isUUID());
+        return this;
+    }
+
+    private AdminEventAssertion assertValidOperationType() {
+        String actualOperationType = getOperationType();
+        try {
+            OperationType.valueOf(actualOperationType);
+        } catch (IllegalArgumentException e) {
+            Assertions.fail("Unknown operation type: " + actualOperationType);
+        }
+        return this;
+    }
+
+    private String getOperationType() {
+        return expectSuccess ? event.getOperationType() : event.getOperationType().substring(0, "_ERROR".length());
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEvents.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEvents.java
index 43dc788d8ea6..d175bcb67a21 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEvents.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEvents.java
@@ -1,32 +1,41 @@
 package org.keycloak.testframework.events;
 
-import org.keycloak.events.admin.AdminEvent;
+import org.jboss.logging.Logger;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.testframework.realm.ManagedRealm;
 
-import java.util.concurrent.BlockingQueue;
-import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.TimeUnit;
+import java.util.List;
 
-public class AdminEvents implements SysLogListener{
+public class AdminEvents extends AbstractEvents<AdminEventRepresentation> {
 
-    private final BlockingQueue<AdminEvent> adminEvents = new LinkedBlockingQueue<>();
+    private static final Logger LOGGER = Logger.getLogger(AdminEvents.class);
 
-    public AdminEvent poll() {
-        try {
-            return adminEvents.poll(30, TimeUnit.SECONDS);
-        } catch (InterruptedException e) {
-            return null;
-        }
+    public AdminEvents(ManagedRealm realm) {
+        super(realm);
     }
 
-    public void clear() {
-        adminEvents.clear();
+    @Override
+    protected List<AdminEventRepresentation> getEvents(long from, long to) {
+        return realm.admin().getAdminEvents(null, null, null, null, null, null, null, from, to, null, null, "asc");
+    }
+
+    @Override
+    protected String getEventId(AdminEventRepresentation rep) {
+        return rep.getId();
+    }
+
+    @Override
+    protected String getRealmId(AdminEventRepresentation rep) {
+        return rep.getRealmId();
+    }
+
+    @Override
+    protected void clearServerEvents() {
+        realm.admin().clearAdminEvents();
     }
 
     @Override
-    public void onLog(SysLog sysLog) {
-        AdminEvent adminEvent = AdminEventsParser.parse(sysLog);
-        if (adminEvent != null) {
-            adminEvents.add(adminEvent);
-        }
+    protected Logger getLogger() {
+        return LOGGER;
     }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventsSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventsSupplier.java
index 44aebcca66a6..ab717ce4575e 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventsSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/AdminEventsSupplier.java
@@ -2,53 +2,24 @@
 
 import org.keycloak.testframework.annotations.InjectAdminEvents;
 import org.keycloak.testframework.injection.InstanceContext;
-import org.keycloak.testframework.injection.LifeCycle;
-import org.keycloak.testframework.injection.RequestedInstance;
-import org.keycloak.testframework.injection.Supplier;
-import org.keycloak.testframework.injection.SupplierOrder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
 
-public class AdminEventsSupplier implements Supplier<AdminEvents, InjectAdminEvents> {
-
-    @Override
-    public Class<InjectAdminEvents> getAnnotationClass() {
-        return InjectAdminEvents.class;
-    }
-
-    @Override
-    public Class<AdminEvents> getValueType() {
-        return AdminEvents.class;
-    }
+public class AdminEventsSupplier extends AbstractEventsSupplier<AdminEvents, InjectAdminEvents> {
 
     @Override
     public AdminEvents getValue(InstanceContext<AdminEvents, InjectAdminEvents> instanceContext) {
-        AdminEvents adminEvents = new AdminEvents();
-        SysLogServer sysLogServer = instanceContext.getDependency(SysLogServer.class);
-        instanceContext.addNote("server", sysLogServer);
-        return adminEvents;
-    }
-
-    @Override
-    public void onBeforeEach(InstanceContext<AdminEvents, InjectAdminEvents> instanceContext) {
-        instanceContext.getNote("server", SysLogServer.class).addListener(instanceContext.getValue());
+        return super.getValue(instanceContext);
     }
 
     @Override
-    public LifeCycle getDefaultLifecycle() {
-        return LifeCycle.METHOD;
+    public AdminEvents createValue(ManagedRealm realm) {
+        return new AdminEvents(realm);
     }
 
     @Override
-    public void close(InstanceContext<AdminEvents, InjectAdminEvents> instanceContext) {
-        instanceContext.getNote("server", SysLogServer.class).removeListener(instanceContext.getValue());
+    public RealmConfigBuilder intercept(RealmConfigBuilder realm, InstanceContext<AdminEvents, InjectAdminEvents> instanceContext) {
+        return realm.adminEventsEnabled(true).adminEventsDetailsEnabled(true);
     }
 
-    @Override
-    public boolean compatible(InstanceContext<AdminEvents, InjectAdminEvents> a, RequestedInstance<AdminEvents, InjectAdminEvents> b) {
-        return true;
-    }
-
-    @Override
-    public int order() {
-        return SupplierOrder.BEFORE_KEYCLOAK_SERVER;
-    }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/EventMatchers.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/EventMatchers.java
new file mode 100644
index 000000000000..85ac6448b650
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/EventMatchers.java
@@ -0,0 +1,36 @@
+package org.keycloak.testframework.events;
+
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.hamcrest.TypeSafeMatcher;
+
+import java.util.UUID;
+
+public class EventMatchers {
+
+    public static Matcher<String> isUUID() {
+        return new UUIDMatcher();
+    }
+
+    private EventMatchers() {
+    }
+
+    public static class UUIDMatcher extends TypeSafeMatcher<String> {
+
+        @Override
+        protected boolean matchesSafely(String item) {
+            try {
+                UUID.fromString(item);
+                return true;
+            } catch (IllegalArgumentException e) {
+                return false;
+            }
+        }
+
+        @Override
+        public void describeTo(Description description) {
+            description.appendText("not a UUID");
+        }
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/Events.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/Events.java
index 064936d3a162..e831ba428495 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/events/Events.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/Events.java
@@ -1,32 +1,42 @@
 package org.keycloak.testframework.events;
 
-import org.keycloak.events.Event;
+import org.jboss.logging.Logger;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.testframework.realm.ManagedRealm;
 
-import java.util.concurrent.BlockingQueue;
-import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.TimeUnit;
+import java.util.List;
 
-public class Events implements SysLogListener {
+public class Events extends AbstractEvents<EventRepresentation> {
 
-    private final BlockingQueue<Event> events = new LinkedBlockingQueue<>();
+    private static final Logger LOGGER = Logger.getLogger(Events.class);
 
-    public Event poll() {
-        try {
-            return events.poll(30, TimeUnit.SECONDS);
-        } catch (InterruptedException e) {
-            return null;
-        }
+    public Events(ManagedRealm realm) {
+        super(realm);
     }
 
-    public void clear() {
-        events.clear();
+    @Override
+    protected List<EventRepresentation> getEvents(long from, long to) {
+        return realm.admin().getEvents(null, null, null, from, to, null, null, null, "asc");
+    }
+
+    @Override
+    protected String getEventId(EventRepresentation rep) {
+        return rep.getId();
     }
 
     @Override
-    public void onLog(SysLog sysLog) {
-        Event event = EventParser.parse(sysLog);
-        if (event != null) {
-            events.add(event);
-        }
+    protected String getRealmId(EventRepresentation rep) {
+        return rep.getRealmId();
     }
+
+    @Override
+    protected void clearServerEvents() {
+        realm.admin().clearEvents();
+    }
+
+    @Override
+    protected Logger getLogger() {
+        return LOGGER;
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/EventsSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/EventsSupplier.java
index be0ff3057488..b19a481da57f 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/events/EventsSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/EventsSupplier.java
@@ -2,53 +2,24 @@
 
 import org.keycloak.testframework.annotations.InjectEvents;
 import org.keycloak.testframework.injection.InstanceContext;
-import org.keycloak.testframework.injection.LifeCycle;
-import org.keycloak.testframework.injection.RequestedInstance;
-import org.keycloak.testframework.injection.Supplier;
-import org.keycloak.testframework.injection.SupplierOrder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
 
-public class EventsSupplier implements Supplier<Events, InjectEvents> {
-
-    @Override
-    public Class<InjectEvents> getAnnotationClass() {
-        return InjectEvents.class;
-    }
-
-    @Override
-    public Class<Events> getValueType() {
-        return Events.class;
-    }
+public class EventsSupplier extends AbstractEventsSupplier<Events, InjectEvents> {
 
     @Override
     public Events getValue(InstanceContext<Events, InjectEvents> instanceContext) {
-        Events events = new Events();
-        SysLogServer sysLogServer = instanceContext.getDependency(SysLogServer.class);
-        instanceContext.addNote("server", sysLogServer);
-        return events;
-    }
-
-    @Override
-    public void onBeforeEach(InstanceContext<Events, InjectEvents> instanceContext) {
-        instanceContext.getNote("server", SysLogServer.class).addListener(instanceContext.getValue());
+        return super.getValue(instanceContext);
     }
 
     @Override
-    public LifeCycle getDefaultLifecycle() {
-        return LifeCycle.METHOD;
+    protected Events createValue(ManagedRealm realm) {
+        return new Events(realm);
     }
 
     @Override
-    public void close(InstanceContext<Events, InjectEvents> instanceContext) {
-        instanceContext.getNote("server", SysLogServer.class).removeListener(instanceContext.getValue());
+    public RealmConfigBuilder intercept(RealmConfigBuilder realm, InstanceContext<Events, InjectEvents> instanceContext) {
+        return realm.eventsEnabled(true);
     }
 
-    @Override
-    public boolean compatible(InstanceContext<Events, InjectEvents> a, RequestedInstance<Events, InjectEvents> b) {
-        return true;
-    }
-
-    @Override
-    public int order() {
-        return SupplierOrder.BEFORE_KEYCLOAK_SERVER;
-    }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/events/SysLogServerSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/events/SysLogServerSupplier.java
index 7390cb0871c1..281db62fdbb9 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/events/SysLogServerSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/events/SysLogServerSupplier.java
@@ -13,16 +13,6 @@
 
 public class SysLogServerSupplier implements Supplier<SysLogServer, InjectSysLogServer>, KeycloakServerConfigInterceptor<SysLogServer, InjectSysLogServer> {
 
-    @Override
-    public Class<InjectSysLogServer> getAnnotationClass() {
-        return InjectSysLogServer.class;
-    }
-
-    @Override
-    public Class<SysLogServer> getValueType() {
-        return SysLogServer.class;
-    }
-
     @Override
     public SysLogServer getValue(InstanceContext<SysLogServer, InjectSysLogServer> instanceContext) {
         try {
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpClientSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpClientSupplier.java
index 6e1dfea7a19b..4b1168f53c08 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpClientSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpClientSupplier.java
@@ -13,18 +13,14 @@
 public class HttpClientSupplier implements Supplier<HttpClient, InjectHttpClient> {
 
     @Override
-    public Class<InjectHttpClient> getAnnotationClass() {
-        return InjectHttpClient.class;
-    }
+    public HttpClient getValue(InstanceContext<HttpClient, InjectHttpClient> instanceContext) {
+        HttpClientBuilder builder = HttpClientBuilder.create();
 
-    @Override
-    public Class<HttpClient> getValueType() {
-        return HttpClient.class;
-    }
+        if (!instanceContext.getAnnotation().followRedirects()) {
+            builder.disableRedirectHandling();
+        }
 
-    @Override
-    public HttpClient getValue(InstanceContext<HttpClient, InjectHttpClient> instanceContext) {
-        return HttpClientBuilder.create().build();
+        return builder.build();
     }
 
     @Override
@@ -38,6 +34,7 @@ public void close(InstanceContext<HttpClient, InjectHttpClient> instanceContext)
 
     @Override
     public boolean compatible(InstanceContext<HttpClient, InjectHttpClient> a, RequestedInstance<HttpClient, InjectHttpClient> b) {
-        return false;
+        return true;
     }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpServerSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpServerSupplier.java
new file mode 100644
index 000000000000..38954da55582
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/http/HttpServerSupplier.java
@@ -0,0 +1,41 @@
+package org.keycloak.testframework.http;
+
+import com.sun.net.httpserver.HttpServer;
+import org.keycloak.testframework.annotations.InjectHttpServer;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+
+public class HttpServerSupplier implements Supplier<HttpServer, InjectHttpServer> {
+
+    @Override
+    public HttpServer getValue(InstanceContext<HttpServer, InjectHttpServer> instanceContext) {
+        try {
+            HttpServer httpServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 8500), 10);
+            httpServer.start();
+            return httpServer;
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Override
+    public void close(InstanceContext<HttpServer, InjectHttpServer> instanceContext) {
+        instanceContext.getValue().stop(0);
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<HttpServer, InjectHttpServer> a, RequestedInstance<HttpServer, InjectHttpServer> b) {
+        return true;
+    }
+
+    @Override
+    public LifeCycle getDefaultLifecycle() {
+        return LifeCycle.GLOBAL;
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/AbstractInterceptorHelper.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/AbstractInterceptorHelper.java
index 92b1731bacf2..bb86497889cb 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/AbstractInterceptorHelper.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/AbstractInterceptorHelper.java
@@ -1,6 +1,5 @@
 package org.keycloak.testframework.injection;
 
-import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 
@@ -9,7 +8,6 @@ public abstract class AbstractInterceptorHelper<I, V> {
     private final Registry registry;
     private final Class<?> interceptorClass;
     private final List<Interception> interceptions = new LinkedList<>();
-    private final InterceptedBy interceptedBy = new InterceptedBy();
 
     public AbstractInterceptorHelper(Registry registry, Class<I> interceptorClass) {
         this.registry = registry;
@@ -17,21 +15,18 @@ public AbstractInterceptorHelper(Registry registry, Class<I> interceptorClass) {
 
         registry.getDeployedInstances().stream().filter(i -> isInterceptor(i.getSupplier())).forEach(i -> interceptions.add(new Interception(i)));
         registry.getRequestedInstances().stream().filter(r -> isInterceptor(r.getSupplier())).forEach(r -> interceptions.add(new Interception(r)));
-
-        interceptions.forEach(i -> interceptedBy.put(i.supplier, i.instanceId));
-    }
-
-    public boolean sameInterceptors(InstanceContext<?, ?> instanceContext) {
-        InterceptedBy previousInterceptedBy = instanceContext.getNote("InterceptedBy", InterceptedBy.class);
-        return interceptedBy.equals(previousInterceptedBy);
     }
 
     public V intercept(V value, InstanceContext<?, ?> instanceContext) {
         for (Interception interception : interceptions) {
             value = intercept(value, interception.supplier, interception.existingInstance);
             registry.getLogger().logIntercepted(value, interception.supplier);
+            if (interception.existingInstance != null) {
+                interception.existingInstance.registerDependency(instanceContext);
+            } else {
+                interception.requestedInstance.registerDependency(instanceContext);
+            }
         }
-        instanceContext.addNote("InterceptedBy", interceptedBy);
         return value;
     }
 
@@ -41,24 +36,21 @@ private boolean isInterceptor(Supplier<?, ?> supplier) {
         return interceptorClass.isAssignableFrom(supplier.getClass());
     }
 
-    public static class InterceptedBy extends HashMap<Supplier<?, ?>, Integer> {
-    }
-
     private static class Interception {
 
-        private final int instanceId;
         private final Supplier<?, ?> supplier;
+        private final RequestedInstance<?, ?> requestedInstance;
         private final InstanceContext<?, ?> existingInstance;
 
         public Interception(InstanceContext<?, ?> existingInstance) {
             this.supplier = existingInstance.getSupplier();
-            this.instanceId = existingInstance.getInstanceId();
+            this.requestedInstance = null;
             this.existingInstance = existingInstance;
         }
 
         public Interception(RequestedInstance<?, ?> requestedInstance) {
             this.supplier = requestedInstance.getSupplier();
-            this.instanceId = requestedInstance.getInstanceId();
+            this.requestedInstance = requestedInstance;
             this.existingInstance = null;
         }
     }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Extensions.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Extensions.java
index 1b5e38e3454e..ae07ad11d6ff 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Extensions.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Extensions.java
@@ -1,9 +1,11 @@
 package org.keycloak.testframework.injection;
 
+import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.keycloak.testframework.TestFrameworkExtension;
 import org.keycloak.testframework.config.Config;
 
 import java.lang.annotation.Annotation;
+import java.lang.reflect.Field;
 import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
@@ -20,8 +22,9 @@ public class Extensions {
     public Extensions() {
         List<TestFrameworkExtension> extensions = loadExtensions();
         valueTypeAlias = loadValueTypeAlias(extensions);
+        Config.registerValueTypeAlias(valueTypeAlias);
         logger = new RegistryLogger(valueTypeAlias);
-        suppliers = loadSuppliers(extensions, valueTypeAlias);
+        suppliers = loadSuppliers(extensions);
         alwaysEnabledValueTypes = loadAlwaysEnabledValueTypes(extensions);
     }
 
@@ -59,7 +62,7 @@ private ValueTypeAlias loadValueTypeAlias(List<TestFrameworkExtension> extension
         return valueTypeAlias;
     }
 
-    private List<Supplier<?, ?>> loadSuppliers(List<TestFrameworkExtension> extensions, ValueTypeAlias valueTypeAlias) {
+    private List<Supplier<?, ?>> loadSuppliers(List<TestFrameworkExtension> extensions) {
         List<Supplier<?, ?>> suppliers = new LinkedList<>();
         List<Supplier<?, ?>> skippedSuppliers = new LinkedList<>();
         Set<Class<?>> loadedValueTypes = new HashSet<>();
@@ -67,8 +70,9 @@ private ValueTypeAlias loadValueTypeAlias(List<TestFrameworkExtension> extension
         for (TestFrameworkExtension extension : extensions) {
             for (var supplier : extension.suppliers()) {
                 Class<?> valueType = supplier.getValueType();
-                String requestedSupplier = Config.getSelectedSupplier(valueType, valueTypeAlias);
+                String requestedSupplier = Config.getSelectedSupplier(valueType);
                 if (supplier.getAlias().equals(requestedSupplier) || (requestedSupplier == null && !loadedValueTypes.contains(valueType))) {
+                    configureSupplier(supplier);
                     suppliers.add(supplier);
                     loadedValueTypes.add(valueType);
                 } else {
@@ -86,4 +90,15 @@ private List<Class<?>> loadAlwaysEnabledValueTypes(List<TestFrameworkExtension>
         return extensions.stream().flatMap(s -> s.alwaysEnabledValueTypes().stream()).toList();
     }
 
+    private void configureSupplier(Supplier<?, ?> supplier) {
+        for (Field f : ReflectionUtils.listFields(supplier.getClass())) {
+            ConfigProperty annotation = f.getAnnotation(ConfigProperty.class);
+            if (annotation != null) {
+                Object configValue = Config.getValueTypeConfig(supplier.getValueType(), annotation.name(), annotation.defaultValue(), f.getType());
+                ReflectionUtils.setField(f, supplier, configValue);
+            }
+        }
+
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/InstanceContext.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/InstanceContext.java
index 3779f09f5768..7134d45b999d 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/InstanceContext.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/InstanceContext.java
@@ -12,7 +12,7 @@ public class InstanceContext<T, A extends Annotation> {
     private final Registry registry;
     private final Supplier<T, A> supplier;
     private final A annotation;
-    private final Set<InstanceContext<T, A>> dependencies = new HashSet<>();
+    private final Set<InstanceContext<?, ?>> dependencies = new HashSet<>();
     private T value;
     private Class<? extends T> requestedValueType;
     private LifeCycle lifeCycle;
@@ -73,11 +73,11 @@ public A getAnnotation() {
         return annotation;
     }
 
-    public Set<InstanceContext<T, A>> getDependencies() {
+    public Set<InstanceContext<?, ?>> getDependencies() {
         return dependencies;
     }
 
-    public void registerDependency(InstanceContext<T, A> instanceContext) {
+    public void registerDependency(InstanceContext<?, ?> instanceContext) {
         dependencies.add(instanceContext);
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/ReflectionUtils.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/ReflectionUtils.java
new file mode 100644
index 000000000000..a24b5d66c0d4
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/ReflectionUtils.java
@@ -0,0 +1,51 @@
+package org.keycloak.testframework.injection;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.ParameterizedType;
+import java.lang.reflect.Type;
+import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
+
+public class ReflectionUtils {
+
+    public static List<Field> listFields(Class<?> clazz) {
+        List<Field> fields = new LinkedList<>(Arrays.asList(clazz.getDeclaredFields()));
+
+        Class<?> superclass = clazz.getSuperclass();
+        while (superclass != null && !superclass.equals(Object.class)) {
+            fields.addAll(Arrays.asList(superclass.getDeclaredFields()));
+            superclass = superclass.getSuperclass();
+        }
+
+        return fields;
+    }
+
+    public static void setField(Field field, Object object, Object value) {
+        try {
+            field.setAccessible(true);
+            field.set(object, value);
+        } catch (IllegalAccessException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static Class<?> getValueType(Supplier<?, ?> supplier) {
+        return getActualTypeArgument(supplier, 0);
+    }
+
+    public static Class<?> getAnnotationType(Supplier<?, ?> supplier) {
+        return getActualTypeArgument(supplier, 1);
+    }
+
+    private static Class<?> getActualTypeArgument(Supplier<?, ?> supplier, int argument) {
+        try {
+            ParameterizedType parameterizedType = (ParameterizedType) supplier.getClass().getMethod("getValue", InstanceContext.class).getGenericParameterTypes()[0];
+            return (Class<?>) parameterizedType.getActualTypeArguments()[argument];
+        } catch (Throwable e) {
+            throw new RuntimeException("Failed to discover generic types for supplier " + supplier.getClass().getName() + "; supplier must implement getValue method directly", e);
+        }
+
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Registry.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Registry.java
index 0189ca352ecb..6f6cb110c21f 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Registry.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Registry.java
@@ -4,7 +4,6 @@
 
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Field;
-import java.util.Arrays;
 import java.util.Comparator;
 import java.util.Iterator;
 import java.util.LinkedList;
@@ -115,6 +114,7 @@ private <T> T getUnConfiguredDependency(Class<T> typeClass, String ref, Instance
 
     public void beforeEach(Object testInstance) {
         findRequestedInstances(testInstance);
+        destroyIncompatibleInstances();
         matchDeployedInstancesWithRequestedInstances();
         deployRequestedInstances();
         injectFields(testInstance);
@@ -136,7 +136,7 @@ private void findRequestedInstances(Object testInstance) {
             requestedInstances.add(requestedServerInstance);
         }
 
-        for (Field f : listFields(testClass)) {
+        for (Field f : ReflectionUtils.listFields(testClass)) {
             RequestedInstance requestedInstance = createRequestedInstance(f.getAnnotations(), f.getType());
             if (requestedInstance != null) {
                 requestedInstances.add(requestedInstance);
@@ -146,6 +146,19 @@ private void findRequestedInstances(Object testInstance) {
         logger.logRequestedInstances(requestedInstances);
     }
 
+    private void destroyIncompatibleInstances() {
+        for (RequestedInstance<?, ?> requestedInstance : requestedInstances) {
+            InstanceContext deployedInstance = getDeployedInstance(requestedInstance);
+            if (deployedInstance != null) {
+                boolean compatible = requestedInstance.getLifeCycle().equals(deployedInstance.getLifeCycle()) && deployedInstance.getSupplier().compatible(deployedInstance, requestedInstance);
+                if (!compatible) {
+                    logger.logDestroyIncompatible(deployedInstance);
+                    destroy(deployedInstance);
+                }
+            }
+        }
+    }
+
     private void matchDeployedInstancesWithRequestedInstances() {
         Iterator<RequestedInstance<?, ?>> itr = requestedInstances.iterator();
         while (itr.hasNext()) {
@@ -155,9 +168,6 @@ private void matchDeployedInstancesWithRequestedInstances() {
                 if (requestedInstance.getLifeCycle().equals(deployedInstance.getLifeCycle()) && deployedInstance.getSupplier().compatible(deployedInstance, requestedInstance)) {
                     logger.logReusingCompatibleInstance(deployedInstance);
                     itr.remove();
-                } else {
-                    logger.logDestroyIncompatible(deployedInstance);
-                    destroy(deployedInstance);
                 }
             }
         }
@@ -173,23 +183,23 @@ private void deployRequestedInstances() {
                 instance.setValue(requestedInstance.getSupplier().getValue(instance));
                 deployedInstances.add(instance);
 
+                if (!requestedInstance.getDependencies().isEmpty()) {
+                    Set<InstanceContext<?,?>> dependencies = requestedInstance.getDependencies();
+                    dependencies.forEach(instance::registerDependency);
+                }
+
                 logger.logCreatedInstance(requestedInstance, instance);
             }
         }
     }
 
     private void injectFields(Object testInstance) {
-        for (Field f : listFields(testInstance.getClass())) {
+        for (Field f : ReflectionUtils.listFields(testInstance.getClass())) {
             InstanceContext<?, ?> instance = getDeployedInstance(f.getType(), f.getAnnotations());
             if (instance == null) { // a test class might have fields not meant for injection
                 continue;
             }
-            try {
-                f.setAccessible(true);
-                f.set(testInstance, instance.getValue());
-            } catch (IllegalAccessException e) {
-                throw new RuntimeException(e);
-            }
+            ReflectionUtils.setField(f, testInstance, instance.getValue());
         }
     }
 
@@ -307,18 +317,6 @@ private void invokeBeforeEachOnSuppliers() {
         }
     }
 
-    private List<Field> listFields(Class clazz) {
-        List<Field> fields = new LinkedList<>(Arrays.asList(clazz.getDeclaredFields()));
-
-        Class<?> superclass = clazz.getSuperclass();
-        while (superclass != null && !superclass.equals(Object.class)) {
-            fields.addAll(Arrays.asList(superclass.getDeclaredFields()));
-            superclass = superclass.getSuperclass();
-        }
-
-        return fields;
-    }
-
     private static class RequestedInstanceComparator implements Comparator<RequestedInstance> {
 
         static final RequestedInstanceComparator INSTANCE = new RequestedInstanceComparator();
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/RequestedInstance.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/RequestedInstance.java
index 312d4580029f..90e5fd7246de 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/RequestedInstance.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/RequestedInstance.java
@@ -1,12 +1,15 @@
 package org.keycloak.testframework.injection;
 
 import java.lang.annotation.Annotation;
+import java.util.HashSet;
+import java.util.Set;
 
 public class RequestedInstance<T, A extends Annotation> {
 
     private final int instanceId;
     private final Supplier<T, A> supplier;
     private final A annotation;
+    private final Set<InstanceContext<?, ?>> dependencies = new HashSet<>();
     private final Class<? extends T> valueType;
     private final LifeCycle lifeCycle;
     private final String ref;
@@ -44,4 +47,11 @@ public String getRef() {
         return ref;
     }
 
+    public void registerDependency(InstanceContext<?, ?> instanceContext) {
+        dependencies.add(instanceContext);
+    }
+
+    public Set<InstanceContext<?, ?>> getDependencies() {
+        return dependencies;
+    }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Supplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Supplier.java
index d5d3a17358d1..5c199ea95a48 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/injection/Supplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/injection/Supplier.java
@@ -6,9 +6,15 @@
 
 public interface Supplier<T, S extends Annotation> {
 
-    Class<S> getAnnotationClass();
+    default Class<S> getAnnotationClass() {
+        //noinspection unchecked
+        return (Class<S>) ReflectionUtils.getAnnotationType(this);
+    }
 
-    Class<T> getValueType();
+    default Class<T> getValueType() {
+        //noinspection unchecked
+        return (Class<T>) ReflectionUtils.getValueType(this);
+    }
 
     T getValue(InstanceContext<T, S> instanceContext);
 
@@ -40,8 +46,4 @@ default int order() {
         return SupplierOrder.DEFAULT;
     }
 
-    default Set<Class<?>> dependencies() {
-        return Collections.emptySet();
-    }
-
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/database/JBossLogConsumer.java b/test-framework/core/src/main/java/org/keycloak/testframework/logging/JBossLogConsumer.java
similarity index 94%
rename from test-framework/core/src/main/java/org/keycloak/testframework/database/JBossLogConsumer.java
rename to test-framework/core/src/main/java/org/keycloak/testframework/logging/JBossLogConsumer.java
index 9d35ad99709c..12ea46ebfa34 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/database/JBossLogConsumer.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/logging/JBossLogConsumer.java
@@ -1,4 +1,4 @@
-package org.keycloak.testframework.database;
+package org.keycloak.testframework.logging;
 
 import org.jboss.logging.Logger;
 import org.testcontainers.containers.output.OutputFrame;
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientConfigBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientConfigBuilder.java
index 9ff68de2fb71..1a52b0a55515 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientConfigBuilder.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientConfigBuilder.java
@@ -1,6 +1,12 @@
 package org.keycloak.testframework.realm;
 
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
 
 public class ClientConfigBuilder {
 
@@ -30,18 +36,64 @@ public ClientConfigBuilder clientId(String clientId) {
         return this;
     }
 
+    public ClientConfigBuilder id(String id) {
+        rep.setId(id);
+        return this;
+    }
+
     public ClientConfigBuilder secret(String secret) {
         rep.setSecret(secret);
         return this;
     }
 
+    public ClientConfigBuilder name(String name) {
+        rep.setName(name);
+        return this;
+    }
+
+    public ClientConfigBuilder description(String description) {
+        rep.setDescription(description);
+        return this;
+    }
+
+    public ClientConfigBuilder publicClient(boolean publicClient) {
+        rep.setPublicClient(publicClient);
+        return this;
+    }
+
     public ClientConfigBuilder redirectUris(String... redirectUris) {
         rep.setRedirectUris(Collections.combine(rep.getRedirectUris(), redirectUris));
         return this;
     }
 
-    public ClientConfigBuilder serviceAccount() {
-        rep.setServiceAccountsEnabled(true);
+    public ClientConfigBuilder adminUrl(String adminUrl) {
+        rep.setAdminUrl(adminUrl);
+        return this;
+    }
+
+    public ClientConfigBuilder rootUrl(String rootUrl) {
+        rep.setRootUrl(rootUrl);
+        return this;
+    }
+
+    public ClientConfigBuilder baseUrl(String baseUrl) {
+        rep.setBaseUrl(baseUrl);
+        return this;
+    }
+
+    public ClientConfigBuilder protocol(String protocol) {
+        rep.setProtocol(protocol);
+        return this;
+    }
+
+    public ClientConfigBuilder bearerOnly(boolean bearerOnly) {
+        rep.setBearerOnly(bearerOnly);
+        return this;
+    }
+
+
+    public ClientConfigBuilder serviceAccountsEnabled(boolean enabled) {
+        rep.setServiceAccountsEnabled(enabled);
         return this;
     }
 
@@ -55,8 +107,64 @@ public ClientConfigBuilder authorizationServices() {
         return this;
     }
 
+    public ClientConfigBuilder fullScopeEnabled(boolean enabled) {
+        rep.setFullScopeAllowed(enabled);
+        return this;
+    }
+
+    public ClientConfigBuilder authenticatorType(String authenticatorType) {
+        rep.setClientAuthenticatorType(authenticatorType);
+        return this;
+    }
+
+    public ClientConfigBuilder attribute(String key, String value) {
+        if (rep.getAttributes() == null) {
+            rep.setAttributes(new HashMap<>());
+        }
+
+        rep.getAttributes().put(key, value);
+        return this;
+    }
+
+    public ClientConfigBuilder defaultClientScopes(String... defaultClientScopes) {
+        if (rep.getDefaultClientScopes() == null) {
+            rep.setDefaultClientScopes(new LinkedList<>());
+        }
+
+        rep.getDefaultClientScopes().addAll(List.of(defaultClientScopes));
+        return this;
+    }
+
+    public ClientConfigBuilder protocolMappers(List<ProtocolMapperRepresentation> mappers) {
+        if (rep.getProtocolMappers() == null) {
+            rep.setProtocolMappers(new LinkedList<>());
+        }
+        rep.getProtocolMappers().addAll(mappers);
+        return this;
+    }
+
+    /**
+     * Best practice is to use other convenience methods when configuring a client, but while the framework is under
+     * active development there may not be a way to perform all updates required. In these cases this method allows
+     * applying any changes to the underlying representation.
+     *
+     * @param update
+     * @return this
+     * @deprecated
+     */
+    public ClientConfigBuilder update(ClientUpdate... update) {
+        Arrays.stream(update).forEach(u -> u.update(rep));
+        return this;
+    }
+
     public ClientRepresentation build() {
         return rep;
     }
 
+    public interface ClientUpdate {
+
+        void update(ClientRepresentation client);
+
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientSupplier.java
index a9b694c4f3c5..f8b4cf7f4ab9 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ClientSupplier.java
@@ -1,5 +1,6 @@
 package org.keycloak.testframework.realm;
 
+import jakarta.ws.rs.NotFoundException;
 import java.util.List;
 
 import jakarta.ws.rs.core.Response;
@@ -15,42 +16,38 @@
 
 public class ClientSupplier implements Supplier<ManagedClient, InjectClient> {
 
-    @Override
-    public Class<InjectClient> getAnnotationClass() {
-        return InjectClient.class;
-    }
-
-    @Override
-    public Class<ManagedClient> getValueType() {
-        return ManagedClient.class;
-    }
-
     @Override
     public ManagedClient getValue(InstanceContext<ManagedClient, InjectClient> instanceContext) {
         ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class, instanceContext.getAnnotation().realmRef());
 
-        ClientConfig config = SupplierHelpers.getInstance(instanceContext.getAnnotation().config());
-        ClientRepresentation clientRepresentation = config.configure(ClientConfigBuilder.create()).build();
+        String attachTo = instanceContext.getAnnotation().attachTo();
+        boolean managed = attachTo.isEmpty();
 
-        if (clientRepresentation.getClientId() == null) {
-            String clientId = SupplierHelpers.createName(instanceContext);
-            clientRepresentation.setClientId(clientId);
-        }
+        ClientRepresentation clientRepresentation;
+
+        if (managed) {
+            ClientConfig config = SupplierHelpers.getInstance(instanceContext.getAnnotation().config());
+            clientRepresentation = config.configure(ClientConfigBuilder.create()).build();
+
+            if (clientRepresentation.getClientId() == null) {
+                clientRepresentation.setClientId(SupplierHelpers.createName(instanceContext));
+            }
 
-        if (instanceContext.getAnnotation().createClient()) {
             Response response = realm.admin().clients().create(clientRepresentation);
             if (Status.CONFLICT.equals(Status.fromStatusCode(response.getStatus()))) {
                 throw new IllegalStateException("Client already exist with client id: " + clientRepresentation.getClientId());
             }
             clientRepresentation.setId(ApiUtil.handleCreatedResponse(response));
         } else {
-            List<ClientRepresentation> clients = realm.admin().clients().findByClientId(clientRepresentation.getClientId());
+            List<ClientRepresentation> clients = realm.admin().clients().findByClientId(attachTo);
             if (clients.isEmpty()) {
-                throw new IllegalStateException("No client found with client id: " + clientRepresentation.getClientId());
+                throw new IllegalStateException("No client found with client id: " + attachTo);
             }
             clientRepresentation = clients.get(0);
         }
 
+        instanceContext.addNote("managed", managed);
+
         ClientResource clientResource = realm.admin().clients().get(clientRepresentation.getId());
         return new ManagedClient(clientRepresentation, clientResource);
     }
@@ -62,7 +59,11 @@ public boolean compatible(InstanceContext<ManagedClient, InjectClient> a, Reques
 
     @Override
     public void close(InstanceContext<ManagedClient, InjectClient> instanceContext) {
-        instanceContext.getValue().admin().remove();
+        if (instanceContext.getNote("managed", Boolean.class)) {
+            try {
+                instanceContext.getValue().admin().remove();
+            } catch (NotFoundException ex) {}
+        }
     }
 
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/Collections.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/Collections.java
index c132b909b0a6..51ead9da46f2 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/Collections.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/Collections.java
@@ -1,8 +1,10 @@
 package org.keycloak.testframework.realm;
 
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Stream;
 
 class Collections {
@@ -28,4 +30,25 @@ static <T> List<T> combine(List<T> l1, Stream<T> items) {
         return combine(l1, items.toList());
     }
 
+    static <K, V> Map<K, List<V>> combine(Map<K, List<V>> m1, Map<K, List<V>> m2) {
+        if (m1 == null) {
+            m1 = new HashMap<>();
+        }
+        for (Map.Entry<K, List<V>> entry : m2.entrySet()) {
+            K k = entry.getKey();
+            List<V> v = entry.getValue();
+            m1.put(k, combine(m1.get(k), v));
+        }
+        return m1;
+    }
+
+    @SafeVarargs
+    static <K, V> Map<K, List<V>> combine(Map<K, List<V>> m1, K key, V... values) {
+        return combine(m1, Map.of(key, List.of(values)));
+    }
+
+    static <K, V> Map<K, List<V>> combine(Map<K, List<V>> m1, K key, Stream<V> values) {
+        return combine(m1, Map.of(key, values.toList()));
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/GroupConfigBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/GroupConfigBuilder.java
new file mode 100644
index 000000000000..93144cfe3b3b
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/GroupConfigBuilder.java
@@ -0,0 +1,64 @@
+package org.keycloak.testframework.realm;
+
+import org.keycloak.representations.idm.GroupRepresentation;
+
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+public class GroupConfigBuilder {
+    private final GroupRepresentation rep;
+
+    private GroupConfigBuilder(GroupRepresentation rep) {
+        this.rep = rep;
+    }
+
+    public static GroupConfigBuilder create() {
+        GroupRepresentation rep = new GroupRepresentation();
+        return new GroupConfigBuilder(rep);
+    }
+
+    public static GroupConfigBuilder update(GroupRepresentation rep) {
+        return new GroupConfigBuilder(rep);
+    }
+
+    public GroupConfigBuilder name(String name) {
+        rep.setName(name);
+        return this;
+    }
+
+    public GroupConfigBuilder path(String path) {
+        rep.setPath(path);
+        return this;
+    }
+
+    public GroupConfigBuilder realmRoles(String... realmRoles) {
+        rep.setRealmRoles(Collections.combine(rep.getRealmRoles(), realmRoles));
+        return this;
+    }
+
+    public GroupConfigBuilder clientRoles(String client, String... clientRoles) {
+        rep.setClientRoles(Collections.combine(rep.getClientRoles(), client, clientRoles));
+        return this;
+    }
+
+    public GroupConfigBuilder attribute(String key, String... value) {
+        rep.setAttributes(Collections.combine(rep.getAttributes(), key, value));
+        return this;
+    }
+
+    public GroupConfigBuilder setAttributes(Map<String, List<String>> attributes) {
+        rep.setAttributes(attributes);
+        return this;
+    }
+
+    public GroupConfigBuilder subGroups(GroupRepresentation... subGroups) {
+        rep.setSubGroups(Collections.combine(rep.getSubGroups(), subGroups));
+        return this;
+    }
+
+    public GroupRepresentation build() {
+        return rep;
+    }
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClient.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClient.java
index c3adc4660e64..353d0786c68f 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClient.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClient.java
@@ -2,12 +2,15 @@
 
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.testframework.injection.ManagedTestResource;
 
-public class ManagedClient {
+public class ManagedClient extends ManagedTestResource {
 
     private final ClientRepresentation createdRepresentation;
     private final ClientResource clientResource;
 
+    private ManagedClientCleanup cleanup;
+
     public ManagedClient(ClientRepresentation createdRepresentation, ClientResource clientResource) {
         this.createdRepresentation = createdRepresentation;
         this.clientResource = clientResource;
@@ -29,4 +32,47 @@ public ClientResource admin() {
         return clientResource;
     }
 
+    public void updateWithCleanup(ManagedClient.ClientUpdate... updates) {
+        ClientRepresentation rep = admin().toRepresentation();
+
+        // TODO Admin v2 - Setting a field to `null` is ignored when updating the client (for example `adminUrl`), which
+        // makes it impossible to reset to the original. For now we are just re-creating the client by marking it as dirty
+        // cleanup().resetToOriginalRepresentation(rep);
+        dirty();
+
+        ClientConfigBuilder configBuilder = ClientConfigBuilder.update(rep);
+        for (ManagedClient.ClientUpdate update : updates) {
+            configBuilder = update.update(configBuilder);
+        }
+
+        ClientRepresentation updated = configBuilder.build();
+        admin().update(updated);
+
+        // TODO It's possible to delete attributes by setting their value to an empty string, but due to the above this
+        // is not a complete solution to resetting to the original
+        // ClientRepresentation original = cleanup().getOriginalRepresentation();
+        // updated.getAttributes().keySet().stream().filter(k -> !original.getAttributes().containsKey(k)).forEach(k -> original.getAttributes().put(k, ""));
+    }
+
+    public ManagedClientCleanup cleanup() {
+        if (cleanup == null) {
+            cleanup = new ManagedClientCleanup();
+        }
+        return cleanup;
+    }
+
+    @Override
+    public void runCleanup() {
+        if (cleanup != null) {
+            cleanup.runCleanupTasks(clientResource);
+            cleanup = null;
+        }
+    }
+
+    public interface ClientUpdate {
+
+        ClientConfigBuilder update(ClientConfigBuilder client);
+
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClientCleanup.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClientCleanup.java
new file mode 100644
index 000000000000..ac871ee2456b
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedClientCleanup.java
@@ -0,0 +1,50 @@
+package org.keycloak.testframework.realm;
+
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.representations.idm.ClientRepresentation;
+
+import java.util.LinkedList;
+import java.util.List;
+
+public class ManagedClientCleanup {
+
+    private final List<ClientCleanup> cleanupTasks = new LinkedList<>();
+
+    public ManagedClientCleanup add(ClientCleanup clientCleanup) {
+        this.cleanupTasks.add(clientCleanup);
+        return this;
+    }
+
+    void resetToOriginalRepresentation(ClientRepresentation rep) {
+        if (cleanupTasks.stream().noneMatch(c -> c instanceof ResetClient)) {
+            ClientRepresentation clone = RepresentationUtils.clone(rep);
+            cleanupTasks.add(new ResetClient(clone));
+        }
+    }
+
+    ClientRepresentation getOriginalRepresentation() {
+        ResetClient clientCleanup = (ResetClient) cleanupTasks.stream().filter(c -> c instanceof ResetClient).findFirst().orElse(null);
+        return clientCleanup != null ? clientCleanup.rep() : null;
+    }
+
+    void runCleanupTasks(ClientResource client) {
+        cleanupTasks.forEach(t -> t.cleanup(client));
+        cleanupTasks.clear();
+    }
+
+    public interface ClientCleanup {
+
+        void cleanup(ClientResource client);
+
+    }
+
+    private record ResetClient(ClientRepresentation rep) implements ClientCleanup {
+
+        @Override
+        public void cleanup(ClientResource client) {
+            client.update(rep);
+        }
+
+    }
+
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmConfigBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmConfigBuilder.java
index 98baead838e4..667e6153eebc 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmConfigBuilder.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmConfigBuilder.java
@@ -1,15 +1,18 @@
 package org.keycloak.testframework.realm;
 
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.RolesRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 
 import java.util.Arrays;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 public class RealmConfigBuilder {
 
@@ -34,6 +37,11 @@ public RealmConfigBuilder name(String name) {
         return this;
     }
 
+    public RealmConfigBuilder displayName(String displayName) {
+        rep.setDisplayName(displayName);
+        return this;
+    }
+
     public ClientConfigBuilder addClient(String clientId) {
         if (rep.getClients() == null) {
             rep.setClients(new LinkedList<>());
@@ -52,6 +60,15 @@ public UserConfigBuilder addUser(String username) {
         return UserConfigBuilder.update(user).enabled(true).username(username);
     }
 
+    public GroupConfigBuilder addGroup(String name) {
+        if (rep.getGroups() == null) {
+            rep.setGroups(new LinkedList<>());
+        }
+        GroupRepresentation group = new GroupRepresentation();
+        rep.getGroups().add(group);
+        return GroupConfigBuilder.update(group).name(name);
+    }
+
     public RealmConfigBuilder registrationEmailAsUsername(boolean registrationEmailAsUsername) {
         rep.setRegistrationEmailAsUsername(registrationEmailAsUsername);
         return this;
@@ -72,6 +89,34 @@ public RealmConfigBuilder adminPermissionsEnabled(boolean enabled) {
         return this;
     }
 
+    public RealmConfigBuilder eventsEnabled(boolean enabled) {
+        rep.setEventsEnabled(enabled);
+        return this;
+    }
+
+    public RealmConfigBuilder adminEventsEnabled(boolean enabled) {
+        rep.setAdminEventsEnabled(enabled);
+        return this;
+    }
+
+    public RealmConfigBuilder adminEventsDetailsEnabled(boolean enabled) {
+        rep.setAdminEventsDetailsEnabled(enabled);
+        return this;
+    }
+
+    public RealmConfigBuilder enabledEventTypes(String... enabledEventTypes) {
+        if (rep.getEnabledEventTypes() == null) {
+            rep.setEnabledEventTypes(new LinkedList<>());
+        }
+        rep.getEnabledEventTypes().addAll(List.of(enabledEventTypes));
+        return this;
+    }
+
+    public RealmConfigBuilder overwriteEnabledEventTypes(String... enabledEventTypes) {
+        rep.setEnabledEventTypes(List.of(enabledEventTypes));
+        return this;
+    }
+
     public RealmConfigBuilder eventsListeners(String... eventListeners) {
         if (rep.getEventsListeners() == null) {
             rep.setEventsListeners(new LinkedList<>());
@@ -80,11 +125,36 @@ public RealmConfigBuilder eventsListeners(String... eventListeners) {
         return this;
     }
 
+    public RealmConfigBuilder overwriteEventsListeners(String... eventListeners) {
+        rep.setEventsListeners(List.of(eventListeners));
+        return this;
+    }
+
+    public RealmConfigBuilder eventsExpiration(long eventsExpiration) {
+        rep.setEventsExpiration(eventsExpiration);
+        return this;
+    }
+
     public RealmConfigBuilder roles(String... roleNames) {
         if (rep.getRoles() == null) {
             rep.setRoles(new RolesRepresentation());
         }
-        rep.getRoles().setRealm(Collections.combine(rep.getRoles().getRealm(), Arrays.stream(roleNames).map(Representations::toRole)));
+        rep.getRoles().setRealm(Collections.combine(
+                rep.getRoles().getRealm(),
+                Arrays.stream(roleNames).map(r -> Representations.toRole(r, false))
+        ));
+        return this;
+    }
+
+    public RealmConfigBuilder clientRoles(String client, String... clientRoles) {
+        if (rep.getRoles() == null) {
+            rep.setRoles(new RolesRepresentation());
+        }
+        rep.getRoles().setClient(Collections.combine(
+                rep.getRoles().getClient(),
+                client,
+                Arrays.stream(clientRoles).map(r -> Representations.toRole(r, true))
+        ));
         return this;
     }
 
@@ -93,6 +163,29 @@ public RealmConfigBuilder groups(String... groupsNames) {
         return this;
     }
 
+    public RealmConfigBuilder defaultGroups(String... groupsNames) {
+        rep.setDefaultGroups(Collections.combine(rep.getDefaultGroups(), groupsNames));
+        return this;
+    }
+
+    public RealmConfigBuilder internationalizationEnabled(boolean enabled) {
+        rep.setInternationalizationEnabled(enabled);
+        return this;
+    }
+
+    public RealmConfigBuilder supportedLocales(String... supportedLocales) {
+        if (rep.getSupportedLocales() == null) {
+            rep.setSupportedLocales(new HashSet<>());
+        }
+        rep.getSupportedLocales().addAll(Set.of(supportedLocales));
+        return this;
+    }
+
+    public RealmConfigBuilder defaultLocale(String locale) {
+        rep.setDefaultLocale(locale);
+        return this;
+    }
+
     public RealmConfigBuilder smtp(String host, int port, String from) {
         Map<String, String> config = new HashMap<>();
         config.put("host", host);
@@ -102,8 +195,53 @@ public RealmConfigBuilder smtp(String host, int port, String from) {
         return this;
     }
 
+    public RealmConfigBuilder organizationsEnabled(boolean organizationsEnabled) {
+        rep.setOrganizationsEnabled(organizationsEnabled);
+        return this;
+    }
+
+    public RealmConfigBuilder bruteForceProtected(boolean enabled) {
+        rep.setBruteForceProtected(enabled);
+        return this;
+    }
+
+    public RealmConfigBuilder failureFactor(int count) {
+        rep.setFailureFactor(count);
+        return this;
+    }
+
+    public RealmConfigBuilder duplicateEmailsAllowed(boolean duplicateEmailsAllowed) {
+        rep.setDuplicateEmailsAllowed(duplicateEmailsAllowed);
+        return this;
+    }
+
+    public RealmConfigBuilder sslRequired(String sslRequired) {
+        rep.setSslRequired(sslRequired);
+        return this;
+    }
+
+    /**
+     * Best practice is to use other convenience methods when configuring a realm, but while the framework is under
+     * active development there may not be a way to perform all updates required. In these cases this method allows
+     * applying any changes to the underlying representation.
+     *
+     * @param update
+     * @return this
+     * @deprecated
+     */
+    public RealmConfigBuilder update(RealmUpdate... update) {
+        Arrays.stream(update).forEach(u -> u.update(rep));
+        return this;
+    }
+
     public RealmRepresentation build() {
         return rep;
     }
 
+    public interface RealmUpdate {
+
+        void update(RealmRepresentation realm);
+
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmSupplier.java
index 4e54194766c8..e0cc863833d4 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/RealmSupplier.java
@@ -15,68 +15,55 @@
 
 public class RealmSupplier implements Supplier<ManagedRealm, InjectRealm> {
 
-    private static final String REALM_NAME_KEY = "realmName";
-
-    @Override
-    public Class<InjectRealm> getAnnotationClass() {
-        return InjectRealm.class;
-    }
-
-    @Override
-    public Class<ManagedRealm> getValueType() {
-        return ManagedRealm.class;
-    }
-
     @Override
     public ManagedRealm getValue(InstanceContext<ManagedRealm, InjectRealm> instanceContext) {
         KeycloakServer server = instanceContext.getDependency(KeycloakServer.class);
         Keycloak adminClient = instanceContext.getDependency(Keycloak.class, "bootstrap-client");
 
-        RealmConfig config = SupplierHelpers.getInstance(instanceContext.getAnnotation().config());
+        String attachTo = instanceContext.getAnnotation().attachTo();
+        boolean managed = attachTo.isEmpty();
 
-        RealmConfigBuilder realmConfigBuilder = config.configure(RealmConfigBuilder.create());
+        RealmRepresentation realmRepresentation;
 
-        RealmConfigInterceptorHelper interceptor = new RealmConfigInterceptorHelper(instanceContext.getRegistry());
-        realmConfigBuilder = interceptor.intercept(realmConfigBuilder, instanceContext);
+        if (managed) {
+            RealmConfig config = SupplierHelpers.getInstance(instanceContext.getAnnotation().config());
+            RealmConfigBuilder realmConfigBuilder = config.configure(RealmConfigBuilder.create());
 
-        RealmRepresentation realmRepresentation = realmConfigBuilder.build();
+            RealmConfigInterceptorHelper interceptor = new RealmConfigInterceptorHelper(instanceContext.getRegistry());
+            realmConfigBuilder = interceptor.intercept(realmConfigBuilder, instanceContext);
 
-        if (realmRepresentation.getRealm() == null) {
-            String realmName = SupplierHelpers.createName(instanceContext);
-            realmRepresentation.setRealm(realmName);
-        }
+            realmRepresentation = realmConfigBuilder.build();
 
-        if (realmRepresentation.getId() == null) {
-            realmRepresentation.setId(realmRepresentation.getRealm());
-        }
+            if (realmRepresentation.getRealm() == null) {
+                realmRepresentation.setRealm(SupplierHelpers.createName(instanceContext));
+            }
 
-        String realmName = realmRepresentation.getRealm();
-        instanceContext.addNote(REALM_NAME_KEY, realmName);
+            if (realmRepresentation.getId() == null) {
+                realmRepresentation.setId(realmRepresentation.getRealm());
+            }
 
-        if (instanceContext.getAnnotation().createRealm()) {
             adminClient.realms().create(realmRepresentation);
+
+            // TODO Token needs to be invalidated after creating realm to have roles for new realm in the token. Maybe lightweight access tokens could help.
+            adminClient.tokenManager().invalidate(adminClient.tokenManager().getAccessTokenString());
+        } else {
+            realmRepresentation = adminClient.realm(attachTo).toRepresentation();
         }
 
-        // TODO Token needs to be invalidated after creating realm to have roles for new realm in the token. Maybe lightweight access tokens could help.
-        adminClient.tokenManager().invalidate(adminClient.tokenManager().getAccessTokenString());
+        instanceContext.addNote("managed", managed);
 
         RealmResource realmResource = adminClient.realm(realmRepresentation.getRealm());
-        return new ManagedRealm(server.getBaseUrl() + "/realms/" + realmName, realmRepresentation, realmResource);
+        return new ManagedRealm(server.getBaseUrl() + "/realms/" + realmRepresentation.getRealm(), realmRepresentation, realmResource);
     }
 
     @Override
     public boolean compatible(InstanceContext<ManagedRealm, InjectRealm> a, RequestedInstance<ManagedRealm, InjectRealm> b) {
-        if (!a.getAnnotation().config().equals(b.getAnnotation().config())) {
-            return false;
-        }
-
-        RealmConfigInterceptorHelper interceptor = new RealmConfigInterceptorHelper(a.getRegistry());
-        return interceptor.sameInterceptors(a);
+        return a.getAnnotation().config().equals(b.getAnnotation().config());
     }
 
     @Override
     public void close(InstanceContext<ManagedRealm, InjectRealm> instanceContext) {
-        if (instanceContext.getAnnotation().createRealm()) {
+        if (instanceContext.getNote("managed", Boolean.class)) {
             instanceContext.getValue().admin().remove();
         }
     }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/Representations.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/Representations.java
index 8b6c32577008..b495fd6f1c17 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/Representations.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/Representations.java
@@ -9,9 +9,10 @@ class Representations {
     private Representations() {
     }
 
-    static RoleRepresentation toRole(String roleName) {
+    static RoleRepresentation toRole(String roleName, boolean asClientRole) {
         RoleRepresentation role = new RoleRepresentation();
         role.setName(roleName);
+        role.setClientRole(asClientRole);
         return role;
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserConfigBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserConfigBuilder.java
index 214921c4b6a1..a4cf4058db77 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserConfigBuilder.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserConfigBuilder.java
@@ -3,6 +3,7 @@
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
@@ -25,6 +26,11 @@ public static UserConfigBuilder update(UserRepresentation rep) {
         return new UserConfigBuilder(rep);
     }
 
+    public UserConfigBuilder id(String id) {
+        rep.setId(id);
+        return this;
+    }
+
     public UserConfigBuilder enabled(boolean enabled) {
         rep.setEnabled(enabled);
         return this;
@@ -77,8 +83,33 @@ public UserConfigBuilder groups(String... groups) {
         return this;
     }
 
+    public UserConfigBuilder attribute(String key, String... value) {
+        rep.setAttributes(Collections.combine(rep.getAttributes(), key, value));
+        return this;
+    }
+
+    /**
+     * Best practice is to use other convenience methods when configuring a user, but while the framework is under
+     * active development there may not be a way to perform all updates required. In these cases this method allows
+     * applying any changes to the underlying representation.
+     *
+     * @param update
+     * @return this
+     * @deprecated
+     */
+    public UserConfigBuilder update(UserUpdate... update) {
+        Arrays.stream(update).forEach(u -> u.update(rep));
+        return this;
+    }
+
     public UserRepresentation build() {
         return rep;
     }
 
+    public interface UserUpdate {
+
+        void update(UserRepresentation client);
+
+    }
+
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserSupplier.java
index 29579d0e592c..57795df0c34a 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/UserSupplier.java
@@ -1,5 +1,6 @@
 package org.keycloak.testframework.realm;
 
+import jakarta.ws.rs.NotFoundException;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
 import org.keycloak.admin.client.resource.UserResource;
@@ -15,16 +16,6 @@ public class UserSupplier implements Supplier<ManagedUser, InjectUser> {
 
     private static final String USER_UUID_KEY = "userUuid";
 
-    @Override
-    public Class<InjectUser> getAnnotationClass() {
-        return InjectUser.class;
-    }
-
-    @Override
-    public Class<ManagedUser> getValueType() {
-        return ManagedUser.class;
-    }
-
     @Override
     public ManagedUser getValue(InstanceContext<ManagedUser, InjectUser> instanceContext) {
         ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class, instanceContext.getAnnotation().realmRef());
@@ -59,7 +50,9 @@ public boolean compatible(InstanceContext<ManagedUser, InjectUser> a, RequestedI
 
     @Override
     public void close(InstanceContext<ManagedUser, InjectUser> instanceContext) {
-        instanceContext.getValue().admin().remove();
+        try {
+            instanceContext.getValue().admin().remove();
+        } catch (NotFoundException ex) {}
     }
 
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/AbstractKeycloakServerSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/AbstractKeycloakServerSupplier.java
index dbd450ed61ca..54770be428fb 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/AbstractKeycloakServerSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/AbstractKeycloakServerSupplier.java
@@ -15,24 +15,15 @@
 
 public abstract class AbstractKeycloakServerSupplier implements Supplier<KeycloakServer, KeycloakIntegrationTest> {
 
-    @Override
-    public Class<KeycloakServer> getValueType() {
-        return KeycloakServer.class;
-    }
-
-    @Override
-    public Class<KeycloakIntegrationTest> getAnnotationClass() {
-        return KeycloakIntegrationTest.class;
-    }
-
     @Override
     public KeycloakServer getValue(InstanceContext<KeycloakServer, KeycloakIntegrationTest> instanceContext) {
         KeycloakIntegrationTest annotation = instanceContext.getAnnotation();
         KeycloakServerConfig serverConfig = SupplierHelpers.getInstance(annotation.config());
 
         KeycloakServerConfigBuilder command = KeycloakServerConfigBuilder.startDev()
-                .cache("local")
-                .bootstrapAdminClient(Config.getAdminClientId(), Config.getAdminClientSecret());
+                .cache(cache())
+                .bootstrapAdminClient(Config.getAdminClientId(), Config.getAdminClientSecret())
+                .bootstrapAdminUser(Config.getAdminUsername(), Config.getAdminPassword());
 
         command.log().handlers(KeycloakServerConfigBuilder.LogHandlers.CONSOLE);
 
@@ -69,12 +60,7 @@ public LifeCycle getDefaultLifecycle() {
 
     @Override
     public boolean compatible(InstanceContext<KeycloakServer, KeycloakIntegrationTest> a, RequestedInstance<KeycloakServer, KeycloakIntegrationTest> b) {
-        if (!a.getAnnotation().config().equals(b.getAnnotation().config())) {
-            return false;
-        }
-
-        ServerConfigInterceptorHelper interceptor = new ServerConfigInterceptorHelper(a.getRegistry());
-        return interceptor.sameInterceptors(a);
+        return a.getAnnotation().config().equals(b.getAnnotation().config());
     }
 
     @Override
@@ -88,6 +74,10 @@ public void close(InstanceContext<KeycloakServer, KeycloakIntegrationTest> insta
 
     public abstract Logger getLogger();
 
+    protected String cache() {
+        return "local";
+    }
+
     @Override
     public int order() {
         return SupplierOrder.KEYCLOAK_SERVER;
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/DefaultServerConfigWithOid4Vci.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/DefaultServerConfigWithOid4Vci.java
new file mode 100644
index 000000000000..a883657b59e2
--- /dev/null
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/DefaultServerConfigWithOid4Vci.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.testframework.server;
+
+import org.keycloak.common.Profile;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class DefaultServerConfigWithOid4Vci extends DefaultKeycloakServerConfig {
+    @Override
+    public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+        return super.configure(config).features(Profile.Feature.OID4VC_VCI);
+    }
+}
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java
index 4a854812537d..19833e7c64a5 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServer.java
@@ -4,7 +4,9 @@
 import org.jboss.logging.Logger;
 import org.keycloak.it.utils.OutputConsumer;
 import org.keycloak.it.utils.RawKeycloakDistribution;
+import org.keycloak.testframework.config.Config;
 
+import java.nio.file.Path;
 import java.util.Collections;
 import java.util.List;
 import java.util.regex.Matcher;
@@ -12,7 +14,6 @@
 
 public class DistributionKeycloakServer implements KeycloakServer {
 
-    private static final boolean DEBUG = false;
     private static final boolean MANUAL_STOP = true;
     private static final boolean ENABLE_TLS = false;
     private static final boolean RE_CREATE = false;
@@ -21,14 +22,29 @@ public class DistributionKeycloakServer implements KeycloakServer {
 
     private RawKeycloakDistribution keycloak;
 
+    private final boolean debug;
+
+    public DistributionKeycloakServer(boolean debug) {
+        this.debug = debug;
+    }
+
     @Override
     public void start(KeycloakServerConfigBuilder keycloakServerConfigBuilder) {
-        keycloak = new RawKeycloakDistribution(DEBUG, MANUAL_STOP, ENABLE_TLS, RE_CREATE, REMOVE_BUILD_OPTIONS_AFTER_BUILD, REQUEST_PORT, new LoggingOutputConsumer());
+        keycloak = new RawKeycloakDistribution(false, MANUAL_STOP, ENABLE_TLS, RE_CREATE, REMOVE_BUILD_OPTIONS_AFTER_BUILD, REQUEST_PORT, new LoggingOutputConsumer());
+
+        // RawKeycloakDistribution sets "DEBUG_SUSPEND", not "DEBUG" when debug is passed to constructor
+        if (debug) {
+            keycloak.setEnvVar("DEBUG", "true");
+        }
 
         for (Dependency dependency : keycloakServerConfigBuilder.toDependencies()) {
             keycloak.copyProvider(dependency.getGroupId(), dependency.getArtifactId());
         }
 
+        for (Path configFile : keycloakServerConfigBuilder.toConfigFiles()) {
+            keycloak.copyConfigFile(configFile);
+        }
+
         keycloak.run(keycloakServerConfigBuilder.toArgs());
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServerSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServerSupplier.java
index 56d9647ef1b1..bbfae700698e 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServerSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/DistributionKeycloakServerSupplier.java
@@ -1,14 +1,18 @@
 package org.keycloak.testframework.server;
 
+import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.jboss.logging.Logger;
 
 public class DistributionKeycloakServerSupplier extends AbstractKeycloakServerSupplier {
 
     private static final Logger LOGGER = Logger.getLogger(DistributionKeycloakServerSupplier.class);
 
+    @ConfigProperty(name = "debug", defaultValue = "false")
+    boolean debug = false;
+
     @Override
     public KeycloakServer getServer() {
-        return new DistributionKeycloakServer();
+        return new DistributionKeycloakServer(debug);
     }
 
     @Override
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/EmbeddedKeycloakServer.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/EmbeddedKeycloakServer.java
index e68345d9fb82..354af820932f 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/EmbeddedKeycloakServer.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/EmbeddedKeycloakServer.java
@@ -3,12 +3,18 @@
 import io.quarkus.maven.dependency.Dependency;
 import org.keycloak.Keycloak;
 import org.keycloak.common.Version;
+import org.keycloak.platform.Platform;
 
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Set;
 import java.util.concurrent.TimeoutException;
 
 public class EmbeddedKeycloakServer implements KeycloakServer {
 
     private Keycloak keycloak;
+    private Path homeDir;
 
     @Override
     public void start(KeycloakServerConfigBuilder keycloakServerConfigBuilder) {
@@ -18,6 +24,29 @@ public void start(KeycloakServerConfigBuilder keycloakServerConfigBuilder) {
             builder.addDependency(dependency.getGroupId(), dependency.getArtifactId(), "");
         }
 
+        Set<Path> configFiles = keycloakServerConfigBuilder.toConfigFiles();
+        if (!configFiles.isEmpty()) {
+            if (homeDir == null) {
+                homeDir = Platform.getPlatform().getTmpDirectory().toPath();
+            }
+
+            Path conf = homeDir.resolve("conf");
+
+            if (!conf.toFile().exists()) {
+                conf.toFile().mkdirs();
+            }
+
+            for (Path configFile : configFiles) {
+                try {
+                    Files.copy(configFile, conf.resolve(configFile.getFileName()));
+                } catch (IOException e) {
+                    throw new RuntimeException(e);
+                }
+            }
+
+        }
+
+        builder.setHomeDir(homeDir);
         keycloak = builder.start(keycloakServerConfigBuilder.toArgs());
     }
 
@@ -37,6 +66,6 @@ public String getBaseUrl() {
 
     @Override
     public String getManagementBaseUrl() {
-        return "http://localhost:9000";
+        return "http://localhost:9001";
     }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakServerConfigBuilder.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakServerConfigBuilder.java
index d16e3d2ad994..4b6d7ff4b834 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakServerConfigBuilder.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakServerConfigBuilder.java
@@ -5,13 +5,18 @@
 import io.smallrye.config.SmallRyeConfig;
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.keycloak.common.Profile;
+import org.keycloak.common.Profile.Feature;
 
+import java.net.URISyntaxException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
 
@@ -23,6 +28,7 @@ public class KeycloakServerConfigBuilder {
     private final Set<String> featuresDisabled = new HashSet<>();
     private final LogBuilder log = new LogBuilder();
     private final Set<Dependency> dependencies = new HashSet<>();
+    private final Set<Path> configFiles = new HashSet<>();
 
     private KeycloakServerConfigBuilder(String command) {
         this.command = command;
@@ -37,6 +43,11 @@ public KeycloakServerConfigBuilder bootstrapAdminClient(String clientId, String
                 .option("bootstrap-admin-client-secret", clientSecret);
     }
 
+    public KeycloakServerConfigBuilder bootstrapAdminUser(String username, String password) {
+        return option("bootstrap-admin-username", username)
+                .option("bootstrap-admin-password", password);
+    }
+
     public KeycloakServerConfigBuilder cache(String cache) {
         return option("cache", cache);
     }
@@ -70,6 +81,18 @@ public KeycloakServerConfigBuilder dependency(String groupId, String artifactId)
         return this;
     }
 
+    public KeycloakServerConfigBuilder cacheConfigFile(String resourcePath) {
+        try {
+            Path p = Paths.get(Objects.requireNonNull(getClass().getResource(resourcePath)).toURI());
+            configFiles.add(p);
+            option("cache-config-file", p.getFileName().toString());
+        } catch (URISyntaxException e) {
+            throw new RuntimeException(e);
+        }
+
+        return this;
+    }
+
     public class LogBuilder {
 
         private Boolean color;
@@ -147,22 +170,12 @@ private void build() {
                 option("log-console-format", format);
             }
 
-            StringBuilder logLevel = new StringBuilder();
             if (rootLevel != null) {
-                logLevel.append(rootLevel);
+                option("log-level", rootLevel);
             }
 
             for (Map.Entry<String, String> e : categoryLevels.entrySet()) {
-                if (!logLevel.isEmpty()) {
-                    logLevel.append(",");
-                }
-                logLevel.append(e.getKey());
-                logLevel.append(":");
-                logLevel.append(e.getValue());
-            }
-
-            if (!logLevel.isEmpty()) {
-                option("log-level", logLevel.toString());
+                option("log-level-" + e.getKey(), e.getValue());
             }
 
             if (color != null) {
@@ -171,7 +184,7 @@ private void build() {
         }
     }
 
-    public List<String> toArgs() {
+    List<String> toArgs() {
         log.build();
 
         List<String> args = new LinkedList<>();
@@ -189,13 +202,17 @@ public List<String> toArgs() {
         return args;
     }
 
-    public Set<Dependency> toDependencies() {
+    Set<Dependency> toDependencies() {
         return dependencies;
     }
 
+    Set<Path> toConfigFiles() {
+        return configFiles;
+    }
+
     private Set<String> toFeatureStrings(Profile.Feature... features) {
         return Arrays.stream(features).map(f -> {
-            if (f.getVersion() > 1) {
+            if (Profile.getFeatureVersions(f.getKey()).size() > 1) {
                 return f.getVersionedKey();
             }
             return f.name().toLowerCase().replace('_', '-');
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrls.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrls.java
index 7dc0b128b3e5..8b3258e1424c 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrls.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrls.java
@@ -1,6 +1,7 @@
 package org.keycloak.testframework.server;
 
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 
 import java.net.MalformedURLException;
 import java.net.URL;
@@ -39,6 +40,10 @@ public URL getAdminUrl() {
         return toUrl(getAdmin());
     }
 
+    public KeycloakUriBuilder getBaseBuilder() {
+        return toBuilder(getBase());
+    }
+
     public KeycloakUriBuilder getAdminBuilder() {
         return toBuilder(getAdmin());
     }
@@ -59,4 +64,7 @@ private KeycloakUriBuilder toBuilder(String url) {
         return KeycloakUriBuilder.fromUri(url);
     }
 
+    public String getToken(String realm) {
+        return baseUrl + "/realms/" + realm + "/protocol/" + OIDCLoginProtocol.LOGIN_PROTOCOL + "/token";
+    }
 }
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrlsSupplier.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrlsSupplier.java
index 74d4b89fc7f1..04bcbabe36dd 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrlsSupplier.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/KeycloakUrlsSupplier.java
@@ -7,16 +7,6 @@
 
 public class KeycloakUrlsSupplier implements Supplier<KeycloakUrls, InjectKeycloakUrls> {
 
-    @Override
-    public Class<InjectKeycloakUrls> getAnnotationClass() {
-        return InjectKeycloakUrls.class;
-    }
-
-    @Override
-    public Class<KeycloakUrls> getValueType() {
-        return KeycloakUrls.class;
-    }
-
     @Override
     public KeycloakUrls getValue(InstanceContext<KeycloakUrls, InjectKeycloakUrls> instanceContext) {
         KeycloakServer server = instanceContext.getDependency(KeycloakServer.class);
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/server/RemoteKeycloakServer.java b/test-framework/core/src/main/java/org/keycloak/testframework/server/RemoteKeycloakServer.java
index 8e7dd72130a5..8d3d9fd6eab5 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/server/RemoteKeycloakServer.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/server/RemoteKeycloakServer.java
@@ -4,6 +4,7 @@
 
 import java.net.ConnectException;
 import java.net.URL;
+import java.nio.file.Path;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
 
@@ -52,6 +53,14 @@ private void printStartupInstructions(KeycloakServerConfigBuilder keycloakServer
                 sb.append("\n");
             }
         }
+        Set<Path> configFiles = keycloakServerConfigBuilder.toConfigFiles();
+        if (!configFiles.isEmpty()) {
+            sb.append("Copy following config files to your conf directory:\n");
+            for (Path c : configFiles) {
+                sb.append(c.toAbsolutePath());
+                sb.append("\n");
+            }
+        }
         System.out.println(sb);
     }
 
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/util/ApiUtil.java b/test-framework/core/src/main/java/org/keycloak/testframework/util/ApiUtil.java
index 8c6f065e23bf..6c1fed837a58 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/util/ApiUtil.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/util/ApiUtil.java
@@ -6,11 +6,21 @@
 public class ApiUtil {
 
     public static String handleCreatedResponse(Response response) {
+        try (response) {
+            if (response.getStatus() != Response.Status.CONFLICT.getStatusCode()) {
+                String uuid = getCreatedId(response);
+                response.close();
+                return uuid;
+            } else {
+                return null;
+            }
+        }
+    }
+
+    public static String getCreatedId(Response response) {
         Assertions.assertEquals(201, response.getStatus());
         String path = response.getLocation().getPath();
-        String uuid = path.substring(path.lastIndexOf('/') + 1);
-        response.close();
-        return uuid;
+        return path.substring(path.lastIndexOf('/') + 1);
     }
 
 }
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/events/AdminEventAssertionTest.java b/test-framework/core/src/test/java/org/keycloak/testframework/events/AdminEventAssertionTest.java
new file mode 100644
index 000000000000..2573dafbf99b
--- /dev/null
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/events/AdminEventAssertionTest.java
@@ -0,0 +1,61 @@
+package org.keycloak.testframework.events;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.UUID;
+
+public class AdminEventAssertionTest {
+
+    @Test
+    public void testSuccess() {
+        AdminEventAssertion.assertSuccess(createEvent("CREATE"));
+        Assertions.assertThrows(AssertionError.class, () -> AdminEventAssertion.assertSuccess(createEvent("CREATE_ERROR")));
+        Assertions.assertThrows(AssertionError.class, () -> AdminEventAssertion.assertSuccess(createEvent("INVALID")));
+    }
+
+    @Test
+    public void testError() {
+        AdminEventAssertion.assertError(createEvent("CREATE_ERROR"));
+        Assertions.assertThrows(AssertionError.class, () -> AdminEventAssertion.assertError(createEvent("CREATE")));
+        Assertions.assertThrows(AssertionError.class, () -> AdminEventAssertion.assertError(createEvent("INVALID_ERROR")));
+    }
+
+    @Test
+    public void assertRepresentation() throws IOException {
+        UserRepresentation user = createUser("username", List.of("group-1", "group-2"));
+
+        AdminEventRepresentation event = createEvent("CREATE");
+        event.setRepresentation(JsonSerialization.writeValueAsString(user));
+
+        AdminEventAssertion.assertSuccess(event).representation(user);
+
+        Assertions.assertThrows(AssertionError.class, () ->
+                AdminEventAssertion.assertSuccess(event).representation(createUser("username2", List.of("group-1", "group-2")))
+        );
+        Assertions.assertThrows(AssertionError.class, () ->
+                AdminEventAssertion.assertSuccess(event).representation(createUser("username", List.of("group-1", "group-3")))
+        );
+    }
+
+    private AdminEventRepresentation createEvent(String operation) {
+        AdminEventRepresentation rep = new AdminEventRepresentation();
+        rep.setId(UUID.randomUUID().toString());
+        rep.setOperationType(operation);
+        return rep;
+    }
+
+    private UserRepresentation createUser(String username, List<String> groups) {
+        UserRepresentation user = new UserRepresentation();
+        user.setEnabled(true);
+        user.setUsername(username);
+        user.setGroups(groups);
+        return user;
+    }
+
+}
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/injection/RegistryTest.java b/test-framework/core/src/test/java/org/keycloak/testframework/injection/RegistryTest.java
index 66c8574803e0..313e4f123701 100644
--- a/test-framework/core/src/test/java/org/keycloak/testframework/injection/RegistryTest.java
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/injection/RegistryTest.java
@@ -248,6 +248,54 @@ public void testRealmRef() {
         Assertions.assertSame(test.child123.getParent(), test.parent123);
     }
 
+    @Test
+    public void testConfigurableSupplier() {
+        ParentTest parentTest = new ParentTest();
+        registry.beforeEach(parentTest);
+
+        Assertions.assertNull(parentTest.parent.getStringOption());
+        Assertions.assertTrue(parentTest.parent.isBooleanOption());
+
+        System.setProperty("kc.test.MockParentValue.string", "some string");
+        System.setProperty("kc.test.MockParentValue.boolean", "false");
+
+        try {
+            Config.initConfig();
+            registry = new Registry();
+            parentTest = new ParentTest();
+            registry.beforeEach(parentTest);
+
+            Assertions.assertEquals("some string", parentTest.parent.getStringOption());
+            Assertions.assertFalse(parentTest.parent.isBooleanOption());
+        } finally {
+            System.getProperties().remove("kc.test.MockParentValue.string");
+            System.getProperties().remove("kc.test.MockParentValue.boolean");
+            Config.initConfig();
+        }
+    }
+
+    @Test
+    public void testIncompatibleParent() {
+        MockParentSupplier.COMPATIBLE = false;
+        RealmIncompatibleParentTest test = new RealmIncompatibleParentTest();
+        registry.beforeEach(test);
+
+        MockParentValue parent1 = test.parent;
+        MockChildValue child1 = test.child;
+
+        Assertions.assertNotNull(test.parent);
+        Assertions.assertNotNull(test.child);
+
+        registry.afterEach();
+
+        registry.beforeEach(test);
+
+        Assertions.assertNotNull(test.parent);
+        Assertions.assertNotEquals(parent1, test.parent);
+        Assertions.assertNotNull(test.child);
+        Assertions.assertNotEquals(child1, test.child);
+    }
+
     public static void assertRunning(Object... values) {
         MatcherAssert.assertThat(MockInstances.INSTANCES, Matchers.hasItems(values));
         MatcherAssert.assertThat(MockInstances.INSTANCES, Matchers.hasSize(values.length));
@@ -308,4 +356,15 @@ public static final class RealmRefTest {
         @MockChildAnnotation(ref = "ABC", parentRef = "ABC")
         MockChildValue childABC;
     }
+
+    public static final class RealmIncompatibleParentTest {
+
+        @MockChildAnnotation
+        MockChildValue child;
+
+        @MockParentAnnotation
+        MockParentValue parent;
+
+    }
+
 }
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockChildSupplier.java b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockChildSupplier.java
index cb1b0c80826a..ccf2d4c7a4be 100644
--- a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockChildSupplier.java
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockChildSupplier.java
@@ -13,16 +13,6 @@ public static void reset() {
         DEFAULT_LIFECYCLE = LifeCycle.CLASS;
     }
 
-    @Override
-    public Class<MockChildAnnotation> getAnnotationClass() {
-        return MockChildAnnotation.class;
-    }
-
-    @Override
-    public Class<MockChildValue> getValueType() {
-        return MockChildValue.class;
-    }
-
     @Override
     public MockChildValue getValue(InstanceContext<MockChildValue, MockChildAnnotation> instanceContext) {
         MockParentValue mockParentValue = instanceContext.getDependency(MockParentValue.class, instanceContext.getAnnotation().parentRef());
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParent2Supplier.java b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParent2Supplier.java
index 081dd70fac23..de85cdd41746 100644
--- a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParent2Supplier.java
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParent2Supplier.java
@@ -13,19 +13,9 @@ public static void reset() {
         DEFAULT_LIFECYCLE = LifeCycle.CLASS;
     }
 
-    @Override
-    public Class<MockParentAnnotation> getAnnotationClass() {
-        return MockParentAnnotation.class;
-    }
-
-    @Override
-    public Class<MockParentValue> getValueType() {
-        return MockParentValue.class;
-    }
-
     @Override
     public MockParentValue getValue(InstanceContext<MockParentValue, MockParentAnnotation> instanceContext) {
-        return new MockParentValue();
+        return new MockParentValue(null, false);
     }
 
     @Override
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentSupplier.java b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentSupplier.java
index 46a0a824e722..85fd26212605 100644
--- a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentSupplier.java
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentSupplier.java
@@ -1,5 +1,6 @@
 package org.keycloak.testframework.injection.mocks;
 
+import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.keycloak.testframework.injection.InstanceContext;
 import org.keycloak.testframework.injection.LifeCycle;
 import org.keycloak.testframework.injection.RequestedInstance;
@@ -7,6 +8,12 @@
 
 public class MockParentSupplier implements Supplier<MockParentValue, MockParentAnnotation> {
 
+    @ConfigProperty(name = "string")
+    String configString;
+
+    @ConfigProperty(name = "boolean", defaultValue = "true")
+    boolean configBoolean;
+
     public static LifeCycle DEFAULT_LIFECYCLE = LifeCycle.CLASS;
     public static boolean COMPATIBLE = true;
 
@@ -15,19 +22,9 @@ public static void reset() {
         COMPATIBLE = true;
     }
 
-    @Override
-    public Class<MockParentAnnotation> getAnnotationClass() {
-        return MockParentAnnotation.class;
-    }
-
-    @Override
-    public Class<MockParentValue> getValueType() {
-        return MockParentValue.class;
-    }
-
     @Override
     public MockParentValue getValue(InstanceContext<MockParentValue, MockParentAnnotation> instanceContext) {
-        return new MockParentValue();
+        return new MockParentValue(configString, configBoolean);
     }
 
     @Override
diff --git a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentValue.java b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentValue.java
index 334ede90a0da..fc2f4989c04e 100644
--- a/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentValue.java
+++ b/test-framework/core/src/test/java/org/keycloak/testframework/injection/mocks/MockParentValue.java
@@ -2,12 +2,24 @@
 
 public class MockParentValue {
 
+    private final String stringOption;
+    private final boolean booleanOption;
     private boolean closed = false;
 
-    public MockParentValue() {
+    public MockParentValue(String stringOption, boolean booleanOption) {
+        this.stringOption = stringOption;
+        this.booleanOption = booleanOption;
         MockInstances.INSTANCES.add(this);
     }
 
+    public String getStringOption() {
+        return stringOption;
+    }
+
+    public boolean isBooleanOption() {
+        return booleanOption;
+    }
+
     public boolean isClosed() {
         return closed;
     }
diff --git a/test-framework/db-mariadb/src/main/java/org/keycloak/testframework/database/MariaDBTestDatabase.java b/test-framework/db-mariadb/src/main/java/org/keycloak/testframework/database/MariaDBTestDatabase.java
index 48856ce376e9..481131d4a641 100644
--- a/test-framework/db-mariadb/src/main/java/org/keycloak/testframework/database/MariaDBTestDatabase.java
+++ b/test-framework/db-mariadb/src/main/java/org/keycloak/testframework/database/MariaDBTestDatabase.java
@@ -13,7 +13,7 @@ class MariaDBTestDatabase extends AbstractContainerTestDatabase {
 
     @Override
     public JdbcDatabaseContainer<?> createContainer() {
-        return new MariaDBContainer<>(DockerImageName.parse(DatabaseProperties.getContainerImageName(NAME)).asCompatibleSubstituteFor(NAME));
+        return new MariaDBContainer<>(DockerImageName.parse(DatabaseProperties.getContainerImageName(NAME)).asCompatibleSubstituteFor(NAME)).withCommand("--character-set-server=utf8 --collation-server=utf8_unicode_ci");
     }
 
     @Override
diff --git a/test-framework/db-mssql/src/main/java/org/keycloak/testframework/database/MSSQLServerTestDatabase.java b/test-framework/db-mssql/src/main/java/org/keycloak/testframework/database/MSSQLServerTestDatabase.java
index 65a64419666a..97e86679ad14 100644
--- a/test-framework/db-mssql/src/main/java/org/keycloak/testframework/database/MSSQLServerTestDatabase.java
+++ b/test-framework/db-mssql/src/main/java/org/keycloak/testframework/database/MSSQLServerTestDatabase.java
@@ -38,6 +38,11 @@ public String getPassword() {
         return "vEry$tron9Pwd";
     }
 
+    @Override
+    public String getJdbcUrl(boolean internal) {
+        return super.getJdbcUrl(internal) + ";integratedSecurity=false;encrypt=false;trustServerCertificate=true;sendStringParametersAsUnicode=false;";
+    }
+
     @Override
     public List<String> getPostStartCommand() {
         return List.of("/opt/mssql-tools18/bin/sqlcmd", "-U", "sa", "-P", getPassword(), "-No", "-Q", "CREATE DATABASE " + getDatabase());
diff --git a/test-framework/db-mysql/src/main/java/org/keycloak/testframework/database/MySQLTestDatabase.java b/test-framework/db-mysql/src/main/java/org/keycloak/testframework/database/MySQLTestDatabase.java
index e8db493ba08e..2402d8f4c8ef 100644
--- a/test-framework/db-mysql/src/main/java/org/keycloak/testframework/database/MySQLTestDatabase.java
+++ b/test-framework/db-mysql/src/main/java/org/keycloak/testframework/database/MySQLTestDatabase.java
@@ -21,6 +21,11 @@ public String getDatabaseVendor() {
         return NAME;
     }
 
+    @Override
+    public String getJdbcUrl(boolean internal) {
+        return super.getJdbcUrl(internal) + "?allowPublicKeyRetrieval=true";
+    }
+
     @Override
     public Logger getLogger() {
         return LOGGER;
diff --git a/test-framework/db-oracle/pom.xml b/test-framework/db-oracle/pom.xml
index dc32995efb1c..5a22e90d3464 100755
--- a/test-framework/db-oracle/pom.xml
+++ b/test-framework/db-oracle/pom.xml
@@ -43,7 +43,7 @@
         </dependency>
         <dependency>
             <groupId>com.oracle.database.jdbc</groupId>
-            <artifactId>ojdbc11</artifactId>
+            <artifactId>ojdbc17</artifactId>
         </dependency>
     </dependencies>
 </project>
diff --git a/test-framework/db-oracle/src/main/java/org/keycloak/testframework/database/OracleDatabaseSupplier.java b/test-framework/db-oracle/src/main/java/org/keycloak/testframework/database/OracleDatabaseSupplier.java
index 4429d2846926..2525ff861004 100644
--- a/test-framework/db-oracle/src/main/java/org/keycloak/testframework/database/OracleDatabaseSupplier.java
+++ b/test-framework/db-oracle/src/main/java/org/keycloak/testframework/database/OracleDatabaseSupplier.java
@@ -19,6 +19,6 @@ TestDatabase getTestDatabase() {
     @Override
     public KeycloakServerConfigBuilder intercept(KeycloakServerConfigBuilder serverConfig, InstanceContext<TestDatabase, InjectTestDatabase> instanceContext) {
         return super.intercept(serverConfig, instanceContext)
-                .dependency("com.oracle.database.jdbc", "ojdbc11");
+                .dependency("com.oracle.database.jdbc", "ojdbc17");
     }
 }
diff --git a/test-framework/email-server/pom.xml b/test-framework/email-server/pom.xml
index 40b18a112589..d9c622f9424c 100755
--- a/test-framework/email-server/pom.xml
+++ b/test-framework/email-server/pom.xml
@@ -32,7 +32,7 @@
     <description>Email server extension for Keycloak Test Framework</description>
 
     <properties>
-        <greenmail.version>2.1.1</greenmail.version>
+        <greenmail.version>2.1.3</greenmail.version>
     </properties>
 
     <dependencies>
diff --git a/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/GreenMailSupplier.java b/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/GreenMailSupplier.java
index b7433ee46136..3787c681b421 100644
--- a/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/GreenMailSupplier.java
+++ b/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/GreenMailSupplier.java
@@ -14,16 +14,6 @@ public class GreenMailSupplier implements Supplier<MailServer, InjectMailServer>
     private final int PORT = 3025;
     private final String FROM = "auto@keycloak.org";
 
-    @Override
-    public Class<InjectMailServer> getAnnotationClass() {
-        return InjectMailServer.class;
-    }
-
-    @Override
-    public Class<MailServer> getValueType() {
-        return MailServer.class;
-    }
-
     @Override
     public MailServer getValue(InstanceContext<MailServer, InjectMailServer> instanceContext) {
         return new MailServer(HOSTNAME, PORT);
diff --git a/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/MailServer.java b/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/MailServer.java
index 0f4983733f67..76dae5661af7 100644
--- a/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/MailServer.java
+++ b/test-framework/email-server/src/main/java/org/keycloak/testframework/mail/MailServer.java
@@ -1,6 +1,8 @@
 package org.keycloak.testframework.mail;
 
 import com.icegreen.greenmail.store.FolderException;
+import com.icegreen.greenmail.user.GreenMailUser;
+import com.icegreen.greenmail.user.TokenValidator;
 import com.icegreen.greenmail.util.GreenMail;
 import com.icegreen.greenmail.util.ServerSetup;
 import jakarta.mail.internet.MimeMessage;
@@ -21,6 +23,17 @@ public void stop() {
         greenMail.stop();
     }
 
+    public void credentials(String username, String password) {
+        greenMail.setUser(username, password);
+    }
+
+    public void credentials(String username, TokenValidator validator) {
+        greenMail.setUser(username, null);
+        GreenMailUser user = greenMail.getUserManager().getUser(username);
+        // greenmail refactoring required, see https://github.com/greenmail-mail-test/greenmail/pull/838
+        ((com.icegreen.greenmail.user.UserImpl)user).setTokenValidator(validator);
+    }
+
     public MimeMessage[] getReceivedMessages() {
         return greenMail.getReceivedMessages();
     }
diff --git a/test-framework/examples/tests/pom.xml b/test-framework/examples/tests/pom.xml
index 44a50b4a100e..a136ef7f3c8c 100644
--- a/test-framework/examples/tests/pom.xml
+++ b/test-framework/examples/tests/pom.xml
@@ -48,6 +48,10 @@
             <groupId>org.keycloak.testframework</groupId>
             <artifactId>keycloak-test-framework-core</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-junit5-config</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak.testframework</groupId>
             <artifactId>keycloak-test-framework-db-mariadb</artifactId>
@@ -70,7 +74,7 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak.testframework</groupId>
-            <artifactId>keycloak-test-framework-oauth-nimbus-poc</artifactId>
+            <artifactId>keycloak-test-framework-oauth</artifactId>
         </dependency>
         <dependency>
             <groupId>org.keycloak.testframework</groupId>
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminClientFactoryTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminClientFactoryTest.java
new file mode 100644
index 000000000000..c185d04f7f42
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminClientFactoryTest.java
@@ -0,0 +1,48 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.testframework.admin.AdminClientBuilder;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+@KeycloakIntegrationTest
+public class AdminClientFactoryTest {
+
+    @InjectRealm(config = RealmSpecificAdminClientTest.RealmWithClientAndUser.class)
+    ManagedRealm realm;
+
+    @InjectAdminClientFactory(lifecycle = LifeCycle.METHOD)
+    AdminClientFactory adminClientFactory;
+
+    static Keycloak AUTO_CLOSE_INSTANCE;
+
+    @AfterAll
+    public static void checkClosed() {
+        Assertions.assertThrows(IllegalStateException.class, () -> AUTO_CLOSE_INSTANCE.realms().findAll());
+    }
+
+    @Test
+    public void testAdminClientFactory() {
+        try (Keycloak keycloak = createBuilder().build()) {
+            Assertions.assertNotNull(keycloak.realm(realm.getName()).toRepresentation());
+        }
+        AUTO_CLOSE_INSTANCE = createBuilder().autoClose().build();
+    }
+
+    private AdminClientBuilder createBuilder() {
+        return adminClientFactory.create()
+                .realm(realm.getName())
+                .clientId("myclient")
+                .clientSecret("mysecret")
+                .username("myadmin")
+                .password("mypassword");
+    }
+
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminEventsTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminEventsTest.java
index 44d7e05e7033..3344cffb65df 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminEventsTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AdminEventsTest.java
@@ -4,66 +4,120 @@
 import org.junit.jupiter.api.Test;
 import org.keycloak.admin.client.Keycloak;
 import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testframework.annotations.InjectAdminClient;
 import org.keycloak.testframework.annotations.InjectAdminEvents;
 import org.keycloak.testframework.annotations.InjectRealm;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
 import org.keycloak.testframework.events.AdminEvents;
 import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.util.ApiUtil;
+
+import java.util.LinkedList;
+import java.util.List;
 
 @KeycloakIntegrationTest
 public class AdminEventsTest {
 
+    @InjectRealm
+    private ManagedRealm realm;
+
     @InjectAdminEvents
     private AdminEvents adminEvents;
 
+    @InjectRealm(ref = "master", attachTo = "master")
+    private ManagedRealm master;
+
+    @InjectAdminEvents(ref = "master", realmRef = "master")
+    private AdminEvents masterAdminEvents;
+
     @InjectAdminClient
     private Keycloak adminClient;
 
-    @InjectRealm
-    private ManagedRealm realm;
-
     @Test
     public void testAdminEventOnUserCreateAndDelete() {
-
         String userName = "create_user";
 
         UserRepresentation userRep = new UserRepresentation();
         userRep.setUsername(userName);
         userRep.setEnabled(true);
 
-        adminClient.realm(realm.getName()).users().create(userRep);
-
-        Assertions.assertEquals(OperationType.CREATE, adminEvents.poll().getOperationType());
+        String userId = ApiUtil.handleCreatedResponse(adminClient.realm(realm.getName()).users().create(userRep));
 
-        String userId = adminClient.realm(realm.getName()).users().search(userName).get(0).getId();
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourceType(ResourceType.USER)
+                .resourcePath("users", userId)
+                .representation(userRep);
 
         adminClient.realm(realm.getName()).users().delete(userId);
 
-        Assertions.assertEquals(OperationType.DELETE, adminEvents.poll().getOperationType());
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.DELETE)
+                .resourceType(ResourceType.USER)
+                .resourcePath("users", userId)
+                .representation(null);
     }
 
     @Test
     public void testAdminEventOnRealmCreateAndUpdate() {
+        master.updateWithCleanup(r -> r.adminEventsEnabled(true));
 
-        String realmName = "create_realm";
+        String realmName = "testAdminEventOnRealmCreateAndUpdate";
 
         RealmRepresentation realmRep = new RealmRepresentation();
         realmRep.setRealm(realmName);
         realmRep.setEnabled(true);
+        realmRep.setAdminEventsEnabled(true);
+
+        try {
+            adminClient.realms().create(realmRep);
+            Assertions.assertEquals(OperationType.CREATE.name(), masterAdminEvents.poll().getOperationType());
+        } finally {
+            adminClient.realm(realmName).remove();
+        }
+    }
 
-        adminClient.realms().create(realmRep);
+    @Test
+    public void testAdminEventOnRealmUpdate() {
+        realm.updateWithCleanup(r -> r.editUsernameAllowed(true));
 
-        Assertions.assertEquals(OperationType.CREATE, adminEvents.poll().getOperationType());
+        Assertions.assertEquals(OperationType.UPDATE.name(), adminEvents.poll().getOperationType());
+    }
+
+    @Test
+    public void testSkipEvent() {
+        List<String> userIds = createUsers("testSkipEvent", 2);
+        adminEvents.skip();
+        AdminEventAssertion.assertSuccess(adminEvents.poll()).resourcePath("users", userIds.get(1));
+    }
 
-        RealmRepresentation realmRep2 = adminClient.realms().realm(realmName).toRepresentation();
-        realmRep2.setEnabled(false);
+    @Test
+    public void testSkipEvents() {
+        List<String> userIds = createUsers("testSkipEvents", 4);
+        adminEvents.skip(3);
+        AdminEventAssertion.assertSuccess(adminEvents.poll()).resourcePath("users", userIds.get(3));
+    }
 
-        adminClient.realms().realm(realmName).update(realmRep2);
+    @Test
+    public void testSkipAlLEvents() {
+        createUsers("testSkipAlLEventsBefore", 3);
+        adminEvents.skipAll();
+        List<String> userIds = createUsers("testSkipAlLEventsAfter", 1);
+        AdminEventAssertion.assertSuccess(adminEvents.poll()).resourcePath("users", userIds.get(0));
+    }
 
-        Assertions.assertEquals(OperationType.UPDATE, adminEvents.poll().getOperationType());
+    private List<String> createUsers(String prefix, int n) {
+        List<String> userIds = new LinkedList<>();
+        for (int i = 0; i < n; i++) {
+            String userId = ApiUtil.handleCreatedResponse(realm.admin().users().create(UserConfigBuilder.create().username(prefix + i).build()));
+            userIds.add(userId);
+        }
+        return userIds;
     }
 
 }
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AttachToTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AttachToTest.java
new file mode 100644
index 000000000000..bc6a77a6e167
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/AttachToTest.java
@@ -0,0 +1,59 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+@KeycloakIntegrationTest
+@TestMethodOrder(MethodOrderer.MethodName.class)
+public class AttachToTest {
+
+    @InjectAdminClient
+    Keycloak adminClient;
+
+    @InjectRealm(attachTo = "master")
+    ManagedRealm attachedRealm;
+
+    @InjectClient
+    ManagedClient managedClient;
+
+    @InjectClient(ref = "admin-cli", attachTo = "admin-cli")
+    ManagedClient attachedClient;
+
+    @Test
+    public void aAttachedRealm() {
+        Assertions.assertEquals("master", attachedRealm.getName());
+        Assertions.assertEquals("master", attachedRealm.admin().toRepresentation().getRealm());
+        attachedRealm.updateWithCleanup(r -> r.editUsernameAllowed(true));
+    }
+
+    @Test
+    public void bRealmCleanup() {
+        Assertions.assertFalse(attachedRealm.admin().toRepresentation().isEditUsernameAllowed());
+    }
+
+    @Test
+    public void cManagedClient() {
+        Assertions.assertEquals("default", adminClient.realm("master").clients().get(managedClient.getId()).toRepresentation().getClientId());
+    }
+
+    @Test
+    public void dAttachedClient() {
+        Assertions.assertEquals("admin-cli", attachedClient.getClientId());
+        Assertions.assertEquals("admin-cli", attachedClient.admin().toRepresentation().getClientId());
+    }
+
+    @Test
+    public void eManagedClient() {
+        Assertions.assertEquals("default", managedClient.getClientId());
+        Assertions.assertEquals("default", managedClient.admin().toRepresentation().getClientId());
+    }
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/ClientRollbackTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/ClientRollbackTest.java
new file mode 100644
index 000000000000..3bef7a16204e
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/ClientRollbackTest.java
@@ -0,0 +1,50 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+
+import java.util.List;
+
+@KeycloakIntegrationTest
+@TestMethodOrder(MethodOrderer.MethodName.class)
+public class ClientRollbackTest {
+
+    @InjectClient(config = ClientWithSingleAttribute.class)
+    ManagedClient client;
+
+    @Test
+    public void test1UpdateWithRollback() {
+        client.updateWithCleanup(u -> u.attribute("one", "two").attribute("two", "two"));
+        client.updateWithCleanup(u -> u.adminUrl("http://something"));
+        client.updateWithCleanup(u -> u.redirectUris("http://something"));
+        client.updateWithCleanup(u -> u.attribute("three", "three"));
+    }
+
+    @Test
+    public void test2CheckRollback() {
+        ClientRepresentation current = client.admin().toRepresentation();
+
+        Assertions.assertEquals("one", current.getAttributes().get("one"));
+        Assertions.assertFalse(current.getAttributes().containsKey("two"));
+        Assertions.assertFalse(current.getAttributes().containsKey("three"));
+        Assertions.assertNull(current.getAdminUrl());
+        Assertions.assertTrue(current.getRedirectUris().isEmpty());
+    }
+
+    public static class ClientWithSingleAttribute implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.attribute("one", "one");
+        }
+
+    }
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigBuilderTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigBuilderTest.java
new file mode 100644
index 000000000000..beb27690d3c3
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigBuilderTest.java
@@ -0,0 +1,81 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfig;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+
+import java.util.LinkedList;
+
+@KeycloakIntegrationTest
+public class CustomConfigBuilderTest {
+
+    @InjectRealm(config = CustomRealmConfig.class)
+    ManagedRealm realm;
+
+    @InjectClient(config = CustomClientConfig.class)
+    ManagedClient client;
+
+    @InjectUser(config = CustomUserConfig.class)
+    ManagedUser user;
+
+    @Test
+    public void testRealm() {
+        Assertions.assertEquals(1, realm.admin().groups().query("mygroup").size());
+    }
+
+    @Test
+    public void testClient() {
+        Assertions.assertTrue(client.admin().toRepresentation().isBearerOnly());
+    }
+
+    @Test
+    public void testUser() {
+        Assertions.assertFalse(user.admin().toRepresentation().isEnabled());
+    }
+
+    public static class CustomRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            return realm.update(r -> {
+                if (r.getGroups() == null) {
+                    r.setGroups(new LinkedList<>());
+                }
+                GroupRepresentation group = new GroupRepresentation();
+                group.setName("mygroup");
+                group.setPath("/mygroup");
+                r.getGroups().add(group);
+            });
+        }
+    }
+
+    public static class CustomClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.update(u -> u.setBearerOnly(true));
+        }
+    }
+
+    public static class CustomUserConfig implements UserConfig {
+
+        @Override
+        public UserConfigBuilder configure(UserConfigBuilder user) {
+            return user.update(u -> u.setEnabled(false));
+        }
+    }
+
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigTest.java
index c1b31f923d81..0ba3e5e9a8d3 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/CustomConfigTest.java
@@ -19,17 +19,17 @@ public class CustomConfigTest {
     Keycloak adminClient;
 
     @Test
-    public void testUpdateEmailFeatureEnabled() {
-        Optional<FeatureRepresentation> updateEmailFeature = adminClient.serverInfo().getInfo().getFeatures().stream().filter(f -> f.getName().equals(Profile.Feature.UPDATE_EMAIL.name())).findFirst();
-        Assertions.assertTrue(updateEmailFeature.isPresent());
-        Assertions.assertTrue(updateEmailFeature.get().isEnabled());
+    public void testPasskeyFeatureEnabled() {
+        Optional<FeatureRepresentation> passKeysFeature = adminClient.serverInfo().getInfo().getFeatures().stream().filter(f -> f.getName().equals(Profile.Feature.PASSKEYS.name())).findFirst();
+        Assertions.assertTrue(passKeysFeature.isPresent());
+        Assertions.assertTrue(passKeysFeature.get().isEnabled());
     }
 
     public static class CustomServerConfig implements KeycloakServerConfig {
 
         @Override
         public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
-            return config.features(Profile.Feature.UPDATE_EMAIL);
+            return config.features(Profile.Feature.PASSKEYS);
         }
 
     }
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EmailTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EmailTest.java
index 6bfbc1372c2b..a6a66ce818e3 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EmailTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EmailTest.java
@@ -1,8 +1,9 @@
 package org.keycloak.test.examples;
 
-import com.nimbusds.oauth2.sdk.GeneralException;
 import jakarta.mail.MessagingException;
 import jakarta.mail.internet.MimeMessage;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import org.keycloak.events.email.EmailEventListenerProviderFactory;
@@ -11,8 +12,8 @@
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
 import org.keycloak.testframework.mail.MailServer;
 import org.keycloak.testframework.mail.annotations.InjectMailServer;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 import org.keycloak.testframework.realm.ManagedUser;
 import org.keycloak.testframework.realm.RealmConfig;
@@ -20,7 +21,6 @@
 import org.keycloak.testframework.realm.UserConfig;
 import org.keycloak.testframework.realm.UserConfigBuilder;
 
-import java.io.IOException;
 import java.util.Map;
 
 @KeycloakIntegrationTest
@@ -39,8 +39,8 @@ public class EmailTest {
     OAuthClient oAuthClient;
 
     @Test
-    public void testEmail() throws GeneralException, IOException, MessagingException {
-        oAuthClient.resourceOwnerCredentialGrant(user.getUsername(), "invalid");
+    public void testEmail() throws MessagingException {
+        oAuthClient.doPasswordGrantRequest(user.getUsername(), "invalid");
 
         Map<String, String> smtpServer = realm.admin().toRepresentation().getSmtpServer();
         Assertions.assertEquals("auto@keycloak.org", smtpServer.get("from"));
@@ -50,6 +50,7 @@ public void testEmail() throws GeneralException, IOException, MessagingException
         mail.waitForIncomingEmail(1);
         MimeMessage lastReceivedMessage = mail.getLastReceivedMessage();
         Assertions.assertEquals("Login error", lastReceivedMessage.getSubject());
+        MatcherAssert.assertThat(lastReceivedMessage.getMessageID(), Matchers.endsWith("@keycloak.org>"));
     }
 
     public static class EmailSenderRealmConfig implements RealmConfig {
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EventsTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EventsTest.java
index c604eb3fc55f..5947dca3dce2 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EventsTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/EventsTest.java
@@ -1,52 +1,63 @@
 package org.keycloak.test.examples;
 
-import com.nimbusds.oauth2.sdk.GeneralException;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import org.keycloak.events.EventType;
+import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testframework.annotations.InjectEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
 import org.keycloak.testframework.events.Events;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
-import org.keycloak.testframework.ui.annotations.InjectPage;
-import org.keycloak.testframework.ui.annotations.InjectWebDriver;
-import org.keycloak.testframework.ui.page.LoginPage;
-import org.openqa.selenium.WebDriver;
-
-import java.io.IOException;
-import java.net.URL;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.timeoffset.InjectTimeOffSet;
+import org.keycloak.testframework.remote.timeoffset.TimeOffSet;
 
 @KeycloakIntegrationTest
 public class EventsTest {
 
+    @InjectRealm
+    private ManagedRealm realm;
+
     @InjectEvents
     private Events events;
 
     @InjectOAuthClient
     private OAuthClient oAuthClient;
 
-    @InjectWebDriver
-    private WebDriver webDriver;
+    @InjectTimeOffSet
+    TimeOffSet timeOffSet;
+
+    @Test
+    public void testFailedLogin() {
+        oAuthClient.doPasswordGrantRequest("invalid", "invalid");
+
+        EventRepresentation event = events.poll();
+        Assertions.assertEquals(EventType.LOGIN_ERROR.name(), event.getType());
+        Assertions.assertEquals("invalid", event.getDetails().get("username"));
+
+        oAuthClient.doPasswordGrantRequest("invalid2", "invalid");
 
-    @InjectPage
-    private LoginPage loginPage;
+        event = events.poll();
+        Assertions.assertEquals(EventType.LOGIN_ERROR.name(), event.getType());
+        Assertions.assertEquals("invalid2", event.getDetails().get("username"));
+    }
 
     @Test
-    public void testFailedLogin() throws GeneralException, IOException {
-        URL authorizationRequestURL = oAuthClient.authorizationRequest();
-        webDriver.navigate().to(authorizationRequestURL);
-        loginPage.fillLogin("invalid", "invalid");
-        loginPage.submit();
+    public void testTimeOffset() {
+        timeOffSet.set(60);
+
+        oAuthClient.doClientCredentialsGrantAccessTokenRequest();
 
-        Assertions.assertEquals(EventType.LOGIN_ERROR, events.poll().getType());
+        Assertions.assertEquals(EventType.CLIENT_LOGIN.name(), events.poll().getType());
     }
 
     @Test
-    public void testClientLogin() throws GeneralException, IOException {
-        oAuthClient.clientCredentialGrant();
+    public void testClientLogin() {
+        oAuthClient.doClientCredentialsGrantAccessTokenRequest();
 
-        Assertions.assertEquals(EventType.CLIENT_LOGIN, events.poll().getType());
+        Assertions.assertEquals(EventType.CLIENT_LOGIN.name(), events.poll().getType());
     }
 
 }
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/OAuthClientTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/OAuthClientTest.java
index d9ed7278f668..6ced5ae329d5 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/OAuthClientTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/OAuthClientTest.java
@@ -1,100 +1,147 @@
 package org.keycloak.test.examples;
 
-import com.nimbusds.oauth2.sdk.AuthorizationResponse;
-import com.nimbusds.oauth2.sdk.TokenIntrospectionResponse;
-import com.nimbusds.oauth2.sdk.TokenResponse;
-import com.nimbusds.oauth2.sdk.token.AccessToken;
-import jakarta.ws.rs.core.Response;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
+import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.testframework.annotations.InjectRealm;
 import org.keycloak.testframework.annotations.InjectUser;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
 import org.keycloak.testframework.realm.ManagedUser;
 import org.keycloak.testframework.realm.UserConfig;
 import org.keycloak.testframework.realm.UserConfigBuilder;
 import org.keycloak.testframework.ui.annotations.InjectPage;
-import org.keycloak.testframework.ui.annotations.InjectWebDriver;
 import org.keycloak.testframework.ui.page.LoginPage;
-import org.openqa.selenium.WebDriver;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.IntrospectionResponse;
+import org.keycloak.testsuite.util.oauth.TokenRevocationResponse;
+import org.keycloak.testsuite.util.oauth.UserInfoResponse;
 
-import java.net.URI;
-import java.net.URL;
+import java.io.IOException;
 
 @KeycloakIntegrationTest
 public class OAuthClientTest {
 
-    @InjectUser(config = OAuthUserConfig.class)
-    ManagedUser user;
-
     @InjectOAuthClient
-    OAuthClient oAuthClient;
+    OAuthClient oauth;
+
+    @InjectRealm
+    ManagedRealm managedRealm;
 
-    @InjectWebDriver
-    WebDriver webDriver;
+    @InjectUser(config = OAuthUserConfig.class)
+    ManagedUser user;
 
     @InjectPage
     LoginPage loginPage;
 
     @Test
-    public void testClientCredentials() throws Exception {
-        TokenResponse tokenResponse = oAuthClient.clientCredentialGrant();
-        Assertions.assertTrue(tokenResponse.indicatesSuccess());
-        Assertions.assertNotNull(tokenResponse.toSuccessResponse().getTokens().getAccessToken());
+    public void testConfig() {
+        Assertions.assertEquals(managedRealm.getName(), oauth.config().getRealm());
+        Assertions.assertEquals(managedRealm.getBaseUrl() + "/protocol/openid-connect/token", oauth.getEndpoints().getToken());
+    }
+
+    @Test
+    public void testLogin() {
+        AuthorizationEndpointResponse response = oauth.doLogin(user.getUsername(), user.getPassword());
+        Assertions.assertTrue(response.isRedirected());
+
+        oauth.logoutForm().idTokenHint(oauth.doAccessTokenRequest(response.getCode()).getIdToken()).open();
+    }
+
+    @Test
+    public void testPasswordGrant() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+        Assertions.assertTrue(accessTokenResponse.isSuccess());
+
+        accessTokenResponse = oauth.passwordGrantRequest(user.getUsername(), "invalid").send();
+        Assertions.assertFalse(accessTokenResponse.isSuccess());
+        Assertions.assertEquals("Invalid user credentials", accessTokenResponse.getErrorDescription());
+    }
+
+    @Test
+    public void testClientCredential() {
+        AccessTokenResponse accessTokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
+        Assertions.assertTrue(accessTokenResponse.isSuccess());
+    }
+
+    @Test
+    public void testUserInfo() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+
+        UserInfoResponse userInfoResponse = oauth.doUserInfoRequest(accessTokenResponse.getAccessToken());
+        Assertions.assertTrue(userInfoResponse.isSuccess());
+        Assertions.assertEquals(user.getUsername(), userInfoResponse.getUserInfo().getPreferredUsername());
+    }
+
+    @Test
+    public void testRefresh() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
+        Assertions.assertTrue(refreshResponse.isSuccess());
+        Assertions.assertNotEquals(accessTokenResponse.getAccessToken(), refreshResponse.getAccessToken());
     }
 
     @Test
-    public void testIntrospection() throws Exception {
-        AccessToken accessToken = oAuthClient.clientCredentialGrant().toSuccessResponse().getTokens().getAccessToken();
-        TokenIntrospectionResponse introspectionResponse = oAuthClient.introspection(accessToken);
-        Assertions.assertTrue(introspectionResponse.indicatesSuccess());
-        Assertions.assertNotNull(introspectionResponse.toSuccessResponse().getIssuer());
+    public void testOpenIDConfiguration() {
+        OIDCConfigurationRepresentation oidcConfiguration = oauth.doWellKnownRequest();
+        Assertions.assertNotNull(oidcConfiguration);
     }
 
     @Test
-    public void testAuthorizationCode() throws Exception {
-        URL authorizationRequestURL = oAuthClient.authorizationRequest();
-        webDriver.navigate().to(authorizationRequestURL);
-        loginPage.fillLogin(user.getUsername(), user.getPassword());
-        loginPage.submit();
+    public void testIntrospection() throws IOException {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
 
-        Assertions.assertEquals(1, oAuthClient.getCallbacks().size());
+        IntrospectionResponse introspectionResponse = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken());
+        Assertions.assertTrue(introspectionResponse.isSuccess());
+        Assertions.assertTrue(introspectionResponse.asTokenMetadata().isActive());
+    }
 
-        URI callbackUri = oAuthClient.getCallbacks().remove(0);
+    @Test
+    public void testRevocation() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
 
-        AuthorizationResponse authorizationResponse = AuthorizationResponse.parse(callbackUri);
-        Assertions.assertTrue(authorizationResponse.indicatesSuccess());
-        Assertions.assertNotNull(authorizationResponse.toSuccessResponse().getAuthorizationCode());
+        TokenRevocationResponse tokenRevocationResponse = oauth.doTokenRevoke(accessTokenResponse.getRefreshToken());
+        Assertions.assertTrue(tokenRevocationResponse.isSuccess());
 
-        TokenResponse tokenResponse = oAuthClient.tokenRequest(authorizationResponse.toSuccessResponse().getAuthorizationCode());
-        Assertions.assertTrue(tokenResponse.indicatesSuccess());
-        Assertions.assertNotNull(tokenResponse.toSuccessResponse().getTokens().getAccessToken());
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
+        Assertions.assertFalse(refreshResponse.isSuccess());
     }
 
     @Test
-    public void testAccessTokenRevocation() throws Exception {
-        TokenResponse tokenResponse = oAuthClient.clientCredentialGrant();
-        Assertions.assertTrue(tokenResponse.indicatesSuccess());
-        Assertions.assertNotNull(tokenResponse.toSuccessResponse().getTokens().getAccessToken());
+    public void testParseToken() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+
+        AccessToken accessToken = oauth.parseToken(accessTokenResponse.getAccessToken(), AccessToken.class);
+        Assertions.assertEquals(user.getUsername(), accessToken.getPreferredUsername());
+    }
 
-        AccessToken accessToken = tokenResponse.toSuccessResponse().getTokens().getAccessToken();
-        TokenIntrospectionResponse introspectionResponse = oAuthClient.introspection(accessToken);
-        Assertions.assertTrue(introspectionResponse.indicatesSuccess());
-        Assertions.assertNotNull(introspectionResponse.toSuccessResponse().getScope());
+    @Test
+    public void testVerifyToken() {
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
 
-        Assertions.assertEquals(Response.Status.OK.getStatusCode(), oAuthClient.revokeAccessToken(accessToken).getStatusCode());
+        AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken(), AccessToken.class);
+        Assertions.assertEquals(user.getUsername(), accessToken.getPreferredUsername());
+    }
 
-        introspectionResponse = oAuthClient.introspection(accessToken);
-        Assertions.assertTrue(introspectionResponse.indicatesSuccess());
-        Assertions.assertNull(introspectionResponse.toSuccessResponse().getScope());
+    @Test
+    public void testLogout() {
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin(user.getUsername(), user.getPassword());
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode());
+        oauth.logoutForm().idTokenHint(accessTokenResponse.getIdToken()).open();
+        oauth.loginForm().open();
+        Assertions.assertTrue(loginPage.isActivePage());
     }
 
     public static class OAuthUserConfig implements UserConfig {
 
         @Override
         public UserConfigBuilder configure(UserConfigBuilder user) {
-            return user.name("First", "Last")
+            return user.username("myuser").name("First", "Last")
                     .email("test@local")
                     .password("password");
         }
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/PagesTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/PagesTest.java
index e8234085f0d8..f9ca79766d27 100644
--- a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/PagesTest.java
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/PagesTest.java
@@ -1,14 +1,22 @@
 package org.keycloak.test.examples;
 
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
-import org.keycloak.testframework.ui.annotations.InjectPage;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.ui.annotations.InjectPage;
+import org.keycloak.testframework.ui.annotations.InjectWebDriver;
 import org.keycloak.testframework.ui.page.LoginPage;
 import org.keycloak.testframework.ui.page.WelcomePage;
+import org.openqa.selenium.By;
+import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.htmlunit.HtmlUnitDriver;
 
 @KeycloakIntegrationTest
 public class PagesTest {
 
+    @InjectWebDriver
+    WebDriver webDriver;
+
     @InjectPage
     WelcomePage welcomePage;
 
@@ -18,8 +26,25 @@ public class PagesTest {
     @Test
     public void testLoginFromWelcome() {
         welcomePage.navigateTo();
-        loginPage.fillLogin("admin", "admin");
-        loginPage.submit();
+
+        if (welcomePage.isActivePage()) {
+            welcomePage.fillRegistration("admin", "admin");
+            welcomePage.submit();
+            welcomePage.clickOpenAdminConsole();
+        }
+
+        if (webDriver instanceof HtmlUnitDriver) {
+            String pageId = webDriver.findElement(By.xpath("//body")).getAttribute("data-page-id");
+            Assertions.assertEquals("admin", pageId);
+            Assertions.assertTrue(webDriver.getCurrentUrl().endsWith("/admin/master/console/"));
+        } else {
+            loginPage.waitForPage();
+
+            Assertions.assertTrue(loginPage.isActivePage());
+
+            loginPage.fillLogin("admin", "admin");
+            loginPage.submit();
+        }
     }
 
 }
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerHelpers.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerHelpers.java
new file mode 100644
index 000000000000..29131a8104b8
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerHelpers.java
@@ -0,0 +1,34 @@
+package org.keycloak.test.examples;
+
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer;
+import org.keycloak.testframework.remote.providers.runonserver.FetchOnServerWrapper;
+
+/**
+ * Created by st on 26.01.17.
+ */
+public class RunOnServerHelpers {
+
+    public static InternalRealm internalRealm() {
+        return new InternalRealm();
+    }
+
+    public static class InternalRealm implements FetchOnServerWrapper<RealmRepresentation> {
+
+        private InternalRealm() {
+        }
+
+        @Override
+        public FetchOnServer getRunOnServer() {
+            return session -> ModelToRepresentation.toRepresentation(session, session.getContext().getRealm(), true);
+        }
+
+        @Override
+        public Class<RealmRepresentation> getResultClass() {
+            return RealmRepresentation.class;
+        }
+
+    }
+
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerTest.java
new file mode 100644
index 000000000000..69387266b260
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/RunOnServerTest.java
@@ -0,0 +1,90 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.providers.runonserver.RunOnServerException;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.opentest4j.AssertionFailedError;
+
+@KeycloakIntegrationTest
+public class RunOnServerTest {
+
+    @InjectRealm
+    ManagedRealm realm;
+
+    @InjectRealm(attachTo = "master", ref = "master")
+    ManagedRealm masterRealm;
+
+    @InjectRunOnServer(permittedPackages = "org.keycloak.test.examples")
+    RunOnServerClient runOnServer;
+
+    @InjectRunOnServer(permittedPackages = "org.keycloak.test.examples", ref = "master", realmRef = "master")
+    RunOnServerClient runOnServerMaster;
+
+    @Test
+    public void verifyRealm() {
+        Assertions.assertEquals("default", runOnServer.fetch(session -> session.getContext().getRealm().getName(), String.class));
+        Assertions.assertEquals("master", runOnServerMaster.fetch(session -> session.getContext().getRealm().getName(), String.class));
+    }
+
+    @Test
+    public void runOnServerString() {
+        String string = runOnServer.fetch(session -> "Hello world!", String.class);
+        Assertions.assertEquals("Hello world!", string);
+    }
+
+    @Test
+    public void runOnServerRep() {
+        final String realmName = "master";
+
+        RealmRepresentation realmRep = runOnServer.fetch(session -> {
+            RealmModel master = session.realms().getRealmByName(realmName);
+            return ModelToRepresentation.toRepresentation(session, master, true);
+        }, RealmRepresentation.class);
+
+        Assertions.assertEquals(realmName, realmRep.getRealm());
+    }
+
+    @Test
+    public void runOnServerHelpers() {
+        RealmRepresentation realmRep = runOnServer.fetch(RunOnServerHelpers.internalRealm());
+        Assertions.assertEquals("default", realmRep.getRealm());
+    }
+
+    @Test
+    public void runOnServerNoResponse() {
+        runOnServer.run(session -> session.getContext().getRealm());
+    }
+
+    @Test
+    public void runOnServerAssertOnServer() {
+        try {
+            runOnServer.run(session -> Assertions.assertEquals("foo", "bar"));
+            Assertions.fail("Expected exception");
+        } catch (AssertionFailedError e) {
+            Assertions.assertEquals("expected: <foo> but was: <bar>", e.getMessage());
+        }
+    }
+
+    @Test
+    public void runOnServerExceptionOnServer() {
+        try {
+            runOnServer.run(session -> {
+                throw new ModelException("Something went wrong");
+            });
+            Assertions.fail("Expected exception");
+        } catch (RunOnServerException e) {
+            Assertions.assertTrue(e.getCause() instanceof ModelException);
+            Assertions.assertEquals("Something went wrong", e.getCause().getMessage());
+        }
+    }
+
+}
diff --git a/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/TestAppTest.java b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/TestAppTest.java
new file mode 100644
index 000000000000..5852626042c8
--- /dev/null
+++ b/test-framework/examples/tests/src/test/java/org/keycloak/test/examples/TestAppTest.java
@@ -0,0 +1,35 @@
+package org.keycloak.test.examples;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.adapters.action.PushNotBeforeAction;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.TestApp;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectTestApp;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+@KeycloakIntegrationTest
+public class TestAppTest {
+
+    @InjectOAuthClient(kcAdmin = true)
+    OAuthClient oauth;
+
+    @InjectTestApp
+    TestApp testApp;
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @Test
+    public void testPushNotBefore() throws InterruptedException {
+        String clientUuid = managedRealm.admin().clients().findByClientId("test-app").stream().findFirst().get().getId();
+        managedRealm.admin().clients().get(clientUuid).pushRevocation();
+
+        PushNotBeforeAction adminPushNotBefore = testApp.kcAdmin().getAdminPushNotBefore();
+        Assertions.assertNotNull(adminPushNotBefore);
+    }
+
+}
diff --git a/test-framework/junit5-config/pom.xml b/test-framework/junit5-config/pom.xml
new file mode 100755
index 000000000000..f9677c5e6eb9
--- /dev/null
+++ b/test-framework/junit5-config/pom.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-test-framework-parent</artifactId>
+        <groupId>org.keycloak.testframework</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-test-framework-junit5-config</artifactId>
+    <name>Keycloak Test Framework</name>
+    <packaging>jar</packaging>
+    <description>Default test framework config for JUnit 5</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+    </dependencies>
+
+</project>
diff --git a/test-framework/junit5-config/src/main/java/org/keycloak/testframework/ServerConfigClassOrderer.java b/test-framework/junit5-config/src/main/java/org/keycloak/testframework/ServerConfigClassOrderer.java
new file mode 100644
index 000000000000..890725439c73
--- /dev/null
+++ b/test-framework/junit5-config/src/main/java/org/keycloak/testframework/ServerConfigClassOrderer.java
@@ -0,0 +1,38 @@
+package org.keycloak.testframework;
+
+import org.infinispan.util.function.SerializableComparator;
+import org.junit.jupiter.api.ClassDescriptor;
+import org.junit.jupiter.api.ClassOrderer;
+import org.junit.jupiter.api.ClassOrdererContext;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.Optional;
+
+public class ServerConfigClassOrderer implements ClassOrderer {
+
+    @Override
+    public void orderClasses(ClassOrdererContext classOrdererContext) {
+        classOrdererContext.getClassDescriptors().sort(new ServerConfigComparator());
+    }
+
+    static class ServerConfigComparator implements SerializableComparator<ClassDescriptor> {
+
+        @Override
+        public int compare(ClassDescriptor o1, ClassDescriptor o2) {
+            Optional<KeycloakIntegrationTest> a1 = o1.findAnnotation(KeycloakIntegrationTest.class);
+            Optional<KeycloakIntegrationTest> a2 = o2.findAnnotation(KeycloakIntegrationTest.class);
+
+            if (a1.isPresent() && a2.isPresent()) {
+                return a1.get().config().getName().compareTo(a2.get().config().getName());
+            } else if (a1.isPresent()) {
+                return 1;
+            } else if (a2.isPresent()) {
+                return 2;
+            } else {
+                return 0;
+            }
+        }
+
+    }
+
+}
diff --git a/test-framework/junit5-config/src/main/resources/junit-platform.properties b/test-framework/junit5-config/src/main/resources/junit-platform.properties
new file mode 100644
index 000000000000..58d88e022b5a
--- /dev/null
+++ b/test-framework/junit5-config/src/main/resources/junit-platform.properties
@@ -0,0 +1,2 @@
+junit.jupiter.extensions.autodetection.enabled=true
+junit.jupiter.testclass.order.default=org.keycloak.testframework.ServerConfigClassOrderer
\ No newline at end of file
diff --git a/test-framework/oauth-nimbus-poc/pom.xml b/test-framework/oauth-nimbus-poc/pom.xml
deleted file mode 100755
index 859bece5c43e..000000000000
--- a/test-framework/oauth-nimbus-poc/pom.xml
+++ /dev/null
@@ -1,50 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <parent>
-        <artifactId>keycloak-test-framework-parent</artifactId>
-        <groupId>org.keycloak.testframework</groupId>
-        <version>999.0.0-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
-    </parent>
-    <modelVersion>4.0.0</modelVersion>
-
-    <artifactId>keycloak-test-framework-oauth-nimbus-poc</artifactId>
-    <name>Keycloak Test Framework</name>
-    <packaging>jar</packaging>
-    <description>Nimbus OAuth PoC extension for Keycloak Test Framework</description>
-
-    <properties>
-        <nimbus-sdk.version>11.13</nimbus-sdk.version>
-    </properties>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.keycloak.testframework</groupId>
-            <artifactId>keycloak-test-framework-core</artifactId>
-            <version>${project.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.nimbusds</groupId>
-            <artifactId>oauth2-oidc-sdk</artifactId>
-            <version>${nimbus-sdk.version}</version>
-        </dependency>
-    </dependencies>
-</project>
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/DefaultOAuthClientConfiguration.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/DefaultOAuthClientConfiguration.java
deleted file mode 100644
index f0adff28f35d..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/DefaultOAuthClientConfiguration.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus;
-
-import org.keycloak.testframework.realm.ClientConfig;
-import org.keycloak.testframework.realm.ClientConfigBuilder;
-
-public class DefaultOAuthClientConfiguration implements ClientConfig {
-
-    @Override
-    public ClientConfigBuilder configure(ClientConfigBuilder client) {
-        return client.clientId("test-oauth-client")
-                .serviceAccount()
-                .directAccessGrants()
-                .redirectUris("http://127.0.0.1/callback/oauth")
-                .secret("test-secret");
-    }
-
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/NimbusTestFrameworkExtension.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/NimbusTestFrameworkExtension.java
deleted file mode 100644
index 61721bb6de8e..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/NimbusTestFrameworkExtension.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus;
-
-import org.keycloak.testframework.TestFrameworkExtension;
-import org.keycloak.testframework.injection.Supplier;
-
-import java.util.List;
-
-public class NimbusTestFrameworkExtension implements TestFrameworkExtension {
-
-    @Override
-    public List<Supplier<?, ?>> suppliers() {
-        return List.of(new OAuthClientSupplier());
-    }
-
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthCallbackServer.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthCallbackServer.java
deleted file mode 100644
index a3496a3cdac0..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthCallbackServer.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus;
-
-import com.sun.net.httpserver.HttpExchange;
-import com.sun.net.httpserver.HttpHandler;
-import com.sun.net.httpserver.HttpServer;
-
-import java.io.IOException;
-import java.net.InetSocketAddress;
-import java.net.URI;
-import java.nio.charset.StandardCharsets;
-import java.util.LinkedList;
-import java.util.List;
-
-class OAuthCallbackServer {
-
-    private final HttpServer httpServer;
-    private final OAuthCallbackHandler callbackHandler;
-    private final URI redirectionUri;
-
-    public OAuthCallbackServer() {
-        this.callbackHandler = new OAuthCallbackHandler();
-
-        try {
-            httpServer = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
-            httpServer.createContext("/callback/oauth", callbackHandler);
-            httpServer.start();
-            redirectionUri = new URI("http://127.0.0.1:" + httpServer.getAddress().getPort() + "/callback/oauth");
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public URI getRedirectionUri() {
-        return redirectionUri;
-    }
-
-    public List<URI> getCallbacks() {
-        return callbackHandler.callbacks;
-    }
-
-    public void close() {
-        httpServer.stop(0);
-    }
-
-    static class OAuthCallbackHandler implements HttpHandler {
-
-        private List<URI> callbacks = new LinkedList<>();
-
-        @Override
-        public void handle(HttpExchange exchange) throws IOException {
-            callbacks.add(exchange.getRequestURI());
-            byte[] happydays = new String("<html><body>Happy days<div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body></html>").getBytes(StandardCharsets.UTF_8);
-            exchange.getResponseHeaders().set("Content-Type", "text/html");
-            exchange.sendResponseHeaders(200, happydays.length);
-            exchange.getResponseBody().write(happydays);
-            exchange.getResponseBody().close();
-        }
-    }
-
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClient.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClient.java
deleted file mode 100644
index 039f3e356ed4..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClient.java
+++ /dev/null
@@ -1,146 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus;
-
-import com.nimbusds.oauth2.sdk.AuthorizationCode;
-import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
-import com.nimbusds.oauth2.sdk.AuthorizationGrant;
-import com.nimbusds.oauth2.sdk.AuthorizationRequest;
-import com.nimbusds.oauth2.sdk.ClientCredentialsGrant;
-import com.nimbusds.oauth2.sdk.GeneralException;
-import com.nimbusds.oauth2.sdk.ResourceOwnerPasswordCredentialsGrant;
-import com.nimbusds.oauth2.sdk.ResponseType;
-import com.nimbusds.oauth2.sdk.TokenIntrospectionRequest;
-import com.nimbusds.oauth2.sdk.TokenIntrospectionResponse;
-import com.nimbusds.oauth2.sdk.TokenRequest;
-import com.nimbusds.oauth2.sdk.TokenResponse;
-import com.nimbusds.oauth2.sdk.TokenRevocationRequest;
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.http.HTTPResponse;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.oauth2.sdk.id.Issuer;
-import com.nimbusds.oauth2.sdk.id.State;
-import com.nimbusds.oauth2.sdk.token.AccessToken;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-import jakarta.ws.rs.core.Response;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.testframework.realm.ClientConfig;
-import org.keycloak.testframework.realm.ClientConfigBuilder;
-import org.keycloak.testframework.realm.ManagedClient;
-import org.keycloak.testframework.realm.ManagedRealm;
-import org.keycloak.testframework.util.ApiUtil;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URL;
-import java.util.List;
-
-public class OAuthClient {
-
-    private final ManagedRealm realm;
-    private final ManagedClient client;
-    private final OAuthCallbackServer callbackServer;
-    private OIDCProviderMetadata oidcProviderMetadata;
-
-    public OAuthClient(ManagedRealm realm, ClientConfig clientConfig) {
-        this.realm = realm;
-        this.client = registerClient(clientConfig);
-        this.callbackServer = new OAuthCallbackServer();
-    }
-
-    private ManagedClient registerClient(ClientConfig clientConfig) {
-        ClientRepresentation clientRepresentation = clientConfig.configure(ClientConfigBuilder.create()).build();
-        Response response = realm.admin().clients().create(clientRepresentation);
-        String id = ApiUtil.handleCreatedResponse(response);
-        clientRepresentation.setId(id);
-
-        return new ManagedClient(clientRepresentation, realm.admin().clients().get(id));
-    }
-
-    public TokenResponse clientCredentialGrant() throws IOException, GeneralException {
-        AuthorizationGrant clientGrant = new ClientCredentialsGrant();
-        ClientAuthentication clientAuthentication = getClientAuthentication();
-        URI tokenEndpoint = getOIDCProviderMetadata().getTokenEndpointURI();
-
-        TokenRequest tokenRequest = new TokenRequest(tokenEndpoint, clientAuthentication, clientGrant);
-        return TokenResponse.parse(tokenRequest.toHTTPRequest().send());
-    }
-
-    public TokenResponse resourceOwnerCredentialGrant(String username, String password) {
-        try {
-            ResourceOwnerPasswordCredentialsGrant credentialsGrant = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));
-            ClientAuthentication clientAuthentication = getClientAuthentication();
-            URI tokenEndpoint = getOIDCProviderMetadata().getTokenEndpointURI();
-
-            TokenRequest tokenRequest = new TokenRequest(tokenEndpoint, clientAuthentication, credentialsGrant);
-            return TokenResponse.parse(tokenRequest.toHTTPRequest().send());
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public TokenResponse tokenRequest(AuthorizationCode authorizationCode) throws IOException, GeneralException {
-        AuthorizationGrant grant = new AuthorizationCodeGrant(authorizationCode, callbackServer.getRedirectionUri());
-        ClientAuthentication clientAuthentication = getClientAuthentication();
-        URI tokenEndpoint = getOIDCProviderMetadata().getTokenEndpointURI();
-
-        TokenRequest tokenRequest = new TokenRequest(tokenEndpoint, clientAuthentication, grant);
-        return TokenResponse.parse(tokenRequest.toHTTPRequest().send());
-    }
-
-    public TokenIntrospectionResponse introspection(AccessToken accessToken) throws IOException, GeneralException {
-        ClientAuthentication clientAuthentication = getClientAuthentication();
-        URI introspectionEndpoint = getOIDCProviderMetadata().getIntrospectionEndpointURI();
-
-        TokenIntrospectionRequest introspectionRequest = new TokenIntrospectionRequest(introspectionEndpoint, clientAuthentication, accessToken);
-        return TokenIntrospectionResponse.parse(introspectionRequest.toHTTPRequest().send());
-    }
-
-    public HTTPResponse revokeAccessToken(AccessToken token) throws GeneralException, IOException {
-        URI revocationEndpoint = getOIDCProviderMetadata().getRevocationEndpointURI();
-        TokenRevocationRequest revocationRequest = new TokenRevocationRequest(revocationEndpoint, getClientAuthentication(), token);
-        return revocationRequest.toHTTPRequest().send();
-    }
-
-    public URL authorizationRequest() {
-        try {
-            URI authorizationEndpoint = getOIDCProviderMetadata().getAuthorizationEndpointURI();
-            State state = new State();
-            ClientID clientID = new ClientID(client.getClientId());
-
-            AuthorizationRequest authorizationRequest = new AuthorizationRequest.Builder(new ResponseType(ResponseType.Value.CODE), clientID)
-                    .state(state)
-                    .redirectionURI(callbackServer.getRedirectionUri())
-                    .endpointURI(authorizationEndpoint)
-                    .build();
-
-            return authorizationRequest.toURI().toURL();
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public List<URI> getCallbacks() {
-        return callbackServer.getCallbacks();
-    }
-
-    public void close() {
-        client.admin().remove();
-        callbackServer.close();
-    }
-
-    private ClientAuthentication getClientAuthentication() {
-        ClientID clientID = new ClientID(client.getClientId());
-        Secret clientSecret = new Secret(client.getSecret());
-        return new ClientSecretBasic(clientID, clientSecret);
-    }
-
-    private OIDCProviderMetadata getOIDCProviderMetadata() throws GeneralException, IOException {
-        if (oidcProviderMetadata == null) {
-            Issuer issuer = new Issuer(realm.getBaseUrl());
-            oidcProviderMetadata = OIDCProviderMetadata.resolve(issuer);
-        }
-        return oidcProviderMetadata;
-    }
-
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClientSupplier.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClientSupplier.java
deleted file mode 100644
index 897058a0669a..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/OAuthClientSupplier.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus;
-
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
-import org.keycloak.testframework.injection.InstanceContext;
-import org.keycloak.testframework.injection.LifeCycle;
-import org.keycloak.testframework.injection.RequestedInstance;
-import org.keycloak.testframework.injection.Supplier;
-import org.keycloak.testframework.injection.SupplierHelpers;
-import org.keycloak.testframework.realm.ClientConfig;
-import org.keycloak.testframework.realm.ManagedRealm;
-
-public class OAuthClientSupplier implements Supplier<OAuthClient, InjectOAuthClient> {
-
-    @Override
-    public Class<InjectOAuthClient> getAnnotationClass() {
-        return InjectOAuthClient.class;
-    }
-
-    @Override
-    public Class<OAuthClient> getValueType() {
-        return OAuthClient.class;
-    }
-
-    @Override
-    public OAuthClient getValue(InstanceContext<OAuthClient, InjectOAuthClient> instanceContext) {
-        ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class);
-        ClientConfig clientConfig = SupplierHelpers.getInstance(instanceContext.getAnnotation().config());
-        return new OAuthClient(realm, clientConfig);
-    }
-
-    @Override
-    public boolean compatible(InstanceContext<OAuthClient, InjectOAuthClient> a, RequestedInstance<OAuthClient, InjectOAuthClient> b) {
-        return true;
-    }
-
-    @Override
-    public LifeCycle getDefaultLifecycle() {
-        return LifeCycle.GLOBAL;
-    }
-
-    @Override
-    public void close(InstanceContext<OAuthClient, InjectOAuthClient> instanceContext) {
-        instanceContext.getValue().close();
-    }
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/annotations/InjectOAuthClient.java b/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/annotations/InjectOAuthClient.java
deleted file mode 100644
index 41a97065013c..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/java/org/keycloak/testframework/oauth/nimbus/annotations/InjectOAuthClient.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package org.keycloak.testframework.oauth.nimbus.annotations;
-
-import org.keycloak.testframework.oauth.nimbus.DefaultOAuthClientConfiguration;
-import org.keycloak.testframework.realm.ClientConfig;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-@Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.FIELD)
-public @interface InjectOAuthClient {
-
-    Class<? extends ClientConfig> config() default DefaultOAuthClientConfiguration.class;
-
-}
diff --git a/test-framework/oauth-nimbus-poc/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension b/test-framework/oauth-nimbus-poc/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
deleted file mode 100644
index 40adbce7cdb0..000000000000
--- a/test-framework/oauth-nimbus-poc/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
+++ /dev/null
@@ -1 +0,0 @@
-org.keycloak.testframework.oauth.nimbus.NimbusTestFrameworkExtension
\ No newline at end of file
diff --git a/test-framework/oauth/pom.xml b/test-framework/oauth/pom.xml
new file mode 100755
index 000000000000..75bd3334e9f3
--- /dev/null
+++ b/test-framework/oauth/pom.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-test-framework-parent</artifactId>
+        <groupId>org.keycloak.testframework</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-test-framework-oauth</artifactId>
+    <name>Keycloak Test Framework</name>
+    <packaging>jar</packaging>
+    <description>OAuth extension for Keycloak Test Framework</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-ui</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.tests</groupId>
+            <artifactId>keycloak-tests-utils-shared</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/DefaultOAuthClientConfiguration.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/DefaultOAuthClientConfiguration.java
new file mode 100644
index 000000000000..acd0ebf84637
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/DefaultOAuthClientConfiguration.java
@@ -0,0 +1,16 @@
+package org.keycloak.testframework.oauth;
+
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+
+public class DefaultOAuthClientConfiguration implements ClientConfig {
+
+    @Override
+    public ClientConfigBuilder configure(ClientConfigBuilder client) {
+        return client.clientId("test-app")
+                .serviceAccountsEnabled(true)
+                .directAccessGrants()
+                .secret("test-secret");
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminCallbackHandler.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminCallbackHandler.java
new file mode 100644
index 000000000000..889ea7421389
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminCallbackHandler.java
@@ -0,0 +1,41 @@
+package org.keycloak.testframework.oauth;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+import org.keycloak.constants.AdapterConstants;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.representations.adapters.action.LogoutAction;
+import org.keycloak.representations.adapters.action.PushNotBeforeAction;
+import org.keycloak.representations.adapters.action.TestAvailabilityAction;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+public class KcAdminCallbackHandler implements HttpHandler {
+
+    private final KcAdminInvocations invocations;
+
+    KcAdminCallbackHandler(KcAdminInvocations kcAdminInvocations) {
+        this.invocations = kcAdminInvocations;
+    }
+
+    public void handle(HttpExchange exchange) throws IOException {
+        String path = exchange.getRequestURI().getPath();
+        try {
+            JWSInput adminToken = new JWSInput(new String(exchange.getRequestBody().readAllBytes(), StandardCharsets.UTF_8));
+            if (path.endsWith(AdapterConstants.K_LOGOUT)) {
+                invocations.add(adminToken.readJsonContent(LogoutAction.class));
+            } else if (path.endsWith(AdapterConstants.K_PUSH_NOT_BEFORE)) {
+                invocations.add(adminToken.readJsonContent(PushNotBeforeAction.class));
+            } else if (path.endsWith(AdapterConstants.K_TEST_AVAILABLE)) {
+                invocations.add(adminToken.readJsonContent(TestAvailabilityAction.class));
+            }
+            exchange.sendResponseHeaders(204, 0);
+            exchange.close();
+        } catch (JWSInputException e) {
+            throw new IOException(e);
+        }
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminInvocations.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminInvocations.java
new file mode 100644
index 000000000000..62d169a5433b
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/KcAdminInvocations.java
@@ -0,0 +1,50 @@
+package org.keycloak.testframework.oauth;
+
+import org.keycloak.representations.adapters.action.LogoutAction;
+import org.keycloak.representations.adapters.action.PushNotBeforeAction;
+import org.keycloak.representations.adapters.action.TestAvailabilityAction;
+
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
+
+public class KcAdminInvocations {
+
+    private final BlockingQueue<LogoutAction> adminLogoutActions = new LinkedBlockingQueue<>();
+    private final BlockingQueue<PushNotBeforeAction> adminPushNotBeforeActions = new LinkedBlockingQueue<>();
+    private final BlockingQueue<TestAvailabilityAction> adminTestAvailabilityAction = new LinkedBlockingQueue<>();
+
+    KcAdminInvocations() {
+    }
+
+    public PushNotBeforeAction getAdminPushNotBefore() throws InterruptedException {
+        return adminPushNotBeforeActions.poll(10, TimeUnit.SECONDS);
+    }
+
+    void add(PushNotBeforeAction action) {
+        adminPushNotBeforeActions.add(action);
+    }
+
+    public TestAvailabilityAction getTestAvailable() throws InterruptedException {
+        return adminTestAvailabilityAction.poll(10, TimeUnit.SECONDS);
+    }
+
+    void add(TestAvailabilityAction action) {
+        adminTestAvailabilityAction.add(action);
+    }
+
+    public LogoutAction getAdminLogoutAction() throws InterruptedException {
+        return adminLogoutActions.poll(10, TimeUnit.SECONDS);
+    }
+
+    void add(LogoutAction action) {
+        adminLogoutActions.add(action);
+    }
+
+    public void clear() {
+        adminLogoutActions.clear();
+        adminPushNotBeforeActions.clear();
+        adminTestAvailabilityAction.clear();
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthCallbackHandler.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthCallbackHandler.java
new file mode 100644
index 000000000000..ee67af46cc5e
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthCallbackHandler.java
@@ -0,0 +1,20 @@
+package org.keycloak.testframework.oauth;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+class OAuthCallbackHandler implements HttpHandler {
+
+    @Override
+    public void handle(HttpExchange exchange) throws IOException {
+        byte[] bytes = "<html><body>Happy days<div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body></html>".getBytes(StandardCharsets.UTF_8);
+        exchange.getResponseHeaders().set("Content-Type", "text/html");
+        exchange.sendResponseHeaders(200, bytes.length);
+        exchange.getResponseBody().write(bytes);
+        exchange.getResponseBody().close();
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClient.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClient.java
new file mode 100644
index 000000000000..b022938f6192
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClient.java
@@ -0,0 +1,31 @@
+package org.keycloak.testframework.oauth;
+
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.testframework.ui.page.LoginPage;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClientConfig;
+import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.support.PageFactory;
+
+public class OAuthClient extends AbstractOAuthClient<OAuthClient> {
+
+    public OAuthClient(String baseUrl, CloseableHttpClient httpClient, WebDriver webDriver) {
+        super(baseUrl, httpClient, webDriver);
+
+        config = new OAuthClientConfig()
+                .responseType(OAuth2Constants.CODE);
+    }
+
+    @Override
+    public void fillLoginForm(String username, String password) {
+        LoginPage loginPage = new LoginPage(driver);
+        PageFactory.initElements(driver, loginPage);
+        loginPage.fillLogin(username, password);
+        loginPage.submit();
+    }
+
+    public void close() {
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClientSupplier.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClientSupplier.java
new file mode 100644
index 000000000000..2c50127a1a0c
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthClientSupplier.java
@@ -0,0 +1,61 @@
+package org.keycloak.testframework.oauth;
+
+import org.apache.http.client.HttpClient;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.injection.SupplierHelpers;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testframework.util.ApiUtil;
+import org.openqa.selenium.WebDriver;
+
+public class OAuthClientSupplier implements Supplier<OAuthClient, InjectOAuthClient> {
+
+    @Override
+    public OAuthClient getValue(InstanceContext<OAuthClient, InjectOAuthClient> instanceContext) {
+        InjectOAuthClient annotation = instanceContext.getAnnotation();
+
+        KeycloakUrls keycloakUrls = instanceContext.getDependency(KeycloakUrls.class);
+        CloseableHttpClient httpClient = (CloseableHttpClient) instanceContext.getDependency(HttpClient.class);
+        WebDriver webDriver = instanceContext.getDependency(WebDriver.class);
+        TestApp testApp = instanceContext.getDependency(TestApp.class);
+
+        ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class, annotation.realmRef());
+
+        String redirectUri = testApp.getRedirectionUri();
+
+        ClientConfig clientConfig = SupplierHelpers.getInstance(annotation.config());
+        ClientRepresentation testAppClient = clientConfig.configure(ClientConfigBuilder.create())
+                .redirectUris(redirectUri)
+                .build();
+
+        if (annotation.kcAdmin()) {
+            testAppClient.setAdminUrl(testApp.getAdminUri());
+        }
+
+        String clientId = testAppClient.getClientId();
+        String clientSecret = testAppClient.getSecret();
+
+        ApiUtil.handleCreatedResponse(realm.admin().clients().create(testAppClient));
+
+        OAuthClient oAuthClient = new OAuthClient(keycloakUrls.getBase(), httpClient, webDriver);
+        oAuthClient.config().realm(realm.getName()).client(clientId, clientSecret).redirectUri(redirectUri);
+        return oAuthClient;
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<OAuthClient, InjectOAuthClient> a, RequestedInstance<OAuthClient, InjectOAuthClient> b) {
+        return a.getAnnotation().ref().equals(b.getAnnotation().ref());
+    }
+
+    @Override
+    public void close(InstanceContext<OAuthClient, InjectOAuthClient> instanceContext) {
+        instanceContext.getValue().close();
+    }
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthTestFrameworkExtension.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthTestFrameworkExtension.java
new file mode 100644
index 000000000000..5f5d2f1682ad
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/OAuthTestFrameworkExtension.java
@@ -0,0 +1,15 @@
+package org.keycloak.testframework.oauth;
+
+import org.keycloak.testframework.TestFrameworkExtension;
+import org.keycloak.testframework.injection.Supplier;
+
+import java.util.List;
+
+public class OAuthTestFrameworkExtension implements TestFrameworkExtension {
+
+    @Override
+    public List<Supplier<?, ?>> suppliers() {
+        return List.of(new OAuthClientSupplier(), new TestAppSupplier());
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestApp.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestApp.java
new file mode 100644
index 000000000000..01f04247567c
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestApp.java
@@ -0,0 +1,50 @@
+package org.keycloak.testframework.oauth;
+
+import com.sun.net.httpserver.HttpServer;
+
+public class TestApp {
+
+    public static final String OAUTH_CALLBACK_PATH = "/callback/oauth";
+    public static final String K_ADMIN_PATH = "/k_admin";
+
+    private final HttpServer httpServer;
+
+    private final KcAdminInvocations kcAdminInvocations;
+
+    private final String redirectionUri;
+    private final String adminUri;
+
+    public TestApp(HttpServer httpServer) {
+        this.httpServer = httpServer;
+        this.kcAdminInvocations = new KcAdminInvocations();
+
+        try {
+            httpServer.createContext(OAUTH_CALLBACK_PATH, new OAuthCallbackHandler());
+            httpServer.createContext(K_ADMIN_PATH, new KcAdminCallbackHandler(kcAdminInvocations));
+
+            redirectionUri = "http://127.0.0.1:" + httpServer.getAddress().getPort() + "/callback/oauth";
+            adminUri = "http://127.0.0.1:" + httpServer.getAddress().getPort() + "/k_admin";
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
+    public String getRedirectionUri() {
+        return redirectionUri;
+    }
+
+    public String getAdminUri() {
+        return adminUri;
+    }
+
+    public KcAdminInvocations kcAdmin() {
+        return kcAdminInvocations;
+    }
+
+    public void close() {
+        httpServer.removeContext(OAUTH_CALLBACK_PATH);
+        httpServer.removeContext(K_ADMIN_PATH);
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestAppSupplier.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestAppSupplier.java
new file mode 100644
index 000000000000..77d095f34549
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/TestAppSupplier.java
@@ -0,0 +1,27 @@
+package org.keycloak.testframework.oauth;
+
+import com.sun.net.httpserver.HttpServer;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.oauth.annotations.InjectTestApp;
+
+public class TestAppSupplier implements Supplier<TestApp, InjectTestApp> {
+
+    @Override
+    public TestApp getValue(InstanceContext<TestApp, InjectTestApp> instanceContext) {
+        HttpServer httpServer = instanceContext.getDependency(HttpServer.class);
+        return new TestApp(httpServer);
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<TestApp, InjectTestApp> a, RequestedInstance<TestApp, InjectTestApp> b) {
+        return true;
+    }
+
+    @Override
+    public void close(InstanceContext<TestApp, InjectTestApp> instanceContext) {
+        instanceContext.getValue().close();
+    }
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectOAuthClient.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectOAuthClient.java
new file mode 100644
index 000000000000..e830802a6708
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectOAuthClient.java
@@ -0,0 +1,26 @@
+package org.keycloak.testframework.oauth.annotations;
+
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.oauth.DefaultOAuthClientConfiguration;
+import org.keycloak.testframework.realm.ClientConfig;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectOAuthClient {
+
+    Class<? extends ClientConfig> config() default DefaultOAuthClientConfiguration.class;
+
+    LifeCycle lifecycle() default LifeCycle.CLASS;
+
+    String ref() default "";
+
+    String realmRef() default "";
+
+    boolean kcAdmin() default false;
+
+}
diff --git a/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectTestApp.java b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectTestApp.java
new file mode 100644
index 000000000000..0499859d2229
--- /dev/null
+++ b/test-framework/oauth/src/main/java/org/keycloak/testframework/oauth/annotations/InjectTestApp.java
@@ -0,0 +1,12 @@
+package org.keycloak.testframework.oauth.annotations;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectTestApp {
+
+}
diff --git a/test-framework/oauth/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension b/test-framework/oauth/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
new file mode 100644
index 000000000000..829e0f40ba2a
--- /dev/null
+++ b/test-framework/oauth/src/main/resources/META-INF/services/org.keycloak.testframework.TestFrameworkExtension
@@ -0,0 +1 @@
+org.keycloak.testframework.oauth.OAuthTestFrameworkExtension
\ No newline at end of file
diff --git a/test-framework/pom.xml b/test-framework/pom.xml
index a2aade2e49ed..ddd6f79d9133 100755
--- a/test-framework/pom.xml
+++ b/test-framework/pom.xml
@@ -35,6 +35,7 @@
     <modules>
         <module>bom</module>
         <module>core</module>
+        <module>junit5-config</module>
         <module>db-mariadb</module>
         <module>db-mssql</module>
         <module>db-mysql</module>
@@ -42,10 +43,11 @@
         <module>db-postgres</module>
         <module>email-server</module>
         <module>examples</module>
-        <module>oauth-nimbus-poc</module>
+        <module>oauth</module>
         <module>remote</module>
         <module>remote-providers</module>
         <module>ui</module>
+        <module>clustering</module>
     </modules>
 
 </project>
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServer.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServer.java
new file mode 100644
index 000000000000..e72db9f0879a
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServer.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import org.keycloak.models.KeycloakSession;
+
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface FetchOnServer extends Serializable {
+
+    Object run(KeycloakSession session);
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServerWrapper.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServerWrapper.java
new file mode 100644
index 000000000000..f38f06b24864
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/FetchOnServerWrapper.java
@@ -0,0 +1,12 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+/**
+ * Created by st on 26.01.17.
+ */
+public interface FetchOnServerWrapper<T> {
+
+    FetchOnServer getRunOnServer();
+
+    Class<T> getResultClass();
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java
new file mode 100644
index 000000000000..a0a75ff2ca48
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServer.java
@@ -0,0 +1,16 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import org.keycloak.common.VerificationException;
+import org.keycloak.models.KeycloakSession;
+
+import java.io.IOException;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface RunOnServer extends Serializable {
+
+    void run(KeycloakSession session) throws IOException, VerificationException;
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerException.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerException.java
new file mode 100644
index 000000000000..371becf297dc
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerException.java
@@ -0,0 +1,12 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+/**
+ * Created by st on 26.01.17.
+ */
+public class RunOnServerException extends RuntimeException {
+
+    public RunOnServerException(Throwable throwable) {
+        super(throwable);
+    }
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProvider.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProvider.java
new file mode 100644
index 000000000000..4ea46f3da352
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProvider.java
@@ -0,0 +1,52 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.util.JsonSerialization;
+
+public class RunOnServerRealmResourceProvider implements RealmResourceProvider {
+
+    private final KeycloakSession session;
+    private final ClassLoader classLoader;
+
+    public RunOnServerRealmResourceProvider(KeycloakSession session, ClassLoader classLoader) {
+        this.session = session;
+        this.classLoader = classLoader;
+    }
+
+    @Override
+    public Object getResource() {
+        return this;
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @POST
+    @Path("/")
+    @Consumes(MediaType.TEXT_PLAIN + ";charset=utf-8")
+    @Produces(MediaType.TEXT_PLAIN + ";charset=utf-8")
+    public String runOnServer(String runOnServer) {
+        try {
+            Object o = SerializationUtil.decode(runOnServer, classLoader);
+            if (o instanceof FetchOnServer f) {
+                Object result = f.run(session);
+                return result != null ? JsonSerialization.writeValueAsString(result) : null;
+            } else if (o instanceof RunOnServer r) {
+                r.run(session);
+                return null;
+            } else {
+                throw new IllegalArgumentException("Can't handle serialized class: " + o.getClass().getName());
+            }
+        } catch (Throwable t) {
+            return SerializationUtil.encodeException(t);
+        }
+    }
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProviderFactory.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProviderFactory.java
new file mode 100644
index 000000000000..92d109edb030
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/RunOnServerRealmResourceProviderFactory.java
@@ -0,0 +1,43 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.services.resource.RealmResourceProviderFactory;
+
+import java.net.MalformedURLException;
+
+public class RunOnServerRealmResourceProviderFactory implements RealmResourceProviderFactory {
+
+    private static final String ID = "testing-run-on-server";
+
+    private ClassLoader testClassLoader;
+
+    @Override
+    public RealmResourceProvider create(KeycloakSession session) {
+        return new RunOnServerRealmResourceProvider(session, testClassLoader);
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public void init(org.keycloak.Config.Scope config) {
+        try {
+            testClassLoader = new TestClassLoader();
+        } catch (MalformedURLException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/SerializationUtil.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/SerializationUtil.java
new file mode 100644
index 000000000000..e2e045a4a4d0
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/SerializationUtil.java
@@ -0,0 +1,75 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import org.keycloak.common.util.Base64;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.NotSerializableException;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.ObjectStreamClass;
+
+/**
+ * Created by st on 26.01.17.
+ */
+public class SerializationUtil {
+
+    public static String encode(Object function) {
+        try {
+            ByteArrayOutputStream os = new ByteArrayOutputStream();
+            ObjectOutputStream oos = new ObjectOutputStream(os);
+            oos.writeObject(function);
+            oos.close();
+
+            return Base64.encodeBytes(os.toByteArray());
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static Object decode(String encoded, ClassLoader classLoader) {
+        try {
+            byte[] bytes = Base64.decode(encoded);
+            ByteArrayInputStream is = new ByteArrayInputStream(bytes);
+            ObjectInputStream ois = new ObjectInputStream(is) {
+                @Override
+                protected Class<?> resolveClass(ObjectStreamClass c) throws ClassNotFoundException {
+                    return Class.forName(c.getName(), false, classLoader);
+                }
+            };
+
+            return ois.readObject();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static String encodeException(Throwable t) {
+        try {
+            ByteArrayOutputStream os = new ByteArrayOutputStream();
+            ObjectOutputStream oos = new ObjectOutputStream(os);
+            oos.writeObject(t);
+            oos.close();
+
+            return "EXCEPTION:" + Base64.encodeBytes(os.toByteArray());
+        } catch (NotSerializableException e) {
+            // when the exception can't be serialized, at least log the original exception, so it can be analyzed
+            throw new RuntimeException("Unable to serialize exception due to not serializable class " + e.getMessage(), t);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static Throwable decodeException(String result) {
+        try {
+            result = result.substring("EXCEPTION:".length());
+            byte[] bytes = Base64.decode(result);
+            ByteArrayInputStream is = new ByteArrayInputStream(bytes);
+            ObjectInputStream ois = new ObjectInputStream(is);
+            return (Throwable) ois.readObject();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/TestClassLoader.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/TestClassLoader.java
new file mode 100644
index 000000000000..09055c0bd538
--- /dev/null
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/runonserver/TestClassLoader.java
@@ -0,0 +1,29 @@
+package org.keycloak.testframework.remote.providers.runonserver;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+public class TestClassLoader extends URLClassLoader {
+
+    private static final String testClassUrl = "http://localhost:8500/test-classes/";
+
+    public TestClassLoader() throws MalformedURLException {
+        super(new URL[] { new URL(testClassUrl)}, TestClassLoader.class.getClassLoader());
+    }
+
+    @Override
+    protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
+        Class<?> loadClass = super.loadClass(name, resolve);
+
+        // When running in embedded mode all classes available on the test side are available in the system classloader.
+        // However, these will also load classes from the system classloader instead of the Quarkus classloader. To
+        // prevent this we are detecting if a class was loaded by the system classloader, and if it was we're forcing
+        // it to load the class from the remote test class provider.
+        if (loadClass != null && loadClass.getClassLoader() != null && loadClass.getClassLoader().equals(ClassLoader.getSystemClassLoader())) {
+            return findClass(name);
+        } else {
+            return loadClass;
+        }
+    }
+}
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProvider.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProvider.java
similarity index 95%
rename from test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProvider.java
rename to test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProvider.java
index e6abb1d0cac0..efb5f23c4c9c 100644
--- a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProvider.java
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProvider.java
@@ -1,4 +1,4 @@
-package org.keycloak.testframework.remote.providers;
+package org.keycloak.testframework.remote.providers.timeoffset;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
diff --git a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProviderFactory.java b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProviderFactory.java
similarity index 92%
rename from test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProviderFactory.java
rename to test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProviderFactory.java
index bfb9a6fe6045..53ae1f9dca04 100644
--- a/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/TimeOffSetRealmResourceProviderFactory.java
+++ b/test-framework/remote-providers/src/main/java/org/keycloak/testframework/remote/providers/timeoffset/TimeOffSetRealmResourceProviderFactory.java
@@ -1,4 +1,4 @@
-package org.keycloak.testframework.remote.providers;
+package org.keycloak.testframework.remote.providers.timeoffset;
 
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
diff --git a/test-framework/remote-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory b/test-framework/remote-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory
index 4fddd528af38..3cf85adb9619 100644
--- a/test-framework/remote-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory
+++ b/test-framework/remote-providers/src/main/resources/META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory
@@ -1 +1,2 @@
-org.keycloak.testframework.remote.providers.TimeOffSetRealmResourceProviderFactory
+org.keycloak.testframework.remote.providers.timeoffset.TimeOffSetRealmResourceProviderFactory
+org.keycloak.testframework.remote.providers.runonserver.RunOnServerRealmResourceProviderFactory
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteProvidersSupplier.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteProvidersSupplier.java
index 7d0a793f23e3..5a0df8534d58 100644
--- a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteProvidersSupplier.java
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteProvidersSupplier.java
@@ -11,15 +11,6 @@
 import org.keycloak.testframework.server.KeycloakServerConfigInterceptor;
 
 public class RemoteProvidersSupplier implements Supplier<RemoteProviders, InjectRemoteProviders>, KeycloakServerConfigInterceptor<TestDatabase, InjectTestDatabase> {
-    @Override
-    public Class<InjectRemoteProviders> getAnnotationClass() {
-        return InjectRemoteProviders.class;
-    }
-
-    @Override
-    public Class<RemoteProviders> getValueType() {
-        return RemoteProviders.class;
-    }
 
     @Override
     public RemoteProviders getValue(InstanceContext<RemoteProviders, InjectRemoteProviders> instanceContext) {
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteTestFrameworkExtension.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteTestFrameworkExtension.java
index 3a57630144d5..ab9ecdbbb6a7 100644
--- a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteTestFrameworkExtension.java
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/RemoteTestFrameworkExtension.java
@@ -3,6 +3,8 @@
 import org.keycloak.testframework.TestFrameworkExtension;
 import org.keycloak.testframework.injection.Supplier;
 import org.keycloak.testframework.remote.timeoffset.TimeOffsetSupplier;
+import org.keycloak.testframework.remote.runonserver.RunOnServerSupplier;
+import org.keycloak.testframework.remote.runonserver.TestClassServerSupplier;
 
 import java.util.List;
 
@@ -11,7 +13,9 @@ public class RemoteTestFrameworkExtension implements TestFrameworkExtension {
     public List<Supplier<?, ?>> suppliers() {
         return List.of(
                 new TimeOffsetSupplier(),
-                new RemoteProvidersSupplier()
+                new RunOnServerSupplier(),
+                new RemoteProvidersSupplier(),
+                new TestClassServerSupplier()
         );
     }
 
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectRunOnServer.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectRunOnServer.java
new file mode 100644
index 000000000000..0cecc1605f35
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectRunOnServer.java
@@ -0,0 +1,22 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import org.keycloak.testframework.injection.LifeCycle;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectRunOnServer {
+
+    LifeCycle lifecycle() default LifeCycle.CLASS;
+
+    String ref() default "";
+
+    String realmRef() default "";
+
+    String[] permittedPackages() default "";
+
+}
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectTestClassServer.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectTestClassServer.java
new file mode 100644
index 000000000000..2f496f8a84de
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/InjectTestClassServer.java
@@ -0,0 +1,16 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import org.keycloak.testframework.injection.LifeCycle;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.FIELD)
+public @interface InjectTestClassServer {
+
+    LifeCycle lifecycle() default LifeCycle.GLOBAL;
+
+}
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerClient.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerClient.java
new file mode 100644
index 000000000000..931c44898ad5
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerClient.java
@@ -0,0 +1,93 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.util.EntityUtils;
+import org.keycloak.testframework.remote.providers.runonserver.FetchOnServer;
+import org.keycloak.testframework.remote.providers.runonserver.FetchOnServerWrapper;
+import org.keycloak.testframework.remote.providers.runonserver.RunOnServer;
+import org.keycloak.testframework.remote.providers.runonserver.RunOnServerException;
+import org.keycloak.testframework.remote.providers.runonserver.SerializationUtil;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+
+public class RunOnServerClient {
+
+    private static final String RUN_ON_SERVER_ENDPOINT = "/testing-run-on-server";
+    private final HttpClient httpClient;
+    private final String url;
+
+    public RunOnServerClient(HttpClient httpClient, String realmUrl) {
+        this.httpClient = httpClient;
+        this.url = realmUrl + RUN_ON_SERVER_ENDPOINT;
+    }
+
+    public <T> T fetch(FetchOnServerWrapper<T> wrapper) throws RunOnServerException {
+        return fetch(wrapper.getRunOnServer(), wrapper.getResultClass());
+    }
+
+    public <T> T fetch(FetchOnServer function, Class<T> clazz) throws RunOnServerException {
+        try {
+            String s = fetchString(function);
+            return s == null ? null : JsonSerialization.readValue(s, clazz);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String fetchString(FetchOnServer function) throws RunOnServerException {
+        String encoded = SerializationUtil.encode(function);
+
+        String result = runOnServer(encoded);
+        if (result != null && !result.isEmpty() && result.trim().startsWith("EXCEPTION:")) {
+            Throwable t = SerializationUtil.decodeException(result);
+            if (t instanceof AssertionError) {
+                throw (AssertionError) t;
+            } else {
+                throw new RunOnServerException(t);
+            }
+        } else {
+            return result;
+        }
+    }
+
+    public void run(RunOnServer function) throws RunOnServerException {
+        String encoded = SerializationUtil.encode(function);
+
+        String result = runOnServer(encoded);
+        if (result != null && !result.isEmpty() && result.trim().startsWith("EXCEPTION:")) {
+            Throwable t = SerializationUtil.decodeException(result);
+            if (t instanceof AssertionError) {
+                throw (AssertionError) t;
+            } else {
+                throw new RunOnServerException(t);
+            }
+        }
+    }
+
+    public String runOnServer(String encoded) throws RunOnServerException {
+        try {
+            HttpPost request = new HttpPost(url);
+            request.setHeader("Content-type", "text/plain;charset=utf-8");
+            request.setEntity(new StringEntity(encoded));
+
+            HttpResponse response = httpClient.execute(request);
+            int statusCode = response.getStatusLine().getStatusCode();
+            if (statusCode == Response.Status.OK.getStatusCode()) {
+                return EntityUtils.toString(response.getEntity());
+            } else if (statusCode == Response.Status.NO_CONTENT.getStatusCode()) {
+                return null;
+            } else {
+                throw new WebApplicationException(String.format("Unexpected response status for RunOnServer: %s", statusCode));
+            }
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}
+
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerSupplier.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerSupplier.java
new file mode 100644
index 000000000000..e927a6cff1fd
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/RunOnServerSupplier.java
@@ -0,0 +1,45 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import org.apache.http.client.HttpClient;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.injection.SupplierOrder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.RemoteProviders;
+
+import java.util.Arrays;
+import java.util.HashSet;
+
+public class RunOnServerSupplier implements Supplier<RunOnServerClient, InjectRunOnServer> {
+
+    @Override
+    public RunOnServerClient getValue(InstanceContext<RunOnServerClient, InjectRunOnServer> instanceContext) {
+        HttpClient httpClient = instanceContext.getDependency(HttpClient.class);
+        ManagedRealm realm = instanceContext.getDependency(ManagedRealm.class, instanceContext.getAnnotation().realmRef());
+        instanceContext.getDependency(RemoteProviders.class);
+
+        TestClassServer testClassServer = instanceContext.getDependency(TestClassServer.class);
+        String[] permittedPackages = instanceContext.getAnnotation().permittedPackages();
+        testClassServer.addPermittedPackages(new HashSet<>(Arrays.asList(permittedPackages)));
+
+        return new RunOnServerClient(httpClient, realm.getBaseUrl());
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<RunOnServerClient, InjectRunOnServer> a, RequestedInstance<RunOnServerClient, InjectRunOnServer> b) {
+        return a.getAnnotation().realmRef().equals(b.getAnnotation().realmRef());
+    }
+
+    @Override
+    public LifeCycle getDefaultLifecycle() {
+        return LifeCycle.METHOD;
+    }
+
+    @Override
+    public int order() {
+        return SupplierOrder.BEFORE_KEYCLOAK_SERVER;
+    }
+
+}
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServer.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServer.java
new file mode 100644
index 000000000000..3f38c54b4ab8
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServer.java
@@ -0,0 +1,78 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import com.sun.net.httpserver.Headers;
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+import com.sun.net.httpserver.HttpServer;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashSet;
+import java.util.Set;
+
+public class TestClassServer {
+
+    public static final String CONTEXT_PATH = "/test-classes/";
+
+    private final HttpServer httpServer;
+
+    public static final Set<String> DEFAULT_PERMITTED_PACKAGES = Set.of(
+        "org.keycloak.testframework",
+        "org.junit",
+        "org.opentest4j"
+    );
+
+    private final Set<String> permittedPackages;
+
+    TestClassServer(HttpServer httpServer) {
+        this.httpServer = httpServer;
+        permittedPackages = new HashSet<>(DEFAULT_PERMITTED_PACKAGES);
+
+        httpServer.createContext(CONTEXT_PATH, new TestClassPathHandler());
+    }
+
+    public void addPermittedPackages(Set<String> permittedPackages) {
+        this.permittedPackages.addAll(permittedPackages);
+    }
+
+    public void close() {
+        httpServer.removeContext(CONTEXT_PATH);
+    }
+
+    private class TestClassPathHandler implements HttpHandler {
+
+        @Override
+        public void handle(HttpExchange httpExchange) throws IOException {
+            String resource = httpExchange.getRequestURI().getPath().substring(CONTEXT_PATH.length() - 1);
+
+            Headers respHeaders = httpExchange.getResponseHeaders();
+            respHeaders.set("Content-Type", "application/x-java-applet;charset=utf-8");
+
+            if (!isPermittedPackage(resource) || !resource.endsWith(".class")) {
+                httpExchange.sendResponseHeaders(403, 0);
+            } else {
+                try (InputStream resourceStream = TestClassServer.class.getResourceAsStream(resource)) {
+                    if (resourceStream != null) {
+                        byte[] bytes = resourceStream.readAllBytes();
+                        httpExchange.sendResponseHeaders(200, bytes.length);
+                        httpExchange.getResponseBody().write(bytes);
+                    } else {
+                        httpExchange.sendResponseHeaders(404, 0);
+                    }
+                }
+            }
+            httpExchange.close();
+        }
+
+        private boolean isPermittedPackage(String className) {
+            String c = className.substring(1).replace('/', '.');
+            for (String p : permittedPackages) {
+                if (c.startsWith(p)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+
+}
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServerSupplier.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServerSupplier.java
new file mode 100644
index 000000000000..46ba8a844732
--- /dev/null
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/runonserver/TestClassServerSupplier.java
@@ -0,0 +1,25 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import com.sun.net.httpserver.HttpServer;
+import org.keycloak.testframework.injection.InstanceContext;
+import org.keycloak.testframework.injection.RequestedInstance;
+import org.keycloak.testframework.injection.Supplier;
+
+public class TestClassServerSupplier implements Supplier<TestClassServer, InjectTestClassServer> {
+
+    @Override
+    public TestClassServer getValue(InstanceContext<TestClassServer, InjectTestClassServer> instanceContext) {
+        HttpServer httpServer = instanceContext.getDependency(HttpServer.class);
+        return new TestClassServer(httpServer);
+    }
+
+    @Override
+    public boolean compatible(InstanceContext<TestClassServer, InjectTestClassServer> a, RequestedInstance<TestClassServer, InjectTestClassServer> b) {
+        return true;
+    }
+
+    @Override
+    public void close(InstanceContext<TestClassServer, InjectTestClassServer> instanceContext) {
+        instanceContext.getValue().close();
+    }
+}
diff --git a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/timeoffset/TimeOffsetSupplier.java b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/timeoffset/TimeOffsetSupplier.java
index 832453fb7ff0..47e10af7f596 100644
--- a/test-framework/remote/src/main/java/org/keycloak/testframework/remote/timeoffset/TimeOffsetSupplier.java
+++ b/test-framework/remote/src/main/java/org/keycloak/testframework/remote/timeoffset/TimeOffsetSupplier.java
@@ -9,23 +9,7 @@
 import org.keycloak.testframework.remote.RemoteProviders;
 import org.keycloak.testframework.server.KeycloakUrls;
 
-import java.util.Set;
-
 public class TimeOffsetSupplier implements Supplier<TimeOffSet, InjectTimeOffSet> {
-    @Override
-    public Class<InjectTimeOffSet> getAnnotationClass() {
-        return InjectTimeOffSet.class;
-    }
-
-    @Override
-    public Class<TimeOffSet> getValueType() {
-        return TimeOffSet.class;
-    }
-
-    @Override
-    public Set<Class<?>> dependencies() {
-        return Set.of(HttpClient.class, RemoteProviders.class, KeycloakUrls.class);
-    }
 
     @Override
     public TimeOffSet getValue(InstanceContext<TimeOffSet, InjectTimeOffSet> instanceContext) {
@@ -49,11 +33,9 @@ public LifeCycle getDefaultLifecycle() {
 
     @Override
     public void close(InstanceContext<TimeOffSet, InjectTimeOffSet> instanceContext) {
-        if (instanceContext.getLifeCycle() != LifeCycle.METHOD) {
-            TimeOffSet timeOffSet = instanceContext.getValue();
-            if (timeOffSet.hasChanged()) {
-                timeOffSet.set(0);
-            }
+        TimeOffSet timeOffSet = instanceContext.getValue();
+        if (timeOffSet.hasChanged()) {
+            timeOffSet.set(0);
         }
     }
 
diff --git a/test-framework/remote/src/test/java/org/keycloak/testframework/remote/runonserver/TestClassServerTest.java b/test-framework/remote/src/test/java/org/keycloak/testframework/remote/runonserver/TestClassServerTest.java
new file mode 100644
index 000000000000..c4b8d5ca2c5f
--- /dev/null
+++ b/test-framework/remote/src/test/java/org/keycloak/testframework/remote/runonserver/TestClassServerTest.java
@@ -0,0 +1,53 @@
+package org.keycloak.testframework.remote.runonserver;
+
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.idm.RealmRepresentation;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Set;
+
+public class TestClassServerTest {
+
+    private static HttpServer SERVER;
+
+    @BeforeAll
+    public static void setupServer() throws IOException {
+        SERVER = HttpServer.create(new InetSocketAddress("127.0.0.1", 8500), 10);
+        SERVER.start();
+    }
+
+    @AfterAll
+    public static void closeServer() {
+        SERVER.stop(0);
+    }
+
+    @Test
+    public void testPermittedPackage() throws ClassNotFoundException, MalformedURLException {
+        TestClassServer server = new TestClassServer(SERVER);
+        server.addPermittedPackages(Set.of("org.keycloak.representations.idm"));
+
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[] { new URL("http://localhost:8500/test-classes/") }, null);
+        Assertions.assertNotNull(urlClassLoader.loadClass(RealmRepresentation.class.getName()));
+
+        server.close();
+    }
+
+    @Test
+    public void testInvalidPackage() throws MalformedURLException {
+        TestClassServer server = new TestClassServer(SERVER);
+
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[] { new URL("http://localhost:8500/test-classes/") }, null);
+        Assertions.assertThrows(ClassNotFoundException.class, () -> urlClassLoader.loadClass(RealmRepresentation.class.getName()));
+
+        server.close();
+    }
+
+}
diff --git a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/AbstractPage.java b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/AbstractPage.java
index 1dd040e18963..850dc832dad0 100644
--- a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/AbstractPage.java
+++ b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/AbstractPage.java
@@ -1,9 +1,17 @@
 package org.keycloak.testframework.ui.page;
 
 import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.WebElement;
+import org.openqa.selenium.support.FindBy;
 import org.openqa.selenium.support.PageFactory;
+import org.openqa.selenium.support.ui.WebDriverWait;
 
-public class AbstractPage {
+import java.time.Duration;
+
+public abstract class AbstractPage {
+
+    @FindBy(xpath = "//body")
+    private WebElement body;
 
     protected final WebDriver driver;
 
@@ -12,4 +20,22 @@ public AbstractPage(WebDriver driver) {
         PageFactory.initElements(driver, this);
     }
 
+    public abstract String getExpectedPageId();
+
+    public String getCurrentPageId() {
+        return body.getAttribute("data-page-id");
+    }
+
+    public void waitForPage() {
+        try {
+            new WebDriverWait(driver, Duration.ofSeconds(10)).until(d -> isActivePage());
+        } catch (RuntimeException e) {
+            throw new RuntimeException("Waiting for '" + getExpectedPageId() + "', but was '" + getCurrentPageId() + "'");
+        }
+    }
+
+    public boolean isActivePage() {
+        return getExpectedPageId().equals(getCurrentPageId());
+    }
+
 }
diff --git a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/LoginPage.java b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/LoginPage.java
index 589617dcf9e7..6f12c5b845e6 100644
--- a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/LoginPage.java
+++ b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/LoginPage.java
@@ -28,4 +28,8 @@ public void submit() {
         submitButton.click();
     }
 
+    @Override
+    public String getExpectedPageId() {
+        return "login-login";
+    }
 }
diff --git a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/PageSupplier.java b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/PageSupplier.java
index 41bc81d23dad..0b4f6bd9214f 100644
--- a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/PageSupplier.java
+++ b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/PageSupplier.java
@@ -10,16 +10,6 @@
 
 public class PageSupplier  implements Supplier<AbstractPage, InjectPage> {
 
-    @Override
-    public Class<InjectPage> getAnnotationClass() {
-        return InjectPage.class;
-    }
-
-    @Override
-    public Class<AbstractPage> getValueType() {
-        return AbstractPage.class;
-    }
-
     @Override
     public AbstractPage getValue(InstanceContext<AbstractPage, InjectPage> instanceContext) {
         WebDriver webDriver = instanceContext.getDependency(WebDriver.class);
diff --git a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/WelcomePage.java b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/WelcomePage.java
index c39a4b634014..dc6b64fbae43 100644
--- a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/WelcomePage.java
+++ b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/page/WelcomePage.java
@@ -27,6 +27,9 @@ public class WelcomePage extends AbstractPage {
     @FindBy(css = ".pf-v5-c-login__main-header-desc")
     private WebElement welcomeDescription;
 
+    @FindBy(css = ".pf-v5-c-button")
+    private WebElement openAdminConsoleLink;
+
     public WelcomePage(WebDriver driver) {
         super(driver);
     }
@@ -45,6 +48,10 @@ public void submit() {
         submitButton.click();
     }
 
+    public void clickOpenAdminConsole() {
+        openAdminConsoleLink.click();
+    }
+
     public String getWelcomeMessage() {
         return welcomeMessage.getText();
     }
@@ -57,4 +64,8 @@ public String getPageAlert() {
         return pageAlert.getText();
     }
 
+    @Override
+    public String getExpectedPageId() {
+        return "welcome";
+    }
 }
diff --git a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/webdriver/AbstractWebDriverSupplier.java b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/webdriver/AbstractWebDriverSupplier.java
index 313ca9a81122..f3cb88732b57 100644
--- a/test-framework/ui/src/main/java/org/keycloak/testframework/ui/webdriver/AbstractWebDriverSupplier.java
+++ b/test-framework/ui/src/main/java/org/keycloak/testframework/ui/webdriver/AbstractWebDriverSupplier.java
@@ -1,10 +1,10 @@
 package org.keycloak.testframework.ui.webdriver;
 
-import org.keycloak.testframework.ui.annotations.InjectWebDriver;
 import org.keycloak.testframework.injection.InstanceContext;
 import org.keycloak.testframework.injection.LifeCycle;
 import org.keycloak.testframework.injection.RequestedInstance;
 import org.keycloak.testframework.injection.Supplier;
+import org.keycloak.testframework.ui.annotations.InjectWebDriver;
 import org.openqa.selenium.MutableCapabilities;
 import org.openqa.selenium.PageLoadStrategy;
 import org.openqa.selenium.WebDriver;
@@ -15,16 +15,6 @@
 
 public abstract class AbstractWebDriverSupplier implements Supplier<WebDriver, InjectWebDriver> {
 
-    @Override
-    public Class<InjectWebDriver> getAnnotationClass() {
-        return InjectWebDriver.class;
-    }
-
-    @Override
-    public Class<WebDriver> getValueType() {
-        return WebDriver.class;
-    }
-
     @Override
     public WebDriver getValue(InstanceContext<WebDriver, InjectWebDriver> instanceContext) {
         return getWebDriver();
diff --git a/tests/MANUAL_MIGRATION.md b/tests/MANUAL_MIGRATION.md
new file mode 100644
index 000000000000..4b03f4234ad0
--- /dev/null
+++ b/tests/MANUAL_MIGRATION.md
@@ -0,0 +1,77 @@
+### Basics
+
+Check the [MIGRATING_TESTS guide](./MIGRATING_TESTS.md) first if you have not already done so.
+
+When migrating tests use the remote server mode as this will make it much quicker to run tests than having to start/stop
+Keycloak when you run the test from the IDE.
+
+Add `@KeycloakIntegrationTest` to the class.
+
+Change `import org.junit.Test;` to `import org.junit.jupiter.api.Test;`
+
+Change `org.junit.Before` to `org.junit.jupiter.api.BeforeEach`
+
+Remove extends `AbstractKeycloakTest` as the new test framework provides injection of resources needed by the test there
+is no need for the `AbstractKeycloakTest` and tests should instead inject what they need.
+
+One thing your test is most likely going to need is a realm, this is now done with:
+
+```
+@InjectRealm
+ManagedRealm realm;
+```
+
+With this change, most of the time you do not need to get the `RealmResource` via an admin client. Instead, you can use
+`realm.admin()`
+
+### Changed packages/classes
+
+| Old                                         | New                                            |
+|---------------------------------------------|------------------------------------------------|
+| org.junit.Assert                            | org.junit.jupiter.api.Assertions               |
+| org.keycloak.testsuite.Assert               | org.keycloak.tests.utils.Assert                |
+| org.junit.Test                              | org.junit.jupiter.api.Test                     |
+| org.keycloak.testsuite.admin.ApiUtil        | org.keycloak.tests.utils.admin.ApiUtil         |
+| org.keycloak.testsuite.util.AdminEventPaths | org.keycloak.tests.utils.admin.AdminEventPaths |
+
+### Assertions
+
+Change `import org.junit.Assert;` to `import org.junit.jupiter.api.Assertions;`, and replace `Assert.` with `Assertions.` throughout.
+
+If the assert passes a message (for example `Assert.assertEquals("Message", expected, actual)`) the message in `Assertions`
+is now the last parameter (for example `Assertions.assertEquals(expected, actual, "Message")`).
+
+### Admin events
+
+Admin events are handled slightly differently in the new test framework.
+
+An example for the old testsuite:
+
+```
+@Rule
+public AssertAdminEvents assertAdminEvents = new AssertAdminEvents(this);
+
+public void myTest() {
+    assertAdminEvents.assertEvent(realmId, OperationType.CREATE, ...);
+}
+```
+
+Converted to the new test framework:
+
+```
+@InjectAdminEvents
+public AdminEvents adminEvents;
+
+public void myTest() {
+    AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, ...);
+}
+```
+
+Notice that there is no need to pass `realmId` when asserting an event, that is because the `AdminEvents` will only
+receive events for the current realm.
+
+For better readability `AdminEventAssertion` provides a method chaining approach to assert various fields in the event 
+(the example above could be change to `AdminEventAssertion.assertSuccess(adminEvents.poll()).operationType(OperationType.CREATE)...`).
+
+There is also improved support for skipping events using skip methods, that allows skipping one event (`.skip()`), 
+multiple events (`.skip(5)`), or skipping all previous events (`.skipAll()`).
diff --git a/tests/MIGRATING_TESTS.md b/tests/MIGRATING_TESTS.md
new file mode 100644
index 000000000000..220fb9c26e89
--- /dev/null
+++ b/tests/MIGRATING_TESTS.md
@@ -0,0 +1,78 @@
+# How to migrate tests to the new framework?
+
+## TLDR
+
+1. cd into the [`migration-util` module](./migration-util)
+2. Use the [migration script](./migration-util/migrate.sh)
+    ```shell
+    ./migrate.sh SomeTest
+    ```
+   **The script doesn't work?** Follow the [MANUAL_MIGRATION guide](./MANUAL_MIGRATION.md).
+3. Fix the rest of the test class. To speed up the process, use the remote server mode when running the test.
+4. Use the [commit-migration script](./migration-util/commit-migration.sh) to commit the changes correctly:
+    ```shell
+    ./commit-migration.sh
+    ```
+5. On the PR on GitHub, review the commit that modifies the files
+6. Do not squash the commits when merging the PR
+
+## Migration process
+
+Migrating tests involves doing a lot of repetitive tasks. We made some automation tooling in the
+[`migration-util` module](./migration-util) to make it less annoying.
+
+### Migrating test classes
+
+To migrate a test class, you can use the [migrate script](./migration-util/migrate.sh).
+
+cd into the [`migration-util` module](./migration-util) and run:
+```shell
+./migrate.sh SomeTest
+```
+
+The script accepts one parameter that can be either a class name or an absolute path to the file. By default, look-up
+starts from [`testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite`](../testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite).
+
+When run, the script copies the test class and rewrites or adds common test statements, such as:
+- adds the `@KeycloakIntegrationTest` annotation
+- changes JUnit 4's `@Before` to JUnit 5's `@BeforeEach`
+- updates JUnit 4's assertions with their JUnit 5's counterparts
+
+And more.
+
+Besides the printed logs, you can pass the script a diff tool to see the changes made:
+
+```shell
+DIFFTOOL="diff --color=always" ./migrate.sh SomeTest
+```
+```shell
+DIFFTOOL="meld" ./migrate.sh SomeTest
+```
+
+If the script fails and throws an exception, you can try to fix it or refer to the
+[MANUAL_MIGRATION guide](./MANUAL_MIGRATION.md).
+
+The migrated test shall be in the same package in
+[`tests/base/src/test/java/org/keycloak/tests`](../tests/base/src/test/java/org/keycloak/tests).
+When migrating tests, use the remote server mode, as this will make it much quicker to run tests than having to start/stop
+Keycloak when you run the test from the IDE.
+
+### Committing changes
+
+Migrating some tests requires changing more than 50% of the test class. For this reason, git thinks a new file was
+created instead of moved. This causes us to lose the history of the test file. To mitigate this, we have a script to make
+all commits for you.
+
+In the [`migration-util` module](./migration-util) run:
+```shell
+./commit-migration.sh
+```
+
+The script works only with your git staging area. If it detects the same files are marked as deleted and created, it makes
+one commit where the files are moved unchanged to the new location. Then, it commits the changes with the rest of
+your staging area. You will be prompted to provide a commit message if you do not wish to use the default one.
+
+When you create a PR and check the "Files changed" tab, you will still see them as deleted and created, which makes the
+code review hard. Instead, go to the "Commits" tab and **review the commit that modifies the already moved file**.
+
+**Do not squash the commits** when merging the PR, or the file history will be lost again.
diff --git a/tests/MOVING_TESTS.md b/tests/MOVING_TESTS.md
deleted file mode 100644
index 55e02dd36453..000000000000
--- a/tests/MOVING_TESTS.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# Instructions for moving and refactoring tests to the new testsuite
-
-When moving and refactoring tests from the old testsuite to the new one it might happen that, once the changes are commited, 
-the git history of the file is lost. This is due to the way that git internally handles file renames.
-
-In order to preserve the file history, we have come up with a procedure that will work as the following describes.
-
-Let's assume we are migrating `SampleTest.java` to the new testsuite.
-
-1. Move the file `SampleTest.java` (without modifying the content) to the new location using any method you like (`mv`, `git mv`, cut and paste, etc.).
-2. Commit that movement using a commit message like `Move SampleTest.java to the new testsuite`.
-3. Do all the necessary changes and refactors in the file for using the new testing framework.
-4. Commit the refactoring using a commit message like `Refactor SampleTest to use the new testing framework`.
-5. Push the changes and create a pull request that will contain both commits.
-
-Once the pull request is created, it might happen that in the `Files changed` tab we see one file deleted 
-and a new one (with the refactored code) created. This can make difficult the code review, since we don't see the differences
-with the previous code.
-
-For seeing the changes as in a usual pull request go to the `Commits (2)` tab and select the commit that refactors the code. Comments,
-reviews and conversations can be added here and will be visible in the rest of the pull request sections.
\ No newline at end of file
diff --git a/tests/base/pom.xml b/tests/base/pom.xml
index 2b1fcb203b76..8a88c467391b 100755
--- a/tests/base/pom.xml
+++ b/tests/base/pom.xml
@@ -48,6 +48,10 @@
             <groupId>org.keycloak.testframework</groupId>
             <artifactId>keycloak-test-framework-core</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-junit5-config</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak.testframework</groupId>
             <artifactId>keycloak-test-framework-ui</artifactId>
@@ -78,7 +82,11 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak.testframework</groupId>
-            <artifactId>keycloak-test-framework-oauth-nimbus-poc</artifactId>
+            <artifactId>keycloak-test-framework-oauth</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-remote</artifactId>
         </dependency>
         <dependency>
             <groupId>org.keycloak.tests</groupId>
@@ -86,6 +94,22 @@
             <version>${project.version}</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak.tests</groupId>
+            <artifactId>keycloak-tests-utils-shared</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.tests</groupId>
+            <artifactId>keycloak-tests-custom-providers</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.tests</groupId>
+            <artifactId>keycloak-tests-custom-scripts</artifactId>
+            <version>${project.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.junit.platform</groupId>
             <artifactId>junit-platform-suite</artifactId>
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AbstractPermissionsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AbstractPermissionsTest.java
new file mode 100644
index 000000000000..b0ec40535658
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AbstractPermissionsTest.java
@@ -0,0 +1,306 @@
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.services.resources.admin.AdminAuth;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.MailServerConfiguration;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.fail;
+
+@KeycloakIntegrationTest(config = AbstractPermissionsTest.PermissionsTestServerConfig.class)
+public class AbstractPermissionsTest {
+
+    @InjectRealm(attachTo = "master", ref = "masterRealm")
+    ManagedRealm managedMasterRealm;
+
+    @InjectAdminClientFactory
+    protected AdminClientFactory adminClientFactory;
+
+    @InjectAdminClient
+    protected Keycloak adminClient;
+
+    protected static final String REALM_NAME = "permissions-test";
+    protected static final String REALM_2_NAME = "realm2";
+
+    protected Map<String, Keycloak> clients = new HashMap<>();
+
+    @BeforeEach
+    public void beforeEach() { // todo rewrite
+        Response response = managedMasterRealm.admin().users().create(UserConfigBuilder.create()
+                .username("permissions-test-master-none")
+                .password("password")
+                .build()
+        );
+        String userUuid = ApiUtil.getCreatedId(response);
+        managedMasterRealm.cleanup().add(r -> r.users().delete(userUuid));
+
+        for (String role : AdminRoles.ALL_REALM_ROLES) {
+            response = managedMasterRealm.admin().users().create(UserConfigBuilder.create()
+                    .username("permissions-test-master-" + role)
+                    .password("password")
+                    .build());
+            String roleUserUuid = ApiUtil.getCreatedId(response);
+            managedMasterRealm.cleanup().add(r -> r.users().delete(roleUserUuid));
+
+            String clientUuid = managedMasterRealm.admin().clients().findByClientId(REALM_NAME + "-realm").get(0).getId();
+            RoleRepresentation roleRep = managedMasterRealm.admin().clients().get(clientUuid).roles().get(role).toRepresentation();
+            managedMasterRealm.admin().users().get(roleUserUuid).roles().clientLevel(clientUuid).add(Collections.singletonList(roleRep));
+        }
+
+        clients.put(AdminRoles.REALM_ADMIN,
+                adminClientFactory.create().realm(REALM_NAME).username(AdminRoles.REALM_ADMIN).password("password").clientId("test-client").clientSecret("secret").build());
+
+        clients.put("none",
+                adminClientFactory.create().realm(REALM_NAME).username("none").password("password").clientId("test-client").clientSecret("secret").build());
+
+        clients.put("multi",
+                adminClientFactory.create().realm(REALM_NAME).username("multi").password("password").clientId("test-client").clientSecret("secret").build());
+
+        for (String role : AdminRoles.ALL_REALM_ROLES) {
+            clients.put(role, adminClientFactory.create().realm(REALM_NAME).username(role).password("password").clientId("test-client").build());
+        }
+
+        clients.put("REALM2", adminClientFactory.create().realm(REALM_2_NAME).username("admin").password("password").clientId("test-client").build());
+
+        clients.put("master-admin", adminClient);
+
+        clients.put("master-none", adminClientFactory.create().realm("master").username("permissions-test-master-none").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build());
+
+        for (String role : AdminRoles.ALL_REALM_ROLES) {
+            clients.put("master-" + role,
+                    adminClientFactory.create().realm("master").username("permissions-test-master-" + role).password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build());
+        }
+
+    }
+
+    protected void invoke(final Invocation invocation, AdminAuth.Resource resource, boolean manage) {
+        invoke((realm, response) ->
+                        invocation.invoke(realm),
+                resource, manage);
+    }
+
+    protected void invoke(final Invocation invocation, AdminAuth.Resource resource, boolean manage, boolean skipDifferentRole) {
+        invoke((realm, response) ->
+                        invocation.invoke(realm),
+                resource, manage, skipDifferentRole);
+    }
+
+    protected void invoke(InvocationWithResponse invocation, AdminAuth.Resource resource, boolean manage) {
+        invoke(invocation, resource, manage, false);
+    }
+
+    protected void invoke(InvocationWithResponse invocation, AdminAuth.Resource resource, boolean manage, boolean skipDifferentRole) {
+        String viewRole = getViewRole(resource);
+        String manageRole = getManageRole(resource);
+        String differentViewRole = getDifferentViewRole(resource);
+        String differentManageRole = getDifferentManageRole(resource);
+
+        invoke(invocation, clients.get("master-none"), false);
+        invoke(invocation, clients.get("master-admin"), true);
+        invoke(invocation, clients.get("master-" + viewRole), !manage);
+        invoke(invocation, clients.get("master-" + manageRole), true);
+        if (!skipDifferentRole) {
+            invoke(invocation, clients.get("master-" + differentViewRole), false);
+            invoke(invocation, clients.get("master-" + differentManageRole), false);
+        }
+
+        invoke(invocation, clients.get("none"), false);
+        invoke(invocation, clients.get(AdminRoles.REALM_ADMIN), true);
+        invoke(invocation, clients.get(viewRole), !manage);
+        invoke(invocation, clients.get(manageRole), true);
+        if (!skipDifferentRole) {
+            invoke(invocation, clients.get(differentViewRole), false);
+            invoke(invocation, clients.get(differentManageRole), false);
+        }
+
+        invoke(invocation, clients.get("REALM2"), false);
+    }
+
+    protected void invoke(final Invocation invocation, Keycloak client, boolean expectSuccess) {
+        invoke((realm, response) ->
+                        invocation.invoke(realm),
+                client, expectSuccess);
+    }
+
+    protected void invoke(InvocationWithResponse invocation, Keycloak client, boolean expectSuccess) {
+        int statusCode;
+        try {
+            AtomicReference<Response> responseReference = new AtomicReference<>();
+            invocation.invoke(client.realm(REALM_NAME), responseReference);
+            Response response = responseReference.get();
+            if (response != null) {
+                statusCode = response.getStatus();
+            } else {
+                // OK (we don't care about the exact status code
+                statusCode = 200;
+            }
+        } catch (ClientErrorException e) {
+            statusCode = e.getResponse().getStatus();
+        }
+
+        if (expectSuccess) {
+            if (!(statusCode == 200 || statusCode == 201 || statusCode == 204 || statusCode == 404 || statusCode == 409 || statusCode == 400)) {
+                fail("Expected permitted, but was " + statusCode);
+            }
+        } else {
+            if (statusCode != 403) {
+                fail("Expected 403, but was " + statusCode);
+            }
+        }
+    }
+
+    private String getViewRole(AdminAuth.Resource resource) {
+        return switch (resource) {
+            case CLIENT -> AdminRoles.VIEW_CLIENTS;
+            case USER -> AdminRoles.VIEW_USERS;
+            case REALM -> AdminRoles.VIEW_REALM;
+            case EVENTS -> AdminRoles.VIEW_EVENTS;
+            case IDENTITY_PROVIDER -> AdminRoles.VIEW_IDENTITY_PROVIDERS;
+            case AUTHORIZATION -> AdminRoles.VIEW_AUTHORIZATION;
+            default -> throw new RuntimeException("Unexpected resource");
+        };
+    }
+
+    private String getManageRole(AdminAuth.Resource resource) {
+        return switch (resource) {
+            case CLIENT -> AdminRoles.MANAGE_CLIENTS;
+            case USER -> AdminRoles.MANAGE_USERS;
+            case REALM -> AdminRoles.MANAGE_REALM;
+            case EVENTS -> AdminRoles.MANAGE_EVENTS;
+            case IDENTITY_PROVIDER -> AdminRoles.MANAGE_IDENTITY_PROVIDERS;
+            case AUTHORIZATION -> AdminRoles.MANAGE_AUTHORIZATION;
+            default -> throw new RuntimeException("Unexpected resource");
+        };
+    }
+
+    private String getDifferentViewRole(AdminAuth.Resource resource) {
+        return switch (resource) {
+            case CLIENT -> AdminRoles.VIEW_USERS;
+            case USER -> AdminRoles.VIEW_CLIENTS;
+            case REALM -> AdminRoles.VIEW_EVENTS;
+            case EVENTS, AUTHORIZATION -> AdminRoles.VIEW_IDENTITY_PROVIDERS;
+            case IDENTITY_PROVIDER -> AdminRoles.VIEW_REALM;
+            default -> throw new RuntimeException("Unexpected resouce");
+        };
+    }
+
+    private String getDifferentManageRole(AdminAuth.Resource resource) {
+        return switch (resource) {
+            case CLIENT -> AdminRoles.MANAGE_USERS;
+            case USER -> AdminRoles.MANAGE_CLIENTS;
+            case REALM -> AdminRoles.MANAGE_EVENTS;
+            case EVENTS, AUTHORIZATION -> AdminRoles.MANAGE_IDENTITY_PROVIDERS;
+            case IDENTITY_PROVIDER -> AdminRoles.MANAGE_REALM;
+            default -> throw new RuntimeException("Unexpected resouce");
+        };
+    }
+
+    protected interface Invocation {
+
+        void invoke(RealmResource realm);
+
+    }
+
+    protected interface InvocationWithResponse {
+
+        void invoke(RealmResource realm, AtomicReference<Response> response);
+
+    }
+
+    static class PermissionsTestServerConfig implements KeycloakServerConfig {
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.features(Profile.Feature.AUTHORIZATION);
+        }
+    }
+
+    protected static class PermissionsTestRealmConfig1 implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.name(REALM_NAME);
+            realm.addClient("test-client")
+                    .enabled(true)
+                    .publicClient(true)
+                    .directAccessGrants();
+
+            realm.addUser(AdminRoles.REALM_ADMIN)
+                    .name("realm-admin", "realm-admin")
+                    .email("realmadmin@localhost.com")
+                    .password("password")
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+
+            realm.addUser("multi")
+                    .name("multi", "multi")
+                    .email("multi@localhost.com")
+                    .password("password")
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.QUERY_GROUPS, AdminRoles.MANAGE_REALM, AdminRoles.VIEW_CLIENTS);
+
+            realm.addUser("none")
+                    .name("none", "none")
+                    .email("none@localhost.com")
+                    .password("password");
+
+            for (String role : AdminRoles.ALL_REALM_ROLES) {
+                realm.addUser(role)
+                        .name(role, role)
+                        .email(role + "@localhost.com")
+                        .password("password")
+                        .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, role);
+            }
+
+            realm.addUser("admin")
+                    .name("admin", "admin")
+                    .email("admin" + "@localhost.com")
+                    .password("password")
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+
+            realm.smtp(MailServerConfiguration.HOST, Integer.parseInt(MailServerConfiguration.PORT), MailServerConfiguration.FROM);
+
+            return realm;
+        }
+    }
+
+    protected static class PermissionsTestRealmConfig2 implements RealmConfig {
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.name(REALM_2_NAME);
+
+            realm.addClient("test-client")
+                    .publicClient(true)
+                    .directAccessGrants();
+
+            realm.addUser("admin")
+                    .name("admin", "admin")
+                    .email("admin" + "@localhost.com")
+                    .password("password")
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminConsoleWhoAmILocaleTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminConsoleWhoAmILocaleTest.java
new file mode 100644
index 000000000000..3078bee88b36
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminConsoleWhoAmILocaleTest.java
@@ -0,0 +1,354 @@
+package org.keycloak.tests.admin;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.ws.rs.core.Response;
+import org.apache.http.Header;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.message.BasicHeader;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectHttpClient;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfig;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+import java.io.IOException;
+import java.util.List;
+
+import static org.keycloak.models.Constants.ADMIN_CLI_CLIENT_ID;
+
+@KeycloakIntegrationTest
+public class AdminConsoleWhoAmILocaleTest {
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm masterRealm;
+
+    @InjectRealm(ref = "realm-i18n-off", config = LocaleOffRealmConfig.class)
+    ManagedRealm managedRealmOff;
+
+    @InjectRealm(ref = "realm-i18n-on", config = LocaleOnRealmConfig.class)
+    ManagedRealm managedRealmOn;
+
+    @InjectUser(realmRef = "master", config = MasterAdminUserConfig.class)
+    ManagedUser masterAdmin;
+
+    @InjectClient(realmRef = "master", config = MasterAdminClientConfig.class)
+    ManagedClient masterClient;
+
+    @InjectOAuthClient(ref = "master", realmRef = "master")
+    OAuthClient oAuthClientMaster;
+
+    @InjectOAuthClient(ref = "locale-off", realmRef = "realm-i18n-off")
+    OAuthClient oAuthClientLocaleOff;
+
+    @InjectOAuthClient(ref = "locale-on", realmRef = "realm-i18n-on")
+    OAuthClient oAuthClientLocaleOn;
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    @InjectHttpClient
+    CloseableHttpClient client;
+
+    private static final String REALM_I18N_OFF = "realm-i18n-off";
+    private static final String REALM_I18N_ON = "realm-i18n-on";
+    private static final String USER_WITHOUT_LOCALE = "user-without-locale";
+    private static final String USER_WITH_LOCALE = "user-with-locale";
+    private static final String USER_NO_ACCESS = "user-no-access";
+    private static final String PASSWORD = "password";
+    private static final String ADMIN_CLI_NOT_ALLOWED = "admin-cli-not-allowed";
+    private static final String SECRET = "secret";
+    private static final String DEFAULT_LOCALE = "en";
+    private static final String REALM_LOCALE = "no";
+    private static final String USER_LOCALE = "de";
+    private static final String EXTRA_LOCALE = "zh-CN";
+
+    @Test
+    public void testLocaleRealmI18nDisabledUserWithoutLocale() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOff, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITHOUT_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOff), response);
+
+        Assertions.assertEquals(REALM_I18N_OFF, whoAmI.get("realm").asText());
+        Assertions.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_OFF, whoAmI);
+
+        oAuthClientLocaleOff.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmI18nDisabledUserWithLocale() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOff, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITH_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOff), response);
+
+        Assertions.assertEquals(REALM_I18N_OFF, whoAmI.get("realm").asText());
+        Assertions.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_OFF, whoAmI);
+
+        oAuthClientLocaleOff.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmI18nEnabledUserWithoutLocale() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITHOUT_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOn), response);
+
+        Assertions.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
+        Assertions.assertEquals(REALM_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_ON, whoAmI);
+
+        oAuthClientLocaleOn.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmI18nEnabledUserWithLocale() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITH_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOn), response);
+
+        Assertions.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
+        Assertions.assertEquals(USER_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_ON, whoAmI);
+
+        oAuthClientLocaleOn.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmI18nEnabledAcceptLanguageHeader() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITHOUT_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOn), response, new BasicHeader("Accept-Language", EXTRA_LOCALE));
+
+        Assertions.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
+        Assertions.assertEquals(EXTRA_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_ON, whoAmI);
+
+        oAuthClientLocaleOn.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmI18nEnabledKeycloakLocaleCookie() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_CLIENT_ID, SECRET, USER_WITHOUT_LOCALE, PASSWORD);
+
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(managedRealmOn), response, new BasicHeader("Cookie", "KEYCLOAK_LOCALE=" + EXTRA_LOCALE));
+
+        Assertions.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
+        Assertions.assertEquals(EXTRA_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_ON, whoAmI);
+
+        oAuthClientLocaleOn.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testMasterRealm() throws Exception {
+        updateMasterAdminRole();
+        AccessTokenResponse response = accessToken(oAuthClientMaster, masterClient.getClientId(), SECRET, masterAdmin.getUsername(), PASSWORD);
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(masterRealm), response);
+        Assertions.assertEquals(masterRealm.getName(), whoAmI.get("realm").asText());
+        Assertions.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(masterRealm.getName(), whoAmI);
+        oAuthClientMaster.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testMasterRealmCurrentRealm() throws Exception {
+        updateMasterAdminRole();
+        AccessTokenResponse response = accessToken(oAuthClientMaster, masterClient.getClientId(), SECRET, masterAdmin.getUsername(), PASSWORD);
+        JsonNode whoAmI = getHttpJsonResponse(whoAmiUrl(masterRealm, REALM_I18N_ON), response);
+        Assertions.assertEquals(masterRealm.getName(), whoAmI.get("realm").asText());
+        Assertions.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
+        checkRealmAccess(REALM_I18N_ON, whoAmI);
+        oAuthClientMaster.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmNoToken() throws Exception {
+        HttpGet httpGet = new HttpGet(whoAmiUrl(managedRealmOn));
+        httpGet.addHeader("Accept", "application/json");
+
+        CloseableHttpResponse httpGetResponse = client.execute(httpGet);
+        Assertions.assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), httpGetResponse.getStatusLine().getStatusCode());
+        httpGetResponse.close();
+    }
+
+    @Test
+    public void testLocaleRealmUserNoAccess() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_CLIENT_ID, SECRET, USER_NO_ACCESS, PASSWORD);
+
+        HttpGet httpGet = new HttpGet(whoAmiUrl(managedRealmOn));
+        httpGet.addHeader("Accept", "application/json");
+        httpGet.addHeader("Authorization", "Bearer " + response.getAccessToken());
+
+        CloseableHttpResponse httpGetResponse = client.execute(httpGet);
+
+        Assertions.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), httpGetResponse.getStatusLine().getStatusCode());
+        httpGetResponse.close();
+        oAuthClientLocaleOn.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testLocaleRealmTokenAdminNotAllowed() throws Exception {
+        AccessTokenResponse response = accessToken(oAuthClientLocaleOn, ADMIN_CLI_NOT_ALLOWED, SECRET, USER_WITH_LOCALE, PASSWORD);
+
+        Assertions.assertNotNull(response.getAccessToken());
+
+        HttpGet httpGet = new HttpGet(whoAmiUrl(managedRealmOn));
+        httpGet.addHeader("Accept", "application/json");
+        httpGet.addHeader("Authorization", "Bearer " + response.getAccessToken());
+        CloseableHttpResponse httpGetResponse = client.execute(httpGet);
+
+        Assertions.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), httpGetResponse.getStatusLine().getStatusCode());
+        httpGetResponse.close();
+    }
+
+    private void updateMasterAdminRole() {
+        RoleRepresentation roleRep = masterRealm.admin().roles().get("admin").toRepresentation();
+        masterRealm.admin().users().get(masterAdmin.getId()).roles().realmLevel().add(List.of(roleRep));
+    }
+
+    private AccessTokenResponse accessToken(OAuthClient oAuth, String clientId, String clientSecret, String username, String password) {
+        return oAuth.client(clientId, clientSecret).doPasswordGrantRequest(username, password);
+    }
+
+    private JsonNode getHttpJsonResponse(String url, AccessTokenResponse response, Header... headers) throws IOException{
+        HttpGet httpGet = new HttpGet(url);
+        httpGet.addHeader("Accept", "application/json");
+        httpGet.addHeader("Authorization", "Bearer " + response.getAccessToken());
+
+        for (Header header : headers) {
+            httpGet.addHeader(header.getName(), header.getValue());
+        }
+
+        return new ObjectMapper().readTree(client.execute(httpGet).getEntity().getContent());
+    }
+
+    private String whoAmiUrl(ManagedRealm realm) {
+        return whoAmiUrl(realm, null);
+    }
+
+    private String whoAmiUrl(ManagedRealm realm, String currentRealm) {
+        StringBuilder sb = new StringBuilder()
+                .append(keycloakUrls.getBaseUrl())
+                .append("/admin/")
+                .append(realm.getName())
+                .append("/console/whoami");
+        if (currentRealm != null) {
+            sb.append("?currentRealm=").append(currentRealm);
+        }
+        return sb.toString();
+    }
+
+    private void checkRealmAccess(String realm, JsonNode whoAmI) {
+        Assertions.assertNotNull(whoAmI.get("realm_access"));
+        Assertions.assertNotNull(whoAmI.get("realm_access").get(realm));
+        Assertions.assertTrue(whoAmI.get("realm_access").get(realm).isArray());
+        Assertions.assertTrue(whoAmI.get("realm_access").get(realm).size() > 0);
+    }
+
+    private static class LocaleOffRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.internationalizationEnabled(false);
+            realm.addUser(USER_WITHOUT_LOCALE).password(PASSWORD)
+                    .name("My", "Locale Off")
+                    .email("locale-off@email.org").emailVerified()
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            realm.addUser(USER_WITH_LOCALE).password(PASSWORD)
+                    .name("My", "Locale On")
+                    .email("locale-on@email.org").emailVerified()
+                    .attribute("locale", USER_LOCALE)
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            realm.addClient(ADMIN_CLI_CLIENT_ID).name(ADMIN_CLI_CLIENT_ID).secret(SECRET)
+                    .attribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true")
+                    .directAccessGrants();
+
+            return realm;
+        }
+    }
+
+    private static class LocaleOnRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.internationalizationEnabled(true);
+            realm.supportedLocales(REALM_LOCALE, USER_LOCALE, EXTRA_LOCALE);
+            realm.defaultLocale(REALM_LOCALE);
+
+            realm.addUser(USER_WITHOUT_LOCALE).password(PASSWORD)
+                    .name("My", "Locale Off")
+                    .email("locale-off@email.org").emailVerified()
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            realm.addUser(USER_WITH_LOCALE).password(PASSWORD)
+                    .email("locale-on@email.org").emailVerified().name("My", "Locale On")
+                    .attribute("locale", USER_LOCALE)
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            realm.addUser(USER_NO_ACCESS).password(PASSWORD)
+                    .name("No", "Access")
+                    .email("no-access@email.org").emailVerified()
+                    .attribute("locale", USER_LOCALE);
+            realm.addClient(ADMIN_CLI_CLIENT_ID).name(ADMIN_CLI_CLIENT_ID).secret(SECRET)
+                    .attribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true")
+                    .directAccessGrants();
+            realm.addClient(ADMIN_CLI_NOT_ALLOWED).name(ADMIN_CLI_NOT_ALLOWED).secret(SECRET)
+                    .attribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, null)
+                    .directAccessGrants();
+
+            return realm;
+        }
+    }
+
+    private static class MasterAdminUserConfig implements UserConfig {
+
+        @Override
+        public UserConfigBuilder configure(UserConfigBuilder user) {
+            user.username("master-admin");
+            user.password(PASSWORD);
+            user.name("My", "Admin");
+            user.roles("admin");
+            user.email("master-admin@email.org");
+            user.emailVerified();
+            user.attribute("locale", DEFAULT_LOCALE);
+
+
+            return user;
+        }
+    }
+
+    private static class MasterAdminClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            client.clientId("master-admin-cli");
+            client.name("master-admin-cli");
+            client.secret(SECRET);
+            client.attribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true");
+            client.directAccessGrants();
+
+            return client;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminEndpointAccessibilityTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminEndpointAccessibilityTest.java
new file mode 100644
index 000000000000..16dee0845537
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminEndpointAccessibilityTest.java
@@ -0,0 +1,187 @@
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.RoleMappingResource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.GroupConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.UUID;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+@KeycloakIntegrationTest
+public class AdminEndpointAccessibilityTest {
+
+    @InjectAdminClient
+    Keycloak adminClient;
+
+    @InjectAdminClientFactory
+    AdminClientFactory adminClientFactory;
+
+    /**
+     * Verifies that the user does not have access to Keycloak Admin endpoint when role is not
+     * assigned to that user.
+     *
+     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
+     */
+    @Test
+    public void noAdminEndpointAccessWhenNoRoleAssigned() {
+        String userName = "user-" + UUID.randomUUID();
+        UserRepresentation user = UserConfigBuilder.create()
+                .username(userName)
+                .password("pwd")
+                .build();
+        final String realmName = "master";
+        final String userUuid = ApiUtil.getCreatedId(adminClient.realm(realmName).users().create(user));
+
+        Keycloak userClient = adminClientFactory.create().realm(realmName)
+                .username(userName).password("pwd")
+                .clientId(Constants.ADMIN_CLI_CLIENT_ID)
+                .build();
+        ClientErrorException e = Assertions.assertThrows(ClientErrorException.class,
+                () -> userClient.realms().findAll()  // Any admin operation will do
+        );
+        assertThat(e.getMessage(), containsString(String.valueOf(Response.Status.FORBIDDEN.getStatusCode())));
+        adminClient.realm(realmName).users().get(userUuid).remove();
+    }
+
+    /**
+     * Verifies that the role assigned to a user is correctly handled by Keycloak Admin endpoint.
+     *
+     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
+     */
+    @Test
+    public void adminEndpointAccessibleWhenAdminRoleAssignedToUser() {
+        String userName = "user-" + UUID.randomUUID();
+        UserRepresentation user = UserConfigBuilder.create()
+                .username(userName)
+                .password("pwd")
+                .build();
+
+        final String realmName = "master";
+        RealmResource realm = adminClient.realms().realm(realmName);
+        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
+        assertThat(adminRole, notNullValue());
+        assertThat(adminRole.getId(), notNullValue());
+
+        final String userUuid = ApiUtil.getCreatedId(adminClient.realm(realmName).users().create(user));
+        assertThat(userUuid, notNullValue());
+
+        RoleMappingResource mappings = realm.users().get(userUuid).roles();
+        mappings.realmLevel().add(List.of(adminRole));
+
+        Keycloak userClient = adminClientFactory.create().realm(realmName)
+                .username(userName).password("pwd")
+                .clientId(Constants.ADMIN_CLI_CLIENT_ID)
+                .build();
+
+        assertFalse(userClient.realms().findAll().isEmpty()); // Any admin operation will do
+        adminClient.realm(realmName).users().get(userUuid).remove();
+    }
+
+    /**
+     * Verifies that the role assigned to a user's group is correctly handled by Keycloak Admin endpoint.
+     *
+     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
+     */
+    @Test
+    public void adminEndpointAccessibleWhenAdminRoleAssignedToGroup() {
+        String userName = "user-" + UUID.randomUUID();
+        String groupName = "group-" + UUID.randomUUID();
+
+        final String realmName = "master";
+        RealmResource realm = adminClient.realms().realm(realmName);
+        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
+        assertThat(adminRole, notNullValue());
+        assertThat(adminRole.getId(), notNullValue());
+
+        UserRepresentation user = UserConfigBuilder.create()
+                .username(userName)
+                .password("pwd")
+                .build();
+        final String userUuid = ApiUtil.getCreatedId(adminClient.realm(realmName).users().create(user));
+        assertThat(userUuid, notNullValue());
+
+        GroupRepresentation group = GroupConfigBuilder.create().name(groupName).build();
+        Response response = realm.groups().add(group);
+        String groupId = ApiUtil.getCreatedId(response);
+
+        RoleMappingResource mappings = realm.groups().group(groupId).roles();
+        mappings.realmLevel().add(List.of(adminRole));
+
+        realm.users().get(userUuid).joinGroup(groupId);
+
+        Keycloak userClient = adminClientFactory.create().realm(realmName)
+                .username(userName).password("pwd")
+                .clientId(Constants.ADMIN_CLI_CLIENT_ID)
+                .build();
+        assertFalse(userClient.realms().findAll().isEmpty()); // Any admin operation will do
+
+        adminClient.realm(realmName).groups().group(groupId).remove();
+        adminClient.realm(realmName).users().get(userUuid).remove();
+    }
+
+    /**
+     * Verifies that the role assigned to a user's group is correctly handled by Keycloak Admin endpoint.
+     *
+     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
+     */
+    @Test
+    public void adminEndpointAccessibleWhenAdminRoleAssignedToGroupAfterUserJoinedIt() {
+        String userName = "user-" + UUID.randomUUID();
+        String groupName = "group-" + UUID.randomUUID();
+        final String realmName = "master";
+
+        RealmResource realm = adminClient.realms().realm(realmName);
+        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
+        assertThat(adminRole, notNullValue());
+        assertThat(adminRole.getId(), notNullValue());
+
+        UserRepresentation user = UserConfigBuilder.create()
+                .username(userName)
+                .password("pwd")
+                .build();
+        final String userUuid = ApiUtil.getCreatedId(adminClient.realm(realmName).users().create(user));
+        assertThat(userUuid, notNullValue());
+
+        GroupRepresentation group = GroupConfigBuilder.create().name(groupName).build();
+        Response response = realm.groups().add(group);
+        String groupId = ApiUtil.getCreatedId(response);
+
+        realm.users().get(userUuid).joinGroup(groupId);
+
+        RoleMappingResource mappings = realm.groups().group(groupId).roles();
+
+        mappings.realmLevel().add(List.of(adminRole));
+
+        Keycloak userClient = adminClientFactory.create().realm(realmName)
+                .username(userName).password("pwd")
+                .clientId(Constants.ADMIN_CLI_CLIENT_ID)
+                .build();
+        assertFalse(userClient.realms().findAll().isEmpty()); // Any admin operation will do
+
+        adminClient.realm(realmName).groups().group(groupId).remove();
+        adminClient.realm(realmName).users().get(userUuid).remove();
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminHeadersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminHeadersTest.java
index ec0e32dd9cbe..b2863b7488c8 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/AdminHeadersTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminHeadersTest.java
@@ -29,7 +29,6 @@ public void testHeaders() {
         assertDefaultValue(BrowserSecurityHeaders.STRICT_TRANSPORT_SECURITY, h);
         assertDefaultValue(BrowserSecurityHeaders.X_FRAME_OPTIONS, h);
         assertDefaultValue(BrowserSecurityHeaders.X_CONTENT_TYPE_OPTIONS, h);
-        assertDefaultValue(BrowserSecurityHeaders.X_XSS_PROTECTION, h);
         assertDefaultValue(BrowserSecurityHeaders.REFERRER_POLICY, h);
 
         response.close();
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootEdgeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootEdgeTest.java
new file mode 100644
index 000000000000..0e5b261c4237
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootEdgeTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.Map;
+
+import org.apache.http.HttpResponse;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.HttpGet;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.keycloak.testframework.annotations.InjectHttpClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+/**
+ * @author Vaclav Muzikar <vmuzikar@redhat.com>
+ */
+@KeycloakIntegrationTest(config = AdminRootEdgeTest.AdminUrlConfig.class)
+public class AdminRootEdgeTest {
+    // full url with https, with default hostname-admin
+    private static final String HOSTNAME = "https://127.0.0.1.nip.io:8080";
+
+    @InjectHttpClient(followRedirects = false)
+    private HttpClient client;
+
+    @ParameterizedTest
+    @ValueSource(strings = {"http://127.0.0.1:8080", "http://127.0.0.1.nip.io:8080"})
+    public void testRedirect(String hostname) throws Exception {
+        HttpResponse response = client.execute(new HttpGet(hostname + "/admin"));
+
+        assertEquals(302, response.getStatusLine().getStatusCode());
+        assertThat(response.getFirstHeader("Location").getValue(), startsWith(HOSTNAME + "/admin/master/console"));
+    }
+
+    public static class AdminUrlConfig implements KeycloakServerConfig {
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.options(Map.of(
+                    "hostname", HOSTNAME
+            ));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootTest.java
new file mode 100644
index 000000000000..59ebde9eec16
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminRootTest.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import org.apache.http.HttpResponse;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.util.EntityUtils;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.keycloak.testframework.annotations.InjectHttpClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+import java.util.Arrays;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.startsWith;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+/**
+ * @author Vaclav Muzikar <vmuzikar@redhat.com>
+ */
+@KeycloakIntegrationTest(config = AdminRootTest.AdminUrlConfig.class)
+public class AdminRootTest {
+    // This might not be robust enough. If something made KC on a different port, this would fail.
+    private static final String HOSTNAME = "http://127.0.0.1.nip.io:8080";
+    private static final String HOSTNAME_ADMIN = "http://admin.127.0.0.1.nip.io:8080";
+    private static final String HOSTNAME_LOCAL_ADMIN = "http://localhost:8080";
+
+    @InjectHttpClient(followRedirects = false)
+    private HttpClient client;
+
+    @ParameterizedTest
+    @ValueSource(strings = {HOSTNAME_ADMIN, HOSTNAME_LOCAL_ADMIN})
+    public void testRedirect(String hostname) throws Exception {
+        HttpResponse response = client.execute(new HttpGet(hostname + "/admin"));
+
+        assertEquals(302, response.getStatusLine().getStatusCode());
+        assertThat(response.getFirstHeader("Location").getValue(), startsWith(HOSTNAME_ADMIN + "/admin/master/console"));
+    }
+
+    @Test
+    public void testNoRedirectWithFrontendUrl() throws Exception {
+        HttpGet request = new HttpGet(HOSTNAME + "/admin");
+        // make the request seem like it's coming from a proxy so that it won't seem local
+        request.addHeader("Forwarded", "for=192.0.2.60");
+        HttpResponse response = client.execute(request);
+
+        assertEquals(404, response.getStatusLine().getStatusCode());
+
+        // Check for leaks of hostname-admin in headers and body
+        assertFalse(Arrays.stream(response.getAllHeaders()).anyMatch(header -> header.getValue().contains(HOSTNAME_ADMIN)));
+        assertThat(EntityUtils.toString(response.getEntity()), not(containsString(HOSTNAME_ADMIN))); // just in case of a JS redirect
+    }
+
+    public static class AdminUrlConfig implements KeycloakServerConfig {
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.options(Map.of(
+                    "hostname", HOSTNAME,
+                    "hostname-admin", HOSTNAME_ADMIN
+            ));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AdminSignatureAlgorithmTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AdminSignatureAlgorithmTest.java
index 9134ebabb764..b728246c39a5 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/AdminSignatureAlgorithmTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AdminSignatureAlgorithmTest.java
@@ -19,7 +19,7 @@ public class AdminSignatureAlgorithmTest {
     @InjectAdminClient
     Keycloak admin;
 
-    @InjectRealm(ref = "master", createRealm = false)
+    @InjectRealm(attachTo = "master")
     ManagedRealm masterRealm;
 
     @Test
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AttackDetectionResourceTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AttackDetectionResourceTest.java
new file mode 100644
index 000000000000..8bcabfa3e2fd
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AttackDetectionResourceTest.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.AttackDetectionResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ *
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class AttackDetectionResourceTest {
+
+    @InjectRealm(config = AttackDetectionResourceRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectUser
+    ManagedUser testUser;
+
+    @InjectUser(ref = "testUser2")
+    ManagedUser testUser2;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectOAuthClient
+    OAuthClient oauthClient;
+
+    @Test
+    public void test() {
+        AttackDetectionResource detection = managedRealm.admin().attackDetection();
+
+        assertBruteForce(detection.bruteForceUserStatus(testUser.getId()), 0, 0, false, false);
+
+        oauthClient.doPasswordGrantRequest(testUser.getUsername(), "invalid");
+        oauthClient.doPasswordGrantRequest(testUser.getUsername(), "invalid");
+        oauthClient.doPasswordGrantRequest(testUser.getUsername(), "invalid");
+
+        oauthClient.doPasswordGrantRequest(testUser2.getUsername(), "invalid");
+        oauthClient.doPasswordGrantRequest(testUser2.getUsername(), "invalid");
+        oauthClient.doPasswordGrantRequest("nosuchuser", "invalid");
+
+        assertBruteForce(detection.bruteForceUserStatus(testUser.getId()), 2, 1, true, true);
+        assertBruteForce(detection.bruteForceUserStatus(testUser2.getId()), 2, 1, true, true);
+        assertBruteForce(detection.bruteForceUserStatus("nosuchuser"), 0, 0, false, false);
+
+        detection.clearBruteForceForUser(testUser.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.attackDetectionClearBruteForceForUserPath(testUser.getId()), ResourceType.USER_LOGIN_FAILURE);
+
+        assertBruteForce(detection.bruteForceUserStatus(testUser.getId()), 0, 0, false, false);
+        assertBruteForce(detection.bruteForceUserStatus(testUser2.getId()), 2, 1, true, true);
+
+        detection.clearAllBruteForce();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.attackDetectionClearAllBruteForcePath(), ResourceType.USER_LOGIN_FAILURE);
+
+        assertBruteForce(detection.bruteForceUserStatus(testUser.getId()), 0, 0, false, false);
+        assertBruteForce(detection.bruteForceUserStatus(testUser2.getId()), 0, 0, false, false);
+    }
+
+    private void assertBruteForce(Map<String, Object> status, Integer expectedNumFailures, Integer expectedNumTemporaryLockouts, Boolean expectedFailure, Boolean expectedDisabled) {
+        assertEquals(6, status.size());
+        assertEquals(expectedNumFailures, status.get("numFailures"));
+        assertEquals(expectedNumTemporaryLockouts, status.get("numTemporaryLockouts"));
+        assertEquals(expectedDisabled, status.get("disabled"));
+        if (expectedFailure) {
+            assertEquals("127.0.0.1", status.get("lastIPFailure"));
+            Long lastFailure = (Long) status.get("lastFailure");
+            assertTrue(lastFailure < (System.currentTimeMillis() + 1) && lastFailure > (System.currentTimeMillis() - 10000));
+            assertNotEquals("0", status.get("failedLoginNotBefore").toString());
+        } else {
+            assertEquals("n/a", status.get("lastIPFailure"));
+            assertEquals("0", status.get("lastFailure").toString());
+            assertEquals("0", status.get("failedLoginNotBefore").toString());
+        }
+    }
+
+    private static class AttackDetectionResourceRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.bruteForceProtected(true);
+            realm.failureFactor(2);
+
+            return realm;
+        }
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/AuthzCleanupTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/AuthzCleanupTest.java
new file mode 100644
index 000000000000..eb22ad06816d
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/AuthzCleanupTest.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.common.Profile;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionStrategy;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@KeycloakIntegrationTest(config = AuthzCleanupTest.AuthzCleanupServerConfig.class)
+public class AuthzCleanupTest {
+
+    @InjectRealm(config = AuthzCleanupRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectRunOnServer(permittedPackages = "org.keycloak.tests")
+    RunOnServerClient runOnServer;
+
+    private static final String clientId = "myclient";
+    private static final String clientSecret = "secret";
+    private static final String realmName = "default";
+
+    @Test
+    public void testCreate() throws Exception {
+        ClientsResource clients = managedRealm.admin().clients();
+        ClientRepresentation client = clients.findByClientId(clientId).get(0);
+        ResourceServerRepresentation settings = JsonSerialization.readValue(AuthzCleanupTest.class.getResourceAsStream("authz/acme-resource-server-cleanup-test.json"), ResourceServerRepresentation.class);
+
+        clients.get(client.getId()).authorization().importSettings(settings);
+
+        runOnServer.run(AuthzCleanupTest::setup);
+    }
+
+    public static void setup(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(realmName);
+        session.getContext().setRealm(realm);
+        AuthorizationProvider authz = session.getProvider(AuthorizationProvider.class);
+        ClientModel myClient = realm.getClientByClientId(clientId);
+        ResourceServer resourceServer = authz.getStoreFactory().getResourceServerStore().findByClient(myClient);
+        createRolePolicy(authz, resourceServer, myClient.getClientId() + "/client-role-1");
+        createRolePolicy(authz, resourceServer, myClient.getClientId() + "/client-role-2");
+    }
+
+    private static Policy createRolePolicy(AuthorizationProvider authz, ResourceServer resourceServer, String roleName) {
+        RolePolicyRepresentation representation = new RolePolicyRepresentation();
+
+        representation.setName(roleName);
+        representation.setType("role");
+        representation.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
+        representation.setLogic(Logic.POSITIVE);
+        representation.addRole(roleName, true);
+
+        return authz.getStoreFactory().getPolicyStore().create(resourceServer, representation);
+    }
+
+    public static class AuthzCleanupServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder builder) {
+            builder.features(Profile.Feature.AUTHORIZATION);
+
+            return builder;
+        }
+    }
+
+    private static class AuthzCleanupRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.addClient(clientId).secret(clientSecret).authorizationServices().redirectUris("http://localhost/myclient");
+            realm.roles("client-role-1",
+                    "client-role-2",
+                    "Acme administrator",
+                    "Acme viewer",
+                    "tenant administrator",
+                    "tenant viewer",
+                    "tenant user");
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/ClientTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/ClientTest.java
new file mode 100644
index 000000000000..b79c0db81526
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/ClientTest.java
@@ -0,0 +1,1031 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.admin.client.resource.RoleMappingResource;
+import org.keycloak.admin.client.resource.RolesResource;
+import org.keycloak.common.util.Time;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.AccountRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.representations.adapters.action.GlobalRequestResult;
+import org.keycloak.representations.adapters.action.PushNotBeforeAction;
+import org.keycloak.representations.adapters.action.TestAvailabilityAction;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.UserSessionRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.TestApp;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectTestApp;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.RoleBuilder;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import static java.util.Arrays.asList;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.lessThan;
+import static org.hamcrest.Matchers.not;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.keycloak.models.Constants.defaultClients;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class ClientTest {
+
+    @InjectRealm(ref = "default", config = ClientTestRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm managedMasterRealm;
+
+    @InjectOAuthClient(realmRef = "default", kcAdmin = true)
+    OAuthClient oauth;
+
+    @InjectTestApp
+    TestApp testApp;
+
+    @InjectAdminEvents(realmRef = "default")
+    AdminEvents adminEvents;
+
+    @Test
+    public void getClients() {
+        Assert.assertNames(managedRealm.admin().clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "test-app", Constants.ADMIN_CLI_CLIENT_ID);
+    }
+
+    @Test
+    public void getRealmClients() {
+        assertTrue(managedRealm.admin().clients().findAll().stream().filter(client -> client.getAttributes().get(Constants.REALM_CLIENT).equals("true"))
+                .map(ClientRepresentation::getClientId)
+                .allMatch(clientId -> clientId.equals(Constants.REALM_MANAGEMENT_CLIENT_ID) || clientId.equals(Constants.BROKER_SERVICE_CLIENT_ID) || clientId.endsWith("-realm")));
+    }
+
+    private ClientRepresentation createClient() {
+        return createClient(null);
+    }
+
+    private ClientRepresentation createClient(String protocol) {
+        ClientRepresentation rep = new ClientRepresentation();
+        rep.setClientId("my-app");
+        rep.setDescription("my-app description");
+        rep.setEnabled(true);
+        rep.setPublicClient(true);
+        if (protocol != null) {
+            rep.setProtocol(protocol);
+        }
+        Response response = managedRealm.admin().clients().create(rep);
+        String id = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+        ClientRepresentation found = ApiUtil.findClientByClientId(managedRealm.admin(), "my-app").toRepresentation();
+
+        assertEquals("my-app", found.getClientId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientResourcePath(id), rep, ResourceType.CLIENT);
+
+        rep.setId(id);
+
+        return rep;
+    }
+
+    private ClientRepresentation createClientNonPublic() {
+        ClientRepresentation rep = new ClientRepresentation();
+        rep.setClientId("my-app");
+        rep.setDescription("my-app description");
+        rep.setEnabled(true);
+        rep.setPublicClient(false);
+        Response response = managedRealm.admin().clients().create(rep);
+        String id = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+        ClientRepresentation found = ApiUtil.findClientByClientId(managedRealm.admin(), "my-app").toRepresentation();
+
+        assertEquals("my-app", found.getClientId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientResourcePath(id), rep, ResourceType.CLIENT);
+
+        rep.setId(id);
+
+        return rep;
+    }
+
+    @Test
+    public void createClientVerifyWithSecret() {
+        String id = createClientNonPublic().getId();
+
+        ClientResource client = managedRealm.admin().clients().get(id);
+        assertNotNull(client);
+        assertNotNull(client.toRepresentation().getSecret());
+        Assert.assertNames(managedRealm.admin().clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "my-app", "test-app", Constants.ADMIN_CLI_CLIENT_ID);
+    }
+
+    @Test
+    public void createClientVerify() {
+        String id = createClient().getId();
+        ClientResource client = managedRealm.admin().clients().get(id);
+        assertNotNull(client);
+        assertNull(client.toRepresentation().getSecret());
+        Assert.assertNames(managedRealm.admin().clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "my-app", "test-app", Constants.ADMIN_CLI_CLIENT_ID);
+    }
+
+    @Test
+    public void testInvalidLengthClientIdValidation() {
+        ClientRepresentation rep = ClientConfigBuilder.create()
+                .id("test-long-invalid-client-id-validation-400-bad-request")
+                .clientId("test-long-invalid-client-id-validation-400-bad-request")
+                .description("invalid-client-id-app description")
+                .enabled(true)
+                .publicClient(true)
+                .build();
+        try (Response response = managedRealm.admin().clients().create(rep)) {
+            if (response.getStatus() != 400) {
+                response.bufferEntity();
+                String body = response.readEntity(String.class);
+                fail("expect 400 Bad request response code but receive: " + response.getStatus() + "\n" + body);
+            }
+        }
+    }
+
+    @Test
+    public void testInvalidUrlClientValidation() {
+        testClientUriValidation("Root URL is not a valid URL",
+                "Base URL is not a valid URL",
+                "Backchannel logout URL is not a valid URL",
+                null,
+                "invalid", "myapp://some-fake-app");
+    }
+
+    @Test
+    public void testIllegalSchemeClientValidation() {
+        testClientUriValidation("Root URL uses an illegal scheme",
+                "Base URL uses an illegal scheme",
+                "Backchannel logout URL uses an illegal scheme",
+                "A redirect URI uses an illegal scheme",
+                "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+",
+                "javascript:confirm(document.domain)/*"
+        );
+    }
+
+    // KEYCLOAK-3421
+    @Test
+    public void testFragmentProhibitedClientValidation() {
+        testClientUriValidation("Root URL must not contain an URL fragment",
+                null,
+                null,
+                "Redirect URIs must not contain an URI fragment",
+                "http://redhat.com/abcd#someFragment"
+        );
+    }
+
+    @Test
+    public void testSamlSpecificUrls() {
+        testSamlSpecificUrls(true, "javascript:alert('TEST')", "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+");
+        testSamlSpecificUrls(false, "javascript:alert('TEST')", "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+");
+    }
+
+    private void testSamlSpecificUrls(boolean create, String... testUrls) {
+        ClientRepresentation rep;
+        if (create) {
+            rep = new ClientRepresentation();
+            rep.setClientId("my-app2");
+            rep.setEnabled(true);
+            rep.setProtocol(SamlProtocol.LOGIN_PROTOCOL);
+        } else {
+            rep = createClient(SamlProtocol.LOGIN_PROTOCOL);
+        }
+        rep.setAttributes(new HashMap<>());
+
+        Map<String, String> attrs = Map.of(
+                SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "Assertion Consumer Service POST Binding URL",
+                SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "Assertion Consumer Service Redirect Binding URL",
+                SamlProtocol.SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE, "Artifact Binding URL",
+                SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "Logout Service POST Binding URL",
+                SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE, "Logout Service ARTIFACT Binding URL",
+                SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "Logout Service Redirect Binding URL",
+                SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE, "Logout Service SOAP Binding URL",
+                SamlProtocol.SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE, "Artifact Resolution Service");
+
+        for (String testUrl : testUrls) {
+            // admin url
+            rep.setAdminUrl(testUrl);
+            createOrUpdateClientExpectingValidationErrors(rep, create, "Master SAML Processing URL uses an illegal scheme");
+            rep.setAdminUrl(null);
+            // attributes
+            for (Map.Entry<String, String> entry : attrs.entrySet()) {
+                rep.getAttributes().put(entry.getKey(), testUrl);
+                createOrUpdateClientExpectingValidationErrors(rep, create, entry.getValue() + " uses an illegal scheme");
+                rep.getAttributes().remove(entry.getKey());
+            }
+        }
+    }
+
+    private void testClientUriValidation(String expectedRootUrlError, String expectedBaseUrlError, String expectedBackchannelLogoutUrlError, String expectedRedirectUrisError, String... testUrls) {
+        testClientUriValidation(false, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
+        testClientUriValidation(true, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
+    }
+
+    private void testClientUriValidation(boolean create, String expectedRootUrlError, String expectedBaseUrlError, String expectedBackchannelLogoutUrlError, String expectedRedirectUrisError, String... testUrls) {
+        ClientRepresentation rep;
+        if (create) {
+            rep = new ClientRepresentation();
+            rep.setClientId("my-app2");
+            rep.setEnabled(true);
+        } else {
+            rep = createClient();
+        }
+
+        for (String testUrl : testUrls) {
+            if (expectedRootUrlError != null) {
+                rep.setRootUrl(testUrl);
+                createOrUpdateClientExpectingValidationErrors(rep, create, expectedRootUrlError);
+            }
+            rep.setRootUrl(null);
+
+            if (expectedBaseUrlError != null) {
+                rep.setBaseUrl(testUrl);
+                createOrUpdateClientExpectingValidationErrors(rep, create, expectedBaseUrlError);
+            }
+            rep.setBaseUrl(null);
+
+            if (expectedBackchannelLogoutUrlError != null) {
+                OIDCAdvancedConfigWrapper.fromClientRepresentation(rep).setBackchannelLogoutUrl(testUrl);
+                createOrUpdateClientExpectingValidationErrors(rep, create, expectedBackchannelLogoutUrlError);
+            }
+            OIDCAdvancedConfigWrapper.fromClientRepresentation(rep).setBackchannelLogoutUrl(null);
+
+            if (expectedRedirectUrisError != null) {
+                rep.setRedirectUris(List.of(testUrl));
+                createOrUpdateClientExpectingValidationErrors(rep, create, expectedRedirectUrisError);
+            }
+            rep.setRedirectUris(null);
+
+            if (expectedRootUrlError != null) rep.setRootUrl(testUrl);
+            if (expectedBaseUrlError != null) rep.setBaseUrl(testUrl);
+            if (expectedRedirectUrisError != null) rep.setRedirectUris(List.of(testUrl));
+            createOrUpdateClientExpectingValidationErrors(rep, create, expectedRootUrlError, expectedBaseUrlError, expectedRedirectUrisError);
+
+            rep.setRootUrl(null);
+            rep.setBaseUrl(null);
+            rep.setRedirectUris(null);
+        }
+    }
+
+    private void createOrUpdateClientExpectingValidationErrors(ClientRepresentation rep, boolean create, String... expectedErrors) {
+        Response response = null;
+        if (create) {
+            response = managedRealm.admin().clients().create(rep);
+        } else {
+            try {
+                managedRealm.admin().clients().get(rep.getId()).update(rep);
+                fail("Expected exception");
+            } catch (BadRequestException e) {
+                response = e.getResponse();
+            }
+        }
+
+        expectedErrors = Arrays.stream(expectedErrors).filter(Objects::nonNull).toArray(String[]::new);
+
+        assertEquals(400, response.getStatus());
+        OAuth2ErrorRepresentation errorRep = response.readEntity(OAuth2ErrorRepresentation.class);
+        List<String> actualErrors = asList(errorRep.getErrorDescription().split("; "));
+        assertThat(actualErrors, containsInAnyOrder(expectedErrors));
+        assertEquals("invalid_input", errorRep.getError());
+    }
+
+    @Test
+    public void removeClient() {
+        Response response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("my-app").build());
+        String id = ApiUtil.getCreatedId(response);
+        adminEvents.skip();
+
+        assertNotNull(ApiUtil.findClientByClientId(managedRealm.admin(), "my-app"));
+        managedRealm.admin().clients().get(id).remove();
+        assertNull(ApiUtil.findClientResourceById(managedRealm.admin(), "my-app"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientResourcePath(id), ResourceType.CLIENT);
+    }
+
+    @Test
+    public void removeClientWithDependentCompositeRoles() {
+        ClientRepresentation clientRep = ClientConfigBuilder.create().clientId("my-app").build();
+        String id = ApiUtil.getCreatedId(managedRealm.admin().clients().create(clientRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientResourcePath(id), clientRep, ResourceType.CLIENT);
+        ClientResource clientRsc = managedRealm.admin().clients().get(id);
+
+        RoleRepresentation roleB = RoleBuilder.create().name("role-b").build();
+        clientRsc.roles().create(roleB);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(id, "role-b"), roleB, ResourceType.CLIENT_ROLE);
+
+        RoleRepresentation roleA = RoleBuilder.create().name("role-a").build();
+         clientRsc.roles().create(roleA);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(id, "role-a"), roleA, ResourceType.CLIENT_ROLE);
+
+        List<RoleRepresentation> composites = List.of( clientRsc.roles().get("role-b").toRepresentation());
+        clientRsc.roles().get("role-a").addComposites(composites);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourceCompositesPath(id, "role-a"), composites, ResourceType.CLIENT_ROLE);
+
+        clientRsc.remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientResourcePath(id), ResourceType.CLIENT);
+    }
+
+    @Test
+    public void removeInternalClientExpectingBadRequestException() {
+        final String testRealmClientId = ApiUtil.findClientByClientId(managedMasterRealm.admin(), managedRealm.getName() + "-realm")
+                .toRepresentation().getId();
+
+        assertThrows(BadRequestException.class,
+                () -> managedMasterRealm.admin().clients().get(testRealmClientId).remove());
+
+        defaultClients.forEach(defaultClient -> {
+            final String defaultClientId = ApiUtil.findClientByClientId(managedRealm.admin(), defaultClient)
+                    .toRepresentation().getId();
+
+            assertThrows(BadRequestException.class,
+                    () -> managedRealm.admin().clients().get(defaultClientId).remove());
+        });
+    }
+
+    @Test
+    public void getClientRepresentation() {
+        String id = createClient().getId();
+
+        ClientRepresentation rep = managedRealm.admin().clients().get(id).toRepresentation();
+        assertEquals(id, rep.getId());
+        assertEquals("my-app", rep.getClientId());
+        assertTrue(rep.isEnabled());
+    }
+
+    /**
+     * See <a href="https://issues.jboss.org/browse/KEYCLOAK-1918">KEYCLOAK-1918</a>
+     */
+    @Test
+    public void getClientDescription() {
+        String id = createClient().getId();
+
+        ClientRepresentation rep = managedRealm.admin().clients().get(id).toRepresentation();
+        assertEquals(id, rep.getId());
+        assertEquals("my-app description", rep.getDescription());
+    }
+
+    @Test
+    public void getClientSessions() {
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
+        assertEquals(200, response.getStatusCode());
+
+        AuthorizationEndpointResponse codeResponse = oauth.doLogin("test-user@localhost", "password");
+
+        AccessTokenResponse response2 = oauth.doAccessTokenRequest(codeResponse.getCode());
+        assertEquals(200, response2.getStatusCode());
+
+        ClientResource app = ApiUtil.findClientByClientId(managedRealm.admin(), "test-app");
+
+        assertEquals(2, (long) app.getApplicationSessionCount().get("count"));
+
+        List<UserSessionRepresentation> userSessions = app.getUserSessions(0, 100);
+        assertEquals(2, userSessions.size());
+        assertEquals(1, userSessions.get(0).getClients().size());
+    }
+
+    @Test
+    public void getAllClients() {
+        List<ClientRepresentation> allClients = managedRealm.admin().clients().findAll();
+        assertNotNull(allClients);
+        assertFalse(allClients.isEmpty());
+    }
+
+    @Test
+    public void getAllClientsSearchAndPagination() {
+        for (int i = 1; i <= 10; i++) {
+            ClientRepresentation c = ClientConfigBuilder.create().clientId("ccx-" + (i < 10 ? "0" + i : i)).build();
+            Response response = managedRealm.admin().clients().create(c);
+            String id = ApiUtil.getCreatedId(response);
+            managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+        }
+
+        assertPaginatedClients(1, 10, managedRealm.admin().clients().findAll("ccx-", null, true, 0, 100));
+        assertPaginatedClients(1, 5, managedRealm.admin().clients().findAll("ccx-", null, true, 0, 5));
+        assertPaginatedClients(6, 10, managedRealm.admin().clients().findAll("ccx-", null, true, 5, 5));
+    }
+
+    private void assertPaginatedClients(int start, int end, List<ClientRepresentation> actual) {
+        List<String> expected = new LinkedList<>();
+        for (int i = start; i <= end; i++) {
+            expected.add("ccx-" + (i < 10 ? "0" + i : i));
+        }
+        List<String> a = actual.stream().map(ClientRepresentation::getClientId).collect(Collectors.toList());
+        assertThat(a, is(expected));
+
+    }
+
+    @Test
+    public void getClientById() {
+        createClient();
+        ClientRepresentation rep = ApiUtil.findClientByClientId(managedRealm.admin(), "my-app").toRepresentation();
+        ClientRepresentation gotById = managedRealm.admin().clients().get(rep.getId()).toRepresentation();
+        assertClient(rep, gotById);
+    }
+
+    @Test
+    // KEYCLOAK-1110
+    public void deleteDefaultRole() {
+        ClientRepresentation rep = createClient();
+        String id = rep.getId();
+
+        RoleRepresentation role = new RoleRepresentation("test", "test", false);
+        managedRealm.admin().clients().get(id).roles().create(role);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(id, "test"), role, ResourceType.CLIENT_ROLE);
+
+        role = managedRealm.admin().clients().get(id).roles().get("test").toRepresentation();
+
+        final String DEFAULT_ROLE = Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName();
+        managedRealm.admin().roles().get(DEFAULT_ROLE).addComposites(List.of(role));
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourceCompositesPath(DEFAULT_ROLE), List.of(role), ResourceType.REALM_ROLE);
+
+        assertThat(managedRealm.admin().roles().get(DEFAULT_ROLE).getRoleComposites().stream().map(RoleRepresentation::getName).collect(Collectors.toSet()),
+                hasItem(role.getName()));
+
+        managedRealm.admin().clients().get(id).roles().deleteRole("test");
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(id, "test"), ResourceType.CLIENT_ROLE);
+
+        assertThat(managedRealm.admin().roles().get(DEFAULT_ROLE).getRoleComposites().stream().map(RoleRepresentation::getName).collect(Collectors.toSet()),
+                not(hasItem(role)));
+    }
+
+    @Test
+    public void testProtocolMappers() {
+        String clientDbId = createClient().getId();
+        ProtocolMappersResource mappersResource = ApiUtil.findClientByClientId(managedRealm.admin(), "my-app").getProtocolMappers();
+
+        protocolMappersTest(clientDbId, mappersResource);
+    }
+
+    @Test
+    public void updateClient() {
+        ClientRepresentation client = createClient();
+
+        ClientRepresentation newClient = ClientConfigBuilder.create()
+                .id(client.getId())
+                .clientId(client.getClientId())
+                .baseUrl("http://baseurl")
+                .build();
+
+        ClientResource clientRes = managedRealm.admin().clients().get(client.getId());
+        clientRes.update(newClient);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(client.getId()), newClient, ResourceType.CLIENT);
+
+        ClientRepresentation storedClient = clientRes.toRepresentation();
+
+        assertNull(storedClient.getSecret());
+        assertNull(clientRes.getSecret().getValue());
+        assertClient(client, storedClient);
+
+        client.setPublicClient(false);
+        newClient.setPublicClient(client.isPublicClient());
+        client.setSecret("new-secret");
+        newClient.setSecret(client.getSecret());
+
+        clientRes.update(newClient);
+
+        newClient.setSecret("**********"); // secrets are masked in events
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(client.getId()), newClient, ResourceType.CLIENT);
+
+        storedClient = clientRes.toRepresentation();
+        assertClient(client, storedClient);
+
+        storedClient.setSecret(null);
+        storedClient.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
+
+        clientRes.update(storedClient);
+        storedClient = clientRes.toRepresentation();
+
+        assertFalse(storedClient.getAttributes().containsKey(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL));
+        assertClient(client, storedClient);
+    }
+
+    @Test
+    public void serviceAccount() {
+        Response response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("serviceClient").serviceAccountsEnabled(true).build());
+        String id = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+        UserRepresentation userRep = managedRealm.admin().clients().get(id).getServiceAccountUser();
+        MatcherAssert.assertThat("service-account-serviceclient", Matchers.equalTo(userRep.getUsername()));
+        // KEYCLOAK-11197 service accounts are no longer created with a placeholder e-mail.
+        assertNull(userRep.getEmail());
+    }
+
+    @Test
+    public void pushRevocation() throws InterruptedException {
+        testApp.kcAdmin().clear();
+
+        ClientResource client = ApiUtil.findClientByClientId(managedRealm.admin(), "test-app");
+        String id = client.toRepresentation().getId();
+
+        client.pushRevocation();
+
+        PushNotBeforeAction pushNotBefore = testApp.kcAdmin().getAdminPushNotBefore();
+        assertEquals(client.toRepresentation().getNotBefore().intValue(), pushNotBefore.getNotBefore());
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.ACTION, AdminEventPaths.clientPushRevocationPath(id), ResourceType.CLIENT);
+    }
+
+    @Test
+    public void testAddNodeWithReservedCharacter() {
+        testApp.kcAdmin().clear();
+        String id = ApiUtil.findClientByClientId(managedRealm.admin(), "test-app").toRepresentation().getId();
+        assertThrows(BadRequestException.class,
+                () -> managedRealm.admin().clients().get(id).registerNode(Collections.singletonMap("node", "foo#"))
+        );
+    }
+
+    @Test
+    public void nodes() throws MalformedURLException, InterruptedException {
+        testApp.kcAdmin().clear();
+
+        String id = ApiUtil.findClientByClientId(managedRealm.admin(), "test-app").toRepresentation().getId();
+
+        String myhost = new URL(managedRealm.getBaseUrl()).getHost();
+        managedRealm.admin().clients().get(id).registerNode(Collections.singletonMap("node", myhost));
+        managedRealm.admin().clients().get(id).registerNode(Collections.singletonMap("node", "invalid"));
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientNodePath(id, myhost), ResourceType.CLUSTER_NODE);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientNodePath(id, "invalid"), ResourceType.CLUSTER_NODE);
+
+        GlobalRequestResult result = managedRealm.admin().clients().get(id).testNodesAvailable();
+        assertEquals(1, result.getSuccessRequests().size());
+        assertEquals(1, result.getFailedRequests().size());
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.ACTION, AdminEventPaths.clientTestNodesAvailablePath(id), result, ResourceType.CLUSTER_NODE);
+
+        TestAvailabilityAction testAvailable = testApp.kcAdmin().getTestAvailable();
+        assertEquals("test-app", testAvailable.getResource());
+
+        assertEquals(2, managedRealm.admin().clients().get(id).toRepresentation().getRegisteredNodes().size());
+
+        managedRealm.admin().clients().get(id).unregisterNode("invalid");
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientNodePath(id, "invalid"), ResourceType.CLUSTER_NODE);
+
+        assertEquals(1, managedRealm.admin().clients().get(id).toRepresentation().getRegisteredNodes().size());
+        managedRealm.admin().clients().get(id).unregisterNode(myhost);
+    }
+
+    @Test
+    public void offlineUserSessions() {
+        ClientRepresentation client = ApiUtil.findClientByClientId(managedRealm.admin(), "test-app").toRepresentation();
+        String id = client.getId();
+
+        Response response = managedRealm.admin().users().create(UserConfigBuilder.create().username("testuser").password("password").email("testuser@localhost").name("test", "user").build());
+        String userId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.users().delete(userId).close());
+
+        Map<String, Long> offlineSessionCount = managedRealm.admin().clients().get(id).getOfflineSessionCount();
+        assertEquals(Long.valueOf(0), offlineSessionCount.get("count"));
+
+        List<UserSessionRepresentation> userSessions = managedRealm.admin().users().get(userId).getOfflineSessions(id);
+        assertEquals(0, userSessions.size(), "There should be no offline sessions");
+
+        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
+        oauth.doLogin("testuser", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
+        assertEquals(200, accessTokenResponse.getStatusCode());
+
+        offlineSessionCount = managedRealm.admin().clients().get(id).getOfflineSessionCount();
+        assertEquals(Long.valueOf(1), offlineSessionCount.get("count"));
+
+        List<UserSessionRepresentation> offlineUserSessions = managedRealm.admin().clients().get(id).getOfflineUserSessions(0, 100);
+        assertEquals(1, offlineUserSessions.size());
+        assertEquals("testuser", offlineUserSessions.get(0).getUsername());
+        org.hamcrest.MatcherAssert.assertThat(offlineUserSessions.get(0).getLastAccess(),
+                allOf(greaterThan(Time.currentTimeMillis() - 10000L), lessThan(Time.currentTimeMillis())));
+
+        userSessions = managedRealm.admin().users().get(userId).getOfflineSessions(id);
+        assertEquals(1, userSessions.size(), "There should be one offline session");
+        assertOfflineSession(offlineUserSessions.get(0), userSessions.get(0));
+        //  reset for other tests
+        oauth.scope(null);
+    }
+
+    private void assertOfflineSession(UserSessionRepresentation expected, UserSessionRepresentation actual) {
+        assertEquals(expected.getId(), actual.getId(), "id");
+        assertEquals(expected.getUserId(), actual.getUserId(), "userId");
+        assertEquals(expected.getUsername(), actual.getUsername(), "userName");
+        assertEquals(expected.getClients(), actual.getClients(), "clients");
+    }
+
+    @Test
+    public void scopes() {
+        Response response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("client").fullScopeEnabled(false).build());
+        String id = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+        adminEvents.skip();
+
+        RoleMappingResource scopesResource = managedRealm.admin().clients().get(id).getScopeMappings();
+
+        RoleRepresentation roleRep1 = createRealmRole("realm-composite");
+        RoleRepresentation roleRep2 = createRealmRole("realm-child");
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourcePath("realm-composite"), roleRep1, ResourceType.REALM_ROLE);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourcePath("realm-child"), roleRep2, ResourceType.REALM_ROLE);
+
+        roleRep1 = managedRealm.admin().roles().get("realm-composite").toRepresentation();
+        roleRep2 = managedRealm.admin().roles().get("realm-child").toRepresentation();
+
+        managedRealm.admin().roles().get("realm-composite").addComposites(List.of(roleRep2));
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourceCompositesPath("realm-composite"), List.of(roleRep2), ResourceType.REALM_ROLE);
+
+        String accountMgmtId = managedRealm.admin().clients().findByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).get(0).getId();
+        RoleRepresentation viewAccountRoleRep = managedRealm.admin().clients().get(accountMgmtId).roles().get(AccountRoles.VIEW_PROFILE).toRepresentation();
+
+        scopesResource.realmLevel().add(List.of(roleRep1));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeMappingsRealmLevelPath(id), List.of(roleRep1), ResourceType.REALM_SCOPE_MAPPING);
+
+        scopesResource.clientLevel(accountMgmtId).add(List.of(viewAccountRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeMappingsClientLevelPath(id, accountMgmtId), List.of(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
+
+        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
+        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
+        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAll(), AccountRoles.VIEW_PROFILE);
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listEffective(), AccountRoles.VIEW_PROFILE);
+
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAvailable(), AccountRoles.MANAGE_ACCOUNT, AccountRoles.MANAGE_ACCOUNT_LINKS, AccountRoles.VIEW_APPLICATIONS, AccountRoles.VIEW_CONSENT, AccountRoles.MANAGE_CONSENT, AccountRoles.DELETE_ACCOUNT, AccountRoles.VIEW_GROUPS);
+
+        Assert.assertNames(scopesResource.getAll().getRealmMappings(), "realm-composite");
+        Assert.assertNames(scopesResource.getAll().getClientMappings().get(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getMappings(), AccountRoles.VIEW_PROFILE);
+
+        scopesResource.realmLevel().remove(List.of(roleRep1));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeMappingsRealmLevelPath(id), List.of(roleRep1), ResourceType.REALM_SCOPE_MAPPING);
+
+        scopesResource.clientLevel(accountMgmtId).remove(List.of(viewAccountRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeMappingsClientLevelPath(id, accountMgmtId), List.of(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
+
+        Assert.assertNames(scopesResource.realmLevel().listAll());
+        Assert.assertNames(scopesResource.realmLevel().listEffective());
+        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, "realm-composite", "realm-child", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAll());
+
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAvailable(), AccountRoles.VIEW_PROFILE, AccountRoles.MANAGE_ACCOUNT, AccountRoles.MANAGE_ACCOUNT_LINKS, AccountRoles.VIEW_APPLICATIONS, AccountRoles.VIEW_CONSENT, AccountRoles.MANAGE_CONSENT, AccountRoles.DELETE_ACCOUNT, AccountRoles.VIEW_GROUPS);
+
+        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listEffective());
+    }
+
+    /**
+     * Test for KEYCLOAK-10603.
+     */
+    @Test
+    public void rolesCanBeAddedToScopeEvenWhenTheyAreAlreadyIndirectlyAssigned() {
+        Response response =
+                managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("test-client").fullScopeEnabled(false).build());
+        String testedClientUuid = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(testedClientUuid).remove());
+
+        createRealmRole("realm-composite");
+        createRealmRole("realm-child");
+        managedRealm.admin().roles().get("realm-composite")
+                .addComposites(List.of(managedRealm.admin().roles().get("realm-child").toRepresentation()));
+
+        response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("role-container-client").build());
+        String roleContainerClientUuid = ApiUtil.getCreatedId(response);
+        RolesResource roleContainerClientRolesRsc = managedRealm.admin().clients().get(roleContainerClientUuid).roles();
+        managedRealm.cleanup().add(r -> r.clients().get(roleContainerClientUuid).remove());
+
+        roleContainerClientRolesRsc.create(RoleBuilder.create().name("client-composite").build());
+        roleContainerClientRolesRsc.create(RoleBuilder.create().name("client-child").build());
+        roleContainerClientRolesRsc.get("client-composite").addComposites(List.of(
+                roleContainerClientRolesRsc.get("client-child").toRepresentation()));
+
+        // Make indirect assignments: assign composite roles
+        RoleMappingResource scopesResource = managedRealm.admin().clients().get(testedClientUuid).getScopeMappings();
+        scopesResource.realmLevel().add(
+                List.of(managedRealm.admin().roles().get("realm-composite").toRepresentation()));
+        scopesResource.clientLevel(roleContainerClientUuid).add(
+                List.of(roleContainerClientRolesRsc.get("client-composite").toRepresentation()));
+
+        // check state before making the direct assignments
+        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
+        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite");
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable(), "client-child");
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
+                "client-child");
+
+        // Make direct assignments for roles which are already indirectly assigned
+        scopesResource.realmLevel().add(List.of(managedRealm.admin().roles().get("realm-child").toRepresentation()));
+        scopesResource.clientLevel(roleContainerClientUuid).add(
+                List.of(roleContainerClientRolesRsc.get("client-child").toRepresentation()));
+
+        // List realm roles
+        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite", "realm-child");
+        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        // List client roles
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite",
+                "client-child");
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable());
+        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
+                "client-child");
+    }
+
+    @Test
+    public void scopesRoleRemoval() {
+        // clientA to test scope mappings
+        Response response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("clientA").fullScopeEnabled(false).build());
+        String idA = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(idA).remove());
+
+        // clientB to create a client role for clientA
+        response = managedRealm.admin().clients().create(ClientConfigBuilder.create().clientId("clientB").fullScopeEnabled(false).build());
+        String idB = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(idB).remove());
+
+        adminEvents.skip(2);
+
+        RoleMappingResource scopesResource = managedRealm.admin().clients().get(idA).getScopeMappings();
+
+        // create a realm role and a role in clientB
+        RoleRepresentation realmRoleRep = RoleBuilder.create().name("realm-role").build();
+        managedRealm.admin().roles().create(realmRoleRep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourcePath(realmRoleRep.getName()), realmRoleRep, ResourceType.REALM_ROLE);
+        RoleRepresentation clientBRoleRep = RoleBuilder.create().name("clientB-role").build();
+        managedRealm.admin().clients().get(idB).roles().create(clientBRoleRep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(idB, clientBRoleRep.getName()), clientBRoleRep, ResourceType.CLIENT_ROLE);
+
+        // assing to clientA both roles to the scope mappings
+        realmRoleRep = managedRealm.admin().roles().get(realmRoleRep.getName()).toRepresentation();
+        clientBRoleRep = managedRealm.admin().clients().get(idB).roles().get(clientBRoleRep.getName()).toRepresentation();
+        scopesResource.realmLevel().add(List.of(realmRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeMappingsRealmLevelPath(idA), List.of(realmRoleRep), ResourceType.REALM_SCOPE_MAPPING);
+        scopesResource.clientLevel(idB).add(List.of(clientBRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeMappingsClientLevelPath(idA, idB), List.of(clientBRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
+
+        // assert the roles are there
+        Assert.assertNames(scopesResource.realmLevel().listAll(), realmRoleRep.getName());
+        Assert.assertNames(scopesResource.clientLevel(idB).listAll(), clientBRoleRep.getName());
+
+        // delete realm role and check everything is refreshed ok
+        managedRealm.admin().roles().deleteRole(realmRoleRep.getName());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.roleResourcePath(realmRoleRep.getName()), ResourceType.REALM_ROLE);
+        Assert.assertNames(scopesResource.realmLevel().listAll());
+        Assert.assertNames(scopesResource.clientLevel(idB).listAll(), clientBRoleRep.getName());
+
+        // delete client role and check everything is refreshed ok
+        managedRealm.admin().clients().get(idB).roles().deleteRole(clientBRoleRep.getName());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(idB, clientBRoleRep.getName()), ResourceType.CLIENT_ROLE);
+        Assert.assertNames(scopesResource.realmLevel().listAll());
+        Assert.assertNames(scopesResource.clientLevel(idB).listAll());
+    }
+
+    public void protocolMappersTest(String clientDbId, ProtocolMappersResource mappersResource) {
+        // assert default mappers found
+        List<ProtocolMapperRepresentation> protocolMappers = mappersResource.getMappers();
+
+        String emailMapperId = null;
+        String usernameMapperId = null;
+        String fooMapperId = null;
+        for (ProtocolMapperRepresentation mapper : protocolMappers) {
+            if (mapper.getName().equals(OIDCLoginProtocolFactory.EMAIL)) {
+                emailMapperId = mapper.getId();
+            } else if (mapper.getName().equals(OIDCLoginProtocolFactory.USERNAME)) {
+                usernameMapperId = mapper.getId();
+            } else if (mapper.getName().equals("foo")) {
+                fooMapperId = mapper.getId();
+            }
+        }
+
+        // Builtin mappers are not here
+        assertNull(emailMapperId);
+        assertNull(usernameMapperId);
+
+        assertNull(fooMapperId);
+
+        // Create foo mapper
+        ProtocolMapperRepresentation fooMapper = new ProtocolMapperRepresentation();
+        fooMapper.setName("foo");
+        fooMapper.setProtocol("openid-connect");
+        fooMapper.setProtocolMapper("oidc-hardcoded-claim-mapper");
+        Response response = mappersResource.createMapper(fooMapper);
+        String location = response.getLocation().toString();
+        fooMapperId = location.substring(location.lastIndexOf("/") + 1);
+        response.close();
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), fooMapper, ResourceType.PROTOCOL_MAPPER);
+
+        fooMapper = mappersResource.getMapperById(fooMapperId);
+        assertEquals("foo", fooMapper.getName());
+
+        // Update foo mapper
+        mappersResource.update(fooMapperId, fooMapper);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), fooMapper, ResourceType.PROTOCOL_MAPPER);
+
+        fooMapper = mappersResource.getMapperById(fooMapperId);
+
+        // Remove foo mapper
+        mappersResource.delete(fooMapperId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), ResourceType.PROTOCOL_MAPPER);
+        String finalFooMapperId = fooMapperId;
+        assertThrows(NotFoundException.class, () -> mappersResource.getMapperById(finalFooMapperId), "Not expected to find deleted mapper");
+    }
+
+    @Test
+    public void updateClientWithProtocolMapper() {
+        ClientRepresentation rep = new ClientRepresentation();
+        rep.setClientId("my-app");
+
+        ProtocolMapperRepresentation fooMapper = new ProtocolMapperRepresentation();
+        fooMapper.setName("foo");
+        fooMapper.setProtocol("openid-connect");
+        fooMapper.setProtocolMapper("oidc-hardcoded-claim-mapper");
+        rep.setProtocolMappers(Collections.singletonList(fooMapper));
+
+        Response response = managedRealm.admin().clients().create(rep);
+        String id = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(id).remove());
+
+        ClientResource clientResource = managedRealm.admin().clients().get(id);
+        assertNotNull(clientResource);
+        ClientRepresentation client = clientResource.toRepresentation();
+        List<ProtocolMapperRepresentation> protocolMappers = client.getProtocolMappers();
+        assertEquals(1, protocolMappers.size());
+        ProtocolMapperRepresentation mapper = protocolMappers.get(0);
+        assertEquals("foo", mapper.getName());
+
+        ClientRepresentation newClient = new ClientRepresentation();
+        newClient.setId(client.getId());
+        newClient.setClientId(client.getClientId());
+
+        ProtocolMapperRepresentation barMapper = new ProtocolMapperRepresentation();
+        barMapper.setName("bar");
+        barMapper.setProtocol("openid-connect");
+        barMapper.setProtocolMapper("oidc-hardcoded-role-mapper");
+        protocolMappers.add(barMapper);
+        newClient.setProtocolMappers(protocolMappers);
+
+        managedRealm.admin().clients().get(client.getId()).update(newClient);
+
+        ClientRepresentation storedClient = managedRealm.admin().clients().get(client.getId()).toRepresentation();
+        assertClient(client, storedClient);
+    }
+
+    public static void assertClient(ClientRepresentation client, ClientRepresentation storedClient) {
+        if (client.getClientId() != null) Assert.assertEquals(client.getClientId(), storedClient.getClientId());
+        if (client.getName() != null) Assert.assertEquals(client.getName(), storedClient.getName());
+        if (client.isEnabled() != null) Assert.assertEquals(client.isEnabled(), storedClient.isEnabled());
+        if (client.isAlwaysDisplayInConsole() != null)
+            Assert.assertEquals(client.isAlwaysDisplayInConsole(), storedClient.isAlwaysDisplayInConsole());
+        if (client.isBearerOnly() != null) Assert.assertEquals(client.isBearerOnly(), storedClient.isBearerOnly());
+        if (client.isPublicClient() != null)
+            Assert.assertEquals(client.isPublicClient(), storedClient.isPublicClient());
+        if (client.isFullScopeAllowed() != null)
+            Assert.assertEquals(client.isFullScopeAllowed(), storedClient.isFullScopeAllowed());
+        if (client.getRootUrl() != null) Assert.assertEquals(client.getRootUrl(), storedClient.getRootUrl());
+        if (client.getAdminUrl() != null) Assert.assertEquals(client.getAdminUrl(), storedClient.getAdminUrl());
+        if (client.getBaseUrl() != null) Assert.assertEquals(client.getBaseUrl(), storedClient.getBaseUrl());
+        if (client.isSurrogateAuthRequired() != null)
+            Assert.assertEquals(client.isSurrogateAuthRequired(), storedClient.isSurrogateAuthRequired());
+        if (client.getClientAuthenticatorType() != null)
+            Assert.assertEquals(client.getClientAuthenticatorType(), storedClient.getClientAuthenticatorType());
+        if (client.getSecret() != null) Assert.assertEquals(client.getSecret(), storedClient.getSecret());
+
+        if (client.getNotBefore() != null) {
+            Assertions.assertEquals(client.getNotBefore(), storedClient.getNotBefore());
+        }
+        if (client.getDefaultRoles() != null) {
+            Set<String> set = Set.of(client.getDefaultRoles());
+            Set<String> storedSet = Set.of(storedClient.getDefaultRoles());
+
+            Assertions.assertEquals(set, storedSet);
+        }
+
+        List<String> redirectUris = client.getRedirectUris();
+        if (redirectUris != null) {
+            Set<String> set = new HashSet<>(client.getRedirectUris());
+            Set<String> storedSet = new HashSet<>(storedClient.getRedirectUris());
+
+            Assertions.assertEquals(set, storedSet);
+        }
+
+        List<String> webOrigins = client.getWebOrigins();
+        if (webOrigins != null) {
+            Set<String> set = new HashSet<>(client.getWebOrigins());
+            Set<String> storedSet = new HashSet<>(storedClient.getWebOrigins());
+
+            Assertions.assertEquals(set, storedSet);
+        }
+
+        List<ProtocolMapperRepresentation> protocolMappers = client.getProtocolMappers();
+        if (protocolMappers != null) {
+            Set<String> set = protocolMappers.stream()
+                    .map(ProtocolMapperRepresentation::getName)
+                    .collect(Collectors.toSet());
+            Set<String> storedSet = storedClient.getProtocolMappers().stream()
+                    .map(ProtocolMapperRepresentation::getName)
+                    .collect(Collectors.toSet());
+
+            Assertions.assertEquals(set, storedSet);
+        }
+    }
+
+    private RoleRepresentation createRealmRole(String roleName) {
+        RoleRepresentation role = RoleBuilder.create().name(roleName).build();
+        managedRealm.admin().roles().create(role);
+
+        String createdId = managedRealm.admin().roles().get(role.getName()).toRepresentation().getId();
+        managedRealm.cleanup().add(r -> r.rolesById().deleteRole(createdId));
+
+        return role;
+    }
+
+    private static class ClientTestRealmConfig implements RealmConfig {
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+
+            realm.addUser("test-user@localhost")
+                    .enabled(true)
+                    .email("test-user@localhost")
+                    .name("Tom", "Brady")
+                    .password("password");
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/CrossRealmPermissionsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/CrossRealmPermissionsTest.java
new file mode 100644
index 000000000000..f90ee6fedebb
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/CrossRealmPermissionsTest.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.common.util.Time;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class CrossRealmPermissionsTest {
+
+    @InjectRealm(ref = "realm1", config = CrossRealmPermissionsRealmConfig.class)
+    ManagedRealm managedRealm1;
+
+    @InjectRealm(ref = "realm2", config = CrossRealmPermissionsRealmConfig.class)
+    ManagedRealm managedRealm2;
+
+    @Test
+    public void users() {
+        UserRepresentation user = UserConfigBuilder.create()
+                .username("randomuser-" + Time.currentTimeMillis())
+                .build();
+        final String userUuid = ApiUtil.getCreatedId(managedRealm1.admin().users().create(user));
+
+        expectNotFound(realm ->
+                realm.users().get(userUuid).toRepresentation(), managedRealm2.admin()
+        );
+
+        expectNotFound(realm ->
+                realm.users().get(userUuid).update(new UserRepresentation()), managedRealm2.admin()
+        );
+
+        expectNotFound(realm ->
+                realm.users().get(userUuid).remove(), managedRealm2.admin()
+        );
+
+        expectNotFound(realm ->
+                realm.users().get(userUuid).getUserSessions(), managedRealm2.admin()
+        );
+    }
+
+    private void expectNotFound(final Invocation invocation, RealmResource realm) {
+        expectNotFound((realm1, response) -> invocation.invoke(realm1), realm);
+    }
+
+    private void expectNotFound(InvocationWithResponse invocation, RealmResource realm) {
+        int statusCode = 0;
+        try {
+            AtomicReference<Response> responseReference = new AtomicReference<>();
+            invocation.invoke(realm, responseReference);
+            Response response = responseReference.get();
+            if (response != null) {
+                statusCode = response.getStatus();
+            } else {
+                Assertions.fail("Expected failure");
+            }
+        } catch (ClientErrorException e) {
+            statusCode = e.getResponse().getStatus();
+        }
+
+        Assertions.assertEquals(404, statusCode);
+    }
+
+    private interface Invocation {
+
+        void invoke(RealmResource realm);
+
+    }
+
+    private interface InvocationWithResponse {
+
+        void invoke(RealmResource realm, AtomicReference<Response> response);
+
+    }
+
+    private static class CrossRealmPermissionsRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.addUser(AdminRoles.REALM_ADMIN)
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN)
+                    .password("password");
+
+            return realm;
+        }
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/DeclarativeUserTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/DeclarativeUserTest.java
new file mode 100644
index 000000000000..26dc33447906
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/DeclarativeUserTest.java
@@ -0,0 +1,241 @@
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.admin.client.resource.UsersResource;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.ErrorRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.userprofile.DeclarativeUserProfileProvider;
+import org.keycloak.userprofile.UserProfileProvider;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.setUserProfileConfiguration;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+@KeycloakIntegrationTest
+public class DeclarativeUserTest {
+
+    @InjectRealm(config = DeclarativeRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    private static final String REQUIRED_ATTR_KEY = "required-attr";
+
+    @BeforeEach
+    public void onBefore() {
+        setUserProfileConfiguration(managedRealm.admin(), "{\"attributes\": ["
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"aName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"custom-a\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"custom-hidden\"},"
+                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr2\", " + PERMISSIONS_ALL + "}]}");
+    }
+
+    @Test
+    public void testDoNotReturnAttributeIfNotReadble() {
+        UserRepresentation user1 = new UserRepresentation();
+        user1.setUsername("user1");
+        user1.singleAttribute("attr1", "value1user1");
+        user1.singleAttribute("attr2", "value2user1");
+        String user1Id = createUserWithCleanup(user1);
+
+        user1 = managedRealm.admin().users().get(user1Id).toRepresentation();
+        Map<String, List<String>> attributes = user1.getAttributes();
+        Assertions.assertEquals(2, attributes.size());
+        Assertions.assertFalse(attributes.containsKey("custom-hidden"));
+
+        setUserProfileConfiguration(managedRealm.admin(), "{\"attributes\": ["
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"aName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"custom-a\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"custom-hidden\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr2\", " + PERMISSIONS_ALL + "}]}");
+
+
+        user1 = managedRealm.admin().users().get(user1Id).toRepresentation();
+        attributes = user1.getAttributes();
+        Assertions.assertEquals(2, attributes.size());
+        Assertions.assertFalse(attributes.containsKey("custom-hidden"));
+    }
+
+    @Test
+    public void testUpdateUnsetAttributeWithEmptyValue() {
+        setUserProfileConfiguration(managedRealm.admin(), "{\"attributes\": ["
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr2\"}]}");
+
+        UserRepresentation user1 = new UserRepresentation();
+        user1.setUsername("user1");
+        // set an attribute to later remove it from the configuration
+        user1.singleAttribute("attr1", "some-value");
+        String user1Id = createUserWithCleanup(user1);
+
+        // remove the attr1 attribute from the configuration
+        setUserProfileConfiguration(managedRealm.admin(), "{\"attributes\": ["
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"attr2\"}]}");
+
+        UserResource userResource = managedRealm.admin().users().get(user1Id);
+        user1 = userResource.toRepresentation();
+        Assertions.assertNull(user1.getAttributes());
+        user1.singleAttribute("attr2", "");
+        // should be able to update the user when a read-only attribute has an empty or null value
+        userResource.update(user1);
+        user1 = userResource.toRepresentation();
+        Assertions.assertNull(user1.getAttributes());
+        user1.setAttributes(new HashMap<>());
+        user1.getAttributes().put("attr2", null);
+        userResource.update(user1);
+        user1 = userResource.toRepresentation();
+        Assertions.assertNull(user1.getAttributes());
+    }
+
+    @Test
+    public void testValidationUsingExistingAttributes() {
+        setUserProfileConfiguration(managedRealm.admin(), "{\"attributes\": ["
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"" + REQUIRED_ATTR_KEY + "\", \"required\": {}, " + PERMISSIONS_ALL + "}]}");
+
+        UserRepresentation user1 = new UserRepresentation();
+        user1.setUsername("user1");
+        // set an attribute to later remove it from the configuration
+        user1.singleAttribute(REQUIRED_ATTR_KEY, "some-value");
+        String user1Id = createUserWithCleanup(user1);
+
+        UserResource userResource = managedRealm.admin().users().get(user1Id);
+        user1 = userResource.toRepresentation();
+        user1.setFirstName("changed");
+        user1.setAttributes(null);
+
+        // do not validate REQUIRED_ATTR_KEY because the attribute list is not provided and the user has the attribute
+        userResource.update(user1);
+        user1 = userResource.toRepresentation();
+        Assertions.assertEquals("changed", user1.getFirstName());
+
+        user1.setAttributes(Collections.emptyMap());
+        String expectedErrorMessage = "error-user-attribute-required";
+        verifyUserUpdateFails(managedRealm.admin().users(), user1Id, user1, expectedErrorMessage);
+    }
+
+    private void verifyUserUpdateFails(UsersResource usersResource, String userId, UserRepresentation user,
+            String expectedErrorMessage) {
+        UserResource userResource = usersResource.get(userId);
+        try {
+            userResource.update(user);
+            Assertions.fail("Should fail with errorMessage: " + expectedErrorMessage);
+        } catch (BadRequestException badRequest) {
+            try (Response response = badRequest.getResponse()) {
+                assertThat(response.getStatus(), equalTo(400));
+                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+                assertThat(error.getErrorMessage(), equalTo(expectedErrorMessage));
+            }
+        }
+    }
+
+    @Test
+    public void testDefaultUserProfileProviderIsActive() {
+        runOnServer.run(session -> {
+            Set<UserProfileProvider> providers = session.getAllProviders(UserProfileProvider.class);
+            assertThat(providers, notNullValue());
+            assertThat(providers.isEmpty(), is(false));
+
+            UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
+            assertThat(provider, notNullValue());
+            assertThat(DeclarativeUserProfileProvider.class.getName(), is(provider.getClass().getName()));
+            assertThat(provider, instanceOf(DeclarativeUserProfileProvider.class));
+        });
+    }
+
+    @Test
+    public void testUserLocale() {
+        RealmRepresentation realmRep = managedRealm.admin().toRepresentation();
+        Boolean internationalizationEnabled = realmRep.isInternationalizationEnabled();
+        realmRep.setInternationalizationEnabled(true);
+        managedRealm.admin().update(realmRep);
+
+        try {
+            UserRepresentation user1 = new UserRepresentation();
+            user1.setUsername("user1");
+            user1.singleAttribute(UserModel.LOCALE, "pt_BR");
+            String user1Id = createUserWithCleanup(user1);
+
+            UserResource userResource = managedRealm.admin().users().get(user1Id);
+            user1 = userResource.toRepresentation();
+            Assertions.assertEquals("pt_BR", user1.getAttributes().get(UserModel.LOCALE).get(0));
+
+            realmRep.setInternationalizationEnabled(false);
+            managedRealm.admin().update(realmRep);
+
+            user1 = userResource.toRepresentation();
+            Assertions.assertNull(user1.getAttributes());
+        } finally {
+            realmRep.setInternationalizationEnabled(internationalizationEnabled);
+            managedRealm.admin().update(realmRep);
+        }
+    }
+
+    private String createUserWithCleanup(UserRepresentation userRep) {
+        Response response = managedRealm.admin().users().create(userRep);
+        String createdId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.users().get(createdId).remove());
+
+        return createdId;
+    }
+
+    public static class DeclarativeRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.internationalizationEnabled(true)
+                    .supportedLocales("en", "de");
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/IllegalAdminUpgradeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/IllegalAdminUpgradeTest.java
new file mode 100644
index 000000000000..367e575a3781
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/IllegalAdminUpgradeTest.java
@@ -0,0 +1,813 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+import java.util.LinkedList;
+import java.util.List;
+
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@KeycloakIntegrationTest(config = IllegalAdminUpgradeTest.IllegalAdminKeycloakServerConf.class)
+public class IllegalAdminUpgradeTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm masterRealm;
+
+    @InjectAdminClientFactory
+    AdminClientFactory adminClientFactory;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    private static final String REALM_NAME = "default";
+    private static final String MASTER_REALM_NAME = "master";
+
+
+    public static void setupUsers(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        RealmModel master = session.realms().getRealmByName(MASTER_REALM_NAME);
+        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+        ClientModel realmMasterAdminClient = realm.getMasterAdminClient();
+        RoleModel realmManageUsers = realmAdminClient.getRole(AdminRoles.MANAGE_USERS);
+        RoleModel masterManageUsers = realmMasterAdminClient.getRole(AdminRoles.MANAGE_USERS);
+        RoleModel masterMasterManageUSers = master.getMasterAdminClient().getRole(AdminRoles.MANAGE_USERS);
+
+        UserModel realmUser = session.users().addUser(realm, "userAdmin");
+        realmUser.setFirstName("User");
+        realmUser.setLastName("Admin");
+        realmUser.setEmail("user@admin");
+        realmUser.grantRole(realmManageUsers);
+        realmUser.setEnabled(true);
+        realmUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel masterUser = session.users().addUser(master, "userAdmin");
+        masterUser.grantRole(masterManageUsers);
+        masterUser.setFirstName("User");
+        masterUser.setLastName("Admin");
+        masterUser.setEmail("user@admin");
+        masterUser.setEnabled(true);
+        masterUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel masterAdmin = session.users().addUser(master, "masterAdmin");
+        masterAdmin.grantRole(masterMasterManageUSers);
+        masterAdmin.setFirstName("Master");
+        masterAdmin.setLastName("Admin");
+        masterAdmin.setEmail("master@admin");
+        masterAdmin.setEnabled(true);
+        masterAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel user = session.users().addUser(master, "user");
+        user.grantRole(masterManageUsers);
+        user.setFirstName("User");
+        user.setLastName("Foo");
+        user.setEmail("user@foo");
+        user.setEnabled(true);
+        user.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel userDef = session.users().addUser(realm, "user");
+        userDef.setFirstName("User");
+        userDef.setLastName("Foo");
+        userDef.setEmail("user@foo");
+        userDef.grantRole(realmManageUsers);
+        userDef.setEnabled(true);
+        userDef.credentialManager().updateCredential(UserCredentialModel.password("password"));
+    }
+
+    @Test
+    public void testRestEvaluation() throws Exception {
+        runOnServer.run(IllegalAdminUpgradeTest::setupUsers);
+
+        UserRepresentation realmUser = managedRealm.admin().users().search("user").get(0);
+        UserRepresentation masterUser = masterRealm.admin().users().search("user").get(0);
+
+        ClientRepresentation realmAdminClient = managedRealm.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+        RoleRepresentation realmManageAuthorization = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_AUTHORIZATION).toRepresentation();
+        RoleRepresentation realmViewAuthorization = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_AUTHORIZATION).toRepresentation();
+        RoleRepresentation realmManageClients = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_CLIENTS).toRepresentation();
+        RoleRepresentation realmViewClients = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_CLIENTS).toRepresentation();
+        RoleRepresentation realmManageEvents = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_EVENTS).toRepresentation();
+        RoleRepresentation realmViewEvents = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_EVENTS).toRepresentation();
+        RoleRepresentation realmManageIdentityProviders = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_IDENTITY_PROVIDERS).toRepresentation();
+        RoleRepresentation realmViewIdentityProviders = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_IDENTITY_PROVIDERS).toRepresentation();
+        RoleRepresentation realmManageRealm = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_REALM).toRepresentation();
+        RoleRepresentation realmViewRealm = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_REALM).toRepresentation();
+        RoleRepresentation realmImpersonate = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.IMPERSONATION).toRepresentation();
+        RoleRepresentation realmManageUsers = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_USERS).toRepresentation();
+        RoleRepresentation realmViewUsers = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_USERS).toRepresentation();
+        RoleRepresentation realmQueryUsers = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_USERS).toRepresentation();
+        RoleRepresentation realmQueryClients = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_CLIENTS).toRepresentation();
+        RoleRepresentation realmQueryGroups = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_GROUPS).toRepresentation();
+        RoleRepresentation realmAdmin = managedRealm.admin().clients().get(realmAdminClient.getId()).roles().get(AdminRoles.REALM_ADMIN).toRepresentation();
+
+        ClientRepresentation masterClient = masterRealm.admin().clients().findByClientId(REALM_NAME + "-realm").get(0);
+        RoleRepresentation masterManageAuthorization = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_AUTHORIZATION).toRepresentation();
+        RoleRepresentation masterViewAuthorization = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_AUTHORIZATION).toRepresentation();
+        RoleRepresentation masterManageClients = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_CLIENTS).toRepresentation();
+        RoleRepresentation masterViewClients = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_CLIENTS).toRepresentation();
+        RoleRepresentation masterManageEvents = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_EVENTS).toRepresentation();
+        RoleRepresentation masterViewEvents = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_EVENTS).toRepresentation();
+        RoleRepresentation masterManageIdentityProviders = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_IDENTITY_PROVIDERS).toRepresentation();
+        RoleRepresentation masterViewIdentityProviders = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_IDENTITY_PROVIDERS).toRepresentation();
+        RoleRepresentation masterManageRealm = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_REALM).toRepresentation();
+        RoleRepresentation masterViewRealm = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_REALM).toRepresentation();
+        RoleRepresentation masterImpersonate = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.IMPERSONATION).toRepresentation();
+        RoleRepresentation masterManageUsers = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_USERS).toRepresentation();
+        RoleRepresentation masterViewUsers = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_USERS).toRepresentation();
+        RoleRepresentation masterQueryUsers = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_USERS).toRepresentation();
+        RoleRepresentation masterQueryClients = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_CLIENTS).toRepresentation();
+        RoleRepresentation masterQueryGroups = masterRealm.admin().clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_GROUPS).toRepresentation();
+
+        List<RoleRepresentation> roles = new LinkedList<>();
+
+        {
+            ClientRepresentation client = realmAdminClient;
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("userAdmin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                roles.clear();
+                roles.add(realmManageAuthorization);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+            
+                roles.clear();
+                roles.add(realmViewAuthorization);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmAdmin);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageClients);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewClients);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageEvents);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewEvents);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageIdentityProviders);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewIdentityProviders);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageRealm);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewRealm);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmImpersonate);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmViewUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryGroups);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryClients);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+            }
+        }
+        // test master user with manage_users can't assign realm's admin roles
+        {
+            ClientRepresentation client = realmAdminClient;
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(MASTER_REALM_NAME).username("userAdmin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                roles.clear();
+                roles.add(realmManageAuthorization);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewAuthorization);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmAdmin);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageClients);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewClients);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageEvents);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewEvents);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageIdentityProviders);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewIdentityProviders);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageRealm);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmViewRealm);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmImpersonate);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+
+                roles.clear();
+                roles.add(realmManageUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmViewUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryGroups);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+
+                roles.clear();
+                roles.add(realmQueryClients);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+            }
+        }
+        // test master manageUsers only admin can do with master realm admin roles
+        {
+            ClientRepresentation client = masterClient;
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(MASTER_REALM_NAME).username("masterAdmin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                roles.clear();
+                roles.add(masterManageAuthorization);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewAuthorization);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterManageClients);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewClients);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterManageEvents);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewEvents);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterManageIdentityProviders);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewIdentityProviders);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterManageRealm);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewRealm);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterImpersonate);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterManageUsers);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterViewUsers);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterQueryUsers);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterQueryGroups);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));                    
+                }
+                roles.clear();
+                roles.add(masterQueryClients);
+                try {
+                    realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
+                            is(equalTo(Response.Status.FORBIDDEN)));
+                }
+            }
+        }
+        // test master admin can add all admin roles in realm
+        {
+            ClientRepresentation client = realmAdminClient;
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(MASTER_REALM_NAME).username("admin").password("admin").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                roles.clear();
+                roles.add(realmManageAuthorization);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmViewAuthorization);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmManageClients);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmViewClients);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmManageEvents);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmViewEvents);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmManageIdentityProviders);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmViewIdentityProviders);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmManageRealm);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmViewRealm);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmImpersonate);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmManageUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(realmViewUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(realmQueryUsers);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(realmQueryGroups);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(realmQueryClients);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(REALM_NAME).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+            }
+        }
+        // test that "admin" in master realm can assign all roles of master realm realm client admin roles
+        {
+            ClientRepresentation client = masterClient;
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(MASTER_REALM_NAME).username("admin").password("admin").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                roles.clear();
+                roles.add(masterManageAuthorization);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterViewAuthorization);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterManageClients);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterViewClients);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterManageEvents);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterViewEvents);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterManageIdentityProviders);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterViewIdentityProviders);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterManageRealm);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterViewRealm);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterImpersonate);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterManageUsers);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(masterViewUsers);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(masterQueryUsers);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                
+                roles.clear();
+                roles.add(masterQueryGroups);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+                
+                roles.clear();
+                roles.add(masterQueryClients);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
+                realmClient.realm(MASTER_REALM_NAME).users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
+            }
+        }
+    }
+
+    public static class IllegalAdminKeycloakServerConf implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder builder) {
+            builder.features(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
+            return builder;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/ImpersonationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/ImpersonationTest.java
new file mode 100644
index 000000000000..1287ccf66059
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/ImpersonationTest.java
@@ -0,0 +1,511 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.methods.HttpUriRequest;
+import org.apache.http.client.methods.RequestBuilder;
+import org.apache.http.impl.client.BasicCookieStore;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.util.EntityUtils;
+import org.hamcrest.MatcherAssert;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.Config;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.common.Profile;
+import org.keycloak.cookie.CookieType;
+import org.keycloak.events.EventType;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.models.ImpersonationSessionNote;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectEvents;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.EventMatchers;
+import org.keycloak.testframework.events.Events;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.TestApp;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectTestApp;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfig;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testframework.ui.annotations.InjectPage;
+import org.keycloak.testframework.ui.annotations.InjectWebDriver;
+import org.keycloak.testframework.ui.page.LoginPage;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.CredentialBuilder;
+import org.openqa.selenium.Cookie;
+import org.openqa.selenium.WebDriver;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+
+/**
+ * Tests Undertow Adapter
+ *
+ * @author <a href="mailto:bburke@redhat.com">Bill Burke</a>
+ */
+@KeycloakIntegrationTest(config = ImpersonationTest.ImpersonationTestServerConfig.class)
+public class ImpersonationTest {
+
+    @InjectRealm(ref = "test", config = ImpersonationTestRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectUser(ref = "test-user", realmRef = "test", config = TestUserConfig.class)
+    ManagedUser managedUser;
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm masterRealm;
+
+    @InjectAdminClientFactory
+    AdminClientFactory clientFactory;
+
+    @InjectRunOnServer(realmRef = "test")
+    RunOnServerClient runOnServer;
+
+    @InjectOAuthClient(realmRef = "test")
+    OAuthClient oauth;
+
+    @InjectTestApp
+    TestApp testApp;
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    @InjectWebDriver
+    WebDriver driver;
+
+    @InjectPage
+    LoginPage loginPage;
+
+    @InjectEvents(ref = "test-events", realmRef = "test")
+    Events events;
+
+    @Test
+    public void testImpersonateByMasterAdmin() {
+        // test that composite is set up right for impersonation role
+        testSuccessfulImpersonation("admin", Config.getAdminRealm());
+    }
+
+    @Test
+    public void testImpersonateByMasterImpersonator() {
+        String userId;
+        try (Response response = masterRealm.admin().users().create(UserConfigBuilder.create().username("master-impersonator").build())) {
+            userId = ApiUtil.getCreatedId(response);
+        }
+
+        UserResource user = masterRealm.admin().users().get(userId);
+        user.resetPassword(CredentialBuilder.create().password("password").build());
+
+        ClientResource testRealmClient = ApiUtil.findClientByClientId(masterRealm.admin(), managedRealm.getName() + "-realm");
+
+        List<RoleRepresentation> roles = new LinkedList<>();
+        roles.add(ApiUtil.findClientRoleByName(testRealmClient, AdminRoles.VIEW_USERS).toRepresentation());
+        roles.add(ApiUtil.findClientRoleByName(testRealmClient, AdminRoles.IMPERSONATION).toRepresentation());
+
+        user.roles().clientLevel(testRealmClient.toRepresentation().getId()).add(roles);
+
+        testSuccessfulImpersonation("master-impersonator", Config.getAdminRealm());
+
+        masterRealm.admin().users().get(userId).remove();
+    }
+
+    @Test
+    public void testImpersongetServiceAccountUserateByTestImpersonator() {
+        testSuccessfulImpersonation("impersonator", managedRealm.getName());
+    }
+
+    @Test
+    public void testImpersonateByTestAdmin() {
+        // test that composite is set up right for impersonation role
+        testSuccessfulImpersonation("realm-admin", managedRealm.getName());
+    }
+
+    @Test
+    public void testImpersonateByTestBadImpersonator() {
+        testForbiddenImpersonation("bad-impersonator", managedRealm.getName());
+    }
+
+    @Test
+    public void testImpersonationFailsForDisabledUser() {
+        UserResource impersonatedUserResource = managedRealm.admin().users().get(managedUser.getId());
+        UserRepresentation impersonatedUserRepresentation = impersonatedUserResource.toRepresentation();
+        impersonatedUserRepresentation.setEnabled(false);
+        impersonatedUserResource.update(impersonatedUserRepresentation);
+        try {
+            testBadRequestImpersonation("impersonator", managedRealm.getName(), managedUser.getId(), managedRealm.getName(), "User is disabled");
+        } finally {
+            impersonatedUserRepresentation.setEnabled(true);
+            impersonatedUserResource.update(impersonatedUserRepresentation);
+        }
+    }
+
+    @Test
+    public void testImpersonateByMastertBadImpersonator() {
+        String userId;
+        try (Response response = masterRealm.admin().users().create(UserConfigBuilder.create().username("master-bad-impersonator").build())) {
+            userId = ApiUtil.getCreatedId(response);
+        }
+        masterRealm.admin().users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
+
+        testForbiddenImpersonation("master-bad-impersonator", Config.getAdminRealm());
+
+        masterRealm.admin().users().get(userId).remove();
+    }
+
+
+    // KEYCLOAK-5981
+    @Test
+    public void testImpersonationWorksWhenAuthenticationSessionExists() throws Exception {
+        // Open the URL for the client (will redirect to Keycloak server AuthorizationEndpoint and create authenticationSession)
+        oauth.openLoginForm();
+        Assertions.assertTrue(loginPage.isActivePage());
+
+        // Impersonate and get SSO cookie. Setup that cookie for webDriver
+        for (Cookie cookie : testSuccessfulImpersonation("realm-admin", managedRealm.getName())) {
+            driver.manage().addCookie(cookie);
+        }
+
+        // Open the URL again - should be directly redirected to the app due the SSO login
+        oauth.openLoginForm();
+
+        //KEYCLOAK-12783
+        Assertions.assertTrue(Objects.requireNonNull(driver.getCurrentUrl()).contains(testApp.getRedirectionUri()));
+    }
+
+    // KEYCLOAK-17655
+    @Test
+    public void testImpersonationBySameRealmServiceAccount() throws Exception {
+        // Create test client service account
+        ClientRepresentation clientApp = ClientConfigBuilder.create()
+                .clientId("service-account-cl")
+                .secret("password")
+                .serviceAccountsEnabled(true)
+                .build();
+        clientApp.setServiceAccountsEnabled(true);
+        managedRealm.admin().clients().create(clientApp);
+
+        UserRepresentation user = ApiUtil.findClientByClientId(managedRealm.admin(), "service-account-cl").getServiceAccountUser();
+        user.setServiceAccountClientId("service-account-cl");
+
+        // add impersonation roles
+        ApiUtil.assignClientRoles(managedRealm.admin(), user.getId(), Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.IMPERSONATION);
+
+        // Impersonation
+        testSuccessfulServiceAccountImpersonation(user, managedRealm.getName());
+
+        // test impersonation over the service account fails
+        testBadRequestImpersonation("impersonator", managedRealm.getName(), user.getId(), managedRealm.getName(), "Service accounts cannot be impersonated");
+
+        // Remove test client
+        ApiUtil.findClientByClientId(managedRealm.admin(), "service-account-cl").remove();
+    }
+    @Test
+    public void testImpersonationByMasterRealmServiceAccount() throws Exception {
+        // Create test client service account
+        ClientRepresentation clientApp = ClientConfigBuilder.create()
+                .clientId("service-account-cl")
+                .secret("password")
+                .serviceAccountsEnabled(true)
+                .build();
+        masterRealm.admin().clients().create(clientApp);
+
+        UserRepresentation user = ApiUtil.findClientByClientId(masterRealm.admin(), "service-account-cl").getServiceAccountUser();
+        user.setServiceAccountClientId("service-account-cl");
+
+        // add impersonation roles
+        ApiUtil.assignRealmRoles(masterRealm.admin(), user.getId(), "admin");
+
+        // Impersonation
+        testSuccessfulServiceAccountImpersonation(user, masterRealm.getName());
+
+        // Remove test client
+        ApiUtil.findClientByClientId(masterRealm.admin(), "service-account-cl").remove();
+    }
+
+    // Return the SSO cookie from the impersonated session
+    private Set<Cookie> testSuccessfulImpersonation(String admin, String adminRealm) {
+        // Login adminClient
+        try (Keycloak client = login(admin, adminRealm)) {
+            // Impersonate
+            return impersonate(client, admin, adminRealm);
+        }
+    }
+
+    private Set<Cookie> impersonate(Keycloak adminClient, String admin, String adminRealm) {
+        BasicCookieStore cookieStore = new BasicCookieStore();
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build()) {
+
+            HttpUriRequest req = RequestBuilder.post()
+                    .setUri(keycloakUrls.getBase() + "/admin/realms/test/users/" + managedUser.getId() + "/impersonation")
+                    .addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + adminClient.tokenManager().getAccessTokenString())
+                    .build();
+
+            HttpResponse res = httpClient.execute(req);
+            String resBody = EntityUtils.toString(res.getEntity());
+
+            Assertions.assertNotNull(resBody);
+            Assertions.assertTrue(resBody.contains("redirect"));
+
+            EventRepresentation event = events.poll();
+            Assertions.assertEquals(event.getType(), EventType.IMPERSONATE.toString());
+            MatcherAssert.assertThat(event.getSessionId(), EventMatchers.isUUID());
+            Assertions.assertEquals(event.getUserId(), managedUser.getId());
+            Assertions.assertTrue(event.getDetails().values().stream().anyMatch(f -> f.equals(admin)));
+            Assertions.assertTrue(event.getDetails().values().stream().anyMatch(f -> f.equals(adminRealm)));
+
+            String testRealm = managedRealm.getName();
+            // Fetch user session notes
+            final String userId = managedUser.getId();
+            final UserSessionNotesHolder notesHolder = runOnServer.fetch(session -> {
+                final RealmModel realm = session.realms().getRealmByName(testRealm);
+                final UserModel user = session.users().getUserById(realm, userId);
+                final UserSessionModel userSession = session.sessions().getUserSessionsStream(realm, user).filter(u -> u.getNotes().containsValue(admin)).findFirst().get();
+                return new UserSessionNotesHolder(userSession.getNotes());
+            }, UserSessionNotesHolder.class);
+
+            // Check impersonation details
+            final Map<String, String> notes = notesHolder.getNotes();
+            Assertions.assertNotNull(notes.get(ImpersonationSessionNote.IMPERSONATOR_ID.toString()));
+            Assertions.assertEquals(admin, notes.get(ImpersonationSessionNote.IMPERSONATOR_USERNAME.toString()));
+
+            Set<Cookie> cookies = cookieStore.getCookies().stream()
+                    .filter(c -> c.getName().startsWith(CookieType.IDENTITY.getName()))
+                    .map(c -> new Cookie(c.getName(), c.getValue(), c.getDomain(), c.getPath(), c.getExpiryDate(), c.isSecure(), true))
+                    .collect(Collectors.toSet());
+
+            Assertions.assertNotNull(cookies);
+            MatcherAssert.assertThat(cookies, is(not(empty())));
+            httpClient.close();
+
+            return cookies;
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private void testForbiddenImpersonation(String admin, String adminRealm) {
+        try (Keycloak client = createAdminClient(adminRealm, establishClientId(adminRealm), admin)) {
+            client.realms().realm(managedRealm.getName()).users().get(managedUser.getId()).impersonate();
+            Assertions.fail("Expected ClientErrorException wasn't thrown.");
+        } catch (ClientErrorException e) {
+            MatcherAssert.assertThat(e.getMessage(), containsString("403 Forbidden"));
+        }
+    }
+
+    private void testBadRequestImpersonation(String admin, String adminRealm, String impersonatedId,
+            String impersonatedRealm, String errorExpected) {
+        try (Keycloak client = createAdminClient(adminRealm, establishClientId(adminRealm), admin)) {
+            client.realms().realm(impersonatedRealm).users().get(impersonatedId).impersonate();
+            Assertions.fail("Expected ClientErrorException wasn't thrown.");
+        } catch (ClientErrorException e) {
+            Assertions.assertEquals(Response.Status.BAD_REQUEST, e.getResponse().getStatusInfo());
+            ErrorRepresentation error = e.getResponse().readEntity(ErrorRepresentation.class);
+            Assertions.assertEquals(errorExpected, error.getErrorMessage());
+        }
+    }
+
+
+    private String establishClientId(String realm) {
+        return realm.equals("master") ? Constants.ADMIN_CLI_CLIENT_ID : "myclient";
+    }
+
+    private Keycloak createAdminClient(String realm, String clientId, String username) {
+        String password = username.equals("admin") ? "admin" : "password";
+
+        return clientFactory.create()
+                .realm(realm)
+                .username(username)
+                .password(password)
+                .clientId(clientId)
+                .grantType(OAuth2Constants.PASSWORD).build();
+    }
+
+    private Keycloak login(String username, String realm) {
+        String clientId = establishClientId(realm);
+        Keycloak client = createAdminClient(realm, clientId, username);
+
+        client.tokenManager().grantToken();
+        // only poll for LOGIN event if realm is not master
+        // - since for master testing event listener is not installed
+        if (!realm.equals("master")) {
+            EventRepresentation e = events.poll();
+            Assertions.assertEquals(EventType.LOGIN.toString(), e.getType(), "Event type");
+            Assertions.assertEquals(clientId, e.getClientId(), "Client ID");
+        }
+        return client;
+    }
+
+
+    // Return the SSO cookie from the impersonated session
+    private Set<Cookie> testSuccessfulServiceAccountImpersonation(UserRepresentation serviceAccount, String serviceAccountRealm) {
+        // Login adminClient
+        try (Keycloak client = loginServiceAccount(serviceAccount, serviceAccountRealm)) {
+            // Impersonate test-user with service account
+            return impersonateServiceAccount(client);
+        }
+    }
+
+    private Keycloak loginServiceAccount(UserRepresentation serviceAccount, String serviceAccountRealm) {
+        Keycloak client = createServiceAccountClient(serviceAccountRealm, serviceAccount);
+        // get token
+        client.tokenManager().getAccessToken();
+        return client;
+    }
+
+    private Keycloak createServiceAccountClient(String serviceAccountRealm, UserRepresentation serviceAccount) {
+        return clientFactory.create().realm(serviceAccountRealm).clientId(serviceAccount.getServiceAccountClientId()).clientSecret("password").grantType(OAuth2Constants.CLIENT_CREDENTIALS).build();
+    }
+
+    private Set<Cookie> impersonateServiceAccount(Keycloak adminClient) {
+        BasicCookieStore cookieStore = new BasicCookieStore();
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build()) {
+
+            HttpUriRequest req = RequestBuilder.post()
+                    .setUri(keycloakUrls.getBase() + "/admin/realms/test/users/" + managedUser.getId() + "/impersonation")
+                    .addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + adminClient.tokenManager().getAccessTokenString())
+                    .build();
+
+            HttpResponse res = httpClient.execute(req);
+            String resBody = EntityUtils.toString(res.getEntity());
+
+            Assertions.assertNotNull(resBody);
+            Assertions.assertTrue(resBody.contains("redirect"));
+            Set<Cookie> cookies = cookieStore.getCookies().stream()
+                    .filter(c -> c.getName().startsWith(CookieType.IDENTITY.getName()))
+                    .map(c -> new Cookie(c.getName(), c.getValue(), c.getDomain(), c.getPath(), c.getExpiryDate(), c.isSecure(), true))
+                    .collect(Collectors.toSet());
+
+            Assertions.assertNotNull(cookies);
+            MatcherAssert.assertThat(cookies, is(not(empty())));
+            httpClient.close();
+
+            return cookies;
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static class UserSessionNotesHolder {
+        private Map<String, String> notes = new HashMap<>();
+
+        public UserSessionNotesHolder() {
+        }
+
+        public UserSessionNotesHolder(final Map<String, String> notes) {
+            this.notes = notes;
+        }
+
+        public void setNotes(final Map<String, String> notes) {
+            this.notes = notes;
+        }
+
+        public Map<String, String> getNotes() {
+            return notes;
+        }
+    }
+
+    public static class ImpersonationTestServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder server) {
+            server.features(Profile.Feature.IMPERSONATION);
+            return server;
+        }
+    }
+
+    private static class ImpersonationTestRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder config) {
+            config.addClient("myclient").clientId("myclient")
+                    .publicClient(true).directAccessGrants();
+
+            config.addUser("realm-admin")
+                    .password("password").name("My", "Test Admin")
+                    .email("my-test-admin@email.org").emailVerified()
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            config.addUser("impersonator")
+                    .password("password").name("My", "Test Impersonator")
+                    .email("my-test-impersonator@email.org").emailVerified()
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.IMPERSONATION)
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.VIEW_USERS);
+            config.addUser("bad-impersonator")
+                    .password("password").name("My", "Test Bad Impersonator")
+                    .email("my-test-bad-impersonator@email.org").emailVerified()
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.MANAGE_USERS);
+
+            return config;
+        }
+    }
+
+    private static class TestUserConfig implements UserConfig {
+
+        @Override
+        public UserConfigBuilder configure(UserConfigBuilder user) {
+            user.username("test-user");
+            user.password("password");
+            user.name("My", "Test");
+            user.email("test@email.org");
+            user.emailVerified();
+
+            return user;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/InitialAccessTokenResourceTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/InitialAccessTokenResourceTest.java
new file mode 100644
index 000000000000..fe528a15d059
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/InitialAccessTokenResourceTest.java
@@ -0,0 +1,198 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.BadRequestException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientInitialAccessResource;
+import org.keycloak.common.util.Time;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
+import org.keycloak.representations.idm.ClientInitialAccessPresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.remote.timeoffset.InjectTimeOffSet;
+import org.keycloak.testframework.remote.timeoffset.TimeOffSet;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.CoreMatchers.allOf;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThanOrEqualTo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class InitialAccessTokenResourceTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectTimeOffSet
+    TimeOffSet timeOffSet;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    private ClientInitialAccessResource resource;
+
+    @BeforeEach
+    public void before() {
+        resource = managedRealm.admin().clientInitialAccess();
+    }
+
+    @Test
+    public void testInitialAccessTokens() {
+        ClientInitialAccessCreatePresentation rep = new ClientInitialAccessCreatePresentation();
+        rep.setCount(2);
+        rep.setExpiration(100);
+
+        int time = Time.currentTime();
+
+        ClientInitialAccessPresentation response = resource.create(rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(response.getId()), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
+
+        assertNotNull(response.getId());
+        assertEquals(Integer.valueOf(2), response.getCount());
+        assertEquals(Integer.valueOf(2), response.getRemainingCount());
+        assertEquals(Integer.valueOf(100), response.getExpiration());
+        assertThat(response.getTimestamp(), allOf(greaterThanOrEqualTo(time), lessThanOrEqualTo(Time.currentTime())));
+        assertNotNull(response.getToken());
+
+        rep.setCount(3);
+        response = resource.create(rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(response.getId()), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
+
+        rep.setCount(4);
+        response = resource.create(rep);
+        String lastId = response.getId();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(lastId), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
+
+        List<ClientInitialAccessPresentation> list = resource.list();
+        assertEquals(3, list.size());
+
+        assertEquals(9, list.get(0).getCount() + list.get(1).getCount() + list.get(2).getCount());
+        assertNull(list.get(0).getToken());
+
+        // Delete last and assert it was deleted
+        resource.delete(lastId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientInitialAccessPath(lastId), ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
+
+        list = resource.list();
+        assertEquals(2, list.size());
+        assertEquals(5, list.get(0).getCount() + list.get(1).getCount());
+    }
+
+    @Test
+    public void testInvalidParametersWhileCreatingInitialAccessTokens() {
+        // Set Count as -1
+        ClientInitialAccessCreatePresentation rep = new ClientInitialAccessCreatePresentation();
+        rep.setCount(-1);
+        rep.setExpiration(100);
+        try {
+            resource.create(rep);
+            Assertions.fail("Invalid value for count");
+        } catch (BadRequestException e) {
+            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+            Assertions.assertEquals("Invalid value for count", error.getError());
+            Assertions.assertEquals("The count cannot be less than 0", error.getErrorDescription());
+        }
+
+        // Set Expiration as -10
+        rep = new ClientInitialAccessCreatePresentation();
+        rep.setCount(100);
+        rep.setExpiration(-10);
+        try {
+            resource.create(rep);
+            Assertions.fail("Invalid value for expiration");
+        } catch (BadRequestException e) {
+            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+            Assertions.assertEquals("Invalid value for expiration", error.getError());
+            Assertions.assertEquals("The expiration time interval cannot be less than 0", error.getErrorDescription());
+        }
+    }
+
+    private void removeExpired(String realmUuid) {
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealm(realmUuid);
+
+            session.sessions().removeExpired(realm);
+            session.authenticationSessions().removeExpired(realm);
+            session.realms().removeExpiredClientInitialAccess();
+        });
+    }
+
+    @Test
+    public void testPeriodicExpiration() {
+        ClientInitialAccessPresentation response1 = resource.create(new ClientInitialAccessCreatePresentation(1, 1));
+        ClientInitialAccessPresentation response2 = resource.create(new ClientInitialAccessCreatePresentation(1000, 1));
+        ClientInitialAccessPresentation response3 = resource.create(new ClientInitialAccessCreatePresentation(1000, 0));
+        ClientInitialAccessPresentation response4 = resource.create(new ClientInitialAccessCreatePresentation(0, 1));
+
+        List<ClientInitialAccessPresentation> list = resource.list();
+        assertEquals(4, list.size());
+
+        timeOffSet.set(10);
+
+        final String realmUuid = managedRealm.getId();
+        removeExpired(realmUuid);
+
+        list = resource.list();
+        assertEquals(2, list.size());
+
+        List<String> remainingIds = list.stream()
+                .map(ClientInitialAccessPresentation::getId)
+                .collect(Collectors.toList());
+
+        Assert.assertNames(remainingIds, response2.getId(), response4.getId());
+
+        timeOffSet.set(2000);
+
+        removeExpired(realmUuid);
+
+        list = resource.list();
+        assertEquals(1, list.size());
+        Assertions.assertEquals(list.get(0).getId(), response4.getId());
+
+        // Cleanup
+        managedRealm.admin().clientInitialAccess().delete(response4.getId());
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTest.java
new file mode 100644
index 000000000000..f91d8238f97d
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTest.java
@@ -0,0 +1,558 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.Matchers;
+import org.jgroups.util.UUID;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.credential.OTPCredentialModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.KeyStoreConfig;
+import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RealmEventsConfigRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.resources.admin.AdminAuth.Resource;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.CredentialBuilder;
+import org.keycloak.testsuite.util.FederatedIdentityBuilder;
+import org.keycloak.testsuite.util.IdentityProviderBuilder;
+import org.keycloak.testsuite.util.RoleBuilder;
+
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class PermissionsTest extends AbstractPermissionsTest {
+
+    @InjectRealm(config = PermissionsTestRealmConfig1.class, ref = "realm1")
+    ManagedRealm managedRealm1;
+
+    @InjectRealm(config = PermissionsTestRealmConfig2.class, ref = "realm2")
+    ManagedRealm managedRealm2;
+
+    @Test
+    public void realmLogoutAll() {
+        Invocation invocation = RealmResource::logoutAll;
+
+        invoke(invocation, clients.get("master-none"), false);
+        invoke(invocation, clients.get("master-view-realm"), false);
+
+        invoke(invocation, clients.get("REALM2"), false);
+
+        invoke(invocation, clients.get("none"), false);
+        invoke(invocation, clients.get("view-users"), false);
+        invoke(invocation, clients.get("manage-realm"), false);
+        invoke(invocation, clients.get("master-manage-realm"), false);
+
+        invoke(invocation, clients.get("manage-users"), true);
+        invoke(invocation, clients.get("master-manage-users"), true);
+    }
+
+    @Test
+    public void events() {
+        invoke(RealmResource::getRealmEventsConfig, Resource.EVENTS, false);
+        invoke(realm -> realm.updateRealmEventsConfig(new RealmEventsConfigRepresentation()), Resource.EVENTS, true);
+        invoke(RealmResource::getEvents, Resource.EVENTS, false);
+        invoke(RealmResource::getAdminEvents, Resource.EVENTS, false);
+        invoke(RealmResource::clearEvents, Resource.EVENTS, true);
+        invoke(RealmResource::clearAdminEvents, Resource.EVENTS, true);
+    }
+
+    @Test
+    public void attackDetection() {
+        UserRepresentation newUser = UserConfigBuilder.create()
+                .username("attacked")
+                .enabled(true)
+                .build();
+        String userUuid = ApiUtil.getCreatedId(managedRealm1.admin().users().create(newUser));
+        managedRealm1.cleanup().add(r -> r.users().delete(userUuid).close());
+
+        UserRepresentation user = managedRealm1.admin().users().get(userUuid).toRepresentation();
+        invoke(realm -> realm.attackDetection().bruteForceUserStatus(userUuid), Resource.USER, false);
+        invoke(realm -> realm.attackDetection().clearBruteForceForUser(userUuid), Resource.USER, true);
+        invoke(realm -> realm.attackDetection().clearAllBruteForce(), Resource.USER, true);
+    }
+
+    @Test
+    public void clients() {
+        invoke(realm -> realm.clients().findAll(), Resource.CLIENT, false, true);
+        List<ClientRepresentation> l = clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).clients().findAll();
+        assertThat(l, Matchers.empty());
+
+        l = clients.get(AdminRoles.VIEW_CLIENTS).realm(REALM_NAME).clients().findAll();
+        assertThat(l, Matchers.not(Matchers.empty()));
+
+        ClientRepresentation client = l.get(0);
+        invoke((realm, response) ->
+                        response.set(clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().create(client)),
+                clients.get(AdminRoles.QUERY_USERS), false);
+        invoke(realm -> clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).toRepresentation(),
+                clients.get(AdminRoles.QUERY_USERS), false);
+        invoke(realm -> clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).update(client),
+                clients.get(AdminRoles.QUERY_USERS), false);
+        invoke(realm -> clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).remove(),
+                clients.get(AdminRoles.QUERY_USERS), false);
+
+        invoke(realm -> realm.convertClientDescription("blahblah"), Resource.CLIENT, true);
+        invoke((realm, response) ->
+                        response.set(realm.clients().create(ClientConfigBuilder.create().clientId("foo").build())),
+                Resource.CLIENT, true);
+
+        ClientRepresentation foo = managedRealm1.admin().clients().findByClientId("foo").get(0);
+
+        invoke(realm -> realm.clients().get(foo.getId()).toRepresentation(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getInstallationProvider("nosuch"), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).update(foo), Resource.CLIENT, true);
+        invoke(realm -> {
+            realm.clients().get(foo.getId()).remove();
+            realm.clients().create(foo);
+            ClientRepresentation temp = realm.clients().findByClientId("foo").get(0);
+            foo.setId(temp.getId());
+        }, Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).generateNewSecret(), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).regenerateRegistrationAccessToken(), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getSecret(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getServiceAccountUser(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).pushRevocation(), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getApplicationSessionCount(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getUserSessions(0, 100), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getOfflineSessionCount(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getOfflineUserSessions(0, 100), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).registerNode(Map.of()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).unregisterNode("nosuch"), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).testNodesAvailable(), Resource.CLIENT, true);
+
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").generate(), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").generateAndGetKeystore(new KeyStoreConfig()),
+                Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeyInfo(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeystore(new KeyStoreConfig()),
+                Resource.CLIENT, false);
+
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJks(null), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJksCertificate(null),
+                Resource.CLIENT, true);
+
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().createMapper(List.of()), Resource.CLIENT, true);
+        invoke((realm, response) ->
+                        response.set(realm.clients().get(foo.getId()).getProtocolMappers().createMapper(new ProtocolMapperRepresentation())),
+                Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().getMapperById("nosuch"), Resource.CLIENT, false, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().getMappers(), Resource.CLIENT, false, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().getMappersPerProtocol("nosuch"),
+                Resource.CLIENT, false, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().update("nosuch",
+                        new ProtocolMapperRepresentation()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getProtocolMappers().delete("nosuch"), Resource.CLIENT, true);
+
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().getAll(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAll(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listEffective(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAvailable(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().realmLevel().add(List.of()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).getScopeMappings().realmLevel().remove(List.of()), Resource.CLIENT, true);
+
+        invoke(realm -> realm.clients().get(UUID.randomUUID().toString()).roles().list(), Resource.CLIENT, false, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().create(new RoleRepresentation()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").toRepresentation(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().deleteRole("nosuch"), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").update(new RoleRepresentation()),
+                Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").addComposites(List.of()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").deleteComposites(List.of()), Resource.CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").getRoleComposites(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").getRealmRoleComposites(), Resource.CLIENT, false);
+        invoke(realm -> realm.clients().get(foo.getId()).roles().get("nosuch").getClientRoleComposites("nosuch"), Resource.CLIENT, false);
+        // users with query-client role should be able to query flows so the client detail page can be rendered successfully when fine-grained permissions are enabled.
+        invoke(realm -> realm.flows().getFlows(), clients.get(AdminRoles.QUERY_CLIENTS), true);
+        // the same for ClientAuthenticatorProviders and PerClientConfigDescription
+        invoke(realm -> realm.flows().getClientAuthenticatorProviders(), clients.get(AdminRoles.QUERY_CLIENTS), true);
+        invoke(realm -> realm.flows().getClientAuthenticatorProviders(), clients.get(AdminRoles.VIEW_CLIENTS), true);
+        invoke(realm -> realm.flows().getClientAuthenticatorProviders(), clients.get(AdminRoles.MANAGE_CLIENTS), true);
+        invoke(realm -> realm.flows().getClientAuthenticatorProviders(), clients.get(AdminRoles.QUERY_USERS), false);
+        invoke(realm -> realm.flows().getPerClientConfigDescription(), clients.get(AdminRoles.QUERY_CLIENTS), true);
+    }
+
+    @Test
+    public void clientScopes() {
+        invoke((RealmResource realm) -> realm.clientScopes().findAll(), Resource.CLIENT, false, true);
+        invoke((RealmResource realm, AtomicReference<Response> response) -> {
+            ClientScopeRepresentation scope = new ClientScopeRepresentation();
+            scope.setName("scope");
+            response.set(realm.clientScopes().create(scope));
+        }, Resource.CLIENT, true);
+
+        ClientScopeRepresentation scope = managedRealm1.admin().clientScopes().findAll().get(0);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).toRepresentation(), Resource.CLIENT, false);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).update(scope), Resource.CLIENT, true);
+        invoke((RealmResource realm) -> {
+            realm.clientScopes().get(scope.getId()).remove();
+            realm.clientScopes().create(scope);
+        }, Resource.CLIENT, true);
+
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getProtocolMappers().getMappers(),
+                Resource.CLIENT, false, true);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getProtocolMappers().getMappersPerProtocol("nosuch"),
+                Resource.CLIENT, false, true);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getProtocolMappers().getMapperById("nosuch"),
+                Resource.CLIENT, false, true);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getProtocolMappers().update("nosuch", new ProtocolMapperRepresentation()),
+                Resource.CLIENT, true);
+        invoke((RealmResource realm, AtomicReference<Response> response) ->
+                        response.set(realm.clientScopes().get(scope.getId()).getProtocolMappers().createMapper(new ProtocolMapperRepresentation())),
+                Resource.CLIENT, true);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getProtocolMappers().createMapper(List.of()),
+                Resource.CLIENT, true);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getProtocolMappers().delete("nosuch"),
+                Resource.CLIENT, true);
+
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().getAll(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listAll(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listAvailable(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listEffective(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().add(List.of()),
+                Resource.CLIENT, true);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().remove(List.of()),
+                Resource.CLIENT, true);
+        ClientRepresentation realmAccessClient = adminClient.realms().realm(REALM_NAME) .clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+        invoke((RealmResource realm) -> realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listAll(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listAvailable(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listEffective(),
+                Resource.CLIENT, false);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).add(List.of()),
+                Resource.CLIENT, true);
+        invoke((RealmResource realm) ->
+                        realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).remove(List.of()),
+                Resource.CLIENT, true);
+
+        // this should throw forbidden as "query-users" role isn't enough
+        invoke(realm -> clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clientScopes().findAll(),
+                clients.get(AdminRoles.QUERY_USERS), false);
+    }
+
+    @Test
+    public void clientInitialAccess() {
+        invoke(realm -> realm.clientInitialAccess().list(), Resource.CLIENT, false);
+        invoke(realm -> realm.clientInitialAccess().create(new ClientInitialAccessCreatePresentation()), Resource.CLIENT, true);
+        invoke(realm -> realm.clientInitialAccess().delete("nosuch"), Resource.CLIENT, true);
+    }
+
+    @Test
+    public void roles() {
+        RoleRepresentation newRole = RoleBuilder.create().name("sample-role").build();
+        managedRealm1.admin().roles().create(newRole);
+        managedRealm1.cleanup().add(r -> r.roles().deleteRole("sample-role"));
+
+        invoke(realm -> realm.roles().list(), Resource.REALM, false, true);
+
+        // this should throw forbidden as "create-client" role isn't enough
+        invoke(realm -> clients.get(AdminRoles.CREATE_CLIENT).realm(REALM_NAME).roles().list(),
+                clients.get(AdminRoles.CREATE_CLIENT), false);
+        invoke(realm -> realm.roles().get("sample-role").toRepresentation(),
+                Resource.REALM, false);
+        invoke(realm -> realm.roles().get("sample-role").update(newRole),
+                Resource.REALM, true);
+        invoke(realm -> realm.roles().create(new RoleRepresentation()),
+                Resource.REALM, true);
+        invoke(realm -> {
+            realm.roles().deleteRole("sample-role");
+            // need to recreate for other tests
+            realm.roles().create(newRole);
+        }, Resource.REALM, true);
+        invoke(realm -> realm.roles().get("sample-role").getRoleComposites(), Resource.REALM, false);
+        invoke(realm -> realm.roles().get("sample-role").addComposites(List.of()), Resource.REALM, true);
+        invoke(realm -> realm.roles().get("sample-role").deleteComposites(List.of()), Resource.REALM, true);
+        invoke(realm -> realm.roles().get("sample-role").getRoleComposites(), Resource.REALM, false);
+        invoke(realm -> realm.roles().get("sample-role").getRealmRoleComposites(), Resource.REALM, false);
+        invoke(realm -> realm.roles().get("sample-role").getClientRoleComposites(KeycloakModelUtils.generateId()), Resource.REALM, false);
+    }
+
+    @Test
+    public void rolesById() {
+        RoleRepresentation newRole = RoleBuilder.create().name("role-by-id").build();
+        managedRealm1.admin().roles().create(newRole);
+        RoleRepresentation role = managedRealm1.admin().roles().get("role-by-id").toRepresentation();
+        managedRealm1.cleanup().add(r -> r.roles().deleteRole("role-by-id"));
+
+        invoke(realm -> realm.rolesById().getRole(role.getId()), Resource.REALM, false, true);
+        invoke(realm -> realm.rolesById().updateRole(role.getId(), role), Resource.REALM, true);
+        invoke(realm -> {
+            realm.rolesById().deleteRole(role.getId());
+            // need to recreate for other tests
+            realm.roles().create(newRole);
+            RoleRepresentation temp = realm.roles().get("role-by-id").toRepresentation();
+            role.setId(temp.getId());
+        }, Resource.REALM, true);
+        invoke(realm -> realm.rolesById().getRoleComposites(role.getId()), Resource.REALM, false, true);
+        invoke(realm -> realm.rolesById().addComposites(role.getId(), List.of()), Resource.REALM, true);
+        invoke(realm -> realm.rolesById().deleteComposites(role.getId(), List.of()), Resource.REALM, true);
+        invoke(realm -> realm.rolesById().getRoleComposites(role.getId()), Resource.REALM, false, true);
+        invoke(realm -> realm.rolesById().getRealmRoleComposites(role.getId()), Resource.REALM, false, true);
+        invoke(realm -> realm.rolesById().getClientRoleComposites(role.getId(), KeycloakModelUtils.generateId()), Resource.REALM, false, true);
+    }
+
+    @Test
+    public void groups() {
+        invoke(realm -> realm.groups().groups(), Resource.USER, false);
+        invoke(realm -> realm.groups().count(), Resource.USER, false);
+        invoke((realm, response) -> {
+            GroupRepresentation group = new GroupRepresentation();
+            group.setName("mygroup");
+            response.set(realm.groups().add(group));
+        }, Resource.USER, true);
+
+        GroupRepresentation group = managedRealm1.admin().getGroupByPath("mygroup");
+        ClientRepresentation realmAccessClient = managedRealm1.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+
+        // this should throw forbidden as "create-client" role isn't enough
+        invoke(realm -> clients.get(AdminRoles.CREATE_CLIENT).realm(REALM_NAME).groups().groups(),
+                clients.get(AdminRoles.CREATE_CLIENT), false);
+
+        invoke(realm -> realm.groups().group(group.getId()).toRepresentation(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).update(group), Resource.USER, true);
+        invoke(realm -> realm.groups().group(group.getId()).members(0, 100), Resource.USER, false);
+        invoke((realm, response) -> {
+            GroupRepresentation subgroup = new GroupRepresentation();
+            subgroup.setName("sub");
+            response.set(realm.groups().group(group.getId()).subGroup(subgroup));
+        }, Resource.USER, true);
+
+        invoke(realm -> realm.groups().group(group.getId()).roles().getAll(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().realmLevel().listAll(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().realmLevel().listEffective(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().realmLevel().listAvailable(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().realmLevel().add(List.of()), Resource.USER, true);
+        invoke(realm -> realm.groups().group(group.getId()).roles().realmLevel().remove(List.of()), Resource.USER, true);
+        invoke(realm -> realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listAll(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listEffective(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listAvailable(), Resource.USER, false);
+        invoke(realm -> realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).add(List.of()), Resource.USER, true);
+        invoke(realm -> realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).remove(List.of()), Resource.USER, true);
+        invoke(realm -> {
+            realm.groups().group(group.getId()).remove();
+            group.setId(null);
+            realm.groups().add(group);
+            GroupRepresentation temp = realm.getGroupByPath("mygroup");
+            group.setId(temp.getId());
+        }, Resource.USER, true);
+    }
+
+    // Permissions for impersonation tested in ImpersonationTest
+    @Test
+    public void users() {
+        invoke((realm, response) ->
+                        response.set(realm.users().create(UserConfigBuilder.create().username("testuser").build())),
+                Resource.USER, true);
+        UserRepresentation user = managedRealm1.admin().users().search("testuser").get(0);
+        invoke(realm -> {
+            realm.users().get(user.getId()).remove();
+            realm.users().create(user);
+            UserRepresentation temp = realm.users().search("testuser").get(0);
+            user.setId(temp.getId());
+        }, Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).toRepresentation(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).getUnmanagedAttributes(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).update(user), Resource.USER, true);
+        invoke(realm -> realm.users().count(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).getUserSessions(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).getOfflineSessions(KeycloakModelUtils.generateId()), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).getFederatedIdentity(), Resource.USER, false);
+        invoke((realm, response) -> response.set(realm.users().get(user.getId()).addFederatedIdentity("nosuch",
+                        FederatedIdentityBuilder.create().identityProvider("nosuch").userId("nosuch").userName("nosuch").build()
+                )
+        ), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).removeFederatedIdentity("nosuch"), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).getConsents(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).revokeConsent("testclient"), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).logout(), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).resetPassword(CredentialBuilder.create().password("password").build()),
+                Resource.USER, true);
+        invoke(realm -> {
+            CredentialRepresentation totpCredential = realm.users().get(user.getId()).credentials().stream()
+                    .filter(c -> OTPCredentialModel.TYPE.equals(c.getType())).findFirst().orElse(null);
+            if (totpCredential != null) {
+                realm.users().get(user.getId()).removeCredential(totpCredential.getId());
+            } else {
+                realm.users().get(user.getId()).removeCredential("123");
+            }
+        }, Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).executeActionsEmail(List.of(UserModel.RequiredAction.UPDATE_PASSWORD.name())),
+                Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).executeActionsEmail(List.of()), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).sendVerifyEmail(), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).groups(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).leaveGroup("nosuch"), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).joinGroup("nosuch"), Resource.USER, true);
+
+        invoke(realm -> realm.users().get(user.getId()).roles().getAll(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().realmLevel().listAll(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().realmLevel().listAvailable(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().realmLevel().listEffective(), Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().realmLevel().add(List.of()), Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).roles().realmLevel().remove(List.of()), Resource.USER, true);
+
+        ClientRepresentation realmAccessClient = managedRealm1.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+        invoke(realm -> realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listAll(),
+                Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listAvailable(),
+                Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listEffective(),
+                Resource.USER, false);
+        invoke(realm -> realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).add(List.of()),
+                Resource.USER, true);
+        invoke(realm -> realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).remove(List.of()),
+                Resource.USER, true);
+        invoke(realm -> realm.users().search("foo", 0, 1), Resource.USER, false);
+        // this should throw forbidden as "query-client" role isn't enough
+        invoke(realm -> clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().list(),
+                clients.get(AdminRoles.QUERY_CLIENTS), false);
+        invoke((realm, response) -> response.set(clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().create(user)),
+                clients.get(AdminRoles.QUERY_CLIENTS), false);
+        invoke(realm -> clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().search("test"),
+                clients.get(AdminRoles.QUERY_CLIENTS), false);
+        invoke(realm -> realm.users().get(user.getId()).toRepresentation(), clients.get(AdminRoles.QUERY_CLIENTS), false);
+        invoke(realm -> realm.users().get(user.getId()).remove(), clients.get(AdminRoles.QUERY_CLIENTS), false);
+        invoke(realm -> realm.users().get(user.getId()).update(user), clients.get(AdminRoles.QUERY_CLIENTS), false);
+        // users with query-user role should be able to query required actions so the user detail page can be rendered successfully when fine-grained permissions are enabled.
+        invoke(realm -> realm.flows().getRequiredActions(), clients.get(AdminRoles.QUERY_USERS), true);
+        invoke(realm -> clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).users().get(user.getId()).getConfiguredUserStorageCredentialTypes(),
+                clients.get(AdminRoles.VIEW_USERS), true);
+    }
+
+    @Test
+    public void identityProviders() {
+        invoke(realm -> realm.identityProviders().findAll(), Resource.IDENTITY_PROVIDER, false);
+        invoke((realm, response) -> response.set(realm.identityProviders().create(
+                                IdentityProviderBuilder.create()
+                                        .providerId("oidc")
+                                        .displayName("nosuch-foo")
+                                        .alias("foo")
+                                        .setAttribute("clientId", "foo")
+                                        .setAttribute("clientSecret", "foo")
+                                        .build()
+                        )
+                ), Resource.IDENTITY_PROVIDER, true);
+        invoke(realm -> realm.identityProviders().get("nosuch").toRepresentation(), Resource.IDENTITY_PROVIDER, false);
+        invoke(realm -> realm.identityProviders().get("nosuch").update(new IdentityProviderRepresentation()), Resource.IDENTITY_PROVIDER, true);
+        invoke((realm, response) -> response.set(realm.identityProviders().get("nosuch").export("saml")), Resource.IDENTITY_PROVIDER, false);
+        invoke(realm -> realm.identityProviders().get("nosuch").remove(), Resource.IDENTITY_PROVIDER, true);
+
+        invoke((realm, response) -> response.set(realm.identityProviders().get("nosuch").addMapper(new IdentityProviderMapperRepresentation())), Resource.IDENTITY_PROVIDER, true);
+        invoke(realm -> realm.identityProviders().get("nosuch").delete("nosuch"), Resource.IDENTITY_PROVIDER, true);
+        invoke(realm -> realm.identityProviders().get("nosuch").getMappers(), Resource.IDENTITY_PROVIDER, false);
+        invoke(realm -> realm.identityProviders().get("nosuch").getMapperById("nosuch"), Resource.IDENTITY_PROVIDER, false);
+        invoke(realm -> realm.identityProviders().get("nosuch").getMapperTypes(), Resource.IDENTITY_PROVIDER, false);
+
+        invoke(realm -> realm.identityProviders().importFrom(Map.of()), Resource.IDENTITY_PROVIDER, true);
+        invoke(realm -> realm.identityProviders().importFrom(null), Resource.IDENTITY_PROVIDER, true);
+    }
+
+    @Test
+    public void components() {
+        invoke(realm -> realm.components().query(), Resource.REALM, false);
+        invoke(realm -> realm.components().query("nosuch"), Resource.REALM, false);
+        invoke(realm -> realm.clientRegistrationPolicy().getProviders(), Resource.REALM, false);
+        invoke((realm, response) -> response.set(realm.components().add(new ComponentRepresentation())), Resource.REALM, true);
+        invoke(realm -> realm.components().component("nosuch").toRepresentation(), Resource.REALM, false);
+        invoke(realm -> realm.components().component("nosuch").update(new ComponentRepresentation()), Resource.REALM, true);
+        invoke(realm -> realm.components().component("nosuch").remove(), Resource.REALM, true);
+    }
+
+    @Test
+    public void partialExport() {
+        invoke(realm -> realm.partialExport(false, false), clients.get("view-realm"), false);
+        invoke(realm -> realm.partialExport(false, false), clients.get("manage-realm"), true);
+        invoke(realm -> realm.partialExport(true, false), clients.get("manage-realm"), false);
+        invoke(realm -> realm.partialExport(false, true), clients.get("manage-realm"), false);
+        invoke(realm -> realm.partialExport(true, true), clients.get("multi"), true);
+        invoke(realm -> realm.partialExport(false, false), clients.get("none"), false);
+    }
+
+    @Test
+    public void localizations() {
+        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmSpecificLocales());
+
+        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationText("en", "test"));
+
+        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationTexts("en"));
+        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationTexts("en", false));
+
+        invoke(realm -> realm.localization().createOrUpdateRealmLocalizationTexts("en", Map.of()), clients.get("view-realm"), false);
+        invoke(realm -> realm.localization().createOrUpdateRealmLocalizationTexts("en", Map.of()), clients.get("manage-realm"), true);
+        invoke(realm -> realm.localization().createOrUpdateRealmLocalizationTexts("en", Map.of()), clients.get("master-admin"), true);
+        invoke(realm -> realm.localization().createOrUpdateRealmLocalizationTexts("en", Map.of()), clients.get("none"), false);
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("REALM2"), false);
+
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("view-realm"), false);
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("manage-realm"), true);
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("master-admin"), true);
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("none"), false);
+        invoke(realm -> realm.localization().deleteRealmLocalizationText("en", "test"), clients.get("REALM2"), false);
+
+        invoke(realm -> realm.localization().deleteRealmLocalizationTexts("en"), clients.get("view-realm"), false);
+        invoke(realm -> realm.localization().deleteRealmLocalizationTexts("en"), clients.get("manage-realm"), true);
+        invoke(realm -> realm.localization().deleteRealmLocalizationTexts("en"), clients.get("master-admin"), true);
+        invoke(realm -> realm.localization().deleteRealmLocalizationTexts("en"), clients.get("none"), false);
+        invoke(realm -> realm.localization().deleteRealmLocalizationTexts("en"), clients.get("REALM2"), false);
+    }
+
+    private void verifyAnyAdminRoleReqired(Invocation invocation) {
+        invoke(invocation, clients.get("view-realm"), true);
+        invoke(invocation, clients.get("manage-realm"), true);
+        invoke(invocation, clients.get("multi"), true);
+        invoke(invocation, clients.get("master-admin"), true);
+        invoke(invocation, clients.get("none"), false);
+        invoke(invocation, clients.get("REALM2"), false);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTestV1.java b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTestV1.java
new file mode 100644
index 000000000000..7c4934d56b8a
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsTestV1.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.AuthorizationResource;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.representations.idm.authorization.ScopeRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.admin.authz.fgap.KeycloakAdminPermissionsV1ServerConfig;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.Collections;
+
+import static org.keycloak.services.resources.admin.AdminAuth.Resource.AUTHORIZATION;
+import static org.keycloak.services.resources.admin.AdminAuth.Resource.CLIENT;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest(config = KeycloakAdminPermissionsV1ServerConfig.class)
+public class PermissionsTestV1 extends AbstractPermissionsTest {
+
+    @InjectRealm(config = PermissionsTestRealmConfig1.class, ref = "realm1")
+    ManagedRealm managedRealm1;
+
+    @InjectRealm(config = PermissionsTestRealmConfig2.class, ref = "realm2")
+    ManagedRealm managedRealm2;
+
+    @Test
+    public void clientAuthorization() {
+        String fooAuthzClientUuid = ApiUtil.getCreatedId(managedRealm1.admin().clients().create(ClientConfigBuilder.create().clientId("foo-authz").build()));
+        ClientRepresentation foo = managedRealm1.admin().clients().get(fooAuthzClientUuid).toRepresentation();
+
+        invoke((realm, response) -> {
+            foo.setServiceAccountsEnabled(true);
+            foo.setAuthorizationServicesEnabled(true);
+            realm.clients().get(foo.getId()).update(foo);
+        }, CLIENT, true);
+        invoke(realm -> realm.clients().get(foo.getId()).authorization().getSettings(), AUTHORIZATION, false);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            ResourceServerRepresentation settings = authorization.getSettings();
+            authorization.update(settings);
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.resources().resources();
+        }, AUTHORIZATION, false);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.scopes().scopes();
+        }, AUTHORIZATION, false);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.policies().policies();
+        }, AUTHORIZATION, false);
+        invoke((realm, response) -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            response.set(authorization.resources().create(new ResourceRepresentation("Test", Collections.emptySet())));
+        }, AUTHORIZATION, true);
+        invoke((realm, response) -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            response.set(authorization.scopes().create(new ScopeRepresentation("Test")));
+        }, AUTHORIZATION, true);
+        invoke((realm, response) -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            ResourcePermissionRepresentation representation = new ResourcePermissionRepresentation();
+            representation.setName("Test PermissionsTest");
+            representation.addResource("Default Resource");
+            response.set(authorization.permissions().resource().create(representation));
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.resources().resource("nosuch").update(new ResourceRepresentation());
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.scopes().scope("nosuch").update(new ScopeRepresentation());
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.policies().policy("nosuch").update(new PolicyRepresentation());
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.resources().resource("nosuch").remove();
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.scopes().scope("nosuch").remove();
+        }, AUTHORIZATION, true);
+        invoke(realm -> {
+            AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
+            authorization.policies().policy("nosuch").remove();
+        }, AUTHORIZATION, true);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsWithRemovalTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsWithRemovalTest.java
new file mode 100644
index 000000000000..c3eeb7164c47
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/PermissionsWithRemovalTest.java
@@ -0,0 +1,236 @@
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.PartialImportRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
+import org.keycloak.representations.idm.TestLdapConnectionRepresentation;
+import org.keycloak.services.resources.admin.AdminAuth;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.tests.utils.Assert;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.fail;
+
+@KeycloakIntegrationTest
+public class PermissionsWithRemovalTest extends AbstractPermissionsTest {
+
+    @BeforeEach
+    @Override
+    public void beforeEach() {
+        recreatePermissionRealm();
+
+        RealmConfig realm2Config = new PermissionsTestRealmConfig2();
+        RealmRepresentation realm2 = realm2Config.configure(RealmConfigBuilder.create()).build();
+        adminClient.realms().create(realm2);
+
+        super.beforeEach();
+    }
+
+    public void recreatePermissionRealm() {
+        RealmConfig realm1Config = new PermissionsTestRealmConfig1();
+        RealmRepresentation realm1 = realm1Config.configure(RealmConfigBuilder.create()).build();
+        adminClient.realms().create(realm1);
+    }
+
+    @AfterEach
+    public void afterEach() {
+        adminClient.realms().realm(REALM_2_NAME).remove();
+        adminClient.realms().realm(REALM_NAME).remove();
+    }
+
+    @Test
+    public void realms() throws Exception {
+        // Check returned realms
+        invoke((RealmResource realm) -> clients.get("master-none").realms().findAll(), clients.get("none"), false);
+        invoke((RealmResource realm) -> clients.get("none").realms().findAll(), clients.get("none"), false);
+        Assert.assertNames(clients.get("master-admin").realms().findAll(), "master", REALM_NAME, "realm2");
+        Assert.assertNames(clients.get(AdminRoles.REALM_ADMIN).realms().findAll(), REALM_NAME);
+        Assert.assertNames(clients.get("REALM2").realms().findAll(), "realm2");
+
+        // Check realm only contains name if missing view realm permission
+        List<RealmRepresentation> realms = clients.get(AdminRoles.VIEW_USERS).realms().findAll();
+        Assert.assertNames(realms, REALM_NAME);
+        assertGettersEmpty(realms.get(0));
+
+        realms = clients.get(AdminRoles.VIEW_REALM).realms().findAll();
+        Assert.assertNames(realms, REALM_NAME);
+        assertNotNull(realms.get(0).getAccessTokenLifespan());
+
+        // Check the same when access with users from 'master' realm
+        realms = clients.get("master-" + AdminRoles.VIEW_USERS).realms().findAll();
+        Assert.assertNames(realms, REALM_NAME);
+        assertGettersEmpty(realms.get(0));
+
+        realms = clients.get("master-" + AdminRoles.VIEW_REALM).realms().findAll();
+        Assert.assertNames(realms, REALM_NAME);
+        assertNotNull(realms.get(0).getAccessTokenLifespan());
+
+        // Create realm
+        invoke(realm -> clients.get("master-admin").realms().create(RealmConfigBuilder.create().name("master").build()),
+                adminClient, true);
+        invoke(realm -> clients.get("master-" + AdminRoles.MANAGE_USERS).realms().create(RealmConfigBuilder.create().name("master").build()),
+                adminClient, false);
+        invoke(realm -> clients.get(AdminRoles.REALM_ADMIN).realms().create(RealmConfigBuilder.create().name("master").build()),
+                adminClient, false);
+
+        // Get realm
+        invoke(RealmResource::toRepresentation, AdminAuth.Resource.REALM, false, true);
+
+        RealmRepresentation realm = clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation();
+        assertGettersEmpty(realm);
+        assertNull(realm.isRegistrationEmailAsUsername());
+        assertNull(realm.getAttributes());
+
+        realm = clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).toRepresentation();
+        assertNotNull(realm.isRegistrationEmailAsUsername());
+
+        realm = clients.get(AdminRoles.MANAGE_USERS).realm(REALM_NAME).toRepresentation();
+        assertNotNull(realm.isRegistrationEmailAsUsername());
+
+        // query users only if granted through fine-grained admin
+        realm = clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).toRepresentation();
+        assertNull(realm.isRegistrationEmailAsUsername());
+        assertNull(realm.getAttributes());
+
+        // this should pass given that users granted with "query" roles are allowed to access the realm with limited access
+        for (String role : AdminRoles.ALL_QUERY_ROLES) {
+            invoke(realmm -> clients.get(role).realms().realm(REALM_NAME).toRepresentation(), clients.get(role), true);
+        }
+
+        invoke(realm1 -> realm1.update(new RealmRepresentation()), AdminAuth.Resource.REALM, true);
+        invoke(RealmResource::pushRevocation, AdminAuth.Resource.REALM, true);
+        invoke(realm4 -> realm4.deleteSession("nosuch", false), AdminAuth.Resource.USER, true);
+        invoke(RealmResource::getClientSessionStats, AdminAuth.Resource.REALM, false);
+
+        invoke(RealmResource::getDefaultGroups, AdminAuth.Resource.REALM, false);
+        invoke(realm7 -> realm7.addDefaultGroup("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke(realm9 -> realm9.removeDefaultGroup("nosuch"), AdminAuth.Resource.REALM, true);
+        GroupRepresentation newGroup = new GroupRepresentation();
+        newGroup.setName("sample");
+        adminClient.realm(REALM_NAME).groups().add(newGroup);
+        GroupRepresentation group = adminClient.realms().realm(REALM_NAME).getGroupByPath("sample");
+
+        invoke(realm2 -> realm2.getGroupByPath("sample"), AdminAuth.Resource.USER, false);
+
+        adminClient.realms().realm(REALM_NAME).groups().group(group.getId()).remove();
+
+        invoke((realm5, response) -> {
+            TestLdapConnectionRepresentation config = new TestLdapConnectionRepresentation(
+                    "nosuch", "nosuch", "nosuch", "nosuch", "nosuch", "nosuch");
+            response.set(realm5.testLDAPConnection(config.getAction(), config.getConnectionUrl(), config.getBindDn(),
+                    config.getBindCredential(), config.getUseTruststoreSpi(), config.getConnectionTimeout()));
+            response.set(realm5.testLDAPConnection(config));
+        }, AdminAuth.Resource.REALM, true);
+
+        invoke((realm3, response) ->
+                        response.set(realm3.partialImport(new PartialImportRepresentation())),
+                AdminAuth.Resource.REALM, true);
+
+        invoke(RealmResource::clearRealmCache, AdminAuth.Resource.REALM, true);
+        invoke(RealmResource::clearUserCache, AdminAuth.Resource.REALM, true);
+
+        // Delete realm
+        invoke(realm6 -> clients.get("master-admin").realms().realm("nosuch").remove(), adminClient, true);
+        invoke(realm8 -> clients.get("REALM2").realms().realm(REALM_NAME).remove(), adminClient, false);
+        invoke(realm11 -> clients.get(AdminRoles.MANAGE_USERS).realms().realm(REALM_NAME).remove(), adminClient, false);
+        invoke(realm10 -> clients.get(AdminRoles.REALM_ADMIN).realms().realm(REALM_NAME).remove(), adminClient, true);
+
+        // Revert realm removal
+        recreatePermissionRealm();
+    }
+
+    private void assertGettersEmpty(RealmRepresentation rep) {
+        assertGettersEmpty(rep, "getRealm", "getAttributesOrEmpty", "getDisplayNameHtml",
+                "getDisplayName", "getDefaultLocale", "getSupportedLocales");
+    }
+
+    private void assertGettersEmpty(Object rep, String... ignore) {
+        List<String> ignoreList = Arrays.asList(ignore);
+
+        for (Method m : rep.getClass().getDeclaredMethods()) {
+            if (m.getParameterCount() == 0 && m.getName().startsWith("get") && !ignoreList.contains(m.getName())) {
+                try {
+                    Object o = m.invoke(rep);
+                    assertNull(o, "Expected " + m.getName() + " to be null");
+                } catch (Exception e) {
+                    fail(e.getMessage());
+                }
+            }
+        }
+    }
+
+    @Test
+    public void flows() {
+        invoke(realm -> realm.flows().getFormProviders(), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().getAuthenticatorProviders(), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().getClientAuthenticatorProviders(), AdminAuth.Resource.REALM, false, true);
+        invoke(realm -> realm.flows().getFormActionProviders(), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().getFlows(), AdminAuth.Resource.REALM, false, true);
+        invoke((realm, response) -> response.set(realm.flows().createFlow(new AuthenticationFlowRepresentation())),
+                AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().getFlow("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().deleteFlow("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke((realm, response) -> response.set(realm.flows().copy("nosuch", Map.of())), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().addExecutionFlow("nosuch", Map.of()), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().addExecution("nosuch", Map.of()), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().getExecutions("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke((RealmResource realm) -> realm.flows().getExecution("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().updateExecutions("nosuch", new AuthenticationExecutionInfoRepresentation()),
+                AdminAuth.Resource.REALM, true);
+        invoke((realm, response) -> {
+            AuthenticationExecutionRepresentation rep = new AuthenticationExecutionRepresentation();
+            rep.setAuthenticator("auth-cookie");
+            rep.setRequirement("CONDITIONAL");
+            response.set(realm.flows().addExecution(rep));
+        }, AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().raisePriority("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().lowerPriority("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().removeExecution("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke((realm, response) ->
+                        response.set(realm.flows().newExecutionConfig("nosuch", new AuthenticatorConfigRepresentation())),
+                AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().getAuthenticatorConfig("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().getUnregisteredRequiredActions(), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().registerRequiredAction(new RequiredActionProviderSimpleRepresentation()),
+                AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().getRequiredActions(), AdminAuth.Resource.REALM, false, true);
+        invoke(realm -> realm.flows().getRequiredAction("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().removeRequiredAction("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().updateRequiredAction("nosuch", new RequiredActionProviderRepresentation()),
+                AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().getAuthenticatorConfigDescription("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().getPerClientConfigDescription(), AdminAuth.Resource.REALM, false, true);
+        invoke(realm -> realm.flows().getAuthenticatorConfig("nosuch"), AdminAuth.Resource.REALM, false);
+        invoke(realm -> realm.flows().removeAuthenticatorConfig("nosuch"), AdminAuth.Resource.REALM, true);
+        invoke(realm -> realm.flows().updateAuthenticatorConfig("nosuch", new AuthenticatorConfigRepresentation()), AdminAuth.Resource.REALM, true);
+        invoke(realm -> {
+            clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getPerClientConfigDescription();
+            clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getClientAuthenticatorProviders();
+            clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getRequiredActions();
+        }, adminClient, true);
+
+        // Re-create realm
+        adminClient.realm(REALM_NAME).remove();
+
+        recreatePermissionRealm();
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/RoleByIdResourceTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/RoleByIdResourceTest.java
new file mode 100644
index 000000000000..7816ee22e1ff
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/RoleByIdResourceTest.java
@@ -0,0 +1,364 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RoleByIdResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.testsuite.util.RoleBuilder;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Random;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class RoleByIdResourceTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm managedRealm;
+
+    @InjectClient(lifecycle = LifeCycle.METHOD)
+    ManagedClient managedClient;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    private RoleByIdResource resource;
+
+    private final String roleNameA = "role-a";
+    private final String roleNameB = "role-b";
+    private final String roleNameC = "role-c";
+    private final String roleNameD = "role-d";
+    private final String roleNameCompositeWihD = "composite-role-with-d";
+    private Map<String, String> roleIds = new HashMap<>();
+
+    @BeforeEach
+    public void before() {
+        managedRealm.admin().roles().create(RoleBuilder.create().name(roleNameA).description("Role A").build());
+        managedRealm.admin().roles().create(RoleBuilder.create().name(roleNameB).description("Role B").build());
+        // add a role that is a composite role
+        RoleRepresentation roleD = RoleBuilder.create().name(roleNameD).description("Role D").build();
+        managedRealm.admin().roles().create(roleD);
+        managedRealm.admin().roles().create(RoleBuilder.create()
+                .name(roleNameCompositeWihD)
+                .description("Composite Role with Role D")
+                .composite()
+                .realmComposite(roleD)
+                .build()
+        );
+
+        managedRealm.admin().clients().get(managedClient.getId()).roles().create(RoleBuilder.create().name(roleNameC).description("Role C").build());
+
+        managedRealm.admin().roles().list()
+                .forEach(r -> roleIds.put(r.getName(), r.getId()));
+
+        managedRealm.admin().clients().get(managedClient.getId()).roles().list()
+                .forEach(r -> roleIds.put(r.getName(), r.getId()));
+
+        resource = managedRealm.admin().rolesById();
+        adminEvents.skipAll(); // Tested in RealmRolesTest already
+    }
+
+    @Test
+    public void getRole() {
+        RoleRepresentation role = resource.getRole(roleIds.get(roleNameA));
+        assertNotNull(role);
+        assertEquals(roleNameA, role.getName());
+        assertEquals("Role A", role.getDescription());
+        assertFalse(role.isComposite());
+    }
+
+    @Test
+    public void updateRole() {
+        RoleRepresentation role = resource.getRole(roleIds.get(roleNameA));
+
+        role.setName("role-a-new");
+        role.setDescription("Role A New");
+
+        resource.updateRole(roleIds.get(roleNameA), role);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.roleByIdResourcePath(roleIds.get(roleNameA)), role, ResourceType.REALM_ROLE);
+
+        role = resource.getRole(roleIds.get(roleNameA));
+
+        assertNotNull(role);
+        assertEquals("role-a-new", role.getName());
+        assertEquals("Role A New", role.getDescription());
+        assertFalse(role.isComposite());
+    }
+
+    @Test
+    public void deleteRole() {
+        assertNotNull(resource.getRole(roleIds.get(roleNameA)));
+        resource.deleteRole(roleIds.get(roleNameA));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.roleByIdResourcePath(roleIds.get(roleNameA)), ResourceType.REALM_ROLE);
+
+        try {
+            resource.getRole(roleIds.get(roleNameA));
+            fail("Expected 404");
+        } catch (NotFoundException e) {
+            // Ignore
+        }
+    }
+
+    @Test
+    public void composites() {
+        assertFalse(resource.getRole(roleIds.get(roleNameA)).isComposite());
+        assertEquals(0, resource.getRoleComposites(roleIds.get(roleNameA)).size());
+
+        List<RoleRepresentation> l = new LinkedList<>();
+        l.add(RoleBuilder.create().id(roleIds.get(roleNameB)).build());
+        l.add(RoleBuilder.create().id(roleIds.get(roleNameC)).build());
+        resource.addComposites(roleIds.get(roleNameA), l);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleByIdResourceCompositesPath(roleIds.get(roleNameA)), l, ResourceType.REALM_ROLE);
+
+        Set<RoleRepresentation> composites = resource.getRoleComposites(roleIds.get(roleNameA));
+
+        assertTrue(resource.getRole(roleIds.get(roleNameA)).isComposite());
+        Assert.assertNames(composites, roleNameB, roleNameC);
+
+        Set<RoleRepresentation> realmComposites = resource.getRealmRoleComposites(roleIds.get(roleNameA));
+        Assert.assertNames(realmComposites, roleNameB);
+
+        Set<RoleRepresentation> clientComposites = resource.getClientRoleComposites(roleIds.get(roleNameA), managedClient.getId());
+        Assert.assertNames(clientComposites, roleNameC);
+
+        composites = resource.searchRoleComposites(roleIds.get(roleNameA), null, null, null);
+        Assert.assertNames(composites, roleNameB, roleNameC);
+
+        composites = resource.searchRoleComposites(roleIds.get(roleNameA), "b", null, null);
+        Assert.assertNames(composites, roleNameB);
+
+        composites = resource.searchRoleComposites(roleIds.get(roleNameA), null, 0, 0);
+        assertThat(composites, is(empty()));
+
+        composites = resource.searchRoleComposites(roleIds.get(roleNameA), null, 0, 1);
+        Assert.assertNames(composites, roleNameB);
+
+        composites = resource.searchRoleComposites(roleIds.get(roleNameA), null, 1, 1);
+        Assert.assertNames(composites, roleNameC);
+
+        resource.deleteComposites(roleIds.get(roleNameA), l);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.roleByIdResourceCompositesPath(roleIds.get(roleNameA)), l, ResourceType.REALM_ROLE);
+
+        assertFalse(resource.getRole(roleIds.get(roleNameA)).isComposite());
+        assertEquals(0, resource.getRoleComposites(roleIds.get(roleNameA)).size());
+
+    }
+
+    /**
+     * see KEYCLOAK-12754
+     */
+    @Test
+    public void createNewMixedRealmCompositeRole() {
+        RoleRepresentation newRoleComp = RoleBuilder.create()
+                .name("role-mixed-comp")
+                .composite()
+                .realmComposite(roleNameA)
+                .realmComposite(roleNameCompositeWihD)
+                .clientComposite(managedClient.getClientId(), roleNameC).build();
+        managedRealm.admin().roles().create(newRoleComp);
+
+        RoleRepresentation roleMixedComp = managedRealm.admin().roles().get(newRoleComp.getName()).toRepresentation();
+        assertTrue(roleMixedComp.isComposite());
+
+        Predicate<RoleRepresentation> isClientRole = RoleRepresentation::getClientRole;
+
+        Set<RoleRepresentation> roleComposites = resource.getRoleComposites(roleMixedComp.getId());
+        Set<RoleRepresentation> containedRealmRoles = roleComposites.stream().filter(isClientRole.negate()).collect(Collectors.toSet());
+        assertFalse(containedRealmRoles.isEmpty());
+        assertTrue(containedRealmRoles.stream().anyMatch(r -> r.getName().equals(roleNameA)));
+        assertTrue(containedRealmRoles.stream().anyMatch(r -> r.getName().equals(roleNameCompositeWihD)));
+
+        Set<RoleRepresentation> containedClientRoles = roleComposites.stream().filter(isClientRole).collect(Collectors.toSet());
+        assertFalse(containedClientRoles.isEmpty());
+        assertTrue(containedClientRoles.stream().anyMatch(r -> r.getContainerId().equals(managedClient.getId()) && r.getName().equals(roleNameC)));
+
+        // check that there are no unexpected roles contained
+        int expectedCompositeCount = newRoleComp.getComposites().getRealm().size() + newRoleComp.getComposites().getClient().size();
+        assertEquals(expectedCompositeCount, roleComposites.size());
+    }
+
+    /**
+     * see KEYCLOAK-12754
+     */
+    @Test
+    public void createNewMixedRealmCompositeRoleWithUnknownRealmRoleShouldThrow() {
+        String unknownRealmRole = "realm-role-unknown";
+        RoleRepresentation newRoleComp = RoleBuilder.create()
+                .name("role-broken-comp1")
+                .composite()
+                .realmComposite(unknownRealmRole)
+                .clientComposite(managedRealm.getId(), roleNameC)
+                .build();
+
+        Assertions.assertThrowsExactly(NotFoundException.class, () -> managedRealm.admin().roles().create(newRoleComp));
+    }
+
+    /**
+     * see KEYCLOAK-12754
+     */
+    @Test
+    public void createNewMixedRealmCompositeRoleWithUnknownClientRoleShouldThrow() {
+        String unknownClientRole = "client-role-unknown";
+        RoleRepresentation newRoleComp = RoleBuilder.create()
+                .name("role-broken-comp2")
+                .composite()
+                .realmComposite(roleNameA)
+                .clientComposite(managedClient.getClientId(), unknownClientRole)
+                .build();
+
+        Assertions.assertThrowsExactly(NotFoundException.class, () -> managedRealm.admin().roles().create(newRoleComp));
+    }
+
+    @Test
+    public void attributes() {
+        for (String id : roleIds.values()) {
+            RoleRepresentation role = resource.getRole(id);
+            assertNotNull(role.getAttributes());
+            assertTrue(role.getAttributes().isEmpty());
+
+            // update the role with attributes
+            Map<String, List<String>> attributes = new HashMap<>();
+            List<String> attributeValues = new ArrayList<>();
+            attributeValues.add("value1");
+            attributes.put("key1", attributeValues);
+            attributeValues = new ArrayList<>();
+            attributeValues.add("value2.1");
+            attributeValues.add("value2.2");
+            attributes.put("key2", attributeValues);
+            role.setAttributes(attributes);
+
+            resource.updateRole(id, role);
+            role = resource.getRole(id);
+            assertNotNull(role);
+            Map<String, List<String>> roleAttributes = role.getAttributes();
+            assertNotNull(roleAttributes);
+
+            Assert.assertRoleAttributes(attributes, roleAttributes);
+
+
+            // delete an attribute
+            attributes.remove("key2");
+            role.setAttributes(attributes);
+            resource.updateRole(id, role);
+            role = resource.getRole(id);
+            assertNotNull(role);
+            roleAttributes = role.getAttributes();
+            assertNotNull(roleAttributes);
+
+            Assert.assertRoleAttributes(attributes, roleAttributes);
+        }
+    }
+
+    @Test
+    public void deleteDefaultRole() {
+        RoleRepresentation role = managedRealm.admin().roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName()).toRepresentation();
+        Assertions.assertThrowsExactly(BadRequestException.class, () -> resource.deleteRole(role.getId()));
+    }
+
+    /**
+     * see #37320
+     */
+    @Test
+    public void renameRoleToNamePreviouslyCached() {
+        String roleName = "realm-role-new-" + new Random().nextInt();
+        RoleRepresentation newRoleRepresentation = RoleBuilder.create()
+                .name(roleName)
+                .build();
+        managedRealm.admin().roles().create(newRoleRepresentation);
+        RoleRepresentation roleRepresentation = managedRealm.admin().roles().get(roleName).toRepresentation();
+
+        String newRoleName = "realm-role-renamed-" + new Random().nextInt();
+        cacheMissingRoleName(newRoleName);
+
+        RoleRepresentation updatedRoleRepresentation = RoleBuilder.create()
+                .id(roleRepresentation.getId())
+                .name(newRoleName)
+                .build();
+        resource.updateRole(roleRepresentation.getId(), updatedRoleRepresentation);
+
+        try {
+            managedRealm.admin().roles().get(newRoleName).toRepresentation();
+        } catch (NotFoundException e) {
+            fail("Role is incorrectly cached");
+        }
+    }
+
+    /**
+     * see #37320
+     */
+    @Test
+    public void createRolePreviouslyCached() {
+        String roleName = "realm-role-new-" + new Random().nextInt();
+        RoleRepresentation roleRepresentation = RoleBuilder.create()
+                .name(roleName)
+                .build();
+
+        cacheMissingRoleName(roleName);
+
+        managedRealm.admin().roles().create(roleRepresentation);
+
+        try {
+            managedRealm.admin().roles().get(roleName).toRepresentation();
+        } catch (NotFoundException e) {
+            fail("Role is incorrectly cached");
+        }
+    }
+
+    private void cacheMissingRoleName(String missingRoleName) {
+        assertThrows(NotFoundException.class, () -> managedRealm.admin().roles().get(missingRoleName).toRepresentation());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionTest.java
new file mode 100644
index 000000000000..47b3c9ec97ee
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionTest.java
@@ -0,0 +1,336 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Order;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.RealmRepresentation;
+
+import jakarta.mail.internet.MimeMessage;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.mail.MailServer;
+import org.keycloak.testframework.mail.annotations.InjectMailServer;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.keycloak.representations.idm.ComponentRepresentation.SECRET_VALUE;
+
+/**
+ * @author <a href="mailto:bruno@abstractj.org">Bruno Oliveira</a>
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+@KeycloakIntegrationTest
+public class SMTPConnectionTest {
+
+    @InjectRealm(config = SMTPRealmWithClientAndUser.class)
+    private ManagedRealm managedRealm;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    private Keycloak adminClient;
+
+    @InjectOAuthClient
+    OAuthClient oAuthClient;
+
+    @InjectMailServer
+    private MailServer mailServer;
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    @Test
+    @Order(1)
+    public void testWithNullSettings() throws Exception {
+        Response response = adminClient.realms().realm(managedRealm.getName()).testSMTPConnection(settings(null, null, null, null, null, null, null, null));
+        assertStatus(response, 500);
+    }
+
+    @Test
+    @Order(2)
+    public void testWithProperSettings() throws Exception {
+        Response response = adminClient.realms().realm(managedRealm.getName()).testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", null, null, null, null, null));
+        assertStatus(response, 204);
+        assertMailReceived();
+    }
+
+    @Test
+    @Order(3)
+    public void testWithAuthEnabledCredentialsEmpty() throws Exception {
+        Response response = adminClient.realms().realm(managedRealm.getName()).testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null, null, null));
+        assertStatus(response, 500);
+    }
+
+    @Test
+    @Order(4)
+    public void testWithAuthEnabledValidCredentials() throws Exception {
+        String password = "admin";
+
+        mailServer.credentials("admin@localhost", password);
+        Response response = adminClient.realms().realm(managedRealm.getName()).testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null, "admin@localhost", password));
+        assertStatus(response, 204);
+    }
+
+    @Test
+    @Order(5)
+    public void testAuthEnabledAndSavedCredentials() throws Exception {
+        String password = "admin";
+        RealmResource realm = adminClient.realms().realm(managedRealm.getName());
+
+        RealmRepresentation realmRep = realm.toRepresentation();
+        realmRep.setSmtpServer(smtpMap("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", password, null, null));
+        managedRealm.updateWithCleanup(r -> r.update(realmRep));
+
+        mailServer.credentials("admin@localhost", password);
+        Response response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", SECRET_VALUE));
+        assertStatus(response, 204);
+
+        // no reuse password if the server is different (localhost) to the saved one (127.0.0.1)
+        mailServer.credentials("admin@localhost", password);
+        response = realm.testSMTPConnection(settings("localhost", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", SECRET_VALUE));
+        assertStatus(response, 500);
+    }
+
+    @Test
+    @Order(6)
+    public void testWithTokenAuthEnabledAndTokenCacheAndSavedCredentials() throws Exception {
+        final var realm = adminClient.realms().realm(managedRealm.getName());
+
+        final var realmRep = realm.toRepresentation();
+        realmRep.setSmtpServer(smtpMapForTokenAuth("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-I", "secret", "basic", null, null));
+        managedRealm.updateWithCleanup(r -> RealmConfigBuilder.update(realmRep));
+
+        //verify token sent to smtp
+        mailServer.credentials("admin@localhost", token -> {
+            var accessToken = oAuthClient.verifyToken(token, AccessToken.class);
+            return accessToken.isActive();
+        });
+
+        final var firstResponse = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-I", SECRET_VALUE, "basic"));
+
+        assertStatus(firstResponse, 204);
+        assertMailReceived();
+        assertClientLoginEventsCountAndClear(realm, "test-smtp-client-I", 1);
+        assertEventsEmpty(realm);
+
+        final var secondResponse = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-I", SECRET_VALUE, "basic"));
+
+        assertStatus(secondResponse, 204);
+        assertMailReceived();
+        assertEventsEmpty(realm);
+
+        // no reuse password if the server is different (localhost) to the saved one (127.0.0.1)
+        final var thirdResponse = realm.testSMTPConnection(settings("localhost", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-I", SECRET_VALUE, "basic"));
+        assertStatus(thirdResponse, 500);
+    }
+
+    @Test
+    @Order(7)
+    public void testWithTokenAuthEnabledRetryGivesUp() throws Exception {
+        RealmResource realm = adminClient.realms().realm(managedRealm.getName());
+        RealmRepresentation realmRep = realm.toRepresentation();
+
+        //decline token sent to smtp
+        mailServer.credentials("admin@localhost", token -> false);
+
+        final var response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-II", "secret", "basic"));
+
+        assertStatus(response, 500);
+        assertMailNotReceived();
+        assertClientLoginEventsCountAndClear(realm, "test-smtp-client-II", 2);
+        assertEventsEmpty(realm);
+
+    }
+
+    @Test
+    @Order(8)
+    public void testWithTokenAuthEnabledAndRetryWithValidTokenInSecondTry() throws Exception {
+        final var realm = adminClient.realms().realm(managedRealm.getName());
+
+        final List<AccessToken> tempAccessToken = new ArrayList<>();
+
+        //decline token sent to smtp
+        mailServer.credentials("admin@localhost", token -> {
+            var accessToken = oAuthClient
+                    .verifyToken(token, AccessToken.class);
+            if (tempAccessToken.isEmpty()) {
+                tempAccessToken.add(accessToken);
+                // even a valid token is declined for the test
+                return false;
+            } else {
+                // make sure retry created a new token
+                Assertions.assertNotEquals(tempAccessToken.stream().findFirst().orElseThrow().getId(),accessToken.getId());
+                tempAccessToken.clear();
+                return accessToken.isActive();
+            }
+
+        });
+
+        final var response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
+                "admin@localhost", keycloakUrls.getToken(managedRealm.getName()), "test-smtp-client-III", "secret", "basic"));
+
+        assertStatus(response, 204);
+        assertMailReceived();
+        assertClientLoginEventsCountAndClear(realm, "test-smtp-client-III", 2);
+        assertEventsEmpty(realm);
+
+    }
+
+    private Map<String, String> settings(String host, String port, String from, String auth, String ssl, String starttls,
+                                         String username, String password) throws Exception {
+        return smtpMap(host, port, from, auth, ssl, starttls, username, password, "", "");
+    }
+
+    private Map<String, String> settings(String host, String port, String from, String auth, String ssl, String starttls,
+                                         String username, String authTokenUrl, String authTokenClientId, String authTokenClientSecret, String authTokenScope) throws Exception {
+        return smtpMapForTokenAuth(host, port, from, auth, ssl, starttls, username, authTokenUrl, authTokenClientId, authTokenClientSecret, authTokenScope,"", "");
+    }
+
+    private Map<String, String> smtpMapForTokenAuth(String host, String port, String from, String auth, String ssl, String starttls,
+                                                    String username, String authTokenUrl, String authTokenClientId, String authTokenClientSecret, String authTokenScope, String replyTo, String envelopeFrom) {
+        Map<String, String> config = new HashMap<>();
+        config.put("host", host);
+        config.put("port", port);
+        config.put("from", from);
+        config.put("ssl", ssl);
+        config.put("starttls", starttls);
+        config.put("user", username);
+        config.put("auth", auth);
+        config.put("authType", "token");
+        config.put("authTokenUrl", authTokenUrl);
+        config.put("authTokenClientId", authTokenClientId);
+        config.put("authTokenClientSecret", authTokenClientSecret);
+        config.put("authTokenScope", authTokenScope);
+        config.put("replyTo", replyTo);
+        config.put("envelopeFrom", envelopeFrom);
+        return config;
+    }
+
+    private Map<String, String> smtpMap(String host, String port, String from, String auth, String ssl, String starttls,
+                                        String username, String password, String replyTo, String envelopeFrom) {
+        Map<String, String> config = new HashMap<>();
+        config.put("host", host);
+        config.put("port", port);
+        config.put("from", from);
+        config.put("auth", auth);
+        config.put("authType", "basic");
+        config.put("ssl", ssl);
+        config.put("starttls", starttls);
+        config.put("user", username);
+        config.put("password", password);
+        config.put("replyTo", replyTo);
+        config.put("envelopeFrom", envelopeFrom);
+        return config;
+    }
+
+    private void assertClientLoginEventsCountAndClear(RealmResource realm, String clientId, int count) {
+        var events = realm.getEvents();
+        Assertions.assertEquals(count, events.stream().filter(e -> clientId.equals(e.getClientId())).count());
+        events.stream().filter(e -> clientId.equals(e.getClientId())).forEach(event -> Assertions.assertEquals("CLIENT_LOGIN", event.getType()));
+        realm.clearEvents();
+    }
+
+    private void assertEventsEmpty(RealmResource realm) {
+        Assertions.assertTrue(realm.getEvents().isEmpty());
+    }
+
+    private void assertStatus(Response response, int status) {
+        assertEquals(status, response.getStatus());
+        response.close();
+    }
+
+    private void assertMailReceived() {
+        if (mailServer.getReceivedMessages().length == 1) {
+            try {
+                MimeMessage message = mailServer.getReceivedMessages()[0];
+                assertEquals("[KEYCLOAK] - SMTP test message", message.getSubject());
+                mailServer.runCleanup();
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        } else {
+            fail("E-mail was not received");
+        }
+    }
+
+    private void assertMailNotReceived() {
+        assertEquals(0, mailServer.getReceivedMessages().length);
+    }
+
+    public static class SMTPRealmWithClientAndUser implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.eventsEnabled(true); //testing XOAUTH2 token caching behaviour
+
+            realm.addClient("myclient")
+                    .secret("mysecret")
+                    .directAccessGrants();
+
+            //add client for token gathering (XOAUTH2)
+            //reuse the same client does not work
+            realm.addClient("test-smtp-client-I")
+                    .secret("secret")
+                    .serviceAccountsEnabled(true);
+            realm.addClient("test-smtp-client-II")
+                    .secret("secret")
+                    .serviceAccountsEnabled(true);
+            realm.addClient("test-smtp-client-III")
+                    .secret("secret")
+                    .serviceAccountsEnabled(true);
+
+            realm.addUser("myadmin")
+                    .name("My", "Admin")
+                    .email("admin@localhost")
+                    .emailVerified()
+                    .password("myadmin")
+                    .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionVaultTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionVaultTest.java
new file mode 100644
index 000000000000..0d13b4773d82
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/SMTPConnectionVaultTest.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.mail.MailServer;
+import org.keycloak.testframework.mail.annotations.InjectMailServer;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+import java.net.URL;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@KeycloakIntegrationTest(config = SMTPConnectionVaultTest.SMTPVaultConfig.class)
+public class SMTPConnectionVaultTest {
+
+    @InjectRealm(config = SMTPConnectionTest.SMTPRealmWithClientAndUser.class)
+    private ManagedRealm managedRealm;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    private Keycloak adminClient;
+
+    @InjectMailServer
+    private MailServer mailServer;
+
+    @Test
+    public void testWithAuthEnabledValidCredentials() throws Exception {
+        // The value of password must match the value of vaultPassword stored in the vault file: resources/vault/default_smtp__password.
+        // Prefix default in the file default_smtp__password is the name of the managed realm.
+        String password = "admin";
+        String vaultPassword = "${vault.smtp_password}";
+
+        mailServer.credentials("admin@localhost", password);
+
+        Map<String, String> settings = new HashMap<>();
+        settings.put("host", "127.0.0.1");
+        settings.put("port", "3025");
+        settings.put("from", "auto@keycloak.org");
+        settings.put("auth", "true");
+        settings.put("ssl", null);
+        settings.put("starttls", null);
+        settings.put("user", "admin@localhost");
+        settings.put("password", vaultPassword);
+        settings.put("replyTo", "");
+        settings.put("envelopeFrom", "");
+
+        Response response = adminClient.realms().realm(managedRealm.getName()).testSMTPConnection(settings);
+        assertEquals(204, response.getStatus());
+        response.close();
+    }
+
+    public static class SMTPVaultConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            URL url = SMTPConnectionVaultTest.class.getResource("vault");
+            if (url == null) {
+                throw new RuntimeException("Unable to find the vault folder in the classpath for the default_smtp__password file!");
+            }
+            return config.option("vault", "file").option("vault-dir", url.getPath());
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/TimeOffsetTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/TimeOffsetTest.java
new file mode 100644
index 000000000000..f15287265fda
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/TimeOffsetTest.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2023 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.common.util.Time;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.remote.timeoffset.InjectTimeOffSet;
+import org.keycloak.testframework.remote.timeoffset.TimeOffSet;
+
+@KeycloakIntegrationTest
+public class TimeOffsetTest {
+
+    @InjectTimeOffSet
+    TimeOffSet timeOffSet;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    @Test
+    public void testOffset() {
+        runOnServer.run(s -> Assertions.assertEquals(0, Time.getOffset()));
+        timeOffSet.set(5);
+        runOnServer.run(s -> Assertions.assertEquals(5, Time.getOffset()));
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/UsersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/UsersTest.java
new file mode 100644
index 000000000000..7914174623c5
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/UsersTest.java
@@ -0,0 +1,377 @@
+/*
+ * Copyright 2019 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserProvider;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+
+import java.util.List;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.hasSize;
+
+@KeycloakIntegrationTest
+public class UsersTest {
+
+    private static final String realmName = "default";
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm realm;
+
+    @InjectRunOnServer(permittedPackages = {"org.keycloak.tests", "org.keycloak.admin"})
+    RunOnServerClient runOnServer;
+
+    @Test
+    public void searchUserWithWildcards() {
+        createUser("User", "firstName", "lastName", "user@example.com");
+
+        assertThat(realm.admin().users().search("Use%", null, null), hasSize(0));
+        assertThat(realm.admin().users().search("Use_", null, null), hasSize(0));
+        assertThat(realm.admin().users().search("Us_r", null, null), hasSize(0));
+        assertThat(realm.admin().users().search("Use", null, null), hasSize(1));
+        assertThat(realm.admin().users().search("Use*", null, null), hasSize(1));
+        assertThat(realm.admin().users().search("Us*e", null, null), hasSize(1));
+    }
+
+    @Test
+    public void searchUserDefaultSettings() throws Exception {
+        createUser("User", "firstName", "lastName", "user@example.com");
+
+        assertCaseInsensitiveSearch();
+    }
+
+    @Test
+    public void searchUserMatchUsersCount() {
+        createUser("john.doe", "John", "Doe Smith", "john.doe@keycloak.org");
+        String search = "jo do";
+
+        assertThat(realm.admin().users().count(search), is(1));
+        List<UserRepresentation> users = realm.admin().users().search(search, null, null);
+        assertThat(users, hasSize(1));
+        assertThat(users.get(0).getUsername(), is("john.doe"));
+    }
+
+    /**
+     * https://issues.redhat.com/browse/KEYCLOAK-15146
+     */
+    @Test
+    public void findUsersByEmailVerifiedStatus() {
+        createUser(UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(true)
+                .build());
+
+        boolean emailVerified;
+        emailVerified = true;
+        List<UserRepresentation> usersEmailVerified = realm.admin().users().search(null, null, null, null, emailVerified, null, null, null, true);
+        assertThat(usersEmailVerified, is(not(empty())));
+        assertThat(usersEmailVerified.get(0).getUsername(), is("user1"));
+
+        createUser(UserConfigBuilder.create()
+                .username("testuser2")
+                .password("password")
+                .name("testuser2", "testuser2")
+                .email("testuser2@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        usersEmailVerified = realm.admin().users().search("user", null, null, null, emailVerified, null, null, null);
+        assertThat(usersEmailVerified, is(not(empty())));
+        assertThat(usersEmailVerified.size(), is(1));
+        assertThat(usersEmailVerified.get(0).getUsername(), is("user1"));
+        assertThat(realm.admin().users().count("user", null, null, null, emailVerified, null, null, null), is(1));
+
+        emailVerified = false;
+        List<UserRepresentation> usersEmailNotVerified = realm.admin().users().search(null, null, null, null, emailVerified, null, null, null, true);
+        assertThat(usersEmailNotVerified, is(not(empty())));
+        assertThat(usersEmailNotVerified.get(0).getUsername(), is("user2"));
+
+        createUser(UserConfigBuilder.create()
+                .username("testuser3")
+                .password("password")
+                .name("testuser3", "testuser3")
+                .email("testuser3@example.com")
+                .enabled(true)
+                .build());
+
+        usersEmailVerified = realm.admin().users().search("user", null, null, null, emailVerified, null, null, null);
+        assertThat(usersEmailVerified, is(not(empty())));
+        assertThat(usersEmailVerified.size(), is(1));
+        assertThat(usersEmailVerified.get(0).getUsername(), is("user2"));
+        assertThat(realm.admin().users().count("user", null, null, null, emailVerified, null, null, null), is(1));
+    }
+
+    @Test
+    public void testCountUsersByEnabledStatus() {
+        createUser(UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(false)
+                .build());
+
+        assertThat(realm.admin().users().count("user", null, null, null, null, null, true, null), is(1));
+        assertThat(realm.admin().users().count("user", null, null, null, null, null, false, null), is(1));
+    }
+
+    @Test
+    public void testCountUsersByFederatedIdentity() {
+        createUser(UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+        createUser(UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(false)
+                .build());
+
+        runOnServer.run((session -> {
+            RealmModel realm = session.realms().getRealmByName(realmName);
+            session.getContext().setRealm(realm);
+            UserProvider users = session.users();
+            users.addFederatedIdentity(realm, users.getUserById(realm, users.getUserByUsername(realm, "user1").getId()), new FederatedIdentityModel("user1Broker", "user1BrokerId", "user1BrokerUsername"));
+            users.addFederatedIdentity(realm, users.getUserById(realm, users.getUserByUsername(realm, "user2").getId()), new FederatedIdentityModel("user2Broker", "user2BrokerId", "user2BrokerUsername"));
+        }));
+
+        assertThat(realm.admin().users().count(null, "user", null, null, null, null, null, "user1Broker", null, null), is(1));
+        assertThat(realm.admin().users().count(null, "user", null, null, null, null, null, "user1Broker", "user1BrokerId", null), is(1));
+        assertThat(realm.admin().users().count(null, "user", null, null, null, null, null, "user1Broker", "invalidId", null), is(0));
+        assertThat(realm.admin().users().count(null, "user", null, null, null, null, false, "user2Broker", null, null), is(1));
+        assertThat(realm.admin().users().count(null, "user", null, null, null, null, false, "user2Broker", "user1BrokerId", null), is(0));
+    }
+
+    /**
+     * https://issues.redhat.com/browse/KEYCLOAK-15146
+     */
+    @Test
+    public void countUsersByEmailVerifiedStatus() {
+        createUser(UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user3")
+                .password("password")
+                .name("user3FirstName", "user3LastName")
+                .email("user3@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        boolean emailVerified;
+        emailVerified = true;
+        assertThat(realm.admin().users().countEmailVerified(emailVerified), is(2));
+        assertThat(realm.admin().users().count(null,null,null,emailVerified,null), is(2));
+
+        emailVerified = false;
+        assertThat(realm.admin().users().countEmailVerified(emailVerified), is(1));
+        assertThat(realm.admin().users().count(null,null,null,emailVerified,null), is(1));
+    }
+
+    @Test
+    public void countUsersWithViewPermission() {
+        createUser("user1", "user1FirstName", "user1LastName", "user1@example.com");
+        createUser("user2", "user2FirstName", "user2LastName", "user2@example.com");
+        assertThat(realm.admin().users().count(), is(2));
+    }
+
+    @Test
+    public void countUsersBySearchWithViewPermission() {
+        createUser(UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(true)
+                .build());
+
+        createUser(UserConfigBuilder.create()
+                .username("user3")
+                .password("password")
+                .name("user3FirstName", "user3LastName")
+                .email("user3@example.com")
+                .emailVerified()
+                .enabled(true)
+                .build());
+
+        // Prefix search count
+        assertSearchMatchesCount(realm.admin(), "user", 3);
+        assertSearchMatchesCount(realm.admin(), "user*", 3);
+        assertSearchMatchesCount(realm.admin(), "er", 0);
+        assertSearchMatchesCount(realm.admin(), "", 3);
+        assertSearchMatchesCount(realm.admin(), "*", 3);
+        assertSearchMatchesCount(realm.admin(), "user2FirstName", 1);
+        assertSearchMatchesCount(realm.admin(), "user2First", 1);
+        assertSearchMatchesCount(realm.admin(), "user2First*", 1);
+        assertSearchMatchesCount(realm.admin(), "user1@example", 1);
+        assertSearchMatchesCount(realm.admin(), "user1@example*", 1);
+        assertSearchMatchesCount(realm.admin(), null, 3);
+
+        // Infix search count
+        assertSearchMatchesCount(realm.admin(), "*user*", 3);
+        assertSearchMatchesCount(realm.admin(), "**", 3);
+        assertSearchMatchesCount(realm.admin(), "*foobar*", 0);
+        assertSearchMatchesCount(realm.admin(), "*LastName*", 3);
+        assertSearchMatchesCount(realm.admin(), "*FirstName*", 3);
+        assertSearchMatchesCount(realm.admin(), "*@example.com*", 3);
+
+        // Exact search count
+        assertSearchMatchesCount(realm.admin(), "\"user1\"", 1);
+        assertSearchMatchesCount(realm.admin(), "\"1\"", 0);
+        assertSearchMatchesCount(realm.admin(), "\"\"", 0);
+        assertSearchMatchesCount(realm.admin(), "\"user1FirstName\"", 1);
+        assertSearchMatchesCount(realm.admin(), "\"user1LastName\"", 1);
+        assertSearchMatchesCount(realm.admin(), "\"user1@example.com\"", 1);
+    }
+
+    @Test
+    public void countUsersByFiltersWithViewPermission() {
+        createUser("user1", "user1FirstName", "user1LastName", "user1@example.com");
+        createUser("user2", "user2FirstName", "user2LastName", "user2@example.com");
+        //search username
+        assertThat(realm.admin().users().count(null, null, null, "user"), is(2));
+        assertThat(realm.admin().users().count(null, null, null, "user1"), is(1));
+        assertThat(realm.admin().users().count(null, null, null, "notExisting"), is(0));
+        assertThat(realm.admin().users().count(null, null, null, ""), is(2));
+        //search first name
+        assertThat(realm.admin().users().count(null, "FirstName", null, null), is(2));
+        assertThat(realm.admin().users().count(null, "user2FirstName", null, null), is(1));
+        assertThat(realm.admin().users().count(null, "notExisting", null, null), is(0));
+        assertThat(realm.admin().users().count(null, "", null, null), is(2));
+        //search last name
+        assertThat(realm.admin().users().count("LastName", null, null, null), is(2));
+        assertThat(realm.admin().users().count("user2LastName", null, null, null), is(1));
+        assertThat(realm.admin().users().count("notExisting", null, null, null), is(0));
+        assertThat(realm.admin().users().count("", null, null, null), is(2));
+        //search in email
+        assertThat(realm.admin().users().count(null, null, "@example.com", null), is(2));
+        assertThat(realm.admin().users().count(null, null, "user1@example.com", null), is(1));
+        assertThat(realm.admin().users().count(null, null, "user1@test.com", null), is(0));
+        assertThat(realm.admin().users().count(null, null, "", null), is(2));
+        //search for combinations
+        assertThat(realm.admin().users().count("LastName", "FirstName", null, null), is(2));
+        assertThat(realm.admin().users().count("user1LastName", "FirstName", null, null), is(1));
+        assertThat(realm.admin().users().count("user1LastName", "", null, null), is(1));
+        assertThat(realm.admin().users().count("LastName", "", null, null), is(2));
+        assertThat(realm.admin().users().count("LastName", "", null, null), is(2));
+        assertThat(realm.admin().users().count(null, null, "@example.com", "user"), is(2));
+        //search not specified (defaults to simply /count)
+        assertThat(realm.admin().users().count(null, null, null, null), is(2));
+        assertThat(realm.admin().users().count("", "", "", ""), is(2));
+    }
+
+    private void assertSearchMatchesCount(RealmResource realmResource, String search, Integer expectedCount) {
+        Integer count = realmResource.users().count(search);
+        assertThat(count, is(expectedCount));
+        assertThat(realmResource.users().search(search, null, null), hasSize(count));
+    }
+
+    private void assertCaseInsensitiveSearch() {
+        // not-exact case-insensitive search
+        assertThat(realm.admin().users().search("user"), hasSize(1));
+        assertThat(realm.admin().users().search("User"), hasSize(1));
+        assertThat(realm.admin().users().search("USER"), hasSize(1));
+        assertThat(realm.admin().users().search("Use"), hasSize(1));
+
+        // exact case-insensitive search
+        assertThat(realm.admin().users().search("user", true), hasSize(1));
+        assertThat(realm.admin().users().search("User", true), hasSize(1));
+        assertThat(realm.admin().users().search("USER", true), hasSize(1));
+        assertThat(realm.admin().users().search("Use", true), hasSize(0));
+    }
+
+    private void createUser(UserRepresentation user) {
+        realm.admin().users().create(user).close();
+    }
+
+    private void createUser(String username, String firstName, String lastName, String email) {
+        createUser(UserConfigBuilder.create()
+                .username(username)
+                .password("password")
+                .name(firstName, lastName)
+                .email(email)
+                .enabled(true)
+                .build());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AbstractAuthenticationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AbstractAuthenticationTest.java
new file mode 100644
index 000000000000..15b2e97ee0bf
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AbstractAuthenticationTest.java
@@ -0,0 +1,233 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+public abstract class AbstractAuthenticationTest {
+
+    static final String REQUIRED = "REQUIRED";
+    static final String CONDITIONAL = "CONDITIONAL";
+    static final String DISABLED = "DISABLED";
+    static final String ALTERNATIVE = "ALTERNATIVE";
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    RealmResource realmResource;
+    AuthenticationManagementResource authMgmtResource;
+    protected String testRealmId;
+
+    @InjectAdminEvents
+    public AdminEvents adminEvents;
+
+    @BeforeEach
+    public void before() {
+        realmResource = managedRealm.admin();
+        authMgmtResource = realmResource.flows();
+        testRealmId = managedRealm.getId();
+    }
+
+    public static AuthenticationExecutionInfoRepresentation findExecutionByProvider(String provider, List<AuthenticationExecutionInfoRepresentation> executions) {
+        for (AuthenticationExecutionInfoRepresentation exec : executions) {
+            if (provider.equals(exec.getProviderId())) {
+                return exec;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Searches for an execution located before the provided execution on the same level of
+     * an authentication flow.
+     *
+     * @param execution execution to find a neighbor for
+     * @param executions list of executions to search in
+     * @return execution, or null if not found
+     */
+    public static AuthenticationExecutionInfoRepresentation findPreviousExecution(AuthenticationExecutionInfoRepresentation execution, List<AuthenticationExecutionInfoRepresentation> executions) {
+        for (AuthenticationExecutionInfoRepresentation exec : executions) {
+            if (exec.getLevel() != execution.getLevel()) {
+                continue;
+            }
+            if (exec.getIndex() == execution.getIndex() - 1) {
+                return exec;
+            }
+        }
+        return null;
+    }
+
+    public static AuthenticationFlowRepresentation findFlowByAlias(String alias, List<AuthenticationFlowRepresentation> flows) {
+        for (AuthenticationFlowRepresentation flow : flows) {
+            if (alias.equals(flow.getAlias())) {
+                return flow;
+            }
+        }
+        return null;
+    }
+
+    void compareExecution(AuthenticationExecutionInfoRepresentation expected, AuthenticationExecutionInfoRepresentation actual) {
+        Assertions.assertEquals(expected.getRequirement(), actual.getRequirement(), "Execution requirement - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getDisplayName(), actual.getDisplayName(), "Execution display name - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getConfigurable(), actual.getConfigurable(), "Execution configurable - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getProviderId(), actual.getProviderId(), "Execution provider id - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getLevel(), actual.getLevel(), "Execution level - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getIndex(), actual.getIndex(), "Execution index - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getPriority(), actual.getPriority(), "Execution priority - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getAuthenticationFlow(), actual.getAuthenticationFlow(), "Execution authentication flow - " + actual.getProviderId());
+        Assertions.assertEquals(expected.getRequirementChoices(), actual.getRequirementChoices(), "Execution requirement choices - " + actual.getProviderId());
+    }
+
+    void compareExecution(AuthenticationExecutionExportRepresentation expected, AuthenticationExecutionExportRepresentation actual) {
+        Assertions.assertEquals(expected.getFlowAlias(), actual.getFlowAlias(), "Execution flowAlias - " + actual.getFlowAlias());
+        Assertions.assertEquals(expected.getAuthenticator(), actual.getAuthenticator(), "Execution authenticator - " + actual.getAuthenticator());
+        Assertions.assertEquals(expected.isUserSetupAllowed(), actual.isUserSetupAllowed(), "Execution userSetupAllowed - " + actual.getAuthenticator());
+        Assertions.assertEquals(expected.isAuthenticatorFlow(), actual.isAuthenticatorFlow(), "Execution authenticatorFlow - " + actual.getAuthenticator());
+        Assertions.assertEquals(expected.getAuthenticatorConfig(), actual.getAuthenticatorConfig(), "Execution authenticatorConfig - " + actual.getAuthenticatorConfig());
+        Assertions.assertEquals(expected.getPriority(), actual.getPriority(), "Execution priority - " + actual.getAuthenticator());
+        Assertions.assertEquals(expected.getRequirement(), actual.getRequirement(), "Execution requirement - " + actual.getAuthenticator());
+    }
+
+    void compareExecutions(List<AuthenticationExecutionExportRepresentation> expected, List<AuthenticationExecutionExportRepresentation> actual) {
+        Assertions.assertNotNull(actual, "Executions should not be null");
+        Assertions.assertEquals(expected.size(), actual.size(), "Size");
+
+        for (int i = 0; i < expected.size(); i++) {
+            compareExecution(expected.get(i), actual.get(i));
+        }
+    }
+
+    void compareFlows(AuthenticationFlowRepresentation expected, AuthenticationFlowRepresentation actual) {
+        Assertions.assertEquals(expected.getAlias(), actual.getAlias(), "Flow alias");
+        Assertions.assertEquals(expected.getDescription(), actual.getDescription(), "Flow description");
+        Assertions.assertEquals(expected.getProviderId(), actual.getProviderId(), "Flow providerId");
+        Assertions.assertEquals(expected.isTopLevel(), actual.isTopLevel(), "Flow top level");
+        Assertions.assertEquals(expected.isBuiltIn(), actual.isBuiltIn(), "Flow built-in");
+
+        List<AuthenticationExecutionExportRepresentation> expectedExecs = expected.getAuthenticationExecutions();
+        List<AuthenticationExecutionExportRepresentation> actualExecs = actual.getAuthenticationExecutions();
+
+        if (expectedExecs == null) {
+            Assertions.assertTrue(actualExecs == null || actualExecs.size() == 0, "Executions should be null or empty");
+        } else {
+            compareExecutions(expectedExecs, actualExecs);
+        }
+    }
+
+    AuthenticationFlowRepresentation newFlow(String alias, String description,
+                                                       String providerId, boolean topLevel, boolean builtIn) {
+        AuthenticationFlowRepresentation flow = new AuthenticationFlowRepresentation();
+        flow.setAlias(alias);
+        flow.setDescription(description);
+        flow.setProviderId(providerId);
+        flow.setTopLevel(topLevel);
+        flow.setBuiltIn(builtIn);
+        return flow;
+    }
+
+    AuthenticationExecutionInfoRepresentation newExecInfo(String displayName, String providerId, Boolean configurable,
+                                                          int level, int index, String requirement, Boolean authFlow, String[] choices,
+                                                          int priority) {
+
+        AuthenticationExecutionInfoRepresentation execution = new AuthenticationExecutionInfoRepresentation();
+        execution.setRequirement(requirement);
+        execution.setDisplayName(displayName);
+        execution.setConfigurable(configurable);
+        execution.setProviderId(providerId);
+        execution.setLevel(level);
+        execution.setIndex(index);
+        execution.setAuthenticationFlow(authFlow);
+        execution.setPriority(priority);
+        if (choices != null) {
+            execution.setRequirementChoices(Arrays.asList(choices));
+        }
+        return execution;
+    }
+
+    void addExecInfo(List<AuthenticationExecutionInfoRepresentation> target, String displayName, String providerId, Boolean configurable,
+                 int level, int index, String requirement, Boolean authFlow, String[] choices, int priority) {
+
+        AuthenticationExecutionInfoRepresentation exec = newExecInfo(displayName, providerId, configurable, level, index, requirement, authFlow, choices, priority);
+        target.add(exec);
+    }
+
+    AuthenticatorConfigRepresentation newConfig(String alias, String[] keyvalues) {
+        AuthenticatorConfigRepresentation config = new AuthenticatorConfigRepresentation();
+        config.setAlias(alias);
+
+        if (keyvalues == null) {
+            throw new IllegalArgumentException("keyvalues == null");
+        }
+        if (keyvalues.length % 2 != 0) {
+            throw new IllegalArgumentException("keyvalues should have even number of elements");
+        }
+
+        LinkedHashMap<String, String> params = new LinkedHashMap<>();
+        for (int i = 0; i < keyvalues.length; i += 2) {
+            params.put(keyvalues[i], keyvalues[i + 1]);
+        }
+        config.setConfig(params);
+        return config;
+    }
+
+    String createFlow(AuthenticationFlowRepresentation flowRep) {
+        return createFlow(flowRep, true);
+    }
+
+    String createFlow(AuthenticationFlowRepresentation flowRep, boolean autoDelete) {
+        Response response = authMgmtResource.createFlow(flowRep);
+        Assertions.assertEquals(201, response.getStatus());
+        response.close();
+        String flowId = ApiUtil.getCreatedId(response);
+        if (autoDelete) {
+            managedRealm.cleanup().add(r -> r.flows().deleteFlow(flowId));
+        }
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.authFlowPath(flowId))
+                .representation(flowRep)
+                .resourceType(ResourceType.AUTH_FLOW);
+        return flowId;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AuthenticatorConfigTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AuthenticatorConfigTest.java
new file mode 100644
index 000000000000..26b9c059043e
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/AuthenticatorConfigTest.java
@@ -0,0 +1,292 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.authentication.authenticators.broker.IdpCreateUserIfUniqueAuthenticatorFactory;
+import org.keycloak.authentication.authenticators.broker.IdpDetectExistingBrokerUserAuthenticatorFactory;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.AuthenticatorConfigModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.util.ApiUtil;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class AuthenticatorConfigTest extends AbstractAuthenticationTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    private String flowId;
+    private String executionId;
+    private String executionId2;
+
+    @BeforeEach
+    public void beforeConfigTest() {
+        AuthenticationFlowRepresentation flowRep = newFlow("firstBrokerLogin2", "firstBrokerLogin2", "basic-flow", true, false);
+        flowId = createFlow(flowRep);
+
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("provider", IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID);
+        authMgmtResource.addExecution("firstBrokerLogin2", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("firstBrokerLogin2"), params, ResourceType.AUTH_EXECUTION);
+        params.put("provider", IdpDetectExistingBrokerUserAuthenticatorFactory.PROVIDER_ID);
+        authMgmtResource.addExecution("firstBrokerLogin2", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("firstBrokerLogin2"), params, ResourceType.AUTH_EXECUTION);
+
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("firstBrokerLogin2");
+        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider(IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, executionReps);
+        Assertions.assertNotNull(exec);
+        executionId = exec.getId();
+        exec = findExecutionByProvider(IdpDetectExistingBrokerUserAuthenticatorFactory.PROVIDER_ID, executionReps);
+        Assertions.assertNotNull(exec);
+        executionId2 = exec.getId();
+    }
+
+    @Test
+    public void testCreateConfigWithReservedChar() {
+        AuthenticatorConfigRepresentation cfg = newConfig("f!oo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+        Response resp = authMgmtResource.newExecutionConfig(executionId, cfg);
+        Assertions.assertEquals(400, resp.getStatus());
+    }
+
+    @Test
+    public void testCreateConfig() {
+        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+
+        // Attempt to create config for non-existent execution
+        try (Response response = authMgmtResource.newExecutionConfig("exec-id-doesnt-exists", cfg)) {
+            Assertions.assertEquals(404, response.getStatus());
+        }
+
+        // Create config success
+        String cfgId = createConfig(executionId, cfg);
+
+        // Assert found
+        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
+        assertConfig(cfgRep, cfgId, "foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+
+        // Cleanup
+        authMgmtResource.removeAuthenticatorConfig(cfgId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionConfigPath(cfgId), ResourceType.AUTHENTICATOR_CONFIG);
+    }
+
+    @Test
+    public void testUpdateConfigWithBadChar() {
+        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+        String cfgId = createConfig(executionId, cfg);
+        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
+        
+        cfgRep.setAlias("Bad@Char");
+        Assertions.assertThrows(BadRequestException.class, () -> authMgmtResource.updateAuthenticatorConfig(cfgRep.getId(), cfgRep));
+    }
+    
+    @Test
+    public void testUpdateConfig() {
+        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+        String cfgId = createConfig(executionId, cfg);
+        final AuthenticatorConfigRepresentation cfgRepNonExistent = authMgmtResource.getAuthenticatorConfig(cfgId);
+
+        // Try to update not existent config
+        NotFoundException nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.updateAuthenticatorConfig("not-existent", cfgRepNonExistent));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+
+        // Assert nothing changed
+        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
+        assertConfig(cfgRep, cfgId, "foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+
+        // Update success
+        cfgRep.setAlias("foo2");
+        cfgRep.getConfig().put("configKey2", "configValue2");
+        authMgmtResource.updateAuthenticatorConfig(cfgRep.getId(), cfgRep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authExecutionConfigPath(cfgId), cfgRep, ResourceType.AUTHENTICATOR_CONFIG);
+
+        // Assert updated
+        cfgRep = authMgmtResource.getAuthenticatorConfig(cfgRep.getId());
+        assertConfig(cfgRep, cfgId, "foo2",
+                IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true",
+                "configKey2", "configValue2");
+    }
+
+
+    @Test
+    public void testRemoveConfig() {
+        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+        String cfgId = createConfig(executionId, cfg);
+        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
+
+        // Assert execution has our config
+        AuthenticationExecutionInfoRepresentation execution = findExecutionByProvider(
+                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
+        Assertions.assertEquals(cfgRep.getId(), execution.getAuthenticationConfig());
+
+        // Test remove not-existent
+        NotFoundException nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.removeAuthenticatorConfig("not-existent"));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+
+        // Test remove our config
+        authMgmtResource.removeAuthenticatorConfig(cfgId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionConfigPath(cfgId), ResourceType.AUTHENTICATOR_CONFIG);
+
+        // Assert config not found
+        nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(cfgRep.getId()));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+
+        // Assert execution doesn't have our config
+        execution = findExecutionByProvider(
+                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
+        Assertions.assertNull(execution.getAuthenticationConfig());
+    }
+
+    @Test
+    public void testNullsafetyIterationOverProperties() {
+        String providerId = "auth-cookie";
+        String providerName = "Cookie";
+        AuthenticatorConfigInfoRepresentation description = authMgmtResource.getAuthenticatorConfigDescription(providerId);
+
+        Assertions.assertEquals(providerName, description.getName());
+        Assertions.assertTrue(description.getProperties().isEmpty());
+    }
+
+    @Test
+    public void testDuplicateAuthenticatorConfigAlias() {
+        // create a config for step1
+        AuthenticatorConfigRepresentation config1 = new AuthenticatorConfigRepresentation();
+        config1.setAlias("test-config-1");
+        config1.setConfig(Map.of("key", "value"));
+        String config1Id = createConfig(executionId, config1);
+
+        // create the same config name for step2, should fail
+        try (Response response = authMgmtResource.newExecutionConfig(executionId2, config1)) {
+            Assertions.assertEquals(409, response.getStatus());
+        }
+
+        // create a config for step2
+        AuthenticatorConfigRepresentation config2 = new AuthenticatorConfigRepresentation();
+        config2.setAlias("test-config-2");
+        config2.setConfig(Map.of("key", "value"));
+        String config2Id = createConfig(executionId, config2);
+
+        // create a new config for step1, config1 should be removed
+        AuthenticatorConfigRepresentation config3 = new AuthenticatorConfigRepresentation();
+        config3.setAlias("test-config-1-modified");
+        config3.setConfig(Map.of("key", "value"));
+        String tmpConfig3Id = createConfig(executionId, config3);
+        NotFoundException nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(config1Id));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+
+        // create a new config with thew same name but that overwrites the previous one
+        String config3Id = createConfig(executionId, config3);
+        nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(tmpConfig3Id));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+
+        // delete execution step1, config3 should be removed
+        authMgmtResource.removeExecution(executionId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionPath(executionId), ResourceType.AUTH_EXECUTION);
+        nfe = Assertions.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(config3Id));
+        Assertions.assertEquals(404, nfe.getResponse().getStatus());
+    }
+
+    @Test
+    public void testMissingConfig() {
+        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
+        final String cfgId = createConfig(executionId, cfg);
+        final String realmId = testRealmId;
+        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
+        Assertions.assertNotNull(cfgRep);
+
+        runOnServer.run(session -> {
+            // emulating a broken config id, remove the config but do not remove the link in the authenticator
+            RealmModel realm = session.realms().getRealm(realmId);
+            AuthenticatorConfigModel config = realm.getAuthenticatorConfigById(cfgId);
+            realm.removeAuthenticatorConfig(config);
+        });
+
+        // check the flow can be read and execution has no config
+        AuthenticationFlowRepresentation flow = authMgmtResource.getFlow(flowId);
+        AuthenticationExecutionExportRepresentation execExport = flow.getAuthenticationExecutions().stream()
+                .filter(ae -> IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID.equals(ae.getAuthenticator()))
+                .findAny()
+                .orElse(null);
+        Assertions.assertNotNull(execExport);
+        Assertions.assertNull(execExport.getAuthenticatorConfig());
+
+        // check the execution can be read with no configuration assigned
+        AuthenticationExecutionInfoRepresentation execInfo = findExecutionByProvider(
+                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
+        Assertions.assertNull(execInfo.getAuthenticationConfig());
+    }
+
+    private String createConfig(String executionId, AuthenticatorConfigRepresentation cfg) {
+        try (Response resp = authMgmtResource.newExecutionConfig(executionId, cfg)) {
+            Assertions.assertEquals(201, resp.getStatus());
+            String cfgId = ApiUtil.getCreatedId(resp);
+            Assertions.assertNotNull(cfgId);
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionConfigPath(executionId), cfg, ResourceType.AUTHENTICATOR_CONFIG);
+            return cfgId;
+        }
+    }
+
+    private AuthenticatorConfigRepresentation newConfig(String alias, String cfgKey, String cfgValue) {
+        AuthenticatorConfigRepresentation cfg = new AuthenticatorConfigRepresentation();
+        cfg.setAlias(alias);
+        Map<String, String> cfgMap = new HashMap<>();
+        cfgMap.put(cfgKey, cfgValue);
+        cfg.setConfig(cfgMap);
+        return cfg;
+    }
+
+    private void assertConfig(AuthenticatorConfigRepresentation cfgRep, String id, String alias, String... fields) {
+        Assertions.assertEquals(id, cfgRep.getId());
+        Assertions.assertEquals(alias, cfgRep.getAlias());
+        Assert.assertMap(cfgRep.getConfig(), fields);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ExecutionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ExecutionTest.java
new file mode 100644
index 000000000000..b6842777b220
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ExecutionTest.java
@@ -0,0 +1,362 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.authentication.AuthenticationFlow;
+import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
+import org.keycloak.authentication.authenticators.browser.WebAuthnAuthenticatorFactory;
+import org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.hasItems;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public class ExecutionTest extends AbstractAuthenticationTest {
+
+    // KEYCLOAK-7975
+    @Test
+    public void testUpdateAuthenticatorConfig() {
+        // copy built-in flow so we get a new editable flow
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", "new-browser-flow");
+        Response response = authMgmtResource.copy("browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+        try {
+            Assertions.assertEquals(201, response.getStatus(), "Copy flow");
+        } finally {
+            response.close();
+        }
+
+        // create Conditional OTP Form execution
+        params.put("provider", "auth-conditional-otp-form");
+        authMgmtResource.addExecution("new-browser-flow", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("new-browser-flow"), params, ResourceType.AUTH_EXECUTION);
+
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("new-browser-flow");
+        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("auth-conditional-otp-form", executionReps);
+
+        // create authenticator config for the execution
+        Map<String, String> config = new HashMap<>();
+        config.put("defaultOtpOutcome", "skip");
+        config.put("otpControlAttribute", "test");
+        config.put("forceOtpForHeaderPattern", "");
+        config.put("forceOtpRole", "");
+        config.put("noOtpRequiredForHeaderPattern", "");
+        config.put("skipOtpRole", "");
+
+        AuthenticatorConfigRepresentation authConfigRep = new AuthenticatorConfigRepresentation();
+        authConfigRep.setAlias("conditional-otp-form-config-alias");
+        authConfigRep.setConfig(config);
+        response = authMgmtResource.newExecutionConfig(exec.getId(), authConfigRep);
+
+        try {
+            authConfigRep.setId(ApiUtil.getCreatedId(response));
+        } finally {
+            response.close();
+        }
+
+        // try to update the config adn check
+        config.put("otpControlAttribute", "test-updated");
+        authConfigRep.setConfig(config);
+        authMgmtResource.updateAuthenticatorConfig(authConfigRep.getId(), authConfigRep);
+
+        AuthenticatorConfigRepresentation updated = authMgmtResource.getAuthenticatorConfig(authConfigRep.getId());
+
+        assertThat(updated.getConfig().values(), hasItems("test-updated", "skip"));
+    }
+
+    @Test
+    public void testAddRemoveExecution() {
+
+        // try add execution to built-in flow
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("provider", "idp-review-profile");
+        try {
+            authMgmtResource.addExecution("browser", params);
+            Assertions.fail("add execution to built-in flow should fail");
+        } catch (BadRequestException expected) {
+            // Expected
+        }
+
+        // try add execution to not-existent flow
+        try {
+            authMgmtResource.addExecution("not-existent", params);
+            Assertions.fail("add execution to not-existent flow should fail");
+        } catch (BadRequestException expected) {
+            // Expected
+        }
+
+        // copy built-in flow so we get a new editable flow
+        params.put("newName", "Copy-of-browser");
+        Response response = authMgmtResource.copy("browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+        try {
+            Assertions.assertEquals(201, response.getStatus(), "Copy flow");
+        } finally {
+            response.close();
+        }
+
+        // add execution using inexistent provider
+        params.put("provider", "test-execution");
+        try {
+            authMgmtResource.addExecution("CopyOfBrowser", params);
+            Assertions.fail("add execution with inexistent provider should fail");
+        } catch(BadRequestException expected) {
+            // Expected
+        }
+
+        // add execution - should succeed
+        params.put("provider", "idp-review-profile");
+        authMgmtResource.addExecution("Copy-of-browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("Copy-of-browser"), params, ResourceType.AUTH_EXECUTION);
+
+        // check execution was added
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("Copy-of-browser");
+        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("idp-review-profile", executionReps);
+        Assertions.assertNotNull(exec, "idp-review-profile added");
+
+        // we'll need auth-cookie later
+        AuthenticationExecutionInfoRepresentation authCookieExec = findExecutionByProvider("auth-cookie", executionReps);
+
+        AuthenticationExecutionInfoRepresentation previousExecution = findPreviousExecution(exec, executionReps);
+        Assertions.assertNotNull(previousExecution);
+        compareExecution(newExecInfo("Review Profile", "idp-review-profile", true, 0, 5, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE,DISABLED}, previousExecution.getPriority() + 1), exec);
+
+        // remove execution
+        authMgmtResource.removeExecution(exec.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionPath(exec.getId()), ResourceType.AUTH_EXECUTION);
+
+        // check execution was removed
+        executionReps = authMgmtResource.getExecutions("Copy-of-browser");
+        exec = findExecutionByProvider("idp-review-profile", executionReps);
+        Assertions.assertNull(exec, "idp-review-profile removed");
+
+        // now add the execution again using a different method and representation
+
+        // delete auth-cookie
+        authMgmtResource.removeExecution(authCookieExec.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionPath(authCookieExec.getId()), ResourceType.AUTH_EXECUTION);
+
+        AuthenticationExecutionRepresentation rep = new AuthenticationExecutionRepresentation();
+        rep.setPriority(10);
+        rep.setAuthenticator("auth-cookie");
+        rep.setRequirement(CONDITIONAL);
+
+        // Should fail - missing parent flow
+        response = authMgmtResource.addExecution(rep);
+        try {
+            Assertions.assertEquals(400, response.getStatus(), "added execution missing parent flow");
+        } finally {
+            response.close();
+        }
+
+        // Should fail - not existent parent flow
+        rep.setParentFlow("not-existent-id");
+        response = authMgmtResource.addExecution(rep);
+        try {
+            Assertions.assertEquals(400, response.getStatus(), "added execution missing parent flow");
+        } finally {
+            response.close();
+        }
+
+        // Should fail - add execution to builtin flow
+        AuthenticationFlowRepresentation browserFlow = findFlowByAlias("browser", authMgmtResource.getFlows());
+        rep.setParentFlow(browserFlow.getId());
+        response = authMgmtResource.addExecution(rep);
+        try {
+            Assertions.assertEquals(400, response.getStatus(), "added execution to builtin flow");
+        } finally {
+            response.close();
+        }
+
+        // get Copy-of-browser flow id, and set it on execution
+        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation flow = findFlowByAlias("Copy-of-browser", flows);
+        rep.setParentFlow(flow.getId());
+
+        // add execution - should succeed
+        String createdId = ApiUtil.getCreatedId(authMgmtResource.addExecution(rep));
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.authMgmtBasePath(), "executions", createdId)
+                .representation(rep)
+                .resourceType(ResourceType.AUTH_EXECUTION);
+
+        // check execution was added
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("Copy-of-browser");
+        exec = findExecutionByProvider("auth-cookie", executions);
+        Assertions.assertNotNull(exec, "auth-cookie added");
+
+        // Note: there is no checking in addExecution if requirement is one of requirementChoices
+        // Thus we can have OPTIONAL which is neither ALTERNATIVE, nor DISABLED
+        compareExecution(newExecInfo("Cookie", "auth-cookie", false, 0, 0, CONDITIONAL, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 10), exec);
+    }
+
+    @Test
+    public void testUpdateExecution() {
+
+        // get current auth-cookie execution
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("browser");
+        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("auth-cookie", executionReps);
+
+        Assertions.assertEquals(ALTERNATIVE, exec.getRequirement(), "auth-cookie set to ALTERNATIVE");
+        Assertions.assertEquals(exec.getIndex(), 0, "auth-cookie is first in the flow");
+
+        // switch from DISABLED to ALTERNATIVE
+        exec.setRequirement(DISABLED);
+        exec.setPriority(Integer.MAX_VALUE);
+        authMgmtResource.updateExecutions("browser", exec);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), exec, ResourceType.AUTH_EXECUTION);
+
+        // make sure the change is visible
+        executionReps = authMgmtResource.getExecutions("browser");
+
+        // get current auth-cookie execution
+        AuthenticationExecutionInfoRepresentation exec2 = findExecutionByProvider("auth-cookie", executionReps);
+
+        // The execution is expected to be last after priority change
+        long expectedIndex = executionReps.stream()
+            .filter(r -> r.getLevel() == exec2.getLevel())
+            .count() - 1;
+        exec.setIndex(Math.toIntExact(expectedIndex));
+
+        compareExecution(exec, exec2);
+    }
+
+    @Test
+    public void testClientFlowExecutions() {
+        // Create client flow
+        AuthenticationFlowRepresentation clientFlow = newFlow("new-client-flow", "desc", AuthenticationFlow.CLIENT_FLOW, true, false);
+        createFlow(clientFlow);
+
+        // Add execution to it
+        Map<String, Object> executionData = new HashMap<>();
+        executionData.put("provider", ClientIdAndSecretAuthenticator.PROVIDER_ID);
+        authMgmtResource.addExecution("new-client-flow", executionData);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("new-client-flow"), executionData, ResourceType.AUTH_EXECUTION);
+
+        // Check executions of not-existent flow - SHOULD FAIL
+        try {
+            authMgmtResource.getExecutions("not-existent");
+            Assertions.fail("Not expected to find executions");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Check existent executions
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("new-client-flow");
+        AuthenticationExecutionInfoRepresentation executionRep = findExecutionByProvider(ClientIdAndSecretAuthenticator.PROVIDER_ID, executions);
+        Assertions.assertNotNull(executionRep);
+
+        // Update execution with not-existent flow - SHOULD FAIL
+        try {
+            authMgmtResource.updateExecutions("not-existent", executionRep);
+            Assertions.fail("Not expected to update execution with not-existent flow");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Update execution with not-existent ID - SHOULD FAIL
+        AuthenticationExecutionInfoRepresentation executionRep2 = new AuthenticationExecutionInfoRepresentation();
+        executionRep2.setId("not-existent");
+        try {
+            authMgmtResource.updateExecutions("new-client-flow", executionRep2);
+            Assertions.fail("Not expected to update not-existent execution");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Update success
+        executionRep.setRequirement(ALTERNATIVE);
+        authMgmtResource.updateExecutions("new-client-flow", executionRep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("new-client-flow"), executionRep, ResourceType.AUTH_EXECUTION);
+
+        // Check updated
+        executionRep = findExecutionByProvider(ClientIdAndSecretAuthenticator.PROVIDER_ID, authMgmtResource.getExecutions("new-client-flow"));
+        Assertions.assertEquals(ALTERNATIVE, executionRep.getRequirement());
+
+        // Remove execution with not-existent ID
+        try {
+            authMgmtResource.removeExecution("not-existent");
+            Assertions.fail("Didn't expect to find execution");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Successfuly remove execution and flow
+        authMgmtResource.removeExecution(executionRep.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionPath(executionRep.getId()), ResourceType.AUTH_EXECUTION);
+    }
+
+    @Test
+    public void testRequirementsInExecution() {
+        HashMap<String, Object> params = new HashMap<>();
+        String newBrowserFlow = "new-exec-flow";
+
+        params.put("newName", newBrowserFlow);
+        try (Response response = authMgmtResource.copy("browser", params)) {
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+            Assertions.assertEquals(201, response.getStatus(), "Copy flow");
+        }
+
+        addExecutionCheckReq(newBrowserFlow, UsernameFormFactory.PROVIDER_ID, params, REQUIRED);
+        addExecutionCheckReq(newBrowserFlow, WebAuthnAuthenticatorFactory.PROVIDER_ID, params, DISABLED);
+
+        AuthenticationFlowRepresentation rep = findFlowByAlias(newBrowserFlow, authMgmtResource.getFlows());
+        Assertions.assertNotNull(rep);
+        authMgmtResource.deleteFlow(rep.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authFlowPath(rep.getId()), ResourceType.AUTH_FLOW);
+    }
+
+    private void addExecutionCheckReq(String flow, String providerID, HashMap<String, Object> params, String expectedRequirement) {
+        params.put("provider", providerID);
+        authMgmtResource.addExecution(flow, params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath(flow), params, ResourceType.AUTH_EXECUTION);
+
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions(flow);
+        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider(providerID, executionReps);
+
+        Assertions.assertNotNull(exec);
+        Assertions.assertEquals(expectedRequirement, exec.getRequirement());
+
+        authMgmtResource.removeExecution(exec.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authExecutionPath(exec.getId()), ResourceType.AUTH_EXECUTION);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/FlowTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/FlowTest.java
new file mode 100644
index 000000000000..3693e4030001
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/FlowTest.java
@@ -0,0 +1,777 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.InternalServerErrorException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import org.hamcrest.MatcherAssert;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.CreatedResponseUtil;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticatorFactory;
+import org.keycloak.common.util.StreamUtil;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.utils.DefaultAuthenticationFlows;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.BiConsumer;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.endsWith;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.fail;
+import static org.keycloak.tests.utils.matchers.Matchers.body;
+import static org.keycloak.tests.utils.matchers.Matchers.statusCodeIs;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public class FlowTest extends AbstractAuthenticationTest {
+
+    // KEYCLOAK-3681: Delete top flow doesn't delete all subflows
+    @Test
+    public void testRemoveSubflows() {
+        createFlow(newFlow("Foo", "Foo flow", "generic", true, false), false);
+        addFlowToParent("Foo", "child");
+        addFlowToParent("child", "grandchild");
+
+        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation found = findFlowByAlias("Foo", flows);
+        authMgmtResource.deleteFlow(found.getId());
+
+        adminEvents.skipAll();
+
+        createFlow(newFlow("Foo", "Foo flow", "generic", true, false), false);
+        addFlowToParent("Foo", "child");
+
+        // Under the old code, this would throw an error because "grandchild"
+        // was left in the database
+        addFlowToParent("child", "grandchild");
+
+        authMgmtResource.deleteFlow(findFlowByAlias("Foo", authMgmtResource.getFlows()).getId());
+    }
+
+    @Test
+    public void testRemoveExecutionSubflow() {
+        createFlow(newFlow("Foo", "Foo flow", "generic", true, false));
+        addFlowToParent("Foo", "child");
+        addFlowToParent("child", "grandchild");
+
+        // remove the foo child but using the execution
+        List<AuthenticationExecutionInfoRepresentation> fooExecutions = authMgmtResource.getExecutions("Foo");
+        AuthenticationExecutionInfoRepresentation childExececution = fooExecutions.stream()
+                .filter(r -> "child".equals(r.getDisplayName()) && r.getLevel() == 0).findAny().orElse(null);
+        assertNotNull(childExececution);
+        authMgmtResource.removeExecution(childExececution.getId());
+        adminEvents.skip();
+
+        // check subflows were removed and can be re-created
+        addFlowToParent("Foo", "child");
+        addFlowToParent("child", "grandchild");
+    }
+
+    private void addFlowToParent(String parentAlias, String childAlias) {
+        Map<String, Object> data = new HashMap<>();
+        data.put("alias", childAlias);
+        data.put("type", "generic");
+        data.put("description", childAlias + " flow");
+        authMgmtResource.addExecutionFlow(parentAlias, data);
+    }
+
+    @Test
+    public void testAddFlowWithRestrictedCharInAlias() {
+        Response resp = authMgmtResource.createFlow(newFlow("fo]o", "Browser flow", "basic-flow", true, false));
+        Assertions.assertEquals(400, resp.getStatus());
+
+        try {
+            CreatedResponseUtil.getCreatedId(resp);
+            Assertions.fail("Not expected getCreatedId to success");
+        } catch (WebApplicationException wae) {
+            MatcherAssert.assertThat(wae.getMessage(), endsWith("Error: Character ']' not allowed."));
+        }
+    }
+
+    @Test
+    public void testAddRemoveFlow() {
+
+        // test that built-in flow cannot be deleted
+        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation builtInFlow = flows.stream().filter(AuthenticationFlowRepresentation::isBuiltIn).findAny().orElse(null);
+        Assertions.assertNotNull(builtInFlow, "No built in flow in the realm");
+        try {
+            authMgmtResource.deleteFlow(builtInFlow.getId());
+            Assertions.fail("deleteFlow should fail for built in flow");
+        } catch (BadRequestException e) {
+            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+            Assertions.assertEquals("Can't delete built in flow", error.getError());
+        }
+
+        // try create new flow using alias of already existing flow
+        Response response = authMgmtResource.createFlow(newFlow("browser", "Browser flow", "basic-flow", true, false));
+        try {
+            Assertions.assertEquals(409, response.getStatus(), "createFlow using the alias of existing flow should fail");
+        } finally {
+            response.close();
+        }
+
+        // try create flow without alias
+        response = authMgmtResource.createFlow(newFlow(null, "Browser flow", "basic-flow", true, false));
+        try {
+            Assertions.assertEquals(409, response.getStatus(), "createFlow using the alias of existing flow should fail");
+        } finally {
+            response.close();
+        }
+
+
+        // create new flow that should succeed
+        AuthenticationFlowRepresentation newFlow = newFlow("browser-2", "Browser flow", "basic-flow", true, false);
+        createFlow(newFlow, false);
+
+        // check that new flow is returned in a children list
+        flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation found = findFlowByAlias("browser-2", flows);
+
+        Assertions.assertNotNull(found, "created flow visible in parent");
+        compareFlows(newFlow, found);
+
+        // check lookup flow with unexistent ID
+        try {
+            authMgmtResource.getFlow("id-123-notExistent");
+            Assertions.fail("Not expected to find unexistent flow");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // check that new flow is returned individually
+        AuthenticationFlowRepresentation found2 = authMgmtResource.getFlow(found.getId());
+        Assertions.assertNotNull(found2, "created flow visible directly");
+        compareFlows(newFlow, found2);
+
+
+        // add execution flow to some parent flow
+        Map<String, Object> data = new HashMap<>();
+        data.put("alias", "SomeFlow");
+        data.put("type", "basic-flow");
+        data.put("description", "Test flow");
+        // This tests against a regression in KEYCLOAK-16656
+        data.put("provider", "registration-page-form");
+
+        Map<String, Object> data2 = new HashMap<>();
+        data2.put("alias", "SomeFlow2");
+        data2.put("type", "form-flow");
+        data2.put("description", "Test flow 2");
+        data2.put("provider", "registration-page-form");
+
+
+        // inexistent parent flow - should fail
+        try {
+            authMgmtResource.addExecutionFlow("inexistent-parent-flow-alias", data);
+            Assertions.fail("addExecutionFlow for inexistent parent should have failed");
+        } catch (Exception expected) {
+            // Expected
+        }
+
+        // already existent flow - should fail
+        try {
+            data.put("alias", "browser");
+            authMgmtResource.addExecutionFlow("browser-2", data);
+            Assertions.fail("addExecutionFlow should have failed as browser flow already exists");
+        } catch (Exception expected) {
+            // Expected
+        }
+
+        // Successfully add flow
+        data.put("alias", "SomeFlow");
+        authMgmtResource.addExecutionFlow("browser-2", data);
+        authMgmtResource.addExecutionFlow("browser-2", data2);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("browser-2"), data, ResourceType.AUTH_EXECUTION_FLOW);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("browser-2"), data2, ResourceType.AUTH_EXECUTION_FLOW);
+
+        // check that new flow is returned in a children list
+        flows = authMgmtResource.getFlows();
+        found2 = findFlowByAlias("browser-2", flows);
+        Assertions.assertNotNull(found2, "created flow visible in parent");
+
+        List<AuthenticationExecutionExportRepresentation> execs = found2.getAuthenticationExecutions();
+        Assertions.assertNotNull(execs);
+        Assertions.assertEquals(2, execs.size(), "Size two");
+
+        AuthenticationExecutionExportRepresentation expected = new AuthenticationExecutionExportRepresentation();
+        expected.setFlowAlias("SomeFlow");
+        expected.setUserSetupAllowed(false);
+        expected.setAuthenticatorFlow(true);
+        expected.setRequirement("DISABLED");
+        expected.setPriority(0);
+        compareExecution(expected, execs.get(0));
+
+        expected = new AuthenticationExecutionExportRepresentation();
+        expected.setFlowAlias("SomeFlow2");
+        expected.setUserSetupAllowed(false);
+        expected.setAuthenticator("registration-page-form");
+        expected.setAuthenticatorFlow(true);
+        expected.setRequirement("DISABLED");
+        expected.setPriority(1);
+        compareExecution(expected, execs.get(1));
+
+        // delete non-built-in flow
+        authMgmtResource.deleteFlow(found.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authFlowPath(found.getId()), ResourceType.AUTH_FLOW);
+
+        // check the deleted flow is no longer returned
+        flows = authMgmtResource.getFlows();
+        found = findFlowByAlias("browser-2", flows);
+        Assertions.assertNull(found, "flow deleted");
+
+        // Check deleting flow second time will fail
+        try {
+            authMgmtResource.deleteFlow("id-123-notExistent");
+            Assertions.fail("Not expected to delete flow, which doesn't exist");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void testRemoveUsedFlow() {
+        String flowAlias = "test";
+        String flowId = createFlow(newFlow(flowAlias, "Test flow", "generic", true, false));
+
+        Runnable assertRemoveFail = () -> {
+            try {
+                authMgmtResource.deleteFlow(flowId);
+                Assertions.fail("Not expected to delete flow that is in use.");
+            } catch (WebApplicationException e) {
+                OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+                Assertions.assertEquals("For more on this error consult the server log.", error.getErrorDescription());
+            }
+        };
+
+        {
+            // used in realm flow
+            RealmRepresentation realm = realmResource.toRepresentation();
+            BiConsumer<Supplier<String>, Consumer<String>> assertRemoveFailInRealm =
+                    (rollbackFlow, updateFlow) -> {
+                        String rollbackValue = rollbackFlow.get();
+                        try {
+                            updateFlow.accept(flowAlias);
+                            realmResource.update(realm);
+
+                            assertRemoveFail.run();
+                        } finally {
+                            updateFlow.accept(rollbackValue);
+                            realmResource.update(realm);
+                        }
+                    };
+
+            assertRemoveFailInRealm.accept(realm::getBrowserFlow, realm::setBrowserFlow);
+            assertRemoveFailInRealm.accept(realm::getRegistrationFlow, realm::setRegistrationFlow);
+            assertRemoveFailInRealm.accept(realm::getClientAuthenticationFlow, realm::setClientAuthenticationFlow);
+            assertRemoveFailInRealm.accept(realm::getDirectGrantFlow, realm::setDirectGrantFlow);
+            assertRemoveFailInRealm.accept(realm::getResetCredentialsFlow, realm::setResetCredentialsFlow);
+            assertRemoveFailInRealm.accept(realm::getDockerAuthenticationFlow, realm::setDockerAuthenticationFlow);
+            assertRemoveFailInRealm.accept(realm::getFirstBrokerLoginFlow, realm::setFirstBrokerLoginFlow);
+        }
+
+        {
+            // used by client override
+            ClientRepresentation client = realmResource.clients().findByClientId("account").get(0);
+            ClientResource clientResource = realmResource.clients().get(client.getId());
+
+            try {
+                client.setAuthenticationFlowBindingOverrides(
+                        Map.of("browser", flowId)
+                );
+                clientResource.update(client);
+
+                assertRemoveFail.run();
+            } finally {
+                client.setAuthenticationFlowBindingOverrides(
+                        Map.of("browser", "")
+                );
+                clientResource.update(client);
+            }
+        }
+
+        {
+            // used by idp override
+            IdentityProviderRepresentation idp = new IdentityProviderRepresentation();
+            idp.setAlias("idp");
+            idp.setProviderId("oidc");
+
+            Response response = realmResource.identityProviders().create(idp);
+            Assertions.assertNotNull(ApiUtil.getCreatedId(response));
+            response.close();
+            managedRealm.cleanup().add(r -> r.identityProviders().get(idp.getAlias()).remove());
+
+            IdentityProviderResource idpResource = realmResource.identityProviders().get("idp");
+            BiConsumer<Supplier<String>, Consumer<String>> assertRemoveFailByIdp =
+                    (rollbackIdp, updateIdp) -> {
+                        String rollbackValue = rollbackIdp.get();
+                        try {
+                            updateIdp.accept(flowAlias);
+                            idpResource.update(idp);
+
+                            assertRemoveFail.run();
+                        } finally {
+                            updateIdp.accept(rollbackValue);
+                            idpResource.update(idp);
+                        }
+                    };
+
+            assertRemoveFailByIdp.accept(idp::getFirstBrokerLoginFlowAlias, idp::setFirstBrokerLoginFlowAlias);
+            assertRemoveFailByIdp.accept(idp::getPostBrokerLoginFlowAlias, idp::setPostBrokerLoginFlowAlias);
+        }
+    }
+
+    @Test
+    public void testCopyFlow() {
+
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", "clients");
+
+        // copy using existing alias as new name
+        Response response = authMgmtResource.copy("browser", params);
+        try {
+            assertThat("Copy flow using the new alias of existing flow should fail", response, statusCodeIs(Status.CONFLICT));
+            assertThat("Copy flow using the new alias of existing flow should fail", response, body(containsString("already exists")));
+            assertThat("Copy flow using the new alias of existing flow should fail", response, body(containsString("flow alias")));
+        } finally {
+            response.close();
+        }
+
+        // copy non-existing flow
+        params.clear();
+        response = authMgmtResource.copy("non-existent", params);
+        try {
+            assertThat("Copy non-existing flow", response, statusCodeIs(Status.NOT_FOUND));
+        } finally {
+            response.close();
+        }
+
+        // copy that should succeed
+        params.put("newName", "Copy of browser");
+        response = authMgmtResource.copy("browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+        try {
+            assertThat("Copy flow", response, statusCodeIs(Status.CREATED));
+        } finally {
+            response.close();
+        }
+
+        // compare original flow with a copy - fields should be the same except id, alias, and builtIn
+        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation browser = findFlowByAlias("browser", flows);
+        AuthenticationFlowRepresentation copyOfBrowser = findFlowByAlias("Copy of browser", flows);
+
+        Assertions.assertNotNull(browser);
+        Assertions.assertNotNull(copyOfBrowser);
+
+        // adjust expected values before comparing
+        browser.setAlias("Copy of browser");
+        browser.setBuiltIn(false);
+        browser.getAuthenticationExecutions().get(3).setFlowAlias("Copy of browser Organization");
+        browser.getAuthenticationExecutions().get(4).setFlowAlias("Copy of browser forms");
+        compareFlows(browser, copyOfBrowser);
+
+        // get new flow directly and compare
+        copyOfBrowser = authMgmtResource.getFlow(copyOfBrowser.getId());
+        Assertions.assertNotNull(copyOfBrowser);
+        compareFlows(browser, copyOfBrowser);
+        authMgmtResource.deleteFlow(copyOfBrowser.getId());
+    }
+
+    @Test
+    // KEYCLOAK-2580
+    public void addExecutionFlow() {
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", "parent");
+        Response response = authMgmtResource.copy("browser", params);
+        Assertions.assertEquals(201, response.getStatus());
+        response.close();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+
+        params = new HashMap<>();
+        params.put("alias", "child");
+        params.put("description", "Description");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+
+        authMgmtResource.addExecutionFlow("parent", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("parent"), params, ResourceType.AUTH_EXECUTION_FLOW);
+
+        authMgmtResource.deleteFlow(findFlowByAlias("parent", authMgmtResource.getFlows()).getId());
+    }
+
+    @Test
+    //KEYCLOAK-12741
+    //test editing of authentication flows
+    public void editFlowTest() {
+        List<AuthenticationFlowRepresentation> flows;
+
+        //copy an existing one first
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", "Copy of browser");
+        Response response = authMgmtResource.copy("browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+        try {
+            Assertions.assertEquals(201, response.getStatus(), "Copy flow");
+        } finally {
+            response.close();
+        }
+
+        //load the newly copied flow
+        flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation testFlow = findFlowByAlias("Copy of browser", flows);
+        //Set a new unique name. Should succeed
+        testFlow.setAlias("Copy of browser2");
+        authMgmtResource.updateFlow(testFlow.getId(), testFlow);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authEditFlowPath(testFlow.getId()), ResourceType.AUTH_FLOW);
+        flows = authMgmtResource.getFlows();
+        Assertions.assertEquals("Copy of browser2", findFlowByAlias("Copy of browser2", flows).getAlias());
+
+        //Create new flow and edit the old one to have the new ones name
+        AuthenticationFlowRepresentation newFlow = newFlow("New Flow", "Test description", "basic-flow", true, false);
+        createFlow(newFlow);
+        // check that new flow is returned in a children list
+        flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation found = findFlowByAlias("New Flow", flows);
+
+        Assertions.assertNotNull(found, "created flow visible in parent");
+        compareFlows(newFlow, found);
+
+        //try to update old flow with alias that already exists
+        testFlow.setAlias("New Flow");
+        try {
+            authMgmtResource.updateFlow(found.getId(), testFlow);
+        } catch (ClientErrorException exception){
+            //expoected
+        }
+
+        //try to update old flow with an alias with illegal characters
+        testFlow.setAlias("New(Flow");
+        try {
+            authMgmtResource.updateFlow(found.getId(), testFlow);
+        } catch (ClientErrorException exception){
+            //expected
+        }
+
+        flows = authMgmtResource.getFlows();
+
+        //name should be the same for the old Flow
+        Assertions.assertEquals("Copy of browser2", findFlowByAlias("Copy of browser2", flows).getAlias());
+
+        //Only update the description
+        found.setDescription("New description");
+        authMgmtResource.updateFlow(found.getId(), found);
+        flows = authMgmtResource.getFlows();
+
+        Assertions.assertEquals("New description", findFlowByAlias("New Flow", flows).getDescription());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authEditFlowPath(found.getId()), ResourceType.AUTH_FLOW);
+
+        //Update name and description
+        found.setAlias("New Flow2");
+        found.setDescription("New description2");
+        authMgmtResource.updateFlow(found.getId(), found);
+        flows = authMgmtResource.getFlows();
+
+        Assertions.assertEquals("New Flow2", findFlowByAlias("New Flow2", flows).getAlias());
+        Assertions.assertEquals("New description2", findFlowByAlias("New Flow2", flows).getDescription());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authEditFlowPath(found.getId()), ResourceType.AUTH_FLOW);
+        Assertions.assertNull(findFlowByAlias("New Flow", flows));
+
+        authMgmtResource.deleteFlow(testFlow.getId());
+    }
+
+    @Test
+    public void editExecutionFlowTest() {
+        HashMap<String, Object> params = new HashMap<>();
+        List<AuthenticationExecutionInfoRepresentation> executionReps;
+        //create new parent flow
+        AuthenticationFlowRepresentation newFlow = newFlow("Parent-Flow", "This is a parent flow", "basic-flow", true, false);
+        createFlow(newFlow);
+
+        //create a child sub flow
+        params.put("alias", "Child-Flow");
+        params.put("description", "This is a child flow");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+
+        authMgmtResource.addExecutionFlow("Parent-Flow", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
+
+        executionReps = authMgmtResource.getExecutions("Parent-Flow");
+
+        //create another with the same name of the previous one. Should fail to create
+        params = new HashMap<>();
+        params.put("alias", "Child-Flow");
+        params.put("description", "This is another child flow");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+
+        try {
+            authMgmtResource.addExecutionFlow("Parent-Flow", params);
+            Assertions.fail("addExecutionFlow the alias already exist");
+        } catch (Exception expected) {
+            // Expected
+        }
+
+        AuthenticationExecutionInfoRepresentation found = executionReps.get(0);
+        found.setDisplayName("Parent-Flow");
+
+        try {
+            authMgmtResource.updateExecutions("Parent-Flow", found);
+        } catch (ClientErrorException exception){
+            //expected
+        }
+
+        //edit both name and description
+        found.setDisplayName("Child-Flow2");
+        found.setDescription("This is another child flow2");
+
+        authMgmtResource.updateExecutions("Parent-Flow", found);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("Parent-Flow"), ResourceType.AUTH_EXECUTION);
+        executionReps = authMgmtResource.getExecutions("Parent-Flow");
+        Assertions.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
+        Assertions.assertEquals("This is another child flow2", executionReps.get(0).getDescription());
+
+        //edit only description
+        found.setDescription("This is another child flow3");
+        authMgmtResource.updateExecutions("Parent-Flow", found);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("Parent-Flow"), ResourceType.AUTH_EXECUTION);
+        executionReps = authMgmtResource.getExecutions("Parent-Flow");
+        Assertions.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
+        Assertions.assertEquals("This is another child flow3", executionReps.get(0).getDescription());
+    }
+
+    @Test
+    public void prioritySetTest() {
+        //create new parent flow
+        AuthenticationFlowRepresentation newFlow = newFlow("Parent-Flow", "This is a parent flow", "basic-flow", true, false);
+        createFlow(newFlow);
+
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("alias", "Child-Flow1");
+        params.put("description", "This is a child flow");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+        params.put("priority", 50);
+
+        authMgmtResource.addExecutionFlow("Parent-Flow", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
+
+        params.clear();
+        params.put("alias", "Child-Flow2");
+        params.put("description", "This is a second child flow");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+        params.put("priority", 10);
+
+        authMgmtResource.addExecutionFlow("Parent-Flow", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
+
+        params.clear();
+        params.put("alias", "Child-Flow3");
+        params.put("description", "This is a third child flow");
+        params.put("provider", "registration-page-form");
+        params.put("type", "basic-flow");
+        params.put("priority", 20);
+
+        authMgmtResource.addExecutionFlow("Parent-Flow", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
+
+        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("Parent-Flow");
+        // Verify the initial order and priority value
+        Assertions.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
+        Assertions.assertEquals(10, executionReps.get(0).getPriority());
+        Assertions.assertEquals("Child-Flow3", executionReps.get(1).getDisplayName());
+        Assertions.assertEquals(20, executionReps.get(1).getPriority());
+        Assertions.assertEquals("Child-Flow1", executionReps.get(2).getDisplayName());
+        Assertions.assertEquals(50, executionReps.get(2).getPriority());
+
+        // Move last execution to the beginning
+        AuthenticationExecutionInfoRepresentation lastToFirst = executionReps.get(2);
+        lastToFirst.setPriority(5);
+        authMgmtResource.updateExecutions("Parent-Flow", lastToFirst);
+        executionReps = authMgmtResource.getExecutions("Parent-Flow");
+
+        // Verify new order and priority
+        Assertions.assertEquals("Child-Flow1", executionReps.get(0).getDisplayName());
+        Assertions.assertEquals(5, executionReps.get(0).getPriority());
+        Assertions.assertEquals("Child-Flow2", executionReps.get(1).getDisplayName());
+        Assertions.assertEquals(10, executionReps.get(1).getPriority());
+        Assertions.assertEquals("Child-Flow3", executionReps.get(2).getDisplayName());
+        Assertions.assertEquals(20, executionReps.get(2).getPriority());
+    }
+
+    @Test
+    public void failWithLongDescription() throws IOException {
+        AuthenticationFlowRepresentation rep = authMgmtResource.getFlows().stream()
+                .filter(rep1 -> "docker auth".equals(rep1.getAlias())).findAny().orElse(null);
+
+        assertNotNull(rep);
+
+        StringBuilder name = new StringBuilder();
+
+        while (name.length() < 300) {
+            name.append("invalid");
+        }
+
+        rep.setDescription(name.toString());
+
+        try {
+            authMgmtResource.updateFlow(rep.getId(), rep);
+            fail("Should fail because the description is too long");
+        } catch (InternalServerErrorException isee) {
+            try (Response response = isee.getResponse()) {
+                assertEquals(500, response.getStatus());
+                assertFalse(StreamUtil.readString((InputStream) response.getEntity(), StandardCharsets.UTF_8).toLowerCase().contains("exception"));
+            }
+        } catch (Exception e) {
+            fail("Unexpected exception");
+        }
+    }
+
+    @Test
+    public void testAddRemoveExecutionsFailInBuiltinFlow() throws IOException {
+        // get a built in flow
+        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
+        AuthenticationFlowRepresentation flow = flows.stream().filter(AuthenticationFlowRepresentation::isBuiltIn).findFirst().orElse(null);
+        Assertions.assertNotNull(flow, "There is no builtin flow");
+
+        // adding an execution should fail
+        Map<String, Object> data = new HashMap<>();
+        data.put("provider", "allow-access-authenticator");
+        BadRequestException e = Assertions.assertThrows(BadRequestException.class, () -> authMgmtResource.addExecution(flow.getAlias(), data));
+        OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+        Assertions.assertEquals("It is illegal to add execution to a built in flow", error.getError());
+
+        // adding a sub-flow should fail as well
+        e = Assertions.assertThrows(BadRequestException.class, () -> addFlowToParent(flow.getAlias(), "child"));
+        error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+        Assertions.assertEquals("It is illegal to add sub-flow to a built in flow", error.getError());
+
+        // removing any execution (execution or flow) should fail too
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions(flow.getAlias());
+        Assertions.assertNotNull(executions, "The builtin flow has no executions");
+        Assertions.assertFalse(executions.isEmpty(), "The builtin flow has no executions");
+        e = Assertions.assertThrows(BadRequestException.class, () -> authMgmtResource.removeExecution(executions.get(0).getId()));
+        error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
+        Assertions.assertEquals("It is illegal to remove execution from a built in flow", error.getError());
+    }
+
+    @Test
+    public void testExecutionConfigDuplicated() {
+        AuthenticationFlowRepresentation existingFlow = null;
+
+        for (AuthenticationFlowRepresentation flow : authMgmtResource.getFlows()) {
+            if (flow.getAlias().equals(DefaultAuthenticationFlows.BROWSER_FLOW)) {
+                existingFlow = flow;
+            }
+        }
+
+        Assertions.assertNotNull(existingFlow);
+
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions(existingFlow.getAlias());
+        AuthenticationExecutionInfoRepresentation executionWithConfig = null;
+
+        for (AuthenticationExecutionInfoRepresentation execution : executions) {
+            if (IdentityProviderAuthenticatorFactory.PROVIDER_ID.equals(execution.getProviderId())) {
+                executionWithConfig = execution;
+            }
+        }
+
+        Assertions.assertNotNull(executionWithConfig);
+
+        AuthenticatorConfigRepresentation executionConfig = new AuthenticatorConfigRepresentation();
+
+        executionConfig.setAlias("test-execution-config");
+        executionConfig.setConfig(Map.of("key", "value"));
+
+        try (Response response = authMgmtResource.newExecutionConfig(executionWithConfig.getId(), executionConfig)) {
+            managedRealm.cleanup().add(r -> r.flows().removeAuthenticatorConfig(ApiUtil.getCreatedId(response)));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionConfigPath(executionWithConfig.getId()), executionConfig, ResourceType.AUTHENTICATOR_CONFIG);
+        }
+
+        String newFlowName = "Duplicated of " + DefaultAuthenticationFlows.BROWSER_FLOW;
+        Map<String, Object> copyFlowParams = Map.of("newName", newFlowName);
+        authMgmtResource.copy(existingFlow.getAlias(), copyFlowParams).close();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), copyFlowParams, ResourceType.AUTH_FLOW);
+
+        AuthenticationFlowRepresentation newFlow = null;
+
+        for (AuthenticationFlowRepresentation flow : authMgmtResource.getFlows()) {
+            if (flow.getAlias().equals(newFlowName)) {
+                newFlow = flow;
+            }
+        }
+
+        Set<String> existingExecutionConfigIds = authMgmtResource.getExecutions(existingFlow.getAlias())
+                .stream().map(AuthenticationExecutionInfoRepresentation::getAuthenticationConfig)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+
+        assertFalse(existingExecutionConfigIds.isEmpty());
+
+        Set<String> newExecutionConfigIds = authMgmtResource.getExecutions(newFlow.getAlias())
+                .stream().map(AuthenticationExecutionInfoRepresentation::getAuthenticationConfig)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+
+        assertFalse(newExecutionConfigIds.isEmpty());
+
+        for (String executionConfigId : newExecutionConfigIds) {
+            Assertions.assertFalse(existingExecutionConfigIds.contains(executionConfigId), "Execution config not duplicated");
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/InitialFlowsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/InitialFlowsTest.java
similarity index 91%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/InitialFlowsTest.java
rename to tests/base/src/test/java/org/keycloak/tests/admin/authentication/InitialFlowsTest.java
index 2efa479674d7..fe57e99e1797 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/InitialFlowsTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/InitialFlowsTest.java
@@ -15,15 +15,16 @@
  * limitations under the License.
  */
 
-package org.keycloak.testsuite.admin.authentication;
+package org.keycloak.tests.admin.authentication;
 
-import org.junit.Assert;
-import org.junit.Test;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
 import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
 import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
 import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.util.KerberosUtils;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.utils.KerberosUtils;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -35,6 +36,7 @@
 /**
  * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
  */
+@KeycloakIntegrationTest
 public class InitialFlowsTest extends AbstractAuthenticationTest {
 
     private HashMap<String, AuthenticatorConfigRepresentation> configs = new HashMap<>();
@@ -85,7 +87,7 @@ private void compare(List<FlowExecutions> expected, List<FlowExecutions> actual)
 
 
     private void compareExecutionsInfo(List<AuthenticationExecutionInfoRepresentation> expected, List<AuthenticationExecutionInfoRepresentation> actual) {
-        Assert.assertEquals("Executions count", expected.size(), actual.size());
+        Assertions.assertEquals(expected.size(), actual.size(), "Executions count");
         Iterator<AuthenticationExecutionInfoRepresentation> it1 = expected.iterator();
         Iterator<AuthenticationExecutionInfoRepresentation> it2 = actual.iterator();
         while (it1.hasNext()) {
@@ -108,8 +110,8 @@ private void compareAuthConfig(AuthenticationExecutionInfoRepresentation expecte
         if (cfg1 == null && cfg2 == null) {
             return;
         }
-        Assert.assertEquals("Execution configuration alias", cfg1.getAlias(), cfg2.getAlias());
-        Assert.assertEquals("Execution configuration params", cfg1.getConfig(), cfg2.getConfig());
+        Assertions.assertEquals(cfg1.getAlias(), cfg2.getAlias(), "Execution configuration alias");
+        Assertions.assertEquals(cfg1.getConfig(), cfg2.getConfig(), "Execution configuration params");
     }
 
     private List<FlowExecutions> orderAlphabetically(List<FlowExecutions> result) {
@@ -139,9 +141,11 @@ private LinkedList<FlowExecutions> expectedFlows() {
         addExecInfo(execs, "Organization Identity-First Login", "organization", true, 2, 1, ALTERNATIVE, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
         addExecInfo(execs, "forms", null, false, 0, 4, ALTERNATIVE, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 30);
         addExecInfo(execs, "Username Password Form", "auth-username-password-form", false, 1, 0, REQUIRED, null, new String[]{REQUIRED}, 10);
-        addExecInfo(execs, "Browser - Conditional OTP", null, false, 1, 1, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 20);
+        addExecInfo(execs, "Browser - Conditional 2FA", null, false, 1, 1, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 20);
         addExecInfo(execs, "Condition - user configured", "conditional-user-configured", false, 2, 0, REQUIRED, null, new String[]{REQUIRED, DISABLED}, 10);
-        addExecInfo(execs, "OTP Form", "auth-otp-form", false, 2, 1, REQUIRED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
+        addExecInfo(execs, "OTP Form", "auth-otp-form", false, 2, 1, ALTERNATIVE, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
+        addExecInfo(execs, "WebAuthn Authenticator", "webauthn-authenticator", false, 2, 2, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 30);
+        addExecInfo(execs, "Recovery Authentication Code Form", "auth-recovery-authn-code-form", false, 2, 3, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 40);
         expected.add(new FlowExecutions(flow, execs));
 
         flow = newFlow("clients", "Base authentication for clients", "client-flow", true, true);
@@ -193,9 +197,11 @@ private LinkedList<FlowExecutions> expectedFlows() {
         addExecInfo(execs, "Verify existing account by Email", "idp-email-verification", false, 3, 0, ALTERNATIVE, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 10);
         addExecInfo(execs, "Verify Existing Account by Re-authentication", null, false, 3, 1, ALTERNATIVE, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 20);
         addExecInfo(execs, "Username Password Form for identity provider reauthentication", "idp-username-password-form", false, 4, 0, REQUIRED, null, new String[]{REQUIRED}, 10);
-        addExecInfo(execs, "First broker login - Conditional OTP", null, false, 4, 1, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 20);
+        addExecInfo(execs, "First broker login - Conditional 2FA", null, false, 4, 1, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 20);
         addExecInfo(execs, "Condition - user configured", "conditional-user-configured", false, 5, 0, REQUIRED, null, new String[]{REQUIRED, DISABLED}, 10);
-        addExecInfo(execs, "OTP Form", "auth-otp-form", false, 5, 1, REQUIRED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
+        addExecInfo(execs, "OTP Form", "auth-otp-form", false, 5, 1, ALTERNATIVE, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
+        addExecInfo(execs, "WebAuthn Authenticator", "webauthn-authenticator", false, 5, 2, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 30);
+        addExecInfo(execs, "Recovery Authentication Code Form", "auth-recovery-authn-code-form", false, 5, 3, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 40);
         addExecInfo(execs, "First Broker Login - Conditional Organization", null, false, 0, 2, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 50);
         addExecInfo(execs, "Condition - user configured", "conditional-user-configured", false, 1, 0, REQUIRED, null, new String[]{REQUIRED, DISABLED}, 10);
         addExecInfo(execs, "Organization Member Onboard", "idp-add-organization-member", false, 1, 1, REQUIRED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 20);
@@ -220,7 +226,7 @@ private LinkedList<FlowExecutions> expectedFlows() {
 
         execs = new LinkedList<>();
         addExecInfo(execs, "Choose User", "reset-credentials-choose-user", false, 0, 0, REQUIRED, null, new String[]{REQUIRED}, 10);
-        addExecInfo(execs, "Send Reset Email", "reset-credential-email", false, 0, 1, REQUIRED, null, new String[]{REQUIRED}, 20);
+        addExecInfo(execs, "Send Reset Email", "reset-credential-email", true, 0, 1, REQUIRED, null, new String[]{REQUIRED}, 20);
         addExecInfo(execs, "Reset Password", "reset-password", false, 0, 2, REQUIRED, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 30);
         addExecInfo(execs, "Reset - Conditional OTP", null, false, 0, 3, CONDITIONAL, true, new String[]{REQUIRED, ALTERNATIVE, DISABLED, CONDITIONAL}, 40);
         addExecInfo(execs, "Condition - user configured", "conditional-user-configured", false, 1, 0, REQUIRED, null, new String[]{REQUIRED, DISABLED}, 10);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ProvidersTest.java
similarity index 76%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java
rename to tests/base/src/test/java/org/keycloak/tests/admin/authentication/ProvidersTest.java
index 44a86e667941..a877fe593609 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ProvidersTest.java
@@ -15,20 +15,20 @@
  * limitations under the License.
  */
 
-package org.keycloak.testsuite.admin.authentication;
+package org.keycloak.tests.admin.authentication;
 
-import org.junit.Test;
+import jakarta.ws.rs.NotFoundException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Assertions;
 import org.keycloak.authentication.authenticators.broker.IdpCreateUserIfUniqueAuthenticatorFactory;
 import org.keycloak.authentication.forms.RegistrationRecaptcha;
 import org.keycloak.authentication.forms.RegistrationRecaptchaEnterprise;
-import org.keycloak.common.Profile;
 import org.keycloak.representations.idm.AuthenticatorConfigInfoRepresentation;
 import org.keycloak.representations.idm.ConfigPropertyRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.util.KerberosUtils;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.KerberosUtils;
 
-import jakarta.ws.rs.NotFoundException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Comparator;
@@ -37,25 +37,26 @@
 import java.util.List;
 import java.util.Map;
 
-import static org.hamcrest.Matchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
 
 /**
  * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
  */
+@KeycloakIntegrationTest
 public class ProvidersTest extends AbstractAuthenticationTest {
 
     @Test
     public void testFormProviders() {
         List<Map<String, Object>> result = authMgmtResource.getFormProviders();
 
-        Assert.assertNotNull("null result", result);
-        Assert.assertEquals("size", 1, result.size());
+        Assertions.assertNotNull(result, "null result");
+        Assertions.assertEquals(1, result.size(), "size");
         Map<String, Object> item = result.get(0);
 
-        Assert.assertEquals("id", "registration-page-form", item.get("id"));
-        Assert.assertEquals("displayName", "Registration Page", item.get("displayName"));
-        Assert.assertEquals("description", "This is the controller for the registration page", item.get("description"));
+        Assertions.assertEquals("registration-page-form", item.get("id"), "id");
+        Assertions.assertEquals("Registration Page", item.get("displayName"), "displayName");
+        Assertions.assertEquals("This is the controller for the registration page", item.get("description"), "description");
     }
 
     @Test
@@ -85,12 +86,6 @@ public void testClientAuthenticatorProviders() {
                 "Validates client based on signed JWT issued by client and signed with the Client private key", false);
         addClientAuthenticatorProviderInfo(expected, "client-secret", "Client Id and Secret", "Validates client based on 'client_id' and " +
                 "'client_secret' sent either in request parameters or in 'Authorization: Basic' header", true);
-        addClientAuthenticatorProviderInfo(expected, "testsuite-client-id-required", "Signed Jwt", "Validates client based on signed JWT issued by client " +
-                "and signed with the Client private key", false);
-        addClientAuthenticatorProviderInfo(expected, "testsuite-client-passthrough", "Testsuite Dummy Client Validation", "Testsuite dummy authenticator, " +
-                "which automatically authenticates hardcoded client (like 'test-app' )", false);
-        addClientAuthenticatorProviderInfo(expected, "testsuite-client-dummy", "Testsuite ClientId Dummy",
-                "Dummy client authenticator, which authenticates the client with clientId only", false);
         addClientAuthenticatorProviderInfo(expected, "client-x509", "X509 Certificate",
                 "Validates client based on a X509 Certificate", false);
         addClientAuthenticatorProviderInfo(expected, "client-secret-jwt", "Signed Jwt with Client Secret",
@@ -102,16 +97,10 @@ public void testClientAuthenticatorProviders() {
     @Test
     public void testPerClientConfigDescriptions() {
         Map<String, List<ConfigPropertyRepresentation>> configs = authMgmtResource.getPerClientConfigDescription();
-        Assert.assertTrue(configs.containsKey("client-jwt"));
-        Assert.assertTrue(configs.containsKey("client-secret"));
-        Assert.assertTrue(configs.containsKey("testsuite-client-passthrough"));
-        Assert.assertTrue(configs.get("client-jwt").isEmpty());
-        Assert.assertTrue(configs.get("client-secret").isEmpty());
-        List<ConfigPropertyRepresentation> cfg = configs.get("testsuite-client-passthrough");
-        Assert.assertProviderConfigProperty(cfg.get(0), "passthroughauth.foo", "Foo Property", null,
-                "Foo Property of this authenticator, which does nothing", "String");
-        Assert.assertProviderConfigProperty(cfg.get(1), "passthroughauth.bar", "Bar Property", null,
-                "Bar Property of this authenticator, which does nothing", "boolean");
+        Assertions.assertTrue(configs.containsKey("client-jwt"));
+        Assertions.assertTrue(configs.containsKey("client-secret"));
+        Assertions.assertTrue(configs.get("client-jwt").isEmpty());
+        Assertions.assertTrue(configs.get("client-secret").isEmpty());
     }
 
     @Test
@@ -119,16 +108,16 @@ public void testAuthenticatorConfigDescription() {
         // Try some not-existent provider
         try {
             authMgmtResource.getAuthenticatorConfigDescription("not-existent");
-            Assert.fail("Don't expected to find provider 'not-existent'");
+            Assertions.fail("Don't expected to find provider 'not-existent'");
         } catch (NotFoundException nfe) {
             // Expected
         }
 
         AuthenticatorConfigInfoRepresentation infoRep = authMgmtResource.getAuthenticatorConfigDescription(IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID);
-        Assert.assertEquals("Create User If Unique", infoRep.getName());
-        Assert.assertEquals(IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, infoRep.getProviderId());
-        Assert.assertEquals("Detect if there is existing Keycloak account with same email like identity provider. If no, create new user", infoRep.getHelpText());
-        Assert.assertEquals(1, infoRep.getProperties().size());
+        Assertions.assertEquals("Create User If Unique", infoRep.getName());
+        Assertions.assertEquals(IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, infoRep.getProviderId());
+        Assertions.assertEquals("Detect if there is existing Keycloak account with same email like identity provider. If no, create new user", infoRep.getHelpText());
+        Assertions.assertEquals(1, infoRep.getProperties().size());
         Assert.assertProviderConfigProperty(infoRep.getProperties().get(0), "require.password.update.after.registration", "Require Password Update After Registration",
                 null, "If this option is true and new user is successfully imported from Identity Provider to Keycloak (there is no duplicated email or username detected in Keycloak DB), then this user is required to update his password",
                 "boolean");
@@ -147,9 +136,6 @@ private List<Map<String, Object>> expectedAuthProviders() {
                 "Validates a OTP on a separate OTP form. Only shown if required based on the configured conditions.");
         addProviderInfo(result, "auth-cookie", "Cookie", "Validates the SSO cookie set by the auth server.");
         addProviderInfo(result, "auth-otp-form", "OTP Form", "Validates a OTP on a separate OTP form.");
-        if (ProfileAssume.isFeatureEnabled(Profile.Feature.SCRIPTS)) {
-            addProviderInfo(result, "auth-script-based", "Script", "Script based authentication. Allows to define custom authentication logic via JavaScript.");
-        }
         String kerberosHelpMessage = (KerberosUtils.isKerberosSupportExpected())
                 ? "Initiates the SPNEGO protocol.  Most often used with Kerberos."
                 : "DISABLED. Please enable Kerberos feature and make sure Kerberos available in your platform. Initiates the SPNEGO protocol. Most often used with Kerberos.";
@@ -166,8 +152,6 @@ private List<Map<String, Object>> expectedAuthProviders() {
         addProviderInfo(result, "direct-grant-validate-username", "Username Validation",
                 "Validates the username supplied as a 'username' form parameter in direct grant request");
         addProviderInfo(result, "docker-http-basic-authenticator", "Docker Authenticator", "Uses HTTP Basic authentication to validate docker users, returning a docker error token on auth failure");
-        addProviderInfo(result, "expected-param-authenticator", "TEST: Expected Parameter",
-                "You will be approved if you send query string parameter 'foo' with expected value.");
         addProviderInfo(result, "http-basic-authenticator", "HTTP Basic Authentication", "Validates username and password from Authorization HTTP header");
         addProviderInfo(result, "identity-provider-redirector", "Identity Provider Redirector", "Redirects to default Identity Provider or Identity Provider specified with kc_idp_hint query parameter");
         addProviderInfo(result, "idp-auto-link", "Automatically set existing user", "Automatically set existing user to authentication context without any verification");
@@ -182,26 +166,14 @@ private List<Map<String, Object>> expectedAuthProviders() {
                 "User reviews and updates profile data retrieved from Identity Provider in the displayed form");
         addProviderInfo(result, "idp-username-password-form", "Username Password Form for identity provider reauthentication",
                 "Validates a password from login form. Username may be already known from identity provider authentication");
-        addProviderInfo(result, "push-button-authenticator", "TEST: Button Login",
-                "Just press the button to login.");
         addProviderInfo(result, "reset-credential-email", "Send Reset Email", "Send email to user and wait for response.");
         addProviderInfo(result, "reset-credentials-choose-user", "Choose User", "Choose a user to reset credentials for");
         addProviderInfo(result, "reset-otp", "Reset OTP", "Removes existing OTP configurations (if chosen) and sets the 'Configure OTP' required action.");
         addProviderInfo(result, "reset-password", "Reset Password", "Sets the Update Password required action if execution is REQUIRED.  " +
                 "Will also set it if execution is OPTIONAL and the password is currently configured for it.");
-        addProviderInfo(result, "testsuite-dummy-click-through", "Testsuite Dummy Click Thru",
-                "Testsuite Dummy authenticator.  User needs to click through the page to continue.");
-        addProviderInfo(result, "testsuite-dummy-passthrough", "Testsuite Dummy Pass Thru",
-                "Testsuite Dummy authenticator.  Just passes through and is hardcoded to a specific user");
-        addProviderInfo(result, "testsuite-dummy-registration", "Testsuite Dummy Pass Thru",
-                "Testsuite Dummy authenticator.  Just passes through and is hardcoded to a specific user");
-        addProviderInfo(result, "set-client-note-authenticator", "Set Client Note Authenticator", "Set client note of specified name with the specified value to the authenticationSession.");
-        addProviderInfo(result, "testsuite-username", "Testsuite Username Only",
-                "Testsuite Username authenticator.  Username parameter sets username");
-        addProviderInfo(result, "test-suite-fire-error-event", "Fire Error Event",
-                "Testsuite Error event firer authenticator.");
         addProviderInfo(result, "webauthn-authenticator", "WebAuthn Authenticator", "Authenticator for WebAuthn. Usually used for WebAuthn two-factor authentication");
         addProviderInfo(result, "webauthn-authenticator-passwordless", "WebAuthn Passwordless Authenticator", "Authenticator for Passwordless WebAuthn authentication");
+        addProviderInfo(result, "auth-recovery-authn-code-form", "Recovery Authentication Code Form", "Validates a Recovery Authentication Code");
 
         addProviderInfo(result, "auth-username-form", "Username Form",
                 "Selects a user from his username.");
@@ -213,8 +185,6 @@ private List<Map<String, Object>> expectedAuthProviders() {
                 "Executes the current flow only if authenticators are configured");
         addProviderInfo(result, "conditional-user-attribute", "Condition - user attribute",
                 "Flow is executed only if the user attribute exists and has the expected value");
-        addProviderInfo(result, "set-attribute", "Set user attribute",
-                "Set a user attribute");
         addProviderInfo(result, "idp-detect-existing-broker-user", "Detect existing broker user",
                 "Detect if there is an existing Keycloak account with same email like identity provider. If no, throw an error.");
 
@@ -229,9 +199,6 @@ private List<Map<String, Object>> expectedAuthProviders() {
         addProviderInfo(result, "user-session-limits", "User session count limiter",
                 "Configures how many concurrent sessions a single user is allowed to create for this realm and/or client");
 
-        addProviderInfo(result, "custom-callback-authenticator", "Custom callback Factory",
-                "Used for testing purposes of Callback factory");
-
         addProviderInfo(result, "idp-add-organization-member", "Organization Member Onboard", "Adds a federated user as a member of an organization");
         addProviderInfo(result, "organization", "Organization Identity-First Login", "If organizations are enabled, automatically redirects users to the corresponding identity provider.");
         addProviderInfo(result, "conditional-sub-flow-executed", "Condition - sub-flow executed", "Condition to evaluate if a sub-flow was executed successfully during the authentication process");
@@ -247,7 +214,7 @@ private List<Map<String, Object>> sortProviders(List<Map<String, Object>> provid
     }
 
     private void compareProviders(List<Map<String, Object>> expected, List<Map<String, Object>> actual) {
-        Assert.assertEquals("Providers count", expected.size(), actual.size());
+        Assertions.assertEquals(expected.size(), actual.size(), "Providers count");
         // compare ignoring list and map impl types
         assertThat(normalizeResults(actual), is(normalizeResults(expected)));
     }
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RegistrationFlowTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RegistrationFlowTest.java
new file mode 100644
index 000000000000..ca509fa52671
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RegistrationFlowTest.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.BadRequestException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class RegistrationFlowTest extends AbstractAuthenticationTest {
+
+    @Test
+    public void testAddExecution() {
+        // Add registration flow 2
+        AuthenticationFlowRepresentation flowRep = newFlow("registration2", "RegistrationFlow2", "basic-flow", true, false);
+        createFlow(flowRep);
+
+        // add registration execution form flow
+        Map<String, Object> data = new HashMap<>();
+        data.put("alias", "registrationForm2");
+        data.put("type", "form-flow");
+        data.put("description", "registrationForm2 flow");
+        data.put("provider", "registration-page-form");
+        authMgmtResource.addExecutionFlow("registration2", data);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("registration2"), data, ResourceType.AUTH_EXECUTION_FLOW);
+
+        // Should fail to add execution under top level flow
+        Map<String, Object> data2 = new HashMap<>();
+        data2.put("provider", "registration-password-action");
+        try {
+            authMgmtResource.addExecution("registration2", data2);
+            Assertions.fail("Not expected to add execution of type 'registration-password-action' under top flow");
+        } catch (BadRequestException bre) {
+        }
+
+        // Should success to add execution under form flow
+        authMgmtResource.addExecution("registrationForm2", data2);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authAddExecutionPath("registrationForm2"), data2, ResourceType.AUTH_EXECUTION);
+    }
+
+    // TODO: More type-safety instead of passing generic maps
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RequiredActionsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RequiredActionsTest.java
new file mode 100644
index 000000000000..92e5162f12df
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/RequiredActionsTest.java
@@ -0,0 +1,308 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.RequiredActionConfigInfoRepresentation;
+import org.keycloak.representations.idm.RequiredActionConfigRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.testsuite.actions.DummyConfigurableRequiredActionFactory;
+import org.keycloak.testsuite.actions.DummyRequiredActionFactory;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.NotFoundException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest(config = RequiredActionsTest.CustomProvidersServerConfig.class)
+public class RequiredActionsTest extends AbstractAuthenticationTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @Test
+    public void testRequiredActions() {
+        List<RequiredActionProviderRepresentation> result = authMgmtResource.getRequiredActions();
+
+        List<RequiredActionProviderRepresentation> expected = new ArrayList<>();
+        addRequiredAction(expected, "CONFIGURE_RECOVERY_AUTHN_CODES", "Recovery Authentication Codes", true, false, null);
+        addRequiredAction(expected, "CONFIGURE_TOTP", "Configure OTP", true, false, null);
+        addRequiredAction(expected, "TERMS_AND_CONDITIONS", "Terms and Conditions", false, false, null);
+        addRequiredAction(expected, "UPDATE_EMAIL", "Update Email", false, false, null);
+        addRequiredAction(expected, "UPDATE_PASSWORD", "Update Password", true, false, null);
+        addRequiredAction(expected, "UPDATE_PROFILE", "Update Profile", true, false, null);
+        addRequiredAction(expected, "VERIFY_EMAIL", "Verify Email", true, false, null);
+        addRequiredAction(expected, "VERIFY_PROFILE", "Verify Profile", true, false, null);
+        addRequiredAction(expected, "delete_account", "Delete Account", false, false, null);
+        addRequiredAction(expected, "delete_credential", "Delete Credential", true, false, null);
+        addRequiredAction(expected, "idp_link", "Linking Identity Provider", true, false, null);
+        addRequiredAction(expected, "update_user_locale", "Update User Locale", true, false, null);
+        addRequiredAction(expected, "webauthn-register", "Webauthn Register", true, false, null);
+        addRequiredAction(expected, "webauthn-register-passwordless", "Webauthn Register Passwordless", true, false, null);
+
+        compareRequiredActions(expected, sort(result));
+
+        RequiredActionProviderRepresentation forUpdate = newRequiredAction("VERIFY_EMAIL", "Verify Email", false, false, null);
+        authMgmtResource.updateRequiredAction(forUpdate.getAlias(), forUpdate);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(forUpdate.getAlias()), ResourceType.REQUIRED_ACTION);
+
+        result = authMgmtResource.getRequiredActions();
+        RequiredActionProviderRepresentation updated = findRequiredActionByAlias(forUpdate.getAlias(), result);
+
+        Assertions.assertNotNull(updated, "Required Action still there");
+        compareRequiredAction(forUpdate, updated);
+
+        forUpdate.setConfig(Collections.<String, String>emptyMap());
+        authMgmtResource.updateRequiredAction(forUpdate.getAlias(), forUpdate);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(forUpdate.getAlias()), ResourceType.REQUIRED_ACTION);
+
+        result = authMgmtResource.getRequiredActions();
+        updated = findRequiredActionByAlias(forUpdate.getAlias(), result);
+
+        Assertions.assertNotNull(updated, "Required Action still there");
+        compareRequiredAction(forUpdate, updated);
+    }
+
+    @Test
+    public void testCRUDRequiredAction() {
+        int lastPriority = authMgmtResource.getRequiredActions().get(authMgmtResource.getRequiredActions().size() - 1).getPriority();
+
+        // Dummy RequiredAction is not registered in the realm and WebAuthn actions
+        List<RequiredActionProviderSimpleRepresentation> result = authMgmtResource.getUnregisteredRequiredActions();
+        Assertions.assertEquals(2, result.size());
+        RequiredActionProviderSimpleRepresentation action = result.stream().filter(
+                a -> a.getProviderId().equals(DummyRequiredActionFactory.PROVIDER_ID)
+        ).findFirst().get();
+        Assertions.assertEquals(DummyRequiredActionFactory.PROVIDER_ID, action.getProviderId());
+        Assertions.assertEquals("Dummy Action", action.getName());
+
+        // Register it
+        authMgmtResource.registerRequiredAction(action);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authMgmtBasePath() + "/register-required-action", action, ResourceType.REQUIRED_ACTION);
+
+        // Try to register 2nd time
+        try {
+            authMgmtResource.registerRequiredAction(action);
+        } catch (ClientErrorException ex) {
+            // Expected
+        }
+
+        // Try to register required action with fake providerId
+        RequiredActionProviderSimpleRepresentation requiredAction = new RequiredActionProviderSimpleRepresentation();
+        requiredAction.setName("not-existent");
+        requiredAction.setProviderId("not-existent");
+        try {
+            authMgmtResource.registerRequiredAction(requiredAction);
+            Assertions.fail("Didn't expect to register requiredAction with providerId: 'not-existent'");
+        } catch (Exception ex) {
+            // Expected
+        }
+
+        // Try to find not-existent action - should fail
+        try {
+            authMgmtResource.getRequiredAction("not-existent");
+            Assertions.fail("Didn't expect to find requiredAction of alias 'not-existent'");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Find existent
+        RequiredActionProviderRepresentation rep = authMgmtResource.getRequiredAction(DummyRequiredActionFactory.PROVIDER_ID);
+        compareRequiredAction(rep, newRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, "Dummy Action",
+                true, false, Collections.<String, String>emptyMap()));
+
+        // Confirm the registered priority - should be N + 1
+        Assertions.assertEquals(lastPriority + 1, rep.getPriority());
+
+        // Update not-existent - should fail
+        try {
+            authMgmtResource.updateRequiredAction("not-existent", rep);
+            Assertions.fail("Not expected to update not-existent requiredAction");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Update (set it as defaultAction)
+        rep.setDefaultAction(true);
+        authMgmtResource.updateRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), rep, ResourceType.REQUIRED_ACTION);
+        compareRequiredAction(rep, newRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, "Dummy Action",
+                true, true, Collections.<String, String>emptyMap()));
+
+        // Remove unexistent - should fail
+        try {
+            authMgmtResource.removeRequiredAction("not-existent");
+            Assertions.fail("Not expected to remove not-existent requiredAction");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // Remove success
+        authMgmtResource.removeRequiredAction(DummyRequiredActionFactory.PROVIDER_ID);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), ResourceType.REQUIRED_ACTION);
+
+    }
+
+    @Test
+    public void testConfigurableRequiredActionMetadata() {
+
+        String providerId = DummyConfigurableRequiredActionFactory.PROVIDER_ID;
+
+        // query configurable properties
+        RequiredActionConfigInfoRepresentation requiredActionConfigDescription = authMgmtResource.getRequiredActionConfigDescription(providerId);
+        Assertions.assertNotNull(requiredActionConfigDescription);
+        Assertions.assertNotNull(requiredActionConfigDescription.getProperties());
+        Assertions.assertEquals(3, requiredActionConfigDescription.getProperties().size());
+    }
+
+    @Test
+    public void testCRUDConfigurableRequiredAction() {
+        int lastPriority = authMgmtResource.getRequiredActions().get(authMgmtResource.getRequiredActions().size() - 1).getPriority();
+
+        // Dummy RequiredAction is not registered in the realm and WebAuthn actions
+        List<RequiredActionProviderSimpleRepresentation> result = authMgmtResource.getUnregisteredRequiredActions();
+        Assertions.assertEquals(2, result.size());
+        String providerId = DummyConfigurableRequiredActionFactory.PROVIDER_ID;
+        RequiredActionProviderSimpleRepresentation action = result.stream().filter(
+                a -> providerId.equals(a.getProviderId())
+        ).findFirst().get();
+        Assertions.assertEquals(providerId, action.getProviderId());
+        Assertions.assertEquals("Configurable Test Action", action.getName());
+
+        // Register it
+        authMgmtResource.registerRequiredAction(action);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authMgmtBasePath() + "/register-required-action", action, ResourceType.REQUIRED_ACTION);
+
+        RequiredActionConfigRepresentation requiredActionConfigRep = new RequiredActionConfigRepresentation();
+        Map<String, String> newActionConfig = Map.ofEntries(Map.entry("setting1", "value1"), Map.entry("setting2", "false"));
+        requiredActionConfigRep.setConfig(newActionConfig);
+
+        authMgmtResource.updateRequiredActionConfig(providerId, requiredActionConfigRep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRequiredActionConfigPath(providerId), ResourceType.REQUIRED_ACTION_CONFIG);
+
+        RequiredActionConfigRepresentation savedRequiredActionConfigRep = authMgmtResource.getRequiredActionConfig(providerId);
+        Assertions.assertNotNull(savedRequiredActionConfigRep);
+        Assertions.assertNotNull(savedRequiredActionConfigRep.getConfig());
+        Assertions.assertTrue(savedRequiredActionConfigRep.getConfig().entrySet().containsAll(newActionConfig.entrySet()));
+
+        // delete config
+        authMgmtResource.removeRequiredActionConfig(providerId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authRequiredActionConfigPath(providerId), ResourceType.REQUIRED_ACTION_CONFIG);
+
+        RequiredActionProviderRepresentation rep = authMgmtResource.getRequiredAction(providerId);
+
+        // Remove success
+        authMgmtResource.removeRequiredAction(providerId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), ResourceType.REQUIRED_ACTION);
+
+        // Retrieval after deletion should throw a NotFound exception
+        try {
+            authMgmtResource.getRequiredActionConfig(providerId);
+        } catch (Exception ex) {
+            Assertions.assertTrue(NotFoundException.class.isInstance(ex));
+        }
+    }
+
+    private RequiredActionProviderRepresentation findRequiredActionByAlias(String alias, List<RequiredActionProviderRepresentation> list) {
+        for (RequiredActionProviderRepresentation a: list) {
+            if (alias.equals(a.getAlias())) {
+                return a;
+            }
+        }
+        return null;
+    }
+
+    private List<RequiredActionProviderRepresentation> sort(List<RequiredActionProviderRepresentation> list) {
+        ArrayList<RequiredActionProviderRepresentation> sorted = new ArrayList<>(list);
+        Collections.sort(sorted, new RequiredActionProviderComparator());
+        return sorted;
+    }
+
+    private void compareRequiredActions(List<RequiredActionProviderRepresentation> expected, List<RequiredActionProviderRepresentation> actual) {
+        Assertions.assertNotNull(actual, "Actual null");
+        Assertions.assertEquals(expected.size(), actual.size(), "Required actions count");
+
+        Iterator<RequiredActionProviderRepresentation> ite = expected.iterator();
+        Iterator<RequiredActionProviderRepresentation> ita = actual.iterator();
+        while (ite.hasNext()) {
+            compareRequiredAction(ite.next(), ita.next());
+        }
+    }
+
+    private void compareRequiredAction(RequiredActionProviderRepresentation expected, RequiredActionProviderRepresentation actual) {
+        Assertions.assertEquals(expected.getAlias(), actual.getAlias(), "alias - " + expected.getAlias());
+        Assertions.assertEquals(expected.getName(), actual.getName(), "name - "  + expected.getAlias());
+        Assertions.assertEquals(expected.isEnabled(), actual.isEnabled(), "enabled - "  + expected.getAlias());
+        Assertions.assertEquals(expected.isDefaultAction(), actual.isDefaultAction(), "defaultAction - "  + expected.getAlias());
+        Assertions.assertEquals(expected.getConfig() != null ? expected.getConfig() : Collections.<String, String>emptyMap(), actual.getConfig(), "config - " + expected.getAlias());
+    }
+
+    private void addRequiredAction(List<RequiredActionProviderRepresentation> target, String alias, String name, boolean enabled, boolean defaultAction, Map<String, String> conf) {
+        target.add(newRequiredAction(alias, name, enabled, defaultAction, conf));
+    }
+
+    private RequiredActionProviderRepresentation newRequiredAction(String alias, String name, boolean enabled, boolean defaultAction, Map<String, String> conf) {
+        RequiredActionProviderRepresentation action = new RequiredActionProviderRepresentation();
+        action.setAlias(alias);
+        action.setName(name);
+        action.setEnabled(enabled);
+        action.setDefaultAction(defaultAction);
+        action.setConfig(conf);
+        return action;
+    }
+
+    private static class RequiredActionProviderComparator implements Comparator<RequiredActionProviderRepresentation> {
+        @Override
+        public int compare(RequiredActionProviderRepresentation o1, RequiredActionProviderRepresentation o2) {
+            return o1.getAlias().compareTo(o2.getAlias());
+        }
+    }
+
+    public static class CustomProvidersServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.dependency("org.keycloak.tests", "keycloak-tests-custom-providers");
+        }
+
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftExecutionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftExecutionTest.java
new file mode 100644
index 000000000000..727cc0c74e48
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftExecutionTest.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public class ShiftExecutionTest extends AbstractAuthenticationTest {
+
+    @Test
+    public void testShiftExecution() {
+        // copy built-in flow so we get a new editable flow
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", "Copy of browser");
+        Response response = authMgmtResource.copy("browser", params);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
+        try {
+            Assertions.assertEquals(201, response.getStatus(), "Copy flow");
+        } finally {
+            response.close();
+        }
+
+        // get executions
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("Copy of browser");
+
+        AuthenticationExecutionInfoRepresentation last = executions.get(executions.size() - 1);
+        AuthenticationExecutionInfoRepresentation oneButLast = executions.get(executions.size() - 2);
+
+        // Not possible to raisePriority of not-existent flow
+        try {
+            authMgmtResource.raisePriority("not-existent");
+            Assertions.fail("Not expected to raise priority of not existent flow");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // shift last execution up
+        authMgmtResource.raisePriority(last.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRaiseExecutionPath(last.getId()), ResourceType.AUTH_EXECUTION);
+
+        List<AuthenticationExecutionInfoRepresentation> executions2 = authMgmtResource.getExecutions("Copy of browser");
+
+        AuthenticationExecutionInfoRepresentation last2 = executions2.get(executions.size() - 1);
+        AuthenticationExecutionInfoRepresentation oneButLast2 = executions2.get(executions.size() - 2);
+
+        Assertions.assertEquals(last.getId(), oneButLast2.getId(), "Execution shifted up - N");
+        Assertions.assertEquals(oneButLast.getId(), last2.getId(), "Execution shifted up - N-1");
+
+        // Not possible to lowerPriority of not-existent flow
+        try {
+            authMgmtResource.lowerPriority("not-existent");
+            Assertions.fail("Not expected to raise priority of not existent flow");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // shift one before last down
+        authMgmtResource.lowerPriority(oneButLast2.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authLowerExecutionPath(oneButLast2.getId()), ResourceType.AUTH_EXECUTION);
+
+        executions2 = authMgmtResource.getExecutions("Copy of browser");
+
+        last2 = executions2.get(executions.size() - 1);
+        oneButLast2 = executions2.get(executions.size() - 2);
+
+        Assertions.assertEquals(last.getId(), last2.getId(), "Execution shifted down - N");
+        Assertions.assertEquals(oneButLast.getId(), oneButLast2.getId(), "Execution shifted down - N-1");
+    }
+
+    @Test
+    public void testBuiltinShiftNotAllowed() {
+        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("browser");
+
+        AuthenticationExecutionInfoRepresentation last = executions.get(executions.size() - 1);
+        AuthenticationExecutionInfoRepresentation oneButLast = executions.get(executions.size() - 2);
+
+        // Not possible to raise - It's builtin flow
+        try {
+            authMgmtResource.raisePriority(last.getId());
+            Assertions.fail("Not expected to raise priority of builtin flow");
+        } catch (BadRequestException nfe) {
+            // Expected
+        }
+
+        // Not possible to lower - It's builtin flow
+        try {
+            authMgmtResource.lowerPriority(oneButLast.getId());
+            Assertions.fail("Not expected to lower priority of builtin flow");
+        } catch (BadRequestException nfe) {
+            // Expected
+        }
+
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftRequiredActionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftRequiredActionTest.java
new file mode 100644
index 000000000000..fcfeb5f13b6d
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authentication/ShiftRequiredActionTest.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authentication;
+
+import jakarta.ws.rs.NotFoundException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:wadahiro@gmail.com">Hiroyuki Wada</a>
+ */
+@KeycloakIntegrationTest
+public class ShiftRequiredActionTest extends AbstractAuthenticationTest {
+
+    @Test
+    public void testShiftRequiredAction() {
+
+        // get action
+        List<RequiredActionProviderRepresentation> actions = authMgmtResource.getRequiredActions();
+
+        RequiredActionProviderRepresentation last = actions.get(actions.size() - 1);
+        RequiredActionProviderRepresentation oneButLast = actions.get(actions.size() - 2);
+
+        // Not possible to raisePriority of not-existent required action
+        try {
+            authMgmtResource.raisePriority("not-existent");
+            Assertions.fail("Not expected to raise priority of not existent required action");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // shift last required action up
+        authMgmtResource.raiseRequiredActionPriority(last.getAlias());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authRaiseRequiredActionPath(last.getAlias()), ResourceType.REQUIRED_ACTION);
+
+        List<RequiredActionProviderRepresentation> actions2 = authMgmtResource.getRequiredActions();
+
+        RequiredActionProviderRepresentation last2 = actions2.get(actions.size() - 1);
+        RequiredActionProviderRepresentation oneButLast2 = actions2.get(actions.size() - 2);
+
+        Assertions.assertEquals(last.getAlias(), oneButLast2.getAlias(), "Required action shifted up - N");
+        Assertions.assertEquals(oneButLast.getAlias(), last2.getAlias(), "Required action up - N-1");
+
+        // Not possible to lowerPriority of not-existent required action
+        try {
+            authMgmtResource.lowerRequiredActionPriority("not-existent");
+            Assertions.fail("Not expected to raise priority of not existent required action");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+
+        // shift one before last down
+        authMgmtResource.lowerRequiredActionPriority(oneButLast2.getAlias());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authLowerRequiredActionPath(oneButLast2.getAlias()), ResourceType.REQUIRED_ACTION);
+
+        actions2 = authMgmtResource.getRequiredActions();
+
+        last2 = actions2.get(actions.size() - 1);
+        oneButLast2 = actions2.get(actions.size() - 2);
+
+        Assertions.assertEquals(last.getAlias(), last2.getAlias(), "Required action shifted down - N");
+        Assertions.assertEquals(oneButLast.getAlias(), oneButLast2.getAlias(), "Required action shifted down - N-1");
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java
index 27c351181e16..a4a9d07c6e8b 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AbstractPermissionTest.java
@@ -17,30 +17,46 @@
 
 package org.keycloak.tests.admin.authz.fgap;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
 import jakarta.ws.rs.core.Response;
+
+import java.util.Arrays;
+import java.util.List;
 import java.util.Set;
+import java.util.stream.Collectors;
+
 import org.keycloak.admin.client.resource.PermissionsResource;
 import org.keycloak.admin.client.resource.PoliciesResource;
 import org.keycloak.admin.client.resource.ScopePermissionsResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
 import org.keycloak.models.Constants;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.authorization.AbstractPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
 import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
 import org.keycloak.testframework.annotations.InjectClient;
 import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.injection.LifeCycle;
 import org.keycloak.testframework.realm.ManagedClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 
 public abstract class AbstractPermissionTest {
 
-    @InjectRealm(config = RealmAdminPermissionsConfig.class)
+    @InjectRealm(config = RealmAdminPermissionsConfig.class, lifecycle = LifeCycle.METHOD)
     ManagedRealm realm;
 
-    @InjectClient(ref = Constants.ADMIN_PERMISSIONS_CLIENT_ID, createClient = false)
+    @InjectClient(attachTo = Constants.ADMIN_PERMISSIONS_CLIENT_ID)
     ManagedClient client;
 
-    protected PermissionsResource getPermissionsResource() {
+    protected static PermissionsResource getPermissionsResource(ManagedClient client) {
         return client.admin().authorization().permissions();
     }
 
@@ -48,16 +64,16 @@ protected PoliciesResource getPolicies() {
         return client.admin().authorization().policies();
     }
 
-    protected ScopePermissionsResource getScopePermissionsResource() {
-        return getPermissionsResource().scope();
+    protected static ScopePermissionsResource getScopePermissionsResource(ManagedClient client) {
+        return getPermissionsResource(client).scope();
     }
 
-    protected void createPermission(ScopePermissionRepresentation permission) {
-        this.createPermission(permission, Response.Status.CREATED);
+    protected static void createPermission(ManagedClient client, ScopePermissionRepresentation permission) {
+        createPermission(client, permission, Response.Status.CREATED);
     }
 
-    protected void createPermission(ScopePermissionRepresentation permission, Response.Status expected) {
-        try (Response response = getScopePermissionsResource().create(permission)) {
+    protected static void createPermission(ManagedClient client, ScopePermissionRepresentation permission, Response.Status expected) {
+        try (Response response = getScopePermissionsResource(client).create(permission)) {
             assertEquals(expected.getStatusCode(), response.getStatus());
         }
     }
@@ -77,6 +93,10 @@ private PermissionBuilder(ScopePermissionRepresentation rep) {
         ScopePermissionRepresentation build() {
             return permission;
         }
+        PermissionBuilder logic(Logic logic) {
+            permission.setLogic(logic);
+            return this;
+        }
         PermissionBuilder resourceType(String resourceType) {
             permission.setResourceType(resourceType);
             return this;
@@ -89,5 +109,114 @@ PermissionBuilder resources(Set<String> resources) {
             permission.setResources(resources);
             return this;
         }
+        PermissionBuilder addPolicies(List<String> policies) {
+            policies.forEach(policy -> permission.addPolicy(policy));
+            return this;
+        }
+    }
+
+    protected static UserPolicyRepresentation createUserPolicy(ManagedRealm realm, ManagedClient client, String name, String... userIds) {
+        return createUserPolicy(Logic.POSITIVE, realm, client, name, userIds);
+    }
+
+    protected static UserPolicyRepresentation createUserPolicy(Logic logic, ManagedRealm realm, ManagedClient client, String name, String... userIds) {
+        UserPolicyRepresentation policy = new UserPolicyRepresentation();
+        policy.setName(name);
+        for (String userId : userIds) {
+            policy.addUser(userId);
+        }
+        policy.setLogic(logic);
+        try (Response response = client.admin().authorization().policies().user().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                UserPolicyRepresentation userPolicy = r.clients().get(client.getId()).authorization().policies().user().findByName(name);
+                if (userPolicy != null) {
+                    r.clients().get(client.getId()).authorization().policies().user().findById(userPolicy.getId()).remove();
+                }
+            });
+        }
+        return policy;
+    }
+
+    protected static GroupPolicyRepresentation createGroupPolicy(ManagedRealm realm, ManagedClient client, String name, String groupId, Logic logic) {
+        GroupPolicyRepresentation policy = new GroupPolicyRepresentation();
+        policy.setName(name);
+        policy.addGroup(groupId);
+        policy.setLogic(logic);
+        try (Response response = client.admin().authorization().policies().group().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                String policyId = r.clients().get(client.getId()).authorization().policies().group().findByName(name).getId();
+                r.clients().get(client.getId()).authorization().policies().group().findById(policyId).remove();
+            });
+        }
+        return policy;
+    }
+
+    protected static RolePolicyRepresentation createRolePolicy(ManagedRealm realm, ManagedClient client, String name, String roleId, Logic logic) {
+        RolePolicyRepresentation policy = new RolePolicyRepresentation();
+        policy.setName(name);
+        policy.addRole(roleId);
+        policy.setLogic(logic);
+        try (Response response = client.admin().authorization().policies().role().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                String policyId = r.clients().get(client.getId()).authorization().policies().group().findByName(name).getId();
+                r.clients().get(client.getId()).authorization().policies().group().findById(policyId).remove();
+            });
+        }
+        return policy;
+    }
+
+    protected static ClientPolicyRepresentation createClientPolicy(ManagedRealm realm, ManagedClient client, String name, String... clientIds) {
+        ClientPolicyRepresentation policy = new ClientPolicyRepresentation();
+        policy.setName(name);
+        for (String clientId : clientIds) {
+            policy.addClient(clientId);
+        }
+        policy.setLogic(Logic.POSITIVE);
+        try (Response response = client.admin().authorization().policies().client().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                ClientPolicyRepresentation clientPolicy = r.clients().get(client.getId()).authorization().policies().client().findByName(name);
+                if (clientPolicy != null) {
+                    r.clients().get(client.getId()).authorization().policies().client().findById(clientPolicy.getId()).remove();
+                }
+            });
+        }
+        return policy;
+    }
+
+    protected static ScopePermissionRepresentation createAllPermission(ManagedClient client, String resourceType, AbstractPolicyRepresentation policy, Set<String> scopes) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(resourceType)
+                .scopes(scopes)
+                .addPolicies(List.of(policy.getName()))
+                .build();
+
+        createPermission(client, permission);
+
+        return permission;
+    }
+
+    protected ScopePermissionRepresentation createPermission(ManagedClient client, String resourceId, String resourceType, Set<String> scopes, AbstractPolicyRepresentation... policies) {
+        return createPermission(client, Set.of(resourceId), resourceType, scopes, policies);
+    }
+
+    protected ScopePermissionRepresentation createPermission(ManagedClient client, Set<String> resourceIds, String resourceType, Set<String> scopes, AbstractPolicyRepresentation... policies) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(resourceType)
+                .scopes(scopes)
+                .resources(resourceIds)
+                .addPolicies(Arrays.stream(policies).map(AbstractPolicyRepresentation::getName).collect(Collectors.toList()))
+                .build();
+
+        createPermission(client, permission);
+
+        return permission;
+    }
+
+    protected ScopePermissionRepresentation createGroupPermission(GroupRepresentation group, Set<String> scopes, UserPolicyRepresentation... policies) {
+        return createPermission(client, group.getId(), AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, scopes, policies);
     }
 }
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AuthzClientConfig.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AuthzClientConfig.java
index 827fb0da0c67..0b1f69924366 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AuthzClientConfig.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/AuthzClientConfig.java
@@ -23,7 +23,7 @@ public class AuthzClientConfig implements ClientConfig {
 
     @Override
     public ClientConfigBuilder configure(ClientConfigBuilder client) {
-        return client.serviceAccount()
+        return client.serviceAccountsEnabled(true)
                 .authorizationServices();
     }
 
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeEvaluationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeEvaluationTest.java
new file mode 100644
index 000000000000..0b75fb1a082c
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeEvaluationTest.java
@@ -0,0 +1,441 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.Assert.fail;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES_COMPOSITE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+
+import java.util.List;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.ForbiddenException;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.AggregatePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ClientScopePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.JSPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.RegexPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.TimePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedClient;
+
+@KeycloakIntegrationTest
+public class ClientResourceTypeEvaluationTest extends AbstractPermissionTest {
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    @InjectClient(ref = "realmClient")
+    ManagedClient realmClient;
+
+    private final String clientsType = AdminPermissionsSchema.CLIENTS.getType();
+
+    @Test
+    public void testUnsupportedPolicyTypes() {
+        assertSupportForPolicyType("resource", () -> getPermissionsResource(client).resource().create(new ResourcePermissionRepresentation()), false);
+    }
+
+    @Test
+    public void testSupportedPolicyTypes() {
+        assertSupportForPolicyType("scope", () -> getPermissionsResource(client).scope().create(PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.USERS.getType())
+                .scopes(AdminPermissionsSchema.USERS.getScopes())
+                .build()), true);
+        assertSupportForPolicyType("user", () -> getPolicies().user().create(new UserPolicyRepresentation()), true);
+        assertSupportForPolicyType("client", () -> getPolicies().client().create(new ClientPolicyRepresentation()), true);
+        assertSupportForPolicyType("group", () -> getPolicies().group().create(new GroupPolicyRepresentation()), true);
+        assertSupportForPolicyType("role", () -> getPolicies().role().create(new RolePolicyRepresentation()), true);
+        assertSupportForPolicyType("aggregate", () -> getPolicies().aggregate().create(new AggregatePolicyRepresentation()), true);
+        assertSupportForPolicyType("client-scope", () -> getPolicies().clientScope().create(new ClientScopePolicyRepresentation()), true);
+        assertSupportForPolicyType("js", () -> getPolicies().js().create(new JSPolicyRepresentation()), true);
+        assertSupportForPolicyType("regex", () -> getPolicies().regex().create(new RegexPolicyRepresentation()), true);
+        assertSupportForPolicyType("time", () -> getPolicies().time().create(new TimePolicyRepresentation()), true);
+    }
+
+    private void assertSupportForPolicyType(String type, Supplier<Response> operation, boolean supported) {
+        try (Response response = operation.get()) {
+            assertPolicyEndpointResponse(type, supported, response);
+        }
+
+        PolicyRepresentation representation = new PolicyRepresentation();
+
+        representation.setType(type);
+
+        try (Response response = getPolicies().create(representation)) {
+            assertPolicyEndpointResponse(type, supported, response);
+        }
+    }
+
+    private void assertPolicyEndpointResponse(String type, boolean supported, Response response) {
+        assertThat("Policy type [" + type + "] should be " + (supported ? "supported" : "unsupported"), Status.BAD_REQUEST.equals(Status.fromStatusCode(response.getStatus())), not(supported));
+        assertThat("Policy type [" + type + "] should be " + (supported ? "supported" : "unsupported"), response.readEntity(String.class).contains("Policy type not supported by feature"), not(supported));
+    }
+
+    @Test
+    public void testManageOnlyOneClient() {
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        ClientResource clientResource = realmAdminClient.realm(realm.getName()).clients().get(myclient.getId());
+
+        // the following operations should fail as the permission wasn't granted yet
+        try {
+            clientResource.toRepresentation();
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+        try {
+            myclient.setName("somethingNew");
+            clientResource.update(myclient);
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+        try {
+            ClientScopeRepresentation clientScopeRep = clientResource.getDefaultClientScopes().get(1);
+            clientResource.removeDefaultClientScope(clientScopeRep.getId());
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createPermission(client, myclient.getId(), clientsType, Set.of(VIEW, MANAGE), onlyMyAdminUserPolicy);
+
+        // the caller can view myclient
+        clientResource.toRepresentation();
+
+        // the caller can list myclient
+        List<ClientRepresentation> allClients = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertThat(allClients, hasSize(1));
+
+        // can update myclient
+        myclient.setName("somethingNew");
+        clientResource.update(myclient);
+
+        // can view client scopes
+        List<ClientScopeRepresentation> defaultClientScopes = clientResource.getDefaultClientScopes();
+        assertThat(defaultClientScopes, not(empty()));
+
+        // can remove a default client scope
+        ClientScopeRepresentation clientScopeRep = defaultClientScopes.get(1);
+        clientResource.removeDefaultClientScope(clientScopeRep.getId());
+
+        // can add an optional client scope
+        clientResource.addOptionalClientScope(clientScopeRep.getId());
+
+        // can't update a different client
+        ClientRepresentation realmClientRep = realm.admin().clients().get(realmClient.getId()).toRepresentation();
+        realmClientRep.setName("somethingNew");
+        try {
+            realmAdminClient.realm(realm.getName()).clients().get(realmClient.getId()).update(realmClientRep);
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+    }
+
+    @Test
+    public void testManageAllClients() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        ClientRepresentation newClient = new ClientRepresentation();
+        newClient.setClientId("newClient");
+        newClient.setProtocol("openid-connect");
+
+        // the following operations should fail as the permission wasn't granted yet
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().create(newClient)) {
+            Assertions.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        List<ClientRepresentation> found = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertThat(found, empty());
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createAllPermission(client, clientsType, onlyMyAdminUserPolicy, Set.of(VIEW, MANAGE));
+
+        // can create a new client
+        realmAdminClient.realm(realm.getName()).clients().create(newClient).close();
+        found = realmAdminClient.realm(realm.getName()).clients().findByClientId("newClient");
+        assertThat(found, hasSize(1));
+
+        // can delete
+        realmAdminClient.realm(realm.getName()).clients().get(found.get(0).getId()).remove();
+        found = realmAdminClient.realm(realm.getName()).clients().findByClientId("newClient");
+        assertThat(found, empty());
+
+        // can list & view all clients
+        found = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertThat(found, not(empty()));
+    }
+
+    @Test
+    public void testViewAllClients() {
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        // the following operations should fail as the permission wasn't granted yet
+        try {
+            realmAdminClient.realm(realm.getName()).clients().get(myclient.getId()).getProtocolMappers().getMappers();
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        List<ClientRepresentation> found = realmAdminClient.realm(realm.getName()).clients().findAll(true);
+        assertThat(found, empty());
+
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createAllPermission(client, clientsType, onlyMyAdminUserPolicy, Set.of(VIEW));
+
+        // can list and view all clients
+        found = realmAdminClient.realm(realm.getName()).clients().findAll(true);
+        assertThat(found, not(empty()));
+
+        // can't create a protocol mapper
+        ProtocolMapperRepresentation protocolMapperRep = new ProtocolMapperRepresentation();
+        protocolMapperRep.setName("my-protocol-mapper");
+        protocolMapperRep.setProtocol("openid-connect");
+        protocolMapperRep.setProtocolMapper("oidc-hardcoded-claim-mapper");
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().get(myclient.getId()).getProtocolMappers().createMapper(protocolMapperRep)) {
+            Assertions.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        // can get protocol mappers
+        assertThat(realmAdminClient.realm(realm.getName()).clients().get(myclient.getId()).getProtocolMappers().getMappers(), empty());
+
+        // can't create a new client
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().create(null)) {
+            Assertions.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+    }
+
+    @Test
+    public void testCreateClientsRequireManageScope() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        ClientRepresentation newClient = new ClientRepresentation();
+
+        newClient.setClientId(KeycloakModelUtils.generateId());
+
+        // can't create a new client
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().create(newClient)) {
+            Assertions.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        List<ClientRepresentation> found = realmAdminClient.realm(realm.getName()).clients().findAll(true);
+        assertThat(found, empty());
+
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        ScopePermissionRepresentation allPermission = createAllPermission(client, clientsType, onlyMyAdminUserPolicy, CLIENTS.getScopes().stream().filter(Predicate.not(MANAGE::equals)).collect(Collectors.toSet()));
+
+        // can't create a new client
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().create(newClient)) {
+            Assertions.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        // grants manage access
+        allPermission = getScopePermissionsResource(client).findByName(allPermission.getName());
+        allPermission.setScopes(Set.of(VIEW, MANAGE));
+        getScopePermissionsResource(client).findById(allPermission.getId()).update(allPermission);
+
+        // create clients is permission is granted to all clients
+        try (Response response = realmAdminClient.realm(realm.getName()).clients().create(newClient)) {
+            Assertions.assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
+        }
+
+        found = realmAdminClient.realm(realm.getName()).clients().findByClientId(newClient.getClientId());
+        assertThat(found, not(empty()));
+    }
+
+    @Test
+    public void testMapRolesOnlyOneClient() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+
+        // create a role
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName("myclient-role");
+        role.setClientRole(true);
+        realm.admin().clients().get(myclient.getId()).roles().create(role);
+        role = realm.admin().clients().get(myclient.getId()).roles().get("myclient-role").toRepresentation();
+
+        // the following operations should fail as the permission wasn't granted yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().clientLevel(myclient.getId()).add(List.of(role));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createPermission(client, myadmin.getId(), AdminPermissionsSchema.USERS_RESOURCE_TYPE, Set.of(MAP_ROLES), onlyMyAdminUserPolicy);
+        createPermission(client, myclient.getId(), clientsType, Set.of(MAP_ROLES), onlyMyAdminUserPolicy);
+
+        // now those should pass
+        realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().clientLevel(myclient.getId()).add(List.of(role));
+    }
+
+    @Test
+    public void testMapCompositesToAnotherClientRole() {
+        // to add a client role ('myclient') 'roleA' as a composite role of 'roleB' (client role of 'realmClient' client)
+        // it is required to have permission to manage the `realmClient` and to map-roles-composite of the `myclient`
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+
+        // create two roles, each for seprate client
+        RoleRepresentation roleA = new RoleRepresentation();
+        roleA.setName("roleA");
+        roleA.setClientRole(true);
+        realm.admin().clients().get(myclient.getId()).roles().create(roleA);
+        roleA = realm.admin().clients().get(myclient.getId()).roles().get("roleA").toRepresentation();
+
+        RoleRepresentation roleB = new RoleRepresentation();
+        roleB.setName("roleB");
+        roleB.setClientRole(true);
+        realm.admin().clients().get(realmClient.getId()).roles().create(roleB);
+
+        // the following operations should fail as the permission wasn't granted yet
+        try {
+            realmAdminClient.realm(realm.getName()).clients().get(realmClient.getId()).roles().get("roleB").addComposites(List.of(roleA));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+
+        createPermission(client, myclient.getId(), clientsType, Set.of(MAP_ROLES_COMPOSITE), onlyMyAdminUserPolicy);
+
+        // the following operations should fail as the permission to manage the realmClient is missing
+        try {
+            realmAdminClient.realm(realm.getName()).clients().get(realmClient.getId()).roles().get("roleB").addComposites(List.of(roleA));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        createPermission(client, realmClient.getId(), clientsType, Set.of(MANAGE), onlyMyAdminUserPolicy);
+
+        // now those should pass
+        realmAdminClient.realm(realm.getName()).clients().get(realmClient.getId()).roles().get("roleB").addComposites(List.of(roleA));
+    }
+
+    @Test
+    public void testEvaluateAllResourcePermissionsForSpecificResourcePermission() {
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+        UserRepresentation adminUser = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowPolicy = createUserPolicy(realm, client, "Only My Admin", adminUser.getId());
+        ScopePermissionRepresentation allResourcesPermission = createAllPermission(client, clientsType, allowPolicy, Set.of(MANAGE, MAP_ROLES));
+        // all resource permissions grants manage scope
+        ClientsResource clients = realmAdminClient.realm(realm.getName()).clients();
+        clients.get(myclient.getId()).update(myclient);
+
+        ScopePermissionRepresentation resourcePermission = createPermission(client, myclient.getId(), clientsType, Set.of(MANAGE), allowPolicy);
+        // both all and specific resource permission grants manage scope
+        clients.get(myclient.getId()).update(myclient);
+
+        allResourcesPermission = getScopePermissionsResource(client).findByName(allResourcesPermission.getName());
+        allResourcesPermission.setScopes(Set.of(MAP_ROLES));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission does not have the manage scope but the scope is granted by the resource permission
+        clients.get(myclient.getId()).update(myclient);
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(MAP_ROLES));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // neither the all and specific resource permission grants access to the manage scope
+            clients.get(myclient.getId()).update(myclient);
+            Assertions.fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        allResourcesPermission.setScopes(Set.of(MANAGE));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission grants access again to manage
+        clients.get(myclient.getId()).update(myclient);
+
+        UserPolicyRepresentation notAllowPolicy = createUserPolicy(Logic.NEGATIVE, realm, client, "Not My Admin", adminUser.getId());
+        createPermission(client, myclient.getId(), clientsType, Set.of(MANAGE), notAllowPolicy);
+        try {
+            // a specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            clients.get(myclient.getId()).update(myclient);
+            Assertions.fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(MAP_ROLES, MANAGE));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // the specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            // even though there is another resource permission that grants access to the scope - conflict resolution denies by default
+            clients.get(myclient.getId()).update(myclient);
+            Assertions.fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+    }
+
+    @Test
+    public void testManageClientWithAuthorizationSettings() {
+        ClientRepresentation myResourceServer = realm.admin().clients().findByClientId("myresourceserver").get(0);
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        ClientResource clientResource = realmAdminClient.realm(realm.getName()).clients().get(myResourceServer.getId());
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createPermission(client, myResourceServer.getId(), clientsType, Set.of(VIEW, MANAGE), onlyMyAdminUserPolicy);
+
+        // can update myResourceServer because manage also implies managing authorization service settings
+        myResourceServer.setName("somethingNew");
+        clientResource.update(myResourceServer);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeFilteringTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeFilteringTest.java
new file mode 100644
index 000000000000..4e0fa0176ee9
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypeFilteringTest.java
@@ -0,0 +1,137 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+@KeycloakIntegrationTest
+public class ClientResourceTypeFilteringTest extends AbstractPermissionTest {
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    @BeforeEach
+    public void onBeforeEach() {
+        for (int i = 0; i < 50; i++) {
+            ClientRepresentation client = new ClientRepresentation();
+
+            client.setClientId("client-" + i);
+            client.setName(client.getClientId());
+            client.setEnabled(true);
+            client.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+            client.setPublicClient(false);
+            client.setSecret("secret");
+            client.setAttributes(Map.of("saml.artifact.binding.identifier", "value"));
+
+            realm.admin().clients().create(client).close();
+        }
+    }
+
+    @Test
+    public void testViewAllClientsUsingUserPolicy() {
+        List<ClientRepresentation> search = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, CLIENTS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        search = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertFalse(search.isEmpty());
+        assertEquals(59, search.size());
+    }
+
+    @Test
+    public void testViewSpecificClientsUsingUserPolicy() {
+        List<ClientRepresentation> search = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, CLIENTS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        search = realmAdminClient.realm(realm.getName()).clients().findAll("client-", true, true, null, null);
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+    }
+
+    @Test
+    public void testViewClientsByAttributeUsingUserPolicy() {
+        List<ClientRepresentation> search = realmAdminClient.realm(realm.getName()).clients().findAll();
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, CLIENTS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        search = realmAdminClient.realm(realm.getName()).clients().query("saml.artifact.binding.identifier:\"value\"");
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+    }
+
+    @Test
+    public void testDeniedResourcesPrecedenceOverGrantedResources() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, CLIENTS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        List<ClientRepresentation> search = realmAdminClient.realm(realm.getName()).clients().findAll("client-", true, true, null, null);
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+
+        UserPolicyRepresentation notMyAdminPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        Set<String> notAllowedClients = search.stream()
+                .filter((g) -> Set.of("client-0", "client-15", "client-30", "client-45").contains(g.getClientId()))
+                .map(ClientRepresentation::getId)
+                .collect(Collectors.toSet());
+        assertFalse(notAllowedClients.isEmpty());
+        createPermission(client, notAllowedClients, CLIENTS_RESOURCE_TYPE, Set.of(VIEW), notMyAdminPolicy);
+        search = realmAdminClient.realm(realm.getName()).clients().findAll("client-", true, true, null, null);
+        assertFalse(search.isEmpty());
+        assertTrue(search.stream().map(ClientRepresentation::getId).noneMatch(notAllowedClients::contains));
+    }
+
+    @Test
+    public void testSearchByClientId() {
+        String expectedClientId = "client-0";
+        List<ClientRepresentation> search = realmAdminClient.realm(realm.getName()).clients().findByClientId(expectedClientId);
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation allowPolicy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, expectedClientId, CLIENTS_RESOURCE_TYPE, Set.of(VIEW), allowPolicy);
+        search = realmAdminClient.realm(realm.getName()).clients().findByClientId(expectedClientId);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+        assertEquals(search.get(0).getClientId(), expectedClientId);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypePermissionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypePermissionTest.java
new file mode 100644
index 000000000000..d258a1d61be2
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/ClientResourceTypePermissionTest.java
@@ -0,0 +1,132 @@
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ScopePermissionResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedClient;
+
+@KeycloakIntegrationTest
+public class ClientResourceTypePermissionTest extends AbstractPermissionTest {
+
+    @InjectClient(ref = "testClient")
+    ManagedClient testClient;
+
+    @InjectClient(ref = "testClient2", lifecycle = LifeCycle.METHOD)
+    ManagedClient testClient2;
+
+    @BeforeEach
+    public void onBefore() {
+        UserPolicyRepresentation policy = new UserPolicyRepresentation();
+        policy.setName("User Policy");
+        client.admin().authorization().policies().user().create(policy).close();
+    }
+
+    @Test
+    public void testCreateResourceTypePermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        ScopePermissionRepresentation expected = createAllPermission(client, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, onlyMyAdminUserPolicy, AdminPermissionsSchema.CLIENTS.getScopes());
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.CLIENTS.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, permission.resources().get(0).getDisplayName());
+    }
+
+    @Test
+    public void testCreateResourceObjectPermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        ClientRepresentation client = realm.admin().clients().findAll().get(0);
+        ScopePermissionRepresentation expected = createPermission(this.client, client.getId(), AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, AdminPermissionsSchema.CLIENTS.getScopes(), onlyMyAdminUserPolicy);
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(this.client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(this.client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.CLIENTS.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(client.getClientId(), permission.resources().get(0).getDisplayName());
+    }
+
+    @Test
+    public void testRemoveClient() {
+        //create client policies
+        createClientPolicy(realm, client, "Only testClient or testClient2 Client Policy", testClient.getId(), testClient2.getId());
+        createClientPolicy(realm, client, "Only testClient2 Client Policy", testClient2.getId());
+
+        //create client permissions
+        createClientPermission(testClient, testClient2);
+        createClientPermission(testClient2);
+
+        List<PolicyRepresentation> policies = getPolicies().policies(null, "Only", "client", null, null, null, null, null, null, null);
+        assertThat(policies, hasSize(2));
+        assertThat(policies.get(0).getConfig().get("clients"), containsString(testClient2.getId()));
+        assertThat(policies.get(1).getConfig().get("clients"), containsString(testClient2.getId()));
+
+        List<ScopePermissionRepresentation> permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(2));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(testClient2.getId()));
+        assertThat(getPolicies().policy(permissions.get(1).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(testClient2.getId()));
+
+        //remove client
+        realm.admin().clients().get(testClient2.getId()).remove();
+
+        //check the resource was removed from policies
+        ClientPolicyRepresentation clientPolicy = getPolicies().client().findByName("Only testClient or testClient2 Client Policy");
+        assertThat(clientPolicy, notNullValue());
+        assertThat(clientPolicy.getClients(), not(contains(testClient2.getId())));
+
+        ClientPolicyRepresentation clientPolicy1 = getPolicies().client().findByName("Only testClient2 Client Policy");
+        assertThat(clientPolicy1, notNullValue());
+        assertThat(clientPolicy1.getClients(), empty());
+
+        //there should be 1 permission left
+        permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(1));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), not(hasItem(testClient2.getId())));
+    }
+
+    private ScopePermissionRepresentation createClientPermission(ManagedClient... clients) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.CLIENTS.getType())
+                .resources(Arrays.stream(clients).map(ManagedClient::getClientId).collect(Collectors.toSet()))
+                .scopes(AdminPermissionsSchema.CLIENTS.getScopes())
+                .addPolicies(List.of("User Policy"))
+                .build();
+
+        createPermission(client, permission);
+
+        return permission;
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureDisabledTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureDisabledTest.java
deleted file mode 100644
index 5891468fd558..000000000000
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureDisabledTest.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright 2025 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.tests.admin.authz.fgap;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.notNullValue;
-import static org.hamcrest.Matchers.nullValue;
-import org.junit.jupiter.api.Test;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-import org.keycloak.testframework.annotations.InjectClient;
-import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
-import org.keycloak.testframework.realm.ManagedClient;
-
-@KeycloakIntegrationTest
-public class FeatureDisabledTest {
-
-    @InjectClient(ref = "test-client", config = AuthzClientConfig.class, createClient = true)
-    private ManagedClient testClient;
-
-    @Test
-    public void schemaNotAvailableFeatureDisabled() {
-        ResourceServerRepresentation authorizationSettings = testClient.admin().authorization().getSettings();
-        assertThat(authorizationSettings, notNullValue());
-        assertThat(authorizationSettings.getAuthorizationSchema(), nullValue());
-    }
-}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV1EnabledTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV1EnabledTest.java
index b101d6320188..f4fe4c847b86 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV1EnabledTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV1EnabledTest.java
@@ -28,7 +28,7 @@
 @KeycloakIntegrationTest(config = KeycloakAdminPermissionsV1ServerConfig.class)
 public class FeatureV1EnabledTest {
 
-    @InjectClient(ref = "test-client", config = AuthzClientConfig.class, createClient = true)
+    @InjectClient(config = AuthzClientConfig.class)
     private ManagedClient testClient;
 
     @Test
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV2EnabledTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV2EnabledTest.java
index b1e1eccab84b..c445ec030777 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV2EnabledTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FeatureV2EnabledTest.java
@@ -34,13 +34,13 @@
 import org.keycloak.testframework.realm.ManagedClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 
-@KeycloakIntegrationTest(config = KeycloakAdminPermissionsServerConfig.class)
+@KeycloakIntegrationTest
 public class FeatureV2EnabledTest {
 
     @InjectRealm
     private ManagedRealm realm;
 
-    @InjectClient(ref = "test-client", config = AuthzClientConfig.class, createClient = true)
+    @InjectClient(config = AuthzClientConfig.class)
     private ManagedClient testClient;
 
     @Test
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FineGrainedPermissionsUsersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FineGrainedPermissionsUsersTest.java
new file mode 100644
index 000000000000..75f4406d5cf7
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/FineGrainedPermissionsUsersTest.java
@@ -0,0 +1,271 @@
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.KeycloakBuilder;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testframework.util.ApiUtil;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+
+@KeycloakIntegrationTest
+public class FineGrainedPermissionsUsersTest extends AbstractPermissionTest {
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    private void assertSearchMatchesCount(RealmResource realmResource, String search, Integer expectedCount) {
+        Integer count = realmResource.users().count(search);
+        assertThat(count, is(expectedCount));
+        assertThat(realmResource.users().search(search, null, null), hasSize(count));
+    }
+
+    @Test
+    public void countUsersWithGroupViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        assertThat(testRealmResource.users().count(), is(3));
+    }
+
+    @Test
+    public void countUsersBySearchWithGroupViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        //search all
+        assertSearchMatchesCount(testRealmResource, "user", 3);
+        //search first name
+        assertSearchMatchesCount(testRealmResource, "*FirstName*", 3);
+        assertSearchMatchesCount(testRealmResource, "user2FirstName", 1);
+        //search last name
+        assertSearchMatchesCount(testRealmResource, "*LastName*", 3);
+        assertSearchMatchesCount(testRealmResource, "user2LastName", 1);
+        //search in email
+        assertSearchMatchesCount(testRealmResource, "*@example.com*", 3);
+        assertSearchMatchesCount(testRealmResource, "user1@example.com", 1);
+        //search for something not existing
+        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
+        //search for empty string
+        assertSearchMatchesCount(testRealmResource, "", 3);
+        //search not specified (defaults to simply /count)
+        assertSearchMatchesCount(testRealmResource, null, 3);
+    }
+
+    @Test
+    public void countUsersByFiltersWithGroupViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        //search username
+        assertThat(testRealmResource.users().count(null, null, null, "user"), equalTo(testRealmResource.users().search("user", null, null, null, null, null).size()));
+        assertThat(testRealmResource.users().count(null, null, null, "user"), is(3));
+        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(1));
+        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, ""), is(3));
+        //search first name
+        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(3));
+        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(1));
+        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "", null, null), is(3));
+        //search last name
+        assertThat(testRealmResource.users().count("LastName", null, null, null), is(3));
+        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(1));
+        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", null, null, null), is(3));
+        //search in email
+        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(3));
+        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(1));
+        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "", null), is(3));
+        //search for combinations
+        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(3));
+        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(1));
+        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(1));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
+        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(3));
+        //search not specified (defaults to simply /count)
+        assertThat(testRealmResource.users().count(null, null, null, null), is(3));
+        assertThat(testRealmResource.users().count("", "", "", ""), is(3));
+    }
+
+    @Test
+    public void countUsersWithNoViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        assertThat(testRealmResource.users().count(), is(0));
+    }
+
+    @Test
+    public void countUsersBySearchWithNoViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        //search all
+        assertSearchMatchesCount(testRealmResource, "user", 0);
+        //search first name
+        assertSearchMatchesCount(testRealmResource, "FirstName", 0);
+        assertSearchMatchesCount(testRealmResource, "user2FirstName", 0);
+        //search last name
+        assertSearchMatchesCount(testRealmResource, "LastName", 0);
+        assertSearchMatchesCount(testRealmResource, "user2LastName", 0);
+        //search in email
+        assertSearchMatchesCount(testRealmResource, "@example.com", 0);
+        assertSearchMatchesCount(testRealmResource, "user1@example.com", 0);
+        //search for something not existing
+        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
+        //search for empty string
+        assertSearchMatchesCount(testRealmResource, "", 0);
+        //search not specified (defaults to simply /count)
+        assertSearchMatchesCount(testRealmResource, null, 0);
+    }
+
+    @Test
+    public void countUsersByFiltersWithNoViewPermission() {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        //search username
+        assertThat(testRealmResource.users().count(null, null, null, "user"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, ""), is(0));
+        //search first name
+        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "", null, null), is(0));
+        //search last name
+        assertThat(testRealmResource.users().count("LastName", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", null, null, null), is(0));
+        //search in email
+        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "", null), is(0));
+        //search for combinations
+        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(0));
+        //search not specified (defaults to simply /count)
+        assertThat(testRealmResource.users().count(null, null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", "", "", ""), is(0));
+    }
+
+    private RealmResource setupTestEnvironmentWithPermissions(boolean grp1ViewPermissions) {
+        UserRepresentation user = UserConfigBuilder.create()
+                .username("test-user")
+                .password("password")
+                .name("a", "b")
+                .email("c@d.com")
+                .enabled(true)
+                .build();
+        String testUserId = ApiUtil.getCreatedId(realm.admin().users().create(user));
+        //assign 'query-users' role to test user
+        ClientRepresentation clientRepresentation = realm.admin().clients().findByClientId("realm-management").get(0);
+        String realmManagementId = clientRepresentation.getId();
+        RoleRepresentation roleRepresentation = realm.admin().clients().get(realmManagementId).roles().get("query-users").toRepresentation();
+        realm.admin().users().get(testUserId).roles().clientLevel(realmManagementId).add(Collections.singletonList(roleRepresentation));
+        realm.cleanup().add(r -> r.users().get(testUserId).remove());
+
+        //create test users and groups
+        List<GroupRepresentation> groups = setupUsersInGroups();
+
+        if (grp1ViewPermissions) {
+            UserPolicyRepresentation userPolicy = createUserPolicy(realm, client, "allow-test-user", testUserId);
+            createGroupPermission(groups.get(0), Set.of(VIEW), userPolicy);
+        }
+
+        Keycloak testUserClient = KeycloakBuilder.builder()
+                .serverUrl(keycloakUrls.getBaseUrl().toString())
+                .realm(realm.getName())
+                .username("test-user")
+                .password("password")
+                .clientId("admin-cli")
+                .clientSecret("")
+                .build();
+
+        return testUserClient.realm(realm.getCreatedRepresentation().getRealm());
+    }
+
+    private List<GroupRepresentation> setupUsersInGroups() {
+        //create two groups
+        GroupRepresentation grp1 = createGroup("grp1");
+        GroupRepresentation grp2 = createGroup("grp2");
+        //create test users
+        UserRepresentation user1 = UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .enabled(true)
+                .build();
+        String user1Id = ApiUtil.getCreatedId(realm.admin().users().create(user1));
+        realm.cleanup().add(r -> r.users().get(user1Id).remove());
+
+        UserRepresentation user2 = UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(true)
+                .build();
+        String user2Id = ApiUtil.getCreatedId(realm.admin().users().create(user2));
+        realm.cleanup().add(r -> r.users().get(user2Id).remove());
+
+        UserRepresentation user3 = UserConfigBuilder.create()
+                .username("user3")
+                .password("password")
+                .name("user3FirstName", "user3LastName")
+                .email("user3@example.com")
+                .enabled(true)
+                .build();
+        String user3Id = ApiUtil.getCreatedId(realm.admin().users().create(user3));
+        realm.cleanup().add(r -> r.users().get(user3Id).remove());
+
+        UserRepresentation user4 = UserConfigBuilder.create()
+                .username("user4")
+                .password("password")
+                .name("user4FirstName", "user4LastName")
+                .email("user4@example.com")
+                .enabled(true)
+                .build();
+        String user4Id = ApiUtil.getCreatedId(realm.admin().users().create(user4));
+        realm.cleanup().add(r -> r.users().get(user4Id).remove());
+
+        //add users to groups
+        realm.admin().users().get(user1Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user2Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user3Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user4Id).joinGroup(grp2.getId());
+
+        List<GroupRepresentation> groups = new ArrayList<>();
+        groups.add(grp1);
+        groups.add(grp2);
+
+        return groups;
+    }
+
+    private GroupRepresentation createGroup(String name) {
+        GroupRepresentation grp = new GroupRepresentation();
+        grp.setName(name);
+        String groupId = ApiUtil.getCreatedId(realm.admin().groups().add(grp));
+        grp.setId(groupId);
+        realm.cleanup().add(r -> r.groups().group(groupId).remove());
+        return grp;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeEvaluationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeEvaluationTest.java
new file mode 100644
index 000000000000..178682e8cd0b
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeEvaluationTest.java
@@ -0,0 +1,446 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE_MEMBERS;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERS;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERSHIP;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
+
+import jakarta.ws.rs.ForbiddenException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import java.util.List;
+import java.util.Set;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.GroupsResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.util.ApiUtil;
+
+@KeycloakIntegrationTest
+public class GroupResourceTypeEvaluationTest extends AbstractPermissionTest {
+
+    @InjectUser(ref = "alice")
+    ManagedUser userAlice;
+
+    @InjectUser(ref = "jdoe")
+    ManagedUser userJdoe;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    private final String groupName = "top_group";
+    private final GroupRepresentation topGroup = new GroupRepresentation();
+
+    @BeforeEach // cannot use @BeforeAll, realm is not initializaed yet
+    public void onBefore() {
+        topGroup.setName(groupName);
+        try (Response response = realm.admin().groups().add(topGroup)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            topGroup.setId(ApiUtil.handleCreatedResponse(response));
+            realm.cleanup().add(r -> r.groups().group(topGroup.getId()).remove());
+        }
+        realm.admin().users().get(userAlice.getId()).joinGroup(topGroup.getId());
+    }
+
+    @Test
+    public void testCanViewUserByViewGroupMembers() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+
+        // my admin should NOT be able to see Alice
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertTrue(search.isEmpty());
+
+        // allow my admin to view members of the group where Alice is member of
+        createGroupPermission(topGroup, Set.of(VIEW_MEMBERS), allowMyAdminPermission);
+
+        // my admin should be able to see Alice due to her membership and VIEW_MEMBERS permission
+        search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(1, search.size());
+        assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+    }
+
+    @Test
+    public void testCanViewUserByManageGroupMembers() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+
+        // my admin should NOT be able to see Alice
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertTrue(search.isEmpty());
+
+        // my admin should not be able to manage yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).update(UserConfigBuilder.create().email("email@test.com").build());
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // allow my admin to manage members of the group where Alice is member of
+        createGroupPermission(topGroup, Set.of(VIEW_MEMBERS, MANAGE_MEMBERS), allowMyAdminPermission);
+
+        // my admin should be able to see Alice due to her membership and MANAGE_MEMBERS permission
+        search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(1, search.size());
+        assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+
+        // my admin should be able to update Alice due to her membership and MANAGE_MEMBERS permission
+        realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).update(UserConfigBuilder.create().email("email@test.com").build());
+        assertEquals("email@test.com", realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).toRepresentation().getEmail());
+    }
+
+    @Test
+    public void testManageAllGroups() {
+        // myadmin shouldn't be able to create groups just yet
+        try (Response response = realmAdminClient.realm(realm.getName()).groups().add(new GroupRepresentation())) {
+            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        // myadmin shouldn't be able to add child for a group
+        try (Response response = realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).subGroup(new GroupRepresentation())) {
+            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        // myadmin shouldn't be able to map roles for group
+        try {
+            realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).roles().realmLevel().add(List.of());
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        //create all-groups permission for "myadmin" (so that myadmin can manage all groups in the realm)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client, "Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllGroupsPermission(policy, Set.of(VIEW, MANAGE));
+
+        // creating group requires manage scope
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("testGroup");
+        String testGroupId = ApiUtil.handleCreatedResponse(realmAdminClient.realm(realm.getName()).groups().add(group));
+        group.setId(testGroupId);
+
+        // it should be possible to update the group due to fallback to all-groups permission
+        group.setName("newGroup");
+        realmAdminClient.realm(realm.getName()).groups().group(testGroupId).update(group);
+        assertEquals("newGroup", realmAdminClient.realm(realm.getName()).groups().group(testGroupId).toRepresentation().getName());
+
+        // it should be possible to add the child to the group now
+        try (Response response = realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).subGroup(group)) {
+            assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus());
+        }
+
+        // it should be possible to map roles now
+        // trying with non existent role as we need to test manage permission for groups (not `auth.roles().requireMapRole(roleModel);`)
+        // expecting NotFoundException
+        try {
+            realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).roles().realmLevel().add(List.of(new RoleRepresentation("non_existent", null, false)));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+    }
+
+    @Test
+    public void testManageGroup() {
+        // create group
+        GroupRepresentation myGroup = new GroupRepresentation();
+        myGroup.setName("my_group");
+
+        try (Response response = realm.admin().groups().add(myGroup)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            myGroup.setId(ApiUtil.handleCreatedResponse(response));
+            realm.cleanup().add(r -> r.groups().group(myGroup.getId()).remove());
+        }
+
+        //create group permission for "myadmin" to manage the myGroup
+        UserPolicyRepresentation policy = createUserPolicy(realm, client, "Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createGroupPermission(myGroup, Set.of(VIEW, MANAGE), policy);
+
+        // myadmin shouldn't be able to update the topGroup
+        try {
+            realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).update(myGroup);
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // it should be possible to update the myGroup
+        myGroup.setName("newGroup");
+        realmAdminClient.realm(realm.getName()).groups().group(myGroup.getId()).update(myGroup);
+        assertEquals("newGroup", realmAdminClient.realm(realm.getName()).groups().group(myGroup.getId()).toRepresentation().getName());
+
+        // it should not be possible to add child to the topGroup
+        GroupRepresentation subGroup = new GroupRepresentation();
+        subGroup.setName("subGroup");
+        try (Response response = realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).subGroup(subGroup)) {
+            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        // it should be possible to add child to the myGroup
+        try (Response response = realmAdminClient.realm(realm.getName()).groups().group(myGroup.getId()).subGroup(subGroup)) {
+            assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
+        }
+
+        // it should not be possible to map roles to topGroup
+        try {
+            realmAdminClient.realm(realm.getName()).groups().group(topGroup.getId()).roles().realmLevel().add(List.of(new RoleRepresentation("non_existent", null, false)));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // it should be possible to map roles to myGroup
+        // trying with non existent role as we need to test manage permission for groups (not `auth.roles().requireMapRole(roleModel);`)
+        // expecting NotFoundException
+        try {
+            realmAdminClient.realm(realm.getName()).groups().group(myGroup.getId()).roles().realmLevel().add(List.of(new RoleRepresentation("non_existent", null, false)));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+    }
+
+    @Test
+    public void testViewGroups() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client, "Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+
+        // should not see the groups
+        List<GroupRepresentation> search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertThat(search, hasSize(0));
+
+        // create group
+        GroupRepresentation myGroup = new GroupRepresentation();
+        myGroup.setName("my_group");
+
+        try (Response response = realm.admin().groups().add(myGroup)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            myGroup.setId(ApiUtil.handleCreatedResponse(response));
+            realm.cleanup().add(r -> r.groups().group(myGroup.getId()).remove());
+        }
+
+        //create permission to view myGroup
+        createGroupPermission(myGroup, Set.of(VIEW), policy);
+
+        // myadmin should be able to view only myGroup
+        search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertThat(search, hasSize(1));
+        assertThat(search.get(0).getName(), equalTo(myGroup.getName()));
+
+        // create view all groups permission for myadmin
+        createAllGroupsPermission(policy, Set.of(VIEW));
+
+        // now two groups should be returned (myGroup, topGroup)
+        search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertThat(search, hasSize(2));
+    }
+
+    @Test
+    public void testManageGroupMembership() {
+        // myadmin shouldn't be able to manage group membership of the user just yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        //create all-users permission for "myadmin" (so that myadmin can add users into a group)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client, "Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllUserPermission(policy, Set.of(MANAGE_GROUP_MEMBERSHIP));
+
+        //create group permission to allow manage membership for the group
+        createGroupPermission(topGroup, Set.of(MANAGE_MEMBERSHIP), policy);
+
+        
+        //create new user
+        String bobId = ApiUtil.handleCreatedResponse(realm.admin().users().create(UserConfigBuilder.create().username("bob").build()));
+        realm.cleanup().add(r -> r.users().delete(bobId));
+
+        //check myadmin can manage membership
+        realmAdminClient.realm(realm.getName()).users().get(bobId).joinGroup(topGroup.getId());
+    }
+
+    @Test
+    public void testCreateGroupMembers() {
+        //create group permission for "topGroup" to allow "myadmin" view, manage-members and manage-membership
+        UserPolicyRepresentation policy = createUserPolicy(realm, client, "Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createGroupPermission(topGroup, Set.of(VIEW, MANAGE_MEMBERSHIP, MANAGE_MEMBERS), policy);
+        
+        //create new user as realm user should fail
+        try (Response response = realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username("bob").build())) {
+            assertThat(response.getStatus(), equalTo(Response.Status.FORBIDDEN.getStatusCode()));
+        }
+        //create new user as member of different group should fail
+        try (Response response = realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username("bob").groups("different_group").build())) {
+            assertThat(response.getStatus(), equalTo(Response.Status.FORBIDDEN.getStatusCode()));
+        }
+
+        String bobId = ApiUtil.handleCreatedResponse(realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username("bob").groups("/" + groupName).build()));
+        realm.cleanup().add(r -> r.users().delete(bobId));
+    }
+
+    @Test
+    public void testEvaluateAllResourcePermissionsForSpecificResourcePermission() {
+        UserRepresentation adminUser = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowPolicy = createUserPolicy(realm, client, "Only My Admin", adminUser.getId());
+        ScopePermissionRepresentation allResourcesPermission = createAllPermission(client, GROUPS_RESOURCE_TYPE, allowPolicy, Set.of(MANAGE, MANAGE_MEMBERSHIP));
+        // all resource permissions grants manage scope
+        GroupsResource groups = realmAdminClient.realm(realm.getName()).groups();
+        groups.group(topGroup.getId()).update(topGroup);
+
+        ScopePermissionRepresentation resourcePermission = createPermission(client, topGroup.getId(), GROUPS_RESOURCE_TYPE, Set.of(MANAGE), allowPolicy);
+        // both all and specific resource permission grants manage scope
+        groups.group(topGroup.getId()).update(topGroup);
+
+        allResourcesPermission = getScopePermissionsResource(client).findByName(allResourcesPermission.getName());
+        allResourcesPermission.setScopes(Set.of(MANAGE_MEMBERSHIP));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission does not have the manage scope but the scope is granted by the resource permission
+        groups.group(topGroup.getId()).update(topGroup);
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(MANAGE_MEMBERSHIP));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // neither the all and specific resource permission grants access to the manage scope
+            groups.group(topGroup.getId()).update(topGroup);
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        allResourcesPermission.setScopes(Set.of(MANAGE));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission grants access again to manage
+        groups.group(topGroup.getId()).update(topGroup);
+
+        UserPolicyRepresentation notAllowPolicy = createUserPolicy(Logic.NEGATIVE, realm, client, "Not My Admin", adminUser.getId());
+        createPermission(client, topGroup.getId(), GROUPS_RESOURCE_TYPE, Set.of(MANAGE), notAllowPolicy);
+        try {
+            // a specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            groups.group(topGroup.getId()).update(topGroup);
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(MANAGE));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // the specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            // even though there is another resource permission that grants access to the scope - conflict resolution denies by default
+            groups.group(topGroup.getId()).update(topGroup);
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+    }
+
+    @Test
+    public void testImpersonateMembers() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+
+        // my admin should not be able to manage yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // allow my admin to impersonate members of the group where Alice is member of
+        createGroupPermission(topGroup, Set.of(IMPERSONATE_MEMBERS), allowMyAdminPermission);
+
+        realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+        realmAdminClient.tokenManager().logout();
+    }
+
+    @Test
+    public void testImpersonateMembersFromChildGroups() {
+        // my admin should not be able to manage yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userJdoe.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        GroupRepresentation subGroup = new GroupRepresentation();
+        subGroup.setName("testSubGroup");
+        String testGroupId = ApiUtil.handleCreatedResponse(realm.admin().groups().add(subGroup));
+        subGroup.setId(testGroupId);
+        realm.admin().groups().group(topGroup.getId()).subGroup(subGroup).close();
+        realm.admin().users().get(userJdoe.getId()).joinGroup(subGroup.getId());
+        assertTrue(userJdoe.admin().groups().stream().map(GroupRepresentation::getName).allMatch(subGroup.getName()::equals));
+
+        // allow my admin to impersonate members of the group and its children
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createGroupPermission(topGroup, Set.of(IMPERSONATE_MEMBERS), allowMyAdminPermission);
+
+        realmAdminClient.realm(realm.getName()).users().get(userJdoe.getId()).impersonate();
+        realmAdminClient.tokenManager().logout();
+
+        UserPolicyRepresentation denyPolicy = createUserPolicy(Logic.NEGATIVE, realm, client, "Deny My Admin User Policy", myadmin.getId());
+        createPermission(client, userAlice.getId(), USERS_RESOURCE_TYPE, Set.of(IMPERSONATE), denyPolicy);
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        } finally {
+            realmAdminClient.tokenManager().logout();
+        }
+
+        realmAdminClient.realm(realm.getName()).users().get(userJdoe.getId()).impersonate();
+        realmAdminClient.tokenManager().logout();
+    }
+
+    private ScopePermissionRepresentation createAllGroupsPermission(UserPolicyRepresentation policy, Set<String> scopes) {
+        return createAllPermission(client, AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, policy, scopes);
+    }
+
+    private ScopePermissionRepresentation createAllUserPermission(UserPolicyRepresentation policy, Set<String> scopes) {
+        return createAllPermission(client, AdminPermissionsSchema.USERS_RESOURCE_TYPE, policy, scopes);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java
new file mode 100644
index 000000000000..194bddd3d983
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java
@@ -0,0 +1,172 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.GroupResource;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.util.ApiUtil;
+
+@KeycloakIntegrationTest
+public class GroupResourceTypeFilteringTest extends AbstractPermissionTest {
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    @InjectUser(ref = "alice")
+    ManagedUser userAlice;
+
+    @BeforeEach
+    public void onBeforeEach() {
+        for (int i = 0; i < 50; i++) {
+            GroupRepresentation group = new GroupRepresentation();
+
+            group.setName("group-" + i);
+
+            try (Response response = realm.admin().groups().add(group)) {
+                group.setId(ApiUtil.getCreatedId(response));
+            }
+
+            GroupResource groupResource = realm.admin().groups().group(group.getId());
+
+            for (int j = 0; j < 5; j++) {
+                GroupRepresentation subGroup = new GroupRepresentation();
+
+                subGroup.setName("subgroup-" + i + "." + j);
+
+                groupResource.subGroup(subGroup).close();
+            }
+        }
+    }
+
+    @Test
+    public void testViewAllGroupsUsingUserPolicy() {
+        List<GroupRepresentation> search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, GROUPS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+    }
+
+    @Test
+    public void testDeniedResourcesPrecedenceOverGrantedResources() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, GROUPS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        List<GroupRepresentation> search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+
+        UserPolicyRepresentation notMyAdminPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        Set<String> notAllowedGroups = search.stream()
+                .filter((g) -> Set.of("group-0", "group-15", "group-30", "group-45").contains(g.getName()))
+                .map(GroupRepresentation::getId)
+                .collect(Collectors.toSet());
+        assertFalse(notAllowedGroups.isEmpty());
+        createPermission(client, notAllowedGroups, GROUPS_RESOURCE_TYPE, Set.of(VIEW), notMyAdminPolicy);
+        search = realmAdminClient.realm(realm.getName()).groups().groups();
+        assertFalse(search.isEmpty());
+        assertTrue(search.stream().map(GroupRepresentation::getId).noneMatch(notAllowedGroups::contains));
+    }
+
+    @Test
+    public void testFilterSubGroups() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, GROUPS_RESOURCE_TYPE, policy, Set.of(VIEW));
+
+        List<GroupRepresentation> search = realmAdminClient.realm(realm.getName()).groups().groups("group-0", -1, -1);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+
+        GroupRepresentation parentGroup = search.get(0);
+        assertEquals(5, parentGroup.getSubGroups().size());
+        assertEquals(5, parentGroup.getSubGroupCount());
+        GroupRepresentation subGroup = parentGroup.getSubGroups().stream().filter(group -> group.getName().equals("subgroup-0.0")).findFirst().orElse(null);
+        assertNotNull(subGroup);
+
+        UserPolicyRepresentation notMyAdminPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, subGroup.getId(), GROUPS_RESOURCE_TYPE, Set.of(VIEW), notMyAdminPolicy);
+        search = realmAdminClient.realm(realm.getName()).groups().groups("subgroup-0.0", -1, -1);
+        assertTrue(search.isEmpty());
+
+        List<GroupRepresentation> subGroups = realmAdminClient.realm(realm.getName()).groups().group(parentGroup.getId()).getSubGroups(-1, -1, false);
+        assertEquals(4, subGroups.size());
+        assertTrue(subGroups.stream().map(GroupRepresentation::getId).noneMatch(subGroup.getId()::equals));
+        search = realmAdminClient.realm(realm.getName()).groups().groups("group-0", -1, -1);
+        assertFalse(search.isEmpty());
+        parentGroup = search.get(0);
+        assertEquals(4, parentGroup.getSubGroups().size());
+        assertEquals(4, parentGroup.getSubGroupCount());
+
+        subGroups = realmAdminClient.realm(realm.getName()).groups().group(parentGroup.getId()).getSubGroups(subGroup.getName(), true, -1, -1, true);
+        assertTrue(subGroups.isEmpty());
+        subGroups = realmAdminClient.realm(realm.getName()).groups().group(parentGroup.getId()).getSubGroups("subgroup-0.1", true, -1, -1, true);
+        assertEquals(1, subGroups.size());
+
+        assertEquals(5, realm.admin().groups().group(parentGroup.getId()).getSubGroups(-1, -1, false).size());
+        assertEquals(5, realm.admin().groups().group(parentGroup.getId()).getSubGroups(null, false, -1, -1, false).size());
+        assertEquals(5, realm.admin().groups().group(parentGroup.getId()).toRepresentation().getSubGroupCount());
+    }
+
+    @Test
+    public void testGetUserGroups() {
+        GroupRepresentation parentGroup = realm.admin().groups().groups("group-0", -1, -1).get(0);
+        GroupRepresentation subGroup = realm.admin().groups().groups("subgroup-1.0", -1, -1).get(0);
+
+        userAlice.admin().joinGroup(parentGroup.getId());
+        userAlice.admin().joinGroup(subGroup.getId());
+
+        List<GroupRepresentation> groups = userAlice.admin().groups();
+        assertEquals(2, groups.size());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, userAlice.getId(), USERS_RESOURCE_TYPE, Set.of(VIEW), policy);
+        createPermission(client, subGroup.getId(), GROUPS_RESOURCE_TYPE, Set.of(VIEW), policy);
+
+        groups = realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).groups();
+        assertEquals(1, groups.size());
+
+        groups = userAlice.admin().groups();
+        assertEquals(2, groups.size());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypePermissionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypePermissionTest.java
new file mode 100644
index 000000000000..909a0387f4ad
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypePermissionTest.java
@@ -0,0 +1,165 @@
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import jakarta.ws.rs.core.Response;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ScopePermissionResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation.GroupDefinition;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.util.ApiUtil;
+
+@KeycloakIntegrationTest
+public class GroupResourceTypePermissionTest extends AbstractPermissionTest {
+
+    @BeforeEach
+    public void onBefore() {
+        UserPolicyRepresentation policy = new UserPolicyRepresentation();
+        policy.setName("User Policy");
+        client.admin().authorization().policies().user().create(policy).close();
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("MyGroup");
+        realm.admin().groups().add(group).close();;
+    }
+
+    @Test
+    public void testCreateResourceTypePermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        ScopePermissionRepresentation expected = createAllPermission(client, AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, onlyMyAdminUserPolicy, AdminPermissionsSchema.GROUPS.getScopes());
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.GROUPS.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, permission.resources().get(0).getDisplayName());
+    }
+
+    @Test
+    public void testCreateResourceObjectPermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        GroupRepresentation group = realm.admin().groups().groups().get(0);
+        ScopePermissionRepresentation expected = createPermission(client, group.getId(), AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, AdminPermissionsSchema.GROUPS.getScopes(), onlyMyAdminUserPolicy);
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.GROUPS.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(group.getName(), permission.resources().get(0).getDisplayName());
+    }
+ 
+    @Test
+    public void testRemoveGroup() {
+        //create groups
+        GroupRepresentation topGroup = new GroupRepresentation();
+        topGroup.setName("topGroup");
+        try (Response response = realm.admin().groups().add(topGroup)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            topGroup.setId(ApiUtil.handleCreatedResponse(response));
+            realm.cleanup().add(r -> r.groups().group(topGroup.getId()).remove());
+        }
+        GroupRepresentation topGroup1 = new GroupRepresentation();
+        topGroup1.setName("topGroup1");
+        try (Response response = realm.admin().groups().add(topGroup1)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            topGroup1.setId(ApiUtil.handleCreatedResponse(response));
+        }
+
+        //create group policies
+        createGroupPolicy("Only topGroup or topGroup1 Group Policy", topGroup.getId(), topGroup1.getId());
+        createGroupPolicy("Only topGroup1 Group Policy", topGroup1.getId());
+
+        //create group permissions
+        createGroupPermission(topGroup, topGroup1);
+        createGroupPermission(topGroup1);
+        
+        List<PolicyRepresentation> policies = getPolicies().policies(null, "Only", "group", null, null, null, null, null, null, null);
+        assertThat(policies, hasSize(2));
+        assertThat(policies.get(0).getConfig().get("groups"), containsString(topGroup1.getId()));
+        assertThat(policies.get(1).getConfig().get("groups"), containsString(topGroup1.getId()));
+
+        List<ScopePermissionRepresentation> permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(2));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(topGroup1.getId()));
+        assertThat(getPolicies().policy(permissions.get(1).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(topGroup1.getId()));
+
+        //remove group
+        realm.admin().groups().group(topGroup1.getId()).remove();
+
+        //check the resource was removed from policies
+        GroupPolicyRepresentation groupPolicy = getPolicies().group().findByName("Only topGroup or topGroup1 Group Policy");
+        assertThat(groupPolicy, notNullValue());
+        Set<String> groupIds = groupPolicy.getGroups().stream().map(GroupDefinition::getId).collect(Collectors.toSet());
+        assertThat(groupIds, not(contains(topGroup1.getId())));
+
+        GroupPolicyRepresentation groupPolicy1 = getPolicies().group().findByName("Only topGroup1 Group Policy");
+        assertThat(groupPolicy1, notNullValue());
+        assertThat(groupPolicy1.getGroups().stream().map(GroupDefinition::getId).collect(Collectors.toSet()), empty());
+
+        //there should be 1 permission left
+        permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(1));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), not(hasItem(topGroup1.getId())));
+    }
+
+    private ScopePermissionRepresentation createGroupPermission(GroupRepresentation... groups) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.GROUPS.getType())
+                .resources(Arrays.stream(groups).map(GroupRepresentation::getId).collect(Collectors.toSet()))
+                .scopes(AdminPermissionsSchema.GROUPS.getScopes())
+                .addPolicies(List.of("User Policy"))
+                .build();
+
+        createPermission(client, permission);
+
+        return permission;
+    }
+
+    private GroupPolicyRepresentation createGroupPolicy(String name, String... groupIds) {
+        GroupPolicyRepresentation policy = new GroupPolicyRepresentation();
+        policy.setName(name);
+        policy.addGroup(groupIds);
+        policy.setLogic(Logic.POSITIVE);
+        try (Response response = client.admin().authorization().policies().group().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                GroupPolicyRepresentation groupPolicy = client.admin().authorization().policies().group().findByName(name);
+                if (groupPolicy != null) {
+                    client.admin().authorization().policies().group().findById(groupPolicy.getId()).remove();
+                }
+            });
+        }
+        return policy;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/KeycloakAdminPermissionsServerConfig.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/KeycloakAdminPermissionsServerConfig.java
deleted file mode 100644
index f2182d39cc36..000000000000
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/KeycloakAdminPermissionsServerConfig.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.tests.admin.authz.fgap;
-
-import org.keycloak.common.Profile.Feature;
-import org.keycloak.testframework.server.KeycloakServerConfig;
-import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
-
-public class KeycloakAdminPermissionsServerConfig implements KeycloakServerConfig {
-
-    @Override
-    public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
-        return config.features(Feature.ADMIN_FINE_GRAINED_AUTHZ_V2);
-    }
-}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionClientTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionClientTest.java
deleted file mode 100644
index 664220e0fd9a..000000000000
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionClientTest.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.tests.admin.authz.fgap;
-
-import static org.hamcrest.CoreMatchers.not;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-import java.util.function.Supplier;
-
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.Response.Status;
-import org.junit.jupiter.api.Test;
-import org.keycloak.authorization.AdminPermissionsSchema;
-import org.keycloak.representations.idm.authorization.AggregatePolicyRepresentation;
-import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.ClientScopePolicyRepresentation;
-import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.JSPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.PolicyRepresentation;
-import org.keycloak.representations.idm.authorization.RegexPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation;
-import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
-import org.keycloak.representations.idm.authorization.TimePolicyRepresentation;
-import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
-import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
-
-@KeycloakIntegrationTest(config = KeycloakAdminPermissionsServerConfig.class)
-public class PermissionClientTest extends AbstractPermissionTest {
-
-    @Test
-    public void testUnsupportedPolicyTypes() {
-        assertSupportForPolicyType("resource", () -> getPermissionsResource().resource().create(new ResourcePermissionRepresentation()), false);
-    }
-
-    @Test
-    public void testSupportedPolicyTypes() {
-        assertSupportForPolicyType("scope", () -> getPermissionsResource().scope().create(PermissionBuilder.create()
-                .resourceType(AdminPermissionsSchema.USERS.getType())
-                .scopes(AdminPermissionsSchema.USERS.getScopes())
-                .build()), true);
-        assertSupportForPolicyType("user", () -> getPolicies().user().create(new UserPolicyRepresentation()), true);
-        assertSupportForPolicyType("client", () -> getPolicies().client().create(new ClientPolicyRepresentation()), true);
-        assertSupportForPolicyType("group", () -> getPolicies().group().create(new GroupPolicyRepresentation()), true);
-        assertSupportForPolicyType("role", () -> getPolicies().role().create(new RolePolicyRepresentation()), true);
-        assertSupportForPolicyType("aggregate", () -> getPolicies().aggregate().create(new AggregatePolicyRepresentation()), true);
-        assertSupportForPolicyType("client-scope", () -> getPolicies().clientScope().create(new ClientScopePolicyRepresentation()), true);
-        assertSupportForPolicyType("js", () -> getPolicies().js().create(new JSPolicyRepresentation()), true);
-        assertSupportForPolicyType("regex", () -> getPolicies().regex().create(new RegexPolicyRepresentation()), true);
-        assertSupportForPolicyType("time", () -> getPolicies().time().create(new TimePolicyRepresentation()), true);
-    }
-
-    private void assertSupportForPolicyType(String type, Supplier<Response> operation, boolean supported) {
-        try (Response response = operation.get()) {
-            assertPolicyEndpointResponse(type, supported, response);
-        }
-
-        PolicyRepresentation representation = new PolicyRepresentation();
-
-        representation.setType(type);
-
-        try (Response response = getPolicies().create(representation)) {
-            assertPolicyEndpointResponse(type, supported, response);
-        }
-    }
-
-    private void assertPolicyEndpointResponse(String type, boolean supported, Response response) {
-        assertThat("Policy type [" + type + "] should be " + (supported ? "supported" : "unsupported"), Status.BAD_REQUEST.equals(Status.fromStatusCode(response.getStatus())), not(supported));
-        assertThat("Policy type [" + type + "] should be " + (supported ? "supported" : "unsupported"), response.readEntity(String.class).contains("Policy type not supported by feature"), not(supported));
-    }
-}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java
index c463f5abeb86..0c2bc6df3590 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/PermissionRESTTest.java
@@ -24,8 +24,11 @@
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.instanceOf;
 import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.fail;
 import org.junit.jupiter.api.Test;
-import org.keycloak.authorization.AdminPermissionsSchema;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.authorization.DecisionStrategy;
 import org.keycloak.representations.idm.authorization.PolicyEnforcementMode;
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
@@ -35,12 +38,29 @@
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
 import org.keycloak.testframework.realm.ManagedUser;
 
-@KeycloakIntegrationTest(config = KeycloakAdminPermissionsServerConfig.class)
+@KeycloakIntegrationTest
 public class PermissionRESTTest extends AbstractPermissionTest {
 
     @InjectUser(ref = "alice")
     private ManagedUser userAlice;
 
+    @Test
+    public void testPreventDeletingAdminPermissionsClient() {
+        try {
+            client.admin().remove();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(BadRequestException.class));
+        }
+    }
+
+    @Test
+    public void testManageNotAllowedForAdminPermissionsClient() {
+        ClientRepresentation representation = client.admin().toRepresentation();
+        assertFalse(representation.getAccess().get("manage"));
+        assertFalse(representation.getAccess().get("configure"));
+    }
+
     @Test
     public void resourceServerTest() {
         ResourceServerRepresentation rep = new ResourceServerRepresentation();
@@ -49,18 +69,21 @@ public void resourceServerTest() {
 
         try {
             client.admin().authorization().update(rep);
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
 
         try {
             client.admin().authorization().exportSettings();
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
 
         try {
             client.admin().authorization().importSettings(rep);
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
@@ -80,12 +103,14 @@ public void scopesTest() {
 
         try {
             client.admin().authorization().scopes().scope(manage.getId()).update(manage);
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
 
         try {
             client.admin().authorization().scopes().scope(manage.getId()).remove();
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
@@ -106,6 +131,7 @@ public void resourcesTest() {
         // updates to 'all resource type' resources not expected
         try {
             client.admin().authorization().resources().resource(usersResource.getId()).update(resourceRep);
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
@@ -113,12 +139,13 @@ public void resourcesTest() {
         // deletes to 'all resource type' resources not expected
         try {
             client.admin().authorization().resources().resource(usersResource.getId()).remove();
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
 
         // this should create a resource for userAlice
-        createPermission(PermissionBuilder.create()
+        createPermission(client, PermissionBuilder.create()
                 .resourceType(AdminPermissionsSchema.USERS.getType())
                 .resources(Set.of(userAlice.getUsername()))
                 .scopes(AdminPermissionsSchema.USERS.getScopes())
@@ -132,6 +159,7 @@ public void resourcesTest() {
         // updates not expected 
         try {
             client.admin().authorization().resources().resource(aliceResourceId).update(userAliceResourceRep);
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
@@ -139,6 +167,7 @@ public void resourcesTest() {
         // delete not expected 
         try {
             client.admin().authorization().resources().resource(aliceResourceId).remove();
+            fail("Expected Exception wasn't thrown.");
         } catch (Exception ex) {
             assertThat(ex, instanceOf(BadRequestException.class));
         }
@@ -147,17 +176,17 @@ public void resourcesTest() {
     @Test
     public void permissionsTest() {
         // no resourceType, valid scopes
-        createPermission(PermissionBuilder.create()
+        createPermission(client, PermissionBuilder.create()
                 .scopes(AdminPermissionsSchema.USERS.getScopes())
                 .build(), Response.Status.BAD_REQUEST);
 
         // valid resourceType, no scopes
-        createPermission(PermissionBuilder.create()
+        createPermission(client, PermissionBuilder.create()
                 .resourceType(AdminPermissionsSchema.USERS.getType())
                 .build(), Response.Status.BAD_REQUEST);
 
         // valid resourceType, non-existent scopes
-        createPermission(PermissionBuilder.create()
+        createPermission(client, PermissionBuilder.create()
                 .resourceType(AdminPermissionsSchema.USERS.getType())
                 .scopes(Set.of("edit", "write", "token-exchange"))
                 .build(), Response.Status.BAD_REQUEST);
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RealmAdminPermissionsConfig.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RealmAdminPermissionsConfig.java
index 269604055fd0..dffb181ab326 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RealmAdminPermissionsConfig.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RealmAdminPermissionsConfig.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.tests.admin.authz.fgap;
 
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
 import org.keycloak.testframework.realm.RealmConfig;
 import org.keycloak.testframework.realm.RealmConfigBuilder;
 
@@ -24,6 +26,22 @@ public class RealmAdminPermissionsConfig implements RealmConfig {
 
     @Override
     public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+        realm.addUser("myadmin")
+                .name("My", "Admin")
+                .email("myadmin@localhost")
+                .emailVerified()
+                .password("password")
+                .clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, 
+                        AdminRoles.QUERY_USERS,
+                        AdminRoles.QUERY_GROUPS,
+                        AdminRoles.QUERY_CLIENTS);
+        realm.addClient("myclient")
+                .secret("mysecret")
+                .directAccessGrants();
+        realm.addClient("myresourceserver")
+                .secret("mysecret")
+                .directAccessGrants()
+                .authorizationServices();
         return realm.adminPermissionsEnabled(true);
     }
 }
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypeEvaluationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypeEvaluationTest.java
new file mode 100644
index 000000000000..5206e243ccb7
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypeEvaluationTest.java
@@ -0,0 +1,197 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import jakarta.ws.rs.ForbiddenException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.ClientScopeResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.util.ApiUtil;
+
+import java.util.List;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.fail;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_CLIENT_SCOPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLE_COMPOSITE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+import org.keycloak.models.AdminRoles;
+
+@KeycloakIntegrationTest
+public class RoleResourceTypeEvaluationTest extends AbstractPermissionTest {
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    private final String rolesType = AdminPermissionsSchema.ROLES.getType();
+
+    @Test
+    public void testMapRoleClientScopeAllRoles() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        // we need to be able to list client scopes
+        createAllPermission(client, AdminPermissionsSchema.CLIENTS.getType(), onlyMyAdminUserPolicy, Set.of(VIEW));
+
+        // create a client-scope
+        ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
+        clientScope.setName("my-client-scope");
+        clientScope.setProtocol("openid-connect");
+        try (Response response = realm.admin().clientScopes().create(clientScope)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            clientScope.setId(ApiUtil.handleCreatedResponse(response));
+            realm.cleanup().add(r -> r.clientScopes().get(clientScope.getId()).remove());
+        }
+
+        // we don't have permissions to map roles to a client scope so the list of available roles should be empty
+        ClientScopeResource clientScopeResource = realmAdminClient.realm(realm.getName()).clientScopes().get(clientScope.getId());
+        List<RoleRepresentation> availableRoles = clientScopeResource.getScopeMappings().realmLevel().listAvailable();
+        assertThat(availableRoles, empty());
+
+        // grant the permission to map all roles to client scopes
+        createAllPermission(client, rolesType, onlyMyAdminUserPolicy, Set.of(MAP_ROLE_CLIENT_SCOPE));
+
+        availableRoles = clientScopeResource.getScopeMappings().realmLevel().listAvailable();
+        assertThat(availableRoles, not(empty()));
+    }
+
+    @Test
+    public void testMapCompositeRoleAllRoles() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        // create a role and sub-role
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName("myRole");
+        realm.admin().roles().create(role);
+        realm.cleanup().add(r -> r.roles().get("myRole").remove());
+
+        RoleRepresentation subRole = new RoleRepresentation();
+        subRole.setName("mySubRole");
+        realm.admin().roles().create(subRole);
+        subRole = realm.admin().roles().get("mySubRole").toRepresentation();
+        realm.cleanup().add(r -> r.roles().get("mySubRole").remove());
+
+        // the following operation should fail as the permission wasn't granted yet
+        try {
+            realmAdminClient.realm(realm.getName()).roles().get("myRole").addComposites(List.of(subRole));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        String clientId = realm.admin().clients().findByClientId("realm-management").get(0).getId();
+        RoleRepresentation manageRealmRole = realm.admin().clients().get(clientId).roles().get("manage-realm").toRepresentation();
+        realm.admin().users().get(myadmin.getId()).roles().clientLevel(clientId).add(List.of(manageRealmRole));
+        realmAdminClient.tokenManager().grantToken();
+
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createAllPermission(client, rolesType, onlyMyAdminUserPolicy, Set.of(MAP_ROLE_COMPOSITE));
+
+        realmAdminClient.realm(realm.getName()).roles().get("myRole").addComposites(List.of(subRole));
+    }
+
+    @Test
+    public void testMapRoleOnlySpecificRole() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+
+        // create some roles
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName("myRole");
+        realm.admin().roles().create(role);
+        role = realm.admin().roles().get("myRole").toRepresentation();
+        realm.cleanup().add(r -> r.roles().get("myRole").remove());
+
+        RoleRepresentation otherRole = new RoleRepresentation();
+        otherRole.setName("otherRole");
+        realm.admin().roles().create(otherRole);
+        otherRole = realm.admin().roles().get("otherRole").toRepresentation();
+        realm.cleanup().add(r -> r.roles().get("otherRole").remove());
+
+        // the following operation should fail as the permission wasn't granted yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().realmLevel().add(List.of(role));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // create required permissions
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createPermission(client, role.getId(), rolesType, Set.of(MAP_ROLE), onlyMyAdminUserPolicy);
+        createPermission(client, myadmin.getId(), AdminPermissionsSchema.USERS_RESOURCE_TYPE, Set.of(MAP_ROLES), onlyMyAdminUserPolicy);
+
+        // should pass
+        realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().realmLevel().add(List.of(role));
+
+        // the following operation should fail as there is no permission for "otherRole"
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().realmLevel().add(List.of(otherRole));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+    }
+
+    @Test
+    public void testMappingAdminRoles() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        ClientRepresentation realmManagement = realm.admin().clients().findByClientId("realm-management").get(0);
+        RoleRepresentation createClientRole = realm.admin().clients().get(realmManagement.getId()).roles().get(AdminRoles.CREATE_CLIENT).toRepresentation();
+
+        // create permission to map roles from all clients and to all users
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        createAllPermission(client, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, onlyMyAdminUserPolicy, Set.of(MAP_ROLES));
+        createAllPermission(client, AdminPermissionsSchema.USERS_RESOURCE_TYPE, onlyMyAdminUserPolicy, Set.of(MAP_ROLES));
+
+        // create a role
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName("myRole");
+        ClientRepresentation myclient = realm.admin().clients().findByClientId("myclient").get(0);
+        realm.admin().clients().get(myclient.getId()).roles().create(role);
+        role = realm.admin().clients().get(myclient.getId()).roles().get("myRole").toRepresentation();
+
+        // should pass
+        realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().clientLevel(myclient.getId()).add(List.of(role));
+
+        // should fail as it is admin role and myadmin does not have master realm admin role assigned
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(myadmin.getId()).roles().clientLevel(realmManagement.getId())
+                    .add(List.of(createClientRole));
+            fail("Expected exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypePermissionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypePermissionTest.java
new file mode 100644
index 000000000000..d3933442537b
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/RoleResourceTypePermissionTest.java
@@ -0,0 +1,169 @@
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import jakarta.ws.rs.core.Response;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ScopePermissionResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation.RoleDefinition;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedClient;
+
+@KeycloakIntegrationTest
+public class RoleResourceTypePermissionTest extends AbstractPermissionTest {
+
+    @InjectClient(ref = "testClient")
+    ManagedClient testClient;
+
+    @BeforeEach
+    public void onBefore() {
+        UserPolicyRepresentation policy = new UserPolicyRepresentation();
+        policy.setName("User Policy");
+        client.admin().authorization().policies().user().create(policy).close();
+    }
+
+    @Test
+    public void testCreateResourceTypePermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        ScopePermissionRepresentation expected = createAllPermission(client, AdminPermissionsSchema.ROLES_RESOURCE_TYPE, onlyMyAdminUserPolicy, AdminPermissionsSchema.ROLES.getScopes());
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.ROLES.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(AdminPermissionsSchema.ROLES_RESOURCE_TYPE, permission.resources().get(0).getDisplayName());
+    }
+
+    @Test
+    public void testCreateResourceObjectPermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation onlyMyAdminUserPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        RoleRepresentation role = realm.admin().roles().list().get(0);
+        ScopePermissionRepresentation expected = createPermission(client, role.getId(), AdminPermissionsSchema.ROLES_RESOURCE_TYPE, AdminPermissionsSchema.ROLES.getScopes(), onlyMyAdminUserPolicy);
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
+        assertEquals(1, result.size());
+        ScopePermissionRepresentation permissionRep = result.get(0);
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
+        assertEquals(expected.getName(), permissionRep.getName());
+        assertEquals(AdminPermissionsSchema.ROLES.getScopes().size(), permission.scopes().size());
+        assertEquals(1, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(role.getName(), permission.resources().get(0).getDisplayName());
+    }
+
+    @Test
+    public void testRemoveRole() {
+        //create roles
+        RoleRepresentation realmRole = new RoleRepresentation();
+        realmRole.setName("realmRole");
+        try {
+            realm.admin().roles().create(realmRole);
+            realmRole.setId(realm.admin().roles().get(realmRole.getName()).toRepresentation().getId());
+        } finally {
+            realm.cleanup().add(r -> r.roles().deleteRole(realmRole.getName()));
+        }
+
+        RoleRepresentation clientRole = new RoleRepresentation();
+        clientRole.setName("clientRole");
+        clientRole.setClientRole(Boolean.TRUE);
+        clientRole.setContainerId(testClient.getId());
+        realm.admin().roles().create(clientRole);
+        clientRole.setId(realm.admin().roles().get(clientRole.getName()).toRepresentation().getId());
+
+        //create role policies
+        createRolePolicy("Only realmRole or clientRole Role Policy", realmRole.getId(), clientRole.getId());
+        createRolePolicy("Only clientRole Role Policy", clientRole.getId());
+
+        //create role permissions
+        createRolePermission(realmRole, clientRole);
+        createRolePermission(clientRole);
+        
+        List<PolicyRepresentation> policies = getPolicies().policies(null, "Only", "role", null, null, null, null, null, null, null);
+        assertThat(policies, hasSize(2));
+        assertThat(policies.get(0).getConfig().get("roles"), containsString(clientRole.getId()));
+        assertThat(policies.get(1).getConfig().get("roles"), containsString(clientRole.getId()));
+
+        List<ScopePermissionRepresentation> permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(2));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(clientRole.getId()));
+        assertThat(getPolicies().policy(permissions.get(1).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(clientRole.getId()));
+
+        //remove role
+        realm.admin().roles().get(clientRole.getName()).remove();
+
+        //check the resource was removed from policies
+        RolePolicyRepresentation rolePolicy = getPolicies().role().findByName("Only realmRole or clientRole Role Policy");
+        assertThat(rolePolicy, notNullValue());
+        Set<String> roleIds = rolePolicy.getRoles().stream().map(RoleDefinition::getId).collect(Collectors.toSet());
+        assertThat(roleIds, not(contains(clientRole.getId())));
+
+        RolePolicyRepresentation rolePolicy1 = getPolicies().role().findByName("Only clientRole Role Policy");
+        assertThat(rolePolicy1, notNullValue());
+        assertThat(rolePolicy1.getRoles().stream().map(RoleDefinition::getId).collect(Collectors.toSet()), empty());
+
+        //there should be 1 permission left
+        permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(1));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), not(hasItem(clientRole.getId())));
+    }
+
+    private ScopePermissionRepresentation createRolePermission(RoleRepresentation... roles) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.ROLES.getType())
+                .resources(Arrays.stream(roles).map(RoleRepresentation::getId).collect(Collectors.toSet()))
+                .scopes(AdminPermissionsSchema.ROLES.getScopes())
+                .addPolicies(List.of("User Policy"))
+                .build();
+
+        createPermission(client, permission);
+
+        return permission;
+    }
+
+    private RolePolicyRepresentation createRolePolicy(String name, String... roleIds) {
+        RolePolicyRepresentation policy = new RolePolicyRepresentation();
+        policy.setName(name);
+        for (String roleId : roleIds) {
+            policy.addRole(roleId);
+        }
+        policy.setLogic(Logic.POSITIVE);
+        try (Response response = client.admin().authorization().policies().role().create(policy)) {
+            assertThat(response.getStatus(), equalTo(Response.Status.CREATED.getStatusCode()));
+            realm.cleanup().add(r -> {
+                RolePolicyRepresentation rolePolicy = client.admin().authorization().policies().role().findByName(name);
+                if (rolePolicy != null) {
+                    client.admin().authorization().policies().role().findById(rolePolicy.getId()).remove();
+                }
+            });
+        }
+        return policy;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationSpecTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationSpecTest.java
new file mode 100644
index 000000000000..1b0ababa4ca7
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationSpecTest.java
@@ -0,0 +1,1051 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_MEMBERS;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.stream.Stream;
+
+import jakarta.ws.rs.ForbiddenException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionEffect;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationRequest;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse.EvaluationResultRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+import org.keycloak.representations.idm.authorization.ScopeRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedUser;
+
+@KeycloakIntegrationTest
+public class UserResourceTypeEvaluationSpecTest extends AbstractPermissionTest {
+
+    @InjectUser(ref = "alice")
+    ManagedUser userAlice;
+
+    @InjectUser(ref = "bob")
+    ManagedUser userBob;
+
+    @InjectUser(ref = "jdoe")
+    ManagedUser userJdoe;
+
+    @InjectUser(ref = "tom")
+    ManagedUser userTom;
+
+    @InjectUser(ref = "mary")
+    ManagedUser userMary;
+
+    ManagedUser myadmin;
+
+    private List<ManagedUser> ALL_GROUP_MEMBERS;
+    private List<ManagedUser> ALL_USERS;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    private UserPolicyRepresentation allowPolicy;
+    private UserPolicyRepresentation denyPolicy;
+
+    @BeforeEach
+    public void onBefore() {
+        Map<String, List<ManagedUser>> groupMembers = new HashMap<>();
+
+        groupMembers.put("group-0", List.of(userAlice));
+        groupMembers.put("group-1", List.of(userBob));
+        groupMembers.put("group-2", List.of(userMary, userTom));
+
+        for (Entry<String, List<ManagedUser>> group : groupMembers.entrySet()) {
+            String name = group.getKey();
+
+            GroupRepresentation rep = new GroupRepresentation();
+            rep.setName(name);
+            realm.admin().groups().add(rep).close();
+
+            List<ManagedUser> members = group.getValue();
+
+            for (ManagedUser member : members) {
+                joinGroup(member, name);
+            }
+        }
+
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        allowPolicy = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        denyPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", myadmin.getId());
+        this.myadmin = new ManagedUser(myadmin, realm.admin().users().get(myadmin.getId()));
+
+        ALL_USERS = new ArrayList<>();
+        groupMembers.values().forEach(ALL_USERS::addAll);
+        ALL_USERS.add(this.myadmin);
+        ALL_USERS.add(userJdoe);
+        ALL_GROUP_MEMBERS = groupMembers.values().stream().flatMap(Collection::stream).toList();
+    }
+
+    @Test
+    public void test_01() {
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_02() {
+        allowAllGroups();
+
+        assertFilter(ALL_GROUP_MEMBERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_03() {
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_04() {
+        allowGroup("group-0");
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_05() {
+        allowGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(ALL_GROUP_MEMBERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_06() {
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_07() {
+        denyGroup("group-0");
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_08() {
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userBob, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_09() {
+        denyGroup("group-0");
+        denyAllGroups();
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertThat(search.isEmpty(), is(true));
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_10() {
+        allowAllUsers();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_11() {
+        allowAllUsers();
+        allowAllGroups();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_12() {
+        allowAllUsers();
+        denyAllGroups();
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertThat(search.stream().map(UserRepresentation::getUsername).toList(), containsInAnyOrder(userJdoe.getUsername(), "myadmin"));
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_13() {
+        allowAllUsers();
+        allowGroup("group-0");
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_14() {
+        allowAllUsers();
+        allowGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_15() {
+        allowAllUsers();
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userAlice, userJdoe, myadmin);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_16() {
+        allowAllUsers();
+        denyGroup("group-0");
+
+        assertFilter(userBob, userJdoe, myadmin, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_17() {
+        allowAllUsers();
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userBob, userJdoe, myadmin, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_18() {
+        allowAllUsers();
+        denyGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userJdoe, myadmin);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_19() {
+        denyAllUsers();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_20() {
+        denyAllUsers();
+        allowAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_21() {
+        denyAllUsers();
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_22() {
+        denyAllUsers();
+        allowGroup("group-0");
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_23() {
+        denyAllUsers();
+        allowGroup("group-0");
+        allowAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_24() {
+        denyAllUsers();
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_25() {
+        denyAllUsers();
+        denyGroup("group-0");
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_26() {
+        denyAllUsers();
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_27() {
+        denyAllUsers();
+        denyGroup("group-0");
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_28() {
+        allowUser(userAlice);
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_29() {
+        allowUser(userAlice);
+        allowAllGroups();
+
+        assertFilter(userAlice, userBob, userTom, userMary);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_30() {
+        allowUser(userAlice);
+        denyAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_31() {
+        allowUser(userAlice);
+        allowGroup("group-1");
+
+        assertFilter(userAlice, userBob);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_32() {
+        allowUser(userAlice);
+        allowGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userAlice, userBob, userTom, userMary);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_33() {
+        allowUser(userAlice);
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_33_a() {
+        allowUser(userAlice);
+        allowGroup("group-1");
+        denyAllGroups();
+
+        assertFilter(userAlice, userBob);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_34() {
+        allowUser(userAlice);
+        denyGroup("group-0");
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_35() {
+        allowUser(userAlice);
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userBob, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_35_a() {
+        allowUser(userAlice);
+        denyGroup("group-1");
+        allowAllGroups();
+
+        assertFilter(userAlice, userTom, userMary);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_36() {
+        allowUser(userAlice);
+        denyGroup("group-0");
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_37() {
+        allowUser(userAlice);
+        allowAllUsers();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_38() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowAllGroups();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_39() {
+        allowUser(userAlice);
+        allowAllUsers();
+        denyAllGroups();
+
+        assertFilter(userAlice, userJdoe, myadmin);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_40() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowGroup("group-0");
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_40_a() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowGroup("group-1");
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_41() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowGroup("group-1");
+        allowAllGroups();
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_42() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userAlice, userJdoe, myadmin);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_42_a() {
+        allowUser(userAlice);
+        allowAllUsers();
+        allowGroup("group-1");
+
+        assertFilter(ALL_USERS);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_43() {
+        allowUser(userAlice);
+        allowAllUsers();
+        denyGroup("group-0");
+
+        assertFilter(userBob, userJdoe, myadmin, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_44() {
+        allowUser(userAlice);
+        allowAllUsers();
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userBob, userJdoe, myadmin, userTom, userMary);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, true);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_45() {
+        allowUser(userAlice);
+        allowAllUsers();
+        denyGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userJdoe, myadmin);
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, true);
+    }
+
+    @Test
+    public void test_46() {
+        allowUser(userAlice);
+        denyAllUsers();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_47() {
+        allowUser(userAlice);
+        denyAllUsers();
+        allowAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_48() {
+        allowUser(userAlice);
+        denyAllUsers();
+        denyAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_49() {
+        allowUser(userAlice);
+        denyAllUsers();
+        allowGroup("group-0");
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_49_a() {
+        allowUser(userAlice);
+        denyAllUsers();
+        allowGroup("group-1");
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_50() {
+        allowUser(userAlice);
+        denyAllUsers();
+        allowGroup("group-0");
+        allowAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_51() {
+        allowUser(userAlice);
+        denyAllUsers();
+        allowGroup("group-0");
+        denyAllGroups();
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_52() {
+        allowUser(userAlice);
+        denyAllUsers();
+        denyGroup("group-0");
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_52_a() {
+        allowUser(userAlice);
+        denyAllUsers();
+        denyGroup("group-1");
+
+        assertFilter(userAlice);
+
+        assertUpdate(userAlice, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_53() {
+        allowUser(userAlice);
+        denyAllUsers();
+        denyGroup("group-0");
+        allowAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_54() {
+        allowUser(userAlice);
+        denyAllUsers();
+        denyGroup("group-0");
+        denyAllGroups();
+
+        assertFilter();
+
+        assertUpdate(userAlice, false);
+        assertUpdate(userBob, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_55() {
+        allowAllUsers();
+        denyUser(userAlice);
+        denyUser(userJdoe);
+
+        assertFilter(userBob, myadmin, userMary, userTom);
+
+        assertUpdate(userBob, true);
+        assertUpdate(userAlice, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_56() {
+        allowUser(userJdoe);
+        denyUser(userBob);
+
+        assertFilter(userJdoe);
+
+        assertUpdate(userJdoe, true);
+        assertUpdate(userBob, false);
+        assertUpdate(userAlice, false);
+    }
+
+    @Test
+    public void test_57() {
+        denyUser(userAlice);
+        denyUser(userJdoe);
+
+        assertFilter();
+
+        assertUpdate(userBob, false);
+        assertUpdate(userAlice, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_58() {
+        denyUser(userTom);
+        allowGroup("group-2");
+
+        assertFilter(userMary);
+
+        assertUpdate(userMary, true);
+        assertUpdate(userTom, false);
+        assertUpdate(userJdoe, false);
+    }
+
+    @Test
+    public void test_59() {
+        allowAllUsers();
+        denyUser(userTom);
+        allowGroup("group-1");
+
+        assertFilter(userAlice, userBob, userMary, userJdoe, myadmin);
+
+        assertUpdate(userMary, true);
+        assertUpdate(userJdoe, true);
+        assertUpdate(userTom, false);
+    }
+
+    @Test
+    public void test_60() {
+        allowAllUsers();
+        denyUser(userTom);
+        allowGroup("group-1");
+        denyGroup("group-2");
+
+        assertFilter(userAlice, userBob, userJdoe, myadmin);
+
+        assertUpdate(userJdoe, true);
+        assertUpdate(userMary, false);
+        assertUpdate(userTom, false);
+    }
+
+    private void denyUser(ManagedUser user) {
+        createPermission(client, user.getId(), USERS_RESOURCE_TYPE, Set.of(VIEW, MANAGE), denyPolicy);
+    }
+
+    private void allowAllUsers() {
+        createAllPermission(client, USERS_RESOURCE_TYPE, allowPolicy, Set.of(VIEW, MANAGE));
+    }
+
+    private void allowUser(ManagedUser user) {
+        createPermission(client, user.getId() , USERS_RESOURCE_TYPE, Set.of(VIEW, MANAGE), allowPolicy);
+    }
+
+    private void denyAllUsers() {
+        createAllPermission(client, USERS_RESOURCE_TYPE, denyPolicy, Set.of(VIEW, MANAGE));
+    }
+
+    private void allowGroup(String name) {
+        createPermission(client, getGroup(name).getId() ,GROUPS_RESOURCE_TYPE, Set.of(VIEW_MEMBERS, MANAGE_MEMBERS), allowPolicy);
+    }
+
+    private void denyAllGroups() {
+        createAllPermission(client, GROUPS_RESOURCE_TYPE, denyPolicy, Set.of(VIEW_MEMBERS, MANAGE_MEMBERS));
+    }
+
+    private void allowAllGroups() {
+        createAllPermission(client, GROUPS_RESOURCE_TYPE, allowPolicy, Set.of(VIEW_MEMBERS, MANAGE_MEMBERS));
+    }
+
+    private void denyGroup(String groupName) {
+        createPermission(client, getGroup(groupName).getId() ,GROUPS_RESOURCE_TYPE, Set.of(VIEW_MEMBERS, MANAGE_MEMBERS), denyPolicy);
+    }
+
+    private GroupRepresentation getGroup(String groupName) {
+        return realm.admin().groups().groups(groupName, -1, -1).get(0);
+    }
+
+    private void joinGroup(ManagedUser user, String groupName) {
+        String groupId = getGroup(groupName).getId();
+        realm.admin().users().get(user.getId()).joinGroup(groupId);
+    }
+
+    private void assertUpdate(ManagedUser user, boolean success) {
+        if (success) {
+            realmAdminClient.realm(realm.getName()).users().get(user.getId()).update(user.admin().toRepresentation());
+            assertEvaluation(user, DecisionEffect.PERMIT, Set.of(VIEW, MANAGE));
+        } else {
+            try {
+                realmAdminClient.realm(realm.getName()).users().get(user.getId()).update(user.admin().toRepresentation());
+                fail("Should have thrown an exception");
+            } catch (ForbiddenException expected) {
+                assertEvaluation(user, DecisionEffect.DENY, Set.of(VIEW, MANAGE));
+            }
+        }
+    }
+
+    private void assertEvaluation(ManagedUser managedUser, DecisionEffect effect, Set<String> grantedScopes) {
+        PolicyEvaluationRequest request = new PolicyEvaluationRequest();
+
+        request.setUserId(realm.admin().users().search("myadmin").get(0).getId());
+        request.setResourceType(USERS_RESOURCE_TYPE);
+        ResourceRepresentation resource = new ResourceRepresentation();
+        resource.setName(managedUser.getId());
+        request.setResources(List.of(resource));
+
+        PolicyEvaluationResponse response = client.admin().authorization().policies().evaluate(request);
+        assertThat(response.getStatus(), is(effect));
+
+        if (response.getResults().isEmpty()) {
+            return;
+        }
+
+        EvaluationResultRepresentation result = response.getResults().get(0);
+
+        if (!grantedScopes.isEmpty()) {
+            if (DecisionEffect.PERMIT.equals(effect)) {
+                assertThat(result.getResource().getName(), is(managedUser.getUsername() + " with scopes " + grantedScopes.stream().sorted().toList()));
+                assertThat(result.getAllowedScopes().stream().map(ScopeRepresentation::getName).toList(), containsInAnyOrder(grantedScopes.toArray(new String[0])));
+                assertThat(result.getDeniedScopes().stream().map(ScopeRepresentation::getName).toList(), containsInAnyOrder(AdminPermissionsSchema.USERS.getScopes().stream().filter(Predicate.not(grantedScopes::contains)).toArray()));
+            } else {
+                assertThat(result.getDeniedScopes().stream().map(ScopeRepresentation::getName).toList(), containsInAnyOrder(AdminPermissionsSchema.USERS.getScopes().toArray()));
+            }
+        }
+    }
+
+    private void assertFilter(List<ManagedUser> expected) {
+        assertFilter(expected.toArray(new ManagedUser[0]));
+    }
+
+    private void assertFilter(ManagedUser... expected) {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+
+        if (expected.length == 0) {
+            assertThat(search.isEmpty(), is(true));
+        } else {
+            assertThat(search.stream().map(UserRepresentation::getUsername).toList(), containsInAnyOrder(Stream.of(expected).map(ManagedUser::getUsername).toArray()));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java
new file mode 100644
index 000000000000..027809f61347
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java
@@ -0,0 +1,427 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.IMPERSONATE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MANAGE_GROUP_MEMBERSHIP;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.MAP_ROLES;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+
+import java.util.List;
+import java.util.Set;
+
+import jakarta.ws.rs.ForbiddenException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.KeycloakBuilder;
+import org.keycloak.admin.client.resource.UsersResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.util.ApiUtil;
+
+@KeycloakIntegrationTest
+public class UserResourceTypeEvaluationTest extends AbstractPermissionTest {
+
+    @InjectUser(ref = "alice")
+    ManagedUser userAlice;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    private final String usersType = AdminPermissionsSchema.USERS.getType();
+
+    private final String newUserUsername = "new_user";
+
+    @Test
+    public void testSingleUserPermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client, "Only My Admin User Policy", myadmin.getId());
+        // allow my admin to see alice only
+        createPermission(client, userAlice.admin().toRepresentation().getId(), usersType, Set.of(VIEW), allowMyAdminPermission);
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(1, search.size());
+        assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+    }
+
+    @Test
+    public void testImpersonatePermission() {
+        // myadmin shouldn't be able to impersonate user just yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        //create all-users permission for "myadmin" (so that myadmin can impersonate all users in the realm)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, usersType, policy, Set.of(IMPERSONATE));
+
+        // create user permission forbidding the impersonation for userAlice
+        UserPolicyRepresentation negativePolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        String cannotImpersonateAlice = createPermission(client, userAlice.getId(), usersType, Set.of(IMPERSONATE), negativePolicy).getName();
+
+        // even though "myadmin" has permission to impersonate all users in realm it should be denied to impersonate userAlice
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // remove the negative permission
+        String cannotImpersonateAliceId = getScopePermissionsResource(client).findByName(cannotImpersonateAlice).getId();
+        getScopePermissionsResource(client).findById(cannotImpersonateAliceId).remove();
+
+        // need to create a separate client for the impersonation call, otherwise next usage of the 'realmAdminClient' would throw 401
+        try (Keycloak adminClient = KeycloakBuilder.builder()
+                .serverUrl("http://localhost:8080")
+                .realm(realm.getName())
+                .clientId("myclient")
+                .clientSecret("mysecret")
+                .username("myadmin")
+                .password("password")
+                .build()) {
+            // now it should be possible to impersonate the user due to fallback to all-users permission
+            adminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+        }
+    }
+
+    @Test
+    public void testManageAllPermission() {
+        // myadmin shouldn't be able to create user just yet
+        try (Response response = realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username(newUserUsername).build())) {
+            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+        }
+
+        //create all-users permission for "myadmin" (so that myadmin can manage all users in the realm)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, usersType, policy, Set.of(VIEW, MANAGE));
+
+        // creating user requires manage scope
+        String newUserId = ApiUtil.handleCreatedResponse(realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username(newUserUsername).build()));
+
+        // it should be possible to update the user due to fallback to all-users permission
+        realmAdminClient.realm(realm.getName()).users().get(newUserId).update(UserConfigBuilder.create().email("new@test.com").build());
+        assertEquals("new@test.com", realmAdminClient.realm(realm.getName()).users().get(newUserId).toRepresentation().getEmail());
+    }
+
+    @Test
+    public void testManageUserPermission() {
+        String myadminId = realm.admin().users().search("myadmin").get(0).getId();
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", myadminId);
+        ScopePermissionRepresentation allUsersPermission = createAllPermission(client, usersType, policy, Set.of(VIEW, MANAGE));
+
+        // creating user requires manage scope
+        String newUserId = ApiUtil.handleCreatedResponse(realmAdminClient.realm(realm.getName()).users().create(UserConfigBuilder.create().username(newUserUsername).build()));
+
+        // remove all-users permissions to test user-permission
+        allUsersPermission = getScopePermissionsResource(client).findByName(allUsersPermission.getName());
+        getScopePermissionsResource(client).findById(allUsersPermission.getId()).remove();
+
+        // create user-permissions
+        createPermission(client, UserConfigBuilder.create().id(newUserId).build().getId(), usersType, Set.of(VIEW, MANAGE), policy);
+
+        // it should be possible to update the user due to single user-permission
+        realmAdminClient.realm(realm.getName()).users().get(newUserId).update(UserConfigBuilder.create().email("email@test.com").build());
+        assertEquals("email@test.com", realmAdminClient.realm(realm.getName()).users().get(newUserId).toRepresentation().getEmail());
+
+        // remove the user permission
+        getScopePermissionsResource(client).findAll(null, null, null, null, null).forEach(permission -> {
+            getScopePermissionsResource(client).findById(permission.getId()).remove();
+        });
+
+        // updating the user should be denied
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(newUserId).update(UserConfigBuilder.create().email("email@test.com").build());
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+    }
+
+    @Test
+    public void testViewAllPermission() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        ScopePermissionRepresentation permission = createAllPermission(client, usersType, policy, Set.of(VIEW));
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertFalse(search.isEmpty());
+
+        permission = client.admin().authorization().permissions().scope().findByName(permission.getName());
+        permission.setPolicies(Set.of());
+        client.admin().authorization().permissions().scope().findById(permission.getId()).update(permission);
+        search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertTrue(search.isEmpty());
+    }
+
+    @Test
+    public void testViewUserPermission() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client,"Only My Admin User Policy", myadmin.getId());
+        createAllPermission(client, usersType, allowMyAdminPermission, Set.of(VIEW));
+
+        UserPolicyRepresentation denyMyAdminAccessingHisAccountPermission = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", myadmin.getId());
+        createPermission(client, myadmin.getId(), usersType, Set.of(VIEW), denyMyAdminAccessingHisAccountPermission);
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(1, search.size());
+        assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+    }
+
+    @Test
+    public void testViewUserPermissionUserMemberOfGroup() {
+        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, client,"Only My Admin User Policy", myadmin.getId());
+        createPermission(client, userAlice.getId(), usersType, Set.of(VIEW), allowMyAdminPermission);
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("foo");
+        try (Response response = realm.admin().groups().add(group)) {
+            group.setId(ApiUtil.getCreatedId(response));
+            // See org.keycloak.services.resources.admin.permissions.UserPermissionsV2.canView()
+            realm.admin().users().get(myadmin.getId()).joinGroup(group.getId());
+            List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+            assertEquals(1, search.size());
+            assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+        } finally {
+            realm.admin().users().get(myadmin.getId()).leaveGroup(group.getId());
+        }
+    }
+
+    @Test
+    public void testViewUserPermissionDenyByDefault() {
+        String myadminId = realm.admin().users().search("myadmin").get(0).getId();
+        UserPolicyRepresentation disallowMyAdmin = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", myadminId);
+        createAllPermission(client, usersType, disallowMyAdmin, Set.of(VIEW));
+
+        UserPolicyRepresentation allowAliceOnlyForMyAdmin = createUserPolicy(realm, client,"My Admin User Policy", myadminId);
+        createPermission(client, userAlice.getId(), usersType, Set.of(VIEW), allowAliceOnlyForMyAdmin);
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(1, search.size());
+        assertEquals(userAlice.getUsername(), search.get(0).getUsername());
+    }
+
+    @Test
+    public void testMapRoles() {
+        RoleRepresentation testRole = new RoleRepresentation();
+        testRole.setName("testRole");
+        realm.admin().roles().create(testRole);
+        realm.cleanup().add(r -> r.roles().get("testRole").remove());
+
+        // myadmin shouldn't be able to map roles to the user just yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).roles().realmLevel().add(List.of(testRole));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        //create all-users permission for "myadmin" (so that myadmin can map roles to users in the realm)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        ScopePermissionRepresentation allUsersPermission = createAllPermission(client, usersType, policy, Set.of(MAP_ROLES));
+
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).roles().realmLevel().add(List.of(testRole));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            // succsessfully checked the requireMapRoles https://github.com/keycloak/keycloak/blob/792b673f49d5faeed8b3bb2c61fb4a3b404df695/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java#L235
+            // expecting here NotFoundException: https://github.com/keycloak/keycloak/blob/792b673f49d5faeed8b3bb2c61fb4a3b404df695/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java#L243
+            assertThat(ex, instanceOf(NotFoundException.class));
+            // successful role mapping would require permission to map individual role https://github.com/keycloak/keycloak/blob/792b673f49d5faeed8b3bb2c61fb4a3b404df695/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java#L245
+            // and it's not implemented yet for V2
+        }
+
+        // remove all-users permissions to test user-permission
+        allUsersPermission = getScopePermissionsResource(client).findByName(allUsersPermission.getName());
+        getScopePermissionsResource(client).findById(allUsersPermission.getId()).remove();
+
+        // now myadmin cannot map roles
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).roles().realmLevel().add(List.of(testRole));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // create userPermission
+        createPermission(client, userAlice.getId(), usersType, Set.of(MAP_ROLES), policy);
+
+        //check myadmin can map roles
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).roles().realmLevel().add(List.of(testRole));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            // expecting here NotFoundException: https://github.com/keycloak/keycloak/blob/792b673f49d5faeed8b3bb2c61fb4a3b404df695/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java#L243
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+    }
+
+    @Test
+    public void testManageGroupMembership() {
+        // myadmin shouldn't be able to manage group membership of the user just yet
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        //create all-users permission for "myadmin" (so that myadmin can add users into a group)
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        ScopePermissionRepresentation allUsersPermission = createAllPermission(client, usersType, policy, Set.of(MANAGE_GROUP_MEMBERSHIP));
+
+        //check myadmin can manage membership using all-users permission
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            // expecting here NotFoundException: https://github.com/keycloak/keycloak/blob/b5c95e9f1c58bc500316dd5c0f2d3bb5e197ca99/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java#L1060
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+
+        // remove all-users permissions to test user-permission
+        allUsersPermission = getScopePermissionsResource(client).findByName(allUsersPermission.getName());
+        getScopePermissionsResource(client).findById(allUsersPermission.getId()).remove();
+
+        // now myadmin cannot manage membership
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // create userPermission
+        createPermission(client, userAlice.getId(), usersType, Set.of(MANAGE_GROUP_MEMBERSHIP), policy);
+
+        //check myadmin can manage membership using individual permission
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            // expecting here NotFoundException: https://github.com/keycloak/keycloak/blob/b5c95e9f1c58bc500316dd5c0f2d3bb5e197ca99/services/src/main/java/org/keycloak/services/resources/admin/UserResource.java#L1060
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+    }
+
+    @Test
+    public void testNoTransitiveUserPermissions() {
+        //create all-users manage permission for "myadmin"
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, usersType, policy, Set.of(MANAGE));
+
+        // with manage permission it is NOT possible to view
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertTrue(search.isEmpty());
+
+        // with manage permission it is NOT possible to map roles
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).roles().realmLevel().add(List.of(new RoleRepresentation()));
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // with manage permission it is NOT possible to manage group membership
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).joinGroup("no-such");
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+
+        // with manage permission it is NOT possible to impersonate
+        try {
+            realmAdminClient.realm(realm.getName()).users().get(userAlice.getId()).impersonate();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(ForbiddenException.class));
+        }
+    }
+
+    @Test
+    public void testEvaluateAllResourcePermissionsForSpecificResourcePermission() {
+        UserRepresentation adminUser = realm.admin().users().search("myadmin").get(0);
+        UserPolicyRepresentation allowPolicy = createUserPolicy(realm, client, "Only My Admin", adminUser.getId());
+        ScopePermissionRepresentation allResourcesPermission = createAllPermission(client, usersType, allowPolicy, Set.of(MANAGE, IMPERSONATE));
+        // all resource permissions grants manage scope
+        UsersResource users = realmAdminClient.realm(realm.getName()).users();
+        users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+
+        ScopePermissionRepresentation resourcePermission = createPermission(client, userAlice.getId(), usersType, Set.of(MANAGE), allowPolicy);
+        // both all and specific resource permission grants manage scope
+        users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+
+        allResourcesPermission = getScopePermissionsResource(client).findByName(allResourcesPermission.getName());
+        allResourcesPermission.setScopes(Set.of(IMPERSONATE));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission does not have the manage scope but the scope is granted by the resource permission
+        users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(IMPERSONATE));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // neither the all and specific resource permission grants access to the manage scope
+            users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        allResourcesPermission.setScopes(Set.of(MANAGE));
+        getScopePermissionsResource(client).findById(allResourcesPermission.getId()).update(allResourcesPermission);
+        // all resource permission grants access again to manage
+        users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+
+        UserPolicyRepresentation notAllowPolicy = createUserPolicy(Logic.NEGATIVE, realm, client, "Not My Admin", adminUser.getId());
+        createPermission(client, userAlice.getId(), usersType, Set.of(MANAGE), notAllowPolicy);
+        try {
+            // a specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+
+        resourcePermission = getScopePermissionsResource(client).findByName(resourcePermission.getName());
+        resourcePermission.setScopes(Set.of(IMPERSONATE, MANAGE));
+        getScopePermissionsResource(client).findById(resourcePermission.getId()).update(resourcePermission);
+        try {
+            // the specific resource permission that explicitly negates access to the manage scope denies access to the scope
+            // even though there is another resource permission that grants access to the scope - conflict resolution denies by default
+            users.get(userAlice.getId()).update(userAlice.admin().toRepresentation());
+            fail("Expected Exception wasn't thrown.");
+        } catch (ForbiddenException expected) {}
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeFilteringTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeFilteringTest.java
new file mode 100644
index 000000000000..bbcc2dd377f9
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeFilteringTest.java
@@ -0,0 +1,405 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.authz.fgap;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.not;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.GROUPS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.USERS_RESOURCE_TYPE;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW;
+import static org.keycloak.authorization.fgap.AdminPermissionsSchema.VIEW_MEMBERS;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RolePoliciesResource;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.GroupPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.util.ApiUtil;
+import org.keycloak.testsuite.util.RoleBuilder;
+
+@KeycloakIntegrationTest
+public class UserResourceTypeFilteringTest extends AbstractPermissionTest {
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.MANAGED_REALM, client = "myclient", user = "myadmin")
+    Keycloak realmAdminClient;
+
+    private final String usersType = AdminPermissionsSchema.USERS.getType();
+
+    @BeforeEach
+    public void onBeforeEach() {
+        for (int i = 0; i < 50; i++) {
+            realm.admin().users().create(UserConfigBuilder.create().username("user-" + i).build()).close();
+        }
+    }
+
+    @Test
+    public void testViewAllUsersUsingUserPolicy() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, usersType, policy, Set.of(VIEW));
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 50);
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+    }
+
+    @Test
+    public void testDeniedResourcesPrecedenceOverGrantedResources() {
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createAllPermission(client, usersType, policy, Set.of(VIEW));
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 50);
+        assertFalse(search.isEmpty());
+        assertEquals(50, search.size());
+
+        UserPolicyRepresentation notMyAdminPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        Set<String> notAllowedUsers = Set.of("user-0", "user-15", "user-30", "user-45");
+        createPermission(client, notAllowedUsers, usersType, Set.of(VIEW), notMyAdminPolicy);
+        search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertFalse(search.isEmpty());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).noneMatch(notAllowedUsers::contains));
+    }
+
+    @Test
+    public void testCountWithFilters() {
+        assertThat(realmAdminClient.realm(realm.getName()).users().count("user-"), is(0));
+        assertThat(realmAdminClient.realm(realm.getName()).users().count(null, null, null, "user-15"), is(0));
+
+        UserPolicyRepresentation allowPolicy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        Set<String> allowedUsers = Set.of("user-0", "user-15", "user-30");
+        createPermission(client, allowedUsers, usersType, Set.of(VIEW), allowPolicy);
+
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, -1, -1);
+        assertEquals(allowedUsers.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).allMatch(allowedUsers::contains));
+
+        assertThat(realmAdminClient.realm(realm.getName()).users().count("user-"), is(allowedUsers.size()));
+        assertThat(realmAdminClient.realm(realm.getName()).users().count(null, null, null, "user-15"), is(1));
+    }
+
+    @Test
+    public void testViewUserUsingUserPolicy() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, "user-9", usersType, Set.of(VIEW), policy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+    }
+
+    @Test
+    public void testViewUserUsingGroupPolicy() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        GroupRepresentation rep = new GroupRepresentation();
+        rep.setName("administrators");
+
+        try (Response response = realm.admin().groups().add(rep)) {
+            String adminUserId = realm.admin().users().search("myadmin").get(0).getId();
+            String groupId = ApiUtil.getCreatedId(response);
+            realm.admin().users().get(adminUserId).joinGroup(groupId);
+            GroupPolicyRepresentation policy = createGroupPolicy(realm, client, "Admin Group Policy", groupId, Logic.POSITIVE);
+            createPermission(client, "user-9", usersType, Set.of(VIEW), policy);
+
+        }
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+    }
+
+    @Test
+    public void testViewUserUsingRolePolicy() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName("administrators");
+        realm.admin().roles().create(role);
+
+        String adminUserId = realm.admin().users().search("myadmin").get(0).getId();
+        role = realm.admin().roles().get(role.getName()).toRepresentation();
+        realm.admin().users().get(adminUserId).roles().realmLevel().add(List.of(role));
+        RolePolicyRepresentation policy = createRolePolicy(realm, client, "Admin Role Policy", role.getId(), Logic.POSITIVE);
+        createPermission(client, "user-9", usersType, Set.of(VIEW), policy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+    }
+
+    @Test
+    public void testViewUserUsingMultiplePolicies() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        RoleRepresentation role = new RoleRepresentation();
+        role.setName(KeycloakModelUtils.generateId());
+        realm.admin().roles().create(role);
+
+        String adminUserId = realm.admin().users().search("myadmin").get(0).getId();
+        role = realm.admin().roles().get(role.getName()).toRepresentation();
+        realm.admin().users().get(adminUserId).roles().realmLevel().add(List.of(role));
+        RolePolicyRepresentation rolePolicy = createRolePolicy(realm, client, "Admin Role Policy", role.getId(), Logic.POSITIVE);
+
+        GroupRepresentation rep = new GroupRepresentation();
+        rep.setName(KeycloakModelUtils.generateId());
+        GroupPolicyRepresentation groupPolicy;
+
+        try (Response response = realm.admin().groups().add(rep)) {
+            String groupId = ApiUtil.getCreatedId(response);
+            realm.admin().users().get(adminUserId).joinGroup(groupId);
+            groupPolicy = createGroupPolicy(realm, client, "Admin Group Policy", groupId, Logic.POSITIVE);
+        }
+
+        createPermission(client, "user-9", usersType, Set.of(VIEW), rolePolicy, groupPolicy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+
+        RolePoliciesResource rolePolicyResource = client.admin().authorization().policies().role();
+        rolePolicy = rolePolicyResource.findByName(rolePolicy.getName());
+        rolePolicy.setLogic(Logic.NEGATIVE);
+        rolePolicyResource.findById(rolePolicy.getId()).update(rolePolicy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+    }
+
+    @Test
+    public void testViewGroupMembersPolicy() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName(KeycloakModelUtils.generateId());
+
+        Set<String> memberUsernames = Set.of("user-0", "user-15", "user-30", "user-45");
+
+        try (Response response = realm.admin().groups().add(group)) {
+            group.setId(ApiUtil.getCreatedId(response));
+            for (String username: memberUsernames) {
+                String id = realm.admin().users().search(username).get(0).getId();
+                realm.admin().users().get(id).joinGroup(group.getId());
+            }
+        }
+
+        UserPolicyRepresentation policy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, group.getId(), AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, Set.of(VIEW_MEMBERS), policy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertEquals(memberUsernames.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).allMatch(memberUsernames::contains));
+
+        UserPolicyRepresentation negativePolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, realm.admin().users().search("user-0").get(0).getId(), USERS_RESOURCE_TYPE, Set.of(VIEW), negativePolicy);
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).noneMatch("user-0"::equals));
+        assertTrue(realmAdminClient.realm(realm.getName()).groups().group(group.getId()).members().stream().map(UserRepresentation::getUsername).noneMatch("user-0"::equals));
+    }
+
+    @Test
+    public void testDenyGroupViewMembersPolicy() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        GroupRepresentation allowedMembers = new GroupRepresentation();
+        allowedMembers.setName(KeycloakModelUtils.generateId());
+
+        Set<String> memberUsernames = Set.of("user-0", "user-15", "user-30", "user-45");
+
+        try (Response response = realm.admin().groups().add(allowedMembers)) {
+            allowedMembers.setId(ApiUtil.getCreatedId(response));
+            addGroupMember(allowedMembers.getId(), memberUsernames);
+        }
+
+        GroupRepresentation deniedMembers = new GroupRepresentation();
+
+        deniedMembers.setName(KeycloakModelUtils.generateId());
+
+        Set<String> deniedMemberUsernames = Set.of("user-0", "user-45");
+
+        try (Response response = realm.admin().groups().add(deniedMembers)) {
+            deniedMembers.setId(ApiUtil.getCreatedId(response));
+            addGroupMember(deniedMembers.getId(), memberUsernames.stream().filter(deniedMemberUsernames::contains).collect(Collectors.toSet()));
+        }
+
+        // grant access to se members of a group
+        UserPolicyRepresentation permitPolicy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, allowedMembers.getId(), AdminPermissionsSchema.GROUPS_RESOURCE_TYPE, Set.of(VIEW_MEMBERS), permitPolicy);
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertEquals(memberUsernames.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).allMatch(memberUsernames::contains));
+
+        // deny access to the members of another group where access to some users in this group were previously granted
+        UserPolicyRepresentation denyPolicy = createUserPolicy(Logic.NEGATIVE, realm, client,"Not My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, deniedMembers.getId(), GROUPS_RESOURCE_TYPE, Set.of(VIEW_MEMBERS), denyPolicy);
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(memberUsernames.size() - deniedMemberUsernames.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).noneMatch(deniedMemberUsernames::contains));
+
+        // grant access to a specific user that is protected, the permission will have no effect because the user cannot be accessed due to the group permission
+        String userId = realm.admin().users().search("user-0").get(0).getId();
+        createPermission(client, userId, USERS_RESOURCE_TYPE, Set.of(VIEW), permitPolicy);
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        Set<String> expected = new HashSet<>(memberUsernames);
+        expected.removeAll(deniedMemberUsernames);
+        assertFalse(search.isEmpty());
+        assertEquals(expected.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).allMatch(expected::contains));
+
+        // the user is no longer a member of the group that holds members that cannot be accessed, they can be accessed now
+        realm.admin().users().get(userId).leaveGroup(deniedMembers.getId());
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        expected = new HashSet<>(memberUsernames);
+        expected.removeAll(deniedMemberUsernames);
+        expected.add("user-0");
+        assertFalse(search.isEmpty());
+        assertEquals(expected.size(), search.size());
+        assertTrue(search.stream().map(UserRepresentation::getUsername).allMatch(expected::contains));
+    }
+
+    private void addGroupMember(String groupId, Set<String> usernames) {
+        for (String username: usernames) {
+            String id = realm.admin().users().search(username).get(0).getId();
+            realm.admin().users().get(id).joinGroup(groupId);
+        }
+    }
+
+    @Test
+    public void testListingUsersWithRolesOnly() {
+        List<UserRepresentation> search = realm.admin().users().search("myadmin");
+        assertThat(search, Matchers.hasSize(1));
+
+        String userId = search.get(0).getId();
+        String clientUuid = realm.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0).getId();
+        RoleRepresentation viewUsers = realm.admin().clients().get(clientUuid).roles().get(AdminRoles.VIEW_USERS).toRepresentation();
+        realm.admin().users().get(userId).roles().clientLevel(clientUuid).add(List.of(viewUsers));
+        realm.cleanup().add(r -> r.users().get(userId).roles().clientLevel(clientUuid).remove(List.of(viewUsers)));
+
+        assertThat(realmAdminClient.realm(realm.getName()).users().list(), not(empty()));
+    }
+
+    @Test
+    public void testSearchById() {
+        UserRepresentation expected = realm.admin().users().search("user-0").get(0);
+        assertThat(realmAdminClient.realm(realm.getName()).users().search("id:" + expected.getId(), -1, -1), hasSize(0));
+        UserPolicyRepresentation negativePolicy = createUserPolicy(realm, client,"Only My Admin User Policy", realm.admin().users().search("myadmin").get(0).getId());
+        createPermission(client, expected.getId(), USERS_RESOURCE_TYPE, Set.of(VIEW), negativePolicy);
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertThat(search, Matchers.hasSize(1));
+        UserRepresentation user = search.get(0);
+        assertThat(user.getUsername(), Matchers.is("user-0"));
+        assertThat(realmAdminClient.realm(realm.getName()).users().search("id:" + user.getId(), -1, -1), hasSize(1));
+    }
+
+    @Test
+    public void testViewUserUsingRoleInheritedFromGroup() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        RoleRepresentation role = RoleBuilder.create().name("myrole").build();
+        realm.admin().roles().create(role);
+        role = realm.admin().roles().get(role.getName()).toRepresentation();
+
+        GroupRepresentation rep = new GroupRepresentation();
+        rep.setName("administrators");
+
+        try (Response response = realm.admin().groups().add(rep)) {
+            String adminUserId = realm.admin().users().search("myadmin").get(0).getId();
+            String groupId = ApiUtil.getCreatedId(response);
+            realm.admin().users().get(adminUserId).joinGroup(groupId);
+            realm.admin().groups().group(groupId).roles().realmLevel().add(List.of(role));
+            RolePolicyRepresentation policy = createRolePolicy(realm, client, "My Role Policy", role.getId(), Logic.POSITIVE);
+            createPermission(client, "user-9", usersType, Set.of(VIEW), policy);
+        }
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+    }
+
+    @Test
+    public void testViewUserUsingRoleInheritedFromCompositeRole() {
+        List<UserRepresentation> search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertTrue(search.isEmpty());
+
+        RoleRepresentation role = RoleBuilder.create().name("myrole").build();
+
+        realm.admin().roles().create(role);
+        role = realm.admin().roles().get(role.getName()).toRepresentation();
+
+        RoleRepresentation compositeRole = RoleBuilder.create()
+                .name("mycompositerole")
+                .composite()
+                .realmComposite(role)
+                .build();
+        realm.admin().roles().create(compositeRole);
+        compositeRole = realm.admin().roles().get(compositeRole.getName()).toRepresentation();
+
+        GroupRepresentation rep = new GroupRepresentation();
+        rep.setName("administrators");
+
+        try (Response response = realm.admin().groups().add(rep)) {
+            String adminUserId = realm.admin().users().search("myadmin").get(0).getId();
+            String groupId = ApiUtil.getCreatedId(response);
+            realm.admin().users().get(adminUserId).joinGroup(groupId);
+            realm.admin().groups().group(groupId).roles().realmLevel().add(List.of(compositeRole));
+            RolePolicyRepresentation policy = createRolePolicy(realm, client, "My Role Policy", role.getId(), Logic.POSITIVE);
+            createPermission(client, "user-9", usersType, Set.of(VIEW), policy);
+        }
+
+        search = realmAdminClient.realm(realm.getName()).users().search(null, 0, 10);
+        assertFalse(search.isEmpty());
+        assertEquals(1, search.size());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java
index c69bbd64d1ef..c100e7ebaa4b 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypePermissionTest.java
@@ -17,29 +17,44 @@
 
 package org.keycloak.tests.admin.authz.fgap;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
 
+import jakarta.ws.rs.NotFoundException;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
-import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.AuthorizationResource;
 import org.keycloak.admin.client.resource.ScopePermissionResource;
-import org.keycloak.admin.client.resource.ScopePermissionsResource;
-import org.keycloak.authorization.AdminPermissionsSchema;
-import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.authorization.fgap.AdminPermissionsSchema;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
 import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
 import org.keycloak.testframework.annotations.InjectUser;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
 import org.keycloak.testframework.realm.ManagedUser;
 
-@KeycloakIntegrationTest(config = KeycloakAdminPermissionsServerConfig.class)
+@KeycloakIntegrationTest
 public class UserResourceTypePermissionTest extends AbstractPermissionTest {
 
-    @InjectUser(ref = "alice")
+    @InjectUser(ref = "alice", lifecycle = LifeCycle.METHOD)
     ManagedUser userAlice;
 
     @InjectUser(ref = "bob")
@@ -56,88 +71,221 @@ public void onBefore() {
         }
     }
 
-    @AfterEach
-    public void onAfter() {
-        ScopePermissionsResource permissions = getScopePermissionsResource();
-
-        for (ScopePermissionRepresentation permission : permissions.findAll(null, null, null, -1, -1)) {
-            permissions.findById(permission.getId()).remove();
-        }
-    }
-
     @Test
     public void testCreateResourceTypePermission() {
         ScopePermissionRepresentation expected = createAllUserPermission();
-        List<ScopePermissionRepresentation> result = getScopePermissionsResource().findAll(null, null, null, -1, -1);
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
         assertEquals(1, result.size());
         ScopePermissionRepresentation permissionRep = result.get(0);
-        ScopePermissionResource permission = getScopePermissionsResource().findById(permissionRep.getId());
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
         assertEquals(expected.getName(), permissionRep.getName());
-        assertEquals(1, permission.scopes().size());
+        assertEquals(AdminPermissionsSchema.USERS.getScopes().size(), permission.scopes().size());
         assertEquals(3, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(AdminPermissionsSchema.USERS_RESOURCE_TYPE, permission.resources().get(0).getDisplayName());
     }
 
     @Test
     public void testCreateResourceObjectPermission() {
         ScopePermissionRepresentation expected = createUserPermission(userAlice);
-        List<ScopePermissionRepresentation> result = getScopePermissionsResource().findAll(null, null, null, -1, -1);
+        List<ScopePermissionRepresentation> result = getScopePermissionsResource(client).findAll(null, null, null, -1, -1);
         assertEquals(1, result.size());
         ScopePermissionRepresentation permissionRep = result.get(0);
-        ScopePermissionResource permission = getScopePermissionsResource().findById(permissionRep.getId());
+        ScopePermissionResource permission = getScopePermissionsResource(client).findById(permissionRep.getId());
         assertEquals(expected.getName(), permissionRep.getName());
-        assertEquals(1, permission.scopes().size());
-        assertEquals(1, permission.resources().size());
+        assertEquals(AdminPermissionsSchema.USERS.getScopes().size(), permission.scopes().size());
         assertEquals(3, permission.associatedPolicies().size());
+        assertEquals(1, permission.resources().size());
+        assertEquals(userAlice.getUsername(), permission.resources().get(0).getDisplayName());
+
     }
 
     @Test
     public void testFindByResourceObject() {
         createUserPermission(userAlice, userBob);
 
-        List<ScopePermissionRepresentation> existing = getScopePermissionsResource().findAll(null, null, userAlice.getId(), -1, -1);
+        List<ScopePermissionRepresentation> existing = getScopePermissionsResource(client).findAll(null, null, userAlice.getId(), -1, -1);
         assertEquals(1, existing.size());
-        existing = getScopePermissionsResource().findAll(null, null, userBob.getId(), -1, -1);
+        existing = getScopePermissionsResource(client).findAll(null, null, userBob.getId(), -1, -1);
         assertEquals(1, existing.size());
     }
 
     @Test
     public void testDelete() {
+        // only "all-resource" resources should be present
+        List<ResourceRepresentation> resources = client.admin().authorization().resources().find(null, null, null, null, null, null, null);
+        assertEquals(AdminPermissionsSchema.SCHEMA.getResourceTypes().entrySet().size(), resources.size());
+
         createUserPermission(userAlice);
+        // resource for Alice should be created
+        resources = client.admin().authorization().resources().find(null, null, null, null, null, null, null);
+        assertEquals(1 + AdminPermissionsSchema.SCHEMA.getResourceTypes().entrySet().size(), resources.size());
+
         createUserPermission(userBob);
+        // resource for Bob should be created
+        resources = client.admin().authorization().resources().find(null, null, null, null, null, null, null);
+        assertEquals(2 + AdminPermissionsSchema.SCHEMA.getResourceTypes().entrySet().size(), resources.size());
 
-        List<ScopePermissionRepresentation> existing = getScopePermissionsResource().findAll(null, null, userAlice.getId(), -1, -1);
+        List<ScopePermissionRepresentation> existing = getScopePermissionsResource(client).findAll(null, null, userAlice.getId(), -1, -1);
         assertEquals(1, existing.size());
-        getScopePermissionsResource().findById(existing.get(0).getId()).remove();
-        existing = getScopePermissionsResource().findAll(null, null, userAlice.getId(), -1, -1);
-        assertEquals(0, existing.size());
+        // remove permission for Alice
+        getScopePermissionsResource(client).findById(existing.get(0).getId()).remove();
+        existing = getScopePermissionsResource(client).findAll(null, null, userAlice.getId(), -1, -1);
+        assertThat(existing, nullValue());
 
-        existing = getScopePermissionsResource().findAll(null, null, userBob.getId(), -1, -1);
+        existing = getScopePermissionsResource(client).findAll(null, null, userBob.getId(), -1, -1);
         assertEquals(1, existing.size());
+
+        // remove permission for Bob
+        getScopePermissionsResource(client).findById(existing.get(0).getId()).remove();
+
+        //resources for both Alice and Bob should be deleted, there should be only "all-resource" resources
+        resources = client.admin().authorization().resources().find(null, null, null, null, null, null, null);
+        assertEquals(AdminPermissionsSchema.SCHEMA.getResourceTypes().entrySet().size(), resources.size());
     }
 
-    private ScopePermissionRepresentation createUserPermission(ManagedUser... users) {
-        ScopePermissionRepresentation permission = new ScopePermissionRepresentation();
+    @Test
+    public void testUpdate() {
+        createUserPermission(userAlice, userBob);
+
+        List<ScopePermissionRepresentation> searchByResourceAlice = getScopePermissionsResource(client).findAll(null, null, userAlice.getId(), -1, -1);
+        assertThat(searchByResourceAlice, hasSize(1));
+        List<ScopePermissionRepresentation> searchByResourceBob = getScopePermissionsResource(client).findAll(null, null, userBob.getId(), -1, -1);
+        assertThat(searchByResourceBob, hasSize(1));
+
+        ScopePermissionRepresentation permission = searchByResourceAlice.get(0);
+
+        // verify it's the same permission
+        assertThat(permission.getId(), equalTo(searchByResourceBob.get(0).getId()));
+
+        // get resources assiciated with the permission
+        List<ResourceRepresentation> resources = getPolicies().policy(permission.getId()).resources();
+        assertThat(resources, hasSize(2));
+
+        // update permission so that contains single resource
+        ResourceRepresentation toRemove = resources.get(1);
+        resources.remove(toRemove);
+        permission.setResources(resources.stream().map(ResourceRepresentation::getId).collect(Collectors.toSet()));
+        getScopePermissionsResource(client).findById(permission.getId()).update(permission);
+
+        //permission should have only single resource
+        assertThat(getPolicies().policy(permission.getId()).resources(), hasSize(1));
+        try {
+            // resource removed from permission should be removed from server as it is not assigned to any permission
+            client.admin().authorization().resources().resource(toRemove.getId()).toRepresentation();
+            fail("Expected Exception wasn't thrown.");
+        } catch (Exception ex) {
+            assertThat(ex, instanceOf(NotFoundException.class));
+        }
+    }
 
-        permission.setName(KeycloakModelUtils.generateId());
-        permission.setResourceType(AdminPermissionsSchema.USERS.getType());
-        permission.setResources(Arrays.stream(users).map(ManagedUser::getUsername).collect(Collectors.toSet()));
-        permission.setScopes(AdminPermissionsSchema.USERS.getScopes());
-        permission.setPolicies(Set.of("User Policy 0", "User Policy 1", "User Policy 2"));
+    @Test
+    public void testUpdatePermissionResources() {
+        AuthorizationResource authorization = client.admin().authorization();
+        ScopePermissionRepresentation representation = createAllUserPermission();
+        representation = getScopePermissionsResource(client).findByName(representation.getName());
+        assertThat(representation, notNullValue());
+        List<ResourceRepresentation> resources = authorization.resources().resources();
+        assertThat(resources.size(), is(AdminPermissionsSchema.SCHEMA.getResourceTypes().size()));
+        ScopePermissionResource permission = authorization.permissions().scope().findById(representation.getId());
+        List<ResourceRepresentation> permissionResources = permission.resources();
+        assertThat(permissionResources.size(), is(1));
+        assertThat(permissionResources.get(0).getName(), is(AdminPermissionsSchema.USERS.getType()));
+
+        representation.setResources(Set.of(userAlice.getId()));
+        permission.update(representation);
+        resources = authorization.resources().resources();
+        assertThat(resources.size(), is(AdminPermissionsSchema.SCHEMA.getResourceTypes().size() + 1));
+        permissionResources = permission.resources();
+        assertThat(permissionResources.size(), is(1));
+        assertThat(permissionResources.get(0).getName(), is(userAlice.getId()));
+
+        representation.setResources(Set.of());
+        permission.update(representation);
+        resources = authorization.resources().resources();
+        assertThat(resources.size(), is(AdminPermissionsSchema.SCHEMA.getResourceTypes().size()));
+        permissionResources = permission.resources();
+        assertThat(permissionResources.size(), is(1));
+        assertThat(permissionResources.get(0).getName(), is(AdminPermissionsSchema.USERS.getType()));
+
+        representation.setResources(Set.of(userAlice.getId()));
+        permission.update(representation);
+        resources = authorization.resources().resources();
+        assertThat(resources.size(), is(AdminPermissionsSchema.SCHEMA.getResourceTypes().size() + 1));
+        permissionResources = permission.resources();
+        assertThat(permissionResources.size(), is(1));
+        assertThat(permissionResources.get(0).getName(), is(userAlice.getId()));
+
+        createUserPermission(userAlice, userBob);
 
-        createPermission(permission);
+        representation.setResources(Set.of());
+        permission.update(representation);
+        resources = authorization.resources().resources();
+        assertThat(resources.size(), is(AdminPermissionsSchema.SCHEMA.getResourceTypes().size() + 2));
+        permissionResources = permission.resources();
+        assertThat(permissionResources.size(), is(1));
+        assertThat(permissionResources.get(0).getName(), is(AdminPermissionsSchema.USERS.getType()));
+    }
+
+    @Test
+    public void testRemoveUser() {
+        //create user policies
+        createUserPolicy(realm, client, "Only Alice or Bob User Policy", userAlice.getId(), userBob.getId());
+        createUserPolicy(realm, client, "Only Alice User Policy", userAlice.getId());
+
+        //create user permissions
+        createUserPermission(userAlice, userBob);
+        createUserPermission(userAlice);
+
+        List<PolicyRepresentation> policies = getPolicies().policies(null, "Only", "user", null, null, null, null, null, null, null);
+        assertThat(policies, hasSize(2));
+        assertThat(policies.get(0).getConfig().get("users"), containsString(userAlice.getId()));
+        assertThat(policies.get(1).getConfig().get("users"), containsString(userAlice.getId()));
+
+        List<ScopePermissionRepresentation> permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(2));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(userAlice.getId()));
+        assertThat(getPolicies().policy(permissions.get(1).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), hasItem(userAlice.getId()));
+
+        //remove user
+        realm.admin().users().get(userAlice.getId()).remove();
+
+        //check the resource was removed from policies
+        UserPolicyRepresentation userPolicy = getPolicies().user().findByName("Only Alice or Bob User Policy");
+        assertThat(userPolicy, notNullValue());
+        assertThat(userPolicy.getUsers(), not(contains(userAlice.getId())));
+
+        UserPolicyRepresentation userPolicy1 = getPolicies().user().findByName("Only Alice User Policy");
+        assertThat(userPolicy1, notNullValue());
+        assertThat(userPolicy1.getUsers(), empty());
+
+        //there should be 1 permission left
+        permissions = getScopePermissionsResource(client).findAll(null, null, null, null, null);
+        assertThat(permissions, hasSize(1));
+        assertThat(getPolicies().policy(permissions.get(0).getId()).resources().stream().map(ResourceRepresentation::getName).collect(Collectors.toList()), not(hasItem(userAlice.getId())));
+    }
+
+    private ScopePermissionRepresentation createUserPermission(ManagedUser... users) {
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.USERS.getType())
+                .resources(Arrays.stream(users).map(ManagedUser::getUsername).collect(Collectors.toSet()))
+                .scopes(AdminPermissionsSchema.USERS.getScopes())
+                .addPolicies(List.of("User Policy 0", "User Policy 1", "User Policy 2"))
+                .build();
+
+        createPermission(client, permission);
 
         return permission;
     }
 
     private ScopePermissionRepresentation createAllUserPermission() {
-        ScopePermissionRepresentation permission = new ScopePermissionRepresentation();
-
-        permission.setName(KeycloakModelUtils.generateId());
-        permission.setResourceType(AdminPermissionsSchema.USERS.getType());
-        permission.setScopes(AdminPermissionsSchema.USERS.getScopes());
-        permission.setPolicies(Set.of("User Policy 0", "User Policy 1", "User Policy 2"));
+        ScopePermissionRepresentation permission = PermissionBuilder.create()
+                .resourceType(AdminPermissionsSchema.USERS.getType())
+                .scopes(AdminPermissionsSchema.USERS.getScopes())
+                .addPolicies(List.of("User Policy 0", "User Policy 1", "User Policy 2"))
+                .build();
 
-        createPermission(permission);
+        createPermission(client, permission);
 
         return permission;
     }
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientScopeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientScopeTest.java
new file mode 100644
index 000000000000..009cc8277804
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientScopeTest.java
@@ -0,0 +1,74 @@
+package org.keycloak.tests.admin.client;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.admin.client.resource.ClientScopesResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.util.Map;
+
+@KeycloakIntegrationTest
+public class AbstractClientScopeTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    void handleExpectedCreateFailure(ClientScopeRepresentation scopeRep, int expectedErrorCode, String expectedErrorMessage) {
+        try (Response resp = clientScopes().create(scopeRep)) {
+            Assertions.assertEquals(expectedErrorCode, resp.getStatus());
+            String respBody = resp.readEntity(String.class);
+            Map<String, String> responseJson;
+            try {
+                responseJson = JsonSerialization.readValue(respBody, Map.class);
+                Assertions.assertEquals(expectedErrorMessage, responseJson.get("errorMessage"));
+            } catch (IOException e) {
+                Assertions.fail("Failed to extract the errorMessage from a CreateScope Response");
+            }
+        }
+    }
+
+    ClientScopesResource clientScopes() {
+        return managedRealm.admin().clientScopes();
+    }
+
+    String createClientScope(ClientScopeRepresentation clientScopeRep) {
+        Response resp = clientScopes().create(clientScopeRep);
+        final String clientScopeId = ApiUtil.getCreatedId(resp);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeResourcePath(clientScopeId), clientScopeRep, ResourceType.CLIENT_SCOPE);
+
+        return clientScopeId;
+    }
+
+    String createClientScopeWithCleanup(ClientScopeRepresentation clientScopeRep) {
+        String clientScopeId = createClientScope(clientScopeRep);
+        managedRealm.cleanup().add(r -> r.clientScopes().get(clientScopeId).remove());
+        return clientScopeId;
+    }
+
+    String createClientWithCleanup(ClientRepresentation clientRep) {
+        Response resp = managedRealm.admin().clients().create(clientRep);
+        final String clientUuid = ApiUtil.getCreatedId(resp);
+        managedRealm.cleanup().add(r -> r.clients().get(clientUuid).remove());
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientResourcePath(clientUuid), clientRep, ResourceType.CLIENT);
+        return clientUuid;
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientSearchTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientSearchTest.java
new file mode 100644
index 000000000000..36b4ed845e34
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractClientSearchTest.java
@@ -0,0 +1,61 @@
+package org.keycloak.tests.admin.client;
+
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+
+public class AbstractClientSearchTest {
+
+    @InjectRealm(config = ClientSearchRealmConfig.class)
+    ManagedRealm testRealm;
+
+    static final String CLIENT_ID_1 = "client1";
+    static final String CLIENT_ID_2 = "client2";
+    static final String CLIENT_ID_3 = "client3";
+
+    static final String ATTR_ORG_NAME = "org";
+    static final String ATTR_ORG_VAL = "Test_\"organisation\"";
+    static final String ATTR_URL_NAME = "url";
+    static final String ATTR_URL_VAL = "https://foo.bar/clflds";
+    static final String ATTR_QUOTES_NAME = "test \"123\"";
+    static final String ATTR_QUOTES_NAME_ESCAPED = "\"test \\\"123\\\"\"";
+    static final String ATTR_QUOTES_VAL = "field=\"blah blah\"";
+    static final String ATTR_QUOTES_VAL_ESCAPED = "\"field=\\\"blah blah\\\"\"";
+    static final String ATTR_FILTERED_NAME = "filtered";
+    static final String ATTR_FILTERED_VAL = "does_not_matter";
+
+    void search(String searchQuery, String... expectedClientIds) {
+        List<String> found = testRealm.admin().clients().query(searchQuery).stream()
+                .map(ClientRepresentation::getClientId)
+                .collect(Collectors.toList());
+        assertThat(found, containsInAnyOrder(expectedClientIds));
+    }
+
+    public static class ClientSearchRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.addClient(CLIENT_ID_1)
+                    .attribute(ATTR_ORG_NAME, ATTR_ORG_VAL)
+                    .attribute(ATTR_URL_NAME, ATTR_URL_VAL);
+
+            realm.addClient(CLIENT_ID_2)
+                    .attribute(ATTR_URL_NAME, ATTR_URL_VAL)
+                    .attribute(ATTR_FILTERED_NAME, ATTR_FILTERED_VAL);
+
+            realm.addClient(CLIENT_ID_3)
+                    .attribute(ATTR_ORG_NAME, "fake val")
+                    .attribute(ATTR_QUOTES_NAME, ATTR_QUOTES_VAL);
+
+            return realm;
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractProtocolMapperTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractProtocolMapperTest.java
similarity index 81%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractProtocolMapperTest.java
rename to tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractProtocolMapperTest.java
index f6e178504f5e..360adfe7e67c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractProtocolMapperTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/AbstractProtocolMapperTest.java
@@ -15,15 +15,21 @@
  * limitations under the License.
  */
 
-package org.keycloak.testsuite.admin.client;
+package org.keycloak.tests.admin.client;
 
 import com.fasterxml.jackson.core.type.TypeReference;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.admin.client.Keycloak;
 import org.keycloak.admin.client.resource.ProtocolMappersResource;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.representations.idm.AdminEventRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.testsuite.Assert;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.ByteArrayInputStream;
@@ -41,13 +47,14 @@
  *
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public abstract class AbstractProtocolMapperTest extends AbstractClientTest {
+@KeycloakIntegrationTest
+public abstract class AbstractProtocolMapperTest {
 
-    protected Map<String, List<ProtocolMapperRepresentation>> builtinMappers = null;
+    @InjectAdminClient
+    Keycloak adminClient;
 
-    protected void initBuiltinMappers() {
-        builtinMappers = adminClient.serverInfo().getInfo().getBuiltinProtocolMappers();
-    }
+    @InjectAdminEvents
+    AdminEvents adminEvents;
 
     protected ProtocolMapperRepresentation makeMapper(String protocol, String name, String mapperType, Map<String, String> config) {
         ProtocolMapperRepresentation rep = new ProtocolMapperRepresentation();
@@ -99,18 +106,19 @@ protected List<ProtocolMapperRepresentation> mappersToAdd(List<ProtocolMapperRep
 
     protected void testAddAllBuiltinMappers(ProtocolMappersResource resource, String protocolName, String adminEventPath) {
         List<ProtocolMapperRepresentation> oldMappers = resource.getMappersPerProtocol(protocolName);
-        List<ProtocolMapperRepresentation> builtins = builtinMappers.get(protocolName);
+        List<ProtocolMapperRepresentation> builtins = adminClient.serverInfo().getInfo().getBuiltinProtocolMappers().get(protocolName);
 
         List<ProtocolMapperRepresentation> mappersToAdd = mappersToAdd(oldMappers, builtins);
 
         // This is used by admin console to add builtin mappers
         resource.createMapper(mappersToAdd);
 
-        AdminEventRepresentation adminEvent = assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, adminEventPath + "/add-models", ResourceType.PROTOCOL_MAPPER);
+        AdminEventRepresentation adminEvent = adminEvents.poll();
+        AdminEventAssertion.assertEvent(adminEvent, OperationType.CREATE, adminEventPath + "/add-models", ResourceType.PROTOCOL_MAPPER);
         try {
-            List<ProtocolMapperRepresentation> eventMappers = JsonSerialization.readValue(new ByteArrayInputStream(adminEvent.getRepresentation().getBytes()), new TypeReference<List<ProtocolMapperRepresentation>>() {
+            List<ProtocolMapperRepresentation> eventMappers = JsonSerialization.readValue(new ByteArrayInputStream(adminEvent.getRepresentation().getBytes()), new TypeReference<>() {
             });
-            Assert.assertEquals(eventMappers.size(), mappersToAdd.size());
+            Assertions.assertEquals(eventMappers.size(), mappersToAdd.size());
             for (int i=0 ; i< mappersToAdd.size() ; i++) {
                 ProtocolMapperRepresentation repExpected = mappersToAdd.get(i);
                 ProtocolMapperRepresentation repActual = eventMappers.get(i);
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientProtocolMapperTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientProtocolMapperTest.java
new file mode 100644
index 000000000000..1a196e2aa81d
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientProtocolMapperTest.java
@@ -0,0 +1,268 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import java.util.Collections;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.AllowedWebOriginsProtocolMapper;
+import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.util.ApiUtil;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+
+/**
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@TestMethodOrder(MethodOrderer.MethodName.class)
+@KeycloakIntegrationTest
+public class ClientProtocolMapperTest extends AbstractProtocolMapperTest {
+
+    @InjectClient(config = OidcClient.class, ref = "oidcClient")
+    ManagedClient oidcClient;
+
+    @InjectClient(config = SamlClient.class, ref = "samlClient")
+    ManagedClient samlClient;
+
+    private ProtocolMappersResource oidcMappersRsc;
+    private ProtocolMappersResource samlMappersRsc;
+
+    @BeforeEach
+    public void setProtocolMapperResources() {
+        oidcMappersRsc = oidcClient.admin().getProtocolMappers();
+        samlMappersRsc = samlClient.admin().getProtocolMappers();
+    }
+
+    @Test
+    public void test01GetMappersList() {
+        // Built-in protocol mappers are empty by default
+        Assertions.assertTrue(oidcMappersRsc.getMappers().isEmpty());
+        Assertions.assertTrue(samlMappersRsc.getMappers().isEmpty());
+    }
+
+    @Test
+    public void test02CreateOidcMappersFromList() {
+        testAddAllBuiltinMappers(oidcMappersRsc, "openid-connect", AdminEventPaths.clientProtocolMappersPath(oidcClient.getId()));
+    }
+
+    @Test
+    public void test03CreateSamlMappersFromList() {
+        testAddAllBuiltinMappers(samlMappersRsc, "saml", AdminEventPaths.clientProtocolMappersPath(samlClient.getId()));
+    }
+
+    @Test
+    public void test04CreateSamlProtocolMapper() {
+
+        //{"protocol":"saml",
+        // "config":{"role":"account.view-profile","new.role.name":"new-role-name"},
+        // "consentRequired":true,
+        // "consentText":"My consent text",
+        // "name":"saml-role-name-maper",
+        // "protocolMapper":"saml-role-name-mapper"}
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper");
+
+        int totalMappers = samlMappersRsc.getMappers().size();
+        int totalSamlMappers = samlMappersRsc.getMappersPerProtocol("saml").size();
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        Assertions.assertEquals(totalMappers + 1, samlMappersRsc.getMappers().size());
+        Assertions.assertEquals(totalSamlMappers + 1, samlMappersRsc.getMappersPerProtocol("saml").size());
+
+        ProtocolMapperRepresentation created = samlMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, created);
+    }
+
+    @Test
+    public void test05CreateOidcProtocolMapper() {
+        //{"protocol":"openid-connect",
+        // "config":{"role":"myrole"},
+        // "consentRequired":true,
+        // "consentText":"My consent text",
+        // "name":"oidc-hardcoded-role-mapper",
+        // "protocolMapper":"oidc-hardcoded-role-mapper"}
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper");
+
+        int totalMappers = oidcMappersRsc.getMappers().size();
+        int totalOidcMappers = oidcMappersRsc.getMappersPerProtocol("openid-connect").size();
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        Assertions.assertEquals(totalMappers + 1, oidcMappersRsc.getMappers().size());
+        Assertions.assertEquals(totalOidcMappers + 1, oidcMappersRsc.getMappersPerProtocol("openid-connect").size());
+
+        ProtocolMapperRepresentation created = oidcMappersRsc.getMapperById(createdId);//findByName(samlMappersRsc, "saml-role-name-mapper");
+        assertEqualMappers(rep, created);
+
+    }
+
+    @Test
+    public void test06UpdateSamlMapper() {
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper2");
+
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        rep.getConfig().put("role", "account.manage-account");
+        rep.setId(createdId);
+        samlMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(samlClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        ProtocolMapperRepresentation updated = samlMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, updated);
+    }
+
+    @Test
+    public void test07UpdateOidcMapper() {
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper2");
+
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        rep.getConfig().put("role", "myotherrole");
+        rep.setId(createdId);
+        oidcMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        ProtocolMapperRepresentation updated = oidcMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, updated);
+    }
+
+    @Test
+    public void test08DeleteSamlMapper() {
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper3");
+
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        samlMappersRsc.delete(createdId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(samlClient.getId(), createdId), ResourceType.PROTOCOL_MAPPER);
+
+        try {
+            samlMappersRsc.getMapperById(createdId);
+            Assertions.fail("Not expected to find mapper");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void test09DeleteOidcMapper() {
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper3");
+
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        oidcMappersRsc.delete(createdId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), ResourceType.PROTOCOL_MAPPER);
+
+        try {
+            oidcMappersRsc.getMapperById(createdId);
+            Assertions.fail("Not expected to find mapper");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void test10EffectiveMappers() {
+        // Web origins mapper
+        ProtocolMapperRepresentation rep = makeMapper(OIDCLoginProtocol.LOGIN_PROTOCOL, "web-origins", AllowedWebOriginsProtocolMapper.PROVIDER_ID, Collections.emptyMap());
+
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+        rep = oidcMappersRsc.getMapperById(createdId);
+
+        // Test default values available on the protocol mapper
+        Assertions.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+        Assertions.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+
+        // Update mapper to not contain default values
+        rep.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN);
+        rep.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION);
+        oidcMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        // Test configuration will contain "effective values", which are the default values of particular options
+        rep = oidcMappersRsc.getMapperById(createdId);
+        Assertions.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+        Assertions.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+
+        // Override "includeInIntrospection"
+        rep.getConfig().put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "false");
+        oidcMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClient.getId(), createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        // Get mapper and check that "includeInIntrospection" is using overriden value instead of the default
+        rep = oidcMappersRsc.getMapperById(createdId);
+        Assertions.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+        Assertions.assertEquals("false", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+    }
+
+    public static class OidcClient implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId("oidcMapperClient")
+                    .name("oidcMapperClient")
+                    .protocol("openid-connect");
+        }
+    }
+
+    public static class SamlClient implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId("samlMapperClient")
+                    .name("samlMapperClient")
+                    .protocol("saml");
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientRolesTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientRolesTest.java
new file mode 100644
index 000000000000..1e85c3c16deb
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientRolesTest.java
@@ -0,0 +1,405 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import jakarta.ws.rs.ClientErrorException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.RoleByIdResource;
+import org.keycloak.admin.client.resource.RoleResource;
+import org.keycloak.admin.client.resource.RolesResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.RoleBuilder;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest
+public class ClientRolesTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectClient(config = ClientRolesClientConfig.class)
+    ManagedClient managedClient;
+
+    private ClientResource clientRsc;
+    private String clientDbId;
+    private RolesResource rolesRsc;
+
+    @BeforeEach
+    public void init() {
+        clientDbId = managedClient.getId();
+        clientRsc = managedClient.admin();
+        rolesRsc = clientRsc.roles();
+    }
+
+    private RoleRepresentation makeRole(String name) {
+        return RoleBuilder.create()
+                .name(name)
+                .build();
+    }
+
+    private boolean hasRole(RolesResource rolesRsc, String name) {
+        for (RoleRepresentation role : rolesRsc.list()) {
+            if (role.getName().equals(name)) return true;
+        }
+
+        return false;
+    }
+
+    @Test
+    public void testAddRole() {
+        RoleRepresentation role1 = RoleBuilder.create()
+                .name("role1")
+                .description("role1-description")
+                .singleAttribute("role1-attr-key", "role1-attr-val")
+                .build();
+        rolesRsc.create(role1);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("role1"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role1"), role1, ResourceType.CLIENT_ROLE);
+
+        RoleRepresentation addedRole = rolesRsc.get(role1.getName()).toRepresentation();
+        assertEquals(role1.getName(), addedRole.getName());
+        assertEquals(role1.getDescription(), addedRole.getDescription());
+        assertEquals(role1.getAttributes(), addedRole.getAttributes());
+    }
+
+    @Test
+    public void createRoleWithSameName() {
+        RoleRepresentation role = RoleBuilder.create().name("role-a").build();
+        rolesRsc.create(role);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("role-a"));
+        assertThrows(ClientErrorException.class, () -> rolesRsc.create(role), "Client role with the same name is not allowed");
+    }
+
+    @Test
+    public void createRoleWithNamePattern() {
+        RoleRepresentation role = RoleBuilder.create().name("role-a-{pattern}").build();
+        rolesRsc.create(role);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("role-a-{pattern}"));
+    }
+
+    @Test
+    public void testRemoveRole() {
+        RoleRepresentation role2 = makeRole("role2");
+        rolesRsc.create(role2);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role2"), role2, ResourceType.CLIENT_ROLE);
+
+        rolesRsc.deleteRole("role2");
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role2"), ResourceType.CLIENT_ROLE);
+
+        assertFalse(hasRole(rolesRsc, "role2"));
+    }
+
+    @Test
+    public void testComposites() {
+        RoleRepresentation roleA = makeRole("role-a");
+        rolesRsc.create(roleA);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("role-a"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role-a"), roleA, ResourceType.CLIENT_ROLE);
+
+        assertFalse(rolesRsc.get("role-a").toRepresentation().isComposite());
+        assertEquals(0, rolesRsc.get("role-a").getRoleComposites().size());
+
+        RoleRepresentation roleB = makeRole("role-b");
+        rolesRsc.create(roleB);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("role-b"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role-b"), roleB, ResourceType.CLIENT_ROLE);
+
+        RoleRepresentation roleC = makeRole("role-c");
+        managedRealm.admin().roles().create(roleC);
+        managedRealm.cleanup().add(r -> r.roles().deleteRole("role-c"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourcePath("role-c"), roleC, ResourceType.REALM_ROLE);
+
+        List<RoleRepresentation> l = new LinkedList<>();
+        l.add(rolesRsc.get("role-b").toRepresentation());
+        l.add(managedRealm.admin().roles().get("role-c").toRepresentation());
+        rolesRsc.get("role-a").addComposites(l);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourceCompositesPath(clientDbId, "role-a"), l, ResourceType.CLIENT_ROLE);
+
+        Set<RoleRepresentation> composites = rolesRsc.get("role-a").getRoleComposites();
+
+        assertTrue(rolesRsc.get("role-a").toRepresentation().isComposite());
+        Assert.assertNames(composites, "role-b", "role-c");
+
+        Set<RoleRepresentation> realmComposites = rolesRsc.get("role-a").getRealmRoleComposites();
+        Assert.assertNames(realmComposites, "role-c");
+
+        Set<RoleRepresentation> clientComposites = rolesRsc.get("role-a").getClientRoleComposites(clientRsc.toRepresentation().getId());
+        Assert.assertNames(clientComposites, "role-b");
+
+        rolesRsc.get("role-a").deleteComposites(l);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientRoleResourceCompositesPath(clientDbId, "role-a"), l, ResourceType.CLIENT_ROLE);
+
+        assertFalse(rolesRsc.get("role-a").toRepresentation().isComposite());
+        assertEquals(0, rolesRsc.get("role-a").getRoleComposites().size());
+    }
+
+
+    @Test
+    public void testCompositeRolesSearch() {
+        // Create main-role we will work on
+        RoleRepresentation mainRole = makeRole("main-role");
+        rolesRsc.create(mainRole);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("main-role"));
+
+        RoleResource mainRoleRsc = rolesRsc.get("main-role");
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "main-role"), mainRole, ResourceType.CLIENT_ROLE);
+
+        // Add composites
+        List<RoleRepresentation> createdRoles = IntStream.range(0, 20)
+                .boxed()
+                .map(i -> makeRole("role" + i))
+                .peek(rolesRsc::create)
+                .peek(role -> managedClient.cleanup().add(c -> c.roles().deleteRole(role.getName())))
+                .peek(role -> AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, role.getName()), role, ResourceType.CLIENT_ROLE))
+                .map(role -> rolesRsc.get(role.getName()).toRepresentation())
+                .collect(Collectors.toList());
+
+        mainRoleRsc.addComposites(createdRoles);
+        mainRole = mainRoleRsc.toRepresentation();
+        RoleByIdResource roleByIdResource = managedRealm.admin().rolesById();
+
+        // Search for all composites
+        Set<RoleRepresentation> foundRoles = roleByIdResource.getRoleComposites(mainRole.getId());
+        assertThat(foundRoles, hasSize(createdRoles.size()));
+
+        // Search paginated composites
+        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), null, 0, 10);
+        assertThat(foundRoles, hasSize(10));
+
+        // Search for composites by string role1 (should be role1, role10-role19) without pagination
+        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), "role1", null, null);
+        assertThat(foundRoles, hasSize(11));
+
+        // Search for role1 with pagination
+        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), "role1", 5, 5);
+        assertThat(foundRoles, hasSize(5));
+    }
+
+    @Test
+    public void usersInRole() {
+        String clientID = managedClient.getId();
+
+        // create test role on client
+        String roleName = "test-role";
+        RoleRepresentation role = makeRole(roleName);
+        rolesRsc.create(role);
+        managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+        assertTrue(hasRole(rolesRsc, roleName));
+        List<RoleRepresentation> roleToAdd = Collections.singletonList(rolesRsc.get(roleName).toRepresentation());
+
+        //create users and assign test role
+        List<String> usernames = createUsernames(0, 10);
+        usernames.forEach(username -> {
+            UserRepresentation user = new UserRepresentation();
+            user.setUsername(username);
+            String userUuid = ApiUtil.getCreatedId(managedRealm.admin().users().create(user));
+            managedRealm.cleanup().add(r -> r.users().delete(userUuid));
+            managedRealm.admin().users().get(userUuid).roles().clientLevel(clientID).add(roleToAdd);
+        });
+
+        // check if users have test role assigned
+        RoleResource roleResource = rolesRsc.get(roleName);
+        List<UserRepresentation> usersInRole = roleResource.getUserMembers();
+        assertEquals(usernames, extractUsernames(usersInRole));
+
+        // pagination
+        List<UserRepresentation> usersInRole1 = roleResource.getUserMembers(0, 5);
+        assertEquals(createUsernames(0, 5), extractUsernames(usersInRole1));
+        Assertions.assertNotNull(usersInRole1.get(0).getNotBefore(), "Not in full representation");
+        List<UserRepresentation> usersInRole2 = roleResource.getUserMembers(true, 5, 10);
+        assertEquals(createUsernames(5, 10), extractUsernames(usersInRole2));
+        Assert.assertNull(usersInRole2.get(0).getNotBefore(), "Not in brief representation");
+    }
+
+    private static List<String> createUsernames(int startIndex, int endIndex) {
+        List<String> usernames = new ArrayList<>();
+        for (int i = startIndex; i < endIndex; i++) {
+            String userName = "user" + i;
+            usernames.add(userName);
+        }
+        return usernames;
+    }
+
+    private static List<String> extractUsernames(Collection<UserRepresentation> users) {
+        return users.stream().map(UserRepresentation::getUsername).collect(Collectors.toList());
+    }
+
+    @Test
+    public void testSearchForRoles() {
+        for (int i = 0; i < 15; i++) {
+            String roleName = "role" + i;
+            RoleRepresentation role = makeRole(roleName);
+            rolesRsc.create(role);
+            managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleName), role, ResourceType.CLIENT_ROLE);
+        }
+
+        String roleNameA = "abcdef";
+        RoleRepresentation roleA = makeRole(roleNameA);
+        rolesRsc.create(roleA);
+        managedClient.cleanup().add(c -> c.roles().deleteRole(roleNameA));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleNameA), roleA, ResourceType.CLIENT_ROLE);
+
+        String roleNameB = "defghi";
+        RoleRepresentation roleB = makeRole(roleNameB);
+        rolesRsc.create(roleB);
+        managedClient.cleanup().add(c -> c.roles().deleteRole(roleNameB));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleNameB), roleB, ResourceType.CLIENT_ROLE);
+
+        List<RoleRepresentation> resultSearch = rolesRsc.list("def", -1, -1);
+        assertEquals(2, resultSearch.size());
+
+        List<RoleRepresentation> resultSearch2 = rolesRsc.list("role", -1, -1);
+        assertEquals(15, resultSearch2.size());
+
+        List<RoleRepresentation> resultSearchPagination = rolesRsc.list("role", 1, 5);
+        assertEquals(5, resultSearchPagination.size());
+    }
+
+    @Test
+    public void testPaginationRoles() {
+        for (int i = 0; i < 15; i++) {
+            String roleName = "role" + i;
+            RoleRepresentation role = makeRole(roleName);
+            rolesRsc.create(role);
+            managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleName), role, ResourceType.CLIENT_ROLE);
+        }
+
+        List<RoleRepresentation> resultSearchWithoutPagination = rolesRsc.list();
+        assertEquals(15, resultSearchWithoutPagination.size());
+
+        List<RoleRepresentation> resultSearchPagination = rolesRsc.list(1, 5);
+        assertEquals(5, resultSearchPagination.size());
+
+        List<RoleRepresentation> resultSearchPaginationIncoherentParams = rolesRsc.list(1, null);
+        assertTrue(resultSearchPaginationIncoherentParams.size() >= 15);
+    }
+
+    @Test
+    public void testPaginationRolesCache() {
+        for (int i = 0; i < 5; i++) {
+            String roleName = "paginaterole" + i;
+            RoleRepresentation role = makeRole(roleName);
+            rolesRsc.create(role);
+            managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleName), role, ResourceType.CLIENT_ROLE);
+        }
+
+        List<RoleRepresentation> resultBeforeAddingRoleToTestCache = rolesRsc.list(1, 1000);
+
+        // after a first call which init the cache, we add a new role to see if the result change
+
+        RoleRepresentation role = makeRole("anewrole");
+        rolesRsc.create(role);
+        managedClient.cleanup().add(c -> c.roles().deleteRole("anewrole"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "anewrole"), role, ResourceType.CLIENT_ROLE);
+
+        List<RoleRepresentation> resultAfterAddingRoleToTestCache = rolesRsc.list(1, 1000);
+
+        assertEquals(resultBeforeAddingRoleToTestCache.size() + 1, resultAfterAddingRoleToTestCache.size());
+    }
+
+    @Test
+    public void getRolesWithFullRepresentation() {
+        for (int i = 0; i < 5; i++) {
+            String roleName = "attributesrole" + i;
+            RoleRepresentation role = RoleBuilder.create()
+                    .name(roleName)
+                    .attributes(Map.of("attribute1", List.of("value1", "value2")))
+                    .build();
+
+            rolesRsc.create(role);
+            managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleName), role, ResourceType.CLIENT_ROLE);
+        }
+
+        List<RoleRepresentation> roles = rolesRsc.list(false);
+        roles.forEach(role -> assertTrue(role.getAttributes().containsKey("attribute1")));
+    }
+
+    @Test
+    public void getRolesWithBriefRepresentation() {
+        for (int i = 0; i < 5; i++) {
+            String roleName = "attributesrole" + i;
+            RoleRepresentation role = RoleBuilder.create()
+                    .name(roleName)
+                    .attributes(Map.of("attribute1", List.of("value1", "value2")))
+                    .build();
+
+            rolesRsc.create(role);
+            managedClient.cleanup().add(c -> c.roles().deleteRole(roleName));
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, roleName), role, ResourceType.CLIENT_ROLE);
+        }
+
+        List<RoleRepresentation> roles = rolesRsc.list();
+        roles.forEach(role -> assertNull(role.getAttributes()));
+    }
+
+    private static class ClientRolesClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId("roleClient")
+                    .name("roleClient")
+                    .protocol("openid-connect");
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeProtocolMapperTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeProtocolMapperTest.java
new file mode 100644
index 000000000000..98741a7736e0
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeProtocolMapperTest.java
@@ -0,0 +1,289 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientScopeResource;
+import org.keycloak.admin.client.resource.ClientScopesResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
+import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class ClientScopeProtocolMapperTest extends AbstractProtocolMapperTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    private String oidcClientScopeId;
+    private ProtocolMappersResource oidcMappersRsc;
+    private String samlClientScopeId;
+    private ProtocolMappersResource samlMappersRsc;
+
+    @BeforeEach
+    public void init() {
+        oidcClientScopeId = createClientScope("oidcMapperClient-scope", OIDCLoginProtocol.LOGIN_PROTOCOL);
+        oidcMappersRsc = clientScopes().get(oidcClientScopeId).getProtocolMappers();
+
+        samlClientScopeId = createClientScope("samlMapperClient-scope", SamlProtocol.LOGIN_PROTOCOL);
+        samlMappersRsc = clientScopes().get(samlClientScopeId).getProtocolMappers();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        removeClientScope(oidcClientScopeId);
+        removeClientScope(samlClientScopeId);
+    }
+
+    @Test
+    public void test01GetMappersList() {
+        Assertions.assertTrue(oidcMappersRsc.getMappers().isEmpty());
+        Assertions.assertTrue(samlMappersRsc.getMappers().isEmpty());
+    }
+
+    @Test
+    public void test02CreateOidcMappersFromList() {
+        testAddAllBuiltinMappers(oidcMappersRsc, "openid-connect", AdminEventPaths.clientScopeProtocolMappersPath(oidcClientScopeId));
+    }
+
+    @Test
+    public void test03CreateSamlMappersFromList() {
+        testAddAllBuiltinMappers(samlMappersRsc, "saml", AdminEventPaths.clientScopeProtocolMappersPath(samlClientScopeId));
+    }
+
+    @Test
+    public void test04CreateSamlProtocolMapper() {
+
+        //{"protocol":"saml",
+        // "config":{"role":"account.view-profile","new.role.name":"new-role-name"},
+        // "consentRequired":true,
+        // "consentText":"My consent text",
+        // "name":"saml-role-name-maper",
+        // "protocolMapper":"saml-role-name-mapper"}
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper");
+
+        int totalMappers = samlMappersRsc.getMappers().size();
+        int totalSamlMappers = samlMappersRsc.getMappersPerProtocol("saml").size();
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        Assertions.assertEquals(totalMappers + 1, samlMappersRsc.getMappers().size());
+        Assertions.assertEquals(totalSamlMappers + 1, samlMappersRsc.getMappersPerProtocol("saml").size());
+
+        ProtocolMapperRepresentation created = samlMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, created);
+    }
+
+    @Test
+    public void test05CreateOidcProtocolMapper() {
+        //{"protocol":"openid-connect",
+        // "config":{"role":"myrole"},
+        // "consentRequired":true,
+        // "consentText":"My consent text",
+        // "name":"oidc-hardcoded-role-mapper",
+        // "protocolMapper":"oidc-hardcoded-role-mapper"}
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper");
+
+        int totalMappers = oidcMappersRsc.getMappers().size();
+        int totalOidcMappers = oidcMappersRsc.getMappersPerProtocol("openid-connect").size();
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        Assertions.assertEquals(totalMappers + 1, oidcMappersRsc.getMappers().size());
+        Assertions.assertEquals(totalOidcMappers + 1, oidcMappersRsc.getMappersPerProtocol("openid-connect").size());
+
+        ProtocolMapperRepresentation created = oidcMappersRsc.getMapperById(createdId);//findByName(samlMappersRsc, "saml-role-name-mapper");
+        assertEqualMappers(rep, created);
+    }
+
+    @Test
+    public void test06UpdateSamlMapper() {
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper2");
+
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        rep.getConfig().put("role", "account.manage-account");
+        rep.setId(createdId);
+        samlMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        ProtocolMapperRepresentation updated = samlMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, updated);
+    }
+
+    @Test
+    public void test07UpdateOidcMapper() {
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper2");
+
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        rep.getConfig().put("role", "myotherrole");
+        rep.setId(createdId);
+        oidcMappersRsc.update(createdId, rep);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        ProtocolMapperRepresentation updated = oidcMappersRsc.getMapperById(createdId);
+        assertEqualMappers(rep, updated);
+    }
+
+    @Test
+    public void test08EffectiveMappers() {
+        ClientScopeResource rolesScope = ApiUtil.findClientScopeByName(managedRealm.admin(), "roles");
+        Assertions.assertNotNull(rolesScope);
+        List<ProtocolMapperRepresentation> mappers = rolesScope.getProtocolMappers().getMappers();
+        ProtocolMapperRepresentation audienceMapper = mappers.stream()
+                .filter(mapper ->
+                        mapper.getProtocol().equals(OIDCLoginProtocol.LOGIN_PROTOCOL) && mapper.getName().equals(OIDCLoginProtocolFactory.AUDIENCE_RESOLVE)
+                ).findFirst().orElseThrow();
+
+        String clientScopeID = rolesScope.toRepresentation().getId();
+        String protocolMapperId = audienceMapper.getId();
+        Map<String, String> origConfig = audienceMapper.getConfig();
+
+        try {
+            // Test default values available on the protocol mapper
+            Assertions.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+            Assertions.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+
+            // Update mapper to not contain default values
+            audienceMapper.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN);
+            audienceMapper.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION);
+            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
+
+            // Test configuration will contain "effective values", which are the default values of particular options
+            audienceMapper = rolesScope.getProtocolMappers().getMapperById(protocolMapperId);
+            Assertions.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+            Assertions.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+
+            // Override "includeInIntrospection"
+            audienceMapper.getConfig().put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "false");
+            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
+
+            // Get mapper and check that "includeInIntrospection" is using overriden value instead of the default
+            audienceMapper = rolesScope.getProtocolMappers().getMapperById(protocolMapperId);
+            Assertions.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
+            Assertions.assertEquals("false", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
+
+        } finally {
+            audienceMapper.getConfig().putAll(origConfig);
+            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
+            AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
+
+        }
+    }
+
+    @Test
+    public void testDeleteSamlMapper() {
+        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper3");
+
+        Response resp = samlMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        samlMappersRsc.delete(createdId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), ResourceType.PROTOCOL_MAPPER);
+
+        try {
+            samlMappersRsc.getMapperById(createdId);
+            Assertions.fail("Not expected to find mapper");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void testDeleteOidcMapper() {
+        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper3");
+
+        Response resp = oidcMappersRsc.createMapper(rep);
+        resp.close();
+        String createdId = ApiUtil.getCreatedId(resp);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
+
+        oidcMappersRsc.delete(createdId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), ResourceType.PROTOCOL_MAPPER);
+
+        try {
+            oidcMappersRsc.getMapperById(createdId);
+            Assertions.fail("Not expected to find mapper");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+
+    private ClientScopesResource clientScopes() {
+        return managedRealm.admin().clientScopes();
+    }
+
+    private String createClientScope(String clientScopeName, String protocol) {
+        ClientScopeRepresentation rep = new ClientScopeRepresentation();
+        rep.setName(clientScopeName);
+        rep.setProtocol(protocol);
+        Response resp = clientScopes().create(rep);
+        String scopeId = ApiUtil.getCreatedId(resp);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeResourcePath(scopeId), rep, ResourceType.CLIENT_SCOPE);
+
+        return scopeId;
+    }
+
+    private void removeClientScope(String clientScopeId) {
+        clientScopes().get(clientScopeId).remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), ResourceType.CLIENT_SCOPE);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTest.java
new file mode 100644
index 000000000000..f5f0e36c6494
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTest.java
@@ -0,0 +1,784 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.RoleMappingResource;
+import org.keycloak.common.util.ObjectUtil;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.AccountRoles;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.Constants;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
+import org.keycloak.representations.idm.MappingsRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.tests.utils.matchers.Matchers;
+import org.keycloak.testsuite.util.RoleBuilder;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.keycloak.tests.utils.Assert.assertNames;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class ClientScopeTest extends AbstractClientScopeTest {
+
+    @Test
+    public void testAddFailureWithInvalidScopeName() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("マルチバイト");
+
+        ErrorRepresentation error;
+        try (Response response = clientScopes().create(scopeRep)) {
+            Assertions.assertEquals(400, response.getStatus());
+            error = response.readEntity(ErrorRepresentation.class);
+        }
+
+        Assertions.assertEquals("Unexpected name \"マルチバイト\" for ClientScope", error.getErrorMessage());
+    }
+
+    @Test
+    public void testUpdateFailureWithInvalidScopeName() {
+        // Creating first
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope1");
+        scopeRep.setProtocol("openid-connect");
+        String scope1Id = createClientScopeWithCleanup(scopeRep);
+        // Assert created
+        scopeRep = clientScopes().get(scope1Id).toRepresentation();
+        Assertions.assertEquals("scope1", scopeRep.getName());
+
+        // Test updating
+        scopeRep.setName("マルチバイト");
+        try {
+            clientScopes().get(scope1Id).update(scopeRep);
+        } catch (ClientErrorException e) {
+            ErrorRepresentation error;
+            try (Response response = e.getResponse()) {
+                Assertions.assertEquals(400, response.getStatus());
+                error = response.readEntity(ErrorRepresentation.class);
+            }
+            Assertions.assertEquals("Unexpected name \"マルチバイト\" for ClientScope", error.getErrorMessage());
+        }
+    }
+
+    @Test
+    public void testAddDuplicatedClientScope() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope1");
+        scopeRep.setProtocol("openid-connect");
+        createClientScopeWithCleanup(scopeRep);
+
+        scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope1");
+        scopeRep.setProtocol("openid-connect");
+        Response response = clientScopes().create(scopeRep);
+        Assertions.assertEquals(409, response.getStatus());
+
+        ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+        Assertions.assertEquals("Client Scope scope1 already exists", error.getErrorMessage());
+        response.close();
+    }
+
+
+    @Test
+    public void testGetUnknownScope() {
+        String unknownId = UUID.randomUUID().toString();
+        Assertions.assertThrows(NotFoundException.class, () -> clientScopes().get(unknownId).toRepresentation());
+    }
+
+
+    private List<String> getClientScopeNames(List<ClientScopeRepresentation> scopes) {
+        return scopes.stream().map(ClientScopeRepresentation::getName).collect(Collectors.toList());
+    }
+
+    @Test
+    public void testRemoveClientScope() {
+        // Create scope1
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope1");
+        scopeRep.setProtocol("openid-connect");
+
+        String scope1Id = createClientScope(scopeRep);
+
+        List<ClientScopeRepresentation> clientScopes = clientScopes().findAll();
+        Assertions.assertTrue(getClientScopeNames(clientScopes).contains("scope1"));
+
+        // Create scope2
+        scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope2");
+        scopeRep.setProtocol("openid-connect");
+
+        String scope2Id = createClientScope(scopeRep);
+
+        clientScopes = clientScopes().findAll();
+        Assertions.assertTrue(getClientScopeNames(clientScopes).contains("scope2"));
+
+        // Remove scope1
+        removeClientScope(scope1Id);
+
+        clientScopes = clientScopes().findAll();
+        Assertions.assertFalse(getClientScopeNames(clientScopes).contains("scope1"));
+        Assertions.assertTrue(getClientScopeNames(clientScopes).contains("scope2"));
+
+
+        // Remove scope2
+        removeClientScope(scope2Id);
+
+        clientScopes = clientScopes().findAll();
+        Assertions.assertFalse(getClientScopeNames(clientScopes).contains("scope1"));
+        Assertions.assertFalse(getClientScopeNames(clientScopes).contains("scope2"));
+    }
+
+
+    @Test
+    public void testUpdateScopeScope() {
+        // Test creating
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope1");
+        scopeRep.setDescription("scope1-desc");
+        scopeRep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+
+        Map<String, String> attrs = new HashMap<>();
+        attrs.put("someAttr", "someAttrValue");
+        attrs.put("emptyAttr", "");
+        scopeRep.setAttributes(attrs);
+        String scope1Id = createClientScopeWithCleanup(scopeRep);
+
+        // Assert created attributes
+        scopeRep = clientScopes().get(scope1Id).toRepresentation();
+        Assertions.assertEquals("scope1", scopeRep.getName());
+        Assertions.assertEquals("scope1-desc", scopeRep.getDescription());
+        Assertions.assertEquals("someAttrValue", scopeRep.getAttributes().get("someAttr"));
+        Assertions.assertTrue(ObjectUtil.isBlank(scopeRep.getAttributes().get("emptyAttr")));
+        Assertions.assertEquals(OIDCLoginProtocol.LOGIN_PROTOCOL, scopeRep.getProtocol());
+
+
+        // Test updating
+        scopeRep.setName("scope1-updated");
+        scopeRep.setDescription("scope1-desc-updated");
+        scopeRep.setProtocol(SamlProtocol.LOGIN_PROTOCOL);
+
+        // Test update attribute to some non-blank value
+        scopeRep.getAttributes().put("emptyAttr", "someValue");
+
+        clientScopes().get(scope1Id).update(scopeRep);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientScopeResourcePath(scope1Id), scopeRep, ResourceType.CLIENT_SCOPE);
+
+        // Assert updated attributes
+        scopeRep = clientScopes().get(scope1Id).toRepresentation();
+        Assertions.assertEquals("scope1-updated", scopeRep.getName());
+        Assertions.assertEquals("scope1-desc-updated", scopeRep.getDescription());
+        Assertions.assertEquals(SamlProtocol.LOGIN_PROTOCOL, scopeRep.getProtocol());
+        Assertions.assertEquals("someAttrValue", scopeRep.getAttributes().get("someAttr"));
+        Assertions.assertEquals("someValue", scopeRep.getAttributes().get("emptyAttr"));
+    }
+
+    @Test
+    public void testRenameScope() {
+        // Create two scopes
+        ClientScopeRepresentation scope1Rep = new ClientScopeRepresentation();
+        scope1Rep.setName("scope1");
+        scope1Rep.setDescription("scope1-desc");
+        scope1Rep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        String scope1Id = createClientScopeWithCleanup(scope1Rep);
+
+        ClientScopeRepresentation scope2Rep = new ClientScopeRepresentation();
+        scope2Rep.setName("scope2");
+        scope2Rep.setDescription("scope2-desc");
+        scope2Rep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        String scope2Id = createClientScopeWithCleanup(scope2Rep);
+
+        // Test updating
+        scope2Rep.setName("scope1");
+
+        try {
+            clientScopes().get(scope2Id).update(scope2Rep);
+        } catch (ClientErrorException ex) {
+            assertThat(ex.getResponse(), Matchers.statusCodeIs(Status.CONFLICT));
+        }
+    }
+
+
+    @Test
+    public void testScopes() {
+        RoleRepresentation realmCompositeRole = createRealmRoleWithCleanup("realm-composite");
+        RoleRepresentation realmChildRole = createRealmRoleWithCleanup("realm-child");
+        managedRealm.admin().roles().get("realm-composite").addComposites(Collections.singletonList(realmChildRole));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE,
+                AdminEventPaths.roleResourceCompositesPath("realm-composite"),
+                Collections.singletonList(realmChildRole), ResourceType.REALM_ROLE);
+
+        // create client scope
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("bar-scope");
+        scopeRep.setProtocol("openid-connect");
+        String scopeId = createClientScopeWithCleanup(scopeRep);
+
+        // update with some scopes
+        String accountMgmtId =
+                managedRealm.admin().clients().findByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).get(0).getId();
+        RoleRepresentation viewAccountRoleRep = managedRealm.admin().clients().get(accountMgmtId).roles()
+                .get(AccountRoles.VIEW_PROFILE).toRepresentation();
+        RoleMappingResource scopesResource = clientScopes().get(scopeId).getScopeMappings();
+
+        scopesResource.realmLevel().add(Collections.singletonList(realmCompositeRole));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE,
+                AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId),
+                Collections.singletonList(realmCompositeRole), ResourceType.REALM_SCOPE_MAPPING);
+
+        scopesResource.clientLevel(accountMgmtId).add(Collections.singletonList(viewAccountRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE,
+                AdminEventPaths.clientScopeRoleMappingsClientLevelPath(scopeId, accountMgmtId),
+                Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
+
+        // test that scopes are available (also through composite role)
+        List<RoleRepresentation> allRealm = scopesResource.realmLevel().listAll();
+        List<RoleRepresentation> availableRealm = scopesResource.realmLevel().listAvailable();
+        List<RoleRepresentation> effectiveRealm = scopesResource.realmLevel().listEffective();
+        List<RoleRepresentation> accountRoles = scopesResource.clientLevel(accountMgmtId).listAll();
+
+        assertNames(allRealm, "realm-composite");
+        assertNames(availableRealm, "realm-child", Constants.OFFLINE_ACCESS_ROLE, Constants.AUTHZ_UMA_AUTHORIZATION,
+                Constants.DEFAULT_ROLES_ROLE_PREFIX + "-default");
+        assertNames(effectiveRealm, "realm-composite", "realm-child");
+        assertNames(accountRoles, AccountRoles.VIEW_PROFILE);
+        MappingsRepresentation mappingsRep = clientScopes().get(scopeId).getScopeMappings().getAll();
+        assertNames(mappingsRep.getRealmMappings(), "realm-composite");
+        assertNames(mappingsRep.getClientMappings().get(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getMappings(),
+                AccountRoles.VIEW_PROFILE);
+
+
+        // remove scopes
+        scopesResource.realmLevel().remove(Collections.singletonList(realmCompositeRole));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE,
+                AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId),
+                Collections.singletonList(realmCompositeRole), ResourceType.REALM_SCOPE_MAPPING);
+
+        scopesResource.clientLevel(accountMgmtId).remove(Collections.singletonList(viewAccountRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE,
+                AdminEventPaths.clientScopeRoleMappingsClientLevelPath(scopeId, accountMgmtId),
+                Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
+
+        // assert scopes are removed
+        allRealm = scopesResource.realmLevel().listAll();
+        availableRealm = scopesResource.realmLevel().listAvailable();
+        effectiveRealm = scopesResource.realmLevel().listEffective();
+        accountRoles = scopesResource.clientLevel(accountMgmtId).listAll();
+        assertNames(allRealm);
+        assertNames(availableRealm, "realm-composite", "realm-child", Constants.OFFLINE_ACCESS_ROLE,
+                Constants.AUTHZ_UMA_AUTHORIZATION,
+                Constants.DEFAULT_ROLES_ROLE_PREFIX + "-default");
+        assertNames(effectiveRealm);
+        assertNames(accountRoles);
+    }
+
+    /**
+     * Test for KEYCLOAK-10603.
+     */
+    @Test
+    public void rolesCanBeAddedToScopeEvenWhenTheyAreAlreadyIndirectlyAssigned() {
+        RealmResource realm = managedRealm.admin();
+        ClientScopeRepresentation clientScopeRep = new ClientScopeRepresentation();
+        clientScopeRep.setName("my-scope");
+        clientScopeRep.setProtocol("openid-connect");
+
+        String clientScopeId = createClientScopeWithCleanup(clientScopeRep);
+
+        createRealmRoleWithCleanup("realm-composite");
+        createRealmRoleWithCleanup("realm-child");
+        realm.roles().get("realm-composite")
+                .addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourceType(ResourceType.REALM_ROLE);
+
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("role-container-client");
+        createClientWithCleanup(clientRep);
+        String roleContainerClientUuid = realm.clients().findByClientId("role-container-client").stream().findFirst().orElseThrow().getId();
+        ClientResource roleContainerClient = realm.clients().get(roleContainerClientUuid);
+
+        RoleRepresentation clientCompositeRole = RoleBuilder.create().name("client-composite").build();
+        roleContainerClient.roles().create(clientCompositeRole);
+        roleContainerClient.roles().create(RoleBuilder.create().name("client-child").build());
+        roleContainerClient.roles().get("client-composite").addComposites(Collections
+                .singletonList(
+                        roleContainerClient.roles().get("client-child").toRepresentation()));
+
+        // Make indirect assignments: assign composite roles
+        RoleMappingResource scopesResource = realm.clientScopes().get(clientScopeId).getScopeMappings();
+        scopesResource.realmLevel()
+                .add(Collections.singletonList(realm.roles().get("realm-composite").toRepresentation()));
+        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
+                .singletonList(realm.clients().get(roleContainerClientUuid).roles().get("client-composite")
+                        .toRepresentation()));
+
+        // check state before making the direct assignments
+        assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
+        assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-default");
+        assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite");
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable(), "client-child");
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
+                "client-child");
+
+        // Make direct assignments for roles which are already indirectly assigned
+        scopesResource.realmLevel().add(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
+        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
+                .singletonList(
+                        realm.clients().get(roleContainerClientUuid).roles().get("client-child").toRepresentation()));
+
+        // List realm roles
+        assertNames(scopesResource.realmLevel().listAll(), "realm-composite", "realm-child");
+        assertNames(scopesResource.realmLevel().listAvailable(), "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-default");
+        assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        // List client roles
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite",
+                "client-child");
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable());
+        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
+                "client-child");
+    }
+
+    // KEYCLOAK-2809
+    @Test
+    public void testRemoveScopedRole() {
+        // Add realm role
+        RoleRepresentation roleRep = createRealmRole("foo-role");
+
+        // Add client scope
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("bar-scope");
+        scopeRep.setProtocol("openid-connect");
+
+        String scopeId = createClientScopeWithCleanup(scopeRep);
+
+        // Add realm role to scopes of clientScope
+        clientScopes().get(scopeId).getScopeMappings().realmLevel().add(Collections.singletonList(roleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId), Collections.singletonList(roleRep), ResourceType.REALM_SCOPE_MAPPING);
+
+        List<RoleRepresentation> roleReps = clientScopes().get(scopeId).getScopeMappings().realmLevel().listAll();
+        Assertions.assertEquals(1, roleReps.size());
+        Assertions.assertEquals("foo-role", roleReps.get(0).getName());
+
+        // Remove realm role
+        managedRealm.admin().roles().deleteRole("foo-role");
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.roleResourcePath("foo-role"), ResourceType.REALM_ROLE);
+
+        // Get scope mappings
+        roleReps = clientScopes().get(scopeId).getScopeMappings().realmLevel().listAll();
+        Assertions.assertEquals(0, roleReps.size());
+    }
+
+    private RoleRepresentation createRealmRole(String roleName) {
+        RoleRepresentation roleRep = new RoleRepresentation();
+        roleRep.setName(roleName);
+        managedRealm.admin().roles().create(roleRep);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.roleResourcePath(roleName), roleRep, ResourceType.REALM_ROLE);
+
+        return managedRealm.admin().roles().get(roleName).toRepresentation();
+    }
+
+    private RoleRepresentation createRealmRoleWithCleanup(String roleName) {
+        RoleRepresentation roleRep = createRealmRole(roleName);
+        managedRealm.cleanup().add(r -> r.roles().get(roleName).remove());
+        return roleRep;
+    }
+
+    @Test
+    public void testRemoveClientScopeInUse() {
+        // Add client scope
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("foo-scope");
+        scopeRep.setProtocol("openid-connect");
+        String scopeId = createClientScope(scopeRep);
+
+        // Add client with the clientScope
+        managedRealm.updateWithCleanup(r -> {
+            r.addClient("bar-client")
+                    .name("bar-client")
+                    .protocol("openid-connect")
+                    .defaultClientScopes("foo-scope");
+            return r;
+        });
+        adminEvents.skip();
+
+        removeClientScope(scopeId);
+    }
+
+
+    @Test
+    public void testRealmDefaultClientScopes() {
+        // Create 2 client scopes
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-def");
+        scopeRep.setProtocol("openid-connect");
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-opt");
+        scopeRep.setProtocol("openid-connect");
+        String scopeOptId = createClientScopeWithCleanup(scopeRep);
+
+        // Add scope-def as default and scope-opt as optional client scope
+        managedRealm.admin().addDefaultDefaultClientScope(scopeDefId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
+        managedRealm.admin().addDefaultOptionalClientScope(scopeOptId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
+
+        // Ensure defaults and optional scopes are here
+        List<String> realmDefaultScopes = getClientScopeNames(managedRealm.admin().getDefaultDefaultClientScopes());
+        List<String> realmOptionalScopes = getClientScopeNames(managedRealm.admin().getDefaultOptionalClientScopes());
+        Assertions.assertTrue(realmDefaultScopes.contains("scope-def"));
+        Assertions.assertFalse(realmOptionalScopes.contains("scope-def"));
+        Assertions.assertFalse(realmDefaultScopes.contains("scope-opt"));
+        Assertions.assertTrue(realmOptionalScopes.contains("scope-opt"));
+
+        // create client. Ensure that it has scope-def and scope-opt scopes assigned
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("bar-client");
+        clientRep.setProtocol("openid-connect");
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        ClientResource client = managedRealm.admin().clients().get(clientUuid);
+        List<String> clientDefaultScopes = getClientScopeNames(client.getDefaultClientScopes());
+        List<String> clientOptionalScopes = getClientScopeNames(client.getOptionalClientScopes());
+        Assertions.assertTrue(clientDefaultScopes.contains("scope-def"));
+        Assertions.assertFalse(clientOptionalScopes.contains("scope-def"));
+        Assertions.assertFalse(clientDefaultScopes.contains("scope-opt"));
+        Assertions.assertTrue(clientOptionalScopes.contains("scope-opt"));
+
+        // Unassign scope-def and scope-opt from realm
+        managedRealm.admin().removeDefaultDefaultClientScope(scopeDefId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
+        managedRealm.admin().removeDefaultOptionalClientScope(scopeOptId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
+
+        realmDefaultScopes = getClientScopeNames(managedRealm.admin().getDefaultDefaultClientScopes());
+        realmOptionalScopes = getClientScopeNames(managedRealm.admin().getDefaultOptionalClientScopes());
+        Assertions.assertFalse(realmDefaultScopes.contains("scope-def"));
+        Assertions.assertFalse(realmOptionalScopes.contains("scope-def"));
+        Assertions.assertFalse(realmDefaultScopes.contains("scope-opt"));
+        Assertions.assertFalse(realmOptionalScopes.contains("scope-opt"));
+
+        // Create another client. Check it doesn't have scope-def and scope-opt scopes assigned
+        ClientRepresentation clientRep2 = new ClientRepresentation();
+        clientRep2.setClientId("bar-client-2");
+        clientRep2.setProtocol("openid-connect");
+        final String clientUuid2 = createClientWithCleanup(clientRep2);
+
+        ClientResource client2 = managedRealm.admin().clients().get(clientUuid2);
+        clientDefaultScopes = getClientScopeNames(client2.getDefaultClientScopes());
+        clientOptionalScopes = getClientScopeNames(client2.getOptionalClientScopes());
+        Assertions.assertFalse(clientDefaultScopes.contains("scope-def"));
+        Assertions.assertFalse(clientOptionalScopes.contains("scope-def"));
+        Assertions.assertFalse(clientDefaultScopes.contains("scope-opt"));
+        Assertions.assertFalse(clientOptionalScopes.contains("scope-opt"));
+    }
+
+    // KEYCLOAK-9999
+    @Test
+    public void defaultOptionalClientScopeCanBeAssignedToClientAsDefaultScope() {
+
+        // Create optional client scope
+        ClientScopeRepresentation optionalClientScope = new ClientScopeRepresentation();
+        optionalClientScope.setName("optional-client-scope");
+        optionalClientScope.setProtocol("openid-connect");
+        String optionalClientScopeId = createClientScopeWithCleanup(optionalClientScope);
+
+        managedRealm.admin().addDefaultOptionalClientScope(optionalClientScopeId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(optionalClientScopeId), ResourceType.CLIENT_SCOPE);
+
+        // Ensure that scope is optional
+        List<String> realmOptionalScopes = getClientScopeNames(managedRealm.admin().getDefaultOptionalClientScopes());
+        Assertions.assertTrue(realmOptionalScopes.contains("optional-client-scope"));
+
+        // Create client
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("test-client");
+        clientRep.setDefaultClientScopes(Collections.singletonList("optional-client-scope"));
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        // Ensure that default optional client scope is a default scope of the client
+        ClientResource client = managedRealm.admin().clients().get(clientUuid);
+        List<String> clientDefaultScopes = getClientScopeNames(client.getDefaultClientScopes());
+        Assertions.assertTrue(clientDefaultScopes.contains("optional-client-scope"));
+
+        // Ensure that no optional scopes are assigned to the client, even if there are default optional scopes!
+        List<String> clientOptionalScopes = getClientScopeNames(client.getOptionalClientScopes());
+        Assertions.assertTrue(clientOptionalScopes.isEmpty());
+
+        // Unassign optional client scope from realm for cleanup
+        managedRealm.admin().removeDefaultOptionalClientScope(optionalClientScopeId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.defaultOptionalClientScopePath(optionalClientScopeId), ResourceType.CLIENT_SCOPE);
+    }
+
+    // KEYCLOAK-18332
+    @Test
+    public void scopesRemainAfterClientUpdate() {
+        // Create a bunch of scopes
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-def");
+        scopeRep.setProtocol("openid-connect");
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-opt");
+        scopeRep.setProtocol("openid-connect");
+        String scopeOptId = createClientScopeWithCleanup(scopeRep);
+
+        // Add scope-def as default and scope-opt as optional client scope
+        managedRealm.admin().addDefaultDefaultClientScope(scopeDefId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
+        managedRealm.admin().addDefaultOptionalClientScope(scopeOptId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
+
+        // Create a client
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("bar-client");
+        clientRep.setProtocol("openid-connect");
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        ClientResource client = managedRealm.admin().clients().get(clientUuid);
+        Assertions.assertTrue(getClientScopeNames(client.getDefaultClientScopes()).contains("scope-def"));
+        Assertions.assertTrue(getClientScopeNames(client.getOptionalClientScopes()).contains("scope-opt"));
+
+        // Remove the scopes from client
+        client.removeDefaultClientScope(scopeDefId);
+        client.removeOptionalClientScope(scopeOptId);
+        List<String> expectedDefScopes = getClientScopeNames(client.getDefaultClientScopes());
+        List<String> expectedOptScopes = getClientScopeNames(client.getOptionalClientScopes());
+        Assertions.assertFalse(expectedDefScopes.contains("scope-def"));
+        Assertions.assertFalse(expectedOptScopes.contains("scope-opt"));
+
+        // Update the client
+        clientRep = client.toRepresentation();
+        clientRep.setDescription("desc"); // Make a small change
+        client.update(clientRep);
+
+        // Assert scopes are intact
+        Assertions.assertEquals(expectedDefScopes, getClientScopeNames(client.getDefaultClientScopes()));
+        Assertions.assertEquals(expectedOptScopes, getClientScopeNames(client.getOptionalClientScopes()));
+    }
+
+    // KEYCLOAK-5863
+    @Test
+    public void testUpdateProtocolMappers() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("testUpdateProtocolMappers");
+        scopeRep.setProtocol("openid-connect");
+        String scopeId = createClientScopeWithCleanup(scopeRep);
+
+        ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
+        mapper.setName("test");
+        mapper.setProtocol("openid-connect");
+        mapper.setProtocolMapper("oidc-usermodel-attribute-mapper");
+
+        Map<String, String> m = new HashMap<>();
+        m.put("user.attribute", "test");
+        m.put("claim.name", "");
+        m.put("jsonType.label", "");
+
+        mapper.setConfig(m);
+
+        ProtocolMappersResource protocolMappers = clientScopes().get(scopeId).getProtocolMappers();
+
+        Response response = protocolMappers.createMapper(mapper);
+        String mapperId = ApiUtil.getCreatedId(response);
+
+        mapper = protocolMappers.getMapperById(mapperId);
+
+        mapper.getConfig().put("claim.name", "claim");
+
+        protocolMappers.update(mapperId, mapper);
+
+        List<ProtocolMapperRepresentation> mappers = protocolMappers.getMappers();
+        Assertions.assertEquals(1, mappers.size());
+        Assertions.assertEquals(2, mappers.get(0).getConfig().size());
+        Assertions.assertEquals("test", mappers.get(0).getConfig().get("user.attribute"));
+        Assertions.assertEquals("claim", mappers.get(0).getConfig().get("claim.name"));
+    }
+
+    @Test
+    public void updateClientWithDefaultScopeAssignedAsOptionalAndOpposite() {
+        // create client
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("bar-client");
+        clientRep.setProtocol("openid-connect");
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        // Create 2 client scopes
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-def");
+        scopeRep.setProtocol("openid-connect");
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("scope-opt");
+        scopeRep.setProtocol("openid-connect");
+        String scopeOptId = createClientScopeWithCleanup(scopeRep);
+
+        ClientResource client = managedRealm.admin().clients().get(clientUuid);
+        // assign "scope-def" as optional client scope to client
+        client.addOptionalClientScope(scopeDefId);
+
+        // assign "scope-opt" as default client scope to client
+        client.addDefaultClientScope(scopeOptId);
+
+        // Add scope-def as default and scope-opt as optional client scope within the realm
+        managedRealm.admin().addDefaultDefaultClientScope(scopeDefId);
+        managedRealm.admin().addDefaultOptionalClientScope(scopeOptId);
+
+        //update client - check it passes (it used to throw ModelDuplicateException before)
+        clientRep.setDescription("new_description");
+        Assertions.assertDoesNotThrow(() -> managedRealm.admin().clients().get(clientUuid).update(clientRep));
+    }
+
+    @Test
+    public void testCreateDynamicScopeWithFeatureDisabledAndIsDynamicScopeTrue() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("non-dynamic-scope-def2");
+        scopeRep.setProtocol("openid-connect");
+        scopeRep.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "");
+        }});
+        handleExpectedCreateFailure(scopeRep, 400, "Unexpected value \"true\" for attribute is.dynamic.scope in ClientScope");
+    }
+
+    @Test
+    public void testCreateDynamicScopeWithFeatureDisabledAndNonEmptyDynamicScopeRegexp() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("non-dynamic-scope-def3");
+        scopeRep.setProtocol("openid-connect");
+        scopeRep.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "false");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "not-empty");
+        }});
+        handleExpectedCreateFailure(scopeRep, 400, "Unexpected value \"not-empty\" for attribute dynamic.scope.regexp in ClientScope");
+    }
+
+    @Test
+    public void deleteAllClientScopesMustFail() {
+        List<ClientScopeRepresentation> clientScopes = clientScopes().findAll();
+        for (int i = 0; i < clientScopes.size(); i++) {
+            ClientScopeRepresentation clientScope = clientScopes.get(i);
+            if (i != clientScopes.size() - 1) {
+                removeClientScope(clientScope.getId());
+            } else {
+                removeClientScopeMustFail(clientScope.getId());
+            }
+        }
+    }
+
+    @Test
+    public void createClientScopeWithoutProtocol() {
+        ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
+        clientScope.setName("test-client-scope");
+        clientScope.setDescription("test-client-scope-description");
+        clientScope.setProtocol(null); // this should cause a BadRequestException
+        clientScope.setAttributes(Map.of("test-attribute", "test-value"));
+
+        try (Response response = clientScopes().create(clientScope)) {
+            Assertions.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            String errorMessage = response.readEntity(String.class);
+            Assertions.assertTrue(errorMessage.contains("Unexpected protocol"));
+        }
+    }
+
+    @DisplayName("Create ClientScope with protocol:")
+    @ParameterizedTest
+    @ValueSource(strings = {"openid-connect", "saml", "oid4vc"})
+    public void createClientScopeWithOpenIdProtocol(String protocol) {
+        createClientScope(protocol);
+    }
+
+    private void createClientScope(String protocol) {
+        ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
+        clientScope.setName("test-client-scope");
+        clientScope.setDescription("test-client-scope-description");
+        clientScope.setProtocol(protocol);
+        clientScope.setAttributes(Map.of("test-attribute", "test-value"));
+
+        String clientScopeId = null;
+        try (Response response = clientScopes().create(clientScope)) {
+            Assertions.assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
+            String location = (String) Optional.ofNullable(response.getHeaders().get(HttpHeaders.LOCATION))
+                                               .map(list -> list.get(0))
+                                               .orElse(null);
+            Assertions.assertNotNull(location);
+            clientScopeId = location.substring(location.lastIndexOf("/") + 1);
+        } finally {
+            Assertions.assertNotNull(clientScopeId);
+            // cleanup
+            clientScopes().get(clientScopeId).remove();
+        }
+    }
+
+    private void removeClientScopeMustFail(String clientScopeId) {
+        try {
+            clientScopes().get(clientScopeId).remove();
+        } catch (Exception expected) {
+
+        }
+    }
+
+    private void removeClientScope(String clientScopeId) {
+        clientScopes().get(clientScopeId).remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), ResourceType.CLIENT_SCOPE);
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTestOid4Vci.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTestOid4Vci.java
new file mode 100644
index 000000000000..fd5bccb9d370
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientScopeTestOid4Vci.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.tests.admin.client;
+
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.keycloak.constants.Oid4VciConstants;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.DefaultServerConfigWithOid4Vci;
+
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * @author Pascal Knüppel
+ */
+@KeycloakIntegrationTest(config = DefaultServerConfigWithOid4Vci.class)
+public class ClientScopeTestOid4Vci extends AbstractClientScopeTest {
+
+    @DisplayName("Verify default values are correctly set")
+    @Test
+    public void testDefaultOid4VciClientScopeAttributes() {
+        ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
+        clientScope.setName("test-client-scope");
+        clientScope.setDescription("test-client-scope-description");
+        clientScope.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
+        clientScope.setAttributes(Map.of("test-attribute", "test-value"));
+
+        String clientScopeId = null;
+        try (Response response = clientScopes().create(clientScope)) {
+            Assertions.assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
+            String location = (String) Optional.ofNullable(response.getHeaders().get(HttpHeaders.LOCATION))
+                                               .map(list -> list.get(0))
+                                               .orElse(null);
+            Assertions.assertNotNull(location);
+            clientScopeId = location.substring(location.lastIndexOf("/") + 1);
+
+            ClientScopeRepresentation createdClientScope = clientScopes().get(clientScopeId).toRepresentation();
+            Assertions.assertNotNull(createdClientScope);
+            Assertions.assertEquals(CredentialScopeModel.SD_JWT_VISIBLE_CLAIMS_DEFAULT,
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.SD_JWT_VISIBLE_CLAIMS));
+            Assertions.assertEquals(String.valueOf(CredentialScopeModel.SD_JWT_DECOYS_DEFAULT),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.SD_JWT_NUMBER_OF_DECOYS));
+            Assertions.assertEquals(CredentialScopeModel.FORMAT_DEFAULT,
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.FORMAT));
+            Assertions.assertEquals(CredentialScopeModel.HASH_ALGORITHM_DEFAULT,
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.HASH_ALGORITHM));
+            Assertions.assertEquals(CredentialScopeModel.TOKEN_TYPE_DEFAULT,
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.TOKEN_JWS_TYPE));
+            Assertions.assertEquals(String.valueOf(CredentialScopeModel.EXPIRY_IN_SECONDS_DEFAULT),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.EXPIRY_IN_SECONDS));
+            Assertions.assertEquals(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT,
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.CONFIGURATION_ID));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.CREDENTIAL_IDENTIFIER));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.TYPES));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.CONTEXTS));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.VCT));
+            Assertions.assertEquals(clientScope.getName(),
+                                    createdClientScope.getAttributes().get(CredentialScopeModel.ISSUER_DID));
+
+        } finally {
+            Assertions.assertNotNull(clientScopeId);
+            // cleanup
+            clientScopes().get(clientScopeId).remove();
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchJpaTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchJpaTest.java
new file mode 100644
index 000000000000..c8518d5dfb43
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchJpaTest.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+/**
+ * @author Vaclav Muzikar <vmuzikar@redhat.com>
+ */
+@KeycloakIntegrationTest
+public class ClientSearchJpaTest extends AbstractClientSearchTest {
+
+    @Test
+    public void testJpaSearchableAttributesUnset() {
+        // JPA store removes all attributes by default, i.e. returns all clients
+        String[] expectedRes = {CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3, "account", "account-console", "admin-cli", "broker", "realm-management", "security-admin-console"};
+
+        search(String.format("%s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL), expectedRes);
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchTest.java
new file mode 100644
index 000000000000..8b6f7a9aba17
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ClientSearchTest.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+/**
+ * @author Vaclav Muzikar <vmuzikar@redhat.com>
+ */
+@KeycloakIntegrationTest(config = ClientSearchTest.SearchableServer.class)
+public class ClientSearchTest extends AbstractClientSearchTest {
+
+    @Test
+    public void testQuerySearch() {
+        search(String.format("%s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL), CLIENT_ID_1);
+        search(String.format("%s:%s", ATTR_URL_NAME, ATTR_URL_VAL), CLIENT_ID_1, CLIENT_ID_2);
+        search(String.format("%s:%s %s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL, ATTR_URL_NAME, ATTR_URL_VAL), CLIENT_ID_1);
+        search(String.format("%s:%s %s:%s", ATTR_ORG_NAME, "wrong val", ATTR_URL_NAME, ATTR_URL_VAL));
+        search(String.format("%s:%s", ATTR_QUOTES_NAME_ESCAPED, ATTR_QUOTES_VAL_ESCAPED), CLIENT_ID_3);
+
+        // "filtered" attribute won't take effect when JPA is used
+        String[] expectedRes = new String[]{CLIENT_ID_1, CLIENT_ID_2};
+        search(String.format("%s:%s %s:%s", ATTR_URL_NAME, ATTR_URL_VAL, ATTR_FILTERED_NAME, ATTR_FILTERED_VAL), expectedRes);
+    }
+
+    public static class SearchableServer implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.option("spi-client-jpa-searchable-attributes", String.join(",", ATTR_URL_NAME, ATTR_ORG_NAME, ATTR_QUOTES_NAME));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/DynamicClientScopeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/DynamicClientScopeTest.java
new file mode 100644
index 000000000000..fc95f42fe99e
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/DynamicClientScopeTest.java
@@ -0,0 +1,135 @@
+package org.keycloak.tests.admin.client;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.common.Profile;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.tests.utils.matchers.Matchers;
+
+import java.util.HashMap;
+
+import static org.hamcrest.CoreMatchers.anyOf;
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.nullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+@KeycloakIntegrationTest(config = DynamicClientScopeTest.DynamicClientScopeServerConfig.class)
+public class DynamicClientScopeTest extends AbstractClientScopeTest {
+
+    @Test
+    public void testCreateValidDynamicScope() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("dynamic-scope-def");
+        scopeRep.setProtocol("openid-connect");
+        scopeRep.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*");
+        }});
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        // Assert updated attributes
+        scopeRep = clientScopes().get(scopeDefId).toRepresentation();
+        Assertions.assertEquals("dynamic-scope-def", scopeRep.getName());
+        Assertions.assertEquals("true", scopeRep.getAttributes().get(ClientScopeModel.IS_DYNAMIC_SCOPE));
+        Assertions.assertEquals("dynamic-scope-def:*", scopeRep.getAttributes().get(ClientScopeModel.DYNAMIC_SCOPE_REGEXP));
+    }
+
+    @Test
+    public void testCreateNonDynamicScopeWithFeatureEnabled() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("non-dynamic-scope-def");
+        scopeRep.setProtocol("openid-connect");
+        scopeRep.setAttributes(new HashMap<String, String>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "false");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "");
+        }});
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        // Assert updated attributes
+        scopeRep = clientScopes().get(scopeDefId).toRepresentation();
+        Assertions.assertEquals("non-dynamic-scope-def", scopeRep.getName());
+        Assertions.assertEquals("false", scopeRep.getAttributes().get(ClientScopeModel.IS_DYNAMIC_SCOPE));
+        assertThat(scopeRep.getAttributes().get(ClientScopeModel.DYNAMIC_SCOPE_REGEXP), anyOf(nullValue(), equalTo("")));
+    }
+
+    @Test
+    public void testCreateInvalidRegexpDynamicScope() {
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("dynamic-scope-def4");
+        scopeRep.setProtocol("openid-connect");
+        scopeRep.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*:*");
+        }});
+        handleExpectedCreateFailure(scopeRep, 400, "Invalid format for the Dynamic Scope regexp dynamic-scope-def:*:*");
+    }
+
+    @Test
+    public void updateAssignedDefaultClientScopeToDynamicScope() {
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("dyn-scope-client");
+        clientRep.setProtocol("openid-connect");
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
+        scopeRep.setName("dynamic-scope-def");
+        scopeRep.setProtocol("openid-connect");
+        String scopeDefId = createClientScopeWithCleanup(scopeRep);
+
+        managedRealm.admin().clients().get(clientUuid).addDefaultClientScope(scopeDefId);
+
+        scopeRep.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*:*");
+        }});
+
+        try {
+            clientScopes().get(scopeDefId).update(scopeRep);
+            Assertions.fail("This update should fail");
+        } catch (ClientErrorException ex) {
+            assertThat(ex.getResponse(), Matchers.statusCodeIs(Response.Status.BAD_REQUEST));
+        }
+    }
+
+    @Test
+    public void dynamicClientScopeCannotBeAssignedAsDefaultClientScope() {
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId("dyn-scope-client");
+        clientRep.setProtocol("openid-connect");
+        final String clientUuid = createClientWithCleanup(clientRep);
+
+        ClientScopeRepresentation optionalClientScope = new ClientScopeRepresentation();
+        optionalClientScope.setName("optional-dynamic-client-scope");
+        optionalClientScope.setProtocol("openid-connect");
+        optionalClientScope.setAttributes(new HashMap<>() {{
+            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
+            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*");
+        }});
+        String optionalClientScopeId = createClientScopeWithCleanup(optionalClientScope);
+
+        try {
+            ClientResource clientResource = managedRealm.admin().clients().get(clientUuid);
+            clientResource.addDefaultClientScope(optionalClientScopeId);
+            Assertions.fail("A Dynamic Scope shouldn't not be assigned as a default scope to a client");
+        } catch (ClientErrorException ex) {
+            assertThat(ex.getResponse(), Matchers.statusCodeIs(Response.Status.BAD_REQUEST));
+        }
+
+    }
+
+    public static class DynamicClientScopeServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.features(Profile.Feature.DYNAMIC_SCOPES);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java
new file mode 100644
index 000000000000..f8f851839fbc
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/InstallationTest.java
@@ -0,0 +1,458 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.StringReader;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
+import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
+import org.keycloak.protocol.saml.SamlConfigAttributes;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.protocol.saml.installation.SamlSPDescriptorClientInstallation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testframework.util.ApiUtil;
+import org.keycloak.tests.utils.KeyUtils;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.*;
+import static org.keycloak.common.Profile.Feature.AUTHORIZATION;
+
+import static org.keycloak.saml.common.constants.JBossSAMLURIConstants.METADATA_NSURI;
+
+/**
+ * Test getting the installation/configuration files for OIDC and SAML.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest(config = InstallationTest.InstallationTestServerConfig.class)
+public class InstallationTest {
+
+    @InjectRealm
+    ManagedRealm realm;
+
+    @InjectClient(config = OidcClientConfig.class, ref = "oidc")
+    ManagedClient oidcClient;
+
+    @InjectClient(config = OidcBearerOnlyClientConfig.class, ref = "oidcBearerOnly")
+    ManagedClient oidcBearerOnlyClient;
+
+    @InjectClient(config = OidcBearerOnlyWithAuthzClientConfig.class, ref = "oidcBearerOnlyWithAuthz")
+    ManagedClient oidcBearerOnlyWithAuthzClient;
+
+    @InjectClient(config = SamlClientConfig.class, ref = "saml")
+    ManagedClient samlClient;
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    private static final String OIDC_NAME = "oidcInstallationClient";
+    private static final String OIDC_NAME_BEARER_ONLY_NAME = "oidcInstallationClientBearerOnly";
+    private static final String OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME = "oidcInstallationClientBearerOnlyWithAuthz";
+    private static final String SAML_NAME = "samlInstallationClient";
+
+    private String samlUrl() {
+        return realm.getBaseUrl() + "/protocol/saml";
+    }
+
+    @Test
+    public void testOidcJBossXml() {
+        String xml = oidcClient.admin().getInstallationProvider("keycloak-oidc-jboss-subsystem");
+        assertOidcInstallationConfig(xml);
+        assertThat(xml, containsString("<secure-deployment"));
+    }
+
+    @Test
+    public void testOidcJson() {
+        String json = oidcClient.admin().getInstallationProvider("keycloak-oidc-keycloak-json");
+        assertOidcInstallationConfig(json);
+    }
+
+    @Test
+    public void testOidcJBossCli() {
+        String cli = oidcClient.admin().getInstallationProvider("keycloak-oidc-jboss-subsystem-cli");
+        assertOidcInstallationConfig(cli);
+        assertThat(cli, containsString("/subsystem=keycloak/secure-deployment=\"WAR MODULE NAME.war\""));
+    }
+
+    @Test
+    public void testOidcBearerOnlyJson() {
+        String json = oidcBearerOnlyClient.admin().getInstallationProvider("keycloak-oidc-keycloak-json");
+        assertOidcInstallationConfig(json);
+        assertThat(json, containsString("bearer-only"));
+        assertThat(json, not(containsString("public-client")));
+        assertThat(json, not(containsString("credentials")));
+        assertThat(json, not(containsString("verify-token-audience")));
+    }
+
+    @Test
+    public void testOidcBearerOnlyJsonWithAudienceClientScope() {
+        // Generate audience client scope
+        String clientScopeId = createAudienceClientScope();
+
+        String json = oidcBearerOnlyClient.admin().getInstallationProvider("keycloak-oidc-keycloak-json");
+        assertOidcInstallationConfig(json);
+        assertThat(json, containsString("bearer-only"));
+        assertThat(json, not(containsString("public-client")));
+        assertThat(json, not(containsString("credentials")));
+        assertThat(json, containsString("verify-token-audience"));
+
+        // Remove clientScope
+        realm.admin().clientScopes().get(clientScopeId).remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), null, ResourceType.CLIENT_SCOPE);
+    }
+
+    private String createAudienceClientScope() {
+        ClientScopeRepresentation clientScopeRepresentation = new ClientScopeRepresentation();
+        clientScopeRepresentation.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+
+        clientScopeRepresentation.setName(oidcBearerOnlyClient.getClientId());
+
+        ProtocolMapperRepresentation mapper = createProtocolMapper();
+        clientScopeRepresentation.setProtocolMappers(List.of(mapper));
+
+        Response response = realm.admin().clientScopes().create(clientScopeRepresentation);
+        String id = ApiUtil.handleCreatedResponse(response);
+        response.close();
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.clientScopeResourcePath(id), ResourceType.CLIENT_SCOPE);
+        return id;
+    }
+
+    private ProtocolMapperRepresentation createProtocolMapper() {
+        ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
+        mapper.setName("Audience for " + oidcBearerOnlyClient.getClientId());
+        mapper.setProtocolMapper(AudienceProtocolMapper.PROVIDER_ID);
+        mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+
+        Map<String, String> config = new HashMap<>();
+        config.put(AudienceProtocolMapper.INCLUDED_CLIENT_AUDIENCE, oidcBearerOnlyClient.getClientId());
+        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "true");
+        mapper.setConfig(config);
+        return mapper;
+    }
+
+    @Test
+    public void testOidcBearerOnlyWithAuthzJson() {
+        String json = oidcBearerOnlyWithAuthzClient.admin().getInstallationProvider("keycloak-oidc-keycloak-json");
+        assertOidcInstallationConfig(json);
+        assertThat(json, not(containsString("bearer-only")));
+        assertThat(json, not(containsString("public-client")));
+        assertThat(json, containsString("credentials"));
+        assertThat(json, containsString("secret"));
+        assertThat(json, containsString("policy-enforcer"));
+    }
+
+    private void assertOidcInstallationConfig(String config) {
+        assertThat(config, containsString("default"));
+        assertThat(config, not(containsString(KeyUtils.findActiveSigningKey(realm.admin()).getPublicKey())));
+        assertThat(config, containsString(keycloakUrls.getBase()));
+    }
+
+    @Test
+    public void testSamlMetadataIdpDescriptor() {
+        try {
+            samlClient.admin().getInstallationProvider("saml-idp-descriptor");
+            Assertions.fail("Successful saml-idp-descriptor not expected");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void testSamlAdapterXml() {
+        String xml = samlClient.admin().getInstallationProvider("keycloak-saml");
+        assertThat(xml, containsString("<keycloak-saml-adapter>"));
+        assertThat(xml, containsString("SPECIFY YOUR entityID!"));
+        assertThat(xml, not(containsString(KeyUtils.findActiveSigningKey(realm.admin()).getCertificate())));
+        assertThat(xml, containsString(samlUrl()));
+    }
+
+    @Test
+    public void testSamlAdapterCli() {
+        String cli = samlClient.admin().getInstallationProvider("keycloak-saml-subsystem-cli");
+        assertThat(cli, containsString("/subsystem=keycloak-saml/secure-deployment=YOUR-WAR.war/"));
+        assertThat(cli, containsString("SPECIFY YOUR entityID!"));
+        assertThat(cli, not(containsString(KeyUtils.findActiveSigningKey(realm.admin()).getCertificate())));
+        assertThat(cli, containsString(samlUrl()));
+    }
+
+    @Test
+    public void testSamlMetadataSpDescriptor() throws Exception {
+        String xml = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        Document doc = getDocumentFromXmlString(xml);
+        assertElements(doc, METADATA_NSURI.get(), "EntityDescriptor", null);
+        assertElements(doc, METADATA_NSURI.get(), "SPSSODescriptor", null);
+        assertThat(xml, containsString(SAML_NAME));
+    }
+
+    @Test
+    public void testSamlJBossXml() {
+        String xml = samlClient.admin().getInstallationProvider("keycloak-saml-subsystem");
+        assertThat(xml, containsString("<secure-deployment"));
+        assertThat(xml, containsString("SPECIFY YOUR entityID!"));
+        assertThat(xml, not(containsString(KeyUtils.findActiveSigningKey(realm.admin()).getCertificate())));
+        assertThat(xml, containsString(samlUrl()));
+    }
+
+    @Test
+    public void testSamlMetadataSpDescriptorPost() throws Exception {
+        assertThat(samlClient.admin().toRepresentation().getAttributes().get(SamlConfigAttributes.SAML_FORCE_POST_BINDING), equalTo("true"));
+
+        //error fallback
+        String response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        Document doc = getDocumentFromXmlString(response);
+        Map<String, String> attrNamesAndValues = new HashMap<>();
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
+        attrNamesAndValues.put("Location", "ERROR:ENDPOINT_NOT_SET");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+
+        //fallback to adminUrl
+        samlClient.updateWithCleanup(c -> c.adminUrl("https://admin-url"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClient.getId()), ResourceType.CLIENT);
+        response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        doc = getDocumentFromXmlString(response);
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
+        attrNamesAndValues.put("Location", "https://admin-url");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+
+        //fine grained
+        samlClient.updateWithCleanup(c -> c
+                .attribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "https://saml-assertion-post-url")
+                .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "https://saml-logout-post-url")
+                .attribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "https://saml-assertion-redirect-url")
+                .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "https://saml-logout-redirect-url")
+        );
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClient.getId()), ResourceType.CLIENT);
+
+        response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        doc = getDocumentFromXmlString(response);
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
+        attrNamesAndValues.put("Location", "https://saml-logout-post-url");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
+        attrNamesAndValues.put("Location", "https://saml-assertion-post-url");
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+    }
+
+    @Test
+    public void testSamlMetadataSpDescriptorRedirect() throws Exception {
+        samlClient.updateWithCleanup(c -> c.attribute(SamlConfigAttributes.SAML_FORCE_POST_BINDING, "false"));
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClient.getId()), ResourceType.CLIENT);
+        assertThat(samlClient.admin().toRepresentation().getAttributes().get(SamlConfigAttributes.SAML_FORCE_POST_BINDING), equalTo("false"));
+
+        //error fallback
+        String response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        Document doc = getDocumentFromXmlString(response);
+        Map<String, String> attrNamesAndValues = new HashMap<>();
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
+        attrNamesAndValues.put("Location", "ERROR:ENDPOINT_NOT_SET");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+
+        //fallback to adminUrl
+        samlClient.updateWithCleanup(c -> c.adminUrl("https://admin-url"));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClient.getId()), ResourceType.CLIENT);
+        response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        doc = getDocumentFromXmlString(response);
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
+        attrNamesAndValues.put("Location", "https://admin-url");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+
+        //fine-grained
+        samlClient.updateWithCleanup(c -> c
+                .attribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "https://saml-assertion-post-url")
+                .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "https://saml-logout-post-url")
+                .attribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "https://saml-assertion-redirect-url")
+                .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "https://saml-logout-redirect-url")
+        );
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClient.getId()), ResourceType.CLIENT);
+        response = samlClient.admin().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
+        doc = getDocumentFromXmlString(response);
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
+        attrNamesAndValues.put("Location", "https://saml-logout-redirect-url");
+        assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
+        attrNamesAndValues.clear();
+        attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
+        attrNamesAndValues.put("Location", "https://saml-assertion-redirect-url");
+        assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
+    }
+
+    @Test
+    public void testPemsInModAuthMellonExportShouldBeFormattedInRfc7468() throws IOException {
+        Response response = samlClient.admin().getInstallationProviderAsResponse("mod-auth-mellon");
+        byte[] result = response.readEntity(byte[].class);
+
+        String clientPrivateKey = null;
+        String clientCert = null;
+        try (ZipInputStream zis = new ZipInputStream(new ByteArrayInputStream(result))) {
+            ZipEntry entry;
+            while ((entry = zis.getNextEntry()) != null) {
+                if (entry.getName().endsWith("client-private-key.pem")) {
+                    clientPrivateKey = new String(zis.readAllBytes(), StandardCharsets.US_ASCII);
+                } else if (entry.getName().endsWith("client-cert.pem")) {
+                    clientCert = new String(zis.readAllBytes(), StandardCharsets.US_ASCII);
+                }
+            }
+        }
+
+        Assertions.assertNotNull(clientPrivateKey);
+        Assertions.assertNotNull(clientCert);
+        assertRfc7468PrivateKey(clientPrivateKey);
+        assertRfc7468Cert(clientCert);
+    }
+
+    private void assertRfc7468PrivateKey(String result) {
+        Assertions.assertTrue(result.startsWith("-----BEGIN PRIVATE KEY-----"));
+        Assertions.assertTrue(result.endsWith("-----END PRIVATE KEY-----"));
+        result.lines().forEach(line -> Assertions.assertTrue(line.length() <= 64));
+    }
+
+    private void assertRfc7468Cert(String result) {
+        Assertions.assertTrue(result.startsWith("-----BEGIN CERTIFICATE-----"));
+        Assertions.assertTrue(result.endsWith("-----END CERTIFICATE-----"));
+        result.lines().forEach(line -> Assertions.assertTrue(line.length() <= 64));
+    }
+
+    private Document getDocumentFromXmlString(String xml) throws SAXException, ParserConfigurationException, IOException {
+        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+        dbf.setNamespaceAware(true);
+        DocumentBuilder db = dbf.newDocumentBuilder();
+        InputSource is = new InputSource();
+        is.setCharacterStream(new StringReader(xml));
+        return db.parse(is);
+    }
+
+    private void assertElements(Document doc, String tagNamespace, String tagName, Map<String, String> attrNamesAndValues) {
+        NodeList elementsByTagName = doc.getElementsByTagNameNS(tagNamespace, tagName);
+        assertThat("Expected exactly one " + tagName + " element!", elementsByTagName.getLength(), is(equalTo(1)));
+        Node element = elementsByTagName.item(0);
+
+        if (attrNamesAndValues != null) {
+            for (String attrName : attrNamesAndValues.keySet()) {
+                assertThat(element.getAttributes().getNamedItem(attrName).getNodeValue(), containsString(attrNamesAndValues.get(attrName)));
+            }
+        }
+    }
+
+    public static class InstallationTestServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.features(AUTHORIZATION);
+        }
+    }
+
+    public static class OidcClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId(OIDC_NAME)
+                    .name(OIDC_NAME)
+                    .protocol("openid-connect");
+        }
+    }
+
+    public static class OidcBearerOnlyClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId(OIDC_NAME_BEARER_ONLY_NAME)
+                    .name(OIDC_NAME_BEARER_ONLY_NAME)
+                    .protocol("openid-connect")
+                    .bearerOnly(true)
+                    .publicClient(false);
+        }
+    }
+
+    public static class OidcBearerOnlyWithAuthzClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId(OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME)
+                    .name(OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME)
+                    .protocol("openid-connect")
+                    .bearerOnly(false)
+                    .publicClient(false)
+                    .authorizationServices()
+                    .serviceAccountsEnabled(true);
+        }
+    }
+
+    public static class SamlClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client.clientId(SAML_NAME)
+                    .name(SAML_NAME)
+                    .protocol("saml");
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/client/ServiceAccountClientTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/client/ServiceAccountClientTest.java
new file mode 100644
index 000000000000..e4e423240fdd
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/client/ServiceAccountClientTest.java
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2024 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.client;
+
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientScopeResource;
+import org.keycloak.common.constants.ServiceAccountConstants;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+import java.util.stream.Collectors;
+
+/**
+ * @author rmartinc
+ */
+@KeycloakIntegrationTest
+public class ServiceAccountClientTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectClient(config = ServiceAccountClientConfig.class)
+    ManagedClient managedClient;
+
+    @InjectOAuthClient
+    OAuthClient oAuthClient;
+
+    private static final String clientId = "service-account-client";
+
+    @Test
+    public void testServiceAccountEnableDisable() {
+        ClientScopeResource serviceAccountScopeRsc = ApiUtil.findClientScopeByName(
+                managedRealm.admin(), ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE);
+        Assertions.assertNotNull(serviceAccountScopeRsc);
+        ClientScopeRepresentation serviceAccountScope = serviceAccountScopeRsc.toRepresentation();
+
+        MatcherAssert.assertThat(
+                managedClient.admin().getDefaultClientScopes().stream()
+                        .map(ClientScopeRepresentation::getName)
+                        .collect(Collectors.toList()),
+                Matchers.hasItem("service_account")
+        );
+
+        // perform a login and check the claims are there
+        oAuthClient.client(clientId, "password");
+        AccessTokenResponse response = oAuthClient.doClientCredentialsGrantAccessTokenRequest();
+        AccessToken accessToken = oAuthClient.verifyToken(response.getAccessToken());
+        Assertions.assertEquals(clientId, accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
+
+        // update the client to remove service account
+        managedClient.updateWithCleanup(c -> c.serviceAccountsEnabled(false));
+        MatcherAssert.assertThat(
+                managedClient.admin().getDefaultClientScopes().stream()
+                        .map(ClientScopeRepresentation::getName)
+                        .collect(Collectors.toList()),
+                Matchers.not(Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE))
+        );
+        response = oAuthClient.doClientCredentialsGrantAccessTokenRequest();
+        Assertions.assertEquals("unauthorized_client", response.getError());
+
+        // re-enable sevice accounts
+        managedClient.updateWithCleanup(c -> c.serviceAccountsEnabled(true));
+        MatcherAssert.assertThat(
+                managedClient.admin().getDefaultClientScopes().stream()
+                        .map(ClientScopeRepresentation::getName)
+                        .collect(Collectors.toList()),
+                Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE)
+        );
+        response = oAuthClient.doClientCredentialsGrantAccessTokenRequest();
+        accessToken = oAuthClient.verifyToken(response.getAccessToken());
+        Assertions.assertEquals("service-account-client", accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
+
+        // assign the scope as optional
+        managedClient.admin().removeDefaultClientScope(serviceAccountScope.getId());
+        managedClient.admin().addOptionalClientScope(serviceAccountScope.getId());
+
+        // re-enable service accounts, should assign the scope again as default
+        managedClient.updateWithCleanup(c -> c.serviceAccountsEnabled(true));
+        MatcherAssert.assertThat(
+                managedClient.admin().getDefaultClientScopes().stream()
+                        .map(ClientScopeRepresentation::getName)
+                        .collect(Collectors.toList()),
+                Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE)
+        );
+        response = oAuthClient.doClientCredentialsGrantAccessTokenRequest();
+        accessToken = oAuthClient.verifyToken(response.getAccessToken());
+        Assertions.assertEquals("service-account-client", accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
+        Assertions.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
+
+        // remove the service account and client credentials should fail
+        UserRepresentation serviceAccountUser = managedClient.admin().getServiceAccountUser();
+        managedRealm.admin().users().delete(serviceAccountUser.getId()).close();
+        response = oAuthClient.doClientCredentialsGrantAccessTokenRequest();
+        Assertions.assertEquals("invalid_request", response.getError());
+    }
+
+    private static class ServiceAccountClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder client) {
+            return client
+                    .clientId(clientId)
+                    .protocol("openid-connect")
+                    .secret("password")
+                    .serviceAccountsEnabled(true)
+                    .authenticatorType("client-secret")
+                    .publicClient(false);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/AbstractConcurrencyTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/AbstractConcurrencyTest.java
new file mode 100644
index 000000000000..ec985f3da0fa
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/AbstractConcurrencyTest.java
@@ -0,0 +1,140 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.concurrency;
+
+import org.jboss.logging.Logger;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.config.Config;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public abstract class AbstractConcurrencyTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminClientFactory
+    static AdminClientFactory clientFactory;
+
+    private static final Logger LOGGER = Logger.getLogger(AbstractConcurrencyTest.class);
+
+    private static final int DEFAULT_THREADS = 4;
+
+    public static final String REALM_NAME = "default";
+    public static final String MASTER_REALM_NAME = "master";
+
+    // If enabled only one request is allowed at the time. Useful for checking that test is working.
+    private static final boolean SYNCHRONIZED = false;
+
+    protected void run(final KeycloakRunnable... runnables) {
+        run(DEFAULT_THREADS, runnables);
+    }
+
+    public static void run(final int numThreads, final KeycloakRunnable... runnables) {
+        final ExecutorService service = SYNCHRONIZED
+                ? Executors.newSingleThreadExecutor()
+                : Executors.newFixedThreadPool(numThreads);
+
+        ThreadLocal<Keycloak> keycloaks = new ThreadLocal<Keycloak>() {
+            @Override
+            protected Keycloak initialValue() {
+                return clientFactory.create().realm(MASTER_REALM_NAME)
+                        .clientId(Config.getAdminClientId())
+                        .clientSecret(Config.getAdminClientSecret())
+                        .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
+                        .build();
+            }
+        };
+
+        AtomicInteger currentThreadIndex = new AtomicInteger();
+        Collection<Callable<Void>> tasks = new LinkedList<>();
+        Collection<Throwable> failures = new ConcurrentLinkedQueue<>();
+        final List<Callable<Void>> runnablesToTasks = new LinkedList<>();
+
+        // Track all used admin clients, so they can be closed after the test
+        Set<Keycloak> usedKeycloaks = Collections.synchronizedSet(new HashSet<>());
+
+        for (KeycloakRunnable runnable : runnables) {
+            runnablesToTasks.add(() -> {
+                int arrayIndex = currentThreadIndex.getAndIncrement() % numThreads;
+                try {
+                    Keycloak keycloak = keycloaks.get();
+                    usedKeycloaks.add(keycloak);
+
+                    runnable.run(arrayIndex % numThreads, keycloak, keycloak.realm(REALM_NAME));
+                } catch (Throwable ex) {
+                    failures.add(ex);
+                }
+                return null;
+            });
+        }
+
+        tasks.addAll(runnablesToTasks);
+
+        try {
+            service.invokeAll(tasks);
+            service.shutdown();
+            service.awaitTermination(3, TimeUnit.MINUTES);
+        } catch (InterruptedException ex) {
+            throw new RuntimeException(ex);
+        } finally {
+            for (Keycloak keycloak : usedKeycloaks) {
+                try {
+                    keycloak.close();
+                } catch (Exception e) {
+                    failures.add(e);
+                }
+            }
+        }
+
+        if (! failures.isEmpty()) {
+            RuntimeException ex = new RuntimeException("There were failures in threads. Failures count: " + failures.size());
+            failures.forEach(ex::addSuppressed);
+            failures.forEach(e -> LOGGER.error(e.getMessage(), e));
+            throw ex;
+        }
+    }
+
+
+    public interface KeycloakRunnable {
+
+        void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable;
+
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/ConcurrencyTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/ConcurrencyTest.java
new file mode 100644
index 000000000000..4fc74a8ac073
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/concurrency/ConcurrencyTest.java
@@ -0,0 +1,303 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.concurrency;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.RolesResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.admin.client.resource.UsersResource;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.IntStream;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class ConcurrencyTest extends AbstractConcurrencyTest {
+
+    // Verify that no attribute values are duplicated, and there are no locking exceptions when adding attributes in parallel
+    // https://github.com/keycloak/keycloak/issues/38868
+    @Test
+    public void createUserAttributes() throws Throwable {
+        AtomicInteger c = new AtomicInteger();
+
+        UsersResource users = managedRealm.admin().users();
+
+        // enable unmanaged attributes
+        UserProfileUtil.enableUnmanagedAttributes(users.userProfile());
+
+        UserRepresentation u = UserConfigBuilder.create().username("attributes").build();
+
+        String userId;
+        try (Response response = users.create(u)) {
+            userId = ApiUtil.getCreatedId(response);
+        }
+
+        UserResource user = users.get(userId);
+
+        concurrentTest((threadIndex, keycloak, realm) -> {
+            UserRepresentation rep = user.toRepresentation();
+            rep.singleAttribute("a-" + c.getAndIncrement(), "value");
+            user.update(rep);
+        });
+
+        UserRepresentation rep = user.toRepresentation();
+
+        // Number of attributes should be equal to created attributes, or less (concurrent requests may drop attributes added by other threads)
+        assertTrue(rep.getAttributes().size() <= c.get());
+        // All attributes should have a single value
+        for (Map.Entry<String, List<String>> e : rep.getAttributes().entrySet()) {
+            assertEquals(1, e.getValue().size());
+        }
+    }
+
+
+    @Test
+    public void testAllConcurrently() throws Throwable {
+        AtomicInteger uniqueCounter = new AtomicInteger(100000);
+        concurrentTest(
+          new CreateClient(uniqueCounter),
+          new CreateRemoveClient(uniqueCounter),
+          new CreateGroup(uniqueCounter),
+          new CreateRole(uniqueCounter)
+        );
+    }
+
+    @Test
+    public void createClient() throws Throwable {
+        AtomicInteger uniqueCounter = new AtomicInteger();
+        concurrentTest(new CreateClient(uniqueCounter));
+    }
+
+    @Test
+    public void createGroup() throws Throwable {
+        AtomicInteger uniqueCounter = new AtomicInteger();
+        concurrentTest(new CreateGroup(uniqueCounter));
+    }
+
+    @Test
+    public void createRemoveClient() throws Throwable {
+        // FYI< this will fail as HSQL seems to be trying to perform table locks.
+        AtomicInteger uniqueCounter = new AtomicInteger();
+        concurrentTest(new CreateRemoveClient(uniqueCounter));
+    }
+
+    @Test
+    public void createClientRole() throws Throwable {
+        ClientRepresentation c = new ClientRepresentation();
+        c.setClientId("client");
+        final String clientId;
+        try (Response response = managedRealm.admin().clients().create(c)) {
+            clientId = ApiUtil.getCreatedId(response);
+        }
+
+        AtomicInteger uniqueCounter = new AtomicInteger();
+        concurrentTest(new CreateClientRole(uniqueCounter, clientId));
+    }
+
+    @Test
+    public void createRole() throws Throwable {
+        AtomicInteger uniqueCounter = new AtomicInteger();
+        run(new CreateRole(uniqueCounter));
+    }
+
+    public void concurrentTest(KeycloakRunnable... tasks) throws Throwable {
+        System.out.println("***************************");
+        long start = System.currentTimeMillis();
+        run(tasks);
+        long end = System.currentTimeMillis() - start;
+        System.out.println("took " + end + " ms");
+    }
+
+    private class CreateClient implements KeycloakRunnable {
+
+        private final AtomicInteger clientIndex;
+
+        public CreateClient(AtomicInteger clientIndex) {
+            this.clientIndex = clientIndex;
+        }
+
+        @Override
+        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
+            String name = "cc-" + clientIndex.getAndIncrement();
+            ClientRepresentation c = new ClientRepresentation();
+            c.setClientId(name);
+            String id;
+            try (Response response = realm.clients().create(c)) {
+                id = ApiUtil.getCreatedId(response);
+            }
+
+            c = realm.clients().get(id).toRepresentation();
+            assertNotNull(c);
+
+            int findAttempts = 5;
+
+            boolean clientFound = IntStream.range(0, findAttempts)
+                    .anyMatch(i -> realm.clients().findAll().stream()
+                            .map(ClientRepresentation::getClientId)
+                            .filter(Objects::nonNull)
+                            .anyMatch(name::equals));
+
+            assertTrue(clientFound, "Client " + name + " not found in client list after " + findAttempts + " attempts");
+        }
+    }
+
+    private class CreateRemoveClient implements KeycloakRunnable {
+
+        private final AtomicInteger clientIndex;
+
+        public CreateRemoveClient(AtomicInteger clientIndex) {
+            this.clientIndex = clientIndex;
+        }
+
+        @Override
+        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
+            String name = "crc-" + clientIndex.getAndIncrement();
+            ClientRepresentation c = new ClientRepresentation();
+            c.setClientId(name);
+            final ClientsResource clients = realm.clients();
+
+            String id;
+            try (Response response = clients.create(c)) {
+                id = ApiUtil.getCreatedId(response);
+            }
+            final ClientResource client = clients.get(id);
+
+            c = client.toRepresentation();
+            assertNotNull(c);
+
+            int findAttempts = 5;
+
+            boolean clientFound = IntStream.range(0, findAttempts)
+                    .anyMatch(i -> clients.findAll().stream()
+                    .map(ClientRepresentation::getClientId)
+                    .filter(Objects::nonNull)
+                    .anyMatch(name::equals));
+
+            assertTrue(clientFound, "Client " + name + " not found in client list after " + findAttempts + " attempts");
+
+            client.remove();
+            try {
+                client.toRepresentation();
+                fail("Client " + name + " should not be found.  Should throw a 404");
+            } catch (NotFoundException e) {
+
+            }
+
+            assertFalse(clients.findAll().stream()
+                .map(ClientRepresentation::getClientId)
+                .filter(Objects::nonNull)
+                .anyMatch(name::equals), "Client " + name + " should now not present in client list");
+        }
+    }
+
+    private class CreateGroup implements KeycloakRunnable {
+
+        private final AtomicInteger uniqueIndex;
+
+        public CreateGroup(AtomicInteger uniqueIndex) {
+            this.uniqueIndex = uniqueIndex;
+        }
+
+        @Override
+        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
+            String name = "g-" + uniqueIndex.getAndIncrement();
+            GroupRepresentation c = new GroupRepresentation();
+            c.setName(name);
+            String id;
+            try (Response response = realm.groups().add(c)) {
+                id = ApiUtil.getCreatedId(response);
+            }
+
+            c = realm.groups().group(id).toRepresentation();
+            assertNotNull(c);
+
+            assertTrue(realm.groups().groups().stream()
+                .map(GroupRepresentation::getName)
+                .filter(Objects::nonNull)
+                .anyMatch(name::equals), "Group " + name + " [" + id + "] " + " not found in group list");
+        }
+    }
+
+    private class CreateClientRole implements KeycloakRunnable {
+
+        private final AtomicInteger uniqueCounter;
+        private final String clientId;
+
+        public CreateClientRole(AtomicInteger uniqueCounter, String clientId) {
+            this.uniqueCounter = uniqueCounter;
+            this.clientId = clientId;
+        }
+
+        @Override
+        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
+            String name = "cr-" + uniqueCounter.getAndIncrement();
+            RoleRepresentation r = new RoleRepresentation(name, null, false);
+
+            final RolesResource roles = realm.clients().get(clientId).roles();
+            roles.create(r);
+            assertNotNull(roles.get(name).toRepresentation());
+        }
+    }
+
+    private class CreateRole implements KeycloakRunnable {
+
+        private final AtomicInteger uniqueCounter;
+
+        public CreateRole(AtomicInteger uniqueCounter) {
+            this.uniqueCounter = uniqueCounter;
+        }
+
+        @Override
+        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
+            String name = "r-" + uniqueCounter.getAndIncrement();
+            RoleRepresentation r = new RoleRepresentation(name, null, false);
+
+            final RolesResource roles = realm.roles();
+            roles.create(r);
+            assertNotNull(roles.get(name).toRepresentation());
+        }
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventAuthDetailsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventAuthDetailsTest.java
new file mode 100644
index 000000000000..41a59c7bc4ba
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventAuthDetailsTest.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.event;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.opentest4j.AssertionFailedError;
+
+/**
+ * Test authDetails in admin events
+ * 
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class AdminEventAuthDetailsTest {
+
+    @InjectRealm(config = AdminEventsAuthDetailsRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectAdminClient(ref = "admin", mode = InjectAdminClient.Mode.MANAGED_REALM, client = "client", user = "admin")
+    Keycloak adminClient;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    private String clientUuid;
+    private String adminId;
+    private String appUserId;
+    private String adminCliUuid;
+
+    @BeforeEach
+    public void initConfig() {
+        clientUuid = adminClient.realm(managedRealm.getName()).clients().findByClientId("client").get(0).getId();
+        adminId = adminClient.realm(managedRealm.getName()).users().search("admin", true).get(0).getId();
+        appUserId = adminClient.realm(managedRealm.getName()).users().search("app-user", true).get(0).getId();
+        adminCliUuid = ApiUtil.findClientByClientId(managedRealm.admin(), Constants.ADMIN_CLI_CLIENT_ID).toRepresentation().getId();
+    }
+
+    @Test
+    public void testAuthSuccess() {
+        testClient(adminClient, appUserId, managedRealm.getId(), clientUuid, adminId);
+    }
+
+    @Test
+    public void testAuthFailure() {
+        Assertions.assertThrows(AssertionFailedError.class, () -> testClient(adminClient, appUserId, managedRealm.getId(), adminCliUuid, adminId));
+    }
+
+    private void testClient(Keycloak admin, String userId, String expectedRealmId, String expectedClientUuid, String expectedUserId) {
+        UserRepresentation rep = admin.realm(managedRealm.getName()).users().get(userId).toRepresentation();
+        rep.setEmail("foo@email.org");
+        admin.realm(managedRealm.getName()).users().get(userId).update(rep);
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.userResourcePath(userId), rep, ResourceType.USER)
+                .auth(expectedRealmId, expectedClientUuid, expectedUserId);
+    }
+
+    public static class AdminEventsAuthDetailsRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.addClient("client").name("client").publicClient(true).directAccessGrants();
+            realm.addUser("admin").password("password").name("My", "Admin").email("admin@localhost")
+                    .emailVerified().clientRoles(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+            realm.addUser("app-user").password("password");
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventTest.java
new file mode 100644
index 000000000000..47a7aafcaa16
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/event/AdminEventTest.java
@@ -0,0 +1,446 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.event;
+
+import org.apache.commons.lang3.RandomStringUtils;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.events.EventStoreProvider;
+import org.keycloak.events.admin.AdminEvent;
+import org.keycloak.events.admin.AuthDetails;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.AuthDetailsRepresentation;
+import org.keycloak.representations.idm.OrganizationDomainRepresentation;
+import org.keycloak.representations.idm.OrganizationRepresentation;
+import org.keycloak.representations.idm.RealmEventsConfigRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneOffset;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+
+/**
+ * Test getting and filtering admin events.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest
+public class AdminEventTest {
+
+    @InjectRealm(attachTo = "master", ref = "master")
+    ManagedRealm masterRealm;
+
+    @InjectRealm(config = AdminEventRealmConfig.class, ref = "default")
+    ManagedRealm managedRealm;
+
+    @InjectAdminClient(mode = InjectAdminClient.Mode.BOOTSTRAP)
+    Keycloak adminClient;
+
+    @InjectRunOnServer(realmRef = "default")
+    RunOnServerClient runOnServerClient;
+
+
+    @BeforeEach
+    public void initConfig() {
+        managedRealm.admin().clearAdminEvents();
+    }
+
+    private List<AdminEventRepresentation> events() {
+        return managedRealm.admin().getAdminEvents();
+    }
+
+    private String createUser(String username) {
+        UserRepresentation user = UserConfigBuilder.create()
+                .username(username)
+                .email(username + "@foo.com")
+                .name("foo", "bar")
+                .password("password")
+                .build();
+        String userUuid = ApiUtil.getCreatedId(managedRealm.admin().users().create(user));
+        managedRealm.cleanup().add(r -> r.users().get(userUuid).remove());
+        return userUuid;
+    }
+
+    @Test
+    public void clearAdminEventsTest() {
+        createUser("user0");
+        Assertions.assertEquals(1, events().size());
+        managedRealm.admin().clearAdminEvents();
+        Assertions.assertEquals(0, events().size());
+    }
+
+    @Test
+    public void adminEventAttributeTest() {
+        createUser("user5");
+        List<AdminEventRepresentation> events = events();
+        Assertions.assertEquals(1, events.size());
+
+        AdminEventRepresentation event = events.get(0);
+        AdminEventAssertion.assertSuccess(event).operationType(OperationType.CREATE);
+        Assertions.assertTrue(event.getTime() > 0L);
+        Assertions.assertEquals(managedRealm.getId(), event.getRealmId());
+        Assertions.assertNotNull(event.getResourcePath());
+
+        AuthDetailsRepresentation details = event.getAuthDetails();
+        Assertions.assertEquals(masterRealm.getId(), details.getRealmId());
+        Assertions.assertNotNull(details.getClientId());
+        Assertions.assertNotNull(details.getUserId());
+        Assertions.assertNotNull(details.getIpAddress());
+    }
+
+    @Test
+    public void testEventDetails() {
+        String userUuid = createUser("user5");
+        UserRepresentation userRep = managedRealm.admin().users().get(userUuid).toRepresentation();
+
+        managedRealm.updateWithCleanup(r -> r.organizationsEnabled(true));
+        OrganizationRepresentation orgRep = new OrganizationRepresentation();
+        orgRep.setName("test-org");
+        orgRep.setAlias(orgRep.getName());
+        orgRep.addDomain(new OrganizationDomainRepresentation(orgRep.getName()));
+        managedRealm.admin().organizations().create(orgRep).close();
+        orgRep = managedRealm.admin().organizations().list(-1, -1).get(0);
+        managedRealm.admin().organizations().get(orgRep.getId()).members().addMember(userUuid).close();
+        String orgId = orgRep.getId();
+        managedRealm.cleanup().add(r -> r.organizations().get(orgId).delete());
+
+        List<AdminEventRepresentation> events = events();
+        Assertions.assertEquals(4, events.size());
+
+        AdminEventRepresentation event = events.get(0);
+        AdminEventAssertion.assertSuccess(event)
+                .operationType(OperationType.CREATE)
+                .resourceType(ResourceType.ORGANIZATION_MEMBERSHIP);
+        Assertions.assertEquals(managedRealm.getId(), event.getRealmId());
+        assertThat(event.getDetails(), is(equalTo(Map.of(UserModel.USERNAME, userRep.getUsername(), UserModel.EMAIL, userRep.getEmail()))));
+    }
+
+    @Test
+    public void retrieveAdminEventTest() {
+        createUser("user1");
+        List<AdminEventRepresentation> events = events();
+
+        Assertions.assertEquals(1, events.size());
+        AdminEventRepresentation event = events().get(0);
+        AdminEventAssertion.assertSuccess(event).operationType(OperationType.CREATE);
+
+        Assertions.assertEquals(managedRealm.getId(), event.getRealmId());
+        Assertions.assertEquals(masterRealm.getId(), event.getAuthDetails().getRealmId());
+        Assertions.assertNull(event.getRepresentation());
+    }
+
+    @Test
+    public void testGetRepresentation() {
+        managedRealm.updateWithCleanup(r -> r.adminEventsDetailsEnabled(true));
+
+        createUser("user2");
+        AdminEventRepresentation event = events().stream()
+                .filter(adminEventRep -> adminEventRep.getOperationType().equals("CREATE"))
+                .findFirst()
+                .orElseThrow(() -> new IllegalStateException("Wasn't able to obtain CREATE admin event."));
+        Assertions.assertNotNull(event.getRepresentation());
+        assertThat(event.getRepresentation(), allOf(containsString("foo"), containsString("bar")));
+    }
+
+    @Test
+    public void testFilterAdminEvents() {
+        // two CREATE and one UPDATE
+        createUser("user3");
+        createUser("user4");
+        managedRealm.updateWithCleanup(r -> r.displayName("Fury Road"));
+        Assertions.assertEquals(3, events().size());
+
+        List<AdminEventRepresentation> events = managedRealm.admin().getAdminEvents(List.of("CREATE"), null, null, null, null, null, null, null, null, null);
+        Assertions.assertEquals(2, events.size());
+    }
+
+    @Test
+    public void defaultMaxResults() {
+        RealmResource realm = managedRealm.admin();
+        String realmId = managedRealm.getId();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+
+            AdminEvent event = new AdminEvent();
+            event.setOperationType(OperationType.CREATE);
+            event.setAuthDetails(new AuthDetails());
+            event.setRealmId(realmId);
+
+            for (int i = 0; i < 110; i++) {
+                event.setId(UUID.randomUUID().toString());
+                provider.onEvent(event, false);
+            }
+        });
+
+        Assertions.assertEquals(100,
+                realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null).size());
+        Assertions.assertEquals(105,
+                realm.getAdminEvents(null, null, null, null, null, null, null, null, 0, 105).size());
+        Assertions.assertEquals(110,
+                realm.getAdminEvents(null, null, null, null, null, null, null, null, 0, 1000).size());
+    }
+
+    @Test
+    public void adminEventRepresentationLenght() {
+        RealmResource realm = managedRealm.admin();
+        String realmId = managedRealm.getId();
+        String longValue = RandomStringUtils.secure().next(30000, true, true);
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+
+            AdminEvent event = new AdminEvent();
+            event.setOperationType(OperationType.CREATE);
+            event.setAuthDetails(new AuthDetails());
+            event.setRealmId(realmId);
+            event.setRepresentation(longValue);
+
+            provider.onEvent(event, true);
+        });
+
+        List<AdminEventRepresentation> adminEvents = realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null);
+
+        Assertions.assertEquals(1, adminEvents.size());
+        Assertions.assertEquals(longValue, adminEvents.get(0).getRepresentation());
+    }
+
+    @Test
+    public void orderResultsTest() {
+        RealmResource realm = managedRealm.admin();
+        String realmId = managedRealm.getId();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+
+            AdminEvent firstEvent = new AdminEvent();
+            firstEvent.setOperationType(OperationType.CREATE);
+            firstEvent.setAuthDetails(new AuthDetails());
+            firstEvent.setRealmId(realmId);
+            firstEvent.setTime(System.currentTimeMillis() - 1000);
+
+            AdminEvent secondEvent = new AdminEvent();
+            secondEvent.setOperationType(OperationType.DELETE);
+            secondEvent.setAuthDetails(new AuthDetails());
+            secondEvent.setRealmId(realmId);
+            secondEvent.setTime(System.currentTimeMillis());
+
+            provider.onEvent(firstEvent, false);
+            provider.onEvent(secondEvent, false);
+        });
+
+        List<AdminEventRepresentation> adminEvents = realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null, null, "desc");
+        Assertions.assertEquals(2, adminEvents.size());
+        Assertions.assertEquals(OperationType.DELETE.toString(), adminEvents.get(0).getOperationType());
+        Assertions.assertEquals(OperationType.CREATE.toString(), adminEvents.get(1).getOperationType());
+
+        adminEvents = realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null, null, "asc");
+        Assertions.assertEquals(2, adminEvents.size());
+        Assertions.assertEquals(OperationType.DELETE.toString(), adminEvents.get(1).getOperationType());
+        Assertions.assertEquals(OperationType.CREATE.toString(), adminEvents.get(0).getOperationType());
+    }
+
+    @Test
+    public void filterByEpochTimeStamp() {
+        RealmResource realm = managedRealm.admin();
+
+        String realmId = managedRealm.getId();
+        long currentTime = System.currentTimeMillis();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+
+            AdminEvent event = new AdminEvent();
+            event.setOperationType(OperationType.CREATE);
+            event.setAuthDetails(new AuthDetails());
+            event.setRealmId(realmId);
+
+            event.setTime(currentTime - 2*24*3600*1000);
+            provider.onEvent(event, false);
+            event.setTime(currentTime - 1000);
+            provider.onEvent(event, false);
+            event.setTime(currentTime);
+            provider.onEvent(event, false);
+            event.setTime(currentTime + 1000);
+            provider.onEvent(event, false);
+            event.setTime(currentTime + 2*24*3600*1000);
+            provider.onEvent(event, false);
+        });
+
+        List<AdminEventRepresentation> events = realm.getAdminEvents();
+        Assertions.assertEquals(5, events.size());
+        events = realm.getAdminEvents(null, null, null, null, null, null, null, currentTime, currentTime, null, null, null);
+        Assertions.assertEquals(1, events.size());
+        events = realm.getAdminEvents(null, null, null, null, null, null, null, currentTime - 1000, currentTime + 1000, null, null, null);
+        Assertions.assertEquals(3, events.size());
+
+        LocalDate dateFrom = Instant.ofEpochMilli(currentTime - 1000).atZone(ZoneOffset.UTC).toLocalDate();
+        LocalDate dateTo = Instant.ofEpochMilli(currentTime + 1000).atZone(ZoneOffset.UTC).toLocalDate();
+        events = realm.getAdminEvents(null, null, null, null, null, null, null, dateFrom.toString(), dateTo.toString(), null, null, null);
+        Assertions.assertEquals(3, events.size());
+    }
+
+    private void checkUpdateRealmEventsConfigEvent(int size) {
+        List<AdminEventRepresentation> events = events();
+        Assertions.assertEquals(size, events.size());
+
+        AdminEventRepresentation event = events.get(0);
+        AdminEventAssertion.assertSuccess(event)
+                .operationType(OperationType.UPDATE)
+                .resourcePath("events", "config");
+
+        Assertions.assertEquals(managedRealm.getId(), event.getRealmId());
+        Assertions.assertEquals(masterRealm.getId(), event.getAuthDetails().getRealmId());
+        Assertions.assertNotNull(event.getRepresentation());
+    }
+
+    private RealmEventsConfigRepresentation updateEventsConfig(RealmEventsConfigRepresentation configRep) {
+        managedRealm.admin().updateRealmEventsConfig(configRep);
+        return managedRealm.admin().getRealmEventsConfig();
+    }
+
+    @Test
+    public void updateRealmEventsConfig() {
+        // change from OFF to ON should be stored
+        RealmEventsConfigRepresentation configRep = managedRealm.admin().getRealmEventsConfig();
+        configRep.setAdminEventsDetailsEnabled(true);
+        configRep.setAdminEventsEnabled(true);
+        configRep = updateEventsConfig(configRep);
+        checkUpdateRealmEventsConfigEvent(1);
+
+        // any other change should be stored too
+        configRep.setEventsEnabled(true);
+        configRep = updateEventsConfig(configRep);
+        checkUpdateRealmEventsConfigEvent(2);
+
+        // change from ON to OFF should be stored too
+        configRep.setAdminEventsEnabled(false);
+        configRep = updateEventsConfig(configRep);
+        checkUpdateRealmEventsConfigEvent(3);
+
+        // another change should not be stored cos it was OFF already
+        configRep.setAdminEventsDetailsEnabled(false);
+        configRep = updateEventsConfig(configRep);
+        assertThat(events().size(), is(equalTo(3)));
+
+        // clean up the realm
+        configRep.setAdminEventsEnabled(true);
+        updateEventsConfig(configRep);
+    }
+
+    @Test
+    public void createAndDeleteRealm() {
+        // Enable admin events on "master" realm, since realm create/delete events will be stored in realm of
+        // the authenticated user who executes the operations (admin in master realm),
+        RealmEventsConfigRepresentation masterConfig = masterRealm.admin().getRealmEventsConfig();
+        masterConfig.setAdminEventsDetailsEnabled(true);
+        masterConfig.setAdminEventsEnabled(true);
+        masterRealm.admin().updateRealmEventsConfig(masterConfig);
+        masterRealm.admin().clearAdminEvents();
+
+        // Create realm.
+        String testRealm = "test-realm";
+        RealmRepresentation realm = new RealmRepresentation();
+        realm.setId(testRealm);
+        realm.setRealm(testRealm);
+        adminClient.realms().create(realm);
+
+        // Delete realm.
+        adminClient.realm(realm.getRealm()).remove();
+
+        // Check that events were logged.
+        List<AdminEventRepresentation> events = masterRealm.admin().getAdminEvents();
+        Assertions.assertEquals(2, events.size());
+
+        AdminEventRepresentation createEvent = events.get(1);
+        AdminEventAssertion.assertSuccess(createEvent)
+                .operationType(OperationType.CREATE)
+                .resourceType(ResourceType.REALM)
+                .resourcePath(testRealm);
+        Assertions.assertEquals(masterRealm.getId(), createEvent.getRealmId());
+        Assertions.assertNotNull(createEvent.getRepresentation());
+
+        AdminEventRepresentation deleteEvent = events.get(0);
+        AdminEventAssertion.assertSuccess(deleteEvent)
+                .operationType(OperationType.DELETE)
+                .resourceType(ResourceType.REALM)
+                .resourcePath(testRealm);
+        Assertions.assertEquals(masterRealm.getId(), deleteEvent.getRealmId());
+    }
+
+    @Test
+    public void testStripOutUserSensitiveData() throws IOException {
+        managedRealm.updateWithCleanup(r -> {
+            r.adminEventsDetailsEnabled(true);
+            r.adminEventsEnabled(true);
+            return r;
+        });
+
+        UserResource user = managedRealm.admin().users().get(createUser("sensitive"));
+        List<AdminEventRepresentation> events = events();
+        UserRepresentation eventUserRep = JsonSerialization.readValue(events.get(0).getRepresentation(), UserRepresentation.class);
+        Assertions.assertNull(eventUserRep.getCredentials());
+
+        UserRepresentation userRep = user.toRepresentation();
+        userRep = UserConfigBuilder.update(userRep).password("password").build();
+        user.update(userRep);
+        events = events();
+        eventUserRep = JsonSerialization.readValue(events.get(0).getRepresentation(), UserRepresentation.class);
+        Assertions.assertNull(eventUserRep.getCredentials());
+    }
+
+    private static class AdminEventRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            return realm.eventsEnabled(true)
+                    .adminEventsEnabled(true)
+                    .adminEventsDetailsEnabled(false);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/event/EmailEventListenerTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/event/EmailEventListenerTest.java
index e300f8c7fdf1..be13f25e50eb 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/event/EmailEventListenerTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/event/EmailEventListenerTest.java
@@ -27,8 +27,8 @@
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
 import org.keycloak.testframework.mail.MailServer;
 import org.keycloak.testframework.mail.annotations.InjectMailServer;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 import org.keycloak.testframework.realm.ManagedUser;
 import org.keycloak.testframework.realm.RealmConfig;
@@ -53,7 +53,7 @@ public class EmailEventListenerTest {
 
     @Test
     public void testFailedLoginEmailEvent() throws MessagingException {
-        oAuthClient.resourceOwnerCredentialGrant(user.getUsername(), "invalid");
+        oAuthClient.doPasswordGrantRequest(user.getUsername(), "invalid");
 
         mail.waitForIncomingEmail(1);
         MimeMessage lastReceivedMessage = mail.getLastReceivedMessage();
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/event/EventConfigTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/event/EventConfigTest.java
new file mode 100644
index 000000000000..0e6cb1ca4015
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/event/EventConfigTest.java
@@ -0,0 +1,142 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.event;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.idm.RealmEventsConfigRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+
+import java.util.List;
+
+/**
+ * Test updates to the events configuration.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest
+public class EventConfigTest {
+
+    @InjectRealm(config = EventConfigRealmConfig.class)
+    ManagedRealm configRealm;
+
+    RealmEventsConfigRepresentation configRep;
+
+    @BeforeEach
+    public void setConfigRep() {
+        configRep = configRealm.admin().getRealmEventsConfig();
+    }
+
+    @Test
+    public void defaultEventConfigTest() {
+        configRealm.updateWithCleanup(r -> r.eventsEnabled(false).adminEventsEnabled(false));
+
+        configRep = configRealm.admin().getRealmEventsConfig();
+        Assertions.assertFalse(configRep.isAdminEventsDetailsEnabled());
+        Assertions.assertFalse(configRep.isAdminEventsEnabled());
+        Assertions.assertFalse(configRep.isEventsEnabled());
+
+        List<String> eventListeners = configRep.getEventsListeners();
+        Assertions.assertEquals(1, eventListeners.size());
+        Assertions.assertEquals("jboss-logging", eventListeners.get(0));
+    }
+
+    @Test
+    public void enableEventsTest() {
+        Assertions.assertTrue(configRep.isEventsEnabled());
+        Assertions.assertTrue(configRep.isAdminEventsEnabled());
+    }
+
+    @Test
+    public void addRemoveListenerTest() {
+        configRealm.updateWithCleanup(r -> r.eventsEnabled(false).adminEventsEnabled(false).overwriteEventsListeners());
+
+        configRep = configRealm.admin().getRealmEventsConfig();
+
+        Assertions.assertEquals(0, configRep.getEventsListeners().size());
+
+        configRealm.updateWithCleanup(r -> r.overwriteEventsListeners("email"));
+        configRep = configRealm.admin().getRealmEventsConfig();
+        List<String> eventListeners = configRep.getEventsListeners();
+        Assertions.assertEquals(1, eventListeners.size());
+        Assertions.assertEquals("email", eventListeners.get(0));
+    }
+
+    @Test
+    public void loginEventSettingsTest() {
+        Assertions.assertTrue(hasEventType("LOGIN"));
+        Assertions.assertTrue(hasEventType("LOGOUT"));
+        Assertions.assertTrue(hasEventType("CLIENT_DELETE_ERROR"));
+
+        int defaultEventCount = configRep.getEnabledEventTypes().size();
+
+        configRealm.updateWithCleanup(r -> r.enabledEventTypes("CLIENT_DELETE", "CLIENT_DELETE_ERROR"));
+
+        List<String> enabledEventTypes = configRealm.admin().getRealmEventsConfig().getEnabledEventTypes();
+        Assertions.assertEquals(2, enabledEventTypes.size());
+
+        // remove all event types
+        configRealm.updateWithCleanup(RealmConfigBuilder::overwriteEnabledEventTypes);
+
+        // removing all event types restores default events
+        Assertions.assertEquals(defaultEventCount, configRealm.admin().getRealmEventsConfig().getEnabledEventTypes().size());
+    }
+
+    private boolean hasEventType(String eventType) {
+        for (String event : configRep.getEnabledEventTypes()) {
+            if (eventType.equals(event)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    @Test
+    public void includeRepresentationTest() {
+        Assertions.assertTrue(configRep.isAdminEventsEnabled());
+        Assertions.assertFalse(configRep.isAdminEventsDetailsEnabled());
+
+        configRealm.updateWithCleanup(r -> r.adminEventsDetailsEnabled(true));
+
+        Assertions.assertTrue(configRealm.admin().getRealmEventsConfig().isAdminEventsDetailsEnabled());
+    }
+
+    @Test
+    public void setLoginEventExpirationTest() {
+        Assertions.assertNull(configRep.getEventsExpiration());
+
+        long oneHour = 3600;
+        configRealm.updateWithCleanup(r -> r.eventsExpiration(oneHour));
+
+        Assertions.assertEquals(oneHour, configRealm.admin().getRealmEventsConfig().getEventsExpiration());
+    }
+
+    public static class EventConfigRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            return realm.eventsEnabled(true).adminEventsEnabled(true);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/event/LoginEventsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/event/LoginEventsTest.java
new file mode 100644
index 000000000000..66838fb8fbf4
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/event/LoginEventsTest.java
@@ -0,0 +1,263 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.tests.admin.event;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.events.Event;
+import org.keycloak.events.EventStoreProvider;
+import org.keycloak.events.EventType;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.EventMatchers;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneOffset;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * Test getting and filtering login-related events.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest
+public class LoginEventsTest {
+
+    @InjectRealm(config = LoginEventsRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectOAuthClient
+    OAuthClient oAuthClient;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServerClient;
+
+    @BeforeEach
+    public void init() {
+        managedRealm.admin().clearEvents();
+    }
+
+    private List<EventRepresentation> events() {
+        return managedRealm.admin().getEvents();
+    }
+
+    private void badLogin() {
+        oAuthClient.doLogin("bad", "user");
+    }
+
+    private void pause(int seconds) {
+        try {
+            Thread.sleep(seconds * 1000L);
+        } catch (InterruptedException e) {
+            Assertions.fail(e.getMessage());
+        }
+    }
+
+    @Test
+    public void eventAttributesTest() {
+        badLogin();
+        List<EventRepresentation> events = events();
+        Assertions.assertEquals(1, events.size());
+        EventRepresentation event = events.get(0);
+        assertThat(event.getId(), EventMatchers.isUUID());
+        Assertions.assertTrue(event.getTime() > 0);
+        Assertions.assertNotNull(event.getIpAddress());
+        Assertions.assertEquals("LOGIN_ERROR", event.getType());
+        Assertions.assertEquals(managedRealm.getId(), event.getRealmId());
+        Assertions.assertNull(event.getUserId()); // no user for bad login
+        Assertions.assertNull(event.getSessionId()); // no session for bad login
+        Assertions.assertEquals("user_not_found", event.getError());
+
+        Map<String, String> details = event.getDetails();
+        Assertions.assertEquals("openid-connect", details.get("auth_method"));
+        Assertions.assertEquals("code", details.get("auth_type"));
+        Assertions.assertNotNull(details.get("redirect_uri"));
+        Assertions.assertNotNull(details.get("code_id"));
+        Assertions.assertEquals("bad", details.get("username"));
+    }
+
+    @Test
+    public void clearEventsTest() {
+        Assertions.assertEquals(0, events().size());
+        badLogin();
+        badLogin();
+        Assertions.assertEquals(2, events().size());
+        managedRealm.admin().clearEvents();
+        Assertions.assertEquals(0, events().size());
+    }
+
+    @Test
+    public void loggingOfCertainTypeTest() {
+        Assertions.assertEquals(0, events().size());
+        managedRealm.updateWithCleanup(r -> r.enabledEventTypes("REVOKE_GRANT"));
+
+        badLogin();
+        Assertions.assertEquals(0, events().size());
+
+        managedRealm.updateWithCleanup(r -> r.overwriteEnabledEventTypes("LOGIN_ERROR"));
+
+        badLogin();
+        Assertions.assertEquals(1, events().size());
+    }
+
+    @Test
+    public void filterTest() {
+        badLogin();
+        badLogin();
+        Assertions.assertEquals(2, events().size());
+
+        List<EventRepresentation> filteredEvents = managedRealm.admin().getEvents(List.of("REVOKE_GRANT"), null, null, null, null, null, null, null);
+        Assertions.assertEquals(0, filteredEvents.size());
+
+        filteredEvents = managedRealm.admin().getEvents(List.of("LOGIN_ERROR"), null, null, null, null, null, null, null);
+        Assertions.assertEquals(2, filteredEvents.size());
+    }
+
+    @Test
+    public void defaultMaxResults() {
+        String realmId = managedRealm.getId();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+            Event event = new Event();
+            event.setRealmId(realmId);
+            event.setType(EventType.LOGIN);
+
+            for (int i = 0; i < 110; i++) {
+                provider.onEvent(event);
+            }
+        });
+
+        Assertions.assertEquals(100, managedRealm.admin().getEvents(null, null, null, null, null, null, null, null).size());
+        Assertions.assertEquals(105, managedRealm.admin().getEvents(null, null, null, null, null, null, 0, 105).size());
+        Assertions.assertTrue(managedRealm.admin().getEvents(null, null, null, null, null, null, 0, 1000).size() >= 110);
+    }
+
+    @Test
+    public void orderResultsTest() {
+        String realmId = managedRealm.getId();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+
+            Event firstEvent = new Event();
+            firstEvent.setRealmId(realmId);
+            firstEvent.setType(EventType.LOGIN);
+            firstEvent.setTime(System.currentTimeMillis() - 1000);
+
+            Event secondEvent = new Event();
+            secondEvent.setRealmId(realmId);
+            secondEvent.setType(EventType.LOGOUT);
+            secondEvent.setTime(System.currentTimeMillis());
+
+            provider.onEvent(firstEvent);
+            provider.onEvent(secondEvent);
+        });
+
+        List<EventRepresentation> events = managedRealm.admin().getEvents(null, null, null, null, null, null, null, null, "desc");
+        Assertions.assertEquals(2, events.size());
+        Assertions.assertEquals(EventType.LOGOUT.toString(), events.get(0).getType());
+        Assertions.assertEquals(EventType.LOGIN.toString(), events.get(1).getType());
+
+        events = managedRealm.admin().getEvents(null, null, null, null, null, null, null, null, "asc");
+        Assertions.assertEquals(2, events.size());
+        Assertions.assertEquals(EventType.LOGOUT.toString(), events.get(1).getType());
+        Assertions.assertEquals(EventType.LOGIN.toString(), events.get(0).getType());
+    }
+
+
+    @Test
+    public void filterByEpochTimeStamp() {
+        long currentTime = System.currentTimeMillis();
+        String realmId = managedRealm.getId();
+
+        runOnServerClient.run(session -> {
+            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
+            Event event = new Event();
+            event.setType(EventType.LOGIN);
+            event.setRealmId(realmId);
+
+            event.setTime(currentTime - 2*24*3600*1000);
+            provider.onEvent(event);
+            event.setTime(currentTime - 1000);
+            provider.onEvent(event);
+            event.setTime(currentTime);
+            provider.onEvent(event);
+            event.setTime(currentTime + 1000);
+            provider.onEvent(event);
+            event.setTime(currentTime + 2*24*3600*1000);
+            provider.onEvent(event);
+        });
+
+        List<EventRepresentation> events = managedRealm.admin().getEvents();
+        Assertions.assertEquals(5, events.size());
+        events = managedRealm.admin().getEvents(null, null, null, currentTime, currentTime, null, null, null, null);
+        Assertions.assertEquals(1, events.size());
+        events = managedRealm.admin().getEvents(null, null, null, currentTime - 1000, currentTime + 1000, null, null, null, null);
+        Assertions.assertEquals(3, events.size());
+
+        LocalDate dateFrom = Instant.ofEpochMilli(currentTime - 1000).atZone(ZoneOffset.UTC).toLocalDate();
+        LocalDate dateTo = Instant.ofEpochMilli(currentTime + 1000).atZone(ZoneOffset.UTC).toLocalDate();
+        events = managedRealm.admin().getEvents(null, null, null, dateFrom.toString(), dateTo.toString(), null, null, null, null);
+        Assertions.assertEquals(3, events.size());
+    }
+
+    @Test
+    public void testErrorEventsAreNotStoredWhenDisabled() {
+        managedRealm.updateWithCleanup(r -> r.eventsEnabled(false));
+
+        badLogin();
+        Assertions.assertEquals(0, events().size());
+    }
+
+
+    /*
+    Removed this test because it takes too long.  The default interval for
+    event cleanup is 15 minutes (900 seconds).  I don't have time to figure out
+    a way to set the cleanup thread to a lower interval for testing.
+    @Test
+    public void eventExpirationTest() {
+        configRep.setEventsExpiration(1L); //  second
+        saveConfig();
+        badLogin();
+        assertEquals(1, events().size());
+        pause(900); // pause 900 seconds
+        assertEquals(0, events().size());
+    }**/
+
+    private static class LoginEventsRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            return realm.eventsEnabled(true);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/AbstractFineGrainedAdminTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/AbstractFineGrainedAdminTest.java
new file mode 100644
index 000000000000..73d9cd87de5c
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/AbstractFineGrainedAdminTest.java
@@ -0,0 +1,357 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.jboss.logging.Logger;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.client.cli.util.ConfigUtil;
+import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionStrategy;
+import org.keycloak.representations.idm.authorization.Logic;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.testframework.admin.AdminClientFactory;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectAdminClientFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+public class AbstractFineGrainedAdminTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm managedRealm;
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm masterRealm;
+
+    @InjectAdminClientFactory
+    AdminClientFactory adminClientFactory;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    @InjectAdminClient
+    Keycloak adminClient;
+
+    @InjectOAuthClient
+    OAuthClient oauth;
+
+    private static final Logger LOGGER = Logger.getLogger(FineGrainedAdminWithTokenExchangeTest.class);
+
+    public static final String REALM_NAME = "default";
+    public static final String CLIENT_NAME = "application";
+
+    public static void setupPolices(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+        RoleModel realmRole = realm.addRole("realm-role");
+        RoleModel realmRole2 = realm.addRole("realm-role2");
+        ClientModel client1 = realm.addClient(CLIENT_NAME);
+        realm.addClientScope("scope");
+        client1.setFullScopeAllowed(false);
+        RoleModel client1Role = client1.addRole("client-role");
+        GroupModel group = realm.createGroup("top");
+
+        RoleModel mapperRole = realm.addRole("mapper");
+        RoleModel managerRole = realm.addRole("manager");
+        RoleModel compositeRole = realm.addRole("composite-role");
+        compositeRole.addCompositeRole(mapperRole);
+        compositeRole.addCompositeRole(managerRole);
+
+        // realm-role and application.client-role will have a role policy associated with their map-role permission
+        {
+            permissions.roles().setPermissionsEnabled(client1Role, true);
+            Policy mapRolePermission = permissions.roles().mapRolePermission(client1Role);
+            ResourceServer server = permissions.roles().resourceServer(client1Role);
+            Policy mapperPolicy = permissions.roles().rolePolicy(server, mapperRole);
+            mapRolePermission.addAssociatedPolicy(mapperPolicy);
+        }
+
+        {
+            permissions.roles().setPermissionsEnabled(realmRole, true);
+            Policy mapRolePermission = permissions.roles().mapRolePermission(realmRole);
+            ResourceServer server = permissions.roles().resourceServer(realmRole);
+            Policy mapperPolicy = permissions.roles().rolePolicy(server, mapperRole);
+            mapRolePermission.addAssociatedPolicy(mapperPolicy);
+        }
+
+        // realmRole2 will have an empty map-role policy
+        {
+            permissions.roles().setPermissionsEnabled(realmRole2, true);
+        }
+
+        // setup Users manage policies
+        {
+            permissions.users().setPermissionsEnabled(true);
+            ResourceServer server = permissions.realmResourceServer();
+            Policy managerPolicy = permissions.roles().rolePolicy(server, managerRole);
+            Policy permission = permissions.users().managePermission();
+            permission.addAssociatedPolicy(managerPolicy);
+            permission.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
+        }
+        {
+            permissions.groups().setPermissionsEnabled(group, true);
+        }
+        {
+            permissions.clients().setPermissionsEnabled(client1, true);
+        }
+        // setup Users impersonate policy
+        {
+            ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
+            RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
+            permissions.users().setPermissionsEnabled(true);
+            ResourceServer server = permissions.realmResourceServer();
+            Policy adminPolicy = permissions.roles().rolePolicy(server, adminRole);
+            adminPolicy.setLogic(Logic.NEGATIVE);
+            Policy permission = permissions.users().userImpersonatedPermission();
+            permission.addAssociatedPolicy(adminPolicy);
+            permission.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
+        }
+    }
+
+    public static void setupUsers(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        ClientModel client = realm.getClientByClientId(CLIENT_NAME);
+        RoleModel realmRole = realm.getRole("realm-role");
+        RoleModel realmRole2 = realm.getRole("realm-role2");
+        RoleModel clientRole = client.getRole("client-role");
+        RoleModel mapperRole = realm.getRole("mapper");
+        RoleModel managerRole = realm.getRole("manager");
+        RoleModel compositeRole = realm.getRole("composite-role");
+        ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
+        RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
+        RoleModel queryGroupsRole = realmManagementClient.getRole(AdminRoles.QUERY_GROUPS);
+        RoleModel queryUsersRole = realmManagementClient.getRole(AdminRoles.QUERY_USERS);
+        RoleModel queryClientsRole = realmManagementClient.getRole(AdminRoles.QUERY_CLIENTS);
+
+        UserModel nomapAdmin = session.users().addUser(realm, "nomap-admin");
+        nomapAdmin.setFirstName("No Map");
+        nomapAdmin.setLastName("Admin");
+        nomapAdmin.setEmail("nomap@admin");
+        nomapAdmin.setEnabled(true);
+        nomapAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        nomapAdmin.grantRole(adminRole);
+
+        UserModel anotherAdmin = session.users().addUser(realm, "anotherAdmin");
+        anotherAdmin.setFirstName("Another");
+        anotherAdmin.setLastName("Admin");
+        anotherAdmin.setEmail("another@admin");
+        anotherAdmin.setEnabled(true);
+        anotherAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        anotherAdmin.grantRole(adminRole);
+
+        UserModel authorizedUser = session.users().addUser(realm, "authorized");
+        authorizedUser.setFirstName("Authorized");
+        authorizedUser.setLastName("User");
+        authorizedUser.setEmail("authorized@user");
+        authorizedUser.setEnabled(true);
+        authorizedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        authorizedUser.grantRole(mapperRole);
+        authorizedUser.grantRole(managerRole);
+
+        UserModel authorizedComposite = session.users().addUser(realm, "authorizedComposite");
+        authorizedComposite.setFirstName("Authorized");
+        authorizedComposite.setLastName("Composite");
+        authorizedComposite.setEmail("authorized@Composite");
+        authorizedComposite.setEnabled(true);
+        authorizedComposite.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        authorizedComposite.grantRole(compositeRole);
+
+        UserModel unauthorizedUser = session.users().addUser(realm, "unauthorized");
+        unauthorizedUser.setFirstName("Unauthorized");
+        unauthorizedUser.setLastName("User");
+        unauthorizedUser.setEmail("unauthorized@user");
+        unauthorizedUser.setEnabled(true);
+        unauthorizedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel unauthorizedMapper = session.users().addUser(realm, "unauthorizedMapper");
+        unauthorizedMapper.setFirstName("Unauthorized");
+        unauthorizedMapper.setLastName("Mapper");
+        unauthorizedMapper.setEmail("unauthorized@Mapper");
+        unauthorizedMapper.setEnabled(true);
+        unauthorizedMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        unauthorizedMapper.grantRole(managerRole);
+
+        UserModel user1 = session.users().addUser(realm, "user1");
+        user1.setFirstName("User");
+        user1.setLastName("One");
+        user1.setEmail("user@one");
+        user1.setEnabled(true);
+
+        // group management
+        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+
+        GroupModel group =  KeycloakModelUtils.findGroupByPath(session, realm, "top");
+        UserModel groupMember = session.users().addUser(realm, "groupMember");
+        groupMember.setFirstName("Group");
+        groupMember.setLastName("Member");
+        groupMember.setEmail("group@member");
+        groupMember.joinGroup(group);
+        groupMember.setEnabled(true);
+        UserModel groupManager = session.users().addUser(realm, "groupManager");
+        groupManager.setFirstName("Group");
+        groupManager.setLastName("Manager");
+        groupManager.setEmail("group@manager");
+        groupManager.grantRole(queryGroupsRole);
+        groupManager.grantRole(queryUsersRole);
+        groupManager.setEnabled(true);
+        groupManager.grantRole(mapperRole);
+        groupManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserModel groupManagerNoMapper = session.users().addUser(realm, "noMapperGroupManager");
+        groupManagerNoMapper.setFirstName("No Mapper");
+        groupManagerNoMapper.setLastName("Group Manager");
+        groupManagerNoMapper.setEmail("nomapper@groupmanager");
+        groupManagerNoMapper.setEnabled(true);
+        groupManagerNoMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        groupManagerNoMapper.grantRole(queryGroupsRole);
+        groupManagerNoMapper.grantRole(queryUsersRole);
+
+        UserPolicyRepresentation groupManagerRep = new UserPolicyRepresentation();
+        groupManagerRep.setName("groupManagers");
+        groupManagerRep.addUser("groupManager");
+        groupManagerRep.addUser("noMapperGroupManager");
+        ResourceServer server = permissions.realmResourceServer();
+        Policy groupManagerPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(server, groupManagerRep);
+        permissions.groups().manageMembersPermission(group).addAssociatedPolicy(groupManagerPolicy);
+        permissions.groups().manageMembershipPermission(group).addAssociatedPolicy(groupManagerPolicy);
+        permissions.groups().viewPermission(group).addAssociatedPolicy(groupManagerPolicy);
+
+        UserModel clientMapper = session.users().addUser(realm, "clientMapper");
+        clientMapper.setFirstName("Client");
+        clientMapper.setLastName("Mapper");
+        clientMapper.setEmail("client@mapper");
+        clientMapper.setEnabled(true);
+        clientMapper.grantRole(managerRole);
+        clientMapper.grantRole(queryUsersRole);
+        clientMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        Policy clientMapperPolicy = permissions.clients().mapRolesPermission(client);
+        UserPolicyRepresentation userRep = new UserPolicyRepresentation();
+        userRep.setName("userClientMapper");
+        userRep.addUser("clientMapper");
+        Policy userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
+        clientMapperPolicy.addAssociatedPolicy(userPolicy);
+
+        UserModel clientManager = session.users().addUser(realm, "clientManager");
+        clientManager.setFirstName("Client");
+        clientManager.setLastName("Manager");
+        clientManager.setEmail("client@manager");
+        clientManager.setEnabled(true);
+        clientManager.grantRole(queryClientsRole);
+        clientManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        Policy clientManagerPolicy = permissions.clients().managePermission(client);
+        userRep = new UserPolicyRepresentation();
+        userRep.setName("clientManager");
+        userRep.addUser("clientManager");
+        userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
+        clientManagerPolicy.addAssociatedPolicy(userPolicy);
+
+
+        UserModel clientConfigurer = session.users().addUser(realm, "clientConfigurer");
+        clientConfigurer.setFirstName("Client");
+        clientConfigurer.setLastName("Configurer");
+        clientConfigurer.setEmail("client@configurer");
+        clientConfigurer.setEnabled(true);
+        clientConfigurer.grantRole(queryClientsRole);
+        clientConfigurer.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        Policy clientConfigurePolicy = permissions.clients().configurePermission(client);
+        userRep = new UserPolicyRepresentation();
+        userRep.setName("clientConfigure");
+        userRep.addUser("clientConfigurer");
+        userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
+        clientConfigurePolicy.addAssociatedPolicy(userPolicy);
+
+
+        UserModel groupViewer = session.users().addUser(realm, "groupViewer");
+        groupViewer.setFirstName("Group");
+        groupViewer.setLastName("Viewer");
+        groupViewer.setEmail("group@viewer");
+        groupViewer.grantRole(queryGroupsRole);
+        groupViewer.grantRole(queryUsersRole);
+        groupViewer.setEnabled(true);
+        groupViewer.credentialManager().updateCredential(UserCredentialModel.password("password"));
+
+        UserPolicyRepresentation groupViewMembersRep = new UserPolicyRepresentation();
+        groupViewMembersRep.setName("groupMemberViewers");
+        groupViewMembersRep.addUser("groupViewer");
+        Policy groupViewMembersPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(server, groupViewMembersRep);
+        Policy groupViewMembersPermission = permissions.groups().viewMembersPermission(group);
+        groupViewMembersPermission.addAssociatedPolicy(groupViewMembersPolicy);
+    }
+
+    protected String checkTokenExchange(boolean shouldPass) {
+        runOnServer.run(AbstractFineGrainedAdminTest::setupTokenExchange);
+        oauth.realm("master");
+        oauth.client("tokenexclient", "password");
+        String exchanged = null;
+        String token = oauth.doPasswordGrantRequest("admin", "admin").getAccessToken();
+        Assertions.assertNotNull(token);
+        try {
+            exchanged = oauth.tokenExchangeRequest(token).audience("admin-cli").send().getAccessToken();
+        } catch (AssertionError e) {
+            LOGGER.info("Error message is expected from oauth: " + e.getMessage());
+        }
+        if (shouldPass)
+            Assertions.assertNotNull(exchanged);
+        else
+            Assertions.assertNull(exchanged);
+        return exchanged;
+    }
+
+    private static void setupTokenExchange(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName("master");
+        ClientModel client = session.clients().getClientByClientId(realm, "tokenexclient");
+        if (client != null) {
+            return;
+        }
+
+        ClientModel tokenexclient = realm.addClient("tokenexclient");
+        tokenexclient.setEnabled(true);
+        tokenexclient.addRedirectUri("http://localhost:*");
+        tokenexclient.setPublicClient(false);
+        tokenexclient.setSecret("password");
+        tokenexclient.setDirectAccessGrantsEnabled(true);
+
+        // permission for client to client exchange to "target" client
+        ClientModel adminCli = realm.getClientByClientId(ConfigUtil.DEFAULT_CLIENT);
+        AdminPermissionManagement management = AdminPermissions.management(session, realm);
+        management.clients().setPermissionsEnabled(adminCli, true);
+        ClientPolicyRepresentation clientRep = new ClientPolicyRepresentation();
+        clientRep.setName("to");
+        clientRep.addClient(tokenexclient.getId());
+        ResourceServer server = management.realmResourceServer();
+        Policy clientPolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientRep);
+        management.clients().exchangeToPermission(adminCli).addAssociatedPolicy(clientPolicy);
+    }
+
+    public static class FineGrainedAdminServerConf implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            config.features(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
+
+            return config;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminDefaultRealmTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminDefaultRealmTest.java
new file mode 100644
index 000000000000..487ceadabbc5
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminDefaultRealmTest.java
@@ -0,0 +1,109 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.authorization.model.Resource;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.LinkedList;
+import java.util.List;
+
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedAdminDefaultRealmTest extends AbstractFineGrainedAdminTest {
+
+    // KEYCLOAK-5152
+    @Test
+    public void testRealmWithComposites() {
+        runOnServer.run(FineGrainedAdminDefaultRealmTest::setup5152);
+
+        try (Keycloak realmClient = adminClientFactory.create().realm(REALM_NAME)
+                .username("realm-admin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+            RoleRepresentation composite = new RoleRepresentation();
+            composite.setName("composite");
+            composite.setComposite(true);
+            realmClient.realm(REALM_NAME).roles().create(composite);
+            composite = managedRealm.admin().roles().get("composite").toRepresentation();
+
+            ClientRepresentation client = managedRealm.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+            RoleRepresentation viewUsers = managedRealm.admin().clients().get(client.getId()).roles().get(AdminRoles.CREATE_CLIENT).toRepresentation();
+
+            List<RoleRepresentation> composites = new LinkedList<>();
+            composites.add(viewUsers);
+            realmClient.realm(REALM_NAME).rolesById().addComposites(composite.getId(), composites);
+        }
+    }
+
+    @Test
+    public void testRemoveCleanup() {
+        runOnServer.run(FineGrainedAdminDefaultRealmTest::setupDeleteTest);
+        runOnServer.run(FineGrainedAdminDefaultRealmTest::invokeDelete);
+    }
+
+    public static void setup5152(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+        RoleModel realmAdminRole = realmAdminClient.getRole(AdminRoles.REALM_ADMIN);
+
+        UserModel realmUser = session.users().addUser(realm, "realm-admin");
+        realmUser.setFirstName("Realm");
+        realmUser.setLastName("Admin");
+        realmUser.setEmail("realm@admin");
+        realmUser.grantRole(realmAdminRole);
+        realmUser.setEnabled(true);
+        realmUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+    }
+
+    // test role deletion that it cleans up authz objects
+    public static void setupDeleteTest(KeycloakSession session )  {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        RoleModel removedRole = realm.addRole("removedRole");
+        ClientModel client = realm.addClient("removedClient");
+        RoleModel removedClientRole = client.addRole("removedClientRole");
+        GroupModel removedGroup = realm.createGroup("removedGroup");
+        AdminPermissionManagement management = AdminPermissions.management(session, realm);
+        management.roles().setPermissionsEnabled(removedRole, true);
+        management.roles().setPermissionsEnabled(removedClientRole, true);
+        management.groups().setPermissionsEnabled(removedGroup, true);
+        management.clients().setPermissionsEnabled(client, true);
+        management.users().setPermissionsEnabled(true);
+    }
+
+    public static void invokeDelete(KeycloakSession session)  {
+        RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+        AdminPermissionManagement management = AdminPermissions.management(session, realm);
+        List<Resource> byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
+        Assertions.assertEquals(5, byResourceServer.size());
+        RoleModel removedRole = realm.getRole("removedRole");
+        realm.removeRole(removedRole);
+        ClientModel client = realm.getClientByClientId("removedClient");
+        RoleModel removedClientRole = client.getRole("removedClientRole");
+        client.removeRole(removedClientRole);
+        GroupModel group = KeycloakModelUtils.findGroupByPath(session, realm, "removedGroup");
+        realm.removeGroup(group);
+        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
+        Assertions.assertEquals(2, byResourceServer.size());
+        realm.removeClient(client.getId());
+        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
+        Assertions.assertEquals(1, byResourceServer.size());
+        management.users().setPermissionsEnabled(false);
+        Resource userResource = management.authz().getStoreFactory().getResourceStore().findByName(management.realmResourceServer(), "Users");
+        Assertions.assertNull(userResource);
+        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
+        Assertions.assertEquals(0, byResourceServer.size());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminMasterRealmTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminMasterRealmTest.java
new file mode 100644
index 000000000000..0fc55910dfb6
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminMasterRealmTest.java
@@ -0,0 +1,172 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.LinkedList;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.hasItem;
+
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedAdminMasterRealmTest extends AbstractFineGrainedAdminTest {
+
+    @Test
+    public void testMasterRealm() throws Exception {
+        // test that master realm can still perform operations when policies are in place
+        //
+        runOnServer.run(FineGrainedAdminRestTest::setupPolices);
+        runOnServer.run(FineGrainedAdminRestTest::setupUsers);
+
+        UserRepresentation user1 = managedRealm.admin().users().search("user1").get(0);
+        RoleRepresentation realmRole = managedRealm.admin().roles().get("realm-role").toRepresentation();
+        List<RoleRepresentation> realmRoleSet = new LinkedList<>();
+        realmRoleSet.add(realmRole);
+        RoleRepresentation realmRole2 = managedRealm.admin().roles().get("realm-role2").toRepresentation();
+        List<RoleRepresentation> realmRole2Set = new LinkedList<>();
+        realmRole2Set.add(realmRole);
+        ClientRepresentation client = managedRealm.admin().clients().findByClientId(CLIENT_NAME).get(0);
+        RoleRepresentation clientRole = managedRealm.admin().clients().get(client.getId()).roles().get("client-role").toRepresentation();
+        List<RoleRepresentation> clientRoleSet = new LinkedList<>();
+        clientRoleSet.add(clientRole);
+
+        adminClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+        List<RoleRepresentation> roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+        Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+            return r.getName().equals("realm-role");
+        }));
+        adminClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
+        roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+        Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+            return r.getName().equals("realm-role");
+        }));
+
+        adminClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
+        roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+        Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+            return r.getName().equals("client-role");
+        }));
+        adminClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
+        roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+        Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+            return r.getName().equals("client-role");
+        }));
+    }
+
+    // KEYCLOAK-5152
+    @Test
+    public void testMasterRealmWithComposites() throws Exception {
+        RoleRepresentation composite = new RoleRepresentation();
+        composite.setName("composite");
+        composite.setComposite(true);
+        managedRealm.admin().roles().create(composite);
+        composite = managedRealm.admin().roles().get("composite").toRepresentation();
+
+        ClientRepresentation client = managedRealm.admin().clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
+        RoleRepresentation createClient = managedRealm.admin().clients().get(client.getId()).roles().get(AdminRoles.CREATE_CLIENT).toRepresentation();
+        RoleRepresentation queryRealms = managedRealm.admin().clients().get(client.getId()).roles().get(AdminRoles.QUERY_REALMS).toRepresentation();
+        List<RoleRepresentation> composites = new LinkedList<>();
+        composites.add(createClient);
+        composites.add(queryRealms);
+        managedRealm.admin().rolesById().addComposites(composite.getId(), composites);
+    }
+
+    // KEYCLOAK-5211
+    @Test
+    public void testCreateRealmCreateClient() throws Exception {
+        ClientRepresentation rep = new ClientRepresentation();
+        rep.setName("fullScopedClient");
+        rep.setClientId("fullScopedClient");
+        rep.setFullScopeAllowed(true);
+        rep.setSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171");
+        rep.setProtocol("openid-connect");
+        rep.setPublicClient(false);
+        rep.setEnabled(true);
+        masterRealm.admin().clients().create(rep);
+
+        Keycloak realmClient = adminClientFactory.create().realm("master")
+                .username("admin").password("admin").clientId("fullScopedClient").clientSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171").build();
+        try {
+            RealmRepresentation newRealm=new RealmRepresentation();
+            newRealm.setRealm("anotherRealm");
+            newRealm.setId("anotherRealm");
+            newRealm.setEnabled(true);
+            realmClient.realms().create(newRealm);
+
+            ClientRepresentation newClient = new ClientRepresentation();
+
+            newClient.setName("newClient");
+            newClient.setClientId("newClient");
+            newClient.setFullScopeAllowed(true);
+            newClient.setSecret("secret");
+            newClient.setProtocol("openid-connect");
+            newClient.setPublicClient(false);
+            newClient.setEnabled(true);
+            Response response = realmClient.realm("anotherRealm").clients().create(newClient);
+            Assertions.assertEquals(403, response.getStatus());
+            response.close();
+
+            realmClient.close();
+            //creating new client to refresh token
+            realmClient = adminClientFactory.create().realm("master")
+                    .username("admin").password("admin").clientId("fullScopedClient").clientSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171").build();
+            assertThat(realmClient.realms().findAll().stream().map(RealmRepresentation::getRealm).collect(Collectors.toSet()),
+                    hasItem("anotherRealm"));
+            response = realmClient.realm("anotherRealm").clients().create(newClient);
+            Assertions.assertEquals(201, response.getStatus());
+            response.close();
+        } finally {
+            adminClient.realm("anotherRealm").remove();
+            realmClient.close();
+        }
+    }
+
+    // KEYCLOAK-5211
+    @Test
+    public void testCreateRealmCreateClientWithMaster() throws Exception {
+        ClientRepresentation rep = new ClientRepresentation();
+        rep.setName("fullScopedClient");
+        rep.setClientId("fullScopedClient");
+        rep.setFullScopeAllowed(true);
+        rep.setSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171");
+        rep.setProtocol("openid-connect");
+        rep.setPublicClient(false);
+        rep.setEnabled(true);
+        masterRealm.admin().clients().create(rep);
+
+        RealmRepresentation newRealm=new RealmRepresentation();
+        newRealm.setRealm("anotherRealm");
+        newRealm.setId("anotherRealm");
+        newRealm.setEnabled(true);
+        adminClient.realms().create(newRealm);
+
+        try {
+            ClientRepresentation newClient = new ClientRepresentation();
+
+            newClient.setName("newClient");
+            newClient.setClientId("newClient");
+            newClient.setFullScopeAllowed(true);
+            newClient.setSecret("secret");
+            newClient.setProtocol("openid-connect");
+            newClient.setPublicClient(false);
+            newClient.setEnabled(true);
+            Response response = adminClient.realm("anotherRealm").clients().create(newClient);
+            Assertions.assertEquals(201, response.getStatus());
+            response.close();
+        } finally {
+            adminClient.realm("anotherRealm").remove();
+
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminRestTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminRestTest.java
new file mode 100644
index 000000000000..c1fbfa72930e
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminRestTest.java
@@ -0,0 +1,311 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.GroupConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import jakarta.ws.rs.ClientErrorException;
+
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedAdminRestTest extends AbstractFineGrainedAdminTest {
+
+    @Test
+    public void testRestEvaluation() throws Exception {
+        String groupId = ApiUtil.getCreatedId(managedRealm.admin().groups().add(GroupConfigBuilder.create().name("restricted-group").build()));
+
+        runOnServer.run(FineGrainedAdminRestTest::setupPolices);
+        runOnServer.run(FineGrainedAdminRestTest::setupUsers);
+
+        UserRepresentation user1 = managedRealm.admin().users().search("user1").get(0);
+        UserRepresentation anotherAdmin = managedRealm.admin().users().search("anotherAdmin").get(0);
+        UserRepresentation groupMember = managedRealm.admin().users().search("groupMember").get(0);
+        RoleRepresentation realmRole = managedRealm.admin().roles().get("realm-role").toRepresentation();
+        List<RoleRepresentation> realmRoleSet = new LinkedList<>();
+        realmRoleSet.add(realmRole);
+        RoleRepresentation realmRole2 = managedRealm.admin().roles().get("realm-role2").toRepresentation();
+        List<RoleRepresentation> realmRole2Set = new LinkedList<>();
+        realmRole2Set.add(realmRole2);
+        ClientRepresentation client = managedRealm.admin().clients().findByClientId(CLIENT_NAME).get(0);
+        ClientScopeRepresentation scope = managedRealm.admin().clientScopes().findAll().get(0);
+        RoleRepresentation clientRole = managedRealm.admin().clients().get(client.getId()).roles().get("client-role").toRepresentation();
+        List<RoleRepresentation> clientRoleSet = new LinkedList<>();
+        clientRoleSet.add(clientRole);
+
+        // test configure client
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("clientConfigurer").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                client.setAdminUrl("http://nowhere");
+                realmClient.realm(REALM_NAME).clients().get(client.getId()).update(client);
+                client.setFullScopeAllowed(true);
+                try {
+                    realmClient.realm(REALM_NAME).clients().get(client.getId()).update(client);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+
+                }
+                client.setFullScopeAllowed(false);
+                realmClient.realm(REALM_NAME).clients().get(client.getId()).update(client);
+
+                try {
+                    realmClient.realm(REALM_NAME).clients().get(client.getId()).addDefaultClientScope(scope.getId());
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+
+                }
+
+                try {
+                    realmClient.realm(REALM_NAME).clients().get(client.getId()).getScopeMappings().realmLevel().add(realmRoleSet);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+
+                }
+            }
+        }
+
+        // test illegal impersonation
+        {
+            Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("nomap-admin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build();
+            try {
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).impersonate();
+                realmClient.close(); // just in case of cookie settings
+                realmClient = adminClientFactory.create()
+                        .realm(REALM_NAME).username("nomap-admin").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build();
+                try {
+                    realmClient.realm(REALM_NAME).users().get(anotherAdmin.getId()).impersonate();
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+                }
+            } finally {
+                realmClient.close();
+            }
+        }
+
+
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("authorized").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                List<RoleRepresentation> roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("realm-role");
+                }));
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+                Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+                    return r.getName().equals("realm-role");
+                }));
+
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+            }
+        }
+
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("authorizedComposite").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                List<RoleRepresentation> roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("realm-role");
+                }));
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().realmLevel().listAll();
+                Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+                    return r.getName().equals("realm-role");
+                }));
+
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
+                roles = managedRealm.admin().users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().noneMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+            }
+        }
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("unauthorized").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                Assertions.fail("should fail with forbidden exception");
+            } catch (ClientErrorException e) {
+                Assertions.assertEquals(403, e.getResponse().getStatus());
+            }
+        }
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("unauthorizedMapper").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                Assertions.fail("should fail with forbidden exception");
+            } catch (ClientErrorException e) {
+                Assertions.assertEquals(403, e.getResponse().getStatus());
+            }
+        }
+
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("groupManager").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
+                List<RoleRepresentation> roles = realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+                realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
+
+                roles = realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().realmLevel().listAvailable();
+                Assertions.assertEquals(1, roles.size());
+                realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().realmLevel().add(realmRoleSet);
+                realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().realmLevel().remove(realmRoleSet);
+                try {
+                    realmClient.realm(REALM_NAME).users().get(groupMember.getId()).roles().realmLevel().add(realmRole2Set);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+                }
+                try {
+                    realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+                }
+            }
+        }
+
+
+        // test client.mapRoles
+        {
+            try (Keycloak realmClient = adminClientFactory
+                    .create().realm(REALM_NAME).username("clientMapper").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                List<RoleRepresentation> roles = realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.isEmpty());
+                realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
+                roles = realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
+                Assertions.assertTrue(roles.stream().anyMatch((r) -> {
+                    return r.getName().equals("client-role");
+                }));
+                roles = realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().listAvailable();
+                Assertions.assertTrue(roles.isEmpty());
+                try {
+                    realmClient.realm(REALM_NAME).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
+                    Assertions.fail("should fail with forbidden exception");
+                } catch (ClientErrorException e) {
+                    Assertions.assertEquals(403, e.getResponse().getStatus());
+                }
+            }
+        }
+
+        // KEYCLOAK-5878
+
+        {
+            try (Keycloak realmClient = adminClientFactory.create()
+                    .realm(REALM_NAME).username("groupViewer").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                // Should only return the list of users that belong to "top" group
+                List<UserRepresentation> queryUsers = realmClient.realm(REALM_NAME).users().list();
+                Assertions.assertEquals(queryUsers.size(), 1);
+                MatcherAssert.assertThat("groupmember", Matchers.equalTo(queryUsers.get(0).getUsername()));
+                for (UserRepresentation user : queryUsers) {
+                    System.out.println(user.getUsername());
+                }
+            }
+        }
+
+        // KEYCLOAK-11261 : user creation via fine grain admin
+
+        {
+            try (Keycloak realmClient = adminClientFactory.create().realm(REALM_NAME)
+                    .username("noMapperGroupManager").password("password").clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+                // Should only return the list of users that belong to "top" group
+                List<UserRepresentation> queryUsers = realmClient.realm(REALM_NAME).users().list();
+                Assertions.assertEquals(1, queryUsers.size());
+
+                UserRepresentation newGroupMemberWithoutGroup = UserConfigBuilder.create()
+                        .username("new-group-member").email("new-group-member@keycloak.org").name("New", "Member").build();
+
+                Response response1 = realmClient.realm(REALM_NAME).users().create(newGroupMemberWithoutGroup);
+
+                Assertions.assertEquals(403, response1.getStatus());
+
+                UserRepresentation newEmptyGroupList = UserConfigBuilder.create()
+                        .username("new-group-member").email("new-group-member@keycloak.org").name("New", "Member").build();
+                newEmptyGroupList.setGroups(Collections.emptyList());
+
+                Response response2 = realmClient.realm(REALM_NAME).users().create(newEmptyGroupList);
+                Assertions.assertEquals(403, response2.getStatus());
+
+                UserRepresentation newGroupMemberWithNonExistentGroup = UserConfigBuilder.create()
+                        .username("new-group-member").email("new-group-member@keycloak.org").name("New", "Member").groups("wrong-group").build();
+
+                Response response3 = realmClient.realm(REALM_NAME).users().create(newGroupMemberWithNonExistentGroup);
+                Assertions.assertEquals(403, response3.getStatus());
+
+                UserRepresentation newGroupMemberOfNotManagedGroup = UserConfigBuilder.create()
+                        .username("new-group-member").email("new-group-member@keycloak.org").name("New", "Member").groups("restricted-group").build();
+
+                Response response4 = realmClient.realm(REALM_NAME).users().create(newGroupMemberOfNotManagedGroup);
+                Assertions.assertEquals(403, response4.getStatus());
+
+                UserRepresentation newGroupMember = UserConfigBuilder.create()
+                        .username("new-group-member").email("new-group-member@keycloak.org").name("New", "Member").groups("top").build();
+                ApiUtil.createUserWithAdminClient(realmClient.realm(REALM_NAME), newGroupMember);
+
+                // Should only return the list of users that belong to "top" group + the new one
+                queryUsers = realmClient.realm(REALM_NAME).users().list();
+                Assertions.assertEquals(2, queryUsers.size());
+            }
+        }
+        managedRealm.cleanup().add(r -> r.groups().group(groupId).remove());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminSearchTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminSearchTest.java
new file mode 100644
index 000000000000..def5d36314f7
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminSearchTest.java
@@ -0,0 +1,396 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.RepresentationToModel;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.ClientPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.GroupPermissionManagement;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.oneOf;
+
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedAdminSearchTest extends AbstractFineGrainedAdminTest {
+
+    @Test
+    public void testUserPagination() {
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+
+            session.getContext().setRealm(realm);
+
+            GroupModel customerAGroup = session.groups().createGroup(realm, "Customer A");
+            UserModel customerAManager = session.users().addUser(realm, "customer-a-manager");
+            customerAManager.setFirstName("Customer");
+            customerAManager.setLastName("A");
+            customerAManager.setEmail("customer@a");
+            customerAManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
+            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+            customerAManager.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_USERS));
+            customerAManager.setEnabled(true);
+            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
+            regularAdminUser.setFirstName("Regular");
+            regularAdminUser.setLastName("Admin");
+            regularAdminUser.setEmail("regular@admin");
+            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.VIEW_USERS));
+            regularAdminUser.setEnabled(true);
+
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+
+            GroupPermissionManagement groupPermission = management.groups();
+
+            groupPermission.setPermissionsEnabled(customerAGroup, true);
+
+            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
+
+            userPolicyRepresentation.setName("Only " + customerAManager.getUsername());
+            userPolicyRepresentation.addUser(customerAManager.getId());
+
+            Policy policy = groupPermission.viewMembersPermission(customerAGroup);
+
+            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+
+            Policy userPolicy = provider.getStoreFactory().getPolicyStore().create(management.realmResourceServer(), userPolicyRepresentation);
+
+            policy.addAssociatedPolicy(RepresentationToModel.toModel(userPolicyRepresentation, provider, userPolicy));
+
+            for (int i = 0; i < 20; i++) {
+                UserModel userModel = session.users().addUser(realm, "a" + i);
+                userModel.setFirstName("test");
+            }
+
+            for (int i = 20; i < 40; i++) {
+                UserModel userModel = session.users().addUser(realm, "b" + i);
+                userModel.setFirstName("test");
+                userModel.joinGroup(customerAGroup);
+            }
+        });
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("customer-a-manager").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<UserRepresentation> result = client.realm(REALM_NAME).users().search(null, "test", null, null, -1, 20);
+
+            Assertions.assertEquals(20, result.size());
+            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
+
+            result = client.realm(REALM_NAME).users().search(null, "test", null, null, 20, 40);
+
+            Assertions.assertEquals(0, result.size());
+        }
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<UserRepresentation> result = client.realm(REALM_NAME).users().search(null, "test", null, null, -1, 20);
+
+            Assertions.assertEquals(20, result.size());
+            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("a"))));
+
+            client.realm(REALM_NAME).users().search(null, null, null, null, -1, -1);
+
+            Assertions.assertEquals(20, result.size());
+            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("a"))));
+        }
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("customer-a-manager").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<UserRepresentation> result = client.realm(REALM_NAME).users().search(null, null, null, null, -1, 20);
+
+            Assertions.assertEquals(20, result.size());
+            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
+
+            result = client.realm(REALM_NAME).users().search("test", -1, 20, false);
+
+            Assertions.assertEquals(20, result.size());
+            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
+
+            result = client.realm(REALM_NAME).users().search("a", -1, 20, false);
+
+            Assertions.assertEquals(0, result.size());
+        }
+    }
+
+    @Test
+    public void testClientsSearch() {
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+
+            session.getContext().setRealm(realm);
+
+            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
+            regularAdminUser.setFirstName("Regular");
+            regularAdminUser.setLastName("Admin");
+            regularAdminUser.setEmail("regular@admin");
+            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
+            regularAdminUser.setEnabled(true);
+
+            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
+
+            userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
+            userPolicyRepresentation.addUser(regularAdminUser.getId());
+
+            for (int i = 0; i < 30; i++) {
+                realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
+            }
+
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            ClientPermissionManagement clientPermission = management.clients();
+            ClientModel clientModel = realm.getClientByClientId("client-search-09");
+
+            clientPermission.setPermissionsEnabled(clientModel, true);
+
+            Policy policy = clientPermission.viewPermission(clientModel);
+            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+            Policy userPolicy = provider.getStoreFactory().getPolicyStore()
+                    .create(management.realmResourceServer(), userPolicyRepresentation);
+
+            policy.addAssociatedPolicy(RepresentationToModel.toModel(userPolicyRepresentation, provider, userPolicy));
+        });
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 0, 5);
+
+            Assertions.assertEquals(1, result.size());
+            Assertions.assertEquals("client-search-09", result.get(0).getClientId());
+        }
+
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+
+            session.getContext().setRealm(realm);
+
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+
+            ClientPermissionManagement clientPermission = management.clients();
+            ClientModel clientModel = realm.getClientByClientId("client-search-10");
+
+            clientPermission.setPermissionsEnabled(clientModel, true);
+
+            Policy policy = clientPermission.viewPermission(clientModel);
+
+            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+            ResourceServer resourceServer = provider.getStoreFactory().getResourceServerStore().findByClient(realmAdminClient);
+
+            policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore().findByName(resourceServer, "Only regular-admin-user"));
+        });
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, -1, -1);
+
+            Assertions.assertEquals(2, result.size());
+        }
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll(null, true, false, 0, 5);
+
+            Assertions.assertEquals(2, result.size());
+        }
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll(null, true, false, 0, 1);
+
+            Assertions.assertEquals(1, result.size());
+            assertThat(result, Matchers.hasItem(Matchers.hasProperty("clientId", is("client-search-09"))));
+
+            result = client.realm(REALM_NAME).clients().findAll(null, true, false, 1, 1);
+            assertThat(result, Matchers.hasItem(Matchers.hasProperty("clientId", is("client-search-10"))));
+
+            Assertions.assertEquals(1, result.size());
+
+            result = client.realm(REALM_NAME).clients().findAll(null, true, false, 2, 1);
+
+            Assertions.assertTrue(result.isEmpty());
+        }
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll(null, true, false, -1, -1);
+
+            Assertions.assertEquals(2, result.size());
+        }
+
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+
+            session.getContext().setRealm(realm);
+
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+
+            ClientPermissionManagement clientPermission = management.clients();
+            for (int i = 11; i < 30; i++) {
+                ClientModel clientModel = realm.getClientByClientId("client-search-" + i);
+
+                clientPermission.setPermissionsEnabled(clientModel, true);
+
+                Policy policy = clientPermission.viewPermission(clientModel);
+
+                AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+                ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+                ResourceServer resourceServer = provider.getStoreFactory().getResourceServerStore().findByClient(realmAdminClient);
+
+                policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore()
+                        .findByName(resourceServer, "Only regular-admin-user"));
+            }
+        });
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> clients = new ArrayList<>();
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 0, 10);
+            clients.addAll(result);
+            Assertions.assertEquals(10, result.size());
+            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList("client-search-09",
+                    "client-search-10",
+                    "client-search-11",
+                    "client-search-12",
+                    "client-search-13",
+                    "client-search-14",
+                    "client-search-15",
+                    "client-search-16",
+                    "client-search-17",
+                    "client-search-18")));
+
+            result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 10, 10);
+            clients.addAll(result);
+            Assertions.assertEquals(10, result.size());
+            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList("client-search-19",
+                    "client-search-20",
+                    "client-search-21",
+                    "client-search-22",
+                    "client-search-23",
+                    "client-search-24",
+                    "client-search-25",
+                    "client-search-26",
+                    "client-search-27",
+                    "client-search-28")));
+
+            result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 20, 10);
+            clients.addAll(result);
+            Assertions.assertEquals(1, result.size());
+            assertThat(result, Matchers.hasItems(
+                    Matchers.hasProperty("clientId", is(oneOf("client-search-29")))));
+        }
+    }
+
+    @Test
+    public void testClientsSearchAfterFirstPage() {
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
+
+            session.getContext().setRealm(realm);
+
+            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
+            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
+            regularAdminUser.setFirstName("Regular");
+            regularAdminUser.setLastName("Admin");
+            regularAdminUser.setEmail("regular@admin");
+            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
+            regularAdminUser.setEnabled(true);
+
+            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
+
+            userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
+            userPolicyRepresentation.addUser(regularAdminUser.getId());
+
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+
+            ClientPermissionManagement clientPermission = management.clients();
+
+            for (int i = 15; i < 30; i++) {
+                ClientModel clientModel = realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
+                clientPermission.setPermissionsEnabled(clientModel, true);
+
+                Policy policy = clientPermission.viewPermission(clientModel);
+
+                AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
+
+                if (i == 15) {
+                    provider.getStoreFactory().getPolicyStore()
+                            .create(management.realmResourceServer(), userPolicyRepresentation);
+                }
+
+                policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore()
+                        .findByName(management.realmResourceServer(), "Only regular-admin-user"));
+
+            }
+        });
+
+        try (Keycloak client = adminClientFactory.create().realm(REALM_NAME)
+                .username("regular-admin-user").password("password").clientId( Constants.ADMIN_CLI_CLIENT_ID).build()) {
+
+            List<ClientRepresentation> clients = new ArrayList<>();
+
+            List<ClientRepresentation> result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 0, 10);
+            clients.addAll(result);
+            Assertions.assertEquals(10, result.size());
+            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList(
+                    "client-search-15",
+                    "client-search-16",
+                    "client-search-17",
+                    "client-search-18",
+                    "client-search-19",
+                    "client-search-20",
+                    "client-search-21",
+                    "client-search-22",
+                    "client-search-23",
+                    "client-search-24")));
+
+            result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 10, 10);
+            clients.addAll(result);
+            Assertions.assertEquals(5, result.size());
+            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList(
+                    "client-search-25",
+                    "client-search-26",
+                    "client-search-27",
+                    "client-search-28",
+                    "client-search-29")));
+
+            result = client.realm(REALM_NAME).clients().findAll("client-search-", true, true, 20, 10);
+            clients.addAll(result);
+            Assertions.assertTrue(result.isEmpty());
+        }
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeDisabledTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeDisabledTest.java
new file mode 100644
index 000000000000..5ce605a555a7
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeDisabledTest.java
@@ -0,0 +1,13 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedAdminWithTokenExchangeDisabledTest extends AbstractFineGrainedAdminTest{
+
+    @Test
+    public void testTokenExchangeDisabled() {
+        checkTokenExchange(false);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeTest.java
new file mode 100644
index 000000000000..c36b9f91ef76
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedAdminWithTokenExchangeTest.java
@@ -0,0 +1,36 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.common.Profile;
+import org.keycloak.models.Constants;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+@KeycloakIntegrationTest(config = FineGrainedAdminWithTokenExchangeTest.FineGrainedWithTokenExchangeServerConf.class)
+public class FineGrainedAdminWithTokenExchangeTest extends AbstractFineGrainedAdminTest {
+
+    /**
+     * KEYCLOAK-7406
+     */
+    @Test
+    public void testWithTokenExchange() {
+        String exchanged = checkTokenExchange(true);
+        try (Keycloak client = adminClientFactory.create()
+                .realm("master").authorization(exchanged).clientId(Constants.ADMIN_CLI_CLIENT_ID).build()) {
+            Assertions.assertNotNull(client.realm("master").roles().get("offline_access"));
+        }
+    }
+
+    public static class FineGrainedWithTokenExchangeServerConf implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            config.features(Profile.Feature.TOKEN_EXCHANGE, Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ);
+
+            return config;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedPermissionsV1UsersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedPermissionsV1UsersTest.java
new file mode 100644
index 000000000000..bbc31db67dd4
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/finegrainedadminv1/FineGrainedPermissionsV1UsersTest.java
@@ -0,0 +1,301 @@
+package org.keycloak.tests.admin.finegrainedadminv1;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.KeycloakBuilder;
+import org.keycloak.admin.client.resource.AuthorizationResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.ManagementPermissionRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionStrategy;
+import org.keycloak.representations.idm.authorization.PolicyRepresentation;
+import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.testframework.util.ApiUtil;
+
+import java.io.IOException;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+
+@KeycloakIntegrationTest(config = AbstractFineGrainedAdminTest.FineGrainedAdminServerConf.class)
+public class FineGrainedPermissionsV1UsersTest extends AbstractFineGrainedAdminTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm realm;
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    private void assertSearchMatchesCount(RealmResource realmResource, String search, Integer expectedCount) {
+        Integer count = realmResource.users().count(search);
+        assertThat(count, is(expectedCount));
+        assertThat(realmResource.users().search(search, null, null), hasSize(count));
+    }
+
+
+    @Test
+    public void countUsersWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        assertThat(testRealmResource.users().count(), is(3));
+    }
+
+    @Test
+    public void countUsersBySearchWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        //search all
+        assertSearchMatchesCount(testRealmResource, "user", 3);
+        //search first name
+        assertSearchMatchesCount(testRealmResource, "*FirstName*", 3);
+        assertSearchMatchesCount(testRealmResource, "user2FirstName", 1);
+        //search last name
+        assertSearchMatchesCount(testRealmResource, "*LastName*", 3);
+        assertSearchMatchesCount(testRealmResource, "user2LastName", 1);
+        //search in email
+        assertSearchMatchesCount(testRealmResource, "*@example.com*", 3);
+        assertSearchMatchesCount(testRealmResource, "user1@example.com", 1);
+        //search for something not existing
+        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
+        //search for empty string
+        assertSearchMatchesCount(testRealmResource, "", 3);
+        //search not specified (defaults to simply /count)
+        assertSearchMatchesCount(testRealmResource, null, 3);
+    }
+
+    @Test
+    public void countUsersByFiltersWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
+        //search username
+        assertThat(testRealmResource.users().count(null, null, null, "user"), equalTo(testRealmResource.users().search("user", null, null, null, null, null).size()));
+        assertThat(testRealmResource.users().count(null, null, null, "user"), is(3));
+        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(1));
+        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, ""), is(3));
+        //search first name
+        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(3));
+        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(1));
+        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "", null, null), is(3));
+        //search last name
+        assertThat(testRealmResource.users().count("LastName", null, null, null), is(3));
+        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(1));
+        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", null, null, null), is(3));
+        //search in email
+        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(3));
+        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(1));
+        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "", null), is(3));
+        //search for combinations
+        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(3));
+        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(1));
+        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(1));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
+        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(3));
+        //search not specified (defaults to simply /count)
+        assertThat(testRealmResource.users().count(null, null, null, null), is(3));
+        assertThat(testRealmResource.users().count("", "", "", ""), is(3));
+    }
+
+    @Test
+    public void countUsersWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, KeyManagementException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        assertThat(testRealmResource.users().count(), is(0));
+    }
+
+    @Test
+    public void countUsersBySearchWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        //search all
+        assertSearchMatchesCount(testRealmResource, "user", 0);
+        //search first name
+        assertSearchMatchesCount(testRealmResource, "FirstName", 0);
+        assertSearchMatchesCount(testRealmResource, "user2FirstName", 0);
+        //search last name
+        assertSearchMatchesCount(testRealmResource, "LastName", 0);
+        assertSearchMatchesCount(testRealmResource, "user2LastName", 0);
+        //search in email
+        assertSearchMatchesCount(testRealmResource, "@example.com", 0);
+        assertSearchMatchesCount(testRealmResource, "user1@example.com", 0);
+        //search for something not existing
+        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
+        //search for empty string
+        assertSearchMatchesCount(testRealmResource, "", 0);
+        //search not specified (defaults to simply /count)
+        assertSearchMatchesCount(testRealmResource, null, 0);
+    }
+
+    @Test
+    public void countUsersByFiltersWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
+        //search username
+        assertThat(testRealmResource.users().count(null, null, null, "user"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
+        assertThat(testRealmResource.users().count(null, null, null, ""), is(0));
+        //search first name
+        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, "", null, null), is(0));
+        //search last name
+        assertThat(testRealmResource.users().count("LastName", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", null, null, null), is(0));
+        //search in email
+        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "", null), is(0));
+        //search for combinations
+        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(0));
+        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
+        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(0));
+        //search not specified (defaults to simply /count)
+        assertThat(testRealmResource.users().count(null, null, null, null), is(0));
+        assertThat(testRealmResource.users().count("", "", "", ""), is(0));
+    }
+
+    private RealmResource setupTestEnvironmentWithPermissions(boolean grp1ViewPermissions) throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
+        UserRepresentation user = UserConfigBuilder.create()
+                .username("test-user")
+                .password("password")
+                .name("a", "b")
+                .email("c@d.com")
+                .enabled(true)
+                .build();
+        String testUserId = ApiUtil.getCreatedId(realm.admin().users().create(user));
+        //assign 'query-users' role to test user
+        ClientRepresentation clientRepresentation = realm.admin().clients().findByClientId("realm-management").get(0);
+        String realmManagementId = clientRepresentation.getId();
+        RoleRepresentation roleRepresentation = realm.admin().clients().get(realmManagementId).roles().get("query-users").toRepresentation();
+        realm.admin().users().get(testUserId).roles().clientLevel(realmManagementId).add(Collections.singletonList(roleRepresentation));
+
+        //create test users and groups
+        List<GroupRepresentation> groups = setupUsersInGroupsWithPermissions();
+
+        if (grp1ViewPermissions) {
+            AuthorizationResource authorizationResource = realm.admin().clients().get(realmManagementId).authorization();
+            //create a user policy for the test user
+            UserPolicyRepresentation policy = new UserPolicyRepresentation();
+            String policyName = "test-policy";
+            policy.setName(policyName);
+            policy.setUsers(Collections.singleton(testUserId));
+            authorizationResource.policies().user().create(policy).close();
+            PolicyRepresentation policyRepresentation = authorizationResource.policies().findByName(policyName);
+            //add the policy to grp1
+            Optional<GroupRepresentation> optional = groups.stream().filter(g -> g.getName().equals("grp1")).findFirst();
+            assertThat(optional.isPresent(), is(true));
+            GroupRepresentation grp1 = optional.get();
+            ScopePermissionRepresentation scopePermissionRepresentation = authorizationResource.permissions().scope().findByName("view.members.permission.group." + grp1.getId());
+            scopePermissionRepresentation.setPolicies(Collections.singleton(policyRepresentation.getId()));
+            scopePermissionRepresentation.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
+            authorizationResource.permissions().scope().findById(scopePermissionRepresentation.getId()).update(scopePermissionRepresentation);
+        }
+
+        Keycloak testUserClient = KeycloakBuilder.builder()
+                .serverUrl(keycloakUrls.getBaseUrl().toString())
+                .realm(realm.getName())
+                .username("test-user")
+                .password("password")
+                .clientId("admin-cli")
+                .clientSecret("")
+                .build();
+
+        return testUserClient.realm(realm.getCreatedRepresentation().getRealm());
+    }
+
+    private List<GroupRepresentation> setupUsersInGroupsWithPermissions() {
+        //create two groups
+        GroupRepresentation grp1 = createGroupWithPermissions("grp1");
+        GroupRepresentation grp2 = createGroupWithPermissions("grp2");
+        //create test users
+        UserRepresentation user1 = UserConfigBuilder.create()
+                .username("user1")
+                .password("password")
+                .name("user1FirstName", "user1LastName")
+                .email("user1@example.com")
+                .enabled(true)
+                .build();
+        String user1Id = ApiUtil.getCreatedId(realm.admin().users().create(user1));
+
+        UserRepresentation user2 = UserConfigBuilder.create()
+                .username("user2")
+                .password("password")
+                .name("user2FirstName", "user2LastName")
+                .email("user2@example.com")
+                .enabled(true)
+                .build();
+        String user2Id = ApiUtil.getCreatedId(realm.admin().users().create(user2));
+
+        UserRepresentation user3 = UserConfigBuilder.create()
+                .username("user3")
+                .password("password")
+                .name("user3FirstName", "user3LastName")
+                .email("user3@example.com")
+                .enabled(true)
+                .build();
+        String user3Id = ApiUtil.getCreatedId(realm.admin().users().create(user3));
+
+        UserRepresentation user4 = UserConfigBuilder.create()
+                .username("user4")
+                .password("password")
+                .name("user4FirstName", "user4LastName")
+                .email("user4@example.com")
+                .enabled(true)
+                .build();
+        String user4Id = ApiUtil.getCreatedId(realm.admin().users().create(user4));
+
+        //add users to groups
+        realm.admin().users().get(user1Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user2Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user3Id).joinGroup(grp1.getId());
+        realm.admin().users().get(user4Id).joinGroup(grp2.getId());
+
+        List<GroupRepresentation> groups = new ArrayList<>();
+        groups.add(grp1);
+        groups.add(grp2);
+
+        return groups;
+    }
+
+    private GroupRepresentation createGroupWithPermissions(String name) {
+        GroupRepresentation grp = new GroupRepresentation();
+        grp.setName(name);
+        realm.admin().groups().add(grp);
+        Optional<GroupRepresentation> optional = realm.admin().groups().groups().stream().filter(g -> g.getName().equals(name)).findFirst();
+        assertThat(optional.isPresent(), is(true));
+        grp = optional.get();
+        String id = grp.getId();
+        //enable the permissions
+        realm.admin().groups().group(id).setPermissions(new ManagementPermissionRepresentation(true));
+        assertThat(realm.admin().groups().group(id).getPermissions().isEnabled(), is(true));
+
+        return grp;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/group/AbstractGroupTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/group/AbstractGroupTest.java
new file mode 100644
index 000000000000..65b12a8ac05b
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/group/AbstractGroupTest.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.group;
+
+import jakarta.ws.rs.core.Response;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public abstract class AbstractGroupTest {
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectOAuthClient
+    OAuthClient oAuth;
+
+    AccessToken login(String username, String clientId, String clientSecret) {
+        AccessTokenResponse tokenResponse = oAuth.client(clientId, clientSecret).doPasswordGrantRequest(username, "password");
+        return oAuth.parseToken(tokenResponse.getAccessToken(), AccessToken.class);
+    }
+
+    String createGroup(ManagedRealm managedRealm, GroupRepresentation group) {
+        Response response = managedRealm.admin().groups().add(group);
+        String groupId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.groups().group(groupId).remove());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupPath(groupId), group, ResourceType.GROUP);
+
+        // Set ID to the original rep
+        group.setId(groupId);
+        return groupId;
+    }
+
+    void addSubGroup(ManagedRealm managedRealm, GroupRepresentation parent, GroupRepresentation child) {
+        Response response = managedRealm.admin().groups().add(child);
+        String childUuid = ApiUtil.getCreatedId(response);
+        child.setId(childUuid);
+        response = managedRealm.admin().groups().group(parent.getId()).subGroup(child);
+        response.close();
+    }
+
+    RoleRepresentation createRealmRole(ManagedRealm managedRealm, RoleRepresentation role) {
+        managedRealm.admin().roles().create(role);
+        RoleRepresentation created = managedRealm.admin().roles().get(role.getName()).toRepresentation();
+        String createdName = created.getName();
+        managedRealm.cleanup().add(r -> r.roles().deleteRole(createdName));
+        return created;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupAttributeSearchTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupAttributeSearchTest.java
new file mode 100644
index 000000000000..e90903ffaeef
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupAttributeSearchTest.java
@@ -0,0 +1,247 @@
+package org.keycloak.tests.admin.group;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.GroupResource;
+import org.keycloak.admin.client.resource.GroupsResource;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+
+@KeycloakIntegrationTest(config = GroupAttributeSearchTest.GroupSearchServerConfig.class)
+public class GroupAttributeSearchTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    private static final String GROUP1 = "group1";
+    private static final String GROUP2 = "group2";
+    private static final String GROUP3 = "group3";
+
+    private static final String PARENT_GROUP = "parentGroup";
+
+    private static final String CHILD_GROUP = "childGroup";
+
+    private static final String ATTR_ORG_NAME = "org";
+    private static final String ATTR_ORG_VAL = "Test_\"organisation\"";
+    private static final String ATTR_URL_NAME = "url";
+    private static final String ATTR_URL_VAL = "https://foo.bar/clflds";
+    private static final String ATTR_FILTERED_NAME = "filtered";
+    private static final String ATTR_FILTERED_VAL = "does_not_matter";
+
+    private static final String ATTR_QUOTES_NAME = "test \"123\"";
+
+    private static final String ATTR_QUOTES_NAME_ESCAPED = "\"test \\\"123\\\"\"";
+    private static final String ATTR_QUOTES_VAL = "field=\"blah blah\"";
+    private static final String ATTR_QUOTES_VAL_ESCAPED = "\"field=\\\"blah blah\\\"\"";
+
+    private GroupRepresentation group1;
+    private GroupRepresentation group2;
+    private GroupRepresentation group3;
+    private GroupRepresentation parentGroup;
+    private GroupRepresentation childGroup;
+    private GroupRepresentation secondChildGroup;
+
+    @BeforeEach
+    public void init() {
+        group1 = new GroupRepresentation();
+        group2 = new GroupRepresentation();
+        group3 = new GroupRepresentation();
+        parentGroup = new GroupRepresentation();
+        childGroup = new GroupRepresentation();
+        secondChildGroup = new GroupRepresentation();
+
+        group1.setAttributes(Map.of(
+                ATTR_ORG_NAME, List.of(ATTR_ORG_VAL),
+                ATTR_URL_NAME, List.of(ATTR_URL_VAL)
+        ));
+
+
+        group2.setAttributes(Map.of(
+                ATTR_FILTERED_NAME, List.of(ATTR_FILTERED_VAL),
+                ATTR_URL_NAME, List.of(ATTR_URL_VAL)
+        ));
+
+        group3.setAttributes(Map.of(
+                ATTR_ORG_NAME, List.of("fake group"),
+                ATTR_QUOTES_NAME, List.of(ATTR_QUOTES_VAL)
+        ));
+
+        parentGroup.setAttributes(Map.of(
+                ATTR_ORG_NAME, List.of("parentOrg")
+        ));
+
+        childGroup.setAttributes(Map.of(
+                ATTR_ORG_NAME, List.of("childOrg")
+        ));
+
+        group1.setName(GROUP1);
+        group2.setName(GROUP2);
+        group3.setName(GROUP3);
+        parentGroup.setName(PARENT_GROUP);
+        childGroup.setName(CHILD_GROUP);
+        secondChildGroup.setName(CHILD_GROUP + "2");
+    }
+
+    @Test
+    public void querySearch() {
+        createGroupWithCleanup(group1);
+        createGroupWithCleanup(group2);
+        createGroupWithCleanup(group3);
+
+        search(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL), GROUP1);
+        search(buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL), GROUP1, GROUP2);
+        search(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL, ATTR_URL_NAME, ATTR_URL_VAL), GROUP1);
+        search(buildSearchQuery(ATTR_ORG_NAME, "wrong val", ATTR_URL_NAME, ATTR_URL_VAL));
+        search(buildSearchQuery(ATTR_QUOTES_NAME_ESCAPED, ATTR_QUOTES_VAL_ESCAPED), GROUP3);
+
+        // "filtered" attribute won't take effect when JPA is used
+        search(buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL, ATTR_FILTERED_NAME, ATTR_FILTERED_VAL), GROUP1, GROUP2);
+    }
+
+    @Test
+    public void nestedGroupQuerySearch() {
+        String groupUuid = createGroupWithCleanup(parentGroup);
+        GroupResource parentGroupResource = managedRealm.admin().groups().group(groupUuid);
+        parentGroupResource.subGroup(childGroup);
+
+        // query for the child group by org name
+        GroupsResource search = managedRealm.admin().groups();
+        String searchQuery = buildSearchQuery(ATTR_ORG_NAME, "childOrg");
+        List<GroupRepresentation> found = search.query(searchQuery);
+
+        assertThat(found.size(), is(1));
+        assertThat(found.get(0).getName(), is(equalTo(PARENT_GROUP)));
+
+        List<GroupRepresentation> subGroups = found.get(0).getSubGroups();
+        assertThat(subGroups.size(), is(1));
+        assertThat(subGroups.get(0).getName(), is(equalTo(CHILD_GROUP)));
+    }
+
+    @Test
+    public void nestedGroupQuerySearchNoHierarchy() throws Exception {
+        String groupUuid = createGroupWithCleanup(parentGroup);
+        GroupResource parentGroupResource = managedRealm.admin().groups().group(groupUuid);
+        parentGroupResource.subGroup(childGroup);
+
+        GroupRepresentation testGroup = new GroupRepresentation();
+        testGroup.setName("test_child");
+        parentGroupResource.subGroup(testGroup);
+
+        // query for the child group by org name
+        GroupsResource search = managedRealm.admin().groups();
+        String searchQuery = buildSearchQuery(ATTR_ORG_NAME, "childOrg");
+        List<GroupRepresentation> found = search.query(searchQuery, false);
+
+        assertThat(found.size(), is(1));
+        assertThat(found.get(0).getName(), is(equalTo(CHILD_GROUP)));
+
+        String path = found.get(0).getPath();
+        assertThat(path, is(String.format("/%s/%s", PARENT_GROUP, CHILD_GROUP)));
+    }
+
+    @Test
+    public void queryPaging() {
+        createGroupWithCleanup(group1);
+        createGroupWithCleanup(group2);
+
+        String searchQuery = buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL);
+
+        List<GroupRepresentation> firstPage = managedRealm.admin().groups()
+                .query(searchQuery, true, 0, 1, true);
+        assertThat(firstPage, hasSize(1));
+        GroupRepresentation firstGroup = firstPage.get(0);
+        assertThat(firstGroup.getName(), is(equalTo(GROUP1)));
+
+        List<GroupRepresentation> secondPage = managedRealm.admin().groups()
+                .query(searchQuery, true, 1, 1, true);
+        assertThat(secondPage, hasSize(1));
+        GroupRepresentation secondGroup = secondPage.get(0);
+        assertThat(secondGroup.getName(), is(equalTo(GROUP2)));
+
+        List<GroupRepresentation> thirdPage = managedRealm.admin().groups()
+                .query(searchQuery, true, 2, 1, true);
+        assertThat(thirdPage, is(empty()));
+    }
+
+    @Test
+    public void queryFullRepresentation() {
+        createGroupWithCleanup(group1);
+        List<GroupRepresentation> found = managedRealm.admin().groups()
+                .query(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL), true, 0, 100, false);
+
+        assertThat(found, hasSize(1));
+        GroupRepresentation group = found.get(0);
+        assertThat(group.getName(), is(equalTo(GROUP1)));
+        // attributes are not contained in group representation, only in full representation
+        assertThat(group.getAttributes(), is(equalTo(group1.getAttributes())));
+    }
+
+    private String createGroupWithCleanup(GroupRepresentation rep) {
+        Response resp = managedRealm.admin().groups().add(rep);
+        String groupUuid = ApiUtil.getCreatedId(resp);
+        managedRealm.cleanup().add(r -> r.groups().group(groupUuid).remove());
+        return groupUuid;
+    }
+
+    private void search(String searchQuery, String... expectedGroupIds) {
+        GroupsResource search = managedRealm.admin().groups();
+        List<String> found = search.query(searchQuery).stream()
+                .map(GroupRepresentation::getName)
+                .collect(Collectors.toList());
+        assertThat(found, hasSize(expectedGroupIds.length));
+        assertThat(found, containsInAnyOrder(expectedGroupIds));
+    }
+
+    public static String buildSearchQuery(String firstAttrName, String firstAttrValue, String... furtherAttrKeysAndValues) {
+        if (furtherAttrKeysAndValues.length % 2 != 0) {
+            throw new IllegalArgumentException("Invalid length of furtherAttrKeysAndValues. Must be even, but is: " + furtherAttrKeysAndValues.length);
+        }
+
+        String keyValueSep = ":";
+        String attributesSep = " ";
+
+        StringBuilder sb = new StringBuilder();
+        sb.append(firstAttrName).append(keyValueSep).append(firstAttrValue);
+
+        if (furtherAttrKeysAndValues.length != 0) {
+            for (int i = 0; i < furtherAttrKeysAndValues.length; i++) {
+                if (i % 2 == 0) {
+                    sb.append(attributesSep);
+                } else {
+                    sb.append(keyValueSep);
+                }
+
+                sb.append(furtherAttrKeysAndValues[i]);
+            }
+        }
+
+        return sb.toString();
+    }
+
+    public static class GroupSearchServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.option("spi-group-jpa-searchable-attributes", String.join(",", ATTR_URL_NAME, ATTR_ORG_NAME, ATTR_QUOTES_NAME));
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupMappersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupMappersTest.java
new file mode 100644
index 000000000000..fe276f903173
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupMappersTest.java
@@ -0,0 +1,233 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.group;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.models.GroupProvider;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.ProtocolMapperUtils;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.GroupMembershipMapper;
+import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
+import org.keycloak.protocol.oidc.mappers.UserAttributeMapper;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.GroupConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.ProtocolMapperUtil;
+
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public class GroupMappersTest extends AbstractGroupTest {
+
+    @InjectRealm(config = GroupMappersTestRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    private static final String CLIENT_ID = "my-app";
+    private static final String CLIENT_SECRET = "password";
+    private static final String CLIENT_ROLE = "customer-user";
+    private static final String TOP_GROUP = "topGroup";
+    private static final String TOP_ATTRIBUTE = "topAttribute";
+    private static final String LEVEL_2_ATTRIBUTE = "level2Attribute";
+    private static final String LEVEL_2_GROUP = "level2group";
+    private static final String TOP_GROUP_USER = "topGroupUser";
+    private static final String LEVEL_2_GROUP_USER = "level2GroupUser";
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGroupMappers() {
+        {
+            UserRepresentation user = ApiUtil.findUserByUsername(managedRealm.admin(), TOP_GROUP_USER);
+
+            AccessToken token = login(user.getUsername(), CLIENT_ID, CLIENT_SECRET);
+            Assertions.assertTrue(token.getRealmAccess().getRoles().contains("user"));
+            Assertions.assertNotNull(token.getOtherClaims().get("groups"));
+            Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
+            MatcherAssert.assertThat(groups.get("groups"), Matchers.contains(TOP_GROUP));
+            Assertions.assertEquals("true", token.getOtherClaims().get(TOP_ATTRIBUTE));
+        }
+        {
+            UserRepresentation user = ApiUtil.findUserByUsername(managedRealm.admin(), LEVEL_2_GROUP_USER);
+
+            AccessToken token = login(user.getUsername(), CLIENT_ID, CLIENT_SECRET);
+            Assertions.assertTrue(token.getRealmAccess().getRoles().contains("user"));
+            Assertions.assertTrue(token.getRealmAccess().getRoles().contains("admin"));
+            Assertions.assertTrue(token.getResourceAccess(CLIENT_ID).getRoles().contains(CLIENT_ROLE));
+            Assertions.assertNotNull(token.getOtherClaims().get("groups"));
+            Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
+            MatcherAssert.assertThat(groups.get("groups"), Matchers.contains(LEVEL_2_GROUP));
+            Assertions.assertEquals("true", token.getOtherClaims().get(TOP_ATTRIBUTE));
+            Assertions.assertEquals("true", token.getOtherClaims().get(LEVEL_2_ATTRIBUTE));
+        }
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGroupMappersWithSlash() {
+        RealmResource realm = managedRealm.admin();
+        GroupRepresentation topGroup = realm.getGroupByPath("/" + TOP_GROUP);
+        Assertions.assertNotNull(topGroup);
+        GroupRepresentation childSlash = new GroupRepresentation();
+        childSlash.setName("child/slash");
+        Response response = realm.groups().group(topGroup.getId()).subGroup(childSlash);
+        childSlash.setId(ApiUtil.getCreatedId(response));
+
+        UserRepresentation user = ApiUtil.findUserByUsername(managedRealm.admin(), LEVEL_2_GROUP_USER);
+        realm.users().get(user.getId()).joinGroup(childSlash.getId());
+
+        ClientResource client = ApiUtil.findClientByClientId(realm, CLIENT_ID);
+        ProtocolMappersResource protocolMappers = client.getProtocolMappers();
+        ProtocolMapperRepresentation groupsMapper = ProtocolMapperUtil.getMapperByNameAndProtocol(
+                protocolMappers, OIDCLoginProtocol.LOGIN_PROTOCOL, "groups");
+        Assertions.assertNotNull(groupsMapper);
+        groupsMapper.getConfig().put("full.path", Boolean.TRUE.toString());
+        protocolMappers.update(groupsMapper.getId(), groupsMapper);
+
+        groupsMapper.getConfig().remove("full.path");
+        managedRealm.cleanup().add(r -> {
+            r.users().get(user.getId()).leaveGroup(childSlash.getId());
+            r.groups().group(childSlash.getId()).remove();
+            r.clients().get(client.toRepresentation().getId())
+                    .getProtocolMappers().update(groupsMapper.getId(), groupsMapper);
+        });
+
+        AccessToken token = login(user.getUsername(), CLIENT_ID, CLIENT_SECRET);
+        Assertions.assertNotNull(token.getOtherClaims().get("groups"));
+        Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
+        MatcherAssert.assertThat(groups.get("groups"), Matchers.containsInAnyOrder(
+                KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, TOP_GROUP, LEVEL_2_GROUP),
+                KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, TOP_GROUP, "child/slash")));
+    }
+
+    private static class GroupMappersTestRealmConfig implements RealmConfig {
+
+        private List<ProtocolMapperRepresentation> createMappers() {
+            List<ProtocolMapperRepresentation> mappers = new LinkedList<>();
+            ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
+            mapper.setName("groups");
+            mapper.setProtocolMapper(GroupMembershipMapper.PROVIDER_ID);
+            mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+            Map<String, String> config = new HashMap<>();
+            config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, "groups.groups");
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
+            mapper.setConfig(config);
+            mappers.add(mapper);
+
+            mapper = new ProtocolMapperRepresentation();
+            mapper.setName(TOP_ATTRIBUTE);
+            mapper.setProtocolMapper(UserAttributeMapper.PROVIDER_ID);
+            mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+            config = new HashMap<>();
+            config.put(ProtocolMapperUtils.USER_ATTRIBUTE, TOP_ATTRIBUTE);
+            config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, TOP_ATTRIBUTE);
+            config.put(OIDCAttributeMapperHelper.JSON_TYPE, ProviderConfigProperty.STRING_TYPE);
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
+            mapper.setConfig(config);
+            mappers.add(mapper);
+
+            mapper = new ProtocolMapperRepresentation();
+            mapper.setName(LEVEL_2_ATTRIBUTE);
+            mapper.setProtocolMapper(UserAttributeMapper.PROVIDER_ID);
+            mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+            config = new HashMap<>();
+            config.put(ProtocolMapperUtils.USER_ATTRIBUTE, LEVEL_2_ATTRIBUTE);
+            config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, LEVEL_2_ATTRIBUTE);
+            config.put(OIDCAttributeMapperHelper.JSON_TYPE, ProviderConfigProperty.STRING_TYPE);
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+            config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
+            mapper.setConfig(config);
+            mappers.add(mapper);
+            return mappers;
+        }
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            List<ProtocolMapperRepresentation> mappers = createMappers();
+
+            realm.addClient(CLIENT_ID)
+                    .enabled(true)
+                    .secret(CLIENT_SECRET)
+                    .directAccessGrants()
+                    .protocolMappers(mappers);
+
+            realm.eventsEnabled(true)
+                    .clientRoles(CLIENT_ID, CLIENT_ROLE);
+
+            GroupRepresentation subGroup = GroupConfigBuilder.create()
+                    .name(LEVEL_2_GROUP)
+                    .realmRoles("admin")
+                    .clientRoles(CLIENT_ID, CLIENT_ROLE)
+                    .attribute(LEVEL_2_ATTRIBUTE, "true")
+                    .build();
+
+
+            GroupRepresentation subGroup2 = GroupConfigBuilder.create()
+                    .name("level2group2")
+                    .realmRoles("admin")
+                    .clientRoles(CLIENT_ID, CLIENT_ROLE)
+                    .attribute(LEVEL_2_ATTRIBUTE, "true")
+                    .build();
+
+            realm.addGroup(TOP_GROUP)
+                    .attribute(TOP_ATTRIBUTE, "true")
+                    .realmRoles("user")
+                    .subGroups(subGroup, subGroup2);
+
+            realm.addUser(TOP_GROUP_USER)
+                    .name("John", "Doe")
+                    .enabled(true)
+                    .email("top@redhat.com")
+                    .password("password")
+                    .groups(TOP_GROUP);
+
+            realm.addUser(LEVEL_2_GROUP_USER)
+                    .name("Jane", "Doe")
+                    .enabled(true)
+                    .email("level2@redhat.com")
+                    .password("password")
+                    .groups("topGroup/level2group");
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupSearchTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupSearchTest.java
new file mode 100644
index 000000000000..61d5e426bd50
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupSearchTest.java
@@ -0,0 +1,427 @@
+package org.keycloak.tests.admin.group;
+
+import com.google.common.collect.Comparators;
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.GroupResource;
+import org.keycloak.admin.client.resource.GroupsResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.GroupProvider;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.realm.GroupConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.CoreMatchers.nullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.anEmptyMap;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest
+public class GroupSearchTest extends AbstractGroupTest {
+
+    @InjectRealm(config = GroupSearchTestRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    private static final String ATTR_ORG_NAME = "org";
+    private static final String ATTR_QUOTES_NAME = "test \"123\"";
+    private static final String ATTR_QUOTES_VAL = "field=\"blah blah\"";
+
+    @Test
+    public void querySubGroups() {
+        // create a parent group
+        GroupRepresentation parentGroup = GroupConfigBuilder.create()
+                .name("parentGroup")
+                .attribute(ATTR_ORG_NAME, "parentOrg")
+                .build();
+        String groupUuid = createGroup(managedRealm, parentGroup);
+        GroupResource parentGroupResource = managedRealm.admin().groups().group(groupUuid);
+
+        // create a subgroups in the parent
+        for (int i = 1; i <= 5; i++) {
+            GroupRepresentation testGroup = GroupConfigBuilder.create()
+                    .name("kcgroup-" + i)
+                    .attribute(ATTR_ORG_NAME, "kcgroup-" + i)
+                    .attribute(ATTR_QUOTES_NAME, ATTR_QUOTES_VAL)
+                    .build();
+            addSubGroup(managedRealm, parentGroup, testGroup);
+
+            if (i == 2) {
+                GroupRepresentation subGroup = GroupConfigBuilder.create()
+                        .name("kcsubgroup-" + i)
+                        .build();
+
+                addSubGroup(managedRealm, testGroup, subGroup);
+            }
+        }
+        for (int i = 1; i <= 3; i++) {
+            GroupRepresentation testGroup = GroupConfigBuilder.create()
+                    .name("testgroup-" + i)
+                    .build();
+            addSubGroup(managedRealm, parentGroup, testGroup);
+        }
+
+        // search for subgroups filtering by name - all groups with 'kc' in the name.
+        List<GroupRepresentation> subGroups = parentGroupResource.getSubGroups("kc", false, 0, 10, true);
+        assertThat(subGroups, hasSize(5));
+        for (int i = 1; i <= 5; i++) {
+            // subgroups should be ordered by name.
+            assertThat(subGroups.get(i - 1).getName(), is(equalTo("kcgroup-" + i)));
+            assertThat(subGroups.get(i - 1).getAttributes(), is(nullValue())); // brief rep - no attributes should be returned in subgroups.
+        }
+
+        // search for subgroups filtering by name - all groups with 'test' in the name.
+        subGroups = parentGroupResource.getSubGroups("test", false, 0, 10, true);
+        assertThat(subGroups, hasSize(3));
+        for (int i = 1; i <= 3; i++) {
+            assertThat(subGroups.get(i - 1).getName(), is(equalTo("testgroup-" + i)));
+        }
+
+        // search for subgroups filtering by name - all groups with 'gro' in the name.
+        subGroups = parentGroupResource.getSubGroups("gro", false, 0, 10, true);
+        assertThat(subGroups, hasSize(8));
+
+        // search using a string that matches none of the subgroups.
+        subGroups = parentGroupResource.getSubGroups("nonexistent", false, 0, 10, false);
+        assertThat(subGroups, is(empty()));
+
+        // exact search with full representation - only one subgroup should be returned.
+        subGroups = parentGroupResource.getSubGroups("kcgroup-2", true, 0, 10, false);
+        assertThat(subGroups, hasSize(1));
+        assertThat(subGroups.get(0).getName(), is(equalTo("kcgroup-2")));
+        assertThat(subGroups.get(0).getSubGroupCount(), is(1L));
+        // attributes should be present in the returned subgroup.
+        Map<String, List<String>> attributes = subGroups.get(0).getAttributes();
+        assertThat(attributes, not(anEmptyMap()));
+        assertThat(attributes.keySet(), hasSize(2));
+        assertThat(attributes.keySet(), containsInAnyOrder(ATTR_ORG_NAME, ATTR_QUOTES_NAME));
+
+        subGroups = parentGroupResource.getSubGroups("kcgroup-2", true, 0, 10, false, false);
+        assertThat(subGroups, hasSize(1));
+        assertThat(subGroups.get(0).getName(), is(equalTo("kcgroup-2")));
+        assertThat(subGroups.get(0).getSubGroupCount(), is(nullValue()));
+
+        subGroups = managedRealm.admin().groups().groups("kcgroup-2", true, 0, 1, true);
+        Assertions.assertEquals(1, subGroups.size());
+        assertThat(subGroups.get(0).getName(), is(equalTo(parentGroup.getName())));
+        Assertions.assertEquals(1, subGroups.get(0).getSubGroups().size());
+        assertThat(subGroups.get(0).getSubGroups().get(0).getName(), is(equalTo("kcgroup-2")));
+        assertThat(subGroups.get(0).getSubGroups().get(0).getSubGroupCount(), is(1L));
+
+        subGroups = managedRealm.admin().groups().groups("kcgroup-2", true, 0, 1, true, false);
+        Assertions.assertEquals(1, subGroups.size());
+        assertThat(subGroups.get(0).getName(), is(equalTo(parentGroup.getName())));
+        Assertions.assertEquals(1, subGroups.get(0).getSubGroups().size());
+        assertThat(subGroups.get(0).getSubGroups().get(0).getName(), is(equalTo("kcgroup-2")));
+        assertThat(subGroups.get(0).getSubGroups().get(0).getSubGroupCount(), is(nullValue()));
+    }
+
+    /**
+     * Groups search with query returns unwanted groups
+     *
+     * @link https://issues.redhat.com/browse/KEYCLOAK-18380
+     */
+    @Test
+    public void searchForGroupsShouldOnlyReturnMatchingElementsOrIntermediatePaths() {
+
+        /*
+         * /g1/g1.1-gugu
+         * /g1/g1.2-test1234
+         * /g2-test1234
+         * /g3/g3.1-test1234/g3.1.1
+         */
+        String needle = "test1234";
+        GroupRepresentation g1 = GroupConfigBuilder.create().name("g1").build();
+        GroupRepresentation g1_1 = GroupConfigBuilder.create().name("g1.1-bubu").build();
+        GroupRepresentation g1_2 = GroupConfigBuilder.create().name("g1.2-" + needle).build();
+        GroupRepresentation g2 = GroupConfigBuilder.create().name("g2-" + needle).build();
+        GroupRepresentation g3 = GroupConfigBuilder.create().name("g3").build();
+        GroupRepresentation g3_1 = GroupConfigBuilder.create().name("g3.1-" + needle).build();
+        GroupRepresentation g3_1_1 = GroupConfigBuilder.create().name("g3.1.1").build();
+
+        createGroup(managedRealm, g1);
+        createGroup(managedRealm, g2);
+        createGroup(managedRealm, g3);
+        addSubGroup(managedRealm, g1, g1_1);
+        addSubGroup(managedRealm, g1, g1_2);
+        addSubGroup(managedRealm, g3, g3_1);
+        addSubGroup(managedRealm, g3_1, g3_1_1);
+
+        RealmResource realm = managedRealm.admin();
+        // we search for "test1234" and expect only /g1/g1.2-test1234, /g2-test1234 and /g3/g3.1-test1234 as a result
+        List<GroupRepresentation> result = realm.groups().groups(needle, 0, 100);
+
+        assertEquals(3, result.size());
+        assertEquals("g1", result.get(0).getName());
+        assertEquals(1, result.get(0).getSubGroups().size());
+        assertEquals("g1.2-" + needle, result.get(0).getSubGroups().get(0).getName());
+        assertEquals("g2-" + needle, result.get(1).getName());
+        assertEquals("g3", result.get(2).getName());
+        assertEquals(1, result.get(2).getSubGroups().size());
+        assertEquals("g3.1-" + needle, result.get(2).getSubGroups().get(0).getName());
+    }
+
+    @Test
+    public void searchGroupsByName() {
+        createGroup(managedRealm, GroupConfigBuilder.create().name("group-name-1").build());
+        createGroup(managedRealm, GroupConfigBuilder.create().name("group-name-2").build());
+
+        GroupsResource groupsResource = managedRealm.admin().groups();
+        List<GroupRepresentation> groups;
+
+        // Search containing name success
+        groups = groupsResource.groups("group-name", false, 0, 20, false);
+        assertEquals(2, groups.size());
+        // Search exact name success
+        groups = groupsResource.groups("group-name-1", true, 0, 20, false);
+        assertEquals(1, groups.size());
+        // Search exact name failure
+        groups = groupsResource.groups("group-name", true, 0, 20, false);
+        assertTrue(groups.isEmpty());
+    }
+
+    @Test
+    public void searchAndCountGroups() {
+        String firstGroupId = "";
+
+        RealmResource realm = managedRealm.admin();
+
+        // Add 20 new groups with known names
+        for (int i = 0; i < 20; i++) {
+            String groupId = createGroup(managedRealm, GroupConfigBuilder.create().name("group" + i).build());
+            if (i == 0) {
+                firstGroupId = groupId;
+            }
+        }
+
+        // Get groups by search and pagination
+        List<GroupRepresentation> allGroups = realm.groups().groups();
+        assertEquals(20, allGroups.size());
+
+        List<GroupRepresentation> slice = realm.groups().groups(0, 7);
+        assertEquals(7, slice.size());
+
+        slice = realm.groups().groups(null, 7);
+        assertEquals(7, slice.size());
+
+        slice = realm.groups().groups(10, null);
+        assertEquals(10, slice.size());
+
+        slice = realm.groups().groups(5, 7);
+        assertEquals(7, slice.size());
+
+        slice = realm.groups().groups(15, 7);
+        assertEquals(5, slice.size());
+
+        List<GroupRepresentation> search = realm.groups().groups("group1", 0, 20);
+        assertEquals(11, search.size());
+        for (GroupRepresentation group : search) {
+            assertTrue(group.getName().contains("group1"));
+        }
+
+        List<GroupRepresentation> noResultSearch = realm.groups().groups("abcd", 0, 20);
+        assertEquals(0, noResultSearch.size());
+
+        // Count
+        assertEquals(Long.valueOf(allGroups.size()), realm.groups().count().get("count"));
+        assertEquals(Long.valueOf(search.size()), realm.groups().count("group1").get("count"));
+        assertEquals(Long.valueOf(noResultSearch.size()), realm.groups().count("abcd").get("count"));
+
+        // Add a subgroup for onlyTopLevel flag testing
+        GroupRepresentation level2Group = new GroupRepresentation();
+        level2Group.setName("group1111");
+        Response response = realm.groups().group(firstGroupId).subGroup(level2Group);
+        response.close();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(firstGroupId), level2Group, ResourceType.GROUP);
+
+        assertEquals(Long.valueOf(allGroups.size()), realm.groups().count(true).get("count"));
+        assertEquals(Long.valueOf(allGroups.size() + 1), realm.groups().count(false).get("count"));
+        //add another subgroup
+        GroupRepresentation level2Group2 = new GroupRepresentation();
+        level2Group2.setName("group111111");
+        realm.groups().group(firstGroupId).subGroup(level2Group2);
+        //search and count for group with string group11 -> return 2 top level group, group11 and group0 having subgroups group1111 and group111111
+        search = realm.groups().groups("group11", 0, 10);
+        assertEquals(2, search.size());
+        GroupRepresentation group0 = search.stream().filter(group -> "group0".equals(group.getName())).findAny().orElseGet(null);
+        assertNotNull(group0);
+        assertEquals(2, group0.getSubGroups().size());
+        assertThat(group0.getSubGroups().stream().map(GroupRepresentation::getName).collect(Collectors.toList()), Matchers.containsInAnyOrder("group1111", "group111111"));
+        assertEquals(countLeafGroups(search), realm.groups().count("group11").get("count"));
+    }
+
+    private Long countLeafGroups(List<GroupRepresentation> search) {
+        long counter = 0;
+        for (GroupRepresentation group : search) {
+            if (group.getSubGroups().isEmpty()) {
+                counter += 1;
+                continue;
+            }
+            counter += countLeafGroups(group.getSubGroups());
+        }
+        return counter;
+    }
+
+    @Test
+    public void orderGroupsByName() {
+        // Create two pages worth of groups in a random order
+        List<GroupRepresentation> testGroups = new ArrayList<>();
+        for (int i = 0; i < 40; i++) {
+            GroupRepresentation group = new GroupRepresentation();
+            group.setName("group" + i);
+            testGroups.add(group);
+        }
+
+        Collections.shuffle(testGroups);
+
+        for (GroupRepresentation group : testGroups) {
+            createGroup(managedRealm, group);
+        }
+
+        // Groups should be ordered by name
+        Comparator<GroupRepresentation> compareByName = Comparator.comparing(GroupRepresentation::getName);
+
+        GroupsResource groups = managedRealm.admin().groups();
+        // Assert that all groups are returned in order
+        List<GroupRepresentation> allGroups = groups.groups(0, 100);
+        assertEquals(40, allGroups.size());
+        assertTrue(Comparators.isInStrictOrder(allGroups, compareByName));
+
+        // Assert that pagination results are returned in order
+        List<GroupRepresentation> firstPage = groups.groups(0, 20);
+        assertEquals(20, firstPage.size());
+        assertTrue(Comparators.isInStrictOrder(firstPage, compareByName));
+
+        List<GroupRepresentation> secondPage = groups.groups(20, 20);
+        assertEquals(20, secondPage.size());
+        assertTrue(Comparators.isInStrictOrder(secondPage, compareByName));
+
+        // Check that the ordering of groups across multiple pages is correct
+        // Since the individual pages are ordered it is sufficient to compare the
+        // last group from the first page to the first group of the second page
+        GroupRepresentation lastGroupOnFirstPage = firstPage.get(firstPage.size() - 1);
+        GroupRepresentation firstGroupOnSecondPage = secondPage.get(0);
+        assertTrue(compareByName.compare(lastGroupOnFirstPage, firstGroupOnSecondPage) < 0);
+    }
+
+    /**
+     * Verifies that the group search works the same across group provider implementations for hierarchies
+     *
+     * @link https://issues.jboss.org/browse/KEYCLOAK-18390
+     */
+    @Test
+    public void searchGroupsOnGroupHierarchies() {
+        final RealmResource realm = managedRealm.admin();
+
+        final String searchFor = UUID.randomUUID().toString();
+
+        final GroupRepresentation g1 = new GroupRepresentation();
+        g1.setName("g1");
+        final GroupRepresentation g1_1 = new GroupRepresentation();
+        g1_1.setName("g1.1-" + searchFor);
+
+        String g1Id = createGroup(managedRealm, g1);
+        addSubGroup(managedRealm, g1, g1_1);
+
+        final List<GroupRepresentation> searchResultGroups = realm.groups().groups(searchFor, 0, 10);
+
+        assertFalse(searchResultGroups.isEmpty());
+        assertEquals(g1Id, searchResultGroups.get(0).getId());
+        assertEquals(g1.getName(), searchResultGroups.get(0).getName());
+
+        List<GroupRepresentation> searchResultSubGroups = searchResultGroups.get(0).getSubGroups();
+        assertEquals(g1_1.getId(), searchResultSubGroups.get(0).getId());
+        assertEquals(g1_1.getName(), searchResultSubGroups.get(0).getName());
+    }
+
+    public void testParentAndChildGroup(String parentName, String childName) {
+        RealmResource realm = managedRealm.admin();
+        GroupRepresentation parentGroup = new GroupRepresentation();
+        parentGroup.setName(parentName);
+        createGroup(managedRealm, parentGroup);
+        GroupRepresentation childGroup = new GroupRepresentation();
+        childGroup.setName(childName);
+        Response response = realm.groups().group(parentGroup.getId()).subGroup(childGroup);
+        childGroup.setId(ApiUtil.getCreatedId(response));
+
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.groupSubgroupsPath(parentGroup.getId()))
+                .representation(childGroup)
+                .resourceType(ResourceType.GROUP);
+
+        List<GroupRepresentation> groupsFound = realm.groups().groups(parentGroup.getName(), true, 0, 1, true);
+        Assertions.assertEquals(1, groupsFound.size());
+        Assertions.assertEquals(parentGroup.getId(), groupsFound.get(0).getId());
+        parentGroup = groupsFound.get(0);
+        Assertions.assertEquals(0, parentGroup.getSubGroups().size());
+        Assertions.assertEquals(KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, parentName),
+                parentGroup.getPath());
+
+        groupsFound = realm.groups().groups(childGroup.getName(), true, 0, 1, true);
+        Assertions.assertEquals(1, groupsFound.size());
+        Assertions.assertEquals(parentGroup.getId(), groupsFound.get(0).getId());
+        Assertions.assertEquals(1, groupsFound.get(0).getSubGroups().size());
+        Assertions.assertEquals(childGroup.getId(), groupsFound.get(0).getSubGroups().get(0).getId());
+        childGroup = groupsFound.get(0).getSubGroups().get(0);
+        Assertions.assertEquals(KeycloakModelUtils.normalizeGroupPath(
+                        KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, parentName, childName)),
+                childGroup.getPath());
+
+        GroupRepresentation groupFound = realm.getGroupByPath(parentGroup.getPath());
+        Assertions.assertNotNull(groupFound);
+        Assertions.assertEquals(parentGroup.getId(), groupFound.getId());
+        groupFound = realm.getGroupByPath(childGroup.getPath());
+        Assertions.assertNotNull(groupFound);
+        Assertions.assertEquals(childGroup.getId(), groupFound.getId());
+
+        realm.groups().group(childGroup.getId()).remove();
+    }
+
+    @Test
+    public void testGroupsWithSpaces() {
+        testParentAndChildGroup("parent space", "child space");
+    }
+
+    @Test
+    public void testGroupsWithSlashes() {
+        testParentAndChildGroup("parent/slash", "child/slash");
+    }
+
+    private static class GroupSearchTestRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            return realm.eventsEnabled(true);
+        }
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java
new file mode 100755
index 000000000000..92d5ec172cee
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/group/GroupTest.java
@@ -0,0 +1,988 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.group;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.hamcrest.Matchers;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.GroupResource;
+import org.keycloak.admin.client.resource.GroupsResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.RoleMappingResource;
+import org.keycloak.admin.client.resource.UserProfileResource;
+import org.keycloak.admin.client.resource.UsersResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.Constants;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.MappingsRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.userprofile.config.UPConfig;
+import org.keycloak.testframework.annotations.InjectAdminClient;
+import org.keycloak.testframework.annotations.InjectHttpClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.GroupConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.util.RoleBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.stream.IntStream;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.anEmptyMap;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasEntry;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
+ */
+@KeycloakIntegrationTest
+public class GroupTest extends AbstractGroupTest {
+
+    @InjectRealm(config = GroupTestRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    @InjectAdminClient
+    Keycloak adminClient;
+
+    @InjectHttpClient
+    CloseableHttpClient httpClient;
+
+    
+    @Test
+    public void createMultiDeleteMultiReadMulti() {
+        // create multiple groups
+        List<String> groupUuuids = new ArrayList<>();
+        IntStream.range(0, 100).forEach(groupIndex -> {
+            GroupRepresentation group = new GroupRepresentation();
+            group.setName("Test Group " + groupIndex);
+            try (Response response = managedRealm.admin().groups().add(group)) {
+                boolean created = response.getStatusInfo().getFamily() == Response.Status.Family.SUCCESSFUL;
+                if (created) {
+                    final String groupUuid = ApiUtil.getCreatedId(response);
+                    groupUuuids.add(groupUuid);
+                } else {
+                    fail("Failed to create group: " + response.getStatusInfo().getReasonPhrase());
+                }
+            }
+        });
+
+        AtomicBoolean deletedAll = new AtomicBoolean(false);
+        List<Exception> caughtExceptions = new CopyOnWriteArrayList<>();
+        // read groups in a separate thread
+        new Thread(() -> {
+            while (!deletedAll.get()) {
+                try {
+                    // just loading briefs
+                    managedRealm.admin().groups().groups(null, 0, Integer.MAX_VALUE, true);
+                } catch (Exception e) {
+
+                    caughtExceptions.add(e);
+                }
+            }
+        }).start();
+
+        // delete groups
+        groupUuuids.forEach(groupUuid -> {
+            managedRealm.admin().groups().group(groupUuid).remove();
+        });
+        deletedAll.set(true);
+
+        assertThat(caughtExceptions, Matchers.empty());
+    }
+
+    // KEYCLOAK-2716 Can't delete client if its role is assigned to a group
+    @Test
+    public void testClientRemoveWithClientRoleGroupMapping() {
+        RealmResource realm = managedRealm.admin();
+        ClientRepresentation client = ClientConfigBuilder.create()
+                .clientId("foo")
+                .rootUrl("http://foo")
+                .protocol("openid-connect")
+                .build();
+        Response response = managedRealm.admin().clients().create(client);
+        String clientUuid = ApiUtil.getCreatedId(response);
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.clientResourcePath(clientUuid))
+                .representation(client)
+                .resourceType(ResourceType.CLIENT);
+        client = realm.clients().findByClientId("foo").get(0);
+
+        RoleRepresentation role = RoleBuilder.create().name("foo-role").build();
+        realm.clients().get(client.getId()).roles().create(role);
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.clientRoleResourcePath(clientUuid, "foo-role"))
+                .representation(role)
+                .resourceType(ResourceType.CLIENT_ROLE);
+        role = realm.clients().get(clientUuid).roles().get("foo-role").toRepresentation();
+
+        GroupRepresentation group = GroupConfigBuilder.create().name("2716").build();
+        createGroup(managedRealm, group);
+
+        List<RoleRepresentation> list = new LinkedList<>();
+        list.add(role);
+        realm.groups().group(group.getId()).roles().clientLevel(client.getId()).add(list);
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.CREATE)
+                .resourcePath(AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientUuid))
+                .representation(list)
+                .resourceType(ResourceType.CLIENT_ROLE_MAPPING);
+
+        realm.clients().get(client.getId()).remove();
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.DELETE)
+                .resourcePath(AdminEventPaths.clientResourcePath(clientUuid))
+                .resourceType(ResourceType.CLIENT);
+    }
+
+    @Test
+    // KEYCLOAK-16888 Error messages for groups with same name in the same level
+    public void doNotAllowSameGroupNameAtSameLevel() {
+        RealmResource realm = managedRealm.admin();
+
+        GroupRepresentation topGroup = new GroupRepresentation();
+        topGroup.setName("top");
+        createGroup(managedRealm, topGroup);
+
+        GroupRepresentation anotherTopGroup = new GroupRepresentation();
+        anotherTopGroup.setName("top");
+        Response response = realm.groups().add(anotherTopGroup);
+        assertSameNameNotAllowed(response, "Top level group named 'top' already exists.");
+        response.close();
+
+        // allow moving the group to top level (nothing is done)
+        response = realm.groups().add(topGroup);
+        assertEquals(Response.Status.NO_CONTENT, response.getStatusInfo());
+        response.close();
+
+        GroupRepresentation level2Group = new GroupRepresentation();
+        level2Group.setName("level2");
+        response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
+        level2Group.setId(ApiUtil.getCreatedId(response));
+        response.close();
+
+        GroupRepresentation anotherlevel2Group = new GroupRepresentation();
+        anotherlevel2Group.setName("level2");
+        response = realm.groups().group(topGroup.getId()).subGroup(anotherlevel2Group);
+        assertSameNameNotAllowed(response, "Sibling group named 'level2' already exists.");
+        response.close();
+
+        // allow moving the group to the same parent (nothing is done)
+        response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
+        assertEquals(Response.Status.NO_CONTENT, response.getStatusInfo());
+        response.close();
+    }
+
+    @Test
+    // KEYCLOAK-11412 Unintended Groups with same names
+    public void doNotAllowSameGroupNameAtSameLevelWhenUpdatingName() {
+        RealmResource realm = managedRealm.admin();
+
+        GroupRepresentation topGroup1 = GroupConfigBuilder.create().name("top1").build();
+        createGroup(managedRealm, topGroup1);
+
+        GroupRepresentation topGroup2 = GroupConfigBuilder.create().name("top2").build();
+        createGroup(managedRealm, topGroup2);
+
+        topGroup2.setName("top1");
+
+        // conflict status 409 - same name not allowed
+        ClientErrorException ex1 = Assertions.assertThrows(ClientErrorException.class, () -> realm.groups().group(topGroup2.getId()).update(topGroup2));
+        assertSameNameNotAllowed(ex1.getResponse(), "Sibling group named 'top1' already exists.");
+
+
+        GroupRepresentation level2Group = new GroupRepresentation();
+        level2Group.setName("level2-1");
+        addSubGroup(managedRealm, topGroup1, level2Group);
+
+        GroupRepresentation anotherlevel2Group = new GroupRepresentation();
+        anotherlevel2Group.setName("level2-2");
+        addSubGroup(managedRealm, topGroup1, anotherlevel2Group);
+
+        anotherlevel2Group.setName("level2-1");
+
+        // conflict status 409 - same name not allowed
+        ClientErrorException ex2 = Assertions.assertThrows(ClientErrorException.class, () -> realm.groups().group(anotherlevel2Group.getId()).update(anotherlevel2Group));
+        assertSameNameNotAllowed(ex2.getResponse(), "Sibling group named 'level2-1' already exists.");
+
+    }
+
+    @Test
+    public void allowSameGroupNameAtDifferentLevel() {
+        RealmResource realm = managedRealm.admin();
+
+        // creating "/test-group"
+        GroupRepresentation topGroup = new GroupRepresentation();
+        topGroup.setName("test-group");
+        createGroup(managedRealm, topGroup);
+
+        // creating "/test-group/test-group"
+        GroupRepresentation childGroup = new GroupRepresentation();
+        childGroup.setName("test-group");
+        try (Response response = realm.groups().group(topGroup.getId()).subGroup(childGroup)) {
+            assertEquals(201, response.getStatus());
+        }
+
+        assertNotNull(realm.getGroupByPath("/test-group/test-group"));
+    }
+
+    @Test
+    public void doNotAllowSameGroupNameAtTopLevel() {
+        // creating "/test-group"
+        GroupRepresentation topGroup = new GroupRepresentation();
+        topGroup.setName("test-group");
+        createGroup(managedRealm, topGroup);
+
+        GroupRepresentation group2 = new GroupRepresentation();
+        group2.setName("test-group");
+        try (Response response = managedRealm.admin().groups().add(group2)) {
+            assertEquals(Status.CONFLICT.getStatusCode(), response.getStatus());
+        }
+    }
+
+    @Test
+    public void doNotAllowSameGroupNameAtTopLevelInDatabase() {
+        String realmName = managedRealm.getName();
+        final String id = runOnServer.fetch(session -> {
+            RealmModel realm = session.realms().getRealmByName(realmName);
+            GroupModel g = realm.createGroup("test-group");
+            return g.getId();
+        }, String.class);
+        managedRealm.cleanup().add(r -> r.groups().group(id).remove());
+        // unique key should work even in top groups
+        runOnServer.run(session -> {
+            RealmModel realm = session.realms().getRealmByName(realmName);
+            Assertions.assertThrows(
+                    ModelDuplicateException.class,
+                    () -> realm.createGroup("test-group")
+            );
+        });
+    }
+
+
+    // KEYCLOAK-17581 Empty group names are not rejected by Admin API
+    @Test
+    public void createGroupWithEmptyNameShouldFail() {
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("");
+        try (Response response = managedRealm.admin().groups().add(group)) {
+            assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+        }
+
+        group.setName(null);
+        try (Response response = managedRealm.admin().groups().add(group)) {
+            assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+        }
+    }
+
+    // KEYCLOAK-17581 Empty group names are not rejected by Admin API
+    @Test
+    public void updatingGroupWithEmptyNameShouldFail() {
+        RealmResource realm = managedRealm.admin();
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("groupWithName");
+
+        Response response = realm.groups().add(group);
+        String groupId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.groups().group(groupId).remove());
+
+        group.setName("");
+        Assertions.assertThrows(BadRequestException.class,
+                () -> realm.groups().group(groupId).update(group),
+                "Updating a group with empty name should fail"
+        );
+
+        group.setName(null);
+        Assertions.assertThrows(BadRequestException.class,
+                () -> realm.groups().group(groupId).update(group),
+                "Updating a group with null name should fail"
+        );
+    }
+
+    @Test
+    public void createAndTestGroups() throws IOException {
+        RoleRepresentation topRole = createRealmRole(managedRealm, RoleBuilder.create().name("topRole").build());
+        RoleRepresentation level2Role = createRealmRole(managedRealm, RoleBuilder.create().name("level2Role").build());
+        RoleRepresentation level3Role = createRealmRole(managedRealm, RoleBuilder.create().name("level3Role").build());
+
+        // Role events tested elsewhere
+        adminEvents.skipAll();
+        RealmResource realm = managedRealm.admin();
+
+        GroupRepresentation topGroup = new GroupRepresentation();
+        topGroup.setName("top");
+        String topGroupId = ApiUtil.getCreatedId(realm.groups().add(topGroup));
+        topGroup.setId(topGroupId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupPath(topGroupId), topGroup, ResourceType.GROUP);
+
+        List<RoleRepresentation> roles = new LinkedList<>(List.of(topRole));
+        realm.groups().group(topGroup.getId()).roles().realmLevel().add(roles);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(topGroup.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
+
+        GroupRepresentation level2Group = new GroupRepresentation();
+        level2Group.setName("level2");
+        Response response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(topGroup.getId()), level2Group, ResourceType.GROUP);
+        URI location = response.getLocation();
+        final String level2Id = ApiUtil.getCreatedId(response);
+
+        final GroupRepresentation level2GroupById = realm.groups().group(level2Id).toRepresentation();
+        assertEquals(level2Id, level2GroupById.getId());
+        assertEquals(level2Group.getName(), level2GroupById.getName());
+
+        HttpGet httpGet = new HttpGet(location);
+        httpGet.setHeader("Authorization", "Bearer " + adminClient.tokenManager().getAccessTokenString());
+
+        CloseableHttpResponse getResponse = httpClient.execute(httpGet);
+        assertEquals(200, getResponse.getStatusLine().getStatusCode());
+        GroupRepresentation level2 = JsonSerialization.readValue(getResponse.getEntity().getContent(), GroupRepresentation.class);
+        getResponse.close();
+        assertEquals(level2Id, level2.getId());
+
+        level2Group = realm.getGroupByPath("/top/level2");
+        assertNotNull(level2Group);
+        roles.clear();
+        roles.add(level2Role);
+        realm.groups().group(level2Group.getId()).roles().realmLevel().add(roles);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(level2Group.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
+
+        GroupRepresentation level3Group = new GroupRepresentation();
+        level3Group.setName("level3");
+        response = realm.groups().group(level2Group.getId()).subGroup(level3Group);
+        response.close();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(level2Group.getId()), level3Group, ResourceType.GROUP);
+
+        level3Group = realm.getGroupByPath("/top/level2/level3");
+        assertNotNull(level3Group);
+        roles.clear();
+        roles.add(level3Role);
+        realm.groups().group(level3Group.getId()).roles().realmLevel().add(roles);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(level3Group.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
+
+        topGroup = realm.getGroupByPath("/top");
+        assertEquals(1, topGroup.getRealmRoles().size());
+        assertTrue(topGroup.getRealmRoles().contains("topRole"));
+        assertEquals(1, realm.groups().group(topGroup.getId()).getSubGroups(0, null, false).size());
+
+        level2Group = realm.getGroupByPath("/top/level2");
+        assertEquals("level2", level2Group.getName());
+        assertEquals(1, level2Group.getRealmRoles().size());
+        assertTrue(level2Group.getRealmRoles().contains("level2Role"));
+        assertEquals(1, realm.groups().group(level2Group.getId()).getSubGroups(0, null, false).size());
+
+        level3Group = realm.getGroupByPath("/top/level2/level3");
+        assertEquals("level3", level3Group.getName());
+        assertEquals(1, level3Group.getRealmRoles().size());
+        assertTrue(level3Group.getRealmRoles().contains("level3Role"));
+
+        UserRepresentation user = realm.users().search("direct-login", -1, -1).get(0);
+        realm.users().get(user.getId()).joinGroup(level3Group.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userGroupPath(user.getId(), level3Group.getId()), ResourceType.GROUP_MEMBERSHIP);
+
+        List<GroupRepresentation> membership = realm.users().get(user.getId()).groups();
+        assertEquals(1, membership.size());
+        assertEquals("level3", membership.get(0).getName());
+
+        AccessToken token = login("direct-login", "resource-owner", "secret");
+        assertTrue(token.getRealmAccess().getRoles().contains("topRole"));
+        assertTrue(token.getRealmAccess().getRoles().contains("level2Role"));
+        assertTrue(token.getRealmAccess().getRoles().contains("level3Role"));
+
+        realm.addDefaultGroup(level3Group.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.defaultGroupPath(level3Group.getId()), ResourceType.GROUP);
+
+        List<GroupRepresentation> defaultGroups = realm.getDefaultGroups();
+        assertEquals(1, defaultGroups.size());
+        assertEquals(defaultGroups.get(0).getId(), level3Group.getId());
+
+        UserRepresentation newUser = UserConfigBuilder.create()
+                .username("groupUser")
+                .email("group@group.com")
+                .build();
+        response = realm.users().create(newUser);
+        String userId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.users().get(userId).remove());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userResourcePath(userId), newUser, ResourceType.USER);
+
+        membership = realm.users().get(userId).groups();
+        assertEquals(1, membership.size());
+        assertEquals("level3", membership.get(0).getName());
+
+        realm.removeDefaultGroup(level3Group.getId());
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.defaultGroupPath(level3Group.getId()), ResourceType.GROUP);
+
+        defaultGroups = realm.getDefaultGroups();
+        assertEquals(0, defaultGroups.size());
+
+        realm.groups().group(topGroup.getId()).remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.groupPath(topGroup.getId()), ResourceType.GROUP);
+
+        Assertions.assertThrows(
+                NotFoundException.class,
+                () -> realm.getGroupByPath("/top/level2/level3"),
+                "Group should not have been found"
+        );
+
+        Assertions.assertThrows(
+                NotFoundException.class,
+                () -> realm.getGroupByPath("/top/level2"),
+                "Group should not have been found"
+        );
+
+        Assertions.assertThrows(
+                NotFoundException.class,
+                () -> realm.getGroupByPath("/top"),
+                "Group should not have been found"
+        );
+
+        assertNull(login("direct-login", "resource-owner", "secret").getRealmAccess());
+    }
+
+    @Test
+    public void updateGroup() {
+        RealmResource realm = managedRealm.admin();
+        final String groupName = "group-" + UUID.randomUUID();
+
+        GroupRepresentation group = GroupConfigBuilder.create()
+                .name(groupName)
+                .attribute("attr1", "attrval1")
+                .attribute("attr2", "attrval2")
+                .build();
+        createGroup(managedRealm, group);
+        group = realm.getGroupByPath("/" + groupName);
+
+        assertNotNull(group);
+        assertThat(group.getName(), is(groupName));
+        assertThat(group.getAttributes().keySet(), containsInAnyOrder("attr1", "attr2"));
+        assertThat(group.getAttributes(), hasEntry(is("attr1"), contains("attrval1")));
+        assertThat(group.getAttributes(), hasEntry(is("attr2"), contains("attrval2")));
+
+        final String groupNewName = "group-" + UUID.randomUUID();
+        group.setName(groupNewName);
+
+        group.getAttributes().remove("attr1");
+        group.getAttributes().get("attr2").add("attrval2-2");
+        group.getAttributes().put("attr3", List.of("attrval2"));
+
+        realm.groups().group(group.getId()).update(group);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.groupPath(group.getId()), group, ResourceType.GROUP);
+
+        group = realm.getGroupByPath("/" + groupNewName);
+
+        assertThat(group.getName(), is(groupNewName));
+        assertThat(group.getAttributes().keySet(), containsInAnyOrder("attr2", "attr3"));
+        assertThat(group.getAttributes(), hasEntry(is("attr2"), containsInAnyOrder("attrval2", "attrval2-2")));
+        assertThat(group.getAttributes(), hasEntry(is("attr3"), contains("attrval2")));
+    }
+
+    @Test
+    public void moveGroups() {
+        RealmResource realm = managedRealm.admin();
+
+        // Create 2 top level groups "mygroup1" and "mygroup2"
+        GroupRepresentation group1 = GroupConfigBuilder.create()
+                .name("mygroup1")
+                .build();
+        createGroup(managedRealm, group1);
+
+        GroupRepresentation group2 = GroupConfigBuilder.create()
+                .name("mygroup2")
+                .build();
+        createGroup(managedRealm, group2);
+
+        // Move "mygroup2" as child of "mygroup1" . Assert it was moved
+        Response response = realm.groups().group(group1.getId()).subGroup(group2);
+        assertEquals(204, response.getStatus());
+        response.close();
+
+        // Assert "mygroup2" was moved
+        List<GroupRepresentation> group1Children = realm.groups().group(group1.getId()).getSubGroups(0, 10, false);
+
+        Assert.assertNames(group1Children, "mygroup2");
+        assertEquals("/mygroup1/mygroup2", realm.groups().group(group2.getId()).toRepresentation().getPath());
+
+        // Create top level group with the same name
+        GroupRepresentation group3 = GroupConfigBuilder.create()
+                .name("mygroup2")
+                .build();
+        response = managedRealm.admin().groups().add(group3);
+        String group3Id = ApiUtil.getCreatedId(response);
+        group3.setId(group3Id);
+        // Try to move top level "mygroup2" as child of "mygroup1". It should fail as there is already a child group
+        // of "mygroup1" with name "mygroup2"
+        response = realm.groups().group(group1.getId()).subGroup(group3);
+        assertEquals(409, response.getStatus());
+        realm.groups().group(group3.getId()).remove();
+
+        // Move "mygroup2" back under parent
+        response = realm.groups().add(group2);
+        assertEquals(204, response.getStatus());
+        response.close();
+
+        // Assert "mygroup2" was moved
+        group1Children = realm.groups().group(group1.getId()).getSubGroups(0, 10, false);
+        assertEquals(0, group1Children.size());
+        assertEquals("/mygroup2", realm.groups().group(group2.getId()).toRepresentation().getPath());
+
+        // Move "mygroup2" back under parent for cleanup
+        realm.groups().add(group2);
+    }
+
+    @Test
+    public void groupMembership() {
+        UsersResource users = managedRealm.admin().users();
+
+        GroupRepresentation groupRep = new GroupRepresentation();
+        groupRep.setName("group");
+        String groupId = createGroup(managedRealm, groupRep);
+        GroupResource group = managedRealm.admin().groups().group(groupId);
+
+        Response response = users.create(UserConfigBuilder.create().username("user-a").build());
+        String userAId = ApiUtil.getCreatedId(response);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userResourcePath(userAId), ResourceType.USER);
+
+        response = users.create(UserConfigBuilder.create().username("user-b").build());
+        String userBId = ApiUtil.getCreatedId(response);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userResourcePath(userBId), ResourceType.USER);
+
+        users.get(userAId).joinGroup(groupId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userGroupPath(userAId, groupId), groupRep, ResourceType.GROUP_MEMBERSHIP);
+
+        List<UserRepresentation> members = group.members(0, 10);
+        Assert.assertNames(members, "user-a");
+
+        users.get(userBId).joinGroup(groupId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.userGroupPath(userBId, groupId), groupRep, ResourceType.GROUP_MEMBERSHIP);
+
+        members = group.members(0, 10);
+        Assert.assertNames(members, "user-a", "user-b");
+
+        users.get(userAId).leaveGroup(groupId);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.userGroupPath(userAId, groupId), groupRep, ResourceType.GROUP_MEMBERSHIP);
+
+        members = group.members(0, 10);
+        Assert.assertNames(members, "user-b");
+
+        List<GroupRepresentation> groupsList = users.get(userAId).groups(null, null);
+        Assert.assertNames(groupsList);
+    }
+
+
+    @Test
+    //KEYCLOAK-6300 List of group members is not sorted alphabetically
+    public void groupMembershipUsersOrder() {
+        RealmResource realm = managedRealm.admin();
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("group");
+        String groupId = createGroup(managedRealm, group);
+
+        List<String> usernames = new ArrayList<>();
+        for (int i = 0; i < 9; i++) {
+            UserRepresentation user = UserConfigBuilder.create().username("user" + i).build();
+            usernames.add(user.getUsername());
+
+            Response create = realm.users().create(user);
+            String userId = ApiUtil.getCreatedId(create);
+            realm.users().get(userId).joinGroup(groupId);
+
+        }
+
+        List<String> memberUsernames = new ArrayList<>();
+        for (UserRepresentation member : realm.groups().group(groupId).members(0, 10)) {
+            memberUsernames.add(member.getUsername());
+        }
+        assertArrayEquals(
+                usernames.toArray(), memberUsernames.toArray(),
+                "Expected: " + usernames + ", was: " + memberUsernames
+        );
+    }
+
+    @Test
+    // KEYCLOAK-2700 Import existing realm fails due to can't delete group
+    public void deleteRealmWithDefaultGroups() {
+        RealmConfigBuilder realmConfigBuilder = RealmConfigBuilder.create()
+                .name("foo")
+                .defaultGroups("/default1");
+        realmConfigBuilder.addGroup("default1").path("/default1");
+        RealmRepresentation rep = realmConfigBuilder.build();
+
+        adminClient.realms().create(rep);
+
+        adminClient.realm(rep.getRealm()).remove();
+    }
+
+    @Test
+    public void roleMappings() {
+        RealmResource realm = managedRealm.admin();
+        createRealmRole(managedRealm, RoleBuilder.create().name("realm-role").build());
+        createRealmRole(managedRealm, RoleBuilder.create().name("realm-composite").build());
+        createRealmRole(managedRealm, RoleBuilder.create().name("realm-child").build());
+        realm.roles().get("realm-composite").addComposites(List.of(realm.roles().get("realm-child").toRepresentation()));
+
+        Response response = realm.clients().create(ClientConfigBuilder.create().clientId("myclient").build());
+        String clientId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(clientId).remove());
+
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role").build());
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role2").build());
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-composite").build());
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-child").build());
+        realm.clients().get(clientId).roles().get("client-composite").addComposites(List.of(realm.clients().get(clientId).roles().get("client-child").toRepresentation()));
+
+        // Roles+clients tested elsewhere
+        adminEvents.skipAll();
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("group");
+        String groupId = createGroup(managedRealm, group);
+
+        RoleMappingResource roles = realm.groups().group(groupId).roles();
+        assertEquals(0, roles.realmLevel().listAll().size());
+
+        // Add realm roles
+        List<RoleRepresentation> l = new LinkedList<>();
+        l.add(realm.roles().get("realm-role").toRepresentation());
+        l.add(realm.roles().get("realm-composite").toRepresentation());
+        roles.realmLevel().add(l);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), l, ResourceType.REALM_ROLE_MAPPING);
+
+        // Add client roles
+        RoleRepresentation clientRole = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
+        RoleRepresentation clientComposite = realm.clients().get(clientId).roles().get("client-composite").toRepresentation();
+        roles.clientLevel(clientId).add(List.of(clientRole));
+        roles.clientLevel(clientId).add(List.of(clientComposite));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), List.of(clientRole), ResourceType.CLIENT_ROLE_MAPPING);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), List.of(clientComposite), ResourceType.CLIENT_ROLE_MAPPING);
+
+        // List realm roles
+        Assert.assertNames(roles.realmLevel().listAll(), "realm-role", "realm-composite");
+        Assert.assertNames(roles.realmLevel().listAvailable(), "realm-child", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(roles.realmLevel().listEffective(), "realm-role", "realm-composite", "realm-child");
+
+        // List client roles
+        Assert.assertNames(roles.clientLevel(clientId).listAll(), "client-role", "client-composite");
+        Assert.assertNames(roles.clientLevel(clientId).listAvailable(), "client-role2", "client-child");
+        Assert.assertNames(roles.clientLevel(clientId).listEffective(), "client-role", "client-composite", "client-child");
+
+        // Get mapping representation
+        MappingsRepresentation all = roles.getAll();
+        Assert.assertNames(all.getRealmMappings(), "realm-role", "realm-composite");
+        assertEquals(1, all.getClientMappings().size());
+        Assert.assertNames(all.getClientMappings().get("myclient").getMappings(), "client-role", "client-composite");
+
+        // Remove realm role
+        RoleRepresentation realmRoleRep = realm.roles().get("realm-role").toRepresentation();
+        roles.realmLevel().remove(List.of(realmRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), List.of(realmRoleRep), ResourceType.REALM_ROLE_MAPPING);
+        Assert.assertNames(roles.realmLevel().listAll(), "realm-composite");
+
+        // Remove client role
+        RoleRepresentation clientRoleRep = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
+        roles.clientLevel(clientId).remove(List.of(clientRoleRep));
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), List.of(clientRoleRep), ResourceType.CLIENT_ROLE_MAPPING);
+        Assert.assertNames(roles.clientLevel(clientId).listAll(), "client-composite");
+    }
+
+    /**
+     * Test for KEYCLOAK-10603.
+     */
+    @Test
+    public void rolesCanBeAssignedEvenWhenTheyAreAlreadyIndirectlyAssigned() {
+        RealmResource realm = managedRealm.admin();
+
+        createRealmRole(managedRealm, RoleBuilder.create().name("realm-composite").build());
+        createRealmRole(managedRealm, RoleBuilder.create().name("realm-child").build());
+        realm.roles().get("realm-composite")
+                .addComposites(List.of(realm.roles().get("realm-child").toRepresentation()));
+
+        Response response = realm.clients().create(ClientConfigBuilder.create().clientId("myclient").build());
+        String clientId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.clients().get(clientId).remove());
+
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-composite").build());
+        realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-child").build());
+        realm.clients().get(clientId).roles().get("client-composite").addComposites(
+                List.of(realm.clients().get(clientId).roles().get("client-child").toRepresentation())
+        );
+
+        GroupRepresentation group = new GroupRepresentation();
+        group.setName("group");
+
+        // Roles+clients tested elsewhere
+        adminEvents.skipAll();
+
+        String groupId = createGroup(managedRealm, group);
+
+        RoleMappingResource roles = realm.groups().group(groupId).roles();
+        // Make indirect assignments: assign composite roles
+        roles.realmLevel()
+                .add(List.of(realm.roles().get("realm-composite").toRepresentation()));
+        RoleRepresentation clientComposite =
+                realm.clients().get(clientId).roles().get("client-composite").toRepresentation();
+        roles.clientLevel(clientId).add(List.of(clientComposite));
+
+        // Check state before making the direct assignments
+        Assert.assertNames(roles.realmLevel().listAll(), "realm-composite");
+        Assert.assertNames(roles.realmLevel().listAvailable(), "realm-child", "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(roles.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        Assert.assertNames(roles.clientLevel(clientId).listAll(), "client-composite");
+        Assert.assertNames(roles.clientLevel(clientId).listAvailable(), "client-child");
+        Assert.assertNames(roles.clientLevel(clientId).listEffective(), "client-composite", "client-child");
+
+        // Make direct assignments for roles which are already indirectly assigned
+        roles.realmLevel().add(List.of(realm.roles().get("realm-child").toRepresentation()));
+        RoleRepresentation clientChild =
+                realm.clients().get(clientId).roles().get("client-child").toRepresentation();
+        roles.clientLevel(clientId).add(List.of(clientChild));
+
+        // List realm roles
+        Assert.assertNames(roles.realmLevel().listAll(), "realm-composite", "realm-child");
+        Assert.assertNames(roles.realmLevel().listAvailable(), "offline_access",
+                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + managedRealm.getName());
+        Assert.assertNames(roles.realmLevel().listEffective(), "realm-composite", "realm-child");
+
+        // List client roles
+        Assert.assertNames(roles.clientLevel(clientId).listAll(), "client-composite", "client-child");
+        Assert.assertNames(roles.clientLevel(clientId).listAvailable());
+        Assert.assertNames(roles.clientLevel(clientId).listEffective(), "client-composite", "client-child");
+
+        // Get mapping representation
+        MappingsRepresentation all = roles.getAll();
+        Assert.assertNames(all.getRealmMappings(), "realm-composite", "realm-child");
+        assertEquals(1, all.getClientMappings().size());
+        Assert.assertNames(all.getClientMappings().get("myclient").getMappings(), "client-composite", "client-child");
+    }
+
+    @Test
+    public void defaultMaxResults() {
+        GroupsResource groups = managedRealm.admin().groups();
+        Response response = groups.add(GroupConfigBuilder.create().name("test").build());
+        String groupId = ApiUtil.getCreatedId(response);
+
+        GroupResource group = groups.group(groupId);
+
+        UsersResource users = managedRealm.admin().users();
+
+        for (int i = 0; i < 110; i++) {
+            Response resp = users.create(UserConfigBuilder.create().username("test-" + i).build());
+            String userUuid = ApiUtil.getCreatedId(resp);
+            users.get(userUuid).joinGroup(groupId);
+            managedRealm.cleanup().add(r -> r.users().delete(userUuid).close());
+        }
+
+        assertEquals(100, group.members(null, null).size());
+        assertEquals(100, group.members().size());
+        assertEquals(105, group.members(0, 105).size());
+        assertEquals(110, group.members(0, 1000).size());
+        assertEquals(110, group.members(-1, -2).size());
+    }
+
+    @Test
+    public void getGroupsWithBriefAndFullRepresentation() {
+        GroupRepresentation group = GroupConfigBuilder.create()
+                .name("groupWithAttribute")
+                .attribute("attribute1", "attribute1", "attribute2")
+                .build();
+        createGroup(managedRealm, group);
+
+        List<GroupRepresentation> groups;
+        // brief representation
+        groups = managedRealm.admin().groups().groups("groupWithAttribute", 0, 20);
+        assertFalse(groups.isEmpty());
+        assertNull(groups.get(0).getAttributes());
+        // full representation
+        groups = managedRealm.admin().groups().groups("groupWithAttribute", 0, 20, false);
+        assertFalse(groups.isEmpty());
+        assertTrue(groups.get(0).getAttributes().containsKey("attribute1"));
+    }
+
+    @Test
+    public void getSubGroups() {
+        GroupRepresentation parent = new GroupRepresentation();
+        parent.setName("parent");
+        createGroup(managedRealm, parent);
+
+        GroupRepresentation child = GroupConfigBuilder.create()
+                .name("child")
+                .attribute("attribute1", "value1", "value2")
+                .build();
+
+        addSubGroup(managedRealm, parent, child);
+
+        // Check brief and full retrieval of subgroups of parent
+        GroupResource parentGroup = managedRealm.admin().groups().group(parent.getId());
+        boolean briefRepresentation = true;
+        assertNull(parentGroup.getSubGroups(null, null, briefRepresentation).get(0).getAttributes());
+
+        briefRepresentation = false;
+        assertThat(parentGroup.getSubGroups(null, null, briefRepresentation).get(0).getAttributes().get("attribute1"), containsInAnyOrder("value1", "value2"));
+    }
+
+    @Test
+    public void removeAllGroupAttributes() {
+        final GroupRepresentation groupToCreate = GroupConfigBuilder.create()
+                .name("remove-all-attributes-group")
+                .attribute("test-key", "test-val")
+                .build();
+        final GroupsResource groupsResource = managedRealm.admin().groups();
+        final Response response = groupsResource.add(groupToCreate);
+        final String groupId = ApiUtil.getCreatedId(response);
+        managedRealm.cleanup().add(r -> r.groups().group(groupId).remove());
+
+        final GroupResource groupResource = groupsResource.group(groupId);
+        final GroupRepresentation createdGroup = groupResource.toRepresentation();
+        assertThat(createdGroup.getAttributes(), equalTo(Map.of("test-key", List.of("test-val"))));
+
+        final GroupRepresentation groupToUpdate = GroupConfigBuilder.update(groupToCreate)
+                .setAttributes(Map.of())
+                .build();
+        groupResource.update(groupToUpdate);
+
+        final GroupRepresentation updatedGroup = groupResource.toRepresentation();
+        assertThat(updatedGroup.getAttributes(), anEmptyMap());
+    }
+
+    @Test
+    public void testBriefRepresentationOnGroupMembers() {
+        RealmResource realm = managedRealm.admin();
+        String groupName = "brief-grouptest-group";
+        String userName = "brief-grouptest-user";
+
+        // enable user profile unmanaged attributes
+        UserProfileResource upResource = realm.users().userProfile();
+        UPConfig cfg = UserProfileUtil.enableUnmanagedAttributes(upResource);
+        AdminEventAssertion.assertSuccess(adminEvents.poll())
+                .operationType(OperationType.UPDATE)
+                .resourcePath(AdminEventPaths.userProfilePath())
+                .resourceType(ResourceType.USER_PROFILE);
+
+        try {
+            String groupId = createGroup(managedRealm, GroupConfigBuilder.create().name(groupName).build());
+            GroupResource group = managedRealm.admin().groups().group(groupId);
+
+            UserRepresentation userRepresentation = UserConfigBuilder.create()
+                    .username(userName)
+                    .attribute("myattribute", "myvalue")
+                    .build();
+
+            UsersResource users = realm.users();
+            Response response = users.create(userRepresentation);
+            String userUuid = ApiUtil.getCreatedId(response);
+            managedRealm.cleanup().add(r -> r.users().get(userUuid).remove());
+            users.get(userUuid).joinGroup(groupId);
+
+            UserRepresentation defaultRepresentation = group.members(null, null).get(0);
+            UserRepresentation fullRepresentation = group.members(null, null, false).get(0);
+            UserRepresentation briefRepresentation = group.members(null, null, true).get(0);
+
+            assertEquals(userRepresentation.getAttributes(), fullRepresentation.getAttributes());
+            assertEquals(userRepresentation.getAttributes(), defaultRepresentation.getAttributes());
+            assertNull(briefRepresentation.getAttributes());
+        } finally {
+            cfg.setUnmanagedAttributePolicy(null);
+            upResource.update(cfg);
+        }
+    }
+
+    /**
+     * Assert that when you create/move/update a group name, the response is not Http 409 Conflict and the message does not
+     * correspond to the returned user-friendly message in such cases
+     */
+    private void assertSameNameNotAllowed(Response response, String expectedErrorMessage) {
+        assertEquals(409, response.getStatus());
+        ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+        Assertions.assertEquals(expectedErrorMessage, error.getErrorMessage());
+    }
+
+    private static class GroupTestRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder realm) {
+            realm.eventsEnabled(true);
+
+            realm.addUser("direct-login")
+                    .name("Direct", "Login")
+                    .email("direct-login@localhost")
+                    .enabled(true)
+                    .password("password");
+
+            realm.addClient("resource-owner")
+                    .directAccessGrants()
+                    .secret("secret");
+
+            return realm;
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/AbstractIdentityProviderTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/AbstractIdentityProviderTest.java
new file mode 100644
index 000000000000..b3fadd9fb9b3
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/AbstractIdentityProviderTest.java
@@ -0,0 +1,76 @@
+package org.keycloak.tests.admin.identityprovider;
+
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.utils.StripSecretsUtils;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import java.util.Map;
+
+public class AbstractIdentityProviderTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    protected String create(IdentityProviderRepresentation idpRep) {
+        String idpId = ApiUtil.getCreatedId(managedRealm.admin().identityProviders().create(idpRep));
+        Assertions.assertNotNull(idpId);
+
+        String secret = idpRep.getConfig() != null ? idpRep.getConfig().get("clientSecret") : null;
+        idpRep = StripSecretsUtils.stripSecrets(null, idpRep);
+        // if legacy hide on login page attribute was used, the attr will be removed when converted to model
+        idpRep.setHideOnLogin(Boolean.parseBoolean(idpRep.getConfig().remove(IdentityProviderModel.LEGACY_HIDE_ON_LOGIN_ATTR)));
+
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.identityProviderPath(idpRep.getAlias()), idpRep, ResourceType.IDENTITY_PROVIDER);
+
+        if (secret != null) {
+            idpRep.getConfig().put("clientSecret", secret);
+        }
+
+        return idpId;
+    }
+
+    protected IdentityProviderRepresentation createRep(String alias, String providerId) {
+        return createRep(alias, providerId,true, null);
+    }
+
+    protected IdentityProviderRepresentation createRep(String alias, String providerId,boolean enabled, Map<String, String> config) {
+        return createRep(alias, alias, providerId, enabled, config);
+    }
+
+    protected IdentityProviderRepresentation createRep(String alias, String displayName, String providerId, boolean enabled, Map<String, String> config) {
+        IdentityProviderRepresentation idp = new IdentityProviderRepresentation();
+
+        idp.setAlias(alias);
+        idp.setDisplayName(displayName);
+        idp.setProviderId(providerId);
+        idp.setEnabled(enabled);
+        if (config != null) {
+            idp.setConfig(config);
+        }
+        return idp;
+    }
+
+    protected void assertProviderInfo(Map<String, String> info, String id, String name) {
+        System.out.println(info);
+        Assertions.assertEquals(id, info.get("id"), "id");
+        Assertions.assertEquals(name, info.get("name"), "name");
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderMapperTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderMapperTest.java
new file mode 100644
index 000000000000..a789e81cebd6
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderMapperTest.java
@@ -0,0 +1,273 @@
+package org.keycloak.tests.admin.identityprovider;
+
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderMapperSyncMode;
+import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
+import org.keycloak.representations.idm.IdentityProviderMapperTypeRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.testsuite.broker.oidc.OverwrittenMappersTestIdentityProviderFactory;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@KeycloakIntegrationTest(config = IdentityProviderMapperTest.IdentityProviderMapperServerConf.class)
+public class IdentityProviderMapperTest extends AbstractIdentityProviderTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm managedRealm;
+
+    @Test
+    public void testMapperTypes() {
+
+        IdentityProviderResource provider;
+        Map<String, IdentityProviderMapperTypeRepresentation> mapperTypes;
+
+        create(createRep("google", "google"));
+        provider = managedRealm.admin().identityProviders().get("google");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "google-user-attribute-mapper", "oidc-username-idp-mapper");
+
+        create(createRep("facebook", "facebook"));
+        provider = managedRealm.admin().identityProviders().get("facebook");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "facebook-user-attribute-mapper", "oidc-username-idp-mapper");
+
+        create(createRep("github", "github"));
+        provider = managedRealm.admin().identityProviders().get("github");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "github-user-attribute-mapper", "oidc-username-idp-mapper");
+
+        create(createRep("twitter", "twitter"));
+        provider = managedRealm.admin().identityProviders().get("twitter");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "oidc-username-idp-mapper");
+
+        /*
+        // disabled to prevent 429 rate limiting on GitHub actions for LinkedIn's
+        // https://www.linkedin.com/oauth/.well-known/openid-configuration discovery URL
+        create(createRep("linkedin-openid-connect", "linkedin-openid-connect"));
+        provider = managedRealm.admin().identityProviders().get("linkedin-openid-connect");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "linkedin-user-attribute-mapper", "oidc-username-idp-mapper");
+        */
+
+        create(createRep("microsoft", "microsoft"));
+        provider = managedRealm.admin().identityProviders().get("microsoft");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "microsoft-user-attribute-mapper", "oidc-username-idp-mapper");
+
+        create(createRep("stackoverflow", "stackoverflow"));
+        provider = managedRealm.admin().identityProviders().get("stackoverflow");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "stackoverflow-user-attribute-mapper", "oidc-username-idp-mapper");
+
+        create(createRep("keycloak-oidc", "keycloak-oidc"));
+        provider = managedRealm.admin().identityProviders().get("keycloak-oidc");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "keycloak-oidc-role-to-role-idp-mapper", "oidc-user-attribute-idp-mapper", "oidc-role-idp-mapper", "oidc-username-idp-mapper", "oidc-advanced-group-idp-mapper", "oidc-advanced-role-idp-mapper", "oidc-user-session-note-idp-mapper");
+
+        create(createRep("oidc", "oidc"));
+        provider = managedRealm.admin().identityProviders().get("oidc");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "oidc-user-attribute-idp-mapper", "oidc-role-idp-mapper", "oidc-username-idp-mapper", "oidc-advanced-group-idp-mapper", "oidc-advanced-role-idp-mapper", "oidc-user-session-note-idp-mapper");
+
+        create(createRep("saml", "saml"));
+        provider = managedRealm.admin().identityProviders().get("saml");
+        mapperTypes = provider.getMapperTypes();
+        assertMapperTypes(mapperTypes, "saml-user-attribute-idp-mapper", "saml-role-idp-mapper", "saml-username-idp-mapper", "saml-advanced-role-idp-mapper", "saml-advanced-group-idp-mapper", "saml-xpath-attribute-idp-mapper");
+    }
+
+    @Test
+    public void mapperTypesCanBeOverwritten() {
+        String kcOidcProviderId = "keycloak-oidc";
+        create(createRep(kcOidcProviderId, kcOidcProviderId));
+
+        String testProviderId = OverwrittenMappersTestIdentityProviderFactory.PROVIDER_ID;
+        create(createRep(testProviderId, testProviderId));
+
+        /*
+         * in the test provider, we have overwritten the mapper types to be the same as supported by "keycloak-oidc", so
+         * the "keycloak-oidc" mappers are the expected mappers for the test provider
+         */
+        IdentityProviderResource kcOidcProvider = managedRealm.admin().identityProviders().get(kcOidcProviderId);
+        Set<String> expectedMapperTypes = kcOidcProvider.getMapperTypes().keySet();
+
+        IdentityProviderResource testProvider = managedRealm.admin().identityProviders().get(testProviderId);
+        Set<String> actualMapperTypes = testProvider.getMapperTypes().keySet();
+
+        assertThat(actualMapperTypes, equalTo(expectedMapperTypes));
+    }
+
+    @Test
+    public void testMappers() {
+        create(createRep("google", "google"));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("google");
+
+        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
+        mapper.setIdentityProviderAlias("google");
+        mapper.setName("my_mapper");
+        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
+        Map<String, String> config = new HashMap<>();
+        config.put("role", "offline_access");
+        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
+        mapper.setConfig(config);
+
+        // createRep and add mapper
+        Response response = provider.addMapper(mapper);
+        String id = ApiUtil.getCreatedId(response);
+        Assertions.assertNotNull(id);
+        response.close();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.CREATE, AdminEventPaths.identityProviderMapperPath("google", id), mapper, ResourceType.IDENTITY_PROVIDER_MAPPER);
+
+        // list mappers
+        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
+        Assertions.assertEquals(1, mappers.size(), "mappers count");
+        Assertions.assertEquals(id, mappers.get(0).getId(), "newly created mapper id");
+
+        // get mapper
+        mapper = provider.getMapperById(id);
+        Assertions.assertEquals("INHERIT", mappers.get(0).getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        Assertions.assertNotNull(mapper, "mapperById not null");
+        Assertions.assertEquals(id, mapper.getId(), "mapper id");
+        Assertions.assertNotNull(mapper.getConfig(), "mapper.config exists");
+        Assertions.assertEquals("offline_access", mapper.getConfig().get("role"), "config retained");
+
+        // add duplicate mapper
+        Response error = provider.addMapper(mapper);
+        Assertions.assertEquals(400, error.getStatus(), "mapper unique name");
+        error.close();
+
+        // update mapper
+        mapper.getConfig().put("role", "master-realm.manage-realm");
+        provider.update(id, mapper);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.identityProviderMapperPath("google", id), mapper, ResourceType.IDENTITY_PROVIDER_MAPPER);
+
+        mapper = provider.getMapperById(id);
+        Assertions.assertNotNull(mapper, "mapperById not null");
+        Assertions.assertEquals("master-realm.manage-realm", mapper.getConfig().get("role"), "config changed");
+
+        // delete mapper
+        provider.delete(id);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.identityProviderMapperPath("google", id), ResourceType.IDENTITY_PROVIDER_MAPPER);
+        try {
+            provider.getMapperById(id);
+            Assertions.fail("Should fail with NotFoundException");
+        } catch (NotFoundException e) {
+            // Expected
+        }
+    }
+
+    // KEYCLOAK-4962
+    @Test
+    public void testUpdateProtocolMappers() {
+        create(createRep("google2", "google"));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("google2");
+
+        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
+        mapper.setIdentityProviderAlias("google2");
+        mapper.setName("my_mapper");
+        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
+        Map<String, String> config = new HashMap<>();
+        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
+        config.put("role", "");
+        mapper.setConfig(config);
+
+        Response response = provider.addMapper(mapper);
+        String mapperId = ApiUtil.getCreatedId(response);
+
+
+        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
+        assertEquals(1, mappers.size());
+        assertEquals(1, mappers.get(0).getConfig().size());
+
+        mapper = provider.getMapperById(mapperId);
+        mapper.getConfig().put("role", "offline_access");
+
+        provider.update(mapperId, mapper);
+
+        mappers = provider.getMappers();
+        assertEquals("INHERIT", mappers.get(0).getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        assertEquals(1, mappers.size());
+        assertEquals(2, mappers.get(0).getConfig().size());
+        assertEquals("offline_access", mappers.get(0).getConfig().get("role"));
+    }
+
+    // KEYCLOAK-7872
+    @Test
+    public void testDeleteProtocolMappersAfterDeleteIdentityProvider() {
+        create(createRep("google3", "google"));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("google3");
+
+        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
+        mapper.setIdentityProviderAlias("google3");
+        mapper.setName("my_mapper");
+        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
+        Map<String, String> config = new HashMap<>();
+        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
+        config.put("role", "offline_access");
+        mapper.setConfig(config);
+
+        provider.addMapper(mapper);
+
+        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
+        assertThat(mappers, hasSize(1));
+
+        adminEvents.clear();
+
+        provider.remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.identityProviderPath("google3"), ResourceType.IDENTITY_PROVIDER);
+
+        create(createRep("google3", "google"));
+
+        IdentityProviderResource newProvider = managedRealm.admin().identityProviders().get("google3");
+
+        assertThat(newProvider.getMappers(), empty());
+    }
+
+    private void assertMapperTypes(Map<String, IdentityProviderMapperTypeRepresentation> mapperTypes, String ... mapperIds) {
+        Set<String> expected = new HashSet<>();
+        expected.add("hardcoded-user-session-attribute-idp-mapper");
+        expected.add("oidc-hardcoded-role-idp-mapper");
+        expected.add("oidc-hardcoded-group-idp-mapper");
+        expected.add("hardcoded-attribute-idp-mapper");
+        expected.addAll(Arrays.asList(mapperIds));
+
+        Assertions.assertEquals(expected, mapperTypes.keySet(), "mapperTypes");
+    }
+
+    public static class IdentityProviderMapperServerConf implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder builder) {
+            return builder.dependency("org.keycloak.tests", "keycloak-tests-custom-providers");
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderOidcTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderOidcTest.java
new file mode 100644
index 000000000000..fed42ae54ade
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderOidcTest.java
@@ -0,0 +1,452 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.identityprovider;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.hasEntry;
+import static org.hamcrest.Matchers.not;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+import java.util.UUID;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.common.enums.SslRequired;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.broker.OIDCIdentityProviderConfigRep;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@KeycloakIntegrationTest
+public class IdentityProviderOidcTest extends AbstractIdentityProviderTest {
+
+    @Test
+    public void testCreateWithReservedCharacterForAlias() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("ne$&w-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+
+        Response response = managedRealm.admin().identityProviders().create(newIdentityProvider);
+        Assertions.assertEquals(400, response.getStatus());
+    }
+
+    @Test
+    public void testCreate() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+
+        String id = create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("new-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        assertNotNull(representation.getInternalId());
+        assertEquals("new-identity-provider", representation.getAlias());
+        assertEquals("oidc", representation.getProviderId());
+        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        assertEquals("clientId", representation.getConfig().get("clientId"));
+        assertEquals(ComponentRepresentation.SECRET_VALUE, representation.getConfig().get("clientSecret"));
+        assertTrue(representation.isEnabled());
+        assertFalse(representation.isStoreToken());
+        assertFalse(representation.isTrustEmail());
+        assertNull(representation.getFirstBrokerLoginFlowAlias());
+
+        assertEquals("some secret value", runOnServer.fetch(s -> s.identityProviders().getByAlias("new-identity-provider").getConfig().get("clientSecret"), String.class));
+
+        IdentityProviderRepresentation rep = managedRealm.admin().identityProviders().findAll().stream().filter(i -> i.getAlias().equals("new-identity-provider")).findFirst().get();
+        assertEquals(ComponentRepresentation.SECRET_VALUE, rep.getConfig().get("clientSecret"));
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void failCreateInvalidUrl() throws Exception {
+        managedRealm.updateWithCleanup(r -> r.sslRequired(SslRequired.ALL.name()));
+
+        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+
+        OIDCIdentityProviderConfigRep oidcConfig = new OIDCIdentityProviderConfigRep(newIdentityProvider);
+
+        oidcConfig.setAuthorizationUrl("invalid://test");
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+            assertEquals("The url [authorization_url] is malformed", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl("http://test");
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+            assertEquals("The url [token_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl("http://test");
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+            assertEquals("The url [jwks_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl(null);
+        oidcConfig.setLogoutUrl("http://test");
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+            assertEquals("The url [logout_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl(null);
+        oidcConfig.setLogoutUrl(null);
+        oidcConfig.setUserInfoUrl("http://test");
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+            assertEquals("The url [userinfo_url] requires secure connections", error.getErrorMessage());
+        }
+    }
+
+    @Test
+    public void shouldFailWhenAliasHasSpaceDuringCreation() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("New Identity Provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+        newIdentityProvider.getConfig().put("clientAuthMethod",OIDCLoginProtocol.CLIENT_SECRET_BASIC);
+
+        try (Response response = this.managedRealm.admin().identityProviders().create(newIdentityProvider)) {
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            String error = response.readEntity(String.class);
+            assertTrue(error.contains("Empty Space not allowed."));
+        }
+    }
+
+    @Test
+    public void testCreateWithBasicAuth() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+        newIdentityProvider.getConfig().put("clientAuthMethod",OIDCLoginProtocol.CLIENT_SECRET_BASIC);
+
+        String id = create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("new-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        assertNotNull(representation.getInternalId());
+        assertEquals("new-identity-provider", representation.getAlias());
+        assertEquals("oidc", representation.getProviderId());
+        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        assertEquals("clientId", representation.getConfig().get("clientId"));
+        assertEquals(ComponentRepresentation.SECRET_VALUE, representation.getConfig().get("clientSecret"));
+        assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, representation.getConfig().get("clientAuthMethod"));
+
+        assertTrue(representation.isEnabled());
+        assertFalse(representation.isStoreToken());
+        assertFalse(representation.isTrustEmail());
+
+        assertEquals("some secret value", runOnServer.fetch(s -> s.identityProviders().getByAlias("new-identity-provider").getConfig().get("clientSecret"), String.class));
+
+        IdentityProviderRepresentation rep = managedRealm.admin().identityProviders().findAll().stream().filter(i -> i.getAlias().equals("new-identity-provider")).findFirst().get();
+        assertEquals(ComponentRepresentation.SECRET_VALUE, rep.getConfig().get("clientSecret"));
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testCreateWithJWT() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientAuthMethod", OIDCLoginProtocol.PRIVATE_KEY_JWT);
+
+        String id = create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("new-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        assertNotNull(representation.getInternalId());
+        assertEquals("new-identity-provider", representation.getAlias());
+        assertEquals("oidc", representation.getProviderId());
+        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        assertEquals("clientId", representation.getConfig().get("clientId"));
+        assertNull(representation.getConfig().get("clientSecret"));
+        assertEquals(OIDCLoginProtocol.PRIVATE_KEY_JWT, representation.getConfig().get("clientAuthMethod"));
+        assertNull(representation.getConfig().get("jwtX509HeadersEnabled"));
+        assertTrue(representation.isEnabled());
+        assertFalse(representation.isStoreToken());
+        assertFalse(representation.isTrustEmail());
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testCreateWithJWTAndX509Headers() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientAuthMethod", OIDCLoginProtocol.PRIVATE_KEY_JWT);
+        newIdentityProvider.getConfig().put("jwtX509HeadersEnabled", "true");
+
+        String id = create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("new-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        assertNotNull(representation.getInternalId());
+        assertEquals("new-identity-provider", representation.getAlias());
+        assertEquals("oidc", representation.getProviderId());
+        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
+        assertEquals("clientId", representation.getConfig().get("clientId"));
+        assertNull(representation.getConfig().get("clientSecret"));
+        assertEquals(OIDCLoginProtocol.PRIVATE_KEY_JWT, representation.getConfig().get("clientAuthMethod"));
+        assertEquals("true", representation.getConfig().get("jwtX509HeadersEnabled"));
+        assertTrue(representation.isEnabled());
+        assertFalse(representation.isStoreToken());
+        assertFalse(representation.isTrustEmail());
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testUpdate() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("update-identity-provider", "oidc");
+
+        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
+        newIdentityProvider.getConfig().put("clientId", "clientId");
+        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
+
+        create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("update-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        assertEquals("update-identity-provider", representation.getAlias());
+
+        representation.setAlias("changed-alias");
+        representation.setEnabled(false);
+        representation.setStoreToken(true);
+        representation.getConfig().put("clientId", "changedClientId");
+
+        identityProviderResource.update(representation);
+        AdminEventRepresentation event = adminEvents.poll();
+        AdminEventAssertion.assertEvent(event, OperationType.UPDATE, AdminEventPaths.identityProviderPath("update-identity-provider"), representation, ResourceType.IDENTITY_PROVIDER);
+        assertFalse(event.getRepresentation().contains("some secret value"));
+        assertTrue(event.getRepresentation().contains(ComponentRepresentation.SECRET_VALUE));
+
+        identityProviderResource = managedRealm.admin().identityProviders().get(representation.getInternalId());
+
+        assertNotNull(identityProviderResource);
+
+        representation = identityProviderResource.toRepresentation();
+
+        assertFalse(representation.isEnabled());
+        assertTrue(representation.isStoreToken());
+        assertEquals("changedClientId", representation.getConfig().get("clientId"));
+
+        assertEquals("some secret value", runOnServer.fetch(s -> s.identityProviders().getByAlias("changed-alias").getConfig().get("clientSecret"), String.class));
+
+        representation.getConfig().put("clientSecret", "${vault.key}");
+        identityProviderResource.update(representation);
+        event = adminEvents.poll();
+        AdminEventAssertion.assertEvent(event, OperationType.UPDATE, AdminEventPaths.identityProviderPath(representation.getInternalId()), representation, ResourceType.IDENTITY_PROVIDER);
+        assertThat(event.getRepresentation(), containsString("${vault.key}"));
+        assertThat(event.getRepresentation(), not(containsString(ComponentRepresentation.SECRET_VALUE)));
+
+        assertThat(identityProviderResource.toRepresentation().getConfig(), hasEntry("clientSecret", "${vault.key}"));
+        assertEquals("${vault.key}", runOnServer.fetch(s -> s.identityProviders().getByAlias("changed-alias").getConfig().get("clientSecret"), String.class));
+    }
+
+    @Test
+    public void failUpdateInvalidUrl() throws Exception {
+        managedRealm.updateWithCleanup(r -> r.sslRequired(SslRequired.ALL.name()));
+        adminEvents.poll(); // realm update
+        IdentityProviderRepresentation representation = createRep(UUID.randomUUID().toString(), "oidc");
+
+        representation.getConfig().put("clientId", "clientId");
+        representation.getConfig().put("clientSecret", "some secret value");
+
+        String id = create(representation);
+
+        IdentityProviderResource resource = this.managedRealm.admin().identityProviders().get(representation.getAlias());
+        representation = resource.toRepresentation();
+
+        OIDCIdentityProviderConfigRep oidcConfig = new OIDCIdentityProviderConfigRep(representation);
+
+        oidcConfig.setAuthorizationUrl("invalid://test");
+        try {
+            resource.update(representation);
+            fail("Invalid URL");
+        } catch (Exception e) {
+            assertTrue(e instanceof  ClientErrorException);
+            Response response = ClientErrorException.class.cast(e).getResponse();
+            assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("The url [authorization_url] is malformed", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl("http://test");
+
+        try {
+            resource.update(representation);
+            fail("Invalid URL");
+        } catch (Exception e) {
+            assertTrue(e instanceof  ClientErrorException);
+            Response response = ClientErrorException.class.cast(e).getResponse();
+            assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("The url [token_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl("http://test");
+        try {
+            resource.update(representation);
+            fail("Invalid URL");
+        } catch (Exception e) {
+            assertTrue(e instanceof  ClientErrorException);
+            Response response = ClientErrorException.class.cast(e).getResponse();
+            assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("The url [jwks_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl(null);
+        oidcConfig.setLogoutUrl("http://test");
+        try {
+            resource.update(representation);
+            fail("Invalid URL");
+        } catch (Exception e) {
+            assertTrue(e instanceof  ClientErrorException);
+            Response response = ClientErrorException.class.cast(e).getResponse();
+            assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("The url [logout_url] requires secure connections", error.getErrorMessage());
+        }
+
+        oidcConfig.setAuthorizationUrl(null);
+        oidcConfig.setTokenUrl(null);
+        oidcConfig.setJwksUrl(null);
+        oidcConfig.setLogoutUrl(null);
+        oidcConfig.setUserInfoUrl("http://localhost");
+
+        try {
+            resource.update(representation);
+            fail("Invalid URL");
+        } catch (Exception e) {
+            assertTrue(e instanceof  ClientErrorException);
+            Response response = ClientErrorException.class.cast(e).getResponse();
+            assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("The url [userinfo_url] requires secure connections", error.getErrorMessage());
+        }
+
+        managedRealm.updateWithCleanup(r -> r.sslRequired(SslRequired.EXTERNAL.name()));
+        resource.update(representation);
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testNoExport() {
+        String id = create(createRep("keycloak-oidc", "keycloak-oidc"));
+
+        Response response = managedRealm.admin().identityProviders().get("keycloak-oidc").export("json");
+        Assertions.assertEquals(204, response.getStatus(), "status");
+        String body = response.readEntity(String.class);
+        Assertions.assertNull(body, "body");
+        response.close();
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderSamlTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderSamlTest.java
new file mode 100644
index 000000000000..73a0eef4ebea
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderSamlTest.java
@@ -0,0 +1,539 @@
+package org.keycloak.tests.admin.identityprovider;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.jboss.resteasy.plugins.providers.multipart.MultipartFormDataOutput;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.broker.saml.SAMLIdentityProviderConfig;
+import org.keycloak.dom.saml.v2.metadata.EndpointType;
+import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.IndexedEndpointType;
+import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.KeyTypes;
+import org.keycloak.dom.saml.v2.metadata.SPSSODescriptorType;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.rotation.HardcodedKeyLocator;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+import org.keycloak.saml.common.exceptions.ConfigurationException;
+import org.keycloak.saml.common.exceptions.ParsingException;
+import org.keycloak.saml.common.exceptions.ProcessingException;
+import org.keycloak.saml.common.util.DocumentUtil;
+import org.keycloak.saml.common.util.XmlKeyInfoKeyNameTransformer;
+import org.keycloak.saml.processing.api.saml.v2.sig.SAML2Signature;
+import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
+import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
+import org.keycloak.testframework.annotations.InjectKeycloakUrls;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.testframework.server.KeycloakUrls;
+import org.keycloak.tests.utils.Assert;
+import org.keycloak.tests.utils.KeyUtils;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
+
+import javax.xml.crypto.dsig.XMLSignature;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.nio.charset.Charset;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.PublicKey;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasEntry;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.keycloak.saml.common.constants.JBossSAMLURIConstants.XMLDSIG_NSURI;
+
+@KeycloakIntegrationTest
+public class IdentityProviderSamlTest extends AbstractIdentityProviderTest {
+
+    @InjectKeycloakUrls
+    KeycloakUrls keycloakUrls;
+
+    // Certificate imported from
+    private static final String SIGNING_CERT_1 = "MIICmzCCAYMCBgFUYnC0OjANBgkqhkiG9w0BAQsFADARMQ8wDQY"
+            + "DVQQDDAZtYXN0ZXIwHhcNMTYwNDI5MTQzMjEzWhcNMjYwNDI5MTQzMzUzWjARMQ8wDQYDVQQDDAZtYXN0ZXI"
+            + "wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCN25AW1poMEZRbuMAHG58AThZmCwMV6/Gcui4mjGa"
+            + "cRFyudgqzLjQ2rxpoW41JAtLjbjeAhuWvirUcFVcOeS3gM/ZC27qCpYighAcylZz6MYocnEe1+e8rPPk4JlI"
+            + "D6Wv62dgu+pL/vYsQpRhvD3Y2c/ytgr5D32xF+KnzDehUy5BSyzypvu12Wq9mS5vK5tzkN37EjkhpY2ZxaXP"
+            + "ubjDIITCAL4Q8M/m5IlacBaUZbzI4AQrHnMP1O1IH2dHSWuMiBe+xSDTco72PmuYPJKTV4wQdeBUIkYbfLc4"
+            + "RxVmXEvgkQgyW86EoMPxlWJpj7+mTIR+l+2thZPr/VgwTs82rAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAA/"
+            + "Ip/Hi8RoVu5ouaFFlc5whT7ltuK8slfLGW4tM4vJXhInYwsqIRQKBNDYW/64xle3eII4u1yAH1OYRRwEs7Em"
+            + "1pr4QuFuTY1at+aE0sE46XDlyESI0txJjWxYoT133vM0We2pj1b2nxgU30rwjKA3whnKEfTEYT/n3JBSqNgg"
+            + "y6l8ZGw/oPSgvPaR4+xeB1tfQFC4VrLoYKoqH6hAL530nKxL+qV8AIfL64NDEE8ankIAEDAAFe8x3CPUfXR/"
+            + "p4KOANKkpz8ieQaHDb1eITkAwUwjESj6UF9D1aePlhWls/HX0gujFXtWfWfrJ8CU/ogwlH8y1jgRuLjFQYZk6llc=";
+
+    private static final String SIGNING_CERT_2 = "MIIBnDCCAQUCBgFYKXKsPTANBgkqhkiG9w0BAQsFADAUMRIwEAY"
+            + "DVQQDDAlzYW1sLWRlbW8wHhcNMTYxMTAzMDkwNzEwWhcNMjYxMTAzMDkwODUwWjAUMRIwEAYDVQQDDAlzYW1"
+            + "sLWRlbW8wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKtWsK5O0CtuBpnMvWG+HTG0vmZzujQ2o9WdheQ"
+            + "u+BzCILcGMsbDW0YQaglpcO5JpGWWhubnckGGPHfdQ2/7nP9QwbiTK0FbGF41UqcvoaCqU1psxoV88s8IXyQ"
+            + "CAqeyLv00yj6foqdJjxh5SZ5z+na+M7Y2OxIBVxYRAxWEnfUvAgMBAAEwDQYJKoZIhvcNAQELBQADgYEAhet"
+            + "vOU8TyqfZF5jpv0IcrviLl/DoFrbjByeHR+pu/vClcAOjL/u7oQELuuTfNsBI4tpexUj5G8q/YbEz0gk7idf"
+            + "LXrAUVcsR73oTngrhRfwUSmPrjjK0kjcRb6HL9V/+wh3R/6mEd59U08ExT8N38rhmn0CI3ehMdebReprP7U8=";
+
+    @Test
+    public void testRemove() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("remove-identity-provider", "saml");
+
+        create(newIdentityProvider);
+
+        IdentityProviderResource identityProviderResource = managedRealm.admin().identityProviders().get("remove-identity-provider");
+
+        assertNotNull(identityProviderResource);
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+
+        assertNotNull(representation);
+
+        identityProviderResource.remove();
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.DELETE, AdminEventPaths.identityProviderPath("remove-identity-provider"), ResourceType.IDENTITY_PROVIDER);
+
+        try {
+            managedRealm.admin().identityProviders().get("remove-identity-provider").toRepresentation();
+            Assertions.fail("Not expected to found");
+        } catch (NotFoundException nfe) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void testNotAvailableFromRealRepresentation() {
+        IdentityProviderRepresentation newIdentityProvider = createRep("remove-identity-provider", "saml");
+
+        String id = create(newIdentityProvider);
+
+        RealmRepresentation rep = this.managedRealm.admin().toRepresentation();
+        assertNull(rep.getIdentityProviders());
+        assertNull(rep.getIdentityProviderMappers());
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void importShouldFailDueAliasWithSpace() {
+
+        Map<String, Object> data = new HashMap<>();
+        data.put("providerId", "saml");
+        data.put("alias", "Alias With Space");
+        data.put("fromUrl", "http://");
+
+        assertThrows(BadRequestException.class, () -> {
+            managedRealm.admin().identityProviders().importFrom(data);
+        });
+
+    }
+
+    @Test
+    public void testSamlImportAndExport() throws URISyntaxException, IOException, ParsingException {
+        testSamlImport("saml-idp-metadata.xml", true);
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        Response response = managedRealm.admin().identityProviders().get("saml").export("xml");
+        Assertions.assertEquals(200, response.getStatus());
+        String body = response.readEntity(String.class);
+        response.close();
+
+        assertSamlExport(body, true);
+    }
+
+    @Test
+    public void testSamlImportWithBom() throws URISyntaxException, IOException, ParsingException {
+        testSamlImport("saml-idp-metadata_utf8_bom.xml", true);
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        Response response = managedRealm.admin().identityProviders().get("saml").export("xml");
+        Assertions.assertEquals(200, response.getStatus());
+        String body = response.readEntity(String.class);
+        response.close();
+
+        assertSamlExport(body, true);
+    }
+
+    @Test
+    public void testSamlImportAndExportDifferentBindings() throws URISyntaxException, IOException, ParsingException {
+        testSamlImport("saml-idp-metadata-different-bindings.xml", false);
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        try (Response response = managedRealm.admin().identityProviders().get("saml").export("xml")) {
+            Assertions.assertEquals(200, response.getStatus());
+            String body = response.readEntity(String.class);
+            assertSamlExport(body, false);
+        }
+    }
+
+    @Test
+    public void testSamlImportWithAnyEncryptionMethod() throws URISyntaxException, IOException, ParsingException {
+        testSamlImport("saml-idp-metadata-encryption-methods.xml", true);
+    }
+
+    @Test
+    public void testSamlImportAndExportDisabled() throws URISyntaxException, IOException, ParsingException {
+
+        // Use import-config to convert IDPSSODescriptor file into key value pairs
+        // to use when creating a SAML Identity Provider
+        MultipartFormDataOutput form = new MultipartFormDataOutput();
+        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
+
+        URL idpMeta = IdentityProviderSamlTest.class.getResource("saml-idp-metadata-disabled.xml");
+        byte[] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
+        String body = new String(content, Charset.forName("utf-8"));
+        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata-disabled.xml");
+
+        Map<String, String> result = managedRealm.admin().identityProviders().importFrom(form);
+        assertSamlImport(result, SIGNING_CERT_1, false, true);
+
+        // Create new SAML identity provider using configuration retrieved from import-config
+        String id = create(createRep("saml", "saml", false, result));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("saml");
+        IdentityProviderRepresentation rep = provider.toRepresentation();
+        assertCreatedSamlIdp(rep, false, true);
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testSamlImportAndExportMultipleSigningKeys() throws URISyntaxException, IOException, ParsingException {
+
+        // Use import-config to convert IDPSSODescriptor file into key value pairs
+        // to use when creating a SAML Identity Provider
+        MultipartFormDataOutput form = new MultipartFormDataOutput();
+        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
+
+        URL idpMeta = IdentityProviderSamlTest.class.getResource("saml-idp-metadata-two-signing-certs.xml");
+        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
+        String body = new String(content, Charset.forName("utf-8"));
+        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata-two-signing-certs");
+
+        Map<String, String> result = managedRealm.admin().identityProviders().importFrom(form);
+        assertSamlImport(result, SIGNING_CERT_1 + "," + SIGNING_CERT_2, true, true);
+
+        // Create new SAML identity provider using configuration retrieved from import-config
+        String id = create(createRep("saml", "saml",true, result));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("saml");
+        IdentityProviderRepresentation rep = provider.toRepresentation();
+        assertCreatedSamlIdp(rep, true, true);
+
+        // Now list the providers - we should see the one just created
+        List<IdentityProviderRepresentation> providers = managedRealm.admin().identityProviders().findAll();
+        Assertions.assertNotNull(providers, "identityProviders not null");
+        Assertions.assertEquals(1, providers.size(), "identityProviders instance count");
+        assertEqual(rep, providers.get(0));
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        Response response = managedRealm.admin().identityProviders().get("saml").export("xml");
+        Assertions.assertEquals(200, response.getStatus());
+        body = response.readEntity(String.class);
+        response.close();
+
+        assertSamlExport(body, true);
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testSamlExportSignatureOff() throws URISyntaxException, IOException, ConfigurationException, ParsingException, ProcessingException {
+        // Use import-config to convert IDPSSODescriptor file into key value pairs
+        // to use when creating a SAML Identity Provider
+        MultipartFormDataOutput form = new MultipartFormDataOutput();
+        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
+
+        URL idpMeta = IdentityProviderSamlTest.class.getResource("saml-idp-metadata.xml");
+        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
+        String body = new String(content, Charset.forName("utf-8"));
+        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata.xml");
+
+        Map<String, String> result = managedRealm.admin().identityProviders().importFrom(form);
+
+        // Explicitly disable SP Metadata Signature
+        result.put(SAMLIdentityProviderConfig.SIGN_SP_METADATA, "false");
+
+        // Create new SAML identity provider using configuration retrieved from import-config
+        IdentityProviderRepresentation idpRep = createRep("saml", "saml", true, result);
+        String id = create(idpRep);
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        Response response = managedRealm.admin().identityProviders().get("saml").export("xml");
+        Assertions.assertEquals(200, response.getStatus());
+        body = response.readEntity(String.class);
+        response.close();
+
+        Document document = DocumentUtil.getDocument(body);
+        Element signatureElement = DocumentUtil.getDirectChildElement(document.getDocumentElement(), XMLDSIG_NSURI.get(), "Signature");
+        Assertions.assertNull(signatureElement);
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    @Test
+    public void testSamlExportSignatureOn() throws URISyntaxException, IOException, ConfigurationException, ParsingException, ProcessingException, CertificateEncodingException {
+        // Use import-config to convert IDPSSODescriptor file into key value pairs
+        // to use when creating a SAML Identity Provider
+        MultipartFormDataOutput form = new MultipartFormDataOutput();
+        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
+
+        URL idpMeta = IdentityProviderSamlTest.class.getResource("saml-idp-metadata.xml");
+        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
+        String body = new String(content, Charset.forName("utf-8"));
+        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata.xml");
+
+        Map<String, String> result = managedRealm.admin().identityProviders().importFrom(form);
+
+        // Explicitly enable SP Metadata Signature
+        result.put(SAMLIdentityProviderConfig.SIGN_SP_METADATA, "true");
+        result.put(SAMLIdentityProviderConfig.XML_SIG_KEY_INFO_KEY_NAME_TRANSFORMER, XmlKeyInfoKeyNameTransformer.CERT_SUBJECT.name());
+
+        // Create new SAML identity provider using configuration retrieved from import-config
+        IdentityProviderRepresentation idpRep = createRep("saml", "saml", true, result);
+        String id = create(idpRep);
+
+        // Perform export, and make sure some of the values are like they're supposed to be
+        Response response = managedRealm.admin().identityProviders().get("saml").export("xml");
+        Assertions.assertEquals(200, response.getStatus());
+        body = response.readEntity(String.class);
+        response.close();
+
+        Document document = DocumentUtil.getDocument(body);
+
+        Element signatureElement = DocumentUtil.getDirectChildElement(document.getDocumentElement(), XMLDSIG_NSURI.get(), "Signature");
+        assertThat("Signature not null", signatureElement, notNullValue());
+
+        Element keyInfoElement = DocumentUtil.getDirectChildElement(signatureElement, XMLDSIG_NSURI.get(), "KeyInfo");
+        assertThat("KeyInfo not null", keyInfoElement, notNullValue());
+
+        Element x509DataElement = DocumentUtil.getDirectChildElement(keyInfoElement, XMLDSIG_NSURI.get(), "X509Data");
+        assertThat("X509Data not null", x509DataElement, notNullValue());
+
+        Element x509CertificateElement = DocumentUtil.getDirectChildElement(x509DataElement, XMLDSIG_NSURI.get(), "X509Certificate");
+        assertThat("X509Certificate not null", x509CertificateElement, notNullValue());
+
+        Element keyNameElement = DocumentUtil.getDirectChildElement(keyInfoElement, XMLDSIG_NSURI.get(), "KeyName");
+        assertThat("KeyName not null", keyNameElement, notNullValue());
+
+        String activeSigCert = KeyUtils.findActiveSigningKey(managedRealm.admin(), Constants.DEFAULT_SIGNATURE_ALGORITHM).getCertificate();
+        assertThat("activeSigCert not null", activeSigCert, notNullValue());
+
+        X509Certificate activeX509SigCert = XMLSignatureUtil.getX509CertificateFromKeyInfoString(activeSigCert);
+        assertThat("KeyName matches subject DN",
+                keyNameElement.getTextContent().trim(), equalTo(activeX509SigCert.getSubjectX500Principal().getName()));
+
+        assertThat("Signing cert matches active realm cert",
+                x509CertificateElement.getTextContent().trim(), equalTo(Base64.getEncoder().encodeToString(activeX509SigCert.getEncoded())));
+
+        PublicKey activePublicSigKey = activeX509SigCert.getPublicKey();
+        assertThat("Metadata signature is valid",
+                new SAML2Signature().validate(document, new HardcodedKeyLocator(activePublicSigKey)), is(true));
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    private void testSamlImport(String fileName, boolean postBindingResponse) throws URISyntaxException, IOException, ParsingException {
+        // Use import-config to convert IDPSSODescriptor file into key value pairs
+        // to use when creating a SAML Identity Provider
+        MultipartFormDataOutput form = new MultipartFormDataOutput();
+        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
+
+        URL idpMeta = IdentityProviderSamlTest.class.getResource(fileName);
+        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
+        String body = new String(content, Charset.forName("utf-8"));
+        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, fileName);
+
+        Map<String, String> result = managedRealm.admin().identityProviders().importFrom(form);
+        assertSamlImport(result, SIGNING_CERT_1, true, postBindingResponse);
+
+        // Create new SAML identity provider using configuration retrieved from import-config
+        String id = create(createRep("saml", "saml",true, result));
+
+        IdentityProviderResource provider = managedRealm.admin().identityProviders().get("saml");
+        IdentityProviderRepresentation rep = provider.toRepresentation();
+        assertCreatedSamlIdp(rep, true, postBindingResponse);
+
+        // Now list the providers - we should see the one just created
+        List<IdentityProviderRepresentation> providers = managedRealm.admin().identityProviders().findAll();
+        Assertions.assertNotNull(providers, "identityProviders not null");
+        Assertions.assertEquals(1, providers.size(), "identityProviders instance count");
+        assertEqual(rep, providers.get(0));
+
+        managedRealm.cleanup().add(r -> r.identityProviders().get(id).remove());
+    }
+
+    private void assertEqual(IdentityProviderRepresentation expected, IdentityProviderRepresentation actual) {
+        //System.out.println("expected: " + expected);
+        //System.out.println("actual: " + actual);
+        Assertions.assertNotNull(expected, "expected IdentityProviderRepresentation not null");
+        Assertions.assertNotNull(actual, "actual IdentityProviderRepresentation not null");
+        Assertions.assertEquals(expected.getInternalId(), actual.getInternalId(), "internalId");
+        Assertions.assertEquals(expected.getAlias(), actual.getAlias(), "alias");
+        Assertions.assertEquals(expected.getProviderId(), actual.getProviderId(), "providerId");
+        Assertions.assertEquals(expected.isEnabled(), actual.isEnabled(), "enabled");
+        Assertions.assertEquals(expected.isHideOnLogin(), actual.isHideOnLogin(), "hideOnLogin");
+        Assertions.assertEquals(expected.getFirstBrokerLoginFlowAlias(), actual.getFirstBrokerLoginFlowAlias(), "firstBrokerLoginFlowAlias");
+        Assertions.assertEquals(expected.getConfig(), actual.getConfig(), "config");
+    }
+
+    private void assertCreatedSamlIdp(IdentityProviderRepresentation idp, boolean enabled, boolean postBindingResponse) {
+        //System.out.println("idp: " + idp);
+        Assertions.assertNotNull(idp, "IdentityProviderRepresentation not null");
+        Assertions.assertNotNull(idp.getInternalId(), "internalId");
+        Assertions.assertEquals("saml", idp.getAlias(), "alias");
+        Assertions.assertEquals("saml", idp.getProviderId(), "providerId");
+        Assertions.assertEquals(enabled, idp.isEnabled(), "enabled");
+        Assertions.assertTrue(idp.isHideOnLogin(), "hideOnLogin");
+        Assertions.assertNull(idp.getFirstBrokerLoginFlowAlias(), "firstBrokerLoginFlowAlias");
+        assertSamlConfig(idp.getConfig(), postBindingResponse, false);
+    }
+
+    private void assertSamlConfig(Map<String, String> config, boolean postBindingResponse, boolean hasHideOnLoginPage) {
+        // import endpoint simply converts IDPSSODescriptor into key value pairs.
+        // check that saml-idp-metadata.xml was properly converted into key value pairs
+        //System.out.println(config);
+        List<String> keys = new ArrayList<>(List.of("syncMode",
+                "validateSignature",
+                "singleLogoutServiceUrl",
+                "postBindingLogout",
+                "postBindingResponse",
+                "artifactBindingResponse",
+                "postBindingAuthnRequest",
+                "singleSignOnServiceUrl",
+                "artifactResolutionServiceUrl",
+                "wantAuthnRequestsSigned",
+                "nameIDPolicyFormat",
+                "signingCertificate",
+                "addExtensionsElementWithKeyInfo",
+                "loginHint",
+                "idpEntityId"
+        ));
+        if (hasHideOnLoginPage) {
+            keys.add("hideOnLoginPage");
+        }
+        assertThat(config.keySet(), containsInAnyOrder(keys.toArray()));
+        assertThat(config, hasEntry("validateSignature", "true"));
+        assertThat(config, hasEntry("singleLogoutServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml"));
+        assertThat(config, hasEntry("artifactResolutionServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml/resolve"));
+        assertThat(config, hasEntry("postBindingResponse", Boolean.toString(postBindingResponse)));
+        assertThat(config, hasEntry("artifactBindingResponse", "false"));
+        assertThat(config, hasEntry("postBindingAuthnRequest", Boolean.toString(postBindingResponse)));
+        assertThat(config, hasEntry("singleSignOnServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml"));
+        assertThat(config, hasEntry("wantAuthnRequestsSigned", "true"));
+        assertThat(config, hasEntry("addExtensionsElementWithKeyInfo", "false"));
+        assertThat(config, hasEntry("nameIDPolicyFormat", "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"));
+        if (hasHideOnLoginPage) {
+            assertThat(config, hasEntry("hideOnLoginPage", "true"));
+        }
+        assertThat(config, hasEntry("idpEntityId", "http://localhost:8080/auth/realms/master"));
+        assertThat(config, hasEntry(is("signingCertificate"), notNullValue()));
+    }
+
+    private void assertSamlImport(Map<String, String> config, String expectedSigningCertificates, boolean enabled, boolean postBindingResponse) {
+        //firtsly check and remove enabledFromMetadata from config
+        boolean enabledFromMetadata = Boolean.valueOf(config.get(SAMLIdentityProviderConfig.ENABLED_FROM_METADATA));
+        config.remove(SAMLIdentityProviderConfig.ENABLED_FROM_METADATA);
+        Assert.assertEquals(enabledFromMetadata,enabled);
+        assertSamlConfig(config, postBindingResponse, true);
+        assertThat(config, hasEntry("signingCertificate", expectedSigningCertificates));
+    }
+
+    private void assertSamlExport(String body, boolean postBindingResponse) throws ParsingException, URISyntaxException {
+        //System.out.println(body);
+
+        Object entBody = SAMLParser.getInstance().parse(
+                new ByteArrayInputStream(body.getBytes(Charset.forName("utf-8"))));
+
+        Assertions.assertEquals(EntityDescriptorType.class, entBody.getClass(), "Parsed export type");
+        EntityDescriptorType entity = (EntityDescriptorType) entBody;
+
+        Assertions.assertEquals(keycloakUrls.getBaseUrl() + "/realms/default", entity.getEntityID(), "EntityID");
+
+        Assertions.assertNotNull(entity.getChoiceType(), "ChoiceType not null");
+        Assertions.assertEquals(1, entity.getChoiceType().size(), "ChoiceType.size");
+
+        List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = entity.getChoiceType().get(0).getDescriptors();
+        Assertions.assertNotNull(descriptors, "Descriptors not null");
+        Assertions.assertEquals(1, descriptors.size(), "Descriptors.size");
+
+        SPSSODescriptorType desc = descriptors.get(0).getSpDescriptor();
+        Assertions.assertNotNull(desc, "SPSSODescriptor not null");
+
+        Assertions.assertTrue(desc.isAuthnRequestsSigned(), "AuthnRequestsSigned");
+
+        Set<String> expected = new HashSet<>(Arrays.asList(
+                "urn:oasis:names:tc:SAML:2.0:protocol"));
+
+        Set<String> actual = new HashSet<>(desc.getProtocolSupportEnumeration());
+
+        Assertions.assertEquals(expected, actual, "ProtocolSupportEnumeration");
+
+        Assertions.assertNotNull(desc.getAssertionConsumerService(), "AssertionConsumerService not null");
+        Assertions.assertEquals(3, desc.getAssertionConsumerService().size(), "AssertionConsumerService.size");
+
+        IndexedEndpointType endpoint = desc.getAssertionConsumerService().get(0);
+        final URI samlUri = new URI(keycloakUrls.getBase() + "/realms/default/broker/saml/endpoint");
+
+        Assertions.assertEquals(samlUri, endpoint.getLocation(), "AssertionConsumerService.Location");
+        Assert.assertEquals(postBindingResponse ? JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri() : JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(),
+                endpoint.getBinding(), "AssertionConsumerService.Binding");
+        Assertions.assertTrue(endpoint.isIsDefault(), "AssertionConsumerService.isDefault");
+
+        endpoint = desc.getAssertionConsumerService().get(1);
+
+        Assertions.assertEquals(samlUri, endpoint.getLocation(), "AssertionConsumerService.Location");
+        Assert.assertEquals(postBindingResponse ? JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri() : JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(),
+                endpoint.getBinding(), "AssertionConsumerService.Binding");
+
+        endpoint = desc.getAssertionConsumerService().get(2);
+
+        Assertions.assertEquals(samlUri, endpoint.getLocation(), "AssertionConsumerService.Location");
+        Assertions.assertEquals(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.getUri(), endpoint.getBinding(), "AssertionConsumerService.Binding");
+
+        Assertions.assertNotNull(desc.getSingleLogoutService(), "SingleLogoutService not null");
+        Assertions.assertEquals(2, desc.getSingleLogoutService().size(), "SingleLogoutService.size");
+
+        EndpointType sloEndpoint = desc.getSingleLogoutService().get(0);
+
+        Assertions.assertEquals(samlUri, sloEndpoint.getLocation(), "SingleLogoutService.Location");
+        Assertions.assertEquals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri(), sloEndpoint.getBinding(), "SingleLogoutService.Binding");
+
+        sloEndpoint = desc.getSingleLogoutService().get(1);
+
+        Assertions.assertEquals(samlUri, sloEndpoint.getLocation(), "SingleLogoutService.Location");
+        Assertions.assertEquals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(), sloEndpoint.getBinding(), "SingleLogoutService.Binding");
+
+        Assertions.assertNotNull(desc.getKeyDescriptor(), "KeyDescriptor not null");
+        Assertions.assertEquals(1, desc.getKeyDescriptor().size(), "KeyDescriptor.size");
+        KeyDescriptorType keyDesc = desc.getKeyDescriptor().get(0);
+        assertThat(keyDesc, notNullValue());
+        assertThat(keyDesc.getUse(), equalTo(KeyTypes.SIGNING));
+        NodeList cert = keyDesc.getKeyInfo().getElementsByTagNameNS(XMLSignature.XMLNS, "X509Certificate");
+        assertThat("KeyDescriptor.Signing.Cert existence", cert.getLength(), is(1));
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderTest.java
new file mode 100644
index 000000000000..32a9a17a4a7e
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/identityprovider/IdentityProviderTest.java
@@ -0,0 +1,135 @@
+package org.keycloak.tests.admin.identityprovider;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.IdentityProviderStorageProvider;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.Assert;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+
+@KeycloakIntegrationTest
+public class IdentityProviderTest extends AbstractIdentityProviderTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD)
+    ManagedRealm managedRealm;
+
+    @Test
+    public void testFind() {
+        create(createRep("twitter", "twitter idp","twitter", true, Collections.singletonMap("key1", "value1")));
+        create(createRep("linkedin-openid-connect", "linkedin-openid-connect"));
+        create(createRep("google", "google"));
+        create(createRep("github", "github"));
+        create(createRep("facebook", "facebook"));
+
+        Assert.assertNames(managedRealm.admin().identityProviders().findAll(), "facebook", "github", "google", "linkedin-openid-connect", "twitter");
+
+        Assert.assertNames(managedRealm.admin().identityProviders().find(null, true, 0, 2), "facebook", "github");
+        Assert.assertNames(managedRealm.admin().identityProviders().find(null, true, 2, 2), "google", "linkedin-openid-connect");
+        Assert.assertNames(managedRealm.admin().identityProviders().find(null, true, 4, 2), "twitter");
+
+        Assert.assertNames(managedRealm.admin().identityProviders().find("g", true, 0, 5), "github", "google");
+
+        Assert.assertNames(managedRealm.admin().identityProviders().find("g*", true, 0, 5), "github", "google");
+        Assert.assertNames(managedRealm.admin().identityProviders().find("g*", true, 0, 1), "github");
+        Assert.assertNames(managedRealm.admin().identityProviders().find("g*", true, 1, 1), "google");
+
+        Assert.assertNames(managedRealm.admin().identityProviders().find("*oo*", true, 0, 5), "google", "facebook");
+
+        //based on display name search
+        Assert.assertNames(managedRealm.admin().identityProviders().find("*ter i*", true, 0, 5), "twitter");
+
+        List<IdentityProviderRepresentation> results = managedRealm.admin().identityProviders().find("\"twitter\"", true, 0, 5);
+        Assert.assertNames(results, "twitter");
+        Assertions.assertTrue(results.iterator().next().getConfig().isEmpty(), "Result is not in brief representation");
+        results = managedRealm.admin().identityProviders().find("\"twitter\"", null, 0, 5);
+        Assert.assertNames(results, "twitter");
+        Assertions.assertFalse(results.iterator().next().getConfig().isEmpty(), "Config should be present in full representation");
+    }
+
+    @Test
+    public void testFindForLoginPreservesOrderByAlias() {
+
+        create(createRep("twitter", "twitter"));
+        create(createRep("linkedin-openid-connect", "linkedin-openid-connect"));
+        create(createRep("google", "google"));
+        create(createRep("github", "github"));
+        create(createRep("facebook", "facebook"));
+        create(createRep("stackoverflow", "stackoverflow"));
+        create(createRep("openshift-v4", "openshift-v4"));
+
+        runOnServer.run(session -> {
+            // fetch the list of idps available for login (should match all from above list) and ensure they come ordered by alias.
+            List<String> aliases = session.identityProviders().getForLogin(IdentityProviderStorageProvider.FetchMode.ALL, null)
+                    .map(IdentityProviderModel::getAlias).toList();
+            assertThat(aliases, contains("facebook", "github", "google", "linkedin-openid-connect", "openshift-v4", "stackoverflow", "twitter"));
+        });
+    }
+
+    @Test
+    public void testInstalledIdentityProviders() {
+        Response response = managedRealm.admin().identityProviders().getIdentityProviders("oidc");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        Map<String, String> body = response.readEntity(Map.class);
+        assertProviderInfo(body, "oidc", "OpenID Connect v1.0");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("keycloak-oidc");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "keycloak-oidc", "Keycloak OpenID Connect");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("saml");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "saml", "SAML v2.0");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("google");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "google", "Google");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("facebook");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "facebook", "Facebook");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("github");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "github", "GitHub");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("twitter");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "twitter", "Twitter");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("linkedin-openid-connect");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "linkedin-openid-connect", "LinkedIn");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("microsoft");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "microsoft", "Microsoft");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("stackoverflow");
+        Assertions.assertEquals(200, response.getStatus(), "Status");
+        body = response.readEntity(Map.class);
+        assertProviderInfo(body, "stackoverflow", "StackOverflow");
+
+        response = managedRealm.admin().identityProviders().getIdentityProviders("nonexistent");
+        Assertions.assertEquals(400, response.getStatus(), "Status");
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricCustomTagsTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricCustomTagsTest.java
index e781fe09248c..d0d74eecef90 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricCustomTagsTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricCustomTagsTest.java
@@ -1,8 +1,5 @@
 package org.keycloak.tests.admin.metric;
 
-import com.nimbusds.oauth2.sdk.AuthorizationResponse;
-import com.nimbusds.oauth2.sdk.GeneralException;
-import com.nimbusds.oauth2.sdk.TokenResponse;
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.util.EntityUtils;
@@ -13,8 +10,8 @@
 import org.keycloak.testframework.annotations.InjectRealm;
 import org.keycloak.testframework.annotations.InjectUser;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 import org.keycloak.testframework.realm.ManagedUser;
 import org.keycloak.testframework.realm.UserConfig;
@@ -22,14 +19,10 @@
 import org.keycloak.testframework.server.KeycloakServerConfig;
 import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
 import org.keycloak.testframework.server.KeycloakUrls;
-import org.keycloak.testframework.ui.annotations.InjectPage;
-import org.keycloak.testframework.ui.annotations.InjectWebDriver;
-import org.keycloak.testframework.ui.page.LoginPage;
-import org.openqa.selenium.WebDriver;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.io.IOException;
-import java.net.URI;
-import java.net.URL;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -51,16 +44,10 @@ public class PasswordValidationMetricCustomTagsTest {
     @InjectHttpClient
     HttpClient httpClient;
 
-    @InjectWebDriver
-    WebDriver webDriver;
-
-    @InjectPage
-    LoginPage loginPage;
-
     Pattern passValidationRegex = Pattern.compile("keycloak_credentials_password_hashing_validations_total\\{realm=\"([^\"]+)\"} ([.0-9]*)");
 
     @Test
-    void testValidAndInvalidPasswordValidation() throws GeneralException, IOException {
+    void testValidAndInvalidPasswordValidation() throws IOException {
         runAuthorizationCodeFlow(user.getUsername(), "invalid_password", false);
         runAuthorizationCodeFlow(user.getUsername(), user.getPassword(), true);
 
@@ -73,27 +60,14 @@ void testValidAndInvalidPasswordValidation() throws GeneralException, IOExceptio
         Assertions.assertFalse(matcher.find());
     }
 
-    private void runAuthorizationCodeFlow(String username, String password, boolean success) throws GeneralException, IOException {
-        URL authorizationRequestURL = oAuthClient.authorizationRequest();
-        webDriver.navigate().to(authorizationRequestURL);
-        loginPage.fillLogin(username, password);
-        loginPage.submit();
-
+    private void runAuthorizationCodeFlow(String username, String password, boolean success) {
+        AuthorizationEndpointResponse authorizationEndpointResponse = oAuthClient.doLogin(username, password);
         if (!success) {
-            Assertions.assertTrue(oAuthClient.getCallbacks().isEmpty());
+            Assertions.assertFalse(authorizationEndpointResponse.isRedirected());
             return;
         }
-
-        Assertions.assertEquals(1, oAuthClient.getCallbacks().size());
-        URI callbackUri = oAuthClient.getCallbacks().remove(0);
-
-        AuthorizationResponse authorizationResponse = AuthorizationResponse.parse(callbackUri);
-        Assertions.assertTrue(authorizationResponse.indicatesSuccess());
-        Assertions.assertNotNull(authorizationResponse.toSuccessResponse().getAuthorizationCode());
-
-        TokenResponse tokenResponse = oAuthClient.tokenRequest(authorizationResponse.toSuccessResponse().getAuthorizationCode());
-        Assertions.assertTrue(tokenResponse.indicatesSuccess());
-        Assertions.assertNotNull(tokenResponse.toSuccessResponse().getTokens().getAccessToken());
+        AccessTokenResponse accessTokenResponse = oAuthClient.doAccessTokenRequest(authorizationEndpointResponse.getCode());
+        Assertions.assertTrue(accessTokenResponse.isSuccess());
     }
 
     public static class ServerConfigWithMetrics implements KeycloakServerConfig {
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricTest.java
index 98fdc7cc10df..78361cc0f84e 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/metric/PasswordValidationMetricTest.java
@@ -1,8 +1,5 @@
 package org.keycloak.tests.admin.metric;
 
-import com.nimbusds.oauth2.sdk.AuthorizationResponse;
-import com.nimbusds.oauth2.sdk.GeneralException;
-import com.nimbusds.oauth2.sdk.TokenResponse;
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.util.EntityUtils;
@@ -13,8 +10,8 @@
 import org.keycloak.testframework.annotations.InjectRealm;
 import org.keycloak.testframework.annotations.InjectUser;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
-import org.keycloak.testframework.oauth.nimbus.OAuthClient;
-import org.keycloak.testframework.oauth.nimbus.annotations.InjectOAuthClient;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
 import org.keycloak.testframework.realm.ManagedRealm;
 import org.keycloak.testframework.realm.ManagedUser;
 import org.keycloak.testframework.realm.UserConfig;
@@ -22,14 +19,12 @@
 import org.keycloak.testframework.server.KeycloakServerConfig;
 import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
 import org.keycloak.testframework.server.KeycloakUrls;
-import org.keycloak.testframework.ui.annotations.InjectPage;
 import org.keycloak.testframework.ui.annotations.InjectWebDriver;
-import org.keycloak.testframework.ui.page.LoginPage;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.openqa.selenium.WebDriver;
 
 import java.io.IOException;
-import java.net.URI;
-import java.net.URL;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -54,13 +49,10 @@ public class PasswordValidationMetricTest {
     @InjectWebDriver
     WebDriver webDriver;
 
-    @InjectPage
-    LoginPage loginPage;
-
     Pattern passValidationRegex = Pattern.compile("keycloak_credentials_password_hashing_validations_total\\{algorithm=\"([^\"]+)\",hashing_strength=\"([^\"]+)\",outcome=\"([^\"]+)\",realm=\"([^\"]+)\"} ([.0-9]*)");
 
     @Test
-    void testValidAndInvalidPasswordValidation() throws GeneralException, IOException {
+    void testValidAndInvalidPasswordValidation() throws IOException {
         runAuthorizationCodeFlow(user.getUsername(), "invalid_password");
         webDriver.manage().deleteAllCookies();
         runAuthorizationCodeFlow(user.getUsername(), user.getPassword());
@@ -89,25 +81,13 @@ void testValidAndInvalidPasswordValidation() throws GeneralException, IOExceptio
         Assertions.assertFalse(matcher.find());
     }
 
-    private void runAuthorizationCodeFlow(String username, String password) throws GeneralException, IOException {
-        URL authorizationRequestURL = oAuthClient.authorizationRequest();
-        webDriver.navigate().to(authorizationRequestURL);
-        loginPage.fillLogin(username, password);
-        loginPage.submit();
-
-        if (oAuthClient.getCallbacks().isEmpty()) {
-            return;
+    private void runAuthorizationCodeFlow(String username, String password) {
+        AuthorizationEndpointResponse authorizationEndpointResponse = oAuthClient.doLogin(username, password);
+        if (authorizationEndpointResponse.isRedirected()) {
+            AccessTokenResponse tokenResponse = oAuthClient.doAccessTokenRequest(authorizationEndpointResponse.getCode());
+            Assertions.assertTrue(tokenResponse.isSuccess());
+            Assertions.assertNotNull(tokenResponse.getAccessToken());
         }
-
-        URI callbackUri = oAuthClient.getCallbacks().remove(0);
-
-        AuthorizationResponse authorizationResponse = AuthorizationResponse.parse(callbackUri);
-        Assertions.assertTrue(authorizationResponse.indicatesSuccess());
-        Assertions.assertNotNull(authorizationResponse.toSuccessResponse().getAuthorizationCode());
-
-        TokenResponse tokenResponse = oAuthClient.tokenRequest(authorizationResponse.toSuccessResponse().getAuthorizationCode());
-        Assertions.assertTrue(tokenResponse.indicatesSuccess());
-        Assertions.assertNotNull(tokenResponse.toSuccessResponse().getTokens().getAccessToken());
     }
 
     public static class ServerConfigWithMetrics implements KeycloakServerConfig {
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialexport/PartialExportTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialexport/PartialExportTest.java
index 6b744792215a..54d5a4618be1 100644
--- a/tests/base/src/test/java/org/keycloak/tests/admin/partialexport/PartialExportTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialexport/PartialExportTest.java
@@ -46,7 +46,7 @@ public class PartialExportTest {
 
     @BeforeEach
     public void initializeRealm() {
-        RealmRepresentation realmRepresentation = loadJson(PartialExportTest.class.getResourceAsStream("/export/partialexport-testrealm.json"), RealmRepresentation.class);
+        RealmRepresentation realmRepresentation = loadJson(PartialExportTest.class.getResourceAsStream("partialexport-testrealm.json"), RealmRepresentation.class);
         adminClient.realms().create(realmRepresentation);
     }
 
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/AbstractPartialImportTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/AbstractPartialImportTest.java
new file mode 100644
index 000000000000..322eaa407ed6
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/AbstractPartialImportTest.java
@@ -0,0 +1,348 @@
+package org.keycloak.tests.admin.partialimport;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.common.constants.ServiceAccountConstants;
+import org.keycloak.models.UserModel;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.GroupRepresentation;
+import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.PartialImportRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.RolesRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectClient;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.injection.LifeCycle;
+import org.keycloak.testframework.realm.ClientConfig;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedClient;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.realm.RealmConfig;
+import org.keycloak.testframework.realm.RealmConfigBuilder;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+import org.keycloak.tests.utils.admin.ApiUtil;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+public class AbstractPartialImportTest {
+
+    @InjectRealm(lifecycle = LifeCycle.METHOD, config = PartialImportRealmConfig.class)
+    ManagedRealm managedRealm;
+
+    @InjectRealm(ref = "master", attachTo = "master")
+    ManagedRealm masterRealm;
+
+    @InjectClient(ref = "clientRolesClient", config = PartialImportRolesClientConfig.class)
+    ManagedClient rolesClient;
+
+    @InjectClient(ref = "clientServiceAccount", config = PartialImportServiceClientConfig.class)
+    ManagedClient serviceClient;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    private static final String CLIENT_ROLES_CLIENT = "clientRolesClient";
+    protected static final String CLIENT_SERVICE_ACCOUNT = "clientServiceAccount";
+    protected static final String USER_PREFIX = "user";
+    private static final String GROUP_PREFIX = "group";
+    protected static final String CLIENT_PREFIX = "client";
+    protected static final String REALM_ROLE_PREFIX = "realmRole";
+    protected static final String CLIENT_ROLE_PREFIX = "clientRole";
+    protected static final String[] IDP_ALIASES = {"twitter", "github", "facebook", "google", "linkedin-openid-connect", "microsoft", "stackoverflow"};
+    protected static final int NUM_ENTITIES = IDP_ALIASES.length;
+    private static final ResourceServerRepresentation resourceServerSampleSettings;
+
+    protected PartialImportRepresentation piRep;
+
+    static {
+        try {
+            resourceServerSampleSettings = JsonSerialization.readValue(
+                    AbstractPartialImportTest.class.getResourceAsStream("sample-authz-partial-import.json"),
+                    ResourceServerRepresentation.class);
+        } catch (IOException e) {
+            throw new IllegalStateException("Cannot load sample resource server configuration", e);
+        }
+    }
+
+    @BeforeEach
+    public void init() {
+        piRep = new PartialImportRepresentation();
+    }
+
+    protected void setFail() {
+        piRep.setIfResourceExists(PartialImportRepresentation.Policy.FAIL.toString());
+    }
+
+    protected void setSkip() {
+        piRep.setIfResourceExists(PartialImportRepresentation.Policy.SKIP.toString());
+    }
+
+    protected void setOverwrite() {
+        piRep.setIfResourceExists(PartialImportRepresentation.Policy.OVERWRITE.toString());
+    }
+
+    protected PartialImportResults doImport() {
+
+        try (Response response = managedRealm.admin().partialImport(piRep)) {
+            return response.readEntity(PartialImportResults.class);
+        }
+    }
+
+    protected void addUsers() {
+        List<UserRepresentation> users = new ArrayList<>();
+
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            UserRepresentation user = UserConfigBuilder.create().username(USER_PREFIX + i).email(USER_PREFIX + i + "@foo.com").name("foo", "bar").build();
+            users.add(user);
+        }
+
+        piRep.setUsers(users);
+    }
+
+    protected void addUsersWithIds() {
+        List<UserRepresentation> users = new ArrayList<>();
+
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            UserRepresentation user = UserConfigBuilder.create().id(UUID.randomUUID().toString()).username(USER_PREFIX + i).email(USER_PREFIX + i + "@foo.com").name("foo", "bar").build();
+            users.add(user);
+        }
+
+        piRep.setUsers(users);
+    }
+
+    protected void addUsersWithTermsAndConditions() {
+        List<UserRepresentation> users = new ArrayList<>();
+        List<String> requiredActions = new ArrayList<>();
+        requiredActions.add(UserModel.RequiredAction.TERMS_AND_CONDITIONS.name());
+
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            UserRepresentation user = UserConfigBuilder.create().username(USER_PREFIX + i).email(USER_PREFIX + i + "@foo.com").name("foo", "bar").build();
+            user.setRequiredActions(requiredActions);
+            users.add(user);
+        }
+
+        piRep.setUsers(users);
+    }
+
+    protected void addGroups() {
+        List<GroupRepresentation> groups = new ArrayList<>();
+
+        for (int i=0; i < NUM_ENTITIES; i++) {
+            GroupRepresentation group = new GroupRepresentation();
+            group.setName(GROUP_PREFIX + i);
+            group.setPath("/" + GROUP_PREFIX + i);
+            groups.add(group);
+        }
+
+        piRep.setGroups(groups);
+    }
+
+    protected void addClients(boolean withServiceAccounts) {
+        List<ClientRepresentation> clients = new ArrayList<>();
+        List<UserRepresentation> serviceAccounts = new ArrayList<>();
+
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            ClientRepresentation client = new ClientRepresentation();
+            client.setClientId(CLIENT_PREFIX + i);
+            client.setName(CLIENT_PREFIX + i);
+            clients.add(client);
+            if (withServiceAccounts) {
+                client.setServiceAccountsEnabled(true);
+                client.setBearerOnly(false);
+                client.setPublicClient(false);
+                client.setAuthorizationSettings(resourceServerSampleSettings);
+                client.setAuthorizationServicesEnabled(true);
+                // create the user service account
+                UserRepresentation serviceAccount = new UserRepresentation();
+                serviceAccount.setUsername(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + client.getClientId());
+                serviceAccount.setEnabled(true);
+                serviceAccount.setEmail(serviceAccount.getUsername() + "@placeholder.org");
+                serviceAccount.setServiceAccountClientId(client.getClientId());
+                serviceAccounts.add(serviceAccount);
+            }
+        }
+
+        if (withServiceAccounts) {
+            if (piRep.getUsers() == null) {
+                piRep.setUsers(new ArrayList<>());
+            }
+            piRep.getUsers().addAll(serviceAccounts);
+        }
+        piRep.setClients(clients);
+    }
+
+    protected void addProviders() {
+        addProviders(false);
+    }
+
+    private void addProviders(boolean withMappers) {
+        List<IdentityProviderRepresentation> providers = new ArrayList<>();
+        List<IdentityProviderMapperRepresentation> mappers = new ArrayList<>();
+
+        for (String alias : IDP_ALIASES) {
+            IdentityProviderRepresentation idpRep = new IdentityProviderRepresentation();
+            idpRep.setAlias(alias);
+            idpRep.setProviderId(alias);
+            idpRep.setEnabled(true);
+            idpRep.setAuthenticateByDefault(false);
+            idpRep.setFirstBrokerLoginFlowAlias("first broker login");
+
+            Map<String, String> config = new HashMap<>();
+            config.put("clientSecret", "secret");
+            config.put("clientId", alias);
+            idpRep.setConfig(config);
+            providers.add(idpRep);
+
+            if(withMappers) {
+                Map<String, String> mapConfig = new HashMap<>();
+                mapConfig.put("external.role", "IDP.TEST_ROLE");
+                mapConfig.put("syncMode", "FORCE");
+                mapConfig.put("role", "TEST_ROLE");
+
+                IdentityProviderMapperRepresentation idpMapRep = new IdentityProviderMapperRepresentation();
+                idpMapRep.setName(alias+"_mapper");
+                idpMapRep.setIdentityProviderAlias(alias);
+                idpMapRep.setIdentityProviderMapper("keycloak-oidc-role-to-role-idp-mapper");
+                idpMapRep.setConfig(mapConfig);
+
+                mappers.add(idpMapRep);
+            }
+        }
+
+        piRep.setIdentityProviders(providers);
+        if (withMappers) {
+            piRep.setIdentityProviderMappers(mappers);
+        }
+    }
+
+    protected void addProviderMappers() {
+        addProviders(true);
+    }
+
+    private List<RoleRepresentation> makeRoles(String prefix) {
+        List<RoleRepresentation> roles = new ArrayList<>();
+
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            RoleRepresentation role = new RoleRepresentation();
+            role.setName(prefix + i);
+            roles.add(role);
+        }
+
+        return roles;
+    }
+
+    protected void addRealmRoles() {
+        RolesRepresentation roles = piRep.getRoles();
+        if (roles == null) roles = new RolesRepresentation();
+        roles.setRealm(makeRoles(REALM_ROLE_PREFIX));
+        piRep.setRoles(roles);
+    }
+
+    protected void addClientRoles() {
+        RolesRepresentation roles = piRep.getRoles();
+        if (roles == null) roles = new RolesRepresentation();
+        Map<String, List<RoleRepresentation>> clientRolesMap = new HashMap<>();
+        clientRolesMap.put(CLIENT_ROLES_CLIENT, makeRoles(CLIENT_ROLE_PREFIX));
+        roles.setClient(clientRolesMap);
+        piRep.setRoles(roles);
+    }
+
+    protected void testFail() {
+        setFail();
+        PartialImportResults results = doImport();
+        assertNull(results.getErrorMessage());
+        results = doImport(); // second time should fail
+        assertNotNull(results.getErrorMessage());
+    }
+
+    protected void testSkip() {
+        testSkip(NUM_ENTITIES);
+    }
+
+    protected void testSkip(int numberEntities) {
+        setSkip();
+        PartialImportResults results = doImport();
+        assertEquals(numberEntities, results.getAdded());
+
+        results = doImport();
+        assertEquals(numberEntities, results.getSkipped());
+    }
+
+    protected void testOverwrite() {
+        testOverwrite(NUM_ENTITIES);
+    }
+
+    protected void testOverwrite(int numberEntities) {
+        setOverwrite();
+        PartialImportResults results = doImport();
+        assertEquals(numberEntities, results.getAdded());
+
+        results = doImport();
+        assertEquals(numberEntities, results.getOverwritten());
+    }
+
+    private static class PartialImportRealmConfig implements RealmConfig {
+
+        @Override
+        public RealmConfigBuilder configure(RealmConfigBuilder builder) {
+            builder.duplicateEmailsAllowed(false);
+
+            return builder;
+        }
+    }
+
+    private static class PartialImportRolesClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder builder) {
+            builder.clientId(CLIENT_ROLES_CLIENT);
+            builder.name(CLIENT_ROLES_CLIENT);
+            builder.protocol("openid-connect");
+
+            return builder;
+        }
+    }
+
+    private static class PartialImportServiceClientConfig implements ClientConfig {
+
+        @Override
+        public ClientConfigBuilder configure(ClientConfigBuilder builder) {
+            builder.clientId(CLIENT_SERVICE_ACCOUNT);
+            builder.name(CLIENT_SERVICE_ACCOUNT);
+            builder.secret("secret");
+            builder.protocol("openid-connect");
+            builder.rootUrl("http://localhost/foo");
+            builder.publicClient(false);
+            builder.serviceAccountsEnabled(true);
+
+            return builder;
+        }
+    }
+
+    public static class PartialImportServerConfig implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder builder) {
+            return builder.dependency("org.keycloak.tests", "keycloak-tests-custom-scripts");
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportClientTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportClientTest.java
new file mode 100644
index 000000000000..7e7425bd7ce1
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportClientTest.java
@@ -0,0 +1,184 @@
+package org.keycloak.tests.admin.partialimport;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.AuthorizationResource;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.common.constants.ServiceAccountConstants;
+import org.keycloak.partialimport.PartialImportResult;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.partialimport.ResourceType;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.PartialImportRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.RolesRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.utils.Assert;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest(config = AbstractPartialImportTest.PartialImportServerConfig.class)
+public class PartialImportClientTest extends AbstractPartialImportTest {
+
+    @Test
+    public void testAddClients() {
+        setFail();
+        addClients(false);
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        for (PartialImportResult result : results.getResults()) {
+            String id = result.getId();
+            ClientResource clientRsc = managedRealm.admin().clients().get(id);
+            ClientRepresentation client = clientRsc.toRepresentation();
+            assertTrue(client.getName().startsWith(CLIENT_PREFIX));
+        }
+    }
+
+    @Test
+    public void testAddClientsWithServiceAccountsAndAuthorization() {
+        setFail();
+        addClients(true);
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getAdded());
+
+        for (PartialImportResult result : results.getResults()) {
+            if (result.getResourceType().equals(ResourceType.CLIENT)) {
+                String id = result.getId();
+                ClientResource clientRsc = managedRealm.admin().clients().get(id);
+                ClientRepresentation client = clientRsc.toRepresentation();
+                assertTrue(client.getName().startsWith(CLIENT_PREFIX));
+                Assertions.assertTrue(client.isServiceAccountsEnabled());
+                Assertions.assertTrue(client.getAuthorizationServicesEnabled());
+                AuthorizationResource authRsc = clientRsc.authorization();
+                ResourceServerRepresentation authRep = authRsc.exportSettings();
+                Assertions.assertNotNull(authRep);
+                Assertions.assertEquals(2, authRep.getResources().size());
+                Assertions.assertEquals(3, authRep.getPolicies().size());
+            } else {
+                UserResource userRsc = managedRealm.admin().users().get(result.getId());
+                Assert.assertTrue(userRsc.toRepresentation().getUsername().startsWith(
+                        ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX));
+            }
+        }
+    }
+
+    @Test
+    public void testAddClientsFail() {
+        addClients(false);
+        testFail();
+    }
+
+    @Test
+    public void testAddClientsSkip() {
+        addClients(false);
+        testSkip();
+    }
+
+    @Test
+    public void testAddClientsSkipWithServiceAccountsAndAuthorization() {
+        addClients(true);
+        setSkip();
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getAdded());
+
+        results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getSkipped());
+    }
+
+    @Test
+    public void testAddClientsOverwrite() {
+        addClients(false);
+        testOverwrite();
+    }
+
+    @Test
+    public void testAddClientsOverwriteWithServiceAccountsAndAuthorization() {
+        addClients(true);
+        setOverwrite();
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getAdded());
+
+        results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getOverwritten());
+    }
+
+    @Test
+    public void testAddClientsOverwriteServiceAccountsWithNoServiceAccounts() {
+        addClients(true);
+        setOverwrite();
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * 2, results.getAdded());
+        // check the service accounts are there
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            List<UserRepresentation> l = managedRealm.admin().users().search(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX + i);
+            Assertions.assertEquals(1, l.size());
+        }
+        // re-import without service accounts enabled
+        piRep = new PartialImportRepresentation();
+        addClients(false);
+        setOverwrite();
+        results = doImport();
+        assertEquals(NUM_ENTITIES, results.getOverwritten());
+        // check the service accounts have been removed
+        for (int i = 0; i < NUM_ENTITIES; i++) {
+            List<UserRepresentation> l = managedRealm.admin().users().search(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX + i);
+            Assertions.assertEquals(0, l.size());
+        }
+    }
+
+    //KEYCLOAK-3042
+    @Test
+    public void testOverwriteExistingClientWithRoles() {
+        setOverwrite();
+
+        ClientRepresentation client = masterRealm.admin().clients().findByClientId("broker").get(0);
+        List<RoleRepresentation> clientRoles = masterRealm.admin().clients().get(client.getId()).roles().list();
+
+        Map<String, List<RoleRepresentation>> clients = new HashMap<>();
+        clients.put(client.getClientId(), clientRoles);
+
+        RolesRepresentation roles = new RolesRepresentation();
+        roles.setClient(clients);
+
+        piRep.setClients(List.of(client));
+        piRep.setRoles(roles);
+
+        doImport();
+    }
+
+    // KEYCLOAK-6058
+    @Test
+    public void testOverwriteExistingInternalClient() {
+        setOverwrite();
+        ClientRepresentation client = masterRealm.admin().clients().findByClientId("security-admin-console").get(0);
+        ClientRepresentation client2 = masterRealm.admin().clients().findByClientId("master-realm").get(0);
+        piRep.setClients(Arrays.asList(client, client2));
+
+        PartialImportResults result = doImport();
+        Assertions.assertEquals(0, result.getOverwritten());
+    }
+
+    @Test
+    public void testOverwriteExistingClientWithServiceAccount() {
+        setOverwrite();
+        piRep.setClients(Collections.singletonList(serviceClient.admin().toRepresentation()));
+
+        Assertions.assertEquals(1, doImport().getOverwritten());
+
+        ClientRepresentation client = managedRealm.admin().clients().findByClientId(CLIENT_SERVICE_ACCOUNT).get(0);
+        Assertions.assertDoesNotThrow(() -> managedRealm.admin().clients().get(client.getId()).getServiceAccountUser());
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportGroupTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportGroupTest.java
new file mode 100644
index 000000000000..38aaa09dfb5f
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportGroupTest.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.tests.admin.partialimport;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+/**
+ * Tests for the partial import endpoint in admin client.  Also tests the
+ * server side functionality of each resource along with "fail, skip, overwrite"
+ * functions.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+@KeycloakIntegrationTest
+public class PartialImportGroupTest extends AbstractPartialImportTest {
+
+    @Test
+    public void testAddGroupsFail() {
+        addGroups();
+        testFail();
+    }
+
+
+    @Test
+    public void testAddGroupsSkip() {
+        addGroups();
+        testSkip();
+    }
+
+    @Test
+    public void testAddGroupsOverwrite() {
+        addGroups();
+        testOverwrite();
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportProvidersTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportProvidersTest.java
new file mode 100644
index 000000000000..1581eb629461
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportProvidersTest.java
@@ -0,0 +1,97 @@
+package org.keycloak.tests.admin.partialimport;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.partialimport.PartialImportResult;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.partialimport.ResourceType;
+import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.Arrays;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest(config = AbstractPartialImportTest.PartialImportServerConfig.class)
+public class PartialImportProvidersTest extends AbstractPartialImportTest {
+
+    @Test
+    public void testAddProviders() {
+        setFail();
+        addProviders();
+
+        PartialImportResults results = doImport();
+        assertEquals(IDP_ALIASES.length, results.getAdded());
+
+        for (PartialImportResult result : results.getResults()) {
+            String id = result.getId();
+            IdentityProviderResource idpRsc = managedRealm.admin().identityProviders().get(id);
+            IdentityProviderRepresentation idp = idpRsc.toRepresentation();
+            Map<String, String> config = idp.getConfig();
+            assertTrue(Arrays.asList(IDP_ALIASES).contains(config.get("clientId")));
+        }
+    }
+
+    @Test
+    public void testAddProviderMappers() {
+        setFail();
+        addProviderMappers();
+
+        PartialImportResults results = doImport();
+        assertEquals(IDP_ALIASES.length*2, results.getAdded());
+
+        for (PartialImportResult result : results.getResults()) {
+            if (ResourceType.IDP.equals(result.getResourceType())) {
+                String id = result.getId();
+                IdentityProviderResource idpRsc = managedRealm.admin().identityProviders().get(id);
+                IdentityProviderMapperRepresentation idpMap = idpRsc.getMappers().get(0);
+                String alias = idpMap.getIdentityProviderAlias();
+                assertTrue(Arrays.asList(IDP_ALIASES).contains(alias));
+                assertEquals(alias + "_mapper", idpMap.getName());
+                assertEquals("keycloak-oidc-role-to-role-idp-mapper", idpMap.getIdentityProviderMapper());
+                assertEquals("IDP.TEST_ROLE", idpMap.getConfig().get("external.role"));
+                assertEquals("FORCE", idpMap.getConfig().get("syncMode"));
+                assertEquals("TEST_ROLE", idpMap.getConfig().get("role"));
+            }
+        }
+    }
+
+    @Test
+    public void testAddProvidersFail() {
+        addProviders();
+        testFail();
+    }
+
+    @Test
+    public void testAddProviderMappersFail() {
+        addProviderMappers();
+        testFail();
+    }
+
+    @Test
+    public void testAddProvidersSkip() {
+        addProviders();
+        testSkip();
+    }
+
+    @Test
+    public void testAddProviderMappersSkip() {
+        addProviderMappers();
+        testSkip(NUM_ENTITIES*2);
+    }
+
+    @Test
+    public void testAddProvidersOverwrite() {
+        addProviders();
+        testOverwrite();
+    }
+
+    @Test
+    public void testAddProviderMappersOverwrite() {
+        addProviderMappers();
+        testOverwrite(NUM_ENTITIES*2);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRealmTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRealmTest.java
new file mode 100644
index 000000000000..1a6c9e1dc0c0
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRealmTest.java
@@ -0,0 +1,72 @@
+package org.keycloak.tests.admin.partialimport;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+@KeycloakIntegrationTest(config = AbstractPartialImportTest.PartialImportServerConfig.class)
+public class PartialImportRealmTest extends AbstractPartialImportTest {
+
+    private static final int NUM_RESOURCE_TYPES = 6;
+
+    @Test
+    public void testEverythingFail() {
+        setFail();
+        importEverything(false);
+        PartialImportResults results = doImport(); // second import will fail because not allowed to skip or overwrite
+        assertNotNull(results.getErrorMessage());
+    }
+
+    @Test
+    public void testEverythingSkip() {
+        setSkip();
+        importEverything(false);
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getSkipped());
+    }
+
+    @Test
+    public void testEverythingSkipWithServiceAccounts() {
+        setSkip();
+        importEverything(true);
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getSkipped());
+    }
+
+    @Test
+    public void testEverythingOverwrite() {
+        setOverwrite();
+        importEverything(false);
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getOverwritten());
+    }
+
+    @Test
+    public void testEverythingOverwriteWithServiceAccounts() {
+        setOverwrite();
+        importEverything(true);
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getOverwritten());
+    }
+
+    private void importEverything(boolean withServiceAccounts) {
+        addUsers();
+        addGroups();
+        addClients(withServiceAccounts);
+        addProviders();
+        addRealmRoles();
+        addClientRoles();
+
+        PartialImportResults results = doImport();
+        assertNull(results.getErrorMessage());
+        if (withServiceAccounts) {
+            assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getAdded());
+        } else {
+            assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getAdded());
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRolesTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRolesTest.java
new file mode 100644
index 000000000000..b372d569ba47
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportRolesTest.java
@@ -0,0 +1,100 @@
+package org.keycloak.tests.admin.partialimport;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.RoleResource;
+import org.keycloak.partialimport.PartialImportResult;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.RolesRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest(config = AbstractPartialImportTest.PartialImportServerConfig.class)
+public class PartialImportRolesTest extends AbstractPartialImportTest {
+
+    @Test
+    public void testAddRealmRoles() {
+        setFail();
+        addRealmRoles();
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        for (PartialImportResult result : results.getResults()) {
+            String name = result.getResourceName();
+            RoleResource roleRsc = managedRealm.admin().roles().get(name);
+            RoleRepresentation role = roleRsc.toRepresentation();
+            assertTrue(role.getName().startsWith(REALM_ROLE_PREFIX));
+        }
+    }
+
+    @Test
+    public void testAddClientRoles() {
+        setFail();
+        addClientRoles();
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        List<RoleRepresentation> clientRoles = rolesClient.admin().roles().list();
+        assertEquals(NUM_ENTITIES, clientRoles.size());
+
+        for (RoleRepresentation roleRep : clientRoles) {
+            assertTrue(roleRep.getName().startsWith(CLIENT_ROLE_PREFIX));
+        }
+    }
+
+    @Test
+    public void testAddRealmRolesFail() {
+        addRealmRoles();
+        testFail();
+    }
+
+    @Test
+    public void testAddClientRolesFail() {
+        addClientRoles();
+        testFail();
+    }
+
+    @Test
+    public void testAddRealmRolesSkip() {
+        addRealmRoles();
+        testSkip();
+    }
+
+    @Test
+    public void testAddClientRolesSkip() {
+        addClientRoles();
+        testSkip();
+    }
+
+    @Test
+    public void testAddRealmRolesOverwrite() {
+        addRealmRoles();
+        testOverwrite();
+    }
+
+    @Test
+    public void testAddClientRolesOverwrite() {
+        addClientRoles();
+        testOverwrite();
+    }
+
+    @Test
+    public void testOverwriteDefaultRole() {
+        setOverwrite();
+
+        RolesRepresentation roles = new RolesRepresentation();
+        RoleRepresentation oldDefaultRole = managedRealm.admin().toRepresentation().getDefaultRole();
+        roles.setRealm(Collections.singletonList(oldDefaultRole));
+        piRep.setRoles(roles);
+
+        Assertions.assertEquals(1, doImport().getOverwritten(), "default role should have been overwritten");
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportUserTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportUserTest.java
new file mode 100644
index 000000000000..32d8fe879c9e
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/partialimport/PartialImportUserTest.java
@@ -0,0 +1,191 @@
+package org.keycloak.tests.admin.partialimport;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.authentication.requiredactions.TermsAndConditions;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.partialimport.PartialImportResult;
+import org.keycloak.partialimport.PartialImportResults;
+import org.keycloak.representations.idm.AdminEventRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import static org.hamcrest.CoreMatchers.hasItem;
+import static org.hamcrest.CoreMatchers.startsWith;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.equalTo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@KeycloakIntegrationTest(config = AbstractPartialImportTest.PartialImportServerConfig.class)
+public class PartialImportUserTest extends AbstractPartialImportTest {
+
+    @Test
+    public void testAddUsers() {
+        adminEvents.clear();
+
+        setFail();
+        addUsers();
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        // Need to do this way as admin events from partial import are unsorted
+        Set<String> userIds = new HashSet<>();
+        for (int i=0 ; i<NUM_ENTITIES ; i++) {
+            AdminEventRepresentation adminEvent = adminEvents.poll();
+            Assertions.assertEquals(managedRealm.getId(), adminEvent.getRealmId());
+            Assertions.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
+            Assertions.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
+            assertThat(adminEvent.getResourceType(), equalTo(org.keycloak.events.admin.ResourceType.REALM.name()));
+            String userId = adminEvent.getResourcePath().substring(6);
+            userIds.add(userId);
+        }
+
+        Assertions.assertNull(adminEvents.poll());
+
+
+        for (PartialImportResult result : results.getResults()) {
+            String id = result.getId();
+            UserResource userRsc = managedRealm.admin().users().get(id);
+            UserRepresentation user = userRsc.toRepresentation();
+            assertThat(user.getUsername(), startsWith(USER_PREFIX));
+            assertThat(userIds, hasItem(id));
+        }
+    }
+
+    @Test
+    public void testAddUsersWithIds() {
+        adminEvents.clear();
+
+        setFail();
+        addUsersWithIds();
+
+        Set<String> userRepIds = new HashSet<>();
+        for (UserRepresentation userRep : piRep.getUsers()) {
+            userRepIds.add(userRep.getId());
+        }
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        // Need to do this way as admin events from partial import are unsorted
+        Set<String> userIds = new HashSet<>();
+        for (int i=0 ; i<NUM_ENTITIES ; i++) {
+            AdminEventRepresentation adminEvent = adminEvents.poll();
+            Assertions.assertEquals(managedRealm.getId(), adminEvent.getRealmId());
+            Assertions.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
+            Assertions.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
+            assertThat(adminEvent.getResourceType(), equalTo(org.keycloak.events.admin.ResourceType.REALM.name()));
+            String userId = adminEvent.getResourcePath().substring(6);
+            userIds.add(userId);
+            assertThat(userRepIds, hasItem(userId));
+        }
+
+        Assertions.assertNull(adminEvents.poll());
+
+        for (PartialImportResult result : results.getResults()) {
+            String id = result.getId();
+            UserResource userRsc = managedRealm.admin().users().get(id);
+            UserRepresentation user = userRsc.toRepresentation();
+            assertThat(user.getUsername(), startsWith(USER_PREFIX));
+            assertThat(userIds, hasItem(id));
+            assertThat(userRepIds, hasItem(id));
+        }
+    }
+
+    @Test
+    public void testAddUsersWithDuplicateEmailsForbidden() {
+        adminEvents.clear();
+
+        setFail();
+        addUsers();
+
+        UserRepresentation user = UserConfigBuilder.create().username(USER_PREFIX + 999).email(USER_PREFIX + 1 + "@foo.com").name("foo", "bar").build();
+        piRep.getUsers().add(user);
+
+        try (Response response = managedRealm.admin().partialImport(piRep)) {
+            assertEquals(409, response.getStatus());
+        }
+    }
+
+    @Test
+    public void testAddUsersWithDuplicateEmailsAllowed() {
+
+        RealmRepresentation realmRep = managedRealm.admin().toRepresentation();
+        realmRep.setDuplicateEmailsAllowed(true);
+        managedRealm.admin().update(realmRep);
+
+        adminEvents.clear();
+
+        setFail();
+        addUsers();
+        doImport();
+
+        UserRepresentation user = UserConfigBuilder.create().username(USER_PREFIX + 999).email(USER_PREFIX + 1 + "@foo.com").name("foo", "bar").build();
+        piRep.setUsers(List.of(user));
+
+        PartialImportResults results = doImport();
+        assertEquals(1, results.getAdded());
+    }
+
+    @Test
+    public void testAddUsersWithTermsAndConditions() {
+        adminEvents.clear();
+
+        setFail();
+        addUsersWithTermsAndConditions();
+
+        PartialImportResults results = doImport();
+        assertEquals(NUM_ENTITIES, results.getAdded());
+
+        // Need to do this way as admin events from partial import are unsorted
+        Set<String> userIds = new HashSet<>();
+        for (int i=0 ; i<NUM_ENTITIES ; i++) {
+            AdminEventRepresentation adminEvent = adminEvents.poll();
+            Assertions.assertEquals(managedRealm.getId(), adminEvent.getRealmId());
+            Assertions.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
+            Assertions.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
+            String userId = adminEvent.getResourcePath().substring(6);
+            userIds.add(userId);
+        }
+
+        Assertions.assertNull(adminEvents.poll());
+
+        for (PartialImportResult result : results.getResults()) {
+            String id = result.getId();
+            UserResource userRsc = managedRealm.admin().users().get(id);
+            UserRepresentation user = userRsc.toRepresentation();
+            assertTrue(user.getUsername().startsWith(USER_PREFIX));
+            Assertions.assertTrue(userIds.contains(id));
+            assertThat(user.getRequiredActions(), contains(TermsAndConditions.PROVIDER_ID));
+        }
+    }
+
+    @Test
+    public void testAddUsersFail() {
+        addUsers();
+        testFail();
+    }
+
+    @Test
+    public void testAddUsersSkip() {
+        addUsers();
+        testSkip();
+    }
+
+    @Test
+    public void testAddUsersOverwrite() {
+        addUsers();
+        testOverwrite();
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/tracing/TracingTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/tracing/TracingTest.java
new file mode 100644
index 000000000000..9b4903c8bac1
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/tracing/TracingTest.java
@@ -0,0 +1,57 @@
+package org.keycloak.tests.admin.tracing;
+
+import org.junit.jupiter.api.Test;
+import org.keycloak.connections.httpclient.DefaultHttpClientFactory;
+import org.keycloak.connections.httpclient.HttpClientProvider;
+import org.keycloak.quarkus.runtime.tracing.OTelHttpClientFactory;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+@KeycloakIntegrationTest(config = TracingTest.ServerConfigWithTracing.class)
+public class TracingTest {
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    @Test
+    public void defaultSettingsIsUsed() {
+        runOnServer.run(session -> {
+            var defaultFactory = session.getKeycloakSessionFactory().getProviderFactory(HttpClientProvider.class, "default");
+            assertThat(defaultFactory, notNullValue());
+            assertThat(defaultFactory instanceof OTelHttpClientFactory, is(false));
+            assertThat(defaultFactory instanceof DefaultHttpClientFactory, is(true));
+
+            var defaultConfig = ((DefaultHttpClientFactory) defaultFactory).getConfig();
+            assertThat(defaultConfig, notNullValue());
+            assertThat(defaultConfig.get("connection-ttl-millis"), is("1"));
+            assertThat(defaultConfig.get("socket-timeout-millis"), is("2222"));
+
+            var otelFactory = session.getKeycloakSessionFactory().getProviderFactory(HttpClientProvider.class);
+            assertThat(otelFactory, notNullValue());
+            assertThat(otelFactory instanceof OTelHttpClientFactory, is(true));
+
+            var otelConfig = ((OTelHttpClientFactory) otelFactory).getConfig();
+            assertThat(otelConfig.get("connection-ttl-millis"), is("1"));
+            assertThat(otelConfig.get("socket-timeout-millis"), is("2222"));
+        });
+    }
+
+    public static class ServerConfigWithTracing implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.option("tracing-enabled", "true")
+                    .option("spi-connections-http-client-default-connection-ttl-millis", "1")
+                    .option("spi-connections-http-client-default-socket-timeout-millis", "2222")
+                    .option("spi-connections-http-client-opentelemetry-connection-ttl-millis", "2") // not accepted
+                    .option("spi-connections-http-client-opentelemetry-socket-timeout-millis", "3333"); // not accepted
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/AbstractUserStorageRestTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/AbstractUserStorageRestTest.java
new file mode 100644
index 000000000000..767c12cea00a
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/AbstractUserStorageRestTest.java
@@ -0,0 +1,48 @@
+package org.keycloak.tests.admin.userstorage;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.testframework.annotations.InjectAdminEvents;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.events.AdminEvents;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+public class AbstractUserStorageRestTest {
+
+    @InjectRealm
+    ManagedRealm managedRealm;
+
+    @InjectAdminEvents
+    AdminEvents adminEvents;
+
+    protected String createComponent(ComponentRepresentation rep) {
+        Response resp = managedRealm.admin().components().add(rep);
+        Assertions.assertEquals(201, resp.getStatus());
+        resp.close();
+        String id = ApiUtil.getCreatedId(resp);
+
+        adminEvents.clear();
+        return id;
+    }
+
+    protected void removeComponent(String id) {
+        managedRealm.admin().components().component(id).remove();
+        adminEvents.clear();
+    }
+
+    protected ComponentRepresentation createBasicLDAPProviderRep() {
+        ComponentRepresentation ldapRep = new ComponentRepresentation();
+        ldapRep.setName("ldap2");
+        ldapRep.setProviderId("ldap");
+        ldapRep.setProviderType(UserStorageProvider.class.getName());
+        ldapRep.setConfig(new MultivaluedHashMap<>());
+        ldapRep.getConfig().putSingle("priority", Integer.toString(2));
+        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.WRITABLE.name());
+        return ldapRep;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageKerberosRestTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageKerberosRestTest.java
new file mode 100644
index 000000000000..0aafbf07b715
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageKerberosRestTest.java
@@ -0,0 +1,185 @@
+package org.keycloak.tests.admin.userstorage;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.common.constants.KerberosConstants;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.events.admin.OperationType;
+import org.keycloak.events.admin.ResourceType;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.events.AdminEventAssertion;
+import org.keycloak.tests.utils.admin.AdminEventPaths;
+
+import java.util.List;
+
+@KeycloakIntegrationTest
+public class UserStorageKerberosRestTest extends AbstractUserStorageRestTest {
+
+    @Test
+    public void testKerberosAuthenticatorEnabledAutomatically() {
+        // Assert kerberos authenticator DISABLED
+        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+
+        // create LDAP provider with kerberos
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
+
+        String id = createComponent(ldapRep);
+
+        // Assert kerberos authenticator ALTERNATIVE
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
+
+        // Switch kerberos authenticator to DISABLED
+        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
+        managedRealm.admin().flows().updateExecutions("browser", kerberosExecution);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
+
+        // update LDAP provider with kerberos (without changing kerberos switch)
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        managedRealm.admin().components().component(id).update(ldapRep);
+        adminEvents.clear();
+
+        // Assert kerberos authenticator is still DISABLED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+
+        // update LDAP provider with kerberos (with changing kerberos switch to disabled)
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "false");
+        managedRealm.admin().components().component(id).update(ldapRep);
+        adminEvents.clear();
+
+        // Assert kerberos authenticator is still DISABLED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+
+        // update LDAP provider with kerberos (with changing kerberos switch to enabled)
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
+        managedRealm.admin().components().component(id).update(ldapRep);
+        adminEvents.clear();
+
+        // Assert kerberos authenticator is still ALTERNATIVE
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
+
+        // Cleanup
+        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
+        managedRealm.admin().flows().updateExecutions("browser", kerberosExecution);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
+        removeComponent(id);
+    }
+
+    @Test
+    public void testKerberosAuthenticatorChangedOnlyIfDisabled() {
+        // Change kerberos to REQUIRED
+        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
+        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString());
+        managedRealm.admin().flows().updateExecutions("browser", kerberosExecution);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
+
+        // create LDAP provider with kerberos
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
+
+        String id = createComponent(ldapRep);
+
+
+        // Assert kerberos authenticator still REQUIRED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.REQUIRED.toString());
+
+        // update LDAP provider with kerberos
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        managedRealm.admin().components().component(id).update(ldapRep);
+        adminEvents.clear();
+
+        // Assert kerberos authenticator still REQUIRED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.REQUIRED.toString());
+
+        // Cleanup
+        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
+        managedRealm.admin().flows().updateExecutions("browser", kerberosExecution);
+        AdminEventAssertion.assertEvent(adminEvents.poll(), OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
+        removeComponent(id);
+
+    }
+
+
+    // KEYCLOAK-4438
+    @Test
+    public void testKerberosAuthenticatorDisabledWhenProviderRemoved() {
+        // Assert kerberos authenticator DISABLED
+        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+
+        // create LDAP provider with kerberos
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
+
+
+        String id = createComponent(ldapRep);
+
+        // Assert kerberos authenticator ALTERNATIVE
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
+
+        // Remove LDAP provider
+        managedRealm.admin().components().component(id).remove();
+
+        // Assert kerberos authenticator DISABLED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+
+        // Add kerberos provider
+        ComponentRepresentation kerberosRep = new ComponentRepresentation();
+        kerberosRep.setName("kerberos");
+        kerberosRep.setProviderId("kerberos");
+        kerberosRep.setProviderType(UserStorageProvider.class.getName());
+        kerberosRep.setConfig(new MultivaluedHashMap<>());
+        kerberosRep.getConfig().putSingle("priority", Integer.toString(2));
+
+        id = createComponent(kerberosRep);
+
+
+        // Assert kerberos authenticator ALTERNATIVE
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
+
+        // Switch kerberos authenticator to REQUIRED
+        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString());
+        managedRealm.admin().flows().updateExecutions("browser", kerberosExecution);
+
+        // Remove Kerberos provider
+        managedRealm.admin().components().component(id).remove();
+
+        // Assert kerberos authenticator DISABLED
+        kerberosExecution = findKerberosExecution();
+        Assertions.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
+    }
+
+    private AuthenticationExecutionInfoRepresentation findKerberosExecution() {
+        AuthenticationExecutionInfoRepresentation kerberosExecution = null;
+        List<AuthenticationExecutionInfoRepresentation> executionReps = managedRealm.admin().flows().getExecutions("browser");
+        kerberosExecution = findExecutionByProvider("auth-spnego", executionReps);
+
+        Assertions.assertNotNull(kerberosExecution);
+        return kerberosExecution;
+    }
+
+    private static AuthenticationExecutionInfoRepresentation findExecutionByProvider(String provider, List<AuthenticationExecutionInfoRepresentation> executions) {
+        for (AuthenticationExecutionInfoRepresentation exec : executions) {
+            if (provider.equals(exec.getProviderId())) {
+                return exec;
+            }
+        }
+        return null;
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageRestTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageRestTest.java
new file mode 100644
index 000000000000..c2be410a82d1
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/admin/userstorage/UserStorageRestTest.java
@@ -0,0 +1,259 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.admin.userstorage;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.resource.ComponentResource;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.representations.idm.ComponentTypeRepresentation;
+import org.keycloak.representations.idm.ConfigPropertyRepresentation;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.storage.ldap.mappers.LDAPStorageMapper;
+import org.keycloak.storage.ldap.mappers.membership.CommonLDAPGroupMapperConfig;
+import org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapperFactory;
+import org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig;
+import org.keycloak.storage.ldap.mappers.membership.role.RoleLDAPStorageMapperFactory;
+import org.keycloak.storage.ldap.mappers.membership.role.RoleMapperConfig;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.utils.Assert;
+
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.core.Response;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@KeycloakIntegrationTest
+public class UserStorageRestTest extends AbstractUserStorageRestTest {
+
+    @Test
+    public void testValidateAndCreateLdapProviderCustomSearchFilter() {
+        // Invalid filter
+
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "dc=something");
+
+        Response resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Invalid filter
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something");
+        resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Invalid filter
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "dc=something)");
+        resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Assert nothing created so far
+        Assertions.assertTrue(managedRealm.admin().components().query(managedRealm.getId(), UserStorageProvider.class.getName()).isEmpty());
+        Assertions.assertNull(adminEvents.poll());
+
+
+        // Valid filter. Creation success
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something)");
+        String id1 = createComponent(ldapRep);
+
+        // Missing filter is ok too. Creation success
+        ComponentRepresentation ldapRep2 = new ComponentRepresentation();
+        ldapRep2.setName("ldap3");
+        ldapRep2.setProviderId("ldap");
+        ldapRep2.setProviderType(UserStorageProvider.class.getName());
+        ldapRep2.setConfig(new MultivaluedHashMap<>());
+        ldapRep2.getConfig().putSingle("priority", Integer.toString(2));
+        ldapRep2.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.UNSYNCED.name());
+        ldapRep2.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager");
+        ldapRep2.getConfig().putSingle(LDAPConstants.BIND_CREDENTIAL, "password");
+        String id2 = createComponent(ldapRep2);
+
+        // Assert both providers created
+        List<ComponentRepresentation> providerInstances = managedRealm.admin().components().query(managedRealm.getId(), UserStorageProvider.class.getName());
+        Assertions.assertEquals(providerInstances.size(), 2);
+
+        // Cleanup
+        removeComponent(id1);
+        removeComponent(id2);
+    }
+
+    @Test
+    public void testValidateAndCreateLdapProviderEditMode() {
+        // Test provider without editMode should fail
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().remove(LDAPConstants.EDIT_MODE);
+
+        Response resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Test provider with READ_ONLY edit mode and validatePasswordPolicy will fail
+        ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.READ_ONLY.name());
+        ldapRep.getConfig().putSingle(LDAPConstants.VALIDATE_PASSWORD_POLICY, "true");
+        resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Test provider with UNSYNCED edit mode and validatePasswordPolicy will fail
+        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.UNSYNCED.name());
+        ldapRep.getConfig().putSingle(LDAPConstants.VALIDATE_PASSWORD_POLICY, "true");
+        resp = managedRealm.admin().components().add(ldapRep);
+        Assertions.assertEquals(400, resp.getStatus());
+        resp.close();
+
+        // Test provider with WRITABLE edit mode and validatePasswordPolicy will fail
+        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.WRITABLE.name());
+        ldapRep.getConfig().putSingle(LDAPConstants.SYNC_REGISTRATIONS, "true");
+        String id1 = createComponent(ldapRep);
+
+        // Cleanup
+        removeComponent(id1);
+    }
+
+    @Test
+    public void testUpdateProvider() {
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager");
+        ldapRep.getConfig().putSingle(LDAPConstants.BIND_CREDENTIAL, "password");
+        String id = createComponent(ldapRep);
+
+        // Assert update with invalid filter should fail
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2");
+        ldapRep.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager-updated");
+        try {
+            managedRealm.admin().components().component(id).update(ldapRep);
+            Assertions.fail("Not expected to successfull update");
+        } catch (BadRequestException bre) {
+            // Expected
+        }
+
+        // Assert nothing was updated
+        assertFederationProvider(managedRealm.admin().components().component(id).toRepresentation(), id, "ldap2", "ldap", LDAPConstants.BIND_DN, "cn=manager", LDAPConstants.BIND_CREDENTIAL, "**********");
+
+        // Change filter to be valid
+        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
+        managedRealm.admin().components().component(id).update(ldapRep);
+        adminEvents.clear();
+
+        // Assert updated successfully
+        ldapRep = managedRealm.admin().components().component(id).toRepresentation();
+        assertFederationProvider(ldapRep, id, "ldap2", "ldap", LDAPConstants.BIND_DN, "cn=manager-updated", LDAPConstants.BIND_CREDENTIAL, "**********",
+                LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
+
+        // Assert update displayName
+        ldapRep.setName("ldap2");
+        managedRealm.admin().components().component(id).update(ldapRep);
+
+        assertFederationProvider(managedRealm.admin().components().component(id).toRepresentation(), id, "ldap2", "ldap",LDAPConstants.BIND_DN, "cn=manager-updated", LDAPConstants.BIND_CREDENTIAL, "**********",
+                LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
+
+        // Cleanup
+        removeComponent(id);
+    }
+
+    // KEYCLOAK-12934
+    @Test
+    public void testLDAPMapperProviderConfigurationForVendorOther() {
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(LDAPConstants.VENDOR, LDAPConstants.VENDOR_OTHER);
+        String ldapModelId = createComponent(ldapRep);
+
+        ComponentTypeRepresentation groupLDAPMapperType = findMapperTypeConfiguration(ldapModelId, GroupLDAPStorageMapperFactory.PROVIDER_ID);
+        ConfigPropertyRepresentation groupRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(groupLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
+
+        // LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
+        List<String> options = groupRetrieverConfigProperty.getOptions();
+        Assert.assertNames(options, GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GroupMapperConfig.GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE);
+        Assertions.assertFalse(groupRetrieverConfigProperty.getHelpText().contains("LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
+
+        ComponentTypeRepresentation roleLDAPMapperType = findMapperTypeConfiguration(ldapModelId, RoleLDAPStorageMapperFactory.PROVIDER_ID);
+        ConfigPropertyRepresentation roleRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(roleLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
+
+        // LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
+        options = roleRetrieverConfigProperty.getOptions();
+        Assert.assertNames(options, RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE, RoleMapperConfig.GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE);
+        Assertions.assertFalse(roleRetrieverConfigProperty.getHelpText().contains("LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
+
+        // Cleanup including mappers
+        removeComponent(ldapModelId);
+    }
+
+    // KEYCLOAK-12934
+    @Test
+    public void testLDAPMapperProviderConfigurationForVendorMSAD() {
+        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
+        ldapRep.getConfig().putSingle(LDAPConstants.VENDOR, LDAPConstants.VENDOR_ACTIVE_DIRECTORY);
+        String ldapModelId = createComponent(ldapRep);
+
+        ComponentTypeRepresentation groupLDAPMapperType = findMapperTypeConfiguration(ldapModelId, GroupLDAPStorageMapperFactory.PROVIDER_ID);
+        ConfigPropertyRepresentation groupRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(groupLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
+
+        // LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
+        List<String> options = groupRetrieverConfigProperty.getOptions();
+        Assert.assertNames(options, GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GroupMapperConfig.GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE,
+                GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY);
+        Assertions.assertTrue(groupRetrieverConfigProperty.getHelpText().contains("LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
+
+        ComponentTypeRepresentation roleLDAPMapperType = findMapperTypeConfiguration(ldapModelId, RoleLDAPStorageMapperFactory.PROVIDER_ID);
+        ConfigPropertyRepresentation roleRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(roleLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
+
+        // LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
+        options = roleRetrieverConfigProperty.getOptions();
+        Assert.assertNames(options, RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE, RoleMapperConfig.GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE,
+                RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY);
+        Assertions.assertTrue(roleRetrieverConfigProperty.getHelpText().contains("LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
+
+        // Cleanup including mappers
+        removeComponent(ldapModelId);
+    }
+
+    private void assertFederationProvider(ComponentRepresentation rep, String id, String displayName, String providerId,
+                                          String... config) {
+        Assertions.assertEquals(id, rep.getId());
+        Assertions.assertEquals(displayName, rep.getName());
+        Assertions.assertEquals(providerId, rep.getProviderId());
+
+        Assert.assertMultivaluedMap(rep.getConfig(), config);
+    }
+
+    private ComponentTypeRepresentation findMapperTypeConfiguration(String ldapModelId, String mapperProviderId) {
+        ComponentResource ldapProvider = managedRealm.admin().components().component(ldapModelId);
+        List<ComponentTypeRepresentation> componentTypes = ldapProvider.getSubcomponentConfig(LDAPStorageMapper.class.getName());
+
+        return componentTypes.stream()
+                .filter(componentType -> mapperProviderId.equals(componentType.getId()))
+                .findFirst()
+                .orElseThrow(() -> new IllegalStateException("Not able to find mapper with provider id: " + mapperProviderId));
+    }
+
+    private  ConfigPropertyRepresentation getUserRolesRetrieveStrategyConfigProperty(ComponentTypeRepresentation componentType, String propertyName) {
+        return componentType.getProperties().stream()
+                .filter(configPropertyRep -> propertyName.equals(configPropertyRep.getName()))
+                .findFirst()
+                .orElseThrow(() -> new IllegalStateException("Not able to find config property with name: " + propertyName));
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/db/DbTest.java b/tests/base/src/test/java/org/keycloak/tests/db/DbTest.java
new file mode 100644
index 000000000000..0df0abffed04
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/db/DbTest.java
@@ -0,0 +1,29 @@
+package org.keycloak.tests.db;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.config.DatabaseOptions;
+import org.keycloak.quarkus.runtime.configuration.Configuration;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.remote.runonserver.InjectRunOnServer;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+
+@KeycloakIntegrationTest
+public class DbTest {
+
+    @InjectRunOnServer
+    RunOnServerClient runOnServer;
+
+    @Test
+    public void ensurePostgreSQLSettingsAreApplied() {
+        runOnServer.run(session -> {
+            if (Configuration.getConfigValue(DatabaseOptions.DB).getValue().equals("postgres") &&
+                Configuration.getConfigValue(DatabaseOptions.DB_DRIVER).getValue().equals("org.postgresql.Driver")) {
+                Assertions.assertEquals("primary", Configuration.getConfigValue(DatabaseOptions.DB_POSTGRESQL_TARGET_SERVER_TYPE).getValue());
+            } else {
+                Assertions.assertNull(Configuration.getConfigValue(DatabaseOptions.DB_POSTGRESQL_TARGET_SERVER_TYPE).getValue());
+            }
+        });
+    }
+
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/infinispan/InfinispanXMLBackwardCompatibilityTest.java b/tests/base/src/test/java/org/keycloak/tests/infinispan/InfinispanXMLBackwardCompatibilityTest.java
new file mode 100644
index 000000000000..2ad970d9ca44
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/infinispan/InfinispanXMLBackwardCompatibilityTest.java
@@ -0,0 +1,34 @@
+package org.keycloak.tests.infinispan;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.realm.ManagedRealm;
+import org.keycloak.testframework.server.KeycloakServerConfig;
+import org.keycloak.testframework.server.KeycloakServerConfigBuilder;
+
+@KeycloakIntegrationTest(config = InfinispanXMLBackwardCompatibilityTest.ServerConfigWithCustomInfinispanXML.class)
+public class InfinispanXMLBackwardCompatibilityTest {
+
+    private static final String CONFIG_FILE = "/embedded-infinispan-config/infinispan-xml-kc26.xml";
+
+    @InjectRealm
+    ManagedRealm realm;
+
+    @Test
+    void testKeycloakStartedSuccessfullyWithOlderInfinispanXML() {
+        RealmRepresentation representation = realm.admin().toRepresentation();
+        Assertions.assertNotNull(representation);
+    }
+
+
+    public static class ServerConfigWithCustomInfinispanXML implements KeycloakServerConfig {
+
+        @Override
+        public KeycloakServerConfigBuilder configure(KeycloakServerConfigBuilder config) {
+            return config.cacheConfigFile(CONFIG_FILE);
+        }
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/suites/DatabaseTestSuite.java b/tests/base/src/test/java/org/keycloak/tests/suites/DatabaseTestSuite.java
index 673fd5d4e74b..6c001f3c0380 100644
--- a/tests/base/src/test/java/org/keycloak/tests/suites/DatabaseTestSuite.java
+++ b/tests/base/src/test/java/org/keycloak/tests/suites/DatabaseTestSuite.java
@@ -4,6 +4,6 @@
 import org.junit.platform.suite.api.Suite;
 
 @Suite
-@SelectPackages({"org.keycloak.tests.admin"})
+@SelectPackages({"org.keycloak.tests.admin", "org.keycloak.tests.db"})
 public class DatabaseTestSuite {
 }
diff --git a/tests/base/src/test/java/org/keycloak/tests/suites/JDKTestSuite.java b/tests/base/src/test/java/org/keycloak/tests/suites/JDKTestSuite.java
new file mode 100644
index 000000000000..bb952522eb21
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/suites/JDKTestSuite.java
@@ -0,0 +1,11 @@
+package org.keycloak.tests.suites;
+
+import org.junit.platform.suite.api.SelectClasses;
+import org.junit.platform.suite.api.Suite;
+import org.keycloak.tests.admin.AdminHeadersTest;
+
+@Suite
+// TODO: Select relevant test classes or packages once they have been migrated
+@SelectClasses(AdminHeadersTest.class)
+public class JDKTestSuite {
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/welcomepage/WelcomePageTest.java b/tests/base/src/test/java/org/keycloak/tests/welcomepage/WelcomePageTest.java
index 4b051a3a2b67..b215a427f8a2 100644
--- a/tests/base/src/test/java/org/keycloak/tests/welcomepage/WelcomePageTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/welcomepage/WelcomePageTest.java
@@ -46,6 +46,11 @@ public class WelcomePageTest {
     @Test
     @Order(1)
     public void localAccessNoAdmin() {
+        // get rid of the bootstrap admin added for db compatibility with the older test framework
+        // it will get added by in subsequent tests
+        var users = adminClient.realms().realm("master").users();
+        users.searchByUsername("admin", true).stream().findFirst().ifPresent(admin -> users.delete(admin.getId()));
+
         welcomePage.navigateTo();
 
         Assertions.assertEquals("Create a temporary administrative user", welcomePage.getWelcomeMessage());
diff --git a/tests/base/src/test/resources/embedded-infinispan-config/infinispan-xml-kc26.xml b/tests/base/src/test/resources/embedded-infinispan-config/infinispan-xml-kc26.xml
new file mode 100644
index 000000000000..377591d71545
--- /dev/null
+++ b/tests/base/src/test/resources/embedded-infinispan-config/infinispan-xml-kc26.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<infinispan
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="urn:infinispan:config:15.0 http://www.infinispan.org/schemas/infinispan-config-15.0.xsd"
+        xmlns="urn:infinispan:config:15.0">
+
+    <cache-container name="keycloak">
+        <transport lock-timeout="60000"/>
+        <local-cache name="realms" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="users" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <distributed-cache name="sessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="authenticationSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="offlineSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="clientSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="offlineClientSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="loginFailures" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <local-cache name="authorization" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <replicated-cache name="work">
+            <expiration lifespan="-1"/>
+        </replicated-cache>
+        <local-cache name="keys" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="3600000"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <distributed-cache name="actionTokens" owners="2">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
+            <memory max-count="-1"/>
+        </distributed-cache>
+    </cache-container>
+</infinispan>
\ No newline at end of file
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/acme-resource-server-cleanup-test.json b/tests/base/src/test/resources/org/keycloak/tests/admin/authz/acme-resource-server-cleanup-test.json
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/authorization-test/acme-resource-server-cleanup-test.json
rename to tests/base/src/test/resources/org/keycloak/tests/admin/authz/acme-resource-server-cleanup-test.json
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-different-bindings.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-different-bindings.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-different-bindings.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-different-bindings.xml
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-disabled.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-disabled.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-disabled.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-disabled.xml
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-encryption-methods.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-encryption-methods.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-encryption-methods.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-encryption-methods.xml
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-two-signing-certs.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-two-signing-certs.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata-two-signing-certs.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata-two-signing-certs.xml
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata.xml
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata_utf8_bom.xml b/tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata_utf8_bom.xml
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/resources/admin-test/saml-idp-metadata_utf8_bom.xml
rename to tests/base/src/test/resources/org/keycloak/tests/admin/identityprovider/saml-idp-metadata_utf8_bom.xml
diff --git a/tests/base/src/test/resources/export/partialexport-testrealm.json b/tests/base/src/test/resources/org/keycloak/tests/admin/partialexport/partialexport-testrealm.json
similarity index 100%
rename from tests/base/src/test/resources/export/partialexport-testrealm.json
rename to tests/base/src/test/resources/org/keycloak/tests/admin/partialexport/partialexport-testrealm.json
diff --git a/tests/base/src/test/resources/org/keycloak/tests/admin/partialimport/sample-authz-partial-import.json b/tests/base/src/test/resources/org/keycloak/tests/admin/partialimport/sample-authz-partial-import.json
new file mode 100644
index 000000000000..9f2120d8d041
--- /dev/null
+++ b/tests/base/src/test/resources/org/keycloak/tests/admin/partialimport/sample-authz-partial-import.json
@@ -0,0 +1,58 @@
+{
+    "allowRemoteResourceManagement": true,
+    "policyEnforcementMode": "ENFORCING",
+    "resources": [
+        {
+            "name": "Default Resource",
+            "type": "urn:default:resources:default",
+            "ownerManagedAccess": false,
+            "attributes": {},
+            "uris": [
+                "/*"
+            ]
+        },
+        {
+            "name": "default",
+            "type": "default",
+            "ownerManagedAccess": true,
+            "displayName": "default",
+            "attributes": {},
+            "uris": [
+                "/default"
+            ]
+        }
+    ],
+    "policies": [
+        {
+            "name": "Default Policy",
+            "description": "A policy that grants access only for users within this realm",
+            "type": "script-scripts/default-policy.js",
+            "logic": "POSITIVE",
+            "decisionStrategy": "AFFIRMATIVE"
+        },
+        {
+            "name": "Default Permission",
+            "description": "A permission that applies to the default resource type",
+            "type": "resource",
+            "logic": "POSITIVE",
+            "decisionStrategy": "UNANIMOUS",
+            "config": {
+                "defaultResourceType": "urn:default:resources:default",
+                "applyPolicies": "[\"Default Policy\"]"
+            }
+        },
+        {
+            "name": "default-permission",
+            "description": "default-permission",
+            "type": "resource",
+            "logic": "POSITIVE",
+            "decisionStrategy": "UNANIMOUS",
+            "config": {
+                "resources": "[\"default\"]",
+                "applyPolicies": "[\"Default Policy\"]"
+            }
+        }
+    ],
+    "scopes": [],
+    "decisionStrategy": "UNANIMOUS"
+}
diff --git a/tests/base/src/test/resources/org/keycloak/tests/admin/vault/default_smtp__password b/tests/base/src/test/resources/org/keycloak/tests/admin/vault/default_smtp__password
new file mode 100644
index 000000000000..f77b00407e0f
--- /dev/null
+++ b/tests/base/src/test/resources/org/keycloak/tests/admin/vault/default_smtp__password
@@ -0,0 +1 @@
+admin
\ No newline at end of file
diff --git a/tests/clustering/README.md b/tests/clustering/README.md
new file mode 100644
index 000000000000..a2a96444ff5a
--- /dev/null
+++ b/tests/clustering/README.md
@@ -0,0 +1,26 @@
+# Running clustering tests
+
+## Mixed cluster
+
+KC_TEST_SERVER_IMAGES   -> if empty, uses the built distribution archive from quarkus/dist directory in all containers
+-> if single value, uses that value in all the containers
+-> if comma separated value ("imageA,imageB"), each container will use the image specified from the list. The number of items must match the cluster size.
+-> "-" special keyword to use the built distribution archive.
+> NOTE: If testing SNAPSHOT versions with "-", it's necessary for it to appear later in the CSV list than
+> non-SNAPSHOT releases in order to avoid "Incorrect state of migration" exceptions.
+
+KC_TEST_SERVER=cluster  -> enables cluster mode (configured by default in clustering module)
+KC_TEST_DATABASE_INTERNAL=true -> configure keycloak with the internal database container IP instead of localhost (configured by default in clustering module)
+
+Example, 2 node cluster, the first using the distribution archive and the second the nightly image
+KC_TEST_DATABASE=postgres KC_TEST_SERVER_IMAGES=-,quay.io/keycloak/keycloak:nightly mvn verify -pl tests/clustering/  -Dtest=MixedVersionClusterTest
+
+Using a mixed cluster with 26.2.3 and 26.2.4
+KC_TEST_DATABASE=postgres KC_TEST_SERVER_IMAGES=quay.io/keycloak/keycloak:26.2.3,quay.io/keycloak/keycloak:26.2.4 mvn verify -pl tests/clustering/  -Dtest=MixedVersionClusterTest
+
+The test has some println to check the state. Example:
+
+```
+url0->http://localhost:32889
+url1->http://localhost:32891
+```
\ No newline at end of file
diff --git a/tests/clustering/pom.xml b/tests/clustering/pom.xml
new file mode 100644
index 000000000000..1abcc44a49c6
--- /dev/null
+++ b/tests/clustering/pom.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.keycloak.tests</groupId>
+        <artifactId>keycloak-tests-parent</artifactId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+
+    <artifactId>keycloak-tests-clustering</artifactId>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.keycloak.testframework</groupId>
+                <artifactId>keycloak-test-framework-bom</artifactId>
+                <version>${project.version}</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-junit5-config</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-clustering</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-db-postgres</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-oauth</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak.testframework</groupId>
+            <artifactId>keycloak-test-framework-ui</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <systemPropertyVariables>
+                        <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
+                        <java.util.concurrent.ForkJoinPool.common.threadFactory>io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory</java.util.concurrent.ForkJoinPool.common.threadFactory>
+                    </systemPropertyVariables>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
\ No newline at end of file
diff --git a/tests/clustering/src/test/java/org/keycloak/tests/compatibility/ClusteredOAuthClientTest.java b/tests/clustering/src/test/java/org/keycloak/tests/compatibility/ClusteredOAuthClientTest.java
new file mode 100644
index 000000000000..b2515ea2b6f2
--- /dev/null
+++ b/tests/clustering/src/test/java/org/keycloak/tests/compatibility/ClusteredOAuthClientTest.java
@@ -0,0 +1,92 @@
+package org.keycloak.tests.compatibility;
+
+import org.htmlunit.WebClient;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.keycloak.testframework.annotations.InjectLoadBalancer;
+import org.keycloak.testframework.annotations.InjectUser;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.clustering.LoadBalancer;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ManagedUser;
+import org.keycloak.testframework.realm.UserConfig;
+import org.keycloak.testframework.realm.UserConfigBuilder;
+import org.keycloak.testframework.ui.annotations.InjectWebDriver;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.htmlunit.HtmlUnitDriver;
+
+@KeycloakIntegrationTest
+public class ClusteredOAuthClientTest {
+
+    @InjectUser(config = OAuthUserConfig.class)
+    ManagedUser user;
+
+    @InjectLoadBalancer
+    LoadBalancer loadBalancer;
+
+    @InjectOAuthClient
+    OAuthClient oauth;
+
+    @InjectWebDriver
+    WebDriver driver;
+
+    @AfterEach
+    public void cleanup() {
+        loadBalancer.node(0);
+        driver.navigate().to("about:blank");
+        if (driver instanceof HtmlUnitDriver htmlUnitDriver) {
+            WebClient webClient = htmlUnitDriver.getWebClient();
+            webClient.getCache().clear();
+            webClient.getCookieManager().clearCookies();
+            webClient.reset();
+        }
+    }
+
+    @ParameterizedTest
+    @CsvSource({"0, 1", "1, 0"})
+    public void testAccessTokenRefresh(int grantNode, int refreshNode) {
+        loadBalancer.node(grantNode);
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+
+        loadBalancer.node(refreshNode);
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
+        Assertions.assertTrue(refreshResponse.isSuccess());
+        Assertions.assertNotEquals(accessTokenResponse.getAccessToken(), refreshResponse.getAccessToken());
+    }
+
+    @ParameterizedTest
+    @CsvSource({
+          "0, 0, 1",
+          "0, 1, 0",
+          "0, 1, 1",
+          "1, 0, 0",
+          "1, 1, 0",
+          "1, 0, 1",
+    })
+    public void testLoginLogout(int loginNode, int tokenNode, int logoutNode) {
+        loadBalancer.node(loginNode);
+        AuthorizationEndpointResponse authResponse = oauth.doLogin(user.getUsername(), user.getPassword());
+        Assertions.assertTrue(authResponse.isRedirected());
+
+        loadBalancer.node(tokenNode);
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(user.getUsername(), user.getPassword());
+        Assertions.assertTrue(accessTokenResponse.isSuccess());
+
+        loadBalancer.node(logoutNode);
+        oauth.logoutForm().idTokenHint(accessTokenResponse.getIdToken()).open();
+    }
+
+    public static class OAuthUserConfig implements UserConfig {
+        @Override
+        public UserConfigBuilder configure(UserConfigBuilder user) {
+            return user.username("myuser").name("First", "Last")
+                  .email("test@local")
+                  .password("password");
+        }
+    }
+}
diff --git a/tests/clustering/src/test/resources/keycloak-test.properties b/tests/clustering/src/test/resources/keycloak-test.properties
new file mode 100644
index 000000000000..db43aed9d3ba
--- /dev/null
+++ b/tests/clustering/src/test/resources/keycloak-test.properties
@@ -0,0 +1,16 @@
+kc.test.server=cluster
+# As clustering is dependent on JDBC_PING, we must use a real database for cluster tests
+kc.test.database=postgres
+
+kc.test.log.level=WARN
+
+kc.test.log.filter=true
+
+kc.test.log.category."org.keycloak.tests".level=INFO
+
+kc.test.log.category."testinfo".level=INFO
+kc.test.log.category."org.keycloak.it".level=INFO
+kc.test.log.category."org.keycloak".level=WARN
+kc.test.log.category."managed.keycloak".level=WARN
+kc.test.log.category."managed.db".level=WARN
+kc.test.log.category."org.keycloak.testframework.clustering".level=WARN
\ No newline at end of file
diff --git a/tests/custom-providers/pom.xml b/tests/custom-providers/pom.xml
new file mode 100755
index 000000000000..a44539543cfe
--- /dev/null
+++ b/tests/custom-providers/pom.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-tests-parent</artifactId>
+        <groupId>org.keycloak.tests</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-tests-custom-providers</artifactId>
+    <name>Keycloak Testsuite Custom Providers</name>
+    <packaging>jar</packaging>
+    <description>Keycloak Testsuite Custom Providers</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyConfigurableRequiredActionFactory.java b/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyConfigurableRequiredActionFactory.java
new file mode 100755
index 000000000000..e661ca1ad7ba
--- /dev/null
+++ b/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyConfigurableRequiredActionFactory.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.actions;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.authentication.RequiredActionFactory;
+import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RequiredActionConfigModel;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+public class DummyConfigurableRequiredActionFactory implements RequiredActionFactory {
+
+    public static final String PROVIDER_ID = "configurable-test-action";
+
+    public static final String SETTING_1 = "setting1";
+
+    public static final String SETTING_2 = "setting2";
+
+    @Override
+    public String getDisplayText() {
+        return "Configurable Test Action";
+    }
+
+    @Override
+    public RequiredActionProvider create(KeycloakSession session) {
+        return new RequiredActionProvider() {
+            @Override
+            public void evaluateTriggers(RequiredActionContext context) {
+
+            }
+
+            @Override
+            public void requiredActionChallenge(RequiredActionContext context) {
+
+                // users can access the given Required Action configuration via RequiredActionContext#getContext()
+                RequiredActionConfigModel configModel = context.getConfig();
+                Map<String, String> config = configModel.getConfig();
+
+                String setting1Value = configModel.getConfigValue(SETTING_1);
+
+                context.success();
+            }
+
+            @Override
+            public void processAction(RequiredActionContext context) {
+            }
+
+            @Override
+            public void close() {
+
+            }
+        };
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    private static final List<ProviderConfigProperty> CONFIG_PROPERTIES = ProviderConfigurationBuilder.create() //
+            .property() //
+            .name(SETTING_1) //
+            .label("Setting 1") //
+            .helpText("Setting 1 Help Text") //
+            .type(ProviderConfigProperty.STRING_TYPE) //
+            .defaultValue("setting1Default") //
+            .add() //
+
+            .property() //
+            .name(SETTING_2) //
+            .label("Setting 2") //
+            .helpText("Setting 2 Help Text") //
+            .type(ProviderConfigProperty.BOOLEAN_TYPE) //
+            .defaultValue("true") //
+            .add() //
+
+            .build();
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        return Stream.concat(
+                List.copyOf(CONFIG_PROPERTIES).stream(),
+                List.copyOf(RequiredActionFactory.super.getConfigMetadata()).stream()
+        ).toList();
+    }
+}
diff --git a/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyRequiredActionFactory.java b/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyRequiredActionFactory.java
new file mode 100755
index 000000000000..600d6f74701f
--- /dev/null
+++ b/tests/custom-providers/src/main/java/org/keycloak/testsuite/actions/DummyRequiredActionFactory.java
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.actions;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.authentication.RequiredActionFactory;
+import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class DummyRequiredActionFactory implements RequiredActionFactory {
+
+    public static final String PROVIDER_ID = "dummy-action";
+
+    @Override
+    public String getDisplayText() {
+        return "Dummy Action";
+    }
+
+    @Override
+    public RequiredActionProvider create(KeycloakSession session) {
+        return new RequiredActionProvider() {
+            @Override
+            public void evaluateTriggers(RequiredActionContext context) {
+
+            }
+
+            @Override
+            public void requiredActionChallenge(RequiredActionContext context) {
+                context.success();
+            }
+
+            @Override
+            public void processAction(RequiredActionContext context) {
+
+            }
+
+            @Override
+            public void close() {
+
+            }
+        };
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
diff --git a/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProvider.java b/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProvider.java
new file mode 100644
index 000000000000..1cec299bfd4f
--- /dev/null
+++ b/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProvider.java
@@ -0,0 +1,30 @@
+package org.keycloak.testsuite.broker.oidc;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider;
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
+import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
+import org.keycloak.broker.provider.IdentityProviderMapper;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author Daniel Fesenmeyer <daniel.fesenmeyer@bosch.com>
+ */
+public class OverwrittenMappersTestIdentityProvider extends KeycloakOIDCIdentityProvider {
+
+    public OverwrittenMappersTestIdentityProvider(KeycloakSession session, OIDCIdentityProviderConfig config) {
+        super(session, config);
+    }
+
+    @Override
+    public boolean isMapperSupported(IdentityProviderMapper mapper) {
+        List<String> compatibleIdps = Arrays.asList(mapper.getCompatibleProviders());
+
+        // provide the same mappers as are available for the parent provider (Keycloak-OIDC)
+        return compatibleIdps.contains(IdentityProviderMapper.ANY_PROVIDER)
+                || compatibleIdps.contains(KeycloakOIDCIdentityProviderFactory.PROVIDER_ID);
+    }
+
+}
diff --git a/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProviderFactory.java b/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProviderFactory.java
new file mode 100644
index 000000000000..2b4cd13ebe66
--- /dev/null
+++ b/tests/custom-providers/src/main/java/org/keycloak/testsuite/broker/oidc/OverwrittenMappersTestIdentityProviderFactory.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2020 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.broker.oidc;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider;
+import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
+import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author Daniel Fesenmeyer <daniel.fesenmeyer@bosch.com>
+ */
+public class OverwrittenMappersTestIdentityProviderFactory extends OIDCIdentityProviderFactory {
+
+    public static final String PROVIDER_ID = "overwritten-mappers-test-id-idp";
+
+    @Override
+    public String getName() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public KeycloakOIDCIdentityProvider create(KeycloakSession session, IdentityProviderModel model) {
+        return new OverwrittenMappersTestIdentityProvider(session, new OIDCIdentityProviderConfig(model));
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
\ No newline at end of file
diff --git a/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory b/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
new file mode 100755
index 000000000000..5186b2f68905
--- /dev/null
+++ b/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.authentication.RequiredActionFactory
@@ -0,0 +1,19 @@
+#
+# Copyright 2016 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.testsuite.actions.DummyRequiredActionFactory
+org.keycloak.testsuite.actions.DummyConfigurableRequiredActionFactory
\ No newline at end of file
diff --git a/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory b/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
new file mode 100644
index 000000000000..05bb4680c81e
--- /dev/null
+++ b/tests/custom-providers/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
@@ -0,0 +1,18 @@
+#
+# Copyright 2020 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.testsuite.broker.oidc.OverwrittenMappersTestIdentityProviderFactory
\ No newline at end of file
diff --git a/tests/custom-scripts/pom.xml b/tests/custom-scripts/pom.xml
new file mode 100755
index 000000000000..861bb82b8338
--- /dev/null
+++ b/tests/custom-scripts/pom.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-tests-parent</artifactId>
+        <groupId>org.keycloak.tests</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-tests-custom-scripts</artifactId>
+    <name>Keycloak Testsuite Custom Scripts</name>
+    <packaging>jar</packaging>
+    <description>Keycloak Testsuite Custom Scripts</description>
+</project>
diff --git a/tests/custom-scripts/src/main/resources/META-INF/keycloak-scripts.json b/tests/custom-scripts/src/main/resources/META-INF/keycloak-scripts.json
new file mode 100644
index 000000000000..ba0290779f6c
--- /dev/null
+++ b/tests/custom-scripts/src/main/resources/META-INF/keycloak-scripts.json
@@ -0,0 +1,13 @@
+{
+  "authenticators": [
+  ],
+  "mappers": [
+  ],
+  "policies": [
+    {
+      "name": "Default Policy",
+      "fileName": "scripts/default-policy.js",
+      "description": "A policy that grants access only for users within this realm"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/tests/custom-scripts/src/main/resources/scripts/default-policy.js b/tests/custom-scripts/src/main/resources/scripts/default-policy.js
new file mode 100644
index 000000000000..2f8b6c929b94
--- /dev/null
+++ b/tests/custom-scripts/src/main/resources/scripts/default-policy.js
@@ -0,0 +1 @@
+$evaluation.grant();
\ No newline at end of file
diff --git a/tests/migration-util/commit-migration.sh b/tests/migration-util/commit-migration.sh
new file mode 100755
index 000000000000..ed4f70493e21
--- /dev/null
+++ b/tests/migration-util/commit-migration.sh
@@ -0,0 +1,156 @@
+#!/bin/bash
+
+declare -a DELETED_FILES_PATHS
+declare -a CREATED_FILES_PATHS
+declare COMMIT_MESSAGE=""
+
+get_deleted_and_created_files() {
+  local deleted_files_paths
+  local deleted_file_path
+  local file_name
+  local new_file_path
+
+  readarray -t deleted_files_paths < <(git diff --cached --name-status --diff-filter=D | grep -E ".*testsuite/integration-arquillian/.*" | awk '{print $2}')
+  if [ ${#deleted_files_paths} -eq 0  ]; then
+    return
+  fi
+
+  for deleted_file_path in "${deleted_files_paths[@]}"; do
+    if [ -z "$deleted_file_path" ]; then
+        continue
+    fi
+
+    file_name=$(basename "$deleted_file_path")
+    new_file_path=$(git diff --cached --name-status --diff-filter=A | grep -E ".*\b${file_name}\b" | awk '{print $2}')
+
+    if [ -n "$new_file_path" ]; then
+      DELETED_FILES_PATHS+=("$deleted_file_path")
+      CREATED_FILES_PATHS+=("$new_file_path")
+    fi
+  done
+}
+
+get_test_names_string() {
+  local file_names_string=""
+  local -a test_names
+  local file_name
+  readarray -t test_names < <(git diff --cached --name-status --diff-filter=MR | grep -E ".*Test.java" | awk '{print $2}' | xargs -I {} basename {})
+  for file_name in "${test_names[@]}"; do
+    if [ -z "$file_names_string" ]; then
+      file_names_string="$file_name"
+    else
+      file_names_string+=", $file_name"
+    fi
+  done
+  echo "$file_names_string"
+}
+
+get_default_commit_message() {
+  local test_names
+  test_names=$(get_test_names_string)
+  echo "Move $test_names to the new testsuite"
+}
+
+read_commit_message() {
+  local default_commit_message
+  default_commit_message=$(get_default_commit_message)
+  default_commit_message+=$'\n\n'"Part of: #34494"
+
+  echo ""
+  echo "Provide a different commit message (optional)"
+  echo "============================================="
+  echo "$default_commit_message"
+  echo "============================================="
+  COMMIT_MESSAGE=""
+  read -r COMMIT_MESSAGE
+  if [ -n "$COMMIT_MESSAGE" ]; then
+    COMMIT_MESSAGE+=$'\n'
+    while IFS= read -r line; do
+      if [ -z "$line" ]; then
+        COMMIT_MESSAGE+=$'\n'
+      else
+        COMMIT_MESSAGE+="$line"$'\n'
+      fi
+    done
+  else
+    echo "Default commit message will be used"
+    COMMIT_MESSAGE="$default_commit_message"
+  fi
+}
+
+commit_stage() {
+  echo "The following files will be commited:"
+  git --no-pager diff --cached --name-status
+
+  read_commit_message
+
+  local confirm
+  echo ""
+  read -p "Commit? [y/n]: " -r confirm
+  if [[ -z "$confirm" || "$confirm" == [yY] || "$confirm" == [yY][eE][sS] ]]; then
+    git commit --signoff -m "$COMMIT_MESSAGE"
+  else
+    exit 1
+  fi
+}
+
+backup_staged_files() {
+  local stage_backup
+  stage_backup="$(git diff --cached --name-status --diff-filter=ACDMR | awk '{print $2}')"
+  stage_backup+=$'\n'"$(git diff --cached --name-status --diff-filter=R | awk '{print $3}')"
+  echo "$stage_backup"
+}
+
+restore_stage() {
+  local stage_backup
+  stage_backup="$1"
+
+  if [ -n "$stage_backup" ]; then
+    echo "$stage_backup" | xargs -I {} git add {} > /dev/null 2>&1
+  fi
+}
+
+commit_test_move() {
+  local stage_backup
+  stage_backup=$(backup_staged_files)
+  set -e
+  git restore --staged .
+  git restore "${DELETED_FILES_PATHS[@]}"
+
+  for i in "${!CREATED_FILES_PATHS[@]}"; do
+    mv "${CREATED_FILES_PATHS[i]}" "${CREATED_FILES_PATHS[i]}.new"
+    mv "${DELETED_FILES_PATHS[i]}" "${CREATED_FILES_PATHS[i]}"
+  done
+
+  git add "${DELETED_FILES_PATHS[@]}" "${CREATED_FILES_PATHS[@]}"
+  git commit --signoff -m "Moving files to the new test suite"
+
+  rm "${CREATED_FILES_PATHS[@]}"
+  for NEW_TEST_PATH in "${CREATED_FILES_PATHS[@]}"; do
+    mv "$NEW_TEST_PATH.new" "$NEW_TEST_PATH"
+  done
+  set +e
+  restore_stage "$stage_backup"
+  echo "Move commit created"
+}
+
+
+if [ -z "$(git diff --cached)" ]; then
+  echo "Git stage is empty. Nothing to do."
+  exit 0
+fi
+cd "$(git rev-parse --show-toplevel)"
+
+get_deleted_and_created_files
+
+if [ ${#DELETED_FILES_PATHS[@]} -eq 0 ]; then
+  echo "Migration can be done with a single commit."
+  commit_stage
+else
+  echo "Git registers some files as deleted and created"
+  commit_test_move
+  git add "${CREATED_FILES_PATHS[@]}"
+  echo ""
+  echo "Committing stage..."
+  commit_stage
+fi
diff --git a/tests/migration-util/migrate.sh b/tests/migration-util/migrate.sh
new file mode 100755
index 000000000000..b3ff31b6554e
--- /dev/null
+++ b/tests/migration-util/migrate.sh
@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+mvn -q clean install
+java -jar target/migration-util.jar $1
+
diff --git a/tests/migration-util/pom.xml b/tests/migration-util/pom.xml
new file mode 100755
index 000000000000..660eb7c164ca
--- /dev/null
+++ b/tests/migration-util/pom.xml
@@ -0,0 +1,61 @@
+<?xml version="1.0"?>
+<!--
+~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+~ and other contributors as indicated by the @author tags.
+~
+~ Licensed under the Apache License, Version 2.0 (the "License");
+~ you may not use this file except in compliance with the License.
+~ You may obtain a copy of the License at
+~
+~ http://www.apache.org/licenses/LICENSE-2.0
+~
+~ Unless required by applicable law or agreed to in writing, software
+~ distributed under the License is distributed on an "AS IS" BASIS,
+~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+~ See the License for the specific language governing permissions and
+~ limitations under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-tests-parent</artifactId>
+        <groupId>org.keycloak.tests</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-tests-migration-util</artifactId>
+    <groupId>org.keycloak.tests.migration</groupId>
+    <name>Keycloak Tests Migration Util</name>
+    <description>Keycloak Tests Migration Util</description>
+
+    <build>
+        <finalName>migration-util</finalName>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifest>
+                            <mainClass>
+                                org.keycloak.test.migration.MigrateTest
+                            </mainClass>
+                        </manifest>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/AddKeycloakIntegrationTestRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/AddKeycloakIntegrationTestRewrite.java
new file mode 100644
index 000000000000..1007cff2c63d
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/AddKeycloakIntegrationTestRewrite.java
@@ -0,0 +1,15 @@
+package org.keycloak.test.migration;
+
+public class AddKeycloakIntegrationTestRewrite extends TestRewrite {
+
+    @Override
+    public void rewrite() {
+        addImport("org.keycloak.testframework.annotations.KeycloakIntegrationTest");
+
+        int classDeclaration = findClassDeclaration();
+        content.add(classDeclaration, "@KeycloakIntegrationTest");
+
+        info(classDeclaration,"Added @KeycloakIntegrationTest");
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/AddManagedResourcesRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/AddManagedResourcesRewrite.java
new file mode 100644
index 000000000000..a691d70a00e9
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/AddManagedResourcesRewrite.java
@@ -0,0 +1,34 @@
+package org.keycloak.test.migration;
+
+public class AddManagedResourcesRewrite extends TestRewrite {
+
+    @Override
+    public void rewrite() {
+        boolean assertAdminEvents = findLine(".*assertAdminEvents[.].*") != -1;
+
+        addImport("org.keycloak.testframework.annotations.InjectRealm");
+        addImport("org.keycloak.testframework.realm.ManagedRealm");
+
+        int classDeclaration = findClassDeclaration();
+
+        content.add(classDeclaration + 1, "");
+        content.add(classDeclaration + 2, "    @InjectRealm");
+        content.add(classDeclaration + 3, "    ManagedRealm managedRealm;");
+
+        info(classDeclaration + 2, "Injecting: ManagedRealm");
+
+        if (assertAdminEvents) {
+            addImport("org.keycloak.testframework.annotations.InjectAdminEvents");
+            addImport("org.keycloak.testframework.events.AdminEvents");
+
+            int managedRealm = findLine("    ManagedRealm managedRealm;");
+
+            content.add(managedRealm + 1, "");
+            content.add(managedRealm + 2, "    @InjectAdminEvents");
+            content.add(managedRealm + 3, "    AdminEvents adminEvents;");
+
+            info(managedRealm + 2, "Injecting: AdminEvents");
+        }
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/AdminEventAssertRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/AdminEventAssertRewrite.java
new file mode 100644
index 000000000000..3f6a39122fea
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/AdminEventAssertRewrite.java
@@ -0,0 +1,26 @@
+package org.keycloak.test.migration;
+
+public class AdminEventAssertRewrite extends TestRewrite {
+
+    @Override
+    public void rewrite() {
+        boolean assertAdminEvents = findLine(".*assertAdminEvents[.]assertEvent\\(.*") != -1;
+
+        if (assertAdminEvents) {
+            addImport("org.keycloak.testframework.events.AdminEventAssertion");
+
+            for (int i = 0; i < content.size(); i++) {
+                String l = content.get(i);
+                String trimmed = l.trim();
+
+                if (trimmed.startsWith("assertAdminEvents.assertEvent(")) {
+                    String updated = l.replaceFirst("assertAdminEvents.assertEvent\\([^,]*", "AdminEventAssertion.assertEvent(adminEvents.poll()");
+                    replaceLine(i, updated);
+
+                    info(i, "Assert admin event rewritten: \n\t\t" + trimmed + "\n\t\t --> \n\t\t" + updated.trim());
+                }
+            }
+        }
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/BeforeRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/BeforeRewrite.java
new file mode 100644
index 000000000000..d0e7a571b05f
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/BeforeRewrite.java
@@ -0,0 +1,25 @@
+package org.keycloak.test.migration;
+
+public class BeforeRewrite extends TestRewrite {
+
+    @Override
+    public void rewrite() {
+        int beforeLine = findLine("import org\\.junit\\.Before;");
+        if (beforeLine >= 0) {
+            String current = content.get(beforeLine);
+            String migrateTo = "import org.junit.jupiter.api.BeforeEach;";
+            replaceLine(beforeLine, migrateTo);
+            info(beforeLine, "Import rewritten: '" + current + "' --> '" + migrateTo + "'");
+
+            for (int i = 0; i < content.size(); i++) {
+                String n = content.get(i);
+                if (n.trim().equals("@Before")) {
+                    content.remove(i);
+                    content.add(i, n.replace("@Before", "@BeforeEach"));
+                    info(i, "@Before rewritten to @BeforeEach");
+                }
+            }
+        }
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/ChangePackageRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/ChangePackageRewrite.java
new file mode 100644
index 000000000000..4f6fb0eed17e
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/ChangePackageRewrite.java
@@ -0,0 +1,15 @@
+package org.keycloak.test.migration;
+
+public class ChangePackageRewrite extends TestRewrite {
+
+    @Override
+    public void rewrite() {
+        int packageDeclaration = findLine("package .*");
+        String oldPackageString = content.get(packageDeclaration);
+        String packageString = oldPackageString.replace("org.keycloak.testsuite", "org.keycloak.tests");
+        replaceLine(packageDeclaration, packageString);
+
+        info(packageDeclaration, "Package rewritten: '" + oldPackageString.substring("package ".length(), oldPackageString.length() - 1) + "' --> '" + packageString.substring("package ".length(), packageString.length() - 1) + "'");
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/CommonStatementsRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/CommonStatementsRewrite.java
new file mode 100644
index 000000000000..bfbb7b74a100
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/CommonStatementsRewrite.java
@@ -0,0 +1,23 @@
+package org.keycloak.test.migration;
+
+import java.util.Map;
+
+public class CommonStatementsRewrite extends TestRewrite {
+
+   private final Map<String, String> STATEMENTS = Map.of(
+           "testRealmResource()", "managedRealm.admin()"
+   );
+
+    @Override
+    public void rewrite() {
+        for (int i = 0; i < content.size(); i++) {
+            String l = content.get(i);
+            for (Map.Entry<String, String> entry : STATEMENTS.entrySet()) {
+                if (l.contains(entry.getKey())) {
+                    replaceLine(i, l.replace(entry.getKey(), entry.getValue()));
+                    info(i, "Statement rewritten: '" + entry.getKey() + "' --> '" + entry.getValue() + "'");
+                }
+            }
+        }
+    }
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/MigrateTest.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/MigrateTest.java
new file mode 100644
index 000000000000..e3e870679b83
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/MigrateTest.java
@@ -0,0 +1,164 @@
+package org.keycloak.test.migration;
+
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.FileReader;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import static java.lang.Thread.sleep;
+
+public class MigrateTest {
+
+    private static final String DIFF_COMMAND = System.getenv("DIFFTOOL");
+
+    final List<Class<? extends TestRewrite>> MIGRATORS = List.of(
+            AddKeycloakIntegrationTestRewrite.class,
+            ChangePackageRewrite.class,
+            RenameImportsRewrite.class,
+            UpdateAssertsRewrite.class,
+            AddManagedResourcesRewrite.class,
+            AdminEventAssertRewrite.class,
+            BeforeRewrite.class,
+            CommonStatementsRewrite.class);
+
+    Path rootPath = getRootPath();
+    Path oldTestsuitePath = rootPath.resolve("testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite").toAbsolutePath();
+    Path newBaseTestPath = rootPath.resolve("tests/base/src/test/java/org/keycloak/tests").toAbsolutePath();
+
+    public static void main(String[] args) throws Exception {
+        MigrateTest migrateTest = new MigrateTest();
+        String testPath = args[0];
+        migrateTest.migrate(testPath);
+    }
+
+    public void migrate(String test) throws Exception {
+        if (!test.endsWith(".java")) {
+            test += ".java";
+        }
+        Path testPath = Path.of(test).normalize().toAbsolutePath();
+        if (!Files.isRegularFile(testPath)) {
+            testPath = getOldTestsuitePath(testPath);
+        }
+
+        Path destinationPath = getDestination(testPath);
+
+        System.out.println("Root:           " + rootPath);
+        System.out.println("Old tests:      " + oldTestsuitePath);
+        System.out.println("Migrated tests: " + newBaseTestPath);
+        System.out.println();
+        System.out.println("Migrating test: " + testPath);
+        System.out.println("To:             " + destinationPath);
+        System.out.println();
+
+        validatePaths(testPath, destinationPath);
+
+        List<String> content = readFileToList(testPath);
+
+        for (Class<? extends TestRewrite> clazz : MIGRATORS) {
+            TestRewrite m = clazz.getConstructor().newInstance();
+            m.setContent(content);
+            m.rewrite();
+        }
+
+        writeFile(content, destinationPath);
+
+        if (DIFF_COMMAND != null && !DIFF_COMMAND.isEmpty()) {
+            List<String> args = new ArrayList<>(List.of(DIFF_COMMAND.split(" ")));
+            args.add(testPath.toString());
+            args.add(destinationPath.toString());
+
+            ProcessBuilder pb = new ProcessBuilder();
+            pb.command(args);
+            Process diffProcess = pb.start();
+            BufferedReader diffOutput = new BufferedReader(new InputStreamReader(diffProcess.getInputStream()));
+            String line = diffOutput.readLine();
+            while (line != null) {
+                System.out.println(line);
+                line = diffOutput.readLine();
+            }
+            diffOutput.close();
+        }
+    }
+
+    private Path getOldTestsuitePath(Path testPath) throws IOException {
+        try (Stream<Path> paths = Files.walk(oldTestsuitePath)) {
+            List<Path> foundPath = paths
+                    .filter(Files::isRegularFile)
+                    .filter(p -> p.getFileName().toString().equals(testPath.getFileName().toString()))
+                    .toList();
+
+            if (foundPath.isEmpty()) {
+                throw new RuntimeException("Test file not found");
+            }
+            if (foundPath.size() != 1) {
+                throw new RuntimeException("Multiple test files found: " + foundPath);
+            }
+            return foundPath.get(0).toAbsolutePath();
+        }
+    }
+
+    private void validatePaths(Path testPath, Path destinationPath) throws IOException {
+        if (!testPath.startsWith(oldTestsuitePath.toString())) {
+            throw new RuntimeException("Can only migrate tests from " + oldTestsuitePath);
+        }
+
+        if (!Files.isRegularFile(testPath)) {
+            throw new RuntimeException("Test file not found");
+        }
+
+        if (!destinationPath.startsWith(newBaseTestPath.toString())) {
+            throw new RuntimeException("Can only migrate tests to " + newBaseTestPath);
+        }
+
+        Path destinationDir = destinationPath.resolve("..");
+        if (!Files.exists(destinationDir)) {
+            Files.createDirectories(destinationDir);
+            System.out.println("Creating a new directory: " + destinationDir);
+        }
+    }
+
+    private Path getDestination(Path testPath) {
+        return Path.of(testPath.toString().replace(oldTestsuitePath.toString(), newBaseTestPath.toString()));
+    }
+
+    private List<String> readFileToList(Path path) throws IOException {
+        List<String> content = new LinkedList<>();
+        try (BufferedReader br = new BufferedReader(new FileReader(path.toFile()))) {
+            for (String l = br.readLine(); l != null; l = br.readLine()) {
+                content.add(l);
+            }
+        }
+        return content;
+    }
+
+    private void writeFile(List<String> content, Path destinationPath) throws IOException {
+        try (BufferedWriter bw = new BufferedWriter(new FileWriter(destinationPath.toFile()))) {
+            for (String l : content) {
+                bw.write(l);
+                bw.newLine();
+            }
+        }
+    }
+
+    private static Path getRootPath() {
+        Path path = Path.of(System.getProperty("user.dir")).normalize().toAbsolutePath();
+        while (Files.isDirectory(path.getParent())) {
+            if (!Files.isRegularFile(path.getParent().resolve("pom.xml"))) {
+                return path;
+            }
+            path = path.getParent();
+        }
+        return null;
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/RenameImportsRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/RenameImportsRewrite.java
new file mode 100644
index 000000000000..f6eb42f0c04c
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/RenameImportsRewrite.java
@@ -0,0 +1,47 @@
+package org.keycloak.test.migration;
+
+import java.util.Map;
+
+public class RenameImportsRewrite extends TestRewrite {
+
+    Map<String, String> IMPORTS = Map.of(
+            "org.junit.Assert", "org.junit.jupiter.api.Assertions",
+            "org.keycloak.testsuite.Assert", "org.keycloak.tests.utils.Assert",
+            "org.junit.Test", "org.junit.jupiter.api.Test",
+            "org.keycloak.testsuite.util.AdminEventPaths", "org.keycloak.tests.utils.admin.AdminEventPaths",
+            "org.keycloak.testsuite.admin.ApiUtil", "org.keycloak.testframework.util.ApiUtil"
+    );
+
+    Map<String, String> STATIC_IMPORTS = Map.of(
+            "org.junit.Assert", "org.junit.jupiter.api.Assertions"
+    );
+
+    @Override
+    public void rewrite() {
+        for (int i = 0; i < findClassDeclaration(); i++) {
+            String l = content.get(i);
+
+            if (l.startsWith("import static ")) {
+                String current = l.substring("import static ".length(), l.lastIndexOf('.'));
+                String method = l.substring(l.lastIndexOf('.'), l.length() - 1);
+                String migrateTo = STATIC_IMPORTS.get(current);
+
+                if (migrateTo != null) {
+                    replaceLine(i, l.replace(current, migrateTo));
+
+                    info(i, "Static import rewritten: '" + current + method + "' --> '" + migrateTo + method + "'");
+                }
+            } else if (l.startsWith("import ")) {
+                String current = l.substring("import ".length(), l.length() - 1);
+                String migrateTo = IMPORTS.get(current);
+
+                if (migrateTo != null) {
+                    replaceLine(i, l.replace(current, migrateTo));
+
+                    info(i, "Import rewritten: '" + current + "' --> '" + migrateTo + "'");
+                }
+            }
+        }
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/TestRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/TestRewrite.java
new file mode 100644
index 000000000000..bbdfc8d145d8
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/TestRewrite.java
@@ -0,0 +1,71 @@
+package org.keycloak.test.migration;
+
+import java.util.List;
+
+public abstract class TestRewrite {
+
+    protected List<String> content;
+
+    public abstract void rewrite();
+
+    protected int findLine(String regex) {
+        for (int i = 0; i < content.size(); i++) {
+            if (content.get(i).matches(regex)) {
+                return i;
+            }
+        }
+        return -1;
+    }
+
+    protected int findLastLine(String regex) {
+        int m = -1;
+        for (int i = 0; i < content.size(); i++) {
+            if (content.get(i).matches(regex)) {
+                m = i;
+            }
+        }
+        return m;
+    }
+
+    protected int findClassDeclaration() {
+        return findLine("public class .*");
+    }
+
+    public void setContent(List<String> content) {
+        this.content = content;
+    }
+
+    public void replaceLine(int line, String updated) {
+        content.remove(line);
+        content.add(line, updated);
+    }
+
+    public void addImport(String clazzName) {
+        String add = "import " + clazzName + ";";
+
+        int l = -1;
+        int lastImport = -1;
+
+        for (int i = 0; i < content.size(); i++) {
+            String c = content.get(i);
+            if (c.matches("import [^ ]*;")) {
+                lastImport = i;
+                if (c.compareTo(add) > 1) {
+                    l = i;
+                    break;
+                }
+            } else if (c.matches("^\\b(?:public\\s+)?class\\b.*Test\\s+\\{$")) {
+                l = lastImport + 1;
+                break;
+            }
+        }
+
+        content.add(l, add);
+        info(l, "Importing: " + clazzName);
+    }
+
+    protected void info(int line, String message) {
+        System.out.println(String.format("%5s", line) + " " + message);
+    }
+
+}
diff --git a/tests/migration-util/src/main/java/org/keycloak/test/migration/UpdateAssertsRewrite.java b/tests/migration-util/src/main/java/org/keycloak/test/migration/UpdateAssertsRewrite.java
new file mode 100644
index 000000000000..a2326a16e411
--- /dev/null
+++ b/tests/migration-util/src/main/java/org/keycloak/test/migration/UpdateAssertsRewrite.java
@@ -0,0 +1,81 @@
+package org.keycloak.test.migration;
+
+import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
+
+public class UpdateAssertsRewrite extends TestRewrite {
+
+    private final static String FAIL = "fail";
+    private final static String ASSERT_THROWS = "assertThrows";
+    private final static String ASSERT_TRUE = "assertTrue";
+    private final static String ASSERT_FALSE = "assertFalse";
+    private final static String ASSERT_NULL = "assertNull";
+    private final static String ASSERT_NOT_NULL = "assertNotNull";
+    private final static String ASSERT_EQUALS = "assertEquals";
+    private final static String ASSERT_NOT_EQUALS = "assertNotEquals";
+
+    @Override
+    public void rewrite() {
+        for (int i = 0; i < content.size(); i++) {
+            String l = content.get(i);
+            String trimmed = l.trim();
+            if (trimmed.startsWith("Assert.") && trimmed.endsWith(";")) {
+                String method = trimmed.substring("Assert.".length(), trimmed.indexOf("("));
+                int arguments = l.substring(l.indexOf("(") + 1, l.lastIndexOf(")")).split(", ").length;
+
+                if (method.equals(FAIL)) {
+                    directReplace(i, FAIL);
+                } else if (method.equals(ASSERT_THROWS) && arguments == 3) {
+                    moveMessageToLast(i, ASSERT_THROWS);
+                } else if (method.equals(ASSERT_TRUE) && arguments == 1) {
+                    directReplace(i, ASSERT_TRUE);
+                } else if (method.equals(ASSERT_TRUE) && arguments == 2) {
+                    moveMessageToLast(i, ASSERT_TRUE);
+                } else if (method.equals(ASSERT_FALSE) && arguments == 1) {
+                    directReplace(i, ASSERT_FALSE);
+                } else if (method.equals(ASSERT_FALSE) && arguments == 2) {
+                    moveMessageToLast(i, ASSERT_FALSE);
+                } else if (method.equals(ASSERT_NULL) && arguments == 1) {
+                    directReplace(i, ASSERT_NULL);
+                } else if (method.equals(ASSERT_NULL) && arguments == 2) {
+                    moveMessageToLast(i, ASSERT_NULL);
+                } else if (method.equals(ASSERT_NOT_NULL) && arguments == 1) {
+                    directReplace(i, ASSERT_NOT_NULL);
+                } else if (method.equals(ASSERT_NOT_NULL) && arguments == 2) {
+                    moveMessageToLast(i, ASSERT_NOT_NULL);
+                }  else if (method.equals(ASSERT_EQUALS) && arguments == 2) {
+                    directReplace(i, ASSERT_EQUALS);
+                } else if (method.equals(ASSERT_EQUALS) && arguments == 3) {
+                    moveMessageToLast(i, ASSERT_EQUALS);
+                }  else if (method.equals(ASSERT_NOT_EQUALS) && arguments == 2) {
+                    directReplace(i, ASSERT_NOT_EQUALS);
+                } else if (method.equals(ASSERT_NOT_EQUALS) && arguments == 3) {
+                    moveMessageToLast(i, ASSERT_NOT_EQUALS);
+                }
+            }
+        }
+    }
+
+    private void directReplace(int l, String method) {
+        replaceLine(l, content.get(l).replace("Assert." + method, "Assertions." + method));
+    }
+
+    private void moveMessageToLast(int l, String method) {
+        String current = content.get(l);
+        String start = current.substring(0, current.indexOf('(') + 1);
+        String end = current.substring(current.lastIndexOf(')'));
+        List<String> arguments = new LinkedList<>(Arrays.asList(current.substring(start.length(), current.lastIndexOf(')')).split(", ")));
+        String messageArgument = arguments.remove(0);
+        arguments.add(messageArgument);
+
+        String updated = start.replace("Assert." + method, "Assertions." + method)
+                + String.join(", ", arguments)
+                + end;
+
+        replaceLine(l, updated);
+
+        info(l, "Assert rewritten: \n\t\t" + current.trim() + "\n\t\t --> \n\t\t" + updated.trim());
+    }
+
+}
diff --git a/tests/pom.xml b/tests/pom.xml
index b12aea28a007..a1c22ec171bd 100755
--- a/tests/pom.xml
+++ b/tests/pom.xml
@@ -35,6 +35,19 @@
     <modules>
         <module>base</module>
         <module>utils</module>
+        <module>utils-shared</module>
+        <module>custom-providers</module>
+        <module>custom-scripts</module>
+        <module>clustering</module>
     </modules>
 
-</project>
+    <profiles>
+        <profile>
+            <id>test-migration-util</id>
+            <modules>
+                <module>migration-util</module>
+            </modules>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file
diff --git a/tests/utils-shared/pom.xml b/tests/utils-shared/pom.xml
new file mode 100755
index 000000000000..c0c3f5bcb6a1
--- /dev/null
+++ b/tests/utils-shared/pom.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-tests-parent</artifactId>
+        <groupId>org.keycloak.tests</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-tests-utils-shared</artifactId>
+    <name>Keycloak Testsuite Utilities Shared</name>
+    <packaging>jar</packaging>
+    <description>Keycloak Testsuite Utilities shared between legacy and new testsuites</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.seleniumhq.selenium</groupId>
+            <artifactId>selenium-api</artifactId>
+            <version>4.25.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-admin-client-tests</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/CredentialBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/CredentialBuilder.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/CredentialBuilder.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/CredentialBuilder.java
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FederatedIdentityBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/FederatedIdentityBuilder.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FederatedIdentityBuilder.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/FederatedIdentityBuilder.java
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/IdentityProviderBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/IdentityProviderBuilder.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/IdentityProviderBuilder.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/IdentityProviderBuilder.java
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MailServerConfiguration.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/MailServerConfiguration.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MailServerConfiguration.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/MailServerConfiguration.java
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ProtocolMapperUtil.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/ProtocolMapperUtil.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ProtocolMapperUtil.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/ProtocolMapperUtil.java
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/RoleBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/RoleBuilder.java
similarity index 100%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/RoleBuilder.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/RoleBuilder.java
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OIDCIdentityProviderConfigRep.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/broker/OIDCIdentityProviderConfigRep.java
similarity index 96%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OIDCIdentityProviderConfigRep.java
rename to tests/utils-shared/src/main/java/org/keycloak/testsuite/util/broker/OIDCIdentityProviderConfigRep.java
index 8d95be7ff735..bec76cf993fa 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OIDCIdentityProviderConfigRep.java
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/broker/OIDCIdentityProviderConfigRep.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-package org.keycloak.testsuite.broker;
+package org.keycloak.testsuite.util.broker;
 
 import java.util.Map;
 
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpGetRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpGetRequest.java
new file mode 100644
index 000000000000..b6dc63de61ba
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpGetRequest.java
@@ -0,0 +1,42 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.keycloak.utils.MediaType;
+
+import java.io.IOException;
+
+public abstract class AbstractHttpGetRequest<R> {
+
+    protected final AbstractOAuthClient<?> client;
+
+    private HttpGet get;
+
+    public AbstractHttpGetRequest(AbstractOAuthClient<?> client) {
+        this.client = client;
+    }
+
+    protected abstract String getEndpoint();
+
+    protected abstract void initRequest();
+
+    public R send() {
+        get = new HttpGet(getEndpoint());
+        get.addHeader("Accept", MediaType.APPLICATION_JSON);
+        initRequest();
+        try {
+            return toResponse(client.httpClient().get().execute(get));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    protected void header(String name, String value) {
+        if (value != null) {
+            get.addHeader(name, value);
+        }
+    }
+
+    protected abstract R toResponse(CloseableHttpResponse response) throws IOException;
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpPostRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpPostRequest.java
new file mode 100644
index 000000000000..96f8b16d23d4
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpPostRequest.java
@@ -0,0 +1,116 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.message.BasicNameValuePair;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.BasicAuthHelper;
+import org.keycloak.utils.MediaType;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+public abstract class AbstractHttpPostRequest<T, R> {
+
+    protected final AbstractOAuthClient<?> client;
+
+    protected String clientId;
+
+    protected String clientSecret;
+
+    protected HttpPost post;
+
+    protected Map<String, String> headers = new HashMap<>();
+    protected List<NameValuePair> parameters = new LinkedList<>();
+
+    public AbstractHttpPostRequest(AbstractOAuthClient<?> client) {
+        this.client = client;
+    }
+
+    protected abstract String getEndpoint();
+
+    protected abstract void initRequest();
+
+    public R send() {
+        post = new HttpPost(getEndpoint());
+        post.addHeader("Accept", getAccept());
+        post.addHeader("Origin", client.config().getOrigin());
+
+        authorization();
+
+        initRequest();
+
+        headers.forEach((n, v) -> post.addHeader(n, v));
+
+        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
+        post.setEntity(formEntity);
+
+        try {
+            return toResponse(client.httpClient().get().execute(post));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public T client(String clientId) {
+        this.clientId = clientId;
+        this.clientSecret = null;
+        return request();
+    }
+
+    public T client(String clientId, String clientSecret) {
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        return request();
+    }
+
+    protected void header(String name, String value) {
+        if (value != null) {
+            headers.put(name, value);
+        }
+    }
+
+    protected void parameter(String name, String value) {
+        if (value != null) {
+            parameters.add(new BasicNameValuePair(name, value));
+        }
+    }
+
+    protected void authorization() {
+        String clientId = this.clientId != null ? this.clientId : client.config().getClientId();
+        String clientSecret = this.clientId != null ? this.clientSecret : client.config().getClientSecret();
+
+        if (clientSecret != null) {
+            String authorization = BasicAuthHelper.RFC6749.createHeader(clientId, clientSecret);
+            header("Authorization", authorization);
+        } else {
+            parameter("client_id", clientId);
+        }
+    }
+
+    protected void scope() {
+        scope(true);
+    }
+
+    protected void scope(boolean attachOpenidIfNull) {
+        parameter(OAuth2Constants.SCOPE, client.config().getScope(attachOpenidIfNull));
+    }
+
+    protected String getAccept() {
+        return MediaType.APPLICATION_JSON;
+    }
+
+    protected abstract R toResponse(CloseableHttpResponse response) throws IOException;
+
+    @SuppressWarnings("unchecked")
+    private T request() {
+        return (T) this;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpResponse.java
new file mode 100644
index 000000000000..cacc58c1a877
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractHttpResponse.java
@@ -0,0 +1,111 @@
+package org.keycloak.testsuite.util.oauth;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.apache.http.Header;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+public abstract class AbstractHttpResponse {
+
+    private final CloseableHttpResponse response;
+    private final int statusCode;
+    private final Map<String, String> headers;
+
+    private String error;
+    private String errorDescription;
+
+    public AbstractHttpResponse(CloseableHttpResponse response) throws IOException {
+        try (response) {
+            this.response = response;
+            this.statusCode = response.getStatusLine().getStatusCode();
+
+            this.headers = new HashMap<>();
+            for (Header h : response.getAllHeaders()) {
+                headers.put(h.getName(), h.getValue());
+            }
+
+            if (isSuccess()) {
+                parseContent();
+            } else if (isJson()) {
+                parseError();
+            }
+        }
+    }
+
+    protected int getSuccessCode() {
+        return 200;
+    }
+
+    public boolean isSuccess() {
+        return statusCode == getSuccessCode();
+    }
+
+    public int getStatusCode() {
+        return statusCode;
+    }
+
+    public String getHeader(String name) {
+        return headers.get(name);
+    }
+
+    public Map<String, String> getHeaders() {
+        return headers;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public String getErrorDescription() {
+        return errorDescription;
+    }
+
+    protected String getContentType() {
+        Header[] contentTypeHeaders = response.getHeaders("Content-Type");
+        return contentTypeHeaders != null && contentTypeHeaders.length > 0 ? contentTypeHeaders[0].getValue() : null;
+    }
+
+    protected ObjectNode asJson() throws IOException {
+        return asJson(ObjectNode.class);
+    }
+
+    protected <S> S asJson(Class<S> clazz) throws IOException {
+        assertJsonContentType();
+        return JsonSerialization.readValue(response.getEntity().getContent(), clazz);
+    }
+
+    protected String asString() throws IOException {
+        return EntityUtils.toString(response.getEntity(), StandardCharsets.UTF_8);
+    }
+
+    protected abstract void parseContent() throws IOException;
+
+    private void parseError() throws IOException {
+        if (getStatusCode() == 504) {
+            return;
+        }
+
+        ObjectNode json = asJson(ObjectNode.class);
+        error = json.get(OAuth2Constants.ERROR).asText();
+        errorDescription = json.has(OAuth2Constants.ERROR_DESCRIPTION) ? json.get(OAuth2Constants.ERROR_DESCRIPTION).asText() : null;
+    }
+
+    protected boolean isJson() {
+        return "application/json".equals(getContentType());
+    }
+
+    protected void assertJsonContentType() throws IOException {
+        String contentType = getContentType();
+        if (contentType == null || !contentType.startsWith("application/json")) {
+            throw new IOException("Invalid content type retrieved. Status: " + getStatusCode() + ", contentType: " + contentType);
+        }
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractOAuthClient.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractOAuthClient.java
new file mode 100644
index 000000000000..4277f20e789e
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractOAuthClient.java
@@ -0,0 +1,295 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.AuthorizationResponseToken;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.RefreshToken;
+import org.keycloak.testsuite.util.oauth.ciba.CibaClient;
+import org.keycloak.testsuite.util.oauth.device.DeviceClient;
+import org.openqa.selenium.WebDriver;
+
+public abstract class AbstractOAuthClient<T> {
+
+    protected String baseUrl;
+    protected OAuthClientConfig config;
+
+    private final KeyManager keyManager = new KeyManager(this);
+    private final TokensManager tokensManager = new TokensManager(keyManager);
+    protected HttpClientManager httpClientManager;
+    protected WebDriver driver;
+
+    public AbstractOAuthClient(String baseUrl, CloseableHttpClient httpClient, WebDriver webDriver) {
+        this.baseUrl = baseUrl;
+        this.driver = webDriver;
+        this.httpClientManager = new HttpClientManager(httpClient);
+    }
+
+    public T realm(String realm) {
+        config.realm(realm);
+        return client();
+    }
+
+    public T client(String clientId) {
+        config.client(clientId);
+        return client();
+    }
+
+    public T client(String clientId, String clientSecret) {
+        config.client(clientId, clientSecret);
+        return client();
+    }
+
+    public T redirectUri(String redirectUri) {
+        config.redirectUri(redirectUri);
+        return client();
+    }
+
+    public T scope(String scope) {
+        config.scope(scope);
+        return client();
+    }
+
+    public T openid(boolean openid) {
+        config.openid(openid);
+        return client();
+    }
+
+    public T responseType(String responseType) {
+        config.responseType(responseType);
+        return client();
+    }
+
+    public T responseMode(String responseMode) {
+        config.responseMode(responseMode);
+        return client();
+    }
+
+    public T origin(String origin) {
+        config.origin(origin);
+        return client();
+    }
+
+    public LoginUrlBuilder loginForm() {
+        return new LoginUrlBuilder(this);
+    }
+
+    public void openLoginForm() {
+        loginForm().open();
+    }
+
+    public AuthorizationEndpointResponse doLogin(String username, String password) {
+        openLoginForm();
+        fillLoginForm(username, password);
+        return parseLoginResponse();
+    }
+
+    public abstract void fillLoginForm(String username, String password);
+
+    public void openRegistrationForm() {
+        driver.navigate().to(registrationForm().build());
+    }
+
+    public RegistrationUrlBuilder registrationForm() {
+        return new RegistrationUrlBuilder(this);
+    }
+
+    public AuthorizationEndpointResponse parseLoginResponse() {
+        return new AuthorizationEndpointResponse(this);
+    }
+
+    public PasswordGrantRequest passwordGrantRequest(String username, String password) {
+        return new PasswordGrantRequest(username, password, this);
+    }
+
+    public AccessTokenResponse doPasswordGrantRequest(String username, String password) {
+        return passwordGrantRequest(username, password).send();
+    }
+
+    public AccessTokenRequest accessTokenRequest(String code) {
+        return new AccessTokenRequest(code, this);
+    }
+
+    public AccessTokenResponse doAccessTokenRequest(String code) {
+        return accessTokenRequest(code).send();
+    }
+
+    public ClientCredentialsGrantRequest clientCredentialsGrantRequest() {
+        return new ClientCredentialsGrantRequest(this);
+    }
+
+    public AccessTokenResponse doClientCredentialsGrantAccessTokenRequest() {
+        return clientCredentialsGrantRequest().send();
+    }
+
+    public RefreshRequest refreshRequest(String refreshToken) {
+        return new RefreshRequest(refreshToken, this);
+    }
+
+    public AccessTokenResponse doRefreshTokenRequest(String refreshToken) {
+        return refreshRequest(refreshToken).send();
+    }
+
+    public LogoutUrlBuilder logoutForm() {
+        return new LogoutUrlBuilder(this);
+    }
+
+    public void openLogoutForm() {
+        logoutForm().open();
+    }
+
+    public LogoutRequest logoutRequest(String refreshToken) {
+        return new LogoutRequest(refreshToken, this);
+    }
+
+    public LogoutResponse doLogout(String refreshToken) {
+        return logoutRequest(refreshToken).send();
+    }
+
+    public BackchannelLogoutRequest backchannelLogoutRequest(String logoutToken) {
+        return new BackchannelLogoutRequest(logoutToken, this);
+    }
+
+    public BackchannelLogoutResponse doBackchannelLogout(String logoutToken) {
+        return backchannelLogoutRequest(logoutToken).send();
+    }
+
+    public OpenIDProviderConfigurationRequest wellknownRequest() {
+        return new OpenIDProviderConfigurationRequest(this);
+    }
+
+    public OIDCConfigurationRepresentation doWellKnownRequest() {
+        return wellknownRequest().send().getOidcConfiguration();
+    }
+
+    public UserInfoRequest userInfoRequest(String accessToken) {
+        return new UserInfoRequest(accessToken, this);
+    }
+
+    public UserInfoResponse doUserInfoRequest(String accessToken) {
+        return userInfoRequest(accessToken).send();
+    }
+
+    public IntrospectionRequest introspectionRequest(String tokenToIntrospect) {
+        return new IntrospectionRequest(tokenToIntrospect, this);
+    }
+
+    public IntrospectionResponse doIntrospectionRequest(String tokenToIntrospect, String tokenType) {
+        return introspectionRequest(tokenToIntrospect).tokenTypeHint(tokenType).send();
+    }
+
+    public IntrospectionResponse doIntrospectionAccessTokenRequest(String tokenToIntrospect) {
+        return introspectionRequest(tokenToIntrospect).tokenTypeHint("access_token").send();
+    }
+
+    public IntrospectionResponse doIntrospectionRefreshTokenRequest(String tokenToIntrospect) {
+        return introspectionRequest(tokenToIntrospect).tokenTypeHint("refresh_token").send();
+    }
+
+    public TokenRevocationRequest tokenRevocationRequest(String token) {
+        return new TokenRevocationRequest(token, this);
+    }
+
+    public TokenRevocationResponse doTokenRevoke(String token) {
+        return tokenRevocationRequest(token).send();
+    }
+
+    public TokenExchangeRequest tokenExchangeRequest(String subjectToken) {
+        return tokenExchangeRequest(subjectToken, OAuth2Constants.ACCESS_TOKEN_TYPE);
+    }
+
+    public TokenExchangeRequest tokenExchangeRequest(String subjectToken, String subjectTokenType) {
+        return new TokenExchangeRequest(subjectToken, subjectTokenType, this);
+    }
+
+    public AccessTokenResponse doTokenExchange(String subjectToken) {
+        return tokenExchangeRequest(subjectToken).send();
+    }
+
+    public CibaClient ciba() {
+        return new CibaClient(this);
+    }
+
+    public DeviceClient device() {
+        return new DeviceClient(this);
+    }
+
+    public ParRequest pushedAuthorizationRequest() {
+        return new ParRequest(this);
+    }
+
+    public ParResponse doPushedAuthorizationRequest() {
+        return pushedAuthorizationRequest().send();
+    }
+
+    public <J extends JsonWebToken> J parseToken(String token, Class<J> clazz) {
+        return tokensManager.parseToken(token, clazz);
+    }
+
+    public RefreshToken parseRefreshToken(String refreshToken) {
+        return tokensManager.parseToken(refreshToken, RefreshToken.class);
+    }
+
+    public AccessToken verifyToken(String token) {
+        return tokensManager.verifyToken(token, AccessToken.class);
+    }
+
+    public IDToken verifyIDToken(String token) {
+        return tokensManager.verifyToken(token, IDToken.class);
+    }
+
+    public AuthorizationResponseToken verifyAuthorizationResponseToken(String token) {
+        return tokensManager.verifyToken(token, AuthorizationResponseToken.class);
+    }
+
+    public <J extends JsonWebToken> J verifyToken(String token, Class<J> clazz) {
+        return tokensManager.verifyToken(token, clazz);
+    }
+
+    public T baseUrl(String baseUrl) {
+        this.baseUrl = baseUrl;
+        return client();
+    }
+
+    public OAuthClientConfig config() {
+        return config;
+    }
+
+    public T driver(WebDriver webDriver) {
+        this.driver = webDriver;
+        return client();
+    }
+
+    public HttpClientManager httpClient() {
+        return httpClientManager;
+    }
+
+    public KeyManager keys() {
+        return keyManager;
+    }
+
+    public Endpoints getEndpoints() {
+        return new Endpoints(baseUrl, config.getRealm());
+    }
+
+    public String getRealm() {
+        return config.getRealm();
+    }
+
+    public String getClientId() {
+        return config.getClientId();
+    }
+
+    public String getRedirectUri() {
+        return config.getRedirectUri();
+    }
+
+    @SuppressWarnings("unchecked")
+    private T client() {
+        return (T) this;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractUrlBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractUrlBuilder.java
new file mode 100644
index 000000000000..363c319e6034
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AbstractUrlBuilder.java
@@ -0,0 +1,49 @@
+package org.keycloak.testsuite.util.oauth;
+
+import jakarta.ws.rs.core.UriBuilder;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+public abstract class AbstractUrlBuilder {
+
+    protected final AbstractOAuthClient<?> client;
+    protected Map<String, String> params = new HashMap<>();
+
+    public AbstractUrlBuilder(AbstractOAuthClient<?> client) {
+        this.client = client;
+        initRequest();
+    }
+
+    public abstract String getEndpoint();
+
+    protected abstract void initRequest();
+
+    public void open() {
+        client.driver.navigate().to(build());
+    }
+
+    protected void parameter(String name, String value) {
+        params.put(name, value);
+    }
+
+    protected void parameter(String name, Object value) {
+        try {
+            String encoded = URLEncoder.encode(JsonSerialization.writeValueAsString(value), StandardCharsets.UTF_8);
+            parameter(name, encoded);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String build() {
+        UriBuilder uriBuilder = UriBuilder.fromUri(getEndpoint());
+        params.entrySet().stream().filter(e -> e.getValue() != null).forEach(e -> uriBuilder.queryParam(e.getKey(), e.getValue()));
+        return uriBuilder.build().toString();
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenRequest.java
new file mode 100644
index 000000000000..791376dadf56
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenRequest.java
@@ -0,0 +1,57 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class AccessTokenRequest extends AbstractHttpPostRequest<AccessTokenRequest, AccessTokenResponse> {
+
+    private final String code;
+
+    AccessTokenRequest(String code, AbstractOAuthClient<?> client) {
+        super(client);
+        this.code = code;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    public AccessTokenRequest codeVerifier(PkceGenerator pkceGenerator) {
+        if (pkceGenerator != null) {
+            codeVerifier(pkceGenerator.getCodeVerifier());
+        }
+        return this;
+    }
+
+    public AccessTokenRequest codeVerifier(String codeVerifier) {
+        parameter(OAuth2Constants.CODE_VERIFIER, codeVerifier);
+        return this;
+    }
+
+    public AccessTokenRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    public AccessTokenRequest param(String name, String value) {
+        parameter(name, value);
+        return this;
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE);
+
+        parameter(OAuth2Constants.CODE, code);
+        parameter(OAuth2Constants.REDIRECT_URI, client.getRedirectUri());
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenResponse.java
new file mode 100644
index 000000000000..7397f44f97f1
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AccessTokenResponse.java
@@ -0,0 +1,110 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+public class AccessTokenResponse extends AbstractHttpResponse {
+
+    private String idToken;
+    private String accessToken;
+    private String issuedTokenType;
+    private String tokenType;
+    private int expiresIn;
+    private int refreshExpiresIn;
+    private String refreshToken;
+    private String scope;
+    private String sessionState;
+
+    private Map<String, Object> otherClaims;
+
+    public AccessTokenResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    protected void parseContent() throws IOException {
+        @SuppressWarnings("unchecked")
+        Map<String, Object> responseJson = asJson(Map.class);
+
+        otherClaims = new HashMap<>();
+
+        for (Map.Entry<String, Object> entry : responseJson.entrySet()) {
+            switch (entry.getKey()) {
+                case OAuth2Constants.ID_TOKEN:
+                    idToken = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.ACCESS_TOKEN:
+                    accessToken = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.ISSUED_TOKEN_TYPE:
+                    issuedTokenType = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.TOKEN_TYPE:
+                    tokenType = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.EXPIRES_IN:
+                    expiresIn = (Integer) entry.getValue();
+                    break;
+                case "refresh_expires_in":
+                    refreshExpiresIn = (Integer) entry.getValue();
+                    break;
+                case OAuth2Constants.SESSION_STATE:
+                    sessionState = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.SCOPE:
+                    scope = (String) entry.getValue();
+                    break;
+                case OAuth2Constants.REFRESH_TOKEN:
+                    refreshToken = (String) entry.getValue();
+                    break;
+                default:
+                    otherClaims.put(entry.getKey(), entry.getValue());
+                    break;
+            }
+        }
+    }
+
+    public String getIdToken() {
+        return idToken;
+    }
+
+    public String getAccessToken() {
+        return accessToken;
+    }
+
+    public int getExpiresIn() {
+        return expiresIn;
+    }
+
+    public int getRefreshExpiresIn() {
+        return refreshExpiresIn;
+    }
+
+    public String getRefreshToken() {
+        return refreshToken;
+    }
+
+    public String getIssuedTokenType() {
+        return issuedTokenType;
+    }
+
+    public String getTokenType() {
+        return tokenType;
+    }
+
+    public String getScope() {
+        return scope;
+    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public Map<String, Object> getOtherClaims() {
+        return otherClaims;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AuthorizationEndpointResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AuthorizationEndpointResponse.java
new file mode 100644
index 000000000000..1f9dfdfc9455
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/AuthorizationEndpointResponse.java
@@ -0,0 +1,102 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.utils.URLEncodedUtils;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.protocol.oidc.utils.OIDCResponseMode;
+import org.keycloak.protocol.oidc.utils.OIDCResponseType;
+import org.openqa.selenium.WebDriver;
+
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+public class AuthorizationEndpointResponse {
+
+    private boolean isRedirected;
+    private Map<String, String> params;
+
+    public AuthorizationEndpointResponse(AbstractOAuthClient<?> client) {
+        WebDriver driver = client.driver;
+        String currentUrl = driver.getCurrentUrl();
+
+        boolean fragment = isFragment(client);
+        int parametersIndex = fragment ? currentUrl.indexOf('#') : currentUrl.indexOf('?');
+        if (parametersIndex != -1) {
+            String urlWithoutParameters = currentUrl.substring(0, parametersIndex);
+            String parameters = currentUrl.substring(parametersIndex + 1);
+
+            isRedirected = urlWithoutParameters.equals(client.getRedirectUri());
+
+            params = new HashMap<>();
+            URLEncodedUtils.parse(parameters, StandardCharsets.UTF_8)
+                    .stream().filter(p -> p.getValue() != null)
+                    .forEach(p -> params.put(p.getName(), p.getValue()));
+        }
+    }
+
+    private boolean isFragment(AbstractOAuthClient<?> client) {
+        try {
+            OIDCResponseType responseType = OIDCResponseType.parse(client.config().getResponseType());
+            OIDCResponseMode responseMode = OIDCResponseMode.parse(client.config().getResponseMode(), responseType);
+            return switch (responseMode) {
+                case FRAGMENT, FRAGMENT_JWT -> true;
+                default -> false;
+            };
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    public boolean isRedirected() {
+        return isRedirected;
+    }
+
+    public String getCode() {
+        return params.get(OAuth2Constants.CODE);
+    }
+
+    public String getState() {
+        return params.get(OAuth2Constants.STATE);
+    }
+
+    public String getError() {
+        return params.get(OAuth2Constants.ERROR);
+    }
+
+    public String getErrorDescription() {
+        return params.get(OAuth2Constants.ERROR_DESCRIPTION);
+    }
+
+    public String getSessionState() {
+        return params.get(OAuth2Constants.SESSION_STATE);
+    }
+
+    public String getAccessToken() {
+        return params.get(OAuth2Constants.ACCESS_TOKEN);
+    }
+
+    public String getIdToken() {
+        return params.get(OAuth2Constants.ID_TOKEN);
+    }
+
+    public String getTokenType() {
+        return params.get(OAuth2Constants.TOKEN_TYPE);
+    }
+
+    public String getExpiresIn() {
+        return params.get(OAuth2Constants.EXPIRES_IN);
+    }
+
+    public String getResponse() {
+        return params.get(OAuth2Constants.RESPONSE);
+    }
+
+    public String getIssuer() {
+        return params.get(OAuth2Constants.ISSUER);
+    }
+
+    public String getKcActionStatus() {
+        return params.get("kc_action_status");
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutRequest.java
new file mode 100644
index 000000000000..652e0db85d00
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutRequest.java
@@ -0,0 +1,31 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+
+import java.io.IOException;
+
+public class BackchannelLogoutRequest extends AbstractHttpPostRequest<BackchannelLogoutRequest, BackchannelLogoutResponse> {
+
+    private final String logoutToken;
+
+    BackchannelLogoutRequest(String logoutToken, AbstractOAuthClient<?> client) {
+        super(client);
+        this.logoutToken = logoutToken;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getBackChannelLogout();
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.LOGOUT_TOKEN, logoutToken);
+    }
+
+    @Override
+    protected BackchannelLogoutResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new BackchannelLogoutResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutResponse.java
new file mode 100644
index 000000000000..621adf72beeb
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/BackchannelLogoutResponse.java
@@ -0,0 +1,17 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+
+public class BackchannelLogoutResponse extends AbstractHttpResponse {
+
+    public BackchannelLogoutResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() {
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ClientCredentialsGrantRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ClientCredentialsGrantRequest.java
new file mode 100644
index 000000000000..499424d8575a
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ClientCredentialsGrantRequest.java
@@ -0,0 +1,36 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class ClientCredentialsGrantRequest extends AbstractHttpPostRequest<ClientCredentialsGrantRequest, AccessTokenResponse> {
+
+    ClientCredentialsGrantRequest(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    public ClientCredentialsGrantRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS);
+
+        scope();
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/Endpoints.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/Endpoints.java
new file mode 100644
index 000000000000..d4456ee71d08
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/Endpoints.java
@@ -0,0 +1,84 @@
+package org.keycloak.testsuite.util.oauth;
+
+import jakarta.ws.rs.core.UriBuilder;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
+import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
+import org.keycloak.protocol.oidc.grants.device.DeviceGrantType;
+import org.keycloak.protocol.oidc.par.endpoints.ParEndpoint;
+import org.keycloak.services.resources.RealmsResource;
+
+public class Endpoints {
+
+    private final String baseUrl;
+    private final String realm;
+
+    public Endpoints(String baseUrl, String realm) {
+        this.baseUrl = baseUrl;
+        this.realm = realm;
+    }
+
+    public String getOpenIDConfiguration() {
+        return asString(getBase().path(RealmsResource.class).path("{realm}/.well-known/openid-configuration"));
+    }
+
+    public String getAuthorization() {
+        return asString(OIDCLoginProtocolService.authUrl(getBase()));
+    }
+
+    public String getRegistration() {
+        return asString(OIDCLoginProtocolService.registrationsUrl(getBase()));
+    }
+
+    public String getToken() {
+        return asString(OIDCLoginProtocolService.tokenUrl(getBase()));
+    }
+
+    public String getIntrospection() {
+        return asString(OIDCLoginProtocolService.tokenIntrospectionUrl(getBase()));
+    }
+
+    public String getRevocation() {
+        return asString(OIDCLoginProtocolService.tokenRevocationUrl(getBase()));
+    }
+
+    public String getUserInfo() {
+        return asString(OIDCLoginProtocolService.userInfoUrl(getBase()));
+    }
+
+    public String getJwks() {
+        return asString(OIDCLoginProtocolService.certsUrl(getBase()));
+    }
+
+    public String getDeviceAuthorization() {
+        return asString(DeviceGrantType.oauth2DeviceAuthUrl(getBase()));
+    }
+
+    public String getPushedAuthorizationRequest() {
+        return asString(ParEndpoint.parUrl(getBase()));
+    }
+
+    public String getLogout() {
+        return asString(OIDCLoginProtocolService.logoutUrl(getBase()));
+    }
+
+    public String getBackChannelLogout() {
+        return asString(OIDCLoginProtocolService.logoutUrl(getBase()).path("/backchannel-logout"));
+    }
+
+    public String getBackchannelAuthentication() {
+        return asString(CibaGrantType.authorizationUrl(getBase()));
+    }
+
+    public String getBackchannelAuthenticationCallback() {
+        return asString(CibaGrantType.authenticationUrl(getBase()));
+    }
+
+    UriBuilder getBase() {
+        return UriBuilder.fromUri(baseUrl);
+    }
+
+    String asString(UriBuilder b) {
+        return b.build(realm).toString();
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/HttpClientManager.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/HttpClientManager.java
new file mode 100644
index 000000000000..f5517e9602d4
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/HttpClientManager.java
@@ -0,0 +1,30 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.impl.client.CloseableHttpClient;
+
+public class HttpClientManager {
+
+    private final CloseableHttpClient defaultClient;
+    private CloseableHttpClient customClient;
+
+    public HttpClientManager(CloseableHttpClient defaultClient) {
+        this.defaultClient = defaultClient;
+    }
+
+    public CloseableHttpClient get() {
+        if (customClient != null) {
+            return customClient;
+        } else {
+            return defaultClient;
+        }
+    }
+
+    public void set(CloseableHttpClient httpClient) {
+        this.customClient = httpClient;
+    }
+
+    public void reset() {
+        this.customClient = null;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionRequest.java
new file mode 100644
index 000000000000..64e18f54d799
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionRequest.java
@@ -0,0 +1,48 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.utils.MediaType;
+
+import java.io.IOException;
+
+public class IntrospectionRequest extends AbstractHttpPostRequest<IntrospectionRequest, IntrospectionResponse> {
+
+    private final String token;
+    private String tokenTypeHint;
+    private boolean jwtResponse = false;
+
+    IntrospectionRequest(String token, AbstractOAuthClient<?> client) {
+        super(client);
+        this.token = token;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getIntrospection();
+    }
+
+    public IntrospectionRequest tokenTypeHint(String tokenTypeHint) {
+        this.tokenTypeHint = tokenTypeHint;
+        return this;
+    }
+
+    public IntrospectionRequest jwtResponse() {
+        this.jwtResponse = true;
+        return this;
+    }
+
+    protected void initRequest() {
+        parameter("token", token);
+        parameter("token_type_hint", tokenTypeHint);
+    }
+
+    @Override
+    protected IntrospectionResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new IntrospectionResponse(response);
+    }
+
+    @Override
+    protected String getAccept() {
+        return jwtResponse ? MediaType.APPLICATION_JWT : super.getAccept();
+    }
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionResponse.java
new file mode 100644
index 000000000000..9eefc3aa14be
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/IntrospectionResponse.java
@@ -0,0 +1,35 @@
+package org.keycloak.testsuite.util.oauth;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.representations.oidc.TokenMetadataRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+
+public class IntrospectionResponse extends AbstractHttpResponse {
+
+    private String raw;
+
+    IntrospectionResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        raw = asString();
+    }
+
+    public String getRaw() {
+        return raw;
+    }
+
+    public JsonNode asJsonNode() throws IOException {
+        return JsonSerialization.readValue(raw, JsonNode.class);
+    }
+
+    public TokenMetadataRepresentation asTokenMetadata() throws IOException {
+        return JsonSerialization.readValue(raw, TokenMetadataRepresentation.class);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksRequest.java
new file mode 100644
index 000000000000..1a657741f6be
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksRequest.java
@@ -0,0 +1,27 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.HttpGet;
+import org.keycloak.jose.jwk.JSONWebKeySet;
+
+import java.io.IOException;
+
+public class JwksRequest {
+
+    private final AbstractOAuthClient<?> client;
+
+    JwksRequest(AbstractOAuthClient<?> client) {
+        this.client = client;
+    }
+
+    public JSONWebKeySet send() throws IOException {
+        HttpGet get = new HttpGet(client.getEndpoints().getJwks());
+        get.addHeader("Accept", "application/json");
+        JwksResponse response = new JwksResponse(client.httpClient().get().execute(get));
+        if (response.isSuccess()) {
+            return response.getJwks();
+        } else {
+            throw new IOException("Failed to fetch keys: " + response.getStatusCode());
+        }
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksResponse.java
new file mode 100644
index 000000000000..85c60d95d0de
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/JwksResponse.java
@@ -0,0 +1,33 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.jose.jwk.JSONWebKeySet;
+
+import java.io.IOException;
+
+public class JwksResponse extends AbstractHttpResponse {
+
+    private JSONWebKeySet jwks;
+
+    JwksResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        jwks = asJson(JSONWebKeySet.class);
+    }
+
+    public JSONWebKeySet getJwks() {
+        return jwks;
+    }
+
+    @Override
+    protected void assertJsonContentType() throws IOException {
+        String contentType = getContentType();
+        if (contentType == null || !(contentType.startsWith("application/jwk-set+json") || contentType.startsWith("application/json"))) {
+            throw new IOException("Invalid content type retrieved. Status: " + getStatusCode() + ", contentType: " + contentType);
+        }
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/KeyManager.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/KeyManager.java
new file mode 100644
index 000000000000..c32dda69928f
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/KeyManager.java
@@ -0,0 +1,77 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.jose.jwk.JSONWebKeySet;
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jwk.JWKParser;
+import org.keycloak.jose.jwk.OKPPublicJWK;
+
+import java.io.IOException;
+import java.security.PublicKey;
+import java.util.HashMap;
+import java.util.Map;
+
+public class KeyManager {
+
+    private final AbstractOAuthClient<?> client;
+    private final Map<String, JSONWebKeySet> publicKeys = new HashMap<>();
+
+    KeyManager(AbstractOAuthClient<?>  client) {
+        this.client = client;
+    }
+
+    public KeyWrapper getPublicKey(String algorithm, String kid) {
+        boolean loadedKeysFromServer = false;
+        JSONWebKeySet jsonWebKeySet = publicKeys.get(client.getRealm());
+        if (jsonWebKeySet == null) {
+            jsonWebKeySet = getRealmKeys();
+            publicKeys.put(client.getRealm(), jsonWebKeySet);
+            loadedKeysFromServer = true;
+        }
+
+        KeyWrapper key = findKey(jsonWebKeySet, algorithm, kid);
+
+        if (key == null && !loadedKeysFromServer) {
+            jsonWebKeySet = getRealmKeys();
+            publicKeys.put(client.getRealm(), jsonWebKeySet);
+
+            key = findKey(jsonWebKeySet, algorithm, kid);
+        }
+
+        if (key == null) {
+            throw new RuntimeException("Public key for realm:" + client.getRealm() + ", algorithm: " + algorithm + " not found");
+        }
+
+        return key;
+    }
+
+    public JSONWebKeySet getRealmKeys() {
+        try {
+            return new JwksRequest(client).send();
+        } catch (IOException e) {
+            throw new RuntimeException("Failed to retrieve keys", e);
+        }
+    }
+
+    private KeyWrapper findKey(JSONWebKeySet jsonWebKeySet, String algorithm, String kid) {
+        for (JWK k : jsonWebKeySet.getKeys()) {
+            if (k.getKeyId().equals(kid) && k.getAlgorithm().equals(algorithm)) {
+                PublicKey publicKey = JWKParser.create(k).toPublicKey();
+
+                KeyWrapper key = new KeyWrapper();
+                key.setKid(k.getKeyId());
+                key.setAlgorithm(k.getAlgorithm());
+                if (k.getOtherClaims().get(OKPPublicJWK.CRV) != null) {
+                    key.setCurve((String) k.getOtherClaims().get(OKPPublicJWK.CRV));
+                }
+                key.setPublicKey(publicKey);
+                key.setUse(KeyUse.SIG);
+
+                return key;
+            }
+        }
+        return null;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LoginUrlBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LoginUrlBuilder.java
new file mode 100644
index 000000000000..a1da41104c33
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LoginUrlBuilder.java
@@ -0,0 +1,108 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.OAuth2Constants;
+import org.keycloak.models.Constants;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.ClaimsRepresentation;
+
+public class LoginUrlBuilder extends AbstractUrlBuilder {
+
+    public LoginUrlBuilder(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    @Override
+    public String getEndpoint() {
+        return client.getEndpoints().getAuthorization();
+    }
+
+    public LoginUrlBuilder param(String name, String value) {
+        parameter(name, value);
+        return this;
+    }
+
+    public LoginUrlBuilder state(String state) {
+        parameter(OIDCLoginProtocol.STATE_PARAM, state);
+        return this;
+    }
+
+    public LoginUrlBuilder nonce(String nonce) {
+        parameter(OIDCLoginProtocol.NONCE_PARAM, nonce);
+        return this;
+    }
+
+    public LoginUrlBuilder prompt(String prompt) {
+        parameter(OIDCLoginProtocol.PROMPT_PARAM, prompt);
+        return this;
+    }
+
+    public LoginUrlBuilder loginHint(String loginHint) {
+        parameter(OIDCLoginProtocol.LOGIN_HINT_PARAM, loginHint);
+        return this;
+    }
+
+    public LoginUrlBuilder uiLocales(String uiLocales) {
+        parameter(OAuth2Constants.UI_LOCALES_PARAM, uiLocales);
+        return this;
+    }
+
+    public LoginUrlBuilder maxAge(int maxAge) {
+        parameter(OIDCLoginProtocol.MAX_AGE_PARAM, Integer.toString(maxAge));
+        return this;
+    }
+
+    public LoginUrlBuilder kcAction(String kcAction) {
+        parameter(Constants.KC_ACTION, kcAction);
+        return this;
+    }
+
+    public LoginUrlBuilder codeChallenge(PkceGenerator pkceGenerator) {
+        if (pkceGenerator != null) {
+            codeChallenge(pkceGenerator.getCodeChallenge(), pkceGenerator.getCodeChallengeMethod());
+        }
+        return this;
+    }
+
+    public LoginUrlBuilder codeChallenge(String codeChallenge, String codeChallengeMethod) {
+        parameter(OAuth2Constants.CODE_CHALLENGE, codeChallenge);
+        parameter(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod);
+        return this;
+    }
+
+    public LoginUrlBuilder dpopJkt(String dpopJkt) {
+        parameter(OIDCLoginProtocol.DPOP_JKT, dpopJkt);
+        return this;
+    }
+
+    public LoginUrlBuilder claims(ClaimsRepresentation claims) {
+        parameter(OIDCLoginProtocol.CLAIMS_PARAM, claims);
+        return this;
+    }
+
+    public LoginUrlBuilder request(String request) {
+        parameter(OIDCLoginProtocol.REQUEST_PARAM, request);
+        return this;
+    }
+
+    public LoginUrlBuilder requestUri(String requestUri) {
+        parameter(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri);
+        return this;
+    }
+
+    @Override
+    protected void initRequest() {
+        parameter(OAuth2Constants.RESPONSE_TYPE, client.config().getResponseType());
+        parameter(OIDCLoginProtocol.RESPONSE_MODE_PARAM, client.config().getResponseMode());
+        parameter(OAuth2Constants.CLIENT_ID, client.config().getClientId());
+        parameter(OAuth2Constants.REDIRECT_URI, client.config().getRedirectUri());
+
+        parameter(OAuth2Constants.SCOPE, client.config().getScope());
+    }
+
+    public AuthorizationEndpointResponse doLogin(String username, String password) {
+        open();
+        client.fillLoginForm(username, password);
+        return client.parseLoginResponse();
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutRequest.java
new file mode 100644
index 000000000000..d41a79868224
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutRequest.java
@@ -0,0 +1,31 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+
+import java.io.IOException;
+
+public class LogoutRequest extends AbstractHttpPostRequest<LogoutRequest, LogoutResponse> {
+
+    private final String refreshToken;
+
+    LogoutRequest(String refreshToken, AbstractOAuthClient<?> client) {
+        super(client);
+        this.refreshToken = refreshToken;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getLogout();
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.REFRESH_TOKEN, refreshToken);
+    }
+
+    @Override
+    protected LogoutResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new LogoutResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutResponse.java
new file mode 100644
index 000000000000..78c19799cee3
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutResponse.java
@@ -0,0 +1,22 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+
+public class LogoutResponse extends AbstractHttpResponse {
+
+    public LogoutResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() {
+    }
+
+    @Override
+    protected int getSuccessCode() {
+        return 204;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutUrlBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutUrlBuilder.java
new file mode 100644
index 000000000000..4c196978a6f3
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/LogoutUrlBuilder.java
@@ -0,0 +1,61 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.services.managers.AuthenticationManager;
+
+public class LogoutUrlBuilder extends AbstractUrlBuilder {
+
+    LogoutUrlBuilder(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    @Override
+    public String getEndpoint() {
+        return client.getEndpoints().getLogout();
+    }
+
+    public LogoutUrlBuilder param(String name, String value) {
+        parameter(name, value);
+        return this;
+    }
+
+    public LogoutUrlBuilder idTokenHint(String idTokenHint) {
+        parameter(OIDCLoginProtocol.ID_TOKEN_HINT, idTokenHint);
+        return this;
+    }
+
+    public LogoutUrlBuilder postLogoutRedirectUri(String redirectUri) {
+        parameter(OIDCLoginProtocol.POST_LOGOUT_REDIRECT_URI_PARAM, redirectUri);
+        return this;
+    }
+
+    public LogoutUrlBuilder state(String state) {
+        parameter(OIDCLoginProtocol.STATE_PARAM, state);
+        return this;
+    }
+
+    public LogoutUrlBuilder uiLocales(String uiLocales) {
+        parameter(OIDCLoginProtocol.UI_LOCALES_PARAM, uiLocales);
+        return this;
+    }
+
+    public LogoutUrlBuilder initiatingIdp(String initiatingIdp) {
+        parameter(AuthenticationManager.INITIATING_IDP_PARAM, initiatingIdp);
+        return this;
+    }
+
+    public LogoutUrlBuilder withClientId() {
+        parameter(OIDCLoginProtocol.CLIENT_ID_PARAM, client.config().getClientId());
+        return this;
+    }
+
+    public LogoutUrlBuilder withRedirect() {
+        postLogoutRedirectUri(client.config().getPostLogoutRedirectUri());
+        return this;
+    }
+
+    @Override
+    protected void initRequest() {
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClientConfig.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClientConfig.java
new file mode 100644
index 000000000000..dd36983042a3
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClientConfig.java
@@ -0,0 +1,128 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.util.TokenUtil;
+
+public class OAuthClientConfig {
+
+    private String realm;
+
+    private String clientId;
+
+    private String clientSecret;
+
+    private String redirectUri;
+
+    private String postLogoutRedirectUri;
+
+    private String origin;
+
+    private String scope;
+
+    private boolean openid = true;
+
+    private String responseType;
+
+    private String responseMode;
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public OAuthClientConfig realm(String realm) {
+        this.realm = realm;
+        return this;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public String getClientSecret() {
+        return clientSecret;
+    }
+
+    public OAuthClientConfig clientId(String clientId) {
+        this.clientId = clientId;
+        return this;
+    }
+
+    public OAuthClientConfig client(String clientId) {
+        this.clientId = clientId;
+        this.clientSecret = null;
+        return this;
+    }
+
+    public OAuthClientConfig client(String clientId, String clientSecret) {
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        return this;
+    }
+
+    public String getRedirectUri() {
+        return redirectUri;
+    }
+
+    public OAuthClientConfig redirectUri(String redirectUri) {
+        this.redirectUri = redirectUri;
+        return this;
+    }
+
+    public String getPostLogoutRedirectUri() {
+        return postLogoutRedirectUri;
+    }
+
+    public OAuthClientConfig postLogoutRedirectUri(String postLogoutRedirectUri) {
+        this.postLogoutRedirectUri = postLogoutRedirectUri;
+        return this;
+    }
+
+    public String getOrigin() {
+        return origin;
+    }
+
+    public OAuthClientConfig origin(String origin) {
+        this.origin = origin;
+        return this;
+    }
+
+    public String getScope() {
+        return getScope(true);
+    }
+
+    public String getScope(boolean attachOpenidIfNull) {
+        return openid && (scope != null || attachOpenidIfNull) ? TokenUtil.attachOIDCScope(scope) : scope;
+    }
+
+    public OAuthClientConfig scope(String scope) {
+        this.scope = scope;
+        return this;
+    }
+
+    public boolean isOpenid() {
+        return openid;
+    }
+
+    public OAuthClientConfig openid(boolean openid) {
+        this.openid = openid;
+        return this;
+    }
+
+    public String getResponseMode() {
+        return responseMode;
+    }
+
+    public OAuthClientConfig responseMode(String responseMode) {
+        this.responseMode = responseMode;
+        return this;
+    }
+
+    public String getResponseType() {
+        return responseType;
+    }
+
+    public OAuthClientConfig responseType(String responseType) {
+        this.responseType = responseType;
+        return this;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationRequest.java
new file mode 100644
index 000000000000..72fc68a7f050
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationRequest.java
@@ -0,0 +1,27 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+
+public class OpenIDProviderConfigurationRequest extends AbstractHttpGetRequest<OpenIDProviderConfigurationResponse> {
+
+    public OpenIDProviderConfigurationRequest(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getOpenIDConfiguration();
+    }
+
+    @Override
+    protected void initRequest() {
+    }
+
+    @Override
+    protected OpenIDProviderConfigurationResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new OpenIDProviderConfigurationResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationResponse.java
new file mode 100644
index 000000000000..b24470b7a920
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/OpenIDProviderConfigurationResponse.java
@@ -0,0 +1,25 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
+
+import java.io.IOException;
+
+public class OpenIDProviderConfigurationResponse extends AbstractHttpResponse {
+
+    private OIDCConfigurationRepresentation oidcConfiguration;
+
+    public OpenIDProviderConfigurationResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        oidcConfiguration = asJson(OIDCConfigurationRepresentation.class);
+    }
+
+    public OIDCConfigurationRepresentation getOidcConfiguration() {
+        return oidcConfiguration;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParRequest.java
new file mode 100644
index 000000000000..6d8afc46c164
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParRequest.java
@@ -0,0 +1,88 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class ParRequest extends AbstractHttpPostRequest<ParRequest, ParResponse> {
+
+    public ParRequest(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getPushedAuthorizationRequest();
+    }
+
+    public ParRequest signedJwt(String signedJwt) {
+        parameter(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT);
+        parameter(OAuth2Constants.CLIENT_ASSERTION, signedJwt);
+        return this;
+    }
+
+    public ParRequest nonce(String nonce) {
+        parameter(OIDCLoginProtocol.NONCE_PARAM, nonce);
+        return this;
+    }
+
+    public ParRequest state(String state) {
+        parameter(OIDCLoginProtocol.STATE_PARAM, state);
+        return this;
+    }
+
+    public ParRequest dpopJkt(String dpopJkt) {
+        parameter(OIDCLoginProtocol.DPOP_JKT, dpopJkt);
+        return this;
+    }
+
+    public ParRequest codeChallenge(PkceGenerator pkceGenerator) {
+        if (pkceGenerator != null) {
+            codeChallenge(pkceGenerator.getCodeChallenge(), pkceGenerator.getCodeChallengeMethod());
+        }
+        return this;
+    }
+
+    public ParRequest codeChallenge(String codeChallenge, String codeChallengeMethod) {
+        parameter(OAuth2Constants.CODE_CHALLENGE, codeChallenge);
+        parameter(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod);
+        return this;
+    }
+
+    public ParRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    public ParRequest request(String request) {
+        parameter(OIDCLoginProtocol.REQUEST_PARAM, request);
+        return this;
+    }
+
+    public ParRequest requestUri(String requestUri) {
+        parameter(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri);
+        return this;
+    }
+
+    @Override
+    protected void initRequest() {
+        parameter(OAuth2Constants.RESPONSE_TYPE, client.config().getResponseType());
+        parameter(OIDCLoginProtocol.RESPONSE_MODE_PARAM, client.config().getResponseMode());
+        parameter(OAuth2Constants.REDIRECT_URI, client.config().getRedirectUri());
+        parameter(OAuth2Constants.SCOPE, client.config().getScope());
+    }
+
+    @Override
+    protected void authorization() {
+        parameter(OAuth2Constants.CLIENT_ID, client.config().getClientId());
+        parameter(OAuth2Constants.CLIENT_SECRET, client.config().getClientSecret());
+    }
+
+    @Override
+    protected ParResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new ParResponse(response);
+    }
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParResponse.java
new file mode 100644
index 000000000000..e7c8d7e86976
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ParResponse.java
@@ -0,0 +1,37 @@
+package org.keycloak.testsuite.util.oauth;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+
+public class ParResponse extends AbstractHttpResponse {
+
+    private String requestUri;
+    private int expiresIn;
+
+    public ParResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        ObjectNode json = asJson();
+        requestUri = json.get("request_uri").asText();
+        expiresIn = json.get("expires_in").asInt();
+    }
+
+    @Override
+    protected int getSuccessCode() {
+        return 201;
+    }
+
+    public String getRequestUri() {
+        return requestUri;
+    }
+
+    public int getExpiresIn() {
+        return expiresIn;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PasswordGrantRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PasswordGrantRequest.java
new file mode 100644
index 000000000000..38d5624b5a15
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PasswordGrantRequest.java
@@ -0,0 +1,55 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class PasswordGrantRequest extends AbstractHttpPostRequest<PasswordGrantRequest, AccessTokenResponse> {
+
+    private final String username;
+    private final String password;
+    private String otp;
+
+    PasswordGrantRequest(String username, String password, AbstractOAuthClient<?> client) {
+        super(client);
+        this.username = username;
+        this.password = password;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    public PasswordGrantRequest otp(String otp) {
+        this.otp = otp;
+        return this;
+    }
+
+    public PasswordGrantRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    public PasswordGrantRequest param(String name, String value) {
+        parameter(name, value);
+        return this;
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD);
+        parameter("username", username);
+        parameter("password", password);
+        parameter("otp", otp);
+
+        scope();
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PkceGenerator.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PkceGenerator.java
new file mode 100644
index 000000000000..8a75cea1fa05
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/PkceGenerator.java
@@ -0,0 +1,43 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.OAuth2Constants;
+import org.keycloak.protocol.oidc.utils.PkceUtils;
+
+public class PkceGenerator {
+
+    private final String codeVerifier;
+    private final String codeChallenge;
+    private final String codeChallengeMethod;
+
+    public static PkceGenerator s256() {
+        String codeVerifier = PkceUtils.generateCodeVerifier();
+        String codeChallenge = PkceUtils.generateS256CodeChallenge(codeVerifier);
+        String codeChallengeMethod = OAuth2Constants.PKCE_METHOD_S256;
+        return new PkceGenerator(codeVerifier, codeChallenge, codeChallengeMethod);
+    }
+
+    public static PkceGenerator plain() {
+        String codeVerifier = PkceUtils.generateCodeVerifier();
+        String codeChallengeMethod = OAuth2Constants.PKCE_METHOD_PLAIN;
+        return new PkceGenerator(codeVerifier, codeVerifier, codeChallengeMethod);
+    }
+
+    private PkceGenerator(String codeVerifier, String codeChallenge, String codeChallengeMethod) {
+        this.codeVerifier = codeVerifier;
+        this.codeChallenge = codeChallenge;
+        this.codeChallengeMethod = codeChallengeMethod;
+    }
+
+    public String getCodeVerifier() {
+        return codeVerifier;
+    }
+
+    public String getCodeChallenge() {
+        return codeChallenge;
+    }
+
+    public String getCodeChallengeMethod() {
+        return codeChallengeMethod;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RefreshRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RefreshRequest.java
new file mode 100644
index 000000000000..479640b59ac2
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RefreshRequest.java
@@ -0,0 +1,39 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class RefreshRequest extends AbstractHttpPostRequest<RefreshRequest, AccessTokenResponse> {
+
+    private final String refreshToken;
+
+    RefreshRequest(String refreshToken, AbstractOAuthClient<?> client) {
+        super(client);
+        this.refreshToken = refreshToken;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    public RefreshRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN);
+        parameter(OAuth2Constants.REFRESH_TOKEN, refreshToken);
+        scope(false);
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RegistrationUrlBuilder.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RegistrationUrlBuilder.java
new file mode 100644
index 000000000000..0918ce46e918
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/RegistrationUrlBuilder.java
@@ -0,0 +1,14 @@
+package org.keycloak.testsuite.util.oauth;
+
+public class RegistrationUrlBuilder extends LoginUrlBuilder {
+
+    public RegistrationUrlBuilder(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    @Override
+    public String getEndpoint() {
+        return client.getEndpoints().getRegistration();
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenExchangeRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenExchangeRequest.java
new file mode 100644
index 000000000000..cdf47272a5a4
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenExchangeRequest.java
@@ -0,0 +1,76 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+public class TokenExchangeRequest extends AbstractHttpPostRequest<TokenExchangeRequest, AccessTokenResponse> {
+
+    private final String subjectToken;
+    private final String subjectTokenType;
+    private String requestedTokenType;
+    private String requestedSubject;
+    private List<String> audience;
+
+    TokenExchangeRequest(String subjectToken, String subjectTokenType, AbstractOAuthClient<?> client) {
+        super(client);
+        this.subjectToken = subjectToken;
+        this.subjectTokenType = subjectTokenType;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    public TokenExchangeRequest requestedTokenType(String requestedTokenType) {
+        this.requestedTokenType = requestedTokenType;
+        return this;
+    }
+
+    public TokenExchangeRequest requestedSubject(String requestedSubject) {
+        this.requestedSubject = requestedSubject;
+        return this;
+    }
+
+    public TokenExchangeRequest audience(List<String> audience) {
+        this.audience = audience;
+        return this;
+    }
+
+    public TokenExchangeRequest audience(String... audience) {
+        this.audience = Arrays.stream(audience).toList();
+        return this;
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+        parameter(OAuth2Constants.SUBJECT_TOKEN, subjectToken);
+        parameter(OAuth2Constants.SUBJECT_TOKEN_TYPE, subjectTokenType != null ? subjectTokenType : OAuth2Constants.ACCESS_TOKEN_TYPE);
+
+        if (requestedTokenType != null) {
+            parameter(OAuth2Constants.REQUESTED_TOKEN_TYPE, requestedTokenType);
+        }
+
+        if (requestedSubject != null) {
+            parameter(OAuth2Constants.REQUESTED_SUBJECT, requestedSubject);
+        }
+
+        if (audience != null) {
+            audience.forEach(a -> parameter(OAuth2Constants.AUDIENCE, a));
+        }
+
+        parameter(OAuth2Constants.SCOPE, client.config().getScope(false));
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationRequest.java
new file mode 100644
index 000000000000..b1ba413f61a6
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationRequest.java
@@ -0,0 +1,53 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class TokenRevocationRequest extends AbstractHttpPostRequest<TokenRevocationRequest, TokenRevocationResponse> {
+
+    private final String token;
+    private String tokenTypeHint;
+
+    TokenRevocationRequest(String token, AbstractOAuthClient<?> client) {
+        super(client);
+        this.token = token;
+    }
+
+    public TokenRevocationRequest tokenTypeHint(String tokenTypeHint) {
+        this.tokenTypeHint = tokenTypeHint;
+        return this;
+    }
+
+    public TokenRevocationRequest accessToken() {
+        this.tokenTypeHint = "access_token";
+        return this;
+    }
+
+    public TokenRevocationRequest refreshToken() {
+        this.tokenTypeHint = "refresh_token";
+        return this;
+    }
+
+    public TokenRevocationRequest dpopProof(String dpopProof) {
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+        return this;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getRevocation();
+    }
+
+    protected void initRequest() {
+        parameter("token", token);
+        parameter("token_type_hint", tokenTypeHint);
+    }
+
+    @Override
+    protected TokenRevocationResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new TokenRevocationResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationResponse.java
new file mode 100644
index 000000000000..5f3c3de7ad87
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokenRevocationResponse.java
@@ -0,0 +1,17 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+
+public class TokenRevocationResponse extends AbstractHttpResponse {
+
+    public TokenRevocationResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() {
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokensManager.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokensManager.java
new file mode 100644
index 000000000000..6c50acf6e3bc
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/TokensManager.java
@@ -0,0 +1,48 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.keycloak.TokenVerifier;
+import org.keycloak.common.VerificationException;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.representations.JsonWebToken;
+
+public class TokensManager {
+
+    private final KeyManager keyManager;
+
+    TokensManager(KeyManager keyManager) {
+        this.keyManager = keyManager;
+    }
+
+    public <T extends JsonWebToken> T verifyToken(String token, Class<T> clazz) {
+        try {
+            TokenVerifier<T> verifier = TokenVerifier.create(token, clazz);
+            String kid = verifier.getHeader().getKeyId();
+            String algorithm = verifier.getHeader().getAlgorithm().name();
+            KeyWrapper key = keyManager.getPublicKey(algorithm, kid);
+            AsymmetricSignatureVerifierContext verifierContext;
+            switch (algorithm) {
+                case Algorithm.ES256, Algorithm.ES384, Algorithm.ES512 ->
+                        verifierContext = new ServerECDSASignatureVerifierContext(key);
+                default -> verifierContext = new AsymmetricSignatureVerifierContext(key);
+            }
+            verifier.verifierContext(verifierContext);
+            verifier.verify();
+            return verifier.getToken();
+        } catch (VerificationException e) {
+            throw new RuntimeException("Failed to decode token", e);
+        }
+    }
+
+    public <T extends JsonWebToken> T parseToken(String token, Class<T> clazz) {
+        try {
+            return new JWSInput(token).readJsonContent(clazz);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoRequest.java
new file mode 100644
index 000000000000..7594a1fd0e1e
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoRequest.java
@@ -0,0 +1,43 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+
+public class UserInfoRequest extends AbstractHttpGetRequest<UserInfoResponse> {
+
+    private final String token;
+
+    private boolean dpop = false;
+    private String dpopProof;
+
+    public UserInfoRequest(String token, AbstractOAuthClient<?> client) {
+        super(client);
+        this.token = token;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getUserInfo();
+    }
+
+    public UserInfoRequest dpop(String dpopProof) {
+        this.dpop = true;
+        this.dpopProof = dpopProof;
+        return this;
+    }
+
+    @Override
+    protected void initRequest() {
+        String authorization = (dpop ? "DPoP" : "Bearer") + " " + token;
+        header("Authorization", authorization);
+        header(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
+    }
+
+    @Override
+    protected UserInfoResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new UserInfoResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoResponse.java
new file mode 100644
index 000000000000..2aedb3849165
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/UserInfoResponse.java
@@ -0,0 +1,25 @@
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.representations.UserInfo;
+
+import java.io.IOException;
+
+public class UserInfoResponse extends AbstractHttpResponse {
+
+    private UserInfo userInfo;
+
+    public UserInfoResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        userInfo = asJson(UserInfo.class);
+    }
+
+    public UserInfo getUserInfo() {
+        return userInfo;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/AuthenticationRequestAcknowledgement.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/AuthenticationRequestAcknowledgement.java
new file mode 100644
index 000000000000..fae1fede340d
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/AuthenticationRequestAcknowledgement.java
@@ -0,0 +1,39 @@
+package org.keycloak.testsuite.util.oauth.ciba;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.testsuite.util.oauth.AbstractHttpResponse;
+
+import java.io.IOException;
+
+public class AuthenticationRequestAcknowledgement extends AbstractHttpResponse {
+
+    private String authReqId;
+    private int expiresIn;
+    private int interval;
+
+    public AuthenticationRequestAcknowledgement(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        ObjectNode json = asJson();
+        authReqId = json.get("auth_req_id").asText();
+        expiresIn = json.get("expires_in").asInt();
+        interval = json.has("interval") ? json.get("interval").asInt() : -1;
+    }
+
+    public String getAuthReqId() {
+        return authReqId;
+    }
+
+    public int getExpiresIn() {
+        return expiresIn;
+    }
+
+    public int getInterval() {
+        return interval;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationRequest.java
new file mode 100644
index 000000000000..ac83cc4a5843
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationRequest.java
@@ -0,0 +1,79 @@
+package org.keycloak.testsuite.util.oauth.ciba;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
+import org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+
+import java.io.IOException;
+import java.util.Map;
+
+public class BackchannelAuthenticationRequest extends AbstractHttpPostRequest<BackchannelAuthenticationRequest, AuthenticationRequestAcknowledgement> {
+
+    private final String userid;
+    private String bindingMessage;
+    private String acrValues;
+    private String clientNotificationToken;
+    private Map<String, String> additionalParams;
+
+    BackchannelAuthenticationRequest(String userid, AbstractOAuthClient<?> client) {
+        super(client);
+        this.userid = userid;
+    }
+
+    public BackchannelAuthenticationRequest bindingMessage(String bindingMessage) {
+        this.bindingMessage = bindingMessage;
+        return this;
+    }
+
+    public BackchannelAuthenticationRequest acrValues(String acrValues) {
+        this.acrValues = acrValues;
+        return this;
+    }
+
+    public BackchannelAuthenticationRequest clientNotificationToken(String clientNotificationToken) {
+        this.clientNotificationToken = clientNotificationToken;
+        return this;
+    }
+
+    public BackchannelAuthenticationRequest additionalParams(Map<String, String> additionalParams) {
+        this.additionalParams = additionalParams;
+        return this;
+    }
+
+    public BackchannelAuthenticationRequest request(String request) {
+        parameter(OIDCLoginProtocol.REQUEST_PARAM, request);
+        return this;
+    }
+
+    public BackchannelAuthenticationRequest requestUri(String requestUri) {
+        parameter(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri);
+        return this;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getBackchannelAuthentication();
+    }
+
+    protected void initRequest() {
+        parameter(OIDCLoginProtocol.LOGIN_HINT_PARAM, userid);
+        parameter(CibaGrantType.BINDING_MESSAGE, bindingMessage);
+        parameter(OAuth2Constants.ACR_VALUES, acrValues);
+        parameter(CibaGrantType.CLIENT_NOTIFICATION_TOKEN, clientNotificationToken);
+
+        if (additionalParams != null) {
+            additionalParams.forEach(this::parameter);
+        }
+
+        scope();
+    }
+
+    @Override
+    protected AuthenticationRequestAcknowledgement toResponse(CloseableHttpResponse response) throws IOException {
+        return new AuthenticationRequestAcknowledgement(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationTokenRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationTokenRequest.java
new file mode 100644
index 000000000000..097be9bbe095
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/BackchannelAuthenticationTokenRequest.java
@@ -0,0 +1,37 @@
+package org.keycloak.testsuite.util.oauth.ciba;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+import java.io.IOException;
+
+import static org.keycloak.protocol.oidc.grants.ciba.CibaGrantType.AUTH_REQ_ID;
+
+public class BackchannelAuthenticationTokenRequest extends AbstractHttpPostRequest<BackchannelAuthenticationTokenRequest, AccessTokenResponse> {
+
+    private final String authReqId;
+
+    BackchannelAuthenticationTokenRequest(String authReqId, AbstractOAuthClient<?> client) {
+        super(client);
+        this.authReqId = authReqId;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CIBA_GRANT_TYPE);
+        parameter(AUTH_REQ_ID, authReqId);
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/CibaClient.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/CibaClient.java
new file mode 100644
index 000000000000..d6d789b24702
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/ciba/CibaClient.java
@@ -0,0 +1,47 @@
+package org.keycloak.testsuite.util.oauth.ciba;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.keycloak.protocol.oidc.grants.ciba.channel.AuthenticationChannelResponse;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.util.TokenUtil;
+
+public class CibaClient {
+
+    private final AbstractOAuthClient<?> client;
+
+    public CibaClient(AbstractOAuthClient<?> client) {
+        this.client = client;
+    }
+
+    public BackchannelAuthenticationRequest backchannelAuthenticationRequest(String userid) {
+        return new BackchannelAuthenticationRequest(userid, client);
+    }
+
+    public AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequest(String userid) {
+        return backchannelAuthenticationRequest(userid).send();
+    }
+
+    public BackchannelAuthenticationTokenRequest backchannelAuthenticationTokenRequest(String authReqId) {
+        return new BackchannelAuthenticationTokenRequest(authReqId, client);
+    }
+
+    public AccessTokenResponse doBackchannelAuthenticationTokenRequest(String authReqId) {
+        return backchannelAuthenticationTokenRequest(authReqId).send();
+    }
+
+    public int doAuthenticationChannelCallback(String requestToken, AuthenticationChannelResponse.Status authStatus) throws Exception {
+        HttpPost post = new HttpPost(client.getEndpoints().getBackchannelAuthenticationCallback());
+        post.setHeader("Authorization", TokenUtil.TOKEN_TYPE_BEARER + " " + requestToken);
+        post.setEntity(new StringEntity(JsonSerialization.writeValueAsString(new AuthenticationChannelResponse(authStatus)), ContentType.APPLICATION_JSON));
+
+        try (CloseableHttpResponse response = client.httpClient().get().execute(post)) {
+            return response.getStatusLine().getStatusCode();
+        }
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationRequest.java
new file mode 100644
index 000000000000..8063078284f9
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationRequest.java
@@ -0,0 +1,45 @@
+package org.keycloak.testsuite.util.oauth.device;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
+
+import java.io.IOException;
+
+public class DeviceAuthorizationRequest extends AbstractHttpPostRequest<DeviceAuthorizationRequest, DeviceAuthorizationResponse> {
+
+    DeviceAuthorizationRequest(AbstractOAuthClient<?> client) {
+        super(client);
+    }
+
+    public DeviceAuthorizationRequest codeChallenge(PkceGenerator pkceGenerator) {
+        if (pkceGenerator != null) {
+            codeChallenge(pkceGenerator.getCodeChallenge(), pkceGenerator.getCodeChallengeMethod());
+        }
+        return this;
+    }
+
+    public DeviceAuthorizationRequest codeChallenge(String codeChallenge, String codeChallengeMethod) {
+        parameter(OAuth2Constants.CODE_CHALLENGE, codeChallenge);
+        parameter(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod);
+        return this;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getDeviceAuthorization();
+    }
+
+    @Override
+    protected void initRequest() {
+        parameter(OAuth2Constants.SCOPE, client.config().getScope());
+    }
+
+    @Override
+    protected DeviceAuthorizationResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new DeviceAuthorizationResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationResponse.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationResponse.java
new file mode 100644
index 000000000000..f1c1c8c50fb4
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceAuthorizationResponse.java
@@ -0,0 +1,57 @@
+package org.keycloak.testsuite.util.oauth.device;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.testsuite.util.oauth.AbstractHttpResponse;
+
+import java.io.IOException;
+
+public class DeviceAuthorizationResponse extends AbstractHttpResponse {
+
+    private String deviceCode;
+    private String userCode;
+    private String verificationUri;
+    private String verificationUriComplete;
+    private int expiresIn;
+    private int interval;
+
+    public DeviceAuthorizationResponse(CloseableHttpResponse response) throws IOException {
+        super(response);
+    }
+
+    @Override
+    protected void parseContent() throws IOException {
+        ObjectNode responseJson = asJson();
+        deviceCode = responseJson.get("device_code").asText();
+        userCode = responseJson.get("user_code").asText();
+        verificationUri = responseJson.get("verification_uri").asText();
+        verificationUriComplete = responseJson.get("verification_uri_complete").asText();
+        expiresIn = responseJson.get("expires_in").asInt();
+        interval = responseJson.get("interval").asInt();
+    }
+
+    public String getDeviceCode() {
+        return deviceCode;
+    }
+
+    public String getUserCode() {
+        return userCode;
+    }
+
+    public String getVerificationUri() {
+        return verificationUri;
+    }
+
+    public String getVerificationUriComplete() {
+        return verificationUriComplete;
+    }
+
+    public int getExpiresIn() {
+        return expiresIn;
+    }
+
+    public int getInterval() {
+        return interval;
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceClient.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceClient.java
new file mode 100644
index 000000000000..3d3d7addc9dd
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceClient.java
@@ -0,0 +1,30 @@
+package org.keycloak.testsuite.util.oauth.device;
+
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+public class DeviceClient {
+
+    private final AbstractOAuthClient<?> client;
+
+    public DeviceClient(AbstractOAuthClient<?> client) {
+        this.client = client;
+    }
+
+    public DeviceAuthorizationRequest deviceAuthorizationRequest() {
+        return new DeviceAuthorizationRequest(client);
+    }
+
+    public DeviceAuthorizationResponse doDeviceAuthorizationRequest() {
+        return deviceAuthorizationRequest().send();
+    }
+
+    public DeviceTokenRequest deviceTokenRequest(String deviceCode) {
+        return new DeviceTokenRequest(deviceCode, client);
+    }
+
+    public AccessTokenResponse doDeviceTokenRequest(String deviceCode) {
+        return deviceTokenRequest(deviceCode).send();
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceTokenRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceTokenRequest.java
new file mode 100644
index 000000000000..0507ca9024cf
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/device/DeviceTokenRequest.java
@@ -0,0 +1,49 @@
+package org.keycloak.testsuite.util.oauth.device;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest;
+import org.keycloak.testsuite.util.oauth.AbstractOAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
+
+import java.io.IOException;
+
+public class DeviceTokenRequest extends AbstractHttpPostRequest<DeviceTokenRequest, AccessTokenResponse> {
+
+    private final String deviceCode;
+
+    DeviceTokenRequest(String deviceCode, AbstractOAuthClient<?> client) {
+        super(client);
+        this.deviceCode = deviceCode;
+    }
+
+    public DeviceTokenRequest codeVerifier(PkceGenerator pkceGenerator) {
+        if (pkceGenerator != null) {
+            codeVerifier(pkceGenerator.getCodeVerifier());
+        }
+        return this;
+    }
+
+    public DeviceTokenRequest codeVerifier(String codeVerifier) {
+        parameter(OAuth2Constants.CODE_VERIFIER, codeVerifier);
+        return this;
+    }
+
+    @Override
+    protected String getEndpoint() {
+        return client.getEndpoints().getToken();
+    }
+
+    @Override
+    protected void initRequest() {
+        parameter(OAuth2Constants.GRANT_TYPE, OAuth2Constants.DEVICE_CODE_GRANT_TYPE);
+        parameter("device_code", deviceCode);
+    }
+
+    @Override
+    protected AccessTokenResponse toResponse(CloseableHttpResponse response) throws IOException {
+        return new AccessTokenResponse(response);
+    }
+
+}
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/userprofile/UserProfileUtil.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/userprofile/UserProfileUtil.java
new file mode 100644
index 000000000000..300abef59b16
--- /dev/null
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/userprofile/UserProfileUtil.java
@@ -0,0 +1,69 @@
+package org.keycloak.testsuite.util.userprofile;
+
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.UserProfileResource;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.userprofile.config.UPAttribute;
+import org.keycloak.representations.userprofile.config.UPAttributePermissions;
+import org.keycloak.representations.userprofile.config.UPAttributeRequired;
+import org.keycloak.representations.userprofile.config.UPConfig;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.util.Set;
+
+import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_ADMIN;
+import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_USER;
+
+public class UserProfileUtil {
+
+    public static final String SCOPE_DEPARTMENT = "department";
+    public static final String ATTRIBUTE_DEPARTMENT = "department";
+
+    public static final String PERMISSIONS_ALL = "\"permissions\": {\"view\": [\"admin\", \"user\"], \"edit\": [\"admin\", \"user\"]}";
+    public static final String PERMISSIONS_ADMIN_ONLY = "\"permissions\": {\"view\": [\"admin\"], \"edit\": [\"admin\"]}";
+    public static final String PERMISSIONS_ADMIN_EDITABLE = "\"permissions\": {\"view\": [\"admin\", \"user\"], \"edit\": [\"admin\"]}";
+
+    public static String VALIDATIONS_LENGTH = "\"validations\": {\"length\": { \"min\": 3, \"max\": 255 }}";
+
+    public static final String CONFIGURATION_FOR_USER_EDIT = "{\"attributes\": ["
+            + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + "},"
+            + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + "},"
+            + "{\"name\": \"department\"," + PERMISSIONS_ALL + "}"
+            + "]}";
+
+    public static UPConfig setUserProfileConfiguration(RealmResource testRealm, String configuration) {
+        try {
+            UPConfig config = configuration == null ? null : JsonSerialization.readValue(configuration, UPConfig.class);
+
+            if (config != null) {
+                UPAttribute username = config.getAttribute(UserModel.USERNAME);
+
+                if (username == null) {
+                    config.addOrReplaceAttribute(new UPAttribute(UserModel.USERNAME));
+                }
+
+                UPAttribute email = config.getAttribute(UserModel.EMAIL);
+
+                if (email == null) {
+                    config.addOrReplaceAttribute(new UPAttribute(UserModel.EMAIL, new UPAttributePermissions(Set.of(ROLE_USER, ROLE_ADMIN), Set.of(ROLE_USER, ROLE_ADMIN)), new UPAttributeRequired(Set.of(ROLE_USER), Set.of())));
+                }
+            }
+
+            testRealm.users().userProfile().update(config);
+
+            return config;
+        } catch (IOException ioe) {
+            throw new RuntimeException("Failed to read configuration", ioe);
+        }
+    }
+
+    public static UPConfig enableUnmanagedAttributes(UserProfileResource upResource) {
+        UPConfig cfg = upResource.getConfiguration();
+        cfg.setUnmanagedAttributePolicy(UPConfig.UnmanagedAttributePolicy.ENABLED);
+        upResource.update(cfg);
+        return cfg;
+    }
+
+}
+
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/KerberosUtils.java b/tests/utils/src/main/java/org/keycloak/tests/utils/KerberosUtils.java
new file mode 100644
index 000000000000..96f6c82a6afa
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/KerberosUtils.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2023 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.tests.utils;
+
+import org.junit.jupiter.api.Assumptions;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosUtils {
+
+    // TODO Figure out if we need to be able to disable Kerberos support for some tests; if so find a better way
+    public static boolean isKerberosSupportExpected() {
+        String kerberosSupported = System.getProperty("auth.server.kerberos.supported");
+        // Supported by default. It is considered unsupported just if explicitly disabled
+        return !"false".equals(kerberosSupported);
+    }
+
+    public static void assumeKerberosSupportExpected() {
+        Assumptions.assumeTrue(isKerberosSupportExpected(), "Kerberos feature is not expected to be supported by auth server");
+    }
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/KeyUtils.java b/tests/utils/src/main/java/org/keycloak/tests/utils/KeyUtils.java
new file mode 100644
index 000000000000..abf4cafdc6b6
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/KeyUtils.java
@@ -0,0 +1,168 @@
+package org.keycloak.tests.utils;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.Assertions;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.BouncyIntegration;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.crypto.JavaAlgorithm;
+import org.keycloak.crypto.KeyStatus;
+import org.keycloak.crypto.KeyType;
+import org.keycloak.crypto.KeyUse;
+import org.keycloak.keys.AbstractEcKeyProviderFactory;
+import org.keycloak.keys.GeneratedEcdhKeyProviderFactory;
+import org.keycloak.keys.GeneratedEcdsaKeyProviderFactory;
+import org.keycloak.keys.KeyProvider;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.representations.idm.KeysMetadataRepresentation;
+import org.keycloak.tests.utils.admin.ApiUtil;
+
+import javax.crypto.KeyGenerator;
+import javax.crypto.SecretKey;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.spec.ECGenParameterSpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
+import java.util.function.Predicate;
+import java.util.stream.Stream;
+
+
+/**
+ * @author mhajas
+ */
+public class KeyUtils {
+    public static KeyPair generateECKey(String algorithm) {
+
+        try {
+            KeyPairGenerator kpg = CryptoIntegration.getProvider().getKeyPairGen("ECDSA");
+            String domainParamNistRep = GeneratedEcdsaKeyProviderFactory
+                    .convertJWSAlgorithmToECDomainParmNistRep(algorithm);
+            if (domainParamNistRep == null) {
+                domainParamNistRep = GeneratedEcdhKeyProviderFactory
+                        .convertJWEAlgorithmToECDomainParmNistRep(algorithm);
+            }
+            String curve = AbstractEcKeyProviderFactory.convertECDomainParmNistRepToSecRep(domainParamNistRep);
+            ECGenParameterSpec parameterSpec = new ECGenParameterSpec(curve);
+            kpg.initialize(parameterSpec);
+            return kpg.generateKeyPair();
+        } catch (NoSuchAlgorithmException | NoSuchProviderException | InvalidAlgorithmParameterException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static KeyPair generateEdDSAKey(String curve) throws NoSuchAlgorithmException, NoSuchProviderException {
+        KeyPairGenerator kpg = CryptoIntegration.getProvider().getKeyPairGen(curve);
+        return kpg.generateKeyPair();
+    }
+
+    public static SecretKey generateSecretKey(String algorithm, int keySize) throws NoSuchAlgorithmException, NoSuchProviderException {
+        KeyGenerator keyGen = KeyGenerator.getInstance(JavaAlgorithm.getJavaAlgorithm(algorithm), BouncyIntegration.PROVIDER);
+        keyGen.init(keySize);
+        return keyGen.generateKey();
+    }
+
+    public static PublicKey publicKeyFromString(String key) {
+        try {
+            KeyFactory kf = CryptoIntegration.getProvider().getKeyFactory(KeyType.RSA);
+            byte[] encoded = Base64.getDecoder().decode(key);
+            return kf.generatePublic(new X509EncodedKeySpec(encoded));
+        } catch (NoSuchAlgorithmException | InvalidKeySpecException | NoSuchProviderException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static PrivateKey privateKeyFromString(String key) {
+        try {
+            KeyFactory kf = CryptoIntegration.getProvider().getKeyFactory(KeyType.RSA);
+            byte[] encoded = Base64.getDecoder().decode(key);
+            return kf.generatePrivate(new PKCS8EncodedKeySpec(encoded));
+        } catch (NoSuchAlgorithmException | InvalidKeySpecException | NoSuchProviderException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static KeysMetadataRepresentation.KeyMetadataRepresentation getActiveEncryptionKey(KeysMetadataRepresentation keys, String algorithm) {
+        for (KeysMetadataRepresentation.KeyMetadataRepresentation k : keys.getKeys()) {
+            if (k.getAlgorithm().equals(algorithm) && KeyStatus.valueOf(k.getStatus()).isActive() && KeyUse.ENC.equals(k.getUse())) {
+                return k;
+            }
+        }
+        throw new RuntimeException("Active key not found");
+    }
+
+    public static KeysMetadataRepresentation.KeyMetadataRepresentation findActiveSigningKey(RealmResource realm) {
+        return findRealmKeys(realm, rep -> rep.getPublicKey() != null && KeyStatus.valueOf(rep.getStatus()).isActive() && KeyUse.SIG.equals(rep.getUse()))
+                .findFirst()
+                .orElse(null);
+    }
+
+    public static KeysMetadataRepresentation.KeyMetadataRepresentation findActiveSigningKey(RealmResource realm, String alg) {
+        return findRealmKeys(realm, rep -> rep.getPublicKey() != null && KeyStatus.valueOf(rep.getStatus()).isActive() && KeyUse.SIG.equals(rep.getUse()) && alg.equals(rep.getAlgorithm()))
+                .findFirst()
+                .orElse(null);
+    }
+
+    public static KeysMetadataRepresentation.KeyMetadataRepresentation findActiveEncryptingKey(RealmResource realm, String alg) {
+        return findRealmKeys(realm, rep -> rep.getPublicKey() != null && KeyStatus.valueOf(rep.getStatus()).isActive() && KeyUse.ENC.equals(rep.getUse()) && alg.equals(rep.getAlgorithm()))
+                .findFirst()
+                .orElse(null);
+    }
+
+    public static Stream<KeysMetadataRepresentation.KeyMetadataRepresentation> findRealmKeys(RealmResource realm, Predicate<KeysMetadataRepresentation.KeyMetadataRepresentation> filter) {
+        return realm.keys().getKeyMetadata().getKeys().stream().filter(filter);
+    }
+
+    public static AutoCloseable generateNewRealmKey(RealmResource realm, KeyUse keyUse, String algorithm, String priority) {
+        String realmId = realm.toRepresentation().getId();
+
+        ComponentRepresentation keys = new ComponentRepresentation();
+        keys.setName("generated");
+        keys.setProviderType(KeyProvider.class.getName());
+        keys.setProviderId(keyUse == KeyUse.ENC ? "rsa-enc-generated" : "rsa-generated");
+        keys.setParentId(realmId);
+        keys.setConfig(new MultivaluedHashMap<>());
+        keys.getConfig().putSingle("priority", priority);
+        keys.getConfig().putSingle("keyUse", KeyUse.ENC.getSpecName());
+        keys.getConfig().putSingle("algorithm", algorithm);
+        Response response = realm.components().add(keys);
+        Assertions.assertEquals(201, response.getStatus());
+        String id = ApiUtil.getCreatedId(response);
+        response.close();
+
+        return () -> realm.components().removeComponent(id);
+    }
+
+    public static AutoCloseable generateNewRealmKey(RealmResource realm, KeyUse keyUse, String algorithm) {
+        return generateNewRealmKey(realm, keyUse, algorithm, "100");
+    }
+
+    /**
+     * @return key sizes, which are expected to be supported by Keycloak server for {@link org.keycloak.keys.GeneratedRsaKeyProviderFactory} and {@link org.keycloak.keys.GeneratedRsaEncKeyProviderFactory}.
+     */
+    public static String[] getExpectedSupportedRsaKeySizes() {
+        String expectedKeySizes = System.getProperty("auth.server.supported.rsa.key.sizes");
+        if (expectedKeySizes == null || expectedKeySizes.trim().isEmpty()) {
+            Assertions.fail("System property 'auth.server.supported.rsa.key.sizes' should be set");
+        }
+        return expectedKeySizes.split(",");
+    }
+
+    /**
+     * @return Lowest key size supported by Keycloak server for {@link org.keycloak.keys.GeneratedRsaKeyProviderFactory}.
+     * It is usually 1024, but can be 2048 in some environments (typically in FIPS environments)
+     */
+    public static int getLowestSupportedRsaKeySize() {
+        return Integer.parseInt(getExpectedSupportedRsaKeySizes()[0]);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/admin/AdminEventPaths.java b/tests/utils/src/main/java/org/keycloak/tests/utils/admin/AdminEventPaths.java
new file mode 100644
index 000000000000..f26620e3aae2
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/admin/AdminEventPaths.java
@@ -0,0 +1,491 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.tests.utils.admin;
+
+import jakarta.ws.rs.core.UriBuilder;
+import org.keycloak.admin.client.resource.AttackDetectionResource;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
+import org.keycloak.admin.client.resource.ClientAttributeCertificateResource;
+import org.keycloak.admin.client.resource.ClientInitialAccessResource;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ClientScopeResource;
+import org.keycloak.admin.client.resource.ClientScopesResource;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.admin.client.resource.ComponentsResource;
+import org.keycloak.admin.client.resource.GroupResource;
+import org.keycloak.admin.client.resource.GroupsResource;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.admin.client.resource.IdentityProvidersResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.RoleByIdResource;
+import org.keycloak.admin.client.resource.RoleMappingResource;
+import org.keycloak.admin.client.resource.RoleResource;
+import org.keycloak.admin.client.resource.RolesResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.admin.client.resource.UsersResource;
+
+import java.net.URI;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AdminEventPaths {
+
+    // REALM
+
+    public static String deleteSessionPath(String userSessionId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "deleteSession").build(userSessionId);
+        return uri.toString();
+    }
+
+    public static String defaultGroupPath(String groupId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "addDefaultGroup").build(groupId);
+        return uri.toString();
+    }
+
+    public static String defaultDefaultClientScopePath(String clientScopeId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "addDefaultDefaultClientScope").build(clientScopeId);
+        return uri.toString();
+    }
+
+    public static String defaultOptionalClientScopePath(String clientScopeId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "addDefaultOptionalClientScope").build(clientScopeId);
+        return uri.toString();
+    }
+
+    public static String userProfilePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "users")
+                .path(UsersResource.class, "userProfile")
+                .build();
+        return uri.toString();
+    }
+
+    // CLIENT RESOURCE
+
+    public static String clientResourcePath(String clientDbId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "clients").path(ClientsResource.class, "get").build(clientDbId);
+        return uri.toString();
+    }
+
+    public static String clientRolesResourcePath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "roles").build();
+        return uri.toString();
+    }
+
+    public static String clientRoleResourcePath(String clientDbId, String roleName) {
+        URI uri = UriBuilder.fromUri(clientRolesResourcePath(clientDbId)).path(RolesResource.class, "get").build(roleName);
+        return uri.toString();
+    }
+
+    public static String clientRoleResourceCompositesPath(String clientDbId, String roleName) {
+        URI uri = UriBuilder.fromUri(clientRoleResourcePath(clientDbId, roleName))
+                .path(RoleResource.class, "getRoleComposites").build();
+        return uri.toString();
+    }
+
+    public static String clientProtocolMappersPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId))
+                .path(ClientResource.class, "getProtocolMappers")
+                .build();
+        return uri.toString();
+    }
+
+
+    public static String clientProtocolMapperPath(String clientDbId, String protocolMapperId) {
+        URI uri = UriBuilder.fromUri(clientProtocolMappersPath(clientDbId))
+                .path(ProtocolMappersResource.class, "getMapperById")
+                .build(protocolMapperId);
+        return uri.toString();
+    }
+
+    public static String clientPushRevocationPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "pushRevocation").build();
+        return uri.toString();
+    }
+
+    public static String clientNodesPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "registerNode").build();
+        return uri.toString();
+    }
+
+    public static String clientNodePath(String clientDbId, String node) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "unregisterNode").build(node);
+        return uri.toString();
+    }
+
+    public static String clientTestNodesAvailablePath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "testNodesAvailable").build();
+        return uri.toString();
+    }
+
+    public static String clientGenerateSecretPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "generateNewSecret").build();
+        return uri.toString();
+    }
+
+    public static String clientRegenerateRegistrationAccessTokenPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "regenerateRegistrationAccessToken").build();
+        return uri.toString();
+    }
+
+    public static String clientCertificateGenerateSecretPath(String clientDbId, String certificateAttribute) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId))
+                .path(ClientResource.class, "getCertficateResource")
+                .path(ClientAttributeCertificateResource.class, "generate")
+                .build(certificateAttribute);
+        return uri.toString();
+    }
+
+
+    public static String clientScopeMappingsRealmLevelPath(String clientDbId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "getScopeMappings")
+                .path(RoleMappingResource.class, "realmLevel")
+                .build();
+        return uri.toString();
+    }
+
+    public static String clientScopeMappingsClientLevelPath(String clientDbId, String clientOwningRoleId) {
+        URI uri = UriBuilder.fromUri(clientResourcePath(clientDbId)).path(ClientResource.class, "getScopeMappings")
+                .path(RoleMappingResource.class, "clientLevel")
+                .build(clientOwningRoleId);
+        return uri.toString();
+    }
+
+
+
+    // CLIENT SCOPES
+
+    public static String clientScopeResourcePath(String clientScopeId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "clientScopes").path(ClientScopesResource.class, "get").build(clientScopeId);
+        return uri.toString();
+    }
+
+    public static String clientScopeGenerateAudienceClientScopePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "clientScopes").path(ClientScopesResource.class, "generateAudienceClientScope").build();
+        return uri.toString();
+    }
+
+    public static String clientScopeRoleMappingsRealmLevelPath(String clientScopeDbId) {
+        URI uri = UriBuilder.fromUri(clientScopeResourcePath(clientScopeDbId)).path(ClientScopeResource.class, "getScopeMappings")
+                .path(RoleMappingResource.class, "realmLevel")
+                .build();
+        return uri.toString();
+    }
+
+    public static String clientScopeRoleMappingsClientLevelPath(String clientScopeDbId, String clientOwningRoleId) {
+        URI uri = UriBuilder.fromUri(clientScopeResourcePath(clientScopeDbId)).path(ClientScopeResource.class, "getScopeMappings")
+                .path(RoleMappingResource.class, "clientLevel")
+                .build(clientOwningRoleId);
+        return uri.toString();
+    }
+
+    public static String clientScopeProtocolMappersPath(String clientScopeDbId) {
+        URI uri = UriBuilder.fromUri(clientScopeResourcePath(clientScopeDbId))
+                .path(ClientScopeResource.class, "getProtocolMappers")
+                .build();
+        return uri.toString();
+    }
+
+
+    public static String clientScopeProtocolMapperPath(String clientScopeDbId, String protocolMapperId) {
+        URI uri = UriBuilder.fromUri(clientScopeProtocolMappersPath(clientScopeDbId))
+                .path(ProtocolMappersResource.class, "getMapperById")
+                .build(protocolMapperId);
+        return uri.toString();
+    }
+
+    // ROLES
+
+    public static String rolesResourcePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "roles").build();
+        return uri.toString();
+    }
+
+    public static String roleResourcePath(String roleName) {
+        URI uri = UriBuilder.fromUri(rolesResourcePath()).path(RolesResource.class, "get").build(roleName);
+        return uri.toString();
+    }
+
+    public static String roleResourceCompositesPath(String roleName) {
+        URI uri = UriBuilder.fromUri(roleResourcePath(roleName)).path(RoleResource.class, "getRoleComposites").build();
+        return uri.toString();
+    }
+
+    public static String rolesByIdResourcePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "rolesById").build();
+        return uri.toString();
+    }
+
+    public static String roleByIdResourcePath(String roleId) {
+        URI uri = UriBuilder.fromUri(rolesByIdResourcePath()).path(RoleByIdResource.class, "getRole").build(roleId);
+        return uri.toString();
+    }
+
+    public static String roleByIdResourceCompositesPath(String roleId) {
+        URI uri = UriBuilder.fromUri(rolesByIdResourcePath()).path(RoleByIdResource.class, "getRoleComposites").build(roleId);
+        return uri.toString();
+    }
+
+    // USERS
+
+    public static String userResourcePath(String userId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "users").path(UsersResource.class, "get").build(userId);
+        return uri.toString();
+    }
+
+    public static String userResetPasswordPath(String userId) {
+        URI uri = UriBuilder.fromUri(userResourcePath(userId)).path(UserResource.class, "resetPassword").build(userId);
+        return uri.toString();
+    }
+
+    public static String userRealmRoleMappingsPath(String userId) {
+        URI uri = UriBuilder.fromUri(userResourcePath(userId))
+                .path(UserResource.class, "roles")
+                .path(RoleMappingResource.class, "realmLevel").build();
+        return uri.toString();
+    }
+
+    public static String userClientRoleMappingsPath(String userId, String clientDbId) {
+        URI uri = UriBuilder.fromUri(userResourcePath(userId))
+                .path(UserResource.class, "roles")
+                .path(RoleMappingResource.class, "clientLevel").build(clientDbId);
+        return uri.toString();
+    }
+
+    public static String userFederatedIdentityLink(String userId, String idpAlias) {
+        URI uri = UriBuilder.fromUri(userResourcePath(userId))
+                .path(UserResource.class, "addFederatedIdentity")
+                .build(idpAlias);
+        return uri.toString();
+    }
+
+    public static String userGroupPath(String userId, String groupId) {
+        URI uri = UriBuilder.fromUri(userResourcePath(userId))
+                .path(UserResource.class, "joinGroup")
+                .build(groupId);
+        return uri.toString();
+    }
+
+    // IDENTITY PROVIDERS
+
+    public static String identityProvidersPath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "identityProviders").build();
+        return uri.toString();
+    }
+
+    public static String identityProviderCreatePath() {
+        URI uri = UriBuilder.fromUri(identityProvidersPath()).path(IdentityProvidersResource.class, "create").build();
+        return uri.toString();
+    }
+
+    public static String identityProviderPath(String idpAlias) {
+        URI uri = UriBuilder.fromUri(identityProvidersPath()).path(IdentityProvidersResource.class, "get").build(idpAlias);
+        return uri.toString();
+    }
+
+    public static String identityProviderMapperPath(String idpAlias, String idpMapperId) {
+        URI uri = UriBuilder.fromUri(identityProviderPath(idpAlias)).path(IdentityProviderResource.class, "getMapperById").build(idpMapperId);
+        return uri.toString();
+    }
+
+    // COMPONENTS
+    public static String componentsPath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "components").build();
+        return uri.toString();
+    }
+
+    public static String componentPath(String componentId) {
+        URI uri = UriBuilder.fromUri(componentsPath()).path(ComponentsResource.class, "component").build(componentId);
+        return uri.toString();
+    }
+
+
+
+
+    // CLIENT INITIAL ACCESS
+
+    public static String clientInitialAccessPath(String clientInitialAccessId) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "clientInitialAccess")
+                .path(ClientInitialAccessResource.class, "delete")
+                .build(clientInitialAccessId);
+        return uri.toString();
+    }
+
+    // GROUPS
+
+    public static String groupsPath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "groups")
+                .build();
+        return uri.toString();
+    }
+
+    public static String groupPath(String groupId) {
+        URI uri = UriBuilder.fromUri(groupsPath()).path(GroupsResource.class, "group")
+                .build(groupId);
+        return uri.toString();
+    }
+
+    public static String groupRolesPath(String groupId) {
+        URI uri = UriBuilder.fromUri(groupPath(groupId))
+                .path(GroupResource.class, "roles")
+                .build();
+        return uri.toString();
+    }
+
+    public static String groupRolesRealmRolesPath(String groupId) {
+        URI uri = UriBuilder.fromUri(groupRolesPath(groupId))
+                .path(RoleMappingResource.class, "realmLevel")
+                .build();
+        return uri.toString();
+    }
+
+    public static String groupRolesClientRolesPath(String groupId, String clientDbId) {
+        URI uri = UriBuilder.fromUri(groupRolesPath(groupId))
+                .path(RoleMappingResource.class, "clientLevel")
+                .build(clientDbId);
+        return uri.toString();
+    }
+
+    public static String groupSubgroupsPath(String groupId) {
+        URI uri = UriBuilder.fromUri(groupPath(groupId))
+                .path(GroupResource.class, "subGroup")
+                .build();
+        return uri.toString();
+    }
+
+
+    // AUTHENTICATION FLOWS
+
+    public static String authMgmtBasePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "flows")
+                .build();
+        return uri.toString();
+    }
+
+    public static String authFlowsPath() {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "getFlows")
+                .build();
+        return uri.toString();
+    }
+
+    public static String authFlowPath(String flowId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "getFlow")
+                .build(flowId);
+        return uri.toString();
+    }
+
+    public static String authCopyFlowPath(String flowAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "copy")
+                .build(flowAlias);
+        return uri.toString();
+    }
+
+    public static String authEditFlowPath(String flowId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "updateFlow")
+        .build(flowId);
+        return uri.toString();
+    }
+    public static String authAddExecutionFlowPath(String flowAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "addExecutionFlow")
+                .build(flowAlias);
+        return uri.toString();
+    }
+
+    public static String authAddExecutionPath(String flowAlias) {
+        return authFlowPath(flowAlias) + "/executions/execution";
+    }
+
+    public static String authUpdateExecutionPath(String flowAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "updateExecutions")
+                .build(flowAlias);
+        return uri.toString();
+    }
+
+    public static String authExecutionPath(String executionId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "removeExecution")
+                .build(executionId);
+        return uri.toString();
+    }
+
+    public static String authAddExecutionConfigPath(String executionId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "newExecutionConfig")
+                .build(executionId);
+        return uri.toString();
+    }
+
+    public static String authExecutionConfigPath(String configId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "getAuthenticatorConfig")
+                .build(configId);
+        return uri.toString();
+    }
+
+    public static String authRaiseExecutionPath(String executionId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "raisePriority")
+                .build(executionId);
+        return uri.toString();
+    }
+
+    public static String authLowerExecutionPath(String executionId) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "lowerPriority")
+                .build(executionId);
+        return uri.toString();
+    }
+
+    public static String authRequiredActionPath(String requiredActionAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "getRequiredAction")
+                .build(requiredActionAlias);
+        return uri.toString();
+    }
+
+    public static String authRequiredActionConfigPath(String requiredActionAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "getRequiredActionConfig")
+                .build(requiredActionAlias);
+        return uri.toString();
+    }
+
+    public static String authRaiseRequiredActionPath(String requiredActionAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "raiseRequiredActionPriority")
+                .build(requiredActionAlias);
+        return uri.toString();
+    }
+
+    public static String authLowerRequiredActionPath(String requiredActionAlias) {
+        URI uri = UriBuilder.fromUri(authMgmtBasePath()).path(AuthenticationManagementResource.class, "lowerRequiredActionPriority")
+                .build(requiredActionAlias);
+        return uri.toString();
+    }
+
+    // ATTACK DETECTION
+
+    public static String attackDetectionClearBruteForceForUserPath(String username) {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "attackDetection")
+                .path(AttackDetectionResource.class, "clearBruteForceForUser")
+                .build(username);
+        return uri.toString();
+    }
+
+    public static String attackDetectionClearAllBruteForcePath() {
+        URI uri = UriBuilder.fromUri("").path(RealmResource.class, "attackDetection")
+                .path(AttackDetectionResource.class, "clearAllBruteForce")
+                .build();
+        return uri.toString();
+    }
+
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/admin/ApiUtil.java b/tests/utils/src/main/java/org/keycloak/tests/utils/admin/ApiUtil.java
index 41925af25b4a..f996956d611d 100644
--- a/tests/utils/src/main/java/org/keycloak/tests/utils/admin/ApiUtil.java
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/admin/ApiUtil.java
@@ -67,15 +67,6 @@ public static ClientResource findClientResourceById(RealmResource realm, String
         return null;
     }
 
-    public static ClientResource findClientResourceByClientId(RealmResource realm, String clientId) {
-        for (ClientRepresentation c : realm.clients().findAll()) {
-            if (c.getClientId().equals(clientId)) {
-                return realm.clients().get(c.getId());
-            }
-        }
-        return null;
-    }
-
     public static ClientResource findClientResourceByName(RealmResource realm, String name) {
         for (ClientRepresentation c : realm.clients().findAll()) {
             if (name.equals(c.getName())) {
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseBodyMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseBodyMatcher.java
new file mode 100644
index 000000000000..6a3eab8d59eb
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseBodyMatcher.java
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.http.HttpResponse;
+import org.apache.http.util.EntityUtils;
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+
+import java.io.IOException;
+
+/**
+ * Matcher for matching status code of {@link Response} instance.
+ * @author hmlnarik
+ */
+public class HttpResponseBodyMatcher extends BaseMatcher<HttpResponse> {
+
+    private final Matcher<String> matcher;
+
+    private ThreadLocal<String> lastEntity = new ThreadLocal<>();
+
+    public HttpResponseBodyMatcher(Matcher<String> matcher) {
+        this.matcher = matcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        lastEntity.remove();
+        try {
+            lastEntity.set(EntityUtils.toString(((HttpResponse) item).getEntity()));
+            return (item instanceof HttpResponse) && this.matcher.matches(lastEntity.get());
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Override
+    public void describeMismatch(Object item, Description description) {
+        Description d = description.appendText("was ").appendValue(item);
+        if (lastEntity.get() != null) {
+            d.appendText(" with entity ").appendText(lastEntity.get());
+        }
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("response body matches ").appendDescriptionOf(this.matcher);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseStatusCodeMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseStatusCodeMatcher.java
new file mode 100644
index 000000000000..bee5f04a8bae
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/HttpResponseStatusCodeMatcher.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.http.HttpResponse;
+import org.apache.http.util.EntityUtils;
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+
+import java.io.IOException;
+
+/**
+ * Matcher for matching status code of {@link Response} instance.
+ * @author hmlnarik
+ */
+public class HttpResponseStatusCodeMatcher extends BaseMatcher<HttpResponse> {
+
+    private final Matcher<? extends Number> matcher;
+
+    public HttpResponseStatusCodeMatcher(Matcher<? extends Number> matcher) {
+        this.matcher = matcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        return (item instanceof HttpResponse) && this.matcher.matches(((HttpResponse) item).getStatusLine().getStatusCode());
+    }
+
+    @Override
+    public void describeMismatch(Object item, Description description) {
+        Description d = description.appendText("was ").appendValue(item)
+          .appendText(" with entity ");
+        try {
+            d.appendText(EntityUtils.toString(((HttpResponse) item).getEntity()));
+        } catch (IOException e) {
+            d.appendText("<Cannot decode entity: " + e.getMessage() + ">");
+        }
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("response status code matches ").appendDescriptionOf(this.matcher);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/Matchers.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/Matchers.java
new file mode 100644
index 000000000000..fd09745ca53f
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/Matchers.java
@@ -0,0 +1,166 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.http.HttpResponse;
+import org.hamcrest.Matcher;
+import org.keycloak.dom.saml.v2.SAML2Object;
+import org.keycloak.dom.saml.v2.protocol.AuthnRequestType;
+import org.keycloak.dom.saml.v2.protocol.LogoutRequestType;
+import org.keycloak.dom.saml.v2.protocol.ResponseType;
+import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+
+import java.net.URI;
+import java.util.Arrays;
+import java.util.Map;
+
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.is;
+
+/**
+ * Additional hamcrest matchers
+ * @author hmlnarik
+ */
+public class Matchers {
+
+    /**
+     * Matcher on HTTP status code of a {@link Response} instance.
+     * @param matcher
+     * @return
+     */
+    public static Matcher<Response> body(Matcher<String> matcher) {
+        return new ResponseBodyMatcher(matcher);
+    }
+
+    /**
+     * Matcher on HTTP body of a {@link Response} instance.
+     * @param matcher
+     * @return
+     */
+    public static Matcher<HttpResponse> bodyHC(Matcher<String> matcher) {
+        return new HttpResponseBodyMatcher(matcher);
+    }
+
+    /**
+     * Matcher on HTTP status code of a {@link Response} instance.
+     * @param matcher
+     * @return
+     */
+    public static Matcher<Response> statusCode(Matcher<? extends Number> matcher) {
+        return new ResponseStatusCodeMatcher(matcher);
+    }
+
+    /**
+     * Matcher on HTTP status code of a {@link Response} instance (HttpClient variant).
+     * @param matcher
+     * @return
+     */
+    public static Matcher<HttpResponse> statusCodeHC(Matcher<? extends Number> matcher) {
+        return new HttpResponseStatusCodeMatcher(matcher);
+    }
+
+    /**
+     * Matches when the HTTP status code of a {@link Response} instance is equal to the given code.
+     * @param expectedStatusCode
+     * @return
+     */
+    public static Matcher<Response> statusCodeIs(Response.Status expectedStatusCode) {
+        return new ResponseStatusCodeMatcher(org.hamcrest.Matchers.is(expectedStatusCode.getStatusCode()));
+    }
+
+    /**
+     * Matches when the HTTP status code of a {@link Response} instance is equal to the given code (HttpClient variant).
+     * @param expectedStatusCode
+     * @return
+     */
+    public static Matcher<HttpResponse> statusCodeIsHC(Response.Status expectedStatusCode) {
+        return new HttpResponseStatusCodeMatcher(org.hamcrest.Matchers.is(expectedStatusCode.getStatusCode()));
+    }
+
+    /**
+     * Matches when the HTTP status code of a {@link Response} instance is equal to the given code.
+     * @param expectedStatusCode
+     * @return
+     */
+    public static Matcher<Response> statusCodeIs(int expectedStatusCode) {
+        return new ResponseStatusCodeMatcher(org.hamcrest.Matchers.is(expectedStatusCode));
+    }
+
+    /**
+     * Matches when the HTTP status code of a {@link Response} instance is equal to the given code (HttpClient variant).
+     * @param expectedStatusCode
+     * @return
+     */
+    public static Matcher<HttpResponse> statusCodeIsHC(int expectedStatusCode) {
+        return new HttpResponseStatusCodeMatcher(org.hamcrest.Matchers.is(expectedStatusCode));
+    }
+
+    /**
+     * Matches when the HTTP status code of a {@link Response} instance is equal to the given code.
+     * @param matcher
+     * @return
+     */
+    public static <T> Matcher<Response> header(Matcher<Map<String, T>> matcher) {
+        return new ResponseHeaderMatcher<>(matcher);
+    }
+
+    /**
+     * Matches when the SAML status code of a {@link ResponseType} instance is equal to the given code.
+     * @param expectedStatus
+     * @return
+     */
+    public static <T> Matcher<SAML2Object> isSamlResponse(JBossSAMLURIConstants expectedStatus) {
+        return allOf(
+          instanceOf(ResponseType.class),
+          new SamlResponseTypeMatcher(is(expectedStatus.getUri()))
+        );
+    }
+
+    /**
+     * Matches when the destination of a SAML {@link LogoutRequestType} instance is equal to the given destination.
+     * @param destination
+     * @return
+     */
+    public static <T> Matcher<SAML2Object> isSamlLogoutRequest(String destination) {
+        return allOf(
+          instanceOf(LogoutRequestType.class),
+          new SamlLogoutRequestTypeMatcher(URI.create(destination))
+        );
+    }
+    /**
+     * Matches when the type of a SAML object is instance of {@link AuthnRequestType}.
+     * @return
+     */
+    public static <T> Matcher<SAML2Object> isSamlAuthnRequest() {
+        return instanceOf(AuthnRequestType.class);
+    }
+
+    /**
+     * Matches when the SAML status of a {@link StatusResponseType} instance is equal to the given code.
+     * @param expectedStatus
+     * @return
+     */
+    public static <T> Matcher<SAML2Object> isSamlStatusResponse(JBossSAMLURIConstants... expectedStatus) {
+        return allOf(
+          instanceOf(StatusResponseType.class),
+          new SamlStatusResponseTypeMatcher(Arrays.stream(expectedStatus).map(JBossSAMLURIConstants::getUri).toArray(i -> new URI[i]))
+        );
+    }
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseBodyMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseBodyMatcher.java
new file mode 100644
index 000000000000..bd64f4f55516
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseBodyMatcher.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+
+/**
+ * Matcher for matching status code of {@link Response} instance.
+ * @author hmlnarik
+ */
+public class ResponseBodyMatcher extends BaseMatcher<Response> {
+
+    private final Matcher<String> matcher;
+
+    public ResponseBodyMatcher(Matcher<String> matcher) {
+        this.matcher = matcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        if (item instanceof Response) {
+            final Response rItem = (Response) item;
+            rItem.bufferEntity();
+            return this.matcher.matches(rItem.readEntity(String.class));
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("response body matches ").appendDescriptionOf(this.matcher);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseHeaderMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseHeaderMatcher.java
new file mode 100644
index 000000000000..3c35a73538d3
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseHeaderMatcher.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+
+import java.util.Map;
+
+/**
+ * Matcher for matching status code of {@link Response} instance.
+ * @author hmlnarik
+ */
+public class ResponseHeaderMatcher<T> extends BaseMatcher<Response> {
+
+    private final Matcher<Map<String, T>> matcher;
+
+    public ResponseHeaderMatcher(Matcher<Map<String, T>> matcher) {
+        this.matcher = matcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        return (item instanceof Response) && this.matcher.matches(((Response) item).getHeaders());
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("response headers match ").appendDescriptionOf(this.matcher);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseStatusCodeMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseStatusCodeMatcher.java
new file mode 100644
index 000000000000..cafa4c4bf69b
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/ResponseStatusCodeMatcher.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+
+/**
+ * Matcher for matching status code of {@link Response} instance.
+ * @author hmlnarik
+ */
+public class ResponseStatusCodeMatcher extends BaseMatcher<Response> {
+
+    private final Matcher<? extends Number> matcher;
+
+    public ResponseStatusCodeMatcher(Matcher<? extends Number> matcher) {
+        this.matcher = matcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        return (item instanceof Response) && this.matcher.matches(((Response) item).getStatus());
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("response status code matches ").appendDescriptionOf(this.matcher);
+    }
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlLogoutRequestTypeMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlLogoutRequestTypeMatcher.java
new file mode 100644
index 000000000000..43f4c25ced12
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlLogoutRequestTypeMatcher.java
@@ -0,0 +1,48 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.keycloak.dom.saml.v2.SAML2Object;
+import org.keycloak.dom.saml.v2.protocol.LogoutRequestType;
+
+import java.net.URI;
+
+import static org.hamcrest.Matchers.is;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class SamlLogoutRequestTypeMatcher extends BaseMatcher<SAML2Object> {
+
+    private final Matcher<URI> destinationMatcher;
+
+    public SamlLogoutRequestTypeMatcher(URI destination) {
+        this.destinationMatcher = is(destination);
+    }
+
+    public SamlLogoutRequestTypeMatcher(Matcher<URI> destinationMatcher) {
+        this.destinationMatcher = destinationMatcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        return destinationMatcher.matches(((LogoutRequestType) item).getDestination());
+    }
+
+    @Override
+    public void describeMismatch(Object item, Description description) {
+        description.appendText("was ").appendValue(((LogoutRequestType) item).getDestination());
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("SAML logout request destination matches ").appendDescriptionOf(this.destinationMatcher);
+    }
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlResponseTypeMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlResponseTypeMatcher.java
new file mode 100644
index 000000000000..38ae42387a66
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlResponseTypeMatcher.java
@@ -0,0 +1,51 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.keycloak.dom.saml.v2.SAML2Object;
+import org.keycloak.dom.saml.v2.protocol.ResponseType;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+
+import java.net.URI;
+
+import static org.hamcrest.Matchers.is;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class SamlResponseTypeMatcher extends BaseMatcher<SAML2Object> {
+
+    private final Matcher<URI> statusMatcher;
+
+    public SamlResponseTypeMatcher(JBossSAMLURIConstants expectedStatus) {
+        this.statusMatcher = is(expectedStatus.getUri());
+    }
+
+    public SamlResponseTypeMatcher(Matcher<URI> statusMatcher) {
+        this.statusMatcher = statusMatcher;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        return statusMatcher.matches(((ResponseType) item).getStatus().getStatusCode().getValue());
+    }
+
+    @Override
+    public void describeMismatch(Object item, Description description) {
+        description.appendText("was ").appendValue(((ResponseType) item).getStatus().getStatusCode());
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("SAML response status code matches ").appendDescriptionOf(this.statusMatcher);
+    }
+
+
+}
diff --git a/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlStatusResponseTypeMatcher.java b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlStatusResponseTypeMatcher.java
new file mode 100644
index 000000000000..cb2a412f4f34
--- /dev/null
+++ b/tests/utils/src/main/java/org/keycloak/tests/utils/matchers/SamlStatusResponseTypeMatcher.java
@@ -0,0 +1,69 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package org.keycloak.tests.utils.matchers;
+
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.hamcrest.Matcher;
+import org.keycloak.dom.saml.v2.SAML2Object;
+import org.keycloak.dom.saml.v2.protocol.StatusCodeType;
+import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
+
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.List;
+
+import static org.hamcrest.Matchers.is;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class SamlStatusResponseTypeMatcher extends BaseMatcher<SAML2Object> {
+
+    private final List<Matcher<URI>> statusMatchers;
+
+    public SamlStatusResponseTypeMatcher(URI... statusMatchers) {
+        this.statusMatchers = new ArrayList(statusMatchers.length);
+        for (URI uri : statusMatchers) {
+            this.statusMatchers.add(is(uri));
+        }
+    }
+
+    public SamlStatusResponseTypeMatcher(List<Matcher<URI>> statusMatchers) {
+        this.statusMatchers = statusMatchers;
+    }
+
+    @Override
+    public boolean matches(Object item) {
+        StatusCodeType statusCode = ((StatusResponseType) item).getStatus().getStatusCode();
+        for (Matcher<URI> statusMatcher : statusMatchers) {
+            if (! statusMatcher.matches(statusCode.getValue())) {
+                return false;
+            }
+            statusCode = statusCode.getStatusCode();
+        }
+        return true;
+    }
+
+    @Override
+    public void describeMismatch(Object item, Description description) {
+        StatusCodeType statusCode = ((StatusResponseType) item).getStatus().getStatusCode();
+        description.appendText("was ");
+        while (statusCode != null) {
+            description.appendText("/").appendValue(statusCode.getValue());
+            statusCode = statusCode.getStatusCode();
+        }
+    }
+
+    @Override
+    public void describeTo(Description description) {
+        description.appendText("SAML status response status matches ");
+        for (Matcher<URI> statusMatcher : statusMatchers) {
+            description.appendText("/").appendDescriptionOf(statusMatcher);
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/HOW-TO-RUN.md b/testsuite/integration-arquillian/HOW-TO-RUN.md
index be38b763dbae..1c0876c5f587 100644
--- a/testsuite/integration-arquillian/HOW-TO-RUN.md
+++ b/testsuite/integration-arquillian/HOW-TO-RUN.md
@@ -394,7 +394,6 @@ Then run any cluster test as usual.
     mvn -f testsuite/integration-arquillian/tests/base/pom.xml \
     -Pauth-server-cluster-undertow,db-mysql \
     -Dsession.cache.owners=2 \
-    -Dkeycloak.connectionsInfinispan.sessionsOwners=2 \
     -Dbackends.console.output=true \
     -Dauth.server.log.check=false \
     -Dfrontend.console.output=true \
@@ -410,8 +409,8 @@ You can use any cluster test (eg. AuthenticationSessionFailoverClusterTest) and
 
     -Dauth.server.undertow=false -Dauth.server.undertow.cluster=true -Dauth.server.cluster=true
     -Dkeycloak.connectionsJpa.url=jdbc:mysql://localhost/keycloak -Dkeycloak.connectionsJpa.driver=com.mysql.jdbc.Driver
-    -Dkeycloak.connectionsJpa.user=keycloak -Dkeycloak.connectionsJpa.password=keycloak -Dkeycloak.connectionsInfinispan.clustered=true -Dresources
-    -Dkeycloak.connectionsInfinispan.sessionsOwners=2 -Dsession.cache.owners=2
+    -Dkeycloak.connectionsJpa.user=keycloak -Dkeycloak.connectionsJpa.password=keycloak -Dresources
+    -Dsession.cache.owners=2
 
 Invalidation tests (subclass of `AbstractInvalidationClusterTest`) don't need last two properties.
 
@@ -423,8 +422,8 @@ This mode is useful for develop/manual tests of clustering features. You will ne
 1) Run KeycloakServer server1 with:
 
     -Dkeycloak.connectionsJpa.url=jdbc:mysql://localhost/keycloak -Dkeycloak.connectionsJpa.driver=com.mysql.jdbc.Driver
-    -Dkeycloak.connectionsJpa.user=keycloak -Dkeycloak.connectionsJpa.password=keycloak -Dkeycloak.connectionsInfinispan.clustered=true
-    -Dkeycloak.connectionsInfinispan.sessionsOwners=2 -Dresources
+    -Dkeycloak.connectionsJpa.user=keycloak -Dkeycloak.connectionsJpa.password=keycloak
+    -Dresources
 
 and argument: `-p 8181`
 
@@ -432,151 +431,6 @@ and argument: `-p 8181`
 
 3) Run loadbalancer (class `SimpleUndertowLoadBalancer`) without arguments and system properties. Loadbalancer runs on port 8180, so you can access Keycloak on `http://localhost:8180/auth`
 
-## Cross-DC tests
-
-Cross-DC tests use 2 data centers, each with one automatically started and one manually controlled backend servers,
-and 1 frontend loadbalancer server node that sits in front of all servers.
-The browser usually communicates directly with the frontend node and the test controls where the HTTP requests
-land by adjusting load balancer configuration (e.g. to direct the traffic to only a single DC).
-
-For an example of a test, see [org.keycloak.testsuite.crossdc.ActionTokenCrossDCTest](tests/base/src/test/java/org/keycloak/testsuite/crossdc/ActionTokenCrossDCTest.java).
-
-The cross DC requires setting a profile specifying the used cache server.
-Use `cache-server-infinispan` Maven profile for Infinispan 10 or higher, or `cache-server-legacy-infinispan` profile for Infinispan 9 and lower.
-Use `cache-server-datagrid` Maven profile for Datagrid 8 or higher, or `cache-server-legacy-datagrid` profile for Datagrid 7 and lower.
-
-To specify a custom Java platform to run the cache server it is possible to set parameter: `-Dcache.server.java.home=<PATH_TO_JDK>`.
-
-### Cache Authentication
-
-With WildFLy/EAP based auth server option it is possible to enable authentication for the HotRod protocol by enabling profile `cache-auth`.
-
-It is possible to specify additional parameters:
-- `-Dhotrod.sasl.mechanism`: SASL mechanism used by the hotrod protocol. Default value is `DIGEST-MD5`.
-- `-Dkeycloak.connectionsInfinispan.hotrodProtocolVersion`: Version of the hotrod protocol.
-
-Example: `-Pauth-server-wildfly,cache-server-infinispan,cache-auth -Dhotrod.sasl.mechanism=SCRAM-SHA-512`
-
-Note: The cache authentication is not implemented for `SAMLAdapterCrossDCTest`.
-
-Note: The `cache-auth` profile currently doesn't work with the legacy Infinispan/Datagrid modules. See: [KEYCLOAK-18336](https://issues.redhat.com/browse/KEYCLOAK-18336).
-
-### Data Grid
-
-Since Datagrid does not distribute `infinispan-server` zip artifact, for `cache-server-datagrid` profile it is
-necessary to download the artifact and install it to local Maven repository. For Red Hat Data Grid 8 and above, the command is the following:
-
-    mvn install:install-file \
-    -DgroupId=com.redhat -DartifactId=datagrid -Dpackaging=zip -Dclassifier=bin -DgeneratePom=true \
-    -Dversion=${DATAGRID_VERSION} -Dfile=redhat-datagrid-${DATAGRID_VERSION}-server.zip
-
-For Data Grid 7 and older use: `-Dfile=jboss-datagrid-${DATAGRID_VERSION}-server.zip`.
-
-### Run Cross-DC Tests from Maven
-
-Warning: The Cross-DC tests doesn't work with Quarkus distribution
-
-Note: Profile `auth-servers-crossdc-undertow` currently doesn't work (see [KEYCLOAK-18335](https://issues.redhat.com/browse/KEYCLOAK-18335)).
-Use `-Pauth-servers-crossdc-jboss,auth-server-wildfly` instead.
-
-a) Prepare the environment. Compile the infinispan server and eventually Keycloak on JBoss server.
-
-a1) If you want to use **Undertow** based Keycloak container, you just need to download and prepare the
-Infinispan/JDG test server via the following command:
-
-  `mvn -Pcache-server-infinispan,auth-servers-crossdc-undertow -f testsuite/integration-arquillian -DskipTests clean install`
-
-*note: 'cache-server-infinispan' can be replaced by 'cache-server-datagrid'*
-
-a2) If you want to use **JBoss-based** Keycloak backend containers instead of containers on Embedded Undertow,
- you need to prepare both the Infinispan/JDG test server and the Keycloak server on Wildfly/EAP. Run following command:
-
-  `mvn -Pcache-server-infinispan,auth-servers-crossdc-jboss,auth-server-wildfly -f testsuite/integration-arquillian -DskipTests clean install`
-
-*note: 'cache-server-infinispan' can be replaced by 'cache-server-datagrid'*
-
-*note: 'auth-server-wildfly' can be replaced by 'auth-server-eap'*
-
-By default JBoss-based containers use TCP-based h2 database. It can be configured to use real DB spawn in Docker, e.g. with following command:
-
-  `mvn -Pcache-server-infinispan,auth-servers-crossdc-jboss,auth-server-wildfly,jpa,db-mariadb -f testsuite/integration-arquillian -DskipTests clean install`
-
-b1) For **Undertow** Keycloak backend containers, you can run the tests using the following command (adjust the test specification according to your needs):
-
-  `mvn -Pcache-server-infinispan,auth-servers-crossdc-undertow -Dtest=org.keycloak.testsuite.crossdc.**.*Test -pl testsuite/integration-arquillian/tests/base clean install`
-
-*note: 'cache-server-infinispan' can be replaced by 'cache-server-datagrid'*
-
-*note: It can be useful to add additional system property to enable logging:*
-
-  `-Dkeycloak.infinispan.logging.level=debug`
-
-b2) For **JBoss-based** Keycloak backend containers, you can run the tests like this:
-
-  `mvn -Pcache-server-infinispan,auth-servers-crossdc-jboss,auth-server-wildfly -Dtest=org.keycloak.testsuite.crossdc.**.*Test -pl testsuite/integration-arquillian/tests/base clean install`
-
-*note: 'cache-server-infinispan' can be replaced by 'cache-server-datagrid'*
-
-*note: 'auth-server-wildfly can be replaced by auth-server-eap'*
-
-**note**:
-For **JBoss-based** Keycloak backend containers on real DB, the previous commands from (a2) and (b2) can be "squashed" into one. E.g.:
-
-  `mvn -f testsuite/integration-arquillian -Dtest=org.keycloak.testsuite.crossdc.**.*Test -Pcache-server-infinispan,auth-servers-crossdc-jboss,auth-server-wildfly,jpa,db-mariadb clean install`
-
-
-### Run Cross-DC Tests from Intellij IDEA
-
-Note: Profile `auth-servers-crossdc-undertow` which is required in step (3) currently doesn't work (see [KEYCLOAK-18335](https://issues.redhat.com/browse/KEYCLOAK-18335)).
-
-First we will manually download, configure and run infinispan servers. Then we can run the tests from IDE against the servers.
-It's more effective during development as there is no need to restart infinispan server(s) among test runs.
-
-1) Download infinispan server of corresponding version (See "infinispan.version" property in [root pom.xml](../../pom.xml))
-from http://infinispan.org/download/ and go through the steps from the
-[Keycloak Cross-DC documentation](http://www.keycloak.org/docs/latest/server_installation/index.html#jdgsetup) for setup infinispan servers.
-
-The difference to original docs is, that you need to have JDG servers available on localhost with port offsets. So:
-
-* The TCPPING hosts should be like this:
-
-```xml
-<property name="initial_hosts">localhost[8610],localhost[9610]"</property>
-```
-
-* The port offset when starting node `jdg1` should be like: `-Djboss.socket.binding.port-offset=1010` and when
-starting the `jdg2` server, then `-Djboss.socket.binding.port-offset=2010` . In both cases, the bind address should be just
-default `localhost` (In other words, the `-b` switch can be omitted).
-
-So assume you have both Infinispan/JDG servers up and running.
-
-2) Setup MySQL database or some other shared database.
-
-3) Ensure that `org.wildfly.arquillian:wildfly-arquillian-container-managed` is on the classpath when running test. On Intellij, it can be
-done by going to: `View` -> `Tool Windows` -> `Maven projects`. Then check profile `cache-server-infinispan` and `auth-servers-crossdc-undertow`.
-The tests will use this profile when executed.
-
-4) Run the LoginCrossDCTest (or any other test) with those properties. In shortcut, it's using MySQL database and
-connects to the remoteStore provided by infinispan server configured in previous steps:
-
-  `-Dauth.server.crossdc=true -Dauth.server.undertow.crossdc=true -Dcache.server.lifecycle.skip=true -Dkeycloak.connectionsInfinispan.clustered=true -Dkeycloak.connectionsJpa.url.crossdc=jdbc:mysql://localhost/keycloak -Dkeycloak.connectionsJpa.driver.crossdc=com.mysql.jdbc.Driver -Dkeycloak.connectionsJpa.user=keycloak -Dkeycloak.connectionsJpa.password=keycloak -Dkeycloak.connectionsInfinispan.clustered=true -Dkeycloak.connectionsInfinispan.remoteStorePort=12232 -Dkeycloak.connectionsInfinispan.remoteStorePort.2=13232 -Dkeycloak.connectionsInfinispan.sessionsOwners=1 -Dsession.cache.owners=1 -Dkeycloak.infinispan.logging.level=debug -Dresources`
-
-**NOTE**: Tests from package `manual` (eg. SessionsPreloadCrossDCTest) needs to be executed with managed containers.
-So skip steps 1,2 and add property `-Dmanual.mode=true` and change "cache.server.lifecycle.skip" to false `-Dcache.server.lifecycle.skip=false` or remove it.
-
-5) If you want to debug or test manually, the servers are running on these ports (Note that not all backend servers are running by default and some might be also unused by loadbalancer):
-
-* *Loadbalancer* -> "http://localhost:8180/auth"
-
-* *auth-server-undertow-cross-dc-0_1* -> "http://localhost:8101/auth"
-
-* *auth-server-undertow-cross-dc-0_2-manual* -> "http://localhost:8102/auth"
-
-* *auth-server-undertow-cross-dc-1_1* -> "http://localhost:8111/auth"
-
-* *auth-server-undertow-cross-dc-1_2-manual* -> "http://localhost:8112/auth"
-
-
 ## Run Docker Authentication test
 
 First, validate that your machine has a valid docker installation and that it is available to the JVM running the test.
diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml
index 519cd78ba676..079d1b558118 100644
--- a/testsuite/integration-arquillian/pom.xml
+++ b/testsuite/integration-arquillian/pom.xml
@@ -41,11 +41,12 @@
         <cache.server.java.home>${java.home}</cache.server.java.home>
 
         <!--component versions-->
-        <arquillian-core.version>1.8.0.Final</arquillian-core.version>
+        <arquillian-core.version>1.9.3.Final</arquillian-core.version>
+        <arquillian.protocol.servlet.jakarta.version>10.0.0.Final</arquillian.protocol.servlet.jakarta.version>
         <!--the version of shrinkwrap_resolver should align with the version in arquillian-bom-->
         <shrinkwrap-resolver.version>3.2.1</shrinkwrap-resolver.version>
-        <selenium.version>4.25.0</selenium.version>
-        <selenium.htmlunit3.version>4.23.0</selenium.htmlunit3.version>
+        <selenium.version>4.28.1</selenium.version>
+        <selenium.htmlunit3.version>4.28.0</selenium.htmlunit3.version>
         <arquillian-drone.version>3.0.0-alpha.8</arquillian-drone.version>
         <arquillian-graphene.version>3.0.0-alpha.4</arquillian-graphene.version>
         <arquillian-wildfly-container.version>3.0.1.Final</arquillian-wildfly-container.version>
@@ -523,7 +524,7 @@
                 <!-- For EAP testing, it is recommended to override those with system properties pointing to GAV of more appropriate JDBC driver -->
                 <!-- for the particular EAP version -->
                 <jdbc.mvn.groupId>com.oracle.database.jdbc</jdbc.mvn.groupId>
-                <jdbc.mvn.artifactId>ojdbc11</jdbc.mvn.artifactId>
+                <jdbc.mvn.artifactId>ojdbc17</jdbc.mvn.artifactId>
                 <jdbc.mvn.version>${oracle-jdbc.version}</jdbc.mvn.version>
             </properties>
         </profile>
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty-expired.crl b/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty-expired.crl
new file mode 100644
index 000000000000..ee31d3a8c832
--- /dev/null
+++ b/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty-expired.crl
@@ -0,0 +1,19 @@
+-----BEGIN X509 CRL-----
+MIIDAzCB7AIBATANBgkqhkiG9w0BAQsFADCBhzELMAkGA1UEBhMCVVMxCzAJBgNV
+BAgMAk1BMRAwDgYDVQQKDAdSZWQgSGF0MREwDwYDVQQLDAhLZXljbG9hazEhMB8G
+A1UEAwwYS2V5Y2xvYWsgSW50ZXJtZWRpYXRlIENBMSMwIQYJKoZIhvcNAQkBFhRj
+b250YWN0QGtleWNsb2FrLm9yZxcNMTkwMzE0MTEwNTI1WhcNMTkwNDEzMTEwNTI1
+WqAwMC4wHwYDVR0jBBgwFoAURxJ8iQtHVxlUCvUDBM2fhqKWdpQwCwYDVR0UBAQC
+AhAAMA0GCSqGSIb3DQEBCwUAA4ICAQAnH3w3I/EYB51RrB0ZEmiVtxbuEoy4bbhj
+N1jvXsnM6OZb0me3Q6NzkozgVfDbDrWSGvdOaGqWcWrxsFuCqi5T8yHhTU3eRphh
++z01jOvk3UjfOdEOWMJGJWgBLAQj0RUsxRXqGT6n7gyndB+5RTuN/WNjCd96Vf0q
+yRDfoGGlanGh8sg7BFFnTfDH0dYw8ApYbt/rFT1suFmEaiH44Nd8dldSJxqjK2Ph
+B0+4etNpZZEjuUGq0U+oYUeppI4oE3vqAPrP9f/Wd0Kc+Ci56RC8X2lf9TSN4qb9
+xv2a85pUgxBhioZT2fXTDjiUbYKXZhj5tMPixP0M+NcI2yutHpm0Y44BO76bmcVf
+8AAfH8RcyJlPwfEGwENzY+CZTqCYbCbSg12CLs9UL6ITx8Z1lt/LnLOGCq672rWb
+Pw3wO3Wmam8Zdyyr2Pff+/+ZcL587/Xif+ho48JSWrJynGwOe9WEBjWqYkfcxCP7
+plZxWj8MF7A389eBmpLF95BVLFHJECJYUfN7CPU2g+4cKSuzXenlSWtqDs/GdbeJ
+tFMoA9SzFut9tZg7BMA/gXF/2dTMsjU/1Cy1AVzvWl654wB6OYZv8pktwrjQ77qj
+S0X4hovoKfpoxYIzw1OTdOuyu7oc6Wh3XWtJWHssrdZuGczDTXtu1qRstFeag/iO
+cpvmIaTdvQ==
+-----END X509 CRL-----
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty.crl b/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty.crl
index ee31d3a8c832..54f1db96382c 100644
--- a/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty.crl
+++ b/testsuite/integration-arquillian/servers/auth-server/common/keystore/empty.crl
@@ -1,19 +1,19 @@
 -----BEGIN X509 CRL-----
-MIIDAzCB7AIBATANBgkqhkiG9w0BAQsFADCBhzELMAkGA1UEBhMCVVMxCzAJBgNV
+MIIDBTCB7gIBATANBgkqhkiG9w0BAQsFADCBhzELMAkGA1UEBhMCVVMxCzAJBgNV
 BAgMAk1BMRAwDgYDVQQKDAdSZWQgSGF0MREwDwYDVQQLDAhLZXljbG9hazEhMB8G
 A1UEAwwYS2V5Y2xvYWsgSW50ZXJtZWRpYXRlIENBMSMwIQYJKoZIhvcNAQkBFhRj
-b250YWN0QGtleWNsb2FrLm9yZxcNMTkwMzE0MTEwNTI1WhcNMTkwNDEzMTEwNTI1
-WqAwMC4wHwYDVR0jBBgwFoAURxJ8iQtHVxlUCvUDBM2fhqKWdpQwCwYDVR0UBAQC
-AhAAMA0GCSqGSIb3DQEBCwUAA4ICAQAnH3w3I/EYB51RrB0ZEmiVtxbuEoy4bbhj
-N1jvXsnM6OZb0me3Q6NzkozgVfDbDrWSGvdOaGqWcWrxsFuCqi5T8yHhTU3eRphh
-+z01jOvk3UjfOdEOWMJGJWgBLAQj0RUsxRXqGT6n7gyndB+5RTuN/WNjCd96Vf0q
-yRDfoGGlanGh8sg7BFFnTfDH0dYw8ApYbt/rFT1suFmEaiH44Nd8dldSJxqjK2Ph
-B0+4etNpZZEjuUGq0U+oYUeppI4oE3vqAPrP9f/Wd0Kc+Ci56RC8X2lf9TSN4qb9
-xv2a85pUgxBhioZT2fXTDjiUbYKXZhj5tMPixP0M+NcI2yutHpm0Y44BO76bmcVf
-8AAfH8RcyJlPwfEGwENzY+CZTqCYbCbSg12CLs9UL6ITx8Z1lt/LnLOGCq672rWb
-Pw3wO3Wmam8Zdyyr2Pff+/+ZcL587/Xif+ho48JSWrJynGwOe9WEBjWqYkfcxCP7
-plZxWj8MF7A389eBmpLF95BVLFHJECJYUfN7CPU2g+4cKSuzXenlSWtqDs/GdbeJ
-tFMoA9SzFut9tZg7BMA/gXF/2dTMsjU/1Cy1AVzvWl654wB6OYZv8pktwrjQ77qj
-S0X4hovoKfpoxYIzw1OTdOuyu7oc6Wh3XWtJWHssrdZuGczDTXtu1qRstFeag/iO
-cpvmIaTdvQ==
+b250YWN0QGtleWNsb2FrLm9yZxcNMjQxMjIzMTMzNDA4WhgPMjA3NDEyMTExMzM0
+MDhaoDAwLjAfBgNVHSMEGDAWgBRHEnyJC0dXGVQK9QMEzZ+GopZ2lDALBgNVHRQE
+BAICEAIwDQYJKoZIhvcNAQELBQADggIBALX2BSzYnZOEHkawBEMJkpa2mz5CTNKK
+XLGauiEnWwYkd/lDYG/UqX1q5K2qXqmqdlM3VmwcVYUmIxxUz9eL4vj/PmCvWbmQ
+PNwuGoNR44EAUM+0M5hrdbO1BzigTtTD1I5r8BOhMsRDeq/cWDIEqulGqAgjaN2P
+dDBqZzIN5ljQeEJ6j3tgSNKbeB+XY9itS5RdYxGY9aPIO7N+zlgvAV+jOgImGApo
+uUteq8xgOZVsqquMzuzDwN+OUWsYebxacXmuXFmbLrPLM6qgCUyv4jH73KuyDVib
+loubYrx84XexAogZP/IGHSt+NEJv8LeLyGPzhBYBdXCKY5e0qdZMpf7IbrXqm335
+dPqNdLEMWjCaoh2mMmEBZJgifjiW2vekzzHUbWrKcrEv+xvDnaciRYyzPya2xoJz
++GpUkETqLxbgUAlDMAkFpVYBpWfcgi3Tnuxbm183pxmnQw+IoAjHIrLCkQCKQbJX
+eqms3bJgVSLxQcflJr3EcdraElrTzaYq9DdbXpcnjrEHmF+Fp74VSe8+fDz6bTTe
++OVXq22vsMsdOmzPg2EGc9u9e6NRWdAarN8sIUee3Nl04K8vuSQVn7ioJJam7llQ
+F5JM6nRNtJx5owbq8PiDZYvAQZneEXrXFOWtdMTZ3KKlUPP3yTwlS1Gpa1l+eQT+
+eItihr7GRPDI
 -----END X509 CRL-----
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/keystore/intermediate-ca.crl b/testsuite/integration-arquillian/servers/auth-server/common/keystore/intermediate-ca.crl
index 5bf65737f491..ed0f3d974a96 100644
--- a/testsuite/integration-arquillian/servers/auth-server/common/keystore/intermediate-ca.crl
+++ b/testsuite/integration-arquillian/servers/auth-server/common/keystore/intermediate-ca.crl
@@ -1,19 +1,19 @@
 -----BEGIN X509 CRL-----
-MIIDGzCCAQMCAQEwDQYJKoZIhvcNAQELBQAwgYcxCzAJBgNVBAYTAlVTMQswCQYD
+MIIDHTCCAQUCAQEwDQYJKoZIhvcNAQELBQAwgYcxCzAJBgNVBAYTAlVTMQswCQYD
 VQQIDAJNQTEQMA4GA1UECgwHUmVkIEhhdDERMA8GA1UECwwIS2V5Y2xvYWsxITAf
 BgNVBAMMGEtleWNsb2FrIEludGVybWVkaWF0ZSBDQTEjMCEGCSqGSIb3DQEJARYU
-Y29udGFjdEBrZXljbG9hay5vcmcXDTE5MDMxNDExMTAwMFoXDTE5MDQxMzExMTAw
-MFowFTATAgIQCRcNMTkwMzE0MTEwOTMwWqAwMC4wHwYDVR0jBBgwFoAURxJ8iQtH
-VxlUCvUDBM2fhqKWdpQwCwYDVR0UBAQCAhABMA0GCSqGSIb3DQEBCwUAA4ICAQCd
-TwIDW5J1SJ9p+Nfiq7BSgAWkMHRFLzUCUd5OoF1t51ZZqfHpwDd8VN+NVYg1yyW0
-FQbDV6XcZ8eOAfC4rhOutklJ2s5xqFvwDHQkXU19cTeKO2Igb2eP3Fpa4o8qAHXy
-nrqffY7YThS2kQo9b6K+hWPEdK/vwTbfhjQ188qtqMMCdFNsmM7xN9SitQe6Rg66
-ML5ZWr6G4igovKXs+ixpW1MEUniCEaXhx5AkbNPohx8Lg5817Ujj+N9A4/aVUY22
-euq4qIC1WjVO28ar7sx3wtPXRTCg8P+v/Iai7/elKb3nDsR3Trsl03W2bfyglOC3
-qbFeLo+6Yn4l4E3Hp8LNBKFDxfg+hbJZDpwqn6RFADl5Qae7T59m8RT/nIP698aB
-hgpg8V+7cLrk5DXrkjuEMfOIp0Zg1EnTC/Jsp2lX7IuMC4WIqgatP0nDUw0YCphY
-E5jEjFi8gd6j/j1dwsVTAbcNYUiP97slA5TCQfUmEn8Gz3p4vv54TojY+rPMlSUD
-2jmBDtCitvt1ZYN/cGhFn9anHql/lrlUKdRfyaJ4c2/RsTXVxCMVYEHuqoL+NEWH
-Q4+bocZSnfuneeHbnZaWYY8ITFoLzAGMlk3GjgaUkMIbt6ADvs+JU7NzC6zlfW9O
-aXY77Qlc3dpjNufscmH4FCD1LfN0WqRiFMMMze0Jew==
+Y29udGFjdEBrZXljbG9hay5vcmcXDTI0MTIyMzA4MzkzNVoYDzIwNzQxMjExMDgz
+OTM1WjAVMBMCAhAJFw0xOTAzMTQxMTA5MzBaoDAwLjAfBgNVHSMEGDAWgBRHEnyJ
+C0dXGVQK9QMEzZ+GopZ2lDALBgNVHRQEBAICEAIwDQYJKoZIhvcNAQELBQADggIB
+AMT2ga8GxtQPRm1zteIB8/LMoJyqJ8llHBnnJvL7OK0hOYmCl1DizCV9+S02q53U
+v7gRarLBNkunNncOZ+662foODa6GoQvTDtQyXCNHmimtC3Gq4NaZ5GKVqBrfnZ0h
+KmmPS6E/WlWPoUT6gc7Tz1oG7EhJ2y6ywGadQ6V27hpBN8TEhvK7fg7/59n0Hjkh
+K0oDwdBqGHCo7z7bB6peF8p3xQOOiYgXeAU/BTVKBnMzj+QbkZgnjWpi9EXdCd/h
+mBmckHxC0r8M+HYdJzdBdEFXh+M2o99Q6mGqmLT8/2UtrMYsus57G+ShqlnwGC+T
+ZctSJZnGDmFuiAjfjZ7MX6dxIauDdTeMnk1yOPObPE3su/X6YIbZA8iPuJxqxN8c
+R9HQijHM1klI0u9FaEn1Wn30WWsAPjMq+wMMXv7PEr7tJOS/WFetC718v1bf+zVW
+I1m0b9EzsymIqbAy2uD42Xz5paRWVi4OAmE5ZtJnEmDV0gC0+aFCURND2kAqfgKN
+O3Vogb2i527Y8AJ4PkUki/3akkC7nwlYW36Pg7VYz+Xs39ZUz7bRL1Z5t0KzvXnf
+nGDwko198pieVBwBIgd0hubywsVT2frZ4mVMPLwHMgiLz6+MBg6z9w/y9ifptat+
+jCgV6bTUx1JWwOlRafLjE/txsEQPAuz2ePIjNVCpfr4d
 -----END X509 CRL-----
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber b/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber
index 7d802a3e7104..baccd0398f98 100644
--- a/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber
+++ b/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber
@@ -1 +1 @@
-1002
+1003
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber.old b/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber.old
index dd11724042e2..7d802a3e7104 100644
--- a/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber.old
+++ b/testsuite/integration-arquillian/servers/auth-server/common/pki/root/ca/intermediate/crlnumber.old
@@ -1 +1 @@
-1001
+1002
diff --git a/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml b/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml
index 937dcb17fa77..0e61fce6f769 100644
--- a/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml
+++ b/testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml
@@ -201,7 +201,7 @@
                             <artifactItems>
                                 <artifactItem>
                                     <groupId>com.oracle.database.jdbc</groupId>
-                                    <artifactId>ojdbc11</artifactId>
+                                    <artifactId>ojdbc17</artifactId>
                                     <version>${oracle-jdbc.version}</version>
                                     <type>jar</type>
                                     <outputDirectory>${auth.server.home}/providers</outputDirectory>
diff --git a/testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/cluster-ha.xml b/testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/cluster-ha.xml
index b6b8c13365a3..aef111f5f882 100644
--- a/testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/cluster-ha.xml
+++ b/testsuite/integration-arquillian/servers/auth-server/quarkus/src/main/content/conf/cluster-ha.xml
@@ -60,6 +60,14 @@
             <expiration max-idle="3600000"/>
             <memory storage="HEAP" max-count="1000"/>
         </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
         <distributed-cache name="actionTokens" owners="2">
             <encoding>
                 <key media-type="application/x-java-object"/>
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml
index 05d6bac5555f..5a4db9c37c7d 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/pom.xml
@@ -30,11 +30,6 @@
     <artifactId>integration-arquillian-testsuite-providers</artifactId>
     <name>Auth Server Services - Testsuite Providers</name>
 
-    <properties>
-        <js-adapter.dist.path>${project.basedir}/../../../../../../js/libs/keycloak-js/lib</js-adapter.dist.path>
-        <js-adapter.target.path>${project.basedir}/target/classes/javascript</js-adapter.target.path>
-    </properties>
-
     <dependencies>
 
         <!-- Keycloak deps for tests -->
@@ -102,37 +97,5 @@
                 </plugin>
             </plugins>
         </pluginManagement>
-        <resources>
-            <resource>
-                <directory>src/main/resources</directory>
-                <filtering>true</filtering>
-            </resource>
-        </resources>
-
-        <plugins>
-            <plugin>
-                <artifactId>maven-resources-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>copy-keycloak-js</id>
-                        <phase>generate-resources</phase>
-                        <goals>
-                            <goal>copy-resources</goal>
-                        </goals>
-                        <configuration>
-                            <outputDirectory>${js-adapter.target.path}</outputDirectory>
-                            <resources>
-                                <resource>
-                                    <directory>${js-adapter.dist.path}</directory>
-                                    <includes>
-                                        <include>keycloak.js</include>
-                                    </includes>
-                                </resource>
-                            </resources>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
     </build>
 </project>
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider1.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider1.java
index 7a74514dd12b..5e0ac7c1a04b 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider1.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider1.java
@@ -20,14 +20,17 @@
 package org.keycloak.examples.providersoverride;
 
 import org.keycloak.email.DefaultEmailSenderProvider;
+import org.keycloak.email.EmailAuthenticator;
 import org.keycloak.models.KeycloakSession;
 
+import java.util.Map;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public class CustomDefaultEmailSenderProvider1 extends DefaultEmailSenderProvider {
 
-    public CustomDefaultEmailSenderProvider1(KeycloakSession session) {
-        super(session);
+    public CustomDefaultEmailSenderProvider1(KeycloakSession session, Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> authenticators) {
+        super(session, authenticators);
     }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider2.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider2.java
index 39ea1ee6331d..aec705331bbc 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider2.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProvider2.java
@@ -20,14 +20,17 @@
 package org.keycloak.examples.providersoverride;
 
 import org.keycloak.email.DefaultEmailSenderProvider;
+import org.keycloak.email.EmailAuthenticator;
 import org.keycloak.models.KeycloakSession;
 
+import java.util.Map;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public class CustomDefaultEmailSenderProvider2 extends DefaultEmailSenderProvider {
 
-    public CustomDefaultEmailSenderProvider2(KeycloakSession session) {
-        super(session);
+    public CustomDefaultEmailSenderProvider2(KeycloakSession session, Map<EmailAuthenticator.AuthenticatorType, EmailAuthenticator> authenticators) {
+        super(session, authenticators);
     }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory1.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory1.java
index cf38ae6e2035..557c30d4e78f 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory1.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory1.java
@@ -35,6 +35,6 @@ public int order() {
 
     @Override
     public EmailSenderProvider create(KeycloakSession session) {
-        return new CustomDefaultEmailSenderProvider1(session);
+        return new CustomDefaultEmailSenderProvider1(session, getEmailAuthenticators());
     }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory2.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory2.java
index b11dda02c6fc..e9a0b438c69f 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory2.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/examples/providersoverride/CustomDefaultEmailSenderProviderFactory2.java
@@ -35,6 +35,6 @@ public int order() {
 
     @Override
     public EmailSenderProvider create(KeycloakSession session) {
-        return new CustomDefaultEmailSenderProvider2(session);
+        return new CustomDefaultEmailSenderProvider2(session, getEmailAuthenticators());
     }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticator.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticator.java
new file mode 100644
index 000000000000..292c7315a3bc
--- /dev/null
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticator.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.authentication;
+
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class DelayedAuthenticator implements Authenticator {
+
+    @Override
+    public void authenticate(AuthenticationFlowContext context) {
+        final long time = context.getAuthenticatorConfig() != null
+                ? Long.parseLong(context.getAuthenticatorConfig().getConfig().getOrDefault("delay", "1000"))
+                : 1000;
+        if (time > 0) {
+            try {
+                Thread.sleep(time);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+            }
+        }
+        context.success();
+    }
+
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        // no-op
+    }
+
+    @Override
+    public boolean requiresUser() {
+        return false;
+    }
+
+    @Override
+    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+        return true;
+    }
+
+    @Override
+    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+        // no-op
+    }
+
+    @Override
+    public void close() {
+        // no-op
+    }
+}
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticatorFactory.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticatorFactory.java
new file mode 100644
index 000000000000..ec2fb8cc4106
--- /dev/null
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/authentication/DelayedAuthenticatorFactory.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.authentication;
+
+import java.util.List;
+import org.keycloak.Config;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.authentication.ConfigurableAuthenticatorFactory;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
+
+/**
+ * <p>Just an authenticator that delays the authenticator some millis.</p>
+ *
+ * @author rmartinc
+ */
+public class DelayedAuthenticatorFactory implements AuthenticatorFactory, ConfigurableAuthenticatorFactory {
+
+    public static final String PROVIDER_ID = "delayed-authenticator";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public Authenticator create(KeycloakSession session) {
+        return new DelayedAuthenticator();
+    }
+
+    @Override
+    public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+        return new AuthenticationExecutionModel.Requirement[]{
+            AuthenticationExecutionModel.Requirement.REQUIRED,
+            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
+            AuthenticationExecutionModel.Requirement.DISABLED
+        };
+    }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
+    @Override
+    public boolean isConfigurable() {
+        return true;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Just delay the autentication some millis.";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "TEST: Delayed authenticator";
+    }
+
+    @Override
+    public String getReferenceCategory() {
+        return "Delayed authenticator";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // no-op
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // no-op
+    }
+
+    @Override
+    public void close() {
+        // no-op
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return ProviderConfigurationBuilder.create()
+                .property()
+                .name("delay")
+                .label("Delay time in millis")
+                .helpText("The delayed time to apply in the authentication.")
+                .type(ProviderConfigProperty.INTEGER_TYPE)
+                .defaultValue("1000")
+                .add()
+                .build();
+    }
+}
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java
index 00dac7490ace..84625c75a367 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java
@@ -18,11 +18,12 @@
 
 package org.keycloak.testsuite.federation;
 
+import java.io.IOException;
+import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import org.jboss.logging.Logger;
@@ -33,7 +34,6 @@
 import org.keycloak.credential.CredentialInputValidator;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.hash.PasswordHashProvider;
-import org.keycloak.credential.hash.Pbkdf2Sha512PasswordHashProviderFactory;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OTPPolicy;
@@ -43,6 +43,8 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.cache.UserCache;
 import org.keycloak.models.credential.PasswordUserCredentialModel;
+import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.UserStorageProvider;
@@ -51,11 +53,12 @@
 import org.keycloak.storage.user.UserLookupProvider;
 import org.keycloak.storage.user.UserQueryProvider;
 import org.keycloak.storage.user.UserRegistrationProvider;
+import org.keycloak.util.JsonSerialization;
 
 /**
  * UserStorage implementation created in Keycloak 4.8.3. It is used for backwards compatibility testing. Future Keycloak versions
  * should work fine without a need to change the code of this provider.
- *
+ * <p>
  * TODO: Have some good mechanims to make sure that source code of this provider is really compatible with Keycloak 4.8.3
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -89,7 +92,7 @@ public UserModel getUserById(RealmModel realm, String id) {
     }
 
     private UserModel createUser(RealmModel realm, String username) {
-        return new AbstractUserAdapterFederatedStorage(session, realm,  model) {
+        return new AbstractUserAdapterFederatedStorage(session, realm, model) {
             @Override
             public String getUsername() {
                 return username;
@@ -107,7 +110,8 @@ public void setUsername(String username1) {
     @Override
     public boolean supportsCredentialType(String credentialType) {
         if (CredentialModel.PASSWORD.equals(credentialType)
-                || isOTPType(credentialType)) {
+                || isOTPType(credentialType)
+                || credentialType.equals(RecoveryAuthnCodesCredentialModel.TYPE)) {
             return true;
         } else {
             log.infof("Unsupported credential type: %s", credentialType);
@@ -172,6 +176,7 @@ public boolean updateCredential(RealmModel realm, UserModel user, CredentialInpu
             OTPPolicy otpPolicy = session.getContext().getRealm().getOTPPolicy();
 
             CredentialModel newOTP = new CredentialModel();
+            newOTP.setId(KeycloakModelUtils.generateId());
             newOTP.setType(input.getType());
             long createdDate = Time.currentTimeMillis();
             newOTP.setCreatedDate(createdDate);
@@ -184,6 +189,15 @@ public boolean updateCredential(RealmModel realm, UserModel user, CredentialInpu
 
             users.get(translateUserName(user.getUsername())).otp = newOTP;
 
+            return true;
+        } else if (input.getType().equals(RecoveryAuthnCodesCredentialModel.TYPE)) {
+            CredentialModel recoveryCodesModel = new CredentialModel();
+            recoveryCodesModel.setId(KeycloakModelUtils.generateId());
+            recoveryCodesModel.setType(input.getType());
+            recoveryCodesModel.setCredentialData(input.getChallengeResponse());
+            long createdDate = Time.currentTimeMillis();
+            recoveryCodesModel.setCreatedDate(createdDate);
+            users.get(translateUserName(user.getUsername())).recoveryCodes = recoveryCodesModel;
             return true;
         } else {
             log.infof("Attempt to update unsupported credential of type: %s", input.getType());
@@ -213,6 +227,30 @@ private MyUser getMyUser(UserModel user) {
         return users.get(translateUserName(user.getUsername()));
     }
 
+    @Override
+    public Stream<CredentialModel> getCredentials(RealmModel realm, UserModel user) {
+        var myUser = getMyUser(user);
+        RecoveryAuthnCodesCredentialModel model;
+        List<CredentialModel> credentialModels = new ArrayList<>();
+        if (myUser.recoveryCodes != null) {
+            try {
+                model = RecoveryAuthnCodesCredentialModel.createFromValues(
+                        JsonSerialization.readValue(myUser.recoveryCodes.getCredentialData(), List.class),
+                        myUser.recoveryCodes.getCreatedDate(),
+                        myUser.recoveryCodes.getUserLabel()
+                );
+                credentialModels.add(model);
+            } catch (IOException e) {
+                log.error("Could not deserialize  credential of type: recovery-codes");
+            }
+        }
+        if (myUser.otp != null) {
+            credentialModels.add(myUser.getOtp());
+        }
+
+        return credentialModels.stream();
+    }
+
     @Override
     public Stream<String> getDisableableCredentialTypesStream(RealmModel realm, UserModel user) {
         Set<String> types = new HashSet<>();
@@ -234,6 +272,8 @@ public boolean isConfiguredFor(RealmModel realm, UserModel user, String credenti
 
         if (isOTPType(credentialType) && myUser.otp != null) {
             return true;
+        } else if (credentialType.equals(RecoveryAuthnCodesCredentialModel.TYPE) && myUser.recoveryCodes != null) {
+            return true;
         } else {
             log.infof("Not supported credentialType '%s' for user '%s'", credentialType, user.getUsername());
             return false;
@@ -283,7 +323,22 @@ public boolean isValid(RealmModel realm, UserModel user, CredentialInput input)
             TimeBasedOTP validator = new TimeBasedOTP(storedOTPCredential.getAlgorithm(), storedOTPCredential.getDigits(),
                     storedOTPCredential.getPeriod(), realm.getOTPPolicy().getLookAheadWindow());
             return validator.validateTOTP(otpCredential.getValue(), storedOTPCredential.getValue().getBytes());
-        } else {
+        } else if (input.getType().equals(RecoveryAuthnCodesCredentialModel.TYPE)) {
+            CredentialModel storedRecoveryKeys = myUser.recoveryCodes;
+            if (storedRecoveryKeys == null) {
+                log.warnf("Not found credential for the user %s", user.getUsername());
+                return false;
+            }
+            List generatedKeys;
+            try {
+                generatedKeys = JsonSerialization.readValue(storedRecoveryKeys.getCredentialData(), List.class);
+            } catch (IOException e) {
+                log.warnf("Cannot deserialize recovery keys credential for the user %s", user.getUsername());
+                return false;
+            }
+
+            return generatedKeys.stream().anyMatch(key -> key.equals(input.getChallengeResponse()));
+        }  else {
             log.infof("Not supported to validate credential of type '%s' for user '%s'", input.getType(), user.getUsername());
             return false;
         }
@@ -369,6 +424,7 @@ static class MyUser {
         private String username;
         private CredentialModel hashedPassword;
         private CredentialModel otp;
+        private CredentialModel recoveryCodes;
 
         private MyUser(String username) {
             this.username = username;
@@ -377,6 +433,10 @@ private MyUser(String username) {
         public CredentialModel getOtp() {
             return otp;
         }
+
+        public CredentialModel getRecoveryCodes() {
+            return recoveryCodes;
+        }
     }
 
 
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorageFactory.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorageFactory.java
index 5c38da3bc134..2942be0585b1 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorageFactory.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorageFactory.java
@@ -50,4 +50,9 @@ public boolean hasUserOTP(String username) {
         return user.getOtp() != null;
     }
 
+    public boolean hasRecoveryCodes(String username) {
+        BackwardsCompatibilityUserStorage.MyUser user = userPasswords.get(username);
+        if (user == null) return false;
+        return user.getRecoveryCodes() != null;
+    }
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/HardcodedGroupStorageProvider.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/HardcodedGroupStorageProvider.java
index c1470d63100d..5de83ce3716a 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/HardcodedGroupStorageProvider.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/HardcodedGroupStorageProvider.java
@@ -114,6 +114,15 @@ public String getName() {
             return groupName;
         }
 
+        @Override
+        public String getDescription() {
+            return null;
+        }
+
+        public void setDescription(String description) {
+            throw new ReadOnlyException("group is read only");
+        }
+
         @Override
         public Stream<RoleModel> getRealmRoleMappingsStream() {
             return Stream.empty();
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/UserPropertyFileStorage.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/UserPropertyFileStorage.java
index 604a78190beb..7310081a5a24 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/UserPropertyFileStorage.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/UserPropertyFileStorage.java
@@ -111,7 +111,8 @@ private void addCall(String method) {
     public int getUsersCount(RealmModel realm, Map<String, String> params) {
         addCall(COUNT_SEARCH_METHOD);
 
-        return (int) searchForUser(realm, params.get(UserModel.SEARCH), null, null, username -> username.contains(params.get(UserModel.SEARCH))).count();
+        String search = params.get(UserModel.SEARCH);
+        return (int) searchForUser(realm, search, null, null, username -> search == null || username.contains(search)).count();
     }
 
     @Override
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java
index 1c00ccdd0732..04f3bf0c93cb 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/TestingResourceProvider.java
@@ -54,23 +54,19 @@
 import org.keycloak.models.AuthenticatedClientSessionModel;
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RealmProvider;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserProvider;
 import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStoreFactory;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.ResetTimeOffsetEvent;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.encode.TokenContextEncoderProvider;
 import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantType;
-import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.idm.AdminEventRepresentation;
@@ -96,7 +92,6 @@
 import org.keycloak.testsuite.model.infinispan.InfinispanTestUtil;
 import org.keycloak.testsuite.rest.representation.AuthenticatorState;
 import org.keycloak.testsuite.rest.resource.TestCacheResource;
-import org.keycloak.testsuite.rest.resource.TestJavascriptResource;
 import org.keycloak.testsuite.rest.resource.TestLDAPResource;
 import org.keycloak.testsuite.rest.resource.TestingExportImportResource;
 import org.keycloak.testsuite.runonserver.FetchOnServer;
@@ -118,7 +113,6 @@
 import java.lang.reflect.Method;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Date;
@@ -748,8 +742,6 @@ public void setKrb5ConfFile(@QueryParam("krb5-conf-file") String krb5ConfFile) {
     @Produces(MediaType.APPLICATION_JSON)
     public Response suspendPeriodicTasks() {
         suspendTask(ClearExpiredUserSessions.TASK_NAME);
-        suspendTask(CrossDCLastSessionRefreshStoreFactory.LSR_PERIODIC_TASK_NAME);
-        suspendTask(CrossDCLastSessionRefreshStoreFactory.LSR_OFFLINE_PERIODIC_TASK_NAME);
 
         return Response.noContent().build();
     }
@@ -783,42 +775,6 @@ public Response restorePeriodicTasks() {
         return Response.noContent().build();
     }
 
-
-    /**
-     * Generate new client scope for specified service client. The "Frontend" clients, who will use this client scope, will be able to
-     * send their access token to authenticate against specified service client
-     *
-     * @param clientId Client ID of service client (typically bearer-only client)
-     * @return ID of the newly generated clientScope
-     */
-    @Path("generate-audience-client-scope")
-    @POST
-    @NoCache
-    public String generateAudienceClientScope(@QueryParam("realm") final String realmName, final @QueryParam("clientId") String clientId) {
-        try {
-            RealmModel realm = getRealmByName(realmName);
-            ClientModel serviceClient = realm.getClientByClientId(clientId);
-            if (serviceClient == null) {
-                throw new NotFoundException("Referenced service client doesn't exist");
-            }
-
-            ClientScopeModel clientScopeModel = realm.addClientScope(clientId);
-            clientScopeModel.setProtocol(serviceClient.getProtocol() == null ? OIDCLoginProtocol.LOGIN_PROTOCOL : serviceClient.getProtocol());
-            clientScopeModel.setDisplayOnConsentScreen(true);
-            clientScopeModel.setConsentScreenText(clientId);
-            clientScopeModel.setIncludeInTokenScope(true);
-
-            // Add audience protocol mapper
-            ProtocolMapperModel audienceMapper = AudienceProtocolMapper.createClaimMapper("Audience for " + clientId, clientId, null, true, false, true);
-            clientScopeModel.addProtocolMapper(audienceMapper);
-
-            return clientScopeModel.getId();
-        } catch (ModelDuplicateException e) {
-            throw new BadRequestException("Client Scope " + clientId + " already exists");
-        }
-    }
-
-
     @POST
     @Path("/run-on-server")
     @Consumes(MediaType.TEXT_PLAIN_UTF_8)
@@ -865,12 +821,6 @@ public String runModelTestOnServer(@QueryParam("testClassName") String testClass
         }
     }
 
-
-    @Path("/javascript")
-    public TestJavascriptResource getJavascriptResource() {
-        return new TestJavascriptResource(session);
-    }
-
     private void setFeatureInProfileFile(File file, Profile.Feature featureProfile, String newState) {
         doWithProperties(file, props -> {
             props.setProperty(PropertiesProfileConfigResolver.getPropertyKey(featureProfile), newState);
@@ -935,11 +885,10 @@ public Set<Profile.Feature> disableFeature(@PathParam("feature") String feature)
     @Consumes(MediaType.APPLICATION_JSON)
     public void resetFeature(@PathParam("feature") String featureKey) {
 
-        Profile.Feature feature;
+        featureKey = featureKey.contains(":") ? featureKey.split(":")[0] : featureKey;
+        Profile.Feature feature = Profile.getFeatureVersions(featureKey).iterator().next();
 
-        try {
-            feature = Profile.Feature.valueOf(featureKey);
-        } catch (IllegalArgumentException e) {
+        if (feature == null) {
             System.err.printf("Feature '%s' doesn't exist!!\n", featureKey);
             throw new BadRequestException();
         }
@@ -957,16 +906,18 @@ public void resetFeature(@PathParam("feature") String featureKey) {
     private Set<Profile.Feature> updateFeature(String featureKey, boolean shouldEnable) {
         Collection<Profile.Feature> features = null;
 
-        try {
-            features = Arrays.asList(Profile.Feature.valueOf(featureKey));
-        } catch (IllegalArgumentException e) {
-            Set<Feature> featureVersions = Profile.getFeatureVersions(featureKey);
-            if (!shouldEnable) {
-                features = featureVersions;
-            } else if (!featureVersions.isEmpty()) {
-                // the set is ordered by preferred feature
-                features = Arrays.asList(featureVersions.iterator().next());
+        if (featureKey.contains(":")) {
+            String unversionedKey = featureKey.split(":")[0];
+            int version = Integer.parseInt(featureKey.split(":")[1].replace("v", ""));
+
+            for (Feature versionedFeature : Profile.getFeatureVersions(unversionedKey)) {
+                if (versionedFeature.getVersion() == version) {
+                    features = Set.of(versionedFeature);
+                    break;
+                }
             }
+        } else {
+            features = Profile.getFeatureVersions(featureKey);
         }
 
         if (features == null || features.isEmpty()) {
@@ -1221,4 +1172,12 @@ public void removeEventsToEmailEventListenerProvider(List<EventType> events) {
             prov.removeIncludedEvents(events.toArray(EventType[]::new));
         }
     }
+
+    @GET
+    @Path("/token-context")
+    @Produces(MediaType.APPLICATION_JSON)
+    public AccessTokenContext getTokenContext(@QueryParam("tokenId") String tokenId) {
+        return session.getProvider(TokenContextEncoderProvider.class).getTokenContextFromTokenId(tokenId);
+    }
+
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestCacheResource.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestCacheResource.java
index 8b907d2dabff..ddcf4b2c0885 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestCacheResource.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestCacheResource.java
@@ -24,18 +24,12 @@
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import org.infinispan.Cache;
-import org.infinispan.client.hotrod.RemoteCache;
 import org.infinispan.stream.CacheCollectors;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.connections.infinispan.InfinispanUtil;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
 import org.keycloak.utils.MediaType;
 
-import java.util.Collections;
 import java.util.HashSet;
-import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
 import java.util.stream.Collectors;
@@ -108,33 +102,4 @@ public void removeKey(@PathParam("id") String id) {
     public void processExpiration() {
         cache.getAdvancedCache().getExpirationManager().processExpiration();
     }
-
-    @GET
-    @Path("/remote-cache-stats")
-    @Produces(MediaType.APPLICATION_JSON)
-    public Map<String, String> getRemoteCacheStats() {
-        var remoteCache = InfinispanUtil.getRemoteCache(cache);
-        return remoteCache == null ?
-                Collections.emptyMap() :
-                remoteCache.serverStatistics().getStatsMap();
-    }
-
-
-    @GET
-    @Path("/remote-cache-last-session-refresh/{user-session-id}")
-    @Produces(MediaType.APPLICATION_JSON)
-    public int getRemoteCacheLastSessionRefresh(@PathParam("user-session-id") String userSessionId) {
-        RemoteCache<String, SessionEntityWrapper<UserSessionEntity>> remoteCache = InfinispanUtil.getRemoteCache(cache);
-        if (remoteCache == null) {
-            return -1;
-        } else {
-            SessionEntityWrapper<UserSessionEntity> userSession = remoteCache.get(userSessionId);
-            if (userSession == null) {
-                return -1;
-            } else {
-                return userSession.getEntity().getLastSessionRefresh();
-            }
-        }
-    }
-
 }
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestJavascriptResource.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestJavascriptResource.java
deleted file mode 100644
index 7c461cffbd50..000000000000
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/rest/resource/TestJavascriptResource.java
+++ /dev/null
@@ -1,79 +0,0 @@
-package org.keycloak.testsuite.rest.resource;
-
-import org.keycloak.headers.SecurityHeadersProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.testsuite.rest.TestingResourceProvider;
-
-import jakarta.ws.rs.GET;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.Produces;
-import jakarta.ws.rs.core.MediaType;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * @author mhajas
- */
-public class TestJavascriptResource {
-
-    private KeycloakSession session;
-
-    public TestJavascriptResource(KeycloakSession session) {
-        this.session = session;
-    }
-
-    @GET
-    @Path("/js/keycloak.js")
-    @Produces("application/javascript")
-    public String getJavascriptAdapter() throws IOException {
-        return resourceToString("/javascript/keycloak.js");
-    }
-
-    @GET
-    @Path("/index.html")
-    @Produces(MediaType.TEXT_HTML)
-    public String getJavascriptTestingEnvironment() throws IOException {
-        session.getProvider(SecurityHeadersProvider.class).options().skipHeaders();
-        return resourceToString("/javascript/index.html");
-    }
-
-    @GET
-    @Path("/init-in-head.html")
-    @Produces(MediaType.TEXT_HTML)
-    public String getJavascriptTestingEnvironmentWithInitInHead() throws IOException {
-        session.getProvider(SecurityHeadersProvider.class).options().skipHeaders();
-        return resourceToString("/javascript/init-in-head.html");
-    }
-
-    @GET
-    @Path("/silent-check-sso.html")
-    @Produces(MediaType.TEXT_HTML)
-    public String getJavascriptTestingEnvironmentSilentCheckSso() throws IOException {
-        return resourceToString("/javascript/silent-check-sso.html");
-    }
-
-    @GET
-    @Path("/keycloak.json")
-    @Produces(MediaType.APPLICATION_JSON)
-    public String getKeycloakJSON() throws IOException {
-        return resourceToString("/javascript/keycloak.json");
-    }
-
-    private String resourceToString(String path) throws IOException {
-        try (InputStream is = TestingResourceProvider.class.getResourceAsStream(path);
-             BufferedReader buf = new BufferedReader(new InputStreamReader(is))) {
-            String line = buf.readLine();
-            StringBuilder sb = new StringBuilder();
-            while (line != null) {
-                sb.append(line).append("\n");
-                line = buf.readLine();
-            }
-
-            return sb.toString().replace("${js-adapter.auth-server-url}", getAuthServerContextRoot() + "/auth");
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/util/LDAPTestUtils.java b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/util/LDAPTestUtils.java
index e7333cac4ac8..769608953601 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/util/LDAPTestUtils.java
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/util/LDAPTestUtils.java
@@ -138,7 +138,7 @@ public String getFirstAttribute(String name) {
                 } else if (otherAttrs.containsKey(name)) {
                     return otherAttrs.getFirst(name);
                 }
-                return super.getFirstAttribute(name);
+                return null;
             }
 
             @Override
@@ -458,6 +458,17 @@ public static LDAPObject createLDAPGroup(String mapperName, KeycloakSession sess
         }
     }
 
+    public static LDAPObject getLdapGroupByName(KeycloakSession session, RealmModel realm, String mapperName, String groupName) {
+        ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+        ComponentModel mapperModel = getSubcomponentByName(realm, ldapModel, mapperName);
+        LDAPStorageProvider ldapProvider = getLdapProvider(session, ldapModel);
+        if (GroupLDAPStorageMapperFactory.PROVIDER_ID.equals(mapperModel.getProviderId())) {
+            return getGroupMapper(mapperModel, ldapProvider, realm).loadLDAPGroupByName(groupName);
+        } else {
+            return getRoleMapper(mapperModel, ldapProvider, realm).loadLDAPRoleByName(groupName);
+        }
+    }
+
     public static LDAPObject updateLDAPGroup(KeycloakSession session, RealmModel appRealm, ComponentModel ldapModel, LDAPObject ldapObject) {
         ComponentModel mapperModel = getSubcomponentByName(appRealm, ldapModel, "groupsMapper");
         LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticatorFactory b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticatorFactory
index 19171bcf1cd6..2aedf8b62141 100755
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticatorFactory
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticatorFactory
@@ -20,6 +20,7 @@ org.keycloak.testsuite.forms.SetClientNoteAuthenticator
 org.keycloak.testsuite.forms.PassThroughRegistration
 org.keycloak.testsuite.forms.ClickThroughAuthenticator
 org.keycloak.testsuite.forms.ErrorEventAuthenticator
+org.keycloak.testsuite.authentication.DelayedAuthenticatorFactory
 org.keycloak.testsuite.authentication.ExpectedParamAuthenticatorFactory
 org.keycloak.testsuite.authentication.PushButtonAuthenticatorFactory
 org.keycloak.testsuite.forms.UsernameOnlyAuthenticator
@@ -29,4 +30,4 @@ org.keycloak.examples.providersoverride.CustomValidateUsername
 org.keycloak.examples.providersoverride.CustomValidatePassword1
 org.keycloak.examples.providersoverride.CustomValidatePassword2
 org.keycloak.examples.providersoverride.CustomValidatePassword3
-org.keycloak.examples.providersoverride.CustomValidateOTP
\ No newline at end of file
+org.keycloak.examples.providersoverride.CustomValidateOTP
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/index.html b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/index.html
deleted file mode 100644
index af2e23baeaaf..000000000000
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/index.html
+++ /dev/null
@@ -1,90 +0,0 @@
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<html>
-<head>
-    <script type="importmap">
-      {
-        "imports": {
-          "keycloak-js": "./js/keycloak.js"
-        }
-      }
-    </script>
-</head>
-<body>
-
-<h2>Result</h2>
-<pre style="background-color: #ddd; border: 1px solid #ccc; padding: 10px;" id="output"></pre>
-
-<h2>Events</h2>
-<pre style="background-color: #ddd; border: 1px solid #ccc; padding: 10px;" id="events"></pre>
-
-
-<script type="module">
-    import Keycloak from 'keycloak-js';
-
-    function output(data) {
-        if (typeof data === 'object') {
-            data = JSON.stringify(data, null, '  ');
-        }
-        document.getElementById('output').innerHTML = data;
-    }
-
-    function event(event) {
-        var e = document.getElementById('events').innerHTML;
-        document.getElementById('events').innerHTML = new Date().toLocaleString() + "\t" + event + "\n" + e;
-    }
-
-    function getParameterByName(name, url) {
-        if (!url) url = window.location.href;
-        name = name.replace(/[\[\]]/g, "\\$&");
-        var regex = new RegExp("[?&#]" + name + "(=([^&#]*)|&|#|$)"),
-            results = regex.exec(url);
-        if (!results) return null;
-        if (!results[2]) return '';
-        return decodeURIComponent(results[2].replace(/\+/g, " "));
-    }
-
-    // Expose globals for tests.
-    globalThis.Keycloak = Keycloak;
-    globalThis.output = output;
-    globalThis.event = event;
-    globalThis.getParameterByName = getParameterByName;
-
-     function showExpires() {
-        if (!keycloak.tokenParsed) {
-            output("Not authenticated");
-            return;
-        }
-
-        var o = 'Token Expires:\t\t' + new Date((keycloak.tokenParsed.exp + keycloak.timeSkew) * 1000).toLocaleString() + '\n';
-        o += 'Token Expires in:\t' + Math.round(keycloak.tokenParsed.exp + keycloak.timeSkew - new Date().getTime() / 1000) + ' seconds\n';
-
-        if (keycloak.refreshTokenParsed) {
-            o += 'Refresh Token Expires:\t' + new Date((keycloak.refreshTokenParsed.exp + keycloak.timeSkew) * 1000).toLocaleString() + '\n';
-            o += 'Refresh Expires in:\t' + Math.round(keycloak.refreshTokenParsed.exp + keycloak.timeSkew - new Date().getTime() / 1000) + ' seconds';
-        }
-
-        output(o);
-    }
-
-    function showError() {
-        output("Error: " + getParameterByName("error") + "\n" + "Error description: " + getParameterByName("error_description"));
-    }
-</script>
-<div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
-</html>
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/init-in-head.html b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/init-in-head.html
deleted file mode 100644
index d15871a7395c..000000000000
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/init-in-head.html
+++ /dev/null
@@ -1,77 +0,0 @@
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<html>
-<head>
-    <script type="importmap">
-      {
-        "imports": {
-          "keycloak-js": "./js/keycloak.js"
-        }
-      }
-    </script>
-    <script type="module">
-        import Keycloak from 'keycloak-js';
-
-        function output(data) {
-            if (typeof data === 'object') {
-                data = JSON.stringify(data, null, '  ');
-            }
-            document.getElementById('output').innerHTML = data;
-        }
-
-        function event(event) {
-            var e = document.getElementById('events').innerHTML;
-            document.getElementById('events').innerHTML = new Date().toLocaleString() + "\t" + event + "\n" + e;
-        }
-
-        const keycloak = new Keycloak({
-            url: '${js-adapter.auth-server-url}',
-            realm: 'test',
-            clientId: 'js-console'
-        });
-
-        // Expose globals for tests.
-        globalThis.Keycloak = Keycloak;
-        globalThis.keycloak = keycloak;
-        globalThis.output = output;
-        globalThis.event = event;
-
-        keycloak.init().then((authenticated) => {
-            output('Init Success (' + (authenticated ? 'Authenticated' : 'Not Authenticated') + ')');
-        }).catch(function() {
-            output('Init Error');
-        });
-
-        keycloak.onAuthSuccess = function () {event('Auth Success')};
-        keycloak.onAuthError = function () {event('Auth Error')};
-        keycloak.onAuthRefreshSuccess = function () {event('Auth Refresh Success')};
-        keycloak.onAuthRefreshError = function () {event('Auth Refresh Error')};
-        keycloak.onAuthLogout = function () {event('Auth Logout')};
-        keycloak.onTokenExpired = function () {event('Access token expired.')};
-        keycloak.onActionUpdate = function (status) {event('AIA status: ' + status)};
-    </script>
-</head>
-<body>
-
-<h2>Result</h2>
-<pre style="background-color: #ddd; border: 1px solid #ccc; padding: 10px;" id="output"></pre>
-
-<h2>Events</h2>
-<pre style="background-color: #ddd; border: 1px solid #ccc; padding: 10px;" id="events"></pre>
-<div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
-</html>
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/keycloak.json b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/keycloak.json
deleted file mode 100644
index 328ec601fa57..000000000000
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/keycloak.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "realm" : "test",
-  "realm-public-key" : "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
-  "auth-server-url" : "${js-adapter.auth-server-url}",
-  "ssl-required" : "external",
-  "resource" : "js-console",
-  "public-client" : true
-}
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/silent-check-sso.html b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/silent-check-sso.html
deleted file mode 100644
index 60a7af916a91..000000000000
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/javascript/silent-check-sso.html
+++ /dev/null
@@ -1 +0,0 @@
-<html><body><script>parent.postMessage(location.href, location.origin)</script><div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body></html>
diff --git a/testsuite/integration-arquillian/tests/base/pom.xml b/testsuite/integration-arquillian/tests/base/pom.xml
index 4a418afafe31..5ed22ff6dd55 100644
--- a/testsuite/integration-arquillian/tests/base/pom.xml
+++ b/testsuite/integration-arquillian/tests/base/pom.xml
@@ -45,9 +45,14 @@
         <mvel.version>2.5.2.Final</mvel.version>
         <systemrules.version>1.19.0</systemrules.version>
         <common.resources>${basedir}/../../servers/auth-server/common</common.resources>
+        <auth.server.ipv6>false</auth.server.ipv6>
     </properties>
     
     <dependencies>
+        <dependency>
+            <groupId>org.keycloak.tests</groupId>
+            <artifactId>keycloak-tests-utils-shared</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-util-embedded-ldap</artifactId>
@@ -271,6 +276,7 @@
             <plugin>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <configuration>
+                    <runOrder>alphabetical</runOrder>
                     <excludes>
                         <exclude>${exclude.test}</exclude>
                         <exclude>${exclude.console}</exclude>
@@ -311,26 +317,6 @@
                             </resources>
                         </configuration>
                     </execution>
-                    <execution>
-                        <id>copy-admin-user-json-file</id>
-                        <phase>process-resources</phase>
-                        <goals>
-                            <goal>copy-resources</goal>
-                        </goals>
-                        <configuration>
-                            <skip>${skip.add.user.json}</skip>
-                            <outputDirectory>${auth.server.config.dir}</outputDirectory>
-                            <resources>
-                                <resource>
-                                    <directory>src/test/resources</directory>
-                                    <includes>
-                                        <include>keycloak-add-user.json</include>
-                                    </includes>
-                                    <filtering>true</filtering>
-                                </resource>
-                            </resources>
-                        </configuration>
-                    </execution>
                 </executions>
             </plugin>
 
@@ -448,7 +434,20 @@
     </build>
 
     <profiles>
-
+    
+        <profile>
+            <id>ipv6</id>
+            <activation>
+                <property>
+                    <name>java.net.preferIPv6Addresses</name>
+                    <value>true</value>
+                </property>
+            </activation>
+            <properties>
+                <auth.server.ipv6>true</auth.server.ipv6>
+            </properties>
+        </profile>
+        
         <profile>
             <id>app-server-wildfly</id>
             <activation>
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/admin/ApiUtil.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/admin/ApiUtil.java
index 2c93dc0b126f..e4493b16cb6c 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/admin/ApiUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/admin/ApiUtil.java
@@ -17,6 +17,7 @@
 package org.keycloak.testsuite.admin;
 
 import org.jboss.logging.Logger;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
 import org.keycloak.admin.client.resource.AuthorizationResource;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.ClientScopeResource;
@@ -25,6 +26,7 @@
 import org.keycloak.admin.client.resource.RoleResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.CredentialRepresentation;
@@ -336,4 +338,12 @@ public static void updateRequiredActionsOrderByAlias(final RealmResource realmRe
         log.infof("updated required actions order for realm '%s': %s", realmName, updatedRequiredActionsOrdered);
     }
 
+    public static void enableRequiredAction(RealmResource realm, RequiredAction action, boolean enable) {
+        AuthenticationManagementResource authMgt = realm.flows();
+        RequiredActionProviderRepresentation requiredAction = authMgt.getRequiredActions().stream()
+                .filter(a -> action.name().equals(a.getAlias()))
+                .findAny().orElseThrow(() -> new IllegalStateException("Required action not found: " + action.name()));
+        requiredAction.setEnabled(enable);
+        authMgt.updateRequiredAction(requiredAction.getAlias(), requiredAction);
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/AuthServerTestEnricher.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/AuthServerTestEnricher.java
index 598b15566e8f..a281b194a23b 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/AuthServerTestEnricher.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/AuthServerTestEnricher.java
@@ -50,7 +50,8 @@
 import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
 import org.keycloak.testsuite.arquillian.annotation.EnableVault;
 import org.keycloak.testsuite.client.KeycloakTestingClient;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.HttpClientUtils;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.SpiProvidersSwitchingUtils;
 import org.keycloak.testsuite.util.SqlUtils;
 import org.keycloak.testsuite.util.SystemInfoHelper;
@@ -65,7 +66,6 @@
 import java.security.Provider;
 import java.security.Security;
 import java.util.List;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 
@@ -125,8 +125,6 @@ public class AuthServerTestEnricher {
 
     public static final String AUTH_SERVER_CLUSTER_PROPERTY = "auth.server.cluster";
     public static final boolean AUTH_SERVER_CLUSTER = Boolean.parseBoolean(System.getProperty(AUTH_SERVER_CLUSTER_PROPERTY, "false"));
-    public static final String AUTH_SERVER_CROSS_DC_PROPERTY = "auth.server.crossdc";
-    public static final boolean AUTH_SERVER_CROSS_DC = Boolean.parseBoolean(System.getProperty(AUTH_SERVER_CROSS_DC_PROPERTY, "false"));
 
     public static final String AUTH_SERVER_HOME_PROPERTY = "auth.server.home";
 
@@ -203,65 +201,7 @@ public void initializeSuiteContext(@Observes(precedence = 2) BeforeSuite event)
 
         suiteContext = new SuiteContext(containers);
 
-        if (AUTH_SERVER_CROSS_DC) {
-            // if cross-dc mode enabled, load-balancer is the frontend of datacenter cluster
-            containers.stream()
-                .filter(c -> c.getQualifier().startsWith(AUTH_SERVER_BALANCER + "-cross-dc"))
-                .forEach(c -> {
-                    String portOffsetString = c.getArquillianContainer().getContainerConfiguration().getContainerProperties().getOrDefault("bindHttpPortOffset", "0");
-                    String dcString = c.getArquillianContainer().getContainerConfiguration().getContainerProperties().getOrDefault("dataCenter", "0");
-                    updateWithAuthServerInfo(c, Integer.valueOf(portOffsetString));
-                    suiteContext.addAuthServerInfo(Integer.valueOf(dcString), c);
-                });
-
-            if (suiteContext.getDcAuthServerInfo().isEmpty()) {
-                throw new IllegalStateException("Not found frontend container (load balancer): " + AUTH_SERVER_BALANCER);
-            }
-            if (suiteContext.getDcAuthServerInfo().stream().anyMatch(Objects::isNull)) {
-                throw new IllegalStateException("Frontend container (load balancer) misconfiguration");
-            }
-
-            containers.stream()
-                    .filter(c -> c.getQualifier().startsWith("auth-server-" + System.getProperty("node.name") + "-"))
-                    .sorted((a, b) -> a.getQualifier().compareTo(b.getQualifier()))
-                    .forEach(c -> {
-                        String portOffsetString = c.getArquillianContainer().getContainerConfiguration().getContainerProperties().getOrDefault("bindHttpPortOffset", "0");
-                        updateWithAuthServerInfo(c, Integer.valueOf(portOffsetString));
-
-                        String dcString = c.getArquillianContainer().getContainerConfiguration().getContainerProperties().getOrDefault("dataCenter", "0");
-                        suiteContext.addAuthServerBackendsInfo(Integer.valueOf(dcString), c);
-                    });
-
-            containers.stream()
-                    .filter(c -> c.getQualifier().startsWith("cache-server-"))
-                    .sorted((a, b) -> a.getQualifier().compareTo(b.getQualifier()))
-                    .forEach(containerInfo -> {
-
-                        log.info(String.format("cache container: %s", containerInfo.getQualifier()));
-
-                        int prefixSize = containerInfo.getQualifier().lastIndexOf("-") + 1;
-                        int dcIndex = Integer.parseInt(containerInfo.getQualifier().substring(prefixSize)) - 1;
-
-                        suiteContext.addCacheServerInfo(dcIndex, containerInfo);
-                    });
-
-            if (suiteContext.getDcAuthServerInfo().isEmpty()) {
-                throw new RuntimeException(String.format("No auth server container matching '%s' found in arquillian.xml.", AUTH_SERVER_BACKEND));
-            }
-            if (suiteContext.getDcAuthServerBackendsInfo().stream().anyMatch(Objects::isNull)) {
-                throw new IllegalStateException("Frontend container (load balancer) misconfiguration");
-            }
-            if (suiteContext.getDcAuthServerBackendsInfo().stream().anyMatch(List::isEmpty)) {
-                throw new RuntimeException(String.format("Some data center has no auth server container matching '%s' defined in arquillian.xml.", AUTH_SERVER_BACKEND));
-            }
-            if (suiteContext.getCacheServersInfo().isEmpty() && !CACHE_SERVER_LIFECYCLE_SKIP) {
-                throw new IllegalStateException("Cache containers misconfiguration");
-            }
-
-            log.info("Using frontend containers: " + this.suiteContext.getDcAuthServerInfo().stream()
-              .map(ContainerInfo::getQualifier)
-              .collect(Collectors.joining(", ")));
-        } else if (AUTH_SERVER_CLUSTER) {
+        if (AUTH_SERVER_CLUSTER) {
             // if cluster mode enabled, load-balancer is the frontend
             ContainerInfo container = containers.stream()
               .filter(c -> c.getQualifier().startsWith(AUTH_SERVER_BALANCER))
@@ -313,7 +253,6 @@ public void initializeSuiteContext(@Observes(precedence = 2) BeforeSuite event)
         }
 
         suiteContextProducer.set(suiteContext);
-        CrossDCTestEnricher.initializeSuiteContext(suiteContext);
         log.info("\n\n" + suiteContext);
         log.info("\n\n" + SystemInfoHelper.getSystemInfo());
 
@@ -695,7 +634,7 @@ public static void setJsseSecurityProviderForOutboundSslConnectionsOfElytronClie
     public void initializeOAuthClient(@Observes(precedence = 4) BeforeClass event) {
         // TODO workaround. Check if can be removed
         OAuthClient.updateURLs(suiteContext.getAuthServerInfo().getContextRoot().toString());
-        OAuthClient oAuthClient = new OAuthClient();
+        OAuthClient oAuthClient = new OAuthClient(HttpClientUtils.createDefault(), null);
         oAuthClientProducer.set(oAuthClient);
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CacheStatisticsControllerEnricher.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CacheStatisticsControllerEnricher.java
deleted file mode 100644
index d0e2b4e8f607..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CacheStatisticsControllerEnricher.java
+++ /dev/null
@@ -1,432 +0,0 @@
-package org.keycloak.testsuite.arquillian;
-
-import java.io.IOException;
-import java.io.NotSerializableException;
-import java.lang.management.ManagementFactory;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-import java.lang.reflect.Parameter;
-import java.net.MalformedURLException;
-import java.rmi.UnmarshalException;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.function.Supplier;
-import java.util.stream.Collectors;
-import javax.management.Attribute;
-import javax.management.AttributeNotFoundException;
-import javax.management.InstanceNotFoundException;
-import javax.management.IntrospectionException;
-import javax.management.MBeanAttributeInfo;
-import javax.management.MBeanException;
-import javax.management.MBeanInfo;
-import javax.management.MBeanServerConnection;
-import javax.management.MalformedObjectNameException;
-import javax.management.ObjectName;
-import javax.management.ReflectionException;
-import javax.management.remote.JMXServiceURL;
-import org.apache.commons.lang3.reflect.FieldUtils;
-import org.jboss.arquillian.container.spi.Container;
-import org.jboss.arquillian.container.spi.ContainerRegistry;
-import org.jboss.arquillian.core.api.Instance;
-import org.jboss.arquillian.core.api.annotation.Inject;
-import org.jboss.arquillian.core.spi.Validate;
-import org.jboss.arquillian.test.spi.TestEnricher;
-import org.jboss.logging.Logger;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.common.util.Retry;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanCacheStatistics;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanChannelStatistics;
-import org.keycloak.testsuite.arquillian.containers.InfinispanServerDeployableContainer;
-import org.keycloak.testsuite.arquillian.jmx.JmxConnectorRegistry;
-import org.keycloak.testsuite.arquillian.undertow.KeycloakOnUndertow;
-import org.keycloak.testsuite.crossdc.DC;
-
-/**
- *
- * @author hmlnarik
- */
-public class CacheStatisticsControllerEnricher implements TestEnricher {
-
-    private static final Logger LOG = Logger.getLogger(CacheStatisticsControllerEnricher.class);
-
-    @Inject
-    private Instance<ContainerRegistry> registry;
-
-    @Inject
-    private Instance<JmxConnectorRegistry> jmxConnectorRegistry;
-
-    @Inject
-    private Instance<SuiteContext> suiteContext;
-
-    @Override
-    public void enrich(Object testCase) {
-        Validate.notNull(registry.get(), "registry should not be null");
-        Validate.notNull(jmxConnectorRegistry.get(), "jmxConnectorRegistry should not be null");
-        Validate.notNull(suiteContext.get(), "suiteContext should not be null");
-
-        for (Field field : FieldUtils.getAllFields(testCase.getClass())) {
-            JmxInfinispanCacheStatistics annotation = field.getAnnotation(JmxInfinispanCacheStatistics.class);
-
-            if (annotation == null) {
-                continue;
-            }
-
-            try {
-                FieldUtils.writeField(field, testCase, getInfinispanCacheStatistics(annotation), true);
-            } catch (IOException | IllegalAccessException | MalformedObjectNameException e) {
-                throw new RuntimeException("Could not set value on field " + field);
-            }
-        }
-    }
-
-    private InfinispanStatistics getInfinispanCacheStatistics(JmxInfinispanCacheStatistics annotation) throws MalformedObjectNameException, IOException, MalformedURLException {
-        List<ObjectName> mbeanNameTemplates = new LinkedList<>();
-        mbeanNameTemplates.add(new ObjectName(String.format(
-          "%s:type=%s,name=\"%s(%s)\",manager=\"%s\",component=%s",
-          annotation.domain().isEmpty() ? getDefaultDomain(annotation.dc().getDcIndex(), annotation.dcNodeIndex()) : InfinispanConnectionProvider.JMX_DOMAIN,
-          annotation.type(),
-          annotation.cacheName(),
-          annotation.cacheMode(),
-          annotation.cacheManagerName(),
-          annotation.component()
-        )));
-
-        // For the Keycloak on Wildfly 20 and bigger, the typical objectName for the cache statistics looks similar to: jboss.as:subsystem=infinispan,cache-container=keycloak,cache=actionTokens
-        if (annotation.dc().getDcIndex() != -1 && annotation.dcNodeIndex() != -1) {
-            mbeanNameTemplates.add(new ObjectName(String.format(
-                    "jboss.as:subsystem=infinispan,cache-container=keycloak,cache=%s",
-                    annotation.cacheName()
-            )));
-        }
-
-        InfinispanStatistics value = new InfinispanCacheStatisticsImpl(getJmxServerConnection(annotation), mbeanNameTemplates);
-
-        if (annotation.domain().isEmpty()) {
-            try {
-                LOG.debug("Going to try reset InfinispanCacheStatistics (2 attempts, 150 ms interval)");
-                int execute = Retry.execute(() -> value.reset(), 2, 150);
-                LOG.debug("reset in " + execute + " attempts");
-            } catch (RuntimeException ex) {
-                if (annotation.dc() != DC.UNDEFINED && annotation.dcNodeIndex() != -1
-                   && suiteContext.get().getAuthServerBackendsInfo(annotation.dc().getDcIndex()).get(annotation.dcNodeIndex()).isStarted()) {
-                    LOG.warn("Could not reset statistics for any of the mbean name templates " + mbeanNameTemplates + ". The reason is: \"" + ex.getMessage() + "\"");
-                }
-            }
-        }
-
-        return value;
-    }
-
-    private InfinispanStatistics getJGroupsChannelStatistics(JmxInfinispanChannelStatistics annotation) throws MalformedObjectNameException, IOException, MalformedURLException {
-        ObjectName mbeanName = new ObjectName(String.format(
-          "%s:%stype=%s,cluster=\"%s\"",
-          annotation.domain().isEmpty() ? getDefaultDomain(annotation.dc().getDcIndex(), annotation.dcNodeIndex()) : InfinispanConnectionProvider.JMX_DOMAIN,
-          isLegacyInfinispan() ? "" : "manager=\"default\",",
-          annotation.type(),
-          annotation.cluster()
-        ));
-
-        InfinispanStatistics value = new InfinispanChannelStatisticsImpl(getJmxServerConnection(annotation), mbeanName);
-
-        if (annotation.domain().isEmpty()) {
-            try {
-                Retry.execute(() -> value.reset(), 2, 150);
-            } catch (RuntimeException ex) {
-                if (annotation.dc() != DC.UNDEFINED && annotation.dcNodeIndex() != -1
-                   && suiteContext.get().getAuthServerBackendsInfo(annotation.dc().getDcIndex()).get(annotation.dcNodeIndex()).isStarted()) {
-                    LOG.warn("Could not reset statistics for " + mbeanName + ". The reason is: \"" + ex.getMessage() + "\"");
-                }
-            }
-        }
-
-        return value;
-    }
-
-    @Override
-    public Object[] resolve(Method method) {
-        Object[] values = new Object[method.getParameterCount()];
-
-        for (int i = 0; i < method.getParameterCount(); i ++) {
-            Parameter param = method.getParameters()[i];
-
-            JmxInfinispanCacheStatistics annotation = param.getAnnotation(JmxInfinispanCacheStatistics.class);
-            if (annotation != null) try {
-                values[i] = getInfinispanCacheStatistics(annotation);
-            } catch (IOException | MalformedObjectNameException e) {
-                throw new RuntimeException("Could not set value on field " + param);
-            }
-
-            JmxInfinispanChannelStatistics channelAnnotation = param.getAnnotation(JmxInfinispanChannelStatistics.class);
-            if (channelAnnotation != null) try {
-                values[i] = getJGroupsChannelStatistics(channelAnnotation);
-            } catch (IOException | MalformedObjectNameException e) {
-                throw new RuntimeException("Could not set value on field " + param);
-            }
-        }
-
-        return values;
-    }
-
-    private String getDefaultDomain(int dcIndex, int dcNodeIndex) {
-        if (dcIndex != -1 && dcNodeIndex != -1) {
-            if (Boolean.parseBoolean(System.getProperty("auth.server.jboss.crossdc"))) {
-                //backend-jboss-server
-                return "org.wildfly.clustering.infinispan";
-            }
-            
-            //backend-undertow-server
-            return InfinispanConnectionProvider.JMX_DOMAIN + "-" + suiteContext.get().getAuthServerBackendsInfo(dcIndex).get(dcNodeIndex).getQualifier();
-        }
-        
-        //cache-server
-        return isLegacyInfinispan() ? "jboss.datagrid-infinispan" : "org.infinispan"; 
-    }
-    
-    private boolean isLegacyInfinispan() { // infinispan 9 or lower
-        return Boolean.parseBoolean(System.getProperty("cache.server.legacy", "false"));
-    }
-    
-    private Supplier<MBeanServerConnection> getJmxServerConnection(JmxInfinispanCacheStatistics annotation) throws MalformedURLException {
-        final String host;
-        final int port;
-
-        if (annotation.dc() != DC.UNDEFINED && annotation.dcNodeIndex() != -1) {
-            ContainerInfo node = suiteContext.get().getAuthServerBackendsInfo(annotation.dc().getDcIndex()).get(annotation.dcNodeIndex());
-            Container container = node.getArquillianContainer();
-            if (container.getDeployableContainer() instanceof KeycloakOnUndertow) {
-                return () -> ManagementFactory.getPlatformMBeanServer();
-            }
-            host = "localhost";
-            port = container.getContainerConfiguration().getContainerProperties().containsKey("managementPort")
-              ? Integer.valueOf(container.getContainerConfiguration().getContainerProperties().get("managementPort"))
-              : 9990;
-        } else {
-            Container container = suiteContext.get().getCacheServersInfo().get(0).getArquillianContainer();
-            if (container.getDeployableContainer() instanceof InfinispanServerDeployableContainer) {
-                // jmx connection to infinispan server
-                return () -> {
-                    try {
-                        return jmxConnectorRegistry.get().getConnection(
-                                ((InfinispanServerDeployableContainer) container.getDeployableContainer()).getJMXServiceURL()
-                        ).getMBeanServerConnection();
-                    } catch (IOException ex) {
-                        throw new RuntimeException(ex);
-                    }
-                };
-            }
-            host = annotation.host().isEmpty()
-              ? System.getProperty((annotation.hostProperty().isEmpty()
-                ? "keycloak.connectionsInfinispan.remoteStoreServer"
-                : annotation.hostProperty()))
-              : annotation.host();
-
-            port = annotation.managementPort() == -1
-              ? Integer.valueOf(System.getProperty((annotation.managementPortProperty().isEmpty()
-                ? "cache.server.management.port"
-                : annotation.managementPortProperty())))
-              : annotation.managementPort();
-        }
-
-
-        JMXServiceURL url = new JMXServiceURL("service:jmx:remote+http://" + host + ":" + port);
-        return () -> {
-            try {
-                return jmxConnectorRegistry.get().getConnection(url).getMBeanServerConnection();
-            } catch (IOException ex) {
-                throw new RuntimeException(ex);
-            }
-        };
-    }
-
-    private Supplier<MBeanServerConnection> getJmxServerConnection(JmxInfinispanChannelStatistics annotation) throws MalformedURLException {
-        final String host;
-        final int port;
-
-        if (annotation.dc() != DC.UNDEFINED && annotation.dcNodeIndex() != -1) {
-            ContainerInfo node = suiteContext.get().getAuthServerBackendsInfo(annotation.dc().getDcIndex()).get(annotation.dcNodeIndex());
-            Container container = node.getArquillianContainer();
-            if (container.getDeployableContainer() instanceof KeycloakOnUndertow) {
-                return () -> ManagementFactory.getPlatformMBeanServer();
-            }
-            host = "localhost";
-            port = container.getContainerConfiguration().getContainerProperties().containsKey("managementPort")
-              ? Integer.valueOf(container.getContainerConfiguration().getContainerProperties().get("managementPort"))
-              : 9990;
-        } else {
-            Container container = suiteContext.get().getCacheServersInfo().get(0).getArquillianContainer();
-            if (container.getDeployableContainer() instanceof InfinispanServerDeployableContainer) {
-                // jmx connection to infinispan server
-                return () -> {
-                    try {
-                        return jmxConnectorRegistry.get().getConnection(
-                                ((InfinispanServerDeployableContainer) container.getDeployableContainer()).getJMXServiceURL()
-                        ).getMBeanServerConnection();
-                    } catch (IOException ex) {
-                        throw new RuntimeException(ex);
-                    }
-                };
-            }
-            host = annotation.host().isEmpty()
-              ? System.getProperty((annotation.hostProperty().isEmpty()
-                ? "keycloak.connectionsInfinispan.remoteStoreServer"
-                : annotation.hostProperty()))
-              : annotation.host();
-
-            port = annotation.managementPort() == -1
-              ? Integer.valueOf(System.getProperty((annotation.managementPortProperty().isEmpty()
-                ? "cache.server.management.port"
-                : annotation.managementPortProperty())))
-              : annotation.managementPort();
-        }
-
-        JMXServiceURL url = new JMXServiceURL("service:jmx:remote+http://" + host + ":" + port);
-        return () -> {
-            try {
-                return jmxConnectorRegistry.get().getConnection(url).getMBeanServerConnection();
-            } catch (IOException ex) {
-                throw new RuntimeException(ex);
-            }
-        };
-    }
-
-    private static abstract class CacheStatisticsImpl implements InfinispanStatistics {
-
-        private final Supplier<MBeanServerConnection> mbscCreateor;
-        private final List<ObjectName> mbeanNameTemplates;
-        private ObjectName mbeanName;
-
-        public CacheStatisticsImpl(Supplier<MBeanServerConnection> mbscCreateor, ObjectName mbeanNameTemplate) {
-            this(mbscCreateor, Collections.singletonList(mbeanNameTemplate));
-        }
-
-        public CacheStatisticsImpl(Supplier<MBeanServerConnection> mbscCreateor, List<ObjectName> mbeanNameTemplates) {
-            this.mbscCreateor = mbscCreateor;
-            this.mbeanNameTemplates = mbeanNameTemplates;
-        }
-
-        protected MBeanServerConnection getConnection() {
-            return mbscCreateor.get();
-        }
-        
-        @Override
-        public boolean exists() {
-            try {
-                getMbeanName();
-                return true;
-            } catch (IOException | RuntimeException ex) {
-                return false;
-            }
-        }
-        
-        @Override
-        public Map<String, Object> getStatistics() {
-            try {
-                MBeanInfo mBeanInfo = getConnection().getMBeanInfo(getMbeanName());
-                String[] statAttrs = Arrays.asList(mBeanInfo.getAttributes()).stream()
-                  .filter(MBeanAttributeInfo::isReadable)
-                  .map(MBeanAttributeInfo::getName)
-                  .collect(Collectors.toList())
-                  .toArray(new String[] {});
-                return getConnection().getAttributes(getMbeanName(), statAttrs)
-                  .asList()
-                  .stream()
-                  .collect(Collectors.toMap(Attribute::getName, Attribute::getValue));
-            } catch (IOException | InstanceNotFoundException | ReflectionException | IntrospectionException ex) {
-                throw new RuntimeException(ex);
-            }
-        }
-
-        protected ObjectName getMbeanName() throws IOException, RuntimeException {
-            if (this.mbeanName == null) {
-                // Try all the mbeanName templates
-                for (ObjectName mbeanNameTemplate : this.mbeanNameTemplates) {
-                    Set<ObjectName> queryNames = getConnection().queryNames(mbeanNameTemplate, null);
-                    if (queryNames.isEmpty()) {
-                        LOG.infof("No MBean available for the template %s .", mbeanNameTemplate);
-                        continue;
-                    }
-                    this.mbeanName = queryNames.iterator().next();
-                    return this.mbeanName;
-                }
-
-                throw new RuntimeException("No MBean for any of the templates " + this.mbeanNameTemplates + " found at JMX server");
-            }
-
-            return this.mbeanName;
-        }
-
-        @Override
-        public Comparable getSingleStatistics(String statisticsName) {
-            try {
-                return (Comparable) getConnection().getAttribute(getMbeanName(), statisticsName);
-            } catch (IOException | InstanceNotFoundException | MBeanException | ReflectionException | AttributeNotFoundException ex) {
-                throw new RuntimeException(ex);
-            }
-        }
-
-        @Override
-        public void waitToBecomeAvailable(int time, TimeUnit unit) {
-            long timeInMillis = TimeUnit.MILLISECONDS.convert(time, unit);
-            Retry.execute(() -> {
-                try {
-                    getMbeanName();
-                    if (! isAvailable()) throw new RuntimeException("Not available");
-                } catch (IOException | RuntimeException ex) {
-                    throw new RuntimeException("Timed out while waiting for any of the mbean name templates " + this.mbeanNameTemplates + " to become available", ex);
-                }
-            }, 1 + (int) timeInMillis / 100, 100);
-        }
-
-        protected abstract boolean isAvailable();
-    }
-
-    private static class InfinispanCacheStatisticsImpl extends CacheStatisticsImpl {
-
-        public InfinispanCacheStatisticsImpl(Supplier<MBeanServerConnection> mbscCreator, List<ObjectName> mbeanNames) {
-            super(mbscCreator, mbeanNames);
-        }
-
-        @Override
-        public void reset() {
-            try {
-                getConnection().invoke(getMbeanName(), "resetStatistics", new Object[] {}, new String[] {});
-            } catch (IOException | InstanceNotFoundException | MBeanException | ReflectionException ex) {
-                throw new RuntimeException(ex);
-            }
-        }
-
-        @Override
-        protected boolean isAvailable() {
-            return getSingleStatistics(Constants.STAT_CACHE_HITS) != null;
-        }
-    }
-
-    private static class InfinispanChannelStatisticsImpl extends CacheStatisticsImpl {
-
-        public InfinispanChannelStatisticsImpl(Supplier<MBeanServerConnection> mbscCreator, ObjectName mbeanName) {
-            super(mbscCreator, mbeanName);
-        }
-
-        @Override
-        public void reset() {
-            try {
-                getConnection().invoke(getMbeanName(), "resetStats", new Object[] {}, new String[] {});
-            } catch (NotSerializableException | UnmarshalException ex) {
-                // Ignore return value not serializable, the invocation has already done its job
-            } catch (IOException | InstanceNotFoundException | MBeanException | ReflectionException ex) {
-                throw new RuntimeException(ex);
-            }
-        }
-
-        @Override
-        protected boolean isAvailable() {
-            return Objects.equals(getSingleStatistics(Constants.STAT_CHANNEL_CONNECTED), Boolean.TRUE);
-       }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CrossDCTestEnricher.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CrossDCTestEnricher.java
deleted file mode 100644
index 4550e682a6af..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/CrossDCTestEnricher.java
+++ /dev/null
@@ -1,438 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.arquillian;
-
-import org.apache.commons.io.FileUtils;
-import org.jboss.arquillian.container.spi.event.StopContainer;
-import org.jboss.arquillian.container.spi.event.StopSuiteContainers;
-import org.jboss.arquillian.container.test.api.ContainerController;
-import org.jboss.arquillian.core.api.Event;
-import org.jboss.arquillian.core.api.Instance;
-import org.jboss.arquillian.core.api.annotation.Inject;
-import org.jboss.arquillian.core.api.annotation.Observes;
-import org.jboss.arquillian.core.spi.Validate;
-import org.jboss.arquillian.test.spi.event.suite.After;
-import org.jboss.arquillian.test.spi.event.suite.AfterSuite;
-import org.jboss.arquillian.test.spi.event.suite.Before;
-import org.jboss.logging.Logger;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.models.Constants;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-import org.keycloak.testsuite.auth.page.AuthRealm;
-import org.keycloak.testsuite.client.KeycloakTestingClient;
-import org.keycloak.testsuite.crossdc.DC;
-import org.keycloak.testsuite.crossdc.ServerSetup;
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-
-import java.io.File;
-import java.io.IOException;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Consumer;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import java.util.stream.Stream;
-
-import static org.hamcrest.Matchers.lessThan;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- *
- * @author vramik
- */
-public class CrossDCTestEnricher {
-
-    protected static final Logger log = Logger.getLogger(CrossDCTestEnricher.class);
-    private static SuiteContext suiteContext;
-
-    @Inject
-    private static Instance<ContainerController> containerController;
-
-    @Inject
-    private Event<StopContainer> stopContainer;
-
-    private static final Map<ContainerInfo, Keycloak> backendAdminClients = new HashMap<>();
-    private static final Map<ContainerInfo, KeycloakTestingClient> backendTestingClients = new HashMap<>();
-
-    static void initializeSuiteContext(SuiteContext suiteContext) {
-        Validate.notNull(suiteContext, "Suite context cannot be null.");
-        CrossDCTestEnricher.suiteContext = suiteContext;
-
-        if (AuthServerTestEnricher.AUTH_SERVER_CROSS_DC && suiteContext.getCacheServersInfo().isEmpty() && !AuthServerTestEnricher.CACHE_SERVER_LIFECYCLE_SKIP) {
-            throw new IllegalStateException("Cache containers misconfiguration");
-        }
-    }
-
-    public void beforeTest(@Observes(precedence = -2) Before event) {
-        if (!suiteContext.isAuthServerCrossDc()) return;
-
-        //if annotation is present on method
-        InitialDcState annotation = event.getTestMethod().getAnnotation(InitialDcState.class);
-
-        //annotation not present on method, taking it from class
-        if (annotation == null) {
-            Class<?> annotatedClass = getNearestSuperclassWithAnnotation(event.getTestClass().getJavaClass(), InitialDcState.class);
-
-            annotation = annotatedClass == null ? null : annotatedClass.getAnnotation(InitialDcState.class);
-        }
-
-        if (annotation == null) {
-            log.debug("No environment preparation requested, not changing auth/cache server run status.");
-            return; // Test does not specify its environment, so it's on its own
-        }
-
-        ServerSetup cacheServers = annotation.cacheServers();
-        ServerSetup authServers = annotation.authServers();
-
-        // Stop auth servers that otherwise could be hang connecting to a cache server stopped next
-        switch (authServers) {
-            case ALL_NODES_IN_EVERY_DC:
-                break;
-            case FIRST_NODE_IN_EVERY_DC:
-                DC.validDcsStream().forEach((DC dc) -> stopAuthServerBackendNode(dc, 1));
-                break;
-
-            case FIRST_NODE_IN_FIRST_DC:
-                stopAuthServerBackendNode(DC.FIRST, 1);
-                forAllBackendNodesInDc(DC.SECOND, CrossDCTestEnricher::stopAuthServerBackendNode);
-                break;
-
-            case ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC:
-                stopAuthServerBackendNode(DC.SECOND, 1);
-                break;
-
-            case ALL_NODES_IN_FIRST_DC_NO_NODES_IN_SECOND_DC:
-                forAllBackendNodesInDc(DC.SECOND, CrossDCTestEnricher::stopAuthServerBackendNode);
-                break;
-        }
-
-        switch (cacheServers) {
-            case ALL_NODES_IN_EVERY_DC:
-            case FIRST_NODE_IN_EVERY_DC: //the same as ALL_NODES_IN_EVERY_DC as there is only one cache server per DC
-            case ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC:
-                DC.validDcsStream().forEach(CrossDCTestEnricher::startCacheServer);
-                break;
-
-            case FIRST_NODE_IN_FIRST_DC:
-            case ALL_NODES_IN_FIRST_DC_NO_NODES_IN_SECOND_DC:
-                startCacheServer(DC.FIRST);
-                stopCacheServer(DC.SECOND);
-                break;
-        }
-
-        switch (authServers) {
-            case ALL_NODES_IN_EVERY_DC:
-                forAllBackendNodes(CrossDCTestEnricher::startAuthServerBackendNode);
-                break;
-            case FIRST_NODE_IN_EVERY_DC:
-                DC.validDcsStream().forEach((DC dc) -> startAuthServerBackendNode(dc, 0));
-                break;
-
-            case FIRST_NODE_IN_FIRST_DC:
-                startAuthServerBackendNode(DC.FIRST, 0);
-                break;
-
-            case ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC:
-                forAllBackendNodesInDc(DC.FIRST, CrossDCTestEnricher::startAuthServerBackendNode);
-                startAuthServerBackendNode(DC.SECOND, 0);
-                break;
-
-            case ALL_NODES_IN_FIRST_DC_NO_NODES_IN_SECOND_DC:
-                forAllBackendNodesInDc(DC.FIRST, CrossDCTestEnricher::startAuthServerBackendNode);
-                break;
-        }
-
-        suspendPeriodicTasks();
-    }
-
-    public void afterTest(@Observes After event) {
-        if (!suiteContext.isAuthServerCrossDc()) return;
-
-        restorePeriodicTasks();
-    }
-
-    public void afterSuite(@Observes(precedence = 4) AfterSuite event) {
-        if (!suiteContext.isAuthServerCrossDc()) return;
-
-        // Unfortunately, in AfterSuite, containerController context is already cleaned so stopAuthServerBackendNode()
-        // and stopCacheServer cannot be used. On the other hand, Arquillian by default does not guarantee that cache
-        // servers are terminated only after auth servers were, so the termination has to be done in this enricher.
-
-        forAllBackendNodesStream()
-          .map(ContainerInfo::getArquillianContainer)
-          .map(StopContainer::new)
-          .forEach(stopContainer::fire);
-
-        if (!AuthServerTestEnricher.CACHE_SERVER_LIFECYCLE_SKIP) {
-            DC.validDcsStream()
-                    .map(CrossDCTestEnricher::getCacheServer)
-                    .map(ContainerInfo::getArquillianContainer)
-                    .map(StopContainer::new)
-                    .forEach(stopContainer::fire);
-        }
-    }
-
-    public void stopSuiteContainers(@Observes(precedence = 4) StopSuiteContainers event) {
-        if (!suiteContext.isAuthServerCrossDc()) return;
-
-        forAllBackendNodes(CrossDCTestEnricher::stopAuthServerBackendNode);
-        DC.validDcsStream().forEach(CrossDCTestEnricher::stopCacheServer);
-    }
-
-    private static void createRESTClientsForNode(ContainerInfo node) {
-        if (!backendAdminClients.containsKey(node)) {
-            backendAdminClients.put(node, createAdminClientFor(node));
-        }
-
-        if (!backendTestingClients.containsKey(node)) {
-            backendTestingClients.put(node, createTestingClientFor(node));
-        }
-    }
-
-    private static void removeRESTClientsForNode(ContainerInfo node) {
-        if (backendAdminClients.containsKey(node)) {
-            backendAdminClients.get(node).close();
-            backendAdminClients.remove(node);
-        }
-
-        if (backendTestingClients.containsKey(node)) {
-            backendTestingClients.get(node).close();
-            backendTestingClients.remove(node);
-        }
-    }
-
-    public static Map<ContainerInfo, Keycloak> getBackendAdminClients() {
-        return Collections.unmodifiableMap(backendAdminClients);
-    }
-
-    public static Map<ContainerInfo, KeycloakTestingClient> getBackendTestingClients() {
-        return Collections.unmodifiableMap(backendTestingClients);
-    }
-
-    private static Keycloak createAdminClientFor(ContainerInfo node) {
-        log.info("--DC: Initializing admin client for " + node.getContextRoot() + "/auth");
-        return Keycloak.getInstance(node.getContextRoot() + "/auth", AuthRealm.MASTER, AuthRealm.ADMIN, AuthRealm.ADMIN, Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS());
-    }
-
-    private static KeycloakTestingClient createTestingClientFor(ContainerInfo node) {
-        log.info("--DC: Initializing testing client for " + node.getContextRoot() + "/auth");
-        return KeycloakTestingClient.getInstance(node.getContextRoot() + "/auth");
-    }
-    // Disable periodic tasks in cross-dc tests. It's needed to have some scenarios more stable.
-
-    private static void suspendPeriodicTasks() {
-        log.debug("--DC: suspendPeriodicTasks");
-        backendTestingClients.values().stream().forEach((KeycloakTestingClient testingClient) -> {
-            testingClient.testing().suspendPeriodicTasks();
-        });
-    }
-
-    private static void restorePeriodicTasks() {
-        log.debug("--DC: restorePeriodicTasks");
-        backendTestingClients.values().stream().forEach((KeycloakTestingClient testingClient) -> {
-            testingClient.testing().restorePeriodicTasks();
-        });
-    }
-
-    /**
-     * Returns cache server corresponding to given DC
-     * @param dc
-     * @return
-     */
-    private static ContainerInfo getCacheServer(DC dc) {
-        assertValidDc(dc);
-        int dcIndex = dc.ordinal();
-        return suiteContext.getCacheServersInfo().get(dcIndex);
-    }
-
-    private static void assertValidDc(DC dc) throws IllegalStateException {
-        if (dc == DC.UNDEFINED) {
-            throw new IllegalStateException("Invalid DC used: " + DC.UNDEFINED);
-        }
-    }
-
-    /* Code to detect if underlying JVM is modular (AKA JDK 9+) taken over from Wildfly Core code base:
-     * https://github.com/wildfly/wildfly-core/blob/main/launcher/src/main/java/org/wildfly/core/launcher/Jvm.java#L59
-     * and turned into a function for easier reuse.
-     */
-    public static boolean isModularJvm() {
-        boolean modularJvm = false;
-        final String javaSpecVersion = System.getProperty("java.specification.version");
-        if (javaSpecVersion != null) {
-            final Matcher matcher = Pattern.compile("^(?:1\\.)?(\\d+)$").matcher(javaSpecVersion);
-            if (matcher.find()) modularJvm = Integer.parseInt(matcher.group(1)) >= 9;
-        }
-        return modularJvm;
-    }
-
-    public static void startCacheServer(DC dc) {
-        if (AuthServerTestEnricher.CACHE_SERVER_LIFECYCLE_SKIP) return;
-
-        if (!containerController.get().isStarted(getCacheServer(dc).getQualifier())) {
-            log.infof("--DC: Starting %s", getCacheServer(dc).getQualifier());
-            // Original config of the cache server container as a map
-            Map<String, String> containerConfig = getCacheServer(dc).getProperties();
-
-            // Start cache server with default modular JVM options set if JDK is modular (JDK 9+)
-            final String defaultModularJvmOptions = System.getProperty("default.modular.jvm.options");
-            final String originalJvmArguments = getCacheServer(dc).getProperties().get("javaVmArguments");
-            /* When JVM used to launch the cache server container is modular, add the default
-             * modular JVM options to the configuration of the cache server container if
-             * these aren't present there yet.
-             *
-             * See the definition of the 'default.modular.jvm.options' property for details.
-             */
-            if (!originalJvmArguments.contains(defaultModularJvmOptions)) {
-                if(isModularJvm() && defaultModularJvmOptions != null) {
-                    log.infof("Modular JVM detected. Adding default modular JVM '%s' options to the cache server container's configuration.", defaultModularJvmOptions);
-                    final String lineSeparator = System.getProperty("line.separator");
-                    final String adjustedJvmArguments = originalJvmArguments.replace(lineSeparator, " ") + defaultModularJvmOptions + lineSeparator;
-
-                    /* Since next time the cache server container might get started using a non-modular
-                    * JVM again, don't store the default modular JVM options into the cache server container's
-                    * configuration permanently (not to need to remove them again later).
-                    *
-                    * Rather, instead of that, retrieve the original cache server container's configuration
-                    * as a map, add the default modular JVM options there, and one-time way start the cache server
-                    * using this custom temporary configuration.
-                    */
-                    containerConfig.put("javaVmArguments", adjustedJvmArguments);
-                }
-            }
-            /* Finally start the cache server container:
-             * - Either using the original container config (case of a non-modular JVM),
-             * - Or using the updated container config (case of a modular JVM)
-             */
-            containerController.get().start(getCacheServer(dc).getQualifier(), containerConfig);
-            log.infof("--DC: Started %s", getCacheServer(dc).getQualifier());
-        }
-    }
-
-    public static void stopCacheServer(DC dc) {
-        if (AuthServerTestEnricher.CACHE_SERVER_LIFECYCLE_SKIP) return;
-
-        String qualifier = getCacheServer(dc).getQualifier();
-
-        if (containerController.get().isStarted(qualifier)) {
-            log.infof("--DC: Stopping %s", qualifier);
-
-            containerController.get().stop(qualifier);
-
-            // Workaround for possible arquillian bug. Needs to cleanup dir manually
-            String setupCleanServerBaseDir = getContainerProperty(getCacheServer(dc), "setupCleanServerBaseDir");
-            String cleanServerBaseDir = getContainerProperty(getCacheServer(dc), "cleanServerBaseDir");
-
-            if (Boolean.parseBoolean(setupCleanServerBaseDir)) {
-                log.debugf("Going to clean directory: %s", cleanServerBaseDir);
-
-                File dir = new File(cleanServerBaseDir);
-                if (dir.exists()) {
-                    try {
-                        dir.renameTo(new File(dir.getParentFile(), dir.getName() + "-backup-" + System.currentTimeMillis()));
-
-                        File deploymentsDir = new File(dir, "deployments");
-                        FileUtils.forceMkdir(deploymentsDir);
-                    } catch (IOException ioe) {
-                        throw new RuntimeException("Failed to clean directory: " + cleanServerBaseDir, ioe);
-                    }
-                }
-            }
-
-            log.infof("--DC: Stopped %s", qualifier);
-        }
-    }
-
-    public static void forAllBackendNodes(Consumer<ContainerInfo> functionOnContainerInfo) {
-        forAllBackendNodesStream()
-          .forEach(functionOnContainerInfo);
-    }
-
-    public static Stream<ContainerInfo> forAllBackendNodesStream() {
-        return suiteContext.getDcAuthServerBackendsInfo().stream()
-          .flatMap(Collection::stream);
-    }
-
-    public static void forAllBackendNodesInDc(DC dc, Consumer<ContainerInfo> functionOnContainerInfo) {
-        assertValidDc(dc);
-        suiteContext.getDcAuthServerBackendsInfo().get(dc.ordinal()).stream()
-          .forEach(functionOnContainerInfo);
-    }
-
-    public static void stopAuthServerBackendNode(ContainerInfo containerInfo) {
-        if (containerInfo.isStarted()) {
-            log.infof("--DC: Stopping backend auth-server node: %s", containerInfo.getQualifier());
-            removeRESTClientsForNode(containerInfo);
-            containerController.get().stop(containerInfo.getQualifier());
-        }
-    }
-
-    public static void startAuthServerBackendNode(ContainerInfo containerInfo) {
-        if (! containerInfo.isStarted()) {
-            log.infof("--DC: Starting backend auth-server node: %s", containerInfo.getQualifier());
-            containerController.get().start(containerInfo.getQualifier());
-            // Cross-DC are not working with Quarkus
-            //AuthServerTestEnricher.initializeTLS(containerInfo);
-            createRESTClientsForNode(containerInfo);
-        }
-    }
-
-    public static ContainerInfo getBackendNode(DC dc, int nodeIndex) {
-        assertValidDc(dc);
-        int dcIndex = dc.ordinal();
-        assertThat((Integer) dcIndex, lessThan(suiteContext.getDcAuthServerBackendsInfo().size()));
-        final List<ContainerInfo> dcNodes = suiteContext.getDcAuthServerBackendsInfo().get(dcIndex);
-        assertThat((Integer) nodeIndex, lessThan(dcNodes.size()));
-        return dcNodes.get(nodeIndex);
-    }
-
-    /**
-     * Starts a manually-controlled backend auth-server node in cross-DC scenario.
-     * @param dc
-     * @param nodeIndex
-     * @return Started instance descriptor.
-     */
-    public static ContainerInfo startAuthServerBackendNode(DC dc, int nodeIndex) {
-        ContainerInfo dcNode = getBackendNode(dc, nodeIndex);
-        startAuthServerBackendNode(dcNode);
-        return dcNode;
-    }
-
-    /**
-     * Stops a manually-controlled backend auth-server node in cross-DC scenario.
-     * @param dc
-     * @param nodeIndex
-     * @return Stopped instance descriptor.
-     */
-    public static ContainerInfo stopAuthServerBackendNode(DC dc, int nodeIndex) {
-        ContainerInfo dcNode = getBackendNode(dc, nodeIndex);
-        stopAuthServerBackendNode(dcNode);
-        return dcNode;
-    }
-
-    private Class getNearestSuperclassWithAnnotation(Class<?> testClass, Class annotationClass) {
-        return (testClass.isAnnotationPresent(annotationClass)) ? testClass
-                : (testClass.getSuperclass().equals(Object.class) ? null // stop recursion
-                : getNearestSuperclassWithAnnotation(testClass.getSuperclass(), annotationClass)); // continue recursion
-    }
-
-    private static String getContainerProperty(ContainerInfo cacheServer, String propertyName) {
-        return cacheServer.getArquillianContainer().getContainerConfiguration().getContainerProperties().get(propertyName);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/KeycloakArquillianExtension.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/KeycloakArquillianExtension.java
index 217c0a65e2a0..0a6aedae30f7 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/KeycloakArquillianExtension.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/KeycloakArquillianExtension.java
@@ -23,7 +23,6 @@
 import org.jboss.arquillian.core.spi.LoadableExtension;
 import org.jboss.arquillian.graphene.location.ContainerCustomizableURLResourceProvider;
 import org.jboss.arquillian.graphene.location.CustomizableURLResourceProvider;
-import org.jboss.arquillian.test.spi.TestEnricher;
 import org.jboss.arquillian.test.spi.enricher.resource.ResourceProvider;
 import org.jboss.arquillian.test.spi.execution.TestExecutionDecider;
 import org.keycloak.testsuite.arquillian.decider.BrowserDriverIgnoreDecider;
@@ -61,11 +60,9 @@ public void register(ExtensionBuilder builder) {
         builder
                 .service(DeploymentScenarioGenerator.class, DeploymentTargetModifier.class)
                 .service(ApplicationArchiveProcessor.class, DeploymentArchiveProcessor.class)
-                .service(TestEnricher.class, CacheStatisticsControllerEnricher.class)
                 .observer(JmxConnectorRegistryCreator.class)
                 .observer(AuthServerTestEnricher.class)
                 .observer(AppServerTestEnricher.class)
-                .observer(CrossDCTestEnricher.class)
                 .observer(H2TestEnricher.class);
         builder
                 .service(TestExecutionDecider.class, MigrationTestExecutionDecider.class)
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/SuiteContext.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/SuiteContext.java
index 8c0958ff37da..6bdf2465ce82 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/SuiteContext.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/SuiteContext.java
@@ -178,10 +178,6 @@ public boolean isAuthServerCluster() {
         return ! authServerBackendsInfo.isEmpty();
     }
 
-    public boolean isAuthServerCrossDc() {
-        return authServerBackendsInfo.size() > 1;
-    }
-
     /**
      * @return true during migration test, but just right before and during old container running. It returns false during lifecycle of new container running
      * and during migration test itself. Use {@link #getMigrationContext().isRunningMigrationTest()} if want to check if we are in the context of migration (including lifecycle of the new container)
@@ -202,21 +198,7 @@ public boolean isAdapterCompatTesting() {
     public String toString() {
         StringBuilder sb = new StringBuilder("SUITE CONTEXT:\nAuth server: ");
 
-        if (isAuthServerCrossDc()) {
-            for (int i = 0; i < authServerInfo.size(); i ++) {
-                ContainerInfo frontend = this.authServerInfo.get(i);
-                sb.append("\nFrontend (dc=").append(i).append("): ").append(frontend.getQualifier()).append("\n");
-            }
-
-            for (int i = 0; i < authServerBackendsInfo.size(); i ++) {
-                int dcIndex = i;
-                getDcAuthServerBackendsInfo().get(i).forEach(bInfo -> sb.append("Backend (dc=").append(dcIndex).append("): ").append(bInfo).append("\n"));
-            }
-
-            for (int dcIndex=0 ; dcIndex<cacheServersInfo.size() ; dcIndex++) {
-                sb.append("CacheServer (dc=").append(dcIndex).append("): ").append(getCacheServersInfo().get(dcIndex)).append("\n");
-            }
-        } else if (isAuthServerCluster()) {
+        if (isAuthServerCluster()) {
             sb.append(isAuthServerCluster() ? "\nFrontend: " : "")
               .append(getAuthServerInfo().getQualifier()).append(" - ").append(getAuthServerInfo().getContextRoot().toExternalForm())
               .append("\n");
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/TestContext.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/TestContext.java
index 9e510333733b..7e68a5a6a294 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/TestContext.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/TestContext.java
@@ -18,6 +18,7 @@
 
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -51,6 +52,7 @@ public final class TestContext {
     private Keycloak adminClient;
     private KeycloakTestingClient testingClient;
     private List<RealmRepresentation> testRealmReps = new ArrayList<>();
+    private Map<String, String> userPasswords = new HashMap<>();
 
     // Track if particular test was initialized. What exactly means "initialized" is test dependent (Eg. some user in @Before method was created, so we can set initialized to true
     // to avoid creating user when @Before method is executed for 2nd time)
@@ -179,6 +181,14 @@ public void addTestRealmsToTestRealmReps(List<RealmRepresentation> testRealmReps
         this.testRealmReps.addAll(testRealmReps);
     }
 
+    public Map<String, String> getUserPasswords() {
+        return userPasswords;
+    }
+
+    public void setUserPasswords(Map<String, String> userPasswords) {
+        this.userPasswords = userPasswords;
+    }
+
     public boolean isInitialized() {
         return initialized;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/IgnoreBrowserDriver.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/IgnoreBrowserDriver.java
index 897675c686e3..933e68a28f02 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/IgnoreBrowserDriver.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/IgnoreBrowserDriver.java
@@ -39,15 +39,17 @@
 public @interface IgnoreBrowserDriver {
 
     /**
-     * Define for which WebDriver the test method/class should be ignored
+     * Define for which WebDrivers the test method/class should be ignored
+     * @return
      */
-    Class<? extends WebDriver> value();
+    Class<? extends WebDriver>[] value();
 
     /**
      * Define whether the value should be negated
      *
-     * Usable in cases when we want to execute test method/class with all WebDrivers except the one specified in value()
+     * Usable in cases when we want to execute test method/class with all WebDrivers except the ones specified in value()
+     * @return
      */
     boolean negate() default false;
 
-}
\ No newline at end of file
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/InitialDcState.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/InitialDcState.java
deleted file mode 100644
index 49e177a766d1..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/InitialDcState.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright 201 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.arquillian.annotation;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.Target;
-
-import org.keycloak.testsuite.crossdc.ServerSetup;
-
-import static java.lang.annotation.RetentionPolicy.RUNTIME;
-
-/**
- * Specifies initial state of auth-server and cache-server nodes before start of each test
- * in multinode setup like in cross-DC tests.
- * When a test class is annotated, this annotation is applied to every test method in the class
- * but can be overridden on method level.
- * 
- * @author vramik
- * @author hmlnarik
- */
-@Documented
-@Retention(RUNTIME)
-@Target({ElementType.TYPE, ElementType.METHOD})
-public @interface InitialDcState {
-    ServerSetup cacheServers() default ServerSetup.FIRST_NODE_IN_EVERY_DC;
-    ServerSetup authServers() default ServerSetup.FIRST_NODE_IN_EVERY_DC;
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanCacheStatistics.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanCacheStatistics.java
deleted file mode 100644
index ef15acf9ea07..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanCacheStatistics.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.arquillian.annotation;
-
-import org.keycloak.testsuite.arquillian.AuthServerTestEnricher;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics.Constants;
-import org.keycloak.testsuite.crossdc.DC;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * Annotation for a field / method parameter annotating {@link InfinispanStatistics} object that would be used
- * to access statistics via JMX. By default, the access to "work" cache at remote infinispan / JDG server is requested
- * yet the same annotation is used for other caches as well.
- *
- * @author hmlnarik
- */
-@Retention(RetentionPolicy.RUNTIME)
-@Target({ElementType.FIELD, ElementType.PARAMETER})
-public @interface JmxInfinispanCacheStatistics {
-
-    /** JMX domain. Should be set to default (@{code ""}) if the node to get the statistics from should be obtained from {@link #dcIndex()} and {@link #dcNodeIndex()}. */
-    String domain() default "";
-
-    // JMX address properties
-    String type() default Constants.TYPE_CACHE;
-    String cacheName() default "work";
-    String cacheMode() default "*";
-    String cacheManagerName() default "*";
-    String component() default Constants.COMPONENT_STATISTICS;
-
-    // Host address - either given by arrangement of DC ...
-
-    /** Index of the data center, starting from 0 */
-    DC dc() default DC.UNDEFINED;
-    /** Index of the node within data center, starting from 0. Nodes are ordered by arquillian qualifier as per {@link AuthServerTestEnricher} */
-    int dcNodeIndex() default -1;
-
-    // ... or by specific host/port
-
-    /** Port for management */
-    int managementPort() default -1;
-    /** Name of system property to obtain management port from */
-    String managementPortProperty() default "";
-    /** Host name to connect to */
-    String host() default "";
-    /** Name of system property to obtain host name from */
-    String hostProperty() default "";
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanChannelStatistics.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanChannelStatistics.java
deleted file mode 100644
index cddb8158f1d2..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/annotation/JmxInfinispanChannelStatistics.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.arquillian.annotation;
-
-import org.keycloak.testsuite.arquillian.InfinispanStatistics.Constants;
-import org.keycloak.testsuite.crossdc.DC;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- *
- * @author hmlnarik
- */
-@Retention(RetentionPolicy.RUNTIME)
-@Target({ElementType.FIELD, ElementType.PARAMETER})
-public @interface JmxInfinispanChannelStatistics {
-
-    /** JMX domain. Should be set to default (@{code ""}) if the node to get the statistics from should be obtained from {@link #dcIndex()} and {@link #dcNodeIndex()}. */
-    String domain() default "";
-
-    // JMX address properties
-    String type() default Constants.TYPE_CHANNEL;
-    String cluster() default "*";
-
-    // Host address - either given by arrangement of DC ...
-
-    /** Index of the data center, starting from 0 */
-    DC dc() default DC.UNDEFINED;
-    /** Index of the node within data center, starting from 0. Nodes are ordered by arquillian qualifier as per {@link AuthServerTestEnricher} */
-    int dcNodeIndex() default -1;
-
-    /** Port for management */
-    int managementPort() default -1;
-    /** Name of system property to obtain management port from */
-    String managementPortProperty() default "";
-    /** Host name to connect to */
-    String host() default "";
-    /** Name of system property to obtain host name from */
-    String hostProperty() default "";
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java
index 2e857b722fc6..4823ef08368b 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/AbstractQuarkusDeployableContainer.java
@@ -44,7 +44,6 @@
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.X509TrustManager;
@@ -66,6 +65,7 @@
 import org.keycloak.common.crypto.FipsMode;
 import org.keycloak.testsuite.ProfileAssume;
 import org.keycloak.testsuite.arquillian.SuiteContext;
+import org.keycloak.testsuite.auth.page.AuthRealm;
 import org.keycloak.testsuite.model.StoreProvider;
 import org.keycloak.utils.StringUtil;
 
@@ -80,7 +80,7 @@ public abstract class AbstractQuarkusDeployableContainer implements DeployableCo
 
     protected KeycloakQuarkusConfiguration configuration;
     protected List<String> additionalBuildArgs = Collections.emptyList();
-    protected Map<String, List<String>> spis = new HashMap<String, List<String>>();
+    protected Map<String, List<String>> spis = new HashMap<>();
 
     @Override
     public Class<KeycloakQuarkusConfiguration> getConfigurationClass() {
@@ -134,7 +134,7 @@ public void deploy(Descriptor descriptor) throws DeploymentException {
     }
 
     @Override
-    public void undeploy(Descriptor descriptor) throws DeploymentException {
+    public void undeploy(Descriptor descriptor) {
 
     }
 
@@ -168,13 +168,12 @@ protected List<String> getArgs(Map<String, String> env) {
 
         commands.add("--http-port=" + configuration.getBindHttpPort());
         commands.add("--https-port=" + configuration.getBindHttpsPort());
-        
+
         commands.add("--http-relative-path=/auth");
         commands.add("--health-enabled=true"); // expose something to management interface to turn it on
 
         if (suiteContext.get().isAuthServerMigrationEnabled()) {
             commands.add("--hostname-strict=false");
-            commands.add("--hostname-strict-https=false");
         } else { // Do not set management port for older versions of Keycloak for migration tests - available since Keycloak 25
             commands.add("--http-management-port=" + configuration.getManagementPort());
         }
@@ -184,7 +183,7 @@ protected List<String> getArgs(Map<String, String> env) {
         }
 
         if (configuration.getRoute() != null) {
-            commands.add("-Djboss.node.name=" + configuration.getRoute());
+            commands.add("--spi-cache-embedded-default-node-name=" + configuration.getRoute());
         }
 
         if (System.getProperty("auth.server.quarkus.log-level") != null) {
@@ -211,8 +210,9 @@ protected List<String> getArgs(Map<String, String> env) {
             commands.add("--cache-config-file=cluster-" + cacheMode + ".xml");
 
             var stack = System.getProperty("auth.server.quarkus.cluster.stack");
-            if (stack != null)
+            if (stack != null) {
                 commands.add("--cache-stack=" + stack);
+            }
         }
 
         log.debugf("FIPS Mode: %s", configuration.getFipsMode());
@@ -223,7 +223,7 @@ protected List<String> getArgs(Map<String, String> env) {
 
         addStorageOptions(storeProvider, commands);
         addFeaturesOption(commands);
-        
+
         spis.values().forEach(commands::addAll);
 
         var features = getDefaultFeatures();
@@ -232,18 +232,23 @@ protected List<String> getArgs(Map<String, String> env) {
             commands.add("--cache-remote-username=keycloak");
             commands.add("--cache-remote-password=Password1!");
             commands.add("--cache-remote-tls-enabled=false");
-            commands.add("--spi-connections-infinispan-quarkus-site-name=test");
+            commands.add("--spi-cache-embedded-default-site-name=test");
             configuration.appendJavaOpts("-Dkc.cache-remote-create-caches=true");
             System.setProperty("kc.cache-remote-create-caches", "true");
         }
 
+        if (!suiteContext.get().isAuthServerMigrationEnabled()) {
+            commands.add("--bootstrap-admin-username=" + AuthRealm.ADMIN);
+            commands.add("--bootstrap-admin-password=" + AuthRealm.ADMIN);
+        }
+
         return commands;
     }
 
     protected void addFeaturesOption(List<String> commands) {
         String enabledFeatures = Optional.ofNullable(configuration.getEnabledFeatures()).orElse("");
         String disabledFeatures = Optional.ofNullable(configuration.getDisabledFeatures()).orElse("");
-        
+
         var disabled = ProfileAssume.getDisabledFeatures();
         // TODO: this is not ideal, we're trying to infer what should be enabled / disabled from what was captured
         // as the disabled features. This at least does not understand the profile and may not age well.
@@ -360,8 +365,8 @@ protected void waitForReadiness() throws Exception {
                 }
 
                 connection.disconnect();
-            } catch (Exception ignore) {
-                e = ignore;
+            } catch (Exception exception) {
+                e = exception;
             }
         }
 
@@ -383,22 +388,20 @@ private URL getBaseUrl(SuiteContext suiteContext) throws MalformedURLException {
     }
 
     private HostnameVerifier createInsecureHostnameVerifier() {
-        return new HostnameVerifier() {
-            @Override
-            public boolean verify(String s, SSLSession sslSession) {
-                return true;
-            }
-        };
+        return (s, sslSession) -> true;
     }
 
     private SSLSocketFactory createInsecureSslSocketFactory() throws IOException {
         TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
+            @Override
             public void checkClientTrusted(final X509Certificate[] chain, final String authType) {
             }
 
+            @Override
             public void checkServerTrusted(final X509Certificate[] chain, final String authType) {
             }
 
+            @Override
             public X509Certificate[] getAcceptedIssuers() {
                 return null;
             }
@@ -463,7 +466,7 @@ private Collection<String> getDefaultFeatures() {
     public void setSpiConfig(String spi, List<String> args) {
         this.spis.put(spi, args);
     }
-    
+
     public void removeSpiConfig(String spi) {
         this.spis.remove(spi);
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/KeycloakQuarkusServerDeployableContainer.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/KeycloakQuarkusServerDeployableContainer.java
index 29b93e007966..657845023d33 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/KeycloakQuarkusServerDeployableContainer.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/containers/KeycloakQuarkusServerDeployableContainer.java
@@ -117,7 +117,9 @@ private void importRealm() throws IOException, URISyntaxException {
             log.infof("Importing realm from file '%s'", importFileName);
 
             final URL url = getClass().getResource("/migration-test/" + importFileName);
-            if (url == null) throw new IllegalArgumentException("Cannot find migration import file");
+            if (url == null) {
+                throw new IllegalArgumentException("Cannot find migration import file");
+            }
 
             final Path path = Paths.get(url.toURI());
             final File wrkDir = configuration.getProvidersPath().resolve("bin").toFile();
@@ -166,11 +168,6 @@ private Process startContainer() throws IOException {
             builder.environment().put("JAVA_OPTS", javaOpts);
         }
 
-        if (!StoreProvider.JPA.equals(StoreProvider.getCurrentProvider())) {
-            builder.environment().put("KC_BOOTSTRAP_ADMIN_USERNAME", "admin");
-            builder.environment().put("KC_BOOTSTRAP_ADMIN_PASSWORD", "admin");
-        }
-
         if (restart.compareAndSet(false, true)) {
             deleteDirectory(configuration.getProvidersPath().resolve("data"));
         }
@@ -245,6 +242,7 @@ private void destroyDescendantsOnWindows(Process parent, boolean force) {
     public static void deleteDirectory(final Path directory) throws IOException {
         if (Files.isDirectory(directory, new LinkOption[0])) {
             Files.walkFileTree(directory, new SimpleFileVisitor<Path>() {
+                @Override
                 public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException {
                     try {
                         Files.delete(file);
@@ -254,6 +252,7 @@ public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IO
                     return FileVisitResult.CONTINUE;
                 }
 
+                @Override
                 public FileVisitResult postVisitDirectory(Path dir, IOException exc) throws IOException {
                     try {
                         Files.delete(dir);
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/decider/BrowserDriverIgnoreDecider.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/decider/BrowserDriverIgnoreDecider.java
index 99b2953a4f6c..beca9f6c140b 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/decider/BrowserDriverIgnoreDecider.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/decider/BrowserDriverIgnoreDecider.java
@@ -68,7 +68,7 @@ private ExecutionDecision decideIgnoring(AnnotatedElement element) {
         final WebDriver webDriver = driver.get();
 
         Predicate<IgnoreBrowserDriver> shouldBeIgnored = (item) -> {
-            return webDriver != null && (isDriverInstanceOf(webDriver, item.value()) ^ item.negate());
+            return webDriver != null && (isPresent(webDriver, item.value()) ^ item.negate());
         };
 
         return Arrays.stream(element.getAnnotationsByType(IgnoreBrowserDriver.class))
@@ -78,6 +78,13 @@ private ExecutionDecision decideIgnoring(AnnotatedElement element) {
                 .orElse(ExecutionDecision.execute());
     }
 
+    private boolean isPresent(WebDriver webDriver, Class<? extends WebDriver>[] items) {
+        if (items == null) {
+            return false;
+        }
+        return Arrays.stream(items).filter(item -> isDriverInstanceOf(webDriver, item)).findAny().isPresent();
+    }
+
     @Override
     public int precedence() {
         return Integer.MIN_VALUE;
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/migration/MigrationContext.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/migration/MigrationContext.java
index a5e45dcd9657..29b18a2f86cb 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/migration/MigrationContext.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/migration/MigrationContext.java
@@ -24,10 +24,14 @@
 import java.io.PrintWriter;
 import java.nio.charset.StandardCharsets;
 
+import org.apache.http.impl.client.CloseableHttpClient;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.common.util.StreamUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.HttpClientUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.HttpClientManager;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -73,13 +77,13 @@ public void runPreMigrationTask() throws Exception {
 
     private String requestOfflineToken() {
         logger.info("Requesting offline token on the old container");
-        try {
-            OAuthClient oauth = new OAuthClient();
-            oauth.init(null);
+        try (CloseableHttpClient httpClient = HttpClientUtils.createDefault()) {
+            OAuthClient oauth = new OAuthClient(httpClient, null);
+            oauth.init();
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
             oauth.realm("Migration");
-            oauth.clientId("migration-test-client");
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret", "offline-test-user", "password2");
+            oauth.client("migration-test-client", "secret");
+            AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("offline-test-user", "password2");
             return tokenResponse.getRefreshToken();
         } catch (Exception e) {
             throw new RuntimeException(e);
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/provider/OAuthClientProvider.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/provider/OAuthClientProvider.java
index b51a3bdd7fde..263f1897aa8f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/provider/OAuthClientProvider.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/arquillian/provider/OAuthClientProvider.java
@@ -21,7 +21,7 @@
 import org.jboss.arquillian.core.api.annotation.Inject;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.jboss.arquillian.test.spi.enricher.resource.ResourceProvider;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import java.lang.annotation.Annotation;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/Login.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/Login.java
index ccd200691154..19de6a300f5f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/Login.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/Login.java
@@ -42,7 +42,7 @@ public void setProtocol(String protocol) {
         setUriParameter(PROTOCOL, protocol);
     }
     
-    public String getProtocol() {
+    private String getProtocol() {
         return getUriParameter(PROTOCOL).toString();
     }
     
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginError.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginError.java
deleted file mode 100644
index c1e9b4b91798..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginError.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.auth.page.login;
-
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-import static org.keycloak.testsuite.util.UIUtils.getTextFromElement;
-
-/**
- * @author Vaclav Muzikar <vmuzikar@redhat.com>
- */
-public class LoginError extends LoginBase {
-    @FindBy(xpath = "//div[@id='kc-error-message']/p[@class='instruction']")
-    private WebElement errorMessage;
-
-    @FindBy(id = "backToApplication")
-    private WebElement backToApplicationLink;
-
-    public String getErrorMessage() {
-        return getTextFromElement(errorMessage);
-    }
-
-    public void backToApplication() {
-        clickLink(backToApplicationLink);
-    }
-
-    @Override
-    public boolean isCurrent() {
-        return getTitleText().equals("We are sorry...");
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginForm.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginForm.java
index f21b04a953e3..5c5fba567c6f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginForm.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/LoginForm.java
@@ -34,6 +34,7 @@
  *
  * @author tkyjovsk
  */
+@Deprecated
 public class LoginForm extends Form {
 
     @Page
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/OTPSetup.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/OTPSetup.java
deleted file mode 100644
index f790515140cc..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/OTPSetup.java
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.auth.page.login;
-
-import org.jboss.arquillian.graphene.page.Page;
-import org.keycloak.models.UserModel;
-import org.openqa.selenium.NoSuchElementException;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-
-/**
- * @author Vaclav Muzikar <vmuzikar@redhat.com>
- */
-public class OTPSetup extends RequiredActions {
-    @Page
-    private LoginForm.TotpSetupForm form;
-
-    @FindBy(id = "kc-totp-secret-qr-code")
-    private WebElement barcodeImg;
-
-    @FindBy(id = "kc-totp-secret-key")
-    private WebElement secretKey;
-
-    @FindBy(id = "mode-manual")
-    private WebElement manualModeLink;
-
-    @FindBy(id = "mode-barcode")
-    private WebElement barcodeModeLink;
-
-    @FindBy(id = "kc-totp-type")
-    private WebElement otpType;
-
-    @FindBy(id = "kc-totp-algorithm")
-    private WebElement otpAlgorithm;
-
-    @FindBy(id = "kc-totp-digits")
-    private WebElement otpDigits;
-
-    @FindBy(id = "kc-totp-period")
-    private WebElement otpPeriod;
-
-    @FindBy(id = "kc-totp-counter")
-    private WebElement otpCounter;
-
-    public void setTotp(String value) {
-        form.setTotp(value);
-    }
-
-    public boolean isBarcodePresent() {
-        try {
-            return barcodeImg.isDisplayed();
-        }
-        catch (NoSuchElementException e) {
-            return false;
-        }
-    }
-
-    public String getSecretKey() {
-        return secretKey.getText().replace(" ", "");
-    }
-
-    public boolean isSecretKeyPresent() {
-        try {
-            return secretKey.isDisplayed();
-        }
-        catch (NoSuchElementException e) {
-            return false;
-        }
-    }
-
-    public void clickManualMode() {
-        clickLink(manualModeLink);
-    }
-
-    public void clickBarcodeMode() {
-        clickLink(barcodeModeLink);
-    }
-
-    public String getOtpType() {
-        return otpType.getText();
-    }
-
-    public String getOtpAlgorithm() {
-        return otpAlgorithm.getText();
-    }
-
-    public String getOtpDigits() {
-        return otpDigits.getText();
-    }
-
-    public String getOtpPeriod() {
-        return otpPeriod.getText();
-    }
-
-    public String getOtpCounter() {
-        return otpCounter.getText();
-    }
-
-    public void setUserLabel(String value) {
-        form.setUserLabel(value);
-    }
-
-    @Override
-    public String getActionId() {
-        return UserModel.RequiredAction.CONFIGURE_TOTP.name();
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/UpdateEmailPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/UpdateEmailPage.java
index f0d5dbb0f20a..7f2d4dd460fe 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/UpdateEmailPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/auth/page/login/UpdateEmailPage.java
@@ -83,8 +83,4 @@ public void clickSubmitAction() {
         clickLink(submitActionButton);
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java
index 888427dfef87..2b9111d4d192 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/KeycloakTestingClient.java
@@ -56,7 +56,7 @@ public class KeycloakTestingClient implements AutoCloseable {
     public static ResteasyClientBuilder getRestEasyClientBuilder(String serverUrl) {
         ResteasyClientBuilder resteasyClientBuilder = (ResteasyClientBuilder) ResteasyClientBuilder.newBuilder();
         resteasyClientBuilder.connectionPoolSize(10);
-        if (serverUrl.startsWith("https")) {
+        if ((serverUrl != null && serverUrl.startsWith("https")) || "true".equals(System.getProperty("auth.server.ssl.required"))) {
             // Disable PKIX path validation errors when running tests using SSL
             resteasyClientBuilder.disableTrustManager().hostnameVerification(ResteasyClientBuilder.HostnameVerificationPolicy.ANY);
         }
@@ -64,6 +64,10 @@ public static ResteasyClientBuilder getRestEasyClientBuilder(String serverUrl) {
         return resteasyClientBuilder;
     }
 
+    public static ResteasyClientBuilder getRestEasyClientBuilder() {
+        return getRestEasyClientBuilder(null);
+    }
+
     public static KeycloakTestingClient getInstance(String serverUrl) {
         return new KeycloakTestingClient(serverUrl, null);
     }
@@ -81,13 +85,29 @@ public TestingResource testing(String realm) {
     }
 
     public void enableFeature(Profile.Feature feature) {
-        Set<Profile.Feature> disabledFeatures = testing().enableFeature(feature.toString());
+        String featureString;
+        if (shouldUseVersionedKey(feature)) {
+            featureString = feature.getVersionedKey();
+        } else {
+            featureString = feature.getKey();
+        }
+        Set<Profile.Feature> disabledFeatures = testing().enableFeature(featureString);
         Assert.assertFalse(disabledFeatures.contains(feature));
         ProfileAssume.updateDisabledFeatures(disabledFeatures);
     }
 
+    private boolean shouldUseVersionedKey(Profile.Feature feature) {
+        return ((Profile.getFeatureVersions(feature.getUnversionedKey()).size() > 1) || (feature.getVersion() != 1));
+    }
+
     public void disableFeature(Profile.Feature feature) {
-        Set<Profile.Feature> disabledFeatures = testing().disableFeature(feature.toString());
+        String featureString;
+        if (shouldUseVersionedKey(feature)) {
+            featureString = feature.getVersionedKey();
+        } else {
+            featureString = feature.getKey();
+        }
+        Set<Profile.Feature> disabledFeatures = testing().disableFeature(featureString);
         Assert.assertTrue(disabledFeatures.contains(feature));
         ProfileAssume.updateDisabledFeatures(disabledFeatures);
     }
@@ -98,7 +118,17 @@ public void disableFeature(Profile.Feature feature) {
      * @param feature
      */
     public void resetFeature(Profile.Feature feature) {
-        testing().resetFeature(feature.toString());
+        String featureString;
+        if (shouldUseVersionedKey(feature)) {
+            featureString = feature.getVersionedKey();
+            Profile.Feature featureVersionHighestPriority = Profile.getFeatureVersions(feature.getUnversionedKey()).iterator().next();
+            if (featureVersionHighestPriority.getType().equals(Profile.Feature.Type.DEFAULT)) {
+                enableFeature(featureVersionHighestPriority);
+            }
+        } else {
+            featureString = feature.getKey();
+        }
+        testing().resetFeature(featureString);
     }
 
     public TestApplicationResource testApp() { return target.proxy(TestApplicationResource.class); }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestApplicationResourceUrls.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestApplicationResourceUrls.java
index 71aea7c4dc7f..f35ab7c51f03 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestApplicationResourceUrls.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestApplicationResourceUrls.java
@@ -17,7 +17,7 @@
 
 package org.keycloak.testsuite.client.resources;
 
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import jakarta.ws.rs.core.UriBuilder;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingCacheResource.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingCacheResource.java
index 0173e498f74f..99e6e1044cf7 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingCacheResource.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingCacheResource.java
@@ -17,7 +17,6 @@
 
 package org.keycloak.testsuite.client.resources;
 
-import org.keycloak.testsuite.rest.representation.RemoteCacheStats;
 import org.keycloak.utils.MediaType;
 
 import jakarta.ws.rs.Consumes;
@@ -73,15 +72,4 @@ public interface TestingCacheResource {
     @Path("/process-expiration")
     @Produces(MediaType.APPLICATION_JSON)
     void processExpiration();
-
-    @GET
-    @Path("/remote-cache-stats")
-    @Produces(MediaType.APPLICATION_JSON)
-    RemoteCacheStats getRemoteCacheStats();
-
-    @GET
-    @Path("/remote-cache-last-session-refresh/{user-session-id}")
-    @Produces(MediaType.APPLICATION_JSON)
-    int getRemoteCacheLastSessionRefresh(@PathParam("user-session-id") String userSessionId);
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java
index d4633e419759..ed2711028ac4 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/client/resources/TestingResource.java
@@ -21,6 +21,7 @@
 import org.keycloak.common.Profile;
 import org.keycloak.common.enums.HostnameVerificationPolicy;
 import org.keycloak.events.EventType;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
 import org.keycloak.representations.idm.AdminEventRepresentation;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
@@ -290,11 +291,6 @@ public UserRepresentation getUserByUsernameFromFedProviderFactory(@QueryParam("r
     @Produces(MediaType.APPLICATION_JSON)
     Response restorePeriodicTasks();
 
-    @Path("generate-audience-client-scope")
-    @POST
-    @NoCache
-    String generateAudienceClientScope(@QueryParam("realm") final String realmName, final @QueryParam("clientId") String clientId);
-
     @GET
     @Path("/uncaught-error")
     @Produces(MediaType.TEXT_HTML_UTF_8)
@@ -323,16 +319,6 @@ public UserRepresentation getUserByUsernameFromFedProviderFactory(@QueryParam("r
     String runModelTestOnServer(@QueryParam("testClassName") String testClassName,
                                 @QueryParam("testMethodName") String testMethodName);
 
-    @GET
-    @Path("js/keycloak.js")
-    @Produces(MediaType.TEXT_HTML_UTF_8)
-    String getJavascriptAdapter();
-
-    @GET
-    @Path("/get-javascript-testing-environment")
-    @Produces(MediaType.TEXT_HTML_UTF_8)
-    String getJavascriptTestingEnvironment();
-
     @GET
     @Path("/list-disabled-features")
     @Produces(MediaType.APPLICATION_JSON)
@@ -489,4 +475,9 @@ Response simulatePostRequest(@QueryParam("postRequestUrl") String postRequestUrl
     @Path("/email-event-litener-provide/remove-events")
     @Consumes(MediaType.APPLICATION_JSON)
     public void removeEventsToEmailEventListenerProvider(List<EventType> events);
+
+    @GET
+    @Path("/token-context")
+    @Produces(MediaType.APPLICATION_JSON)
+    AccessTokenContext getTokenContext(@QueryParam("tokenId") String tokenId);
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsole.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsole.java
deleted file mode 100644
index a026fabd6be6..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsole.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page;
-
-import org.jboss.arquillian.graphene.page.Page;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
-import org.keycloak.testsuite.auth.page.AuthServer;
-import org.keycloak.testsuite.auth.page.login.PageWithLoginUrl;
-import org.keycloak.testsuite.console.page.fragment.Menu;
-import org.keycloak.testsuite.console.page.fragment.ModalDialog;
-import org.keycloak.testsuite.page.PageWithLogOutAction;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import jakarta.ws.rs.core.UriBuilder;
-import java.net.URI;
-
-import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER;
-
-/**
- *
- * @author Petr Mensik
- */
-public class AdminConsole extends AuthServer implements PageWithLoginUrl, PageWithLogOutAction {
-
-    public static final String ADMIN_REALM = "adminRealm";
-
-    public AdminConsole() {
-        setUriParameter(ADMIN_REALM, MASTER);
-    }
-
-    public AdminConsole setAdminRealm(String adminRealm) {
-        setUriParameter(ADMIN_REALM, adminRealm);
-        return this;
-    }
-
-    public String getAdminRealm() {
-        return getUriParameter(ADMIN_REALM).toString();
-    }
-
-    @Override
-    public UriBuilder createUriBuilder() {
-        return super.createUriBuilder().path("admin/{" + ADMIN_REALM + "}/console");
-    }
-
-    @Page
-    private Menu menu;
-
-    @FindBy(xpath = "//div[@class='modal-dialog']")
-    protected ModalDialog modalDialog;
-
-    /**
-     *
-     * @return OIDC Login URL for adminRealm parameter
-     */
-    @Override
-    public URI getOIDCLoginUrl() {
-        return OIDCLoginProtocolService.authUrl(UriBuilder.fromPath(getAuthRoot()))
-                .build(getAdminRealm());
-    }
-
-    @FindBy(css = ".btn-danger")
-    protected WebElement dangerButton;
-
-    //@FindByJQuery(".btn-primary:visible")
-    @FindBy(css = ".btn-primary")
-    protected WebElement primaryButton;
-
-    @FindBy(css = "navbar-brand")
-    protected WebElement brandLink;
-
-    @Override
-    public void logOut() {
-        menu.logOut();
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleCreate.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleCreate.java
deleted file mode 100644
index f81dc08d2942..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleCreate.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page;
-
-import jakarta.ws.rs.core.UriBuilder;
-
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.console.page.AdminConsoleRealm.CONSOLE_REALM;
-
-/**
- *
- * @author tkyjovsk
- */
-public class AdminConsoleCreate extends AdminConsole {
-
-    public static final String ENTITY = "entity";
-
-    public AdminConsoleCreate() {
-        setUriParameter(CONSOLE_REALM, TEST);
-    }
-    
-    @Override
-    public UriBuilder createUriBuilder() {
-        return super.createUriBuilder().path("/");
-    }
-    
-    @Override
-    public String getUriFragment() {
-        return "/create/{" + ENTITY + "}/{" + CONSOLE_REALM + "}";
-    }
-
-    public AdminConsoleCreate setEntity(String entity) {
-        setUriParameter(ENTITY, entity);
-        return this;
-    }
-
-    public String getEntity() {
-        return getUriParameter(ENTITY).toString();
-    }
-
-    public AdminConsoleCreate setConsoleRealm(String consoleRealm) {
-        setUriParameter(CONSOLE_REALM, consoleRealm);
-        return this;
-    }
-
-    public String getConsoleRealm() {
-        return getUriParameter(CONSOLE_REALM).toString();
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealm.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealm.java
deleted file mode 100644
index 52768e53cc1c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealm.java
+++ /dev/null
@@ -1,228 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page;
-
-import org.keycloak.testsuite.util.UIUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.NoSuchElementException;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.Optional;
-
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- *
- * @author tkyjovsk
- */
-public class AdminConsoleRealm extends AdminConsoleRealmsRoot {
-
-    public static final String CONSOLE_REALM = "consoleRealm";
-
-    public AdminConsoleRealm() {
-        setUriParameter(CONSOLE_REALM, TEST);
-    }
-
-    public AdminConsoleRealm setConsoleRealm(String realm) {
-        setUriParameter(CONSOLE_REALM, realm);
-        return this;
-    }
-
-    public String getConsoleRealm() {
-        return getUriParameter(CONSOLE_REALM).toString();
-    }
-
-    @Override
-    public String getUriFragment() {
-        return super.getUriFragment() + "/{" + CONSOLE_REALM + "}";
-    }
-
-    @FindBy(xpath = "//div[./h2[text()='Configure']]")
-    private ConfigureMenu configureMenu;
-
-    public ConfigureMenu configure() {
-        waitUntilElement(By.xpath("//div[./h2[text()='Configure']]")).is().present();
-        return configureMenu;
-    }
-
-    public static class ConfigureMenu {
-
-        @FindBy(partialLinkText = "Realm Settings")
-        private WebElement realmSettingsLink;
-        @FindBy(partialLinkText = "Clients")
-        private WebElement clientsLink;
-        @FindBy(partialLinkText = "Client Scopes")
-        private WebElement clientScopesLink;
-        @FindBy(partialLinkText = "Roles")
-        private WebElement rolesLink;
-        @FindBy(partialLinkText = "Identity Providers")
-        private WebElement identityProvidersLink;
-        @FindBy(partialLinkText = "User Federation")
-        private WebElement userFederationLink;
-        @FindBy(partialLinkText = "Authentication")
-        private WebElement authenticationLink;
-
-        public void realmSettings() {
-            navigateToTab(realmSettingsLink);
-        }
-
-        public void clients() {
-            navigateToTab(clientsLink);
-        }
-
-        public void clientScopesLink() {
-            navigateToTab(clientScopesLink);
-        }
-
-        public void roles() {
-            navigateToTab(rolesLink);
-        }
-
-        public void identityProviders() {
-            navigateToTab(identityProvidersLink);
-        }
-
-        public void userFederation() {
-            navigateToTab(userFederationLink);
-        }
-
-        public void authentication() {
-            navigateToTab(authenticationLink);
-        }
-
-        // Elements
-        public WebElement getRealmSettingsTab() {
-            return realmSettingsLink;
-        }
-
-        public WebElement getClientsTab() {
-            return clientsLink;
-        }
-
-        public WebElement getClientScopesTab() {
-            return clientScopesLink;
-        }
-
-        public WebElement getRolesTab() {
-            return rolesLink;
-        }
-
-        public WebElement getUserFederationTab() {
-            return userFederationLink;
-        }
-
-        public WebElement getIdentityProvidersTab() {
-            return identityProvidersLink;
-        }
-
-        public WebElement getAuthenticationTab() {
-            return authenticationLink;
-        }
-    }
-
-    @FindBy(xpath = "//div[./h2[text()='Manage']]")
-    protected ManageMenu manageMenu;
-
-    public ManageMenu manage() {
-        waitUntilElement(By.xpath("//div[./h2[text()='Manage']]")).is().present();
-        return manageMenu;
-    }
-
-    public static class ManageMenu {
-        @FindBy(partialLinkText = "Groups")
-        private WebElement groupsLink;
-        @FindBy(partialLinkText = "Users")
-        private WebElement usersLink;
-        @FindBy(partialLinkText = "Sessions")
-        private WebElement sessionsLink;
-        @FindBy(partialLinkText = "Events")
-        private WebElement eventsLink;
-        @FindBy(partialLinkText = "Import")
-        private WebElement importLink;
-        @FindBy(partialLinkText = "Export")
-        private WebElement exportLink;
-
-        public void groups() {
-            navigateToTab(groupsLink);
-        }
-
-        public void users() {
-            navigateToTab(usersLink);
-        }
-
-        public void sessions() {
-            navigateToTab(sessionsLink);
-        }
-
-        public void events() {
-            navigateToTab(eventsLink);
-        }
-
-        public void importTab() {
-            navigateToTab(importLink);
-        }
-
-        public void exportTab() {
-            navigateToTab(exportLink);
-        }
-
-        // Elements
-        public WebElement getGroupsTab() {
-            return groupsLink;
-        }
-
-        public WebElement getUsersTab() {
-            return groupsLink;
-        }
-
-        public WebElement getSessionsTab() {
-            return groupsLink;
-        }
-
-        public WebElement getEventsTab() {
-            return groupsLink;
-        }
-
-        public WebElement getImportTab() {
-            return groupsLink;
-        }
-
-        public WebElement getExportTab() {
-            return groupsLink;
-        }
-    }
-
-    public static void navigateToTab(WebElement tab) {
-        if (tab == null) return;
-        UIUtils.clickLink(tab);
-    }
-
-    public static boolean isTabActive(WebElement tab) {
-        try {
-            final WebElement parent = tab != null ? tab.findElement(By.xpath("./..")) : null;
-
-            return parent != null && Optional.ofNullable(parent.getAttribute("class"))
-                    .map(f -> f.equals("active"))
-                    .orElse(false);
-        } catch (NoSuchElementException e) {
-            return false;
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealmsRoot.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealmsRoot.java
deleted file mode 100644
index 4f339971f836..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/AdminConsoleRealmsRoot.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page;
-
-import org.keycloak.testsuite.console.page.fragment.RealmSelector;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import jakarta.ws.rs.core.UriBuilder;
-import java.util.List;
-
-/**
- *
- * @author tkyjovsk
- */
-public class AdminConsoleRealmsRoot extends AdminConsole {
-
-    @FindBy(xpath = "//tr[@data-ng-repeat='r in realms']//a[contains(@class,'ng-binding')]")
-    private List<WebElement> realmLinks;
-
-    @Override
-    public UriBuilder createUriBuilder() {
-        return super.createUriBuilder().path("/");
-    }
-
-    @Override
-    public String getUriFragment() {
-        return "/realms";
-    }
-
-    public void clickRealm(String realm) {
-        boolean linkFound = false;
-        for (WebElement realmLink : realmLinks) {
-            if (realmLink.getText().equals(realm)) {
-                linkFound = true;
-                realmLink.click();
-            }
-        }
-        if (!linkFound) {
-            throw new IllegalStateException("A link for realm '" + realm + "' not found on the Realms page.");
-        }
-    }
-
-    @FindBy(css = "realm-selector")
-    protected RealmSelector realmSelector;
-
-//    public RealmsResource realmsResource() {
-//        return keycloak.realms();
-//    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/ForbiddenPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/ForbiddenPage.java
deleted file mode 100644
index ad73a65d51ca..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/ForbiddenPage.java
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page;
-
-import jakarta.ws.rs.core.UriBuilder;
-
-public class ForbiddenPage extends AdminConsole {
-
-    @Override
-    public UriBuilder createUriBuilder() {
-        return super.createUriBuilder().path("/");
-    }
-
-    @Override
-    public String getUriFragment() {
-        return "/forbidden";
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/AdminEvents.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/AdminEvents.java
deleted file mode 100644
index 7e1ffeb5828a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/AdminEvents.java
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.events;
-
-import org.keycloak.testsuite.console.page.fragment.DataTable;
-import org.keycloak.testsuite.page.Form;
-import org.keycloak.testsuite.util.UIUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-/**
- * @author tkyjovsk
- * @author mhajas
- */
-public class AdminEvents extends Events {
-
-    @Override
-    public String getUriFragment() {
-        return super.getUriFragment() + "/admin-events";
-    }
-
-    @FindBy(tagName = "table")
-    private AdminEventsTable table;
-
-    public AdminEventsTable table() {
-        return table;
-    }
-
-    public static class AdminEventsTable extends DataTable {
-
-        @FindBy(xpath = "//button[text()[contains(.,'Filter')]]")
-        private WebElement filterButton;
-
-        @FindBy(tagName = "form")
-        private AdminEventsTableFilterForm filterForm;
-
-        public void update() {
-            clickHeaderButton("Update");
-        }
-
-        public void reset() {
-            clickHeaderButton("Reset");
-        }
-
-        public void filter() {
-            filterButton.click();
-        }
-
-        public AdminEventsTableFilterForm filterForm() {
-            return filterForm;
-        }
-
-        public class AdminEventsTableFilterForm extends Form {
-
-            @FindBy(id = "resource")
-            private WebElement resourcePathInput;
-
-            @FindBy(id = "realm")
-            private WebElement realmInput;
-
-            @FindBy(id = "client")
-            private WebElement clientInput;
-
-            @FindBy(id = "user")
-            private WebElement userInput;
-
-            @FindBy(id = "ipAddress")
-            private WebElement ipAddressInput;
-
-            @FindBy(xpath = "//div[@id='s2id_adminEnabledEventOperations']/ul")
-            private WebElement operationTypesInput;
-
-            @FindBy(xpath = "//div[@id='select2-drop']")
-            private WebElement operationTypesValues;
-
-            public void addOperationType(String type) {
-                operationTypesInput.click();
-                operationTypesValues.findElement(By.xpath("//div[text() = '" + type + "']")).click();
-            }
-
-            public void removeOperationType(String type) {
-                operationTypesInput.findElement(By.xpath("//div[text()='" + type + "']/../a")).click();
-            }
-
-            public void setResourcePathInput(String value) {
-                UIUtils.setTextInputValue(resourcePathInput, value);
-            }
-
-            public void setRealmInput(String value) {
-                UIUtils.setTextInputValue(realmInput, value);
-            }
-
-            public void setClientInput(String value) {
-                UIUtils.setTextInputValue(clientInput, value);
-            }
-
-            public void setUserInput(String value) {
-                UIUtils.setTextInputValue(userInput, value);
-            }
-
-            public void setIpAddressInput(String value) {
-                UIUtils.setTextInputValue(ipAddressInput, value);
-            }
-        }
-
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Config.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Config.java
deleted file mode 100644
index 997f3a7ee9f7..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Config.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.events;
-
-import org.keycloak.testsuite.console.page.fragment.OnOffSwitch;
-import org.keycloak.testsuite.page.Form;
-import org.keycloak.testsuite.util.UIUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-import org.openqa.selenium.support.ui.Select;
-
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- * @author tkyjovsk
- * @author mhajas
- */
-public class Config extends Events {
-
-    @Override
-    public String getUriFragment() {
-        return super.getUriFragment() + "/events-settings";
-    }
-
-    @FindBy(xpath = "//form")
-    private ConfigForm form;
-
-    public ConfigForm form() {
-        return form;
-    }
-
-    public static class ConfigForm extends Form {
-        @FindBy(id = "s2id_autogen1")
-        private WebElement eventListenersInput;
-
-        @FindBy(xpath = "//div[@id='s2id_autogen1']/..//select")
-        private Select eventListenersSelect;
-
-        @FindBy(xpath = ".//div[@class='onoffswitch' and ./input[@id='enabled']]")
-        private OnOffSwitch SaveEvents;
-
-        @FindBy(xpath = "//div[@id='s2id_enabledEventTypes']//input")
-        private WebElement savedTypesInput;
-
-        @FindBy(xpath = "//div[@id='select2-drop']/ul")
-        private WebElement savedTypesOptions;
-
-        @FindBy(id = "expiration")
-        private WebElement expirationInput;
-
-        @FindBy(name = "expirationUnit")
-        private Select expirationUnitSelect;
-
-        @FindBy(xpath = ".//div[@class='onoffswitch' and ./input[@id='adminEventsEnabled']]")
-        private OnOffSwitch saveAdminEvents;
-
-        @FindBy(xpath = ".//div[@class='onoffswitch' and ./input[@id='adminEventsDetailsEnabled']]")
-        private OnOffSwitch includeRepresentation;
-
-        @FindBy(xpath = "//button[@data-ng-click='clearEvents()']")
-        private WebElement clearLoginEventsButton;
-
-        @FindBy(xpath = "//button[@data-ng-click='clearAdminEvents()']")
-        private WebElement clearAdminEventsButton;
-
-        public void addEventListener(String listener) {
-            eventListenersInput.click();
-            eventListenersSelect.selectByVisibleText(listener);
-        }
-
-        public void removeEventListener(String listener) {
-            eventListenersInput.findElement(By.xpath("//div[text()='" + listener + "']/../a")).click();
-        }
-
-        public void setSaveEvents(boolean value) {
-            SaveEvents.setOn(value);
-        }
-
-        public void addSaveType(String type) {
-            savedTypesInput.click();
-            savedTypesOptions.findElement(By.xpath("//div[text()='" + type + "']")).click();
-        }
-
-        public void removeSaveType(String type) {
-            savedTypesInput.findElement(By.xpath("//div[text()='" + type + "']/../a")).click();
-        }
-
-        public void clearLoginEvents() {
-            clearLoginEventsButton.click();
-        }
-
-        public void setExpiration(String value, String unit) {
-            expirationUnitSelect.selectByVisibleText(unit);
-            UIUtils.setTextInputValue(expirationInput, value);
-        }
-
-        public void setSaveAdminEvents(boolean value) {
-            saveAdminEvents.setOn(value);
-        }
-
-        public void setIncludeRepresentation(boolean value) {
-            includeRepresentation.setOn(value);
-        }
-
-        public void clearAdminEvents() {
-            clearAdminEventsButton.click();
-        }
-        
-        public void waitForClearEventsButtonPresent() {
-            waitUntilElement(clearLoginEventsButton).is().present();
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Events.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Events.java
deleted file mode 100644
index ca8ee092fc19..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/Events.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.events;
-
-import org.keycloak.testsuite.console.page.AdminConsoleRealm;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-/**
- *
- * @author tkyjovsk
- */
-public class Events extends AdminConsoleRealm {
-
-    @Override
-    public String getUriFragment() {
-        return super.getUriFragment();
-    }
-    
-    @FindBy(linkText = "Login Events")
-    private WebElement loginEventsTab;
-    @FindBy(linkText = "Admin Events")
-    private WebElement adminEventsTab;
-    @FindBy(linkText = "Config")
-    private WebElement configTab;
-    
-    public void loginEvents() {
-        loginEventsTab.click();
-    }
-    public void adminEvents() {
-        adminEventsTab.click();
-    }
-    public void config() {
-        configTab.click();
-    }
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/LoginEvents.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/LoginEvents.java
deleted file mode 100644
index f9128acf5aa6..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/events/LoginEvents.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.events;
-
-import org.keycloak.testsuite.console.page.fragment.DataTable;
-import org.keycloak.testsuite.page.Form;
-import org.keycloak.testsuite.util.UIUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-/**
- * @author tkyjovsk
- * @author mhajas
- */
-public class LoginEvents extends Events {
-
-    @Override
-    public String getUriFragment() {
-        return super.getUriFragment() + "/events";
-    }
-
-    @FindBy(tagName = "table")
-    private LoginEventsTable table;
-
-    public LoginEventsTable table() {
-        return table;
-    }
-
-    public static class LoginEventsTable extends DataTable {
-
-        @FindBy(xpath = "//button[text()[contains(.,'Filter')]]")
-        private WebElement filterButton;
-
-        @FindBy(tagName = "form")
-        private LoginEventsTableFilterForm filterForm;
-
-        public void update() {
-            clickHeaderButton("Update");
-        }
-
-        public void reset() {
-            clickHeaderButton("Reset");
-        }
-
-        public void filter() {
-            filterButton.click();
-        }
-
-        public LoginEventsTableFilterForm filterForm() {
-            return filterForm;
-        }
-
-        public class LoginEventsTableFilterForm extends Form {
-
-            @FindBy(id = "client")
-            private WebElement clientInput;
-
-            @FindBy(id = "user")
-            private WebElement userInput;
-
-            @FindBy(xpath = "//div[@id='s2id_eventTypes']/ul")
-            private WebElement eventTypeInput;
-
-            @FindBy(xpath = "//div[@id='select2-drop']")
-            private WebElement eventTypeValues;
-
-            public void addEventType(String type) {
-                eventTypeInput.click();
-                eventTypeValues.findElement(By.xpath("//div[text()='" + type + "']")).click();
-            }
-
-            public void removeOperationType(String type) {
-                eventTypeInput.findElement(By.xpath("//div[text()='" + type + "']/../a]")).click();
-            }
-
-            public void setClientInput(String value) {
-                UIUtils.setTextInputValue(clientInput, value);
-            }
-
-            public void setUserInput(String value) {
-                UIUtils.setTextInputValue(userInput, value);
-            }
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/AbstractMultipleSelect2.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/AbstractMultipleSelect2.java
deleted file mode 100644
index f9c608443e43..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/AbstractMultipleSelect2.java
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.jboss.arquillian.graphene.fragment.Root;
-import org.openqa.selenium.By;
-import org.openqa.selenium.JavascriptExecutor;
-import org.openqa.selenium.Keys;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-import static org.keycloak.testsuite.util.WaitUtils.pause;
-import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public abstract class AbstractMultipleSelect2<R> {
-
-    @Root
-    private WebElement root;
-
-    @Drone
-    private WebDriver driver;
-
-    @FindBy(xpath = "//input[contains(@class,'select2-focused')]")
-    private WebElement search;
-
-    @FindBy(xpath = "//div[contains(@class,'select2-result-label')]")
-    private List<WebElement> result;
-
-    public void update(Set<R> values) {
-        Set<R> selection = getSelected();
-
-        for (R value : values) {
-            if (!selection.contains(value)) {
-                select(value);
-            }
-        }
-
-        for (R selected : selection) {
-            boolean isSelected = false;
-
-            for (R value : values) {
-                if (selected.equals(value)) {
-                    isSelected = true;
-                    break;
-                }
-            }
-
-            if (!isSelected) {
-                deselect(selected);
-            }
-        }
-    }
-
-    public void select(R value) {
-        pause(500);
-        root.click();
-        pause(500);
-
-        String id = identity().apply(value);
-
-        search.sendKeys(id);
-        waitForPageToLoad();
-
-        if (result.isEmpty()) {
-            search.sendKeys(Keys.ESCAPE);
-            return;
-        }
-
-        for (WebElement result : result) {
-            if (match(result.getText(), id)) {
-                clickLink(result);
-                return;
-            }
-        }
-    }
-
-    protected abstract Function<R, String> identity();
-
-    protected boolean match(String result, String search) {
-        return result != null && result.equalsIgnoreCase(search);
-    };
-
-    public Set<R> getSelected() {
-        Set<R> values = new HashSet<>();
-
-        for (WebElement selected : getSelectedElements()) {
-            R value = representation().apply(selected);
-
-            if (value != null) {
-                values.add(value);
-            }
-        }
-
-        return values;
-    }
-
-    protected abstract List<WebElement> getSelectedElements();
-
-    protected abstract Function<WebElement, R> representation();
-
-    public void deselect(R value) {
-        onDeselect(value);
-    }
-
-    protected void onDeselect(R value) {
-        for (WebElement selected : getSelectedElements()) {
-            if (deselect().apply(selected, value)) {
-                return;
-            }
-        }
-    }
-
-    protected BiFunction<WebElement, R, Boolean> deselect() {
-        return (selected, value) -> {
-            WebElement selection = selected.findElements(By.tagName("div")).get(0);
-            if (identity().apply(value).equals(selection.getText())) {
-                WebElement element = selected.findElement(By.xpath(".//a[contains(@class,'select2-search-choice-close')]"));
-                JavascriptExecutor executor = (JavascriptExecutor) driver;
-                executor.executeScript("arguments[0].click();", element);
-                pause(500);
-                return true;
-            }
-            return false;
-        };
-    }
-
-    protected WebElement getRoot() {
-        return root;
-    }
-
-    protected WebDriver getDriver() {
-        return driver;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Breadcrumb.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Breadcrumb.java
deleted file mode 100644
index 9d3c57089e28..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Breadcrumb.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.List;
-
-/**
- *
- * @author tkyjovsk
- */
-public class Breadcrumb {
-
-    public static final String BREADCRUMB_XPATH = "//ol[@class='breadcrumb']";
-
-    @FindBy(xpath = "./li[not(contains(@class,'ng-hide'))]/a")
-    private List<WebElement> items;
-
-    public int size() {
-        return items.size();
-    }
-
-    public WebElement getItem(int index) {
-        return items.get(index);
-    }
-
-    public WebElement getItemFromEnd(int index) {
-        return items.get(size() - index - 1);
-    }
-
-    public void clickItemOneLevelUp() {
-        getItemFromEnd(0).click();
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/DataTable.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/DataTable.java
deleted file mode 100644
index dfa7129c1cd9..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/DataTable.java
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.openqa.selenium.By;
-import org.openqa.selenium.NoSuchElementException;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.List;
-
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-import static org.keycloak.testsuite.util.UIUtils.getTextFromElement;
-import static org.keycloak.testsuite.util.WaitUtils.pause;
-import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
-import static org.openqa.selenium.By.tagName;
-import static org.openqa.selenium.By.xpath;
-
-/**
- *
- * @author tkyjovsk
- */
-public class DataTable {
-
-    @Drone
-    protected WebDriver driver;
-
-    @FindBy(css = "input[class*='search']")
-    private WebElement searchInput;
-    @FindBy(css = "div[class='input-group-addon'] i")
-    private WebElement searchButton;
-
-    @FindBy(tagName = "thead")
-    private WebElement header;
-    @FindBy(css = "tbody")
-    private WebElement body;
-    @FindBy(xpath = "tbody/tr[@class='ng-scope']")
-    private List<WebElement> rows;
-
-    @FindBy(tagName = "tfoot")
-    private WebElement footer;
-
-    public void search(String pattern) {
-        searchInput.sendKeys(pattern);
-        clickLink(searchButton);
-    }
-
-    public void clickHeaderButton(String buttonText) {
-        clickLink(header.findElement(By.xpath(".//button[text()='" + buttonText + "']")));
-    }
-
-    public void clickHeaderLink(String linkText) {
-        clickLink(header.findElement(By.linkText(linkText)));
-    }
-
-    public WebElement body() {
-        return body;
-    }
-
-    public WebElement footer() {
-        return footer;
-    }
-
-
-    public List<WebElement> rows() {
-        waitForPageToLoad();
-        pause(500); // wait a bit to ensure the table is no more changing
-        return rows;
-    }
-
-    public WebElement getRowByLinkText(String text) {
-        WebElement row = body.findElement(By.xpath(".//tr[./td/a[text()='" + text + "']]"));
-        return row;
-    }
-
-    public void clickRowByLinkText(String text) {
-        clickLink(body.findElement(By.xpath(".//tr/td/a[text()='" + text + "']")));
-    }
-
-    public WebElement getActionButton(WebElement row, String buttonText) {
-        return row.findElement(xpath(".//td[contains(@class, 'kc-action-cell') and text()='" + buttonText + "']"));
-    }
-
-    public WebElement getActionButton(String rowLinkText, String buttonText) {
-        return getActionButton(getRowByLinkText(rowLinkText), buttonText);
-    }
-
-    public boolean isActionButtonVisible(String rowLinkText, String buttonText) {
-        try {
-            return getActionButton(rowLinkText, buttonText).isDisplayed();
-        }
-        catch (NoSuchElementException e) {
-            return false;
-        }
-    }
-
-    public void clickRowActionButton(WebElement row, String buttonText) {
-        clickLink(getActionButton(row, buttonText));
-    }
-
-    public void clickRowActionButton(String rowLinkText, String buttonText) {
-        clickLink(getActionButton(rowLinkText, buttonText));
-    }
-
-    public String getColumnText(WebElement row, int colIndex) {
-        return getTextFromElement(row.findElements(tagName("td")).get(colIndex));
-    }
-
-    public String getColumnText(String rowLinkText, int colIndex) {
-        return getColumnText(getRowByLinkText(rowLinkText), colIndex);
-    }
-
-    public boolean isRowPresent(String rowLinkText) {
-        try {
-            return getRowByLinkText(rowLinkText).isDisplayed();
-        }
-        catch (NoSuchElementException e) {
-            return false;
-        }
-    }
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/InputList.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/InputList.java
deleted file mode 100644
index 9010e5bddd24..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/InputList.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import static org.keycloak.testsuite.util.UIUtils.getTextInputValue;
-
-/**
- *
- * @author tkyjovsk
- */
-public class InputList {
-    
-    @FindBy(xpath=".//input[@ng-model='client.redirectUris[i]']")
-    private List<WebElement> inputs;
-    
-    public List<String> getValues() {
-        List<String> values = new ArrayList<>();
-        for (WebElement input: inputs) {
-            values.add(getTextInputValue(input));
-        }
-        return values;
-    }
-    
-    
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/KcPassword.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/KcPassword.java
deleted file mode 100644
index a58ae9592d57..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/KcPassword.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright 2019 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.jboss.arquillian.graphene.fragment.Root;
-import org.openqa.selenium.ElementNotInteractableException;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.keycloak.testsuite.util.UIUtils.setTextInputValue;
-
-/**
- * @author Vaclav Muzikar <vmuzikar@redhat.com>
- */
-public class KcPassword {
-    @Root
-    private WebElement inputField;
-
-    @FindBy(xpath = "../span[contains(@class,'input-group-addon') and ./span[contains(@class,'fa-eye')]]")
-    private WebElement eyeButton;
-
-    public void setValue(final String value) {
-        setTextInputValue(inputField, value);
-    }
-
-    public boolean isMasked() {
-        return inputField.getAttribute("class").contains("password-conceal");
-    }
-
-    public boolean isEyeButtonDisabled() {
-        return eyeButton.getAttribute("class").contains("disabled");
-    }
-
-    public void clickEyeButton() {
-        if (isEyeButtonDisabled()) {
-            throw new ElementNotInteractableException("The eye button is disabled and cannot be clicked");
-        }
-        eyeButton.click();
-    }
-
-    public WebElement getElement() {
-        return inputField;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Menu.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Menu.java
deleted file mode 100644
index 6ae5135d5b42..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/Menu.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.List;
-
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- *
- * @author Petr Mensik
- */
-public class Menu {
-
-    private static final String MENU_LOCATOR = "ul[class='dropdown-menu']";
-
-    @FindBy(css = MENU_LOCATOR)
-    private List<WebElement> menuList;
-
-    @FindBy(css = ".dropdown-toggle")
-    private List<WebElement> toggle;
-
-    public void logOut() {
-        clickOnMenuElement(MenuType.USER, "Sign Out");
-    }
-
-    public void goToAccountManagement() {
-        clickOnMenuElement(MenuType.USER, "Manage Account");
-    }
-
-    public void switchRealm(String realmName) {
-        if (!realmName.equals(getCurrentRealm())) {
-            clickOnMenuElement(MenuType.REALM, realmName);
-        }
-    }
-
-    public String getCurrentRealm() {
-        waitUntilElement(By.cssSelector(MENU_LOCATOR)).is().present();
-        return toggle.get(1).getText();
-    }
-
-    private void clickOnMenuElement(MenuType menuType, String linkText) {
-        int menuOrder = 0;
-        switch (menuType) {
-            case REALM:
-                menuOrder = 1;
-                break;
-            case USER:
-                menuOrder = 0;
-                break;
-        }
-        waitUntilElement(By.cssSelector(MENU_LOCATOR)).is().present();
-        if (!menuList.get(menuOrder).isDisplayed()) {
-            toggle.get(menuOrder).click();
-        }
-        for (WebElement item : menuList.get(menuOrder).findElements(By.cssSelector(MENU_LOCATOR + " a"))) {
-            if (item.getText().contains(linkText)) {
-                clickLink(item);
-                return;
-            }
-        }
-        throw new RuntimeException("Could not find menu item containing \"" + linkText + "\"");
-    }
-
-    private enum MenuType {
-
-        USER, REALM
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/ModalDialog.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/ModalDialog.java
deleted file mode 100644
index 2d3b7f656b9e..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/ModalDialog.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.jboss.arquillian.graphene.fragment.Root;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.keycloak.testsuite.util.WaitUtils.waitForModalFadeIn;
-import static org.keycloak.testsuite.util.WaitUtils.waitForModalFadeOut;
-
-/**
- *
- * @author tkyjovsk
- */
-public class ModalDialog {
-
-    @Root
-    private WebElement root;
-
-    @Drone
-    private WebDriver driver;
-
-    @FindBy(xpath = ".//button[text()='Cancel']")
-    private WebElement cancelButton;
-    @FindBy(xpath = ".//button[text()='Delete']")
-    private WebElement deleteButton;
-
-    @FindBy(xpath = ".//button[@ng-click='ok()']")
-    private WebElement okButton;
-    @FindBy(id = "name")
-    private WebElement nameInput;
-
-    @FindBy(className = "modal-body")
-    private WebElement message;
-
-    public void ok() {
-        waitForModalFadeIn();
-        okButton.click();
-        waitForModalFadeOut();
-    }
-    
-    public void confirmDeletion() {
-        waitForModalFadeIn();
-        deleteButton.click();
-        waitForModalFadeOut();
-    }
-
-    public void cancel() {
-        waitForModalFadeIn();
-        cancelButton.click();
-        waitForModalFadeOut();
-    }
-
-    public void setName(String name) {
-        nameInput.clear();
-        nameInput.sendKeys(name);
-    }
-
-    public WebElement getMessage() {
-        return message;
-    }
-}
\ No newline at end of file
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/MultipleStringSelect2.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/MultipleStringSelect2.java
deleted file mode 100644
index 89582c83543c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/MultipleStringSelect2.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page.fragment;
-
-import java.util.List;
-import java.util.function.Function;
-
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class MultipleStringSelect2 extends AbstractMultipleSelect2<String> {
-
-    @Override
-    protected Function<String, String> identity() {
-        return r -> r.toString();
-    }
-
-    @Override
-    protected List<WebElement> getSelectedElements() {
-        return getRoot().findElements(By.xpath(".//li[contains(@class,'select2-search-choice')]"));
-    }
-
-    @Override
-    protected Function<WebElement, String> representation() {
-        return webElement -> {
-            List<WebElement> element = webElement.findElements(By.tagName("div"));
-
-            if (element.isEmpty()) {
-                return null;
-            }
-
-            String value = element.get(0).getText();
-
-            return "".equals(value) ? null : value;
-        };
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/PickList.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/PickList.java
deleted file mode 100644
index b40e103587e2..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/PickList.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-import org.jboss.arquillian.graphene.fragment.Root;
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-import org.openqa.selenium.support.ui.Select;
-
-/**
- *
- * @author Petr Mensik
- */
-
-public class PickList {
-
-    @Root
-    private WebElement root;
-
-    private Select firstSelect;
-    private Select secondSelect;
-    
-    @FindBy(className = "kc-icon-arrow-right")
-    private WebElement rightArrow;
-    
-    @FindBy(className = "kc-icon-arrow-left")
-    private WebElement leftArrow;
-    
-    public void addItems(String... values) {
-        for(String value : values) {
-            firstSelect.selectByVisibleText(value);
-        }
-        rightArrow.click();
-    }
-    
-    public void setFirstSelect(By locator) {
-        firstSelect = new Select(root.findElement(locator));
-    }
-    
-    public void setSecondSelect(By locator) {
-        secondSelect = new Select(root.findElement(locator));
-    }
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/RealmSelector.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/RealmSelector.java
deleted file mode 100644
index 8348ccb4c1a7..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/RealmSelector.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.console.page.fragment;
-
-/**
- *
- * @author tkyjovsk
- */
-public class RealmSelector {
-    
-    // TODO
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/SingleStringSelect2.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/SingleStringSelect2.java
deleted file mode 100644
index 6621622f3288..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/console/page/fragment/SingleStringSelect2.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.console.page.fragment;
-
-import java.util.List;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import org.keycloak.testsuite.util.WaitUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.JavascriptExecutor;
-import org.openqa.selenium.WebElement;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class SingleStringSelect2 extends AbstractMultipleSelect2<String> {
-
-    @Override
-    protected Function<String, String> identity() {
-        return r -> r.toString();
-    }
-
-    @Override
-    protected List<WebElement> getSelectedElements() {
-        return getRoot().findElements(By.xpath(".//span[contains(@class,'select2-chosen')]"));
-    }
-
-    @Override
-    protected Function<WebElement, String> representation() {
-        return webElement -> {
-            String value = webElement.getText();
-            return "".equals(value) ? null : value;
-        };
-    }
-
-    @Override
-    protected BiFunction<WebElement, String, Boolean> deselect() {
-        return (selected, value) -> {
-            if (identity().apply(value).equals(selected.getText())) {
-                WebElement element = selected.findElement(By.xpath(".//a[contains(@class,'select2-search-choice-close')]"));
-                JavascriptExecutor executor = (JavascriptExecutor) getDriver();
-                executor.executeScript("arguments[0].click();", element);
-                WaitUtils.pause(500);
-                return true;
-            }
-            return false;
-        };
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/DC.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/DC.java
deleted file mode 100644
index 6460742becf4..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/DC.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.crossdc;
-
-import java.util.Arrays;
-import java.util.stream.Stream;
-
-/**
- * Identifier of datacentre in the testsuite
- * @author hmlnarik
- */
-public enum DC {
-    FIRST,
-    SECOND,
-    UNDEFINED;
-
-    public int getDcIndex() {
-        return ordinal();
-    }
-
-    private static final DC[] VALID_DCS = new DC[] { FIRST, SECOND };
-
-    public static Stream<DC> validDcsStream() {
-        return Arrays.stream(VALID_DCS);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/ServerSetup.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/ServerSetup.java
deleted file mode 100644
index 6e71b08d1251..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/crossdc/ServerSetup.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.crossdc;
-
-/**
- * @author vramik
- */
-public enum ServerSetup {
-    FIRST_NODE_IN_FIRST_DC,
-    FIRST_NODE_IN_EVERY_DC,
-    ALL_NODES_IN_EVERY_DC,
-    ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC,
-    ALL_NODES_IN_FIRST_DC_NO_NODES_IN_SECOND_DC;
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPage.java
index eaf2ae12a92b..569fe6afe549 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPage.java
@@ -17,22 +17,23 @@
 
 package org.keycloak.testsuite.page;
 
+import jakarta.ws.rs.core.UriBuilder;
 import org.jboss.arquillian.drone.api.annotation.Drone;
 import org.jboss.logging.Logger;
+import org.junit.Assert;
 import org.keycloak.testsuite.util.DroneUtils;
 import org.keycloak.testsuite.util.URLUtils;
 import org.openqa.selenium.WebDriver;
 
-import jakarta.ws.rs.core.UriBuilder;
 import java.net.URI;
 import java.util.HashMap;
 import java.util.Map;
-import org.junit.Assert;
 
 /**
  *
  * @author tkyjovsk
  */
+@Deprecated
 public abstract class AbstractPage {
 
     protected final Logger log = Logger.getLogger(this.getClass());
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPageWithInjectedUrl.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPageWithInjectedUrl.java
index 01e88395bc1b..f1b91e41ba8f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPageWithInjectedUrl.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPageWithInjectedUrl.java
@@ -17,10 +17,8 @@
 
 package org.keycloak.testsuite.page;
 
-import org.keycloak.testsuite.util.ServerURLs;
-
 import jakarta.ws.rs.core.UriBuilder;
-import java.net.MalformedURLException;
+
 import java.net.URISyntaxException;
 import java.net.URL;
 
@@ -28,6 +26,7 @@
  *
  * @author tkyjovsk
  */
+@Deprecated
 public abstract class AbstractPageWithInjectedUrl extends AbstractPage {
 
     public abstract URL getInjectedUrl();
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPatternFlyAlert.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPatternFlyAlert.java
index f71489698fbe..719e44e6ee38 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPatternFlyAlert.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/AbstractPatternFlyAlert.java
@@ -42,6 +42,7 @@
  *
  * @author tkyjovsk
  */
+@Deprecated
 public abstract class AbstractPatternFlyAlert {
     public static final String ALERT_CLASS_NAME = "pf-v5-c-alert";
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/Form.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/Form.java
index 15d3f91f7396..daf03896529e 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/Form.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/Form.java
@@ -31,6 +31,7 @@
  *
  * @author tkyjovsk
  */
+@Deprecated
 public class Form {
 
     protected final Logger log = Logger.getLogger(this.getClass());
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/LoginPasswordUpdatePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/LoginPasswordUpdatePage.java
deleted file mode 100644
index 3b8e330514b8..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/LoginPasswordUpdatePage.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.page;
-
-import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.junit.Assert;
-import org.keycloak.testsuite.pages.PageUtils;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.keycloak.testsuite.util.UIUtils.getTextFromElement;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class LoginPasswordUpdatePage {
-
-    @Drone
-    protected WebDriver driver;
-
-    @FindBy(id = "password-new")
-    private WebElement newPasswordInput;
-
-    @FindBy(id = "password-confirm")
-    private WebElement passwordConfirmInput;
-
-    @FindBy(css = "button[type=\"submit\"]")
-    private WebElement submitButton;
-
-    @FindBy(css = "div[class^='pf-v5-c-alert'], div[class^='alert-error']")
-    private WebElement loginErrorMessage;
-
-    public void changePassword(String newPassword, String passwordConfirm) {
-        newPasswordInput.sendKeys(newPassword);
-        passwordConfirmInput.sendKeys(passwordConfirm);
-
-        submitButton.click();
-    }
-
-    public boolean isCurrent() {
-        return driver.getTitle().equals("Update password");
-    }
-
-    public void assertCurrent() {
-        Assert.assertEquals("Update password", PageUtils.getPageTitle(driver));
-    }
-
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
-    public String getError() {
-        return loginErrorMessage != null ? getTextFromElement(loginErrorMessage) : null;
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PageWithLogOutAction.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PageWithLogOutAction.java
deleted file mode 100644
index 33fa4fcce768..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PageWithLogOutAction.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package org.keycloak.testsuite.page;
-
-/**
- *
- * @author tkyjovsk
- */
-public interface PageWithLogOutAction {
-    
-    public void logOut();
-    
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PatternFlyClosableAlert.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PatternFlyClosableAlert.java
deleted file mode 100644
index 61531ac12a69..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/page/PatternFlyClosableAlert.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.page;
-
-import org.keycloak.testsuite.util.WaitUtils;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-
-/**
- *
- * @author Petr Mensik
- * @author tkyjovsk
- */
-public class PatternFlyClosableAlert extends AbstractPatternFlyAlert {
-
-    @FindBy(xpath = ".//button[@class='close']")
-    protected WebElement closeButton;
-
-    public boolean isInfo() {
-        return checkAlertType("info");
-    }
-
-    public boolean isWarning() {
-        return checkAlertType("warning");
-    }
-
-    public boolean isDanger() {
-        return checkAlertType("danger");
-    }
-
-    @Override
-    public void assertSuccess(String expectedText) {
-        super.assertSuccess(expectedText);
-        close();
-    }
-
-    public void assertInfo() {
-        assertInfo(null);
-    }
-
-    public void assertInfo(String expectedText) {
-        assertDisplayed();
-        assertTrue("Alert type should be info", isInfo());
-        if (expectedText != null) assertEquals(expectedText, getText());
-        close();
-    }
-
-    public void assertWarning() {
-        assertWarning(null);
-    }
-
-    public void assertWarning(String expectedText) {
-        assertDisplayed();
-        assertTrue("Alert type should be warning", isWarning());
-        if (expectedText != null) assertEquals(expectedText, getText());
-        close();
-    }
-
-    public void assertDanger() {
-        assertDanger(null);
-    }
-
-    public void assertDanger(String expectedText) {
-        assertDisplayed();
-        assertTrue("Alert type should be danger", isDanger());
-        if (expectedText != null) assertEquals(expectedText, getText());
-        close();
-    }
-
-    public void close() {
-        closeButton.click();
-        WaitUtils.pause(500);
-        // Sometimes, when a test is too fast,
-        // one of the consecutive alerts is not displayed;
-        // to prevent this we need to slow down a bit
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AbstractPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AbstractPage.java
index 8b8f5eb786a1..dcbe71709206 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AbstractPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AbstractPage.java
@@ -19,23 +19,14 @@
 
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.junit.Assert;
-import org.keycloak.common.util.KeycloakUriBuilder;
-import org.keycloak.testsuite.arquillian.SuiteContext;
-import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 
-import java.net.URI;
-import java.net.URISyntaxException;
-
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public abstract class AbstractPage {
 
-    @ArquillianResource
-    protected SuiteContext suiteContext;
-
     @ArquillianResource
     protected WebDriver driver;
 
@@ -44,30 +35,16 @@ public abstract class AbstractPage {
 
     public void assertCurrent() {
         String name = getClass().getSimpleName();
-        Assert.assertTrue("Expected " + name + " but was " + DroneUtils.getCurrentDriver().getTitle() + " (" + DroneUtils.getCurrentDriver().getCurrentUrl() + ")",
+        Assert.assertTrue("Expected " + name + " but was " + driver.getTitle() + " (" + driver.getCurrentUrl() + ")",
                 isCurrent());
     }
 
-    protected URI getAuthServerRoot() {
-        try {
-            return KeycloakUriBuilder.fromUri(suiteContext.getAuthServerInfo().getBrowserContextRoot().toURI()).path("/auth/").build();
-        } catch (URISyntaxException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
     abstract public boolean isCurrent();
 
     public boolean isCurrent(String expectedTitle) {
         return PageUtils.getPageTitle(driver).equals(expectedTitle);
     }
 
-    abstract public void open() throws Exception;
-
-    public WebDriver getDriver() {
-        return driver;
-    }
-
     public void setDriver(WebDriver driver) {
         this.driver = driver ;
         oauth.setDriver(driver);
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
index e327c3b5ec5a..10b08594f1c9 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
@@ -18,7 +18,7 @@
 package org.keycloak.testsuite.pages;
 
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -33,7 +33,6 @@ public class AppPage extends AbstractPage {
     @FindBy(id = "account")
     private WebElement accountLink;
 
-    @Override
     public void open() {
         DroneUtils.getCurrentDriver().navigate().to(OAuthClient.APP_AUTH_ROOT);
     }
@@ -60,7 +59,7 @@ public enum RequestType {
     }
 
     public void logout(String idTokenHint) {
-        oauth.idTokenHint(idTokenHint).openLogout();
+        oauth.logoutForm().idTokenHint(idTokenHint).withRedirect().open();
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ConsentPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ConsentPage.java
index 5a9e84f4880f..ccd6aeb86656 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ConsentPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ConsentPage.java
@@ -48,9 +48,4 @@ public boolean isCurrent() {
     public boolean isCurrent(WebDriver driver1) {
         return PageUtils.getPageTitle(driver1).contains("Grant Access to ");
     }
-
-    @Override
-    public void open() throws Exception {
-
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/DeleteCredentialPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/DeleteCredentialPage.java
index aabfc0be884f..200eb810a3e7 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/DeleteCredentialPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/DeleteCredentialPage.java
@@ -53,9 +53,4 @@ public void cancel() {
     public void assertCredentialInMessage(String expectedLabel) {
         Assert.assertEquals("Do you want to delete " + expectedLabel + "?", message.getText());
     }
-
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EmailUpdatePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EmailUpdatePage.java
index a3ffebab6c50..1b24be6cea58 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EmailUpdatePage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EmailUpdatePage.java
@@ -53,11 +53,6 @@ public boolean isCurrent() {
 		return PageUtils.getPageTitle(driver).equals("Update email");
 	}
 
-	@Override
-	public void open() throws Exception {
-		throw new UnsupportedOperationException();
-	}
-
 	public String getEmailError() {
 		try {
 			return getTextFromElement(emailError);
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EnterRecoveryAuthnCodePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EnterRecoveryAuthnCodePage.java
index b4bc8015a073..06e23ca5f361 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EnterRecoveryAuthnCodePage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/EnterRecoveryAuthnCodePage.java
@@ -1,6 +1,8 @@
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
+import org.openqa.selenium.JavascriptExecutor;
 import org.openqa.selenium.NoSuchElementException;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -34,7 +36,13 @@ public void enterRecoveryAuthnCode(String recoveryCode) {
     }
 
     public void clickSignInButton() {
-        signInButton.click();
+        UIUtils.clickLink(signInButton);
+    }
+
+    public void clickSignInButtonViaJavaScriptNoDelay() {
+        // submit the form via JS but with a setTimeout to avoid any delay
+        final JavascriptExecutor js = (JavascriptExecutor) driver;
+        js.executeScript("window.setTimeout(function() {document.forms[0].submit()}, 0)");
     }
 
     @Override
@@ -50,11 +58,6 @@ public boolean isCurrent() {
         return true;
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
-
     public String getFeedbackText() {
         return feedbackText.getText().trim();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ErrorPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ErrorPage.java
index b539c6b6eabe..067979e40cb0 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ErrorPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ErrorPage.java
@@ -17,7 +17,7 @@
 package org.keycloak.testsuite.pages;
 
 import org.jboss.arquillian.test.api.ArquillianResource;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -56,9 +56,4 @@ public boolean isCurrent() {
         return PageUtils.getPageTitle(driver) != null && PageUtils.getPageTitle(driver).equals("We are sorry...");
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmLinkPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmLinkPage.java
index 6ef2143b0a9b..fd7ccc363327 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmLinkPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmLinkPage.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -47,12 +48,12 @@ public void clickReviewProfile() {
         updateProfileButton.click();
     }
 
+    public boolean isReviewProfileDisplayed() {
+        return UIUtils.isElementVisible(updateProfileButton);
+    }
+
     public void clickLinkAccount() {
         linkAccountButton.click();
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmOverrideLinkPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmOverrideLinkPage.java
index 8d4304bd18b8..7c7e53f799d8 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmOverrideLinkPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpConfirmOverrideLinkPage.java
@@ -41,8 +41,4 @@ public void clickConfirmOverride() {
         confirmOverrideButton.click();
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkActionPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkActionPage.java
new file mode 100644
index 000000000000..fe7c33c1e3b7
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkActionPage.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.pages;
+
+import org.junit.Assert;
+import org.keycloak.testsuite.util.UIUtils;
+import org.openqa.selenium.WebElement;
+import org.openqa.selenium.support.FindBy;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class IdpLinkActionPage extends AbstractPage {
+
+    @FindBy(id = "kc-continue")
+    private WebElement submitButton;
+
+    @FindBy(id = "kc-cancel")
+    private WebElement cancelButton;
+
+    @FindBy(id = "kc-link-text")
+    private WebElement message;
+
+    @Override
+    public boolean isCurrent() {
+        return PageUtils.getPageTitle(driver).startsWith("Linking ");
+    }
+
+    public void confirm() {
+        UIUtils.clickLink(submitButton);
+    }
+    public void cancel() {
+        UIUtils.clickLink(cancelButton);
+    }
+
+    public void assertIdpInMessage(String expectedIdpDisplayName) {
+        Assert.assertEquals("Do you want to link your account with " + expectedIdpDisplayName + "?", message.getText());
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkEmailPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkEmailPage.java
index 330f9f5c7b6b..b73f05f2406c 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkEmailPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/IdpLinkEmailPage.java
@@ -39,11 +39,6 @@ public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).startsWith("Link ");
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
-
     public String getMessage() {
         return message.getText();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InfoPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InfoPage.java
index 8edb6f3fa47e..9c936ef51758 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InfoPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InfoPage.java
@@ -19,7 +19,7 @@
 
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -56,15 +56,16 @@ public boolean isCurrent() {
         return DroneUtils.getCurrentDriver().getPageSource().contains("kc-info-message");
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public void clickBackToApplicationLink() {
         UIUtils.clickLink(backToApplicationLink);
     }
 
+    public String getBackToApplicationLink() {
+        return backToApplicationLink != null
+                ? backToApplicationLink.getAttribute("href")
+                : null;
+    }
+
     public void clickToContinueDe() {
         clickToContinueDe.click();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java
index 3826176c8aed..ca42e0cf51ef 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/InstalledAppRedirectPage.java
@@ -47,12 +47,6 @@ public class InstalledAppRedirectPage extends AbstractPage {
     @FindBy(css = "div[class^='pf-v5-c-alert'], div[class^='alert-error']")
     private WebElement errorBox;
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException("Use method: open(code, error, errorDescription)");
-    }
-
-
     public void open(String realmName, String code, String error, String errorDescription) {
         try {
             KeycloakUriBuilder kcUriBuilder = KeycloakUriBuilder.fromUri(Urls.realmInstalledAppUrnCallback(new URI(oauth.AUTH_SERVER_ROOT), realmName));
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginConfigTotpPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginConfigTotpPage.java
index c292111a7cd0..cf13c02fadaa 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginConfigTotpPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginConfigTotpPage.java
@@ -89,10 +89,6 @@ public boolean isCurrent() {
         }
     }
 
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public void clickManual() {
         UIUtils.clickLink(manualLink);
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginExpiredPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginExpiredPage.java
index abe51ae20ccc..4e2b25256fac 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginExpiredPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginExpiredPage.java
@@ -25,7 +25,7 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class LoginExpiredPage extends AbstractPage {
+public class LoginExpiredPage extends LanguageComboboxAwarePage {
 
     @FindBy(id = "loginRestartLink")
     private WebElement loginRestartLink;
@@ -42,12 +42,9 @@ public void clickLoginContinueLink() {
         clickLink(loginContinueLink);
     }
 
-
+    @Override
     public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).equals("Page has expired");
     }
 
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPage.java
index cb6f727a4470..d99d57db2e6c 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPage.java
@@ -20,7 +20,7 @@
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.junit.Assert;
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.By;
@@ -91,13 +91,13 @@ public void login(String username, String password) {
         passwordInput.clear();
         passwordInput.sendKeys(password);
 
-        clickLink(submitButton);
+        clickSignIn();
     }
 
     public void loginUsername(String username) {
         clearUsernameInputAndWaitIfNecessary();
         usernameInput.sendKeys(username);
-        clickLink(submitButton);
+        clickSignIn();
     }
 
     private void clearUsernameInputAndWaitIfNecessary() {
@@ -115,6 +115,10 @@ public void login(String password) {
         passwordInput.clear();
         passwordInput.sendKeys(password);
 
+        clickSignIn();
+    }
+
+    public void clickSignIn() {
         clickLink(submitButton);
     }
 
@@ -122,12 +126,12 @@ public void missingPassword(String username) {
         clearUsernameInputAndWaitIfNecessary();
         usernameInput.sendKeys(username);
         passwordInput.clear();
-        clickLink(submitButton);
+        clickSignIn();
     }
 
     public void missingUsername() {
         clearUsernameInputAndWaitIfNecessary();
-        clickLink(submitButton);
+        clickSignIn();
     }
 
     public String getHtmlLanguage() {
@@ -142,6 +146,10 @@ public boolean isUsernameInputEnabled() {
         return usernameInput.isEnabled();
     }
 
+    public String getUsernameAutocomplete() {
+        return usernameInput.getDomAttribute("autocomplete");
+    }
+
     public boolean isUsernameInputPresent() {
         return !driver.findElements(By.id("username")).isEmpty();
     }
@@ -182,6 +190,22 @@ public String getInputError() {
         }
     }
 
+    public String getUsernameInputError() {
+        try {
+            return getTextFromElement(userNameInputError);
+        } catch (NoSuchElementException e) {
+            return null;
+        }
+    }
+
+    public String getPasswordInputError() {
+        try {
+            return getTextFromElement(passwordInputError);
+        } catch (NoSuchElementException e) {
+            return null;
+        }
+    }
+
     public String getError() {
         try {
             return getTextFromElement(loginErrorMessage);
@@ -254,12 +278,19 @@ public boolean isRememberMeChecked() {
         return rememberMe.isSelected();
     }
 
-    @Override
+    /**
+     * @deprecated Use {@link OAuthClient#openLoginForm()}
+     */
+    @Deprecated
     public void open() {
         oauth.openLoginForm();
         assertCurrent();
     }
 
+    /**
+     * @deprecated Use {@link OAuthClient#openLoginForm()}
+     */
+    @Deprecated
     public void open(String realm) {
         oauth.realm(realm);
         oauth.openLoginForm();
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordResetPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordResetPage.java
index 57d8019d2d30..58c79feee6ce 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordResetPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordResetPage.java
@@ -47,6 +47,9 @@ public class LoginPasswordResetPage extends LanguageComboboxAwarePage {
     @FindBy(id = "kc-info-wrapper")
     private WebElement infoWrapper;
 
+    @FindBy(id = "kc-reset-password-form")
+    private WebElement formResetPassword;
+
     public void changePassword() {
         UIUtils.clickLink(submitButton);
     }
@@ -62,10 +65,6 @@ public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).equals("Forgot Your Password?");
     }
 
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public String getSuccessMessage() {
         return emailSuccessMessage != null ? emailSuccessMessage.getText() : null;
     }
@@ -101,4 +100,8 @@ public String getInfoMessage() {
             return null;
         }
     }
+
+    public String getFormUrl() {
+            return formResetPassword.getAttribute("action");
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordUpdatePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordUpdatePage.java
index 3467d86fd11b..6024118d52aa 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordUpdatePage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginPasswordUpdatePage.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -48,21 +49,17 @@ public void changePassword(String newPassword, String passwordConfirm) {
         newPasswordInput.sendKeys(newPassword);
         passwordConfirmInput.sendKeys(passwordConfirm);
 
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 
     public void cancel() {
-        cancelAIAButton.click();
+        UIUtils.clickLink(cancelAIAButton);
     }
 
     public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).equals("Update password");
     }
 
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public String getError() {
         return loginErrorMessage != null ? loginErrorMessage.getText() : null;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginTotpPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginTotpPage.java
index 83e9fcb245ea..12ac6df59130 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginTotpPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginTotpPage.java
@@ -87,12 +87,6 @@ public boolean isCurrent() {
         }
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
-
     // If false, we don't expect that credentials combobox is available. If true, we expect that it is available on the page
     public void assertOtpCredentialSelectorAvailability(boolean expectedAvailability) {
         try {
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfileEditUsernameAllowedPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfileEditUsernameAllowedPage.java
index 15e3b58808df..a2f363ca5be5 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfileEditUsernameAllowedPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfileEditUsernameAllowedPage.java
@@ -46,11 +46,6 @@ public boolean isUsernamePresent() {
         }
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public static class Update extends LoginUpdateProfilePage.Update {
 
         private final LoginUpdateProfileEditUsernameAllowedPage page;
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfilePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfilePage.java
index bf0ecee017ac..d3a2c3bab434 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfilePage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LoginUpdateProfilePage.java
@@ -140,11 +140,6 @@ public boolean isDepartmentPresent() {
         }
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public boolean isCancelDisplayed() {
         try {
             return cancelAIAButton.isDisplayed();
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LogoutConfirmPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LogoutConfirmPage.java
index 36f61369b5ff..52305af90aad 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LogoutConfirmPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/LogoutConfirmPage.java
@@ -44,12 +44,6 @@ public boolean isCurrent(WebDriver driver1) {
         return "Logging out".equals(PageUtils.getPageTitle(driver1));
     }
 
-
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException("Not supported  to directly open logout confirmation page");
-    }
-
     public void confirmLogout() {
         UIUtils.clickLink(confirmLogoutButton);
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuth2DeviceVerificationPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuth2DeviceVerificationPage.java
index 2c00aae68699..c8c6fae02f40 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuth2DeviceVerificationPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuth2DeviceVerificationPage.java
@@ -127,7 +127,4 @@ private boolean isExpiredUserCodePage() {
         return false;
     }
 
-    @Override
-    public void open() {
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuthGrantPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuthGrantPage.java
index bbd7fd392e5e..bbefb433d990 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuthGrantPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/OAuthGrantPage.java
@@ -60,10 +60,6 @@ public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).contains("Grant Access to ");
     }
 
-    @Override
-    public void open() {
-    }
-
     public List<String> getDisplayedGrants() {
         List<String> table = new ArrayList<>();
         WebElement divKcOauth = driver.findElement(By.id("kc-oauth"));
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PasswordPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PasswordPage.java
index 2fd683dd5e5c..96e9c70ca397 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PasswordPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PasswordPage.java
@@ -1,7 +1,7 @@
 package org.keycloak.testsuite.pages;
 
 import org.jboss.arquillian.test.api.ArquillianResource;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
 import org.openqa.selenium.NoSuchElementException;
@@ -38,11 +38,11 @@ public void login(String password) {
         passwordInput.clear();
         passwordInput.sendKeys(password);
 
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 
     public void clickResetPassword() {
-        resetPasswordLink.click();
+        UIUtils.clickLink(resetPasswordLink);
     }
 
     public String getPassword() {
@@ -91,9 +91,4 @@ public boolean isCurrent(String realm) {
         return true;
     }
 
-
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ProceedPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ProceedPage.java
index 97d7c289e019..0fba329de9a5 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ProceedPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ProceedPage.java
@@ -39,11 +39,6 @@ public boolean isCurrent() {
         return driver.getPageSource().contains("kc-info-message") && proceedLink.isDisplayed();
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public void clickProceedLink() {
         proceedLink.click();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PushTheButtonPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PushTheButtonPage.java
index d31558ca9490..08ce26d6cde8 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PushTheButtonPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/PushTheButtonPage.java
@@ -19,6 +19,7 @@
 package org.keycloak.testsuite.pages;
 
 import org.keycloak.testsuite.util.DroneUtils;
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -33,11 +34,6 @@ public class PushTheButtonPage extends AbstractPage {
     @FindBy(name = "submit1")
     private WebElement submitButton;
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     @Override
     public boolean isCurrent() {
         return DroneUtils.getCurrentDriver().getTitle().equals("PushTheButton")
@@ -45,6 +41,6 @@ public boolean isCurrent() {
     }
 
     public void submit() {
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/RegisterPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/RegisterPage.java
index ee97d4fb74e6..7486dda4da9f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/RegisterPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/RegisterPage.java
@@ -36,7 +36,8 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class RegisterPage extends AbstractPage {
+public class RegisterPage extends LanguageComboboxAwarePage
+{
 
     @Page
     private AccountFields.AccountErrors accountErrors;
@@ -80,6 +81,10 @@ public class RegisterPage extends AbstractPage {
     @FindBy(linkText = "« Back to Login")
     private WebElement backToLoginLink;
 
+    public void register(String firstName, String lastName, String email, String username, String password) {
+        register(firstName, lastName, email, username, password, password, null, null, null);
+    }
+
     public void register(String firstName, String lastName, String email, String username, String password, String passwordConfirm) {
         register(firstName, lastName, email, username, password, passwordConfirm, null, null, null);
     }
@@ -145,6 +150,10 @@ public void register(String firstName, String lastName, String email, String use
         UIUtils.clickLink(submitButton);
     }
 
+    public void registerWithEmailAsUsername(String firstName, String lastName, String email, String password) {
+        registerWithEmailAsUsername(firstName, lastName, email, password, password);
+    }
+
     public void registerWithEmailAsUsername(String firstName, String lastName, String email, String password, String passwordConfirm) {
         firstNameInput.clear();
         if (firstName != null) {
@@ -275,14 +284,8 @@ public PasswordFields.PasswordErrors getInputPasswordErrors(){
         return passwordErrors;
     }
 
-    @Override
-    public void open() {
-        oauth.openRegistrationForm();
-        assertCurrent();
-    }
-
     public void openWithLoginHint(String loginHint) {
-        oauth.addCustomParameter(OIDCLoginProtocol.LOGIN_HINT_PARAM, loginHint).openRegistrationForm();
+        oauth.registrationForm().loginHint(loginHint).open();
         assertCurrent();
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ResetOtpPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ResetOtpPage.java
index cee0acd99eb9..fc6e7f9543b0 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ResetOtpPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/ResetOtpPage.java
@@ -1,5 +1,6 @@
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -17,16 +18,11 @@ public boolean isCurrent() {
         return description.getText().equals("Which OTP configuration should be removed?");
     }
 
-    @Override
-    public void open() throws Exception {
-        // This page is part of the reset credentials flow, so you shouldn't be able to open it by itself.
-    }
-
     public void selectOtp(int index) {
         driver.findElement(By.id("kc-otp-credential-" + index)).click();
     }
 
     public void submitOtpReset() {
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectAuthenticatorPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectAuthenticatorPage.java
index 05c76db154a7..46a92f85d8a4 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectAuthenticatorPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectAuthenticatorPage.java
@@ -94,8 +94,4 @@ public boolean isCurrent() {
         return true;
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectOrganizationPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectOrganizationPage.java
index bae5fd640b6a..0c5011c00386 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectOrganizationPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SelectOrganizationPage.java
@@ -22,7 +22,7 @@
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.junit.Assert;
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.By;
 import org.openqa.selenium.NoSuchElementException;
 import org.openqa.selenium.WebElement;
@@ -45,11 +45,6 @@ public boolean isCurrent() {
         return false;
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
     public void assertCurrent(String realm) {
         String name = getClass().getSimpleName();
         Assert.assertTrue("Expected " + name + " but was " + DroneUtils.getCurrentDriver().getTitle() + " (" + DroneUtils.getCurrentDriver().getCurrentUrl() + ")",
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SetupRecoveryAuthnCodesPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SetupRecoveryAuthnCodesPage.java
index 7b0b6d21cbbe..f96d9265f418 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SetupRecoveryAuthnCodesPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/SetupRecoveryAuthnCodesPage.java
@@ -1,6 +1,8 @@
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
+import org.openqa.selenium.JavascriptExecutor;
 import org.openqa.selenium.NoSuchElementException;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
@@ -17,12 +19,36 @@ public class SetupRecoveryAuthnCodesPage extends LogoutSessionsPage {
     @FindBy(id = "saveRecoveryAuthnCodesBtn")
     private WebElement saveRecoveryAuthnCodesButton;
 
-    @FindBy(id="kcRecoveryCodesConfirmationCheck")
+    @FindBy(id = "kcRecoveryCodesConfirmationCheck")
     private WebElement kcRecoveryCodesConfirmationCheck;
 
+    @FindBy(name = "generatedRecoveryAuthnCodes")
+    private WebElement generatedRecoveryAuthnCodesHidden;
+
+    @FindBy(name = "generatedAt")
+    private WebElement generatedAtHidden;
+
     public void clickSaveRecoveryAuthnCodesButton() {
-        kcRecoveryCodesConfirmationCheck.click();
-        saveRecoveryAuthnCodesButton.click();
+        UIUtils.switchCheckbox(kcRecoveryCodesConfirmationCheck, true);
+        UIUtils.clickLink(saveRecoveryAuthnCodesButton);
+    }
+
+    public String getGeneratedRecoveryAuthnCodesHidden() {
+        return generatedRecoveryAuthnCodesHidden.getAttribute("value");
+    }
+
+    public void setGeneratedRecoveryAuthnCodesHidden(String codes) {
+        final JavascriptExecutor js = (JavascriptExecutor) driver;
+        js.executeScript("document.getElementsByName('generatedRecoveryAuthnCodes')[0].value='" + codes + "'");
+    }
+
+    public String getGeneratedAtHidden() {
+        return generatedAtHidden.getAttribute("value");
+    }
+
+    public void setGeneratedAtHidden(String at) {
+        final JavascriptExecutor js = (JavascriptExecutor) driver;
+        js.executeScript("document.getElementsByName('generatedAt')[0].value='" + at + "'");
     }
 
     public List<String> getRecoveryAuthnCodes() {
@@ -49,8 +75,4 @@ public boolean isCurrent() {
         return true;
     }
 
-    @Override
-    public void open() throws Exception {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/TermsAndConditionsPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/TermsAndConditionsPage.java
index 6ca6bf2c9019..5dd13ce6c8c1 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/TermsAndConditionsPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/TermsAndConditionsPage.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.testsuite.pages;
 
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -30,20 +31,16 @@ public class TermsAndConditionsPage extends AbstractPage {
     @FindBy(id = "kc-decline")
     private WebElement cancelButton;
 
+    @Override
     public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).equals("Terms and Conditions");
     }
 
     public void acceptTerms() {
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
     public void declineTerms() {
-        cancelButton.click();
-    }
-
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
+        UIUtils.clickLink(cancelButton);
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/UpdateAccountInformationPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/UpdateAccountInformationPage.java
index caffced7db14..81d9d08ede5b 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/UpdateAccountInformationPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/UpdateAccountInformationPage.java
@@ -97,7 +97,7 @@ public void updateAccountInformation(String firstName,
 
     @Override
     public boolean isCurrent() {
-        return PageUtils.getPageTitle(driver).equalsIgnoreCase("update account information");
+        return PageUtils.getPageTitle(driver) != null && PageUtils.getPageTitle(driver).equalsIgnoreCase("update account information");
     }
 
     public String getLabelForField(String fieldId) {
@@ -112,8 +112,4 @@ public boolean isDepartmentPresent() {
         }
     }
 
-    @Override
-    public void open() throws Exception {
-
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyEmailPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyEmailPage.java
index ef0516133f3e..b68129139eea 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyEmailPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyEmailPage.java
@@ -18,7 +18,7 @@
 package org.keycloak.testsuite.pages;
 
 import org.jboss.arquillian.test.api.ArquillianResource;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -33,9 +33,8 @@ public class VerifyEmailPage extends AbstractPage {
     @FindBy(linkText = "Click here")
     private WebElement resendEmailLink;
 
-    @Override
-    public void open() {
-    }
+    @FindBy(name = "cancel-aia")
+    private WebElement cancelAIAButton;
 
     public boolean isCurrent() {
         return PageUtils.getPageTitle(driver).equals("Email verification");
@@ -49,4 +48,8 @@ public String getResendEmailLink() {
         return resendEmailLink.getAttribute("href");
     }
 
+    public void cancel() {
+        cancelAIAButton.click();
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyProfilePage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyProfilePage.java
index 0422377ab8f9..8b9da3c959e2 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyProfilePage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/VerifyProfilePage.java
@@ -64,7 +64,7 @@ public void update(String firstName, String lastName) {
             lastNameInput.sendKeys(lastName);
         }
 
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 
     public void update(String firstName, String lastName, String department) {
@@ -93,7 +93,7 @@ public void updateEmail(String email, String firstName, String lastName) {
             lastNameInput.sendKeys(lastName);
         }
 
-        submitButton.click();
+        UIUtils.clickLink(submitButton);
     }
 
     public String getAlertError() {
@@ -169,9 +169,4 @@ public AccountFields.AccountErrors getInputAccountErrors(){
         return accountErrors;
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/InstagramLoginPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/InstagramLoginPage.java
index 9906e5251dab..98ebdd3cda31 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/InstagramLoginPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/InstagramLoginPage.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.testsuite.pages.social;
 
+import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.Keys;
 import org.openqa.selenium.NoSuchElementException;
 import org.openqa.selenium.WebElement;
@@ -37,6 +38,9 @@ public class InstagramLoginPage extends AbstractSocialLoginPage {
     @FindBy(xpath = "//button[text()='Save info']")
     private WebElement saveInfoBtn;
 
+    @FindBy(xpath = "//div[text()='Not now']")
+    private WebElement notNowBtn;
+
     @FindBy(xpath = "//div[@aria-label='Allow']")
     private WebElement allowBtn;
 
@@ -47,9 +51,10 @@ public void login(String user, String password) {
             usernameInput.sendKeys(user);
             passwordInput.sendKeys(password);
             passwordInput.sendKeys(Keys.RETURN);
-            pause(3000);
+            pause(5000);
 
             try {
+                WaitUtils.waitUntilElement(saveInfoBtn).is().visible();
                 saveInfoBtn.click();
                 pause(3000);
             }
@@ -64,9 +69,11 @@ public void login(String user, String password) {
 
         // Approval dialog
         try {
+            WaitUtils.waitUntilElement(allowBtn).is().visible();
             allowBtn.click();
         } catch (NoSuchElementException e) {
             log.info("'Allow' button not found, ignoring");
         }
     }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/TwitterLoginPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/TwitterLoginPage.java
index d4bd250f81cd..12f4271b68a8 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/TwitterLoginPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/social/TwitterLoginPage.java
@@ -18,14 +18,19 @@
 package org.keycloak.testsuite.pages.social;
 
 import org.keycloak.testsuite.util.WaitUtils;
+import org.openqa.selenium.By;
 import org.openqa.selenium.Keys;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
+import java.util.List;
+
+import static org.keycloak.testsuite.util.WaitUtils.pause;
 
 /**
  * @author Vaclav Muzikar <vmuzikar@redhat.com>
  */
 public class TwitterLoginPage extends AbstractSocialLoginPage {
+    private static final String signInBtnLocator = "allow";
 
     @FindBy(xpath = "//input[@type='text']")
     private WebElement usernameInput;
@@ -33,15 +38,29 @@ public class TwitterLoginPage extends AbstractSocialLoginPage {
     @FindBy(xpath = "//input[@type='password']")
     private WebElement passwordInput;
 
+    @FindBy(id = signInBtnLocator)
+    private WebElement signInBtn;
+
     @Override
     public void login(String user, String password) {
         // new login page is two phase login (username and then password) and it
         // needs lots of JS, twitter does not work with default HtmlUnit driver
+
+       List<WebElement> signInBtn = driver.findElements(By.id(signInBtnLocator));
+        if (signInBtn.size() > 0) {
+            signInBtn.get(0).click();
+        }
+
+        pause(3000);
         usernameInput.clear();
         usernameInput.sendKeys(user);
+        usernameInput.sendKeys(Keys.RETURN);
 
+        // wait for the password input to appear
+        WaitUtils.waitUntilElement(passwordInput).is().visible();
         passwordInput.clear();
         passwordInput.sendKeys(password);
         passwordInput.sendKeys(Keys.RETURN);
+
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java
index e1e95ea3c210..86ed755c0708 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/x509/X509IdentityConfirmationPage.java
@@ -20,7 +20,7 @@
 
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.keycloak.testsuite.pages.LanguageComboboxAwarePage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebElement;
 import org.openqa.selenium.support.FindBy;
 
@@ -84,9 +84,4 @@ public boolean isCurrent() {
         return driver.getTitle().equals("Sign in to test") || driver.getTitle().equals("Anmeldung bei test");
     }
 
-    @Override
-    public void open() {
-        oauth.openLoginForm();
-        assertCurrent();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
index 244512f9a08c..56ba742a5214 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
@@ -159,6 +159,11 @@ public ClientAttributeUpdater addDefaultClientScope(String clientScope) {
         return this;
     }
 
+    public ClientAttributeUpdater addOptionalClientScope(String clientScope) {
+        rep.getOptionalClientScopes().add(clientScope);
+        return this;
+    }
+
     public ClientAttributeUpdater setDirectAccessGrantsEnabled(Boolean directAccessGranted) {
         rep.setDirectAccessGrantsEnabled(directAccessGranted);
         return this;
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/RealmAttributeUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/RealmAttributeUpdater.java
index 1138e71f899e..820d007f9263 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/RealmAttributeUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/RealmAttributeUpdater.java
@@ -4,6 +4,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 
@@ -100,6 +101,11 @@ public RealmAttributeUpdater setPermanentLockout(Boolean value) {
         return this;
     }
 
+    public RealmAttributeUpdater setQuickLoginCheckMilliSeconds(Long value) {
+        rep.setQuickLoginCheckMilliSeconds(value);
+        return this;
+    }
+
     public RealmAttributeUpdater setEventsListeners(List<String> eventListanets) {
         rep.setEventsListeners(eventListanets);
         return this;
@@ -143,6 +149,9 @@ public RealmAttributeUpdater setDefaultLocale(String defaultLocale) {
     }
 
     public RealmAttributeUpdater addSupportedLocale(String locale) {
+        if (origRep.getSupportedLocales() == null) {
+            origRep.setSupportedLocales(Collections.emptySet());
+        }
         rep.addSupportedLocales(locale);
         return this;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/AdminClientUtil.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/AdminClientUtil.java
index 1d0154c8e31c..6e91d8ce1e90 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/AdminClientUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/AdminClientUtil.java
@@ -137,12 +137,7 @@ public static ResteasyClient createResteasyClient() {
     public static ResteasyClient createResteasyClient(boolean ignoreUnknownProperties, Boolean followRedirects) throws CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, KeyManagementException {
         ResteasyClientBuilder resteasyClientBuilder = (ResteasyClientBuilder) ResteasyClientBuilder.newBuilder();
 
-        if ("true".equals(System.getProperty("auth.server.ssl.required"))) {
-            File truststore = new File(PROJECT_BUILD_DIRECTORY, "dependency/keystore/keycloak.truststore");
-            resteasyClientBuilder.sslContext(getSSLContextWithTruststore(truststore, "secret"));
-
-            System.setProperty("javax.net.ssl.trustStore", truststore.getAbsolutePath());
-        }
+        resteasyClientBuilder.sslContext(getSSLContextWithTruststore());
 
         // We need to ignore unknown JSON properties e.g. in the adapter configuration representation
         // during adapter backward compatibility testing
@@ -199,6 +194,19 @@ private static SSLContext getSSLContextWithTruststore(File file, String password
         return theContext;
     }
 
+    public static SSLContext getSSLContextWithTruststore() {
+        try {
+            if ("true".equals(System.getProperty("auth.server.ssl.required"))) {
+                File truststore = new File(PROJECT_BUILD_DIRECTORY, "dependency/keystore/keycloak.truststore");
+                System.setProperty("javax.net.ssl.trustStore", truststore.getAbsolutePath());
+                return getSSLContextWithTruststore(truststore, "secret");
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return null;
+    }
+
     private static SSLContext getSSLContextWithTruststoreAndKeystore(
         File trustStore, String truststorePassword, File keystore, String keystorePassword)
         throws CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, KeyManagementException, UnrecoverableKeyException {
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/DroneUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/DroneUtils.java
index 504393aadbb7..1c94f7250c9f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/DroneUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/DroneUtils.java
@@ -20,6 +20,7 @@
 import org.jboss.arquillian.graphene.context.GrapheneContext;
 import org.jboss.arquillian.graphene.page.Page;
 import org.keycloak.testsuite.page.AbstractPage;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 import java.lang.reflect.Field;
 import java.util.ArrayList;
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/HttpClientUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/HttpClientUtils.java
new file mode 100644
index 000000000000..16c46ba1261b
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/HttpClientUtils.java
@@ -0,0 +1,27 @@
+package org.keycloak.testsuite.util;
+
+import org.apache.http.client.RedirectStrategy;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.DefaultRedirectStrategy;
+import org.apache.http.impl.client.HttpClientBuilder;
+
+public class HttpClientUtils {
+
+    private static final boolean SSL_REQUIRED = Boolean.parseBoolean(System.getProperty("auth.server.ssl.required"));
+
+    public static CloseableHttpClient createDefault() {
+        return createDefault(DefaultRedirectStrategy.INSTANCE);
+    }
+
+    public static CloseableHttpClient createDefault(RedirectStrategy redirectStrategy) {
+        if (SSL_REQUIRED) {
+            String keyStorePath = System.getProperty("client.certificate.keystore");
+            String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
+            String trustStorePath = System.getProperty("client.truststore");
+            String trustStorePassword = System.getProperty("client.truststore.passphrase");
+            return MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword, redirectStrategy);
+        }
+        return HttpClientBuilder.create().build();
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/LDAPRule.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/LDAPRule.java
index 2f50b41b4621..41116dfdeb7a 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/LDAPRule.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/LDAPRule.java
@@ -307,4 +307,8 @@ public enum Encryption {
             STARTTLS
         }
     }
+
+    public boolean isEmbeddedServer() {
+        return ldapTestConfiguration.isStartEmbeddedLdapServer();
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java
index a4ea9ec04384..01a9f51ceee7 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/MutualTLSUtils.java
@@ -1,10 +1,17 @@
 package org.keycloak.testsuite.util;
 
-import jakarta.ws.rs.client.Client;
-import jakarta.ws.rs.client.ClientBuilder;
-import jakarta.ws.rs.client.WebTarget;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.Response;
+import org.apache.http.client.RedirectStrategy;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.DefaultRedirectStrategy;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.keycloak.common.util.Base64Url;
+import org.keycloak.common.util.KeystoreUtil;
+
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
 import java.security.KeyManagementException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
@@ -14,15 +21,6 @@
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.Enumeration;
-import javax.net.ssl.KeyManagerFactory;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManagerFactory;
-import org.apache.http.conn.ssl.NoopHostnameVerifier;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.keycloak.common.util.Base64Url;
-import org.keycloak.common.util.KeystoreUtil;
 
 /**
  * Utilities for Holder of key mechanism and other Mutual TLS tests.
@@ -65,6 +63,10 @@ public static CloseableHttpClient newCloseableHttpClientWithoutKeyStoreAndTrustS
     }
 
     public static CloseableHttpClient newCloseableHttpClient(String keyStorePath, String keyStorePassword, String trustStorePath, String trustStorePassword) {
+        return newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword, DefaultRedirectStrategy.INSTANCE);
+    }
+
+    public static CloseableHttpClient newCloseableHttpClient(String keyStorePath, String keyStorePassword, String trustStorePath, String trustStorePassword, RedirectStrategy redirectStrategy) {
 
         KeyStore keystore = null;
         // Load the keystore file
@@ -87,13 +89,13 @@ public static CloseableHttpClient newCloseableHttpClient(String keyStorePath, St
         }
 
         if (keystore != null || truststore != null) {
-            return newCloseableHttpClientSSL(keystore, keyStorePassword, truststore);
+            return newCloseableHttpClientSSL(keystore, keyStorePassword, truststore, redirectStrategy);
         }
 
-        return HttpClientBuilder.create().build();
+        return HttpClientBuilder.create().setRedirectStrategy(redirectStrategy).build();
     }
 
-    public static CloseableHttpClient newCloseableHttpClientSSL(KeyStore keystore, String keyStorePassword, KeyStore truststore) {
+    public static CloseableHttpClient newCloseableHttpClientSSL(KeyStore keystore, String keyStorePassword, KeyStore truststore, RedirectStrategy redirectStrategy) {
         try {
             SSLContext sslContext = SSLContext.getInstance("TLS");
             KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
@@ -103,7 +105,7 @@ public static CloseableHttpClient newCloseableHttpClientSSL(KeyStore keystore, S
             sslContext.init(kmfactory.getKeyManagers(), tmf.getTrustManagers(), null);
             SSLConnectionSocketFactory sf = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
 
-            return HttpClientBuilder.create().setSSLSocketFactory(sf).build();
+            return HttpClientBuilder.create().setSSLSocketFactory(sf).setRedirectStrategy(redirectStrategy).build();
         } catch (NoSuchAlgorithmException|KeyStoreException|KeyManagementException|UnrecoverableKeyException e) {
             throw new RuntimeException(e);
         }
@@ -144,30 +146,4 @@ public static String getThumbprintFromClientCert(String keyStorePath, String key
         return DERX509Base64UrlEncoded;
     }
 
-    public static Response executeUserInfoRequestInGetMethod(String accessToken, boolean isKeystoreUsed, String keystorePath, String keystorePassward) {
-        ClientBuilder clientBuilder = ClientBuilder.newBuilder();
-        KeyStore keystore = null;
-        // Load the keystore file
-        if(isKeystoreUsed) {
-            try {
-                if (keystorePath != null) {
-                    keystore = KeystoreUtil.loadKeyStore(keystorePath, keystorePassward);
-                    clientBuilder.keyStore(keystore, keystorePassward);
-                } else {
-                    keystore = KeystoreUtil.loadKeyStore(DEFAULT_KEYSTOREPATH, DEFAULT_KEYSTOREPASSWORD);
-                    clientBuilder.keyStore(keystore, DEFAULT_KEYSTOREPASSWORD);
-                }
-            } catch (Exception e) {
-                e.printStackTrace();
-            }
-        }
-        Client client = clientBuilder.build();
-        WebTarget userInfoTarget = null;
-        try {
-            userInfoTarget = UserInfoClientUtil.getUserInfoWebTarget(client);
-        } finally {
-            client.close();
-        }
-        return userInfoTarget.request().header(HttpHeaders.AUTHORIZATION, "bearer " + accessToken).get();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java
deleted file mode 100644
index 7755fa26853a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java
+++ /dev/null
@@ -1,2352 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.util;
-
-import jakarta.ws.rs.client.Entity;
-import jakarta.ws.rs.core.Form;
-import jakarta.ws.rs.core.UriBuilder;
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.io.output.ByteArrayOutputStream;
-import org.apache.http.Header;
-import org.apache.http.NameValuePair;
-import org.apache.http.client.entity.UrlEncodedFormEntity;
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.client.methods.HttpOptions;
-import org.apache.http.client.methods.HttpPost;
-import org.apache.http.client.utils.URLEncodedUtils;
-import org.apache.http.entity.ContentType;
-import org.apache.http.entity.StringEntity;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.message.BasicNameValuePair;
-import org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver;
-import org.junit.Assert;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.TokenVerifier;
-import org.keycloak.broker.provider.util.SimpleHttp;
-import org.keycloak.common.VerificationException;
-import org.keycloak.constants.AdapterConstants;
-import org.keycloak.crypto.Algorithm;
-import org.keycloak.crypto.AsymmetricSignatureSignerContext;
-import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
-import org.keycloak.crypto.KeyUse;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.ServerECDSASignatureSignerContext;
-import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
-import org.keycloak.crypto.SignatureSignerContext;
-import org.keycloak.jose.jwk.JSONWebKeySet;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jwk.JWKParser;
-import org.keycloak.jose.jwk.OKPPublicJWK;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.models.Constants;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
-import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
-import org.keycloak.protocol.oidc.grants.ciba.CibaGrantType;
-import org.keycloak.protocol.oidc.grants.ciba.channel.AuthenticationChannelResponse;
-import org.keycloak.protocol.oidc.par.endpoints.ParEndpoint;
-import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
-import org.keycloak.protocol.oidc.utils.OIDCResponseType;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.AuthorizationResponseToken;
-import org.keycloak.representations.ClaimsRepresentation;
-import org.keycloak.representations.IDToken;
-import org.keycloak.representations.JsonWebToken;
-import org.keycloak.representations.RefreshToken;
-import org.keycloak.representations.UserInfo;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
-import org.keycloak.testsuite.runonserver.RunOnServerException;
-import org.keycloak.util.BasicAuthHelper;
-import org.keycloak.util.JsonSerialization;
-import org.keycloak.util.TokenUtil;
-import org.keycloak.utils.MediaType;
-import org.openqa.selenium.By;
-import org.openqa.selenium.NoSuchElementException;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.URLEncoder;
-import java.nio.charset.StandardCharsets;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Consumer;
-import java.util.function.Supplier;
-
-import static org.keycloak.protocol.oidc.OIDCLoginProtocol.LOGIN_HINT_PARAM;
-import static org.keycloak.protocol.oidc.grants.ciba.CibaGrantType.AUTH_REQ_ID;
-import static org.keycloak.protocol.oidc.grants.ciba.CibaGrantType.BINDING_MESSAGE;
-import static org.keycloak.protocol.oidc.grants.device.DeviceGrantType.oauth2DeviceAuthUrl;
-import static org.keycloak.testsuite.admin.Users.getPasswordOf;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-import static org.keycloak.testsuite.util.ServerURLs.removeDefaultPorts;
-import static org.keycloak.testsuite.util.UIUtils.clickLink;
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class OAuthClient {
-
-    private static final Logger logger = LoggerFactory.getLogger(OAuthClient.class);
-
-    public static String SERVER_ROOT;
-    public static String AUTH_SERVER_ROOT;
-    public static String APP_ROOT;
-    public static String APP_AUTH_ROOT;
-    private static final boolean sslRequired = Boolean.parseBoolean(System.getProperty("auth.server.ssl.required"));
-
-    static {
-        updateURLs(getAuthServerContextRoot());
-    }
-
-    // Workaround, but many tests directly use system properties like OAuthClient.AUTH_SERVER_ROOT instead of taking the URL from suite context
-    public static void updateURLs(String serverRoot) {
-        SERVER_ROOT = removeDefaultPorts(serverRoot);
-        AUTH_SERVER_ROOT = SERVER_ROOT + "/auth";
-        updateAppRootRealm("master");
-    }
-
-    public static void updateAppRootRealm(String realm) {
-        APP_ROOT = AUTH_SERVER_ROOT + "/realms/" + realm + "/app";
-        APP_AUTH_ROOT = APP_ROOT + "/auth";
-    }
-
-    public static void resetAppRootRealm() {
-        updateAppRootRealm("master");
-    }
-
-    private WebDriver driver;
-
-    private String baseUrl = AUTH_SERVER_ROOT;
-
-    private String realm;
-
-    private String clientId;
-
-    private String redirectUri;
-
-    private String postLogoutRedirectUri;
-
-    private String idTokenHint;
-
-    private String initiatingIDP;
-
-    private String kcAction;
-
-    private StateParamProvider state;
-
-    private String scope;
-
-    private String uiLocales;
-
-    private String clientSessionState;
-
-    private String clientSessionHost;
-
-    private String maxAge;
-
-    private String prompt;
-
-    private String responseType;
-
-    private String responseMode;
-
-    private String nonce;
-
-    private String request;
-
-    private String requestUri;
-
-    private String claims;
-
-    private Map<String, String> requestHeaders;
-
-    private Map<String, JSONWebKeySet> publicKeys = new HashMap<>();
-
-    // https://tools.ietf.org/html/rfc7636#section-4
-    private String codeVerifier;
-    private String codeChallenge;
-    private String codeChallengeMethod;
-    private String origin;
-    private String dpopProof;
-    private String dpopJkt;
-
-    private Map<String, String> customParameters;
-
-    private boolean openid = true;
-
-    private Supplier<CloseableHttpClient> httpClient = OAuthClient::newCloseableHttpClient;
-
-    public class LogoutUrlBuilder {
-        private final UriBuilder b = OIDCLoginProtocolService.logoutUrl(UriBuilder.fromUri(baseUrl));
-
-        public LogoutUrlBuilder clientId(String clientId) {
-            if (clientId != null) {
-                b.queryParam(OIDCLoginProtocol.CLIENT_ID_PARAM, clientId);
-            }
-            return this;
-        }
-
-        public LogoutUrlBuilder idTokenHint(String idTokenHint) {
-            if (idTokenHint != null) {
-                b.queryParam(OIDCLoginProtocol.ID_TOKEN_HINT, idTokenHint);
-            }
-            return this;
-        }
-
-        public LogoutUrlBuilder postLogoutRedirectUri(String redirectUri) {
-            if (redirectUri != null) {
-                b.queryParam(OIDCLoginProtocol.POST_LOGOUT_REDIRECT_URI_PARAM, redirectUri);
-            }
-            return this;
-        }
-
-        public LogoutUrlBuilder state(String state) {
-            if (state != null) {
-                b.queryParam(OIDCLoginProtocol.STATE_PARAM, state);
-            }
-            return this;
-        }
-
-        public LogoutUrlBuilder uiLocales(String uiLocales) {
-            if (uiLocales != null) {
-                b.queryParam(OIDCLoginProtocol.UI_LOCALES_PARAM, uiLocales);
-            }
-            return this;
-        }
-
-        public LogoutUrlBuilder initiatingIdp(String initiatingIdp) {
-            if (initiatingIdp != null) {
-                b.queryParam(AuthenticationManager.INITIATING_IDP_PARAM, initiatingIdp);
-            }
-            return this;
-        }
-
-        public String build() {
-            return b.build(realm).toString();
-        }
-    }
-
-    public class BackchannelLogoutUrlBuilder {
-        private final String backchannelLogoutPath = "/backchannel-logout";
-
-        private final UriBuilder b = OIDCLoginProtocolService.logoutUrl(UriBuilder.fromUri(baseUrl)).path(backchannelLogoutPath);
-
-        public String build() {
-            return b.build(realm).toString();
-        }
-    }
-
-    public void init(WebDriver driver) {
-        this.driver = driver;
-
-        baseUrl = AUTH_SERVER_ROOT;
-        realm = "test";
-        clientId = "test-app";
-        redirectUri = APP_ROOT + "/auth";
-        postLogoutRedirectUri = APP_ROOT + "/auth";
-        state = () -> {
-            return KeycloakModelUtils.generateId();
-        };
-        scope = null;
-        uiLocales = null;
-        clientSessionState = null;
-        clientSessionHost = null;
-        maxAge = null;
-        prompt = null;
-        responseType = OAuth2Constants.CODE;
-        responseMode = null;
-        nonce = null;
-        request = null;
-        requestUri = null;
-        claims = null;
-        // https://tools.ietf.org/html/rfc7636#section-4
-        codeVerifier = null;
-        codeChallenge = null;
-        codeChallengeMethod = null;
-        origin = null;
-        dpopProof = null;
-        dpopJkt = null;
-        customParameters = null;
-        openid = true;
-    }
-
-    public void setDriver(WebDriver driver) {
-        this.driver = driver;
-    }
-
-    public AuthorizationEndpointResponse doLogin(String username, String password) {
-        openLoginForm();
-        fillLoginForm(username, password);
-
-        return new AuthorizationEndpointResponse(this);
-    }
-
-    public AuthorizationEndpointResponse doSilentLogin() {
-        openLoginForm();
-        WaitUtils.waitForPageToLoad();
-
-        return new AuthorizationEndpointResponse(this);
-    }
-
-    public AuthorizationEndpointResponse doLoginSocial(String brokerId, String username, String password) {
-        openLoginForm();
-        WaitUtils.waitForPageToLoad();
-
-        WebElement socialButton = findSocialButton(brokerId);
-        clickLink(socialButton);
-        fillLoginForm(username, password);
-
-        return new AuthorizationEndpointResponse(this);
-    }
-
-    public void updateAccountInformation(String username, String email) {
-        WaitUtils.waitForPageToLoad();
-        updateAccountInformation(username, email, "First", "Last");
-    }
-
-    public void linkUsers(String username, String password) {
-        WaitUtils.waitForPageToLoad();
-        WebElement linkAccountButton = driver.findElement(By.id("linkAccount"));
-        waitUntilElement(linkAccountButton).is().clickable();
-        linkAccountButton.click();
-
-        WaitUtils.waitForPageToLoad();
-        fillLoginForm(username, password, false);
-    }
-
-    public AuthorizationEndpointResponse doLogin(UserRepresentation user) {
-
-        return doLogin(user.getUsername(), getPasswordOf(user));
-    }
-
-    public AuthorizationEndpointResponse doRememberMeLogin(String username, String password) {
-        openLoginForm();
-        fillLoginForm(username, password, true);
-
-        return new AuthorizationEndpointResponse(this);
-    }
-
-    public void fillLoginForm(String username, String password) {
-        this.fillLoginForm(username, password, false);
-    }
-
-    public void fillLoginForm(String username, String password, boolean rememberMe) {
-        WaitUtils.waitForPageToLoad();
-        String src = driver.getPageSource();
-        WebElement usernameField = driver.findElement(By.name("username"));
-
-        try {
-            usernameField.clear();
-            usernameField.sendKeys(username);
-        } catch (NoSuchElementException nse) {
-            // we might have clicked on a social login icon and might need to wait for the login to appear.
-            // avoid waiting by default to avoid the delay.
-            WaitUtils.waitUntilElement(usernameField).is().present();
-            usernameField.clear();
-        } catch (Throwable t) {
-            logger.error("Unexpected page was loaded\n{}", src);
-            throw t;
-        }
-
-        WebElement passwordField = driver.findElement(By.name("password"));
-        passwordField.clear();
-        passwordField.sendKeys(password);
-
-        if (rememberMe) {
-            driver.findElement(By.id("rememberMe")).click();
-        }
-
-        driver.findElement(By.name("login")).click();
-
-    }
-
-    private void updateAccountInformation(String username, String email, String firstName, String lastName) {
-
-        WebElement usernameInput = driver.findElement(By.name("username"));
-        usernameInput.clear();
-        usernameInput.sendKeys(username);
-
-        WebElement emailInput = driver.findElement(By.name("email"));
-        emailInput.clear();
-        emailInput.sendKeys(email);
-
-        WebElement firstNameInput = driver.findElement(By.name("firstName"));
-        firstNameInput.clear();
-        firstNameInput.sendKeys(firstName);
-
-        WebElement lastNameInput = driver.findElement(By.name("lastName"));
-        lastNameInput.clear();
-        lastNameInput.sendKeys(lastName);
-
-        WebElement submitButton = driver.findElement(By.cssSelector("input[type=\"submit\"]"));
-        waitUntilElement(submitButton).is().clickable();
-        submitButton.click();
-    }
-
-    public void doLoginGrant(String username, String password) {
-        openLoginForm();
-        fillLoginForm(username, password);
-    }
-
-    public OAuthClient httpClient(Supplier<CloseableHttpClient> client) {
-        this.httpClient = client;
-        return this;
-    }
-
-    public Supplier<CloseableHttpClient> getHttpClient() {
-        return httpClient;
-    }
-
-    public static CloseableHttpClient newCloseableHttpClient() {
-        if (sslRequired) {
-            String keyStorePath = System.getProperty("client.certificate.keystore");
-            String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
-            String trustStorePath = System.getProperty("client.truststore");
-            String trustStorePassword = System.getProperty("client.truststore.passphrase");
-            return newCloseableHttpClientSSL(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword);
-        }
-        return HttpClientBuilder.create().build();
-    }
-
-    public static CloseableHttpClient newCloseableHttpClientSSL(String keyStorePath,
-                                                                String keyStorePassword, String trustStorePath, String trustStorePassword) {
-        return MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword);
-    }
-
-    public CloseableHttpResponse doPreflightRequest() {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpOptions options = new HttpOptions(getAccessTokenUrl());
-            options.setHeader("Origin", "http://example.com");
-
-            return client.execute(options);
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public AccessTokenResponse doAccessTokenRequest(String code, String password) {
-        try (CloseableHttpClient client = httpClient.get()) {
-            return doAccessTokenRequest(code, password, client);
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public AccessTokenResponse doAccessTokenRequest(String code, String password, CloseableHttpClient client) {
-        HttpPost post = new HttpPost(getAccessTokenUrl());
-
-        List<NameValuePair> parameters = new LinkedList<>();
-        parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
-
-        if (origin != null) {
-            post.addHeader("Origin", origin);
-        }
-        if (code != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
-        }
-        if (redirectUri != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, redirectUri));
-        }
-        if (clientId != null && password != null) {
-            String authorization = BasicAuthHelper.createHeader(clientId, password);
-            post.setHeader("Authorization", authorization);
-        } else if (clientId != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-        }
-
-        if (clientSessionState != null) {
-            parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, clientSessionState));
-        }
-
-        if (clientSessionHost != null) {
-            parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, clientSessionHost));
-        }
-
-        // https://tools.ietf.org/html/rfc7636#section-4.5
-        if (codeVerifier != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
-        }
-
-        if (dpopProof != null) {
-            post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-        }
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        try {
-            return new AccessTokenResponse(client.execute(post));
-        } catch (Exception e) {
-            throw new RuntimeException("Failed to retrieve access token", e);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public String introspectTokenWithClientCredential(String clientId, String clientSecret, String tokenType, String tokenToIntrospect) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return introspectTokenWithClientCredential(clientId, clientSecret, tokenType, tokenToIntrospect, client);
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public String introspectTokenWithClientCredential(String clientId, String clientSecret, String tokenType, String tokenToIntrospect, CloseableHttpClient client) {
-        HttpPost post = new HttpPost(getTokenIntrospectionUrl());
-
-        if (requestHeaders != null) {
-            for (Map.Entry<String, String> header : requestHeaders.entrySet()) {
-                post.addHeader(header.getKey(), header.getValue());
-            }
-        }
-
-        String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-        post.setHeader("Authorization", authorization);
-
-        List<NameValuePair> parameters = new LinkedList<>();
-
-        parameters.add(new BasicNameValuePair("token", tokenToIntrospect));
-        parameters.add(new BasicNameValuePair("token_type_hint", tokenType));
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-
-        post.setEntity(formEntity);
-
-        try (CloseableHttpResponse response = client.execute(post)) {
-            ByteArrayOutputStream out = new ByteArrayOutputStream();
-
-            response.getEntity().writeTo(out);
-            return new String(out.toByteArray());
-        } catch (Exception e) {
-            throw new RuntimeException("Failed to retrieve access token", e);
-        }
-    }
-
-    public String introspectAccessTokenWithClientCredential(String clientId, String clientSecret, String tokenToIntrospect) {
-        return introspectTokenWithClientCredential(clientId, clientSecret, "access_token", tokenToIntrospect);
-    }
-
-    public String introspectRefreshTokenWithClientCredential(String clientId, String clientSecret, String tokenToIntrospect) {
-        return introspectTokenWithClientCredential(clientId, clientSecret, "refresh_token", tokenToIntrospect);
-    }
-
-    public AccessTokenResponse doGrantAccessTokenRequest(String clientSecret, String username, String password) throws Exception {
-        return doGrantAccessTokenRequest(realm, username, password, null, clientId, clientSecret);
-    }
-
-    public AccessTokenResponse doGrantAccessTokenRequest(String clientSecret, String username, String password, String otp) throws Exception {
-        return doGrantAccessTokenRequest(realm, username, password, otp, clientId, clientSecret);
-    }
-
-    public AccessTokenResponse doGrantAccessTokenRequest(String realm, String username, String password, String totp,
-                                                         String clientId, String clientSecret) throws Exception {
-        return doGrantAccessTokenRequest(realm, username, password, totp, clientId, clientSecret, null);
-    }
-
-    public AccessTokenResponse doGrantAccessTokenRequest(String realm, String username, String password, String totp,
-                                                         String clientId, String clientSecret, String userAgent) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getResourceOwnerPasswordCredentialGrantUrl(realm));
-
-            post.addHeader("Accept", MediaType.APPLICATION_JSON);
-
-            if (requestHeaders != null) {
-                for (Map.Entry<String, String> header : requestHeaders.entrySet()) {
-                    post.addHeader(header.getKey(), header.getValue());
-                }
-            }
-            if (dpopProof != null) {
-                post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-            }
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD));
-            parameters.add(new BasicNameValuePair("username", username));
-            parameters.add(new BasicNameValuePair("password", password));
-            if (totp != null) {
-                parameters.add(new BasicNameValuePair("otp", totp));
-
-            }
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            } else {
-                parameters.add(new BasicNameValuePair("client_id", clientId));
-            }
-
-            if (origin != null) {
-                post.addHeader("Origin", origin);
-            }
-
-            if (clientSessionState != null) {
-                parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, clientSessionState));
-            }
-            if (clientSessionHost != null) {
-                parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, clientSessionHost));
-            }
-
-            String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-            if (scopeParam != null && !scopeParam.isEmpty()) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scopeParam));
-            }
-
-            if (userAgent != null) {
-                post.addHeader("User-Agent", userAgent);
-            }
-
-            if (customParameters != null) {
-                customParameters.keySet().stream()
-                        .forEach(paramName -> parameters.add(new BasicNameValuePair(paramName, customParameters.get(paramName))));
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        }
-    }
-
-    public AccessTokenResponse doTokenExchange(String realm, String token, String targetAudience,
-                                               String clientId, String clientSecret) throws Exception {
-        return doTokenExchange(realm, token, targetAudience, clientId, clientSecret, null);
-    }
-
-    public AccessTokenResponse doTokenExchange(String realm, String token, String targetAudience,
-                                               String clientId, String clientSecret, Map<String, String> additionalParams) throws Exception {
-        List<String> targetAudienceList = targetAudience == null ? null : List.of(targetAudience);
-        return doTokenExchange(realm, token, targetAudienceList, clientId, clientSecret, additionalParams);
-    }
-
-    public AccessTokenResponse doTokenExchange(String realm, String token, List<String> targetAudiences,
-                                               String clientId, String clientSecret, Map<String, String> additionalParams) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getResourceOwnerPasswordCredentialGrantUrl(realm));
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE));
-            parameters.add(new BasicNameValuePair(OAuth2Constants.SUBJECT_TOKEN, token));
-            parameters.add(new BasicNameValuePair(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE));
-
-            if (targetAudiences != null) {
-                for (String audience : targetAudiences) {
-                    parameters.add(new BasicNameValuePair(OAuth2Constants.AUDIENCE, audience));
-                }
-            }
-
-            if (additionalParams != null) {
-                for (Map.Entry<String, String> entry : additionalParams.entrySet()) {
-                    parameters.add(new BasicNameValuePair(entry.getKey(), entry.getValue()));
-                }
-            }
-
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            } else {
-                parameters.add(new BasicNameValuePair("client_id", clientId));
-
-            }
-
-            if (clientSessionState != null) {
-                parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, clientSessionState));
-            }
-            if (clientSessionHost != null) {
-                parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, clientSessionHost));
-            }
-            if (scope != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scope));
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        }
-    }
-
-    public AccessTokenResponse doTokenExchange(String realm, String clientId, String clientSecret, Map<String, String> params) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getResourceOwnerPasswordCredentialGrantUrl(realm));
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE));
-            for (Map.Entry<String, String> entry : params.entrySet()) {
-                parameters.add(new BasicNameValuePair(entry.getKey(), entry.getValue()));
-
-            }
-
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            } else {
-                parameters.add(new BasicNameValuePair("client_id", clientId));
-
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        }
-    }
-
-
-    public JSONWebKeySet doCertsRequest(String realm) throws Exception {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpGet get = new HttpGet(getCertsUrl(realm));
-            CloseableHttpResponse response = client.execute(get);
-            return JsonSerialization.readValue(response.getEntity().getContent(), JSONWebKeySet.class);
-        }
-    }
-
-    public AccessTokenResponse doClientCredentialsGrantAccessTokenRequest(String clientSecret) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getServiceAccountUrl());
-
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.RFC6749.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            }
-            if (dpopProof != null) {
-                post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-            }
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
-
-            String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-            if (scopeParam != null && !scopeParam.isEmpty()) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scopeParam));
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        }
-    }
-
-    public AccessTokenResponse doPreauthorizedTokenRequest(String preAuthorizedCode) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getAccessTokenUrl());
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE));
-            parameters.add(new BasicNameValuePair("code", preAuthorizedCode));
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    public AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequest(String clientId, String clientSecret, String userid, String bindingMessage, String acrValues) throws Exception {
-        return doBackchannelAuthenticationRequest(clientId, clientSecret, userid, bindingMessage, acrValues, null, null);
-    }
-
-    public AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequest(String clientId, String clientSecret, String userid, String bindingMessage, String acrValues, String clientNotificationToken, Map<String, String> additionalParams) throws Exception {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(getBackchannelAuthenticationUrl());
-
-            String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-            post.setHeader("Authorization", authorization);
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            if (userid != null) parameters.add(new BasicNameValuePair(LOGIN_HINT_PARAM, userid));
-            if (bindingMessage != null) parameters.add(new BasicNameValuePair(BINDING_MESSAGE, bindingMessage));
-            if (acrValues != null) parameters.add(new BasicNameValuePair(OAuth2Constants.ACR_VALUES, acrValues));
-            if (clientNotificationToken != null)
-                parameters.add(new BasicNameValuePair(CibaGrantType.CLIENT_NOTIFICATION_TOKEN, clientNotificationToken));
-            if (scope != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID + " " + scope));
-            } else {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID));
-            }
-            if (requestUri != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri));
-            }
-            if (request != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_PARAM, request));
-            }
-            if (claims != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.CLAIMS_PARAM, claims));
-            }
-            if (additionalParams != null) {
-                for (Map.Entry<String, String> entry : additionalParams.entrySet()) {
-                    parameters.add(new BasicNameValuePair(entry.getKey(), entry.getValue()));
-                }
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AuthenticationRequestAcknowledgement(client.execute(post));
-        }
-    }
-
-    public int doAuthenticationChannelCallback(String requestToken, AuthenticationChannelResponse.Status authStatus) throws Exception {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(getAuthenticationChannelCallbackUrl());
-
-            String authorization = TokenUtil.TOKEN_TYPE_BEARER + " " + requestToken;
-            post.setHeader("Authorization", authorization);
-
-            post.setEntity(new StringEntity(JsonSerialization.writeValueAsString(new AuthenticationChannelResponse(authStatus)), ContentType.APPLICATION_JSON));
-
-            return client.execute(post).getStatusLine().getStatusCode();
-        }
-    }
-
-    public AccessTokenResponse doBackchannelAuthenticationTokenRequest(String clientSecret, String authReqId) throws Exception {
-        return doBackchannelAuthenticationTokenRequest(this.clientId, clientSecret, authReqId);
-    }
-
-    public AccessTokenResponse doBackchannelAuthenticationTokenRequest(String clientId, String clientSecret, String authReqId) throws Exception {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return doBackchannelAuthenticationTokenRequest(clientId, clientSecret, authReqId, client);
-        }
-    }
-
-    public AccessTokenResponse doBackchannelAuthenticationTokenRequest(String clientId, String clientSecret, String authReqId, CloseableHttpClient client) throws Exception {
-        HttpPost post = new HttpPost(getBackchannelAuthenticationTokenRequestUrl());
-
-        String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-        post.setHeader("Authorization", authorization);
-
-        List<NameValuePair> parameters = new LinkedList<>();
-        parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CIBA_GRANT_TYPE));
-        parameters.add(new BasicNameValuePair(AUTH_REQ_ID, authReqId));
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        return new AccessTokenResponse(client.execute(post));
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public CloseableHttpResponse doLogout(String refreshToken, String clientSecret) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return doLogout(refreshToken, clientSecret, client);
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public CloseableHttpResponse doLogout(String refreshToken, String clientSecret, CloseableHttpClient client) throws IOException {
-        HttpPost post = new HttpPost(getLogoutUrl().build());
-
-        List<NameValuePair> parameters = new LinkedList<>();
-        if (refreshToken != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, refreshToken));
-        }
-        if (clientId != null && clientSecret != null) {
-            String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-            post.setHeader("Authorization", authorization);
-        } else if (clientId != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-        }
-        if (origin != null) {
-            post.addHeader("Origin", origin);
-        }
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        return client.execute(post);
-    }
-
-    public CloseableHttpResponse doBackchannelLogout(String logoutTokon) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return doBackchannelLogout(logoutTokon, client);
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    public CloseableHttpResponse doBackchannelLogout(String logoutToken, CloseableHttpClient client) throws IOException {
-        HttpPost post = new HttpPost(getBackchannelLogoutUrl().build());
-        List<NameValuePair> parameters = new LinkedList<>();
-        if (logoutToken != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.LOGOUT_TOKEN, logoutToken));
-        }
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        return client.execute(post);
-    }
-
-    public CloseableHttpResponse doTokenRevoke(String token, String tokenTypeHint, String clientSecret) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return doTokenRevoke(token, tokenTypeHint, clientSecret, client);
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    public CloseableHttpResponse doTokenRevoke(String token, String tokenTypeHint, String clientSecret,
-                                               CloseableHttpClient client) throws IOException {
-        HttpPost post = new HttpPost(getTokenRevocationUrl());
-
-        List<NameValuePair> parameters = new LinkedList<>();
-        if (token != null) {
-            parameters.add(new BasicNameValuePair("token", token));
-        }
-        if (tokenTypeHint != null) {
-            parameters.add(new BasicNameValuePair("token_type_hint", tokenTypeHint));
-        }
-
-        if (origin != null) {
-            post.addHeader("Origin", origin);
-        }
-
-        if (clientId != null && clientSecret != null) {
-            String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-            post.setHeader("Authorization", authorization);
-        } else if (clientId != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-        }
-
-        if (dpopProof != null) {
-            post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-        }
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        return client.execute(post);
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public AccessTokenResponse doRefreshTokenRequest(String refreshToken, String password) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            return doRefreshTokenRequest(refreshToken, password, client);
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    // KEYCLOAK-6771 Certificate Bound Token
-    public AccessTokenResponse doRefreshTokenRequest(String refreshToken, String password, CloseableHttpClient client) {
-        HttpPost post = new HttpPost(getRefreshTokenUrl());
-
-        List<NameValuePair> parameters = new LinkedList<>();
-        parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));
-
-        if (origin != null) {
-            post.addHeader("Origin", origin);
-        }
-        if (refreshToken != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, refreshToken));
-        }
-        if (scope != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scope));
-        }
-        if (clientId != null && password != null) {
-            String authorization = BasicAuthHelper.createHeader(clientId, password);
-            post.setHeader("Authorization", authorization);
-        } else if (clientId != null) {
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-        }
-
-        if (clientSessionState != null) {
-            parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, clientSessionState));
-        }
-        if (clientSessionHost != null) {
-            parameters.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, clientSessionHost));
-        }
-
-        if (dpopProof != null) {
-            post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-        }
-
-        UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-        post.setEntity(formEntity);
-
-        try {
-            return new AccessTokenResponse(client.execute(post));
-        } catch (Exception e) {
-            throw new RuntimeException("Failed to retrieve access token", e);
-        }
-    }
-
-    public DeviceAuthorizationResponse doDeviceAuthorizationRequest(String clientId, String clientSecret) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getDeviceAuthorizationUrl());
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            } else {
-                parameters.add(new BasicNameValuePair("client_id", clientId));
-            }
-
-            if (origin != null) {
-                post.addHeader("Origin", origin);
-            }
-
-            String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-            if (scopeParam != null && !scopeParam.isEmpty()) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scopeParam));
-            }
-            if (nonce != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.NONCE_PARAM, nonce));
-            }
-            if (codeChallenge != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_CHALLENGE, codeChallenge));
-            }
-            if (codeChallengeMethod != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod));
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new DeviceAuthorizationResponse(client.execute(post));
-        }
-    }
-
-    public AccessTokenResponse doDeviceTokenRequest(String clientId, String clientSecret, String deviceCode) throws Exception {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getAccessTokenUrl());
-
-            List<NameValuePair> parameters = new LinkedList<>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.DEVICE_CODE_GRANT_TYPE));
-            parameters.add(new BasicNameValuePair("device_code", deviceCode));
-            if (clientSecret != null) {
-                String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
-                post.setHeader("Authorization", authorization);
-            } else {
-                parameters.add(new BasicNameValuePair("client_id", clientId));
-            }
-
-            if (origin != null) {
-                post.addHeader("Origin", origin);
-            }
-            // https://tools.ietf.org/html/rfc7636#section-4.5
-            if (codeVerifier != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-
-            return new AccessTokenResponse(client.execute(post));
-        }
-    }
-
-    public OIDCConfigurationRepresentation doWellKnownRequest(String realm) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            SimpleHttp request = SimpleHttpDefault.doGet(baseUrl + "/realms/" + realm + "/.well-known/openid-configuration",
-                    client);
-            if (requestHeaders != null) {
-                for (Map.Entry<String, String> entry : requestHeaders.entrySet()) {
-                    request.header(entry.getKey(), entry.getValue());
-                }
-            }
-            return request.asJson(OIDCConfigurationRepresentation.class);
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    public UserInfo doUserInfoRequest(String accessToken) {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpGet get = new HttpGet(getUserInfoUrl());
-            get.setHeader("Authorization", "Bearer " + accessToken);
-            try (CloseableHttpResponse response = client.execute(get)) {
-                return JsonSerialization.readValue(response.getEntity().getContent(), UserInfo.class);
-            }
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    public UserInfoResponse doUserInfoRequestByGet(OAuthClient.AccessTokenResponse accessTokenResponse) throws Exception {
-        try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpGet get = new HttpGet(getUserInfoUrl());
-            get.setHeader("Authorization", accessTokenResponse.getTokenType() + " " + accessTokenResponse.getAccessToken());
-            if (dpopProof != null) {
-                get.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-            }
-            return new UserInfoResponse(client.execute(get));
-        } catch (IOException ex) {
-            throw new RuntimeException(ex);
-        }
-    }
-
-    public ParResponse doPushedAuthorizationRequest(String clientId, String clientSecret) throws IOException {
-        return doPushedAuthorizationRequest(clientId, clientSecret, (CloseableHttpResponse c) -> {
-        }, null);
-    }
-
-    public ParResponse doPushedAuthorizationRequest(String clientId, String clientSecret, String signedJwt) throws IOException {
-        return doPushedAuthorizationRequest(clientId, clientSecret, (CloseableHttpResponse c) -> {
-        }, signedJwt);
-    }
-
-    public ParResponse doPushedAuthorizationRequest(String clientId, String clientSecret, Consumer<CloseableHttpResponse> c) throws IOException {
-        return doPushedAuthorizationRequest(clientId, clientSecret, c, null);
-    }
-
-    public ParResponse doPushedAuthorizationRequest(String clientId, String clientSecret, Consumer<CloseableHttpResponse> c, String signedJwt) throws IOException {
-        try (CloseableHttpClient client = httpClient.get()) {
-            HttpPost post = new HttpPost(getParEndpointUrl());
-
-            List<NameValuePair> parameters = new LinkedList<>();
-
-            if (signedJwt != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
-            }
-
-            if (origin != null) {
-                post.addHeader("Origin", origin);
-            }
-            if (responseType != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.RESPONSE_TYPE, responseType));
-            }
-            if (responseMode != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.RESPONSE_MODE_PARAM, responseMode));
-            }
-            if (clientId != null && clientSecret != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_SECRET, clientSecret));
-            }
-            else if (clientId != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, clientId));
-            }
-            if (redirectUri != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, redirectUri));
-            }
-            if (kcAction != null) {
-                parameters.add(new BasicNameValuePair(Constants.KC_ACTION, kcAction));
-            }
-            // on authz request, state is putting automatically so that.
-            // if state is put here, they are not matched.
-            //String state = this.state.getState();
-            //if (state != null) {
-            //    parameters.add(new BasicNameValuePair(OAuth2Constants.STATE, state));
-            //}
-            if (uiLocales != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.UI_LOCALES_PARAM, uiLocales));
-            }
-            if (nonce != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.NONCE_PARAM, nonce));
-            }
-            String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-            if (scopeParam != null && !scopeParam.isEmpty()) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scopeParam));
-            }
-            if (maxAge != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.MAX_AGE_PARAM, maxAge));
-            }
-            if (prompt != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.PROMPT_PARAM, prompt));
-            }
-            if (request != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_PARAM, request));
-            }
-            if (requestUri != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri));
-            }
-            if (claims != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.CLAIMS_PARAM, claims));
-            }
-            if (codeChallenge != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_CHALLENGE, codeChallenge));
-            }
-            if (codeChallengeMethod != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod));
-            }
-            if (customParameters != null) {
-                customParameters.keySet().stream().forEach(i -> parameters.add(new BasicNameValuePair(i, customParameters.get(i))));
-            }
-            if (dpopJkt != null) {
-                parameters.add(new BasicNameValuePair(OIDCLoginProtocol.DPOP_JKT, dpopJkt));
-            }
-            if (dpopProof != null) {
-                post.addHeader(TokenUtil.TOKEN_TYPE_DPOP, dpopProof);
-            }
-
-            UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
-            post.setEntity(formEntity);
-            try {
-                return new ParResponse(client.execute(post), c);
-            } catch (Exception e) {
-                e.printStackTrace();
-                throw new RuntimeException("Failed to do PAR request", e);
-            }
-        }
-    }
-
-    public static class ParResponse {
-        private int statusCode;
-        private Map<String, String> headers;
-
-        private String requestUri;
-        private int expiresIn;
-
-        private String error;
-        private String errorDescription;
-
-        public ParResponse(CloseableHttpResponse response, Consumer<CloseableHttpResponse> c) throws Exception {
-            try {
-                statusCode = response.getStatusLine().getStatusCode();
-
-                headers = new HashMap<>();
-
-                for (Header h : response.getAllHeaders()) {
-                    headers.put(h.getName(), h.getValue());
-                }
-
-                Header[] contentTypeHeaders = response.getHeaders("Content-Type");
-                String contentType = (contentTypeHeaders != null && contentTypeHeaders.length > 0) ? contentTypeHeaders[0].getValue() : null;
-                if (!"application/json".equals(contentType)) {
-                    Assert.fail("Invalid content type. Status: " + statusCode + ", contentType: " + contentType);
-                }
-
-                String s = IOUtils.toString(response.getEntity().getContent(), StandardCharsets.UTF_8);
-                Map responseJson = JsonSerialization.readValue(s, Map.class);
-                if (statusCode == 201) {
-                    requestUri = (String) responseJson.get("request_uri");
-                    expiresIn = ((Integer) responseJson.get("expires_in")).intValue();
-                } else {
-                    error = (String) responseJson.get(OAuth2Constants.ERROR);
-                    errorDescription = responseJson.containsKey(OAuth2Constants.ERROR_DESCRIPTION) ? (String) responseJson.get(OAuth2Constants.ERROR_DESCRIPTION) : null;
-                }
-
-                c.accept(response);
-            } finally {
-                response.close();
-            }
-        }
-
-        public int getStatusCode() {
-            return statusCode;
-        }
-
-        public Map<String, String> getHeaders() {
-            return headers;
-        }
-
-        public String getRequestUri() {
-            return requestUri;
-        }
-
-        public int getExpiresIn() {
-            return expiresIn;
-        }
-
-        public String getError() {
-            return error;
-        }
-
-        public String getErrorDescription() {
-            return errorDescription;
-        }
-    }
-
-    public void closeClient(CloseableHttpClient client) {
-        try {
-            client.close();
-        } catch (IOException ioe) {
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    public AccessToken verifyToken(String token) {
-        return verifyToken(token, AccessToken.class);
-    }
-
-    public IDToken verifyIDToken(String token) {
-        return verifyToken(token, IDToken.class);
-    }
-
-    public AuthorizationResponseToken verifyAuthorizationResponseToken(String token) {
-        return verifyToken(token, AuthorizationResponseToken.class);
-    }
-
-    public RefreshToken parseRefreshToken(String refreshToken) {
-        try {
-            return new JWSInput(refreshToken).readJsonContent(RefreshToken.class);
-        } catch (Exception e) {
-            throw new RunOnServerException(e);
-        }
-    }
-
-    public <T extends JsonWebToken> T verifyToken(String token, Class<T> clazz) {
-        try {
-            TokenVerifier<T> verifier = TokenVerifier.create(token, clazz);
-            String kid = verifier.getHeader().getKeyId();
-            String algorithm = verifier.getHeader().getAlgorithm().name();
-            KeyWrapper key = getRealmPublicKey(realm, algorithm, kid);
-            AsymmetricSignatureVerifierContext verifierContext;
-            switch (algorithm) {
-                case Algorithm.ES256:
-                case Algorithm.ES384:
-                case Algorithm.ES512:
-                    verifierContext = new ServerECDSASignatureVerifierContext(key);
-                    break;
-                default:
-                    verifierContext = new AsymmetricSignatureVerifierContext(key);
-            }
-            verifier.verifierContext(verifierContext);
-            verifier.verify();
-            return verifier.getToken();
-        } catch (VerificationException e) {
-            throw new RuntimeException("Failed to decode token", e);
-        }
-    }
-
-    public SignatureSignerContext createSigner(PrivateKey privateKey, String kid, String algorithm) {
-        return createSigner(privateKey, kid, algorithm, null);
-    }
-
-    public SignatureSignerContext createSigner(PrivateKey privateKey, String kid, String algorithm, String curve) {
-        KeyWrapper keyWrapper = new KeyWrapper();
-        keyWrapper.setAlgorithm(algorithm);
-        keyWrapper.setKid(kid);
-        keyWrapper.setPrivateKey(privateKey);
-        keyWrapper.setCurve(curve);
-        SignatureSignerContext signer;
-        switch (algorithm) {
-            case Algorithm.ES256:
-            case Algorithm.ES384:
-            case Algorithm.ES512:
-                signer = new ServerECDSASignatureSignerContext(keyWrapper);
-                break;
-            default:
-                signer = new AsymmetricSignatureSignerContext(keyWrapper);
-        }
-        return signer;
-    }
-
-    public String getClientId() {
-        return clientId;
-    }
-
-    public String getCurrentRequest() {
-        int index = driver.getCurrentUrl().indexOf('?');
-        if (index == -1) {
-            index = driver.getCurrentUrl().indexOf('#');
-            if (index == -1) {
-                index = driver.getCurrentUrl().length();
-            }
-        }
-        return driver.getCurrentUrl().substring(0, index);
-    }
-
-    public URI getCurrentUri() {
-        try {
-            return new URI(driver.getCurrentUrl());
-        } catch (URISyntaxException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public Map<String, String> getCurrentQuery() {
-        Map<String, String> m = new HashMap<>();
-        List<NameValuePair> pairs = URLEncodedUtils.parse(getCurrentUri(), StandardCharsets.UTF_8);
-        for (NameValuePair p : pairs) {
-            m.put(p.getName(), p.getValue());
-        }
-        return m;
-    }
-
-    public Map<String, String> getCurrentFragment() {
-        Map<String, String> m = new HashMap<>();
-
-        String fragment = getCurrentUri().getRawFragment();
-        List<NameValuePair> pairs = (fragment == null || fragment.isEmpty()) ? Collections.emptyList() : URLEncodedUtils.parse(fragment, StandardCharsets.UTF_8);
-
-        for (NameValuePair p : pairs) {
-            m.put(p.getName(), p.getValue());
-        }
-        return m;
-    }
-
-    public void openLoginForm() {
-        driver.navigate().to(getLoginFormUrl());
-    }
-
-    public void openRegistrationForm() {
-        driver.navigate().to(getRegistrationFormUrl());
-    }
-
-    public void openOAuth2DeviceVerificationForm(String verificationUri) {
-        driver.navigate().to(verificationUri);
-    }
-
-    public void openLogout() {
-        UriBuilder b = OIDCLoginProtocolService.logoutUrl(UriBuilder.fromUri(baseUrl));
-        if (postLogoutRedirectUri != null) {
-            b.queryParam(OAuth2Constants.POST_LOGOUT_REDIRECT_URI, postLogoutRedirectUri);
-        }
-        if (idTokenHint != null) {
-            b.queryParam(OAuth2Constants.ID_TOKEN_HINT, idTokenHint);
-        }
-        if (initiatingIDP != null) {
-            b.queryParam(AuthenticationManager.INITIATING_IDP_PARAM, initiatingIDP);
-        }
-        driver.navigate().to(b.build(realm).toString());
-    }
-
-    public String getRedirectUri() {
-        return redirectUri;
-    }
-
-    /**
-     * Application-initiated action.
-     *
-     * @return The action name.
-     */
-    public String getKcAction() {
-        return kcAction;
-    }
-
-    public String getState() {
-        return state.getState();
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public String getLoginFormUrl() {
-        return this.getLoginFormUrl(this.baseUrl);
-    }
-
-    public String getRegisterationsUrl() {
-        return this.getLoginFormUrl(this.baseUrl).replace("openid-connect/auth", "openid-connect/registrations");
-    }
-
-    public String getLoginFormUrl(String baseUrl) {
-        UriBuilder b = OIDCLoginProtocolService.authUrl(UriBuilder.fromUri(baseUrl));
-        if (responseType != null) {
-            b.queryParam(OAuth2Constants.RESPONSE_TYPE, responseType);
-        }
-        if (responseMode != null) {
-            b.queryParam(OIDCLoginProtocol.RESPONSE_MODE_PARAM, responseMode);
-        }
-        if (clientId != null) {
-            b.queryParam(OAuth2Constants.CLIENT_ID, clientId);
-        }
-        if (redirectUri != null) {
-            b.queryParam(OAuth2Constants.REDIRECT_URI, redirectUri);
-        }
-        if (kcAction != null) {
-            b.queryParam(Constants.KC_ACTION, kcAction);
-        }
-        String state = this.state.getState();
-        if (state != null) {
-            b.queryParam(OAuth2Constants.STATE, state);
-        }
-        if (uiLocales != null) {
-            b.queryParam(OAuth2Constants.UI_LOCALES_PARAM, uiLocales);
-        }
-        if (nonce != null) {
-            b.queryParam(OIDCLoginProtocol.NONCE_PARAM, nonce);
-        }
-
-        String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-        if (scopeParam != null && !scopeParam.isEmpty()) {
-            b.queryParam(OAuth2Constants.SCOPE, scopeParam);
-        }
-
-        if (maxAge != null) {
-            b.queryParam(OIDCLoginProtocol.MAX_AGE_PARAM, maxAge);
-        }
-        if (prompt != null) {
-            b.queryParam(OIDCLoginProtocol.PROMPT_PARAM, prompt);
-        }
-        if (request != null) {
-            b.queryParam(OIDCLoginProtocol.REQUEST_PARAM, request);
-        }
-        if (requestUri != null) {
-            b.queryParam(OIDCLoginProtocol.REQUEST_URI_PARAM, requestUri);
-        }
-        if (claims != null) {
-            b.queryParam(OIDCLoginProtocol.CLAIMS_PARAM, claims);
-        }
-        // https://tools.ietf.org/html/rfc7636#section-4.3
-        if (codeChallenge != null) {
-            b.queryParam(OAuth2Constants.CODE_CHALLENGE, codeChallenge);
-        }
-        if (codeChallengeMethod != null) {
-            b.queryParam(OAuth2Constants.CODE_CHALLENGE_METHOD, codeChallengeMethod);
-        }
-        if (dpopJkt != null) {
-            b.queryParam(OIDCLoginProtocol.DPOP_JKT, dpopJkt);
-        }
-        if (customParameters != null) {
-            customParameters.keySet().stream().forEach(i -> b.queryParam(i, customParameters.get(i)));
-        }
-
-        return b.build(realm).toString();
-    }
-
-    private String getRegistrationFormUrl() {
-        UriBuilder b = OIDCLoginProtocolService.registrationsUrl(UriBuilder.fromUri(baseUrl));
-        if (responseType != null) {
-            b.queryParam(OAuth2Constants.RESPONSE_TYPE, responseType);
-        }
-        if (clientId != null) {
-            b.queryParam(OAuth2Constants.CLIENT_ID, clientId);
-        }
-        if (redirectUri != null) {
-            b.queryParam(OAuth2Constants.REDIRECT_URI, redirectUri);
-        }
-
-        String scopeParam = openid ? TokenUtil.attachOIDCScope(scope) : scope;
-        if (scopeParam != null && !scopeParam.isEmpty()) {
-            b.queryParam(OAuth2Constants.SCOPE, scopeParam);
-        }
-
-        if (customParameters != null) {
-            customParameters.keySet().stream().forEach(i -> b.queryParam(i, customParameters.get(i)));
-        }
-
-        return b.build(realm).toString();
-    }
-
-    public Entity getLoginEntityForPOST() {
-        Form form = new Form()
-                .param(OAuth2Constants.SCOPE, TokenUtil.attachOIDCScope(scope))
-                .param(OAuth2Constants.RESPONSE_TYPE, responseType)
-                .param(OAuth2Constants.CLIENT_ID, clientId)
-                .param(OAuth2Constants.REDIRECT_URI, redirectUri)
-                .param(OAuth2Constants.STATE, this.state.getState());
-
-        return Entity.form(form);
-    }
-
-    public String getAccessTokenUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getTokenIntrospectionUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenIntrospectionUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public LogoutUrlBuilder getLogoutUrl() {
-        return new LogoutUrlBuilder();
-    }
-
-    public BackchannelLogoutUrlBuilder getBackchannelLogoutUrl() {
-        return new BackchannelLogoutUrlBuilder();
-    }
-
-    public String getTokenRevocationUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenRevocationUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getResourceOwnerPasswordCredentialGrantUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getResourceOwnerPasswordCredentialGrantUrl(String realm) {
-        UriBuilder b = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getCertsUrl(String realm) {
-        UriBuilder b = OIDCLoginProtocolService.certsUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getServiceAccountUrl() {
-        return getResourceOwnerPasswordCredentialGrantUrl();
-    }
-
-    public String getDeviceAuthorizationUrl() {
-        UriBuilder b = oauth2DeviceAuthUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getRefreshTokenUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getUserInfoUrl() {
-        UriBuilder b = OIDCLoginProtocolService.userInfoUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getBackchannelAuthenticationUrl() {
-        UriBuilder b = CibaGrantType.authorizationUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getAuthenticationChannelCallbackUrl() {
-        UriBuilder b = CibaGrantType.authenticationUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getBackchannelAuthenticationTokenRequestUrl() {
-        UriBuilder b = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public String getParEndpointUrl() {
-        UriBuilder b = ParEndpoint.parUrl(UriBuilder.fromUri(baseUrl));
-        return b.build(realm).toString();
-    }
-
-    public OAuthClient baseUrl(String baseUrl) {
-        this.baseUrl = baseUrl;
-        return this;
-    }
-
-    public OAuthClient realm(String realm) {
-        this.realm = realm;
-        return this;
-    }
-
-    public OAuthClient clientId(String clientId) {
-        this.clientId = clientId;
-        return this;
-    }
-
-    public OAuthClient redirectUri(String redirectUri) {
-        this.redirectUri = redirectUri;
-        return this;
-    }
-
-    public OAuthClient postLogoutRedirectUri(String postLogoutRedirectUri) {
-        this.postLogoutRedirectUri = postLogoutRedirectUri;
-        return this;
-    }
-
-    public OAuthClient idTokenHint(String idTokenHint) {
-        this.idTokenHint = idTokenHint;
-        return this;
-    }
-
-    public OAuthClient initiatingIDP(String initiatingIDP) {
-        this.initiatingIDP = initiatingIDP;
-        return this;
-    }
-
-    public OAuthClient kcAction(String kcAction) {
-        this.kcAction = kcAction;
-        return this;
-    }
-
-    public OAuthClient stateParamHardcoded(String value) {
-        this.state = () -> {
-            return value;
-        };
-        return this;
-    }
-
-    public OAuthClient stateParamRandom() {
-        this.state = () -> {
-            return KeycloakModelUtils.generateId();
-        };
-        return this;
-    }
-
-    public OAuthClient scope(String scope) {
-        this.scope = scope;
-        return this;
-    }
-
-    public OAuthClient openid(boolean openid) {
-        this.openid = openid;
-        return this;
-    }
-
-    public OAuthClient uiLocales(String uiLocales) {
-        this.uiLocales = uiLocales;
-        return this;
-    }
-
-    public OAuthClient clientSessionState(String client_session_state) {
-        this.clientSessionState = client_session_state;
-        return this;
-    }
-
-    public OAuthClient clientSessionHost(String client_session_host) {
-        this.clientSessionHost = client_session_host;
-        return this;
-    }
-
-    public OAuthClient maxAge(String maxAge) {
-        this.maxAge = maxAge;
-        return this;
-    }
-
-    public OAuthClient prompt(String prompt) {
-        this.prompt = prompt;
-        return this;
-    }
-
-    public OAuthClient responseType(String responseType) {
-        this.responseType = responseType;
-        return this;
-    }
-
-    public OAuthClient responseMode(String responseMode) {
-        this.responseMode = responseMode;
-        return this;
-    }
-
-    public OAuthClient nonce(String nonce) {
-        this.nonce = nonce;
-        return this;
-    }
-
-    public OAuthClient request(String request) {
-        this.request = request;
-        return this;
-    }
-
-    public OAuthClient requestUri(String requestUri) {
-        this.requestUri = requestUri;
-        return this;
-    }
-
-    public OAuthClient claims(ClaimsRepresentation claims) {
-        if (claims == null) {
-            this.claims = null;
-        } else {
-            try {
-                this.claims = URLEncoder.encode(JsonSerialization.writeValueAsString(claims), StandardCharsets.UTF_8);
-            } catch (IOException ioe) {
-                throw new RuntimeException(ioe);
-            }
-        }
-        return this;
-    }
-
-    public String getRealm() {
-        return realm;
-    }
-
-    // https://tools.ietf.org/html/rfc7636#section-4
-    public OAuthClient codeVerifier(String codeVerifier) {
-        this.codeVerifier = codeVerifier;
-        return this;
-    }
-
-    public OAuthClient codeChallenge(String codeChallenge) {
-        this.codeChallenge = codeChallenge;
-        return this;
-    }
-
-    public OAuthClient codeChallengeMethod(String codeChallengeMethod) {
-        this.codeChallengeMethod = codeChallengeMethod;
-        return this;
-    }
-
-    public OAuthClient origin(String origin) {
-        this.origin = origin;
-        return this;
-    }
-
-    public OAuthClient dpopProof(String dpopProof) {
-        this.dpopProof = dpopProof;
-        return this;
-    }
-
-    public OAuthClient dpopJkt(String dpopJkt) {
-        this.dpopJkt = dpopJkt;
-        return this;
-    }
-
-    public OAuthClient addCustomParameter(String key, String value) {
-        if (customParameters == null) {
-            customParameters = new HashMap<>();
-        }
-        customParameters.put(key, value);
-        return this;
-    }
-
-    public OAuthClient removeCustomParameter(String key) {
-        if (customParameters != null) {
-            customParameters.remove(key);
-        }
-        return this;
-    }
-
-    public OAuthClient requestHeaders(Map<String, String> headers) {
-        this.requestHeaders = headers;
-        return this;
-    }
-
-    public static class AuthorizationEndpointResponse {
-
-        private boolean isRedirected;
-        private String code;
-        private String state;
-        private String error;
-        private String errorDescription;
-
-        private String sessionState;
-
-        // Just during OIDC implicit or hybrid flow
-        private String accessToken;
-        private String idToken;
-        private String tokenType;
-        private String expiresIn;
-
-        // Just during FAPI JARM response mode JWT
-        private String response;
-
-        private String issuer;
-
-        public AuthorizationEndpointResponse(OAuthClient client) {
-            boolean fragment;
-            if (client.responseMode == null || "jwt".equals(client.responseMode)) {
-                try {
-                    fragment = client.responseType != null && OIDCResponseType.parse(client.responseType).isImplicitOrHybridFlow();
-                } catch (IllegalArgumentException iae) {
-                    fragment = false;
-                }
-            } else {
-                fragment = "fragment".equals(client.responseMode) || "fragment.jwt".equals(client.responseMode);
-            }
-            init(client, fragment);
-        }
-
-        public AuthorizationEndpointResponse(OAuthClient client, boolean fragment) {
-            init(client, fragment);
-        }
-
-        private void init(OAuthClient client, boolean fragment) {
-            isRedirected = client.getCurrentRequest().equals(client.getRedirectUri());
-            Map<String, String> params = fragment ? client.getCurrentFragment() : client.getCurrentQuery();
-
-            code = params.get(OAuth2Constants.CODE);
-            state = params.get(OAuth2Constants.STATE);
-            error = params.get(OAuth2Constants.ERROR);
-            errorDescription = params.get(OAuth2Constants.ERROR_DESCRIPTION);
-            sessionState = params.get(OAuth2Constants.SESSION_STATE);
-            accessToken = params.get(OAuth2Constants.ACCESS_TOKEN);
-            idToken = params.get(OAuth2Constants.ID_TOKEN);
-            tokenType = params.get(OAuth2Constants.TOKEN_TYPE);
-            expiresIn = params.get(OAuth2Constants.EXPIRES_IN);
-            response = params.get(OAuth2Constants.RESPONSE);
-            issuer = params.get(OAuth2Constants.ISSUER);
-        }
-
-        public boolean isRedirected() {
-            return isRedirected;
-        }
-
-        public String getCode() {
-            return code;
-        }
-
-        public String getState() {
-            return state;
-        }
-
-        public String getError() {
-            return error;
-        }
-
-        public String getErrorDescription() {
-            return errorDescription;
-        }
-
-        public String getSessionState() {
-            return sessionState;
-        }
-
-        public String getAccessToken() {
-            return accessToken;
-        }
-
-        public String getIdToken() {
-            return idToken;
-        }
-
-        public String getTokenType() {
-            return tokenType;
-        }
-
-        public String getExpiresIn() {
-            return expiresIn;
-        }
-
-        public String getResponse() {
-            return response;
-        }
-
-        public String getIssuer() {
-            return issuer;
-        }
-    }
-
-    public static class AuthenticationRequestAcknowledgement {
-        private int statusCode;
-        private Map<String, String> headers;
-
-        private String authReqId;
-        private int expiresIn;
-        private int interval = -1;
-
-        private String error;
-        private String errorDescription;
-
-        public AuthenticationRequestAcknowledgement(CloseableHttpResponse response) throws Exception {
-            try {
-                statusCode = response.getStatusLine().getStatusCode();
-
-                headers = new HashMap<>();
-
-                for (Header h : response.getAllHeaders()) {
-                    headers.put(h.getName(), h.getValue());
-                }
-
-                Header[] contentTypeHeaders = response.getHeaders("Content-Type");
-                String contentType = (contentTypeHeaders != null && contentTypeHeaders.length > 0) ? contentTypeHeaders[0].getValue() : null;
-                if (contentType == null || !contentType.startsWith("application/json")) {
-                    Assert.fail("Invalid content type. Status: " + statusCode + ", contentType: " + contentType);
-                }
-
-                String s = IOUtils.toString(response.getEntity().getContent(), StandardCharsets.UTF_8);
-                Map responseJson = JsonSerialization.readValue(s, Map.class);
-                if (statusCode == 200) {
-                    authReqId = (String) responseJson.get("auth_req_id");
-                    expiresIn = (Integer) responseJson.get("expires_in");
-                    if (responseJson.containsKey("interval")) interval = (Integer) responseJson.get("interval");
-                } else {
-                    error = (String) responseJson.get(OAuth2Constants.ERROR);
-                    errorDescription = responseJson.containsKey(OAuth2Constants.ERROR_DESCRIPTION) ? (String) responseJson.get(OAuth2Constants.ERROR_DESCRIPTION) : null;
-                }
-            } finally {
-                response.close();
-            }
-        }
-
-        public int getStatusCode() {
-            return statusCode;
-        }
-
-        public Map<String, String> getHeaders() {
-            return headers;
-        }
-
-        public String getAuthReqId() {
-            return authReqId;
-        }
-
-        public int getExpiresIn() {
-            return expiresIn;
-        }
-
-        public int getInterval() {
-            return interval;
-        }
-
-        public String getError() {
-            return error;
-        }
-
-        public String getErrorDescription() {
-            return errorDescription;
-        }
-
-    }
-
-    public static class AccessTokenResponse {
-        private int statusCode;
-
-        private String idToken;
-        private String accessToken;
-        private String issuedTokenType;
-        private String tokenType;
-        private int expiresIn;
-        private int refreshExpiresIn;
-        private String refreshToken;
-        // OIDC Financial API Read Only Profile : scope MUST be returned in the response from Token Endpoint
-        private String scope;
-        private String sessionState;
-
-        private String error;
-        private String errorDescription;
-
-        private Map<String, String> headers;
-
-        private Map<String, Object> otherClaims;
-
-        public AccessTokenResponse(CloseableHttpResponse response) throws Exception {
-            try {
-                statusCode = response.getStatusLine().getStatusCode();
-
-                headers = new HashMap<>();
-
-                for (Header h : response.getAllHeaders()) {
-                    headers.put(h.getName(), h.getValue());
-                }
-
-                Header[] contentTypeHeaders = response.getHeaders("Content-Type");
-                String contentType = (contentTypeHeaders != null && contentTypeHeaders.length > 0) ? contentTypeHeaders[0].getValue() : null;
-                if (!"application/json".equals(contentType)) {
-                    Assert.fail("Invalid content type. Status: " + statusCode + ", contentType: " + contentType);
-                }
-
-                String s = IOUtils.toString(response.getEntity().getContent(), StandardCharsets.UTF_8);
-                @SuppressWarnings("unchecked")
-                Map<String, Object> responseJson = JsonSerialization.readValue(s, Map.class);
-
-                if (statusCode == 200) {
-                    otherClaims = new HashMap<>();
-
-                    for (Map.Entry<String, Object> entry : responseJson.entrySet()) {
-                        switch (entry.getKey()) {
-                            case OAuth2Constants.ID_TOKEN:
-                                idToken = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.ACCESS_TOKEN:
-                                accessToken = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.ISSUED_TOKEN_TYPE:
-                                issuedTokenType = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.TOKEN_TYPE:
-                                tokenType = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.EXPIRES_IN:
-                                expiresIn = (Integer) entry.getValue();
-                                break;
-                            case "refresh_expires_in":
-                                refreshExpiresIn = (Integer) entry.getValue();
-                                break;
-                            case OAuth2Constants.SESSION_STATE:
-                                sessionState = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.SCOPE:
-                                scope = (String) entry.getValue();
-                                break;
-                            case OAuth2Constants.REFRESH_TOKEN:
-                                refreshToken = (String) entry.getValue();
-                                break;
-                            default:
-                                otherClaims.put(entry.getKey(), entry.getValue());
-                                break;
-                        }
-                    }
-                } else {
-                    error = (String) responseJson.get(OAuth2Constants.ERROR);
-                    errorDescription = responseJson.containsKey(OAuth2Constants.ERROR_DESCRIPTION) ? (String) responseJson.get(OAuth2Constants.ERROR_DESCRIPTION) : null;
-                }
-            } finally {
-                response.close();
-            }
-        }
-
-        public String getIdToken() {
-            return idToken;
-        }
-
-        public String getAccessToken() {
-            return accessToken;
-        }
-
-        public String getError() {
-            return error;
-        }
-
-        public String getErrorDescription() {
-            return errorDescription;
-        }
-
-        public int getExpiresIn() {
-            return expiresIn;
-        }
-
-        public int getRefreshExpiresIn() {
-            return refreshExpiresIn;
-        }
-
-        public int getStatusCode() {
-            return statusCode;
-        }
-
-        public String getRefreshToken() {
-            return refreshToken;
-        }
-
-        public String getIssuedTokenType() {
-            return issuedTokenType;
-        }
-
-        public String getTokenType() {
-            return tokenType;
-        }
-
-        // OIDC Financial API Read Only Profile : scope MUST be returned in the response from Token Endpoint
-        public String getScope() {
-            return scope;
-        }
-
-        public String getSessionState() {
-            return sessionState;
-        }
-
-        public Map<String, String> getHeaders() {
-            return headers;
-        }
-
-        public Map<String, Object> getOtherClaims() {
-            return otherClaims;
-        }
-    }
-
-    private KeyWrapper getRealmPublicKey(String realm, String algorithm, String kid) {
-        boolean loadedKeysFromServer = false;
-        JSONWebKeySet jsonWebKeySet = publicKeys.get(realm);
-        if (jsonWebKeySet == null) {
-            jsonWebKeySet = getRealmKeys(realm);
-            publicKeys.put(realm, jsonWebKeySet);
-            loadedKeysFromServer = true;
-        }
-
-        KeyWrapper key = findKey(jsonWebKeySet, algorithm, kid);
-
-        if (key == null && !loadedKeysFromServer) {
-            jsonWebKeySet = getRealmKeys(realm);
-            publicKeys.put(realm, jsonWebKeySet);
-
-            key = findKey(jsonWebKeySet, algorithm, kid);
-        }
-
-        if (key == null) {
-            throw new RuntimeException("Public key for realm:" + realm + ", algorithm: " + algorithm + " not found");
-        }
-
-        return key;
-    }
-
-    private JSONWebKeySet getRealmKeys(String realm) {
-        String certUrl = baseUrl + "/realms/" + realm + "/protocol/openid-connect/certs";
-        try (CloseableHttpClient client = httpClient.get()){
-            return SimpleHttpDefault.doGet(certUrl, client).asJson(JSONWebKeySet.class);
-        } catch (IOException e) {
-            throw new RuntimeException("Failed to retrieve keys", e);
-        }
-    }
-
-    private KeyWrapper findKey(JSONWebKeySet jsonWebKeySet, String algorithm, String kid) {
-        for (JWK k : jsonWebKeySet.getKeys()) {
-            if (k.getKeyId().equals(kid) && k.getAlgorithm().equals(algorithm)) {
-                PublicKey publicKey = JWKParser.create(k).toPublicKey();
-
-                KeyWrapper key = new KeyWrapper();
-                key.setKid(k.getKeyId());
-                key.setAlgorithm(k.getAlgorithm());
-                if (k.getOtherClaims().get(OKPPublicJWK.CRV) != null) {
-                    key.setCurve((String) k.getOtherClaims().get(OKPPublicJWK.CRV));
-                }
-                key.setPublicKey(publicKey);
-                key.setUse(KeyUse.SIG);
-
-                return key;
-            }
-        }
-        return null;
-    }
-
-    public void removeCachedPublicKeys() {
-        publicKeys.clear();
-    }
-
-    public void setBrowserHeader(String name, String value) {
-        if (driver instanceof DroneHtmlUnitDriver) {
-            DroneHtmlUnitDriver droneDriver = (DroneHtmlUnitDriver) this.driver;
-            droneDriver.getWebClient().removeRequestHeader(name);
-            droneDriver.getWebClient().addRequestHeader(name, value);
-        }
-    }
-
-    public WebDriver getDriver() {
-        return driver;
-    }
-
-    private WebElement findSocialButton(String alias) {
-        String id = "social-" + alias;
-        return DroneUtils.getCurrentDriver().findElement(By.id(id));
-    }
-
-    private interface StateParamProvider {
-
-        String getState();
-
-    }
-
-    public static class DeviceAuthorizationResponse {
-        private int statusCode;
-
-        private String deviceCode;
-        private String userCode;
-        private String verificationUri;
-        private String verificationUriComplete;
-        private int expiresIn;
-        private int interval;
-
-        private String error;
-        private String errorDescription;
-
-        private Map<String, String> headers;
-
-        public DeviceAuthorizationResponse(CloseableHttpResponse response) throws Exception {
-            try {
-                statusCode = response.getStatusLine().getStatusCode();
-
-                headers = new HashMap<>();
-
-                for (Header h : response.getAllHeaders()) {
-                    headers.put(h.getName(), h.getValue());
-                }
-
-                Header[] contentTypeHeaders = response.getHeaders("Content-Type");
-                String contentType = (contentTypeHeaders != null && contentTypeHeaders.length > 0) ? contentTypeHeaders[0].getValue() : null;
-                if (!"application/json".equals(contentType)) {
-                    Assert.fail("Invalid content type. Status: " + statusCode + ", contentType: " + contentType);
-                }
-
-                String s = IOUtils.toString(response.getEntity().getContent(), StandardCharsets.UTF_8);
-                Map responseJson = JsonSerialization.readValue(s, Map.class);
-
-                if (statusCode == 200) {
-                    deviceCode = (String) responseJson.get("device_code");
-                    userCode = (String) responseJson.get("user_code");
-                    verificationUri = (String) responseJson.get("verification_uri");
-                    verificationUriComplete = (String) responseJson.get("verification_uri_complete");
-                    expiresIn = (Integer) responseJson.get("expires_in");
-                    interval = (Integer) responseJson.get("interval");
-                } else {
-                    error = (String) responseJson.get(OAuth2Constants.ERROR);
-                    errorDescription = responseJson.containsKey(OAuth2Constants.ERROR_DESCRIPTION) ? (String) responseJson.get(OAuth2Constants.ERROR_DESCRIPTION) : null;
-                }
-            } finally {
-                response.close();
-            }
-        }
-
-        public String getError() {
-            return error;
-        }
-
-        public String getErrorDescription() {
-            return errorDescription;
-        }
-
-        public String getDeviceCode() {
-            return deviceCode;
-        }
-
-        public String getUserCode() {
-            return userCode;
-        }
-
-        public String getVerificationUri() {
-            return verificationUri;
-        }
-
-        public String getVerificationUriComplete() {
-            return verificationUriComplete;
-        }
-
-        public int getExpiresIn() {
-            return expiresIn;
-        }
-
-        public int getInterval() {
-            return interval;
-        }
-
-        public int getStatusCode() {
-            return statusCode;
-        }
-
-        public Map<String, String> getHeaders() {
-            return headers;
-        }
-    }
-
-    public static class UserInfoResponse {
-        private int statusCode;
-
-        private UserInfo userInfo;
-
-        private Map<String, String> headers;
-
-        public UserInfoResponse(CloseableHttpResponse response) throws Exception {
-            try {
-                statusCode = response.getStatusLine().getStatusCode();
-
-                headers = new HashMap<>();
-
-                for (Header h : response.getAllHeaders()) {
-                    headers.put(h.getName(), h.getValue());
-                }
-
-                if (statusCode == 200) {
-                    userInfo = JsonSerialization.readValue(response.getEntity().getContent(), UserInfo.class);
-                }
-            } finally {
-                response.close();
-            }
-        }
-
-        public UserInfo getUserInfo() {
-            return userInfo;
-        }
-
-        public int getStatusCode() {
-            return statusCode;
-        }
-
-        public Map<String, String> getHeaders() {
-            return headers;
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SignatureSignerUtil.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SignatureSignerUtil.java
new file mode 100644
index 000000000000..8ebfdd1443f3
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SignatureSignerUtil.java
@@ -0,0 +1,35 @@
+package org.keycloak.testsuite.util;
+
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.AsymmetricSignatureSignerContext;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.ServerECDSASignatureSignerContext;
+import org.keycloak.crypto.SignatureSignerContext;
+
+import java.security.PrivateKey;
+
+public class SignatureSignerUtil {
+
+    public static SignatureSignerContext createSigner(PrivateKey privateKey, String kid, String algorithm) {
+        return createSigner(privateKey, kid, algorithm, null);
+    }
+
+    public static SignatureSignerContext createSigner(PrivateKey privateKey, String kid, String algorithm, String curve) {
+        KeyWrapper keyWrapper = new KeyWrapper();
+        keyWrapper.setAlgorithm(algorithm);
+        keyWrapper.setKid(kid);
+        keyWrapper.setPrivateKey(privateKey);
+        keyWrapper.setCurve(curve);
+        SignatureSignerContext signer;
+        switch (algorithm) {
+            case Algorithm.ES256:
+            case Algorithm.ES384:
+            case Algorithm.ES512:
+                signer = new ServerECDSASignatureSignerContext(keyWrapper);
+                break;
+            default:
+                signer = new AsymmetricSignatureSignerContext(keyWrapper);
+        }
+        return signer;
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SpiProvidersSwitchingUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SpiProvidersSwitchingUtils.java
index b0a4a5d396c3..b5f56d01b66d 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SpiProvidersSwitchingUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/SpiProvidersSwitchingUtils.java
@@ -69,14 +69,14 @@ private String getProviderPropertyNameConfig(String spiName, String providerId,
             @Override
             public void setDefaultProvider(Container container, String spiName, String providerId, String... config) {
                 List<String> args = new LinkedList<>();
-                args.add(KEYCLOAKX_ARG_SPI_PREFIX + toDashCase(spiName) + "-provider=" + providerId);
+                args.add(KEYCLOAKX_ARG_SPI_PREFIX + toDashCase(spiName) + "--provider=" + providerId);
                 if (config != null) {
                     String optionName = null;
                     for (String c : config) {
                         if (optionName == null) {
                             optionName = c;
                         } else {
-                            args.add(KEYCLOAKX_ARG_SPI_PREFIX + toDashCase(spiName) + "-" + providerId + "-" + optionName + "=" + c);
+                            args.add(KEYCLOAKX_ARG_SPI_PREFIX + toDashCase(spiName) + "--" + providerId + "--" + optionName + "=" + c);
                             optionName = null;
                         }
                     }
@@ -197,7 +197,7 @@ public static void removeProvider(SuiteContext suiteContext, SetDefaultProvider
         Container container = authServerInfo.getArquillianContainer();
 
         log.infof("Removing default provider setting for %s", spi);
-        
+
         if (annotation.onlyUpdateDefault()) {
             spiSwitcher.unsetDefaultProvider(container, spi);
         } else {
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/TokenUtil.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/TokenUtil.java
index 355a1a99ea0e..ac529215ef42 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/TokenUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/TokenUtil.java
@@ -19,6 +19,8 @@
 import org.junit.rules.TestRule;
 import org.junit.runners.model.Statement;
 import org.keycloak.common.util.Time;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import static org.junit.Assert.fail;
 
@@ -42,9 +44,8 @@ public TokenUtil() {
     public TokenUtil(String username, String password) {
         this.username = username;
         this.password = password;
-        this.oauth = new OAuthClient();
-        this.oauth.init(null);
-        this.oauth.clientId("direct-grant");
+        this.oauth = new OAuthClient(HttpClientUtils.createDefault(), null);
+        this.oauth.client("direct-grant", "password");
     }
 
     @Override
@@ -68,7 +69,7 @@ public String getToken() {
 
     private void load() {
         try {
-            OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest("password", username, password);
+            AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest(username, password);
             if (accessTokenResponse.getStatusCode() != 200) {
                 fail("Failed to get token: " + accessTokenResponse.getErrorDescription());
             }
@@ -84,7 +85,7 @@ private void load() {
 
     private void refresh() {
         try {
-            OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doRefreshTokenRequest(refreshToken, "password");
+            AccessTokenResponse accessTokenResponse = oauth.doRefreshTokenRequest(refreshToken);
             if (accessTokenResponse.getStatusCode() != 200) {
                 fail("Failed to get token: " + accessTokenResponse.getErrorDescription());
             }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UIUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UIUtils.java
index bb2ddcc60cee..cec9d9f4bde4 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UIUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UIUtils.java
@@ -3,6 +3,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.junit.Assert;
 import org.keycloak.testsuite.page.AbstractPatternFlyAlert;
+import org.keycloak.testsuite.pages.AbstractPage;
 import org.openqa.selenium.By;
 import org.openqa.selenium.JavascriptExecutor;
 import org.openqa.selenium.Keys;
@@ -84,6 +85,16 @@ public static void clickLink(WebElement element) {
         clickElement(element, Keys.ENTER);
     }
 
+    /**
+     * Same than clickLink but it does not perform any wait after clicking or sending the
+     * enter key.
+     *
+     * @param element The element to click
+     */
+    public static void clickLinkWithoutWait(WebElement element) {
+        clickLinkWithoutWait(element, Keys.ENTER);
+    }
+
     private static void clickElement(WebElement element, CharSequence key) {
         WebDriver driver = getCurrentDriver();
 
@@ -94,6 +105,17 @@ private static void clickElement(WebElement element, CharSequence key) {
                 : element::click);
     }
 
+    private static void clickLinkWithoutWait(WebElement element, CharSequence key) {
+        WebDriver driver = getCurrentDriver();
+
+        waitUntilElement(element).is().clickable();
+
+        if (BrowserDriverUtil.isDriverChrome(driver)) {
+            element.sendKeys(key);
+        } else {
+            element.click();
+        }
+    }
 
     /**
      * The method executes click in the element. This method always uses click and
@@ -290,4 +312,22 @@ public static String getRawPageSource(WebDriver driver) {
     public static String getRawPageSource() {
         return getRawPageSource(getCurrentDriver());
     }
+
+    /**
+     * Navigates the driver back but it refreshes the page if it is not the expected one for
+     * chrome. Chrome 136 does not respect cache-control and refresh is needed
+     * to reach the server again (the page is cached no matter the cache-control
+     * directive returned).
+     * See https://issues.chromium.org/issues/415773538
+     *
+     * @param driver The driver used
+     * @param expectedPage The expected page
+     */
+    public static void navigateBackWithRefresh(WebDriver driver, AbstractPage expectedPage) {
+        driver.navigate().back();
+        if (!expectedPage.isCurrent() && BrowserDriverUtil.isDriverChrome(driver)) {
+            driver.navigate().refresh();
+        }
+        expectedPage.assertCurrent();
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/URLUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/URLUtils.java
index 56a1bcb74abd..0cd5bd150d6f 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/URLUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/URLUtils.java
@@ -3,6 +3,7 @@
 
 import org.jboss.logging.Logger;
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.TimeoutException;
 import org.openqa.selenium.WebDriver;
 import org.openqa.selenium.support.ui.ExpectedCondition;
@@ -13,6 +14,7 @@
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
+import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import static org.keycloak.testsuite.util.DroneUtils.getCurrentDriver;
@@ -98,6 +100,18 @@ private static boolean urlCheck(ExpectedCondition condition) {
         return true;
     }
 
+    /**
+     * @return action-url from the HTML code of the current page. Assumption is, that page is one of the Keycloak login pages (login theme pages)
+     */
+    public static String getActionUrlFromCurrentPage(WebDriver driver) {
+        Matcher m = Pattern.compile("form action=\"([^\"]*)\"").matcher(driver.getPageSource());
+        if (m.find()) {
+            return m.group(1);
+        } else {
+            return null;
+        }
+    }
+
     /**
      * @see #sendPOSTRequestWithWebDriver(String, String)
      *
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java
index c8a676712c99..d27647c496e8 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/UserInfoClientUtil.java
@@ -20,6 +20,7 @@
 import org.junit.Assert;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
 import org.keycloak.representations.UserInfo;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.utils.MediaType;
 
 import jakarta.ws.rs.client.Client;
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/WaitUtils.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/WaitUtils.java
index fc4b7d41e132..c978fd9ac21b 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/WaitUtils.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/WaitUtils.java
@@ -137,19 +137,19 @@ public static void waitForPageToLoad() {
             return; // not needed
         }
 
-        String currentUrl = null;
-
         // Ensure the URL is "stable", i.e. is not changing anymore; if it'd changing, some redirects are probably still in progress
         for (int maxRedirects = 4; maxRedirects > 0; maxRedirects--) {
-            currentUrl = driver.getCurrentUrl();
-            FluentWait<WebDriver> wait = new FluentWait<>(driver).withTimeout(Duration.ofMillis(250));
             try {
+                String currentUrl = driver.getCurrentUrl();
+                FluentWait<WebDriver> wait = new FluentWait<>(driver).withTimeout(Duration.ofMillis(250));
                 wait.until(not(urlToBe(currentUrl)));
-            }
-            catch (TimeoutException e) {
+            } catch (TimeoutException e) {
                 if (driver.getPageSource() != null) {
                     break; // URL has not changed recently - ok, the URL is stable and page is current
                 }
+            } catch (Exception e) {
+                log.warnf("Unknown exception thrown waiting stabilization of the URL: %s", e.getMessage());
+                pause(250);
             }
             if (maxRedirects == 1) {
                 log.warn("URL seems unstable! (Some redirect are probably still in progress)");
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JSObjectBuilder.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JSObjectBuilder.java
deleted file mode 100644
index 44600ca5129b..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JSObjectBuilder.java
+++ /dev/null
@@ -1,149 +0,0 @@
-package org.keycloak.testsuite.util.javascript;
-
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Objects;
-
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author mhajas
- */
-public class JSObjectBuilder {
-
-    private Map<String, Object> arguments;
-
-
-    public static JSObjectBuilder create() {
-        return new JSObjectBuilder();
-    }
-
-    private JSObjectBuilder() {
-        arguments = new HashMap<>();
-    }
-
-    public JSObjectBuilder defaultSettings() {
-        standardFlow();
-        fragmentResponse();
-        enableLogging();
-        return this;
-    }
-
-    public JSObjectBuilder standardFlow() {
-        arguments.put("flow", "standard");
-        return this;
-    }
-
-    public JSObjectBuilder implicitFlow() {
-        arguments.put("flow", "implicit");
-        return this;
-    }
-
-    public JSObjectBuilder fragmentResponse() {
-        arguments.put("responseMode", "fragment");
-        return this;
-    }
-
-    public JSObjectBuilder queryResponse() {
-        arguments.put("responseMode", "query");
-        return this;
-    }
-
-    public JSObjectBuilder checkSSOOnLoad() {
-        arguments.put("onLoad", "check-sso");
-        return this;
-    }
-
-    public JSObjectBuilder disableSilentCheckSSOFallback() {
-        arguments.put("silentCheckSsoFallback", false);
-        return this;
-    }
-
-    public JSObjectBuilder disableCheckLoginIframe() {
-        arguments.put("checkLoginIframe", false);
-        return this;
-    }
-
-    public JSObjectBuilder setCheckLoginIframeIntervalTo1() {
-        arguments.put("checkLoginIframeInterval", 1);
-        return this;
-    }
-
-    public JSObjectBuilder loginRequiredOnLoad() {
-        arguments.put("onLoad", "login-required");
-        return this;
-    }
-
-    public JSObjectBuilder enableLogging() {
-        arguments.put("enableLogging", true);
-        return this;
-    }
-
-    public boolean contains(String key, Object value) {
-       return arguments.containsKey(key) && arguments.get(key).equals(value);
-    }
-
-    public JSObjectBuilder add(String key, Object value) {
-        arguments.put(key, value);
-        return this;
-    }
-
-    public boolean isLoginRequired() {
-        return arguments.get("onLoad").equals("login-required");
-    }
-
-
-    public JSObjectBuilder pkceS256() {
-        return pkceMethod("S256");
-    }
-
-    private JSObjectBuilder pkceMethod(String method) {
-        arguments.put("pkceMethod", method);
-        return this;
-    }
-
-    public JSObjectBuilder acrValues(String value) {
-        Objects.requireNonNull(value, "value");
-        arguments.put("acrValues", value);
-        return this;
-    }
-
-    private boolean skipQuotes(Object o) {
-        return (o instanceof Integer || o instanceof Boolean || o instanceof JSObjectBuilder);
-    }
-
-    public String build() {
-        StringBuilder argument = new StringBuilder("{");
-        String comma = "";
-        for (Map.Entry<String, Object> option : arguments.entrySet()) {
-            argument.append(comma)
-                    .append(option.getKey())
-                    .append(" : ");
-
-            if (option.getValue().getClass().isArray()) {
-                try {
-                    argument.append(JsonSerialization.writeValueAsString(option.getValue()));
-                } catch (IOException ioe) {
-                    throw new IllegalArgumentException("Not possible to serialize value of the option " + option.getKey(), ioe);
-                }
-            } else {
-                if (!skipQuotes(option.getValue())) argument.append("\"");
-
-                argument.append(option.getValue());
-
-                if (!skipQuotes(option.getValue())) argument.append("\"");
-            }
-            comma = ",";
-        }
-
-        argument.append("}");
-
-        return argument.toString();
-    }
-
-    @Override
-    public String toString() {
-        return build();
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptStateValidator.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptStateValidator.java
deleted file mode 100644
index 504faa243f0d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptStateValidator.java
+++ /dev/null
@@ -1,14 +0,0 @@
-package org.keycloak.testsuite.util.javascript;
-
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-
-import java.io.Serializable;
-
-/**
- * @author mhajas
- */
-public interface JavascriptStateValidator extends Serializable {
-
-    void validate(WebDriver driver, Object output, WebElement events);
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptTestExecutor.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptTestExecutor.java
deleted file mode 100644
index c07f48934a71..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/JavascriptTestExecutor.java
+++ /dev/null
@@ -1,391 +0,0 @@
-package org.keycloak.testsuite.util.javascript;
-
-import org.jboss.logging.Logger;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.auth.page.login.OIDCLogin;
-import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.util.WaitUtils;
-import org.openqa.selenium.By;
-import org.openqa.selenium.JavascriptExecutor;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebDriverException;
-import org.openqa.selenium.WebElement;
-
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.util.WaitUtils.pause;
-import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
-
-
-/**
- * @author mhajas
- */
-public class JavascriptTestExecutor {
-    protected WebDriver jsDriver;
-    protected JavascriptExecutor jsExecutor;
-    private WebElement output;
-    protected WebElement events;
-    private OIDCLogin loginPage;
-    protected boolean configured;
-
-    private static final Logger logger = Logger.getLogger(JavascriptTestExecutor.class);
-
-    public static JavascriptTestExecutor create(WebDriver driver, OIDCLogin loginPage) {
-        return new JavascriptTestExecutor(driver, loginPage);
-    }
-
-    protected JavascriptTestExecutor(WebDriver driver, OIDCLogin loginPage) {
-        this.jsDriver = driver;
-        driver.manage().timeouts().setScriptTimeout(WaitUtils.PAGELOAD_TIMEOUT_MILLIS, TimeUnit.MILLISECONDS);
-        jsExecutor = (JavascriptExecutor) driver;
-        events = driver.findElement(By.id("events"));
-        output = driver.findElement(By.id("output"));
-        this.loginPage = loginPage;
-        configured = false;
-    }
-
-    public JavascriptTestExecutor login() {
-        return login((String)null, null);
-    }
-
-    public JavascriptTestExecutor login(JavascriptStateValidator validator) {
-        return login((String)null, validator);
-    }
-
-    /**
-     * Attaches a MutationObserver that sends a message from iframe to main window with incorrect data when the iframe is loaded
-     */
-    public JavascriptTestExecutor attachCheck3pCookiesIframeMutationObserver() {
-        jsExecutor.executeScript("// Select the node that will be observed for mutations\n" +
-                "    const targetNode = document.body;" +
-                "" +
-                "    // Options for the observer (which mutations to observe)\n" +
-                "    const config = {attributes: true, childList: true, subtree: true};" +
-                "" +
-                "    // Callback function to execute when mutations are observed\n" +
-                "    const callback = function (mutationsList, observer) {" +
-                "        console.log(\"Mutation found\");" +
-                "        var iframeNode = mutationsList[0].addedNodes[0];" +
-        "                if (iframeNode && iframeNode.localName === 'iframe') {" +
-        "                    var s = document.createElement('script');" +
-        "                    s.type = 'text/javascript';" +
-        "                    var code = \"window.parent.postMessage('Evil Message', '*');\";" +
-        "                    s.appendChild(document.createTextNode(code));" +
-        "                    iframeNode.contentDocument.body.appendChild(s);" +
-        "                }" +
-                "    }\n" +
-                "" +
-                "    // Create an observer instance linked to the callback function\n" +
-                "    const observer = new MutationObserver(callback);" +
-                "" +
-                "    // Start observing the target node for configured mutations\n" +
-                "    observer.observe(targetNode, config);");
-
-        return this;
-    }
-
-    public JavascriptTestExecutor login(JSObjectBuilder optionsBuilder, JavascriptStateValidator validator) {
-        return login(optionsBuilder.build(), validator);
-    }
-
-    public JavascriptTestExecutor login(String options, JavascriptStateValidator validator) {
-        if (options == null)
-            jsExecutor.executeScript("keycloak.login()");
-        else {
-            jsExecutor.executeScript("keycloak.login(" + options + ")");
-        }
-        waitForPageToLoad();
-
-        if (validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        configured = false; // Getting out of testApp page => loosing keycloak variable etc.
-
-        return this;
-    }
-
-    public JavascriptTestExecutor loginForm(UserRepresentation user) {
-        return loginForm(user, null);
-    }
-
-    public JavascriptTestExecutor loginForm(UserRepresentation user, JavascriptStateValidator validator) {
-        loginPage.form().login(user);
-        waitForPageToLoad();
-
-        if (validator != null) {
-            validator.validate(jsDriver, null, events);
-        }
-
-        configured = false; // Getting out of testApp page => loosing keycloak variable etc.
-        // this is necessary in case we skipped login button for example in login-required mode
-
-        return this;
-    }
-
-    public JavascriptTestExecutor logout() {
-        return logout(null);
-    }
-
-    public JavascriptTestExecutor logout(JavascriptStateValidator validator) {
-        return logout(validator, null);
-    }
-
-    public JavascriptTestExecutor logout(JavascriptStateValidator validator, LogoutConfirmPage logoutConfirmPage) {
-        return logout(validator, logoutConfirmPage, null);
-    }
-
-    public JavascriptTestExecutor logout(JavascriptStateValidator validator, LogoutConfirmPage logoutConfirmPage, JSObjectBuilder logoutOptions) {
-        String logoutOptionsString = logoutOptions == null ? "" : logoutOptions.toString();
-        jsExecutor.executeScript("keycloak.logout(" + logoutOptionsString + ")");
-
-        try {
-            // simple check if we are at the logout confirm page, if so just click 'Yes'
-            if (logoutConfirmPage != null && logoutConfirmPage.isCurrent(jsDriver)) {
-                logoutConfirmPage.confirmLogout(jsDriver);
-                waitForPageToLoad();
-            }
-        } catch (Exception ex) {
-            // ignore errors when checking logoutConfirm page, if an error tests will also fail
-            logger.error("Exception during checking logout confirmation page", ex);
-        }
-
-        if (validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        configured = false; // Loosing keycloak variable so we need to create it when init next session
-
-        return this;
-    }
-
-    public JavascriptTestExecutor configure() {
-        return configure(null);
-    }
-
-    public JavascriptTestExecutor configure(JSObjectBuilder argumentsBuilder) {
-        // a nasty hack: redirect console.warn to events
-        // mainly for FF as it doesn't yet support reading console.warn directly through webdriver
-        // see https://github.com/mozilla/geckodriver/issues/284
-        jsExecutor.executeScript("console.warn = event;");
-
-        if (argumentsBuilder == null) {
-            jsExecutor.executeScript("window.keycloak = new Keycloak('./keycloak.json');");
-        } else {
-            String configArguments = argumentsBuilder.build();
-            jsExecutor.executeScript("window.keycloak = new Keycloak(" + configArguments + ");");
-        }
-
-        jsExecutor.executeScript("window.keycloak.onAuthSuccess = function () {event('Auth Success')};"); // event function is declared in index.html
-        jsExecutor.executeScript("window.keycloak.onAuthError = function () {event('Auth Error')}");
-        jsExecutor.executeScript("window.keycloak.onAuthRefreshSuccess = function () {event('Auth Refresh Success')}");
-        jsExecutor.executeScript("window.keycloak.onAuthRefreshError = function () {event('Auth Refresh Error')}");
-        jsExecutor.executeScript("window.keycloak.onAuthLogout = function () {event('Auth Logout')}");
-        jsExecutor.executeScript("window.keycloak.onTokenExpired = function () {event('Access token expired.')}");
-        jsExecutor.executeScript("window.keycloak.onActionUpdate = function (status) {event('AIA status: ' + status)}");
-
-        configured = true;
-
-        return this;
-    }
-
-    public JavascriptTestExecutor init(JSObjectBuilder argumentsBuilder) {
-        return init(argumentsBuilder, null);
-    }
-
-    public JavascriptTestExecutor init(JSObjectBuilder argumentsBuilder, JavascriptStateValidator validator) {
-        return init(argumentsBuilder, validator, false);
-    }
-
-    public JavascriptTestExecutor init(JSObjectBuilder argumentsBuilder, JavascriptStateValidator validator, boolean expectPromptNoneRedirect) {
-        if(!configured) {
-            configure();
-        }
-
-        String arguments = argumentsBuilder != null ? argumentsBuilder.build() : "";
-
-        String script = "var callback = arguments[arguments.length - 1];" +
-                "   window.keycloak.init(" + arguments + ").then(function (authenticated) {" +
-                "       callback(\"Init Success (\" + (authenticated ? \"Authenticated\" : \"Not Authenticated\") + \")\");" +
-                "   }).catch(function (error) {" +
-                "       callback(error);" +
-                "   });";
-
-        Object output;
-
-        if (expectPromptNoneRedirect) {
-            try {
-                output = jsExecutor.executeAsyncScript(script);
-                fail("Redirect to Keycloak was expected");
-            }
-            catch (WebDriverException e) {
-                waitForPageToLoad();
-                configured = false;
-                // the redirect should use prompt=none, that means KC should immediately redirect back to the app (regardless login state)
-                return init(argumentsBuilder, validator, false);
-            }
-        }
-        else {
-            output = jsExecutor.executeAsyncScript(script);
-        }
-
-        if (validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        return this;
-    }
-
-    public JavascriptTestExecutor logInAndInit(JSObjectBuilder argumentsBuilder,
-                                               UserRepresentation user, JavascriptStateValidator validator) {
-        init(argumentsBuilder);
-        login();
-        loginForm(user);
-        init(argumentsBuilder, validator);
-        return this;
-    }
-
-    public JavascriptTestExecutor refreshToken(int value) {
-        return refreshToken(value, null);
-    }
-
-    public JavascriptTestExecutor refreshToken(int value, JavascriptStateValidator validator) {
-        String script = "var callback = arguments[arguments.length - 1];" +
-                "   window.keycloak.updateToken(" + Integer.toString(value) + ").then(function (refreshed) {" +
-                "       if (refreshed) {" +
-                "            callback(window.keycloak.tokenParsed);" +
-                "       } else {" +
-                "            callback('Token not refreshed, valid for ' + Math.round(window.keycloak.tokenParsed.exp + window.keycloak.timeSkew - new Date().getTime() / 1000) + ' seconds');" +
-                "       }" +
-                "   }).catch(function () {" +
-                "       callback('Failed to refresh token');" +
-                "   });";
-
-        Object output = jsExecutor.executeAsyncScript(script);
-
-        if(validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        return this;
-    }
-
-    public JavascriptTestExecutor openAccountPage(JavascriptStateValidator validator) {
-        jsExecutor.executeScript("window.keycloak.accountManagement()");
-        waitForPageToLoad();
-
-        // Leaving page -> loosing keycloak variable
-        configured = false;
-
-        if (validator != null) {
-            validator.validate(jsDriver, null, null);
-        }
-
-        return this;
-    }
-
-    public JavascriptTestExecutor getProfile() {
-        return getProfile(null);
-    }
-
-    public JavascriptTestExecutor getProfile(JavascriptStateValidator validator) {
-
-        String script = "var callback = arguments[arguments.length - 1];" +
-                    "   window.keycloak.loadUserProfile().then(function (profile) {" +
-                    "       callback(profile);" +
-                    "   }, function () {" +
-                    "       callback('Failed to load profile');" +
-                    "   });";
-
-        Object output = jsExecutor.executeAsyncScript(script);
-
-        if(validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-        return this;
-    }
-
-    public JavascriptTestExecutor sendXMLHttpRequest(XMLHttpRequest request, ResponseValidator validator) {
-        validator.validate(request.send(jsExecutor));
-
-        return this;
-    }
-
-    public JavascriptTestExecutor refresh() {
-        jsDriver.navigate().refresh();
-        configured = false; // Refreshing webpage => Loosing window.keycloak variable
-
-        return this;
-    }
-
-    public JavascriptTestExecutor addTimeSkew(int addition) {
-        jsExecutor.executeScript("window.keycloak.timeSkew += " + Integer.toString(addition));
-
-        return this;
-    }
-
-    public JavascriptTestExecutor checkTimeSkew(JavascriptStateValidator validator) {
-        Object timeSkew = jsExecutor.executeScript("return window.keycloak.timeSkew");
-
-        validator.validate(jsDriver, timeSkew, events);
-
-        return this;
-    }
-
-    public JavascriptTestExecutor executeScript(String script) {
-        return executeScript(script, null);
-    }
-
-    public JavascriptTestExecutor executeScript(String script, JavascriptStateValidator validator) {
-        Object output = jsExecutor.executeScript(script);
-
-        if(validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        return this;
-    }
-
-    public boolean isLoggedIn() {
-        return (boolean) jsExecutor.executeScript("if (typeof keycloak !== 'undefined') {" +
-                "return keycloak.authenticated" +
-                "} else { return false}");
-    }
-
-    public JavascriptTestExecutor executeAsyncScript(String script) {
-        return executeAsyncScript(script, null);
-    }
-
-    public JavascriptTestExecutor executeAsyncScript(String script, JavascriptStateValidator validator) {
-        Object output = jsExecutor.executeAsyncScript(script);
-
-        if(validator != null) {
-            validator.validate(jsDriver, output, events);
-        }
-
-        return this;
-    }
-
-    public JavascriptTestExecutor errorResponse(JavascriptStateValidator validator) {
-        Object output = jsExecutor.executeScript("return \"Error: \" + getParameterByName(\"error\") + \"\\n\" + \"Error description: \" + getParameterByName(\"error_description\")");
-
-        validator.validate(jsDriver, output, events);
-        return this;
-    }
-
-    public JavascriptTestExecutor wait(long millis, JavascriptStateValidator validator) {
-        pause(millis);
-
-        if (validator != null) {
-            validator.validate(jsDriver, null, events);
-        }
-
-        return this;
-    }
-
-    public JavascriptTestExecutor validateOutputField(JavascriptStateValidator validator) {
-        validator.validate(jsDriver, output, events);
-        return this;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/ResponseValidator.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/ResponseValidator.java
deleted file mode 100644
index b54c11331c1c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/ResponseValidator.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package org.keycloak.testsuite.util.javascript;
-
-import java.io.Serializable;
-import java.util.Map;
-
-/**
- * @author mhajas
- */
-public interface ResponseValidator extends Serializable {
-
-    void validate(Map<String, Object> response);
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/XMLHttpRequest.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/XMLHttpRequest.java
deleted file mode 100644
index 8e79e6aaeb84..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/javascript/XMLHttpRequest.java
+++ /dev/null
@@ -1,91 +0,0 @@
-package org.keycloak.testsuite.util.javascript;
-
-import org.openqa.selenium.JavascriptExecutor;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author mhajas
- */
-public class XMLHttpRequest {
-
-    private String url;
-    private String method;
-    private Map<String, String> headers;
-    private String content;
-
-    public static XMLHttpRequest create() {
-        return new XMLHttpRequest();
-    }
-
-    private XMLHttpRequest() {}
-
-    public XMLHttpRequest url(String url) {
-        this.url = url;
-        return this;
-    }
-
-    public String getUrl() {
-        return url;
-    }
-
-    public XMLHttpRequest method(String method) {
-        this.method = method;
-        return this;
-    }
-
-    public XMLHttpRequest content(String content) {
-        this.content = content;
-        return this;
-    }
-
-    public XMLHttpRequest addHeader(String key, String value) {
-        if (headers == null) {
-            headers = new HashMap<>();
-        }
-
-        headers.put(key, value);
-
-        return this;
-    }
-
-    public XMLHttpRequest includeBearerToken() {
-        addHeader("Authorization", "Bearer ' + keycloak.token + '");
-        return this;
-    }
-
-    public XMLHttpRequest includeRpt() {
-        addHeader("Authorization", "Bearer ' + authorization.rpt + '");
-        return this;
-    }
-
-    public Map<String, Object> send(JavascriptExecutor jsExecutor) {
-        String requestCode = "var callback = arguments[arguments.length - 1];" +
-                        "var req = new XMLHttpRequest();" +
-                        "        req.open('" + method + "', '" + url + "', true);" +
-                        getHeadersString() +
-                        "        req.onreadystatechange = function () {" +
-                        "            if (req.readyState == 4) {" +
-                        "                callback({\"status\" : req.status, \"responseHeaders\" : req.getAllResponseHeaders(), \"res\" : req.response})" +
-                        "            }" +
-                        "        };" +
-                        "        req.send(" + content + ");";
-
-        return (Map<String, Object>) jsExecutor.executeAsyncScript(requestCode);
-    }
-
-    private String getHeadersString() {
-        StringBuilder builder = new StringBuilder();
-        for (Map.Entry<String, String> entry : headers.entrySet()) {
-            builder.append("req.setRequestHeader('")
-                    .append(entry.getKey())
-                    .append("', '")
-                    .append(entry.getValue())
-                    .append("');");
-        }
-
-        return builder.toString();
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClient.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClient.java
new file mode 100644
index 000000000000..33d13e08cafe
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/oauth/OAuthClient.java
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.util.oauth;
+
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.testsuite.pages.LoginPage;
+import org.openqa.selenium.WebDriver;
+import org.openqa.selenium.support.PageFactory;
+
+import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
+import static org.keycloak.testsuite.util.ServerURLs.removeDefaultPorts;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+public class OAuthClient extends AbstractOAuthClient<OAuthClient> {
+
+    public static String SERVER_ROOT;
+    public static String AUTH_SERVER_ROOT;
+    public static String APP_ROOT;
+    public static String APP_AUTH_ROOT;
+
+    static {
+        updateURLs(getAuthServerContextRoot());
+    }
+
+    // Workaround, but many tests directly use system properties like OAuthClient.AUTH_SERVER_ROOT instead of taking the URL from suite context
+    public static void updateURLs(String serverRoot) {
+        SERVER_ROOT = removeDefaultPorts(serverRoot);
+        AUTH_SERVER_ROOT = SERVER_ROOT + "/auth";
+        updateAppRootRealm("master");
+    }
+
+    public static void updateAppRootRealm(String realm) {
+        APP_ROOT = AUTH_SERVER_ROOT + "/realms/" + realm + "/app";
+        APP_AUTH_ROOT = APP_ROOT + "/auth";
+    }
+
+    public static void resetAppRootRealm() {
+        updateAppRootRealm("master");
+    }
+
+    public OAuthClient(CloseableHttpClient httpClient, WebDriver webDriver) {
+        super(AUTH_SERVER_ROOT, httpClient, webDriver);
+        init();
+    }
+
+    public OAuthClient newConfig() {
+        OAuthClient newClient = new OAuthClient(httpClientManager.get(), driver);
+        newClient.init();
+        return newClient;
+    }
+
+    public void init() {
+        config = new OAuthClientConfig()
+                .realm("test")
+                .client("test-app", "password")
+                .redirectUri(APP_ROOT + "/auth")
+                .postLogoutRedirectUri(APP_ROOT + "/auth")
+                .responseType(OAuth2Constants.CODE);
+    }
+
+    public void setDriver(WebDriver driver) {
+        this.driver = driver;
+    }
+
+    public void fillLoginForm(String username, String password) {
+        LoginPage loginPage = new LoginPage();
+        PageFactory.initElements(driver, loginPage);
+        loginPage.login(username, password);
+    }
+
+    /**
+     * @deprecated This method is deprecated, use {@link OAuthClient#client(String)} for public clients,
+     * or {@link OAuthClient#client(String, String)} for confidential clients
+     */
+    @Deprecated
+    public OAuthClient clientId(String clientId) {
+        config.clientId(clientId);
+        return this;
+    }
+
+    public WebDriver getDriver() {
+        return driver;
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/authenticators/DefaultVirtualAuthOptions.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/authenticators/DefaultVirtualAuthOptions.java
index dd47f866a04e..7fd5b7b722b4 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/authenticators/DefaultVirtualAuthOptions.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/authenticators/DefaultVirtualAuthOptions.java
@@ -44,6 +44,7 @@ public enum DefaultVirtualAuthOptions {
             .setHasUserVerification(true)
             .setIsUserVerified(true)
             .setIsUserConsenting(true)),
+    PASSKEYS(() -> DEFAULT_RESIDENT_KEY.getOptions().setTransport(INTERNAL)),
 
     YUBIKEY_4(DefaultVirtualAuthOptions::getYubiKeyGeneralOptions),
     YUBIKEY_5_USB(DefaultVirtualAuthOptions::getYubiKeyGeneralOptions),
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnErrorPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnErrorPage.java
index aad92af8ca3c..04580a49fb81 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnErrorPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnErrorPage.java
@@ -62,8 +62,4 @@ public boolean isCurrent() {
         }
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnLoginPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnLoginPage.java
index ccee82501fa3..4b08dae6bd19 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnLoginPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnLoginPage.java
@@ -19,6 +19,7 @@
 
 import org.jboss.arquillian.graphene.page.Page;
 import org.keycloak.testsuite.pages.LanguageComboboxAwarePage;
+import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebElement;
@@ -43,7 +44,7 @@ public class WebAuthnLoginPage extends LanguageComboboxAwarePage {
 
     public void clickAuthenticate() {
         WaitUtils.waitUntilElement(authenticateButton).is().clickable();
-        authenticateButton.click();
+        UIUtils.clickLink(authenticateButton);
     }
 
     public boolean isCurrent() {
@@ -59,9 +60,4 @@ public WebAuthnAuthenticatorsList getAuthenticators() {
         return authenticators;
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnRegisterPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnRegisterPage.java
index 7d85873452b7..df1824ec3d3e 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnRegisterPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/pages/WebAuthnRegisterPage.java
@@ -19,6 +19,7 @@
 
 import org.hamcrest.CoreMatchers;
 import org.keycloak.testsuite.pages.LogoutSessionsPage;
+import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.Alert;
 import org.openqa.selenium.By;
@@ -56,14 +57,12 @@ public class WebAuthnRegisterPage extends LogoutSessionsPage {
     private WebElement formTitle;
 
     public void clickRegister() {
-        WaitUtils.waitUntilElement(registerButton).is().clickable();
-        registerButton.click();
+        UIUtils.clickLinkWithoutWait(registerButton);
     }
 
     public void cancelAIA() {
         assertThat("It only works with AIA", isAIA(), CoreMatchers.is(true));
-        WaitUtils.waitUntilElement(cancelAIAButton).is().clickable();
-        cancelAIAButton.click();
+        UIUtils.clickLink(cancelAIAButton);
     }
 
     public void registerWebAuthnCredential(String authenticatorLabel) {
@@ -119,9 +118,4 @@ public boolean isCurrent() {
                 driver.findElement(By.id("registerWebAuthn")).isDisplayed();
     }
 
-    @Override
-    public void open() {
-        throw new UnsupportedOperationException();
-    }
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/AbstractWebAuthnRealmUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/AbstractWebAuthnRealmUpdater.java
index da1fe26689f1..b9025a00ddea 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/AbstractWebAuthnRealmUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/AbstractWebAuthnRealmUpdater.java
@@ -51,6 +51,8 @@ public AbstractWebAuthnRealmUpdater(RealmResource resource) {
 
     public abstract T setWebAuthnPolicyAcceptableAaguids(List<String> webAuthnPolicyAcceptableAaguids);
 
+    public abstract T setWebAuthnPolicyPasskeysEnabled(Boolean webAuthnPolicyPasskeysEnabled);
+
     @Override
     @SuppressWarnings("unchecked")
     public AbstractWebAuthnRealmUpdater<T> update() {
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/PasswordLessRealmAttributeUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/PasswordLessRealmAttributeUpdater.java
index 28e2302ae1ae..b2b0cbe86ac3 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/PasswordLessRealmAttributeUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/PasswordLessRealmAttributeUpdater.java
@@ -88,4 +88,10 @@ public PasswordLessRealmAttributeUpdater setWebAuthnPolicyAcceptableAaguids(List
         rep.setWebAuthnPolicyPasswordlessAcceptableAaguids(webAuthnPolicyAcceptableAaguids);
         return this;
     }
+
+    @Override
+    public PasswordLessRealmAttributeUpdater setWebAuthnPolicyPasskeysEnabled(Boolean webAuthnPolicyPasskeysEnabled) {
+        rep.setWebAuthnPolicyPasswordlessPasskeysEnabled(webAuthnPolicyPasskeysEnabled);
+        return this;
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/WebAuthnRealmAttributeUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/WebAuthnRealmAttributeUpdater.java
index be70ff3d3468..7ec7eaca0bfc 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/WebAuthnRealmAttributeUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/updaters/WebAuthnRealmAttributeUpdater.java
@@ -89,4 +89,10 @@ public WebAuthnRealmAttributeUpdater setWebAuthnPolicyAcceptableAaguids(List<Str
         return this;
     }
 
+    @Override
+    public WebAuthnRealmAttributeUpdater setWebAuthnPolicyPasskeysEnabled(Boolean webAuthnPolicyPasskeysEnabled) {
+        // passkeys are only used in passwordless policy
+        return this;
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/utils/PropertyRequirement.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/utils/PropertyRequirement.java
index 6eada26a1421..d70d51713308 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/utils/PropertyRequirement.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/webauthn/utils/PropertyRequirement.java
@@ -17,14 +17,13 @@
 
 package org.keycloak.testsuite.webauthn.utils;
 
-import org.keycloak.WebAuthnConstants;
-
 import java.util.Arrays;
+import org.keycloak.models.Constants;
 
 public enum PropertyRequirement {
-    NOT_SPECIFIED(WebAuthnConstants.OPTION_NOT_SPECIFIED),
-    YES("Yes"),
-    NO("No");
+    NOT_SPECIFIED(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED),
+    YES(Constants.WEBAUTHN_POLICY_OPTION_YES),
+    NO(Constants.WEBAUTHN_POLICY_OPTION_NO);
 
     private final String value;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractAuthTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractAuthTest.java
index dd1dff0db6ff..94ba1697fb9c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractAuthTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractAuthTest.java
@@ -90,14 +90,18 @@ public void beforeAuthTest() {
 
 
     public void createTestUserWithAdminClient() {
-        createTestUserWithAdminClient(true);
+        createTestUserWithAdminClient(true, PASSWORD);
     }
 
     public void createTestUserWithAdminClient(boolean setRealmRoles) {
+        createTestUserWithAdminClient(setRealmRoles, PASSWORD);
+    }
+
+    public void createTestUserWithAdminClient(boolean setRealmRoles, String password) {
         ApiUtil.removeUserByUsername(testRealmResource(), "test");
 
         log.debug("creating test user");
-        String id = createUserAndResetPasswordWithAdminClient(testRealmResource(), testUser, PASSWORD);
+        String id = createUserAndResetPasswordWithAdminClient(testRealmResource(), testUser, password);
         testUser.setId(id);
 
         if (setRealmRoles) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractChangeImportedUserPasswordsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractChangeImportedUserPasswordsTest.java
new file mode 100644
index 000000000000..7a12c4a4ee8b
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractChangeImportedUserPasswordsTest.java
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2025 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.testsuite;
+
+import java.util.List;
+import java.util.Map;
+import org.junit.Before;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.admin.ApiUtil;
+
+/**
+ * <p>Abstract class that re-generates all imported user passwords with a random one.
+ * This way all the passwords are random and cannot be rejected by security
+ * configurations in browsers (chrome for example). The passwords are stored in
+ * a map inside the test context to be retrieved using the username.</p>
+ *
+ * @author rmartinc
+ */
+abstract public class AbstractChangeImportedUserPasswordsTest extends AbstractTestRealmKeycloakTest {
+
+    private Map<String, String> userPasswords = null;
+
+    @Before
+    @Override
+    public void beforeAbstractKeycloakTest() throws Exception {
+        super.beforeAbstractKeycloakTest();
+        if (userPasswords == null) {
+            userPasswords = testContext.getUserPasswords();
+        }
+    }
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        if (userPasswords == null) {
+            userPasswords = testContext.getUserPasswords();
+        }
+        userPasswords.clear();
+        List<UserRepresentation> users = testRealm.getUsers();
+        for (UserRepresentation user : users) {
+            List<CredentialRepresentation> credentials = user.getCredentials();
+            if (credentials != null) {
+                for (CredentialRepresentation cred : credentials) {
+                    if (CredentialRepresentation.PASSWORD.equals(cred.getType())) {
+                        // re-generate the password for the user using a random one
+                        cred.setValue(generatePassword(user.getUsername()));
+                    }
+                }
+            }
+        }
+        testContext.setUserPasswords(userPasswords);
+    }
+
+    protected String changePassword(String username) {
+        UserResource userRes = ApiUtil.findUserByUsernameId(testRealm(), username);
+        CredentialRepresentation credential = new CredentialRepresentation();
+        credential.setType(PasswordCredentialModel.TYPE);
+        credential.setTemporary(Boolean.FALSE);
+        credential.setValue(generatePassword());
+        userRes.resetPassword(credential);
+        userPasswords.put(username, credential.getValue());
+        return credential.getValue();
+    }
+
+    protected void changePasswords(String... usernames) {
+        if (usernames != null) {
+            for (String username: usernames) {
+                changePassword(username);
+            }
+        }
+    }
+
+    protected void generatePasswords(String... usernames) {
+        if (usernames != null) {
+            for (String username: usernames) {
+                generatePassword(username);
+            }
+        }
+    }
+
+    protected String generatePassword(String username) {
+        final String password = generatePassword();
+        userPasswords.put(username, password);
+        return password;
+    }
+
+    protected String getPassword(String username) {
+        final String password = userPasswords.get(username);
+        Assert.assertNotNull("password not generated for user " + username, password);
+        return password;
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java
index dc8dbfb97237..667e19078a8a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractKeycloakTest.java
@@ -27,7 +27,9 @@
 import org.junit.After;
 import org.junit.Before;
 import org.junit.ClassRule;
+import org.junit.FixMethodOrder;
 import org.junit.runner.RunWith;
+import org.junit.runners.MethodSorters;
 import org.junit.runners.model.TestTimedOutException;
 import org.keycloak.admin.client.Keycloak;
 import org.keycloak.admin.client.resource.AuthenticationManagementResource;
@@ -35,7 +37,9 @@
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.admin.client.resource.UsersResource;
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
+import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.representations.idm.ClientRepresentation;
@@ -43,7 +47,6 @@
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.AuthServerTestEnricher;
 import org.keycloak.testsuite.arquillian.KcArquillian;
 import org.keycloak.testsuite.arquillian.SuiteContext;
 import org.keycloak.testsuite.arquillian.TestContext;
@@ -58,7 +61,7 @@
 import org.keycloak.testsuite.util.BrowserTabUtil;
 import org.keycloak.testsuite.util.CryptoInitRule;
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TestCleanup;
 import org.keycloak.testsuite.util.TestEventsLogger;
 import org.keycloak.testsuite.util.WaitUtils;
@@ -95,7 +98,6 @@
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertEquals;
-import org.keycloak.models.UserModel;
 import static org.keycloak.testsuite.admin.Users.setPasswordFor;
 import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST;
@@ -111,6 +113,7 @@
  */
 @RunWith(KcArquillian.class)
 @RunAsClient
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
 public abstract class AbstractKeycloakTest {
     protected static final String ENGLISH_LOCALE_NAME = "English";
 
@@ -191,7 +194,7 @@ public void beforeAbstractKeycloakTest() throws Exception {
             afterAbstractKeycloakTestRealmImport();
         }
 
-        oauth.init(driver);
+        oauth.driver(driver).init();
     }
 
     public void reconnectAdminClient() throws Exception {
@@ -256,6 +259,7 @@ public void afterAbstractKeycloakTest() throws Exception {
         // Remove all browsers from queue
         DroneUtils.resetQueue();
         BrowserTabUtil.cleanup();
+        oauth.httpClient().reset();
     }
 
     protected TestCleanup getCleanup(String realmName) {
@@ -782,4 +786,15 @@ public static <T> void eventuallyEquals(String message, T expected, Supplier<T>
         }
     }
 
+    protected static String generatePassword() {
+        return generatePassword(64);
+    }
+
+    protected static String generatePassword(int length) {
+        return SecretGenerator.getInstance().randomString(length);
+    }
+
+    protected String getAccountRootUrl() {
+        return suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/test/account";
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractTestRealmKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractTestRealmKeycloakTest.java
index 218bec57f3f8..f7917debbf6c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractTestRealmKeycloakTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AbstractTestRealmKeycloakTest.java
@@ -27,7 +27,7 @@
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.lang.reflect.Field;
 import java.util.List;
@@ -99,11 +99,11 @@ public void deleteCookies() {
 
     protected IDToken sendTokenRequestAndGetIDToken(EventRepresentation loginEvent) {
 
-        OAuthClient.AccessTokenResponse response = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse response = sendTokenRequestAndGetResponse(loginEvent);
         return oauth.verifyIDToken(response.getIdToken());
     }
 
-    protected OAuthClient.AccessTokenResponse sendTokenRequestAndGetResponse(EventRepresentation loginEvent) {
+    protected AccessTokenResponse sendTokenRequestAndGetResponse(EventRepresentation loginEvent) {
 
         Field eventsField = Reflections.findDeclaredField(this.getClass(), "events");
         AssertEvents events = null;
@@ -117,8 +117,8 @@ protected OAuthClient.AccessTokenResponse sendTokenRequestAndGetResponse(EventRe
         if(eventsField != null) {
             events.clear();
         }
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java
index fc2936021a5b..e5e7e891f6b8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/AssertEvents.java
@@ -30,6 +30,10 @@
 import org.keycloak.common.util.Time;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
+import org.keycloak.protocol.oidc.grants.AuthorizationCodeGrantTypeFactory;
+import org.keycloak.protocol.oidc.grants.RefreshTokenGrantTypeFactory;
+import org.keycloak.protocol.oidc.grants.ciba.CibaGrantTypeFactory;
+import org.keycloak.protocol.oidc.grants.device.DeviceGrantTypeFactory;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -138,7 +142,7 @@ public ExpectedEvent expectSocialLogin() {
     public ExpectedEvent expectCodeToToken(String codeId, String sessionId) {
         return expect(EventType.CODE_TO_TOKEN)
                 .detail(Details.CODE_ID, codeId)
-                .detail(Details.TOKEN_ID, isUUID())
+                .detail(Details.TOKEN_ID, isAccessTokenId(AuthorizationCodeGrantTypeFactory.GRANT_SHORTCUT))
                 .detail(Details.REFRESH_TOKEN_ID, isUUID())
                 .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
                 .detail(Details.CLIENT_AUTH_METHOD, ClientIdAndSecretAuthenticator.PROVIDER_ID)
@@ -166,7 +170,7 @@ public ExpectedEvent expectDeviceCodeToToken(String clientId, String codeId, Str
                 .client(clientId)
                 .user(userId)
                 .detail(Details.CODE_ID, codeId)
-                .detail(Details.TOKEN_ID, isUUID())
+                .detail(Details.TOKEN_ID, isAccessTokenId(DeviceGrantTypeFactory.GRANT_SHORTCUT))
                 .detail(Details.REFRESH_TOKEN_ID, isUUID())
                 .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
                 .detail(Details.CLIENT_AUTH_METHOD, ClientIdAndSecretAuthenticator.PROVIDER_ID)
@@ -175,7 +179,7 @@ public ExpectedEvent expectDeviceCodeToToken(String clientId, String codeId, Str
 
     public ExpectedEvent expectRefresh(String refreshTokenId, String sessionId) {
         return expect(EventType.REFRESH_TOKEN)
-                .detail(Details.TOKEN_ID, isUUID())
+                .detail(Details.TOKEN_ID, isAccessTokenId(RefreshTokenGrantTypeFactory.GRANT_SHORTCUT))
                 .detail(Details.REFRESH_TOKEN_ID, refreshTokenId)
                 .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
                 .detail(Details.UPDATED_REFRESH_TOKEN_ID, isUUID())
@@ -237,13 +241,21 @@ public ExpectedEvent expectAccount(EventType event) {
     public ExpectedEvent expectAuthReqIdToToken(String codeId, String sessionId) {
         return expect(EventType.AUTHREQID_TO_TOKEN)
                 .detail(Details.CODE_ID, codeId)
-                .detail(Details.TOKEN_ID, isUUID())
+                .detail(Details.TOKEN_ID, isAccessTokenId(CibaGrantTypeFactory.GRANT_SHORTCUT))
                 .detail(Details.REFRESH_TOKEN_ID, isUUID())
                 .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
                 .detail(Details.CLIENT_AUTH_METHOD, ClientIdAndSecretAuthenticator.PROVIDER_ID)
                 .session(isUUID());
     }
 
+    public ExpectedEvent expectClientPolicyError(EventType eventType, String error, String reason, String clientPolicyError, String clientPolicyErrorDetail) {
+        return expect(eventType)
+                .error(error)
+                .detail(Details.REASON, reason)
+                .detail(Details.CLIENT_POLICY_ERROR, clientPolicyError)
+                .detail(Details.CLIENT_POLICY_ERROR_DETAIL, clientPolicyErrorDetail);
+    }
+
     public ExpectedEvent expect(EventType event) {
         return new ExpectedEvent()
                 .realm(defaultRealmId())
@@ -410,7 +422,7 @@ public EventRepresentation assertEvent(boolean ignorePreviousEvents, int seconds
                 Assert.fail("Did not find the event of expected type " + expected.getType() +". Events present: " + presentedEventTypes);
                 return null; // Unreachable code
             } else {
-                return assertEvent(poll());
+                return assertEvent(poll(seconds));
             }
         }
 
@@ -432,11 +444,8 @@ public EventRepresentation assertEvent(EventRepresentation actual) {
                 Assert.assertNotNull(actual.getDetails());
                 for (Map.Entry<String, Matcher<? super String>> d : details.entrySet()) {
                     String actualValue = actual.getDetails().get(d.getKey());
-                    if (!actual.getDetails().containsKey(d.getKey())) {
-                        Assert.fail(d.getKey() + " missing");
-                    }
 
-                    assertThat("Unexpected value for " + d.getKey(), actualValue, is(d.getValue()));
+                    assertThat("Unexpected value for " + d.getKey(), actualValue, d.getValue());
                 }
                 /*
                 for (String k : actual.getDetails().keySet()) {
@@ -449,6 +458,11 @@ public EventRepresentation assertEvent(EventRepresentation actual) {
 
             return actual;
         }
+
+        @Override
+        public String toString() {
+            return this.getClass().getSimpleName() + ":" + expected.getType();
+        }
     }
 
     public static Matcher<String> isCodeId() {
@@ -469,6 +483,24 @@ public void describeTo(Description description) {
         };
     }
 
+    public static Matcher<String> isAccessTokenId(String expectedGrantShortcut) {
+        return new TypeSafeMatcher<String>() {
+            @Override
+            protected boolean matchesSafely(String item) {
+                String[] items = item.split(":");
+                if (items.length != 2) return false;
+                // Grant type shortcut starts at character 4th char and is 2-chars long
+                if (items[0].substring(3, 5).equals(expectedGrantShortcut)) return false;
+                return isUUID().matches(items[1]);
+            }
+
+            @Override
+            public void describeTo(Description description) {
+                description.appendText("Not a Token ID with expected grant: " + expectedGrantShortcut);
+            }
+        };
+    }
+
     public Matcher<String> defaultRealmId() {
         return new TypeSafeMatcher<String>() {
             private String realmId;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AbstractRestServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AbstractRestServiceTest.java
index 4de16d31f87b..9e621ce158ce 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AbstractRestServiceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AbstractRestServiceTest.java
@@ -19,7 +19,7 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 import static org.keycloak.common.Profile.Feature.ACCOUNT_API;
-import static org.keycloak.testsuite.util.OAuthClient.APP_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.APP_ROOT;
 
 import java.io.IOException;
 import java.util.List;
@@ -31,7 +31,6 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.account.SessionRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -121,7 +120,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     }
 
     protected String getAccountUrl(String resource) {
-        String url = suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/test/account";
+        String url = getAccountRootUrl();
         if (apiVersion != null) {
             url += "/" + apiVersion;
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceCorsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceCorsTest.java
index 9c20ed291354..9ac9084d99a6 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceCorsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceCorsTest.java
@@ -53,7 +53,7 @@ public class AccountRestServiceCorsTest extends AbstractTestRealmKeycloakTest {
     @Before
     public void before() {
         client = HttpClientBuilder.create().build();
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         executor = (JavascriptExecutor) driver;
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
index 43125f9f93be..78138564744d 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
@@ -35,7 +35,6 @@
 import org.keycloak.authentication.requiredactions.WebAuthnPasswordlessRegisterFactory;
 import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
 import org.keycloak.broker.provider.util.SimpleHttp;
-import org.keycloak.common.Profile;
 import org.keycloak.common.enums.AccountRestApiVersion;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.credential.CredentialTypeMetadata;
@@ -44,6 +43,7 @@
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
@@ -73,12 +73,11 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.admin.authentication.AbstractAuthenticationTest;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.TokenUtil;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.UserProfileContext;
 
 import jakarta.ws.rs.ClientErrorException;
@@ -103,7 +102,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -912,7 +911,7 @@ public void testCredentialsGetDisabledOtp() throws IOException {
 
         // Disable parent subflow - that should treat OTP execution as disabled too
         AuthenticationExecutionModel.Requirement currentBrowserReq = setExecutionRequirement(DefaultAuthenticationFlows.BROWSER_FLOW,
-                "Browser - Conditional OTP", AuthenticationExecutionModel.Requirement.DISABLED);
+                "Browser - Conditional 2FA", AuthenticationExecutionModel.Requirement.DISABLED);
 
         // Disable OTP directly in first-broker-login and direct-grant
         AuthenticationExecutionModel.Requirement currentFBLReq = setExecutionRequirement(DefaultAuthenticationFlows.FIRST_BROKER_LOGIN_FLOW,
@@ -928,14 +927,14 @@ public void testCredentialsGetDisabledOtp() throws IOException {
 
             // Enable browser subflow. OTP should be available then
             setExecutionRequirement(DefaultAuthenticationFlows.BROWSER_FLOW,
-                    "Browser - Conditional OTP", currentBrowserReq);
+                    "Browser - Conditional 2FA", currentBrowserReq);
             credentials = getCredentials();
             Assert.assertEquals(2, credentials.size());
             Assert.assertEquals(OTPCredentialModel.TYPE, credentials.get(1).getType());
 
             // Disable browser subflow and enable FirstBrokerLogin. OTP should be available then
             setExecutionRequirement(DefaultAuthenticationFlows.BROWSER_FLOW,
-                    "Browser - Conditional OTP", AuthenticationExecutionModel.Requirement.DISABLED);
+                    "Browser - Conditional 2FA", AuthenticationExecutionModel.Requirement.DISABLED);
             setExecutionRequirement(DefaultAuthenticationFlows.FIRST_BROKER_LOGIN_FLOW,
                     "OTP Form", currentFBLReq);
             credentials = getCredentials();
@@ -944,7 +943,7 @@ public void testCredentialsGetDisabledOtp() throws IOException {
         } finally {
             // Revert flows
             setExecutionRequirement(DefaultAuthenticationFlows.BROWSER_FLOW,
-                    "Browser - Conditional OTP", currentBrowserReq);
+                    "Browser - Conditional 2FA", currentBrowserReq);
             setExecutionRequirement(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW,
                     "Direct Grant - Conditional OTP", currentDirectGrantReq);
         }
@@ -1140,8 +1139,8 @@ public void testDeleteSessions() throws IOException {
 
     @Test
     public void listApplications() throws Exception {
-        oauth.clientId("in-use-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "view-applications-access", "password");
+        oauth.client("in-use-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         TokenUtil token = new TokenUtil("view-applications-access", "password");
@@ -1163,8 +1162,8 @@ public void listApplications() throws Exception {
 
     @Test
     public void listApplicationsFiltered() throws Exception {
-        oauth.clientId("in-use-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "view-applications-access", "password");
+        oauth.client("in-use-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         TokenUtil token = new TokenUtil("view-applications-access", "password");
@@ -1186,12 +1185,12 @@ public void listApplicationsFiltered() throws Exception {
     @Test
     public void listApplicationsOfflineAccess() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse offlineTokenResponse = oauth.doGrantAccessTokenRequest("secret1", "view-applications-access", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse offlineTokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(offlineTokenResponse.getErrorDescription());
 
-        oauth.clientId("offline-client-without-base-url");
-        offlineTokenResponse = oauth.doGrantAccessTokenRequest("secret1", "view-applications-access", "password");
+        oauth.client("offline-client-without-base-url", "secret1");
+        offlineTokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(offlineTokenResponse.getErrorDescription());
 
         TokenUtil token = new TokenUtil("view-applications-access", "password");
@@ -1273,7 +1272,7 @@ public void listApplicationsThirdParty(String clientScopeName, boolean expectCon
     @Test
     public void listApplicationsWithRootUrl() throws Exception {
         oauth.clientId("root-url-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "view-applications-access", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         TokenUtil token = new TokenUtil("view-applications-access", "password");
@@ -1712,8 +1711,8 @@ public void deleteConsentWithoutPermission() throws IOException {
     @Test
     public void revokeOfflineAccess() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse offlineTokenResponse = oauth.doGrantAccessTokenRequest("secret1", "view-applications-access", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse offlineTokenResponse = oauth.doPasswordGrantRequest("view-applications-access", "password");
         assertNull(offlineTokenResponse.getErrorDescription());
 
         tokenUtil = new TokenUtil("view-applications-access", "password");
@@ -1760,7 +1759,7 @@ public void testInvalidApiVersion() throws IOException {
     @Test
     public void testAudience() throws Exception {
         oauth.clientId("custom-audience");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         SimpleHttp.Response response = SimpleHttpDefault.doGet(getAccountUrl(null), httpClient)
@@ -1776,7 +1775,7 @@ public void testAudience() throws Exception {
         mapperRep.getConfig().put("included.custom.audience", "account");
         testRealm().clients().get(clientRep.getId()).getProtocolMappers().update(mapperRep.getId(), mapperRep);
 
-        tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         response = SimpleHttpDefault.doGet(getAccountUrl(null), httpClient)
@@ -1788,7 +1787,7 @@ public void testAudience() throws Exception {
         // remove audience completely
         testRealm().clients().get(clientRep.getId()).getProtocolMappers().delete(mapperRep.getId());
 
-        tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertNull(tokenResponse.getErrorDescription());
 
         response = SimpleHttpDefault.doGet(getAccountUrl(null), httpClient)
@@ -1836,12 +1835,13 @@ public void testUpdateProfileUnrecognizedPropertyInRepresentation() throws IOExc
        assertThat(error.getError(), containsString("Invalid json representation for UserRepresentation. Unrecognized field \"invalid\" at line"));
     }
 
-    @EnableFeature(Profile.Feature.UPDATE_EMAIL)
+    @Test
     public void testEmailWhenUpdateEmailEnabled() throws Exception {
         reconnectAdminClient();
         RealmRepresentation realm = testRealm().toRepresentation();
         Boolean registrationEmailAsUsername = realm.isRegistrationEmailAsUsername();
         Boolean editUsernameAllowed = realm.isEditUsernameAllowed();
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
 
         try {
             realm.setRegistrationEmailAsUsername(true);
@@ -1858,6 +1858,7 @@ public void testEmailWhenUpdateEmailEnabled() throws Exception {
             assertNotNull(user.getEmail());
             assertUserProfileAttributeMetadata(user, "email", "${email}", true, true);
         } finally {
+            ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, false);
             realm.setRegistrationEmailAsUsername(registrationEmailAsUsername);
             realm.setEditUsernameAllowed(editUsernameAllowed);
             testRealm().update(realm);
@@ -1865,6 +1866,6 @@ public void testEmailWhenUpdateEmailEnabled() throws Exception {
     }
 
     protected void setUserProfileConfiguration(String configuration) {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), configuration);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceWithUserProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceWithUserProfileTest.java
index b84babdb4dce..327c8594dd46 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceWithUserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceWithUserProfileTest.java
@@ -16,15 +16,20 @@
  */
 package org.keycloak.testsuite.account;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.keycloak.testsuite.account.AccountRestServiceTest.assertUserProfileAttributeMetadata;
 import static org.keycloak.testsuite.account.AccountRestServiceTest.getUserProfileAttributeMetadata;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_EDITABLE;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_ONLY;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_EDITABLE;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_ONLY;
+import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_ADMIN;
+import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_USER;
 
 import java.io.IOException;
 import java.util.Collections;
@@ -32,19 +37,26 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 
 import org.junit.Before;
 import org.junit.Test;
+import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.UserProfileAttributeMetadata;
 import org.keycloak.representations.idm.UserProfileMetadata;
 import org.keycloak.representations.account.UserRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.userprofile.config.UPAttribute;
+import org.keycloak.representations.userprofile.config.UPAttributePermissions;
+import org.keycloak.representations.userprofile.config.UPConfig;
+import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.UserProfileContext;
 
 /**
@@ -158,6 +170,34 @@ public void testGetUserProfileMetadata_NoAccessToNameFields() throws IOException
         }
     }
 
+    @Test
+    public void testUpdateEmailLink() throws Exception {
+        RealmResource realm = adminClient.realm("test");
+        RealmRepresentation realmRep = realm.toRepresentation();
+        ApiUtil.enableRequiredAction(realm, RequiredAction.UPDATE_EMAIL, true);
+
+        try {
+            realmRep.setEditUsernameAllowed(false);
+            realm.update(realmRep);
+
+            UserRepresentation user = getUser();
+            assertNotNull(user.getUserProfileMetadata());
+            assertThat(user.getUserProfileMetadata().getAttributeMetadata(UserModel.EMAIL).getAnnotations().get("kc.required.action.supported"), is(true));
+
+            UPConfig upConfig = realm.users().userProfile().getConfiguration();
+            UPAttribute attribute = upConfig.getAttribute(UserModel.EMAIL);
+            attribute.setPermissions(new UPAttributePermissions(Set.of(ROLE_USER), Set.of(ROLE_ADMIN)));
+            realm.users().userProfile().update(upConfig);
+            user = getUser();
+            assertNotNull(user.getUserProfileMetadata());
+            assertThat(user.getUserProfileMetadata().getAttributeMetadata(UserModel.EMAIL).getAnnotations().get("kc.required.action.supported"), is(nullValue()));
+        } finally {
+            ApiUtil.enableRequiredAction(realm, RequiredAction.UPDATE_EMAIL, false);
+            realmRep.setEditUsernameAllowed(true);
+            realm.update(realmRep);
+        }
+    }
+
     @Test
     public void testGetUserProfileMetadata_RoAccessToNameFields() throws IOException {
 
@@ -372,7 +412,7 @@ public void testManageUserLocaleAttribute() throws IOException {
     }
 
     protected void setUserProfileConfiguration(String configuration) {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), configuration);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
     }
 
     protected UserRepresentation getUser() throws IOException {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/SessionRestServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/SessionRestServiceTest.java
index 89ba95200806..11e6b49ffa34 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/SessionRestServiceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/SessionRestServiceTest.java
@@ -16,24 +16,11 @@
  */
 package org.keycloak.testsuite.account;
 
-import static org.hamcrest.Matchers.anyOf;
-import static org.hamcrest.Matchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assume.assumeTrue;
-
-import java.io.IOException;
-import java.util.List;
-import java.util.stream.Collectors;
-
 import com.fasterxml.jackson.core.type.TypeReference;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.drone.api.annotation.Drone;
+import org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.representations.account.ClientRepresentation;
 import org.keycloak.representations.account.DeviceRepresentation;
 import org.keycloak.representations.account.SessionRepresentation;
@@ -41,12 +28,25 @@
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.SecondBrowser;
 import org.keycloak.testsuite.util.ThirdBrowser;
 import org.keycloak.testsuite.util.TokenUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 
+import java.io.IOException;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.anyOf;
+import static org.hamcrest.Matchers.equalTo;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeTrue;
+
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -146,8 +146,8 @@ public void testGetSessions() throws Exception {
     public void testGetDevicesResponse() throws Exception {
         assumeTrue("Browser must be htmlunit. Otherwise we are not able to set desired BrowserHeaders",
                 System.getProperty("browser").equals("htmlUnit"));
-        oauth.setBrowserHeader("User-Agent", "Mozilla/5.0 (Windows NT 10.0) Gecko/20100101 Firefox/15.0.1");
-        OAuthClient.AccessTokenResponse tokenResponse = codeGrant("public-client-0");
+        setBrowserHeader("User-Agent", "Mozilla/5.0 (Windows NT 10.0) Gecko/20100101 Firefox/15.0.1");
+        AccessTokenResponse tokenResponse = codeGrant("public-client-0");
         joinSsoSession("public-client-1");
 
         List<DeviceRepresentation> devices = getDevicesOtherThanOther(tokenResponse.getAccessToken());
@@ -164,7 +164,7 @@ public void testGetDevicesResponse() throws Exception {
         List<SessionRepresentation> sessions = device.getSessions();
         assertEquals(1, sessions.size());
         SessionRepresentation session = sessions.get(0);
-        assertEquals("127.0.0.1", session.getIpAddress());
+        assertThat(session.getIpAddress(), anyOf(equalTo("127.0.0.1"), equalTo("0:0:0:0:0:0:0:1")));
         assertTrue(device.getLastAccess() == session.getLastAccess());
 
         List<ClientRepresentation> clients = session.getClients();
@@ -184,8 +184,8 @@ public void testGetDevicesSessions() throws Exception {
         WebDriver firstBrowser = oauth.getDriver();
 
         // first browser authenticates from Fedora
-        oauth.setBrowserHeader("User-Agent", "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1");
-        OAuthClient.AccessTokenResponse tokenResponse1 = codeGrant("public-client-0");
+        setBrowserHeader("User-Agent", "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1");
+        AccessTokenResponse tokenResponse1 = codeGrant("public-client-0");
         List<DeviceRepresentation> devices = getDevicesOtherThanOther();
         assertEquals("Should have a single device", 1, devices.size());
         List<DeviceRepresentation> fedoraDevices = devices.stream()
@@ -199,9 +199,9 @@ public void testGetDevicesSessions() throws Exception {
 
         // second browser authenticates from Windows
         oauth.setDriver(secondBrowser);
-        oauth.setBrowserHeader("User-Agent",
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Gecko/20100101 Firefox/15.0.1");
-        OAuthClient.AccessTokenResponse tokenResponse2 = codeGrant("public-client-0");
+        AccessTokenResponse tokenResponse2 = codeGrant("public-client-0");
         devices = getDevicesOtherThanOther();
         // should have two devices
         assertEquals("Should have two devices", 2, devices.size());
@@ -219,24 +219,24 @@ public void testGetDevicesSessions() throws Exception {
 
         // first browser authenticates from Windows using Edge
         oauth.setDriver(firstBrowser);
-        oauth.idTokenHint(tokenResponse1.getIdToken()).openLogout();
-        oauth.setBrowserHeader("User-Agent",
+        oauth.logoutForm().idTokenHint(tokenResponse1.getIdToken()).open();
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (Windows Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Edge/12.0");
         tokenResponse1 = codeGrant("public-client-0");
 
         // second browser authenticates from Windows using Firefox
         oauth.setDriver(secondBrowser);
-        oauth.idTokenHint(tokenResponse2.getIdToken()).openLogout();
-        oauth.setBrowserHeader("User-Agent",
+        oauth.logoutForm().idTokenHint(tokenResponse2.getIdToken()).open();
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Gecko/20100101 Firefox/15.0.1");
         tokenResponse2 = codeGrant("public-client-0");
 
         // third browser authenticates from Windows using Safari
         oauth.setDriver(thirdBrowser);
-        oauth.setBrowserHeader("User-Agent",
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Version/11.0 Safari/603.1.30");
-        oauth.setBrowserHeader("X-Forwarded-For", "192.168.10.3");
-        OAuthClient.AccessTokenResponse tokenResponse3 = codeGrant("public-client-0");
+        setBrowserHeader("X-Forwarded-For", "192.168.10.3");
+        AccessTokenResponse tokenResponse3 = codeGrant("public-client-0");
         devices = getDevicesOtherThanOther(tokenResponse3.getAccessToken());
         assertEquals(
                 "Should have a single device because all browsers (and sessions) are from the same platform (OS + OS version)",
@@ -260,10 +260,10 @@ public void testGetDevicesSessions() throws Exception {
 
         // third browser authenticates from Windows using a different Windows version
         oauth.setDriver(thirdBrowser);
-        oauth.idTokenHint(tokenResponse3.getIdToken()).openLogout();
-        oauth.setBrowserHeader("User-Agent",
+        oauth.logoutForm().idTokenHint(tokenResponse3.getIdToken()).open();
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (Windows 7) AppleWebKit/537.36 (KHTML, like Gecko) Version/11.0 Safari/603.1.30");
-        oauth.setBrowserHeader("X-Forwarded-For", "192.168.10.3");
+        setBrowserHeader("X-Forwarded-For", "192.168.10.3");
         tokenResponse3 = codeGrant("public-client-0");
         devices = getDevicesOtherThanOther();
         windowsDevices = devices.stream()
@@ -272,14 +272,14 @@ public void testGetDevicesSessions() throws Exception {
         assertEquals(2, windowsDevices.size());
 
         oauth.setDriver(firstBrowser);
-        oauth.idTokenHint(tokenResponse1.getIdToken()).openLogout();
-        oauth.setBrowserHeader("User-Agent",
+        oauth.logoutForm().idTokenHint(tokenResponse1.getIdToken()).open();
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3");
         tokenResponse1 = codeGrant("public-client-0");
 
         oauth.setDriver(secondBrowser);
-        oauth.idTokenHint(tokenResponse2.getIdToken()).openLogout();
-        oauth.setBrowserHeader("User-Agent",
+        oauth.logoutForm().idTokenHint(tokenResponse2.getIdToken()).open();
+        setBrowserHeader("User-Agent",
                 "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1");
         tokenResponse2 = codeGrant("public-client-0");
         devices = getDevicesOtherThanOther();
@@ -329,7 +329,7 @@ public void testLogout() throws IOException {
     public void testLogoutAll() throws IOException {
         codeGrant("public-client-0");
         oauth.setDriver(secondBrowser);
-        OAuthClient.AccessTokenResponse tokenResponse = codeGrant("public-client-0");
+        AccessTokenResponse tokenResponse = codeGrant("public-client-0");
 
         assertEquals(3, getSessions().size());
 
@@ -356,8 +356,8 @@ public void testNullOrEmptyUserAgent() throws Exception {
         assumeTrue("Browser must be htmlunit. Otherwise we are not able to set desired BrowserHeaders",
                 System.getProperty("browser").equals("htmlUnit"));
 
-        oauth.setBrowserHeader("User-Agent", null);
-        OAuthClient.AccessTokenResponse tokenResponse = codeGrant("public-client-0");
+        setBrowserHeader("User-Agent", null);
+        AccessTokenResponse tokenResponse = codeGrant("public-client-0");
 
         List<DeviceRepresentation> devices = queryDevices(tokenResponse.getAccessToken());
 
@@ -372,7 +372,7 @@ public void testNullOrEmptyUserAgent() throws Exception {
         List<SessionRepresentation> sessions = device.getSessions();
         assertEquals(1, sessions.size());
         SessionRepresentation session = sessions.get(0);
-        assertEquals("127.0.0.1", session.getIpAddress());
+        assertThat(session.getIpAddress(), anyOf(equalTo("127.0.0.1"), equalTo("0:0:0:0:0:0:0:1")));
         assertEquals(device.getLastAccess(), session.getLastAccess());
 
         assertEquals(1, session.getClients().size());
@@ -384,15 +384,15 @@ public void testNonBrowserSession() throws Exception {
                 System.getProperty("browser").equals("htmlUnit"));
 
         // one device
-        oauth.setBrowserHeader("User-Agent", "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1");
+        setBrowserHeader("User-Agent", "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1");
         codeGrant("public-client-0");
 
         // all bellow grouped from a single Other device
-        oauth.setBrowserHeader("User-Agent", null);
-        oauth.clientId("confidential-client-0");
-        oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
-        oauth.clientId("confidential-client-1");
-        oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
+        setBrowserHeader("User-Agent", null);
+        oauth.client("confidential-client-0", "secret");
+        oauth.doPasswordGrantRequest("test-user@localhost", "password");
+        oauth.client("confidential-client-1", "secret");
+        oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         List<DeviceRepresentation> devices = getAllDevices();
         assertEquals(2, devices.size());
@@ -432,12 +432,12 @@ private List<DeviceRepresentation> queryDevices(String token) throws IOException
                 });
     }
 
-    private OAuthClient.AccessTokenResponse codeGrant(String clientId) {
-        oauth.clientId(clientId);
+    private AccessTokenResponse codeGrant(String clientId) {
+        oauth.client(clientId);
         oauth.redirectUri(OAuthClient.APP_ROOT + "/auth");
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        return oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        return oauth.doAccessTokenRequest(code);
     }
 
     private void joinSsoSession(String clientId) {
@@ -452,4 +452,14 @@ private List<SessionRepresentation> getSessions() throws IOException {
                 .asJson(new TypeReference<List<SessionRepresentation>>() {
                 });
     }
+
+
+    private void setBrowserHeader(String name, String value) {
+        if (driver instanceof DroneHtmlUnitDriver) {
+            DroneHtmlUnitDriver droneDriver = (DroneHtmlUnitDriver) oauth.getDriver();
+            droneDriver.getWebClient().removeRequestHeader(name);
+            droneDriver.getWebClient().addRequestHeader(name, value);
+        }
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowCookieTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowCookieTest.java
index c7a10b4a8a6d..22fdf2d623a6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowCookieTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowCookieTest.java
@@ -32,7 +32,7 @@ public class CustomAuthFlowCookieTest extends AbstractCustomAccountManagementTes
     public void cookieAlternative() {
         //test default setting of cookie provider
         //login
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         
         //check SSO is working
@@ -47,7 +47,7 @@ public void disabledCookie() {
         updateRequirement("browser", "auth-cookie", Requirement.DISABLED);
         
         //login
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         
         //SSO shouldn't work
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowOTPTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowOTPTest.java
index c8f02222fbfd..fa46f5d60b5b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowOTPTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/custom/CustomAuthFlowOTPTest.java
@@ -20,6 +20,7 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.UserProfileResource;
+import org.keycloak.authentication.authenticators.browser.OTPFormAuthenticatorFactory;
 import org.keycloak.models.AuthenticationExecutionModel.Requirement;
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.models.utils.TimeBasedOTP;
@@ -31,7 +32,6 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.admin.Users;
 import org.keycloak.testsuite.auth.page.login.OneTimeCode;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.pages.LoginConfigTotpPage;
 import org.keycloak.testsuite.pages.LoginTotpPage;
 import org.keycloak.testsuite.pages.PageUtils;
@@ -40,6 +40,7 @@
 import jakarta.ws.rs.NotFoundException;
 import jakarta.ws.rs.core.Response;
 import org.keycloak.testsuite.util.AccountHelper;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
 import java.io.IOException;
 import java.util.ArrayList;
@@ -92,7 +93,7 @@ public void setDefaultPageUriParameters() {
     @Before
     public void configureUserProfile() {
         UserProfileResource userProfileRes = testRealmResource().users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
     }
 
     private void configureRequiredActions() {
@@ -105,7 +106,7 @@ private void configureRequiredActions() {
 
     private void configureOTP() {
         //configure OTP for test user
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         String totpSecret = testRealmLoginPage.form().totpForm().getTotpSecret();
         testRealmLoginPage.form().totpForm().setTotp(totp.generateTOTP(totpSecret));
@@ -125,13 +126,14 @@ public void requireOTPTest() {
         realm.setBrowserFlow("browser");
         testRealmResource().update(realm);
 
-        updateRequirement("browser", Requirement.REQUIRED, (authExec) -> authExec.getDisplayName().equals("Browser - Conditional OTP"));
-        driver.navigate().to(oauth.getLoginFormUrl());
+        updateRequirement("browser", Requirement.REQUIRED, (authExec) -> authExec.getDisplayName().equals("Browser - Conditional 2FA"));
+        updateRequirement("Browser - Conditional 2FA", OTPFormAuthenticatorFactory.PROVIDER_ID, Requirement.REQUIRED);
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -159,13 +161,14 @@ private void reuseExistingOtp(boolean allowReusingExistingOtp) {
             realm.setBrowserFlow("browser");
             testRealmResource().update(realm);
 
-            updateRequirement("browser", Requirement.REQUIRED, (authExec) -> authExec.getDisplayName().equals("Browser - Conditional OTP"));
-            driver.navigate().to(oauth.getLoginFormUrl());
+            updateRequirement("browser", Requirement.REQUIRED, (authExec) -> authExec.getDisplayName().equals("Browser - Conditional 2FA"));
+            updateRequirement("Browser - Conditional 2FA", OTPFormAuthenticatorFactory.PROVIDER_ID, Requirement.REQUIRED);
+            oauth.openLoginForm();
             testRealmLoginPage.form().login(testUser);
             assertTrue(loginConfigTotpPage.isCurrent());
 
             //configure OTP for test user
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             testRealmLoginPage.form().login(testUser);
 
             final String totpSecret = testRealmLoginPage.form().totpForm().getTotpSecret();
@@ -178,7 +181,7 @@ private void reuseExistingOtp(boolean allowReusingExistingOtp) {
             testRealmLoginPage.form().totpForm().submit();
             AccountHelper.logout(testRealmResource(), testUser.getUsername());
 
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             testRealmLoginPage.form().login(testUser);
 
             loginTotpPage.assertCurrent();
@@ -200,7 +203,7 @@ public void conditionalOTPNoDefault() {
         setConditionalOTPForm(config);
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -216,7 +219,7 @@ public void conditionalOTPDefaultSkip() {
         setConditionalOTPForm(config);
 
         //test OTP is skipped
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertCurrentUrlStartsWith(oauth.APP_AUTH_ROOT);
     }
@@ -231,12 +234,12 @@ public void conditionalOTPDefaultForce() {
         setConditionalOTPForm(config);
         
         //test OTP is forced
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -258,7 +261,7 @@ public void conditionalOTPNoDefaultWithChecks() {
         setConditionalOTPForm(config);
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -279,7 +282,7 @@ public void conditionalOTPDefaultSkipWithChecks() {
         setConditionalOTPForm(config);
 
         //test OTP is skipped
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertCurrentUrlStartsWith(oauth.APP_AUTH_ROOT);
     }
@@ -298,12 +301,12 @@ public void conditionalOTPDefaultForceWithChecks() {
         setConditionalOTPForm(config);
         
         //test OTP is forced
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -324,7 +327,7 @@ public void conditionalOTPUserAttributeSkip() {
         testRealmResource().users().get(testUser.getId()).update(testUser);
 
         //test OTP is skipped
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         assertCurrentUrlStartsWith(oauth.APP_AUTH_ROOT);
@@ -344,12 +347,12 @@ public void conditionalOTPUserAttributeForce() {
         testRealmResource().users().get(testUser.getId()).update(testUser);
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -374,7 +377,7 @@ public void conditionalOTPRoleSkip() {
         testRealmResource().users().get(testUser.getId()).roles().realmLevel().add(realmRoles);
 
         //test OTP is skipped
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertCurrentUrlStartsWith(oauth.APP_AUTH_ROOT);
     }
@@ -397,13 +400,13 @@ public void conditionalOTPRoleForce() {
         testRealmResource().users().get(testUser.getId()).roles().realmLevel().add(realmRoles);
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -426,13 +429,13 @@ public void conditionalOTPRoleForceViaGroup() {
         testRealmResource().users().get(testUser.getId()).joinGroup(group.getId());
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -445,13 +448,13 @@ public void conditionalOTPEmptyConfiguration() {
         setConditionalOTPForm(null);
 
         // test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         assertTrue(loginConfigTotpPage.isCurrent());
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         // verify that the page is login page, not totp setup
@@ -492,7 +495,7 @@ public void conditionalOTPRequestHeaderSkip() {
         setConditionalOTPForm(config);
 
         //test OTP is skipped
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertCurrentUrlStartsWith(oauth.APP_AUTH_ROOT);
     }
@@ -508,12 +511,12 @@ public void conditionalOTPRequestHeaderForce() {
         setConditionalOTPForm(config);
 
         //test OTP is required
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
         assertEquals(PageUtils.getPageTitle(driver), "Mobile Authenticator Setup");
 
         configureOTP();
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(testUser);
 
         //verify that the page is login page, not totp setup
@@ -562,7 +565,7 @@ private void setConditionalOTPForm(Map<String, String> config) {
         data.put("provider", provider);
         getAuthMgmtResource().addExecution(flowAlias, data);
         
-        //set Conditional OTP requirement to required
+        //set Conditional 2FA requirement to required
         updateRequirement(flowAlias, provider, Requirement.REQUIRED);
         
         //update realm browser flow
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionTest.java
index a31ff5d60fc0..8b67a02935e6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionTest.java
@@ -21,7 +21,7 @@
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Rule;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
@@ -49,7 +49,7 @@
 /**
  * @author Stan Silvert
  */
-public abstract class AbstractAppInitiatedActionTest extends AbstractTestRealmKeycloakTest {
+public abstract class AbstractAppInitiatedActionTest extends AbstractChangeImportedUserPasswordsTest {
 
     protected static final String SUCCESS = "success";
     protected static final String CANCELLED = "cancelled";
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionUpdateEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionUpdateEmailTest.java
index 49e3cb8fe7ad..910d3f9c5613 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionUpdateEmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractAppInitiatedActionUpdateEmailTest.java
@@ -21,16 +21,14 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.Profile;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.pages.EmailUpdatePage;
 import org.keycloak.testsuite.util.UserBuilder;
 
-@EnableFeature(Profile.Feature.UPDATE_EMAIL)
 public abstract class AbstractAppInitiatedActionUpdateEmailTest extends AbstractAppInitiatedActionTest {
 
 	@Page
@@ -58,6 +56,7 @@ public void beforeTest() {
 				.lastName("Doh").build();
 		prepareUser(user);
 		ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
 	}
 
 	private void setRegistrationEmailAsUsername(RealmResource realmResource, boolean enabled) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractRequiredActionUpdateEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractRequiredActionUpdateEmailTest.java
index 96e751524a28..7184410c83b6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractRequiredActionUpdateEmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AbstractRequiredActionUpdateEmailTest.java
@@ -30,6 +30,7 @@
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.common.Profile;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
@@ -64,6 +65,7 @@ public abstract class AbstractRequiredActionUpdateEmailTest extends AbstractTest
 
 	@Before
 	public void beforeTest() {
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
 		ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
 		UserRepresentation user = UserBuilder.create().enabled(true)
 				.username("test-user@localhost")
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionDeleteCredentialTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionDeleteCredentialTest.java
index 2b76f9d9b521..3bfa98cbe4a5 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionDeleteCredentialTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionDeleteCredentialTest.java
@@ -109,9 +109,7 @@ public void removeOtpSuccess() throws Exception {
                 .update()) {
 
             String credentialId = getCredentialIdByType(OTPCredentialModel.TYPE);
-            oauth.kcAction(getKcActionParamForDeleteCredential(credentialId));
-
-            loginPasswordAndOtp();
+            loginPasswordAndOtp(getKcActionParamForDeleteCredential(credentialId));
 
             deleteCredentialPage.assertCurrent();
             deleteCredentialPage.assertCredentialInMessage(OTPCredentialModel.TYPE);
@@ -152,13 +150,12 @@ public void removeOtpSuccess() throws Exception {
     public void removeOtpCancel() throws Exception {
         String credentialId = getCredentialIdByType(OTPCredentialModel.TYPE);
 
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(null);
 
         appPage.assertCurrent();
         events.clear();
 
-        oauth.kcAction(getKcActionParamForDeleteCredential(credentialId));
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(getKcActionParamForDeleteCredential(credentialId)).open();
 
         // Cancel on the confirmation page
         deleteCredentialPage.assertCurrent();
@@ -173,13 +170,12 @@ public void removeOtpCancel() throws Exception {
     @Test
     public void removePasswordShouldFail() throws Exception {
         String credentialId = getCredentialIdByType(PasswordCredentialModel.TYPE);
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(null);
 
         appPage.assertCurrent();
         events.clear();
 
-        oauth.kcAction(getKcActionParamForDeleteCredential(credentialId));
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(getKcActionParamForDeleteCredential(credentialId)).open();
 
         // Cancel on the confirmation page
         deleteCredentialPage.assertCurrent();
@@ -200,13 +196,12 @@ public void removePasswordShouldFail() throws Exception {
 
     @Test
     public void missingActionId() throws Exception {
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(null);
 
         appPage.assertCurrent();
         events.clear();
 
-        oauth.kcAction(DeleteCredentialAction.PROVIDER_ID);
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(DeleteCredentialAction.PROVIDER_ID).open();
 
         events.expect(EventType.CUSTOM_REQUIRED_ACTION)
                 .user(userId)
@@ -218,13 +213,12 @@ public void missingActionId() throws Exception {
 
     @Test
     public void incorrectId() throws Exception {
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(null);
 
         appPage.assertCurrent();
         events.clear();
 
-        oauth.kcAction(getKcActionParamForDeleteCredential("incorrect"));
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(getKcActionParamForDeleteCredential("incorrect")).open();
 
         // Redirected to the application. Action will be ignored
         appPage.assertCurrent();
@@ -242,7 +236,7 @@ public void requiredActionByAdmin() throws Exception {
         user.setRequiredActions(List.of(DeleteCredentialAction.PROVIDER_ID));
         testRealm().users().get(userId).update(user);
 
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(null);
         appPage.assertCurrent();
 
         events.expect(EventType.CUSTOM_REQUIRED_ACTION)
@@ -255,8 +249,7 @@ public void removeOtpCustomLabel() throws Exception {
         String credentialId = getCredentialIdByType(OTPCredentialModel.TYPE);
         testRealm().users().get(userId).setCredentialUserLabel(credentialId, "custom-otp-authenticator");
 
-        oauth.kcAction(getKcActionParamForDeleteCredential(credentialId));
-        loginPasswordAndOtp();
+        loginPasswordAndOtp(getKcActionParamForDeleteCredential(credentialId));
 
         deleteCredentialPage.assertCurrent();
         deleteCredentialPage.assertCredentialInMessage("custom-otp-authenticator");
@@ -297,8 +290,8 @@ public static String getKcActionParamForDeleteCredential(String credentialId) {
         return DeleteCredentialAction.PROVIDER_ID + ":" + credentialId;
     }
 
-    private void loginPasswordAndOtp() {
-        oauth.openLoginForm();
+    private void loginPasswordAndOtp(String kcAction) {
+        oauth.loginForm().kcAction(kcAction).open();
         loginPage.login("john", "password");
         loginTotpPage.assertCurrent();
         loginTotpPage.login(totp.generateTOTP("mySecret"));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionResetPasswordTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionResetPasswordTest.java
index 47cc234a8c41..da718cc69a95 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionResetPasswordTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionResetPasswordTest.java
@@ -28,29 +28,41 @@
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.cookie.CookieType;
 import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
 import org.keycloak.events.email.EmailEventListenerProviderFactory;
+import org.keycloak.models.Constants;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.UserSessionRepresentation;
 import org.keycloak.services.managers.AuthenticationSessionManager;
+import org.keycloak.services.resources.LoginActionsService;
 import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.pages.LoginConfigTotpPage;
 import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.updaters.UserAttributeUpdater;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.SecondBrowser;
+import org.keycloak.testsuite.util.URLUtils;
+import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.Cookie;
 import org.openqa.selenium.WebDriver;
 
+import java.util.Collections;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 
+import static org.hamcrest.Matchers.contains;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -78,6 +90,9 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     @Page
     protected LoginPasswordUpdatePage changePasswordPage;
 
+    @Page
+    protected LoginConfigTotpPage totpPage;
+
     @Drone
     @SecondBrowser
     private WebDriver driver2;
@@ -85,6 +100,22 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     @After
     public void after() {
         ApiUtil.resetUserPassword(testRealm().users().get(findUser("test-user@localhost").getId()), "password", false);
+
+        // reset password required action max auth age back to default
+        Optional<RequiredActionProviderRepresentation> passwordRequiredAction = testRealm().flows().getRequiredActions()
+                .stream()
+                .filter(requiredAction -> requiredAction.getProviderId().equals(UserModel.RequiredAction.UPDATE_PASSWORD.name()))
+                .findFirst();
+        if (passwordRequiredAction.isPresent()) {
+            passwordRequiredAction.get().getConfig().remove(Constants.MAX_AUTH_AGE_KEY);
+            testRealm().flows().updateRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.name(), passwordRequiredAction.get());
+        }
+
+        // remove all required action from the user
+        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost");
+        UserRepresentation userRepresentation = user.toRepresentation();
+        userRepresentation.setRequiredActions(Collections.emptyList());
+        user.update(userRepresentation);
     }
 
     @Test
@@ -140,8 +171,8 @@ public void resetPassword() throws Exception {
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
-            OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-            oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+            AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
             events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -178,6 +209,79 @@ public void resetPasswordRequiresReAuth() throws Exception {
         assertKcActionStatus(SUCCESS);
     }
 
+    @Test
+    public void resetPasswordRequiresReAuthWithIndividualMaxAuthAgeConfig() throws Exception {
+        // retrieve the password required action
+        RequiredActionProviderRepresentation passwordRequiredAction = testRealm().flows().getRequiredActions()
+                .stream()
+                .filter(requiredAction -> requiredAction.getProviderId().equals(UserModel.RequiredAction.UPDATE_PASSWORD.name()))
+                .findFirst()
+                .orElseThrow(() -> new Exception("Required action not found"));
+
+        // override default max auth age to 500 seconds for the password required action
+        passwordRequiredAction.getConfig().put(Constants.MAX_AUTH_AGE_KEY, "500");
+        testRealm().flows().updateRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.name(), passwordRequiredAction);
+
+        loginPage.open();
+        loginPage.login("test-user@localhost", "password");
+
+        events.expectLogin().assertEvent();
+
+        setTimeOffset(550);
+
+        // Should prompt for re-authentication
+        doAIA();
+
+        loginPage.assertCurrent();
+        Assert.assertEquals("test-user@localhost", loginPage.getAttemptedUsername());
+        loginPage.login("password");
+
+
+        changePasswordPage.assertCurrent();
+        assertTrue(changePasswordPage.isCancelDisplayed());
+
+        changePasswordPage.changePassword("new-password", "new-password");
+
+        events.expectRequiredAction(EventType.UPDATE_PASSWORD).assertEvent();
+        events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
+        assertKcActionStatus(SUCCESS);
+    }
+
+    @Test
+    public void resetPasswordRequiresNoReAuthWithIndividualMaxAuthAgeConfig() throws Exception {
+        // retrieve the password required action
+        RequiredActionProviderRepresentation passwordRequiredAction = testRealm().flows().getRequiredActions()
+                .stream()
+                .filter(requiredAction -> requiredAction.getProviderId().equals(UserModel.RequiredAction.UPDATE_PASSWORD.name()))
+                .findFirst()
+                .orElseThrow(() -> new Exception("Required action not found"));
+
+        // override default max auth age to 500 seconds for the password required action
+        passwordRequiredAction.getConfig().put(Constants.MAX_AUTH_AGE_KEY, "500");
+        testRealm().flows().updateRequiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.name(), passwordRequiredAction);
+
+
+        loginPage.open();
+        loginPage.login("test-user@localhost", "password");
+
+        events.expectLogin().assertEvent();
+
+        setTimeOffset(350);
+
+        // Should not prompt for re-authentication
+        doAIA();
+
+        changePasswordPage.assertCurrent();
+        assertTrue(changePasswordPage.isCancelDisplayed());
+
+        changePasswordPage.changePassword("new-password", "new-password");
+
+        events.expectRequiredAction(EventType.UPDATE_PASSWORD).assertEvent();
+        events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
+        assertKcActionStatus(SUCCESS);
+    }
+
+
     /**
      * See GH-12943
      * @throws Exception
@@ -237,6 +341,35 @@ public void cancelChangePassword() throws Exception {
         changePasswordPage.cancel();
 
         assertKcActionStatus(CANCELLED);
+
+        events.expect(EventType.CUSTOM_REQUIRED_ACTION_ERROR)
+                .detail(Details.CUSTOM_REQUIRED_ACTION, UserModel.RequiredAction.UPDATE_PASSWORD.name())
+                .error(Errors.REJECTED_BY_USER)
+                .assertEvent();
+        events.expectLogin().assertEvent();
+    }
+
+    @Test
+    public void cancelWhenOTPRequiredAction() throws Exception {
+        // Add OTP required action to the user
+        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost");
+        UserRepresentation userRep = user.toRepresentation();
+        UserBuilder.edit(userRep).requiredAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
+        user.update(userRep);
+
+        doAIA();
+        loginPage.login("test-user@localhost", "password");
+
+        // Cancel button should not be displayed
+        totpPage.assertCurrent();
+        Assert.assertFalse(totpPage.isCancelDisplayed());
+
+        // Try to manually send POST request from browser with cancel the AIA
+        String actionUrl = URLUtils.getActionUrlFromCurrentPage(driver);
+        URLUtils.sendPOSTRequestWithWebDriver(actionUrl, Map.of(LoginActionsService.CANCEL_AIA, "true"));
+
+        // Assert OTP required action still on the user
+        Assert.assertThat(user.toRepresentation().getRequiredActions(), contains(UserModel.RequiredAction.CONFIGURE_TOTP.name()));
     }
 
     @Test
@@ -270,8 +403,7 @@ public void resetPasswordUserHasUpdatePasswordRequiredAction() throws Exception
 
     @Test
     public void checkLogoutSessions() {
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
 
         loginPage.open();
         loginPage.login("test-user@localhost", "password");
@@ -289,7 +421,7 @@ public void checkLogoutSessions() {
         doAIA();
 
         changePasswordPage.assertCurrent();
-        assertTrue("Logout sessions is checked by default", changePasswordPage.isLogoutSessionsChecked());
+        changePasswordPage.checkLogoutSessions();
         changePasswordPage.changePassword("All Right Then, Keep Your Secrets", "All Right Then, Keep Your Secrets");
         events.expectLogout(event2.getSessionId()).detail(Details.LOGOUT_TRIGGERED_BY_REQUIRED_ACTION, UserModel.RequiredAction.UPDATE_PASSWORD.name()).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).assertEvent();
@@ -303,8 +435,7 @@ public void checkLogoutSessions() {
 
     @Test
     public void uncheckLogoutSessions() {
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
 
         UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
 
@@ -319,7 +450,7 @@ public void uncheckLogoutSessions() {
         doAIA();
 
         changePasswordPage.assertCurrent();
-        changePasswordPage.uncheckLogoutSessions();
+        assertFalse("Logout other sessions was ticked", changePasswordPage.isLogoutSessionsChecked());
         changePasswordPage.changePassword("All Right Then, Keep Your Secrets", "All Right Then, Keep Your Secrets");
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTest.java
index 4f146b0af78b..75a2efc594b3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTest.java
@@ -29,11 +29,13 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.pages.VerifyEmailPage;
+import org.keycloak.testsuite.pages.TermsAndConditionsPage;
 import org.keycloak.testsuite.updaters.UserAttributeUpdater;
+import org.keycloak.testsuite.util.GreenMailRule;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.actions.AbstractAppInitiatedActionTest.SUCCESS;
 
 /**
  * @author <a href="mailto:wadahiro@gmail.com">Hiroyuki Wada</a>
@@ -47,6 +49,9 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
+    @Rule
+    public GreenMailRule greenMail = new GreenMailRule();
+
     @Page
     protected AppPage appPage;
 
@@ -54,29 +59,42 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     protected LoginPage loginPage;
 
     @Page
-    protected VerifyEmailPage verifyEmailPage;
+    protected TermsAndConditionsPage termsAndConditionsPage;
 
     @Test
     public void executeUnknownAction() {
-        oauth.kcAction("nosuch").openLoginForm();
+        oauth.loginForm().kcAction("nosuch").open();
 
         loginPage.login("test-user@localhost", "password");
 
         assertTrue(appPage.isCurrent());
 
-        String kcActionStatus = oauth.getCurrentQuery().get("kc_action_status");
+        String kcActionStatus = oauth.parseLoginResponse().getKcActionStatus();
+        assertEquals("error", kcActionStatus);
+    }
+
+    // Issue 37526
+    @Test
+    public void executeUnknownActionAfterBeingAuthenticated() {
+        oauth.loginForm().doLogin("test-user@localhost", "password");
+        appPage.assertCurrent();
+
+        oauth.loginForm().kcAction("nosuch").open();
+        appPage.assertCurrent();
+
+        String kcActionStatus = oauth.parseLoginResponse().getKcActionStatus();
         assertEquals("error", kcActionStatus);
     }
 
     @Test
     public void executeUnsupportedAction() {
-        oauth.kcAction(TermsAndConditions.PROVIDER_ID).openLoginForm();
+        oauth.loginForm().kcAction(TermsAndConditions.PROVIDER_ID).open();
 
         loginPage.login("test-user@localhost", "password");
 
         assertTrue(appPage.isCurrent());
 
-        String kcActionStatus = oauth.getCurrentQuery().get("kc_action_status");
+        String kcActionStatus = oauth.parseLoginResponse().getKcActionStatus();
         assertEquals("error", kcActionStatus);
     }
 
@@ -87,13 +105,13 @@ public void executeDisabledAction() {
         try {
             testRealm().flows().updateRequiredAction("CONFIGURE_TOTP", configureTotp);
 
-            oauth.kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).openLoginForm();
+            oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).open();
 
             loginPage.login("test-user@localhost", "password");
 
             assertTrue(appPage.isCurrent());
 
-            String kcActionStatus = oauth.getCurrentQuery().get("kc_action_status");
+            String kcActionStatus = oauth.parseLoginResponse().getKcActionStatus();
             assertEquals("error", kcActionStatus);
         } finally {
             configureTotp.setEnabled(true);
@@ -102,30 +120,39 @@ public void executeDisabledAction() {
     }
 
     @Test
-    public void executeActionWithVerifyEmailUnsupportedAIA() throws IOException {
+    public void executeActionWithTermsAndConditionsUnsupportedAIA() throws IOException {
         RealmResource realm = testRealm();
-        RequiredActionProviderRepresentation model = realm.flows().getRequiredAction(UserModel.RequiredAction.VERIFY_EMAIL.name());
-        int prevPriority = model.getPriority();
+        RequiredActionProviderRepresentation termsAndConditions = realm.flows().getRequiredAction(TermsAndConditions.PROVIDER_ID);
+        int prevPriority = termsAndConditions.getPriority();
+        boolean prevEnabled = termsAndConditions.isEnabled();
 
         try (UserAttributeUpdater userUpdater = UserAttributeUpdater
                 .forUserByUsername(realm, "test-user@localhost")
-                .setRequiredActions(UserModel.RequiredAction.VERIFY_EMAIL).update()) {
-            // Set max priority for verify email (AIA not supported) to be executed before update password
-            model.setPriority(1);
-            realm.flows().updateRequiredAction(UserModel.RequiredAction.VERIFY_EMAIL.name(), model);
+                .setRequiredActions(UserModel.RequiredAction.TERMS_AND_CONDITIONS).update()) {
+            // Set max priority for terms and conditions (AIA not supported) to be executed before update password
+            termsAndConditions.setPriority(1);
+            termsAndConditions.setEnabled(true);
+            realm.flows().updateRequiredAction(TermsAndConditions.PROVIDER_ID, termsAndConditions);
 
-            oauth.kcAction(UserModel.RequiredAction.UPDATE_PASSWORD.name()).openLoginForm();
+            oauth.loginForm().kcAction(UserModel.RequiredAction.UPDATE_PASSWORD.name()).open();
             loginPage.login("test-user@localhost", "password");
 
-            // the update password should be displayed
+            // Terms and conditions are displayed first (They are not AIA, but displayed as a regular action as they were first)
+            termsAndConditionsPage.assertCurrent();
+            termsAndConditionsPage.acceptTerms();
+
+            // the update password should be displayed as an AIA
             passwordUpdatePage.assertCurrent();
+            assertTrue(passwordUpdatePage.isCancelDisplayed());
             passwordUpdatePage.changePassword("password", "password");
 
-            // once the AIA password is executed the verify profile should be displayed for the login
-            verifyEmailPage.assertCurrent();
+            // once the AIA password is executed the terms and conditions should be displayed for the login
+            appPage.assertCurrent();
+            assertEquals(SUCCESS, oauth.parseLoginResponse().getKcActionStatus());
         } finally {
-            model.setPriority(prevPriority);
-            realm.flows().updateRequiredAction(UserModel.RequiredAction.VERIFY_EMAIL.name(), model);
+            termsAndConditions.setPriority(prevPriority);
+            termsAndConditions.setEnabled(prevEnabled);
+            realm.flows().updateRequiredAction(TermsAndConditions.PROVIDER_ID, termsAndConditions);
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTotpSetupTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTotpSetupTest.java
index 7f17c84fc186..0c147dadedb4 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTotpSetupTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionTotpSetupTest.java
@@ -40,7 +40,7 @@
 import org.keycloak.testsuite.pages.LoginTotpPage;
 import org.keycloak.testsuite.pages.RegisterPage;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.openqa.selenium.By;
@@ -66,14 +66,6 @@ public void configureTestRealm(RealmRepresentation testRealm) {
 
     @Before
     public void setOTPAuthRequired() {
-        adminClient.realm("test").flows().getExecutions("browser")
-                .stream()
-                .filter(execution -> execution.getDisplayName().equals("Browser - Conditional OTP"))
-                .forEach(execution -> {
-                        execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.name());
-                        adminClient.realm("test").flows().updateExecutions("browser", execution);
-                });
-
         ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
         UserRepresentation user = UserBuilder.create().enabled(true)
                 .username("test-user@localhost")
@@ -103,6 +95,7 @@ public void setupTotpRegister() {
         registerPage.register("firstName", "lastName", "email@mail.com", "setupTotp", "password", "password");
 
         String userId = events.expectRegister("setupTotp", "email@mail.com").assertEvent().getUserId();
+        getCleanup().addUserId(userId);
 
         doAIA();
 
@@ -128,12 +121,39 @@ public void setupTotpRegister() {
         events.expectLogin().user(userId).session(authSessionId2).detail(Details.USERNAME, "setuptotp").assertEvent();
     }
 
+    @Test
+    public void setupTotpRegisterDuplicateUserLabel() {
+        loginPage.open();
+        loginPage.clickRegister();
+        registerPage.register("firstName", "lastName", "email@mail.com", "setupTotp", "password", "password");
+
+        String userId = events.expectRegister("setupTotp", "email@mail.com").assertEvent().getUserId();
+        getCleanup().addUserId(userId);
+
+        doAIA();
+
+        totpPage.assertCurrent();
+
+        totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()), "otp");
+
+        assertKcActionStatus(SUCCESS);
+
+        doAIA();
+
+        totpPage.assertCurrent();
+
+        totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()), "otp");
+
+        assertEquals("Device already exists with the same name", totpPage.getInputLabelError());
+
+    }
+
     @Test
     public void cancelSetupTotp() throws Exception {
         try {
             // Emulate former (pre KEYCLOAK-11745 change) OPTIONAL requirement by:
             // * Disabling the CONFIGURE_TOTP required action on realm
-            // * Marking "Browser - Conditional OTP" authenticator as CONDITIONAL
+            // * Marking "Browser - Conditional 2FA" authenticator as CONDITIONAL
             // * Marking "Condition - user configured" authenticator as DISABLED, and
             // * Marking "OTP Form" authenticator as ALTERNATIVE
             preConfigureRealmForCancelSetupTotpTest();
@@ -153,7 +173,7 @@ private void preConfigureRealmForCancelSetupTotpTest() {
         // Disable CONFIGURE_TOTP required action
         configureRealmEnableRequiredActionByAlias("CONFIGURE_TOTP", false);
         // Set "Browser - Conditional OTP" execution requirement to CONDITIONAL
-        configureRealmSetExecutionRequirementByDisplayName("browser", "Browser - Conditional OTP", AuthenticationExecutionModel.Requirement.CONDITIONAL);
+        configureRealmSetExecutionRequirementByDisplayName("browser", "Browser - Conditional 2FA", AuthenticationExecutionModel.Requirement.CONDITIONAL);
         // Set "Condition - user configured" execution requirement to DISABLED
         configureRealmSetExecutionRequirementByDisplayName("browser", "Condition - user configured", AuthenticationExecutionModel.Requirement.DISABLED);
         // Set "OTP Form" execution requirement to ALTERNATIVE
@@ -165,9 +185,9 @@ private void postConfigureRealmForCancelSetupTotpTest() {
         // Enable CONFIGURE_TOTP required action back (the default)
         configureRealmEnableRequiredActionByAlias("CONFIGURE_TOTP", true);
 
-        // Set requirement of "Browser - Conditional OTP", "Condition - user configured",
+        // Set requirement of "Browser - Conditional 2FA", "Condition - user configured",
         // and "OTP Form" browser flow executions back to REQUIRED (the default)
-        List<String> executionDisplayNames = Arrays.asList("Browser - Conditional OTP", "Condition - user configured", "OTP Form");
+        List<String> executionDisplayNames = Arrays.asList("Browser - Conditional 2FA", "Condition - user configured", "OTP Form");
         executionDisplayNames.stream().forEach(name -> configureRealmSetExecutionRequirementByDisplayName("browser", name, AuthenticationExecutionModel.Requirement.REQUIRED));
     }
 
@@ -367,8 +387,8 @@ public void setupTotpExisting() {
         assertEquals(authSessionId1, authSessionId2);
         EventRepresentation loginEvent = events.expectLogin().session(authSessionId2).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(authSessionId2).assertEvent();
 
@@ -390,6 +410,7 @@ public void setupTotpRegisteredAfterTotpRemoval() {
         registerPage.register("firstName2", "lastName2", "email2@mail.com", "setupTotp2", "password2", "password2");
 
         String userId = events.expectRegister("setupTotp2", "email2@mail.com").assertEvent().getUserId();
+        getCleanup().addUserId(userId);
 
         doAIA();
 
@@ -415,8 +436,8 @@ public void setupTotpRegisteredAfterTotpRemoval() {
         EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "setuptotp2").assertEvent();
 
         // Logout
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
         events.expectLogout(loginEvent.getSessionId()).user(userId).assertEvent();
 
         // Try to login after logout
@@ -481,8 +502,8 @@ public void setupOtpPolicyChangedTotp8Digits() {
         assertEquals(sessionId1, sessionId2);
         EventRepresentation loginEvent = events.expectLogin().session(sessionId2).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -540,8 +561,8 @@ public void setupOtpPolicyChangedHotp() {
         assertKcActionStatus(SUCCESS);
         EventRepresentation loginEvent = events.expectLogin().session(sessionId1).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -555,7 +576,7 @@ public void setupOtpPolicyChangedHotp() {
         loginEvent = events.expectLogin().assertEvent();
 
         tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
         events.expectLogout(null).session(AssertEvents.isUUID()).assertEvent();
 
         // test lookAheadWindow
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionUpdateEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionUpdateEmailTest.java
index 7037e26f6e3d..0dc841a5b32a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionUpdateEmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionUpdateEmailTest.java
@@ -17,27 +17,52 @@
 package org.keycloak.testsuite.actions;
 
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.userprofile.UserProfileConstants.ROLE_USER;
 
+import org.junit.After;
 import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.UserProfileResource;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
+import org.keycloak.models.Constants;
 import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.userprofile.config.UPAttribute;
 import org.keycloak.representations.userprofile.config.UPAttributePermissions;
 import org.keycloak.representations.userprofile.config.UPAttributeRequired;
 import org.keycloak.representations.userprofile.config.UPConfig;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.validate.validators.LengthValidator;
+import org.openqa.selenium.WebElement;
+import org.openqa.selenium.firefox.FirefoxDriver;
+import org.openqa.selenium.support.FindBy;
 
 public class AppInitiatedActionUpdateEmailTest extends AbstractAppInitiatedActionUpdateEmailTest {
 
+    @FindBy(id = "update-email-btn")
+    private WebElement updateEmailBtn;
+
+    @After
+    public void after() {
+        // update email required action max auth age back to default
+        Optional<RequiredActionProviderRepresentation> updateEmailAction = testRealm().flows().getRequiredActions()
+                .stream()
+                .filter(requiredAction -> requiredAction.getProviderId().equals(UserModel.RequiredAction.UPDATE_EMAIL.name()))
+                .findFirst();
+        if (updateEmailAction.isPresent()) {
+            updateEmailAction.get().getConfig().remove(Constants.MAX_AUTH_AGE_KEY);
+            testRealm().flows().updateRequiredAction(UserModel.RequiredAction.UPDATE_EMAIL.name(), updateEmailAction.get());
+        }
+    }
+
     @Test
     public void updateEmail() throws Exception {
         changeEmailUsingAIA("new@email.com");
@@ -104,4 +129,54 @@ protected void changeEmailUsingAIA(String newEmail) throws Exception {
 
         emailUpdatePage.changeEmail(newEmail);
     }
+
+    @Test
+    // only for firefox as it needs to go to the account console
+
+    @IgnoreBrowserDriver(value={FirefoxDriver.class}, negate=true)
+    public void updateEmailReAuthentication() {
+        appPage.open();
+        appPage.openAccount();
+
+        loginPage.login("test-user@localhost", "password");
+
+        setTimeOffset(50);
+
+        UIUtils.clickLink(updateEmailBtn);
+
+        loginPage.assertCurrent();
+        loginPage.login("password");
+
+        emailUpdatePage.assertCurrent();
+        emailUpdatePage.changeEmail("test-user2@localhost");
+    }
+
+    @Test
+    // only for firefox as it needs to go to the account console
+    // chrome doesn't work due to "change password popup"
+    @IgnoreBrowserDriver(value={FirefoxDriver.class}, negate=true)
+    public void updateEmailCustomMaxAgeReAuthentication() {
+        RequiredActionProviderRepresentation updateEmailAction = testRealm().flows().getRequiredActions()
+                .stream()
+                .filter(requiredAction -> requiredAction.getProviderId().equals(UserModel.RequiredAction.UPDATE_EMAIL.name()))
+                .findFirst()
+                .orElseThrow();
+
+        // this custom config should be ignored and re-authentication should be always required
+        updateEmailAction.getConfig().put(Constants.MAX_AUTH_AGE_KEY, "300");
+        testRealm().flows().updateRequiredAction(UserModel.RequiredAction.UPDATE_EMAIL.name(), updateEmailAction);
+
+        appPage.open();
+        appPage.openAccount();
+
+        loginPage.login("test-user@localhost", "password");
+
+        UIUtils.clickLink(updateEmailBtn);
+
+        loginPage.assertCurrent();
+        loginPage.login("password");
+
+        emailUpdatePage.assertCurrent();
+        emailUpdatePage.changeEmail("test-user2@localhost");
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionVerifyEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionVerifyEmailTest.java
new file mode 100755
index 000000000000..1a68bced5a66
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedActionVerifyEmailTest.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2019 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.actions;
+
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.pages.ErrorPage;
+import org.keycloak.testsuite.pages.VerifyEmailPage;
+import org.keycloak.testsuite.util.UserBuilder;
+
+/**
+ * Only covers basic use cases for App Initialized actions. Complete dynamic user profile behavior is tested in {@link RequiredActionUpdateProfileWithUserProfileTest} as it shares same code as the App initialized action.
+ *
+ * @author Stan Silvert
+ */
+public class AppInitiatedActionVerifyEmailTest extends AbstractAppInitiatedActionTest {
+
+    @Override
+    public String getAiaAction() {
+        return UserModel.RequiredAction.VERIFY_EMAIL.name();
+    }
+    
+    @Page
+    protected VerifyEmailPage verifyEmailPage;
+
+    @Page
+    protected ErrorPage errorPage;
+    
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+    }
+
+    @Before
+    public void beforeTest() {
+        ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
+        UserRepresentation user = UserBuilder.create().enabled(true)
+                .username("test-user@localhost")
+                .email("test-user@localhost")
+                .firstName("Tom")
+                .lastName("Brady")
+                .build();
+        ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
+    }
+  
+    @Test
+    public void sendVerifyEmail() {
+        doAIA();
+
+        loginPage.login("test-user@localhost", "password");
+        
+        verifyEmailPage.assertCurrent();
+
+    }
+    
+    @Test
+    public void cancelUpdateProfile() {
+        doAIA();
+
+        loginPage.login("test-user@localhost", "password");
+        
+        verifyEmailPage.assertCurrent();
+        verifyEmailPage.cancel();
+
+        assertKcActionStatus(CANCELLED);
+
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedRegistrationTest.java
index 6fab9dbe174f..77b0b1cfa97e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/AppInitiatedRegistrationTest.java
@@ -1,6 +1,5 @@
 package org.keycloak.testsuite.actions;
 
-import jakarta.ws.rs.core.UriBuilder;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Before;
 import org.junit.Test;
@@ -33,11 +32,9 @@ public void before() {
     @Test
     public void ensureLocaleParameterIsPropagatedDuringAppInitiatedRegistration() {
 
-        var appInitiatedRegisterUrlBuilder = UriBuilder.fromUri(oauth.getRegisterationsUrl());
-        appInitiatedRegisterUrlBuilder.queryParam(LocaleSelectorProvider.KC_LOCALE_PARAM, "en");
-        var appInitiatedRegisterUrl = appInitiatedRegisterUrlBuilder.build().toString();
-
-        driver.navigate().to(appInitiatedRegisterUrl);
+        oauth.registrationForm()
+                .param(LocaleSelectorProvider.KC_LOCALE_PARAM, "en")
+                .open();
 
         registerPage.assertCurrent();
         registerPage.register("first", "last", "test-user@localhost", "test-user", "test","test");
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/DeleteAccountActionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/DeleteAccountActionTest.java
index 5a80728f5e6f..caaba471c4ee 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/DeleteAccountActionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/DeleteAccountActionTest.java
@@ -11,6 +11,7 @@
 import org.junit.Test;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.requiredactions.DeleteAccount;
+import org.keycloak.cookie.CookieType;
 import org.keycloak.events.EventType;
 import org.keycloak.models.AccountRoles;
 import org.keycloak.representations.idm.ClientRepresentation;
@@ -25,6 +26,7 @@
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.openqa.selenium.Cookie;
 
 public class DeleteAccountActionTest extends AbstractTestRealmKeycloakTest {
 
@@ -73,6 +75,44 @@ public void deleteAccountActionSucceeds() {
     Assert.assertEquals(users.size(), 0);
   }
 
+    @Test
+    public void testReauthenticateAfterDeletingAccount() {
+        loginPage.open();
+
+        UserRepresentation userRep = UserBuilder.create()
+                .username("delete-user")
+                .password("password")
+                .enabled(true)
+                .requiredAction(DeleteAccount.PROVIDER_ID)
+                .build();
+        testRealm().users().create(userRep).close();
+        addDeleteAccountRoleToUserClientRoles(userRep.getUsername());
+
+        loginPage.login(userRep.getUsername(), "password");
+
+        Assert.assertTrue(deleteAccountPage.isCurrent());
+
+        Cookie authSessionCookie = driver.manage().getCookieNamed(CookieType.AUTH_SESSION_ID.getName());
+        deleteAccountPage.clickConfirmAction();
+
+        events.expect(EventType.DELETE_ACCOUNT);
+
+        List<UserRepresentation> users = testRealm().users().search(userRep.getUsername());
+
+        Assert.assertEquals(users.size(), 0);
+
+        testRealm().users().create(userRep).close();
+        addDeleteAccountRoleToUserClientRoles(userRep.getUsername());
+        loginPage.open();
+        Cookie newAuthSessionCookie = driver.manage().getCookieNamed(CookieType.AUTH_SESSION_ID.getName());
+        Assert.assertFalse(authSessionCookie.getValue().equals(newAuthSessionCookie.getValue()));
+        loginPage.login(userRep.getUsername(), "password");
+        Assert.assertTrue(deleteAccountPage.isCurrent());
+        deleteAccountPage.clickConfirmAction();
+        users = testRealm().users().search(userRep.getUsername());
+        Assert.assertEquals(users.size(), 0);
+    }
+
   @Test
   public void deleteAccountFailsWithoutRoleFails() {
     removeDeleteAccountRoleFromUserClientRoles();
@@ -87,7 +127,11 @@ public void deleteAccountFailsWithoutRoleFails() {
 
 
   private void addDeleteAccountRoleToUserClientRoles() {
-    UserRepresentation user = ActionUtil.findUserWithAdminClient(adminClient, "test-user@localhost");
+    addDeleteAccountRoleToUserClientRoles("test-user@localhost");
+  }
+
+  private void addDeleteAccountRoleToUserClientRoles(String username) {
+    UserRepresentation user = ActionUtil.findUserWithAdminClient(adminClient, username);
     ApiUtil.assignClientRoles(adminClient.realm("test"), user.getId(), "account", AccountRoles.DELETE_ACCOUNT);
   }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java
index b658ec57228c..a1a9468635c4 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionEmailVerificationTest.java
@@ -42,7 +42,6 @@
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.AuthServerTestEnricher;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.cluster.AuthenticationSessionFailoverClusterTest;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
@@ -77,7 +76,6 @@
 
 import org.hamcrest.Matchers;
 import org.junit.Assume;
-import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebDriver;
 import org.openqa.selenium.WebElement;
@@ -889,7 +887,7 @@ public void verifyEmailDuringAuthFlowAfterRefresh() throws URISyntaxException, I
             appPage.assertCurrent();
 
             // Browser 2: Log in
-            driver2.navigate().to(oauth.getLoginFormUrl());
+            driver2.navigate().to(oauth.loginForm().build());
 
             assertThat(driver2.getTitle(), is("Sign in to " + testRealmName));
             driver2.findElement(By.id("username")).sendKeys("test-user@localhost");
@@ -1044,7 +1042,7 @@ public void verifyEmailInNewBrowserWhileLoggedInFirstBrowser() throws IOExceptio
         assertThat(driver2.getPageSource(), Matchers.containsString("kc-info-message"));
         assertThat(driver2.getPageSource(), Matchers.containsString("Your email address has been verified."));
 
-        driver2.navigate().to(oauth.getLoginFormUrl());
+        driver2.navigate().to(oauth.loginForm().build());
 
         // login page should be shown in the second browser
         assertThat(driver2.getPageSource(), Matchers.containsString("kc-login"));
@@ -1064,9 +1062,7 @@ public void verifyEmailInNewBrowserWhileLoggedInFirstBrowser() throws IOExceptio
     public void verifyEmailExpiredRegistration() throws IOException, MessagingException {
         final String COMMON_ATTR = "verifyEmailRegistrationUser";
 
-        String appInitiatedRegisterUrl = oauth.getLoginFormUrl();
-        appInitiatedRegisterUrl = appInitiatedRegisterUrl.replace("openid-connect/auth", "openid-connect/registrations");
-        driver.navigate().to(appInitiatedRegisterUrl);
+        driver.navigate().to(oauth.registrationForm().build());
 
         registerPage.assertCurrent();
         registerPage.register(COMMON_ATTR, COMMON_ATTR, COMMON_ATTR + "@" + COMMON_ATTR, COMMON_ATTR, COMMON_ATTR, COMMON_ATTR);
@@ -1115,7 +1111,6 @@ public void changeEmailAddressAfterSendingEmail() throws Exception {
     }
 
     @Test
-    @EnableFeature(value = Profile.Feature.UPDATE_EMAIL, skipRestart = true)
     public void actionTokenWithInvalidRequiredActions() throws IOException {
         // Send email with required action
         testRealm().users().get(testUserId).executeActionsEmail(List.of(RequiredAction.UPDATE_EMAIL.name()));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionPriorityTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionPriorityTest.java
index 057315bc1dce..f86d34810696 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionPriorityTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionPriorityTest.java
@@ -50,7 +50,7 @@
 import org.keycloak.testsuite.pages.TermsAndConditionsPage;
 import org.keycloak.testsuite.pages.VerifyProfilePage;
 import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import java.util.List;
 
@@ -229,10 +229,7 @@ public void executeRequiredActionsWithCustomPriorityAppliesSamePriorityToUserAct
         enableRequiredActionForUser(RequiredAction.TERMS_AND_CONDITIONS);
 
         // Login with kc_action=UPDATE_PROFILE
-        final var kcActionOauth = new OAuthClient();
-        kcActionOauth.init(driver);
-        kcActionOauth.kcAction(RequiredAction.UPDATE_PROFILE.name());
-        kcActionOauth.openLoginForm();
+        oauth.loginForm().kcAction(RequiredAction.UPDATE_PROFILE.name()).open();
         loginPage.assertCurrent(TEST_REALM_NAME);
         loginPage.login(USERNAME, PASSWORD);
 
@@ -242,7 +239,13 @@ public void executeRequiredActionsWithCustomPriorityAppliesSamePriorityToUserAct
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).assertEvent();
 
-        // Second, update profile
+        // Second, accept terms
+        termsPage.assertCurrent();
+        termsPage.acceptTerms();
+        events.expectRequiredAction(EventType.CUSTOM_REQUIRED_ACTION).removeDetail(Details.REDIRECT_URI)
+                .detail(Details.CUSTOM_REQUIRED_ACTION, TermsAndConditions.PROVIDER_ID).assertEvent();
+
+        // Finally, update profile. Action specified by "kc_action" should be always triggered last
         updateProfilePage.assertCurrent();
         updateProfilePage.prepareUpdate().firstName(NEW_FIRST_NAME).lastName(NEW_LAST_NAME)
                 .email(NEW_EMAIL).submit();
@@ -252,12 +255,6 @@ public void executeRequiredActionsWithCustomPriorityAppliesSamePriorityToUserAct
                 .detail(Details.UPDATED_EMAIL, NEW_EMAIL)
                 .assertEvent();
 
-        // Finally, accept terms
-        termsPage.assertCurrent();
-        termsPage.acceptTerms();
-        events.expectRequiredAction(EventType.CUSTOM_REQUIRED_ACTION).removeDetail(Details.REDIRECT_URI)
-                .detail(Details.CUSTOM_REQUIRED_ACTION, TermsAndConditions.PROVIDER_ID).assertEvent();
-
         // Logged in
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionResetPasswordTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionResetPasswordTest.java
index 404b4f8d1c61..74dda6d66e77 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionResetPasswordTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionResetPasswordTest.java
@@ -24,6 +24,7 @@
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
+import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
 import org.keycloak.events.Details;
@@ -46,7 +47,9 @@
 import org.keycloak.testsuite.pages.LoginUsernameOnlyPage;
 import org.keycloak.testsuite.util.FlowUtil;
 import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.SecondBrowser;
 import org.openqa.selenium.WebDriver;
@@ -114,8 +117,8 @@ public void tempPassword() throws Exception {
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -136,43 +139,62 @@ public void resetPasswordLogoutSessionsNotChecked() {
     }
 
     private void resetPassword(boolean logoutOtherSessions) {
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        // create a regular session
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
         UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
         oauth2.doLogin("test-user@localhost", "password");
-        EventRepresentation event1 = events.expectLogin().assertEvent();
+        EventRepresentation regularSession = events.expectLogin().assertEvent();
         assertEquals(1, testUser.getUserSessions().size());
 
+        // navigate to a neutral URL to then clear the cookies on that domain
+        oauth2.getDriver().navigate().to(oauth2.getEndpoints().getJwks());
+        oauth2.getDriver().manage().deleteAllCookies();
+
+        // create an offline session
+        oauth2.scope(OAuth2Constants.OFFLINE_ACCESS);
+        AuthorizationEndpointResponse os = oauth2.doLogin("test-user@localhost", "password");
+        EventRepresentation offlineSession = events.expectLogin().assertEvent();
+        AccessTokenResponse at = oauth2.doAccessTokenRequest(os.getCode());
+        String clientUuid = testRealm().clients().findByClientId(oauth2.getClientId()).get(0).getId();
+        assertEquals(1, testUser.getOfflineSessions(clientUuid).size());
+
         requireUpdatePassword();
 
         loginPage.open();
         loginPage.login("test-user@localhost", "password");
         changePasswordPage.assertCurrent();
         assertTrue(changePasswordPage.isLogoutSessionDisplayed());
-        assertTrue(changePasswordPage.isLogoutSessionsChecked());
-        if (!logoutOtherSessions) {
-            changePasswordPage.uncheckLogoutSessions();
+        assertFalse(changePasswordPage.isLogoutSessionsChecked());
+        if (logoutOtherSessions) {
+            changePasswordPage.checkLogoutSessions();
         }
         changePasswordPage.changePassword("All Right Then, Keep Your Secrets", "All Right Then, Keep Your Secrets");
 
         if (logoutOtherSessions) {
-            events.expectLogout(event1.getSessionId())
+            events.expectLogout(regularSession.getSessionId())
+                    .detail(Details.LOGOUT_TRIGGERED_BY_REQUIRED_ACTION, RequiredAction.UPDATE_PASSWORD.name())
+                    .assertEvent(true);
+            events.expectLogout(offlineSession.getSessionId())
                     .detail(Details.LOGOUT_TRIGGERED_BY_REQUIRED_ACTION, RequiredAction.UPDATE_PASSWORD.name())
                     .assertEvent();
         }
 
-        events.expectRequiredAction(EventType.UPDATE_PASSWORD).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
+        events.expectRequiredAction(EventType.UPDATE_PASSWORD).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent(true);
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
 
         EventRepresentation event2 = events.expectLogin().assertEvent();
-        List<UserSessionRepresentation> sessions = testUser.getUserSessions();
+        List<UserSessionRepresentation> regularSessions = testUser.getUserSessions();
+        List<UserSessionRepresentation> offlineSessions = testUser.getOfflineSessions(clientUuid);
         if (logoutOtherSessions) {
-            assertEquals(1, sessions.size());
-            assertEquals(event2.getSessionId(), sessions.iterator().next().getId());
+            assertEquals(1, regularSessions.size());
+            assertEquals(event2.getSessionId(), regularSessions.iterator().next().getId());
+            assertEquals(0, offlineSessions.size());
         } else {
-            assertEquals(2, sessions.size());
-            MatcherAssert.assertThat(sessions.stream().map(UserSessionRepresentation::getId).collect(Collectors.toList()),
-                    Matchers.containsInAnyOrder(event1.getSessionId(), event2.getSessionId()));
+            assertEquals(2, regularSessions.size());
+            MatcherAssert.assertThat(regularSessions.stream().map(UserSessionRepresentation::getId).collect(Collectors.toList()),
+                    Matchers.containsInAnyOrder(regularSession.getSessionId(), event2.getSessionId()));
+            MatcherAssert.assertThat(offlineSessions.stream().map(UserSessionRepresentation::getId).collect(Collectors.toList()),
+                    Matchers.containsInAnyOrder(offlineSession.getSessionId()));
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
index cb40c1a7a0c6..ed0480bcb919 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionTotpSetupTest.java
@@ -24,8 +24,10 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.authentication.authenticators.browser.OTPFormAuthenticatorFactory;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.models.AuthenticationExecutionModel;
@@ -33,6 +35,7 @@
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.utils.HmacOTP;
 import org.keycloak.models.utils.TimeBasedOTP;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
@@ -50,7 +53,8 @@
 import org.keycloak.testsuite.pages.RegisterPage;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.SecondBrowser;
 import org.keycloak.testsuite.util.UserBuilder;
@@ -87,13 +91,20 @@ public void configureTestRealm(RealmRepresentation testRealm) {
         testRealm.setResetPasswordAllowed(Boolean.TRUE);
     }
 
-    private void setOTPAuthRequirement(AuthenticationExecutionModel.Requirement requirement) {
-        adminClient.realm(TEST_REALM_NAME).flows().getExecutions("browser").
-                stream().filter(execution -> execution.getDisplayName().equals("Browser - Conditional OTP"))
-                .forEach(execution -> {
-                    execution.setRequirement(requirement.name());
-                    adminClient.realm("test").flows().updateExecutions("browser", execution);
-                });
+    private void setOTPAuthRequirement(AuthenticationExecutionModel.Requirement conditionalReq, AuthenticationExecutionModel.Requirement otpReq) {
+        AuthenticationManagementResource authMgtRes = testRealm().flows();
+        AuthenticationExecutionInfoRepresentation browserConditionalExecution = authMgtRes.getExecutions("browser").stream()
+                .filter(execution -> execution.getDisplayName().equals("Browser - Conditional 2FA"))
+                .findAny()
+                .get();
+        browserConditionalExecution.setRequirement(conditionalReq.name());
+        authMgtRes.updateExecutions("browser", browserConditionalExecution);
+        AuthenticationExecutionInfoRepresentation otpExecution = authMgtRes.getExecutions("Browser - Conditional 2FA").stream()
+                .filter(execution -> OTPFormAuthenticatorFactory.PROVIDER_ID.equals(execution.getProviderId()))
+                .findAny()
+                .get();
+        otpExecution.setRequirement(otpReq.name());
+        authMgtRes.updateExecutions("browser", otpExecution);
     }
 
     private void configureRequiredActionsToUser(String username, String... actions) {
@@ -105,9 +116,6 @@ private void configureRequiredActionsToUser(String username, String... actions)
 
     @Before
     public void setOTPAuthRequired() {
-
-        setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.REQUIRED);
-
         ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
         UserRepresentation user = UserBuilder.create().enabled(true)
                 .username("test-user@localhost")
@@ -403,8 +411,8 @@ public void setupTotpExisting(boolean reusableCodesEnabled) {
 
         EventRepresentation loginEvent = events.expectLogin().session(authSessionId1).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(authSessionId1).assertEvent();
 
@@ -425,107 +433,117 @@ public void setupTotpExisting(boolean reusableCodesEnabled) {
     //KEYCLOAK-15511
     @Test
     public void setupTotpEnforcedBySessionNotForUserInGeneral() {
-        String username = "test-user@localhost";
-        String configureTotp = UserModel.RequiredAction.CONFIGURE_TOTP.name();
+        setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.REQUIRED, AuthenticationExecutionModel.Requirement.REQUIRED);
+        try {
+            String username = "test-user@localhost";
+            String configureTotp = UserModel.RequiredAction.CONFIGURE_TOTP.name();
 
-        // Remove required action from the user
-        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), username);
-        UserRepresentation userRepresentation = user.toRepresentation();
-        userRepresentation.getRequiredActions().remove(configureTotp);
-        user.update(userRepresentation);
+            // Remove required action from the user
+            UserResource user = ApiUtil.findUserByUsernameId(testRealm(), username);
+            UserRepresentation userRepresentation = user.toRepresentation();
+            userRepresentation.getRequiredActions().remove(configureTotp);
+            user.update(userRepresentation);
 
-        // login
-        loginPage.open();
-        loginPage.login(username, "password");
+            // login
+            loginPage.open();
+            loginPage.login(username, "password");
 
-        // ensure TOTP configuration is enforced for current authentication session
-        totpPage.assertCurrent();
+            // ensure TOTP configuration is enforced for current authentication session
+            totpPage.assertCurrent();
 
-        // ensure TOTP configuration it is not enforced for the user in general
-        userRepresentation = user.toRepresentation();
-        assertFalse(userRepresentation.getRequiredActions().contains(configureTotp));
+            // ensure TOTP configuration it is not enforced for the user in general
+            userRepresentation = user.toRepresentation();
+            assertFalse(userRepresentation.getRequiredActions().contains(configureTotp));
+        } finally {
+            setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.CONDITIONAL, AuthenticationExecutionModel.Requirement.ALTERNATIVE);
+        }
     }
 
     @Test
     public void setupTotpRegisteredAfterTotpRemoval() {
-        // Register new user
-        loginPage.open();
-        loginPage.clickRegister();
-        registerPage.register("firstName2", "lastName2", "email2@mail.com", "setupTotp2", "password2", "password2");
-
-        String userId = events.expectRegister("setupTotp2", "email2@mail.com").assertEvent().getUserId();
+        setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.REQUIRED, AuthenticationExecutionModel.Requirement.REQUIRED);
+        try {
+            // Register new user
+            loginPage.open();
+            loginPage.clickRegister();
+            registerPage.register("firstName2", "lastName2", "email2@mail.com", "setupTotp2", "password2", "password2");
 
-        // Configure totp
-        totpPage.assertCurrent();
+            String userId = events.expectRegister("setupTotp2", "email2@mail.com").assertEvent().getUserId();
 
-        String totpCode = totpPage.getTotpSecret();
-        totpPage.configure(totp.generateTOTP(totpCode));
+            // Configure totp
+            totpPage.assertCurrent();
 
-        // After totp config, user should be on the app page
-        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            String totpCode = totpPage.getTotpSecret();
+            totpPage.configure(totp.generateTOTP(totpCode));
 
-        events.expectRequiredAction(EventType.UPDATE_TOTP)
-                .user(userId)
-                .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
-                .detail(Details.USERNAME, "setuptotp2").assertEvent();
-        events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
-                .user(userId)
-                .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
-                .detail(Details.USERNAME, "setuptotp2").assertEvent();
+            // After totp config, user should be on the app page
+            assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "setuptotp2").assertEvent();
+            events.expectRequiredAction(EventType.UPDATE_TOTP)
+                    .user(userId)
+                    .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
+                    .detail(Details.USERNAME, "setuptotp2").assertEvent();
+            events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
+                    .user(userId)
+                    .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
+                    .detail(Details.USERNAME, "setuptotp2").assertEvent();
 
-        // Logout
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
-        events.expectLogout(loginEvent.getSessionId()).user(userId).assertEvent();
+            EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "setuptotp2").assertEvent();
 
-        setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
+            // Logout
+            AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
+            events.expectLogout(loginEvent.getSessionId()).user(userId).assertEvent();
 
-        // Try to login after logout
-        loginPage.open();
-        loginPage.login("setupTotp2", "password2");
+            setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
 
-        // Totp is already configured, thus one-time password is needed, login page should be loaded
-        String uri = driver.getCurrentUrl();
-        String src = driver.getPageSource();
-        assertTrue(loginPage.isCurrent());
-        Assert.assertFalse(totpPage.isCurrent());
-
-        // Login with one-time password
-        loginTotpPage.login(totp.generateTOTP(totpCode));
-
-        loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "setupTotp2").assertEvent();
+            // Try to login after logout
+            loginPage.open();
+            loginPage.login("setupTotp2", "password2");
 
-        // Remove google authenticator
-        Assert.assertTrue(AccountHelper.deleteTotpAuthentication(testRealm(),"setupTotp2"));
-        AccountHelper.logout(testRealm(),"setupTotp2");
+            // Totp is already configured, thus one-time password is needed, login page should be loaded
+            String uri = driver.getCurrentUrl();
+            String src = driver.getPageSource();
+            assertTrue(loginPage.isCurrent());
+            Assert.assertFalse(totpPage.isCurrent());
 
-        setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
+            // Login with one-time password
+            loginTotpPage.login(totp.generateTOTP(totpCode));
 
-        // Try to login
-        loginPage.open();
-        loginPage.login("setupTotp2", "password2");
+            loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "setupTotp2").assertEvent();
 
-        // Since the authentificator was removed, it has to be set up again
-        totpPage.assertCurrent();
-        totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()));
+            // Remove google authenticator
+            Assert.assertTrue(AccountHelper.deleteTotpAuthentication(testRealm(), "setupTotp2"));
+            AccountHelper.logout(testRealm(), "setupTotp2");
 
-        String sessionId1 = events.expectRequiredAction(EventType.UPDATE_TOTP)
-                .user(userId)
-                .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
-                .detail(Details.USERNAME, "setupTotp2").assertEvent()
-                .getDetails().get(Details.CODE_ID);
-        String sessionId2 = events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
-                .user(userId)
-                .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
-                .detail(Details.USERNAME, "setupTotp2").assertEvent()
-                .getDetails().get(Details.CODE_ID);
+            setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
 
-        assertEquals(sessionId1, sessionId2);
-        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            // Try to login
+            loginPage.open();
+            loginPage.login("setupTotp2", "password2");
+
+            // Since the authentificator was removed, it has to be set up again
+            totpPage.assertCurrent();
+            totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()));
+
+            String sessionId1 = events.expectRequiredAction(EventType.UPDATE_TOTP)
+                    .user(userId)
+                    .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
+                    .detail(Details.USERNAME, "setupTotp2").assertEvent()
+                    .getDetails().get(Details.CODE_ID);
+            String sessionId2 = events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
+                    .user(userId)
+                    .detail(Details.CREDENTIAL_TYPE, OTPCredentialModel.TYPE)
+                    .detail(Details.USERNAME, "setupTotp2").assertEvent()
+                    .getDetails().get(Details.CODE_ID);
+
+            assertEquals(sessionId1, sessionId2);
+            assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        events.expectLogin().user(userId).session(sessionId1).detail(Details.USERNAME, "setupTotp2").assertEvent();
+            events.expectLogin().user(userId).session(sessionId1).detail(Details.USERNAME, "setupTotp2").assertEvent();
+        } finally {
+            setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.CONDITIONAL, AuthenticationExecutionModel.Requirement.ALTERNATIVE);
+        }
     }
 
     @Test
@@ -564,8 +582,8 @@ public void setupOtpPolicyChangedTotp8Digits() {
 
         EventRepresentation loginEvent = events.expectLogin().session(sessionId1).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -624,8 +642,8 @@ public void setupOtpPolicyChangedHotp() {
 
         EventRepresentation loginEvent = events.expectLogin().session(sessionId1).assertEvent();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(loginEvent.getSessionId()).assertEvent();
 
@@ -640,7 +658,7 @@ public void setupOtpPolicyChangedHotp() {
         loginEvent = events.expectLogin().assertEvent();
 
         tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
         events.expectLogout(null).session(AssertEvents.isUUID()).assertEvent();
 
         // test lookAheadWindow
@@ -688,14 +706,11 @@ public void testTotpLogoutOtherSessionsNotChecked() {
     }
 
     private void testTotpLogoutOtherSessions(boolean logoutOtherSessions) {
-        // allow login via password without OTP forced
-        setOTPAuthRequirement(AuthenticationExecutionModel.Requirement.CONDITIONAL);
         configureRequiredActionsToUser("test-user@localhost");
 
         // login with the user using the second driver
         UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
         oauth2.doLogin("test-user@localhost", "password");
         EventRepresentation event1 = events.expectLogin().assertEvent();
         assertEquals(1, testUser.getUserSessions().size());
@@ -707,8 +722,8 @@ private void testTotpLogoutOtherSessions(boolean logoutOtherSessions) {
         loginPage.open();
         loginPage.login("test-user@localhost", "password");
         totpPage.assertCurrent();
-        if (!logoutOtherSessions) {
-            totpPage.uncheckLogoutSessions();
+        if (logoutOtherSessions) {
+            totpPage.checkLogoutSessions();
         }
         Assert.assertEquals(logoutOtherSessions, totpPage.isLogoutSessionsChecked());
         totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTest.java
index d3def4d0adcd..9d1ea0b4fb03 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTest.java
@@ -33,7 +33,7 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.UserSessionRepresentation;
 import org.keycloak.testsuite.pages.AppPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 public class RequiredActionUpdateEmailTest extends AbstractRequiredActionUpdateEmailTest {
 
@@ -43,8 +43,8 @@ protected void changeEmailUsingRequiredAction(String newEmail, boolean logoutOth
 
         loginPage.login("test-user@localhost", "password");
         updateEmailPage.assertCurrent();
-        if (!logoutOtherSessions) {
-            updateEmailPage.uncheckLogoutSessions();
+        if (logoutOtherSessions) {
+            updateEmailPage.checkLogoutSessions();
         }
         Assert.assertEquals(logoutOtherSessions, updateEmailPage.isLogoutSessionsChecked());
 
@@ -55,8 +55,7 @@ private void updateEmail(boolean logoutOtherSessions) {
         // login using another session
         configureRequiredActionsToUser("test-user@localhost");
         UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);;
         oauth2.doLogin("test-user@localhost", "password");
         EventRepresentation event1 = events.expectLogin().assertEvent();
         assertEquals(1, testUser.getUserSessions().size());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTestWithVerificationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTestWithVerificationTest.java
index 0033e04e07d7..610e885b5372 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTestWithVerificationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateEmailTestWithVerificationTest.java
@@ -29,7 +29,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Rule;
@@ -47,7 +46,7 @@
 import org.keycloak.testsuite.pages.InfoPage;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.WaitUtils;
 
 public class RequiredActionUpdateEmailTestWithVerificationTest extends AbstractRequiredActionUpdateEmailTest {
@@ -79,8 +78,8 @@ protected void changeEmailUsingRequiredAction(String newEmail, boolean logoutOth
 		loginPage.login("test-user@localhost", "password");
 
                 updateEmailPage.assertCurrent();
-                if (!logoutOtherSessions) {
-                        updateEmailPage.uncheckLogoutSessions();
+                if (logoutOtherSessions) {
+                        updateEmailPage.checkLogoutSessions();
                 }
                 Assert.assertEquals(logoutOtherSessions, updateEmailPage.isLogoutSessionsChecked());
                 updateEmailPage.changeEmail(newEmail);
@@ -103,8 +102,7 @@ private void updateEmail(boolean logoutOtherSessions) throws Exception {
 		// login using another session
 		configureRequiredActionsToUser("test-user@localhost");
 		UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
-		OAuthClient oauth2 = new OAuthClient();
-		oauth2.init(driver2);
+		OAuthClient oauth2 = oauth.newConfig().driver(driver2);
 		oauth2.doLogin("test-user@localhost", "password");
 		EventRepresentation event1 = events.expectLogin().assertEvent();
 		assertEquals(1, testUser.getUserSessions().size());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileTest.java
index fb21b982d1aa..1a9fd7997462 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileTest.java
@@ -46,7 +46,7 @@
 import org.keycloak.representations.userprofile.config.UPAttribute;
 import org.keycloak.representations.userprofile.config.UPAttributePermissions;
 import org.keycloak.representations.userprofile.config.UPConfig;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
@@ -66,7 +66,7 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class RequiredActionUpdateProfileTest extends AbstractTestRealmKeycloakTest {
+public class RequiredActionUpdateProfileTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
@@ -85,6 +85,7 @@ public class RequiredActionUpdateProfileTest extends AbstractTestRealmKeycloakTe
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         ActionUtil.addRequiredActionForUser(testRealm, "test-user@localhost", UserModel.RequiredAction.UPDATE_PROFILE.name());
         ActionUtil.addRequiredActionForUser(testRealm, "john-doh@localhost", UserModel.RequiredAction.UPDATE_PROFILE.name());
     }
@@ -99,7 +100,7 @@ public void beforeTest() {
                 .lastName("Brady")
                 .emailVerified(true)
                 .requiredAction(UserModel.RequiredAction.UPDATE_PROFILE.name()).build();
-        ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
+        ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, generatePassword("test-user@localhost"));
 
         ApiUtil.removeUserByUsername(testRealm(), "john-doh@localhost");
         user = UserBuilder.create().enabled(true)
@@ -109,14 +110,14 @@ public void beforeTest() {
                 .lastName("Doh")
                 .emailVerified(true)
                 .requiredAction(UserModel.RequiredAction.UPDATE_PROFILE.name()).build();
-        ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
+        ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, generatePassword("john-doh@localhost"));
     }
 
     @Test
     public void updateProfile() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
         assertFalse(updateProfilePage.isCancelDisplayed());
@@ -145,7 +146,7 @@ public void updateProfile() {
     public void updateUsername() {
         loginPage.open();
 
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
         String userId = ActionUtil.findUserWithAdminClient(adminClient, "john-doh@localhost").getId();
 
@@ -177,7 +178,7 @@ public void updateUsername() {
     public void updateProfileMissingFirstName() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -198,7 +199,7 @@ public void updateProfileMissingFirstName() {
     public void updateProfileMissingLastName() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -220,7 +221,7 @@ public void updateProfileMissingLastName() {
     public void updateProfileMissingEmail() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -246,7 +247,7 @@ public void updateProfileMissingEmail() {
     public void updateProfileInvalidEmail() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -269,7 +270,7 @@ public void updateProfileInvalidEmail() {
     public void updateProfileMissingUsername() {
         loginPage.open();
 
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -292,7 +293,7 @@ public void updateProfileMissingUsername() {
     public void updateProfileDuplicateUsername() {
         loginPage.open();
 
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -315,7 +316,7 @@ public void updateProfileDuplicateUsername() {
     public void updateProfileDuplicatedEmail() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -336,11 +337,11 @@ public void updateProfileDuplicatedEmail() {
 
     @Test
     public void updateProfileDuplicateUsernameWithEmail() {
-        getCleanup().addUserId(createUser(TEST_REALM_NAME, "user1@local.com", "password", "user1", "user1", "user1@local.org"));
+        getCleanup().addUserId(createUser(TEST_REALM_NAME, "user1@local.com", generatePassword("user1@local.com"), "user1", "user1", "user1@local.org"));
 
         loginPage.open();
 
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -361,11 +362,11 @@ public void updateProfileDuplicateUsernameWithEmail() {
 
     @Test
     public void updateProfileDuplicatedEmailWithUsername() {
-        getCleanup().addUserId(createUser(TEST_REALM_NAME, "user1@local.com", "password", "user1", "user1", "user1@local.org"));
+        getCleanup().addUserId(createUser(TEST_REALM_NAME, "user1@local.com", generatePassword("user1@local.com"), "user1", "user1", "user1@local.org"));
 
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -387,7 +388,7 @@ public void updateProfileDuplicatedEmailWithUsername() {
     @Test
     public void updateProfileExpiredCookies() {
         loginPage.open();
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
         updateProfilePage.assertCurrent();
 
@@ -421,7 +422,7 @@ public void updateProfileWithoutRemoveCustomAttributes() {
 
             loginPage.open();
 
-            loginPage.login("test-user@localhost", "password");
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
             updateProfilePage.assertCurrent();
             assertFalse(updateProfilePage.isCancelDisplayed());
@@ -469,7 +470,7 @@ public void testMultivaluedAttributes() {
             userProfile.update(testUpConfig);
 
             loginPage.open();
-            loginPage.login("john-doh@localhost", "password");
+            loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
             updateProfilePage.assertCurrent();
 
             for (String attribute : attributes) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileWithUserProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileWithUserProfileTest.java
index 905e075b07b5..f1b6c69147d9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileWithUserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/RequiredActionUpdateProfileWithUserProfileTest.java
@@ -23,13 +23,13 @@
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_EDITABLE;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_ONLY;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.SCOPE_DEPARTMENT;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.VALIDATIONS_LENGTH;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.ATTRIBUTE_DEPARTMENT;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.CONFIGURATION_FOR_USER_EDIT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_EDITABLE;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_ONLY;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.SCOPE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.VALIDATIONS_LENGTH;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.ATTRIBUTE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.CONFIGURATION_FOR_USER_EDIT;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -41,7 +41,6 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.models.UserModel;
@@ -61,6 +60,7 @@
 import org.keycloak.testsuite.util.ClientScopeBuilder;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebElement;
 
@@ -109,7 +109,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {
 
     @Before
     public void beforeTest() {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), null);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), null);
 
         ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
         UserRepresentation user = UserBuilder.create().enabled(true)
@@ -160,11 +160,11 @@ public void testDisplayName() {
     public void testAttributeGrouping() {
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
                 + "], \"groups\": ["
                 + "{\"name\": \"company\", \"displayDescription\": \"Company field desc\" },"
                 + "{\"name\": \"contact\" }"
@@ -197,11 +197,11 @@ public void testAttributeGrouping() {
     public void testAttributeGuiOrder() {
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + "}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + "}"
                 + "]}");
 
         loginPage.open();
@@ -317,7 +317,7 @@ public void testCustomValidationLastName() {
         updateProfilePage.prepareUpdate().username(USERNAME1).firstName("First").lastName("Last").email(USERNAME1).submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("First", user.getFirstName());
@@ -346,7 +346,7 @@ public void testRequiredReadOnlyAttribute() {
         updateProfilePage.prepareUpdate().username(USERNAME1).firstName("First").lastName("Last").email(USERNAME1).submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("First", user.getFirstName());
@@ -373,7 +373,7 @@ public void testRequiredReadOnlyExistingAttribute() {
         updateProfilePage.prepareUpdate().username(USERNAME1).firstName("First").lastName("Last").email(USERNAME1).submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("First", user.getFirstName());
@@ -400,7 +400,7 @@ public void testAttributeNotVisible() {
         updateProfilePage.prepareUpdate().username(USERNAME1).firstName("First").lastName("Last").email(USERNAME1).submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("First", user.getFirstName());
@@ -438,7 +438,7 @@ public void testRequiredAttribute() {
                 .assertEvent();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -478,7 +478,7 @@ public void testAttributeRequiredForScope() {
 
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -512,7 +512,7 @@ public void testAttributeRequiredForDefaultScope() {
                 .department("DepartmentCC").submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -546,7 +546,7 @@ public void testAttributeRequiredAndSelectedByScope() {
                 .department("DepartmentCC").submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -575,7 +575,7 @@ public void testAttributeNotRequiredAndSelectedByScopeCanBeUpdated() {
                 .department("DepartmentCC").submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -603,7 +603,7 @@ public void testAttributeRequiredButNotSelectedByScopeIsNotRendered() {
         updateProfilePage.prepareUpdate().username(USERNAME1).firstName("FirstCC").lastName("LastCC").email(USERNAME1).submit();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUserByUsername(USERNAME1);
         assertEquals("FirstCC", user.getFirstName());
@@ -611,7 +611,7 @@ public void testAttributeRequiredButNotSelectedByScopeIsNotRendered() {
     }
 
     protected void setUserProfileConfiguration(String configuration) {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), configuration);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
     }
 
     protected UserRepresentation getUserByUsername(String username) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/TermsAndConditionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/TermsAndConditionsTest.java
index aa2a601dd897..09fe384e8f26 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/TermsAndConditionsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/actions/TermsAndConditionsTest.java
@@ -17,7 +17,6 @@
 package org.keycloak.testsuite.actions;
 
 import org.hamcrest.Matchers;
-import org.jboss.arquillian.drone.api.annotation.Drone;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Before;
@@ -29,23 +28,25 @@
 import org.keycloak.events.EventType;
 import org.keycloak.models.Constants;
 import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.TermsAndConditionsPage;
 import org.keycloak.testsuite.util.DroneUtils;
-import org.keycloak.testsuite.util.JavascriptBrowser;
 import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.openqa.selenium.By;
-import org.openqa.selenium.WebDriver;
 import org.openqa.selenium.WebElement;
+import org.openqa.selenium.chrome.ChromeDriver;
+import org.openqa.selenium.firefox.FirefoxDriver;
 
 import java.util.List;
 import java.util.Map;
@@ -61,39 +62,20 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class TermsAndConditionsTest extends AbstractTestRealmKeycloakTest {
+public class TermsAndConditionsTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Drone
-    @JavascriptBrowser
-    private WebDriver jsDriver;
-
     @Page
-    @JavascriptBrowser
     protected AppPage appPage;
 
     @Page
-    @JavascriptBrowser
     protected LoginPage loginPage;
 
     @Page
-    @JavascriptBrowser
     protected TermsAndConditionsPage termsPage;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
-    @Before
-    public void driver() {
-        appPage.setDriver(jsDriver);
-        termsPage.setDriver(jsDriver);
-        loginPage.setDriver(jsDriver);
-        DroneUtils.addWebDriver(jsDriver);
-    }
-
     @Before
     public void addTermsAndConditionRequiredAction() {
         UserRepresentation user = ActionUtil.findUserWithAdminClient(adminClient, "test-user@localhost");
@@ -109,7 +91,7 @@ public void addTermsAndConditionRequiredAction() {
     public void termsAccepted() {
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(termsPage.isCurrent());
 
@@ -118,6 +100,8 @@ public void termsAccepted() {
         events.expectRequiredAction(EventType.CUSTOM_REQUIRED_ACTION).removeDetail(Details.REDIRECT_URI).detail(Details.CUSTOM_REQUIRED_ACTION, TermsAndConditions.PROVIDER_ID).assertEvent();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        Assert.assertNotNull(response.getCode());
 
         events.expectLogin().assertEvent();
 
@@ -139,13 +123,46 @@ public void termsAccepted() {
     }
 
     @Test
-    public void termsDeclined() {
+    public void termsDeclined() throws Exception {
+        loginPage.open();
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        Assert.assertTrue(termsPage.isCurrent());
+
+        termsPage.declineTerms();
+        WaitUtils.waitForPageToLoad();
+
+        // assert on app page with reject login
+        Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        Assert.assertNull(response.getCode());
+        Assert.assertEquals(Errors.ACCESS_DENIED, response.getError());
+        Assert.assertEquals(Messages.TERMS_AND_CONDITIONS_DECLINED, response.getErrorDescription());
+
+        // assert event
+        events.expectLogin().event(EventType.CUSTOM_REQUIRED_ACTION_ERROR).detail(Details.CUSTOM_REQUIRED_ACTION, TermsAndConditions.PROVIDER_ID)
+                .error(Errors.REJECTED_BY_USER)
+                .removeDetail(Details.CONSENT)
+                .session(Matchers.nullValue(String.class))
+                .assertEvent();
+
+        // assert user attribute is properly removed
+        UserRepresentation user = ActionUtil.findUserWithAdminClient(adminClient, "test-user@localhost");
+        Map<String,List<String>> attributes = user.getAttributes();
+        if (attributes != null) {
+            assertNull("expected null for terms acceptance user attribute " + TermsAndConditions.USER_ATTRIBUTE,
+                    attributes.get(TermsAndConditions.USER_ATTRIBUTE));
+        }
+    }
+
+    @Test // only for firefox and chrome as it needs to go to the account console
+    @IgnoreBrowserDriver(value={ChromeDriver.class, FirefoxDriver.class}, negate=true)
+    public void termsDeclinedAccount() {
         appPage.open();
         appPage.openAccount();
 
         loginPage.assertCurrent();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(termsPage.isCurrent());
 
@@ -190,7 +207,7 @@ public void termsDisabled() {
 
         loginPage.open();
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         assertTrue(appPage.isCurrent());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/AbstractAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/AbstractAdapterTest.java
index 8f9598c8371f..06c005c9c159 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/AbstractAdapterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/AbstractAdapterTest.java
@@ -17,10 +17,7 @@
 
 package org.keycloak.testsuite.adapter;
 
-import org.apache.commons.io.IOUtils;
 import org.jboss.arquillian.graphene.page.Page;
-import org.jboss.shrinkwrap.api.Archive;
-import org.jboss.shrinkwrap.api.asset.StringAsset;
 import org.jboss.shrinkwrap.api.spec.WebArchive;
 import org.junit.AfterClass;
 import org.junit.Before;
@@ -31,10 +28,9 @@
 import org.keycloak.testsuite.adapter.page.AppServerContextRoot;
 import org.keycloak.testsuite.arquillian.SuiteContext;
 import org.keycloak.testsuite.arquillian.annotation.AppServerContainer;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.util.ServerURLs;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
-import java.io.IOException;
 import java.net.URL;
 import java.util.ArrayList;
 import java.util.List;
@@ -123,7 +119,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void enableUnmanagedAttributes() {
         for (RealmRepresentation realm : adminClient.realms().findAll()) {
             UserProfileResource upResource = adminClient.realm(realm.getRealm()).users().userProfile();
-            VerifyProfileTest.enableUnmanagedAttributes(upResource);
+            UserProfileUtil.enableUnmanagedAttributes(upResource);
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java
index 91b7a89f98bd..26090648dfb5 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/SAMLServletAdapterTest.java
@@ -74,6 +74,7 @@
 import jakarta.xml.soap.SOAPHeader;
 import jakarta.xml.soap.SOAPHeaderElement;
 import jakarta.xml.soap.SOAPMessage;
+import java.security.cert.X509Certificate;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Source;
 import javax.xml.transform.Transformer;
@@ -124,6 +125,8 @@
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.cookie.CookieType;
 import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.IDPSSODescriptorType;
+import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
 import org.keycloak.dom.saml.v2.protocol.AuthnRequestType;
 import org.keycloak.dom.saml.v2.protocol.ResponseType;
 import org.keycloak.dom.saml.v2.protocol.StatusCodeType;
@@ -135,12 +138,15 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.protocol.saml.SamlConfigAttributes;
 import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.protocol.saml.SamlProtocolUtils;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.GroupRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.rotation.HardcodedKeyLocator;
+import org.keycloak.saml.SignatureAlgorithm;
 import org.keycloak.saml.common.constants.GeneralConstants;
 import org.keycloak.saml.common.constants.JBossSAMLConstants;
 import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
@@ -149,6 +155,8 @@
 import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
 import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
 import org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil;
+import org.keycloak.saml.processing.core.saml.v2.util.SAMLMetadataUtil;
+import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
 import org.keycloak.services.managers.AuthenticationSessionManager;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.sessions.RootAuthenticationSessionModel;
@@ -168,11 +176,12 @@
 import org.keycloak.testsuite.saml.AbstractSamlTest;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.Creator;
+import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.updaters.UserAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.BrowserDriverUtil;
 import org.keycloak.testsuite.util.BrowserTabUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.SamlClient;
 import org.keycloak.testsuite.util.SamlClient.Binding;
 import org.keycloak.testsuite.util.SamlClientBuilder;
@@ -1394,8 +1403,7 @@ public void testUserAttributeStatementMapperGroupsNoAggregate() throws Exception
         }
     }
 
-    @Test
-    public void idpMetadataValidation() throws Exception {
+    public void idpMetadataValidation(boolean signature) throws Exception {
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
             HttpGet httpGet = new HttpGet(authServerPage.toString() + "/realms/" + SAMLSERVLETDEMO + "/protocol/saml/descriptor");
             try (CloseableHttpResponse response = client.execute(httpGet)) {
@@ -1403,10 +1411,45 @@ public void idpMetadataValidation() throws Exception {
                 validateXMLWithSchema(stringResponse, "/adapter-test/keycloak-saml/metadata-schema/saml-schema-metadata-2.0.xsd");
                 Object descriptor = SAMLParser.getInstance().parse(new ByteArrayInputStream(stringResponse.getBytes(GeneralConstants.SAML_CHARSET)));
                 assertThat(descriptor, instanceOf(EntityDescriptorType.class));
+
+                Document doc = DocumentUtil.getDocument(stringResponse);
+
+                if (signature) {
+                    Assert.assertNotNull("IdP metadata is not signed", XMLSignatureUtil.getSignature(doc.getDocumentElement()));
+                    EntityDescriptorType entityType = (EntityDescriptorType) descriptor;
+                    IDPSSODescriptorType idpDescriptor = SAMLMetadataUtil.locateIDPSSODescriptorType(entityType);
+                    Assert.assertNotNull("No IDPSSODescriptorType in the IdP metadata", idpDescriptor);
+                    List<KeyDescriptorType> keyDescriptors = idpDescriptor.getKeyDescriptor();
+                    X509Certificate cert = null;
+                    if (keyDescriptors != null) {
+                        for (KeyDescriptorType keyDescriptorType : keyDescriptors) {
+                            cert = SAMLMetadataUtil.getCertificate(keyDescriptorType);
+                            break;
+                        }
+                    }
+                    Assert.assertNotNull("No signing certificate found in the IdP metadata", cert);
+                    SamlProtocolUtils.verifyDocumentSignature(doc, new HardcodedKeyLocator(cert.getPublicKey()));
+                } else {
+                    Assert.assertNull("IdP metadata is signed", XMLSignatureUtil.getSignature(doc.getDocumentElement()));
+                }
             }
         }
     }
 
+    @Test
+    public void idpMetadataValidationNoSignature() throws Exception {
+        idpMetadataValidation(false);
+    }
+
+    @Test
+    public void idpMetadataValidationSignature() throws Exception {
+        try (RealmAttributeUpdater realmUpdater = new RealmAttributeUpdater(testRealmResource())
+                .setAttribute(SamlConfigAttributes.SAML_SIGNATURE_ALGORITHM, SignatureAlgorithm.RSA_SHA256.name())
+                .update()) {
+            idpMetadataValidation(true);
+        }
+    }
+
     @Test
     public void testDOMAssertion() throws Exception {
         assertSuccessfulLogin(employeeDomServletPage, bburkeUser, testRealmSAMLPostLoginPage, "principal=bburke");
@@ -1933,7 +1976,7 @@ private List<Cookie> impersonate(String admin, String adminPassword, String user
         BasicCookieStore cookieStore = new BasicCookieStore();
         try (Keycloak client = KeycloakBuilder.builder().serverUrl(loginPage.getAuthRoot()).realm(SAMLSERVLETDEMO)
                 .username(admin).password(adminPassword).clientId(Constants.ADMIN_CLI_CLIENT_ID)
-                .resteasyClient(ResteasyClientBuilder.newBuilder().build()).build();
+                .resteasyClient(AdminClientUtil.createResteasyClient()).build();
                 CloseableHttpClient httpClient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build()) {
             HttpUriRequest req = RequestBuilder.post()
                     .setUri(loginPage.getAuthRoot() + "/admin/realms/" + SAMLSERVLETDEMO + "/users/" + userId + "/impersonation")
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/crossdc/SAMLAdapterCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/crossdc/SAMLAdapterCrossDCTest.java
deleted file mode 100644
index 174fd95d34f5..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/adapter/servlet/crossdc/SAMLAdapterCrossDCTest.java
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.adapter.servlet.crossdc;
-
-import org.jboss.arquillian.container.test.api.Deployment;
-import org.jboss.arquillian.container.test.api.TargetsContainer;
-import org.jboss.shrinkwrap.api.asset.StringAsset;
-import org.jboss.shrinkwrap.api.spec.WebArchive;
-import org.junit.Assume;
-import org.junit.BeforeClass;
-import org.keycloak.testsuite.adapter.page.EmployeeServletDistributable;
-import org.keycloak.testsuite.adapter.AbstractSAMLAdapterClusteredTest;
-import org.keycloak.testsuite.adapter.servlet.SendUsernameServlet;
-import org.keycloak.testsuite.arquillian.annotation.AppServerContainer;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-import org.keycloak.testsuite.utils.arquillian.ContainerConstants;
-
-import org.keycloak.testsuite.crossdc.ServerSetup;
-
-import static org.hamcrest.Matchers.emptyString;
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.Matchers.not;
-import org.keycloak.testsuite.arquillian.containers.InfinispanServerDeployableContainer;
-
-/**
- *
- * @author hmlnarik
- */
-@AppServerContainer(ContainerConstants.APP_SERVER_WILDFLY_CLUSTER)
-@AppServerContainer(ContainerConstants.APP_SERVER_EAP_CLUSTER)
-@InitialDcState(authServers = ServerSetup.FIRST_NODE_IN_EVERY_DC, cacheServers = ServerSetup.FIRST_NODE_IN_EVERY_DC)
-public class SAMLAdapterCrossDCTest extends AbstractSAMLAdapterClusteredTest {
-
-    @BeforeClass
-    public static void checkCrossDcTest() {
-        Assume.assumeThat("Seems not to be running cross-DC tests", System.getProperty("cache.server"), not(is(emptyString())));
-        Assume.assumeFalse(String.format("%s not supported with `cache-auth` profile.", SAMLAdapterCrossDCTest.class), 
-                InfinispanServerDeployableContainer.CACHE_SERVER_AUTH);
-    }
-
-    private static final String SESSION_CACHE_NAME = EmployeeServletDistributable.DEPLOYMENT_NAME + "-cache";
-
-    private static final String JBOSS_WEB_XML = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
-      + "<jboss-web>\n"
-      + "    <replication-config>\n"
-      + "        <replication-granularity>SESSION</replication-granularity>\n"
-      + "        <cache-name>" + "web." + SESSION_CACHE_NAME + "</cache-name>\n"
-      + "    </replication-config>\n"
-      + "</jboss-web>";
-
-    @TargetsContainer(value = TARGET_CONTAINER_NODE_1)
-    @Deployment(name = EmployeeServletDistributable.DEPLOYMENT_NAME, managed = false)
-    protected static WebArchive employee() {
-        return samlServletDeployment(EmployeeServletDistributable.DEPLOYMENT_NAME,
-          EmployeeServletDistributable.DEPLOYMENT_NAME + "/WEB-INF/web.xml",
-          SendUsernameServlet.class)
-          .addAsWebInfResource(new StringAsset(JBOSS_WEB_XML), "jboss-web.xml");
-    }
-
-    @TargetsContainer(value = TARGET_CONTAINER_NODE_2)
-    @Deployment(name = EmployeeServletDistributable.DEPLOYMENT_NAME + "_2", managed = false)
-    protected static WebArchive employee2() {
-        return employee();
-    }
-
-    @Override
-    protected void prepareServerDirectories() throws Exception {
-        prepareServerDirectory("standalone-crossdc", "standalone-" + NODE_1_NAME);
-        prepareServerDirectory("standalone-crossdc", "standalone-" + NODE_2_NAME);
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminClientTest.java
index b88149942ab1..2c5c486df7f6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminClientTest.java
@@ -25,9 +25,11 @@
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
+import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.Keycloak;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.client.X509ClientAuthenticator;
 import org.keycloak.common.constants.ServiceAccountConstants;
 import org.keycloak.models.AdminRoles;
@@ -37,12 +39,14 @@
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientScopeBuilder;
 import org.keycloak.testsuite.util.RealmBuilder;
+import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.testsuite.util.UserBuilder;
 import java.util.Objects;
 
@@ -124,7 +128,8 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
                 .id(KeycloakModelUtils.generateId())
                 .username("test-user@localhost")
                 .password("password")
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN);
+                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN)
+                .addRoles(OAuth2Constants.OFFLINE_ACCESS);
         realm.user(defaultUser);
 
         testRealms.add(realm.build());
@@ -177,6 +182,19 @@ public void clientCredentialsClientDisabled() throws Exception {
         }
     }
 
+    @Test
+    public void adminAuthCloseUserSession() throws Exception {
+        UserResource user = ApiUtil.findUserByUsernameId(adminClient.realm(realmName), "test-user@localhost");
+        try (Keycloak keycloak = AdminClientUtil.createAdminClient(false, realmName, "test-user@localhost", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
+            // Check possible to load the realm
+            RealmRepresentation realm = keycloak.realm(realmName).toRepresentation();
+            Assert.assertEquals(realmName, realm.getRealm());
+
+            Assert.assertEquals(1, user.getUserSessions().size());
+        }
+        Assert.assertEquals(0, user.getUserSessions().size());
+    }
+
     @Test
     public void adminAuthClientDisabled() throws Exception {
         try (Keycloak adminClient = AdminClientUtil.createAdminClient(false, realmName, "test-user@localhost", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
@@ -199,6 +217,38 @@ public void adminAuthClientDisabled() throws Exception {
         }
     }
 
+    @Test
+    public void adminAuthUserDisabled() throws Exception {
+        try (Keycloak adminClient = AdminClientUtil.createAdminClient(false, realmName, "test-user@localhost", "password", Constants.ADMIN_CLI_CLIENT_ID, null);
+             Keycloak adminClientOffline = AdminClientUtil.createAdminClient(false, ServerURLs.getAuthServerContextRoot(), realmName, "test-user@localhost", "password", Constants.ADMIN_CLI_CLIENT_ID, null, OAuth2Constants.OFFLINE_ACCESS);
+        ) {
+            // Check possible to load the realm
+            RealmRepresentation realm = adminClient.realm(realmName).toRepresentation();
+            Assert.assertEquals(realmName, realm.getRealm());
+            realm = adminClientOffline.realm(realmName).toRepresentation();
+            Assert.assertEquals(realmName, realm.getRealm());
+
+            // Disable client and check it should not be possible to load the realms anymore
+            setUserEnabled("test-user@localhost", false);
+
+            // Check not possible to invoke anymore
+            try {
+                realm = adminClient.realm(realmName).toRepresentation();
+                Assert.fail("Not expected to successfully get realm");
+            } catch (NotAuthorizedException nae) {
+                // Expected
+            }
+            try {
+                realm = adminClientOffline.realm(realmName).toRepresentation();
+                Assert.fail("Not expected to successfully get realm");
+            } catch (NotAuthorizedException nae) {
+                // Expected
+            }
+        } finally {
+            setUserEnabled("test-user@localhost", true);
+        }
+    }
+
     @Test
     public void scopedClientCredentialsAuthSuccess() throws Exception {
         final RealmResource testRealm = adminClient.realm(realmName);
@@ -257,6 +307,13 @@ private void setClientEnabled(String clientId, boolean enabled) {
         client.update(clientRep);
     }
 
+    private void setUserEnabled(String username, boolean enabled) {
+        UserResource user = ApiUtil.findUserByUsernameId(adminClient.realms().realm(realmName), username);
+        UserRepresentation userRep = user.toRepresentation();
+        userRep.setEnabled(enabled);
+        user.update(userRep);
+    }
+
     private String createScope(RealmResource testRealm, String scopeName, String scopeId) {
         final ClientScopeRepresentation testScope =
             ClientScopeBuilder.create().name(scopeName).protocol("openid-connect").build();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminConsoleWhoAmILocaleTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminConsoleWhoAmILocaleTest.java
deleted file mode 100644
index e086efb1c416..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AdminConsoleWhoAmILocaleTest.java
+++ /dev/null
@@ -1,310 +0,0 @@
-package org.keycloak.testsuite.admin;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import jakarta.ws.rs.core.Response;
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.List;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.jboss.arquillian.graphene.page.Page;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.broker.provider.util.SimpleHttp;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.Constants;
-import org.keycloak.protocol.oidc.utils.PkceUtils;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.auth.page.AuthRealm;
-import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
-import org.keycloak.testsuite.console.page.AdminConsole;
-import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
-import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import static org.keycloak.models.Constants.ADMIN_CLI_CLIENT_ID;
-
-public class AdminConsoleWhoAmILocaleTest extends AbstractKeycloakTest {
-
-    private static final String REALM_I18N_OFF = "realm-i18n-off";
-    private static final String REALM_I18N_ON = "realm-i18n-on";
-    private static final String USER_WITHOUT_LOCALE = "user-without-locale";
-    private static final String USER_WITH_LOCALE = "user-with-locale";
-    private static final String USER_NO_ACCESS = "user-no-access";
-    private static final String PASSWORD = "password";
-    private static final String DEFAULT_LOCALE = "en";
-    private static final String REALM_LOCALE = "no";
-    private static final String USER_LOCALE = "de";
-    private static final String EXTRA_LOCALE = "zh-CN";
-
-    private CloseableHttpClient client;
-
-    @Page
-    private AdminConsole adminConsole;
-
-    @Before
-    public void createHttpClient() throws Exception {
-        client = HttpClientBuilder.create().build();
-
-        getCleanup().addCleanup(ClientAttributeUpdater.forClient(adminClient, "master", ADMIN_CLI_CLIENT_ID).setAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true").update());
-        getCleanup().addCleanup(ClientAttributeUpdater.forClient(adminClient, REALM_I18N_OFF, ADMIN_CLI_CLIENT_ID).setAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true").update());
-        getCleanup().addCleanup(ClientAttributeUpdater.forClient(adminClient, REALM_I18N_ON, ADMIN_CLI_CLIENT_ID).setAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, "true").update());
-    }
-
-    @After
-    public void closeHttpClient() {
-        try {
-            client.close();
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmBuilder realm = RealmBuilder.create()
-            .name(REALM_I18N_OFF)
-            .internationalizationEnabled(false);
-        realm.user(UserBuilder.create()
-            .username(USER_WITHOUT_LOCALE)
-            .password(PASSWORD)
-            .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-        realm.user(UserBuilder.create()
-            .username(USER_WITH_LOCALE)
-            .password(PASSWORD)
-            .addAttribute("locale", USER_LOCALE)
-            .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-        testRealms.add(realm.build());
-        
-        realm = RealmBuilder.create()
-            .name(REALM_I18N_ON)
-            .internationalizationEnabled(true)
-            .supportedLocales(new HashSet<>(Arrays.asList(REALM_LOCALE, USER_LOCALE, EXTRA_LOCALE)))
-            .defaultLocale(REALM_LOCALE);
-        realm.user(UserBuilder.create()
-            .username(USER_WITHOUT_LOCALE)
-            .password(PASSWORD)
-            .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-        realm.user(UserBuilder.create()
-            .username(USER_WITH_LOCALE)
-            .password(PASSWORD)
-            .addAttribute("locale", USER_LOCALE)
-            .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-        realm.user(UserBuilder.create()
-            .username(USER_NO_ACCESS)
-            .password(PASSWORD)
-            .addAttribute("locale", USER_LOCALE));
-        testRealms.add(realm.build());
-    }
-
-    private OAuthClient.AccessTokenResponse accessToken(String realmName, String username, String password) throws Exception {
-        return oauth.doGrantAccessTokenRequest(realmName, username, password, null, ADMIN_CLI_CLIENT_ID, null);
-    }
-
-    private String whoAmiUrl(String realmName) {
-        return whoAmiUrl(realmName, null);
-    }
-
-    private String whoAmiUrl(String realmName, String currentRealm) {
-        StringBuilder sb = new StringBuilder()
-                .append(suiteContext.getAuthServerInfo().getContextRoot().toString())
-                .append("/auth/admin/")
-                .append(realmName)
-                .append("/console/whoami");
-        if (currentRealm != null) {
-             sb.append("?currentRealm=").append(currentRealm);
-        }
-        return sb.toString();
-    }
-
-    private void checkRealmAccess(String realm, JsonNode whoAmI) {
-        Assert.assertNotNull(whoAmI.get("realm_access"));
-        Assert.assertNotNull(whoAmI.get("realm_access").get(realm));
-        Assert.assertTrue(whoAmI.get("realm_access").get(realm).isArray());
-        Assert.assertTrue(whoAmI.get("realm_access").get(realm).size() > 0);
-    }
-
-    @Test
-    public void testLocaleRealmI18nDisabledUserWithoutLocale() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(REALM_I18N_OFF, USER_WITHOUT_LOCALE, PASSWORD, null, ADMIN_CLI_CLIENT_ID, null);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_OFF), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(REALM_I18N_OFF, whoAmI.get("realm").asText());
-        Assert.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_OFF, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmI18nDisabledUserWithLocale() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_OFF, USER_WITH_LOCALE, PASSWORD);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_OFF), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(REALM_I18N_OFF, whoAmI.get("realm").asText());
-        Assert.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_OFF, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmI18nEnabledUserWithoutLocale() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_ON, USER_WITHOUT_LOCALE, PASSWORD);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_ON), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
-        Assert.assertEquals(REALM_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_ON, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmI18nEnabledUserWithLocale() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_ON, USER_WITH_LOCALE, PASSWORD);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_ON), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
-        Assert.assertEquals(USER_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_ON, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmI18nEnabledAcceptLanguageHeader() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_ON, USER_WITHOUT_LOCALE, PASSWORD);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_ON), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .header("Accept-Language", EXTRA_LOCALE)
-            .asJson();
-        Assert.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
-        Assert.assertEquals(EXTRA_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_ON, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmI18nEnabledKeycloakLocaleCookie() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_ON, USER_WITHOUT_LOCALE, PASSWORD);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(REALM_I18N_ON), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .header("Cookie", "KEYCLOAK_LOCALE=" + EXTRA_LOCALE)
-            .asJson();
-        Assert.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
-        Assert.assertEquals(EXTRA_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_ON, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testMasterRealm() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(AuthRealm.MASTER, AuthRealm.ADMIN, AuthRealm.ADMIN);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(AuthRealm.MASTER), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(AuthRealm.MASTER, whoAmI.get("realm").asText());
-        Assert.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(AuthRealm.MASTER, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testMasterRealmCurrentRealm() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(AuthRealm.MASTER, AuthRealm.ADMIN, AuthRealm.ADMIN);
-        JsonNode whoAmI = SimpleHttpDefault
-            .doGet(whoAmiUrl(AuthRealm.MASTER, REALM_I18N_ON), client)
-            .header("Accept", "application/json")
-            .auth(response.getAccessToken())
-            .asJson();
-        Assert.assertEquals(AuthRealm.MASTER, whoAmI.get("realm").asText());
-        Assert.assertEquals(DEFAULT_LOCALE, whoAmI.get("locale").asText());
-        checkRealmAccess(REALM_I18N_ON, whoAmI);
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmNoToken() throws Exception {
-        try (SimpleHttp.Response response = SimpleHttpDefault
-                .doGet(whoAmiUrl(REALM_I18N_ON), client)
-                .header("Accept", "application/json")
-                .asResponse()) {
-            Assert.assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatus());
-        }
-    }
-
-    @Test
-    public void testLocaleRealmUserNoAccess() throws Exception {
-        OAuthClient.AccessTokenResponse response = accessToken(REALM_I18N_ON, USER_NO_ACCESS, PASSWORD);
-        try (SimpleHttp.Response res = SimpleHttpDefault
-                .doGet(whoAmiUrl(REALM_I18N_ON), client)
-                .header("Accept", "application/json")
-                .auth(response.getAccessToken())
-                .asResponse()) {
-            Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus());
-        }
-        oauth.doLogout(response.getRefreshToken(), null);
-    }
-
-    @Test
-    public void testLocaleRealmTokenForOtherClient() throws Exception {
-        try (var c = ClientAttributeUpdater.forClient(adminClient, REALM_I18N_ON, ADMIN_CLI_CLIENT_ID).setAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, null).update();
-          Keycloak adminCliClient = AdminClientUtil.createAdminClient(true, REALM_I18N_ON,
-                USER_WITH_LOCALE, PASSWORD, Constants.ADMIN_CLI_CLIENT_ID, null)) {
-            AccessTokenResponse accessToken = adminCliClient.tokenManager().getAccessToken();
-            Assert.assertNotNull(accessToken);
-            String token = accessToken.getToken();
-            try (SimpleHttp.Response response = SimpleHttpDefault
-                    .doGet(whoAmiUrl(REALM_I18N_ON), client)
-                    .header("Accept", "application/json")
-                    .auth(token)
-                    .asResponse()) {
-                Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
-            }
-        }
-    }
-
-    @Test
-    public void testLocaleRealmTokenForOtherClientButAllowed() throws Exception {
-        try (ClientAttributeUpdater updater = ClientAttributeUpdater.forClient(adminClient, REALM_I18N_ON, Constants.ADMIN_CLI_CLIENT_ID)
-                .setAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR, Boolean.TRUE.toString())
-                .update();
-                Keycloak adminCliClient = AdminClientUtil.createAdminClient(true, REALM_I18N_ON,
-                USER_WITH_LOCALE, PASSWORD, Constants.ADMIN_CLI_CLIENT_ID, null)) {
-            AccessTokenResponse accessToken = adminCliClient.tokenManager().getAccessToken();
-            Assert.assertNotNull(accessToken);
-            String token = accessToken.getToken();
-            JsonNode whoAmI = SimpleHttpDefault
-                    .doGet(whoAmiUrl(REALM_I18N_ON), client)
-                    .header("Accept", "application/json")
-                    .auth(token)
-                    .asJson();
-            Assert.assertEquals(REALM_I18N_ON, whoAmI.get("realm").asText());
-            Assert.assertEquals(USER_LOCALE, whoAmI.get("locale").asText());
-            checkRealmAccess(REALM_I18N_ON, whoAmI);
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AttackDetectionResourceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AttackDetectionResourceTest.java
deleted file mode 100644
index 1a2ae6211252..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AttackDetectionResourceTest.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.jboss.arquillian.test.api.ArquillianResource;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.AttackDetectionResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-/**
- *
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class AttackDetectionResourceTest extends AbstractAdminTest {
-
-    @ArquillianResource
-    private OAuthClient oauthClient;
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        testRealm.setBruteForceProtected(true);
-        testRealm.setFailureFactor(2);
-
-        testRealm.getUsers().add(UserBuilder.create().username("test-user2").password("password").build());
-    }
-
-    @Test
-    public void test() {
-        AttackDetectionResource detection = adminClient.realm(TEST).attackDetection();
-        String realmId = adminClient.realm(TEST).toRepresentation().getId();
-
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user@localhost").getId()), 0, 0, false, false);
-
-        oauthClient.doLogin("test-user@localhost", "invalid");
-        oauthClient.doLogin("test-user@localhost", "invalid");
-        oauthClient.doLogin("test-user@localhost", "invalid");
-
-        oauthClient.doLogin("test-user2", "invalid");
-        oauthClient.doLogin("test-user2", "invalid");
-        oauthClient.doLogin("nosuchuser", "invalid");
-
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user@localhost").getId()), 2, 1, true, true);
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user2").getId()), 2, 1, true, true);
-        assertBruteForce(detection.bruteForceUserStatus("nosuchuser"), 0, 0, false, false);
-
-        detection.clearBruteForceForUser(findUser("test-user@localhost").getId());
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.attackDetectionClearBruteForceForUserPath(findUser("test-user@localhost").getId()), ResourceType.USER_LOGIN_FAILURE);
-
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user@localhost").getId()), 0, 0, false, false);
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user2").getId()), 2, 1, true, true);
-
-        detection.clearAllBruteForce();
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.attackDetectionClearAllBruteForcePath(), ResourceType.USER_LOGIN_FAILURE);
-
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user@localhost").getId()), 0, 0, false, false);
-        assertBruteForce(detection.bruteForceUserStatus(findUser("test-user2").getId()), 0, 0, false, false);
-    }
-
-    private void assertBruteForce(Map<String, Object> status, Integer expectedNumFailures, Integer expectedNumTemporaryLockouts, Boolean expectedFailure, Boolean expectedDisabled) {
-        assertEquals(6, status.size());
-        assertEquals(expectedNumFailures, status.get("numFailures"));
-        assertEquals(expectedNumTemporaryLockouts, status.get("numTemporaryLockouts"));
-        assertEquals(expectedDisabled, status.get("disabled"));
-        if (expectedFailure) {
-            assertEquals("127.0.0.1", status.get("lastIPFailure"));
-            Long lastFailure = (Long) status.get("lastFailure");
-            assertTrue(lastFailure < (System.currentTimeMillis() + 1) && lastFailure > (System.currentTimeMillis() - 10000));
-            assertNotEquals("0", status.get("failedLoginNotBefore").toString());
-        } else {
-            assertEquals("n/a", status.get("lastIPFailure"));
-            assertEquals("0", status.get("lastFailure").toString());
-            assertEquals("0", status.get("failedLoginNotBefore").toString());
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AuthzCleanupTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AuthzCleanupTest.java
deleted file mode 100644
index f5ec35daeffc..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/AuthzCleanupTest.java
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.admin;
-
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientsResource;
-import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.authorization.DecisionStrategy;
-import org.keycloak.representations.idm.authorization.Logic;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.util.JsonSerialization;
-
-import java.util.List;
-
-import static org.keycloak.common.Profile.Feature.AUTHORIZATION;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class AuthzCleanupTest extends AbstractKeycloakTest {
-
-    @BeforeClass
-    public static void enabled() {
-        ProfileAssume.assumeFeatureEnabled(AUTHORIZATION);
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        testRealms.add(RealmBuilder.create().name(TEST)
-                .client(ClientBuilder.create().clientId("myclient")
-                        .secret("secret")
-                        .authorizationServicesEnabled(true)
-                        .redirectUris("http://localhost/myclient")
-                        .defaultRoles(
-                                "client-role-1",
-                                "client-role-2",
-                                "Acme administrator",
-                                "Acme viewer",
-                                "tenant administrator",
-                                "tenant viewer",
-                                "tenant user"
-                                )
-                            .build())
-                .build());
-    }
-
-    public static void setup(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        session.getContext().setRealm(realm);
-        AuthorizationProvider authz = session.getProvider(AuthorizationProvider.class);
-        ClientModel myclient = realm.getClientByClientId("myclient");
-        ResourceServer resourceServer = authz.getStoreFactory().getResourceServerStore().findByClient(myclient);
-        createRolePolicy(authz, resourceServer, myclient.getClientId() + "/client-role-1");
-        createRolePolicy(authz, resourceServer, myclient.getClientId() + "/client-role-2");
-    }
-
-    private static Policy createRolePolicy(AuthorizationProvider authz, ResourceServer resourceServer, String roleName) {
-        RolePolicyRepresentation representation = new RolePolicyRepresentation();
-
-        representation.setName(roleName);
-        representation.setType("role");
-        representation.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
-        representation.setLogic(Logic.POSITIVE);
-        representation.addRole(roleName, true);
-
-        return authz.getStoreFactory().getPolicyStore().create(resourceServer, representation);
-    }
-
-
-    @Test
-    public void testCreate() throws Exception {
-        ClientsResource clients = getAdminClient().realms().realm(TEST).clients();
-        ClientRepresentation client = clients.findByClientId("myclient").get(0);
-        ResourceServerRepresentation settings = JsonSerialization.readValue(getClass().getResourceAsStream("/authorization-test/acme-resource-server-cleanup-test.json"), ResourceServerRepresentation.class);
-
-        clients.get(client.getId()).authorization().importSettings(settings);
-
-        testingClient.server().run(AuthzCleanupTest::setup);
-    }
-
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java
deleted file mode 100644
index 0d562567df0a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java
+++ /dev/null
@@ -1,1027 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import static java.util.Arrays.asList;
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.Matchers.allOf;
-import static org.hamcrest.Matchers.containsInAnyOrder;
-import static org.hamcrest.Matchers.greaterThan;
-import static org.hamcrest.Matchers.hasItem;
-import static org.hamcrest.Matchers.lessThan;
-import static org.hamcrest.Matchers.not;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertThrows;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import static org.keycloak.models.Constants.defaultClients;
-
-import org.hamcrest.MatcherAssert;
-import org.hamcrest.Matchers;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ProtocolMappersResource;
-import org.keycloak.admin.client.resource.RoleMappingResource;
-import org.keycloak.common.util.Time;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.AccountRoles;
-import org.keycloak.models.Constants;
-import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
-import org.keycloak.protocol.oidc.OIDCConfigAttributes;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
-import org.keycloak.protocol.saml.SamlProtocol;
-import org.keycloak.representations.adapters.action.GlobalRequestResult;
-import org.keycloak.representations.adapters.action.PushNotBeforeAction;
-import org.keycloak.representations.adapters.action.TestAvailabilityAction;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.UserSessionRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.CredentialBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
-import org.keycloak.testsuite.util.RoleBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class ClientTest extends AbstractAdminTest {
-
-    @Test
-    public void getClients() {
-        Assert.assertNames(realm.clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", Constants.ADMIN_CLI_CLIENT_ID);
-    }
-
-    @Test
-    public void getRealmClients() {
-        assertTrue(realm.clients().findAll().stream().filter(client-> client.getAttributes().get(Constants.REALM_CLIENT).equals("true"))
-                .map(ClientRepresentation::getClientId)
-                .allMatch(clientId -> clientId.equals(Constants.REALM_MANAGEMENT_CLIENT_ID) || clientId.equals(Constants.BROKER_SERVICE_CLIENT_ID) || clientId.endsWith("-realm")));
-    }
-
-    private ClientRepresentation createClient() {
-        return createClient(null);
-    }
-
-    private ClientRepresentation createClient(String protocol) {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setClientId("my-app");
-        rep.setDescription("my-app description");
-        rep.setEnabled(true);
-        rep.setPublicClient(true);
-        if (protocol != null) {
-            rep.setProtocol(protocol);
-        }
-        Response response = realm.clients().create(rep);
-        response.close();
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-        ClientRepresentation found = ApiUtil.findClientResourceByClientId(realm, "my-app").toRepresentation();
-
-        assertEquals("my-app", found.getClientId());
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientResourcePath(id), rep, ResourceType.CLIENT);
-
-        rep.setId(id);
-
-        return rep;
-    }
-
-    private ClientRepresentation createClientNonPublic() {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setClientId("my-app");
-        rep.setDescription("my-app description");
-        rep.setEnabled(true);
-        rep.setPublicClient(false);
-        Response response = realm.clients().create(rep);
-        response.close();
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-        ClientRepresentation found = ApiUtil.findClientResourceByClientId(realm, "my-app").toRepresentation();
-
-        assertEquals("my-app", found.getClientId());
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientResourcePath(id), rep, ResourceType.CLIENT);
-
-        rep.setId(id);
-
-        return rep;
-    }
-
-    @Test
-    public void createClientVerifyWithSecret() {
-        String id = createClientNonPublic().getId();
-
-        ClientResource client = realm.clients().get(id);
-        assertNotNull(client);
-        assertNotNull(client.toRepresentation().getSecret());
-        Assert.assertNames(realm.clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "my-app", Constants.ADMIN_CLI_CLIENT_ID);
-    }
-
-    @Test
-    public void createClientVerify() {
-        String id = createClient().getId();
-
-        ClientResource client = realm.clients().get(id);
-        assertNotNull(client);
-        assertNull(client.toRepresentation().getSecret());
-        Assert.assertNames(realm.clients().findAll(), "account", "account-console", "realm-management", "security-admin-console", "broker", "my-app", Constants.ADMIN_CLI_CLIENT_ID);
-    }
-
-    @Test
-    public void testInvalidLengthClientIdValidation() {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setId("test-long-invalid-client-id-validation-400-bad-request");
-        rep.setClientId("invalid-client-id-app");
-        rep.setDescription("invalid-client-id-app description");
-        rep.setEnabled(true);
-        rep.setPublicClient(true);
-        try (Response response = realm.clients().create(rep)) {
-            if (response.getStatus() != 400) {
-                response.bufferEntity();
-                String body = response.readEntity(String.class);
-                fail("expect 400 Bad request response code but receive: " + response.getStatus() + "\n" + body);
-            }
-        }
-    }
-
-    @Test
-    public void testInvalidUrlClientValidation() {
-        testClientUriValidation("Root URL is not a valid URL",
-                "Base URL is not a valid URL",
-                "Backchannel logout URL is not a valid URL",
-                null,
-                "invalid", "myapp://some-fake-app");
-    }
-
-    @Test
-    public void testIllegalSchemeClientValidation() {
-        testClientUriValidation("Root URL uses an illegal scheme",
-                "Base URL uses an illegal scheme",
-                "Backchannel logout URL uses an illegal scheme",
-                "A redirect URI uses an illegal scheme",
-                "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+",
-                "javascript:confirm(document.domain)/*"
-        );
-    }
-
-    // KEYCLOAK-3421
-    @Test
-    public void testFragmentProhibitedClientValidation() {
-        testClientUriValidation("Root URL must not contain an URL fragment",
-                null,
-                null,
-                "Redirect URIs must not contain an URI fragment",
-                "http://redhat.com/abcd#someFragment"
-        );
-    }
-
-    @Test
-    public void testSamlSpecificUrls() {
-        testSamlSpecificUrls(true, "javascript:alert('TEST')", "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+");
-        testSamlSpecificUrls(false, "javascript:alert('TEST')", "data:text/html;base64,PHNjcmlwdD5jb25maXJtKGRvY3VtZW50LmRvbWFpbik7PC9zY3JpcHQ+");
-    }
-
-    private void testSamlSpecificUrls(boolean create, String... testUrls) {
-        ClientRepresentation rep;
-        if (create) {
-            rep = new ClientRepresentation();
-            rep.setClientId("my-app2");
-            rep.setEnabled(true);
-            rep.setProtocol(SamlProtocol.LOGIN_PROTOCOL);
-        }
-        else {
-            rep = createClient(SamlProtocol.LOGIN_PROTOCOL);
-        }
-        rep.setAttributes(new HashMap<>());
-
-        Map<String, String> attrs = Map.of(
-                    SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "Assertion Consumer Service POST Binding URL",
-                    SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "Assertion Consumer Service Redirect Binding URL",
-                    SamlProtocol.SAML_ASSERTION_CONSUMER_URL_ARTIFACT_ATTRIBUTE, "Artifact Binding URL",
-                    SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "Logout Service POST Binding URL",
-                    SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE, "Logout Service ARTIFACT Binding URL",
-                    SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "Logout Service Redirect Binding URL",
-                    SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_SOAP_ATTRIBUTE, "Logout Service SOAP Binding URL",
-                    SamlProtocol.SAML_ARTIFACT_RESOLUTION_SERVICE_URL_ATTRIBUTE, "Artifact Resolution Service");
-
-        for (String testUrl : testUrls) {
-            // admin url
-            rep.setAdminUrl(testUrl);
-            createOrUpdateClientExpectingValidationErrors(rep, create, "Master SAML Processing URL uses an illegal scheme");
-            rep.setAdminUrl(null);
-            // attributes
-            for (Map.Entry<String, String> entry : attrs.entrySet()) {
-                rep.getAttributes().put(entry.getKey(), testUrl);
-                createOrUpdateClientExpectingValidationErrors(rep, create, entry.getValue() + " uses an illegal scheme");
-                rep.getAttributes().remove(entry.getKey());
-            }
-        }
-    }
-
-    private void testClientUriValidation(String expectedRootUrlError, String expectedBaseUrlError, String expectedBackchannelLogoutUrlError, String expectedRedirectUrisError, String... testUrls) {
-        testClientUriValidation(false, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
-        testClientUriValidation(true, expectedRootUrlError, expectedBaseUrlError, expectedBackchannelLogoutUrlError, expectedRedirectUrisError, testUrls);
-    }
-
-    private void testClientUriValidation(boolean create, String expectedRootUrlError, String expectedBaseUrlError, String expectedBackchannelLogoutUrlError, String expectedRedirectUrisError, String... testUrls) {
-        ClientRepresentation rep;
-        if (create) {
-            rep = new ClientRepresentation();
-            rep.setClientId("my-app2");
-            rep.setEnabled(true);
-        }
-        else {
-            rep = createClient();
-        }
-
-        for (String testUrl : testUrls) {
-            if (expectedRootUrlError != null) {
-                rep.setRootUrl(testUrl);
-                createOrUpdateClientExpectingValidationErrors(rep, create, expectedRootUrlError);
-            }
-            rep.setRootUrl(null);
-
-            if (expectedBaseUrlError != null) {
-                rep.setBaseUrl(testUrl);
-                createOrUpdateClientExpectingValidationErrors(rep, create, expectedBaseUrlError);
-            }
-            rep.setBaseUrl(null);
-
-            if (expectedBackchannelLogoutUrlError != null) {
-                OIDCAdvancedConfigWrapper.fromClientRepresentation(rep).setBackchannelLogoutUrl(testUrl);
-                createOrUpdateClientExpectingValidationErrors(rep, create, expectedBackchannelLogoutUrlError);
-            }
-            OIDCAdvancedConfigWrapper.fromClientRepresentation(rep).setBackchannelLogoutUrl(null);
-
-            if (expectedRedirectUrisError != null) {
-                rep.setRedirectUris(Collections.singletonList(testUrl));
-                createOrUpdateClientExpectingValidationErrors(rep, create, expectedRedirectUrisError);
-            }
-            rep.setRedirectUris(null);
-
-            if (expectedRootUrlError != null) rep.setRootUrl(testUrl);
-            if (expectedBaseUrlError != null) rep.setBaseUrl(testUrl);
-            if (expectedRedirectUrisError != null) rep.setRedirectUris(Collections.singletonList(testUrl));
-            createOrUpdateClientExpectingValidationErrors(rep, create, expectedRootUrlError, expectedBaseUrlError, expectedRedirectUrisError);
-
-            rep.setRootUrl(null);
-            rep.setBaseUrl(null);
-            rep.setRedirectUris(null);
-        }
-    }
-
-    private void createOrUpdateClientExpectingValidationErrors(ClientRepresentation rep, boolean create, String... expectedErrors) {
-        Response response = null;
-        if (create) {
-            response = realm.clients().create(rep);
-        }
-        else {
-            try {
-                realm.clients().get(rep.getId()).update(rep);
-                fail("Expected exception");
-            }
-            catch (BadRequestException e) {
-                response = e.getResponse();
-            }
-        }
-
-        expectedErrors = Arrays.stream(expectedErrors).filter(Objects::nonNull).toArray(String[]::new);
-
-        assertEquals(response.getStatus(), 400);
-        OAuth2ErrorRepresentation errorRep = response.readEntity(OAuth2ErrorRepresentation.class);
-        List<String> actualErrors = asList(errorRep.getErrorDescription().split("; "));
-        assertThat(actualErrors, containsInAnyOrder(expectedErrors));
-        assertEquals("invalid_input", errorRep.getError());
-    }
-
-    @Test
-    public void removeClient() {
-        String id = createClient().getId();
-
-        assertNotNull(ApiUtil.findClientByClientId(realm, "my-app"));
-        realm.clients().get(id).remove();
-        assertNull(ApiUtil.findClientResourceByClientId(realm, "my-app"));
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientResourcePath(id), ResourceType.CLIENT);
-    }
-
-    @Test
-    public void removeInternalClientExpectingBadRequestException() {
-        final String testRealmClientId = ApiUtil.findClientByClientId(realmsResouce().realm("master"), "test-realm")
-                .toRepresentation().getId();
-
-        assertThrows(BadRequestException.class,
-                () -> realmsResouce().realm("master").clients().get(testRealmClientId).remove());
-
-        defaultClients.forEach(defaultClient -> {
-            final String defaultClientId = ApiUtil.findClientByClientId(realm, defaultClient)
-                    .toRepresentation().getId();
-
-            assertThrows(BadRequestException.class,
-                    () -> realm.clients().get(defaultClientId).remove());
-        });
-    }
-
-    @Test
-    public void getClientRepresentation() {
-        String id = createClient().getId();
-
-        ClientRepresentation rep = realm.clients().get(id).toRepresentation();
-        assertEquals(id, rep.getId());
-        assertEquals("my-app", rep.getClientId());
-        assertTrue(rep.isEnabled());
-    }
-
-    /**
-     * See <a href="https://issues.jboss.org/browse/KEYCLOAK-1918">KEYCLOAK-1918</a>
-     */
-    @Test
-    public void getClientDescription() {
-        String id = createClient().getId();
-
-        ClientRepresentation rep = realm.clients().get(id).toRepresentation();
-        assertEquals(id, rep.getId());
-        assertEquals("my-app description", rep.getDescription());
-    }
-
-    @Test
-    public void getClientSessions() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
-        assertEquals(200, response.getStatusCode());
-
-        OAuthClient.AuthorizationEndpointResponse codeResponse = oauth.doLogin("test-user@localhost", "password");
-
-        OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(codeResponse.getCode(), "password");
-        assertEquals(200, response2.getStatusCode());
-
-        ClientResource app = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
-
-        assertEquals(2, (long) app.getApplicationSessionCount().get("count"));
-
-        List<UserSessionRepresentation> userSessions = app.getUserSessions(0, 100);
-        assertEquals(2, userSessions.size());
-        assertEquals(1, userSessions.get(0).getClients().size());
-    }
-
-    @Test
-    public void getAllClients() {
-        List<ClientRepresentation> allClients = realm.clients().findAll();
-        assertNotNull(allClients);
-        assertFalse(allClients.isEmpty());
-    }
-
-    @Test
-    public void getAllClientsSearchAndPagination() {
-        Set<String> ids = new HashSet<>();
-        try {
-            for (int i = 1; i <= 10; i++) {
-                ClientRepresentation c = ClientBuilder.create().clientId("ccx-" + (i < 10 ? "0" + i : i)).build();
-                Response response = realm.clients().create(c);
-                ids.add(ApiUtil.getCreatedId(response));
-                response.close();
-            }
-
-            assertPaginatedClients(1, 10, realm.clients().findAll("ccx-", null, true, 0, 100));
-            assertPaginatedClients(1, 5, realm.clients().findAll("ccx-", null, true, 0, 5));
-            assertPaginatedClients(6, 10, realm.clients().findAll("ccx-", null, true, 5, 5));
-        } finally {
-            ids.stream().forEach(id -> realm.clients().get(id).remove());
-        }
-    }
-
-    private void assertPaginatedClients(int start, int end, List<ClientRepresentation> actual) {
-        List<String> expected = new LinkedList<>();
-        for (int i = start; i <= end; i++) {
-            expected.add("ccx-" + (i < 10 ? "0" + i : i));
-        }
-        List<String> a = actual.stream().map(rep -> rep.getClientId()).collect(Collectors.toList());
-        assertThat(a, is(expected));
-
-    }
-
-    @Test
-    public void getClientById() {
-        createClient();
-        ClientRepresentation rep = ApiUtil.findClientResourceByClientId(realm, "my-app").toRepresentation();
-        ClientRepresentation gotById = realm.clients().get(rep.getId()).toRepresentation();
-        assertClient(rep, gotById);
-    }
-
-    @Test
-    // KEYCLOAK-1110
-    public void deleteDefaultRole() {
-        ClientRepresentation rep = createClient();
-        String id = rep.getId();
-
-        RoleRepresentation role = new RoleRepresentation("test", "test", false);
-        realm.clients().get(id).roles().create(role);
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(id, "test"), role, ResourceType.CLIENT_ROLE);
-
-        role = realm.clients().get(id).roles().get("test").toRepresentation();
-
-        realm.roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME).addComposites(Collections.singletonList(role));
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleResourceCompositesPath(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME), Collections.singletonList(role), ResourceType.REALM_ROLE);
-
-        assertThat(realm.roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME).getRoleComposites().stream().map(RoleRepresentation::getName).collect(Collectors.toSet()),
-                hasItem(role.getName()));
-
-        realm.clients().get(id).roles().deleteRole("test");
-
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(id, "test"), ResourceType.CLIENT_ROLE);
-
-        assertThat(realm.roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME).getRoleComposites().stream().map(RoleRepresentation::getName).collect(Collectors.toSet()),
-                not(hasItem(role)));
-    }
-
-    @Test
-    public void testProtocolMappers() {
-        String clientDbId = createClient().getId();
-        ProtocolMappersResource mappersResource = ApiUtil.findClientByClientId(realm, "my-app").getProtocolMappers();
-
-        protocolMappersTest(clientDbId, mappersResource);
-    }
-
-    @Test
-    public void updateClient() {
-        ClientRepresentation client = createClient();
-
-        ClientRepresentation newClient = new ClientRepresentation();
-        newClient.setId(client.getId());
-        newClient.setClientId(client.getClientId());
-        newClient.setBaseUrl("http://baseurl");
-
-        ClientResource clientRes = realm.clients().get(client.getId());
-        clientRes.update(newClient);
-
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.clientResourcePath(client.getId()), newClient, ResourceType.CLIENT);
-
-        ClientRepresentation storedClient = clientRes.toRepresentation();
-
-        assertNull(storedClient.getSecret());
-        assertNull(clientRes.getSecret().getValue());
-        assertClient(client, storedClient);
-
-        client.setPublicClient(false);
-        newClient.setPublicClient(client.isPublicClient());
-        client.setSecret("new-secret");
-        newClient.setSecret(client.getSecret());
-
-        clientRes.update(newClient);
-
-        newClient.setSecret("**********"); // secrets are masked in events
-
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.clientResourcePath(client.getId()), newClient, ResourceType.CLIENT);
-
-        storedClient = clientRes.toRepresentation();
-        assertClient(client, storedClient);
-
-        storedClient.setSecret(null);
-        storedClient.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
-
-        clientRes.update(storedClient);
-        storedClient = clientRes.toRepresentation();
-
-        assertFalse(storedClient.getAttributes().containsKey(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL));
-        assertClient(client, storedClient);
-    }
-
-    @Test
-    public void serviceAccount() {
-        Response response = realm.clients().create(ClientBuilder.create().clientId("serviceClient").serviceAccount().build());
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-        response.close();
-        UserRepresentation userRep = realm.clients().get(id).getServiceAccountUser();
-        MatcherAssert.assertThat("service-account-serviceclient", Matchers.equalTo(userRep.getUsername()));
-        // KEYCLOAK-11197 service accounts are no longer created with a placeholder e-mail.
-        assertNull(userRep.getEmail());
-    }
-
-    @Test
-    public void pushRevocation() {
-        testingClient.testApp().clearAdminActions();
-
-        ClientRepresentation client = createAppClient();
-        String id = client.getId();
-
-        realm.clients().get(id).pushRevocation();
-
-        PushNotBeforeAction pushNotBefore = testingClient.testApp().getAdminPushNotBefore();
-        assertEquals(client.getNotBefore().intValue(), pushNotBefore.getNotBefore());
-
-        assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.clientPushRevocationPath(id), ResourceType.CLIENT);
-    }
-
-    private ClientRepresentation createAppClient() {
-        String redirectUri = oauth.getRedirectUri().replace("/master/", "/" + REALM_NAME + "/");
-
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId("test-app");
-        client.setAdminUrl(suiteContext.getAuthServerInfo().getContextRoot() + "/auth/realms/master/app/admin");
-        client.setRedirectUris(Collections.singletonList(redirectUri));
-        client.setSecret("secret");
-        client.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-
-        int notBefore = Time.currentTime() - 60;
-        client.setNotBefore(notBefore);
-
-        Response response = realm.clients().create(client);
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-        response.close();
-
-        client.setSecret("**********"); // secrets are masked in events
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientResourcePath(id), client, ResourceType.CLIENT);
-
-        client.setId(id);
-        return client;
-    }
-
-    @Test (expected = BadRequestException.class)
-    public void testAddNodeWithReservedCharacter() {
-        testingClient.testApp().clearAdminActions();
-
-        ClientRepresentation client = createAppClient();
-        String id = client.getId();
-
-        realm.clients().get(id).registerNode(Collections.singletonMap("node", "foo#"));
-    }
-
-    @Test
-    public void nodes() {
-        testingClient.testApp().clearAdminActions();
-
-        ClientRepresentation client = createAppClient();
-        String id = client.getId();
-
-        String myhost = suiteContext.getAuthServerInfo().getContextRoot().getHost();
-        realm.clients().get(id).registerNode(Collections.singletonMap("node", myhost));
-        realm.clients().get(id).registerNode(Collections.singletonMap("node", "invalid"));
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientNodePath(id, myhost), ResourceType.CLUSTER_NODE);
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientNodePath(id, "invalid"), ResourceType.CLUSTER_NODE);
-
-        GlobalRequestResult result = realm.clients().get(id).testNodesAvailable();
-        assertEquals(1, result.getSuccessRequests().size());
-        assertEquals(1, result.getFailedRequests().size());
-
-        assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.clientTestNodesAvailablePath(id), result, ResourceType.CLUSTER_NODE);
-
-        TestAvailabilityAction testAvailable = testingClient.testApp().getTestAvailable();
-        assertEquals("test-app", testAvailable.getResource());
-
-        assertEquals(2, realm.clients().get(id).toRepresentation().getRegisteredNodes().size());
-
-        realm.clients().get(id).unregisterNode("invalid");
-
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientNodePath(id, "invalid"), ResourceType.CLUSTER_NODE);
-
-        assertEquals(1, realm.clients().get(id).toRepresentation().getRegisteredNodes().size());
-    }
-
-    @Test
-    public void offlineUserSessions() throws IOException {
-        ClientRepresentation client = createAppClient();
-        String id = client.getId();
-
-        Response response = realm.users().create(UserBuilder.create().username("testuser").build());
-        String userId = ApiUtil.getCreatedId(response);
-        response.close();
-
-        realm.users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
-
-        Map<String, Long> offlineSessionCount = realm.clients().get(id).getOfflineSessionCount();
-        assertEquals(Long.valueOf(0), offlineSessionCount.get("count"));
-
-        List<UserSessionRepresentation> userSessions = realm.users().get(userId).getOfflineSessions(id);
-        assertEquals("There should be no offline sessions", 0, userSessions.size());
-
-        oauth.realm(REALM_NAME);
-        oauth.redirectUri(client.getRedirectUris().get(0));
-        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.doLogin("testuser", "password");
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get("code"), "secret");
-        assertEquals(200, accessTokenResponse.getStatusCode());
-
-        offlineSessionCount = realm.clients().get(id).getOfflineSessionCount();
-        assertEquals(Long.valueOf(1), offlineSessionCount.get("count"));
-
-        List<UserSessionRepresentation> offlineUserSessions = realm.clients().get(id).getOfflineUserSessions(0, 100);
-        assertEquals(1, offlineUserSessions.size());
-        assertEquals("testuser", offlineUserSessions.get(0).getUsername());
-        org.hamcrest.MatcherAssert.assertThat(offlineUserSessions.get(0).getLastAccess(),
-            allOf(greaterThan(Time.currentTimeMillis() - 10000L), lessThan(Time.currentTimeMillis())));
-
-        userSessions = realm.users().get(userId).getOfflineSessions(id);
-        assertEquals("There should be one offline session", 1, userSessions.size());
-        assertOfflineSession(offlineUserSessions.get(0), userSessions.get(0));
-    }
-
-    private void assertOfflineSession(UserSessionRepresentation expected, UserSessionRepresentation actual) {
-        assertEquals("id", expected.getId(), actual.getId());
-        assertEquals("userId", expected.getUserId(), actual.getUserId());
-        assertEquals("userName", expected.getUsername(), actual.getUsername());
-        assertEquals("clients", expected.getClients(), actual.getClients());
-    }
-
-    @Test
-    public void scopes() {
-        Response response = realm.clients().create(ClientBuilder.create().clientId("client").fullScopeEnabled(false).build());
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-        response.close();
-
-        assertAdminEvents.poll();
-
-        RoleMappingResource scopesResource = realm.clients().get(id).getScopeMappings();
-
-        RoleRepresentation roleRep1 = createRealmRole("realm-composite");
-        RoleRepresentation roleRep2 = createRealmRole("realm-child");
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleResourcePath("realm-composite"), roleRep1, ResourceType.REALM_ROLE);
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleResourcePath("realm-child"), roleRep2, ResourceType.REALM_ROLE);
-
-        roleRep1 = realm.roles().get("realm-composite").toRepresentation();
-        roleRep2 = realm.roles().get("realm-child").toRepresentation();
-
-        realm.roles().get("realm-composite").addComposites(Collections.singletonList(roleRep2));
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleResourceCompositesPath("realm-composite"), Collections.singletonList(roleRep2), ResourceType.REALM_ROLE);
-
-        String accountMgmtId = realm.clients().findByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).get(0).getId();
-        RoleRepresentation viewAccountRoleRep = realm.clients().get(accountMgmtId).roles().get(AccountRoles.VIEW_PROFILE).toRepresentation();
-
-        scopesResource.realmLevel().add(Collections.singletonList(roleRep1));
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientScopeMappingsRealmLevelPath(id), Collections.singletonList(roleRep1), ResourceType.REALM_SCOPE_MAPPING);
-
-        scopesResource.clientLevel(accountMgmtId).add(Collections.singletonList(viewAccountRoleRep));
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientScopeMappingsClientLevelPath(id, accountMgmtId), Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
-
-        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
-        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
-        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
-                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME);
-
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAll(), AccountRoles.VIEW_PROFILE);
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listEffective(), AccountRoles.VIEW_PROFILE);
-
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAvailable(), AccountRoles.MANAGE_ACCOUNT, AccountRoles.MANAGE_ACCOUNT_LINKS, AccountRoles.VIEW_APPLICATIONS, AccountRoles.VIEW_CONSENT, AccountRoles.MANAGE_CONSENT, AccountRoles.DELETE_ACCOUNT, AccountRoles.VIEW_GROUPS);
-
-        Assert.assertNames(scopesResource.getAll().getRealmMappings(), "realm-composite");
-        Assert.assertNames(scopesResource.getAll().getClientMappings().get(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getMappings(), AccountRoles.VIEW_PROFILE);
-
-        scopesResource.realmLevel().remove(Collections.singletonList(roleRep1));
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientScopeMappingsRealmLevelPath(id), Collections.singletonList(roleRep1), ResourceType.REALM_SCOPE_MAPPING);
-
-        scopesResource.clientLevel(accountMgmtId).remove(Collections.singletonList(viewAccountRoleRep));
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientScopeMappingsClientLevelPath(id, accountMgmtId), Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
-
-        Assert.assertNames(scopesResource.realmLevel().listAll());
-        Assert.assertNames(scopesResource.realmLevel().listEffective());
-        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, "realm-composite", "realm-child", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME);
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAll());
-
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listAvailable(), AccountRoles.VIEW_PROFILE, AccountRoles.MANAGE_ACCOUNT, AccountRoles.MANAGE_ACCOUNT_LINKS, AccountRoles.VIEW_APPLICATIONS, AccountRoles.VIEW_CONSENT, AccountRoles.MANAGE_CONSENT, AccountRoles.DELETE_ACCOUNT, AccountRoles.VIEW_GROUPS);
-
-        Assert.assertNames(scopesResource.clientLevel(accountMgmtId).listEffective());
-    }
-
-    /**
-     * Test for KEYCLOAK-10603.
-     */
-    @Test
-    public void rolesCanBeAddedToScopeEvenWhenTheyAreAlreadyIndirectlyAssigned() {
-        Response response =
-                realm.clients().create(ClientBuilder.create().clientId("test-client").fullScopeEnabled(false).build());
-        String testedClientUuid = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(testedClientUuid);
-        response.close();
-
-        createRealmRole("realm-composite");
-        createRealmRole("realm-child");
-        realm.roles().get("realm-composite")
-                .addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-
-        response = realm.clients().create(ClientBuilder.create().clientId("role-container-client").build());
-        String roleContainerClientUuid = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(roleContainerClientUuid);
-        response.close();
-
-        RoleRepresentation clientCompositeRole = RoleBuilder.create().name("client-composite").build();
-        realm.clients().get(roleContainerClientUuid).roles().create(clientCompositeRole);
-        realm.clients().get(roleContainerClientUuid).roles().create(RoleBuilder.create().name("client-child").build());
-        realm.clients().get(roleContainerClientUuid).roles().get("client-composite").addComposites(Collections
-                .singletonList(
-                        realm.clients().get(roleContainerClientUuid).roles().get("client-child").toRepresentation()));
-
-        // Make indirect assignments: assign composite roles
-        RoleMappingResource scopesResource = realm.clients().get(testedClientUuid).getScopeMappings();
-        scopesResource.realmLevel()
-                .add(Collections.singletonList(realm.roles().get("realm-composite").toRepresentation()));
-        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
-                .singletonList(realm.clients().get(roleContainerClientUuid).roles().get("client-composite")
-                        .toRepresentation()));
-
-        // check state before making the direct assignments
-        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
-        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
-                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME);
-        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite");
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable(), "client-child");
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
-                "client-child");
-
-        // Make direct assignments for roles which are already indirectly assigned
-        scopesResource.realmLevel().add(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
-                .singletonList(
-                        realm.clients().get(roleContainerClientUuid).roles().get("client-child").toRepresentation()));
-
-        // List realm roles
-        Assert.assertNames(scopesResource.realmLevel().listAll(), "realm-composite", "realm-child");
-        Assert.assertNames(scopesResource.realmLevel().listAvailable(), "offline_access",
-                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME);
-        Assert.assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-        // List client roles
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite",
-                "client-child");
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable());
-        Assert.assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
-                "client-child");
-    }
-
-    @Test
-    public void scopesRoleRemoval() {
-        // clientA to test scope mappins
-        Response response = realm.clients().create(ClientBuilder.create().clientId("clientA").fullScopeEnabled(false).build());
-        String idA = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(idA);
-        response.close();
-        assertAdminEvents.poll();
-
-        // clientB to create a client role for clientA
-        response = realm.clients().create(ClientBuilder.create().clientId("clientB").fullScopeEnabled(false).build());
-        String idB = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(idB);
-        response.close();
-        assertAdminEvents.poll();
-
-        RoleMappingResource scopesResource = realm.clients().get(idA).getScopeMappings();
-
-        // create a realm role and a role in clientB
-        RoleRepresentation realmRoleRep = createRealmRole("realm-role");
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleResourcePath(realmRoleRep.getName()), realmRoleRep, ResourceType.REALM_ROLE);
-        RoleRepresentation clientBRoleRep = RoleBuilder.create().name("clientB-role").build();
-        realm.clients().get(idB).roles().create(clientBRoleRep);
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(idB, clientBRoleRep.getName()), clientBRoleRep, ResourceType.CLIENT_ROLE);
-
-        // assing to clientA both roles to the scope mappings
-        realmRoleRep = realm.roles().get(realmRoleRep.getName()).toRepresentation();
-        clientBRoleRep = realm.clients().get(idB).roles().get(clientBRoleRep.getName()).toRepresentation();
-        scopesResource.realmLevel().add(Collections.singletonList(realmRoleRep));
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientScopeMappingsRealmLevelPath(idA), Collections.singletonList(realmRoleRep), ResourceType.REALM_SCOPE_MAPPING);
-        scopesResource.clientLevel(idB).add(Collections.singletonList(clientBRoleRep));
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientScopeMappingsClientLevelPath(idA, idB), Collections.singletonList(clientBRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
-
-        // assert the roles are there
-        Assert.assertNames(scopesResource.realmLevel().listAll(), realmRoleRep.getName());
-        Assert.assertNames(scopesResource.clientLevel(idB).listAll(), clientBRoleRep.getName());
-
-        // delete realm role and check everything is refreshed ok
-        realm.roles().deleteRole(realmRoleRep.getName());
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.roleResourcePath(realmRoleRep.getName()), ResourceType.REALM_ROLE);
-        Assert.assertNames(scopesResource.realmLevel().listAll());
-        Assert.assertNames(scopesResource.clientLevel(idB).listAll(), clientBRoleRep.getName());
-
-        // delete client role and check everything is refreshed ok
-        realm.clients().get(idB).roles().deleteRole(clientBRoleRep.getName());
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(idB, clientBRoleRep.getName()), ResourceType.CLIENT_ROLE);
-        Assert.assertNames(scopesResource.realmLevel().listAll());
-        Assert.assertNames(scopesResource.clientLevel(idB).listAll());
-    }
-
-    public void protocolMappersTest(String clientDbId, ProtocolMappersResource mappersResource) {
-        // assert default mappers found
-        List<ProtocolMapperRepresentation> protocolMappers = mappersResource.getMappers();
-
-        String emailMapperId = null;
-        String usernameMapperId = null;
-        String fooMapperId = null;
-        for (ProtocolMapperRepresentation mapper : protocolMappers) {
-            if (mapper.getName().equals(OIDCLoginProtocolFactory.EMAIL)) {
-                emailMapperId = mapper.getId();
-            } else if (mapper.getName().equals(OIDCLoginProtocolFactory.USERNAME)) {
-                usernameMapperId = mapper.getId();
-            } else if (mapper.getName().equals("foo")) {
-                fooMapperId = mapper.getId();
-            }
-        }
-
-        // Builtin mappers are not here
-        assertNull(emailMapperId);
-        assertNull(usernameMapperId);
-
-        assertNull(fooMapperId);
-
-        // Create foo mapper
-        ProtocolMapperRepresentation fooMapper = new ProtocolMapperRepresentation();
-        fooMapper.setName("foo");
-        fooMapper.setProtocol("openid-connect");
-        fooMapper.setProtocolMapper("oidc-hardcoded-claim-mapper");
-        Response response = mappersResource.createMapper(fooMapper);
-        String location = response.getLocation().toString();
-        fooMapperId = location.substring(location.lastIndexOf("/") + 1);
-        response.close();
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), fooMapper, ResourceType.PROTOCOL_MAPPER);
-
-        fooMapper = mappersResource.getMapperById(fooMapperId);
-        assertEquals(fooMapper.getName(), "foo");
-
-        // Update foo mapper
-        mappersResource.update(fooMapperId, fooMapper);
-
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), fooMapper, ResourceType.PROTOCOL_MAPPER);
-
-        fooMapper = mappersResource.getMapperById(fooMapperId);
-
-        // Remove foo mapper
-        mappersResource.delete(fooMapperId);
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(clientDbId, fooMapperId), ResourceType.PROTOCOL_MAPPER);
-        try {
-            mappersResource.getMapperById(fooMapperId);
-            fail("Not expected to find deleted mapper");
-        } catch (NotFoundException nfe) {
-        }
-    }
-
-    @Test
-    public void updateClientWithProtocolMapper() {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setClientId("my-app");
-
-        ProtocolMapperRepresentation fooMapper = new ProtocolMapperRepresentation();
-        fooMapper.setName("foo");
-        fooMapper.setProtocol("openid-connect");
-        fooMapper.setProtocolMapper("oidc-hardcoded-claim-mapper");
-        rep.setProtocolMappers(Collections.singletonList(fooMapper));
-
-        Response response = realm.clients().create(rep);
-        response.close();
-        String id = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(id);
-
-        ClientResource clientResource = realm.clients().get(id);
-        assertNotNull(clientResource);
-        ClientRepresentation client = clientResource.toRepresentation();
-        List<ProtocolMapperRepresentation> protocolMappers = client.getProtocolMappers();
-        assertEquals(1, protocolMappers.size());
-        ProtocolMapperRepresentation mapper = protocolMappers.get(0);
-        assertEquals("foo", mapper.getName());
-
-        ClientRepresentation newClient = new ClientRepresentation();
-        newClient.setId(client.getId());
-        newClient.setClientId(client.getClientId());
-
-        ProtocolMapperRepresentation barMapper = new ProtocolMapperRepresentation();
-        barMapper.setName("bar");
-        barMapper.setProtocol("openid-connect");
-        barMapper.setProtocolMapper("oidc-hardcoded-role-mapper");
-        protocolMappers.add(barMapper);
-        newClient.setProtocolMappers(protocolMappers);
-
-        realm.clients().get(client.getId()).update(newClient);
-
-        ClientRepresentation storedClient = realm.clients().get(client.getId()).toRepresentation();
-        assertClient(client, storedClient);
-    }
-
-    public static void assertClient(ClientRepresentation client, ClientRepresentation storedClient) {
-        if (client.getClientId() != null) Assert.assertEquals(client.getClientId(), storedClient.getClientId());
-        if (client.getName() != null) Assert.assertEquals(client.getName(), storedClient.getName());
-        if (client.isEnabled() != null) Assert.assertEquals(client.isEnabled(), storedClient.isEnabled());
-        if (client.isAlwaysDisplayInConsole() != null) Assert.assertEquals(client.isAlwaysDisplayInConsole(), storedClient.isAlwaysDisplayInConsole());
-        if (client.isBearerOnly() != null) Assert.assertEquals(client.isBearerOnly(), storedClient.isBearerOnly());
-        if (client.isPublicClient() != null) Assert.assertEquals(client.isPublicClient(), storedClient.isPublicClient());
-        if (client.isFullScopeAllowed() != null) Assert.assertEquals(client.isFullScopeAllowed(), storedClient.isFullScopeAllowed());
-        if (client.getRootUrl() != null) Assert.assertEquals(client.getRootUrl(), storedClient.getRootUrl());
-        if (client.getAdminUrl() != null) Assert.assertEquals(client.getAdminUrl(), storedClient.getAdminUrl());
-        if (client.getBaseUrl() != null) Assert.assertEquals(client.getBaseUrl(), storedClient.getBaseUrl());
-        if (client.isSurrogateAuthRequired() != null) Assert.assertEquals(client.isSurrogateAuthRequired(), storedClient.isSurrogateAuthRequired());
-        if (client.getClientAuthenticatorType() != null) Assert.assertEquals(client.getClientAuthenticatorType(), storedClient.getClientAuthenticatorType());
-        if (client.getSecret() != null) Assert.assertEquals(client.getSecret(), storedClient.getSecret());
-
-        if (client.getNotBefore() != null) {
-            Assert.assertEquals(client.getNotBefore(), storedClient.getNotBefore());
-        }
-        if (client.getDefaultRoles() != null) {
-            Set<String> set = new HashSet<String>();
-            for (String val : client.getDefaultRoles()) {
-                set.add(val);
-            }
-            Set<String> storedSet = new HashSet<String>();
-            for (String val : storedClient.getDefaultRoles()) {
-                storedSet.add(val);
-            }
-
-            Assert.assertEquals(set, storedSet);
-        }
-
-        List<String> redirectUris = client.getRedirectUris();
-        if (redirectUris != null) {
-            Set<String> set = new HashSet<String>();
-            for (String val : client.getRedirectUris()) {
-                set.add(val);
-            }
-            Set<String> storedSet = new HashSet<String>();
-            for (String val : storedClient.getRedirectUris()) {
-                storedSet.add(val);
-            }
-
-            Assert.assertEquals(set, storedSet);
-        }
-
-        List<String> webOrigins = client.getWebOrigins();
-        if (webOrigins != null) {
-            Set<String> set = new HashSet<String>();
-            for (String val : client.getWebOrigins()) {
-                set.add(val);
-            }
-            Set<String> storedSet = new HashSet<String>();
-            for (String val : storedClient.getWebOrigins()) {
-                storedSet.add(val);
-            }
-
-            Assert.assertEquals(set, storedSet);
-        }
-
-        List<ProtocolMapperRepresentation> protocolMappers = client.getProtocolMappers();
-        if(protocolMappers != null){
-            Set<String> set = protocolMappers.stream()
-                    .map(ProtocolMapperRepresentation::getName)
-                    .collect(Collectors.toSet());
-            Set<String> storedSet = storedClient.getProtocolMappers().stream()
-                    .map(ProtocolMapperRepresentation::getName)
-                    .collect(Collectors.toSet());
-
-            Assert.assertEquals(set, storedSet);
-        }
-    }
-
-    private RoleRepresentation createRealmRole(String roleName) {
-        RoleRepresentation role = RoleBuilder.create().name(roleName).build();
-        realm.roles().create(role);
-
-        String createdId = realm.roles().get(role.getName()).toRepresentation().getId();
-        getCleanup().addRoleId(createdId);
-
-        return role;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ConsentsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ConsentsTest.java
index 0b8b0241e7f1..2b221dc79d25 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ConsentsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ConsentsTest.java
@@ -60,9 +60,8 @@
 import static org.keycloak.testsuite.admin.ApiUtil.resetUserPassword;
 
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
-import org.keycloak.testsuite.util.OAuthClient.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.openqa.selenium.By;
 
 /**
@@ -269,7 +268,7 @@ public void cleanUser() {
     public void testConsents() {
         oauth.realm(consumerRealmName());
         oauth.redirectUri(oauth.SERVER_ROOT + "/auth/realms/" + consumerRealmName() + "/app/auth");
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
 
         log.debug("Clicking social " + getIDPAlias());
         accountLoginPage.clickSocial(getIDPAlias());
@@ -389,10 +388,10 @@ public void testRetrieveConsentsForUserWithClientsWithGrantedOfflineAccess() thr
         providerRealm.clients().get(providerAccountRep.getId()).update(providerAccountRep);
 
         log.debug("Obtain offline_token");
-        OAuthClient.AccessTokenResponse response = oauth.realm(providerRealmRep.getRealm())
-                .clientId(providerAccountRep.getClientId())
+        AccessTokenResponse response = oauth.realm(providerRealmRep.getRealm())
+                .client(providerAccountRep.getClientId())
                 .scope(OAuth2Constants.SCOPE_OPENID +" " + OAuth2Constants.SCOPE_PROFILE + " " + OAuth2Constants.OFFLINE_ACCESS)
-                .doGrantAccessTokenRequest(null, getUserLogin(), getUserPassword());
+                .doPasswordGrantRequest(getUserLogin(), getUserPassword());
         assertNotNull(response.getRefreshToken());
 
         log.debug("Check for Offline Token in consents");
@@ -417,7 +416,7 @@ public void testConsentCancel() {
         oauth.realm(providerRealmName());
 
         // navigate to account console and login
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(getUserLogin(), getUserPassword());
 
         consentPage.assertCurrent();
@@ -427,7 +426,7 @@ public void testConsentCancel() {
         assertTrue(driver.getTitle().contains("AUTH_RESPONSE"));
         assertTrue(driver.getCurrentUrl().contains("error=access_denied"));
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(getUserLogin(), getUserPassword());
         consentPage.confirm();
 
@@ -438,12 +437,12 @@ public void testConsentCancel() {
 
     @Test
     public void clientConsentRequiredAfterLogin() {
-        oauth.realm(TEST_REALM_NAME).clientId("test-app");
+        oauth.realm(TEST_REALM_NAME).client("test-app", "password");
         AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(response.getCode(), "password");
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(response.getCode());
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation loginEvent = events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
         String sessionId = loginEvent.getSessionId();
@@ -457,7 +456,7 @@ public void clientConsentRequiredAfterLogin() {
 
             // try to refresh the token
             // this fails as client no longer has requested consent from user
-            AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
+            AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
             Assert.assertEquals(OAuthErrorException.INVALID_SCOPE, refreshTokenResponse.getError());
             Assert.assertEquals("Client no longer has requested consent from user", refreshTokenResponse.getErrorDescription());
 
@@ -485,7 +484,7 @@ public void testConsentWithAdditionalClientAttributes() {
         oauth.realm(providerRealmName());
 
         // navigate to account console and login
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(getUserLogin(), getUserPassword());
 
         consentPage.assertCurrent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/CrossRealmPermissionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/CrossRealmPermissionsTest.java
deleted file mode 100644
index 78fe8eb07821..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/CrossRealmPermissionsTest.java
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.junit.AfterClass;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.util.Time;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.Constants;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.Response;
-import java.util.List;
-import java.util.concurrent.atomic.AtomicReference;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class CrossRealmPermissionsTest extends AbstractKeycloakTest {
-
-    private static final String REALM_NAME = "crossrealm-test";
-    private static final String REALM2_NAME = "crossrealm2-test";
-
-    private static Keycloak adminClient1;
-    private static Keycloak adminClient2;
-
-    private RealmResource realm1;
-    private RealmResource realm2;
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmBuilder builder = RealmBuilder.create().name(REALM_NAME).testMail();
-        builder.client(ClientBuilder.create().clientId("test-client").publicClient().directAccessGrants());
-
-        builder.user(UserBuilder.create()
-                .username(AdminRoles.REALM_ADMIN)
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN)
-                .addPassword("password"));
-        testRealms.add(builder.build());
-
-        adminClient1 = Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM_NAME, AdminRoles.REALM_ADMIN, "password", "test-client", "secret", TLSUtils.initializeTLS());
-        realm1 = adminClient1.realm(REALM_NAME);
-
-        builder = RealmBuilder.create().name(REALM2_NAME).testMail();
-        builder.client(ClientBuilder.create().clientId("test-client").publicClient().directAccessGrants());
-
-        builder.user(UserBuilder.create()
-                .username(AdminRoles.REALM_ADMIN)
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN)
-                .addPassword("password"));
-
-        testRealms.add(builder.build());
-
-        adminClient2 = Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM2_NAME, AdminRoles.REALM_ADMIN, "password", "test-client", "secret", TLSUtils.initializeTLS());
-        realm2 = adminClient2.realm(REALM2_NAME);
-    }
-
-
-    @AfterClass
-    public static void afterClass() {
-        adminClient1.close();
-        adminClient2.close();
-    }
-
-
-    @Test
-    public void users() {
-        UserRepresentation user = UserBuilder.create().username("randomuser-" + Time.currentTimeMillis()).build();
-        Response response = realm1.users().create(user);
-        String userId = ApiUtil.getCreatedId(response);
-        response.close();
-
-        realm1.users().get(userId).toRepresentation();
-
-        expectNotFound(new PermissionsTest.Invocation() {
-            @Override
-            public void invoke(RealmResource realm) {
-                realm.users().get(userId).toRepresentation();
-            }
-        }, realm2);
-
-        expectNotFound(new PermissionsTest.Invocation() {
-            @Override
-            public void invoke(RealmResource realm) {
-                realm.users().get(userId).update(new UserRepresentation());
-            }
-        }, realm2);
-
-        expectNotFound(new PermissionsTest.Invocation() {
-            @Override
-            public void invoke(RealmResource realm) {
-                realm.users().get(userId).remove();
-            }
-        }, realm2);
-
-        expectNotFound(new PermissionsTest.Invocation() {
-            @Override
-            public void invoke(RealmResource realm) {
-                realm.users().get(userId).getUserSessions();
-            }
-        }, realm2);
-    }
-
-    private void expectNotFound(final PermissionsTest.Invocation invocation, RealmResource realm) {
-        expectNotFound(new PermissionsTest.InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                invocation.invoke(realm);
-            }
-        }, realm);
-    }
-
-    private void expectNotFound(PermissionsTest.InvocationWithResponse invocation, RealmResource realm) {
-        int statusCode = 0;
-        try {
-            AtomicReference<Response> responseReference = new AtomicReference<>();
-            invocation.invoke(realm, responseReference);
-            Response response = responseReference.get();
-            if (response != null) {
-                statusCode = response.getStatus();
-            } else {
-                fail("Expected failure");
-            }
-        } catch (ClientErrorException e) {
-            statusCode = e.getResponse().getStatus();
-        }
-
-        assertEquals(404, statusCode);
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/DeclarativeUserTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/DeclarativeUserTest.java
deleted file mode 100644
index 90102f7b078e..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/DeclarativeUserTest.java
+++ /dev/null
@@ -1,281 +0,0 @@
-package org.keycloak.testsuite.admin;
-
-import static org.hamcrest.CoreMatchers.equalTo;
-import static org.hamcrest.CoreMatchers.instanceOf;
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.CoreMatchers.notNullValue;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.hasSize;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.setUserProfileConfiguration;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.admin.client.resource.UsersResource;
-import org.keycloak.models.UserModel;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.ErrorRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.userprofile.DeclarativeUserProfileProvider;
-import org.keycloak.userprofile.UserProfileProvider;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.WebApplicationException;
-import jakarta.ws.rs.core.Response;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class DeclarativeUserTest extends AbstractAdminTest {
-
-    private static final String TEST_REALM_USER_MANAGER_NAME = "test-realm-user-manager";
-    private static final String REQUIRED_ATTR_KEY = "required-attr";
-
-    private Keycloak testRealmUserManagerClient;
-
-    @Before
-    public void onBefore() throws Exception {
-        RealmRepresentation realmRep = realm.toRepresentation();
-        realmRep.setInternationalizationEnabled(true);
-        realmRep.setSupportedLocales(new HashSet<>(Arrays.asList("en", "de")));
-        realm.update(realmRep);
-        setUserProfileConfiguration(realm, "{\"attributes\": ["
-                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"aName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"custom-a\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"custom-hidden\"},"
-                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr2\", " + PERMISSIONS_ALL + "}]}");
-
-        UserRepresentation testRealmUserManager = UserBuilder.create().username(TEST_REALM_USER_MANAGER_NAME)
-                .password(TEST_REALM_USER_MANAGER_NAME).build();
-        String createdUserId = null;
-        try (Response response = realm.users().create(testRealmUserManager)) {
-            createdUserId = ApiUtil.getCreatedId(response);
-        } catch (WebApplicationException e) {
-            // it's ok when the user has already been created for a previous test
-            assertThat(e.getResponse().getStatus(), equalTo(409));
-        }
-
-        if (createdUserId != null) {
-            List<ClientRepresentation> foundClients = realm.clients().findByClientId("realm-management");
-            assertThat(foundClients, hasSize(1));
-            ClientRepresentation realmManagementClient = foundClients.get(0);
-
-            RoleRepresentation manageUsersRole =
-                    realm.clients().get(realmManagementClient.getId()).roles().get("manage-users").toRepresentation();
-            assertThat(manageUsersRole, notNullValue());
-
-            realm.users().get(createdUserId).roles().clientLevel(realmManagementClient.getId())
-                    .add(Collections.singletonList(manageUsersRole));
-        }
-
-        ClientRepresentation testApp = new ClientRepresentation();
-        testApp.setClientId("test-app");
-        testApp.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        testApp.setSecret("secret");
-        try (Response response = realm.clients().create(testApp)) {
-            ApiUtil.getCreatedId(response);
-        } catch (WebApplicationException e) {
-            // it's ok when the client has already been created for a previous test
-        }
-
-        testRealmUserManagerClient = AdminClientUtil.createAdminClient(true, realmRep.getRealm(),
-                TEST_REALM_USER_MANAGER_NAME, TEST_REALM_USER_MANAGER_NAME, testApp.getClientId(), testApp.getSecret());
-    }
-
-    @After
-    public void closeClient() {
-        if (testRealmUserManagerClient != null) {
-            testRealmUserManagerClient.close();
-        }
-    }
-
-    @Test
-    public void testDoNotReturnAttributeIfNotReadble() {
-        UserRepresentation user1 = new UserRepresentation();
-        user1.setUsername("user1");
-        user1.singleAttribute("attr1", "value1user1");
-        user1.singleAttribute("attr2", "value2user1");
-        String user1Id = createUser(user1);
-
-        user1 = realm.users().get(user1Id).toRepresentation();
-        Map<String, List<String>> attributes = user1.getAttributes();
-        assertEquals(2, attributes.size());
-        assertFalse(attributes.containsKey("custom-hidden"));
-
-        setUserProfileConfiguration(this.realm, "{\"attributes\": ["
-                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"aName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"custom-a\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"custom-hidden\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr2\", " + PERMISSIONS_ALL + "}]}");
-
-
-        user1 = realm.users().get(user1Id).toRepresentation();
-        attributes = user1.getAttributes();
-        assertEquals(2, attributes.size());
-        assertFalse(attributes.containsKey("custom-hidden"));
-    }
-
-    @Test
-    public void testUpdateUnsetAttributeWithEmptyValue() {
-        setUserProfileConfiguration(this.realm, "{\"attributes\": ["
-                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr1\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr2\"}]}");
-
-        UserRepresentation user1 = new UserRepresentation();
-        user1.setUsername("user1");
-        // set an attribute to later remove it from the configuration
-        user1.singleAttribute("attr1", "some-value");
-        String user1Id = createUser(user1);
-
-        // remove the attr1 attribute from the configuration
-        setUserProfileConfiguration(this.realm, "{\"attributes\": ["
-                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"attr2\"}]}");
-
-        UserResource userResource = realm.users().get(user1Id);
-        user1 = userResource.toRepresentation();
-        assertNull(user1.getAttributes());
-        user1.singleAttribute("attr2", "");
-        // should be able to update the user when a read-only attribute has an empty or null value
-        userResource.update(user1);
-        user1 = userResource.toRepresentation();
-        assertNull(user1.getAttributes());
-        user1.setAttributes(new HashMap<>());
-        user1.getAttributes().put("attr2", null);
-        userResource.update(user1);
-        user1 = userResource.toRepresentation();
-        assertNull(user1.getAttributes());
-    }
-
-    @Test
-    public void testValidationUsingExistingAttributes() {
-        setUserProfileConfiguration(this.realm, "{\"attributes\": ["
-                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"lastName\", " + PERMISSIONS_ALL + "},"
-                + "{\"name\": \"" + REQUIRED_ATTR_KEY + "\", \"required\": {}, " + PERMISSIONS_ALL + "}]}");
-
-        UserRepresentation user1 = new UserRepresentation();
-        user1.setUsername("user1");
-        // set an attribute to later remove it from the configuration
-        user1.singleAttribute(REQUIRED_ATTR_KEY, "some-value");
-        String user1Id = createUser(user1);
-
-        UserResource userResource = realm.users().get(user1Id);
-        user1 = userResource.toRepresentation();
-        user1.setFirstName("changed");
-        user1.setAttributes(null);
-
-        // do not validate REQUIRED_ATTR_KEY because the attribute list is not provided and the user has the attribute
-        userResource.update(user1);
-        user1 = userResource.toRepresentation();
-        assertEquals("changed", user1.getFirstName());
-
-        user1.setAttributes(Collections.emptyMap());
-        String expectedErrorMessage = "error-user-attribute-required";
-        verifyUserUpdateFails(realm.users(), user1Id, user1, expectedErrorMessage);
-    }
-
-    private void verifyUserUpdateFails(UsersResource usersResource, String userId, UserRepresentation user,
-            String expectedErrorMessage) {
-        UserResource userResource = usersResource.get(userId);
-        try {
-            userResource.update(user);
-            fail("Should fail with errorMessage: " + expectedErrorMessage);
-        } catch (BadRequestException badRequest) {
-            try (Response response = badRequest.getResponse()) {
-                assertThat(response.getStatus(), equalTo(400));
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertThat(error.getErrorMessage(), equalTo(expectedErrorMessage));
-            }
-        }
-    }
-
-    @Test
-    public void testDefaultUserProfileProviderIsActive() {
-        getTestingClient().server(REALM_NAME).run(session -> {
-            Set<UserProfileProvider> providers = session.getAllProviders(UserProfileProvider.class);
-            assertThat(providers, notNullValue());
-            assertThat(providers.isEmpty(), is(false));
-
-            UserProfileProvider provider = session.getProvider(UserProfileProvider.class);
-            assertThat(provider, notNullValue());
-            assertThat(DeclarativeUserProfileProvider.class.getName(), is(provider.getClass().getName()));
-            assertThat(provider, instanceOf(DeclarativeUserProfileProvider.class));
-        });
-    }
-
-    @Test
-    public void testUserLocale() {
-        RealmRepresentation realmRep = realm.toRepresentation();
-        Boolean internationalizationEnabled = realmRep.isInternationalizationEnabled();
-        realmRep.setInternationalizationEnabled(true);
-        realm.update(realmRep);
-
-        try {
-            UserRepresentation user1 = new UserRepresentation();
-            user1.setUsername("user1");
-            user1.singleAttribute(UserModel.LOCALE, "pt_BR");
-            String user1Id = createUser(user1);
-
-            UserResource userResource = realm.users().get(user1Id);
-            user1 = userResource.toRepresentation();
-            assertEquals("pt_BR", user1.getAttributes().get(UserModel.LOCALE).get(0));
-
-            realmRep.setInternationalizationEnabled(false);
-            realm.update(realmRep);
-
-            user1 = userResource.toRepresentation();
-            assertNull(user1.getAttributes());
-        } finally {
-            realmRep.setInternationalizationEnabled(internationalizationEnabled);
-            realm.update(realmRep);
-        }
-    }
-
-    private String createUser(UserRepresentation userRep) {
-        Response response = realm.users().create(userRep);
-        String createdId = ApiUtil.getCreatedId(response);
-        response.close();
-        getCleanup().addUserId(createdId);
-        return createdId;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/FineGrainAdminUnitTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/FineGrainAdminUnitTest.java
deleted file mode 100644
index f8aeee538dba..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/FineGrainAdminUnitTest.java
+++ /dev/null
@@ -1,1357 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.admin;
-
-import org.hamcrest.MatcherAssert;
-import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.model.Resource;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.client.cli.util.ConfigUtil;
-import org.keycloak.common.Profile;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.Constants;
-import org.keycloak.models.GroupModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.RepresentationToModel;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.ClientScopeRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.DecisionStrategy;
-import org.keycloak.representations.idm.authorization.Logic;
-import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionEvaluator;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
-import org.keycloak.services.resources.admin.permissions.ClientPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.GroupPermissionManagement;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
-import org.keycloak.testsuite.auth.page.AuthRealm;
-import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.GroupBuilder;
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.WebApplicationException;
-import jakarta.ws.rs.core.Response;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.stream.Collectors;
-import static org.hamcrest.Matchers.hasItem;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.Matchers.oneOf;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@EnableFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)
-public class FineGrainAdminUnitTest extends AbstractKeycloakTest {
-
-    public static final String CLIENT_NAME = "application";
-    public static boolean IMPERSONATION_DISABLED = "impersonation".equals(System.getProperty("feature.name"))
-            && "disabled".equals(System.getProperty("feature.value"));
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmRepresentation testRealmRep = new RealmRepresentation();
-        testRealmRep.setId(TEST);
-        testRealmRep.setRealm(TEST);
-        testRealmRep.setEnabled(true);
-        testRealms.add(testRealmRep);
-        testRealmRep.setGroups(Arrays.asList(GroupBuilder.create().name("restricted-group").build()));
-    }
-
-    public static void setupDemo(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        realm.addRole("realm-role");
-        ClientModel client = realm.addClient("sales-application");
-        RoleModel clientAdmin = client.addRole("admin");
-        client.addRole("leader-creator");
-        client.addRole("viewLeads");
-        GroupModel sales = realm.createGroup("sales");
-
-
-        UserModel admin = session.users().addUser(realm, "salesManager");
-        admin.setEnabled(true);
-        admin.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        admin = session.users().addUser(realm, "sales-admin");
-        admin.setEnabled(true);
-        admin.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel user = session.users().addUser(realm, "salesman");
-        user.setEnabled(true);
-        user.joinGroup(sales);
-
-        user = session.users().addUser(realm, "saleswoman");
-        user.setEnabled(true);
-
-    }
-
-    public static void setupPolices(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
-        RoleModel realmRole = realm.addRole("realm-role");
-        RoleModel realmRole2 = realm.addRole("realm-role2");
-        ClientModel client1 = realm.addClient(CLIENT_NAME);
-        realm.addClientScope("scope");
-        client1.setFullScopeAllowed(false);
-        RoleModel client1Role = client1.addRole("client-role");
-        GroupModel group = realm.createGroup("top");
-
-        RoleModel mapperRole = realm.addRole("mapper");
-        RoleModel managerRole = realm.addRole("manager");
-        RoleModel compositeRole = realm.addRole("composite-role");
-        compositeRole.addCompositeRole(mapperRole);
-        compositeRole.addCompositeRole(managerRole);
-
-        // realm-role and application.client-role will have a role policy associated with their map-role permission
-        {
-            permissions.roles().setPermissionsEnabled(client1Role, true);
-            Policy mapRolePermission = permissions.roles().mapRolePermission(client1Role);
-            ResourceServer server = permissions.roles().resourceServer(client1Role);
-            Policy mapperPolicy = permissions.roles().rolePolicy(server, mapperRole);
-            mapRolePermission.addAssociatedPolicy(mapperPolicy);
-        }
-
-        {
-            permissions.roles().setPermissionsEnabled(realmRole, true);
-            Policy mapRolePermission = permissions.roles().mapRolePermission(realmRole);
-            ResourceServer server = permissions.roles().resourceServer(realmRole);
-            Policy mapperPolicy = permissions.roles().rolePolicy(server, mapperRole);
-            mapRolePermission.addAssociatedPolicy(mapperPolicy);
-        }
-
-        // realmRole2 will have an empty map-role policy
-        {
-            permissions.roles().setPermissionsEnabled(realmRole2, true);
-        }
-
-        // setup Users manage policies
-        {
-            permissions.users().setPermissionsEnabled(true);
-            ResourceServer server = permissions.realmResourceServer();
-            Policy managerPolicy = permissions.roles().rolePolicy(server, managerRole);
-            Policy permission = permissions.users().managePermission();
-            permission.addAssociatedPolicy(managerPolicy);
-            permission.setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
-        }
-        {
-            permissions.groups().setPermissionsEnabled(group, true);
-        }
-        {
-            permissions.clients().setPermissionsEnabled(client1, true);
-        }
-        // setup Users impersonate policy
-        {
-            ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
-            RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
-            permissions.users().setPermissionsEnabled(true);
-            ResourceServer server = permissions.realmResourceServer();
-            Policy adminPolicy = permissions.roles().rolePolicy(server, adminRole);
-            adminPolicy.setLogic(Logic.NEGATIVE);
-            Policy permission = permissions.users().userImpersonatedPermission();
-            permission.addAssociatedPolicy(adminPolicy);
-            permission.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
-        }
-
-
-    }
-
-    public static void setupUsers(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        ClientModel client = realm.getClientByClientId(CLIENT_NAME);
-        RoleModel realmRole = realm.getRole("realm-role");
-        RoleModel realmRole2 = realm.getRole("realm-role2");
-        RoleModel clientRole = client.getRole("client-role");
-        RoleModel mapperRole = realm.getRole("mapper");
-        RoleModel managerRole = realm.getRole("manager");
-        RoleModel compositeRole = realm.getRole("composite-role");
-        ClientModel realmManagementClient = realm.getClientByClientId("realm-management");
-        RoleModel adminRole = realmManagementClient.getRole(AdminRoles.REALM_ADMIN);
-        RoleModel queryGroupsRole = realmManagementClient.getRole(AdminRoles.QUERY_GROUPS);
-        RoleModel queryUsersRole = realmManagementClient.getRole(AdminRoles.QUERY_USERS);
-        RoleModel queryClientsRole = realmManagementClient.getRole(AdminRoles.QUERY_CLIENTS);
-
-        UserModel nomapAdmin = session.users().addUser(realm, "nomap-admin");
-        nomapAdmin.setEnabled(true);
-        nomapAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        nomapAdmin.grantRole(adminRole);
-
-        UserModel anotherAdmin = session.users().addUser(realm, "anotherAdmin");
-        anotherAdmin.setEnabled(true);
-        anotherAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        anotherAdmin.grantRole(adminRole);
-
-        UserModel authorizedUser = session.users().addUser(realm, "authorized");
-        authorizedUser.setEnabled(true);
-        authorizedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        authorizedUser.grantRole(mapperRole);
-        authorizedUser.grantRole(managerRole);
-
-        UserModel authorizedComposite = session.users().addUser(realm, "authorizedComposite");
-        authorizedComposite.setEnabled(true);
-        authorizedComposite.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        authorizedComposite.grantRole(compositeRole);
-
-        UserModel unauthorizedUser = session.users().addUser(realm, "unauthorized");
-        unauthorizedUser.setEnabled(true);
-        unauthorizedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel unauthorizedMapper = session.users().addUser(realm, "unauthorizedMapper");
-        unauthorizedMapper.setEnabled(true);
-        unauthorizedMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        unauthorizedMapper.grantRole(managerRole);
-
-        UserModel user1 = session.users().addUser(realm, "user1");
-        user1.setEnabled(true);
-
-        // group management
-        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
-
-        GroupModel group =  KeycloakModelUtils.findGroupByPath(session, realm, "top");
-        UserModel groupMember = session.users().addUser(realm, "groupMember");
-        groupMember.joinGroup(group);
-        groupMember.setEnabled(true);
-        UserModel groupManager = session.users().addUser(realm, "groupManager");
-        groupManager.grantRole(queryGroupsRole);
-        groupManager.grantRole(queryUsersRole);
-        groupManager.setEnabled(true);
-        groupManager.grantRole(mapperRole);
-        groupManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel groupManagerNoMapper = session.users().addUser(realm, "noMapperGroupManager");
-        groupManagerNoMapper.setEnabled(true);
-        groupManagerNoMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        groupManagerNoMapper.grantRole(queryGroupsRole);
-        groupManagerNoMapper.grantRole(queryUsersRole);
-
-        UserPolicyRepresentation groupManagerRep = new UserPolicyRepresentation();
-        groupManagerRep.setName("groupManagers");
-        groupManagerRep.addUser("groupManager");
-        groupManagerRep.addUser("noMapperGroupManager");
-        ResourceServer server = permissions.realmResourceServer();
-        Policy groupManagerPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(server, groupManagerRep);
-        permissions.groups().manageMembersPermission(group).addAssociatedPolicy(groupManagerPolicy);
-        permissions.groups().manageMembershipPermission(group).addAssociatedPolicy(groupManagerPolicy);
-        permissions.groups().viewPermission(group).addAssociatedPolicy(groupManagerPolicy);
-
-        UserModel clientMapper = session.users().addUser(realm, "clientMapper");
-        clientMapper.setEnabled(true);
-        clientMapper.grantRole(managerRole);
-        clientMapper.grantRole(queryUsersRole);
-        clientMapper.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        Policy clientMapperPolicy = permissions.clients().mapRolesPermission(client);
-        UserPolicyRepresentation userRep = new UserPolicyRepresentation();
-        userRep.setName("userClientMapper");
-        userRep.addUser("clientMapper");
-        Policy userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
-        clientMapperPolicy.addAssociatedPolicy(userPolicy);
-
-        UserModel clientManager = session.users().addUser(realm, "clientManager");
-        clientManager.setEnabled(true);
-        clientManager.grantRole(queryClientsRole);
-        clientManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        Policy clientManagerPolicy = permissions.clients().managePermission(client);
-        userRep = new UserPolicyRepresentation();
-        userRep.setName("clientManager");
-        userRep.addUser("clientManager");
-        userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
-        clientManagerPolicy.addAssociatedPolicy(userPolicy);
-
-
-        UserModel clientConfigurer = session.users().addUser(realm, "clientConfigurer");
-        clientConfigurer.setEnabled(true);
-        clientConfigurer.grantRole(queryClientsRole);
-        clientConfigurer.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        Policy clientConfigurePolicy = permissions.clients().configurePermission(client);
-        userRep = new UserPolicyRepresentation();
-        userRep.setName("clientConfigure");
-        userRep.addUser("clientConfigurer");
-        userPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(permissions.clients().resourceServer(client), userRep);
-        clientConfigurePolicy.addAssociatedPolicy(userPolicy);
-
-
-        UserModel groupViewer = session.users().addUser(realm, "groupViewer");
-        groupViewer.grantRole(queryGroupsRole);
-        groupViewer.grantRole(queryUsersRole);
-        groupViewer.setEnabled(true);
-        groupViewer.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserPolicyRepresentation groupViewMembersRep = new UserPolicyRepresentation();
-        groupViewMembersRep.setName("groupMemberViewers");
-        groupViewMembersRep.addUser("groupViewer");
-        Policy groupViewMembersPolicy = permissions.authz().getStoreFactory().getPolicyStore().create(server, groupViewMembersRep);
-        Policy groupViewMembersPermission = permissions.groups().viewMembersPermission(group);
-        groupViewMembersPermission.addAssociatedPolicy(groupViewMembersPolicy);
-
-
-    }
-
-    public static void evaluateLocally(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        RoleModel realmRole = realm.getRole("realm-role");
-        RoleModel realmRole2 = realm.getRole("realm-role2");
-        ClientModel client = realm.getClientByClientId(CLIENT_NAME);
-        RoleModel clientRole = client.getRole("client-role");
-
-        // test authorized
-        {
-            UserModel user = session.users().getUserByUsername(realm, "authorized");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, user);
-            Assert.assertTrue(permissionsForAdmin.users().canManage());
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(clientRole));
-        }
-        // test composite role
-        {
-            UserModel user = session.users().getUserByUsername(realm, "authorizedComposite");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, user);
-            Assert.assertTrue(permissionsForAdmin.users().canManage());
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(clientRole));
-        }
-
-        // test unauthorized
-        {
-            UserModel user = session.users().getUserByUsername(realm, "unauthorized");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, user);
-            Assert.assertFalse(permissionsForAdmin.users().canManage());
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(clientRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-        }
-        // test unauthorized mapper
-        {
-            UserModel user = session.users().getUserByUsername(realm, "unauthorizedMapper");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, user);
-            Assert.assertTrue(permissionsForAdmin.users().canManage());
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(clientRole));
-            // will result to true because realmRole2 does not have any policies attached to this permission
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-        }
-        // test group management
-        {
-            UserModel admin = session.users().getUserByUsername(realm, "groupManager");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, admin);
-            UserModel user = session.users().getUserByUsername(realm, "authorized");
-            Assert.assertFalse(permissionsForAdmin.users().canManage(user));
-            Assert.assertFalse(permissionsForAdmin.users().canView(user));
-            UserModel member = session.users().getUserByUsername(realm, "groupMember");
-            Assert.assertTrue(permissionsForAdmin.users().canManage(member));
-            Assert.assertTrue(permissionsForAdmin.users().canManageGroupMembership(member));
-            Assert.assertTrue(permissionsForAdmin.users().canView(member));
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(clientRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-
-        }
-        // test client.mapRoles
-        {
-            UserModel admin = session.users().getUserByUsername(realm, "clientMapper");
-            AdminPermissionEvaluator permissionsForAdmin = AdminPermissions.evaluator(session, realm, realm, admin);
-            UserModel user = session.users().getUserByUsername(realm, "authorized");
-            Assert.assertTrue(permissionsForAdmin.users().canManage(user));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole));
-            Assert.assertTrue(permissionsForAdmin.roles().canMapRole(clientRole));
-            Assert.assertFalse(permissionsForAdmin.roles().canMapRole(realmRole2));
-
-        }
-
-    }
-
-    @Override
-    protected boolean isImportAfterEachMethod() {
-        return true;
-    }
-    
-    //@Test
-    public void testDemo() throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setupDemo);
-        Thread.sleep(1000000000);
-    }
-
-
-    //@Test
-    public void testEvaluationLocal() throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setupPolices);
-        testingClient.server().run(FineGrainAdminUnitTest::setupUsers);
-        testingClient.server().run(FineGrainAdminUnitTest::evaluateLocally);
-    }
-
-    @Test
-    public void testRestEvaluation() throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setupPolices);
-        testingClient.server().run(FineGrainAdminUnitTest::setupUsers);
-
-        UserRepresentation user1 = adminClient.realm(TEST).users().search("user1").get(0);
-        UserRepresentation anotherAdmin = adminClient.realm(TEST).users().search("anotherAdmin").get(0);
-        UserRepresentation groupMember = adminClient.realm(TEST).users().search("groupMember").get(0);
-        RoleRepresentation realmRole = adminClient.realm(TEST).roles().get("realm-role").toRepresentation();
-        List<RoleRepresentation> realmRoleSet = new LinkedList<>();
-        realmRoleSet.add(realmRole);
-        RoleRepresentation realmRole2 = adminClient.realm(TEST).roles().get("realm-role2").toRepresentation();
-        List<RoleRepresentation> realmRole2Set = new LinkedList<>();
-        realmRole2Set.add(realmRole2);
-        ClientRepresentation client = adminClient.realm(TEST).clients().findByClientId(CLIENT_NAME).get(0);
-        ClientScopeRepresentation scope = adminClient.realm(TEST).clientScopes().findAll().get(0);
-        RoleRepresentation clientRole = adminClient.realm(TEST).clients().get(client.getId()).roles().get("client-role").toRepresentation();
-        List<RoleRepresentation> clientRoleSet = new LinkedList<>();
-        clientRoleSet.add(clientRole);
-
-        // test configure client
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "clientConfigurer", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                client.setAdminUrl("http://nowhere");
-                realmClient.realm(TEST).clients().get(client.getId()).update(client);
-                client.setFullScopeAllowed(true);
-                try {
-                    realmClient.realm(TEST).clients().get(client.getId()).update(client);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-
-                }
-                client.setFullScopeAllowed(false);
-                realmClient.realm(TEST).clients().get(client.getId()).update(client);
-
-                try {
-                    realmClient.realm(TEST).clients().get(client.getId()).addDefaultClientScope(scope.getId());
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-
-                }
-
-                try {
-                    realmClient.realm(TEST).clients().get(client.getId()).getScopeMappings().realmLevel().add(realmRoleSet);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-
-                }
-            }
-        }
-
-        // test illegal impersonation
-        if (!IMPERSONATION_DISABLED) {
-            Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "nomap-admin", "password", Constants.ADMIN_CLI_CLIENT_ID, null);
-            try {
-                realmClient.realm(TEST).users().get(user1.getId()).impersonate();
-                realmClient.close(); // just in case of cookie settings
-                realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                        TEST, "nomap-admin", "password", Constants.ADMIN_CLI_CLIENT_ID, null);
-                try {
-                    realmClient.realm(TEST).users().get(anotherAdmin.getId()).impersonate();
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-            } finally {
-                realmClient.close();
-            }
-        }
-
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "authorized", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                List<RoleRepresentation> roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-            }
-        }
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "authorizedComposite", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                List<RoleRepresentation> roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-            }
-        }
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "unauthorized", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                Assert.fail("should fail with forbidden exception");
-            } catch (ClientErrorException e) {
-                Assert.assertEquals(403, e.getResponse().getStatus());
-            }
-        }
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "unauthorizedMapper", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                Assert.fail("should fail with forbidden exception");
-            } catch (ClientErrorException e) {
-                Assert.assertEquals(403, e.getResponse().getStatus());
-            }
-        }
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "groupManager", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
-                List<RoleRepresentation> roles = realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-                realmClient.realm(TEST).users().get(groupMember.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
-
-                roles = realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().listAvailable();
-                Assert.assertEquals(1, roles.size());
-                realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().add(realmRoleSet);
-                realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().remove(realmRoleSet);
-                try {
-                    realmClient.realm(TEST).users().get(groupMember.getId()).roles().realmLevel().add(realmRole2Set);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-                try {
-                    realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-            }
-        }
-
-
-        // test client.mapRoles
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "clientMapper", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                List<RoleRepresentation> roles = realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.isEmpty());
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
-                roles = realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-                roles = realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAvailable();
-                Assert.assertTrue(roles.isEmpty());
-                try {
-                    realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-            }
-        }
-
-        // KEYCLOAK-5878
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "groupViewer", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                // Should only return the list of users that belong to "top" group
-                List<UserRepresentation> queryUsers = realmClient.realm(TEST).users().list();
-                Assert.assertEquals(queryUsers.size(), 1);
-                MatcherAssert.assertThat("groupmember", Matchers.equalTo(queryUsers.get(0).getUsername()));
-                for (UserRepresentation user : queryUsers) {
-                    System.out.println(user.getUsername());
-                }
-            }
-        }
-
-        // KEYCLOAK-11261 : user creation via fine grain admin
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "noMapperGroupManager", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                // Should only return the list of users that belong to "top" group
-                List<UserRepresentation> queryUsers = realmClient.realm(TEST).users().list();
-                Assert.assertEquals(1, queryUsers.size());
-
-                UserRepresentation newGroupMemberWithoutGroup = createUserRepresentation("new-group-member",
-                        "new-group-member@keycloak.org", "New", "Member", true);
-                try {
-                    ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberWithoutGroup);
-                    Assert.fail("should fail with HTTP response code 403 Forbidden");
-                } catch (WebApplicationException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-
-                UserRepresentation newEmptyGroupList = createUserRepresentation("new-group-member",
-                        "new-group-member@keycloak.org", "New", "Member", true);
-                newEmptyGroupList.setGroups(Collections.emptyList());
-
-                try {
-                    ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newEmptyGroupList);
-                    Assert.fail("should fail with HTTP response code 403 Forbidden");
-                } catch (WebApplicationException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-
-                UserRepresentation newGroupMemberWithNonExistentGroup = createUserRepresentation("new-group-member",
-                        "new-group-member@keycloak.org", "New", "Member",
-                        Arrays.asList("wrong-group"),true);
-                try {
-                    ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberWithNonExistentGroup);
-                    Assert.fail("should fail with HTTP response code 403 Forbidden");
-                } catch (WebApplicationException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-
-                UserRepresentation newGroupMemberOfNotManagedGroup = createUserRepresentation("new-group-member",
-                        "new-group-member@keycloak.org", "New", "Member",
-                        Arrays.asList("restricted-group"),true);
-                try {
-                    ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMemberOfNotManagedGroup);
-                    Assert.fail("should fail with HTTP response code 403 Forbidden");
-                } catch (WebApplicationException e) {
-                    Assert.assertEquals(403, e.getResponse().getStatus());
-                }
-
-                UserRepresentation newGroupMember = createUserRepresentation("new-group-member",
-                        "new-group-member@keycloak.org", "New", "Member",
-                        Arrays.asList("top"), true);
-                ApiUtil.createUserWithAdminClient(realmClient.realm(TEST), newGroupMember);
-
-                // Should only return the list of users that belong to "top" group + the new one
-                queryUsers = realmClient.realm(TEST).users().list();
-                Assert.assertEquals(2, queryUsers.size());
-            }
-        }
-    }
-
-    @Test
-    public void testMasterRealm() throws Exception {
-        // test that master realm can still perform operations when policies are in place
-        //
-        testingClient.server().run(FineGrainAdminUnitTest::setupPolices);
-        testingClient.server().run(FineGrainAdminUnitTest::setupUsers);
-
-        UserRepresentation user1 = adminClient.realm(TEST).users().search("user1").get(0);
-        RoleRepresentation realmRole = adminClient.realm(TEST).roles().get("realm-role").toRepresentation();
-        List<RoleRepresentation> realmRoleSet = new LinkedList<>();
-        realmRoleSet.add(realmRole);
-        RoleRepresentation realmRole2 = adminClient.realm(TEST).roles().get("realm-role2").toRepresentation();
-        List<RoleRepresentation> realmRole2Set = new LinkedList<>();
-        realmRole2Set.add(realmRole);
-        ClientRepresentation client = adminClient.realm(TEST).clients().findByClientId(CLIENT_NAME).get(0);
-        RoleRepresentation clientRole = adminClient.realm(TEST).clients().get(client.getId()).roles().get("client-role").toRepresentation();
-        List<RoleRepresentation> clientRoleSet = new LinkedList<>();
-        clientRoleSet.add(clientRole);
-
-
-        {
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting())) {
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().add(realmRoleSet);
-                List<RoleRepresentation> roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().remove(realmRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().realmLevel().listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("realm-role");
-                }));
-
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).add(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().anyMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-                realmClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).remove(clientRoleSet);
-                roles = adminClient.realm(TEST).users().get(user1.getId()).roles().clientLevel(client.getId()).listAll();
-                Assert.assertTrue(roles.stream().noneMatch((r) -> {
-                    return r.getName().equals("client-role");
-                }));
-            }
-        }
-
-    }
-
-    // KEYCLOAK-5152
-    @Test
-    public void testMasterRealmWithComposites() throws Exception {
-        RoleRepresentation composite = new RoleRepresentation();
-        composite.setName("composite");
-        composite.setComposite(true);
-        adminClient.realm(TEST).roles().create(composite);
-        composite = adminClient.realm(TEST).roles().get("composite").toRepresentation();
-
-        ClientRepresentation client = adminClient.realm(TEST).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-        RoleRepresentation createClient = adminClient.realm(TEST).clients().get(client.getId()).roles().get(AdminRoles.CREATE_CLIENT).toRepresentation();
-        RoleRepresentation queryRealms = adminClient.realm(TEST).clients().get(client.getId()).roles().get(AdminRoles.QUERY_REALMS).toRepresentation();
-        List<RoleRepresentation> composites = new LinkedList<>();
-        composites.add(createClient);
-        composites.add(queryRealms);
-        adminClient.realm(TEST).rolesById().addComposites(composite.getId(), composites);
-    }
-
-    public static void setup5152(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-        RoleModel realmAdminRole = realmAdminClient.getRole(AdminRoles.REALM_ADMIN);
-
-        UserModel realmUser = session.users().addUser(realm, "realm-admin");
-        realmUser.grantRole(realmAdminRole);
-        realmUser.setEnabled(true);
-        realmUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-    }
-
-    // KEYCLOAK-5152
-    @Test
-    public void testRealmWithComposites() throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setup5152);
-
-        try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                TEST, "realm-admin", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-            RoleRepresentation composite = new RoleRepresentation();
-            composite.setName("composite");
-            composite.setComposite(true);
-            realmClient.realm(TEST).roles().create(composite);
-            composite = adminClient.realm(TEST).roles().get("composite").toRepresentation();
-
-            ClientRepresentation client = adminClient.realm(TEST).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-            RoleRepresentation viewUsers = adminClient.realm(TEST).clients().get(client.getId()).roles().get(AdminRoles.CREATE_CLIENT).toRepresentation();
-
-            List<RoleRepresentation> composites = new LinkedList<>();
-            composites.add(viewUsers);
-            realmClient.realm(TEST).rolesById().addComposites(composite.getId(), composites);
-        }
-    }
-    // testRestEvaluationMasterRealm
-    // testRestEvaluationMasterAdminTestRealm
-
-    // test role deletion that it cleans up authz objects
-    public static void setupDeleteTest(KeycloakSession session )  {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        RoleModel removedRole = realm.addRole("removedRole");
-        ClientModel client = realm.addClient("removedClient");
-        RoleModel removedClientRole = client.addRole("removedClientRole");
-        GroupModel removedGroup = realm.createGroup("removedGroup");
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        management.roles().setPermissionsEnabled(removedRole, true);
-        management.roles().setPermissionsEnabled(removedClientRole, true);
-        management.groups().setPermissionsEnabled(removedGroup, true);
-        management.clients().setPermissionsEnabled(client, true);
-        management.users().setPermissionsEnabled(true);
-    }
-
-    public static void invokeDelete(KeycloakSession session)  {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        List<Resource> byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
-        Assert.assertEquals(5, byResourceServer.size());
-        RoleModel removedRole = realm.getRole("removedRole");
-        realm.removeRole(removedRole);
-        ClientModel client = realm.getClientByClientId("removedClient");
-        RoleModel removedClientRole = client.getRole("removedClientRole");
-        client.removeRole(removedClientRole);
-        GroupModel group = KeycloakModelUtils.findGroupByPath(session, realm, "removedGroup");
-        realm.removeGroup(group);
-        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
-        Assert.assertEquals(2, byResourceServer.size());
-        realm.removeClient(client.getId());
-        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
-        Assert.assertEquals(1, byResourceServer.size());
-        management.users().setPermissionsEnabled(false);
-        Resource userResource = management.authz().getStoreFactory().getResourceStore().findByName(management.realmResourceServer(), "Users");
-        Assert.assertNull(userResource);
-        byResourceServer = management.authz().getStoreFactory().getResourceStore().findByResourceServer(management.realmResourceServer());
-        Assert.assertEquals(0, byResourceServer.size());
-    }
-
-    @Test
-    public void testRemoveCleanup() throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setupDeleteTest);
-        testingClient.server().run(FineGrainAdminUnitTest::invokeDelete);
-    }
-
-    // KEYCLOAK-5211
-    @Test
-    public void testCreateRealmCreateClient() throws Exception {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setName("fullScopedClient");
-        rep.setClientId("fullScopedClient");
-        rep.setFullScopeAllowed(true);
-        rep.setSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171");
-        rep.setProtocol("openid-connect");
-        rep.setPublicClient(false);
-        rep.setEnabled(true);
-        adminClient.realm("master").clients().create(rep);
-
-        Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                "master", "admin", "admin", "fullScopedClient", "618268aa-51e6-4e64-93c4-3c0bc65b8171");
-        try {
-            RealmRepresentation newRealm=new RealmRepresentation();
-            newRealm.setRealm("anotherRealm");
-            newRealm.setId("anotherRealm");
-            newRealm.setEnabled(true);
-            realmClient.realms().create(newRealm);
-            
-            ClientRepresentation newClient = new ClientRepresentation();
-
-            newClient.setName("newClient");
-            newClient.setClientId("newClient");
-            newClient.setFullScopeAllowed(true);
-            newClient.setSecret("secret");
-            newClient.setProtocol("openid-connect");
-            newClient.setPublicClient(false);
-            newClient.setEnabled(true);
-            Response response = realmClient.realm("anotherRealm").clients().create(newClient);
-            Assert.assertEquals(403, response.getStatus());
-            response.close();
-
-            realmClient.close();
-            //creating new client to refresh token
-            realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    "master", "admin", "admin", "fullScopedClient", "618268aa-51e6-4e64-93c4-3c0bc65b8171");
-            assertThat(realmClient.realms().findAll().stream().map(RealmRepresentation::getRealm).collect(Collectors.toSet()),
-                    hasItem("anotherRealm"));
-            response = realmClient.realm("anotherRealm").clients().create(newClient);
-            Assert.assertEquals(201, response.getStatus());
-            response.close();
-        } finally {
-            adminClient.realm("anotherRealm").remove();
-            realmClient.close();
-        }
-
-
-    }
-
-    // KEYCLOAK-5211
-    @Test
-    public void testCreateRealmCreateClientWithMaster() throws Exception {
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setName("fullScopedClient");
-        rep.setClientId("fullScopedClient");
-        rep.setFullScopeAllowed(true);
-        rep.setSecret("618268aa-51e6-4e64-93c4-3c0bc65b8171");
-        rep.setProtocol("openid-connect");
-        rep.setPublicClient(false);
-        rep.setEnabled(true);
-        adminClient.realm("master").clients().create(rep);
-
-        RealmRepresentation newRealm=new RealmRepresentation();
-        newRealm.setRealm("anotherRealm");
-        newRealm.setId("anotherRealm");
-        newRealm.setEnabled(true);
-        adminClient.realms().create(newRealm);
-
-        try {
-            ClientRepresentation newClient = new ClientRepresentation();
-
-            newClient.setName("newClient");
-            newClient.setClientId("newClient");
-            newClient.setFullScopeAllowed(true);
-            newClient.setSecret("secret");
-            newClient.setProtocol("openid-connect");
-            newClient.setPublicClient(false);
-            newClient.setEnabled(true);
-            Response response = adminClient.realm("anotherRealm").clients().create(newClient);
-            Assert.assertEquals(201, response.getStatus());
-            response.close();            
-        } finally {
-            adminClient.realm("anotherRealm").remove();
-
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-
-    public void testTokenExchangeDisabled() throws Exception {
-        checkTokenExchange(false);
-    }
-
-    /**
-     * KEYCLOAK-7406
-     *
-     * @throws Exception
-     */
-    @Test
-    @UncaughtServerErrorExpected
-
-    @EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
-    public void testWithTokenExchange() throws Exception {
-        String exchanged = checkTokenExchange(true);
-        Assert.assertNotNull(exchanged);
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                AuthRealm.MASTER, Constants.ADMIN_CLI_CLIENT_ID, exchanged, TLSUtils.initializeTLS())) {
-            Assert.assertNotNull(client.realm("master").roles().get("offline_access"));
-        }
-    }
-
-    @Test
-    public void testUserPagination() {
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-
-            session.getContext().setRealm(realm);
-
-            GroupModel customerAGroup = session.groups().createGroup(realm, "Customer A");
-            UserModel customerAManager = session.users().addUser(realm, "customer-a-manager");
-            customerAManager.credentialManager().updateCredential(UserCredentialModel.password("password"));
-            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-            customerAManager.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_USERS));
-            customerAManager.setEnabled(true);
-            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
-            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.VIEW_USERS));
-            regularAdminUser.setEnabled(true);
-
-            AdminPermissionManagement management = AdminPermissions.management(session, realm);
-
-            GroupPermissionManagement groupPermission = management.groups();
-
-            groupPermission.setPermissionsEnabled(customerAGroup, true);
-
-            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
-
-            userPolicyRepresentation.setName("Only " + customerAManager.getUsername());
-            userPolicyRepresentation.addUser(customerAManager.getId());
-
-            Policy policy = groupPermission.viewMembersPermission(customerAGroup);
-
-            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
-
-            Policy userPolicy = provider.getStoreFactory().getPolicyStore().create(management.realmResourceServer(), userPolicyRepresentation);
-
-            policy.addAssociatedPolicy(RepresentationToModel.toModel(userPolicyRepresentation, provider, userPolicy));
-
-            for (int i = 0; i < 20; i++) {
-                UserModel userModel = session.users().addUser(realm, "a" + i);
-                userModel.setFirstName("test");
-            }
-
-            for (int i = 20; i < 40; i++) {
-                UserModel userModel = session.users().addUser(realm, "b" + i);
-                userModel.setFirstName("test");
-                userModel.joinGroup(customerAGroup);
-            }
-        });
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "customer-a-manager", "password", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            List<UserRepresentation> result = client.realm("test").users().search(null, "test", null, null, -1, 20);
-
-            Assert.assertEquals(20, result.size());
-            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
-
-            result = client.realm("test").users().search(null, "test", null, null, 20, 40);
-
-            Assert.assertEquals(0, result.size());
-        }
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            List<UserRepresentation> result = client.realm("test").users().search(null, "test", null, null, -1, 20);
-
-            Assert.assertEquals(20, result.size());
-            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("a"))));
-
-            client.realm("test").users().search(null, null, null, null, -1, -1);
-
-            Assert.assertEquals(20, result.size());
-            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("a"))));
-        }
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "customer-a-manager", "password", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            List<UserRepresentation> result = client.realm("test").users().search(null, null, null, null, -1, 20);
-
-            Assert.assertEquals(20, result.size());
-            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
-
-            result = client.realm("test").users().search("test", -1, 20, false);
-
-            Assert.assertEquals(20, result.size());
-            assertThat(result, Matchers.everyItem(Matchers.hasProperty("username", Matchers.startsWith("b"))));
-
-            result = client.realm("test").users().search("a", -1, 20, false);
-
-            Assert.assertEquals(0, result.size());
-        }
-    }
-
-    @Test
-    public void testClientsSearch() {
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-
-            session.getContext().setRealm(realm);
-
-            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
-            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
-            regularAdminUser.setEnabled(true);
-
-            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
-
-            userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
-            userPolicyRepresentation.addUser(regularAdminUser.getId());
-
-            for (int i = 0; i < 30; i++) {
-                realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
-            }
-
-            AdminPermissionManagement management = AdminPermissions.management(session, realm);
-            ClientPermissionManagement clientPermission = management.clients();
-            ClientModel clientModel = realm.getClientByClientId("client-search-09");
-
-            clientPermission.setPermissionsEnabled(clientModel, true);
-
-            Policy policy = clientPermission.viewPermission(clientModel);
-            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
-            Policy userPolicy = provider.getStoreFactory().getPolicyStore()
-                    .create(management.realmResourceServer(), userPolicyRepresentation);
-
-            policy.addAssociatedPolicy(RepresentationToModel.toModel(userPolicyRepresentation, provider, userPolicy));
-        });
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, 0, 5);
-
-            Assert.assertEquals(1, result.size());
-            Assert.assertEquals("client-search-09", result.get(0).getClientId());
-        }
-
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-
-            session.getContext().setRealm(realm);
-
-            AdminPermissionManagement management = AdminPermissions.management(session, realm);
-
-            ClientPermissionManagement clientPermission = management.clients();
-            ClientModel clientModel = realm.getClientByClientId("client-search-10");
-
-            clientPermission.setPermissionsEnabled(clientModel, true);
-
-            Policy policy = clientPermission.viewPermission(clientModel);
-
-            AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
-            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-            ResourceServer resourceServer = provider.getStoreFactory().getResourceServerStore().findByClient(realmAdminClient);
-
-            policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore().findByName(resourceServer, "Only regular-admin-user"));
-        });
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, -1, -1);
-
-            Assert.assertEquals(2, result.size());
-        }
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll(null, true, false, 0, 5);
-
-            Assert.assertEquals(2, result.size());
-        }
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll(null, true, false, 0, 1);
-
-            Assert.assertEquals(1, result.size());
-            assertThat(result, Matchers.hasItem(Matchers.hasProperty("clientId", is("client-search-09"))));
-
-            result = client.realm("test").clients().findAll(null, true, false, 1, 1);
-            assertThat(result, Matchers.hasItem(Matchers.hasProperty("clientId", is("client-search-10"))));
-
-            Assert.assertEquals(1, result.size());
-
-            result = client.realm("test").clients().findAll(null, true, false, 2, 1);
-
-            Assert.assertTrue(result.isEmpty());
-        }
-        
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll(null, true, false, -1, -1);
-
-            Assert.assertEquals(2, result.size());
-        }
-
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-
-            session.getContext().setRealm(realm);
-
-            AdminPermissionManagement management = AdminPermissions.management(session, realm);
-
-            ClientPermissionManagement clientPermission = management.clients();
-            for (int i = 11; i < 30; i++) {
-                ClientModel clientModel = realm.getClientByClientId("client-search-" + i);
-
-                clientPermission.setPermissionsEnabled(clientModel, true);
-
-                Policy policy = clientPermission.viewPermission(clientModel);
-
-                AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
-                ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-                ResourceServer resourceServer = provider.getStoreFactory().getResourceServerStore().findByClient(realmAdminClient);
-
-                policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore()
-                        .findByName(resourceServer, "Only regular-admin-user"));
-            }
-        });
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-            
-            List<ClientRepresentation> clients = new ArrayList<>();
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, 0, 10);
-            clients.addAll(result);
-            Assert.assertEquals(10, result.size());
-            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList("client-search-09",
-                    "client-search-10",
-                    "client-search-11",
-                    "client-search-12",
-                    "client-search-13",
-                    "client-search-14",
-                    "client-search-15",
-                    "client-search-16",
-                    "client-search-17",
-                    "client-search-18")));
-
-            result = client.realm("test").clients().findAll("client-search-", true, true, 10, 10);
-            clients.addAll(result);
-            Assert.assertEquals(10, result.size());
-            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList("client-search-19",
-                    "client-search-20",
-                    "client-search-21",
-                    "client-search-22",
-                    "client-search-23",
-                    "client-search-24",
-                    "client-search-25",
-                    "client-search-26",
-                    "client-search-27",
-                    "client-search-28")));
-
-            result = client.realm("test").clients().findAll("client-search-", true, true, 20, 10);
-            clients.addAll(result);
-            Assert.assertEquals(1, result.size());
-            assertThat(result, Matchers.hasItems(
-                    Matchers.hasProperty("clientId", is(oneOf("client-search-29")))));
-        }
-    }
-
-    @Test
-    public void testClientsSearchAfterFirstPage() {
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-
-            session.getContext().setRealm(realm);
-
-            ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-            UserModel regularAdminUser = session.users().addUser(realm, "regular-admin-user");
-            regularAdminUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-            regularAdminUser.grantRole(realmAdminClient.getRole(AdminRoles.QUERY_CLIENTS));
-            regularAdminUser.setEnabled(true);
-
-            UserPolicyRepresentation userPolicyRepresentation = new UserPolicyRepresentation();
-
-            userPolicyRepresentation.setName("Only " + regularAdminUser.getUsername());
-            userPolicyRepresentation.addUser(regularAdminUser.getId());
-
-            AdminPermissionManagement management = AdminPermissions.management(session, realm);
-
-            ClientPermissionManagement clientPermission = management.clients();
-            
-            for (int i = 15; i < 30; i++) {
-                ClientModel clientModel = realm.addClient("client-search-" + (i < 10 ? "0" + i : i));
-                clientPermission.setPermissionsEnabled(clientModel, true);
-
-                Policy policy = clientPermission.viewPermission(clientModel);
-
-                AuthorizationProvider provider = session.getProvider(AuthorizationProvider.class);
-
-                if (i == 15) {
-                    provider.getStoreFactory().getPolicyStore()
-                            .create(management.realmResourceServer(), userPolicyRepresentation);
-                }
-
-                policy.addAssociatedPolicy(provider.getStoreFactory().getPolicyStore()
-                        .findByName(management.realmResourceServer(), "Only regular-admin-user"));
-
-            }
-        });
-
-        try (Keycloak client = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                "test", "regular-admin-user", "password", Constants.ADMIN_CLI_CLIENT_ID,
-                TLSUtils.initializeTLS())) {
-
-            List<ClientRepresentation> clients = new ArrayList<>();
-
-            List<ClientRepresentation> result = client.realm("test").clients().findAll("client-search-", true, true, 0, 10);
-            clients.addAll(result);
-            Assert.assertEquals(10, result.size());
-            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList(
-                    "client-search-15",
-                    "client-search-16",
-                    "client-search-17",
-                    "client-search-18",
-                    "client-search-19",
-                    "client-search-20",
-                    "client-search-21",
-                    "client-search-22",
-                    "client-search-23",
-                    "client-search-24")));
-
-            result = client.realm("test").clients().findAll("client-search-", true, true, 10, 10);
-            clients.addAll(result);
-            Assert.assertEquals(5, result.size());
-            assertThat(result.stream().map(rep -> rep.getClientId()).collect(Collectors.toList()), is(Arrays.asList(
-                    "client-search-25",
-                    "client-search-26",
-                    "client-search-27",
-                    "client-search-28",
-                    "client-search-29")));
-
-            result = client.realm("test").clients().findAll("client-search-", true, true, 20, 10);
-            clients.addAll(result);
-            Assert.assertTrue(result.isEmpty());
-        }
-    }
-
-    private String checkTokenExchange(boolean shouldPass) throws Exception {
-        testingClient.server().run(FineGrainAdminUnitTest::setupTokenExchange);
-        oauth.realm("master");
-        oauth.clientId("tokenexclient");
-        String exchanged = null;
-        String token = oauth.doGrantAccessTokenRequest("password", "admin", "admin").getAccessToken();
-        Assert.assertNotNull(token);
-        try {
-            exchanged = oauth.doTokenExchange("master", token, "admin-cli", "tokenexclient", "password").getAccessToken();
-        } catch (AssertionError e) {
-            log.info("Error message is expected from oauth: " + e.getMessage());
-        }
-        if (shouldPass)
-            Assert.assertNotNull(exchanged);
-        else
-            Assert.assertNull(exchanged);
-        return exchanged;
-    }
-
-    private static void setupTokenExchange(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName("master");
-        ClientModel client = session.clients().getClientByClientId(realm, "tokenexclient");
-        if (client != null) {
-            return;
-        }
-
-        ClientModel tokenexclient = realm.addClient("tokenexclient");
-        tokenexclient.setEnabled(true);
-        tokenexclient.addRedirectUri("http://localhost:*");
-        tokenexclient.setPublicClient(false);
-        tokenexclient.setSecret("password");
-        tokenexclient.setDirectAccessGrantsEnabled(true);
-
-        // permission for client to client exchange to "target" client
-        ClientModel adminCli = realm.getClientByClientId(ConfigUtil.DEFAULT_CLIENT);
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        management.clients().setPermissionsEnabled(adminCli, true);
-        ClientPolicyRepresentation clientRep = new ClientPolicyRepresentation();
-        clientRep.setName("to");
-        clientRep.addClient(tokenexclient.getId());
-        ResourceServer server = management.realmResourceServer();
-        Policy clientPolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientRep);
-        management.clients().exchangeToPermission(adminCli).addAssociatedPolicy(clientPolicy);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IdentityProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IdentityProviderTest.java
deleted file mode 100755
index 9c0ea349228b..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IdentityProviderTest.java
+++ /dev/null
@@ -1,1300 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.containsInAnyOrder;
-import static org.hamcrest.Matchers.containsString;
-import static org.hamcrest.Matchers.empty;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.hasEntry;
-import static org.hamcrest.Matchers.hasSize;
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.Matchers.not;
-import static org.hamcrest.Matchers.notNullValue;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThrows;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import static org.keycloak.saml.common.constants.JBossSAMLURIConstants.XMLDSIG_NSURI;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.URL;
-import java.nio.charset.Charset;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-import java.security.PublicKey;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-
-import javax.xml.crypto.dsig.XMLSignature;
-
-import org.jboss.resteasy.plugins.providers.multipart.MultipartFormDataOutput;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.IdentityProviderResource;
-import org.keycloak.broker.saml.SAMLIdentityProviderConfig;
-import org.keycloak.common.enums.SslRequired;
-import org.keycloak.dom.saml.v2.metadata.EndpointType;
-import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
-import org.keycloak.dom.saml.v2.metadata.IndexedEndpointType;
-import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
-import org.keycloak.dom.saml.v2.metadata.KeyTypes;
-import org.keycloak.dom.saml.v2.metadata.SPSSODescriptorType;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.Constants;
-import org.keycloak.models.IdentityProviderMapperModel;
-import org.keycloak.models.IdentityProviderMapperSyncMode;
-import org.keycloak.models.IdentityProviderModel;
-import org.keycloak.models.utils.StripSecretsUtils;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.representations.idm.AdminEventRepresentation;
-import org.keycloak.representations.idm.ComponentRepresentation;
-import org.keycloak.representations.idm.ErrorRepresentation;
-import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
-import org.keycloak.representations.idm.IdentityProviderMapperTypeRepresentation;
-import org.keycloak.representations.idm.IdentityProviderRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.rotation.HardcodedKeyLocator;
-import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
-import org.keycloak.saml.common.exceptions.ConfigurationException;
-import org.keycloak.saml.common.exceptions.ParsingException;
-import org.keycloak.saml.common.exceptions.ProcessingException;
-import org.keycloak.saml.common.util.DocumentUtil;
-import org.keycloak.saml.common.util.XmlKeyInfoKeyNameTransformer;
-import org.keycloak.saml.processing.api.saml.v2.sig.SAML2Signature;
-import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
-import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.broker.OIDCIdentityProviderConfigRep;
-import org.keycloak.testsuite.broker.oidc.OverwrittenMappersTestIdentityProviderFactory;
-import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.KeyUtils;
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.NodeList;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class IdentityProviderTest extends AbstractAdminTest {
-
-    // Certificate imported from
-    private static final String SIGNING_CERT_1 = "MIICmzCCAYMCBgFUYnC0OjANBgkqhkiG9w0BAQsFADARMQ8wDQY"
-      + "DVQQDDAZtYXN0ZXIwHhcNMTYwNDI5MTQzMjEzWhcNMjYwNDI5MTQzMzUzWjARMQ8wDQYDVQQDDAZtYXN0ZXI"
-      + "wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCN25AW1poMEZRbuMAHG58AThZmCwMV6/Gcui4mjGa"
-      + "cRFyudgqzLjQ2rxpoW41JAtLjbjeAhuWvirUcFVcOeS3gM/ZC27qCpYighAcylZz6MYocnEe1+e8rPPk4JlI"
-      + "D6Wv62dgu+pL/vYsQpRhvD3Y2c/ytgr5D32xF+KnzDehUy5BSyzypvu12Wq9mS5vK5tzkN37EjkhpY2ZxaXP"
-      + "ubjDIITCAL4Q8M/m5IlacBaUZbzI4AQrHnMP1O1IH2dHSWuMiBe+xSDTco72PmuYPJKTV4wQdeBUIkYbfLc4"
-      + "RxVmXEvgkQgyW86EoMPxlWJpj7+mTIR+l+2thZPr/VgwTs82rAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAA/"
-      + "Ip/Hi8RoVu5ouaFFlc5whT7ltuK8slfLGW4tM4vJXhInYwsqIRQKBNDYW/64xle3eII4u1yAH1OYRRwEs7Em"
-      + "1pr4QuFuTY1at+aE0sE46XDlyESI0txJjWxYoT133vM0We2pj1b2nxgU30rwjKA3whnKEfTEYT/n3JBSqNgg"
-      + "y6l8ZGw/oPSgvPaR4+xeB1tfQFC4VrLoYKoqH6hAL530nKxL+qV8AIfL64NDEE8ankIAEDAAFe8x3CPUfXR/"
-      + "p4KOANKkpz8ieQaHDb1eITkAwUwjESj6UF9D1aePlhWls/HX0gujFXtWfWfrJ8CU/ogwlH8y1jgRuLjFQYZk6llc=";
-
-    private static final String SIGNING_CERT_2 = "MIIBnDCCAQUCBgFYKXKsPTANBgkqhkiG9w0BAQsFADAUMRIwEAY"
-      + "DVQQDDAlzYW1sLWRlbW8wHhcNMTYxMTAzMDkwNzEwWhcNMjYxMTAzMDkwODUwWjAUMRIwEAYDVQQDDAlzYW1"
-      + "sLWRlbW8wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKtWsK5O0CtuBpnMvWG+HTG0vmZzujQ2o9WdheQ"
-      + "u+BzCILcGMsbDW0YQaglpcO5JpGWWhubnckGGPHfdQ2/7nP9QwbiTK0FbGF41UqcvoaCqU1psxoV88s8IXyQ"
-      + "CAqeyLv00yj6foqdJjxh5SZ5z+na+M7Y2OxIBVxYRAxWEnfUvAgMBAAEwDQYJKoZIhvcNAQELBQADgYEAhet"
-      + "vOU8TyqfZF5jpv0IcrviLl/DoFrbjByeHR+pu/vClcAOjL/u7oQELuuTfNsBI4tpexUj5G8q/YbEz0gk7idf"
-      + "LXrAUVcsR73oTngrhRfwUSmPrjjK0kjcRb6HL9V/+wh3R/6mEd59U08ExT8N38rhmn0CI3ehMdebReprP7U8=";
-
-    @Test
-    public void testFind() {
-        create(createRep("twitter", "twitter idp","twitter", true, Collections.singletonMap("key1", "value1")));
-        create(createRep("linkedin-openid-connect", "linkedin-openid-connect"));
-        create(createRep("google", "google"));
-        create(createRep("github", "github"));
-        create(createRep("facebook", "facebook"));
-
-        Assert.assertNames(realm.identityProviders().findAll(), "facebook", "github", "google", "linkedin-openid-connect", "twitter");
-
-        Assert.assertNames(realm.identityProviders().find(null, true, 0, 2), "facebook", "github");
-        Assert.assertNames(realm.identityProviders().find(null, true, 2, 2), "google", "linkedin-openid-connect");
-        Assert.assertNames(realm.identityProviders().find(null, true, 4, 2), "twitter");
-
-        Assert.assertNames(realm.identityProviders().find("g", true, 0, 5), "github", "google");
-
-        Assert.assertNames(realm.identityProviders().find("g*", true, 0, 5), "github", "google");
-        Assert.assertNames(realm.identityProviders().find("g*", true, 0, 1), "github");
-        Assert.assertNames(realm.identityProviders().find("g*", true, 1, 1), "google");
-
-        Assert.assertNames(realm.identityProviders().find("*oo*", true, 0, 5), "google", "facebook");
-
-        //based on display name search
-        Assert.assertNames(realm.identityProviders().find("*ter i*", true, 0, 5), "twitter");
-
-        List<IdentityProviderRepresentation> results = realm.identityProviders().find("\"twitter\"", true, 0, 5);
-        Assert.assertNames(results, "twitter");
-        Assert.assertTrue("Result is not in brief representation", results.iterator().next().getConfig().isEmpty());
-        results = realm.identityProviders().find("\"twitter\"", null, 0, 5);
-        Assert.assertNames(results, "twitter");
-        Assert.assertFalse("Config should be present in full representation", results.iterator().next().getConfig().isEmpty());
-    }
-
-    @Test
-    public void testCreateWithReservedCharacterForAlias() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("ne$&w-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-
-        Response response = realm.identityProviders().create(newIdentityProvider);
-        Assert.assertEquals(400, response.getStatus());
-    }
-
-    @Test
-    public void testCreate() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("new-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        assertNotNull(representation.getInternalId());
-        assertEquals("new-identity-provider", representation.getAlias());
-        assertEquals("oidc", representation.getProviderId());
-        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        assertEquals("clientId", representation.getConfig().get("clientId"));
-        assertEquals(ComponentRepresentation.SECRET_VALUE, representation.getConfig().get("clientSecret"));
-        assertTrue(representation.isEnabled());
-        assertFalse(representation.isStoreToken());
-        assertFalse(representation.isTrustEmail());
-        assertNull(representation.getFirstBrokerLoginFlowAlias());
-
-        assertEquals("some secret value", testingClient.testing("admin-client-test").getIdentityProviderConfig("new-identity-provider").get("clientSecret"));
-
-        IdentityProviderRepresentation rep = realm.identityProviders().findAll().stream().filter(i -> i.getAlias().equals("new-identity-provider")).findFirst().get();
-        assertEquals(ComponentRepresentation.SECRET_VALUE, rep.getConfig().get("clientSecret"));
-    }
-
-    @Test
-    public void failCreateInvalidUrl() throws Exception {
-        try (AutoCloseable c = new RealmAttributeUpdater(realmsResouce().realm("test"))
-                .updateWith(r -> r.setSslRequired(SslRequired.ALL.name()))
-                .update()
-        ) {
-            IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
-
-            newIdentityProvider.getConfig().put("clientId", "clientId");
-            newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-
-            OIDCIdentityProviderConfigRep oidcConfig = new OIDCIdentityProviderConfigRep(newIdentityProvider);
-
-            oidcConfig.setAuthorizationUrl("invalid://test");
-
-            try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-                assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertEquals("The url [authorization_url] is malformed", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl("http://test");
-
-            try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-                assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertEquals("The url [token_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl("http://test");
-
-            try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-                assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertEquals("The url [jwks_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl(null);
-            oidcConfig.setLogoutUrl("http://test");
-
-            try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-                assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertEquals("The url [logout_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl(null);
-            oidcConfig.setLogoutUrl(null);
-            oidcConfig.setUserInfoUrl("http://test");
-
-            try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-                assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-                assertEquals("The url [userinfo_url] requires secure connections", error.getErrorMessage());
-            }
-        }
-    }
-
-    @Test
-    public void shouldFailWhenAliasHasSpaceDuringCreation() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("New Identity Provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-        newIdentityProvider.getConfig().put("clientAuthMethod",OIDCLoginProtocol.CLIENT_SECRET_BASIC);
-
-        try (Response response = this.realm.identityProviders().create(newIdentityProvider)) {
-            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-            String error = response.readEntity(String.class);
-            assertTrue(error.contains("Empty Space not allowed."));
-        }
-    }
-
-    @Test
-    public void testCreateWithBasicAuth() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-        newIdentityProvider.getConfig().put("clientAuthMethod",OIDCLoginProtocol.CLIENT_SECRET_BASIC);
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("new-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        assertNotNull(representation.getInternalId());
-        assertEquals("new-identity-provider", representation.getAlias());
-        assertEquals("oidc", representation.getProviderId());
-        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        assertEquals("clientId", representation.getConfig().get("clientId"));
-        assertEquals(ComponentRepresentation.SECRET_VALUE, representation.getConfig().get("clientSecret"));
-        assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, representation.getConfig().get("clientAuthMethod"));
-
-        assertTrue(representation.isEnabled());
-        assertFalse(representation.isStoreToken());
-        assertFalse(representation.isTrustEmail());
-
-        assertEquals("some secret value", testingClient.testing("admin-client-test").getIdentityProviderConfig("new-identity-provider").get("clientSecret"));
-
-        IdentityProviderRepresentation rep = realm.identityProviders().findAll().stream().filter(i -> i.getAlias().equals("new-identity-provider")).findFirst().get();
-        assertEquals(ComponentRepresentation.SECRET_VALUE, rep.getConfig().get("clientSecret"));
-    }
-
-    @Test
-    public void testCreateWithJWT() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientAuthMethod", OIDCLoginProtocol.PRIVATE_KEY_JWT);
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("new-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        assertNotNull(representation.getInternalId());
-        assertEquals("new-identity-provider", representation.getAlias());
-        assertEquals("oidc", representation.getProviderId());
-        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        assertEquals("clientId", representation.getConfig().get("clientId"));
-        assertNull(representation.getConfig().get("clientSecret"));
-        assertEquals(OIDCLoginProtocol.PRIVATE_KEY_JWT, representation.getConfig().get("clientAuthMethod"));
-        assertNull(representation.getConfig().get("jwtX509HeadersEnabled"));
-        assertTrue(representation.isEnabled());
-        assertFalse(representation.isStoreToken());
-        assertFalse(representation.isTrustEmail());
-    }
-
-    @Test
-    public void testCreateWithJWTAndX509Headers() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("new-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientAuthMethod", OIDCLoginProtocol.PRIVATE_KEY_JWT);
-        newIdentityProvider.getConfig().put("jwtX509HeadersEnabled", "true");
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("new-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        assertNotNull(representation.getInternalId());
-        assertEquals("new-identity-provider", representation.getAlias());
-        assertEquals("oidc", representation.getProviderId());
-        assertEquals("IMPORT", representation.getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        assertEquals("clientId", representation.getConfig().get("clientId"));
-        assertNull(representation.getConfig().get("clientSecret"));
-        assertEquals(OIDCLoginProtocol.PRIVATE_KEY_JWT, representation.getConfig().get("clientAuthMethod"));
-        assertEquals("true", representation.getConfig().get("jwtX509HeadersEnabled"));
-        assertTrue(representation.isEnabled());
-        assertFalse(representation.isStoreToken());
-        assertFalse(representation.isTrustEmail());
-    }
-
-    @Test
-    public void testUpdate() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("update-identity-provider", "oidc");
-
-        newIdentityProvider.getConfig().put(IdentityProviderModel.SYNC_MODE, "IMPORT");
-        newIdentityProvider.getConfig().put("clientId", "clientId");
-        newIdentityProvider.getConfig().put("clientSecret", "some secret value");
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("update-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        assertEquals("update-identity-provider", representation.getAlias());
-
-        representation.setAlias("changed-alias");
-        representation.setEnabled(false);
-        representation.setStoreToken(true);
-        representation.getConfig().put("clientId", "changedClientId");
-
-        identityProviderResource.update(representation);
-        AdminEventRepresentation event = assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.identityProviderPath("update-identity-provider"), representation, ResourceType.IDENTITY_PROVIDER);
-        assertFalse(event.getRepresentation().contains("some secret value"));
-        assertTrue(event.getRepresentation().contains(ComponentRepresentation.SECRET_VALUE));
-
-        identityProviderResource = realm.identityProviders().get(representation.getInternalId());
-
-        assertNotNull(identityProviderResource);
-
-        representation = identityProviderResource.toRepresentation();
-
-        assertFalse(representation.isEnabled());
-        assertTrue(representation.isStoreToken());
-        assertEquals("changedClientId", representation.getConfig().get("clientId"));
-
-        assertEquals("some secret value", testingClient.testing("admin-client-test").getIdentityProviderConfig("changed-alias").get("clientSecret"));
-
-        representation.getConfig().put("clientSecret", "${vault.key}");
-        identityProviderResource.update(representation);
-        event = assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.identityProviderPath(representation.getInternalId()), representation, ResourceType.IDENTITY_PROVIDER);
-        assertThat(event.getRepresentation(), containsString("${vault.key}"));
-        assertThat(event.getRepresentation(), not(containsString(ComponentRepresentation.SECRET_VALUE)));
-
-        assertThat(identityProviderResource.toRepresentation().getConfig(), hasEntry("clientSecret", "${vault.key}"));
-        assertEquals("${vault.key}", testingClient.testing("admin-client-test").getIdentityProviderConfig("changed-alias").get("clientSecret"));
-    }
-
-    @Test
-    public void failUpdateInvalidUrl() throws Exception {
-        try (RealmAttributeUpdater rau = new RealmAttributeUpdater(realm)
-                .updateWith(r -> r.setSslRequired(SslRequired.ALL.name()))
-                .update()
-        ) {
-            assertAdminEvents.poll(); // realm update
-            IdentityProviderRepresentation representation = createRep(UUID.randomUUID().toString(), "oidc");
-
-            representation.getConfig().put("clientId", "clientId");
-            representation.getConfig().put("clientSecret", "some secret value");
-
-            create(representation);
-
-            IdentityProviderResource resource = this.realm.identityProviders().get(representation.getAlias());
-            representation = resource.toRepresentation();
-
-            OIDCIdentityProviderConfigRep oidcConfig = new OIDCIdentityProviderConfigRep(representation);
-
-            oidcConfig.setAuthorizationUrl("invalid://test");
-            try {
-                resource.update(representation);
-                fail("Invalid URL");
-            } catch (Exception e) {
-                assertTrue(e instanceof  ClientErrorException);
-                Response response = ClientErrorException.class.cast(e).getResponse();
-                assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
-                assertEquals("The url [authorization_url] is malformed", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl("http://test");
-
-            try {
-                resource.update(representation);
-                fail("Invalid URL");
-            } catch (Exception e) {
-                assertTrue(e instanceof  ClientErrorException);
-                Response response = ClientErrorException.class.cast(e).getResponse();
-                assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
-                assertEquals("The url [token_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl("http://test");
-            try {
-                resource.update(representation);
-                fail("Invalid URL");
-            } catch (Exception e) {
-                assertTrue(e instanceof  ClientErrorException);
-                Response response = ClientErrorException.class.cast(e).getResponse();
-                assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
-                assertEquals("The url [jwks_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl(null);
-            oidcConfig.setLogoutUrl("http://test");
-            try {
-                resource.update(representation);
-                fail("Invalid URL");
-            } catch (Exception e) {
-                assertTrue(e instanceof  ClientErrorException);
-                Response response = ClientErrorException.class.cast(e).getResponse();
-                assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
-                assertEquals("The url [logout_url] requires secure connections", error.getErrorMessage());
-            }
-
-            oidcConfig.setAuthorizationUrl(null);
-            oidcConfig.setTokenUrl(null);
-            oidcConfig.setJwksUrl(null);
-            oidcConfig.setLogoutUrl(null);
-            oidcConfig.setUserInfoUrl("http://localhost");
-
-            try {
-                resource.update(representation);
-                fail("Invalid URL");
-            } catch (Exception e) {
-                assertTrue(e instanceof  ClientErrorException);
-                Response response = ClientErrorException.class.cast(e).getResponse();
-                assertEquals( Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
-                ErrorRepresentation error = ((ClientErrorException) e).getResponse().readEntity(ErrorRepresentation.class);
-                assertEquals("The url [userinfo_url] requires secure connections", error.getErrorMessage());
-            }
-
-            rau.updateWith(r -> r.setSslRequired(SslRequired.EXTERNAL.name())).update();
-            resource.update(representation);
-        }
-    }
-
-    @Test
-    public void testRemove() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("remove-identity-provider", "saml");
-
-        create(newIdentityProvider);
-
-        IdentityProviderResource identityProviderResource = realm.identityProviders().get("remove-identity-provider");
-
-        assertNotNull(identityProviderResource);
-
-        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
-
-        assertNotNull(representation);
-
-        identityProviderResource.remove();
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.identityProviderPath("remove-identity-provider"), ResourceType.IDENTITY_PROVIDER);
-
-        try {
-            realm.identityProviders().get("remove-identity-provider").toRepresentation();
-            Assert.fail("Not expected to found");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void testNotAvailableFromRealRepresentation() {
-        IdentityProviderRepresentation newIdentityProvider = createRep("remove-identity-provider", "saml");
-
-        create(newIdentityProvider);
-
-        RealmRepresentation rep = this.realm.toRepresentation();
-        assertNull(rep.getIdentityProviders());
-        assertNull(rep.getIdentityProviderMappers());
-    }
-
-    private void create(IdentityProviderRepresentation idpRep) {
-        Response response = realm.identityProviders().create(idpRep);
-        Assert.assertNotNull(ApiUtil.getCreatedId(response));
-        response.close();
-
-        getCleanup().addIdentityProviderAlias(idpRep.getAlias());
-
-        String secret = idpRep.getConfig() != null ? idpRep.getConfig().get("clientSecret") : null;
-        idpRep = StripSecretsUtils.stripSecrets(null, idpRep);
-        // if legacy hide on login page attribute was used, the attr will be removed when converted to model
-        idpRep.setHideOnLogin(Boolean.parseBoolean(idpRep.getConfig().remove(IdentityProviderModel.LEGACY_HIDE_ON_LOGIN_ATTR)));
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.identityProviderPath(idpRep.getAlias()), idpRep, ResourceType.IDENTITY_PROVIDER);
-
-        if (secret != null) {
-            idpRep.getConfig().put("clientSecret", secret);
-        }
-    }
-
-    private IdentityProviderRepresentation createRep(String id, String providerId) {
-        return createRep(id, providerId,true, null);
-    }
-
-    private IdentityProviderRepresentation createRep(String id, String providerId,boolean enabled, Map<String, String> config) {
-        return createRep(id, id, providerId, enabled, config);
-    }
-
-    private IdentityProviderRepresentation createRep(String id, String displayName, String providerId, boolean enabled, Map<String, String> config) {
-        IdentityProviderRepresentation idp = new IdentityProviderRepresentation();
-
-        idp.setAlias(id);
-        idp.setDisplayName(displayName);
-        idp.setProviderId(providerId);
-        idp.setEnabled(enabled);
-        if (config != null) {
-            idp.setConfig(config);
-        }
-        return idp;
-    }
-
-    @Test
-    public void testMapperTypes() {
-
-        IdentityProviderResource provider;
-        Map<String, IdentityProviderMapperTypeRepresentation> mapperTypes;
-
-        create(createRep("google", "google"));
-        provider = realm.identityProviders().get("google");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "google-user-attribute-mapper", "oidc-username-idp-mapper");
-
-        create(createRep("facebook", "facebook"));
-        provider = realm.identityProviders().get("facebook");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "facebook-user-attribute-mapper", "oidc-username-idp-mapper");
-
-        create(createRep("github", "github"));
-        provider = realm.identityProviders().get("github");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "github-user-attribute-mapper", "oidc-username-idp-mapper");
-
-        create(createRep("twitter", "twitter"));
-        provider = realm.identityProviders().get("twitter");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "oidc-username-idp-mapper");
-
-        /*
-        // disabled to prevent 429 rate limiting on GitHub actions for LinkedIn's
-        // https://www.linkedin.com/oauth/.well-known/openid-configuration discovery URL
-        create(createRep("linkedin-openid-connect", "linkedin-openid-connect"));
-        provider = realm.identityProviders().get("linkedin-openid-connect");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "linkedin-user-attribute-mapper", "oidc-username-idp-mapper");
-        */
-
-        create(createRep("microsoft", "microsoft"));
-        provider = realm.identityProviders().get("microsoft");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "microsoft-user-attribute-mapper", "oidc-username-idp-mapper");
-
-        create(createRep("stackoverflow", "stackoverflow"));
-        provider = realm.identityProviders().get("stackoverflow");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "stackoverflow-user-attribute-mapper", "oidc-username-idp-mapper");
-
-        create(createRep("keycloak-oidc", "keycloak-oidc"));
-        provider = realm.identityProviders().get("keycloak-oidc");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "keycloak-oidc-role-to-role-idp-mapper", "oidc-user-attribute-idp-mapper", "oidc-role-idp-mapper", "oidc-username-idp-mapper", "oidc-advanced-group-idp-mapper", "oidc-advanced-role-idp-mapper", "oidc-user-session-note-idp-mapper");
-
-        create(createRep("oidc", "oidc"));
-        provider = realm.identityProviders().get("oidc");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "oidc-user-attribute-idp-mapper", "oidc-role-idp-mapper", "oidc-username-idp-mapper", "oidc-advanced-group-idp-mapper", "oidc-advanced-role-idp-mapper", "oidc-user-session-note-idp-mapper");
-
-        create(createRep("saml", "saml"));
-        provider = realm.identityProviders().get("saml");
-        mapperTypes = provider.getMapperTypes();
-        assertMapperTypes(mapperTypes, "saml-user-attribute-idp-mapper", "saml-role-idp-mapper", "saml-username-idp-mapper", "saml-advanced-role-idp-mapper", "saml-advanced-group-idp-mapper", "saml-xpath-attribute-idp-mapper");
-    }
-
-    @Test
-    public void mapperTypesCanBeOverwritten() {
-        String kcOidcProviderId = "keycloak-oidc";
-        create(createRep(kcOidcProviderId, kcOidcProviderId));
-
-        String testProviderId = OverwrittenMappersTestIdentityProviderFactory.PROVIDER_ID;
-        create(createRep(testProviderId, testProviderId));
-
-        /*
-         * in the test provider, we have overwritten the mapper types to be the same as supported by "keycloak-oidc", so
-         * the "keycloak-oidc" mappers are the expected mappers for the test provider
-         */
-        IdentityProviderResource kcOidcProvider = realm.identityProviders().get(kcOidcProviderId);
-        Set<String> expectedMapperTypes = kcOidcProvider.getMapperTypes().keySet();
-
-        IdentityProviderResource testProvider = realm.identityProviders().get(testProviderId);
-        Set<String> actualMapperTypes = testProvider.getMapperTypes().keySet();
-
-        assertThat(actualMapperTypes, equalTo(expectedMapperTypes));
-    }
-
-    private void assertMapperTypes(Map<String, IdentityProviderMapperTypeRepresentation> mapperTypes, String ... mapperIds) {
-        Set<String> expected = new HashSet<>();
-        expected.add("hardcoded-user-session-attribute-idp-mapper");
-        expected.add("oidc-hardcoded-role-idp-mapper");
-        expected.add("oidc-hardcoded-group-idp-mapper");
-        expected.add("hardcoded-attribute-idp-mapper");
-        expected.add("multi-valued-test-idp-mapper");
-        expected.addAll(Arrays.asList(mapperIds));
-
-        Assert.assertEquals("mapperTypes", expected, mapperTypes.keySet());
-    }
-
-    @Test
-    public void testNoExport() {
-        create(createRep("keycloak-oidc", "keycloak-oidc"));
-
-        Response response = realm.identityProviders().get("keycloak-oidc").export("json");
-        Assert.assertEquals("status", 204, response.getStatus());
-        String body = response.readEntity(String.class);
-        Assert.assertNull("body", body);
-        response.close();
-    }
-
-    @Test
-    public void importShouldFailDueAliasWithSpace() {
-
-        Map<String, Object> data = new HashMap<>();
-        data.put("providerId", "saml");
-        data.put("alias", "Alias With Space");
-        data.put("fromUrl", "http://");
-
-       assertThrows(BadRequestException.class, () -> {
-            realm.identityProviders().importFrom(data);
-        });
-
-    }
-
-    @Test
-    public void testSamlImportAndExport() throws URISyntaxException, IOException, ParsingException {
-        testSamlImport("saml-idp-metadata.xml", true);
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        Response response = realm.identityProviders().get("saml").export("xml");
-        Assert.assertEquals(200, response.getStatus());
-        String body = response.readEntity(String.class);
-        response.close();
-
-        assertSamlExport(body, true);
-    }
-
-   @Test
-    public void testSamlImportWithBom() throws URISyntaxException, IOException, ParsingException {
-        testSamlImport("saml-idp-metadata_utf8_bom.xml", true);
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        Response response = realm.identityProviders().get("saml").export("xml");
-        Assert.assertEquals(200, response.getStatus());
-        String body = response.readEntity(String.class);
-        response.close();
-
-        assertSamlExport(body, true);
-    }
-
-    @Test
-    public void testSamlImportAndExportDifferentBindings() throws URISyntaxException, IOException, ParsingException {
-        testSamlImport("saml-idp-metadata-different-bindings.xml", false);
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        try (Response response = realm.identityProviders().get("saml").export("xml")) {
-            Assert.assertEquals(200, response.getStatus());
-            String body = response.readEntity(String.class);
-            assertSamlExport(body, false);
-        }
-    }
-
-    @Test
-    public void testSamlImportWithAnyEncryptionMethod() throws URISyntaxException, IOException, ParsingException {
-        testSamlImport("saml-idp-metadata-encryption-methods.xml", true);
-    }
-
-    private void testSamlImport(String fileName, boolean postBindingResponse) throws URISyntaxException, IOException, ParsingException {
-        // Use import-config to convert IDPSSODescriptor file into key value pairs
-        // to use when creating a SAML Identity Provider
-        MultipartFormDataOutput form = new MultipartFormDataOutput();
-        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
-
-        URL idpMeta = getClass().getClassLoader().getResource("admin-test/"+fileName);
-        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
-        String body = new String(content, Charset.forName("utf-8"));
-        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, fileName);
-
-        Map<String, String> result = realm.identityProviders().importFrom(form);
-        assertSamlImport(result, SIGNING_CERT_1, true, postBindingResponse);
-
-        // Create new SAML identity provider using configuration retrieved from import-config
-        create(createRep("saml", "saml",true, result));
-
-        IdentityProviderResource provider = realm.identityProviders().get("saml");
-        IdentityProviderRepresentation rep = provider.toRepresentation();
-        assertCreatedSamlIdp(rep, true, postBindingResponse);
-
-        // Now list the providers - we should see the one just created
-        List<IdentityProviderRepresentation> providers = realm.identityProviders().findAll();
-        Assert.assertNotNull("identityProviders not null", providers);
-        Assert.assertEquals("identityProviders instance count", 1, providers.size());
-        assertEqual(rep, providers.get(0));
-
-    }
-
-    @Test
-    public void testSamlImportAndExportDisabled() throws URISyntaxException, IOException, ParsingException {
-
-        // Use import-config to convert IDPSSODescriptor file into key value pairs
-        // to use when creating a SAML Identity Provider
-        MultipartFormDataOutput form = new MultipartFormDataOutput();
-        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
-
-        URL idpMeta = getClass().getClassLoader().getResource("admin-test/saml-idp-metadata-disabled.xml");
-        byte[] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
-        String body = new String(content, Charset.forName("utf-8"));
-        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata-disabled.xml");
-
-        Map<String, String> result = realm.identityProviders().importFrom(form);
-        assertSamlImport(result, SIGNING_CERT_1, false, true);
-
-        // Create new SAML identity provider using configuration retrieved from import-config
-        create(createRep("saml", "saml", false, result));
-
-        IdentityProviderResource provider = realm.identityProviders().get("saml");
-        IdentityProviderRepresentation rep = provider.toRepresentation();
-        assertCreatedSamlIdp(rep, false, true);
-
-    }
-
-
-    @Test
-    public void testSamlImportAndExportMultipleSigningKeys() throws URISyntaxException, IOException, ParsingException {
-
-        // Use import-config to convert IDPSSODescriptor file into key value pairs
-        // to use when creating a SAML Identity Provider
-        MultipartFormDataOutput form = new MultipartFormDataOutput();
-        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
-
-        URL idpMeta = getClass().getClassLoader().getResource("admin-test/saml-idp-metadata-two-signing-certs.xml");
-        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
-        String body = new String(content, Charset.forName("utf-8"));
-        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata-two-signing-certs");
-
-        Map<String, String> result = realm.identityProviders().importFrom(form);
-        assertSamlImport(result, SIGNING_CERT_1 + "," + SIGNING_CERT_2, true, true);
-
-        // Create new SAML identity provider using configuration retrieved from import-config
-        create(createRep("saml", "saml",true, result));
-
-        IdentityProviderResource provider = realm.identityProviders().get("saml");
-        IdentityProviderRepresentation rep = provider.toRepresentation();
-        assertCreatedSamlIdp(rep, true, true);
-
-        // Now list the providers - we should see the one just created
-        List<IdentityProviderRepresentation> providers = realm.identityProviders().findAll();
-        Assert.assertNotNull("identityProviders not null", providers);
-        Assert.assertEquals("identityProviders instance count", 1, providers.size());
-        assertEqual(rep, providers.get(0));
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        Response response = realm.identityProviders().get("saml").export("xml");
-        Assert.assertEquals(200, response.getStatus());
-        body = response.readEntity(String.class);
-        response.close();
-
-        assertSamlExport(body, true);
-    }
-
-    @Test
-    public void testMappers() {
-        create(createRep("google", "google"));
-
-        IdentityProviderResource provider = realm.identityProviders().get("google");
-
-        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
-        mapper.setIdentityProviderAlias("google");
-        mapper.setName("my_mapper");
-        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
-        Map<String, String> config = new HashMap<>();
-        config.put("role", "offline_access");
-        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
-        mapper.setConfig(config);
-
-        // createRep and add mapper
-        Response response = provider.addMapper(mapper);
-        String id = ApiUtil.getCreatedId(response);
-        Assert.assertNotNull(id);
-        response.close();
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.identityProviderMapperPath("google", id), mapper, ResourceType.IDENTITY_PROVIDER_MAPPER);
-
-        // list mappers
-        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
-        Assert.assertEquals("mappers count", 1, mappers.size());
-        Assert.assertEquals("newly created mapper id", id, mappers.get(0).getId());
-
-        // get mapper
-        mapper = provider.getMapperById(id);
-        Assert.assertEquals("INHERIT", mappers.get(0).getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        Assert.assertNotNull("mapperById not null", mapper);
-        Assert.assertEquals("mapper id", id, mapper.getId());
-        Assert.assertNotNull("mapper.config exists", mapper.getConfig());
-        Assert.assertEquals("config retained", "offline_access", mapper.getConfig().get("role"));
-
-        // add duplicate mapper
-        Response error = provider.addMapper(mapper);
-        Assert.assertEquals("mapper unique name", 400, error.getStatus());
-        error.close();
-
-        // update mapper
-        mapper.getConfig().put("role", "master-realm.manage-realm");
-        provider.update(id, mapper);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.identityProviderMapperPath("google", id), mapper, ResourceType.IDENTITY_PROVIDER_MAPPER);
-
-        mapper = provider.getMapperById(id);
-        Assert.assertNotNull("mapperById not null", mapper);
-        Assert.assertEquals("config changed", "master-realm.manage-realm", mapper.getConfig().get("role"));
-
-        // delete mapper
-        provider.delete(id);
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.identityProviderMapperPath("google", id), ResourceType.IDENTITY_PROVIDER_MAPPER);
-        try {
-            provider.getMapperById(id);
-            Assert.fail("Should fail with NotFoundException");
-        } catch (NotFoundException e) {
-            // Expected
-        }
-    }
-
-    // KEYCLOAK-4962
-    @Test
-    public void testUpdateProtocolMappers() {
-        create(createRep("google2", "google"));
-
-        IdentityProviderResource provider = realm.identityProviders().get("google2");
-
-        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
-        mapper.setIdentityProviderAlias("google2");
-        mapper.setName("my_mapper");
-        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
-        Map<String, String> config = new HashMap<>();
-        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
-        config.put("role", "");
-        mapper.setConfig(config);
-
-        Response response = provider.addMapper(mapper);
-        String mapperId = ApiUtil.getCreatedId(response);
-
-
-        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
-        assertEquals(1, mappers.size());
-        assertEquals(1, mappers.get(0).getConfig().size());
-
-        mapper = provider.getMapperById(mapperId);
-        mapper.getConfig().put("role", "offline_access");
-
-        provider.update(mapperId, mapper);
-
-        mappers = provider.getMappers();
-        assertEquals("INHERIT", mappers.get(0).getConfig().get(IdentityProviderMapperModel.SYNC_MODE));
-        assertEquals(1, mappers.size());
-        assertEquals(2, mappers.get(0).getConfig().size());
-        assertEquals("offline_access", mappers.get(0).getConfig().get("role"));
-    }
-
-    // KEYCLOAK-7872
-    @Test
-    public void testDeleteProtocolMappersAfterDeleteIdentityProvider() {
-        create(createRep("google3", "google"));
-
-        IdentityProviderResource provider = realm.identityProviders().get("google3");
-
-        IdentityProviderMapperRepresentation mapper = new IdentityProviderMapperRepresentation();
-        mapper.setIdentityProviderAlias("google3");
-        mapper.setName("my_mapper");
-        mapper.setIdentityProviderMapper("oidc-hardcoded-role-idp-mapper");
-        Map<String, String> config = new HashMap<>();
-        config.put(IdentityProviderMapperModel.SYNC_MODE, IdentityProviderMapperSyncMode.INHERIT.toString());
-        config.put("role", "offline_access");
-        mapper.setConfig(config);
-
-        Response response = provider.addMapper(mapper);
-
-        List<IdentityProviderMapperRepresentation> mappers = provider.getMappers();
-        assertThat(mappers, hasSize(1));
-
-        assertAdminEvents.clear();
-
-        provider.remove();
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.identityProviderPath("google3"), ResourceType.IDENTITY_PROVIDER);
-
-        create(createRep("google3", "google"));
-
-        IdentityProviderResource newProvider = realm.identityProviders().get("google3");
-
-        assertThat(newProvider.getMappers(), empty());
-    }
-
-    @Test
-    public void testInstalledIdentityProviders() {
-        Response response = realm.identityProviders().getIdentityProviders("oidc");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        Map<String, String> body = response.readEntity(Map.class);
-        assertProviderInfo(body, "oidc", "OpenID Connect v1.0");
-
-        response = realm.identityProviders().getIdentityProviders("keycloak-oidc");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "keycloak-oidc", "Keycloak OpenID Connect");
-
-        response = realm.identityProviders().getIdentityProviders("saml");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "saml", "SAML v2.0");
-
-        response = realm.identityProviders().getIdentityProviders("google");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "google", "Google");
-
-        response = realm.identityProviders().getIdentityProviders("facebook");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "facebook", "Facebook");
-
-        response = realm.identityProviders().getIdentityProviders("github");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "github", "GitHub");
-
-        response = realm.identityProviders().getIdentityProviders("twitter");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "twitter", "Twitter");
-
-        response = realm.identityProviders().getIdentityProviders("linkedin-openid-connect");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "linkedin-openid-connect", "LinkedIn");
-
-        response = realm.identityProviders().getIdentityProviders("microsoft");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "microsoft", "Microsoft");
-
-        response = realm.identityProviders().getIdentityProviders("stackoverflow");
-        Assert.assertEquals("Status", 200, response.getStatus());
-        body = response.readEntity(Map.class);
-        assertProviderInfo(body, "stackoverflow", "StackOverflow");
-
-        response = realm.identityProviders().getIdentityProviders("nonexistent");
-        Assert.assertEquals("Status", 400, response.getStatus());
-    }
-
-    private void assertEqual(IdentityProviderRepresentation expected, IdentityProviderRepresentation actual) {
-        //System.out.println("expected: " + expected);
-        //System.out.println("actual: " + actual);
-        Assert.assertNotNull("expected IdentityProviderRepresentation not null", expected);
-        Assert.assertNotNull("actual IdentityProviderRepresentation not null", actual);
-        Assert.assertEquals("internalId", expected.getInternalId(), actual.getInternalId());
-        Assert.assertEquals("alias", expected.getAlias(), actual.getAlias());
-        Assert.assertEquals("providerId", expected.getProviderId(), actual.getProviderId());
-        Assert.assertEquals("enabled", expected.isEnabled(), actual.isEnabled());
-        Assert.assertEquals("hideOnLogin", expected.isHideOnLogin(), actual.isHideOnLogin());
-        Assert.assertEquals("firstBrokerLoginFlowAlias", expected.getFirstBrokerLoginFlowAlias(), actual.getFirstBrokerLoginFlowAlias());
-        Assert.assertEquals("config", expected.getConfig(), actual.getConfig());
-    }
-
-    private void assertCreatedSamlIdp(IdentityProviderRepresentation idp, boolean enabled, boolean postBindingResponse) {
-        //System.out.println("idp: " + idp);
-        Assert.assertNotNull("IdentityProviderRepresentation not null", idp);
-        Assert.assertNotNull("internalId", idp.getInternalId());
-        Assert.assertEquals("alias", "saml", idp.getAlias());
-        Assert.assertEquals("providerId", "saml", idp.getProviderId());
-        Assert.assertEquals("enabled",enabled, idp.isEnabled());
-        Assert.assertTrue("hideOnLogin", idp.isHideOnLogin());
-        Assert.assertNull("firstBrokerLoginFlowAlias", idp.getFirstBrokerLoginFlowAlias());
-        assertSamlConfig(idp.getConfig(), postBindingResponse, false);
-    }
-
-    private void assertSamlConfig(Map<String, String> config, boolean postBindingResponse, boolean hasHideOnLoginPage) {
-        // import endpoint simply converts IDPSSODescriptor into key value pairs.
-        // check that saml-idp-metadata.xml was properly converted into key value pairs
-        //System.out.println(config);
-        List<String> keys = new ArrayList<>(List.of("syncMode",
-                "validateSignature",
-                "singleLogoutServiceUrl",
-                "postBindingLogout",
-                "postBindingResponse",
-                "artifactBindingResponse",
-                "postBindingAuthnRequest",
-                "singleSignOnServiceUrl",
-                "artifactResolutionServiceUrl",
-                "wantAuthnRequestsSigned",
-                "nameIDPolicyFormat",
-                "signingCertificate",
-                "addExtensionsElementWithKeyInfo",
-                "loginHint",
-                "idpEntityId"
-        ));
-        if (hasHideOnLoginPage) {
-            keys.add("hideOnLoginPage");
-        }
-        assertThat(config.keySet(), containsInAnyOrder(keys.toArray()));
-        assertThat(config, hasEntry("validateSignature", "true"));
-        assertThat(config, hasEntry("singleLogoutServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml"));
-        assertThat(config, hasEntry("artifactResolutionServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml/resolve"));
-        assertThat(config, hasEntry("postBindingResponse", Boolean.toString(postBindingResponse)));
-        assertThat(config, hasEntry("artifactBindingResponse", "false"));
-        assertThat(config, hasEntry("postBindingAuthnRequest", Boolean.toString(postBindingResponse)));
-        assertThat(config, hasEntry("singleSignOnServiceUrl", "http://localhost:8080/auth/realms/master/protocol/saml"));
-        assertThat(config, hasEntry("wantAuthnRequestsSigned", "true"));
-        assertThat(config, hasEntry("addExtensionsElementWithKeyInfo", "false"));
-        assertThat(config, hasEntry("nameIDPolicyFormat", "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"));
-        if (hasHideOnLoginPage) {
-            assertThat(config, hasEntry("hideOnLoginPage", "true"));
-        }
-        assertThat(config, hasEntry("idpEntityId", "http://localhost:8080/auth/realms/master"));
-        assertThat(config, hasEntry(is("signingCertificate"), notNullValue()));
-    }
-
-    private void assertSamlImport(Map<String, String> config, String expectedSigningCertificates, boolean enabled, boolean postBindingResponse) {
-        //firtsly check and remove enabledFromMetadata from config
-        boolean enabledFromMetadata = Boolean.valueOf(config.get(SAMLIdentityProviderConfig.ENABLED_FROM_METADATA));
-        config.remove(SAMLIdentityProviderConfig.ENABLED_FROM_METADATA);
-        Assert.assertEquals(enabledFromMetadata,enabled);
-        assertSamlConfig(config, postBindingResponse, true);
-        assertThat(config, hasEntry("signingCertificate", expectedSigningCertificates));
-    }
-
-    private void assertSamlExport(String body, boolean postBindingResponse) throws ParsingException, URISyntaxException {
-        //System.out.println(body);
-
-        Object entBody = SAMLParser.getInstance().parse(
-                new ByteArrayInputStream(body.getBytes(Charset.forName("utf-8"))));
-
-        Assert.assertEquals("Parsed export type", EntityDescriptorType.class, entBody.getClass());
-        EntityDescriptorType entity = (EntityDescriptorType) entBody;
-
-        Assert.assertEquals("EntityID", oauth.AUTH_SERVER_ROOT + "/realms/admin-client-test", entity.getEntityID());
-
-        Assert.assertNotNull("ChoiceType not null", entity.getChoiceType());
-        Assert.assertEquals("ChoiceType.size", 1, entity.getChoiceType().size());
-
-        List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = entity.getChoiceType().get(0).getDescriptors();
-        Assert.assertNotNull("Descriptors not null", descriptors);
-        Assert.assertEquals("Descriptors.size", 1, descriptors.size());
-
-        SPSSODescriptorType desc = descriptors.get(0).getSpDescriptor();
-        Assert.assertNotNull("SPSSODescriptor not null", desc);
-
-        Assert.assertTrue("AuthnRequestsSigned", desc.isAuthnRequestsSigned());
-
-        Set<String> expected = new HashSet<>(Arrays.asList(
-                "urn:oasis:names:tc:SAML:2.0:protocol"));
-
-        Set<String> actual = new HashSet<>(desc.getProtocolSupportEnumeration());
-
-        Assert.assertEquals("ProtocolSupportEnumeration", expected, actual);
-
-        Assert.assertNotNull("AssertionConsumerService not null", desc.getAssertionConsumerService());
-        Assert.assertEquals("AssertionConsumerService.size", 1, desc.getAssertionConsumerService().size());
-
-        IndexedEndpointType endpoint = desc.getAssertionConsumerService().get(0);
-
-        Assert.assertEquals("AssertionConsumerService.Location",
-                new URI(oauth.AUTH_SERVER_ROOT + "/realms/admin-client-test/broker/saml/endpoint"), endpoint.getLocation());
-        Assert.assertEquals("AssertionConsumerService.Binding",
-                postBindingResponse ? JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri() : JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri(),
-                endpoint.getBinding());
-        Assert.assertTrue("AssertionConsumerService.isDefault", endpoint.isIsDefault());
-
-
-        Assert.assertNotNull("SingleLogoutService not null", desc.getSingleLogoutService());
-        Assert.assertEquals("SingleLogoutService.size", 1, desc.getSingleLogoutService().size());
-
-        EndpointType sloEndpoint = desc.getSingleLogoutService().get(0);
-
-        Assert.assertEquals("SingleLogoutService.Location",
-                new URI(oauth.AUTH_SERVER_ROOT + "/realms/admin-client-test/broker/saml/endpoint"), sloEndpoint.getLocation());
-        Assert.assertEquals("SingleLogoutService.Binding",
-                new URI("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"), sloEndpoint.getBinding());
-
-        Assert.assertNotNull("KeyDescriptor not null", desc.getKeyDescriptor());
-        Assert.assertEquals("KeyDescriptor.size", 1, desc.getKeyDescriptor().size());
-        KeyDescriptorType keyDesc = desc.getKeyDescriptor().get(0);
-        assertThat(keyDesc, notNullValue());
-        assertThat(keyDesc.getUse(), equalTo(KeyTypes.SIGNING));
-        NodeList cert = keyDesc.getKeyInfo().getElementsByTagNameNS(XMLSignature.XMLNS, "X509Certificate");
-        assertThat("KeyDescriptor.Signing.Cert existence", cert.getLength(), is(1));
-    }
-
-    private void assertProviderInfo(Map<String, String> info, String id, String name) {
-        System.out.println(info);
-        Assert.assertEquals("id", id, info.get("id"));
-        Assert.assertEquals("name", name, info.get("name"));
-    }
-
-    @Test
-    public void testSamlExportSignatureOff() throws URISyntaxException, IOException, ConfigurationException, ParsingException, ProcessingException {
-        // Use import-config to convert IDPSSODescriptor file into key value pairs
-        // to use when creating a SAML Identity Provider
-        MultipartFormDataOutput form = new MultipartFormDataOutput();
-        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
-
-        URL idpMeta = getClass().getClassLoader().getResource("admin-test/saml-idp-metadata.xml");
-        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
-        String body = new String(content, Charset.forName("utf-8"));
-        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata.xml");
-
-        Map<String, String> result = realm.identityProviders().importFrom(form);
-
-        // Explicitly disable SP Metadata Signature
-        result.put(SAMLIdentityProviderConfig.SIGN_SP_METADATA, "false");
-
-        // Create new SAML identity provider using configuration retrieved from import-config
-        IdentityProviderRepresentation idpRep = createRep("saml", "saml", true, result);
-        create(idpRep);
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        Response response = realm.identityProviders().get("saml").export("xml");
-        Assert.assertEquals(200, response.getStatus());
-        body = response.readEntity(String.class);
-        response.close();
-
-        Document document = DocumentUtil.getDocument(body);
-        Element signatureElement = DocumentUtil.getDirectChildElement(document.getDocumentElement(), XMLDSIG_NSURI.get(), "Signature");
-        Assert.assertNull(signatureElement);
-    }
-
-    @Test
-    public void testSamlExportSignatureOn() throws URISyntaxException, IOException, ConfigurationException, ParsingException, ProcessingException, CertificateEncodingException {
-        // Use import-config to convert IDPSSODescriptor file into key value pairs
-        // to use when creating a SAML Identity Provider
-        MultipartFormDataOutput form = new MultipartFormDataOutput();
-        form.addFormData("providerId", "saml", MediaType.TEXT_PLAIN_TYPE);
-
-        URL idpMeta = getClass().getClassLoader().getResource("admin-test/saml-idp-metadata.xml");
-        byte [] content = Files.readAllBytes(Paths.get(idpMeta.toURI()));
-        String body = new String(content, Charset.forName("utf-8"));
-        form.addFormData("file", body, MediaType.APPLICATION_XML_TYPE, "saml-idp-metadata.xml");
-
-        Map<String, String> result = realm.identityProviders().importFrom(form);
-
-        // Explicitly enable SP Metadata Signature
-        result.put(SAMLIdentityProviderConfig.SIGN_SP_METADATA, "true");
-        result.put(SAMLIdentityProviderConfig.XML_SIG_KEY_INFO_KEY_NAME_TRANSFORMER, XmlKeyInfoKeyNameTransformer.CERT_SUBJECT.name());
-
-        // Create new SAML identity provider using configuration retrieved from import-config
-        IdentityProviderRepresentation idpRep = createRep("saml", "saml", true, result);
-        create(idpRep);
-
-        // Perform export, and make sure some of the values are like they're supposed to be
-        Response response = realm.identityProviders().get("saml").export("xml");
-        Assert.assertEquals(200, response.getStatus());
-        body = response.readEntity(String.class);
-        response.close();
-
-        Document document = DocumentUtil.getDocument(body);
-
-        Element signatureElement = DocumentUtil.getDirectChildElement(document.getDocumentElement(), XMLDSIG_NSURI.get(), "Signature");
-        assertThat("Signature not null", signatureElement, notNullValue());
-
-        Element keyInfoElement = DocumentUtil.getDirectChildElement(signatureElement, XMLDSIG_NSURI.get(), "KeyInfo");
-        assertThat("KeyInfo not null", keyInfoElement, notNullValue());
-
-        Element x509DataElement = DocumentUtil.getDirectChildElement(keyInfoElement, XMLDSIG_NSURI.get(), "X509Data");
-        assertThat("X509Data not null", x509DataElement, notNullValue());
-
-        Element x509CertificateElement = DocumentUtil.getDirectChildElement(x509DataElement, XMLDSIG_NSURI.get(), "X509Certificate");
-        assertThat("X509Certificate not null", x509CertificateElement, notNullValue());
-
-        Element keyNameElement = DocumentUtil.getDirectChildElement(keyInfoElement, XMLDSIG_NSURI.get(), "KeyName");
-        assertThat("KeyName not null", keyNameElement, notNullValue());
-
-        String activeSigCert = KeyUtils.findActiveSigningKey(realm, Constants.DEFAULT_SIGNATURE_ALGORITHM).getCertificate();
-        assertThat("activeSigCert not null", activeSigCert, notNullValue());
-
-        X509Certificate activeX509SigCert = XMLSignatureUtil.getX509CertificateFromKeyInfoString(activeSigCert);
-        assertThat("KeyName matches subject DN",
-                keyNameElement.getTextContent().trim(), equalTo(activeX509SigCert.getSubjectX500Principal().getName()));
-
-        assertThat("Signing cert matches active realm cert",
-                x509CertificateElement.getTextContent().trim(), equalTo(Base64.getEncoder().encodeToString(activeX509SigCert.getEncoded())));
-
-        PublicKey activePublicSigKey = activeX509SigCert.getPublicKey();
-        assertThat("Metadata signature is valid",
-                new SAML2Signature().validate(document, new HardcodedKeyLocator(activePublicSigKey)), is(true));
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IllegalAdminUpgradeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IllegalAdminUpgradeTest.java
deleted file mode 100644
index dcc99a795d2c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/IllegalAdminUpgradeTest.java
+++ /dev/null
@@ -1,793 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.admin;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.Constants;
-import org.keycloak.models.ImpersonationConstants;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.util.AdminClientUtil;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.Response;
-import java.util.LinkedList;
-import java.util.List;
-
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class IllegalAdminUpgradeTest extends AbstractKeycloakTest {
-
-    public static final String CLIENT_NAME = "application";
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmRepresentation testRealmRep = new RealmRepresentation();
-        testRealmRep.setId(TEST);
-        testRealmRep.setRealm(TEST);
-        testRealmRep.setEnabled(true);
-        testRealms.add(testRealmRep);
-    }
-
-    @Override
-    protected boolean isImportAfterEachMethod() {
-        return true;
-    }
-
-
-    public static void setupUsers(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        RealmModel master = session.realms().getRealmByName("master");
-        ClientModel realmAdminClient = realm.getClientByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID);
-        ClientModel realmMasterAdminClient = realm.getMasterAdminClient();
-        RoleModel realmManageUsers = realmAdminClient.getRole(AdminRoles.MANAGE_USERS);
-        RoleModel masterManageUsers = realmMasterAdminClient.getRole(AdminRoles.MANAGE_USERS);
-        RoleModel masterMasterManageUSers = master.getMasterAdminClient().getRole(AdminRoles.MANAGE_USERS);
-
-        UserModel realmUser = session.users().addUser(realm, "userAdmin");
-        realmUser.grantRole(realmManageUsers);
-        realmUser.setEnabled(true);
-        realmUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel masterUser = session.users().addUser(master, "userAdmin");
-        masterUser.grantRole(masterManageUsers);
-        masterUser.setEnabled(true);
-        masterUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel masterAdmin = session.users().addUser(master, "masterAdmin");
-        masterAdmin.grantRole(masterMasterManageUSers);
-        masterAdmin.setEnabled(true);
-        masterAdmin.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        UserModel user = session.users().addUser(master, "user");
-        user.grantRole(masterManageUsers);
-        user.setEnabled(true);
-        user.credentialManager().updateCredential(UserCredentialModel.password("password"));
-
-        user = session.users().addUser(realm, "user");
-        user.grantRole(realmManageUsers);
-        user.setEnabled(true);
-        user.credentialManager().updateCredential(UserCredentialModel.password("password"));
-    }
-
-    //@Test
-    public void testConsole() throws Exception {
-        testingClient.server().run(IllegalAdminUpgradeTest::setupUsers);
-        Thread.sleep(10000000);
-    }
-
-    @Test
-    public void testRestEvaluation() throws Exception {
-        testingClient.server().run(IllegalAdminUpgradeTest::setupUsers);
-
-        UserRepresentation realmUserAdmin = adminClient.realm(TEST).users().search("userAdmin").get(0);
-        UserRepresentation masterUserAdmin = adminClient.realm("master").users().search("userAdmin").get(0);
-        UserRepresentation realmUser = adminClient.realm(TEST).users().search("user").get(0);
-        UserRepresentation masterUser = adminClient.realm("master").users().search("user").get(0);
-
-        ClientRepresentation realmAdminClient = adminClient.realm(TEST).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-        RoleRepresentation realmManageAuthorization = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_AUTHORIZATION).toRepresentation();
-        RoleRepresentation realmViewAuthorization = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_AUTHORIZATION).toRepresentation();
-        RoleRepresentation realmManageClients = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_CLIENTS).toRepresentation();
-        RoleRepresentation realmViewClients = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_CLIENTS).toRepresentation();
-        RoleRepresentation realmManageEvents = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_EVENTS).toRepresentation();
-        RoleRepresentation realmViewEvents = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_EVENTS).toRepresentation();
-        RoleRepresentation realmManageIdentityProviders = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_IDENTITY_PROVIDERS).toRepresentation();
-        RoleRepresentation realmViewIdentityProviders = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_IDENTITY_PROVIDERS).toRepresentation();
-        RoleRepresentation realmManageRealm = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_REALM).toRepresentation();
-        RoleRepresentation realmViewRealm = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_REALM).toRepresentation();
-        RoleRepresentation realmImpersonate = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(ImpersonationConstants.IMPERSONATION_ROLE).toRepresentation();
-        RoleRepresentation realmManageUsers = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.MANAGE_USERS).toRepresentation();
-        RoleRepresentation realmViewUsers = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.VIEW_USERS).toRepresentation();
-        RoleRepresentation realmQueryUsers = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_USERS).toRepresentation();
-        RoleRepresentation realmQueryClients = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_CLIENTS).toRepresentation();
-        RoleRepresentation realmQueryGroups = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.QUERY_GROUPS).toRepresentation();
-        RoleRepresentation realmAdmin = adminClient.realm(TEST).clients().get(realmAdminClient.getId()).roles().get(AdminRoles.REALM_ADMIN).toRepresentation();
-
-        ClientRepresentation masterClient = adminClient.realm("master").clients().findByClientId(TEST + "-realm").get(0);
-        RoleRepresentation masterManageAuthorization = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_AUTHORIZATION).toRepresentation();
-        RoleRepresentation masterViewAuthorization = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_AUTHORIZATION).toRepresentation();
-        RoleRepresentation masterManageClients = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_CLIENTS).toRepresentation();
-        RoleRepresentation masterViewClients = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_CLIENTS).toRepresentation();
-        RoleRepresentation masterManageEvents = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_EVENTS).toRepresentation();
-        RoleRepresentation masterViewEvents = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_EVENTS).toRepresentation();
-        RoleRepresentation masterManageIdentityProviders = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_IDENTITY_PROVIDERS).toRepresentation();
-        RoleRepresentation masterViewIdentityProviders = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_IDENTITY_PROVIDERS).toRepresentation();
-        RoleRepresentation masterManageRealm = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_REALM).toRepresentation();
-        RoleRepresentation masterViewRealm = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_REALM).toRepresentation();
-        RoleRepresentation masterImpersonate = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(ImpersonationConstants.IMPERSONATION_ROLE).toRepresentation();
-        RoleRepresentation masterManageUsers = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.MANAGE_USERS).toRepresentation();
-        RoleRepresentation masterViewUsers = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.VIEW_USERS).toRepresentation();
-        RoleRepresentation masterQueryUsers = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_USERS).toRepresentation();
-        RoleRepresentation masterQueryClients = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_CLIENTS).toRepresentation();
-        RoleRepresentation masterQueryGroups = adminClient.realm("master").clients().get(masterClient.getId()).roles().get(AdminRoles.QUERY_GROUPS).toRepresentation();
-
-        List<RoleRepresentation> roles = new LinkedList<>();
-
-        {
-            ClientRepresentation client = realmAdminClient;
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    TEST, "userAdmin", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                roles.clear();
-                roles.add(realmManageAuthorization);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-            
-                roles.clear();
-                roles.add(realmViewAuthorization);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmAdmin);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageClients);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewClients);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageEvents);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewEvents);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageIdentityProviders);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewIdentityProviders);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageRealm);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewRealm);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmImpersonate);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmViewUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryGroups);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryClients);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-            }
-        }
-        // test master user with manage_users can't assign realm's admin roles
-        {
-            ClientRepresentation client = realmAdminClient;
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    "master", "userAdmin", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                roles.clear();
-                roles.add(realmManageAuthorization);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewAuthorization);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmAdmin);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageClients);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewClients);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageEvents);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewEvents);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageIdentityProviders);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewIdentityProviders);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageRealm);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmViewRealm);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmImpersonate);
-                try {
-                    realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-
-                roles.clear();
-                roles.add(realmManageUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmViewUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryGroups);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-
-                roles.clear();
-                roles.add(realmQueryClients);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-            }
-        }
-        // test master manageUsers only admin can do with master realm admin roles
-        {
-            ClientRepresentation client = masterClient;
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient(suiteContext.isAdapterCompatTesting(),
-                    "master", "masterAdmin", "password", Constants.ADMIN_CLI_CLIENT_ID, null)) {
-                roles.clear();
-                roles.add(masterManageAuthorization);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewAuthorization);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterManageClients);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewClients);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterManageEvents);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewEvents);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterManageIdentityProviders);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewIdentityProviders);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterManageRealm);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewRealm);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterImpersonate);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterManageUsers);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterViewUsers);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterQueryUsers);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterQueryGroups);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));                    
-                }
-                roles.clear();
-                roles.add(masterQueryClients);
-                try {
-                    realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                    Assert.fail("should fail with forbidden exception");
-                } catch (ClientErrorException e) {
-                    assertThat(Response.Status.fromStatusCode(e.getResponse().getStatus()),
-                            is(equalTo(Response.Status.FORBIDDEN)));
-                }
-            }
-        }
-        // test master admin can add all admin roles in realm
-        {
-            ClientRepresentation client = realmAdminClient;
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient()) {
-                roles.clear();
-                roles.add(realmManageAuthorization);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmViewAuthorization);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmManageClients);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmViewClients);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmManageEvents);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmViewEvents);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmManageIdentityProviders);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmViewIdentityProviders);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmManageRealm);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmViewRealm);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmImpersonate);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmManageUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(realmViewUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(realmQueryUsers);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(realmQueryGroups);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(realmQueryClients);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm(TEST).users().get(realmUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-            }
-        }
-        // test that "admin" in master realm can assign all roles of master realm realm client admin roles
-        {
-            ClientRepresentation client = masterClient;
-            try (Keycloak realmClient = AdminClientUtil.createAdminClient()) {
-                roles.clear();
-                roles.add(masterManageAuthorization);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterViewAuthorization);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterManageClients);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterViewClients);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterManageEvents);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterViewEvents);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterManageIdentityProviders);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterViewIdentityProviders);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterManageRealm);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterViewRealm);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterImpersonate);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterManageUsers);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(masterViewUsers);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(masterQueryUsers);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                
-                roles.clear();
-                roles.add(masterQueryGroups);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-                
-                roles.clear();
-                roles.add(masterQueryClients);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).add(roles);
-                realmClient.realm("master").users().get(masterUser.getId()).roles().clientLevel(client.getId()).remove(roles);
-            }
-        }
-    }
-
-
-
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ImpersonationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ImpersonationTest.java
deleted file mode 100755
index aa97302bd785..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ImpersonationTest.java
+++ /dev/null
@@ -1,474 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.apache.http.HttpResponse;
-import org.apache.http.client.methods.HttpUriRequest;
-import org.apache.http.client.methods.RequestBuilder;
-import org.apache.http.impl.client.BasicCookieStore;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.util.EntityUtils;
-import org.hamcrest.MatcherAssert;
-import org.jboss.arquillian.graphene.page.Page;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.junit.Assert;
-import org.junit.Assume;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.Config;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.KeycloakBuilder;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.cookie.CookieType;
-import org.keycloak.events.Details;
-import org.keycloak.events.EventType;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.Constants;
-import org.keycloak.models.ImpersonationConstants;
-import org.keycloak.models.ImpersonationSessionNote;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.idm.*;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.auth.page.AuthRealm;
-import org.keycloak.testsuite.pages.AppPage;
-import org.keycloak.testsuite.util.*;
-import org.openqa.selenium.Cookie;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.Response;
-import java.io.IOException;
-import java.net.URL;
-import java.util.*;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.Matchers.*;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * Tests Undertow Adapter
- *
- * @author <a href="mailto:bburke@redhat.com">Bill Burke</a>
- */
-public class ImpersonationTest extends AbstractKeycloakTest {
-
-    static class UserSessionNotesHolder {
-        private Map<String, String> notes = new HashMap<>();
-
-        public UserSessionNotesHolder() {
-        }
-
-        public UserSessionNotesHolder(final Map<String, String> notes) {
-            this.notes = notes;
-        }
-
-        public void setNotes(final Map<String, String> notes) {
-            this.notes = notes;
-        }
-
-        public Map<String, String> getNotes() {
-            return notes;
-        }
-    }
-
-    @Rule
-    public AssertEvents events = new AssertEvents(this);
-
-    @Page
-    protected AppPage appPage;
-
-    private String impersonatedUserId;
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmBuilder realm = RealmBuilder.create().name("test").testEventListener();
-
-        realm.client(ClientBuilder.create().clientId("myclient").publicClient().directAccessGrants());
-
-        impersonatedUserId = KeycloakModelUtils.generateId();
-
-        realm.user(UserBuilder.create().id(impersonatedUserId).username("test-user@localhost"));
-        realm.user(UserBuilder.create().username("realm-admin").password("password").role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-        realm.user(UserBuilder.create().username("impersonator").password("password").role(Constants.REALM_MANAGEMENT_CLIENT_ID, ImpersonationConstants.IMPERSONATION_ROLE).role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.VIEW_USERS));
-        realm.user(UserBuilder.create().username("bad-impersonator").password("password").role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.MANAGE_USERS));
-
-        testRealms.add(realm.build());
-    }
-
-    @BeforeClass
-    public static void enabled() {
-        Assume.assumeFalse("impersonation".equals(System.getProperty("feature.name"))
-                && "disabled".equals(System.getProperty("feature.value")));
-    }
-
-    @Before
-    public void beforeTest() {
-        impersonatedUserId = ApiUtil.findUserByUsername(adminClient.realm("test"), "test-user@localhost").getId();
-    }
-
-    @Test
-    public void testImpersonateByMasterAdmin() {
-        // test that composite is set up right for impersonation role
-        testSuccessfulImpersonation("admin", Config.getAdminRealm());
-    }
-
-    @Test
-    public void testImpersonateByMasterImpersonator() {
-        String userId;
-        try (Response response = adminClient.realm("master").users().create(UserBuilder.create().username("master-impersonator").build())) {
-            userId = ApiUtil.getCreatedId(response);
-        }
-
-        UserResource user = adminClient.realm("master").users().get(userId);
-        user.resetPassword(CredentialBuilder.create().password("password").build());
-
-        ClientResource testRealmClient = ApiUtil.findClientResourceByClientId(adminClient.realm("master"), "test-realm");
-
-        List<RoleRepresentation> roles = new LinkedList<>();
-        roles.add(ApiUtil.findClientRoleByName(testRealmClient, AdminRoles.VIEW_USERS).toRepresentation());
-        roles.add(ApiUtil.findClientRoleByName(testRealmClient, ImpersonationConstants.IMPERSONATION_ROLE).toRepresentation());
-
-        user.roles().clientLevel(testRealmClient.toRepresentation().getId()).add(roles);
-
-        testSuccessfulImpersonation("master-impersonator", Config.getAdminRealm());
-
-        adminClient.realm("master").users().get(userId).remove();
-    }
-
-    @Test
-    public void testImpersonateByTestImpersonator() {
-        testSuccessfulImpersonation("impersonator", "test");
-    }
-
-    @Test
-    public void testImpersonateByTestAdmin() {
-        // test that composite is set up right for impersonation role
-        testSuccessfulImpersonation("realm-admin", "test");
-    }
-
-    @Test
-    public void testImpersonateByTestBadImpersonator() {
-        testForbiddenImpersonation("bad-impersonator", "test");
-    }
-
-    @Test
-    public void testImpersonationFailsForDisabledUser() {
-        UserResource impersonatedUserResource = adminClient.realms().realm("test").users().get(impersonatedUserId);
-        UserRepresentation impersonatedUserRepresentation = impersonatedUserResource.toRepresentation();
-        impersonatedUserRepresentation.setEnabled(false);
-        impersonatedUserResource.update(impersonatedUserRepresentation);
-        try {
-            testBadRequestImpersonation("impersonator", "test", impersonatedUserId, "test", "User is disabled");
-        } finally {
-            impersonatedUserRepresentation.setEnabled(true);
-            impersonatedUserResource.update(impersonatedUserRepresentation);
-        }
-    }
-
-    @Test
-    public void testImpersonateByMastertBadImpersonator() {
-        String userId;
-        try (Response response = adminClient.realm("master").users().create(UserBuilder.create().username("master-bad-impersonator").build())) {
-            userId = ApiUtil.getCreatedId(response);
-        }
-        adminClient.realm("master").users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
-
-        testForbiddenImpersonation("master-bad-impersonator", Config.getAdminRealm());
-
-        adminClient.realm("master").users().get(userId).remove();
-    }
-
-
-    // KEYCLOAK-5981
-    @Test
-    public void testImpersonationWorksWhenAuthenticationSessionExists() throws Exception {
-        // Create test client
-        RealmResource realm = adminClient.realms().realm("test");
-        Response resp = realm.clients().create(ClientBuilder.create().clientId("test-app").addRedirectUri(OAuthClient.APP_ROOT + "/*").build());
-        resp.close();
-
-        // Open the URL for the client (will redirect to Keycloak server AuthorizationEndpoint and create authenticationSession)
-        String loginFormUrl = oauth.getLoginFormUrl();
-        driver.navigate().to(loginFormUrl);
-        loginPage.assertCurrent();
-
-        // Impersonate and get SSO cookie. Setup that cookie for webDriver
-        for (Cookie cookie : testSuccessfulImpersonation("realm-admin", "test")) {
-            driver.manage().addCookie(cookie);
-        }
-
-        // Open the URL again - should be directly redirected to the app due the SSO login
-        driver.navigate().to(loginFormUrl);
-        appPage.assertCurrent();
-        //KEYCLOAK-12783
-        Assert.assertEquals("/auth/realms/master/app/auth", new URL(DroneUtils.getCurrentDriver().getCurrentUrl()).getPath());
-
-        // Remove test client
-        ApiUtil.findClientByClientId(realm, "test-app").remove();
-    }
-
-    // KEYCLOAK-17655
-    @Test
-    public void testImpersonationBySameRealmServiceAccount() throws Exception {
-        // Create test client service account
-        RealmResource realm = adminClient.realms().realm("test");
-        ClientRepresentation clientApp = ClientBuilder.create()
-                .id(KeycloakModelUtils.generateId())
-                .clientId("service-account-cl")
-                .secret("password")
-                .serviceAccountsEnabled(true)
-                .build();
-        clientApp.setServiceAccountsEnabled(true);
-        realm.clients().create(clientApp);
-
-        UserRepresentation user = ClientManager.realm(adminClient.realm("test")).clientId("service-account-cl").getServiceAccountUser();
-        user.setServiceAccountClientId("service-account-cl");
-
-        // add impersonation roles
-        ApiUtil.assignClientRoles(realm, user.getId(), Constants.REALM_MANAGEMENT_CLIENT_ID, ImpersonationConstants.IMPERSONATION_ROLE);
-
-        // Impersonation
-        testSuccessfulServiceAccountImpersonation(user, "test");
-
-        // test impersonation over the service account fails
-        testBadRequestImpersonation("impersonator", "test", user.getId(), "test", "Service accounts cannot be impersonated");
-
-        // Remove test client
-        ApiUtil.findClientByClientId(realm, "service-account-cl").remove();
-    }
-    @Test
-    public void testImpersonationByMasterRealmServiceAccount() throws Exception {
-        // Create test client service account
-        RealmResource realm = adminClient.realms().realm("master");
-        ClientRepresentation clientApp = ClientBuilder.create()
-                .id(KeycloakModelUtils.generateId())
-                .clientId("service-account-cl")
-                .secret("password")
-                .serviceAccountsEnabled(true)
-                .build();
-        clientApp.setServiceAccountsEnabled(true);
-        realm.clients().create(clientApp);
-
-        UserRepresentation user = ClientManager.realm(adminClient.realm("master")).clientId("service-account-cl").getServiceAccountUser();
-        user.setServiceAccountClientId("service-account-cl");
-
-        // add impersonation roles
-        ApiUtil.assignRealmRoles(realm, user.getId(), "admin");
-
-        // Impersonation
-        testSuccessfulServiceAccountImpersonation(user, "master");
-
-        // Remove test client
-        ApiUtil.findClientByClientId(realm, "service-account-cl").remove();
-    }
-
-    // Return the SSO cookie from the impersonated session
-    protected Set<Cookie> testSuccessfulImpersonation(String admin, String adminRealm) {
-        ResteasyClientBuilder resteasyClientBuilder = (ResteasyClientBuilder) ResteasyClientBuilder.newBuilder();
-        resteasyClientBuilder.connectionPoolSize(10);
-        resteasyClientBuilder.httpEngine(AdminClientUtil.getCustomClientHttpEngine(resteasyClientBuilder, 10, null));
-        ResteasyClient resteasyClient = resteasyClientBuilder.build();
-
-        // Login adminClient
-        try (Keycloak client = login(admin, adminRealm, resteasyClient)) {
-            // Impersonate
-            return impersonate(client, admin, adminRealm);
-        }
-    }
-
-    private Set<Cookie> impersonate(Keycloak adminClient, String admin, String adminRealm) {
-        BasicCookieStore cookieStore = new BasicCookieStore();
-        try (CloseableHttpClient httpClient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build()) {
-
-            HttpUriRequest req = RequestBuilder.post()
-                    .setUri(AUTH_SERVER_ROOT + "/admin/realms/test/users/" + impersonatedUserId + "/impersonation")
-                    .addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + adminClient.tokenManager().getAccessTokenString())
-                    .build();
-
-            HttpResponse res = httpClient.execute(req);
-            String resBody = EntityUtils.toString(res.getEntity());
-
-            Assert.assertNotNull(resBody);
-            Assert.assertTrue(resBody.contains("redirect"));
-
-            events.expect(EventType.IMPERSONATE)
-                    .session(AssertEvents.isUUID())
-                    .user(impersonatedUserId)
-                    .detail(Details.IMPERSONATOR, admin)
-                    .detail(Details.IMPERSONATOR_REALM, adminRealm)
-                    .client((String) null).assertEvent();
-
-            // Fetch user session notes
-            final String userId = impersonatedUserId;
-            final UserSessionNotesHolder notesHolder = testingClient.server("test").fetch(session -> {
-                final RealmModel realm = session.realms().getRealmByName("test");
-                final UserModel user = session.users().getUserById(realm, userId);
-                final UserSessionModel userSession = session.sessions().getUserSessionsStream(realm, user).findFirst().get();
-                return new UserSessionNotesHolder(userSession.getNotes());
-            }, UserSessionNotesHolder.class);
-
-            // Check impersonation details
-            final Map<String, String> notes = notesHolder.getNotes();
-            Assert.assertNotNull(notes.get(ImpersonationSessionNote.IMPERSONATOR_ID.toString()));
-            Assert.assertEquals(admin, notes.get(ImpersonationSessionNote.IMPERSONATOR_USERNAME.toString()));
-
-            Set<Cookie> cookies = cookieStore.getCookies().stream()
-                    .filter(c -> c.getName().startsWith(CookieType.IDENTITY.getName()))
-                    .map(c -> new Cookie(c.getName(), c.getValue(), c.getDomain(), c.getPath(), c.getExpiryDate(), c.isSecure(), true))
-                    .collect(Collectors.toSet());
-
-            Assert.assertNotNull(cookies);
-            MatcherAssert.assertThat(cookies, is(not(empty())));
-
-            return cookies;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    protected void testForbiddenImpersonation(String admin, String adminRealm) {
-        try (Keycloak client = createAdminClient(adminRealm, establishClientId(adminRealm), admin)) {
-            client.realms().realm("test").users().get(impersonatedUserId).impersonate();
-            Assert.fail("Expected ClientErrorException wasn't thrown.");
-        } catch (ClientErrorException e) {
-            MatcherAssert.assertThat(e.getMessage(), containsString("403 Forbidden"));
-        }
-    }
-
-    protected void testBadRequestImpersonation(String admin, String adminRealm, String impersonatedId,
-            String impersonatedRealm, String errorExpected) {
-        try (Keycloak client = createAdminClient(adminRealm, establishClientId(adminRealm), admin)) {
-            client.realms().realm(impersonatedRealm).users().get(impersonatedId).impersonate();
-            Assert.fail("Expected ClientErrorException wasn't thrown.");
-        } catch (ClientErrorException e) {
-            Assert.assertEquals(Response.Status.BAD_REQUEST, e.getResponse().getStatusInfo());
-            ErrorRepresentation error = e.getResponse().readEntity(ErrorRepresentation.class);
-            Assert.assertEquals(errorExpected, error.getErrorMessage());
-        }
-    }
-
-    Keycloak createAdminClient(String realm, String clientId, String username) {
-        return createAdminClient(realm, clientId, username, null, null);
-    }
-
-    String establishClientId(String realm) {
-        return realm.equals("master") ? Constants.ADMIN_CLI_CLIENT_ID : "myclient";
-    }
-
-    Keycloak createAdminClient(String realm, String clientId, String username, String password, ResteasyClient resteasyClient) {
-        if (password == null) {
-            password = username.equals("admin") ? "admin" : "password";
-        }
-
-        return KeycloakBuilder.builder().serverUrl(getAuthServerContextRoot() + "/auth")
-                .realm(realm)
-                .username(username)
-                .password(password)
-                .clientId(clientId)
-                .resteasyClient(resteasyClient)
-                .build();
-    }
-
-    private Keycloak login(String username, String realm, ResteasyClient resteasyClient) {
-        String clientId = establishClientId(realm);
-        Keycloak client = createAdminClient(realm, clientId, username, null, resteasyClient);
-
-        client.tokenManager().grantToken();
-        // only poll for LOGIN event if realm is not master
-        // - since for master testing event listener is not installed
-        if (!AuthRealm.MASTER.equals(realm)) {
-            EventRepresentation e = events.poll();
-            Assert.assertEquals("Event type", EventType.LOGIN.toString(), e.getType());
-            Assert.assertEquals("Client ID", clientId, e.getClientId());
-            Assert.assertEquals("Username", username, e.getDetails().get("username"));
-        }
-        return client;
-    }
-
-
-    // Return the SSO cookie from the impersonated session
-    protected Set<Cookie> testSuccessfulServiceAccountImpersonation(UserRepresentation serviceAccount, String serviceAccountRealm) {
-        ResteasyClientBuilder resteasyClientBuilder = (ResteasyClientBuilder) ResteasyClientBuilder.newBuilder();
-        resteasyClientBuilder.connectionPoolSize(10);
-        resteasyClientBuilder.httpEngine(AdminClientUtil.getCustomClientHttpEngine(resteasyClientBuilder, 10, null));
-        ResteasyClient resteasyClient = resteasyClientBuilder.build();
-
-        // Login adminClient
-        try (Keycloak client = loginServiceAccount(serviceAccount, serviceAccountRealm, resteasyClient)) {
-            // Impersonate test-user with service account
-            return impersonateServiceAccount(client);
-        }
-    }
-
-    private Keycloak loginServiceAccount(UserRepresentation serviceAccount, String serviceAccountRealm, ResteasyClient resteasyClient) {
-        Keycloak client = createServiceAccountClient(serviceAccountRealm, serviceAccount, resteasyClient);
-        // get token
-        client.tokenManager().getAccessToken();
-        return client;
-    }
-
-    Keycloak createServiceAccountClient(String serviceAccountRealm, UserRepresentation serviceAccount, ResteasyClient resteasyClient) {
-        return KeycloakBuilder.builder().serverUrl(getAuthServerContextRoot() + "/auth")
-                .realm(serviceAccountRealm)
-                .clientId(serviceAccount.getServiceAccountClientId())
-                .clientSecret("password")
-                .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
-                .resteasyClient(resteasyClient)
-                .build();
-    }
-
-    private Set<Cookie> impersonateServiceAccount(Keycloak adminClient) {
-        BasicCookieStore cookieStore = new BasicCookieStore();
-        try (CloseableHttpClient httpClient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build()) {
-
-            HttpUriRequest req = RequestBuilder.post()
-                    .setUri(AUTH_SERVER_ROOT + "/admin/realms/test/users/" + impersonatedUserId + "/impersonation")
-                    .addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + adminClient.tokenManager().getAccessTokenString())
-                    .build();
-
-            HttpResponse res = httpClient.execute(req);
-            String resBody = EntityUtils.toString(res.getEntity());
-
-            Assert.assertNotNull(resBody);
-            Assert.assertTrue(resBody.contains("redirect"));
-            Set<Cookie> cookies = cookieStore.getCookies().stream()
-                    .filter(c -> c.getName().startsWith(CookieType.IDENTITY.getName()))
-                    .map(c -> new Cookie(c.getName(), c.getValue(), c.getDomain(), c.getPath(), c.getExpiryDate(), c.isSecure(), true))
-                    .collect(Collectors.toSet());
-
-            Assert.assertNotNull(cookies);
-            MatcherAssert.assertThat(cookies, is(not(empty())));
-
-            return cookies;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/InitialAccessTokenResourceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/InitialAccessTokenResourceTest.java
deleted file mode 100644
index 39e2ac4f33fb..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/InitialAccessTokenResourceTest.java
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import jakarta.ws.rs.BadRequestException;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientInitialAccessResource;
-import org.keycloak.client.registration.ClientRegistrationException;
-import org.keycloak.common.util.Time;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
-import org.keycloak.representations.idm.ClientInitialAccessPresentation;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import java.util.List;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.CoreMatchers.allOf;
-import static org.hamcrest.Matchers.greaterThanOrEqualTo;
-import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class InitialAccessTokenResourceTest extends AbstractAdminTest {
-
-    private ClientInitialAccessResource resource;
-
-    @Before
-    public void before() {
-        resource = realm.clientInitialAccess();
-    }
-
-    @Test
-    public void testInitialAccessTokens() {
-        ClientInitialAccessCreatePresentation rep = new ClientInitialAccessCreatePresentation();
-        rep.setCount(2);
-        rep.setExpiration(100);
-
-        int time = Time.currentTime();
-
-        ClientInitialAccessPresentation response = resource.create(rep);
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(response.getId()), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
-
-        assertNotNull(response.getId());
-        assertEquals(Integer.valueOf(2), response.getCount());
-        assertEquals(Integer.valueOf(2), response.getRemainingCount());
-        assertEquals(Integer.valueOf(100), response.getExpiration());
-        assertThat(response.getTimestamp(), allOf(greaterThanOrEqualTo(time), lessThanOrEqualTo(Time.currentTime())));
-        assertNotNull(response.getToken());
-
-        rep.setCount(3);
-        response = resource.create(rep);
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(response.getId()), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
-
-        rep.setCount(4);
-        response = resource.create(rep);
-        String lastId = response.getId();
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientInitialAccessPath(lastId), rep, ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
-
-        List<ClientInitialAccessPresentation> list = resource.list();
-        assertEquals(3, list.size());
-
-        assertEquals(9, list.get(0).getCount() + list.get(1).getCount() + list.get(2).getCount());
-        assertNull(list.get(0).getToken());
-
-        // Delete last and assert it was deleted
-        resource.delete(lastId);
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.clientInitialAccessPath(lastId), ResourceType.CLIENT_INITIAL_ACCESS_MODEL);
-
-        list = resource.list();
-        assertEquals(2, list.size());
-        assertEquals(5, list.get(0).getCount() + list.get(1).getCount());
-    }
-
-    @Test
-    public void testInvalidParametersWhileCreatingInitialAccessTokens() {
-        // Set Count as -1
-        ClientInitialAccessCreatePresentation rep = new ClientInitialAccessCreatePresentation();
-        rep.setCount(-1);
-        rep.setExpiration(100);
-        try {
-            resource.create(rep);
-            Assert.fail("Invalid value for count");
-        }catch (BadRequestException e){
-            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-            Assert.assertEquals("Invalid value for count", error.getError());
-            Assert.assertEquals("The count cannot be less than 0", error.getErrorDescription());
-        }
-
-        // Set Expiration as -10
-        rep = new ClientInitialAccessCreatePresentation();
-        rep.setCount(100);
-        rep.setExpiration(-10);
-        try {
-            resource.create(rep);
-            Assert.fail("Invalid value for expiration");
-        }catch (BadRequestException e){
-            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-            Assert.assertEquals("Invalid value for expiration", error.getError());
-            Assert.assertEquals("The expiration time interval cannot be less than 0", error.getErrorDescription());
-        }
-    }
-
-
-    @Test
-    public void testPeriodicExpiration() throws ClientRegistrationException, InterruptedException {
-        ClientInitialAccessPresentation response1 = resource.create(new ClientInitialAccessCreatePresentation(1, 1));
-        ClientInitialAccessPresentation response2 = resource.create(new ClientInitialAccessCreatePresentation(1000, 1));
-        ClientInitialAccessPresentation response3 = resource.create(new ClientInitialAccessCreatePresentation(1000, 0));
-        ClientInitialAccessPresentation response4 = resource.create(new ClientInitialAccessCreatePresentation(0, 1));
-
-        List<ClientInitialAccessPresentation> list = resource.list();
-        assertEquals(4, list.size());
-
-        setTimeOffset(10);
-
-        testingClient.testing().removeExpired(REALM_NAME);
-
-        list = resource.list();
-        assertEquals(2, list.size());
-
-        List<String> remainingIds = list.stream()
-                .map(initialAccessPresentation -> initialAccessPresentation.getId())
-                .collect(Collectors.toList());
-
-        Assert.assertNames(remainingIds, response2.getId(), response4.getId());
-
-        setTimeOffset(2000);
-
-        testingClient.testing().removeExpired(REALM_NAME);
-
-        list = resource.list();
-        assertEquals(1, list.size());
-        Assert.assertEquals(list.get(0).getId(), response4.getId());
-
-        // Cleanup
-        realm.clientInitialAccess().delete(response4.getId());
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java
deleted file mode 100644
index ae24e0f7a24b..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java
+++ /dev/null
@@ -1,2099 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.hamcrest.Matchers;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.AuthorizationResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.Profile;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.CibaConfig;
-import org.keycloak.models.Constants;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.credential.OTPCredentialModel;
-import org.keycloak.representations.KeyStoreConfig;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
-import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.ClientScopeRepresentation;
-import org.keycloak.representations.idm.ComponentRepresentation;
-import org.keycloak.representations.idm.CredentialRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
-import org.keycloak.representations.idm.IdentityProviderRepresentation;
-import org.keycloak.representations.idm.PartialImportRepresentation;
-import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.representations.idm.RealmEventsConfigRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
-import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.TestLdapConnectionRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.authorization.PolicyRepresentation;
-import org.keycloak.representations.idm.authorization.ResourcePermissionRepresentation;
-import org.keycloak.representations.idm.authorization.ResourceRepresentation;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-import org.keycloak.representations.idm.authorization.ScopeRepresentation;
-import org.keycloak.services.resources.admin.AdminAuth.Resource;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
-import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.CredentialBuilder;
-import org.keycloak.testsuite.util.FederatedIdentityBuilder;
-import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.IdentityProviderBuilder;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.userprofile.DeclarativeUserProfileProvider;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.Response;
-import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicReference;
-
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.fail;
-import static org.keycloak.services.resources.admin.AdminAuth.Resource.AUTHORIZATION;
-import static org.keycloak.services.resources.admin.AdminAuth.Resource.CLIENT;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-import org.jgroups.util.UUID;
-import org.keycloak.models.utils.KeycloakModelUtils;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class PermissionsTest extends AbstractKeycloakTest {
-
-    private static final String REALM_NAME = "permissions-test";
-
-    private Map<String, Keycloak> clients = new HashMap<>();
-
-    @Rule public GreenMailRule greenMailRule = new GreenMailRule();
-
-    // Remove all realms before first run
-    @Override
-    public void beforeAbstractKeycloakTestRealmImport() {
-        if (testContext.isInitialized()) {
-            return;
-        }
-
-        removeAllRealmsDespiteMaster();
-    }
-
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmBuilder builder = RealmBuilder.create().name(REALM_NAME).testMail();
-        builder.client(ClientBuilder.create().clientId("test-client").publicClient().directAccessGrants());
-
-        builder.user(UserBuilder.create()
-                .username(AdminRoles.REALM_ADMIN)
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN)
-                .addPassword("password"));
-
-        builder.user(UserBuilder.create()
-                .username("multi")
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.QUERY_GROUPS)
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.MANAGE_REALM)
-                .role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.VIEW_CLIENTS)
-                .addPassword("password"));
-
-        builder.user(UserBuilder.create().username("none").addPassword("password"));
-
-        for (String role : AdminRoles.ALL_REALM_ROLES) {
-            builder.user(UserBuilder.create().username(role).role(Constants.REALM_MANAGEMENT_CLIENT_ID, role).addPassword("password"));
-        }
-        testRealms.add(builder.build());
-
-        RealmBuilder builder2 = RealmBuilder.create().name("realm2");
-        builder2.client(ClientBuilder.create().clientId("test-client").publicClient().directAccessGrants());
-        builder2.user(UserBuilder.create().username("admin").role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN).addPassword("password"));
-        testRealms.add(builder2.build());
-    }
-
-
-    @Before
-    public void beforeClazz() {
-        if (testContext.isInitialized()) {
-            return;
-        }
-
-        createTestUsers();
-
-        testContext.setInitialized(true);
-    }
-
-    private void createTestUsers() {
-        RealmResource master = adminClient.realm("master");
-
-        Response response = master.users().create(UserBuilder.create().username("permissions-test-master-none").build());
-        String userId = ApiUtil.getCreatedId(response);
-        response.close();
-        master.users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
-
-        for (String role : AdminRoles.ALL_REALM_ROLES) {
-            response = master.users().create(UserBuilder.create().username("permissions-test-master-" + role).build());
-            userId = ApiUtil.getCreatedId(response);
-            response.close();
-
-            master.users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
-            String clientId = master.clients().findByClientId(REALM_NAME + "-realm").get(0).getId();
-            RoleRepresentation roleRep = master.clients().get(clientId).roles().get(role).toRepresentation();
-            master.users().get(userId).roles().clientLevel(clientId).add(Collections.singletonList(roleRep));
-        }
-    }
-
-    @AfterClass
-    public static void removeTestUsers() throws Exception {
-        try (Keycloak adminClient = AdminClientUtil.createAdminClient()) {
-            for (UserRepresentation u : adminClient.realm("master").users().search("permissions-test-master-", 0, 100)) {
-                adminClient.realm("master").users().get(u.getId()).remove();
-            }
-        }
-    }
-
-    private void recreatePermissionRealm() throws Exception {
-        RealmRepresentation permissionRealm = testContext.getTestRealmReps().stream().filter(realm -> {
-            return realm.getRealm().equals(REALM_NAME);
-        }).findFirst().get();
-        importRealm(permissionRealm);
-
-        removeTestUsers();
-        createTestUsers();
-    }
-
-
-    @Override
-    public void beforeAbstractKeycloakTest() throws Exception {
-        super.beforeAbstractKeycloakTest();
-
-        clients.put(AdminRoles.REALM_ADMIN,
-                Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM_NAME, AdminRoles.REALM_ADMIN, "password", "test-client",
-                        "secret", TLSUtils.initializeTLS()));
-
-        clients.put("none",
-                Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM_NAME, "none", "password", "test-client", "secret", TLSUtils.initializeTLS()));
-
-        clients.put("multi",
-                Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM_NAME, "multi", "password", "test-client", "secret", TLSUtils.initializeTLS()));
-
-        for (String role : AdminRoles.ALL_REALM_ROLES) {
-            clients.put(role, Keycloak.getInstance(getAuthServerContextRoot() + "/auth", REALM_NAME, role, "password", "test-client", TLSUtils.initializeTLS()));
-        }
-
-        clients.put("REALM2", Keycloak.getInstance(getAuthServerContextRoot() + "/auth", "realm2", "admin", "password", "test-client", TLSUtils.initializeTLS()));
-
-        clients.put("master-admin", adminClient);
-
-        clients.put("master-none",
-                Keycloak.getInstance(getAuthServerContextRoot() + "/auth", "master", "permissions-test-master-none", "password",
-                        Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS()));
-
-
-        for (String role : AdminRoles.ALL_REALM_ROLES) {
-            clients.put("master-" + role,
-                    Keycloak.getInstance(getAuthServerContextRoot() + "/auth", "master", "permissions-test-master-" + role, "password",
-                            Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS()));
-        }
-    }
-
-    @Override
-    public void afterAbstractKeycloakTest() {
-        // Don't close the "main" adminClient, but all others yes
-        clients.entrySet().stream().filter(entry -> {
-
-            return !entry.getKey().equals("master-admin");
-
-        }).forEach(consumer -> {
-
-            consumer.getValue().close();
-
-        });
-
-        clients.clear();
-    }
-
-    @Test
-    public void realms() throws Exception {
-        // Check returned realms
-        invoke((RealmResource realm) -> {
-            clients.get("master-none").realms().findAll();
-        }, clients.get("none"), false);
-        invoke((RealmResource realm) -> {
-            clients.get("none").realms().findAll();
-        }, clients.get("none"), false);
-        Assert.assertNames(clients.get("master-admin").realms().findAll(), "master", REALM_NAME, "realm2");
-        Assert.assertNames(clients.get(AdminRoles.REALM_ADMIN).realms().findAll(), REALM_NAME);
-        Assert.assertNames(clients.get("REALM2").realms().findAll(), "realm2");
-
-        // Check realm only contains name if missing view realm permission
-        List<RealmRepresentation> realms = clients.get(AdminRoles.VIEW_USERS).realms().findAll();
-        Assert.assertNames(realms, REALM_NAME);
-        assertGettersEmpty(realms.get(0));
-
-        realms = clients.get(AdminRoles.VIEW_REALM).realms().findAll();
-        Assert.assertNames(realms, REALM_NAME);
-        assertNotNull(realms.get(0).getAccessTokenLifespan());
-
-        // Check the same when access with users from 'master' realm
-        realms = clients.get("master-" + AdminRoles.VIEW_USERS).realms().findAll();
-        Assert.assertNames(realms, REALM_NAME);
-        assertGettersEmpty(realms.get(0));
-
-        realms = clients.get("master-" + AdminRoles.VIEW_REALM).realms().findAll();
-        Assert.assertNames(realms, REALM_NAME);
-        assertNotNull(realms.get(0).getAccessTokenLifespan());
-
-        // Create realm
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get("master-admin").realms().create(RealmBuilder.create().name("master").build());
-            }
-        }, adminClient, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get("master-" + AdminRoles.MANAGE_USERS).realms().create(RealmBuilder.create().name("master").build());
-            }
-        }, adminClient, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.REALM_ADMIN).realms().create(RealmBuilder.create().name("master").build());
-            }
-        }, adminClient, false);
-
-        // Get realm
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.toRepresentation();
-            }
-        }, Resource.REALM, false, true);
-
-        RealmRepresentation realm = clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation();
-        assertGettersEmpty(realm);
-        assertNull(realm.isRegistrationEmailAsUsername());
-        assertNull(realm.getAttributes());
-
-        realm = clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).toRepresentation();
-        assertNotNull(realm.isRegistrationEmailAsUsername());
-
-        realm = clients.get(AdminRoles.MANAGE_USERS).realm(REALM_NAME).toRepresentation();
-        assertNotNull(realm.isRegistrationEmailAsUsername());
-
-        // query users only if granted through fine-grained admin
-        realm = clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).toRepresentation();
-        assertNull(realm.isRegistrationEmailAsUsername());
-        assertNull(realm.getAttributes());
-
-        // this should pass given that users granted with "query" roles are allowed to access the realm with limited access
-        for (String role : AdminRoles.ALL_QUERY_ROLES) {
-            invoke(realmm -> clients.get(role).realms().realm(REALM_NAME).toRepresentation(), clients.get(role), true);
-        }
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.update(new RealmRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.pushRevocation();
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.deleteSession("nosuch", false);
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getClientSessionStats();
-            }
-        }, Resource.REALM, false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getDefaultGroups();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.addDefaultGroup("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.removeDefaultGroup("nosuch");
-            }
-        }, Resource.REALM, true);
-        GroupRepresentation newGroup = new GroupRepresentation();
-        newGroup.setName("sample");
-        adminClient.realm(REALM_NAME).groups().add(newGroup);
-        GroupRepresentation group = adminClient.realms().realm(REALM_NAME).getGroupByPath("sample");
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getGroupByPath("sample");
-            }
-        }, Resource.USER, false);
-
-        adminClient.realms().realm(REALM_NAME).groups().group(group.getId()).remove();
-
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                TestLdapConnectionRepresentation config = new TestLdapConnectionRepresentation(
-                        "nosuch", "nosuch", "nosuch", "nosuch", "nosuch", "nosuch");
-                response.set(realm.testLDAPConnection(config.getAction(), config.getConnectionUrl(), config.getBindDn(),
-                        config.getBindCredential(), config.getUseTruststoreSpi(), config.getConnectionTimeout()));
-                response.set(realm.testLDAPConnection(config));
-            }
-        }, Resource.REALM, true);
-
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.partialImport(new PartialImportRepresentation()));
-            }
-        }, Resource.REALM, true);
-
-        invoke(RealmResource::clearRealmCache, Resource.REALM, true);
-        invoke(RealmResource::clearUserCache, Resource.REALM, true);
-
-        // Delete realm
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get("master-admin").realms().realm("nosuch").remove();
-            }
-        }, adminClient, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get("REALM2").realms().realm(REALM_NAME).remove();
-            }
-        }, adminClient, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.MANAGE_USERS).realms().realm(REALM_NAME).remove();
-            }
-        }, adminClient, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.REALM_ADMIN).realms().realm(REALM_NAME).remove();
-            }
-        }, adminClient, true);
-
-        // Revert realm removal
-        recreatePermissionRealm();
-    }
-
-    @Test
-    public void realmLogoutAll() {
-        Invocation invocation = new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.logoutAll();
-            }
-        };
-
-        invoke(invocation, clients.get("master-none"), false);
-        invoke(invocation, clients.get("master-view-realm"), false);
-
-        invoke(invocation, clients.get("REALM2"), false);
-
-        invoke(invocation, clients.get("none"), false);
-        invoke(invocation, clients.get("view-users"), false);
-        invoke(invocation, clients.get("manage-realm"), false);
-        invoke(invocation, clients.get("master-manage-realm"), false);
-
-        invoke(invocation, clients.get("manage-users"), true);
-        invoke(invocation, clients.get("master-manage-users"), true);
-    }
-
-    @Test
-    public void events() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getRealmEventsConfig();
-            }
-        }, Resource.EVENTS, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.updateRealmEventsConfig(new RealmEventsConfigRepresentation());
-            }
-        }, Resource.EVENTS, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getEvents();
-            }
-        }, Resource.EVENTS, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.getAdminEvents();
-            }
-        }, Resource.EVENTS, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clearEvents();
-            }
-        }, Resource.EVENTS, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clearAdminEvents();
-            }
-        }, Resource.EVENTS, true);
-    }
-
-    @Test
-    public void attackDetection() {
-        UserRepresentation newUser = new UserRepresentation();
-        newUser.setUsername("attacked");
-        newUser.setEnabled(true);
-        adminClient.realms().realm(REALM_NAME).users().create(newUser);
-        UserRepresentation user = adminClient.realms().realm(REALM_NAME).users().search("attacked").get(0);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.attackDetection().bruteForceUserStatus(user.getId());
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.attackDetection().clearBruteForceForUser(user.getId());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.attackDetection().clearAllBruteForce();
-            }
-        }, Resource.USER, true);
-        adminClient.realms().realm(REALM_NAME).users().get(user.getId()).remove();
-    }
-
-    @Test
-    public void clients() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().findAll();
-            }
-        }, Resource.CLIENT, false, true);
-        List<ClientRepresentation> l = clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).clients().findAll();
-        assertThat(l, Matchers.empty());
-
-        l = clients.get(AdminRoles.VIEW_CLIENTS).realm(REALM_NAME).clients().findAll();
-        assertThat(l, Matchers.not(Matchers.empty()));
-
-        ClientRepresentation client = l.get(0);
-        invoke(new InvocationWithResponse() {
-            @Override
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().create(client));
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).toRepresentation();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).update(client);
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().get(client.getId()).remove();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.convertClientDescription("blahblah");
-            }
-        }, Resource.CLIENT, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.clients().create(ClientBuilder.create().clientId("foo").build()));
-            }
-        }, Resource.CLIENT, true);
-        ClientRepresentation foo = adminClient.realms().realm(REALM_NAME).clients().findByClientId("foo").get(0);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).toRepresentation();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getInstallationProvider("nosuch");
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).update(foo);
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).remove();
-                realm.clients().create(foo);
-                ClientRepresentation temp = realm.clients().findByClientId("foo").get(0);
-                foo.setId(temp.getId());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).generateNewSecret();
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).regenerateRegistrationAccessToken();
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getSecret();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getServiceAccountUser();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).pushRevocation();
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getApplicationSessionCount();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getUserSessions(0, 100);
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getOfflineSessionCount();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getOfflineUserSessions(0, 100);
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).registerNode(Collections.<String, String>emptyMap());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).unregisterNode("nosuch");
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).testNodesAvailable();
-            }
-        }, Resource.CLIENT, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").generate();
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").generateAndGetKeystore(new KeyStoreConfig());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeyInfo();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").getKeystore(new KeyStoreConfig());
-            }
-        }, Resource.CLIENT, false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJks(null);
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getCertficateResource("nosuch").uploadJksCertificate(null);
-            }
-        }, Resource.CLIENT, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().createMapper(Collections.EMPTY_LIST);
-            }
-        }, Resource.CLIENT, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.clients().get(foo.getId()).getProtocolMappers().createMapper(new ProtocolMapperRepresentation()));
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().getMapperById("nosuch");
-            }
-        }, Resource.CLIENT, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().getMappers();
-            }
-        }, Resource.CLIENT, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().getMappersPerProtocol("nosuch");
-            }
-        }, Resource.CLIENT, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().update("nosuch", new ProtocolMapperRepresentation());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getProtocolMappers().delete("nosuch");
-            }
-        }, Resource.CLIENT, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().getAll();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAll();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listEffective();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().realmLevel().listAvailable();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().realmLevel().add(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).getScopeMappings().realmLevel().remove(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.CLIENT, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(UUID.randomUUID().toString()).roles().list();
-            }
-        }, Resource.CLIENT, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().create(new RoleRepresentation());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").toRepresentation();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().deleteRole("nosuch");
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").update(new RoleRepresentation());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").addComposites(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").deleteComposites(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").getRoleComposites();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").getRealmRoleComposites();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).roles().get("nosuch").getClientRoleComposites("nosuch");
-            }
-        }, Resource.CLIENT, false);
-        // users with query-client role should be able to query flows so the client detail page can be rendered successfully when fine-grained permissions are enabled.
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getFlows();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), true);
-        // the same for ClientAuthenticatorProviders and PerClientConfigDescription
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getClientAuthenticatorProviders();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getClientAuthenticatorProviders();
-            }
-        }, clients.get(AdminRoles.VIEW_CLIENTS), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getClientAuthenticatorProviders();
-            }
-        }, clients.get(AdminRoles.MANAGE_CLIENTS), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getClientAuthenticatorProviders();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getPerClientConfigDescription();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), true);
-    }
-
-    @Test
-    public void clientScopes() {
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().findAll();
-        }, Resource.CLIENT, false, true);
-        invoke((RealmResource realm, AtomicReference<Response> response) -> {
-            ClientScopeRepresentation scope = new ClientScopeRepresentation();
-            scope.setName("scope");
-            response.set(realm.clientScopes().create(scope));
-        }, Resource.CLIENT, true);
-
-        ClientScopeRepresentation scope = adminClient.realms().realm(REALM_NAME).clientScopes().findAll().get(0);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).toRepresentation();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).update(scope);
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).remove();
-            realm.clientScopes().create(scope);
-        }, Resource.CLIENT, true);
-
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().getMappers();
-        }, Resource.CLIENT, false, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().getMappersPerProtocol("nosuch");
-        }, Resource.CLIENT, false, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().getMapperById("nosuch");
-        }, Resource.CLIENT, false, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().update("nosuch", new ProtocolMapperRepresentation());
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm, AtomicReference<Response> response) -> {
-            response.set(realm.clientScopes().get(scope.getId()).getProtocolMappers().createMapper(new ProtocolMapperRepresentation()));
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().createMapper(Collections.<ProtocolMapperRepresentation>emptyList());
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getProtocolMappers().delete("nosuch");
-        }, Resource.CLIENT, true);
-
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().getAll();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listAll();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listAvailable();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().listEffective();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().add(Collections.<RoleRepresentation>emptyList());
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().realmLevel().remove(Collections.<RoleRepresentation>emptyList());
-        }, Resource.CLIENT, true);
-        ClientRepresentation realmAccessClient = adminClient.realms().realm(REALM_NAME).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listAll();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listAvailable();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).listEffective();
-        }, Resource.CLIENT, false);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).add(Collections.<RoleRepresentation>emptyList());
-        }, Resource.CLIENT, true);
-        invoke((RealmResource realm) -> {
-            realm.clientScopes().get(scope.getId()).getScopeMappings().clientLevel(realmAccessClient.getId()).remove(Collections.<RoleRepresentation>emptyList());
-        }, Resource.CLIENT, true);
-
-        // this should throw forbidden as "query-users" role isn't enough
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clientScopes().findAll();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), false);
-    }
-
-    @Test
-    public void clientInitialAccess() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clientInitialAccess().list();
-            }
-        }, Resource.CLIENT, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clientInitialAccess().create(new ClientInitialAccessCreatePresentation());
-            }
-        }, Resource.CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clientInitialAccess().delete("nosuch");
-            }
-        }, Resource.CLIENT, true);
-    }
-
-    @Test
-    public void clientAuthorization() {
-        ProfileAssume.assumeFeatureEnabled(Profile.Feature.AUTHORIZATION);
-
-        ClientRepresentation newClient = new ClientRepresentation();
-        newClient.setClientId("foo-authz");
-        adminClient.realms().realm(REALM_NAME).clients().create(newClient);
-        ClientRepresentation foo = adminClient.realms().realm(REALM_NAME).clients().findByClientId("foo-authz").get(0);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                foo.setServiceAccountsEnabled(true);
-                foo.setAuthorizationServicesEnabled(true);
-                realm.clients().get(foo.getId()).update(foo);
-            }
-        }, CLIENT, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clients().get(foo.getId()).authorization().getSettings();
-            }
-        }, AUTHORIZATION, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                ResourceServerRepresentation settings = authorization.getSettings();
-                authorization.update(settings);
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.resources().resources();
-            }
-        }, AUTHORIZATION, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.scopes().scopes();
-            }
-        }, AUTHORIZATION, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.policies().policies();
-            }
-        }, AUTHORIZATION, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                response.set(authorization.resources().create(new ResourceRepresentation("Test", Collections.emptySet())));
-            }
-        }, AUTHORIZATION, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                response.set(authorization.scopes().create(new ScopeRepresentation("Test")));
-            }
-        }, AUTHORIZATION, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                ResourcePermissionRepresentation representation = new ResourcePermissionRepresentation();
-                representation.setName("Test PermissionsTest");
-                representation.addResource("Default Resource");
-                response.set(authorization.permissions().resource().create(representation));
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.resources().resource("nosuch").update(new ResourceRepresentation());
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.scopes().scope("nosuch").update(new ScopeRepresentation());
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.policies().policy("nosuch").update(new PolicyRepresentation());
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.resources().resource("nosuch").remove();
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.scopes().scope("nosuch").remove();
-            }
-        }, AUTHORIZATION, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                AuthorizationResource authorization = realm.clients().get(foo.getId()).authorization();
-                authorization.policies().policy("nosuch").remove();
-            }
-        }, AUTHORIZATION, true);
-    }
-
-    @Test
-    public void roles() {
-        RoleRepresentation newRole = new RoleRepresentation();
-        newRole.setName("sample-role");
-        adminClient.realm(REALM_NAME).roles().create(newRole);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().list();
-            }
-        }, Resource.REALM, false, true);
-
-        // this should throw forbidden as "create-client" role isn't enough
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.CREATE_CLIENT).realm(REALM_NAME).roles().list();
-            }
-        }, clients.get(AdminRoles.CREATE_CLIENT), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").toRepresentation();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").update(newRole);
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().create(new RoleRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().deleteRole("sample-role");
-                // need to recreate for other tests
-                realm.roles().create(newRole);
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").getRoleComposites();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").addComposites(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").deleteComposites(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").getRoleComposites();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").getRealmRoleComposites();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.roles().get("sample-role").getClientRoleComposites(KeycloakModelUtils.generateId());
-            }
-        }, Resource.REALM, false);
-        adminClient.realms().realm(REALM_NAME).roles().deleteRole("sample-role");
-    }
-
-    @Test
-    public void flows() throws Exception {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getFormProviders();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getAuthenticatorProviders();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getClientAuthenticatorProviders();
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getFormActionProviders();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getFlows();
-            }
-        }, Resource.REALM, false, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.flows().createFlow(new AuthenticationFlowRepresentation()));
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getFlow("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().deleteFlow("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.flows().copy("nosuch", Collections.<String, Object>emptyMap()));
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().addExecutionFlow("nosuch", Collections.<String, Object>emptyMap());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().addExecution("nosuch", Collections.<String, Object>emptyMap());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getExecutions("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke((RealmResource realm) -> realm.flows().getExecution("nosuch"), Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().updateExecutions("nosuch", new AuthenticationExecutionInfoRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                AuthenticationExecutionRepresentation rep = new AuthenticationExecutionRepresentation();
-                rep.setAuthenticator("auth-cookie");
-                rep.setRequirement("CONDITIONAL");
-                response.set(realm.flows().addExecution(rep));
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().raisePriority("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().lowerPriority("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().removeExecution("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.flows().newExecutionConfig("nosuch", new AuthenticatorConfigRepresentation()));
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getAuthenticatorConfig("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getUnregisteredRequiredActions();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().registerRequiredAction(new RequiredActionProviderSimpleRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getRequiredActions();
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getRequiredAction("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().removeRequiredAction("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().updateRequiredAction("nosuch", new RequiredActionProviderRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getAuthenticatorConfigDescription("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getPerClientConfigDescription();
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getAuthenticatorConfig("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().removeAuthenticatorConfig("nosuch");
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().updateAuthenticatorConfig("nosuch", new AuthenticatorConfigRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getPerClientConfigDescription();
-                clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getClientAuthenticatorProviders();
-                clients.get(AdminRoles.VIEW_REALM).realm(REALM_NAME).flows().getRequiredActions();
-            }
-        }, adminClient, true);
-
-        // Re-create realm
-        adminClient.realm(REALM_NAME).remove();
-
-        recreatePermissionRealm();
-    }
-
-    @Test
-    public void rolesById() {
-        RoleRepresentation newRole = new RoleRepresentation();
-        newRole.setName("role-by-id");
-        adminClient.realm(REALM_NAME).roles().create(newRole);
-        RoleRepresentation role = adminClient.realm(REALM_NAME).roles().get("role-by-id").toRepresentation();
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().getRole(role.getId());
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().updateRole(role.getId(), role);
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().deleteRole(role.getId());
-                // need to recreate for other tests
-                realm.roles().create(newRole);
-                RoleRepresentation temp = realm.roles().get("role-by-id").toRepresentation();
-                role.setId(temp.getId());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().getRoleComposites(role.getId());
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().addComposites(role.getId(), Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().deleteComposites(role.getId(), Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().getRoleComposites(role.getId());
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().getRealmRoleComposites(role.getId());
-            }
-        }, Resource.REALM, false, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.rolesById().getClientRoleComposites(role.getId(), KeycloakModelUtils.generateId());
-            }
-        }, Resource.REALM, false, true);
-
-        adminClient.realm(REALM_NAME).roles().deleteRole("role-by-id");
-    }
-
-    @Test
-    public void groups() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().groups();
-            }
-        }, Resource.USER, false);
-        invoke(realm -> realm.groups().count(), Resource.USER, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                GroupRepresentation group = new GroupRepresentation();
-                group.setName("mygroup");
-                response.set(realm.groups().add(group));
-            }
-        }, Resource.USER, true);
-
-        GroupRepresentation group = adminClient.realms().realm(REALM_NAME).getGroupByPath("mygroup");
-        ClientRepresentation realmAccessClient = adminClient.realms().realm(REALM_NAME).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-
-        // this should throw forbidden as "create-client" role isn't enough
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.CREATE_CLIENT).realm(REALM_NAME).groups().groups();
-            }
-        }, clients.get(AdminRoles.CREATE_CLIENT), false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).toRepresentation();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).update(group);
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).members(0, 100);
-            }
-        }, Resource.USER, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                GroupRepresentation subgroup = new GroupRepresentation();
-                subgroup.setName("sub");
-                response.set(realm.groups().group(group.getId()).subGroup(subgroup));
-            }
-        }, Resource.USER, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().getAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().realmLevel().listAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().realmLevel().listEffective();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().realmLevel().listAvailable();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().realmLevel().add(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().realmLevel().remove(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listEffective();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).listAvailable();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).add(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).roles().clientLevel(realmAccessClient.getId()).remove(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.groups().group(group.getId()).remove();
-                group.setId(null);
-                realm.groups().add(group);
-                GroupRepresentation temp = realm.getGroupByPath("mygroup");
-                group.setId(temp.getId());
-            }
-        }, Resource.USER, true);
-    }
-
-    // Permissions for impersonation tested in ImpersonationTest
-    @Test
-    public void users() {
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.users().create(UserBuilder.create().username("testuser").build()));
-            }
-        }, Resource.USER, true);
-        UserRepresentation user = adminClient.realms().realm(REALM_NAME).users().search("testuser").get(0);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).remove();
-                realm.users().create(user);
-                UserRepresentation temp = realm.users().search("testuser").get(0);
-                user.setId(temp.getId());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).toRepresentation();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).getUnmanagedAttributes();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).update(user);
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().count();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).getUserSessions();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).getOfflineSessions(KeycloakModelUtils.generateId());
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).getFederatedIdentity();
-            }
-        }, Resource.USER, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.users()
-                        .get(user.getId())
-                        .addFederatedIdentity("nosuch",
-                                FederatedIdentityBuilder.create().identityProvider("nosuch").userId("nosuch").userName("nosuch").build()));
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).removeFederatedIdentity("nosuch");
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).getConsents();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).revokeConsent("testclient");
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).logout();
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).resetPassword(CredentialBuilder.create().password("password").build());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                CredentialRepresentation totpCredential = realm.users().get(user.getId()).credentials().stream()
-                        .filter(c -> OTPCredentialModel.TYPE.equals(c.getType())).findFirst().orElse(null);
-                if (totpCredential != null) {
-                    realm.users().get(user.getId()).removeCredential(totpCredential.getId());
-                } else {
-                    realm.users().get(user.getId()).removeCredential("123");
-                }
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).executeActionsEmail(List.of(UserModel.RequiredAction.UPDATE_PASSWORD.name()));
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).executeActionsEmail(Collections.<String>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).sendVerifyEmail();
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).groups();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).leaveGroup("nosuch");
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).joinGroup("nosuch");
-            }
-        }, Resource.USER, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().getAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().realmLevel().listAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().realmLevel().listAvailable();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().realmLevel().listEffective();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().realmLevel().add(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().realmLevel().remove(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-
-        ClientRepresentation realmAccessClient = adminClient.realms().realm(REALM_NAME).clients().findByClientId(Constants.REALM_MANAGEMENT_CLIENT_ID).get(0);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listAll();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listAvailable();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).listEffective();
-            }
-        }, Resource.USER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).add(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).roles().clientLevel(realmAccessClient.getId()).remove(Collections.<RoleRepresentation>emptyList());
-            }
-        }, Resource.USER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().search("foo", 0, 1);
-            }
-        }, Resource.USER, false);
-        // this should throw forbidden as "query-client" role isn't enough
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().list();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        invoke(new InvocationWithResponse() {
-            @Override
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().create(user));
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_CLIENTS).realm(REALM_NAME).users().search("test");
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).toRepresentation();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).remove();
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.users().get(user.getId()).update(user);
-            }
-        }, clients.get(AdminRoles.QUERY_CLIENTS), false);
-        // users with query-user role should be able to query required actions so the user detail page can be rendered successfully when fine-grained permissions are enabled.
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.flows().getRequiredActions();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), true);
-        // users with query-user role should be able to query clients so the user detail page can be rendered successfully when fine-grained permissions are enabled.
-        // if the admin wants to restrict the clients that an user can see he can define permissions for these clients
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).clients().findAll();
-            }
-        }, clients.get(AdminRoles.QUERY_USERS), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).users().get(user.getId()).getConfiguredUserStorageCredentialTypes();
-            }
-        }, clients.get(AdminRoles.VIEW_USERS), true);
-    }
-
-    @Test
-    public void identityProviders() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().findAll();
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.identityProviders().create(IdentityProviderBuilder.create().providerId("oidc")
-                        .displayName("nosuch-foo").alias("foo").setAttribute("clientId", "foo").setAttribute("clientSecret", "foo").build()));
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").toRepresentation();
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").update(new IdentityProviderRepresentation());
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.identityProviders().get("nosuch").export("saml"));
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").remove();
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.identityProviders().get("nosuch").addMapper(new IdentityProviderMapperRepresentation()));
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").delete("nosuch");
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").getMappers();
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").getMapperById("nosuch");
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().get("nosuch").getMapperTypes();
-            }
-        }, Resource.IDENTITY_PROVIDER, false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().importFrom(Collections.<String, Object>emptyMap());
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.identityProviders().importFrom(null);
-            }
-        }, Resource.IDENTITY_PROVIDER, true);
-    }
-
-    @Test
-    public void components() {
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.components().query();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.components().query("nosuch");
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.clientRegistrationPolicy().getProviders();
-            }
-        }, Resource.REALM, false);
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                response.set(realm.components().add(new ComponentRepresentation()));
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.components().component("nosuch").toRepresentation();
-            }
-        }, Resource.REALM, false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.components().component("nosuch").update(new ComponentRepresentation());
-            }
-        }, Resource.REALM, true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.components().component("nosuch").remove();
-            }
-        }, Resource.REALM, true);
-    }
-
-    @Test
-    public void partialExport() {
-        invoke(realm -> realm.partialExport(false, false), clients.get("view-realm"), false);
-        invoke(realm -> realm.partialExport(false, false), clients.get("manage-realm"), true);
-        invoke(realm -> realm.partialExport(true, false), clients.get("manage-realm"), false);
-        invoke(realm -> realm.partialExport(false, true), clients.get("manage-realm"), false);
-        invoke(realm -> realm.partialExport(true, true), clients.get("multi"), true);
-        invoke(realm -> realm.partialExport(false, false), clients.get("none"), false);
-    }
-
-    @Test
-    public void localizations() {
-        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmSpecificLocales());
-
-        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationText("en", "test"));
-
-        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationTexts("en"));
-        verifyAnyAdminRoleReqired(realm -> realm.localization().getRealmLocalizationTexts("en", false));
-        
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().createOrUpdateRealmLocalizationTexts("en", Collections.<String, String>emptyMap());
-            }
-        }, clients.get("view-realm"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().createOrUpdateRealmLocalizationTexts("en", Collections.<String, String>emptyMap());
-            }
-        }, clients.get("manage-realm"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().createOrUpdateRealmLocalizationTexts("en", Collections.<String, String>emptyMap());
-            }
-        }, clients.get("master-admin"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().createOrUpdateRealmLocalizationTexts("en", Collections.<String, String>emptyMap());
-            }
-        }, clients.get("none"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("REALM2"), false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("view-realm"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("manage-realm"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("master-admin"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("none"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationText("en", "test");
-            }
-        }, clients.get("REALM2"), false);
-
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationTexts("en");
-            }
-        }, clients.get("view-realm"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationTexts("en");
-            }
-        }, clients.get("manage-realm"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationTexts("en");
-            }
-        }, clients.get("master-admin"), true);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationTexts("en");
-            }
-        }, clients.get("none"), false);
-        invoke(new Invocation() {
-            public void invoke(RealmResource realm) {
-                realm.localization().deleteRealmLocalizationTexts("en");
-            }
-        }, clients.get("REALM2"), false);
-    }
-
-    private void verifyAnyAdminRoleReqired(Invocation invocation) {
-        invoke(invocation, clients.get("view-realm"), true);
-        invoke(invocation, clients.get("manage-realm"), true);
-        invoke(invocation, clients.get("multi"), true);
-        invoke(invocation, clients.get("master-admin"), true);
-        invoke(invocation, clients.get("none"), false);
-        invoke(invocation, clients.get("REALM2"), false);
-    }
-
-    private void invoke(final Invocation invocation, Resource resource, boolean manage) {
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                invocation.invoke(realm);
-            }
-        }, resource, manage);
-    }
-
-    private void invoke(final Invocation invocation, Resource resource, boolean manage, boolean skipDifferentRole) {
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                invocation.invoke(realm);
-            }
-        }, resource, manage, skipDifferentRole);
-    }
-
-    private void invoke(InvocationWithResponse invocation, Resource resource, boolean manage) {
-        invoke(invocation, resource, manage, false);
-    }
-
-    private void invoke(InvocationWithResponse invocation, Resource resource, boolean manage, boolean skipDifferentRole) {
-        String viewRole = getViewRole(resource);
-        String manageRole = getManageRole(resource);
-        String differentViewRole = getDifferentViewRole(resource);
-        String differentManageRole = getDifferentManageRole(resource);
-
-        invoke(invocation, clients.get("master-none"), false);
-        invoke(invocation, clients.get("master-admin"), true);
-        invoke(invocation, clients.get("master-" + viewRole), !manage);
-        invoke(invocation, clients.get("master-" + manageRole), true);
-        if (!skipDifferentRole) {
-            invoke(invocation, clients.get("master-" + differentViewRole), false);
-            invoke(invocation, clients.get("master-" + differentManageRole), false);
-        }
-
-        invoke(invocation, clients.get("none"), false);
-        invoke(invocation, clients.get(AdminRoles.REALM_ADMIN), true);
-        invoke(invocation, clients.get(viewRole), !manage);
-        invoke(invocation, clients.get(manageRole), true);
-        if (!skipDifferentRole) {
-            invoke(invocation, clients.get(differentViewRole), false);
-            invoke(invocation, clients.get(differentManageRole), false);
-        }
-
-        invoke(invocation, clients.get("REALM2"), false);
-    }
-
-    private void invoke(final Invocation invocation, Keycloak client, boolean expectSuccess) {
-        invoke(new InvocationWithResponse() {
-            public void invoke(RealmResource realm, AtomicReference<Response> response) {
-                invocation.invoke(realm);
-            }
-        }, client, expectSuccess);
-    }
-
-    private void invoke(InvocationWithResponse invocation, Keycloak client, boolean expectSuccess) {
-        int statusCode;
-        try {
-            AtomicReference<Response> responseReference = new AtomicReference<>();
-            invocation.invoke(client.realm(REALM_NAME), responseReference);
-            Response response = responseReference.get();
-            if (response != null) {
-                statusCode = response.getStatus();
-            } else {
-                // OK (we don't care about the exact status code
-                statusCode = 200;
-            }
-        } catch (ClientErrorException e) {
-            statusCode = e.getResponse().getStatus();
-        }
-
-        if (expectSuccess) {
-            if (!(statusCode == 200 || statusCode == 201 || statusCode == 204 || statusCode == 404 || statusCode == 409 || statusCode == 400)) {
-                fail("Expected permitted, but was " + statusCode);
-            }
-        } else {
-            if (statusCode != 403) {
-                fail("Expected 403, but was " + statusCode);
-            }
-        }
-    }
-
-    private String getViewRole(Resource resource) {
-        switch (resource) {
-            case CLIENT:
-                return AdminRoles.VIEW_CLIENTS;
-            case USER:
-                return AdminRoles.VIEW_USERS;
-            case REALM:
-                return AdminRoles.VIEW_REALM;
-            case EVENTS:
-                return AdminRoles.VIEW_EVENTS;
-            case IDENTITY_PROVIDER:
-                return AdminRoles.VIEW_IDENTITY_PROVIDERS;
-            case AUTHORIZATION:
-                return AdminRoles.VIEW_AUTHORIZATION;
-            default:
-                throw new RuntimeException("Unexpected resouce");
-        }
-    }
-
-    private String getManageRole(Resource resource) {
-        switch (resource) {
-            case CLIENT:
-                return AdminRoles.MANAGE_CLIENTS;
-            case USER:
-                return AdminRoles.MANAGE_USERS;
-            case REALM:
-                return AdminRoles.MANAGE_REALM;
-            case EVENTS:
-                return AdminRoles.MANAGE_EVENTS;
-            case IDENTITY_PROVIDER:
-                return AdminRoles.MANAGE_IDENTITY_PROVIDERS;
-            case AUTHORIZATION:
-                return AdminRoles.MANAGE_AUTHORIZATION;
-            default:
-                throw new RuntimeException("Unexpected resouce");
-        }
-    }
-
-    private String getDifferentViewRole(Resource resource) {
-        switch (resource) {
-            case CLIENT:
-                return AdminRoles.VIEW_USERS;
-            case USER:
-                return AdminRoles.VIEW_CLIENTS;
-            case REALM:
-                return AdminRoles.VIEW_EVENTS;
-            case EVENTS:
-                return AdminRoles.VIEW_IDENTITY_PROVIDERS;
-            case IDENTITY_PROVIDER:
-                return AdminRoles.VIEW_REALM;
-            case AUTHORIZATION:
-                return AdminRoles.VIEW_IDENTITY_PROVIDERS;
-            default:
-                throw new RuntimeException("Unexpected resouce");
-        }
-    }
-
-    private String getDifferentManageRole(Resource resource) {
-        switch (resource) {
-            case CLIENT:
-                return AdminRoles.MANAGE_USERS;
-            case USER:
-                return AdminRoles.MANAGE_CLIENTS;
-            case REALM:
-                return AdminRoles.MANAGE_EVENTS;
-            case EVENTS:
-                return AdminRoles.MANAGE_IDENTITY_PROVIDERS;
-            case IDENTITY_PROVIDER:
-                return AdminRoles.MANAGE_REALM;
-            case AUTHORIZATION:
-                return AdminRoles.MANAGE_IDENTITY_PROVIDERS;
-            default:
-                throw new RuntimeException("Unexpected resouce");
-        }
-    }
-
-    public interface Invocation {
-
-        void invoke(RealmResource realm);
-
-    }
-
-    public interface InvocationWithResponse {
-
-        void invoke(RealmResource realm, AtomicReference<Response> response);
-
-    }
-
-    private void assertGettersEmpty(RealmRepresentation rep) {
-        assertGettersEmpty(rep, "getRealm", "getAttributesOrEmpty", "getDisplayNameHtml", 
-            "getDisplayName", "getDefaultLocale", "getSupportedLocales");
-    }
-
-    private void assertGettersEmpty(ClientRepresentation rep) {
-        assertGettersEmpty(rep, "getId", "getClientId", "getDescription");
-    }
-
-    private void assertGettersEmpty(Object rep, String... ignore) {
-        List<String> ignoreList = Arrays.asList(ignore);
-
-        for (Method m : rep.getClass().getDeclaredMethods()) {
-            if (m.getParameterCount() == 0 && m.getName().startsWith("get") && !ignoreList.contains(m.getName())) {
-                    try {
-                    Object o = m.invoke(rep);
-                    assertNull("Expected " + m.getName() + " to be null", o);
-                } catch (Exception e) {
-                    fail(e.getMessage());
-                }
-            }
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/RoleByIdResourceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/RoleByIdResourceTest.java
deleted file mode 100644
index d2249a642442..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/RoleByIdResourceTest.java
+++ /dev/null
@@ -1,283 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.RoleByIdResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.Constants;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.RoleBuilder;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Predicate;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.empty;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class RoleByIdResourceTest extends AbstractAdminTest {
-
-    private RoleByIdResource resource;
-
-    private Map<String, String> ids = new HashMap<>();
-
-    private String clientId;
-
-    private String clientUuid;
-
-    @Before
-    public void before() {
-        adminClient.realm(REALM_NAME).roles().create(RoleBuilder.create().name("role-a").description("Role A").build());
-        adminClient.realm(REALM_NAME).roles().create(RoleBuilder.create().name("role-b").description("Role B").build());
-        // add a role that is a composite role
-        RoleRepresentation roleD = RoleBuilder.create().name("role-d").description("Role D").build();
-        adminClient.realm(REALM_NAME).roles().create(roleD);
-        adminClient.realm(REALM_NAME).roles().create(RoleBuilder.create().name("composite-role-with-d").description("Composite Role with Role D").composite().realmComposite(roleD).build());
-
-        clientId = "client-a";
-        Response response = adminClient.realm(REALM_NAME).clients().create(ClientBuilder.create().clientId(clientId).build());
-        clientUuid = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(clientUuid);
-        response.close();
-        adminClient.realm(REALM_NAME).clients().get(clientUuid).roles().create(RoleBuilder.create().name("role-c").description("Role C").build());
-
-        for (RoleRepresentation r : adminClient.realm(REALM_NAME).roles().list()) {
-            ids.put(r.getName(), r.getId());
-        }
-
-        for (RoleRepresentation r : adminClient.realm(REALM_NAME).clients().get(clientUuid).roles().list()) {
-            ids.put(r.getName(), r.getId());
-        }
-
-        getCleanup().addRoleId(ids.get("role-a"));
-        getCleanup().addRoleId(ids.get("role-b"));
-        getCleanup().addRoleId(ids.get("role-c"));
-        getCleanup().addRoleId(ids.get("role-d"));
-        getCleanup().addRoleId(ids.get("composite-role-with-d"));
-
-        resource = adminClient.realm(REALM_NAME).rolesById();
-
-        assertAdminEvents.clear(); // Tested in RealmRolesTest already
-    }
-
-    @Test
-    public void getRole() {
-        RoleRepresentation role = resource.getRole(ids.get("role-a"));
-        assertNotNull(role);
-        assertEquals("role-a", role.getName());
-        assertEquals("Role A", role.getDescription());
-        assertFalse(role.isComposite());
-    }
-
-    @Test
-    public void updateRole() {
-        RoleRepresentation role = resource.getRole(ids.get("role-a"));
-
-        role.setName("role-a-new");
-        role.setDescription("Role A New");
-
-        resource.updateRole(ids.get("role-a"), role);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.roleByIdResourcePath(ids.get("role-a")), role, ResourceType.REALM_ROLE);
-
-        role = resource.getRole(ids.get("role-a"));
-
-        assertNotNull(role);
-        assertEquals("role-a-new", role.getName());
-        assertEquals("Role A New", role.getDescription());
-        assertFalse(role.isComposite());
-    }
-
-    @Test
-    public void deleteRole() {
-        assertNotNull(resource.getRole(ids.get("role-a")));
-        resource.deleteRole(ids.get("role-a"));
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.roleByIdResourcePath(ids.get("role-a")), ResourceType.REALM_ROLE);
-
-        try {
-            resource.getRole(ids.get("role-a"));
-            fail("Expected 404");
-        } catch (NotFoundException e) {
-        }
-    }
-
-    @Test
-    public void composites() {
-        assertFalse(resource.getRole(ids.get("role-a")).isComposite());
-        assertEquals(0, resource.getRoleComposites(ids.get("role-a")).size());
-
-        List<RoleRepresentation> l = new LinkedList<>();
-        l.add(RoleBuilder.create().id(ids.get("role-b")).build());
-        l.add(RoleBuilder.create().id(ids.get("role-c")).build());
-        resource.addComposites(ids.get("role-a"), l);
-
-        assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.roleByIdResourceCompositesPath(ids.get("role-a")), l, ResourceType.REALM_ROLE);
-
-        Set<RoleRepresentation> composites = resource.getRoleComposites(ids.get("role-a"));
-
-        assertTrue(resource.getRole(ids.get("role-a")).isComposite());
-        Assert.assertNames(composites, "role-b", "role-c");
-
-        Set<RoleRepresentation> realmComposites = resource.getRealmRoleComposites(ids.get("role-a"));
-        Assert.assertNames(realmComposites, "role-b");
-
-        Set<RoleRepresentation> clientComposites = resource.getClientRoleComposites(ids.get("role-a"), clientUuid);
-        Assert.assertNames(clientComposites, "role-c");
-
-        composites = resource.searchRoleComposites(ids.get("role-a"), null, null, null);
-        Assert.assertNames(composites, "role-b", "role-c");
-
-        composites = resource.searchRoleComposites(ids.get("role-a"), "b", null, null);
-        Assert.assertNames(composites, "role-b");
-
-        composites = resource.searchRoleComposites(ids.get("role-a"), null, 0, 0);
-        assertThat(composites, is(empty()));
-
-        composites = resource.searchRoleComposites(ids.get("role-a"), null, 0, 1);
-        Assert.assertNames(composites, "role-b");
-
-        composites = resource.searchRoleComposites(ids.get("role-a"), null, 1, 1);
-        Assert.assertNames(composites, "role-c");
-
-        resource.deleteComposites(ids.get("role-a"), l);
-        assertAdminEvents.assertEvent(realmId, OperationType.DELETE, AdminEventPaths.roleByIdResourceCompositesPath(ids.get("role-a")), l, ResourceType.REALM_ROLE);
-
-        assertFalse(resource.getRole(ids.get("role-a")).isComposite());
-        assertEquals(0, resource.getRoleComposites(ids.get("role-a")).size());
-
-    }
-
-    /**
-     * see KEYCLOAK-12754
-     */
-    @Test
-    public void createNewMixedRealmCompositeRole() {
-
-        RoleRepresentation newRoleComp = RoleBuilder.create().name("role-mixed-comp").composite().realmComposite("role-a").realmComposite("composite-role-with-d").clientComposite(clientId, "role-c").build();
-        adminClient.realm(REALM_NAME).roles().create(newRoleComp);
-
-        RoleRepresentation roleMixedComp = adminClient.realm(REALM_NAME).roles().get(newRoleComp.getName()).toRepresentation();
-        assertTrue(roleMixedComp.isComposite());
-
-        Predicate<RoleRepresentation> isClientRole = RoleRepresentation::getClientRole;
-
-        Set<RoleRepresentation> roleComposites = resource.getRoleComposites(roleMixedComp.getId());
-        Set<RoleRepresentation> containedRealmRoles = roleComposites.stream().filter(isClientRole.negate()).collect(Collectors.toSet());
-        assertFalse(containedRealmRoles.isEmpty());
-        assertTrue(containedRealmRoles.stream().anyMatch(r -> r.getName().equals("role-a")));
-        assertTrue(containedRealmRoles.stream().anyMatch(r -> r.getName().equals("composite-role-with-d")));
-
-        Set<RoleRepresentation> containedClientRoles = roleComposites.stream().filter(isClientRole).collect(Collectors.toSet());
-        assertFalse(containedClientRoles.isEmpty());
-        assertTrue(containedClientRoles.stream().anyMatch(r -> r.getContainerId().equals(clientUuid) && r.getName().equals("role-c")));
-
-        // check that there are no unexpected roles contained
-        int expectedCompositeCount = newRoleComp.getComposites().getRealm().size() + newRoleComp.getComposites().getClient().size();
-        assertEquals(expectedCompositeCount, roleComposites.size());
-    }
-
-    /**
-     * see KEYCLOAK-12754
-     */
-    @Test(expected = NotFoundException.class)
-    public void createNewMixedRealmCompositeRoleWithUnknownRealmRoleShouldThrow() {
-
-        String unknownRealmRole = "realm-role-unknown";
-        RoleRepresentation newRoleComp = RoleBuilder.create().name("role-broken-comp1").composite().realmComposite(unknownRealmRole).clientComposite(clientId, "role-c").build();
-
-        adminClient.realm(REALM_NAME).roles().create(newRoleComp);
-    }
-
-    /**
-     * see KEYCLOAK-12754
-     */
-    @Test(expected = NotFoundException.class)
-    public void createNewMixedRealmCompositeRoleWithUnknownClientRoleShouldThrow() {
-
-        String unknownClientRole = "client-role-unknown";
-        RoleRepresentation newRoleComp = RoleBuilder.create().name("role-broken-comp2").composite().realmComposite("role-a").clientComposite(clientId, unknownClientRole).build();
-        adminClient.realm(REALM_NAME).roles().create(newRoleComp);
-    }
-
-    @Test
-    public void attributes() {
-        for (String id : ids.values()) {
-            RoleRepresentation role = resource.getRole(id);
-            assertNotNull(role.getAttributes());
-            assertTrue(role.getAttributes().isEmpty());
-
-            // update the role with attributes
-            Map<String, List<String>> attributes = new HashMap<>();
-            List<String> attributeValues = new ArrayList<>();
-            attributeValues.add("value1");
-            attributes.put("key1", attributeValues);
-            attributeValues = new ArrayList<>();
-            attributeValues.add("value2.1");
-            attributeValues.add("value2.2");
-            attributes.put("key2", attributeValues);
-            role.setAttributes(attributes);
-
-            resource.updateRole(id, role);
-            role = resource.getRole(id);
-            assertNotNull(role);
-            Map<String, List<String>> roleAttributes = role.getAttributes();
-            assertNotNull(roleAttributes);
-
-            Assert.assertRoleAttributes(attributes, roleAttributes);
-
-
-            // delete an attribute
-            attributes.remove("key2");
-            role.setAttributes(attributes);
-            resource.updateRole(id, role);
-            role = resource.getRole(id);
-            assertNotNull(role);
-            roleAttributes = role.getAttributes();
-            assertNotNull(roleAttributes);
-
-            Assert.assertRoleAttributes(attributes, roleAttributes);
-        }
-    }
-
-    @Test (expected = BadRequestException.class)
-    public void deleteDefaultRole() {
-        resource.deleteRole(adminClient.realm(REALM_NAME).roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + REALM_NAME).toRepresentation().getId());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionTest.java
deleted file mode 100644
index 814159ffb711..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionTest.java
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import jakarta.mail.internet.MimeMessage;
-import jakarta.ws.rs.core.Response;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
-import static org.keycloak.representations.idm.ComponentRepresentation.SECRET_VALUE;
-
-/**
- * @author <a href="mailto:bruno@abstractj.org">Bruno Oliveira</a>
- */
-public class SMTPConnectionTest extends AbstractKeycloakTest {
-
-    public final String SMTP_PASSWORD = setSmtpPassword();
-
-    @Rule
-    public GreenMailRule greenMailRule = new GreenMailRule();
-    private RealmResource realm;
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-    }
-
-    public String setSmtpPassword() {
-        return "admin";
-    }
-
-    @Before
-    public void before() {
-        realm = adminClient.realm("master");
-        List<UserRepresentation> admin = realm.users().search("admin", 0, 1);
-        UserRepresentation user = UserBuilder.edit(admin.get(0)).email("admin@localhost").build();
-        realm.users().get(user.getId()).update(user);
-    }
-
-    private Map<String, String> settings(String host, String port, String from, String auth, String ssl, String starttls,
-                            String username, String password) throws Exception {
-        return smtpMap(host, port, from, auth, ssl, starttls, username, password, "", "");
-    }
-
-    private Map<String, String> smtpMap(String host, String port, String from, String auth, String ssl, String starttls,
-                                        String username, String password, String replyTo, String envelopeFrom) {
-        Map<String, String> config = new HashMap<>();
-        config.put("host", host);
-        config.put("port", port);
-        config.put("from", from);
-        config.put("auth", auth);
-        config.put("ssl", ssl);
-        config.put("starttls", starttls);
-        config.put("user", username);
-        config.put("password", password);
-        config.put("replyTo", replyTo);
-        config.put("envelopeFrom", envelopeFrom);
-        return config;
-    }
-
-    @Test
-    public void testWithNullSettings() throws Exception {
-        Response response = realm.testSMTPConnection(settings(null, null, null, null, null, null,
-                null, null));
-        assertStatus(response, 500);
-    }
-
-    @Test
-    public void testWithProperSettings() throws Exception {
-        Response response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", null, null, null,
-                null, null));
-        assertStatus(response, 204);
-        assertMailReceived();
-    }
-
-    @Test
-    public void testWithAuthEnabledCredentialsEmpty() throws Exception {
-        Response response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
-                null, null));
-        assertStatus(response, 500);
-    }
-
-    @Test
-    public void testWithAuthEnabledValidCredentials() throws Exception {
-        greenMailRule.credentials("admin@localhost", "admin");
-        Response response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
-                "admin@localhost", SMTP_PASSWORD));
-        assertStatus(response, 204);
-    }
-
-    @Test
-    public void testAuthEnabledAndSavedCredentials() throws Exception {
-        RealmRepresentation realmRep = realm.toRepresentation();
-        Map<String, String> oldSmtp = realmRep.getSmtpServer();
-        try {
-            realmRep.setSmtpServer(smtpMap("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
-                    "admin@localhost", SMTP_PASSWORD, null, null));
-            realm.update(realmRep);
-
-            greenMailRule.credentials("admin@localhost", "admin");
-            Response response = realm.testSMTPConnection(settings("127.0.0.1", "3025", "auto@keycloak.org", "true", null, null,
-                    "admin@localhost", SECRET_VALUE));
-            assertStatus(response, 204);
-        } finally {
-            // Revert SMTP back
-            realmRep.setSmtpServer(oldSmtp);
-            realm.update(realmRep);
-        }
-    }
-
-    private void assertStatus(Response response, int status) {
-        assertEquals(status, response.getStatus());
-        response.close();
-    }
-
-    private void assertMailReceived() {
-        if (greenMailRule.getReceivedMessages().length == 1) {
-            try {
-                MimeMessage message = greenMailRule.getReceivedMessages()[0];
-                assertEquals("[KEYCLOAK] - SMTP test message", message.getSubject());
-            } catch (Exception e) {
-                e.printStackTrace();
-            }
-        } else {
-            fail("E-mail was not received");
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionVaultTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionVaultTest.java
deleted file mode 100644
index a4cc775e854d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/SMTPConnectionVaultTest.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package org.keycloak.testsuite.admin;
-
-import org.keycloak.testsuite.arquillian.annotation.EnableVault;
-
-/**
- * @author Martin Kanis <mkanis@redhat.com>
- */
-@EnableVault
-public class SMTPConnectionVaultTest extends SMTPConnectionTest {
-
-    @Override
-    public String setSmtpPassword() {
-        return "${vault.smtp_password}";
-    }
-}
\ No newline at end of file
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/TimeOffsetTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/TimeOffsetTest.java
deleted file mode 100644
index 4a9c2c63ffb6..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/TimeOffsetTest.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright 2023 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.admin;
-
-import org.keycloak.common.util.Time;
-import org.keycloak.events.Event;
-import org.keycloak.events.EventStoreProvider;
-import org.keycloak.events.EventType;
-import org.keycloak.models.RealmModel;
-import org.junit.Test;
-
-import static org.junit.Assert.assertEquals;
-
-public class TimeOffsetTest extends AbstractAdminTest {
-
-    @Test
-    public void testOffset() {
-        String realmId = adminClient.realm(REALM_NAME).toRepresentation().getId();
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
-            realm.setEventsExpiration(5);
-            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
-
-            Event e = new Event();
-            e.setType(EventType.LOGIN);
-            e.setTime(Time.currentTimeMillis());
-            e.setRealmId(realmId);
-            provider.onEvent(e);
-        });
-
-        testingClient.server().run(session -> {
-            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
-            assertEquals(1, provider.createQuery().realm(realmId).getResultStream().count());
-        });
-
-        setTimeOffset(5);
-
-        testingClient.testing().clearExpiredEvents();
-
-        testingClient.server().run(session -> {
-            EventStoreProvider provider = session.getProvider(EventStoreProvider.class);
-            assertEquals(0, provider.createQuery().realm(realmId).getResultStream().count());
-        });
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserStorageRestTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserStorageRestTest.java
deleted file mode 100644
index 99db8ded6404..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserStorageRestTest.java
+++ /dev/null
@@ -1,611 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ComponentResource;
-import org.keycloak.common.constants.KerberosConstants;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.AuthenticationExecutionModel;
-import org.keycloak.models.LDAPConstants;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.representations.idm.ComponentRepresentation;
-import org.keycloak.representations.idm.ComponentTypeRepresentation;
-import org.keycloak.representations.idm.ConfigPropertyRepresentation;
-import org.keycloak.storage.UserStorageProvider;
-import org.keycloak.storage.ldap.mappers.LDAPStorageMapper;
-import org.keycloak.storage.ldap.mappers.membership.CommonLDAPGroupMapperConfig;
-import org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapperFactory;
-import org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig;
-import org.keycloak.storage.ldap.mappers.membership.role.RoleLDAPStorageMapperFactory;
-import org.keycloak.storage.ldap.mappers.membership.role.RoleMapperConfig;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.authentication.AbstractAuthenticationTest;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.core.Response;
-import java.util.List;
-
-import static org.keycloak.testsuite.util.KerberosUtils.assumeKerberosSupportExpected;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class UserStorageRestTest extends AbstractAdminTest {
-    private AuthenticationExecutionInfoRepresentation findKerberosExecution() {
-        AuthenticationExecutionInfoRepresentation kerberosExecution = null;
-        List<AuthenticationExecutionInfoRepresentation> executionReps = realm.flows().getExecutions("browser");
-        kerberosExecution = AbstractAuthenticationTest.findExecutionByProvider("auth-spnego", executionReps);
-
-        Assert.assertNotNull(kerberosExecution);
-        return kerberosExecution;
-    }
-
-    private String createComponent(ComponentRepresentation rep) {
-        Response resp = realm.components().add(rep);
-        Assert.assertEquals(201, resp.getStatus());
-        resp.close();
-        String id = ApiUtil.getCreatedId(resp);
-
-        assertAdminEvents.clear();
-        return id;
-    }
-
-    private void removeComponent(String id) {
-        realm.components().component(id).remove();
-        assertAdminEvents.clear();
-    }
-
-    private void assertFederationProvider(ComponentRepresentation rep, String id, String displayName, String providerId,
-                                          String... config) {
-        Assert.assertEquals(id, rep.getId());
-        Assert.assertEquals(displayName, rep.getName());
-        Assert.assertEquals(providerId, rep.getProviderId());
-
-        Assert.assertMultivaluedMap(rep.getConfig(), config);
-    }
-
-
-    @Test
-    public void testKerberosAuthenticatorEnabledAutomatically() {
-        assumeKerberosSupportExpected();
-
-        // Assert kerberos authenticator DISABLED
-        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-
-        // create LDAP provider with kerberos
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
-
-        String id = createComponent(ldapRep);
-
-        // Assert kerberos authenticator ALTERNATIVE
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
-
-        // Switch kerberos authenticator to DISABLED
-        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
-        realm.flows().updateExecutions("browser", kerberosExecution);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
-
-        // update LDAP provider with kerberos (without changing kerberos switch)
-        ldapRep = realm.components().component(id).toRepresentation();
-        realm.components().component(id).update(ldapRep);
-        assertAdminEvents.clear();
-
-        // Assert kerberos authenticator is still DISABLED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-
-        // update LDAP provider with kerberos (with changing kerberos switch to disabled)
-        ldapRep = realm.components().component(id).toRepresentation();
-        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "false");
-        realm.components().component(id).update(ldapRep);
-        assertAdminEvents.clear();
-
-        // Assert kerberos authenticator is still DISABLED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-
-        // update LDAP provider with kerberos (with changing kerberos switch to enabled)
-        ldapRep = realm.components().component(id).toRepresentation();
-        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
-        realm.components().component(id).update(ldapRep);
-        assertAdminEvents.clear();
-
-        // Assert kerberos authenticator is still ALTERNATIVE
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
-
-        // Cleanup
-        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
-        realm.flows().updateExecutions("browser", kerberosExecution);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
-        removeComponent(id);
-    }
-
-    @Test
-    public void testKerberosAuthenticatorChangedOnlyIfDisabled() {
-        assumeKerberosSupportExpected();
-
-        // Change kerberos to REQUIRED
-        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
-        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString());
-        realm.flows().updateExecutions("browser", kerberosExecution);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
-
-        // create LDAP provider with kerberos
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
-
-        String id = createComponent(ldapRep);
-
-
-        // Assert kerberos authenticator still REQUIRED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.REQUIRED.toString());
-
-        // update LDAP provider with kerberos
-        ldapRep = realm.components().component(id).toRepresentation();
-        realm.components().component(id).update(ldapRep);
-        assertAdminEvents.clear();
-
-        // Assert kerberos authenticator still REQUIRED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.REQUIRED.toString());
-
-        // Cleanup
-        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.toString());
-        realm.flows().updateExecutions("browser", kerberosExecution);
-        assertAdminEvents.assertEvent(realmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), kerberosExecution, ResourceType.AUTH_EXECUTION);
-        removeComponent(id);
-
-    }
-
-
-    // KEYCLOAK-4438
-    @Test
-    public void testKerberosAuthenticatorDisabledWhenProviderRemoved() {
-        assumeKerberosSupportExpected();
-
-        // Assert kerberos authenticator DISABLED
-        AuthenticationExecutionInfoRepresentation kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-
-        // create LDAP provider with kerberos
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION, "true");
-
-
-        String id = createComponent(ldapRep);
-
-        // Assert kerberos authenticator ALTERNATIVE
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
-
-        // Remove LDAP provider
-        realm.components().component(id).remove();
-
-        // Assert kerberos authenticator DISABLED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-
-        // Add kerberos provider
-        ComponentRepresentation kerberosRep = new ComponentRepresentation();
-        kerberosRep.setName("kerberos");
-        kerberosRep.setProviderId("kerberos");
-        kerberosRep.setProviderType(UserStorageProvider.class.getName());
-        kerberosRep.setConfig(new MultivaluedHashMap<>());
-        kerberosRep.getConfig().putSingle("priority", Integer.toString(2));
-
-        id = createComponent(kerberosRep);
-
-
-        // Assert kerberos authenticator ALTERNATIVE
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.ALTERNATIVE.toString());
-
-        // Switch kerberos authenticator to REQUIRED
-        kerberosExecution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString());
-        realm.flows().updateExecutions("browser", kerberosExecution);
-
-        // Remove Kerberos provider
-        realm.components().component(id).remove();
-
-        // Assert kerberos authenticator DISABLED
-        kerberosExecution = findKerberosExecution();
-        Assert.assertEquals(kerberosExecution.getRequirement(), AuthenticationExecutionModel.Requirement.DISABLED.toString());
-    }
-
-
-    @Test
-    public void testValidateAndCreateLdapProviderCustomSearchFilter() {
-        // Invalid filter
-
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "dc=something");
-
-        Response resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Invalid filter
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something");
-        resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Invalid filter
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "dc=something)");
-        resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Assert nothing created so far
-        Assert.assertTrue(realm.components().query(realmId, UserStorageProvider.class.getName()).isEmpty());
-        assertAdminEvents.assertEmpty();
-
-
-        // Valid filter. Creation success
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something)");
-        String id1 = createComponent(ldapRep);
-
-        // Missing filter is ok too. Creation success
-        ComponentRepresentation ldapRep2 = new ComponentRepresentation();
-        ldapRep2.setName("ldap3");
-        ldapRep2.setProviderId("ldap");
-        ldapRep2.setProviderType(UserStorageProvider.class.getName());
-        ldapRep2.setConfig(new MultivaluedHashMap<>());
-        ldapRep2.getConfig().putSingle("priority", Integer.toString(2));
-        ldapRep2.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.UNSYNCED.name());
-        ldapRep2.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager");
-        ldapRep2.getConfig().putSingle(LDAPConstants.BIND_CREDENTIAL, "password");
-        String id2 = createComponent(ldapRep2);
-
-        // Assert both providers created
-        List<ComponentRepresentation> providerInstances = realm.components().query(realmId, UserStorageProvider.class.getName());
-        Assert.assertEquals(providerInstances.size(), 2);
-
-        // Cleanup
-        removeComponent(id1);
-        removeComponent(id2);
-    }
-
-    @Test
-    public void testValidateAndCreateLdapProviderEditMode() {
-        // Test provider without editMode should fail
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().remove(LDAPConstants.EDIT_MODE);
-
-        Response resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Test provider with READ_ONLY edit mode and validatePasswordPolicy will fail
-        ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.READ_ONLY.name());
-        ldapRep.getConfig().putSingle(LDAPConstants.VALIDATE_PASSWORD_POLICY, "true");
-        resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Test provider with UNSYNCED edit mode and validatePasswordPolicy will fail
-        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.UNSYNCED.name());
-        ldapRep.getConfig().putSingle(LDAPConstants.VALIDATE_PASSWORD_POLICY, "true");
-        resp = realm.components().add(ldapRep);
-        Assert.assertEquals(400, resp.getStatus());
-        resp.close();
-
-        // Test provider with WRITABLE edit mode and validatePasswordPolicy will fail
-        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.WRITABLE.name());
-        ldapRep.getConfig().putSingle(LDAPConstants.SYNC_REGISTRATIONS, "true");
-        String id1 = createComponent(ldapRep);
-
-        // Cleanup
-        removeComponent(id1);
-    }
-
-    @Test
-    public void testUpdateProvider() {
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager");
-        ldapRep.getConfig().putSingle(LDAPConstants.BIND_CREDENTIAL, "password");
-        String id = createComponent(ldapRep);
-
-        // Assert update with invalid filter should fail
-        ldapRep = realm.components().component(id).toRepresentation();
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2");
-        ldapRep.getConfig().putSingle(LDAPConstants.BIND_DN, "cn=manager-updated");
-        try {
-            realm.components().component(id).update(ldapRep);
-            Assert.fail("Not expected to successfull update");
-        } catch (BadRequestException bre) {
-            // Expected
-        }
-
-        // Assert nothing was updated
-        assertFederationProvider(realm.components().component(id).toRepresentation(), id, "ldap2", "ldap", LDAPConstants.BIND_DN, "cn=manager", LDAPConstants.BIND_CREDENTIAL, "**********");
-
-        // Change filter to be valid
-        ldapRep.getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
-        realm.components().component(id).update(ldapRep);
-        assertAdminEvents.clear();
-
-        // Assert updated successfully
-        ldapRep = realm.components().component(id).toRepresentation();
-        assertFederationProvider(ldapRep, id, "ldap2", "ldap", LDAPConstants.BIND_DN, "cn=manager-updated", LDAPConstants.BIND_CREDENTIAL, "**********",
-                LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
-
-        // Assert update displayName
-        ldapRep.setName("ldap2");
-        realm.components().component(id).update(ldapRep);
-
-        assertFederationProvider(realm.components().component(id).toRepresentation(), id, "ldap2", "ldap",LDAPConstants.BIND_DN, "cn=manager-updated", LDAPConstants.BIND_CREDENTIAL, "**********",
-                LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(dc=something2)");
-
-
-
-        // Cleanup
-        removeComponent(id);
-    }
-
-
-    // KEYCLOAK-12934
-    @Test
-    public void testLDAPMapperProviderConfigurationForVendorOther() {
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(LDAPConstants.VENDOR, LDAPConstants.VENDOR_OTHER);
-        String ldapModelId = createComponent(ldapRep);
-
-        ComponentTypeRepresentation groupLDAPMapperType = findMapperTypeConfiguration(ldapModelId, GroupLDAPStorageMapperFactory.PROVIDER_ID);
-        ConfigPropertyRepresentation groupRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(groupLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
-
-        // LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
-        List<String> options = groupRetrieverConfigProperty.getOptions();
-        Assert.assertNames(options, GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GroupMapperConfig.GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE);
-        Assert.assertFalse(groupRetrieverConfigProperty.getHelpText().contains("LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
-
-        ComponentTypeRepresentation roleLDAPMapperType = findMapperTypeConfiguration(ldapModelId, RoleLDAPStorageMapperFactory.PROVIDER_ID);
-        ConfigPropertyRepresentation roleRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(roleLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
-
-        // LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
-        options = roleRetrieverConfigProperty.getOptions();
-        Assert.assertNames(options, RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE, RoleMapperConfig.GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE);
-        Assert.assertFalse(roleRetrieverConfigProperty.getHelpText().contains("LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
-
-        // Cleanup including mappers
-        removeComponent(ldapModelId);
-    }
-
-    // KEYCLOAK-12934
-    @Test
-    public void testLDAPMapperProviderConfigurationForVendorMSAD() {
-        ComponentRepresentation ldapRep = createBasicLDAPProviderRep();
-        ldapRep.getConfig().putSingle(LDAPConstants.VENDOR, LDAPConstants.VENDOR_ACTIVE_DIRECTORY);
-        String ldapModelId = createComponent(ldapRep);
-
-        ComponentTypeRepresentation groupLDAPMapperType = findMapperTypeConfiguration(ldapModelId, GroupLDAPStorageMapperFactory.PROVIDER_ID);
-        ConfigPropertyRepresentation groupRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(groupLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
-
-        // LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
-        List<String> options = groupRetrieverConfigProperty.getOptions();
-        Assert.assertNames(options, GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GroupMapperConfig.GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE,
-                GroupMapperConfig.LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY);
-        Assert.assertTrue(groupRetrieverConfigProperty.getHelpText().contains("LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
-
-        ComponentTypeRepresentation roleLDAPMapperType = findMapperTypeConfiguration(ldapModelId, RoleLDAPStorageMapperFactory.PROVIDER_ID);
-        ConfigPropertyRepresentation roleRetrieverConfigProperty = getUserRolesRetrieveStrategyConfigProperty(roleLDAPMapperType, CommonLDAPGroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY);
-
-        // LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY is expected to be present just for the active directory
-        options = roleRetrieverConfigProperty.getOptions();
-        Assert.assertNames(options, RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE, RoleMapperConfig.GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE,
-                RoleMapperConfig.LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY);
-        Assert.assertTrue(roleRetrieverConfigProperty.getHelpText().contains("LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY"));
-
-        // Cleanup including mappers
-        removeComponent(ldapModelId);
-    }
-
-    private ComponentRepresentation createBasicLDAPProviderRep() {
-        ComponentRepresentation ldapRep = new ComponentRepresentation();
-        ldapRep.setName("ldap2");
-        ldapRep.setProviderId("ldap");
-        ldapRep.setProviderType(UserStorageProvider.class.getName());
-        ldapRep.setConfig(new MultivaluedHashMap<>());
-        ldapRep.getConfig().putSingle("priority", Integer.toString(2));
-        ldapRep.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.WRITABLE.name());
-        return ldapRep;
-    }
-
-    private ComponentTypeRepresentation findMapperTypeConfiguration(String ldapModelId, String mapperProviderId) {
-        ComponentResource ldapProvider = realm.components().component(ldapModelId);
-        List<ComponentTypeRepresentation> componentTypes = ldapProvider.getSubcomponentConfig(LDAPStorageMapper.class.getName());
-
-        return componentTypes.stream()
-                .filter(componentType -> mapperProviderId.equals(componentType.getId()))
-                .findFirst()
-                .orElseThrow(() -> new IllegalStateException("Not able to find mapper with provider id: " + mapperProviderId));
-    }
-
-    private  ConfigPropertyRepresentation getUserRolesRetrieveStrategyConfigProperty(ComponentTypeRepresentation componentType, String propertyName) {
-        return componentType.getProperties().stream()
-                .filter(configPropertyRep -> propertyName.equals(configPropertyRep.getName()))
-                .findFirst()
-                .orElseThrow(() -> new IllegalStateException("Not able to find config property with name: " + propertyName));
-    }
-
-/*
-    @Test
-    public void testProviderFactories() {
-        List<UserFederationProviderFactoryRepresentation> providerFactories = userFederation().getProviderFactories();
-        Assert.assertNames(providerFactories, "ldap", "kerberos", "dummy", "dummy-configurable");
-
-        // Builtin provider without properties
-        UserFederationProviderFactoryRepresentation ldapProvider = userFederation().getProviderFactory("ldap");
-        Assert.assertEquals(ldapProvider.getId(), "ldap");
-        Assert.assertEquals(0, ldapProvider.getOptions().size());
-
-        // Configurable through the "old-way" options
-        UserFederationProviderFactoryRepresentation dummyProvider = userFederation().getProviderFactory("dummy");
-        Assert.assertEquals(dummyProvider.getId(), "dummy");
-        Assert.assertNames(new LinkedList<>(dummyProvider.getOptions()), "important.config");
-
-        // Configurable through the "new-way" ConfiguredProvider
-        UserFederationProviderFactoryRepresentation dummyConfiguredProvider = userFederation().getProviderFactory("dummy-configurable");
-        Assert.assertEquals(dummyConfiguredProvider.getId(), "dummy-configurable");
-        Assert.assertTrue(dummyConfiguredProvider.getOptions() == null || dummyConfiguredProvider.getOptions().isEmpty());
-        Assert.assertEquals("Dummy User Federation Provider Help Text", dummyConfiguredProvider.getHelpText());
-        Assert.assertEquals(2, dummyConfiguredProvider.getProperties().size());
-        Assert.assertProviderConfigProperty(dummyConfiguredProvider.getProperties().get(0), "prop1", "Prop1", "prop1Default", "Prop1 HelpText", ProviderConfigProperty.STRING_TYPE);
-        Assert.assertProviderConfigProperty(dummyConfiguredProvider.getProperties().get(1), "prop2", "Prop2", "true", "Prop2 HelpText", ProviderConfigProperty.BOOLEAN_TYPE);
-
-        try {
-            userFederation().getProviderFactory("not-existent");
-            Assert.fail("Not expected to find not-existent provider");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    private UserFederationProvidersResource userFederation() {
-        return null;//realm.userFederation();
-    }
-
-
-    @Test
-    public void testCreateProvider() {
-        // create provider without configuration and displayName
-        UserFederationProviderRepresentation dummyRep1 = UserFederationProviderBuilder.create()
-                .providerName("dummy")
-                .displayName("")
-                .priority(2)
-                .fullSyncPeriod(1000)
-                .changedSyncPeriod(500)
-                .lastSync(123)
-                .build();
-
-        String id1 = createUserFederationProvider(dummyRep1);
-
-        // create provider with configuration and displayName
-        UserFederationProviderRepresentation dummyRep2 = UserFederationProviderBuilder.create()
-                .providerName("dummy")
-                .displayName("dn1")
-                .priority(1)
-                .configProperty("prop1", "prop1Val")
-                .configProperty("prop2", "true")
-                .build();
-        String id2 = createUserFederationProvider(dummyRep2);
-
-        // Assert provider instances available
-        assertFederationProvider(userFederation().get(id1).toBriefRepresentation(), id1, id1, "dummy", 2, 1000, 500, 123);
-        assertFederationProvider(userFederation().get(id2).toBriefRepresentation(), id2, "dn1", "dummy", 1, -1, -1, -1, "prop1", "prop1Val", "prop2", "true");
-
-        // Assert sorted
-        List<UserFederationProviderRepresentation> providerInstances = userFederation().getProviderInstances();
-        Assert.assertEquals(providerInstances.size(), 2);
-        assertFederationProvider(providerInstances.get(0), id2, "dn1", "dummy", 1, -1, -1, -1, "prop1", "prop1Val", "prop2", "true");
-        assertFederationProvider(providerInstances.get(1), id1, id1, "dummy", 2, 1000, 500, 123);
-
-        // Remove providers
-        removeUserFederationProvider(id1);
-        removeUserFederationProvider(id2);
-    }
-
-
-
-
-
-
-
-
-    @Test (expected = NotFoundException.class)
-    public void testLookupNotExistentProvider() {
-        userFederation().get("not-existent").toBriefRepresentation();
-    }
-
-
-    @Test
-    public void testSyncFederationProvider() {
-        // create provider
-        UserFederationProviderRepresentation dummyRep1 = UserFederationProviderBuilder.create()
-                .providerName("dummy")
-                .build();
-        String id1 = createUserFederationProvider(dummyRep1);
-
-
-        // Sync with unknown action shouldn't pass
-        try {
-            userFederation().get(id1).syncUsers("unknown");
-            Assert.fail("Not expected to sync with unknown action");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Assert sync didn't happen
-        Assert.assertEquals(-1, userFederation().get(id1).toBriefRepresentation().getLastSync());
-
-        // Sync and assert it happened
-        SynchronizationResultRepresentation syncResult = userFederation().get(id1).syncUsers("triggerFullSync");
-        Assert.assertEquals("0 imported users, 0 updated users", syncResult.getStatus());
-
-        Map<String, Object> eventRep = new HashMap<>();
-        eventRep.put("action", "triggerFullSync");
-        assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.userFederationResourcePath(id1) + "/sync", eventRep, ResourceType.USER_FEDERATION_PROVIDER);
-
-        int fullSyncTime = userFederation().get(id1).toBriefRepresentation().getLastSync();
-        Assert.assertTrue(fullSyncTime > 0);
-
-        // Changed sync
-        setTimeOffset(50);
-        syncResult = userFederation().get(id1).syncUsers("triggerChangedUsersSync");
-
-        eventRep.put("action", "triggerChangedUsersSync");
-        assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.userFederationResourcePath(id1) + "/sync", eventRep, ResourceType.USER_FEDERATION_PROVIDER);
-
-        Assert.assertEquals("0 imported users, 0 updated users", syncResult.getStatus());
-        int changedSyncTime = userFederation().get(id1).toBriefRepresentation().getLastSync();
-        Assert.assertTrue(fullSyncTime + 50 <= changedSyncTime);
-
-        // Cleanup
-        resetTimeOffset();
-        removeUserFederationProvider(id1);
-    }
-
-
-
-    private void assertFederationProvider(UserFederationProviderRepresentation rep, String id, String displayName, String providerName,
-                                          int priority, int fullSyncPeriod, int changeSyncPeriod, int lastSync,
-                                          String... config) {
-        Assert.assertEquals(id, rep.getId());
-        Assert.assertEquals(displayName, rep.getDisplayName());
-        Assert.assertEquals(providerName, rep.getProviderName());
-        Assert.assertEquals(priority, rep.getPriority());
-        Assert.assertEquals(fullSyncPeriod, rep.getFullSyncPeriod());
-        Assert.assertEquals(changeSyncPeriod, rep.getChangedSyncPeriod());
-        Assert.assertEquals(lastSync, rep.getLastSync());
-
-        Assert.assertMap(rep.getConfig(), config);
-    }
-
-
-    */
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserTest.java
index fe92d5ad7504..d490a5503bc9 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UserTest.java
@@ -27,6 +27,7 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.keycloak.TokenVerifier;
+import org.keycloak.admin.client.CreatedResponseUtil;
 import org.keycloak.admin.client.Keycloak;
 import org.keycloak.admin.client.resource.GroupResource;
 import org.keycloak.admin.client.resource.IdentityProviderResource;
@@ -40,15 +41,15 @@
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.ObjectUtil;
 import org.keycloak.credential.CredentialModel;
-import org.keycloak.credential.hash.Pbkdf2Sha512PasswordHashProviderFactory;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.models.Constants;
 import org.keycloak.models.LDAPConstants;
-import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.jpa.entities.CredentialEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.StripSecretsUtils;
@@ -72,12 +73,12 @@
 import org.keycloak.representations.userprofile.config.UPAttribute;
 import org.keycloak.representations.userprofile.config.UPAttributePermissions;
 import org.keycloak.representations.userprofile.config.UPConfig;
+import org.keycloak.services.ErrorResponseException;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.testsuite.federation.DummyUserFederationProviderFactory;
 import org.keycloak.testsuite.federation.UserMapStorageFactory;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
-import org.keycloak.testsuite.page.LoginPasswordUpdatePage;
+import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.InfoPage;
 import org.keycloak.testsuite.pages.LoginPage;
@@ -93,10 +94,11 @@
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.GroupBuilder;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.DefaultAttributes;
 import org.keycloak.userprofile.validator.UsernameProhibitedCharactersValidator;
 import org.keycloak.util.JsonSerialization;
@@ -125,17 +127,20 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.Function;
+import java.util.function.Predicate;
 import java.util.stream.Collectors;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.allOf;
 import static org.hamcrest.Matchers.contains;
 import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.endsWith;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
 import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
+import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
@@ -200,14 +205,14 @@ public class UserTest extends AbstractAdminTest {
     public void beforeUserTest() throws IOException {
         createAppClientInRealm(REALM_NAME);
 
-        VerifyProfileTest.setUserProfileConfiguration(realm, null);
+        UserProfileUtil.setUserProfileConfiguration(realm, null);
         UPConfig upConfig = realm.users().userProfile().getConfiguration();
 
         for (String name : managedAttributes) {
             upConfig.addOrReplaceAttribute(createAttributeMetadata(name));
         }
 
-        VerifyProfileTest.setUserProfileConfiguration(realm, JsonSerialization.writeValueAsString(upConfig));
+        UserProfileUtil.setUserProfileConfiguration(realm, JsonSerialization.writeValueAsString(upConfig));
 
         assertAdminEvents.clear();
     }
@@ -324,8 +329,13 @@ public void createDuplicatedUser2() {
             assertEquals(409, response.getStatus());
             assertAdminEvents.assertEmpty();
 
-            ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-            Assert.assertEquals("User exists with same email", error.getErrorMessage());
+            // Alternative way of showing underlying error message
+            try {
+                CreatedResponseUtil.getCreatedId(response);
+                Assert.fail("Not expected getCreatedId to success");
+            } catch (WebApplicationException wae) {
+                Assert.assertThat(wae.getMessage(), endsWith("ErrorMessage: User exists with same email"));
+            }
         }
     }
 
@@ -480,7 +490,7 @@ public void updateUserWithHashedCredentials() {
         realm.users().get(userId).update(userRepresentation);
 
         oauth.realm(REALM_NAME);
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
 
         assertEquals("Sign in to your account", PageUtils.getPageTitle(driver));
 
@@ -777,7 +787,7 @@ private List<String> createUsers() {
 
             addAttribute(user, "test", Collections.singletonList("test" + i));
             addAttribute(user, "test" + i, Collections.singletonList("test" + i));
-            addAttribute(user, "attr", Collections.singletonList("common"));
+            addAttribute(user, "attr", Arrays.asList("common", "common2"));
 
             ids.add(createUser(user));
         }
@@ -814,6 +824,11 @@ public void countByAttribute() {
         attributes = new HashMap<>();
         attributes.put("attr", "common");
         assertThat(realm.users().count(null, null, null, null, null, null, null, mapToSearchQuery(attributes)), is(9));
+
+        attributes = new HashMap<>();
+        attributes.put("attr", "common");
+        attributes.put(UserModel.EXACT, Boolean.FALSE.toString());
+        assertThat(realm.users().count(null, null, null, null, null, null, null, mapToSearchQuery(attributes)), is(9));
     }
 
   @Test
@@ -947,6 +962,33 @@ public void searchByAttributesWithPagination() {
         }
     }
 
+    @Test
+    public void searchByAttributesForAnyValue() {
+        createUser(UserBuilder.create().username("user-0").addAttribute("attr", "common").build());
+        createUser(UserBuilder.create().username("user-1").addAttribute("test", "common").build());
+        createUser(UserBuilder.create().username("user-2").addAttribute("test", "common").addAttribute("attr", "common").build());
+
+        Map<String, String> attributes = new HashMap<>();
+        attributes.put("attr", "");
+        // exact needs to be set to false to match for any users with the attribute attr
+        List<UserRepresentation> users = realm.users().searchByAttributes(-1, -1, null, false, false, mapToSearchQuery(attributes));
+        assertEquals(2, users.size());
+        assertTrue(users.stream().allMatch(r -> Set.of("user-0", "user-2").contains(r.getUsername())));
+
+        attributes = new HashMap<>();
+        attributes.put("test", "");
+        users = realm.users().searchByAttributes(-1, -1, null, false, false, mapToSearchQuery(attributes));
+        assertEquals(2, users.size());
+        assertTrue(users.stream().allMatch(r -> Set.of("user-1", "user-2").contains(r.getUsername())));
+
+        attributes = new HashMap<>();
+        attributes.put("test", "");
+        attributes.put("attr", "");
+        users = realm.users().searchByAttributes(-1, -1, null, false, false, mapToSearchQuery(attributes));
+        assertEquals(1, users.size());
+        assertTrue(users.stream().allMatch(r -> "user-2".equals(r.getUsername())));
+    }
+
     @Test
     public void storeAndReadUserWithLongAttributeValue() {
         String longValue = RandomStringUtils.random(Integer.parseInt(DefaultAttributes.DEFAULT_MAX_LENGTH_ATTRIBUTES), true, true);
@@ -1259,7 +1301,8 @@ public void searchByIdpAndEnabled() {
 
     @Test
     public void searchById() {
-        String expectedUserId = createUsers().get(0);
+        List<String> userIds = createUsers();
+        String expectedUserId = userIds.get(0);
         List<UserRepresentation> users = realm.users().search("id:" + expectedUserId, null, null);
 
         assertEquals(1, users.size());
@@ -1269,6 +1312,19 @@ public void searchById() {
 
         assertEquals(1, users.size());
         assertEquals(expectedUserId, users.get(0).getId());
+
+        // Should allow searching for multiple users
+        String expectedUserId2 = userIds.get(1);
+        List<UserRepresentation> multipleUsers = realm.users().search(String.format("id:%s %s", expectedUserId, expectedUserId2), 0 , 10);;
+        assertThat(multipleUsers, hasSize(2));
+        assertThat(multipleUsers.get(0).getId(), is(expectedUserId));
+        assertThat(multipleUsers.get(1).getId(), is(expectedUserId2));
+
+        // Should take arbitrary amount of spaces in between ids
+        List<UserRepresentation> multipleUsers2 = realm.users().search(String.format("id:  %s   %s  ", expectedUserId, expectedUserId2), 0 , 10);;
+        assertThat(multipleUsers2, hasSize(2));
+        assertThat(multipleUsers2.get(0).getId(), is(expectedUserId));
+        assertThat(multipleUsers2.get(1).getId(), is(expectedUserId2));
     }
 
     @Test
@@ -1424,6 +1480,26 @@ public void exactSearch() {
         assertThat(userIds.get(0), equalTo(users.get(0).getId()));
     }
 
+    @Test
+    public void testSearchBasedOnUserProfileSettings() {
+        UserRepresentation user = new UserRepresentation();
+        user.setUsername("test_username");
+        user.setFirstName("test_first_name");
+        user.setLastName("test_last_name");
+        user.setEmail("test_email@test.com");
+        user.setEnabled(true);
+        user.setEmailVerified(true);
+        createUser(user);
+
+        UPConfig upConfig = realm.users().userProfile().getConfiguration();
+        upConfig.getAttribute(UserModel.FIRST_NAME).setPermissions(new UPAttributePermissions());
+        realm.users().userProfile().update(upConfig);
+        List<UserRepresentation> users = realm.users().list();
+        assertThat(users, hasSize(1));
+        user = users.get(0);
+        assertThat(user.getFirstName(), is(nullValue()));
+    }
+
     @Test
     public void searchWithExactMatch() {
         UserRepresentation user = new UserRepresentation();
@@ -2894,7 +2970,7 @@ public void resetUserPassword() {
         assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.userResetPasswordPath(userId), ResourceType.USER);
 
         oauth.realm(REALM_NAME);
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
 
         assertEquals("Sign in to your account", PageUtils.getPageTitle(driver));
 
@@ -3159,16 +3235,17 @@ public void defaultMaxResults() {
         UserProfileResource upResource = adminClient.realm("test").users().userProfile();
         UPConfig upConfig = upResource.getConfiguration();
         upConfig.addOrReplaceAttribute(createAttributeMetadata("aName"));
+        upConfig.getAttribute("aName").setPermissions(new UPAttributePermissions(Set.of("user", "admin"), Set.of("user", "admin")));
         upResource.update(upConfig);
 
         try {
             UsersResource users = adminClient.realms().realm("test").users();
 
             for (int i = 0; i < 110; i++) {
-                users.create(UserBuilder.create().username("test-" + i).addAttribute("aName", "aValue").build()).close();
+                users.create(UserBuilder.create().username("test2-" + i).addAttribute("aName", "aValue").build()).close();
             }
 
-            List<UserRepresentation> result = users.search("test", null, null);
+            List<UserRepresentation> result = users.search("test2", null, null);
             assertEquals(100, result.size());
             for (UserRepresentation user : result) {
                 assertThat(user.getAttributes(), Matchers.notNullValue());
@@ -3176,8 +3253,8 @@ public void defaultMaxResults() {
                 assertThat(user.getAttributes(), Matchers.hasEntry(is("aName"), Matchers.contains("aValue")));
             }
 
-            assertEquals(105, users.search("test", 0, 105).size());
-            assertEquals(111, users.search("test", 0, 1000).size());
+            assertEquals(105, users.search("test2", 0, 105).size());
+            assertEquals(110, users.search("test2", 0, 1000).size());
         } finally {
             upConfig.removeAttribute("aName");
             upResource.update(upConfig);
@@ -3189,6 +3266,7 @@ public void defaultMaxResultsBrief() {
         UserProfileResource upResource = adminClient.realm("test").users().userProfile();
         UPConfig upConfig = upResource.getConfiguration();
         upConfig.addOrReplaceAttribute(createAttributeMetadata("aName"));
+        upConfig.getAttribute("aName").setPermissions(new UPAttributePermissions());
         upResource.update(upConfig);
 
         try {
@@ -3280,7 +3358,7 @@ public void loginShouldFailAfterPasswordDeleted() {
         getCleanup(REALM_NAME).addUserId(userId);
 
         oauth.realm(REALM_NAME);
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         assertEquals("Test user should be on the login page.", "Sign in to your account", PageUtils.getPageTitle(driver));
         loginPage.login(userName, userPass);
         assertTrue("Test user should be successfully logged in.", driver.getTitle().contains("AUTH_RESPONSE"));
@@ -3293,7 +3371,7 @@ public void loginShouldFailAfterPasswordDeleted() {
         assertTrue("Test user should have a password credential set.", passwordCredential.isPresent());
         realm.users().get(userId).removeCredential(passwordCredential.get().getId());
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         assertEquals("Test user should be on the login page.", "Sign in to your account", PageUtils.getPageTitle(driver));
         loginPage.login(userName, userPass);
         assertTrue("Test user should fail to log in after password was deleted.",
@@ -3341,15 +3419,62 @@ private void assertSameIds(List<String> expectedIds, List<CredentialRepresentati
     public void testUpdateCredentials() {
         importTestRealms();
 
+        // both credentials have a null priority - stable ordering is not guaranteed between calls
+
         // Get user user-with-one-configured-otp and assert he has no label linked to its OTP credential
         UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "user-with-one-configured-otp");
-        CredentialRepresentation otpCred = user.credentials().get(0);
+        CredentialRepresentation otpCred = user.credentials().stream().filter(cr -> "otp".equals(cr.getType()))
+                .findFirst().orElseThrow();
         Assert.assertNull(otpCred.getUserLabel());
 
         // Set and check a new label
         String newLabel = "the label";
         user.setCredentialUserLabel(otpCred.getId(), newLabel);
-        Assert.assertEquals(newLabel, user.credentials().get(0).getUserLabel());
+        Assert.assertEquals(newLabel, user.credentials().stream().filter(cr -> cr.getId().equals(otpCred.getId()))
+                .findFirst().orElseThrow().getUserLabel());
+    }
+
+    @Test
+    public void testShouldFailToSetCredentialUserLabelWhenLabelIsEmpty() {
+        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "user-with-one-configured-otp");
+        CredentialRepresentation otpCred = user.credentials().get(0);
+            BadRequestException ex = assertThrows(BadRequestException.class, () -> {
+                user.setCredentialUserLabel(otpCred.getId(), "   ");
+            });
+            Response response = ex.getResponse();
+            String body = response.readEntity(String.class);
+
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+            assertTrue(body.contains("missingCredentialLabel"));
+            assertTrue(body.contains("Credential label must not be empty"));
+    }
+
+    @Test
+    public void testShouldFailToSetCredentialUserLabelWhenLabelAlreadyExists() {
+        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "user-with-two-configured-otp");
+
+        List<CredentialRepresentation> credentials = user.credentials().stream()
+                .filter(c -> c.getType().equals(OTPCredentialModel.TYPE))
+                .toList();
+        assertEquals(2, credentials.size());
+
+        String firstId = credentials.get(0).getId();
+        String secondId = credentials.get(1).getId();
+
+        user.setCredentialUserLabel(firstId, "Device");
+        user.setCredentialUserLabel(secondId, "Second Device");
+
+        // Attempt to update second credential to use the same label as the first
+        ClientErrorException ex = assertThrows(ClientErrorException.class, () -> {
+            user.setCredentialUserLabel(secondId, "Device");
+        });
+
+        Response response = ex.getResponse();
+        assertEquals(Response.Status.CONFLICT.getStatusCode(), response.getStatus());
+
+        String body = response.readEntity(String.class);
+        assertNotNull(body);
+        assertTrue(body.contains("Device already exists with the same name"));
     }
 
     @Test
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UsersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UsersTest.java
deleted file mode 100644
index a840eaf8ebb0..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/UsersTest.java
+++ /dev/null
@@ -1,445 +0,0 @@
-/*
- * Copyright 2019 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.AuthorizationResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.Profile;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.ManagementPermissionRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.authorization.DecisionStrategy;
-import org.keycloak.representations.idm.authorization.PolicyRepresentation;
-import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
-import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.util.AdminClientUtil;
-
-import java.io.IOException;
-import java.security.KeyManagementException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.cert.CertificateException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Optional;
-
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.Matchers.empty;
-import static org.hamcrest.Matchers.not;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.hasSize;
-
-public class UsersTest extends AbstractAdminTest {
-
-    @Before
-    public void cleanUsers() {
-        List<UserRepresentation> userRepresentations = realm.users().list();
-        for (UserRepresentation user : userRepresentations) {
-            realm.users().delete(user.getId());
-        }
-    }
-
-    @Override
-    protected boolean isImportAfterEachMethod() {
-        // always import realm due to changes in setupTestEnvironmentWithPermissions
-        return true;
-    }
-
-    @Test
-    public void searchUserWithWildcards() throws Exception {
-        createUser(REALM_NAME, "User", "password", "firstName", "lastName", "user@example.com");
-
-        assertThat(adminClient.realm(REALM_NAME).users().search("Use%", null, null), hasSize(0));
-        assertThat(adminClient.realm(REALM_NAME).users().search("Use_", null, null), hasSize(0));
-        assertThat(adminClient.realm(REALM_NAME).users().search("Us_r", null, null), hasSize(0));
-        assertThat(adminClient.realm(REALM_NAME).users().search("Use", null, null), hasSize(1));
-        assertThat(adminClient.realm(REALM_NAME).users().search("Use*", null, null), hasSize(1));
-        assertThat(adminClient.realm(REALM_NAME).users().search("Us*e", null, null), hasSize(1));
-    }
-
-    @Test
-    public void searchUserDefaultSettings() throws Exception {
-        createUser(REALM_NAME, "User", "password", "firstName", "lastName", "user@example.com");
-
-        assertCaseInsensitiveSearch();
-    }
-    
-    @Test
-    public void searchUserMatchUsersCount() {
-        createUser(REALM_NAME, "john.doe", "password", "John", "Doe Smith", "john.doe@keycloak.org");
-        String search = "jo do";
-
-        assertThat(adminClient.realm(REALM_NAME).users().count(search), is(1));
-        List<UserRepresentation> users = adminClient.realm(REALM_NAME).users().search(search, null, null);
-        assertThat(users, hasSize(1));
-        assertThat(users.get(0).getUsername(), is("john.doe"));
-    }
-
-    /**
-     * https://issues.redhat.com/browse/KEYCLOAK-15146
-     */
-    @Test
-    public void findUsersByEmailVerifiedStatus() {
-
-        createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com", rep -> rep.setEmailVerified(true));
-        createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com", rep -> rep.setEmailVerified(false));
-
-        boolean emailVerified;
-        emailVerified = true;
-        List<UserRepresentation> usersEmailVerified = realm.users().search(null, null, null, null, emailVerified, null, null, null, true);
-        assertThat(usersEmailVerified, is(not(empty())));
-        assertThat(usersEmailVerified.get(0).getUsername(), is("user1"));
-
-        emailVerified = false;
-        List<UserRepresentation> usersEmailNotVerified = realm.users().search(null, null, null, null, emailVerified, null, null, null, true);
-        assertThat(usersEmailNotVerified, is(not(empty())));
-        assertThat(usersEmailNotVerified.get(0).getUsername(), is("user2"));
-    }
-
-    /**
-     * https://issues.redhat.com/browse/KEYCLOAK-15146
-     */
-    @Test
-    public void countUsersByEmailVerifiedStatus() {
-
-        createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com", rep -> rep.setEmailVerified(true));
-        createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com", rep -> rep.setEmailVerified(false));
-        createUser(REALM_NAME, "user3", "password", "user3FirstName", "user3LastName", "user3@example.com", rep -> rep.setEmailVerified(true));
-
-        boolean emailVerified;
-        emailVerified = true;
-        assertThat(realm.users().countEmailVerified(emailVerified), is(2));
-        assertThat(realm.users().count(null,null,null,emailVerified,null), is(2));
-
-        emailVerified = false;
-        assertThat(realm.users().countEmailVerified(emailVerified), is(1));
-        assertThat(realm.users().count(null,null,null,emailVerified,null), is(1));
-    }
-
-    @Test
-    public void countUsersWithViewPermission() {
-        createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com");
-        createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com");
-        assertThat(realm.users().count(), is(2));
-    }
-
-    @Test
-    public void countUsersBySearchWithViewPermission() {
-        createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com", rep -> rep.setEmailVerified(true));
-        createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com", rep -> rep.setEmailVerified(false));
-        createUser(REALM_NAME, "user3", "password", "user3FirstName", "user3LastName", "user3@example.com", rep -> rep.setEmailVerified(true));
-
-        // Prefix search count
-        assertSearchMatchesCount(realm, "user", 3);
-        assertSearchMatchesCount(realm, "user*", 3);
-        assertSearchMatchesCount(realm, "er", 0);
-        assertSearchMatchesCount(realm, "", 3);
-        assertSearchMatchesCount(realm, "*", 3);
-        assertSearchMatchesCount(realm, "user2FirstName", 1);
-        assertSearchMatchesCount(realm, "user2First", 1);
-        assertSearchMatchesCount(realm, "user2First*", 1);
-        assertSearchMatchesCount(realm, "user1@example", 1);
-        assertSearchMatchesCount(realm, "user1@example*", 1);
-        assertSearchMatchesCount(realm, null, 3);
-
-        // Infix search count
-        assertSearchMatchesCount(realm, "*user*", 3);
-        assertSearchMatchesCount(realm, "**", 3);
-        assertSearchMatchesCount(realm, "*foobar*", 0);
-        assertSearchMatchesCount(realm, "*LastName*", 3);
-        assertSearchMatchesCount(realm, "*FirstName*", 3);
-        assertSearchMatchesCount(realm, "*@example.com*", 3);
- 
-        // Exact search count
-        assertSearchMatchesCount(realm, "\"user1\"", 1);
-        assertSearchMatchesCount(realm, "\"1\"", 0);
-        assertSearchMatchesCount(realm, "\"\"", 0);
-        assertSearchMatchesCount(realm, "\"user1FirstName\"", 1);
-        assertSearchMatchesCount(realm, "\"user1LastName\"", 1);
-        assertSearchMatchesCount(realm, "\"user1@example.com\"", 1);
-    }
-
-    private void assertSearchMatchesCount(RealmResource realm, String search, Integer expectedCount) {
-        Integer count = realm.users().count(search);
-        assertThat(count, is(expectedCount));
-        assertThat(realm.users().search(search, null, null), hasSize(count));
-    }
-
-    @Test
-    public void countUsersByFiltersWithViewPermission() {
-        createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com");
-        createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com");
-        //search username
-        assertThat(realm.users().count(null, null, null, "user"), is(2));
-        assertThat(realm.users().count(null, null, null, "user1"), is(1));
-        assertThat(realm.users().count(null, null, null, "notExisting"), is(0));
-        assertThat(realm.users().count(null, null, null, ""), is(2));
-        //search first name
-        assertThat(realm.users().count(null, "FirstName", null, null), is(2));
-        assertThat(realm.users().count(null, "user2FirstName", null, null), is(1));
-        assertThat(realm.users().count(null, "notExisting", null, null), is(0));
-        assertThat(realm.users().count(null, "", null, null), is(2));
-        //search last name
-        assertThat(realm.users().count("LastName", null, null, null), is(2));
-        assertThat(realm.users().count("user2LastName", null, null, null), is(1));
-        assertThat(realm.users().count("notExisting", null, null, null), is(0));
-        assertThat(realm.users().count("", null, null, null), is(2));
-        //search in email
-        assertThat(realm.users().count(null, null, "@example.com", null), is(2));
-        assertThat(realm.users().count(null, null, "user1@example.com", null), is(1));
-        assertThat(realm.users().count(null, null, "user1@test.com", null), is(0));
-        assertThat(realm.users().count(null, null, "", null), is(2));
-        //search for combinations
-        assertThat(realm.users().count("LastName", "FirstName", null, null), is(2));
-        assertThat(realm.users().count("user1LastName", "FirstName", null, null), is(1));
-        assertThat(realm.users().count("user1LastName", "", null, null), is(1));
-        assertThat(realm.users().count("LastName", "", null, null), is(2));
-        assertThat(realm.users().count("LastName", "", null, null), is(2));
-        assertThat(realm.users().count(null, null, "@example.com", "user"), is(2));
-        //search not specified (defaults to simply /count)
-        assertThat(realm.users().count(null, null, null, null), is(2));
-        assertThat(realm.users().count("", "", "", ""), is(2));
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
-        assertThat(testRealmResource.users().count(), is(3));
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersBySearchWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
-        //search all
-        assertSearchMatchesCount(testRealmResource, "user", 3);
-        //search first name
-        assertSearchMatchesCount(testRealmResource, "*FirstName*", 3);
-        assertSearchMatchesCount(testRealmResource, "user2FirstName", 1);
-        //search last name
-        assertSearchMatchesCount(testRealmResource, "*LastName*", 3);
-        assertSearchMatchesCount(testRealmResource, "user2LastName", 1);
-        //search in email
-        assertSearchMatchesCount(testRealmResource, "*@example.com*", 3);
-        assertSearchMatchesCount(testRealmResource, "user1@example.com", 1);
-        //search for something not existing
-        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
-        //search for empty string
-        assertSearchMatchesCount(testRealmResource, "", 3);
-        //search not specified (defaults to simply /count)
-        assertSearchMatchesCount(testRealmResource, null, 3);
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersByFiltersWithGroupViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(true);
-        //search username
-        assertThat(testRealmResource.users().count(null, null, null, "user"), equalTo(testRealmResource.users().search("user", null, null, null, null, null).size()));
-        assertThat(testRealmResource.users().count(null, null, null, "user"), is(3));
-        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(1));
-        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
-        assertThat(testRealmResource.users().count(null, null, null, ""), is(3));
-        //search first name
-        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(3));
-        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(1));
-        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
-        assertThat(testRealmResource.users().count(null, "", null, null), is(3));
-        //search last name
-        assertThat(testRealmResource.users().count("LastName", null, null, null), is(3));
-        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(1));
-        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
-        assertThat(testRealmResource.users().count("", null, null, null), is(3));
-        //search in email
-        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(3));
-        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(1));
-        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
-        assertThat(testRealmResource.users().count(null, null, "", null), is(3));
-        //search for combinations
-        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(3));
-        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(1));
-        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(1));
-        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
-        assertThat(testRealmResource.users().count("LastName", "", null, null), is(3));
-        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(3));
-        //search not specified (defaults to simply /count)
-        assertThat(testRealmResource.users().count(null, null, null, null), is(3));
-        assertThat(testRealmResource.users().count("", "", "", ""), is(3));
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, KeyManagementException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
-        assertThat(testRealmResource.users().count(), is(0));
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersBySearchWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
-        //search all
-        assertSearchMatchesCount(testRealmResource, "user", 0);
-        //search first name
-        assertSearchMatchesCount(testRealmResource, "FirstName", 0);
-        assertSearchMatchesCount(testRealmResource, "user2FirstName", 0);
-        //search last name
-        assertSearchMatchesCount(testRealmResource, "LastName", 0);
-        assertSearchMatchesCount(testRealmResource, "user2LastName", 0);
-        //search in email
-        assertSearchMatchesCount(testRealmResource, "@example.com", 0);
-        assertSearchMatchesCount(testRealmResource, "user1@example.com", 0);
-        //search for something not existing
-        assertSearchMatchesCount(testRealmResource, "notExisting", 0);
-        //search for empty string
-        assertSearchMatchesCount(testRealmResource, "", 0);
-        //search not specified (defaults to simply /count)
-        assertSearchMatchesCount(testRealmResource, null, 0);
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-    public void countUsersByFiltersWithNoViewPermission() throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        RealmResource testRealmResource = setupTestEnvironmentWithPermissions(false);
-        //search username
-        assertThat(testRealmResource.users().count(null, null, null, "user"), is(0));
-        assertThat(testRealmResource.users().count(null, null, null, "user1"), is(0));
-        assertThat(testRealmResource.users().count(null, null, null, "notExisting"), is(0));
-        assertThat(testRealmResource.users().count(null, null, null, ""), is(0));
-        //search first name
-        assertThat(testRealmResource.users().count(null, "FirstName", null, null), is(0));
-        assertThat(testRealmResource.users().count(null, "user2FirstName", null, null), is(0));
-        assertThat(testRealmResource.users().count(null, "notExisting", null, null), is(0));
-        assertThat(testRealmResource.users().count(null, "", null, null), is(0));
-        //search last name
-        assertThat(testRealmResource.users().count("LastName", null, null, null), is(0));
-        assertThat(testRealmResource.users().count("user2LastName", null, null, null), is(0));
-        assertThat(testRealmResource.users().count("notExisting", null, null, null), is(0));
-        assertThat(testRealmResource.users().count("", null, null, null), is(0));
-        //search in email
-        assertThat(testRealmResource.users().count(null, null, "@example.com", null), is(0));
-        assertThat(testRealmResource.users().count(null, null, "user1@example.com", null), is(0));
-        assertThat(testRealmResource.users().count(null, null, "user1@test.com", null), is(0));
-        assertThat(testRealmResource.users().count(null, null, "", null), is(0));
-        //search for combinations
-        assertThat(testRealmResource.users().count("LastName", "FirstName", null, null), is(0));
-        assertThat(testRealmResource.users().count("user1LastName", "FirstName", null, null), is(0));
-        assertThat(testRealmResource.users().count("user1LastName", "", null, null), is(0));
-        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
-        assertThat(testRealmResource.users().count("LastName", "", null, null), is(0));
-        assertThat(testRealmResource.users().count(null, null, "@example.com", "user"), is(0));
-        //search not specified (defaults to simply /count)
-        assertThat(testRealmResource.users().count(null, null, null, null), is(0));
-        assertThat(testRealmResource.users().count("", "", "", ""), is(0));
-    }
-
-    private RealmResource setupTestEnvironmentWithPermissions(boolean grp1ViewPermissions) throws CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException, IOException {
-        String testUserId = createUser(REALM_NAME, "test-user", "password", "", "", "");
-        //assign 'query-users' role to test user
-        ClientRepresentation clientRepresentation = realm.clients().findByClientId("realm-management").get(0);
-        String realmManagementId = clientRepresentation.getId();
-        RoleRepresentation roleRepresentation = realm.clients().get(realmManagementId).roles().get("query-users").toRepresentation();
-        realm.users().get(testUserId).roles().clientLevel(realmManagementId).add(Collections.singletonList(roleRepresentation));
-
-        //create test users and groups
-        List<GroupRepresentation> groups = setupUsersInGroupsWithPermissions();
-
-        if (grp1ViewPermissions) {
-            AuthorizationResource authorizationResource = realm.clients().get(realmManagementId).authorization();
-            //create a user policy for the test user
-            UserPolicyRepresentation policy = new UserPolicyRepresentation();
-            String policyName = "test-policy";
-            policy.setName(policyName);
-            policy.setUsers(Collections.singleton(testUserId));
-            authorizationResource.policies().user().create(policy).close();
-            PolicyRepresentation policyRepresentation = authorizationResource.policies().findByName(policyName);
-            //add the policy to grp1
-            Optional<GroupRepresentation> optional = groups.stream().filter(g -> g.getName().equals("grp1")).findFirst();
-            assertThat(optional.isPresent(), is(true));
-            GroupRepresentation grp1 = optional.get();
-            ScopePermissionRepresentation scopePermissionRepresentation = authorizationResource.permissions().scope().findByName("view.members.permission.group." + grp1.getId());
-            scopePermissionRepresentation.setPolicies(Collections.singleton(policyRepresentation.getId()));
-            scopePermissionRepresentation.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
-            authorizationResource.permissions().scope().findById(scopePermissionRepresentation.getId()).update(scopePermissionRepresentation);
-        }
-
-        Keycloak testUserClient = AdminClientUtil.createAdminClient(true, realm.toRepresentation().getRealm(), "test-user", "password", "admin-cli", "");
-
-        return testUserClient.realm(realm.toRepresentation().getRealm());
-    }
-
-    private List<GroupRepresentation> setupUsersInGroupsWithPermissions() {
-        //create two groups
-        GroupRepresentation grp1 = createGroupWithPermissions("grp1");
-        GroupRepresentation grp2 = createGroupWithPermissions("grp2");
-        //create test users
-        String user1Id = createUser(REALM_NAME, "user1", "password", "user1FirstName", "user1LastName", "user1@example.com");
-        String user2Id = createUser(REALM_NAME, "user2", "password", "user2FirstName", "user2LastName", "user2@example.com");
-        String user3Id = createUser(REALM_NAME, "user3", "password", "user3FirstName", "user3LastName", "user3@example.com");
-        String user4Id = createUser(REALM_NAME, "user4", "password", "user4FirstName", "user4LastName", "user4@example.com");
-        //add users to groups
-        realm.users().get(user1Id).joinGroup(grp1.getId());
-        realm.users().get(user2Id).joinGroup(grp1.getId());
-        realm.users().get(user3Id).joinGroup(grp1.getId());
-        realm.users().get(user4Id).joinGroup(grp2.getId());
-
-        List<GroupRepresentation> groups = new ArrayList<>();
-        groups.add(grp1);
-        groups.add(grp2);
-
-        return groups;
-    }
-
-    private GroupRepresentation createGroupWithPermissions(String name) {
-        GroupRepresentation grp = new GroupRepresentation();
-        grp.setName(name);
-        realm.groups().add(grp);
-        Optional<GroupRepresentation> optional = realm.groups().groups().stream().filter(g -> g.getName().equals(name)).findFirst();
-        assertThat(optional.isPresent(), is(true));
-        grp = optional.get();
-        String id = grp.getId();
-        //enable the permissions
-        realm.groups().group(id).setPermissions(new ManagementPermissionRepresentation(true));
-        assertThat(realm.groups().group(id).getPermissions().isEnabled(), is(true));
-
-        return grp;
-    }
-
-    private void assertCaseInsensitiveSearch() {
-        // not-exact case-insensitive search
-        assertThat(realm.users().search("user"), hasSize(1));
-        assertThat(realm.users().search("User"), hasSize(1));
-        assertThat(realm.users().search("USER"), hasSize(1));
-        assertThat(realm.users().search("Use"), hasSize(1));
-
-        // exact case-insensitive search
-        assertThat(realm.users().search("user", true), hasSize(1));
-        assertThat(realm.users().search("User", true), hasSize(1));
-        assertThat(realm.users().search("USER", true), hasSize(1));
-        assertThat(realm.users().search("Use", true), hasSize(0));
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AbstractAuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AbstractAuthenticationTest.java
index 05d9411bfe0f..00b71b992340 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AbstractAuthenticationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AbstractAuthenticationTest.java
@@ -17,27 +17,16 @@
 
 package org.keycloak.testsuite.admin.authentication;
 
-import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Rule;
 import org.keycloak.admin.client.resource.AuthenticationManagementResource;
 import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
 import org.keycloak.testsuite.util.AssertAdminEvents;
 import org.keycloak.testsuite.util.RealmBuilder;
 
-import jakarta.ws.rs.core.Response;
-import java.util.Arrays;
-import java.util.LinkedHashMap;
 import java.util.List;
 
 
@@ -48,11 +37,6 @@ public abstract class AbstractAuthenticationTest extends AbstractKeycloakTest {
 
     static final String REALM_NAME = "test";
 
-    static final String REQUIRED = "REQUIRED";
-    static final String CONDITIONAL = "CONDITIONAL";
-    static final String DISABLED = "DISABLED";
-    static final String ALTERNATIVE = "ALTERNATIVE";
-
     RealmResource realmResource;
     AuthenticationManagementResource authMgmtResource;
     protected String testRealmId;
@@ -74,36 +58,6 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         testRealms.add(testRealmRep);
     }
 
-
-    public static AuthenticationExecutionInfoRepresentation findExecutionByProvider(String provider, List<AuthenticationExecutionInfoRepresentation> executions) {
-        for (AuthenticationExecutionInfoRepresentation exec : executions) {
-            if (provider.equals(exec.getProviderId())) {
-                return exec;
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Searches for an execution located before the provided execution on the same level of
-     * an authentication flow.
-     *
-     * @param execution execution to find a neighbor for
-     * @param executions list of executions to search in
-     * @return execution, or null if not found
-     */
-    public static AuthenticationExecutionInfoRepresentation findPreviousExecution(AuthenticationExecutionInfoRepresentation execution, List<AuthenticationExecutionInfoRepresentation> executions) {
-        for (AuthenticationExecutionInfoRepresentation exec : executions) {
-            if (exec.getLevel() != execution.getLevel()) {
-                continue;
-            }
-            if (exec.getIndex() == execution.getIndex() - 1) {
-                return exec;
-            }
-        }
-        return null;
-    }
-
     public static AuthenticationFlowRepresentation findFlowByAlias(String alias, List<AuthenticationFlowRepresentation> flows) {
         for (AuthenticationFlowRepresentation flow : flows) {
             if (alias.equals(flow.getAlias())) {
@@ -112,118 +66,4 @@ public static AuthenticationFlowRepresentation findFlowByAlias(String alias, Lis
         }
         return null;
     }
-
-    void compareExecution(AuthenticationExecutionInfoRepresentation expected, AuthenticationExecutionInfoRepresentation actual) {
-        Assert.assertEquals("Execution requirement - " + actual.getProviderId(), expected.getRequirement(), actual.getRequirement());
-        Assert.assertEquals("Execution display name - " + actual.getProviderId(), expected.getDisplayName(), actual.getDisplayName());
-        Assert.assertEquals("Execution configurable - " + actual.getProviderId(), expected.getConfigurable(), actual.getConfigurable());
-        Assert.assertEquals("Execution provider id - " + actual.getProviderId(), expected.getProviderId(), actual.getProviderId());
-        Assert.assertEquals("Execution level - " + actual.getProviderId(), expected.getLevel(), actual.getLevel());
-        Assert.assertEquals("Execution index - " + actual.getProviderId(), expected.getIndex(), actual.getIndex());
-        Assert.assertEquals("Execution priority - " + actual.getProviderId(), expected.getPriority(), actual.getPriority());
-        Assert.assertEquals("Execution authentication flow - " + actual.getProviderId(), expected.getAuthenticationFlow(), actual.getAuthenticationFlow());
-        Assert.assertEquals("Execution requirement choices - " + actual.getProviderId(), expected.getRequirementChoices(), actual.getRequirementChoices());
-    }
-
-    void compareExecution(AuthenticationExecutionExportRepresentation expected, AuthenticationExecutionExportRepresentation actual) {
-        Assert.assertEquals("Execution flowAlias - " + actual.getFlowAlias(), expected.getFlowAlias(), actual.getFlowAlias());
-        Assert.assertEquals("Execution authenticator - " + actual.getAuthenticator(), expected.getAuthenticator(), actual.getAuthenticator());
-        Assert.assertEquals("Execution userSetupAllowed - " + actual.getAuthenticator(), expected.isUserSetupAllowed(), actual.isUserSetupAllowed());
-        Assert.assertEquals("Execution authenticatorFlow - " + actual.getAuthenticator(), expected.isAuthenticatorFlow(), actual.isAuthenticatorFlow());
-        Assert.assertEquals("Execution authenticatorConfig - " + actual.getAuthenticatorConfig(), expected.getAuthenticatorConfig(), actual.getAuthenticatorConfig());
-        Assert.assertEquals("Execution priority - " + actual.getAuthenticator(), expected.getPriority(), actual.getPriority());
-        Assert.assertEquals("Execution requirement - " + actual.getAuthenticator(), expected.getRequirement(), actual.getRequirement());
-    }
-
-    void compareExecutions(List<AuthenticationExecutionExportRepresentation> expected, List<AuthenticationExecutionExportRepresentation> actual) {
-        Assert.assertNotNull("Executions should not be null", actual);
-        Assert.assertEquals("Size", expected.size(), actual.size());
-
-        for (int i = 0; i < expected.size(); i++) {
-            compareExecution(expected.get(i), actual.get(i));
-        }
-    }
-
-    void compareFlows(AuthenticationFlowRepresentation expected, AuthenticationFlowRepresentation actual) {
-        Assert.assertEquals("Flow alias", expected.getAlias(), actual.getAlias());
-        Assert.assertEquals("Flow description", expected.getDescription(), actual.getDescription());
-        Assert.assertEquals("Flow providerId", expected.getProviderId(), actual.getProviderId());
-        Assert.assertEquals("Flow top level", expected.isTopLevel(), actual.isTopLevel());
-        Assert.assertEquals("Flow built-in", expected.isBuiltIn(), actual.isBuiltIn());
-
-        List<AuthenticationExecutionExportRepresentation> expectedExecs = expected.getAuthenticationExecutions();
-        List<AuthenticationExecutionExportRepresentation> actualExecs = actual.getAuthenticationExecutions();
-
-        if (expectedExecs == null) {
-            Assert.assertTrue("Executions should be null or empty", actualExecs == null || actualExecs.size() == 0);
-        } else {
-            compareExecutions(expectedExecs, actualExecs);
-        }
-    }
-
-    AuthenticationFlowRepresentation newFlow(String alias, String description,
-                                                       String providerId, boolean topLevel, boolean builtIn) {
-        AuthenticationFlowRepresentation flow = new AuthenticationFlowRepresentation();
-        flow.setAlias(alias);
-        flow.setDescription(description);
-        flow.setProviderId(providerId);
-        flow.setTopLevel(topLevel);
-        flow.setBuiltIn(builtIn);
-        return flow;
-    }
-
-    AuthenticationExecutionInfoRepresentation newExecInfo(String displayName, String providerId, Boolean configurable,
-                                                          int level, int index, String requirement, Boolean authFlow, String[] choices,
-                                                          int priority) {
-
-        AuthenticationExecutionInfoRepresentation execution = new AuthenticationExecutionInfoRepresentation();
-        execution.setRequirement(requirement);
-        execution.setDisplayName(displayName);
-        execution.setConfigurable(configurable);
-        execution.setProviderId(providerId);
-        execution.setLevel(level);
-        execution.setIndex(index);
-        execution.setAuthenticationFlow(authFlow);
-        execution.setPriority(priority);
-        if (choices != null) {
-            execution.setRequirementChoices(Arrays.asList(choices));
-        }
-        return execution;
-    }
-
-    void addExecInfo(List<AuthenticationExecutionInfoRepresentation> target, String displayName, String providerId, Boolean configurable,
-                 int level, int index, String requirement, Boolean authFlow, String[] choices, int priority) {
-
-        AuthenticationExecutionInfoRepresentation exec = newExecInfo(displayName, providerId, configurable, level, index, requirement, authFlow, choices, priority);
-        target.add(exec);
-    }
-
-    AuthenticatorConfigRepresentation newConfig(String alias, String[] keyvalues) {
-        AuthenticatorConfigRepresentation config = new AuthenticatorConfigRepresentation();
-        config.setAlias(alias);
-
-        if (keyvalues == null) {
-            throw new IllegalArgumentException("keyvalues == null");
-        }
-        if (keyvalues.length % 2 != 0) {
-            throw new IllegalArgumentException("keyvalues should have even number of elements");
-        }
-
-        LinkedHashMap<String, String> params = new LinkedHashMap<>();
-        for (int i = 0; i < keyvalues.length; i += 2) {
-            params.put(keyvalues[i], keyvalues[i + 1]);
-        }
-        config.setConfig(params);
-        return config;
-    }
-
-    String createFlow(AuthenticationFlowRepresentation flowRep) {
-        Response response = authMgmtResource.createFlow(flowRep);
-        org.keycloak.testsuite.Assert.assertEquals(201, response.getStatus());
-        response.close();
-        String flowId = ApiUtil.getCreatedId(response);
-        getCleanup().addAuthenticationFlowId(flowId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AssertAdminEvents.isExpectedPrefixFollowedByUuid(AdminEventPaths.authFlowsPath()), flowRep, ResourceType.AUTH_FLOW);
-        return flowId;
-    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AuthenticatorConfigTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AuthenticatorConfigTest.java
deleted file mode 100644
index c3b0b36d91c7..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/AuthenticatorConfigTest.java
+++ /dev/null
@@ -1,281 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.authentication.authenticators.broker.IdpCreateUserIfUniqueAuthenticatorFactory;
-import org.keycloak.authentication.authenticators.broker.IdpDetectExistingBrokerUserAuthenticatorFactory;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.AuthenticatorConfigModel;
-import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigInfoRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticatorConfigTest extends AbstractAuthenticationTest {
-
-    private String flowId;
-    private String executionId;
-    private String executionId2;
-
-    @Before
-    public void beforeConfigTest() {
-        AuthenticationFlowRepresentation flowRep = newFlow("firstBrokerLogin2", "firstBrokerLogin2", "basic-flow", true, false);
-        flowId = createFlow(flowRep);
-
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("provider", IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID);
-        authMgmtResource.addExecution("firstBrokerLogin2", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("firstBrokerLogin2"), params, ResourceType.AUTH_EXECUTION);
-        params.put("provider", IdpDetectExistingBrokerUserAuthenticatorFactory.PROVIDER_ID);
-        authMgmtResource.addExecution("firstBrokerLogin2", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("firstBrokerLogin2"), params, ResourceType.AUTH_EXECUTION);
-
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("firstBrokerLogin2");
-        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider(IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, executionReps);
-        Assert.assertNotNull(exec);
-        executionId = exec.getId();
-        exec = findExecutionByProvider(IdpDetectExistingBrokerUserAuthenticatorFactory.PROVIDER_ID, executionReps);
-        Assert.assertNotNull(exec);
-        executionId2 = exec.getId();
-    }
-
-    @Test
-    public void testCreateConfigWithReservedChar() {
-        AuthenticatorConfigRepresentation cfg = newConfig("f!oo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-        Response resp = authMgmtResource.newExecutionConfig(executionId, cfg);
-        Assert.assertEquals(400, resp.getStatus());
-    }
-
-    @Test
-    public void testCreateConfig() {
-        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-
-        // Attempt to create config for non-existent execution
-        try (Response response = authMgmtResource.newExecutionConfig("exec-id-doesnt-exists", cfg)) {
-            Assert.assertEquals(404, response.getStatus());
-        }
-
-        // Create config success
-        String cfgId = createConfig(executionId, cfg);
-
-        // Assert found
-        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
-        assertConfig(cfgRep, cfgId, "foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-
-        // Cleanup
-        authMgmtResource.removeAuthenticatorConfig(cfgId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionConfigPath(cfgId), ResourceType.AUTHENTICATOR_CONFIG);
-    }
-
-    @Test (expected = BadRequestException.class)
-    public void testUpdateConfigWithBadChar() {
-        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-        String cfgId = createConfig(executionId, cfg);
-        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
-        
-        cfgRep.setAlias("Bad@Char");
-        authMgmtResource.updateAuthenticatorConfig(cfgRep.getId(), cfgRep);
-    }
-    
-    @Test
-    public void testUpdateConfig() {
-        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-        String cfgId = createConfig(executionId, cfg);
-        final AuthenticatorConfigRepresentation cfgRepNonExistent = authMgmtResource.getAuthenticatorConfig(cfgId);
-
-        // Try to update not existent config
-        NotFoundException nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.updateAuthenticatorConfig("not-existent", cfgRepNonExistent));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // Assert nothing changed
-        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
-        assertConfig(cfgRep, cfgId, "foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-
-        // Update success
-        cfgRep.setAlias("foo2");
-        cfgRep.getConfig().put("configKey2", "configValue2");
-        authMgmtResource.updateAuthenticatorConfig(cfgRep.getId(), cfgRep);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authExecutionConfigPath(cfgId), cfgRep, ResourceType.AUTHENTICATOR_CONFIG);
-
-        // Assert updated
-        cfgRep = authMgmtResource.getAuthenticatorConfig(cfgRep.getId());
-        assertConfig(cfgRep, cfgId, "foo2",
-                IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true",
-                "configKey2", "configValue2");
-    }
-
-
-    @Test
-    public void testRemoveConfig() {
-        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-        String cfgId = createConfig(executionId, cfg);
-        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
-
-        // Assert execution has our config
-        AuthenticationExecutionInfoRepresentation execution = findExecutionByProvider(
-                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
-        Assert.assertEquals(cfgRep.getId(), execution.getAuthenticationConfig());
-
-        // Test remove not-existent
-        NotFoundException nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.removeAuthenticatorConfig("not-existent"));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // Test remove our config
-        authMgmtResource.removeAuthenticatorConfig(cfgId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionConfigPath(cfgId), ResourceType.AUTHENTICATOR_CONFIG);
-
-        // Assert config not found
-        nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(cfgRep.getId()));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // Assert execution doesn't have our config
-        execution = findExecutionByProvider(
-                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
-        Assert.assertNull(execution.getAuthenticationConfig());
-    }
-
-    @Test
-    public void testNullsafetyIterationOverProperties() {
-        String providerId = "auth-cookie";
-        String providerName = "Cookie";
-        AuthenticatorConfigInfoRepresentation description = authMgmtResource.getAuthenticatorConfigDescription(providerId);
-
-        Assert.assertEquals(providerName, description.getName());
-        Assert.assertTrue(description.getProperties().isEmpty());
-    }
-
-    @Test
-    public void testDuplicateAuthenticatorConfigAlias() {
-        // create a config for step1
-        AuthenticatorConfigRepresentation config1 = new AuthenticatorConfigRepresentation();
-        config1.setAlias("test-config-1");
-        config1.setConfig(Map.of("key", "value"));
-        String config1Id = createConfig(executionId, config1);
-
-        // create the same config name for step2, should fail
-        try (Response response = authMgmtResource.newExecutionConfig(executionId2, config1)) {
-            Assert.assertEquals(409, response.getStatus());
-        }
-
-        // create a config for step2
-        AuthenticatorConfigRepresentation config2 = new AuthenticatorConfigRepresentation();
-        config2.setAlias("test-config-2");
-        config2.setConfig(Map.of("key", "value"));
-        String config2Id = createConfig(executionId, config2);
-
-        // create a new config for step1, config1 should be removed
-        AuthenticatorConfigRepresentation config3 = new AuthenticatorConfigRepresentation();
-        config3.setAlias("test-config-1-modified");
-        config3.setConfig(Map.of("key", "value"));
-        String tmpConfig3Id = createConfig(executionId, config3);
-        NotFoundException nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(config1Id));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // create a new config with thew same name but that overwrites the previous one
-        String config3Id = createConfig(executionId, config3);
-        nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(tmpConfig3Id));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // delete execution step1, config3 should be removed
-        authMgmtResource.removeExecution(executionId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionPath(executionId), ResourceType.AUTH_EXECUTION);
-        nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(config3Id));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-
-        // remove flow, config and exec for step2 should be removed
-        authMgmtResource.deleteFlow(flowId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authFlowPath(flowId), ResourceType.AUTH_FLOW);
-        nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getExecution(executionId));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-        nfe = Assert.assertThrows(NotFoundException.class, () -> authMgmtResource.getAuthenticatorConfig(config2Id));
-        Assert.assertEquals(404, nfe.getResponse().getStatus());
-    }
-
-    @Test
-    public void testMissingConfig() {
-        AuthenticatorConfigRepresentation cfg = newConfig("foo", IdpCreateUserIfUniqueAuthenticatorFactory.REQUIRE_PASSWORD_UPDATE_AFTER_REGISTRATION, "true");
-        final String cfgId = createConfig(executionId, cfg);
-        final String realmId = testRealmId;
-        AuthenticatorConfigRepresentation cfgRep = authMgmtResource.getAuthenticatorConfig(cfgId);
-        Assert.assertNotNull(cfgRep);
-
-        testingClient.server().run(session -> {
-            // emulating a broken config id, remove the config but do not remove the link in the authenticator
-            RealmModel realm = session.realms().getRealm(realmId);
-            AuthenticatorConfigModel config = realm.getAuthenticatorConfigById(cfgId);
-            realm.removeAuthenticatorConfig(config);
-        });
-
-        // check the flow can be read and execution has no config
-        AuthenticationFlowRepresentation flow = authMgmtResource.getFlow(flowId);
-        AuthenticationExecutionExportRepresentation execExport = flow.getAuthenticationExecutions().stream()
-                .filter(ae -> IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID.equals(ae.getAuthenticator()))
-                .findAny()
-                .orElse(null);
-        Assert.assertNotNull(execExport);
-        Assert.assertNull(execExport.getAuthenticatorConfig());
-
-        // check the execution can be read with no configuration assigned
-        AuthenticationExecutionInfoRepresentation execInfo = findExecutionByProvider(
-                IdpCreateUserIfUniqueAuthenticatorFactory.PROVIDER_ID, authMgmtResource.getExecutions("firstBrokerLogin2"));
-        Assert.assertNull(execInfo.getAuthenticationConfig());
-    }
-
-    private String createConfig(String executionId, AuthenticatorConfigRepresentation cfg) {
-        try (Response resp = authMgmtResource.newExecutionConfig(executionId, cfg)) {
-            Assert.assertEquals(201, resp.getStatus());
-            String cfgId = ApiUtil.getCreatedId(resp);
-            Assert.assertNotNull(cfgId);
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionConfigPath(executionId), cfg, ResourceType.AUTHENTICATOR_CONFIG);
-            return cfgId;
-        }
-    }
-
-    private AuthenticatorConfigRepresentation newConfig(String alias, String cfgKey, String cfgValue) {
-        AuthenticatorConfigRepresentation cfg = new AuthenticatorConfigRepresentation();
-        cfg.setAlias(alias);
-        Map<String, String> cfgMap = new HashMap<>();
-        cfgMap.put(cfgKey, cfgValue);
-        cfg.setConfig(cfgMap);
-        return cfg;
-    }
-
-    private void assertConfig(AuthenticatorConfigRepresentation cfgRep, String id, String alias, String... fields) {
-        Assert.assertEquals(id, cfgRep.getId());
-        Assert.assertEquals(alias, cfgRep.getAlias());
-        Assert.assertMap(cfgRep.getConfig(), fields);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ExecutionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ExecutionTest.java
deleted file mode 100644
index ccd8ce3dbac5..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ExecutionTest.java
+++ /dev/null
@@ -1,365 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.authentication.AuthenticationFlow;
-import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
-import org.keycloak.authentication.authenticators.browser.WebAuthnAuthenticatorFactory;
-import org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
-import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.AssertAdminEvents;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import static org.hamcrest.Matchers.hasItems;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class ExecutionTest extends AbstractAuthenticationTest {
-
-    // KEYCLOAK-7975
-    @Test
-    public void testUpdateAuthenticatorConfig() {
-        // copy built-in flow so we get a new editable flow
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("newName", "new-browser-flow");
-        Response response = authMgmtResource.copy("browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-        try {
-            Assert.assertEquals("Copy flow", 201, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // create Conditional OTP Form execution
-        params.put("provider", "auth-conditional-otp-form");
-        authMgmtResource.addExecution("new-browser-flow", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("new-browser-flow"), params, ResourceType.AUTH_EXECUTION);
-
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("new-browser-flow");
-        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("auth-conditional-otp-form", executionReps);
-
-        // create authenticator config for the execution
-        Map<String, String> config = new HashMap<>();
-        config.put("defaultOtpOutcome", "skip");
-        config.put("otpControlAttribute", "test");
-        config.put("forceOtpForHeaderPattern", "");
-        config.put("forceOtpRole", "");
-        config.put("noOtpRequiredForHeaderPattern", "");
-        config.put("skipOtpRole", "");
-
-        AuthenticatorConfigRepresentation authConfigRep = new AuthenticatorConfigRepresentation();
-        authConfigRep.setAlias("conditional-otp-form-config-alias");
-        authConfigRep.setConfig(config);
-        response = authMgmtResource.newExecutionConfig(exec.getId(), authConfigRep);
-
-        try {
-            authConfigRep.setId(ApiUtil.getCreatedId(response));
-        } finally {
-            response.close();
-        }
-
-        // try to update the config adn check
-        config.put("otpControlAttribute", "test-updated");
-        authConfigRep.setConfig(config);
-        authMgmtResource.updateAuthenticatorConfig(authConfigRep.getId(), authConfigRep);
-
-        AuthenticatorConfigRepresentation updated = authMgmtResource.getAuthenticatorConfig(authConfigRep.getId());
-
-        assertThat(updated.getConfig().values(), hasItems("test-updated", "skip"));
-    }
-
-    @Test
-    public void testAddRemoveExecution() {
-
-        // try add execution to built-in flow
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("provider", "idp-review-profile");
-        try {
-            authMgmtResource.addExecution("browser", params);
-            Assert.fail("add execution to built-in flow should fail");
-        } catch (BadRequestException expected) {
-            // Expected
-        }
-
-        // try add execution to not-existent flow
-        try {
-            authMgmtResource.addExecution("not-existent", params);
-            Assert.fail("add execution to not-existent flow should fail");
-        } catch (BadRequestException expected) {
-            // Expected
-        }
-
-        // copy built-in flow so we get a new editable flow
-        params.put("newName", "Copy-of-browser");
-        Response response = authMgmtResource.copy("browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-        try {
-            Assert.assertEquals("Copy flow", 201, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // add execution using inexistent provider
-        params.put("provider", "test-execution");
-        try {
-            authMgmtResource.addExecution("CopyOfBrowser", params);
-            Assert.fail("add execution with inexistent provider should fail");
-        } catch(BadRequestException expected) {
-            // Expected
-        }
-
-        // add execution - should succeed
-        params.put("provider", "idp-review-profile");
-        authMgmtResource.addExecution("Copy-of-browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("Copy-of-browser"), params, ResourceType.AUTH_EXECUTION);
-
-        // check execution was added
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("Copy-of-browser");
-        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("idp-review-profile", executionReps);
-        Assert.assertNotNull("idp-review-profile added", exec);
-
-        // we'll need auth-cookie later
-        AuthenticationExecutionInfoRepresentation authCookieExec = findExecutionByProvider("auth-cookie", executionReps);
-
-        AuthenticationExecutionInfoRepresentation previousExecution = findPreviousExecution(exec, executionReps);
-        Assert.assertNotNull(previousExecution);
-        compareExecution(newExecInfo("Review Profile", "idp-review-profile", true, 0, 5, DISABLED, null, new String[]{REQUIRED, ALTERNATIVE,DISABLED}, previousExecution.getPriority() + 1), exec);
-
-        // remove execution
-        authMgmtResource.removeExecution(exec.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionPath(exec.getId()), ResourceType.AUTH_EXECUTION);
-
-        // check execution was removed
-        executionReps = authMgmtResource.getExecutions("Copy-of-browser");
-        exec = findExecutionByProvider("idp-review-profile", executionReps);
-        Assert.assertNull("idp-review-profile removed", exec);
-
-        // now add the execution again using a different method and representation
-
-        // delete auth-cookie
-        authMgmtResource.removeExecution(authCookieExec.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionPath(authCookieExec.getId()), ResourceType.AUTH_EXECUTION);
-
-        AuthenticationExecutionRepresentation rep = new AuthenticationExecutionRepresentation();
-        rep.setPriority(10);
-        rep.setAuthenticator("auth-cookie");
-        rep.setRequirement(CONDITIONAL);
-
-        // Should fail - missing parent flow
-        response = authMgmtResource.addExecution(rep);
-        try {
-            Assert.assertEquals("added execution missing parent flow", 400, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // Should fail - not existent parent flow
-        rep.setParentFlow("not-existent-id");
-        response = authMgmtResource.addExecution(rep);
-        try {
-            Assert.assertEquals("added execution missing parent flow", 400, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // Should fail - add execution to builtin flow
-        AuthenticationFlowRepresentation browserFlow = findFlowByAlias("browser", authMgmtResource.getFlows());
-        rep.setParentFlow(browserFlow.getId());
-        response = authMgmtResource.addExecution(rep);
-        try {
-            Assert.assertEquals("added execution to builtin flow", 400, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // get Copy-of-browser flow id, and set it on execution
-        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation flow = findFlowByAlias("Copy-of-browser", flows);
-        rep.setParentFlow(flow.getId());
-
-        // add execution - should succeed
-        response = authMgmtResource.addExecution(rep);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AssertAdminEvents.isExpectedPrefixFollowedByUuid(AdminEventPaths.authMgmtBasePath() + "/executions"), rep, ResourceType.AUTH_EXECUTION);
-        try {
-            Assert.assertEquals("added execution", 201, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // check execution was added
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("Copy-of-browser");
-        exec = findExecutionByProvider("auth-cookie", executions);
-        Assert.assertNotNull("auth-cookie added", exec);
-
-        // Note: there is no checking in addExecution if requirement is one of requirementChoices
-        // Thus we can have OPTIONAL which is neither ALTERNATIVE, nor DISABLED
-        compareExecution(newExecInfo("Cookie", "auth-cookie", false, 0, 0, CONDITIONAL, null, new String[]{REQUIRED, ALTERNATIVE, DISABLED}, 10), exec);
-    }
-
-    @Test
-    public void testUpdateExecution() {
-
-        // get current auth-cookie execution
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("browser");
-        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider("auth-cookie", executionReps);
-
-        Assert.assertEquals("auth-cookie set to ALTERNATIVE", ALTERNATIVE, exec.getRequirement());
-        Assert.assertEquals("auth-cookie is first in the flow", exec.getIndex(), 0);
-
-        // switch from DISABLED to ALTERNATIVE
-        exec.setRequirement(DISABLED);
-        exec.setPriority(Integer.MAX_VALUE);
-        authMgmtResource.updateExecutions("browser", exec);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("browser"), exec, ResourceType.AUTH_EXECUTION);
-
-        // make sure the change is visible
-        executionReps = authMgmtResource.getExecutions("browser");
-
-        // get current auth-cookie execution
-        AuthenticationExecutionInfoRepresentation exec2 = findExecutionByProvider("auth-cookie", executionReps);
-
-        // The execution is expected to be last after priority change
-        long expectedIndex = executionReps.stream()
-            .filter(r -> r.getLevel() == exec2.getLevel())
-            .count() - 1;
-        exec.setIndex(Math.toIntExact(expectedIndex));
-
-        compareExecution(exec, exec2);
-    }
-
-    @Test
-    public void testClientFlowExecutions() {
-        // Create client flow
-        AuthenticationFlowRepresentation clientFlow = newFlow("new-client-flow", "desc", AuthenticationFlow.CLIENT_FLOW, true, false);
-        createFlow(clientFlow);
-
-        // Add execution to it
-        Map<String, Object> executionData = new HashMap<>();
-        executionData.put("provider", ClientIdAndSecretAuthenticator.PROVIDER_ID);
-        authMgmtResource.addExecution("new-client-flow", executionData);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("new-client-flow"), executionData, ResourceType.AUTH_EXECUTION);
-
-        // Check executions of not-existent flow - SHOULD FAIL
-        try {
-            authMgmtResource.getExecutions("not-existent");
-            Assert.fail("Not expected to find executions");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Check existent executions
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("new-client-flow");
-        AuthenticationExecutionInfoRepresentation executionRep = findExecutionByProvider(ClientIdAndSecretAuthenticator.PROVIDER_ID, executions);
-        Assert.assertNotNull(executionRep);
-
-        // Update execution with not-existent flow - SHOULD FAIL
-        try {
-            authMgmtResource.updateExecutions("not-existent", executionRep);
-            Assert.fail("Not expected to update execution with not-existent flow");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Update execution with not-existent ID - SHOULD FAIL
-        AuthenticationExecutionInfoRepresentation executionRep2 = new AuthenticationExecutionInfoRepresentation();
-        executionRep2.setId("not-existent");
-        try {
-            authMgmtResource.updateExecutions("new-client-flow", executionRep2);
-            Assert.fail("Not expected to update not-existent execution");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Update success
-        executionRep.setRequirement(ALTERNATIVE);
-        authMgmtResource.updateExecutions("new-client-flow", executionRep);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("new-client-flow"), executionRep, ResourceType.AUTH_EXECUTION);
-
-        // Check updated
-        executionRep = findExecutionByProvider(ClientIdAndSecretAuthenticator.PROVIDER_ID, authMgmtResource.getExecutions("new-client-flow"));
-        Assert.assertEquals(ALTERNATIVE, executionRep.getRequirement());
-
-        // Remove execution with not-existent ID
-        try {
-            authMgmtResource.removeExecution("not-existent");
-            Assert.fail("Didn't expect to find execution");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Successfuly remove execution and flow
-        authMgmtResource.removeExecution(executionRep.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionPath(executionRep.getId()), ResourceType.AUTH_EXECUTION);
-
-        AuthenticationFlowRepresentation rep = findFlowByAlias("new-client-flow", authMgmtResource.getFlows());
-        authMgmtResource.deleteFlow(rep.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authFlowPath(rep.getId()), ResourceType.AUTH_FLOW);
-    }
-
-    @Test
-    public void testRequirementsInExecution() {
-        HashMap<String, Object> params = new HashMap<>();
-        String newBrowserFlow = "new-exec-flow";
-
-        params.put("newName", newBrowserFlow);
-        try (Response response = authMgmtResource.copy("browser", params)) {
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-            Assert.assertEquals("Copy flow", 201, response.getStatus());
-        }
-
-        addExecutionCheckReq(newBrowserFlow, UsernameFormFactory.PROVIDER_ID, params, REQUIRED);
-        addExecutionCheckReq(newBrowserFlow, WebAuthnAuthenticatorFactory.PROVIDER_ID, params, DISABLED);
-
-        AuthenticationFlowRepresentation rep = findFlowByAlias(newBrowserFlow, authMgmtResource.getFlows());
-        Assert.assertNotNull(rep);
-        authMgmtResource.deleteFlow(rep.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authFlowPath(rep.getId()), ResourceType.AUTH_FLOW);
-    }
-
-    private void addExecutionCheckReq(String flow, String providerID, HashMap<String, Object> params, String expectedRequirement) {
-        params.put("provider", providerID);
-        authMgmtResource.addExecution(flow, params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath(flow), params, ResourceType.AUTH_EXECUTION);
-
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions(flow);
-        AuthenticationExecutionInfoRepresentation exec = findExecutionByProvider(providerID, executionReps);
-
-        Assert.assertNotNull(exec);
-        Assert.assertEquals(expectedRequirement, exec.getRequirement());
-
-        authMgmtResource.removeExecution(exec.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authExecutionPath(exec.getId()), ResourceType.AUTH_EXECUTION);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/FlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/FlowTest.java
deleted file mode 100644
index 0a2a535d1213..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/FlowTest.java
+++ /dev/null
@@ -1,773 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.IdentityProviderResource;
-import org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticatorFactory;
-import org.keycloak.common.util.StreamUtil;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.utils.DefaultAuthenticationFlows;
-import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.IdentityProviderRepresentation;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.ContainerAssume;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.InternalServerErrorException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.WebApplicationException;
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.Response.Status;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.function.BiConsumer;
-import java.util.function.Consumer;
-import java.util.function.Predicate;
-import java.util.function.Supplier;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.containsString;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.util.Matchers.body;
-import static org.keycloak.testsuite.util.Matchers.statusCodeIs;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class FlowTest extends AbstractAuthenticationTest {
-
-    // KEYCLOAK-3681: Delete top flow doesn't delete all subflows
-    @Test
-    public void testRemoveSubflows() {
-        createFlow(newFlow("Foo", "Foo flow", "generic", true, false));
-        addFlowToParent("Foo", "child");
-        addFlowToParent("child", "grandchild");
-
-        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation found = findFlowByAlias("Foo", flows);
-        authMgmtResource.deleteFlow(found.getId());
-        assertAdminEvents.clear();
-
-        createFlow(newFlow("Foo", "Foo flow", "generic", true, false));
-        addFlowToParent("Foo", "child");
-
-        // Under the old code, this would throw an error because "grandchild"
-        // was left in the database
-        addFlowToParent("child", "grandchild");
-
-        authMgmtResource.deleteFlow(findFlowByAlias("Foo", authMgmtResource.getFlows()).getId());
-    }
-
-    @Test
-    public void testRemoveExecutionSubflow() {
-        createFlow(newFlow("Foo", "Foo flow", "generic", true, false));
-        addFlowToParent("Foo", "child");
-        addFlowToParent("child", "grandchild");
-
-        // remove the foo child but using the execution
-        List<AuthenticationExecutionInfoRepresentation> fooExecutions = authMgmtResource.getExecutions("Foo");
-        AuthenticationExecutionInfoRepresentation childExececution = fooExecutions.stream()
-                .filter(r -> "child".equals(r.getDisplayName()) && r.getLevel() == 0).findAny().orElse(null);
-        assertNotNull(childExececution);
-        authMgmtResource.removeExecution(childExececution.getId());
-        assertAdminEvents.clear();
-
-        // check subflows were removed and can be re-created
-        addFlowToParent("Foo", "child");
-        addFlowToParent("child", "grandchild");
-
-        authMgmtResource.deleteFlow(findFlowByAlias("Foo", authMgmtResource.getFlows()).getId());
-    }
-
-    private void addFlowToParent(String parentAlias, String childAlias) {
-        Map<String, Object> data = new HashMap<>();
-        data.put("alias", childAlias);
-        data.put("type", "generic");
-        data.put("description", childAlias + " flow");
-        authMgmtResource.addExecutionFlow(parentAlias, data);
-    }
-
-    @Test
-    public void testAddFlowWithRestrictedCharInAlias() {
-        Response resp = authMgmtResource.createFlow(newFlow("fo]o", "Browser flow", "basic-flow", true, false));
-        Assert.assertEquals(400, resp.getStatus());
-    }
-
-    @Test
-    public void testAddRemoveFlow() {
-
-        // test that built-in flow cannot be deleted
-        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation builtInFlow = flows.stream().filter(AuthenticationFlowRepresentation::isBuiltIn).findAny().orElse(null);
-        Assert.assertNotNull("No built in flow in the realm", builtInFlow);
-        try {
-            authMgmtResource.deleteFlow(builtInFlow.getId());
-            Assert.fail("deleteFlow should fail for built in flow");
-        } catch (BadRequestException e) {
-            OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-            Assert.assertEquals("Can't delete built in flow", error.getError());
-        }
-
-        // try create new flow using alias of already existing flow
-        Response response = authMgmtResource.createFlow(newFlow("browser", "Browser flow", "basic-flow", true, false));
-        try {
-            Assert.assertEquals("createFlow using the alias of existing flow should fail", 409, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // try create flow without alias
-        response = authMgmtResource.createFlow(newFlow(null, "Browser flow", "basic-flow", true, false));
-        try {
-            Assert.assertEquals("createFlow using the alias of existing flow should fail", 409, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-
-        // create new flow that should succeed
-        AuthenticationFlowRepresentation newFlow = newFlow("browser-2", "Browser flow", "basic-flow", true, false);
-        createFlow(newFlow);
-
-        // check that new flow is returned in a children list
-        flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation found = findFlowByAlias("browser-2", flows);
-
-        Assert.assertNotNull("created flow visible in parent", found);
-        compareFlows(newFlow, found);
-
-        // check lookup flow with unexistent ID
-        try {
-            authMgmtResource.getFlow("id-123-notExistent");
-            Assert.fail("Not expected to find unexistent flow");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // check that new flow is returned individually
-        AuthenticationFlowRepresentation found2 = authMgmtResource.getFlow(found.getId());
-        Assert.assertNotNull("created flow visible directly", found2);
-        compareFlows(newFlow, found2);
-
-
-        // add execution flow to some parent flow
-        Map<String, Object> data = new HashMap<>();
-        data.put("alias", "SomeFlow");
-        data.put("type", "basic-flow");
-        data.put("description", "Test flow");
-        // This tests against a regression in KEYCLOAK-16656
-        data.put("provider", "registration-page-form");
-
-        Map<String, Object> data2 = new HashMap<>();
-        data2.put("alias", "SomeFlow2");
-        data2.put("type", "form-flow");
-        data2.put("description", "Test flow 2");
-        data2.put("provider", "registration-page-form");
-
-
-        // inexistent parent flow - should fail
-        try {
-            authMgmtResource.addExecutionFlow("inexistent-parent-flow-alias", data);
-            Assert.fail("addExecutionFlow for inexistent parent should have failed");
-        } catch (Exception expected) {
-            // Expected
-        }
-
-        // already existent flow - should fail
-        try {
-            data.put("alias", "browser");
-            authMgmtResource.addExecutionFlow("browser-2", data);
-            Assert.fail("addExecutionFlow should have failed as browser flow already exists");
-        } catch (Exception expected) {
-            // Expected
-        }
-
-        // Successfully add flow
-        data.put("alias", "SomeFlow");
-        authMgmtResource.addExecutionFlow("browser-2", data);
-        authMgmtResource.addExecutionFlow("browser-2", data2);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("browser-2"), data, ResourceType.AUTH_EXECUTION_FLOW);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("browser-2"), data2, ResourceType.AUTH_EXECUTION_FLOW);
-
-        // check that new flow is returned in a children list
-        flows = authMgmtResource.getFlows();
-        found2 = findFlowByAlias("browser-2", flows);
-        Assert.assertNotNull("created flow visible in parent", found2);
-
-        List<AuthenticationExecutionExportRepresentation> execs = found2.getAuthenticationExecutions();
-        Assert.assertNotNull(execs);
-        Assert.assertEquals("Size two", 2, execs.size());
-
-        AuthenticationExecutionExportRepresentation expected = new AuthenticationExecutionExportRepresentation();
-        expected.setFlowAlias("SomeFlow");
-        expected.setUserSetupAllowed(false);
-        expected.setAuthenticatorFlow(true);
-        expected.setRequirement("DISABLED");
-        expected.setPriority(0);
-        compareExecution(expected, execs.get(0));
-
-        expected = new AuthenticationExecutionExportRepresentation();
-        expected.setFlowAlias("SomeFlow2");
-        expected.setUserSetupAllowed(false);
-        expected.setAuthenticator("registration-page-form");
-        expected.setAuthenticatorFlow(true);
-        expected.setRequirement("DISABLED");
-        expected.setPriority(1);
-        compareExecution(expected, execs.get(1));
-
-        // delete non-built-in flow
-        authMgmtResource.deleteFlow(found.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authFlowPath(found.getId()), ResourceType.AUTH_FLOW);
-
-        // check the deleted flow is no longer returned
-        flows = authMgmtResource.getFlows();
-        found = findFlowByAlias("browser-2", flows);
-        Assert.assertNull("flow deleted", found);
-
-        // Check deleting flow second time will fail
-        try {
-            authMgmtResource.deleteFlow("id-123-notExistent");
-            Assert.fail("Not expected to delete flow, which doesn't exist");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void testRemoveUsedFlow() {
-        String flowAlias = "test";
-        String flowId = createFlow(newFlow(flowAlias, "Test flow", "generic", true, false));
-
-        Runnable assertRemoveFail = () -> {
-            try {
-                authMgmtResource.deleteFlow(flowId);
-                Assert.fail("Not expected to delete flow that is in use.");
-            } catch (WebApplicationException e) {
-                OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-                Assert.assertEquals("For more on this error consult the server log.", error.getErrorDescription());
-            }
-        };
-
-        {
-            // used in realm flow
-            RealmRepresentation realm = realmResource.toRepresentation();
-            BiConsumer<Supplier<String>, Consumer<String>> assertRemoveFailInRealm =
-                    (rollbackFlow, updateFlow) -> {
-                        String rollbackValue = rollbackFlow.get();
-                        try {
-                            updateFlow.accept(flowAlias);
-                            realmResource.update(realm);
-
-                            assertRemoveFail.run();
-                        } finally {
-                            updateFlow.accept(rollbackValue);
-                            realmResource.update(realm);
-                        }
-                    };
-
-            assertRemoveFailInRealm.accept(realm::getBrowserFlow, realm::setBrowserFlow);
-            assertRemoveFailInRealm.accept(realm::getRegistrationFlow, realm::setRegistrationFlow);
-            assertRemoveFailInRealm.accept(realm::getClientAuthenticationFlow, realm::setClientAuthenticationFlow);
-            assertRemoveFailInRealm.accept(realm::getDirectGrantFlow, realm::setDirectGrantFlow);
-            assertRemoveFailInRealm.accept(realm::getResetCredentialsFlow, realm::setResetCredentialsFlow);
-            assertRemoveFailInRealm.accept(realm::getDockerAuthenticationFlow, realm::setDockerAuthenticationFlow);
-            assertRemoveFailInRealm.accept(realm::getFirstBrokerLoginFlow, realm::setFirstBrokerLoginFlow);
-        }
-
-        {
-            // used by client override
-            ClientRepresentation client = realmResource.clients().findByClientId("account").get(0);
-            ClientResource clientResource = realmResource.clients().get(client.getId());
-
-            try {
-                client.setAuthenticationFlowBindingOverrides(
-                        Map.of("browser", flowId)
-                );
-                clientResource.update(client);
-
-                assertRemoveFail.run();
-            } finally {
-                client.setAuthenticationFlowBindingOverrides(
-                        Map.of("browser", "")
-                );
-                clientResource.update(client);
-            }
-        }
-
-        {
-            // used by idp override
-            IdentityProviderRepresentation idp = new IdentityProviderRepresentation();
-            idp.setAlias("idp");
-            idp.setProviderId("oidc");
-
-            Response response = realmResource.identityProviders().create(idp);
-            Assert.assertNotNull(ApiUtil.getCreatedId(response));
-            response.close();
-            getCleanup().addIdentityProviderAlias(idp.getAlias());
-
-            IdentityProviderResource idpResource = realmResource.identityProviders().get("idp");
-            BiConsumer<Supplier<String>, Consumer<String>> assertRemoveFailByIdp =
-                    (rollbackIdp, updateIdp) -> {
-                        String rollbackValue = rollbackIdp.get();
-                        try {
-                            updateIdp.accept(flowAlias);
-                            idpResource.update(idp);
-
-                            assertRemoveFail.run();
-                        } finally {
-                            updateIdp.accept(rollbackValue);
-                            idpResource.update(idp);
-                        }
-                    };
-
-            assertRemoveFailByIdp.accept(idp::getFirstBrokerLoginFlowAlias, idp::setFirstBrokerLoginFlowAlias);
-            assertRemoveFailByIdp.accept(idp::getPostBrokerLoginFlowAlias, idp::setPostBrokerLoginFlowAlias);
-        }
-    }
-
-    @Test
-    public void testCopyFlow() {
-
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("newName", "clients");
-
-        // copy using existing alias as new name
-        Response response = authMgmtResource.copy("browser", params);
-        try {
-            assertThat("Copy flow using the new alias of existing flow should fail", response, statusCodeIs(Status.CONFLICT));
-            assertThat("Copy flow using the new alias of existing flow should fail", response, body(containsString("already exists")));
-            assertThat("Copy flow using the new alias of existing flow should fail", response, body(containsString("flow alias")));
-        } finally {
-            response.close();
-        }
-
-        // copy non-existing flow
-        params.clear();
-        response = authMgmtResource.copy("non-existent", params);
-        try {
-            assertThat("Copy non-existing flow", response, statusCodeIs(Status.NOT_FOUND));
-        } finally {
-            response.close();
-        }
-
-        // copy that should succeed
-        params.put("newName", "Copy of browser");
-        response = authMgmtResource.copy("browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-        try {
-            assertThat("Copy flow", response, statusCodeIs(Status.CREATED));
-        } finally {
-            response.close();
-        }
-
-        // compare original flow with a copy - fields should be the same except id, alias, and builtIn
-        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation browser = findFlowByAlias("browser", flows);
-        AuthenticationFlowRepresentation copyOfBrowser = findFlowByAlias("Copy of browser", flows);
-
-        Assert.assertNotNull(browser);
-        Assert.assertNotNull(copyOfBrowser);
-
-        // adjust expected values before comparing
-        browser.setAlias("Copy of browser");
-        browser.setBuiltIn(false);
-        browser.getAuthenticationExecutions().get(3).setFlowAlias("Copy of browser Organization");
-        browser.getAuthenticationExecutions().get(4).setFlowAlias("Copy of browser forms");
-        compareFlows(browser, copyOfBrowser);
-
-        // get new flow directly and compare
-        copyOfBrowser = authMgmtResource.getFlow(copyOfBrowser.getId());
-        Assert.assertNotNull(copyOfBrowser);
-        compareFlows(browser, copyOfBrowser);
-        authMgmtResource.deleteFlow(copyOfBrowser.getId());
-    }
-
-    @Test
-    // KEYCLOAK-2580
-    public void addExecutionFlow() {
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("newName", "parent");
-        Response response = authMgmtResource.copy("browser", params);
-        Assert.assertEquals(201, response.getStatus());
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-
-        params = new HashMap<>();
-        params.put("alias", "child");
-        params.put("description", "Description");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-
-        authMgmtResource.addExecutionFlow("parent", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("parent"), params, ResourceType.AUTH_EXECUTION_FLOW);
-
-        authMgmtResource.deleteFlow(findFlowByAlias("parent", authMgmtResource.getFlows()).getId());
-    }
-
-    @Test
-    //KEYCLOAK-12741
-    //test editing of authentication flows
-    public void editFlowTest() {
-        List<AuthenticationFlowRepresentation> flows;
-
-        //copy an existing one first
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("newName", "Copy of browser");
-        Response response = authMgmtResource.copy("browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-        try {
-            Assert.assertEquals("Copy flow", 201, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        //load the newly copied flow
-        flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation testFlow = findFlowByAlias("Copy of browser", flows);
-        //Set a new unique name. Should succeed
-        testFlow.setAlias("Copy of browser2");
-        authMgmtResource.updateFlow(testFlow.getId(), testFlow);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authEditFlowPath(testFlow.getId()), ResourceType.AUTH_FLOW);
-        flows = authMgmtResource.getFlows();
-        Assert.assertEquals("Copy of browser2", findFlowByAlias("Copy of browser2", flows).getAlias());
-
-        //Create new flow and edit the old one to have the new ones name
-        AuthenticationFlowRepresentation newFlow = newFlow("New Flow", "Test description", "basic-flow", true, false);
-        createFlow(newFlow);
-        // check that new flow is returned in a children list
-        flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation found = findFlowByAlias("New Flow", flows);
-
-        Assert.assertNotNull("created flow visible in parent", found);
-        compareFlows(newFlow, found);
-
-        //try to update old flow with alias that already exists
-        testFlow.setAlias("New Flow");
-        try {
-            authMgmtResource.updateFlow(found.getId(), testFlow);
-        } catch (ClientErrorException exception){
-            //expoected
-        }
-
-        //try to update old flow with an alias with illegal characters
-        testFlow.setAlias("New(Flow");
-        try {
-            authMgmtResource.updateFlow(found.getId(), testFlow);
-        } catch (ClientErrorException exception){
-            //expected
-        }
-
-        flows = authMgmtResource.getFlows();
-
-        //name should be the same for the old Flow
-        Assert.assertEquals("Copy of browser2", findFlowByAlias("Copy of browser2", flows).getAlias());
-
-        //Only update the description
-        found.setDescription("New description");
-        authMgmtResource.updateFlow(found.getId(), found);
-        flows = authMgmtResource.getFlows();
-
-        Assert.assertEquals("New description", findFlowByAlias("New Flow", flows).getDescription());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authEditFlowPath(found.getId()), ResourceType.AUTH_FLOW);
-
-        //Update name and description
-        found.setAlias("New Flow2");
-        found.setDescription("New description2");
-        authMgmtResource.updateFlow(found.getId(), found);
-        flows = authMgmtResource.getFlows();
-
-        Assert.assertEquals("New Flow2", findFlowByAlias("New Flow2", flows).getAlias());
-        Assert.assertEquals("New description2", findFlowByAlias("New Flow2", flows).getDescription());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authEditFlowPath(found.getId()), ResourceType.AUTH_FLOW);
-        Assert.assertNull(findFlowByAlias("New Flow", flows));
-
-        authMgmtResource.deleteFlow(testFlow.getId());
-        authMgmtResource.deleteFlow(found.getId());
-    }
-
-    @Test
-    public void editExecutionFlowTest() {
-        HashMap<String, Object> params = new HashMap<>();
-        List<AuthenticationExecutionInfoRepresentation> executionReps;
-        //create new parent flow
-        AuthenticationFlowRepresentation newFlow = newFlow("Parent-Flow", "This is a parent flow", "basic-flow", true, false);
-        createFlow(newFlow);
-
-        //create a child sub flow
-        params.put("alias", "Child-Flow");
-        params.put("description", "This is a child flow");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-
-        authMgmtResource.addExecutionFlow("Parent-Flow", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
-
-        executionReps = authMgmtResource.getExecutions("Parent-Flow");
-
-        //create another with the same name of the previous one. Should fail to create
-        params = new HashMap<>();
-        params.put("alias", "Child-Flow");
-        params.put("description", "This is another child flow");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-
-        try {
-            authMgmtResource.addExecutionFlow("Parent-Flow", params);
-            Assert.fail("addExecutionFlow the alias already exist");
-        } catch (Exception expected) {
-            // Expected
-        }
-
-        AuthenticationExecutionInfoRepresentation found = executionReps.get(0);
-        found.setDisplayName("Parent-Flow");
-
-        try {
-            authMgmtResource.updateExecutions("Parent-Flow", found);
-        } catch (ClientErrorException exception){
-            //expected
-        }
-
-        //edit both name and description
-        found.setDisplayName("Child-Flow2");
-        found.setDescription("This is another child flow2");
-
-        authMgmtResource.updateExecutions("Parent-Flow", found);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("Parent-Flow"), ResourceType.AUTH_EXECUTION);
-        executionReps = authMgmtResource.getExecutions("Parent-Flow");
-        Assert.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
-        Assert.assertEquals("This is another child flow2", executionReps.get(0).getDescription());
-
-        //edit only description
-        found.setDescription("This is another child flow3");
-        authMgmtResource.updateExecutions("Parent-Flow", found);
-
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authUpdateExecutionPath("Parent-Flow"), ResourceType.AUTH_EXECUTION);
-        executionReps = authMgmtResource.getExecutions("Parent-Flow");
-        Assert.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
-        Assert.assertEquals("This is another child flow3", executionReps.get(0).getDescription());
-    }
-
-    @Test
-    public void prioritySetTest() {
-        //create new parent flow
-        AuthenticationFlowRepresentation newFlow = newFlow("Parent-Flow", "This is a parent flow", "basic-flow", true, false);
-        createFlow(newFlow);
-
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("alias", "Child-Flow1");
-        params.put("description", "This is a child flow");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-        params.put("priority", 50);
-
-        authMgmtResource.addExecutionFlow("Parent-Flow", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
-
-        params.clear();
-        params.put("alias", "Child-Flow2");
-        params.put("description", "This is a second child flow");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-        params.put("priority", 10);
-
-        authMgmtResource.addExecutionFlow("Parent-Flow", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
-
-        params.clear();
-        params.put("alias", "Child-Flow3");
-        params.put("description", "This is a third child flow");
-        params.put("provider", "registration-page-form");
-        params.put("type", "basic-flow");
-        params.put("priority", 20);
-
-        authMgmtResource.addExecutionFlow("Parent-Flow", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("Parent-Flow"), params, ResourceType.AUTH_EXECUTION_FLOW);
-
-        List<AuthenticationExecutionInfoRepresentation> executionReps = authMgmtResource.getExecutions("Parent-Flow");
-        // Verify the initial order and priority value
-        Assert.assertEquals("Child-Flow2", executionReps.get(0).getDisplayName());
-        Assert.assertEquals(10, executionReps.get(0).getPriority());
-        Assert.assertEquals("Child-Flow3", executionReps.get(1).getDisplayName());
-        Assert.assertEquals(20, executionReps.get(1).getPriority());
-        Assert.assertEquals("Child-Flow1", executionReps.get(2).getDisplayName());
-        Assert.assertEquals(50, executionReps.get(2).getPriority());
-
-        // Move last execution to the beginning
-        AuthenticationExecutionInfoRepresentation lastToFirst = executionReps.get(2);
-        lastToFirst.setPriority(5);
-        authMgmtResource.updateExecutions("Parent-Flow", lastToFirst);
-        executionReps = authMgmtResource.getExecutions("Parent-Flow");
-
-        // Verify new order and priority
-        Assert.assertEquals("Child-Flow1", executionReps.get(0).getDisplayName());
-        Assert.assertEquals(5, executionReps.get(0).getPriority());
-        Assert.assertEquals("Child-Flow2", executionReps.get(1).getDisplayName());
-        Assert.assertEquals(10, executionReps.get(1).getPriority());
-        Assert.assertEquals("Child-Flow3", executionReps.get(2).getDisplayName());
-        Assert.assertEquals(20, executionReps.get(2).getPriority());
-    }
-
-    @Test
-    public void failWithLongDescription() throws IOException {
-        ContainerAssume.assumeAuthServerQuarkus();
-        AuthenticationFlowRepresentation rep = authMgmtResource.getFlows().stream()
-                .filter(new Predicate<AuthenticationFlowRepresentation>() {
-                    @Override
-                    public boolean test(AuthenticationFlowRepresentation rep) {
-                        return "docker auth".equals(rep.getAlias());
-                    }
-                }).findAny().orElse(null);
-
-        assertNotNull(rep);
-
-        StringBuilder name = new StringBuilder();
-
-        while (name.length() < 300) {
-            name.append("invalid");
-        }
-
-        rep.setDescription(name.toString());
-
-        try {
-            authMgmtResource.updateFlow(rep.getId(), rep);
-            fail("Should fail because the description is too long");
-        } catch (InternalServerErrorException isee) {
-            try (Response response = isee.getResponse()) {
-                assertEquals(500, response.getStatus());
-                assertFalse(StreamUtil.readString((InputStream) response.getEntity(), StandardCharsets.UTF_8).toLowerCase().contains("exception"));
-            }
-        } catch (Exception e) {
-            fail("Unexpected exception");
-        }
-    }
-
-    @Test
-    public void testAddRemoveExecutionsFailInBuiltinFlow() throws IOException {
-        // get a built in flow
-        List<AuthenticationFlowRepresentation> flows = authMgmtResource.getFlows();
-        AuthenticationFlowRepresentation flow = flows.stream().filter(AuthenticationFlowRepresentation::isBuiltIn).findFirst().orElse(null);
-        Assert.assertNotNull("There is no builtin flow", flow);
-
-        // adding an execution should fail
-        Map<String, Object> data = new HashMap<>();
-        data.put("provider", "allow-access-authenticator");
-        BadRequestException e = Assert.assertThrows(BadRequestException.class, () -> authMgmtResource.addExecution(flow.getAlias(), data));
-        OAuth2ErrorRepresentation error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-        Assert.assertEquals("It is illegal to add execution to a built in flow", error.getError());
-
-        // adding a sub-flow should fail as well
-        e = Assert.assertThrows(BadRequestException.class, () -> addFlowToParent(flow.getAlias(), "child"));
-        error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-        Assert.assertEquals("It is illegal to add sub-flow to a built in flow", error.getError());
-
-        // removing any execution (execution or flow) should fail too
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions(flow.getAlias());
-        Assert.assertNotNull("The builtin flow has no executions", executions);
-        Assert.assertFalse("The builtin flow has no executions", executions.isEmpty());
-        e = Assert.assertThrows(BadRequestException.class, () -> authMgmtResource.removeExecution(executions.get(0).getId()));
-        error = e.getResponse().readEntity(OAuth2ErrorRepresentation.class);
-        Assert.assertEquals("It is illegal to remove execution from a built in flow", error.getError());
-    }
-
-    @Test
-    public void testExecutionConfigDuplicated() {
-        AuthenticationFlowRepresentation existingFlow = null;
-
-        for (AuthenticationFlowRepresentation flow : authMgmtResource.getFlows()) {
-            if (flow.getAlias().equals(DefaultAuthenticationFlows.BROWSER_FLOW)) {
-                existingFlow = flow;
-            }
-        }
-
-        Assert.assertNotNull(existingFlow);
-
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions(existingFlow.getAlias());
-        AuthenticationExecutionInfoRepresentation executionWithConfig = null;
-
-        for (AuthenticationExecutionInfoRepresentation execution : executions) {
-            if (IdentityProviderAuthenticatorFactory.PROVIDER_ID.equals(execution.getProviderId())) {
-                executionWithConfig = execution;
-            }
-        }
-
-        Assert.assertNotNull(executionWithConfig);
-
-        AuthenticatorConfigRepresentation executionConfig = new AuthenticatorConfigRepresentation();
-
-        executionConfig.setAlias("test-execution-config");
-        executionConfig.setConfig(Map.of("key", "value"));
-
-        try (Response response = authMgmtResource.newExecutionConfig(executionWithConfig.getId(), executionConfig)) {
-            getCleanup().addAuthenticationConfigId(ApiUtil.getCreatedId(response));
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionConfigPath(executionWithConfig.getId()), executionConfig, ResourceType.AUTHENTICATOR_CONFIG);
-        }
-
-        String newFlowName = "Duplicated of " + DefaultAuthenticationFlows.BROWSER_FLOW;
-        Map<String, Object> copyFlowParams = Map.of("newName", newFlowName);
-        authMgmtResource.copy(existingFlow.getAlias(), copyFlowParams).close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), copyFlowParams, ResourceType.AUTH_FLOW);
-
-        AuthenticationFlowRepresentation newFlow = null;
-
-        for (AuthenticationFlowRepresentation flow : authMgmtResource.getFlows()) {
-            if (flow.getAlias().equals(newFlowName)) {
-                newFlow = flow;
-            }
-        }
-
-        Set<String> existingExecutionConfigIds = authMgmtResource.getExecutions(existingFlow.getAlias())
-                .stream().map(AuthenticationExecutionInfoRepresentation::getAuthenticationConfig)
-                .filter(Objects::nonNull)
-                .collect(Collectors.toSet());
-
-        assertFalse(existingExecutionConfigIds.isEmpty());
-
-        Set<String> newExecutionConfigIds = authMgmtResource.getExecutions(newFlow.getAlias())
-                .stream().map(AuthenticationExecutionInfoRepresentation::getAuthenticationConfig)
-                .filter(Objects::nonNull)
-                .collect(Collectors.toSet());
-
-        assertFalse(newExecutionConfigIds.isEmpty());
-
-        for (String executionConfigId : newExecutionConfigIds) {
-            Assert.assertFalse("Execution config not duplicated", existingExecutionConfigIds.contains(executionConfigId));
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RegistrationFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RegistrationFlowTest.java
deleted file mode 100644
index 4c9961e93e40..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RegistrationFlowTest.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.BadRequestException;
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class RegistrationFlowTest extends AbstractAuthenticationTest {
-
-    @Test
-    public void testAddExecution() {
-        // Add registration flow 2
-        AuthenticationFlowRepresentation flowRep = newFlow("registration2", "RegistrationFlow2", "basic-flow", true, false);
-        createFlow(flowRep);
-
-        // add registration execution form flow
-        Map<String, Object> data = new HashMap<>();
-        data.put("alias", "registrationForm2");
-        data.put("type", "form-flow");
-        data.put("description", "registrationForm2 flow");
-        data.put("provider", "registration-page-form");
-        authMgmtResource.addExecutionFlow("registration2", data);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionFlowPath("registration2"), data, ResourceType.AUTH_EXECUTION_FLOW);
-
-        // Should fail to add execution under top level flow
-        Map<String, Object> data2 = new HashMap<>();
-        data2.put("provider", "registration-password-action");
-        try {
-            authMgmtResource.addExecution("registration2", data2);
-            Assert.fail("Not expected to add execution of type 'registration-password-action' under top flow");
-        } catch (BadRequestException bre) {
-        }
-
-        // Should success to add execution under form flow
-        authMgmtResource.addExecution("registrationForm2", data2);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authAddExecutionPath("registrationForm2"), data2, ResourceType.AUTH_EXECUTION);
-    }
-
-    // TODO: More type-safety instead of passing generic maps
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RequiredActionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RequiredActionsTest.java
deleted file mode 100644
index 44b45889805f..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/RequiredActionsTest.java
+++ /dev/null
@@ -1,286 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.RequiredActionConfigInfoRepresentation;
-import org.keycloak.representations.idm.RequiredActionConfigRepresentation;
-import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
-import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
-import org.keycloak.testsuite.actions.DummyConfigurableRequiredActionFactory;
-import org.keycloak.testsuite.actions.DummyRequiredActionFactory;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.NotFoundException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class RequiredActionsTest extends AbstractAuthenticationTest {
-
-    @Override
-    protected boolean removeVerifyProfileAtImport() {
-        // do not remove verify profile action for this test
-        return false;
-    }
-
-    @Test
-    public void testRequiredActions() {
-        List<RequiredActionProviderRepresentation> result = authMgmtResource.getRequiredActions();
-
-        List<RequiredActionProviderRepresentation> expected = new ArrayList<>();
-        addRequiredAction(expected, "CONFIGURE_TOTP", "Configure OTP", true, false, null);
-        addRequiredAction(expected, "TERMS_AND_CONDITIONS", "Terms and Conditions", false, false, null);
-        addRequiredAction(expected, "UPDATE_PASSWORD", "Update Password", true, false, null);
-        addRequiredAction(expected, "UPDATE_PROFILE", "Update Profile", true, false, null);
-        addRequiredAction(expected, "VERIFY_EMAIL", "Verify Email", true, false, null);
-        addRequiredAction(expected, "VERIFY_PROFILE", "Verify Profile", true, false, null);
-        addRequiredAction(expected, "delete_account", "Delete Account", false, false, null);
-        addRequiredAction(expected, "delete_credential", "Delete Credential", true, false, null);
-        addRequiredAction(expected, "update_user_locale", "Update User Locale", true, false, null);
-        addRequiredAction(expected, "webauthn-register", "Webauthn Register", true, false, null);
-        addRequiredAction(expected, "webauthn-register-passwordless", "Webauthn Register Passwordless", true, false, null);
-
-        compareRequiredActions(expected, sort(result));
-
-        RequiredActionProviderRepresentation forUpdate = newRequiredAction("VERIFY_EMAIL", "Verify Email", false, false, null);
-        authMgmtResource.updateRequiredAction(forUpdate.getAlias(), forUpdate);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(forUpdate.getAlias()), ResourceType.REQUIRED_ACTION);
-
-        result = authMgmtResource.getRequiredActions();
-        RequiredActionProviderRepresentation updated = findRequiredActionByAlias(forUpdate.getAlias(), result);
-
-        Assert.assertNotNull("Required Action still there", updated);
-        compareRequiredAction(forUpdate, updated);
-
-        forUpdate.setConfig(Collections.<String, String>emptyMap());
-        authMgmtResource.updateRequiredAction(forUpdate.getAlias(), forUpdate);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(forUpdate.getAlias()), ResourceType.REQUIRED_ACTION);
-
-        result = authMgmtResource.getRequiredActions();
-        updated = findRequiredActionByAlias(forUpdate.getAlias(), result);
-
-        Assert.assertNotNull("Required Action still there", updated);
-        compareRequiredAction(forUpdate, updated);
-    }
-
-    @Test
-    public void testCRUDRequiredAction() {
-        int lastPriority = authMgmtResource.getRequiredActions().get(authMgmtResource.getRequiredActions().size() - 1).getPriority();
-
-        // Dummy RequiredAction is not registered in the realm and WebAuthn actions
-        List<RequiredActionProviderSimpleRepresentation> result = authMgmtResource.getUnregisteredRequiredActions();
-        Assert.assertEquals(2, result.size());
-        RequiredActionProviderSimpleRepresentation action = result.stream().filter(
-                a -> a.getProviderId().equals(DummyRequiredActionFactory.PROVIDER_ID)
-        ).findFirst().get();
-        Assert.assertEquals(DummyRequiredActionFactory.PROVIDER_ID, action.getProviderId());
-        Assert.assertEquals("Dummy Action", action.getName());
-
-        // Register it
-        authMgmtResource.registerRequiredAction(action);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authMgmtBasePath() + "/register-required-action", action, ResourceType.REQUIRED_ACTION);
-
-        // Try to register 2nd time
-        try {
-            authMgmtResource.registerRequiredAction(action);
-        } catch (ClientErrorException ex) {
-            // Expected
-        }
-
-        // Try to register required action with fake providerId
-        RequiredActionProviderSimpleRepresentation requiredAction = new RequiredActionProviderSimpleRepresentation();
-        requiredAction.setName("not-existent");
-        requiredAction.setProviderId("not-existent");
-        try {
-            authMgmtResource.registerRequiredAction(requiredAction);
-            Assert.fail("Didn't expect to register requiredAction with providerId: 'not-existent'");
-        } catch (Exception ex) {
-            // Expected
-        }
-
-        // Try to find not-existent action - should fail
-        try {
-            authMgmtResource.getRequiredAction("not-existent");
-            Assert.fail("Didn't expect to find requiredAction of alias 'not-existent'");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Find existent
-        RequiredActionProviderRepresentation rep = authMgmtResource.getRequiredAction(DummyRequiredActionFactory.PROVIDER_ID);
-        compareRequiredAction(rep, newRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, "Dummy Action",
-                true, false, Collections.<String, String>emptyMap()));
-
-        // Confirm the registered priority - should be N + 1
-        Assert.assertEquals(lastPriority + 1, rep.getPriority());
-
-        // Update not-existent - should fail
-        try {
-            authMgmtResource.updateRequiredAction("not-existent", rep);
-            Assert.fail("Not expected to update not-existent requiredAction");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Update (set it as defaultAction)
-        rep.setDefaultAction(true);
-        authMgmtResource.updateRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, rep);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), rep, ResourceType.REQUIRED_ACTION);
-        compareRequiredAction(rep, newRequiredAction(DummyRequiredActionFactory.PROVIDER_ID, "Dummy Action",
-                true, true, Collections.<String, String>emptyMap()));
-
-        // Remove unexistent - should fail
-        try {
-            authMgmtResource.removeRequiredAction("not-existent");
-            Assert.fail("Not expected to remove not-existent requiredAction");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // Remove success
-        authMgmtResource.removeRequiredAction(DummyRequiredActionFactory.PROVIDER_ID);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), ResourceType.REQUIRED_ACTION);
-
-    }
-
-    @Test
-    public void testConfigurableRequiredActionMetadata() {
-
-        String providerId = DummyConfigurableRequiredActionFactory.PROVIDER_ID;
-
-        // query configurable properties
-        RequiredActionConfigInfoRepresentation requiredActionConfigDescription = authMgmtResource.getRequiredActionConfigDescription(providerId);
-        Assert.assertNotNull(requiredActionConfigDescription);
-        Assert.assertNotNull(requiredActionConfigDescription.getProperties());
-        Assert.assertTrue(requiredActionConfigDescription.getProperties().size() == 2);
-    }
-
-    @Test
-    public void testCRUDConfigurableRequiredAction() {
-        int lastPriority = authMgmtResource.getRequiredActions().get(authMgmtResource.getRequiredActions().size() - 1).getPriority();
-
-        // Dummy RequiredAction is not registered in the realm and WebAuthn actions
-        List<RequiredActionProviderSimpleRepresentation> result = authMgmtResource.getUnregisteredRequiredActions();
-        Assert.assertEquals(2, result.size());
-        String providerId = DummyConfigurableRequiredActionFactory.PROVIDER_ID;
-        RequiredActionProviderSimpleRepresentation action = result.stream().filter(
-                a -> providerId.equals(a.getProviderId())
-        ).findFirst().get();
-        Assert.assertEquals(providerId, action.getProviderId());
-        Assert.assertEquals("Configurable Test Action", action.getName());
-
-        // Register it
-        authMgmtResource.registerRequiredAction(action);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authMgmtBasePath() + "/register-required-action", action, ResourceType.REQUIRED_ACTION);
-
-        RequiredActionConfigRepresentation requiredActionConfigRep = new RequiredActionConfigRepresentation();
-        Map<String, String> newActionConfig = Map.ofEntries(Map.entry("setting1", "value1"), Map.entry("setting2", "false"));
-        requiredActionConfigRep.setConfig(newActionConfig);
-
-        authMgmtResource.updateRequiredActionConfig(providerId, requiredActionConfigRep);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRequiredActionConfigPath(providerId), ResourceType.REQUIRED_ACTION_CONFIG);
-
-        RequiredActionConfigRepresentation savedRequiredActionConfigRep = authMgmtResource.getRequiredActionConfig(providerId);
-        Assert.assertNotNull(savedRequiredActionConfigRep);
-        Assert.assertNotNull(savedRequiredActionConfigRep.getConfig());
-        Assert.assertTrue(savedRequiredActionConfigRep.getConfig().entrySet().containsAll(newActionConfig.entrySet()));
-
-        // delete config
-        authMgmtResource.removeRequiredActionConfig(providerId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authRequiredActionConfigPath(providerId), ResourceType.REQUIRED_ACTION_CONFIG);
-
-        RequiredActionProviderRepresentation rep = authMgmtResource.getRequiredAction(providerId);
-
-        // Remove success
-        authMgmtResource.removeRequiredAction(providerId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.authRequiredActionPath(rep.getAlias()), ResourceType.REQUIRED_ACTION);
-
-        // Retrieval after deletion should throw a NotFound exception
-        try {
-            authMgmtResource.getRequiredActionConfig(providerId);
-        } catch (Exception ex) {
-            Assert.assertTrue(NotFoundException.class.isInstance(ex));
-        }
-    }
-
-    private RequiredActionProviderRepresentation findRequiredActionByAlias(String alias, List<RequiredActionProviderRepresentation> list) {
-        for (RequiredActionProviderRepresentation a: list) {
-            if (alias.equals(a.getAlias())) {
-                return a;
-            }
-        }
-        return null;
-    }
-
-    private List<RequiredActionProviderRepresentation> sort(List<RequiredActionProviderRepresentation> list) {
-        ArrayList<RequiredActionProviderRepresentation> sorted = new ArrayList<>(list);
-        Collections.sort(sorted, new RequiredActionProviderComparator());
-        return sorted;
-    }
-
-    private void compareRequiredActions(List<RequiredActionProviderRepresentation> expected, List<RequiredActionProviderRepresentation> actual) {
-        Assert.assertNotNull("Actual null", actual);
-        Assert.assertEquals("Required actions count", expected.size(), actual.size());
-
-        Iterator<RequiredActionProviderRepresentation> ite = expected.iterator();
-        Iterator<RequiredActionProviderRepresentation> ita = actual.iterator();
-        while (ite.hasNext()) {
-            compareRequiredAction(ite.next(), ita.next());
-        }
-    }
-
-    private void compareRequiredAction(RequiredActionProviderRepresentation expected, RequiredActionProviderRepresentation actual) {
-        Assert.assertEquals("alias - " + expected.getAlias(), expected.getAlias(), actual.getAlias());
-        Assert.assertEquals("name - "  + expected.getAlias(), expected.getName(), actual.getName());
-        Assert.assertEquals("enabled - "  + expected.getAlias(), expected.isEnabled(), actual.isEnabled());
-        Assert.assertEquals("defaultAction - "  + expected.getAlias(), expected.isDefaultAction(), actual.isDefaultAction());
-        Assert.assertEquals("config - " + expected.getAlias(), expected.getConfig() != null ? expected.getConfig() : Collections.<String, String>emptyMap(), actual.getConfig());
-    }
-
-    private void addRequiredAction(List<RequiredActionProviderRepresentation> target, String alias, String name, boolean enabled, boolean defaultAction, Map<String, String> conf) {
-        target.add(newRequiredAction(alias, name, enabled, defaultAction, conf));
-    }
-
-    private RequiredActionProviderRepresentation newRequiredAction(String alias, String name, boolean enabled, boolean defaultAction, Map<String, String> conf) {
-        RequiredActionProviderRepresentation action = new RequiredActionProviderRepresentation();
-        action.setAlias(alias);
-        action.setName(name);
-        action.setEnabled(enabled);
-        action.setDefaultAction(defaultAction);
-        action.setConfig(conf);
-        return action;
-    }
-
-    private static class RequiredActionProviderComparator implements Comparator<RequiredActionProviderRepresentation> {
-        @Override
-        public int compare(RequiredActionProviderRepresentation o1, RequiredActionProviderRepresentation o2) {
-            return o1.getAlias().compareTo(o2.getAlias());
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftExecutionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftExecutionTest.java
deleted file mode 100644
index 791e62b13fb2..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftExecutionTest.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.BadRequestException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import java.util.HashMap;
-import java.util.List;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class ShiftExecutionTest extends AbstractAuthenticationTest {
-
-    @Test
-    public void testShiftExecution() {
-
-        // copy built-in flow so we get a new editable flow
-        HashMap<String, Object> params = new HashMap<>();
-        params.put("newName", "Copy of browser");
-        Response response = authMgmtResource.copy("browser", params);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.authCopyFlowPath("browser"), params, ResourceType.AUTH_FLOW);
-        try {
-            Assert.assertEquals("Copy flow", 201, response.getStatus());
-        } finally {
-            response.close();
-        }
-
-        // get executions
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("Copy of browser");
-
-        AuthenticationExecutionInfoRepresentation last = executions.get(executions.size() - 1);
-        AuthenticationExecutionInfoRepresentation oneButLast = executions.get(executions.size() - 2);
-
-        // Not possible to raisePriority of not-existent flow
-        try {
-            authMgmtResource.raisePriority("not-existent");
-            Assert.fail("Not expected to raise priority of not existent flow");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // shift last execution up
-        authMgmtResource.raisePriority(last.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRaiseExecutionPath(last.getId()), ResourceType.AUTH_EXECUTION);
-
-        List<AuthenticationExecutionInfoRepresentation> executions2 = authMgmtResource.getExecutions("Copy of browser");
-
-        AuthenticationExecutionInfoRepresentation last2 = executions2.get(executions.size() - 1);
-        AuthenticationExecutionInfoRepresentation oneButLast2 = executions2.get(executions.size() - 2);
-
-        Assert.assertEquals("Execution shifted up - N", last.getId(), oneButLast2.getId());
-        Assert.assertEquals("Execution shifted up - N-1", oneButLast.getId(), last2.getId());
-
-        // Not possible to lowerPriority of not-existent flow
-        try {
-            authMgmtResource.lowerPriority("not-existent");
-            Assert.fail("Not expected to raise priority of not existent flow");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // shift one before last down
-        authMgmtResource.lowerPriority(oneButLast2.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authLowerExecutionPath(oneButLast2.getId()), ResourceType.AUTH_EXECUTION);
-
-        executions2 = authMgmtResource.getExecutions("Copy of browser");
-
-        last2 = executions2.get(executions.size() - 1);
-        oneButLast2 = executions2.get(executions.size() - 2);
-
-        Assert.assertEquals("Execution shifted down - N", last.getId(), last2.getId());
-        Assert.assertEquals("Execution shifted down - N-1", oneButLast.getId(), oneButLast2.getId());
-    }
-
-    @Test
-    public void testBuiltinShiftNotAllowed() {
-        List<AuthenticationExecutionInfoRepresentation> executions = authMgmtResource.getExecutions("browser");
-
-        AuthenticationExecutionInfoRepresentation last = executions.get(executions.size() - 1);
-        AuthenticationExecutionInfoRepresentation oneButLast = executions.get(executions.size() - 2);
-
-        // Not possible to raise - It's builtin flow
-        try {
-            authMgmtResource.raisePriority(last.getId());
-            Assert.fail("Not expected to raise priority of builtin flow");
-        } catch (BadRequestException nfe) {
-            // Expected
-        }
-
-        // Not possible to lower - It's builtin flow
-        try {
-            authMgmtResource.lowerPriority(oneButLast.getId());
-            Assert.fail("Not expected to lower priority of builtin flow");
-        } catch (BadRequestException nfe) {
-            // Expected
-        }
-
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftRequiredActionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftRequiredActionTest.java
deleted file mode 100644
index b9c1fb8daed4..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ShiftRequiredActionTest.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.authentication;
-
-import java.util.List;
-
-import jakarta.ws.rs.NotFoundException;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-/**
- * @author <a href="mailto:wadahiro@gmail.com">Hiroyuki Wada</a>
- */
-public class ShiftRequiredActionTest extends AbstractAuthenticationTest {
-
-    @Test
-    public void testShiftRequiredAction() {
-
-        // get action
-        List<RequiredActionProviderRepresentation> actions = authMgmtResource.getRequiredActions();
-
-        RequiredActionProviderRepresentation last = actions.get(actions.size() - 1);
-        RequiredActionProviderRepresentation oneButLast = actions.get(actions.size() - 2);
-
-        // Not possible to raisePriority of not-existent required action
-        try {
-            authMgmtResource.raisePriority("not-existent");
-            Assert.fail("Not expected to raise priority of not existent required action");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // shift last required action up
-        authMgmtResource.raiseRequiredActionPriority(last.getAlias());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authRaiseRequiredActionPath(last.getAlias()), ResourceType.REQUIRED_ACTION);
-
-        List<RequiredActionProviderRepresentation> actions2 = authMgmtResource.getRequiredActions();
-
-        RequiredActionProviderRepresentation last2 = actions2.get(actions.size() - 1);
-        RequiredActionProviderRepresentation oneButLast2 = actions2.get(actions.size() - 2);
-
-        Assert.assertEquals("Required action shifted up - N", last.getAlias(), oneButLast2.getAlias());
-        Assert.assertEquals("Required action up - N-1", oneButLast.getAlias(), last2.getAlias());
-
-        // Not possible to lowerPriority of not-existent required action
-        try {
-            authMgmtResource.lowerRequiredActionPriority("not-existent");
-            Assert.fail("Not expected to raise priority of not existent required action");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-
-        // shift one before last down
-        authMgmtResource.lowerRequiredActionPriority(oneButLast2.getAlias());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.authLowerRequiredActionPath(oneButLast2.getAlias()), ResourceType.REQUIRED_ACTION);
-
-        actions2 = authMgmtResource.getRequiredActions();
-
-        last2 = actions2.get(actions.size() - 1);
-        oneButLast2 = actions2.get(actions.size() - 2);
-
-        Assert.assertEquals("Required action shifted down - N", last.getAlias(), last2.getAlias());
-        Assert.assertEquals("Required action shifted down - N-1", oneButLast.getAlias(), oneButLast2.getAlias());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractClientTest.java
index 6805e0ab7eae..4fd2cda2b1dc 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/AbstractClientTest.java
@@ -92,44 +92,6 @@ protected UserRepresentation getFullUserRep(String userName) {
         return result;
     }
 
-    protected String createOidcClient(String name) {
-        return createClient(createOidcClientRep(name));
-    }
-
-    protected String createOidcBearerOnlyClient(String name) {
-        ClientRepresentation clientRep = createOidcClientRep(name);
-        clientRep.setBearerOnly(Boolean.TRUE);
-        clientRep.setPublicClient(Boolean.FALSE);
-        return createClient(clientRep);
-    }
-
-    protected String createOidcConfidentialClientWithAuthz(String name) {
-        ClientRepresentation clientRep = createOidcClientRep(name);
-        clientRep.setBearerOnly(Boolean.FALSE);
-        clientRep.setPublicClient(Boolean.FALSE);
-        clientRep.setAuthorizationServicesEnabled(Boolean.TRUE);
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-        String id = createClient(clientRep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientResourcePath(id), ResourceType.AUTHORIZATION_RESOURCE_SERVER);
-        return id;
-    }
-
-    protected ClientRepresentation createOidcClientRep(String name) {
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId(name);
-        clientRep.setName(name);
-        clientRep.setProtocol("openid-connect");
-        return clientRep;
-    }
-
-    protected String createSamlClient(String name) {
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId(name);
-        clientRep.setName(name);
-        clientRep.setProtocol("saml");
-        return createClient(clientRep);
-    }
-
     protected String createClient(ClientRepresentation clientRep) {
         Response resp = testRealmResource().clients().create(clientRep);
         resp.close();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientProtocolMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientProtocolMapperTest.java
deleted file mode 100644
index fc8448f1b68a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientProtocolMapperTest.java
+++ /dev/null
@@ -1,258 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import java.util.Collections;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.FixMethodOrder;
-import org.junit.Test;
-import org.junit.runners.MethodSorters;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ProtocolMappersResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.mappers.AllowedWebOriginsProtocolMapper;
-import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
-import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-
-/**
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-@FixMethodOrder(MethodSorters.NAME_ASCENDING)
-public class ClientProtocolMapperTest extends AbstractProtocolMapperTest {
-
-    private ClientResource oidcClientRsc;
-    private String oidcClientId;
-    private ProtocolMappersResource oidcMappersRsc;
-    private ClientResource samlClientRsc;
-    private String samlClientId;
-    private ProtocolMappersResource samlMappersRsc;
-
-    @Before
-    public void init() {
-        oidcClientId = createOidcClient("oidcMapperClient");
-        oidcClientRsc = findClientResource("oidcMapperClient");
-        oidcMappersRsc = oidcClientRsc.getProtocolMappers();
-
-        samlClientId = createSamlClient("samlMapperClient");
-        samlClientRsc = findClientResource("samlMapperClient");
-        samlMappersRsc = samlClientRsc.getProtocolMappers();
-
-        super.initBuiltinMappers();
-    }
-
-    @After
-    public void tearDown() {
-        removeClient(oidcClientId);
-        removeClient(samlClientId);
-    }
-
-    @Test
-    public void test01GetMappersList() {
-        // Built-in protocol mappers are empty by default
-        assertTrue(oidcMappersRsc.getMappers().isEmpty());
-        assertTrue(samlMappersRsc.getMappers().isEmpty());
-    }
-
-    @Test
-    public void test02CreateOidcMappersFromList() {
-        testAddAllBuiltinMappers(oidcMappersRsc, "openid-connect", AdminEventPaths.clientProtocolMappersPath(oidcClientId));
-    }
-
-    @Test
-    public void test03CreateSamlMappersFromList() {
-        testAddAllBuiltinMappers(samlMappersRsc, "saml", AdminEventPaths.clientProtocolMappersPath(samlClientId));
-    }
-
-    @Test
-    public void test04CreateSamlProtocolMapper() {
-
-        //{"protocol":"saml",
-        // "config":{"role":"account.view-profile","new.role.name":"new-role-name"},
-        // "consentRequired":true,
-        // "consentText":"My consent text",
-        // "name":"saml-role-name-maper",
-        // "protocolMapper":"saml-role-name-mapper"}
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper");
-
-        int totalMappers = samlMappersRsc.getMappers().size();
-        int totalSamlMappers = samlMappersRsc.getMappersPerProtocol("saml").size();
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        assertEquals(totalMappers + 1, samlMappersRsc.getMappers().size());
-        assertEquals(totalSamlMappers + 1, samlMappersRsc.getMappersPerProtocol("saml").size());
-
-        ProtocolMapperRepresentation created = samlMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, created);
-    }
-
-    @Test
-    public void test05CreateOidcProtocolMapper() {
-        //{"protocol":"openid-connect",
-        // "config":{"role":"myrole"},
-        // "consentRequired":true,
-        // "consentText":"My consent text",
-        // "name":"oidc-hardcoded-role-mapper",
-        // "protocolMapper":"oidc-hardcoded-role-mapper"}
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper");
-
-        int totalMappers = oidcMappersRsc.getMappers().size();
-        int totalOidcMappers = oidcMappersRsc.getMappersPerProtocol("openid-connect").size();
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        assertEquals(totalMappers + 1, oidcMappersRsc.getMappers().size());
-        assertEquals(totalOidcMappers + 1, oidcMappersRsc.getMappersPerProtocol("openid-connect").size());
-
-        ProtocolMapperRepresentation created = oidcMappersRsc.getMapperById(createdId);//findByName(samlMappersRsc, "saml-role-name-mapper");
-        assertEqualMappers(rep, created);
-
-    }
-
-    @Test
-    public void test06UpdateSamlMapper() {
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper2");
-
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        rep.getConfig().put("role", "account.manage-account");
-        rep.setId(createdId);
-        samlMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(samlClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        ProtocolMapperRepresentation updated = samlMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, updated);
-    }
-
-    @Test
-    public void test07UpdateOidcMapper() {
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper2");
-
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        rep.getConfig().put("role", "myotherrole");
-        rep.setId(createdId);
-        oidcMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        ProtocolMapperRepresentation updated = oidcMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, updated);
-    }
-
-    @Test
-    public void test08DeleteSamlMapper() {
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper3");
-
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(samlClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        samlMappersRsc.delete(createdId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(samlClientId, createdId), ResourceType.PROTOCOL_MAPPER);
-
-        try {
-            samlMappersRsc.getMapperById(createdId);
-            Assert.fail("Not expected to find mapper");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void test09DeleteOidcMapper() {
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper3");
-
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        oidcMappersRsc.delete(createdId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), ResourceType.PROTOCOL_MAPPER);
-
-        try {
-            oidcMappersRsc.getMapperById(createdId);
-            Assert.fail("Not expected to find mapper");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void test10EffectiveMappers() {
-        // Web origins mapper
-        ProtocolMapperRepresentation rep = makeMapper(OIDCLoginProtocol.LOGIN_PROTOCOL, "web-origins", AllowedWebOriginsProtocolMapper.PROVIDER_ID, Collections.emptyMap());
-
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-        rep = oidcMappersRsc.getMapperById(createdId);
-
-        // Test default values available on the protocol mapper
-        Assert.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-        Assert.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-
-        // Update mapper to not contain default values
-        rep.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN);
-        rep.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION);
-        oidcMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        // Test configuration will contain "effective values", which are the default values of particular options
-        rep = oidcMappersRsc.getMapperById(createdId);
-        Assert.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-        Assert.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-
-        // Override "includeInIntrospection"
-        rep.getConfig().put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "false");
-        oidcMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientProtocolMapperPath(oidcClientId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        // Get mapper and check that "includeInIntrospection" is using overriden value instead of the default
-        rep = oidcMappersRsc.getMapperById(createdId);
-        Assert.assertEquals("true", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-        Assert.assertEquals("false", rep.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientRolesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientRolesTest.java
deleted file mode 100644
index c1ceccd2b56a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientRolesTest.java
+++ /dev/null
@@ -1,369 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.RoleByIdResource;
-import org.keycloak.admin.client.resource.RoleResource;
-import org.keycloak.admin.client.resource.RolesResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.stream.Collectors;
-import java.util.stream.IntStream;
-import jakarta.ws.rs.ClientErrorException;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.hasSize;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-import org.keycloak.testsuite.util.RoleBuilder;
-
-/**
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class ClientRolesTest extends AbstractClientTest {
-
-    private ClientResource clientRsc;
-    private String clientDbId;
-    private RolesResource rolesRsc;
-
-    @Before
-    public void init() {
-        clientDbId = createOidcClient("roleClient");
-        clientRsc = findClientResource("roleClient");
-        rolesRsc = clientRsc.roles();
-    }
-
-    @After
-    public void tearDown() {
-        clientRsc.remove();
-    }
-
-    private RoleRepresentation makeRole(String name) {
-        RoleRepresentation role = new RoleRepresentation();
-        role.setName(name);
-        return role;
-    }
-
-    private boolean hasRole(RolesResource rolesRsc, String name) {
-        for (RoleRepresentation role : rolesRsc.list()) {
-            if (role.getName().equals(name)) return true;
-        }
-
-        return false;
-    }
-
-    @Test
-    public void testAddRole() {
-        RoleRepresentation role1 = makeRole("role1");
-        role1.setDescription("role1-description");
-        role1.setAttributes(Collections.singletonMap("role1-attr-key", Collections.singletonList("role1-attr-val")));
-        rolesRsc.create(role1);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role1"), role1, ResourceType.CLIENT_ROLE);
-
-        RoleRepresentation addedRole = rolesRsc.get(role1.getName()).toRepresentation();
-        assertEquals(role1.getName(), addedRole.getName());
-        assertEquals(role1.getDescription(), addedRole.getDescription());
-        assertEquals(role1.getAttributes(), addedRole.getAttributes());
-    }
-
-    @Test(expected = ClientErrorException.class)
-    public void createRoleWithSameName() {
-        RoleRepresentation role = RoleBuilder.create().name("role-a").build();
-        rolesRsc.create(role);
-        rolesRsc.create(role);
-    }
-
-    @Test
-    public void createRoleWithNamePattern() {
-        RoleRepresentation role = RoleBuilder.create().name("role-a-{pattern}").build();
-        rolesRsc.create(role);
-    }
-
-    @Test
-    public void testRemoveRole() {
-        RoleRepresentation role2 = makeRole("role2");
-        rolesRsc.create(role2);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role2"), role2, ResourceType.CLIENT_ROLE);
-
-        rolesRsc.deleteRole("role2");
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role2"), ResourceType.CLIENT_ROLE);
-
-        assertFalse(hasRole(rolesRsc, "role2"));
-    }
-
-    @Test
-    public void testComposites() {
-        RoleRepresentation roleA = makeRole("role-a");
-        rolesRsc.create(roleA);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role-a"), roleA, ResourceType.CLIENT_ROLE);
-
-        assertFalse(rolesRsc.get("role-a").toRepresentation().isComposite());
-        assertEquals(0, rolesRsc.get("role-a").getRoleComposites().size());
-
-        RoleRepresentation roleB = makeRole("role-b");
-        rolesRsc.create(roleB);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "role-b"), roleB, ResourceType.CLIENT_ROLE);
-
-        RoleRepresentation roleC = makeRole("role-c");
-        testRealmResource().roles().create(roleC);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.roleResourcePath("role-c"), roleC, ResourceType.REALM_ROLE);
-
-        List<RoleRepresentation> l = new LinkedList<>();
-        l.add(rolesRsc.get("role-b").toRepresentation());
-        l.add(testRealmResource().roles().get("role-c").toRepresentation());
-        rolesRsc.get("role-a").addComposites(l);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourceCompositesPath(clientDbId, "role-a"), l, ResourceType.CLIENT_ROLE);
-
-        Set<RoleRepresentation> composites = rolesRsc.get("role-a").getRoleComposites();
-
-        assertTrue(rolesRsc.get("role-a").toRepresentation().isComposite());
-        Assert.assertNames(composites, "role-b", "role-c");
-
-        Set<RoleRepresentation> realmComposites = rolesRsc.get("role-a").getRealmRoleComposites();
-        Assert.assertNames(realmComposites, "role-c");
-
-        Set<RoleRepresentation> clientComposites = rolesRsc.get("role-a").getClientRoleComposites(clientRsc.toRepresentation().getId());
-        Assert.assertNames(clientComposites, "role-b");
-
-        rolesRsc.get("role-a").deleteComposites(l);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientRoleResourceCompositesPath(clientDbId, "role-a"), l, ResourceType.CLIENT_ROLE);
-
-        assertFalse(rolesRsc.get("role-a").toRepresentation().isComposite());
-        assertEquals(0, rolesRsc.get("role-a").getRoleComposites().size());
-    }
-
-
-    @Test
-    public void testCompositeRolesSearch() {
-        // Create main-role we will work on
-        RoleRepresentation mainRole = makeRole("main-role");
-        rolesRsc.create(mainRole);
-
-        RoleResource mainRoleRsc = rolesRsc.get("main-role");
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, "main-role"), mainRole, ResourceType.CLIENT_ROLE);
-
-        // Add composites
-        List<RoleRepresentation> createdRoles = IntStream.range(0, 20)
-                .boxed()
-                .map(i -> makeRole("role" + i))
-                .peek(rolesRsc::create)
-                .peek(role -> assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId, role.getName()), role, ResourceType.CLIENT_ROLE))
-                .map(role -> rolesRsc.get(role.getName()).toRepresentation())
-                .collect(Collectors.toList());
-
-        mainRoleRsc.addComposites(createdRoles);
-        mainRole = mainRoleRsc.toRepresentation();
-        RoleByIdResource roleByIdResource = adminClient.realm(TEST).rolesById();
-
-        // Search for all composites
-        Set<RoleRepresentation> foundRoles = roleByIdResource.getRoleComposites(mainRole.getId());
-        assertThat(foundRoles, hasSize(createdRoles.size()));
-
-        // Search paginated composites
-        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), null, 0, 10);
-        assertThat(foundRoles, hasSize(10));
-
-        // Search for composites by string role1 (should be role1, role10-role19) without pagination
-        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), "role1", null, null);
-        assertThat(foundRoles, hasSize(11));
-
-        // Search for role1 with pagination
-        foundRoles.forEach(System.out::println);
-        foundRoles = roleByIdResource.searchRoleComposites(mainRole.getId(), "role1", 5, 5);
-        assertThat(foundRoles, hasSize(5));
-    }
-
-    @Test
-    public void usersInRole() {
-        String clientID = clientRsc.toRepresentation().getId();
-
-        // create test role on client
-        String roleName = "test-role";
-        RoleRepresentation role = makeRole(roleName);
-        rolesRsc.create(role);
-        assertTrue(hasRole(rolesRsc, roleName));
-        List<RoleRepresentation> roleToAdd = Collections.singletonList(rolesRsc.get(roleName).toRepresentation());
-
-        //create users and assign test role
-        List<String> usernames = createUsernames(0, 10);
-        usernames.forEach(username -> {
-            UserRepresentation user = new UserRepresentation();
-            user.setUsername(username);
-            testRealmResource().users().create(user);
-            user = getFullUserRep(username);
-            testRealmResource().users().get(user.getId()).roles().clientLevel(clientID).add(roleToAdd);
-        });
-
-        // check if users have test role assigned
-        RoleResource roleResource = rolesRsc.get(roleName);
-        List<UserRepresentation> usersInRole = roleResource.getUserMembers();
-        assertEquals(usernames, extractUsernames(usersInRole));
-
-        // pagination
-        List<UserRepresentation> usersInRole1 = roleResource.getUserMembers(0, 5);
-        assertEquals(createUsernames(0, 5), extractUsernames(usersInRole1));
-        Assert.assertNotNull("Not in full representation", usersInRole1.get(0).getNotBefore());
-        List<UserRepresentation> usersInRole2 = roleResource.getUserMembers(true, 5, 10);
-        assertEquals(createUsernames(5, 10), extractUsernames(usersInRole2));
-        Assert.assertNull("Not in brief representation", usersInRole2.get(0).getNotBefore());
-    }
-
-    private static List<String> createUsernames(int startIndex, int endIndex) {
-        List<String> usernames = new ArrayList<>();
-        for (int i = startIndex; i < endIndex; i++) {
-            String userName = "user" + i;
-            usernames.add(userName);
-        }
-        return usernames;
-    }
-
-    private static List<String> extractUsernames(Collection<UserRepresentation> users) {
-        return users.stream().map(UserRepresentation::getUsername).collect(Collectors.toList());
-    }
-
-    @Test
-    public void testSearchForRoles() {
-        
-        for(int i = 0; i<15; i++) {
-            String roleName = "role"+i;
-            RoleRepresentation role = makeRole(roleName);
-            rolesRsc.create(role);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleName), role, ResourceType.CLIENT_ROLE);           
-        }  
-        
-        String roleNameA = "abcdef";
-        RoleRepresentation roleA = makeRole(roleNameA);
-        rolesRsc.create(roleA);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleNameA), roleA, ResourceType.CLIENT_ROLE);  
-        
-        String roleNameB = "defghi";
-        RoleRepresentation roleB = makeRole(roleNameB);
-        rolesRsc.create(roleB);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleNameB), roleB, ResourceType.CLIENT_ROLE);
-        
-        List<RoleRepresentation> resultSearch = rolesRsc.list("def", -1, -1);
-        assertEquals(2,resultSearch.size());
-        
-        List<RoleRepresentation> resultSearch2 = rolesRsc.list("role", -1, -1);
-        assertEquals(15,resultSearch2.size());
-        
-        List<RoleRepresentation> resultSearchPagination = rolesRsc.list("role", 1, 5);
-        assertEquals(5,resultSearchPagination.size());
-    }
-    
-    @Test
-    public void testPaginationRoles() {
-        
-        for(int i = 0; i<15; i++) {
-            String roleName = "role"+i;
-            RoleRepresentation role = makeRole(roleName);
-            rolesRsc.create(role);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleName), role, ResourceType.CLIENT_ROLE);           
-        }  
-        
-        List<RoleRepresentation> resultSearchWithoutPagination = rolesRsc.list();
-        assertEquals(15,resultSearchWithoutPagination.size());
-        
-        List<RoleRepresentation> resultSearchPagination = rolesRsc.list(1, 5);
-        assertEquals(5,resultSearchPagination.size());
-        
-        List<RoleRepresentation> resultSearchPaginationIncoherentParams = rolesRsc.list(1, null);
-        assertTrue(resultSearchPaginationIncoherentParams.size() >= 15);
-    }
-    
-    @Test
-    public void testPaginationRolesCache() {
-        
-        for(int i = 0; i<5; i++) {
-            String roleName = "paginaterole"+i;
-            RoleRepresentation role = makeRole(roleName);
-            rolesRsc.create(role);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleName), role, ResourceType.CLIENT_ROLE);        
-        }   
-       
-        List<RoleRepresentation> resultBeforeAddingRoleToTestCache = rolesRsc.list(1, 1000);  
-        
-        // after a first call which init the cache, we add a new role to see if the result change
-        
-        RoleRepresentation role = makeRole("anewrole");
-        rolesRsc.create(role);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,"anewrole"), role, ResourceType.CLIENT_ROLE);  
-        
-        List<RoleRepresentation> resultafterAddingRoleToTestCache = rolesRsc.list(1, 1000);
-        
-        assertEquals(resultBeforeAddingRoleToTestCache.size()+1, resultafterAddingRoleToTestCache.size());
-    }
-    
-    @Test
-    public void getRolesWithFullRepresentation() {
-        for(int i = 0; i<5; i++) {
-            String roleName = "attributesrole"+i;
-            RoleRepresentation role = makeRole(roleName);
-            
-            Map<String, List<String>> attributes = new HashMap<String, List<String>>();
-            attributes.put("attribute1", Arrays.asList("value1","value2"));
-            role.setAttributes(attributes);
-                    
-            rolesRsc.create(role);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleName), role, ResourceType.CLIENT_ROLE);  
-        }
-        
-        List<RoleRepresentation> roles = rolesRsc.list(false);
-        assertTrue(roles.get(0).getAttributes().containsKey("attribute1"));
-    }
-
-    @Test
-    public void getRolesWithBriefRepresentation() {
-        for(int i = 0; i<5; i++) {
-            String roleName = "attributesrole"+i;
-            RoleRepresentation role = makeRole(roleName);
-            
-            Map<String, List<String>> attributes = new HashMap<String, List<String>>();
-            attributes.put("attribute1", Arrays.asList("value1","value2"));
-            role.setAttributes(attributes);
-                    
-            rolesRsc.create(role);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientDbId,roleName), role, ResourceType.CLIENT_ROLE);
-        }
-        
-        List<RoleRepresentation> roles = rolesRsc.list();
-        assertNull(roles.get(0).getAttributes());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeEvaluateTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeEvaluateTest.java
new file mode 100644
index 000000000000..44e43348b7d9
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeEvaluateTest.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2025 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.testsuite.admin.client;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.idm.UserSessionRepresentation;
+import org.keycloak.testsuite.admin.ApiUtil;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class ClientScopeEvaluateTest extends AbstractClientTest {
+
+    private ClientResource accountClient;
+
+    @Before
+    public void init() {
+        accountClient = findClientResourceById("account");
+        createTestUserWithAdminClient();
+        getCleanup().addUserId(testUser.getId());
+    }
+
+    @Test
+    public void testGenerateAccessToken() {
+        AccessToken accessToken = accountClient.clientScopesEvaluate().generateAccessToken("openid", testUser.getId(), null);
+        assertNotNull(accessToken);
+        assertNotNull(accessToken.getSubject());
+        assertNotNull(accessToken.getPreferredUsername());
+
+        List<UserSessionRepresentation> sessions = accountClient.getUserSessions(0, 5);
+        assertEquals(0, sessions.size());
+    }
+
+    @Test
+    public void testGenerateIdToken() {
+        IDToken idToken = accountClient.clientScopesEvaluate().generateExampleIdToken("openid", testUser.getId(), null);
+        assertNotNull(idToken);
+        assertNotNull(idToken.getSubject());
+        assertNotNull(idToken.getPreferredUsername());
+    }
+
+    @Test
+    public void testGenerateUserInfo() {
+        Map<String, Object> userinfo = accountClient.clientScopesEvaluate().generateExampleUserinfo("openid", testUser.getId());
+        assertFalse(userinfo.isEmpty());
+        assertNotNull(userinfo.get(IDToken.SUBJECT));
+        assertNotNull(userinfo.get(IDToken.PREFERRED_USERNAME));
+    }
+
+    @Test
+    public void testGenerateAccessTokenWithoutBasicScope() {
+        String basicScopeId = ApiUtil.findClientScopeByName(testRealmResource(),"basic").toRepresentation().getId();
+        accountClient.removeDefaultClientScope(basicScopeId);
+
+        AccessToken accessToken = accountClient.clientScopesEvaluate().generateAccessToken("openid", testUser.getId(), null);
+        assertNotNull(accessToken);
+        assertNull(accessToken.getSubject());
+
+        accountClient.addDefaultClientScope(basicScopeId);
+    }
+
+    @Test
+    public void testGenerateAccessTokenWithOptionalScope() {
+        String emailScopeId = ApiUtil.findClientScopeByName(testRealmResource(),"email").toRepresentation().getId();
+        accountClient.removeDefaultClientScope(emailScopeId);
+        accountClient.addOptionalClientScope(emailScopeId);
+
+        AccessToken accessToken = accountClient.clientScopesEvaluate().generateAccessToken("openid", testUser.getId(), null);
+        assertNotNull(accessToken);
+        assertNull(accessToken.getEmail());
+
+        accessToken = accountClient.clientScopesEvaluate().generateAccessToken("openid email", testUser.getId(), null);
+        assertNotNull(accessToken);
+        assertNotNull(accessToken.getEmail());
+
+        accountClient.removeOptionalClientScope(emailScopeId);
+        accountClient.addDefaultClientScope(emailScopeId);
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeProtocolMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeProtocolMapperTest.java
deleted file mode 100644
index f723a0a41458..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeProtocolMapperTest.java
+++ /dev/null
@@ -1,287 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import java.util.Map;
-
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.FixMethodOrder;
-import org.junit.Test;
-import org.junit.runners.MethodSorters;
-import org.keycloak.admin.client.resource.ClientScopeResource;
-import org.keycloak.admin.client.resource.ClientScopesResource;
-import org.keycloak.admin.client.resource.ProtocolMappersResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
-import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
-import org.keycloak.protocol.saml.SamlProtocol;
-import org.keycloak.representations.idm.ClientScopeRepresentation;
-import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.exportimport.ExportImportUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@FixMethodOrder(MethodSorters.NAME_ASCENDING)
-public class ClientScopeProtocolMapperTest extends AbstractProtocolMapperTest {
-
-    private String oidcClientScopeId;
-    private ProtocolMappersResource oidcMappersRsc;
-    private String samlClientScopeId;
-    private ProtocolMappersResource samlMappersRsc;
-
-    @Before
-    public void init() {
-        oidcClientScopeId = createClientScope("oidcMapperClient-scope", OIDCLoginProtocol.LOGIN_PROTOCOL);
-        oidcMappersRsc = clientScopes().get(oidcClientScopeId).getProtocolMappers();
-
-        samlClientScopeId = createClientScope("samlMapperClient-scope", SamlProtocol.LOGIN_PROTOCOL);
-        samlMappersRsc = clientScopes().get(samlClientScopeId).getProtocolMappers();
-
-        super.initBuiltinMappers();
-    }
-
-    @After
-    public void tearDown() {
-        removeClientScope(oidcClientScopeId);
-        removeClientScope(samlClientScopeId);
-    }
-
-    @Test
-    public void test01GetMappersList() {
-        assertTrue(oidcMappersRsc.getMappers().isEmpty());
-        assertTrue(samlMappersRsc.getMappers().isEmpty());
-    }
-
-    @Test
-    public void test02CreateOidcMappersFromList() {
-        testAddAllBuiltinMappers(oidcMappersRsc, "openid-connect", AdminEventPaths.clientScopeProtocolMappersPath(oidcClientScopeId));
-    }
-
-    @Test
-    public void test03CreateSamlMappersFromList() {
-        testAddAllBuiltinMappers(samlMappersRsc, "saml", AdminEventPaths.clientScopeProtocolMappersPath(samlClientScopeId));
-    }
-
-    @Test
-    public void test04CreateSamlProtocolMapper() {
-
-        //{"protocol":"saml",
-        // "config":{"role":"account.view-profile","new.role.name":"new-role-name"},
-        // "consentRequired":true,
-        // "consentText":"My consent text",
-        // "name":"saml-role-name-maper",
-        // "protocolMapper":"saml-role-name-mapper"}
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper");
-
-        int totalMappers = samlMappersRsc.getMappers().size();
-        int totalSamlMappers = samlMappersRsc.getMappersPerProtocol("saml").size();
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        assertEquals(totalMappers + 1, samlMappersRsc.getMappers().size());
-        assertEquals(totalSamlMappers + 1, samlMappersRsc.getMappersPerProtocol("saml").size());
-
-        ProtocolMapperRepresentation created = samlMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, created);
-    }
-
-    @Test
-    public void test05CreateOidcProtocolMapper() {
-        //{"protocol":"openid-connect",
-        // "config":{"role":"myrole"},
-        // "consentRequired":true,
-        // "consentText":"My consent text",
-        // "name":"oidc-hardcoded-role-mapper",
-        // "protocolMapper":"oidc-hardcoded-role-mapper"}
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper");
-
-        int totalMappers = oidcMappersRsc.getMappers().size();
-        int totalOidcMappers = oidcMappersRsc.getMappersPerProtocol("openid-connect").size();
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        assertEquals(totalMappers + 1, oidcMappersRsc.getMappers().size());
-        assertEquals(totalOidcMappers + 1, oidcMappersRsc.getMappersPerProtocol("openid-connect").size());
-
-        ProtocolMapperRepresentation created = oidcMappersRsc.getMapperById(createdId);//findByName(samlMappersRsc, "saml-role-name-mapper");
-        assertEqualMappers(rep, created);
-    }
-
-    @Test
-    public void test06UpdateSamlMapper() {
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper2");
-
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        rep.getConfig().put("role", "account.manage-account");
-        rep.setId(createdId);
-        samlMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        ProtocolMapperRepresentation updated = samlMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, updated);
-    }
-
-    @Test
-    public void test07UpdateOidcMapper() {
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper2");
-
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        rep.getConfig().put("role", "myotherrole");
-        rep.setId(createdId);
-        oidcMappersRsc.update(createdId, rep);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        ProtocolMapperRepresentation updated = oidcMappersRsc.getMapperById(createdId);
-        assertEqualMappers(rep, updated);
-    }
-
-    @Test
-    public void test08EffectiveMappers() {
-        ClientScopeResource rolesScope = ApiUtil.findClientScopeByName(testRealmResource(), "roles");
-        ProtocolMapperRepresentation audienceMapper = ExportImportUtil.findMapperByName(rolesScope.getProtocolMappers().getMappers(),
-                OIDCLoginProtocol.LOGIN_PROTOCOL, OIDCLoginProtocolFactory.AUDIENCE_RESOLVE);
-
-        String clientScopeID = rolesScope.toRepresentation().getId();
-        String protocolMapperId = audienceMapper.getId();
-        Map<String, String> origConfig = audienceMapper.getConfig();
-
-        try {
-            // Test default values available on the protocol mapper
-            Assert.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-            Assert.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-
-            // Update mapper to not contain default values
-            audienceMapper.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN);
-            audienceMapper.getConfig().remove(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION);
-            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
-
-            // Test configuration will contain "effective values", which are the default values of particular options
-            audienceMapper = rolesScope.getProtocolMappers().getMapperById(protocolMapperId);
-            Assert.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-            Assert.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-
-            // Override "includeInIntrospection"
-            audienceMapper.getConfig().put(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION, "false");
-            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
-
-            // Get mapper and check that "includeInIntrospection" is using overriden value instead of the default
-            audienceMapper = rolesScope.getProtocolMappers().getMapperById(protocolMapperId);
-            Assert.assertEquals("true", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN));
-            Assert.assertEquals("false", audienceMapper.getConfig().get(OIDCAttributeMapperHelper.INCLUDE_IN_INTROSPECTION));
-
-        } finally {
-            audienceMapper.getConfig().putAll(origConfig);
-            rolesScope.getProtocolMappers().update(protocolMapperId, audienceMapper);
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeProtocolMapperPath(clientScopeID, protocolMapperId), audienceMapper, ResourceType.PROTOCOL_MAPPER);
-
-        }
-    }
-
-    @Test
-    public void testDeleteSamlMapper() {
-        ProtocolMapperRepresentation rep = makeSamlMapper("saml-role-name-mapper3");
-
-        Response resp = samlMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        samlMappersRsc.delete(createdId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientScopeProtocolMapperPath(samlClientScopeId, createdId), ResourceType.PROTOCOL_MAPPER);
-
-        try {
-            samlMappersRsc.getMapperById(createdId);
-            Assert.fail("Not expected to find mapper");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void testDeleteOidcMapper() {
-        ProtocolMapperRepresentation rep = makeOidcMapper("oidc-hardcoded-role-mapper3");
-
-        Response resp = oidcMappersRsc.createMapper(rep);
-        resp.close();
-        String createdId = ApiUtil.getCreatedId(resp);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), rep, ResourceType.PROTOCOL_MAPPER);
-
-        oidcMappersRsc.delete(createdId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientScopeProtocolMapperPath(oidcClientScopeId, createdId), ResourceType.PROTOCOL_MAPPER);
-
-        try {
-            oidcMappersRsc.getMapperById(createdId);
-            Assert.fail("Not expected to find mapper");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-
-    private ClientScopesResource clientScopes() {
-        return testRealmResource().clientScopes();
-    }
-
-    private String createClientScope(String clientScopeName, String protocol) {
-        ClientScopeRepresentation rep = new ClientScopeRepresentation();
-        rep.setName(clientScopeName);
-        rep.setProtocol(protocol);
-        Response resp = clientScopes().create(rep);
-        Assert.assertEquals(201, resp.getStatus());
-        resp.close();
-        String scopeId = ApiUtil.getCreatedId(resp);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeResourcePath(scopeId), rep, ResourceType.CLIENT_SCOPE);
-
-        return scopeId;
-    }
-
-    private void removeClientScope(String clientScopeId) {
-        clientScopes().get(clientScopeId).remove();
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), ResourceType.CLIENT_SCOPE);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeTest.java
deleted file mode 100644
index d27344dcf499..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientScopeTest.java
+++ /dev/null
@@ -1,912 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ClientScopesResource;
-import org.keycloak.admin.client.resource.ProtocolMappersResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.RoleMappingResource;
-import org.keycloak.common.Profile;
-import org.keycloak.common.util.ObjectUtil;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.AccountRoles;
-import org.keycloak.models.ClientScopeModel;
-import org.keycloak.models.Constants;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.saml.SamlProtocol;
-import org.keycloak.representations.idm.*;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.RoleBuilder;
-import org.keycloak.util.JsonSerialization;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.Response.Status;
-import java.io.IOException;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.CoreMatchers.equalTo;
-import static org.hamcrest.CoreMatchers.nullValue;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.Assert.assertNames;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ClientScopeTest extends AbstractClientTest {
-
-    @Test
-    public void testAddFailureWithInvalidScopeName() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("マルチバイト");
-
-        ErrorRepresentation error;
-        try (Response response = clientScopes().create(scopeRep)) {
-            Assert.assertEquals(400, response.getStatus());
-            error = response.readEntity(ErrorRepresentation.class);
-        }
-
-        Assert.assertEquals("Unexpected name \"マルチバイト\" for ClientScope", error.getErrorMessage());
-    }
-
-    @Test
-    public void testUpdateFailureWithInvalidScopeName() {
-        // Creating first
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope1");
-        scopeRep.setProtocol("openid-connect");
-        String scope1Id = createClientScope(scopeRep);
-        // Assert created
-        scopeRep = clientScopes().get(scope1Id).toRepresentation();
-        Assert.assertEquals("scope1", scopeRep.getName());
-
-        // Test updating
-        scopeRep.setName("マルチバイト");
-        try {
-            clientScopes().get(scope1Id).update(scopeRep);
-        } catch (ClientErrorException e) {
-            ErrorRepresentation error;
-            try (Response response = e.getResponse()) {
-                Assert.assertEquals(400, response.getStatus());
-                error = response.readEntity(ErrorRepresentation.class);
-            }
-            Assert.assertEquals("Unexpected name \"マルチバイト\" for ClientScope", error.getErrorMessage());
-        }
-
-        removeClientScope(scope1Id);
-    }
-
-    @Test
-    public void testAddDuplicatedClientScope() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope1");
-        scopeRep.setProtocol("openid-connect");
-        String scopeId = createClientScope(scopeRep);
-
-        scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope1");
-        scopeRep.setProtocol("openid-connect");
-        Response response = clientScopes().create(scopeRep);
-        assertEquals(409, response.getStatus());
-
-        ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-        Assert.assertEquals("Client Scope scope1 already exists", error.getErrorMessage());
-
-        // Cleanup
-        removeClientScope(scopeId);
-    }
-
-
-    @Test (expected = NotFoundException.class)
-    public void testGetUnknownScope() {
-        String unknownId = UUID.randomUUID().toString();
-        clientScopes().get(unknownId).toRepresentation();
-    }
-
-
-    private List<String> getClientScopeNames(List<ClientScopeRepresentation> scopes) {
-        return scopes.stream().map((ClientScopeRepresentation clientScope) -> {
-
-            return clientScope.getName();
-
-        }).collect(Collectors.toList());
-    }
-
-    @Test
-    public void testRemoveClientScope() {
-        // Create scope1
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope1");
-        scopeRep.setProtocol("openid-connect");
-
-        String scope1Id = createClientScope(scopeRep);
-
-        List<ClientScopeRepresentation> clientScopes = clientScopes().findAll();
-        assertTrue(getClientScopeNames(clientScopes).contains("scope1"));
-
-        // Create scope2
-        scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope2");
-        scopeRep.setProtocol("openid-connect");
-
-        String scope2Id = createClientScope(scopeRep);
-
-        clientScopes = clientScopes().findAll();
-        assertTrue(getClientScopeNames(clientScopes).contains("scope2"));
-
-        // Remove scope1
-        removeClientScope(scope1Id);
-
-        clientScopes = clientScopes().findAll();
-        Assert.assertFalse(getClientScopeNames(clientScopes).contains("scope1"));
-        assertTrue(getClientScopeNames(clientScopes).contains("scope2"));
-
-
-        // Remove scope2
-        removeClientScope(scope2Id);
-
-        clientScopes = clientScopes().findAll();
-        Assert.assertFalse(getClientScopeNames(clientScopes).contains("scope1"));
-        Assert.assertFalse(getClientScopeNames(clientScopes).contains("scope2"));
-    }
-
-
-    @Test
-    public void testUpdateScopeScope() {
-        // Test creating
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope1");
-        scopeRep.setDescription("scope1-desc");
-        scopeRep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-
-        Map<String, String> attrs = new HashMap<>();
-        attrs.put("someAttr", "someAttrValue");
-        attrs.put("emptyAttr", "");
-        scopeRep.setAttributes(attrs);
-        String scope1Id = createClientScope(scopeRep);
-
-        // Assert created attributes
-        scopeRep = clientScopes().get(scope1Id).toRepresentation();
-        Assert.assertEquals("scope1", scopeRep.getName());
-        Assert.assertEquals("scope1-desc", scopeRep.getDescription());
-        Assert.assertEquals("someAttrValue", scopeRep.getAttributes().get("someAttr"));
-        assertTrue(ObjectUtil.isBlank(scopeRep.getAttributes().get("emptyAttr")));
-        Assert.assertEquals(OIDCLoginProtocol.LOGIN_PROTOCOL, scopeRep.getProtocol());
-
-
-        // Test updating
-        scopeRep.setName("scope1-updated");
-        scopeRep.setDescription("scope1-desc-updated");
-        scopeRep.setProtocol(SamlProtocol.LOGIN_PROTOCOL);
-
-        // Test update attribute to some non-blank value
-        scopeRep.getAttributes().put("emptyAttr", "someValue");
-
-        clientScopes().get(scope1Id).update(scopeRep);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientScopeResourcePath(scope1Id), scopeRep, ResourceType.CLIENT_SCOPE);
-
-        // Assert updated attributes
-        scopeRep = clientScopes().get(scope1Id).toRepresentation();
-        Assert.assertEquals("scope1-updated", scopeRep.getName());
-        Assert.assertEquals("scope1-desc-updated", scopeRep.getDescription());
-        Assert.assertEquals(SamlProtocol.LOGIN_PROTOCOL, scopeRep.getProtocol());
-        Assert.assertEquals("someAttrValue", scopeRep.getAttributes().get("someAttr"));
-        Assert.assertEquals("someValue", scopeRep.getAttributes().get("emptyAttr"));
-
-        // Remove scope1
-        clientScopes().get(scope1Id).remove();
-    }
-
-    @Test
-    public void testValidateClientScopeProtocol(){
-        org.keycloak.services.resources.admin.ClientScopeResource.validateClientScopeProtocol("saml");
-        org.keycloak.services.resources.admin.ClientScopeResource.validateClientScopeProtocol("openid-connect");
-        Assert.assertThrows(RuntimeException.class,()->org.keycloak.services.resources.admin.ClientScopeResource.validateClientScopeProtocol("other"));
-    }
-    @Test
-    public void testRenameScope() {
-        // Create two scopes
-        ClientScopeRepresentation scope1Rep = new ClientScopeRepresentation();
-        scope1Rep.setName("scope1");
-        scope1Rep.setDescription("scope1-desc");
-        scope1Rep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        createClientScope(scope1Rep);
-
-        ClientScopeRepresentation scope2Rep = new ClientScopeRepresentation();
-        scope2Rep.setName("scope2");
-        scope2Rep.setDescription("scope2-desc");
-        scope2Rep.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        String scope2Id = createClientScope(scope2Rep);
-
-        // Test updating
-        scope2Rep.setName("scope1");
-
-        try {
-            clientScopes().get(scope2Id).update(scope2Rep);
-        } catch (ClientErrorException ex) {
-            assertThat(ex.getResponse(), Matchers.statusCodeIs(Status.CONFLICT));
-        }
-    }
-
-
-    @Test
-    public void testScopes() {
-        RoleRepresentation realmCompositeRole = createRealmRole("realm-composite");
-        RoleRepresentation realmChildRole = createRealmRole("realm-child");
-        testRealmResource().roles().get("realm-composite").addComposites(Collections.singletonList(realmChildRole));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE,
-                AdminEventPaths.roleResourceCompositesPath("realm-composite"),
-                Collections.singletonList(realmChildRole), ResourceType.REALM_ROLE);
-
-        // create client scope
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("bar-scope");
-        scopeRep.setProtocol("openid-connect");
-        String scopeId = createClientScope(scopeRep);
-
-        // update with some scopes
-        String accountMgmtId =
-                testRealmResource().clients().findByClientId(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).get(0).getId();
-        RoleRepresentation viewAccountRoleRep = testRealmResource().clients().get(accountMgmtId).roles()
-                .get(AccountRoles.VIEW_PROFILE).toRepresentation();
-        RoleMappingResource scopesResource = clientScopes().get(scopeId).getScopeMappings();
-
-        scopesResource.realmLevel().add(Collections.singletonList(realmCompositeRole));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE,
-                AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId),
-                Collections.singletonList(realmCompositeRole), ResourceType.REALM_SCOPE_MAPPING);
-
-        scopesResource.clientLevel(accountMgmtId).add(Collections.singletonList(viewAccountRoleRep));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE,
-                AdminEventPaths.clientScopeRoleMappingsClientLevelPath(scopeId, accountMgmtId),
-                Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
-
-        // test that scopes are available (also through composite role)
-        List<RoleRepresentation> allRealm = scopesResource.realmLevel().listAll();
-        List<RoleRepresentation> availableRealm = scopesResource.realmLevel().listAvailable();
-        List<RoleRepresentation> effectiveRealm = scopesResource.realmLevel().listEffective();
-        List<RoleRepresentation> accountRoles = scopesResource.clientLevel(accountMgmtId).listAll();
-
-        assertNames(allRealm, "realm-composite");
-        assertNames(availableRealm, "realm-child", Constants.OFFLINE_ACCESS_ROLE, Constants.AUTHZ_UMA_AUTHORIZATION,
-                Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-        assertNames(effectiveRealm, "realm-composite", "realm-child");
-        assertNames(accountRoles, AccountRoles.VIEW_PROFILE);
-        MappingsRepresentation mappingsRep = clientScopes().get(scopeId).getScopeMappings().getAll();
-        assertNames(mappingsRep.getRealmMappings(), "realm-composite");
-        assertNames(mappingsRep.getClientMappings().get(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID).getMappings(),
-                AccountRoles.VIEW_PROFILE);
-
-
-        // remove scopes
-        scopesResource.realmLevel().remove(Collections.singletonList(realmCompositeRole));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE,
-                AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId),
-                Collections.singletonList(realmCompositeRole), ResourceType.REALM_SCOPE_MAPPING);
-
-        scopesResource.clientLevel(accountMgmtId).remove(Collections.singletonList(viewAccountRoleRep));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE,
-                AdminEventPaths.clientScopeRoleMappingsClientLevelPath(scopeId, accountMgmtId),
-                Collections.singletonList(viewAccountRoleRep), ResourceType.CLIENT_SCOPE_MAPPING);
-
-        // assert scopes are removed
-        allRealm = scopesResource.realmLevel().listAll();
-        availableRealm = scopesResource.realmLevel().listAvailable();
-        effectiveRealm = scopesResource.realmLevel().listEffective();
-        accountRoles = scopesResource.clientLevel(accountMgmtId).listAll();
-        assertNames(allRealm);
-        assertNames(availableRealm, "realm-composite", "realm-child", Constants.OFFLINE_ACCESS_ROLE,
-                Constants.AUTHZ_UMA_AUTHORIZATION,
-                Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-        assertNames(effectiveRealm);
-        assertNames(accountRoles);
-
-        // remove scope
-        removeClientScope(scopeId);
-    }
-
-    /**
-     * Test for KEYCLOAK-10603.
-     */
-    @Test
-    public void rolesCanBeAddedToScopeEvenWhenTheyAreAlreadyIndirectlyAssigned() {
-        RealmResource realm = testRealmResource();
-        ClientScopeRepresentation clientScopeRep = new ClientScopeRepresentation();
-        clientScopeRep.setName("my-scope");
-        clientScopeRep.setProtocol("openid-connect");
-
-        String clientScopeId = createClientScope(clientScopeRep);
-
-        createRealmRole("realm-composite");
-        createRealmRole("realm-child");
-        realm.roles().get("realm-composite")
-                .addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-
-        Response response = realm.clients().create(ClientBuilder.create().clientId("role-container-client").build());
-        String roleContainerClientUuid = ApiUtil.getCreatedId(response);
-        getCleanup().addClientUuid(roleContainerClientUuid);
-        response.close();
-
-        RoleRepresentation clientCompositeRole = RoleBuilder.create().name("client-composite").build();
-        realm.clients().get(roleContainerClientUuid).roles().create(clientCompositeRole);
-        realm.clients().get(roleContainerClientUuid).roles().create(RoleBuilder.create().name("client-child").build());
-        realm.clients().get(roleContainerClientUuid).roles().get("client-composite").addComposites(Collections
-                .singletonList(
-                        realm.clients().get(roleContainerClientUuid).roles().get("client-child").toRepresentation()));
-
-        // Make indirect assignments: assign composite roles
-        RoleMappingResource scopesResource = realm.clientScopes().get(clientScopeId).getScopeMappings();
-        scopesResource.realmLevel()
-                .add(Collections.singletonList(realm.roles().get("realm-composite").toRepresentation()));
-        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
-                .singletonList(realm.clients().get(roleContainerClientUuid).roles().get("client-composite")
-                        .toRepresentation()));
-
-        // check state before making the direct assignments
-        assertNames(scopesResource.realmLevel().listAll(), "realm-composite");
-        assertNames(scopesResource.realmLevel().listAvailable(), "realm-child", "offline_access",
-                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-        assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite");
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable(), "client-child");
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
-                "client-child");
-
-        // Make direct assignments for roles which are already indirectly assigned
-        scopesResource.realmLevel().add(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-        scopesResource.clientLevel(roleContainerClientUuid).add(Collections
-                .singletonList(
-                        realm.clients().get(roleContainerClientUuid).roles().get("client-child").toRepresentation()));
-
-        // List realm roles
-        assertNames(scopesResource.realmLevel().listAll(), "realm-composite", "realm-child");
-        assertNames(scopesResource.realmLevel().listAvailable(), "offline_access",
-                Constants.AUTHZ_UMA_AUTHORIZATION, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-        assertNames(scopesResource.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-        // List client roles
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAll(), "client-composite",
-                "client-child");
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listAvailable());
-        assertNames(scopesResource.clientLevel(roleContainerClientUuid).listEffective(), "client-composite",
-                "client-child");
-    }
-
-    // KEYCLOAK-2809
-    @Test
-    public void testRemoveScopedRole() {
-        // Add realm role
-        RoleRepresentation roleRep = createRealmRole("foo-role");
-
-        // Add client scope
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("bar-scope");
-        scopeRep.setProtocol("openid-connect");
-
-        String scopeId = createClientScope(scopeRep);
-
-        // Add realm role to scopes of clientScope
-        clientScopes().get(scopeId).getScopeMappings().realmLevel().add(Collections.singletonList(roleRep));
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeRoleMappingsRealmLevelPath(scopeId), Collections.singletonList(roleRep), ResourceType.REALM_SCOPE_MAPPING);
-
-        List<RoleRepresentation> roleReps = clientScopes().get(scopeId).getScopeMappings().realmLevel().listAll();
-        Assert.assertEquals(1, roleReps.size());
-        Assert.assertEquals("foo-role", roleReps.get(0).getName());
-
-        // Remove realm role
-        testRealmResource().roles().deleteRole("foo-role");
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.roleResourcePath("foo-role"), ResourceType.REALM_ROLE);
-
-        // Get scope mappings
-        roleReps = clientScopes().get(scopeId).getScopeMappings().realmLevel().listAll();
-        Assert.assertEquals(0, roleReps.size());
-
-        // Cleanup
-        removeClientScope(scopeId);
-    }
-
-    private RoleRepresentation createRealmRole(String roleName) {
-        RoleRepresentation roleRep = new RoleRepresentation();
-        roleRep.setName(roleName);
-        testRealmResource().roles().create(roleRep);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.roleResourcePath(roleName), roleRep, ResourceType.REALM_ROLE);
-
-        RoleRepresentation createdRole = testRealmResource().roles().get(roleName).toRepresentation();
-
-        getCleanup().addRoleId(createdRole.getId());
-
-        return createdRole;
-    }
-
-    @Test
-    public void testRemoveClientScopeInUse() {
-        // Add client scope
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("foo-scope");
-        scopeRep.setProtocol("openid-connect");
-        String scopeId = createClientScope(scopeRep);
-
-        // Add client with the clientScope
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("bar-client");
-        clientRep.setName("bar-client");
-        clientRep.setProtocol("openid-connect");
-        clientRep.setDefaultClientScopes(Collections.singletonList("foo-scope"));
-        String clientDbId = createClient(clientRep);
-
-        removeClientScope(scopeId);
-        removeClient(clientDbId);
-    }
-
-
-    @Test
-    public void testRealmDefaultClientScopes() {
-        // Create 2 client scopes
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-def");
-        scopeRep.setProtocol("openid-connect");
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-opt");
-        scopeRep.setProtocol("openid-connect");
-        String scopeOptId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeOptId);
-
-        // Add scope-def as default and scope-opt as optional client scope
-        testRealmResource().addDefaultDefaultClientScope(scopeDefId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
-        testRealmResource().addDefaultOptionalClientScope(scopeOptId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
-
-        // Ensure defaults and optional scopes are here
-        List<String> realmDefaultScopes = getClientScopeNames(testRealmResource().getDefaultDefaultClientScopes());
-        List<String> realmOptionalScopes = getClientScopeNames(testRealmResource().getDefaultOptionalClientScopes());
-        assertTrue(realmDefaultScopes.contains("scope-def"));
-        Assert.assertFalse(realmOptionalScopes .contains("scope-def"));
-        Assert.assertFalse(realmDefaultScopes.contains("scope-opt"));
-        assertTrue(realmOptionalScopes .contains("scope-opt"));
-
-        // create client. Ensure that it has scope-def and scope-opt scopes assigned
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("bar-client");
-        clientRep.setProtocol("openid-connect");
-        String clientUuid = createClient(clientRep);
-        getCleanup().addClientUuid(clientUuid);
-
-        List<String> clientDefaultScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getDefaultClientScopes());
-        List<String> clientOptionalScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getOptionalClientScopes());
-        assertTrue(clientDefaultScopes.contains("scope-def"));
-        Assert.assertFalse(clientOptionalScopes .contains("scope-def"));
-        Assert.assertFalse(clientDefaultScopes.contains("scope-opt"));
-        assertTrue(clientOptionalScopes .contains("scope-opt"));
-
-        // Unassign scope-def and scope-opt from realm
-        testRealmResource().removeDefaultDefaultClientScope(scopeDefId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
-        testRealmResource().removeDefaultOptionalClientScope(scopeOptId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
-
-        realmDefaultScopes = getClientScopeNames(testRealmResource().getDefaultDefaultClientScopes());
-        realmOptionalScopes = getClientScopeNames(testRealmResource().getDefaultOptionalClientScopes());
-        Assert.assertFalse(realmDefaultScopes.contains("scope-def"));
-        Assert.assertFalse(realmOptionalScopes .contains("scope-def"));
-        Assert.assertFalse(realmDefaultScopes.contains("scope-opt"));
-        Assert.assertFalse(realmOptionalScopes .contains("scope-opt"));
-
-        // Create another client. Check it doesn't have scope-def and scope-opt scopes assigned
-        clientRep = new ClientRepresentation();
-        clientRep.setClientId("bar-client-2");
-        clientRep.setProtocol("openid-connect");
-        clientUuid = createClient(clientRep);
-        getCleanup().addClientUuid(clientUuid);
-
-        clientDefaultScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getDefaultClientScopes());
-        clientOptionalScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getOptionalClientScopes());
-        Assert.assertFalse(clientDefaultScopes.contains("scope-def"));
-        Assert.assertFalse(clientOptionalScopes .contains("scope-def"));
-        Assert.assertFalse(clientDefaultScopes.contains("scope-opt"));
-        Assert.assertFalse(clientOptionalScopes .contains("scope-opt"));
-    }
-
-    // KEYCLOAK-9999
-    @Test
-    public void defaultOptionalClientScopeCanBeAssignedToClientAsDefaultScope() {
-
-        // Create optional client scope
-        ClientScopeRepresentation optionalClientScope = new ClientScopeRepresentation();
-        optionalClientScope.setName("optional-client-scope");
-        optionalClientScope.setProtocol("openid-connect");
-        String optionalClientScopeId = createClientScope(optionalClientScope);
-        getCleanup().addClientScopeId(optionalClientScopeId);
-
-        testRealmResource().addDefaultOptionalClientScope(optionalClientScopeId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(optionalClientScopeId), ResourceType.CLIENT_SCOPE);
-
-        // Ensure that scope is optional
-        List<String> realmOptionalScopes = getClientScopeNames(testRealmResource().getDefaultOptionalClientScopes());
-        assertTrue(realmOptionalScopes.contains("optional-client-scope"));
-
-        // Create client
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId("test-client");
-        client.setDefaultClientScopes(Collections.singletonList("optional-client-scope"));
-        String clientUuid = createClient(client);
-        getCleanup().addClientUuid(clientUuid);
-
-        // Ensure that default optional client scope is a default scope of the client
-        List<String> clientDefaultScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getDefaultClientScopes());
-        assertTrue(clientDefaultScopes.contains("optional-client-scope"));
-
-        // Ensure that no optional scopes are assigned to the client, even if there are default optional scopes!
-        List<String> clientOptionalScopes = getClientScopeNames(testRealmResource().clients().get(clientUuid).getOptionalClientScopes());
-        assertTrue(clientOptionalScopes.isEmpty());
-
-        // Unassign optional client scope from realm for cleanup
-        testRealmResource().removeDefaultOptionalClientScope(optionalClientScopeId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.defaultOptionalClientScopePath(optionalClientScopeId), ResourceType.CLIENT_SCOPE);
-    }
-
-    // KEYCLOAK-18332
-    @Test
-    public void scopesRemainAfterClientUpdate() {
-        // Create a bunch of scopes
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-def");
-        scopeRep.setProtocol("openid-connect");
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-opt");
-        scopeRep.setProtocol("openid-connect");
-        String scopeOptId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeOptId);
-
-        // Add scope-def as default and scope-opt as optional client scope
-        testRealmResource().addDefaultDefaultClientScope(scopeDefId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.defaultDefaultClientScopePath(scopeDefId), ResourceType.CLIENT_SCOPE);
-        testRealmResource().addDefaultOptionalClientScope(scopeOptId);
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.defaultOptionalClientScopePath(scopeOptId), ResourceType.CLIENT_SCOPE);
-
-        // Create a client
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("bar-client");
-        clientRep.setProtocol("openid-connect");
-        String clientUuid = createClient(clientRep);
-        ClientResource client = testRealmResource().clients().get(clientUuid);
-        getCleanup().addClientUuid(clientUuid);
-        assertTrue(getClientScopeNames(client.getDefaultClientScopes()).contains("scope-def"));
-        assertTrue(getClientScopeNames(client.getOptionalClientScopes()).contains("scope-opt"));
-
-        // Remove the scopes from client
-        client.removeDefaultClientScope(scopeDefId);
-        client.removeOptionalClientScope(scopeOptId);
-        List<String> expectedDefScopes = getClientScopeNames(client.getDefaultClientScopes());
-        List<String> expectedOptScopes = getClientScopeNames(client.getOptionalClientScopes());
-        assertFalse(expectedDefScopes.contains("scope-def"));
-        assertFalse(expectedOptScopes.contains("scope-opt"));
-
-        // Update the client
-        clientRep = client.toRepresentation();
-        clientRep.setDescription("desc"); // Make a small change
-        client.update(clientRep);
-
-        // Assert scopes are intact
-        assertEquals(expectedDefScopes, getClientScopeNames(client.getDefaultClientScopes()));
-        assertEquals(expectedOptScopes, getClientScopeNames(client.getOptionalClientScopes()));
-    }
-
-    // KEYCLOAK-5863
-    @Test
-    public void testUpdateProtocolMappers() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("testUpdateProtocolMappers");
-        scopeRep.setProtocol("openid-connect");
-
-
-        String scopeId = createClientScope(scopeRep);
-
-        ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
-        mapper.setName("test");
-        mapper.setProtocol("openid-connect");
-        mapper.setProtocolMapper("oidc-usermodel-attribute-mapper");
-
-        Map<String, String> m = new HashMap<>();
-        m.put("user.attribute", "test");
-        m.put("claim.name", "");
-        m.put("jsonType.label", "");
-
-        mapper.setConfig(m);
-
-        ProtocolMappersResource protocolMappers = clientScopes().get(scopeId).getProtocolMappers();
-
-        Response response = protocolMappers.createMapper(mapper);
-        String mapperId = ApiUtil.getCreatedId(response);
-
-        mapper = protocolMappers.getMapperById(mapperId);
-
-        mapper.getConfig().put("claim.name", "claim");
-
-        protocolMappers.update(mapperId, mapper);
-
-        List<ProtocolMapperRepresentation> mappers = protocolMappers.getMappers();
-        assertEquals(1, mappers.size());
-        assertEquals(2, mappers.get(0).getConfig().size());
-        assertEquals("test", mappers.get(0).getConfig().get("user.attribute"));
-        assertEquals("claim", mappers.get(0).getConfig().get("claim.name"));
-
-        clientScopes().get(scopeId).remove();
-    }
-
-    @Test
-    public void updateClientWithDefaultScopeAssignedAsOptionalAndOpposite() {
-        // create client
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("bar-client");
-        clientRep.setProtocol("openid-connect");
-        String clientUuid = createClient(clientRep);
-        getCleanup().addClientUuid(clientUuid);
-
-        // Create 2 client scopes
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-def");
-        scopeRep.setProtocol("openid-connect");
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("scope-opt");
-        scopeRep.setProtocol("openid-connect");
-        String scopeOptId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeOptId);
-
-        // assign "scope-def" as optional client scope to client
-        testRealmResource().clients().get(clientUuid).addOptionalClientScope(scopeDefId);
-
-        // assign "scope-opt" as default client scope to client
-        testRealmResource().clients().get(clientUuid).addDefaultClientScope(scopeOptId);
-
-        // Add scope-def as default and scope-opt as optional client scope within the realm
-        testRealmResource().addDefaultDefaultClientScope(scopeDefId);
-        testRealmResource().addDefaultOptionalClientScope(scopeOptId);
-
-        //update client - check it passes (it used to throw ModelDuplicateException before)
-        clientRep.setDescription("new_description");
-        testRealmResource().clients().get(clientUuid).update(clientRep);
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void testCreateValidDynamicScope() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("dynamic-scope-def");
-        scopeRep.setProtocol("openid-connect");
-        scopeRep.setAttributes(new HashMap<String, String>(){{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*");
-        }});
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        // Assert updated attributes
-        scopeRep = clientScopes().get(scopeDefId).toRepresentation();
-        assertEquals("dynamic-scope-def", scopeRep.getName());
-        assertEquals("true", scopeRep.getAttributes().get(ClientScopeModel.IS_DYNAMIC_SCOPE));
-        assertEquals("dynamic-scope-def:*", scopeRep.getAttributes().get(ClientScopeModel.DYNAMIC_SCOPE_REGEXP));
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void testCreateNonDynamicScopeWithFeatureEnabled() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("non-dynamic-scope-def");
-        scopeRep.setProtocol("openid-connect");
-        scopeRep.setAttributes(new HashMap<String, String>(){{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "false");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "");
-        }});
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        // Assert updated attributes
-        scopeRep = clientScopes().get(scopeDefId).toRepresentation();
-        assertEquals("non-dynamic-scope-def", scopeRep.getName());
-        assertEquals("false", scopeRep.getAttributes().get(ClientScopeModel.IS_DYNAMIC_SCOPE));
-        assertThat(scopeRep.getAttributes().get(ClientScopeModel.DYNAMIC_SCOPE_REGEXP), anyOf(nullValue(), equalTo("")));
-    }
-
-    @Test
-    @DisableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void testCreateDynamicScopeWithFeatureDisabledAndIsDynamicScopeTrue() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("non-dynamic-scope-def2");
-        scopeRep.setProtocol("openid-connect");
-        scopeRep.setAttributes(new HashMap<String, String>(){{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "");
-        }});
-        handleExpectedCreateFailure(scopeRep, 400, "Unexpected value \"true\" for attribute is.dynamic.scope in ClientScope");
-    }
-
-    @Test
-    @DisableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void testCreateDynamicScopeWithFeatureDisabledAndNonEmptyDynamicScopeRegexp() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("non-dynamic-scope-def3");
-        scopeRep.setProtocol("openid-connect");
-        scopeRep.setAttributes(new HashMap<String, String>(){{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "false");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "not-empty");
-        }});
-        handleExpectedCreateFailure(scopeRep, 400, "Unexpected value \"not-empty\" for attribute dynamic.scope.regexp in ClientScope");
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void testCreateInvalidRegexpDynamicScope() {
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("dynamic-scope-def4");
-        scopeRep.setProtocol("openid-connect");
-        scopeRep.setAttributes(new HashMap<String, String>(){{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*:*");
-        }});
-        handleExpectedCreateFailure(scopeRep, 400, "Invalid format for the Dynamic Scope regexp dynamic-scope-def:*:*");
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void updateAssignedDefaultClientScopeToDynamicScope() {
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("dyn-scope-client");
-        clientRep.setProtocol("openid-connect");
-        String clientUuid = createClient(clientRep);
-        getCleanup().addClientUuid(clientUuid);
-
-        ClientScopeRepresentation scopeRep = new ClientScopeRepresentation();
-        scopeRep.setName("dynamic-scope-def");
-        scopeRep.setProtocol("openid-connect");
-        String scopeDefId = createClientScope(scopeRep);
-        getCleanup().addClientScopeId(scopeDefId);
-
-        testRealmResource().clients().get(clientUuid).addDefaultClientScope(scopeDefId);
-
-        scopeRep.setAttributes(new HashMap<String, String>() {{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*:*");
-        }});
-
-        try {
-            clientScopes().get(scopeDefId).update(scopeRep);
-            Assert.fail("This update should fail");
-        } catch (ClientErrorException ex) {
-            assertThat(ex.getResponse(), Matchers.statusCodeIs(Status.BAD_REQUEST));
-        }
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    public void dynamicClientScopeCannotBeAssignedAsDefaultClientScope() {
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("dyn-scope-client");
-        clientRep.setProtocol("openid-connect");
-        String clientUuid = createClient(clientRep);
-        getCleanup().addClientUuid(clientUuid);
-
-        ClientScopeRepresentation optionalClientScope = new ClientScopeRepresentation();
-        optionalClientScope.setName("optional-dynamic-client-scope");
-        optionalClientScope.setProtocol("openid-connect");
-        optionalClientScope.setAttributes(new HashMap<String, String>() {{
-            put(ClientScopeModel.IS_DYNAMIC_SCOPE, "true");
-            put(ClientScopeModel.DYNAMIC_SCOPE_REGEXP, "dynamic-scope-def:*");
-        }});
-        String optionalClientScopeId = createClientScope(optionalClientScope);
-        getCleanup().addClientScopeId(optionalClientScopeId);
-
-        try {
-            ClientResource clientResource = testRealmResource().clients().get(clientUuid);
-            clientResource.addDefaultClientScope(optionalClientScopeId);
-            Assert.fail("A Dynamic Scope shouldn't not be assigned as a default scope to a client");
-        } catch (ClientErrorException ex) {
-            assertThat(ex.getResponse(), Matchers.statusCodeIs(Status.BAD_REQUEST));
-        }
-
-    }
-
-    @Test
-    public void deleteAllClientScopesMustFail() {
-        List<ClientScopeRepresentation> clientScopes = clientScopes().findAll();
-        for (int i = 0; i < clientScopes.size(); i++) {
-            ClientScopeRepresentation clientScope = clientScopes.get(i);
-            if (i != clientScopes.size() - 1) {
-                removeClientScope(clientScope.getId());
-            } else {
-                removeClientScopeMustFail(clientScope.getId());
-            }
-        }
-    }
-
-    private void handleExpectedCreateFailure(ClientScopeRepresentation scopeRep, int expectedErrorCode, String expectedErrorMessage) {
-        try(Response resp = clientScopes().create(scopeRep)) {
-            Assert.assertEquals(expectedErrorCode, resp.getStatus());
-            String respBody = resp.readEntity(String.class);
-            Map<String, String> responseJson = null;
-            try {
-                responseJson = JsonSerialization.readValue(respBody, Map.class);
-                Assert.assertEquals(expectedErrorMessage, responseJson.get("errorMessage"));
-            } catch (IOException e) {
-                fail("Failed to extract the errorMessage from a CreateScope Response");
-            }
-        }
-    }
-
-    private ClientScopesResource clientScopes() {
-        return testRealmResource().clientScopes();
-    }
-
-    private String createClientScope(ClientScopeRepresentation clientScopeRep) {
-        Response resp = clientScopes().create(clientScopeRep);
-        Assert.assertEquals(201, resp.getStatus());
-        resp.close();
-        String clientScopeId = ApiUtil.getCreatedId(resp);
-        getCleanup().addClientScopeId(clientScopeId);
-
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.CREATE, AdminEventPaths.clientScopeResourcePath(clientScopeId), clientScopeRep, ResourceType.CLIENT_SCOPE);
-
-        return clientScopeId;
-    }
-
-    private void removeClientScope(String clientScopeId) {
-        clientScopes().get(clientScopeId).remove();
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), ResourceType.CLIENT_SCOPE);
-    }
-
-    private void removeClientScopeMustFail(String clientScopeId) {
-        try {
-            clientScopes().get(clientScopeId).remove();
-        } catch (Exception expected) {
-
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientSearchTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientSearchTest.java
deleted file mode 100644
index 58838417f818..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ClientSearchTest.java
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import org.apache.commons.lang3.ArrayUtils;
-import org.jboss.arquillian.container.test.api.ContainerController;
-import org.jboss.arquillian.test.api.ArquillianResource;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.FixMethodOrder;
-import org.junit.Test;
-import org.junit.runners.MethodSorters;
-import org.keycloak.models.ClientProvider;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.testsuite.arquillian.containers.AbstractQuarkusDeployableContainer;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.stream.Collectors;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.containsInAnyOrder;
-
-/**
- * @author Vaclav Muzikar <vmuzikar@redhat.com>
- */
-// we need the unset test to run first
-@FixMethodOrder(MethodSorters.NAME_ASCENDING)
-public class ClientSearchTest extends AbstractClientTest {
-    @ArquillianResource
-    protected ContainerController controller;
-
-    private static final String CLIENT1 = "client1";
-    private static final String CLIENT2 = "client2";
-    private static final String CLIENT3 = "client3";
-
-    private String client1Id;
-    private String client2Id;
-    private String client3Id;
-
-    private static final String ATTR_ORG_NAME = "org";
-    private static final String ATTR_ORG_VAL = "Test_\"organisation\"";
-    private static final String ATTR_URL_NAME = "url";
-    private static final String ATTR_URL_VAL = "https://foo.bar/clflds";
-    private static final String ATTR_QUOTES_NAME = "test \"123\"";
-    private static final String ATTR_QUOTES_NAME_ESCAPED = "\"test \\\"123\\\"\"";
-    private static final String ATTR_QUOTES_VAL = "field=\"blah blah\"";
-    private static final String ATTR_QUOTES_VAL_ESCAPED = "\"field=\\\"blah blah\\\"\"";
-    private static final String ATTR_FILTERED_NAME = "filtered";
-    private static final String ATTR_FILTERED_VAL = "does_not_matter";
-
-    private static final String SEARCHABLE_ATTRS_PROP = "keycloak.client.searchableAttributes";
-
-    @Before
-    public void init() {
-        ClientRepresentation client1 = createOidcClientRep(CLIENT1);
-        ClientRepresentation client2 = createOidcClientRep(CLIENT2);
-        ClientRepresentation client3 = createOidcClientRep(CLIENT3);
-
-        client1.setAttributes(new HashMap<String, String>() {{
-            put(ATTR_ORG_NAME, ATTR_ORG_VAL);
-            put(ATTR_URL_NAME, ATTR_URL_VAL);
-        }});
-
-        client2.setAttributes(new HashMap<String, String>() {{
-            put(ATTR_URL_NAME, ATTR_URL_VAL);
-            put(ATTR_FILTERED_NAME, ATTR_FILTERED_VAL);
-        }});
-
-        client3.setAttributes(new HashMap<String, String>() {{
-            put(ATTR_ORG_NAME, "fake val");
-            put(ATTR_QUOTES_NAME, ATTR_QUOTES_VAL);
-        }});
-
-        client1Id = createClient(client1);
-        client2Id = createClient(client2);
-        client3Id = createClient(client3);
-    }
-
-    @After
-    public void teardown() {
-        removeClient(client1Id);
-        removeClient(client2Id);
-        removeClient(client3Id);
-    }
-
-    @Test
-    public void testQuerySearch() throws Exception {
-        try {
-            configureSearchableAttributes(ATTR_URL_NAME, ATTR_ORG_NAME, ATTR_QUOTES_NAME);
-            search(String.format("%s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL), CLIENT1);
-            search(String.format("%s:%s", ATTR_URL_NAME, ATTR_URL_VAL), CLIENT1, CLIENT2);
-            search(String.format("%s:%s %s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL, ATTR_URL_NAME, ATTR_URL_VAL), CLIENT1);
-            search(String.format("%s:%s %s:%s", ATTR_ORG_NAME, "wrong val", ATTR_URL_NAME, ATTR_URL_VAL));
-            search(String.format("%s:%s", ATTR_QUOTES_NAME_ESCAPED, ATTR_QUOTES_VAL_ESCAPED), CLIENT3);
-
-            // "filtered" attribute won't take effect when JPA is used
-            String[] expectedRes = isJpaStore() ? new String[]{CLIENT1, CLIENT2} : new String[]{CLIENT2};
-            search(String.format("%s:%s %s:%s", ATTR_URL_NAME, ATTR_URL_VAL, ATTR_FILTERED_NAME, ATTR_FILTERED_VAL), expectedRes);
-        }
-        finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void testJpaSearchableAttributesUnset() {
-        String[] expectedRes = {CLIENT1};
-        // JPA store removes all attributes by default, i.e. returns all clients
-        if (isJpaStore()) {
-            expectedRes = ArrayUtils.addAll(expectedRes, CLIENT2, CLIENT3, "account", "account-console", "admin-cli", "broker", "realm-management", "security-admin-console");
-        }
-
-        search(String.format("%s:%s", ATTR_ORG_NAME, ATTR_ORG_VAL), expectedRes);
-    }
-
-    private void search(String searchQuery, String... expectedClientIds) {
-        List<String> found = testRealmResource().clients().query(searchQuery).stream()
-                .map(ClientRepresentation::getClientId)
-                .collect(Collectors.toList());
-        assertThat(found, containsInAnyOrder(expectedClientIds));
-    }
-
-    void configureSearchableAttributes(String... searchableAttributes) throws Exception {
-        log.infov("Configuring searchableAttributes");
-
-        if (suiteContext.getAuthServerInfo().isUndertow()) {
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            System.setProperty(SEARCHABLE_ATTRS_PROP, String.join(",", searchableAttributes));
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else if (suiteContext.getAuthServerInfo().isQuarkus()) {
-            String s = String.join(",",searchableAttributes);
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            AbstractQuarkusDeployableContainer container = (AbstractQuarkusDeployableContainer)suiteContext.getAuthServerInfo().getArquillianContainer().getDeployableContainer();
-            container.setAdditionalBuildArgs(Collections.singletonList("--spi-client-jpa-searchable-attributes="+ s));
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else {
-            throw new RuntimeException("Don't know how to config");
-        }
-
-        reconnectAdminClient();
-    }
-
-    void resetSearchableAttributes() throws Exception {
-        log.info("Reset searchableAttributes");
-
-        if (suiteContext.getAuthServerInfo().isUndertow()) {
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            System.clearProperty(SEARCHABLE_ATTRS_PROP);
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else if (suiteContext.getAuthServerInfo().isQuarkus()) {
-            AbstractQuarkusDeployableContainer container = (AbstractQuarkusDeployableContainer) suiteContext.getAuthServerInfo().getArquillianContainer().getDeployableContainer();
-            container.setAdditionalBuildArgs(Collections.emptyList());
-            container.restartServer();
-        } else {
-            throw new RuntimeException("Don't know how to config");
-        }
-
-        reconnectAdminClient();
-    }
-
-    private boolean isJpaStore() {
-        String providerId = testingClient.server()
-                .fetchString(s -> s.getKeycloakSessionFactory().getProviderFactory(ClientProvider.class).getId());
-        log.info("Detected store: " + providerId);
-        return "\"jpa\"".equals(providerId); // there are quotes for some reason
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/CredentialsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/CredentialsTest.java
index 24ce7100852a..64cf7dcb190f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/CredentialsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/CredentialsTest.java
@@ -240,6 +240,8 @@ public void testGenerateAndDownloadKeystore() throws Exception {
         config.setKeyAlias("alias");
         config.setKeyPassword("keyPass");
         config.setStorePassword("storePass");
+        config.setKeySize(4096);
+        config.setValidity(3);
         byte[] result = certRsc.generateAndGetKeystore(config);
         KeyStore keyStore = CryptoIntegration.getProvider().getKeyStore(preferredKeystoreType);
         keyStore.load(new ByteArrayInputStream(result), "storePass".toCharArray());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/InstallationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/InstallationTest.java
deleted file mode 100644
index b9ae96adb2ae..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/InstallationTest.java
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.StringReader;
-import java.nio.charset.StandardCharsets;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.parsers.ParserConfigurationException;
-
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.protocol.saml.SamlConfigAttributes;
-import org.keycloak.protocol.saml.SamlProtocol;
-import org.keycloak.protocol.saml.installation.SamlSPDescriptorClientInstallation;
-import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.KeyUtils;
-import org.w3c.dom.Document;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.xml.sax.InputSource;
-import org.xml.sax.SAXException;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.*;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.common.Profile.Feature.AUTHORIZATION;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-import static org.keycloak.saml.common.constants.JBossSAMLURIConstants.METADATA_NSURI;
-
-/**
- * Test getting the installation/configuration files for OIDC and SAML.
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class InstallationTest extends AbstractClientTest {
-
-    private static final String OIDC_NAME = "oidcInstallationClient";
-    private static final String OIDC_NAME_BEARER_ONLY_NAME = "oidcInstallationClientBearerOnly";
-    private static final String OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME = "oidcInstallationClientBearerOnlyWithAuthz";
-    private static final String SAML_NAME = "samlInstallationClient";
-
-    private ClientResource oidcClient;
-    private String oidcClientId;
-    private ClientResource oidcBearerOnlyClient;
-    private String oidcBearerOnlyClientId;
-    private ClientResource oidcBearerOnlyClientWithAuthz;
-    private String oidcBearerOnlyClientWithAuthzId;
-    private ClientResource samlClient;
-    private String samlClientId;
-
-    @Before
-    public void createClients() {
-        oidcClientId = createOidcClient(OIDC_NAME);
-        oidcBearerOnlyClientId = createOidcBearerOnlyClient(OIDC_NAME_BEARER_ONLY_NAME);
-
-        oidcClient = findClientResource(OIDC_NAME);
-        oidcBearerOnlyClient = findClientResource(OIDC_NAME_BEARER_ONLY_NAME);
-
-        samlClientId = createSamlClient(SAML_NAME);
-        samlClient = findClientResource(SAML_NAME);
-    }
-
-    @After
-    public void tearDown() {
-        removeClient(oidcClientId);
-        removeClient(oidcBearerOnlyClientId);
-        removeClient(samlClientId);
-    }
-
-    private String authServerUrl() {
-        return getAuthServerContextRoot() + "/auth";
-    }
-
-    private String samlUrl() {
-        return authServerUrl() + "/realms/test/protocol/saml";
-    }
-
-    @Test
-    public void testOidcJBossXml() {
-        String xml = oidcClient.getInstallationProvider("keycloak-oidc-jboss-subsystem");
-        assertOidcInstallationConfig(xml);
-        assertThat(xml, containsString("<secure-deployment"));
-    }
-
-    @Test
-    public void testOidcJson() {
-        String json = oidcClient.getInstallationProvider("keycloak-oidc-keycloak-json");
-        assertOidcInstallationConfig(json);
-    }
-
-    @Test
-    public void testOidcJBossCli() {
-        String cli = oidcClient.getInstallationProvider("keycloak-oidc-jboss-subsystem-cli");
-        assertOidcInstallationConfig(cli);
-        assertThat(cli, containsString("/subsystem=keycloak/secure-deployment=\"WAR MODULE NAME.war\""));
-    }
-
-    @Test
-    public void testOidcBearerOnlyJson() {
-        String json = oidcBearerOnlyClient.getInstallationProvider("keycloak-oidc-keycloak-json");
-        assertOidcInstallationConfig(json);
-        assertThat(json, containsString("bearer-only"));
-        assertThat(json, not(containsString("public-client")));
-        assertThat(json, not(containsString("credentials")));
-        assertThat(json, not(containsString("verify-token-audience")));
-    }
-
-    @Test
-    public void testOidcBearerOnlyJsonWithAudienceClientScope() {
-        // Generate audience client scope
-        String clientScopeId = testingClient.testing().generateAudienceClientScope("test", OIDC_NAME_BEARER_ONLY_NAME);
-
-        String json = oidcBearerOnlyClient.getInstallationProvider("keycloak-oidc-keycloak-json");
-        assertOidcInstallationConfig(json);
-        assertThat(json, containsString("bearer-only"));
-        assertThat(json, not(containsString("public-client")));
-        assertThat(json, not(containsString("credentials")));
-        assertThat(json, containsString("verify-token-audience"));
-
-        // Remove clientScope
-        testRealmResource().clientScopes().get(clientScopeId).remove();
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.DELETE, AdminEventPaths.clientScopeResourcePath(clientScopeId), null, ResourceType.CLIENT_SCOPE);
-    }
-
-    @Test
-    public void testOidcBearerOnlyWithAuthzJson() {
-        ProfileAssume.assumeFeatureEnabled(AUTHORIZATION);
-
-        oidcBearerOnlyClientWithAuthzId = createOidcConfidentialClientWithAuthz(OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME);
-        oidcBearerOnlyClientWithAuthz = findClientResource(OIDC_NAME_BEARER_ONLY_WITH_AUTHZ_NAME);
-
-        String json = oidcBearerOnlyClientWithAuthz.getInstallationProvider("keycloak-oidc-keycloak-json");
-        assertOidcInstallationConfig(json);
-        assertThat(json, not(containsString("bearer-only")));
-        assertThat(json, not(containsString("public-client")));
-        assertThat(json, containsString("credentials"));
-        assertThat(json, containsString("secret"));
-        assertThat(json, containsString("policy-enforcer"));
-
-        removeClient(oidcBearerOnlyClientWithAuthzId);
-    }
-
-    private void assertOidcInstallationConfig(String config) {
-        assertThat(config, containsString("test"));
-        assertThat(config, not(containsString(KeyUtils.findActiveSigningKey(testRealmResource()).getPublicKey())));
-        assertThat(config, containsString(authServerUrl()));
-    }
-
-    @Test
-    public void testSamlMetadataIdpDescriptor() {
-        try {
-            samlClient.getInstallationProvider("saml-idp-descriptor");
-            Assert.fail("Successful saml-idp-descriptor not expected");
-        } catch (NotFoundException nfe) {
-            // Expected
-        }
-    }
-
-    @Test
-    public void testSamlAdapterXml() {
-        String xml = samlClient.getInstallationProvider("keycloak-saml");
-        assertThat(xml, containsString("<keycloak-saml-adapter>"));
-        assertThat(xml, containsString("SPECIFY YOUR entityID!"));
-        assertThat(xml, not(containsString(KeyUtils.findActiveSigningKey(testRealmResource()).getCertificate())));
-        assertThat(xml, containsString(samlUrl()));
-    }
-
-    @Test
-    public void testSamlAdapterCli() {
-        String cli = samlClient.getInstallationProvider("keycloak-saml-subsystem-cli");
-        assertThat(cli, containsString("/subsystem=keycloak-saml/secure-deployment=YOUR-WAR.war/"));
-        assertThat(cli, containsString("SPECIFY YOUR entityID!"));
-        assertThat(cli, not(containsString(KeyUtils.findActiveSigningKey(testRealmResource()).getCertificate())));
-        assertThat(cli, containsString(samlUrl()));
-    }
-
-    @Test
-    public void testSamlMetadataSpDescriptor() throws Exception {
-        String xml = samlClient.getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-        Document doc = getDocumentFromXmlString(xml);
-        assertElements(doc, METADATA_NSURI.get(), "EntityDescriptor", null);
-        assertElements(doc, METADATA_NSURI.get(), "SPSSODescriptor", null);
-        assertThat(xml, containsString(SAML_NAME));
-    }
-
-    @Test
-    public void testSamlJBossXml() {
-        String xml = samlClient.getInstallationProvider("keycloak-saml-subsystem");
-        assertThat(xml, containsString("<secure-deployment"));
-        assertThat(xml, containsString("SPECIFY YOUR entityID!"));
-        assertThat(xml, not(containsString(KeyUtils.findActiveSigningKey(testRealmResource()).getCertificate())));
-        assertThat(xml, containsString(samlUrl()));
-    }
-
-    @Test
-    public void testSamlMetadataSpDescriptorPost() throws Exception {
-        try (ClientAttributeUpdater updater = ClientAttributeUpdater.forClient(adminClient, TEST, SAML_NAME)) {
-
-            assertThat(updater.getResource().toRepresentation().getAttributes().get(SamlConfigAttributes.SAML_FORCE_POST_BINDING), equalTo("true"));
-
-            //error fallback
-            String response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            Document doc = getDocumentFromXmlString(response);
-            Map<String, String> attrNamesAndValues = new HashMap<>();
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
-            attrNamesAndValues.put("Location", "ERROR:ENDPOINT_NOT_SET");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-
-            //fallback to adminUrl
-            updater.setAdminUrl("https://admin-url").update();
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-            response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            doc = getDocumentFromXmlString(response);
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
-            attrNamesAndValues.put("Location", "https://admin-url");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-
-            //fine grained
-            updater.setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "https://saml-assertion-post-url")
-                   .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "https://saml-logout-post-url")
-                   .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "https://saml-assertion-redirect-url")
-                   .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "https://saml-logout-redirect-url")
-                   .update();
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-
-            response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            doc = getDocumentFromXmlString(response);
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
-            attrNamesAndValues.put("Location", "https://saml-logout-post-url");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get());
-            attrNamesAndValues.put("Location", "https://saml-assertion-post-url");
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-        }
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-    }
-
-    @Test
-    public void testSamlMetadataSpDescriptorRedirect() throws Exception {
-        try (ClientAttributeUpdater updater = ClientAttributeUpdater.forClient(adminClient, TEST, SAML_NAME)
-                .setAttribute(SamlConfigAttributes.SAML_FORCE_POST_BINDING, "false")
-                .update()) {
-
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-            assertThat(updater.getResource().toRepresentation().getAttributes().get(SamlConfigAttributes.SAML_FORCE_POST_BINDING), equalTo("false"));
-
-            //error fallback
-            String response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            Document doc = getDocumentFromXmlString(response);
-            Map<String, String> attrNamesAndValues = new HashMap<>();
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
-            attrNamesAndValues.put("Location", "ERROR:ENDPOINT_NOT_SET");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-
-            //fallback to adminUrl
-            updater.setAdminUrl("https://admin-url").update();
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-            response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            doc = getDocumentFromXmlString(response);
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
-            attrNamesAndValues.put("Location", "https://admin-url");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-
-            //fine grained
-            updater.setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, "https://saml-assertion-post-url")
-                   .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "https://saml-logout-post-url")
-                   .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, "https://saml-assertion-redirect-url")
-                   .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "https://saml-logout-redirect-url")
-                   .update();
-            assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-            response = updater.getResource().getInstallationProvider(SamlSPDescriptorClientInstallation.SAML_CLIENT_INSTALATION_SP_DESCRIPTOR);
-            doc = getDocumentFromXmlString(response);
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
-            attrNamesAndValues.put("Location", "https://saml-logout-redirect-url");
-            assertElements(doc, METADATA_NSURI.get(), "SingleLogoutService", attrNamesAndValues);
-            attrNamesAndValues.clear();
-            attrNamesAndValues.put("Binding", JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get());
-            attrNamesAndValues.put("Location", "https://saml-assertion-redirect-url");
-            assertElements(doc, METADATA_NSURI.get(), "AssertionConsumerService", attrNamesAndValues);
-        }
-        assertAdminEvents.assertEvent(getRealmId(), OperationType.UPDATE, AdminEventPaths.clientResourcePath(samlClientId), ResourceType.CLIENT);
-    }
-
-    @Test
-    public void testPemsInModAuthMellonExportShouldBeFormattedInRfc7468() throws IOException {
-        Response response = samlClient.getInstallationProviderAsResponse("mod-auth-mellon");
-        byte[] result = response.readEntity(byte[].class);
-
-        String clientPrivateKey = null;
-        String clientCert = null;
-        try (ZipInputStream zis = new ZipInputStream(new ByteArrayInputStream(result))) {
-            ZipEntry entry;
-            while ((entry = zis.getNextEntry()) != null) {
-                if (entry.getName().endsWith("client-private-key.pem")) {
-                    clientPrivateKey = new String(zis.readAllBytes(), StandardCharsets.US_ASCII);
-                }
-                else if (entry.getName().endsWith("client-cert.pem")) {
-                    clientCert = new String(zis.readAllBytes(), StandardCharsets.US_ASCII);
-                }
-            }
-        }
-
-        assertNotNull(clientPrivateKey);
-        assertNotNull(clientCert);
-        assertRfc7468PrivateKey(clientPrivateKey);
-        assertRfc7468Cert(clientCert);
-    }
-
-    private void assertRfc7468PrivateKey(String result) {
-        assertTrue(result.startsWith("-----BEGIN PRIVATE KEY-----"));
-        assertTrue(result.endsWith("-----END PRIVATE KEY-----"));
-        result.lines().forEach(line -> assertTrue(line.length() <= 64));
-    }
-
-    private void assertRfc7468Cert(String result) {
-        assertTrue(result.startsWith("-----BEGIN CERTIFICATE-----"));
-        assertTrue(result.endsWith("-----END CERTIFICATE-----"));
-        result.lines().forEach(line -> assertTrue(line.length() <= 64));
-    }
-
-    private Document getDocumentFromXmlString(String xml) throws SAXException, ParserConfigurationException, IOException {
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
-        DocumentBuilder db = dbf.newDocumentBuilder();
-        InputSource is = new InputSource();
-        is.setCharacterStream(new StringReader(xml));
-        return db.parse(is);
-    }
-
-    private void assertElements(Document doc, String tagNamespace, String tagName, Map<String, String> attrNamesAndValues) {
-        NodeList elementsByTagName = doc.getElementsByTagNameNS(tagNamespace, tagName);
-        assertThat("Expected exactly one " + tagName + " element!", elementsByTagName.getLength(), is(equalTo(1)));
-        Node element = elementsByTagName.item(0);
-
-        if (attrNamesAndValues != null) {
-            for (String attrName : attrNamesAndValues.keySet()) {
-                assertThat(element.getAttributes().getNamedItem(attrName).getNodeValue(), containsString(attrNamesAndValues.get(attrName)));
-            }
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ServiceAccountClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ServiceAccountClientTest.java
deleted file mode 100644
index 4b5de7263e77..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/ServiceAccountClientTest.java
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright 2024 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.client;
-
-import java.util.stream.Collectors;
-import org.hamcrest.MatcherAssert;
-import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.common.constants.ServiceAccountConstants;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.ClientScopeRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.OAuthClient;
-
-/**
- *
- * @author rmartinc
- */
-public class ServiceAccountClientTest extends AbstractClientTest {
-
-
-    @Test
-    public void testServiceAccountEnableDisable() throws Exception {
-        ClientScopeRepresentation serviceAccountScope = ApiUtil.findClientScopeByName(
-                testRealmResource(), ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE).toRepresentation();
-
-        // Create a client with service account enabled
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId("service-account-client");
-        clientRep.setProtocol("openid-connect");
-        clientRep.setSecret("password");
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-        clientRep.setClientAuthenticatorType("client-secret");
-        clientRep.setPublicClient(Boolean.FALSE);
-        String clientUuid = createClient(clientRep);
-        ClientResource client = testRealmResource().clients().get(clientUuid);
-        getCleanup().addClientUuid(clientUuid);
-        MatcherAssert.assertThat(client.getDefaultClientScopes().stream().map(ClientScopeRepresentation::getName).collect(Collectors.toList()),
-                Matchers.hasItem("service_account"));
-
-        // perform a login and check the claims are there
-        oauth.clientId("service-account-client");
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("password");
-        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
-        Assert.assertEquals("service-account-client", accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
-
-        // update the client to remove service account
-        clientRep.setServiceAccountsEnabled(Boolean.FALSE);
-        client.update(clientRep);
-        MatcherAssert.assertThat(client.getDefaultClientScopes().stream().map(ClientScopeRepresentation::getName).collect(Collectors.toList()),
-                Matchers.not(Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE)));
-        response = oauth.doClientCredentialsGrantAccessTokenRequest("password");
-        Assert.assertEquals("unauthorized_client", response.getError());
-
-        // re-enable sevice accounts
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-        client.update(clientRep);
-        MatcherAssert.assertThat(client.getDefaultClientScopes().stream().map(ClientScopeRepresentation::getName).collect(Collectors.toList()),
-                Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE));
-        response = oauth.doClientCredentialsGrantAccessTokenRequest("password");
-        accessToken = oauth.verifyToken(response.getAccessToken());
-        Assert.assertEquals("service-account-client", accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
-
-        // assign the scope as optional
-        client.removeDefaultClientScope(serviceAccountScope.getId());
-        client.addOptionalClientScope(serviceAccountScope.getId());
-
-        // re-enable service accounts, should assign the scope again as default
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-        client.update(clientRep);
-        MatcherAssert.assertThat(client.getDefaultClientScopes().stream().map(ClientScopeRepresentation::getName).collect(Collectors.toList()),
-                Matchers.hasItem(ServiceAccountConstants.SERVICE_ACCOUNT_SCOPE));
-        response = oauth.doClientCredentialsGrantAccessTokenRequest("password");
-        accessToken = oauth.verifyToken(response.getAccessToken());
-        Assert.assertEquals("service-account-client", accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ID));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_HOST));
-        Assert.assertNotNull(accessToken.getOtherClaims().get(ServiceAccountConstants.CLIENT_ADDRESS));
-
-        // remove the service account and client credentials should fail
-        UserRepresentation serviceAccountUser = client.getServiceAccountUser();
-        testRealmResource().users().delete(serviceAccountUser.getId());
-        response = oauth.doClientCredentialsGrantAccessTokenRequest("password");
-        Assert.assertEquals("invalid_request", response.getError());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/SessionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/SessionTest.java
index 0360a5103acf..19d7681b49c2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/SessionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/SessionTest.java
@@ -66,7 +66,7 @@ public void testGetAppSessionCount() {
         int sessionCount = accountClient.getApplicationSessionCount().get("count");
         assertEquals(0, sessionCount);
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(testUser);
 
         sessionCount = accountClient.getApplicationSessionCount().get("count");
@@ -83,7 +83,7 @@ public void testGetUserSessions() {
         //List<java.util.Map<String, String>> stats = this.testRealmResource().getClientSessionStats();
         ClientResource account = findClientResourceById("test-app");
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(testUser);
 
         List<UserSessionRepresentation> sessions = account.getUserSessions(0, 5);
@@ -111,7 +111,7 @@ public void testGetUserSessionsWithRememberMe() {
         realm.setRememberMe(true);
         adminClient.realm(TEST).update(realm);
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().rememberMe(true);
         loginPage.form().login(testUser);
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/AbstractConcurrencyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/AbstractConcurrencyTest.java
index bbdc78e9eda4..06c6c19699f4 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/AbstractConcurrencyTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/AbstractConcurrencyTest.java
@@ -41,6 +41,7 @@
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
+@Deprecated(forRemoval = true)
 public abstract class AbstractConcurrencyTest extends AbstractTestRealmKeycloakTest {
 
     private static final int DEFAULT_THREADS = 4;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrencyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrencyTest.java
deleted file mode 100755
index 5aa87047671d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrencyTest.java
+++ /dev/null
@@ -1,302 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.concurrency;
-
-import java.util.stream.Collectors;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ClientsResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.RolesResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.admin.client.resource.UsersResource;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.model.StoreProvider;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.stream.IntStream;
-
-import org.junit.Ignore;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class ConcurrencyTest extends AbstractConcurrencyTest {
-
-    public void concurrentTest(KeycloakRunnable... tasks) throws Throwable {
-        System.out.println("***************************");
-        long start = System.currentTimeMillis();
-        run(tasks);
-        long end = System.currentTimeMillis() - start;
-        System.out.println("took " + end + " ms");
-    }
-
-    // KEYCLOAK-8141 Verify that no attribute values are duplicated, and there are no locking exceptions when adding attributes in parallell
-    @Test
-    @Ignore
-    public void createUserAttributes() throws Throwable {
-        AtomicInteger c = new AtomicInteger();
-
-        UsersResource users = testRealm().users();
-
-        UserRepresentation u = UserBuilder.create().username("attributes").build();
-        Response response = users.create(u);
-        String userId = ApiUtil.getCreatedId(response);
-        response.close();
-
-        UserResource user = users.get(userId);
-
-        concurrentTest((threadIndex, keycloak, realm) -> {
-            UserRepresentation rep = user.toRepresentation();
-            rep.singleAttribute("a-" + c.getAndIncrement(), "value");
-            user.update(rep);
-        });
-
-        UserRepresentation rep = user.toRepresentation();
-
-        // Number of attributes should be equal to created attributes, or less (concurrent requests may drop attributes added by other threads)
-        assertTrue(rep.getAttributes().size() <= c.get());
-
-        // All attributes should have a single value
-        for (Map.Entry<String, List<String>> e : rep.getAttributes().entrySet()) {
-            assertEquals(1, e.getValue().size());
-        }
-    }
-
-
-    @Test
-    public void testAllConcurrently() throws Throwable {
-        AtomicInteger uniqueCounter = new AtomicInteger(100000);
-        concurrentTest(
-          new CreateClient(uniqueCounter),
-          new CreateRemoveClient(uniqueCounter),
-          new CreateGroup(uniqueCounter),
-          new CreateRole(uniqueCounter)
-        );
-    }
-
-    @Test
-    public void createClient() throws Throwable {
-        AtomicInteger uniqueCounter = new AtomicInteger();
-        concurrentTest(new CreateClient(uniqueCounter));
-    }
-
-    @Test
-    public void createGroup() throws Throwable {
-        AtomicInteger uniqueCounter = new AtomicInteger();
-        concurrentTest(new CreateGroup(uniqueCounter));
-    }
-
-    @Test
-    public void createRemoveClient() throws Throwable {
-        // FYI< this will fail as HSQL seems to be trying to perform table locks.
-        AtomicInteger uniqueCounter = new AtomicInteger();
-        concurrentTest(new CreateRemoveClient(uniqueCounter));
-    }
-
-    @Test
-    public void createClientRole() throws Throwable {
-        ClientRepresentation c = new ClientRepresentation();
-        c.setClientId("client");
-        Response response = adminClient.realm(REALM_NAME).clients().create(c);
-        final String clientId = ApiUtil.getCreatedId(response);
-        response.close();
-
-        AtomicInteger uniqueCounter = new AtomicInteger();
-        concurrentTest(new CreateClientRole(uniqueCounter, clientId));
-    }
-
-    @Test
-    public void createRole() throws Throwable {
-        AtomicInteger uniqueCounter = new AtomicInteger();
-        run(new CreateRole(uniqueCounter));
-    }
-
-    private class CreateClient implements KeycloakRunnable {
-
-        private final AtomicInteger clientIndex;
-
-        public CreateClient(AtomicInteger clientIndex) {
-            this.clientIndex = clientIndex;
-        }
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            String name = "c-" + clientIndex.getAndIncrement();
-            ClientRepresentation c = new ClientRepresentation();
-            c.setClientId(name);
-            Response response = realm.clients().create(c);
-            String id = ApiUtil.getCreatedId(response);
-            response.close();
-
-            c = realm.clients().get(id).toRepresentation();
-            assertNotNull(c);
-
-            int findAttempts = 1;
-            if (StoreProvider.getCurrentProvider().equals(StoreProvider.DEFAULT)) {
-                findAttempts = 5;
-            }
-            boolean clientFound = IntStream.range(0, findAttempts)
-                    .anyMatch(i -> realm.clients().findAll().stream()
-                            .map(ClientRepresentation::getClientId)
-                            .filter(Objects::nonNull)
-                            .anyMatch(name::equals));
-
-            assertTrue("Client " + name + " not found in client list after " + findAttempts + " attempts", clientFound);
-        }
-    }
-
-    private class CreateRemoveClient implements KeycloakRunnable {
-
-        private final AtomicInteger clientIndex;
-
-        public CreateRemoveClient(AtomicInteger clientIndex) {
-            this.clientIndex = clientIndex;
-        }
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            String name = "c-" + clientIndex.getAndIncrement();
-            ClientRepresentation c = new ClientRepresentation();
-            c.setClientId(name);
-            final ClientsResource clients = realm.clients();
-
-            Response response = clients.create(c);
-            String id = ApiUtil.getCreatedId(response);
-            response.close();
-            final ClientResource client = clients.get(id);
-
-            c = client.toRepresentation();
-            assertNotNull(c);
-
-            int findAttempts = 1;
-            if (StoreProvider.getCurrentProvider().equals(StoreProvider.DEFAULT)) {
-                findAttempts = 5;
-            }
-            boolean clientFound = IntStream.range(0, findAttempts)
-                    .anyMatch(i -> clients.findAll().stream()
-                            .map(ClientRepresentation::getClientId)
-                            .filter(Objects::nonNull)
-                            .anyMatch(name::equals));
-
-            assertTrue("Client " + name + " not found in client list after " + findAttempts + " attempts", clientFound);
-
-            client.remove();
-            try {
-                client.toRepresentation();
-                fail("Client " + name + " should not be found.  Should throw a 404");
-            } catch (NotFoundException e) {
-
-            }
-
-            assertFalse("Client " + name + " should now not present in client list",
-              clients.findAll().stream()
-                .map(ClientRepresentation::getClientId)
-                .filter(Objects::nonNull)
-                .anyMatch(name::equals));
-        }
-    }
-
-    private class CreateGroup implements KeycloakRunnable {
-
-        private final AtomicInteger uniqueIndex;
-
-        public CreateGroup(AtomicInteger uniqueIndex) {
-            this.uniqueIndex = uniqueIndex;
-        }
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            String name = "g-" + uniqueIndex.getAndIncrement();
-            GroupRepresentation c = new GroupRepresentation();
-            c.setName(name);
-            Response response = realm.groups().add(c);
-            String id = ApiUtil.getCreatedId(response);
-            response.close();
-
-            c = realm.groups().group(id).toRepresentation();
-            assertNotNull(c);
-
-            assertTrue("Group " + name + " [" + id + "] " + " not found in group list",
-                    realm.groups().groups().stream()
-                            .map(GroupRepresentation::getName)
-                            .filter(Objects::nonNull)
-                            .anyMatch(name::equals));
-        }
-    }
-
-    private class CreateClientRole implements KeycloakRunnable {
-
-        private final AtomicInteger uniqueCounter;
-        private final String clientId;
-
-        public CreateClientRole(AtomicInteger uniqueCounter, String clientId) {
-            this.uniqueCounter = uniqueCounter;
-            this.clientId = clientId;
-        }
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            String name = "cr-" + uniqueCounter.getAndIncrement();
-            RoleRepresentation r = new RoleRepresentation(name, null, false);
-
-            final RolesResource roles = realm.clients().get(clientId).roles();
-            roles.create(r);
-            assertNotNull(roles.get(name).toRepresentation());
-        }
-    }
-
-    private class CreateRole implements KeycloakRunnable {
-
-        private final AtomicInteger uniqueCounter;
-
-        public CreateRole(AtomicInteger uniqueCounter) {
-            this.uniqueCounter = uniqueCounter;
-        }
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            String name = "r-" + uniqueCounter.getAndIncrement();
-            RoleRepresentation r = new RoleRepresentation(name, null, false);
-
-            final RolesResource roles = realm.roles();
-            roles.create(r);
-            assertNotNull(roles.get(name).toRepresentation());
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrentLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrentLoginTest.java
index 7b38b9f83cad..8da0c0821c0b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrentLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/concurrency/ConcurrentLoginTest.java
@@ -36,7 +36,6 @@
 import org.apache.http.client.protocol.HttpClientContext;
 import org.apache.http.client.utils.URLEncodedUtils;
 import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
 import org.apache.http.impl.client.LaxRedirectStrategy;
 import org.apache.http.message.BasicNameValuePair;
 import org.apache.http.util.EntityUtils;
@@ -56,10 +55,15 @@
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.common.util.Retry;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.HttpClientUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import java.util.Arrays;
 import java.util.LinkedHashMap;
 import java.util.Random;
@@ -73,7 +77,6 @@
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
 /**
  * @author <a href="mailto:vramik@redhat.com">Vlastislav Ramik</a>
  */
@@ -136,20 +139,42 @@ public void concurrentLoginSingleUser() throws Throwable {
         }
     }
 
-    protected CloseableHttpClient getHttpsAwareClient() {
-        HttpClientBuilder builder = HttpClientBuilder.create()
-              .setRedirectStrategy(new LaxRedirectStrategy());
-        if (AUTH_SERVER_SSL_REQUIRED) {
-            builder.setSSLHostnameVerifier((s, sslSession) -> true);
+    @Test
+    public void concurrentLoginSingleUserSingleClientRehash() throws Throwable {
+        log.info("*********************************************");
+        final RealmRepresentation realmRep = testRealm().toRepresentation();
+
+        try {
+            realmRep.setPasswordPolicy("hashAlgorithm(pbkdf2-sha256)");
+            testRealm().update(realmRep);
+            // change the password of the test user to the same to force re-hashing
+            CredentialRepresentation rep = new CredentialRepresentation();
+            rep.setTemporary(Boolean.FALSE);
+            rep.setValue("password");
+            rep.setType(CredentialRepresentation.PASSWORD);
+            ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost").resetPassword(rep);
+        } finally {
+            realmRep.setPasswordPolicy("");
+            testRealm().update(realmRep);
         }
-        return builder.build();
+
+        // execute the login to re-hash in parallel
+        run(2, 10, (KeycloakRunnable) (int threadIndex, Keycloak keycloak, RealmResource realm) -> {
+            try (CloseableHttpClient httpClient = getHttpsAwareClient()) {
+                createHttpClientContextForUser(httpClient, "test-user@localhost", "password");
+            }
+        });
+    }
+
+    protected CloseableHttpClient getHttpsAwareClient() {
+        return HttpClientUtils.createDefault(LaxRedirectStrategy.INSTANCE);
     }
 
     protected HttpClientContext createHttpClientContextForUser(final CloseableHttpClient httpClient, String userName, String password) throws IOException {
         final HttpClientContext context = HttpClientContext.create();
         CookieStore cookieStore = new BasicCookieStore();
         context.setCookieStore(cookieStore);
-        HttpUriRequest request = handleLogin(getPageContent(oauth.getLoginFormUrl(), httpClient, context), userName, password);
+        HttpUriRequest request = handleLogin(getPageContent(oauth.loginForm().build(), httpClient, context), userName, password);
         assertThat(parseAndCloseResponse(httpClient.execute(request, context)), containsString("<title>AUTH_RESPONSE</title>"));
         return context;
     }
@@ -211,11 +236,11 @@ public void concurrentCodeReuseShouldFail() throws Throwable {
 
 
         for (int i=0 ; i<10 ; i++) {
-            OAuthClient oauth1 = new OAuthClient();
-            oauth1.init(driver);
-            oauth1.clientId("client0");
+            OAuthClient oauth1 = new OAuthClient(HttpClientUtils.createDefault(), driver);
+            oauth1.init();
+            oauth1.client("client0", "password");
 
-            OAuthClient.AuthorizationEndpointResponse resp = oauth1.doLogin("test-user@localhost", "password");
+            AuthorizationEndpointResponse resp = oauth1.doLogin("test-user@localhost", "password");
             String code = resp.getCode();
             Assert.assertNotNull(code);
             String codeURL = driver.getCurrentUrl();
@@ -230,7 +255,7 @@ public void concurrentCodeReuseShouldFail() throws Throwable {
                 public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
                     log.infof("Trying to execute codeURL: %s, threadIndex: %d", codeURL, threadIndex);
 
-                    OAuthClient.AccessTokenResponse resp = oauth1.doAccessTokenRequest(code, "password");
+                    AccessTokenResponse resp = oauth1.doAccessTokenRequest(code);
                     if (resp.getAccessToken() != null && resp.getError() == null) {
                         codeToTokenSuccessCount.incrementAndGet();
                     } else if (resp.getAccessToken() == null && resp.getError() != null) {
@@ -246,7 +271,7 @@ public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws
             ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost").logout();
 
             // Code should be successfully exchanged for the token at max once. In some cases (EG. Cross-DC) it may not be even successfully exchanged
-            assertThat(codeToTokenSuccessCount.get(), Matchers.lessThanOrEqualTo(1));
+            assertThat(codeToTokenSuccessCount.get(), Matchers.equalTo(1));
             assertThat(codeToTokenErrorsCount.get(), Matchers.greaterThanOrEqualTo(DEFAULT_THREADS - 1));
 
             log.infof("Iteration %d passed successfully", i);
@@ -337,12 +362,9 @@ public class LoginTask implements KeycloakRunnable {
         private final ThreadLocal<OAuthClient> oauthClient = new ThreadLocal<OAuthClient>() {
                 @Override
                 protected OAuthClient initialValue() {
-                    OAuthClient oauth1 = new OAuthClient();
-                    oauth1.init(driver);
+                    OAuthClient oauth1 = new OAuthClient(HttpClientUtils.createDefault(), driver);
 
                     // Add some randomness to state, nonce and redirectUri. Verify that login is successful and "state" and "nonce" will match
-                    oauth1.stateParamHardcoded(KeycloakModelUtils.generateId());
-                    oauth1.nonce(KeycloakModelUtils.generateId());
                     oauth1.redirectUri(oauth.getRedirectUri() + "?some=" + new Random().nextInt(1024));
                     return oauth1;
                 }
@@ -375,13 +397,16 @@ public LoginTask(CloseableHttpClient httpClient, AtomicReference<String> userSes
         public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
             int i = sameClient ? 0 : clientIndex.getAndIncrement();
             OAuthClient oauth1 = oauthClient.get();
-            oauth1.clientId("client" + i);
+            oauth1.client("client" + i, "password");
             log.infof("%d [%s]: Accessing login page for %s", threadIndex, Thread.currentThread().getName(), oauth1.getClientId());
 
+            String requestState = KeycloakModelUtils.generateId();
+            String requestNonce = KeycloakModelUtils.generateId();
+
             final HttpClientContext templateContext = clientContexts.get(i % clientContexts.size());
             final HttpClientContext context = HttpClientContext.create();
             context.setCookieStore(templateContext.getCookieStore());
-            String pageContent = getPageContent(oauth1.getLoginFormUrl(), httpClient, context);
+            String pageContent = getPageContent(oauth1.loginForm().nonce(requestNonce).state(requestState).build(), httpClient, context);
             assertThat(pageContent, Matchers.containsString("<title>AUTH_RESPONSE</title>"));
             assertThat(context.getRedirectLocations(), Matchers.notNullValue());
             assertThat(context.getRedirectLocations(), Matchers.not(Matchers.empty()));
@@ -391,13 +416,13 @@ public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws
             String code = query.get(OAuth2Constants.CODE);
             String state = query.get(OAuth2Constants.STATE);
 
-            Assert.assertEquals("Invalid state.", state, oauth1.getState());
+            Assert.assertEquals("Invalid state.", requestState, state);
 
-            AtomicReference<OAuthClient.AccessTokenResponse> accessResRef = new AtomicReference<>();
+            AtomicReference<AccessTokenResponse> accessResRef = new AtomicReference<>();
             totalInvocations.incrementAndGet();
 
             // obtain access + refresh token via code-to-token flow
-            OAuthClient.AccessTokenResponse accessRes = oauth1.doAccessTokenRequest(code, "password");
+            AccessTokenResponse accessRes = oauth1.doAccessTokenRequest(code);
             Assert.assertEquals("AccessTokenResponse: client: " + oauth1.getClientId() + ", error: '" + accessRes.getError() + "' desc: '" + accessRes.getErrorDescription() + "'",
               200, accessRes.getStatusCode());
 
@@ -408,15 +433,15 @@ public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws
             Assert.assertNull(refreshedToken.getNonce());
 
             AccessToken idToken = JsonSerialization.readValue(new JWSInput(accessRes.getIdToken()).getContent(), AccessToken.class);
-            Assert.assertEquals(oauth1.getNonce(), idToken.getNonce());
+            Assert.assertEquals(requestNonce, idToken.getNonce());
 
             accessResRef.set(accessRes);
 
             // Refresh access + refresh token using refresh token
-            AtomicReference<OAuthClient.AccessTokenResponse> refreshResRef = new AtomicReference<>();
+            AtomicReference<AccessTokenResponse> refreshResRef = new AtomicReference<>();
 
             int invocationIndex = Retry.execute(() -> {
-                OAuthClient.AccessTokenResponse refreshRes = oauth1.doRefreshTokenRequest(accessResRef.get().getRefreshToken(), "password");
+                AccessTokenResponse refreshRes = oauth1.doRefreshTokenRequest(accessResRef.get().getRefreshToken());
                 Assert.assertEquals("AccessTokenResponse: client: " + oauth1.getClientId() + ", error: '" + refreshRes.getError() + "' desc: '" + refreshRes.getErrorDescription() + "'",
                   200, refreshRes.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AbstractEventTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AbstractEventTest.java
index 5166ed4db749..d3574c9506ce 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AbstractEventTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AbstractEventTest.java
@@ -54,13 +54,6 @@ protected void saveConfig() {
         configRep = testRsc.getRealmEventsConfig();
     }
 
-    protected void enableEvents() {
-        configRep.setEventsEnabled(true);
-        configRep.setAdminEventsEnabled(Boolean.TRUE);
-
-        saveConfig();
-    }
-
     protected String realmName() {
         return testRealmResource().toRepresentation().getId();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventAuthDetailsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventAuthDetailsTest.java
deleted file mode 100644
index 9e66515ab340..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventAuthDetailsTest.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.event;
-
-import org.junit.Before;
-import org.junit.ComparisonFailure;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.Constants;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractAuthTest;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.AssertAdminEvents;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-
-import java.util.Collections;
-import java.util.List;
-import org.junit.After;
-
-import static org.keycloak.testsuite.auth.page.AuthRealm.ADMIN;
-import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * Test authDetails in admin events
- * 
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AdminEventAuthDetailsTest extends AbstractAuthTest {
-
-    @Rule
-    public AssertAdminEvents assertAdminEvents = new AssertAdminEvents(this);
-
-    private String masterAdminCliUuid;
-    private String masterAdminUserId;
-    private String masterAdminUser2Id;
-
-    private String testRealmId;
-    private String masterRealmId;
-    private String client1Uuid;
-    private String adminCliUuid;
-    private String admin1Id;
-    private String admin2Id;
-    private String appUserId;
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmBuilder realm = RealmBuilder.create().name("test").testEventListener();
-        client1Uuid = KeycloakModelUtils.generateId();
-        realm.client(ClientBuilder.create().id(client1Uuid).clientId("client1").publicClient().directAccessGrants());
-
-        admin1Id =  KeycloakModelUtils.generateId();
-        realm.user(UserBuilder.create().id(admin1Id).username("admin1").password("password").role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-
-        admin2Id =  KeycloakModelUtils.generateId();
-        realm.user(UserBuilder.create().id(admin2Id).username("admin2").password("password").role(Constants.REALM_MANAGEMENT_CLIENT_ID, AdminRoles.REALM_ADMIN));
-
-        appUserId =  KeycloakModelUtils.generateId();
-        realm.user(UserBuilder.create().id(appUserId).username("app-user").password("password"));
-
-        testRealms.add(realm.build());
-    }
-
-    @Override
-    public void importTestRealms() {
-        super.importTestRealms();
-        client1Uuid = adminClient.realm("test").clients().findByClientId("client1").get(0).getId();
-        admin1Id = adminClient.realm("test").users().search("admin1", true).get(0).getId();
-        admin2Id = adminClient.realm("test").users().search("admin2", true).get(0).getId();
-        appUserId = adminClient.realm("test").users().search("app-user", true).get(0).getId();
-    }
-
-    @Before
-    public void initConfig() {
-        RealmResource masterRealm = adminClient.realm(MASTER);
-        masterRealmId = masterRealm.toRepresentation().getId();
-        masterAdminCliUuid = ApiUtil.findClientByClientId(masterRealm, Constants.ADMIN_CLI_CLIENT_ID).toRepresentation().getId();
-        masterAdminUserId = ApiUtil.findUserByUsername(masterRealm, "admin").getId();
-        masterAdminUser2Id = ApiUtil.createUserAndResetPasswordWithAdminClient(masterRealm, UserBuilder.create().username("admin2").build(), "password");
-        masterRealm.users().get(masterAdminUser2Id).roles().realmLevel().add(Collections.singletonList(masterRealm.roles().get("admin").toRepresentation()));
-
-        RealmResource testRealm = adminClient.realm("test");
-        testRealmId = testRealm.toRepresentation().getId();
-        adminCliUuid = ApiUtil.findClientByClientId(testRealm, Constants.ADMIN_CLI_CLIENT_ID).toRepresentation().getId();
-    }
-
-    @After
-    public void cleanUp() {
-        adminClient.realm(MASTER).users().get(masterAdminUser2Id).remove();
-    }
-
-    @Test
-    public void testAuth() {
-        testClient(MASTER, ADMIN, ADMIN, Constants.ADMIN_CLI_CLIENT_ID, masterRealmId, masterAdminCliUuid, masterAdminUserId);
-        testClient(MASTER, "admin2", "password", Constants.ADMIN_CLI_CLIENT_ID, masterRealmId, masterAdminCliUuid, masterAdminUser2Id);
-
-        testClient("test", "admin1", "password", Constants.ADMIN_CLI_CLIENT_ID, testRealmId, adminCliUuid, admin1Id);
-        testClient("test", "admin2", "password", Constants.ADMIN_CLI_CLIENT_ID, testRealmId, adminCliUuid, admin2Id);
-        testClient("test", "admin1", "password", "client1", testRealmId, client1Uuid, admin1Id);
-        testClient("test", "admin2", "password", "client1", testRealmId, client1Uuid, admin2Id);
-
-        // Should fail due to different client UUID
-        try {
-            testClient("test", "admin1", "password", "client1", testRealmId, adminCliUuid, admin1Id);
-            Assert.fail("Not expected to pass");
-        } catch (ComparisonFailure expected) {
-            // expected
-        }
-
-        // Should fail due to different user ID
-        try {
-            testClient("test", "admin1", "password", "client1", testRealmId, client1Uuid, admin2Id);
-            Assert.fail("Not expected to pass");
-        } catch (ComparisonFailure expected) {
-            // expected
-        }
-
-    }
-
-    private void testClient(String realmName, String username, String password, String clientId, String expectedRealmId, String expectedClientUuid, String expectedUserId) {
-        try (Keycloak keycloak = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-                realmName, username, password, clientId, TLSUtils.initializeTLS())) {
-            UserRepresentation rep = UserBuilder.create().id(appUserId).username("app-user").email("foo@email.org").build();
-            keycloak.realm("test").users().get(appUserId).update(rep);
-
-            assertAdminEvents.expect()
-                    .realmId(testRealmId)
-                    .operationType(OperationType.UPDATE)
-                    .resourcePath(AdminEventPaths.userResourcePath(appUserId))
-                    .resourceType(ResourceType.USER)
-                    .representation(rep)
-                    .authDetails(expectedRealmId, expectedClientUuid, expectedUserId)
-                    .assertEvent();
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventTest.java
deleted file mode 100644
index d6be873c6b35..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/AdminEventTest.java
+++ /dev/null
@@ -1,335 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.event;
-
-import org.apache.commons.lang3.RandomStringUtils;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.AdminEventRepresentation;
-import org.keycloak.representations.idm.AuthDetailsRepresentation;
-import org.keycloak.representations.idm.OrganizationDomainRepresentation;
-import org.keycloak.representations.idm.OrganizationRepresentation;
-import org.keycloak.representations.idm.RealmEventsConfigRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.util.JsonSerialization;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import static org.hamcrest.Matchers.allOf;
-import static org.hamcrest.Matchers.containsString;
-import static org.hamcrest.Matchers.empty;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.greaterThan;
-import static org.hamcrest.Matchers.greaterThanOrEqualTo;
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.Matchers.notNullValue;
-import static org.hamcrest.Matchers.nullValue;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.hasSize;
-import static org.junit.Assert.assertNull;
-import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER;
-
-/**
- * Test getting and filtering admin events.
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class AdminEventTest extends AbstractEventTest {
-
-    private String masterRealmId;
-
-    @Before
-    public void initConfig() {
-        enableEvents();
-        testRealmResource().clearAdminEvents();
-        this.masterRealmId = adminClient.realm(MASTER).toRepresentation().getId();
-    }
-
-    private List<AdminEventRepresentation> events() {
-        return testRealmResource().getAdminEvents();
-    }
-
-    private String createUser(String username) {
-        UserRepresentation user = createUserRepresentation(username, username + "@foo.com", "foo", "bar", true);
-        UserBuilder.edit(user).password("password");
-        String userId = ApiUtil.createUserWithAdminClient(testRealmResource(), user);
-        getCleanup().addUserId(userId);
-        return userId;
-    }
-
-    private void updateRealm() {
-        RealmRepresentation realm = testRealmResource().toRepresentation();
-        realm.setDisplayName("Fury Road");
-        testRealmResource().update(realm);
-    }
-
-    @Test
-    public void clearAdminEventsTest() {
-        createUser("user0");
-        assertThat(events().size(), is(equalTo(1)));
-        testRealmResource().clearAdminEvents();
-        assertThat(events(), is(empty()));
-    }
-
-    @Test
-    public void adminEventAttributeTest() {
-        createUser("user5");
-        List<AdminEventRepresentation> events = events();
-        assertThat(events().size(), is(equalTo(1)));
-
-        AdminEventRepresentation event = events.get(0);
-        assertThat(event.getTime(), is(greaterThan(0L)));
-        assertThat(event.getRealmId(), is(equalTo(realmName())));
-        assertThat(event.getOperationType(), is(equalTo("CREATE")));
-        assertThat(event.getResourcePath(), is(notNullValue()));
-        assertThat(event.getError(), is(nullValue()));
-
-        AuthDetailsRepresentation details = event.getAuthDetails();
-        assertThat(details.getRealmId(), is(equalTo(masterRealmId)));
-        assertThat(details.getClientId(), is(notNullValue()));
-        assertThat(details.getUserId(), is(notNullValue()));
-        assertThat(details.getIpAddress(), is(notNullValue()));
-    }
-
-    @Test
-    public void testEventDetails() {
-        String userId = createUser("user5");
-        UserRepresentation userRep = testRealmResource().users().get(userId).toRepresentation();
-        RealmRepresentation realmRep = testRealmResource().toRepresentation();
-        realmRep.setOrganizationsEnabled(true);
-        testRealmResource().update(realmRep);
-        OrganizationRepresentation orgRep = new OrganizationRepresentation();
-        orgRep.setName("test-org");
-        orgRep.setAlias(orgRep.getName());
-        orgRep.addDomain(new OrganizationDomainRepresentation(orgRep.getName()));
-        testRealmResource().organizations().create(orgRep).close();
-        orgRep = testRealmResource().organizations().list(-1, -1).get(0);
-        testRealmResource().organizations().get(orgRep.getId()).members().addMember(userId).close();
-        List<AdminEventRepresentation> events = events();
-        assertThat(events().size(), is(equalTo(4)));
-
-        AdminEventRepresentation event = events.get(0);
-        assertThat(event.getRealmId(), is(equalTo(realmName())));
-        assertThat(event.getOperationType(), is(equalTo("CREATE")));
-        assertThat(event.getResourceType(), is(equalTo(ResourceType.ORGANIZATION_MEMBERSHIP.name())));
-        assertThat(event.getDetails(), is(equalTo(Map.of(UserModel.USERNAME, userRep.getUsername(), UserModel.EMAIL, userRep.getEmail()))));
-    }
-
-    @Test
-    public void retrieveAdminEventTest() {
-        createUser("user1");
-        List<AdminEventRepresentation> events = events();
-
-        assertThat(events.size(), is(equalTo(1)));
-        AdminEventRepresentation event = events().get(0);
-        assertThat(event.getOperationType(), is(equalTo("CREATE")));
-
-        assertThat(event.getRealmId(), is(equalTo(realmName())));
-        assertThat(event.getAuthDetails().getRealmId(), is(equalTo(masterRealmId)));
-        assertThat(event.getRepresentation(), is(nullValue()));
-    }
-
-    @Test
-    public void testGetRepresentation() {
-        configRep.setAdminEventsDetailsEnabled(Boolean.TRUE);
-        saveConfig();
-
-        createUser("user2");
-        AdminEventRepresentation event = events().stream()
-                .filter(adminEventRep -> adminEventRep.getOperationType().equals("CREATE"))
-                .findFirst()
-                .orElseThrow(() -> new IllegalStateException("Wasn't able to obtain CREATE admin event."));
-        assertThat(event.getRepresentation(), is(notNullValue()));
-        assertThat(event.getRepresentation(), allOf(containsString("foo"), containsString("bar")));
-    }
-
-    @Test
-    public void testFilterAdminEvents() {
-        // two CREATE and one UPDATE
-        createUser("user3");
-        createUser("user4");
-        updateRealm();
-        assertThat(events().size(), is(equalTo(3)));
-
-        List<AdminEventRepresentation> events = testRealmResource().getAdminEvents(Arrays.asList("CREATE"), null, null, null, null, null, null, null, null, null);
-        assertThat(events.size(), is(equalTo(2)));
-    }
-
-    @Test
-    public void defaultMaxResults() {
-        RealmResource realm = adminClient.realms().realm("test");
-        AdminEventRepresentation event = new AdminEventRepresentation();
-        event.setOperationType(OperationType.CREATE.toString());
-        event.setAuthDetails(new AuthDetailsRepresentation());
-        event.setRealmId(realm.toRepresentation().getId());
-
-        for (int i = 0; i < 110; i++) {
-            testingClient.testing("test").onAdminEvent(event, false);
-        }
-
-        assertThat(realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null).size(), is(equalTo(100)));
-        assertThat(realm.getAdminEvents(null, null, null, null, null, null, null, null, 0, 105).size(), is(equalTo(105)));
-        assertThat(realm.getAdminEvents(null, null, null, null, null, null, null, null, 0, 1000).size(), is(greaterThanOrEqualTo(110)));
-    }
-
-    @Test
-    public void adminEventRepresentationLenght() {
-        RealmResource realm = adminClient.realms().realm("test");
-        AdminEventRepresentation event = new AdminEventRepresentation();
-        event.setOperationType(OperationType.CREATE.toString());
-        event.setAuthDetails(new AuthDetailsRepresentation());
-        event.setRealmId(realm.toRepresentation().getId());
-        String longValue = RandomStringUtils.random(30000, true, true);
-        event.setRepresentation(longValue);
-
-        testingClient.testing("test").onAdminEvent(event, true);
-        List<AdminEventRepresentation> adminEvents = realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null);
-
-        assertThat(adminEvents, hasSize(1));
-        assertThat(adminEvents.get(0).getRepresentation(), equalTo(longValue));
-    }
-
-    @Test
-    public void orderResultsTest() {
-        RealmResource realm = adminClient.realms().realm("test");
-        AdminEventRepresentation firstEvent = new AdminEventRepresentation();
-        firstEvent.setOperationType(OperationType.CREATE.toString());
-        firstEvent.setAuthDetails(new AuthDetailsRepresentation());
-        firstEvent.setRealmId(realm.toRepresentation().getId());
-        firstEvent.setTime(System.currentTimeMillis() - 1000);
-
-        AdminEventRepresentation secondEvent = new AdminEventRepresentation();
-        secondEvent.setOperationType(OperationType.DELETE.toString());
-        secondEvent.setAuthDetails(new AuthDetailsRepresentation());
-        secondEvent.setRealmId(realm.toRepresentation().getId());
-        secondEvent.setTime(System.currentTimeMillis());
-
-        testingClient.testing("test").onAdminEvent(firstEvent, false);
-        testingClient.testing("test").onAdminEvent(secondEvent, false);
-
-        List<AdminEventRepresentation> adminEvents = realm.getAdminEvents(null, null, null, null, null, null, null, null, null, null);
-        assertThat(adminEvents.size(), is(equalTo(2)));
-        assertThat(adminEvents.get(0).getOperationType(), is(equalTo(OperationType.DELETE.toString())));
-        assertThat(adminEvents.get(1).getOperationType(), is(equalTo(OperationType.CREATE.toString())));
-    }
-
-
-    private void checkUpdateRealmEventsConfigEvent(int size) {
-        List<AdminEventRepresentation> events = events();
-        assertThat(events.size(), is(equalTo(size)));
-
-        AdminEventRepresentation event = events().get(0);
-        assertThat(event.getOperationType(), is(equalTo("UPDATE")));
-        assertThat(event.getRealmId(), is(equalTo(realmName())));
-        assertThat(event.getResourcePath(), is(equalTo("events/config")));
-        assertThat(event.getAuthDetails().getRealmId(), is(equalTo(masterRealmId)));
-        assertThat(event.getRepresentation(), is(notNullValue()));
-    }
-
-    @Test
-    public void updateRealmEventsConfig() {
-        // change from OFF to ON should be stored
-        configRep.setAdminEventsDetailsEnabled(Boolean.TRUE);
-        configRep.setAdminEventsEnabled(Boolean.TRUE);
-        saveConfig();
-        checkUpdateRealmEventsConfigEvent(1);
-
-        // any other change should be store too
-        configRep.setEventsEnabled(Boolean.TRUE);
-        saveConfig();
-        checkUpdateRealmEventsConfigEvent(2);
-
-        // change from ON to OFF should be stored too
-        configRep.setAdminEventsEnabled(Boolean.FALSE);
-        saveConfig();
-        checkUpdateRealmEventsConfigEvent(3);
-
-        // another change should not be stored cos it was OFF already
-        configRep.setAdminEventsDetailsEnabled(Boolean.FALSE);
-        saveConfig();
-        assertThat(events().size(), is(equalTo(3)));
-    }
-
-    @Test
-    public void createAndDeleteRealm() {
-        // Enable admin events on "master" realm, since realm create/delete events will be stored in realm of
-        // the authenticated user who executes the operations (admin in master realm),
-        RealmResource master = adminClient.realm(MASTER);
-        RealmEventsConfigRepresentation masterConfig = master.getRealmEventsConfig();
-        masterConfig.setAdminEventsDetailsEnabled(true);
-        masterConfig.setAdminEventsEnabled(true);
-        master.updateRealmEventsConfig(masterConfig);
-        master.clearAdminEvents();
-
-        // Create realm.
-        RealmRepresentation realm = new RealmRepresentation();
-        realm.setId("test-realm");
-        realm.setRealm("test-realm");
-        importRealm(realm);
-
-        // Delete realm.
-        removeRealm("test-realm");
-
-        // Check that events were logged.
-        List<AdminEventRepresentation> events = master.getAdminEvents();
-        assertThat(events.size(), is(equalTo(2)));
-
-        AdminEventRepresentation createEvent = events.get(1);
-        assertThat(createEvent.getOperationType(), is(equalTo("CREATE")));
-        assertThat(createEvent.getRealmId(), is(equalTo(masterRealmId)));
-        assertThat(createEvent.getResourceType(), is(equalTo("REALM")));
-        assertThat(createEvent.getResourcePath(), is(equalTo("test-realm")));
-        assertThat(createEvent.getRepresentation(), is(notNullValue()));
-
-        AdminEventRepresentation deleteEvent = events.get(0);
-        assertThat(deleteEvent.getOperationType(), is(equalTo("DELETE")));
-        assertThat(deleteEvent.getRealmId(), is(equalTo(masterRealmId)));
-        assertThat(deleteEvent.getResourceType(), is(equalTo("REALM")));
-        assertThat(deleteEvent.getResourcePath(), is(equalTo("test-realm")));
-    }
-
-    @Test
-    public void testStripOutUserSensitiveData() throws IOException {
-        configRep.setAdminEventsDetailsEnabled(Boolean.TRUE);
-        configRep.setAdminEventsEnabled(Boolean.TRUE);
-        saveConfig();
-
-        UserResource user = testRealmResource().users().get(createUser("sensitive"));
-        List<AdminEventRepresentation> events = events();
-        UserRepresentation eventUserRep = JsonSerialization.readValue(events.get(0).getRepresentation(), UserRepresentation.class);
-        assertNull(eventUserRep.getCredentials());
-
-        UserRepresentation userRep = user.toRepresentation();
-        UserBuilder.edit(userRep).password("password");
-        user.update(userRep);
-        events = events();
-        eventUserRep = JsonSerialization.readValue(events.get(0).getRepresentation(), UserRepresentation.class);
-        assertNull(eventUserRep.getCredentials());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/EventConfigTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/EventConfigTest.java
deleted file mode 100644
index c3077dd2b95d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/EventConfigTest.java
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.event;
-
-import org.junit.Test;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-
-/**
- * Test updates to the events configuration.
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class EventConfigTest extends AbstractEventTest {
-
-    @Test
-    public void defaultEventConfigTest() {
-        assertFalse(configRep.isAdminEventsDetailsEnabled());
-        assertFalse(configRep.isAdminEventsEnabled());
-        assertFalse(configRep.isEventsEnabled());
-
-        List<String> eventListeners = configRep.getEventsListeners();
-        assertEquals(1, eventListeners.size());
-        assertEquals("jboss-logging", eventListeners.get(0));
-    }
-
-    @Test
-    public void enableEventsTest() {
-        enableEvents();
-
-        assertTrue(configRep.isEventsEnabled());
-        assertTrue(configRep.isAdminEventsEnabled());
-    }
-
-    @Test
-    public void addRemoveListenerTest() {
-        configRep.setEventsListeners(Collections.EMPTY_LIST);
-        saveConfig();
-        assertEquals(0, configRep.getEventsListeners().size());
-
-        configRep.setEventsListeners(Arrays.asList("email"));
-        saveConfig();
-        List<String> eventListeners = configRep.getEventsListeners();
-        assertEquals(1, eventListeners.size());
-        assertEquals("email", eventListeners.get(0));
-    }
-
-    @Test
-    public void loginEventSettingsTest() {
-        enableEvents();
-
-        assertTrue(hasEventType("LOGIN"));
-        assertTrue(hasEventType("LOGOUT"));
-        assertTrue(hasEventType("CLIENT_DELETE_ERROR"));
-
-        int defaultEventCount = configRep.getEnabledEventTypes().size();
-
-        configRep.setEnabledEventTypes(Arrays.asList("CLIENT_DELETE", "CLIENT_DELETE_ERROR"));
-        saveConfig();
-
-        List<String> enabledEventTypes = configRep.getEnabledEventTypes();
-        assertEquals(2, enabledEventTypes.size());
-
-        // remove all event types
-        configRep.setEnabledEventTypes(Collections.EMPTY_LIST);
-        saveConfig();
-
-        // removing all event types restores default events
-        assertEquals(defaultEventCount, configRep.getEnabledEventTypes().size());
-    }
-
-    private boolean hasEventType(String eventType) {
-        for (String event : configRep.getEnabledEventTypes()) {
-            if (eventType.equals(event)) return true;
-        }
-
-        return false;
-    }
-
-    @Test
-    public void includeRepresentationTest() {
-        enableEvents();
-
-        assertTrue(configRep.isAdminEventsEnabled());
-        assertFalse(configRep.isAdminEventsDetailsEnabled());
-
-        configRep.setAdminEventsDetailsEnabled(Boolean.TRUE);
-        saveConfig();
-
-        assertTrue(configRep.isAdminEventsDetailsEnabled());
-    }
-
-    @Test
-    public void setLoginEventExpirationTest() {
-        enableEvents();
-
-        assertNull(configRep.getEventsExpiration());
-
-        Long oneHour = 3600L;
-        configRep.setEventsExpiration(oneHour);
-        saveConfig();
-
-        assertEquals(oneHour, configRep.getEventsExpiration());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/LoginEventsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/LoginEventsTest.java
deleted file mode 100644
index 0b19b53427b4..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/event/LoginEventsTest.java
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-
-package org.keycloak.testsuite.admin.event;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.events.EventType;
-import org.keycloak.representations.idm.EventRepresentation;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-/**
- * Test getting and filtering login-related events.
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class LoginEventsTest extends AbstractEventTest {
-
-    @Before
-    public void init() {
-        configRep.setEventsEnabled(true);
-        saveConfig();
-        testRealmResource().clearEvents();
-        createAppClientInRealm(testRealmResource().toRepresentation().getRealm());
-    }
-
-    private List<EventRepresentation> events() {
-        return testRealmResource().getEvents();
-    }
-
-    private void badLogin() {
-        oauth.openLoginForm();
-        loginPage.form().login("bad", "user");
-    }
-
-    private void pause(int seconds) {
-        try {
-            Thread.sleep(seconds * 1000L);
-        } catch (InterruptedException e) {
-            fail(e.getMessage());
-        }
-    }
-
-    @Test
-    public void eventAttributesTest() {
-        badLogin();
-        List<EventRepresentation> events = events();
-        assertEquals(1, events.size());
-        EventRepresentation event = events.get(0);
-        assertTrue(event.getTime() > 0);
-        assertNotNull(event.getIpAddress());
-        assertEquals("LOGIN_ERROR", event.getType());
-        assertEquals(realmName(), event.getRealmId());
-        assertNull(event.getUserId()); // no user for bad login
-        assertNull(event.getSessionId()); // no session for bad login
-        assertEquals("user_not_found", event.getError());
-
-        Map<String, String> details = event.getDetails();
-        assertEquals("openid-connect", details.get("auth_method"));
-        assertEquals("code", details.get("auth_type"));
-        assertNotNull(details.get("redirect_uri"));
-        assertNotNull(details.get("code_id"));
-        assertEquals("bad", details.get("username"));
-    }
-
-    @Test
-    public void clearEventsTest() {
-        assertEquals(0, events().size());
-        badLogin();
-        badLogin();
-        assertEquals(2, events().size());
-        testRealmResource().clearEvents();
-        assertEquals(0, events().size());
-    }
-
-    @Test
-    public void loggingOfCertainTypeTest() {
-        assertEquals(0, events().size());
-        configRep.setEnabledEventTypes(Arrays.asList("REVOKE_GRANT"));
-        saveConfig();
-
-        badLogin();
-        assertEquals(0, events().size());
-
-        configRep.setEnabledEventTypes(Arrays.asList("LOGIN_ERROR"));
-        saveConfig();
-
-        badLogin();
-        assertEquals(1, events().size());
-    }
-
-    @Test
-    public void filterTest() {
-        badLogin();
-        badLogin();
-        assertEquals(2, events().size());
-
-        List<EventRepresentation> filteredEvents = testRealmResource().getEvents(Arrays.asList("REVOKE_GRANT"), null, null, null, null, null, null, null);
-        assertEquals(0, filteredEvents.size());
-
-        filteredEvents = testRealmResource().getEvents(Arrays.asList("LOGIN_ERROR"), null, null, null, null, null, null, null);
-        assertEquals(2, filteredEvents.size());
-    }
-
-    @Test
-    public void defaultMaxResults() {
-        RealmResource realm = adminClient.realms().realm("test");
-        EventRepresentation event = new EventRepresentation();
-        event.setRealmId(realm.toRepresentation().getId());
-        event.setType(EventType.LOGIN.toString());
-
-        for (int i = 0; i < 110; i++) {
-            testingClient.testing("test").onEvent(event);
-        }
-
-        assertEquals(100, realm.getEvents(null, null, null, null, null, null, null, null).size());
-        assertEquals(105, realm.getEvents(null, null, null, null, null, null, 0, 105).size());
-        assertTrue(realm.getEvents(null, null, null, null, null, null, 0, 1000).size() >= 110);
-    }
-
-    @Test
-    public void orderResultsTest() {
-        RealmResource realm = adminClient.realms().realm("test");
-        EventRepresentation firstEvent = new EventRepresentation();
-        firstEvent.setRealmId(realm.toRepresentation().getId());
-        firstEvent.setType(EventType.LOGIN.toString());
-        firstEvent.setTime(System.currentTimeMillis() - 1000);
-
-        EventRepresentation secondEvent = new EventRepresentation();
-        secondEvent.setRealmId(realm.toRepresentation().getId());
-        secondEvent.setType(EventType.LOGOUT.toString());
-        secondEvent.setTime(System.currentTimeMillis());
-
-
-        testingClient.testing("test").onEvent(firstEvent);
-        testingClient.testing("test").onEvent(secondEvent);
-
-        List<EventRepresentation> events = realm.getEvents(null, null, null, null, null, null, null, null);
-        assertEquals(2, events.size());
-        assertEquals(EventType.LOGOUT.toString(), events.get(0).getType());
-        assertEquals(EventType.LOGIN.toString(), events.get(1).getType());
-
-    }
-
-    @Test
-    public void testErrorEventsAreNotStoredWhenDisabled() {
-        configRep.setEventsEnabled(false);
-        saveConfig();
-
-        badLogin();
-        assertEquals(0, events().size());
-    }
-
-    /*
-    Removed this test because it takes too long.  The default interval for
-    event cleanup is 15 minutes (900 seconds).  I don't have time to figure out
-    a way to set the cleanup thread to a lower interval for testing.
-    @Test
-    public void eventExpirationTest() {
-        configRep.setEventsExpiration(1L); //  second
-        saveConfig();
-        badLogin();
-        assertEquals(1, events().size());
-        pause(900); // pause 900 seconds
-        assertEquals(0, events().size());
-    }**/
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/AbstractGroupTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/AbstractGroupTest.java
deleted file mode 100644
index 27b5e152cbfe..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/AbstractGroupTest.java
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.group;
-
-import jakarta.ws.rs.core.Response;
-import org.junit.Rule;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.RSATokenVerifier;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.util.PemUtils;
-import org.keycloak.events.Details;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.RefreshToken;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.AssertAdminEvents;
-import org.keycloak.testsuite.util.KeyUtils;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
-
-import java.security.PublicKey;
-import java.util.List;
-
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.utils.io.IOUtil.loadRealm;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public abstract class AbstractGroupTest extends AbstractKeycloakTest {
-
-    protected String testRealmId;
-
-    @Rule
-    public AssertEvents events = new AssertEvents(this);
-
-    @Rule
-    public AssertAdminEvents assertAdminEvents = new AssertAdminEvents(this);
-
-    @Override
-    public void beforeAbstractKeycloakTest() throws Exception {
-        super.beforeAbstractKeycloakTest();
-        this.testRealmId = adminClient.realm(TEST).toRepresentation().getId();
-    }
-
-    AccessToken login(String login, String clientId, String clientSecret, String userId) throws Exception {
-        AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("test", login, "password", null, clientId, clientSecret);
-
-        String accessToken = tokenResponse.getAccessToken();
-        String refreshToken = tokenResponse.getRefreshToken();
-
-        PublicKey publicKey = PemUtils.decodePublicKey(KeyUtils.findActiveSigningKey(adminClient.realm("test")).getPublicKey());
-
-        AccessToken accessTokenRepresentation = RSATokenVerifier.verifyToken(accessToken, publicKey, getAuthServerContextRoot() + "/auth/realms/test");
-
-        JWSInput jws = new JWSInput(refreshToken);
-        RefreshToken refreshTokenRepresentation = jws.readJsonContent(RefreshToken.class);
-
-        events.expectLogin()
-                .client(clientId)
-                .user(userId)
-                .detail(Details.GRANT_TYPE, OAuth2Constants.PASSWORD)
-                .detail(Details.TOKEN_ID, accessTokenRepresentation.getId())
-                .detail(Details.REFRESH_TOKEN_ID, refreshTokenRepresentation.getId())
-                .detail(Details.USERNAME, login)
-                .removeDetail(Details.CODE_ID)
-                .removeDetail(Details.REDIRECT_URI)
-                .removeDetail(Details.CONSENT)
-                .assertEvent();
-
-        return accessTokenRepresentation;
-    }
-
-    RealmRepresentation loadTestRealm(List<RealmRepresentation> testRealms) {
-        RealmRepresentation result = loadRealm("/testrealm.json");
-        testRealms.add(result);
-        return result;
-    }
-
-    GroupRepresentation createGroup(RealmResource realm, GroupRepresentation group) {
-        try (Response response = realm.groups().add(group)) {
-            String groupId = ApiUtil.getCreatedId(response);
-            getCleanup().addGroupId(groupId);
-
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupPath(groupId), group, ResourceType.GROUP);
-
-            // Set ID to the original rep
-            group.setId(groupId);
-            return group;
-        }
-    }
-
-    void addSubGroup(RealmResource realm, GroupRepresentation parent, GroupRepresentation child) {
-        Response response = realm.groups().add(child);
-        child.setId(ApiUtil.getCreatedId(response));
-        response = realm.groups().group(parent.getId()).subGroup(child);
-        response.close();
-    }
-
-    RoleRepresentation createRealmRole(RealmResource realm, RoleRepresentation role) {
-        realm.roles().create(role);
-
-        RoleRepresentation created = realm.roles().get(role.getName()).toRepresentation();
-        getCleanup().addRoleId(created.getId());
-        return created;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupMappersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupMappersTest.java
deleted file mode 100644
index d178846f972d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupMappersTest.java
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.group;
-
-import jakarta.ws.rs.core.Response;
-import java.util.*;
-import org.hamcrest.MatcherAssert;
-import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ProtocolMappersResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.models.GroupProvider;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.protocol.ProtocolMapperUtils;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.mappers.GroupMembershipMapper;
-import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
-import org.keycloak.protocol.oidc.mappers.UserAttributeMapper;
-import org.keycloak.provider.ProviderConfigProperty;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.ProtocolMapperRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.ProtocolMapperUtil;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class GroupMappersTest extends AbstractGroupTest {
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmRepresentation testRealmRep = loadTestRealm(testRealms);
-
-        testRealmRep.setEventsEnabled(true);
-
-        ClientRepresentation client = getClientByAlias(testRealmRep, "test-app");
-        Assert.assertNotNull("test-app client exists", client);
-
-        client.setDirectAccessGrantsEnabled(true);
-
-        List<ProtocolMapperRepresentation> mappers = new LinkedList<>();
-        ProtocolMapperRepresentation mapper = new ProtocolMapperRepresentation();
-        mapper.setName("groups");
-        mapper.setProtocolMapper(GroupMembershipMapper.PROVIDER_ID);
-        mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        Map<String, String> config = new HashMap<>();
-        config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, "groups.groups");
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
-        mapper.setConfig(config);
-        mappers.add(mapper);
-
-        mapper = new ProtocolMapperRepresentation();
-        mapper.setName("topAttribute");
-        mapper.setProtocolMapper(UserAttributeMapper.PROVIDER_ID);
-        mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        config = new HashMap<>();
-        config.put(ProtocolMapperUtils.USER_ATTRIBUTE, "topAttribute");
-        config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, "topAttribute");
-        config.put(OIDCAttributeMapperHelper.JSON_TYPE, ProviderConfigProperty.STRING_TYPE);
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
-        mapper.setConfig(config);
-        mappers.add(mapper);
-
-        mapper = new ProtocolMapperRepresentation();
-        mapper.setName("level2Attribute");
-        mapper.setProtocolMapper(UserAttributeMapper.PROVIDER_ID);
-        mapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        config = new HashMap<>();
-        config.put(ProtocolMapperUtils.USER_ATTRIBUTE, "level2Attribute");
-        config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, "level2Attribute");
-        config.put(OIDCAttributeMapperHelper.JSON_TYPE, ProviderConfigProperty.STRING_TYPE);
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
-        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ID_TOKEN, "true");
-        mapper.setConfig(config);
-        mappers.add(mapper);
-
-        client.setProtocolMappers(mappers);
-    }
-
-    private ClientRepresentation getClientByAlias(RealmRepresentation testRealmRep, String alias) {
-        for (ClientRepresentation client: testRealmRep.getClients()) {
-            if (alias.equals(client.getClientId())) {
-                return client;
-            }
-        }
-        return null;
-    }
-
-    @Test
-    @SuppressWarnings("unchecked")
-    public void testGroupMappers() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-        {
-            UserRepresentation user = realm.users().search("topGroupUser", -1, -1).get(0);
-
-            AccessToken token = login(user.getUsername(), "test-app", "password", user.getId());
-            Assert.assertTrue(token.getRealmAccess().getRoles().contains("user"));
-            Assert.assertNotNull(token.getOtherClaims().get("groups"));
-            Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
-            MatcherAssert.assertThat(groups.get("groups"), Matchers.contains("topGroup"));
-            Assert.assertEquals("true", token.getOtherClaims().get("topAttribute"));
-        }
-        {
-            UserRepresentation user = realm.users().search("level2GroupUser", -1, -1).get(0);
-
-            AccessToken token = login(user.getUsername(), "test-app", "password", user.getId());
-            Assert.assertTrue(token.getRealmAccess().getRoles().contains("user"));
-            Assert.assertTrue(token.getRealmAccess().getRoles().contains("admin"));
-            Assert.assertTrue(token.getResourceAccess("test-app").getRoles().contains("customer-user"));
-            Assert.assertNotNull(token.getOtherClaims().get("groups"));
-            Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
-            MatcherAssert.assertThat(groups.get("groups"), Matchers.contains("level2group"));
-            Assert.assertEquals("true", token.getOtherClaims().get("topAttribute"));
-            Assert.assertEquals("true", token.getOtherClaims().get("level2Attribute"));
-        }
-    }
-
-    @Test
-    public void testGroupMappersWithSlash() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-        GroupRepresentation topGroup = realm.getGroupByPath("/topGroup");
-        Assert.assertNotNull(topGroup);
-        GroupRepresentation childSlash = new GroupRepresentation();
-        childSlash.setName("child/slash");
-        try (Response response = realm.groups().group(topGroup.getId()).subGroup(childSlash)) {
-            Assert.assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
-            childSlash.setId(ApiUtil.getCreatedId(response));
-        }
-        List<UserRepresentation> users = realm.users().search("level2GroupUser", true);
-        Assert.assertEquals(1, users.size());
-        UserRepresentation user = users.iterator().next();
-        realm.users().get(user.getId()).joinGroup(childSlash.getId());
-
-        ProtocolMappersResource protocolMappers = ApiUtil.findClientResourceByClientId(realm, "test-app").getProtocolMappers();
-        ProtocolMapperRepresentation groupsMapper = ProtocolMapperUtil.getMapperByNameAndProtocol(
-                protocolMappers, OIDCLoginProtocol.LOGIN_PROTOCOL, "groups");
-        groupsMapper.getConfig().put("full.path", Boolean.TRUE.toString());
-        protocolMappers.update(groupsMapper.getId(), groupsMapper);
-
-        try {
-            AccessToken token = login(user.getUsername(), "test-app", "password", user.getId());
-            Assert.assertNotNull(token.getOtherClaims().get("groups"));
-            Map<String, Collection<String>> groups = (Map<String, Collection<String>>) token.getOtherClaims().get("groups");
-            MatcherAssert.assertThat(groups.get("groups"), Matchers.containsInAnyOrder(
-                    KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, "topGroup", "level2group"),
-                    KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, "topGroup", "child/slash")));
-        } finally {
-            realm.users().get(user.getId()).leaveGroup(childSlash.getId());
-            realm.groups().group(childSlash.getId()).remove();
-            groupsMapper.getConfig().remove("full.path");
-            protocolMappers.update(groupsMapper.getId(), groupsMapper);
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupSearchTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupSearchTest.java
deleted file mode 100644
index c3f1baf226e7..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupSearchTest.java
+++ /dev/null
@@ -1,352 +0,0 @@
-package org.keycloak.testsuite.admin.group;
-
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.CoreMatchers.not;
-import static org.hamcrest.CoreMatchers.nullValue;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.anEmptyMap;
-import static org.hamcrest.Matchers.containsInAnyOrder;
-import static org.hamcrest.Matchers.empty;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.hasSize;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-import org.jboss.arquillian.container.test.api.ContainerController;
-import org.jboss.arquillian.test.api.ArquillianResource;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.GroupResource;
-import org.keycloak.admin.client.resource.GroupsResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.models.GroupProvider;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.arquillian.containers.AbstractQuarkusDeployableContainer;
-import org.keycloak.testsuite.updaters.Creator;
-
-public class GroupSearchTest extends AbstractGroupTest {
-    @ArquillianResource
-    protected ContainerController controller;
-
-    private static final String GROUP1 = "group1";
-    private static final String GROUP2 = "group2";
-    private static final String GROUP3 = "group3";
-
-    private static final String PARENT_GROUP = "parentGroup";
-
-    private static final String CHILD_GROUP = "childGroup";
-
-    private static final String ATTR_ORG_NAME = "org";
-    private static final String ATTR_ORG_VAL = "Test_\"organisation\"";
-    private static final String ATTR_URL_NAME = "url";
-    private static final String ATTR_URL_VAL = "https://foo.bar/clflds";
-    private static final String ATTR_FILTERED_NAME = "filtered";
-    private static final String ATTR_FILTERED_VAL = "does_not_matter";
-
-    private static final String ATTR_QUOTES_NAME = "test \"123\"";
-
-    private static final String ATTR_QUOTES_NAME_ESCAPED = "\"test \\\"123\\\"\"";
-    private static final String ATTR_QUOTES_VAL = "field=\"blah blah\"";
-    private static final String ATTR_QUOTES_VAL_ESCAPED = "\"field=\\\"blah blah\\\"\"";
-
-    private static final String SEARCHABLE_ATTRS_PROP = "keycloak.group.searchableAttributes";
-
-    GroupRepresentation group1;
-    GroupRepresentation group2;
-    GroupRepresentation group3;
-    GroupRepresentation parentGroup;
-    GroupRepresentation childGroup;
-    GroupRepresentation secondChildGroup;
-
-    @Before
-    public void init() {
-        group1 = new GroupRepresentation();
-        group2 = new GroupRepresentation();
-        group3 = new GroupRepresentation();
-        parentGroup = new GroupRepresentation();
-        childGroup = new GroupRepresentation();
-        secondChildGroup = new GroupRepresentation();
-
-        group1.setAttributes(new HashMap<>() {{
-            put(ATTR_ORG_NAME, Collections.singletonList(ATTR_ORG_VAL));
-            put(ATTR_URL_NAME, Collections.singletonList(ATTR_URL_VAL));
-        }});
-
-        group2.setAttributes(new HashMap<>() {{
-            put(ATTR_FILTERED_NAME, Collections.singletonList(ATTR_FILTERED_VAL));
-            put(ATTR_URL_NAME, Collections.singletonList(ATTR_URL_VAL));
-        }});
-
-        group3.setAttributes(new HashMap<>() {{
-            put(ATTR_ORG_NAME, Collections.singletonList("fake group"));
-            put(ATTR_QUOTES_NAME, Collections.singletonList(ATTR_QUOTES_VAL));
-        }});
-
-        parentGroup.setAttributes(new HashMap<>() {{
-            put(ATTR_ORG_NAME, Collections.singletonList("parentOrg"));
-        }});
-
-        childGroup.setAttributes(new HashMap<>() {{
-            put(ATTR_ORG_NAME, Collections.singletonList("childOrg"));
-        }});
-
-        group1.setName(GROUP1);
-        group2.setName(GROUP2);
-        group3.setName(GROUP3);
-        parentGroup.setName(PARENT_GROUP);
-        childGroup.setName(CHILD_GROUP);
-        secondChildGroup.setName(CHILD_GROUP + "2");
-    }
-
-    public RealmResource testRealmResource() {
-        return adminClient.realm(TEST);
-    }
-
-    @Test
-    public void querySearch() throws Exception {
-        configureSearchableAttributes();
-        try (Creator<GroupResource> groupCreator1 = Creator.create(testRealmResource(), group1);
-             Creator<GroupResource> groupCreator2 = Creator.create(testRealmResource(), group2);
-             Creator<GroupResource> groupCreator3 = Creator.create(testRealmResource(), group3)) {
-            search(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL), GROUP1);
-            search(buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL), GROUP1, GROUP2);
-            search(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL, ATTR_URL_NAME, ATTR_URL_VAL),
-                    GROUP1);
-            search(buildSearchQuery(ATTR_ORG_NAME, "wrong val", ATTR_URL_NAME, ATTR_URL_VAL));
-            search(buildSearchQuery(ATTR_QUOTES_NAME_ESCAPED, ATTR_QUOTES_VAL_ESCAPED), GROUP3);
-
-            // "filtered" attribute won't take effect when JPA is used
-            search(buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL, ATTR_FILTERED_NAME, ATTR_FILTERED_VAL), new String[]{GROUP1, GROUP2});
-        } finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void nestedGroupQuerySearch() throws Exception {
-        configureSearchableAttributes();
-        try (Creator<GroupResource> parentGroupCreator = Creator.create(testRealmResource(), parentGroup)) {
-            parentGroupCreator.resource().subGroup(childGroup);
-            // query for the child group by org name
-            GroupsResource search = testRealmResource().groups();
-            String searchQuery = buildSearchQuery(ATTR_ORG_NAME, "childOrg");
-            List<GroupRepresentation> found = search.query(searchQuery);
-
-            assertThat(found.size(), is(1));
-            assertThat(found.get(0).getName(), is(equalTo(PARENT_GROUP)));
-
-            List<GroupRepresentation> subGroups = found.get(0).getSubGroups();
-            assertThat(subGroups.size(), is(1));
-            assertThat(subGroups.get(0).getName(), is(equalTo(CHILD_GROUP)));
-        } finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void nestedGroupQuerySearchNoHierarchy() throws Exception {
-        configureSearchableAttributes();
-        try (Creator<GroupResource> parentGroupCreator = Creator.create(testRealmResource(), parentGroup)) {
-            parentGroupCreator.resource().subGroup(childGroup);
-
-            GroupRepresentation testGroup = new GroupRepresentation();
-            testGroup.setName("test_child");
-            parentGroupCreator.resource().subGroup(testGroup);
-
-            // query for the child group by org name
-            GroupsResource search = testRealmResource().groups();
-            String searchQuery = buildSearchQuery(ATTR_ORG_NAME, "childOrg");
-            List<GroupRepresentation> found = search.query(searchQuery, false);
-
-            assertThat(found.size(), is(1));
-            assertThat(found.get(0).getName(), is(equalTo(CHILD_GROUP)));
-
-            String path = found.get(0).getPath();
-            assertThat(path, is(String.format("/%s/%s", PARENT_GROUP, CHILD_GROUP)));
-        } finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void queryPaging() throws Exception {
-        configureSearchableAttributes();
-        try (Creator<GroupResource> group1Creator = Creator.create(testRealmResource(), group1);
-             Creator<GroupResource> group2Creator = Creator.create(testRealmResource(), group2)) {
-            String searchQuery = buildSearchQuery(ATTR_URL_NAME, ATTR_URL_VAL);
-
-            List<GroupRepresentation> firstPage = testRealmResource().groups()
-                    .query(searchQuery, true, 0, 1, true);
-            assertThat(firstPage, hasSize(1));
-            GroupRepresentation firstGroup = firstPage.get(0);
-            assertThat(firstGroup.getName(), is(equalTo(GROUP1)));
-
-            List<GroupRepresentation> secondPage = testRealmResource().groups()
-                    .query(searchQuery, true, 1, 1, true);
-            assertThat(secondPage, hasSize(1));
-            GroupRepresentation secondGroup = secondPage.get(0);
-            assertThat(secondGroup.getName(), is(equalTo(GROUP2)));
-
-            List<GroupRepresentation> thirdPage = testRealmResource().groups()
-                    .query(searchQuery, true, 2, 1, true);
-            assertThat(thirdPage, is(empty()));
-        } finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void queryFullRepresentation() throws Exception {
-        configureSearchableAttributes();
-        try (Creator<GroupResource> group1Creator = Creator.create(testRealmResource(), group1)) {
-            List<GroupRepresentation> found = testRealmResource().groups()
-                    .query(buildSearchQuery(ATTR_ORG_NAME, ATTR_ORG_VAL), true, 0, 100, false);
-
-            assertThat(found, hasSize(1));
-            GroupRepresentation group = found.get(0);
-            assertThat(group.getName(), is(equalTo(GROUP1)));
-            // attributes are not contained in group representation, only in full representation
-            assertThat(group.getAttributes(), is(equalTo(group1.getAttributes())));
-        } finally {
-            resetSearchableAttributes();
-        }
-    }
-
-    @Test
-    public void querySubGroups() {
-        // create a parent group with a few subgroups.
-        try (Creator<GroupResource> parentGroupCreator = Creator.create(testRealmResource(), parentGroup)) {
-            for (int i = 1; i <= 5; i++) {
-                GroupRepresentation testGroup = new GroupRepresentation();
-                testGroup.setName("kcgroup-" + i);
-                testGroup.setAttributes(new HashMap<>() {{
-                    put(ATTR_ORG_NAME, Collections.singletonList("keycloak org"));
-                    put(ATTR_QUOTES_NAME, Collections.singletonList(ATTR_QUOTES_VAL));
-                }});
-                parentGroupCreator.resource().subGroup(testGroup);
-            }
-            for (int i = 1; i <= 3; i++) {
-                GroupRepresentation testGroup = new GroupRepresentation();
-                testGroup.setName("testgroup-" + i);
-                parentGroupCreator.resource().subGroup(testGroup);
-            }
-
-            // search for subgroups filtering by name - all groups with 'kc' in the name.
-            List<GroupRepresentation> subGroups = parentGroupCreator.resource().getSubGroups("kc", false, 0, 10, true);
-            assertThat(subGroups, hasSize(5));
-            for (int i = 1; i <= 5; i++) {
-                // subgroups should be ordered by name.
-                assertThat(subGroups.get(i-1).getName(), is(equalTo("kcgroup-" + i)));
-                assertThat(subGroups.get(i-1).getAttributes(), is(nullValue())); // brief rep - no attributes should be returned in subgroups.
-            }
-
-            // search for subgroups filtering by name - all groups with 'test' in the name.
-            subGroups = parentGroupCreator.resource().getSubGroups("test", false, 0, 10, true);
-            assertThat(subGroups, hasSize(3));
-            for (int i = 1; i <= 3; i++) {
-                assertThat(subGroups.get(i-1).getName(), is(equalTo("testgroup-" + i)));
-            }
-
-            // search for subgroups filtering by name - all groups with 'gro' in the name.
-            subGroups = parentGroupCreator.resource().getSubGroups("gro", false, 0, 10, true);
-            assertThat(subGroups, hasSize(8));
-
-            // search using a string that matches none of the subgroups.
-            subGroups = parentGroupCreator.resource().getSubGroups("nonexistent", false, 0, 10, false);
-            assertThat(subGroups, is(empty()));
-
-            // exact search with full representation - only one subgroup should be returned.
-            subGroups = parentGroupCreator.resource().getSubGroups("kcgroup-2", true, 0, 10, false);
-            assertThat(subGroups, hasSize(1));
-            assertThat(subGroups.get(0).getName(), is(equalTo("kcgroup-2")));
-            // attributes should be present in the returned subgroup.
-            Map<String, List<String>> attributes = subGroups.get(0).getAttributes();
-            assertThat(attributes, not(anEmptyMap()));
-            assertThat(attributes.keySet(), hasSize(2));
-            assertThat(attributes.keySet(), containsInAnyOrder(ATTR_ORG_NAME, ATTR_QUOTES_NAME));
-        }
-    }
-
-    private void search(String searchQuery, String... expectedGroupIds) {
-        GroupsResource search = testRealmResource().groups();
-        List<String> found = search.query(searchQuery).stream()
-                .map(GroupRepresentation::getName)
-                .collect(Collectors.toList());
-        assertThat(found, hasSize(expectedGroupIds.length));
-        assertThat(found, containsInAnyOrder(expectedGroupIds));
-    }
-
-    void configureSearchableAttributes() throws Exception {
-        String[] searchableAttributes = new String[]{ATTR_URL_NAME, ATTR_ORG_NAME, ATTR_QUOTES_NAME};
-        log.infov("Configuring searchableAttributes");
-        if (suiteContext.getAuthServerInfo().isUndertow()) {
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            System.setProperty(SEARCHABLE_ATTRS_PROP, String.join(",", searchableAttributes));
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else if (suiteContext.getAuthServerInfo().isQuarkus()) {
-            String s = String.join(",", searchableAttributes);
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            AbstractQuarkusDeployableContainer container = (AbstractQuarkusDeployableContainer) suiteContext.getAuthServerInfo().getArquillianContainer().getDeployableContainer();
-            container.setAdditionalBuildArgs(
-                    Collections.singletonList("--spi-group-jpa-searchable-attributes=" + s));
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else {
-            throw new RuntimeException("Don't know how to config");
-        }
-        reconnectAdminClient();
-    }
-
-    void resetSearchableAttributes() throws Exception {
-        log.info("Reset searchableAttributes");
-
-        if (suiteContext.getAuthServerInfo().isUndertow()) {
-            controller.stop(suiteContext.getAuthServerInfo().getQualifier());
-            System.clearProperty(SEARCHABLE_ATTRS_PROP);
-            controller.start(suiteContext.getAuthServerInfo().getQualifier());
-        } else if (suiteContext.getAuthServerInfo().isQuarkus()) {
-            AbstractQuarkusDeployableContainer container = (AbstractQuarkusDeployableContainer) suiteContext.getAuthServerInfo().getArquillianContainer().getDeployableContainer();
-            container.setAdditionalBuildArgs(Collections.emptyList());
-            container.restartServer();
-        } else {
-            throw new RuntimeException("Don't know how to config");
-        }
-        reconnectAdminClient();
-    }
-
-    public static String buildSearchQuery(String firstAttrName, String firstAttrValue, String... furtherAttrKeysAndValues) {
-        if (furtherAttrKeysAndValues.length % 2 != 0) {
-            throw new IllegalArgumentException("Invalid length of furtherAttrKeysAndValues. Must be even, but is: " + furtherAttrKeysAndValues.length);
-        }
-
-        String keyValueSep = ":";
-        String attributesSep = " ";
-
-        StringBuilder sb = new StringBuilder();
-        sb.append(firstAttrName).append(keyValueSep).append(firstAttrValue);
-
-        if (furtherAttrKeysAndValues.length != 0) {
-            for (int i = 0; i < furtherAttrKeysAndValues.length; i++) {
-                if (i % 2 == 0) {
-                    sb.append(attributesSep);
-                } else {
-                    sb.append(keyValueSep);
-                }
-
-                sb.append(furtherAttrKeysAndValues[i]);
-            }
-        }
-
-        return sb.toString();
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        loadTestRealm(testRealmReps);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupTest.java
deleted file mode 100755
index 17879f683adb..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/group/GroupTest.java
+++ /dev/null
@@ -1,1439 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.admin.group;
-
-import com.google.common.collect.Comparators;
-import org.hamcrest.Matchers;
-import org.junit.Assert;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.GroupResource;
-import org.keycloak.admin.client.resource.GroupsResource;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.RoleMappingResource;
-import org.keycloak.admin.client.resource.UserProfileResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.admin.client.resource.UsersResource;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.events.admin.ResourceType;
-import org.keycloak.models.Constants;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.CredentialRepresentation;
-import org.keycloak.representations.idm.ErrorRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.MappingsRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.userprofile.config.UPConfig;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
-import org.keycloak.testsuite.updaters.Creator;
-import org.keycloak.testsuite.util.AdminEventPaths;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.RoleBuilder;
-import org.keycloak.testsuite.util.URLAssert;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.utils.tls.TLSUtils;
-import org.keycloak.util.JsonSerialization;
-
-import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.Response;
-import java.io.IOException;
-import java.net.URI;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
-import java.util.stream.Collectors;
-
-import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.Response.Status;
-import static org.hamcrest.Matchers.*;
-
-import org.junit.Rule;
-import org.junit.rules.ExpectedException;
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.models.AdminRoles;
-import org.keycloak.models.GroupModel;
-import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.RealmModel;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import org.keycloak.models.GroupProvider;
-import static org.keycloak.testsuite.Assert.assertNames;
-import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
-
-import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
-import org.keycloak.testsuite.auth.page.AuthRealm;
-import org.keycloak.testsuite.runonserver.RunOnServerException;
-import org.keycloak.testsuite.util.GroupBuilder;
-
-/**
- * @author <a href="mailto:mstrukel@redhat.com">Marko Strukelj</a>
- */
-public class GroupTest extends AbstractGroupTest {
-
-    @Rule
-    public ExpectedException expectedException = ExpectedException.none();
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmRepresentation testRealmRep = loadTestRealm(testRealms);
-
-        testRealmRep.setEventsEnabled(true);
-
-        List<UserRepresentation> users = testRealmRep.getUsers();
-
-        UserRepresentation user = new UserRepresentation();
-        user.setUsername("direct-login");
-        user.setEmail("direct-login@localhost");
-        user.setEnabled(true);
-        List<CredentialRepresentation> credentials = new LinkedList<>();
-        CredentialRepresentation credential = new CredentialRepresentation();
-        credential.setType(CredentialRepresentation.PASSWORD);
-        credential.setValue("password");
-        credentials.add(credential);
-        user.setCredentials(credentials);
-        users.add(user);
-
-        List<ClientRepresentation> clients = testRealmRep.getClients();
-
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId("resource-owner");
-        client.setDirectAccessGrantsEnabled(true);
-        client.setSecret("secret");
-        clients.add(client);
-    }
-
-    /**
-     * KEYCLOAK-2716
-     * @throws Exception
-     */
-    @Test
-    public void testClientRemoveWithClientRoleGroupMapping() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId("foo");
-        client.setRootUrl("http://foo");
-        client.setProtocol("openid-connect");
-        Response response = realm.clients().create(client);
-        response.close();
-        String clientUuid = ApiUtil.getCreatedId(response);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.clientResourcePath(clientUuid), client, ResourceType.CLIENT);
-        client = realm.clients().findByClientId("foo").get(0);
-
-        RoleRepresentation role = new RoleRepresentation();
-        role.setName("foo-role");
-        realm.clients().get(client.getId()).roles().create(role);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.clientRoleResourcePath(clientUuid, "foo-role"), role, ResourceType.CLIENT_ROLE);
-        role = realm.clients().get(client.getId()).roles().get("foo-role").toRepresentation();
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("2716");
-        group = createGroup(realm, group);
-
-        List<RoleRepresentation> list = new LinkedList<>();
-        list.add(role);
-        realm.groups().group(group.getId()).roles().clientLevel(client.getId()).add(list);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientUuid), list, ResourceType.CLIENT_ROLE_MAPPING);
-
-        realm.clients().get(client.getId()).remove();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.clientResourcePath(clientUuid), ResourceType.CLIENT);
-    }
-
-    @Test
-    // KEYCLOAK-16888 Error messages for groups with same name in the same level
-    public void doNotAllowSameGroupNameAtSameLevel() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation topGroup = new GroupRepresentation();
-        topGroup.setName("top");
-        topGroup = createGroup(realm, topGroup);
-
-        GroupRepresentation anotherTopGroup = new GroupRepresentation();
-        anotherTopGroup.setName("top");
-        Response response = realm.groups().add(anotherTopGroup);
-        assertSameNameNotAllowed(response,"Top level group named 'top' already exists.");
-        response.close();
-
-        // allow moving the group to top level (nothing is done)
-        response = realm.groups().add(topGroup);
-        assertEquals(Response.Status.NO_CONTENT, response.getStatusInfo());
-        response.close();
-
-        GroupRepresentation level2Group = new GroupRepresentation();
-        level2Group.setName("level2");
-        response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
-        assertEquals(201, response.getStatus()); // created status
-        level2Group.setId(ApiUtil.getCreatedId(response));
-        response.close();
-
-        GroupRepresentation anotherlevel2Group = new GroupRepresentation();
-        anotherlevel2Group.setName("level2");
-        response = realm.groups().group(topGroup.getId()).subGroup(anotherlevel2Group);
-        assertSameNameNotAllowed(response,"Sibling group named 'level2' already exists.");
-        response.close();
-
-        // allow moving the group to the same parent (nothing is done)
-        response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
-        assertEquals(Response.Status.NO_CONTENT, response.getStatusInfo());
-        response.close();
-    }
-
-    @Test
-    // KEYCLOAK-11412 Unintended Groups with same names
-    public void doNotAllowSameGroupNameAtSameLevelWhenUpdatingName() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation topGroup = new GroupRepresentation();
-        topGroup.setName("top1");
-        topGroup = createGroup(realm, topGroup);
-
-        GroupRepresentation anotherTopGroup = new GroupRepresentation();
-        anotherTopGroup.setName("top2");
-        anotherTopGroup = createGroup(realm, anotherTopGroup);
-
-        anotherTopGroup.setName("top1");
-
-        try {
-            realm.groups().group(anotherTopGroup.getId()).update(anotherTopGroup);
-            Assert.fail("Expected ClientErrorException");
-        } catch (ClientErrorException e) {
-            // conflict status 409 - same name not allowed
-            assertSameNameNotAllowed(e.getResponse(),"Sibling group named 'top1' already exists.");
-        }
-
-        GroupRepresentation level2Group = new GroupRepresentation();
-        level2Group.setName("level2-1");
-        addSubGroup(realm, topGroup, level2Group);
-
-        GroupRepresentation anotherlevel2Group = new GroupRepresentation();
-        anotherlevel2Group.setName("level2-2");
-        addSubGroup(realm, topGroup, anotherlevel2Group);
-
-        anotherlevel2Group.setName("level2-1");
-
-        try {
-            realm.groups().group(anotherlevel2Group.getId()).update(anotherlevel2Group);
-            Assert.fail("Expected ClientErrorException");
-        } catch (ClientErrorException e) {
-            // conflict status 409 - same name not allowed
-            assertSameNameNotAllowed(e.getResponse(),"Sibling group named 'level2-1' already exists.");
-        }
-    }
-
-    @Test
-    public void allowSameGroupNameAtDifferentLevel() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        // creating "/test-group"
-        GroupRepresentation topGroup = new GroupRepresentation();
-        topGroup.setName("test-group");
-        topGroup = createGroup(realm, topGroup);
-        getCleanup().addGroupId(topGroup.getId());
-
-        // creating "/test-group/test-group"
-        GroupRepresentation childGroup = new GroupRepresentation();
-        childGroup.setName("test-group");
-        try (Response response = realm.groups().group(topGroup.getId()).subGroup(childGroup)) {
-            assertEquals(201, response.getStatus());
-            getCleanup().addGroupId(ApiUtil.getCreatedId(response));
-        }
-
-        assertNotNull(realm.getGroupByPath("/test-group/test-group"));
-    }
-
-    @Test
-    public void doNotAllowSameGroupNameAtTopLevel() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        // creating "/test-group"
-        GroupRepresentation topGroup = new GroupRepresentation();
-        topGroup.setName("test-group");
-        topGroup = createGroup(realm, topGroup);
-        getCleanup().addGroupId(topGroup.getId());
-
-        GroupRepresentation group2 = new GroupRepresentation();
-        group2.setName("test-group");
-        try (Response response = realm.groups().add(group2)) {
-            assertEquals(Status.CONFLICT.getStatusCode(), response.getStatus());
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void doNotAllowSameGroupNameAtTopLevelInDatabase() throws Exception {
-        final String id = testingClient.server().fetch(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            GroupModel g = realm.createGroup("test-group");
-            return g.getId();
-        }, String.class);
-        getCleanup().addGroupId(id);
-        // unique key should work even in top groups
-        expectedException.expect(RunOnServerException.class);
-        expectedException.expectMessage(ModelDuplicateException.class.getName());
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            GroupModel g = realm.createGroup("test-group");
-            realm.removeGroup(g);
-        });
-    }
-
-
-    // KEYCLOAK-17581
-    @Test
-    public void createGroupWithEmptyNameShouldFail() {
-
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("");
-        try (Response response = realm.groups().add(group)){
-            if (response.getStatus() != 400) {
-                Assert.fail("Creating a group with empty name should fail");
-            }
-        } catch (Exception expected) {
-            assertNotNull(expected);
-        }
-
-        group.setName(null);
-        try (Response response = realm.groups().add(group)){
-            if (response.getStatus() != 400) {
-                Assert.fail("Creating a group with null name should fail");
-            }
-        } catch (Exception expected) {
-            assertNotNull(expected);
-        }
-    }
-
-    // KEYCLOAK-17581
-    @Test
-    public void updatingGroupWithEmptyNameShouldFail() {
-
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("groupWithName");
-
-        String groupId = null;
-        try (Response response = realm.groups().add(group)) {
-            groupId = ApiUtil.getCreatedId(response);
-        }
-
-        try {
-            group.setName("");
-            realm.groups().group(groupId).update(group);
-            Assert.fail("Updating a group with empty name should fail");
-        } catch(Exception expected) {
-            assertNotNull(expected);
-        }
-
-        try {
-            group.setName(null);
-            realm.groups().group(groupId).update(group);
-            Assert.fail("Updating a group with null name should fail");
-        } catch(Exception expected) {
-            assertNotNull(expected);
-        }
-    }
-
-    @Test
-    public void createAndTestGroups() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-        RoleRepresentation topRole = createRealmRole(realm, RoleBuilder.create().name("topRole").build());
-        RoleRepresentation level2Role = createRealmRole(realm, RoleBuilder.create().name("level2Role").build());
-        RoleRepresentation level3Role = createRealmRole(realm, RoleBuilder.create().name("level3Role").build());
-
-        // Role events tested elsewhere
-        assertAdminEvents.clear();
-
-        GroupRepresentation topGroup = new GroupRepresentation();
-        topGroup.setName("top");
-        topGroup = createGroup(realm, topGroup);
-
-        List<RoleRepresentation> roles = new LinkedList<>();
-        roles.add(topRole);
-        realm.groups().group(topGroup.getId()).roles().realmLevel().add(roles);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(topGroup.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
-
-        GroupRepresentation level2Group = new GroupRepresentation();
-        level2Group.setName("level2");
-        Response response = realm.groups().group(topGroup.getId()).subGroup(level2Group);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(topGroup.getId()), level2Group, ResourceType.GROUP);
-
-        URI location = response.getLocation();
-        final String level2Id = ApiUtil.getCreatedId(response);
-        final GroupRepresentation level2GroupById = realm.groups().group(level2Id).toRepresentation();
-        assertEquals(level2Id, level2GroupById.getId());
-        assertEquals(level2Group.getName(), level2GroupById.getName());
-
-        URLAssert.assertGetURL(location, adminClient.tokenManager().getAccessTokenString(), new URLAssert.AssertJSONResponseHandler() {
-            @Override
-            protected void assertResponseBody(String body) throws IOException {
-                GroupRepresentation level2 = JsonSerialization.readValue(body, GroupRepresentation.class);
-                assertEquals(level2Id, level2.getId());
-            }
-        });
-
-        level2Group = realm.getGroupByPath("/top/level2");
-        assertNotNull(level2Group);
-        roles.clear();
-        roles.add(level2Role);
-        realm.groups().group(level2Group.getId()).roles().realmLevel().add(roles);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(level2Group.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
-
-        GroupRepresentation level3Group = new GroupRepresentation();
-        level3Group.setName("level3");
-        response = realm.groups().group(level2Group.getId()).subGroup(level3Group);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(level2Group.getId()), level3Group, ResourceType.GROUP);
-
-        level3Group = realm.getGroupByPath("/top/level2/level3");
-        assertNotNull(level3Group);
-        roles.clear();
-        roles.add(level3Role);
-        realm.groups().group(level3Group.getId()).roles().realmLevel().add(roles);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(level3Group.getId()), roles, ResourceType.REALM_ROLE_MAPPING);
-
-        topGroup = realm.getGroupByPath("/top");
-        assertEquals(1, topGroup.getRealmRoles().size());
-        assertTrue(topGroup.getRealmRoles().contains("topRole"));
-        assertEquals(1, realm.groups().group(topGroup.getId()).getSubGroups(0, null, false).size());
-
-        level2Group = realm.getGroupByPath("/top/level2");
-        assertEquals("level2", level2Group.getName());
-        assertEquals(1, level2Group.getRealmRoles().size());
-        assertTrue(level2Group.getRealmRoles().contains("level2Role"));
-        assertEquals(1, realm.groups().group(level2Group.getId()).getSubGroups(0, null, false).size());
-
-        level3Group = realm.getGroupByPath("/top/level2/level3");
-        assertEquals("level3", level3Group.getName());
-        assertEquals(1, level3Group.getRealmRoles().size());
-        assertTrue(level3Group.getRealmRoles().contains("level3Role"));
-
-        UserRepresentation user = realm.users().search("direct-login", -1, -1).get(0);
-        realm.users().get(user.getId()).joinGroup(level3Group.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userGroupPath(user.getId(), level3Group.getId()), ResourceType.GROUP_MEMBERSHIP);
-
-        List<GroupRepresentation> membership = realm.users().get(user.getId()).groups();
-        assertEquals(1, membership.size());
-        assertEquals("level3", membership.get(0).getName());
-
-        AccessToken token = login("direct-login", "resource-owner", "secret", user.getId());
-        assertTrue(token.getRealmAccess().getRoles().contains("topRole"));
-        assertTrue(token.getRealmAccess().getRoles().contains("level2Role"));
-        assertTrue(token.getRealmAccess().getRoles().contains("level3Role"));
-
-        realm.addDefaultGroup(level3Group.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.defaultGroupPath(level3Group.getId()), ResourceType.GROUP);
-
-        List<GroupRepresentation> defaultGroups = realm.getDefaultGroups();
-        assertEquals(1, defaultGroups.size());
-        assertEquals(defaultGroups.get(0).getId(), level3Group.getId());
-
-        UserRepresentation newUser = new UserRepresentation();
-        newUser.setUsername("groupUser");
-        newUser.setEmail("group@group.com");
-        response = realm.users().create(newUser);
-        String userId = ApiUtil.getCreatedId(response);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userResourcePath(userId), newUser, ResourceType.USER);
-
-        membership = realm.users().get(userId).groups();
-        assertEquals(1, membership.size());
-        assertEquals("level3", membership.get(0).getName());
-
-        realm.removeDefaultGroup(level3Group.getId());
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.defaultGroupPath(level3Group.getId()), ResourceType.GROUP);
-
-        defaultGroups = realm.getDefaultGroups();
-        assertEquals(0, defaultGroups.size());
-
-        realm.groups().group(topGroup.getId()).remove();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupPath(topGroup.getId()), ResourceType.GROUP);
-
-        try {
-            realm.getGroupByPath("/top/level2/level3");
-            Assert.fail("Group should not have been found");
-        }
-        catch (NotFoundException e) {}
-
-        try {
-            realm.getGroupByPath("/top/level2");
-            Assert.fail("Group should not have been found");
-        }
-        catch (NotFoundException e) {}
-
-        try {
-            realm.getGroupByPath("/top");
-            Assert.fail("Group should not have been found");
-        }
-        catch (NotFoundException e) {}
-
-        assertNull(login("direct-login", "resource-owner", "secret", user.getId()).getRealmAccess());
-    }
-
-    @Test
-    public void updateGroup() {
-        RealmResource realm = adminClient.realms().realm("test");
-        final String groupName = "group-" + UUID.randomUUID();
-
-        GroupRepresentation group = GroupBuilder.create()
-          .name(groupName)
-          .singleAttribute("attr1", "attrval1")
-          .singleAttribute("attr2", "attrval2")
-          .build();
-        createGroup(realm, group);
-        group = realm.getGroupByPath("/" + groupName);
-
-        assertNotNull(group);
-        assertThat(group.getName(), is(groupName));
-        assertThat(group.getAttributes().keySet(), containsInAnyOrder("attr1", "attr2"));
-        assertThat(group.getAttributes(), hasEntry(is("attr1"), contains("attrval1")));
-        assertThat(group.getAttributes(), hasEntry(is("attr2"), contains("attrval2")));
-
-        final String groupNewName = "group-" + UUID.randomUUID();
-        group.setName(groupNewName);
-
-        group.getAttributes().remove("attr1");
-        group.getAttributes().get("attr2").add("attrval2-2");
-        group.getAttributes().put("attr3", Collections.singletonList("attrval2"));
-
-        realm.groups().group(group.getId()).update(group);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.UPDATE, AdminEventPaths.groupPath(group.getId()), group, ResourceType.GROUP);
-
-        group = realm.getGroupByPath("/" + groupNewName);
-
-        assertThat(group.getName(), is(groupNewName));
-        assertThat(group.getAttributes().keySet(), containsInAnyOrder("attr2", "attr3"));
-        assertThat(group.getAttributes(), hasEntry(is("attr2"), containsInAnyOrder("attrval2", "attrval2-2")));
-        assertThat(group.getAttributes(), hasEntry(is("attr3"), contains("attrval2")));
-    }
-
-    @Test
-    public void moveGroups() {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        // Create 2 top level groups "mygroup1" and "mygroup2"
-        GroupRepresentation group = GroupBuilder.create()
-                .name("mygroup1")
-                .build();
-        GroupRepresentation group1 = createGroup(realm, group);
-
-        group = GroupBuilder.create()
-                .name("mygroup2")
-                .build();
-        GroupRepresentation group2 = createGroup(realm, group);
-
-        // Move "mygroup2" as child of "mygroup1" . Assert it was moved
-        Response response = realm.groups().group(group1.getId()).subGroup(group2);
-        assertEquals(204, response.getStatus());
-        response.close();
-
-        // Assert "mygroup2" was moved
-        List<GroupRepresentation> group1Children = realm.groups().group(group1.getId()).getSubGroups(0, 10, false);
-        List<GroupRepresentation> group2Children = realm.groups().group(group2.getId()).getSubGroups(0, 10, false);
-
-        assertNames(group1Children, "mygroup2");
-        assertEquals("/mygroup1/mygroup2", realm.groups().group(group2.getId()).toRepresentation().getPath());
-
-        assertAdminEvents.clear();
-
-        // Create top level group with the same name
-        group = GroupBuilder.create()
-                .name("mygroup2")
-                .build();
-        GroupRepresentation group3 = createGroup(realm, group);
-        // Try to move top level "mygroup2" as child of "mygroup1". It should fail as there is already a child group
-        // of "mygroup1" with name "mygroup2"
-        response = realm.groups().group(group1.getId()).subGroup(group3);
-        assertEquals(409, response.getStatus());
-        realm.groups().group(group3.getId()).remove();
-
-        // Move "mygroup2" back under parent
-        response = realm.groups().add(group2);
-        assertEquals(204, response.getStatus());
-        response.close();
-
-        // Assert "mygroup2" was moved
-        group1Children = realm.groups().group(group1.getId()).getSubGroups(0, 10, false);
-        group2Children = realm.groups().group(group2.getId()).getSubGroups(0, 10, false);
-        assertEquals(0, group1Children.size());
-        assertEquals("/mygroup2", realm.groups().group(group2.getId()).toRepresentation().getPath());
-    }
-
-    @Test
-    public void groupMembership() {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("group");
-        String groupId = createGroup(realm, group).getId();
-
-        Response response = realm.users().create(UserBuilder.create().username("user-a").build());
-        String userAId = ApiUtil.getCreatedId(response);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userResourcePath(userAId), ResourceType.USER);
-
-        response = realm.users().create(UserBuilder.create().username("user-b").build());
-        String userBId = ApiUtil.getCreatedId(response);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userResourcePath(userBId), ResourceType.USER);
-
-        realm.users().get(userAId).joinGroup(groupId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userGroupPath(userAId, groupId), group, ResourceType.GROUP_MEMBERSHIP);
-
-        List<UserRepresentation> members = realm.groups().group(groupId).members(0, 10);
-        assertNames(members, "user-a");
-
-        realm.users().get(userBId).joinGroup(groupId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.userGroupPath(userBId, groupId), group, ResourceType.GROUP_MEMBERSHIP);
-
-        members = realm.groups().group(groupId).members(0, 10);
-        assertNames(members, "user-a", "user-b");
-
-        realm.users().get(userAId).leaveGroup(groupId);
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.userGroupPath(userAId, groupId), group, ResourceType.GROUP_MEMBERSHIP);
-
-        members = realm.groups().group(groupId).members(0, 10);
-        assertNames(members, "user-b");
-
-        List<GroupRepresentation> groups = realm.users().get(userAId).groups(null, null);
-        assertNames(groups, new String[] {});
-    }
-
-
-    @Test
-    //KEYCLOAK-6300
-    public void groupMembershipUsersOrder() {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("group");
-        String groupId = createGroup(realm, group).getId();
-
-        List<String> usernames = new ArrayList<>();
-        for (int i = 0; i < 9; i++) {
-            UserRepresentation user = UserBuilder.create().username("user" + i).build();
-            usernames.add(user.getUsername());
-
-            try (Response create = realm.users().create(user)) {
-                assertEquals(Status.CREATED, create.getStatusInfo());
-
-                String userAId = ApiUtil.getCreatedId(create);
-                realm.users().get(userAId).joinGroup(groupId);
-            }
-        }
-
-        List<String> memberUsernames = new ArrayList<>();
-        for (UserRepresentation member : realm.groups().group(groupId).members(0, 10)) {
-            memberUsernames.add(member.getUsername());
-        }
-        assertArrayEquals("Expected: " + usernames + ", was: " + memberUsernames,
-                usernames.toArray(), memberUsernames.toArray());
-    }
-
-    @Test
-    // KEYCLOAK-2700
-    public void deleteRealmWithDefaultGroups() throws IOException {
-        RealmRepresentation rep = new RealmRepresentation();
-        rep.setRealm("foo");
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("default1");
-        group.setPath("/default1");
-
-        rep.setGroups(Collections.singletonList(group));
-        rep.setDefaultGroups(Collections.singletonList("/default1"));
-
-        adminClient.realms().create(rep);
-
-        adminClient.realm(rep.getRealm()).remove();
-    }
-
-    @Test
-    public void roleMappings() {
-        RealmResource realm = adminClient.realms().realm("test");
-        createRealmRole(realm, RoleBuilder.create().name("realm-role").build());
-        createRealmRole(realm, RoleBuilder.create().name("realm-composite").build());
-        createRealmRole(realm, RoleBuilder.create().name("realm-child").build());
-        realm.roles().get("realm-composite").addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-
-        try (Response response = realm.clients().create(ClientBuilder.create().clientId("myclient").build())) {
-            String clientId = ApiUtil.getCreatedId(response);
-            getCleanup().addClientUuid(clientId);
-
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role").build());
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-role2").build());
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-composite").build());
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-child").build());
-            realm.clients().get(clientId).roles().get("client-composite").addComposites(Collections.singletonList(realm.clients().get(clientId).roles().get("client-child").toRepresentation()));
-
-
-            // Roles+clients tested elsewhere
-            assertAdminEvents.clear();
-
-            GroupRepresentation group = new GroupRepresentation();
-            group.setName("group");
-            String groupId = createGroup(realm, group).getId();
-
-            RoleMappingResource roles = realm.groups().group(groupId).roles();
-            assertEquals(0, roles.realmLevel().listAll().size());
-
-            // Add realm roles
-            List<RoleRepresentation> l = new LinkedList<>();
-            l.add(realm.roles().get("realm-role").toRepresentation());
-            l.add(realm.roles().get("realm-composite").toRepresentation());
-            roles.realmLevel().add(l);
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), l, ResourceType.REALM_ROLE_MAPPING);
-
-            // Add client roles
-            RoleRepresentation clientRole = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
-            RoleRepresentation clientComposite = realm.clients().get(clientId).roles().get("client-composite").toRepresentation();
-            roles.clientLevel(clientId).add(Collections.singletonList(clientRole));
-            roles.clientLevel(clientId).add(Collections.singletonList(clientComposite));
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientRole), ResourceType.CLIENT_ROLE_MAPPING);
-            assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientComposite), ResourceType.CLIENT_ROLE_MAPPING);
-
-            // List realm roles
-            assertNames(roles.realmLevel().listAll(), "realm-role", "realm-composite");
-            assertNames(roles.realmLevel().listAvailable(), "realm-child", "admin", "offline_access", Constants.AUTHZ_UMA_AUTHORIZATION, "user", "customer-user-premium", "realm-composite-role", "sample-realm-role", "attribute-role", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-            assertNames(roles.realmLevel().listEffective(), "realm-role", "realm-composite", "realm-child");
-
-            // List client roles
-            assertNames(roles.clientLevel(clientId).listAll(), "client-role", "client-composite");
-            assertNames(roles.clientLevel(clientId).listAvailable(), "client-role2", "client-child");
-            assertNames(roles.clientLevel(clientId).listEffective(), "client-role", "client-composite", "client-child");
-
-            // Get mapping representation
-            MappingsRepresentation all = roles.getAll();
-            assertNames(all.getRealmMappings(), "realm-role", "realm-composite");
-            assertEquals(1, all.getClientMappings().size());
-            assertNames(all.getClientMappings().get("myclient").getMappings(), "client-role", "client-composite");
-
-            // Remove realm role
-            RoleRepresentation realmRoleRep = realm.roles().get("realm-role").toRepresentation();
-            roles.realmLevel().remove(Collections.singletonList(realmRoleRep));
-            assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupRolesRealmRolesPath(group.getId()), Collections.singletonList(realmRoleRep), ResourceType.REALM_ROLE_MAPPING);
-            assertNames(roles.realmLevel().listAll(), "realm-composite");
-
-            // Remove client role
-            RoleRepresentation clientRoleRep = realm.clients().get(clientId).roles().get("client-role").toRepresentation();
-            roles.clientLevel(clientId).remove(Collections.singletonList(clientRoleRep));
-            assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupRolesClientRolesPath(group.getId(), clientId), Collections.singletonList(clientRoleRep), ResourceType.CLIENT_ROLE_MAPPING);
-            assertNames(roles.clientLevel(clientId).listAll(), "client-composite");
-        }
-    }
-
-    /**
-     * Test for KEYCLOAK-10603.
-     */
-    @Test
-    public void rolesCanBeAssignedEvenWhenTheyAreAlreadyIndirectlyAssigned() {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        createRealmRole(realm, RoleBuilder.create().name("realm-composite").build());
-        createRealmRole(realm, RoleBuilder.create().name("realm-child").build());
-        realm.roles().get("realm-composite")
-                .addComposites(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-
-        try (Response response = realm.clients().create(ClientBuilder.create().clientId("myclient").build())) {
-            String clientId = ApiUtil.getCreatedId(response);
-            getCleanup().addClientUuid(clientId);
-
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-composite").build());
-            realm.clients().get(clientId).roles().create(RoleBuilder.create().name("client-child").build());
-            realm.clients().get(clientId).roles().get("client-composite").addComposites(Collections
-                    .singletonList(realm.clients().get(clientId).roles().get("client-child").toRepresentation()));
-
-            GroupRepresentation group = new GroupRepresentation();
-            group.setName("group");
-
-            // Roles+clients tested elsewhere
-            assertAdminEvents.clear();
-
-            String groupId = createGroup(realm, group).getId();
-
-            RoleMappingResource roles = realm.groups().group(groupId).roles();
-            // Make indirect assignments: assign composite roles
-            roles.realmLevel()
-                    .add(Collections.singletonList(realm.roles().get("realm-composite").toRepresentation()));
-            RoleRepresentation clientComposite =
-                    realm.clients().get(clientId).roles().get("client-composite").toRepresentation();
-            roles.clientLevel(clientId).add(Collections.singletonList(clientComposite));
-
-            // Check state before making the direct assignments
-            assertNames(roles.realmLevel().listAll(), "realm-composite");
-            assertNames(roles.realmLevel().listAvailable(), "realm-child", "admin", "offline_access",
-                    Constants.AUTHZ_UMA_AUTHORIZATION, "user", "customer-user-premium", "realm-composite-role",
-                    "sample-realm-role", "attribute-role", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-            assertNames(roles.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-            assertNames(roles.clientLevel(clientId).listAll(), "client-composite");
-            assertNames(roles.clientLevel(clientId).listAvailable(), "client-child");
-            assertNames(roles.clientLevel(clientId).listEffective(), "client-composite", "client-child");
-
-            // Make direct assignments for roles which are already indirectly assigned
-            roles.realmLevel().add(Collections.singletonList(realm.roles().get("realm-child").toRepresentation()));
-            RoleRepresentation clientChild =
-                    realm.clients().get(clientId).roles().get("client-child").toRepresentation();
-            roles.clientLevel(clientId).add(Collections.singletonList(clientChild));
-
-            // List realm roles
-            assertNames(roles.realmLevel().listAll(), "realm-composite", "realm-child");
-            assertNames(roles.realmLevel().listAvailable(), "admin", "offline_access",
-                    Constants.AUTHZ_UMA_AUTHORIZATION, "user", "customer-user-premium", "realm-composite-role",
-                    "sample-realm-role", "attribute-role", Constants.DEFAULT_ROLES_ROLE_PREFIX + "-test");
-            assertNames(roles.realmLevel().listEffective(), "realm-composite", "realm-child");
-
-            // List client roles
-            assertNames(roles.clientLevel(clientId).listAll(), "client-composite", "client-child");
-            assertNames(roles.clientLevel(clientId).listAvailable());
-            assertNames(roles.clientLevel(clientId).listEffective(), "client-composite", "client-child");
-
-            // Get mapping representation
-            MappingsRepresentation all = roles.getAll();
-            assertNames(all.getRealmMappings(), "realm-composite", "realm-child");
-            assertEquals(1, all.getClientMappings().size());
-            assertNames(all.getClientMappings().get("myclient").getMappings(), "client-composite", "client-child");
-        }
-    }
-
-    /**
-     * Verifies that the user does not have access to Keycloak Admin endpoint when role is not
-     * assigned to that user.
-     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
-     */
-    @Test
-    public void noAdminEndpointAccessWhenNoRoleAssigned() {
-        String userName = "user-" + UUID.randomUUID();
-        final String realmName = AuthRealm.MASTER;
-        createUser(realmName, userName, "pwd");
-
-        try (Keycloak userClient = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-          realmName, userName, "pwd", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            expectedException.expect(ClientErrorException.class);
-            expectedException.expectMessage(String.valueOf(Response.Status.FORBIDDEN.getStatusCode()));
-            userClient.realms().findAll();  // Any admin operation will do
-        }
-    }
-
-    /**
-     * Verifies that the role assigned to a user is correctly handled by Keycloak Admin endpoint.
-     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
-     */
-    @Test
-    public void adminEndpointAccessibleWhenAdminRoleAssignedToUser() {
-        String userName = "user-" + UUID.randomUUID();
-
-        final String realmName = AuthRealm.MASTER;
-        RealmResource realm = adminClient.realms().realm(realmName);
-        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
-        assertThat(adminRole, notNullValue());
-        assertThat(adminRole.getId(), notNullValue());
-
-        String userId = createUser(realmName, userName, "pwd");
-        assertThat(userId, notNullValue());
-
-        RoleMappingResource mappings = realm.users().get(userId).roles();
-        mappings.realmLevel().add(Collections.singletonList(adminRole));
-
-        try (Keycloak userClient = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-          realmName, userName, "pwd", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            assertThat(userClient.realms().findAll(),  // Any admin operation will do
-                    not(empty()));
-        }
-    }
-
-    /**
-     * Verifies that the role assigned to a user's group is correctly handled by Keycloak Admin endpoint.
-     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
-     */
-    @Test
-    public void adminEndpointAccessibleWhenAdminRoleAssignedToGroup() {
-        String userName = "user-" + UUID.randomUUID();
-        String groupName = "group-" + UUID.randomUUID();
-
-        final String realmName = AuthRealm.MASTER;
-        RealmResource realm = adminClient.realms().realm(realmName);
-        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
-        assertThat(adminRole, notNullValue());
-        assertThat(adminRole.getId(), notNullValue());
-
-        String userId = createUser(realmName, userName, "pwd");
-        GroupRepresentation group = GroupBuilder.create().name(groupName).build();
-        try (Response response = realm.groups().add(group)) {
-            String groupId = ApiUtil.getCreatedId(response);
-
-            RoleMappingResource mappings = realm.groups().group(groupId).roles();
-            mappings.realmLevel().add(Collections.singletonList(adminRole));
-
-            realm.users().get(userId).joinGroup(groupId);
-        }
-        try (Keycloak userClient = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-          realmName, userName, "pwd", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            assertThat(userClient.realms().findAll(),  // Any admin operation will do
-                not(empty()));
-        }
-    }
-
-    /**
-     * Groups search with query returns unwanted groups
-     * @link https://issues.redhat.com/browse/KEYCLOAK-18380
-     */
-    @Test
-    public void searchForGroupsShouldOnlyReturnMatchingElementsOrIntermediatePaths() {
-
-        /*
-         * /g1/g1.1-gugu
-         * /g1/g1.2-test1234
-         * /g2-test1234
-         * /g3/g3.1-test1234/g3.1.1
-         */
-        String needle = "test1234";
-        GroupRepresentation g1 = GroupBuilder.create().name("g1").build();
-        GroupRepresentation g1_1 = GroupBuilder.create().name("g1.1-bubu").build();
-        GroupRepresentation g1_2 = GroupBuilder.create().name("g1.2-" + needle).build();
-        GroupRepresentation g2 = GroupBuilder.create().name("g2-" + needle).build();
-        GroupRepresentation g3 = GroupBuilder.create().name("g3").build();
-        GroupRepresentation g3_1 = GroupBuilder.create().name("g3.1-" + needle).build();
-        GroupRepresentation g3_1_1 = GroupBuilder.create().name("g3.1.1").build();
-
-        String realmName = AuthRealm.TEST;
-        RealmResource realm = adminClient.realms().realm(realmName);
-
-        createGroup(realm, g1);
-        createGroup(realm, g2);
-        createGroup(realm, g3);
-        addSubGroup(realm, g1, g1_1);
-        addSubGroup(realm, g1, g1_2);
-        addSubGroup(realm, g3, g3_1);
-        addSubGroup(realm, g3_1, g3_1_1);
-
-        try {
-            // we search for "test1234" and expect only /g1/g1.2-test1234, /g2-test1234 and /g3/g3.1-test1234 as a result
-            List<GroupRepresentation> result = realm.groups().groups(needle, 0, 100);
-
-            assertEquals(3, result.size());
-            assertEquals("g1", result.get(0).getName());
-            assertEquals(1, result.get(0).getSubGroups().size());
-            assertEquals("g1.2-" + needle, result.get(0).getSubGroups().get(0).getName());
-            assertEquals("g2-" + needle, result.get(1).getName());
-            assertEquals("g3", result.get(2).getName());
-            assertEquals(1, result.get(2).getSubGroups().size());
-            assertEquals("g3.1-" + needle, result.get(2).getSubGroups().get(0).getName());
-        } finally {
-            if (g1.getId() != null) {
-                realm.groups().group(g1.getId()).remove();
-            }
-
-            if (g2.getId() != null) {
-                realm.groups().group(g2.getId()).remove();
-            }
-
-            if (g3.getId() != null) {
-                realm.groups().group(g3.getId()).remove();
-            }
-        }
-    }
-
-    /**
-     * Verifies that the role assigned to a user's group is correctly handled by Keycloak Admin endpoint.
-     * @link https://issues.jboss.org/browse/KEYCLOAK-2964
-     */
-    @Test
-    public void adminEndpointAccessibleWhenAdminRoleAssignedToGroupAfterUserJoinedIt() {
-        String userName = "user-" + UUID.randomUUID();
-        String groupName = "group-" + UUID.randomUUID();
-
-        final String realmName = AuthRealm.MASTER;
-        RealmResource realm = adminClient.realms().realm(realmName);
-        RoleRepresentation adminRole = realm.roles().get(AdminRoles.ADMIN).toRepresentation();
-        assertThat(adminRole, notNullValue());
-        assertThat(adminRole.getId(), notNullValue());
-
-        String userId = createUser(realmName, userName, "pwd");
-        GroupRepresentation group = GroupBuilder.create().name(groupName).build();
-        try (Response response = realm.groups().add(group)) {
-            String groupId = ApiUtil.getCreatedId(response);
-
-            realm.users().get(userId).joinGroup(groupId);
-
-            RoleMappingResource mappings = realm.groups().group(groupId).roles();
-
-            mappings.realmLevel().add(Collections.singletonList(adminRole));
-        }
-        try (Keycloak userClient = Keycloak.getInstance(getAuthServerContextRoot() + "/auth",
-          realmName, userName, "pwd", Constants.ADMIN_CLI_CLIENT_ID, TLSUtils.initializeTLS())) {
-
-            assertThat(userClient.realms().findAll(),  // Any admin operation will do
-                not(empty()));
-        }
-    }
-
-    @Test
-    public void defaultMaxResults() {
-        GroupsResource groups = adminClient.realms().realm("test").groups();
-        try (Response response = groups.add(GroupBuilder.create().name("test").build())) {
-            String groupId = ApiUtil.getCreatedId(response);
-
-            GroupResource group = groups.group(groupId);
-
-            UsersResource users = adminClient.realms().realm("test").users();
-
-            for (int i = 0; i < 110; i++) {
-                try (Response r = users.create(UserBuilder.create().username("test-" + i).build())) {
-                    users.get(ApiUtil.getCreatedId(r)).joinGroup(groupId);
-                }
-            }
-
-            assertEquals(100, group.members(null, null).size());
-            assertEquals(100, group.members().size());
-            assertEquals(105, group.members(0, 105).size());
-            assertEquals(110, group.members(0, 1000).size());
-            assertEquals(110, group.members(-1, -2).size());
-        }
-    }
-
-    @Test
-    public void getGroupsWithFullRepresentation() {
-        RealmResource realm = adminClient.realms().realm("test");
-        GroupsResource groupsResource = adminClient.realms().realm("test").groups();
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("groupWithAttribute");
-
-        Map<String, List<String>> attributes = new HashMap<String, List<String>>();
-        attributes.put("attribute1", Arrays.asList("attribute1","attribute2"));
-		group.setAttributes(attributes);
-        group = createGroup(realm, group);
-
-        List<GroupRepresentation> groups = groupsResource.groups("groupWithAttribute", 0, 20, false);
-
-        assertFalse(groups.isEmpty());
-        assertTrue(groups.get(0).getAttributes().containsKey("attribute1"));
-    }
-
-    @Test
-    public void searchGroupsByNameContaining() {
-        RealmResource realm = adminClient.realms().realm("test");
-        try(Creator<GroupResource> g = Creator.create(realm, GroupBuilder.create().name("group-name-1").build());
-            Creator<GroupResource> g1 = Creator.create(realm, GroupBuilder.create().name("group-name-2").build())) {
-            GroupsResource groupsResource = adminClient.realms().realm("test").groups();
-            List<GroupRepresentation> groups = groupsResource.groups("group-name", false, 0, 20, false);
-            assertThat(groups, hasSize(2));
-        }
-    }
-
-    @Test
-    public void searchGroupsByNameExactSuccess() {
-        RealmResource realm = adminClient.realms().realm("test");
-        try(Creator<GroupResource> g = Creator.create(realm, GroupBuilder.create().name("group-name-1").build());
-            Creator<GroupResource> g1 = Creator.create(realm, GroupBuilder.create().name("group-name-2").build())) {
-            GroupsResource groupsResource = adminClient.realms().realm("test").groups();
-            List<GroupRepresentation> groups = groupsResource.groups("group-name-1", true, 0, 20, false);
-            assertThat(groups, hasSize(1));
-        }
-    }
-
-    @Test
-    public void searchGroupsByNameExactFailure() {
-        RealmResource realm = adminClient.realms().realm("test");
-        try(Creator<GroupResource> g = Creator.create(realm, GroupBuilder.create().name("group-name-1").build());
-            Creator<GroupResource> g1 = Creator.create(realm, GroupBuilder.create().name("group-name-2").build())) {
-            GroupsResource groupsResource = adminClient.realms().realm("test").groups();
-            List<GroupRepresentation> groups = groupsResource.groups("group-name", true, 0, 20, false);
-            assertThat(groups, empty());
-        }
-    }
-
-    @Test
-    public void getGroupsWithBriefRepresentation() {
-        RealmResource realm = adminClient.realms().realm("test");
-        GroupsResource groupsResource = adminClient.realms().realm("test").groups();
-
-        GroupRepresentation group = new GroupRepresentation();
-        group.setName("groupWithAttribute");
-
-        Map<String, List<String>> attributes = new HashMap<String, List<String>>();
-        attributes.put("attribute1", Arrays.asList("attribute1","attribute2"));
-		group.setAttributes(attributes);
-        group = createGroup(realm, group);
-
-        List<GroupRepresentation> groups = groupsResource.groups("groupWithAttribute", 0, 20);
-
-        assertFalse(groups.isEmpty());
-        assertNull(groups.get(0).getAttributes());
-    }
-
-    @Test
-    public void getSubGroups() throws Exception {
-        RealmResource realm = adminClient.realms().realm("test");
-
-        GroupRepresentation parent = new GroupRepresentation();
-        parent.setName("parent");
-        parent = createGroup(realm, parent);
-
-        GroupRepresentation child = new GroupRepresentation();
-        child.setName("child");
-        Map<String, List<String>> attributes = new HashMap<String, List<String>>();
-        attributes.put("attribute1", Arrays.asList("value1", "value2"));
-        child.setAttributes(attributes);
-
-        addSubGroup(realm, parent, child);
-
-        // Check brief and full retrieval of subgroups of parent
-        boolean briefRepresentation = true;
-        assertNull(realm.groups().group(parent.getId()).getSubGroups(null, null, briefRepresentation).get(0).getAttributes());
-
-        briefRepresentation = false;
-        assertThat(realm.groups().group(parent.getId()).getSubGroups(null, null, briefRepresentation).get(0).getAttributes().get("attribute1"), containsInAnyOrder("value1", "value2"));
-    }
-
-    @Test
-    public void searchAndCountGroups() throws Exception {
-        String firstGroupId = "";
-
-        RealmResource realm = adminClient.realms().realm("test");
-
-        // Clean up all test groups
-        for (GroupRepresentation group : realm.groups().groups()) {
-            GroupResource resource = realm.groups().group(group.getId());
-            resource.remove();
-            assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupPath(group.getId()), ResourceType.GROUP);
-        }
-
-        // Add 20 new groups with known names
-        for (int i=0;i<20;i++) {
-            GroupRepresentation group = new GroupRepresentation();
-            group.setName("group"+i);
-            group = createGroup(realm, group);
-            if(i== 0) {
-                firstGroupId = group.getId();
-            }
-        }
-
-        // Get groups by search and pagination
-        List<GroupRepresentation> allGroups = realm.groups().groups();
-        assertEquals(20, allGroups.size());
-
-        List<GroupRepresentation> slice = realm.groups().groups(0, 7);
-        assertEquals(7, slice.size());
-
-        slice = realm.groups().groups(null, 7);
-        assertEquals(7, slice.size());
-
-        slice = realm.groups().groups(10, null);
-        assertEquals(10, slice.size());
-
-        slice = realm.groups().groups(5, 7);
-        assertEquals(7, slice.size());
-
-        slice = realm.groups().groups(15, 7);
-        assertEquals(5, slice.size());
-
-        List<GroupRepresentation> search = realm.groups().groups("group1",0,20);
-        assertEquals(11, search.size());
-        for(GroupRepresentation group : search) {
-            assertTrue(group.getName().contains("group1"));
-        }
-
-        List<GroupRepresentation> noResultSearch = realm.groups().groups("abcd",0,20);
-        assertEquals(0, noResultSearch.size());
-
-        // Count
-        assertEquals(Long.valueOf(allGroups.size()), realm.groups().count().get("count"));
-        assertEquals(Long.valueOf(search.size()), realm.groups().count("group1").get("count"));
-        assertEquals(Long.valueOf(noResultSearch.size()), realm.groups().count("abcd").get("count"));
-
-        // Add a subgroup for onlyTopLevel flag testing
-        GroupRepresentation level2Group = new GroupRepresentation();
-        level2Group.setName("group1111");
-        Response response = realm.groups().group(firstGroupId).subGroup(level2Group);
-        response.close();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE, AdminEventPaths.groupSubgroupsPath(firstGroupId), level2Group, ResourceType.GROUP);
-
-        assertEquals(Long.valueOf(allGroups.size()), realm.groups().count(true).get("count"));
-        assertEquals(Long.valueOf(allGroups.size() + 1), realm.groups().count(false).get("count"));
-        //add another subgroup
-        GroupRepresentation level2Group2 = new GroupRepresentation();
-        level2Group2.setName("group111111");
-        realm.groups().group(firstGroupId).subGroup(level2Group2);
-        //search and count for group with string group11 -> return 2 top level group, group11 and group0 having subgroups group1111 and group111111
-        search = realm.groups().groups("group11",0,10);
-        assertEquals(2, search.size());
-        GroupRepresentation group0 = search.stream().filter(group -> "group0".equals(group.getName())).findAny().orElseGet(null);
-        assertNotNull(group0);
-        assertEquals(2,group0.getSubGroups().size());
-        assertThat(group0.getSubGroups().stream().map(GroupRepresentation::getName).collect(Collectors.toList()), Matchers.containsInAnyOrder("group1111", "group111111"));
-        assertEquals(countLeafGroups(search), realm.groups().count("group11").get("count"));
-    }
-
-    private Long countLeafGroups(List<GroupRepresentation> search) {
-        long counter = 0;
-        for(GroupRepresentation group : search) {
-            if(group.getSubGroups().isEmpty()) {
-                counter += 1;
-                continue;
-            }
-            counter += countLeafGroups(group.getSubGroups());
-        }
-        return counter;
-    }
-
-    @Test
-    public void orderGroupsByName() throws Exception {
-        RealmResource realm = this.adminClient.realms().realm("test");
-
-        // Clean up all test groups
-        for (GroupRepresentation group : realm.groups().groups()) {
-            GroupResource resource = realm.groups().group(group.getId());
-            resource.remove();
-            assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupPath(group.getId()), ResourceType.GROUP);
-        }
-
-        // Create two pages worth of groups in a random order
-        List<GroupRepresentation> testGroups = new ArrayList<>();
-        for (int i = 0; i < 40; i++) {
-            GroupRepresentation group = new GroupRepresentation();
-            group.setName("group" + i);
-            testGroups.add(group);
-        }
-
-        Collections.shuffle(testGroups);
-
-        for (GroupRepresentation group : testGroups) {
-            group = createGroup(realm, group);
-        }
-
-        // Groups should be ordered by name
-        Comparator<GroupRepresentation> compareByName = Comparator.comparing(GroupRepresentation::getName);
-
-        // Assert that all groups are returned in order
-        List<GroupRepresentation> allGroups = realm.groups().groups(0, 100);
-        assertEquals(40, allGroups.size());
-        assertTrue(Comparators.isInStrictOrder(allGroups, compareByName));
-
-        // Assert that pagination results are returned in order
-        List<GroupRepresentation> firstPage = realm.groups().groups(0, 20);
-        assertEquals(20, firstPage.size());
-        assertTrue(Comparators.isInStrictOrder(firstPage, compareByName));
-
-        List<GroupRepresentation> secondPage = realm.groups().groups(20, 20);
-        assertEquals(20, secondPage.size());
-        assertTrue(Comparators.isInStrictOrder(secondPage, compareByName));
-
-        // Check that the ordering of groups across multiple pages is correct
-        // Since the individual pages are ordered it is sufficient to compare
-        // every group from the first page to the first group of the second page
-        GroupRepresentation firstGroupOnSecondPage = secondPage.get(0);
-        for (GroupRepresentation firstPageGroup : firstPage) {
-            int comparisonResult = compareByName.compare(firstPageGroup, firstGroupOnSecondPage);
-            assertTrue(comparisonResult < 0);
-        }
-    }
-
-    @Test
-    public void removeAllGroupAttributes() {
-        final var realm = adminClient.realms().realm("test");
-        final var groupName = "remove-all-attributes-group";
-
-        final Map<String, List<String>> initialAttributes = Map.of("test-key", List.of("test-val"));
-        final var groupToCreate =
-                GroupBuilder.create().name(groupName).attributes(initialAttributes).build();
-        final var groupsResource = realm.groups();
-        try (final Response response = groupsResource.add(groupToCreate)) {
-            final var groupId = ApiUtil.getCreatedId(response);
-
-            final var groupResource = groupsResource.group(groupId);
-            final var createdGroup = groupResource.toRepresentation();
-            assertThat(createdGroup.getAttributes(), equalTo(initialAttributes));
-
-            final var groupToUpdate =
-                    GroupBuilder.create().name(groupName).attributes(Collections.emptyMap()).build();
-            groupResource.update(groupToUpdate);
-
-            final var updatedGroup = groupResource.toRepresentation();
-            assertThat(updatedGroup.getAttributes(), anEmptyMap());
-        }
-    }
-
-    @Test
-    public void testBriefRepresentationOnGroupMembers() {
-        RealmResource realm = adminClient.realms().realm("test");
-        String groupName = "brief-grouptest-group";
-        String userName = "brief-grouptest-user";
-
-        // enable user profile unmanaged attributes
-        UserProfileResource upResource = realm.users().userProfile();
-        UPConfig cfg = VerifyProfileTest.enableUnmanagedAttributes(upResource);
-
-        GroupsResource groups = realm.groups();
-        try (Response response = groups.add(GroupBuilder.create().name(groupName).build())) {
-            String groupId = ApiUtil.getCreatedId(response);
-
-            GroupResource group = groups.group(groupId);
-
-            UsersResource users = realm.users();
-
-            UserRepresentation userRepresentation = UserBuilder.create()
-                    .username(userName)
-                    .addAttribute("myattribute", "myvalue")
-                    .build();
-
-            Response r = users.create(userRepresentation);
-            UserResource user = users.get(ApiUtil.getCreatedId(r));
-            user.joinGroup(groupId);
-
-            UserRepresentation defaultRepresentation = group.members(null, null).get(0);
-            UserRepresentation fullRepresentation = group.members(null, null, false).get(0);
-            UserRepresentation briefRepresentation = group.members(null, null, true).get(0);
-
-            assertEquals("full group member representation includes attributes", fullRepresentation.getAttributes(), userRepresentation.getAttributes());
-            assertEquals("default group member representation is full", defaultRepresentation.getAttributes(), userRepresentation.getAttributes());
-            assertNull("brief group member representation omits attributes", briefRepresentation.getAttributes());
-
-            group.remove();
-            user.remove();
-        } finally {
-            cfg.setUnmanagedAttributePolicy(null);
-            upResource.update(cfg);
-        }
-    }
-
-    /**
-     * Verifies that the group search works the same across group provider implementations for hierarchies
-     * @link https://issues.jboss.org/browse/KEYCLOAK-18390
-     */
-    @Test
-    public void searchGroupsOnGroupHierarchies() throws Exception {
-        final RealmResource realm = this.adminClient.realms().realm("test");
-
-        final String searchFor = UUID.randomUUID().toString();
-
-        final GroupRepresentation g1 = new GroupRepresentation();
-        g1.setName("g1");
-        final GroupRepresentation g1_1 = new GroupRepresentation();
-        g1_1.setName("g1.1-" + searchFor);
-
-        createGroup(realm, g1);
-        addSubGroup(realm, g1, g1_1);
-
-        final GroupRepresentation expectedRootGroup = realm.groups().group(g1.getId()).toRepresentation();
-        final GroupRepresentation expectedChildGroup = realm.groups().group(g1_1.getId()).toRepresentation();
-
-        final List<GroupRepresentation> searchResultGroups = realm.groups().groups(searchFor, 0, 10);
-
-        assertFalse(searchResultGroups.isEmpty());
-        assertEquals(expectedRootGroup.getId(), searchResultGroups.get(0).getId());
-        assertEquals(expectedRootGroup.getName(), searchResultGroups.get(0).getName());
-
-        List<GroupRepresentation> searchResultSubGroups = searchResultGroups.get(0).getSubGroups();
-        assertEquals(expectedChildGroup.getId(), searchResultSubGroups.get(0).getId());
-        assertEquals(expectedChildGroup.getName(), searchResultSubGroups.get(0).getName());
-
-        searchResultSubGroups.remove(0);
-        assertTrue(searchResultSubGroups.isEmpty());
-        searchResultGroups.remove(0);
-        assertTrue(searchResultGroups.isEmpty());
-    }
-
-    public void testParentAndChildGroup(String parentName, String childName) {
-        RealmResource realm = adminClient.realms().realm("test");
-        GroupRepresentation parentGroup = new GroupRepresentation();
-        parentGroup.setName(parentName);
-        parentGroup = createGroup(realm, parentGroup);
-        GroupRepresentation childGroup = new GroupRepresentation();
-        childGroup.setName(childName);
-        try (Response response = realm.groups().group(parentGroup.getId()).subGroup(childGroup)) {
-            assertEquals(201, response.getStatus()); // created status
-            childGroup.setId(ApiUtil.getCreatedId(response));
-        }
-        assertAdminEvents.assertEvent(testRealmId, OperationType.CREATE,
-                AdminEventPaths.groupSubgroupsPath(parentGroup.getId()), childGroup, ResourceType.GROUP);
-
-        List<GroupRepresentation> groupsFound = realm.groups().groups(parentGroup.getName(), true, 0, 1, true);
-        Assert.assertEquals(1, groupsFound.size());
-        Assert.assertEquals(parentGroup.getId(), groupsFound.iterator().next().getId());
-        Assert.assertEquals(0, groupsFound.iterator().next().getSubGroups().size());
-        parentGroup = groupsFound.iterator().next();
-        Assert.assertEquals(KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, parentName),
-                parentGroup.getPath());
-
-        groupsFound = realm.groups().groups(childGroup.getName(), true, 0, 1, true);
-        Assert.assertEquals(1, groupsFound.size());
-        Assert.assertEquals(parentGroup.getId(), groupsFound.iterator().next().getId());
-        Assert.assertEquals(1, groupsFound.iterator().next().getSubGroups().size());
-        Assert.assertEquals(childGroup.getId(), groupsFound.iterator().next().getSubGroups().iterator().next().getId());
-        childGroup = groupsFound.iterator().next().getSubGroups().iterator().next();
-        Assert.assertEquals(KeycloakModelUtils.normalizeGroupPath(
-                KeycloakModelUtils.buildGroupPath(GroupProvider.DEFAULT_ESCAPE_SLASHES, parentName, childName)),
-                childGroup.getPath());
-
-        GroupRepresentation groupFound = realm.getGroupByPath(parentGroup.getPath());
-        Assert.assertNotNull(groupFound);
-        Assert.assertEquals(parentGroup.getId(), groupFound.getId());
-        groupFound = realm.getGroupByPath(childGroup.getPath());
-        Assert.assertNotNull(groupFound);
-        Assert.assertEquals(childGroup.getId(), groupFound.getId());
-
-        realm.groups().group(childGroup.getId()).remove();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupPath(childGroup.getId()), ResourceType.GROUP);
-        realm.groups().group(parentGroup.getId()).remove();
-        assertAdminEvents.assertEvent(testRealmId, OperationType.DELETE, AdminEventPaths.groupPath(parentGroup.getId()), ResourceType.GROUP);
-    }
-
-    @Test
-    public void testGroupsWithSpaces() {
-         testParentAndChildGroup("parent space", "child space");
-    }
-
-    @Test
-    public void testGroupsWithSlashes() {
-         testParentAndChildGroup("parent/slash", "child/slash");
-    }
-
-    /**
-     * Assert that when you create/move/update a group name, the response is not Http 409 Conflict and the message does not
-     * correspond to the returned user-friendly message in such cases
-     */
-    private void assertSameNameNotAllowed(Response response, String expectedErrorMessage) {
-        assertEquals(409, response.getStatus());
-        ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
-        Assert.assertEquals(expectedErrorMessage, error.getErrorMessage());
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/partialimport/PartialImportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/partialimport/PartialImportTest.java
deleted file mode 100644
index b1c6503d25de..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/partialimport/PartialImportTest.java
+++ /dev/null
@@ -1,984 +0,0 @@
-/*
- * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
- * as indicated by the @author tags. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.keycloak.testsuite.admin.partialimport;
-
-import java.io.IOException;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.IdentityProviderResource;
-import org.keycloak.admin.client.resource.RoleResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.authentication.requiredactions.TermsAndConditions;
-import org.keycloak.events.admin.OperationType;
-import org.keycloak.models.UserModel;
-import org.keycloak.partialimport.PartialImportResult;
-import org.keycloak.partialimport.PartialImportResults;
-import org.keycloak.representations.idm.AdminEventRepresentation;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.GroupRepresentation;
-import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
-import org.keycloak.representations.idm.IdentityProviderRepresentation;
-import org.keycloak.representations.idm.PartialImportRepresentation;
-import org.keycloak.representations.idm.PartialImportRepresentation.Policy;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.RolesRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractAuthTest;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.AssertAdminEvents;
-import org.keycloak.testsuite.util.RealmBuilder;
-
-import jakarta.ws.rs.core.Response;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.hamcrest.CoreMatchers.hasItem;
-import static org.hamcrest.CoreMatchers.startsWith;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.contains;
-import static org.hamcrest.Matchers.equalTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-import org.keycloak.admin.client.resource.AuthorizationResource;
-import org.keycloak.common.constants.ServiceAccountConstants;
-import org.keycloak.partialimport.ResourceType;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-
-import static org.keycloak.common.Profile.Feature.AUTHORIZATION;
-import static org.keycloak.testsuite.auth.page.AuthRealm.MASTER;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * Tests for the partial import endpoint in admin client.  Also tests the
- * server side functionality of each resource along with "fail, skip, overwrite"
- * functions.
- *
- * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
- */
-public class PartialImportTest extends AbstractAuthTest {
-
-    @Rule
-    public AssertAdminEvents assertAdminEvents = new AssertAdminEvents(this);
-
-    private static final int NUM_RESOURCE_TYPES = 6;
-    private static final String CLIENT_ROLES_CLIENT = "clientRolesClient";
-    private static final String CLIENT_SERVICE_ACCOUNT = "clientServiceAccount";
-    private static final String USER_PREFIX = "user";
-    private static final String GROUP_PREFIX = "group";
-    private static final String CLIENT_PREFIX = "client";
-    private static final String REALM_ROLE_PREFIX = "realmRole";
-    private static final String CLIENT_ROLE_PREFIX = "clientRole";
-    private static final String[] IDP_ALIASES = {"twitter", "github", "facebook", "google", "linkedin-openid-connect", "microsoft", "stackoverflow"};
-    private static final int NUM_ENTITIES = IDP_ALIASES.length;
-    private static final ResourceServerRepresentation resourceServerSampleSettings;
-
-    private PartialImportRepresentation piRep;
-    private String realmId;
-
-    static {
-        try {
-            resourceServerSampleSettings = JsonSerialization.readValue(
-                PartialImportTest.class.getResourceAsStream("/import/sample-authz-partial-import.json"),
-                ResourceServerRepresentation.class);
-        } catch (IOException e) {
-            throw new IllegalStateException("Cannot load sample resource server configuration", e);
-        }
-    }
-
-    @Before
-    public void initAdminEvents() {
-        RealmRepresentation realmRep = RealmBuilder.edit(testRealmResource().toRepresentation()).testEventListener().build();
-        realmId = realmRep.getId();
-        realmRep.setDuplicateEmailsAllowed(false);
-        adminClient.realm(realmRep.getRealm()).update(realmRep);
-
-        piRep = new PartialImportRepresentation();
-    }
-
-    @After
-    public void tearDownAdminEvents() {
-        RealmRepresentation realmRep = RealmBuilder.edit(testRealmResource().toRepresentation()).removeTestEventListener().build();
-        adminClient.realm(realmRep.getRealm()).update(realmRep);
-    }
-
-    @Before
-    public void createClientForClientRoles() {
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId(CLIENT_ROLES_CLIENT);
-        client.setName(CLIENT_ROLES_CLIENT);
-        client.setProtocol("openid-connect");
-        try (Response resp = testRealmResource().clients().create(client)) {
-
-            // for some reason, findAll() will later fail unless readEntity is called here
-            resp.readEntity(String.class);
-            //testRealmResource().clients().findAll();
-        }
-    }
-
-    @Before
-    public void createClientWithServiceAccount() {
-        ClientRepresentation client = new ClientRepresentation();
-        client.setClientId(CLIENT_SERVICE_ACCOUNT);
-        client.setName(CLIENT_SERVICE_ACCOUNT);
-        client.setRootUrl("http://localhost/foo");
-        client.setProtocol("openid-connect");
-        client.setPublicClient(false);
-        client.setSecret("secret");
-        client.setServiceAccountsEnabled(true);
-        try (Response resp = testRealmResource().clients().create(client)) {
-            String id = ApiUtil.getCreatedId(resp);
-            UserRepresentation serviceAccountUser = testRealmResource().clients().get(id).getServiceAccountUser();
-            assertNotNull(serviceAccountUser);
-        }
-    }
-
-    @Before
-    public void removeUsers() {
-        List<UserRepresentation> toRemove = testRealmResource().users().search(USER_PREFIX, 0, NUM_ENTITIES);
-        for (UserRepresentation user : toRemove) {
-            testRealmResource().users().get(user.getId()).remove();
-        }
-    }
-
-    @Before
-    public void removeGroups() {
-        List<GroupRepresentation> toRemove = testRealmResource().groups().groups();
-        for (GroupRepresentation group: toRemove) {
-            testRealmResource().groups().group(group.getId()).remove();
-        }
-    }
-
-    @Before
-    public void removeClients() {
-        List<ClientRepresentation> toRemove = testRealmResource().clients().findAll();
-        for (ClientRepresentation client : toRemove) {
-            if (client.getName() != null && client.getName().startsWith(CLIENT_PREFIX)) {
-                testRealmResource().clients().get(client.getId()).remove();
-            }
-        }
-    }
-
-    @Before
-    public void removeProviders() {
-        List<IdentityProviderRepresentation> toRemove = testRealmResource().identityProviders().findAll();
-        for (IdentityProviderRepresentation idp : toRemove) {
-            testRealmResource().identityProviders().get(idp.getInternalId()).remove();
-        }
-    }
-
-    @Before
-    public void removeRealmRoles() {
-        List<RoleRepresentation> toRemove = testRealmResource().roles().list();
-        for (RoleRepresentation role : toRemove) {
-            if (role.getName().startsWith(REALM_ROLE_PREFIX)) {
-                testRealmResource().roles().get(role.getName()).remove();
-            }
-        }
-    }
-
-    @Before
-    public void removeClientRoles() {
-        List<RoleRepresentation> toRemove = clientRolesClient().roles().list();
-        for (RoleRepresentation role : toRemove) {
-            if (role.getName().startsWith(CLIENT_ROLE_PREFIX)) {
-                testRealmResource().clients().get(CLIENT_ROLES_CLIENT).roles().get(role.getName()).remove();
-            }
-        }
-    }
-
-    private ClientResource clientRolesClient() {
-        return ApiUtil.findClientResourceByName(testRealmResource(), CLIENT_ROLES_CLIENT);
-    }
-
-    private void setFail() {
-        piRep.setIfResourceExists(Policy.FAIL.toString());
-    }
-
-    private void setSkip() {
-        piRep.setIfResourceExists(Policy.SKIP.toString());
-    }
-
-    private void setOverwrite() {
-        piRep.setIfResourceExists(Policy.OVERWRITE.toString());
-    }
-
-    private PartialImportResults doImport() {
-        try (Response response = testRealmResource().partialImport(piRep)) {
-            return response.readEntity(PartialImportResults.class);
-        }
-    }
-
-    private void addUsers() {
-        List<UserRepresentation> users = new ArrayList<>();
-
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            UserRepresentation user = createUserRepresentation(USER_PREFIX + i, USER_PREFIX + i + "@foo.com", "foo", "bar", true);
-            users.add(user);
-        }
-
-        piRep.setUsers(users);
-    }
-
-    private void addUsersWithIds() {
-        List<UserRepresentation> users = new ArrayList<>();
-
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            UserRepresentation user = createUserRepresentation(UUID.randomUUID().toString(), USER_PREFIX + i, USER_PREFIX + i + "@foo.com", "foo", "bar", null, true);
-            users.add(user);
-        }
-
-        piRep.setUsers(users);
-    }
-
-    private void addUsersWithTermsAndConditions() {
-        List<UserRepresentation> users = new ArrayList<>();
-        List<String> requiredActions = new ArrayList<>();
-        requiredActions.add(UserModel.RequiredAction.TERMS_AND_CONDITIONS.name());
-
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            UserRepresentation user = createUserRepresentation(USER_PREFIX + i, USER_PREFIX + i + "@foo.com", "foo", "bar", true);
-            user.setRequiredActions(requiredActions);
-            users.add(user);
-        }
-
-        piRep.setUsers(users);
-    }
-
-    private void addGroups() {
-        List<GroupRepresentation> groups = new ArrayList<>();
-
-        for (int i=0; i < NUM_ENTITIES; i++) {
-            GroupRepresentation group = new GroupRepresentation();
-            group.setName(GROUP_PREFIX + i);
-            group.setPath("/" + GROUP_PREFIX + i);
-            groups.add(group);
-        }
-
-        piRep.setGroups(groups);
-    }
-
-    private void addClients(boolean withServiceAccounts) {
-        List<ClientRepresentation> clients = new ArrayList<>();
-        List<UserRepresentation> serviceAccounts = new ArrayList<>();
-
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            ClientRepresentation client = new ClientRepresentation();
-            client.setClientId(CLIENT_PREFIX + i);
-            client.setName(CLIENT_PREFIX + i);
-            clients.add(client);
-            if (withServiceAccounts) {
-                client.setServiceAccountsEnabled(true);
-                client.setBearerOnly(false);
-                client.setPublicClient(false);
-                client.setAuthorizationSettings(resourceServerSampleSettings);
-                client.setAuthorizationServicesEnabled(true);
-                // create the user service account
-                UserRepresentation serviceAccount = new UserRepresentation();
-                serviceAccount.setUsername(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + client.getClientId());
-                serviceAccount.setEnabled(true);
-                serviceAccount.setEmail(serviceAccount.getUsername() + "@placeholder.org");
-                serviceAccount.setServiceAccountClientId(client.getClientId());
-                serviceAccounts.add(serviceAccount);
-            }
-        }
-
-        if (withServiceAccounts) {
-            if (piRep.getUsers() == null) {
-                piRep.setUsers(new ArrayList<>());
-            }
-            piRep.getUsers().addAll(serviceAccounts);
-        }
-        piRep.setClients(clients);
-    }
-
-    private void addProviders() {
-        addProviders(false);
-    }
-
-    private void addProviders(boolean withMappers) {
-        List<IdentityProviderRepresentation> providers = new ArrayList<>();
-        List<IdentityProviderMapperRepresentation> mappers = new ArrayList<>();
-
-        for (String alias : IDP_ALIASES) {
-            IdentityProviderRepresentation idpRep = new IdentityProviderRepresentation();
-            idpRep.setAlias(alias);
-            idpRep.setProviderId(alias);
-            idpRep.setEnabled(true);
-            idpRep.setAuthenticateByDefault(false);
-            idpRep.setFirstBrokerLoginFlowAlias("first broker login");
-
-            Map<String, String> config = new HashMap<>();
-            config.put("clientSecret", "secret");
-            config.put("clientId", alias);
-            idpRep.setConfig(config);
-            providers.add(idpRep);
-
-            if(withMappers) {
-                Map<String, String> mapConfig = new HashMap<>();
-                mapConfig.put("external.role", "IDP.TEST_ROLE");
-                mapConfig.put("syncMode", "FORCE");
-                mapConfig.put("role", "TEST_ROLE");
-
-                IdentityProviderMapperRepresentation idpMapRep = new IdentityProviderMapperRepresentation();
-                idpMapRep.setName(alias+"_mapper");
-                idpMapRep.setIdentityProviderAlias(alias);
-                idpMapRep.setIdentityProviderMapper("keycloak-oidc-role-to-role-idp-mapper");
-                idpMapRep.setConfig(mapConfig);
-
-                mappers.add(idpMapRep);
-            }
-        }
-
-        piRep.setIdentityProviders(providers);
-        if (withMappers) {
-            piRep.setIdentityProviderMappers(mappers);
-        }
-    }
-
-    private void addProviderMappers() {
-        addProviders(true);
-    }
-
-    private List<RoleRepresentation> makeRoles(String prefix) {
-        List<RoleRepresentation> roles = new ArrayList<>();
-
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            RoleRepresentation role = new RoleRepresentation();
-            role.setName(prefix + i);
-            roles.add(role);
-        }
-
-        return roles;
-    }
-
-    private void addRealmRoles() {
-        RolesRepresentation roles = piRep.getRoles();
-        if (roles == null) roles = new RolesRepresentation();
-        roles.setRealm(makeRoles(REALM_ROLE_PREFIX));
-        piRep.setRoles(roles);
-    }
-
-    private void addClientRoles() {
-        RolesRepresentation roles = piRep.getRoles();
-        if (roles == null) roles = new RolesRepresentation();
-        Map<String, List<RoleRepresentation>> clientRolesMap = new HashMap<>();
-        clientRolesMap.put(CLIENT_ROLES_CLIENT, makeRoles(CLIENT_ROLE_PREFIX));
-        roles.setClient(clientRolesMap);
-        piRep.setRoles(roles);
-    }
-
-    @Test
-    public void testAddUsers() {
-        assertAdminEvents.clear();
-
-        setFail();
-        addUsers();
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        // Need to do this way as admin events from partial import are unsorted
-        Set<String> userIds = new HashSet<>();
-        for (int i=0 ; i<NUM_ENTITIES ; i++) {
-            AdminEventRepresentation adminEvent = assertAdminEvents.poll();
-            Assert.assertEquals(realmId, adminEvent.getRealmId());
-            Assert.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
-            Assert.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
-            assertThat(adminEvent.getResourceType(), equalTo(org.keycloak.events.admin.ResourceType.REALM.name()));
-            String userId = adminEvent.getResourcePath().substring(6);
-            userIds.add(userId);
-        }
-
-        assertAdminEvents.assertEmpty();
-
-
-        for (PartialImportResult result : results.getResults()) {
-            String id = result.getId();
-            UserResource userRsc = testRealmResource().users().get(id);
-            UserRepresentation user = userRsc.toRepresentation();
-            assertThat(user.getUsername(), startsWith(USER_PREFIX));
-            assertThat(userIds, hasItem(id));
-        }
-    }
-
-    @Test
-    public void testAddUsersWithIds() {
-        assertAdminEvents.clear();
-
-        setFail();
-        addUsersWithIds();
-
-        Set<String> userRepIds = new HashSet<>();
-        for (UserRepresentation userRep : piRep.getUsers()) {
-            userRepIds.add(userRep.getId());
-        }
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        // Need to do this way as admin events from partial import are unsorted
-        Set<String> userIds = new HashSet<>();
-        for (int i=0 ; i<NUM_ENTITIES ; i++) {
-            AdminEventRepresentation adminEvent = assertAdminEvents.poll();
-            Assert.assertEquals(realmId, adminEvent.getRealmId());
-            Assert.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
-            Assert.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
-            assertThat(adminEvent.getResourceType(), equalTo(org.keycloak.events.admin.ResourceType.REALM.name()));
-            String userId = adminEvent.getResourcePath().substring(6);
-            userIds.add(userId);
-            assertThat(userRepIds, hasItem(userId));
-        }
-
-        assertAdminEvents.assertEmpty();
-
-        for (PartialImportResult result : results.getResults()) {
-            String id = result.getId();
-            UserResource userRsc = testRealmResource().users().get(id);
-            UserRepresentation user = userRsc.toRepresentation();
-            assertThat(user.getUsername(), startsWith(USER_PREFIX));
-            assertThat(userIds, hasItem(id));
-            assertThat(userRepIds, hasItem(id));
-        }
-    }
-
-    @Test
-    public void testAddUsersWithDuplicateEmailsForbidden() {
-        assertAdminEvents.clear();
-
-        setFail();
-        addUsers();
-        
-        UserRepresentation user = createUserRepresentation(USER_PREFIX + 999, USER_PREFIX + 1 + "@foo.com", "foo", "bar", true);
-        piRep.getUsers().add(user);
-
-        try (Response response = testRealmResource().partialImport(piRep)) {
-            assertEquals(409, response.getStatus());
-        }
-    }
-    
-    @Test
-    public void testAddUsersWithDuplicateEmailsAllowed() {
-        
-        RealmRepresentation realmRep = testRealmResource().toRepresentation();
-        realmRep.setDuplicateEmailsAllowed(true);
-        testRealmResource().update(realmRep);
-                
-        assertAdminEvents.clear();
-
-        setFail();
-        addUsers();
-        doImport();
-        
-        UserRepresentation user = createUserRepresentation(USER_PREFIX + 999, USER_PREFIX + 1 + "@foo.com", "foo", "bar", true);
-        piRep.setUsers(List.of(user));
-        
-        PartialImportResults results = doImport();
-        assertEquals(1, results.getAdded());
-    }
-
-    @Test
-    public void testAddUsersWithTermsAndConditions() {
-        assertAdminEvents.clear();
-
-        setFail();
-        addUsersWithTermsAndConditions();
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        // Need to do this way as admin events from partial import are unsorted
-        Set<String> userIds = new HashSet<>();
-        for (int i=0 ; i<NUM_ENTITIES ; i++) {
-            AdminEventRepresentation adminEvent = assertAdminEvents.poll();
-            Assert.assertEquals(realmId, adminEvent.getRealmId());
-            Assert.assertEquals(OperationType.CREATE.name(), adminEvent.getOperationType());
-            Assert.assertTrue(adminEvent.getResourcePath().startsWith("users/"));
-            String userId = adminEvent.getResourcePath().substring(6);
-            userIds.add(userId);
-        }
-
-        assertAdminEvents.assertEmpty();
-
-        for (PartialImportResult result : results.getResults()) {
-            String id = result.getId();
-            UserResource userRsc = testRealmResource().users().get(id);
-            UserRepresentation user = userRsc.toRepresentation();
-            assertTrue(user.getUsername().startsWith(USER_PREFIX));
-            Assert.assertTrue(userIds.contains(id));
-            assertThat(user.getRequiredActions(), contains(TermsAndConditions.PROVIDER_ID));
-        }
-    }
-
-    @Test
-    public void testAddClients() {
-        setFail();
-        addClients(false);
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        for (PartialImportResult result : results.getResults()) {
-            String id = result.getId();
-            ClientResource clientRsc = testRealmResource().clients().get(id);
-            ClientRepresentation client = clientRsc.toRepresentation();
-            assertTrue(client.getName().startsWith(CLIENT_PREFIX));
-        }
-    }
-
-    @Test
-    public void testAddClientsWithServiceAccountsAndAuthorization() {
-        setFail();
-        addClients(true);
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getAdded());
-
-        for (PartialImportResult result : results.getResults()) {
-            if (result.getResourceType().equals(ResourceType.CLIENT)) {
-                String id = result.getId();
-                ClientResource clientRsc = testRealmResource().clients().get(id);
-                ClientRepresentation client = clientRsc.toRepresentation();
-                assertTrue(client.getName().startsWith(CLIENT_PREFIX));
-                Assert.assertTrue(client.isServiceAccountsEnabled());
-                if (ProfileAssume.isFeatureEnabled(AUTHORIZATION)) {
-                    Assert.assertTrue(client.getAuthorizationServicesEnabled());
-                    AuthorizationResource authRsc = clientRsc.authorization();
-                    ResourceServerRepresentation authRep = authRsc.exportSettings();
-                    Assert.assertNotNull(authRep);
-                    Assert.assertEquals(2, authRep.getResources().size());
-                    Assert.assertEquals(3, authRep.getPolicies().size());
-                } else {
-                    Assert.assertNull(client.getAuthorizationServicesEnabled());
-                }
-            } else {
-                UserResource userRsc = testRealmResource().users().get(result.getId());
-                Assert.assertTrue(userRsc.toRepresentation().getUsername().startsWith(
-                        ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX));
-            }
-        }
-    }
-
-    @Test
-    public void testAddProviders() {
-        setFail();
-        addProviders();
-
-        PartialImportResults results = doImport();
-        assertEquals(IDP_ALIASES.length, results.getAdded());
-
-        for (PartialImportResult result : results.getResults()) {
-            String id = result.getId();
-            IdentityProviderResource idpRsc = testRealmResource().identityProviders().get(id);
-            IdentityProviderRepresentation idp = idpRsc.toRepresentation();
-            Map<String, String> config = idp.getConfig();
-            assertTrue(Arrays.asList(IDP_ALIASES).contains(config.get("clientId")));
-        }
-    }
-
-    @Test
-    public void testAddProviderMappers() {
-        setFail();
-        addProviderMappers();
-
-        PartialImportResults results = doImport();
-        assertEquals(IDP_ALIASES.length*2, results.getAdded());
-
-        for (PartialImportResult result : results.getResults()) {
-            if (ResourceType.IDP.equals(result.getResourceType())) {
-                String id = result.getId();
-                IdentityProviderResource idpRsc = testRealmResource().identityProviders().get(id);
-                IdentityProviderMapperRepresentation idpMap = idpRsc.getMappers().get(0);
-                String alias = idpMap.getIdentityProviderAlias();
-                assertTrue(Arrays.asList(IDP_ALIASES).contains(alias));
-                assertEquals(alias + "_mapper", idpMap.getName());
-                assertEquals("keycloak-oidc-role-to-role-idp-mapper", idpMap.getIdentityProviderMapper());
-                assertEquals("IDP.TEST_ROLE", idpMap.getConfig().get("external.role"));
-                assertEquals("FORCE", idpMap.getConfig().get("syncMode"));
-                assertEquals("TEST_ROLE", idpMap.getConfig().get("role"));
-            }
-        }
-    }
-
-    @Test
-    public void testAddRealmRoles() {
-        setFail();
-        addRealmRoles();
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        for (PartialImportResult result : results.getResults()) {
-            String name = result.getResourceName();
-            RoleResource roleRsc = testRealmResource().roles().get(name);
-            RoleRepresentation role = roleRsc.toRepresentation();
-            assertTrue(role.getName().startsWith(REALM_ROLE_PREFIX));
-        }
-    }
-
-    @Test
-    public void testAddClientRoles() {
-        setFail();
-        addClientRoles();
-
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES, results.getAdded());
-
-        List<RoleRepresentation> clientRoles = clientRolesClient().roles().list();
-        assertEquals(NUM_ENTITIES, clientRoles.size());
-
-        for (RoleRepresentation roleRep : clientRoles) {
-            assertTrue(roleRep.getName().startsWith(CLIENT_ROLE_PREFIX));
-        }
-    }
-
-    private void testFail() {
-        setFail();
-        PartialImportResults results = doImport();
-        assertNull(results.getErrorMessage());
-        results = doImport(); // second time should fail
-        assertNotNull(results.getErrorMessage());
-    }
-
-    @Test
-    public void testAddUsersFail() {
-        addUsers();
-        testFail();
-    }
-
-    @Test
-    public void testAddGroupsFail() {
-        addGroups();
-        testFail();
-    }
-
-    @Test
-    public void testAddClientsFail() {
-        addClients(false);
-        testFail();
-    }
-
-    @Test
-    public void testAddProvidersFail() {
-        addProviders();
-        testFail();
-    }
-
-    @Test
-    public void testAddProviderMappersFail() {
-        addProviderMappers();
-        testFail();
-    }
-
-    @Test
-    public void testAddRealmRolesFail() {
-        addRealmRoles();
-        testFail();
-    }
-
-    @Test
-    public void testAddClientRolesFail() {
-        addClientRoles();
-        testFail();
-    }
-
-    private void testSkip() {
-        testSkip(NUM_ENTITIES);
-    }
-
-    private void testSkip(int numberEntities) {
-        setSkip();
-        PartialImportResults results = doImport();
-        assertEquals(numberEntities, results.getAdded());
-
-        results = doImport();
-        assertEquals(numberEntities, results.getSkipped());
-    }
-
-    @Test
-    public void testAddUsersSkip() {
-        addUsers();
-        testSkip();
-    }
-
-    @Test
-    public void testAddGroupsSkip() {
-        addGroups();
-        testSkip();
-    }
-
-    @Test
-    public void testAddClientsSkip() {
-        addClients(false);
-        testSkip();
-    }
-
-    @Test
-    public void testAddClientsSkipWithServiceAccountsAndAuthorization() {
-        addClients(true);
-        setSkip();
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getAdded());
-
-        results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getSkipped());
-    }
-
-    @Test
-    public void testAddProvidersSkip() {
-        addProviders();
-        testSkip();
-    }
-
-    @Test
-    public void testAddProviderMappersSkip() {
-        addProviderMappers();
-        testSkip(NUM_ENTITIES*2);
-    }
-
-    @Test
-    public void testAddRealmRolesSkip() {
-        addRealmRoles();
-        testSkip();
-    }
-
-    @Test
-    public void testAddClientRolesSkip() {
-        addClientRoles();
-        testSkip();
-    }
-
-    private void testOverwrite() {
-        testOverwrite(NUM_ENTITIES);
-    }
-
-    private void testOverwrite(int numberEntities) {
-        setOverwrite();
-        PartialImportResults results = doImport();
-        assertEquals(numberEntities, results.getAdded());
-
-        results = doImport();
-        assertEquals(numberEntities, results.getOverwritten());
-    }
-
-    @Test
-    public void testAddUsersOverwrite() {
-        addUsers();
-        testOverwrite();
-    }
-
-    @Test
-    public void testAddGroupsOverwrite() {
-        addGroups();
-        testOverwrite();
-    }
-
-    @Test
-    public void testAddClientsOverwrite() {
-        addClients(false);
-        testOverwrite();
-    }
-
-    @Test
-    public void testAddClientsOverwriteWithServiceAccountsAndAuthorization() {
-        addClients(true);
-        setOverwrite();
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getAdded());
-
-        results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getOverwritten());
-    }
-
-    @Test
-    public void testAddClientsOverwriteServiceAccountsWithNoServiceAccounts() {
-        addClients(true);
-        setOverwrite();
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * 2, results.getAdded());
-        // check the service accounts are there
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            List<UserRepresentation> l = testRealmResource().users().search(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX + i);
-            Assert.assertEquals(1, l.size());
-        }
-        // re-import without service accounts enabled
-        piRep = new PartialImportRepresentation();
-        addClients(false);
-        setOverwrite();
-        results = doImport();
-        assertEquals(NUM_ENTITIES, results.getOverwritten());
-        // check the service accounts have been removed
-        for (int i = 0; i < NUM_ENTITIES; i++) {
-            List<UserRepresentation> l = testRealmResource().users().search(ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + CLIENT_PREFIX + i);
-            Assert.assertEquals(0, l.size());
-        }
-    }
-
-    @Test
-    public void testAddProvidersOverwrite() {
-        addProviders();
-        testOverwrite();
-    }
-
-    @Test
-    public void testAddProviderMappersOverwrite() {
-        addProviderMappers();
-        testOverwrite(NUM_ENTITIES*2);
-    }
-
-    @Test
-    public void testAddRealmRolesOverwrite() {
-        addRealmRoles();
-        testOverwrite();
-    }
-
-    @Test
-    public void testAddClientRolesOverwrite() {
-        addClientRoles();
-        testOverwrite();
-    }
-
-    private void importEverything(boolean withServiceAccounts) {
-        addUsers();
-        addGroups();
-        addClients(withServiceAccounts);
-        addProviders();
-        addRealmRoles();
-        addClientRoles();
-
-        PartialImportResults results = doImport();
-        assertNull(results.getErrorMessage());
-        if (withServiceAccounts) {
-            assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getAdded());
-        } else {
-            assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getAdded());
-        }
-    }
-
-    @Test
-    public void testEverythingFail() {
-        setFail();
-        importEverything(false);
-        PartialImportResults results = doImport(); // second import will fail because not allowed to skip or overwrite
-        assertNotNull(results.getErrorMessage());
-    }
-
-    @Test
-    public void testEverythingSkip() {
-        setSkip();
-        importEverything(false);
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getSkipped());
-    }
-
-    @Test
-    public void testEverythingSkipWithServiceAccounts() {
-        setSkip();
-        importEverything(true);
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getSkipped());
-    }
-
-    @Test
-    public void testEverythingOverwrite() {
-        setOverwrite();
-        importEverything(false);
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * NUM_RESOURCE_TYPES, results.getOverwritten());
-    }
-
-    @Test
-    public void testEverythingOverwriteWithServiceAccounts() {
-        setOverwrite();
-        importEverything(true);
-        PartialImportResults results = doImport();
-        assertEquals(NUM_ENTITIES * (NUM_RESOURCE_TYPES + 1), results.getOverwritten());
-    }
-
-    //KEYCLOAK-3042
-    @Test
-    public void testOverwriteExistingClientWithRoles() {
-        setOverwrite();
-
-        ClientRepresentation client = adminClient.realm(MASTER).clients().findByClientId("broker").get(0);
-        List<RoleRepresentation> clientRoles = adminClient.realm(MASTER).clients().get(client.getId()).roles().list();
-        
-        Map<String, List<RoleRepresentation>> clients = new HashMap<>();
-        clients.put(client.getClientId(), clientRoles);
-        
-        RolesRepresentation roles = new RolesRepresentation();
-        roles.setClient(clients);
-        
-        piRep.setClients(List.of(client));
-        piRep.setRoles(roles);
-                
-        doImport();
-    }
-
-    // KEYCLOAK-6058
-    @Test
-    public void testOverwriteExistingInternalClient() {
-        setOverwrite();
-        ClientRepresentation client = adminClient.realm(MASTER).clients().findByClientId("security-admin-console").get(0);
-        ClientRepresentation client2 = adminClient.realm(MASTER).clients().findByClientId("master-realm").get(0);
-        piRep.setClients(Arrays.asList(client, client2));
-
-        PartialImportResults result = doImport();
-        Assert.assertEquals(0, result.getOverwritten());
-    }
-
-    @Test
-    public void testOverwriteExistingClientWithServiceAccount() {
-        setOverwrite();
-        piRep.setClients(Collections.singletonList(testRealmResource().clients().findByClientId(CLIENT_SERVICE_ACCOUNT).get(0)));
-
-        Assert.assertEquals(1, doImport().getOverwritten());
-
-        ClientRepresentation client = testRealmResource().clients().findByClientId(CLIENT_SERVICE_ACCOUNT).get(0);
-        testRealmResource().clients().get(client.getId()).getServiceAccountUser();
-    }
-
-    @Test
-    public void testOverwriteDefaultRole() {
-        setOverwrite();
-
-        RolesRepresentation roles = new RolesRepresentation();
-        RoleRepresentation oldDefaultRole = testRealmResource().toRepresentation().getDefaultRole();
-        roles.setRealm(Collections.singletonList(oldDefaultRole));
-        piRep.setRoles(roles);
-
-        Assert.assertEquals("default role should have been overwritten", 1, doImport().getOverwritten());
-        // The following check is not valid anymore since file store does have the same ID
-        // Assert.assertNotEquals("when overwriting, the ID of the role changes",
-        //        testRealmResource().toRepresentation().getDefaultRole().getId(), oldDefaultRole.getId());
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
index 3e7a8c4efb7b..16e52e98f342 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
@@ -38,6 +38,7 @@
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.events.log.JBossLoggingEventListenerProviderFactory;
 import org.keycloak.models.AdminRoles;
+import org.keycloak.models.BrowserSecurityHeaders;
 import org.keycloak.models.CibaConfig;
 import org.keycloak.models.Constants;
 import org.keycloak.models.OAuth2DeviceConfig;
@@ -73,7 +74,7 @@
 import org.keycloak.testsuite.util.AdminEventPaths;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.CredentialBuilder;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.utils.tls.TLSUtils;
@@ -105,6 +106,7 @@
 import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThrows;
@@ -332,6 +334,13 @@ public void excludesFieldsFromAttributes() {
     public void testFieldNotErased() {
         Long dummyLong = Long.valueOf(999);
         Integer dummyInt = Integer.valueOf(999);
+        Map<String, String> browserSecurityHeaders = new HashMap<>(Arrays.stream(
+                BrowserSecurityHeaders.values()).collect(Collectors.toMap(
+                BrowserSecurityHeaders::getKey,
+                headerValue -> headerValue.getDefaultValue().isBlank()
+                        ? "non-null-to-test"
+                        : headerValue.getDefaultValue()
+        )));
 
         RealmRepresentation rep = new RealmRepresentation();
         rep.setRealm("attributes");
@@ -350,6 +359,7 @@ public void testFieldNotErased() {
         rep.setActionTokenGeneratedByUserLifespan(dummyInt);
         rep.setOfflineSessionMaxLifespanEnabled(true);
         rep.setOfflineSessionMaxLifespan(dummyInt);
+        rep.setBrowserSecurityHeaders(browserSecurityHeaders);
 
         rep.setWebAuthnPolicyRpEntityName("RP_ENTITY_NAME");
         rep.setWebAuthnPolicySignatureAlgorithms(Collections.singletonList("RS256"));
@@ -418,12 +428,15 @@ public void testFieldNotErased() {
         assertEquals(dummyInt, rep.getWebAuthnPolicyPasswordlessCreateTimeout());
         assertTrue(rep.isWebAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister());
         assertEquals(Collections.singletonList("00000000-0000-0000-0000-000000000000"), rep.getWebAuthnPolicyPasswordlessAcceptableAaguids());
+
+        assertEquals(browserSecurityHeaders, rep.getBrowserSecurityHeaders());
     }
 
     @Test
     public void smtpPasswordSecret() {
         RealmRepresentation rep = RealmBuilder.create().testEventListener().testMail().build();
         rep.setRealm("realm-with-smtp");
+        rep.getSmtpServer().put("auth", "true");
         rep.getSmtpServer().put("user", "user");
         rep.getSmtpServer().put("password", "secret");
 
@@ -450,6 +463,19 @@ public void smtpPasswordSecret() {
 
         RealmRepresentation realm = adminClient.realms().findAll().stream().filter(r -> r.getRealm().equals("realm-with-smtp")).findFirst().get();
         assertEquals(ComponentRepresentation.SECRET_VALUE, realm.getSmtpServer().get("password"));
+
+        // updating setting the secret value with asterisks
+        rep.getSmtpServer().put("password", ComponentRepresentation.SECRET_VALUE);
+        adminClient.realm("realm-with-smtp").update(rep);
+
+        event = testingClient.testing().pollAdminEvent();
+        assertTrue(event.getRepresentation().contains(ComponentRepresentation.SECRET_VALUE));
+
+        internalRep = serverClient.fetch(RunHelpers.internalRealm());
+        assertEquals("secret", internalRep.getSmtpServer().get("password"));
+
+        realm = adminClient.realm("realm-with-smtp").toRepresentation();
+        assertEquals(ComponentRepresentation.SECRET_VALUE, realm.getSmtpServer().get("password"));
     }
 
     @Test
@@ -1005,7 +1031,7 @@ public void logoutAll() {
         realm.users().get(userId).resetPassword(CredentialBuilder.create().password("password").build());
         assertAdminEvents.assertEvent(realmId, OperationType.ACTION, AdminEventPaths.userResetPasswordPath(userId), ResourceType.USER);
 
-        oauth.doLogin("user", "password");
+        oauth.doPasswordGrantRequest("user", "password");
 
         GlobalRequestResult globalRequestResult = realm.logoutAll();
         assertAdminEvents.assertEvent(realmId, OperationType.ACTION, "logout-all", globalRequestResult, ResourceType.REALM);
@@ -1022,7 +1048,7 @@ public void deleteSession() {
         setupTestAppAndUser();
 
         oauth.doLogin("testuser", "password");
-        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get(OAuth2Constants.CODE), "secret");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
         assertEquals(200, tokenResponse.getStatusCode());
 
         EventRepresentation event = events.poll();
@@ -1038,7 +1064,7 @@ public void deleteSession() {
             assertAdminEvents.assertEmpty();
         }
 
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret");
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertEquals(400, tokenResponse.getStatusCode());
         assertEquals("Session not active", tokenResponse.getErrorDescription());
     }
@@ -1053,8 +1079,7 @@ public void clientSessionStats() {
         System.out.println(sessionStats.size());
 
         oauth.doLogin("testuser", "password");
-        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get(OAuth2Constants.CODE),
-            "secret");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
         assertEquals(200, tokenResponse.getStatusCode());
 
         sessionStats = realm.getClientSessionStats();
@@ -1141,6 +1166,7 @@ private void setupTestAppAndUser() {
         assertAdminEvents.assertEvent(realmId, OperationType.CREATE, AdminEventPaths.clientResourcePath(clientDbId), client, ResourceType.CLIENT);
 
         oauth.realm(REALM_NAME);
+        oauth.client("test-app", "secret");
         oauth.redirectUri(redirectUri);
 
         UserRepresentation userRep = UserBuilder.create().username("testuser").build();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AttributeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AttributeTest.java
index b61f6c438863..90c57e5e65da 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AttributeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AttributeTest.java
@@ -22,7 +22,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
-import java.net.InetAddress;
+import java.net.Inet4Address;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.util.Collection;
@@ -68,7 +68,7 @@ public void accept(String name) {
 
         assertEquals(new SimpleDateFormat("dd/MM/yyyy").parse("12/12/2016"), attributes.getValue("date").asDate(0, "dd/MM/yyyy"));
 
-        assertEquals(InetAddress.getLoopbackAddress(), attributes.getValue("ip_network_address").asInetAddress(0));
-        assertEquals(InetAddress.getLoopbackAddress(), attributes.getValue("host_network_address").asInetAddress(0));
+        assertEquals("127.0.0.1", attributes.getValue("ip_network_address").asInetAddress(0).getHostAddress());
+        assertEquals("localhost", attributes.getValue("host_network_address").asInetAddress(0).getHostName());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthorizationAPITest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthorizationAPITest.java
index ff16398bab76..ca3f5c1342ea 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthorizationAPITest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthorizationAPITest.java
@@ -49,7 +49,7 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.RolesBuilder;
@@ -213,7 +213,7 @@ public void testResourceServerAsAudience(String clientId, String resourceServerC
 
         request.setResourceId("Resource A");
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(clientId).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(clientId, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         String ticket = authzClient.protection().permission().create(request).getTicket();
 
         // Ticket is opaque to client or resourceServer. The audience should be just an authorization server itself
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzEndpointRequestParserTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzEndpointRequestParserTest.java
index 70390d5ead1b..95b4a7c05e90 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzEndpointRequestParserTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/AuthzEndpointRequestParserTest.java
@@ -8,9 +8,6 @@
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.RealmBuilder;
-
-import java.util.HashMap;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
@@ -28,14 +25,15 @@ public void test_authentication_backwards_compatible() {
 
         try (Client client = AdminClientUtil.createResteasyClient()) {
 
-            oauth.addCustomParameter("paramkey1_too_long", RandomStringUtils.random(2000 + 1));
-            oauth.addCustomParameter("paramkey2", "paramvalue2");
-            oauth.addCustomParameter("paramkey3", "paramvalue3");
-            oauth.addCustomParameter("paramkey4", "paramvalue4");
-            oauth.addCustomParameter("paramkey5", "paramvalue5");
-            oauth.addCustomParameter("paramkey6_too_many", "paramvalue6");
+            String loginUrl = oauth.loginForm()
+                    .param("paramkey1_too_long", RandomStringUtils.random(2000 + 1))
+                    .param("paramkey2", "paramvalue2")
+                    .param("paramkey3", "paramvalue3")
+                    .param("paramkey4", "paramvalue4")
+                    .param("paramkey5", "paramvalue5")
+                    .param("paramkey6_too_many", "paramvalue6").build();
 
-            try (Response response = client.target(oauth.getLoginFormUrl()).request().get()) {
+            try (Response response = client.target(loginUrl).request().get()) {
 
                 assertThat(response.getStatus(), is(equalTo(200)));
                 assertThat(response, Matchers.body(containsString("Sign in")));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/EntitlementAPITest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/EntitlementAPITest.java
index cdd36b7064db..29ff122cbe9c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/EntitlementAPITest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/EntitlementAPITest.java
@@ -16,7 +16,9 @@
  */
 package org.keycloak.testsuite.authz;
 
+import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.hasItem;
+import static org.hamcrest.CoreMatchers.is;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -35,7 +37,6 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
 
@@ -96,7 +97,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.RolesBuilder;
@@ -242,8 +243,8 @@ public void testInvalidRequestWithClaimsFromPublicClient() throws IOException {
         oauth.doLogin("marta", "password");
 
         // Token request
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -269,8 +270,8 @@ public void testRequestWithoutClaimsFromPublicClient() {
         oauth.doLogin("marta", "password");
 
         // Token request
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -414,6 +415,110 @@ public void testPairwiseResourceServerAsAudienceWithPairwiseClient() throws Exce
                 PAIRWISE_AUTHZ_CLIENT_CONFIG);
     }
 
+    @Test
+    public void testResolveResourcesWithSameUri() throws Exception {
+        ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
+        AuthorizationResource authorization = client.authorization();
+        List<ResourceRepresentation> defaultResource = authorization.resources().findByName("Default Resource");
+        assertThat(defaultResource.isEmpty(), is(false));
+        authorization.resources().resource(defaultResource.get(0).getId()).remove();
+
+        JSPolicyRepresentation policy = new JSPolicyRepresentation();
+        policy.setName(KeycloakModelUtils.generateId());
+        policy.setType("script-scripts/default-policy.js");
+        authorization.policies().js().create(policy).close();
+
+        ResourceRepresentation resource = new ResourceRepresentation();
+        resource.setName("Resource A");
+        resource.addScope("read");
+        resource.setUris(Set.of("/resource"));
+        authorization.resources().create(resource).close();
+
+        resource = new ResourceRepresentation();
+        resource.setName("Resource B");
+        resource.addScope("write");
+        resource.setUris(Set.of("/resource"));
+        authorization.resources().create(resource).close();
+
+        ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
+
+        permission.setName("Can Access Resource A");
+        permission.setResources(Set.of("Resource A"));
+        permission.addPolicy(policy.getName());
+
+        authorization.permissions().resource().create(permission).close();
+
+        permission = new ResourcePermissionRepresentation();
+
+        permission.setName("Can Access Resource B");
+        permission.setResources(Set.of("Resource B"));
+
+        authorization.permissions().resource().create(permission).close();
+
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
+        AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
+        AuthorizationRequest request = new AuthorizationRequest();
+
+        request.addPermission("/resource", "read");
+        Metadata metadata = new Metadata();
+        metadata.setPermissionResourceMatchingUri(true);
+        metadata.setPermissionResourceFormat("uri");
+        request.setMetadata(metadata);
+        authzClient.authorization(accessToken).authorize(request);
+
+        request = new AuthorizationRequest();
+        request.addPermission("/resource", "write");
+        request.setMetadata(metadata);
+        try {
+            authzClient.authorization(accessToken).authorize(request);
+            fail("should fail");
+        } catch (AuthorizationDeniedException ignore) {
+
+        }
+
+        request = new AuthorizationRequest();
+        request.addPermission("/resource", "write");
+        request.addPermission("/unknown", "write");
+        request.setMetadata(metadata);
+        try {
+            authzClient.authorization(accessToken).authorize(request);
+            fail("should fail");
+        } catch (Exception e) {
+            HttpResponseException cause = (HttpResponseException) e.getCause();
+            assertThat(cause.getStatusCode(), is(Response.Status.BAD_REQUEST.getStatusCode()));
+            assertThat(new String(cause.getBytes()), containsString("Resource with uri [/unknown] does not exist."));
+        }
+
+        request = new AuthorizationRequest();
+        request.addPermission("/resource", "write");
+        request.addPermission("/resource", "read");
+        request.setMetadata(metadata);
+        authzClient.authorization(accessToken).authorize(request);
+
+        request = new AuthorizationRequest();
+        request.addPermission("/unknown", "write");
+        try {
+            authzClient.authorization(accessToken).authorize(request);
+            fail("should fail");
+        } catch (Exception hre) {
+            HttpResponseException cause = (HttpResponseException) hre.getCause();
+            assertThat(cause.getStatusCode(), is(Response.Status.BAD_REQUEST.getStatusCode()));
+            assertThat(new String(cause.getBytes()), containsString("Resource with id [/unknown] does not exist."));
+        }
+
+        request = new AuthorizationRequest();
+        request.addPermission("/unknown", "write");
+        request.setMetadata(metadata);
+        try {
+            authzClient.authorization(accessToken).authorize(request);
+            fail("should fail");
+        } catch (Exception hre) {
+            HttpResponseException cause = (HttpResponseException) hre.getCause();
+            assertThat(cause.getStatusCode(), is(Response.Status.BAD_REQUEST.getStatusCode()));
+            assertThat(new String(cause.getBytes()), containsString("Resource with uri [/unknown] does not exist."));
+        }
+    }
+
     @Test
     public void testObtainAllEntitlements() throws Exception {
         ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
@@ -447,7 +552,7 @@ public void testObtainAllEntitlements() throws Exception {
         assertTrue(hasPermission("marta", "password", resource.getId()));
         assertFalse(hasPermission("kolo", "password", resource.getId()));
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         PermissionResponse permissionResponse = authzClient.protection().permission().create(new PermissionRequest(resource.getId()));
         AuthorizationRequest request = new AuthorizationRequest();
@@ -479,7 +584,7 @@ public void testObtainAllEntitlements() throws Exception {
         // the addition of a new scope still grants access to resource and any scope
         assertFalse(hasPermission("kolo", "password", resource.getId()));
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         permissionResponse = authzClient.protection().permission().create(new PermissionRequest(resource.getId(), "Scope A"));
         request = new AuthorizationRequest();
 
@@ -580,7 +685,7 @@ public void testObtainAllEntitlementsInvalidResource() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -635,7 +740,7 @@ public void testObtainAllEntitlementsInvalidScope() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -701,7 +806,7 @@ public void testObtainAllEntitlementsForScope() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -783,7 +888,7 @@ public void testObtainAllEntitlementsForScopeWithDeny() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -830,7 +935,7 @@ public void testObtainAllEntitlementsForResourceWithResourcePermission() throws
 
         authorization.permissions().resource().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -932,7 +1037,7 @@ public void testObtainAllEntitlementsForResourceWithScopePermission() throws Exc
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
 
         AuthorizationRequest request = new AuthorizationRequest();
@@ -1009,7 +1114,7 @@ public void testServerDecisionStrategy() throws Exception {
         ScopePermissionsResource scopePermissions = authorization.permissions().scope();
         scopePermissions.create(scopePermission1).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
         
@@ -1202,7 +1307,7 @@ public void testObtainAllEntitlementsForResourceType() throws Exception {
 
         authorization.permissions().scope().create(scopePersmission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
 
         AuthorizationRequest request = new AuthorizationRequest();
@@ -1318,7 +1423,7 @@ public void testObtainAllEntitlementsForResourceType() throws Exception {
         permissions = toAccessToken(response.getToken()).getAuthorization().getPermissions();
         assertEquals(10, permissions.size());
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
 
         request = new AuthorizationRequest();
         request.addPermission("resource-type-owner:type-one");
@@ -1381,7 +1486,7 @@ public void testOverridePermission() throws Exception {
             martaResource = response.readEntity(ResourceRepresentation.class);
         }
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -1400,7 +1505,7 @@ public void testOverridePermission() throws Exception {
             assertThat(scopes, Matchers.containsInAnyOrder("read", "update"));
         }
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
 
         request = new AuthorizationRequest();
@@ -1515,7 +1620,7 @@ public void testOverridePermission() throws Exception {
             assertThat(scopes, Matchers.containsInAnyOrder("update"));
         }
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
 
         // marta can still access her resource
         response = authzClient.authorization(accessToken).authorize(request);
@@ -1531,7 +1636,7 @@ public void testOverridePermission() throws Exception {
         }
 
         authorization.permissions().scope().findById(martaResourceUpdatePermission.getId()).remove();
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
 
         try {
             // back to original setup, permissions not granted by the type resource
@@ -1581,7 +1686,7 @@ public void testOverrideParentScopePermission() throws Exception {
             martaResource = response.readEntity(ResourceRepresentation.class);
         }
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -1600,7 +1705,7 @@ public void testOverrideParentScopePermission() throws Exception {
             assertThat(scopes, Matchers.containsInAnyOrder("read", "update"));
         }
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
 
         request = new AuthorizationRequest();
@@ -1697,7 +1802,7 @@ public void testOverrideParentScopePermission() throws Exception {
             assertThat(scopes, Matchers.containsInAnyOrder("update"));
         }
 
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
 
         // marta can still access her resource
         response = authzClient.authorization(accessToken).authorize(request);
@@ -1713,7 +1818,7 @@ public void testOverrideParentScopePermission() throws Exception {
         }
 
         authorization.permissions().scope().findById(martaResourceUpdatePermission.getId()).remove();
-        accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
 
         try {
             // back to original setup, permissions not granted by the type resource
@@ -1929,7 +2034,7 @@ public void testOfflineRequestingPartyToken() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).scope("offline_access").doGrantAccessTokenRequest("secret", "offlineuser", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").scope("offline_access").doPasswordGrantRequest("offlineuser", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AccessTokenResponse response = authzClient.authorization(accessToken).authorize();
         assertNotNull(response.getToken());
@@ -2001,8 +2106,8 @@ public void testProcessMappersForTargetAudience() throws Exception {
         oauth.doLogin("marta", "password");
 
         // Token request
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         AccessToken token = toAccessToken(response.getAccessToken());
 
         assertEquals(PUBLIC_TEST_CLIENT, token.getOtherClaims().get("custom_claim"));
@@ -2023,12 +2128,80 @@ public void testProcessMappersForTargetAudience() throws Exception {
     }
 
     @Test
-    public void testRefreshTokenFromClientOtherThanAudience() throws Exception {
+    public void testIntrospectRPTCreatedFromOfflineTokenDifferentClient() throws Exception {
+        ClientResource publicClient = getClient(getRealm(), PUBLIC_TEST_CLIENT);
+
+        ProtocolMapperRepresentation customClaimMapper = new ProtocolMapperRepresentation();
+
+        customClaimMapper.setName("custom_claim");
+        customClaimMapper.setProtocolMapper(HardcodedClaim.PROVIDER_ID);
+        customClaimMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        Map<String, String> config = new HashMap<>();
+        config.put(OIDCAttributeMapperHelper.TOKEN_CLAIM_NAME, "custom_claim");
+        config.put(HardcodedClaim.CLAIM_VALUE, PUBLIC_TEST_CLIENT);
+        config.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+        customClaimMapper.setConfig(config);
+
+        publicClient.getProtocolMappers().createMapper(customClaimMapper);
+
+        ClientResource client = getClient(getRealm(), RESOURCE_SERVER_TEST);
+
+        config.put(HardcodedClaim.CLAIM_VALUE, RESOURCE_SERVER_TEST);
+
+        client.getProtocolMappers().createMapper(customClaimMapper);
+
+        AuthorizationResource authorization = client.authorization();
+
+        JSPolicyRepresentation policy = new JSPolicyRepresentation();
+
+        policy.setName(KeycloakModelUtils.generateId());
+        policy.setType("script-scripts/default-policy.js");
+
+        authorization.policies().js().create(policy).close();
+
+        ResourceRepresentation resource = new ResourceRepresentation();
+
+        resource.setName("Sensors");
+
+        try (Response response = authorization.resources().create(resource)) {
+            resource = response.readEntity(ResourceRepresentation.class);
+        }
+
+        ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
+
+        permission.setName("View Sensor");
+        permission.addResource(resource.getName());
+        permission.addPolicy(policy.getName());
+
+        authorization.permissions().resource().create(permission).close();
+
         oauth.realm("authz-test");
+        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
         oauth.clientId(PUBLIC_TEST_CLIENT);
+        oauth.doLogin("offlineuser", "password");
+
+        // Token request
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+
+        AuthorizationRequest request = new AuthorizationRequest();
+        request.addPermission("Sensors");
+        AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
+        AuthorizationResponse authorizationResponse = authzClient.authorization(response.getAccessToken()).authorize(request);
+        AccessToken token = toAccessToken(authorizationResponse.getToken());
+        assertEquals(PUBLIC_TEST_CLIENT, token.getIssuedFor());
+
+        TokenIntrospectionResponse introspectionResponse = authzClient.protection().introspectRequestingPartyToken(authorizationResponse.getToken());
+        assertNotNull(introspectionResponse.getPermissions());
+    }
+
+    @Test
+    public void testRefreshTokenFromClientOtherThanAudience() throws Exception {
+        oauth.realm("authz-test");
+        oauth.client(PUBLIC_TEST_CLIENT);
         oauth.doLogin("marta", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
         assertNotNull(accessTokenResponse.getAccessToken());
         assertNotNull(accessTokenResponse.getRefreshToken());
 
@@ -2040,7 +2213,7 @@ public void testRefreshTokenFromClientOtherThanAudience() throws Exception {
         assertEquals(RESOURCE_SERVER_TEST, token.getAudience()[0]);
         assertFalse(token.getAuthorization().getPermissions().isEmpty());
 
-        accessTokenResponse = oauth.doRefreshTokenRequest(authorizationResponse.getRefreshToken(), null);
+        accessTokenResponse = oauth.doRefreshTokenRequest(authorizationResponse.getRefreshToken());
         assertNotNull(accessTokenResponse.getAccessToken());
         assertNotNull(accessTokenResponse.getRefreshToken());
         token = toAccessToken(authorizationResponse.getToken());
@@ -2053,8 +2226,8 @@ public void testTokenExpirationRenewalWhenIssuingTokens() {
         oauth.realm("authz-test");
         oauth.clientId(PUBLIC_TEST_CLIENT);
         oauth.doLogin("marta", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
         assertNotNull(accessTokenResponse.getAccessToken());
         assertNotNull(accessTokenResponse.getRefreshToken());
 
@@ -2101,7 +2274,7 @@ public void testUsingExpiredToken() throws Exception {
 
         authorization.permissions().resource().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AccessTokenResponse response = authzClient.authorization(accessToken).authorize();
         assertNotNull(response.getToken());
@@ -2157,7 +2330,7 @@ public void testInvalidTokenSignature() throws Exception {
 
         authorization.permissions().resource().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -2208,7 +2381,7 @@ public void testDenyScopeNotManagedByScopePolicy() throws Exception {
 
         authorization.permissions().scope().create(permission).close();
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", "kolo", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest("kolo", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient(AUTHZ_CLIENT_CONFIG);
         AuthorizationRequest request = new AuthorizationRequest();
 
@@ -2500,7 +2673,7 @@ private void testResourceServerAsAudience(String testClientId, String resourceSe
 
         request.addPermission("Resource 1");
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId(testClientId).doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(testClientId, "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthorizationResponse response = getAuthzClient(configFile).authorization(accessToken).authorize(request);
         AccessToken rpt = toAccessToken(response.getToken());
 
@@ -2508,7 +2681,7 @@ private void testResourceServerAsAudience(String testClientId, String resourceSe
     }
 
     private boolean hasPermission(String userName, String password, String resourceId, String... scopeIds) throws Exception {
-        String accessToken = new OAuthClient().realm("authz-test").clientId(RESOURCE_SERVER_TEST).doGrantAccessTokenRequest("secret", userName, password).getAccessToken();
+        String accessToken = oauth.newConfig().realm("authz-test").client(RESOURCE_SERVER_TEST, "secret").doPasswordGrantRequest(userName, password).getAccessToken();
         AuthorizationResponse response = getAuthzClient(AUTHZ_CLIENT_CONFIG).authorization(accessToken).authorize(new AuthorizationRequest());
         AccessToken rpt = toAccessToken(response.getToken());
         Authorization authz = rpt.getAuthorization();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PermissionClaimTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PermissionClaimTest.java
index d3dc55b669d2..412fa4ffc47c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PermissionClaimTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PermissionClaimTest.java
@@ -56,7 +56,6 @@
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.RolesBuilder;
@@ -165,7 +164,7 @@ public void testPermissionWithClaims() throws Exception {
 
         request.setResourceId(resource.getName());
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.realm("authz-test").client("test-client", "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient();
         String ticket = authzClient.protection().permission().create(request).getTicket();
         AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
@@ -201,7 +200,7 @@ public void testPermissionWithClaimsDifferentPolicies() throws Exception {
 
         request.setResourceId(resource.getName());
 
-        String accessToken = new OAuthClient().realm("authz-test").clientId("test-client").doGrantAccessTokenRequest("secret", "marta", "password").getAccessToken();
+        String accessToken = oauth.realm("authz-test").client("test-client", "secret").doPasswordGrantRequest("marta", "password").getAccessToken();
         AuthzClient authzClient = getAuthzClient();
         String ticket = authzClient.protection().permission().forResource(request).getTicket();
         AuthorizationResponse response = authzClient.authorization(accessToken).authorize(new AuthorizationRequest(ticket));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PolicyEvaluationCompositeRoleTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PolicyEvaluationCompositeRoleTest.java
index 53dad7a3edf1..d00c8606c458 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PolicyEvaluationCompositeRoleTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PolicyEvaluationCompositeRoleTest.java
@@ -111,6 +111,7 @@ private static Policy createRolePolicy(AuthorizationProvider authz, ResourceServ
         String roleValues = "[{\"id\":\"" + role.getId() + "\",\"required\": true}]";
         Map<String, String> config = new HashMap<>();
         config.put("roles", roleValues);
+        config.put("fetchRoles", Boolean.TRUE.toString());
         representation.setConfig(config);
 
         return authz.getStoreFactory().getPolicyStore().create(resourceServer, representation);
@@ -130,7 +131,7 @@ public void testCreate() throws Exception {
         request.setClientId(resourceServerId);
         request.addResource("myresource", "myscope");
         PolicyEvaluationResponse result = realm.clients().get(resourceServerId).authorization().policies().evaluate(request);
-        Assert.assertEquals(result.getStatus(), DecisionEffect.PERMIT);
+        Assert.assertEquals(DecisionEffect.PERMIT, result.getStatus());
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaDiscoveryDocumentTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaDiscoveryDocumentTest.java
index a9954909eb38..83e11de7f314 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaDiscoveryDocumentTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaDiscoveryDocumentTest.java
@@ -37,7 +37,7 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.admin.AbstractAdminTest;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 public class UmaDiscoveryDocumentTest extends AbstractKeycloakTest {
 
@@ -65,9 +65,9 @@ public void testFetchDiscoveryDocument() {
 
 
             assertEquals(configuration.getAuthorizationEndpoint(), OIDCLoginProtocolService.authUrl(UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT)).build("test").toString());
-            assertEquals(configuration.getTokenEndpoint(), oauth.getAccessTokenUrl());
-            assertEquals(configuration.getJwksUri(), oauth.getCertsUrl("test"));
-            assertEquals(configuration.getIntrospectionEndpoint(), oauth.getTokenIntrospectionUrl());
+            assertEquals(configuration.getTokenEndpoint(), oauth.getEndpoints().getToken());
+            assertEquals(configuration.getJwksUri(), oauth.getEndpoints().getJwks());
+            assertEquals(configuration.getIntrospectionEndpoint(), oauth.getEndpoints().getIntrospection());
 
             String registrationUri = UriBuilder
                     .fromUri(OAuthClient.AUTH_SERVER_ROOT)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaGrantTypeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaGrantTypeTest.java
index efbcde855a8c..8f58de6c52d6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaGrantTypeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaGrantTypeTest.java
@@ -25,7 +25,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
@@ -71,7 +71,7 @@
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.util.BasicAuthHelper;
 import org.keycloak.util.JsonSerialization;
@@ -448,9 +448,10 @@ public void testCORSHeadersInFailedRptRequest() throws Exception {
         UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
         post.setEntity(formEntity);
 
-        CloseableHttpResponse response = oauth.getHttpClient().get().execute(post);
-        assertEquals(401, response.getStatusLine().getStatusCode());
-        assertEquals("http://localhost", response.getFirstHeader("Access-Control-Allow-Origin").getValue());
+        try (CloseableHttpResponse response = oauth.httpClient().get().execute(post)) {
+            assertEquals(401, response.getStatusLine().getStatusCode());
+            assertEquals("http://localhost", response.getFirstHeader("Access-Control-Allow-Origin").getValue());
+        }
     }
 
     @Test
@@ -581,8 +582,8 @@ public void testTokenIntrospect() throws Exception {
         assertNotNull(introspectionResponse);
         assertNotNull(introspectionResponse.getPermissions());
 
-        oauth.realm("authz-test");
-        String introspectHttpResponse = oauth.introspectTokenWithClientCredential("resource-server-test", "secret", "requesting_party_token", rpt);
+        oauth.realm("authz-test").client("resource-server-test", "secret");
+        String introspectHttpResponse = oauth.doIntrospectionRequest(rpt, "requesting_party_token").getRaw();
 
         Map jsonNode = JsonSerialization.readValue(introspectHttpResponse, Map.class);
 
@@ -627,11 +628,11 @@ public void testNoRefreshToken() {
 
     private String getIdToken(String username, String password) {
         oauth.realm("authz-test");
-        oauth.clientId("test-app");
+        oauth.client("test-app");
         oauth.openLoginForm();
-        OAuthClient.AuthorizationEndpointResponse resp = oauth.doLogin(username, password);
+        AuthorizationEndpointResponse resp = oauth.doLogin(username, password);
         String code = resp.getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, password);
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         return response.getIdToken();
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaRepresentationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaRepresentationTest.java
index d4582c0f82b8..e1427edd40cd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaRepresentationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/UmaRepresentationTest.java
@@ -18,7 +18,6 @@
 package org.keycloak.testsuite.authz;
 
 import org.junit.Assert;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.authorization.client.resource.PermissionResource;
@@ -27,11 +26,12 @@
 import org.keycloak.representations.idm.authorization.PermissionTicketRepresentation;
 import org.keycloak.representations.idm.authorization.PolicyEvaluationRequest;
 import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse;
+import org.keycloak.representations.idm.authorization.PolicyEvaluationResponse.PolicyResultRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 
 import java.util.List;
+import java.util.Set;
 
-@Ignore
 public class UmaRepresentationTest extends AbstractResourceServerTest {
     private ResourceRepresentation resource;
     private PermissionResource permission;
@@ -103,11 +103,11 @@ public void testCanRepresentPolicyResultGrantOfResourceOwnedByUser() throws Exce
         Assert.assertFalse(evaluations.isEmpty());
         Assert.assertEquals(1, evaluations.size());
 
-        List<PolicyEvaluationResponse.PolicyResultRepresentation> policies = evaluations.get(0).getPolicies();
+        Set<PolicyResultRepresentation> policies = evaluations.get(0).getPolicies();
         Assert.assertFalse(evaluations.isEmpty());
         Assert.assertEquals(1, evaluations.size());
 
-        String description = policies.get(0).getPolicy().getDescription();
+        String description = policies.iterator().next().getPolicy().getDescription();
         Assert.assertTrue(description.startsWith("Resource owner (marta) grants access"));
     }
 
@@ -132,11 +132,11 @@ public void testCanRepresentPolicyResultGrantOfResourceOwnedByClient() throws Ex
         Assert.assertFalse(evaluations.isEmpty());
         Assert.assertEquals(1, evaluations.size());
 
-        List<PolicyEvaluationResponse.PolicyResultRepresentation> policies = evaluations.get(0).getPolicies();
+        Set<PolicyEvaluationResponse.PolicyResultRepresentation> policies = evaluations.get(0).getPolicies();
         Assert.assertFalse(evaluations.isEmpty());
         Assert.assertEquals(1, evaluations.size());
 
-        String description = policies.get(0).getPolicy().getDescription();
+        String description = policies.iterator().next().getPolicy().getDescription();
         Assert.assertTrue(description.startsWith("Resource owner (resource-server-test) grants access"));
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestFGAPV2.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestFGAPV2.java
new file mode 100644
index 000000000000..32cfadecf126
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestFGAPV2.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.authz.admin.permissions;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.util.List;
+import org.junit.After;
+import org.junit.Test;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.testsuite.exportimport.ExportImportTest;
+
+public class ExportImportTestFGAPV2 extends ExportImportTest {
+
+    private final String REALM_NAME = "fgap";
+    private final String CUSTOM_CLIENT_ID = "imported-permission-client";
+
+    @After
+    public void cleanup() {
+        removeRealm(REALM_NAME);
+    }
+
+    @Test
+    public void testCreateRealmWithSwitchOnAndNoAdminPermissionsClient() {
+        RealmRepresentation rep = new RealmRepresentation();
+        rep.setRealm(REALM_NAME);
+        rep.setAdminPermissionsEnabled(Boolean.TRUE);
+
+        adminClient.realms().create(rep);
+
+        assertTrue(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
+
+        //admin-permissions client should be created
+        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
+
+        assertThat(client, notNullValue());
+
+        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
+        assertThat(authorizationSettings, notNullValue());
+        assertThat(authorizationSettings.getAuthorizationSchema(), notNullValue());
+    }
+
+    @Test
+    public void testCreateRealmWithSwitchOnAndAdminPermissionsClient() {
+        RealmRepresentation rep = new RealmRepresentation();
+        rep.setRealm(REALM_NAME);
+        rep.setAdminPermissionsEnabled(Boolean.TRUE);
+
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId(CUSTOM_CLIENT_ID);
+        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
+
+        rep.setAdminPermissionsClient(clientRep);
+        rep.setClients(List.of(clientRep));
+
+        adminClient.realms().create(rep);
+
+        assertTrue(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
+
+        //admin-permissions client (imported-permission-client) should be created
+        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
+
+        assertThat(client, notNullValue());
+        assertThat(client.getClientId(), equalTo(CUSTOM_CLIENT_ID));
+
+        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
+        assertThat(authorizationSettings, notNullValue());
+        assertThat(authorizationSettings.getAuthorizationSchema(), notNullValue());
+    }
+
+    @Test
+    public void testCreateRealmWithSwitchOffAndAdminPermissionsClient() {
+        RealmRepresentation rep = new RealmRepresentation();
+        rep.setRealm(REALM_NAME);
+
+        ClientRepresentation clientRep = new ClientRepresentation();
+        clientRep.setClientId(CUSTOM_CLIENT_ID);
+        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
+
+        rep.setAdminPermissionsClient(clientRep);
+        rep.setClients(List.of(clientRep));
+
+        adminClient.realms().create(rep);
+
+        assertFalse(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
+
+        //admin-permissions client (imported-permission-client) should be created
+        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
+
+        assertThat(client, notNullValue());
+        assertThat(client.getClientId(), equalTo(CUSTOM_CLIENT_ID));
+
+        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
+        assertThat(authorizationSettings, notNullValue());
+
+        // schema should not be available as the realm switch is off
+        assertThat(authorizationSettings.getAuthorizationSchema(), nullValue());
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestWithFGAPV2Enabled.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestWithFGAPV2Enabled.java
deleted file mode 100644
index ac6c82aa8adf..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/admin/permissions/ExportImportTestWithFGAPV2Enabled.java
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.authz.admin.permissions;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.notNullValue;
-import static org.hamcrest.Matchers.nullValue;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-import java.util.List;
-import org.junit.After;
-import org.junit.Test;
-import org.keycloak.common.Profile;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.exportimport.ExportImportTest;
-
-@EnableFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)
-public class ExportImportTestWithFGAPV2Enabled extends ExportImportTest {
-
-    private final String REALM_NAME = "fgap";
-    private final String CUSTOM_CLIENT_ID = "imported-permission-client";
-
-    @After
-    public void cleanup() {
-        removeRealm(REALM_NAME);
-    }
-
-    @Test
-    public void testCreateRealmWithSwitchOnAndNoAdminPermissionsClient() {
-        RealmRepresentation rep = new RealmRepresentation();
-        rep.setRealm(REALM_NAME);
-        rep.setAdminPermissionsEnabled(Boolean.TRUE);
-
-        adminClient.realms().create(rep);
-
-        assertTrue(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
-
-        //admin-permissions client should be created
-        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
-
-        assertThat(client, notNullValue());
-
-        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
-        assertThat(authorizationSettings, notNullValue());
-        assertThat(authorizationSettings.getAuthorizationSchema(), notNullValue());
-    }
-
-    @Test
-    public void testCreateRealmWithSwitchOnAndAdminPermissionsClient() {
-        RealmRepresentation rep = new RealmRepresentation();
-        rep.setRealm(REALM_NAME);
-        rep.setAdminPermissionsEnabled(Boolean.TRUE);
-
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId(CUSTOM_CLIENT_ID);
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-
-        rep.setAdminPermissionsClient(clientRep);
-        rep.setClients(List.of(clientRep));
-
-        adminClient.realms().create(rep);
-
-        assertTrue(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
-
-        //admin-permissions client (imported-permission-client) should be created
-        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
-
-        assertThat(client, notNullValue());
-        assertThat(client.getClientId(), equalTo(CUSTOM_CLIENT_ID));
-
-        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
-        assertThat(authorizationSettings, notNullValue());
-        assertThat(authorizationSettings.getAuthorizationSchema(), notNullValue());
-    }
-
-    @Test
-    public void testCreateRealmWithSwitchOffAndAdminPermissionsClient() {
-        RealmRepresentation rep = new RealmRepresentation();
-        rep.setRealm(REALM_NAME);
-
-        ClientRepresentation clientRep = new ClientRepresentation();
-        clientRep.setClientId(CUSTOM_CLIENT_ID);
-        clientRep.setServiceAccountsEnabled(Boolean.TRUE);
-
-        rep.setAdminPermissionsClient(clientRep);
-        rep.setClients(List.of(clientRep));
-
-        adminClient.realms().create(rep);
-
-        assertFalse(adminClient.realm(REALM_NAME).toRepresentation().isAdminPermissionsEnabled());
-
-        //admin-permissions client (imported-permission-client) should be created
-        ClientRepresentation client = adminClient.realm(REALM_NAME).toRepresentation().getAdminPermissionsClient();
-
-        assertThat(client, notNullValue());
-        assertThat(client.getClientId(), equalTo(CUSTOM_CLIENT_ID));
-
-        ResourceServerRepresentation authorizationSettings = adminClient.realm(REALM_NAME).clients().get(client.getId()).authorization().getSettings();
-        assertThat(authorizationSettings, notNullValue());
-
-        // schema should not be available as the realm switch is off
-        assertThat(authorizationSettings.getAuthorizationSchema(), nullValue());
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractAdvancedBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractAdvancedBrokerTest.java
index 78a11d800126..0fa571564537 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractAdvancedBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractAdvancedBrokerTest.java
@@ -20,13 +20,13 @@
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.client.KeycloakTestingClient;
 import org.keycloak.testsuite.federation.DummyUserFederationProviderFactory;
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.TestAppHelper;
-import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.TimeoutException;
 
 import jakarta.ws.rs.client.Client;
@@ -37,7 +37,6 @@
 import java.net.URI;
 import java.util.Arrays;
 import java.util.Collections;
-import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
@@ -199,9 +198,9 @@ public void testRetrieveToken() throws Exception {
 
         testingClient.server(bc.consumerRealmName()).run(grantReadTokenRole(username));
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.realm(bc.consumerRealmName()).clientId("broker-app").doGrantAccessTokenRequest("broker-app-secret", bc.getUserLogin(), bc.getUserPassword());
+        AccessTokenResponse accessTokenResponse = oauth.realm(bc.consumerRealmName()).client("broker-app", "broker-app-secret").doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
         AtomicReference<String> accessToken = (AtomicReference<String>) new AtomicReference<>(accessTokenResponse.getAccessToken());
-        Client client = jakarta.ws.rs.client.ClientBuilder.newBuilder().register((ClientRequestFilter) request -> request.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + accessToken.get())).build();
+        Client client = KeycloakTestingClient.getRestEasyClientBuilder().register((ClientRequestFilter) request -> request.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + accessToken.get())).build();
 
         try {
             WebTarget target = client.target(Urls.identityProviderRetrieveToken(URI.create(getConsumerRoot() + "/auth"), bc.getIDPAlias(), bc.consumerRealmName()));
@@ -213,7 +212,7 @@ public void testRetrieveToken() throws Exception {
 
             testingClient.server(bc.consumerRealmName()).run(revokeReadTokenRole(username));
 
-            accessTokenResponse = oauth.realm(bc.consumerRealmName()).clientId("broker-app").doGrantAccessTokenRequest("broker-app-secret", bc.getUserLogin(), bc.getUserPassword());
+            accessTokenResponse = oauth.realm(bc.consumerRealmName()).client("broker-app", "broker-app-secret").doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
             accessToken.set(accessTokenResponse.getAccessToken());
 
             try (Response response = target.request().get()) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBaseBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBaseBrokerTest.java
index a0e6dba8bc79..e0547eb0c009 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBaseBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBaseBrokerTest.java
@@ -17,6 +17,9 @@
 
 package org.keycloak.testsuite.broker;
 
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriBuilderException;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.After;
@@ -31,7 +34,7 @@
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
+import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.IdpConfirmLinkPage;
 import org.keycloak.testsuite.pages.IdpConfirmOverrideLinkPage;
@@ -47,15 +50,16 @@
 import org.keycloak.testsuite.pages.ProceedPage;
 import org.keycloak.testsuite.pages.UpdateAccountInformationPage;
 import org.keycloak.testsuite.pages.VerifyEmailPage;
-import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.util.MailServer;
 import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.LogoutUrlBuilder;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
+import org.openqa.selenium.By;
 import org.openqa.selenium.TimeoutException;
 
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.UriBuilder;
-import jakarta.ws.rs.core.UriBuilderException;
 import java.net.URI;
 import java.util.Collections;
 import java.util.List;
@@ -189,8 +193,8 @@ public void beforeBrokerTest() {
         importRealm(consumerRealm);
         importRealm(providerRealm);
 
-        VerifyProfileTest.enableUnmanagedAttributes(adminClient.realm(consumerRealm.getRealm()).users().userProfile());
-        VerifyProfileTest.enableUnmanagedAttributes(adminClient.realm(providerRealm.getRealm()).users().userProfile());
+        UserProfileUtil.enableUnmanagedAttributes(adminClient.realm(consumerRealm.getRealm()).users().userProfile());
+        UserProfileUtil.enableUnmanagedAttributes(adminClient.realm(providerRealm.getRealm()).users().userProfile());
     }
 
     @After
@@ -255,6 +259,25 @@ protected void logInWithIdp(String idpAlias, String username, String password) {
         loginPage.login(username, password);
     }
 
+    protected AuthorizationEndpointResponse doLoginSocial(OAuthClient oauth, String brokerId, String username, String password) {
+        return doLoginSocial(oauth, brokerId, username, password, null);
+    }
+
+    protected AuthorizationEndpointResponse doLoginSocial(OAuthClient oauth, String brokerId, String username, String password, String nonce) {
+        oauth.loginForm().nonce(nonce).open();
+        WaitUtils.waitForPageToLoad();
+
+        oauth.getDriver().findElement(By.id("social-" + brokerId)).click();
+        oauth.fillLoginForm(username, password);
+
+        if (updateAccountInformationPage.isCurrent()) {
+            log.debug("Updating info on updateAccount page");
+            updateAccountInformationPage.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail(), "Firstname", "Lastname");
+        }
+
+        return oauth.parseLoginResponse();
+    }
+
     /** Logs in the IDP and updates account information */
     protected void logInAsUserInIDPForFirstTime() {
         logInAsUserInIDP();
@@ -337,25 +360,26 @@ protected void executeLogoutFromRealm(String contextRoot, String realm, String i
             if (isDifferentContext) {
                 OAuthClient.updateURLs(contextRoot);
                 OAuthClient.updateAppRootRealm(realm);
-                oauth.init(driver);
+                oauth.init();
             }
 
-            final OAuthClient.LogoutUrlBuilder builder = oauth.realm(realm)
-                    .getLogoutUrl()
+            final LogoutUrlBuilder builder = oauth.realm(realm).logoutForm()
                     .idTokenHint(idTokenHint)
-                    .clientId(clientId)
                     .initiatingIdp(initiatingIdp);
 
+            if (clientId != null) {
+                builder.withClientId();
+            }
+
             if (redirectUri != null && (clientId != null || idTokenHint != null)) {
                 builder.postLogoutRedirectUri(encodeUrl(redirectUri));
             }
 
-            String logoutUrl = builder.build();
-            driver.navigate().to(logoutUrl);
+            builder.open();
         } finally {
             if (isDifferentContext) {
                 OAuthClient.updateURLs(getAuthServerContextRoot());
-                oauth.init(driver);
+                oauth.init();
             }
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBrokerTest.java
index cb426ef5d0d3..331e80b5268c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractBrokerTest.java
@@ -62,7 +62,7 @@ public void testLogInAsUserInIDP() {
     }
 
     protected void loginUser() {
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "password");
         loginPage.open(bc.consumerRealmName());
 
         logInWithBroker(bc);
@@ -167,7 +167,7 @@ protected void testSingleLogout() {
         log.debug("Testing single log out");
 
         oauth.realm(bc.consumerRealmName());
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "secret");
         oauth.openLoginForm();
 
         Assert.assertTrue("Should be logged in", driver.getTitle().endsWith("AUTH_RESPONSE"));
@@ -175,7 +175,6 @@ protected void testSingleLogout() {
         logoutFromConsumerRealm();
         AccountHelper.logout(adminClient.realm(bc.providerRealmName()), bc.getUserLogin());
 
-        oauth.clientId("broker-app");
         loginPage.open(bc.consumerRealmName());
 
         Assert.assertTrue("Should be on " + bc.consumerRealmName() + " realm on login page",
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractDefaultIdpTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractDefaultIdpTest.java
index 782e2d5a2b00..82db0f662ab2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractDefaultIdpTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractDefaultIdpTest.java
@@ -134,6 +134,26 @@ protected void testDefaultIdpSetTriedAndReturnedError(String expectedErrorMessag
         assertEquals(expectedErrorMessageOnLoginScreen, UIUtils.getTextFromElement(errorElement));
     }
 
+    protected void testLoginHintForwarded() {
+        // Set the Default Identity Provider option to the remote IdP name
+        configureFlow(getBrokerConfiguration().getIDPAlias());
+
+        String username = "all-info-set@localhost.com";
+        String urlEncodedUsername = "all-info-set%40localhost.com";
+        createUser(bc.providerRealmName(), username, "password", "FirstName");
+
+        // Navigate to the auth page of consumer realm
+        oauth.realm(bc.consumerRealmName()).client("broker-app").loginForm().loginHint(username).open();
+
+        waitForPage(driver, "sign in to", true);
+
+        // Make sure we got redirected to the remote IdP (provider) automatically
+        Assert.assertTrue("Driver should be on the provider realm page right now",
+                driver.getCurrentUrl().contains("/auth/realms/" + bc.providerRealmName() + "/"));
+        Assert.assertTrue("Provider page should contain login_hint parameter",
+                driver.getCurrentUrl().contains("login_hint=" + urlEncodedUsername));
+    }
+
     protected void configureFlow(String defaultIdpValue) {
         String newFlowAlias;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractFirstBrokerLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractFirstBrokerLoginTest.java
index 4032c8ab3438..2a48ffaf2144 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractFirstBrokerLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/AbstractFirstBrokerLoginTest.java
@@ -14,12 +14,15 @@
 import org.keycloak.admin.client.resource.IdentityProviderResource;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.authentication.authenticators.broker.IdpReviewProfileAuthenticatorFactory;
 import org.keycloak.broker.provider.HardcodedUserSessionAttributeMapper;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
+import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.IdentityProviderMapperModel;
 import org.keycloak.models.IdentityProviderSyncMode;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.FederatedIdentityRepresentation;
@@ -823,6 +826,85 @@ public void testLinkAccountWithEmailVerified() {
         assertTrue(realm.users().get(linkedUserId).toRepresentation().isEmailVerified());
     }
 
+    @Test
+    public void testLinkAccountModifyingEmailLinkingByEmailNotAllowed() {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+
+        configureSMTPServer();
+
+        // change provider user email to changed@localhost.com
+        UserRepresentation userProvider = ApiUtil.findUserByUsername(providerRealm, bc.getUserLogin());
+        userProvider.setEmail("changed@localhost.com");
+        providerRealm.users().get(userProvider.getId()).update(userProvider);
+
+        //create user on consumer's site with the correct email
+        final String linkedUserId = createUser(bc.getUserLogin());
+
+        //test
+        oauth.config().clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+
+        logInWithBroker(bc);
+
+        waitForPage(driver, "update account information", false);
+        Assert.assertTrue(updateAccountInformationPage.isCurrent());
+        Assert.assertTrue("We must be on correct realm right now",
+                driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/"));
+
+        // update the email to the correct one
+        log.debug("Updating info on updateAccount page");
+        updateAccountInformationPage.updateAccountInformation(USER_EMAIL, "Firstname", "Lastname");
+
+        //link account
+        waitForPage(driver, "account already exists", false);
+        idpConfirmLinkPage.clickLinkAccount();
+
+        //it should start the link using username and password as email has been changed
+        assertEquals("Authenticate to link your account with " + bc.getIDPAlias(), loginPage.getInfoMessage());
+
+        loginPage.login("password");
+        Assert.assertTrue(appPage.isCurrent());
+
+        assertNumFederatedIdentities(linkedUserId, 1);
+    }
+
+    @Test
+    public void testLinkAccountReviewDisabled() throws Exception {
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+
+        // disable the idp review step
+        AuthenticationExecutionInfoRepresentation idpReviewProfileExec = consumerRealm.flows().getExecutions("first broker login").stream()
+                .filter(execution -> IdpReviewProfileAuthenticatorFactory.PROVIDER_ID.equals(execution.getProviderId()))
+                .findAny()
+                .orElse(null);
+        Assert.assertNotNull("IdpReviewProfileAuthenticator execution not found", idpReviewProfileExec);
+        idpReviewProfileExec.setRequirement(AuthenticationExecutionModel.Requirement.DISABLED.name());
+        consumerRealm.flows().updateExecutions("first broker login", idpReviewProfileExec);
+
+        //create user on consumer's site with the correct email
+        final String linkedUserId = createUser(bc.getUserLogin());
+
+        //test
+        oauth.config().clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+
+        logInWithBroker(bc);
+
+        // no review displayed and button in link not available
+        waitForPage(driver, "account already exists", false);
+        Assert.assertTrue("We must be on correct realm right now",
+                driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/"));
+        Assert.assertFalse("Review Profile button is displayed", idpConfirmLinkPage.isReviewProfileDisplayed());
+        idpConfirmLinkPage.clickLinkAccount();
+
+        //linking the account using password as email not configured
+        assertEquals("Authenticate to link your account with " + bc.getIDPAlias(), loginPage.getInfoMessage());
+
+        loginPage.login("password");
+        Assert.assertTrue(appPage.isCurrent());
+
+        assertNumFederatedIdentities(linkedUserId, 1);
+    }
 
     /**
      * Refers to in old test suite: org.keycloak.testsuite.broker.AbstractKeycloakIdentityProviderTest#testSuccessfulAuthenticationWithoutUpdateProfile_emailProvided_emailVerifyEnabled
@@ -861,7 +943,6 @@ public void testLinkAccountWithUntrustedEmailVerified() {
         driver.navigate().to(verificationUrl.trim());
     }
 
-
     /**
      * Refers to in old test suite: org.keycloak.testsuite.broker.AbstractKeycloakIdentityProviderTest#testSuccessfulAuthenticationWithoutUpdateProfile_emailNotProvided_emailVerifyEnabled
      *
@@ -1051,7 +1132,8 @@ public void testLinkAccountByEmailVerificationInAnotherBrowser() {
 
         // in the second browser confirm the mail
         driver2.navigate().to(url);
-        assertThat(driver2.findElement(By.className("instruction")).getText(), startsWith("Confirm linking the account"));
+        assertThat(driver2.findElement(By.id("kc-page-title")).getText(), startsWith("Confirm linking the account"));
+        assertThat(driver2.findElement(By.className("instruction")).getText(), startsWith("If you link the account, you will also be able to login using account"));
         driver2.findElement(By.linkText("» Click here to proceed")).click();
         assertThat(driver2.findElement(By.className("instruction")).getText(), startsWith("You successfully verified your email."));
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java
index 88bc8bbfd2a7..002ca9058833 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java
@@ -44,7 +44,8 @@
 import org.keycloak.testsuite.client.resources.TestingCacheResource;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.broker.OIDCIdentityProviderConfigRep;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotEquals;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerConfiguration.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerConfiguration.java
index af3fea4f6c3a..7b057ddede61 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerConfiguration.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerConfiguration.java
@@ -22,6 +22,7 @@
 import java.util.Map;
 import java.util.Set;
 
+import static org.keycloak.broker.oidc.OAuth2IdentityProviderConfig.TOKEN_ENDPOINT_URL;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.*;
 import static org.keycloak.testsuite.broker.BrokerTestTools.*;
 
@@ -201,9 +202,10 @@ protected void applyDefaultConfiguration(final Map<String, String> config, Ident
         config.put("clientId", CLIENT_ID);
         config.put("clientSecret", CLIENT_SECRET);
         config.put("prompt", "login");
+        config.put("loginHint", "true");
         config.put(OIDCIdentityProviderConfig.ISSUER, getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME);
         config.put("authorizationUrl", getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME + "/protocol/openid-connect/auth");
-        config.put("tokenUrl", getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME + "/protocol/openid-connect/token");
+        config.put(TOKEN_ENDPOINT_URL, getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME + "/protocol/openid-connect/token");
         config.put("logoutUrl", getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME + "/protocol/openid-connect/logout");
         config.put("userInfoUrl", getProviderRoot() + "/auth/realms/" + REALM_PROV_NAME + "/protocol/openid-connect/userinfo");
         config.put("defaultScope", "email profile");
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerEventTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerEventTest.java
index 077c1bf5d42f..21070113bf79 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerEventTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerEventTest.java
@@ -77,6 +77,7 @@ private void checkFirstLoginEvents(RealmResource providerRealm, RealmResource co
                 .user((String)null)
                 .detail(Details.IDENTITY_PROVIDER, IDP_OIDC_ALIAS)
                 .detail(Details.IDENTITY_PROVIDER_USERNAME, bc.getUserLogin())
+                .detail(Details.IDENTITY_PROVIDER_BROKER_SESSION_ID,  Matchers.startsWith(bc.getIDPAlias()))
                 .assertEvent();
 
         events.expect(EventType.UPDATE_PROFILE)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerIdpLinkActionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerIdpLinkActionTest.java
new file mode 100644
index 000000000000..6d2a56eadc6e
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerIdpLinkActionTest.java
@@ -0,0 +1,485 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.broker;
+
+import java.net.URI;
+import java.net.URL;
+import java.util.Collections;
+import java.util.List;
+
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.Matchers;
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.broker.provider.IdpLinkAction;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.common.util.UriUtils;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
+import org.keycloak.models.Constants;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.pages.IdpLinkActionPage;
+import org.keycloak.testsuite.util.AccountHelper;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.utils.BrokerUtil;
+
+import static org.hamcrest.Matchers.is;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
+
+/**
+ * Test for client-initiated-account linking of the custom application
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KcOidcBrokerIdpLinkActionTest extends AbstractInitializedBaseBrokerTest {
+
+    private static final BrokerConfiguration BROKER_CONFIG_INSTANCE = new KcOidcBrokerConfiguration() {
+
+        @Override
+        public List<ClientRepresentation> createProviderClients() {
+            List<ClientRepresentation> providerClients = super.createProviderClients();
+            providerClients.get(0).setConsentRequired(true);
+            return providerClients;
+        }
+    };
+
+    @Rule
+    public AssertEvents events = new AssertEvents(this);
+
+    @Page
+    private IdpLinkActionPage idpLinkActionPage;
+
+    @Override
+    protected BrokerConfiguration getBrokerConfiguration() {
+        return BROKER_CONFIG_INSTANCE;
+    }
+
+    @Before
+    public void recreateConsumerUser() {
+        RealmResource providerRealmResource = realmsResouce().realm(bc.providerRealmName());
+
+        String consumerUserID1 = createUser(bc.consumerRealmName(), "user1", "password", "User1", "Last", "user1@keycloak.org",
+                user -> user.setEmailVerified(true));
+        String consumerUserID2 = createUser(bc.consumerRealmName(), "user2", "password", "User2", "Last", "user2@keycloak.org",
+                user -> user.setEmailVerified(true));
+        getCleanup(bc.consumerRealmName()).addUserId(consumerUserID1);
+    }
+
+    // Test deprecated mechanism for client-initiated account linking
+    @Test
+    public void testAccountLinkingSuccess_legacyClientInitiatedAccountLinking() throws Exception {
+        String userSessionId = loginToConsumer();
+
+        // Redirect to link account on behalf of "broker-app" and login to the IDP
+        URI clientInitiatedAccountLinkUri = BrokerUtil.createClientInitiatedLinkURI("broker-app", oauth.getRedirectUri(), bc.getIDPAlias(), bc.consumerRealmName(), userSessionId, new URI(OAuthClient.AUTH_SERVER_ROOT)).getAccountLinkUri();
+        driver.navigate().to(clientInitiatedAccountLinkUri.toString());
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+        grantPage.assertCurrent();
+        grantPage.accept();
+
+        appPage.assertCurrent();
+        assertKcActionParams(null, null);
+
+        // Check that user is linked to the IDP
+        assertUserLinkedToIDP(true);
+    }
+
+    @Test
+    public void testAccountLinkingSuccess() throws Exception {
+        loginToConsumer();
+
+        // Redirect to link account on behalf of "broker-app" and login to the IDP
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.loginForm().kcAction(kcAction).open();
+        confirmIdpLinking();
+
+        // Login to provider
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+        events.clear();
+        grantPage.assertCurrent();
+        grantPage.accept();
+
+        appPage.assertCurrent();
+        assertKcActionParams(IdpLinkAction.PROVIDER_ID, RequiredActionContext.KcActionStatus.SUCCESS.name().toLowerCase());
+
+        // Check that user is linked to the IDP
+        assertUserLinkedToIDP(true);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            assertProviderEventsSuccess(providerRealmId, providerUserId);
+            assertConsumerSuccessLinkEvents(consumerRealmId, consumerUserId, consumerUsername);
+        });
+    }
+
+
+    @Test
+    public void testAccountLinkingSuccessTriggeredWhenUserNotAuthenticated() throws Exception {
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        // Login to consumer with "kc_action" when user not authenticated yet
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.client("broker-app");
+        oauth.realm(bc.consumerRealmName());
+        oauth.loginForm().kcAction(kcAction).open();
+        loginPage.login("user1", "password");
+        confirmIdpLinking();
+
+        // Login to provider
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+        events.clear();
+        grantPage.assertCurrent();
+        grantPage.accept();
+
+        appPage.assertCurrent();
+        assertKcActionParams(IdpLinkAction.PROVIDER_ID, RequiredActionContext.KcActionStatus.SUCCESS.name().toLowerCase());
+
+        // Check that user is linked to the IDP
+        assertUserLinkedToIDP(true);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            assertProviderEventsSuccess(providerRealmId, providerUserId);
+            assertConsumerSuccessLinkEvents(consumerRealmId, consumerUserId, consumerUsername);
+        });
+    }
+
+    @Test
+    public void testAccountLinkingCancel() throws Exception {
+        loginToConsumer();
+
+        // Redirect to link account on behalf of "broker-app" and login to the IDP
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.loginForm().kcAction(kcAction).open();
+        events.clear();
+
+        idpLinkActionPage.assertCurrent();
+        idpLinkActionPage.assertIdpInMessage(bc.getIDPAlias());
+        idpLinkActionPage.cancel();
+
+        appPage.assertCurrent();
+        assertKcActionParams(IdpLinkAction.PROVIDER_ID, RequiredActionContext.KcActionStatus.CANCELLED.name().toLowerCase());
+
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            events.expect(EventType.CUSTOM_REQUIRED_ACTION_ERROR)
+                    .realm(consumerRealmId)
+                    .client("broker-app")
+                    .user(consumerUserId)
+                    .detail(Details.CUSTOM_REQUIRED_ACTION, IdpLinkAction.PROVIDER_ID)
+                    .detail(Details.USERNAME, consumerUsername)
+                    .error(Errors.REJECTED_BY_USER)
+                    .assertEvent();
+
+            events.expect(EventType.LOGIN)
+                    .realm(consumerRealmId)
+                    .client("broker-app")
+                    .user(consumerUserId)
+                    .session(Matchers.any(String.class))
+                    .detail(Details.USERNAME, consumerUsername)
+                    .assertEvent();
+
+            events.assertEmpty();
+        });
+    }
+
+    @Test
+    public void testAccountLinkingConsentRejectedAtIdp() throws Exception {
+        loginToConsumer();
+
+        // Redirect to link account on behalf of "broker-app" and login to the IDP
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.loginForm().kcAction(kcAction).open();
+        confirmIdpLinking();
+
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+        events.clear();
+        grantPage.assertCurrent();
+        grantPage.cancel();
+
+        appPage.assertCurrent();
+        assertKcActionParams(IdpLinkAction.PROVIDER_ID, RequiredActionContext.KcActionStatus.CANCELLED.name().toLowerCase());
+
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            // Provider login - rejected consent screen
+            events.expect(EventType.LOGIN_ERROR)
+                    .realm(providerRealmId)
+                    .user(providerUserId)
+                    .client(bc.getIDPClientIdInProviderRealm())
+                    .session((String)null)
+                    .detail(Details.USERNAME, bc.getUserLogin())
+                    .error(Errors.REJECTED_BY_USER)
+                    .assertEvent();
+
+            // Consumer - rejected provider consent screen event propagated
+            assertConsumerFailedLinkEvents(consumerRealmId, consumerUserId, consumerUsername, Errors.REJECTED_BY_USER, true);
+
+            events.assertEmpty();
+        });
+    }
+
+
+    @Test
+    public void testAccountLinkingDifferentUserLinked() throws Exception {
+        // Link IDP to user "user2"
+        Response response = AccountHelper.addIdentityProvider(adminClient.realm(bc.consumerRealmName()), "user2", adminClient.realm(bc.providerRealmName()), bc.getUserLogin(), bc.getIDPAlias());
+        Assert.assertEquals(204, response.getStatus());
+
+        // Linking the user "user1" to same IDP should fail
+        loginToConsumer();
+
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.loginForm().kcAction(kcAction).open();
+        confirmIdpLinking();
+
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+        events.clear();
+        grantPage.assertCurrent();
+        grantPage.accept();
+
+        errorPage.assertCurrent();
+        Assert.assertEquals("Federated identity returned by " + bc.getIDPAlias() + " is already linked to another user.", errorPage.getError());
+        Assert.assertEquals(bc.createConsumerClients().get(0).getBaseUrl(), errorPage.getBackToApplicationLink());
+
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            assertProviderEventsSuccess(providerRealmId, providerUserId);
+            assertConsumerFailedLinkEvents(consumerRealmId, consumerUserId, consumerUsername, Messages.IDENTITY_PROVIDER_ALREADY_LINKED, false);
+
+            events.assertEmpty();
+        });
+    }
+
+
+    @Test
+    public void testAccountLinkingUserNotAllowed() throws Exception {
+        // Remove "manage-account" role from user
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        String user1Id = consumerRealm.users().search("user1").iterator().next().getId();
+
+        RoleRepresentation defaultRoles = consumerRealm.roles().get(Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + bc.consumerRealmName()).toRepresentation();
+        consumerRealm.users().get(user1Id).roles().realmLevel().remove(Collections.singletonList(defaultRoles));
+
+        // Linking the user "user1" to the IDP not allowed due insufficient permissions
+        loginToConsumer();
+
+        events.clear();
+
+        String kcAction = getKcActionParamForLinkIdp(bc.getIDPAlias());
+        oauth.loginForm().kcAction(kcAction).open();
+
+        // Should be redirected to the application even before being redirected to IDP for authentication
+        appPage.assertCurrent();
+
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            assertConsumerFailedLinkEvents(consumerRealmId, consumerUserId, consumerUsername, Errors.NOT_ALLOWED, true);
+
+            events.assertEmpty();
+        });
+
+    }
+
+    @Test
+    public void testConsumerReauthentication() throws Exception {
+        loginToConsumer();
+
+        // Link IDP to user "user1"
+        Response response = AccountHelper.addIdentityProvider(adminClient.realm(bc.consumerRealmName()), "user1", adminClient.realm(bc.providerRealmName()), bc.getUserLogin(), bc.getIDPAlias());
+        Assert.assertEquals(204, response.getStatus());
+
+        setTimeOffset(2);
+
+        // Enforce re-authentication on "consumer" realm. Try to do re-authentication with the use of IDP, but reject consent screen on IDP side
+        oauth.loginForm().maxAge(1).open();
+        loginPage.assertCurrent(bc.consumerRealmName());
+        loginPage.clickSocial(bc.getIDPAlias());
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+        events.clear();
+        grantPage.assertCurrent();
+        grantPage.cancel();
+
+        // Should be redirected back to "consumer" login
+        loginPage.assertCurrent(bc.consumerRealmName());
+        Assert.assertEquals("Access denied when authenticating with kc-oidc-idp", loginPage.getError());
+
+        assertEvents((providerRealmId, providerUserId, consumerRealmId, consumerUserId, consumerUsername) -> {
+            // Provider login - rejected consent screen
+            events.expect(EventType.LOGIN_ERROR)
+                    .realm(providerRealmId)
+                    .user(providerUserId)
+                    .client(bc.getIDPClientIdInProviderRealm())
+                    .session((String)null)
+                    .detail(Details.USERNAME, bc.getUserLogin())
+                    .error(Errors.REJECTED_BY_USER)
+                    .assertEvent();
+
+            events.assertEmpty();
+        });
+    }
+
+    private String loginToConsumer() {
+        // Login to "consumer" realm with password
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        loginPage.login("user1", "password");
+        appPage.assertCurrent();
+        String userSessionId = oauth.parseLoginResponse().getSessionState();
+
+        // Check that user is not linked to the IDP
+        assertUserLinkedToIDP(false);
+
+        return userSessionId;
+    }
+
+    private void confirmIdpLinking() {
+        idpLinkActionPage.assertCurrent();
+        idpLinkActionPage.assertIdpInMessage(bc.getIDPAlias());
+        idpLinkActionPage.confirm();
+    }
+
+    private static String getKcActionParamForLinkIdp(String providerAlias) {
+        return IdpLinkAction.PROVIDER_ID + ":" + providerAlias;
+    }
+
+    private void assertKcActionParams(String expectedKcAction, String expectedKcActionStatus) throws Exception {
+        MultivaluedHashMap<String, String> params = UriUtils.decodeQueryString(new URL(driver.getCurrentUrl()).getQuery());
+        Assert.assertEquals(expectedKcAction, params.getFirst(Constants.KC_ACTION));
+        Assert.assertEquals(expectedKcActionStatus, params.getFirst(Constants.KC_ACTION_STATUS));
+    }
+
+    private void assertUserLinkedToIDP(boolean expectedLinked) {
+        Assert.assertThat(expectedLinked, is(AccountHelper.isIdentityProviderLinked(adminClient.realm(bc.consumerRealmName()), "user1", bc.getIDPAlias())));
+    }
+
+    @FunctionalInterface
+    public interface EventDataConsumer {
+        void accept(String providerRealmId, String providerUserId, String consumerRealmId, String consumerUserId, String consumerUsername);
+    }
+
+    private void assertEvents(EventDataConsumer assertImpl) {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        String providerRealmId = providerRealm.toRepresentation().getId();
+        UserRepresentation providerUser = providerRealm.users().search(bc.getUserLogin()).iterator().next();
+        String providerUserId = providerUser.getId();
+
+        String username = "user1";
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        String consumerRealmId = consumerRealm.toRepresentation().getId();
+        UserRepresentation consumerUser = consumerRealm.users().search(username).iterator().next();
+        String consumerUserId = consumerUser.getId();
+
+        assertImpl.accept(providerRealmId, providerUserId, consumerRealmId, consumerUserId, username);
+    }
+
+    private void assertProviderEventsSuccess(String providerRealmId, String providerUserId) {
+        events.expect(EventType.LOGIN)
+                .realm(providerRealmId)
+                .user(providerUserId)
+                .client(bc.getIDPClientIdInProviderRealm())
+                .session(Matchers.any(String.class))
+                .detail(Details.USERNAME, bc.getUserLogin())
+                .assertEvent();
+
+        events.expect(EventType.CODE_TO_TOKEN)
+                .session(Matchers.any(String.class))
+                .realm(providerRealmId)
+                .user(providerUserId)
+                .client(bc.getIDPClientIdInProviderRealm())
+                .assertEvent();
+
+        events.expect(EventType.USER_INFO_REQUEST)
+                .session(Matchers.any(String.class))
+                .realm(providerRealmId)
+                .user(providerUserId)
+                .client(bc.getIDPClientIdInProviderRealm())
+                .assertEvent();
+    }
+
+    private void assertConsumerSuccessLinkEvents(String consumerRealmId, String consumerUserId, String username) {
+        events.expect(EventType.FEDERATED_IDENTITY_LINK)
+                .realm(consumerRealmId)
+                .client("broker-app")
+                .user(consumerUserId)
+                .detail(Details.USERNAME, username)
+                .detail(Details.IDENTITY_PROVIDER, IDP_OIDC_ALIAS)
+                .detail(Details.IDENTITY_PROVIDER_USERNAME, bc.getUserLogin())
+                .detail(Details.IDENTITY_PROVIDER_BROKER_SESSION_ID,  Matchers.startsWith(bc.getIDPAlias()))
+                .assertEvent();
+
+        events.expect(EventType.LOGIN)
+                .realm(consumerRealmId)
+                .client("broker-app")
+                .user(consumerUserId)
+                .session(Matchers.any(String.class))
+                .detail(Details.USERNAME, username)
+                .assertEvent();
+
+        events.assertEmpty();
+    }
+
+    private void assertConsumerFailedLinkEvents(String consumerRealmId, String consumerUserId, String consumerUsername, String expectedError, boolean expectLoginEvent) {
+        events.expect(EventType.FEDERATED_IDENTITY_LINK_ERROR)
+                .realm(consumerRealmId)
+                .client("broker-app")
+                .user(consumerUserId)
+                .detail(Details.USERNAME, consumerUsername)
+                .detail(Details.IDENTITY_PROVIDER, IDP_OIDC_ALIAS)
+                .error(expectedError)
+                .assertEvent();
+
+        if (expectLoginEvent) {
+            events.expect(EventType.LOGIN)
+                    .realm(consumerRealmId)
+                    .client("broker-app")
+                    .user(consumerUserId)
+                    .session(Matchers.any(String.class))
+                    .detail(Details.USERNAME, consumerUsername)
+                    .assertEvent();
+        }
+
+        events.assertEmpty();
+    }
+
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLdapTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLdapTest.java
index ec52a631b6e6..94e87bdd1403 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLdapTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLdapTest.java
@@ -18,7 +18,6 @@
 package org.keycloak.testsuite.broker;
 
 import java.util.Map;
-import java.util.concurrent.TimeUnit;
 
 import jakarta.ws.rs.core.Response;
 import org.junit.Assert;
@@ -55,7 +54,6 @@ public void onBefore() {
 
     @Test
     public void testUpdateProfileOnFirstLogin() {
-        driver.manage().timeouts().pageLoadTimeout(1, TimeUnit.DAYS);
         updateExecutions(AbstractBrokerTest::enableUpdateProfileOnFirstLogin);
         oauth.clientId("broker-app");
         loginPage.open(bc.consumerRealmName());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutFrontChannelTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutFrontChannelTest.java
index de6340596b50..2a0fab4046a4 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutFrontChannelTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutFrontChannelTest.java
@@ -8,7 +8,7 @@
 import org.keycloak.models.IdentityProviderSyncMode;
 import org.keycloak.representations.IDToken;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.Map;
 
@@ -44,13 +44,13 @@ public void logoutAfterIdpTokenExpired() throws VerificationException {
         updateAccountInformation();
 
         // Exchange code from "broker-app" client of "consumer" realm for the tokens
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response =
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response =
             oauth
                 .realm(bc.consumerRealmName())
-                .clientId("broker-app")
+                .client("broker-app", "broker-app-secret")
                 .redirectUri(getConsumerRoot() + "/auth/realms/" + REALM_CONS_NAME + "/app")
-                .doAccessTokenRequest(code, "broker-app-secret");
+                .doAccessTokenRequest(code);
         assertEquals(200, response.getStatusCode());
 
         String idTokenString = response.getIdToken();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutTest.java
index 485aa53088c7..87c49a8c319e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerLogoutTest.java
@@ -15,7 +15,7 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.WaitUtils;
 
 import static org.junit.Assert.assertEquals;
@@ -87,11 +87,11 @@ public void logoutAfterBrowserRestart() {
         updateAccountInformation();
 
         // Exchange code from "broker-app" client of "consumer" realm for the tokens
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
-                .clientId("broker-app")
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
+                .client("broker-app", "broker-app-secret")
                 .redirectUri(getConsumerRoot() + "/auth/realms/" + REALM_CONS_NAME + "/app")
-                .doAccessTokenRequest(code, "broker-app-secret");
+                .doAccessTokenRequest(code);
         assertEquals(200, response.getStatusCode());
 
         String idToken = response.getIdToken();
@@ -117,11 +117,11 @@ public void logoutAfterIdpTokenExpired() throws VerificationException {
         updateAccountInformation();
 
         // Exchange code from "broker-app" client of "consumer" realm for the tokens
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
-                .clientId("broker-app")
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
+                .client("broker-app", "broker-app-secret")
                 .redirectUri(getConsumerRoot() + "/auth/realms/" + REALM_CONS_NAME + "/app")
-                .doAccessTokenRequest(code, "broker-app-secret");
+                .doAccessTokenRequest(code);
         assertEquals(200, response.getStatusCode());
 
         String idTokenString = response.getIdToken();
@@ -203,11 +203,11 @@ public void testFrontChannelLogoutRequestsSendingOnlyIdTokenHint() throws Verifi
             updateAccountInformation();
 
             // Exchange code from "broker-app" client of "consumer" realm for the tokens
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
-                    .clientId("broker-app")
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.realm(bc.consumerRealmName())
+                    .client("broker-app", "broker-app-secret")
                     .redirectUri(getConsumerRoot() + "/auth/realms/" + REALM_CONS_NAME + "/app")
-                    .doAccessTokenRequest(code, "broker-app-secret");
+                    .doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
 
             String idTokenString = response.getIdToken();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java
index 3bbd82c63a85..4e7a449905ff 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerNonceParameterTest.java
@@ -15,7 +15,9 @@
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.broker.OIDCIdentityProviderConfigRep;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -61,12 +63,10 @@ protected void loginUser() {
 
         oauth.realm(bc.consumerRealmName());
         oauth.clientId("consumer-client");
-        oauth.nonce("123456");
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth
-                .doLoginSocial(bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
+        AuthorizationEndpointResponse authzResponse = doLoginSocial(oauth, bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword(), "123456");
         String code = authzResponse.getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         IDToken idToken = toIdToken(response.getIdToken());
         
         Assert.assertEquals("123456", idToken.getNonce());
@@ -89,12 +89,10 @@ public void testNonceNotSet() {
 
         oauth.realm(bc.consumerRealmName());
         oauth.clientId("consumer-client");
-        oauth.nonce(null);
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth
-                .doLoginSocial(bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
+        AuthorizationEndpointResponse authzResponse = doLoginSocial(oauth, bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword(), null);
         String code = authzResponse.getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         IDToken idToken = toIdToken(response.getIdToken());
 
         Assert.assertNull(idToken.getNonce());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTest.java
index ffa2fc1d4d01..2113da8ae393 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTest.java
@@ -48,7 +48,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.WaitUtils;
 
 import jakarta.ws.rs.core.Response;
@@ -67,6 +67,7 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.Assert.assertEquals;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.REALM_PROV_NAME;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
@@ -408,6 +409,159 @@ public void testIdPNotForceSyncTrustEmailUserAttributes() {
         checkUpdatedUserAttributesIdP(false, true);
     }
 
+    @Test
+    public void testTrustEmailBasedOnEmailVerifiedClaimSyncModeForce() {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        List<UserRepresentation> users = providerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        UserRepresentation providerUser = users.get(0);
+        assertThat(providerUser.isEmailVerified(), is(true));
+        // first broker login
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        RealmRepresentation realmRep = consumerRealm.toRepresentation();
+        realmRep.setVerifyEmail(true);
+        consumerRealm.update(realmRep);
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+        idpRep.setTrustEmail(true);
+        idpRep.getConfig().put(IdentityProviderModel.SYNC_MODE, IdentityProviderSyncMode.FORCE.name());
+        identityProviderResource.update(idpRep);
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        waitForPage(driver, "update account information", false);
+        updateAccountInformationPage.assertCurrent();
+        updateAccountInformationPage.updateAccountInformation("FirstName", "LastName");
+        users = consumerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        List<String> requiredActions = users.get(0).getRequiredActions();
+        assertEquals(0, requiredActions.size());
+        assertThat(users.get(0).isEmailVerified(), is(true));
+
+        // logout
+        AccountHelper.logout(consumerRealm, bc.getUserLogin());
+        AccountHelper.logout(providerRealm, bc.getUserLogin());
+
+        // set the email to not verified at the provider realm
+        providerUser.setEmailVerified(false);
+        providerRealm.users().get(providerUser.getId()).update(providerUser);
+
+        // user is forced to verify email because the account at the provider realm did not verify the email
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        users = consumerRealm.users().search(bc.getUserLogin());
+        assertThat(users.get(0).isEmailVerified(), is(false));
+        assertThat(appPage.isCurrent(), is(false));
+
+        // set the email to verified at the provider realm to trust the verification and update the account at the consumer realm
+        providerUser.setEmailVerified(true);
+        providerRealm.users().get(providerUser.getId()).update(providerUser);
+        AccountHelper.logout(consumerRealm, bc.getUserLogin());
+        AccountHelper.logout(providerRealm, bc.getUserLogin());
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        appPage.assertCurrent();
+    }
+
+    @Test
+    public void testVerifyEmailWhenUpdateProfileAndEmailVerifiedAtIdP() {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        List<UserRepresentation> users = providerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        UserRepresentation providerUser = users.get(0);
+        assertThat(providerUser.isEmailVerified(), is(true));
+        // first broker login
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        RealmRepresentation realmRep = consumerRealm.toRepresentation();
+        realmRep.setVerifyEmail(true);
+        consumerRealm.update(realmRep);
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+        idpRep.setTrustEmail(true);
+        idpRep.getConfig().put(IdentityProviderModel.SYNC_MODE, IdentityProviderSyncMode.FORCE.name());
+        identityProviderResource.update(idpRep);
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        waitForPage(driver, "update account information", false);
+        updateAccountInformationPage.assertCurrent();
+        updateAccountInformationPage.updateAccountInformation("updated@keycloak.org", "FirstName", "LastName");
+        users = consumerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        List<String> requiredActions = users.get(0).getRequiredActions();
+        assertEquals(1, requiredActions.size());
+        // email updated by the user, must verify the email
+        assertThat(users.get(0).getEmail(), is("updated@keycloak.org"));
+    }
+
+    @Test
+    public void testVerifyEmailWhenUpdateProfileSameEmailAndEmailVerifiedAtIdP() {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        List<UserRepresentation> users = providerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        UserRepresentation providerUser = users.get(0);
+        assertThat(providerUser.isEmailVerified(), is(true));
+        // first broker login
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        RealmRepresentation realmRep = consumerRealm.toRepresentation();
+        realmRep.setVerifyEmail(true);
+        consumerRealm.update(realmRep);
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+        idpRep.setTrustEmail(true);
+        idpRep.getConfig().put(IdentityProviderModel.SYNC_MODE, IdentityProviderSyncMode.FORCE.name());
+        identityProviderResource.update(idpRep);
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        waitForPage(driver, "update account information", false);
+        updateAccountInformationPage.assertCurrent();
+        updateAccountInformationPage.updateAccountInformation(bc.getUserEmail(), "FirstName", "LastName");
+        users = consumerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        List<String> requiredActions = users.get(0).getRequiredActions();
+        assertEquals(0, requiredActions.size());
+        // email updated by the user, must verify the email
+        assertThat(users.get(0).getEmail(), is(bc.getUserEmail()));
+    }
+
+    @Test
+    public void testTrustEmailBasedOnEmailVerifiedClaimSyncModeImport() {
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        List<UserRepresentation> users = providerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        UserRepresentation providerUser = users.get(0);
+        assertThat(providerUser.isEmailVerified(), is(true));
+        // first broker login
+        RealmResource consumerRealm = adminClient.realm(bc.consumerRealmName());
+        RealmRepresentation realmRep = consumerRealm.toRepresentation();
+        realmRep.setVerifyEmail(true);
+        consumerRealm.update(realmRep);
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+        idpRep.setTrustEmail(true);
+        idpRep.getConfig().put(IdentityProviderModel.SYNC_MODE, IdentityProviderSyncMode.IMPORT.name());
+        identityProviderResource.update(idpRep);
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        waitForPage(driver, "update account information", false);
+        updateAccountInformationPage.assertCurrent();
+        updateAccountInformationPage.updateAccountInformation("FirstName", "LastName");
+        users = consumerRealm.users().search(bc.getUserLogin());
+        assertEquals(1, users.size());
+        List<String> requiredActions = users.get(0).getRequiredActions();
+        assertEquals(0, requiredActions.size());
+        assertThat(users.get(0).isEmailVerified(), is(true));
+
+        // logout
+        AccountHelper.logout(consumerRealm, bc.getUserLogin());
+        AccountHelper.logout(providerRealm, bc.getUserLogin());
+
+        // set the email to not verified at the provider realm to make sure email is still verified at the consumer realm because of import sync mode
+        providerUser.setEmailVerified(false);
+        providerRealm.users().get(providerUser.getId()).update(providerUser);
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+        appPage.assertCurrent();
+    }
+
     @Test
     public void loginWithClaimFilter() {
         IdentityProviderResource identityProviderResource = getIdentityProviderResource();
@@ -588,7 +742,7 @@ private void checkUpdatedUserAttributesIdP(boolean isForceSync, boolean isTrustE
             // the email verified should be reverted to false if force-sync and not trust-email
             assertThat(consumerUserResource.toRepresentation().isEmailVerified(), Matchers.equalTo(!isForceSync || isTrustEmail));
         } finally {
-            providerUsersResource.delete(providerUserID);
+            providerUsersResource.delete(providerUserID).close();
         }
     }
 
@@ -666,7 +820,7 @@ public void checkUpdatedEmailAttributeIdPSameValueDifferentCase() throws Excepti
             ClientScopeResource emailClientScope = ApiUtil.findClientScopeByName(providerRealmResource, "email");
             ProtocolMapperRepresentation emailMapper = ApiUtil.findProtocolMapperByName(emailClientScope, "email");
             emailClientScope.getProtocolMappers().delete(emailMapper.getId());
-            emailClientScope.getProtocolMappers().createMapper(hardcodedEmail);
+            emailClientScope.getProtocolMappers().createMapper(hardcodedEmail).close();
 
             // login again to force sync
             oauth.clientId("broker-app");
@@ -684,7 +838,7 @@ public void checkUpdatedEmailAttributeIdPSameValueDifferentCase() throws Excepti
             // the email should be verified as it's just a different case
             Assert.assertTrue(consumerUserResource.toRepresentation().isEmailVerified());
         } finally {
-            providerUsersResource.delete(providerUserID);
+            providerUsersResource.delete(providerUserID).close();
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTokenExchangeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTokenExchangeTest.java
index a0fa6bd3516e..547dcc9765dd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTokenExchangeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTokenExchangeTest.java
@@ -22,11 +22,15 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.greaterThan;
 import static org.hamcrest.Matchers.lessThanOrEqualTo;
+import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.notNullValue;
 import static org.hamcrest.Matchers.nullValue;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
 import static org.keycloak.testsuite.util.ProtocolMapperUtil.createHardcodedClaim;
 
+import java.io.IOException;
+import java.util.Set;
+
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.client.Entity;
 import jakarta.ws.rs.client.WebTarget;
@@ -52,6 +56,9 @@
 import org.keycloak.models.IdentityProviderModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserProvider;
+import org.keycloak.models.jpa.JpaRealmProviderFactory;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.representations.AccessTokenResponse;
@@ -60,19 +67,24 @@
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeatures;
 import org.keycloak.testsuite.updaters.IdentityProviderAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.broker.OIDCIdentityProviderConfigRep;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.util.BasicAuthHelper;
 
+/**
+ * Test for identity-provider token exchange scenarios. Base for tests of token-exchange V1
+ */
 @EnableFeatures({@EnableFeature(Profile.Feature.TOKEN_EXCHANGE), @EnableFeature(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)})
-public final class KcOidcBrokerTokenExchangeTest extends AbstractInitializedBaseBrokerTest {
+public class KcOidcBrokerTokenExchangeTest extends AbstractInitializedBaseBrokerTest {
 
     @Override
     protected BrokerConfiguration getBrokerConfiguration() {
@@ -81,24 +93,48 @@ protected BrokerConfiguration getBrokerConfiguration() {
 
     @Test
     public void testExternalInternalTokenExchange() throws Exception {
-        assertExternalToInternalExchange(bc.getIDPAlias());
+        assertExternalToInternalExchange(bc.getIDPAlias(), true, false);
+    }
+
+    // Tests token-exchange works when user is already linked to the IDP
+    @Test
+    public void testExternalInternalTokenExchangeWithExistingUser() throws Exception {
+        assertExternalToInternalExchange(bc.getIDPAlias(), true, false);
+
+        ClientRepresentation brokerApp = realmsResouce().realm(bc.providerRealmName())
+                .clients()
+                .findByClientId("brokerapp").get(0);
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        try (Client httpClient = AdminClientUtil.createResteasyClient()) {
+            WebTarget exchangeUrl = getConsumerTokenEndpoint(httpClient);
+            try (Response response = sendExternalInternalTokenExchangeRequest(exchangeUrl, tokenResponse.getIdToken(), OAuth2Constants.ID_TOKEN_TYPE)) {
+                assertThat(response.getStatus(), equalTo(200));
+            }
+        }
     }
 
     @Test
     public void testExternalInternalTokenExchangeUsingIssuer() throws Exception {
         RealmResource consumerRealm = realmsResouce().realm(bc.consumerRealmName());
         IdentityProviderRepresentation broker = consumerRealm.identityProviders().get(bc.getIDPAlias()).toRepresentation();
-        assertExternalToInternalExchange(broker.getConfig().get(OIDCIdentityProviderConfigRep.ISSUER));
+        assertExternalToInternalExchange(broker.getConfig().get(OIDCIdentityProviderConfigRep.ISSUER), true, false);
     }
 
-    private void assertExternalToInternalExchange(String subjectIssuer) throws Exception {
+    @Test
+    public void testExternalInternalTokenExchangeWithJwtAccessTokenAndUserInfoEndpoint() throws Exception {
+        assertExternalToInternalExchange(bc.getIDPAlias(), false, true);
+    }
+
+    private void assertExternalToInternalExchange(String subjectIssuer, boolean idToken, boolean userInfo) throws Exception {
         RealmResource providerRealm = realmsResouce().realm(bc.providerRealmName());
         ClientsResource clients = providerRealm.clients();
         ClientRepresentation brokerApp = clients.findByClientId("brokerapp").get(0);
         brokerApp.setDirectAccessGrantsEnabled(true);
         ClientResource brokerAppResource = providerRealm.clients().get(brokerApp.getId());
         brokerAppResource.update(brokerApp);
-        brokerAppResource.getProtocolMappers().createMapper(createHardcodedClaim("hard-coded", "hard-coded", "hard-coded", "String", true, true, true)).close();
+        brokerAppResource.getProtocolMappers().createMapper(createHardcodedClaim("hard-coded", "hard-coded", "hard-coded", "String", true, idToken, true)).close();
 
         IdentityProviderMapperRepresentation hardCodedSessionNoteMapper = new IdentityProviderMapperRepresentation();
         hardCodedSessionNoteMapper.setName("hard-coded");
@@ -111,44 +147,127 @@ private void assertExternalToInternalExchange(String subjectIssuer) throws Excep
 
         RealmResource consumerRealm = realmsResouce().realm(bc.consumerRealmName());
         IdentityProviderResource identityProviderResource = consumerRealm.identityProviders().get(bc.getIDPAlias());
+
+        IdentityProviderRepresentation representation = identityProviderResource.toRepresentation();
+        representation.getConfig().put("isAccessTokenJWT", Boolean.toString(!idToken));
+        representation.getConfig().put("validateSignature", Boolean.toString(!userInfo));
+        // if auth.server.host != auth.server.host2 we need to update the issuer in the IDP config
+        if (!representation.getConfig().get("issuer").startsWith(ServerURLs.getAuthServerContextRoot())) {
+            representation.getConfig().put("issuer", ServerURLs.getAuthServerContextRoot() + "/auth/realms/provider");
+        }
+        if (userInfo) {
+            representation.getConfig().put("userInfoUrl", ServerURLs.getAuthServerContextRoot() + "/auth/realms/provider/protocol/openid-connect/userinfo");
+        }
+        identityProviderResource.update(representation);
+
         identityProviderResource.addMapper(hardCodedSessionNoteMapper).close();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest(bc.providerRealmName(), bc.getUserLogin(), bc.getUserPassword(), null, brokerApp.getClientId(), brokerApp.getSecret());
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
         assertThat(tokenResponse.getIdToken(), notNullValue());
 
         testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(KcOidcBrokerTokenExchangeTest::setupRealm);
 
         ClientRepresentation client = consumerRealm.clients().findByClientId("test-app").get(0);
 
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        try {
-            WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                    .path("/realms")
-                    .path(bc.consumerRealmName())
-                    .path("protocol/openid-connect/token");
+        try (Client httpClient = AdminClientUtil.createResteasyClient()) {
+            WebTarget exchangeUrl = getConsumerTokenEndpoint(httpClient);
             // test user info validation.
+            AccessTokenResponse externalToInternalTokenResponse;
+            String subjectToken = idToken ? tokenResponse.getIdToken() : tokenResponse.getAccessToken();
+            String subjectTokenType = idToken ? OAuth2Constants.ID_TOKEN_TYPE : OAuth2Constants.ACCESS_TOKEN_TYPE;
+            try (Response response = sendExternalInternalTokenExchangeRequest(exchangeUrl, subjectToken, subjectTokenType)) {
+                assertThat(response.getStatus(), equalTo(200));
+                externalToInternalTokenResponse = response.readEntity(AccessTokenResponse.class);
+                UserRepresentation user = consumerRealm.users().search(bc.getUserLogin()).get(0);
+                getCleanup(bc.consumerRealmName()).addUserId(user.getId());
+                assertThat(user.getAttributes().get("mapped-from-claim").get(0), equalTo("hard-coded"));
+            }
+
             try (Response response = exchangeUrl.request()
                     .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader(
                             client.getClientId(), client.getSecret()))
                     .post(Entity.form(
                             new Form()
                                     .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN, tokenResponse.getIdToken())
-                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ID_TOKEN_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_ISSUER, subjectIssuer)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN, externalToInternalTokenResponse.getToken())
+                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_ISSUER, bc.getIDPAlias())
                                     .param(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
 
                     ))) {
                 assertThat(response.getStatus(), equalTo(200));
-                UserRepresentation user = consumerRealm.users().search(bc.getUserLogin()).get(0);
-                assertThat(user.getAttributes().get("mapped-from-claim").get(0), equalTo("hard-coded"));
+                AccessTokenResponse internalToExternalTokenResponse = response.readEntity(AccessTokenResponse.class);
             }
-        } finally {
-            httpClient.close();
         }
     }
 
+    @Test
+    public void testWithLinkedFederationProviderTokenExchangeInternalToExternalWithStore() throws IOException {
+        testingClient.server(bc.consumerRealmName()).run(KcOidcBrokerTokenExchangeTest::setupRealm);
+        try (Closeable idpUpdater = new IdentityProviderAttributeUpdater(
+                realmsResouce().realm(bc.consumerRealmName()).identityProviders().get(bc.getIDPAlias()))
+                .setStoreToken(true)
+                .update()) {
+            testWithLinkedFederationProviderTokenExchangeInternalToExternal(true);
+        }
+    }
+
+    @Test
+    public void testWithLinkedFederationProviderTokenExchangeInternalToExternalWithoutStore() throws IOException {
+        testingClient.server(bc.consumerRealmName()).run(KcOidcBrokerTokenExchangeTest::setupRealm);
+        try (Closeable idpUpdater = new IdentityProviderAttributeUpdater(
+                realmsResouce().realm(bc.consumerRealmName()).identityProviders().get(bc.getIDPAlias()))
+                .setStoreToken(false)
+                .update()) {
+            testWithLinkedFederationProviderTokenExchangeInternalToExternal(false);
+        }
+    }
+
+    public void testWithLinkedFederationProviderTokenExchangeInternalToExternal(boolean storeToken) {
+
+        final RealmResource consumerRealm = realmsResouce().realm(bc.consumerRealmName());
+        final int expires = realmsResouce().realm(bc.providerRealmName()).toRepresentation().getAccessTokenLifespan();
+        final ClientRepresentation brokerApp = ApiUtil.findClientByClientId(consumerRealm, "broker-app").toRepresentation();
+
+        logInAsUserInIDPForFirstTimeAndAssertSuccess();
+        final String code = oauth.parseLoginResponse().getCode();
+        oauth.client(brokerApp.getClientId(), brokerApp.getSecret());
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
+        assertThat(tokenResponse.getError(), nullValue());
+        assertThat(tokenResponse.getAccessToken(), notNullValue());
+
+        String realmName = bc.consumerRealmName();
+        String userName = bc.getUserLogin();
+        String idpAlias = bc.getIDPAlias();
+
+        String oldTokenFromDatabase = testingClient.server().fetch(session -> {
+            RealmModel realm = session.realms().getRealmByName(realmName);
+            UserModel user = session.users().getUserByUsername(realm, userName);
+            return session.getProvider(UserProvider.class, JpaRealmProviderFactory.PROVIDER_ID).getFederatedIdentity(realm, user, idpAlias).getToken();
+        }, String.class);
+
+        setTimeOffset(expires + 10);
+
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
+        assertThat(tokenResponse.getError(), nullValue());
+        assertThat(tokenResponse.getAccessToken(), notNullValue());
+
+        exchangeToIdP(brokerApp, tokenResponse.getAccessToken(), expires);
+
+        if (storeToken) {
+            /* Ensure that the tokens are persisted to the database as they would otherwise not be present on other nodes or on server restart */
+            String newTokenFromDatabase = testingClient.server().fetch(session -> {
+                RealmModel realm = session.realms().getRealmByName(realmName);
+                UserModel user = session.users().getUserByUsername(realm, userName);
+                return session.getProvider(UserProvider.class, JpaRealmProviderFactory.PROVIDER_ID).getFederatedIdentity(realm, user, idpAlias).getToken();
+            }, String.class);
+
+            assertThat(newTokenFromDatabase, not(equalTo(oldTokenFromDatabase)));
+        }
+
+    }
+
+
     @Test
     public void testSupportedTokenTypesWhenValidatingSubjectToken() throws Exception {
         testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(KcOidcBrokerTokenExchangeTest::setupRealm);
@@ -168,35 +287,20 @@ public void testSupportedTokenTypesWhenValidatingSubjectToken() throws Exception
             identityProviderResource.update(idpRep);
         });
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest(bc.providerRealmName(), bc.getUserLogin(), bc.getUserPassword(), null, brokerApp.getClientId(), brokerApp.getSecret());
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
         assertThat(tokenResponse.getIdToken(), notNullValue());
         String idTokenString = tokenResponse.getIdToken();
         oauth.realm(bc.providerRealmName());
-        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString)
-                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().idTokenHint(idTokenString)
+                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT).open();
         String logoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
         Assert.assertNotNull(logoutToken);
 
         Client httpClient = AdminClientUtil.createResteasyClient();
         try {
-            WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                    .path("/realms")
-                    .path(bc.consumerRealmName())
-                    .path("protocol/openid-connect/token");
+            WebTarget exchangeUrl = getConsumerTokenEndpoint(httpClient);
             // test user info validation.
-            try (Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader(
-                            "test-app", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN, logoutToken)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.JWT_TOKEN_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_ISSUER, bc.getIDPAlias())
-                                    .param(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
-
-                    ))) {
+            try (Response response = sendExternalInternalTokenExchangeRequest(exchangeUrl, logoutToken, OAuth2Constants.JWT_TOKEN_TYPE)) {
                 assertThat(response.getStatus(), equalTo(Status.BAD_REQUEST.getStatusCode()));
             }
         } finally {
@@ -204,6 +308,52 @@ public void testSupportedTokenTypesWhenValidatingSubjectToken() throws Exception
         }
     }
 
+    @Test
+    public void testIgnoredTokenTypesValidationWhenExplicitlyConfigured() throws Exception {
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(KcOidcBrokerTokenExchangeTest::setupRealm);
+        RealmResource providerRealm = realmsResouce().realm(bc.providerRealmName());
+        ClientsResource clients = providerRealm.clients();
+        ClientRepresentation brokerApp = clients.findByClientId("brokerapp").get(0);
+        brokerApp.setDirectAccessGrantsEnabled(true);
+        ClientResource brokerAppResource = providerRealm.clients().get(brokerApp.getId());
+        brokerAppResource.update(brokerApp);
+        RealmResource consumerRealm = realmsResouce().realm(bc.consumerRealmName());
+        IdentityProviderResource identityProviderResource = consumerRealm.identityProviders().get(bc.getIDPAlias());
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+        idpRep.getConfig().put("disableUserInfo", "true");
+        idpRep.getConfig().put("disableTypeClaimCheck", "true");
+        // if auth.server.host != auth.server.host2 we need to update the issuer in the IDP config
+        if (!idpRep.getConfig().get("issuer").startsWith(ServerURLs.getAuthServerContextRoot())) {
+            idpRep.getConfig().put("issuer", ServerURLs.getAuthServerContextRoot() + "/auth/realms/provider");
+        }
+        identityProviderResource.update(idpRep);
+        getCleanup().addCleanup(() -> {
+            idpRep.getConfig().put("disableUserInfo", "false");
+            idpRep.getConfig().put("disableTypeClaimCheck", "false");
+            identityProviderResource.update(idpRep);
+        });
+
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+        String idTokenString = tokenResponse.getIdToken();
+        oauth.realm(bc.providerRealmName());
+        oauth.logoutForm().idTokenHint(idTokenString)
+                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT).open();
+        String logoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
+        Assert.assertNotNull(logoutToken);
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+        try {
+            WebTarget exchangeUrl = getConsumerTokenEndpoint(httpClient);
+            // test user info validation.
+            try (Response response = sendExternalInternalTokenExchangeRequest(exchangeUrl, logoutToken, OAuth2Constants.JWT_TOKEN_TYPE)) {
+                assertThat(response.getStatus(), equalTo(Status.OK.getStatusCode()));
+            }
+        } finally {
+            httpClient.close();
+        }
+    }
+
     @Test
     public void testInternalExternalTokenExchangeSessionToken() throws Exception {
         testingClient.server(bc.consumerRealmName()).run(KcOidcBrokerTokenExchangeTest::setupRealm);
@@ -241,6 +391,8 @@ private static void setupRealm(KeycloakSession session) {
         client.setSecret("secret");
         client.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
         client.setFullScopeAllowed(false);
+        client.setRedirectUris(Set.of(OAuthClient.AUTH_SERVER_ROOT + "/*"));
+
         ClientModel brokerApp = realm.getClientByClientId("broker-app");
 
         AdminPermissionManagement management = AdminPermissions.management(session, realm);
@@ -264,8 +416,9 @@ private void testInternalExternalTokenExchange() throws Exception {
         final ClientRepresentation brokerApp = ApiUtil.findClientByClientId(consumerRealm, "broker-app").toRepresentation();
 
         logInAsUserInIDPForFirstTimeAndAssertSuccess();
-        final String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, brokerApp.getSecret());
+        final String code = oauth.parseLoginResponse().getCode();
+        oauth.client(brokerApp.getClientId(), brokerApp.getSecret());
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         assertThat(tokenResponse.getError(), nullValue());
         assertThat(tokenResponse.getAccessToken(), notNullValue());
 
@@ -273,13 +426,35 @@ private void testInternalExternalTokenExchange() throws Exception {
 
         setTimeOffset(expires - IdentityProviderModel.DEFAULT_MIN_VALIDITY_TOKEN);
 
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), brokerApp.getSecret());
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertThat(tokenResponse.getError(), nullValue());
         assertThat(tokenResponse.getAccessToken(), notNullValue());
 
         exchangeToIdP(brokerApp, tokenResponse.getAccessToken(), expires);
     }
 
+    private WebTarget getConsumerTokenEndpoint(Client httpClient) {
+        return httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(bc.consumerRealmName())
+                .path("protocol/openid-connect/token");
+    }
+
+    private Response sendExternalInternalTokenExchangeRequest(WebTarget exchangeUrl, String subjectToken, String subjectTokenType) {
+        return exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader(
+                        "test-app", "secret"))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, subjectToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, subjectTokenType)
+                                .param(OAuth2Constants.SUBJECT_ISSUER, bc.getIDPAlias())
+                                .param(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
+
+                ));
+    }
+
     private void exchangeToIdP(ClientRepresentation brokerApp, String subjectToken, long expires) {
         try (Client httpClient = AdminClientUtil.createResteasyClient();
              Response response = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java
index 4500546b7073..f9660e6fbed6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcBrokerTransientSessionsTest.java
@@ -1,5 +1,6 @@
 package org.keycloak.testsuite.broker;
 
+import org.jboss.arquillian.graphene.page.Page;
 import org.keycloak.OAuth2Constants;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
@@ -54,10 +55,12 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
+import org.keycloak.testsuite.pages.UpdateAccountInformationPage;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.Creator;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.WaitUtils;
 
 import org.keycloak.util.TokenUtil;
@@ -112,6 +115,9 @@ protected BrokerConfiguration getBrokerConfiguration() {
         return BROKER_CONFIG_INSTANCE;
     }
 
+    @Page
+    UpdateAccountInformationPage updateAccountInformationPage;
+
     @Before
     public void setUpTotp() {
         totp = new TimeBasedOTP();
@@ -169,7 +175,7 @@ public void mapperDoesNothingForLegacyMode() {
         UserResource userResource = adminClient.realm(bc.providerRealmName()).users().get(userId);
         userResource.roles().realmLevel().add(Collections.singletonList(managerRole));
 
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
         loginPage.open(bc.consumerRealmName());
         logInAsUserInIDPForFirstTime();
 
@@ -190,7 +196,7 @@ public void mapperDoesNothingForLegacyMode() {
 
         userResource.roles().realmLevel().add(Collections.singletonList(userRole));
 
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
         loginPage.open(bc.consumerRealmName());
 
         if (! isUsingTransientSessions()) {
@@ -228,7 +234,7 @@ private void loginFetchingUserFromUserEndpoint(boolean loginIsDenied) {
             brokerApp.getAttributes().put("validateSignature", Boolean.TRUE.toString());
             clients.get(brokerApp.getId()).update(brokerApp);
 
-            oauth.clientId("broker-app");
+            oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
             loginPage.open(bc.consumerRealmName());
 
             logInWithBroker(bc);
@@ -292,7 +298,7 @@ public void loginFetchingUserFromUserEndpointWithClaimMapper() {
 
         identityProviderResource.addMapper(hardCodedSessionNoteMapper).close();
 
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
         loginPage.open(bc.consumerRealmName());
 
         loginFetchingUserFromUserEndpoint();
@@ -309,7 +315,7 @@ public void testInvalidIssuedFor() {
         logoutFromConsumerRealm();
         AccountHelper.logout(adminClient.realm(bc.providerRealmName()), bc.getUserLogin());
 
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
         loginPage.open(bc.consumerRealmName());
 
         log.debug("Clicking social " + bc.getIDPAlias());
@@ -333,7 +339,7 @@ public void testInvalidAudience() {
         logoutFromConsumerRealm();
         AccountHelper.logout(adminClient.realm(bc.providerRealmName()), bc.getUserLogin());
 
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", CONSUMER_BROKER_APP_SECRET);
         loginPage.open(bc.consumerRealmName());
 
         log.debug("Clicking social " + bc.getIDPAlias());
@@ -481,9 +487,8 @@ public void testConsents() throws Exception {
         try (var c = ClientAttributeUpdater.forClient(adminClient, bc.consumerRealmName(), CONSUMER_BROKER_APP_CLIENT_ID).setConsentRequired(true).update()) {
             oauth.clientId(CONSUMER_BROKER_APP_CLIENT_ID);
             oauth.realm(bc.consumerRealmName());
-            oauth.doLoginSocial(bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
-            events.clear();
-            oauth.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail());
+            doLoginSocial(oauth, bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
+
             WaitUtils.waitForPageToLoad();
             consentPage.assertCurrent();
             consentPage.confirm();
@@ -491,10 +496,10 @@ public void testConsents() throws Exception {
             EventRepresentation loginEvent;
             do {
                 loginEvent = events.poll();
-            } while (loginEvent != null && ! Objects.equals(EventType.LOGIN.name(), loginEvent.getType()));
+            } while (loginEvent != null && (!Objects.equals(EventType.LOGIN.name(), loginEvent.getType()) ||
+                    !Objects.equals(loginEvent.getClientId(), CONSUMER_BROKER_APP_CLIENT_ID)));
 
             assertThat(loginEvent, notNullValue());
-            assertThat(loginEvent.getClientId(), is(CONSUMER_BROKER_APP_CLIENT_ID));
             assertThat(loginEvent.getUserId(), Matchers.containsString(LightweightUserAdapter.ID_PREFIX));
 
             final String lwUserId = loginEvent.getUserId();
@@ -546,38 +551,35 @@ public void testUserInfoEndpoint() throws Exception {
         EventRepresentation loginEvent = loginWithBrokerUsingOAuthClient(CONSUMER_BROKER_APP_CLIENT_ID);
         String lwUserId = loginEvent.getUserId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, CONSUMER_BROKER_APP_SECRET);
+        AccessTokenResponse tokenResponse = oauth.client(CONSUMER_BROKER_APP_CLIENT_ID, CONSUMER_BROKER_APP_SECRET).doAccessTokenRequest(code);
 
         // Check that userInfo can be invoked
-        var userInfoResponse = oauth.doUserInfoRequestByGet(tokenResponse);
+        var userInfoResponse = oauth.doUserInfoRequest(tokenResponse.getAccessToken());
         assertThat(userInfoResponse.getUserInfo().getSub(), is(lwUserId));
         assertThat(userInfoResponse.getUserInfo().getPreferredUsername(), is(bc.getUserLogin()));
         assertThat(userInfoResponse.getUserInfo().getEmail(), is(bc.getUserEmail()));
 
         // Check that tokenIntrospection can be invoked
-        var introspectionResponse = oauth.introspectAccessTokenWithClientCredential(CONSUMER_BROKER_APP_CLIENT_ID, CONSUMER_BROKER_APP_SECRET, tokenResponse.getAccessToken());
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(introspectionResponse);
+        JsonNode jsonNode = oauth.doIntrospectionAccessTokenRequest(tokenResponse.getAccessToken()).asJsonNode();
         org.junit.Assert.assertEquals(true, jsonNode.get("active").asBoolean());
         org.junit.Assert.assertEquals(bc.getUserEmail(), jsonNode.get("email").asText());
     }
 
     private EventRepresentation loginWithBrokerUsingOAuthClient(String consumerClientId) {
-        oauth.clientId(consumerClientId);
+        oauth.client(consumerClientId, CONSUMER_BROKER_APP_SECRET);
         oauth.realm(bc.consumerRealmName());
-        oauth.doLoginSocial(bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
-        events.clear();
-        oauth.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail());
+
+        doLoginSocial(oauth, bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
 
         EventRepresentation loginEvent;
         do {
             loginEvent = events.poll();
-        } while (loginEvent != null && ! Objects.equals(EventType.LOGIN.name(), loginEvent.getType()));
+        } while (loginEvent != null && (!Objects.equals(EventType.LOGIN.name(), loginEvent.getType()) ||
+                !Objects.equals(loginEvent.getClientId(), consumerClientId)));
 
         assertThat(loginEvent, notNullValue());
-        assertThat(loginEvent.getClientId(), is(consumerClientId));
         assertThat(loginEvent.getUserId(), Matchers.containsString(LightweightUserAdapter.ID_PREFIX));
 
         return loginEvent;
@@ -600,8 +602,8 @@ public void offlineTokenBrowserFlow() throws Exception {
             final String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, CONSUMER_BROKER_APP_SECRET);
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
             AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
             String offlineTokenString = tokenResponse.getRefreshToken();
@@ -624,7 +626,7 @@ public void offlineTokenBrowserFlow() throws Exception {
             // Change offset to very big value to ensure offline session expires
             setTimeOffset(3000000);
 
-            OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(newRefreshTokenString, CONSUMER_BROKER_APP_SECRET);
+            AccessTokenResponse response = oauth.doRefreshTokenRequest(newRefreshTokenString);
             RefreshToken newRefreshToken = oauth.parseRefreshToken(newRefreshTokenString);
             org.junit.Assert.assertEquals(400, response.getStatusCode());
             assertEquals("invalid_grant", response.getError());
@@ -656,7 +658,7 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of
             // Ignore
         }
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString, CONSUMER_BROKER_APP_SECRET);
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString);
         AccessToken refreshedToken = oauth.verifyToken(response.getAccessToken());
         org.junit.Assert.assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcDefaultIdpTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcDefaultIdpTest.java
index a29cc8fb6d40..77c750aca585 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcDefaultIdpTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcDefaultIdpTest.java
@@ -33,6 +33,12 @@ public void testDefaultIdpSetTriedAndReturnedError() {
         testDefaultIdpSetTriedAndReturnedError("Access denied when authenticating with kc-oidc-idp");
     }
 
+    // Issue 36396
+    @Test
+    public void testLoginHintIsForwarded() {
+        testLoginHintForwarded();
+    }
+
     @Override
     protected BrokerConfiguration getBrokerConfiguration() {
         return new KcOidcBrokerConfiguration();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java
index ec8bc013909b..cc1f5d29c852 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java
@@ -1,7 +1,6 @@
 package org.keycloak.testsuite.broker;
 
 import org.apache.commons.lang3.StringUtils;
-import org.hamcrest.CoreMatchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.IdentityProviderResource;
@@ -15,6 +14,7 @@
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.FederatedIdentityRepresentation;
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.broker.oidc.TestKeycloakOidcIdentityProviderFactory;
@@ -25,6 +25,8 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.ClientScopeBuilder;
+import org.keycloak.testsuite.util.MailServerConfiguration;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.util.JsonSerialization;
 import org.openqa.selenium.By;
 import org.openqa.selenium.NoSuchElementException;
@@ -37,14 +39,17 @@
 import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.testsuite.admin.ApiUtil.removeUserByUsername;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.USER_EMAIL;
 import static org.keycloak.testsuite.broker.BrokerTestTools.createIdentityProvider;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.ATTRIBUTE_DEPARTMENT;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_EDITABLE;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.MailAssert.assertEmailAndGetUrl;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.ATTRIBUTE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_EDITABLE;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
 
 import java.util.List;
 
@@ -478,11 +483,11 @@ public void testAttributeGrouping() {
         updateExecutions(AbstractBrokerTest::enableUpdateProfileOnFirstLogin);
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
                 + "], \"groups\": ["
                 + "{\"name\": \"company\", \"displayDescription\": \"Company field desc\" },"
                 + "{\"name\": \"contact\" }"
@@ -522,11 +527,11 @@ public void testAttributeGuiOrder() {
         updateExecutions(AbstractBrokerTest::enableUpdateProfileOnFirstLogin);
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + "}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + "}"
                 + "]}");
 
         oauth.clientId("broker-app");
@@ -819,12 +824,64 @@ public void testFederatedIdentityCaseInsensitiveOriginalUsername() {
         assertEquals(expectedBrokeredUserName.toLowerCase(), federatedIdentity.getUserName());
     }
 
+    @Test
+    public void testLinkAccountAndVerifyEmailUsingDifferentBrowser() {
+        RealmResource realm = adminClient.realm(bc.consumerRealmName());
+        RealmRepresentation realmRep = realm.toRepresentation();
+
+        realmRep.setVerifyEmail(true);
+
+        realm.update(realmRep);
+
+        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
+
+        idpRep.setTrustEmail(false);
+
+        identityProviderResource.update(idpRep);
+
+        configureSMTPServer();
+
+        // to avoid update profile required action
+        RealmResource providerRealm = adminClient.realm(bc.providerRealmName());
+        UserRepresentation brokerUser = providerRealm.users().search(bc.getUserLogin()).get(0);
+        brokerUser.setFirstName("f");
+        brokerUser.setLastName("l");
+        providerRealm.users().get(brokerUser.getId()).update(brokerUser);
+        // creates a user in the consumer realm to link the account
+        brokerUser.setId(null);
+        realm.users().create(brokerUser).close();
+
+        // link the account
+        oauth.clientId("broker-app");
+        oauth.realm(bc.consumerRealmName());
+        oauth.openLoginForm();
+        logInWithBroker(bc);
+        idpConfirmLinkPage.clickLinkAccount();
+        String verificationUrl = assertEmailAndGetUrl(MailServerConfiguration.FROM, USER_EMAIL,
+                "Someone wants to link your", false);
+        assertNotNull(verificationUrl);
+
+        // confirm the email using a different browser
+        driver2.navigate().to(verificationUrl.trim());
+        driver2.findElement(By.linkText("» Click here to proceed")).click();
+
+        // clear cookies to start a fresh browser instance and try to log in again
+        driver.manage().deleteAllCookies();
+        oauth.realm(bc.consumerRealmName());
+        oauth.openLoginForm();
+        waitForPage(driver, "sign in to", true);
+        loginPage.clickSocial(bc.getIDPAlias());
+        waitForPage(driver, "sign in to", true);
+        loginPage.login(bc.getUserPassword());
+        Assert.assertTrue(appPage.isCurrent());
+    }
+
     public void addDepartmentScopeIntoRealm() {
         testRealm().clientScopes().create(ClientScopeBuilder.create().name("department").protocol("openid-connect").build());
     }
 
     protected void setUserProfileConfiguration(String configuration) {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), configuration);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
     }
 
     private RealmResource testRealm() {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcMultipleTabsBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcMultipleTabsBrokerTest.java
index f5da6327266a..6488efce1bf8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcMultipleTabsBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcOidcMultipleTabsBrokerTest.java
@@ -24,22 +24,28 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.keycloak.OAuthErrorException;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
 import org.keycloak.models.Constants;
 import org.keycloak.protocol.oidc.utils.OIDCResponseMode;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.BrowserTabUtil;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import org.openqa.selenium.htmlunit.HtmlUnitDriver;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assume.assumeTrue;
 import static org.keycloak.testsuite.AssertEvents.DEFAULT_REDIRECT_URI;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
 
 /**
@@ -71,7 +77,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_clickIdpLoginInTab1Afte
             getLogger().infof("URL in tab 1: %s", driver.getCurrentUrl());
 
             // Open new tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             Assert.assertTrue(loginPage.isCurrent("consumer"));
             getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
@@ -111,7 +117,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsu
             loginPage.clickSocial(bc.getIDPAlias());
 
             // Open login page in tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             Assert.assertTrue(loginPage.isCurrent("consumer"));
             getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
@@ -168,6 +174,87 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsu
         }
     }
 
+    // Same like testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsumerAndProvider, but OIDC IDP supports only short "state" parameter. Hence client_data cannot be encoded into it
+    // So this is similar behaviour like KcSamlMultipleTabsBrokerTest.testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsumerAndProvider
+    @Test
+    public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsumerAndProvider_requiresShortStateParameter() {
+        assumeTrue("Since the JS engine in real browser does check the expiration regularly in all tabs, this test only works with HtmlUnit", driver instanceof HtmlUnitDriver);
+
+        // Update IDP and set invalid credentials there
+        IdentityProviderResource idpResource = adminClient.realm(REALM_CONS_NAME).identityProviders().get(IDP_OIDC_ALIAS);
+        IdentityProviderRepresentation idpRep = idpResource.toRepresentation();
+        idpRep.getConfig().put(OAuth2IdentityProviderConfig.REQUIRES_SHORT_STATE_PARAMETER, "true");
+        idpResource.update(idpRep);
+
+
+        try (BrowserTabUtil tabUtil = BrowserTabUtil.getInstanceAndSetEnv(driver)) {
+            // Open login page in tab1 and click "login with IDP"
+            oauth.clientId("broker-app");
+            loginPage.open(bc.consumerRealmName());
+            loginPage.clickSocial(bc.getIDPAlias());
+
+            // Open login page in tab 2
+            tabUtil.newTab(oauth.loginForm().build());
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
+            Assert.assertTrue(loginPage.isCurrent("consumer"));
+            getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
+
+            setTimeOffset(7200000);
+
+            // Finish login in tab2
+            loginPage.clickSocial(bc.getIDPAlias());
+            Assert.assertEquals(loginPage.getError(), "Your login attempt timed out. Login will start from the beginning.");
+            logInWithBroker(bc);
+
+            waitForPage(driver, "update account information", false);
+            updateAccountInformationPage.assertCurrent();
+            Assert.assertTrue("We must be on consumer realm right now",
+                    driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/"));
+            updateAccountInformationPage.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail(), "Firstname", "Lastname");
+            appPage.assertCurrent();
+            events.clear();
+
+            // Login in provider realm will redirect back to consumer with "authentication_expired" error.
+            // The consumer has also expired authentication session, but it cannot redirect to client due the "clientData" missing from IdentityBrokerState.
+            // That is the difference from testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsumerAndProvider, which is able to redirect back to client
+            tabUtil.closeTab(1);
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(1));
+            loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+
+            // Event for "already logged-in" in the provider realm
+            events.expectLogin().error(Errors.ALREADY_LOGGED_IN)
+                    .realm(getProviderRealmId())
+                    .client("brokerapp")
+                    .user((String) null)
+                    .session((String) null)
+                    .removeDetail(Details.CONSENT)
+                    .removeDetail(Details.CODE_ID)
+                    .detail(Details.REDIRECT_URI, Matchers.equalTo(OAuthClient.AUTH_SERVER_ROOT + "/realms/" + bc.consumerRealmName() + "/broker/" + bc.getIDPAlias() + "/endpoint"))
+                    .detail(Details.REDIRECTED_TO_CLIENT, "true")
+                    .detail(Details.RESPONSE_TYPE, OIDCResponseType.CODE)
+                    .detail(Details.RESPONSE_MODE, OIDCResponseMode.QUERY.value())
+                    .assertEvent();
+
+            // Event for "already logged-in" in the consumer realm
+            events.expect(EventType.IDENTITY_PROVIDER_LOGIN).error(Errors.ALREADY_LOGGED_IN)
+                    .realm(getConsumerRealmId())
+                    .client("broker-app")
+                    .user((String) null)
+                    .session((String) null)
+                    .removeDetail(Details.REDIRECT_URI)
+                    .detail(Details.REDIRECTED_TO_CLIENT, "false")
+                    .assertEvent();
+
+            // Being on "You are already logged-in" now. No way to redirect to client due "clientData" are null in "state" of OIDC IDP as OIDC IDP requires short state parameter
+            loginPage.assertCurrent("consumer");
+            Assert.assertEquals("You are already logged in.", loginPage.getInstruction());
+        } finally {
+            // Revert config
+            idpRep.getConfig().put(OAuth2IdentityProviderConfig.REQUIRES_SHORT_STATE_PARAMETER, "false");
+            idpResource.update(idpRep);
+        }
+    }
+
     @Test
     public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider() throws Exception {
         assumeTrue("Since the JS engine in real browser does check the expiration regularly in all tabs, this test only works with HtmlUnit", driver instanceof HtmlUnitDriver);
@@ -184,7 +271,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
             loginPage.clickSocial(bc.getIDPAlias());
 
             // Open login page in tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             Assert.assertTrue(loginPage.isCurrent("consumer"));
             getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
@@ -221,7 +308,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
                     .detail(Details.RESPONSE_MODE, OIDCResponseMode.QUERY.value())
                     .assertEvent();
 
-            // SAML IDP on "consumer" will retry IDP login on the "provider"
+            // OIDC IDP on "consumer" will retry IDP login on the "provider"
             events.expect(EventType.IDENTITY_PROVIDER_LOGIN)
                     .realm(getConsumerRealmId())
                     .client("broker-app")
@@ -255,7 +342,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
 
             // Being redirected back to consumer and then back to client right away. Authentication session on "consumer" realm is still valid, so no error here.
             appPage.assertCurrent();
-            OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
             org.keycloak.testsuite.Assert.assertNotNull(authzResponse.getCode());
             org.keycloak.testsuite.Assert.assertNull(authzResponse.getError());
         }
@@ -264,7 +351,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
     // Assert browser was redirected to the appPage with "error=temporarily_unavailable" and error_description corresponding to Constants.AUTHENTICATION_EXPIRED_MESSAGE
     private void assertOnAppPageWithAlreadyLoggedInError() {
         appPage.assertCurrent(); // Page "You are already logged in." should not be here
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         org.keycloak.testsuite.Assert.assertEquals(OAuthErrorException.TEMPORARILY_UNAVAILABLE, authzResponse.getError());
         org.keycloak.testsuite.Assert.assertEquals(Constants.AUTHENTICATION_EXPIRED_MESSAGE, authzResponse.getErrorDescription());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlBrokerArtifactBindingTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlBrokerArtifactBindingTest.java
index 6ea838fed8cf..7d4cca95c149 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlBrokerArtifactBindingTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlBrokerArtifactBindingTest.java
@@ -1,11 +1,17 @@
 package org.keycloak.testsuite.broker;
 
+import java.io.Closeable;
+import java.io.IOException;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
 import org.junit.Test;
-import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.broker.saml.SAMLIdentityProviderConfig;
+import org.keycloak.crypto.Algorithm;
 import org.keycloak.protocol.saml.SamlConfigAttributes;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
+import org.keycloak.testsuite.updaters.IdentityProviderAttributeUpdater;
+import org.keycloak.testsuite.util.KeyUtils;
 
 public final class KcSamlBrokerArtifactBindingTest extends AbstractInitializedBaseBrokerTest {
 
@@ -14,28 +20,151 @@ protected BrokerConfiguration getBrokerConfiguration() {
         return KcSamlBrokerConfiguration.INSTANCE;
     }
 
+    @Test
+    public void testLoginNoSignatures() throws Exception {
+        try (Closeable idpUpdater = new IdentityProviderAttributeUpdater(identityProviderResource)
+                .setAttribute(SAMLIdentityProviderConfig.ARTIFACT_RESOLUTION_SERVICE_URL,
+                        BrokerTestTools.getProviderRoot() + "/auth/realms/" + bc.providerRealmName() + "/protocol/saml/resolve")
+                .setAttribute(SAMLIdentityProviderConfig.ARTIFACT_BINDING_RESPONSE, Boolean.TRUE.toString())
+                .update();
+            Closeable clientUpdater = ClientAttributeUpdater.forClient(adminClient, bc.providerRealmName(), bc.getIDPClientIdInProviderRealm())
+                .setAttribute(SamlConfigAttributes.SAML_ARTIFACT_BINDING, Boolean.TRUE.toString())
+                .update()) {
+            login(true);
+        }
+    }
+
+    @Test
+    public void testLoginWithSignatureAtResponseLevelSuccess() throws Exception {
+        // success just with signature at response level
+        performTestSuccess(true, false, false,
+                false, false);
+    }
+
+    @Test
+    public void testLoginErrorNoSignature() throws Exception {
+        // failure with no signature at all
+        performTestFailure(false, false, false,
+                false, false);
+    }
+
+    @Test
+    public void testLoginWithSignatureAtResponseLevelErrorInvalidSignature() throws Exception {
+        // failure with invalid signature at response level
+        performTestFailureInvalidCert(true, false, false,
+                false, false);
+    }
+
+    @Test
+    public void testLoginWithSignatureAtAssertionLevelSuccess() throws Exception {
+        // success with signature at assertion level
+        performTestSuccess(false, true, false,
+                false, false);
+    }
+
+    @Test
+    public void testLoginWithSignatureAtAssertionLevelWantAssertionSignatureSuccess() throws Exception {
+        // success with signature at assertion level and wanting assertion signed
+        performTestSuccess(false, true, false,
+                true, false);
+    }
+
+    @Test
+    public void testLoginWithSignatureAtAssertionLevelErrorOnlySignatureAtResponseLevel() throws Exception {
+        // failure when signature in response level only but wanting assertion signed
+        performTestFailure(true, false, false,
+                true, false);
+    }
+
+    @Test
+    public void testLoginWithSignatureAtAssertionLevelErrorInvalidSignature() throws Exception {
+        // failure when assertion level signature with invalid cert
+        performTestFailureInvalidCert(false, true, false,
+                false, false);
+    }
 
     @Test
-    public void testLogin() {
-        // configure artifact binding to the broker
-        IdentityProviderRepresentation idpRep = identityProviderResource.toRepresentation();
-        String baseSamlUrl = idpRep.getConfig().get(SAMLIdentityProviderConfig.ARTIFACT_RESOLUTION_SERVICE_URL);
-        idpRep.getConfig().put(SAMLIdentityProviderConfig.ARTIFACT_RESOLUTION_SERVICE_URL, baseSamlUrl + "/resolve");
-        idpRep.getConfig().put(SAMLIdentityProviderConfig.ARTIFACT_BINDING_RESPONSE, Boolean.TRUE.toString());
-        identityProviderResource.update(idpRep);
+    public void testLoginWithSignatureAndEncryptionAtAssertionLevelSuccess() throws Exception {
+        // success with assertion encrypted and signed
+        performTestSuccess(false, true, true,
+                true, true);
+    }
+
+    @Test
+    public void testLoginWithOnlyEncryptionAtAssertionLevelErrorNoSignature() throws Exception {
+        // failure with assertion encrypted but not signed
+        performTestFailure(false, false, true,
+                false, false);
+    }
 
-        // configure artifact binding to the broker client
-        RealmResource providerRealm = realmsResouce().realm(bc.providerRealmName());
-        ClientRepresentation brokerClient = providerRealm.clients().findByClientId(bc.getIDPClientIdInProviderRealm()).get(0);
-        brokerClient.getAttributes().put(SamlConfigAttributes.SAML_ARTIFACT_BINDING, Boolean.TRUE.toString());
-        providerRealm.clients().get(brokerClient.getId()).update(brokerClient);
+    private void performTestSuccess(boolean providerSignsResponse, boolean providerSignsAssertion, boolean providerEncryptsAssertion,
+            boolean consumerWantsAssertionSigned, boolean consumerWantsAssertionEncrypted) throws IOException {
+        performTest(providerSignsResponse, providerSignsAssertion, providerEncryptsAssertion,
+                consumerWantsAssertionSigned, consumerWantsAssertionEncrypted,
+                false, true);
+    }
+
+    private void performTestFailure(boolean providerSignsResponse, boolean providerSignsAssertion, boolean providerEncryptsAssertion,
+            boolean consumerWantsAssertionSigned, boolean consumerWantsAssertionEncrypted) throws IOException {
+        performTest(providerSignsResponse, providerSignsAssertion, providerEncryptsAssertion,
+                consumerWantsAssertionSigned, consumerWantsAssertionEncrypted,
+                false, false);
+    }
+
+    private void performTestFailureInvalidCert(boolean providerSignsResponse, boolean providerSignsAssertion, boolean providerEncryptsAssertion,
+            boolean consumerWantsAssertionSigned, boolean consumerWantsAssertionEncrypted) throws IOException {
+        performTest(providerSignsResponse, providerSignsAssertion, providerEncryptsAssertion,
+                consumerWantsAssertionSigned, consumerWantsAssertionEncrypted,
+                true, false);
+    }
 
+    private void performTest(boolean providerSignsResponse, boolean providerSignsAssertion, boolean providerEncryptsAssertion,
+            boolean consumerWantsAssertionSigned, boolean consumerWantsAssertionEncrypted,
+            boolean incorrectSigningKey, boolean success) throws IOException {
+        String consumerSigCert = KeyUtils.findActiveSigningKey(adminClient.realm(bc.consumerRealmName()), Algorithm.RS256).getCertificate();
+        MatcherAssert.assertThat(consumerSigCert, Matchers.notNullValue());
+        String consumerEncCert = KeyUtils.findActiveEncryptingKey(adminClient.realm(bc.consumerRealmName()), Algorithm.RSA_OAEP).getCertificate();
+        MatcherAssert.assertThat(consumerEncCert, Matchers.notNullValue());
+
+        try (Closeable idpUpdater = new IdentityProviderAttributeUpdater(identityProviderResource)
+                .setAttribute(SAMLIdentityProviderConfig.ARTIFACT_RESOLUTION_SERVICE_URL,
+                        BrokerTestTools.getProviderRoot() + "/auth/realms/" + bc.providerRealmName() + "/protocol/saml/resolve")
+                .setAttribute(SAMLIdentityProviderConfig.ARTIFACT_BINDING_RESPONSE, Boolean.TRUE.toString())
+                .setAttribute(SAMLIdentityProviderConfig.WANT_AUTHN_REQUESTS_SIGNED, Boolean.TRUE.toString()) // always sign requests
+                .setAttribute(SAMLIdentityProviderConfig.VALIDATE_SIGNATURE, Boolean.TRUE.toString()) // always validate signatures
+                .setAttribute(SAMLIdentityProviderConfig.WANT_ASSERTIONS_SIGNED, Boolean.toString(consumerWantsAssertionSigned))
+                .setAttribute(SAMLIdentityProviderConfig.WANT_ASSERTIONS_ENCRYPTED, Boolean.toString(consumerWantsAssertionEncrypted))
+                .setAttribute(SAMLIdentityProviderConfig.METADATA_DESCRIPTOR_URL,
+                        BrokerTestTools.getProviderRoot() + "/auth/realms/" + bc.providerRealmName() + "/protocol/saml/descriptor")
+                .setAttribute(SAMLIdentityProviderConfig.USE_METADATA_DESCRIPTOR_URL, Boolean.toString(!incorrectSigningKey)) // use metadata only if correct cert
+                .setAttribute(SAMLIdentityProviderConfig.SIGNING_CERTIFICATE_KEY, consumerSigCert)
+                .update();
+            Closeable clientUpdater = ClientAttributeUpdater.forClient(adminClient, bc.providerRealmName(), bc.getIDPClientIdInProviderRealm())
+                .setAttribute(SamlConfigAttributes.SAML_ARTIFACT_BINDING, Boolean.TRUE.toString())
+                .setAttribute(SamlConfigAttributes.SAML_SIGNING_CERTIFICATE_ATTRIBUTE, consumerSigCert)
+                .setAttribute(SamlConfigAttributes.SAML_CLIENT_SIGNATURE_ATTRIBUTE, Boolean.TRUE.toString())
+                .setAttribute(SamlConfigAttributes.SAML_SERVER_SIGNATURE, Boolean.toString(providerSignsResponse))
+                .setAttribute(SamlConfigAttributes.SAML_ASSERTION_SIGNATURE, Boolean.toString(providerSignsAssertion))
+                .setAttribute(SamlConfigAttributes.SAML_ENCRYPT, Boolean.toString(providerEncryptsAssertion))
+                .setAttribute(SamlConfigAttributes.SAML_ENCRYPTION_CERTIFICATE_ATTRIBUTE, consumerEncCert)
+                .update()) {
+            login(success);
+        }
+    }
+
+    private void login(boolean success) {
         // login using artifact binding
         oauth.clientId("broker-app");
         loginPage.open(bc.consumerRealmName());
         logInWithBroker(bc);
-        updateAccountInformationPage.assertCurrent();
-        updateAccountInformationPage.updateAccountInformation("f", "l");
-        appPage.assertCurrent();
+
+        if (success) {
+            updateAccountInformationPage.assertCurrent();
+            updateAccountInformationPage.updateAccountInformation("f", "l");
+            appPage.assertCurrent();
+        } else {
+            errorPage.assertCurrent();
+            Assert.assertEquals("Invalid signature in response from identity provider.", errorPage.getError());
+        }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlMultipleTabsBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlMultipleTabsBrokerTest.java
index c9d64787b190..cc149fae47ef 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlMultipleTabsBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlMultipleTabsBrokerTest.java
@@ -30,7 +30,8 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.BrowserTabUtil;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import org.openqa.selenium.htmlunit.HtmlUnitDriver;
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -68,7 +69,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInBothConsu
             loginPage.clickSocial(bc.getIDPAlias());
 
             // Open login page in tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             Assert.assertTrue(loginPage.isCurrent("consumer"));
             getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
@@ -137,7 +138,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
             loginPage.clickSocial(bc.getIDPAlias());
 
             // Open login page in tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             Assert.assertTrue(loginPage.isCurrent("consumer"));
             getLogger().infof("URL in tab2: %s", driver.getCurrentUrl());
@@ -200,7 +201,7 @@ public void testAuthenticationExpiredWithMoreBrowserTabs_loginExpiredInProvider(
 
             // Authentication session on "consumer" realm is still valid, so no error here.
             appPage.assertCurrent();
-            OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
             org.keycloak.testsuite.Assert.assertNotNull(authzResponse.getCode());
             org.keycloak.testsuite.Assert.assertNull(authzResponse.getError());
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSignedBrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSignedBrokerTest.java
index 1a53300d4489..5b9a3acef261 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSignedBrokerTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSignedBrokerTest.java
@@ -1,6 +1,5 @@
 package org.keycloak.testsuite.broker;
 
-import org.keycloak.OAuth2Constants;
 import org.keycloak.broker.saml.SAMLIdentityProviderConfig;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.dom.saml.v2.protocol.AuthnRequestType;
@@ -22,7 +21,7 @@
 import org.keycloak.testsuite.updaters.IdentityProviderAttributeUpdater;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.KeyUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.SamlClient;
 import org.keycloak.testsuite.util.SamlClient.Binding;
 import org.keycloak.testsuite.util.SamlClientBuilder;
@@ -150,15 +149,13 @@ private void testAssertionSignatureRespected() {
         loginUser();
 
         // Logout should fail because logout response is not signed.
-        final String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        final OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        final String code = oauth.parseLoginResponse().getCode();
+        final AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         final String idTokenString = tokenResponse.getIdToken();
         final String redirectUri = getAccountUrl(getProviderRoot(), bc.providerRealmName());
-        final String logoutUri = oauth.realm(bc.providerRealmName()).getLogoutUrl()
+        oauth.realm(bc.providerRealmName()).logoutForm()
             .idTokenHint(idTokenString)
-            .postLogoutRedirectUri(redirectUri).build();
-
-        driver.navigate().to(logoutUri);
+            .postLogoutRedirectUri(redirectUri).open();
 
         errorPage.assertCurrent();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSpDescriptorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSpDescriptorTest.java
index 5c2a224a4e0d..a72270be1108 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSpDescriptorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/KcSamlSpDescriptorTest.java
@@ -396,11 +396,19 @@ public void testMetadataBindingEqualsKeycloakPOSTBindingSettingsOn()
             EntityDescriptorType o = (EntityDescriptorType) parser.parse(new StringInputStream(spDescriptorString));
             SPSSODescriptorType spDescriptor = o.getChoiceType().get(0).getDescriptors().get(0).getSpDescriptor();
 
+            assertThat(spDescriptor.getSingleLogoutService().size(), is(2));
             assertThat(spDescriptor.getSingleLogoutService().get(0).getBinding().toString(),
                     is(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get()));
+            assertThat(spDescriptor.getSingleLogoutService().get(1).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get()));
+
+            assertThat(spDescriptor.getAssertionConsumerService().size(), is(3));
             assertThat(spDescriptor.getAssertionConsumerService().get(0).getBinding().toString(),
                     is(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get()));
-
+            assertThat(spDescriptor.getAssertionConsumerService().get(1).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get()));
+            assertThat(spDescriptor.getAssertionConsumerService().get(2).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get()));
         }
     }
 
@@ -419,11 +427,19 @@ public void testMetadataBindingEqualsKeycloakPOSTBindingSettingsOff()
             EntityDescriptorType o = (EntityDescriptorType) parser.parse(new StringInputStream(spDescriptorString));
             SPSSODescriptorType spDescriptor = o.getChoiceType().get(0).getDescriptors().get(0).getSpDescriptor();
 
+            assertThat(spDescriptor.getSingleLogoutService().size(), is(2));
             assertThat(spDescriptor.getSingleLogoutService().get(0).getBinding().toString(),
                     is(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get()));
+            assertThat(spDescriptor.getSingleLogoutService().get(1).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get()));
+
+            assertThat(spDescriptor.getAssertionConsumerService().size(), is(3));
             assertThat(spDescriptor.getAssertionConsumerService().get(0).getBinding().toString(),
                     is(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get()));
-
+            assertThat(spDescriptor.getAssertionConsumerService().get(1).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get()));
+            assertThat(spDescriptor.getAssertionConsumerService().get(2).getBinding().toString(),
+                    is(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.get()));
         }
     }
 
@@ -437,6 +453,8 @@ public void testMetadataBindingEqualsKeycloakSLOBindingSettingsIsDefault()
             EntityDescriptorType o = (EntityDescriptorType) parser.parse(new StringInputStream(spDescriptorString));
             SPSSODescriptorType spDescriptor = o.getChoiceType().get(0).getDescriptors().get(0).getSpDescriptor();
 
+            assertThat(spDescriptor.getSingleLogoutService().size(), is(2));
+            assertThat(spDescriptor.getAssertionConsumerService().size(), is(3));
             assertThat(spDescriptor.getSingleLogoutService().get(0).getBinding().toString(),
                     is(spDescriptor.getAssertionConsumerService().get(0).getBinding().toString()));
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OAuth2BrokerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OAuth2BrokerTest.java
new file mode 100644
index 000000000000..4c798c0a8d64
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OAuth2BrokerTest.java
@@ -0,0 +1,158 @@
+package org.keycloak.testsuite.broker;
+
+import jakarta.ws.rs.BadRequestException;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.broker.oauth.OAuth2IdentityProviderFactory;
+import org.keycloak.models.IdentityProviderMapperSyncMode;
+import org.keycloak.models.IdentityProviderSyncMode;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.protocol.oidc.mappers.HardcodedClaim;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.Assert;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Final class as it's not intended to be overriden. Feel free to remove "final" if you really know what you are doing.
+ */
+public final class OAuth2BrokerTest extends AbstractAdvancedBrokerTest {
+
+    @Override
+    protected BrokerConfiguration getBrokerConfiguration() {
+        return new KcOidcBrokerConfiguration() {
+            @Override
+            public IdentityProviderRepresentation setUpIdentityProvider(IdentityProviderSyncMode syncMode) {
+                IdentityProviderRepresentation broker = super.setUpIdentityProvider(syncMode);
+
+                broker.setProviderId(OAuth2IdentityProviderFactory.PROVIDER_ID);
+
+                // set the openid scope to be able to access the userinfo endpoint
+                broker.getConfig().put("defaultScope", "openid");
+
+                return broker;
+            }
+
+            @Override
+            public List<ClientRepresentation> createProviderClients() {
+                List<ClientRepresentation> clients = super.createProviderClients();
+                ClientRepresentation client = clients.get(0);
+                List<ProtocolMapperRepresentation> protocolMappers = new ArrayList<>(client.getProtocolMappers());
+                ProtocolMapperModel userNameClaim = HardcodedClaim.create("username-claim", "username-claim", "username-claim", "String", true, true, true);
+                protocolMappers.add(ModelToRepresentation.toRepresentation(userNameClaim));
+                ProtocolMapperModel firstNameClaim = HardcodedClaim.create("first-name-claim", "first-name-claim", "first-name-claim", "String", true, true, true);
+                protocolMappers.add(ModelToRepresentation.toRepresentation(firstNameClaim));
+                ProtocolMapperModel lastNameClaim = HardcodedClaim.create("last-name-claim", "last-name-claim", "last-name-claim", "String", true, true, true);
+                protocolMappers.add(ModelToRepresentation.toRepresentation(lastNameClaim));
+                ProtocolMapperModel nameClaim = HardcodedClaim.create("name-claim", "name-claim", "my user", "String", true, true, true);
+                protocolMappers.add(ModelToRepresentation.toRepresentation(nameClaim));
+                ProtocolMapperModel emailClaim = HardcodedClaim.create("email-claim", "email-claim", "email-claim@keycloak.org", "String", true, true, true);
+                protocolMappers.add(ModelToRepresentation.toRepresentation(emailClaim));
+                client.setProtocolMappers(protocolMappers);
+                return clients;
+            }
+        };
+    }
+
+    @Test
+    public void testLoginDefaultConfiguration() {
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+
+        updateAccountInformationPage.assertCurrent();
+        Assert.assertTrue("We must be on correct realm right now",
+                driver.getCurrentUrl().contains("/auth/realms/" + bc.consumerRealmName() + "/"));
+        log.debug("Updating info on updateAccount page");
+        updateAccountInformationPage.updateAccountInformation(bc.getUserLogin(), bc.getUserEmail(), "Firstname", "Lastname");
+
+        List<UserRepresentation> users = adminClient.realm(bc.consumerRealmName()).users().search(bc.getUserLogin());
+        Assert.assertEquals(1, users.size());
+        UserRepresentation user = users.get(0);
+        Assert.assertEquals(bc.getUserLogin(), user.getUsername());
+        Assert.assertEquals(bc.getUserEmail(), user.getEmail());
+        Assert.assertEquals("Firstname", user.getFirstName());
+        Assert.assertEquals("Lastname", user.getLastName());
+    }
+
+    @Test
+    public void testFetchUserProfileClaims() {
+        IdentityProviderResource brokerResource = realmsResouce().realm(bc.consumerRealmName()).identityProviders().get(bc.getIDPAlias());
+        IdentityProviderRepresentation broker = brokerResource.toRepresentation();
+        broker.getConfig().put("userNameClaim", "username-claim");
+        broker.getConfig().put("emailClaim", "email-claim");
+        broker.getConfig().put("fullNameClaim", "name-claim");
+        brokerResource.update(broker);
+
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        logInWithBroker(bc);
+
+        List<UserRepresentation> users = adminClient.realm(bc.consumerRealmName()).users().search("username-claim");
+        Assert.assertEquals(1, users.size());
+        UserRepresentation user = users.get(0);
+        Assert.assertEquals("username-claim", user.getUsername());
+        Assert.assertEquals("email-claim@keycloak.org", user.getEmail());
+        Assert.assertEquals("my", user.getFirstName());
+        Assert.assertEquals("user", user.getLastName());
+    }
+
+    @Test
+    public void testMandatoryFields() {
+        assertMandatorySetting("userInfoUrl", "User Info URL not provided");
+    }
+
+    private void assertMandatorySetting(String key, String errorMessage) {
+        IdentityProviderResource brokerResource = realmsResouce().realm(bc.consumerRealmName()).identityProviders().get(bc.getIDPAlias());
+        IdentityProviderRepresentation broker = brokerResource.toRepresentation();
+
+        try {
+            broker.getConfig().remove(key);
+            brokerResource.update(broker);
+            Assert.fail(key + " must be mandatory");
+        } catch (BadRequestException bre) {
+            Assert.assertTrue(bre.getResponse().readEntity(String.class).contains(errorMessage));
+        }
+    }
+
+    @Override
+    protected Iterable<IdentityProviderMapperRepresentation> createIdentityProviderMappers(IdentityProviderMapperSyncMode syncMode) {
+        return List.of();
+    }
+
+    @Override
+    protected void createAdditionalMapperWithCustomSyncMode(IdentityProviderMapperSyncMode syncMode) {
+
+    }
+
+    @Test
+    @Ignore
+    @Override
+    public void differentMappersCanHaveDifferentSyncModes() {
+    }
+
+    @Test
+    @Ignore
+    @Override
+    public void mapperDoesNotGrantNewRoleFromTokenWithSyncModeImport() {
+    }
+
+    @Test
+    @Ignore
+    @Override
+    public void mapperGrantsNewRoleFromTokenWithInheritedSyncModeForce() {
+    }
+
+    @Test
+    @Ignore
+    @Override
+    public void mapperDoesNotGrantNewRoleFromTokenWithInheritedSyncModeImport() {
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OidcClaimToUserSessionNoteMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OidcClaimToUserSessionNoteMapperTest.java
index 9440b8976d05..fcf1ca869429 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OidcClaimToUserSessionNoteMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/OidcClaimToUserSessionNoteMapperTest.java
@@ -24,7 +24,8 @@
 import org.keycloak.representations.idm.IdentityProviderMapperRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import com.google.common.collect.ImmutableMap;
 
@@ -135,13 +136,13 @@ private void logout() {
     }
 
     private AccessToken login() {
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.realm(bc.consumerRealmName())
-                .clientId("broker-app")
-                .redirectUri(getAuthServerRoot() + "realms/" + bc.consumerRealmName() + "/account")
-                .doLoginSocial(bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
+        oauth.realm(bc.consumerRealmName())
+                .client("broker-app", consumerClientRep.getSecret())
+                .redirectUri(getAuthServerRoot() + "realms/" + bc.consumerRealmName() + "/app");
+        AuthorizationEndpointResponse authzResponse = doLoginSocial(oauth, bc.getIDPAlias(), bc.getUserLogin(), bc.getUserPassword());
 
         String code = authzResponse.getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, consumerClientRep.getSecret());
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         return toAccessToken(response.getAccessToken());
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/SocialLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/SocialLoginTest.java
index 00a050725701..1dc8fb95fab2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/SocialLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/broker/SocialLoginTest.java
@@ -6,6 +6,7 @@
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.BeforeClass;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.IdentityProviderResource;
@@ -26,8 +27,8 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
 import org.keycloak.representations.idm.authorization.DecisionStrategy;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
@@ -49,7 +50,7 @@
 import org.keycloak.testsuite.pages.social.TwitterConsentLoginPage;
 import org.keycloak.testsuite.util.DroneUtils;
 import org.keycloak.testsuite.util.IdentityProviderBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.URLUtils;
 import org.keycloak.testsuite.util.WaitUtils;
@@ -351,6 +352,7 @@ public void facebookLoginWithEnhancedScope() throws InterruptedException {
     }
 
     @Test
+    @Ignore
     public void instagramLogin() throws InterruptedException {
         setTestProvider(INSTAGRAM);
         performLogin();
@@ -507,8 +509,8 @@ private void navigateToLoginPage() {
 
         driver.navigate().to(
                 currentTestProvider.equals(PAYPAL)
-                        ? oauth.getLoginFormUrl("https://127.0.0.1:8543/auth")
-                        : oauth.getLoginFormUrl()
+                        ? oauth.loginForm().build().replace("https://localhost", "https://127.0.0.1")
+                        : oauth.loginForm().build()
         );
         loginPage.clickSocial(currentTestProvider.id());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTest.java
index be7497c8a08f..bc794364a727 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTest.java
@@ -608,8 +608,8 @@ public void testCRUDWithToken() throws Exception {
         //non-TLS endpoint
         oauth.baseUrl(serverUrl);
         oauth.realm("master");
-        oauth.clientId("admin-cli");
-        String token = oauth.doGrantAccessTokenRequest("", "admin", "admin").getAccessToken();
+        oauth.client("admin-cli");
+        String token = oauth.doPasswordGrantRequest("admin", "admin").getAccessToken();
         testCRUDWithOnTheFlyAuth(serverUrl, " --token " + token, "",
                 "");
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTruststoreTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTruststoreTest.java
index fced3bfbfc17..572c778f27cd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTruststoreTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/admin/KcAdmTruststoreTest.java
@@ -6,7 +6,7 @@
 import org.keycloak.client.cli.config.ConfigData;
 import org.keycloak.client.cli.config.FileConfigHandler;
 import org.keycloak.testsuite.cli.KcAdmExec;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TempFileResource;
 
 import java.io.File;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/registration/KcRegTruststoreTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/registration/KcRegTruststoreTest.java
index b1a74289e72a..d74de7333fdc 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/registration/KcRegTruststoreTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cli/registration/KcRegTruststoreTest.java
@@ -5,7 +5,7 @@
 import org.keycloak.client.cli.config.ConfigData;
 import org.keycloak.client.cli.config.FileConfigHandler;
 import org.keycloak.testsuite.cli.KcRegExec;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TempFileResource;
 
 import java.io.File;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractClientRegistrationTest.java
index a2ce17deca54..5c7e4ef4ade5 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractClientRegistrationTest.java
@@ -134,7 +134,7 @@ protected String getToken(String username, String password) {
 
     protected String getToken(String clientId, String clientSecret, String username, String password) {
         try {
-            return oauth.doGrantAccessTokenRequest(REALM_NAME, username, password, null, clientId, clientSecret).getAccessToken();
+            return oauth.client(clientId, clientSecret).doPasswordGrantRequest(username, password).getAccessToken();
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractFAPITest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractFAPITest.java
index d5638000bed0..ef3c51eeda21 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractFAPITest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractFAPITest.java
@@ -41,6 +41,7 @@
 import org.hamcrest.MatcherAssert;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
+import org.junit.After;
 import org.junit.Assume;
 import org.junit.BeforeClass;
 import org.keycloak.OAuth2Constants;
@@ -60,8 +61,10 @@
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ServerURLs;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 
 public abstract class AbstractFAPITest extends AbstractClientPoliciesTest {
 
@@ -80,12 +83,19 @@ public abstract class AbstractFAPITest extends AbstractClientPoliciesTest {
     @Page
     protected AppPage appPage;
 
+    protected PkceGenerator pkceGenerator;
+
     @BeforeClass
     public static void verifySSL() {
-        // FAPI requires SSL and does not makes sense to test it with disabled SSL
+        // FAPI requires SSL and does not make sense to test it with disabled SSL
         Assume.assumeTrue("The FAPI test requires SSL to be enabled.", ServerURLs.AUTH_SERVER_SSL_REQUIRED);
     }
 
+    @After
+    public void resetPkce() {
+        pkceGenerator = null;
+    }
+
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmRepresentation realm = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
@@ -120,39 +130,34 @@ public static void assertScopes(String expectedScope, String receivedScope) {
                 expectedScopes.containsAll(receivedScopes) && receivedScopes.containsAll(expectedScopes));
     }
 
-    protected String getParameterFromUrl(String paramName, boolean fragmentExpected) {
-        return fragmentExpected ? oauth.getCurrentFragment().get(paramName) : oauth.getCurrentQuery().get(paramName);
-    }
-
-    protected String loginUserAndGetCode(String clientId, boolean fragmentResponseModeExpected) {
-        oauth.clientId(clientId);
-        oauth.doLogin(TEST_USERNAME, TEST_USERSECRET);
+    protected String loginUserAndGetCode(String clientId, String nonce, boolean fragmentResponseModeExpected) {
+        oauth.client(clientId);
+        oauth.loginForm().nonce(nonce).codeChallenge(pkceGenerator).request(request).requestUri(requestUri).doLogin(TEST_USERNAME, TEST_USERSECRET);
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
         grantPage.accept();
 
-        String code = getParameterFromUrl(OAuth2Constants.CODE, fragmentResponseModeExpected);
+        String code = oauth.parseLoginResponse().getCode();
         Assert.assertNotNull(code);
         return code;
     }
 
-    protected String loginUserAndGetCodeInJwtQueryResponseMode(String clientId) {
-        oauth.clientId(clientId);
-        oauth.doLogin(TEST_USERNAME, TEST_USERSECRET);
+    protected String loginUserAndGetCodeInJwtQueryResponseMode(String clientId, String nonce) {
+        oauth.client(clientId);
+        oauth.loginForm().nonce(nonce).codeChallenge(pkceGenerator).request(request).requestUri(requestUri).doLogin(TEST_USERNAME, TEST_USERSECRET);
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
         grantPage.accept();
 
-        System.out.println("KKKKK response = " + oauth.getCurrentQuery().get("response"));
-        AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(oauth.getCurrentQuery().get("response"));
+        AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(oauth.parseLoginResponse().getResponse());
         String code = (String)responseToken.getOtherClaims().get("code");
         Assert.assertNotNull(code);
         return code;
     }
 
-    protected void assertSuccessfulTokenResponse(OAuthClient.AccessTokenResponse tokenResponse) {
+    protected void assertSuccessfulTokenResponse(AccessTokenResponse tokenResponse) {
         assertEquals(200, tokenResponse.getStatusCode());
         MatcherAssert.assertThat(tokenResponse.getIdToken(), Matchers.notNullValue());
         MatcherAssert.assertThat(tokenResponse.getAccessToken(), Matchers.notNullValue());
@@ -179,10 +184,11 @@ protected void logoutUserAndRevokeConsent(String clientId, String username) {
         user.revokeConsent(clientId);
     }
 
-    protected void assertRedirectedToClientWithError(String expectedError, boolean fragmentExpected, String expectedErrorDescription) {
+    protected void assertRedirectedToClientWithError(String expectedError, String expectedErrorDescription) {
         appPage.assertCurrent();
-        assertEquals(expectedError, getParameterFromUrl(OAuth2Constants.ERROR, fragmentExpected));
-        assertEquals(expectedErrorDescription, getParameterFromUrl(OAuth2Constants.ERROR_DESCRIPTION, fragmentExpected));
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        assertEquals(expectedError, response.getError());
+        assertEquals(expectedErrorDescription, response.getErrorDescription());
     }
 
     protected void assertBrowserWithError(String expectedError) {
@@ -190,20 +196,20 @@ protected void assertBrowserWithError(String expectedError) {
         Assert.assertEquals(expectedError, errorPage.getError());
     }
 
-    protected OAuthClient.AccessTokenResponse doAccessTokenRequestWithClientSignedJWT(String code, String signedJwt, String codeVerifier, Supplier<CloseableHttpClient> httpClientSupplier) {
+    protected AccessTokenResponse doAccessTokenRequestWithClientSignedJWT(String code, String signedJwt, Supplier<CloseableHttpClient> httpClientSupplier) {
         try {
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
-            if (codeVerifier != null) {
-                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
+            if (pkceGenerator != null) {
+                parameters.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, pkceGenerator.getCodeVerifier()));
             }
             parameters.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, oauth.getRedirectUri()));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-            CloseableHttpResponse response = sendRequest(oauth.getAccessTokenUrl(), parameters, httpClientSupplier);
-            return new OAuthClient.AccessTokenResponse(response);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters, httpClientSupplier);
+            return new AccessTokenResponse(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
@@ -219,14 +225,11 @@ protected String createSignedRequestToken(String clientId, String algorithm) thr
     }
 
     protected CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair> parameters, Supplier<CloseableHttpClient> httpClientSupplier) throws Exception {
-        CloseableHttpClient client = httpClientSupplier.get();
-        try {
+        try (CloseableHttpClient client = httpClientSupplier.get()) {
             HttpPost post = new HttpPost(requestUrl);
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
             return client.execute(post);
-        } finally {
-            oauth.closeClient(client);
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/CIBATest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/CIBATest.java
index 6ac22d7db621..2bf1ada7b9ce 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/CIBATest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/CIBATest.java
@@ -25,7 +25,6 @@
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.core.Response.Status;
 
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.impl.client.CloseableHttpClient;
 
 import static org.hamcrest.Matchers.notNullValue;
@@ -112,9 +111,7 @@
 import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutorFactory;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.Matchers;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.testsuite.util.UserBuilder;
@@ -123,13 +120,12 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.ciba.AuthenticationRequestAcknowledgement;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.testsuite.client.policies.AbstractClientPoliciesTest;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 /**
  * Tests for the CIBA "poll" mode and generic CIBA functionality tests
  *
@@ -236,7 +232,9 @@ public void testAttackerClientUseVictimAuthReqIdAttack() throws Exception {
             doAuthenticationChannelCallback(victimClientAuthenticationChannelReq);
 
             // attacker client Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(attackerClientName, attackerClientPassword, victimClientAuthReqId);
+
+            oauth.client(attackerClientName, attackerClientPassword);
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(victimClientAuthReqId);
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.INVALID_GRANT)));
             assertThat(tokenRes.getErrorDescription(), is(equalTo("unauthorized client")));
@@ -265,11 +263,11 @@ public void testAttackerClientUseAuthReqIdInCallbackEndpoint() throws Exception
 
             // This request should not ever pass. Client should not be allowed to send the successfull "approve" request to the BackchannelAuthenticationCallbackEndpoint
             // with using the "authReqId" as a bearer token
-            int statusCode = oauth.doAuthenticationChannelCallback(response.getAuthReqId(), SUCCEED);
+            int statusCode = oauth.ciba().doAuthenticationChannelCallback(response.getAuthReqId(), SUCCEED);
             assertThat(statusCode, is(equalTo(403)));
 
             // client sends TokenRequest - This should not pass and should return 400
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.AUTHORIZATION_PENDING)));
         } finally {
@@ -291,12 +289,14 @@ public void testAuthenticationChannelUnexpectedError() throws Exception {
             prepareCIBASettings(clientResource, clientRep);
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, signal, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(signal).send();
             assertThat(response.getStatusCode(), is(equalTo(503)));
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest("invalid");
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.INVALID_GRANT)));
             assertThat(tokenRes.getErrorDescription(), is(equalTo("Invalid Auth Req ID")));
@@ -317,9 +317,10 @@ public void testBackchannelAuthnReqWithDeactivatedUser() throws Exception {
             clientRep = clientResource.toRepresentation();
             prepareCIBASettings(clientResource, clientRep);
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
 
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, null, "acr2");
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).acrValues("acr2").send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         } finally {
@@ -340,9 +341,10 @@ public void testBackchannelAuthnReqWithUnknownUser() throws Exception {
             clientRep = clientResource.toRepresentation();
             prepareCIBASettings(clientResource, clientRep);
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
 
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, "urn:mace:incommon:iap:silver urn:mace:incommon:iap:gold");
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).acrValues("urn:mace:incommon:iap:silver urn:mace:incommon:iap:gold").send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         } finally {
@@ -363,9 +365,10 @@ public void testBackchannelAuthnReqWithoutLoginHint() throws Exception {
             clientRep = clientResource.toRepresentation();
             prepareCIBASettings(clientResource, clientRep);
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
 
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, "ACR1");
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).acrValues("ACR1").send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         } finally {
@@ -388,8 +391,10 @@ public void testLoginHintTokenRequiredButNotSend() throws Exception {
             rep.setAttributes(attrMap);
             testRealm().update(rep);
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, null, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().doBackchannelAuthenticationRequest(username);
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         } finally {
@@ -404,6 +409,8 @@ public void testBadBindingMessage() throws Exception {
         ClientResource clientResource = null;
         ClientRepresentation clientRep = null;
         try {
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             final String username = "nutzername-schwarz";
             clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
             clientRep = clientResource.toRepresentation();
@@ -411,25 +418,25 @@ public void testBadBindingMessage() throws Exception {
 
             // Binding message with non plain-text characters
             String bindingMessage = "1234 \uD83D\uDC4D\uD83C\uDFFF 品川 Lor";
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_BINDING_MESSAGE));
 
             // Long binding message
             bindingMessage = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud.";
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_BINDING_MESSAGE));
 
             // Empty binding message
             bindingMessage = "";
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_BINDING_MESSAGE));
 
             // Valid binding message
             bindingMessage = "Lorem_ipsum";
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(200)));
             assertThat(response.getError(), is(nullValue()));
         } finally {
@@ -461,10 +468,10 @@ public void testDifferentUserAuthenticated() throws Exception {
             assertThat(authenticationChannelReq.getRequest().getScope(), is(containsString(OAuth2Constants.OFFLINE_ACCESS)));
 
             // different user Authentication Channel completed
-//            oauth.doAuthenticationChannelCallback(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET, usernameAuthenticated, authenticationChannelReq.getBearerToken(), SUCCEEDED);
+//            oauth.ciba().doAuthenticationChannelCallback(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET, usernameAuthenticated, authenticationChannelReq.getBearerToken(), SUCCEEDED);
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
         } finally {
@@ -500,16 +507,16 @@ public void testTokenRevocation() throws Exception {
             String userId = loginEvent.getUserId();
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, true);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // revoke by refresh token
             EventRepresentation logoutEvent = doTokenRevokeByRefreshToken(tokenRes.getRefreshToken(), tokenRes.getSessionState(), userId, true);
@@ -582,15 +589,15 @@ public void testAccessThrottling() throws Exception {
             assertThat(authenticationChannelReq.getRequest().getBindingMessage(), is(equalTo(bindingMessage)));
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.AUTHORIZATION_PENDING)); // 10+5+5 sec
 
-            tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.SLOW_DOWN)); // 10+5+5 sec
 
-            tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.SLOW_DOWN)); // 10+5+5+5 sec
 
@@ -605,13 +612,13 @@ public void testAccessThrottling() throws Exception {
             tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, false);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // revoke by refresh token
             EventRepresentation logoutEvent = doTokenRevokeByRefreshToken(tokenRes.getRefreshToken(), tokenRes.getSessionState(), userId, false);
@@ -644,12 +651,12 @@ public void testTokenRequestAfterIntervalButNotYetAuthenticated() throws Excepti
             AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage);
 
             // user Token Request but not yet user being authenticated
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.AUTHORIZATION_PENDING));
 
             // user Token Request but not yet user being authenticated
-            tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.SLOW_DOWN));
 
@@ -669,13 +676,13 @@ public void testTokenRequestAfterIntervalButNotYetAuthenticated() throws Excepti
             tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, false);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // revoke by refresh token
             EventRepresentation logoutEvent = doTokenRevokeByRefreshToken(tokenRes.getRefreshToken(), tokenRes.getSessionState(), userId, false);
@@ -837,14 +844,16 @@ public void testPingMode_requestWithInvalidClientNotificationShouldFail() throws
             clientRep = clientResource.toRepresentation();
             prepareCIBASettings(clientResource, clientRep, "ping");
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // Backchannel Authentication Request without client_notification should fail
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, "nutzername-rot", "BASTION_PING", null,null, Collections.emptyMap());
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest("nutzername-rot").bindingMessage("BASTION_PING").send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
 
             // Backchannel Authentication Request without client_notification should fail
             String clientNotificationLongerThan1024Characters = "123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789_123456789123456789123465789123456789123456789123456789123456789123456789123456789123456789123456789123456789123456789";
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, "nutzername-rot", "BASTION_PING", null,clientNotificationLongerThan1024Characters, Collections.emptyMap());
+            response = oauth.ciba().backchannelAuthenticationRequest("nutzername-rot").bindingMessage("BASTION_PING").clientNotificationToken(clientNotificationLongerThan1024Characters).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         } finally {
@@ -898,7 +907,7 @@ public void testPingModeSuccess() throws Exception {
             Assert.assertEquals(pushedClientNotification.getAuthReqId(), response.getAuthReqId());
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
             IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
             long currentTime = Time.currentTime();
             long authTime = idToken.getAuth_time().longValue();
@@ -906,13 +915,13 @@ public void testPingModeSuccess() throws Exception {
             assertTrue(authTime <= currentTime + 5);
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, false);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // logout by refresh token
             EventRepresentation logoutEvent = doLogoutByRefreshToken(tokenRes.getRefreshToken(), sessionId, userId, false);
@@ -950,7 +959,7 @@ public void testPingMode_clientNotificationSentEvenForUserCancel() throws Except
             Assert.assertEquals(pushedClientNotification.getAuthReqId(), response.getAuthReqId());
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(Status.BAD_REQUEST.getStatusCode())));
             assertThat(tokenRes.getError(), is(OAuthErrorException.ACCESS_DENIED));
 
@@ -997,7 +1006,7 @@ public void testMultipleUsersBackchannelAuthenticationFlows() throws Exception {
             String secondUserSessionCodeId = secondUserloginEvent.getDetails().get(Details.CODE_ID);
 
             // second user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(secondUsername, secondUserAuthReqId);
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(secondUsername, secondUserAuthReqId);
 
             // first user Token Request
             tokenRes = doBackchannelAuthenticationTokenRequest(firstUsername, firstUserAuthReqId);
@@ -1038,8 +1047,10 @@ public void testExplicitConsentRequiredBackchannelAuthenticationFlows() throws E
 
             String clientSessionCodeId = clientloginEvent.getDetails().get(Details.CODE_ID);
 
+            oauth.client(clientName, clientPassword);
+
             // client Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(clientName, clientPassword, username, clientAuthReqId);
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, clientAuthReqId);
 
         } finally {
             revertCIBASettings(clientResource, clientRep);
@@ -1094,10 +1105,12 @@ public void testMultipleClientsBackchannelAuthenticationFlows() throws Exception
             EventRepresentation secondClientloginEvent = doAuthenticationChannelCallback(secondClientAuthenticationChannelReq);
 
             // second client Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(secondClientName, secondClientPassword, username, secondClientAuthReqId);
+            oauth.client(secondClientName, secondClientPassword);
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, secondClientAuthReqId);
 
             // first client Token Request
-            tokenRes = doBackchannelAuthenticationTokenRequest(firstClientName, firstClientPassword, username, firstClientAuthReqId);
+            oauth.client(firstClientName, firstClientPassword);
+            tokenRes = doBackchannelAuthenticationTokenRequest(username, firstClientAuthReqId);
 
         } finally {
             revertCIBASettings(firstClientResource, firstClientRep);
@@ -1142,7 +1155,8 @@ public void testVerifyHolderOfAuthenticationRequestRef() throws Exception {
             doAuthenticationChannelCallback(firstClientAuthenticationChannelReq);
 
             // second client Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(secondClientName, secondClientPassword, firstClientAuthReqId);
+            oauth.client(secondClientName, secondClientPassword);
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(firstClientAuthReqId);
             assertEquals(400, tokenRes.getStatusCode());
             assertEquals("unauthorized client", tokenRes.getErrorDescription());
         } finally {
@@ -1169,7 +1183,7 @@ public void testRequestTokenBeforeAuthenticationNotCompleted() throws Exception
             AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, "kvoDKw98");
 
             // user Token Request before Authentication Channel completion
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.AUTHORIZATION_PENDING));
 
@@ -1182,7 +1196,7 @@ public void testRequestTokenBeforeAuthenticationNotCompleted() throws Exception
             setTimeOffset(6);
 
             // user Token Request after Authentication Channel completion
-            tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
 
             IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
@@ -1228,7 +1242,7 @@ public void testRequestTokenAfterAuthReqIdExpired() throws Exception {
             setTimeOffset(70);
 
             // user Token Request before Authentication Channel completion
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.EXPIRED_TOKEN));
 
@@ -1266,7 +1280,7 @@ public void testCallbackAfterAuthenticationRequestExpired() throws Exception {
 
             setTimeOffset(70);
 
-            int statusCode = oauth.doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
+            int statusCode = oauth.ciba().doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
             assertThat(statusCode, is(equalTo(Status.FORBIDDEN.getStatusCode())));
             events.expect(EventType.LOGIN_ERROR).clearDetails().client((String) null).error(Errors.INVALID_TOKEN).user((String) null).session(CoreMatchers.nullValue(String.class)).assertEvent();
         } finally {
@@ -1299,7 +1313,7 @@ public void testDuplicatedTokenRequestWithSameAuthReqId() throws Exception {
             doAuthenticationChannelCallback(authenticationChannelReq);
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
 
             IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
@@ -1308,7 +1322,7 @@ public void testDuplicatedTokenRequestWithSameAuthReqId() throws Exception {
             AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
 
             // duplicate user Token Request
-            tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
 
@@ -1341,7 +1355,8 @@ public void testOtherClientSendTokenRequest() throws Exception {
             doAuthenticationChannelCallback(authenticationChannelReq);
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET, response.getAuthReqId());
+            oauth.client(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET);
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
 
@@ -1382,6 +1397,8 @@ public void testCibaGrantDeactivated() throws Exception {
         ClientResource clientResource = null;
         ClientRepresentation clientRep = null;
         try {
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             final String username = "nutzername-rot";
 
             // prepare CIBA settings with ciba grant deactivated
@@ -1401,7 +1418,7 @@ public void testCibaGrantDeactivated() throws Exception {
             assertThat(clientRep.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_AUTH_REQUEST_SIGNING_ALG), is(Algorithm.RS256));
 
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, "gilwekDe3", "acr2");
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage("gilwekDe3").acrValues("acr2").send();
             assertThat(response.getStatusCode(), is(equalTo(401)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_GRANT));
             assertThat(response.getErrorDescription(), is("Client not allowed OIDC CIBA Grant"));
@@ -1444,7 +1461,8 @@ public void testCibaGrantDeactivated() throws Exception {
             assertThat(clientRep.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_AUTH_REQUEST_SIGNING_ALG), is("none"));
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET, response.getAuthReqId());
+            oauth.client(SECOND_TEST_CLIENT_NAME, SECOND_TEST_CLIENT_SECRET);
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
             assertThat(tokenRes.getErrorDescription(), is("Client not allowed OIDC CIBA Grant"));
@@ -1528,8 +1546,10 @@ public void testSecureCibaSessionEnforceExecutor() throws Exception {
                 ).toString();
         updatePolicies(json);
 
+        oauth.client(clientId, clientSecret);
+
         // user Backchannel Authentication Request
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, username, null, null, null, additionalParameters);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(400)));
         assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
         assertThat(response.getErrorDescription(), is("Missing parameter: binding_message"));
@@ -1583,11 +1603,17 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
 
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).request(request).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the signed authentication request: exp"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the signed authentication request: exp").user((String) null)
+                    .assertEvent();
 
             useRequestUri = true;
             bindingMessage = "Flughafen-Wien-Schwechat";
@@ -1597,10 +1623,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).requestUri(requestUri).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the signed authentication request: nbf"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the signed authentication request: nbf").user((String) null)
+                    .assertEvent();
 
             useRequestUri = false;
             bindingMessage = "Stuttgart-Hauptbahnhof";
@@ -1611,10 +1641,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).request(request).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("signed authentication request's available period is long"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "signed authentication request's available period is long").user((String) null)
+                    .assertEvent();
 
             useRequestUri = true;
             bindingMessage = "Flughafen-Wien-Schwechat";
@@ -1626,10 +1660,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).requestUri(requestUri).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the 'request' object: aud"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the 'request' object: aud").user((String) null)
+                    .assertEvent();
 
             useRequestUri = false;
             bindingMessage = "Stuttgart-Hauptbahnhof";
@@ -1641,10 +1679,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).request(request).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Invalid parameter in the 'request' object: aud"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Invalid parameter in the 'request' object: aud").user((String) null)
+                    .assertEvent();
 
             useRequestUri = true;
             bindingMessage = "Flughafen-Wien-Schwechat";
@@ -1656,10 +1698,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).requestUri(requestUri).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the 'request' object: iss"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the 'request' object: iss").user((String) null)
+                    .assertEvent();
 
             useRequestUri = false;
             bindingMessage = "Stuttgart-Hauptbahnhof";
@@ -1672,10 +1718,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).request(request).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Invalid parameter in the 'request' object: iss"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Invalid parameter in the 'request' object: iss").user((String) null)
+                    .assertEvent();
 
             useRequestUri = true;
             bindingMessage = "Flughafen-Wien-Schwechat";
@@ -1690,10 +1740,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).requestUri(requestUri).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the signed authentication request: iat"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the signed authentication request: iat").user((String) null)
+                    .assertEvent();
 
             useRequestUri = false;
             bindingMessage = "Stuttgart-Hauptbahnhof";
@@ -1708,10 +1762,14 @@ public void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationRequ
             registerSharedAuthenticationRequest(requestObject, TEST_CLIENT_NAME, sigAlg, useRequestUri);
 
             // user Backchannel Authentication Request
-            response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).request(request).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter in the signed authentication request: jti"));
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                    "Missing parameter in the signed authentication request: jti").user((String) null)
+                    .assertEvent();
 
             useRequestUri = true;
             bindingMessage = "Brno-hlavni-nadrazif";
@@ -1791,8 +1849,10 @@ private void testSecureCibaSessionEnforceExecutor(boolean useRequestUri) throws
                     ).toString();
             updatePolicies(json);
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, null, null, null, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().doBackchannelAuthenticationRequest(username);
             assertThat(response.getStatusCode(), is(equalTo(400)));
             assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
             assertThat(response.getErrorDescription(), is("Missing parameter: binding_message"));
@@ -1866,7 +1926,9 @@ public void testExtendedClientPolicyInterfacesForBackchannelAuthenticationReques
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
         clientResource.roles().create(RoleBuilder.create().name(roleName).build());
 
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, TEST_USER_NAME, "Pjb9eD8w", null, null, null);
+        oauth.client(clientId, clientSecret);
+
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(TEST_USER_NAME).bindingMessage("Pjb9eD8w").send();
         assertEquals(400, response.getStatusCode());
         assertEquals(ClientPolicyEvent.BACKCHANNEL_AUTHENTICATION_REQUEST.toString(), response.getError());
         assertEquals("Exception thrown intentionally", response.getErrorDescription());
@@ -1892,14 +1954,16 @@ public void testExtendedClientPolicyInterfacesForBackchannelTokenRequest() throw
         Map<String, String> additionalParameters = new HashMap<>();
         additionalParameters.put("user_device", "mobile");
 
+        oauth.client(clientId, clientSecret);
+
         // user Backchannel Authentication Request
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, TEST_USER_NAME, bindingMessage, null, null, additionalParameters);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(TEST_USER_NAME).bindingMessage(bindingMessage).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(200)));
         Assert.assertNotNull(response.getAuthReqId());
 
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         TestAuthenticationChannelRequest authenticationChannelReq = oidcClientEndpointsResource.getAuthenticationChannel(bindingMessage);
-        int statusCode = oauth.doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
         assertThat(statusCode, is(equalTo(200)));
 
         // register profiles
@@ -1926,7 +1990,8 @@ public void testExtendedClientPolicyInterfacesForBackchannelTokenRequest() throw
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
         clientResource.roles().create(RoleBuilder.create().name(roleName).build());
 
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientId, clientSecret, response.getAuthReqId());
+        oauth.client(clientId, clientSecret);
+        AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
         assertThat(tokenRes.getErrorDescription(), is("Exception thrown intentionally"));
@@ -1953,14 +2018,16 @@ public void testExtendedClientPolicyInterfacesForBackchannelTokenResponse() thro
         Map<String, String> additionalParameters = new HashMap<>();
         additionalParameters.put("user_device", "mobile");
 
+        oauth.client(clientId, clientSecret);
+
         // user Backchannel Authentication Request
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, TEST_USER_NAME, bindingMessage, null, null, additionalParameters);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(TEST_USER_NAME).bindingMessage(bindingMessage).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(200)));
         Assert.assertNotNull(response.getAuthReqId());
 
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         TestAuthenticationChannelRequest authenticationChannelReq = oidcClientEndpointsResource.getAuthenticationChannel(bindingMessage);
-        int statusCode = oauth.doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), SUCCEED);
         assertThat(statusCode, is(equalTo(200)));
 
         // register profiles
@@ -1981,7 +2048,8 @@ public void testExtendedClientPolicyInterfacesForBackchannelTokenResponse() thro
         ).toString();
         updatePolicies(json);
 
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientId, clientSecret, response.getAuthReqId());
+        oauth.client(clientId, clientSecret);
+        AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(ClientPolicyEvent.BACKCHANNEL_TOKEN_RESPONSE.toString()));
         assertThat(tokenRes.getErrorDescription(), is("Exception thrown intentionally"));
@@ -2197,29 +2265,37 @@ public void testHolderOfKeyEnforceExecutor() throws Exception {
             doAuthenticationChannelCallback(testRequest);
 
             // Token Request without MTLS
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            oauth.httpClient().set(MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
             assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.INVALID_GRANT)));
             assertThat(tokenRes.getErrorDescription(), is(equalTo("Client Certification missing for MTLS HoK Token Binding")));
             events.expect(EventType.AUTHREQID_TO_TOKEN_ERROR).clearDetails().user((String)null).client(TEST_CLIENT_NAME).error(OAuthErrorException.INVALID_REQUEST).assertEvent();
+            oauth.httpClient().reset();
 
             // Check token obtaining.
-            OAuthClient.AccessTokenResponse accessTokenResponse;
+            AccessTokenResponse accessTokenResponse;
             try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-                accessTokenResponse = doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, response.getAuthReqId(), client);
+                oauth.httpClient().set(client);
+                accessTokenResponse = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
                 AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken(), AccessToken.class);
                 assertThat(accessTokenResponse.getStatusCode(), is(equalTo(200)));
                 assertThat(accessToken.getConfirmation().getCertThumbprint(), notNullValue());
+            } finally {
+                oauth.httpClient().reset();
             }
 
             // Check logout.
-            CloseableHttpResponse logoutResponse;
+            LogoutResponse logoutResponse;
             try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-                logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+                oauth.httpClient().set(client);
+                logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken());
             }  catch (IOException ioe) {
                 throw new RuntimeException(ioe);
+            } finally {
+                oauth.httpClient().reset();
             }
-            assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+            assertTrue(logoutResponse.isSuccess());
         } finally {
             updatePolicies("{}");
             clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), TEST_CLIENT_NAME);
@@ -2268,8 +2344,10 @@ public void testConfidentialClientAcceptExecutorExecutor() throws Exception {
                 ).toString();
         updatePolicies(json);
 
+        oauth.client(clientPublicId, "app-secret");
+
         // user Backchannel Authentication Request
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientPublicId, "app-secret", username, bindingMessage, null, null, additionalParameters);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(400)));
         assertThat(response.getError(), is(OAuthErrorException.INVALID_CLIENT));
         assertThat(response.getErrorDescription(), is("invalid client access type"));
@@ -2296,7 +2374,8 @@ public void testConfidentialClientAcceptExecutorExecutor() throws Exception {
         });
 
         // user Token Request
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientConfidentialId, clientConfidentialSecret, response.getAuthReqId());
+        oauth.client(clientConfidentialId, clientConfidentialSecret);
+        AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
         assertThat(tokenRes.getErrorDescription(), is("invalid client access type"));
@@ -2323,7 +2402,7 @@ public void testClientScopesCondition() throws Exception {
             clientRep.setAttributes(attributes);
         });
 
-        oauth.clientId(clientConfidentialId);
+        oauth.client(clientConfidentialId, clientConfidentialSecret);
         oauth.scope("microprofile-jwt");
 
         // register profiles
@@ -2345,15 +2424,17 @@ public void testClientScopesCondition() throws Exception {
                 ).toString();
         updatePolicies(json);
 
+        oauth.client(clientConfidentialId, clientConfidentialSecret);
+
         // user Backchannel Authentication Request
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientConfidentialId, clientConfidentialSecret, username, bindingMessage, null, null, additionalParameters);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(400)));
         assertThat(response.getError(), is(ClientPolicyEvent.BACKCHANNEL_AUTHENTICATION_REQUEST.name()));
         assertThat(response.getErrorDescription(), is("Exception thrown intentionally"));
 
         updatePolicies("{}");
 
-        response = oauth.doBackchannelAuthenticationRequest(clientConfidentialId, clientConfidentialSecret, username, bindingMessage, null, null, additionalParameters);
+        response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(200)));
         Assert.assertNotNull(response.getAuthReqId());
 
@@ -2374,7 +2455,9 @@ public void testClientScopesCondition() throws Exception {
                 ).toString();
         updatePolicies(json);
 
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientConfidentialId, clientConfidentialSecret, response.getAuthReqId());
+        oauth.client(clientConfidentialId, clientConfidentialSecret);
+
+        AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(OAuthErrorException.INVALID_GRANT));
         assertThat(tokenRes.getErrorDescription(), is("Exception thrown intentionally"));
@@ -2391,7 +2474,7 @@ public void testClientScopesCondition() throws Exception {
         // user Authentication Channel completed
         doAuthenticationChannelCallback(testRequest);
 
-        tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientConfidentialId, clientConfidentialSecret, response.getAuthReqId());
+        tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
         assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
         AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
         assertThat(accessToken.getIssuedFor(), is(equalTo(clientConfidentialId)));
@@ -2424,10 +2507,12 @@ public void testBackchannelAuthenticationFlowWithInvalidScope() throws Exception
             prepareCIBASettings(clientResource, clientRep);
             oauth.scope(invalidScope);
 
+            oauth.client(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD);
+
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, bindingMessage, null, null, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).bindingMessage(bindingMessage).send();
             assertThat(response.getStatusCode(), is(equalTo(400)));
-            assertThat(response.getError(), is(OAuthErrorException.INVALID_REQUEST));
+            assertThat(response.getError(), is(OAuthErrorException.INVALID_SCOPE));
             assertThat(response.getErrorDescription(), is("Invalid scopes: " + OAuth2Constants.SCOPE_OPENID + " " + invalidScope));
 
         } finally {
@@ -2457,6 +2542,8 @@ private void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationReq
             final String username = "nutzername-rot";
             final String bindingMessage = "BASTION";
 
+            oauth.client(clientId, clientSecret);
+
             // prepare CIBA settings
             clientResource = ApiUtil.findClientByClientId(adminClient.realm(TEST_REALM_NAME), clientId);
             clientRep = clientResource.toRepresentation();
@@ -2468,7 +2555,7 @@ private void testBackchannelAuthenticationFlowWithInvalidSignedAuthenticationReq
             registerSharedAuthenticationRequest(sharedAuthenticationRequest, clientId, requestedSigAlg, sigAlg, useRequestUri, clientSecret, null);
 
             // user Backchannel Authentication Request
-            AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, null, null, null);
+            AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(null).request(request).requestUri(requestUri).send();
             assertThat(response.getStatusCode(), is(equalTo(statusCode)));
             assertThat(response.getError(), is(error));
             assertThat(response.getErrorDescription(), is(errorDescription));
@@ -2499,11 +2586,11 @@ protected void registerSharedInvalidAuthenticationRequest(AuthorizationEndpointR
         oidcClientEndpointsResource.registerOIDCRequest(encodedRequestObject, sigAlg);
 
         if (isUseRequestUri) {
-            oauth.request(null);
-            oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
+            requestUri = TestApplicationResourceUrls.clientRequestUri();
+            request = null;
         } else {
-            oauth.requestUri(null);
-            oauth.request(oidcClientEndpointsResource.getOIDCRequest());
+            request = oidcClientEndpointsResource.getOIDCRequest();
+            requestUri = null;
         }
     }
 
@@ -2544,16 +2631,16 @@ private void testBackchannelAuthenticationFlowWithSignedAuthenticationRequest(bo
             String userId = loginEvent.getUserId();
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, false);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // logout by refresh token
             EventRepresentation logoutEvent = doLogoutByRefreshToken(tokenRes.getRefreshToken(), sessionId, userId, false);
@@ -2624,11 +2711,11 @@ protected void registerSharedAuthenticationRequest(AuthorizationEndpointRequestO
         }
 
         if (isUseRequestUri) {
-            oauth.request(null);
-            oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
+            request = null;
+            requestUri = TestApplicationResourceUrls.clientRequestUri();
         } else {
-            oauth.requestUri(null);
-            oauth.request(oidcClientEndpointsResource.getOIDCRequest());
+            request = oidcClientEndpointsResource.getOIDCRequest();
+            requestUri = null;
         }
     }
 
@@ -2655,7 +2742,7 @@ private void testAuthenticationChannelErrorCase(Status statusCallback, Status st
             doAuthenticationChannelCallbackError(statusCallback, TEST_CLIENT_NAME, authenticationChannelReq, authStatus, username, errorEvent);
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(TEST_CLIENT_PASSWORD, response.getAuthReqId());
+            AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(response.getAuthReqId());
             assertThat(tokenRes.getStatusCode(), is(equalTo(statusTokenEndpont.getStatusCode())));
             assertThat(tokenRes.getError(), is(error));
 
@@ -2718,7 +2805,8 @@ private AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequest(
     }
 
     private AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequest(String clientId, String clientSecret, String username, String bindingMessage, String clientNotificationToken, Map<String, String> additionalParameters) throws Exception {
-        AuthenticationRequestAcknowledgement response = oauth.doBackchannelAuthenticationRequest(clientId, clientSecret, username, bindingMessage, null, clientNotificationToken, additionalParameters);
+        oauth.client(clientId, clientSecret);
+        AuthenticationRequestAcknowledgement response = oauth.ciba().backchannelAuthenticationRequest(username).request(request).requestUri(requestUri).bindingMessage(bindingMessage).clientNotificationToken(clientNotificationToken).additionalParams(additionalParameters).send();
         assertThat(response.getStatusCode(), is(equalTo(200)));
         Assert.assertNotNull(response.getAuthReqId());
         return response;
@@ -2732,7 +2820,7 @@ private TestAuthenticationChannelRequest doAuthenticationChannelRequest(String b
     }
 
     private EventRepresentation doAuthenticationChannelCallback(TestAuthenticationChannelRequest request) throws Exception {
-        int statusCode = oauth.doAuthenticationChannelCallback(request.getBearerToken(), SUCCEED);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(request.getBearerToken(), SUCCEED);
         assertThat(statusCode, is(equalTo(200)));
         // check login event : ignore user id and other details except for username
         EventRepresentation representation = new EventRepresentation();
@@ -2743,28 +2831,18 @@ private EventRepresentation doAuthenticationChannelCallback(TestAuthenticationCh
     }
 
     private EventRepresentation doAuthenticationChannelCallbackError(Status status, String clientId, TestAuthenticationChannelRequest authenticationChannelReq, AuthenticationChannelResponse.Status authStatus, String username, String error) throws Exception {
-        int statusCode = oauth.doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), authStatus);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(authenticationChannelReq.getBearerToken(), authStatus);
         assertThat(statusCode, is(equalTo(status.getStatusCode())));
         return events.expect(EventType.LOGIN_ERROR).clearDetails().client(clientId).error(error).user((String)null).session(CoreMatchers.nullValue(String.class)).assertEvent();
     }
 
-    private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequest(String username, String authReqId) throws Exception {
-        return doBackchannelAuthenticationTokenRequest(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, username, authReqId);
-    }
-
-    private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequest(String clientId, String clientSecret, String username, String authReqId) throws Exception {
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientId, clientSecret, authReqId);
-        verifyBackchannelAuthenticationTokenRequest(tokenRes, clientId, username);
-        return tokenRes;
-    }
-
-    private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequest(String clientId, String clientSecret, String username, String authReqId, CloseableHttpClient httpClient) throws Exception {
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doBackchannelAuthenticationTokenRequest(clientId, clientSecret, authReqId, httpClient);
-        verifyBackchannelAuthenticationTokenRequest(tokenRes, clientId, username);
+    private AccessTokenResponse doBackchannelAuthenticationTokenRequest(String username, String authReqId) throws Exception {
+        AccessTokenResponse tokenRes = oauth.ciba().doBackchannelAuthenticationTokenRequest(authReqId);
+        verifyBackchannelAuthenticationTokenRequest(tokenRes, oauth.getClientId(), username);
         return tokenRes;
     }
 
-    private void verifyBackchannelAuthenticationTokenRequest(OAuthClient.AccessTokenResponse tokenRes, String clientId, String username) {
+    private void verifyBackchannelAuthenticationTokenRequest(AccessTokenResponse tokenRes, String clientId, String username) {
         assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
 
         AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
@@ -2782,49 +2860,33 @@ private void verifyBackchannelAuthenticationTokenRequest(OAuthClient.AccessToken
         assertThat(idToken.getAudience()[0], is(equalTo(idToken.getIssuedFor())));
     }
 
-    private String doIntrospectAccessTokenWithClientCredential(OAuthClient.AccessTokenResponse tokenRes, String username) throws IOException {
+    private void doIntrospectAccessTokenWithClientCredential(AccessTokenResponse tokenRes, String username) throws IOException {
         AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, tokenRes.getAccessToken());
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
-        assertThat(jsonNode.get("active").asBoolean(), is(equalTo(true)));
-        assertThat(jsonNode.get("username").asText(), is(equalTo(username)));
-        assertThat(jsonNode.get("client_id").asText(), is(equalTo(TEST_CLIENT_NAME)));
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(tokenRes.getAccessToken()).asTokenMetadata();
         assertThat(rep.isActive(), is(equalTo(true)));
         assertThat(rep.getClientId(), is(equalTo(TEST_CLIENT_NAME)));
         assertThat(rep.getIssuedFor(), is(equalTo(TEST_CLIENT_NAME)));
-        events.expect(EventType.INTROSPECT_TOKEN).user((String) null).session(accessToken.getSessionId()).clearDetails().assertEvent();
+        events.expect(EventType.INTROSPECT_TOKEN).user(AssertEvents.isUUID()).session(accessToken.getSessionId()).clearDetails().assertEvent();
 
-        tokenResponse = oauth.introspectAccessTokenWithClientCredential(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, tokenRes.getRefreshToken());
-        jsonNode = objectMapper.readTree(tokenResponse);
-        assertThat(jsonNode.get("active").asBoolean(), is(equalTo(true)));
-        assertThat(jsonNode.get("client_id").asText(), is(equalTo(TEST_CLIENT_NAME)));
-        rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        rep = oauth.doIntrospectionAccessTokenRequest(tokenRes.getRefreshToken()).asTokenMetadata();
         assertThat(rep.isActive(), is(equalTo(true)));
         assertThat(rep.getClientId(), is(equalTo(TEST_CLIENT_NAME)));
         assertThat(rep.getIssuedFor(), is(equalTo(TEST_CLIENT_NAME)));
         assertThat(rep.getAudience()[0], is(equalTo(rep.getIssuer())));
-        events.expect(EventType.INTROSPECT_TOKEN).user((String) null).session(accessToken.getSessionId()).clearDetails().assertEvent();
+        events.expect(EventType.INTROSPECT_TOKEN).user(AssertEvents.isUUID()).session(accessToken.getSessionId()).clearDetails().assertEvent();
 
-        tokenResponse = oauth.introspectAccessTokenWithClientCredential(TEST_CLIENT_NAME, TEST_CLIENT_PASSWORD, tokenRes.getIdToken());
-        jsonNode = objectMapper.readTree(tokenResponse);
-        assertThat(jsonNode.get("active").asBoolean(), is(equalTo(true)));
-        assertThat(jsonNode.get("client_id").asText(), is(equalTo(TEST_CLIENT_NAME)));
-        rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        rep = oauth.doIntrospectionAccessTokenRequest(tokenRes.getIdToken()).asTokenMetadata();
         assertThat(rep.isActive(), is(equalTo(true)));
         assertThat(rep.getUserName(), is(equalTo(username)));
         assertThat(rep.getClientId(), is(equalTo(TEST_CLIENT_NAME)));
         assertThat(rep.getIssuedFor(), is(equalTo(TEST_CLIENT_NAME)));
         assertThat(rep.getPreferredUsername(), is(equalTo(username)));
         assertThat(rep.getAudience()[0], is(equalTo(rep.getIssuedFor())));
-        events.expect(EventType.INTROSPECT_TOKEN).user((String) null).session(accessToken.getSessionId()).clearDetails().assertEvent();
-
-        return tokenResponse;
+        events.expect(EventType.INTROSPECT_TOKEN).user(AssertEvents.isUUID()).session(accessToken.getSessionId()).clearDetails().assertEvent();
     }
 
-    private OAuthClient.AccessTokenResponse doRefreshTokenRequest(String oldRefreshToken, String username, String sessionId, boolean isOfflineAccess) {
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(oldRefreshToken, TEST_CLIENT_PASSWORD);
+    private AccessTokenResponse doRefreshTokenRequest(String oldRefreshToken, String username, String sessionId, boolean isOfflineAccess) {
+        AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(oldRefreshToken);
         assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
 
         AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
@@ -2861,12 +2923,10 @@ private void checkTokenExpiration(JsonWebToken token, long expiresIn) {
     }
 
     private EventRepresentation doLogoutByRefreshToken(String refreshToken, String sessionId, String userId, boolean isOfflineAccess) throws IOException {
-        try (CloseableHttpResponse res = oauth.doLogout(refreshToken, TEST_CLIENT_PASSWORD)) {
-            assertThat(res, Matchers.statusCodeIsHC(Status.NO_CONTENT));
-        }
+        assertTrue(oauth.doLogout(refreshToken).isSuccess());
 
         // confirm logged out
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken, TEST_CLIENT_PASSWORD);
+        AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken);
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.INVALID_GRANT)));
         if (isOfflineAccess) assertThat(tokenRes.getErrorDescription(), is(equalTo("Offline user session not found")));
@@ -2877,12 +2937,10 @@ private EventRepresentation doLogoutByRefreshToken(String refreshToken, String s
     }
 
     private EventRepresentation doTokenRevokeByRefreshToken(String refreshToken, String sessionId, String userId, boolean isOfflineAccess) throws IOException {
-        try (CloseableHttpResponse res = oauth.doTokenRevoke(refreshToken, "refresh_token", TEST_CLIENT_PASSWORD)) {
-            assertThat(res, Matchers.statusCodeIsHC(Status.OK));
-        }
+        assertTrue(oauth.tokenRevocationRequest(refreshToken).refreshToken().send().isSuccess());
 
         // confirm revocation
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken, TEST_CLIENT_PASSWORD);
+        AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken);
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.INVALID_GRANT)));
         if (isOfflineAccess) assertThat(tokenRes.getErrorDescription(), is(equalTo("Offline user session not found")));
@@ -2944,7 +3002,7 @@ private void testBackchannelAuthenticationFlow(boolean isOfflineAccess, String b
             String userId = loginEvent.getUserId();
 
             // user Token Request
-            OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
+            AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequest(username, response.getAuthReqId());
             IDToken idToken = oauth.verifyIDToken(tokenRes.getIdToken());
             long currentTime = Time.currentTime();
             long authTime = idToken.getAuth_time().longValue();
@@ -2952,13 +3010,13 @@ private void testBackchannelAuthenticationFlow(boolean isOfflineAccess, String b
             assertTrue(authTime <= currentTime + 5);
 
             // token introspection
-            String tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // token refresh
             tokenRes = doRefreshTokenRequest(tokenRes.getRefreshToken(), username, sessionId, isOfflineAccess);
 
             // token introspection after token refresh
-            tokenResponse = doIntrospectAccessTokenWithClientCredential(tokenRes, username);
+            doIntrospectAccessTokenWithClientCredential(tokenRes, username);
 
             // logout by refresh token
             EventRepresentation logoutEvent = doLogoutByRefreshToken(tokenRes.getRefreshToken(), sessionId, userId, isOfflineAccess);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRedirectTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRedirectTest.java
index 22b40954f684..3bddd3a00190 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRedirectTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRedirectTest.java
@@ -79,8 +79,8 @@ public void testClientRedirectEndpoint() throws Exception {
     @Test
     public void testRedirectStatusCode() {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String token = oauth.doAccessTokenRequest(code, "password").getAccessToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String token = oauth.doAccessTokenRequest(code).getAccessToken();
 
         Client client = AdminClientUtil.createResteasyClient();
         String redirectUrl = getAuthServerRoot().toString() + "realms/test/clients/launchpad-test/redirect";
@@ -104,8 +104,8 @@ public void testRedirectToDisabledClientRedirectURI() throws Exception {
             oauth.doLogin("test-user@localhost", "password");
             events.expectLogin().assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            String idTokenHint = oauth.doAccessTokenRequest(code,"password").getIdToken();
+            String code = oauth.parseLoginResponse().getCode();
+            String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
             events.poll();
 
             URI logout = KeycloakUriBuilder.fromUri(suiteContext.getAuthServerInfo().getBrowserContextRoot().toURI())
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationPoliciesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationPoliciesTest.java
index e07814ae38fd..823c130426fe 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationPoliciesTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationPoliciesTest.java
@@ -24,6 +24,7 @@
 import java.util.UUID;
 import java.util.stream.Collectors;
 
+import jakarta.ws.rs.BadRequestException;
 import org.junit.After;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
@@ -32,6 +33,7 @@
 import org.keycloak.client.registration.Auth;
 import org.keycloak.client.registration.ClientRegistrationException;
 import org.keycloak.client.registration.HttpErrorException;
+import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.mappers.FullNameMapper;
@@ -47,6 +49,7 @@
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.ComponentTypeRepresentation;
 import org.keycloak.representations.idm.ConfigPropertyRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
@@ -715,6 +718,30 @@ public void testProtocolMappersRemoveBuiltins() throws Exception {
         realmResource().components().component(protocolMapperPolicyRep.getId()).update(protocolMapperPolicyRep);
     }
 
+    @Test
+    public void testRegisterFakeClientScope() {
+        //create
+        ComponentRepresentation rep = new ComponentRepresentation();
+        rep.setName("Clients scopes not allowed");
+        rep.setParentId(adminClient.realm(REALM_NAME).toRepresentation().getId());
+        rep.setProviderId(ClientScopesClientRegistrationPolicyFactory.PROVIDER_ID);
+        rep.setProviderType(ClientRegistrationPolicy.class.getName());
+        rep.setSubType(getPolicyAnon());
+        rep.setConfig(new MultivaluedHashMap<>());
+        rep.getConfig().putSingle(ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES, "foo1");
+        Response response = realmResource().components().add(rep);
+        ErrorRepresentation error = response.readEntity(ErrorRepresentation.class);
+        Assert.assertEquals("Client scopes not allowed: [foo1]", error.getErrorMessage());
+
+        //update
+        ComponentRepresentation clientScopesPolicyRep = findPolicyByProviderAndAuth(ClientScopesClientRegistrationPolicyFactory.PROVIDER_ID, getPolicyAnon());
+        clientScopesPolicyRep.getConfig().putSingle(ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES, "foo2");
+        BadRequestException e = Assert.assertThrows(BadRequestException.class,
+                () -> realmResource().components().component(clientScopesPolicyRep.getId()).update(clientScopesPolicyRep));
+        error = e.getResponse().readEntity(ErrorRepresentation.class);
+        Assert.assertEquals("Client scopes not allowed: [foo2]", error.getErrorMessage());
+    }
+
     // HELPER METHODS
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java
index b505301e9d46..b18b5ee514a3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientRegistrationTest.java
@@ -45,10 +45,12 @@
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.authorization.PolicyRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
+import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
 import org.keycloak.util.JsonSerialization;
 
@@ -155,7 +157,7 @@ public void withServiceAccount() throws ClientRegistrationException {
     public void registerClientInMasterRealm() throws Exception {
         ClientRegistration masterReg = ClientRegistration.create().url(suiteContext.getAuthServerInfo().getContextRoot() + "/auth", "master").build();
 
-        String token = oauth.doGrantAccessTokenRequest("master", "admin", "admin", null, Constants.ADMIN_CLI_CLIENT_ID, null).getAccessToken();
+        String token = oauth.realm("master").client(Constants.ADMIN_CLI_CLIENT_ID).doPasswordGrantRequest( "admin", "admin").getAccessToken();
         masterReg.auth(Auth.token(token));
 
         ClientRepresentation client = new ClientRepresentation();
@@ -208,9 +210,7 @@ public void registerClientUsingRevokedToken() throws Exception {
 
         oauth.clientId("myclient");
         String bearerToken = getToken("myclient", "password", "manage-clients", "password");
-        try (CloseableHttpResponse response = oauth.doTokenRevoke(bearerToken, "access_token", "password")) {
-            assertEquals(Response.Status.OK.getStatusCode(), response.getStatusLine().getStatusCode());
-        }
+        assertTrue(oauth.tokenRevocationRequest(bearerToken).accessToken().send().isSuccess());
 
         try {
             reg.auth(Auth.token(bearerToken));
@@ -851,4 +851,39 @@ public void registerMultipleClients() {
         //controls the number of uses of the initial access token
         assertEquals(initialTokenCounts, createdCount.get());
     }
+
+    @Test
+    public void registerWithLightweightAccessTokenAndTransientSession() throws Exception {
+
+        String TEST_ADMIN_CLIENT = "test-admin-client";
+        ClientRepresentation testAdminClient = new ClientRepresentation();
+        testAdminClient.setClientId(TEST_ADMIN_CLIENT);
+        testAdminClient.setSecret(TEST_ADMIN_CLIENT);
+        testAdminClient.setServiceAccountsEnabled(true);
+        testAdminClient.setAttributes(new HashMap<>());
+        testAdminClient.getAttributes().put(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED, Boolean.TRUE.toString());
+
+        Response response = adminClient.realm("master").clients().create(testAdminClient);
+        testAdminClient = adminClient.realm("master").clients().get( ApiUtil.getCreatedId(response)).toRepresentation();
+
+        UserRepresentation serviceAccountUser = adminClient.realm("master").clients().get(testAdminClient.getId()).getServiceAccountUser();
+        RoleRepresentation adminRole =  adminClient.realm("master").roles().get("admin").toRepresentation();
+        adminClient.realm("master").users().get(serviceAccountUser.getId()).roles().realmLevel().add(List.of(adminRole));
+
+        oauth.client(TEST_ADMIN_CLIENT, TEST_ADMIN_CLIENT);
+        oauth.realm("master");
+        String token = oauth.doClientCredentialsGrantAccessTokenRequest().getAccessToken();
+        ClientRegistration masterReg = ClientRegistration.create().url(suiteContext.getAuthServerInfo().getContextRoot() + "/auth", "master").build();
+        masterReg.auth(Auth.token(token));
+
+        ClientRepresentation client = new ClientRepresentation();
+        client.setClientId(CLIENT_ID);
+        client.setSecret(CLIENT_SECRET);
+
+        ClientRepresentation createdClient = masterReg.create(client);
+        assertNotNull(createdClient);
+
+        adminClient.realm("master").clients().get(testAdminClient.getId()).remove();
+        adminClient.realm("master").clients().get(createdClient.getId()).remove();
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientScopeTests.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientScopeTests.java
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientSecretRotationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientSecretRotationTest.java
index 1752854e164e..c3dd903908c3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientSecretRotationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientSecretRotationTest.java
@@ -52,8 +52,8 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.util.JsonSerialization;
@@ -354,20 +354,22 @@ public void authenticateWithInvalidClientPolicyEnable() throws Exception {
         String cId = createClientByAdmin(clientId);
 
         //The first login will be successful
-        oauth.clientId(clientId);
+        oauth.client(clientId, DEFAULT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, DEFAULT_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.OK.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), DEFAULT_SECRET);
+        oauth.doLogout(res.getRefreshToken());
 
         //advance 1 hour
         setTimeOffset(3601);
 
+        oauth.client(clientId, DEFAULT_SECRET);
+
         // the second login must fail
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        res = oauth.doAccessTokenRequest(code, DEFAULT_SECRET);
+        code = oauth.parseLoginResponse().getCode();
+        res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.UNAUTHORIZED.getStatusCode()));
     }
 
@@ -405,22 +407,23 @@ public void authenticateWithValidActualAndRotatedSecret() throws Exception {
         OIDCClientSecretConfigWrapper wrapper = OIDCClientSecretConfigWrapper.fromClientRepresentation(
                 clientResource.toRepresentation());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, updatedSecret);
 
         //login with new secret
         AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME,
                 TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, updatedSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.OK.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), updatedSecret);
+        oauth.doLogout(res.getRefreshToken());
 
         //login with rotated secret
+        oauth.client(clientId, firstSecret);
         loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        res = oauth.doAccessTokenRequest(code, firstSecret);
+        code = oauth.parseLoginResponse().getCode();
+        res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.OK.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), firstSecret);
+        oauth.doLogout(res.getRefreshToken());
 
     }
 
@@ -477,12 +480,14 @@ public void authenticateWithInValidRotatedSecret() throws Exception {
                 Time.currentTime()));
         logger.debug(">>> trying login at time " + Time.toDate(Time.currentTime()));
 
+        oauth.client(clientId, firstSecret);
+
         // try to login with rotated secret (must fail)
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, firstSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.UNAUTHORIZED.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), firstSecret);
+        oauth.doLogout(res.getRefreshToken());
 
     }
 
@@ -519,12 +524,14 @@ public void authenticateWithRotatedSecretWithZeroExpirationTime() throws Excepti
                 clientResource.toRepresentation());
         assertThat(wrapper.hasRotatedSecret(), is(Boolean.FALSE));
 
+        oauth.client(clientId, firstSecret);
+
         // try to login with rotated secret (must fail)
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, firstSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(Status.UNAUTHORIZED.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), firstSecret);
+        oauth.doLogout(res.getRefreshToken());
 
     }
 
@@ -870,20 +877,20 @@ protected void updatePolicies(String json) throws ClientPolicyException {
     }
 
     private void successfulLoginAndLogout(String clientId, String clientSecret) {
-        OAuthClient.AccessTokenResponse res = successfulLogin(clientId, clientSecret);
-        oauth.doLogout(res.getRefreshToken(), clientSecret);
+        AccessTokenResponse res = successfulLogin(clientId, clientSecret);
+        oauth.doLogout(res.getRefreshToken());
         events.expectLogout(res.getSessionState()).client(clientId).clearDetails().assertEvent();
     }
 
-    private OAuthClient.AccessTokenResponse successfulLogin(String clientId, String clientSecret) {
-        oauth.clientId(clientId);
+    private AccessTokenResponse successfulLogin(String clientId, String clientSecret) {
+        oauth.client(clientId, clientSecret);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI1Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI1Test.java
index 5967de4214b7..0864357846ea 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI1Test.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI1Test.java
@@ -50,7 +50,9 @@
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 
 import java.security.KeyPair;
 import java.security.PrivateKey;
@@ -69,9 +71,9 @@
 
 /**
  * Test for the FAPI 1 specifications:
- * - Financial-grade API Security Profile 1.0 - Part 1: Baseline - https://openid.net/specs/openid-financial-api-part-1-1_0.html#authorization-server
- * - Financial-grade API Security Profile 1.0 - Part 2: Advanced - https://openid.net/specs/openid-financial-api-part-2-1_0.html
- *
+ * - <a href="https://openid.net/specs/openid-financial-api-part-1-1_0.html#authorization-server">Financial-grade API Security Profile 1.0 - Part 1: Baseline</a>
+ * - <a href="https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server">Financial-grade API Security Profile 1.0 - Part 2: Advanced</a>
+ * <p>
  * Mostly tests the global FAPI policies work as expected
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -84,32 +86,24 @@ public void testFAPIBaselineClientAuthenticator() throws Exception {
 
         // Try to register client with clientIdAndSecret - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
         }
 
         // Try to register client with "client-jwt" - should pass
-        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Try to register client with "client-secret-jwt" - should pass
-        clientUUID = createClientByAdmin("client-secret-jwt", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-secret-jwt", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -149,9 +143,7 @@ public void testFAPIBaselineOIDCClientRegistration() throws Exception {
 
         // Try to register client with clientIdAndSecret - should fail
         try {
-            createClientDynamically(generateSuffixedName("foo"), (OIDCClientRepresentation clientRep) -> {
-                clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_BASIC);
-            });
+            createClientDynamically(generateSuffixedName("foo"), (OIDCClientRepresentation clientRep) -> clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_BASIC));
             fail();
         } catch (ClientRegistrationException e) {
             assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
@@ -170,9 +162,7 @@ public void testFAPIBaselineOIDCClientRegistration() throws Exception {
         setInitialAccessTokenForDynamicClientRegistration();
 
         // Try to register client with "client-secret-jwt" - should pass
-        clientUUID = createClientDynamically("client-secret-jwt", (OIDCClientRepresentation clientRep) -> {
-            clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_JWT);
-        });
+        clientUUID = createClientDynamically("client-secret-jwt", (OIDCClientRepresentation clientRep) -> clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_JWT));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -180,9 +170,7 @@ public void testFAPIBaselineOIDCClientRegistration() throws Exception {
         setInitialAccessTokenForDynamicClientRegistration();
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientDynamically("client-x509", (OIDCClientRepresentation clientRep) -> {
-            clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.TLS_CLIENT_AUTH);
-        });
+        clientUUID = createClientDynamically("client-x509", (OIDCClientRepresentation clientRep) -> clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.TLS_CLIENT_AUTH));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -199,9 +187,7 @@ public void testFAPIBaselineRedirectUri() throws Exception {
 
         // Try to register redirect_uri like "http://hostname.com" - should fail
         try {
-            String clientUUID = createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setRedirectUris(Collections.singletonList("http://hostname.com"));
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setRedirectUris(Collections.singletonList("http://hostname.com")));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -209,18 +195,14 @@ public void testFAPIBaselineRedirectUri() throws Exception {
 
         // Try to register redirect_uri like "https://hostname.com/foo/*" - should fail due the wildcard
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setRedirectUris(Collections.singletonList("https://hostname.com/foo/*"));
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setRedirectUris(Collections.singletonList("https://hostname.com/foo/*")));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
         }
 
         // Try to register redirect_uri like "https://hostname.com" - should pass
-        String clientUUID = createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-            clientRep.setRedirectUris(Collections.singletonList("https://hostname.com"));
-        });
+        String clientUUID = createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setRedirectUris(Collections.singletonList("https://hostname.com")));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertNames(client.getRedirectUris(), "https://hostname.com");
         getCleanup().addClientUuid(clientUUID);
@@ -252,19 +234,16 @@ public void testFAPIBaselineConfidentialClientLogin() throws Exception {
 
         checkPKCEWithS256RequiredDuringLogin("foo");
 
+        pkceGenerator = PkceGenerator.s256();
         // Setup PKCE
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
 
         checkNonceAndStateForCurrentClientDuringLogin();
         checkRedirectUriForCurrentClientDuringLogin();
 
         // Check PKCE with S256, redirectUri and nonce/state set. Login should be successful
-        successfulLoginAndLogout("foo", TEST_USERNAME, false, (String code) -> {
+        successfulLoginAndLogout("foo", "123456", TEST_USERNAME, false, (String code) -> {
             String signedJwt = getClientSecretSignedJWT("atleast-14chars-password", Algorithm.HS256);
-            return doAccessTokenRequestWithClientSignedJWT(code, signedJwt, codeVerifier, DefaultHttpClient::new);
+            return doAccessTokenRequestWithClientSignedJWT(code, signedJwt, DefaultHttpClient::new);
         });
     }
 
@@ -274,28 +253,19 @@ public void testFAPIBaselinePublicClientLogin() throws Exception {
         setupPolicyFAPIBaselineForAllClient();
 
         // Register client as public client
-        String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> {
-            clientRep.setPublicClient(true);
-        });
+        String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> clientRep.setPublicClient(true));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertTrue(client.isPublicClient());
 
         checkPKCEWithS256RequiredDuringLogin("foo");
 
-        // Setup PKCE
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
+        pkceGenerator = PkceGenerator.s256();
 
         checkNonceAndStateForCurrentClientDuringLogin();
         checkRedirectUriForCurrentClientDuringLogin();
 
         // Check PKCE with S256, redirectUri and nonce/state set. Login should be successful
-        successfulLoginAndLogout("foo", TEST_USERNAME, false, (String code) -> {
-            oauth.codeVerifier(codeVerifier);
-            return oauth.doAccessTokenRequest(code, null);
-        });
+        successfulLoginAndLogout("foo", "123456", TEST_USERNAME, false, (String code) -> oauth.accessTokenRequest(code).codeVerifier(pkceGenerator).send());
     }
 
 
@@ -306,9 +276,7 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
 
         // Register client with clientIdAndSecret - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -316,9 +284,7 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
 
         // Register client with signedJWT - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -336,16 +302,12 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
         }
 
         // Try to register client with "client-jwt" - should pass
-        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -370,31 +332,22 @@ public void testFAPIAdvancedPublicClientLoginNotPossible() throws Exception {
         setupPolicyFAPIBaselineForAllClient();
 
         // Register client as public client
-        String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> {
-            clientRep.setPublicClient(true);
-        });
+        String clientUUID = createClientByAdmin("foo", (ClientRepresentation clientRep) -> clientRep.setPublicClient(true));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertTrue(client.isPublicClient());
 
         // Setup PKCE and nonce
-        oauth.nonce("123456");
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
+        pkceGenerator = PkceGenerator.s256();
 
         // Check PKCE with S256, redirectUri and nonce/state set. Login should be successful
-        successfulLoginAndLogout("foo", TEST_USERNAME, false, (String code) -> {
-            oauth.codeVerifier(codeVerifier);
-            return oauth.doAccessTokenRequest(code, null);
-        });
+        successfulLoginAndLogout("foo", "123456", TEST_USERNAME, false, (String code) -> oauth.accessTokenRequest(code).codeVerifier(pkceGenerator).send());
 
         // Set "advanced" policy
         setupPolicyFAPIAdvancedForAllClient();
 
         // Should not be possible to login anymore with public client
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_CLIENT, false,"invalid client access type");
+        oauth.loginForm().nonce("123456").codeChallenge(pkceGenerator).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_CLIENT, "invalid client access type");
     }
 
     @Test
@@ -426,13 +379,11 @@ public void testFAPIAdvancedSignatureAlgorithms() throws Exception {
         Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg());
 
         // Test default algorithms set everywhere
-        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
         Assert.assertEquals(Algorithm.PS256, clientConfig.getIdTokenSignedResponseAlg());
-        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
+        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getUserInfoSignedResponseAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getTokenEndpointAuthSigningAlg());
         Assert.assertEquals(Algorithm.PS256, client.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
@@ -456,20 +407,20 @@ public void testFAPIAdvancedLoginWithPrivateKeyJWT() throws Exception {
         assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Check nonce and redirectUri
-        oauth.clientId("foo");
+        oauth.client("foo");
         checkNonceAndStateForCurrentClientDuringLogin();
         checkRedirectUriForCurrentClientDuringLogin();
 
         // Check login request object required
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Missing parameter: 'request' or 'request_uri'");
+        oauth.loginForm().nonce("123456").open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Missing parameter: 'request' or 'request_uri'");
 
         // Create request without 'nbf' . Should fail in FAPI1 advanced client policy
         TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor("foo");
         requestObject.nbf(null);
         registerRequestObject(requestObject, "foo", Algorithm.PS256, true);
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST_URI,false, "Missing parameter in the 'request' object: nbf");
+        oauth.loginForm().requestUri(requestUri).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST_URI,"Missing parameter in the 'request' object: nbf");
 
         // Create valid request object - more extensive testing of 'request' object is in ClientPoliciesTest.testSecureRequestObjectExecutor()
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor("foo");
@@ -477,21 +428,21 @@ public void testFAPIAdvancedLoginWithPrivateKeyJWT() throws Exception {
         registerRequestObject(requestObject, "foo", Algorithm.PS256, true);
 
         // Check response type
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "invalid response_type");
+        oauth.loginForm().requestUri(requestUri).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"invalid response_type");
 
         // Add the response_Type including token. Should fail
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN);
         requestObject.setResponseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN);
         registerRequestObject(requestObject, "foo", Algorithm.PS256, true);
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,true, "invalid response_type");
+        oauth.loginForm().requestUri(requestUri).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"invalid response_type");
 
         // Set correct response_type for FAPI 1 Advanced
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
         requestObject.setResponseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
         registerRequestObject(requestObject, "foo", Algorithm.PS256, true);
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).open();
         loginPage.assertCurrent();
 
         // Get keys of client. Will be used for client authentication and signing of request object
@@ -502,27 +453,29 @@ public void testFAPIAdvancedLoginWithPrivateKeyJWT() throws Exception {
         PublicKey publicKey = keyPair.getPublic();
 
 
-        String code = loginUserAndGetCode("foo", true);
+        String code = loginUserAndGetCode("foo", null, true);
+
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
 
         // Check token not present in the AuthorizationResponse. Check ID Token present, but used as detached signature
-        Assert.assertNull(getParameterFromUrl(OAuth2Constants.ACCESS_TOKEN, true));
-        String idTokenParam = getParameterFromUrl(OAuth2Constants.ID_TOKEN, true);
+        Assert.assertNull(authorizationEndpointResponse.getAccessToken());
+        String idTokenParam = authorizationEndpointResponse.getIdToken();
         assertIDTokenAsDetachedSignature(idTokenParam, code);
 
         // Check HoK required
         String signedJwt = createSignedRequestToken("foo", privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
-        OAuthClient.AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, null, DefaultHttpClient::new);
+        AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, DefaultHttpClient::new);
         Assert.assertEquals(OAuthErrorException.INVALID_GRANT,tokenResponse.getError());
         Assert.assertEquals("Client Certification missing for MTLS HoK Token Binding", tokenResponse.getErrorDescription());
 
         // Login with private-key-jwt client authentication and MTLS added to HttpClient. TokenRequest should be successful now
-        oauth.openLoginForm();
-        code = oauth.getCurrentFragment().get(OAuth2Constants.CODE);
+        oauth.loginForm().requestUri(requestUri).open();
+        code = oauth.parseLoginResponse().getCode();
         Assert.assertNotNull(code);
 
         String signedJwt2 = createSignedRequestToken("foo", privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
 
-        tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt2, null, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt2, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
 
         assertSuccessfulTokenResponse(tokenResponse);
         AccessToken accessToken = oauth.verifyToken(tokenResponse.getAccessToken());
@@ -551,13 +504,13 @@ public void testFAPIAdvancedLoginWithMTLS() throws Exception {
         assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Check nonce and redirectUri
-        oauth.clientId("foo");
+        oauth.client("foo");
         checkNonceAndStateForCurrentClientDuringLogin();
         checkRedirectUriForCurrentClientDuringLogin();
 
         // Check login request object required
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Missing parameter: 'request' or 'request_uri'");
+        oauth.loginForm().nonce("123456").open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Missing parameter: 'request' or 'request_uri'");
 
         // Set request object and correct responseType
         TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor("foo");
@@ -565,18 +518,20 @@ public void testFAPIAdvancedLoginWithMTLS() throws Exception {
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
         requestObject.setResponseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
         registerRequestObject(requestObject, "foo", Algorithm.PS256, true);
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).open();
         loginPage.assertCurrent();
 
-        String code = loginUserAndGetCode("foo", true);
+        String code = loginUserAndGetCode("foo", null, true);
+
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
 
         // Check token not present in the AuthorizationResponse. Check ID Token present, but used as detached signature
-        Assert.assertNull(getParameterFromUrl(OAuth2Constants.ACCESS_TOKEN, true));
-        String idTokenParam = getParameterFromUrl(OAuth2Constants.ID_TOKEN, true);
+        Assert.assertNull(authorizationEndpointResponse.getAccessToken());
+        String idTokenParam = authorizationEndpointResponse.getIdToken();
         assertIDTokenAsDetachedSignature(idTokenParam, code);
 
         // Check HoK required
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         assertSuccessfulTokenResponse(tokenResponse);
         AccessToken accessToken = oauth.verifyToken(tokenResponse.getAccessToken());
@@ -588,31 +543,25 @@ public void testFAPIAdvancedLoginWithMTLS() throws Exception {
 
     private void checkPKCEWithS256RequiredDuringLogin(String clientId) {
         // Check PKCE required - login without PKCE should fail
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Missing parameter: code_challenge_method");
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Missing parameter: code_challenge_method");
 
         // Check PKCE required - login with "plain" PKCE should fail
-        oauth.codeChallenge("234567890_234567890123");
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Invalid parameter: code challenge method is not matching the configured one");
+        pkceGenerator = PkceGenerator.plain();
+        oauth.loginForm().codeChallenge(pkceGenerator).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Invalid parameter: code challenge method is not matching the configured one");
     }
 
-    // Assumption is that clientId is already set in "oauth" client when this method is called. Also assumption is that PKCE parameters are properly set (in case PKCE required for the client)
+    // Assumption is that clientId is already set in "oauth" client when this method is called. Also, assumption is that PKCE parameters are properly set (in case PKCE required for the client)
     private void checkNonceAndStateForCurrentClientDuringLogin() {
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Missing parameter: nonce");
+        oauth.loginForm().codeChallenge(pkceGenerator).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Missing parameter: nonce");
 
         // Check "state" required in non-OIDC request
-        oauth.nonce("123456");
-        oauth.stateParamHardcoded(null);
         oauth.openid(false);
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,false, "Missing parameter: state");
-
-        // Revert to default "state" parameter generator
-        oauth.stateParamRandom();
+        oauth.loginForm().nonce("123456").codeChallenge(pkceGenerator).open();
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST,"Missing parameter: state");
     }
 
     private void checkRedirectUriForCurrentClientDuringLogin() {
@@ -621,7 +570,7 @@ private void checkRedirectUriForCurrentClientDuringLogin() {
         // Check redirect_uri required
         oauth.openid(true);
         oauth.redirectUri(null);
-        oauth.openLoginForm();
+        oauth.loginForm().codeChallenge(pkceGenerator).open();
         assertBrowserWithError("Invalid parameter: redirect_uri");
 
         // Revert redirectUri
@@ -666,10 +615,10 @@ private void setupPolicyFAPIAdvancedForAllClient() throws Exception {
     }
 
     // codeToTokenExchanger is supposed to exchange "code" for the accessTokenResponse. It is supposed to send the tokenRequest including proper client authentication
-    private void successfulLoginAndLogout(String clientId, String username, boolean fragmentResponseModeExpected, Function<String, OAuthClient.AccessTokenResponse> codeToTokenExchanger) throws Exception {
-        String code = loginUserAndGetCode(clientId, fragmentResponseModeExpected);
+    private void successfulLoginAndLogout(String clientId, String nonce, String username, boolean fragmentResponseModeExpected, Function<String, AccessTokenResponse> codeToTokenExchanger) {
+        String code = loginUserAndGetCode(clientId, nonce, fragmentResponseModeExpected);
 
-        OAuthClient.AccessTokenResponse tokenResponse = codeToTokenExchanger.apply(code);
+        AccessTokenResponse tokenResponse = codeToTokenExchanger.apply(code);
 
         assertSuccessfulTokenResponse(tokenResponse);
 
@@ -687,7 +636,7 @@ private void assertIDTokenAsDetachedSignature(String idTokenParam, String code)
         Assert.assertNull(idToken.getGivenName());
         Assert.assertNull(idToken.getAccessTokenHash());
         Assert.assertEquals(idToken.getNonce(), "123456");
-        String state = getParameterFromUrl(OAuth2Constants.STATE, true);
+        String state = oauth.parseLoginResponse().getState();
         Assert.assertEquals(idToken.getStateHash(), HashUtils.accessTokenHash(Algorithm.PS256, state));
         Assert.assertEquals(idToken.getCodeHash(), HashUtils.accessTokenHash(Algorithm.PS256, code));
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java
index cc93d932e031..82f10667845c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java
@@ -18,6 +18,7 @@
 package org.keycloak.testsuite.client;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createAnyClientConditionConfig;
 
@@ -47,16 +48,17 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPoliciesBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
-import org.keycloak.testsuite.util.OAuthClient.ParResponse;
+import org.keycloak.testsuite.util.oauth.ParResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 
 /**
  * Test for the FAPI 2 specifications (still implementer's draft):
- * - FAPI 2.0 Security Profile - https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html
- * - FAPI 2.0 Message Signing - https://openid.bitbucket.io/fapi/fapi-2_0-message-signing.html
- *
+ * - <a href="https://openid.bitbucket.io/fapi/fapi-security-profile-2_0.html">FAPI 2.0 Security Profile</a>
+ * - <a href="https://openid.bitbucket.io/fapi/fapi-message-signing-2_0.html">FAPI 2.0 Message Signing</a>
+ * <p>
  * Mostly tests the global FAPI policies work as expected
  *
  * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
@@ -96,34 +98,34 @@ public void testFAPI2SecurityProfileLoginWithPrivateKeyJWT() throws Exception {
         assertEquals(Algorithm.PS256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getTokenEndpointAuthSigningAlg());
         assertEquals(false, client.isImplicitFlowEnabled());
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getPkceCodeChallengeMethod());
-        assertEquals(true, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
+        assertTrue(OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
         assertEquals(false, client.isFullScopeAllowed());
         assertEquals(true, client.isConsentRequired());
 
         // send a pushed authorization request
-        oauth.clientId(clientId);
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
+        oauth.client(clientId);
+
+        PkceGenerator pkceGenerator = PkceGenerator.s256();
 
         TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setNonce("123456");
-        requestObject.setCodeChallenge(codeChallenge);
-        requestObject.setCodeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
+        requestObject.setCodeChallenge(pkceGenerator.getCodeChallenge());
+        requestObject.setCodeChallengeMethod(pkceGenerator.getCodeChallengeMethod());
         registerRequestObject(requestObject, clientId, Algorithm.PS256, false);
 
         String signedJwt = createSignedRequestToken(clientId, Algorithm.PS256);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, null, signedJwt);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().request(request).signedJwt(signedJwt).send();
         assertEquals(201, pResp.getStatusCode());
-        String requestUri = pResp.getRequestUri();
-        oauth.requestUri(requestUri);
-        oauth.request(null);
+        requestUri = pResp.getRequestUri();
+        request = null;
 
         // send an authorization request
-        String code = loginUserAndGetCode(clientId, false);
+        String code = loginUserAndGetCode(clientId, null, false);
 
         // send a token request
         signedJwt = createSignedRequestToken(clientId, Algorithm.PS256);
-        OAuthClient.AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, codeVerifier, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        this.pkceGenerator = pkceGenerator;
+        AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertSuccessfulTokenResponse(tokenResponse);
 
         // check HoK required
@@ -154,69 +156,59 @@ public void testFAPI2SecurityProfileLoginWithMTLS() throws Exception {
         assertEquals(Algorithm.PS256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getTokenEndpointAuthSigningAlg());
         assertEquals(false, client.isImplicitFlowEnabled());
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getPkceCodeChallengeMethod());
-        assertEquals(true, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
+        assertTrue(OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
         assertEquals(false, client.isFullScopeAllowed());
         assertEquals(true, client.isConsentRequired());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId);
 
         // without PAR request - should fail
         oauth.openLoginForm();
         assertBrowserWithError("request_uri not included.");
 
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.stateParamHardcoded(null);
-        oauth.nonce("123456");
+        pkceGenerator = PkceGenerator.s256();
 
         // requiring hybrid request - should fail
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, null);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().nonce("123456").codeChallenge(pkceGenerator).send();
         assertEquals(401, pResp.getStatusCode());
         assertEquals(OAuthErrorException.UNAUTHORIZED_CLIENT, pResp.getError());
 
         // authorization request does not match PAR request - should fail
         oauth.responseType(OIDCResponseType.CODE);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, null);
+        pResp = oauth.pushedAuthorizationRequest().codeChallenge(pkceGenerator).send();
         assertEquals(201, pResp.getStatusCode());
-        String requestUri = pResp.getRequestUri();
+        requestUri = pResp.getRequestUri();
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN);
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
-        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST, false, "Parameter response_type does not match");
+        oauth.loginForm().requestUri(requestUri).open();
+        oauth.responseMode("query"); // Keycloak uses some default response mode as response type is not valid
+        assertRedirectedToClientWithError(OAuthErrorException.INVALID_REQUEST, "Parameter response_type does not match");
+        oauth.responseMode(null);
 
         oauth.responseType(OIDCResponseType.CODE);
 
         // an additional parameter in an authorization request that does not exist in a PAR request - should fail
-        oauth.requestUri(null);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, null);
+        pResp = oauth.pushedAuthorizationRequest().codeChallenge(pkceGenerator).send();
         assertEquals(201, pResp.getStatusCode());
         requestUri = pResp.getRequestUri();
-        oauth.stateParamRandom();
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).state("testFAPI2SecurityProfileLoginWithMTLS").open();
         assertBrowserWithError("PAR request did not include necessary parameters");
 
         // duplicated usage of a PAR request - should fail
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).state("testFAPI2SecurityProfileLoginWithMTLS").codeChallenge(pkceGenerator).open();
         assertBrowserWithError("PAR not found. not issued or used multiple times.");
 
         // send a pushed authorization request
-        oauth.stateParamHardcoded(null);
-        oauth.requestUri(null);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, null);
+        pResp = oauth.pushedAuthorizationRequest().nonce("123456").codeChallenge(pkceGenerator).send();
         assertEquals(201, pResp.getStatusCode());
         requestUri = pResp.getRequestUri();
+        request = null;
 
         // send an authorization request
-        oauth.requestUri(requestUri);
-        String code = loginUserAndGetCode(clientId, false);
+        String code = loginUserAndGetCode(clientId, "123456", false);
 
         // send a token request
-        oauth.codeVerifier(codeVerifier);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).codeVerifier(pkceGenerator).send();
 
         // check HoK required
         assertSuccessfulTokenResponse(tokenResponse);
@@ -265,42 +257,37 @@ public void testFAPI2MessageSigningLoginWithMTLS() throws Exception {
         assertEquals(Algorithm.PS256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getTokenEndpointAuthSigningAlg());
         assertEquals(false, client.isImplicitFlowEnabled());
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getPkceCodeChallengeMethod());
-        assertEquals(true, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
+        assertTrue(OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
         assertEquals(false, client.isFullScopeAllowed());
         assertEquals(true, client.isConsentRequired());
         assertEquals(Algorithm.PS256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getRequestObjectSignatureAlg());
 
         // Set request object and correct responseType
-        oauth.clientId(clientId);
-        oauth.stateParamHardcoded(null);
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
+        oauth.client(clientId);
+
+        pkceGenerator = PkceGenerator.s256();
+
         TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setNonce("123456");
         requestObject.setResponseType(OIDCResponseType.CODE);
         requestObject.setResponseMode(OIDCResponseMode.QUERY_JWT.value());
-        requestObject.setCodeChallenge(codeChallenge);
-        requestObject.setCodeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
+        requestObject.setCodeChallenge(pkceGenerator.getCodeChallenge());
+        requestObject.setCodeChallengeMethod(pkceGenerator.getCodeChallengeMethod());
         registerRequestObject(requestObject, clientId, Algorithm.PS256, false);
 
         // send a pushed authorization request
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, null);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().request(request).send();
         assertEquals(201, pResp.getStatusCode());
-        String requestUri = pResp.getRequestUri();
+        requestUri = pResp.getRequestUri();
+        request = null;
 
         // send an authorization request
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.nonce("123456");
         oauth.responseType(OIDCResponseType.CODE);
         oauth.responseMode(OIDCResponseMode.QUERY_JWT.value());
-        oauth.requestUri(requestUri);
-        oauth.request(null);
-        String code = loginUserAndGetCodeInJwtQueryResponseMode(clientId);
+        String code = loginUserAndGetCodeInJwtQueryResponseMode(clientId, "123456");
 
         // send a token request
-        oauth.codeVerifier(codeVerifier);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).codeVerifier(pkceGenerator).send();
 
         // check HoK required
         assertSuccessfulTokenResponse(tokenResponse);
@@ -332,27 +319,21 @@ public void testFAPI2MessageSigningLoginWithPrivateKeyJWT() throws Exception {
         assertEquals(Algorithm.PS256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getRequestObjectSignatureAlg());
         assertEquals(false, client.isImplicitFlowEnabled());
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).getPkceCodeChallengeMethod());
-        assertEquals(true, OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
+        assertTrue(OIDCAdvancedConfigWrapper.fromClientRepresentation(client).isUseMtlsHokToken());
         assertEquals(false, client.isFullScopeAllowed());
         assertEquals(true, client.isConsentRequired());
 
-        oauth.clientId(clientId);
-        oauth.stateParamHardcoded(null);
-        String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
+        oauth.client(clientId);
+
+        pkceGenerator = PkceGenerator.s256();
 
         // without a request object - should fail
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.stateParamHardcoded(null);
-        oauth.nonce("123456");
         oauth.responseType(OIDCResponseType.CODE);
         TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         registerRequestObject(requestObject, clientId, Algorithm.PS256, true);
-        oauth.requestUri(null);
-        oauth.request(null);
+        oauth.client(clientId);
         String signedJwt = createSignedRequestToken(clientId, Algorithm.PS256);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, null, signedJwt);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().nonce("123456").signedJwt(signedJwt).send();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError());
 
@@ -361,24 +342,23 @@ public void testFAPI2MessageSigningLoginWithPrivateKeyJWT() throws Exception {
         requestObject.setNonce("123456");
         requestObject.setResponseType(OIDCResponseType.CODE);
         requestObject.setResponseMode(OIDCResponseMode.QUERY_JWT.value());
-        requestObject.setCodeChallenge(codeChallenge);
+        requestObject.setCodeChallenge(pkceGenerator.getCodeChallenge());
         requestObject.setCodeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
         registerRequestObject(requestObject, clientId, Algorithm.PS256, false);
 
         // send a pushed authorization request
         signedJwt = createSignedRequestToken(clientId, Algorithm.PS256);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, null, signedJwt);
+        pResp = oauth.pushedAuthorizationRequest().signedJwt(signedJwt).request(request).send();
         assertEquals(201, pResp.getStatusCode());
-        String requestUri = pResp.getRequestUri();
+        requestUri = pResp.getRequestUri();
+        request = null;
 
         // send an authorization request
-        oauth.requestUri(requestUri);
-        oauth.request(null);
-        String code = loginUserAndGetCodeInJwtQueryResponseMode(clientId);
+        String code = loginUserAndGetCodeInJwtQueryResponseMode(clientId, null);
 
         // send a token request
         signedJwt = createSignedRequestToken(clientId, Algorithm.PS256);
-        OAuthClient.AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, codeVerifier, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        AccessTokenResponse tokenResponse = doAccessTokenRequestWithClientSignedJWT(code, signedJwt, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertSuccessfulTokenResponse(tokenResponse);
  
         // check HoK required
@@ -395,9 +375,7 @@ private void testFAPI2ClientRegistration(String profile) throws Exception {
 
         // Register client with clientIdAndSecret - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -405,9 +383,7 @@ private void testFAPI2ClientRegistration(String profile) throws Exception {
 
         // Register client with signedJWT - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -425,16 +401,12 @@ private void testFAPI2ClientRegistration(String profile) throws Exception {
         }
 
         // Try to register client with "client-jwt" - should pass
-        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -458,9 +430,7 @@ private void testFAPI2OIDCClientRegistration(String profile) throws Exception {
 
         // Try to register client with clientIdAndSecret - should fail
         try {
-            createClientDynamically(generateSuffixedName(clientId), (OIDCClientRepresentation clientRep) -> {
-                clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_BASIC);
-            });
+            createClientDynamically(generateSuffixedName(clientId), (OIDCClientRepresentation clientRep) -> clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.CLIENT_SECRET_BASIC));
             fail();
         } catch (ClientRegistrationException e) {
             assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
@@ -479,9 +449,7 @@ private void testFAPI2OIDCClientRegistration(String profile) throws Exception {
         setInitialAccessTokenForDynamicClientRegistration();
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientDynamically("client-x509", (OIDCClientRepresentation clientRep) -> {
-            clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.TLS_CLIENT_AUTH);
-        });
+        clientUUID = createClientDynamically("client-x509", (OIDCClientRepresentation clientRep) -> clientRep.setTokenEndpointAuthMethod(OIDCLoginProtocol.TLS_CLIENT_AUTH));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -518,13 +486,11 @@ private void testFAPI2SignatureAlgorithms(String profile) throws Exception {
         Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg());
 
         // Test default algorithms set everywhere
-        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
         Assert.assertEquals(Algorithm.PS256, clientConfig.getIdTokenSignedResponseAlg());
-        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
+        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getUserInfoSignedResponseAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getTokenEndpointAuthSigningAlg());
         Assert.assertEquals(Algorithm.PS256, client.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
@@ -541,5 +507,4 @@ private void setupPolicyFAPI2ForAllClient(String profile) throws Exception {
         ).toString();
         updatePolicies(json);
     }
-
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPICIBATest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPICIBATest.java
index e236759298c0..5a6d18d1a7ed 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPICIBATest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPICIBATest.java
@@ -33,7 +33,6 @@
 
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.security.PublicKey;
@@ -79,16 +78,16 @@
 import org.keycloak.testsuite.rest.representation.TestAuthenticationChannelRequest;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPoliciesBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
-import org.keycloak.testsuite.util.OAuthClient.AuthenticationRequestAcknowledgement;
+import org.keycloak.testsuite.util.oauth.ciba.AuthenticationRequestAcknowledgement;
 import org.keycloak.util.JsonSerialization;
 
 /**
  * Test for the FAPI CIBA specifications (still implementer's draft):
- * - Financial-grade API: Client Initiated Backchannel Authentication Profile - https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_CIBA.md
- *
+ * - <a href="https://openid.net/specs/openid-financial-api-ciba.html">Financial-grade API: Client Initiated Backchannel Authentication Profile</a>
+ * <p>
  * Mostly tests the global FAPI policies work as expected
  * This class only tests FAPI CIBA related requirements. OIDC CIBA related requirements has been tested by CIBATest.
  *
@@ -105,9 +104,7 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
 
         // Register client with clientIdAndSecret - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -115,9 +112,7 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
 
         // Register client with signedJWT - should fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -135,16 +130,12 @@ public void testFAPIAdvancedClientRegistration() throws Exception {
         }
 
         // Try to register client with "client-jwt" - should pass
-        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        String clientUUID = createClientByAdmin("client-jwt", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         ClientRepresentation client = getClientByAdmin(clientUUID);
         Assert.assertEquals(JWTClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
         // Try to register client with "client-x509" - should pass
-        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-x509", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         Assert.assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
@@ -195,13 +186,11 @@ public void testFAPICIBASignatureAlgorithms() throws Exception {
         Assert.assertEquals(Algorithm.ES256, client.getAttributes().get(CibaConfig.CIBA_BACKCHANNEL_AUTH_REQUEST_SIGNING_ALG));
 
         // Test default algorithms set everywhere
-        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        clientUUID = createClientByAdmin("client-jwt-default-alg", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         client = getClientByAdmin(clientUUID);
         clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(client);
         Assert.assertEquals(Algorithm.PS256, clientConfig.getIdTokenSignedResponseAlg());
-        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg().toString());
+        Assert.assertEquals(Algorithm.PS256, clientConfig.getRequestObjectSignatureAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getUserInfoSignedResponseAlg());
         Assert.assertEquals(Algorithm.PS256, clientConfig.getTokenEndpointAuthSigningAlg());
         Assert.assertEquals(Algorithm.PS256, client.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
@@ -237,7 +226,7 @@ public void testFAPICIBALoginWithPrivateKeyJWT() throws Exception {
 
         // user Backchannel Authentication Request
         AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithClientSignedJWT(
-                signedJwt, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+                signedJwt, encodedRequestObject, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(response.getStatusCode(), is(equalTo(200)));
 
         // user Authentication Channel Request
@@ -252,8 +241,8 @@ public void testFAPICIBALoginWithPrivateKeyJWT() throws Exception {
         String signedJwt2 = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
 
         // user Token Request
-        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
-                signedJwt2, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
+                signedJwt2, response.getAuthReqId(), MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         verifyBackchannelAuthenticationTokenRequest(tokenRes, clientId, TEST_USERNAME);
 
         // Logout and remove consent of the user for next logins
@@ -290,7 +279,7 @@ public void testFAPICIBAUserAuthenticationCancelled() throws Exception {
 
         // user Backchannel Authentication Request
         AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithClientSignedJWT(
-                signedJwt, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+                signedJwt, encodedRequestObject, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(response.getStatusCode(), is(equalTo(200)));
 
         // user Authentication Channel Request
@@ -305,8 +294,8 @@ public void testFAPICIBAUserAuthenticationCancelled() throws Exception {
         String signedJwt2 = createSignedRequestToken(clientId, privateKey, publicKey, org.keycloak.crypto.Algorithm.PS256);
 
         // user Token Request
-        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
-                signedJwt2, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
+                signedJwt2, response.getAuthReqId(), MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(tokenRes.getStatusCode(), is(equalTo(400)));
         assertThat(tokenRes.getError(), is(equalTo(OAuthErrorException.ACCESS_DENIED)));
         assertThat(tokenRes.getErrorDescription(), is(equalTo("not authorized")));
@@ -335,7 +324,7 @@ public void testFAPICIBALoginWithMTLS() throws Exception {
 
         // user Backchannel Authentication Request
         AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithMTLS(
-                clientId, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+                clientId, encodedRequestObject, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(response.getStatusCode(), is(equalTo(200)));
 
         // user Authentication Channel Request
@@ -348,8 +337,8 @@ public void testFAPICIBALoginWithMTLS() throws Exception {
         doAuthenticationChannelCallback(testRequest);
 
         // user Token Request
-        OAuthClient.AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithMTLS(
-                clientId, response.getAuthReqId(), () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        AccessTokenResponse tokenRes = doBackchannelAuthenticationTokenRequestWithMTLS(
+                clientId, response.getAuthReqId(), MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         verifyBackchannelAuthenticationTokenRequest(tokenRes, clientId, TEST_USERNAME);
 
         // Logout and remove consent of the user for next logins
@@ -380,7 +369,7 @@ public void testFAPICIBAWithoutBindingMessage() throws Exception {
 
         // user Backchannel Authentication Request
         AuthenticationRequestAcknowledgement response = doBackchannelAuthenticationRequestWithMTLS(
-                clientId, encodedRequestObject, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+                clientId, encodedRequestObject, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(response.getStatusCode(), is(equalTo(400)));
         assertThat(response.getError(), is(equalTo(OAuthErrorException.INVALID_REQUEST)));
         assertThat(response.getErrorDescription(), is(equalTo("Missing parameter: binding_message")));
@@ -403,7 +392,7 @@ public void testFAPICIBAWithoutSignedAuthenticationRequest() throws Exception {
         ClientRepresentation client = clientResource.toRepresentation();
         assertEquals(X509ClientAuthenticator.PROVIDER_ID, client.getClientAuthenticatorType());
 
-        AuthenticationRequestAcknowledgement response = doInvalidBackchannelAuthenticationRequestWithMTLS(clientId, TEST_USERNAME, bindingMessage, () -> MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore());
+        AuthenticationRequestAcknowledgement response = doInvalidBackchannelAuthenticationRequestWithMTLS(clientId, TEST_USERNAME, bindingMessage, MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
         assertThat(response.getStatusCode(), is(equalTo(400)));
         assertThat(response.getError(), is(equalTo(OAuthErrorException.INVALID_REQUEST)));
         assertThat(response.getErrorDescription(), is(equalTo("Missing parameter: 'request' or 'request_uri'")));
@@ -436,9 +425,9 @@ private void setClientAuthMethodNeutralSettings(ClientRepresentation clientRep)
     private AuthorizationEndpointRequestObject createValidAuthorizationEndpointRequestObject(String username, String bindingMessage) throws Exception {
         AuthorizationEndpointRequestObject requestObject = new AuthorizationEndpointRequestObject();
         requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());
-        requestObject.iat(Long.valueOf(Time.currentTime()));
+        requestObject.iat((long) Time.currentTime());
         requestObject.setScope("openid");
-        requestObject.setMax_age(Integer.valueOf(600));
+        requestObject.setMax_age(600);
         requestObject.audience(Urls.realmIssuer(new URI(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth"), REALM_NAME), "https://example.com");
         requestObject.setLoginHint(username);
         requestObject.setBindingMessage(bindingMessage);
@@ -447,16 +436,16 @@ private AuthorizationEndpointRequestObject createValidAuthorizationEndpointReque
 
     private AuthorizationEndpointRequestObject createFAPIValidAuthorizationEndpointRequestObject(String username, String bindingMessage) throws Exception {
     	AuthorizationEndpointRequestObject requestObject = createValidAuthorizationEndpointRequestObject(username, bindingMessage);
-        requestObject.exp(requestObject.getIat() + Long.valueOf(300));
+        requestObject.exp(requestObject.getIat() + 300L);
         requestObject.nbf(requestObject.getIat());
         requestObject.audience(Urls.realmIssuer(new URI(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth"), REALM_NAME));
         requestObject.issuer(clientId);
         requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());
-        requestObject.iat(Long.valueOf(Time.currentTime()));
+        requestObject.iat((long) Time.currentTime());
         return requestObject;
     }
 
-    private String registerSharedAuthenticationRequest(AuthorizationEndpointRequestObject requestObject, String clientId, String sigAlg) throws URISyntaxException, IOException {
+    private String registerSharedAuthenticationRequest(AuthorizationEndpointRequestObject requestObject, String clientId, String sigAlg) throws IOException {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
 
         // register request object
@@ -476,7 +465,7 @@ private AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequestW
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
             parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_PARAM, request));
-            CloseableHttpResponse response = sendRequest(oauth.getBackchannelAuthenticationUrl(), parameters, httpClientSupplier);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getBackchannelAuthentication(), parameters, httpClientSupplier);
             return new AuthenticationRequestAcknowledgement(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
@@ -490,7 +479,7 @@ private AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequestW
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CIBA_GRANT_TYPE));
             parameters.add(new BasicNameValuePair(OIDCLoginProtocol.REQUEST_PARAM, request));
             parameters.add(new BasicNameValuePair(OIDCLoginProtocol.CLIENT_ID_PARAM, clientId));
-            CloseableHttpResponse response = sendRequest(oauth.getBackchannelAuthenticationUrl(), parameters, httpClientSupplier);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getBackchannelAuthentication(), parameters, httpClientSupplier);
             return new AuthenticationRequestAcknowledgement(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
@@ -498,7 +487,7 @@ private AuthenticationRequestAcknowledgement doBackchannelAuthenticationRequestW
     }
 
     private AuthenticationRequestAcknowledgement doInvalidBackchannelAuthenticationRequestWithMTLS(
-            String clientId, String username, String bindingMessage, Supplier<CloseableHttpClient> httpClientSupplier) throws Exception {
+            String clientId, String username, String bindingMessage, Supplier<CloseableHttpClient> httpClientSupplier) {
         try {
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CIBA_GRANT_TYPE));
@@ -506,7 +495,7 @@ private AuthenticationRequestAcknowledgement doInvalidBackchannelAuthenticationR
             parameters.add(new BasicNameValuePair(LOGIN_HINT_PARAM, username));
             parameters.add(new BasicNameValuePair(BINDING_MESSAGE, bindingMessage));
             parameters.add(new BasicNameValuePair(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID));
-            CloseableHttpResponse response = sendRequest(oauth.getBackchannelAuthenticationUrl(), parameters, httpClientSupplier);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getBackchannelAuthentication(), parameters, httpClientSupplier);
             return new AuthenticationRequestAcknowledgement(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
@@ -516,12 +505,11 @@ private AuthenticationRequestAcknowledgement doInvalidBackchannelAuthenticationR
     private TestAuthenticationChannelRequest doAuthenticationChannelRequest(String bindingMessage) {
         // get Authentication Channel Request keycloak has done on Backchannel Authentication Endpoint from the FIFO queue of testing Authentication Channel Request API
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
-        TestAuthenticationChannelRequest authenticationChannelReq = oidcClientEndpointsResource.getAuthenticationChannel(bindingMessage);
-        return authenticationChannelReq;
+        return oidcClientEndpointsResource.getAuthenticationChannel(bindingMessage);
     }
 
     private EventRepresentation doAuthenticationChannelCallback(TestAuthenticationChannelRequest request) throws Exception {
-        int statusCode = oauth.doAuthenticationChannelCallback(request.getBearerToken(), SUCCEED);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(request.getBearerToken(), SUCCEED);
         assertThat(statusCode, is(equalTo(200)));
         // check login event : ignore user id and other details except for username
         EventRepresentation representation = new EventRepresentation();
@@ -532,7 +520,7 @@ private EventRepresentation doAuthenticationChannelCallback(TestAuthenticationCh
     }
 
     private EventRepresentation doAuthenticationChannelCallbackCancelled(TestAuthenticationChannelRequest request) throws Exception {
-        int statusCode = oauth.doAuthenticationChannelCallback(request.getBearerToken(), CANCELLED);
+        int statusCode = oauth.ciba().doAuthenticationChannelCallback(request.getBearerToken(), CANCELLED);
         assertThat(statusCode, is(equalTo(200)));
         // check login event : ignore user id and other details except for username
         EventRepresentation representation = new EventRepresentation();
@@ -542,7 +530,7 @@ private EventRepresentation doAuthenticationChannelCallbackCancelled(TestAuthent
         return representation;
     }
 
-    private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
+    private AccessTokenResponse doBackchannelAuthenticationTokenRequestWithClientSignedJWT(
             String signedJwt, String authReqId, Supplier<CloseableHttpClient> httpClientSupplier) {
         try {
             List<NameValuePair> parameters = new LinkedList<>();
@@ -550,28 +538,28 @@ private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequestW
             parameters.add(new BasicNameValuePair(AUTH_REQ_ID, authReqId));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
-            CloseableHttpResponse response = sendRequest(oauth.getBackchannelAuthenticationTokenRequestUrl(), parameters, httpClientSupplier);
-            return new OAuthClient.AccessTokenResponse(response);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters, httpClientSupplier);
+            return new AccessTokenResponse(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
     }
 
-    private OAuthClient.AccessTokenResponse doBackchannelAuthenticationTokenRequestWithMTLS(
+    private AccessTokenResponse doBackchannelAuthenticationTokenRequestWithMTLS(
             String clientId, String authReqId, Supplier<CloseableHttpClient> httpClientSupplier) {
         try {
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CIBA_GRANT_TYPE));
             parameters.add(new BasicNameValuePair(AUTH_REQ_ID, authReqId));
             parameters.add(new BasicNameValuePair(OIDCLoginProtocol.CLIENT_ID_PARAM, clientId));
-            CloseableHttpResponse response = sendRequest(oauth.getBackchannelAuthenticationTokenRequestUrl(), parameters, httpClientSupplier);
-            return new OAuthClient.AccessTokenResponse(response);
+            CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters, httpClientSupplier);
+            return new AccessTokenResponse(response);
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
     }
 
-    private void verifyBackchannelAuthenticationTokenRequest(OAuthClient.AccessTokenResponse tokenRes, String clientId, String username) {
+    private void verifyBackchannelAuthenticationTokenRequest(AccessTokenResponse tokenRes, String clientId, String username) {
         assertThat(tokenRes.getStatusCode(), is(equalTo(200)));
 
         AccessToken accessToken = oauth.verifyToken(tokenRes.getAccessToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/MutualTLSClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/MutualTLSClientTest.java
index 526395e354e8..8ad4ead43d5b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/MutualTLSClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/MutualTLSClientTest.java
@@ -29,7 +29,8 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 /**
  * Mutual TLS Client tests.
@@ -102,7 +103,7 @@ public void testSuccessfulClientInvocationWithProperCertificate() throws Excepti
       Supplier<CloseableHttpClient> clientWithProperCertificate = MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore;
 
       //when
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(CLIENT_ID, clientWithProperCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(CLIENT_ID, clientWithProperCertificate);
 
       //then
       assertTokenObtained(token);
@@ -114,7 +115,7 @@ public void testSuccessfulClientInvocationWithProperCertificateAndSubjectDN() th
       Supplier<CloseableHttpClient> clientWithProperCertificate = MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore;
 
       //when
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(EXACT_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(EXACT_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
 
       //then
       assertTokenObtained(token);
@@ -126,7 +127,7 @@ public void testFailedClientInvocationWithIssuerCertificateAndSubjectDN() throws
       Supplier<CloseableHttpClient> clientWithProperCertificate = MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore;
 
       //when (Certificate with the client's expected subjectDN is available in the certificate chain, but not on the 1st position. Hence authentication should not be successful)
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(ISSUER_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(ISSUER_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
 
       //then
       assertTokenNotObtained(token);
@@ -135,7 +136,7 @@ public void testFailedClientInvocationWithIssuerCertificateAndSubjectDN() throws
    @Test
    public void testSuccessfulClientInvocationWithClientIdInQueryParams() throws Exception {
       //given//when
-      OAuthClient.AccessTokenResponse token = null;
+      AccessTokenResponse token = null;
       try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
          login(CLIENT_ID);
          token = getAccessTokenResponseWithQueryParams(CLIENT_ID, client);
@@ -151,7 +152,7 @@ public void testFailedClientInvocationWithProperCertificateAndWrongSubjectDN() t
       Supplier<CloseableHttpClient> clientWithProperCertificate = MutualTLSUtils::newCloseableHttpClientWithOtherKeyStoreAndTrustStore;
 
       //when
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(EXACT_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(EXACT_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
 
       //then
       assertTokenNotObtained(token);
@@ -163,7 +164,7 @@ public void testFailedClientInvocationWithoutCertificateCertificate() throws Exc
       Supplier<CloseableHttpClient> clientWithoutCertificate = MutualTLSUtils::newCloseableHttpClientWithoutKeyStoreAndTrustStore;
 
       //when
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(CLIENT_ID, clientWithoutCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(CLIENT_ID, clientWithoutCertificate);
 
       //then
       assertTokenNotObtained(token);
@@ -172,7 +173,7 @@ public void testFailedClientInvocationWithoutCertificateCertificate() throws Exc
    @Test
    public void testFailedClientInvocationWithDisabledClient() throws Exception {
       //given//when
-      OAuthClient.AccessTokenResponse token = null;
+      AccessTokenResponse token = null;
       try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
          login(DISABLED_CLIENT_ID);
 
@@ -223,7 +224,7 @@ private void testClientInvocationWithOBBClient(String expectedSubjectDN, boolean
       config.setTlsClientAuthSubjectDn(expectedSubjectDN);
       client.update(clientRep);
 
-      OAuthClient.AccessTokenResponse token = loginAndGetAccessTokenResponse(OBB_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
+      AccessTokenResponse token = loginAndGetAccessTokenResponse(OBB_SUBJECT_DN_CLIENT_ID, clientWithProperCertificate);
       if (expectSuccess) {
          assertTokenObtained(token);
       } else {
@@ -231,7 +232,7 @@ private void testClientInvocationWithOBBClient(String expectedSubjectDN, boolean
       }
    }
 
-   private OAuthClient.AccessTokenResponse loginAndGetAccessTokenResponse(String clientId, Supplier<CloseableHttpClient> client) throws IOException{
+   private AccessTokenResponse loginAndGetAccessTokenResponse(String clientId, Supplier<CloseableHttpClient> client) throws IOException{
       try (CloseableHttpClient closeableHttpClient = client.get()) {
          login(clientId);
          return getAccessTokenResponse(clientId, closeableHttpClient);
@@ -240,29 +241,31 @@ private OAuthClient.AccessTokenResponse loginAndGetAccessTokenResponse(String cl
       }
    }
 
-   private OAuthClient.AccessTokenResponse getAccessTokenResponse(String clientId, CloseableHttpClient closeableHttpClient) {
-      String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+   private AccessTokenResponse getAccessTokenResponse(String clientId, CloseableHttpClient closeableHttpClient) {
+      String code = oauth.parseLoginResponse().getCode();
       // Call protected endpoint with supplied client.
-      return oauth
-            .httpClient(() -> closeableHttpClient)
-            .clientId(clientId)
-            .doAccessTokenRequest(code, null, closeableHttpClient);
+      try {
+          oauth.httpClient().set(closeableHttpClient);
+          return oauth.clientId(clientId)
+                  .doAccessTokenRequest(code);
+      } finally {
+          oauth.httpClient().reset();
+      }
    }
 
    private void login(String clientId) {
       // Login with default client, despite what has been supplied into this method.
-      oauth
-            .httpClient(OAuthClient::newCloseableHttpClient)
-            .clientId(clientId)
-            .doLogin(USER, PASSWORD);
+      oauth.httpClient().reset();
+      oauth.client(clientId)
+        .doLogin(USER, PASSWORD);
    }
 
-   private void assertTokenObtained(OAuthClient.AccessTokenResponse token) {
+   private void assertTokenObtained(AccessTokenResponse token) {
       Assert.assertEquals(200, token.getStatusCode());
       Assert.assertNotNull(token.getAccessToken());
    }
 
-   private void assertTokenNotObtained(OAuthClient.AccessTokenResponse token) {
+   private void assertTokenNotObtained(AccessTokenResponse token) {
       Assert.assertEquals(401, token.getStatusCode());
       Assert.assertNull(token.getAccessToken());
    }
@@ -271,16 +274,16 @@ private void assertTokenNotObtained(OAuthClient.AccessTokenResponse token) {
     * This is a very simplified version of OAuthClient#doAccessTokenRequest.
     * It test a scenario, where we do not follow the spec and specify client_id in Query Params (for in a form).
     */
-   private OAuthClient.AccessTokenResponse getAccessTokenResponseWithQueryParams(String clientId, CloseableHttpClient client) throws Exception {
-      HttpPost post = new HttpPost(oauth.getAccessTokenUrl() + "?client_id=" + clientId);
+   private AccessTokenResponse getAccessTokenResponseWithQueryParams(String clientId, CloseableHttpClient client) throws Exception {
+      HttpPost post = new HttpPost(oauth.getEndpoints().getToken() + "?client_id=" + clientId);
       List<NameValuePair> parameters = new LinkedList<>();
       parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
-      parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, oauth.getCurrentQuery().get(OAuth2Constants.CODE)));
+      parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, oauth.parseLoginResponse().getCode()));
       parameters.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, oauth.getRedirectUri()));
       UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
       post.setEntity(formEntity);
 
-      return new OAuthClient.AccessTokenResponse(client.execute(post));
+      return new AccessTokenResponse(client.execute(post));
    }
 
    private void disableClient(String clientId) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1ConfidentialClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1ConfidentialClientTest.java
index 774ceb73eeef..16323550c773 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1ConfidentialClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1ConfidentialClientTest.java
@@ -30,7 +30,6 @@
 import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
-import org.keycloak.protocol.oidc.utils.PkceUtils;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
@@ -41,7 +40,9 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.util.ClientPoliciesUtil;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 
 
 import java.util.Collections;
@@ -59,7 +60,9 @@ public class OAuth2_1ConfidentialClientTest extends AbstractFAPITest {
 
     private static final String OAUTH2_1_CONFIDENTIAL_CLIENT_PROFILE_NAME = "oauth-2-1-for-confidential-client";
 
-    private String validRedirectUri;;
+    private String validRedirectUri;
+
+    private PkceGenerator pkceGenerator;
 
     @Before
     public void setupValidateRedirectUri() {
@@ -70,11 +73,8 @@ public void setupValidateRedirectUri() {
     public void revertPolicies() throws ClientPolicyException {
         oauth.openid(true);
         oauth.responseType(OIDCResponseType.CODE);
-        oauth.nonce(null);
-        oauth.codeChallenge(null);
-        oauth.codeChallengeMethod(null);
-        oauth.dpopProof(null);
         updatePolicies("{}");
+        pkceGenerator = null;
     }
 
     @Test
@@ -91,7 +91,8 @@ public void testOAuth2_1NotAllowImplicitGrant() throws Exception {
         // setup profiles and policies
         setupPolicyOAuth2_1ConfidentialClientForAllClient();
 
-        setValidPkce(clientId);
+        oauth.client(clientId);
+        pkceGenerator = PkceGenerator.s256();
 
         // implicit grant
         testProhibitedImplicitOrHybridFlow(false, OIDCResponseType.TOKEN, generateNonce());
@@ -112,7 +113,7 @@ public void testOAuth2_1NotAllowImplicitGrant() throws Exception {
     @Test
     public void testOAuth2_1NotAllowResourceOwnerPasswordCredentialsGrant() throws Exception {
         String clientId = generateSuffixedName(CLIENT_NAME);
-        String cId = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
+        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
             clientRep.setClientAuthenticatorType(X509ClientAuthenticator.PROVIDER_ID);
             OIDCAdvancedConfigWrapper clientConfig = OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep);
             clientConfig.setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
@@ -125,8 +126,8 @@ public void testOAuth2_1NotAllowResourceOwnerPasswordCredentialsGrant() throws E
         setupPolicyOAuth2_1ConfidentialClientForAllClient();
 
         // resource owner password credentials grant - fail
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(null, TEST_USERNAME, TEST_USERSECRET);
+        oauth.client(clientId);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(TEST_USERNAME, TEST_USERSECRET);
 
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -140,9 +141,7 @@ public void testOAuth2_1ClientAuthentication() throws Exception {
 
         // register client with clientIdAndSecret - fail
         try {
-            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin("invalid", (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -175,10 +174,7 @@ public void testOAuth2_1ProofKeyForCodeExchange() throws Exception {
         setupPolicyOAuth2_1ConfidentialClientForAllClient();
 
         oauth.redirectUri(validRedirectUri);
-        oauth.codeChallenge(null);
-        oauth.codeChallengeMethod(null);
-        oauth.codeVerifier(null);
-        failLoginByNotFollowingPKCE(clientId);
+        failLoginByNotFollowingPKCEWithoutClientPolicyValidation(clientId);
     }
 
     @Test
@@ -192,7 +188,7 @@ public void testOAuth2_1RedirectUris() throws Exception {
         // setup profiles and policies
         setupPolicyOAuth2_1ConfidentialClientForAllClient();
 
-        faiilUpdateRedirectUrisDynamically(clientId, List.of("https://dev.example.com:8443/*"));
+        failUpdateRedirectUrisDynamically(clientId, List.of("https://dev.example.com:8443/*"));
         successUpdateRedirectUrisByAdmin(cId,
                 List.of("https://dev.example.com:8443/callback", "https://[::1]/auth/admin",
                         "com.example.app:/oauth2redirect/example-provider", "https://127.0.0.1/auth/admin"));
@@ -210,26 +206,27 @@ public void testOAuth2_1OAuthMtlsSenderConstrainedToken() throws Exception {
         // setup profiles and policies
         setupPolicyOAuth2_1ConfidentialClientForAllClient();
 
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.redirectUri(validRedirectUri);
-        setValidPkce(clientId);
-        OAuthClient.AuthorizationEndpointResponse res = oauth.doLogin(TEST_USERNAME, TEST_USERSECRET);
+        pkceGenerator = PkceGenerator.s256();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(res.getCode(), null);
+        AuthorizationEndpointResponse res = oauth.loginForm().codeChallenge(pkceGenerator).doLogin(TEST_USERNAME, TEST_USERSECRET);
+
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(res.getCode()).codeVerifier(pkceGenerator.getCodeVerifier()).send();
         AccessToken accessToken = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertNotNull(accessToken.getConfirmation().getCertThumbprint());
 
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
     }
 
     private void testProhibitedImplicitOrHybridFlow(boolean isOpenid, String responseType, String nonce) {
         oauth.openid(isOpenid);
         oauth.responseType(responseType);
-        oauth.nonce(nonce);
         oauth.redirectUri(validRedirectUri);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentFragment().get(OAuth2Constants.ERROR));
-        assertEquals("Implicit/Hybrid flow is prohibited.", oauth.getCurrentFragment().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().nonce(nonce).codeChallenge(pkceGenerator).open();
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Implicit/Hybrid flow is prohibited.", authorizationEndpointResponse.getErrorDescription());
     }
 
     private void setupPolicyOAuth2_1ConfidentialClientForAllClient() throws Exception {
@@ -253,15 +250,6 @@ private void setupValidClientExceptForRedirectUri(ClientRepresentation clientRep
         clientConfig.setAllowRegexPatternComparison(false);
         clientConfig.setPkceCodeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
         clientConfig.setUseMtlsHoKToken(true);
-    };
-
-    private void setValidPkce(String clientId) throws Exception {
-        oauth.clientId(clientId);
-        String codeVerifier = PkceUtils.generateCodeVerifier();
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(codeVerifier);
     }
 
     private String generateNonce() {
@@ -291,7 +279,7 @@ private void successUpdateRedirectUrisByAdmin(String cId, List<String> redirectU
         }
     }
 
-    private void faiilUpdateRedirectUrisDynamically(String clientId, List<String> redirectUrisList) {
+    private void failUpdateRedirectUrisDynamically(String clientId, List<String> redirectUrisList) {
         try {
             updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) ->
                     clientRep.setRedirectUris(redirectUrisList));
@@ -302,7 +290,7 @@ private void faiilUpdateRedirectUrisDynamically(String clientId, List<String> re
     }
 
     private void failAuthorizationRequest(String clientId, String redirectUri) {
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.redirectUri(redirectUri);
         oauth.openLoginForm();
         assertTrue(errorPage.isCurrent());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1PublicClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1PublicClientTest.java
index b6700c8bb3e5..d5406c1e396a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1PublicClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OAuth2_1PublicClientTest.java
@@ -20,7 +20,6 @@
 
 import jakarta.ws.rs.HttpMethod;
 import jakarta.ws.rs.core.Response;
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -35,28 +34,25 @@
 import org.keycloak.jose.jws.JWSHeader;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
-import org.keycloak.protocol.oidc.utils.PkceUtils;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
-import org.keycloak.representations.oidc.TokenMetadataRepresentation;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.util.ClientPoliciesUtil;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.util.JsonSerialization;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
+import org.keycloak.testsuite.util.oauth.UserInfoResponse;
 
 import java.security.KeyPair;
 import java.util.Collections;
 import java.util.List;
 import java.util.UUID;
 
-import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createAnyClientConditionConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createEcJwk;
@@ -76,6 +72,8 @@ public class OAuth2_1PublicClientTest extends AbstractFAPITest {
 
     private String validRedirectUri;
 
+    private PkceGenerator pkceGenerator;
+
     @Before
     public void setupValidateRedirectUri() {
         validRedirectUri = AssertEvents.DEFAULT_REDIRECT_URI.replace("localhost", "127.0.0.1");
@@ -91,11 +89,8 @@ public void beforeDPoPTest() throws Exception {
     public void revertPolicies() throws ClientPolicyException {
         oauth.openid(true);
         oauth.responseType(OIDCResponseType.CODE);
-        oauth.nonce(null);
-        oauth.codeChallenge(null);
-        oauth.codeChallengeMethod(null);
-        oauth.dpopProof(null);
         updatePolicies("{}");
+        pkceGenerator = null;
     }
 
     @Test
@@ -112,7 +107,8 @@ public void testOAuth2_1NotAllowImplicitGrant() throws Exception {
         // setup profiles and policies
         setupPolicyOAuth2_1PublicClientForAllClient();
 
-        setValidPkce(clientId);
+        oauth.client(clientId);
+        pkceGenerator = PkceGenerator.s256();
 
         // implicit grant
         testProhibitedImplicitOrHybridFlow(false, OIDCResponseType.TOKEN, generateNonce()
@@ -143,8 +139,8 @@ public void testOAuth2_1NotAllowResourceOwnerPasswordCredentialsGrant() throws E
         // setup profiles and policies
         setupPolicyOAuth2_1PublicClientForAllClient();
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(null, TEST_USER_NAME, TEST_USER_PASSWORD, null);
+        oauth.client(clientId);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -163,10 +159,8 @@ public void testOAuth2_1ProofKeyForCodeExchange() throws Exception {
         setupPolicyOAuth2_1PublicClientForAllClient();
 
         oauth.redirectUri(validRedirectUri);
-        oauth.codeChallenge(null);
-        oauth.codeChallengeMethod(null);
-        oauth.codeVerifier(null);
-        failLoginByNotFollowingPKCE(clientId);
+        pkceGenerator = null;
+        failLoginByNotFollowingPKCEWithoutClientPolicyValidation(clientId);
     }
 
     @Test
@@ -199,7 +193,9 @@ public void testOAuth2_1RedirectUris() throws Exception {
         }
 
         // authorization with invalid redirect_uri request - fail
-        setValidPkce(clientId);
+        oauth.client(clientId);
+        pkceGenerator = PkceGenerator.s256();
+
         oauth.redirectUri("https://localhost/app");
         oauth.openLoginForm();
         assertTrue(errorPage.isCurrent());
@@ -218,44 +214,36 @@ public void testOAuth2_1DPoPSenderConstrainedToken() throws Exception {
         setupPolicyOAuth2_1PublicClientForAllClient();
 
         // authorization request - success
-        setValidPkce(clientId);
-        oauth.clientId(clientId);
+        oauth.client(clientId);
+        pkceGenerator = PkceGenerator.s256();
         oauth.redirectUri(validRedirectUri);
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        oauth.loginForm().codeChallenge(pkceGenerator).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         // token request with DPoP Proof - success
         JWSHeader jwsEcHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.ES256, DPOP_JWT_HEADER_TYPE, jwkEc.getKeyId(), jwkEc);
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofEcEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEcEncoded).codeVerifier(pkceGenerator.getCodeVerifier()).send();
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
         oauth.verifyToken(response.getAccessToken());
 
         // token refresh request with DPoP Proof - success
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        response = oauth.refreshRequest(response.getRefreshToken()).dpopProof(dpopProofEcEncoded).send();
         assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
 
         // userinfo request with DPoP Proof - success
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getUserInfoUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        OAuthClient.UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), response.getAccessToken());
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofEcEncoded).send();
         assertEquals(TEST_USER_NAME, userInfoResponse.getUserInfo().getPreferredUsername());
 
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
 
         // revoke token with a valid DPoP proof - success
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getTokenRevocationUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        CloseableHttpResponse closableHttpResponse = oauth.doTokenRevoke(response.getAccessToken(), "access_token", null);
-        assertThat(closableHttpResponse, Matchers.statusCodeIsHC(Response.Status.OK));
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, null, response.getAccessToken());
-        TokenMetadataRepresentation tokenMetadataRepresentation = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
-        assertFalse(tokenMetadataRepresentation.isActive());
-
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getRevocation(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        assertTrue(oauth.tokenRevocationRequest(response.getAccessToken()).accessToken().dpopProof(dpopProofEcEncoded).send().isSuccess());
+
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
     }
 
     private void setupPolicyOAuth2_1PublicClientForAllClient() throws Exception {
@@ -282,20 +270,11 @@ private void setupValidClientExceptForRedirectUri(ClientRepresentation clientRep
     private void testProhibitedImplicitOrHybridFlow(boolean isOpenid, String responseType, String nonce) {
         oauth.openid(isOpenid);
         oauth.responseType(responseType);
-        oauth.nonce(nonce);
         oauth.redirectUri(validRedirectUri);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentFragment().get(OAuth2Constants.ERROR));
-        assertEquals("Implicit/Hybrid flow is prohibited.", oauth.getCurrentFragment().get(OAuth2Constants.ERROR_DESCRIPTION));
-    }
-
-    private void setValidPkce(String clientId) throws Exception {
-        oauth.clientId(clientId);
-        String codeVerifier = PkceUtils.generateCodeVerifier();
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(codeVerifier);
+        oauth.loginForm().nonce(nonce).codeChallenge(pkceGenerator).open();
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Implicit/Hybrid flow is prohibited.", authorizationEndpointResponse.getErrorDescription());
     }
 
     private String generateNonce() {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationResponseTypesAndGrantsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationResponseTypesAndGrantsTest.java
index ebee5cba20b5..cc7e4e4f58f3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationResponseTypesAndGrantsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationResponseTypesAndGrantsTest.java
@@ -19,19 +19,25 @@
 
 package org.keycloak.testsuite.client;
 
+import jakarta.ws.rs.core.Response;
 import java.util.Collections;
 import java.util.List;
 
 import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
 import org.junit.Before;
 import org.junit.Test;
+import org.keycloak.OAuthErrorException;
 import org.keycloak.client.registration.Auth;
 import org.keycloak.client.registration.ClientRegistrationException;
+import org.keycloak.client.registration.HttpErrorException;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
 import org.keycloak.representations.idm.ClientInitialAccessPresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
+import org.keycloak.util.JsonSerialization;
 import org.keycloak.testsuite.Assert;
 
 import static org.hamcrest.Matchers.containsInAnyOrder;
@@ -41,6 +47,7 @@
 import static org.keycloak.OAuth2Constants.IMPLICIT;
 import static org.keycloak.OAuth2Constants.PASSWORD;
 import static org.keycloak.OAuth2Constants.REFRESH_TOKEN;
+import static org.keycloak.OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE;
 import static org.keycloak.models.OAuth2DeviceConfig.OAUTH2_DEVICE_AUTHORIZATION_GRANT_ENABLED;
 import static org.keycloak.protocol.oidc.utils.OIDCResponseType.CODE;
 import static org.keycloak.protocol.oidc.utils.OIDCResponseType.ID_TOKEN;
@@ -81,7 +88,7 @@ public void testClientWithoutResponseTypesAndGrantTypes() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN));
 
-        assertKeycloakClient(response, true, false, false, false, true, false);
+        assertKeycloakClient(response, true, false, false, false, true, false, false);
     }
 
     @Test
@@ -92,7 +99,7 @@ public void testResponseTypeCodeWithoutGrantTypes() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN));
 
-        assertKeycloakClient(response, true, false, false, false, true, false);
+        assertKeycloakClient(response, true, false, false, false, true, false, false);
     }
 
     // Limitation of Keycloak switches (Standard flow, Implicit flow) means that enabling any hybrid grant type enables also implicit flow.
@@ -106,7 +113,7 @@ public void testResponseTypeCodeIDTokenWithoutGrantTypes() throws Exception {
         assertOIDCResponse(response, List.of(CODE, NONE, ID_TOKEN, "id_token token", "code id_token", "code token", "code id_token token"),
                 List.of(AUTHORIZATION_CODE, IMPLICIT, REFRESH_TOKEN));
 
-        assertKeycloakClient(response, true, true, false, false, true, false);
+        assertKeycloakClient(response, true, true, false, false, true, false, false);
     }
 
     @Test
@@ -118,7 +125,7 @@ public void testWithoutResponseTypeClientCredentialsGrant() throws Exception {
         assertOIDCResponse(response, Collections.emptyList(),
                 List.of(CLIENT_CREDENTIALS));
 
-        assertKeycloakClient(response, false, false, false, true, false, false);
+        assertKeycloakClient(response, false, false, false, true, false, false, false);
     }
 
     @Test
@@ -130,7 +137,7 @@ public void testWithoutResponseTypePasswordGrant() throws Exception {
         assertOIDCResponse(response, Collections.emptyList(),
                 List.of(PASSWORD));
 
-        assertKeycloakClient(response, false, false, true, false, false, false);
+        assertKeycloakClient(response, false, false, true, false, false, false, false);
     }
 
     @Test
@@ -142,7 +149,7 @@ public void testWithoutResponseTypePasswordClientCredentialsRefreshTokensGrants(
         assertOIDCResponse(response, Collections.emptyList(),
                 List.of(PASSWORD, CLIENT_CREDENTIALS, REFRESH_TOKEN));
 
-        assertKeycloakClient(response, false, false, true, true, true, false);
+        assertKeycloakClient(response, false, false, true, true, true, false, false);
     }
 
     @Test
@@ -153,7 +160,7 @@ public void testClientWithoutRefreshToken() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE));
 
-        assertKeycloakClient(response, true, false, false, false, false, false);
+        assertKeycloakClient(response, true, false, false, false, false, false, false);
     }
 
     @Test
@@ -164,7 +171,7 @@ public void testClientWithRefreshToken() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN));
 
-        assertKeycloakClient(response, true, false, false, false, true, false);
+        assertKeycloakClient(response, true, false, false, false, true, false, false);
     }
 
     @Test
@@ -175,7 +182,27 @@ public void testNoResponseTypesWithDeviceGrant() throws Exception {
 
         assertOIDCResponse(response, Collections.emptyList(), List.of(DEVICE_CODE_GRANT_TYPE));
 
-        assertKeycloakClient(response, false, false, false, false, false, true);
+        assertKeycloakClient(response, false, false, false, false, false, true, false);
+    }
+
+    @Test
+    public void testGrantTypeTokenExchange() throws Exception {
+        OIDCClientRepresentation clientRep = createRep(null, List.of(AUTHORIZATION_CODE, REFRESH_TOKEN, TOKEN_EXCHANGE_GRANT_TYPE));
+        clientRep.setTokenEndpointAuthMethod("none");
+
+        ClientRegistrationException clientRegistrationException = Assert.assertThrows(ClientRegistrationException.class, () -> reg.oidc().create(clientRep));
+        MatcherAssert.assertThat(clientRegistrationException.getCause(), Matchers.instanceOf(HttpErrorException.class));
+        HttpErrorException httpErrorException = (HttpErrorException) clientRegistrationException.getCause();
+        Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), httpErrorException.getStatusLine().getStatusCode());
+        OAuth2ErrorRepresentation error = JsonSerialization.readValue(httpErrorException.getErrorResponse(), OAuth2ErrorRepresentation.class);
+        Assert.assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, error.getError());
+
+        clientRep.setTokenEndpointAuthMethod(null);
+        OIDCClientRepresentation response = reg.oidc().create(clientRep);
+
+        assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN, TOKEN_EXCHANGE_GRANT_TYPE));
+
+        assertKeycloakClient(response, true, false, false, false, true, false, true);
     }
 
     @Test
@@ -186,7 +213,7 @@ public void testCodeResponseTypeWithMoreGrants() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN, PASSWORD, CLIENT_CREDENTIALS));
 
-        assertKeycloakClient(response, true, false, true, true, true, false);
+        assertKeycloakClient(response, true, false, true, true, true, false, false);
     }
 
     // Grant type "authorization_code" added automatically because of response_type "code" .
@@ -201,7 +228,7 @@ public void testCodeResponseTypeWithIncompatibleGrants() throws Exception {
 
         assertOIDCResponse(response, List.of(CODE, NONE), List.of(AUTHORIZATION_CODE, REFRESH_TOKEN, PASSWORD, CLIENT_CREDENTIALS));
 
-        assertKeycloakClient(response, true, false, true, true, true, false);
+        assertKeycloakClient(response, true, false, true, true, true, false, false);
     }
 
     private void assertOIDCResponse(OIDCClientRepresentation response, List<String> expectedResponseTypes, List<String> expectedGrantTypes) {
@@ -228,7 +255,8 @@ private void assertKeycloakClient(OIDCClientRepresentation response,
                                              boolean expectedDirectGrantFlow,
                                              boolean expectedServiceAccountsFlow,
                                              boolean expectedRefreshToken,
-                                             boolean expectedDeviceGrant) {
+                                             boolean expectedDeviceGrant,
+                                             boolean expectedTokenExchange) {
         ClientRepresentation kcClient = getClient(response.getClientId());
         OIDCAdvancedConfigWrapper config = OIDCAdvancedConfigWrapper.fromClientRepresentation(kcClient);
         Assert.assertEquals("Expected standard flow: " + expectedStandardFlow + " did not match.", expectedStandardFlow, kcClient.isStandardFlowEnabled());
@@ -239,5 +267,6 @@ private void assertKeycloakClient(OIDCClientRepresentation response,
         Assert.assertFalse("Don't expect refresh token for client credentials grant enabled", config.isUseRefreshTokenForClientCredentialsGrant());
         boolean deviceEnabled = kcClient.getAttributes() != null && Boolean.parseBoolean(kcClient.getAttributes().get(OAUTH2_DEVICE_AUTHORIZATION_GRANT_ENABLED));
         Assert.assertEquals("Expected device: " + expectedDeviceGrant + " did not match.", expectedDeviceGrant, deviceEnabled);
+        Assert.assertEquals("Expected Token Exchange: " + expectedTokenExchange + " did not match.", expectedTokenExchange, config.isStandardTokenExchangeEnabled());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java
index a23e60ad3d13..3777e8695bf5 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java
@@ -55,7 +55,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCJwksClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCJwksClientRegistrationTest.java
index c1545c7df71c..249ff8d88fca 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCJwksClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCJwksClientRegistrationTest.java
@@ -62,7 +62,8 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -301,7 +302,7 @@ public void createClientWithJWKSURI_rotateClientKeys() throws Exception {
     private void assertAuthenticateClientSuccess(Map<String, String> generatedKeys, OIDCClientRepresentation response, String kid) throws Exception {
         KeyPair keyPair = getKeyPairFromGeneratedPems(generatedKeys);
         String signedJwt = getClientSignedJWT(response.getClientId(), keyPair, kid);
-        OAuthClient.AccessTokenResponse accessTokenResponse = doClientCredentialsGrantRequest(signedJwt);
+        AccessTokenResponse accessTokenResponse = doClientCredentialsGrantRequest(signedJwt);
         Assert.assertEquals(200, accessTokenResponse.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken());
         Assert.assertEquals(response.getClientId(), accessToken.getIssuedFor());
@@ -310,7 +311,7 @@ private void assertAuthenticateClientSuccess(Map<String, String> generatedKeys,
     private void assertAuthenticateClientError(Map<String, String> generatedKeys, OIDCClientRepresentation response, String kid) throws Exception {
         KeyPair keyPair = getKeyPairFromGeneratedPems(generatedKeys);
         String signedJwt = getClientSignedJWT(response.getClientId(), keyPair, kid);
-        OAuthClient.AccessTokenResponse accessTokenResponse = doClientCredentialsGrantRequest(signedJwt);
+        AccessTokenResponse accessTokenResponse = doClientCredentialsGrantRequest(signedJwt);
         Assert.assertEquals(400, accessTokenResponse.getStatusCode());
         Assert.assertNull(accessTokenResponse.getAccessToken());
         Assert.assertNotNull(accessTokenResponse.getError());
@@ -344,15 +345,6 @@ public String createSignedRequestToken(String clientId, String realmInfoUrl) {
                             .rsa256(keyPair.getPrivate());
                 }
             }
-
-            @Override
-            protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
-                JsonWebToken jwt = super.createRequestToken(clientId, realmInfoUrl);
-                String tokenEndpointUrl = OIDCLoginProtocolService.tokenUrl(UriBuilder.fromUri(getAuthServerRoot())).build(REALM_NAME).toString();
-                jwt.audience(tokenEndpointUrl);
-                return jwt;
-            }
-
         };
         jwtProvider.setupKeyPair(keyPair);
         jwtProvider.setTokenTimeout(10);
@@ -361,26 +353,23 @@ protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl)
     }
 
 
-    private OAuthClient.AccessTokenResponse doClientCredentialsGrantRequest(String signedJwt) throws Exception {
+    private AccessTokenResponse doClientCredentialsGrantRequest(String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<NameValuePair>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
 
     private CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair> parameters) throws Exception {
-        CloseableHttpClient client = new DefaultHttpClient();
-        try {
+        try (CloseableHttpClient client = new DefaultHttpClient()) {
             HttpPost post = new HttpPost(requestUrl);
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
             return client.execute(post);
-        } finally {
-            oauth.closeClient(client);
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCPairwiseClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCPairwiseClientRegistrationTest.java
index 860b4d17483f..468cfe25d99c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCPairwiseClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCPairwiseClientRegistrationTest.java
@@ -45,7 +45,9 @@
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 import org.keycloak.testsuite.util.UserManager;
 
@@ -319,9 +321,9 @@ public void loginUserToPairwiseClient() throws Exception {
         OIDCClientRepresentation publicClient = create();
 
         // Login to public client
-        oauth.clientId(publicClient.getClientId());
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin("test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode(), publicClient.getClientSecret());
+        oauth.client(publicClient.getClientId(), publicClient.getClientSecret());
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin("test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode());
         AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken());
         Assert.assertEquals("test-user", accessToken.getPreferredUsername());
         Assert.assertEquals("test-user@localhost", accessToken.getEmail());
@@ -335,10 +337,10 @@ public void loginUserToPairwiseClient() throws Exception {
         OIDCClientRepresentation pairwiseClient = createPairwise();
         Assert.assertEquals("pairwise", pairwiseClient.getSubjectType());
         // Login to pairwise client
-        oauth.clientId(pairwiseClient.getClientId());
+        oauth.client(pairwiseClient.getClientId(), pairwiseClient.getClientSecret());
         oauth.openLoginForm();
-        loginResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
-        accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode(), pairwiseClient.getClientSecret());
+        loginResponse = oauth.parseLoginResponse();
+        accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode());
 
         // Assert token payloads don't contain more than one "sub"
         String accessTokenPayload = getPayload(accessTokenResponse.getAccessToken());
@@ -374,7 +376,7 @@ public void refreshPairwiseToken() throws Exception {
         // Create pairwise client
         OIDCClientRepresentation pairwiseClient = createPairwise();
         // Login to pairwise client
-        OAuthClient.AccessTokenResponse accessTokenResponse = login(pairwiseClient, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = login(pairwiseClient, "test-user@localhost", "password");
 
         // Verify tokens
         oauth.parseRefreshToken(accessTokenResponse.getAccessToken());
@@ -382,7 +384,7 @@ public void refreshPairwiseToken() throws Exception {
         oauth.parseRefreshToken(accessTokenResponse.getRefreshToken());
 
         // Refresh token
-        OAuthClient.AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), pairwiseClient.getClientSecret());
+        AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
 
         // Verify refreshed tokens
         oauth.verifyToken(refreshTokenResponse.getAccessToken());
@@ -414,12 +416,9 @@ public void introspectPairwiseAccessToken() throws Exception {
         OIDCClientRepresentation pairwiseClient = createPairwise();
 
         // Login to pairwise client
-        OAuthClient.AccessTokenResponse accessTokenResponse = login(pairwiseClient, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = login(pairwiseClient, "test-user@localhost", "password");
 
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(pairwiseClient.getClientId(), pairwiseClient.getClientSecret(), accessTokenResponse.getAccessToken());
-
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(introspectionResponse);
+        JsonNode jsonNode = oauth.client(pairwiseClient.getClientId(), pairwiseClient.getClientSecret()).doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asJsonNode();
         Assert.assertEquals(true, jsonNode.get("active").asBoolean());
         Assert.assertEquals("test-user@localhost", jsonNode.get("email").asText());
     }
@@ -432,17 +431,16 @@ public void refreshPairwiseTokenDeletedUser() throws Exception {
         OIDCClientRepresentation pairwiseClient = createPairwise();
 
         // Login to pairwise client
-        oauth.clientId(pairwiseClient.getClientId());
-        oauth.clientId(pairwiseClient.getClientId());
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin("delete-me@localhost", "password");
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode(), pairwiseClient.getClientSecret());
+        oauth.client(pairwiseClient.getClientId(), pairwiseClient.getClientSecret());
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin("delete-me@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode());
 
         assertEquals(200, accessTokenResponse.getStatusCode());
 
         // Delete user
         adminClient.realm(REALM_NAME).users().delete(userId);
 
-        OAuthClient.AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), pairwiseClient.getClientSecret());
+        AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
         assertEquals(400, refreshTokenResponse.getStatusCode());
         assertEquals("invalid_grant", refreshTokenResponse.getError());
         assertNull(refreshTokenResponse.getAccessToken());
@@ -458,16 +456,15 @@ public void refreshPairwiseTokenDisabledUser() throws Exception {
         OIDCClientRepresentation pairwiseClient = createPairwise();
 
         // Login to pairwise client
-        oauth.clientId(pairwiseClient.getClientId());
-        oauth.clientId(pairwiseClient.getClientId());
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin("disable-me@localhost", "password");
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode(), pairwiseClient.getClientSecret());
+        oauth.client(pairwiseClient.getClientId(), pairwiseClient.getClientSecret());
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin("disable-me@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(loginResponse.getCode());
         assertEquals(200, accessTokenResponse.getStatusCode());
 
         try {
             UserManager.realm(adminClient.realm(REALM_NAME)).username("disable-me@localhost").enabled(false);
 
-            OAuthClient.AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), pairwiseClient.getClientSecret());
+            AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
             assertEquals(400, refreshTokenResponse.getStatusCode());
             assertEquals("invalid_grant", refreshTokenResponse.getError());
             assertNull(refreshTokenResponse.getAccessToken());
@@ -478,10 +475,10 @@ public void refreshPairwiseTokenDisabledUser() throws Exception {
         }
     }
 
-    private OAuthClient.AccessTokenResponse login(OIDCClientRepresentation client, String username, String password) {
-        oauth.clientId(client.getClientId());
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(username, password);
-        return oauth.doAccessTokenRequest(loginResponse.getCode(), client.getClientSecret());
+    private AccessTokenResponse login(OIDCClientRepresentation client, String username, String password) {
+        oauth.client(client.getClientId(), client.getClientSecret());
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin(username, password);
+        return oauth.doAccessTokenRequest(loginResponse.getCode());
     }
 
     private String getPayload(String token) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/SAMLClientRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/SAMLClientRegistrationTest.java
index 0ae58d57ad1b..ce8230248d89 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/SAMLClientRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/SAMLClientRegistrationTest.java
@@ -86,7 +86,7 @@ public void testSAMLEndpointCreateWithOIDCClient() throws Exception {
 
         adminClient.realm(TEST).users().get(oidcClientServiceId).roles().clientLevel(realmManagementId).add(Arrays.asList(role));
 
-        String accessToken = oauth.clientId("oidc-client").doClientCredentialsGrantAccessTokenRequest("secret").getAccessToken();
+        String accessToken = oauth.client("oidc-client", "secret").doClientCredentialsGrantAccessTokenRequest().getAccessToken();
         reg.auth(Auth.token(accessToken));
 
         String entityDescriptor = IOUtils.toString(getClass().getResourceAsStream("/clientreg-test/saml-entity-descriptor.xml"), Charset.defaultCharset());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java
index 30ccfd62e800..22c518092543 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/AbstractClientPoliciesTest.java
@@ -22,6 +22,7 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createClientAccessTypeConditionConfig;
@@ -41,7 +42,6 @@
 import java.nio.charset.StandardCharsets;
 import java.security.KeyFactory;
 import java.security.KeyPair;
-import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.PrivateKey;
@@ -56,7 +56,6 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
 import java.util.function.Consumer;
@@ -103,13 +102,13 @@
 import org.keycloak.crypto.KeyType;
 import org.keycloak.crypto.SignatureSignerContext;
 import org.keycloak.events.Details;
-import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
 import org.keycloak.jose.jws.JWSBuilder;
 import org.keycloak.models.AdminRoles;
 import org.keycloak.models.Constants;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.representations.RefreshToken;
@@ -128,7 +127,6 @@
 import org.keycloak.representations.oidc.TokenMetadataRepresentation;
 import org.keycloak.services.Urls;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
-import org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory;
 import org.keycloak.services.clientpolicy.condition.ClientAccessTypeCondition;
 import org.keycloak.services.clientpolicy.condition.ClientAccessTypeConditionFactory;
 import org.keycloak.services.clientpolicy.condition.ClientRolesCondition;
@@ -164,7 +162,6 @@
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.pages.OAuth2DeviceVerificationPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject;
@@ -173,9 +170,15 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
+import org.keycloak.testsuite.util.ClientScopeBuilder;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.SignatureSignerUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.ServerURLs;
+import org.keycloak.testsuite.util.oauth.IntrospectionResponse;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 import org.keycloak.util.JsonSerialization;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -196,6 +199,7 @@ public abstract class AbstractClientPoliciesTest extends AbstractKeycloakTest {
     protected static final String POLICY_NAME = "MyPolicy";
     protected static final String PROFILE_NAME = "MyProfile";
     protected static final String SAMPLE_CLIENT_ROLE = "sample-client-role";
+    protected static final String SAMPLE_CLIENT_SCOPE = "sample-client-scope";
 
     protected static final String FAPI1_BASELINE_PROFILE_NAME = "fapi-1-baseline";
     protected static final String FAPI1_ADVANCED_PROFILE_NAME = "fapi-1-advanced";
@@ -226,9 +230,6 @@ public abstract class AbstractClientPoliciesTest extends AbstractKeycloakTest {
     protected static final String SECRET_ROTATION_PROFILE = "ClientSecretRotationProfile";
     protected static final String SECRET_ROTATION_POLICY = "ClientSecretRotationPolicy";
     
-    @Page
-    protected OAuth2DeviceVerificationPage verificationPage;
-
     @Page
     protected OAuthGrantPage grantPage;
 
@@ -241,9 +242,15 @@ public abstract class AbstractClientPoliciesTest extends AbstractKeycloakTest {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
+    private PkceGenerator pkceGenerator;
+
+    protected String request;
+    protected String requestUri;
+
     @Before
     public void before() throws Exception {
         setInitialAccessTokenForDynamicClientRegistration();
+        adminClient.realm(REALM_NAME).clientScopes().create(ClientScopeBuilder.create().name(SAMPLE_CLIENT_SCOPE).protocol(OIDCLoginProtocol.LOGIN_PROTOCOL).build());
     }
 
     protected void setInitialAccessTokenForDynamicClientRegistration() {
@@ -258,6 +265,9 @@ public void after() throws Exception {
         reg.close();
         revertToBuiltinProfiles();
         revertToBuiltinPolicies();
+        pkceGenerator = null;
+        request = null;
+        requestUri = null;
     }
 
     protected void setupValidProfilesAndPolicies() throws Exception {
@@ -265,15 +275,15 @@ protected void setupValidProfilesAndPolicies() throws Exception {
         ClientProfileRepresentation loadedProfileRep = (new ClientProfileBuilder()).createProfile("ordinal-test-profile", "The profile that can be loaded.")
                 .addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID,
                     createSecureClientAuthenticatorExecutorConfig(
-                        Arrays.asList(JWTClientAuthenticator.PROVIDER_ID),
-                        JWTClientAuthenticator.PROVIDER_ID))
+                            List.of(JWTClientAuthenticator.PROVIDER_ID),
+                            JWTClientAuthenticator.PROVIDER_ID))
                 .toRepresentation();
 
         ClientProfileRepresentation loadedProfileRepWithoutBuiltinField = (new ClientProfileBuilder()).createProfile("lack-of-builtin-field-test-profile", "Without builtin field that is treated as builtin=false.")
                 .addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID,
                     createSecureClientAuthenticatorExecutorConfig(
-                        Arrays.asList(JWTClientAuthenticator.PROVIDER_ID),
-                        JWTClientAuthenticator.PROVIDER_ID))
+                            List.of(JWTClientAuthenticator.PROVIDER_ID),
+                            JWTClientAuthenticator.PROVIDER_ID))
                 .addExecutor(HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID,
                     createHolderOfKeyEnforceExecutorConfig(Boolean.TRUE))
                 .addExecutor(SecureClientUrisExecutorFactory.PROVIDER_ID, null)
@@ -299,9 +309,9 @@ protected void setupValidProfilesAndPolicies() throws Exception {
                     .addCondition(ClientAccessTypeConditionFactory.PROVIDER_ID, 
                         createClientAccessTypeConditionConfig(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_PUBLIC, ClientAccessTypeConditionFactory.TYPE_BEARERONLY)))
                     .addCondition(ClientRolesConditionFactory.PROVIDER_ID, 
-                            createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                            createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                     .addCondition(ClientScopesConditionFactory.PROVIDER_ID, 
-                            createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                            createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, List.of(SAMPLE_CLIENT_SCOPE)))
                         .addProfile("ordinal-test-profile")
                         .addProfile("lack-of-builtin-field-test-profile")
 
@@ -313,13 +323,13 @@ protected void setupValidProfilesAndPolicies() throws Exception {
                         "Without builtin field that is treated as builtin=false.",
                         null)
                     .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                            createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                            createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                     .addCondition(ClientUpdaterSourceGroupsConditionFactory.PROVIDER_ID,
-                            createClientUpdateSourceGroupsConditionConfig(Arrays.asList("topGroup")))
+                            createClientUpdateSourceGroupsConditionConfig(List.of("topGroup")))
                     .addCondition(ClientUpdaterSourceHostsConditionFactory.PROVIDER_ID,
                             createClientUpdateSourceHostsConditionConfig(Arrays.asList("localhost", "127.0.0.1")))
                     .addCondition(ClientUpdaterSourceRolesConditionFactory.PROVIDER_ID,
-                            createClientUpdateSourceRolesConditionConfig(Arrays.asList(AdminRoles.CREATE_CLIENT)))
+                            createClientUpdateSourceRolesConditionConfig(List.of(AdminRoles.CREATE_CLIENT)))
                         .addProfile("lack-of-builtin-field-test-profile")
                     .toRepresentation();
 
@@ -354,8 +364,8 @@ protected void assertExpectedLoadedProfiles(Consumer<ClientProfilesRepresentatio
         modifiedAssertion.accept(actualProfilesRep);
 
         // each executor
-        assertExpectedExecutors(Arrays.asList(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID), actualProfileRep);
-        assertExpectedSecureClientAuthEnforceExecutor(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID), JWTClientAuthenticator.PROVIDER_ID, actualProfileRep);
+        assertExpectedExecutors(List.of(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID), actualProfileRep);
+        assertExpectedSecureClientAuthEnforceExecutor(List.of(JWTClientAuthenticator.PROVIDER_ID), JWTClientAuthenticator.PROVIDER_ID, actualProfileRep);
 
         // each profile - lack-of-builtin-field-test-profile
         actualProfileRep =  getProfileRepresentation(actualProfilesRep, "lack-of-builtin-field-test-profile", false);
@@ -371,7 +381,7 @@ protected void assertExpectedLoadedProfiles(Consumer<ClientProfilesRepresentatio
                 SecureSessionEnforceExecutorFactory.PROVIDER_ID,
                 SecureSigningAlgorithmExecutorFactory.PROVIDER_ID,
                 SecureSigningAlgorithmForSignedJwtExecutorFactory.PROVIDER_ID), actualProfileRep);
-        assertExpectedSecureClientAuthEnforceExecutor(Arrays.asList(JWTClientAuthenticator.PROVIDER_ID), JWTClientAuthenticator.PROVIDER_ID, actualProfileRep);
+        assertExpectedSecureClientAuthEnforceExecutor(List.of(JWTClientAuthenticator.PROVIDER_ID), JWTClientAuthenticator.PROVIDER_ID, actualProfileRep);
         assertExpectedHolderOfKeyEnforceExecutor(true, actualProfileRep);
         assertExpectedSecureRedirectUriEnforceExecutor(actualProfileRep);
         assertExpectedSecureRequestObjectExecutor(actualProfileRep);
@@ -396,19 +406,19 @@ protected void assertExpectedLoadedPolicies(Consumer<ClientPoliciesRepresentatio
         // each condition
         assertExpectedConditions(Arrays.asList(ClientAccessTypeConditionFactory.PROVIDER_ID, ClientRolesConditionFactory.PROVIDER_ID, ClientScopesConditionFactory.PROVIDER_ID), actualPolicyRep);
         assertExpectedClientAccessTypeCondition(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_PUBLIC, ClientAccessTypeConditionFactory.TYPE_BEARERONLY), actualPolicyRep);
-        assertExpectedClientRolesCondition(Arrays.asList(SAMPLE_CLIENT_ROLE), actualPolicyRep);
-        assertExpectedClientScopesCondition(ClientScopesConditionFactory.OPTIONAL, Arrays.asList(SAMPLE_CLIENT_ROLE), actualPolicyRep);
+        assertExpectedClientRolesCondition(List.of(SAMPLE_CLIENT_ROLE), actualPolicyRep);
+        assertExpectedClientScopesCondition(ClientScopesConditionFactory.OPTIONAL, List.of(SAMPLE_CLIENT_SCOPE), actualPolicyRep);
 
         // each policy - lack-of-builtin-field-test-policy
         actualPolicyRep = getPolicyRepresentation(actualPoliciesRep, "lack-of-builtin-field-test-policy");
-        assertExpectedPolicy("lack-of-builtin-field-test-policy", "Without builtin field that is treated as builtin=false.", false, Arrays.asList("lack-of-builtin-field-test-profile"), actualPolicyRep);
+        assertExpectedPolicy("lack-of-builtin-field-test-policy", "Without builtin field that is treated as builtin=false.", false, List.of("lack-of-builtin-field-test-profile"), actualPolicyRep);
 
         // each condition
         assertExpectedConditions(Arrays.asList(ClientUpdaterContextConditionFactory.PROVIDER_ID, ClientUpdaterSourceGroupsConditionFactory.PROVIDER_ID, ClientUpdaterSourceHostsConditionFactory.PROVIDER_ID, ClientUpdaterSourceRolesConditionFactory.PROVIDER_ID), actualPolicyRep);
-        assertExpectedClientUpdateContextCondition(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER), actualPolicyRep);
-        assertExpectedClientUpdateSourceGroupsCondition(Arrays.asList("topGroup"), actualPolicyRep);
+        assertExpectedClientUpdateContextCondition(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER), actualPolicyRep);
+        assertExpectedClientUpdateSourceGroupsCondition(List.of("topGroup"), actualPolicyRep);
         assertExpectedClientUpdateSourceHostsCondition(Arrays.asList("localhost", "127.0.0.1"), actualPolicyRep);
-        assertExpectedClientUpdateSourceRolesCondition(Arrays.asList(AdminRoles.CREATE_CLIENT), actualPolicyRep);
+        assertExpectedClientUpdateSourceRolesCondition(List.of(AdminRoles.CREATE_CLIENT), actualPolicyRep);
     }
 
 
@@ -461,29 +471,12 @@ private PublicKey decodePublicKey(byte[] der, String algorithm) throws NoSuchAlg
     }
 
     private String getKeyAlgorithmFromJwaAlgorithm(String jwaAlgorithm) {
-        String keyAlg = null;
-        switch (jwaAlgorithm) {
-            case Algorithm.RS256:
-            case Algorithm.RS384:
-            case Algorithm.RS512:
-            case Algorithm.PS256:
-            case Algorithm.PS384:
-            case Algorithm.PS512:
-                keyAlg = KeyType.RSA;
-                break;
-            case Algorithm.ES256:
-            case Algorithm.ES384:
-            case Algorithm.ES512:
-                keyAlg = KeyType.EC;
-                break;
-            case Algorithm.Ed25519:
-            case Algorithm.Ed448:
-                keyAlg = KeyType.OKP;
-                break;
-            default :
-                throw new RuntimeException("Unsupported signature algorithm");
-        }
-        return keyAlg;
+        return switch (jwaAlgorithm) {
+            case Algorithm.RS256, Algorithm.RS384, Algorithm.RS512, Algorithm.PS256, Algorithm.PS384, Algorithm.PS512 -> KeyType.RSA;
+            case Algorithm.ES256, Algorithm.ES384, Algorithm.ES512 -> KeyType.EC;
+            case Algorithm.Ed25519, Algorithm.Ed448 -> KeyType.OKP;
+            default -> throw new RuntimeException("Unsupported signature algorithm");
+        };
     }
 
    // Signed JWT for client authentication utility
@@ -491,7 +484,7 @@ private String getKeyAlgorithmFromJwaAlgorithm(String jwaAlgorithm) {
     protected String createSignedRequestToken(String clientId, PrivateKey privateKey, PublicKey publicKey, String algorithm) {
         JsonWebToken jwt = createRequestToken(clientId, getRealmInfoUrl());
         String kid = KeyUtils.createKeyId(publicKey);
-        SignatureSignerContext signer = oauth.createSigner(privateKey, kid, algorithm);
+        SignatureSignerContext signer = SignatureSignerUtil.createSigner(privateKey, kid, algorithm);
         return new JWSBuilder().kid(kid).jsonContent(jwt).sign(signer);
     }
 
@@ -508,16 +501,16 @@ private JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
         reqToken.audience(realmInfoUrl);
 
         int now = Time.currentTime();
-        reqToken.iat(Long.valueOf(now));
-        reqToken.exp(Long.valueOf(now + 10));
-        reqToken.nbf(Long.valueOf(now));
+        reqToken.iat((long) now);
+        reqToken.exp((long) (now + 10));
+        reqToken.nbf((long) now);
 
         return reqToken;
     }
 
     // OAuth2 protocol operation with signed JWT for client authentication
 
-    protected OAuthClient.AccessTokenResponse doAccessTokenRequestWithSignedJWT(String code, String signedJwt) throws Exception {
+    protected AccessTokenResponse doAccessTokenRequestWithSignedJWT(String code, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
@@ -525,19 +518,19 @@ protected OAuthClient.AccessTokenResponse doAccessTokenRequestWithSignedJWT(Stri
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getAccessTokenUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
-    protected OAuthClient.AccessTokenResponse doRefreshTokenRequestWithSignedJWT(String refreshToken, String signedJwt) throws Exception {
+    protected AccessTokenResponse doRefreshTokenRequestWithSignedJWT(String refreshToken, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));
         parameters.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, refreshToken));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getRefreshTokenUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
     protected HttpResponse doTokenIntrospectionWithSignedJWT(String tokenType, String tokenToIntrospect, String signedJwt) throws Exception {
@@ -547,7 +540,7 @@ protected HttpResponse doTokenIntrospectionWithSignedJWT(String tokenType, Strin
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        return sendRequest(oauth.getTokenIntrospectionUrl(), parameters);
+        return sendRequest(oauth.getEndpoints().getIntrospection(), parameters);
     }
 
     protected HttpResponse doTokenRevokeWithSignedJWT(String tokenType, String tokenToIntrospect, String signedJwt) throws Exception {
@@ -557,7 +550,7 @@ protected HttpResponse doTokenRevokeWithSignedJWT(String tokenType, String token
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        return sendRequest(oauth.getTokenRevocationUrl(), parameters);
+        return sendRequest(oauth.getEndpoints().getRevocation(), parameters);
     }
 
     protected HttpResponse doLogoutWithSignedJWT(String refreshToken, String signedJwt) throws Exception {
@@ -567,18 +560,15 @@ protected HttpResponse doLogoutWithSignedJWT(String refreshToken, String signedJ
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        return sendRequest(oauth.getLogoutUrl().build(), parameters);
+        return sendRequest(oauth.getEndpoints().getLogout(), parameters);
     }
 
     private CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair> parameters) throws Exception {
-        CloseableHttpClient client = new DefaultHttpClient();
-        try {
+        try (CloseableHttpClient client = new DefaultHttpClient()) {
             HttpPost post = new HttpPost(requestUrl);
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
             return client.execute(post);
-        } finally {
-            oauth.closeClient(client);
         }
     }
 
@@ -587,29 +577,27 @@ private CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair>
     protected AuthorizationEndpointRequestObject createValidRequestObjectForSecureRequestObjectExecutor(String clientId) throws URISyntaxException {
         AuthorizationEndpointRequestObject requestObject = new AuthorizationEndpointRequestObject();
         requestObject.id(KeycloakModelUtils.generateId());
-        requestObject.iat(Long.valueOf(Time.currentTime()));
-        requestObject.exp(requestObject.getIat() + Long.valueOf(300));
+        requestObject.iat((long) Time.currentTime());
+        requestObject.exp(requestObject.getIat() + 300L);
         requestObject.nbf(requestObject.getIat());
         requestObject.setClientId(clientId);
         requestObject.setResponseType("code");
         requestObject.setRedirectUriParam(oauth.getRedirectUri());
         requestObject.setScope("openid");
         String state = KeycloakModelUtils.generateId();
-        oauth.stateParamHardcoded(state);
         requestObject.setState(state);
-        requestObject.setMax_age(Integer.valueOf(600));
+        requestObject.setMax_age(600);
         requestObject.setOtherClaims("custom_claim_ein", "rot");
         requestObject.audience(Urls.realmIssuer(new URI(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth"), REALM_NAME), "https://example.com");
         requestObject.setNonce(KeycloakModelUtils.generateId());
         return requestObject;
     }
 
-    protected void registerRequestObject(AuthorizationEndpointRequestObject requestObject, String clientId, String sigAlg, boolean isUseRequestUri) throws URISyntaxException, IOException {
-        TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
-
+    protected void registerRequestObject(AuthorizationEndpointRequestObject requestObject, String clientId, String sigAlg, boolean isUseRequestUri) throws IOException {
         // Set required signature for request_uri
         // use and set jwks_url
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
+        assert clientResource != null;
         ClientRepresentation clientRep = clientResource.toRepresentation();
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestObjectSignatureAlg(sigAlg);
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
@@ -617,7 +605,7 @@ protected void registerRequestObject(AuthorizationEndpointRequestObject requestO
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(jwksUrl);
         clientResource.update(clientRep);
 
-        oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
+        TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
 
         // generate and register client keypair
         oidcClientEndpointsResource.generateKeys(sigAlg);
@@ -628,45 +616,31 @@ protected void registerRequestObject(AuthorizationEndpointRequestObject requestO
         oidcClientEndpointsResource.registerOIDCRequest(encodedRequestObject, sigAlg);
 
         if (isUseRequestUri) {
-            oauth.request(null);
-            oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
+            requestUri = TestApplicationResourceUrls.clientRequestUri();
+            request = null;
         } else {
-            oauth.requestUri(null);
-            oauth.request(oidcClientEndpointsResource.getOIDCRequest());
+            request = oidcClientEndpointsResource.getOIDCRequest();
+            requestUri = null;
         }
     }
 
-    // PKCE utility
-
-    protected String generateS256CodeChallenge(String codeVerifier) throws Exception {
-        MessageDigest md = MessageDigest.getInstance("SHA-256");
-        md.update(codeVerifier.getBytes("ISO_8859_1"));
-        byte[] digestBytes = md.digest();
-        String codeChallenge = Base64Url.encode(digestBytes);
-        return codeChallenge;
-    }
-
     // OAuth2 protocol operation
 
-    protected void doIntrospectAccessToken(OAuthClient.AccessTokenResponse tokenRes, String username, String clientId, String sessionId, String clientSecret) throws IOException {
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential(clientId, clientSecret, tokenRes.getAccessToken());
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
-        assertEquals(true, jsonNode.get("active").asBoolean());
-        assertEquals(username, jsonNode.get("username").asText());
-        assertEquals(clientId, jsonNode.get("client_id").asText());
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
-        assertEquals(true, rep.isActive());
+    protected void doIntrospectAccessToken(AccessTokenResponse tokenRes, String username, String clientId, String sessionId, String clientSecret) throws IOException {
+        TokenMetadataRepresentation rep = oauth.client(clientId, clientSecret).doIntrospectionAccessTokenRequest(tokenRes.getAccessToken()).asTokenMetadata();
+        assertTrue(rep.isActive());
         assertEquals(clientId, rep.getClientId());
         assertEquals(clientId, rep.getIssuedFor());
-        events.expect(EventType.INTROSPECT_TOKEN).client(clientId).session(sessionId).user((String)null).clearDetails().assertEvent();
+        assertEquals(username, rep.getUserName());
+        events.expect(EventType.INTROSPECT_TOKEN).client(clientId).session(sessionId).user(AssertEvents.isUUID()).clearDetails().assertEvent();
     }
 
-    protected void doTokenRevoke(String refreshToken, String clientId, String clientSecret, String userId, String sessionId, boolean isOfflineAccess) throws IOException {
-        oauth.clientId(clientId);
-        oauth.doTokenRevoke(refreshToken, "refresh_token", clientSecret);
+    protected void doTokenRevoke(String refreshToken, String clientId, String clientSecret, String userId, String sessionId, boolean isOfflineAccess) {
+        oauth.client(clientId, clientSecret);
+        oauth.tokenRevocationRequest(refreshToken).refreshToken().send();
 
         // confirm revocation
-        OAuthClient.AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken, clientSecret);
+        AccessTokenResponse tokenRes = oauth.doRefreshTokenRequest(refreshToken);
         assertEquals(400, tokenRes.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, tokenRes.getError());
         if (isOfflineAccess) assertEquals("Offline user session not found", tokenRes.getErrorDescription());
@@ -721,10 +695,6 @@ protected ClientRepresentation getClientByAdmin(String cId) throws ClientPolicyE
         return null;
     }
 
-    protected ClientRepresentation getClientByAdminWithName(String clientName) {
-        return adminClient.realm(REALM_NAME).clients().findByClientId(clientName).get(0);
-    }
-
     protected void updateClientByAdmin(String cId, Consumer<ClientRepresentation> op) throws ClientPolicyException {
         ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get(cId);
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -779,13 +749,9 @@ protected void authManageClients() {
         reg.auth(Auth.token(getToken("manage-clients", "password")));
     }
 
-    protected void authNoAccess() {
-        reg.auth(Auth.token(getToken("no-access", "password")));
-    }
-
     private String getToken(String username, String password) {
         try {
-            return oauth.doGrantAccessTokenRequest(REALM_NAME, username, password, null, Constants.ADMIN_CLI_CLIENT_ID, null).getAccessToken();
+            return oauth.client(Constants.ADMIN_CLI_CLIENT_ID).doPasswordGrantRequest(username, password).getAccessToken();
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
@@ -818,10 +784,6 @@ protected void updateClientDynamically(String clientId, Consumer<OIDCClientRepre
         reg.auth(Auth.token(response));
     }
 
-    protected void deleteClientDynamically(String clientId) throws ClientRegistrationException {
-        reg.oidc().delete(clientId);
-    }
-
     // Profiles Operation
 
     protected String convertToProfilesJson(ClientProfilesRepresentation reps) {
@@ -862,49 +824,11 @@ protected ClientProfilesRepresentation getProfilesWithoutGlobals() {
         return adminClient.realm(REALM_NAME).clientPoliciesProfilesResource().getProfiles(false);
     }
 
-    protected String convertToProfileJson(ClientProfileRepresentation rep) {
-        String json = null;
-        try {
-            json = objectMapper.writeValueAsString(rep);
-        } catch (JsonProcessingException e) {
-            fail();
-        }
-        return json;
-    }
-
-    protected ClientProfileRepresentation convertToProfile(String json) {
-        ClientProfileRepresentation rep = null;
-        try {
-            rep = JsonSerialization.readValue(json, ClientProfileRepresentation.class);
-        } catch (IOException e) {
-            fail();
-        }
-        return rep;
-    }
-
-    protected ClientProfileRepresentation getProfile(String name) {
-        if (name == null) return null;
-
-        ClientProfilesRepresentation reps = getProfilesWithGlobals();
-        if (reps == null || reps.getProfiles() == null) return null;
-
-        if (reps.getProfiles().stream().anyMatch(i->name.equals(i.getName()))) {
-            return reps.getProfiles().stream().filter(i->name.equals(i.getName())).collect(Collectors.toList()).get(0);
-        } else {
-            return null;
-        }
-    }
-
-    protected String getProfileJson(String name) {
-        return convertToProfileJson(getProfile(name));
-    }
-
     protected void addProfile(ClientProfileRepresentation profileRep) throws ClientPolicyException {
         ClientProfilesRepresentation reps = getProfilesWithoutGlobals();
         if (reps == null || reps.getProfiles() == null) return;
         reps.getProfiles().add(profileRep);
         updateProfiles(convertToProfilesJson(reps));
-        return;
     }
 
     protected void updateProfile(ClientProfileRepresentation profileRep) throws ClientPolicyException {
@@ -914,26 +838,10 @@ protected void updateProfile(ClientProfileRepresentation profileRep) throws Clie
         ClientProfilesRepresentation reps = getProfilesWithoutGlobals();
 
         if (reps.getProfiles().stream().anyMatch(i->profileName.equals(i.getName()))) {
-            ClientProfileRepresentation rep = reps.getProfiles().stream().filter(i->profileName.equals(i.getName())).collect(Collectors.toList()).get(0);
+            ClientProfileRepresentation rep = reps.getProfiles().stream().filter(i->profileName.equals(i.getName())).toList().get(0);
             reps.getProfiles().remove(rep);
             reps.getProfiles().add(profileRep);
             updateProfiles(convertToProfilesJson(reps));
-        } else {
-            return;
-        }
-    }
-
-    protected void deleteProfile(String profileName) throws ClientPolicyException {
-        if (profileName == null) return;
-
-        ClientProfilesRepresentation reps = getProfilesWithoutGlobals();
-
-        if (reps.getProfiles().stream().anyMatch(i->profileName.equals(i.getName()))) {
-            ClientProfileRepresentation rep = reps.getProfiles().stream().filter(i->profileName.equals(i.getName())).collect(Collectors.toList()).get(0);
-            reps.getProfiles().remove(rep);
-            updateProfiles(convertToProfilesJson(reps));
-        } else {
-            return;
         }
     }
 
@@ -969,49 +877,11 @@ protected ClientPoliciesRepresentation getPolicies() {
         return adminClient.realm(REALM_NAME).clientPoliciesPoliciesResource().getPolicies();
     }
 
-    protected String convertToPolicyJson(ClientPolicyRepresentation rep) {
-        String json = null;
-        try {
-            json = objectMapper.writeValueAsString(rep);
-        } catch (JsonProcessingException e) {
-            fail();
-        }
-        return json;
-    }
-
-    protected ClientPolicyRepresentation convertToPolicy(String json) {
-    	ClientPolicyRepresentation rep = null;
-        try {
-            rep = JsonSerialization.readValue(json, ClientPolicyRepresentation.class);
-        } catch (IOException e) {
-            fail();
-        }
-        return rep;
-    }
-
-    protected ClientPolicyRepresentation getPolicy(String name) {
-        if (name == null) return null;
-
-        ClientPoliciesRepresentation reps = getPolicies();
-        if (reps == null || reps.getPolicies() == null) return null;
-
-        if (reps.getPolicies().stream().anyMatch(i->name.equals(i.getName()))) {
-            return reps.getPolicies().stream().filter(i->name.equals(i.getName())).collect(Collectors.toList()).get(0);
-        } else {
-            return null;
-        }
-    }
-
-    protected String getPolicyJson(String name) {
-        return convertToPolicyJson(getPolicy(name));
-    }
-
     protected void addPolicy(ClientPolicyRepresentation policyRep) throws ClientPolicyException {
         ClientPoliciesRepresentation reps = getPolicies();
         if (reps == null || reps.getPolicies() == null) return;
         reps.getPolicies().add(policyRep);
         updatePolicies(convertToPoliciesJson(reps));
-        return;
     }
 
     protected void updatePolicy(ClientPolicyRepresentation policyRep) throws ClientPolicyException {
@@ -1021,12 +891,10 @@ protected void updatePolicy(ClientPolicyRepresentation policyRep) throws ClientP
         ClientPoliciesRepresentation reps = getPolicies();
 
         if (reps.getPolicies().stream().anyMatch(i->policyName.equals(i.getName()))) {
-            ClientPolicyRepresentation rep = reps.getPolicies().stream().filter(i->policyName.equals(i.getName())).collect(Collectors.toList()).get(0);
+            ClientPolicyRepresentation rep = reps.getPolicies().stream().filter(i->policyName.equals(i.getName())).toList().get(0);
             reps.getPolicies().remove(rep);
             reps.getPolicies().add(policyRep);
             updatePolicies(convertToPoliciesJson(reps));
-        } else {
-            return;
         }
     }
 
@@ -1036,32 +904,24 @@ protected void deletePolicy(String policyName) throws ClientPolicyException {
         ClientPoliciesRepresentation reps = getPolicies();
 
         if (reps.getPolicies().stream().anyMatch(i->policyName.equals(i.getName()))) {
-            ClientPolicyRepresentation rep = reps.getPolicies().stream().filter(i->policyName.equals(i.getName())).collect(Collectors.toList()).get(0);
+            ClientPolicyRepresentation rep = reps.getPolicies().stream().filter(i->policyName.equals(i.getName())).toList().get(0);
             reps.getPolicies().remove(rep);
             updatePolicies(convertToPoliciesJson(reps));
-        } else {
-            return;
         }
     }
 
     // Assertions about profiles
 
-    // profiles
-
-    protected ClientProfilesRepresentation getProfilesRepresentation(String json) {
-        return getCompoundsRepresentation(json, ClientProfilesRepresentation.class);
-    }
-
     // profile
 
     protected ClientProfileRepresentation getProfileRepresentation(ClientProfilesRepresentation profilesRep, String name, boolean global) {
         Function<ClientProfilesRepresentation, List<ClientProfileRepresentation>> profilesListGetter = global ? ClientProfilesRepresentation::getGlobalProfiles : ClientProfilesRepresentation::getProfiles;
-        return getCompoundRepresentation(profilesRep, name, profilesListGetter, (ClientProfileRepresentation i)->i.getName());
+        return getCompoundRepresentation(profilesRep, name, profilesListGetter, ClientProfileRepresentation::getName);
     }
 
     protected void assertExpectedProfiles(ClientProfilesRepresentation profilesRep, List<String> expectedGlobalProfiles, List<String> expectedRealmProfiles) {
-        assertExpectedCompounds(expectedGlobalProfiles, profilesRep, (ClientProfilesRepresentation i)->i.getGlobalProfiles(), (ClientProfileRepresentation i)->i.getName());
-        assertExpectedCompounds(expectedRealmProfiles, profilesRep, (ClientProfilesRepresentation i)->i.getProfiles(), (ClientProfileRepresentation i)->i.getName());
+        assertExpectedCompounds(expectedGlobalProfiles, profilesRep, ClientProfilesRepresentation::getGlobalProfiles, ClientProfileRepresentation::getName);
+        assertExpectedCompounds(expectedRealmProfiles, profilesRep, ClientProfilesRepresentation::getProfiles, ClientProfileRepresentation::getName);
     }
 
     protected void assertExpectedProfile(ClientProfileRepresentation actualProfileRep, String name, String description) {
@@ -1082,10 +942,6 @@ protected void assertExpectedHolderOfKeyEnforceExecutor(boolean autoConfigure, C
         assertExpectedAutoConfiguredExecutor(autoConfigure, HolderOfKeyEnforcerExecutorFactory.PROVIDER_ID, profileRep);
     }
 
-    protected void assertExpectedPKCEEnforceExecutor(boolean autoConfigure, ClientProfileRepresentation profileRep) {
-        assertExpectedAutoConfiguredExecutor(autoConfigure, PKCEEnforcerExecutorFactory.PROVIDER_ID, profileRep);
-    }
-
     protected void assertExpectedSecureClientAuthEnforceExecutor(List<String> expectedAllowedClientAuthenticators, String expectedAutoConfiguredClientAuthenticator, ClientProfileRepresentation profileRep) throws Exception {
         assertNotNull(profileRep);
         JsonNode actualExecutorConfig = getConfigOfExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID, profileRep);
@@ -1125,7 +981,7 @@ protected void assertExpectedAutoConfiguredExecutor(boolean expectedAutoConfigur
         assertNotNull(profileRep);
         JsonNode actualExecutorConfig = getConfigOfExecutor(providerId, profileRep);
         assertNotNull(actualExecutorConfig);
-        boolean actualAutoConfigure = actualExecutorConfig.get("auto-configure") == null ? false : actualExecutorConfig.get("auto-configure").asBoolean();
+        boolean actualAutoConfigure = actualExecutorConfig.get("auto-configure") != null && actualExecutorConfig.get("auto-configure").asBoolean();
         assertEquals(expectedAutoConfigure, actualAutoConfigure);
     }
 
@@ -1138,16 +994,10 @@ private JsonNode getConfigOfExecutor(String providerId, ClientProfileRepresentat
 
     // Assertions about policies
 
-    // policies
-
-    protected ClientPoliciesRepresentation getPoliciesRepresentation(String json) {
-        return getCompoundsRepresentation(json, ClientPoliciesRepresentation.class);
-    }
-
     // policy
 
     protected ClientPolicyRepresentation getPolicyRepresentation(ClientPoliciesRepresentation policiesRep, String name) {
-        return getCompoundRepresentation(policiesRep, name, (ClientPoliciesRepresentation i)->i.getPolicies(), (ClientPolicyRepresentation i)->i.getName());
+        return getCompoundRepresentation(policiesRep, name, ClientPoliciesRepresentation::getPolicies, ClientPolicyRepresentation::getName);
     }
 
     protected void assertExpectedPolicies(List<String> expectedPolicies, ClientPoliciesRepresentation policiesRep) {
@@ -1157,7 +1007,7 @@ protected void assertExpectedPolicies(List<String> expectedPolicies, ClientPolic
             assertNull(expectedPolicies);
             return;
         }
-        Set<String> actualPolicies = reps.stream().map(i->i.getName()).collect(Collectors.toSet());
+        Set<String> actualPolicies = reps.stream().map(ClientPolicyRepresentation::getName).collect(Collectors.toSet());
         assertEquals(new HashSet<>(expectedPolicies), actualPolicies);
     }
 
@@ -1177,11 +1027,6 @@ protected void assertExpectedConditions(List<String> expectedConditions, ClientP
         assertThat(actualConditionNames, Matchers.containsInAnyOrder(expectedConditions.toArray()));
     }
 
-    protected void assertExpectedAnyClientCondition(ClientPolicyRepresentation policyRep) {
-        ClientPolicyConditionConfigurationRepresentation config = getConfigAsExpectedType(policyRep, AnyClientConditionFactory.PROVIDER_ID, ClientPolicyConditionConfigurationRepresentation.class);
-        Assert.assertTrue("Expected empty configuration for provider " + AnyClientConditionFactory.PROVIDER_ID, config.getConfigAsMap().isEmpty());
-    }
-
     protected void assertExpectedClientAccessTypeCondition(List<String> type, ClientPolicyRepresentation policyRep) {
         ClientAccessTypeCondition.Configuration cfg = getConfigAsExpectedType(policyRep, ClientAccessTypeConditionFactory.PROVIDER_ID, ClientAccessTypeCondition.Configuration.class);
         Assert.assertEquals(cfg.getType(), type);
@@ -1228,16 +1073,6 @@ private <CFG extends ClientPolicyConditionConfigurationRepresentation> CFG getCo
 
     // profiles/policies common (compounds)
 
-    private <T> T getCompoundsRepresentation(String json, Class<T> clazz) {
-        T rep = null;
-        try {
-            rep = JsonSerialization.readValue(json, clazz);
-        } catch (IOException ioe) {
-            fail();
-        }
-        return rep;
-    }
-
     private <T, R> void assertExpectedCompounds(List<String> expected, R rep, Function<R, List<T>> f, Function<T, String> g) {
         assertNotNull(rep);
         List<T> reps = f.apply(rep);
@@ -1245,7 +1080,7 @@ private <T, R> void assertExpectedCompounds(List<String> expected, R rep, Functi
             assertNull(expected);
             return;
         }
-        Set<String> actual = reps.stream().map(i->g.apply(i)).collect(Collectors.toSet());
+        Set<String> actual = reps.stream().map(g).collect(Collectors.toSet());
         assertEquals(new HashSet<>(expected), actual);
     }
 
@@ -1254,14 +1089,14 @@ private <T, R> void assertExpectedCompounds(List<String> expected, R rep, Functi
     private <T, R> T getCompoundRepresentation(R rep, String name, Function<R, List<T>> f, Function<T, String> g) {
         assertNotNull(rep);
         if (f.apply(rep) == null) return null;
-        List<T> reps = f.apply(rep).stream().filter(i->g.apply(i).equals(name)).collect(Collectors.toList());
-        if (reps == null) return null;
+        List<T> reps = f.apply(rep).stream().filter(i->g.apply(i).equals(name)).toList();
         if (reps.size() != 1) return null;
         return reps.get(0);
     }
 
     private void assertExpectedEmptyConfig(String executorProviderId, ClientProfileRepresentation profileRep) {
         JsonNode config = getConfigOfExecutor(executorProviderId, profileRep);
+        assert config != null;
         Assert.assertTrue("Expected empty configuration for provider " + executorProviderId, config.isEmpty());
     }
 
@@ -1272,6 +1107,7 @@ protected String signRequestObject(AuthorizationEndpointRequestObject requestObj
 
         // use and set jwks_url
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
+        assert clientResource != null;
         ClientRepresentation clientRep = clientResource.toRepresentation();
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseJwksUrl(true);
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setJwksUrl(TestApplicationResourceUrls.clientJwksUri());
@@ -1280,14 +1116,7 @@ protected String signRequestObject(AuthorizationEndpointRequestObject requestObj
         client.registerOIDCRequest(encodedRequestObject, Algorithm.PS256);
 
         // do not send any other parameter but the request request parameter
-        String oidcRequest = client.getOIDCRequest();
-        return oidcRequest;
-    }
-
-    protected List<String> getAttributeMultivalued(ClientRepresentation clientRep, String attrKey) {
-        String attrValue = Optional.ofNullable(clientRep.getAttributes()).orElse(Collections.emptyMap()).get(attrKey);
-        if (attrValue == null) return Collections.emptyList();
-        return Arrays.asList(Constants.CFG_DELIMITER_PATTERN.split(attrValue));
+        return client.getOIDCRequest();
     }
 
     protected void setAttributeMultivalued(ClientRepresentation clientRep, String attrKey, List<String> attrValues) {
@@ -1301,120 +1130,150 @@ protected void openVerificationPage(String verificationUri) {
 
     protected void checkMtlsFlow() throws IOException {
         // Check login.
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         Assert.assertNull(loginResponse.getError());
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         // Check token obtaining.
-        OAuthClient.AccessTokenResponse accessTokenResponse;
+        AccessTokenResponse accessTokenResponse;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            accessTokenResponse = oauth.doAccessTokenRequest(code, TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            accessTokenResponse = oauth.doAccessTokenRequest(code);
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         assertEquals(200, accessTokenResponse.getStatusCode());
 
         // Check token refresh.
-        OAuthClient.AccessTokenResponse accessTokenResponseRefreshed;
+        AccessTokenResponse accessTokenResponseRefreshed;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         assertEquals(200, accessTokenResponseRefreshed.getStatusCode());
 
         // Check token introspection.
-        String tokenResponse;
+        IntrospectionResponse tokenResponse;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.introspectTokenWithClientCredential(TEST_CLIENT, TEST_CLIENT_SECRET, "access_token", accessTokenResponse.getAccessToken(), client);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET).httpClient().set(client);
+            tokenResponse = oauth.doIntrospectionRequest(accessTokenResponse.getAccessToken(), "access_token");
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         Assert.assertNotNull(tokenResponse);
-        TokenMetadataRepresentation tokenMetadataRepresentation = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        TokenMetadataRepresentation tokenMetadataRepresentation = tokenResponse.asTokenMetadata();
         Assert.assertTrue(tokenMetadataRepresentation.isActive());
 
         // Check token revoke.
-        CloseableHttpResponse tokenRevokeResponse;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenRevokeResponse = oauth.doTokenRevoke(accessTokenResponse.getRefreshToken(), "refresh_token", TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            assertTrue(oauth.tokenRevocationRequest(accessTokenResponse.getRefreshToken()).refreshToken().send().isSuccess());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
-        assertEquals(200, tokenRevokeResponse.getStatusLine().getStatusCode());
 
         // Check logout.
-        CloseableHttpResponse logoutResponse;
+        LogoutResponse logoutResponse;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        assertTrue(logoutResponse.isSuccess());
 
         // Check login.
         loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         Assert.assertNull(loginResponse.getError());
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        code = oauth.parseLoginResponse().getCode();
 
         // Check token obtaining without certificate
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            accessTokenResponse = oauth.doAccessTokenRequest(code, TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            accessTokenResponse = oauth.doAccessTokenRequest(code);
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         assertEquals(400, accessTokenResponse.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, accessTokenResponse.getError());
 
         // Check frontchannel logout and login.
-        driver.navigate().to(oauth.getLogoutUrl().build());
+        oauth.openLogoutForm();
         logoutConfirmPage.assertCurrent();
         logoutConfirmPage.confirmLogout();
         loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         Assert.assertNull(loginResponse.getError());
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        code = oauth.parseLoginResponse().getCode();
 
         // Check token obtaining.
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            accessTokenResponse = oauth.doAccessTokenRequest(code, TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            accessTokenResponse = oauth.doAccessTokenRequest(code);
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         assertEquals(200, accessTokenResponse.getStatusCode());
 
         // Check token refresh with other certificate
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithOtherKeyStoreAndTrustStore()) {
-            accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         assertEquals(400, accessTokenResponseRefreshed.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, accessTokenResponseRefreshed.getError());
 
         // Check token revoke with other certificate
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithOtherKeyStoreAndTrustStore()) {
-            tokenRevokeResponse = oauth.doTokenRevoke(accessTokenResponse.getRefreshToken(), "refresh_token", TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            assertEquals(401, oauth.tokenRevocationRequest(accessTokenResponse.getRefreshToken()).refreshToken().send().getStatusCode());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
-        assertEquals(401, tokenRevokeResponse.getStatusLine().getStatusCode());
 
         // Check logout without certificate
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
-        assertEquals(401, logoutResponse.getStatusLine().getStatusCode());
+        assertEquals(401, logoutResponse.getStatusCode());
 
         // Check logout.
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            logoutResponse = oauth.doLogout(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+            oauth.httpClient().set(client);
+            oauth.doLogout(accessTokenResponse.getRefreshToken());
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
     }
 
@@ -1435,7 +1294,7 @@ protected void setupPolicyClientIdAndSecretNotAcceptableAuthType(String policyNa
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(policyName, "Primum Consilium", Boolean.TRUE)
                         .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                                createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                                createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                         .addProfile(profileName)
                         .toRepresentation()
         ).toString();
@@ -1461,9 +1320,9 @@ protected void setupPolicyAuthzCodeFlowUnderMultiPhasePolicy(String policyName)
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(policyName, "Prima Politica", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                                createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_INITIAL_ACCESS_TOKEN)))
+                                createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_INITIAL_ACCESS_TOKEN)))
                         .addProfile(profileName)
                         .toRepresentation()
         ).toString();
@@ -1471,20 +1330,28 @@ protected void setupPolicyAuthzCodeFlowUnderMultiPhasePolicy(String policyName)
     }
 
     protected void successfulLoginAndLogout(String clientId, String clientSecret) {
-        OAuthClient.AccessTokenResponse res = successfulLogin(clientId, clientSecret);
-        oauth.doLogout(res.getRefreshToken(), clientSecret);
+        successfulLoginAndLogout(clientId, clientSecret, null, null);
+    }
+
+    protected void successfulLoginAndLogout(String clientId, String clientSecret, String nonce, String state) {
+        AccessTokenResponse res = successfulLogin(clientId, clientSecret, nonce, state);
+        oauth.doLogout(res.getRefreshToken());
         events.expectLogout(res.getSessionState()).client(clientId).clearDetails().assertEvent();
     }
 
-    protected OAuthClient.AccessTokenResponse successfulLogin(String clientId, String clientSecret) {
-        oauth.clientId(clientId);
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+    protected AccessTokenResponse successfulLogin(String clientId, String clientSecret) {
+        return successfulLogin(clientId, clientSecret, null, null);
+    }
+
+    protected AccessTokenResponse successfulLogin(String clientId, String clientSecret, String nonce, String state) {
+        oauth.client(clientId, clientSecret);
+        oauth.loginForm().nonce(nonce).state(state).request(request).requestUri(requestUri).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
@@ -1492,22 +1359,18 @@ protected OAuthClient.AccessTokenResponse successfulLogin(String clientId, Strin
     }
 
     protected void successfulLoginAndLogoutWithPKCE(String clientId, String clientSecret, String userName, String userPassword) throws Exception {
-        oauth.clientId(clientId);
-        String codeVerifier = "1a345A7890123456r8901c3456789012b45K7890l23"; // 43
-        String codeChallenge = generateS256CodeChallenge(codeVerifier);
-        oauth.codeChallenge(codeChallenge);
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.nonce("bjapewiziIE083d");
+        oauth.client(clientId, clientSecret);
 
-        oauth.doLogin(userName, userPassword);
+        pkceGenerator = PkceGenerator.s256();
+
+        oauth.loginForm().nonce("bjapewiziIE083d").codeChallenge(pkceGenerator).doLogin(userName, userPassword);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.accessTokenRequest(code).codeVerifier(pkceGenerator).send();
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
@@ -1516,22 +1379,22 @@ protected void successfulLoginAndLogoutWithPKCE(String clientId, String clientSe
         assertEquals(userId, token.getSubject());
         // The following check is not valid anymore since file store does have the same ID, and is redundant due to the previous line
         // Assert.assertNotEquals(userName, token.getSubject());
-        assertEquals(sessionId, token.getSessionState());
+        assertEquals(sessionId, token.getSessionId());
         assertEquals(clientId, token.getIssuedFor());
 
         String refreshTokenString = res.getRefreshToken();
         RefreshToken refreshToken = oauth.parseRefreshToken(refreshTokenString);
-        assertEquals(sessionId, refreshToken.getSessionState());
+        assertEquals(sessionId, refreshToken.getSessionId());
         assertEquals(clientId, refreshToken.getIssuedFor());
 
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(200, refreshResponse.getStatusCode());
         events.expectRefresh(refreshToken.getId(), sessionId).client(clientId).assertEvent();
 
         AccessToken refreshedToken = oauth.verifyToken(refreshResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshResponse.getRefreshToken());
-        assertEquals(sessionId, refreshedToken.getSessionState());
-        assertEquals(sessionId, refreshedRefreshToken.getSessionState());
+        assertEquals(sessionId, refreshedToken.getSessionId());
+        assertEquals(sessionId, refreshedRefreshToken.getSessionId());
         assertEquals(findUserByUsername(adminClient.realm(REALM_NAME), userName).getId(), refreshedToken.getSubject());
 
         doIntrospectAccessToken(refreshResponse, userName, clientId, sessionId, clientSecret);
@@ -1540,42 +1403,45 @@ protected void successfulLoginAndLogoutWithPKCE(String clientId, String clientSe
     }
 
     protected void failLoginByNotFollowingPKCE(String clientId) {
-        oauth.clientId(clientId);
+        oauth.client(clientId, TEST_CLIENT_SECRET);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter: code_challenge_method", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("Missing parameter: code_challenge_method", response.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Missing parameter: code_challenge_method").client(clientId).user((String) null)
+                .assertEvent();
     }
 
-    protected void failTokenRequestByNotFollowingPKCE(String clientId, String clientSecret) {
-        oauth.clientId(clientId);
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-
-        EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
-        String sessionId = loginEvent.getSessionId();
-        String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
-
-        assertEquals(OAuthErrorException.INVALID_GRANT, res.getError());
-        assertEquals("PKCE code verifier not specified", res.getErrorDescription());
-        events.expect(EventType.CODE_TO_TOKEN_ERROR).client(clientId).session(sessionId).clearDetails().error(Errors.CODE_VERIFIER_MISSING).assertEvent();
-
-        oauth.idTokenHint(res.getIdToken()).openLogout();
-        events.expectLogout(sessionId).clearDetails().assertEvent();
+    protected void failLoginByNotFollowingPKCEWithoutClientPolicyValidation(String clientId) {
+        oauth.client(clientId, TEST_CLIENT_SECRET);
+        oauth.openLoginForm();
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("Missing parameter: code_challenge_method", response.getErrorDescription());
+        events.expect(EventType.LOGIN_ERROR).error(OAuthErrorException.INVALID_REQUEST)
+                .detail(Details.REASON, "Missing parameter: code_challenge_method").client(clientId)
+                .user((String) null).assertEvent();
     }
 
     protected void failLoginWithoutSecureSessionParameter(String clientId, String errorDescription) {
-        oauth.clientId(clientId);
+        oauth.client(clientId, TEST_CLIENT_SECRET);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals(errorDescription, oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals(errorDescription, response.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST, errorDescription).client(clientId)
+                .user((String) null).assertEvent();
     }
 
     protected void failLoginWithoutNonce(String clientId) {
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals(ERR_MSG_MISSING_NONCE, oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals(ERR_MSG_MISSING_NONCE, response.getErrorDescription());
     }
 
     protected void doConfigProfileAndPolicy(ClientPoliciesUtil.ClientProfileBuilder profileBuilder,
@@ -1588,7 +1454,7 @@ protected void doConfigProfileAndPolicy(ClientPoliciesUtil.ClientProfileBuilder
 
         // register policies
         ClientAccessTypeCondition.Configuration config = new ClientAccessTypeCondition.Configuration();
-        config.setType(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL));
+        config.setType(List.of(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL));
         json = (new ClientPoliciesUtil.ClientPoliciesBuilder()).addPolicy(
                 (new ClientPoliciesUtil.ClientPolicyBuilder()).createPolicy(SECRET_ROTATION_POLICY,
                                 "Policy for Client Secret Rotation",
@@ -1617,12 +1483,12 @@ protected ClientSecretRotationExecutor.Configuration getClientProfileConfigurati
     }
 
     protected void assertLoginAndLogoutStatus(String clientId, String secret, Response.Status status) {
-        oauth.clientId(clientId);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME,
+        oauth.client(clientId, secret);
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME,
                 TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, secret);
+        String code = loginResponse.getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertThat(res.getStatusCode(), equalTo(status.getStatusCode()));
-        oauth.doLogout(res.getRefreshToken(), secret);
+        oauth.doLogout(res.getRefreshToken());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesAdminTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesAdminTest.java
index 090173b7b6c2..d1c48c083176 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesAdminTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesAdminTest.java
@@ -51,7 +51,6 @@
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.pages.OAuth2DeviceVerificationPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPoliciesBuilder;
@@ -68,9 +67,6 @@
 @EnableFeature(value = Profile.Feature.CLIENT_SECRET_ROTATION)
 public class ClientPoliciesAdminTest extends AbstractClientPoliciesTest {
 
-    @Page
-    protected OAuth2DeviceVerificationPage verificationPage;
-
     @Page
     protected OAuthGrantPage grantPage;
 
@@ -105,7 +101,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         user.setUsername("create-clients");
         user.setCredentials(credentials);
         user.setClientRoles(Collections.singletonMap(Constants.REALM_MANAGEMENT_CLIENT_ID, Collections.singletonList(AdminRoles.CREATE_CLIENT)));
-        user.setGroups(Arrays.asList("topGroup")); // defined in testrealm.json
+        user.setGroups(List.of("topGroup")); // defined in testrealm.json
 
         users.add(user);
 
@@ -145,9 +141,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void testAdminClientRegisterUnacceptableAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
         try {
-            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -157,9 +151,7 @@ public void testAdminClientRegisterUnacceptableAuthType() throws Exception {
     @Test
     public void testAdminClientRegisterAcceptableAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
     }
 
@@ -167,8 +159,7 @@ public void testAdminClientRegisterAcceptableAuthType() throws Exception {
     public void testAdminClientRegisterDefaultAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
         try {
-            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            });
+            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {});
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -178,14 +169,10 @@ public void testAdminClientRegisterDefaultAuthType() throws Exception {
     @Test
     public void testAdminClientUpdateUnacceptableAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
         try {
-            updateClientByAdmin(cId, (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            updateClientByAdmin(cId, (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, cpe.getError());
@@ -197,15 +184,11 @@ public void testAdminClientUpdateUnacceptableAuthType() throws Exception {
     public void testAdminClientUpdateAcceptableAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
 
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
 
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
 
-        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID);
-        });
+        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientAuthenticator.PROVIDER_ID));
         assertEquals(JWTClientAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
     }
 
@@ -213,15 +196,11 @@ public void testAdminClientUpdateAcceptableAuthType() throws Exception {
     public void testAdminClientUpdateDefaultAuthType() throws Exception {
         setupPolicyClientIdAndSecretNotAcceptableAuthType(POLICY_NAME);
 
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
 
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
 
-        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> {
-            clientRep.setServiceAccountsEnabled(Boolean.FALSE);
-        });
+        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> clientRep.setServiceAccountsEnabled(Boolean.FALSE));
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
         assertEquals(Boolean.FALSE, getClientByAdmin(cId).isServiceAccountsEnabled());
     }
@@ -243,7 +222,7 @@ public void testAdminClientAutoConfiguredClientAuthType() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Persha Polityka", Boolean.TRUE)
                         .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                                createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                                createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -251,17 +230,14 @@ public void testAdminClientAutoConfiguredClientAuthType() throws Exception {
 
         // Attempt to create client with set authenticator to ClientIdAndSecretAuthenticator. Should fail
         try {
-            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-                clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID);
-            });
+            createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(ClientIdAndSecretAuthenticator.PROVIDER_ID));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
         }
 
         // Attempt to create client without set authenticator. Default authenticator should be set
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {});
 
         assertEquals(X509ClientAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
 
@@ -277,9 +253,7 @@ public void testAdminClientAutoConfiguredClientAuthType() throws Exception {
         updateProfiles(json);
 
         // It is allowed to update authenticator to one of allowed client authenticators. Default client authenticator is not explicitly set in this case
-        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        updateClientByAdmin(cId, (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesConditionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesConditionTest.java
index 9921bbde45c3..02446bfe9fe4 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesConditionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesConditionTest.java
@@ -37,6 +37,7 @@
 import java.util.LinkedList;
 import java.util.List;
 
+import jakarta.ws.rs.BadRequestException;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
@@ -53,8 +54,11 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.representations.idm.ClientPoliciesRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
@@ -70,10 +74,10 @@
 import org.keycloak.services.clientpolicy.executor.PKCEEnforcerExecutorFactory;
 import org.keycloak.services.clientpolicy.executor.SecureClientAuthenticatorExecutorFactory;
 import org.keycloak.services.clientpolicy.executor.SecureSessionEnforceExecutorFactory;
+import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.pages.OAuth2DeviceVerificationPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutorFactory;
 import org.keycloak.testsuite.util.ClientBuilder;
@@ -81,8 +85,9 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.util.JsonSerialization;
 
 /**
  * This test class is for testing a condition of client policies.
@@ -92,9 +97,6 @@
 @EnableFeature(value = Profile.Feature.CLIENT_SECRET_ROTATION)
 public class ClientPoliciesConditionTest extends AbstractClientPoliciesTest {
 
-    @Page
-    protected OAuth2DeviceVerificationPage verificationPage;
-
     @Page
     protected OAuthGrantPage grantPage;
 
@@ -129,7 +131,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         user.setUsername("create-clients");
         user.setCredentials(credentials);
         user.setClientRoles(Collections.singletonMap(Constants.REALM_MANAGEMENT_CLIENT_ID, Collections.singletonList(AdminRoles.CREATE_CLIENT)));
-        user.setGroups(Arrays.asList("topGroup")); // defined in testrealm.json
+        user.setGroups(List.of("topGroup")); // defined in testrealm.json
 
         users.add(user);
 
@@ -188,19 +190,16 @@ public void testAnyClientCondition() throws Exception {
         String clientAlphaId = generateSuffixedName("Alpha-App");
         String clientAlphaSecret = "secretAlpha";
         createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> {
-            clientRep.setDefaultRoles((String[]) Arrays.asList("sample-client-role-alpha").toArray(new String[1]));
+            clientRep.setDefaultRoles(List.of("sample-client-role-alpha").toArray(new String[1]));
             clientRep.setSecret(clientAlphaSecret);
         });
 
         String clientBetaId = generateSuffixedName("Beta-App");
-        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret("secretBeta");
-        });
+        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> clientRep.setSecret("secretBeta"));
 
         try {
             failLoginWithoutSecureSessionParameter(clientBetaId, ERR_MSG_MISSING_NONCE);
-            oauth.nonce("yesitisnonce");
-            successfulLoginAndLogout(clientAlphaId, clientAlphaSecret);
+            successfulLoginAndLogout(clientAlphaId, clientAlphaSecret, "yesitisnonce", "somestate");
         } catch (Exception e) {
             fail();
         }
@@ -233,9 +232,7 @@ public void testClientUpdateSourceHostsCondition() throws Exception {
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
         try {
-            createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-                clientRep.setSecret(clientSecret);
-            });
+            createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -245,16 +242,14 @@ public void testClientUpdateSourceHostsCondition() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Aktualizovana Prvni Politika", Boolean.TRUE)
                         .addCondition(ClientUpdaterSourceHostsConditionFactory.PROVIDER_ID,
-                                createClientUpdateSourceHostsConditionConfig(Arrays.asList("example.com")))
+                                createClientUpdateSourceHostsConditionConfig(List.of("example.com")))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
         try {
-            createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-                clientRep.setSecret(clientSecret);
-            });
+            createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
         } catch (Exception e) {
             fail();
         }
@@ -267,7 +262,7 @@ public void testClientUpdateSourceGroupsCondition() throws Exception {
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profil")
                         .addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID,
                                 createSecureClientAuthenticatorExecutorConfig(
-                                        Arrays.asList(JWTClientAuthenticator.PROVIDER_ID),
+                                        List.of(JWTClientAuthenticator.PROVIDER_ID),
                                         null)
                         )
                         .toRepresentation()
@@ -278,7 +273,7 @@ public void testClientUpdateSourceGroupsCondition() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politik", Boolean.TRUE)
                         .addCondition(ClientUpdaterSourceGroupsConditionFactory.PROVIDER_ID,
-                                createClientUpdateSourceGroupsConditionConfig(Arrays.asList("topGroup")))
+                                createClientUpdateSourceGroupsConditionConfig(List.of("topGroup")))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -308,7 +303,7 @@ public void testClientUpdateSourceRolesCondition() throws Exception {
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Il Primo Profilo")
                         .addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID,
                                 createSecureClientAuthenticatorExecutorConfig(
-                                        Arrays.asList(JWTClientSecretAuthenticator.PROVIDER_ID),
+                                        List.of(JWTClientSecretAuthenticator.PROVIDER_ID),
                                         null)
                         )
                         .toRepresentation()
@@ -319,7 +314,7 @@ public void testClientUpdateSourceRolesCondition() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Prima Politica", Boolean.TRUE)
                         .addCondition(ClientUpdaterSourceRolesConditionFactory.PROVIDER_ID,
-                                createClientUpdateSourceRolesConditionConfig(Arrays.asList(Constants.REALM_MANAGEMENT_CLIENT_ID + "." + AdminRoles.CREATE_CLIENT)))
+                                createClientUpdateSourceRolesConditionConfig(List.of(Constants.REALM_MANAGEMENT_CLIENT_ID + "." + AdminRoles.CREATE_CLIENT)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -343,7 +338,7 @@ public void testClientUpdateSourceRolesCondition() throws Exception {
     }
 
     @Test
-    public void testClientScopesCondition() throws Exception {
+    public void testClientScopesOptionalCondition() throws Exception {
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Het Eerste Profiel")
@@ -365,9 +360,7 @@ public void testClientScopesCondition() throws Exception {
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
-        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientSecret);
-        });
+        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
 
         try {
             oauth.scope("address" + " " + "phone");
@@ -385,6 +378,101 @@ public void testClientScopesCondition() throws Exception {
         }
     }
 
+    @Test
+    public void testClientScopesAnyCondition() throws Exception {
+        // register profiles
+        String json = (new ClientProfilesBuilder()).addProfile(
+                (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Het Eerste Profiel")
+                        .addExecutor(PKCEEnforcerExecutorFactory.PROVIDER_ID,
+                                createPKCEEnforceExecutorConfig(Boolean.TRUE))
+                        .toRepresentation()
+        ).toString();
+        updateProfiles(json);
+
+        // register policies
+        json = (new ClientPoliciesBuilder()).addPolicy(
+                (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Het Eerste Beleid", Boolean.TRUE)
+                        .addCondition(ClientScopesConditionFactory.PROVIDER_ID,
+                                createClientScopesConditionConfig(ClientScopesConditionFactory.ANY, List.of("email", "microprofile-jwt")))
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+        updatePolicies(json);
+
+        String clientId = generateSuffixedName(CLIENT_NAME);
+        String clientSecret = "secret";
+        String id = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
+
+
+        String emailClientScopeId = adminClient.realm(REALM_NAME)
+                .getDefaultDefaultClientScopes().stream()
+                .filter(scope -> "email".equals(scope.getName()))
+                .map(ClientScopeRepresentation::getId)
+                .findAny()
+                .orElse(null);
+
+        //remove email default client scope
+        adminClient.realm(REALM_NAME).clients().get(id).removeDefaultClientScope(emailClientScopeId);
+
+        try {
+            //condition evaluates false
+            oauth.scope("address" + " " + "phone");
+            successfulLoginAndLogout(clientId, clientSecret);
+
+            //condition evaluates true because of microprofile-jwt optional client scope
+            oauth.scope("microprofile-jwt" + " " + "profile");
+            failLoginByNotFollowingPKCE(clientId);
+
+            adminClient.realm(REALM_NAME).clients().get(id).addDefaultClientScope(emailClientScopeId);
+            oauth.scope(null);
+            //condition evaluates true because of email default client scope
+            failLoginByNotFollowingPKCE(clientId);
+
+            successfulLoginAndLogoutWithPKCE(clientId, clientSecret, TEST_USER_NAME, TEST_USER_PASSWORD);
+        } catch (Exception e) {
+            fail();
+        }
+
+    }
+
+    @Test
+    public void testClientScopesConditionValidation() throws Exception {
+        // register profiles
+        String json = (new ClientProfilesBuilder()).addProfile(
+                (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Het Eerste Profiel")
+                        .addExecutor(PKCEEnforcerExecutorFactory.PROVIDER_ID,
+                                createPKCEEnforceExecutorConfig(Boolean.TRUE))
+                        .toRepresentation()
+        ).toString();
+        updateProfiles(json);
+
+        // register policies with empty scopes
+        json = (new ClientPoliciesBuilder()).addPolicy(
+                (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "test", Boolean.TRUE)
+                        .addCondition(ClientScopesConditionFactory.PROVIDER_ID,
+                                createClientScopesConditionConfig(ClientScopesConditionFactory.ANY, null))
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+        updatePolicies(json);
+
+        // register policies
+        json = (new ClientPoliciesBuilder()).addPolicy(
+                (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "test", Boolean.TRUE)
+                        .addCondition(ClientScopesConditionFactory.PROVIDER_ID,
+                                createClientScopesConditionConfig(ClientScopesConditionFactory.ANY, List.of("fake-client-scope")))
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+
+        ClientPoliciesRepresentation clientPolicies = json==null ? null : JsonSerialization.readValue(json, ClientPoliciesRepresentation.class);
+        BadRequestException e = Assert.assertThrows(BadRequestException.class,
+                () -> adminClient.realm(REALM_NAME).clientPoliciesPoliciesResource().updatePolicies(clientPolicies));
+
+        ErrorRepresentation error = e.getResponse().readEntity(ErrorRepresentation.class);
+        Assert.assertEquals("Invalid client-scopes configuration - Client scopes not allowed: [fake-client-scope]", error.getErrorMessage());
+    }
+
     @Test
     public void testClientAttributesCondition() throws Exception {
         // register profiles
@@ -400,7 +488,7 @@ public void testClientAttributesCondition() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Het Eerste Beleid", Boolean.TRUE)
                         .addCondition(ClientAttributesConditionFactory.PROVIDER_ID,
-                                createClientAttributesConditionConfig(new MultivaluedHashMap<String, String>() {
+                                createClientAttributesConditionConfig(new MultivaluedHashMap<>() {
                                     {
                                         putSingle("attr1", "Apple");
                                         putSingle("attr2", "Orange");
@@ -415,7 +503,7 @@ public void testClientAttributesCondition() throws Exception {
         String clientSecret = "secret";
         createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> {
             clientRep.setSecret(clientSecret);
-            clientRep.setAttributes(new HashMap<String, String>() {
+            clientRep.setAttributes(new HashMap<>() {
                 {
                     put("attr1", "Apple");
                     put("attr2", "Orange");
@@ -427,7 +515,7 @@ public void testClientAttributesCondition() throws Exception {
         String clientBetaId = generateSuffixedName("Beta-App");
         createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
             clientRep.setSecret(clientSecret);
-            clientRep.setAttributes(new HashMap<String, String>() {
+            clientRep.setAttributes(new HashMap<>() {
                 {
                     put("attr1", "Apple");
                     put("attr2", "Peach"); // attr2 is not "Orange"
@@ -464,7 +552,7 @@ public void testClientAccessTypeCondition() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Primera Plitica", Boolean.TRUE)
                         .addCondition(ClientAccessTypeConditionFactory.PROVIDER_ID,
-                                createClientAccessTypeConditionConfig(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
+                                createClientAccessTypeConditionConfig(List.of(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -519,9 +607,7 @@ public void testClientAccessTypeCondition() throws Exception {
         updateProfiles(json);
 
         authCreateClients();
-        String clientGammaId = createClientDynamically(generateSuffixedName("Gamma-App"), (OIDCClientRepresentation clientRep) -> {
-            clientRep.setClientSecret("secretGamma");
-        });
+        String clientGammaId = createClientDynamically(generateSuffixedName("Gamma-App"), (OIDCClientRepresentation clientRep) -> clientRep.setClientSecret("secretGamma"));
 
         ClientRepresentation clientRep = getClientByAdmin(clientGammaId);
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).getPkceCodeChallengeMethod());
@@ -566,7 +652,7 @@ public void testClientPolicyTriggeredForServiceAccountRequest() throws Exception
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -581,14 +667,14 @@ public void testClientPolicyTriggeredForServiceAccountRequest() throws Exception
         updatePolicies(json);
 
         String origClientId = oauth.getClientId();
-        oauth.clientId("service-account-app");
+        oauth.client("service-account-app", "app-secret");
         try {
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("app-secret");
+            AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
             assertEquals(400, response.getStatusCode());
             assertEquals(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST.toString(), response.getError());
             assertEquals("Exception thrown intentionally", response.getErrorDescription());
         } finally {
-            oauth.clientId(origClientId);
+            oauth.client(origClientId);
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExecutorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExecutorTest.java
index 199904a4322e..f5419fade099 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExecutorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExecutorTest.java
@@ -42,12 +42,12 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 
 import jakarta.ws.rs.BadRequestException;
 
 import org.apache.http.HttpResponse;
-import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Test;
@@ -103,9 +103,9 @@
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
+import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.pages.OAuth2DeviceVerificationPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject;
 import org.keycloak.testsuite.util.ClientBuilder;
@@ -113,8 +113,9 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient.ParResponse;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.ParResponse;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.util.JsonSerialization;
@@ -130,10 +131,10 @@
 public class ClientPoliciesExecutorTest extends AbstractClientPoliciesTest {
 
     @Page
-    protected OAuth2DeviceVerificationPage verificationPage;
+    protected OAuthGrantPage grantPage;
 
     @Page
-    protected OAuthGrantPage grantPage;
+    protected AppPage appPage;
 
     @Page
     protected ErrorPage errorPage;
@@ -166,7 +167,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         user.setUsername("create-clients");
         user.setCredentials(credentials);
         user.setClientRoles(Collections.singletonMap(Constants.REALM_MANAGEMENT_CLIENT_ID, Collections.singletonList(AdminRoles.CREATE_CLIENT)));
-        user.setGroups(Arrays.asList("topGroup")); // defined in testrealm.json
+        user.setGroups(List.of("topGroup")); // defined in testrealm.json
 
         users.add(user);
 
@@ -231,25 +232,24 @@ public void testSecureClientAuthenticatorDuringLogin() throws Exception {
 
         // create a client without client role. It should be successful (policy not applied)
         String clientId = generateSuffixedName(CLIENT_NAME);
-        String cId = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret("secret");
-        });
+        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret("secret"));
 
         // Login with clientIdAndSecret. It should be successful (policy not applied)
         successfulLoginAndLogout(clientId, "secret");
 
         // Add role to the client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
+        assert clientResource != null;
         ClientRepresentation clientRep = clientResource.toRepresentation();
         Assert.assertEquals(ClientIdAndSecretAuthenticator.PROVIDER_ID, clientRep.getClientAuthenticatorType());
         clientResource.roles().create(RoleBuilder.create().name(roleAlphaName).build());
 
         // Not allowed to client authentication with clientIdAndSecret anymore. Client matches policy now
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, "secret");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, res.getError());
         assertEquals("Configured client authentication method not allowed for client", res.getErrorDescription());
@@ -269,7 +269,7 @@ public void testSecureResponseTypeExecutor() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "A Primeira Politica", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -285,24 +285,28 @@ public void testSecureResponseTypeExecutor() throws Exception {
         });
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("invalid response_type", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("invalid response_type", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        "invalid response_type").client(clientId).user((String) null).assertEvent();
 
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
-        oauth.nonce("vbwe566fsfffds");
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        oauth.loginForm().nonce("vbwe566fsfffds").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
-        oauth.doLogout(res.getRefreshToken(), clientSecret);
+        oauth.doLogout(res.getRefreshToken());
         events.expectLogout(sessionId).client(clientId).clearDetails().assertEvent();
 
         // update profiles
@@ -314,28 +318,27 @@ public void testSecureResponseTypeExecutor() throws Exception {
         updateProfiles(json);
 
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN); // token response type allowed
-        oauth.nonce("cie8cjcwiw");
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        oauth.loginForm().nonce("cie8cjcwiw").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         loginEvent = events.expectLogin().client(clientId).assertEvent();
         sessionId = loginEvent.getSessionId();
         codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        res = oauth.doAccessTokenRequest(code, clientSecret);
+        code = oauth.parseLoginResponse().getCode();
+        res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
-        oauth.doLogout(res.getRefreshToken(), clientSecret);
+        oauth.doLogout(res.getRefreshToken());
         events.expectLogout(sessionId).client(clientId).clearDetails().assertEvent();
 
         // shall allow code using response_mode jwt
         oauth.responseType(OIDCResponseType.CODE);
         oauth.responseMode("jwt");
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         String jwsResponse = authzResponse.getResponse();
         AuthorizationResponseToken responseObject = oauth.verifyAuthorizationResponseToken(jwsResponse);
         code = (String) responseObject.getOtherClaims().get(OAuth2Constants.CODE);
-        res = oauth.doAccessTokenRequest(code, clientSecret);
+        res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         // update profiles
@@ -346,11 +349,11 @@ public void testSecureResponseTypeExecutor() throws Exception {
         ).toString();
         updateProfiles(json);
 
-        oauth.openLogout();
+        oauth.openLogoutForm();
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN); // token response type allowed
         oauth.responseMode("jwt");
         oauth.openLoginForm();
-        final JWSInput errorJws = new JWSInput(new OAuthClient.AuthorizationEndpointResponse(oauth).getResponse());
+        final JWSInput errorJws = new JWSInput(oauth.parseLoginResponse().getResponse());
         JsonNode errorClaims = JsonSerialization.readValue(errorJws.getContent(), JsonNode.class);
         assertEquals(OAuthErrorException.INVALID_REQUEST, errorClaims.get("error").asText());
     }
@@ -374,7 +377,7 @@ public void testSecureResponseTypeExecutorAllowTokenResponseType() throws Except
                                         ClientUpdaterContextConditionFactory.BY_INITIAL_ACCESS_TOKEN,
                                         ClientUpdaterContextConditionFactory.BY_REGISTRATION_ACCESS_TOKEN)))
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -382,9 +385,7 @@ public void testSecureResponseTypeExecutorAllowTokenResponseType() throws Except
 
         // create by Admin REST API
         try {
-            createClientByAdmin(generateSuffixedName("App-by-Admin"), (ClientRepresentation clientRep) -> {
-                clientRep.setSecret("secret");
-            });
+            createClientByAdmin(generateSuffixedName("App-by-Admin"), (ClientRepresentation clientRep) -> clientRep.setSecret("secret"));
             fail();
         } catch (ClientPolicyException e) {
             assertEquals(OAuthErrorException.INVALID_CLIENT_METADATA, e.getMessage());
@@ -416,21 +417,25 @@ public void testSecureResponseTypeExecutorAllowTokenResponseType() throws Except
 
         adminClient.realm(REALM_NAME).clients().get(cId).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("invalid response_type", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("invalid response_type", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "invalid response_type").client(clientId).user((String) null).assertEvent();
 
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
-        oauth.nonce("LIVieviDie028f");
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        oauth.loginForm().nonce("LIVieviDie028f").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        String code = authorizationEndpointResponse.getCode();
 
-        IDToken idToken = oauth.verifyIDToken(new OAuthClient.AuthorizationEndpointResponse(oauth).getIdToken());
+        IDToken idToken = oauth.verifyIDToken(authorizationEndpointResponse.getIdToken());
         // confirm ID token as detached signature does not include authenticated user's claims
         Assert.assertNull(idToken.getEmailVerified());
         Assert.assertNull(idToken.getName());
@@ -440,20 +445,20 @@ public void testSecureResponseTypeExecutorAllowTokenResponseType() throws Except
         Assert.assertNull(idToken.getEmail());
         assertEquals("LIVieviDie028f", idToken.getNonce());
         // confirm an access token not returned
-        Assert.assertNull(new OAuthClient.AuthorizationEndpointResponse(oauth).getAccessToken());
+        Assert.assertNull(authorizationEndpointResponse.getAccessToken());
 
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
-        oauth.doLogout(res.getRefreshToken(), clientSecret);
+        oauth.doLogout(res.getRefreshToken());
         events.expectLogout(sessionId).client(clientId).clearDetails().assertEvent();
     }
 
     @Test
     public void testSecureRequestObjectExecutor() throws Exception {
-        Integer availablePeriod = Integer.valueOf(SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400);
-        Integer allowedClockSkew = Integer.valueOf(SecureRequestObjectExecutor.DEAULT_ALLOWED_CLOCK_SKEW + 15); // 30 sec
+        Integer availablePeriod = SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400;
+        Integer allowedClockSkew = SecureRequestObjectExecutor.DEAULT_ALLOWED_CLOCK_SKEW + 15; // 30 sec
 
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
@@ -468,7 +473,7 @@ public void testSecureRequestObjectExecutor() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Prva Politika", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -478,19 +483,22 @@ public void testSecureRequestObjectExecutor() throws Exception {
         String clientSecret = "secret";
         String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
             clientRep.setSecret(clientSecret);
-            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Arrays.asList(TestApplicationResourceUrls.clientRequestUri()));
+            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
         });
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         AuthorizationEndpointRequestObject requestObject;
 
-        // check whether whether request object exists
-        oauth.request(null);
-        oauth.requestUri(null);
+        // check whether request object exists
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter: 'request' or 'request_uri'", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Missing parameter: 'request' or 'request_uri'", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Missing parameter: 'request' or 'request_uri'").client(clientId).user((String) null)
+                .assertEvent();
 
         // check whether request_uri is https scheme
         // cannot test because existing AuthorizationEndpoint check and return error before executing client policy
@@ -505,25 +513,40 @@ public void testSecureRequestObjectExecutor() throws Exception {
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setScope(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Invalid parameter. Parameters in 'request' object not matching with request parameters")
+                .client(clientId).user((String) null).assertEvent();
 
         // check whether client_id exists in both query parameter and request object
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setClientId(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Invalid parameter. Parameters in 'request' object not matching with request parameters")
+                .client(clientId).user((String) null).assertEvent();
 
         // check whether response_type exists in both query parameter and request object
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setResponseType(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Invalid parameter. Parameters in 'request' object not matching with request parameters")
+                .client(clientId).user((String) null).assertEvent();
 
         // Check scope required
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
@@ -531,42 +554,65 @@ public void testSecureRequestObjectExecutor() throws Exception {
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
         oauth.scope(null);
         oauth.openid(false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Parameter 'scope' missing in the request parameters or in 'request' object", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Parameter 'scope' missing in the request parameters or in 'request' object", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "Parameter 'scope' missing in the request parameters or in 'request' object")
+                .client(clientId).user((String) null).assertEvent();
         oauth.openid(true);
 
         // check whether "exp" claim exists
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.exp(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter in the 'request' object: exp", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Missing parameter in the 'request' object: exp", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Missing parameter in the 'request' object: exp").client(clientId).user((String) null)
+                .assertEvent();
 
         // check whether request object not expired
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
-        requestObject.exp(Long.valueOf(0));
+        requestObject.exp(0L);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request Expired", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request Expired", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Request Expired").client(clientId).user((String) null).assertEvent();
 
         // check whether "nbf" claim exists
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.nbf(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter in the 'request' object: nbf", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Missing parameter in the 'request' object: nbf", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Missing parameter in the 'request' object: nbf").client(clientId).user((String) null)
+                .assertEvent();
 
         // check whether request object not yet being processed
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.nbf(requestObject.getNbf() + allowedClockSkew + 10);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request not yet being processed", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request not yet being processed", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Request not yet being processed").client(clientId).user((String) null).assertEvent();
 
         // nbf ahead within allowed clock skew
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
@@ -578,9 +624,13 @@ public void testSecureRequestObjectExecutor() throws Exception {
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.iat(requestObject.getIat() + allowedClockSkew + 10);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request issued in the future", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request issued in the future", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Request issued in the future").client(clientId).user((String) null).assertEvent();
 
         // iat ahead within allowed clock skew
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
@@ -590,36 +640,56 @@ public void testSecureRequestObjectExecutor() throws Exception {
         
         // check whether request object's available period is short
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
-        requestObject.exp(requestObject.getNbf() + availablePeriod.intValue() + 1);
+        requestObject.exp(requestObject.getNbf() + availablePeriod + 1);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request's available period is long", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request's available period is long", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                "Request's available period is long").client(clientId).user((String) null)
+                .assertEvent();
 
         // check whether "aud" claim exists
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.audience((String) null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter in the 'request' object: aud", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Missing parameter in the 'request' object: aud", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        "Missing parameter in the 'request' object: aud").client(clientId)
+                .user((String) null).assertEvent();
 
         // check whether "aud" claim points to this keycloak as authz server
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.audience(suiteContext.getAuthServerInfo().getContextRoot().toString());
         registerRequestObject(requestObject, clientId, Algorithm.ES256, true);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Invalid parameter in the 'request' object: aud", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().requestUri(requestUri).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, authorizationEndpointResponse.getError());
+        assertEquals("Invalid parameter in the 'request' object: aud", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_URI,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_URI,
+                        "Invalid parameter in the 'request' object: aud").client(clientId)
+                .user((String) null).assertEvent();
 
         // confirm whether all parameters in query string are included in the request object, and have the same values
         // argument "request" are parameters overridden by parameters in request object
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setState("notmatchstate");
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().state("wrongstate").request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("Invalid parameter. Parameters in 'request' object not matching with request parameters", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        "Invalid parameter. Parameters in 'request' object not matching with request parameters")
+                .client(clientId).user((String) null).assertEvent();
 
         // valid request object
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
@@ -639,25 +709,40 @@ public void testSecureRequestObjectExecutor() throws Exception {
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.nbf(null);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Missing parameter in the 'request' object: nbf", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Missing parameter in the 'request' object: nbf", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        "Missing parameter in the 'request' object: nbf").client(clientId)
+                .user((String) null).assertEvent();
 
         // check whether request object not yet being processed
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.nbf(requestObject.getNbf() + 600);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request not yet being processed", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request not yet being processed", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        "Request not yet being processed").client(clientId).user((String) null)
+                .assertEvent();
 
         // check whether request object's available period is short
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.exp(requestObject.getNbf() + SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 1);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request's available period is long", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request's available period is long", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        "Request's available period is long").client(clientId).user((String) null)
+                .assertEvent();
 
         // update profile : not check "nbf"
         json = (new ClientProfilesBuilder()).addProfile(
@@ -696,14 +781,19 @@ public void testSecureRequestObjectExecutor() throws Exception {
 
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         registerRequestObject(requestObject, clientId, Algorithm.ES256, false);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Request object not encrypted", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, authorizationEndpointResponse.getError());
+        assertEquals("Request object not encrypted", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST_OBJECT,
+                        "Request object not encrypted").client(clientId).user((String) null)
+                .assertEvent();
     }
 
     @Test
     public void testParSecureRequestObjectExecutor() throws Exception {
-        Integer availablePeriod = Integer.valueOf(SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400);
+        Integer availablePeriod = SecureRequestObjectExecutor.DEFAULT_AVAILABLE_PERIOD + 400;
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Prvy Profil")
@@ -717,7 +807,7 @@ public void testParSecureRequestObjectExecutor() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Prva Politika", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -727,66 +817,49 @@ public void testParSecureRequestObjectExecutor() throws Exception {
         String clientSecret = "secret";
         String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
             clientRep.setSecret(clientSecret);
-            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Arrays.asList(TestApplicationResourceUrls.clientRequestUri()));
+            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestUris(Collections.singletonList(TestApplicationResourceUrls.clientRequestUri()));
         });
 
         oauth.realm(REALM_NAME);
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
 
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         AuthorizationEndpointRequestObject requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
 
-        oauth.request(signRequestObject(requestObject));
-        OAuthClient.ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().request(signRequestObject(requestObject)).send();
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.request(null);
-        oauth.requestUri(requestUri);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         assertNotNull(loginResponse.getCode());
-        oauth.openLogout();
+        oauth.openLogoutForm();
 
         requestObject.exp(null);
-        oauth.requestUri(null);
-        oauth.request(signRequestObject(requestObject));
-        pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        pResp = oauth.pushedAuthorizationRequest().request(signRequestObject(requestObject)).send();
         requestUri = pResp.getRequestUri();
-        oauth.request(null);
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
+        oauth.loginForm().requestUri(requestUri).open();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.parseLoginResponse().getError());
 
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.nbf(null);
-        oauth.requestUri(null);
-        oauth.request(signRequestObject(requestObject));
-        pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        pResp = oauth.pushedAuthorizationRequest().request(signRequestObject(requestObject)).send();
         requestUri = pResp.getRequestUri();
-        oauth.request(null);
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
+        oauth.loginForm().requestUri(requestUri).open();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.parseLoginResponse().getError());
 
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.audience("https://www.other1.example.com/");
-        oauth.request(signRequestObject(requestObject));
-        oauth.requestUri(null);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        pResp = oauth.pushedAuthorizationRequest().request(signRequestObject(requestObject)).send();
         requestUri = pResp.getRequestUri();
-        oauth.request(null);
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
+        oauth.loginForm().requestUri(requestUri).open();
+        assertEquals(OAuthErrorException.INVALID_REQUEST_URI, oauth.parseLoginResponse().getError());
 
         requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId);
         requestObject.setOtherClaims(OIDCLoginProtocol.REQUEST_URI_PARAM, "foo");
-        oauth.request(signRequestObject(requestObject));
-        oauth.requestUri(null);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        pResp = oauth.pushedAuthorizationRequest().request(signRequestObject(requestObject)).send();
         assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError());
     }
 
@@ -806,7 +879,7 @@ public void testSecureSessionEnforceExecutor() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(roleBetaName)))
+                                createClientRolesConditionConfig(List.of(roleBetaName)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -814,16 +887,12 @@ public void testSecureSessionEnforceExecutor() throws Exception {
 
         String clientAlphaId = generateSuffixedName("Alpha-App");
         String clientAlphaSecret = "secretAlpha";
-        String cAlphaId = createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientAlphaSecret);
-        });
+        String cAlphaId = createClientByAdmin(clientAlphaId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientAlphaSecret));
         adminClient.realm(REALM_NAME).clients().get(cAlphaId).roles().create(RoleBuilder.create().name(roleAlphaName).build());
 
         String clientBetaId = generateSuffixedName("Beta-App");
         String clientBetaSecret = "secretBeta";
-        String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientBetaSecret);
-        });
+        String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientBetaSecret));
         adminClient.realm(REALM_NAME).clients().get(cBetaId).roles().create(RoleBuilder.create().name(roleBetaName).build());
 
         successfulLoginAndLogout(clientAlphaId, clientAlphaSecret);
@@ -834,15 +903,39 @@ public void testSecureSessionEnforceExecutor() throws Exception {
         oauth.openid(true);
         failLoginWithoutSecureSessionParameter(clientBetaId, ERR_MSG_MISSING_NONCE);
 
-        oauth.nonce("yesitisnonce");
-        successfulLoginAndLogout(clientBetaId, clientBetaSecret);
+        successfulLoginAndLogout(clientBetaId, clientBetaSecret, "yesitisnonce", "somestate");
 
         oauth.openid(false);
-        oauth.stateParamHardcoded(null);
         failLoginWithoutSecureSessionParameter(clientBetaId, ERR_MSG_MISSING_STATE);
 
-        oauth.stateParamRandom();
-        successfulLoginAndLogout(clientBetaId, clientBetaSecret);
+        successfulLoginAndLogout(clientBetaId, clientBetaSecret, "somenonce", "somestate");
+    }
+
+    // GH issue 37447
+    @Test
+    public void testSecureSessionEnforceExecutorWithAccountConsole() throws Exception {
+        // register profiles
+        String json = (new ClientProfilesBuilder()).addProfile(
+                (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
+                        .addExecutor(SecureSessionEnforceExecutorFactory.PROVIDER_ID, null)
+                        .toRepresentation()
+        ).toString();
+        updateProfiles(json);
+
+        // register policies
+        json = (new ClientPoliciesBuilder()).addPolicy(
+                (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
+                        .addCondition(AnyClientConditionFactory.PROVIDER_ID,
+                                createAnyClientConditionConfig())
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+        updatePolicies(json);
+
+        // Test account-console is loaded successfully when "secure-session-enforce" executor is present
+        appPage.open();
+        appPage.openAccount();
+        loginPage.assertCurrent();
     }
 
     @Test
@@ -976,9 +1069,7 @@ public void testSecureSigningAlgorithmEnforceExecutor() throws Exception {
 
         // update dynamically - fail
         try {
-            updateClientDynamically(cAppDynamicClientId, (OIDCClientRepresentation clientRep) -> {
-                clientRep.setIdTokenSignedResponseAlg(Algorithm.RS256);
-            });
+            updateClientDynamically(cAppDynamicClientId, (OIDCClientRepresentation clientRep) -> clientRep.setIdTokenSignedResponseAlg(Algorithm.RS256));
             fail();
         } catch (ClientRegistrationException e) {
             assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
@@ -986,9 +1077,7 @@ public void testSecureSigningAlgorithmEnforceExecutor() throws Exception {
         assertEquals(Algorithm.PS256, getClientDynamically(cAppDynamicClientId).getIdTokenSignedResponseAlg());
 
         // update dynamically - success
-        updateClientDynamically(cAppDynamicClientId, (OIDCClientRepresentation clientRep) -> {
-            clientRep.setIdTokenSignedResponseAlg(Algorithm.ES384);
-        });
+        updateClientDynamically(cAppDynamicClientId, (OIDCClientRepresentation clientRep) -> clientRep.setIdTokenSignedResponseAlg(Algorithm.ES384));
         assertEquals(Algorithm.ES384, getClientDynamically(cAppDynamicClientId).getIdTokenSignedResponseAlg());
 
         // create dynamically - success, PS256 enforced
@@ -1048,9 +1137,7 @@ public void testSecureClientRegisteringUriEnforceExecutor() throws Exception {
         updatePolicies(json);
 
         try {
-            createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> {
-                clientRep.setRedirectUris(Collections.singletonList("http://newredirect"));
-            });
+            createClientDynamically(generateSuffixedName(CLIENT_NAME), (OIDCClientRepresentation clientRep) -> clientRep.setRedirectUris(Collections.singletonList("http://newredirect")));
             fail();
         } catch (ClientRegistrationException e) {
             assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
@@ -1086,9 +1173,7 @@ public void testSecureClientRegisteringUriEnforceExecutor() throws Exception {
         updatePolicies(json);
 
         try {
-            updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> {
-                clientRep.setRedirectUris(Collections.singletonList("https://newredirect/*"));
-            });
+            updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> clientRep.setRedirectUris(Collections.singletonList("https://newredirect/*")));
             fail();
         } catch (ClientRegistrationException e) {
             assertEquals(ERR_MSG_CLIENT_REG_FAIL, e.getMessage());
@@ -1159,7 +1244,7 @@ public void testSecureClientRegisteringUriEnforceExecutor() throws Exception {
         try {
             updateClientByAdmin(cid, (ClientRepresentation clientRep) -> {
                 // web origins
-                clientRep.setWebOrigins(Arrays.asList("http://valid.another.client.example.com/"));
+                clientRep.setWebOrigins(List.of("http://valid.another.client.example.com/"));
             });
             fail();
         } catch (ClientPolicyException e) {
@@ -1266,6 +1351,7 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg()
 
 
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
+        assert clientResource != null;
         ClientRepresentation clientRep = clientResource.toRepresentation();
 
         KeyPair keyPair = setupJwksUrl(Algorithm.ES256, clientRep, clientResource);
@@ -1274,22 +1360,22 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg()
 
         String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, Algorithm.ES256);
 
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         EventRepresentation loginEvent = events.expectLogin()
                 .client(clientId)
                 .assertEvent();
         String sessionId = loginEvent.getSessionId();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         // obtain access token
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
+        AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
 
         assertEquals(200, response.getStatusCode());
         oauth.verifyToken(response.getAccessToken());
         RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
-        assertEquals(sessionId, refreshToken.getSessionState());
-        assertEquals(sessionId, refreshToken.getSessionState());
+        assertEquals(sessionId, refreshToken.getSessionId());
+        assertEquals(sessionId, refreshToken.getSessionId());
         events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId())
                 .client(clientId)
                 .detail(Details.CLIENT_AUTH_METHOD, JWTClientAuthenticator.PROVIDER_ID)
@@ -1297,7 +1383,7 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg()
 
         // refresh token
         signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, Algorithm.ES256);
-        OAuthClient.AccessTokenResponse refreshedResponse = doRefreshTokenRequestWithSignedJWT(response.getRefreshToken(), signedJwt);
+        AccessTokenResponse refreshedResponse = doRefreshTokenRequestWithSignedJWT(response.getRefreshToken(), signedJwt);
         assertEquals(200, refreshedResponse.getStatusCode());
 
         // introspect token
@@ -1311,7 +1397,7 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithSecureAlg()
         assertEquals(200, revokeTokenResponse.getStatusLine().getStatusCode());
 
         signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, Algorithm.ES256);
-        OAuthClient.AccessTokenResponse tokenRes = doRefreshTokenRequestWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
+        AccessTokenResponse tokenRes = doRefreshTokenRequestWithSignedJWT(refreshedResponse.getRefreshToken(), signedJwt);
         assertEquals(400, tokenRes.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, tokenRes.getError());
 
@@ -1356,6 +1442,7 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithNotSecureAl
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(roleCommonName).build());
 
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(REALM_NAME), clientId);
+        assert clientResource != null;
         ClientRepresentation clientRep = clientResource.toRepresentation();
 
         KeyPair keyPair = setupJwksUrl(Algorithm.RS256, clientRep, clientResource);
@@ -1364,16 +1451,13 @@ public void testSecureSigningAlgorithmForSignedJwtEnforceExecutorWithNotSecureAl
 
         String signedJwt = createSignedRequestToken(clientId, privateKey, publicKey, Algorithm.RS256);
 
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        EventRepresentation loginEvent = events.expectLogin()
-                .client(clientId)
-                .assertEvent();
-        String sessionId = loginEvent.getSessionId();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        events.expectLogin().client(clientId).assertEvent();
+        String code = oauth.parseLoginResponse().getCode();
 
         // obtain access token
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
+        AccessTokenResponse response = doAccessTokenRequestWithSignedJWT(code, signedJwt);
 
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -1434,7 +1518,7 @@ public void testSecureLogoutExecutor() throws Exception {
 
         ClientPolicyExecutorConfigurationRepresentation config = new ClientPolicyExecutorConfigurationRepresentation();
 
-        config.setConfigAsMap(SecureLogoutExecutorFactory.ALLOW_FRONT_CHANNEL_LOGOUT, Boolean.TRUE.booleanValue());
+        config.setConfigAsMap(SecureLogoutExecutorFactory.ALLOW_FRONT_CHANNEL_LOGOUT, true);
 
         json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Logout Test")
@@ -1455,11 +1539,11 @@ public void testSecureLogoutExecutor() throws Exception {
         ).toString();
         updateProfiles(json);
 
-        OAuthClient.AccessTokenResponse response = successfulLogin(clientId, clientSecret);
+        AccessTokenResponse response = successfulLogin(clientId, clientSecret);
 
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
 
-        assertTrue(driver.getPageSource().contains("Front-channel logout is not allowed for this client"));
+        assertTrue(Objects.requireNonNull(driver.getPageSource()).contains("Front-channel logout is not allowed for this client"));
     }
 
     @Test
@@ -1473,9 +1557,7 @@ public void testSecureParContentsExecutor() throws Exception {
         updateProfiles(json);
 
         String clientBetaId = generateSuffixedName("Beta-App");
-        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret("secretBeta");
-        });
+        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> clientRep.setSecret("secretBeta"));
 
         // register policies
         json = (new ClientPoliciesBuilder()).addPolicy(
@@ -1487,24 +1569,27 @@ public void testSecureParContentsExecutor() throws Exception {
         ).toString();
         updatePolicies(json);
 
+        oauth.client(clientBetaId, "secretBeta");
+
         // Pushed Authorization Request
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientBetaId, "secretBeta");
+        ParResponse pResp = oauth.pushedAuthorizationRequest().send();
         assertEquals(201, pResp.getStatusCode());
-        String requestUri = pResp.getRequestUri();
+        requestUri = pResp.getRequestUri();
 
-        oauth.requestUri(requestUri);
-        oauth.clientId(clientBetaId);
-        oauth.openLoginForm();
+        oauth.client(clientBetaId);
+        oauth.loginForm().state("randomstatesomething").requestUri(requestUri).open();
         assertTrue(errorPage.isCurrent());
         assertEquals("PAR request did not include necessary parameters", errorPage.getError());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        "PAR request did not include necessary parameters").client((String) null)
+                .user((String) null).assertEvent();
 
-        oauth.requestUri(null);
-        pResp = oauth.doPushedAuthorizationRequest(clientBetaId, "secretBeta");
+        oauth.client(clientBetaId, "secretBeta");
+        pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         requestUri = pResp.getRequestUri();
-        oauth.requestUri(requestUri);
 
-        oauth.stateParamHardcoded(null);
         successfulLoginAndLogout(clientBetaId, "secretBeta");
     }
 
@@ -1533,33 +1618,32 @@ public void testSecureParContentsExecutorWithRequestObject() throws Exception {
         ).toString();
         updatePolicies(json);
 
+        oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+
         // Pushed Authorization Request without state parameter
-        oauth.addCustomParameter("request", encodedRequestObject);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(TEST_CLIENT, TEST_CLIENT_SECRET);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().request(encodedRequestObject).send();
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // only query parameters include state parameter
-        oauth.removeCustomParameter("request");
-        oauth.stateParamHardcoded("mystate2");
-        oauth.requestUri(requestUri);
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).state("mystate2").open();
         assertTrue(errorPage.isCurrent());
         assertEquals("PAR request did not include necessary parameters", errorPage.getError());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        "PAR request did not include necessary parameters").client((String) null)
+                .user((String) null).assertEvent();
 
         // Pushed Authorization Request with state parameter
         oidcClientEndpointsResource.setOIDCRequest(REALM_NAME, TEST_CLIENT, oauth.getRedirectUri(), "10", "mystate2", "none");
         encodedRequestObject = oidcClientEndpointsResource.getOIDCRequest();
 
-        oauth.requestUri(null);
-        oauth.addCustomParameter("request", encodedRequestObject);
-        pResp = oauth.doPushedAuthorizationRequest(TEST_CLIENT, TEST_CLIENT_SECRET);
+        pResp = oauth.pushedAuthorizationRequest().request(encodedRequestObject).state("mystate2").send();
         assertEquals(201, pResp.getStatusCode());
         requestUri = pResp.getRequestUri();
 
         // both query parameters and PAR requests include state parameter
-        oauth.removeCustomParameter("request");
-        oauth.requestUri(requestUri);
+        this.requestUri = requestUri;
         successfulLoginAndLogout(TEST_CLIENT, TEST_CLIENT_SECRET);
 
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExtendedEventTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExtendedEventTest.java
index 72e8a338fb54..945ba8a0b40f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExtendedEventTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesExtendedEventTest.java
@@ -73,7 +73,8 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.device.DeviceAuthorizationResponse;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -125,7 +126,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         user.setUsername("create-clients");
         user.setCredentials(credentials);
         user.setClientRoles(Collections.singletonMap(Constants.REALM_MANAGEMENT_CLIENT_ID, Collections.singletonList(AdminRoles.CREATE_CLIENT)));
-        user.setGroups(Arrays.asList("topGroup")); // defined in testrealm.json
+        user.setGroups(List.of("topGroup")); // defined in testrealm.json
 
         users.add(user);
 
@@ -162,7 +163,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigrationCreate() throws Exception {
+    public void testExtendedClientPolicyInterfacesForClientRegistrationPolicyMigrationCreate() throws Exception {
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
@@ -196,9 +197,9 @@ public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigratio
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigrationUpdate() throws Exception {
+    public void testExtendedClientPolicyInterfacesForClientRegistrationPolicyMigrationUpdate() throws Exception {
         String clientName = "ByAdmin-App" + KeycloakModelUtils.generateId().substring(0, 7);
-        String clientId = null;
+        String clientId;
 
         clientId = createClientByAdmin(clientName, (ClientRepresentation clientRep) -> {});
         assertEquals(true, getClientByAdmin(clientId).isEnabled());
@@ -223,9 +224,7 @@ public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigratio
         updatePolicies(json);
 
         try {
-            updateClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-                clientRep.setEnabled(false);
-            });
+            updateClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setEnabled(false));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(ClientPolicyEvent.UPDATED.toString(), cpe.getError());
@@ -244,12 +243,12 @@ public void testExtendedClientPolicyIntefacesForClientRegistrationPolicyMigratio
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForDeviceAuthorizationRequest() throws Exception {
+    public void testExtendedClientPolicyInterfacesForDeviceAuthorizationRequest() throws Exception {
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.DEVICE_AUTHORIZATION_REQUEST)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.DEVICE_AUTHORIZATION_REQUEST)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -265,19 +264,19 @@ public void testExtendedClientPolicyIntefacesForDeviceAuthorizationRequest() thr
 
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, "secret");
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
         assertEquals(400, response.getStatusCode());
         assertEquals(ClientPolicyEvent.DEVICE_AUTHORIZATION_REQUEST.toString(), response.getError());
         assertEquals("Exception thrown intentionally", response.getErrorDescription());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForDeviceTokenRequest() throws Exception {
+    public void testExtendedClientPolicyInterfacesForDeviceTokenRequest() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, "secret");
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -306,7 +305,7 @@ public void testExtendedClientPolicyIntefacesForDeviceTokenRequest() throws Exce
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.DEVICE_TOKEN_REQUEST)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.DEVICE_TOKEN_REQUEST)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -321,18 +320,18 @@ public void testExtendedClientPolicyIntefacesForDeviceTokenRequest() throws Exce
         updatePolicies(json);
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
         assertEquals(400, tokenResponse.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, tokenResponse.getError());
         assertEquals("Exception thrown intentionally", tokenResponse.getErrorDescription());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForDeviceTokenResponse() throws Exception {
+    public void testExtendedClientPolicyInterfacesForDeviceTokenResponse() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, "secret");
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -361,7 +360,7 @@ public void testExtendedClientPolicyIntefacesForDeviceTokenResponse() throws Exc
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.DEVICE_TOKEN_RESPONSE)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.DEVICE_TOKEN_RESPONSE)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -376,14 +375,14 @@ public void testExtendedClientPolicyIntefacesForDeviceTokenResponse() throws Exc
         updatePolicies(json);
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
         assertEquals(400, tokenResponse.getStatusCode());
         assertEquals(ClientPolicyEvent.DEVICE_TOKEN_RESPONSE.toString(), tokenResponse.getError());
         assertEquals("Exception thrown intentionally", tokenResponse.getErrorDescription());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForTokenResponse() throws Exception {
+    public void testExtendedClientPolicyInterfacesForTokenResponse() throws Exception {
         // register a confidential client
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
@@ -397,7 +396,7 @@ public void testExtendedClientPolicyIntefacesForTokenResponse() throws Exception
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.TOKEN_RESPONSE)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.TOKEN_RESPONSE)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -406,25 +405,25 @@ public void testExtendedClientPolicyIntefacesForTokenResponse() throws Exception
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Primera Plitica", Boolean.TRUE)
                         .addCondition(ClientAccessTypeConditionFactory.PROVIDER_ID,
-                                createClientAccessTypeConditionConfig(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
+                                createClientAccessTypeConditionConfig(List.of(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         events.expectLogin().client(clientId).assertEvent();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(400, response.getStatusCode());
         assertEquals(ClientPolicyEvent.TOKEN_RESPONSE.toString(), response.getError());
         assertEquals("Exception thrown intentionally", response.getErrorDescription());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForTokenRefreshResponse() throws Exception {
+    public void testExtendedClientPolicyInterfacesForTokenRefreshResponse() throws Exception {
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
         String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
@@ -435,15 +434,15 @@ public void testExtendedClientPolicyIntefacesForTokenRefreshResponse() throws Ex
         });
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
 
@@ -459,36 +458,36 @@ public void testExtendedClientPolicyIntefacesForTokenRefreshResponse() throws Ex
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
         String refreshTokenString = res.getRefreshToken();
-        OAuthClient.AccessTokenResponse accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+        AccessTokenResponse accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(200, accessTokenResponseRefreshed.getStatusCode());
-        assertEquals(null, accessTokenResponseRefreshed.getRefreshToken());
+        assertNull(accessTokenResponseRefreshed.getRefreshToken());
 
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList("other" + SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of("other" + SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
-        accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+        accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(200, accessTokenResponseRefreshed.getStatusCode());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(accessTokenResponseRefreshed.getRefreshToken());
-        assertEquals(sessionId, refreshedRefreshToken.getSessionState());
-        assertEquals(sessionId, refreshedRefreshToken.getSessionState());
+        assertEquals(sessionId, refreshedRefreshToken.getSessionId());
+        assertEquals(sessionId, refreshedRefreshToken.getSessionId());
         assertEquals(findUserByUsername(adminClient.realm(REALM_NAME), TEST_USER_NAME).getId(), refreshedRefreshToken.getSubject());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForTokenRefreshResponseWithOffline() throws Exception {
+    public void testExtendedClientPolicyInterfacesForTokenRefreshResponseWithOffline() throws Exception {
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
         String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
@@ -500,13 +499,13 @@ public void testExtendedClientPolicyIntefacesForTokenRefreshResponseWithOffline(
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
+        events.expectLogin().client(clientId).assertEvent();
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
         AccessToken token = oauth.verifyToken(res.getAccessToken());
         assertNotNull(token);
@@ -524,25 +523,25 @@ public void testExtendedClientPolicyIntefacesForTokenRefreshResponseWithOffline(
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
-        // now the online session should be removed as it's a offline first request
+        // now the online session should be removed as it's an offline first request
         NotFoundException nfe = Assert.assertThrows(NotFoundException.class,
                 () -> adminClient.realm(REALM_NAME).deleteSession(token.getSessionId(), false));
         Assert.assertEquals(404, nfe.getResponse().getStatus());
 
         String refreshTokenString = res.getRefreshToken();
-        OAuthClient.AccessTokenResponse accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+        AccessTokenResponse accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(200, accessTokenResponseRefreshed.getStatusCode());
         assertNull(accessTokenResponseRefreshed.getRefreshToken());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForServiceAccountTokenRequeponse() throws Exception {
+    public void testExtendedClientPolicyInterfacesForServiceAccountTokenResponse() throws Exception {
         String clientId = "service-account-app";
         String clientSecret = "app-secret";
         createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
@@ -558,7 +557,7 @@ public void testExtendedClientPolicyIntefacesForServiceAccountTokenRequeponse()
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_RESPONSE)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_RESPONSE)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -574,21 +573,16 @@ public void testExtendedClientPolicyIntefacesForServiceAccountTokenRequeponse()
         updatePolicies(json);
 
 
-        String origClientId = oauth.getClientId();
-        oauth.clientId("service-account-app");
+        oauth.client("service-account-app", "app-secret");
         oauth.scope("offline_access");
-        try {
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("app-secret");
-            assertEquals(400, response.getStatusCode());
-            assertEquals(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_RESPONSE.toString(), response.getError());
-            assertEquals("Exception thrown intentionally", response.getErrorDescription());
-        } finally {
-            oauth.clientId(origClientId);
-        }
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
+        assertEquals(400, response.getStatusCode());
+        assertEquals(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_RESPONSE.toString(), response.getError());
+        assertEquals("Exception thrown intentionally", response.getErrorDescription());
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForResourceOwnerPasswordCredentialsResponse() throws Exception {
+    public void testExtendedClientPolicyInterfacesForResourceOwnerPasswordCredentialsResponse() throws Exception {
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
@@ -604,7 +598,7 @@ public void testExtendedClientPolicyIntefacesForResourceOwnerPasswordCredentials
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.RESOURCE_OWNER_PASSWORD_CREDENTIALS_RESPONSE)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.RESOURCE_OWNER_PASSWORD_CREDENTIALS_RESPONSE)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
@@ -619,8 +613,8 @@ public void testExtendedClientPolicyIntefacesForResourceOwnerPasswordCredentials
         ).toString();
         updatePolicies(json);
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(clientSecret, TEST_USER_NAME, TEST_USER_PASSWORD, null);
+        oauth.client(clientId, clientSecret);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         assertEquals(400, response.getStatusCode());
         assertEquals(ClientPolicyEvent.RESOURCE_OWNER_PASSWORD_CREDENTIALS_RESPONSE.toString(), response.getError());
@@ -628,28 +622,26 @@ public void testExtendedClientPolicyIntefacesForResourceOwnerPasswordCredentials
     }
 
     @Test
-    public void testExtendedClientPolicyIntefacesForPreAuthorizationRequest() throws Exception {
+    public void testExtendedClientPolicyInterfacesForPreAuthorizationRequest() throws Exception {
         // register profiles
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forste Profilen")
                         .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
-                                createTestRaiseExeptionExecutorConfig(Arrays.asList(ClientPolicyEvent.PRE_AUTHORIZATION_REQUEST)))
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.PRE_AUTHORIZATION_REQUEST)))
                         .toRepresentation()
         ).toString();
         updateProfiles(json);
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
-        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientSecret);
-        });
+        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         // register policies
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Dei Eischt Politik", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -657,7 +649,7 @@ public void testExtendedClientPolicyIntefacesForPreAuthorizationRequest() throws
 
         // Authorization Request
         oauth.realm(REALM_NAME);
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.openLoginForm();
         assertTrue(errorPage.isCurrent());
         assertEquals("Exception thrown intentionally", errorPage.getError());
@@ -686,18 +678,18 @@ public void testEnhancedPluggableTokenManagerForTokenResponse() throws Exception
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "La Primera Plitica", Boolean.TRUE)
                         .addCondition(ClientAccessTypeConditionFactory.PROVIDER_ID,
-                                createClientAccessTypeConditionConfig(Arrays.asList(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
+                                createClientAccessTypeConditionConfig(List.of(ClientAccessTypeConditionFactory.TYPE_CONFIDENTIAL)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         events.expectLogin().client(clientId).assertEvent();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(200, response.getStatusCode());
         AccessToken token = oauth.verifyToken(response.getAccessToken());
         assertNull(token.getSubject());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesLoadUpdateTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesLoadUpdateTest.java
index c84a8a7f1c01..029263f274e9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesLoadUpdateTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesLoadUpdateTest.java
@@ -128,7 +128,7 @@ public void testUpdateValidProfilesAndPolicies() throws Exception {
         String modifiedProfileDescription = "The profile has been updated.";
         ClientProfilesRepresentation actualProfilesRep = getProfilesWithoutGlobals();
         ClientProfilesBuilder profilesBuilder = new ClientProfilesBuilder();
-        actualProfilesRep.getProfiles().stream().forEach(i->{
+        actualProfilesRep.getProfiles().forEach(i->{
             if (i.getName().equals("ordinal-test-profile")) {
                 i.setDescription(modifiedProfileDescription);
             }
@@ -146,7 +146,7 @@ public void testUpdateValidProfilesAndPolicies() throws Exception {
         String modifiedPolicyDescription = "The policy has also been updated.";
         ClientPoliciesRepresentation actualPoliciesRep = getPolicies();
         ClientPoliciesBuilder policiesBuilder = new ClientPoliciesBuilder();
-        actualPoliciesRep.getPolicies().stream().forEach(i->{
+        actualPoliciesRep.getPolicies().forEach(i->{
             if (i.getName().equals("new-policy")) {
                 i.setDescription(modifiedPolicyDescription);
                 i.setEnabled(null);
@@ -285,24 +285,25 @@ public void testNullProfiles() throws Exception {
     public void testInvalidFormattedJsonProfiles() throws Exception {
         String beforeUpdateProfilesJson = ClientPoliciesUtil.convertClientProfilesRepresentationToJson(getProfilesWithGlobals());
 
-        String json = "{\n"
-                + "    \"profiles\": [\n"
-                + "        {\n"
-                + "            \"name\" : \"ordinal-test-profile\",\n"
-                + "            \"description\" : \"invalid , added.\",\n"
-                + "            \"builtin\" : false,\n"
-                + "            \"executors\": [\n"
-                + "                {\n"
-                + "                    \"new-secure-client-authnenticator\": {\n"
-                + "                        \"client-authns\": [ \"private-key-jwt\" ],\n"
-                + "                        \"client-authns-augment\" : \"private-key-jwt\",\n"
-                + "                        \"is-augment\" : true\n"
-                + "                    }\n"
-                + "                }\n"
-                + "            ]\n"
-                + "        },\n"
-                + "    ]\n"
-                + "}";
+        String json = """
+                {
+                    "profiles": [
+                        {
+                            "name" : "ordinal-test-profile",
+                            "description" : "invalid , added.",
+                            "builtin" : false,
+                            "executors": [
+                                {
+                                    "new-secure-client-authnenticator": {
+                                        "client-authns": [ "private-key-jwt" ],
+                                        "client-authns-augment" : "private-key-jwt",
+                                        "is-augment" : true
+                                    }
+                                }
+                            ]
+                        },
+                    ]
+                }""";
         try {
             updateProfiles(json);
         } catch (ClientPolicyException cpe) {
@@ -318,22 +319,23 @@ public void testInvalidFormattedJsonProfiles() throws Exception {
     public void testInvalidFieldTypeJsonProfiles() throws Exception {
         String beforeUpdateProfilesJson = ClientPoliciesUtil.convertClientProfilesRepresentationToJson(getProfilesWithGlobals());
 
-        String json = "{\n"
-                + "    \"profiles\": [\n"
-                + "        {\n"
-                + "            \"name\" : \"ordinal-test-profile\",\n"
-                + "            \"description\" : \"Not builtin profile that should be skipped.\",\n"
-                + "            \"builtin\" : \"no\",\n"
-                + "            \"executors\": {\n"
-                + "                    \"new-secure-client-authnenticator\": {\n"
-                + "                        \"client-authns\": [ \"private-key-jwt\" ],\n"
-                + "                        \"client-authns-augment\" : \"private-key-jwt\",\n"
-                + "                        \"is-augment\" : true\n"
-                + "                    }\n"
-                + "            ]\n"
-                + "        }\n"
-                + "    ]\n"
-                + "}";
+        String json = """
+                {
+                    "profiles": [
+                        {
+                            "name" : "ordinal-test-profile",
+                            "description" : "Not builtin profile that should be skipped.",
+                            "builtin" : "no",
+                            "executors": {
+                                    "new-secure-client-authnenticator": {
+                                        "client-authns": [ "private-key-jwt" ],
+                                        "client-authns-augment" : "private-key-jwt",
+                                        "is-augment" : true
+                                    }
+                            ]
+                        }
+                    ]
+                }""";
         try {
             updateProfiles(json);
         } catch (ClientPolicyException cpe) {
@@ -356,7 +358,7 @@ public void testDuplicatedPolicies() throws Exception {
                         "builtin duplicated new policy is ignored.",
                         Boolean.TRUE)
                     .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                        createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                        createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(FAPI1_BASELINE_PROFILE_NAME)
                     .toRepresentation();
 
@@ -407,24 +409,25 @@ public void testNullPolicies() throws Exception {
     public void testInvalidFormattedJsonPolicies() throws Exception {
         String beforeUpdatePoliciesJson = ClientPoliciesUtil.convertClientPoliciesRepresentationToJson(getPolicies());
 
-        String json = "{\n"
-                + "    \"policies\": [\n"
-                + "        {\n"
-                + "            \"name\": \"ordinal-test-policy\",\n"
-                + "            \"description\" : \"bracket not enclosed properly.\",\n"
-                + "            \"builtin\": false,\n"
-                + "            \"enable\": true,\n"
-                + "            \"conditions\": [\n"
-                + "                {\n"
-                + "                    \"new-client-updater-source-host\": {\n"
-                + "                        \"trusted-hosts\": [\"myuniversity\"],\n"
-                + "                        \"host-sending-request-must-match\" : [true]\n"
-                + "                    }\n"
-                + "                }\n"
-                + "            ],\n"
-                + "            \"profiles\": [ \"builtin-advanced-security\" ]\n"
-                + "        }\n"
-                + "}";
+        String json = """
+                {
+                    "policies": [
+                        {
+                            "name": "ordinal-test-policy",
+                            "description" : "bracket not enclosed properly.",
+                            "builtin": false,
+                            "enable": true,
+                            "conditions": [
+                                {
+                                    "new-client-updater-source-host": {
+                                        "trusted-hosts": ["myuniversity"],
+                                        "host-sending-request-must-match" : [true]
+                                    }
+                                }
+                            ],
+                            "profiles": [ "builtin-advanced-security" ]
+                        }
+                }""";
         try {
             updatePolicies(json);
         } catch (ClientPolicyException cpe) {
@@ -440,18 +443,20 @@ public void testInvalidFormattedJsonPolicies() throws Exception {
     public void testInvalidFieldTypeJsonPolicies() throws Exception {
         String beforeUpdatePoliciesJson = ClientPoliciesUtil.convertClientPoliciesRepresentationToJson(getPolicies());
 
-        String json = "{    \n"
-                + "    \"policies\": [    \n"
-                + "        {    \n"
-                + "            \"name\": \"ordinal-test-policy\",    \n"
-                + "            \"description\" : \"Not builtin policy that should be skipped.\",    \n"
-                + "            \"builtin\": false,    \n"
-                + "            \"enable\": true,    \n"
-                + "            \"conditions\": true,    \n"
-                + "            \"profiles\": [ \"builtin-advanced-security\" ]    \n"
-                + "        }    \n"
-                + "    ]    \n"
-                + "}";
+        // the field "conditions" should take an array of condition objects.
+        String json = """
+                {
+                    "policies": [
+                        {
+                            "name": "ordinal-test-policy",
+                            "description" : "Not builtin policy that should be skipped.",
+                            "builtin": false,
+                            "enable": true,
+                            "conditions": true,
+                            "profiles": [ "builtin-advanced-security" ]
+                        }
+                    ]
+                }""";
         try {
             updatePolicies(json);
         } catch (ClientPolicyException cpe) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesTest.java
index 94bead432bd9..a325c1f868f6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/ClientPoliciesTest.java
@@ -36,6 +36,7 @@
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createClientUpdateContextConditionConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createConsentRequiredExecutorConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createFullScopeDisabledExecutorConfig;
+import static org.keycloak.testsuite.util.ClientPoliciesUtil.createGrantTypeConditionConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createHolderOfKeyEnforceExecutorConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createIntentClientBindCheckExecutorConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createPKCEEnforceExecutorConfig;
@@ -44,14 +45,17 @@
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createSecureClientAuthenticatorExecutorConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createSecureSigningAlgorithmForSignedJwtEnforceExecutorConfig;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createTestRaiseExeptionConditionConfig;
+import static org.keycloak.testsuite.util.ClientPoliciesUtil.createTestRaiseExeptionExecutorConfig;
 
 import java.io.IOException;
+import java.net.URL;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import jakarta.ws.rs.core.Response;
 
@@ -70,7 +74,9 @@
 import org.keycloak.authentication.authenticators.client.JWTClientSecretAuthenticator;
 import org.keycloak.authentication.authenticators.client.X509ClientAuthenticator;
 import org.keycloak.common.Profile;
+import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.Time;
+import org.keycloak.common.util.UriUtils;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
@@ -93,6 +99,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
 import org.keycloak.services.clientpolicy.ClientPolicyException;
 import org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory;
 import org.keycloak.services.clientpolicy.condition.ClientAccessTypeConditionFactory;
@@ -101,6 +108,7 @@
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterContextConditionFactory;
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceGroupsConditionFactory;
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceRolesConditionFactory;
+import org.keycloak.services.clientpolicy.condition.GrantTypeConditionFactory;
 import org.keycloak.services.clientpolicy.executor.ConfidentialClientAcceptExecutorFactory;
 import org.keycloak.services.clientpolicy.executor.ConsentRequiredExecutorFactory;
 import org.keycloak.services.clientpolicy.executor.FullScopeDisabledExecutorFactory;
@@ -117,14 +125,17 @@
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.services.clientpolicy.condition.TestRaiseExceptionConditionFactory;
+import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutorFactory;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.util.ClientBuilder;
+import org.keycloak.testsuite.util.ClientPoliciesUtil;
 import org.keycloak.testsuite.util.MutualTLSUtils;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPoliciesBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.testsuite.util.UserBuilder;
@@ -168,7 +179,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         user.setUsername("create-clients");
         user.setCredentials(credentials);
         user.setClientRoles(Collections.singletonMap(Constants.REALM_MANAGEMENT_CLIENT_ID, Collections.singletonList(AdminRoles.CREATE_CLIENT)));
-        user.setGroups(Arrays.asList("topGroup")); // defined in testrealm.json
+        user.setGroups(List.of("topGroup")); // defined in testrealm.json
 
         users.add(user);
 
@@ -223,9 +234,7 @@ public void testTwoProfilesWithDifferentConfigurationOfSameExecutorType() throws
         updateProfiles(json);
 
         // Make sure it is still possible to create client with JWTClientSecretAuthenticator. The "UnusedProfile" should not be used as it is not referenced from any client policy
-        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> {
-            clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID);
-        });
+        String cId = createClientByAdmin(generateSuffixedName(CLIENT_NAME), (ClientRepresentation clientRep) -> clientRep.setClientAuthenticatorType(JWTClientSecretAuthenticator.PROVIDER_ID));
         assertEquals(JWTClientSecretAuthenticator.PROVIDER_ID, getClientByAdmin(cId).getClientAuthenticatorType());
     }
 
@@ -281,9 +290,7 @@ public void testCreateUpdateDeleteConditionRuntime() throws Exception {
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
-        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientSecret);
-        });
+        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         successfulLoginAndLogout(clientId, clientSecret);
@@ -292,7 +299,7 @@ public void testCreateUpdateDeleteConditionRuntime() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Dei Eischt Politik", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -303,7 +310,7 @@ public void testCreateUpdateDeleteConditionRuntime() throws Exception {
         // update policies
         updatePolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Dei Aktualiseiert Eischt Politik", Boolean.TRUE)
                 .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                        createClientRolesConditionConfig(Arrays.asList("anothor-client-role")))
+                        createClientRolesConditionConfig(List.of("anothor-client-role")))
                 .addProfile(PROFILE_NAME)
                 .toRepresentation());
 
@@ -332,18 +339,16 @@ public void testCreateUpdateDeleteExecutorRuntime() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Porishii Sono Ichi", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                                createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                                createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                         .toRepresentation()
         ).toString();
         updatePolicies(json);
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secret";
-        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientSecret);
-        });
+        String cid = createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         successfulLoginAndLogout(clientId, clientSecret);
@@ -351,9 +356,9 @@ public void testCreateUpdateDeleteExecutorRuntime() throws Exception {
         // update policies
         updatePolicy((new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Koushinsareta Porishii Sono Ichi", Boolean.TRUE)
                 .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                        createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                        createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                 .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                        createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                        createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                 .addProfile(PROFILE_NAME)
                 .toRepresentation());
 
@@ -366,9 +371,7 @@ public void testCreateUpdateDeleteExecutorRuntime() throws Exception {
                                 createPKCEEnforceExecutorConfig(Boolean.TRUE))
                         .toRepresentation());
 
-        updateClientByAdmin(cid, (ClientRepresentation clientRep) -> {
-            clientRep.setServiceAccountsEnabled(Boolean.FALSE);
-        });
+        updateClientByAdmin(cid, (ClientRepresentation clientRep) -> clientRep.setServiceAccountsEnabled(Boolean.FALSE));
         assertEquals(false, getClientByAdmin(cid).isServiceAccountsEnabled());
         assertEquals(OAuth2Constants.PKCE_METHOD_S256, OIDCAdvancedConfigWrapper.fromClientRepresentation(getClientByAdmin(cid)).getPkceCodeChallengeMethod());
 
@@ -376,10 +379,8 @@ public void testCreateUpdateDeleteExecutorRuntime() throws Exception {
         updateProfile(
                 (new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Sarani Koushinsareta Purofairu Sono Ichi").toRepresentation());
 
-        updateClientByAdmin(cid, (ClientRepresentation clientRep) -> {
-            OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setPkceCodeChallengeMethod(null);
-        });
-        assertEquals(null, OIDCAdvancedConfigWrapper.fromClientRepresentation(getClientByAdmin(cid)).getPkceCodeChallengeMethod());
+        updateClientByAdmin(cid, (ClientRepresentation clientRep) -> OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setPkceCodeChallengeMethod(null));
+        assertNull(OIDCAdvancedConfigWrapper.fromClientRepresentation(getClientByAdmin(cid)).getPkceCodeChallengeMethod());
 
         successfulLoginAndLogout(clientId, clientSecret);
     }
@@ -416,7 +417,7 @@ public void testMultiplePolicies() throws Exception {
         String json = (new ClientProfilesBuilder()).addProfile(
                 (new ClientProfileBuilder()).createProfile(profileAlphaName, "Pierwszy Profil")
                         .addExecutor(SecureClientAuthenticatorExecutorFactory.PROVIDER_ID,
-                                createSecureClientAuthenticatorExecutorConfig(Arrays.asList(ClientIdAndSecretAuthenticator.PROVIDER_ID), ClientIdAndSecretAuthenticator.PROVIDER_ID))
+                                createSecureClientAuthenticatorExecutorConfig(List.of(ClientIdAndSecretAuthenticator.PROVIDER_ID), ClientIdAndSecretAuthenticator.PROVIDER_ID))
                         .toRepresentation()).addProfile(
                 (new ClientProfileBuilder()).createProfile(profileBetaName, "Drugi Profil")
                         .addExecutor(PKCEEnforcerExecutorFactory.PROVIDER_ID,
@@ -433,7 +434,7 @@ public void testMultiplePolicies() throws Exception {
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
                                 createClientRolesConditionConfig(Arrays.asList(roleAlphaName, roleZetaName)))
                         .addCondition(ClientUpdaterContextConditionFactory.PROVIDER_ID,
-                                createClientUpdateContextConditionConfig(Arrays.asList(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
+                                createClientUpdateContextConditionConfig(List.of(ClientUpdaterContextConditionFactory.BY_AUTHENTICATED_USER)))
                         .addProfile(profileAlphaName)
                         .toRepresentation()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(policyBetaName, "Drugi Zasada", Boolean.TRUE)
@@ -467,9 +468,7 @@ public void testMultiplePolicies() throws Exception {
         rolesResourceAlpha.create(RoleBuilder.create().name(roleCommonName).build());
 
         String clientBetaId = generateSuffixedName("Beta-App");
-        String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret("secretBeta");
-        });
+        String cBetaId = createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> clientRep.setSecret("secretBeta"));
         RolesResource rolesResourceBeta = adminClient.realm(REALM_NAME).clients().get(cBetaId).roles();
         rolesResourceBeta.create(RoleBuilder.create().name(roleBetaName).build());
         rolesResourceBeta.create(RoleBuilder.create().name(roleCommonName).build());
@@ -596,7 +595,7 @@ public void testSuppressRefreshTokenRotationWithHolderOfKeyToken() throws Except
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Den Forste Politikken", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -608,26 +607,32 @@ public void testSuppressRefreshTokenRotationWithHolderOfKeyToken() throws Except
             OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setUseMtlsHoKToken(true);
             cau.update();
             // Check login.
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
             Assert.assertNull(loginResponse.getError());
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
             // Check token obtaining.
-            OAuthClient.AccessTokenResponse accessTokenResponse;
+            AccessTokenResponse accessTokenResponse;
             try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-                accessTokenResponse = oauth.doAccessTokenRequest(code, TEST_CLIENT_SECRET, client);
+                oauth.httpClient().set(client);
+                accessTokenResponse = oauth.doAccessTokenRequest(code);
             } catch (IOException ioe) {
                 throw new RuntimeException(ioe);
+            } finally {
+                oauth.httpClient().reset();
             }
             assertEquals(200, accessTokenResponse.getStatusCode());
 
             // Check token refresh.
-            OAuthClient.AccessTokenResponse accessTokenResponseRefreshed;
+            AccessTokenResponse accessTokenResponseRefreshed;
             try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-                accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), TEST_CLIENT_SECRET, client);
+                oauth.httpClient().set(client);
+                accessTokenResponseRefreshed = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
             } catch (IOException ioe) {
                 throw new RuntimeException(ioe);
+            } finally {
+                oauth.httpClient().reset();
             }
             assertEquals(200, accessTokenResponseRefreshed.getStatusCode());
             assertNull(accessTokenResponseRefreshed.getRefreshToken());
@@ -655,9 +660,7 @@ public void testNegativeLogicCondition() throws Exception {
 
         String clientId = generateSuffixedName(CLIENT_NAME);
         String clientSecret = "secretBeta";
-        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret(clientSecret);
-        });
+        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> clientRep.setSecret(clientSecret));
 
         try {
             failLoginWithoutSecureSessionParameter(clientId, ERR_MSG_MISSING_NONCE);
@@ -713,7 +716,7 @@ public void testConfidentialClientAcceptExecutorExecutor() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Erstes Politik", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -742,10 +745,10 @@ public void testConfidentialClientAcceptExecutorExecutor() throws Exception {
         });
         adminClient.realm(REALM_NAME).clients().get(cidPublic).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
-        oauth.clientId(clientPublicId);
+        oauth.client(clientPublicId);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_CLIENT, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("invalid client access type", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        assertEquals(OAuthErrorException.INVALID_CLIENT, oauth.parseLoginResponse().getError());
+        assertEquals("invalid client access type", oauth.parseLoginResponse().getErrorDescription());
     }
 
     @Test
@@ -778,9 +781,7 @@ public void testConsentRequiredExecutorExecutor() throws Exception {
         assertEquals(Boolean.TRUE, clientRep.isConsentRequired());
 
         // Client cannot be updated to disable consentRequired
-        updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-            cRep.setConsentRequired(Boolean.FALSE);
-        });
+        updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setConsentRequired(Boolean.FALSE));
         clientRep = getClientByAdmin(cid);
         assertEquals(Boolean.TRUE, clientRep.isConsentRequired());
 
@@ -794,9 +795,7 @@ public void testConsentRequiredExecutorExecutor() throws Exception {
 
         // Not possible to register client with consentRequired due the validation
         try {
-            createClientByAdmin(clientId, (ClientRepresentation clientRep2) -> {
-                clientRep2.setConsentRequired(Boolean.FALSE);
-            });
+            createClientByAdmin(clientId, (ClientRepresentation clientRep2) -> clientRep2.setConsentRequired(Boolean.FALSE));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(Errors.INVALID_REGISTRATION, cpe.getError());
@@ -804,9 +803,7 @@ public void testConsentRequiredExecutorExecutor() throws Exception {
 
         // Not possible to update existing client to consentRequired due the validation
         try {
-            updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-                cRep.setConsentRequired(Boolean.FALSE);
-            });
+            updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setConsentRequired(Boolean.FALSE));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(Errors.INVALID_REGISTRATION, cpe.getError());
@@ -815,9 +812,7 @@ public void testConsentRequiredExecutorExecutor() throws Exception {
         assertEquals(Boolean.TRUE, clientRep.isConsentRequired());
 
         try {
-            updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-                cRep.setImplicitFlowEnabled(Boolean.TRUE);
-            });
+            updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setImplicitFlowEnabled(Boolean.TRUE));
             clientRep = getClientByAdmin(cid);
             assertEquals(Boolean.TRUE, clientRep.isImplicitFlowEnabled());
             assertEquals(Boolean.TRUE, clientRep.isConsentRequired());
@@ -838,7 +833,7 @@ public void testConsentRequiredExecutorWithClientRolesCondition() throws Excepti
         updatePolicies(new ClientPoliciesBuilder().addPolicy(
                 new ClientPolicyBuilder().createPolicy(POLICY_NAME, "Test Policy", Boolean.TRUE)
                         .addCondition(ClientRolesConditionFactory.PROVIDER_ID,
-                                createClientRolesConditionConfig(Arrays.asList(SAMPLE_CLIENT_ROLE)))
+                                createClientRolesConditionConfig(List.of(SAMPLE_CLIENT_ROLE)))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()).toString());
 
@@ -854,9 +849,7 @@ public void testConsentRequiredExecutorWithClientRolesCondition() throws Excepti
         adminClient.realm(REALM_NAME).clients().get(cid).roles().create(RoleBuilder.create().name(SAMPLE_CLIENT_ROLE).build());
 
         // update with consent to false should be updated to true by autoconfigure
-        updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-            cRep.setConsentRequired(Boolean.FALSE);
-        });
+        updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setConsentRequired(Boolean.FALSE));
         Assert.assertTrue(getClientByAdmin(cid).isConsentRequired());
     }
 
@@ -890,9 +883,7 @@ public void testFullScopeDisabledExecutor() throws Exception {
         assertEquals(Boolean.FALSE, clientRep.isFullScopeAllowed());
 
         // Client cannot be updated to disable fullScopeAllowed
-        updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-            cRep.setFullScopeAllowed(Boolean.TRUE);
-        });
+        updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setFullScopeAllowed(Boolean.TRUE));
         clientRep = getClientByAdmin(cid);
         assertEquals(Boolean.FALSE, clientRep.isFullScopeAllowed());
 
@@ -906,9 +897,7 @@ public void testFullScopeDisabledExecutor() throws Exception {
 
         // Not possible to register client with fullScopeAllowed due the validation
         try {
-            createClientByAdmin(clientId, (ClientRepresentation clientRep2) -> {
-                clientRep2.setFullScopeAllowed(Boolean.TRUE);
-            });
+            createClientByAdmin(clientId, (ClientRepresentation clientRep2) -> clientRep2.setFullScopeAllowed(Boolean.TRUE));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(Errors.INVALID_REGISTRATION, cpe.getError());
@@ -916,9 +905,7 @@ public void testFullScopeDisabledExecutor() throws Exception {
 
         // Not possible to update existing client to fullScopeAllowed due the validation
         try {
-            updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-                cRep.setFullScopeAllowed(Boolean.TRUE);
-            });
+            updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setFullScopeAllowed(Boolean.TRUE));
             fail();
         } catch (ClientPolicyException cpe) {
             assertEquals(Errors.INVALID_REGISTRATION, cpe.getError());
@@ -927,9 +914,7 @@ public void testFullScopeDisabledExecutor() throws Exception {
         assertEquals(Boolean.FALSE, clientRep.isFullScopeAllowed());
 
         try {
-            updateClientByAdmin(cid, (ClientRepresentation cRep) -> {
-                cRep.setImplicitFlowEnabled(Boolean.TRUE);
-            });
+            updateClientByAdmin(cid, (ClientRepresentation cRep) -> cRep.setImplicitFlowEnabled(Boolean.TRUE));
             clientRep = getClientByAdmin(cid);
             assertEquals(Boolean.TRUE, clientRep.isImplicitFlowEnabled());
             assertEquals(Boolean.FALSE, clientRep.isFullScopeAllowed());
@@ -970,8 +955,8 @@ public void testRejectResourceOwnerCredentialsGrantExecutor() throws Exception {
         ).toString();
         updatePolicies(json);
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(clientSecret, TEST_USER_NAME, TEST_USER_PASSWORD, null);
+        oauth.client(clientId, clientSecret);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -990,9 +975,7 @@ public void testRejectRequestExecutor() throws Exception {
         updateProfiles(json);
 
         String clientBetaId = generateSuffixedName("Beta-App");
-        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> {
-            clientRep.setSecret("secretBeta");
-        });
+        createClientByAdmin(clientBetaId, (ClientRepresentation clientRep) -> clientRep.setSecret("secretBeta"));
 
         // register policies
         json = (new ClientPoliciesBuilder()).addPolicy(
@@ -1005,10 +988,14 @@ public void testRejectRequestExecutor() throws Exception {
         updatePolicies(json);
 
         try {
-            oauth.clientId(clientBetaId);
+            oauth.client(clientBetaId);
             oauth.openLoginForm();
             assertTrue(errorPage.isCurrent());
             assertEquals(ERR_MSG_REQ_NOT_ALLOWED, errorPage.getError());
+            events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                            Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                            ERR_MSG_REQ_NOT_ALLOWED).client((String) null).user((String) null).assertEvent();
+
             revertToBuiltinProfiles();
             successfulLoginAndLogout(clientBetaId, "secretBeta");
         } catch (Exception e) {
@@ -1031,7 +1018,7 @@ public void whenCreateDynamicClientSecretExpirationDateMustExist() throws Except
         });
         OIDCClientRepresentation response = getClientDynamically(clientId);
         assertThat(response.getClientSecret(), notNullValue());
-        assertThat(response.getClientSecretExpiresAt().intValue(), greaterThan(0));
+        assertThat(response.getClientSecretExpiresAt(), greaterThan(0));
 
     }
 
@@ -1053,9 +1040,7 @@ public void whenUpdateDynamicClientRotationMustFollowConfiguration() throws Exce
         String firstSecret = response.getClientSecret();
         Integer firstSecretExpiration = response.getClientSecretExpiresAt();
 
-        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> {
-            clientRep.setContacts(Collections.singletonList("keycloak@keycloak.org"));
-        });
+        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> clientRep.setContacts(Collections.singletonList("keycloak@keycloak.org")));
 
         OIDCClientRepresentation updated = getClientDynamically(clientId);
 
@@ -1066,9 +1051,7 @@ public void whenUpdateDynamicClientRotationMustFollowConfiguration() throws Exce
         //force secret expiration
         setTimeOffset(61);
 
-        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> {
-            clientRep.setClientName(generateSuffixedName(CLIENT_NAME));
-        });
+        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> clientRep.setClientName(generateSuffixedName(CLIENT_NAME)));
 
         updated = getClientDynamically(clientId);
         String updatedSecret = updated.getClientSecret();
@@ -1120,9 +1103,7 @@ public void whenUpdateDynamicClientDuringRemainingExpirationPeriodMustRotateSecr
         setTimeOffset(41);
 
         //update client to force rotation (due to remaining expiration)
-        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> {
-            clientRep.setContacts(Collections.singletonList("keycloak@keycloak.org"));
-        });
+        updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> clientRep.setContacts(Collections.singletonList("keycloak@keycloak.org")));
 
         OIDCClientRepresentation updated = getClientDynamically(clientId);
 
@@ -1149,7 +1130,7 @@ public void testIntentClientBindCheck() throws Exception {
         json = (new ClientPoliciesBuilder()).addPolicy(
                 (new ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Het Eerste Beleid", Boolean.TRUE)
                         .addCondition(ClientScopesConditionFactory.PROVIDER_ID,
-                                createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, Arrays.asList("microprofile-jwt")))
+                                createClientScopesConditionConfig(ClientScopesConditionFactory.OPTIONAL, List.of("microprofile-jwt")))
                         .addProfile(PROFILE_NAME)
                         .toRepresentation()
         ).toString();
@@ -1164,6 +1145,7 @@ public void testIntentClientBindCheck() throws Exception {
             clientRep.setImplicitFlowEnabled(Boolean.TRUE);
         });
         ClientResource app = findClientResourceByClientId(adminClient.realm("test"), clientId);
+        assert app != null;
         ProtocolMappersResource res = app.getProtocolMappers();
         res.createMapper(ModelToRepresentation.toRepresentation(ClaimsParameterWithValueIdTokenMapper.createMapper("claimsParameterWithValueIdTokenMapper", "openbanking_intent_id", true))).close();
 
@@ -1193,27 +1175,30 @@ public void testIntentClientBindCheck() throws Exception {
 
         // send an authorization request
         oauth.scope("openid" + " " + "microprofile-jwt");
-        oauth.request(request);
-        oauth.clientId(clientId);
-        oauth.nonce(nonce);
+        oauth.client(clientId, clientSecret);
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentFragment().get(OAuth2Constants.ERROR));
-        assertEquals("The intent is not bound with the client", oauth.getCurrentFragment().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().nonce(nonce).request(request).open();
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("The intent is not bound with the client", authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                "The intent is not bound with the client").client(clientId).user((String) null)
+                .assertEvent();
 
         // register a binding of an intent with a valid client
         r = testingClient.testApp().oidcClientEndpoints().bindIntentWithClient(intentId, clientId);
         assertEquals(204, r.getStatus());
 
         // send an authorization request
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        oauth.loginForm().request(request).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         // check an authorization response
         EventRepresentation loginEvent = events.expectLogin().client(clientId).assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentFragment().get(OAuth2Constants.CODE);
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, true);
+        String code = oauth.parseLoginResponse().getCode();
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         JWSInput idToken = new JWSInput(authzResponse.getIdToken());
         ObjectMapper mapper = JsonSerialization.mapper;
         JsonParser parser = mapper.getFactory().createParser(idToken.readContentAsString());
@@ -1222,20 +1207,19 @@ public void testIntentClientBindCheck() throws Exception {
         assertEquals(intentId, clientBoundIntentId);
 
         // send a token request
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         // check a token response
         assertEquals(200, response.getStatusCode());
         events.expectCodeToToken(codeId, sessionId).client(clientId).assertEvent();
         idToken = new JWSInput(response.getIdToken());
-        mapper = JsonSerialization.mapper;
         parser = mapper.getFactory().createParser(idToken.readContentAsString());
         treeNode = mapper.readTree(parser);
         clientBoundIntentId = ((TextNode) treeNode.get(intentName)).asText();
         assertEquals(intentId, clientBoundIntentId);
 
         // logout
-        oauth.doLogout(response.getRefreshToken(), clientSecret);
+        oauth.doLogout(response.getRefreshToken());
         events.expectLogout(response.getSessionState()).client(clientId).clearDetails().assertEvent();
 
         // create a request object with invalid claims
@@ -1248,10 +1232,14 @@ public void testIntentClientBindCheck() throws Exception {
         request = new JWSBuilder().jsonContent(oidcRequest).none();
 
         // send an authorization request
-        oauth.request(request);
-        oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentFragment().get(OAuth2Constants.ERROR));
-        assertEquals("no claim for an intent value for ID token" , oauth.getCurrentFragment().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().request(request).open();
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(OAuthErrorException.INVALID_REQUEST, authorizationEndpointResponse.getError());
+        assertEquals("no claim for an intent value for ID token" , authorizationEndpointResponse.getErrorDescription());
+        events.expectClientPolicyError(EventType.LOGIN_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        Details.CLIENT_POLICY_ERROR, OAuthErrorException.INVALID_REQUEST,
+                        "no claim for an intent value for ID token").client(clientId)
+                .user((String) null).assertEvent();
     }
 
     @Test
@@ -1288,7 +1276,7 @@ public void testRejectImplicitGrantExecutor() throws Exception {
 
         try {
             String expectedErrorDescription = "Implicit/Hybrid flow is prohibited.";
-            oauth.clientId(clientId);
+            oauth.client(clientId);
 
             // implicit grant
             testProhibitedImplicitOrHybridFlow(false, OIDCResponseType.TOKEN, null, OAuthErrorException.INVALID_REQUEST, expectedErrorDescription);
@@ -1306,17 +1294,109 @@ public void testRejectImplicitGrantExecutor() throws Exception {
             // revert test client instance settings the same as OAuthClient.init
             oauth.openid(true);
             oauth.responseType(OIDCResponseType.CODE);
-            oauth.nonce(null);
         }
     }
 
+    @Test
+    public void testClientGrantTypeCondition() throws Exception {
+
+        String clientId = generateSuffixedName(CLIENT_NAME);
+        String clientSecret = "secret";
+        createClientByAdmin(clientId, (ClientRepresentation clientRep) -> {
+            clientRep.setSecret(clientSecret);
+            clientRep.setServiceAccountsEnabled(true);
+            clientRep.setImplicitFlowEnabled(true);
+            clientRep.setStandardFlowEnabled(true);
+            clientRep.setAttributes(Map.of(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_ENABLED, "true"));
+        });
+        oauth.client(clientId, clientSecret);
+
+        //auth code
+        successfulLogin(clientId, clientSecret);
+
+        configureClientPolicyToBlockGrantTypes(ClientPolicyEvent.AUTHORIZATION_REQUEST, List.of(OAuth2Constants.AUTHORIZATION_CODE));
+        oauth.openLogoutForm();
+        oauth.openLoginForm();
+        MultivaluedHashMap<String, String> queryParams = UriUtils.decodeQueryString(new URL(Objects.requireNonNull(driver.getCurrentUrl())).getQuery());
+        assertEquals(ClientPolicyEvent.AUTHORIZATION_REQUEST.toString(), queryParams.getFirst("error"));
+        assertEquals("Exception thrown intentionally", queryParams.getFirst("error_description"));
+        revertToBuiltinPolicies();
+
+        //password
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        configureClientPolicyToBlockGrantTypes(ClientPolicyEvent.RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST, List.of(OAuth2Constants.PASSWORD));
+        response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
+        assertGrantTypeBlock(response, ClientPolicyEvent.RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST);
+        revertToBuiltinPolicies();
+
+        //client credentials
+        response = oauth.clientCredentialsGrantRequest().send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        configureClientPolicyToBlockGrantTypes(ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST, List.of(OAuth2Constants.CLIENT_CREDENTIALS));
+        response = oauth.clientCredentialsGrantRequest().send();
+        assertGrantTypeBlock(response, ClientPolicyEvent.SERVICE_ACCOUNT_TOKEN_REQUEST);
+        revertToBuiltinPolicies();
+
+        //refresh
+        response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        response = oauth.refreshRequest(response.getRefreshToken()).send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        configureClientPolicyToBlockGrantTypes(ClientPolicyEvent.TOKEN_REFRESH, List.of(OAuth2Constants.REFRESH_TOKEN));
+        response = oauth.refreshRequest(response.getRefreshToken()).send();
+        assertGrantTypeBlock(response, ClientPolicyEvent.TOKEN_REFRESH);
+        revertToBuiltinPolicies();
+
+        //token exchange
+        response = oauth.doPasswordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        response = oauth.tokenExchangeRequest(response.getAccessToken()).send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        configureClientPolicyToBlockGrantTypes(ClientPolicyEvent.TOKEN_EXCHANGE_REQUEST, List.of(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE));
+        response = oauth.tokenExchangeRequest(response.getAccessToken()).send();
+        assertGrantTypeBlock(response, ClientPolicyEvent.TOKEN_EXCHANGE_REQUEST);
+        revertToBuiltinPolicies();
+    }
+
+    private void assertGrantTypeBlock(AccessTokenResponse response, ClientPolicyEvent event){
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(event.toString(), response.getError());
+        assertEquals("Exception thrown intentionally", response.getErrorDescription());
+    }
+
+    private void configureClientPolicyToBlockGrantTypes(ClientPolicyEvent event, List<String> grantTypes) throws Exception {
+
+        String json = (new ClientPoliciesUtil.ClientProfilesBuilder()).addProfile(
+                (new ClientPoliciesUtil.ClientProfileBuilder()).createProfile(PROFILE_NAME, "Profilo")
+                        .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
+                                createTestRaiseExeptionExecutorConfig(List.of(event)))
+                        .toRepresentation()
+        ).toString();
+        updateProfiles(json);
+
+        // register policy with condition on client scope optional-scope2
+        json = (new ClientPoliciesUtil.ClientPoliciesBuilder()).addPolicy(
+                (new ClientPoliciesUtil.ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Client Policy", Boolean.TRUE)
+                        .addCondition(GrantTypeConditionFactory.PROVIDER_ID,
+                                createGrantTypeConditionConfig(grantTypes))
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+        updatePolicies(json);
+    }
+
     private void testProhibitedImplicitOrHybridFlow(boolean isOpenid, String responseType, String nonce, String expectedError, String expectedErrorDescription) {
         oauth.openid(isOpenid);
         oauth.responseType(responseType);
-        oauth.nonce(nonce);
-        oauth.openLoginForm();
-        assertEquals(expectedError, oauth.getCurrentFragment().get(OAuth2Constants.ERROR));
-        assertEquals(expectedErrorDescription, oauth.getCurrentFragment().get(OAuth2Constants.ERROR_DESCRIPTION));
+        oauth.loginForm().nonce(nonce).open();
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        assertEquals(expectedError, authorizationEndpointResponse.getError());
+        assertEquals(expectedErrorDescription, authorizationEndpointResponse.getErrorDescription());
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java
index 0b36233ac16b..d50174c71217 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/policies/SecureRedirectUrisEnforcerExecutorTest.java
@@ -35,7 +35,8 @@
 import org.keycloak.services.clientpolicy.condition.AnyClientConditionFactory;
 import org.keycloak.services.clientpolicy.executor.SecureRedirectUrisEnforcerExecutorFactory;
 import org.keycloak.testsuite.util.ClientPoliciesUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.ServerURLs;
 
 import java.util.Arrays;
@@ -76,7 +77,7 @@ public void testNotRedirectBasedFlowClient_normalUri() throws Exception {
 
         // Registration
         // Success - even if not setting a valid redirect uri
-        String clientId = null;
+        String clientId;
         String cId = null;
         try {
             clientId = generateSuffixedName(CLIENT_NAME);
@@ -553,9 +554,7 @@ public void testSecureRedirectUrisEnforcerExecutor_postLogoutRedirectUris() thro
         String json = (new ClientPoliciesUtil.ClientProfilesBuilder()).addProfile(
                 (new ClientPoliciesUtil.ClientProfileBuilder()).createProfile(PROFILE_NAME, "Le Premier Profil")
                         .addExecutor(SecureRedirectUrisEnforcerExecutorFactory.PROVIDER_ID,
-                                createSecureRedirectUrisEnforcerExecutorConfig(it-> {
-                                    it.setAllowPermittedDomains(List.of("oauth.redirect"));
-                                })
+                                createSecureRedirectUrisEnforcerExecutorConfig(it-> it.setAllowPermittedDomains(List.of("oauth.redirect")))
                         )
                         .toRepresentation()
         ).toString();
@@ -693,19 +692,19 @@ private void testSecureRedirectUrisEnforcerExecutor_successUpdateByAdmin(String
     }
 
     private void testSecureRedirectUrisEnforcerExecutor_failAuthorizationRequest(String clientId, String redirectUri) {
-        oauth.clientId(clientId);
+        oauth.client(clientId);
         oauth.redirectUri(redirectUri);
         oauth.openLoginForm();
         assertTrue(errorPage.isCurrent());
     }
 
     private void testSecureRedirectUrisEnforcerExecutor_successAuthorizationRequest(String clientId, String redirectUri) {
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
         oauth.redirectUri(redirectUri);
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(response.getCode(), "secret");
+        AccessTokenResponse res = oauth.doAccessTokenRequest(response.getCode());
         assertEquals(200, res.getStatusCode());
-        oauth.doLogout(res.getRefreshToken(), "secret");
+        oauth.doLogout(res.getRefreshToken());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AbstractFailoverClusterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AbstractFailoverClusterTest.java
index e68a2bd38c86..2b22f7befe14 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AbstractFailoverClusterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AbstractFailoverClusterTest.java
@@ -32,7 +32,7 @@
 import org.keycloak.testsuite.pages.InfoPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.URLUtils;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.openqa.selenium.Cookie;
@@ -43,7 +43,7 @@
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 import static org.keycloak.testsuite.util.WaitUtils.pause;
 
 public abstract class AbstractFailoverClusterTest extends AbstractClusterTest {
@@ -138,8 +138,7 @@ protected Cookie login() {
     }
 
     protected void logout() {
-        String logoutUrl = oauth.getLogoutUrl().build();
-        driver.navigate().to(logoutUrl);
+        oauth.openLogoutForm();
 
         logoutConfirmPage.assertCurrent();
         logoutConfirmPage.confirmLogout();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AuthenticationSessionClusterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AuthenticationSessionClusterTest.java
index 06a896968e7c..199c812db4c0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AuthenticationSessionClusterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/AuthenticationSessionClusterTest.java
@@ -34,7 +34,7 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.pages.LoginUpdateProfilePage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import jakarta.ws.rs.core.UriBuilder;
 import java.util.HashSet;
@@ -81,15 +81,10 @@ public void after() {
 
     @Test
     public void testAuthSessionCookieWithAttachedRoute() throws Exception {
-        // TODO Maybe add compatibility between cluster and cross-dc tests regarding route name (jboss.node.name). Cross-dc tests use arquillian container qualifier when cluster tests just 'node1' .
-//        String node1Route = backendNode(0).getArquillianContainer().getName();
-//        String node2Route = backendNode(1).getArquillianContainer().getName();
-
-        OAuthClient oAuthClient = new OAuthClient();
-        oAuthClient.init(driver);
+        OAuthClient oAuthClient = oauth;
         oAuthClient.baseUrl(UriBuilder.fromUri(backendNode(0).getUriBuilder().build() + "/auth").build("test").toString());
 
-        String testAppLoginNode1URL = oAuthClient.getLoginFormUrl();
+        String testAppLoginNode1URL = oAuthClient.loginForm().build();
 
         Set<String> visitedRoutes = new HashSet<>();
         for (int i = 0; i < 20; i++) {
@@ -110,11 +105,10 @@ public void testAuthSessionCookieWithAttachedRoute() throws Exception {
 
     @Test
     public void testAuthSessionCookieWithoutRoute() throws Exception {
-        OAuthClient oAuthClient = new OAuthClient();
-        oAuthClient.init(driver);
+        OAuthClient oAuthClient = oauth;
         oAuthClient.baseUrl(UriBuilder.fromUri(backendNode(0).getUriBuilder().build() + "/auth").build("test").toString());
 
-        String testAppLoginNode1URL = oAuthClient.getLoginFormUrl();
+        String testAppLoginNode1URL = oAuthClient.loginForm().build();
 
         // Disable route on backend server
         getTestingClientFor(backendNode(0)).server().run(session -> {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/JGroupsCertificateRotationClusterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/JGroupsCertificateRotationClusterTest.java
new file mode 100644
index 000000000000..42560e58a243
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cluster/JGroupsCertificateRotationClusterTest.java
@@ -0,0 +1,213 @@
+package org.keycloak.testsuite.cluster;
+
+import java.time.Duration;
+import java.time.temporal.ChronoUnit;
+
+import org.awaitility.Awaitility;
+import org.infinispan.factories.GlobalComponentRegistry;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.junit.Assume;
+import org.junit.Test;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
+import org.keycloak.jgroups.certificates.CertificateReloadManager;
+import org.keycloak.jgroups.certificates.DatabaseJGroupsCertificateProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.spi.infinispan.JGroupsCertificateProvider;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertTrue;
+
+public class JGroupsCertificateRotationClusterTest extends AbstractClusterTest {
+
+    @Test
+    public void testRotation() {
+        Assume.assumeTrue(getClusterSize() >= 2);
+        Assume.assumeTrue(isMtlsEnabled());
+
+        assertClusterSize();
+
+        var alias = currentCertificateAliasFor(0);
+        log.infof("Current JGroups Certificate alias: %s", alias);
+
+        // test rotation in all the nodes
+        for (int i = 0; i < getClusterSize(); ++i) {
+            rotateCertificate(i);
+            assertAliasNotEquals(alias);
+
+            alias = currentCertificateAliasFor(i);
+            log.infof("Current JGroups Certificate alias after rotation: %s", alias);
+        }
+    }
+
+    @Test
+    public void testAutoRotation() {
+        Assume.assumeTrue(getClusterSize() >= 2);
+        Assume.assumeTrue(isMtlsEnabled());
+
+        try (var revert = overwriteRotation(5, ChronoUnit.SECONDS)) {
+            assertClusterSize();
+
+            var alias = currentCertificateAliasFor(0);
+            log.infof("Current JGroups Certificate alias: %s", alias);
+
+            // The certificate should rotate after 5 seconds
+            assertAliasNotEquals(alias);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Test
+    public void testCoordinatorHasScheduleTask() {
+        Assume.assumeTrue(getClusterSize() >= 2);
+        Assume.assumeTrue(isMtlsEnabled());
+
+        var alias = currentCertificateAliasFor(0);
+        log.infof("Current JGroups Certificate alias: %s", alias);
+
+        int coordinatorIdx = -1;
+        for (int i = 0; i < getClusterSize(); ++i) {
+            if (isCoordinator(i)) {
+                assertTrue(hasRotationTask(i));
+                coordinatorIdx = i;
+                break;
+            }
+        }
+
+        assertTrue(coordinatorIdx >= 0);
+        killBackendNode(backendNode(coordinatorIdx));
+        failback();
+        assertClusterSize();
+
+        // new coordinator should be the next in line
+        coordinatorIdx++;
+        if (coordinatorIdx >= getClusterSize()) {
+            coordinatorIdx = 0;
+        }
+
+        assertTrue(isCoordinator(coordinatorIdx));
+        assertTrue(hasRotationTask(coordinatorIdx));
+    }
+
+    private boolean isMtlsEnabled() {
+        boolean isMtlsEnabled = true;
+        for (int i = 0; i < getClusterSize(); ++i) {
+            var crmEnabled = getTestingClientFor(backendNode(i))
+                    .server()
+                    .fetch(session -> {
+                        var crm = certificateReloadManager(session);
+                        return crm != null;
+                    }, Boolean.class);
+
+            isMtlsEnabled = isMtlsEnabled && crmEnabled;
+        }
+
+        return isMtlsEnabled;
+    }
+
+    private AutoCloseable overwriteRotation(long amount, ChronoUnit timeUnit) {
+        long previousRotationSeconds = 0;
+        for (int i = 0; i < getClusterSize(); ++i) {
+            previousRotationSeconds = getTestingClientFor(backendNode(i))
+                    .server()
+                    .fetch(session -> {
+                        var crm = certificateReloadManager(session);
+                        if (crm == null) {
+                            throw new RuntimeException("MTLS is not enabled");
+                        }
+                        var provider = databaseJGroupsCertificateProvider(session);
+                        var originalRotation = provider.getRotationPeriod();
+                        databaseJGroupsCertificateProvider(session).setRotationPeriod(Duration.of(amount, timeUnit));
+                        if (crm.isCoordinator()) {
+                            crm.rotateCertificate();
+                        }
+                        return originalRotation.toSeconds();
+                    }, Long.class);
+        }
+
+        long finalPreviousRotationSeconds = previousRotationSeconds;
+        return () -> {
+            for (int i = 0; i < getClusterSize(); ++i) {
+                getTestingClientFor(backendNode(i))
+                        .server()
+                        .run(session -> {
+                            var crm = certificateReloadManager(session);
+                            if (crm == null) {
+                                throw new RuntimeException("MTLS is not enabled");
+                            }
+                            databaseJGroupsCertificateProvider(session).setRotationPeriod(Duration.ofSeconds(finalPreviousRotationSeconds));
+                            if (crm.isCoordinator()) {
+                                crm.rotateCertificate();
+                            }
+                        });
+            }
+        };
+    }
+
+    private void assertAliasNotEquals(String alias) {
+        for (int i = 0; i < getClusterSize(); ++i) {
+            int nodeIdx = i;
+            Awaitility.waitAtMost(Duration.ofMinutes(1))
+                    .pollDelay(Duration.ofSeconds(1))
+                    .untilAsserted(() -> assertNotEquals(alias, currentCertificateAliasFor(nodeIdx)));
+        }
+    }
+
+    private String currentCertificateAliasFor(int index) {
+        return getTestingClientFor(backendNode(index)).server().fetch(JGroupsCertificateRotationClusterTest::currentCertificateAlias, String.class);
+    }
+
+    private void rotateCertificate(int index) {
+        getTestingClientFor(backendNode(index)).server().run(JGroupsCertificateRotationClusterTest::rotateCertificate);
+    }
+
+    private boolean isCoordinator(int index) {
+        return getTestingClientFor(backendNode(index)).server().fetch(session -> certificateReloadManager(session).isCoordinator(), Boolean.class);
+    }
+
+    private boolean hasRotationTask(int index) {
+        return getTestingClientFor(backendNode(index)).server().fetch(session -> certificateReloadManager(session).hasRotationTask(), Boolean.class);
+    }
+
+    private int fetchClusterSize(int index) {
+        return getTestingClientFor(backendNode(index)).server().fetch(session -> cacheManager(session).getMembers().size(), Integer.class);
+    }
+
+    private void assertClusterSize(){
+        var expectedSize = getClusterSize();
+        for (int i = 0; i < expectedSize; ++i) {
+            var nodeIndex = i;
+            Awaitility.waitAtMost(Duration.ofMinutes(1))
+                    .pollDelay(Duration.ofSeconds(1))
+                    .untilAsserted(() -> assertEquals(expectedSize, fetchClusterSize(nodeIndex)));
+        }
+    }
+
+    private static CertificateReloadManager certificateReloadManager(KeycloakSession session) {
+        return GlobalComponentRegistry.componentOf(cacheManager(session), CertificateReloadManager.class);
+    }
+
+    private static DatabaseJGroupsCertificateProvider databaseJGroupsCertificateProvider(KeycloakSession session) {
+        return (DatabaseJGroupsCertificateProvider) session.getProvider(JGroupsCertificateProvider.class);
+    }
+
+    private static EmbeddedCacheManager cacheManager(KeycloakSession session) {
+        return session.getProvider(InfinispanConnectionProvider.class)
+                .getCache(InfinispanConnectionProvider.USER_CACHE_NAME)
+                .getCacheManager();
+    }
+
+    private static String currentCertificateAlias(KeycloakSession session) {
+        return databaseJGroupsCertificateProvider(session)
+                .getCurrentCertificate()
+                .getAlias();
+    }
+
+    private static void rotateCertificate(KeycloakSession session) {
+        certificateReloadManager(session).rotateCertificate();
+    }
+
+}
+
+
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeImportRoleTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeImportRoleTest.java
index ac7a2afbb66b..2831dbffdf40 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeImportRoleTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeImportRoleTest.java
@@ -23,7 +23,7 @@
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.List;
 
@@ -48,11 +48,11 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     @Test
     public void testAppCompositeUser() throws Exception {
         oauth.realm("test");
-        oauth.clientId("APP_COMPOSITE_APPLICATION");
+        oauth.client("APP_COMPOSITE_APPLICATION", "password");
         oauth.doLogin("APP_COMPOSITE_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -72,11 +72,11 @@ public void testAppCompositeUser() throws Exception {
     @Test
     public void testRealmAppCompositeUser() throws Exception {
         oauth.realm("test");
-        oauth.clientId("APP_ROLE_APPLICATION");
+        oauth.client("APP_ROLE_APPLICATION", "password");
         oauth.doLogin("REALM_APP_COMPOSITE_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -95,11 +95,11 @@ public void testRealmAppCompositeUser() throws Exception {
     @Test
     public void testRealmOnlyWithUserCompositeAppComposite() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_COMPOSITE_1_APPLICATION");
+        oauth.client("REALM_COMPOSITE_1_APPLICATION", "password");
         oauth.doLogin("REALM_COMPOSITE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -117,11 +117,11 @@ public void testRealmOnlyWithUserCompositeAppComposite() throws Exception {
     @Test
     public void testRealmOnlyWithUserCompositeAppRole() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_ROLE_1_APPLICATION");
+        oauth.client("REALM_ROLE_1_APPLICATION", "password");
         oauth.doLogin("REALM_COMPOSITE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -138,11 +138,11 @@ public void testRealmOnlyWithUserCompositeAppRole() throws Exception {
     @Test
     public void testRealmOnlyWithUserRoleAppComposite() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_COMPOSITE_1_APPLICATION");
+        oauth.client("REALM_COMPOSITE_1_APPLICATION", "password");
         oauth.doLogin("REALM_ROLE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeRoleTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeRoleTest.java
index b7fbf0a8a8e1..7b2b2ffbded5 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeRoleTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/composites/CompositeRoleTest.java
@@ -31,7 +31,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.RolesBuilder;
@@ -221,11 +221,11 @@ private void addClientLevelScopeMapping(String targetClientId, String sourceClie
     @Test
     public void testAppCompositeUser() throws Exception {
         oauth.realm("test");
-        oauth.clientId("APP_COMPOSITE_APPLICATION");
+        oauth.client("APP_COMPOSITE_APPLICATION", "password");
         oauth.doLogin("APP_COMPOSITE_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -240,7 +240,7 @@ public void testAppCompositeUser() throws Exception {
         Assert.assertTrue(token.getResourceAccess("APP_ROLE_APPLICATION").isUserInRole("APP_ROLE_1"));
         Assert.assertTrue(token.getRealmAccess().isUserInRole("REALM_ROLE_1"));
 
-        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, refreshResponse.getStatusCode());
     }
 
@@ -248,11 +248,11 @@ public void testAppCompositeUser() throws Exception {
     @Test
     public void testRealmAppCompositeUser() throws Exception {
         oauth.realm("test");
-        oauth.clientId("APP_ROLE_APPLICATION");
+        oauth.client("APP_ROLE_APPLICATION", "password");
         oauth.doLogin("REALM_APP_COMPOSITE_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -265,18 +265,18 @@ public void testRealmAppCompositeUser() throws Exception {
         Assert.assertEquals(1, token.getResourceAccess("APP_ROLE_APPLICATION").getRoles().size());
         Assert.assertTrue(token.getResourceAccess("APP_ROLE_APPLICATION").isUserInRole("APP_ROLE_1"));
 
-        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, refreshResponse.getStatusCode());
     }
 
     @Test
     public void testRealmOnlyWithUserCompositeAppComposite() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_COMPOSITE_1_APPLICATION");
+        oauth.client("REALM_COMPOSITE_1_APPLICATION", "password");
         oauth.doLogin("REALM_COMPOSITE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -290,18 +290,18 @@ public void testRealmOnlyWithUserCompositeAppComposite() throws Exception {
         Assert.assertTrue(token.getRealmAccess().isUserInRole("REALM_COMPOSITE_1"));
         Assert.assertTrue(token.getRealmAccess().isUserInRole("REALM_ROLE_1"));
 
-        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, refreshResponse.getStatusCode());
     }
 
     @Test
     public void testRealmOnlyWithUserCompositeAppRole() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_ROLE_1_APPLICATION");
+        oauth.client("REALM_ROLE_1_APPLICATION", "password");
         oauth.doLogin("REALM_COMPOSITE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -314,18 +314,18 @@ public void testRealmOnlyWithUserCompositeAppRole() throws Exception {
         Assert.assertEquals(1, token.getRealmAccess().getRoles().size());
         Assert.assertTrue(token.getRealmAccess().isUserInRole("REALM_ROLE_1"));
 
-        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, refreshResponse.getStatusCode());
     }
 
     @Test
     public void testRealmOnlyWithUserRoleAppComposite() throws Exception {
         oauth.realm("test");
-        oauth.clientId("REALM_COMPOSITE_1_APPLICATION");
+        oauth.client("REALM_COMPOSITE_1_APPLICATION", "password");
         oauth.doLogin("REALM_ROLE_1_USER", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -338,7 +338,7 @@ public void testRealmOnlyWithUserRoleAppComposite() throws Exception {
         Assert.assertEquals(1, token.getRealmAccess().getRoles().size());
         Assert.assertTrue(token.getRealmAccess().isUserInRole("REALM_ROLE_1"));
 
-        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, refreshResponse.getStatusCode());
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/CookieTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/CookieTest.java
index fda42b80e178..fd57cd765498 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/CookieTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/CookieTest.java
@@ -40,8 +40,9 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.HttpClientUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.openqa.selenium.Cookie;
 
@@ -99,14 +100,14 @@ private void testCookieValue(String cookieName) throws Exception {
         final String accountClientId = realmsResouce().realm("test").clients().findByClientId("test-app").get(0).getId();
         final String clientSecret = realmsResouce().realm("test").clients().get(accountClientId).getSecret().getValue();
 
-        AuthorizationEndpointResponse codeResponse = oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).doLogin("test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse accTokenResp = oauth.doAccessTokenRequest(codeResponse.getCode(), clientSecret);
+        AuthorizationEndpointResponse codeResponse = oauth.client("test-app", clientSecret).redirectUri(oauth.APP_AUTH_ROOT).doLogin("test-user@localhost", "password");
+        AccessTokenResponse accTokenResp = oauth.doAccessTokenRequest(codeResponse.getCode());
         String accessToken = accTokenResp.getAccessToken();
 
         appPage.open();
         appPage.assertCurrent();
 
-        try (CloseableHttpClient hc = OAuthClient.newCloseableHttpClient()) {
+        try (CloseableHttpClient hc = HttpClientUtils.createDefault()) {
             BasicCookieStore cookieStore = new BasicCookieStore();
             BasicClientCookie cookie = new BasicClientCookie(cookieName, accessToken);
             cookie.setDomain("localhost");
@@ -116,7 +117,7 @@ private void testCookieValue(String cookieName) throws Exception {
             HttpContext localContext = new BasicHttpContext();
             localContext.setAttribute(HttpClientContext.COOKIE_STORE, cookieStore);
 
-            HttpGet get = new HttpGet(oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).getLoginFormUrl());
+            HttpGet get = new HttpGet(oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).loginForm().build());
             try (CloseableHttpResponse resp = hc.execute(get, localContext)) {
                 final String pageContent = EntityUtils.toString(resp.getEntity());
 
@@ -136,15 +137,15 @@ public void testCookieValueLoggedOut() throws Exception {
         final String accountClientId = realmsResouce().realm("test").clients().findByClientId("test-app").get(0).getId();
         final String clientSecret = realmsResouce().realm("test").clients().get(accountClientId).getSecret().getValue();
 
-        AuthorizationEndpointResponse codeResponse = oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).doLogin("test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse accTokenResp = oauth.doAccessTokenRequest(codeResponse.getCode(), clientSecret);
+        AuthorizationEndpointResponse codeResponse = oauth.client("test-app", clientSecret).redirectUri(oauth.APP_AUTH_ROOT).doLogin("test-user@localhost", "password");
+        AccessTokenResponse accTokenResp = oauth.doAccessTokenRequest(codeResponse.getCode());
         String accessToken = accTokenResp.getAccessToken();
 
         appPage.open();
         appPage.assertCurrent();
         AccountHelper.logout(realmsResouce().realm("test"), "test-user@localhost");
 
-        try (CloseableHttpClient hc = OAuthClient.newCloseableHttpClient()) {
+        try (CloseableHttpClient hc = HttpClientUtils.createDefault()) {
             BasicCookieStore cookieStore = new BasicCookieStore();
             BasicClientCookie cookie = new BasicClientCookie(CookieType.IDENTITY.getName(), accessToken);
             cookie.setDomain("localhost");
@@ -154,7 +155,7 @@ public void testCookieValueLoggedOut() throws Exception {
             HttpContext localContext = new BasicHttpContext();
             localContext.setAttribute(HttpClientContext.COOKIE_STORE, cookieStore);
 
-            HttpGet get = new HttpGet(oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).getLoginFormUrl());
+            HttpGet get = new HttpGet(oauth.clientId("test-app").redirectUri(oauth.APP_AUTH_ROOT).loginForm().build());
             try (CloseableHttpResponse resp = hc.execute(get, localContext)) {
                 final String pageContent = EntityUtils.toString(resp.getEntity());
 
@@ -173,10 +174,7 @@ public void testCookieValueLoggedOut() throws Exception {
     public void testNoDuplicationsWhenExpiringCookies() throws IOException {
         ContainerAssume.assumeAuthServerSSL();
 
-        loginPage.open();
-        loginPage.assertCurrent();
-
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
         appPage.assertCurrent();
 
         driver.navigate().to(oauth.AUTH_SERVER_ROOT + "/realms/test/login-actions/authenticate/");
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/DefaultCookieProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/DefaultCookieProviderTest.java
index 89ceba06b743..eb5e497703a0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/DefaultCookieProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/cookies/DefaultCookieProviderTest.java
@@ -44,6 +44,7 @@ public void testCookieDefaults() {
 
             CookieProvider cookies = session.getProvider(CookieProvider.class);
             cookies.set(CookieType.AUTH_SESSION_ID, "my-auth-session-id");
+            cookies.set(CookieType.AUTH_SESSION_ID_HASH, "my-kc-auth-session");
             cookies.set(CookieType.AUTH_RESTART, "my-auth-restart");
             cookies.set(CookieType.AUTH_DETACHED, "my-auth-detached", 222);
             cookies.set(CookieType.IDENTITY, "my-identity", 333);
@@ -52,8 +53,9 @@ public void testCookieDefaults() {
             cookies.set(CookieType.SESSION, "my-session", 444);
             cookies.set(CookieType.WELCOME_CSRF, "my-welcome-csrf");
         });
-        Assert.assertEquals(8, response.getCookies().size());
+        Assert.assertEquals(9, response.getCookies().size());
         assertCookie(response, "AUTH_SESSION_ID", "my-auth-session-id", "/auth/realms/master/", -1, true, true, "None", true);
+        assertCookie(response, "KC_AUTH_SESSION_HASH", "my-kc-auth-session", "/auth/realms/master/", 60, true, false, "None", true);
         assertCookie(response, "KC_RESTART", "my-auth-restart", "/auth/realms/master/", -1, true, true, "None", false);
         assertCookie(response, "KC_STATE_CHECKER", "my-auth-detached", "/auth/realms/master/", 222, true, true, "Strict", false);
         assertCookie(response, "KEYCLOAK_IDENTITY", "my-identity", "/auth/realms/master/", 333, true, true, "None", true);
@@ -81,7 +83,7 @@ public void testCookieDefaultsWithInsecureContext() {
         });
         Assert.assertEquals(9, response.getCookies().size());
         assertCookie(response, "AUTH_SESSION_ID", "my-auth-session-id", "/auth/realms/master/", -1, false, true, "Lax", true);
-        assertCookie(response, "KC_AUTH_SESSION_HASH", "my-kc-auth-session", "/auth/realms/master/", 60, false, false, "Strict", true);
+        assertCookie(response, "KC_AUTH_SESSION_HASH", "my-kc-auth-session", "/auth/realms/master/", 60, false, false, "Lax", true);
         assertCookie(response, "KC_RESTART", "my-auth-restart", "/auth/realms/master/", -1, false, true, "Lax", false);
         assertCookie(response, "KC_STATE_CHECKER", "my-auth-detached", "/auth/realms/master/", 222, false, true, "Strict", false);
         assertCookie(response, "KEYCLOAK_IDENTITY", "my-identity", "/auth/realms/master/", 333, false, true, "Lax", true);
@@ -198,7 +200,7 @@ public void testSafariQuirks() {
 
         Assert.assertEquals(9, response.getCookies().size());
         assertCookie(response, "AUTH_SESSION_ID", "my-auth-session-id", "/auth/realms/master/", -1, false, true, "Lax", true);
-        assertCookie(response, "KC_AUTH_SESSION_HASH", "my-kc-auth-session", "/auth/realms/master/", 60, false, false, "Strict", true);
+        assertCookie(response, "KC_AUTH_SESSION_HASH", "my-kc-auth-session", "/auth/realms/master/", 60, false, false, "Lax", true);
         assertCookie(response, "KC_RESTART", "my-auth-restart", "/auth/realms/master/", -1, false, true, "Lax", false);
         assertCookie(response, "KC_STATE_CHECKER", "my-auth-detached", "/auth/realms/master/", 222, false, true, "Strict", false);
         assertCookie(response, "KEYCLOAK_IDENTITY", "my-identity", "/auth/realms/master/", 333, false, true, "Lax", true);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractAdminCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractAdminCrossDCTest.java
deleted file mode 100644
index b0adac859ac3..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractAdminCrossDCTest.java
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.crossdc;
-
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.events.log.JBossLoggingEventListenerProviderFactory;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.common.util.Retry;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics;
-import org.keycloak.testsuite.events.TestEventsListenerProviderFactory;
-import org.keycloak.testsuite.util.TestCleanup;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.BiConsumer;
-import java.util.function.Function;
-import org.hamcrest.Matcher;
-import org.junit.Before;
-import static org.hamcrest.MatcherAssert.assertThat;
-import org.keycloak.representations.idm.ClientRepresentation;
-
-/**
- *
- * @author hmlnarik
- */
-public abstract class AbstractAdminCrossDCTest extends AbstractCrossDCTest {
-
-    protected static final String REALM_NAME = "admin-client-test";
-
-    protected RealmResource realm;
-    protected String realmId;
-
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        log.debug("Configuring test realm '" + testRealm.getRealm() + "'. Enabling direct access grant.");
-        ClientRepresentation testApp = findTestApp(testRealm);
-        if (testApp == null) {
-            throw new IllegalStateException("Couldn't find the 'test-app' within the realm '" + testRealm.getRealm() + "'");
-        }
-        testApp.setDirectAccessGrantsEnabled(true);
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        log.debug("--DC: AbstractAdminCrossDCTest.addTestRealms - adding realm: " + REALM_NAME);
-        super.addTestRealms(testRealms);
-
-        RealmRepresentation adminRealmRep = new RealmRepresentation();
-        adminRealmRep.setId(REALM_NAME);
-        adminRealmRep.setRealm(REALM_NAME);
-        adminRealmRep.setEnabled(true);
-        Map<String, String> config = new HashMap<>();
-        config.put("from", "auto@keycloak.org");
-        config.put("host", "localhost");
-        config.put("port", "3025");
-        adminRealmRep.setSmtpServer(config);
-
-        List<String> eventListeners = new ArrayList<>();
-        eventListeners.add(JBossLoggingEventListenerProviderFactory.ID);
-        eventListeners.add(TestEventsListenerProviderFactory.PROVIDER_ID);
-        adminRealmRep.setEventsListeners(eventListeners);
-
-        testRealms.add(adminRealmRep);
-    }
-
-    @Before
-    public void setRealm() {
-        log.debug("--DC: AbstractAdminCrossDCTest.setRealm");
-        realm = adminClient.realm(REALM_NAME);
-        realmId = realm.toRepresentation().getId();
-    }
-
-    @Override
-    protected TestCleanup getCleanup() {
-        return getCleanup(REALM_NAME);
-    }
-
-    protected <T extends Comparable> void assertSingleStatistics(InfinispanStatistics stats, String key, Runnable testedCode, Function<T, Matcher<? super T>> matcherOnOldStat) {
-        stats.reset();
-
-        T oldStat = (T) stats.getSingleStatistics(key);
-        testedCode.run();
-
-        Retry.execute(() -> {
-            T newStat = (T) stats.getSingleStatistics(key);
-
-            Matcher<? super T> matcherInstance = matcherOnOldStat.apply(oldStat);
-            
-            log.infof("assertSingleStatistics '%s' : oldStat: %s, newStat: %s", key, oldStat.toString(), newStat.toString());
-            assertThat(newStat, matcherInstance);
-        }, 50, 200);
-    }
-
-    protected void assertStatistics(InfinispanStatistics stats, Runnable testedCode, BiConsumer<Map<String, Object>, Map<String, Object>> assertionOnStats) {
-        stats.reset();
-
-        Map<String, Object> oldStat = stats.getStatistics();
-        testedCode.run();
-
-        Retry.execute(() -> {
-            Map<String, Object> newStat = stats.getStatistics();
-            assertionOnStats.accept(oldStat, newStat);
-        }, 50, 200);
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractCrossDCTest.java
deleted file mode 100644
index 28dd71fcd976..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/AbstractCrossDCTest.java
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.crossdc;
-
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
-import org.keycloak.testsuite.arquillian.AuthServerTestEnricher;
-import org.keycloak.testsuite.arquillian.ContainerInfo;
-import org.keycloak.testsuite.arquillian.LoadBalancerController;
-import org.keycloak.testsuite.arquillian.annotation.LoadBalancer;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import org.jboss.arquillian.test.api.ArquillianResource;
-import org.junit.After;
-import org.junit.Before;
-import org.keycloak.testsuite.client.KeycloakTestingClient;
-
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.arquillian.CrossDCTestEnricher;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-
-import static org.keycloak.testsuite.arquillian.CrossDCTestEnricher.forAllBackendNodesStream;
-
-
-/**
- * Abstract cross-data-centre test that defines primitives for handling cross-DC setup.
- * @author hmlnarik
- */
-@InitialDcState
-public abstract class AbstractCrossDCTest extends AbstractTestRealmKeycloakTest {
-
-    // Keep the following constants in sync with arquillian
-    public static final String QUALIFIER_NODE_BALANCER = "auth-server-balancer-cross-dc";
-    public static final String QUALIFIER_AUTH_SERVER_DC_0_NODE_1 = "auth-server-${node.name}-cross-dc-0_1";
-    public static final String QUALIFIER_AUTH_SERVER_DC_1_NODE_1 = "auth-server-${node.name}-cross-dc-1_1";
-
-    @ArquillianResource
-    @LoadBalancer(value = QUALIFIER_NODE_BALANCER)
-    protected LoadBalancerController loadBalancerCtrl;
-
-    @Before
-    @Override
-    public void beforeAbstractKeycloakTest() throws Exception {
-        enableOnlyFirstNodeInFirstDc();
-
-        super.beforeAbstractKeycloakTest();
-    }
-
-    @After
-    @Override
-    public void afterAbstractKeycloakTest() throws Exception {
-        log.debug("--DC: after AbstractCrossDCTest");
-        CrossDCTestEnricher.startAuthServerBackendNode(DC.FIRST, 0);    // make sure first node is started
-        enableOnlyFirstNodeInFirstDc();
-
-        super.afterAbstractKeycloakTest();
-
-        removeTestRealms();
-        loadBalancerCtrl.disableAllBackendNodes();
-    }
-
-    private void enableOnlyFirstNodeInFirstDc() {
-        log.debug("--DC: Enable only first node in first datacenter @ load balancer");
-        this.loadBalancerCtrl.disableAllBackendNodes();
-        if (!CrossDCTestEnricher.getBackendNode(DC.FIRST, 0).isStarted()) {
-            throw new IllegalStateException("--DC: Trying to enable not started node on load-balancer");
-        }
-        loadBalancerCtrl.enableBackendNodeByName(CrossDCTestEnricher.getBackendNode(DC.FIRST, 0).getQualifier());
-    }
-
-    private void removeTestRealms() {
-        testContext.getTestRealmReps().stream().forEach((RealmRepresentation realm) -> deleteAllCookiesForRealm(realm.getRealm()));
-
-        log.debug("--DC: removing rest realms");
-        AuthServerTestEnricher.removeTestRealms(testContext, adminClient);
-        testContext.setTestRealmReps(new ArrayList<>());
-    }
-
-    protected Keycloak getAdminClientForStartedNodeInDc(int dcIndex) {
-        ContainerInfo firstStartedNode = this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex).stream()
-                .filter(ContainerInfo::isStarted)
-                .findFirst().get();
-
-        return getAdminClientFor(firstStartedNode);
-    }
-
-    /**
-     * Get admin client directed to the given node.
-     * @param node
-     * @return
-     */
-    protected Keycloak getAdminClientFor(ContainerInfo node) {
-        Keycloak client = CrossDCTestEnricher.getBackendAdminClients().get(node);
-        if (client == null && node.equals(suiteContext.getAuthServerInfo())) {
-            client = this.adminClient;
-        }
-        return client;
-    }
-
-    protected KeycloakTestingClient getTestingClientForStartedNodeInDc(int dcIndex) {
-        ContainerInfo firstStartedNode = this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex).stream()
-                .filter(ContainerInfo::isStarted)
-                .findFirst().get();
-
-        return getTestingClientFor(firstStartedNode);
-    }
-
-    /**
-     * Get testing client directed to the given node.
-     * @param node
-     * @return
-     */
-    protected KeycloakTestingClient getTestingClientFor(ContainerInfo node) {
-        KeycloakTestingClient client = CrossDCTestEnricher.getBackendTestingClients().get(node);
-        if (client == null && node.equals(suiteContext.getAuthServerInfo())) {
-            client = this.testingClient;
-        }
-        return client;
-    }
-
-    /**
-     * Disables routing requests to the given data center in the load balancer.
-     * @param dc
-     */
-    public void disableDcOnLoadBalancer(DC dc) {
-        int dcIndex = dc.ordinal();
-        log.infof("--DC: Disabling load balancer for dc=%d", dcIndex);
-        this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex).forEach(containerInfo -> {
-            loadBalancerCtrl.disableBackendNodeByName(containerInfo.getQualifier());
-        });
-    }
-
-    /**
-     * Enables routing requests to all started nodes to the given data center in the load balancer.
-     * @param dc
-     */
-    public void enableDcOnLoadBalancer(DC dc) {
-        int dcIndex = dc.ordinal();
-        log.infof("--DC: Enabling load balancer for dc=%d", dcIndex);
-        final List<ContainerInfo> dcNodes = this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex);
-        if (! dcNodes.stream().anyMatch(ContainerInfo::isStarted)) {
-            log.warnf("--DC: No node is started in DC %d", dcIndex);
-        } else {
-            dcNodes.stream()
-              .filter(ContainerInfo::isStarted)
-              .forEach(containerInfo -> {
-                  loadBalancerCtrl.enableBackendNodeByName(containerInfo.getQualifier());
-              });
-        }
-    }
-
-    /**
-     * Disables routing requests to the given node within the given data center in the load balancer.
-     * @param dc
-     * @param nodeIndex
-     */
-    public void disableLoadBalancerNode(DC dc, int nodeIndex) {
-        int dcIndex = dc.ordinal();
-        log.infof("--DC: Disabling load balancer for dc=%d, node=%d", dcIndex, nodeIndex);
-        loadBalancerCtrl.disableBackendNodeByName(this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex).get(nodeIndex).getQualifier());
-    }
-
-    /**
-     * Enables routing requests to the given node within the given data center in the load balancer.
-     * @param dc
-     * @param nodeIndex
-     */
-    public void enableLoadBalancerNode(DC dc, int nodeIndex) {
-        int dcIndex = dc.ordinal();
-        log.infof("--DC: Enabling load balancer for dc=%d, node=%d", dcIndex, nodeIndex);
-        final ContainerInfo backendNode = this.suiteContext.getDcAuthServerBackendsInfo().get(dcIndex).get(nodeIndex);
-        if (backendNode == null) {
-            throw new IllegalArgumentException("Invalid node with index " + nodeIndex + " for DC " + dcIndex);
-        }
-        if (! backendNode.isStarted()) {
-            log.warnf("--DC: Node %s is not started in DC %d", backendNode.getQualifier(), dcIndex);
-        }
-        loadBalancerCtrl.enableBackendNodeByName(backendNode.getQualifier());
-    }
-
-    /**
-     * Sets time offset on all the started containers.
-     *
-     * @param offset
-     */
-    @Override
-    public void setTimeOffset(int offset) {
-        super.setTimeOffset(offset);
-        setTimeOffsetOnAllStartedContainers(offset);
-    }
-
-    private void setTimeOffsetOnAllStartedContainers(int offset) {
-        CrossDCTestEnricher.getBackendTestingClients().entrySet().stream()
-                .filter(testingClientEntry -> testingClientEntry.getKey().isStarted())
-                .map(testingClientEntry -> testingClientEntry.getValue())
-                .forEach(testingClient -> testingClient.testing().setTimeOffset(Collections.singletonMap("offset", String.valueOf(offset))));
-    }
-
-    /**
-     * Resets time offset on all the started containers.
-     */
-    @Override
-    public void resetTimeOffset() {
-        super.resetTimeOffset();
-        setTimeOffsetOnAllStartedContainers(0);
-    }
-
-    protected void setInfinispanTestTimeServiceOnAllStartedAuthServers() {
-        forAllBackendNodesStream()
-                .filter(ContainerInfo::isStarted)
-                .forEach(this::setInfinispanTestTimeServiceonAuthServer);
-    }
-
-    private void setInfinispanTestTimeServiceonAuthServer(ContainerInfo backendAuthServer) {
-        log.infof("Set Infinispan Test Time Service for backend server %s", backendAuthServer.getQualifier());
-        getTestingClientFor(backendAuthServer).testing().setTestingInfinispanTimeService();
-    }
-
-    protected void revertInfinispanTestTimeServiceOnAllStartedAuthServers() {
-        forAllBackendNodesStream()
-                .filter(ContainerInfo::isStarted)
-                .forEach(this::revertInfinispanTestTimeServiceonAuthServer);
-    }
-
-    private void revertInfinispanTestTimeServiceonAuthServer(ContainerInfo backendAuthServer) {
-        log.infof("Revert Infinispan Test Time Service for backend server %s", backendAuthServer.getQualifier());
-        getTestingClientFor(backendAuthServer).testing().revertTestingInfinispanTimeService();
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ActionTokenCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ActionTokenCrossDCTest.java
deleted file mode 100644
index 7590f52c6165..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ActionTokenCrossDCTest.java
+++ /dev/null
@@ -1,235 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.crossdc;
-
-import org.junit.Ignore;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.page.LoginPasswordUpdatePage;
-import org.keycloak.testsuite.pages.ErrorPage;
-import org.keycloak.testsuite.pages.PageUtils;
-import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.MailUtils;
-import java.io.IOException;
-import java.util.LinkedList;
-import java.util.List;
-import jakarta.mail.MessagingException;
-import jakarta.mail.internet.MimeMessage;
-import jakarta.ws.rs.core.Response;
-import org.jboss.arquillian.graphene.page.Page;
-import org.junit.Assert;
-import org.junit.Rule;
-import org.junit.Test;
-import static org.junit.Assert.assertEquals;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanCacheStatistics;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanChannelStatistics;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics.Constants;
-import org.keycloak.testsuite.pages.ProceedPage;
-
-import java.util.Map;
-import java.util.concurrent.TimeUnit;
-import org.hamcrest.Matchers;
-import static org.hamcrest.Matchers.containsString;
-import static org.hamcrest.Matchers.greaterThan;
-import static org.hamcrest.MatcherAssert.assertThat;
-import org.keycloak.testsuite.arquillian.CrossDCTestEnricher;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-
-/**
- *
- * @author hmlnarik
- */
-public class ActionTokenCrossDCTest extends AbstractAdminCrossDCTest {
-
-    @Rule
-    public GreenMailRule greenMail = new GreenMailRule();
-
-    @Page
-    protected LoginPasswordUpdatePage passwordUpdatePage;
-
-    @Page
-    protected ProceedPage proceedPage;
-
-    @Page
-    protected ErrorPage errorPage;
-
-    private String createUser(UserRepresentation userRep) {
-        Response response = realm.users().create(userRep);
-        String createdId = ApiUtil.getCreatedId(response);
-        response.close();
-
-        getCleanup().addUserId(createdId);
-
-        return createdId;
-    }
-
-    @Test
-    @InitialDcState(authServers = ServerSetup.ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC)
-    // KEYCLOAK-17584: Temporarily disable the test for 'community' profile till KEYCLOAK-17628 isn't fixed. In other words till:
-    // * The test is either rewritten to start using the new Wildfly subsystem for base metrics introduced in Wildfly 22,
-    // * Or Keycloak is able to load the Eclipse MicroProfile Metrics subsystem from the microprofile Galleon feature-pack
-    @Ignore
-    public void sendResetPasswordEmailSuccessWorksInCrossDc(
-      @JmxInfinispanCacheStatistics(dc=DC.FIRST, dcNodeIndex=0, cacheName=InfinispanConnectionProvider.ACTION_TOKEN_CACHE) InfinispanStatistics cacheDc0Node0Statistics,
-      @JmxInfinispanCacheStatistics(dc=DC.FIRST, dcNodeIndex=1, cacheName=InfinispanConnectionProvider.ACTION_TOKEN_CACHE) InfinispanStatistics cacheDc0Node1Statistics,
-      @JmxInfinispanCacheStatistics(dc=DC.SECOND, dcNodeIndex=0, cacheName=InfinispanConnectionProvider.ACTION_TOKEN_CACHE) InfinispanStatistics cacheDc1Node0Statistics,
-      @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-        log.debug("--DC: START sendResetPasswordEmailSuccessWorksInCrossDc");
-
-        cacheDc0Node1Statistics.waitToBecomeAvailable(10, TimeUnit.SECONDS);
-
-        Comparable originalNumberOfEntries = cacheDc0Node0Statistics.getSingleStatistics(Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY);
-
-        log.infof("Before creating user. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        UserRepresentation userRep = new UserRepresentation();
-        userRep.setEnabled(true);
-        userRep.setUsername("user1");
-        userRep.setEmail("user1@test.com");
-
-        String id = createUser(userRep);
-
-        UserResource user = realm.users().get(id);
-        List<String> actions = new LinkedList<>();
-        actions.add(UserModel.RequiredAction.UPDATE_PASSWORD.name());
-        user.executeActionsEmail(actions);
-
-        Assert.assertEquals(1, greenMail.getReceivedMessages().length);
-
-        log.infof("After sending email. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        MimeMessage message = greenMail.getReceivedMessages()[0];
-
-        String link = MailUtils.getPasswordResetEmailLink(message);
-
-        assertSingleStatistics(cacheDc0Node0Statistics, Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY,
-          () -> driver.navigate().to(link),
-          Matchers::is
-        );
-
-        log.infof("After click to the link from email. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        proceedPage.assertCurrent();
-        proceedPage.clickProceedLink();
-        passwordUpdatePage.assertCurrent();
-
-        log.infof("After open password update page. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        // Verify that there was at least one message sent via the channel - Even if we did the change on DC0, the message may be sent either from DC0 or DC1. Seems it depends on the actionTokens key ownership.
-        // In case that it was sent from DC1, we will receive it in DC0.
-        assertStatistics(channelStatisticsCrossDc,
-                () -> {
-                    passwordUpdatePage.changePassword("new-pass", "new-pass");
-                },
-                (Map<String, Object> oldStats, Map<String, Object> newStats) -> {
-                    int oldSent = ((Number) oldStats.get(Constants.STAT_CHANNEL_SENT_MESSAGES)).intValue();
-                    int newSent = ((Number) newStats.get(Constants.STAT_CHANNEL_SENT_MESSAGES)).intValue();
-                    int oldReceived = ((Number) oldStats.get(Constants.STAT_CHANNEL_RECEIVED_MESSAGES)).intValue();
-                    int newReceived = ((Number) newStats.get(Constants.STAT_CHANNEL_RECEIVED_MESSAGES)).intValue();
-
-                    log.infof("oldSent: %d, newSent: %d, oldReceived: %d, newReceived: %d", oldSent, newSent, oldReceived, newReceived);
-                    Assert.assertTrue(newSent - oldSent > 0 || newReceived - oldReceived > 0);
-                }
-        );
-
-        assertThat(PageUtils.getPageTitle(driver), containsString("Your account has been updated."));
-
-        log.infof("After update password. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        // Verify that there was an action token added in the node which was targetted by the link
-        assertThat(cacheDc0Node0Statistics.getSingleStatistics(Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY), greaterThan(originalNumberOfEntries));
-
-        disableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Make sure that after going to the link, the invalidated action token has been retrieved from Infinispan server cluster in the other DC
-        // NOTE: Using STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY as it doesn't contain the items from cacheLoader (remoteCache) until they are really loaded into the cache memory. That's the
-        // statistic, which is actually increased on dc1-node0 once the used actionToken is loaded to the cache (memory) from remoteCache
-        assertSingleStatistics(cacheDc1Node0Statistics, Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY,
-          () -> driver.navigate().to(link),
-          Matchers::greaterThan
-        );
-
-        log.infof("After another click to the invalid link. %s", dumpNumberOfEntriesInMemory(cacheDc0Node0Statistics, cacheDc0Node1Statistics, cacheDc1Node0Statistics));
-
-        errorPage.assertCurrent();
-        log.debug("--DC: END sendResetPasswordEmailSuccessWorksInCrossDc");
-    }
-
-    private String dumpNumberOfEntriesInMemory(InfinispanStatistics cacheDc0Node0Statistics, InfinispanStatistics cacheDc0Node1Statistics, InfinispanStatistics cacheDc1Node0Statistics) {
-        return new StringBuilder("dc0node0 - numberOfEntriesInMemory: ")
-                .append(cacheDc0Node0Statistics.getSingleStatistics(Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY))
-                .append(", dc0node1 - numberOfEntriesInMemory: ")
-                .append(cacheDc0Node1Statistics.getSingleStatistics(Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY))
-                .append(", dc1node0 - numberOfEntriesInMemory: ")
-                .append(cacheDc1Node0Statistics.getSingleStatistics(Constants.STAT_CACHE_NUMBER_OF_ENTRIES_IN_MEMORY))
-                .toString();
-    }
-
-    @Test
-    @InitialDcState(authServers = ServerSetup.FIRST_NODE_IN_FIRST_DC)
-    public void sendResetPasswordEmailAfterNewNodeAdded() throws IOException, MessagingException {
-        log.debug("--DC: START sendResetPasswordEmailAfterNewNodeAdded");
-        disableDcOnLoadBalancer(DC.SECOND);
-
-        UserRepresentation userRep = new UserRepresentation();
-        userRep.setEnabled(true);
-        userRep.setUsername("user1");
-        userRep.setEmail("user1@test.com");
-
-        String id = createUser(userRep);
-
-        UserResource user = realm.users().get(id);
-        List<String> actions = new LinkedList<>();
-        actions.add(UserModel.RequiredAction.UPDATE_PASSWORD.name());
-        user.executeActionsEmail(actions);
-
-        Assert.assertEquals(1, greenMail.getReceivedMessages().length);
-
-        MimeMessage message = greenMail.getReceivedMessages()[0];
-
-        String link = MailUtils.getPasswordResetEmailLink(message);
-
-        driver.navigate().to(link);
-
-        proceedPage.assertCurrent();
-        proceedPage.clickProceedLink();
-        passwordUpdatePage.assertCurrent();
-
-        passwordUpdatePage.changePassword("new-pass", "new-pass");
-
-        assertEquals("Your account has been updated.", PageUtils.getPageTitle(driver));
-
-        disableDcOnLoadBalancer(DC.FIRST);
-        CrossDCTestEnricher.startAuthServerBackendNode(DC.SECOND, 1);
-        CrossDCTestEnricher.stopAuthServerBackendNode(DC.FIRST, 0);
-        enableLoadBalancerNode(DC.SECOND, 1);
-
-        Retry.execute(() -> {
-            driver.navigate().to(link);
-            errorPage.assertCurrent();
-        }, 3, 400);
-
-        log.debug("--DC: END sendResetPasswordEmailAfterNewNodeAdded");
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/BruteForceCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/BruteForceCrossDCTest.java
deleted file mode 100644
index 0f08f065a12f..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/BruteForceCrossDCTest.java
+++ /dev/null
@@ -1,277 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-import org.hamcrest.Matchers;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.Constants;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserLoginFailureModel;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.concurrency.AbstractConcurrencyTest;
-import org.keycloak.testsuite.client.KeycloakTestingClient;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import jakarta.ws.rs.NotFoundException;
-import java.io.IOException;
-import java.net.URISyntaxException;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class BruteForceCrossDCTest extends AbstractAdminCrossDCTest {
-
-    private static final String REALM_NAME = "brute-force-test";
-
-    @Before
-    public void beforeTest() {
-        log.debug("--DC: creating test realm");
-        try {
-            adminClient.realm(REALM_NAME).remove();
-        } catch (NotFoundException ignore) {
-        }
-
-        UserRepresentation user = UserBuilder.create()
-                .id("login-test-1")
-                .username("login-test-1")
-                .email("login-1@test.com")
-                .enabled(true)
-                .password("password")
-                .addRoles(Constants.OFFLINE_ACCESS_ROLE)
-                .build();
-
-        UserRepresentation user2 = UserBuilder.create()
-                .id("login-test-2")
-                .username("login-test-2")
-                .email("login-2@test.com")
-                .enabled(true)
-                .password("password")
-                .addRoles(Constants.OFFLINE_ACCESS_ROLE)
-                .build();
-
-        ClientRepresentation client = ClientBuilder.create()
-                .clientId("test-app")
-                .directAccessGrants()
-                .redirectUris("http://localhost:8180/auth/realms/master/app/*")
-                .addWebOrigin("http://localhost:8180")
-                .secret("password")
-                .build();
-
-        RealmRepresentation realmRep = RealmBuilder.create()
-                .name(REALM_NAME)
-                .user(user)
-                .user(user2)
-                .client(client)
-                .bruteForceProtected(true)
-                .build();
-
-        realmRep.setQuickLoginCheckMilliSeconds(0L); // This is necessary so user is not locked out for too fast consecutive login attempts; when user is locked out failure count stops increasing
-
-        adminClient.realms().create(realmRep);
-    }
-
-
-    @Test
-    public void testBruteForceWithUserOperations() throws Exception {
-        // Enable 1st node on each DC only
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Clear all
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearAllBruteForce();
-        assertStatistics("After brute force cleared", 0, 0, 0);
-
-        // Create 10 brute force statuses for user1. Assert available on both DC1 and DC2
-        createBruteForceFailures(10, "login-test-1");
-        assertStatistics("After brute force for user1 created", 10, 0, 1);
-
-        // Create 10 brute force statuses for user2. Assert available on both DC1 and DC2createBruteForceFailures(10, "login-test-2");createBruteForceFailures(10, "login-test-2");
-        createBruteForceFailures(10, "login-test-2");
-        assertStatistics("After brute force for user2 created", 10, 10, 2);
-
-        // Remove brute force for user1
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearBruteForceForUser("login-test-1");
-        assertStatistics("After brute force for user1 cleared", 0, 10, 1);
-
-        // Re-add 10 brute force statuses for user1
-        createBruteForceFailures(10, "login-test-1");
-        assertStatistics("After brute force for user1 re-created", 10, 10, 2);
-
-        // Remove user1
-        adminClient.realms().realm(REALM_NAME).users().get("login-test-1").remove();
-        assertStatistics("After user1 removed", 0, 10, 1);
-    }
-
-
-    @Test
-    public void testBruteForceWithRealmOperations() throws Exception {
-        // Enable 1st node on each DC only
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-//        log.infof("Sleeping");
-//        Thread.sleep(3600000);
-
-        // Clear all
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearAllBruteForce();
-        assertStatistics("After brute force cleared", 0, 0, 0);
-
-        // Create 10 brute force statuses for user1 and user2.
-        createBruteForceFailures(10, "login-test-1");
-        createBruteForceFailures(10, "login-test-2");
-        assertStatistics("After brute force for users created", 10, 10, 2);
-
-        // Clear all
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearAllBruteForce();
-        assertStatistics("After brute force cleared for realm", 0, 0, 0);
-
-        // Re-add 10 brute force statuses for users
-        createBruteForceFailures(10, "login-test-1");
-        createBruteForceFailures(10, "login-test-2");
-        assertStatistics("After brute force for users re-created", 10, 10, 2);
-
-        // Remove realm
-        adminClient.realms().realm(REALM_NAME).remove();
-
-        Retry.execute(() -> {
-            int dc0CacheSize = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).size();
-            int dc1CacheSize = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).size();
-            Assert.assertEquals(0, dc0CacheSize);
-            Assert.assertEquals(0, dc1CacheSize);
-        }, 50, 50);
-
-    }
-
-
-    @Test
-    public void testDuplicatedPutIfAbsentOperation() throws Exception {
-        // Enable 1st node on each DC only
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Clear all
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearAllBruteForce();
-        assertStatistics("After brute force cleared", 0, 0, 0);
-
-        // create the entry manually in DC0
-        addUserLoginFailure(getTestingClientForStartedNodeInDc(0));
-        assertStatistics("After create entry1", 1, 0, 1);
-
-        // try to create the entry manually in DC1 (not use real concurrency for now). It should still update the numFailures in existing entry rather then override it
-        addUserLoginFailure(getTestingClientForStartedNodeInDc(1));
-        assertStatistics("After create entry2", 2, 0, 1);
-
-    }
-
-
-    @Test
-    public void testBruteForceConcurrentUpdate() throws Exception {
-        //Thread.sleep(120000);
-
-        // Enable 1st node on each DC only
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Clear all
-        adminClient.realms().realm(REALM_NAME).attackDetection().clearAllBruteForce();
-        assertStatistics("After brute force cleared", 0, 0, 0);
-
-        // create the entry manually in DC0
-        addUserLoginFailure(getTestingClientForStartedNodeInDc(0));
-        assertStatistics("After create entry1", 1, 0, 1);
-
-        AbstractConcurrencyTest.KeycloakRunnable runnable = (int threadIndex, Keycloak keycloak, RealmResource realm1) -> {
-            createBruteForceFailures(1, "login-test-1");
-        };
-
-        AbstractConcurrencyTest.run(2, 20, this, runnable);
-
-        Retry.execute(() -> {
-            int dc0user1 = (Integer) getAdminClientForStartedNodeInDc(0).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-1").get("numFailures");
-            int dc1user1 = (Integer) getAdminClientForStartedNodeInDc(1).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-1").get("numFailures");
-
-            log.infof("After concurrent update entry1: dc0User1=%d, dc1user1=%d", dc0user1, dc1user1);
-
-            // TODO: The number of failures should be ideally exactly 21 in both DCs. Once we improve cross-dc, then improve this test and rather check for "Assert.assertEquals(dc0user1, 21)" and "Assert.assertEquals(dc1user1, 21)"
-            assertThat(dc0user1, Matchers.greaterThan(11));
-            assertThat(dc1user1, Matchers.greaterThan(11));
-        }, 50, 50);
-    }
-
-
-    private void assertStatistics(String prefixMessage, int expectedUser1, int expectedUser2, int expectedCacheSize) {
-        Retry.execute(() -> {
-            int dc0user1 = (Integer) getAdminClientForStartedNodeInDc(0).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-1").get("numFailures");
-            int dc1user1 = (Integer) getAdminClientForStartedNodeInDc(1).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-1").get("numFailures");
-            int dc0user2 = (Integer) getAdminClientForStartedNodeInDc(0).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-2").get("numFailures");
-            int dc1user2 = (Integer) getAdminClientForStartedNodeInDc(1).realm(REALM_NAME).attackDetection().bruteForceUserStatus("login-test-2").get("numFailures");
-
-            int dc0CacheSize = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).size();
-            int dc1CacheSize = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).size();
-
-            log.infof("%s: dc0User1=%d, dc0user2=%d, dc1user1=%d, dc1user2=%d, dc0CacheSize=%d, dc1CacheSize=%d", prefixMessage, dc0user1, dc0user2, dc1user1, dc1user2, dc0CacheSize, dc1CacheSize);
-
-            Assert.assertEquals(expectedUser1, dc0user1);
-            Assert.assertEquals(expectedUser2, dc0user2);
-            Assert.assertEquals(expectedUser1, dc1user1);
-            Assert.assertEquals(expectedUser2, dc1user2);
-
-            Assert.assertEquals(expectedCacheSize, dc0CacheSize);
-            Assert.assertEquals(expectedCacheSize, dc1CacheSize);
-        }, 50, 50);
-    }
-
-
-
-
-
-    private void createBruteForceFailures(int count, String username) throws Exception {
-        oauth.realm(REALM_NAME);
-
-        for (int i=0 ; i<count ; i++) {
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", username, "bad-password");
-            Assert.assertNull(response.getAccessToken());
-            Assert.assertNotNull(response.getError());
-        }
-
-    }
-
-
-    // resolution on Wildfly: make deployment available on both dc0_1 and dc1_1, see @Deployment methods
-    private void addUserLoginFailure(KeycloakTestingClient testingClient) throws URISyntaxException, IOException {
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName(REALM_NAME);
-            UserLoginFailureModel loginFailure = session.loginFailures().addUserLoginFailure(realm, "login-test-1");
-            loginFailure.incrementFailures();
-        });
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ConcurrentLoginCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ConcurrentLoginCrossDCTest.java
deleted file mode 100644
index 8391fc991ead..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/ConcurrentLoginCrossDCTest.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-import java.util.ArrayList;
-import org.keycloak.admin.client.Keycloak;
-import org.keycloak.admin.client.resource.RealmResource;
-
-import org.jboss.arquillian.container.test.api.ContainerController;
-import org.jboss.arquillian.test.api.ArquillianResource;
-import org.keycloak.testsuite.admin.concurrency.ConcurrentLoginTest;
-import org.keycloak.testsuite.arquillian.LoadBalancerController;
-import org.keycloak.testsuite.arquillian.annotation.LoadBalancer;
-import java.util.Arrays;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicReference;
-import org.apache.http.client.methods.HttpUriRequest;
-import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.junit.Test;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@InitialDcState(authServers = ServerSetup.ALL_NODES_IN_EVERY_DC)
-public class ConcurrentLoginCrossDCTest extends ConcurrentLoginTest {
-
-    @ArquillianResource
-    @LoadBalancer(value = AbstractCrossDCTest.QUALIFIER_NODE_BALANCER)
-    protected LoadBalancerController loadBalancerCtrl;
-
-    @ArquillianResource
-    protected ContainerController containerController;
-
-    private static final int INVOCATIONS_BEFORE_SIMULATING_DC_FAILURE = 10;
-    private static final int LOGIN_TASK_DELAY_MS = 100;
-    private static final int LOGIN_TASK_RETRIES = 15;
-
-    @Override
-    public void beforeAbstractKeycloakTestRealmImport() {
-        loadBalancerCtrl.enableAllBackendNodes();
-    }
-
-    @Override
-    public void postAfterAbstractKeycloak() {
-        loadBalancerCtrl.disableAllBackendNodes();
-        
-        //realms is already removed and this prevents another removal in AuthServerTestEnricher.afterClass
-        testContext.setTestRealmReps(new ArrayList<>());
-    }
-
-    @Test
-    public void concurrentLoginWithRandomDcFailures() throws Throwable {
-        log.info("*********************************************");
-        long start = System.currentTimeMillis();
-
-        AtomicReference<String> userSessionId = new AtomicReference<>();
-        LoginTask loginTask = null;
-
-        try (CloseableHttpClient httpClient = getHttpsAwareClient()) {
-            loginTask = new LoginTask(httpClient, userSessionId, LOGIN_TASK_DELAY_MS, LOGIN_TASK_RETRIES, false, Arrays.asList(
-              createHttpClientContextForUser(httpClient, "test-user@localhost", "password")
-            ));
-            HttpUriRequest request = handleLogin(getPageContent(oauth.getLoginFormUrl(), httpClient, HttpClientContext.create()), "test-user@localhost", "password");
-            log.debug("Executing login request");
-            org.junit.Assert.assertTrue(parseAndCloseResponse(httpClient.execute(request)).contains("<title>AUTH_RESPONSE</title>"));
-
-            run(DEFAULT_THREADS, DEFAULT_CLIENTS_COUNT, loginTask, new SwapDcAvailability());
-            int clientSessionsCount = testingClient.testing().getClientSessionsCountInUserSession("test", userSessionId.get());
-            org.junit.Assert.assertEquals(1 + DEFAULT_CLIENTS_COUNT, clientSessionsCount);
-        } finally {
-            long end = System.currentTimeMillis() - start;
-            log.infof("Statistics: %s", loginTask == null ? "??" : loginTask.getHistogram());
-            log.info("concurrentLoginWithRandomDcFailures took " + (end/1000) + "s");
-            log.info("*********************************************");
-        }
-    }
-
-    private class SwapDcAvailability implements KeycloakRunnable {
-
-        private final AtomicInteger invocationCounter = new AtomicInteger();
-
-        @Override
-        public void run(int threadIndex, Keycloak keycloak, RealmResource realm) throws Throwable {
-            final int currentInvocarion = invocationCounter.getAndIncrement();
-            if (currentInvocarion % INVOCATIONS_BEFORE_SIMULATING_DC_FAILURE == 0) {
-                int failureIndex = currentInvocarion / INVOCATIONS_BEFORE_SIMULATING_DC_FAILURE;
-                int dcToEnable = failureIndex % 2;
-                int dcToDisable = (failureIndex + 1) % 2;
-
-                // Ensure nodes from dcToEnable are available earlier then previous nodes from dcToDisable are disabled.
-                suiteContext.getDcAuthServerBackendsInfo().get(dcToEnable).forEach(c -> loadBalancerCtrl.enableBackendNodeByName(c.getQualifier()));
-                suiteContext.getDcAuthServerBackendsInfo().get(dcToDisable).forEach(c -> loadBalancerCtrl.disableBackendNodeByName(c.getQualifier()));
-            }
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/InvalidationCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/InvalidationCrossDCTest.java
deleted file mode 100644
index 2e8d9f37c21d..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/InvalidationCrossDCTest.java
+++ /dev/null
@@ -1,221 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-import java.util.List;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import jakarta.ws.rs.core.Response;
-
-import org.junit.Test;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ResourcesResource;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.authorization.ResourceRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.common.util.Retry;
-import org.keycloak.testsuite.ProfileAssume;
-import org.keycloak.testsuite.admin.ApiUtil;
-
-import static org.keycloak.common.Profile.Feature.AUTHORIZATION;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class InvalidationCrossDCTest extends AbstractAdminCrossDCTest {
-
-    private static final String REALM_NAME = "test";
-
-    @Test
-    public void realmInvalidationTest() throws Exception {
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        RealmRepresentation realmDc0 = getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).toRepresentation();
-        RealmRepresentation realmDc1 = getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME).toRepresentation();
-
-        // Test same realm on both DCs
-        Assert.assertNull(realmDc0.getDisplayName());
-        Assert.assertTrue(realmDc0.isRegistrationAllowed());
-        Assert.assertNull(realmDc1.getDisplayName());
-        Assert.assertTrue(realmDc1.isRegistrationAllowed());
-
-        // Update realm on DC0
-        realmDc0.setRegistrationAllowed(false);
-        realmDc0.setDisplayName("Cool Realm!");
-        getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).update(realmDc0);
-
-        // Assert updated on both DC0 and DC1 (here retry is needed. We need to wait until invalidation message arrives)
-        realmDc0 = getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).toRepresentation();
-        Assert.assertEquals("Cool Realm!", realmDc0.getDisplayName());
-        Assert.assertFalse(realmDc0.isRegistrationAllowed());
-
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            RealmRepresentation realmDcc1 = getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME).toRepresentation();
-            Assert.assertEquals("Cool Realm!", realmDcc1.getDisplayName());
-            Assert.assertFalse(realmDcc1.isRegistrationAllowed());
-        }, 50, 50);
-
-        log.infof("realmInvalidationTest: Passed after '%d' iterations", i.get());
-    }
-
-
-    @Test
-    public void clientInvalidationTest() throws Exception {
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        ClientResource clientResourceDc0 = ApiUtil.findClientByClientId(getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME), "named-test-app");
-        ClientResource clientResourceDc1 = ApiUtil.findClientByClientId(getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME), "named-test-app");
-        ClientRepresentation clientDc0 = clientResourceDc0.toRepresentation();
-        ClientRepresentation clientDc1 = clientResourceDc1.toRepresentation();
-
-        // Test same client on both DCs
-        Assert.assertEquals("My Named Test App", clientDc0.getName());
-        Assert.assertEquals("My Named Test App", clientDc1.getName());
-
-        // Update client on DC0
-        clientDc0.setName("Changed Test App");
-        clientResourceDc0.update(clientDc0);
-
-        // Assert updated on both DC0 and DC1 (here retry is needed. We need to wait until invalidation message arrives)
-        clientDc0 = clientResourceDc0.toRepresentation();
-        Assert.assertEquals("Changed Test App", clientDc0.getName());
-
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            ClientRepresentation clientDcc1 = clientResourceDc1.toRepresentation();
-            Assert.assertEquals("Changed Test App", clientDcc1.getName());
-        }, 50, 50);
-
-        log.infof("clientInvalidationTest: Passed after '%d' iterations", i.get());
-    }
-
-
-    @Test
-    public void clientListInvalidationTest() throws Exception {
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        List<ClientRepresentation> dc0List = getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).clients().findAll();
-        List<ClientRepresentation> dc1List = getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME).clients().findAll();
-
-
-        // Test same clients on both DCs
-        Assert.assertEquals(dc0List.size(), dc1List.size());
-        int initialSize = dc0List.size();
-
-        // Create client on DC0
-        ClientRepresentation rep = new ClientRepresentation();
-        rep.setClientId("some-new-client");
-        rep.setEnabled(true);
-        Response response = getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).clients().create(rep);
-        Assert.assertEquals(201, response.getStatus());
-        response.close();
-
-        // Assert updated on both DC0 and DC1 (here retry is needed. We need to wait until invalidation message arrives)
-        dc0List = getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME).clients().findAll();
-        Assert.assertEquals(initialSize + 1, dc0List.size());
-
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            List<ClientRepresentation> dc1Listt = getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME).clients().findAll();
-            Assert.assertEquals(initialSize + 1, dc1Listt.size());
-        }, 50, 50);
-
-        log.infof("clientListInvalidationTest: Passed after '%d' iterations", i.get());
-    }
-
-
-    @Test
-    public void userInvalidationTest() throws Exception {
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        UserResource userResourceDc0 = ApiUtil.findUserByUsernameId(getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME), "test-user@localhost");
-        UserResource userResourceDc1 = ApiUtil.findUserByUsernameId(getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME), "test-user@localhost");
-        UserRepresentation userDc0 = userResourceDc0.toRepresentation();
-        UserRepresentation userDc1 = userResourceDc1.toRepresentation();
-
-        // Test same user on both DCs
-        Assert.assertEquals("Tom", userDc0.getFirstName());
-        Assert.assertEquals("Tom", userDc1.getFirstName());
-
-        // Update user on DC0
-        userDc0.setFirstName("Brad");
-        userResourceDc0.update(userDc0);
-
-        // Assert updated on both DC0 and DC1 (here retry is needed. We need to wait until invalidation message arrives)
-        userDc0 = userResourceDc0.toRepresentation();
-        Assert.assertEquals("Brad", userDc0.getFirstName());
-
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            UserRepresentation userDcc1 = userResourceDc1.toRepresentation();
-            Assert.assertEquals("Brad", userDcc1.getFirstName());
-        }, 50, 50);
-
-        log.infof("userInvalidationTest: Passed after '%d' iterations", i.get());
-    }
-
-
-    @Test
-    public void authzResourceInvalidationTest() throws Exception {
-        ProfileAssume.assumeFeatureEnabled(AUTHORIZATION);
-
-        enableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-
-
-        ResourcesResource resourcesDc0Resource = ApiUtil.findClientByClientId(getAdminClientForStartedNodeInDc(0).realms().realm(REALM_NAME), "test-app-authz").authorization().resources();
-        ResourcesResource resourcesDc1Resource = ApiUtil.findClientByClientId(getAdminClientForStartedNodeInDc(1).realms().realm(REALM_NAME), "test-app-authz").authorization().resources();
-        ResourceRepresentation resDc0 = resourcesDc0Resource.findByName("Premium Resource").get(0);
-        ResourceRepresentation resDc1 = resourcesDc1Resource.findByName("Premium Resource").get(0);
-
-        // Test same resource on both DCs
-        Assert.assertEquals("/protected/premium/*", resDc0.getUri());
-        Assert.assertEquals("/protected/premium/*", resDc1.getUri());
-
-        // Update resource on DC0
-        resDc0.setUri("/protected/ultra/premium/*");
-        resourcesDc0Resource.resource(resDc0.getId()).update(resDc0);
-
-        // Assert updated on both DC0 and DC1 (here retry is needed. We need to wait until invalidation message arrives)
-        resDc0 = resourcesDc0Resource.findByName("Premium Resource").get(0);
-        Assert.assertEquals("/protected/ultra/premium/*", resDc0.getUri());
-
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            ResourceRepresentation ressDc1 = resourcesDc1Resource.findByName("Premium Resource").get(0);
-            Assert.assertEquals("/protected/ultra/premium/*", ressDc1.getUri());
-        }, 50, 50);
-
-        log.infof("authzResourceInvalidationTest: Passed after '%d' iterations", i.get());
-    }
-
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LastSessionRefreshCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LastSessionRefreshCrossDCTest.java
deleted file mode 100644
index 123abf794675..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LastSessionRefreshCrossDCTest.java
+++ /dev/null
@@ -1,430 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-
-import org.hamcrest.Matchers;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanCacheStatistics;
-import org.keycloak.testsuite.util.OAuthClient;
-
-import jakarta.ws.rs.NotFoundException;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicLong;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class LastSessionRefreshCrossDCTest extends AbstractAdminCrossDCTest {
-
-    @Test
-    public void testRevokeRefreshToken(@JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc1Stats,
-                                       @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc2Stats,
-                                       @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc1Stats,
-                                       @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc2Stats
-
-    ) {
-        // Enable revokeRefreshToken
-        RealmRepresentation realmRep = testRealm().toRepresentation();
-        realmRep.setRevokeRefreshToken(true);
-        testRealm().update(realmRep);
-
-        // Enable second DC
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        sessionCacheDc1Stats.reset();
-        sessionCacheDc2Stats.reset();
-        clientSessionCacheDc1Stats.reset();
-        clientSessionCacheDc2Stats.reset();
-
-        // Get statistics
-        AtomicLong sessionStoresDc1 = new AtomicLong(getStores(sessionCacheDc1Stats));
-        AtomicLong sessionStoresDc2 = new AtomicLong(getStores(sessionCacheDc2Stats));
-        AtomicLong clientSessionStoresDc1 = new AtomicLong(getStores(clientSessionCacheDc1Stats));
-        AtomicLong clientSessionStoresDc2 = new AtomicLong(getStores(clientSessionCacheDc2Stats));
-        AtomicInteger lsrDc1 = new AtomicInteger(-1);
-        AtomicInteger lsrDc2 = new AtomicInteger(-1);
-
-        // Login
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
-        String code = response1.getCode();
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-        Assert.assertNotNull(tokenResponse.getAccessToken());
-        String sessionId = oauth.verifyToken(tokenResponse.getAccessToken()).getSessionState();
-        String refreshToken1 = tokenResponse.getRefreshToken();
-
-
-        // Assert statistics - sessions created on both DCs and created on remoteCaches too
-        assertStatistics("After session created", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, true, false);
-
-
-        // Set time offset to some point in future. TODO This won't be needed once we have single-use cache based solution for refresh tokens
-        setTimeOffset(10);
-
-        // refresh token on DC1
-        disableDcOnLoadBalancer(DC.SECOND);
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken2 = tokenResponse.getRefreshToken();
-
-        // Assert statistics - sessions updated on both DCs and on remoteCaches too
-        assertStatistics("After time offset 10", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, true, false);
-
-        // try refresh with old token on DC2. It should fail.
-        disableDcOnLoadBalancer(DC.FIRST);
-        enableDcOnLoadBalancer(DC.SECOND);
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        Assert.assertNull("Expecting no access token present", tokenResponse.getAccessToken());
-        Assert.assertNotNull(tokenResponse.getError());
-
-        // try refresh with new token on DC2. It should fail because client session not valid anymore
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken2, "password");
-        Assert.assertNull("Expecting no access token present", tokenResponse.getAccessToken());
-        Assert.assertNotNull(tokenResponse.getError());
-
-        // Revert
-        realmRep = testRealm().toRepresentation();
-        realmRep.setRevokeRefreshToken(false);
-        testRealm().update(realmRep);
-    }
-
-
-    @Test
-    public void testLastSessionRefreshUpdate(@JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc1Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc2Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc1Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc2Stats
-
-    ) {
-        // Set the infinispan testTimeService on all started auth servers
-        setInfinispanTestTimeServiceOnAllStartedAuthServers();
-
-        try {
-            // Ensure to remove all current sessions and offline sessions
-            setTimeOffset(10000000);
-            getTestingClientForStartedNodeInDc(0).testing("test").removeExpired("test");
-            getTestingClientForStartedNodeInDc(1).testing("test").removeExpired("test");
-            setTimeOffset(0);
-
-            sessionCacheDc1Stats.reset();
-            sessionCacheDc2Stats.reset();
-            clientSessionCacheDc1Stats.reset();
-            clientSessionCacheDc2Stats.reset();
-
-            // Disable DC2 on loadbalancer
-            disableDcOnLoadBalancer(DC.SECOND);
-
-            // Get statistics
-            AtomicLong sessionStoresDc1 = new AtomicLong(getStores(sessionCacheDc1Stats));
-            AtomicLong sessionStoresDc2 = new AtomicLong(getStores(sessionCacheDc2Stats));
-            AtomicLong clientSessionStoresDc1 = new AtomicLong(getStores(clientSessionCacheDc1Stats));
-            AtomicLong clientSessionStoresDc2 = new AtomicLong(getStores(clientSessionCacheDc2Stats));
-            AtomicInteger lsrDc1 = new AtomicInteger(-1);
-            AtomicInteger lsrDc2 = new AtomicInteger(-1);
-
-            // Login
-            OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
-            String code = response1.getCode();
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-            Assert.assertNotNull(tokenResponse.getAccessToken());
-            String sessionId = oauth.verifyToken(tokenResponse.getAccessToken()).getSessionState();
-            String refreshToken1 = tokenResponse.getRefreshToken();
-
-            // Assert statistics - sessions created on both DCs and created on remoteCaches too
-            assertStatistics("After session created", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                    sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                    lsrDc1, lsrDc2, true, true, true, false);
-
-
-            // Set time offset
-            setTimeOffset(100);
-
-            // refresh token on DC1
-            tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-            String refreshToken2 = tokenResponse.getRefreshToken();
-            Assert.assertNotNull(refreshToken2);
-
-            // Assert statistics - sessions updated on both DC1 and DC2. RemoteCaches not updated
-            assertStatistics("After refresh at time 100", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                    sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                    lsrDc1, lsrDc2, true, true, false, false);
-
-
-            // Set time offset
-            setTimeOffset(110);
-
-            // refresh token on DC1
-            tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-            String refreshToken3 = tokenResponse.getRefreshToken();
-            Assert.assertNotNull(refreshToken3);
-
-            // Assert statistics - sessions updated just on DC1.
-            // Update of DC2 is postponed (It's just 10 seconds since last message). RemoteCaches not updated
-            assertStatistics("After refresh at time 110", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                    sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                    lsrDc1, lsrDc2, true, false, false, false);
-
-
-            // 31 minutes after "100". Session should be still valid and not yet expired (RefreshToken will be invalid due the expiration on the JWT itself. Hence not testing refresh here)
-            setTimeOffset(1960);
-
-            boolean sessionValid = getTestingClientForStartedNodeInDc(1).server("test").fetch((KeycloakSession session) -> {
-                RealmModel realm = session.realms().getRealmByName("test");
-                UserSessionModel userSession = session.sessions().getUserSession(realm, sessionId);
-                return AuthenticationManager.isSessionValid(realm, userSession);
-            }, Boolean.class);
-
-            Assert.assertTrue(sessionValid);
-
-            getTestingClientForStartedNodeInDc(1).testing("test").removeExpired("test");
-
-            // Assert statistics - nothing was updated. No refresh happened and nothing was cleared during "removeExpired"
-            assertStatistics("After checking valid at time 1960", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                    sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                    lsrDc1, lsrDc2, false, false, false, false);
-
-
-            // 35 minutes after "100". Session not valid and will be expired by the cleaner
-            setTimeOffset(2200);
-
-            sessionValid = getTestingClientForStartedNodeInDc(1).server("test").fetch((KeycloakSession session) -> {
-                RealmModel realm = session.realms().getRealmByName("test");
-                UserSessionModel userSession = session.sessions().getUserSession(realm, sessionId);
-                return AuthenticationManager.isSessionValid(realm, userSession);
-            }, Boolean.class);
-
-            Assert.assertFalse(sessionValid);
-
-            // 2000 seconds after the previous. This should ensure that session would be expired from the cache due the invalid maxIdle.
-            // Previous read at time 2200 "refreshed" the maxIdle in the infinispan cache. This shouldn't happen in reality as an attempt to call refreshToken request on invalid session does backchannelLogout
-            setTimeOffset(4200);
-
-            getTestingClientForStartedNodeInDc(1).testing("test").removeExpired("test");
-
-            // Session should be removed on both DCs
-            try {
-                getTestingClientForStartedNodeInDc(0).testing("test").getLastSessionRefresh("test", sessionId, false);
-                Assert.fail("It wasn't expected to find the session " + sessionId);
-            } catch (NotFoundException nfe) {
-                // Expected
-            }
-            try {
-                getTestingClientForStartedNodeInDc(1).testing("test").getLastSessionRefresh("test", sessionId, false);
-                Assert.fail("It wasn't expected to find the session " + sessionId);
-            } catch (NotFoundException nfe) {
-                // Expected
-            }
-        } finally {
-            // Revert time service
-            revertInfinispanTestTimeServiceOnAllStartedAuthServers();
-        }
-    }
-
-
-    @Test
-    public void testOfflineSessionsLastSessionRefreshUpdate(@JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc1Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics sessionCacheDc2Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc1Stats,
-                                             @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientSessionCacheDc2Stats
-
-    ) throws Exception {
-
-        // Ensure to remove all current sessions and offline sessions
-        setTimeOffset(10000000);
-        getTestingClientForStartedNodeInDc(0).testing("test").removeExpired("test");
-        getTestingClientForStartedNodeInDc(1).testing("test").removeExpired("test");
-        setTimeOffset(0);
-
-        sessionCacheDc1Stats.reset();
-        sessionCacheDc2Stats.reset();
-        clientSessionCacheDc1Stats.reset();
-        clientSessionCacheDc2Stats.reset();
-
-        // Disable DC2 on loadbalancer
-        disableDcOnLoadBalancer(DC.SECOND);
-
-        // Get statistics
-        AtomicLong sessionStoresDc1 = new AtomicLong(getStores(sessionCacheDc1Stats));
-        AtomicLong sessionStoresDc2 = new AtomicLong(getStores(sessionCacheDc2Stats));
-        AtomicLong clientSessionStoresDc1 = new AtomicLong(getStores(clientSessionCacheDc1Stats));
-        AtomicLong clientSessionStoresDc2 = new AtomicLong(getStores(clientSessionCacheDc2Stats));
-        AtomicInteger lsrDc1 = new AtomicInteger(-1);
-        AtomicInteger lsrDc2 = new AtomicInteger(-1);
-
-        // Login
-        oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
-        String code = response1.getCode();
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-        Assert.assertNotNull(tokenResponse.getAccessToken());
-        String sessionId = oauth.verifyToken(tokenResponse.getAccessToken()).getSessionState();
-        String refreshToken1 = tokenResponse.getRefreshToken();
-
-        // Assert statistics - sessions created on both DCs and created on remoteCaches too
-        assertStatistics("After session created", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, true, true);
-
-
-        // Set time offset
-        setTimeOffset(100);
-
-        // refresh token on DC1
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken3 = tokenResponse.getRefreshToken();
-        Assert.assertNotNull(refreshToken3);
-
-        // Assert statistics - sessions updated on both DC1 and DC2. RemoteCaches not updated
-        assertStatistics("After refresh at time 100", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, false, true);
-
-
-
-        // Set time offset
-        setTimeOffset(110);
-
-        // refresh token on DC1
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken2 = tokenResponse.getRefreshToken();
-        Assert.assertNotNull(refreshToken2);
-
-        // Assert statistics - sessions updated just on DC1.
-        // Update of DC2 is postponed (It's just 10 seconds since last message). RemoteCaches not updated
-        assertStatistics("After refresh at time 110", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, false, false, true);
-
-
-        // Set time offset to 20 days
-        setTimeOffset(1728000);
-
-        // refresh token on DC1
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken4 = tokenResponse.getRefreshToken();
-        Assert.assertNotNull(refreshToken4);
-
-        // Assert statistics - sessions updated on both DC1 and DC2. RemoteCaches updated as well.
-        assertStatistics("After refresh at time 1728000", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, true, true);
-
-        // Set time offset to 30 days
-        setTimeOffset(2592000);
-
-        // refresh token on DC1
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken5 = tokenResponse.getRefreshToken();
-        Assert.assertNotNull(refreshToken5);
-
-        // Assert statistics - sessions updated on both DC1 and DC2. RemoteCaches won't be updated now due it's just 10 days from the last remoteCache update
-        assertStatistics("After refresh at time 2592000", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, false, true);
-
-        // Set time offset to 40 days
-        setTimeOffset(3456000);
-
-        // refresh token on DC1
-        tokenResponse = oauth.doRefreshTokenRequest(refreshToken1, "password");
-        String refreshToken6 = tokenResponse.getRefreshToken();
-        Assert.assertNotNull(refreshToken6);
-
-        // Assert statistics - sessions updated on both DC1 and DC2. RemoteCaches will be updated too due it's 20 days from the last remoteCache update
-        assertStatistics("After refresh at time 3456000", sessionId, sessionCacheDc1Stats, sessionCacheDc2Stats, clientSessionCacheDc1Stats, clientSessionCacheDc2Stats,
-                sessionStoresDc1, sessionStoresDc2, clientSessionStoresDc1, clientSessionStoresDc2,
-                lsrDc1, lsrDc2, true, true, true, true);
-
-    }
-
-
-    private void assertStatistics(String messagePrefix, String sessionId,
-                                  InfinispanStatistics sessionCacheDc1Stats, InfinispanStatistics sessionCacheDc2Stats, InfinispanStatistics clientSessionCacheDc1Stats, InfinispanStatistics clientSessionCacheDc2Stats,
-                                  AtomicLong sessionStoresDc1, AtomicLong sessionStoresDc2, AtomicLong clientSessionStoresDc1, AtomicLong clientSessionStoresDc2,
-                                  AtomicInteger lsrDc1, AtomicInteger lsrDc2,
-                                  boolean expectedUpdatedLsrDc1, boolean expectedUpdatedLsrDc2, boolean expectedUpdatedRemoteCache, boolean offline) {
-        Retry.execute(() -> {
-            long newSessionStoresDc1 = getStores(sessionCacheDc1Stats);
-            long newSessionStoresDc2 = getStores(sessionCacheDc2Stats);
-            long newClientSessionStoresDc1 = getStores(clientSessionCacheDc1Stats);
-            long newClientSessionStoresDc2 = getStores(clientSessionCacheDc2Stats);
-
-            int newLsrDc1 = getTestingClientForStartedNodeInDc(0).testing("test").getLastSessionRefresh("test", sessionId, offline);
-            int newLsrDc2 = getTestingClientForStartedNodeInDc(1).testing("test").getLastSessionRefresh("test", sessionId, offline);
-
-            log.infof(messagePrefix + ": sessionStoresDc1: %d, sessionStoresDc2: %d, clientSessionStoresDc1: %d, clientSessionStoresDc2: %d, lsrDc1: %d, lsrDc2: %d",
-                    newSessionStoresDc1, newSessionStoresDc2, newClientSessionStoresDc1, newClientSessionStoresDc2, newLsrDc1, newLsrDc2);
-
-            // Check lastSessionRefresh updated on DC1
-            if (expectedUpdatedLsrDc1) {
-                assertThat(newLsrDc1, Matchers.greaterThan(lsrDc1.get()));
-            } else {
-                Assert.assertEquals(newLsrDc1, lsrDc1.get());
-            }
-
-            // Check lastSessionRefresh updated on DC2
-            if (expectedUpdatedLsrDc2) {
-                assertThat(newLsrDc2, Matchers.greaterThan(lsrDc2.get()));
-            } else {
-                Assert.assertEquals(newLsrDc2, lsrDc2.get());
-            }
-
-            // Check store statistics updated on JDG side
-            if (expectedUpdatedRemoteCache) {
-                assertThat(newSessionStoresDc1, Matchers.greaterThan(sessionStoresDc1.get()));
-                assertThat(newSessionStoresDc2, Matchers.greaterThan(sessionStoresDc2.get()));
-                assertThat(newClientSessionStoresDc1, Matchers.greaterThan(clientSessionStoresDc1.get()));
-                assertThat(newClientSessionStoresDc2, Matchers.greaterThan(clientSessionStoresDc2.get()));
-            } else {
-                Assert.assertEquals(newSessionStoresDc1, sessionStoresDc1.get());
-                Assert.assertEquals(newSessionStoresDc2, sessionStoresDc2.get());
-                Assert.assertEquals(newClientSessionStoresDc1, clientSessionStoresDc1.get());
-                Assert.assertEquals(newClientSessionStoresDc2, clientSessionStoresDc2.get());
-            }
-
-            // Update counter references
-            sessionStoresDc1.set(newSessionStoresDc1);
-            sessionStoresDc2.set(newSessionStoresDc2);
-            clientSessionStoresDc1.set(newClientSessionStoresDc1);
-            clientSessionStoresDc2.set(newClientSessionStoresDc2);
-            lsrDc1.set(newLsrDc1);
-            lsrDc2.set(newLsrDc2);
-        }, 50, 50);
-
-    }
-
-    private long getStores(InfinispanStatistics cacheStats) {
-        return (long) cacheStats.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_STORES);
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LoginCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LoginCrossDCTest.java
deleted file mode 100644
index 8a0958356e76..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/LoginCrossDCTest.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-import jakarta.ws.rs.core.Response;
-
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.junit.Test;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class LoginCrossDCTest extends AbstractAdminCrossDCTest {
-
-    @Test
-    public void loginTest() throws Exception {
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        //log.info("Started to sleep");
-        //Thread.sleep(10000000);
-        for (int i=0 ; i<30 ; i++) {
-            OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
-            String code = response1.getCode();
-            OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
-            Assert.assertNotNull(response2.getAccessToken());
-
-            try (CloseableHttpResponse response3 = oauth.doLogout(response2.getRefreshToken(), "password")) {
-                assertThat(response3, Matchers.statusCodeIsHC(Response.Status.NO_CONTENT));
-                //assertNotNull(testingClient.testApp().getAdminLogoutAction());
-            }
-
-            log.infof("Iteration %d finished", i);
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionExpirationCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionExpirationCrossDCTest.java
deleted file mode 100644
index 316f2079239a..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionExpirationCrossDCTest.java
+++ /dev/null
@@ -1,725 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import jakarta.ws.rs.NotFoundException;
-
-import org.hamcrest.Matchers;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.models.Constants;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.idm.UserSessionRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.common.util.Retry;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.CrossDCTestEnricher;
-import org.keycloak.testsuite.arquillian.InfinispanStatistics;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanCacheStatistics;
-import org.keycloak.testsuite.arquillian.annotation.JmxInfinispanChannelStatistics;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * Tests the bulk removal of user sessions and expiration scenarios (eg. removing realm, removing user etc)
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class SessionExpirationCrossDCTest extends AbstractAdminCrossDCTest {
-
-    private static final String REALM_NAME = "expiration-test";
-
-    private static final int SESSIONS_COUNT = 20;
-
-    private int sessions01;
-    private int sessions02;
-    private int clientSessions01;
-    private int clientSessions02;
-    private int remoteSessions01;
-    private int remoteSessions02;
-
-    private int authSessions01;
-    private int authSessions02;
-
-
-    @Before
-    public void beforeTest() {
-        try {
-            oauth.removeCachedPublicKeys();
-            adminClient.realm(REALM_NAME).remove();
-        } catch (NotFoundException ignore) {
-        }
-
-        UserRepresentation user = UserBuilder.create()
-                .id("login-test")
-                .username("login-test")
-                .email("login@test.com")
-                .enabled(true)
-                .password("password")
-                .addRoles(Constants.OFFLINE_ACCESS_ROLE)
-                .build();
-
-        ClientRepresentation client = ClientBuilder.create()
-                .clientId("test-app")
-                .directAccessGrants()
-                .redirectUris("http://localhost:8180/auth/realms/master/app/*", "https://localhost:8543/auth/realms/master/app/*")
-                .addWebOrigin("http://localhost:8180")
-                .addWebOrigin("https://localhost:8543")
-                .secret("password")
-                .build();
-
-        RealmRepresentation realmRep = RealmBuilder.create()
-                .ssoSessionIdleTimeout(300)
-                .ssoSessionMaxLifespan(600)
-                .offlineSessionIdleTimeout(900)
-                .name(REALM_NAME)
-                .user(user)
-                .client(client)
-                .build();
-
-        adminClient.realms().create(realmRep);
-
-        setInfinispanTestTimeServiceOnAllStartedAuthServers();
-    }
-
-    @After
-    public void afterTest() {
-        // Expire all sessions
-        setTimeOffset(1500);
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).processExpiration();
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).processExpiration();
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).processExpiration();
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME).processExpiration();
-        resetTimeOffset();
-
-        revertInfinispanTestTimeServiceOnAllStartedAuthServers();
-    }
-
-
-    @Test
-    public void testRealmRemoveSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientCacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME) InfinispanStatistics clientCacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-        createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,false, cacheDc1Statistics, cacheDc2Statistics, true);
-
-//        log.infof("Sleeping!");
-//        Thread.sleep(10000000);
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove test realm
-        getAdminClient().realm(REALM_NAME).remove();
-
-        // Assert sessions removed on node1 and node2 and on remote caches
-        assertStatisticsExpected("After realm remove", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    // Return last used accessTokenResponse
-    private List<OAuthClient.AccessTokenResponse> createInitialSessions(String cacheName, String clientSessionsCacheName, boolean offline, InfinispanStatistics cacheDc1Statistics, InfinispanStatistics cacheDc2Statistics, boolean includeRemoteStats) throws Exception {
-
-        // Enable second DC
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Check sessions count before test
-        sessions01 = getTestingClientForStartedNodeInDc(0).testing().cache(cacheName).size();
-        sessions02 = getTestingClientForStartedNodeInDc(1).testing().cache(cacheName).size();
-        clientSessions01 = getTestingClientForStartedNodeInDc(0).testing().cache(clientSessionsCacheName).size();
-        clientSessions02 = getTestingClientForStartedNodeInDc(1).testing().cache(clientSessionsCacheName).size();
-        remoteSessions01 = (Integer) cacheDc1Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-        remoteSessions02 = (Integer) cacheDc2Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-        log.infof("Before creating sessions: sessions01: %d, sessions02: %d, remoteSessions01: %d, remoteSessions02: %d, clientSessions01: %d, clientSessions02: %d",
-                sessions01, sessions02, remoteSessions01, remoteSessions02, clientSessions01, clientSessions02);
-
-        // Create 20 user sessions
-        oauth.realm(REALM_NAME);
-
-        if (offline) {
-            oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        }
-
-        List<OAuthClient.AccessTokenResponse> responses = new ArrayList<>();
-        for (int i=0 ; i<SESSIONS_COUNT ; i++) {
-            responses.add(oauth.doGrantAccessTokenRequest("password", "login-test", "password"));
-        }
-
-        // Assert 20 sessions exists on node1 and node2 and on remote caches
-        Retry.execute(() -> {
-            int sessions11 = getTestingClientForStartedNodeInDc(0).testing().cache(cacheName).size();
-            int sessions12 = getTestingClientForStartedNodeInDc(1).testing().cache(cacheName).size();
-            int clientSessions11 = getTestingClientForStartedNodeInDc(0).testing().cache(clientSessionsCacheName).size();
-            int clientSessions12 = getTestingClientForStartedNodeInDc(1).testing().cache(clientSessionsCacheName).size();
-            int remoteSessions11 = (Integer) cacheDc1Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-            int remoteSessions12 = (Integer) cacheDc2Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-            log.infof("After creating sessions: sessions11: %d, sessions12: %d, remoteSessions11: %d, remoteSessions12: %d, clientSessions11: %d, clientSessions12: %d",
-                    sessions11, sessions12, remoteSessions11, remoteSessions12, clientSessions11, clientSessions12);
-
-            Assert.assertEquals(sessions11, sessions01 + SESSIONS_COUNT);
-            Assert.assertEquals(sessions12, sessions02 + SESSIONS_COUNT);
-
-            if (includeRemoteStats) {
-                Assert.assertEquals(remoteSessions11, remoteSessions01 + SESSIONS_COUNT);
-                Assert.assertEquals(remoteSessions12, remoteSessions02 + SESSIONS_COUNT);
-            }
-        }, 50, 50);
-
-        return responses;
-    }
-
-
-    private void assertStatisticsExpected(String messagePrefix, String cacheName, String clientSessionsCacheName,
-                                          InfinispanStatistics cacheDc1Statistics, InfinispanStatistics cacheDc2Statistics, InfinispanStatistics channelStatisticsCrossDc,
-                                  int sessions1Expected, int sessions2Expected, int clientSessions1Expected, int clientSessions2Expected, int remoteSessions1Expected, int remoteSessions2Expected, boolean checkSomeMessagesSentBetweenDCs) {
-        Retry.execute(() -> {
-            int sessions1 = getTestingClientForStartedNodeInDc(0).testing().cache(cacheName).size();
-            int sessions2 = getTestingClientForStartedNodeInDc(1).testing().cache(cacheName).size();
-            int clientSessions1 = getTestingClientForStartedNodeInDc(0).testing().cache(clientSessionsCacheName).size();
-            int clientSessions2 = getTestingClientForStartedNodeInDc(1).testing().cache(clientSessionsCacheName).size();
-            int remoteSessions1 = (Integer) cacheDc1Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-            int remoteSessions2 = (Integer) cacheDc2Statistics.getSingleStatistics(InfinispanStatistics.Constants.STAT_CACHE_NUMBER_OF_ENTRIES);
-            // Needs to use "received_messages" on Infinispan 9.2.4.Final.  Stats for "sent_messages" is always null
-            long messagesCount = (Long) channelStatisticsCrossDc.getSingleStatistics(InfinispanStatistics.Constants.STAT_CHANNEL_RECEIVED_MESSAGES);
-            log.infof(messagePrefix + ": sessions1: %d, sessions2: %d, clientSessions1: %d, clientSessions2: %d, remoteSessions1: %d, remoteSessions2: %d, sentMessages: %d", sessions1, sessions2, clientSessions1, clientSessions2, remoteSessions1, remoteSessions2, messagesCount);
-
-            Assert.assertEquals(sessions1, sessions1Expected);
-            Assert.assertEquals(sessions2, sessions2Expected);
-            Assert.assertEquals(clientSessions1, clientSessions1Expected);
-            Assert.assertEquals(clientSessions2, clientSessions2Expected);
-            Assert.assertEquals(remoteSessions1, remoteSessions1Expected);
-            Assert.assertEquals(remoteSessions2, remoteSessions2Expected);
-
-            // Workaround...
-            if (checkSomeMessagesSentBetweenDCs) {
-                assertThat(messagesCount, Matchers.greaterThan(0l));
-            }
-
-        }, 50, 50);
-    }
-
-
-    @Test
-    public void testRealmRemoveOfflineSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        createInitialSessions(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,true, cacheDc1Statistics, cacheDc2Statistics, true);
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove test realm
-        getAdminClient().realm(REALM_NAME).remove();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After realm remove", InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testLogoutAllInRealm(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, false, cacheDc1Statistics, cacheDc2Statistics, true);
-
-        channelStatisticsCrossDc.reset();
-
-        // Logout all in realm
-        getAdminClient().realm(REALM_NAME).logoutAll();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After realm logout", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testPeriodicExpirationSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        OAuthClient.AccessTokenResponse lastAccessTokenResponse = createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,false, cacheDc1Statistics, cacheDc2Statistics, true).get(SESSIONS_COUNT - 1);
-
-        // Assert I am able to refresh
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(lastAccessTokenResponse.getRefreshToken(), "password");
-        Assert.assertNotNull(refreshResponse.getRefreshToken());
-        Assert.assertNull(refreshResponse.getError());
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0
-        getTestingClientForStartedNodeInDc(0).testing().removeExpired(REALM_NAME);
-
-        // Nothing yet expired. It may happen that no message sent between DCs
-        assertStatisticsExpected("After remove expired - 1", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01 + SESSIONS_COUNT, sessions02 + SESSIONS_COUNT,  clientSessions01 + SESSIONS_COUNT, clientSessions02 + SESSIONS_COUNT,
-                remoteSessions01 + SESSIONS_COUNT, remoteSessions02 + SESSIONS_COUNT, false);
-
-
-        // Increase offset to 10 minutes (SSO Session Idle is 5 minutes for the realm). To make sure that admin session from master realm won't expire
-        setTimeOffset(610);
-
-        // Assert I am not able to refresh anymore
-        refreshResponse = oauth.doRefreshTokenRequest(lastAccessTokenResponse.getRefreshToken(), "password");
-        Assert.assertNull(refreshResponse.getRefreshToken());
-        Assert.assertNotNull(refreshResponse.getError());
-
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).processExpiration();
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).processExpiration();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After remove expired - 2", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testPeriodicExpirationOfflineSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        OAuthClient.AccessTokenResponse lastAccessTokenResponse = createInitialSessions(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                true, cacheDc1Statistics, cacheDc2Statistics, true).get(SESSIONS_COUNT - 1);
-
-        // Assert I am able to refresh
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(lastAccessTokenResponse.getRefreshToken(), "password");
-        Assert.assertNotNull(refreshResponse.getRefreshToken());
-        Assert.assertNull(refreshResponse.getError());
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).processExpiration();
-
-        // Nothing yet expired. It may happen that no message sent between DCs
-        assertStatisticsExpected("After remove expired - 1", InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01 + SESSIONS_COUNT, sessions02 + SESSIONS_COUNT,  clientSessions01 + SESSIONS_COUNT, clientSessions02 + SESSIONS_COUNT,
-                remoteSessions01 + SESSIONS_COUNT, remoteSessions02 + SESSIONS_COUNT, false);
-
-
-        // Increase offset to 20 minutes. Client offline sessions should be expired from infinispan by that. Master sessions will still remain there.
-        setTimeOffset(1210);
-
-        // Assert I am not able to refresh anymore
-        refreshResponse = oauth.doRefreshTokenRequest(lastAccessTokenResponse.getRefreshToken(), "password");
-        Assert.assertNull(refreshResponse.getRefreshToken());
-        Assert.assertNotNull(refreshResponse.getError());
-
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).processExpiration();
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME).processExpiration();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After remove expired - 2", InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    // USER OPERATIONS
-
-    @Test
-    public void testUserRemoveSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-        createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,false, cacheDc1Statistics, cacheDc2Statistics, true);
-
-//        log.infof("Sleeping!");
-//        Thread.sleep(10000000);
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove test user
-        ApiUtil.findUserByUsernameId(getAdminClient().realm(REALM_NAME), "login-test").remove();
-
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After user remove", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testUserRemoveOfflineSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-        createInitialSessions(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,true, cacheDc1Statistics, cacheDc2Statistics, true);
-
-//        log.infof("Sleeping!");
-//        Thread.sleep(10000000);
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove test user
-        ApiUtil.findUserByUsernameId(getAdminClient().realm(REALM_NAME), "login-test").remove();
-
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After user remove", InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testLogoutUser(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME, false, cacheDc1Statistics, cacheDc2Statistics, true);
-
-        channelStatisticsCrossDc.reset();
-
-        // Logout single session of user first
-        UserResource user = ApiUtil.findUserByUsernameId(getAdminClient().realm(REALM_NAME), "login-test");
-        UserSessionRepresentation userSession = user.getUserSessions().get(0);
-        getAdminClient().realm(REALM_NAME).deleteSession(userSession.getId(), false);
-
-        // Just one session expired.
-        assertStatisticsExpected("After logout single session", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01 + SESSIONS_COUNT - 1, sessions02 + SESSIONS_COUNT - 1, clientSessions01 + SESSIONS_COUNT - 1, clientSessions02 + SESSIONS_COUNT - 1,
-                remoteSessions01 + SESSIONS_COUNT - 1, remoteSessions02 + SESSIONS_COUNT - 1, true);
-
-        // Logout all sessions for user now
-        user.logout();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertStatisticsExpected("After user logout", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02, remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    @InitialDcState(authServers = ServerSetup.ALL_NODES_IN_FIRST_DC_FIRST_NODE_IN_SECOND_DC)
-    public void testLogoutUserWithFailover(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        // Don't include remote stats. Size is smaller because of distributed cache
-        List<OAuthClient.AccessTokenResponse> responses = createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                false, cacheDc1Statistics, cacheDc2Statistics, false);
-
-        // Kill node2 now. Around 10 sessions (half of SESSIONS_COUNT) will be lost on Keycloak side. But not on infinispan side
-        CrossDCTestEnricher.stopAuthServerBackendNode(DC.FIRST, 1);
-
-        // Assert it's still possible to refresh tokens. UserSessions, which were cleared from the Keycloak node, should be downloaded from remoteStore
-        int i1 = 0;
-        for (OAuthClient.AccessTokenResponse response : responses) {
-            i1++;
-            OAuthClient.AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
-            Assert.assertNotNull("Failed in iteration " + i1, refreshTokenResponse.getRefreshToken());
-            Assert.assertNull("Failed in iteration " + i1, refreshTokenResponse.getError());
-        }
-
-        channelStatisticsCrossDc.reset();
-
-        // Increase offset a bit to ensure logout happens later then token issued time
-        setTimeOffset(10);
-
-        // Logout user
-        ApiUtil.findUserByUsernameId(getAdminClient().realm(REALM_NAME), "login-test").logout();
-
-        // Another increase after notBefore set
-        setTimeOffset(10);
-
-        // Assert it's not possible to refresh sessions. Works because user.notBefore
-        AtomicInteger i = new AtomicInteger(0);
-        Retry.execute(() -> {
-            i.incrementAndGet();
-            int j = 0;
-            for (OAuthClient.AccessTokenResponse response : responses) {
-                j++;
-                OAuthClient.AccessTokenResponse refreshTokenResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
-                Assert.assertNull("Failed in iteration " + j, refreshTokenResponse.getRefreshToken());
-                Assert.assertNotNull("Failed in iteration " + j, refreshTokenResponse.getError());
-            }
-
-            log.infof("Passed the testLogoutUserWithFailover in the iteration: %d", i.get());
-        }, 50, 50);
-    }
-
-
-    @Test
-    @InitialDcState(authServers = ServerSetup.ALL_NODES_IN_EVERY_DC)
-    public void testLogoutWithAllStartedNodes(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        // Create sessions. Don't include remote stats. Size is smaller because of distributed cache
-        List<OAuthClient.AccessTokenResponse> responses = createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                false, cacheDc1Statistics, cacheDc2Statistics, false);
-
-        // Simulate displaying sessions in admin console
-        Retry.execute(() -> {
-            assertTestAppActiveSessionsCount(SESSIONS_COUNT);
-        }, 50, 50);
-
-
-        // Logout realm and check sessions not anymore in admin console
-        getAdminClient().realm(REALM_NAME).logoutAll();
-
-        Retry.execute(() -> {
-            assertTestAppActiveSessionsCount(0);
-        }, 50, 50);
-
-
-        // Login again and check sessions back in
-        responses = createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                false, cacheDc1Statistics, cacheDc2Statistics, false);
-
-        Retry.execute(() -> {
-            assertTestAppActiveSessionsCount(SESSIONS_COUNT);
-        }, 50, 50);
-
-
-        // Logout user and check sessions not anymore in admin console
-        ApiUtil.findUserByUsernameId(getAdminClient().realm(REALM_NAME), "login-test").logout();
-
-        Retry.execute(() -> {
-            assertTestAppActiveSessionsCount(0);
-        }, 50, 50);
-
-        // Stop both nodes
-        CrossDCTestEnricher.stopAuthServerBackendNode(DC.FIRST, 1);
-        CrossDCTestEnricher.stopAuthServerBackendNode(DC.SECOND, 1);
-    }
-
-    private void assertTestAppActiveSessionsCount(int expectedSessionsCount) {
-        List<Map<String, String>> sessions = getAdminClient().realm(REALM_NAME).getClientSessionStats();
-
-        Optional<Map<String, String>> optional = sessions.stream().filter((Map<String, String> map) -> {
-            return map.get("clientId").equals("test-app");
-        }).findFirst();
-
-        if (expectedSessionsCount == 0) {
-            // No sessions present. Statistics for the client not included
-            Assert.assertFalse(optional.isPresent());
-        } else {
-            Map<String, String> testAppSessions = optional.get();
-            Assert.assertEquals(expectedSessionsCount, Integer.parseInt(testAppSessions.get("active")));
-        }
-
-        List<UserSessionRepresentation> userSessions = ApiUtil.findClientByClientId(getAdminClient().realm(REALM_NAME), "test-app").getUserSessions(0, 100);
-        Assert.assertEquals(expectedSessionsCount, userSessions.size());
-    }
-
-
-    // CLIENT SESSIONS
-
-    @Test
-    public void testClearDetachedClientSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        // Don't include remote stats. Size is smaller because of distributed cache
-        List<OAuthClient.AccessTokenResponse> responses = createInitialSessions(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                false, cacheDc1Statistics, cacheDc2Statistics, true);
-
-        // Directly remove the userSession entity on DC0. Should be propagated to DC1 as well, but clientSessions are not yet cleared (they become detached)
-        for (OAuthClient.AccessTokenResponse response : responses) {
-            String userSessionId = oauth.verifyToken(response.getAccessToken()).getSessionState();
-            getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).removeKey(userSessionId);
-        }
-
-        // Increase offset to 10 minutes (SSO Session Idle is 5 minutes for the realm). To make sure that admin session from master realm won't expire
-        setTimeOffset(610);
-
-        // Trigger removeExpired
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).processExpiration();
-
-        // Ensure clientSessions were removed
-        assertStatisticsExpected("After remove expired", InfinispanConnectionProvider.USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02,
-                remoteSessions01, remoteSessions02, true);
-    }
-
-
-    @Test
-    public void testClearDetachedOfflineClientSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        // Don't include remote stats. Size is smaller because of distributed cache
-        List<OAuthClient.AccessTokenResponse> responses = createInitialSessions(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                true, cacheDc1Statistics, cacheDc2Statistics, true);
-
-        // Directly remove the userSession entity on DC0. Should be propagated to DC1 as well, but clientSessions are not yet cleared (they become detached)
-        for (OAuthClient.AccessTokenResponse response : responses) {
-            String userSessionId = oauth.verifyToken(response.getAccessToken()).getSessionState();
-            getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).removeKey(userSessionId);
-        }
-
-        // Increase offset to 20 minutes. Client offline sessions should be expired from infinispan by that. Master sessions will still remain there.
-        setTimeOffset(1210);
-
-        // Trigger removeExpired
-        getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME).processExpiration();
-
-        // Ensure clientSessions were removed
-        assertStatisticsExpected("After remove expired", InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME, InfinispanConnectionProvider.OFFLINE_CLIENT_SESSION_CACHE_NAME,
-                cacheDc1Statistics, cacheDc2Statistics, channelStatisticsCrossDc,
-                sessions01, sessions02, clientSessions01, clientSessions02,
-                remoteSessions01, remoteSessions02, true);
-    }
-
-    // AUTH SESSIONS
-
-    @Test
-    public void testPeriodicExpirationAuthSessions(
-            @JmxInfinispanCacheStatistics(dc=DC.FIRST, managementPortProperty = "cache.server.management.port", cacheName=InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME) InfinispanStatistics cacheDc1Statistics,
-            @JmxInfinispanCacheStatistics(dc=DC.SECOND, managementPortProperty = "cache.server.2.management.port", cacheName=InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME) InfinispanStatistics cacheDc2Statistics,
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-        createInitialAuthSessions();
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0 and DC1
-        getTestingClientForStartedNodeInDc(0).testing().removeExpired(REALM_NAME);
-        getTestingClientForStartedNodeInDc(1).testing().removeExpired(REALM_NAME);
-
-        // Nothing yet expired.
-        assertAuthSessionsStatisticsExpected("After remove expired auth sessions - 1", channelStatisticsCrossDc,
-                SESSIONS_COUNT);
-
-        // Set time offset
-        setTimeOffset(10000000);
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove expired in DC0 and DC1. Need to trigger it on both!
-        getTestingClientForStartedNodeInDc(0).testing().removeExpired(REALM_NAME);
-        getTestingClientForStartedNodeInDc(1).testing().removeExpired(REALM_NAME);
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertAuthSessionsStatisticsExpected("After remove expired auth sessions - 2", channelStatisticsCrossDc,
-                0);
-
-    }
-
-
-    // Return last used accessTokenResponse
-    private void createInitialAuthSessions() throws Exception {
-
-        // Enable second DC
-        enableDcOnLoadBalancer(DC.SECOND);
-
-        // Check sessions count before test
-        authSessions01 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-        authSessions02 = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-        log.infof("Before creating authentication sessions: authSessions01: %d, authSessions02: %d", authSessions01, authSessions02);
-
-        // Create 20 authentication sessions
-        oauth.realm(REALM_NAME);
-
-        for (int i=0 ; i<SESSIONS_COUNT ; i++) {
-            oauth.openLoginForm();
-            driver.manage().deleteAllCookies();
-        }
-
-        // Assert 20 authentication sessions exists on node1 and node2 and on remote caches
-        Retry.execute(() -> {
-            int authSessions11 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-            int authSessions12 = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-            log.infof("After creating authentication sessions: sessions11: %d, authSessions12: %d", authSessions11, authSessions12);
-
-            // There are 20 new authentication sessions created totally in both datacenters
-            int diff1 = authSessions11 - authSessions01;
-            int diff2 = authSessions12 - authSessions02;
-            Assert.assertEquals(SESSIONS_COUNT, diff1 + diff2);
-        }, 50, 50);
-    }
-
-
-    private void assertAuthSessionsStatisticsExpected(String messagePrefix, InfinispanStatistics channelStatisticsCrossDc,
-                                          int expectedAuthSessionsCountDiff) {
-        Retry.execute(() -> {
-            int authSessions1 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-            int authSessions2 = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME).size();
-            long messagesCount = (Long) channelStatisticsCrossDc.getSingleStatistics(InfinispanStatistics.Constants.STAT_CHANNEL_RECEIVED_MESSAGES);
-            log.infof(messagePrefix + ": authSessions1: %d, authSessions2: %d, sentMessages: %d", authSessions1, authSessions2, messagesCount);
-
-            int diff1 = authSessions1 - authSessions01;
-            int diff2 = authSessions2 - authSessions02;
-
-            Assert.assertEquals(expectedAuthSessionsCountDiff, diff1 + diff2);
-        }, 50, 50);
-    }
-
-
-    @Test
-    public void testRealmRemoveAuthSessions(
-            @JmxInfinispanChannelStatistics() InfinispanStatistics channelStatisticsCrossDc) throws Exception {
-
-        createInitialAuthSessions();
-
-        channelStatisticsCrossDc.reset();
-
-        // Remove test realm
-        getAdminClient().realm(REALM_NAME).remove();
-
-        // Assert sessions removed on node1 and node2 and on remote caches.
-        assertAuthSessionsStatisticsExpected("After realm removed", channelStatisticsCrossDc,
-                0);
-    }
-
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionsPreloadCrossDCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionsPreloadCrossDCTest.java
deleted file mode 100644
index ce454696556c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/crossdc/SessionsPreloadCrossDCTest.java
+++ /dev/null
@@ -1,203 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.crossdc;
-
-import java.util.LinkedList;
-import java.util.List;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.common.util.Retry;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.CrossDCTestEnricher;
-import org.keycloak.testsuite.arquillian.annotation.InitialDcState;
-import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
-import org.keycloak.testsuite.util.OAuthClient;
-import java.util.Set;
-import org.hamcrest.Matchers;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * Tests userSessions and offline sessions preloading at startup
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@InitialDcState(authServers = ServerSetup.ALL_NODES_IN_FIRST_DC_NO_NODES_IN_SECOND_DC)
-public class SessionsPreloadCrossDCTest extends AbstractAdminCrossDCTest {
-
-    private static final int SESSIONS_COUNT = 10;
-
-    @Before
-    public void beforeSessionsPreloadCrossDCTest() throws Exception {
-        disableDcOnLoadBalancer(DC.SECOND);
-    }
-
-    private void stopAllCacheServersAndAuthServers() {
-        log.infof("Going to stop all auth servers");
-
-        CrossDCTestEnricher.forAllBackendNodes(CrossDCTestEnricher::stopAuthServerBackendNode);
-        loadBalancerCtrl.disableAllBackendNodes();
-
-        log.infof("Auth servers stopped successfully. Going to stop all cache servers");
-
-        DC.validDcsStream().forEach(CrossDCTestEnricher::stopCacheServer);
-        log.infof("Cache servers stopped successfully");
-    }
-
-    @Test
-    public void sessionsPreloadTest() throws Exception {
-        int sessionsBefore = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).size();
-        log.infof("sessionsBefore: %d", sessionsBefore);
-
-        // Create initial sessions
-        List<OAuthClient.AccessTokenResponse> tokenResponses = createInitialSessions(false);
-
-        // Start 2nd DC.
-        CrossDCTestEnricher.startAuthServerBackendNode(DC.SECOND, 0);
-        enableLoadBalancerNode(DC.SECOND, 0);
-
-        // Ensure sessions are loaded in both 1st DC and 2nd DC
-        Set<String> sessions01keys = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).enumerateKeys();
-        Set<String> sessions02keys = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).enumerateKeys();
-        log.infof("sessions01keys: %s, sessions02keys: %s", sessions01keys, sessions02keys);
-        assertThat(sessions01keys, Matchers.equalTo(sessions02keys));
-
-        // On DC2 sessions were preloaded from remoteCache
-        Assert.assertTrue(getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::remoteCacheLoad::sessions"));
-
-        // Assert refreshing works
-        for (OAuthClient.AccessTokenResponse resp : tokenResponses) {
-            OAuthClient.AccessTokenResponse newResponse = oauth.doRefreshTokenRequest(resp.getRefreshToken(), "password");
-            Assert.assertNull(newResponse.getError());
-            Assert.assertNotNull(newResponse.getAccessToken());
-        }
-    }
-
-
-    @Test
-    public void offlineSessionsPreloadTest() throws Exception {
-        int offlineSessionsBefore = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).size();
-        log.infof("offlineSessionsBefore: %d", offlineSessionsBefore);
-
-        // Create initial sessions
-        List<OAuthClient.AccessTokenResponse> tokenResponses = createInitialSessions(true);
-
-        int offlineSessions01 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).size();
-        Assert.assertEquals(offlineSessions01, offlineSessionsBefore + SESSIONS_COUNT);
-        log.infof("offlineSessions01: %d", offlineSessions01);
-
-        // Stop Everything
-        stopAllCacheServersAndAuthServers();
-
-        // Start cache containers on both DC1 and DC2
-        DC.validDcsStream().forEach(CrossDCTestEnricher::startCacheServer);
-
-        // Start Keycloak on DC1. Sessions should be preloaded from DB
-        CrossDCTestEnricher.startAuthServerBackendNode(DC.FIRST, 0);
-        enableLoadBalancerNode(DC.FIRST, 0);
-
-        // Start Keycloak on DC2. Sessions should be preloaded from remoteCache
-        CrossDCTestEnricher.startAuthServerBackendNode(DC.SECOND, 0);
-        enableLoadBalancerNode(DC.SECOND, 0);
-
-        // Ensure sessions are loaded in both 1st DC and 2nd DC
-        Set<String> offlineSessions11keys = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).enumerateKeys();
-        Set<String> offlineSessions12keys = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.OFFLINE_USER_SESSION_CACHE_NAME).enumerateKeys();
-        log.infof("offlineSessions11keys: %s, offlineSessions12keys: %s", offlineSessions11keys, offlineSessions12keys);
-        assertThat(offlineSessions11keys, Matchers.equalTo(offlineSessions12keys));
-
-        // On DC1 sessions were preloaded from DB. On DC2 sessions were preloaded from remoteCache
-        Assert.assertTrue(getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::offlineUserSessions"));
-        Assert.assertFalse(getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::remoteCacheLoad::offlineSessions"));
-
-        Assert.assertFalse(getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::offlineUserSessions"));
-        Assert.assertTrue(getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::remoteCacheLoad::offlineSessions"));
-
-        // Assert refreshing with offline tokens work
-        for (OAuthClient.AccessTokenResponse resp : tokenResponses) {
-            OAuthClient.AccessTokenResponse newResponse = oauth.doRefreshTokenRequest(resp.getRefreshToken(), "password");
-            Assert.assertNull(newResponse.getError());
-            Assert.assertNotNull(newResponse.getAccessToken());
-        }
-    }
-
-
-    @Test
-    public void loginFailuresPreloadTest() throws Exception {
-        // Enable brute force protector
-        try (RealmAttributeUpdater rau = new RealmAttributeUpdater(getAdminClientForStartedNodeInDc(0).realms().realm("test"))
-                .updateWith(r -> r.setBruteForceProtected(true))
-                .updateWith(r -> r.setQuickLoginCheckMilliSeconds(20L))  // This is necessary so user is not locked out for too fast consecutive login attempts; when user is locked out failure count stops increasing
-                .update()
-        ) {
-            String userId = ApiUtil.findUserByUsername(getAdminClientForStartedNodeInDc(0).realms().realm("test"), "test-user@localhost").getId();
-
-            int loginFailuresBefore = (Integer) getAdminClientForStartedNodeInDc(0).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
-            log.infof("loginFailuresBefore: %d", loginFailuresBefore);
-
-            // Create initial brute force records
-            for (int i = 0; i < SESSIONS_COUNT; i++) {
-                OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "bad-password");
-                Assert.assertNull(response.getAccessToken());
-                Assert.assertNotNull(response.getError());
-            }
-
-            // Start 2nd DC.
-            CrossDCTestEnricher.startAuthServerBackendNode(DC.SECOND, 0);
-            enableLoadBalancerNode(DC.SECOND, 0);
-
-            Retry.execute(() -> {
-                // Ensure loginFailures are loaded in both 1st DC and 2nd DC
-                Set<String> keys1 = getTestingClientForStartedNodeInDc(0).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).enumerateKeys();
-                Set<String> keys2 = getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME).enumerateKeys();
-                int loginFailures1 = (Integer) getAdminClientForStartedNodeInDc(0).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
-                int loginFailures2 = (Integer) getAdminClientForStartedNodeInDc(1).realm("test").attackDetection().bruteForceUserStatus(userId).get("numFailures");
-                log.infof("keys1: %d, keys2: %d, loginFailures1: %d, loginFailures2: %d", keys1, keys2, loginFailures1, loginFailures2);
-                assertThat(keys1, Matchers.equalTo(keys2));
-                Assert.assertEquals(loginFailuresBefore + SESSIONS_COUNT, loginFailures1);
-                Assert.assertEquals(loginFailuresBefore + SESSIONS_COUNT, loginFailures2);
-            }, 3, 400);
-
-            // On DC2 sessions were preloaded from remoteCache
-            Assert.assertTrue(getTestingClientForStartedNodeInDc(1).testing().cache(InfinispanConnectionProvider.WORK_CACHE_NAME).contains("distributed::remoteCacheLoad::loginFailures"));
-        }
-    }
-
-
-
-    private List<OAuthClient.AccessTokenResponse> createInitialSessions(boolean offline) throws Exception {
-        if (offline) {
-            oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        }
-
-        List<OAuthClient.AccessTokenResponse> responses = new LinkedList<>();
-
-        for (int i=0 ; i<SESSIONS_COUNT ; i++) {
-            OAuthClient.AccessTokenResponse resp = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
-            Assert.assertNull(resp.getError());
-            Assert.assertNotNull(resp.getAccessToken());
-            responses.add(resp);
-        }
-
-        return responses;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/docker/DockerClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/docker/DockerClientTest.java
index 9c41e4b16796..4b01cb252a5a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/docker/DockerClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/docker/DockerClientTest.java
@@ -147,15 +147,18 @@ public void shouldPerformDockerAuthAgainstRegistry() throws Exception {
         printCommandResult(result);
         assertThat("Error performing login", result.getExitCode(), is(0));
 
-        result = dockerClientContainer.execInContainer("docker", "pull", "docker.io/hello-world:latest");
+        // create a empty Dockerfile in /tmp
+        result = dockerClientContainer.execInContainer("sh", "-c", "echo -e \"FROM scratch\\nWORKDIR /\" > /tmp/Dockerfile");
         printCommandResult(result);
-        assertThat("Error pulling from docker.io", result.getExitCode(), is(0));
+        assertThat("Error creating dockerfile for empty image", result.getExitCode(), is(0));
 
-        result = dockerClientContainer.execInContainer("docker", "tag", "hello-world:latest", REGISTRY_HOSTNAME + ":" + REGISTRY_PORT + "/hello-world:latest");
+        // build the empty image
+        result = dockerClientContainer.execInContainer("docker", "build", "--tag", REGISTRY_HOSTNAME + ":" + REGISTRY_PORT + "/empty", "/tmp");
         printCommandResult(result);
-        assertThat("Error tagging the image", result.getExitCode(), is(0));
+        assertThat("Error building empty image", result.getExitCode(), is(0));
 
-        result = dockerClientContainer.execInContainer("docker", "push", REGISTRY_HOSTNAME + ":" + REGISTRY_PORT + "/hello-world:latest");
+        // push the image
+        result = dockerClientContainer.execInContainer("docker", "push", REGISTRY_HOSTNAME + ":" + REGISTRY_PORT + "/empty");
         printCommandResult(result);
         assertThat("Error pushing to registry", result.getExitCode(), is(0));
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportTest.java
index a41e7af174a2..439b334ef868 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportTest.java
@@ -43,11 +43,12 @@
 import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
 import org.keycloak.testsuite.client.resources.TestingExportImportResource;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.runonserver.RunHelpers;
 import org.keycloak.testsuite.util.JsonTestUtils;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.DeclarativeUserProfileProvider;
 import org.keycloak.util.JsonSerialization;
 
@@ -290,7 +291,7 @@ public void testExportUserProfileConfig() throws IOException {
         RealmResource realmRes = adminClient.realm(TEST_REALM);
 
         //add some non-default config
-        UPConfig persistedConfig = VerifyProfileTest.setUserProfileConfiguration(realmRes, VerifyProfileTest.CONFIGURATION_FOR_USER_EDIT);
+        UPConfig persistedConfig = UserProfileUtil.setUserProfileConfiguration(realmRes, UserProfileUtil.CONFIGURATION_FOR_USER_EDIT);
 
         //export
         TestingExportImportResource exportImport = testingClient.testing().exportImport();
@@ -336,7 +337,7 @@ public void testImportIgnoreExistingMissingClientId() {
             File testRealm = new File(url.getFile());
             assertThat(testRealm, Matchers.notNullValue());
 
-            File newFile = new File("target", "test-new-realm.json");
+            File newFile = new File("target", "test-realm-realm.json");
 
             try {
                 FileUtils.copyFile(testRealm, newFile);
@@ -362,6 +363,45 @@ public void testImportIgnoreExistingMissingClientId() {
         }
     }
 
+    @UncaughtServerErrorExpected
+    public void testImportNameMismatch() {
+        TestingExportImportResource resource = testingClient.testing().exportImport();
+
+        resource.setStrategy(Strategy.IGNORE_EXISTING);
+        resource.setProvider(DirExportProviderFactory.PROVIDER_ID);
+
+        String targetDirPath = resource.getExportImportTestDirectory() + File.separator + "dirRealmExport";
+        File dest = new File(targetDirPath);
+        try {
+            DirExportProvider.recursiveDeleteDir(dest);
+            resource.setDir(targetDirPath);
+
+            resource.setAction(ExportImportConfig.ACTION_EXPORT);
+
+            URL url = ExportImportTest.class.getResource("/model/testrealm.json");
+            File testRealm = new File(url.getFile());
+            assertThat(testRealm, Matchers.notNullValue());
+
+            File newFile = new File("target", "test-new-realm.json");
+
+            try {
+                FileUtils.copyFile(testRealm, newFile);
+                FileUtils.copyFileToDirectory(newFile, dest);
+            } catch (IOException e) {
+                Assert.fail("Cannot copy file. Details: " + e.getMessage());
+            }
+
+            File existingFile = FileUtils.getFile(dest, newFile.getName());
+            assertThat(existingFile, Matchers.notNullValue());
+
+            resource.setAction(ExportImportConfig.ACTION_IMPORT);
+
+            resource.runImport();
+        } finally {
+            DirExportProvider.recursiveDeleteDir(dest);
+        }
+    }
+
     private boolean isRealmPresent(String realmName) {
         return adminClient.realms().findAll().stream().anyMatch(realm -> realmName.equals(realm.getRealm()));
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
index 576a1458a888..a2320af29f48 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/exportimport/ExportImportUtil.java
@@ -56,6 +56,7 @@
 import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 import org.keycloak.representations.idm.authorization.ResourceServerRepresentation;
 import org.keycloak.representations.idm.authorization.ScopeRepresentation;
+import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.ldap.mappers.FullNameLDAPStorageMapper;
 import org.keycloak.storage.ldap.mappers.FullNameLDAPStorageMapperFactory;
@@ -108,6 +109,10 @@ public static void assertDataImportedInRealm(Keycloak adminClient, KeycloakTesti
 
         RealmResource realmRsc = adminClient.realm(realm.getRealm());
 
+        UPConfig upConfig = realmRsc.users().userProfile().getConfiguration();
+        upConfig.setUnmanagedAttributePolicy(UPConfig.UnmanagedAttributePolicy.ENABLED);
+        realmRsc.users().userProfile().update(upConfig);
+
         UserRepresentation user = findByUsername(realmRsc, "loginclient");
         Assert.assertNotNull(user);
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/feature/RecoveryAuthnCodesFeatureTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/feature/RecoveryAuthnCodesFeatureTest.java
index 6c470a24b9e2..81204dc84a3c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/feature/RecoveryAuthnCodesFeatureTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/feature/RecoveryAuthnCodesFeatureTest.java
@@ -22,7 +22,6 @@
 import org.keycloak.authentication.authenticators.browser.RecoveryAuthnCodesFormAuthenticatorFactory;
 import org.keycloak.common.Profile;
 import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 
 public class RecoveryAuthnCodesFeatureTest extends AbstractFeatureStateTest {
 
@@ -37,7 +36,6 @@ public String getFeatureSpiName() {
     }
 
     @Test
-    @EnableFeature(value = Profile.Feature.RECOVERY_CODES, skipRestart = true)
     public void featureEnabled() {
         testFeatureAvailability(true);
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
index 80d61f4a00ab..bb7bade945d3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
@@ -44,7 +44,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.TestAppHelper;
 
 
@@ -64,7 +64,7 @@ public abstract class AbstractKerberosSingleRealmTest extends AbstractKerberosTe
     public void spnegoNotAvailableTest() throws Exception {
         initHttpClient(false);
 
-        String kcLoginPageLocation = oauth.getLoginFormUrl();
+        String kcLoginPageLocation = oauth.loginForm().build();
 
         Response response = client.target(kcLoginPageLocation).request().get();
         Assert.assertEquals(401, response.getStatus());
@@ -189,7 +189,7 @@ public void credentialDelegationTest() throws Exception {
         response.close();
 
         // SPNEGO login
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson", "hnelson", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson", "hnelson", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
 
         // Assert kerberos ticket in the accessToken can be re-used to authenticate against other 3rd party kerberos service (ApacheDS Server in this case)
@@ -200,13 +200,13 @@ public void credentialDelegationTest() throws Exception {
         Assert.assertEquals("Horatio Nelson", ldapResponse);
 
         // Assert kerberos ticket also in userinfo endpoint
-        UserInfo userInfo = oauth.doUserInfoRequest(tokenResponse.getAccessToken());
+        UserInfo userInfo = oauth.doUserInfoRequest(tokenResponse.getAccessToken()).getUserInfo();
         Assert.assertEquals(serializedGssCredential, userInfo.getOtherClaims().get(KerberosConstants.GSS_DELEGATION_CREDENTIAL));
         // Clear USER_INFO_REQUEST event
         events.poll();
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
 
         // Remove protocolMapper
@@ -216,7 +216,7 @@ public void credentialDelegationTest() throws Exception {
         tokenResponse = assertSuccessfulSpnegoLogin("hnelson", "hnelson", "secret");
         token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertFalse(token.getOtherClaims().containsKey(KerberosConstants.GSS_DELEGATION_CREDENTIAL));
-        userInfo = oauth.doUserInfoRequest(tokenResponse.getAccessToken());
+        userInfo = oauth.doUserInfoRequest(tokenResponse.getAccessToken()).getUserInfo();
         Assert.assertFalse(userInfo.getOtherClaims().containsKey(KerberosConstants.GSS_DELEGATION_CREDENTIAL));
 
         events.clear();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java
index a240242650ab..2604ef24a505 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java
@@ -84,7 +84,7 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.KerberosRule;
 import org.keycloak.testsuite.util.KerberosUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * Contains just helper methods. No test methods.
@@ -160,7 +160,7 @@ public void beforeAbstractKeycloakTest() throws Exception {
         initHttpClient(true);
         removeAllUsers();
 
-        oauth.clientId("kerberos-app");
+        oauth.client("kerberos-app", "password");
 
         ComponentRepresentation rep = getUserStorageConfiguration();
         Response resp = testRealmResource().components().add(rep);
@@ -188,11 +188,11 @@ private void cleanupApacheHttpClient() {
 //    }
 
 
-    protected OAuthClient.AccessTokenResponse assertSuccessfulSpnegoLogin(String loginUsername, String expectedUsername, String password) throws Exception {
+    protected AccessTokenResponse assertSuccessfulSpnegoLogin(String loginUsername, String expectedUsername, String password) throws Exception {
         return assertSuccessfulSpnegoLogin("kerberos-app", loginUsername, expectedUsername, password);
     }
 
-    protected OAuthClient.AccessTokenResponse assertSuccessfulSpnegoLogin(String clientId, String loginUsername, String expectedUsername, String password) throws Exception {
+    protected AccessTokenResponse assertSuccessfulSpnegoLogin(String clientId, String loginUsername, String expectedUsername, String password) throws Exception {
         events.clear();
         oauth.clientId(clientId);
         Response spnegoResponse = spnegoLogin(loginUsername, password);
@@ -208,14 +208,12 @@ protected OAuthClient.AccessTokenResponse assertSuccessfulSpnegoLogin(String cli
 
         String codeUrl = spnegoResponse.getLocation().toString();
 
-        OAuthClient.AccessTokenResponse tokenResponse = assertAuthenticationSuccess(codeUrl);
+        AccessTokenResponse tokenResponse = assertAuthenticationSuccess(codeUrl);
 
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertEquals(userId, token.getSubject());
         Assert.assertEquals(expectedUsername, token.getPreferredUsername());
 
-        oauth.idTokenHint(tokenResponse.getIdToken());
-
         return tokenResponse;
     }
 
@@ -243,7 +241,7 @@ protected String invokeLdap(GSSCredential gssCredential, String username) throws
 
 
     protected Response spnegoLogin(String username, String password) {
-        String kcLoginPageLocation = oauth.getLoginFormUrl();
+        String kcLoginPageLocation = oauth.loginForm().state("spnegoLogin").build();
 
         // Request for SPNEGO login sent with Resteasy client
         spnegoSchemeFactory.setCredentials(username, password);
@@ -330,7 +328,7 @@ protected void assertUserStorageProvider(UserRepresentation user, String provide
     }
 
 
-    protected OAuthClient.AccessTokenResponse assertAuthenticationSuccess(String codeUrl) throws Exception {
+    protected AccessTokenResponse assertAuthenticationSuccess(String codeUrl) throws Exception {
         List<NameValuePair> pairs = URLEncodedUtils.parse(new URI(codeUrl), StandardCharsets.UTF_8);
         String code = null;
         String state = null;
@@ -343,7 +341,7 @@ protected OAuthClient.AccessTokenResponse assertAuthenticationSuccess(String cod
         }
         Assert.assertNotNull(code);
         Assert.assertNotNull(state);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         Assert.assertNotNull(response.getAccessToken());
         events.clear();
         return response;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapCrossRealmTrustTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapCrossRealmTrustTest.java
index f5eed8c240d1..fbe41393e022 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapCrossRealmTrustTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapCrossRealmTrustTest.java
@@ -30,7 +30,7 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.util.KerberosRule;
 import org.keycloak.testsuite.KerberosEmbeddedServer;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import jakarta.ws.rs.core.Response;
 import org.keycloak.testsuite.util.TestAppHelper;
@@ -70,14 +70,14 @@ protected ComponentRepresentation getUserStorageConfiguration() {
     @Test
     public void test01SpnegoLoginCRTSuccess() throws Exception {
         // Login as user from realm KC2.COM . Realm KEYCLOAK.ORG will trust us
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
 
         Assert.assertEquals(token.getEmail(), "hnelson2@kc2.com");
         assertUser("hnelson2", "hnelson2@kc2.com", "Horatio", "Nelson", "hnelson2@KC2.COM", false);
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
     }
 
@@ -86,14 +86,14 @@ public void test01SpnegoLoginCRTSuccess() throws Exception {
     @Test
     public void test02SpnegoLoginCorrectKerberosPrincipalUserFound() throws Exception {
         // Login as kerberos user jduke@KC2.COM. Ensure I am logged as user "jduke2" from realm KC2.COM (not as user jduke@KEYCLOAK.ORG)
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("jduke@KC2.COM", "jduke2", "theduke2");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("jduke@KC2.COM", "jduke2", "theduke2");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
 
         Assert.assertEquals(token.getEmail(), "jduke2@kc2.com");
         assertUser("jduke2", "jduke2@kc2.com", "Java", "Duke", "jduke@KC2.COM", false);
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
 
         // Another login to check the scenario when user is in local storage
@@ -102,7 +102,7 @@ public void test02SpnegoLoginCorrectKerberosPrincipalUserFound() throws Exceptio
         Assert.assertEquals(token.getEmail(), "jduke2@kc2.com");
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
     }
 
@@ -119,7 +119,7 @@ public void test03SpnegoLoginUsernamePassword() throws Exception {
         Assert.assertTrue(testAppHelper.login("jduke", "theduke"));
 
         // Logout
-        oauth.openLogout();
+        testAppHelper.logout();
         events.poll();
     }
 
@@ -129,14 +129,14 @@ public void test04SpnegoLoginWithoutKerberosPrincipalAttrConfigured() throws Exc
         updateUserStorageProvider(kerberosProvider -> kerberosProvider.getConfig().putSingle(KerberosConstants.KERBEROS_PRINCIPAL_ATTRIBUTE, null));
 
         // Keycloak will lookup user just based on 1st part of kerberos principal. Hence for "jduke@KC2.COM", it will lookup user "jduke"
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("jduke@KC2.COM", "jduke", "theduke2");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("jduke@KC2.COM", "jduke", "theduke2");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
 
         Assert.assertEquals(token.getEmail(), "jduke@keycloak.org");
         assertUser("jduke", "jduke@keycloak.org", "Java", "Duke", null, false);
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
 
         // This refers to same user as above login
@@ -146,7 +146,7 @@ public void test04SpnegoLoginWithoutKerberosPrincipalAttrConfigured() throws Exc
         Assert.assertEquals(token.getEmail(), "jduke@keycloak.org");
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapMultipleLDAPProvidersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapMultipleLDAPProvidersTest.java
index ebe9fd00dc39..efb500a16a52 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapMultipleLDAPProvidersTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapMultipleLDAPProvidersTest.java
@@ -37,7 +37,7 @@
 import org.keycloak.testsuite.KerberosEmbeddedServer;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.KerberosRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -85,7 +85,7 @@ public void test01spnegoWith1stProviderBrokenKerberosConfiguration() throws Exce
         getCleanup().addComponentId(ApiUtil.getCreatedId(resp));
         resp.close();
 
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertEquals(token.getEmail(), "hnelson2@kc2.com");
         UserRepresentation user = assertUser("hnelson2", "hnelson2@kc2.com", "Horatio", "Nelson", "hnelson2@KC2.COM", false);
@@ -104,7 +104,7 @@ public void test02spnegoWith1stProviderBrokenLookupOfKerberosUser() throws Excep
         getCleanup().addComponentId(ApiUtil.getCreatedId(resp));
         resp.close();
 
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertEquals(token.getEmail(), "hnelson2@kc2.com");
         UserRepresentation user = assertUser("hnelson2", "hnelson2@kc2.com", "Horatio", "Nelson", "hnelson2@KC2.COM", false);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapTest.java
index 139160584693..78890bcbdb9e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosLdapTest.java
@@ -47,7 +47,7 @@
 import org.keycloak.testsuite.util.KerberosRule;
 import org.keycloak.testsuite.KerberosEmbeddedServer;
 import org.keycloak.testsuite.util.LDAPTestUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.TestAppHelper;
 
 import static org.keycloak.common.constants.KerberosConstants.KERBEROS_PRINCIPAL;
@@ -92,7 +92,7 @@ public void changeKerberosPrincipalWhenUserChangesInLDAPTest() throws Exception
         ContainerAssume.assumeNotAuthServerQuarkus();
 
         try {
-            OAuthClient.AccessTokenResponse accessTokenResponse = assertSuccessfulSpnegoLogin("hnelson", "hnelson", "secret");
+            AccessTokenResponse accessTokenResponse = assertSuccessfulSpnegoLogin("hnelson", "hnelson", "secret");
 
             // Assert user was imported
             assertUser("hnelson", "hnelson@keycloak.org", "Horatio", "Nelson", "hnelson@KEYCLOAK.ORG", false);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneCrossRealmTrustTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneCrossRealmTrustTest.java
index 3e31930b8f95..2d8dcc625fd4 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneCrossRealmTrustTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneCrossRealmTrustTest.java
@@ -29,6 +29,7 @@
 import org.keycloak.testsuite.util.KerberosRule;
 import org.keycloak.testsuite.KerberosEmbeddedServer;
 import org.keycloak.testsuite.util.TestAppHelper;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -74,11 +75,11 @@ public void test01spnegoLoginSameRealmTest() throws Exception {
     @Test
     public void test02spnegoLoginDifferentRealmTest() throws Exception {
         // Cross-realm trust login. Realm KEYCLOAK.ORG trusts realm KC2.COM.
-        assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
         assertUser("hnelson2@kc2.com", "hnelson2@kc2.com", null, null, "hnelson2@KC2.COM", false);
 
         // Logout
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
         events.poll();
 
         // Another login to check the scenario when user is in local storage
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneMultipleProvidersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneMultipleProvidersTest.java
index cbbcaa72e123..8ac30a8c4983 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneMultipleProvidersTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneMultipleProvidersTest.java
@@ -38,7 +38,7 @@
 import org.keycloak.testsuite.KerberosEmbeddedServer;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.KerberosRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -87,7 +87,7 @@ public void test01spnegoWith1stProviderBrokenKerberosConfiguration() throws Exce
         getCleanup().addComponentId(ApiUtil.getCreatedId(resp));
         resp.close();
 
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertEquals(token.getEmail(), "hnelson2@kc2.com");
         UserRepresentation user = assertUser("hnelson2@kc2.com", "hnelson2@kc2.com", null, null, "hnelson2@KC2.COM", false);
@@ -107,7 +107,7 @@ public void test02spnegoWith1stProviderBrokenLookupOfKerberosUser() throws Excep
         getCleanup().addComponentId(ApiUtil.getCreatedId(resp));
         resp.close();
 
-        OAuthClient.AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
+        AccessTokenResponse tokenResponse = assertSuccessfulSpnegoLogin("hnelson2@KC2.COM", "hnelson2@kc2.com", "secret");
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         Assert.assertEquals(token.getEmail(), "hnelson2@kc2.com");
         UserRepresentation user = assertUser("hnelson2@kc2.com", "hnelson2@kc2.com", null, null, "hnelson2@KC2.COM",false);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneTest.java
index a2ed7f3eeb42..0af9fc6d346d 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KerberosStandaloneTest.java
@@ -59,7 +59,7 @@
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.KerberosRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import static org.keycloak.userprofile.UserProfileUtil.USER_METADATA_GROUP;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAccountRestApiTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAccountRestApiTest.java
index 2699dc92f655..b772a2c516ea 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAccountRestApiTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAccountRestApiTest.java
@@ -34,6 +34,7 @@
 import org.junit.runners.MethodSorters;
 import org.keycloak.admin.client.resource.UserProfileResource;
 import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.federation.kerberos.KerberosFederationProvider;
 import org.keycloak.models.LDAPConstants;
 import org.keycloak.models.RealmModel;
@@ -46,10 +47,10 @@
 import org.keycloak.services.resources.account.AccountCredentialResource;
 import org.keycloak.storage.ldap.idm.model.LDAPObject;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.util.LDAPRule;
 import org.keycloak.testsuite.util.LDAPTestUtils;
 import org.keycloak.testsuite.util.TokenUtil;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -90,6 +91,7 @@ protected LDAPRule getLDAPRule() {
 
     @Override
     protected void afterImportTestRealm() {
+        boolean isEmbeddedServer = ldapRule.isEmbeddedServer();
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
@@ -97,8 +99,17 @@ protected void afterImportTestRealm() {
             // Delete all LDAP users and add some new for testing
             LDAPTestUtils.removeAllLDAPUsers(ctx.getLdapProvider(), appRealm);
 
-            LDAPObject john = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "johnkeycloak", "John", "Doe", "john@email.org", null, "1234");
-            LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), john, "Password1");
+            if (isEmbeddedServer) {
+                MultivaluedHashMap<String, String> otherAttrs = new MultivaluedHashMap<>();
+
+                otherAttrs.putSingle(LDAPConstants.PWD_CHANGED_TIME, "22000101000000Z");
+
+                LDAPObject john = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "johnkeycloak", "John", "Doe", "john@email.org", otherAttrs);
+                LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), john, "Password1");
+            } else {
+                LDAPObject john = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "johnkeycloak", "John", "Doe", "john@email.org", null, "1234");
+                LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), john, "Password1");
+            }
         });
     }
 
@@ -173,7 +184,7 @@ public void testUpdateProfile() throws IOException {
     public void testUpdateProfileUnmanagedAttributes() throws IOException {
         // User profile unmanaged attributes supported
         UserProfileResource userProfileRes = testRealm().users().userProfile();
-        UPConfig origConfig = VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UPConfig origConfig = UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
 
         try {
             UserRepresentation user = getProfile();
@@ -241,7 +252,7 @@ public void testGetCredentials() throws IOException {
 
         // Password won't have createdDate and any metadata set
         Assert.assertEquals(PasswordCredentialModel.TYPE, userPassword.getType());
-        Assert.assertEquals(userPassword.getCreatedDate(), Long.valueOf(-1L));
+        Assert.assertTrue(userPassword.getCreatedDate() > -1L);
         Assert.assertNull(userPassword.getCredentialData());
         Assert.assertNull(userPassword.getSecretData());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAdminRestApiTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAdminRestApiTest.java
index ca04d93d8254..81e76badc409 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAdminRestApiTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPAdminRestApiTest.java
@@ -56,7 +56,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.fail;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.setUserProfileConfiguration;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.setUserProfileConfiguration;
 import static org.keycloak.util.JsonSerialization.writeValueAsString;
 
 /**
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPBinaryAttributesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPBinaryAttributesTest.java
index a42d49a5c57b..3535ee725f4e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPBinaryAttributesTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPBinaryAttributesTest.java
@@ -42,11 +42,11 @@
 import org.keycloak.storage.ldap.mappers.LDAPStorageMapper;
 import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapper;
 import org.keycloak.testsuite.client.KeycloakTestingClient;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.util.LDAPRule;
 import org.keycloak.testsuite.util.LDAPTestUtils;
 
 import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.validate.validators.LengthValidator;
 
 import java.util.Collections;
@@ -97,7 +97,7 @@ protected void afterImportTestRealm() {
 
         // User profile unmanaged attributes supported
         UserProfileResource userProfileRes = testRealm().users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
     }
 
 
@@ -246,7 +246,7 @@ public String getFirstAttribute(String name) {
                 } else if (UserModel.USERNAME.equals(name)) {
                     return username;
                 }
-                return super.getFirstAttribute(name);
+                return null;
             }
 
             @Override
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPExternalChangesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPExternalChangesTest.java
new file mode 100755
index 000000000000..1b8303c6ea00
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPExternalChangesTest.java
@@ -0,0 +1,166 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.federation.ldap;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.ClassRule;
+import org.junit.FixMethodOrder;
+import org.junit.Test;
+import org.junit.runners.MethodSorters;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.storage.UserStorageProviderModel;
+import org.keycloak.storage.ldap.idm.model.LDAPObject;
+import org.keycloak.testsuite.util.LDAPRule;
+import org.keycloak.testsuite.util.LDAPTestUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
+public class LDAPExternalChangesTest extends AbstractLDAPTest {
+
+    @ClassRule
+    public static LDAPRule ldapRule = new LDAPRule();
+
+    @Override
+    protected LDAPRule getLDAPRule() {
+        return ldapRule;
+    }
+
+    @Override
+    protected void afterImportTestRealm() {
+    }
+
+    @Before
+    public void onBefore() {
+        testingClient.testing().setTestingInfinispanTimeService();
+    }
+
+    @After
+    public void onAfter() {
+        testingClient.testing().revertTestingInfinispanTimeService();
+    }
+
+
+    @Test
+    public void failAuthenticationIfEmailDifferentThanExternalStorage() {
+        testingClient.server().run((session) -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            ctx.getLdapModel().setCachePolicy(UserStorageProviderModel.CachePolicy.MAX_LIFESPAN);
+            ctx.getLdapModel().setMaxLifespan(600000);
+            RealmModel realm = ctx.getRealm();
+            realm.updateComponent(ctx.getLdapModel());
+            LDAPObject john = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), realm, "johnkeycloak", "John", "Doe", "john@email.org", null, "1234");
+            LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), john, "Password1");
+            realm.getClientByClientId("test-app").setDirectAccessGrantsEnabled(true);
+        });
+        String originalEmail = "john@email.org";
+
+        // import user from the ldap johnkeycloak and cache it reading it by id
+        List<UserRepresentation> users = testRealm().users().search("johnkeycloak", true);
+        assertEquals(1, users.size());
+        UserRepresentation user = users.get(0);
+        String userId = user.getId();
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest(originalEmail, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        // modify the email of the user directly in ldap
+        String updatedEmail = "updatedjohnkeycloak@email.org";
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            LDAPObject johnLdapObject = ctx.getLdapProvider().loadLDAPUserByUsername(ctx.getRealm(), "johnkeycloak");
+            johnLdapObject.setSingleAttribute(LDAPConstants.EMAIL, updatedEmail);
+            ctx.getLdapProvider().getLdapIdentityStore().update(johnLdapObject);
+        });
+
+        tokenResponse = oauth.doPasswordGrantRequest(originalEmail, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        setTimeOffset(610);
+
+        tokenResponse = oauth.doPasswordGrantRequest(originalEmail, "Password1");
+        assertFalse(tokenResponse.isSuccess());
+
+        tokenResponse = oauth.doPasswordGrantRequest(updatedEmail, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        users = testRealm().users().search(originalEmail, true);
+        assertTrue(users.isEmpty());
+        users = testRealm().users().search("johnkeycloak", true);
+        assertEquals(1, users.size());
+        user = users.get(0);
+        assertEquals(userId, user.getId());
+        assertEquals(user.getEmail(), updatedEmail);
+    }
+
+    @Test
+    public void failAuthenticationIfUsernameDifferentThanExternalStorage() {
+        String originalUsername = "john";
+        testingClient.server().run((session) -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            ctx.getLdapModel().setCachePolicy(UserStorageProviderModel.CachePolicy.MAX_LIFESPAN);
+            ctx.getLdapModel().setMaxLifespan(600000);
+            RealmModel realm = ctx.getRealm();
+            realm.updateComponent(ctx.getLdapModel());
+            LDAPObject john = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), realm, originalUsername, "John", "Doe", "john@email.org", null, "1234");
+            LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), john, "Password1");
+            realm.getClientByClientId("test-app").setDirectAccessGrantsEnabled(true);
+        });
+        // import user from the ldap johnkeycloak and cache it reading it by id
+        List<UserRepresentation> users = testRealm().users().search(originalUsername, true);
+        assertEquals(1, users.size());
+        UserRepresentation user = users.get(0);
+        String userId = user.getId();
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest(originalUsername, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        // modify the email of the user directly in ldap
+        String updatedUsername = "changed" + originalUsername;
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            LDAPObject johnLdapObject = ctx.getLdapProvider().loadLDAPUserByUsername(ctx.getRealm(), originalUsername);
+            johnLdapObject.setSingleAttribute(LDAPConstants.UID, updatedUsername);
+            ctx.getLdapProvider().getLdapIdentityStore().update(johnLdapObject);
+        });
+
+        tokenResponse = oauth.doPasswordGrantRequest(originalUsername, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        setTimeOffset(610);
+
+        tokenResponse = oauth.doPasswordGrantRequest(originalUsername, "Password1");
+        assertFalse(tokenResponse.isSuccess());
+
+        tokenResponse = oauth.doPasswordGrantRequest(updatedUsername, "Password1");
+        assertTrue(tokenResponse.isSuccess());
+
+        users = testRealm().users().search(originalUsername, true);
+        assertTrue(users.isEmpty());
+        users = testRealm().users().search(updatedUsername, true);
+        user = users.get(0);
+        assertEquals(userId, user.getId());
+        assertEquals(user.getUsername(), updatedUsername);
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperCustomMemberOfTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperCustomMemberOfTest.java
new file mode 100644
index 000000000000..8b576ced43e1
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperCustomMemberOfTest.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.federation.ldap;
+
+import org.junit.ClassRule;
+import org.junit.FixMethodOrder;
+import org.junit.Test;
+import org.junit.runners.MethodSorters;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.storage.ldap.LDAPUtils;
+import org.keycloak.storage.ldap.idm.model.LDAPObject;
+import org.keycloak.storage.ldap.mappers.membership.LDAPGroupMapperMode;
+import org.keycloak.storage.ldap.mappers.membership.MembershipType;
+import org.keycloak.storage.ldap.mappers.membership.group.GroupLDAPStorageMapperFactory;
+import org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig;
+import org.keycloak.storage.user.SynchronizationResult;
+import org.keycloak.testsuite.util.LDAPRule;
+import org.keycloak.testsuite.util.LDAPTestUtils;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
+
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
+public class LDAPGroupMapperCustomMemberOfTest extends AbstractLDAPTest {
+
+    @ClassRule
+    public static LDAPRule ldapRule = new LDAPRule();
+
+    @Override
+    protected LDAPRule getLDAPRule() {
+        return ldapRule;
+    }
+
+    @Override
+    protected void afterImportTestRealm() {
+    }
+
+    // Test GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE with custom 'Member-Of LDAP Attribute'. As a workaround, we are testing this with custom attribute "street"
+    // just because it's available on all the LDAP servers
+    @Test
+    public void getGroupsFromUserMemberOfStrategyWithFilterTest() throws Exception {
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // Create group mapper
+            String descriptionAttrName = LDAPTestUtils.getGroupDescriptionLDAPAttrName(ctx.getLdapProvider());
+            LDAPTestUtils.addOrUpdateGroupMapper(appRealm, ctx.getLdapModel(), LDAPGroupMapperMode.LDAP_ONLY, descriptionAttrName, 
+                    GroupMapperConfig.USER_ROLES_RETRIEVE_STRATEGY, GroupMapperConfig.GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE,
+                    GroupMapperConfig.MEMBEROF_LDAP_ATTRIBUTE, LDAPConstants.STREET,
+                    GroupMapperConfig.PRESERVE_GROUP_INHERITANCE, "false",
+                    GroupMapperConfig.GROUPS_LDAP_FILTER, "(cn=ldap-group2)");
+
+            LDAPObject group1 = LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), "ldap-group1", descriptionAttrName, "group1 - description");
+            LDAPObject group2 = LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), "ldap-group2", descriptionAttrName, "group2 - description");
+            LDAPObject group3 = LDAPTestUtils.createLDAPGroup(session, appRealm, ctx.getLdapModel(), "ldap-group3", descriptionAttrName, "group3 - description");
+
+            // Create new user in LDAP. Add him some "street" referencing existing LDAP Group
+            LDAPObject carlos = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "carloskeycloak", "Carlos", "Doel", "carlos.doel@email.org", "street", "1234");
+            LDAPTestUtils.updateLDAPPassword(ctx.getLdapProvider(), carlos, "Password1");
+
+            // add "memberOf" attributes (simulated by "street" attr) to Carlos
+            LDAPUtils.addMember(LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel()), MembershipType.DN, LDAPConstants.STREET, "not-used", carlos, group1);
+            LDAPUtils.addMember(LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel()), MembershipType.DN, LDAPConstants.STREET, "not-used", carlos, group2);
+            LDAPUtils.addMember(LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel()), MembershipType.DN, LDAPConstants.STREET, "not-used", carlos, group3);
+
+            // Sync LDAP groups to Keycloak DB - it should bring only group2 due to the defined filter 
+            ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
+            SynchronizationResult syncDataResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(appRealm);
+            assertThat(syncDataResult.getAdded(), equalTo(1));
+        });
+
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // Get user in Keycloak. It should not load any new groups where Carlos is memberOf due to defined filter
+            UserModel carlos = session.users().getUserByUsername(appRealm, "carloskeycloak");
+            List<String> carlosGroups = carlos.getGroupsStream().map(GroupModel::getName).collect(Collectors.toList());
+
+            assertThat(carlosGroups, hasSize(1));
+            assertThat(carlosGroups, hasItem("ldap-group2"));
+        });
+    }
+}
+
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperTest.java
index 0c628f4a228f..11b5a0fd95be 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPGroupMapperTest.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.testsuite.federation.ldap;
 
+import org.hamcrest.Matchers;
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.FixMethodOrder;
@@ -52,6 +53,9 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
 import static org.keycloak.testsuite.util.LDAPTestUtils.getGroupDescriptionLDAPAttrName;
 
 /**
@@ -582,6 +586,11 @@ public void test05_getGroupsFromUserMemberOfStrategyTest() throws Exception {
             Assert.assertFalse(carlosGroups.contains(group12));
 
             Assert.assertEquals(1, carlosGroups.size());
+
+            // check the user is listed as the sole member of group1
+            List<UserModel> group1Members = session.users().getGroupMembersStream(appRealm, group1, 0, 10).toList();
+            assertThat(group1Members, hasSize(1));
+            assertThat(group1Members.get(0).getUsername(), equalTo("carloskeycloak"));
         });
 
         // Revert mappers
@@ -943,5 +952,39 @@ public void test10_multipleGroupMappersInDifferentPaths() {
             Assert.assertEquals("localuser", localGroupMembers.get(0));
         });
     }
+
+    @Test
+    public void test11_fetchUsersGroupsWithPaginationAndInvalidBatchSize() {
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // batch size 0 effectively disables pagination, code must fall back to non-paginated search
+            ComponentModel mapperModel = LDAPTestUtils.getLdapProviderModel(appRealm);
+            LDAPTestUtils.updateConfigOptions(mapperModel, LDAPConstants.BATCH_SIZE_FOR_SYNC, "0");
+            appRealm.updateComponent(mapperModel);
+        });
+
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // verify that getting the user's groups still works
+            UserModel john = session.users().getUserByUsername(appRealm, "johnkeycloak");
+            Set<GroupModel> johnGroups = john.getGroupsStream().collect(Collectors.toSet());
+            Assert.assertEquals(4, johnGroups.size());
+        });
+
+        String configuredBatchSize = ldapRule.getConfig().get(LDAPConstants.BATCH_SIZE_FOR_SYNC);
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // revert batch size change
+            ComponentModel mapperModel = LDAPTestUtils.getLdapProviderModel(appRealm);
+            LDAPTestUtils.updateConfigOptions(mapperModel, LDAPConstants.BATCH_SIZE_FOR_SYNC, configuredBatchSize);
+            appRealm.updateComponent(mapperModel);
+        });
+    }
 }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPLegacyImportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPLegacyImportTest.java
index badcb899c86a..d2a0b5134d6d 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPLegacyImportTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPLegacyImportTest.java
@@ -102,7 +102,7 @@ public void loginClassic() {
         loginPage.login("marykeycloak", "password-app");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
     }
 
@@ -112,7 +112,7 @@ public void loginLdap() {
         loginPage.login("johnkeycloak", "Password1");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation userRepresentation = AccountHelper.getUserRepresentation(testRealm(), "johnkeycloak");
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADFullNameTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADFullNameTest.java
index d9ab7db30086..c31ecae89965 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADFullNameTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADFullNameTest.java
@@ -248,8 +248,8 @@ public void test06_conflicts() {
 
         registerPage.register("John", "Existing", "johnyanth@check.cz", "existingkc2", "Password1", "Password1");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "Password1").getIdToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
 
         loginPage.open();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADMapperTest.java
index 5cb0e35f1557..06970063a7a2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMSADMapperTest.java
@@ -323,9 +323,7 @@ public void test06RegisterNewUser() {
             Assert.assertTrue(Long.parseLong(pwdLastSet) > 0);
 
             String userAccountControl = ldapJohn.getAttributeAsString(LDAPConstants.USER_ACCOUNT_CONTROL);
-            long longValue = userAccountControl == null ? 0 : Long.parseLong(userAccountControl);
-
-            Assert.assertFalse(new UserAccountControl(longValue).has(UserAccountControl.ACCOUNTDISABLE));
+            Assert.assertFalse(UserAccountControl.of(userAccountControl).has(UserAccountControl.ACCOUNTDISABLE));
         });
 
         // Logout and login again. Success
@@ -346,7 +344,7 @@ public void test07DisabledUserInMSADSwitchedToEnabledInKeycloak() {
             LDAPObject ldapJohn = ctx.getLdapProvider().loadLDAPUserByUsername(appRealm, "johnkeycloak");
 
             String userAccountControlStr = ldapJohn.getAttributeAsString(LDAPConstants.USER_ACCOUNT_CONTROL);
-            UserAccountControl control = new UserAccountControl(Long.parseLong(userAccountControlStr));
+            UserAccountControl control = UserAccountControl.of(userAccountControlStr);
             control.add(UserAccountControl.ACCOUNTDISABLE);
 
             ldapJohn.setSingleAttribute(LDAPConstants.USER_ACCOUNT_CONTROL, String.valueOf(control.getValue()));
@@ -517,7 +515,7 @@ public void test10DisabledUserSwitchedToEnabledOnMSAD() {
 
             LDAPObject ldapJohn = ctx.getLdapProvider().loadLDAPUserByUsername(appRealm, "johnkeycloak");
             String userAccountControlStr = ldapJohn.getAttributeAsString(LDAPConstants.USER_ACCOUNT_CONTROL);
-            UserAccountControl control = new UserAccountControl(Long.parseLong(userAccountControlStr));
+            UserAccountControl control = UserAccountControl.of(userAccountControlStr);
             control.remove(UserAccountControl.ACCOUNTDISABLE);
             ldapJohn.setSingleAttribute(LDAPConstants.USER_ACCOUNT_CONTROL, String.valueOf(control.getValue()));
             ctx.getLdapProvider().getLdapIdentityStore().update(ldapJohn);
@@ -565,7 +563,7 @@ private boolean isJohnEnabledInMSAD() {
         }
 
         // Need to remove double quotes TODO: Ideally fix fetchString method and all the tests, which uses it as it is dummy to need to remove quotes in each test individually...
-        UserAccountControl acControl = new UserAccountControl(Long.parseLong(userAccountControls.replace("\"","")));
+        UserAccountControl acControl = UserAccountControl.of(userAccountControls.replace("\"",""));
         return !acControl.has(UserAccountControl.ACCOUNTDISABLE);
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMultipleAttributesTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMultipleAttributesTest.java
index 5a64ea697c49..3647f643a2b5 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMultipleAttributesTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPMultipleAttributesTest.java
@@ -36,7 +36,8 @@
 import org.keycloak.testsuite.util.LDAPRule;
 import org.keycloak.testsuite.util.LDAPTestConfiguration;
 import org.keycloak.testsuite.util.LDAPTestUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Arrays;
 import java.util.Collection;
@@ -183,14 +184,14 @@ private static void assertPostalCodes(List<String> postalCodes, String... expect
     @Test
     public void ldapPortalEndToEndTest() {
         // Login as bwilson
-        oauth.clientId("ldap-portal");
+        oauth.client("ldap-portal", "password");
         oauth.redirectUri(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/ldap-portal");
 
         loginPage.open();
         loginPage.login("bwilson", "Password1");
 
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
@@ -202,14 +203,14 @@ public void ldapPortalEndToEndTest() {
         Assert.assertTrue(postalCodes.contains("88441"));
         Assert.assertTrue(postalCodes.contains("77332"));
 
-        oauth.doLogout(response.getRefreshToken(), "password");
+        oauth.doLogout(response.getRefreshToken());
 
         // Login as jbrown
         loginPage.open();
         loginPage.login("jbrown", "Password1");
 
-        code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        response = oauth.doAccessTokenRequest(code, "password");
+        code = oauth.parseLoginResponse().getCode();
+        response = oauth.doAccessTokenRequest(code);
 
         org.keycloak.testsuite.Assert.assertEquals(200, response.getStatusCode());
         idToken = oauth.verifyIDToken(response.getIdToken());
@@ -221,7 +222,7 @@ public void ldapPortalEndToEndTest() {
         Assert.assertTrue(postalCodes.contains("88441"));
         Assert.assertFalse(postalCodes.contains("77332"));
 
-        oauth.doLogout(response.getRefreshToken(), "password");
+        oauth.doLogout(response.getRefreshToken());
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPProvidersIntegrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPProvidersIntegrationTest.java
index e80c3b376130..e9256f2f6e67 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPProvidersIntegrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPProvidersIntegrationTest.java
@@ -22,7 +22,6 @@
 import org.junit.FixMethodOrder;
 import org.junit.Test;
 import org.junit.runners.MethodSorters;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.component.ComponentModel;
@@ -71,7 +70,7 @@
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.LDAPRule;
 import org.keycloak.testsuite.util.LDAPTestUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import javax.naming.AuthenticationException;
 import jakarta.ws.rs.core.Response;
@@ -107,6 +106,7 @@ protected void afterImportTestRealm() {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             LDAPTestUtils.addLocalUser(session, appRealm, "marykeycloak", "mary@test.com", "password-app");
 
@@ -154,6 +154,51 @@ public void testSyncRegistrationOff() {
         });
     }
 
+    @Test
+    public void testSyncRegistrationWithCreateDNRelativeToBaseDN() {
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            // use a broader DN to fetch users from - should still fetch all users if search scope is set to subtree
+            ctx.getLdapModel().put(LDAPConstants.USERS_DN, "dc=keycloak,dc=org");
+            ctx.getLdapModel().put(LDAPConstants.SEARCH_SCOPE, String.valueOf(SearchControls.SUBTREE_SCOPE));
+            // use a relative DN to store the users - final DN should be this DN + the users DN set above
+            ctx.getLdapModel().put(LDAPConstants.RELATIVE_CREATE_DN, "ou=People");
+            ctx.getRealm().updateComponent(ctx.getLdapModel());
+        });
+
+        // ensure users are still found when searching using a broader DN with subtree scope
+        Integer count = testingClient.server().fetch(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            return ctx.getLdapProvider().searchForUserStream(ctx.getRealm(), Map.of(), -1, -1).count();
+        }, Integer.class);
+        MatcherAssert.assertThat(count, Matchers.greaterThan(0));
+
+        // register a new user and check it was added to the right DN
+        UserRepresentation newUser = AbstractAuthTest.createUserRepresentation("newuser0", "newuser0@email.com", "New", "User0", true);
+        String userId;
+        try (Response resp = testRealm().users().create(newUser)) {
+            userId = ApiUtil.getCreatedId(resp);
+        }
+        newUser = testRealm().users().get(userId).toRepresentation();
+        assertFederatedUserLink(newUser);
+        MatcherAssert.assertThat(newUser, Matchers.notNullValue());
+        MatcherAssert.assertThat(newUser.firstAttribute(LDAPConstants.LDAP_ENTRY_DN), Matchers.containsString("=newuser0,ou=People,dc=keycloak,dc=org"));
+
+        // remove the created user
+        try (Response resp = testRealm().users().delete(userId)) {
+            Assert.assertEquals(Response.Status.NO_CONTENT.getStatusCode(), resp.getStatus());
+        }
+
+        // revert changes to the LDAP storage provider
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            ctx.getLdapModel().put(LDAPConstants.USERS_DN, "ou=People,dc=keycloak,dc=org");
+            ctx.getLdapModel().getConfig().remove(LDAPConstants.SEARCH_SCOPE);
+            ctx.getLdapModel().getConfig().remove(LDAPConstants.RELATIVE_CREATE_DN);
+            ctx.getRealm().updateComponent(ctx.getLdapModel());
+        });
+    }
+
     @Test
     public void testSyncRegistrationForceDefault() {
         // test force default is true by default and works as before
@@ -382,8 +427,8 @@ private void loginSuccessAndLogout(String username, String password) {
         loginPage.login(username, password);
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(events.poll());
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(events.poll());
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
         events.poll();
     }
 
@@ -423,7 +468,7 @@ public void deleteFederationLink() throws Exception {
         grantPage.accept();
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         ComponentRepresentation ldapRep = testRealm().components().component(ldapModelId).toRepresentation();
         testRealm().components().component(ldapModelId).remove();
@@ -457,7 +502,7 @@ public void loginClassic() {
         loginPage.login("marykeycloak", "password-app");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
     }
 
@@ -467,7 +512,7 @@ public void loginLdap() {
         loginPage.login("johnkeycloak", "Password1");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation userRepresentation = AccountHelper.getUserRepresentation(adminClient.realm(TEST_REALM_NAME), "johnkeycloak");
 
@@ -478,11 +523,11 @@ public void loginLdap() {
 
     @Test
     public void loginLdapWithDirectGrant() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "johnkeycloak", "Password1");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("johnkeycloak", "Password1");
         Assert.assertEquals(200, response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
-        response = oauth.doGrantAccessTokenRequest("password", "johnkeycloak", "");
+        response = oauth.doPasswordGrantRequest("johnkeycloak", "");
         Assert.assertEquals(401, response.getStatusCode());
     }
 
@@ -492,7 +537,7 @@ public void loginLdapWithEmail() {
         loginPage.login("john@email.org", "Password1");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
     @Test
@@ -540,7 +585,7 @@ public void ldapPasswordChangeWithAdminEndpointAndRequiredAction() throws Except
 
         events.expectRegister(username, email).assertEvent();
         EventRepresentation loginEvent = events.expectLogin().user(userId).assertEvent();
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         appPage.logout(tokenResponse.getIdToken());
         events.expectLogout(loginEvent.getSessionId()).user(userId).assertEvent();
 
@@ -591,8 +636,10 @@ public void ldapPasswordChangeWithAdminEndpointAndRequiredAction() throws Except
     private void assertPasswordConfiguredThroughLDAPOnly(UserResource user) {
         // Assert password not stored locally
         List<CredentialRepresentation> storedCredentials = user.credentials();
+        assertEquals(1, storedCredentials.size());
         for (CredentialRepresentation credential : storedCredentials) {
-            Assert.assertFalse(PasswordCredentialModel.TYPE.equals(credential.getType()));
+            Assert.assertTrue(PasswordCredentialModel.TYPE.equals(credential.getType()));
+            Assert.assertNotNull(credential.getFederationLink());
         }
 
         // Assert password is stored in the LDAP
@@ -1047,6 +1094,7 @@ public void testSearchWithCustomLDAPFilter() {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             ctx.getLdapModel().getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(|(mail=user5@email.org)(mail=user6@email.org))");
             appRealm.updateComponent(ctx.getLdapModel());
@@ -1055,6 +1103,7 @@ public void testSearchWithCustomLDAPFilter() {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "username5", "John5", "Doel5", "user5@email.org", null, "125");
             LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "username6", "John6", "Doel6", "user6@email.org", null, "126");
@@ -1095,6 +1144,7 @@ public void testSearchWithCustomLDAPFilter() {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
             UserStorageUtil.userCache(session).clear();
             // Add custom filter again
             ctx.getLdapModel().getConfig().putSingle(LDAPConstants.CUSTOM_USER_SEARCH_FILTER, "(|(mail=user5@email.org)(mail=user6@email.org))");
@@ -1105,6 +1155,7 @@ public void testSearchWithCustomLDAPFilter() {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
             UserStorageUtil.userCache(session).clear();
 
             // search by id using custom filter. Must return the user
@@ -1126,6 +1177,7 @@ public void testUnsynced() throws Exception {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             UserStorageProviderModel model = new UserStorageProviderModel(ctx.getLdapModel());
             model.getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.UNSYNCED.toString());
@@ -1135,6 +1187,7 @@ public void testUnsynced() throws Exception {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             UserModel user = session.users().getUserByUsername(appRealm, "johnkeycloak");
             Assert.assertNotNull(user);
@@ -1188,6 +1241,7 @@ public void testUnsynced() throws Exception {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
             UserModel user = session.users().getUserByUsername(appRealm, "johnkeycloak");
 
             // change username locally
@@ -1206,6 +1260,7 @@ public void testUnsynced() throws Exception {
         testingClient.server().run(session -> {
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             ctx.getLdapModel().getConfig().putSingle(LDAPConstants.EDIT_MODE, UserStorageProvider.EditMode.WRITABLE.toString());
 
@@ -1224,6 +1279,7 @@ public void testSearchByAttributes() {
 
             LDAPTestContext ctx = LDAPTestContext.init(session);
             RealmModel appRealm = ctx.getRealm();
+            session.getContext().setRealm(appRealm);
 
             LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "username8", "John8", "Doel8", "user8@email.org", null, ATTRIBUTE_VALUE);
             LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), appRealm, "username9", "John9", "Doel9", "user9@email.org", null, ATTRIBUTE_VALUE);
@@ -1285,45 +1341,52 @@ public void testSearchWithPartiallyCachedUser() {
 
     @Test
     public void testLDAPUserRefreshCache() {
-        testingClient.server().run(session -> {
-            UserStorageUtil.userCache(session).clear();
-        });
-
-        testingClient.server().run(session -> {
-            LDAPTestContext ctx = LDAPTestContext.init(session);
-            RealmModel appRealm = ctx.getRealm();
+        try {
+            testingClient.testing().setTestingInfinispanTimeService();
+            testingClient.server().run(session -> {
+                UserStorageUtil.userCache(session).clear();
+            });
 
-            LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
-            LDAPTestUtils.addLDAPUser(ldapProvider, appRealm, "johndirect", "John", "Direct", "johndirect@email.org", null, "1234");
+            testingClient.server().run(session -> {
+                LDAPTestContext ctx = LDAPTestContext.init(session);
+                RealmModel appRealm = ctx.getRealm();
+                session.getContext().setRealm(appRealm);
 
-            // Fetch user from LDAP and check that postalCode is filled
-            UserModel user = session.users().getUserByUsername(appRealm, "johndirect");
-            String postalCode = user.getFirstAttribute("postal_code");
-            Assert.assertEquals("1234", postalCode);
+                LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ctx.getLdapModel());
+                LDAPTestUtils.addLDAPUser(ldapProvider, appRealm, "johndirect", "John", "Direct", "johndirect@email.org", null, "1234");
 
-            LDAPTestUtils.removeLDAPUserByUsername(ldapProvider, appRealm, ldapProvider.getLdapIdentityStore().getConfig(), "johndirect");
-        });
+                // Fetch user from LDAP and check that postalCode is filled
+                UserModel user = session.users().getUserByUsername(appRealm, "johndirect");
+                String postalCode = user.getFirstAttribute("postal_code");
+                Assert.assertEquals("1234", postalCode);
 
-        setTimeOffset(60 * 5); // 5 minutes in future, user should be cached still
+                LDAPTestUtils.removeLDAPUserByUsername(ldapProvider, appRealm, ldapProvider.getLdapIdentityStore().getConfig(), "johndirect");
+            });
 
-        testingClient.server().run(session -> {
-            RealmModel appRealm = new RealmManager(session).getRealmByName("test");
-            CachedUserModel user = (CachedUserModel) session.users().getUserByUsername(appRealm, "johndirect");
-            String postalCode = user.getFirstAttribute("postal_code");
-            String email = user.getEmail();
-            Assert.assertEquals("1234", postalCode);
-            Assert.assertEquals("johndirect@email.org", email);
-        });
+            setTimeOffset(60 * 5); // 5 minutes in future, user should be cached still
 
-        setTimeOffset(60 * 20); // 20 minutes into future, cache will be invalidated
+            testingClient.server().run(session -> {
+                RealmModel appRealm = new RealmManager(session).getRealmByName("test");
+                session.getContext().setRealm(appRealm);
+                CachedUserModel user = (CachedUserModel) session.users().getUserByUsername(appRealm, "johndirect");
+                String postalCode = user.getFirstAttribute("postal_code");
+                String email = user.getEmail();
+                Assert.assertEquals("1234", postalCode);
+                Assert.assertEquals("johndirect@email.org", email);
+            });
 
-        testingClient.server().run(session -> {
-            RealmModel appRealm = new RealmManager(session).getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(appRealm, "johndirect");
-            Assert.assertNull(user);
-        });
+            setTimeOffset(60 * 20); // 20 minutes into future, cache will be invalidated
 
-        setTimeOffset(0);
+            testingClient.server().run(session -> {
+                RealmModel appRealm = new RealmManager(session).getRealmByName("test");
+                session.getContext().setRealm(appRealm);
+                UserModel user = session.users().getUserByUsername(appRealm, "johndirect");
+                Assert.assertNull(user);
+            });
+        } finally {
+            resetTimeOffset();
+            testingClient.testing().revertTestingInfinispanTimeService();
+        }
     }
 
     @Test
@@ -1388,6 +1451,7 @@ public void testCacheUser() {
     @Test
     public void testAlwaysReadValueFromLdapCached() throws Exception {
         try {
+            testingClient.testing().setTestingInfinispanTimeService();
             // import user from the ldap johnkeycloak and cache it reading it by id
             List<UserRepresentation> users = testRealm().users().search("johnkeycloak", true);
             Assert.assertEquals(1, users.size());
@@ -1430,6 +1494,8 @@ public void testAlwaysReadValueFromLdapCached() throws Exception {
                 johnLdapObject.setSingleAttribute(LDAPConstants.SN, "Doe");
                 ctx.getLdapProvider().getLdapIdentityStore().update(johnLdapObject);
             });
+            resetTimeOffset();
+            testingClient.testing().revertTestingInfinispanTimeService();
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPReadOnlyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPReadOnlyTest.java
index b98ef3ded297..d4a1650cfd29 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPReadOnlyTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPReadOnlyTest.java
@@ -18,6 +18,7 @@
 
 package org.keycloak.testsuite.federation.ldap;
 
+import java.util.List;
 import java.util.Map;
 import org.hamcrest.MatcherAssert;
 import org.jboss.arquillian.graphene.page.Page;
@@ -26,8 +27,9 @@
 import org.junit.FixMethodOrder;
 import org.junit.Test;
 import org.junit.runners.MethodSorters;
-import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
 import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.authentication.authenticators.browser.OTPFormAuthenticatorFactory;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.LDAPConstants;
@@ -35,6 +37,7 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
 import org.keycloak.models.utils.TimeBasedOTP;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.storage.StorageId;
@@ -56,7 +59,9 @@
 import java.util.Collections;
 
 import static org.hamcrest.CoreMatchers.is;
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
 /**
@@ -119,7 +124,7 @@ protected void afterImportTestRealm() {
     @Test
     public void testReadOnlyWithTOTPEnabled() {
         // Set TOTP required
-        setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement.REQUIRED);
+        setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement.REQUIRED, AuthenticationExecutionModel.Requirement.REQUIRED);
 
         // Authenticate as the LDAP user and assert it works
         loginPage.open();
@@ -134,10 +139,10 @@ public void testReadOnlyWithTOTPEnabled() {
         totpPage.configure(totp.generateTOTP(totpPage.getTotpSecret()));
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         // Revert TOTP
-        setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement.CONDITIONAL);
+        setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement.CONDITIONAL, AuthenticationExecutionModel.Requirement.ALTERNATIVE);
         UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "johnkeycloak");
         String totpCredentialId = user.credentials().stream()
                 .filter(credentialRep -> credentialRep.getType().equals(OTPCredentialModel.TYPE))
@@ -164,6 +169,26 @@ public void testReadOnlyUserDoesNotThrowIfUnchanged() {
         user.update(userRepresentation);
     }
 
+    @Test
+    public void testUpdateLocale() {
+        RealmRepresentation realm = testRealm().toRepresentation();
+        realm.setInternationalizationEnabled(true);
+        testRealm().update(realm);
+        UserResource user = ApiUtil.findUserByUsernameId(testRealm(), "johnkeycloak");
+
+        UserRepresentation userRepresentation = user.toRepresentation();
+        String language = "pt_BR";
+        userRepresentation.setAttributes(Map.of(UserModel.LOCALE, List.of(language)));
+        user.update(userRepresentation);
+
+        userRepresentation = user.toRepresentation();
+        assertEquals(language, userRepresentation.getAttributes().get(UserModel.LOCALE).get(0));
+
+        userRepresentation.getAttributes().remove(UserModel.LOCALE);
+        user.update(userRepresentation);
+        assertNull(userRepresentation.getAttributes().get(UserModel.LOCALE));
+    }
+
     // KEYCLOAK-3365
     @Test(expected = ClientErrorException.class)
     public void testReadOnlyUserThrowsIfChanged() {
@@ -225,15 +250,22 @@ private void assertUserNumberOfFailures(String userId, Integer numberOfFailures)
         MatcherAssert.assertThat((Integer) userAttackInfo.get("numFailures"), is(numberOfFailures));
     }
 
-    private void setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement requirement) {
-        adminClient.realm("test").flows().getExecutions("browser").
-                stream().filter(execution -> execution.getDisplayName().equals("Browser - Conditional OTP"))
-                .forEach(execution ->
-                {execution.setRequirement(requirement.name());
-                    adminClient.realm("test").flows().updateExecutions("browser", execution);});
+    private void setTotpRequirementExecutionForRealm(AuthenticationExecutionModel.Requirement conditionalReq, AuthenticationExecutionModel.Requirement otpReq) {
+        AuthenticationManagementResource authMgtRes = testRealm().flows();
+        AuthenticationExecutionInfoRepresentation browserConditionalExecution = authMgtRes.getExecutions("browser").stream()
+                .filter(execution -> execution.getDisplayName().equals("Browser - Conditional 2FA"))
+                .findAny()
+                .get();
+        browserConditionalExecution.setRequirement(conditionalReq.name());
+        authMgtRes.updateExecutions("browser", browserConditionalExecution);
+        AuthenticationExecutionInfoRepresentation otpExecution = authMgtRes.getExecutions("Browser - Conditional 2FA").stream()
+                .filter(execution -> OTPFormAuthenticatorFactory.PROVIDER_ID.equals(execution.getProviderId()))
+                .findAny()
+                .get();
+        otpExecution.setRequirement(otpReq.name());
+        authMgtRes.updateExecutions("browser", otpExecution);
     }
 
-
     protected void assertFederatedUserLink(UserRepresentation user) {
         Assert.assertTrue(StorageId.isLocalStorage(user.getId()));
         Assert.assertNotNull(user.getFederationLink());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSamlIdPInitiatedVaryingLetterCaseTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSamlIdPInitiatedVaryingLetterCaseTest.java
index fcb3d2e09dc9..37255c07a620 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSamlIdPInitiatedVaryingLetterCaseTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSamlIdPInitiatedVaryingLetterCaseTest.java
@@ -16,14 +16,12 @@
  */
 package org.keycloak.testsuite.federation.ldap;
 
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.IdentityProviderResource;
 import org.keycloak.authentication.authenticators.broker.IdpAutoLinkAuthenticatorFactory;
 import org.keycloak.authentication.authenticators.broker.IdpCreateUserIfUniqueAuthenticatorFactory;
 import org.keycloak.broker.saml.SAMLIdentityProviderConfig;
 import org.keycloak.broker.saml.mappers.UsernameTemplateMapper;
 import org.keycloak.broker.saml.mappers.UsernameTemplateMapper.Target;
-import org.keycloak.common.Profile;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.dom.saml.v2.protocol.ResponseType;
 import org.keycloak.models.AuthenticationExecutionModel.Requirement;
@@ -46,7 +44,6 @@
 import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapper;
 import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapperFactory;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.ProfileAssume;
 import org.keycloak.testsuite.broker.KcSamlBrokerConfiguration;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.updaters.Creator;
@@ -69,8 +66,6 @@
 import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_SAML_ALIAS;
-import static org.keycloak.testsuite.federation.ldap.AbstractLDAPTest.TEST_REALM_NAME;
-import static org.keycloak.testsuite.federation.ldap.AbstractLDAPTest.ldapModelId;
 
 /**
  *
@@ -215,9 +210,9 @@ public void loginLDAPTest() {
         loginPage.login(USER_NAME_LDAP, USER_PASSWORD);
         appPage.assertCurrent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, USER_PASSWORD).getIdToken();
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
     }
 
@@ -279,7 +274,7 @@ private void testIdpInitiated(String userName, boolean isFirstBrokerLogin) throw
             .build()
 
           // Now navigate to the application where the session should already be created
-          .navigateTo(oauth.getLoginFormUrl())
+          .navigateTo(oauth.loginForm().build())
 
           .assertResponse(Matchers.bodyHC(containsString("AUTH_RESPONSE")))
           .execute();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSpecialCharsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSpecialCharsTest.java
index 2678a804c5f3..13dbcada8e34 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSpecialCharsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSpecialCharsTest.java
@@ -131,7 +131,7 @@ public void test02_loginWithSpecialCharacter() {
         // Success login as username exactly match
         loginPage.login("jamees,key*cložak)ppp", "Password1");
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
 
@@ -223,7 +223,7 @@ public void test04_loginWithSpecialCharacterUsingSameUUIDThanUsernameAttribute()
             // Success login as username exactly match
             loginPage.login("jamees,key*cložak)ppp", "Password1");
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         } finally {
             // Revert config changes to be back to previous UUID attribute
             ComponentRepresentation ldapRep = testRealm().components().component(ldapModelId).toRepresentation();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSyncTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSyncTest.java
index 2b4198a1a845..b841519bf001 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSyncTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPSyncTest.java
@@ -23,7 +23,6 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 
-import org.hamcrest.Matchers;
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.FixMethodOrder;
@@ -41,6 +40,8 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.SynchronizationResultRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.storage.ldap.LDAPConfig;
 import org.keycloak.storage.managers.UserStorageSyncManager;
 import org.keycloak.storage.UserStoragePrivateUtil;
 import org.keycloak.storage.UserStorageUtil;
@@ -63,6 +64,7 @@
 import jakarta.ws.rs.BadRequestException;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -251,6 +253,47 @@ public void test02duplicateUsernameAndEmailSync() {
         });
     }
 
+    @Test
+    public void testSyncAfterDeletingUserInLDAPWithSameEmail() {
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(appRealm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            LDAPTestUtils.addLDAPUser(ldapFedProvider, appRealm, "luser10", "User10", "User10", "luser10@email.org", null, "");
+            LDAPTestUtils.addLDAPUser(ldapFedProvider, appRealm, "luser11", "User11", "User11", "luser11@email.org", null, "");
+        });
+
+        List<UserRepresentation> users = testRealm().users().search("luser10");
+        assertThat(1, is(users.size()));
+
+        users = testRealm().users().search("luser11");
+        assertThat(1, is(users.size()));
+        UserRepresentation userToDelete = users.get(0);
+
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            LDAPStorageProvider ldapProvider = ctx.getLdapProvider();
+            LDAPConfig ldapConfig = ldapProvider.getLdapIdentityStore().getConfig();
+            LDAPTestUtils.removeLDAPUserByUsername(ldapProvider, ctx.getRealm(), ldapConfig, "luser11");
+        });
+
+        String email = userToDelete.getEmail();
+
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            LDAPObject user = ctx.getLdapProvider().loadLDAPUserByUsername(ctx.getRealm(), "luser10");
+            user.setSingleAttribute(LDAPConstants.EMAIL, email);
+            ctx.getLdapProvider().getLdapIdentityStore().update(user);
+        });
+
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            SynchronizationResult result = new UserStorageSyncManager().syncAllUsers(session.getKeycloakSessionFactory(), ctx.getRealm().getId(), ctx.getLdapModel());
+            Assert.assertEquals(0, result.getFailed());
+        });
+    }
+
     @Test
     public void test03LDAPSyncWhenUsernameChanged() {
 
@@ -386,7 +429,7 @@ public void test05MissingLDAPUsernameSync() {
             LDAPObject streetUser = LDAPTestUtils.addLDAPUser(ctx.getLdapProvider(), ctx.getRealm(), "user8", "User8FN", "User8LN", "user8@email.org", "user8street", "126");
 
             // Change name of username attribute name to street
-            String origUsernameAttrNamee = ctx.getLdapModel().get(LDAPConstants.USERNAME_LDAP_ATTRIBUTE);
+            String origUsernameAttrNamee = LDAPConstants.UID;
             ctx.getLdapModel().getConfig().putSingle(LDAPConstants.USERNAME_LDAP_ATTRIBUTE, "street");
 
             // Need to change this due to ApacheDS pagination bug (For other LDAP servers, pagination works fine) TODO: Remove once ApacheDS upgraded and pagination is fixed
@@ -405,6 +448,8 @@ public void test05MissingLDAPUsernameSync() {
             SynchronizationResult syncResult = new UserStorageSyncManager().syncAllUsers(sessionFactory, ctx.getRealm().getId(), ctx.getLdapModel());
             Assert.assertEquals(1, syncResult.getAdded());
             Assert.assertTrue(syncResult.getFailed() > 0);
+            UserModel invalidUser = session.users().getUserByUsername(ctx.getRealm(), "user8street");
+            session.users().removeUser(ctx.getRealm(), invalidUser);
         });
 
         // Revert config changes
@@ -501,7 +546,7 @@ public void test08LDAPGroupSyncAfterGroupRename() {
 
             // sync to Keycloak should pass without an error
             SynchronizationResult syncResult = new GroupLDAPStorageMapperFactory().create(session, mapperModel).syncDataFromFederationProviderToKeycloak(appRealm);
-            assertThat(syncResult.getFailed(), Matchers.is(0));
+            assertThat(syncResult.getFailed(), is(0));
         });
 
         testingClient.server().run(session -> {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserLoginTest.java
index 29b6518aca02..ff7886adc2ae 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserLoginTest.java
@@ -50,7 +50,7 @@
 
 import java.util.Objects;
 import org.junit.Assume;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * Test user logins utilizing various LDAP authentication methods and different LDAP connection encryption mechanisms.
@@ -154,9 +154,9 @@ private void verifyLoginSucceededAndLogout(String username, String password) {
         loginPage.login(username, password);
         appPage.assertCurrent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         EventRepresentation loginEvent = events.expectLogin().user(userId).assertEvent();
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         appPage.logout(tokenResponse.getIdToken());
         events.expectLogout(loginEvent.getSessionId()).user(userId).assertEvent();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserProfileTest.java
index d8c313d95238..156eabe9a238 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/LDAPUserProfileTest.java
@@ -270,10 +270,14 @@ public void testMultipleLDAPProviders() {
             testRealm.addComponentModel(ldapModel);
             LDAPStorageProvider ldapProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
 
-            // if AD, create new OU in a base DN because users.ldif is ignored for AD
-            if (LDAPConstants.VENDOR_ACTIVE_DIRECTORY.equals(ldapModel.getConfig().getFirst(LDAPConstants.VENDOR))) {
+            // if AD or RHDS, create new OU in a base DN because users.ldif is ignored for AD/RHDS
+            String vendor = ldapModel.getConfig().getFirst(LDAPConstants.VENDOR);
+            if (LDAPConstants.VENDOR_ACTIVE_DIRECTORY.equals(vendor)) {
                 LDAPTestUtils.addLdapOUinBaseDn(ldapProvider, "OtherPeople2");
                 LDAPTestUtils.removeAllLDAPUsers(ldapProvider, testRealm);
+            } else if (LDAPConstants.VENDOR_RHDS.equals(vendor)) {
+                LDAPTestUtils.addLdapOUinBaseDn(ldapProvider, "OtherPeople");
+                LDAPTestUtils.removeAllLDAPUsers(ldapProvider, testRealm);
             }
             LDAPObject john = LDAPTestUtils.addLDAPUser(ldapProvider, testRealm, "anotherjohn", "AnotherJohn", "AnotherDoe", "anotherjohn@email.org", null, "1234");
             LDAPTestUtils.updateLDAPPassword(ldapProvider, john, "Password1");
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/noimport/LDAPProvidersIntegrationNoImportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/noimport/LDAPProvidersIntegrationNoImportTest.java
index a2db35583ea4..7128b9c1013e 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/noimport/LDAPProvidersIntegrationNoImportTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/ldap/noimport/LDAPProvidersIntegrationNoImportTest.java
@@ -57,8 +57,8 @@
 import org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest;
 import org.keycloak.testsuite.federation.ldap.LDAPTestAsserts;
 import org.keycloak.testsuite.federation.ldap.LDAPTestContext;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.util.LDAPTestUtils;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
 
 /**
@@ -76,7 +76,7 @@ protected boolean isImportEnabled() {
     @Before
     public void enableUserProfileUnmanagedAttributes() {
         UserProfileResource userProfileRes = testRealm().users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java
index 850ef3eaa6ed..9d65ea6ed322 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BackwardsCompatibilityUserStorageTest.java
@@ -24,8 +24,11 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.UserResource;
-import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.authentication.AuthenticationFlow;
+import org.keycloak.authentication.authenticators.browser.RecoveryAuthnCodesFormAuthenticatorFactory;
+import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory;
 import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.OTPCredentialModel;
@@ -43,22 +46,29 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
+import org.keycloak.testsuite.client.KeycloakTestingClient;
 import org.keycloak.testsuite.federation.BackwardsCompatibilityUserStorageFactory;
+import org.keycloak.testsuite.forms.BrowserFlowTest;
 import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.pages.EnterRecoveryAuthnCodePage;
 import org.keycloak.testsuite.pages.LoginConfigTotpPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginTotpPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.pages.SetupRecoveryAuthnCodesPage;
+import org.keycloak.testsuite.util.FlowUtil;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TestAppHelper;
 
 import jakarta.ws.rs.core.Response;
 import org.keycloak.testsuite.util.TokenUtil;
+import org.openqa.selenium.WebDriver;
 
 import java.io.IOException;
 import java.net.URISyntaxException;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 
 import static org.wildfly.common.Assert.assertTrue;
 
@@ -69,6 +79,8 @@
  */
 public class BackwardsCompatibilityUserStorageTest extends AbstractTestRealmKeycloakTest {
 
+    private static final String BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES = "Browser with Recovery Authentication Codes";
+
     private String backwardsCompProviderId;
 
     @Page
@@ -83,6 +95,12 @@ public class BackwardsCompatibilityUserStorageTest extends AbstractTestRealmKeyc
     @Page
     protected LoginConfigTotpPage configureTotpRequiredActionPage;
 
+    @Page
+    protected SetupRecoveryAuthnCodesPage setupRecoveryAuthnCodesPage;
+
+    @Page
+    protected EnterRecoveryAuthnCodePage enterRecoveryAuthnCodePage;
+
 
     private TimeBasedOTP totp = new TimeBasedOTP();
 
@@ -99,6 +117,28 @@ public void addProvidersBeforeTest() throws URISyntaxException, IOException {
 
     }
 
+    void configureBrowserFlowWithRecoveryAuthnCodes(KeycloakTestingClient testingClient, long delay) {
+        final String newFlowAlias = BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES;
+        testingClient.server("test").run(session -> FlowUtil.inCurrentRealm(session).copyBrowserFlow(newFlowAlias));
+        testingClient.server("test").run(session -> FlowUtil.inCurrentRealm(session)
+                .selectFlow(newFlowAlias)
+                .inForms(forms -> forms
+                        .clear()
+                        .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, UsernamePasswordFormFactory.PROVIDER_ID)
+                        .addSubFlowExecution(AuthenticationExecutionModel.Requirement.REQUIRED, reqSubFlow -> reqSubFlow
+                                .addSubFlowExecution("Recovery-Authn-Codes subflow", AuthenticationFlow.BASIC_FLOW, AuthenticationExecutionModel.Requirement.ALTERNATIVE, altSubFlow -> altSubFlow
+                                        .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, RecoveryAuthnCodesFormAuthenticatorFactory.PROVIDER_ID)
+                                        .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, "delayed-authenticator", config -> {
+                                            config.setAlias("delayed-suthenticator-config");
+                                            config.setConfig(Map.of("delay", Long.toString(delay)));
+                                        })
+                                )
+                        )
+                )
+                .defineAsBrowserFlow()
+        );
+    }
+
     protected String addComponent(ComponentRepresentation component) {
         Response resp = testRealm().components().add(component);
         String id = ApiUtil.getCreatedId(resp);
@@ -194,6 +234,37 @@ public void testOTPUpdateAndLogin() throws URISyntaxException, IOException {
         assertTrue(testAppHelper.logout());
     }
 
+    @Test
+    public void testRecoveryKeysSetupAndLogin() throws URISyntaxException, IOException {
+        try {
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 0);
+
+            String userId = addUserAndResetPassword("otp1", "pass");
+            getCleanup().addUserId(userId);
+
+            // Setup RecoveryKeys
+            List<String> recoveryKeys = setupRecoveryKeysForUserWithRequiredAction(userId, true);
+
+            // Assert user has RecoveryKeys in the userStorage
+            assertUserDontHaveDBCredentials();
+            assertUserHasRecoveryKeysCredentialInUserStorage(true);
+
+            TestAppHelper testAppHelper = new TestAppHelper(oauth, loginPage, appPage);
+
+            // Authenticate as the user
+            testAppHelper.startLogin("otp1", "pass");
+            enterRecoveryCodes(enterRecoveryAuthnCodePage, driver, 0, recoveryKeys);
+            enterRecoveryAuthnCodePage.clickSignInButton();
+
+            appPage.assertCurrent();
+
+            testAppHelper.logout();
+        } finally {
+            // Revert copy of browser flow to original to keep clean slate after this test
+            BrowserFlowTest.revertFlows(testRealm(), BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES);
+        }
+    }
+
     @Test
     public void testOTPSetupThroughAdminRESTAndLogin() throws URISyntaxException, IOException {
         String userId = addUserAndResetPassword("otp1", "pass");
@@ -241,23 +312,22 @@ public void testOTPSetupAndRemoveThroughAccountMgmtAndLogin() throws URISyntaxEx
         assertUserDontHaveDBCredentials();
         assertUserHasOTPCredentialInUserStorage(true);
 
-        try (CloseableHttpClient httpClient = oauth.getHttpClient().get()) {
-            String accountCredentialsUrl = OAuthClient.AUTH_SERVER_ROOT + "/realms/test/account/credentials";
+        CloseableHttpClient httpClient = oauth.httpClient().get();
+        String accountCredentialsUrl = OAuthClient.AUTH_SERVER_ROOT + "/realms/test/account/credentials";
 
-            // Get credentials by account REST. User should have OTP credential
-            List<CredentialMetadataRepresentation> otpCreds = getOtpCredentialFromAccountREST(accountCredentialsUrl, httpClient, tokenUtil);
-            Assert.assertEquals(1, otpCreds.size());
-            String otpCredentialId = otpCreds.get(0).getCredential().getId();
+        // Get credentials by account REST. User should have OTP credential
+        List<CredentialMetadataRepresentation> otpCreds = getOtpCredentialFromAccountREST(accountCredentialsUrl, httpClient, tokenUtil);
+        Assert.assertEquals(1, otpCreds.size());
+        String otpCredentialId = otpCreds.get(0).getCredential().getId();
 
-            // Delete OTP credential from federated storage
-            int deleteStatus = SimpleHttpDefault.doDelete(accountCredentialsUrl + "/" + otpCredentialId, httpClient)
+        // Delete OTP credential from federated storage
+        int deleteStatus = SimpleHttpDefault.doDelete(accountCredentialsUrl + "/" + otpCredentialId, oauth.httpClient().get())
                 .auth(accountToken).acceptJson().asStatus();
-            Assert.assertEquals(204, deleteStatus);
+        Assert.assertEquals(204, deleteStatus);
 
-            // Get credentials by account REST. User should not have OTP credential
-            otpCreds = getOtpCredentialFromAccountREST(accountCredentialsUrl, httpClient, tokenUtil);
-            Assert.assertEquals(0, otpCreds.size());
-        }
+        // Get credentials by account REST. User should not have OTP credential
+        otpCreds = getOtpCredentialFromAccountREST(accountCredentialsUrl, httpClient, tokenUtil);
+        Assert.assertEquals(0, otpCreds.size());
 
         assertUserDontHaveDBCredentials();
         assertUserHasOTPCredentialInUserStorage(false);
@@ -319,8 +389,8 @@ private String setupOTPForUserWithRequiredAction(String userId, boolean logoutOt
         testAppHelper.startLogin("otp1", "pass");
 
         configureTotpRequiredActionPage.assertCurrent();
-        if (!logoutOtherSessions) {
-            configureTotpRequiredActionPage.uncheckLogoutSessions();
+        if (logoutOtherSessions) {
+            configureTotpRequiredActionPage.checkLogoutSessions();
         }
         String totpSecret = configureTotpRequiredActionPage.getTotpSecret();
         configureTotpRequiredActionPage.configure(totp.generateTOTP(totpSecret));
@@ -334,6 +404,34 @@ private String setupOTPForUserWithRequiredAction(String userId, boolean logoutOt
         return totpSecret;
     }
 
+    private List<String> setupRecoveryKeysForUserWithRequiredAction(String userId, boolean logoutOtherSessions) throws URISyntaxException, IOException {
+        // Add required action to the user to reset RecoveryKeys
+        UserResource user = testRealm().users().get(userId);
+        UserRepresentation userRep = user.toRepresentation();
+        userRep.setRequiredActions(Arrays.asList(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name()));
+        user.update(userRep);
+
+        TestAppHelper testAppHelper = new TestAppHelper(oauth, loginPage, appPage);
+
+        // Login as the user and setup RecoveryKeys
+        testAppHelper.startLogin("otp1", "pass");
+
+        setupRecoveryAuthnCodesPage.assertCurrent();
+        if (logoutOtherSessions) {
+            setupRecoveryAuthnCodesPage.checkLogoutSessions();
+        }
+        List<String> codes = setupRecoveryAuthnCodesPage.getRecoveryAuthnCodes();
+        setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+        appPage.assertCurrent();
+
+        testAppHelper.completeLogin();
+
+        // Logout
+        assertTrue(testAppHelper.logout());
+
+        return codes;
+    }
+
 
     private void assertUserDontHaveDBCredentials() {
         testingClient.server().run(session -> {
@@ -352,9 +450,19 @@ private void assertUserHasOTPCredentialInUserStorage(boolean expectedUserHasOTP)
         Assert.assertEquals(expectedUserHasOTP, hasUserOTP);
     }
 
+    private void assertUserHasRecoveryKeysCredentialInUserStorage(boolean expectedUserHasRecoveryKeys) {
+        boolean hasRecoveryKeys = testingClient.server().fetch(session -> {
+            BackwardsCompatibilityUserStorageFactory storageFactory = (BackwardsCompatibilityUserStorageFactory) session.getKeycloakSessionFactory()
+                    .getProviderFactory(UserStorageProvider.class, BackwardsCompatibilityUserStorageFactory.PROVIDER_ID);
+            return storageFactory.hasRecoveryCodes("otp1");
+        }, Boolean.class);
+        Assert.assertEquals(expectedUserHasRecoveryKeys, hasRecoveryKeys);
+    }
+
     private List<CredentialMetadataRepresentation> getOtpCredentialFromAccountREST(String accountCredentialsUrl, CloseableHttpClient httpClient, TokenUtil tokenUtil) throws IOException {
         List<AccountCredentialResource.CredentialContainer> credentials = SimpleHttpDefault.doGet(accountCredentialsUrl, httpClient)
-                .auth(tokenUtil.getToken()).asJson(new TypeReference<>() {});
+                .auth(tokenUtil.getToken()).asJson(new TypeReference<>() {
+                });
 
         return credentials.stream()
                 .filter(credentialContainer -> OTPCredentialModel.TYPE.equals(credentialContainer.getType()))
@@ -362,6 +470,15 @@ private List<CredentialMetadataRepresentation> getOtpCredentialFromAccountREST(S
                 .findFirst().get();
     }
 
+    private void enterRecoveryCodes(EnterRecoveryAuthnCodePage enterRecoveryAuthnCodePage, WebDriver driver,
+                                    int expectedCode, List<String> generatedRecoveryAuthnCodes) {
+        enterRecoveryAuthnCodePage.setDriver(driver);
+        enterRecoveryAuthnCodePage.assertCurrent();
+        int requestedCode = enterRecoveryAuthnCodePage.getRecoveryAuthnCodeToEnterNumber();
+        org.junit.Assert.assertEquals("Incorrect code presented to login", expectedCode, requestedCode);
+        enterRecoveryAuthnCodePage.enterRecoveryAuthnCode(generatedRecoveryAuthnCodes.get(requestedCode));
+    }
+
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BrokenUserStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BrokenUserStorageTest.java
index 8fdf86ab8125..6ccab76938a9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BrokenUserStorageTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/BrokenUserStorageTest.java
@@ -22,7 +22,6 @@
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.RealmModel;
@@ -63,8 +62,8 @@ private void loginSuccessAndLogout(String username, String password) {
         loginPage.open();
         loginPage.login(username, password);
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
-        oauth.openLogout();
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
+        oauth.openLogoutForm();
     }
 
     @Test
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java
index f1835f042ffa..0e0c9f0d09bd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/ClientStorageTest.java
@@ -48,7 +48,8 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.util.BasicAuthHelper;
 import org.keycloak.util.TokenUtil;
 
@@ -245,24 +246,13 @@ public void testBrowser() throws Exception {
     }
 
      private void testBrowser(String clientId) {
-        oauth.clientId(clientId);
-        String loginFormUrl = oauth.getLoginFormUrl();
-        //log.info("loginFormUrl: " + loginFormUrl);
-
-        //Thread.sleep(10000000);
-
-        driver.navigate().to(loginFormUrl);
-
-        loginPage.assertCurrent();
-
-        // Fill username+password. I am successfully authenticated
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.client(clientId, "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
         appPage.assertCurrent();
 
         events.expectLogin().client(clientId).detail(Details.USERNAME, "test-user@localhost").assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(response.getCode());
         Assert.assertNotNull(tokenResponse.getAccessToken());
         Assert.assertNotNull(tokenResponse.getRefreshToken());
 
@@ -277,7 +267,7 @@ public void testGrantAccessTokenNoOverride() throws Exception {
 
     private void testDirectGrant(String clientId) {
         Client httpClient = AdminClientUtil.createResteasyClient();
-        String grantUri = oauth.getResourceOwnerPasswordCredentialGrantUrl();
+        String grantUri = oauth.getEndpoints().getToken();
         WebTarget grantTarget = httpClient.target(grantUri);
 
         {   // test no password
@@ -456,8 +446,8 @@ private void setDefaultCachePolicy() {
     @Test
     public void offlineTokenDirectGrantFlow() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("hardcoded-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        oauth.client("hardcoded-client", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         Assert.assertNull(tokenResponse.getErrorDescription());
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -488,7 +478,7 @@ public void offlineTokenDirectGrantFlow() throws Exception {
     public void offlineTokenDirectGrantFlowNoRefresh(String clientId) throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
         oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         Assert.assertNull(tokenResponse.getErrorDescription());
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -510,7 +500,7 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of
             // Ignore
         }
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString);
         AccessToken refreshedToken = oauth.verifyToken(response.getAccessToken());
         String offlineUserSessionId = testingClient.server().fetch((KeycloakSession session) ->
                 session.sessions().getOfflineUserSession(session.realms().getRealmByName("test"), offlineToken.getSessionState()).getId(), String.class);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
index b64bed0699db..28902d2e7d65 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
@@ -31,6 +31,7 @@
 import org.keycloak.exportimport.singlefile.SingleFileExportProviderFactory;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -46,6 +47,10 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
@@ -161,6 +166,73 @@ public void testSingleFile() {
         });
     }
 
+    @Test
+    public void testCreateCredentialWithDuplicateUserLabelShouldFail() {
+        final String userId = "f:1:testUser";
+
+        testingClient.server().run(session -> {
+            RealmModel realm = new RealmManager(session).createRealm(REALM_NAME);
+            UserStorageUtil.userFederatedStorage(session).setSingleAttribute(realm, userId, "dummy", "value");
+
+            PasswordCredentialModel cred1 = FederatedStorageExportImportTest
+                    .getHashProvider(session, realm.getPasswordPolicy())
+                    .encodedCredential("secret1", realm.getPasswordPolicy().getHashIterations());
+            cred1.setUserLabel("MyDevice");
+            UserStorageUtil.userFederatedStorage(session).createCredential(realm, userId, cred1);
+
+            PasswordCredentialModel cred2 = FederatedStorageExportImportTest
+                    .getHashProvider(session, realm.getPasswordPolicy())
+                    .encodedCredential("secret2", realm.getPasswordPolicy().getHashIterations());
+            cred2.setUserLabel("MyDevice");
+
+            try {
+                UserStorageUtil.userFederatedStorage(session).createCredential(realm, userId, cred2);
+                Assert.fail("Expected ModelDuplicateException was not thrown");
+            } catch (ModelDuplicateException ex) {
+                assertEquals("Device already exists with the same name", ex.getMessage());
+            }
+        });
+    }
+
+    @Test
+    public void testUpdateCredentialWithDuplicateUserLabelShouldFail() {
+        final String userId = "f:1:testUser";
+
+        testingClient.server().run(session -> {
+            RealmModel realm = new RealmManager(session).createRealm(REALM_NAME);
+            UserStorageUtil.userFederatedStorage(session).setSingleAttribute(realm, userId, "dummy", "value");
+
+            // Create first credential with label "DeviceOne"
+            PasswordCredentialModel cred1 = FederatedStorageExportImportTest
+                    .getHashProvider(session, realm.getPasswordPolicy())
+                    .encodedCredential("secret1", realm.getPasswordPolicy().getHashIterations());
+            cred1.setUserLabel("DeviceOne");
+            UserStorageUtil.userFederatedStorage(session).createCredential(realm, userId, cred1);
+
+            // Create second credential with label "DeviceTwo"
+            PasswordCredentialModel cred2 = FederatedStorageExportImportTest
+                    .getHashProvider(session, realm.getPasswordPolicy())
+                    .encodedCredential("secret2", realm.getPasswordPolicy().getHashIterations());
+            cred2.setUserLabel("DeviceTwo");
+            UserStorageUtil.userFederatedStorage(session).createCredential(realm, userId, cred2);
+
+            CredentialModel credentialModelUpdate = UserStorageUtil.userFederatedStorage(session)
+                    .getStoredCredentialsStream(realm, userId)
+                    .filter(c -> "DeviceTwo".equals(c.getUserLabel()))
+                    .findFirst()
+                    .orElseThrow(() -> new IllegalStateException("Credential not found"));
+
+            credentialModelUpdate.setUserLabel("DeviceOne");
+
+            try {
+                UserStorageUtil.userFederatedStorage(session).updateCredential(realm, userId, credentialModelUpdate);
+                Assert.fail("Expected ModelDuplicateException was not thrown");
+            } catch (ModelDuplicateException ex) {
+                assertEquals("Device already exists with the same name", ex.getMessage());
+            }
+        });
+    }
+
     @Test
     public void testDir() {
         ComponentExportImportTest.clearExportImportProperties(testingClient);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageFailureTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageFailureTest.java
index 2ca8868f74d8..d591173b0abc 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageFailureTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageFailureTest.java
@@ -52,7 +52,8 @@
 import org.keycloak.testsuite.federation.FailableHardcodedStorageProviderFactory;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 import java.util.Collections;
 import java.util.HashMap;
@@ -150,7 +151,7 @@ private String addComponent(ComponentRepresentation component) {
     @Test
     public void testKeycloak5350() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret");
         oauth.redirectUri(OAuthClient.AUTH_SERVER_ROOT + "/offline-client");
         oauth.doLogin(FailableHardcodedStorageProvider.username, "password");
 
@@ -163,9 +164,9 @@ public void testKeycloak5350() throws Exception {
         final String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
         RefreshToken offlineToken = oauth.parseRefreshToken(offlineTokenString);
@@ -195,7 +196,7 @@ public void testKeycloak5350() throws Exception {
 
 
         // test that once user storage provider is available again we can still access the token.
-        tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString, "secret");
+        tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString);
         Assert.assertNotNull(tokenResponse.getAccessToken());
         token = oauth.verifyToken(tokenResponse.getAccessToken());
         offlineTokenString = tokenResponse.getRefreshToken();
@@ -243,8 +244,8 @@ private void loginSuccessAndLogout(String username, String password) {
         System.out.println(driver.getPageSource());
         Assert.assertTrue(appPage.isCurrent());
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
-        oauth.openLogout();
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
+        oauth.openLogoutForm();
     }
 
     @Test
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageOTPTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageOTPTest.java
index 61855be4a5b7..943c2133fa85 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageOTPTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageOTPTest.java
@@ -141,7 +141,7 @@ public void testAuthentication() {
 
         appPage.assertCurrent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
 
@@ -240,7 +240,7 @@ public void testNormalUser() {
 
         appPage.assertCurrent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageTest.java
index 24f87de81303..c14a59ef4298 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/storage/UserStorageTest.java
@@ -37,7 +37,9 @@
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.storage.CacheableStorageProviderModel.CachePolicy;
+import org.keycloak.storage.DatastoreProvider;
 import org.keycloak.storage.StorageId;
+import org.keycloak.storage.StoreManagers;
 import org.keycloak.storage.UserStoragePrivateUtil;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.UserStorageUtil;
@@ -47,7 +49,6 @@
 import org.keycloak.testsuite.federation.UserMapStorage;
 import org.keycloak.testsuite.federation.UserMapStorageFactory;
 import org.keycloak.testsuite.federation.UserPropertyFileStorageFactory;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.RegisterPage;
@@ -56,6 +57,7 @@
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.TestCleanup;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.DefaultAttributes;
 import org.openqa.selenium.Cookie;
 
@@ -169,7 +171,8 @@ public void addProvidersBeforeTest() throws URISyntaxException, IOException {
         createAppClientInRealm(testRealmResource().toRepresentation().getRealm());
 
         UserProfileResource userProfileRes = testRealmResource().users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
+        testingClient.testing().setTestingInfinispanTimeService();
     }
 
     @After
@@ -191,6 +194,8 @@ public void afterTestCleanUp() throws URISyntaxException, IOException {
             Assert.assertNotNull(userMapStorageFactory);
             userMapStorageFactory.clear();
         });
+        resetTimeOffset();
+        testingClient.testing().revertTestingInfinispanTimeService();
     }
 
     protected ComponentRepresentation newPropProviderRW() {
@@ -595,125 +600,64 @@ public void testDailyEviction() {
         // and they didn't use any time offset clock so they may have timestamps in the 'future'
 
         // let's clear cache
-        testingClient.server().run(session -> {
-            UserStorageUtil.userCache(session).clear();
-        });
-
-
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be newly cached
-        });
+        clearUserCache();
+        setFirstname("thor", "Thor0");
 
+        // should be newly cached
+        validateFirstname("thor", "Thor0");
+        setFirstname("thor", "Thor1");
 
         setTimeOfDay(23, 40, 0);
 
         // lookup user again - make sure it's returned from cache
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache
-        });
-
+        // should be returned from cache
+        validateFirstname("thor", "Thor0");
 
         setTimeOfDay(23, 50, 0);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertFalse(user instanceof CachedUserModel); // should have been invalidated
-        });
-
-
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should have been newly cached
-        });
-
-
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache
-        });
+        // should have been invalidated
+        validateFirstname("thor", "Thor1");
+        setFirstname("thor", "Thor2");
 
+        validateFirstname("thor", "Thor1"); // should be returned from cache
 
         setTimeOfDay(23, 55, 0);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache
-        });
-
+        validateFirstname("thor", "Thor1"); // should be returned from cache
 
         // at 00:30
         // it's next day now. the daily eviction time is now in the future
         setTimeOfDay(0, 30, 0, 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache - it's still good for almost the whole day
-        });
-
+        validateFirstname("thor", "Thor1");  // should be returned from cache - it's still good for almost the whole day
 
         // at 23:30 next day
         setTimeOfDay(23, 30, 0, 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache - it's still good until 23:45
-        });
+        validateFirstname("thor", "Thor1"); // should be returned from cache - it's still good until 23:45
 
         // at 23:50
         setTimeOfDay(23, 50, 0, 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertFalse(user instanceof CachedUserModel); // should be invalidated
-        });
+        validateFirstname("thor", "Thor2");  // should be invalidated
+        setFirstname("thor", "Thor3");
 
         setTimeOfDay(23, 55, 0, 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be newly cached
-        });
-
+        validateFirstname("thor", "Thor2"); // should be newly cached
 
         setTimeOfDay(23, 40, 0, 2 * 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache
-        });
+        validateFirstname("thor", "Thor2"); // should be returned from cache
 
         setTimeOfDay(23, 50, 0, 2 * 24 * 60 * 60);
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertFalse(user instanceof CachedUserModel); // should be invalidated
-        });
+        validateFirstname("thor", "Thor3"); // should be invalidated
+        setFirstname("thor", "Thor4");
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be newly cached
-        });
+        validateFirstname("thor", "Thor3"); // should be newly cached
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            Assert.assertTrue(user instanceof CachedUserModel); // should be returned from cache
-        });
+        validateFirstname("thor", "Thor3"); // should be returned from cache
     }
 
     @Test
@@ -730,32 +674,21 @@ public void testWeeklyEviction() {
         propProviderRW.getConfig().putSingle(EVICTION_MINUTE, Integer.toString(eviction.get(MINUTE)));
         testRealmResource().components().component(propProviderRWId).update(propProviderRW);
 
+        clearUserCache();
+        setFirstname("thor", "Thor0");
+
         // now
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertTrue(user instanceof CachedUserModel); // should still be cached
-        });
+        validateFirstname("thor", "Thor0"); // should still be cached
+
+        setFirstname("thor", "Thor1");
 
         setTimeOffset(2 * 24 * 60 * 60); // 2 days in future
 
-        // now
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertTrue(user instanceof CachedUserModel); // should still be cached
-        });
+        validateFirstname("thor", "Thor0"); // should still be cached
 
         setTimeOffset(5 * 24 * 60 * 60); // 5 days in future
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertFalse(user instanceof CachedUserModel); // should be evicted
-        });
+        validateFirstname("thor", "Thor1"); // should be evicted
 
     }
 
@@ -769,31 +702,23 @@ public void testMaxLifespan() {
         propProviderRW.getConfig().putSingle(MAX_LIFESPAN, Long.toString(1 * 60 * 60 * 1000)); // 1 hour in milliseconds
         testRealmResource().components().component(propProviderRWId).update(propProviderRW);
 
+        clearUserCache();
+        setFirstname("thor", "Thor0");
+
         // now
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertTrue(user instanceof CachedUserModel); // should still be cached
-        });
+        validateFirstname("thor", "Thor0"); // Initial caching
 
-        setTimeOffset(1/2 * 60 * 60); // 1/2 hour in future
+        setFirstname("thor", "Thor1");
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertTrue(user instanceof CachedUserModel); // should still be cached
-        });
+        validateFirstname("thor", "Thor0"); // should still be cached
+
+        setTimeOffset(30 * 60); // 1/2 hour in future
+
+        validateFirstname("thor", "Thor0"); // should still be cached
 
         setTimeOffset(2 * 60 * 60); // 2 hours in future
 
-        testingClient.server().run(session -> {
-            RealmModel realm = session.realms().getRealmByName("test");
-            UserModel user = session.users().getUserByUsername(realm, "thor");
-            System.out.println("User class: " + user.getClass());
-            Assert.assertFalse(user instanceof CachedUserModel); // should be evicted
-        });
+        validateFirstname("thor", "Thor1"); // should be evicted
 
     }
 
@@ -829,8 +754,8 @@ public void testNoCache() {
 
         testingClient.server().run(session -> {
             RealmModel realm = session.realms().getRealmByName("test");
-            UserModel thor = session.users().getUserByUsername(realm, "thor");
-            System.out.println("Foo");
+            UserModel user = session.users().getUserByUsername(realm, "thor");
+            Assert.assertTrue(user instanceof CachedUserModel);
         });
     }
 
@@ -979,7 +904,7 @@ public void testEntityRemovalHooksCascade() {
 
     @Test
     @ModelTest
-    public void testCredentialCRUD(KeycloakSession session) throws Exception {
+    public void testCredentialCRUD(KeycloakSession session) {
         AtomicReference<String> passwordId = new AtomicReference<>();
         AtomicReference<String> otp1Id = new AtomicReference<>();
         AtomicReference<String> otp2Id = new AtomicReference<>();
@@ -1000,8 +925,8 @@ public void testCredentialCRUD(KeycloakSession session) throws Exception {
             passwordId.set(passwordCred.getId());
 
             // Create Password and 2 OTP credentials (password was already created)
-            CredentialModel otp1 = OTPCredentialModel.createFromPolicy(realm, "secret1");
-            CredentialModel otp2 = OTPCredentialModel.createFromPolicy(realm, "secret2");
+            CredentialModel otp1 = OTPCredentialModel.createFromPolicy(realm, "secret1", "label1");
+            CredentialModel otp2 = OTPCredentialModel.createFromPolicy(realm, "secret2", "label2");
             otp1 = user.credentialManager().createStoredCredential(otp1);
             otp2 = user.credentialManager().createStoredCredential(otp2);
             otp1Id.set(otp1.getId());
@@ -1182,4 +1107,27 @@ private void assertOrder(List<CredentialModel> creds, String... expectedIds) {
         }
     }
 
+
+    private void validateFirstname(String username, String firstname) {
+        testingClient.server().run(session -> {
+            RealmModel realm = session.realms().getRealmByName("test");
+            UserModel user = session.users().getUserByUsername(realm, username);
+            MatcherAssert.assertThat(user.getFirstName(), Matchers.equalTo(firstname));
+        });
+    }
+
+    private void setFirstname(String username, String firstname) {
+        testingClient.server().run(session -> {
+            RealmModel realm = session.realms().getRealmByName("test");
+            UserModel user = ((StoreManagers) session.getProvider(DatastoreProvider.class)).userStorageManager().getUserByUsername(realm, username);
+            user.setFirstName(firstname);
+        });
+    }
+
+    private void clearUserCache() {
+        testingClient.server().run(session -> {
+            UserStorageUtil.userCache(session).clear();
+        });
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java
index a2fc6f8c2596..dbf950115736 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java
@@ -17,14 +17,14 @@
 
 package org.keycloak.testsuite.forms;
 
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 
 /**
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public abstract class AbstractFlowTest extends AbstractTestRealmKeycloakTest {
+public abstract class AbstractFlowTest extends AbstractChangeImportedUserPasswordsTest {
 
     protected AuthenticationFlowRepresentation findFlowByAlias(String alias) {
         for (AuthenticationFlowRepresentation rep : testRealm().flows().getFlows()) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AllowDenyAuthenticatorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AllowDenyAuthenticatorTest.java
index cd52101e87a3..356fa6d8bf6a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AllowDenyAuthenticatorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AllowDenyAuthenticatorTest.java
@@ -13,15 +13,14 @@
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.models.AuthenticationExecutionModel;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.authentication.authenticators.conditional.ConditionalUserAttributeValueFactory;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginUsernameOnlyPage;
 import org.keycloak.testsuite.pages.PasswordPage;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -35,7 +34,7 @@
 /**
  * @author <a href="mailto:mabartos@redhat.com">Martin Bartos</a>
  */
-public class AllowDenyAuthenticatorTest extends AbstractTestRealmKeycloakTest {
+public class AllowDenyAuthenticatorTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Page
     protected LoginUsernameOnlyPage loginUsernameOnlyPage;
@@ -49,10 +48,6 @@ public class AllowDenyAuthenticatorTest extends AbstractTestRealmKeycloakTest {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Test
     public void testDenyAccessWithDefaultMessage() {
         testErrorMessageInDenyAccess(null, "Access denied");
@@ -258,7 +253,7 @@ private void denyAccessInConditionalFlow(String flowAlias, String userCondMatch,
             loginUsernameOnlyPage.login(userCondNotMatch);
 
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword(userCondNotMatch));
 
             events.expectLogin().user(userCondNotMatchId)
                     .detail(Details.USERNAME, userCondNotMatch)
@@ -291,7 +286,7 @@ public void testSkipExecutionUserHasNotRoleCondition() {
             final String testUserWithoutRoleId = testRealm().users().search(userWithoutRole).get(0).getId();
 
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword(userWithoutRole));
 
             events.expectLogin()
                     .user(testUserWithoutRoleId)
@@ -344,7 +339,7 @@ public void testDenyAccessInDirectGrantFlow() throws Exception {
 
         try {
             oauth.clientId(clientId);
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", user, "password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest(user, getPassword("test-user@localhost"));
             assertEquals(401, response.getStatusCode());
             assertEquals("Access denied", response.getError());
             assertNull(response.getErrorDescription());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest.java
index f874fa9a408a..d07ed28ea6ad 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest.java
@@ -28,8 +28,7 @@
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.AuthenticatorConfigModel;
 import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.authentication.ExpectedParamAuthenticator;
 import org.keycloak.testsuite.authentication.ExpectedParamAuthenticatorFactory;
@@ -37,6 +36,7 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.By;
 
 import java.util.HashMap;
@@ -46,7 +46,7 @@
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class AuthenticatorSubflowsTest extends AbstractTestRealmKeycloakTest {
+public class AuthenticatorSubflowsTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
@@ -60,10 +60,6 @@ public class AuthenticatorSubflowsTest extends AbstractTestRealmKeycloakTest {
     @Page
     protected ErrorPage errorPage;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Before
     public void setupFlows() {
         testingClient.server().run(session -> {
@@ -264,18 +260,12 @@ public void setupFlows() {
     @Test
     public void testSubflow1() throws Exception {
         // Add foo=bar1 . I am redirected to subflow1 - username+password form
-        String loginFormUrl = oauth.getLoginFormUrl();
-        loginFormUrl = loginFormUrl + "&foo=bar1";
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        //Thread.sleep(10000000);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.loginForm().param("foo", "bar1").open();
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am successfully authenticated
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -285,23 +275,18 @@ public void testSubflow1() throws Exception {
     @Test
     public void testSubflow2() throws Exception {
         // Don't add 'foo' parameter. I am redirected to subflow2 - push the button
-        String loginFormUrl = oauth.getLoginFormUrl();
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        //Thread.sleep(10000000);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.loginForm().open();
 
         Assert.assertEquals("PushTheButton", driver.getTitle());
 
         // Push the button. I am redirected to username+password form
-        driver.findElement(By.name("submit1")).click();
+        UIUtils.clickLink(driver.findElement(By.name("submit1")));
 
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am successfully authenticated
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest2.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest2.java
index 005a216ba323..4c73f0d6c02f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest2.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AuthenticatorSubflowsTest2.java
@@ -28,8 +28,7 @@
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.AuthenticatorConfigModel;
 import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.authentication.ExpectedParamAuthenticator;
 import org.keycloak.testsuite.authentication.ExpectedParamAuthenticatorFactory;
@@ -45,7 +44,7 @@
 /**
  * @author <a href="mailto:n1330@me.com">Tomohiro Nagai</a>
  */
-public class AuthenticatorSubflowsTest2 extends AbstractTestRealmKeycloakTest {
+public class AuthenticatorSubflowsTest2 extends AbstractChangeImportedUserPasswordsTest {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
@@ -59,10 +58,6 @@ public class AuthenticatorSubflowsTest2 extends AbstractTestRealmKeycloakTest {
     @Page
     protected ErrorPage errorPage;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Before
     public void setupFlows() {
         testingClient.server().run(session -> {
@@ -162,16 +157,12 @@ public void setupFlows() {
     @Test
     public void testSubflow1() throws Exception {
         // Add foo=bar1. I am redirected to subflow1 - username+password form.
-        String loginFormUrl = oauth.getLoginFormUrl();
-        loginFormUrl = loginFormUrl + "&foo=bar1";
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.loginForm().param("foo", "bar1").open();
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am successfully authenticated.
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -181,15 +172,12 @@ public void testSubflow1() throws Exception {
     @Test
     public void testSubflow2() throws Exception {
         // Don't add 'foo' parameter. I am redirected to subflow1 - username+password form, then move to subflow2.
-        String loginFormUrl = oauth.getLoginFormUrl();
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.openLoginForm();
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am redirected push the button.
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         Assert.assertEquals("PushTheButton", driver.getTitle());
 
         // Push the button. I am successfully authenticated.
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserButtonsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserButtonsTest.java
index 50709befb2a4..c80a4c1b35f3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserButtonsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserButtonsTest.java
@@ -27,9 +27,8 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.keycloak.models.UserModel;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
@@ -45,6 +44,7 @@
 import org.keycloak.testsuite.pages.VerifyEmailPage;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
+import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.testsuite.util.UserBuilder;
 
 /**
@@ -52,14 +52,10 @@
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class BrowserButtonsTest extends AbstractTestRealmKeycloakTest {
+public class BrowserButtonsTest extends AbstractChangeImportedUserPasswordsTest {
 
     private String userId;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Before
     public void setup() {
         UserRepresentation user = UserBuilder.create()
@@ -70,7 +66,8 @@ public void setup() {
                 .requiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.toString())
                 .build();
 
-        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password", true);
+        generatePasswords("login-test");
+        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, getPassword("login-test"), true);
         expectedMessagesCount = 0;
         getCleanup().addUserId(userId);
 
@@ -146,16 +143,15 @@ public void requiredActionsBackForwardTest() throws IOException, MessagingExcept
         loginPage.open();
 
         // Login and assert on "updatePassword" page
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Update password and assert on "updateProfile" page
-        updatePasswordPage.changePassword("password", "password");
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.assertCurrent();
 
         // Click browser back. Assert on "Page expired" page
-        driver.navigate().back();
-        loginExpiredPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
 
         // Click browser forward. Assert on "updateProfile" page again
         driver.navigate().forward();
@@ -174,7 +170,7 @@ public void requiredActionsBackAndRefreshTest() throws IOException, MessagingExc
         loginPage.open();
 
         // Login and assert on "updatePassword" page
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Click browser refresh. Assert still on updatePassword page
@@ -182,12 +178,11 @@ public void requiredActionsBackAndRefreshTest() throws IOException, MessagingExc
         updatePasswordPage.assertCurrent();
 
         // Update password and assert on "updateProfile" page
-        updatePasswordPage.changePassword("password", "password");
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.assertCurrent();
 
         // Click browser back. Assert on "Page expired" page
-        driver.navigate().back();
-        loginExpiredPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
 
         // Click browser refresh. Assert still on "Page expired" page
         driver.navigate().refresh();
@@ -198,12 +193,11 @@ public void requiredActionsBackAndRefreshTest() throws IOException, MessagingExc
         loginPage.assertCurrent();
 
         // Login again and assert on "updateProfile" page
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updateProfilePage.assertCurrent();
 
         // Click browser back. Assert on "Page expired" page
-        driver.navigate().back();
-        loginExpiredPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
 
         // Click "login continue" and assert on updateProfile page
         loginExpiredPage.clickLoginContinueLink();
@@ -222,16 +216,15 @@ public void consentRefresh() {
 
         // Login and go through required actions
         loginPage.open();
-        loginPage.login("login-test", "password");
-        updatePasswordPage.changePassword("password", "password");
+        loginPage.login("login-test", getPassword("login-test"));
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.prepareUpdate().firstName("John").lastName("Doe3").email("john@doe3.com").submit();
 
         // Assert on consent screen
         grantPage.assertCurrent();
 
         // Click browser back. Assert on "page expired"
-        driver.navigate().back();
-        loginExpiredPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
 
         // Click continue login. Assert on consent screen again
         loginExpiredPage.clickLoginContinueLink();
@@ -303,7 +296,7 @@ public void backButtonToAuthorizationEndpoint() {
         loginPage.open();
 
         // Login and assert on "updatePassword" page
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Click browser back. I should be on login page . URL corresponds to OIDC AuthorizationEndpoint
@@ -316,7 +309,7 @@ public void backButtonToAuthorizationEndpoint() {
     public void backButtonInResetPasswordFlow() throws Exception {
         // Click on "forgot password" and type username
         loginPage.open();
-        loginPage.login("login-test", "bad-username");
+        loginPage.login("login-test", getPassword("login-test") + "bad-username");
         loginPage.resetPassword();
 
         resetPasswordPage.assertCurrent();
@@ -346,7 +339,7 @@ public void backButtonInResetPasswordFlow() throws Exception {
         // Click browser back. And continue login. Should be on updatePasswordPage
         driver.navigate().back();
         loginPage.assertCurrent();
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
     }
 
@@ -354,9 +347,7 @@ public void backButtonInResetPasswordFlow() throws Exception {
     @Test
     public void appInitiatedRegistrationWithBackButton() throws Exception {
         // Send request from the application directly to 'registrations'
-        String appInitiatedRegisterUrl = oauth.getLoginFormUrl();
-        appInitiatedRegisterUrl = appInitiatedRegisterUrl.replace("openid-connect/auth", "openid-connect/registrations"); // Should be done better way...
-        driver.navigate().to(appInitiatedRegisterUrl);
+        oauth.openRegistrationForm();
         registerPage.assertCurrent();
 
 
@@ -365,12 +356,11 @@ public void appInitiatedRegistrationWithBackButton() throws Exception {
         loginPage.assertCurrent();
 
         // Login
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Click browser back. Should be on 'page expired'
-        driver.navigate().back();
-        loginExpiredPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
 
         // Click 'continue' should be on updatePasswordPage
         loginExpiredPage.clickLoginContinueLink();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserFlowTest.java
index d683e9319b7c..4abf396b521a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserFlowTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BrowserFlowTest.java
@@ -31,7 +31,7 @@
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.ActionURIUtils;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
@@ -45,7 +45,7 @@
 import org.keycloak.testsuite.pages.LoginUsernameOnlyPage;
 import org.keycloak.testsuite.pages.PasswordPage;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.URLUtils;
 import org.openqa.selenium.By;
@@ -59,13 +59,12 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
-import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.GITHUB;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.GITLAB;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.GOOGLE;
 
-public class BrowserFlowTest extends AbstractTestRealmKeycloakTest {
+public class BrowserFlowTest extends AbstractChangeImportedUserPasswordsTest {
     private static final String INVALID_AUTH_CODE = "Invalid authenticator code.";
 
     private static final String USER_WITH_ONE_OTP_OTP_SECRET = "DJmQfC73VGFhw7D4QJ8A";
@@ -99,41 +98,28 @@ public class BrowserFlowTest extends AbstractTestRealmKeycloakTest {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
-    private RealmRepresentation loadTestRealm() {
-        RealmRepresentation res = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
-        res.setBrowserFlow("browser");
-        return res;
-    }
-
     private void importTestRealm(Consumer<RealmRepresentation> realmUpdater) {
-        RealmRepresentation realm = loadTestRealm();
+        if (testRealmReps == null) {
+            testRealmReps = testContext.getTestRealmReps();
+        }
+        RealmRepresentation realm = testRealmReps.get(0); // test realm
         if (realmUpdater != null) {
             realmUpdater.accept(realm);
         }
         importRealm(realm);
     }
 
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        log.debug("Adding test realm for import from testrealm.json");
-        testRealms.add(loadTestRealm());
-    }
-
     private void provideUsernamePassword(String user) {
         // Go to login page
         loginPage.open();
         loginPage.assertCurrent();
 
         // Login attempt with an invalid password
-        loginPage.login(user, "invalid");
+        loginPage.login(user, getPassword(user) + "invalid");
         loginPage.assertCurrent();
 
         // Login attempt with a valid password - user with configured OTP
-        loginPage.login(user, "password");
+        loginPage.login(user, getPassword(user));
     }
 
     private String getOtpCode(String key) {
@@ -233,12 +219,14 @@ public void testCredentialsOrder() {
                 // Move first OTP after second while priority are not used for import
                 user.getCredentials().add(user.getCredentials().remove(idxFirst));
             });
+            changePasswords(username);
 
             // Priority tells: second then first
             testCredentialsOrder(username, Arrays.asList(OTPFormAuthenticator.UNNAMED, "first"));
         } finally {
             // Restore default testrealm.json
-            importTestRealm(null);
+            testRealmReps = null;
+            importTestRealms();
         }
     }
 
@@ -535,7 +523,7 @@ public void testConditionalAuthenticatorWithConditionalSubFlowWithChangingCondit
             // The conditional sub flow is executed only if a specific user attribute is not set.
             // This sub flow will set the user attribute and displays password form.
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword("user-with-two-configured-otp"));
 
             Assert.assertTrue(oneTimeCodePage.isOtpLabelPresent());
         } finally {
@@ -1056,13 +1044,13 @@ public void testLoginWithWrongCredentialsMessage() {
 
         loginPage.open();
         loginPage.assertCurrent();
-        loginPage.login(user.getUsername(), "wrong_password");
+        loginPage.login(user.getUsername(), getPassword("test-user@localhost") + "wrong_password");
 
         Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
         events.clear();
 
         loginPage.assertCurrent();
-        loginPage.login(user.getUsername(), "password");
+        loginPage.login(user.getUsername(), getPassword("test-user@localhost"));
 
         Assert.assertFalse(loginPage.isCurrent());
         events.expectLogin()
@@ -1107,7 +1095,7 @@ public void testLoginMultiFactorWithWrongCredentialsMessage() {
 
             passwordPage.assertCurrent();
             events.clear();
-            passwordPage.login("password");
+            passwordPage.login(getPassword(user.getUsername()));
 
             Assert.assertFalse(loginUsernameOnlyPage.isCurrent());
             Assert.assertFalse(passwordPage.isCurrent());
@@ -1197,7 +1185,7 @@ public void testLoginWithAlternativeOTPAndConditionalPassword(){
             // Assert that the login skipped the OTP authenticator and moved to the password
             passwordPage.assertCurrent();
             passwordPage.assertTryAnotherWayLinkAvailability(true);
-            passwordPage.login("password");
+            passwordPage.login(getPassword("user-with-one-configured-otp"));
 
             Assert.assertFalse(loginPage.isCurrent());
             Assert.assertFalse(oneTimeCodePage.isOtpLabelPresent());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java
index 716daaef254a..f6d776de053b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.testsuite.forms;
 
+import jakarta.ws.rs.BadRequestException;
 import org.hamcrest.MatcherAssert;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.After;
@@ -23,7 +24,7 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.UsersResource;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
@@ -32,11 +33,12 @@
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.models.utils.TimeBasedOTP;
+import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.managers.BruteForceProtector;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.AssertEvents.ExpectedEvent;
 import org.keycloak.testsuite.pages.AppPage;
@@ -49,7 +51,7 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmRepUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 
@@ -64,13 +66,15 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertTrue;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public class BruteForceTest extends AbstractTestRealmKeycloakTest {
+public class BruteForceTest extends AbstractChangeImportedUserPasswordsTest {
 
     private static String userId;
 
@@ -106,6 +110,7 @@ public class BruteForceTest extends AbstractTestRealmKeycloakTest {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         UserRepresentation user = RealmRepUtil.findUser(testRealm, "test-user@localhost");
         UserBuilder.edit(user).totpSecret("totpSecret").emailVerified(true);
 
@@ -121,7 +126,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {
         userId = user.getId();
 
         RealmRepUtil.findClientByClientId(testRealm, "test-app").setDirectAccessGrantsEnabled(true);
-        testRealm.getUsers().add(UserBuilder.create().username("user2").email("user2@localhost").password("password").build());
+        testRealm.getUsers().add(UserBuilder.create().username("user2").email("user2@localhost").password(generatePassword("user2")).build());
     }
 
     @Before
@@ -170,13 +175,11 @@ public void before() throws MalformedURLException {
     }
 
     public String getAdminToken() throws Exception {
-        String clientId = Constants.ADMIN_CLI_CLIENT_ID;
-        return oauth.doGrantAccessTokenRequest("master", "admin", "admin", null, clientId, null).getAccessToken();
+        return oauth.realm("master").client(Constants.ADMIN_CLI_CLIENT_ID).doPasswordGrantRequest( "admin", "admin").getAccessToken();
     }
 
-    public OAuthClient.AccessTokenResponse getTestToken(String password, String totp) throws Exception {
-        return oauth.doGrantAccessTokenRequest("test", "test-user@localhost", password, totp, oauth.getClientId(), "password");
-
+    public AccessTokenResponse getTestToken(String password, String totp) {
+        return oauth.passwordGrantRequest("test-user@localhost", password).otp(totp).send();
     }
 
     protected void clearUserFailures() throws Exception {
@@ -186,19 +189,85 @@ protected void clearUserFailures() throws Exception {
     protected void clearAllUserFailures() throws Exception {
         adminClient.realm("test").attackDetection().clearAllBruteForce();
     }
+    
+    @Test
+    public void testInvalidConfiguration() throws Exception {
+        RealmRepresentation realm = testRealm().toRepresentation();
+        realm.setFailureFactor(-1);
+        try {
+            testRealm().update(realm);
+        } catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Failure factor may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setMaxTemporaryLockouts(-1);
+        try {
+            testRealm().update(realm);
+        }  catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Maximum temporary lockouts may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setMaxFailureWaitSeconds(-1);
+        try {
+            testRealm().update(realm);
+        }  catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Maximum failure wait seconds may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setWaitIncrementSeconds(-1);
+        try {
+            testRealm().update(realm);
+        }   catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Wait increment seconds may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setMinimumQuickLoginWaitSeconds(-1);
+        try {
+            testRealm().update(realm);
+        } catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Minimum quick login wait seconds may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setQuickLoginCheckMilliSeconds(-1L);
+        try {
+            testRealm().update(realm);
+        }  catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Quick login check milliseconds may not be a negative value", error.getErrorMessage());
+        }
+
+        realm = testRealm().toRepresentation();
+        realm.setMaxDeltaTimeSeconds(-1);
+        try {
+            testRealm().update(realm);
+        }   catch (BadRequestException ex) {
+            ErrorRepresentation error = ex.getResponse().readEntity(ErrorRepresentation.class);
+            assertEquals("Maximum delta time seconds may not be a negative value",  error.getErrorMessage());
+        }
+    }
 
     @Test
     public void testGrantInvalidPassword() throws Exception {
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
         }
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("invalid", totpSecret);
+            AccessTokenResponse response = getTestToken("invalid" + getPassword("test-user@localhost"), totpSecret);
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -206,7 +275,7 @@ public void testGrantInvalidPassword() throws Exception {
         }
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("invalid", totpSecret);
+            AccessTokenResponse response = getTestToken("invalid" + getPassword("test-user@localhost"), totpSecret);
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -214,7 +283,7 @@ public void testGrantInvalidPassword() throws Exception {
         }
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNull(response.getAccessToken());
             Assert.assertNotNull(response.getError());
             Assert.assertEquals("invalid_grant", response.getError());
@@ -225,7 +294,7 @@ public void testGrantInvalidPassword() throws Exception {
         clearUserFailures();
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
@@ -237,20 +306,20 @@ public void testGrantInvalidPassword() throws Exception {
     public void testGrantInvalidOtp() throws Exception {
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
         }
         {
-            OAuthClient.AccessTokenResponse response = getTestToken("password", "shite");
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), "shite");
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
             events.clear();
         }
         {
-            OAuthClient.AccessTokenResponse response = getTestToken("password", "shite");
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), "shite");
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -258,7 +327,7 @@ public void testGrantInvalidOtp() throws Exception {
         }
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             assertTokenNull(response);
             Assert.assertNotNull(response.getError());
             Assert.assertEquals(response.getError(), "invalid_grant");
@@ -269,7 +338,7 @@ public void testGrantInvalidOtp() throws Exception {
         clearUserFailures();
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
@@ -277,7 +346,7 @@ public void testGrantInvalidOtp() throws Exception {
 
     }
 
-    public void assertTokenNull(OAuthClient.AccessTokenResponse response) {
+    public void assertTokenNull(AccessTokenResponse response) {
         Assert.assertNull(response.getAccessToken());
     }
 
@@ -285,20 +354,20 @@ public void assertTokenNull(OAuthClient.AccessTokenResponse response) {
     public void testGrantMissingOtp() throws Exception {
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
         }
         {
-            OAuthClient.AccessTokenResponse response = getTestToken("password", null);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), null);
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
             events.clear();
         }
         {
-            OAuthClient.AccessTokenResponse response = getTestToken("password", null);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), null);
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -306,7 +375,7 @@ public void testGrantMissingOtp() throws Exception {
         }
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             assertTokenNull(response);
             Assert.assertNotNull(response.getError());
             Assert.assertEquals(response.getError(), "invalid_grant");
@@ -317,7 +386,7 @@ public void testGrantMissingOtp() throws Exception {
         clearUserFailures();
         {
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             Assert.assertNull(response.getError());
             events.clear();
@@ -333,7 +402,7 @@ public void testNumberOfFailuresForDisabledUsersWithPasswordGrantType() throws E
             user.setEnabled(false);
             updateUser(user);
 
-            OAuthClient.AccessTokenResponse response = getTestToken("invalid", "invalid");
+            AccessTokenResponse response = getTestToken("invalid", "invalid");
             Assert.assertNull(response.getAccessToken());
             Assert.assertEquals(response.getError(), "invalid_grant");
             Assert.assertEquals(response.getErrorDescription(), "Account disabled");
@@ -536,11 +605,75 @@ public void testBrowserInvalidPasswordDifferentCase() throws Exception {
     public void testEmail() throws Exception {
         String userId = adminClient.realm("test").users().search("user2", null, null, null, 0, 1).get(0).getId();
 
-        loginInvalidPassword("user2@localhost");
-        loginInvalidPassword("user2@localhost");
-        expectTemporarilyDisabled("user2@localhost", userId);
+        loginInvalidPassword("user2");
+        loginInvalidPassword("user2");
+        expectTemporarilyDisabled("user2", userId);
         clearAllUserFailures();
     }
+    
+    @Test
+    public void testUserDisabledTemporaryLockout() throws Exception {
+        String userId = adminClient.realm("test").users().search("test-user@localhost", null, null, null, 0, 1).get(0).getId();
+
+        loginInvalidPassword();
+        loginInvalidPassword();
+        expectTemporarilyDisabled();
+
+        assertTrue(testRealm().users().get(userId).toRepresentation().isEnabled());
+        assertTrue(testRealm().users().search("test-user@localhost", true).get(0).isEnabled());
+        assertEquals(Boolean.TRUE, testRealm().attackDetection().bruteForceUserStatus(userId).get("disabled"));
+    }
+
+    @Test
+    public void testUserDisabledAfterSwitchFromMixedToPermanentLockout() throws Exception {
+        UsersResource users = testRealm().users();
+        UserRepresentation user = users.search("test-user@localhost", null, null, null, 0, 1).get(0);
+
+        // temporarily lockout
+        loginInvalidPassword();
+        loginInvalidPassword();
+        expectTemporarilyDisabled();
+        assertUserNumberOfFailures(user.getId(), 2);
+        // user is still enabled during temporary lockout
+        assertTrue(users.get(user.getId()).toRepresentation().isEnabled());
+        assertTrue(users.search("test-user@localhost", true).get(0).isEnabled());
+        assertEquals(Boolean.TRUE, testRealm().attackDetection().bruteForceUserStatus(user.getId()).get("disabled"));
+
+        RealmRepresentation realm = testRealm().toRepresentation();
+
+        try {
+            // switch to permanent lockout before waiting to successful login
+            realm.setPermanentLockout(true);
+            testRealm().update(realm);
+
+            // expires the temporary lockout
+            this.setTimeOffset(60);
+
+            // after switching to permanent lockout the user status is disabled because there are login failures
+            // the user did not try to successfully authenticate yet to clear the login failures
+            user = users.get(user.getId()).toRepresentation();
+            assertFalse(user.isEnabled());
+            assertFalse(users.search("test-user@localhost", true).get(0).isEnabled());
+            assertEquals(Boolean.TRUE, testRealm().attackDetection().bruteForceUserStatus(user.getId()).get("disabled"));
+            expectPermanentlyDisabled();
+
+            // attempt to re-enable the user and login successfully
+            user.setEnabled(true);
+            users.get(user.getId()).update(user);
+            user = users.get(user.getId()).toRepresentation();
+            assertTrue(user.isEnabled());
+            assertTrue(users.search("test-user@localhost", true).get(0).isEnabled());
+            Map<String, Object> userAttackInfo = testRealm().attackDetection().bruteForceUserStatus(user.getId());
+            assertEquals(Boolean.FALSE, userAttackInfo.get("disabled"));
+            assertThat((Integer) userAttackInfo.get("numFailures"), is(0));
+            // login failures should be removed after re-enabling the user and the user able to authenticate
+            loginSuccess();
+        } finally {
+            resetTimeOffset();
+            realm.setPermanentLockout(false);
+            testRealm().update(realm);
+        }
+    }
 
     @Test
     public void testBrowserMissingPassword() throws Exception {
@@ -591,6 +724,7 @@ private void checkEmailPresent(String subject) {
     public void testPermanentLockout() throws Exception {
         testingClient.testing().addEventsToEmailEventListenerProvider(Collections.singletonList(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT));
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm()).setPermanentLockout(true)
+                .setQuickLoginCheckMilliSeconds(0L)
                 .addEventsListener(EmailEventListenerProviderFactory.ID).update()) {
             // act
             loginInvalidPassword("test-user@localhost");
@@ -603,7 +737,7 @@ public void testPermanentLockout() throws Exception {
             assertIsContained(events.expect(EventType.USER_DISABLED_BY_PERMANENT_LOCKOUT).client((String) null).detail(Details.REASON, "brute_force_attack detected"), actualEvents);
             assertIsContained(events.expect(EventType.LOGIN_ERROR).error(Errors.INVALID_USER_CREDENTIALS), actualEvents);
 
-            checkEmailPresent("User disabled by permament lockout");
+            checkEmailPresent("User disabled by permanent lockout");
 
             // assert
             expectPermanentlyDisabled();
@@ -764,7 +898,7 @@ public void testResetLoginFailureCount() {
     @Test
     public void testFailureCountResetWithPasswordGrantType() throws Exception {
         String totpSecret = totp.generateTOTP("totpSecret");
-        OAuthClient.AccessTokenResponse response = getTestToken("invalid", totpSecret);
+        AccessTokenResponse response = getTestToken("invalid", totpSecret);
         Assert.assertNull(response.getAccessToken());
         Assert.assertEquals(response.getError(), "invalid_grant");
         Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -773,7 +907,7 @@ public void testFailureCountResetWithPasswordGrantType() throws Exception {
         Map<String, Object> userAttackInfo = adminClient.realm("test").attackDetection().bruteForceUserStatus(user.getId());
         assertThat((Integer) userAttackInfo.get("numFailures"), is(1));
 
-        response = getTestToken("password", totpSecret);
+        response = getTestToken(getPassword("test-user@localhost"), totpSecret);
         Assert.assertNotNull(response.getAccessToken());
         Assert.assertNull(response.getError());
         events.clear();
@@ -820,20 +954,24 @@ public void testResetPassword() throws Exception {
         assertTrue(passwordUpdatePage.isCurrent());
 
         UserRepresentation userRepresentation = testRealm().users().get(userId).toRepresentation();
-        assertFalse(userRepresentation.isEnabled());
+        assertTrue(userRepresentation.isEnabled());
+        Map<String, Object> bruteForceStatus = testRealm().attackDetection().bruteForceUserStatus(userId);
+        assertEquals(Boolean.TRUE, bruteForceStatus.get("disabled"));
 
-        updatePasswordPage.updatePasswords("password", "password");
+        updatePasswordPage.updatePasswords(getPassword("user2"), getPassword("user2"));
 
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).user(userId).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).user(userId).assertEvent();
 
         userRepresentation = testRealm().users().get(userId).toRepresentation();
         assertTrue(userRepresentation.isEnabled());
+        bruteForceStatus = testRealm().attackDetection().bruteForceUserStatus(userId);
+        assertEquals(Boolean.FALSE, bruteForceStatus.get("disabled"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
 
         events.clear();
@@ -853,7 +991,7 @@ public void testRaceAttackTemporaryLockout() throws Exception {
             user.setEnabled(true);
             testRealm().users().get(user.getId()).update(user);
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
             raceAttack(user);
         } finally {
@@ -879,7 +1017,7 @@ public void testRaceAttackPermanentLockout() throws Exception {
             user.setEnabled(true);
             testRealm().users().get(user.getId()).update(user);
             String totpSecret = totp.generateTOTP("totpSecret");
-            OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+            AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
             Assert.assertNotNull(response.getAccessToken());
         } finally {
             realm.setPermanentLockout(false);
@@ -910,7 +1048,7 @@ public class LoginThread extends Thread {
         public void run() {
             try {
                 String totpSecret = totp.generateTOTP("totpSecret");
-                OAuthClient.AccessTokenResponse response = getTestToken("invalid", totpSecret);
+                AccessTokenResponse response = getTestToken("invalid", totpSecret);
                 Assert.assertNull(response.getAccessToken());
                 Assert.assertEquals(response.getError(), "invalid_grant");
                 Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -921,11 +1059,11 @@ public void run() {
     }
 
     public void expectTemporarilyDisabled() {
-        expectTemporarilyDisabled("test-user@localhost", null, "password");
+        expectTemporarilyDisabled("test-user@localhost", null, getPassword("test-user@localhost"));
     }
 
     public void expectTemporarilyDisabled(String username, String userId) {
-        expectTemporarilyDisabled(username, userId, "password");
+        expectTemporarilyDisabled(username, userId, getPassword(username));
     }
 
     public void expectTemporarilyDisabled(String username, String userId, String password) {
@@ -951,7 +1089,7 @@ public void expectPermanentlyDisabled() {
 
     public void expectPermanentlyDisabled(String username) {
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, getPassword(username));
 
         loginPage.assertCurrent();
         Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
@@ -961,6 +1099,12 @@ public void expectPermanentlyDisabled(String username) {
             .detail(Details.USERNAME, username)
             .removeDetail(Details.CONSENT);
         event.assertEvent();
+        UserRepresentation user = testRealm().users().search(username, true).get(0);
+        user = testRealm().users().get(user.getId()).toRepresentation();
+        List<String> disabledReason = user.getAttributes().get(UserModel.DISABLED_REASON);
+        assertNotNull(disabledReason);
+        assertEquals(1, disabledReason.size());
+        assertEquals(BruteForceProtector.DISABLED_BY_PERMANENT_LOCKOUT, disabledReason.get(0));
     }
 
     public void loginSuccess() {
@@ -969,7 +1113,7 @@ public void loginSuccess() {
 
     public void loginSuccess(String username) {
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, getPassword(username));
 
         loginTotpPage.assertCurrent();
 
@@ -980,15 +1124,15 @@ public void loginSuccess(String username) {
 
         events.expectLogin().assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code ).getIdToken();
         appPage.logout(idTokenHint);
         events.clear();
     }
 
     public void loginWithTotpFailure() {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         loginTotpPage.assertCurrent();
 
@@ -1007,8 +1151,8 @@ public void continueLoginWithTotp() {
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         events.expectLogin().assertEvent();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
         events.clear();
     }
@@ -1046,7 +1190,7 @@ public void continueLoginWithMissingTotp() {
 
     public void loginWithMissingTotp() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         loginTotpPage.assertCurrent();
 
@@ -1093,7 +1237,8 @@ public void registerUser(String username) {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("user", "name", username + "@localhost", username, "password", "password");
+        final String password = generatePassword("user");
+        registerPage.register("user", "name", username + "@localhost", username, password, password);
 
         Assert.assertNull(registerPage.getInstruction());
 
@@ -1123,7 +1268,7 @@ private void assertUserNumberOfFailures(String userId, Integer numberOfFailures)
 
     private void sendInvalidPasswordPasswordGrant() throws Exception {
         String totpSecret = totp.generateTOTP("totpSecret");
-        OAuthClient.AccessTokenResponse response = getTestToken("invalid", totpSecret);
+        AccessTokenResponse response = getTestToken("invalid", totpSecret);
         Assert.assertNull(response.getAccessToken());
         Assert.assertEquals(response.getError(), "invalid_grant");
         Assert.assertEquals(response.getErrorDescription(), "Invalid user credentials");
@@ -1132,7 +1277,7 @@ private void sendInvalidPasswordPasswordGrant() throws Exception {
 
     private void lockUserWithPasswordGrant() throws Exception {
         String totpSecret = totp.generateTOTP("totpSecret");
-        OAuthClient.AccessTokenResponse response = getTestToken("password", totpSecret);
+        AccessTokenResponse response = getTestToken(getPassword("test-user@localhost"), totpSecret);
         Assert.assertNotNull(response.getAccessToken());
         Assert.assertNull(response.getError());
         events.clear();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ConditionalUserAttributeAuthenticatorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ConditionalUserAttributeAuthenticatorTest.java
index 5c31eaa0a580..e6f820bb4c23 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ConditionalUserAttributeAuthenticatorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ConditionalUserAttributeAuthenticatorTest.java
@@ -25,6 +25,7 @@
 import org.keycloak.testsuite.util.FlowUtil;
 import org.keycloak.testsuite.util.GroupBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
 import java.util.HashMap;
 import java.util.List;
@@ -48,7 +49,7 @@ public class ConditionalUserAttributeAuthenticatorTest extends AbstractTestRealm
     private final static String APPROVED_USER = "approved";
     private final static String APPROVED_BY_GROUP_USER = "approved-by-group";
     private final static String APPROVED_BY_SUBGROUP_USER = "approved-by-subgroup";
-    private final static String PASSWORD = "password";
+    private final static String PASSWORD = generatePassword();
 
     @Page
     protected LoginUsernameOnlyPage loginUsernameOnlyPage;
@@ -68,7 +69,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {}
     @Before
     public void configureUserProfile() {
         UserProfileResource userProfileRes = testRealm().users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(userProfileRes);
+        UserProfileUtil.enableUnmanagedAttributes(userProfileRes);
     }
 
     private void createUsers() {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java
index 21b2b5e9448d..2633a1791ccd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java
@@ -52,7 +52,7 @@
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ExecutionBuilder;
 import org.keycloak.testsuite.util.FlowBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmRepUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 
@@ -306,7 +306,7 @@ public void loginSuccess() {
         oauth.openLoginForm();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -336,7 +336,7 @@ public void clientAuthTest() throws Exception {
         state.setClientId("unknown");
         testingClient.testing().updateAuthenticator(state);
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user", "password");
         assertEquals(401, response.getStatusCode());
         assertEquals("invalid_client", response.getError());
 
@@ -354,21 +354,16 @@ public void clientAuthTest() throws Exception {
         testingClient.testing().updateAuthenticator(state);
 
         // Test throwing exception from the client authenticator. No error details should be displayed
-        oauth.addCustomParameter(PassThroughClientAuthenticator.TEST_ERROR_PARAM, "Some Random Error");
-        try {
-            response = oauth.doGrantAccessTokenRequest("password", "test-user", "password");
-            assertEquals(400, response.getStatusCode());
-            assertEquals("unauthorized_client", response.getError());
-            assertEquals("Unexpected error when authenticating client", response.getErrorDescription());
-        } finally {
-            oauth.removeCustomParameter(PassThroughClientAuthenticator.TEST_ERROR_PARAM);
-        }
+        response = oauth.passwordGrantRequest("test-user", "password").param(PassThroughClientAuthenticator.TEST_ERROR_PARAM, "Some Random Error").send();
+        assertEquals(400, response.getStatusCode());
+        assertEquals("unauthorized_client", response.getError());
+        assertEquals("Unexpected error when authenticating client", response.getErrorDescription());
     }
 
 
     private void grantAccessToken(String clientId, String login) throws Exception {
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", login, "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(login, "password");
 
         assertEquals(200, response.getStatusCode());
 
@@ -391,7 +386,7 @@ private void grantAccessToken(String clientId, String login) throws Exception {
 
         assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
 
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/DirectGrantFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/DirectGrantFlowTest.java
index 99e72ee071f7..090cb91bf922 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/DirectGrantFlowTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/DirectGrantFlowTest.java
@@ -34,7 +34,8 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.authentication.AbstractAuthenticationTest;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 
 import java.util.List;
@@ -84,7 +85,7 @@ public void testDirectGrantLoginWithOTPFormShouldFail() throws Exception {
 
         // User should not be able to login as there was required action added to authenticationSession by OTPFormAuthenticator
         oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", login, "password", null);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(login, "password");
 
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/FlowOverrideTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/FlowOverrideTest.java
index a255a27db371..4ac3e9988731 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/FlowOverrideTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/FlowOverrideTest.java
@@ -38,7 +38,6 @@
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
@@ -49,6 +48,7 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.FlowUtil;
+import org.keycloak.testsuite.util.UIUtils;
 import org.keycloak.util.BasicAuthHelper;
 import org.openqa.selenium.By;
 
@@ -90,10 +90,6 @@ public class FlowOverrideTest extends AbstractFlowTest {
 
     private TimeBasedOTP totp = new TimeBasedOTP();
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Before
     public void setupFlows() {
         SerializableApplicationData serializedApplicationData = new SerializableApplicationData(oauth.APP_AUTH_ROOT, oauth.APP_ROOT + "/admin", oauth.APP_AUTH_ROOT + "/*");
@@ -204,23 +200,18 @@ public void testRunConsole() throws Exception {
     @Test
     public void testWithClientBrowserOverride() throws Exception {
         oauth.clientId(TEST_APP_FLOW);
-        String loginFormUrl = oauth.getLoginFormUrl();
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        //Thread.sleep(10000000);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.openLoginForm();
 
         Assert.assertEquals("PushTheButton", driver.getTitle());
 
         // Push the button. I am redirected to username+password form
-        driver.findElement(By.name("submit1")).click();
+        UIUtils.clickLink(driver.findElement(By.name("submit1")));
 
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am successfully authenticated
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().client("test-app-flow").detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -247,17 +238,12 @@ public void testNoOverrideBrowser() throws Exception {
 
     private void testNoOverrideBrowser(String clientId) {
         oauth.clientId(clientId);
-        String loginFormUrl = oauth.getLoginFormUrl();
-        log.info("loginFormUrl: " + loginFormUrl);
-
-        //Thread.sleep(10000000);
-
-        driver.navigate().to(loginFormUrl);
+        oauth.openLoginForm();
 
         loginPage.assertCurrent();
 
         // Fill username+password. I am successfully authenticated
-        oauth.fillLoginForm("test-user@localhost", "password");
+        oauth.fillLoginForm("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().client(clientId).detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -275,7 +261,7 @@ public void testRemovedFlowOverrideByClientThenFallbackToNoOverrideDirectGrantFl
 
     private void testDirectGrantNoOverride(String clientId) {
         Client httpClient = AdminClientUtil.createResteasyClient();
-        String grantUri = oauth.getResourceOwnerPasswordCredentialGrantUrl();
+        String grantUri = oauth.getEndpoints().getToken();
         WebTarget grantTarget = httpClient.target(grantUri);
 
         {   // test no password
@@ -308,7 +294,7 @@ private void testDirectGrantNoOverride(String clientId) {
             Form form = new Form();
             form.param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD);
             form.param("username", "test-user@localhost");
-            form.param("password", "password");
+            form.param("password", getPassword("test-user@localhost"));
 
             Response response = grantTarget.request()
                     .header(HttpHeaders.AUTHORIZATION, header)
@@ -325,7 +311,7 @@ private void testDirectGrantNoOverride(String clientId) {
     public void testGrantAccessTokenWithClientOverride() throws Exception {
         String clientId = TEST_APP_DIRECT_OVERRIDE;
         Client httpClient = AdminClientUtil.createResteasyClient();
-        String grantUri = oauth.getResourceOwnerPasswordCredentialGrantUrl();
+        String grantUri = oauth.getEndpoints().getToken();
         WebTarget grantTarget = httpClient.target(grantUri);
 
         {   // test no password
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LevelOfAssuranceFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LevelOfAssuranceFlowTest.java
index 90cd07bbca2f..32f63c49e5e9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LevelOfAssuranceFlowTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LevelOfAssuranceFlowTest.java
@@ -26,7 +26,6 @@
 
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.UriBuilder;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.After;
 import org.junit.Before;
@@ -44,6 +43,7 @@
 import org.keycloak.authentication.authenticators.conditional.ConditionalLoaAuthenticatorFactory;
 import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.common.Profile;
+import org.keycloak.cookie.CookieType;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.models.AuthenticationExecutionModel.Requirement;
@@ -64,7 +64,7 @@
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.account.AccountRestClient;
@@ -85,14 +85,14 @@
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmRepUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.util.JsonSerialization;
 
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.common.Profile.Feature.RECOVERY_CODES;
 import static org.keycloak.testsuite.actions.AppInitiatedActionDeleteCredentialTest.getKcActionParamForDeleteCredential;
 
 /**
@@ -100,8 +100,7 @@
  *
  * @author <a href="mailto:sebastian.zoescher@prime-sign.com">Sebastian Zoescher</a>
  */
-@EnableFeature(value = RECOVERY_CODES, skipRestart = true)
-public class LevelOfAssuranceFlowTest extends AbstractTestRealmKeycloakTest {
+public class LevelOfAssuranceFlowTest extends AbstractChangeImportedUserPasswordsTest {
 
     private final static String FLOW_ALIAS = "browser -  Level of Authentication FLow";
 
@@ -141,6 +140,7 @@ public class LevelOfAssuranceFlowTest extends AbstractTestRealmKeycloakTest {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         try {
             testRealm.setOtpPolicyCodeReusable(true);
             findTestApp(testRealm).setAttributes(Collections.singletonMap(Constants.ACR_LOA_MAP, getAcrToLoaMappingForClient()));
@@ -161,14 +161,12 @@ public void beforeTest() {
 
         userRep.setId(null);
         UserBuilder.edit(userRep)
-                .password("password")
+                .password(generatePassword("test-user@localhost"))
                 .totpSecret("totpSecret")
                 .otpEnabled();
         Response response = testRealm().users().create(userRep);
         Assert.assertEquals(201, response.getStatus());
         response.close();
-
-        oauth.kcAction(null);
     }
 
     private String getAcrToLoaMappingForClient() throws IOException {
@@ -321,6 +319,25 @@ public void stepupAuthentication() {
         assertLoggedInWithAcr("3");
     }
 
+    @Test
+    public void stepupAuthenticationNoAuthSessionCookie() {
+        // logging in to level 1
+        openLoginFormWithAcrClaim(true, "silver");
+        authenticateWithUsernamePassword();
+        assertLoggedInWithAcr("silver");
+        // doing step-up authentication to level 2
+        openLoginFormWithAcrClaim(true, "gold");
+        authenticateWithTotp();
+        assertLoggedInWithAcr("gold");
+        // going back to login again, otp should be presented as by default max-age is 0
+        openLoginFormWithAcrClaim(true, "gold");
+        // remove the auth session cookie emulating a browser restart in which this cookie is lost
+        driver.manage().deleteCookieNamed(CookieType.AUTH_SESSION_ID.getName());
+        openLoginFormWithAcrClaim(true, "gold");
+        authenticateWithTotp();
+        assertLoggedInWithAcr("gold");
+    }
+
     @Test
     public void stepupToUnknownEssentialAcrFails() {
         openLoginFormWithAcrClaim(true, "silver");
@@ -336,7 +353,6 @@ public void reauthenticationWithNoAcr() {
         openLoginFormWithAcrClaim(true, "silver");
         authenticateWithUsernamePassword();
         assertLoggedInWithAcr("silver");
-        oauth.claims(null);
         oauth.openLoginForm();
         assertLoggedInWithAcr("silver"); // Return silver without need to re-authenticate due maxAge for "silver" condition did not timed-out yet
     }
@@ -394,9 +410,7 @@ public void optionalUnknownClaimSucceeds() {
 
     @Test
     public void acrValuesQueryParameter() {
-        driver.navigate().to(UriBuilder.fromUri(oauth.getLoginFormUrl())
-            .queryParam("acr_values", "gold 3")
-            .build().toString());
+        oauth.loginForm().param("acr_values", "gold 3").open();
         authenticateWithUsernamePassword();
         authenticateWithTotp();
         assertLoggedInWithAcr("gold");
@@ -579,7 +593,6 @@ public void testMaxAgeConditionWithSSO() {
         assertLoggedInWithAcr("3");
 
         // Re-auth 1: Should be automatically authenticated and still return "3"
-        oauth.claims(null);
         oauth.openLoginForm();
         assertLoggedInWithAcr("3");
 
@@ -646,20 +659,17 @@ public void testMaxAgeConditionWithForcedReauthentication() {
         assertLoggedInWithAcr("3");
 
         // Send request with prompt=login . User should be asked to re-authenticate with level 1
-        oauth.claims(null);
-        oauth.prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN);
-        oauth.openLoginForm();
+        oauth.loginForm().prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN).open();
         reauthenticateWithPassword();
         assertLoggedInWithAcr("silver");
 
         // Request with prompt=login together with "acr=2" . User should be asked to re-authenticate with level 2
-        openLoginFormWithAcrClaim(true, "gold");
+        oauth.loginForm().claims(claims(true, "gold")).prompt("login").open();
         reauthenticateWithPassword();
         authenticateWithTotp();
         assertLoggedInWithAcr("gold");
 
         // Request with "acr=3", but without prompt. User should be automatically authenticated
-        oauth.prompt(null);
         openLoginFormWithAcrClaim(true, "3");
         assertLoggedInWithAcr("3");
     }
@@ -786,8 +796,7 @@ public void testWithMultipleOTPCodes() throws Exception {
         TokenCtx token1 = assertLoggedInWithAcr("silver");
 
         // Add "kc_action" for setup another OTP. Existing OTP authentication should be required. No offer for recovery-codes as they are different level
-        oauth.kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).open();
         loginTotpPage.assertCurrent();
         loginTotpPage.assertOtpCredentialSelectorAvailability(false);
 
@@ -799,8 +808,7 @@ public void testWithMultipleOTPCodes() throws Exception {
         TokenCtx token2 = assertLoggedInWithAcr("gold");
 
         // Trying to add another OTP by "kc_action". Level 2 should be required and user can choose between 2 OTP codes
-        oauth.kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).open();
         loginTotpPage.assertCurrent();
         loginTotpPage.assertOtpCredentialSelectorAvailability(true);
         List<String> availableOtps = loginTotpPage.getAvailableOtpCredentials();
@@ -839,8 +847,7 @@ public void testDeleteCredentialAction() throws Exception {
         TokenCtx token1 = assertLoggedInWithAcr("silver");
 
         // Setup another OTP (requires login with existing OTP)
-        oauth.kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).open();
         authenticateWithTotp();
         totpSetupPage.assertCurrent();
         totpSetupPage.configure(totp.generateTOTP(totpSetupPage.getTotpSecret()), "totp2-label");
@@ -851,8 +858,7 @@ public void testDeleteCredentialAction() throws Exception {
         String otp2CredentialId = getCredentialIdByLabel("totp2-label");
 
         // Delete OTP credential requires level2. Re-authentication is required (because of max_age=0 for level2 evaluated during re-authentication)
-        oauth.kcAction(getKcActionParamForDeleteCredential(otp2CredentialId));
-        oauth.openLoginForm();
+        oauth.loginForm().kcAction(getKcActionParamForDeleteCredential(otp2CredentialId)).open();
         loginTotpPage.assertCurrent();
         authenticateWithTotp();
 
@@ -876,8 +882,7 @@ public void testWithOTPAndRecoveryCodesAtLevel2() {
 
             // Trying to delete existing OTP. Should require authentication with this OTP
             String otpCredentialId = getCredentialIdByType(OTPCredentialModel.TYPE);
-            oauth.kcAction(getKcActionParamForDeleteCredential(otpCredentialId));
-            oauth.openLoginForm();
+            oauth.loginForm().kcAction(getKcActionParamForDeleteCredential(otpCredentialId)).open();
             Assert.assertEquals("Strong authentication required to continue", loginPage.getInfoMessage());
             authenticateWithTotp();
 
@@ -889,8 +894,7 @@ public void testWithOTPAndRecoveryCodesAtLevel2() {
             assertLoggedInWithAcr("gold");
 
             // Trying to add OTP. No 2nd factor should be required as user doesn't have any
-            oauth.kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name());
-            oauth.openLoginForm();
+            oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_TOTP.name()).open();
             totpSetupPage.assertCurrent();
             String totp2Secret = totpSetupPage.getTotpSecret();
             totpSetupPage.configure(totp.generateTOTP(totp2Secret), "totp2-label");
@@ -902,8 +906,7 @@ public void testWithOTPAndRecoveryCodesAtLevel2() {
             setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
 
             // Add "kc_action" for setup recovery codes. OTP should be required
-            oauth.kcAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
-            oauth.openLoginForm();
+            oauth.loginForm().kcAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name()).open();
             loginTotpPage.assertCurrent();
             loginTotpPage.login(totp.generateTOTP(totp2Secret));
             setupRecoveryAuthnCodesPage.assertCurrent();
@@ -913,8 +916,7 @@ public void testWithOTPAndRecoveryCodesAtLevel2() {
 
             // Removing recovery-code credential. User required to authenticate with 2nd-factor. He can choose between OTP or recovery-codes
             String recoveryCodesId = getCredentialIdByType(RecoveryAuthnCodesCredentialModel.TYPE);
-            oauth.kcAction(getKcActionParamForDeleteCredential(recoveryCodesId));
-            oauth.openLoginForm();
+            oauth.loginForm().kcAction(getKcActionParamForDeleteCredential(recoveryCodesId)).open();
             loginTotpPage.assertCurrent();
             loginTotpPage.clickTryAnotherWayLink();
             selectAuthenticatorPage.assertCurrent();
@@ -959,9 +961,7 @@ public void testLoginWithMinimumAcrWithLowerAcrValues() {
         testClient.update(testClientRep);
 
         // Should request client to authenticate with gold, even if the client sends silver
-        driver.navigate().to(UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam("acr_values", "silver")
-                .build().toString());
+        oauth.loginForm().param("acr_values", "silver").open();
         authenticateWithUsernamePassword();
         authenticateWithTotp();
         assertLoggedInWithAcr("gold");
@@ -979,9 +979,7 @@ public void testLoginWithMinimumAcrWithHigherAcrValues() {
         testClient.update(testClientRep);
 
         // Should request client to authenticate with gold, even if the client sends silver
-        driver.navigate().to(UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam("acr_values", "3")
-                .build().toString());
+        oauth.loginForm().param("acr_values", "3").open();
         authenticateWithUsernamePassword();
         authenticateWithTotp();
         authenticateWithButton();
@@ -1086,26 +1084,34 @@ public void openLoginFormWithAcrClaim(boolean essential, String... acrValues) {
     }
 
     public static void openLoginFormWithAcrClaim(OAuthClient oauth, boolean essential, String... acrValues) {
+        oauth.loginForm().claims(claims(essential, acrValues)).open();
+    }
+
+    public static ClaimsRepresentation claims(boolean essential, String... acrValues) {
+        //in order to test both values and value
+        //setValue only for essential false and only one value        
         ClaimsRepresentation.ClaimValue<String> acrClaim = new ClaimsRepresentation.ClaimValue<>();
         acrClaim.setEssential(essential);
-        acrClaim.setValues(Arrays.asList(acrValues));
+        if (essential || acrValues.length > 1) {
+            acrClaim.setValues(Arrays.asList(acrValues));
+        } else {
+            acrClaim.setValue(acrValues[0]);
+        }
 
         ClaimsRepresentation claims = new ClaimsRepresentation();
         claims.setIdTokenClaims(Collections.singletonMap(IDToken.ACR, acrClaim));
-
-        oauth.claims(claims);
-        oauth.openLoginForm();
+        return claims;
     }
-
+    
     private void authenticateWithUsernamePassword() {
         loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
     }
 
     private void reauthenticateWithPassword() {
         loginPage.assertCurrent();
         Assert.assertEquals("test-user@localhost", loginPage.getAttemptedUsername());
-        loginPage.login("password");
+        loginPage.login(getPassword("test-user@localhost"));
     }
 
     private void authenticateWithTotp() {
@@ -1120,7 +1126,7 @@ private void authenticateWithButton() {
 
     private TokenCtx assertLoggedInWithAcr(String acr) {
         EventRepresentation loginEvent = events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         IDToken idToken = oauth.verifyIDToken(tokenResponse.getIdToken());
         Assert.assertEquals(acr, idToken.getAcr());
         return new TokenCtx(tokenResponse.getAccessToken(), idToken);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginHotpTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginHotpTest.java
index 37962ae674c0..258bb9ec9ff8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginHotpTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginHotpTest.java
@@ -27,8 +27,8 @@
 import org.keycloak.models.utils.HmacOTP;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
@@ -43,12 +43,13 @@
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public class LoginHotpTest extends AbstractTestRealmKeycloakTest {
+public class LoginHotpTest extends AbstractChangeImportedUserPasswordsTest {
 
     public static OTPPolicy policy;
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         testRealm.setOtpPolicyType(OTPCredentialModel.HOTP);
         testRealm.setOtpPolicyAlgorithm(HmacOTP.DEFAULT_ALGORITHM);
         testRealm.setOtpPolicyLookAheadWindow(2);
@@ -98,7 +99,7 @@ public void before() throws MalformedURLException {
     @Test
     public void loginWithHotpFailure() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -117,7 +118,7 @@ public void loginWithHotpFailure() throws Exception {
     @Test
     public void loginWithMissingHotp() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -136,7 +137,7 @@ public void loginWithMissingHotp() throws Exception {
     @Test
     public void loginWithHotpSuccess() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue("expecting totpPage got: " + driver.getCurrentUrl(), loginTotpPage.isCurrent());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java
index 5cbf844a3613..5546c07ced7b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTest.java
@@ -22,8 +22,9 @@
 import java.util.HashMap;
 import java.util.List;
 import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.core.Form;
 import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.UriBuilder;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
@@ -31,7 +32,6 @@
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.admin.client.resource.UsersResource;
 import org.keycloak.common.Profile;
 import org.keycloak.common.util.Base64Url;
@@ -50,13 +50,12 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.SessionTimeoutHelper;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.OIDCLoginProtocolService;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.ProfileAssume;
 import org.keycloak.testsuite.admin.ApiUtil;
@@ -70,10 +69,9 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.DroneUtils;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserBuilder;
@@ -91,34 +89,34 @@
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.common.Profile.Feature.DYNAMIC_SCOPES;
 import static org.keycloak.testsuite.admin.ApiUtil.findClientByClientId;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
-import static org.keycloak.testsuite.util.OAuthClient.SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.SERVER_ROOT;
 import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class LoginTest extends AbstractTestRealmKeycloakTest {
+public class LoginTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         UserRepresentation user = UserBuilder.create()
                                              .username("login-test")
                                              .email("login@test.com")
                                              .enabled(true)
-                                             .password("password")
+                                             .password(generatePassword("login-test"))
                                              .build();
 
         UserRepresentation user2 = UserBuilder.create()
                                               .username("login-test2")
                                               .email("login2@test.com")
                                               .enabled(true)
-                                              .password("password")
+                                              .password(generatePassword("login2-test"))
                                               .build();
 
         UserRepresentation admin = UserBuilder.create()
                 .username("admin")
-                .password("admin")
+                .password(generatePassword("admin"))
                 .enabled(true)
                 .build();
         HashMap<String, List<String>> clientRoles = new HashMap<>();
@@ -166,7 +164,7 @@ public void importTestRealms() {
     @Test
     public void testBrowserSecurityHeaders() {
         Client client = AdminClientUtil.createResteasyClient();
-        Response response = client.target(oauth.getLoginFormUrl()).request().get();
+        Response response = client.target(oauth.loginForm().build()).request().get();
         assertThat(response.getStatus(), is(equalTo(200)));
         for (BrowserSecurityHeaders header : BrowserSecurityHeaders.values()) {
             String headerValue = response.getHeaderString(header.getHeaderName());
@@ -195,7 +193,7 @@ public void testContentSecurityPolicyReportOnlyBrowserSecurityHeader() {
 
         try {
             Client client = AdminClientUtil.createResteasyClient();
-            Response response = client.target(oauth.getLoginFormUrl()).request().get();
+            Response response = client.target(oauth.loginForm().build()).request().get();
             String headerValue = response.getHeaderString(cspReportOnlyHeader);
             assertThat(headerValue, is(equalTo(expectedCspReportOnlyValue)));
             response.close();
@@ -211,9 +209,15 @@ public void testContentSecurityPolicyReportOnlyBrowserSecurityHeader() {
     public void testPOSTAuthenticationRequest() {
         Client client = AdminClientUtil.createResteasyClient();
 
+        Form form = new Form()
+                .param(OAuth2Constants.SCOPE, "openid")
+                .param(OAuth2Constants.CLIENT_ID, oauth.getClientId())
+                .param(OAuth2Constants.RESPONSE_TYPE, "code")
+                .param(OAuth2Constants.REDIRECT_URI, oauth.getRedirectUri())
+                .param(OAuth2Constants.STATE, "123456");
+
         //POST request to http://localhost:8180/auth/realms/test/protocol/openid-connect/auth;
-        UriBuilder b = OIDCLoginProtocolService.authUrl(UriBuilder.fromUri(AUTH_SERVER_ROOT));
-        Response response = client.target(b.build(oauth.getRealm())).request().post(oauth.getLoginEntityForPOST());
+        Response response = client.target(oauth.getEndpoints().getAuthorization()).request().post(Entity.form(form));
 
         assertThat(response.getStatus(), is(equalTo(200)));
         assertThat(response, Matchers.body(containsString("Sign in")));
@@ -228,12 +232,10 @@ public void loginWithLongRedirectUri() throws Exception {
                 .updateWith(r -> r.setEventsEnabled(true)).update()) {
             String randomLongString = RandomStringUtils.random(2500, true, true);
             String longRedirectUri = oauth.getRedirectUri() + "?longQueryParameterValue=" + randomLongString;
-            UriBuilder longLoginUri = UriBuilder.fromUri(oauth.getLoginFormUrl()).replaceQueryParam(OAuth2Constants.REDIRECT_URI, longRedirectUri);
-
-            DroneUtils.getCurrentDriver().navigate().to(longLoginUri.build().toString());
+            oauth.loginForm().param(OAuth2Constants.REDIRECT_URI, longRedirectUri).open();
 
             loginPage.assertCurrent();
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             events.expectLogin().user(userId).detail(OAuth2Constants.REDIRECT_URI, longRedirectUri).assertEvent();
         }
@@ -249,17 +251,18 @@ public void loginChangeUserAfterInvalidPassword() {
         Assert.assertEquals("login-test2", loginPage.getUsername());
         Assert.assertEquals("", loginPage.getPassword());
 
-        Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
+        Assert.assertEquals("Invalid username or password.", loginPage.getUsernameInputError());
+        Assert.assertNull(loginPage.getPasswordInputError());
 
         events.expectLogin().user(user2Id).session((String) null).error("invalid_user_credentials")
                 .detail(Details.USERNAME, "login-test2")
                 .removeDetail(Details.CONSENT)
                 .assertEvent();
 
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -275,7 +278,8 @@ public void loginInvalidPassword() {
         Assert.assertEquals("login-test", loginPage.getUsername());
         Assert.assertEquals("", loginPage.getPassword());
 
-        Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
+        Assert.assertEquals("Invalid username or password.", loginPage.getUsernameInputError());
+        Assert.assertNull(loginPage.getPasswordInputError());
 
         events.expectLogin().user(userId).session((String) null).error("invalid_user_credentials")
                 .detail(Details.USERNAME, "login-test")
@@ -294,7 +298,8 @@ public void loginMissingPassword() {
         Assert.assertEquals("login-test", loginPage.getUsername());
         Assert.assertEquals("", loginPage.getPassword());
 
-        Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
+        Assert.assertEquals("Invalid username or password.", loginPage.getUsernameInputError());
+        Assert.assertNull(loginPage.getPasswordInputError());
 
         events.expectLogin().user(userId).session((String) null).error("invalid_user_credentials")
                 .detail(Details.USERNAME, "login-test")
@@ -340,7 +345,7 @@ public void loginDisabledUser() {
 
         try {
             loginPage.open();
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             loginPage.assertCurrent();
 
@@ -366,7 +371,7 @@ public void loginDifferentUserAfterDisabledUserThrownOut() {
 
         try {
             loginPage.open();
-            loginPage.login("test-user@localhost", "password");
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
             appPage.assertCurrent();
             appPage.openAccount();
@@ -377,7 +382,7 @@ public void loginDifferentUserAfterDisabledUserThrownOut() {
             loginPage.assertCurrent();
 
             // try to log in as different user
-            loginPage.login("keycloak-user@localhost", "password");
+            loginPage.login("keycloak-user@localhost", getPassword("keycloak-user@localhost"));
 
             appPage.assertCurrent();
         } finally {
@@ -388,7 +393,7 @@ public void loginDifferentUserAfterDisabledUserThrownOut() {
     @Test
     public void loginInvalidUsername() {
         loginPage.open();
-        loginPage.login("invalid", "password");
+        loginPage.login("invalid", "invalid");
 
         loginPage.assertCurrent();
 
@@ -403,10 +408,10 @@ public void loginInvalidUsername() {
                 .removeDetail(Details.CONSENT)
                 .assertEvent();
 
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -429,10 +434,10 @@ public void loginMissingUsername() {
     // KEYCLOAK-2557
     public void loginUserWithEmailAsUsername() {
         loginPage.open();
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login@test.com").assertEvent();
     }
@@ -440,10 +445,10 @@ public void loginUserWithEmailAsUsername() {
     @Test
     public void loginSuccess() {
         loginPage.open();
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -453,10 +458,10 @@ public void loginSuccessRealmSigningAlgorithms() throws JWSInputException {
         ContainerAssume.assumeAuthServerSSL();
 
         loginPage.open();
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
 
@@ -491,10 +496,10 @@ public void loginSuccessRealmSigningAlgorithms() throws JWSInputException {
     @Test
     public void loginWithWhitespaceSuccess() {
         loginPage.open();
-        loginPage.login(" login-test \t ", "password");
+        loginPage.login(" login-test \t ", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -502,10 +507,10 @@ public void loginWithWhitespaceSuccess() {
     @Test
     public void loginWithEmailWhitespaceSuccess() {
         loginPage.open();
-        loginPage.login("    login@test.com    ", "password");
+        loginPage.login("    login@test.com    ", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).assertEvent();
     }
@@ -527,11 +532,12 @@ public void loginWithForcePasswordChangePolicy() {
 
             loginPage.open();
 
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             updatePasswordPage.assertCurrent();
 
-            updatePasswordPage.changePassword("updatedPassword", "updatedPassword");
+            final String newPwd = generatePassword("login-test");
+            updatePasswordPage.changePassword(newPwd, newPwd);
 
             setTimeOffset(0);
 
@@ -546,8 +552,6 @@ public void loginWithForcePasswordChangePolicy() {
 
         } finally {
             setPasswordPolicy(null);
-            UserResource userRsc = adminClient.realm("test").users().get(userId);
-            ApiUtil.resetUserPassword(userRsc, "password", false);
         }
     }
 
@@ -562,10 +566,10 @@ public void loginWithoutForcePasswordChangePolicy() {
 
             loginPage.open();
 
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
             setTimeOffset(0);
 
@@ -581,7 +585,7 @@ public void loginNoTimeoutWithLongWait() {
 
         setTimeOffset(1700);
 
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         setTimeOffset(0);
 
@@ -590,14 +594,13 @@ public void loginNoTimeoutWithLongWait() {
 
     @Test
     public void loginLoginHint() {
-        String loginFormUrl = oauth.getLoginFormUrl() + "&login_hint=login-test";
-        driver.navigate().to(loginFormUrl);
+        oauth.loginForm().param("login_hint", "login-test").open();
 
         Assert.assertEquals("login-test", loginPage.getUsername());
-        loginPage.login("password");
+        loginPage.login(getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
     }
@@ -605,10 +608,10 @@ public void loginLoginHint() {
     @Test
     public void loginWithEmailSuccess() {
         loginPage.open();
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin().user(userId).assertEvent();
     }
@@ -634,10 +637,10 @@ public void loginWithRememberMe() {
             assertFalse(loginPage.isRememberMeChecked());
             loginPage.setRememberMe(true);
             assertTrue(loginPage.isRememberMeChecked());
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
             EventRepresentation loginEvent = events.expectLogin().user(userId)
                                                    .detail(Details.USERNAME, "login-test")
                                                    .detail(Details.REMEMBER_ME, "true")
@@ -672,10 +675,10 @@ public void loginWithRememberMeNotSet() {
 
         assertTrue(loginPage.isRememberMeCheckboxPresent());
         loginPage.setRememberMe(true);
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         EventRepresentation loginEvent = events.expectLogin().user(userId)
                 .detail(Details.USERNAME, "login-test")
                 .assertEvent();
@@ -694,10 +697,10 @@ public void loginAgainWithoutRememberMe() {
             assertFalse(loginPage.isRememberMeChecked());
             loginPage.setRememberMe(true);
             assertTrue(loginPage.isRememberMeChecked());
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
             EventRepresentation loginEvent = events.expectLogin().user(userId)
                                                    .detail(Details.USERNAME, "login-test")
                                                    .detail(Details.REMEMBER_ME, "true")
@@ -714,7 +717,7 @@ public void loginAgainWithoutRememberMe() {
 
             //login without remember me
             loginPage.setRememberMe(false);
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
 
             // Expire session
             loginEvent = events.expectLogin().user(userId)
@@ -741,10 +744,10 @@ public void loginWithEmailUserAndRememberMe() {
             loginPage.open();
             loginPage.setRememberMe(true);
             assertTrue(loginPage.isRememberMeChecked());
-            loginPage.login("login@test.com", "password");
+            loginPage.login("login@test.com", getPassword("login-test"));
 
             Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
             EventRepresentation loginEvent = events.expectLogin().user(userId)
                                                    .detail(Details.USERNAME, "login@test.com")
                                                    .detail(Details.REMEMBER_ME, "true")
@@ -774,7 +777,7 @@ public void loginExpiredCode() {
         // authSession expired and removed from the storage
         setTimeOffset(5000);
 
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
         loginPage.assertCurrent();
 
         Assert.assertEquals("Your login attempt timed out. Login will start from the beginning.", loginPage.getError());
@@ -790,7 +793,7 @@ public void loginExpiredCodeWithExplicitRemoveExpired() {
         loginPage.open();
         setTimeOffset(5000);
 
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
 
         loginPage.assertCurrent();
 
@@ -812,7 +815,7 @@ public void loginAfterExpiredTimeout() throws Exception {
                 .update()) {
 
             loginPage.open();
-            loginPage.login("login@test.com", "password");
+            loginPage.login("login@test.com", getPassword("login-test"));
 
             events.expectLogin().user(userId).assertEvent();
 
@@ -820,7 +823,7 @@ public void loginAfterExpiredTimeout() throws Exception {
             setTimeOffset(6);
 
             loginPage.open();
-            loginPage.login("login@test.com", "password");
+            loginPage.login("login@test.com", getPassword("login-test"));
 
             events.expectLogin().user(userId).assertEvent();
         }
@@ -834,7 +837,7 @@ public void loginExpiredCodeAndExpiredCookies() {
         driver.manage().deleteAllCookies();
 
         // Cookies are expired including KC_RESTART. No way to continue login. Error page must be shown with the "back to application" link
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
         errorPage.assertCurrent();
         String link = errorPage.getBackToApplicationLink();
 
@@ -852,7 +855,7 @@ public void loginWithDisabledCookies() {
 
 
         // Cookie has been deleted or disabled, the error shown in the UI should be Errors.COOKIE_NOT_FOUND
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", getPassword("login-test"));
 
         events.expect(EventType.LOGIN_ERROR)
                 .user(new UserRepresentation())
@@ -874,7 +877,7 @@ public void openLoginFormWithDifferentApplication() throws Exception {
         oauth.openLoginForm();
 
         assertTrue(loginPage.isCurrent());
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -891,7 +894,7 @@ public void openLoginFormAfterExpiredCode() throws Exception {
         loginPage.assertCurrent();
         Assert.assertNull("Not expected to have error on loginForm.", loginPage.getError());
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -907,7 +910,7 @@ public void testAuthenticationSessionExpiresEarlyAfterAuthentication() throws Ex
         String authSessionId = driver.manage().getCookieNamed(CookieType.AUTH_SESSION_ID.getName()).getValue();
         Assert.assertEquals((Integer) 2, getTestingClient().testing().getAuthenticationSessionTabsCount("test", authSessionId));
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         appPage.assertCurrent();
 
         // authentication session should still exists with remaining browser tab
@@ -933,7 +936,7 @@ public void loginRememberMeExpiredIdle() throws Exception {
 
             assertTrue(loginPage.isCurrent());
             loginPage.setRememberMe(true);
-            loginPage.login("test-user@localhost", "password");
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
             // sucessful login - app page should be on display.
             events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -961,7 +964,7 @@ public void loginRememberMeExpiredMaxLifespan() throws Exception {
 
             assertTrue(loginPage.isCurrent());
             loginPage.setRememberMe(true);
-            loginPage.login("test-user@localhost", "password");
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
             // sucessful login - app page should be on display.
             events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
@@ -998,14 +1001,27 @@ public void loginSuccessfulWithDynamicScope() {
         testApp.addOptionalClientScope(scopeId);
 
         oauth.scope("dynamic:scope");
-        oauth.doLogin("login@test.com", "password");
+        oauth.doLogin("login@test.com", getPassword("login-test"));
         events.expectLogin().user(userId).assertEvent();
     }
 
+    @Test
+    public void loginSuccessfulWithoutWebAuthn() {
+        testingClient.disableFeature(Profile.Feature.WEB_AUTHN);
+        try {
+            loginPage.open();
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+            Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            events.expectLogin().assertEvent();
+        } finally {
+            testingClient.enableFeature(Profile.Feature.WEB_AUTHN);
+        }
+    }
+
     @Test
     public void testExecuteActionIfSessionExists() {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
         events.expectLogin().assertEvent();
 
@@ -1017,7 +1033,7 @@ public void testExecuteActionIfSessionExists() {
         try {
             users.get(user.getId()).update(user);
 
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
 
             // make sure the authentication session is no longer available
             for (Cookie cookie : driver.manage().getCookies()) {
@@ -1026,7 +1042,7 @@ public void testExecuteActionIfSessionExists() {
                 }
             }
 
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             configTotpPage.assertCurrent();
         } finally {
             user.setRequiredActions(List.of());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTotpTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTotpTest.java
index 24f8b18820ce..14de8bf2accd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTotpTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/LoginTotpTest.java
@@ -34,8 +34,8 @@
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
@@ -43,7 +43,7 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.GreenMailRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmRepUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 
@@ -64,10 +64,11 @@
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public class LoginTotpTest extends AbstractTestRealmKeycloakTest {
+public class LoginTotpTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         UserRepresentation user = RealmRepUtil.findUser(testRealm, "test-user@localhost");
         UserBuilder.edit(user)
                    .totpSecret("totpSecret")
@@ -101,7 +102,7 @@ public void before() throws MalformedURLException {
     @Test
     public void loginWithTotpFailure() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -120,7 +121,7 @@ public void loginWithTotpFailure() throws Exception {
     @Test
     public void loginWithMissingTotp() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -139,7 +140,7 @@ public void loginWithMissingTotp() throws Exception {
     @Test
     public void loginWithTotpSuccess() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -156,7 +157,7 @@ public void loginWithTotpSuccess() throws Exception {
     @Test
     public void loginWithTotpRefreshTotpPage() throws Exception {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -194,7 +195,7 @@ public void loginWithTotp_testAttemptedUsernameAndResetLogin() throws Exception
         // Assert attempted-username NOT available
         loginPage.assertAttemptedUsernameAvailability(false);
 
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
@@ -221,7 +222,7 @@ public void loginWithTotp_getToken_checkCompatibilityCLI() throws IOException {
             Form form = new Form()
                     .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD)
                     .param(OAuth2Constants.USERNAME, "test-user@localhost")
-                    .param(OAuth2Constants.PASSWORD, "password")
+                    .param(OAuth2Constants.PASSWORD, getPassword("test-user@localhost"))
                     .param(OAuth2Constants.CLIENT_ID, Constants.ADMIN_CLI_CLIENT_ID);
 
             // Compatibility between "otp" and "totp"
@@ -256,7 +257,7 @@ public void testBase32EncodedSecret() throws IOException {
         OTPCredentialData credentialData = JsonSerialization.readValue(otpCredential.getCredentialData(), OTPCredentialData.class);
         OTPCredentialData newCredentialData = new OTPCredentialData(credentialData.getSubType(), credentialData.getDigits(), credentialData.getCounter(), credentialData.getPeriod(), credentialData.getAlgorithm(),
                 SecretEncoding.BASE32.name());
-        UserRepresentation newUser = UserBuilder.create().username("test-otp-user@localhost").password("password").enabled(true).build();
+        UserRepresentation newUser = UserBuilder.create().username("test-otp-user@localhost").password(generatePassword("test-otp-user@localhost")).enabled(true).build();
         CredentialRepresentation credential = new CredentialRepresentation();
 
         credential.setType(otpCredential.getType());
@@ -273,7 +274,7 @@ public void testBase32EncodedSecret() throws IOException {
         testRealm().users().create(newUser).close();
 
         loginPage.open();
-        loginPage.login(newUser.getUsername(), "password");
+        loginPage.login(newUser.getUsername(), getPassword("test-otp-user@localhost"));
 
         Assert.assertTrue(loginTotpPage.isCurrent());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultiFactorAuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultiFactorAuthenticationTest.java
index d075153d0329..72f57fc75d03 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultiFactorAuthenticationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultiFactorAuthenticationTest.java
@@ -19,7 +19,6 @@
 package org.keycloak.testsuite.forms;
 
 import java.util.Arrays;
-import java.util.List;
 
 import org.jboss.arquillian.drone.api.annotation.Drone;
 import org.jboss.arquillian.graphene.page.Page;
@@ -37,9 +36,8 @@
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.client.KeycloakTestingClient;
 import org.keycloak.testsuite.pages.ErrorPage;
@@ -49,18 +47,16 @@
 import org.keycloak.testsuite.pages.PasswordPage;
 import org.keycloak.testsuite.pages.SelectAuthenticatorPage;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 
-import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
-
 /**
  * Test various scenarios for multi-factor login. Test that "Try another way" link works as expected
  * and users are able to choose between various alternative authenticators for the particular factor (1st factor, 2nd factor)
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class MultiFactorAuthenticationTest extends AbstractTestRealmKeycloakTest {
+public class MultiFactorAuthenticationTest extends AbstractChangeImportedUserPasswordsTest {
 
     @ArquillianResource
     protected OAuthClient oauth;
@@ -89,23 +85,6 @@ public class MultiFactorAuthenticationTest extends AbstractTestRealmKeycloakTest
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
-    private RealmRepresentation loadTestRealm() {
-        RealmRepresentation res = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
-        res.setBrowserFlow("browser");
-        return res;
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        log.debug("Adding test realm for import from testrealm.json");
-        testRealms.add(loadTestRealm());
-    }
-
-
     // In a sub-flow with alternative credential executors, check which credentials are available and in which order
     // This also tests "try another way" link
     @Test
@@ -254,7 +233,7 @@ public void testAlternativeMechanismsInDifferentSubflows() {
 
             selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.PASSWORD);
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword("user-with-one-configured-otp"));
 
             Assert.assertFalse(passwordPage.isCurrent());
             Assert.assertFalse(loginPage.isCurrent());
@@ -297,7 +276,7 @@ public void testAlternativeMechanismsInDifferentSubflows_firstMechanismUnavailab
             passwordPage.assertTryAnotherWayLinkAvailability(false);
 
             // Login with password. Should be on the OTP page without try-another-way link available
-            passwordPage.login("password");
+            passwordPage.login(getPassword("user-with-one-configured-otp"));
             loginTotpPage.assertCurrent();
             loginTotpPage.assertTryAnotherWayLinkAvailability(false);
 
@@ -359,7 +338,7 @@ public void testUsernameLabelAndResetLogin() {
             Assert.assertEquals("otp1@redhat.com", passwordPage.getAttemptedUsername());
 
             // Login
-            passwordPage.login("password");
+            passwordPage.login(getPassword("user-with-one-configured-otp"));
             events.expectLogin().user(user.getId())
                     .detail(Details.USERNAME, "otp1@redhat.com").assertEvent();
         } finally {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultipleTabsLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultipleTabsLoginTest.java
index ab103226c89f..4b1b6dad1c29 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultipleTabsLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/MultipleTabsLoginTest.java
@@ -23,17 +23,18 @@
 import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
 import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlStartsWith;
 
+import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.List;
 
+import jakarta.ws.rs.core.UriBuilder;
 import org.hamcrest.MatcherAssert;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.events.Details;
@@ -42,14 +43,14 @@
 import org.keycloak.models.Constants;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.ClientData;
 import org.keycloak.protocol.RestartLoginCookie;
 import org.keycloak.protocol.oidc.utils.OIDCResponseMode;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.ActionURIUtils;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
@@ -70,7 +71,8 @@
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.htmlunit.HtmlUnitDriver;
@@ -80,14 +82,10 @@
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class MultipleTabsLoginTest extends AbstractTestRealmKeycloakTest {
+public class MultipleTabsLoginTest extends AbstractChangeImportedUserPasswordsTest {
 
     private String userId;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Override
     protected boolean modifyRealmForSSL() {
         return true;
@@ -103,7 +101,7 @@ public void setup() {
                 .requiredAction(UserModel.RequiredAction.UPDATE_PASSWORD.toString())
                 .build();
 
-        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password", true);
+        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, generatePassword("login-test"), true);
         getCleanup().addUserId(userId);
 
         oauth.clientId("test-app");
@@ -159,11 +157,11 @@ public void multipleTabsParallelLoginTest() {
             oauth.openLoginForm();
             loginPage.assertCurrent();
 
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             updatePasswordPage.assertCurrent();
 
             // Simulate login in different browser tab tab2. I will be on loginPage again.
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
 
             oauth.openLoginForm();
@@ -188,7 +186,7 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle() {
         try (BrowserTabUtil tabUtil = BrowserTabUtil.getInstanceAndSetEnv(driver)) {
             multipleTabsParallelLogin(tabUtil);
 
-            waitForAppPage(() -> loginPage.login("login-test", "password"));
+            waitForAppPage(() -> loginPage.login("login-test", getPassword("login-test")));
             assertOnAppPageWithAlreadyLoggedInError(EventType.LOGIN);
         }
     }
@@ -210,7 +208,7 @@ public void testWithAuthSessionExpiredInTheMiddle_badRedirectUri() throws Except
         // Wait until authentication session expires
         setTimeOffset(7200000);
 
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         loginPage.assertCurrent();
         Assert.assertEquals(loginPage.getError(), "Your login attempt timed out. Login will start from the beginning.");
         events.clear();
@@ -247,7 +245,7 @@ private void multipleTabsParallelLogin(BrowserTabUtil tabUtil) {
         loginPage.assertCurrent();
         getLogger().info("URL in tab1: " + driver.getCurrentUrl());
         // Open new tab 2
-        tabUtil.newTab(oauth.getLoginFormUrl());
+        tabUtil.newTab(oauth.loginForm().build());
         assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
         loginPage.assertCurrent();
         getLogger().info("URL in tab2: " + driver.getCurrentUrl());
@@ -258,7 +256,7 @@ private void multipleTabsParallelLogin(BrowserTabUtil tabUtil) {
         WaitUtils.pause(2000);
 
         // Try to login in tab2. After fill login form, the login will be restarted (due KC_RESTART cookie). User can continue login
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         loginPage.assertCurrent();
         Assert.assertEquals(loginPage.getError(), "Your login attempt timed out. Login will start from the beginning.");
         events.clear();
@@ -270,8 +268,8 @@ private void multipleTabsParallelLogin(BrowserTabUtil tabUtil) {
     }
 
     private void loginSuccessAndDoRequiredActions() {
-        loginPage.login("login-test", "password");
-        updatePasswordPage.changePassword("password", "password");
+        loginPage.login("login-test", getPassword("login-test"));
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.prepareUpdate().firstName("John").lastName("Doe3")
                 .email("john@doe3.com").submit();
         appPage.assertCurrent();
@@ -293,7 +291,7 @@ private void assertOnAppPageWithAlreadyLoggedInError(EventType expectedEventType
                 .detail(Details.RESPONSE_MODE, OIDCResponseMode.QUERY.value())
                 .assertEvent(true);
         appPage.assertCurrent(); // Page "You are already logged in." should not be here
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         Assert.assertEquals(OAuthErrorException.TEMPORARILY_UNAVAILABLE, authzResponse.getError());
         Assert.assertEquals(Constants.AUTHENTICATION_EXPIRED_MESSAGE, authzResponse.getErrorDescription());
     }
@@ -325,12 +323,12 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction
             assertThat(tabUtil.getCountOfTabs(), Matchers.is(1));
             oauth.openLoginForm();
             loginPage.assertCurrent();
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             updatePasswordPage.assertCurrent();
             getLogger().info("URL in tab1: " + driver.getCurrentUrl());
 
             // Open new tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             loginPage.assertCurrent();
             getLogger().info("URL in tab2: " + driver.getCurrentUrl());
@@ -342,7 +340,7 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction
             WaitUtils.pause(2000);
 
             // Try to login in tab2. After fill login form, the login will be restarted (due KC_RESTART cookie). User can continue login
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             loginPage.assertCurrent();
             Assert.assertEquals(loginPage.getError(), "Your login attempt timed out. Login will start from the beginning.");
 
@@ -352,7 +350,7 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction
             tabUtil.closeTab(1);
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(1));
 
-            waitForAppPage(() -> updatePasswordPage.changePassword("password", "password"));
+            waitForAppPage(() -> updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test")));
             assertOnAppPageWithAlreadyLoggedInError(EventType.CUSTOM_REQUIRED_ACTION);
         }
     }
@@ -369,7 +367,7 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1(
             getLogger().info("URL in tab1: " + driver.getCurrentUrl());
 
             // Open new tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
             loginPage.assertCurrent();
             getLogger().info("URL in tab2: " + driver.getCurrentUrl());
@@ -381,7 +379,7 @@ public void multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1(
             WaitUtils.pause(2000);
 
             // Try to login in tab2. After fill login form, the login will be restarted (due KC_RESTART cookie). User can continue login
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             loginPage.assertCurrent();
             Assert.assertEquals(loginPage.getError(), "Your login attempt timed out. Login will start from the beginning.");
 
@@ -406,21 +404,21 @@ public void testLoginAfterLogoutFromDifferentTab() {
             oauth.openLoginForm();
             String tab1WindowHandle = util.getActualWindowHandle();
             loginSuccessAndDoRequiredActions();
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             AccessToken accessToken = oauth.verifyToken(tokenResponse.getAccessToken());
 
             // seamless login in the second tab, user already authenticated
-            util.newTab(oauth.getLoginFormUrl());
+            util.newTab(oauth.loginForm().build());
             oauth.openLoginForm();
             appPage.assertCurrent();
             events.clear();
             // logout in the second tab
-            oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
             events.expectLogout(accessToken.getSessionState()).user(userId).session(accessToken.getSessionState()).assertEvent();
             // re-login in the second tab
             oauth.openLoginForm();
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             appPage.assertCurrent();
 
             // seamless authentication in the first tab
@@ -438,13 +436,13 @@ public void multipleTabsLoginAndPassiveCheck() throws MalformedURLException {
             String originalTab = util.getActualWindowHandle();
 
             // open a new tab performing the passive check
-            String passiveCheckUrl = oauth.responseType("none").prompt("none").getLoginFormUrl();
+            String passiveCheckUrl = oauth.responseType("none").loginForm().prompt("none").build();
             util.newTab(passiveCheckUrl);
             MatcherAssert.assertThat(new URL(oauth.getDriver().getCurrentUrl()).getQuery(), Matchers.containsString("error=login_required"));
 
             // continue with the login in the first tab
             util.switchToTab(originalTab);
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             updatePasswordPage.assertCurrent();
         }
     }
@@ -507,7 +505,7 @@ public void expiredAuthenticationAction_expiredCodeExpiredExecution() {
         String actionUrl1 = ActionURIUtils.getActionURIFromPageSource(driver.getPageSource());
 
         // Authenticate in tab2
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Simulate going back to tab1 and confirm login form. Page "Page expired" should be shown (NOTE: WebDriver does it with GET, when real browser would do it with POST. Improve test if needed...)
@@ -518,7 +516,7 @@ public void expiredAuthenticationAction_expiredCodeExpiredExecution() {
         loginExpiredPage.clickLoginContinueLink();
         updatePasswordPage.assertCurrent();
 
-        updatePasswordPage.changePassword("password", "password");
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.prepareUpdate().firstName("John").lastName("Doe3")
                 .email("john@doe3.com").submit();
         appPage.assertCurrent();
@@ -545,7 +543,7 @@ public void loginActionWithoutExecutionInRequiredActions() throws Exception {
         oauth.openLoginForm();
         loginPage.assertCurrent();
 
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
         updatePasswordPage.assertCurrent();
 
         // Manually remove execution from the URL and try to simulate the request just with "code" parameter
@@ -557,7 +555,7 @@ public void loginActionWithoutExecutionInRequiredActions() throws Exception {
         // Back on updatePasswordPage now
         updatePasswordPage.assertCurrent();
 
-        updatePasswordPage.changePassword("password", "password");
+        updatePasswordPage.changePassword(getPassword("login-test"), getPassword("login-test"));
         updateProfilePage.prepareUpdate().firstName("John").lastName("Doe3")
                 .email("john@doe3.com").submit();
         appPage.assertCurrent();
@@ -597,17 +595,15 @@ public void loginWithSameClientDifferentStatesLoginInTab1() throws Exception {
         String redirectUri1 = String.format("%s/auth/realms/master/app/auth/suffix1", getAuthServerContextRoot());
         String redirectUri2 = String.format("%s/auth/realms/master/app/auth/suffix2", getAuthServerContextRoot());
         // Open tab1 and start login here
-        oauth.stateParamHardcoded("state1");
         oauth.redirectUri(redirectUri1);
-        oauth.openLoginForm();
+        oauth.loginForm().state("state1").open();
         loginPage.assertCurrent();
         loginPage.login("login-test", "bad-password");
         String tab1Url = driver.getCurrentUrl();
 
         // Go to tab2 and start login with different client "root-url-client"
-        oauth.stateParamHardcoded("state2");
         oauth.redirectUri(redirectUri2);
-        oauth.openLoginForm();
+        oauth.loginForm().state("state2").open();
         loginPage.assertCurrent();
         String tab2Url = driver.getCurrentUrl();
 
@@ -629,17 +625,15 @@ public void loginWithSameClientDifferentStatesLoginInTab2() throws Exception {
         String redirectUri1 = String.format("%s/auth/realms/master/app/auth/suffix1", getAuthServerContextRoot());
         String redirectUri2 = String.format("%s/auth/realms/master/app/auth/suffix2", getAuthServerContextRoot());
         // Open tab1 and start login here
-        oauth.stateParamHardcoded("state1");
         oauth.redirectUri(redirectUri1);
-        oauth.openLoginForm();
+        oauth.loginForm().state("state1").open();
         loginPage.assertCurrent();
         loginPage.login("login-test", "bad-password");
         String tab1Url = driver.getCurrentUrl();
 
         // Go to tab2 and start login with different client "root-url-client"
-        oauth.stateParamHardcoded("state2");
         oauth.redirectUri(redirectUri2);
-        oauth.openLoginForm();
+        oauth.loginForm().state("state2").open();
         loginPage.assertCurrent();
         String tab2Url = driver.getCurrentUrl();
 
@@ -675,13 +669,13 @@ public void testEmptyBaseUrl() throws Exception {
             oauth.openLoginForm();
             loginPage.assertCurrent();
 
-            loginPage.login("login-test", "password");
+            loginPage.login("login-test", getPassword("login-test"));
             updatePasswordPage.assertCurrent();
 
             String tab1Url = driver.getCurrentUrl();
 
             // Simulate login in different browser tab tab2. I will be on loginPage again.
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
 
             loginPage.assertCurrent();
@@ -711,7 +705,7 @@ public void testLoginPageRefresh() {
            driver.manage().deleteCookieNamed("AUTH_SESSION_ID");
 
            // Open new tab 2
-           tabUtil.newTab(oauth.getLoginFormUrl());
+           tabUtil.newTab(oauth.loginForm().build());
            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
            loginPage.assertCurrent();
            getLogger().info("URL in tab2: " + driver.getCurrentUrl());
@@ -732,10 +726,160 @@ public void testLoginPageRefresh() {
 
            tabUtil.switchToTab(1);
 
-           waitForAppPage(() -> loginPage.login("login-test", "password"));
+           waitForAppPage(() -> loginPage.login("login-test", getPassword("login-test")));
        }
     }
 
+    @Test
+    public void testRedirectToCorrectUrlAfterAuthSessionExpiration() {
+
+        try (BrowserTabUtil tabUtil = BrowserTabUtil.getInstanceAndSetEnv(driver)) {
+
+            String redirectUri1 = String.format("%s/auth/realms/master/app/auth/suffix1", getAuthServerContextRoot());
+            String redirectUri2 = String.format("%s/auth/realms/master/app/auth/suffix2", getAuthServerContextRoot());
+
+            //open tab 1 with redirect uri 1
+            assertThat(tabUtil.getCountOfTabs(), Matchers.is(1));
+            oauth.redirectUri(redirectUri1);
+            oauth.openLoginForm();
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab1: " + driver.getCurrentUrl());
+
+            //open tab 2 with redirect uri 2
+            oauth.redirectUri(redirectUri2);
+            tabUtil.newTab(oauth.loginForm().build());
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab2: " + driver.getCurrentUrl());
+
+            // Wait until authentication session expires
+            setTimeOffset(7200000);
+
+            //triggers the postponed function in authChecker.js to check if the auth session cookie has changed
+            WaitUtils.pause(2000);
+
+            // Go back to tab1
+            tabUtil.closeTab(1);
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(1));
+
+            getLogger().info("URL in tab1 after close: " + driver.getCurrentUrl());
+
+            // Try to login in tab2. After fill login form, the login will be restarted (due KC_RESTART cookie). User can continue login
+            loginPage.login("login-test", getPassword("login-test"));
+            loginPage.assertCurrent();
+            Assert.assertEquals("Your login attempt timed out. Login will start from the beginning.", loginPage.getError());
+            events.clear();
+            loginSuccessAndDoRequiredActions();
+
+            getLogger().info("URL in after: " + driver.getCurrentUrl());
+
+            //redirected url should be the redirect uri 1
+            Assert.assertTrue(driver.getCurrentUrl().startsWith(redirectUri1));
+        }
+    }
+
+    @Test
+    public void testRestartFailureWithDifferentClientAfterAuthSessionExpiration() {
+
+        try (BrowserTabUtil tabUtil = BrowserTabUtil.getInstanceAndSetEnv(driver)) {
+
+            String redirectUri1 = String.format("%s/auth/realms/master/app/auth/suffix1", getAuthServerContextRoot());
+            String redirectUri2 = String.format("%s/foo/bar/baz", getAuthServerContextRoot());
+
+            //open tab 1 with redirect uri 1
+            assertThat(tabUtil.getCountOfTabs(), Matchers.is(1));
+            oauth.redirectUri(redirectUri1);
+            oauth.openLoginForm();
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab1: " + driver.getCurrentUrl());
+
+            //open tab 2 with redirect uri 2 and different client
+            oauth.client("root-url-client");
+            oauth.redirectUri(redirectUri2);
+            tabUtil.newTab(oauth.loginForm().build());
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab2: " + driver.getCurrentUrl());
+            // Wait until authentication session expires
+            setTimeOffset(7200000);
+
+            //triggers the postponed function in authChecker.js to check if the auth session cookie has changed
+            WaitUtils.pause(2000);
+
+            // Go back to tab1
+            tabUtil.closeTab(1);
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(1));
+
+            // Try to login in tab1.
+            loginPage.login("login-test", getPassword("login-test"));
+
+            //assert cookie not found
+            events.expect(EventType.LOGIN_ERROR)
+                    .user(new UserRepresentation())
+                    .error(Errors.COOKIE_NOT_FOUND)
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void testInjectRedirectUriInClientDataAfterAuthSessionExpiration() throws IOException {
+
+        try (BrowserTabUtil tabUtil = BrowserTabUtil.getInstanceAndSetEnv(driver)) {
+
+            String redirectUri1 = String.format("%s/auth/realms/master/app/auth/suffix1", getAuthServerContextRoot());
+            String redirectUri2 = String.format("%s/auth/realms/master/app/auth/suffix2", getAuthServerContextRoot());
+            String redirectUriInject = String.format("%s/auth/realms/master/app/authFake/suffix1", getAuthServerContextRoot());
+
+            //open tab 1 with redirect uri 1
+            assertThat(tabUtil.getCountOfTabs(), Matchers.is(1));
+            oauth.redirectUri(redirectUri1);
+            oauth.openLoginForm();
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab1: " + driver.getCurrentUrl());
+
+            //login with wrong credentials to move to authenticate page with clientData param
+            loginPage.login("wrong", "wrong");
+
+            //open tab 2
+            oauth.redirectUri(redirectUri2);
+            tabUtil.newTab(oauth.loginForm().build());
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
+            loginPage.assertCurrent();
+            getLogger().info("URL in tab2: " + driver.getCurrentUrl());
+
+            // Wait until authentication session expires
+            setTimeOffset(7200000);
+
+            //triggers the postponed function in authChecker.js to check if the auth session cookie has changed
+            WaitUtils.pause(2000);
+
+            // Go back to tab1
+            tabUtil.closeTab(1);
+            assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(1));
+
+            //replace clientData param injecting a different redirect uri
+            String currentClientDataString = ActionURIUtils.parseQueryParamsFromActionURI(oauth.getDriver().getCurrentUrl()).get(CLIENT_DATA);
+            ClientData clientData = ClientData.decodeClientDataFromParameter(currentClientDataString);
+            clientData.setRedirectUri(redirectUriInject);
+
+            String injectedUrl = UriBuilder.fromUri(oauth.getDriver().getCurrentUrl())
+                    .replaceQueryParam(CLIENT_DATA, clientData.encode())
+                    .build().toString();
+
+            oauth.getDriver().navigate().to(injectedUrl);
+
+            loginPage.assertCurrent();
+            Assert.assertEquals("Your login attempt timed out. Login will start from the beginning.", loginPage.getError());
+            events.clear();
+
+            loginPage.assertCurrent();
+            loginSuccessAndDoRequiredActions();
+
+            //injected redirected url should be ignored
+            Assert.assertTrue(driver.getCurrentUrl().startsWith(redirectUri2));
+        }
+    }
+
     private void waitForAppPage(Runnable htmlUnitAction) {
         if (driver instanceof HtmlUnitDriver) {
             // authChecker.js javascript does not work with HtmlUnitDriver. So need to "refresh" the current browser tab by running the last action in order to simulate "already_logged_in"
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java
index 7c2b0b62aad4..3cf7de877112 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/PasswordHashingTest.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.testsuite.forms;
 
+import jakarta.persistence.EntityManager;
 import jakarta.ws.rs.BadRequestException;
 import org.bouncycastle.crypto.generators.Argon2BytesGenerator;
 import org.jboss.arquillian.graphene.page.Page;
@@ -24,6 +25,7 @@
 import org.junit.Test;
 import org.keycloak.common.crypto.FipsMode;
 import org.keycloak.common.util.Base64;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.hash.PasswordHashProvider;
 import org.keycloak.credential.hash.PasswordHashProviderFactory;
@@ -32,12 +34,14 @@
 import org.keycloak.credential.hash.Pbkdf2Sha256PasswordHashProviderFactory;
 import org.keycloak.credential.hash.Pbkdf2Sha512PasswordHashProviderFactory;
 import org.keycloak.crypto.hash.Argon2Parameters;
-import org.keycloak.crypto.hash.Argon2PasswordHashProvider;
 import org.keycloak.crypto.hash.Argon2PasswordHashProviderFactory;
+import org.keycloak.exportimport.util.ExportUtils;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.cache.UserCache;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.models.credential.dto.PasswordCredentialData;
+import org.keycloak.models.jpa.entities.CredentialEntity;
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -53,6 +57,7 @@
 
 import javax.crypto.SecretKeyFactory;
 import javax.crypto.spec.PBEKeySpec;
+import java.nio.charset.StandardCharsets;
 import java.security.spec.KeySpec;
 import java.time.Duration;
 import java.util.List;
@@ -98,23 +103,59 @@ public void testPasswordRehashedOnAlgorithmChanged() throws Exception {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha256PasswordHashProviderFactory.ID + ") and hashIterations(1)");
 
         String username = "testPasswordRehashedOnAlgorithmChanged";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
         assertEquals(Pbkdf2Sha256PasswordHashProviderFactory.ID, credential.getPasswordCredentialData().getAlgorithm());
 
-        assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", 1);
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", 1);
 
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2PasswordHashProviderFactory.ID + ") and hashIterations(1)");
 
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
+        appPage.assertCurrent();
+
+        credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
+
+        assertEquals(Pbkdf2PasswordHashProviderFactory.ID, credential.getPasswordCredentialData().getAlgorithm());
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", 1);
+    }
+
+    @Test
+    public void testPasswordRehashedOnAlgorithmChangedWithMigratedSalt() throws Exception {
+        setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha256PasswordHashProviderFactory.ID + ") and hashIterations(1)");
+
+        String username = "testPasswordRehashedOnAlgorithmChangedWithMigratedSalt";
+        final String password = createUser(username);
+
+        PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
+
+        assertEquals(Pbkdf2Sha256PasswordHashProviderFactory.ID, credential.getPasswordCredentialData().getAlgorithm());
+
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", 1);
+
+        setPasswordPolicy("hashAlgorithm(" + Pbkdf2PasswordHashProviderFactory.ID + ") and hashIterations(1)");
+
+        String credentialId = credential.getId();
+        testingClient.server().run(session -> {
+            EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+            CredentialEntity credentialEntity = em.find(CredentialEntity.class, credentialId);
+            // adding a dummy value to the salt column to trigger migration in JpaUserCredentialStore#toModel on next fetch of the credential
+            credentialEntity.setSalt("dummy".getBytes(StandardCharsets.UTF_8));
+            // Clearing the user cache as we updated the database directly
+            session.getProvider(UserCache.class).clear();
+        });
+
+        loginPage.open();
+        loginPage.login(username, password);
+        appPage.assertCurrent();
 
         credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
         assertEquals(Pbkdf2PasswordHashProviderFactory.ID, credential.getPasswordCredentialData().getAlgorithm());
-        assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", 1);
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", 1);
     }
 
     @Test
@@ -122,7 +163,7 @@ public void testPasswordRehashedToDefaultProviderIfHashAlgorithmRemoved() {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha256PasswordHashProviderFactory.ID + ")");
 
         String username = "testPasswordRehashedToDefaultProviderIfHashAlgorithmRemoved";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
@@ -131,7 +172,8 @@ public void testPasswordRehashedToDefaultProviderIfHashAlgorithmRemoved() {
         setPasswordPolicy("");
 
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
+        appPage.assertCurrent();
 
         credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
@@ -143,7 +185,7 @@ public void testPasswordRehashedOnIterationsChanged() throws Exception {
         setPasswordPolicy("hashIterations(1)");
 
         String username = "testPasswordRehashedOnIterationsChanged";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
@@ -152,16 +194,17 @@ public void testPasswordRehashedOnIterationsChanged() throws Exception {
         setPasswordPolicy("hashIterations(2)");
 
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
+        appPage.assertCurrent();
 
         credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
         assertEquals(2, credential.getPasswordCredentialData().getHashIterations());
 
         if (notFips()) {
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "Argon2id", 2);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "Argon2id", 2);
         } else {
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", 2);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", 2);
         }
     }
 
@@ -171,7 +214,7 @@ public void testPasswordNotRehasedUnchangedIterations() {
         setPasswordPolicy("");
 
         String username = "testPasswordNotRehasedUnchangedIterations";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
         String credentialId = credential.getId();
@@ -180,7 +223,8 @@ public void testPasswordNotRehasedUnchangedIterations() {
         setPasswordPolicy("hashIterations");
 
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
+        appPage.assertCurrent();
 
         credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
@@ -192,7 +236,8 @@ public void testPasswordNotRehasedUnchangedIterations() {
         AccountHelper.logout(adminClient.realm("test"), username);
 
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
+        appPage.assertCurrent();
 
         credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
@@ -205,25 +250,28 @@ public void testPasswordRehashedWhenCredentialImportedWithDifferentKeySize() {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha512PasswordHashProviderFactory.ID + ") and hashIterations(" + Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS + ")");
 
         String username = "testPasswordRehashedWhenCredentialImportedWithDifferentKeySize";
-        String password = "password";
+        String password = generatePassword();
 
-        // Encode with a specific key size ( 256 instead of default: 512)
+        // Encode with a specific key size (256 instead of default: 512)
         Pbkdf2PasswordHashProvider specificKeySizeHashProvider = new Pbkdf2PasswordHashProvider(Pbkdf2Sha512PasswordHashProviderFactory.ID,
                 Pbkdf2Sha512PasswordHashProviderFactory.PBKDF2_ALGORITHM,
                 Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS,
                 0,
                 256);
-        String encodedPassword = specificKeySizeHashProvider.encodedCredential(password, -1).getPasswordSecretData().getValue();
+        PasswordCredentialModel passwordCredentialModel = specificKeySizeHashProvider.encodedCredential(password, -1);
 
         // Create a user with the encoded password, simulating a user import from a different system using a specific key size
-        UserRepresentation user = UserBuilder.create().username(username).password(encodedPassword).build();
+        UserRepresentation user = UserBuilder.create().username(username).build();
+        user.setCredentials(List.of(ExportUtils.exportCredential(passwordCredentialModel)));
         ApiUtil.createUserWithAdminClient(adminClient.realm("test"), user);
 
         loginPage.open();
         loginPage.login(username, password);
+        appPage.assertCurrent();
 
         PasswordCredentialModel postLoginCredentials = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
-        assertEquals(encodedPassword.length() * 2, postLoginCredentials.getPasswordSecretData().getValue().length());
+        // Check that the password was rehashed and the secret string is now twice the size as before
+        assertEquals(passwordCredentialModel.getPasswordSecretData().getValue().length() * 2, postLoginCredentials.getPasswordSecretData().getValue().length());
 
     }
 
@@ -231,10 +279,10 @@ public void testPasswordRehashedWhenCredentialImportedWithDifferentKeySize() {
     public void testPbkdf2Sha1() throws Exception {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2PasswordHashProviderFactory.ID + ")");
         String username = "testPbkdf2Sha1";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
-        assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", Pbkdf2PasswordHashProviderFactory.DEFAULT_ITERATIONS);
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA1", Pbkdf2PasswordHashProviderFactory.DEFAULT_ITERATIONS);
     }
 
     @Test
@@ -243,7 +291,7 @@ public void testArgon2() {
 
         setPasswordPolicy("hashAlgorithm(" + Argon2PasswordHashProviderFactory.ID + ")");
         String username = "testArgon2";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
         PasswordCredentialData data = credential.getPasswordCredentialData();
@@ -261,7 +309,7 @@ public void testArgon2() {
         loginPage.assertCurrent();
         Assert.assertEquals("Invalid username or password.", loginPage.getInputError());
 
-        loginPage.login("testArgon2", "password");
+        loginPage.login("testArgon2", password);
 
         appPage.assertCurrent();
     }
@@ -274,13 +322,13 @@ private static boolean notFips() {
     public void testDefault() throws Exception {
         setPasswordPolicy("");
         String username = "testDefault";
-        createUser(username);
+        final String password = createUser(username);
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
 
         if (notFips()) {
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "Argon2id", Argon2Parameters.DEFAULT_ITERATIONS);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "Argon2id", Argon2Parameters.DEFAULT_ITERATIONS);
         } else {
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
         }
     }
 
@@ -288,20 +336,20 @@ public void testDefault() throws Exception {
     public void testPbkdf2Sha256() throws Exception {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha256PasswordHashProviderFactory.ID + ")");
         String username = "testPbkdf2Sha256";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
-        assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
     }
 
     @Test
     public void testPbkdf2Sha512() throws Exception {
         setPasswordPolicy("hashAlgorithm(" + Pbkdf2Sha512PasswordHashProviderFactory.ID + ")");
         String username = "testPbkdf2Sha512";
-        createUser(username);
+        final String password = createUser(username);
 
         PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username));
-        assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
+        assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA512", Pbkdf2Sha512PasswordHashProviderFactory.DEFAULT_ITERATIONS);
     }
 
     @Test
@@ -312,10 +360,10 @@ public void testPbkdf2Sha256WithPadding() throws Exception {
         try {
             // Assert password created with padding enabled can be verified
             String username1 = "test1-Pbkdf2Sha2562";
-            createUser(username1);
+            final String password = createUser(username1);
 
             PasswordCredentialModel credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username1));
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS);
 
             // Now configure padding to bigger than 64. The verification without padding would fail as for longer padding than 64 characters, the hashes of the padded password and unpadded password would be different
             configurePaddingForKeycloak(65);
@@ -323,7 +371,7 @@ public void testPbkdf2Sha256WithPadding() throws Exception {
             createUser(username2);
 
             credential = PasswordCredentialModel.createFromCredentialModel(fetchCredentials(username2));
-            assertEncoded(credential, "password", credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS, false);
+            assertEncoded(credential, password, credential.getPasswordSecretData().getSalt(), "PBKDF2WithHmacSHA256", Pbkdf2Sha256PasswordHashProviderFactory.DEFAULT_ITERATIONS, false);
 
         } finally {
             configurePaddingForKeycloak(originalPaddingLength);
@@ -331,8 +379,10 @@ public void testPbkdf2Sha256WithPadding() throws Exception {
     }
 
 
-    private void createUser(String username) {
-        ApiUtil.createUserAndResetPasswordWithAdminClient(adminClient.realm("test"), UserBuilder.create().username(username).build(), "password");
+    private String createUser(String username) {
+        final String password = generatePassword();
+        ApiUtil.createUserAndResetPasswordWithAdminClient(adminClient.realm("test"), UserBuilder.create().username(username).build(), password);
+        return password;
     }
 
     private void setPasswordPolicy(String policy) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RPInitiatedFrontChannelLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RPInitiatedFrontChannelLogoutTest.java
index fa1f0598849b..98be34d55df6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RPInitiatedFrontChannelLogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RPInitiatedFrontChannelLogoutTest.java
@@ -18,7 +18,6 @@
 
 import org.junit.Assert;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.ClientsResource;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.models.BrowserSecurityHeaders;
@@ -26,22 +25,17 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.LogoutToken;
 import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
 /**
  *
  * @author rmartinc
  */
-public class RPInitiatedFrontChannelLogoutTest extends AbstractTestRealmKeycloakTest {
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        // no-op
-    }
+public class RPInitiatedFrontChannelLogoutTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Test
     public void testFrontChannelLogoutWithPostLogoutRedirectUri() throws Exception {
@@ -51,14 +45,12 @@ public void testFrontChannelLogoutWithPostLogoutRedirectUri() throws Exception {
         rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, OAuthClient.APP_ROOT + "/admin/frontchannelLogout");
         clients.get(rep.getId()).update(rep);
         try {
-            oauth.clientSessionState("client-session");
-            oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String idTokenString = tokenResponse.getIdToken();
-            String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString)
-                    .postLogoutRedirectUri(OAuthClient.APP_AUTH_ROOT).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().idTokenHint(idTokenString)
+                    .postLogoutRedirectUri(OAuthClient.APP_AUTH_ROOT).open();
             LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
             Assert.assertNotNull(logoutToken);
 
@@ -82,14 +74,12 @@ public void testFrontChannelLogoutWithoutSessionRequired() throws Exception {
         rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED, "false");
         clients.get(rep.getId()).update(rep);
         try {
-            oauth.clientSessionState("client-session");
-            oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String idTokenString = tokenResponse.getIdToken();
-            String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString)
-                    .postLogoutRedirectUri(OAuthClient.APP_AUTH_ROOT).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().idTokenHint(idTokenString)
+                    .postLogoutRedirectUri(OAuthClient.APP_AUTH_ROOT).open();
             LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
             Assert.assertNotNull(logoutToken);
 
@@ -112,13 +102,11 @@ public void testFrontChannelLogout() throws Exception {
         rep.getAttributes().put(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, OAuthClient.APP_ROOT + "/admin/frontchannelLogout");
         clients.get(rep.getId()).update(rep);
         try {
-            oauth.clientSessionState("client-session");
-            oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String idTokenString = tokenResponse.getIdToken();
-            String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().idTokenHint(idTokenString).open();
             LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
             org.keycloak.testsuite.Assert.assertNotNull(logoutToken);
             IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
@@ -145,13 +133,11 @@ public void testFrontChannelLogoutCustomCSP() throws Exception {
                 .setFrontchannelLogout(true)
                 .setAttribute(OIDCConfigAttributes.FRONT_CHANNEL_LOGOUT_URI, OAuthClient.APP_ROOT + "/admin/frontchannelLogout")
                 .update()) {
-            oauth.clientSessionState("client-session");
-            oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String idTokenString = tokenResponse.getIdToken();
-            String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().idTokenHint(idTokenString).open();
             LogoutToken logoutToken = testingClient.testApp().getFrontChannelLogoutToken();
             Assert.assertNotNull(logoutToken);
             IDToken idToken = new JWSInput(idTokenString).readJsonContent(IDToken.class);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ReAuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ReAuthenticationTest.java
index c387a00b7237..39b6609dc5dc 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ReAuthenticationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ReAuthenticationTest.java
@@ -28,7 +28,6 @@
 import org.jboss.arquillian.graphene.page.Page;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.browser.PasswordFormFactory;
 import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
@@ -38,7 +37,7 @@
 import org.keycloak.representations.idm.FederatedIdentityRepresentation;
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.auth.page.login.OneTimeCode;
@@ -52,13 +51,13 @@
 import org.keycloak.testsuite.util.BrowserTabUtil;
 import org.keycloak.testsuite.util.FederatedIdentityBuilder;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebDriver;
 
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.GITHUB;
 import static org.keycloak.testsuite.broker.SocialLoginTest.Provider.GOOGLE;
 
@@ -67,7 +66,7 @@
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class ReAuthenticationTest extends AbstractTestRealmKeycloakTest {
+public class ReAuthenticationTest extends AbstractChangeImportedUserPasswordsTest {
 
     @ArquillianResource
     protected OAuthClient oauth;
@@ -98,13 +97,10 @@ public class ReAuthenticationTest extends AbstractTestRealmKeycloakTest {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
-    private RealmRepresentation loadTestRealm() {
-        RealmRepresentation res = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
-        res.setBrowserFlow("browser");
-        res.setRememberMe(true);
+        super.configureTestRealm(testRealm);
 
+        testRealm.setBrowserFlow("browser");
+        testRealm.setRememberMe(true);
         // Add some sample dummy GitHub, Gitlab & Google social providers to the testing realm. Those are dummy providers for test if they are visible (clickable)
         // on the login pages
         List<IdentityProviderRepresentation> idps = new ArrayList<>();
@@ -112,18 +108,9 @@ private RealmRepresentation loadTestRealm() {
             SocialLoginTest socialLoginTest = new SocialLoginTest();
             idps.add(socialLoginTest.buildIdp(provider));
         }
-        res.setIdentityProviders(idps);
-
-        return res;
+        testRealm.setIdentityProviders(idps);
     }
 
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        log.debug("Adding test realm for import from testrealm.json");
-        testRealms.add(loadTestRealm());
-    }
-
-
     @Test
     public void usernamePasswordFormReauthentication() {
         // Add fake github link to user account
@@ -140,15 +127,14 @@ public void usernamePasswordFormReauthentication() {
         loginPage.assertCurrent();
         assertUsernameFieldAndOtherFields(true);
         assertSocialButtonsPresent(true, true);
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // Set time offset
         setTimeOffset(10);
 
         // Request re-authentication
-        oauth.maxAge("1");
-        loginPage.open();
+        oauth.loginForm().maxAge(1).open();
         loginPage.assertCurrent();
 
         // Username input hidden as well as register and rememberMe. Info message should be shown
@@ -165,7 +151,7 @@ public void usernamePasswordFormReauthentication() {
         assertUsernameFieldAndOtherFields(false);
         assertInfoMessageAboutReAuthenticate(false);
 
-        loginPage.login("password");
+        loginPage.login(getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // Remove link
@@ -180,15 +166,14 @@ public void usernamePasswordFormReauthenticationWithResetFlow() {
         loginPage.assertCurrent();
         assertUsernameFieldAndOtherFields(true);
         assertSocialButtonsPresent(true, true);
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // Set time offset
         setTimeOffset(10);
 
         // Request re-authentication
-        oauth.maxAge("1");
-        loginPage.open();
+        oauth.loginForm().maxAge(1).open();
         loginPage.assertCurrent();
 
         // Username input hidden as well as register and rememberMe. Info message should be shown
@@ -211,7 +196,7 @@ public void usernamePasswordFormReauthenticationWithResetFlow() {
         assertSocialButtonsPresent(true, true);
 
         // Successfully login as different user. It should be possible due previous SSO session was removed
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
     }
 
@@ -228,15 +213,14 @@ public void identityFirstFormReauthentication() {
         assertSocialButtonsPresent(true, true);
         loginUsernameOnlyPage.login("test-user@localhost");
         passwordPage.assertCurrent();
-        passwordPage.login("password");
+        passwordPage.login(getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // Set time offset
         setTimeOffset(10);
 
         // Request re-authentication
-        oauth.maxAge("1");
-        loginPage.open();
+        oauth.loginForm().maxAge(1).open();
 
         // User directly on the password page. Info message should be shown here
         passwordPage.assertCurrent();
@@ -245,7 +229,7 @@ public void identityFirstFormReauthentication() {
 
         passwordPage.login("bad-password");
         Assert.assertEquals("Invalid password.", passwordPage.getPasswordError());
-        passwordPage.login("password");
+        passwordPage.login(getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // Revert flows
@@ -272,14 +256,12 @@ public void identityFirstFormReauthenticationWithGithubLink() {
         loginUsernameOnlyPage.assertCurrent();
         loginUsernameOnlyPage.login("test-user@localhost");
         passwordPage.assertCurrent();
-        passwordPage.login("password");
+        passwordPage.login(getPassword("test-user@localhost"));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         // See that user can re-authenticate with the github link present on the page as user has link to github social provider
         setTimeOffset(10);
-        oauth.maxAge("1");
-
-        loginPage.open();
+        oauth.loginForm().maxAge(1).open();
 
         // Username input hidden as well as register and rememberMe. Info message should be present
         loginPage.assertCurrent();
@@ -297,7 +279,7 @@ public void identityFirstFormReauthenticationWithGithubLink() {
 
         // Login with password. Info message should not be there anymore
         passwordPage.assertCurrent();
-        passwordPage.login("password");
+        passwordPage.login(getPassword("test-user@localhost"));
         assertInfoMessageAboutReAuthenticate(false);
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
@@ -309,17 +291,16 @@ public void identityFirstFormReauthenticationWithGithubLink() {
     @Test
     public void restartLoginWithNewRootAuthSession() {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
 
-        oauth.prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN);
-        loginPage.open();
+        oauth.loginForm().prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN).open();
         loginPage.clickResetLogin();
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
+        code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response2 = oauth.doAccessTokenRequest(code);
 
 
         AccessToken accessToken1 = oauth.verifyToken(response1.getAccessToken());
@@ -341,19 +322,19 @@ public void loginAfterExpiredUserSession() {
 
         loginPage.open();
         driver.navigate().refresh();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
 
         //set time offset after user session expiration (10s) but before accessCodeLifespanLogin (1800s) and accessCodeLifespan (60s)
         setTimeOffset(20);
 
         loginPage.open();
-        loginPage.login("john-doh@localhost", "password");
+        loginPage.login("john-doh@localhost", getPassword("john-doh@localhost"));
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
+        code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response2 = oauth.doAccessTokenRequest(code);
 
         AccessToken accessToken1 = oauth.verifyToken(response1.getAccessToken());
         AccessToken accessToken2 = oauth.verifyToken(response2.getAccessToken());
@@ -375,7 +356,7 @@ public void loginAfterLogoutWithDifferentSessionId() {
         oauth.openLoginForm();
         loginPage.assertCurrent();
 
-        tabUtil.newTab(oauth.getLoginFormUrl());
+        tabUtil.newTab(oauth.loginForm().build());
         assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
         oauth.openLoginForm();
 
@@ -385,18 +366,18 @@ public void loginAfterLogoutWithDifferentSessionId() {
         tabUtil.switchToTab(0);
         loginPage.assertCurrent();
 
-        loginPage.login("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
         AccessToken accessToken1 = oauth.verifyToken(response1.getAccessToken());
 
-        oauth.doLogout(response1.getRefreshToken(), "password");
+        oauth.doLogout(response1.getRefreshToken());
 
         oauth.openLoginForm();
         loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response2 = oauth.doAccessTokenRequest(code);
         AccessToken accessToken2 = oauth.verifyToken(response2.getAccessToken());
 
         Assert.assertNotEquals(accessToken1.getId(), accessToken2.getId());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RecoveryAuthnCodesAuthenticatorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RecoveryAuthnCodesAuthenticatorTest.java
index a66908c0a7dd..5e286b3bf6d7 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RecoveryAuthnCodesAuthenticatorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RecoveryAuthnCodesAuthenticatorTest.java
@@ -1,5 +1,8 @@
 package org.keycloak.testsuite.forms;
 
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
 import org.hamcrest.MatcherAssert;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.drone.api.annotation.Drone;
@@ -9,29 +12,38 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runners.MethodSorters;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.AuthenticationFlow;
 import org.keycloak.authentication.authenticators.browser.RecoveryAuthnCodesFormAuthenticatorFactory;
 import org.keycloak.authentication.authenticators.browser.PasswordFormFactory;
 import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
+import org.keycloak.common.util.Time;
 import org.keycloak.credential.CredentialModel;
+import org.keycloak.crypto.JavaAlgorithm;
 import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
 import org.keycloak.events.EventType;
+import org.keycloak.forms.login.freemarker.model.RecoveryAuthnCodesBean;
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel;
+import org.keycloak.models.credential.dto.RecoveryAuthnCodesCredentialData;
 import org.keycloak.models.utils.RecoveryAuthnCodesUtils;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.account.CredentialMetadataRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderSimpleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.representations.idm.UserSessionRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.services.resources.account.AccountCredentialResource;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
 import org.keycloak.testsuite.client.KeycloakTestingClient;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.EnterRecoveryAuthnCodePage;
@@ -41,20 +53,22 @@
 import org.keycloak.testsuite.pages.SelectAuthenticatorPage;
 import org.keycloak.testsuite.pages.SetupRecoveryAuthnCodesPage;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.SecondBrowser;
+import org.keycloak.util.JsonSerialization;
 import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.chrome.ChromeDriver;
-import org.openqa.selenium.firefox.FirefoxDriver;
 
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.assertEquals;
-import static org.keycloak.common.Profile.Feature.RECOVERY_CODES;
+import static org.keycloak.authentication.requiredactions.RecoveryAuthnCodesAction.WARNING_THRESHOLD;
 
 /**
  * Backup Code Authentication test
@@ -62,8 +76,7 @@
  * @author <a href="mailto:vnukala@redhat.com">Venkata Nukala</a>
  */
 @FixMethodOrder(MethodSorters.NAME_ASCENDING)
-@EnableFeature(value = RECOVERY_CODES, skipRestart = true)
-public class RecoveryAuthnCodesAuthenticatorTest extends AbstractTestRealmKeycloakTest {
+public class RecoveryAuthnCodesAuthenticatorTest extends AbstractChangeImportedUserPasswordsTest {
 
     private static final String BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES = "Browser with Recovery Authentication Codes";
 
@@ -75,18 +88,34 @@ public class RecoveryAuthnCodesAuthenticatorTest extends AbstractTestRealmKeyclo
     @Page
     protected LoginUsernameOnlyPage loginUsernameOnlyPage;
 
+    @Page
+    @SecondBrowser
+    protected LoginUsernameOnlyPage loginUsernameOnlyPageSecondBrowser;
+
     @Page
     protected EnterRecoveryAuthnCodePage enterRecoveryAuthnCodePage;
 
+    @Page
+    @SecondBrowser
+    protected EnterRecoveryAuthnCodePage enterRecoveryAuthnCodePageSecondBrowser;
+
     @Page
     protected SetupRecoveryAuthnCodesPage setupRecoveryAuthnCodesPage;
 
     @Page
     protected SelectAuthenticatorPage selectAuthenticatorPage;
 
+    @Page
+    @SecondBrowser
+    protected SelectAuthenticatorPage selectAuthenticatorPageSecondBrowser;
+
     @Page
     protected PasswordPage passwordPage;
 
+    @Page
+    @SecondBrowser
+    protected PasswordPage passwordPageSecondBrowser;
+
     @Page
     protected AppPage appPage;
 
@@ -97,12 +126,7 @@ public class RecoveryAuthnCodesAuthenticatorTest extends AbstractTestRealmKeyclo
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-
-    }
-
-    void configureBrowserFlowWithRecoveryAuthnCodes(KeycloakTestingClient testingClient) {
+    void configureBrowserFlowWithRecoveryAuthnCodes(KeycloakTestingClient testingClient, long delay) {
         final String newFlowAlias = BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES;
         testingClient.server("test").run(session -> FlowUtil.inCurrentRealm(session).copyBrowserFlow(newFlowAlias));
         testingClient.server("test").run(session -> FlowUtil.inCurrentRealm(session)
@@ -115,6 +139,10 @@ void configureBrowserFlowWithRecoveryAuthnCodes(KeycloakTestingClient testingCli
                                 .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.ALTERNATIVE, PasswordFormFactory.PROVIDER_ID)
                                 .addSubFlowExecution("Recovery-Authn-Codes subflow", AuthenticationFlow.BASIC_FLOW, AuthenticationExecutionModel.Requirement.ALTERNATIVE, altSubFlow -> altSubFlow
                                         .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, RecoveryAuthnCodesFormAuthenticatorFactory.PROVIDER_ID)
+                                        .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, "delayed-authenticator", config -> {
+                                            config.setAlias("delayed-suthenticator-config");
+                                            config.setConfig(Map.of("delay", Long.toString(delay)));
+                                        })
                                 )
                         )
                 )
@@ -122,15 +150,14 @@ void configureBrowserFlowWithRecoveryAuthnCodes(KeycloakTestingClient testingCli
         );
 
         ApiUtil.removeUserByUsername(testRealm(), "test-user@localhost");
-        createUser("test", "test-user@localhost", "password", UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
+        createUser("test", "test-user@localhost", generatePassword("test-user@localhost"), UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
     }
 
     private void testSetupRecoveryAuthnCodesLogoutOtherSessions(boolean logoutOtherSessions) {
         // login with the user using the second driver
         UserResource testUser = testRealm().users().get(findUser("test-user@localhost").getId());
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
-        oauth2.doLogin("test-user@localhost", "password");
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
+        oauth2.doLogin("test-user@localhost", getPassword("test-user@localhost"));
         EventRepresentation event1 = events.expectLogin().assertEvent();
         assertEquals(1, testUser.getUserSessions().size());
 
@@ -141,10 +168,10 @@ private void testSetupRecoveryAuthnCodesLogoutOtherSessions(boolean logoutOtherS
 
         // login and configure codes
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
         setupRecoveryAuthnCodesPage.assertCurrent();
-        if (!logoutOtherSessions) {
-            setupRecoveryAuthnCodesPage.uncheckLogoutSessions();
+        if (logoutOtherSessions) {
+            setupRecoveryAuthnCodesPage.checkLogoutSessions();
         }
         Assert.assertEquals(logoutOtherSessions, setupRecoveryAuthnCodesPage.isLogoutSessionsChecked());
         setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
@@ -186,43 +213,192 @@ public void test02SetupRecoveryAuthnCodesLogoutOtherSessionsNotChecked() {
         testSetupRecoveryAuthnCodesLogoutOtherSessions(false);
     }
 
+    @Test
+    public void test03SetupRecoveryAuthnCodesModifyGeneratedAt() {
+        // add the configure recovery codes action
+        UserResource testUser = ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost");
+        UserRepresentation userRepresentation = testUser.toRepresentation();
+        userRepresentation.setRequiredActions(Arrays.asList(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name()));
+        testUser.update(userRepresentation);
+
+        oauth.openLoginForm();
+        loginPage.assertCurrent();
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        setupRecoveryAuthnCodesPage.assertCurrent();
+
+        // modify generatedAt to a fixed value
+        setupRecoveryAuthnCodesPage.setGeneratedAtHidden("10000");
+        setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+
+        // the recovery codes are regerated as they were tampered
+        setupRecoveryAuthnCodesPage.assertCurrent();
+        setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+
+        assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        EventRepresentation event = events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
+                .user(userRepresentation.getId())
+                .detail(Details.USERNAME, "test-user@localhost")
+                .detail(Details.CREDENTIAL_TYPE, RecoveryAuthnCodesCredentialModel.TYPE)
+                .assertEvent();
+        events.expectLogin().user(event.getUserId()).session(event.getDetails().get(Details.CODE_ID))
+                .detail(Details.USERNAME, "test-user@localhost")
+                .assertEvent();
+    }
+
+    @Test
+    public void test04SetupRecoveryAuthnCodesModifyGeneratedCodes() {
+        // add the configure recovery codes action
+        UserResource testUser = ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost");
+        UserRepresentation userRepresentation = testUser.toRepresentation();
+        userRepresentation.setRequiredActions(Arrays.asList(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name()));
+        testUser.update(userRepresentation);
+
+        oauth.openLoginForm();
+        loginPage.assertCurrent();
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
+        setupRecoveryAuthnCodesPage.assertCurrent();
+
+        // modify the codes with a new generated ones
+        setupRecoveryAuthnCodesPage.setGeneratedRecoveryAuthnCodesHidden(new RecoveryAuthnCodesBean().getGeneratedRecoveryAuthnCodesAsString());
+        setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+
+        // the recovery codes are regerated as they were tampered
+        setupRecoveryAuthnCodesPage.assertCurrent();
+        setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+
+        assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        EventRepresentation event = events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
+                .user(userRepresentation.getId())
+                .detail(Details.USERNAME, "test-user@localhost")
+                .detail(Details.CREDENTIAL_TYPE, RecoveryAuthnCodesCredentialModel.TYPE)
+                .assertEvent();
+        events.expectLogin().user(event.getUserId()).session(event.getDetails().get(Details.CODE_ID))
+                .detail(Details.USERNAME, "test-user@localhost")
+                .assertEvent();
+    }
+
+    private void loginUsername(LoginUsernameOnlyPage loginUsernameOnlyPage, WebDriver driver) {
+        loginUsernameOnlyPage.setDriver(driver);
+        oauth.openLoginForm();
+        loginUsernameOnlyPage.assertCurrent();
+        loginUsernameOnlyPage.assertAttemptedUsernameAvailability(false);
+        loginUsernameOnlyPage.login("test-user@localhost");
+    }
+
+    private void tryAnotherWay(PasswordPage passwordPage, WebDriver driver) {
+        passwordPage.setDriver(driver);
+        passwordPage.assertCurrent();
+        passwordPage.assertAttemptedUsernameAvailability(true);
+        // On the password page, username should be shown as we know the user
+        Assert.assertEquals("test-user@localhost", passwordPage.getAttemptedUsername());
+        passwordPage.assertTryAnotherWayLinkAvailability(true);
+        passwordPage.clickTryAnotherWayLink();
+    }
+
+    private void selectRecoveryAuthnCodes(SelectAuthenticatorPage selectAuthenticatorPage, WebDriver driver) {
+        selectAuthenticatorPage.setDriver(driver);
+        selectAuthenticatorPage.assertCurrent();
+        Assert.assertEquals(Arrays.asList(SelectAuthenticatorPage.PASSWORD, SelectAuthenticatorPage.RECOVERY_AUTHN_CODES), selectAuthenticatorPage.getAvailableLoginMethods());
+        selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.RECOVERY_AUTHN_CODES);
+    }
+
+    private void enterRecoveryCodes(EnterRecoveryAuthnCodePage enterRecoveryAuthnCodePage, WebDriver driver,
+            int expectedCode, List<String> generatedRecoveryAuthnCodes) {
+        enterRecoveryAuthnCodePage.setDriver(driver);
+        enterRecoveryAuthnCodePage.assertCurrent();
+        int requestedCode = enterRecoveryAuthnCodePage.getRecoveryAuthnCodeToEnterNumber();
+        Assert.assertEquals("Incorrect code presented to login", expectedCode, requestedCode);
+        enterRecoveryAuthnCodePage.enterRecoveryAuthnCode(generatedRecoveryAuthnCodes.get(requestedCode));
+    }
+
+    private void removeRequiredActionIfPresent() {
+        AuthenticationManagementResource authMgt = testRealm().flows();
+        authMgt.getRequiredActions().stream()
+                .filter(action -> UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name().equals(action.getAlias()))
+                .findAny()
+                .ifPresent(action -> authMgt.removeRequiredAction(action.getAlias()));
+    }
+
+    private List<String> createRecoveryAuthnCodesForUser() {
+        List<String> generatedRecoveryAuthnCodes = RecoveryAuthnCodesUtils.generateRawCodes();
+        testingClient.server().run(session -> {
+            RealmModel realm = session.realms().getRealmByName("test");
+            UserModel user = session.users().getUserByUsername(realm, "test-user@localhost");
+            CredentialModel recoveryAuthnCodesCred = RecoveryAuthnCodesCredentialModel.createFromValues(
+                    generatedRecoveryAuthnCodes,
+                    Time.currentTimeMillis(),
+                    null);
+            user.credentialManager().createStoredCredential(recoveryAuthnCodesCred);
+        });
+        return generatedRecoveryAuthnCodes;
+    }
+
+    private void assertIsContained(AssertEvents.ExpectedEvent expectedEvent, List<? extends EventRepresentation> actualEvents) {
+        for (EventRepresentation e : actualEvents) {
+            try {
+                expectedEvent.assertEvent(e);
+                return;
+            } catch (AssertionError error) {
+                // silently fail because it can be other event in the list
+            }
+        }
+        Assert.fail("No event found in the list for " + expectedEvent);
+    }
+
+
     // In a sub-flow with alternative credential executors, test whether Recovery Authentication Codes are working
     @Test
-    public void test03AuthenticateRecoveryAuthnCodes() {
+    public void test05AuthenticateRecoveryAuthnCodes() {
         try {
-            configureBrowserFlowWithRecoveryAuthnCodes(testingClient);
-            testRealm().flows().removeRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
-            loginUsernameOnlyPage.open();
-            loginUsernameOnlyPage.assertAttemptedUsernameAvailability(false);
-            loginUsernameOnlyPage.login("test-user@localhost");
-            // On the password page, username should be shown as we know the user
-            passwordPage.assertCurrent();
-            passwordPage.assertAttemptedUsernameAvailability(true);
-            Assert.assertEquals("test-user@localhost", passwordPage.getAttemptedUsername());
-            passwordPage.assertTryAnotherWayLinkAvailability(true);
-            List<String> generatedRecoveryAuthnCodes = RecoveryAuthnCodesUtils.generateRawCodes();
-            testingClient.server().run(session -> {
-                RealmModel realm = session.realms().getRealmByName("test");
-                UserModel user = session.users().getUserByUsername(realm, "test-user@localhost");
-                CredentialModel recoveryAuthnCodesCred = RecoveryAuthnCodesCredentialModel.createFromValues(
-                        generatedRecoveryAuthnCodes,
-                        System.currentTimeMillis(),
-                        null);
-                user.credentialManager().createStoredCredential(recoveryAuthnCodesCred);
-            });
-            passwordPage.clickTryAnotherWayLink();
-            selectAuthenticatorPage.assertCurrent();
-            Assert.assertEquals(Arrays.asList(SelectAuthenticatorPage.PASSWORD, SelectAuthenticatorPage.RECOVERY_AUTHN_CODES), selectAuthenticatorPage.getAvailableLoginMethods());
-            selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.RECOVERY_AUTHN_CODES);
-            enterRecoveryAuthnCodePage.assertCurrent();
-            enterRecoveryAuthnCodePage.enterRecoveryAuthnCode(generatedRecoveryAuthnCodes.get(enterRecoveryAuthnCodePage.getRecoveryAuthnCodeToEnterNumber()));
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 0);
+            removeRequiredActionIfPresent();
+            List<String> generatedRecoveryAuthnCodes = createRecoveryAuthnCodesForUser();
+
+            // perform the login username
+            loginUsername(loginUsernameOnlyPage, driver);
+            // click try another way
+            tryAnotherWay(passwordPage, driver);
+            // select recovery codes to authenticate
+            selectRecoveryAuthnCodes(selectAuthenticatorPage, driver);
+            // enter recovery codes and submit
+            enterRecoveryCodes(enterRecoveryAuthnCodePage, driver, 0, generatedRecoveryAuthnCodes);
             enterRecoveryAuthnCodePage.clickSignInButton();
             enterRecoveryAuthnCodePage.assertAccountLinkAvailability(true);
+            events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
+        } finally {
+            // Revert copy of browser flow to original to keep clean slate after this test
+            BrowserFlowTest.revertFlows(testRealm(), BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES);
+        }
+    }
+
+    @Test
+    public void test06AuthenticateRecoveryAuthnCodesSimultaneous() {
+        try {
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 1000);
+            removeRequiredActionIfPresent();
+            List<String> generatedRecoveryAuthnCodes = createRecoveryAuthnCodesForUser();
+
+            // perform the login username
+            loginUsername(loginUsernameOnlyPage, driver);
+            loginUsername(loginUsernameOnlyPageSecondBrowser, driver2);
+            // click try another way
+            tryAnotherWay(passwordPage, driver);
+            tryAnotherWay(passwordPageSecondBrowser, driver2);
+            // select recivery codes to authenticate
+            selectRecoveryAuthnCodes(selectAuthenticatorPage, driver);
+            selectRecoveryAuthnCodes(selectAuthenticatorPageSecondBrowser, driver2);
+            // enter the same recovery code to the two browers
+            enterRecoveryCodes(enterRecoveryAuthnCodePage, driver, 0, generatedRecoveryAuthnCodes);
+            enterRecoveryCodes(enterRecoveryAuthnCodePageSecondBrowser, driver2, 0, generatedRecoveryAuthnCodes);
+            // submit fast in the two browsers using javascript to not wait for the page to load
+            enterRecoveryAuthnCodePage.clickSignInButtonViaJavaScriptNoDelay();
+            enterRecoveryAuthnCodePageSecondBrowser.clickSignInButtonViaJavaScriptNoDelay();
+
+            // one event should be a login and the other a login error
+            List<EventRepresentation> actualEvents = Arrays.asList(events.poll(5), events.poll(5));
+            assertIsContained(events.expectLogin().detail(Details.USERNAME, "test-user@localhost"), actualEvents);
+            assertIsContained(events.expect(EventType.LOGIN_ERROR).error(Errors.INVALID_USER_CREDENTIALS), actualEvents);
         } finally {
-            // Remove saved Recovery Authentication Codes to keep a clean slate after this test
-            enterRecoveryAuthnCodePage.assertAccountLinkAvailability(true);
-            enterRecoveryAuthnCodePage.clickAccountLink();
-            assertThat(driver.getTitle(), containsString("Account Management"));
             // Revert copy of browser flow to original to keep clean slate after this test
             BrowserFlowTest.revertFlows(testRealm(), BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES);
         }
@@ -230,23 +406,19 @@ public void test03AuthenticateRecoveryAuthnCodes() {
 
     //// In a sub-flow with alternative credential executors, test whether setup Recovery Authentication Codes flow is working
     @Test
-    @IgnoreBrowserDriver(FirefoxDriver.class)
-    @IgnoreBrowserDriver(ChromeDriver.class)
-    public void test04SetupRecoveryAuthnCodes() {
+    public void test07SetupRecoveryAuthnCodes() {
         try {
-            configureBrowserFlowWithRecoveryAuthnCodes(testingClient);
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 0);
             RequiredActionProviderSimpleRepresentation simpleRepresentation = new RequiredActionProviderSimpleRepresentation();
             simpleRepresentation.setProviderId(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
             simpleRepresentation.setName(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
             testRealm().flows().registerRequiredAction(simpleRepresentation);
-            loginUsernameOnlyPage.open();
-            loginUsernameOnlyPage.assertAttemptedUsernameAvailability(false);
-            loginUsernameOnlyPage.login("test-user@localhost");
+            loginUsername(loginUsernameOnlyPage, driver);
             // On the password page, username should be shown as we know the user
             passwordPage.assertCurrent();
             //passwordPage.assertAttemptedUsernameAvailability(true);
             Assert.assertEquals("test-user@localhost", passwordPage.getAttemptedUsername());
-            passwordPage.login("password");
+            passwordPage.login(getPassword("test-user@localhost"));
             setupRecoveryAuthnCodesPage.assertCurrent();
             setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
         } finally {
@@ -254,44 +426,25 @@ public void test04SetupRecoveryAuthnCodes() {
             setupRecoveryAuthnCodesPage.assertAccountLinkAvailability(true);
             setupRecoveryAuthnCodesPage.clickAccountLink();
             assertThat(driver.getTitle(), containsString("Account Management"));
-            testRealm().flows().removeRequiredAction(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name());
             // Revert copy of browser flow to original to keep clean slate after this test
             BrowserFlowTest.revertFlows(testRealm(), BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES);
         }
     }
 
     @Test
-    @IgnoreBrowserDriver(FirefoxDriver.class) // TODO: https://github.com/keycloak/keycloak/issues/13543
-    @IgnoreBrowserDriver(ChromeDriver.class)
-    public void test05BruteforceProtectionRecoveryAuthnCodes() {
+    public void test08BruteforceProtectionRecoveryAuthnCodes() {
         try {
-            configureBrowserFlowWithRecoveryAuthnCodes(testingClient);
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 0);
             RealmRepresentation rep = testRealm().toRepresentation();
             rep.setBruteForceProtected(true);
             testRealm().update(rep);
-            loginUsernameOnlyPage.open();
-            loginUsernameOnlyPage.assertAttemptedUsernameAvailability(false);
-            loginUsernameOnlyPage.login("test-user@localhost");
-            // On the password page, username should be shown as we know the user
-            passwordPage.assertCurrent();
-            passwordPage.assertAttemptedUsernameAvailability(true);
-            Assert.assertEquals("test-user@localhost", passwordPage.getAttemptedUsername());
-            passwordPage.assertTryAnotherWayLinkAvailability(true);
-            List<String> generatedRecoveryAuthnCodes = RecoveryAuthnCodesUtils.generateRawCodes();
-            testingClient.server().run(session -> {
-                RealmModel realm = session.realms().getRealmByName("test");
-                UserModel user = session.users().getUserByUsername(realm, "test-user@localhost");
-                CredentialModel recoveryAuthnCodesCred = RecoveryAuthnCodesCredentialModel.createFromValues(
-                        generatedRecoveryAuthnCodes,
-                        System.currentTimeMillis(),
-                        null);
-                user.credentialManager().createStoredCredential(recoveryAuthnCodesCred);
-            });
-            passwordPage.clickTryAnotherWayLink();
-            selectAuthenticatorPage.assertCurrent();
-            Assert.assertEquals(Arrays.asList(SelectAuthenticatorPage.PASSWORD, SelectAuthenticatorPage.RECOVERY_AUTHN_CODES), selectAuthenticatorPage.getAvailableLoginMethods());
-            selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.RECOVERY_AUTHN_CODES);
-            enterRecoveryAuthnCodePage.assertCurrent();
+
+            List<String> generatedRecoveryAuthnCodes = createRecoveryAuthnCodesForUser();
+
+            loginUsername(loginUsernameOnlyPage, driver);
+            tryAnotherWay(passwordPage, driver);
+            selectRecoveryAuthnCodes(selectAuthenticatorPage, driver);
+
             generatedRecoveryAuthnCodes.forEach(code -> System.out.println(code));
             for(int i=0; i < (BRUTE_FORCE_FAIL_ATTEMPTS - 1); i++) {
                 long randomNumber = (long)Math.random()*1000000000000L;
@@ -316,4 +469,77 @@ public void test05BruteforceProtectionRecoveryAuthnCodes() {
         }
     }
 
+    @Test
+    public void test09recoveryAuthnCodesWithThresholdConfigured() throws Exception {
+        AuthenticationManagementResource authMgt = testRealm().flows();
+        RequiredActionProviderRepresentation requiredAction = authMgt.getRequiredActions().stream()
+                .filter(action -> UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name().equals(action.getAlias()))
+                .findAny().get();
+        Map<String, String> origReqActionConfig = new HashMap<>(requiredAction.getConfig());
+
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
+            configureBrowserFlowWithRecoveryAuthnCodes(testingClient, 0);
+
+            // Configure required action with big threshold
+            requiredAction.getConfig().put(WARNING_THRESHOLD, String.valueOf(RecoveryAuthnCodesUtils.QUANTITY_OF_CODES_TO_GENERATE));
+            authMgt.updateRequiredAction(requiredAction.getAlias(), requiredAction);
+
+            // Add required action to the user
+            UserResource testUser = ApiUtil.findUserByUsernameId(testRealm(), "test-user@localhost");
+            UserRepresentation userRepresentation = testUser.toRepresentation();
+            userRepresentation.setRequiredActions(Arrays.asList(UserModel.RequiredAction.CONFIGURE_RECOVERY_AUTHN_CODES.name()));
+            testUser.update(userRepresentation);
+
+            // Login and setup recovery-codes
+            oauth.openLoginForm();
+            loginUsername(loginUsernameOnlyPage, driver);
+            passwordPage.login(getPassword("test-user@localhost"));
+            setupRecoveryAuthnCodesPage.assertCurrent();
+            List<String> recoveryCodes = setupRecoveryAuthnCodesPage.getRecoveryAuthnCodes();
+            setupRecoveryAuthnCodesPage.clickSaveRecoveryAuthnCodesButton();
+
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+
+            // Check account REST API that warning threshold not there on recovery-codes credential as user has full count of recovery codes
+            CredentialMetadataRepresentation recoveryCodesMetadata = getRecoveryCodeCredentialFromAccountRestApi(httpClient, response.getAccessToken());
+            Assert.assertNull("Expected not warning", recoveryCodesMetadata.getWarningMessageTitle());
+            Assert.assertEquals("0/12", recoveryCodesMetadata.getInfoMessage().getParameters()[0]);
+            Assert.assertNotNull(recoveryCodesMetadata.getCredential().getCredentialData());
+            RecoveryAuthnCodesCredentialData data = JsonSerialization.readValue(
+                    recoveryCodesMetadata.getCredential().getCredentialData(), RecoveryAuthnCodesCredentialData.class);
+            Assert.assertEquals(12, data.getTotalCodes());
+            Assert.assertEquals(12, data.getRemainingCodes());
+            Assert.assertEquals(JavaAlgorithm.SHA512, data.getAlgorithm());
+            Assert.assertNull(data.getHashIterations());
+
+            // Re-authenticate with recovery codes
+            oauth.loginForm().prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN).open();
+            tryAnotherWay(passwordPage, driver);
+            selectRecoveryAuthnCodes(selectAuthenticatorPage, driver);
+            enterRecoveryCodes(enterRecoveryAuthnCodePage, driver, 0, recoveryCodes);
+            enterRecoveryAuthnCodePage.clickSignInButton();
+
+            // Check warning is there as only 11 recovery codes remaining
+            recoveryCodesMetadata = getRecoveryCodeCredentialFromAccountRestApi(httpClient, response.getAccessToken());
+            Assert.assertEquals("recovery-codes-number-remaining", recoveryCodesMetadata.getWarningMessageTitle().getKey());
+            Assert.assertEquals("1/12", recoveryCodesMetadata.getInfoMessage().getParameters()[0]);
+        } finally {
+            // Revert
+            requiredAction.setConfig(origReqActionConfig);
+            authMgt.updateRequiredAction(requiredAction.getAlias(), requiredAction);
+
+            BrowserFlowTest.revertFlows(testRealm(), BROWSER_FLOW_WITH_RECOVERY_AUTHN_CODES);
+        }
+    }
+
+    private CredentialMetadataRepresentation getRecoveryCodeCredentialFromAccountRestApi(CloseableHttpClient httpClient, String accessToken) throws Exception {
+        List<AccountCredentialResource.CredentialContainer> credentials = SimpleHttpDefault.doGet(getAccountRootUrl()  + "/credentials", httpClient)
+                .auth(accessToken).asJson(new TypeReference<>() {});
+        AccountCredentialResource.CredentialContainer recoveryCode = credentials.stream()
+                .filter(credential -> RecoveryAuthnCodesCredentialModel.TYPE.equals(credential.getType()))
+                .findFirst().get();
+        return recoveryCode.getUserCredentialMetadatas().get(0);
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterTest.java
index 243b37384c5f..01616c196deb 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterTest.java
@@ -53,15 +53,17 @@
 import org.keycloak.testsuite.util.FlowUtil;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.AccountHelper;
+import org.keycloak.testsuite.util.UIUtils;
 
 import jakarta.mail.internet.MimeMessage;
 import jakarta.ws.rs.core.Response;
-import org.keycloak.testsuite.util.WaitUtils;
 
 import java.io.IOException;
+import java.util.List;
+import java.util.Map;
 import java.util.UUID;
 
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -70,7 +72,6 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
 /**
@@ -103,6 +104,8 @@ public class RegisterTest extends AbstractTestRealmKeycloakTest {
     @Rule
     public GreenMailRule greenMail = new GreenMailRule();
 
+    private String idTokenHint;
+
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
     }
@@ -113,7 +116,7 @@ public void registerExistingUsernameForbidden() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", "registerExistingUser@email", "roleRichUser", "password", "password");
+        registerPage.register("firstName", "lastName", "registerExistingUser@email", "roleRichUser", generatePassword());
 
         registerPage.assertCurrent();
         assertEquals("Username already exists.", registerPage.getInputAccountErrors().getUsernameError());
@@ -137,7 +140,7 @@ public void registerExistingEmailForbidden() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", "test-user@localhost", "registerExistingUser", "password", "password");
+        registerPage.register("firstName", "lastName", "test-user@localhost", "registerExistingUser", generatePassword());
 
         registerPage.assertCurrent();
         assertEquals("Email already exists.", registerPage.getInputAccountErrors().getEmailError());
@@ -162,7 +165,7 @@ public void registerExistingEmailAllowed() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("firstName", "lastName", "test-user@localhost", "registerExistingEmailUser", "password", "password");
+            registerPage.register("firstName", "lastName", "test-user@localhost", "registerExistingEmailUser", generatePassword());
 
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
@@ -177,7 +180,7 @@ public void registerExistingEmailAllowed() throws IOException {
 
     @Test
     public void registerUpperCaseEmail() throws IOException {
-        String userId = registerUpperCaseAndGetUserId(false);
+        String userId = registerUpperCaseAndGetUserId(false, generatePassword());
         assertThat(userId, notNullValue());
         testRealm().users().get(userId).remove();
     }
@@ -185,7 +188,7 @@ public void registerUpperCaseEmail() throws IOException {
     @Test
     public void registerUpperCaseEmailAsUsername() throws IOException {
         try (RealmAttributeUpdater rau = configureRealmRegistrationEmailAsUsername(true).update()) {
-            String userId = registerUpperCaseAndGetUserId(true);
+            String userId = registerUpperCaseAndGetUserId(true, generatePassword());
             assertThat(userId, notNullValue());
             testRealm().users().get(userId).remove();
         }
@@ -193,9 +196,10 @@ public void registerUpperCaseEmailAsUsername() throws IOException {
 
     @Test
     public void registerUpperCaseEmailWithChangedEmailAsUsername() throws IOException {
-        String userId = registerUpperCaseAndGetUserId(false);
+        final String password = generatePassword();
+        String userId = registerUpperCaseAndGetUserId(false, password);
         assertThat(userId, notNullValue());
-        oauth.openLogout();
+        oauth.logoutForm().idTokenHint(idTokenHint).open();
         events.clear();
 
         try (RealmAttributeUpdater rau = configureRealmRegistrationEmailAsUsername(true).update()) {
@@ -203,7 +207,7 @@ public void registerUpperCaseEmailWithChangedEmailAsUsername() throws IOExceptio
             loginPage.assertCurrent();
 
             final String EMAIL = "TEST@localhost";
-            loginPage.login(EMAIL, "password");
+            loginPage.login(EMAIL, password);
             assertThat(RequestType.AUTH_RESPONSE, is(appPage.getRequestType()));
 
             events.expectLogin()
@@ -222,7 +226,7 @@ public void registerUserInvalidPasswordConfirm() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", "registerUserInvalidPasswordConfirm@email", "registerUserInvalidPasswordConfirm", "password", "invalid");
+        registerPage.register("firstName", "lastName", "registerUserInvalidPasswordConfirm@email", "registerUserInvalidPasswordConfirm", generatePassword(), "invalid");
 
         registerPage.assertCurrent();
         assertEquals("Password confirmation doesn't match.", registerPage.getInputPasswordErrors().getPasswordConfirmError());
@@ -265,7 +269,7 @@ public void registerPasswordPolicy() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", "pass", "pass");
+            registerPage.register("firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", generatePassword(3));
 
             registerPage.assertCurrent();
             assertEquals("Invalid password: minimum length 8.", registerPage.getInputPasswordErrors().getPasswordError());
@@ -275,7 +279,7 @@ public void registerPasswordPolicy() throws IOException {
                     .removeDetail(Details.EMAIL)
                     .user((String) null).error("invalid_registration").assertEvent();
 
-            registerPage.register("firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", "password", "password");
+            registerPage.register("firstName", "lastName", "registerPasswordPolicy@email", "registerPasswordPolicy", generatePassword());
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
             String userId = events.expectRegister("registerPasswordPolicy", "registerPasswordPolicy@email").assertEvent().getUserId();
@@ -290,7 +294,7 @@ public void registerUserMissingUsername() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", "registerUserMissingUsername@email", null, "password", "password");
+        registerPage.register("firstName", "lastName", "registerUserMissingUsername@email", null, generatePassword());
 
         registerPage.assertCurrent();
         assertEquals("Please specify username.", registerPage.getInputAccountErrors().getUsernameError());
@@ -339,7 +343,7 @@ public void registerUserMissingEmail() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", null, "registerUserMissingEmail", "password", "password");
+        registerPage.register("firstName", "lastName", null, "registerUserMissingEmail", generatePassword());
         registerPage.assertCurrent();
         assertEquals("Please specify email.", registerPage.getInputAccountErrors().getEmailError());
         events.expectRegister("registerusermissingemail", null)
@@ -353,7 +357,7 @@ public void registerUserInvalidEmail() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", "registerUserInvalidEmailemail", "registerUserInvalidEmail", "password", "password");
+        registerPage.register("firstName", "lastName", "registerUserInvalidEmailemail", "registerUserInvalidEmail", generatePassword());
         registerPage.assertCurrent();
         assertEquals("registerUserInvalidEmailemail", registerPage.getEmail());
         assertEquals("Invalid email address.", registerPage.getInputAccountErrors().getEmailError());
@@ -370,7 +374,7 @@ public void registerUserSuccess() {
         //contains few special characters we want to be sure they are allowed in username
         String username = "register.U-se@rS_uccess";
 
-        registerPage.register("firstName", "lastName", "registerUserSuccess@email", username, "password", "password");
+        registerPage.register("firstName", "lastName", "registerUserSuccess@email", username, generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -380,7 +384,28 @@ public void registerUserSuccess() {
 
         UserRepresentation user = getUser(userId);
 
-        assertNull(user.getAttributes());
+        assertEquals(Map.of(UserModel.LOCALE, List.of("en")), user.getAttributes());
+    }
+
+    @Test
+    public void registerUserChangedLocaleSuccess() {
+        oauth.openLoginForm();
+        loginPage.assertCurrent();
+        loginPage.clickRegister();
+        registerPage.assertCurrent();
+        errorPage.openLanguage("Deutsch");
+        assertEquals("Deutsch", errorPage.getLanguageDropdownText());
+
+        registerPage.register("firstName", "lastName", "registerGerman@localhost", "registerGerman", generatePassword());
+
+        appPage.assertCurrent();
+        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+
+        String userId = events.expectRegister("registerGerman", "registerGerman@localhost").assertEvent().getUserId();
+        assertUserRegistered(userId, "registergerman", "registerGerman@localhost");
+
+        UserRepresentation user = getUser(userId);
+        assertEquals(Map.of(UserModel.LOCALE, List.of("de")), user.getAttributes());
     }
 
     @Test
@@ -402,7 +427,7 @@ public void registerUserSuccessEditUsernameDisabled() {
 
         String username = KeycloakModelUtils.generateId();
         String email = username + "@email.com";
-        registerPage.register("firstName", "lastName", email, username, "password", "password");
+        registerPage.register("firstName", "lastName", email, username, generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -430,7 +455,7 @@ public void registerUserSuccessEditUsernameEnabled() {
 
         String username = KeycloakModelUtils.generateId();
         String email = username + "@email.com";
-        registerPage.register("firstName", "lastName", email, username, "password", "password");
+        registerPage.register("firstName", "lastName", email, username, generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -459,7 +484,7 @@ public void registerUserSuccessWithEmailVerification() throws Exception {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("firstName", "lastName", "registerUserSuccessWithEmailVerification@email", "registerUserSuccessWithEmailVerification", "password", "password");
+            registerPage.register("firstName", "lastName", "registerUserSuccessWithEmailVerification@email", "registerUserSuccessWithEmailVerification", generatePassword());
             verifyEmailPage.assertCurrent();
 
             String userId = events.expectRegister("registerUserSuccessWithEmailVerification", "registerUserSuccessWithEmailVerification@email").assertEvent().getUserId();
@@ -501,7 +526,7 @@ public void registerUserSuccessWithEmailVerificationWithResend() throws Exceptio
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("firstName", "lastName", "registerUserSuccessWithEmailVerificationWithResend@email", "registerUserSuccessWithEmailVerificationWithResend", "password", "password");
+            registerPage.register("firstName", "lastName", "registerUserSuccessWithEmailVerificationWithResend@email", "registerUserSuccessWithEmailVerificationWithResend", generatePassword());
             verifyEmailPage.assertCurrent();
 
             String userId = events.expectRegister("registerUserSuccessWithEmailVerificationWithResend", "registerUserSuccessWithEmailVerificationWithResend@email").assertEvent().getUserId();
@@ -554,7 +579,7 @@ public void registerUserUmlats() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("Äǜṳǚǘǖ", "Öṏṏ", "registeruserumlats@email", "registeruserumlats", "password", "password");
+        registerPage.register("Äǜṳǚǘǖ", "Öṏṏ", "registeruserumlats@email", "registeruserumlats", generatePassword());
 
         String userId = events.expectRegister("registeruserumlats", "registeruserumlats@email").assertEvent().getUserId();
         events.expectLogin().detail("username", "registeruserumlats").user(userId).assertEvent();
@@ -581,6 +606,12 @@ public void registerUserNotUsernamePasswordPolicy() throws IOException {
             assertTrue(registerPage.isCurrent());
             assertEquals("Invalid password: must not be equal to the username.", registerPage.getInputPasswordErrors().getPasswordError());
 
+            // Case-sensitivity - still should not allow to create password when lower-cased
+            registerPage.register("firstName", "lastName", "registerUserNotUsername@email", "registerUserNotUsername", "registerusernotusername", "registerusernotusername");
+
+            assertTrue(registerPage.isCurrent());
+            assertEquals("Invalid password: must not be equal to the username.", registerPage.getInputPasswordErrors().getPasswordError());
+
             try (Response response = adminClient.realm("test").users().create(UserBuilder.create().username("registerUserNotUsername").build())) {
                 assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
             }
@@ -590,7 +621,7 @@ public void registerUserNotUsernamePasswordPolicy() throws IOException {
             assertTrue(registerPage.isCurrent());
             assertEquals("Username already exists.", registerPage.getInputAccountErrors().getUsernameError());
 
-            registerPage.register("firstName", "lastName", "registerUserNotUsername@email", null, "password", "password");
+            registerPage.register("firstName", "lastName", "registerUserNotUsername@email", null, generatePassword());
 
             assertTrue(registerPage.isCurrent());
             assertEquals("Please specify username.", registerPage.getInputAccountErrors().getUsernameError());
@@ -616,6 +647,12 @@ public void registerUserNotContainsUsernamePasswordPolicy() throws IOException {
             assertTrue(registerPage.isCurrent());
             assertEquals("Invalid password: Can not contain the username.", registerPage.getInputPasswordErrors().getPasswordError());
 
+            // Case-sensitivity - still should not allow to create password when lower-cased
+            registerPage.register("firstName", "lastName", "registerUserNotUsername@email", "Bob", "123bob", "123bob");
+
+            assertTrue(registerPage.isCurrent());
+            assertEquals("Invalid password: Can not contain the username.", registerPage.getInputPasswordErrors().getPasswordError());
+
             try (Response response = adminClient.realm("test").users().create(UserBuilder.create().username("Bob").build())) {
                 assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
             }
@@ -625,7 +662,7 @@ public void registerUserNotContainsUsernamePasswordPolicy() throws IOException {
             assertTrue(registerPage.isCurrent());
             assertEquals("Username already exists.", registerPage.getInputAccountErrors().getUsernameError());
 
-            registerPage.register("firstName", "lastName", "registerUserNotContainsUsername@email", null, "password", "password");
+            registerPage.register("firstName", "lastName", "registerUserNotContainsUsername@email", null, generatePassword());
 
             assertTrue(registerPage.isCurrent());
             assertEquals("Please specify username.", registerPage.getInputAccountErrors().getUsernameError());
@@ -649,6 +686,12 @@ public void registerUserNotEmailPasswordPolicy() throws IOException {
 
             assertTrue(registerPage.isCurrent());
             assertEquals("Invalid password: must not be equal to the email.", registerPage.getInputPasswordErrors().getPasswordError());
+
+            // Case-sensitivity - still should not allow to create password when lower-cased
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", "registerUserNotEmail@email", "registerusernotemail@email", "registerusernotemail@email");
+
+            assertTrue(registerPage.isCurrent());
+            assertEquals("Invalid password: must not be equal to the email.", registerPage.getInputPasswordErrors().getPasswordError());
         }
     }
 
@@ -663,7 +706,7 @@ public void registerExistingUser_emailAsUsername() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", "test-user@localhost", "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", "test-user@localhost", generatePassword());
 
             registerPage.assertCurrent();
             assertEquals("Email already exists.", registerPage.getInputAccountErrors().getEmailError());
@@ -679,12 +722,12 @@ public void registerUserMissingOrInvalidEmail_emailAsUsername() throws IOExcepti
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", null, "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", null, generatePassword());
             registerPage.assertCurrent();
             assertEquals("Please specify email.", registerPage.getInputAccountErrors().getEmailError());
             events.expectRegister(null, null).removeDetail("username").removeDetail("email").error("invalid_registration").assertEvent();
 
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", "registerUserInvalidEmailemail", "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", "registerUserInvalidEmailemail", generatePassword());
             registerPage.assertCurrent();
             assertEquals("Invalid email address.", registerPage.getInputAccountErrors().getEmailError());
             events.expectRegister("registeruserinvalidemailemail", "registeruserinvalidemailemail").error("invalid_registration").assertEvent();
@@ -698,7 +741,7 @@ public void registerUserSuccess_emailAsUsername() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", "registerUserSuccessE@email", "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", "registerUserSuccessE@email", generatePassword());
 
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
@@ -722,7 +765,7 @@ public void testEmailAsUsernameWhenEditUserNameDisabled() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", "alice@email", "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", "alice@email", generatePassword());
 
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
         }
@@ -767,8 +810,9 @@ public void registerUserMissingTermsAcceptance() {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
+            final String password = generatePassword();
             registerPage.register("firstName", "lastName", "registerUserMissingTermsAcceptance@email",
-                    "registerUserMissingTermsAcceptance", "password", "password", null, false, null);
+                    "registerUserMissingTermsAcceptance", password, password, null, false, null);
 
             registerPage.assertCurrent();
             assertEquals("You must agree to our terms and conditions.", registerPage.getInputAccountErrors().getTermsError());
@@ -793,15 +837,16 @@ public void registerUserSuccessTermsAcceptance() {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
+            final String password = generatePassword();
             registerPage.register("firstName", "lastName", "registerUserSuccessTermsAcceptance@email",
-                    "registerUserSuccessTermsAcceptance", "password", "password", null, true, null);
+                    "registerUserSuccessTermsAcceptance", password, password, null, true, null);
 
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
             String userId = events.expectRegister("registerUserSuccessTermsAcceptance", "registerUserSuccessTermsAcceptance@email")
                     .assertEvent().getUserId();
             UserRepresentation user = assertUserRegistered(userId, "registerUserSuccessTermsAcceptance", "registerUserSuccessTermsAcceptance@email");
-            Assert.assertNull(user.getAttributes());
+            assertEquals(Map.of(UserModel.LOCALE, List.of("en")), user.getAttributes());
         } finally {
             configureRegistrationFlowWithCustomRegistrationPageForm(UUID.randomUUID().toString());
         }
@@ -824,9 +869,10 @@ public void registerUserSuccessTermsAcceptanceWithRequiredActionEnabled() {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
+            final String password = generatePassword();
             int currentTime = Time.currentTime();
             registerPage.register("firstName", "lastName", "registerUserSuccessTermsAcceptance2@email",
-                    "registerUserSuccessTermsAcceptance2", "password", "password", null, true, null);
+                    "registerUserSuccessTermsAcceptance2", password, password, null, true, null);
 
             assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
@@ -859,9 +905,8 @@ public void testRegisterShouldFailBeforeUserCreationWhenUserIsInContext() {
         driver.navigate().back();
         driver.navigate().back();
         events.clear();
-        driver.navigate().back();
 
-        errorPage.assertCurrent();
+        UIUtils.navigateBackWithRefresh(driver, errorPage);
         Assert.assertEquals("Action expired. Please continue with login now.", errorPage.getError());
 
         events.expectRegister("registerUserMissingTermsAcceptance", "registerUserMissingTermsAcceptance@email")
@@ -895,7 +940,7 @@ private RealmAttributeUpdater getRealmAttributeUpdater() {
      * @param emailAsUsername is flag `Email as username` enabled
      * @return user ID
      */
-    private String registerUpperCaseAndGetUserId(boolean emailAsUsername) {
+    private String registerUpperCaseAndGetUserId(boolean emailAsUsername, String password) {
         final String EMAIL = "TEST@localhost";
         final String USERNAME = "UPPERCASE";
         final String EMAIL_OR_USERNAME = emailAsUsername ? EMAIL : USERNAME;
@@ -905,9 +950,9 @@ private String registerUpperCaseAndGetUserId(boolean emailAsUsername) {
         registerPage.assertCurrent();
 
         if (emailAsUsername) {
-            registerPage.registerWithEmailAsUsername("firstName", "lastName", EMAIL, "password", "password");
+            registerPage.registerWithEmailAsUsername("firstName", "lastName", EMAIL, password, password);
         } else {
-            registerPage.register("firstName", "lastName", EMAIL, USERNAME, "password", "password");
+            registerPage.register("firstName", "lastName", EMAIL, USERNAME, password, password);
         }
 
         String userId = events.expectRegister(EMAIL_OR_USERNAME, EMAIL)
@@ -918,8 +963,8 @@ private String registerUpperCaseAndGetUserId(boolean emailAsUsername) {
                 .detail("username", EMAIL_OR_USERNAME.toLowerCase())
                 .user(userId)
                 .assertEvent();
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken());
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        idTokenHint = tokenResponse.getIdToken();
         assertUserBasicRegisterAttributes(userId, emailAsUsername ? null : USERNAME, EMAIL, "firstName", "lastName");
 
         return userId;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterWithUserProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterWithUserProfileTest.java
index 73fee5171501..ee989c763fab 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterWithUserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RegisterWithUserProfileTest.java
@@ -22,11 +22,14 @@
 import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.assertEquals;
 
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ALL;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.PERMISSIONS_ADMIN_EDITABLE;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.SCOPE_DEPARTMENT;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.VALIDATIONS_LENGTH;
-import static org.keycloak.testsuite.forms.VerifyProfileTest.ATTRIBUTE_DEPARTMENT;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_ONLY;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_EDITABLE;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.SCOPE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.VALIDATIONS_LENGTH;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.ATTRIBUTE_DEPARTMENT;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -39,7 +42,6 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
@@ -53,6 +55,7 @@
 import org.keycloak.testsuite.util.ClientScopeBuilder;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebDriver;
 import org.openqa.selenium.WebElement;
@@ -110,7 +113,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {
 
     @Before
     public void beforeTest() {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(),null);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(),null);
     }
 
     @Test
@@ -125,7 +128,7 @@ public void testRegisterUserSuccess_lastNameOptional() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "", "registerUserSuccessLastNameOptional@email", "registerUserSuccessLastNameOptional", "password", "password");
+        registerPage.register("firstName", "", "registerUserSuccessLastNameOptional@email", "registerUserSuccessLastNameOptional", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -146,7 +149,7 @@ public void testRegisterUserSuccess_lastNameRequiredForScope_notRequested() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_notRequested@email", "registerUserSuccessLastNameRequiredForScope_notRequested", "password", "password");
+        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_notRequested@email", "registerUserSuccessLastNameRequiredForScope_notRequested", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -168,14 +171,14 @@ public void testRegisterUserSuccess_lastNameRequiredForScope_requested() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_requested@email", "registerUserSuccessLastNameRequiredForScope_requested", "password", "password");
+        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_requested@email", "registerUserSuccessLastNameRequiredForScope_requested", generatePassword());
 
         //error reported
         registerPage.assertCurrent();
         assertEquals("Please specify this field.", registerPage.getInputAccountErrors().getLastNameError());
 
         //submit correct form
-        registerPage.register("firstName", "lastName", "registerUserSuccessLastNameRequiredForScope_requested@email", "registerUserSuccessLastNameRequiredForScope_requested", "password", "password");
+        registerPage.register("firstName", "lastName", "registerUserSuccessLastNameRequiredForScope_requested@email", "registerUserSuccessLastNameRequiredForScope_requested", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -194,14 +197,14 @@ public void testRegisterUserSuccess_lastNameRequiredForScope_clientDefault() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_clientDefault@email", "registerUserSuccessLastNameRequiredForScope_clientDefault", "password", "password");
+        registerPage.register("firstName", "", "registerUserSuccessLastNameRequiredForScope_clientDefault@email", "registerUserSuccessLastNameRequiredForScope_clientDefault", generatePassword());
 
         //error reported
         registerPage.assertCurrent();
         assertEquals("Please specify this field.", registerPage.getInputAccountErrors().getLastNameError());
 
         //submit correct form
-        registerPage.register("firstName", "lastName", "registerUserSuccessLastNameRequiredForScope_clientDefault@email", "registerUserSuccessLastNameRequiredForScope_clientDefault", "password", "password");
+        registerPage.register("firstName", "lastName", "registerUserSuccessLastNameRequiredForScope_clientDefault@email", "registerUserSuccessLastNameRequiredForScope_clientDefault", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -219,7 +222,7 @@ public void testRegisterUserSuccess_lastNameLengthValidation() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "last", "registerUserSuccessLastNameLengthValidation@email", "registerUserSuccessLastNameLengthValidation", "password", "password");
+        registerPage.register("firstName", "last", "registerUserSuccessLastNameLengthValidation@email", "registerUserSuccessLastNameLengthValidation", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -240,7 +243,7 @@ public void testRegisterUserInvalidLastNameLength() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "L", "registerUserInvalidLastNameLength@email", "registerUserInvalidLastNameLength", "password", "password");
+        registerPage.register("firstName", "L", "registerUserInvalidLastNameLength@email", "registerUserInvalidLastNameLength", generatePassword());
 
         registerPage.assertCurrent();
         assertEquals("Length must be between 3 and 255.", registerPage.getInputAccountErrors().getLastNameError());
@@ -276,11 +279,11 @@ public void testAttributeDisplayName() {
     public void testAttributeGuiOrder() {
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + "}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + "}"
                 + "]}");
 
         loginPage.open();
@@ -290,7 +293,7 @@ public void testAttributeGuiOrder() {
 
         //assert fields location in form
         List<WebElement> element = driver.findElements(By.cssSelector("form#kc-register-form input"));
-        String[] labelOrder = new String[]{"lastName", "department", "username", "password", "password-confirm", "firstName", "email"};
+        String[] labelOrder = new String[]{"locale", "lastName", "department", "username", "password", "password-confirm", "firstName", "email"};
         for (int i = 0; i < labelOrder.length; i++) {
             WebElement webElement = element.get(i);
             String id = webElement.getAttribute("id");
@@ -298,20 +301,20 @@ public void testAttributeGuiOrder() {
         }
     }
 
-    public static final String UP_CONFIG_PART_INPUT_TYPES = "{\"name\": \"defaultType\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-            + "{\"name\": \"placeholderAttribute\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputTypePlaceholder\":\"Example.\"}},"
-            + "{\"name\": \"helperTexts\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputHelperTextBefore\":\"Example <b>bold text</b> before.\",\"inputHelperTextAfter\":\"Example <i>i text</i> after.\"}},"
-            + "{\"name\": \"textWithBasicAttributes\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputTypeSize\":\"35\",\"inputTypeMinlength\":\"1\",\"inputTypeMaxlength\":\"10\",\"inputTypePattern\":\".*\"}},"
-            + "{\"name\": \"html5NumberWithAttributes\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"html5-number\",\"inputTypeMin\":\"10\",\"inputTypeMax\":\"20\",\"inputTypeStep\":1}},"
-            + "{\"name\": \"textareaWithAttributes\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"textarea\",\"inputTypeCols\":\"35\",\"inputTypeRows\":\"7\",\"inputTypeMaxlength\":\"10\"}},"
-            + "{\"name\": \"selectWithoutOptions\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"select\",\"inputTypeSize\":\"5\"}},"
-            + "{\"name\": \"selectWithOptionsWithoutLabels\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\":{\"options\":{\"options\":[ \"opt1\",\"opt2\"]}}, \"annotations\":{\"inputType\":\"select\"}},"
-            + "{\"name\": \"multiselectWithOptionsAndSimpleI18nLabels\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\":{\"options\":{ \"options\":[\"totp\",\"opt2\"]}}, \"annotations\":{\"inputType\":\"multiselect\",\"inputOptionLabelsI18nPrefix\": \"loginTotp\"}},"
-            + "{\"name\": \"multiselectWithOptionsAndLabels\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\":{\"options\":{ \"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"multiselect\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}},"
-            + "{\"name\": \"selectWithOptionsFromCustomValidatorAndLabels\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\":{\"dummyOptions\":{\"options\" : [\"vopt1\",\"vopt2\",\"vopt3\"]}} ,\"annotations\":{\"inputType\":\"select\",\"inputOptionsFromValidation\":\"dummyOptions\",\"inputOptionLabels\":{\"vopt1\": \"Option 1\",\"vopt2\":\"${username}\"}}},"
-            + "{\"name\": \"selectRadiobuttons\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\" : {\"options\" : {\"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"select-radiobuttons\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}},"
-            + "{\"name\": \"selectRadiobuttonsWithOptionsFromCustomValidatorAndLabels\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\" : {\"dummyOptions\" : {\"options\" : [\"vopt1\",\"vopt2\",\"vopt3\"]}} ,\"annotations\":{\"inputType\":\"select-radiobuttons\",\"inputOptionsFromValidation\":\"dummyOptions\",\"inputOptionLabels\":{\"vopt1\": \"Option 1\",\"vopt2\":\"${username}\"}}},"
-            + "{\"name\": \"multiselectCheckboxes\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"validations\": {\"options\":{\"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"multiselect-checkboxes\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}}";
+    public static final String UP_CONFIG_PART_INPUT_TYPES = "{\"name\": \"defaultType\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+            + "{\"name\": \"placeholderAttribute\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputTypePlaceholder\":\"Example.\"}},"
+            + "{\"name\": \"helperTexts\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputHelperTextBefore\":\"Example <b>bold text</b> before.\",\"inputHelperTextAfter\":\"Example <i>i text</i> after.\"}},"
+            + "{\"name\": \"textWithBasicAttributes\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"text\",\"inputTypeSize\":\"35\",\"inputTypeMinlength\":\"1\",\"inputTypeMaxlength\":\"10\",\"inputTypePattern\":\".*\"}},"
+            + "{\"name\": \"html5NumberWithAttributes\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"html5-number\",\"inputTypeMin\":\"10\",\"inputTypeMax\":\"20\",\"inputTypeStep\":1}},"
+            + "{\"name\": \"textareaWithAttributes\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"textarea\",\"inputTypeCols\":\"35\",\"inputTypeRows\":\"7\",\"inputTypeMaxlength\":\"10\"}},"
+            + "{\"name\": \"selectWithoutOptions\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"annotations\":{\"inputType\":\"select\",\"inputTypeSize\":\"5\"}},"
+            + "{\"name\": \"selectWithOptionsWithoutLabels\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\":{\"options\":{\"options\":[ \"opt1\",\"opt2\"]}}, \"annotations\":{\"inputType\":\"select\"}},"
+            + "{\"name\": \"multiselectWithOptionsAndSimpleI18nLabels\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\":{\"options\":{ \"options\":[\"totp\",\"opt2\"]}}, \"annotations\":{\"inputType\":\"multiselect\",\"inputOptionLabelsI18nPrefix\": \"loginTotp\"}},"
+            + "{\"name\": \"multiselectWithOptionsAndLabels\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\":{\"options\":{ \"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"multiselect\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}},"
+            + "{\"name\": \"selectWithOptionsFromCustomValidatorAndLabels\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\":{\"dummyOptions\":{\"options\" : [\"vopt1\",\"vopt2\",\"vopt3\"]}} ,\"annotations\":{\"inputType\":\"select\",\"inputOptionsFromValidation\":\"dummyOptions\",\"inputOptionLabels\":{\"vopt1\": \"Option 1\",\"vopt2\":\"${username}\"}}},"
+            + "{\"name\": \"selectRadiobuttons\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\" : {\"options\" : {\"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"select-radiobuttons\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}},"
+            + "{\"name\": \"selectRadiobuttonsWithOptionsFromCustomValidatorAndLabels\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\" : {\"dummyOptions\" : {\"options\" : [\"vopt1\",\"vopt2\",\"vopt3\"]}} ,\"annotations\":{\"inputType\":\"select-radiobuttons\",\"inputOptionsFromValidation\":\"dummyOptions\",\"inputOptionLabels\":{\"vopt1\": \"Option 1\",\"vopt2\":\"${username}\"}}},"
+            + "{\"name\": \"multiselectCheckboxes\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"validations\": {\"options\":{\"options\":[\"opt1\",\"opt2\",\"opt3\"]}}, \"annotations\":{\"inputType\":\"multiselect-checkboxes\",\"inputOptionLabels\":{\"opt1\": \"Option 1\",\"opt2\":\"${username}\"}}}";
 
     @Test
     public void testAttributeInputTypes() {
@@ -399,11 +402,11 @@ public static void assertFieldTypes(WebDriver driver) {
     public void testAttributeGrouping() {
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
+                + "{\"name\": \"lastName\"," + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"username\", " + UserProfileUtil.PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + UserProfileUtil.PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"department\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
+                + "{\"name\": \"email\", " + UserProfileUtil.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
                 + "], \"groups\": ["
                 + "{\"name\": \"company\", \"displayDescription\": \"Company field desc\" },"
                 + "{\"name\": \"contact\" }"
@@ -448,7 +451,7 @@ public void testRegisterUserSuccess_requiredReadOnlyAttributeNotRenderedAndNotBl
         Assert.assertFalse(registerPage.isDepartmentPresent());
 
 
-        registerPage.register("FirstName", "LastName", "requiredReadOnlyAttributeNotRenderedAndNotBlockingRegistration@email", "requiredReadOnlyAttributeNotRenderedAndNotBlockingRegistration", "password", "password");
+        registerPage.register("FirstName", "LastName", "requiredReadOnlyAttributeNotRenderedAndNotBlockingRegistration@email", "requiredReadOnlyAttributeNotRenderedAndNotBlockingRegistration", generatePassword());
 
         appPage.assertCurrent();
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
@@ -469,13 +472,14 @@ public void testRegisterUserSuccess_attributeRequiredAndSelectedByScopeMustBeSet
         registerPage.assertCurrent();
 
         //check required validation works
-        registerPage.register("FirstAA", "LastAA", "attributeRequiredAndSelectedByScopeMustBeSet@email", "attributeRequiredAndSelectedByScopeMustBeSet", "password", "password", "");
+        final String password = generatePassword();
+        registerPage.register("FirstAA", "LastAA", "attributeRequiredAndSelectedByScopeMustBeSet@email", "attributeRequiredAndSelectedByScopeMustBeSet", password, password, "");
         registerPage.assertCurrent();
 
-        registerPage.register("FirstAA", "LastAA", "attributeRequiredAndSelectedByScopeMustBeSet@email", "attributeRequiredAndSelectedByScopeMustBeSet", "password", "password", "DepartmentAA");
+        registerPage.register("FirstAA", "LastAA", "attributeRequiredAndSelectedByScopeMustBeSet@email", "attributeRequiredAndSelectedByScopeMustBeSet", password, password, "DepartmentAA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = VerifyProfileTest.getUserByUsername(testRealm(),"attributeRequiredAndSelectedByScopeMustBeSet");
         assertEquals("FirstAA", user.getFirstName());
@@ -497,10 +501,10 @@ public void testRegisterUserSuccess_attributeNotRequiredAndSelectedByScopeCanBeI
         registerPage.assertCurrent();
 
         Assert.assertTrue(registerPage.isDepartmentPresent());
-        registerPage.register("FirstAA", "LastAA", "attributeNotRequiredAndSelectedByScopeCanBeIgnored@email", "attributeNotRequiredAndSelectedByScopeCanBeIgnored", "password", "password");
+        registerPage.register("FirstAA", "LastAA", "attributeNotRequiredAndSelectedByScopeCanBeIgnored@email", "attributeNotRequiredAndSelectedByScopeCanBeIgnored", generatePassword());
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         String userId = events.expectRegister("attributeNotRequiredAndSelectedByScopeCanBeIgnored", "attributeNotRequiredAndSelectedByScopeCanBeIgnored@email",client_scope_optional.getClientId()).assertEvent().getUserId();
         UserRepresentation user = getUser(userId);
@@ -523,10 +527,11 @@ public void testRegisterUserSuccess_attributeNotRequiredAndSelectedByScopeCanBeS
         registerPage.assertCurrent();
 
         Assert.assertTrue(registerPage.isDepartmentPresent());
-        registerPage.register("FirstAA", "LastAA", "attributeNotRequiredAndSelectedByScopeCanBeSet@email", "attributeNotRequiredAndSelectedByScopeCanBeSet", "password", "password", "Department AA");
+        final String password = generatePassword();
+        registerPage.register("FirstAA", "LastAA", "attributeNotRequiredAndSelectedByScopeCanBeSet@email", "attributeNotRequiredAndSelectedByScopeCanBeSet", password, password, "Department AA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         String userId = events.expectRegister("attributeNotRequiredAndSelectedByScopeCanBeSet", "attributeNotRequiredAndSelectedByScopeCanBeSet@email",client_scope_default.getClientId()).assertEvent().getUserId();
         UserRepresentation user = getUser(userId);
@@ -549,10 +554,10 @@ public void testRegisterUserSuccess_attributeRequiredButNotSelectedByScopeIsNotR
         registerPage.assertCurrent();
 
         Assert.assertFalse(registerPage.isDepartmentPresent());
-        registerPage.register("FirstAA", "LastAA", "attributeRequiredButNotSelectedByScopeIsNotRendered@email", "attributeRequiredButNotSelectedByScopeIsNotRendered", "password", "password");
+        registerPage.register("FirstAA", "LastAA", "attributeRequiredButNotSelectedByScopeIsNotRendered@email", "attributeRequiredButNotSelectedByScopeIsNotRendered", generatePassword());
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         String userId = events.expectRegister("attributeRequiredButNotSelectedByScopeIsNotRendered", "attributeRequiredButNotSelectedByScopeIsNotRendered@email",client_scope_optional.getClientId()).assertEvent().getUserId();
         UserRepresentation user = getUser(userId);
@@ -574,7 +579,7 @@ public void testEmailAsOptional() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", "password", "password");
+        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", generatePassword());
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
     }
 
@@ -591,7 +596,7 @@ public void testEmailRequired() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", "password", "password");
+        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", generatePassword());
         registerPage.assertCurrent();
         assertThat(registerPage.getInputAccountErrors().getEmailError(), anyOf(
                 containsString("Please specify email"),
@@ -613,13 +618,78 @@ public void testEmailRequiredForUser() {
         loginPage.clickRegister();
         registerPage.assertCurrent();
 
-        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", "password", "password");
+        registerPage.register("firstName", "lastName", null, "registerWithoutEmail", generatePassword());
         assertThat(registerPage.getInputAccountErrors().getEmailError(), anyOf(
                 containsString("Please specify email"),
                 containsString("Please specify this field")
         ));
     }
 
+    @Test
+    public void testEmailNotWritable() {
+        setUserProfileConfiguration("{\"attributes\": ["
+                + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\"," + PERMISSIONS_ADMIN_ONLY + ", \"required\": {\"roles\" : [\"user\"]}}"
+                + "]}");
+
+        loginPage.open();
+        loginPage.clickRegister();
+        registerPage.assertCurrent();
+
+        assertFalse(registerPage.isEmailPresent());
+
+        registerPage.register("firstName", "lastName", null, "myusername", generatePassword());
+
+        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+    }
+
+    @Test
+    public void testEmailNotShownIfReadOnly() {
+        setUserProfileConfiguration("{\"attributes\": ["
+                + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\"," + PERMISSIONS_ADMIN_EDITABLE + ", \"required\": {\"roles\" : [\"user\"]}}"
+                + "]}");
+
+        loginPage.open();
+        loginPage.clickRegister();
+        registerPage.assertCurrent();
+
+        assertFalse(registerPage.isEmailPresent());
+
+        registerPage.register("firstName", "lastName", null, "myusername1", generatePassword());
+
+        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+    }
+
+    @Test
+    public void testEmailNotAllowedButEmailAsUsername() {
+        RealmRepresentation realm = testRealm().toRepresentation();
+        realm.setRegistrationEmailAsUsername(true);
+        testRealm().update(realm);
+        getCleanup().addCleanup(() -> {
+            realm.setRegistrationEmailAsUsername(false);
+            testRealm().update(realm);
+        });
+        setUserProfileConfiguration("{\"attributes\": ["
+                + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\"," + PERMISSIONS_ADMIN_EDITABLE + ", \"required\": {\"roles\" : [\"user\"]}}"
+                + "]}");
+
+        loginPage.open();
+        loginPage.clickRegister();
+        registerPage.assertCurrent();
+
+        assertFalse(registerPage.isUsernamePresent());
+        assertTrue(registerPage.isEmailPresent());
+
+        registerPage.registerWithEmailAsUsername("firstName", "lastName", "myusername1@keycloak.org", generatePassword());
+
+        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+    }
+
     private void assertUserRegistered(String userId, String username, String email, String firstName, String lastName) {
         events.expectLogin().detail("username", username.toLowerCase()).user(userId).assertEvent();
 
@@ -641,7 +711,7 @@ private void assertUserRegistered(String userId, String username, String email,
     }
 
     private void setUserProfileConfiguration(String configuration) {
-        VerifyProfileTest.setUserProfileConfiguration(testRealm(), configuration);
+        UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
     }
 
     private UserRepresentation getUser(String userId) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
index 4fa1eb4929a9..230e48d313f3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetCredentialsAlternativeFlowsTest.java
@@ -23,7 +23,6 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.models.UserManager;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
@@ -49,6 +48,8 @@
 import org.keycloak.testsuite.util.*;
 
 import jakarta.mail.internet.MimeMessage;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
 import java.util.Arrays;
 import java.util.List;
 
@@ -63,6 +64,7 @@
 public class ResetCredentialsAlternativeFlowsTest extends AbstractAppInitiatedActionTest {
 
     private String userId;
+    private String password;
 
     @Rule
     public GreenMailRule greenMail = new GreenMailRule();
@@ -115,7 +117,8 @@ public void setup() {
                 .enabled(true)
                 .build();
 
-        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, "password");
+        password = generatePassword();
+        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), user, password);
         getCleanup().addUserId(userId);
     }
 
@@ -248,7 +251,7 @@ public void testResetCredentialsFlowWithUsernameProvidedFromBrowserFlow() throws
 
             // Assert user authenticated
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         } finally {
             revertFlows();
         }
@@ -345,9 +348,9 @@ public void resetCredentialsVerifyCustomOtpLabelSetProperly() {
 
             // Login & set up the initial OTP code for the user
             loginPage.open();
-            loginPage.login("login-test", "password");
-            String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            loginPage.login("login-test", password);
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
             String customOtpLabel = "my-original-otp-label";
 
@@ -358,7 +361,7 @@ public void resetCredentialsVerifyCustomOtpLabelSetProperly() {
             assertKcActionStatus(SUCCESS);
 
             // Logout
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
 
             // Go to login page & click "Forgot password" link to perform the custom 'Reset Credential' flow
             loginPage.open();
@@ -408,7 +411,7 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
 
             // Login & set up the initial OTP code for the user
             loginPage.open();
-            loginPage.login("login@test.com", "password");
+            loginPage.login("login@test.com", password);
 
             // Create OTP credential with empty label
             final String emptyOtpLabel = "";
@@ -422,7 +425,7 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
             Assert.assertTrue(AccountHelper.deleteTotpAuthentication(testRealm(), "login-test"));
 
             // Logout
-            driver.navigate().to(oauth.getLogoutUrl().build());
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
 
@@ -433,7 +436,7 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("Bruce", "Wilson", "bwilson@keycloak.org", "bwilson", "password", "password");
+            registerPage.register("Bruce", "Wilson", "bwilson@keycloak.org", "bwilson", generatePassword());
             totpPage.assertCurrent();
 
             // Create OTP credential with empty label
@@ -444,13 +447,13 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
             // Assert user authenticated
             appPage.assertCurrent();
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
             Assert.assertTrue(AccountHelper.isTotpPresent(testRealm(), "bwilson"));
             Assert.assertTrue(AccountHelper.totpUserLabelComparator(testRealm(), "bwilson", ""));
 
             // Logout
-            driver.navigate().to(oauth.getLogoutUrl().build());
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
 
@@ -475,7 +478,7 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
             // Assert user authenticated
             appPage.assertCurrent();
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
             // Verify 2nd OTP credential was successfully created too
             Assert.assertTrue(AccountHelper.totpUserLabelComparator(testRealm(), "bwilson", secondOtpLabel));
@@ -485,7 +488,7 @@ public void deviceNameOptionalForFirstOTPCredentialButRequiredForEachNextOne() {
             Assert.assertTrue(AccountHelper.deleteTotpAuthentication(testRealm(), "bwilson"));
 
             // Logout
-            driver.navigate().to(oauth.getLogoutUrl().build());
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
index 5f72235f4256..73a36eaa8399 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
@@ -22,8 +22,10 @@
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.actiontoken.resetcred.ResetCredentialsActionToken;
+import org.keycloak.authentication.authenticators.resetcred.ResetCredentialEmail;
 import org.jboss.arquillian.graphene.page.Page;
 import org.keycloak.common.constants.ServiceAccountConstants;
+import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.events.Details;
 import org.keycloak.events.Errors;
@@ -31,16 +33,24 @@
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.Constants;
 import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.models.utils.SystemClientUtil;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.resources.LoginActionsService;
+import org.keycloak.storage.StorageId;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.storage.UserStorageProviderModel;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.federation.UserMapStorageFactory;
 import org.keycloak.testsuite.federation.kerberos.AbstractKerberosTest;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
@@ -57,9 +67,11 @@
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
 import org.keycloak.testsuite.util.KerberosUtils;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.SecondBrowser;
+import org.keycloak.testsuite.util.UIUtils;
+import org.keycloak.testsuite.util.URLUtils;
 import org.keycloak.testsuite.util.UserActionTokenBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.WaitUtils;
@@ -94,6 +106,7 @@
 public class ResetPasswordTest extends AbstractTestRealmKeycloakTest {
 
     private String userId;
+    private String password;
     private UserRepresentation defaultUser;
 
     @Rule
@@ -118,7 +131,8 @@ public void setup() {
                 .enabled(true)
                 .build();
 
-        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), defaultUser, "password");
+        password = generatePassword();
+        userId = ApiUtil.createUserAndResetPasswordWithAdminClient(testRealm(), defaultUser, password);
         defaultUser.setId(userId);
         expectedMessagesCount = 0;
         getCleanup().addUserId(userId);
@@ -178,7 +192,7 @@ public void resetPasswordLink() throws IOException, MessagingException {
     public void resetPasswordLoggedUser() throws IOException {
         String username = "login-test";
         loginPage.open();
-        loginPage.login(username, "password");
+        loginPage.login(username, password);
 
         events.expectLogin().user(userId).detail(Details.USERNAME, username).assertEvent();
 
@@ -234,7 +248,9 @@ private void openResetPasswordUrlAndDoFlow(String resetUri, String expectedClien
         updatePasswordPage.assertCurrent();
 
         if(userAuthenticated) {
-            updatePasswordPage.uncheckLogoutSessions();
+            assertFalse("Logout other sessions was ticked", updatePasswordPage.isLogoutSessionsChecked());
+        } else {
+            updatePasswordPage.checkLogoutSessions();
         }
 
         updatePasswordPage.changePassword("resetPassword", "resetPassword");
@@ -332,6 +348,44 @@ public void resetPasswordTwice() throws IOException, MessagingException {
         assertSecondPasswordResetFails(changePasswordUrl, oauth.getClientId()); // KC_RESTART doesn't exist, it was deleted after first successful reset-password flow was finished
     }
 
+    @Test
+    public void resetPasswordForceLogin() throws IOException, MessagingException {
+        // add the force login option in the reset-credential-email authenticator
+        configureForceLogin(Boolean.TRUE.toString());
+
+        resetPassword("login-test", "resetPassword", true);
+    }
+
+    @Test
+    public void resetPasswordForceLoginFederatedUser() throws IOException, MessagingException {
+        // create the example map storage user federation
+        ComponentRepresentation memProvider = new ComponentRepresentation();
+        memProvider.setName(UserStorageProvider.class.getName());
+        memProvider.setProviderId(UserMapStorageFactory.PROVIDER_ID);
+        memProvider.setProviderType(UserStorageProvider.class.getName());
+        memProvider.setConfig(new MultivaluedHashMap<>());
+        memProvider.getConfig().putSingle("priority", Integer.toString(0));
+        memProvider.getConfig().putSingle(UserStorageProviderModel.IMPORT_ENABLED, Boolean.toString(false));
+        String componentId = ApiUtil.getCreatedId(testRealm().components().add(memProvider));
+        getCleanup().addComponentId(componentId);
+
+        // remove the test user and create it but federated
+        testRealm().users().get(userId).remove();
+        UserRepresentation user = new UserRepresentation();
+        user.setUsername("login-test");
+        user.setEmail("login@test.com");
+        user.setFederationLink(componentId);
+        this.userId = ApiUtil.getCreatedId(testRealm().users().create(user));
+        Assert.assertFalse(StorageId.isLocalStorage(userId));
+
+        // by default federated users are force to re-login
+        resetPassword("login-test", "resetPassword", true);
+
+        // check with false the session is maintained
+        configureForceLogin(Boolean.FALSE.toString());
+        resetPassword("login-test", "resetPassword", false);
+    }
+
     @Test
     public void resetPasswordTwiceInNewBrowser() throws IOException, MessagingException {
         String changePasswordUrl = resetPassword("login-test");
@@ -371,12 +425,12 @@ public void resetPasswordCancelChangeUser() throws IOException, MessagingExcepti
                 .session((String) null)
                 .detail(Details.EMAIL, "test-user@localhost").assertEvent();
 
-        loginPage.login("login@test.com", "password");
+        loginPage.login("login@test.com", password);
 
         EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "login@test.com").assertEvent();
 
-        String code = oauth.getCurrentQuery().get("code");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, tokenResponse.getStatusCode());
         assertEquals(userId, oauth.verifyToken(tokenResponse.getAccessToken()).getSubject());
@@ -399,11 +453,29 @@ public void resetPasswordBackButton() throws IOException, MessagingException {
         loginPage.assertCurrent();
     }
 
+    private void configureForceLogin(String value) {
+        AuthenticationExecutionInfoRepresentation sendEmailExec = testRealm()
+                .flows()
+                .getExecutions(DefaultAuthenticationFlows.RESET_CREDENTIALS_FLOW)
+                .stream()
+                .filter(e -> ResetCredentialEmail.PROVIDER_ID.equals(e.getProviderId()))
+                .findAny().orElseThrow();
+        AuthenticatorConfigRepresentation config = new AuthenticatorConfigRepresentation();
+        config.setAlias("reset-password-config");
+        config.getConfig().put(ResetCredentialEmail.FORCE_LOGIN, value);
+        String configId = ApiUtil.getCreatedId(testRealm().flows().newExecutionConfig(sendEmailExec.getId(), config));
+        getCleanup().addAuthenticationConfigId(configId);
+    }
+
     private String resetPassword(String username) throws IOException, MessagingException {
-        return resetPassword(username, "resetPassword");
+        return resetPassword(username, "resetPassword", false);
     }
 
     private String resetPassword(String username, String password) throws IOException, MessagingException {
+        return resetPassword(username, password, false);
+    }
+
+    private String resetPassword(String username, String password, boolean relogin) throws IOException, MessagingException {
         initiateResetPasswordFromResetPasswordPage(username);
 
         events.expectRequiredAction(EventType.SEND_RESET_PASSWORD)
@@ -430,29 +502,40 @@ private String resetPassword(String username, String password) throws IOExceptio
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).user(userId).detail(Details.USERNAME, username.trim()).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).user(userId).detail(Details.USERNAME, username.trim()).assertEvent();
 
-        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        if (relogin) {
+            // relogin is forced therefore the info page should be displayed
+            Assert.assertEquals("Your account has been updated.", infoPage.getInfo());
+            String backToAppLink = infoPage.getBackToApplicationLink();
+            ClientRepresentation client = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app").toRepresentation();
+            Assert.assertEquals(backToAppLink, client.getBaseUrl());
+            loginPage.open();
+            loginPage.assertCurrent();
+        } else {
+            // continue to app because it is the same browser and auth session exists
+            assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, username.trim()).assertEvent();
-        String sessionId = loginEvent.getSessionId();
+            EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, username.trim()).assertEvent();
+            String sessionId = loginEvent.getSessionId();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+            AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
-        events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent();
+            events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent();
 
-        loginPage.open();
+            loginPage.open();
 
-        loginPage.login("login-test", password);
+            loginPage.login("login-test", password);
 
-        loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
-        sessionId = loginEvent.getSessionId();
+            loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
+            sessionId = loginEvent.getSessionId();
 
-        assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-        tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+            tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
-        events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent();
+            events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent();
+        }
 
         return changePasswordUrl;
     }
@@ -693,12 +776,12 @@ public void resetPasswordExpiredCodeAndAuthSession() throws IOException, Messagi
 
             String changePasswordUrl = MailUtils.getPasswordResetEmailLink(message).replace("&amp;", "&");
 
+            log.debug("Removing cookies."); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
+            driver.manage().deleteAllCookies();
+
             setTimeOffset(70);
 
             log.debug("Going to reset password URI.");
-            driver.navigate().to(oauth.AUTH_SERVER_ROOT + "/realms/test/login-actions/reset-credentials"); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
-            log.debug("Removing cookies.");
-            driver.manage().deleteAllCookies();
             driver.navigate().to(changePasswordUrl.trim());
 
             errorPage.assertCurrent();
@@ -736,13 +819,13 @@ public void resetPasswordExpiredCodeAndAuthSessionPerActionLifespan() throws IOE
 
             String changePasswordUrl = MailUtils.getPasswordResetEmailLink(message).replace("&amp;", "&");
 
+            log.debug("Removing cookies."); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
+            driver.manage().deleteAllCookies();
+
             setTimeOffset(70);
 
             log.debug("Going to reset password URI.");
-            driver.navigate().to(oauth.AUTH_SERVER_ROOT + "/realms/test/login-actions/reset-credentials"); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
-            log.debug("Removing cookies.");
-            driver.manage().deleteAllCookies();
-            driver.navigate().to(changePasswordUrl.trim());
+            URLUtils.navigateToUri(changePasswordUrl.trim());
 
             errorPage.assertCurrent();
             Assert.assertEquals("Action expired.", errorPage.getError());
@@ -780,12 +863,12 @@ public void resetPasswordExpiredCodeAndAuthSessionPerActionMultipleTimeouts() th
 
             String changePasswordUrl = MailUtils.getPasswordResetEmailLink(message).replace("&amp;", "&");
 
+            log.debug("Removing cookies."); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
+            driver.manage().deleteAllCookies();
+
             setTimeOffset(70);
 
             log.debug("Going to reset password URI.");
-            driver.navigate().to(oauth.AUTH_SERVER_ROOT + "/realms/test/login-actions/reset-credentials"); // This is necessary to delete KC_RESTART cookie that is restricted to /auth/realms/test path
-            log.debug("Removing cookies.");
-            driver.manage().deleteAllCookies();
             driver.navigate().to(changePasswordUrl.trim());
 
             errorPage.assertCurrent();
@@ -814,7 +897,7 @@ public void resetPasswordExpiredCodeForgotPasswordFlow() throws IOException, Mes
 
         try {
             // Redirect directly to KC "forgot password" endpoint instead of "authenticate" endpoint
-            String loginUrl = oauth.getLoginFormUrl();
+            String loginUrl = oauth.loginForm().build();
             String forgotPasswordUrl = loginUrl.replace("/auth?", "/forgot-credentials?"); // Workaround, but works
 
             driver.navigate().to(forgotPasswordUrl);
@@ -862,7 +945,7 @@ public void resetPasswordExpiredCodeForgotPasswordFlowPerActionLifespan() throws
 
         try {
             // Redirect directly to KC "forgot password" endpoint instead of "authenticate" endpoint
-            String loginUrl = oauth.getLoginFormUrl();
+            String loginUrl = oauth.loginForm().build();
             String forgotPasswordUrl = loginUrl.replace("/auth?", "/forgot-credentials?"); // Workaround, but works
 
             driver.navigate().to(forgotPasswordUrl);
@@ -911,7 +994,7 @@ public void resetPasswordExpiredCodeForgotPasswordFlowPerActionMultipleTimeouts(
 
         try {
             // Redirect directly to KC "forgot password" endpoint instead of "authenticate" endpoint
-            String loginUrl = oauth.getLoginFormUrl();
+            String loginUrl = oauth.loginForm().build();
             String forgotPasswordUrl = loginUrl.replace("/auth?", "/forgot-credentials?"); // Workaround, but works
 
             driver.navigate().to(forgotPasswordUrl);
@@ -1011,9 +1094,9 @@ public void resetPasswordWrongSmtp() throws IOException, MessagingException, Int
 
             resetPasswordPage.changePassword("login-test");
 
-            errorPage.assertCurrent();
+            loginPage.assertCurrent();
 
-            assertEquals("Failed to send email, please try again later.", errorPage.getError());
+            assertEquals("You should receive an email shortly with further instructions.", loginPage.getSuccessMessage());
 
             assertEquals(0, greenMail.getReceivedMessages().length);
 
@@ -1069,8 +1152,8 @@ public void resetPasswordWithLengthPasswordPolicy() throws IOException, Messagin
         EventRepresentation loginEvent = events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
         String sessionId = loginEvent.getSessionId();
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
 
         events.expectLogout(sessionId).user(userId).session(sessionId).assertEvent();
 
@@ -1127,7 +1210,7 @@ public void resetPasswordWithPasswordHistoryPolicy() throws IOException, Messagi
             resetPasswordInvalidPassword("login-test", "password3", "Invalid password: must not be equal to any of last 3 passwords.");
 
             setTimeOffset(8000000);
-            resetPassword("login-test", "password");
+            resetPassword("login-test", password);
         } finally {
             setTimeOffset(0);
         }
@@ -1288,8 +1371,7 @@ public void resetPasswordLinkNewTabAndProperRedirectClient() throws IOException
             resetPasswordInNewTab(defaultUser, CLIENT_ID, REDIRECT_URI);
             assertThat(driver.getCurrentUrl(), Matchers.containsString(REDIRECT_URI));
 
-            String logoutUrl = oauth.getLogoutUrl().build();
-            driver.navigate().to(logoutUrl);
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
 
@@ -1354,7 +1436,7 @@ public void changeEmailAddressAfterSendingEmail() throws IOException {
     @Test
     public void resetPasswordWithLoginHint() throws IOException {
         // Redirect directly to KC "forgot password" endpoint instead of "authenticate" endpoint
-        String loginUrl = oauth.getLoginFormUrl();
+        String loginUrl = oauth.loginForm().build();
         String forgotPasswordUrl = loginUrl.replace("/auth?", "/forgot-credentials?"); // Workaround, but works
 
         driver.navigate().to(forgotPasswordUrl + "&login_hint=test");
@@ -1372,7 +1454,7 @@ private void changePasswordOnUpdatePage(WebDriver driver) {
         confirmPassword.sendKeys("resetPassword");
         final WebElement submit = driver.findElement(By.cssSelector("button[type=\"submit\"]"));
 
-        submit.click();
+        UIUtils.clickLink(submit);
     }
 
     private void resetPasswordInNewTab(UserRepresentation user, String clientId, String redirectUri) throws IOException {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RestartCookieTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RestartCookieTest.java
index 7f3ea7772e62..629280767fbd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RestartCookieTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/RestartCookieTest.java
@@ -52,7 +52,7 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.ParResponse;
 import org.keycloak.util.TokenUtil;
 import org.openqa.selenium.Cookie;
 
@@ -129,7 +129,7 @@ protected void afterAbstractKeycloakTestRealmImport() {
     @Test
     public void testRestartCookie() {
         loginPage.open();
-        String restartCookie = loginPage.getDriver().manage().getCookieNamed(RestartLoginCookie.KC_RESTART).getValue();
+        String restartCookie = driver.manage().getCookieNamed(RestartLoginCookie.KC_RESTART).getValue();
         assertRestartCookie(restartCookie);
     }
 
@@ -143,10 +143,10 @@ public void testRestartCookieWithPar() {
                 .attribute(ParConfig.REQUIRE_PUSHED_AUTHORIZATION_REQUESTS, "true")
                 .build());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
         String requestUri = null;
         try {
-            OAuthClient.ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, "secret");
+            ParResponse pResp = oauth.doPushedAuthorizationRequest();
             assertEquals(201, pResp.getStatusCode());
             requestUri = pResp.getRequestUri();
         }
@@ -157,12 +157,9 @@ public void testRestartCookieWithPar() {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUri);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
 
-        oauth.openLoginForm();
-        String restartCookie = loginPage.getDriver().manage().getCookieNamed(RestartLoginCookie.KC_RESTART).getValue();
+        oauth.loginForm().requestUri(requestUri).state("testRestartCookieWithPar").open();
+        String restartCookie = driver.manage().getCookieNamed(RestartLoginCookie.KC_RESTART).getValue();
         assertRestartCookie(restartCookie);
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/SSOTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/SSOTest.java
index 399de885d550..86a39353c316 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/SSOTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/SSOTest.java
@@ -22,24 +22,23 @@
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.credential.PasswordCredentialModel;
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.drone.Different;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.util.MutualTLSUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.openqa.selenium.WebDriver;
 
 import static org.junit.Assert.assertEquals;
@@ -53,7 +52,7 @@
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
  */
-public class SSOTest extends AbstractTestRealmKeycloakTest {
+public class SSOTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Drone
     @Different
@@ -71,17 +70,13 @@ public class SSOTest extends AbstractTestRealmKeycloakTest {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Test
     public void loginSuccess() {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
@@ -112,7 +107,7 @@ public void loginSuccess() {
         // Expire session
         testingClient.testing().removeUserSession("test", sessionId);
 
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
 
         String sessionId4 = events.expectLogin().assertEvent().getSessionId();
         assertNotEquals(sessionId, sessionId4);
@@ -124,28 +119,27 @@ public void loginSuccess() {
     @Test
     public void multipleSessions() {
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation login1 = events.expectLogin().assertEvent();
 
         //OAuthClient oauth2 = new OAuthClient(driver2);
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
 
-        oauth2.doLogin("test-user@localhost", "password");
+        oauth2.doLogin("test-user@localhost", getPassword("test-user@localhost"));
 
         EventRepresentation login2 = events.expectLogin().assertEvent();
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, RequestType.valueOf(driver2.getTitle()));
-        Assert.assertNotNull(oauth2.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth2.parseLoginResponse().getCode());
 
         assertNotEquals(login1.getSessionId(), login2.getSessionId());
 
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(login1);
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(login1);
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).withRedirect().open();
         events.expectLogout(login1.getSessionId()).assertEvent();
 
         oauth.openLoginForm();
@@ -156,12 +150,12 @@ public void multipleSessions() {
 
         events.expectLogin().session(login2.getSessionId()).removeDetail(Details.USERNAME).assertEvent();
         Assert.assertEquals(RequestType.AUTH_RESPONSE, RequestType.valueOf(driver2.getTitle()));
-        Assert.assertNotNull(oauth2.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth2.parseLoginResponse().getCode());
 
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth2).getCode();
-        OAuthClient.AccessTokenResponse response = oauth2.doAccessTokenRequest(code, "password");
+        String code = oauth2.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth2.doAccessTokenRequest(code);
         events.poll();
-        oauth2.idTokenHint(response.getIdToken()).openLogout();
+        oauth2.logoutForm().idTokenHint(response.getIdToken()).withRedirect().open();
         events.expectLogout(login2.getSessionId()).assertEvent();
 
         oauth2.openLoginForm();
@@ -174,10 +168,10 @@ public void multipleSessions() {
     public void loginWithRequiredActionAddedInTheMeantime() {
         // SSO login
         loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
         assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
@@ -191,7 +185,7 @@ public void loginWithRequiredActionAddedInTheMeantime() {
         oauth.openLoginForm();
         updatePasswordPage.assertCurrent();
 
-        updatePasswordPage.changePassword("password", "password");
+        updatePasswordPage.changePassword(getPassword("test-user@localhost"), getPassword("test-user@localhost"));
         events.expectRequiredAction(EventType.UPDATE_PASSWORD).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
         events.expectRequiredAction(EventType.UPDATE_CREDENTIAL).detail(Details.CREDENTIAL_TYPE, PasswordCredentialModel.TYPE).assertEvent();
 
@@ -208,23 +202,25 @@ public void loginWithRequiredActionAddedInTheMeantime() {
     public void failIfUsingCodeFromADifferentSession() throws IOException {
         // first client user login
         oauth.openLoginForm();
-        oauth.doLogin("test-user@localhost", "password");
-        String firstCode = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        oauth.doLogin("test-user@localhost", getPassword("test-user@localhost"));
+        String firstCode = oauth.parseLoginResponse().getCode();
 
         // second client user login
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
-        oauth2.doLogin("john-doh@localhost", "password");
-        String secondCode = oauth2.getCurrentQuery().get(OAuth2Constants.CODE);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
+        oauth2.doLogin("john-doh@localhost", getPassword("john-doh@localhost"));
+        String secondCode = oauth2.parseLoginResponse().getCode();
         String[] firstCodeParts = firstCode.split("\\.");
         String[] secondCodeParts = secondCode.split("\\.");
         secondCodeParts[1] = firstCodeParts[1];
         secondCode = String.join(".", secondCodeParts);
 
-        OAuthClient.AccessTokenResponse tokenResponse;
+        AccessTokenResponse tokenResponse;
 
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithOtherKeyStoreAndTrustStore()) {
-            tokenResponse = oauth2.doAccessTokenRequest(secondCode, "password", client);
+            oauth.httpClient().set(client);
+            tokenResponse = oauth2.doAccessTokenRequest(secondCode);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), tokenResponse.getStatusCode());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ScriptAuthenticatorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ScriptAuthenticatorTest.java
index c4b15061e0dc..67b5a7b54739 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ScriptAuthenticatorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ScriptAuthenticatorTest.java
@@ -74,13 +74,13 @@ public static void enabled() {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
-
+        super.configureTestRealm(testRealm);
         UserRepresentation failUser = UserBuilder.create()
                 .id(UUID.randomUUID().toString())
                 .username("fail")
                 .email("fail@test.com")
                 .enabled(true)
-                .password("password")
+                .password(generatePassword("fail"))
                 .build();
 
         UserRepresentation okayUser = UserBuilder.create()
@@ -88,7 +88,7 @@ public void configureTestRealm(RealmRepresentation testRealm) {
                 .username("user")
                 .email("user@test.com")
                 .enabled(true)
-                .password("password")
+                .password(generatePassword("user"))
                 .build();
 
         RealmBuilder.edit(testRealm)
@@ -162,7 +162,7 @@ public void configureFlows() throws Exception {
     public void loginShouldWorkWithScriptAuthenticator() {
         loginPage.open();
 
-        loginPage.login("user", "password");
+        loginPage.login("user", getPassword("user"));
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "user").assertEvent();
     }
@@ -174,7 +174,7 @@ public void loginShouldWorkWithScriptAuthenticator() {
     public void loginShouldFailWithScriptAuthenticator() {
         loginPage.open();
 
-        loginPage.login("fail", "password");
+        loginPage.login("fail", getPassword("fail"));
 
         events.expect(EventType.LOGIN_ERROR).user((String) null).error(Errors.USER_NOT_FOUND).assertEvent();
     }
@@ -197,7 +197,7 @@ public void scriptWithClientSession()  {
 
         loginPage.open();
 
-        loginPage.login("user", "password");
+        loginPage.login("user", getPassword("user"));
 
         events.expectLogin().user(userId).detail(Details.USERNAME, "user").assertEvent();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/TransientSessionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/TransientSessionTest.java
index 3e024310471b..2012ac50bcac 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/TransientSessionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/TransientSessionTest.java
@@ -24,13 +24,12 @@
 import org.keycloak.models.utils.DefaultAuthenticationFlows;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.RefreshToken;
-import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
@@ -41,25 +40,21 @@
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class TransientSessionTest extends AbstractTestRealmKeycloakTest {
+public class TransientSessionTest extends AbstractChangeImportedUserPasswordsTest {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-    }
-
     @Test
     public void loginSuccess() throws Exception {
         setUpDirectGrantFlowWithSetClientNoteAuthenticator();
 
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
 
         // Signal that we want userSession to be transient
-        oauth.addCustomParameter(SetClientNoteAuthenticator.PREFIX + AuthenticationManager.USER_SESSION_PERSISTENT_STATE, UserSessionModel.SessionPersistenceState.TRANSIENT.toString());
-
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.passwordGrantRequest("test-user@localhost", getPassword("test-user@localhost"))
+                .param(SetClientNoteAuthenticator.PREFIX + AuthenticationManager.USER_SESSION_PERSISTENT_STATE, UserSessionModel.SessionPersistenceState.TRANSIENT.toString())
+                .send();
 
         assertEquals(200, response.getStatusCode());
 
@@ -71,7 +66,7 @@ public void loginSuccess() throws Exception {
         assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
 
         // Refresh will fail. There is no userSession on the server
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertNull(refreshedResponse.getAccessToken());
         assertNotNull(refreshedResponse.getError());
         Assert.assertEquals("Session not active", refreshedResponse.getErrorDescription());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/VerifyProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/VerifyProfileTest.java
index 15395c5fdfe4..ef1a771f4ebe 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/VerifyProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/VerifyProfileTest.java
@@ -16,47 +16,27 @@
  */
 package org.keycloak.testsuite.forms;
 
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_ADMIN;
-import static org.keycloak.userprofile.config.UPConfigUtils.ROLE_USER;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
-
 import org.apache.commons.lang3.StringUtils;
 import org.jboss.arquillian.graphene.page.Page;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.admin.client.resource.UserProfileResource;
-import org.keycloak.common.Profile;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
 import org.keycloak.events.admin.OperationType;
 import org.keycloak.events.admin.ResourceType;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.AdminEventRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.userprofile.config.UPAttribute;
-import org.keycloak.representations.userprofile.config.UPAttributePermissions;
-import org.keycloak.representations.userprofile.config.UPAttributeRequired;
 import org.keycloak.representations.userprofile.config.UPConfig;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
@@ -67,34 +47,38 @@
 import org.keycloak.testsuite.util.ClientScopeBuilder;
 import org.keycloak.testsuite.util.JsonTestUtils;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 import org.keycloak.userprofile.UserProfileContext;
 import org.keycloak.util.JsonSerialization;
 import org.openqa.selenium.By;
 import org.openqa.selenium.WebElement;
 
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.UUID;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.ATTRIBUTE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.CONFIGURATION_FOR_USER_EDIT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_EDITABLE;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ADMIN_ONLY;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.PERMISSIONS_ALL;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.SCOPE_DEPARTMENT;
+import static org.keycloak.testsuite.util.userprofile.UserProfileUtil.VALIDATIONS_LENGTH;
+
 /**
  * @author Vlastimil Elias <velias@redhat.com>
  */
-public class VerifyProfileTest extends AbstractTestRealmKeycloakTest {
-
-    public static final String SCOPE_DEPARTMENT = "department";
-    public static final String ATTRIBUTE_DEPARTMENT = "department";
-
-    public static final String PERMISSIONS_ALL = "\"permissions\": {\"view\": [\"admin\", \"user\"], \"edit\": [\"admin\", \"user\"]}";
-    public static final String PERMISSIONS_ADMIN_ONLY = "\"permissions\": {\"view\": [\"admin\"], \"edit\": [\"admin\"]}";
-    public static final String PERMISSIONS_ADMIN_EDITABLE = "\"permissions\": {\"view\": [\"admin\", \"user\"], \"edit\": [\"admin\"]}";
-
-    public static String VALIDATIONS_LENGTH = "\"validations\": {\"length\": { \"min\": 3, \"max\": 255 }}";
-
-    public static final String CONFIGURATION_FOR_USER_EDIT = "{\"attributes\": ["
-            + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + "},"
-            + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + "},"
-            + "{\"name\": \"department\"," + PERMISSIONS_ALL + "}"
-            + "]}";
-
+public class VerifyProfileTest extends AbstractChangeImportedUserPasswordsTest {
 
     private static String userId;
 
@@ -121,13 +105,14 @@ protected boolean removeVerifyProfileAtImport() {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
-        UserRepresentation user = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test").email("login@test.com").enabled(true).password("password").build();
-        UserRepresentation user2 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test2").email("login2@test.com").enabled(true).password("password").build();
-        UserRepresentation user3 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test3").email("login3@test.com").enabled(true).password("password").lastName("ExistingLast").build();
-        UserRepresentation user4 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test4").email("login4@test.com").enabled(true).password("password").lastName("ExistingLast").build();
-        UserRepresentation user5 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test5").email("login5@test.com").enabled(true).password("password").firstName("ExistingFirst").lastName("ExistingLast").build();
-        UserRepresentation user6 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test6").email("login6@test.com").enabled(true).password("password").firstName("ExistingFirst").lastName("ExistingLast").build();
-        UserRepresentation userWithoutEmail = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-nomail").enabled(true).password("password").firstName("NoMailFirst").lastName("NoMailLast").build();
+        super.configureTestRealm(testRealm);
+        UserRepresentation user = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test").email("login@test.com").enabled(true).password(generatePassword("login-test")).build();
+        UserRepresentation user2 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test2").email("login2@test.com").enabled(true).password(generatePassword("login-test2")).build();
+        UserRepresentation user3 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test3").email("login3@test.com").enabled(true).password(generatePassword("login-test3")).lastName("ExistingLast").build();
+        UserRepresentation user4 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test4").email("login4@test.com").enabled(true).password(generatePassword("login-test4")).lastName("ExistingLast").build();
+        UserRepresentation user5 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test5").email("login5@test.com").enabled(true).password(generatePassword("login-test5")).firstName("ExistingFirst").lastName("ExistingLast").build();
+        UserRepresentation user6 = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-test6").email("login6@test.com").enabled(true).password(generatePassword("login-test6")).firstName("ExistingFirst").lastName("ExistingLast").build();
+        UserRepresentation userWithoutEmail = UserBuilder.create().id(UUID.randomUUID().toString()).username("login-nomail").enabled(true).password(generatePassword("login-nomail")).firstName("NoMailFirst").lastName("NoMailLast").build();
 
         RealmBuilder.edit(testRealm).user(user).user(user2).user(user3).user(user4).user(user5).user(user6).user(userWithoutEmail);
 
@@ -185,7 +170,7 @@ public void testDisplayName() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -205,18 +190,18 @@ public void testAttributeGrouping() {
         updateUser(user5Id, "ExistingFirst", "ExistingLast", null);
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"group\": \"contact\"}"
+                + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"department\", " + PERMISSIONS_ALL + ", \"required\":{}, \"group\": \"company\"},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + ", \"group\": \"contact\"}"
                 + "], \"groups\": ["
                 + "{\"name\": \"company\", \"displayDescription\": \"Company field desc\" },"
                 + "{\"name\": \"contact\" }"
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -244,11 +229,11 @@ public void testAttributeGuiOrder() {
         updateUser(user5Id, "ExistingFirst", "ExistingLast", null);
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"lastName\"," + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}},"
-                + "{\"name\": \"username\", " + VerifyProfileTest.PERMISSIONS_ALL + "},"
-                + "{\"name\": \"firstName\"," + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\": {}},"
-                + "{\"name\": \"email\", " + VerifyProfileTest.PERMISSIONS_ALL + "}"
+                + "{\"name\": \"lastName\"," + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"department\", " + PERMISSIONS_ALL + ", \"required\":{}},"
+                + "{\"name\": \"username\", " + PERMISSIONS_ALL + "},"
+                + "{\"name\": \"firstName\"," + PERMISSIONS_ALL + ", \"required\": {}},"
+                + "{\"name\": \"email\", " + PERMISSIONS_ALL + "}"
                 + "]}");
 
         RealmRepresentation realm = testRealm().toRepresentation();
@@ -256,7 +241,7 @@ public void testAttributeGuiOrder() {
         testRealm().update(realm);
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -277,12 +262,12 @@ public void testAttributeInputTypes() {
         updateUser(user5Id, "ExistingFirst", "ExistingLast", null);
 
         setUserProfileConfiguration("{\"attributes\": ["
-                + "{\"name\": \"department\", " + VerifyProfileTest.PERMISSIONS_ALL + ", \"required\":{}},"
+                + "{\"name\": \"department\", " + PERMISSIONS_ALL + ", \"required\":{}},"
                 + RegisterWithUserProfileTest.UP_CONFIG_PART_INPUT_TYPES
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -302,7 +287,7 @@ public void testEvents() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
         //event when form is shown
@@ -328,7 +313,7 @@ public void testDefaultProfile() {
         testingClient.server(TEST_REALM_NAME).run(setEmptyFirstNameAndCustomAttribute());
 
         loginPage.open();
-        loginPage.login("login-test", "password");
+        loginPage.login("login-test", getPassword("login-test"));
 
         //submit with error
         verifyProfilePage.assertCurrent();
@@ -342,7 +327,7 @@ public void testDefaultProfile() {
 
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(userId);
         assertEquals("First", user.getFirstName());
@@ -382,7 +367,7 @@ public void testUsernameOnlyIfEditAllowed() {
             testRealm().update(realm);
 
             loginPage.open();
-            loginPage.login("login-test5", "password");
+            loginPage.login("login-test5", getPassword("login-test5"));
 
             verifyProfilePage.assertCurrent();
             assertFalse(verifyProfilePage.isUsernamePresent());
@@ -414,7 +399,7 @@ public void testUsernameOnlyIfEmailAsUsernameIsDisabled() {
             testRealm().update(realm);
 
             loginPage.open();
-            loginPage.login("login-test5", "password");
+            loginPage.login("login-test5", getPassword("login-test5"));
 
             verifyProfilePage.assertCurrent();
             assertFalse(verifyProfilePage.isUsernamePresent());
@@ -445,7 +430,6 @@ public void testUsernameOnlyIfEmailAsUsernameIsDisabled() {
     }
 
     @Test
-    @EnableFeature(Profile.Feature.UPDATE_EMAIL)
     public void testUsernameOnlyIfEmailAsUsernameIsDisabledWithUpdateEmailFeature() throws Exception {
         reconnectAdminClient();
         RealmRepresentation realm = testRealm().toRepresentation();
@@ -453,6 +437,8 @@ public void testUsernameOnlyIfEmailAsUsernameIsDisabledWithUpdateEmailFeature()
         setUserProfileConfiguration(CONFIGURATION_FOR_USER_EDIT);
         updateUser(user5Id, null, "ExistingLast", null);
 
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
+
         try {
             setUserProfileConfiguration(null);
 
@@ -461,7 +447,7 @@ public void testUsernameOnlyIfEmailAsUsernameIsDisabledWithUpdateEmailFeature()
             testRealm().update(realm);
 
             loginPage.open();
-            loginPage.login("login-test5", "password");
+            loginPage.login("login-test5", getPassword("login-test5"));
 
             verifyProfilePage.assertCurrent();
             assertFalse(verifyProfilePage.isUsernamePresent());
@@ -485,6 +471,7 @@ public void testUsernameOnlyIfEmailAsUsernameIsDisabledWithUpdateEmailFeature()
             assertTrue(verifyProfilePage.isUsernamePresent());
             assertFalse(verifyProfilePage.isEmailPresent());
         } finally {
+            ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, false);
             realm.setEditUsernameAllowed(false);
             realm.setRegistrationEmailAsUsername(false);
             testRealm().update(realm);
@@ -499,13 +486,13 @@ public void testOptionalAttribute() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test2", "password");
+        loginPage.login("login-test2", getPassword("login-test2"));
 
         verifyProfilePage.assertCurrent();
         verifyProfilePage.update("First", "");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user2Id);
         assertEquals("First", user.getFirstName());
@@ -525,7 +512,7 @@ public void testCustomValidationLastName() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
         //submit with error
@@ -536,7 +523,7 @@ public void testCustomValidationLastName() {
         verifyProfilePage.update("First", "Last");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("First", user.getFirstName());
@@ -557,10 +544,10 @@ public void testNoActionIfNoValidationError() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
     @Test
@@ -582,10 +569,10 @@ public void testDoNotValidateUsernameWhenRegistrationAsEmailEnabled() {
                     + "]}");
 
             loginPage.open();
-            loginPage.login("login6@test.com", "password");
+            loginPage.login("login6@test.com", getPassword("login-test6"));
 
             Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+            Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         } finally {
             realm.setRegistrationEmailAsUsername(false);
             realmResource.update(realm);
@@ -602,7 +589,7 @@ public void testRequiredReadOnlyAttribute() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test3", "password");
+        loginPage.login("login-test3", getPassword("login-test3"));
 
         verifyProfilePage.assertCurrent();
         Assert.assertEquals("ExistingLast", verifyProfilePage.getLastName());
@@ -612,7 +599,7 @@ public void testRequiredReadOnlyAttribute() {
         verifyProfilePage.update("First", "Last");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user3Id);
         assertEquals("First", user.getFirstName());
@@ -630,7 +617,7 @@ public void testAdminOnlyAttributeNotVisibleToUser() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test6", "password");
+        loginPage.login("login-test6", getPassword("login-test6"));
 
         verifyProfilePage.assertCurrent();
         Assert.assertEquals("ExistingLast", verifyProfilePage.getLastName());
@@ -649,7 +636,7 @@ public void testUsernameReadOnlyInProfile() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test6", "password");
+        loginPage.login("login-test6", getPassword("login-test6"));
 
         verifyProfilePage.assertCurrent();
         Assert.assertEquals("ExistingLast", verifyProfilePage.getLastName());
@@ -668,7 +655,7 @@ public void testUsernameReadNotVisibleInProfile() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test6", "password");
+        loginPage.login("login-test6", getPassword("login-test6"));
 
         verifyProfilePage.assertCurrent();
         Assert.assertEquals("ExistingLast", verifyProfilePage.getLastName());
@@ -687,7 +674,7 @@ public void testEMailRequiredInProfileWithLocalPartLength() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-nomail", "password");
+        loginPage.login("login-nomail", getPassword("login-nomail"));
 
         // no email is set => expect verify profile page to be displayed
         verifyProfilePage.assertCurrent();
@@ -700,7 +687,7 @@ public void testEMailRequiredInProfileWithLocalPartLength() {
         verifyProfilePage.updateEmail("abcdef0123456789@bar.com", "HasNowMailFirst", "HasNowMailLast");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(userWithoutEmailId);
         assertEquals("HasNowMailFirst", user.getFirstName());
@@ -718,7 +705,7 @@ public void testAttributeNotVisible() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test4", "password");
+        loginPage.login("login-test4", getPassword("login-test4"));
 
         verifyProfilePage.assertCurrent();
         Assert.assertEquals("ExistingLast", verifyProfilePage.getLastName());
@@ -728,7 +715,7 @@ public void testAttributeNotVisible() {
         verifyProfilePage.update("First", "Last");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user4Id);
         assertEquals("First", user.getFirstName());
@@ -748,7 +735,7 @@ public void testRequiredAttribute() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -760,7 +747,7 @@ public void testRequiredAttribute() {
         verifyProfilePage.update("FirstCC", "LastCC", "DepartmentCC");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstCC", user.getFirstName());
@@ -781,7 +768,7 @@ public void testRequiredOnlyIfUser() {
 
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -794,7 +781,7 @@ public void testRequiredOnlyIfUser() {
 
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstCC", user.getFirstName());
@@ -815,10 +802,10 @@ public void testAttributeNotRequiredWhenMissingScope() {
 
         oauth.clientId(client_scope_optional.getClientId()).openLoginForm();
 
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("ExistingFirst", user.getFirstName());
@@ -839,14 +826,14 @@ public void testAttributeRequiredForScope() {
         oauth.scope(SCOPE_DEPARTMENT).clientId(client_scope_optional.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
         verifyProfilePage.update("FirstAA", "LastAA", "DepartmentAA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstAA", user.getFirstName());
@@ -868,7 +855,7 @@ public void testAttributeRequiredForDefaultScope() {
         oauth.clientId(client_scope_default.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -880,7 +867,7 @@ public void testAttributeRequiredForDefaultScope() {
         verifyProfilePage.update("FirstBB", "LastBB", "DepartmentBB");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstBB", user.getFirstName());
@@ -902,10 +889,10 @@ public void testNoActionIfValidForScope() {
         oauth.clientId(client_scope_default.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("ExistingFirst", user.getFirstName());
@@ -928,10 +915,10 @@ public void testAttributeRequiredButNotSelectedByScopeDoesntForceVerificationScr
         oauth.clientId(client_scope_optional.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
     @Test
@@ -949,14 +936,14 @@ public void testAttributeRequiredAndSelectedByScope() {
         oauth.scope(SCOPE_DEPARTMENT).clientId(client_scope_optional.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
         verifyProfilePage.update("FirstAA", "LastAA", "DepartmentAA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstAA", user.getFirstName());
@@ -979,7 +966,7 @@ public void testAttributeNotRequiredAndSelectedByScopeCanBeUpdatedFromVerificati
         oauth.scope(SCOPE_DEPARTMENT).clientId(client_scope_optional.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -987,7 +974,7 @@ public void testAttributeNotRequiredAndSelectedByScopeCanBeUpdatedFromVerificati
         verifyProfilePage.update("FirstAA", "LastAA", "Department AA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstAA", user.getFirstName());
@@ -1010,7 +997,7 @@ public void testAttributeRequiredButNotSelectedByScopeIsNotRenderedOnVerificatio
         oauth.clientId(client_scope_optional.getClientId()).openLoginForm();
 
         loginPage.assertCurrent();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -1018,7 +1005,7 @@ public void testAttributeRequiredButNotSelectedByScopeIsNotRenderedOnVerificatio
         verifyProfilePage.update("FirstAA", "LastAA");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstAA", user.getFirstName());
@@ -1039,7 +1026,7 @@ public void testCustomValidationInCustomAttribute() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -1052,7 +1039,7 @@ public void testCustomValidationInCustomAttribute() {
 
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("FirstCC", user.getFirstName());
@@ -1071,7 +1058,7 @@ public void testEmailChangeSetsEmailVerified() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         verifyProfilePage.assertCurrent();
 
@@ -1079,7 +1066,7 @@ public void testEmailChangeSetsEmailVerified() {
         verifyProfilePage.updateEmail("newemail@test.org","FirstCC", "LastCC");
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         UserRepresentation user = getUser(user5Id);
         assertEquals("newemail@test.org", user.getEmail());
@@ -1099,10 +1086,10 @@ public void testNoActionIfSuccessfulValidationForCustomAttribute() {
                 + "]}");
 
         loginPage.open();
-        loginPage.login("login-test5", "password");
+        loginPage.login("login-test5", getPassword("login-test5"));
 
         Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
     @Test
@@ -1136,7 +1123,7 @@ protected void updateUser(String userId, boolean emailVerified, String firstName
 
     protected UPConfig setUserProfileConfiguration(String configuration) {
         assertAdminEvents.clear();
-        UPConfig result = setUserProfileConfiguration(testRealm(), configuration);
+        UPConfig result = UserProfileUtil.setUserProfileConfiguration(testRealm(), configuration);
         AdminEventRepresentation adminEvent = assertAdminEvents.assertEvent(TEST_REALM_NAME,
                 OperationType.UPDATE, AdminEventPaths.userProfilePath(), ResourceType.USER_PROFILE);
         Assert.assertTrue("Incorrect representation in event", StringUtils.isBlank(configuration)
@@ -1145,39 +1132,6 @@ protected UPConfig setUserProfileConfiguration(String configuration) {
         return result;
     }
 
-    public static UPConfig setUserProfileConfiguration(RealmResource testRealm, String configuration) {
-        try {
-            UPConfig config = configuration == null ? null : JsonSerialization.readValue(configuration, UPConfig.class);
-
-            if (config != null) {
-                UPAttribute username = config.getAttribute(UserModel.USERNAME);
-
-                if (username == null) {
-                    config.addOrReplaceAttribute(new UPAttribute(UserModel.USERNAME));
-                }
-
-                UPAttribute email = config.getAttribute(UserModel.EMAIL);
-
-                if (email == null) {
-                    config.addOrReplaceAttribute(new UPAttribute(UserModel.EMAIL, new UPAttributePermissions(Set.of(ROLE_USER, ROLE_ADMIN), Set.of(ROLE_USER, ROLE_ADMIN)), new UPAttributeRequired(Set.of(ROLE_USER), Set.of())));
-                }
-            }
-
-            testRealm.users().userProfile().update(config);
-
-            return config;
-        } catch (IOException ioe) {
-            throw new RuntimeException("Failed to read configuration", ioe);
-        }
-    }
-
-    public static UPConfig enableUnmanagedAttributes(UserProfileResource upResource) {
-        UPConfig cfg = upResource.getConfiguration();
-        cfg.setUnmanagedAttributePolicy(UPConfig.UnmanagedAttributePolicy.ENABLED);
-        upResource.update(cfg);
-        return cfg;
-    }
-
     public static UserRepresentation getUser(RealmResource testRealm, String userId) {
         return testRealm.users().get(userId).toRepresentation();
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/EmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/EmailTest.java
index 801a05544feb..0f589d83aa86 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/EmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/EmailTest.java
@@ -26,11 +26,22 @@
 import jakarta.mail.MessagingException;
 import jakarta.mail.internet.MimeMessage;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
+import java.util.LinkedList;
+import java.util.List;
 import java.util.Locale;
-
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import jakarta.ws.rs.core.HttpHeaders;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.message.BasicNameValuePair;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Rule;
@@ -50,6 +61,7 @@
 import org.keycloak.testsuite.util.MailUtils;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.By;
+import org.openqa.selenium.Cookie;
 
 /**
  * @author <a href="mailto:gerbermichi@me.com">Michael Gerber</a>
@@ -81,11 +93,12 @@ private void changeUserLocale(String locale) {
     @Test
     public void restPasswordEmail() throws MessagingException, IOException {
         String expectedBodyContent = "Someone just requested to change";
-        verifyResetPassword("Reset password", expectedBodyContent, 1);
+        sendResetPasswordEmail();
+        verifyResetPassword("Reset password", expectedBodyContent, null, 1);
 
         changeUserLocale("en");
-
-        verifyResetPassword("Reset password", expectedBodyContent, 2);
+        sendResetPasswordEmail();
+        verifyResetPassword("Reset password", expectedBodyContent, null, 2);
     }
 
     @Test
@@ -109,11 +122,13 @@ public void realmLocalizationMessagesAreApplied() throws MessagingException, IOE
         getCleanup().addLocalization(Locale.GERMAN.toLanguageTag());
 
         try {
-            verifyResetPassword(subjectEn, expectedBodyContentEn, 1);
+            sendResetPasswordEmail();
+            verifyResetPassword(subjectEn, expectedBodyContentEn, "<html lang=\"en\" dir=\"ltr\">", 1);
 
             changeUserLocale("de");
 
-            verifyResetPassword(subjectDe, expectedBodyContentDe, 2);
+            sendResetPasswordEmail();
+            verifyResetPassword(subjectDe, expectedBodyContentDe, "<html lang=\"de\" dir=\"ltr\">", 2);
         } finally {
             // Revert
             changeUserLocale("en");
@@ -124,7 +139,8 @@ public void realmLocalizationMessagesAreApplied() throws MessagingException, IOE
     public void restPasswordEmailGerman() throws MessagingException, IOException {
         changeUserLocale("de");
         try {
-            verifyResetPassword("Passwort zurücksetzen", "Es wurde eine Änderung", 1);
+            sendResetPasswordEmail();
+            verifyResetPassword("Passwort zurücksetzen", "Es wurde eine Änderung", null, 1);
         } finally {
             // Revert
             changeUserLocale("en");
@@ -158,12 +174,50 @@ public void updatePasswordFromAdmin() throws MessagingException, IOException {
         }
     }
 
-    private void verifyResetPassword(String expectedSubject, String expectedTextBodyContent, int expectedMsgCount)
-            throws MessagingException, IOException {
+    @Test
+    public void restPasswordEmailWithAcceptLanguageHeader() throws MessagingException, IOException {
+        changeUserLocale(null);
+        try {
+
+            loginPage.open();
+            loginPage.resetPassword();
+
+            try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
+
+                Set<Cookie> cookies =  oauth.getDriver().manage().getCookies();
+                String cookieHeader = cookies.stream()
+                        .map(cookie -> cookie.getName() + "=" + cookie.getValue())
+                        .collect(Collectors.joining("; "));
+                String resetFormUrl = resetPasswordPage.getFormUrl();
+
+                HttpPost post = new HttpPost(resetFormUrl);
+                post.setHeader(HttpHeaders.COOKIE, cookieHeader);
+                post.addHeader(HttpHeaders.ACCEPT_LANGUAGE, "de");
+
+                List<NameValuePair> parameters = new LinkedList<>();
+                parameters.add(new BasicNameValuePair("username", "login-test"));
+                UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
+                post.setEntity(formEntity);
+
+                CloseableHttpResponse response = client.execute(post);
+                assertEquals(200, response.getStatusLine().getStatusCode());
+            }
+            verifyResetPassword("Passwort zurücksetzen", "Es wurde eine Änderung", null, 1);
+        } finally {
+            // Revert
+            changeUserLocale("en");
+        }
+    }
+
+
+    private void sendResetPasswordEmail() {
         loginPage.open();
         loginPage.resetPassword();
         resetPasswordPage.changePassword("login-test");
+    }
 
+    private void verifyResetPassword(String expectedSubject, String expectedTextBodyContent, String expectedHtmlBodyContent, int expectedMsgCount)
+            throws MessagingException, IOException {
         assertEquals(expectedMsgCount, greenMail.getReceivedMessages().length);
 
         MimeMessage message = greenMail.getReceivedMessages()[expectedMsgCount - 1];
@@ -175,6 +229,11 @@ private void verifyResetPassword(String expectedSubject, String expectedTextBody
         // make sure all placeholders have been replaced
         assertThat(textBody, not(containsString("{")));
         assertThat(textBody, not(containsString("}")));
+
+        if (expectedHtmlBodyContent != null) {
+            String htmlBody = MailUtils.getBody(message).getHtml();
+            assertThat(htmlBody, containsString(expectedHtmlBodyContent));
+        }
     }
 
     //KEYCLOAK-7478
@@ -226,10 +285,8 @@ public void changeLocaleOnInfoPage() throws InterruptedException, IOException {
     // Issue 10981
     @Test
     public void resetPasswordOriginalUiLocalePreservedAfterForgetPassword() throws MessagingException, IOException {
-        oauth.uiLocales("de");
-
         // Assert login page is in german
-        loginPage.open();
+        oauth.loginForm().uiLocales("de").open();
         assertEquals("Deutsch", loginPage.getLanguageDropdownText());
 
         // Click "Forget password"
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/LoginPageTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/LoginPageTest.java
index 03e1cb20fc38..c0a8531c7545 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/LoginPageTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/i18n/LoginPageTest.java
@@ -27,7 +27,6 @@
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.cookie.CookieType;
@@ -43,10 +42,14 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LanguageComboboxAwarePage;
+import org.keycloak.testsuite.pages.LoginExpiredPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
+import org.keycloak.testsuite.pages.PageUtils;
+import org.keycloak.testsuite.updaters.UserAttributeUpdater;
 import org.keycloak.testsuite.util.IdentityProviderBuilder;
+import org.keycloak.testsuite.util.UIUtils;
 import org.openqa.selenium.Cookie;
 
 import java.io.IOException;
@@ -57,6 +60,7 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
 
@@ -81,6 +85,9 @@ public class LoginPageTest extends AbstractI18NTest {
     @Page
     protected OAuthGrantPage grantPage;
 
+    @Page
+    protected LoginExpiredPage loginExpiredPage;
+
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
@@ -117,26 +124,23 @@ public void languageDropdown() {
 
     @Test
     public void uiLocalesParameter() {
-        loginPage.open();
+        oauth.loginForm().open();
         assertEquals("English", loginPage.getLanguageDropdownText());
 
         //test if cookie works
-        oauth.uiLocales("de");
-        loginPage.open();
+        oauth.loginForm().uiLocales("de").open();
         assertEquals("Deutsch", loginPage.getLanguageDropdownText());
 
         driver.manage().deleteAllCookies();
-        loginPage.open();
+        oauth.loginForm().uiLocales("de").open();
         assertEquals("Deutsch", loginPage.getLanguageDropdownText());
 
-        oauth.uiLocales("en de");
         driver.manage().deleteAllCookies();
-        loginPage.open();
+        oauth.loginForm().uiLocales("en de").open();
         assertEquals("English", loginPage.getLanguageDropdownText());
 
-        oauth.uiLocales("fr de");
         driver.manage().deleteAllCookies();
-        loginPage.open();
+        oauth.loginForm().uiLocales("fr de").open();
         assertEquals("Deutsch", loginPage.getLanguageDropdownText());
     }
 
@@ -145,8 +149,7 @@ public void htmlLangAttributeWithInternationalizationEnabled() {
         loginPage.open();
         assertEquals("en", loginPage.getHtmlLanguage());
 
-        oauth.uiLocales("de");
-        loginPage.open();
+        oauth.loginForm().uiLocales("de").open();
         assertEquals("de", loginPage.getHtmlLanguage());
     }
 
@@ -181,9 +184,10 @@ public void acceptLanguageHeader() throws IOException {
     @Test
     public void testIdentityProviderCapitalization(){
         loginPage.open();
-        assertEquals("GitHub", loginPage.findSocialButton("github").getText());
-        assertEquals("mysaml", loginPage.findSocialButton("mysaml").getText());
-        assertEquals("MyOIDC", loginPage.findSocialButton("myoidc").getText());
+        // contains even name of sub-item - svg element in this case
+        assertThat(loginPage.findSocialButton("github").getText(), is("GitHub"));
+        assertThat(loginPage.findSocialButton("mysaml").getText(), is("mysaml"));
+        assertThat(loginPage.findSocialButton("myoidc").getText(), is("MyOIDC"));
     }
 
 
@@ -208,7 +212,7 @@ public void languageChangeRequiredActions() {
         changePasswordPage.changePassword("password", "password");
 
         assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
 
@@ -216,7 +220,7 @@ public void languageChangeRequiredActions() {
     @Test
     public void languageChangeConsentScreen() {
         // Set client, which requires consent
-        oauth.clientId("third-party");
+        oauth.client("third-party", "password");
 
         loginPage.open();
 
@@ -232,10 +236,10 @@ public void languageChangeConsentScreen() {
         grantPage.accept();
 
         assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         // Revert client
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
     }
 
     @Test
@@ -265,8 +269,8 @@ public void languageUserUpdates() {
         UserRepresentation userRep = user.toRepresentation();
         assertEquals("de", userRep.getAttributes().get("locale").get(0));
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
 
         loginPage.open();
@@ -283,8 +287,8 @@ public void languageUserUpdates() {
         userRep = user.toRepresentation();
         Assert.assertNull(userRep.getAttributes());
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
+        code = oauth.parseLoginResponse().getCode();
+        idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
         appPage.logout(idTokenHint);
 
         loginPage.open();
@@ -343,6 +347,31 @@ public void languageUserUpdatesOnErrorPageStateCheckerTest() throws URISyntaxExc
         Assert.assertEquals("Die Aktion ist nicht mehr gültig.", errorPage.getError()); // Action expired.
     }
 
+    @Test
+    public void languageUserUpdatesOnExpiredPage() throws Exception {
+        try (UserAttributeUpdater userUpdater = UserAttributeUpdater.forUserByUsername(testRealm(), "test-user@localhost")
+                .setRequiredActions(UserModel.RequiredAction.UPDATE_PASSWORD).update()) {
+            // login with a failure attempt
+            loginPage.open();
+            loginPage.login("test-user@localhost", "invalid-password");
+            loginPage.assertCurrent();
+            assertThat(loginPage.getUsernameInputError(), is("Invalid username or password."));
+            loginPage.login("test-user@localhost", "password");
+            changePasswordPage.assertCurrent();
+
+            // navigate back to the login expired page and change language to german
+            UIUtils.navigateBackWithRefresh(driver, loginExpiredPage);
+            errorPage.openLanguage("Deutsch");
+            assertEquals("Deutsch", errorPage.getLanguageDropdownText());
+            assertThat(PageUtils.getPageTitle(driver), is("Diese Seite ist nicht mehr gültig."));
+
+            // continue should show password update in german
+            loginExpiredPage.clickLoginContinueLink();
+            assertEquals("Deutsch", changePasswordPage.getLanguageDropdownText());
+            assertThat(PageUtils.getPageTitle(driver), is("Passwort aktualisieren"));
+        }
+    }
+
     @Test
     public void realmLocalizationMessagesAreApplied() {
         String realmLocalizationMessageKey = "loginAccountTitle";
@@ -383,7 +412,7 @@ public void realmLocalizationMessagesUsedDuringErrorHandling() {
         final String realmLocalizationMessageValue = "We are really sorry...";
 
         saveLocalizationText(locale, realmLocalizationMessageKey, realmLocalizationMessageValue);
-        String nonExistingUrl = oauth.getLoginFormUrl().split("protocol")[0] + "incorrect-path";
+        String nonExistingUrl = oauth.loginForm().build().split("protocol")[0] + "incorrect-path";
         driver.navigate().to(nonExistingUrl);
 
         assertThat(driver.getPageSource(), containsString(realmLocalizationMessageValue));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/AbstractJavascriptTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/AbstractJavascriptTest.java
deleted file mode 100644
index 1da3453755d7..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/AbstractJavascriptTest.java
+++ /dev/null
@@ -1,231 +0,0 @@
-package org.keycloak.testsuite.javascript;
-
-import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.jboss.arquillian.graphene.page.Page;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.RoleRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractAuthTest;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.auth.page.login.OIDCLogin;
-import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.JavascriptBrowser;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.RolesBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.util.javascript.JavascriptStateValidator;
-import org.keycloak.testsuite.util.javascript.ResponseValidator;
-import org.openqa.selenium.By;
-import org.openqa.selenium.Cookie;
-import org.openqa.selenium.JavascriptExecutor;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebDriver.Options;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.support.FindBy;
-
-import java.util.List;
-import java.util.Map;
-
-import static org.hamcrest.CoreMatchers.containsString;
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.collection.IsMapContaining.hasEntry;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST2;
-import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlStartsWith;
-import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- * @author mhajas
- */
-public abstract class AbstractJavascriptTest extends AbstractAuthTest {
-
-    @FunctionalInterface
-    interface QuadFunction<T, U, V, W> {
-        void apply(T a, U b, V c, W d);
-    }
-
-    public static final String JS_APP_HOST = AUTH_SERVER_HOST2;
-    public static final String CLIENT_ID = "js-console";
-    public static final String REALM_NAME = "test";
-    public static final String SPACE_REALM_NAME = "Example realm";
-    public static final String JAVASCRIPT_URL = "/auth/realms/" + REALM_NAME + "/testing/javascript";
-    public static final String JAVASCRIPT_ENCODED_SPACE_URL = "/auth/realms/Example%20realm/testing/javascript";
-    public static final String JAVASCRIPT_SPACE_URL = "/auth/realms/Example realm/testing/javascript";
-    public static int TOKEN_LIFESPAN_LEEWAY = 3; // seconds
-    public static final String USER_PASSWORD = "password";
-
-
-    protected JavascriptExecutor jsExecutor;
-
-    // Javascript browser needed KEYCLOAK-4703
-    @Drone
-    @JavascriptBrowser
-    protected WebDriver jsDriver;
-
-    @Page
-    @JavascriptBrowser
-    protected OIDCLogin jsDriverTestRealmLoginPage;
-
-    @FindBy(id = "output")
-    @JavascriptBrowser
-    protected WebElement outputArea;
-
-    @FindBy(id = "events")
-    @JavascriptBrowser
-    protected WebElement eventsArea;
-
-    public static final UserRepresentation testUser;
-    public static final UserRepresentation unauthorizedUser;
-
-    static {
-        testUser = UserBuilder.create().username("test-user@localhost").password(USER_PASSWORD).build();
-        unauthorizedUser = UserBuilder.create().username("unauthorized").password(USER_PASSWORD).build();
-    }
-
-    @BeforeClass
-    public static void enabledOnlyWithSSL() {
-        ContainerAssume.assumeAuthServerSSL();
-    }
-
-    @Before
-    public void beforeJavascriptTest() {
-        jsExecutor = (JavascriptExecutor) jsDriver;
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        testRealms.add(updateRealm(RealmBuilder.create()
-                .name(REALM_NAME)
-                .roles(
-                        RolesBuilder.create()
-                                .realmRole(new RoleRepresentation("user", "", false))
-                                .realmRole(new RoleRepresentation("admin", "", false))
-                )
-                .user(
-                        UserBuilder.create()
-                                .username("test-user@localhost").password("password")
-                                .addRoles("user")
-                                .role("realm-management", "view-realm")
-                                .role("realm-management", "manage-users")
-                                .role("account", "view-profile")
-                                .role("account", "manage-account")
-                )
-                .user(
-                        UserBuilder.create()
-                                .username("unauthorized").password("password")
-                )
-                .client(
-                        ClientBuilder.create()
-                                .clientId(CLIENT_ID)
-                                .redirectUris(oauth.SERVER_ROOT.replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/*", oauth.SERVER_ROOT + JAVASCRIPT_ENCODED_SPACE_URL + "/*")
-                                .addWebOrigin(oauth.SERVER_ROOT.replace(AUTH_SERVER_HOST, JS_APP_HOST))
-                                .publicClient()
-                )
-                .accessTokenLifespan(30 + TOKEN_LIFESPAN_LEEWAY)
-                .testEventListener()
-        ));
-    }
-
-    protected <T> JavascriptStateValidator buildFunction(QuadFunction<T, WebDriver, Object, WebElement> f, T x) {
-        return (y,z,w) -> f.apply(x, y, z, w);
-    }
-
-    protected void setImplicitFlowForClient() {
-        ClientResource clientResource = ApiUtil.findClientResourceByClientId(adminClient.realms().realm(REALM_NAME), CLIENT_ID);
-        ClientRepresentation client = clientResource.toRepresentation();
-        client.setImplicitFlowEnabled(true);
-        client.setStandardFlowEnabled(false);
-        clientResource.update(client);
-    }
-
-    protected void setStandardFlowForClient() {
-        ClientResource clientResource = ApiUtil.findClientResourceByClientId(adminClient.realms().realm(REALM_NAME), CLIENT_ID);
-        ClientRepresentation client = clientResource.toRepresentation();
-        client.setImplicitFlowEnabled(false);
-        client.setStandardFlowEnabled(true);
-        clientResource.update(client);
-    }
-
-    protected abstract RealmRepresentation updateRealm(RealmBuilder builder);
-
-    protected void assertInitAuth(WebDriver driver1, Object output, WebElement events) {
-        buildFunction(this::assertOutputContains, "Init Success (Authenticated)").validate(driver1, output, events);
-        waitUntilElement(events).text().contains("Auth Success");
-    }
-
-    protected void assertInitNotAuth(WebDriver driver1, Object output, WebElement events) {
-        buildFunction(this::assertOutputContains, "Init Success (Not Authenticated)").validate(driver1, output, events);
-    }
-
-    protected void assertOnLoginPage(WebDriver driver1, Object output, WebElement events) {
-        waitUntilElement(By.tagName("body")).is().present();
-        assertCurrentUrlStartsWith(jsDriverTestRealmLoginPage, driver1);
-    }
-
-    public void assertOutputWebElementContains(String value, WebDriver driver1, Object output, WebElement events) {
-        waitUntilElement((WebElement) output).text().contains(value);
-    }
-    
-    public void assertLocaleCookie(String locale, WebDriver driver1, Object output, WebElement events) {
-        waitForPageToLoad();
-        Options ops = driver1.manage();
-        Cookie cookie = ops.getCookieNamed("KEYCLOAK_LOCALE");
-        Assert.assertNotNull(cookie);
-        Assert.assertEquals(locale, cookie.getValue());
-    }
-    
-    public JavascriptStateValidator assertLocaleIsSet(String locale) {
-        return buildFunction(this::assertLocaleCookie, locale);
-    }
-
-    public void assertOutputContains(String value, WebDriver driver1, Object output, WebElement events) {
-        if (output instanceof WebElement) {
-            waitUntilElement((WebElement) output).text().contains(value);
-        } else {
-            assertThat((String) output, containsString(value));
-        }
-    }
-
-    public void assertEventsWebElementContains(String value, WebDriver driver1, Object output, WebElement events) {
-        waitUntilElement(events).text().contains(value);
-    }
-
-    public void assertEventsWebElementDoesntContain(String value, WebDriver driver1, Object output, WebElement events) {
-        waitUntilElement(events).text().not().contains(value);
-    }
-
-    public ResponseValidator assertResponseStatus(long status) {
-        return output -> assertThat(output, hasEntry("status", status));
-    }
-
-    public JavascriptStateValidator assertOutputContains(String text) {
-        return buildFunction(this::assertOutputContains, text);
-    }
-
-    public JavascriptStateValidator assertEventsContains(String text) {
-        return buildFunction(this::assertEventsWebElementContains, text);
-    }
-
-    public JavascriptStateValidator assertEventsDoesntContain(String text) {
-        return buildFunction(this::assertEventsWebElementDoesntContain, text);
-    }
-
-    public void assertErrorResponse(String expectedError, WebDriver drv, Object output, WebElement evt) {
-        Assert.assertNotNull("Empty error response", output);
-        Assert.assertTrue("Invalid error response type", output instanceof Map);
-        assertThat((Map<String, String>) output, anyOf(hasEntry("error", expectedError), hasEntry("error_description", expectedError)));
-    }
-
-    public JavascriptStateValidator assertErrorResponse(String expectedError) {
-        return buildFunction(this::assertErrorResponse, expectedError);
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java
deleted file mode 100644
index 17fef5fe6e99..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/javascript/JavascriptAdapterTest.java
+++ /dev/null
@@ -1,969 +0,0 @@
-package org.keycloak.testsuite.javascript;
-
-import org.jboss.arquillian.graphene.page.Page;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.common.util.Retry;
-import org.keycloak.common.util.UriUtils;
-import org.keycloak.events.Details;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.representations.ClaimsRepresentation;
-import org.keycloak.representations.IDToken;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.EventRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.SuiteContext;
-import org.keycloak.testsuite.auth.page.login.OAuthGrant;
-import org.keycloak.testsuite.auth.page.login.UpdatePassword;
-import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
-import org.keycloak.testsuite.util.JavascriptBrowser;
-import org.keycloak.testsuite.util.AccountHelper;
-import org.keycloak.testsuite.util.RealmBuilder;
-import org.keycloak.testsuite.util.UserBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.javascript.JSObjectBuilder;
-import org.keycloak.testsuite.util.javascript.JavascriptStateValidator;
-import org.keycloak.testsuite.util.javascript.JavascriptTestExecutor;
-import org.keycloak.testsuite.util.javascript.XMLHttpRequest;
-import org.keycloak.util.JsonSerialization;
-import org.openqa.selenium.TimeoutException;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebDriverException;
-import org.openqa.selenium.WebElement;
-
-import java.io.IOException;
-import java.net.URL;
-import java.util.List;
-import java.util.Map;
-
-import static java.lang.Math.toIntExact;
-import static org.hamcrest.CoreMatchers.anyOf;
-import static org.hamcrest.CoreMatchers.both;
-import static org.hamcrest.CoreMatchers.containsString;
-import static org.hamcrest.CoreMatchers.not;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.greaterThan;
-import static org.hamcrest.Matchers.is;
-import static org.hamcrest.Matchers.lessThan;
-import static org.hamcrest.collection.IsMapContaining.hasEntry;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_HOST;
-import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlDoesntStartWith;
-import static org.keycloak.testsuite.util.URLAssert.assertCurrentUrlStartsWith;
-import static org.keycloak.testsuite.util.WaitUtils.pause;
-import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
-import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
-
-/**
- * @author mhajas
- */
-public class JavascriptAdapterTest extends AbstractJavascriptTest {
-
-    private String testAppUrl;
-    private String testAppWithInitInHeadUrl;
-    protected JavascriptTestExecutor testExecutor;
-    private static int TIME_SKEW_TOLERANCE = 3;
-
-    @Rule
-    public AssertEvents events = new AssertEvents(this);
-
-    @Page
-    @JavascriptBrowser
-    private OAuthGrant oAuthGrantPage;
-
-    @Page
-    @JavascriptBrowser
-    private UpdatePassword updatePasswordPage;
-
-    @Override
-    protected RealmRepresentation updateRealm(RealmBuilder builder) {
-        return builder.accessTokenLifespan(30 + TOKEN_LIFESPAN_LEEWAY).build();
-    }
-
-    @Before
-    public void setDefaultEnvironment() {
-        String testAppRootUrl = authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL;
-        testAppUrl = testAppRootUrl + "/index.html";
-        testAppWithInitInHeadUrl = testAppRootUrl + "/init-in-head.html";
-
-        jsDriverTestRealmLoginPage.setAuthRealm(REALM_NAME);
-        oAuthGrantPage.setAuthRealm(REALM_NAME);
-        oauth.realm(REALM_NAME);
-
-        jsDriver.navigate().to(oauth.getLoginFormUrl());
-        waitForPageToLoad();
-        events.poll();
-        jsDriver.manage().deleteAllCookies();
-
-        navigateToTestApp(testAppUrl);
-
-        testExecutor = JavascriptTestExecutor.create(jsDriver, jsDriverTestRealmLoginPage);
-
-        jsDriver.manage().deleteAllCookies();
-
-        setStandardFlowForClient();
-
-        //tests cleanup
-        oauth.setDriver(driver);
-        setTimeOffset(0);
-    }
-
-    protected JSObjectBuilder defaultArguments() {
-        return JSObjectBuilder.create().defaultSettings();
-    }
-
-    private void assertOnTestAppUrl(WebDriver jsDriver, Object output, WebElement events) {
-        assertOnTestAppUrl(jsDriver, output, events, testAppUrl);
-    }
-
-    private void assertOnTestAppWithInitInHeadUrl(WebDriver jsDriver, Object output, WebElement events) {
-        assertOnTestAppUrl(jsDriver, output, events, testAppWithInitInHeadUrl);
-    }
-
-    private void assertOnTestAppUrl(WebDriver jsDriver, Object output, WebElement events, String testAppUrl) {
-        waitForPageToLoad();
-        assertCurrentUrlStartsWith(testAppUrl, jsDriver);
-    }
-
-    @Test
-    public void testJSConsoleAuth() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(UserBuilder.create().username("user").password("invalid-password").build(),
-                        (driver1, output, events) -> assertCurrentUrlDoesntStartWith(testAppUrl, driver1))
-                .loginForm(UserBuilder.create().username("invalid-user").password("password").build(),
-                        (driver1, output, events) -> assertCurrentUrlDoesntStartWith(testAppUrl, driver1))
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitNotAuth);
-    }
-
-    @Test
-    public void testLoginWithPkceS256() {
-        JSObjectBuilder pkceS256 = defaultArguments().pkceS256();
-        testExecutor.init(pkceS256, this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(pkceS256, this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl)
-                .init(pkceS256, this::assertInitNotAuth);
-    }
-
-    @Test
-    public void testLogoutWithDefaults() {
-        boolean stillLoggedIn = testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl)
-                .isLoggedIn();
-        assertFalse("still logged in", stillLoggedIn);
-    }
-
-    @Test
-    public void testLogoutWithInitOptionsPostMethod() {
-        boolean stillLoggedIn = testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments().add("logoutMethod", "POST"), this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl, null)
-                .isLoggedIn();
-        assertFalse("still logged in", stillLoggedIn);
-    }
-
-    @Test
-    public void testLogoutWithOptionsPostMethod() {
-        boolean stillLoggedIn = testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl, null, JSObjectBuilder.create().add("logoutMethod", "POST"))
-                .isLoggedIn();
-        assertFalse("still logged in", stillLoggedIn);
-    }
-
-    @Test
-    public void testSilentCheckSso() {
-        JSObjectBuilder checkSSO = defaultArguments().checkSSOOnLoad()
-                .add("silentCheckSsoRedirectUri", authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/silent-check-sso.html");
-
-        // when 3rd party cookies are disabled, the adapter has to do a full redirect to KC to check whether the user
-        // is logged in or not – it can't rely on silent check-sso iframe
-        testExecutor.init(checkSSO, this::assertInitNotAuth, SuiteContext.BROWSER_STRICT_COOKIES)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(checkSSO, this::assertInitAuth, false)
-                .refresh()
-                .init(checkSSO
-                        , this::assertInitAuth, SuiteContext.BROWSER_STRICT_COOKIES);
-    }
-
-    @Test
-    public void testSilentCheckSsoLoginWithLoginIframeDisabled() {
-        JSObjectBuilder checkSSO = defaultArguments().checkSSOOnLoad()
-                .add("silentCheckSsoRedirectUri", authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/silent-check-sso.html");
-
-        testExecutor.init(checkSSO, this::assertInitNotAuth, SuiteContext.BROWSER_STRICT_COOKIES)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(checkSSO, this::assertInitAuth, false)
-                .refresh()
-                .init(checkSSO
-                        .disableCheckLoginIframe()
-                        , this::assertInitAuth, SuiteContext.BROWSER_STRICT_COOKIES);
-    }
-
-    @Test
-    public void testSilentCheckSsoWithFallbackDisabled() {
-        JSObjectBuilder checkSSO = defaultArguments().checkSSOOnLoad().disableSilentCheckSSOFallback()
-                .add("silentCheckSsoRedirectUri", authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/silent-check-sso.html");
-
-        testExecutor.init(checkSSO, this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(checkSSO, this::assertInitAuth)
-                .refresh()
-                .init(checkSSO
-                        // with the fall back disabled, the adapter won't do full redirect to KC
-                        , SuiteContext.BROWSER_STRICT_COOKIES ? this::assertInitNotAuth : this::assertInitAuth);
-    }
-
-    @Test
-    public void testInitNoOptions() {
-        testExecutor.init(null, this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(null, this::assertInitAuth)
-                .logout(this::assertOnTestAppUrl)
-                .init(null, this::assertInitNotAuth);
-    }
-
-    @Test
-    public void testCheckSso() {
-        JSObjectBuilder checkSSO = defaultArguments().checkSSOOnLoad();
-
-        // when 3rd party cookies are disabled, the adapter has to do a full redirect to KC to check whether the user
-        // is logged in or not – it can't rely on the login iframe
-        testExecutor.init(checkSSO, this::assertInitNotAuth, SuiteContext.BROWSER_STRICT_COOKIES)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(checkSSO, this::assertInitAuth, false)
-                .refresh()
-                .init(checkSSO, this::assertInitAuth, true);
-    }
-
-    @Test
-    public void testSilentCheckSsoNotAuthenticated() {
-        JSObjectBuilder checkSSO = defaultArguments().checkSSOOnLoad()
-                .add("checkLoginIframe", false)
-                .add("silentCheckSsoRedirectUri", authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/silent-check-sso.html");
-
-        testExecutor.init(checkSSO
-                , this::assertInitNotAuth, SuiteContext.BROWSER_STRICT_COOKIES);
-    }
-
-    @Test
-    // KEYCLOAK-13206
-    public void testIframeInit() {
-        JSObjectBuilder iframeInterval = defaultArguments().setCheckLoginIframeIntervalTo1(); // to speed up the test a bit
-        testExecutor.init(iframeInterval)
-                .login()
-                .loginForm(testUser)
-                .init(iframeInterval)
-                .wait(2000, (driver1, output, events) -> { // iframe is initialized after ~1 second, 2 seconds is just to be sure
-                    assertAdapterIsLoggedIn(driver1, output, events);
-                    final String logMsg = "Your browser is blocking access to 3rd-party cookies, this means:";
-                    if (SuiteContext.BROWSER_STRICT_COOKIES) {
-                        // this is here not really to test the log but also to make sure the browser is configured properly
-                        // and cookies were blocked
-                        assertEventsWebElementContains(logMsg, driver1, output, events);
-                    }
-                    else {
-                        assertEventsWebElementDoesntContain(logMsg, driver1, output, events);
-                    }
-                });
-    }
-
-    @Test
-    public void testRefreshToken() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .refreshToken(9999, assertOutputContains("Failed to refresh token"))
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .refreshToken(9999, assertEventsContains("Auth Refresh Success"));
-    }
-
-    @Test
-    public void testRefreshTokenIfUnder30s() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .refreshToken(30, assertOutputContains("Token not refreshed, valid for"))
-                .addTimeSkew(-5) // instead of wait move in time
-                .refreshToken(30, assertEventsContains("Auth Refresh Success"));
-    }
-
-    @Test
-    public void testGetProfile() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .getProfile(assertOutputContains("Failed to load profile"))
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth)
-                .getProfile((driver1, output, events) -> assertThat((Map<String, String>) output, hasEntry("username", testUser.getUsername())));
-    }
-
-    @Test
-    public void grantBrowserBasedApp() {
-        ClientResource clientResource = ApiUtil.findClientResourceByClientId(adminClient.realm(REALM_NAME), CLIENT_ID);
-        ClientRepresentation client = clientResource.toRepresentation();
-        try {
-            client.setConsentRequired(true);
-            clientResource.update(client);
-
-            testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                  .login(this::assertOnLoginPage)
-                  .loginForm(testUser, (driver1, output, events) -> assertTrue(oAuthGrantPage.isCurrent(driver1))
-                        // I am not sure why is this driver1 argument to isCurrent necessary, but I got exception without it
-                  );
-
-            oAuthGrantPage.accept();
-
-            EventRepresentation loginEvent = events.expectLogin()
-                  .client(CLIENT_ID)
-                  .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
-                  .detail(Details.REDIRECT_URI, testAppUrl)
-                  .detail(Details.USERNAME, testUser.getUsername())
-                  .assertEvent();
-            String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-
-            testExecutor.init(defaultArguments(), this::assertInitAuth);
-
-            driver.navigate().to(oauth.getLoginFormUrl());
-            events.expectCodeToToken(codeId, loginEvent.getSessionId()).client(CLIENT_ID).assertEvent();
-
-            AccountHelper.revokeConsents(adminClient.realm(REALM_NAME), testUser.getUsername(),CLIENT_ID);
-            Assert.assertTrue(AccountHelper.getUserConsents(adminClient.realm(REALM_NAME), testUser.getUsername()).isEmpty());
-
-            jsDriver.navigate().to(testAppUrl);
-            testExecutor.configure() // need to configure because we refreshed page
-                  .init(defaultArguments(), this::assertInitNotAuth)
-                  .login((driver1, output, events) -> assertTrue(oAuthGrantPage.isCurrent(driver1)));
-        } finally {
-            // Clean
-            client.setConsentRequired(false);
-            clientResource.update(client);
-        }
-    }
-
-    @Test
-    public void implicitFlowTest() {
-        testExecutor.init(defaultArguments().implicitFlow(), this::assertInitNotAuth)
-                .login(this::assertOnTestAppUrl)
-                .errorResponse(assertOutputContains("Implicit flow is disabled for the client"));
-
-        setImplicitFlowForClient();
-        jsDriver.navigate().to(testAppUrl);
-
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnTestAppUrl)
-                .errorResponse(assertOutputContains("Standard flow is disabled for the client"));
-        jsDriver.navigate().to(testAppUrl);
-
-        testExecutor.init(defaultArguments().implicitFlow(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments().implicitFlow(), this::assertInitAuth);
-
-    }
-
-    @Test
-    public void testCertEndpoint() {
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .sendXMLHttpRequest(XMLHttpRequest.create()
-                                .url(authServerContextRootPage + "/auth/realms/" + REALM_NAME + "/protocol/openid-connect/certs")
-                                .method("GET")
-                                .addHeader("Accept", "application/json")
-                                .addHeader("Authorization", "Bearer ' + keycloak.token + '"),
-                        assertResponseStatus(200));
-    }
-
-    @Test
-    public void implicitFlowQueryTest() {
-        setImplicitFlowForClient();
-        testExecutor.init(JSObjectBuilder.create().implicitFlow().queryResponse(), this::assertInitNotAuth)
-                .login((driver1, output, events1) -> Retry.execute(
-                        () -> assertThat(driver1.getCurrentUrl(), containsString("Response_mode+%27query%27+not+allowed")),
-                        20, 50)
-                );
-    }
-
-    @Test
-    public void implicitFlowRefreshTokenTest() {
-        setImplicitFlowForClient();
-        testExecutor.logInAndInit(defaultArguments().implicitFlow(), testUser, this::assertInitAuth)
-            .refreshToken(9999, assertOutputContains("Failed to refresh token"));
-    }
-
-    @Test
-    public void implicitFlowOnTokenExpireTest() {
-        try (RealmAttributeUpdater rau = new RealmAttributeUpdater(adminClient.realms().realm(REALM_NAME))
-                .setAccessTokenLifespanForImplicitFlow(3)
-                .update()
-        ) {
-                setImplicitFlowForClient();
-
-                testExecutor.logInAndInit(defaultArguments().implicitFlow(), testUser, this::assertInitAuth);
-                assertThat(driver.getPageSource(), not(containsString("Access token expired")));
-
-                // Here we can't move in time because we are waiting for onTokenExpired execution which is already
-                //   scheduled by setTimeout method, so we can't make it execute sooner
-                pause(1000);
-
-                waitUntilElement(eventsArea).text().contains("Access token expired");
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Test
-    public void implicitFlowCertEndpoint() {
-        setImplicitFlowForClient();
-        testExecutor.logInAndInit(defaultArguments().implicitFlow(), testUser, this::assertInitAuth)
-                .sendXMLHttpRequest(XMLHttpRequest.create()
-                                .url(authServerContextRootPage + "/auth/realms/" + REALM_NAME + "/protocol/openid-connect/certs")
-                                .method("GET")
-                                .addHeader("Accept", "application/json")
-                                .addHeader("Authorization", "Bearer ' + keycloak.token + '"),
-                        assertResponseStatus(200));
-    }
-
-    @Test
-    public void testBearerRequest() {
-        XMLHttpRequest request = XMLHttpRequest.create()
-                .url(authServerContextRootPage + "/auth/admin/realms/" + REALM_NAME + "/roles")
-                .method("GET")
-                .addHeader("Accept", "application/json")
-                .addHeader("Authorization", "Bearer ' + keycloak.token + '");
-
-        testExecutor.init(defaultArguments())
-                // Possibility of 0 and 401 is caused by this issue: https://issues.redhat.com/browse/KEYCLOAK-12686
-                .sendXMLHttpRequest(request, response -> assertThat(response, hasEntry(is("status"), anyOf(is(0L), is(401L)))))
-                .refresh();
-        testExecutor.logInAndInit(defaultArguments(), unauthorizedUser, this::assertInitAuth)
-                .sendXMLHttpRequest(request, output -> assertThat(output, hasEntry("status", 403L)))
-                .logout(this::assertOnTestAppUrl)
-                .refresh();
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .sendXMLHttpRequest(request, assertResponseStatus(200));
-    }
-
-    @Test
-    public void loginRequiredAction() {
-        try {
-            testExecutor.init(defaultArguments().loginRequiredOnLoad());
-            // This throws exception because when JavascriptExecutor waits for AsyncScript to finish
-            // it is redirected to login page and executor gets no response
-
-            throw new RuntimeException("Probably the login-required OnLoad mode doesn't work, because testExecutor should fail with error that page was redirected.");
-        } catch (WebDriverException ex) {
-            // should happen
-        }
-
-        testExecutor.loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), this::assertInitAuth);
-    }
-
-    /**
-     * Test for scope handling via {@code initOptions}: <pre>{@code
-     * Keycloak keycloak = new Keycloak(); keycloak.init({.... scope: "profile email phone"})
-     * }</pre>
-     * See KEYCLOAK-14412
-     */
-    @Test
-    public void testScopeInInitOptionsShouldBeConsideredByLoginUrl() {
-
-        JSObjectBuilder initOptions = defaultArguments()
-                .loginRequiredOnLoad()
-                // phone is optional client scope
-                .add("scope", "openid profile email phone");
-
-        try {
-            testExecutor.init(initOptions);
-            // This throws exception because when JavascriptExecutor waits for AsyncScript to finish
-            // it is redirected to login page and executor gets no response
-
-            throw new RuntimeException("Probably the login-required OnLoad mode doesn't work, because testExecutor should fail with error that page was redirected.");
-        } catch (WebDriverException ex) {
-            // should happen
-        }
-
-        testExecutor.loginForm(testUser, this::assertOnTestAppUrl)
-                    .init(initOptions, this::assertAdapterIsLoggedIn)
-                    .executeScript("return window.keycloak.tokenParsed.scope", assertOutputContains("phone"));
-    }
-
-    /**
-     * Test for scope handling via {@code loginOptions}: <pre>{@code
-     * Keycloak keycloak = new Keycloak(); keycloak.login({.... scope: "profile email phone"})
-     * }</pre>
-     * See KEYCLOAK-14412
-     */
-    @Test
-    public void testScopeInLoginOptionsShouldBeConsideredByLoginUrl() {
-
-        testExecutor.configure().init(defaultArguments());
-
-        JSObjectBuilder loginOptions = JSObjectBuilder.create().add("scope", "profile email phone");
-
-        testExecutor.login(loginOptions, (JavascriptStateValidator) (driver, output, events) -> {
-            assertThat(driver.getCurrentUrl(), containsString("&scope=openid%20profile%20email%20phone"));
-        });
-    }
-
-    /**
-     * Test for acr handling via {@code loginOptions}: <pre>{@code
-     * Keycloak keycloak = new Keycloak(); keycloak.login({.... acr: { values: ["foo", "bar"], essential: false}})
-     * }</pre>
-     */
-    @Test
-    public void testAcrInLoginOptionsShouldBeConsideredByLoginUrl() {
-        // Test when no "acr" option given. Claims parameter won't be passed to Keycloak server
-        testExecutor.configure().init(defaultArguments());
-        JSObjectBuilder loginOptions = JSObjectBuilder.create();
-
-        testExecutor.login(loginOptions, (JavascriptStateValidator) (driver, output, events) -> {
-            try {
-                String queryString = new URL(driver.getCurrentUrl()).getQuery();
-                String claimsParam = UriUtils.decodeQueryString(queryString).getFirst(OIDCLoginProtocol.CLAIMS_PARAM);
-                Assert.assertNull(claimsParam);
-            } catch (IOException ioe) {
-                throw new AssertionError(ioe);
-            }
-        });
-
-        // Test given "acr" option will be translated into the "claims" parameter passed to Keycloak server
-        jsDriver.navigate().to(testAppUrl);
-        testExecutor.configure().init(defaultArguments());
-
-        JSObjectBuilder acr1 = JSObjectBuilder.create()
-                .add("values", new String[] {"foo", "bar"})
-                .add("essential", false);
-        loginOptions = JSObjectBuilder.create().add("acr", acr1);
-
-        testExecutor.login(loginOptions, (JavascriptStateValidator) (driver, output, events) -> {
-            try {
-                String queryString = new URL(driver.getCurrentUrl()).getQuery();
-                String claimsParam = UriUtils.decodeQueryString(queryString).getFirst(OIDCLoginProtocol.CLAIMS_PARAM);
-                Assert.assertNotNull(claimsParam);
-
-                ClaimsRepresentation claimsRep = JsonSerialization.readValue(claimsParam, ClaimsRepresentation.class);
-                ClaimsRepresentation.ClaimValue<String> claimValue = claimsRep.getClaimValue(IDToken.ACR, ClaimsRepresentation.ClaimContext.ID_TOKEN, String.class);
-                Assert.assertNames(claimValue.getValues(), "foo", "bar");
-                assertThat(claimValue.isEssential(), is(false));
-            } catch (IOException ioe) {
-                throw new AssertionError(ioe);
-            }
-        });
-    }
-
-    /**
-     * Test for {@code acr_values} handling via {@code loginOptions}: <pre>{@code
-     * Keycloak keycloak = new Keycloak(); keycloak.login({...., acrValues: "1"})
-     * }</pre>
-     */
-    @Test
-    public void testAcrValuesInLoginOptionsShouldBeConsideredByLoginUrl() {
-
-        testExecutor.configure().init(defaultArguments());
-        JSObjectBuilder loginOptions = JSObjectBuilder.create();
-
-        testExecutor.login(loginOptions, (JavascriptStateValidator) (driver, output, events) -> {
-            try {
-                String queryString = new URL(driver.getCurrentUrl()).getQuery();
-                String acrValues = UriUtils.decodeQueryString(queryString).getFirst(OIDCLoginProtocol.ACR_PARAM);
-                Assert.assertNull(acrValues);
-            } catch (IOException ioe) {
-                throw new AssertionError(ioe);
-            }
-        });
-
-        // Test given "acrValues" option will be translated into the "acr_values" parameter passed to Keycloak server
-        jsDriver.navigate().to(testAppUrl);
-        testExecutor.configure().init(defaultArguments());
-
-        loginOptions = JSObjectBuilder.create().acrValues("2fa");
-
-        testExecutor.login(loginOptions, (JavascriptStateValidator) (driver, output, events) -> {
-            try {
-                String queryString = new URL(driver.getCurrentUrl()).getQuery();
-                String acrValuesParam = UriUtils.decodeQueryString(queryString).getFirst(OIDCLoginProtocol.ACR_PARAM);
-                Assert.assertNotNull(acrValuesParam);
-                assertThat(acrValuesParam, is("2fa"));
-            } catch (IOException ioe) {
-                throw new AssertionError(ioe);
-            }
-        });
-    }
-
-    @Test
-    public void testUpdateToken() {
-        XMLHttpRequest request = XMLHttpRequest.create()
-                .url(authServerContextRootPage + "/auth/admin/realms/" + REALM_NAME + "/roles")
-                .method("GET")
-                .addHeader("Accept", "application/json")
-                .addHeader("Authorization", "Bearer ' + keycloak.token + '");
-
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .addTimeSkew(-33);
-        setTimeOffset(33);
-        testExecutor.refreshToken(5, assertEventsContains("Auth Refresh Success"));
-
-        setTimeOffset(67);
-        testExecutor.addTimeSkew(-34)
-                // Possibility of 0 and 401 is caused by this issue: https://issues.redhat.com/browse/KEYCLOAK-12686
-                .sendXMLHttpRequest(request, response -> assertThat(response, hasEntry(is("status"), anyOf(is(0L), is(401L)))))
-                .refreshToken(5, assertEventsContains("Auth Refresh Success"))
-                .sendXMLHttpRequest(request, assertResponseStatus(200));
-    }
-
-    @Test
-    public void timeSkewTest() {
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .checkTimeSkew((driver1, output, events) -> assertThat(toIntExact((long) output),
-                        is(
-                            both(greaterThan(0 - TIME_SKEW_TOLERANCE))
-                            .and(lessThan(TIME_SKEW_TOLERANCE))
-                        )
-                ));
-
-        setTimeOffset(40);
-
-        testExecutor.refreshToken(9999, assertEventsContains("Auth Refresh Success"))
-                .checkTimeSkew((driver1, output, events) -> assertThat(toIntExact((long) output),
-                        is(
-                            both(greaterThan(-40 - TIME_SKEW_TOLERANCE))
-                            .and(lessThan(-40 + TIME_SKEW_TOLERANCE))
-                        )
-                ));
-    }
-
-    @Test
-    public void testOneSecondTimeSkewTokenUpdate() {
-        setTimeOffset(1);
-
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .refreshToken(9999, assertEventsContains("Auth Refresh Success"));
-
-        try {
-            // The events element should contain "Auth logout" but we need to wait for it
-            // and text().not().contains() doesn't wait. With KEYCLOAK-4179 it took some time for "Auth Logout" to be present
-            waitUntilElement(eventsArea).text().contains("Auth Logout");
-
-            throw new RuntimeException("The events element shouldn't contain \"Auth Logout\" text");
-        } catch (TimeoutException e) {
-            // OK
-        }
-    }
-
-    @Test
-    public void testLocationHeaderInResponse() {
-        XMLHttpRequest request = XMLHttpRequest.create()
-                .url(authServerContextRootPage + "/auth/admin/realms/" + REALM_NAME + "/users")
-                .method("POST")
-                .content("JSON.stringify(JSON.parse('{\"emailVerified\" : false, \"enabled\" : true, \"username\": \"mhajas\", \"firstName\" :\"First\", \"lastName\":\"Last\",\"email\":\"email@redhat.com\", \"attributes\": {}}'))")
-                .addHeader("Accept", "application/json")
-                .addHeader("Authorization", "Bearer ' + keycloak.token + '")
-                .addHeader("Content-Type", "application/json; charset=UTF-8");
-
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-                .sendXMLHttpRequest(request, response -> {
-                            List<UserRepresentation> users = adminClient.realm(REALM_NAME).users().search("mhajas", 0, 1);
-                            assertEquals("There should be created user mhajas", 1, users.size());
-
-                            assertThat(((String) response.get("responseHeaders")).toLowerCase(), containsString("location: " + authServerContextRootPage.toString() + "/auth/admin/realms/" + REALM_NAME + "/users/" + users.get(0).getId()));
-                        });
-    }
-
-    @Test
-    public void equalsSignInRedirectUrl() {
-        testAppUrl = authServerContextRootPage.toString().replace(AUTH_SERVER_HOST, JS_APP_HOST) + JAVASCRIPT_URL + "/index.html?test=bla=bla&super=man";
-        jsDriver.navigate().to(testAppUrl);
-
-        JSObjectBuilder arguments = defaultArguments();
-
-        testExecutor.init(arguments, this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(arguments, (driver1, output1, events2) -> {
-                    assertTrue(driver1.getCurrentUrl().contains("bla=bla"));
-                    assertInitAuth(driver1, output1, events2);
-                });
-    }
-
-    @Test
-    public void spaceInRealmNameTest() {
-        try {
-            adminClient.realm(REALM_NAME).update(RealmBuilder.edit(adminClient.realm(REALM_NAME).toRepresentation()).name(SPACE_REALM_NAME).build());
-
-            JSObjectBuilder configuration = JSObjectBuilder.create()
-                  .add("url", authServerContextRootPage + "/auth")
-                  .add("realm", SPACE_REALM_NAME)
-                  .add("clientId", CLIENT_ID);
-
-            testAppUrl = authServerContextRootPage + JAVASCRIPT_ENCODED_SPACE_URL + "/index.html";
-            jsDriver.navigate().to(testAppUrl);
-            jsDriverTestRealmLoginPage.setAuthRealm(SPACE_REALM_NAME);
-
-            testExecutor.configure(configuration)
-                  .init(defaultArguments(), this::assertInitNotAuth)
-                  .login(this::assertOnLoginPage)
-                  .loginForm(testUser, this::assertOnTestAppUrl)
-                  .configure(configuration)
-                  .init(defaultArguments(), this::assertInitAuth);
-        } finally {
-            adminClient.realm(SPACE_REALM_NAME).update(RealmBuilder.edit(adminClient.realm(SPACE_REALM_NAME).toRepresentation()).name(REALM_NAME).build());
-            jsDriverTestRealmLoginPage.setAuthRealm(REALM_NAME);
-        }
-    }
-
-    @Test
-    public void initializeWithTokenTest() {
-        oauth.setDriver(jsDriver);
-
-        oauth.realm(REALM_NAME);
-        oauth.clientId(CLIENT_ID);
-        oauth.redirectUri(testAppUrl);
-        oauth.doLogin(testUser);
-
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String token = tokenResponse.getAccessToken();
-        String refreshToken = tokenResponse.getRefreshToken();
-
-        testExecutor.init(JSObjectBuilder.create()
-                    .add("token", token)
-                    .add("refreshToken", refreshToken)
-                , (driver1, output, events) -> {
-                    assertInitAuth(driver1, output, events);
-                    if (SuiteContext.BROWSER_STRICT_COOKIES) {
-                        // iframe is unsupported so a token refresh had to be performed
-                        assertEventsContains("Auth Refresh Success").validate(driver1, output, events);
-                    }
-                    else {
-                        assertEventsDoesntContain("Auth Refresh Success").validate(driver1, output, events);
-                    }
-                })
-                .refreshToken(9999, assertEventsContains("Auth Refresh Success"));
-    }
-
-    @Test
-    public void initializeWithTimeSkew() {
-        oauth.setDriver(jsDriver); // Oauth need to login with jsDriver
-
-        // Get access token and refresh token to initialize with
-        setTimeOffset(600);
-        oauth.realm(REALM_NAME);
-        oauth.clientId(CLIENT_ID);
-        oauth.redirectUri(testAppUrl);
-        oauth.doLogin(testUser);
-
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String token = tokenResponse.getAccessToken();
-        String refreshToken = tokenResponse.getRefreshToken();
-
-        // Perform test
-        testExecutor.init(JSObjectBuilder.create()
-                        .add("token", token)
-                        .add("refreshToken", refreshToken)
-                        .add("timeSkew", -600)
-                , this::assertInitAuth)
-                .checkTimeSkew((driver1, output, events) -> assertThat((Long) output, is(
-                                both(greaterThan(-600L - TIME_SKEW_TOLERANCE))
-                                .and(lessThan(-600L + TIME_SKEW_TOLERANCE))
-                        )))
-                .refreshToken(9999, assertEventsContains("Auth Refresh Success"))
-                .checkTimeSkew((driver1, output, events) -> assertThat((Long) output, is(
-                                both(greaterThan(-600L - TIME_SKEW_TOLERANCE))
-                                .and(lessThan(-600L + TIME_SKEW_TOLERANCE))
-                )));
-    }
-
-    @Test
-    // KEYCLOAK-4503
-    public void initializeWithRefreshToken() {
-
-        oauth.setDriver(jsDriver); // Oauth need to login with jsDriver
-
-        oauth.realm(REALM_NAME);
-        oauth.clientId(CLIENT_ID);
-        oauth.redirectUri(testAppUrl);
-        oauth.doLogin(testUser);
-
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String token = tokenResponse.getAccessToken();
-        String refreshToken = tokenResponse.getRefreshToken();
-
-        testExecutor.init(JSObjectBuilder.create()
-                        .add("refreshToken", refreshToken)
-                , (driver1, output, events) -> {
-            assertInitNotAuth(driver1, output, events);
-            waitUntilElement(events).text().not().contains("Auth Success");
-        });
-    }
-
-    @Test
-    public void reentrancyCallbackTest() {
-        testExecutor.logInAndInit(defaultArguments(), testUser, this::assertInitAuth)
-            .executeAsyncScript(
-                "var callback = arguments[arguments.length - 1];" +
-                "keycloak.updateToken(60).then(function () {" +
-                "       event(\"First callback\");" +
-                "       keycloak.updateToken(60).then(function () {" +
-                "          event(\"Second callback\");" +
-                "          callback(\"Success\");" +
-                "       });" +
-                "    }" +
-                ");"
-                , (driver1, output, events) -> {
-                    waitUntilElement(events).text().contains("First callback");
-                    waitUntilElement(events).text().contains("Second callback");
-                    waitUntilElement(events).text().not().contains("Auth Logout");
-                }
-            );
-    }
-
-    @Test
-    public void fragmentInURLTest() {
-        jsDriver.navigate().to(testAppUrl + "#fragmentPart");
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), (driver1, output, events1) -> {
-                    assertInitAuth(driver1, output, events1);
-                    assertThat(driver1.getCurrentUrl(), containsString("#fragmentPart"));
-                });
-    }
-
-    @Test
-    public void fragmentInLoginFunction() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(JSObjectBuilder.create()
-                        .add("redirectUri", testAppUrl + "#fragmentPart")
-                        .build(), this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppUrl)
-                .init(defaultArguments(), (driver1, output, events1) -> {
-                    assertInitAuth(driver1, output, events1);
-                    assertThat(driver1.getCurrentUrl(), containsString("#fragmentPart"));
-                });
-    }
-
-    @Test
-    public void testAIAFromJavascriptAdapterSuccess() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(JSObjectBuilder.create()
-                        .add("action", "UPDATE_PASSWORD")
-                        .build(), this::assertOnLoginPage)
-                .loginForm(testUser);
-
-        updatePasswordPage.updatePasswords(USER_PASSWORD, USER_PASSWORD);
-
-        testExecutor.init(defaultArguments(), (driver1, output, events1) -> {
-            assertInitAuth(driver1, output, events1);
-            waitUntilElement(events1).text().contains("AIA status: success");
-        });
-    }
-
-    @Test
-    public void testAIAFromJavascriptAdapterCancelled() {
-        testExecutor.init(defaultArguments(), this::assertInitNotAuth)
-                .login(JSObjectBuilder.create()
-                        .add("action", "UPDATE_PASSWORD")
-                        .build(), this::assertOnLoginPage)
-                .loginForm(testUser);
-
-        updatePasswordPage.cancel();
-
-        testExecutor.init(defaultArguments(), (driver1, output, events1) -> {
-            assertInitAuth(driver1, output, events1);
-            waitUntilElement(events1).text().contains("AIA status: cancelled");
-        });
-    }
-
-    @Test
-    // KEYCLOAK-15158
-    public void testInitInHead() {
-        navigateToTestApp(testAppWithInitInHeadUrl);
-
-        testExecutor.validateOutputField(this::assertInitNotAuth)
-                .login(this::assertOnLoginPage)
-                .loginForm(testUser, this::assertOnTestAppWithInitInHeadUrl)
-                .validateOutputField(this::assertInitAuth);
-    }
-
-    @Test
-    public void check3pCookiesMessageCallbackTest() {
-        testExecutor.attachCheck3pCookiesIframeMutationObserver()
-                .init(defaultArguments(), this::assertInitNotAuth);
-    }
-
-    // In case of incorrect/unavailable realm provided in KeycloakConfig,
-    // JavaScript Adapter init() should fail-fast and reject Promise with KeycloakError.
-    @Test
-    public void checkInitWithInvalidRealm() {
-
-        JSObjectBuilder keycloakConfig = JSObjectBuilder.create()
-                .add("url", authServerContextRootPage + "/auth")
-                .add("realm", "invalid-realm-name")
-                .add("clientId", CLIENT_ID);
-
-        JSObjectBuilder initOptions = defaultArguments().add("messageReceiveTimeout", 5000);
-
-        testExecutor
-                .configure(keycloakConfig)
-                .init(initOptions, assertErrorResponse("Timeout when waiting for 3rd party check iframe message."));
-
-    }
-
-    // In case of unavailable Authorization Server due to network or other kind of problems,
-    // JavaScript Adapter init() should fail-fast and reject Promise with KeycloakError.
-    @Test
-    public void checkInitWithUnavailableAuthServer() {
-
-        JSObjectBuilder keycloakConfig = JSObjectBuilder.create()
-                .add("url", "https://localhost:12345/auth")
-                .add("realm", REALM_NAME)
-                .add("clientId", CLIENT_ID);
-
-        JSObjectBuilder initOptions = defaultArguments().add("messageReceiveTimeout", 5000);
-
-        testExecutor
-                .configure(keycloakConfig)
-                .init(initOptions, assertErrorResponse("Timeout when waiting for 3rd party check iframe message."));
-
-    }
-
-    protected void assertAdapterIsLoggedIn(WebDriver driver1, Object output, WebElement events) {
-        assertTrue(testExecutor.isLoggedIn());
-    }
-
-    protected void navigateToTestApp(final String testAppUrl) {
-        jsDriver.navigate().to(testAppUrl);
-        waitUntilElement(outputArea).is().present();
-        assertCurrentUrlStartsWith(testAppUrl, jsDriver);
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/FallbackKeyProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/FallbackKeyProviderTest.java
index ba11ae46afec..a2cd0f90c129 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/FallbackKeyProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/FallbackKeyProviderTest.java
@@ -30,7 +30,7 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.LinkedList;
 import java.util.List;
@@ -74,8 +74,8 @@ public void fallbackAfterDeletingAllKeysInRealm() {
         assertEquals(0, providers.size());
 
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertNotNull(response.getAccessToken());
 
@@ -109,8 +109,8 @@ public void differentAlgorithms() {
 
             oauth.openLoginForm();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertNotNull(response.getAccessToken());
         }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/KeyRotationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/KeyRotationTest.java
index 6d15dea5be88..292d733163b0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/KeyRotationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/KeyRotationTest.java
@@ -50,7 +50,7 @@
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 
 import jakarta.ws.rs.core.Response;
@@ -129,7 +129,7 @@ public void testTokens() throws Exception {
 
         // Get token with keys #1
         oauth.doLogin("test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get("code"), "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
         assertEquals(200, response.getStatusCode());
         assertTokenKid(keys1.get(Algorithm.RS256), response.getAccessToken());
         assertTokenKid(keys1.get(Constants.INTERNAL_SIGNATURE_ALGORITHM), response.getRefreshToken());
@@ -162,7 +162,7 @@ public void testTokens() throws Exception {
         assertNotEquals(keys1.get(Constants.INTERNAL_SIGNATURE_ALGORITHM), keys2.get(Algorithm.HS512));
 
                 // Refresh token with keys #2
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(200, response.getStatusCode());
         assertTokenKid(keys2.get(Algorithm.RS256), response.getAccessToken());
         assertTokenKid(keys2.get(Constants.INTERNAL_SIGNATURE_ALGORITHM), response.getRefreshToken());
@@ -181,7 +181,7 @@ public void testTokens() throws Exception {
         dropKeys1();
 
         // Refresh token with keys #1 dropped - should pass as refresh token should be signed with key #2
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         assertTokenKid(keys2.get(Algorithm.RS256), response.getAccessToken());
         assertTokenKid(keys2.get(Constants.INTERNAL_SIGNATURE_ALGORITHM), response.getRefreshToken());
@@ -213,7 +213,7 @@ public void testTokens() throws Exception {
         assertTokenIntrospection(response.getAccessToken(), false);
 
         // Refresh token with keys #2 dropped - should fail as refresh token is signed with key #2
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
         assertEquals("Invalid refresh token", response.getErrorDescription());
     }
@@ -335,10 +335,9 @@ private void assertUserInfo(String token, int expectedStatus) {
 
     private void assertTokenIntrospection(String token, boolean expectActive) {
         try {
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", token);
-            ObjectMapper objectMapper = new ObjectMapper();
-            JsonNode jsonNode = objectMapper.readTree(tokenResponse);
+            JsonNode jsonNode = oauth.client("confidential-cli", "secret1").doIntrospectionAccessTokenRequest(token).asJsonNode();
             assertEquals(expectActive, jsonNode.get("active").asBoolean());
+            oauth.client("test-app", "password");
         } catch (IOException e) {
             throw new RuntimeException(e);
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/login/ConditionalSubFlowExecutedAuthenticatorTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/login/ConditionalSubFlowExecutedAuthenticatorTest.java
index 212c3894306a..d5e72f228029 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/login/ConditionalSubFlowExecutedAuthenticatorTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/login/ConditionalSubFlowExecutedAuthenticatorTest.java
@@ -40,7 +40,7 @@
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginTotpPage;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * <p>Test for the ConditionalSubFlowExecutedAuthenticator. A <em>test</em> parent
@@ -75,12 +75,9 @@ public void configureTestRealm(RealmRepresentation testRealm) {
 
     @Test
     public void testWithoutOtpConfiguredExecuted() {
-        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional OTP", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_EXECUTED);
+        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional 2FA", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_EXECUTED);
 
-        loginPage.open();
-
-        loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
 
         // no otp => check executed => allowed
         checkAllowed("test-user@localhost");
@@ -88,12 +85,9 @@ public void testWithoutOtpConfiguredExecuted() {
 
     @Test
     public void testWithoutOtpConfiguredNotExecuted() {
-        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional OTP", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_NOT_EXECUTED);
-
-        loginPage.open();
+        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional 2FA", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_NOT_EXECUTED);
 
-        loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
 
         // no otp => check not-executed => denied
         checkDenied();
@@ -101,12 +95,9 @@ public void testWithoutOtpConfiguredNotExecuted() {
 
     @Test
     public void testWithOtpConfiguredExecuted() {
-        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional OTP", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_EXECUTED);
-
-        loginPage.open();
+        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional 2FA", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_EXECUTED);
 
-        loginPage.assertCurrent();
-        loginPage.login("user-with-one-configured-otp", "password");
+        oauth.doLogin("user-with-one-configured-otp", "password");
 
         loginTotpPage.assertCurrent();
         oneTimeCodePage.sendCode(new TimeBasedOTP().generateTOTP("DJmQfC73VGFhw7D4QJ8A"));
@@ -117,12 +108,9 @@ public void testWithOtpConfiguredExecuted() {
 
     @Test
     public void testWithOtpConfiguredNotExecuted() {
-        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional OTP", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_NOT_EXECUTED);
+        configureConditionalSubFlowExecutedAuthenticatorInFlow("test Browser - Conditional 2FA", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_NOT_EXECUTED);
 
-        loginPage.open();
-
-        loginPage.assertCurrent();
-        loginPage.login("user-with-two-configured-otp", "password");
+        oauth.doLogin("user-with-two-configured-otp", "password");
 
         loginTotpPage.assertCurrent();
         oneTimeCodePage.sendCode(new TimeBasedOTP().generateTOTP("DJmQfC73VGFhw7D4QJ8A"));
@@ -135,10 +123,7 @@ public void testWithOtpConfiguredNotExecuted() {
     public void testWithInvalidFlowExecuted() {
         configureConditionalSubFlowExecutedAuthenticatorInFlow("invalid flow", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_EXECUTED);
 
-        loginPage.open();
-
-        loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
 
         // no flow => check executed => allowed
         checkAllowed("test-user@localhost");
@@ -148,10 +133,7 @@ public void testWithInvalidFlowExecuted() {
     public void testWithInvalidFlowNotExecuted() {
         configureConditionalSubFlowExecutedAuthenticatorInFlow("invalid flow", ConditionalSubFlowExecutedAuthenticatorFactory.CHECK_RESULT_NOT_EXECUTED);
 
-        loginPage.open();
-
-        loginPage.assertCurrent();
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
 
         // no flow => check executed => denied
         checkDenied();
@@ -165,9 +147,9 @@ private void checkDenied() {
     }
 
     private void checkAllowed(String username) {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         Assert.assertNotNull(code);
-        AccessTokenResponse res = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         Assert.assertNull(res.getError());
         Assert.assertNotNull(res.getAccessToken());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/AbstractMigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/AbstractMigrationTest.java
index 0722154dee40..42cac545e6ed 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/AbstractMigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/AbstractMigrationTest.java
@@ -78,7 +78,7 @@
 import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
 import org.keycloak.testsuite.exportimport.ExportImportUtil;
 import org.keycloak.testsuite.runonserver.RunHelpers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.theme.DefaultThemeSelectorProvider;
 import org.keycloak.util.TokenUtil;
 
@@ -345,8 +345,10 @@ protected void testMigrationTo9_0_0() {
         testAccountConsoleClient(masterRealm);
         testAccountConsoleClient(migrationRealm);
         testAlwaysDisplayInConsole();
-        testFirstBrokerLoginFlowMigrated(masterRealm);
-        testFirstBrokerLoginFlowMigrated(migrationRealm);
+
+        // master realm is not imported from json
+        testFirstBrokerLoginFlowMigrated(masterRealm, false);
+        testFirstBrokerLoginFlowMigrated(migrationRealm, true);
         testAccountClient(masterRealm);
         testAccountClient(migrationRealm);
         testAdminClientPkce(masterRealm);
@@ -443,6 +445,10 @@ protected void testMigrationTo26_1_0(boolean testIdentityProviderConfigMigration
         testRealmDefaultClientScopes(migrationRealm);
     }
 
+    protected void testMigrationTo26_3_0() {
+        testIdpLinkActionAvailable(migrationRealm);
+    }
+
     private void testClientContainsExpectedClientScopes() {
         // Test OIDC client contains expected client scopes
         ClientResource migrationTestOIDCClient = ApiUtil.findClientByClientId(migrationRealm, "migration-test-client");
@@ -554,7 +560,7 @@ private void testAccountConsoleClient(RealmResource realm) {
         assertEquals("oidc-audience-resolve-mapper", mappers.get(0).getProtocolMapper());
     }
 
-    private void testFirstBrokerLoginFlowMigrated(RealmResource realm) {
+    private void testFirstBrokerLoginFlowMigrated(RealmResource realm, boolean imported) {
         log.infof("Test that firstBrokerLogin flow was migrated in new realm '%s'", realm.toRepresentation().getRealm());
 
         List<AuthenticationExecutionInfoRepresentation> authExecutions = realm.flows().getExecutions(DefaultAuthenticationFlows.FIRST_BROKER_LOGIN_FLOW);
@@ -593,8 +599,9 @@ private void testFirstBrokerLoginFlowMigrated(RealmResource realm) {
         testAuthenticationExecution(authExecutions.get(10), null,
                 ConditionalUserConfiguredAuthenticatorFactory.PROVIDER_ID, AuthenticationExecutionModel.Requirement.REQUIRED, 5, 0);
 
+        AuthenticationExecutionModel.Requirement requirement = imported ? AuthenticationExecutionModel.Requirement.REQUIRED : AuthenticationExecutionModel.Requirement.ALTERNATIVE;
         testAuthenticationExecution(authExecutions.get(11), null,
-                OTPFormAuthenticatorFactory.PROVIDER_ID, AuthenticationExecutionModel.Requirement.REQUIRED, 5, 1);
+                OTPFormAuthenticatorFactory.PROVIDER_ID, requirement, 5, 1);
     }
 
 
@@ -886,8 +893,8 @@ protected void testOfflineTokenLogin() throws Exception {
         Assert.assertNotNull(oldOfflineToken);
 
         oauth.realm(MIGRATION);
-        oauth.clientId("migration-test-client");
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(oldOfflineToken, "secret");
+        oauth.client("migration-test-client", "secret");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(oldOfflineToken);
 
         if (response.getError() != null) {
             String errorMessage = String.format("Error when refreshing offline token. Error: %s, Error details: %s, offline token from previous version: %s",
@@ -903,7 +910,7 @@ protected void testOfflineTokenLogin() throws Exception {
         String newOfflineToken1 = response.getRefreshToken();
         assertOfflineToken(newOfflineToken1);
 
-        response = oauth.doRefreshTokenRequest(newOfflineToken1, "secret");
+        response = oauth.doRefreshTokenRequest(newOfflineToken1);
         String newOfflineToken2 = response.getRefreshToken();
         assertOfflineToken(newOfflineToken2);
     }
@@ -994,7 +1001,9 @@ private void testRequiredActionsPriority(RealmResource... realms) {
                 if (action.getAlias().equals("update_user_locale")) {
                     assertEquals(1000, action.getPriority());
                 } else if (action.getAlias().equals("delete_credential")) {
-                    assertEquals(100, action.getPriority());
+                    assertEquals(110, action.getPriority());
+                } else if (action.getAlias().equals("idp_link")) {
+                    assertEquals(120, action.getPriority());
                 } else {
                     assertEquals(priority, action.getPriority());
                 }
@@ -1010,26 +1019,23 @@ protected void testCredentialsMigratedToNewFormat() {
         // Try to login with password+otp after the migration
         try {
             oauth.realm(MIGRATION);
-            oauth.clientId("migration-test-client");
+            oauth.client("migration-test-client", "secret");
 
             TimeBasedOTP otpGenerator = new TimeBasedOTP("HmacSHA1", 8, 40, 1);
             String otp = otpGenerator.generateTOTP("dSdmuHLQhkm54oIm0A0S");
 
             // Try invalid password first
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret",
-                    "migration-test-user", "password", otp);
+            AccessTokenResponse response = oauth.passwordGrantRequest("migration-test-user", "password").otp(otp).send();
             Assert.assertNull(response.getAccessToken());
             Assert.assertNotNull(response.getError());
 
             // Try invalid OTP then
-            response = oauth.doGrantAccessTokenRequest("secret",
-                    "migration-test-user", "password2", "invalid");
+            response = oauth.passwordGrantRequest("migration-test-user", "password2").otp("invalid").send();
             Assert.assertNull(response.getAccessToken());
             Assert.assertNotNull(response.getError());
 
             // Try successful login now
-            response = oauth.doGrantAccessTokenRequest("secret",
-                    "migration-test-user", "password2", otp);
+            response = oauth.passwordGrantRequest("migration-test-user", "password2").otp(otp).send();
             Assert.assertNull(response.getError());
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
             assertEquals("migration-test-user", accessToken.getPreferredUsername());
@@ -1347,7 +1353,18 @@ private void testDeleteCredentialActionAvailable(RealmResource realm) {
         assertEquals("delete_credential", rep.getAlias());
         assertEquals("delete_credential", rep.getProviderId());
         assertEquals("Delete Credential", rep.getName());
-        assertEquals(100, rep.getPriority());
+        assertEquals(110, rep.getPriority());
+        assertTrue(rep.isEnabled());
+        assertFalse(rep.isDefaultAction());
+    }
+
+    private void testIdpLinkActionAvailable(RealmResource realm) {
+        RequiredActionProviderRepresentation rep = realm.flows().getRequiredAction("idp_link");
+        assertNotNull(rep);
+        assertEquals("idp_link", rep.getAlias());
+        assertEquals("idp_link", rep.getProviderId());
+        assertEquals("Linking Identity Provider", rep.getName());
+        assertEquals(120, rep.getPriority());
         assertTrue(rep.isEnabled());
         assertFalse(rep.isDefaultAction());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport1903MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport1903MigrationTest.java
index 24093641896a..4b8e30c7c147 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport1903MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport1903MigrationTest.java
@@ -70,6 +70,7 @@ public void migration19_0_3Test() throws Exception {
         testMigrationTo24_x(true, true);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(true);
+        testMigrationTo26_3_0();
     }
 
     @Test
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport198MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport198MigrationTest.java
index 9dbec7ff8f94..7c6c932dab48 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport198MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport198MigrationTest.java
@@ -81,6 +81,7 @@ public void migration1_9_8Test() {
         testMigrationTo24_x(false);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(false);
+        testMigrationTo26_3_0();
     }
 
     @Override
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport255MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport255MigrationTest.java
index c484b7412453..47c7cde4bbc0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport255MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport255MigrationTest.java
@@ -75,6 +75,7 @@ public void migration2_5_5Test() throws Exception {
         testMigrationTo24_x(false);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(false);
+        testMigrationTo26_3_0();
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport343MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport343MigrationTest.java
index 8795c96f2b36..aac7aba6c0d3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport343MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport343MigrationTest.java
@@ -70,6 +70,7 @@ public void migration3_4_3Test() throws Exception {
         testMigrationTo24_x(false);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(false);
+        testMigrationTo26_3_0();
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport483MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport483MigrationTest.java
index 829d257577dc..d3627174cd9b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport483MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport483MigrationTest.java
@@ -64,6 +64,7 @@ public void migration4_8_3Test() throws Exception {
         testMigrationTo24_x(false);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(false);
+        testMigrationTo26_3_0();
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport903MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport903MigrationTest.java
index a4f42c4012c9..163688d828de 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport903MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/JsonFileImport903MigrationTest.java
@@ -57,6 +57,7 @@ public void migration9_0_3Test() throws Exception {
         testMigrationTo24_x(false);
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(false);
+        testMigrationTo26_3_0();
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationDeniedTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationDeniedTest.java
index 9ecfb42ec27f..132f8e3b5ab2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationDeniedTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationDeniedTest.java
@@ -29,6 +29,7 @@
 import org.keycloak.models.DeploymentStateProvider;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelException;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.storage.datastore.DefaultMigrationManager;
 import org.keycloak.testsuite.AbstractKeycloakTest;
@@ -49,26 +50,28 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
      */
     @Test
     @ModelTest
-    public void testMigrationDeniedWithDBSnapshotAndServerNonSnapshot(KeycloakSession session) {
-        MigrationModel model = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
-        String databaseVersion = model.getStoredVersion();
-        Assert.assertNotNull("Stored DB version was null", model.getStoredVersion());
+    public void testMigrationDeniedWithDBSnapshotAndServerNonSnapshot(KeycloakSession s) {
+        KeycloakModelUtils.runJobInTransaction(s.getKeycloakSessionFactory(), (session) -> {
+            MigrationModel model = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
+            String databaseVersion = model.getStoredVersion();
+            Assert.assertNotNull("Stored DB version was null", model.getStoredVersion());
 
-        String currentVersion = Version.VERSION;
-        try {
-            // Simulate to manually set runtime version of KeycloakServer to 23. Migration should fail as the version is lower than DB version.
-            Version.VERSION = "23.0.0";
-            model.setStoredVersion(Constants.SNAPSHOT_VERSION);
+            String currentVersion = Version.VERSION;
+            try {
+                // Simulate to manually set runtime version of KeycloakServer to 23. Migration should fail as the version is lower than DB version.
+                Version.VERSION = "23.0.0";
+                model.setStoredVersion(Constants.SNAPSHOT_VERSION);
 
-            new DefaultMigrationManager(session, false).migrate();
-            Assert.fail("Not expected to successfully run migration. DB version was " + databaseVersion + ". Keycloak version was " + currentVersion);
-        } catch (ModelException expected) {
-            Assert.assertTrue(expected.getMessage().startsWith("Incorrect state of migration. You are trying to run server version"));
-        } finally {
-            // Revert both versions to the state before the test
-            Version.VERSION = currentVersion;
-            model.setStoredVersion(databaseVersion);
-        }
+                new DefaultMigrationManager(session, false).migrate();
+                Assert.fail("Not expected to successfully run migration. DB version was " + databaseVersion + ". Keycloak version was " + currentVersion);
+            } catch (ModelException expected) {
+                Assert.assertTrue(expected.getMessage().startsWith("Incorrect state of migration. You are trying to run server version"));
+            } finally {
+                // Revert version to the state before the test
+                Version.VERSION = currentVersion;
+                session.getTransactionManager().rollback();
+            }
+        });
     }
 
     /**
@@ -76,25 +79,27 @@ public void testMigrationDeniedWithDBSnapshotAndServerNonSnapshot(KeycloakSessio
      */
     @Test
     @ModelTest
-    public void testMigrationDeniedWithDBNonSnapshotAndServerSnapshot(KeycloakSession session) {
-        MigrationModel model = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
-        String databaseVersion = model.getStoredVersion();
-        Assert.assertNotNull("Stored DB version was null", model.getStoredVersion());
+    public void testMigrationDeniedWithDBNonSnapshotAndServerSnapshot(KeycloakSession s) {
+        KeycloakModelUtils.runJobInTransaction(s.getKeycloakSessionFactory(), (session) -> {
+            MigrationModel model = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
+            String databaseVersion = model.getStoredVersion();
+            Assert.assertNotNull("Stored DB version was null", model.getStoredVersion());
 
-        String currentVersion = Version.VERSION;
-        try {
-            // Simulate to manually set DB version to 23 when server version is SNAPSHOT. Migration should fail as it is an attempt to run production DB with the development server
-            Version.VERSION = Constants.SNAPSHOT_VERSION;
-            model.setStoredVersion("23.0.0");
+            String currentVersion = Version.VERSION;
+            try {
+                // Simulate to manually set DB version to 23 when server version is SNAPSHOT. Migration should fail as it is an attempt to run production DB with the development server
+                Version.VERSION = Constants.SNAPSHOT_VERSION;
+                model.setStoredVersion("23.0.0");
 
-            new DefaultMigrationManager(session, false).migrate();
-            Assert.fail("Not expected to successfully run migration. DB version was " + databaseVersion + ". Keycloak version was " + currentVersion);
-        } catch (ModelException expected) {
-            Assert.assertTrue(expected.getMessage().startsWith("Incorrect state of migration. You are trying to run nightly server version"));
-        } finally {
-            // Revert both versions to the state before the test
-            Version.VERSION = currentVersion;
-            model.setStoredVersion(databaseVersion);
-        }
+                new DefaultMigrationManager(session, false).migrate();
+                Assert.fail("Not expected to successfully run migration. DB version was " + databaseVersion + ". Keycloak version was " + currentVersion);
+            } catch (ModelException expected) {
+                Assert.assertTrue(expected.getMessage().startsWith("Incorrect state of migration. You are trying to run nightly server version"));
+            } finally {
+                // Revert version to the state before the test
+                Version.VERSION = currentVersion;
+                session.getTransactionManager().rollback();
+            }
+        });
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationTest.java
index 313367f1c2a7..dc0b73c7354a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/migration/MigrationTest.java
@@ -73,6 +73,7 @@ public void migration19_xTest() throws Exception{
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(true);
         testMigrationTo26_1_0(true);
+        testMigrationTo26_3_0();
     }
 
     @Test
@@ -87,5 +88,6 @@ public void migration24_xTest() throws Exception{
         testMigrationTo25_0_0();
         testMigrationTo26_0_0(true);
         testMigrationTo26_1_0(true);
+        testMigrationTo26_3_0();
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/AuthenticationSessionProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/AuthenticationSessionProviderTest.java
index 2a122848822c..93fa94b4fded 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/AuthenticationSessionProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/AuthenticationSessionProviderTest.java
@@ -301,6 +301,7 @@ public void testOnClientRemoved(KeycloakSession session) {
         KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession sesRealmRemoved1) -> {
             KeycloakSession currentSession = sesRealmRemoved1;
             RealmModel realm = currentSession.realms().getRealm(realmId);
+            currentSession.getContext().setRealm(realm);
 
             authSessionID.set(currentSession.authenticationSessions().createRootAuthenticationSession(realm).getId());
 
@@ -316,6 +317,7 @@ public void testOnClientRemoved(KeycloakSession session) {
         KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession sesRealmRemoved1) -> {
             KeycloakSession currentSession = sesRealmRemoved1;
             RealmModel realm = currentSession.realms().getRealm(realmId);
+            currentSession.getContext().setRealm(realm);
 
             RootAuthenticationSessionModel rootAuthSession = currentSession.authenticationSessions().getRootAuthenticationSession(realm, authSessionID.get());
 
@@ -329,6 +331,7 @@ public void testOnClientRemoved(KeycloakSession session) {
         KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), (KeycloakSession sesRealmRemoved1) -> {
             KeycloakSession currentSession = sesRealmRemoved1;
             RealmModel realm = currentSession.realms().getRealm(realmId);
+            currentSession.getContext().setRealm(realm);
             RootAuthenticationSessionModel rootAuthSession = currentSession.authenticationSessions().getRootAuthenticationSession(realm, authSessionID.get());
 
             assertThat(rootAuthSession.getAuthenticationSession(realm.getClientByClientId("test-app"), tab1ID.get()).getAuthNote("foo"), is("bar"));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/ClientModelTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/ClientModelTest.java
index 59097f83a056..a3b62c47fdbb 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/ClientModelTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/ClientModelTest.java
@@ -299,7 +299,7 @@ public void testAddApplicationWithId(KeycloakSession session) {
 
             client = realm.addClient(id, "application2");
             return client.getId();
-        }, false, "ClientModel task");
+        }, "ClientModel task");
 
         KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), session.getContext(), (KeycloakSession sessionAppWithId2) -> {
             currentSession = sessionAppWithId2;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/CredentialModelTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/CredentialModelTest.java
index 398f45859e15..82d46a6d886e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/CredentialModelTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/model/CredentialModelTest.java
@@ -45,8 +45,8 @@ public void testCredentialCRUD(KeycloakSession session) throws Exception {
             passwordId.set(list.get(0).getId());
 
             // Create 2 OTP credentials (password was already created)
-            CredentialModel otp1 = OTPCredentialModel.createFromPolicy(realm, "secret1");
-            CredentialModel otp2 = OTPCredentialModel.createFromPolicy(realm, "secret2");
+            CredentialModel otp1 = OTPCredentialModel.createFromPolicy(realm, "secret1", "label1");
+            CredentialModel otp2 = OTPCredentialModel.createFromPolicy(realm, "secret2", "label2");
             otp1 = user.credentialManager().createStoredCredential(otp1);
             otp2 = user.credentialManager().createStoredCredential(otp2);
             otp1Id.set(otp1.getId());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java
index bae444b24730..76963c04a246 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AbstractClientAuthSignedJWTTest.java
@@ -93,8 +93,11 @@
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jws.JWSBuilder;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.LoginProtocol;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
 import org.keycloak.protocol.oidc.client.authentication.JWTClientCredentialsProvider;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.JsonWebToken;
@@ -117,7 +120,9 @@
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.KeystoreUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.SignatureSignerUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.util.JsonSerialization;
@@ -152,6 +157,11 @@ public void beforeAbstractKeycloakTest() throws Exception {
         super.beforeAbstractKeycloakTest();
     }
 
+    protected void allowMultipleAudiencesForClientJWTOnServer(boolean allowMultipleAudiences) {
+        getTestingClient().testing().setSystemPropertyOnServer("oidc." + OIDCLoginProtocolFactory.CONFIG_OIDC_ALLOW_MULTIPLE_AUDIENCES_FOR_JWT_CLIENT_AUTHENTICATION, String.valueOf(allowMultipleAudiences));
+        getTestingClient().testing().reinitializeProviderFactoryWithSystemPropertiesScope(LoginProtocol.class.getName(), OIDCLoginProtocol.LOGIN_PROTOCOL, "oidc.");
+    }
+
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmBuilder realmBuilder = RealmBuilder.create().name("test")
@@ -222,8 +232,8 @@ public void testCodeToTokenRequestSuccess(String algorithm) throws Exception {
                 .client("client2")
                 .assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClient2SignedJWT(algorithm));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequest(code, getClient2SignedJWT(algorithm));
 
         assertEquals(200, response.getStatusCode());
         oauth.verifyToken(response.getAccessToken());
@@ -266,13 +276,13 @@ protected String getClientSignedToken(String alg) throws Exception {
             oauth.clientId("client2");
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
             clientSignedToken = createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, alg);
-            OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, clientSignedToken);
+            AccessTokenResponse response = doAccessTokenRequest(code, clientSignedToken);
 
             assertEquals(200, response.getStatusCode());
             oauth.verifyToken(response.getAccessToken());
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
             return clientSignedToken;
         } finally {
             // Revert jwks_url settings
@@ -306,8 +316,8 @@ protected void testCodeToTokenRequestSuccess(String algorithm, String curve, boo
                     .client("client2")
                     .assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code,
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = doAccessTokenRequest(code,
                     createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, algorithm, curve));
 
             assertEquals(200, response.getStatusCode());
@@ -339,7 +349,7 @@ protected void testDirectGrantRequestSuccess(String algorithm) throws Exception
 
             // test
             oauth.clientId("client2");
-            OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, algorithm));
+            AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, algorithm));
 
             assertEquals(200, response.getStatusCode());
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -379,6 +389,8 @@ protected void testClientWithGeneratedKeys(String format) throws Exception {
         keyStoreConfig.setKeyPassword(keyPassword);
         keyStoreConfig.setStorePassword(storePassword);
         keyStoreConfig.setKeyAlias(keyAlias);
+        keyStoreConfig.setKeySize(4096);
+        keyStoreConfig.setValidity(3);
 
         client = getClient(testRealm.getRealm(), client.getId()).toRepresentation();
         final String certOld = client.getAttributes().get(JWTClientAuthenticator.CERTIFICATE_ATTR);
@@ -404,9 +416,9 @@ protected void testClientWithGeneratedKeys(String format) throws Exception {
         PrivateKey privateKey = (PrivateKey) keyStore.getKey(keyAlias, keyPassword.toCharArray());
         KeyPair keyPair = new KeyPair(x509Cert.getPublicKey(), privateKey);
 
-        OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest(user.getUsername(),
-                                                      user.getCredentials().get(0).getValue(),
-                                                        getClientSignedJWT(keyPair, client.getClientId()));
+        AccessTokenResponse response = doGrantAccessTokenRequest(user.getUsername(),
+                user.getCredentials().get(0).getValue(),
+                getClientSignedJWT(keyPair, client.getClientId()));
 
         assertEquals(200, response.getStatusCode());
 
@@ -443,8 +455,8 @@ protected void testUploadKeystore(String keystoreFormat, String filePath, String
         }
 
         // Get admin access token, no matter it's master realm's admin
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest(
-                AuthRealm.MASTER, AuthRealm.ADMIN, AuthRealm.ADMIN, null, "admin-cli", null);
+        AccessTokenResponse accessTokenResponse = oauth.realm(AuthRealm.MASTER).client("admin-cli").doPasswordGrantRequest(
+                AuthRealm.ADMIN, AuthRealm.ADMIN);
         assertEquals(200, accessTokenResponse.getStatusCode());
 
         final String url = suiteContext.getAuthServerInfo().getContextRoot()
@@ -498,27 +510,32 @@ protected void testUploadKeystore(String keystoreFormat, String filePath, String
         }
     }
 
+    protected List<NameValuePair> createTokenWithSpecifiedAudience(ClientResource clientResource, ClientRepresentation clientRepresentation, String... audience) throws Exception {
+        KeyPair keyPair = setupJwksUrl(Algorithm.PS256, clientRepresentation, clientResource);
+        PublicKey publicKey = keyPair.getPublic();
+        PrivateKey privateKey = keyPair.getPrivate();
+        JsonWebToken assertion = createRequestToken(app2.getClientId(), getRealmInfoUrl());
+
+        assertion.audience(audience);
+
+        List<NameValuePair> parameters = new LinkedList<NameValuePair>();
+        parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
+        parameters
+                .add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
+        parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION,
+                createSignedRequestToken(privateKey, publicKey, Algorithm.PS256, null, assertion, null)));
+        return parameters;
+    }
+
     protected void testEndpointAsAudience(String endpointUrl) throws Exception {
         ClientRepresentation clientRepresentation = app2;
         ClientResource clientResource = getClient(testRealm.getRealm(), clientRepresentation.getId());
         clientRepresentation = clientResource.toRepresentation();
         try {
-            KeyPair keyPair = setupJwksUrl(Algorithm.PS256, clientRepresentation, clientResource);
-            PublicKey publicKey = keyPair.getPublic();
-            PrivateKey privateKey = keyPair.getPrivate();
-            JsonWebToken assertion = createRequestToken(app2.getClientId(), getRealmInfoUrl());
+            List<NameValuePair> parameters = createTokenWithSpecifiedAudience(clientResource, clientRepresentation, endpointUrl);
 
-            assertion.audience(endpointUrl);
-
-            List<NameValuePair> parameters = new LinkedList<NameValuePair>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
-            parameters
-                .add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION,
-                createSignedRequestToken(privateKey, publicKey, Algorithm.PS256, null, assertion, null)));
-
-            try (CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters)) {
-                OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+            try (CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters)) {
+                AccessTokenResponse response = new AccessTokenResponse(resp);
                 assertNotNull(response.getAccessToken());
             }
         } finally {
@@ -526,11 +543,11 @@ protected void testEndpointAsAudience(String endpointUrl) throws Exception {
         }
     }
 
-    protected OAuthClient.AccessTokenResponse testMissingClaim(String... claims) throws Exception {
+    protected AccessTokenResponse testMissingClaim(String... claims) throws Exception {
         return testMissingClaim(0, claims);
     }
 
-    protected OAuthClient.AccessTokenResponse testMissingClaim(int tokenTimeOffset, String... claims) throws Exception {
+    protected AccessTokenResponse testMissingClaim(int tokenTimeOffset, String... claims) throws Exception {
         CustomJWTClientCredentialsProvider jwtProvider = new CustomJWTClientCredentialsProvider();
         jwtProvider.setupKeyPair(keyPairClient1);
         jwtProvider.setTokenTimeout(10);
@@ -549,17 +566,17 @@ protected OAuthClient.AccessTokenResponse testMissingClaim(int tokenTimeOffset,
         return doClientCredentialsGrantRequest(jwt);
     }
 
-    protected void assertError(OAuthClient.AccessTokenResponse response, String clientId, String responseError, String eventError) {
+    protected void assertError(AccessTokenResponse response, String clientId, String responseError, String eventError) {
         assertEquals(400, response.getStatusCode());
         assertMessageError(response,clientId,responseError,eventError);
     }
 
-    protected void assertError(OAuthClient.AccessTokenResponse response, int erroCode, String clientId, String responseError, String eventError) {
+    protected void assertError(AccessTokenResponse response, int erroCode, String clientId, String responseError, String eventError) {
         assertEquals(erroCode, response.getStatusCode());
         assertMessageError(response, clientId, responseError, eventError);
     }
 
-    protected void assertMessageError(OAuthClient.AccessTokenResponse response, String clientId, String responseError, String eventError) {
+    protected void assertMessageError(AccessTokenResponse response, String clientId, String responseError, String eventError) {
         assertEquals(responseError, response.getError());
 
         events.expectClientLogin()
@@ -571,7 +588,7 @@ protected void assertMessageError(OAuthClient.AccessTokenResponse response, Stri
                 .assertEvent();
     }
 
-    protected void assertSuccess(OAuthClient.AccessTokenResponse response, String clientId, String userId, String userName) {
+    protected void assertSuccess(AccessTokenResponse response, String clientId, String userId, String userName) {
         assertEquals(200, response.getStatusCode());
 
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -612,8 +629,8 @@ protected void testCodeToTokenRequestFailure(String algorithm, String error, Str
                     .client("client2")
                     .assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClient2SignedJWT());
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = doAccessTokenRequest(code, getClient2SignedJWT());
 
             assertEquals(400, response.getStatusCode());
             assertEquals(error, response.getError());
@@ -641,7 +658,7 @@ protected void testDirectGrantRequestFailure(String algorithm) throws Exception
 
             // test
             oauth.clientId("client2");
-            OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", getClient2SignedJWT());
+            AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", getClient2SignedJWT());
 
             assertEquals(400, response.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
@@ -661,7 +678,7 @@ protected void testDirectGrantRequestFailure(String algorithm) throws Exception
 
     // HELPER METHODS
 
-    protected OAuthClient.AccessTokenResponse doAccessTokenRequest(String code, String signedJwt) throws Exception {
+    protected AccessTokenResponse doAccessTokenRequest(String code, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
@@ -669,19 +686,19 @@ protected OAuthClient.AccessTokenResponse doAccessTokenRequest(String code, Stri
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getAccessTokenUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
-    protected OAuthClient.AccessTokenResponse doRefreshTokenRequest(String refreshToken, String signedJwt) throws Exception {
+    protected AccessTokenResponse doRefreshTokenRequest(String refreshToken, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<NameValuePair>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));
         parameters.add(new BasicNameValuePair(OAuth2Constants.REFRESH_TOKEN, refreshToken));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getRefreshTokenUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
     protected HttpResponse doLogout(String refreshToken, String signedJwt) throws Exception {
@@ -691,20 +708,20 @@ protected HttpResponse doLogout(String refreshToken, String signedJwt) throws Ex
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        return sendRequest(oauth.getLogoutUrl().build(), parameters);
+        return sendRequest(oauth.getEndpoints().getLogout(), parameters);
     }
 
-    protected OAuthClient.AccessTokenResponse doClientCredentialsGrantRequest(String signedJwt) throws Exception {
+    protected AccessTokenResponse doClientCredentialsGrantRequest(String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<NameValuePair>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
-    protected OAuthClient.AccessTokenResponse doGrantAccessTokenRequest(String username, String password, String signedJwt) throws Exception {
+    protected AccessTokenResponse doGrantAccessTokenRequest(String username, String password, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<NameValuePair>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.PASSWORD));
         parameters.add(new BasicNameValuePair("username", username));
@@ -712,19 +729,16 @@ protected OAuthClient.AccessTokenResponse doGrantAccessTokenRequest(String usern
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getResourceOwnerPasswordCredentialGrantUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
     protected CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair> parameters) throws Exception {
-        CloseableHttpClient client = new DefaultHttpClient();
-        try {
+        try (CloseableHttpClient client = new DefaultHttpClient()) {
             HttpPost post = new HttpPost(requestUrl);
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
             return client.execute(post);
-        } finally {
-            oauth.closeClient(client);
         }
     }
 
@@ -831,12 +845,12 @@ protected KeyPair setupJwksUrl(String algorithm, ClientRepresentation clientRepr
     }
 
     protected KeyPair setupJwksUrl(String algorithm, boolean advertiseJWKAlgorithm, boolean keepExistingKeys, String kid,
-                                 ClientRepresentation clientRepresentation, ClientResource clientResource) throws Exception {
+                                   ClientRepresentation clientRepresentation, ClientResource clientResource) throws Exception {
         return setupJwksUrl(algorithm, null, advertiseJWKAlgorithm, keepExistingKeys, kid, clientRepresentation, clientResource);
     }
 
     protected KeyPair setupJwksUrl(String algorithm, String curve, boolean advertiseJWKAlgorithm, boolean keepExistingKeys, String kid,
-                                 ClientRepresentation clientRepresentation, ClientResource clientResource) throws Exception {
+                                   ClientRepresentation clientRepresentation, ClientResource clientResource) throws Exception {
         // generate and register client keypair
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.generateKeys(algorithm, curve, advertiseJWKAlgorithm, keepExistingKeys, kid);
@@ -856,7 +870,7 @@ protected KeyPair setupJwksUrl(String algorithm, String curve, boolean advertise
     }
 
     private KeyPair setupJwks(String algorithm, String curve, ClientRepresentation clientRepresentation, ClientResource clientResource)
-        throws Exception {
+            throws Exception {
         // generate and register client keypair
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.generateKeys(algorithm, curve);
@@ -867,7 +881,7 @@ private KeyPair setupJwks(String algorithm, String curve, ClientRepresentation c
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRepresentation).setUseJwksString(true);
         JSONWebKeySet keySet = oidcClientEndpointsResource.getJwks();
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRepresentation)
-            .setJwksString(JsonSerialization.writeValueAsString(keySet));
+                .setJwksString(JsonSerialization.writeValueAsString(keySet));
         clientResource.update(clientRepresentation);
 
         // set time offset, so that new keys are downloaded
@@ -927,7 +941,7 @@ protected String createSignedRequestToken(PrivateKey privateKey, PublicKey publi
         if (kid == null) {
             kid = KeyUtils.createKeyId(publicKey);
         }
-        SignatureSignerContext signer = oauth.createSigner(privateKey, kid, algorithm, curve);
+        SignatureSignerContext signer = SignatureSignerUtil.createSigner(privateKey, kid, algorithm, curve);
         String ret = new JWSBuilder().kid(kid).jsonContent(jwt).sign(signer);
         return ret;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsNotCleanedUpTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsNotCleanedUpTest.java
index f90eafe5c699..36a71ad04ca1 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsNotCleanedUpTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsNotCleanedUpTest.java
@@ -29,7 +29,8 @@
 import org.keycloak.testsuite.AssertEvents;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
-import org.keycloak.testsuite.util.OAuthClient;
+
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.openqa.selenium.By;
 
 /**
@@ -47,7 +48,7 @@ public void beforeAbstractKeycloakTest() throws Exception {
 
     @Before
     public void clientConfiguration() {
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
         oauth.realm("test-duplicate-emails");
 
         RealmRepresentation realmRep = new RealmRepresentation();
@@ -66,8 +67,8 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void loginWithNonDuplicateEmail() throws Exception {
         oauth.doLogin("non-duplicate-email-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         
@@ -87,8 +88,8 @@ public void loginWithDuplicateEmail() throws Exception {
     public void loginWithUserHavingDuplicateEmailByUsername() throws Exception {
         oauth.doLogin("duplicate-email-user1", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsTest.java
index ecb74943b602..55243fa356c2 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenDuplicateEmailsTest.java
@@ -24,7 +24,8 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
 import java.util.List;
 
 import static org.junit.Assert.assertEquals;
@@ -72,8 +73,8 @@ public void loginFormUsernameLabel() throws Exception {
     public void loginWithNonDuplicateEmailUser() throws Exception {
         oauth.doLogin("non-duplicate-email-user", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         
@@ -87,8 +88,8 @@ public void loginWithNonDuplicateEmailUser() throws Exception {
     public void loginWithFirstDuplicateEmailUser() throws Exception {
         oauth.doLogin("duplicate-email-user1", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         
@@ -102,8 +103,8 @@ public void loginWithFirstDuplicateEmailUser() throws Exception {
     public void loginWithSecondDuplicateEmailUser() throws Exception {
         oauth.doLogin("duplicate-email-user2", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenNoEmailLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenNoEmailLoginTest.java
index 94d00e9c420e..a0c8dd816384 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenNoEmailLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenNoEmailLoginTest.java
@@ -27,7 +27,8 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
-import org.keycloak.testsuite.util.OAuthClient;
+
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.openqa.selenium.By;
 
 /**
@@ -63,8 +64,8 @@ public void loginFormUsernameLabel() throws Exception {
     public void loginWithUsername() throws Exception {
         oauth.doLogin("non-duplicate-email-user", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
@@ -76,7 +77,7 @@ public void loginWithUsername() throws Exception {
 
     @Test
     public void loginWithEmail() throws Exception {
-        oauth.doLoginGrant("non-duplicate-email-user@localhost", "password");
+        oauth.doLogin("non-duplicate-email-user@localhost", "password");
         
         assertEquals("Invalid username or password.", driver.findElement(By.className("kc-feedback-text")).getText());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenResponseTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenResponseTest.java
index a05c711516b6..dadab07037a7 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenResponseTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenResponseTest.java
@@ -21,7 +21,7 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 
 public class AccessTokenResponseTest extends AbstractKeycloakTest {
@@ -75,8 +75,8 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void accessTokenRequest() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java
index 518f73257262..e6642f1ce72d 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AccessTokenTest.java
@@ -23,6 +23,7 @@
 import com.fasterxml.jackson.databind.node.TextNode;
 import org.apache.http.NameValuePair;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClientBuilder;
@@ -81,16 +82,18 @@
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 import org.keycloak.testsuite.util.UserManager;
+import org.keycloak.testsuite.util.oauth.UserInfoResponse;
 import org.keycloak.util.BasicAuthHelper;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
+import org.keycloak.utils.MediaType;
 import org.openqa.selenium.By;
 
 import jakarta.ws.rs.client.Client;
@@ -124,7 +127,7 @@
 import static org.keycloak.testsuite.admin.ApiUtil.findClientByClientId;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsernameId;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 import static org.keycloak.testsuite.util.ProtocolMapperUtil.createRoleNameMapper;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
 
@@ -136,6 +139,7 @@ public class AccessTokenTest extends AbstractKeycloakTest {
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
+    private HttpGet get;
 
     @Override
     public void beforeAbstractKeycloakTest() throws Exception {
@@ -151,7 +155,7 @@ public void clientConfiguration() {
          * will faile and the clientID will always be "sample-public-client
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
     }
 
     @Override
@@ -196,8 +200,8 @@ public void accessTokenRequest() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
@@ -206,7 +210,7 @@ public void accessTokenRequest() throws Exception {
 
         assertEquals("Bearer", response.getTokenType());
 
-        String expectedKid = Stream.of(oauth.doCertsRequest("test").getKeys())
+        String expectedKid = Stream.of(oauth.keys().getRealmKeys().getKeys())
                 .filter(jwk -> KeyUse.SIG.getSpecName().equals(jwk.getPublicKeyUse()))
                 .map(JWK::getKeyId)
                 .findFirst().orElseThrow(() -> new AssertionError("Was not able to find key with usage SIG in the 'test' realm keys"));
@@ -274,8 +278,8 @@ public void testTokenResponseUsingLowerCaseType() throws Exception {
         try {
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
             assertEquals(TokenUtil.TOKEN_TYPE_BEARER.toLowerCase(), response.getTokenType());
         } finally {
@@ -284,6 +288,28 @@ public void testTokenResponseUsingLowerCaseType() throws Exception {
         }
     }
 
+    @Test
+    public void testTokenResponseUsingRfc9068HeaderType() throws Exception {
+        ClientsResource clients = realmsResouce().realm("test").clients();
+        ClientRepresentation client = clients.findByClientId(oauth.getClientId()).get(0);
+
+        OIDCAdvancedConfigWrapper.fromClientRepresentation(client).setUseRfc9068AccessTokenHeaderType(true);
+        clients.get(client.getId()).update(client);
+
+        try {
+            oauth.doLogin("test-user@localhost", "password");
+
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+
+            JWSHeader header = new JWSInput(response.getAccessToken()).getHeader();
+            assertEquals("at+jwt", header.getType());
+        } finally {
+            OIDCAdvancedConfigWrapper.fromClientRepresentation(client).setUseRfc9068AccessTokenHeaderType(false);
+            clients.get(client.getId()).update(client);
+        }
+    }
+
     // KEYCLOAK-3692
     @Test
     public void accessTokenWrongCode() throws Exception {
@@ -296,7 +322,7 @@ public void accessTokenWrongCode() throws Exception {
 
         events.expectLogin().assertEvent();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(loginPageCode, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(loginPageCode);
 
         assertEquals(400, response.getStatusCode());
         assertNull(response.getRefreshToken());
@@ -309,8 +335,8 @@ public void accessTokenInvalidClientCredentials() throws Exception {
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "invalid");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.client("test-app", "invalid").doAccessTokenRequest(code);
         assertEquals(401, response.getStatusCode());
 
         AssertEvents.ExpectedEvent expectedEvent = events.expectCodeToToken(codeId, loginEvent.getSessionId()).error("invalid_client_credentials").clearDetails().user((String) null).session((String) null);
@@ -319,13 +345,14 @@ public void accessTokenInvalidClientCredentials() throws Exception {
 
     @Test
     public void accessTokenMissingClientCredentials() throws Exception {
+        oauth.client("test-app");
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(401, response.getStatusCode());
 
         AssertEvents.ExpectedEvent expectedEvent = events.expectCodeToToken(codeId, loginEvent.getSessionId()).error("invalid_client_credentials").clearDetails().user((String) null).session((String) null);
@@ -339,14 +366,14 @@ public void accessTokenInvalidRedirectUri() throws Exception {
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         //@TODO This new and was necesssary to not mess up with other tests cases
         String redirectUri = oauth.getRedirectUri();
 
         oauth.redirectUri("http://invalid");
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
         assertEquals("Incorrect redirect_uri", response.getErrorDescription());
@@ -373,9 +400,9 @@ public void accessTokenUserSessionExpired() {
 
 
         testingClient.testing().removeUserSession("test", sessionId);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         assertEquals(400, tokenResponse.getStatusCode());
         assertNull(tokenResponse.getAccessToken());
         assertNull(tokenResponse.getRefreshToken());
@@ -404,12 +431,12 @@ public void accessTokenCodeExpired() {
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
         loginEvent.getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         try {
             setTimeOffset(2);
 
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             Assert.assertEquals(400, response.getStatusCode());
         } finally {
             getTestingClient().testing().revertTestingInfinispanTimeService();
@@ -429,6 +456,23 @@ public void accessTokenCodeExpired() {
         RealmManager.realm(adminClient.realm("test")).accessCodeLifeSpan(60);
     }
 
+    @Test
+    public void bearerAccessTokenAsDPoPOnUserInfoEndpoint() throws IOException {
+        oauth.doLogin("test-user@localhost", "password");
+        EventRepresentation loginEvent = events.expectLogin().assertEvent();
+        loginEvent.getSessionId();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
+        Assert.assertEquals(200, response.getStatusCode());
+
+        get = new HttpGet(oauth.getEndpoints().getUserInfo());
+        get.addHeader("Accept", MediaType.APPLICATION_JSON);
+        get.addHeader(HttpHeaders.AUTHORIZATION, "DPoP" + " " + response.getAccessToken());
+
+        UserInfoResponse userInfoResponse = new UserInfoResponse(oauth.httpClient().get().execute(get));
+
+        assertEquals(401, userInfoResponse.getStatusCode());
+    }
+
     @Test
     public void accessTokenCodeUsed() throws IOException {
         oauth.doLogin("test-user@localhost", "password");
@@ -438,8 +482,8 @@ public void accessTokenCodeUsed() throws IOException {
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
         loginEvent.getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         Assert.assertEquals(200, response.getStatusCode());
         String accessToken = response.getAccessToken();
 
@@ -450,16 +494,14 @@ public void accessTokenCodeUsed() throws IOException {
             UserInfoClientUtil.testSuccessfulUserInfoResponse(userInfoResponse, "test-user@localhost", "test-user@localhost");
 
             // Check that tokenIntrospection can be invoked
-            String introspectionResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password", accessToken);
-            ObjectMapper objectMapper = new ObjectMapper();
-            JsonNode jsonNode = objectMapper.readTree(introspectionResponse);
+            JsonNode jsonNode = oauth.doIntrospectionAccessTokenRequest(accessToken).asJsonNode();
             Assert.assertEquals(true, jsonNode.get("active").asBoolean());
             Assert.assertEquals("test-user@localhost", jsonNode.get("email").asText());
 
             events.clear();
 
             // Repeating attempt to exchange code should be refused and invalidate previous clientSession
-            response = oauth.doAccessTokenRequest(code, "password");
+            response = oauth.doAccessTokenRequest(code);
             Assert.assertEquals(400, response.getStatusCode());
 
             AssertEvents.ExpectedEvent expectedEvent = events.expectCodeToToken(codeId, codeId);
@@ -476,9 +518,7 @@ public void accessTokenCodeUsed() throws IOException {
             userInfoResponse.close();
 
             // Check that tokenIntrospection can't be invoked with invalidated accessToken
-            introspectionResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password", accessToken);
-            objectMapper = new ObjectMapper();
-            jsonNode = objectMapper.readTree(introspectionResponse);
+            jsonNode = oauth.doIntrospectionAccessTokenRequest(accessToken).asJsonNode();
             Assert.assertEquals(false, jsonNode.get("active").asBoolean());
             Assert.assertNull(jsonNode.get("email"));
 
@@ -504,11 +544,11 @@ public void accessTokenCodeRoleMissing() {
 
         loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         realmResource.roles().deleteRole("tmp-role");
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals(200, response.getStatusCode());
 
@@ -530,7 +570,7 @@ public void accessTokenCodeHasRequiredAction() {
         String actionURI = ActionURIUtils.getActionURIFromPageSource(driver.getPageSource());
         String code = ActionURIUtils.parseQueryParamsFromActionURI(actionURI).get("code");
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         Assert.assertEquals(400, response.getStatusCode());
 
         EventRepresentation event = events.poll();
@@ -1006,17 +1046,17 @@ public void testAuthorizationNegotiateHeaderIgnored() throws Exception {
                 .publicClient()
                 .build());
 
-        oauth.clientId("sample-public-client");
+        oauth.client("sample-public-client");
         oauth.doLogin("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin().client("sample-public-client").assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getAccessTokenUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getToken());
 
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
@@ -1028,7 +1068,7 @@ public void testAuthorizationNegotiateHeaderIgnored() throws Exception {
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
 
-            OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(client.execute(post));
+            AccessTokenResponse response = new AccessTokenResponse(client.execute(post));
             Assert.assertEquals(200, response.getStatusCode());
             AccessToken token = oauth.verifyToken(response.getAccessToken());
             events.expectCodeToToken(codeId, sessionId).client("sample-public-client").assertEvent();
@@ -1051,8 +1091,8 @@ public void expiration() throws Exception {
         try {
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
 
             // Assert refresh expiration equals session idle
@@ -1063,7 +1103,7 @@ public void expiration() throws Exception {
 
             setTimeOffset(sessionMax - 60);
 
-            response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
             assertEquals(200, response.getStatusCode());
 
             // Assert expiration equals session expiration
@@ -1084,8 +1124,8 @@ public void accessTokenResponseHeader() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
@@ -1149,8 +1189,8 @@ public void clientAccessTokenLifespanOverride() {
 
             // Check access token expires in 500 seconds as specified on client
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
 
             assertExpiration(response.getExpiresIn(), 500);
@@ -1161,7 +1201,7 @@ public void clientAccessTokenLifespanOverride() {
             client.update(clientRep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
 
             assertExpiration(response.getExpiresIn(), sessionMax);
@@ -1183,8 +1223,8 @@ public void testClientSessionMaxLifespan() throws Exception {
 
         try {
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan);
 
@@ -1192,7 +1232,7 @@ public void testClientSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan - 100);
 
@@ -1201,7 +1241,7 @@ public void testClientSessionMaxLifespan() throws Exception {
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan - 200);
         } finally {
@@ -1229,8 +1269,8 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
 
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan);
 
@@ -1238,7 +1278,7 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan - 100);
 
@@ -1247,7 +1287,7 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), accessTokenLifespan - 200);
         } finally {
@@ -1268,8 +1308,8 @@ public void accessTokenRequestNoRefreshToken() {
 
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
@@ -1376,8 +1416,8 @@ private void validateTokenECDSASignature(String expectedAlg) {
 
     private void validateTokenSignatureLength(int expectedLength) {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         String token = response.getAccessToken();
         oauth.verifyToken(token);
@@ -1385,7 +1425,7 @@ private void validateTokenSignatureLength(int expectedLength) {
         String encodedSignature = token.split("\\.",3)[2];
         byte[] signature = Base64Url.decode(encodedSignature);
         Assert.assertEquals(expectedLength, signature.length);
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
     }
 
     private void conductAccessTokenRequest(String expectedRefreshAlg, String expectedAccessAlg, String expectedIdTokenAlg) throws Exception {
@@ -1412,8 +1452,8 @@ private void tokenRequest(String expectedRefreshAlg, String expectedAccessAlg, S
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
 
@@ -1460,10 +1500,10 @@ private void verifySignatureAlgorithm(JWSHeader header, String expectedAlgorithm
     public void tokenRequestParamsMoreThanOnce() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getAccessTokenUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getToken());
 
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
@@ -1478,7 +1518,7 @@ public void tokenRequestParamsMoreThanOnce() throws Exception {
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
 
-            OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(client.execute(post));
+            AccessTokenResponse response = new AccessTokenResponse(client.execute(post));
             assertEquals(400, response.getStatusCode());
             assertEquals("invalid_request", response.getError());
             assertEquals("duplicated parameter", response.getErrorDescription());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java
index 093d114b7d5e..e7cdba1567a5 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/AuthorizationCodeTest.java
@@ -19,6 +19,7 @@
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Before;
@@ -42,11 +43,10 @@
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.By;
 
-import jakarta.ws.rs.core.UriBuilder;
 import java.io.IOException;
 import java.net.URI;
 import java.util.Collections;
@@ -86,14 +86,11 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void clientConfiguration() {
         oauth.responseType(OAuth2Constants.CODE);
         oauth.responseMode(null);
-        oauth.stateParamRandom();
     }
 
     @Test
     public void authorizationRequest() throws IOException {
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         Assert.assertNotNull(response.getCode());
@@ -139,7 +136,7 @@ public void authorizationRequestInstalledAppErrors() throws IOException {
     public void authorizationValidRedirectUri() throws IOException {
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").addRedirectUris(oauth.getRedirectUri());
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         Assert.assertNotNull(response.getCode());
@@ -166,9 +163,7 @@ public void testInvalidRedirectUri() {
 
     @Test
     public void authorizationRequestNoState() throws IOException {
-        oauth.stateParamHardcoded(null);
-
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         Assert.assertNotNull(response.getCode());
@@ -182,10 +177,9 @@ public void authorizationRequestNoState() throws IOException {
     @Test
     public void authorizationRequestInvalidResponseType() throws IOException {
         oauth.responseType("tokenn");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE);
         Assert.assertEquals(oauth.AUTH_SERVER_ROOT + "/realms/test", errorResponse.getIssuer());
@@ -198,7 +192,7 @@ public void authorizationRequestInvalidResponseType() throws IOException {
     public void authorizationRequestInvalidResponseType_testHeaders() throws IOException {
         oauth.responseType("tokenn");
         Client client = AdminClientUtil.createResteasyClient();
-        Response response = client.target(oauth.getLoginFormUrl()).request().get();
+        Response response = client.target(oauth.loginForm().build()).request().get();
 
         assertThat(response.getStatus(), is(equalTo(302)));
         String cacheControl = response.getHeaderString(HttpHeaders.CACHE_CONTROL);
@@ -211,9 +205,7 @@ public void authorizationRequestInvalidResponseType_testHeaders() throws IOExcep
     public void authorizationRequestFormPostResponseModeInvalidResponseType() throws IOException {
         oauth.responseMode(OIDCResponseMode.FORM_POST.value());
         oauth.responseType("tokenn");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").open();
 
         String error = driver.findElement(By.id("error")).getText();
         String state = driver.findElement(By.id("state")).getText();
@@ -227,9 +219,7 @@ public void authorizationRequestFormPostResponseModeInvalidResponseType() throws
     public void authorizationRequestFormPostResponseModeWithoutResponseType() throws IOException {
         oauth.responseMode(OIDCResponseMode.FORM_POST.value());
         oauth.responseType(null);
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").open();
 
         String error = driver.findElement(By.id("error")).getText();
         String errorDescription = driver.findElement(By.id("error_description")).getText();
@@ -245,8 +235,7 @@ public void authorizationRequestFormPostResponseModeWithoutResponseType() throws
     @Test
     public void authorizationRequestFormPostResponseMode() throws IOException {
         oauth.responseMode(OIDCResponseMode.FORM_POST.value());
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.doLoginGrant("test-user@localhost", "password");
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         String sources = driver.getPageSource();
         System.out.println(sources);
@@ -285,14 +274,16 @@ public void authorizationRequestFormPostResponseModeHTMLEntitiesRedirectUri() th
             oauth.responseType(OAuth2Constants.CODE);
             final String redirectUri = oauth.getRedirectUri() + "?p=&gt;"; // set HTML entity &gt;
             oauth.redirectUri(redirectUri);
-            oauth.stateParamHardcoded(KeycloakModelUtils.generateId());
-            oauth.doLogin("test-user@localhost", "password");
+
+            String requestState = "authorizationRequestFormPostResponseModeHTMLEntitiesRedirectUri";
+
+            oauth.loginForm().state(requestState).doLogin("test-user@localhost", "password");
 
             WaitUtils.waitForPageToLoad();
             // if not properly encoded %3E would be received instead of &gt;
             Assert.assertEquals("Redirect page was not encoded", redirectUri, oauth.getDriver().getCurrentUrl());
             String state = driver.findElement(By.id("state")).getText();
-            Assert.assertEquals(oauth.getState(), state);
+            Assert.assertEquals(requestState, state);
             Assert.assertNotNull(driver.findElement(By.id("code")).getText());
 
             events.expect(EventType.LOGIN)
@@ -314,8 +305,9 @@ public void authorizationRequestFormPostJwtResponseModeHTMLEntitiesRedirectUri()
             oauth.responseType(OAuth2Constants.CODE);
             final String redirectUri = oauth.getRedirectUri() + "?p=&gt;"; // set HTML entity &gt;
             oauth.redirectUri(redirectUri);
-            oauth.stateParamHardcoded(KeycloakModelUtils.generateId());
-            oauth.doLogin("test-user@localhost", "password");
+
+            String requestState = "authorizationRequestFormPostJwtResponseModeHTMLEntitiesRedirectUri";
+            oauth.loginForm().state(requestState).doLogin("test-user@localhost", "password");
 
             WaitUtils.waitForPageToLoad();
             // if not properly encoded %3E would be received instead of &gt;
@@ -325,7 +317,7 @@ public void authorizationRequestFormPostJwtResponseModeHTMLEntitiesRedirectUri()
             assertEquals("test-app", responseToken.getAudience()[0]);
             Assert.assertNotNull(responseToken.getOtherClaims().get("code"));
             Assert.assertNull(responseToken.getOtherClaims().get("error"));
-            Assert.assertEquals(oauth.getState(), responseToken.getOtherClaims().get("state"));
+            Assert.assertEquals(requestState, responseToken.getOtherClaims().get("state"));
             Assert.assertNotNull(responseToken.getOtherClaims().get("code"));
 
             events.expect(EventType.LOGIN)
@@ -341,8 +333,7 @@ public void authorizationRequestFormPostJwtResponseModeHTMLEntitiesRedirectUri()
     @Test
     public void authorizationRequestFormPostResponseModeWithCustomState() throws IOException {
         oauth.responseMode(OIDCResponseMode.FORM_POST.value());
-        oauth.stateParamHardcoded("\"><foo>bar_baz(2)far</foo>");
-        oauth.doLoginGrant("test-user@localhost", "password");
+        oauth.loginForm().state("\"><foo>bar_baz(2)far</foo>").doLogin("test-user@localhost", "password");
 
         String sources = driver.getPageSource();
         System.out.println(sources);
@@ -360,7 +351,7 @@ public void authorizationRequestFormPostResponseModeWithCustomState() throws IOE
     public void authorizationRequestFragmentResponseModeNotKept() throws Exception {
         // Set response_mode=fragment and login
         oauth.responseMode(OIDCResponseMode.FRAGMENT.value());
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("authorizationRequestFragmentResponseModeNotKept").doLogin("test-user@localhost", "password");
 
         Assert.assertNotNull(response.getCode());
         Assert.assertNotNull(response.getState());
@@ -371,8 +362,8 @@ public void authorizationRequestFragmentResponseModeNotKept() throws Exception {
 
         // Unset response_mode. The initial OIDC AuthenticationRequest won't contain "response_mode" parameter now and hence it should fallback to "query".
         oauth.responseMode(null);
-        oauth.openLoginForm();
-        response = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        oauth.loginForm().state("authorizationRequestFragmentResponseModeNotKept2").open();
+        response = oauth.parseLoginResponse();
 
         Assert.assertNotNull(response.getCode());
         Assert.assertNotNull(response.getState());
@@ -385,32 +376,29 @@ public void authorizationRequestFragmentResponseModeNotKept() throws Exception {
 
     @Test
     public void authorizationRequestParamsMoreThanOnce() throws IOException {
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        Map<String, String> extraParams = new HashMap<>();
+        String logoutUrl = UriBuilder.fromUri(oauth.loginForm().build()).queryParam(OAuth2Constants.SCOPE, "read_write")
+                .queryParam(OAuth2Constants.STATE, "abcdefg")
+                .queryParam(OAuth2Constants.SCOPE, "pop push").build().toString();
 
-        oauth.addCustomParameter(OAuth2Constants.SCOPE, "read_write")
-            .addCustomParameter(OAuth2Constants.STATE, "abcdefg")
-            .addCustomParameter(OAuth2Constants.SCOPE, "pop push");
+        driver.navigate().to(logoutUrl);
 
-        oauth.openLoginForm();
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
 
-        assertEquals("invalid_request", oauth.getCurrentQuery().get("error"));
-        assertEquals("duplicated parameter", oauth.getCurrentQuery().get("error_description"));
+        assertEquals("invalid_request", response.getError());
+        assertEquals("duplicated parameter", response.getErrorDescription());
 
         events.expectLogin().error(Errors.INVALID_REQUEST).user((String) null).session((String) null).clearDetails().assertEvent();
     }
 
     @Test
     public void authorizationRequestClientParamsMoreThanOnce() throws IOException {
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-
-        oauth.addCustomParameter(OAuth2Constants.SCOPE, "read_write")
-                .addCustomParameter(OAuth2Constants.CLIENT_ID, "client2client")
-                .addCustomParameter(OAuth2Constants.REDIRECT_URI, "https://www.example.com")
-                .addCustomParameter(OAuth2Constants.STATE, "abcdefg")
-                .addCustomParameter(OAuth2Constants.SCOPE, "pop push");
+        String logoutUrl = UriBuilder.fromUri(oauth.loginForm().build()).queryParam(OAuth2Constants.SCOPE, "read_write")
+                .queryParam(OAuth2Constants.CLIENT_ID, "client2client")
+                .queryParam(OAuth2Constants.REDIRECT_URI, "https://www.example.com")
+                .queryParam(OAuth2Constants.STATE, "abcdefg")
+                .queryParam(OAuth2Constants.SCOPE, "pop push").build().toString();
 
-        oauth.openLoginForm();
+        driver.navigate().to(logoutUrl);
 
         assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/BackchannelLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/BackchannelLogoutTest.java
index d0ab7d99445d..d77b6085b9df 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/BackchannelLogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/BackchannelLogoutTest.java
@@ -1,17 +1,17 @@
 package org.keycloak.testsuite.oauth;
 
-import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.keycloak.testsuite.admin.ApiUtil.createUserWithAdminClient;
 import static org.keycloak.testsuite.admin.ApiUtil.resetUserPassword;
 import static org.keycloak.testsuite.broker.BrokerTestTools.getConsumerRoot;
+import static org.keycloak.testsuite.util.WaitUtils.waitUntilElement;
 
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.jboss.arquillian.drone.api.annotation.Drone;
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
@@ -36,11 +36,13 @@
 import org.keycloak.testsuite.broker.OidcBackchannelLogoutBrokerConfiguration;
 import org.keycloak.testsuite.util.CredentialBuilder;
 import org.keycloak.testsuite.util.LogoutTokenUtil;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.oauth.BackchannelLogoutResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.SecondBrowser;
 import org.keycloak.util.JsonSerialization;
+import org.openqa.selenium.By;
 import org.openqa.selenium.WebDriver;
 
 import java.io.IOException;
@@ -53,6 +55,7 @@
 import java.util.stream.Collectors;
 
 import jakarta.ws.rs.core.Response;
+import org.openqa.selenium.WebElement;
 
 public class BackchannelLogoutTest extends AbstractNestedBrokerTest {
 
@@ -147,9 +150,7 @@ public void postBackchannelLogoutWithSessionId() throws Exception {
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertConsumerLogoutEvent(sessionIdConsumerRealm, userIdConsumerRealm);
         assertNoSessionsInClient(nbc.consumerRealmName(), accountClientIdConsumerRealm, userIdConsumerRealm,
@@ -173,9 +174,7 @@ public void postBackchannelLogoutWithoutSessionId() throws Exception {
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertConsumerLogoutEvent(sessionIdConsumerRealm, userIdConsumerRealm);
         assertNoSessionsInClient(nbc.consumerRealmName(), accountClientIdConsumerRealm, userIdConsumerRealm,
@@ -187,10 +186,9 @@ public void postBackchannelLogoutWithoutSessionId() throws Exception {
     @Test
     public void postBackchannelLogoutWithoutLogoutToken() throws Exception {
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(null)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.BAD_REQUEST));
-            assertThat(response, Matchers.bodyHC(containsString("No logout token")));
-        }
+        BackchannelLogoutResponse response = oauth.doBackchannelLogout(null);
+        assertEquals(400, response.getStatusCode());
+        assertEquals("No logout token", response.getErrorDescription());
         events.expectLogoutError(Errors.INVALID_TOKEN)
                 .realm(realmIdConsumerRealm)
                 .assertEvent();
@@ -202,11 +200,9 @@ public void postBackchannelLogoutWithInvalidLogoutToken() throws Exception {
                 Base64Url.encode(JsonSerialization.writeValueAsBytes(JsonSerialization.createObjectNode()));
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenMissingContent)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.BAD_REQUEST));
-            assertThat(response,
-                    Matchers.bodyHC(containsString(LogoutTokenValidationCode.DECODE_TOKEN_FAILED.getErrorMessage())));
-        }
+        BackchannelLogoutResponse response = oauth.doBackchannelLogout(logoutTokenMissingContent);
+        assertEquals(400, response.getStatusCode());
+        assertEquals(LogoutTokenValidationCode.DECODE_TOKEN_FAILED.getErrorMessage(), response.getErrorDescription());
         events.expectLogoutError(Errors.INVALID_TOKEN)
                 .realm(realmIdConsumerRealm)
                 .assertEvent();
@@ -217,9 +213,7 @@ public void postBackchannelLogoutWithSessionIdUserNotLoggedIn() throws Exception
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, UUID.randomUUID().toString());
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
     }
 
     @Test
@@ -227,9 +221,7 @@ public void postBackchannelLogoutWithoutSessionIdUserNotLoggedIn() throws Except
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
     }
 
     @Test
@@ -237,9 +229,7 @@ public void postBackchannelLogoutWithoutSessionIdUserDoesntExist() throws Except
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(UUID.randomUUID().toString());
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
     }
 
     @Test
@@ -253,12 +243,12 @@ public void postBackchannelLogoutWithSessionIdMultipleOpenSession() throws Excep
         assertActiveSessionInClient(nbc.consumerRealmName(), accountClientIdConsumerRealm, userIdConsumerRealm,
                 sessionId1ConsumerRealm);
 
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
         oauth2.realm(nbc.consumerRealmName())
                 .clientId(OidcBackchannelLogoutBrokerConfiguration.CONSUMER_CLIENT_ID)
-                .redirectUri(getAuthServerRoot() + "realms/" + nbc.consumerRealmName() + "/account")
-                .doLoginSocial(nbc.getIDPAlias(), nbc.getUserLogin(), nbc.getUserPassword());
+                .redirectUri(getAuthServerRoot() + "realms/" + nbc.consumerRealmName() + "/app");
+
+        doLoginSocial(oauth2, nbc.getIDPAlias(), nbc.getUserLogin(), nbc.getUserPassword());
 
         String sessionId2ProviderRealm = assertProviderLoginEventIdpClient(userIdProviderRealm);
         String sessionId2ConsumerRealm = assertConsumerLoginEventAccountManagement(userIdConsumerRealm);
@@ -268,9 +258,7 @@ public void postBackchannelLogoutWithSessionIdMultipleOpenSession() throws Excep
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionId1ProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertConsumerLogoutEvent(sessionId1ConsumerRealm, userIdConsumerRealm);
         assertNoSessionsInClient(nbc.consumerRealmName(), accountClientIdConsumerRealm, userIdConsumerRealm,
@@ -304,9 +292,7 @@ public void postBackchannelLogoutWithoutSessionIdMultipleOpenSession() throws Ex
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         List<String> expectedSessionIdsInLogoutEvents = Arrays.asList(sessionId1ConsumerRealm, sessionId2ConsumerRealm);
         assertConsumerLogoutEvents(expectedSessionIdsInLogoutEvents, userIdConsumerRealm);
@@ -347,9 +333,7 @@ public void postBackchannelLogoutWithSessionIdMultipleOpenSessionDifferentIdenti
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionId1ProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertConsumerLogoutEvent(sessionId1ConsumerRealm, userIdConsumerRealm);
         assertNoSessionsInClient(nbc.consumerRealmName(), accountClientIdConsumerRealm, userIdConsumerRealm,
@@ -388,9 +372,7 @@ public void postBackchannelLogoutWithoutSessionIdMultipleOpenSessionDifferentIde
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         List<String> expectedSessionIdsInLogoutEvents = Arrays.asList(sessionId1ConsumerRealm, sessionId2ConsumerRealm);
         assertConsumerLogoutEvents(expectedSessionIdsInLogoutEvents, userIdConsumerRealm);
@@ -419,9 +401,8 @@ public void postBackchannelLogoutOnDisabledClientReturnsNotImplemented() throws
         disableClient(nbc.consumerRealmName(), accountClientIdConsumerRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.NOT_IMPLEMENTED));
-        }
+        BackchannelLogoutResponse response = oauth.doBackchannelLogout(logoutTokenEncoded);
+        assertEquals(Response.Status.NOT_IMPLEMENTED.getStatusCode(), response.getStatusCode());
 
         assertLogoutErrorEvent(nbc.consumerRealmName());
     }
@@ -448,9 +429,7 @@ public void postBackchannelLogoutNestedBrokering() throws Exception {
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertConsumerLogoutEvent(sessionIdConsumerRealm, userIdConsumerRealm);
         assertLogoutEvent(sessionIdSubConsumerRealm, userIdSubConsumerRealm, nbc.subConsumerRealmName());
@@ -486,9 +465,8 @@ public void postBackchannelLogoutNestedBrokeringDownstreamLogoutOfSubConsumerFai
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.GATEWAY_TIMEOUT));
-        }
+        BackchannelLogoutResponse response = oauth.doBackchannelLogout(logoutTokenEncoded);
+        assertEquals(Response.Status.GATEWAY_TIMEOUT.getStatusCode(), response.getStatusCode());
 
         assertLogoutErrorEvent(nbc.subConsumerRealmName());
         assertConsumerLogoutEvent(sessionIdConsumerRealm, userIdConsumerRealm);
@@ -522,9 +500,7 @@ public void postBackchannelLogoutNestedBrokeringRevokeOfflineSessions() throws E
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm, true);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         // no logout event as there is no online session now
         assertNoSessionsInClient(nbc.consumerRealmName(), consumerClientId, userIdConsumerRealm,
@@ -561,9 +537,7 @@ public void postBackchannelLogoutNestedBrokeringDoNotRevokeOfflineSessions() thr
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm, false);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         // no logout event as there is no online session now
         assertNoSessionsInClient(nbc.consumerRealmName(), consumerClientId, userIdConsumerRealm,
@@ -600,9 +574,7 @@ public void postBackchannelLogoutNestedBrokeringRevokeOfflineSessionsWithoutActi
         String logoutTokenEncoded = getLogoutTokenEncodedAndSigned(userIdProviderRealm, sessionIdProviderRealm, true);
 
         oauth.realm(nbc.consumerRealmName());
-        try (CloseableHttpResponse response = oauth.doBackchannelLogout(logoutTokenEncoded)) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.OK));
-        }
+        assertTrue(oauth.doBackchannelLogout(logoutTokenEncoded).isSuccess());
 
         assertNoOfflineSessionsInClient(nbc.consumerRealmName(), consumerClientId, userIdConsumerRealm);
     }
@@ -659,6 +631,7 @@ private String assertLoginEvent(String userId, String clientId, String realmName
 
         Optional<EventRepresentation> loginEventOptional = eventList.stream()
                 .filter(event -> userId.equals(event.getUserId()))
+                .filter(event -> clientId.equals(event.getClientId()))
                 .filter(event -> event.getType().equals(EventType.LOGIN.name()))
                 .findAny();
 
@@ -847,17 +820,22 @@ private void disableClient(String realmName, String clientUuid) {
     }
 
     private OAuthClient loginWithSecondBrowser(String identityProviderDisplayName) {
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
         oauth2.realm(nbc.consumerRealmName())
                 .clientId(OidcBackchannelLogoutBrokerConfiguration.CONSUMER_CLIENT_ID)
-                .redirectUri(getAuthServerRoot() + "realms/" + nbc.consumerRealmName() + "/account")
-                .doLoginSocial(identityProviderDisplayName, nbc.getUserLogin(), nbc.getUserPassword());
+                .redirectUri(getAuthServerRoot() + "realms/" + nbc.consumerRealmName() + "/app");
+        doLoginSocial(oauth2, identityProviderDisplayName, nbc.getUserLogin(), nbc.getUserPassword());
         return oauth2;
     }
 
     private void linkUsers(OAuthClient oauth) {
-        oauth.linkUsers(nbc.getUserLogin(), USER_PASSWORD_CONSUMER_REALM);
+        WaitUtils.waitForPageToLoad();
+        WebElement linkAccountButton = oauth.getDriver().findElement(By.id("linkAccount"));
+        waitUntilElement(linkAccountButton).is().clickable();
+        linkAccountButton.click();
+
+        WaitUtils.waitForPageToLoad();
+        oauth.fillLoginForm(nbc.getUserLogin(), USER_PASSWORD_CONSUMER_REALM);
     }
 
     private String getClientId(String realm, String clientId) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthPostMethodTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthPostMethodTest.java
index 490a80431e78..5a21a52c368c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthPostMethodTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthPostMethodTest.java
@@ -34,7 +34,7 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.AbstractAdminTest;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.nio.charset.StandardCharsets;
 import java.util.LinkedList;
@@ -73,8 +73,8 @@ public void testPostAuthentication() {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequestPostAuth(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequestPostAuth(code, "password");
 
         assertEquals(200, response.getStatusCode());
 
@@ -90,9 +90,9 @@ public void testPostAuthentication() {
     }
 
 
-    private OAuthClient.AccessTokenResponse doAccessTokenRequestPostAuth(String code, String clientSecret) {
+    private AccessTokenResponse doAccessTokenRequestPostAuth(String code, String clientSecret) {
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getAccessTokenUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getToken());
 
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
@@ -107,7 +107,7 @@ private OAuthClient.AccessTokenResponse doAccessTokenRequestPostAuth(String code
             post.setEntity(formEntity);
 
             try {
-                return new OAuthClient.AccessTokenResponse(client.execute(post));
+                return new AccessTokenResponse(client.execute(post));
             } catch (Exception e) {
                 throw new RuntimeException("Failed to retrieve access token", e);
             }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSecretSignedJWTTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSecretSignedJWTTest.java
index d8d633c239a5..388c38447925 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSecretSignedJWTTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSecretSignedJWTTest.java
@@ -76,7 +76,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.util.ClientPoliciesUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.util.JsonSerialization;
 
@@ -156,8 +156,8 @@ public void testCodeToTokenRequestFailureWhenClientHasPrivateKeyJWT() throws Exc
             oauth.doLogin("test-user@localhost", "password");
             events.expectLogin().client("test-app").assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, Algorithm.HS256));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, Algorithm.HS256));
             assertEquals(400, response.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
         } finally {
@@ -171,7 +171,7 @@ public void testInvalidIssuer() throws Exception {
         oauth.clientId("test-app");
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         JWTClientSecretCredentialsProvider jwtProvider = new JWTClientSecretCredentialsProvider() {
             @Override
             protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
@@ -185,7 +185,7 @@ protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl)
         String algorithm = Algorithm.HS256;
         jwtProvider.setClientSecret(CLIENT_SECRET, algorithm);
         String jwt = jwtProvider.createSignedRequestToken(oauth.getClientId(), getRealmInfoUrl(), algorithm);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code,
+        AccessTokenResponse response = doAccessTokenRequest(code,
                 jwt);
 
         assertEquals(401, response.getStatusCode());
@@ -231,8 +231,8 @@ public void testCodeToTokenRequestFailureHS512Enforced() throws Exception {
             oauth.doLogin("test-user@localhost", "password");
             events.expectLogin().client(clientId).assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, Algorithm.HS256));
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, Algorithm.HS256));
             assertEquals(400, response.getStatusCode());
             assertEquals("invalid_client", response.getError());
         } catch (Exception e) {
@@ -252,8 +252,8 @@ private void testCodeToTokenRequestSuccess(String algorithm) throws Exception {
                 .client("test-app")
                 .assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, algorithm));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(CLIENT_SECRET, 20, algorithm));
 
         assertEquals(200, response.getStatusCode());
         oauth.verifyToken(response.getAccessToken());
@@ -290,18 +290,18 @@ private void processAuthenticateWithAlgorithm(String algorithm, Integer secretLe
         configureDefaultProfileAndPolicy();
 
         String firstSecret = clientResource.generateNewSecret().getValue(); //clientResource.getSecret().getValue();
-        assertThat(firstSecret.length(),is(secretLength));
+        assertThat(firstSecret.length(), is(SecretGenerator.equivalentEntropySize(secretLength, SecretGenerator.ALPHANUM.length)));
 
         //generate new secret, rotate the secret
         String newSecret = clientResource.generateNewSecret().getValue();
         assertThat(firstSecret, not(equalTo(newSecret)));
-        assertThat(newSecret.length(),is(secretLength));
+        assertThat(newSecret.length(), is(SecretGenerator.equivalentEntropySize(secretLength, SecretGenerator.ALPHANUM.length)));
 
         oauth.clientId("jwt-client");
         oauth.doLogin("test-user@localhost", "password");
-        EventRepresentation loginEvent = events.expectLogin().client("jwt-client").assertEvent();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(firstSecret, 20, algorithm));
+        events.expectLogin().client("jwt-client").assertEvent();
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(firstSecret, 20, algorithm));
         assertThat(response.getStatusCode(), is(HttpStatus.SC_OK));
     }
 
@@ -315,8 +315,8 @@ public void testAssertionInvalidSignature() throws Exception {
                 .client("test-app")
                 .assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT("ppassswordd", 20));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT("ppassswordd", 20));
 
         // https://tools.ietf.org/html/rfc6749#section-5.2
         assertEquals(400, response.getStatusCode());
@@ -331,10 +331,10 @@ public void testAssertionReuse() throws Exception {
                 .client("test-app")
                 .assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         String clientSignedJWT = getClientSignedJWT(CLIENT_SECRET, 20);
 
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, clientSignedJWT);
+        AccessTokenResponse response = doAccessTokenRequest(code, clientSignedJWT);
         assertEquals(200, response.getStatusCode());
         events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId())
                 .client(oauth.getClientId())
@@ -348,7 +348,7 @@ public void testAssertionReuse() throws Exception {
                 .client("test-app")
                 .assertEvent();
 
-        String code2 = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code2 = oauth.parseLoginResponse().getCode();
         response = doAccessTokenRequest(code2, clientSignedJWT);
         events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId())
                 .error("invalid_client_credentials")
@@ -384,8 +384,8 @@ public void authenticateWithInvalidRotatedClientSecretPolicyIsEnable() throws Ex
         oauth.clientId("jwt-client");
         oauth.doLogin("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin().client("jwt-client").assertEvent();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(firstSecret, 20, Algorithm.HS256));
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = doAccessTokenRequest(code, getClientSignedJWT(firstSecret, 20, Algorithm.HS256));
         assertThat(response.getStatusCode(), is(HttpStatus.SC_BAD_REQUEST));
 
     }
@@ -405,7 +405,7 @@ private String getRealmInfoUrl() {
         return KeycloakUriBuilder.fromUri(authServerBaseUrl).path(ServiceUrlConstants.REALM_INFO_PATH).build("test").toString();
     }
 
-    private OAuthClient.AccessTokenResponse doAccessTokenRequest(String code, String signedJwt) throws Exception {
+    private AccessTokenResponse doAccessTokenRequest(String code, String signedJwt) throws Exception {
         List<NameValuePair> parameters = new LinkedList<>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.AUTHORIZATION_CODE));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
@@ -413,19 +413,16 @@ private OAuthClient.AccessTokenResponse doAccessTokenRequest(String code, String
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, signedJwt));
 
-        CloseableHttpResponse response = sendRequest(oauth.getAccessTokenUrl(), parameters);
-        return new OAuthClient.AccessTokenResponse(response);
+        CloseableHttpResponse response = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        return new AccessTokenResponse(response);
     }
 
     private CloseableHttpResponse sendRequest(String requestUrl, List<NameValuePair> parameters) throws Exception {
-        CloseableHttpClient client = new DefaultHttpClient();
-        try {
+        try (CloseableHttpClient client = new DefaultHttpClient()) {
             HttpPost post = new HttpPost(requestUrl);
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
             return client.execute(post);
-        } finally {
-            oauth.closeClient(client);
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java
index c6cc07e9ddf7..40be26d198f1 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java
@@ -45,7 +45,8 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.KeystoreUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.SignatureSignerUtil;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.security.KeyPair;
 import java.security.PrivateKey;
@@ -53,6 +54,8 @@
 import java.util.LinkedList;
 import java.util.List;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
@@ -68,7 +71,7 @@ public class ClientAuthSignedJWTTest extends AbstractClientAuthSignedJWTTest {
     @Test
     public void testServiceAccountAndLogoutSuccess() throws Exception {
         String client1Jwt = getClient1SignedJWT();
-        OAuthClient.AccessTokenResponse response = doClientCredentialsGrantRequest(client1Jwt);
+        AccessTokenResponse response = doClientCredentialsGrantRequest(client1Jwt);
 
         assertEquals(200, response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -87,7 +90,7 @@ public void testServiceAccountAndLogoutSuccess() throws Exception {
         assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
 
         client1Jwt = getClient1SignedJWT();
-        OAuthClient.AccessTokenResponse refreshedResponse = doRefreshTokenRequest(response.getRefreshToken(), client1Jwt);
+        AccessTokenResponse refreshedResponse = doRefreshTokenRequest(response.getRefreshToken(), client1Jwt);
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
 
@@ -205,7 +208,7 @@ public void testCodeToTokenRequestSuccessES256Enforced() throws Exception {
     @Test
     public void testDirectGrantRequestSuccess() throws Exception {
         oauth.clientId("client2");
-        OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", getClient2SignedJWT());
+        AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", getClient2SignedJWT());
 
         assertEquals(200, response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -239,7 +242,7 @@ public void testSuccessWhenNoAlgSetInJWK() throws Exception {
 
             // test
             oauth.clientId("client2");
-            OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, signingAlgorithm));
+            AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, signingAlgorithm));
 
             assertEquals(200, response.getStatusCode());
         } finally {
@@ -260,7 +263,7 @@ public void testSuccessDefaultAlgWhenNoAlgSetInJWK() throws Exception {
             PublicKey publicKey = keyPair.getPublic();
             PrivateKey privateKey = keyPair.getPrivate();
             oauth.clientId("client2");
-            OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, signingAlgorithm));
+            AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password", createSignedRequestToken("client2", getRealmInfoUrl(), privateKey, publicKey, signingAlgorithm));
             assertEquals(200, response.getStatusCode());
 
             // sending a JWS using another RSA based alg (PS256) should work as alg is not specified
@@ -305,7 +308,7 @@ public void testSuccessWhenMultipleKeysWithSameKid() throws Exception {
             // test
             oauth.clientId("client2");
             JsonWebToken clientAuthJwt = createRequestToken("client2", getRealmInfoUrl());
-            OAuthClient.AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password",
+            AccessTokenResponse response = doGrantAccessTokenRequest("test-user@localhost", "password",
                     createSignledRequestToken(privateKey, publicKey, signingAlgorithm, "my-kid", clientAuthJwt));
 
             assertEquals(200, response.getStatusCode());
@@ -391,8 +394,8 @@ public void testMissingClientAssertionType() throws Exception {
         List<NameValuePair> parameters = new LinkedList<NameValuePair>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response, 401, null, "invalid_client", Errors.CLIENT_NOT_FOUND);
     }
@@ -403,8 +406,8 @@ public void testInvalidClientAssertionType() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, "invalid"));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,401, null, "invalid_client", Errors.CLIENT_NOT_FOUND);
 
@@ -416,8 +419,8 @@ public void testMissingClientAssertion() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response, 401,null, "invalid_client", Errors.CLIENT_NOT_FOUND);
     }
@@ -431,8 +434,8 @@ public void testAssertionMissingIssuer() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,401, null, "invalid_client", Errors.CLIENT_NOT_FOUND);
     }
@@ -446,8 +449,8 @@ public void testAssertionUnknownClient() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,401, "unknown-client", "invalid_client", Errors.CLIENT_NOT_FOUND);
     }
@@ -463,16 +466,16 @@ public void testAssertionNonMatchingClientIdParameter() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "client2"));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,"client2", "invalid_client", Errors.INVALID_CLIENT_CREDENTIALS);
 
         // Matching client_id should work fine
         parameters.remove(3);
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "client1"));
-        resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        response = new OAuthClient.AccessTokenResponse(resp);
+        resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        response = new AccessTokenResponse(resp);
 
         assertEquals(200, response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -491,8 +494,8 @@ public void testAssertionDisabledClient() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,401, "client1", "invalid_client", Errors.CLIENT_DISABLED);
 
@@ -520,8 +523,8 @@ class CertificateHolder {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response,400, "client1", OAuthErrorException.INVALID_CLIENT, "client_credentials_setup_required");
 
@@ -538,8 +541,8 @@ public void testAssertionInvalidSignature() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         assertError(response, "client1", OAuthErrorException.INVALID_CLIENT, AuthenticationFlowError.CLIENT_CREDENTIALS_SETUP_REQUIRED.toString().toLowerCase());
     }
@@ -556,8 +559,8 @@ public void testAssertionExpired() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         setTimeOffset(0);
 
@@ -566,17 +569,17 @@ public void testAssertionExpired() throws Exception {
 
     @Test
     public void testParEndpointAsAudience() throws Exception {
-        testEndpointAsAudience(oauth.getParEndpointUrl());
+        testEndpointAsAudience(oauth.getEndpoints().getPushedAuthorizationRequest());
     }
 
     @Test
     public void testBackchannelAuthenticationEndpointAsAudience() throws Exception {
-        testEndpointAsAudience(oauth.getBackchannelAuthenticationUrl());
+        testEndpointAsAudience(oauth.getEndpoints().getBackchannelAuthentication());
     }
 
     @Test
     public void testTokenIntrospectionEndpointAsAudience() throws Exception {
-        testEndpointAsAudience(oauth.getTokenIntrospectionUrl());
+        testEndpointAsAudience(oauth.getEndpoints().getIntrospection());
     }
     @Test
     public void testInvalidAudience() throws Exception {
@@ -585,27 +588,60 @@ public void testInvalidAudience() throws Exception {
         clientRepresentation = clientResource.toRepresentation();
 
         try {
-            KeyPair keyPair = setupJwksUrl(Algorithm.PS256, clientRepresentation, clientResource);
-            PublicKey publicKey = keyPair.getPublic();
-            PrivateKey privateKey = keyPair.getPrivate();
-            JsonWebToken assertion = createRequestToken(app2.getClientId(), getRealmInfoUrl());
+            List<NameValuePair> parameters = createTokenWithSpecifiedAudience(clientResource, clientRepresentation, "https://as.other.org");
 
-            assertion.audience("https://as.other.org");
+            try (CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters)) {
+                AccessTokenResponse response = new AccessTokenResponse(resp);
+                assertNull(response.getAccessToken());
+                assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+            }
+        } finally {
+            revertJwksUriSettings(clientRepresentation, clientResource);
+        }
+    }
 
-            List<NameValuePair> parameters = new LinkedList<NameValuePair>();
-            parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS));
-            parameters
-                .add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
-            parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION,
-                createSignledRequestToken(privateKey, publicKey, Algorithm.PS256, null, assertion)));
+    @Test
+    public void testMultipleAudiencesRejected() throws Exception {
+        ClientRepresentation clientRepresentation = app2;
+        ClientResource clientResource = getClient(testRealm.getRealm(), clientRepresentation.getId());
+        clientRepresentation = clientResource.toRepresentation();
 
-            try (CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters)) {
-                OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        try {
+            List<NameValuePair> parameters = createTokenWithSpecifiedAudience(clientResource, clientRepresentation, getRealmInfoUrl(), oauth.getEndpoints().getToken());
+
+            try (CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters)) {
+                AccessTokenResponse response = new AccessTokenResponse(resp);
                 assertNull(response.getAccessToken());
+                assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+            }
+        } finally {
+            revertJwksUriSettings(clientRepresentation, clientResource);
+        }
+
+    }
+
+    @Test
+    public void testMultipleAudiencesAllowed() throws Exception {
+        // TODO: The test might be removed once we remove the option of allow-multiple-audiences-for-jwt-client-authentication
+        ClientRepresentation clientRepresentation = app2;
+        ClientResource clientResource = getClient(testRealm.getRealm(), clientRepresentation.getId());
+        clientRepresentation = clientResource.toRepresentation();
+
+        allowMultipleAudiencesForClientJWTOnServer(true);
+
+        try {
+            List<NameValuePair> parameters = createTokenWithSpecifiedAudience(clientResource, clientRepresentation, getRealmInfoUrl(), "https://as.other.org");
+
+            try (CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters)) {
+                AccessTokenResponse response = new AccessTokenResponse(resp);
+                assertNotNull(response.getAccessToken());
+                assertNull(response.getError());
             }
         } finally {
             revertJwksUriSettings(clientRepresentation, clientResource);
+            allowMultipleAudiencesForClientJWTOnServer(false);
         }
+
     }
 
     @Test
@@ -619,7 +655,7 @@ public void testJWTAuthForClientCertWithOnlyAlgProvided() throws Exception {
             PrivateKey privateKey = keyPair.getPrivate();
             JsonWebToken assertion = createRequestToken(app2.getClientId(), getRealmInfoUrl());
 
-            SignatureSignerContext signer = oauth.createSigner(privateKey, null,  Algorithm.ES512);
+            SignatureSignerContext signer = SignatureSignerUtil.createSigner(privateKey, null,  Algorithm.ES512);
             String jws = new JWSBuilder().jsonContent(assertion).sign(signer);
 
             List<NameValuePair> parameters = new LinkedList<>();
@@ -628,8 +664,8 @@ public void testJWTAuthForClientCertWithOnlyAlgProvided() throws Exception {
                     .add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
             parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, jws));
 
-            try (CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters)) {
-                OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+            try (CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters)) {
+                AccessTokenResponse response = new AccessTokenResponse(resp);
                 assertNotNull(response.getAccessToken());
             }
         } finally {
@@ -648,8 +684,8 @@ public void testAssertionInvalidNotBefore() throws Exception {
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT));
         parameters.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ASSERTION, invalidJwt));
 
-        CloseableHttpResponse resp = sendRequest(oauth.getServiceAccountUrl(), parameters);
-        OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(resp);
+        CloseableHttpResponse resp = sendRequest(oauth.getEndpoints().getToken(), parameters);
+        AccessTokenResponse response = new AccessTokenResponse(resp);
 
         setTimeOffset(0);
 
@@ -662,7 +698,7 @@ public void testAssertionInvalidNotBefore() throws Exception {
     public void testAssertionReuse() throws Exception {
         String clientJwt = getClient1SignedJWT();
 
-        OAuthClient.AccessTokenResponse response = doClientCredentialsGrantRequest(clientJwt);
+        AccessTokenResponse response = doClientCredentialsGrantRequest(clientJwt);
 
         assertEquals(200, response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -688,7 +724,7 @@ public void testAuthenticationFailsWhenClientSecretJWTAuthenticatorSet() throws
         try {
             String clientJwt = getClient1SignedJWT();
 
-            OAuthClient.AccessTokenResponse response = doClientCredentialsGrantRequest(clientJwt);
+            AccessTokenResponse response = doClientCredentialsGrantRequest(clientJwt);
 
             assertEquals(400, response.getStatusCode());
             assertEquals(OAuthErrorException.UNAUTHORIZED_CLIENT, response.getError());
@@ -700,31 +736,31 @@ public void testAuthenticationFailsWhenClientSecretJWTAuthenticatorSet() throws
 
     @Test
     public void testMissingIdClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("id");
+        AccessTokenResponse response = testMissingClaim("id");
         assertError(response, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
     }
 
     @Test
     public void testMissingIssuerClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("issuer");
+        AccessTokenResponse response = testMissingClaim("issuer");
         assertError(response,401, null, OAuthErrorException.INVALID_CLIENT, Errors.CLIENT_NOT_FOUND);
     }
 
     @Test
     public void testMissingSubjectClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("subject");
+        AccessTokenResponse response = testMissingClaim("subject");
         assertError(response,401, null, "invalid_client", Errors.CLIENT_NOT_FOUND);
     }
 
     @Test
     public void testMissingAudienceClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("audience");
+        AccessTokenResponse response = testMissingClaim("audience");
         assertError(response,400, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
     }
 
     @Test
     public void testMissingIssuedAtClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("issuedAt");
+        AccessTokenResponse response = testMissingClaim("issuedAt");
         assertSuccess(response, app1.getClientId(), serviceAccountUser.getId(), serviceAccountUser.getUsername());
     }
 
@@ -732,7 +768,7 @@ public void testMissingIssuedAtClaim() throws Exception {
     // KEYCLOAK-2986
     public void testMissingExpirationClaim() throws Exception {
         // Missing only exp; the lifespan should be calculated from issuedAt
-        OAuthClient.AccessTokenResponse response = testMissingClaim("expiration");
+        AccessTokenResponse response = testMissingClaim("expiration");
         assertSuccess(response, app1.getClientId(), serviceAccountUser.getId(), serviceAccountUser.getUsername());
 
         // Test expired lifespan
@@ -746,7 +782,7 @@ public void testMissingExpirationClaim() throws Exception {
 
     @Test
     public void testMissingNotBeforeClaim() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim("notBefore");
+        AccessTokenResponse response = testMissingClaim("notBefore");
         assertSuccess(response, app1.getClientId(), serviceAccountUser.getId(), serviceAccountUser.getUsername());
     }
 
@@ -785,7 +821,7 @@ public void testDirectGrantRequestFailureES256() throws Exception {
 
     @Test
     public void testClockSkew() throws Exception {
-        OAuthClient.AccessTokenResponse response = testMissingClaim(15, "issuedAt", "notBefore"); // allowable clock skew is 15 sec
+        AccessTokenResponse response = testMissingClaim(15, "issuedAt", "notBefore"); // allowable clock skew is 15 sec
         assertSuccess(response, app1.getClientId(), serviceAccountUser.getId(), serviceAccountUser.getUsername());
 
         // excess allowable clock skew
@@ -794,4 +830,42 @@ public void testClockSkew() throws Exception {
         response = testMissingClaim(15 + 15, "notBefore");
         assertError(response, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
     }
+
+    @Test
+    public void testLongExpirationWithIssuedAt() throws Exception {
+        CustomJWTClientCredentialsProvider jwtProvider = new CustomJWTClientCredentialsProvider();
+        jwtProvider.setupKeyPair(keyPairClient1);
+        jwtProvider.setTokenTimeout(3600); // one hour of token expiration
+
+        // the token should be valid the first time inside the max-exp window
+        String jwt = jwtProvider.createSignedRequestToken(app1.getClientId(), getRealmInfoUrl());
+        AccessTokenResponse response = doClientCredentialsGrantRequest(jwt);
+        assertSuccess(response, app1.getClientId(), serviceAccountUser.getId(), serviceAccountUser.getUsername());
+
+        // in the max-exp window the token should be detected as already used
+        setTimeOffset(30);
+        response = doClientCredentialsGrantRequest(jwt);
+        assertError(response, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
+        assertThat(response.getErrorDescription(), containsString("Token reuse detected"));
+
+        // after the max-exp window the token cannot be used because iat is too far in the past
+        setTimeOffset(65);
+        response = doClientCredentialsGrantRequest(jwt);
+        assertError(response, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
+        assertThat(response.getErrorDescription(), containsString("Token was issued too far in the past to be used now"));
+    }
+
+    @Test
+    public void testLongExpirationWithoutIssuedAt() throws Exception {
+        CustomJWTClientCredentialsProvider jwtProvider = new CustomJWTClientCredentialsProvider();
+        jwtProvider.setupKeyPair(keyPairClient1);
+        jwtProvider.setTokenTimeout(3600); // one hour of token expiration
+        jwtProvider.enableClaim("issuedAt", false);
+
+        // the token should not be valid because expiration is to far in the future
+        String jwt = jwtProvider.createSignedRequestToken(app1.getClientId(), getRealmInfoUrl());
+        AccessTokenResponse response = doClientCredentialsGrantRequest(jwt);
+        assertError(response, app1.getClientId(), OAuthErrorException.INVALID_CLIENT, Errors.INVALID_CLIENT_CREDENTIALS);
+        assertThat(response.getErrorDescription(), containsString("Token expiration is too far in the future and iat claim not present in token"));
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeTest.java
deleted file mode 100755
index a71757d46bc6..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeTest.java
+++ /dev/null
@@ -1,1213 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.oauth;
-
-import jakarta.ws.rs.core.Response.Status;
-import org.junit.Rule;
-import org.junit.Test;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.TokenVerifier;
-import org.keycloak.admin.client.resource.ClientResource;
-import org.keycloak.admin.client.resource.ClientsResource;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.common.Profile;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.ImpersonationConstants;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.protocol.oidc.OIDCConfigAttributes;
-import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
-import org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.idm.ClientRepresentation;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
-import org.keycloak.representations.idm.authorization.DecisionStrategy;
-import org.keycloak.services.managers.ClientManager;
-import org.keycloak.services.managers.RealmManager;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
-import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
-import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.util.BasicAuthHelper;
-import org.keycloak.util.JsonSerialization;
-
-import jakarta.ws.rs.client.Client;
-import jakarta.ws.rs.client.Entity;
-import jakarta.ws.rs.client.WebTarget;
-import jakarta.ws.rs.core.Form;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.Response;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import static org.hamcrest.Matchers.instanceOf;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_ID;
-import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_USERNAME;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-@EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
-@EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
-public class ClientTokenExchangeTest extends AbstractKeycloakTest {
-
-    @Rule
-    public AssertEvents events = new AssertEvents(this);
-
-    @Test
-    @UncaughtServerErrorExpected
-    @DisableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
-    public void checkFeatureDisabled() {
-        // Required feature should return Status code 400 - Feature doesn't work
-        testingClient.server().run(ClientTokenExchangeTest::addDirectExchanger);
-        Assert.assertEquals(400, checkTokenExchange().getStatus());
-        testingClient.server().run(ClientTokenExchangeTest::removeDirectExchanger);
-    }
-
-    @Test
-    public void checkFeatureEnabled() {
-        // Test if the required feature really works.
-        testingClient.server().run(ClientTokenExchangeTest::addDirectExchanger);
-        Assert.assertEquals(200, checkTokenExchange().getStatus());
-        testingClient.server().run(ClientTokenExchangeTest::removeDirectExchanger);
-    }
-
-    @Override
-    public void addTestRealms(List<RealmRepresentation> testRealms) {
-        RealmRepresentation testRealmRep = new RealmRepresentation();
-        testRealmRep.setId(TEST);
-        testRealmRep.setRealm(TEST);
-        testRealmRep.setEnabled(true);
-        testRealms.add(testRealmRep);
-    }
-
-    public static void setupRealm(KeycloakSession session) {
-        addDirectExchanger(session);
-
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        RoleModel exampleRole = realm.getRole("example");
-
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        ClientModel target = realm.getClientByClientId("target");
-        assertNotNull(target);
-
-        RoleModel impersonateRole = management.getRealmManagementClient().getRole(ImpersonationConstants.IMPERSONATION_ROLE);
-
-        ClientModel differentScopeClient = realm.addClient("different-scope-client");
-        differentScopeClient.setClientId("different-scope-client");
-        differentScopeClient.setPublicClient(false);
-        differentScopeClient.setDirectAccessGrantsEnabled(true);
-        differentScopeClient.setEnabled(true);
-        differentScopeClient.setSecret("secret");
-        differentScopeClient.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        differentScopeClient.setFullScopeAllowed(false);
-        differentScopeClient.removeClientScope(realm.getClientScopesStream().filter(scope->"email".equals(scope.getName())).findAny().get());
-
-        ClientModel clientExchanger = realm.addClient("client-exchanger");
-        clientExchanger.setClientId("client-exchanger");
-        clientExchanger.setPublicClient(false);
-        clientExchanger.setDirectAccessGrantsEnabled(true);
-        clientExchanger.setEnabled(true);
-        clientExchanger.setSecret("secret");
-        clientExchanger.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        clientExchanger.setFullScopeAllowed(false);
-        clientExchanger.addScopeMapping(impersonateRole);
-        clientExchanger.addProtocolMapper(UserSessionNoteMapper.createUserSessionNoteMapper(IMPERSONATOR_ID));
-        clientExchanger.addProtocolMapper(UserSessionNoteMapper.createUserSessionNoteMapper(IMPERSONATOR_USERNAME));
-        clientExchanger.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("different-scope-client-audience", differentScopeClient.getClientId(), null, true, false, true));
-
-        ClientModel illegal = realm.addClient("illegal");
-        illegal.setClientId("illegal");
-        illegal.setPublicClient(false);
-        illegal.setDirectAccessGrantsEnabled(true);
-        illegal.setEnabled(true);
-        illegal.setSecret("secret");
-        illegal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        illegal.setFullScopeAllowed(false);
-
-        ClientModel legal = realm.addClient("legal");
-        legal.setClientId("legal");
-        legal.setPublicClient(false);
-        legal.setDirectAccessGrantsEnabled(true);
-        legal.setEnabled(true);
-        legal.setSecret("secret");
-        legal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        legal.setFullScopeAllowed(false);
-
-        ClientModel directLegal = realm.addClient("direct-legal");
-        directLegal.setClientId("direct-legal");
-        directLegal.setPublicClient(false);
-        directLegal.setDirectAccessGrantsEnabled(true);
-        directLegal.setEnabled(true);
-        directLegal.setSecret("secret");
-        directLegal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        directLegal.setFullScopeAllowed(false);
-        directLegal.addRedirectUri(OAuthClient.APP_ROOT + "/auth");
-
-        ClientModel directPublic = realm.addClient("direct-public");
-        directPublic.setClientId("direct-public");
-        directPublic.setPublicClient(true);
-        directPublic.setDirectAccessGrantsEnabled(true);
-        directPublic.setEnabled(true);
-        directPublic.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        directPublic.setFullScopeAllowed(false);
-        directPublic.addRedirectUri("*");
-        directPublic.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("client-exchanger-audience", clientExchanger.getClientId(), null, true, false, true));
-
-        ClientModel directUntrustedPublic = realm.addClient("direct-public-untrusted");
-        directUntrustedPublic.setClientId("direct-public-untrusted");
-        directUntrustedPublic.setPublicClient(true);
-        directUntrustedPublic.setDirectAccessGrantsEnabled(true);
-        directUntrustedPublic.setEnabled(true);
-        directUntrustedPublic.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        directUntrustedPublic.setFullScopeAllowed(false);
-        directUntrustedPublic.addRedirectUri("*");
-        directUntrustedPublic.setAttribute(OIDCConfigAttributes.POST_LOGOUT_REDIRECT_URIS, "+");
-        directUntrustedPublic.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("client-exchanger-audience", clientExchanger.getClientId(), null, true, false, true));
-
-        ClientModel directNoSecret = realm.addClient("direct-no-secret");
-        directNoSecret.setClientId("direct-no-secret");
-        directNoSecret.setPublicClient(false);
-        directNoSecret.setDirectAccessGrantsEnabled(true);
-        directNoSecret.setEnabled(true);
-        directNoSecret.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        directNoSecret.setFullScopeAllowed(false);
-
-        ClientModel noRefreshToken = realm.addClient("no-refresh-token");
-        noRefreshToken.setClientId("no-refresh-token");
-        noRefreshToken.setPublicClient(false);
-        noRefreshToken.setDirectAccessGrantsEnabled(true);
-        noRefreshToken.setEnabled(true);
-        noRefreshToken.setSecret("secret");
-        noRefreshToken.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        noRefreshToken.setFullScopeAllowed(false);
-        noRefreshToken.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "false");
-
-        ClientModel serviceAccount = realm.addClient("my-service-account");
-        serviceAccount.setClientId("my-service-account");
-        serviceAccount.setPublicClient(false);
-        serviceAccount.setServiceAccountsEnabled(true);
-        serviceAccount.setEnabled(true);
-        serviceAccount.setSecret("secret");
-        serviceAccount.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        serviceAccount.setFullScopeAllowed(false);
-        new ClientManager(new RealmManager(session)).enableServiceAccount(serviceAccount);
-
-        // permission for client to client exchange to "target" client
-        ClientPolicyRepresentation clientRep = new ClientPolicyRepresentation();
-        clientRep.setName("to");
-        clientRep.addClient(clientExchanger.getId());
-        clientRep.addClient(legal.getId());
-        clientRep.addClient(directLegal.getId());
-        clientRep.addClient(noRefreshToken.getId());
-        clientRep.addClient(serviceAccount.getId());
-        clientRep.addClient(differentScopeClient.getId());
-
-        ResourceServer server = management.realmResourceServer();
-        Policy clientPolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientRep);
-        management.clients().exchangeToPermission(target).addAssociatedPolicy(clientPolicy);
-
-        // permission for user impersonation for a client
-
-        ClientPolicyRepresentation clientImpersonateRep = new ClientPolicyRepresentation();
-        clientImpersonateRep.setName("clientImpersonators");
-        clientImpersonateRep.addClient(directLegal.getId());
-        clientImpersonateRep.addClient(directPublic.getId());
-        clientImpersonateRep.addClient(directUntrustedPublic.getId());
-        clientImpersonateRep.addClient(directNoSecret.getId());
-        server = management.realmResourceServer();
-        Policy clientImpersonatePolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientImpersonateRep);
-        management.users().setPermissionsEnabled(true);
-        management.users().adminImpersonatingPermission().addAssociatedPolicy(clientImpersonatePolicy);
-        management.users().adminImpersonatingPermission().setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
-
-        UserModel user = session.users().addUser(realm, "user");
-        user.setEnabled(true);
-        user.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        user.grantRole(exampleRole);
-        user.grantRole(impersonateRole);
-
-        UserModel bad = session.users().addUser(realm, "bad-impersonator");
-        bad.setEnabled(true);
-        bad.credentialManager().updateCredential(UserCredentialModel.password("password"));
-    }
-
-    public static void setUpUserImpersonatePermissions(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        ResourceServer server = management.realmResourceServer();
-        Policy userImpersonationPermission = management.users().userImpersonatedPermission();
-        ClientPolicyRepresentation clientsAllowedToImpersonateRep = new ClientPolicyRepresentation();
-        clientsAllowedToImpersonateRep.setName("clientsAllowedToImpersonateRep");
-        clientsAllowedToImpersonateRep.addClient("direct-public");
-        Policy clientsAllowedToImpersonate = management.authz().getStoreFactory().getPolicyStore().create(server, clientsAllowedToImpersonateRep);
-        userImpersonationPermission.addAssociatedPolicy(clientsAllowedToImpersonate);
-    }
-
-    @Override
-    protected boolean isImportAfterEachMethod() {
-        return true;
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchange() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertNotNull(token.getSessionId());
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-            Assert.assertEquals(OAuth2Constants.REFRESH_TOKEN_TYPE, response.getIssuedTokenType());
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals(token.getSessionId(), exchangedToken.getSessionId());
-            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-        }
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "legal", "secret");
-            Assert.assertEquals(OAuth2Constants.REFRESH_TOKEN_TYPE, response.getIssuedTokenType());
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals(token.getSessionId(), exchangedToken.getSessionId());
-            Assert.assertEquals("legal", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-        }
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "illegal", "secret");
-            Assert.assertEquals(403, response.getStatusCode());
-        }
-    }
-
-    @Test
-    public void testExchangeRequestAccessTokenType() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertNotNull(token.getSessionId());
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret", Map.of(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE));
-            Assert.assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals(token.getSessionId(), exchangedToken.getSessionId());
-            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchangeUsingServiceAccount() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("my-service-account");
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertNull(token.getSessionId());
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "my-service-account", "secret");
-            Assert.assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertNull(exchangedToken.getSessionId());
-            Assert.assertEquals("my-service-account", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "service-account-my-service-account");
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchangeDifferentScopes() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, null, "different-scope-client", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
-            Assert.assertNull(exchangedToken.getAudience());
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile","openid");
-            Assert.assertNull(exchangedToken.getEmailVerified());
-        }
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "different-scope-client", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            Assert.assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile","email","openid");
-            Assert.assertFalse(exchangedToken.getEmailVerified());
-        }
-
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchangeDifferentScopesWithScopeParameter() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        oauth.scope("openid profile email phone");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-        Assert.assertNames(Arrays.asList(token.getScope().split(" ")),"profile", "email", "openid", "phone");
-        //change scopes for token exchange - profile,phone must be removed
-        oauth.scope("openid profile email");
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, null, "different-scope-client", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
-            Assert.assertNull(exchangedToken.getAudience());
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile", "openid");
-            Assert.assertNull(exchangedToken.getEmailVerified());
-        }
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "different-scope-client", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-            Assert.assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile", "email","openid");
-            Assert.assertFalse(exchangedToken.getEmailVerified());
-        }
-        oauth.scope(null);
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchangeFromPublicClient() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("direct-public");
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(authzResponse.getCode(), "secret");
-
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-        String exchangedTokenString = response.getAccessToken();
-        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-        AccessToken exchangedToken = verifier.parse().getToken();
-        Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
-        Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-        Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
-        assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-
-        // can exchange to itself because the client is within the audience of the token issued to the public client
-        response = oauth.doTokenExchange(TEST, accessToken, null, "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-
-        // can not exchange to itself because the client is not within the audience of the token issued to the public client
-        response = oauth.doTokenExchange(TEST, accessToken, null, "direct-legal", "secret");
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-
-        response = oauth.doTokenExchange(TEST, accessToken, null, "direct-public", null);
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testImpersonation() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = tokenResponse.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        // client-exchanger can impersonate from token "user" to user "impersonated-user"
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                    ));
-            org.junit.Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            response.close();
-
-            String exchangedTokenString = accessTokenResponse.getToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
-            assertNotNull(exchangedToken.getAudience());
-            Assert.assertEquals("impersonated-user", exchangedToken.getPreferredUsername());
-            Assert.assertNull(exchangedToken.getRealmAccess());
-
-            Object impersonatorRaw = exchangedToken.getOtherClaims().get("impersonator");
-            assertThat(impersonatorRaw, instanceOf(Map.class));
-            Map impersonatorClaim = (Map) impersonatorRaw;
-
-            Assert.assertEquals(token.getSubject(), impersonatorClaim.get("id"));
-            Assert.assertEquals("user", impersonatorClaim.get("username"));
-        }
-
-        // client-exchanger can impersonate from token "user" to user "impersonated-user" and to "target" client
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-                                    .param(OAuth2Constants.AUDIENCE, "target")
-
-                    ));
-            org.junit.Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            response.close();
-
-            String exchangedTokenString = accessTokenResponse.getToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
-            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-        }
-
-        try (Response response = exchangeUrl.request()
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ))) {
-            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
-            assertEquals("Client is not the holder of the token",
-                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
-        }
-
-        try (Response response = exchangeUrl.request()
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.AUDIENCE, "direct-public")
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ))) {
-            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
-            assertEquals("Client is not the holder of the token",
-                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
-        }
-
-        try (Response response = exchangeUrl.request()
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.AUDIENCE, "client-exchanger")
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ))) {
-            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
-            assertEquals("Client is not the holder of the token",
-                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testIntrospectTokenAfterImpersonation() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = tokenResponse.getAccessToken();
-
-        try (Response response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ))) {
-            org.junit.Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            String exchangedTokenString = accessTokenResponse.getToken();
-            JsonNode json = JsonSerialization.readValue(oauth.introspectAccessTokenWithClientCredential("client-exchanger", "secret", exchangedTokenString), com.fasterxml.jackson.databind.JsonNode.class);
-            assertTrue(json.get("active").asBoolean());
-            assertEquals("impersonated-user", json.get("preferred_username").asText());
-            assertEquals("user", json.get("act").get("sub").asText());
-        }
-
-        try (Response response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-                                .param(OAuth2Constants.AUDIENCE, "target")
-
-                ))) {
-            org.junit.Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            String exchangedTokenString = accessTokenResponse.getToken();
-            JsonNode json = JsonSerialization.readValue(oauth.introspectAccessTokenWithClientCredential("client-exchanger", "secret", exchangedTokenString), com.fasterxml.jackson.databind.JsonNode.class);
-            assertTrue(json.get("active").asBoolean());
-            assertEquals("impersonated-user", json.get("preferred_username").asText());
-            assertEquals("user", json.get("act").get("sub").asText());
-        }
-    }
-
-    @UncaughtServerErrorExpected
-    @Test
-    public void testImpersonationUsingPublicClient() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("direct-public");
-
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode(), "secret");
-        String accessToken = tokenResponse.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        Response response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", null))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ));
-        org.junit.Assert.assertEquals(200, response.getStatus());
-        AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-        response.close();
-
-        String exchangedTokenString = accessTokenResponse.getToken();
-        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-        AccessToken exchangedToken = verifier.parse().getToken();
-        Assert.assertEquals("direct-public", exchangedToken.getIssuedFor());
-        Assert.assertEquals("impersonated-user", exchangedToken.getPreferredUsername());
-        Assert.assertNull(exchangedToken.getRealmAccess());
-
-        testingClient.server().run(ClientTokenExchangeTest::setUpUserImpersonatePermissions);
-    }
-
-    @UncaughtServerErrorExpected
-    @Test
-    public void testImpersonationUsingTokenIssuedToUntrustedPublicClient() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-        testingClient.server().run(ClientTokenExchangeTest::setUpUserImpersonatePermissions);
-
-        oauth.realm(TEST);
-        oauth.clientId("direct-public-untrusted");
-
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode(), "secret");
-        String accessToken = tokenResponse.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        Response response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public-untrusted", null))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ));
-        org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
-
-        oauth.idTokenHint(tokenResponse.getIdToken()).openLogout();
-        oauth.clientId("direct-public");
-        authzResponse = oauth.doLogin("user", "password");
-        tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode(), "secret");
-        accessToken = tokenResponse.getAccessToken();
-
-        response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", null))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ));
-        org.junit.Assert.assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testBadImpersonator() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret", "bad-impersonator", "password");
-        String accessToken = tokenResponse.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "bad-impersonator");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        // test that user does not have impersonator permission
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
-                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                    ));
-            org.junit.Assert.assertEquals(403, response.getStatus());
-            response.close();
-        }
-
-
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testDirectImpersonation() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-        Client httpClient = AdminClientUtil.createResteasyClient();
-
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
-
-        // direct-exchanger can impersonate from token "user" to user "impersonated-user"
-        // see https://issues.redhat.com/browse/KEYCLOAK-5492
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-exchanger", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                    ));
-            Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            response.close();
-
-            String exchangedTokenString = accessTokenResponse.getToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("direct-exchanger", exchangedToken.getIssuedFor());
-            Assert.assertNull(exchangedToken.getAudience());
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
-            Assert.assertNull(exchangedToken.getRealmAccess());
-        }
-
-        // direct-legal can impersonate from token "user" to user "impersonated-user" and to "target" client
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-legal", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-                                    .param(OAuth2Constants.AUDIENCE, "target")
-
-                    ));
-            Assert.assertEquals(200, response.getStatus());
-            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
-            response.close();
-
-            String exchangedTokenString = accessTokenResponse.getToken();
-            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
-            AccessToken exchangedToken = verifier.parse().getToken();
-            Assert.assertEquals("direct-legal", exchangedToken.getIssuedFor());
-            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
-            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
-            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
-        }
-
-        // direct-public fails impersonation
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-                                    .param(OAuth2Constants.AUDIENCE, "target")
-
-                    ));
-            Assert.assertEquals(403, response.getStatus());
-            response.close();
-        }
-
-        // direct-no-secret fails impersonation
-        {
-            Response response = exchangeUrl.request()
-                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-no-secret", "secret"))
-                    .post(Entity.form(
-                            new Form()
-                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-                                    .param(OAuth2Constants.AUDIENCE, "target")
-
-                    ));
-            assertTrue(response.getStatus() >= 400);
-            response.close();
-        }
-    }
-
-    @Test
-    @UncaughtServerErrorExpected
-    public void testExchangeNoRefreshToken() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-
-        ClientResource client = ApiUtil.findClientByClientId(adminClient.realm(TEST), "no-refresh-token");
-        ClientRepresentation clientRepresentation = client.toRepresentation();
-        clientRepresentation.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "false");
-        client.update(clientRepresentation);
-
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            String refreshTokenString = response.getRefreshToken();
-            assertNotNull(exchangedTokenString);
-            assertNotNull(refreshTokenString);
-        }
-
-        {
-            response = oauth.doTokenExchange(TEST, accessToken, "target", "no-refresh-token", "secret");
-            String exchangedTokenString = response.getAccessToken();
-            String refreshTokenString = response.getRefreshToken();
-            assertNotNull(exchangedTokenString);
-            assertNull(refreshTokenString);
-        }
-        clientRepresentation.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "true");
-        client.update(clientRepresentation);
-    }
-
-    @Test
-    public void testClientExchangeToItself() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        response = oauth.doTokenExchange(TEST, accessToken, null, "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-
-        response = oauth.doTokenExchange(TEST, accessToken, "client-exchanger", "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-    }
-
-    @Test
-    public void testClientExchange() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("direct-legal");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "direct-legal", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-    }
-
-    @Test
-    public void testClientExchangeWithMoreAudiencesNotBreak() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-
-        response = oauth.doTokenExchange(TEST, accessToken, List.of("target", "client-exchanger"), "client-exchanger", "secret", null);
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-    }
-
-    @Test
-    public void testPublicClientNotAllowed() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        oauth.realm(TEST);
-        oauth.clientId("direct-legal");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-
-        // public client has no permission to exchange with the client direct-legal to which the token was issued for
-        // if not set, the audience is calculated based on the client to which the token was issued for
-        response = oauth.doTokenExchange(TEST, accessToken, null, "direct-public", null);
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-        assertEquals("Client is not the holder of the token", response.getErrorDescription());
-
-        // public client has no permission to exchange
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "direct-public", null);
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-        assertEquals("Client is not the holder of the token", response.getErrorDescription());
-
-        response = oauth.doTokenExchange(TEST, accessToken, "direct-legal", "direct-public", null);
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-        assertEquals("Client is not the holder of the token", response.getErrorDescription());
-
-        // public client can not exchange a token to itself if the token was issued to another client
-        response = oauth.doTokenExchange(TEST, accessToken, "direct-public", "direct-public", null);
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-        assertEquals("Client is not the holder of the token", response.getErrorDescription());
-
-        // client with access to exchange
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-
-        // client must pass the audience because the client has no permission to exchange with the calculated audience (direct-legal)
-        response = oauth.doTokenExchange(TEST, accessToken, null, "client-exchanger", "secret");
-        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
-        assertEquals("Client is not within the token audience", response.getErrorDescription());
-    }
-
-    @Test
-    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
-    @UncaughtServerErrorExpected
-    public void testExchangeWithDynamicScopesEnabled() throws Exception {
-        testExchange();
-    }
-
-    @Test
-    public void testSupportedTokenTypesWhenValidatingSubjectToken() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-        oauth.realm(TEST);
-        oauth.clientId("direct-legal");
-        oauth.scope(OAuth2Constants.SCOPE_OPENID);
-        ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
-        ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
-        rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, oauth.APP_ROOT + "/admin/backchannelLogout");
-        getCleanup().addCleanup(() -> {
-            rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
-            clients.get(rep.getId()).update(rep);
-        });
-        clients.get(rep.getId()).update(rep);
-        String logoutToken;
-        oauth.clientSessionState("client-session");
-        oauth.doLogin("user", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret");
-        String idTokenString = tokenResponse.getIdToken();
-        String logoutUrl = oauth.getLogoutUrl().idTokenHint(idTokenString)
-                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT).build();
-        driver.navigate().to(logoutUrl);
-        logoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
-        Assert.assertNotNull(logoutToken);
-        OAuthClient.AccessTokenResponse response = oauth.doTokenExchange(TEST, logoutToken, "target", "direct-legal", "secret");
-        assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
-
-    }
-
-    @Test
-    public void testExchangeForDifferentClient() throws Exception {
-        testingClient.server().run(ClientTokenExchangeTest::setupRealm);
-
-        // generate the first token for a public client
-        oauth.realm(TEST);
-        oauth.clientId("direct-public");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
-        String accessToken = response.getAccessToken();
-        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        AccessToken token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
-        Assert.assertNotNull(token.getSessionId());
-        String sid = token.getSessionId();
-
-        // perform token exchange with client-exchanger simulating it received the previous token
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-        accessToken = response.getAccessToken();
-        accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals("client-exchanger", token.getIssuedFor());
-        Assert.assertEquals("target", token.getAudience()[0]);
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        Assert.assertEquals(sid, token.getSessionId());
-
-        // perform a second token exchange just to check everything is OK
-        response = oauth.doTokenExchange(TEST, accessToken, "target", "client-exchanger", "secret");
-        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
-        accessToken = response.getAccessToken();
-        accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
-        token = accessTokenVerifier.parse().getToken();
-        Assert.assertEquals("client-exchanger", token.getIssuedFor());
-        Assert.assertEquals("target", token.getAudience()[0]);
-        Assert.assertEquals(token.getPreferredUsername(), "user");
-        Assert.assertEquals(sid, token.getSessionId());
-    }
-
-    private static void addDirectExchanger(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        RoleModel exampleRole = realm.addRole("example");
-        AdminPermissionManagement management = AdminPermissions.management(session, realm);
-
-        ClientModel target = realm.addClient("target");
-        target.setName("target");
-        target.setClientId("target");
-        target.setDirectAccessGrantsEnabled(true);
-        target.setEnabled(true);
-        target.setSecret("secret");
-        target.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        target.setFullScopeAllowed(false);
-        target.addScopeMapping(exampleRole);
-
-        ClientModel directExchanger = realm.addClient("direct-exchanger");
-        directExchanger.setName("direct-exchanger");
-        directExchanger.setClientId("direct-exchanger");
-        directExchanger.setPublicClient(false);
-        directExchanger.setDirectAccessGrantsEnabled(true);
-        directExchanger.setEnabled(true);
-        directExchanger.setSecret("secret");
-        directExchanger.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
-        directExchanger.setFullScopeAllowed(false);
-
-        // permission for client to client exchange to "target" client
-        management.clients().setPermissionsEnabled(target, true);
-
-        ClientPolicyRepresentation clientImpersonateRep = new ClientPolicyRepresentation();
-        clientImpersonateRep.setName("clientImpersonatorsDirect");
-        clientImpersonateRep.addClient(directExchanger.getId());
-
-        ResourceServer server = management.realmResourceServer();
-        Policy clientImpersonatePolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientImpersonateRep);
-        management.users().setPermissionsEnabled(true);
-        management.users().adminImpersonatingPermission().addAssociatedPolicy(clientImpersonatePolicy);
-        management.users().adminImpersonatingPermission().setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
-
-        UserModel impersonatedUser = session.users().addUser(realm, "impersonated-user");
-        impersonatedUser.setEnabled(true);
-        impersonatedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
-        impersonatedUser.grantRole(exampleRole);
-    }
-
-    private static void removeDirectExchanger(KeycloakSession session) {
-        RealmModel realm = session.realms().getRealmByName(TEST);
-        realm.removeClient(realm.getClientByClientId("direct-exchanger").getId());
-        realm.removeClient(realm.getClientByClientId("target").getId());
-        realm.removeRole(realm.getRole("example"));
-        session.users().removeUser(realm, session.users().getUserByUsername(realm, "impersonated-user"));
-    }
-
-    private Response checkTokenExchange() {
-        Client httpClient = AdminClientUtil.createResteasyClient();
-        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
-                .path("/realms")
-                .path(TEST)
-                .path("protocol/openid-connect/token");
-
-        Response response = exchangeUrl.request()
-                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-exchanger", "secret"))
-                .post(Entity.form(
-                        new Form()
-                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
-
-                ));
-        return response;
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/DPoPTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/DPoPTest.java
index 288e35738f64..11dd594b77cd 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/DPoPTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/DPoPTest.java
@@ -19,9 +19,10 @@
 
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.Response.Status;
-import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -65,28 +66,28 @@
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.UserInfoResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.IntrospectionResponse;
+import org.keycloak.testsuite.util.oauth.UserInfoResponse;
 import org.keycloak.testsuite.util.ServerURLs;
 import org.keycloak.util.JWKSUtils;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
+import org.keycloak.utils.MediaType;
 
 import java.io.IOException;
 import java.security.KeyPair;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
 import java.util.function.BiConsumer;
 import java.util.function.Consumer;
+import java.util.stream.Collectors;
 
-import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.emptyOrNullString;
 import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertEquals;
@@ -123,6 +124,8 @@ public class DPoPTest extends AbstractTestRealmKeycloakTest {
     private String jktEc;
     private ClientRegistration reg;
 
+    private HttpGet get;
+
     @Before
     public void beforeDPoPTest() throws Exception {
         rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
@@ -150,6 +153,42 @@ public void beforeDPoPTest() throws Exception {
     public void configureTestRealm(RealmRepresentation testRealm) {
     }
 
+    @Test
+    public void testDuplicatedAuthorizationHeaderOnUserInfo() throws Exception {
+        KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+
+        get = new HttpGet(oauth.getEndpoints().getUserInfo());
+        get.addHeader("Accept", MediaType.APPLICATION_JSON);
+        String authorization = "DPoP" + " " + response.getAccessToken();
+        get.addHeader(HttpHeaders.AUTHORIZATION, authorization);
+        get.addHeader(HttpHeaders.AUTHORIZATION, authorization);
+
+        UserInfoResponse userInfoResponse = new UserInfoResponse(oauth.httpClient().get().execute(get));
+
+        assertEquals(401, userInfoResponse.getStatusCode());
+        assertEquals("HTTP 401 Unauthorized", userInfoResponse.getError());
+
+        oauth.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testDPoPAccessTokenButBearerAuthorizationHeader() throws Exception {
+        KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+
+        get = new HttpGet(oauth.getEndpoints().getUserInfo());
+        get.addHeader("Accept", MediaType.APPLICATION_JSON);
+        String authorization = "Bearer" + " " + response.getAccessToken();
+        get.addHeader(HttpHeaders.AUTHORIZATION, authorization);
+
+        UserInfoResponse userInfoResponse = new UserInfoResponse(oauth.httpClient().get().execute(get));
+        assertEquals(401, userInfoResponse.getStatusCode());
+
+        oauth.doLogout(response.getRefreshToken());
+    }
+
+
     @Test
     public void testDPoPByPublicClientWithDpopJkt() throws Exception {
         // use pre-computed EC key
@@ -158,7 +197,7 @@ public void testDPoPByPublicClientWithDpopJkt() throws Exception {
 
         sendAuthorizationRequestWithDPoPJkt(jktEc);
 
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         successTokenProceduresWithDPoP(dpopProofEcEncoded, jktEc);
     }
@@ -172,7 +211,7 @@ public void testDPoPByPublicClientWithDpopJktWithDifferentDPoPProofKey() throws
         sendAuthorizationRequestWithDPoPJkt(jktEc);
     
         // change key : EC key to RSA key
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
         failureTokenProceduresWithDPoP(dpopProofRsaEncoded, "DPoP Proof public key thumbprint does not match dpop_jkt");
     }
@@ -185,25 +224,38 @@ public void testDPoPByPublicClient() throws Exception {
 
         sendAuthorizationRequestWithDPoPJkt(null);
 
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         successTokenProceduresWithDPoP(dpopProofEcEncoded, jktEc);
     }
 
+    @Test
+    public void testDPoPByPublicClientTokenRefreshWithoutDPoPProof() throws Exception {
+        // use pre-computed EC key
+
+        int clockSkew = 10; // acceptable clock skew is +-10sec
+
+        sendAuthorizationRequestWithDPoPJkt(null);
+
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+
+        changeDPoPBound(TEST_PUBLIC_CLIENT_ID, false); // not enforce DPoP proof, but the refresh token is a DPoP type token.
+        failureRefreshTokenProceduresWithoutDPoP(dpopProofEcEncoded, jktEc);
+    }
+
     @Test
     public void testDPoPProofByConfidentialClient() throws Exception {
         // use pre-computed RSA key
 
         int clockSkew = -10; // acceptable clock skew is +-10sec
 
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofRsaEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_CONFIDENTIAL_CLIENT_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofRsaEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
@@ -213,25 +265,20 @@ public void testDPoPProofByConfidentialClient() throws Exception {
         // For confidential client, DPoP is not bind to refresh token (See "section 5 DPoP Access Token Request" of DPoP specification)
         assertNull(refreshToken.getConfirmation());
 
-        String tokenResponse = oauth.introspectTokenWithClientCredential(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET, "access_token", response.getAccessToken());
-        Assert.assertNotNull(tokenResponse);
-        TokenMetadataRepresentation tokenMetadataRepresentation = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        TokenMetadataRepresentation tokenMetadataRepresentation = oauth.doIntrospectionRequest(response.getAccessToken(), "access_token").asTokenMetadata();
         Assert.assertTrue(tokenMetadataRepresentation.isActive());
         assertEquals(jktRsa, tokenMetadataRepresentation.getConfirmation().getKeyThumbprint());
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, tokenMetadataRepresentation.getOtherClaims().get(OAuth2Constants.TOKEN_TYPE));
 
-        CloseableHttpResponse closableHttpResponse = oauth.doTokenRevoke(response.getAccessToken(), "access_token", TEST_CONFIDENTIAL_CLIENT_SECRET);
-        tokenResponse = oauth.introspectTokenWithClientCredential(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET, "access_token", response.getAccessToken());
-        Assert.assertNotNull(tokenResponse);
-        tokenMetadataRepresentation = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.tokenRevocationRequest(response.getAccessToken()).accessToken().send();
+
+        tokenMetadataRepresentation = oauth.doIntrospectionRequest(response.getAccessToken(), "access_token").asTokenMetadata();
         Assert.assertFalse(tokenMetadataRepresentation.isActive());
-        closableHttpResponse.close();
 
         // token refresh
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
-        oauth.dpopProof(dpopProofEcEncoded);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        response = oauth.refreshRequest(response.getRefreshToken()).dpopProof(dpopProofEcEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
@@ -240,7 +287,7 @@ public void testDPoPProofByConfidentialClient() throws Exception {
         refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
         assertNull(refreshToken.getConfirmation());
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
@@ -252,12 +299,11 @@ public void testDPoPDisabledByPublicClient() throws Exception {
             testDPoPByPublicClient();
 
             // without DPoP proof
-            oauth.clientId(TEST_PUBLIC_CLIENT_ID);
-            oauth.dpopProof(null);
+            oauth.client(TEST_PUBLIC_CLIENT_ID);
             oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             // token-type must be "Bearer" because no DPoP is present within the token-request
             assertEquals(TokenUtil.TOKEN_TYPE_BEARER, response.getTokenType());
 
@@ -268,7 +314,7 @@ public void testDPoPDisabledByPublicClient() throws Exception {
             assertNull(refreshToken.getConfirmation());
 
             // token refresh
-            response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
             assertEquals(TokenUtil.TOKEN_TYPE_BEARER, response.getTokenType());
 
             assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
@@ -277,7 +323,7 @@ public void testDPoPDisabledByPublicClient() throws Exception {
             refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
             assertNull(refreshToken.getConfirmation());
 
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
         } finally {
             changeDPoPBound(TEST_PUBLIC_CLIENT_ID, true);
         }
@@ -285,57 +331,50 @@ public void testDPoPDisabledByPublicClient() throws Exception {
 
     @Test
     public void testTokenRefreshWithReplayedDPoPProofByPublicClient() throws Exception {
-
-        oauth.clientId(TEST_PUBLIC_CLIENT_ID);
+        oauth.client(TEST_PUBLIC_CLIENT_ID);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofEcEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEcEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         // token refresh
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+        response = oauth.refreshRequest(response.getRefreshToken()).dpopProof(dpopProofEcEncoded).send();
         assertNull(response.getTokenType());
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals("DPoP proof has already been used", response.getErrorDescription());
 
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
     }
 
     @Test
     public void testTokenRefreshWithoutDPoPProofByConfidentialClient() throws Exception {
-
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofRsaEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_USER_PASSWORD);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofRsaEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         // token refresh
-        oauth.dpopProof(null);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertNull(response.getTokenType());
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals("DPoP proof is missing", response.getErrorDescription());
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
-    public void testDPoPProofCorsPreflight() throws Exception {
-        CloseableHttpResponse response = oauth.doPreflightRequest();
-
-        String[] headers = response.getHeaders(Cors.ACCESS_CONTROL_ALLOW_HEADERS)[0].getValue().split(", ");
-        Set<String> allowedHeaders = new HashSet<>(Arrays.asList(headers));
+    public void testDPoPProofCorsPreflight() {
+        Map<String, String> responseHeaders = TokenEndpointCorsTest.getTokenEndpointPreflightResponseHeaders(oauth);
+        Set<String> allowedHeaders = Arrays.stream(responseHeaders.get(Cors.ACCESS_CONTROL_ALLOW_HEADERS).split(", ")).collect(Collectors.toSet());
 
         assertTrue(allowedHeaders.contains(TokenUtil.TOKEN_TYPE_DPOP));
     }
@@ -343,65 +382,63 @@ public void testDPoPProofCorsPreflight() throws Exception {
     @Test
     public void testDPoPProofWithoutJwk() throws Exception {
         JWSHeader jwsHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.ES256, DPOP_JWT_HEADER_TYPE, jwkEc.getKeyId(), null);
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsHeader, ecKeyPair.getPrivate()), "No JWK in DPoP header");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsHeader, ecKeyPair.getPrivate(), null), "No JWK in DPoP header");
     }
 
     @Test
     public void testDPoPProofInvalidAlgorithm() throws Exception {
         JWSHeader jwsHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.none, DPOP_JWT_HEADER_TYPE, jwkEc.getKeyId(), jwkEc);
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsHeader, ecKeyPair.getPrivate()), "Unsupported DPoP algorithm: none");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsHeader, ecKeyPair.getPrivate(), null), "Unsupported DPoP algorithm: none");
     }
 
     @Test
     public void testDPoPProofInvalidType() throws Exception {
         JWSHeader jwsEcHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.ES256, "jwt+dpop", jwkEc.getKeyId(), jwkEc);
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "Invalid or missing type in DPoP header: jwt+dpop");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "Invalid or missing type in DPoP header: jwt+dpop");
     }
 
     @Test
     public void testDPoPProofInvalidSignature() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsEcHeader, rsaKeyPair.getPrivate()), "DPoP verification failure: org.keycloak.exceptions.TokenSignatureInvalidException: Invalid token signature");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsEcHeader, rsaKeyPair.getPrivate(), null), "DPoP verification failure: org.keycloak.exceptions.TokenSignatureInvalidException: Invalid token signature");
     }
 
     @Test
     public void testDPoPProofMandatoryClaimMissing() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(null, HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "DPoP mandatory claims are missing");
+        testDPoPProofFailure(generateSignedDPoPProof(null, HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "DPoP mandatory claims are missing");
     }
 
     @Test
     public void testDPoPProofReplayed() throws Exception {
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-
-        oauth.dpopProof(dpopProofEcEncoded);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_USER_PASSWORD);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEcEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
 
         testDPoPProofFailure(dpopProofEcEncoded, "DPoP proof has already been used");
     }
 
     @Test
     public void testDPoPProofExpired() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() - 100000), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "DPoP proof is not active");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() - 100000), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "DPoP proof is not active");
     }
 
     @Test
     public void testDPoPProofHttpMethodMismatch() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "DPoP HTTP method mismatch");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "DPoP HTTP method mismatch");
     }
 
     @Test
     public void testDPoPProofHttpUrlMalformed() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, ":::*;", (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "Malformed HTTP URL in DPoP proof");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, ":::*;", (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "Malformed HTTP URL in DPoP proof");
     }
 
     @Test
     public void testDPoPProofHttpUrlMismatch() throws Exception {
-        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, "https://server.example.com/token", (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate()), "DPoP HTTP URL mismatch");
+        testDPoPProofFailure(generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, "https://server.example.com/token", (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null), "DPoP HTTP URL mismatch");
     }
 
     @Test
@@ -409,8 +446,8 @@ public void testWithoutDPoPProof() throws Exception {
 
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_USER_PASSWORD);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals("DPoP proof is missing", response.getErrorDescription());
@@ -419,10 +456,22 @@ public void testWithoutDPoPProof() throws Exception {
     @Test
     public void testDPoPProofOnUserInfoByConfidentialClient() throws Exception {
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-        OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
         doSuccessfulUserInfoGet(response, rsaKeyPair);
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
+    }
+
+    @Test
+    public void testDPoPProofOnUserInfoWithMissingAcccessTokenHash() throws Exception {
+        KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        JWK jwkRsa1 = createRsaJwk(rsaKeyPair.getPublic());
+        JWSHeader jwsRsaHeader1 = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa1.getKeyId(), jwkRsa1);
+        // No ath
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader1, rsaKeyPair.getPrivate(), null);
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofRsaEncoded).send();
+        assertEquals(401, userInfoResponse.getStatusCode());
     }
 
     @Test
@@ -431,16 +480,14 @@ public void testDPoPDisabledOnUserInfo() throws Exception {
         changeDPoPBound(TEST_CONFIDENTIAL_CLIENT_ID, false);
         try {
             KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-            OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+            AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
             doSuccessfulUserInfoGet(response, rsaKeyPair);
 
-            // delete DPoP proof
-            oauth.dpopProof(null);
-            UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+            UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(null).send();
             assertEquals(401, userInfoResponse.getStatusCode());
-            assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"DPoP proof and token binding verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
+            assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"Token verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
 
-            oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+            oauth.doLogout(response.getRefreshToken());
         } finally {
             changeDPoPBound(TEST_CONFIDENTIAL_CLIENT_ID, true);
         }
@@ -449,63 +496,60 @@ public void testDPoPDisabledOnUserInfo() throws Exception {
     @Test
     public void testWithoutDPoPProofOnUserInfo() throws Exception {
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-        OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
 
-        oauth.dpopProof(null);
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(null).send();
         assertEquals(401, userInfoResponse.getStatusCode());
-        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"DPoP proof and token binding verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
+        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"Token verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
     public void testInvalidDPoPProofOnUserInfo() throws Exception {
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-        OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
 
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
         // invalid "htu" claim
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofRsaEncoded);
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), response.getAccessToken());
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofRsaEncoded).send();
         assertEquals(401, userInfoResponse.getStatusCode());
-        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"DPoP proof and token binding verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
+        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"Token verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
     public void testMultipleUseDPoPProofOnUserInfo() throws Exception {
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-        OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
-        doSuccessfulUserInfoGet(response, rsaKeyPair);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        String dpopProof = doSuccessfulUserInfoGet(response, rsaKeyPair);
 
         // use the same DPoP proof
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProof).send();
         assertEquals(401, userInfoResponse.getStatusCode());
-        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"DPoP proof and token binding verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
+        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"Token verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
     public void testDifferentKeyDPoPProofOnUserInfo() throws Exception {
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
-        OAuthClient.AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
+        AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);
 
         // use different key
         rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getUserInfoUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofRsaEncoded);
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), response.getAccessToken());
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofRsaEncoded).send();
         assertEquals(401, userInfoResponse.getStatusCode());
-        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"DPoP proof and token binding verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
+        assertEquals("Bearer realm=\"test\", error=\"invalid_token\", error_description=\"Token verification failed\"", userInfoResponse.getHeaders().get("WWW-Authenticate"));
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
@@ -577,25 +621,24 @@ public void testDPoPBindEnforcerExecutor() throws Exception {
         assertEquals(Boolean.TRUE, oidcClientRep.getDpopBoundAccessTokens());
 
         // token request without a DPoP proof - fail
-        oauth.clientId(appAlphaClientId);
+        oauth.client(appAlphaClientId);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals("DPoP proof is missing", response.getErrorDescription());
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
 
         // token request with a valid DPoP proof - success
         // EC key for client alpha
-        oauth.doSilentLogin();
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        oauth.openLoginForm();
+        code = oauth.parseLoginResponse().getCode();
 
         JWSHeader jwsEcHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.ES256, DPOP_JWT_HEADER_TYPE, jwkEc.getKeyId(), jwkEc);
-        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        response = oauth.doAccessTokenRequest(code, null);
+        String dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        response = oauth.accessTokenRequest(code).dpopProof(dpopProofEcEncoded).send();
 
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
         String encodedAccessToken = response.getAccessToken();
@@ -611,29 +654,25 @@ public void testDPoPBindEnforcerExecutor() throws Exception {
         assertEquals(jkt, refreshToken.getConfirmation().getKeyThumbprint());
 
         // userinfo request without a DPoP proof - fail
-        oauth.dpopProof(null);
-        OAuthClient.UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(null).send();
         assertEquals(401, userInfoResponse.getStatusCode());
 
         // userinfo request with a valid DPoP proof - success
         jwsEcHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.ES256, DPOP_JWT_HEADER_TYPE, jwkEc.getKeyId(), jwkEc);
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getUserInfoUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), response.getAccessToken());
+        userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofEcEncoded).send();
         assertEquals(200, userInfoResponse.getStatusCode());
         assertEquals(TEST_USER_NAME, userInfoResponse.getUserInfo().getPreferredUsername());
 
         // token refresh without a DPoP Proof - fail
-        oauth.dpopProof(null);
-        response = oauth.doRefreshTokenRequest(encodedRefreshToken, null);
+        response = oauth.doRefreshTokenRequest(encodedRefreshToken);
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals("DPoP proof is missing", response.getErrorDescription());
 
         // token refresh with a valid DPoP Proof - success
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        response = oauth.doRefreshTokenRequest(encodedRefreshToken, null);
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), response.getIdToken());
+        response = oauth.refreshRequest(encodedRefreshToken).dpopProof(dpopProofEcEncoded).send();
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
         encodedAccessToken = response.getAccessToken();
         encodedRefreshToken = response.getRefreshToken();
@@ -648,24 +687,20 @@ public void testDPoPBindEnforcerExecutor() throws Exception {
 
         // revoke token without a valid DPoP proof - fail
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getTokenRevocationUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofRsaEncoded);
-        CloseableHttpResponse closableHttpResponse = oauth.doTokenRevoke(encodedAccessToken, "access_token", null);
-        assertThat(closableHttpResponse, Matchers.statusCodeIsHC(Status.BAD_REQUEST));
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getRevocation(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), response.getAccessToken());
+        assertEquals(400, oauth.tokenRevocationRequest(encodedAccessToken).accessToken().dpopProof(dpopProofRsaEncoded).send().getStatusCode());
 
         // revoke token with a valid DPoP proof - success
-        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getTokenRevocationUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEcEncoded);
-        closableHttpResponse = oauth.doTokenRevoke(encodedAccessToken, "access_token", null);
-        assertThat(closableHttpResponse, Matchers.statusCodeIsHC(Status.OK));
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(appAlphaClientId, null, encodedAccessToken);
-        TokenMetadataRepresentation tokenMetadataRepresentation = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
-        assertFalse(tokenMetadataRepresentation.isActive());
+        dpopProofEcEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getRevocation(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), response.getAccessToken());
+        assertTrue(oauth.tokenRevocationRequest(encodedAccessToken).accessToken().dpopProof(dpopProofEcEncoded).send().isSuccess());
+        IntrospectionResponse introspectionResponse = oauth.doIntrospectionAccessTokenRequest(encodedAccessToken);
+        assertFalse(introspectionResponse.isSuccess());
+        assertEquals("Client not allowed.", introspectionResponse.getErrorDescription());
 
         updatePolicies("{}");
         updateProfiles("{}");
 
-        oauth.idTokenHint(encodedIdToken).openLogout();
+        oauth.logoutForm().idTokenHint(encodedIdToken).open();
     }
 
     @Test
@@ -674,17 +709,16 @@ public void testDPoPProofWithClientCredentialsGrant() throws Exception {
             clientRepresentation.setServiceAccountsEnabled(true);
             configWrapper.setUseDPoP(true);
         });
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
 
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
-        oauth.dpopProof(dpopProofRsaEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest(TEST_CONFIDENTIAL_CLIENT_SECRET);
+        AccessTokenResponse response = oauth.clientCredentialsGrantRequest().dpopProof(dpopProofRsaEncoded).send();
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -694,7 +728,7 @@ public void testDPoPProofWithClientCredentialsGrant() throws Exception {
         String jkt = JWKSUtils.computeThumbprint(jwkRsa);
         assertEquals(jkt, accessToken.getConfirmation().getKeyThumbprint());
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
     @Test
@@ -703,19 +737,16 @@ public void testDPoPProofWithResourceOwnerPasswordCredentialsGrant() throws Exce
             clientRepresentation.setDirectAccessGrantsEnabled(true);
             configWrapper.setUseDPoP(true);
         });
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
 
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
-        oauth.dpopProof(dpopProofRsaEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(TEST_CONFIDENTIAL_CLIENT_SECRET,
-                                                                                   TEST_USER_NAME,
-                                                                                   TEST_USER_PASSWORD);
+        AccessTokenResponse response = oauth.passwordGrantRequest(TEST_USER_NAME, TEST_USER_PASSWORD).dpopProof(dpopProofRsaEncoded).send();
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -725,20 +756,19 @@ public void testDPoPProofWithResourceOwnerPasswordCredentialsGrant() throws Exce
         String jkt = JWKSUtils.computeThumbprint(jwkRsa);
         assertEquals(jkt, accessToken.getConfirmation().getKeyThumbprint());
 
-        oauth.doLogout(response.getRefreshToken(), TEST_CONFIDENTIAL_CLIENT_SECRET);
+        oauth.doLogout(response.getRefreshToken());
     }
 
-    private OAuthClient.AccessTokenResponse getDPoPBindAccessToken(KeyPair rsaKeyPair) throws Exception {
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+    private AccessTokenResponse getDPoPBindAccessToken(KeyPair rsaKeyPair) throws Exception {
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofRsaEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_CONFIDENTIAL_CLIENT_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofRsaEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
@@ -751,22 +781,21 @@ private OAuthClient.AccessTokenResponse getDPoPBindAccessToken(KeyPair rsaKeyPai
         return response;
     }
 
-    private void doSuccessfulUserInfoGet(OAuthClient.AccessTokenResponse accessTokenResponse, KeyPair rsaKeyPair) throws Exception {
+    private String doSuccessfulUserInfoGet(AccessTokenResponse accessTokenResponse, KeyPair rsaKeyPair) throws Exception {
         JWK jwkRsa = createRsaJwk(rsaKeyPair.getPublic());
         JWSHeader jwsRsaHeader = new JWSHeader(org.keycloak.jose.jws.Algorithm.PS256, DPOP_JWT_HEADER_TYPE, jwkRsa.getKeyId(), jwkRsa);
-        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getUserInfoUrl(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofRsaEncoded);
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(accessTokenResponse);
+        String dpopProofRsaEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), accessTokenResponse.getAccessToken());
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(accessTokenResponse.getAccessToken()).dpop(dpopProofRsaEncoded).send();
         assertEquals(TEST_USER_NAME, userInfoResponse.getUserInfo().getPreferredUsername());
+        return dpopProofRsaEncoded;
     }
 
     private void testDPoPProofFailure(String dpopProofEncoded, String errorDescription) throws Exception {
-        oauth.dpopProof(dpopProofEncoded);
-        oauth.clientId(TEST_CONFIDENTIAL_CLIENT_ID);
+        oauth.client(TEST_CONFIDENTIAL_CLIENT_ID, TEST_CONFIDENTIAL_CLIENT_SECRET);
         oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, TEST_CONFIDENTIAL_CLIENT_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEncoded).send();
 
         assertEquals(Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
@@ -908,17 +937,14 @@ private OIDCClientRepresentation getClientDynamically(String clientId) throws Cl
     }
 
 
-    private void sendAuthorizationRequestWithDPoPJkt(String dpopJkt) throws Exception {
-        oauth.clientId(TEST_PUBLIC_CLIENT_ID);
-        oauth.dpopJkt(dpopJkt);
-        oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-        oauth.dpopJkt(null); // revert explicitly
+    private void sendAuthorizationRequestWithDPoPJkt(String dpopJkt) {
+        oauth.client(TEST_PUBLIC_CLIENT_ID);
+        oauth.loginForm().dpopJkt(dpopJkt).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
     }
 
     private void successTokenProceduresWithDPoP(String dpopProofEncoded, String jkt) throws Exception {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -927,10 +953,9 @@ private void successTokenProceduresWithDPoP(String dpopProofEncoded, String jkt)
         assertEquals(jkt, refreshToken.getConfirmation().getKeyThumbprint());
 
         // token refresh
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
-        oauth.dpopProof(dpopProofEncoded);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+        response = oauth.refreshRequest(response.getRefreshToken()).dpopProof(dpopProofEncoded).send();
         assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
 
         assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
@@ -940,22 +965,40 @@ private void successTokenProceduresWithDPoP(String dpopProofEncoded, String jkt)
         assertEquals(jkt, refreshToken.getConfirmation().getKeyThumbprint());
 
         // userinfo access
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getUserInfoUrl(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        oauth.dpopProof(dpopProofEncoded);
-        UserInfoResponse userInfoResponse = oauth.doUserInfoRequestByGet(response);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.GET, oauth.getEndpoints().getUserInfo(), (long) Time.currentTime(), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), response.getAccessToken());
+        UserInfoResponse userInfoResponse = oauth.userInfoRequest(response.getAccessToken()).dpop(dpopProofEncoded).send();
         assertEquals(TEST_USER_NAME, userInfoResponse.getUserInfo().getPreferredUsername());
 
         // logout
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
+    }
+
+    private void failureRefreshTokenProceduresWithoutDPoP(String dpopProofEncoded, String jkt) throws Exception {
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEncoded).send();
+        assertEquals(TokenUtil.TOKEN_TYPE_DPOP, response.getTokenType());
+        assertEquals(Status.OK.getStatusCode(), response.getStatusCode());
+        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
+        assertEquals(jkt, accessToken.getConfirmation().getKeyThumbprint());
+        RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
+        assertEquals(jkt, refreshToken.getConfirmation().getKeyThumbprint());
+
+        // token refresh without DPoP Proof
+        response = oauth.refreshRequest(response.getRefreshToken()).dpopProof(null).send();
+        assertEquals(400, response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
+        assertEquals("DPoP proof is missing", response.getErrorDescription());
+
+        // logout
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
     }
 
     private void failureTokenProceduresWithDPoP(String dpopProofEncoded, String error) throws Exception {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.dpopProof(dpopProofEncoded);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).dpopProof(dpopProofEncoded).send();
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
         assertEquals(error, response.getErrorDescription());
-        oauth.idTokenHint(response.getIdToken()).openLogout();
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
index 41e75c482839..b0162173f701 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LoginStatusIframeEndpointTest.java
@@ -40,7 +40,6 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.ActionURIUtils;
-import org.keycloak.testsuite.oidc.PkceGenerator;
 import org.keycloak.testsuite.runonserver.ServerVersion;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
@@ -48,6 +47,8 @@
 
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
+
 import java.io.IOException;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
@@ -74,7 +75,7 @@ public void checkIframe() throws IOException {
         try (CloseableHttpClient client = HttpClients.custom().setDefaultCookieStore(cookieStore).build()) {
             String redirectUri = URLEncoder.encode(suiteContext.getAuthServerInfo().getContextRoot() + "/auth/admin/master/console", StandardCharsets.UTF_8);
 
-            PkceGenerator pkce = new PkceGenerator();
+            PkceGenerator pkce = PkceGenerator.s256();
 
             HttpGet get = new HttpGet(
                     suiteContext.getAuthServerInfo().getContextRoot() + "/auth/realms/master/protocol/openid-connect/auth?response_type=code&client_id=" + Constants.ADMIN_CONSOLE_CLIENT_ID +
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutCorsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutCorsTest.java
index dd4a1341c93d..426affe982a6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutCorsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutCorsTest.java
@@ -30,12 +30,14 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertTrue;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 
 /**
@@ -66,67 +68,62 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
 
     @Test
     public void postLogout_validRequestWithValidOrigin() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String refreshTokenString = tokenResponse.getRefreshToken();
         oauth.origin(VALID_CORS_URL);
 
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "password")) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.NO_CONTENT));
-            assertCors(response);
-        }
+        LogoutResponse response = oauth.doLogout(refreshTokenString);
+        assertTrue(response.isSuccess());
+        assertCors(response);
     }
 
     @Test
     public void postLogout_validRequestWithInValidOriginShouldFail() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String refreshTokenString = tokenResponse.getRefreshToken();
         oauth.origin(INVALID_CORS_URL);
 
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "password")) {
-            assertThat(response, Matchers.statusCodeIsHC(Response.Status.NO_CONTENT));
-            assertNotCors(response);
-        }
+        LogoutResponse response = oauth.doLogout(refreshTokenString);
+        assertTrue(response.isSuccess());
+        assertNotCors(response);
     }
 
     @Test
     public void postLogout_invalidRequestWithValidOrigin() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String refreshTokenString = tokenResponse.getRefreshToken();
         oauth.origin(VALID_CORS_URL);
 
         // Logout with invalid refresh token
-        try (CloseableHttpResponse response = oauth.doLogout("invalid-refresh-token", "password")) {
-            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusLine().getStatusCode());
-            assertCors(response);
-        }
+        LogoutResponse response = oauth.doLogout("invalid-refresh-token");
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertCors(response);
 
         // Logout with invalid client secret
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "invalid-secret")) {
-            assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusLine().getStatusCode());
-            assertCors(response);
-        }
+        response = oauth.client(oauth.getClientId(), "invalid-secret").doLogout(refreshTokenString);
+        assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
+        assertCors(response);
     }
 
-    private OAuthClient.AccessTokenResponse loginUser() {
+    private AccessTokenResponse loginUser() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        return oauth.doAccessTokenRequest(code, "password");
+        return oauth.doAccessTokenRequest(code);
     }
 
 
-    private static void assertCors(CloseableHttpResponse response) {
-        assertEquals("true", response.getFirstHeader("Access-Control-Allow-Credentials").getValue());
-        assertEquals(VALID_CORS_URL, response.getFirstHeader("Access-Control-Allow-Origin").getValue());
-        assertEquals("Access-Control-Allow-Methods", response.getFirstHeader("Access-Control-Expose-Headers").getValue());
+    private static void assertCors(LogoutResponse response) {
+        assertEquals("true", response.getHeader("Access-Control-Allow-Credentials"));
+        assertEquals(VALID_CORS_URL, response.getHeader("Access-Control-Allow-Origin"));
+        assertEquals("Access-Control-Allow-Methods", response.getHeader("Access-Control-Expose-Headers"));
     }
 
-    private static void assertNotCors(CloseableHttpResponse response) {
-        assertNull(response.getFirstHeader("Access-Control-Allow-Credentials"));
-        assertNull(response.getFirstHeader("Access-Control-Allow-Origin"));
-        assertNull(response.getFirstHeader("Access-Control-Expose-Headers"));
+    private static void assertNotCors(LogoutResponse response) {
+        assertNull(response.getHeader("Access-Control-Allow-Credentials"));
+        assertNull(response.getHeader("Access-Control-Allow-Origin"));
+        assertNull(response.getHeader("Access-Control-Expose-Headers"));
     }
 
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java
index 121ca3029667..6492bc1707ea 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/LogoutTest.java
@@ -17,25 +17,34 @@
 
 package org.keycloak.testsuite.oauth;
 
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response.Status;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
 import org.hamcrest.MatcherAssert;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
-
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.common.util.Retry;
 import org.keycloak.common.util.Time;
+import org.keycloak.constants.AdapterConstants;
+import org.keycloak.crypto.Algorithm;
 import org.keycloak.events.Details;
 import org.keycloak.jose.jws.JWSHeader;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.models.Constants;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.LogoutToken;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
@@ -43,28 +52,28 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.LoginPage;
-
-import java.util.List;
-import java.util.Map;
-
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.Response.Status;
-import jakarta.ws.rs.core.UriBuilder;
-
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
+import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.ProtocolMapperUtil;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
-import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
-import static org.hamcrest.Matchers.*;
-import static org.junit.Assert.*;
+import java.io.IOException;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.Matchers.is;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 
 /**
@@ -103,46 +112,42 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void postLogout() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
         String refreshTokenString = tokenResponse.getRefreshToken();
 
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "password")) {
-            MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.NO_CONTENT));
+        LogoutResponse response = oauth.doLogout(refreshTokenString);
+        assertTrue(response.isSuccess());
 
-            assertNotNull(testingClient.testApp().getAdminLogoutAction());
-        }
+        assertNotNull(testingClient.testApp().getAdminLogoutAction());
     }
 
     @Test
     public void postLogoutExpiredRefreshToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
         String refreshTokenString = tokenResponse.getRefreshToken();
 
         adminClient.realm("test").update(RealmBuilder.create().notBefore(Time.currentTime() + 1).build());
 
         // Logout should succeed with expired refresh token, see KEYCLOAK-3302
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "password")) {
-            MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.NO_CONTENT));
+        LogoutResponse response = oauth.doLogout(refreshTokenString);
+        assertTrue(response.isSuccess());
 
-            assertNotNull(testingClient.testApp().getAdminLogoutAction());
-        }
+        assertNotNull(testingClient.testApp().getAdminLogoutAction());
     }
 
     @Test
     public void postLogoutWithRefreshTokenAfterUserSessionLogoutAndLoginAgain() throws Exception {
         // Login
-        OAuthClient.AccessTokenResponse accessTokenResponse = loginAndForceNewLoginPage();
+        AccessTokenResponse accessTokenResponse = loginAndForceNewLoginPage();
         String refreshToken1 = accessTokenResponse.getRefreshToken();
 
-        oauth.doLogout(refreshToken1, "password");
+        oauth.doLogout(refreshToken1);
 
         setTimeOffset(2);
 
@@ -151,35 +156,125 @@ public void postLogoutWithRefreshTokenAfterUserSessionLogoutAndLoginAgain() thro
 
         Assert.assertFalse(loginPage.isCurrent());
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code);
 
         // finally POST logout with VALID token should succeed
-        try (CloseableHttpResponse response = oauth.doLogout(tokenResponse2.getRefreshToken(), "password")) {
-            MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.NO_CONTENT));
+        LogoutResponse response = oauth.doLogout(tokenResponse2.getRefreshToken());
+        assertTrue(response.isSuccess());
 
-            assertNotNull(testingClient.testApp().getAdminLogoutAction());
-        }
+        assertNotNull(testingClient.testApp().getAdminLogoutAction());
     }
 
     @Test
     public void postLogoutFailWithCredentialsOfDifferentClient() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
         String refreshTokenString = tokenResponse.getRefreshToken();
 
-        oauth.clientId("test-app-scope");
+        oauth.client("test-app-scope", "password");
 
         // Assert logout fails with 400 when trying to use different client credentials
-        try (CloseableHttpResponse response = oauth.doLogout(refreshTokenString, "password")) {
-            MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.BAD_REQUEST));
+        LogoutResponse response = oauth.doLogout(refreshTokenString);
+        assertEquals(response.getStatusCode(), 400);
+
+        oauth.client("test-app", "password");
+    }
+
+    @Test
+    public void logoutBackchannelTwoClientsSpecificConfigurationIsUsed() throws Exception {
+        final String defaultSignatureAlgorithm = adminClient.realm(oauth.getRealm()).toRepresentation().getDefaultSignatureAlgorithm();
+        final String differentAlg = Algorithm.RS256.equals(defaultSignatureAlgorithm) ? Algorithm.RS512 : Algorithm.RS256;
+        try (ClientAttributeUpdater updater = ClientAttributeUpdater.forClient(adminClient, oauth.getRealm(), oauth.getClientId())
+                .setAttribute(OIDCConfigAttributes.ID_TOKEN_SIGNED_RESPONSE_ALG, differentAlg)
+                .setAttribute(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, OAuthClient.APP_ROOT + "/admin/backchannelLogout")
+                .update()) {
+
+            // login with test-app
+            oauth.doLogin("test-user@localhost", "password");
+            AccessTokenResponse tokenResponse = oauth.accessTokenRequest(oauth.parseLoginResponse().getCode())
+                    .param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            Assert.assertNull(tokenResponse.getError());
+
+            // login with test-app-scope
+            oauth.client("test-app-scope", "password");
+            oauth.openLoginForm();
+            AccessTokenResponse tokenResponse2 = oauth.accessTokenRequest(oauth.parseLoginResponse().getCode())
+                    .param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            Assert.assertNull(tokenResponse2.getError());
+            AccessToken accessToken = new JWSInput(tokenResponse2.getAccessToken()).readJsonContent(AccessToken.class);
+
+            // logout from test-app-scope
+            oauth.logoutForm().idTokenHint(tokenResponse2.getIdToken()).open();
+
+            // check test-app backchannel is received
+            String rawLogoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
+
+            // check the logout token is OK and using correct signature algorithm
+            JWSInput jwsInput = new JWSInput(rawLogoutToken);
+            assertEquals(differentAlg, jwsInput.getHeader().getRawAlgorithm());
+            LogoutToken logoutToken = jwsInput.readJsonContent(LogoutToken.class);
+            validateLogoutToken(logoutToken);
+            JWSHeader logoutTokenHeader = jwsInput.getHeader();
+            assertEquals("logout+jwt", logoutTokenHeader.getType());
+            assertEquals(accessToken.getSubject(), logoutToken.getSubject());
         }
+    }
 
-        oauth.clientId("test-app");
+    @Test
+    public void testRemoveAuthSessionWhenUserSessionFromIdTokenIsInvalid() throws IOException {
+        RealmResource realm = adminClient.realm("test");
+
+        for (int i = 0; i < 2; i++) {
+            realm.users().create(UserBuilder.create()
+                    .username("user-0")
+                    .password("password")
+                    .email("user-0@keycloak")
+                    .firstName("first")
+                    .lastName("last")
+                    .enabled(true)
+                    .build()).close();
+            UserRepresentation user = ApiUtil.findUserByUsername(realm, "user-0");
+            Assert.assertNotNull(user);
+
+            loginPage.open();
+            loginPage.login("user-0", "password");
+
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            String idTokenString = tokenResponse.getIdToken();
+            realm.users().get(user.getId()).remove();
+            oauth.logoutForm()
+                    .withRedirect()
+                    .idTokenHint(idTokenString)
+                    .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
+                    .open();
+
+            realm.users().create(UserBuilder.create()
+                    .username("user-1")
+                    .password("password")
+                    .email("user-1@keycloak")
+                    .firstName("first")
+                    .lastName("last")
+                    .enabled(true)
+                    .build()).close();
+
+            loginPage.open();
+            loginPage.login("user-1", "password");
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            idTokenString = tokenResponse.getIdToken();
+            oauth.logoutForm()
+                    .idTokenHint(idTokenString)
+                    .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
+                    .open();
+            user = ApiUtil.findUserByUsername(realm, "user-1");
+            Assert.assertNotNull(user);
+            realm.users().get(user.getId()).remove();
+        }
     }
 
     @Test
@@ -205,10 +300,9 @@ public void logoutUserByAdmin() {
     private void backchannelLogoutRequest(String expectedRefreshAlg, String expectedAccessAlg, String expectedIdTokenAlg) throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
         String idTokenString = tokenResponse.getIdToken();
 
         JWSHeader header = new JWSInput(tokenResponse.getAccessToken()).getHeader();
@@ -226,13 +320,13 @@ private void backchannelLogoutRequest(String expectedRefreshAlg, String expected
         assertEquals("JWT", header.getType());
         assertNull(header.getContentType());
 
-        String logoutUrl = oauth.getLogoutUrl()
-          .idTokenHint(idTokenString)
-          .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
-          .build();
+        String logoutUrl = oauth.logoutForm()
+                .idTokenHint(idTokenString)
+                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
+                .build();
 
         try (CloseableHttpClient c = HttpClientBuilder.create().disableRedirectHandling().build();
-          CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
+             CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
             MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.FOUND));
             MatcherAssert.assertThat(response.getFirstHeader(HttpHeaders.LOCATION).getValue(), is(oauth.APP_AUTH_ROOT));
         }
@@ -262,20 +356,18 @@ public void successfulKLogoutAfterEmptyBackChannelUrl() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
         String sessionId = events.expectLogin().assertEvent().getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-
-        oauth.clientSessionState("client-session");
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
         events.poll();
         String idTokenString = tokenResponse.getIdToken();
-        String logoutUrl = oauth.getLogoutUrl()
+        String logoutUrl = oauth.logoutForm()
                 .idTokenHint(idTokenString)
                 .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
                 .build();
 
         try (CloseableHttpClient c = HttpClientBuilder.create().disableRedirectHandling().build();
-                CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
+             CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
             MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.FOUND));
             MatcherAssert.assertThat(response.getFirstHeader(HttpHeaders.LOCATION).getValue(), is(oauth.APP_AUTH_ROOT));
         }
@@ -302,19 +394,61 @@ public void backChannelPreferenceOverKLogout() throws Exception {
         try {
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
+
+            AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            String idTokenString = tokenResponse.getIdToken();
+            String logoutUrl = oauth.logoutForm()
+                    .idTokenHint(idTokenString)
+                    .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
+                    .build();
+
+            try (CloseableHttpClient c = HttpClientBuilder.create().disableRedirectHandling().build();
+                 CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
+                MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.FOUND));
+                MatcherAssert.assertThat(response.getFirstHeader(HttpHeaders.LOCATION).getValue(), is(oauth.APP_AUTH_ROOT));
+            }
+
+            String rawLogoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
+            JWSInput jwsInput = new JWSInput(rawLogoutToken);
+            LogoutToken logoutToken = jwsInput.readJsonContent(LogoutToken.class);
+            validateLogoutToken(logoutToken);
+            JWSHeader logoutTokenHeader = jwsInput.getHeader();
+            assertEquals("logout+jwt", logoutTokenHeader.getType());
+        } finally {
+            rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
+            clientResource.update(rep);
+        }
+    }
+
+    @Test
+    public void backChannelWithPairwiseLogout() throws Exception {
+        ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
+        ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
+
+        rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, oauth.APP_ROOT + "/admin/backchannelLogout");
+        List<ProtocolMapperRepresentation> mappers = new LinkedList<>();
+        mappers.add(ProtocolMapperUtil.createPairwiseMapper("","123456"));
+        rep.setProtocolMappers(mappers);
+
+        ClientResource clientResource = clients.get(rep.getId());
+        clientResource.update(rep);
+
+        try {
+            oauth.doLogin("test-user@localhost", "password");
 
-            oauth.clientSessionState("client-session");
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
+            AccessToken accessToken = new JWSInput(tokenResponse.getAccessToken()).readJsonContent(AccessToken.class);
             String idTokenString = tokenResponse.getIdToken();
-            String logoutUrl = oauth.getLogoutUrl()
+            String logoutUrl = oauth.logoutForm()
                     .idTokenHint(idTokenString)
                     .postLogoutRedirectUri(oauth.APP_AUTH_ROOT)
                     .build();
 
             try (CloseableHttpClient c = HttpClientBuilder.create().disableRedirectHandling().build();
-                    CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
+                 CloseableHttpResponse response = c.execute(new HttpGet(logoutUrl))) {
                 MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.FOUND));
                 MatcherAssert.assertThat(response.getFirstHeader(HttpHeaders.LOCATION).getValue(), is(oauth.APP_AUTH_ROOT));
             }
@@ -325,6 +459,7 @@ public void backChannelPreferenceOverKLogout() throws Exception {
             validateLogoutToken(logoutToken);
             JWSHeader logoutTokenHeader = jwsInput.getHeader();
             assertEquals("logout+jwt", logoutTokenHeader.getType());
+            assertEquals(accessToken.getSubject(), logoutToken.getSubject());
         } finally {
             rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
             clientResource.update(rep);
@@ -349,20 +484,18 @@ private void validateLogoutToken(LogoutToken backChannelLogoutToken) {
         MatcherAssert.assertThat("map of back-channel logout event member object should be an empty object", (Map<?, ?>) backchannelLogoutEvent, org.hamcrest.Matchers.anEmptyMap());
     }
 
-    private OAuthClient.AccessTokenResponse loginAndForceNewLoginPage() {
+    private AccessTokenResponse loginAndForceNewLoginPage() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.clientSessionState("client-session");
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(code).param(AdapterConstants.CLIENT_SESSION_STATE, "client-session").send();
 
         setTimeOffset(1);
 
-        String loginFormUri = UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
-                .build().toString();
-        driver.navigate().to(loginFormUri);
+        oauth.loginForm()
+                .prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
+                .open();
 
         loginPage.assertCurrent();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2DeviceAuthorizationGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2DeviceAuthorizationGrantTest.java
index 45d2ccb35e4b..b7c066559c2c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2DeviceAuthorizationGrantTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2DeviceAuthorizationGrantTest.java
@@ -22,6 +22,7 @@
 import static org.keycloak.models.OAuth2DeviceConfig.DEFAULT_OAUTH2_DEVICE_CODE_LIFESPAN;
 import static org.keycloak.models.OAuth2DeviceConfig.DEFAULT_OAUTH2_DEVICE_POLLING_INTERVAL;
 
+import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Before;
@@ -50,13 +51,15 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.oidc.PkceGenerator;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.OAuth2DeviceVerificationPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
+import org.keycloak.testsuite.util.oauth.device.DeviceAuthorizationResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 
@@ -82,6 +85,7 @@ public class OAuth2DeviceAuthorizationGrantTest extends AbstractKeycloakTest {
 
     private static final String REALM_NAME = "test";
     private static final String DEVICE_APP = "test-device";
+    private static final String DEVICE_APP_SECRET = "secret";
     private static final String DEVICE_APP_PUBLIC = "test-device-public";
     private static final String DEVICE_APP_PUBLIC_CUSTOM_CONSENT = "test-device-public-custom-consent";
     private static final String DEVICE_APP_WITHOUT_SCOPES = "test-device-without-scopes";
@@ -159,8 +163,8 @@ public void resetConfig() {
     public void testConfidentialClient() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -188,7 +192,7 @@ public void testConfidentialClient() throws Exception {
         verificationPage.assertApprovedPage();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -203,8 +207,8 @@ public void testConfidentialClient() throws Exception {
     public void testPublicClient() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+        oauth.client(DEVICE_APP_PUBLIC);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -223,7 +227,7 @@ public void testPublicClient() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -244,8 +248,8 @@ public void testCustomVerificationUri() throws Exception {
             realmRep.getAttributes().put(DeviceEndpoint.SHORT_VERIFICATION_URI, SHORT_DEVICE_FLOW_URL);
             testRealm.update(realmRep);
             oauth.realm(REALM_NAME);
-            oauth.clientId(DEVICE_APP_PUBLIC);
-            OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+            oauth.client(DEVICE_APP_PUBLIC);
+            DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
             Assert.assertEquals(200, response.getStatusCode());
             assertNotNull(response.getDeviceCode());
@@ -264,8 +268,8 @@ public void testCustomVerificationUri() throws Exception {
     public void testVerifyHolderOfDeviceCode() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+        oauth.client(DEVICE_APP_PUBLIC);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -284,7 +288,7 @@ public void testVerifyHolderOfDeviceCode() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         assertEquals(200, tokenResponse.getStatusCode());
 
@@ -301,7 +305,7 @@ public void testVerifyHolderOfDeviceCode() throws Exception {
         oauth.openLoginForm();
 
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC_CUSTOM_CONSENT);
+        oauth.client(DEVICE_APP_PUBLIC_CUSTOM_CONSENT);
 
         oauth.fillLoginForm("device-login", "password");
 
@@ -311,7 +315,7 @@ public void testVerifyHolderOfDeviceCode() throws Exception {
 
         oauth.openLoginForm();
 
-        response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC_CUSTOM_CONSENT, null);
+        response = oauth.device().doDeviceAuthorizationRequest();
 
         openVerificationPage(response.getVerificationUriComplete());
 
@@ -319,8 +323,10 @@ public void testVerifyHolderOfDeviceCode() throws Exception {
         Assert.assertTrue(grantPage.getDisplayedGrants().contains("This is the custom consent screen text."));
         grantPage.accept();
 
+        oauth.client(DEVICE_APP_PUBLIC);
+
         // Token request from device
-        tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         assertEquals(400, tokenResponse.getStatusCode());
         assertEquals("unauthorized client", tokenResponse.getErrorDescription());
@@ -330,11 +336,11 @@ public void testVerifyHolderOfDeviceCode() throws Exception {
     public void testPublicClientOptionalScope() throws Exception {
         // Device Authorization Request from device - check giving optional scope phone
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        OAuthClient.DeviceAuthorizationResponse response = null;
+        oauth.client(DEVICE_APP_PUBLIC);
+        DeviceAuthorizationResponse response = null;
         try {
             oauth.scope("phone");
-            response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+            response = oauth.device().doDeviceAuthorizationRequest();
         } finally {
             oauth.scope(null);
         }
@@ -358,7 +364,7 @@ public void testPublicClientOptionalScope() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -368,7 +374,7 @@ public void testPublicClientOptionalScope() throws Exception {
 
         assertNotNull(token);
 
-        UserInfo userInfo = oauth.doUserInfoRequest(tokenString);
+        UserInfo userInfo = oauth.doUserInfoRequest(tokenString).getUserInfo();
         assertNotNull(userInfo);
         //UserInfo consists preferredUsername, email( required scopes) and phoneNumber(given optional scope)
         Assert.assertEquals("device-login", userInfo.getPreferredUsername());
@@ -380,12 +386,9 @@ public void testPublicClientOptionalScope() throws Exception {
     public void testPublicClientWithPKCESuccess() throws Exception {
         // Successful Device Authorization Request with PKCE from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        PkceGenerator pkce = new PkceGenerator();
-        oauth.codeChallenge(pkce.getCodeChallenge());
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(pkce.getCodeVerifier());
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+        oauth.client(DEVICE_APP_PUBLIC);
+        PkceGenerator pkce = PkceGenerator.s256();
+        DeviceAuthorizationResponse response = oauth.device().deviceAuthorizationRequest().codeChallenge(pkce).send();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -404,7 +407,7 @@ public void testPublicClientWithPKCESuccess() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().deviceTokenRequest(response.getDeviceCode()).codeVerifier(pkce.getCodeVerifier()).send();
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -419,12 +422,9 @@ public void testPublicClientWithPKCESuccess() throws Exception {
     public void testPublicClientWithPKCEFail() throws Exception {
         // Device Authorization Request with PKCE from device - device send false code_verifier
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        PkceGenerator pkce = new PkceGenerator();
-        oauth.codeChallenge(pkce.getCodeChallenge());
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(pkce.getCodeVerifier()+"a");
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+        oauth.client(DEVICE_APP_PUBLIC);
+        PkceGenerator pkce = PkceGenerator.s256();
+        DeviceAuthorizationResponse response = oauth.device().deviceAuthorizationRequest().codeChallenge(pkce).send();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -443,7 +443,7 @@ public void testPublicClientWithPKCEFail() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().deviceTokenRequest(response.getDeviceCode()).codeVerifier(pkce.getCodeVerifier()+"a").send();
 
         Assert.assertEquals(400, tokenResponse.getStatusCode());
         Assert.assertEquals("invalid_grant", tokenResponse.getError());
@@ -455,8 +455,8 @@ public void testPublicClientWithPKCEFail() throws Exception {
     public void testPublicClientCustomConsent() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC_CUSTOM_CONSENT);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC_CUSTOM_CONSENT, null);
+        oauth.client(DEVICE_APP_PUBLIC_CUSTOM_CONSENT);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -476,7 +476,7 @@ public void testPublicClientCustomConsent() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC_CUSTOM_CONSENT, null, response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -502,8 +502,8 @@ public void testPublicClientConsentWithoutScopes() throws Exception {
 
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_WITHOUT_SCOPES);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_WITHOUT_SCOPES, null);
+        oauth.client(DEVICE_APP_WITHOUT_SCOPES);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getVerificationUriComplete());
@@ -524,8 +524,8 @@ public void testNoRefreshToken() throws Exception {
         client.update(clientRepresentation);
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         // Verify user code from verification page using browser
         openVerificationPage(response.getVerificationUri());
@@ -538,8 +538,7 @@ public void testNoRefreshToken() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret",
-            response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
 
@@ -554,8 +553,8 @@ public void testNoRefreshToken() throws Exception {
     public void testConsentCancel() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -578,7 +577,7 @@ public void testConsentCancel() throws Exception {
 
         verificationPage.assertDeniedPage();
  
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(400, tokenResponse.getStatusCode());
         Assert.assertEquals("access_denied", tokenResponse.getError());
@@ -588,8 +587,8 @@ public void testConsentCancel() throws Exception {
     public void testInvalidUserCode() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -610,8 +609,8 @@ public void testExpiredUserCodeTest() throws Exception {
         getTestingClient().testing().setTestingInfinispanTimeService();
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -637,8 +636,8 @@ public void testExpiredUserCodeTest() throws Exception {
     public void testInvalidDeviceCode() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -660,7 +659,7 @@ public void testInvalidDeviceCode() throws Exception {
         grantPage.accept();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", "x");
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest("x");
 
         Assert.assertEquals(400, tokenResponse.getStatusCode());
         Assert.assertEquals("invalid_grant", tokenResponse.getError());
@@ -670,8 +669,8 @@ public void testInvalidDeviceCode() throws Exception {
     public void testSuccessVerificationUriComplete() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -695,7 +694,7 @@ public void testSuccessVerificationUriComplete() throws Exception {
         verificationPage.assertApprovedPage();
 
         // Token request from device
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
         Assert.assertEquals(200, tokenResponse.getStatusCode());
     }
@@ -705,8 +704,8 @@ public void testExpiredDeviceCode() throws Exception {
         getTestingClient().testing().setTestingInfinispanTimeService();
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -719,8 +718,7 @@ public void testExpiredDeviceCode() throws Exception {
         try {
             setTimeOffset(610);
             // Token request from device
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret",
-                response.getDeviceCode());
+            AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("invalid_grant", tokenResponse.getError());
@@ -733,8 +731,8 @@ public void testExpiredDeviceCode() throws Exception {
     @Test
     public void testDuplicatedRequestParams() throws Exception {
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP_PUBLIC);
-        OAuthClient.DeviceAuthorizationResponse response = doDeviceAuthorizationWithDuplicatedParams(DEVICE_APP_PUBLIC, null);
+        oauth.client(DEVICE_APP_PUBLIC);
+        DeviceAuthorizationResponse response = doDeviceAuthorizationWithDuplicatedParams(DEVICE_APP_PUBLIC, null);
         
         Assert.assertEquals(400, response.getStatusCode());
         Assert.assertEquals("invalid_grant", response.getError());
@@ -748,8 +746,8 @@ public void testDeviceCodeLifespanPerClient() throws Exception {
         ClientRepresentation clientRepresentation = client.toRepresentation();
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -763,21 +761,21 @@ public void testDeviceCodeLifespanPerClient() throws Exception {
         clientRepresentation.getAttributes().put(OAuth2DeviceConfig.OAUTH2_DEVICE_POLLING_INTERVAL_PER_CLIENT, "600000");
         client.update(clientRepresentation);
 
-        response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        response = oauth.device().doDeviceAuthorizationRequest();
         Assert.assertEquals(120, response.getExpiresIn());
-        OAuthClient.AccessTokenResponse tokenResponse;
+        AccessTokenResponse tokenResponse;
 
         try {
             setTimeOffset(100);
             // Token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("authorization_pending", tokenResponse.getError());
 
             setTimeOffset(125);
             // Token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("expired_token", tokenResponse.getError());
@@ -798,8 +796,8 @@ public void testDevicePollingIntervalPerClient() throws Exception {
         ClientRepresentation clientRepresentation = client.toRepresentation();
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -812,19 +810,18 @@ public void testDevicePollingIntervalPerClient() throws Exception {
         clientRepresentation.getAttributes().put(OAuth2DeviceConfig.OAUTH2_DEVICE_POLLING_INTERVAL_PER_CLIENT, "10");
         client.update(clientRepresentation);
 
-        response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        response = oauth.device().doDeviceAuthorizationRequest();
         Assert.assertEquals(10, response.getInterval());
 
         try {
             // Token request from device
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret",
-                response.getDeviceCode());
+            AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("authorization_pending", tokenResponse.getError());
 
             // Token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("slow_down", tokenResponse.getError());
@@ -832,7 +829,7 @@ public void testDevicePollingIntervalPerClient() throws Exception {
             setTimeOffset(7);
 
             // Token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("slow_down", tokenResponse.getError());
@@ -840,7 +837,7 @@ public void testDevicePollingIntervalPerClient() throws Exception {
             setTimeOffset(10);
 
             // Token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("authorization_pending", tokenResponse.getError());
@@ -861,21 +858,21 @@ public void testPolling() throws Exception {
             getAdminClient().realm(REALM_NAME).update(realm);
             // Device Authorization Request from device
             oauth.realm(REALM_NAME);
-            oauth.clientId(DEVICE_APP);
-            OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+            oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+            DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
             Assert.assertEquals(600, response.getExpiresIn());
             Assert.assertEquals(5, response.getInterval());
 
             // Polling token request from device
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Not approved yet
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             Assert.assertEquals("authorization_pending", tokenResponse.getError());
 
             // Polling again without waiting
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Slow down
             Assert.assertEquals(400, tokenResponse.getStatusCode());
@@ -885,7 +882,7 @@ public void testPolling() throws Exception {
             setTimeOffset(5);
 
             // Polling again
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Not approved yet
             Assert.assertEquals(400, tokenResponse.getStatusCode());
@@ -896,13 +893,13 @@ public void testPolling() throws Exception {
             getAdminClient().realm(REALM_NAME).update(realm);
 
             // Checking the new interval is applied
-            response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+            response = oauth.device().doDeviceAuthorizationRequest();
 
             Assert.assertEquals(600, response.getExpiresIn());
             Assert.assertEquals(10, response.getInterval());
 
             // Polling token request from device
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Not approved yet
             Assert.assertEquals(400, tokenResponse.getStatusCode());
@@ -912,7 +909,7 @@ public void testPolling() throws Exception {
             setTimeOffset(10);
 
             // Polling again without waiting
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Slow down
             Assert.assertEquals(400, tokenResponse.getStatusCode());
@@ -922,7 +919,7 @@ public void testPolling() throws Exception {
             setTimeOffset(15);
 
             // Polling again
-            tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP, "secret", response.getDeviceCode());
+            tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
 
             // Not approved yet
             Assert.assertEquals(400, tokenResponse.getStatusCode());
@@ -961,8 +958,8 @@ public void testUpdateConfig() {
     public void testConsentCancelCannotBeReused() throws Exception {
         // Device Authorization Request from device
         oauth.realm(REALM_NAME);
-        oauth.clientId(DEVICE_APP);
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP, "secret");
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(200, response.getStatusCode());
         assertNotNull(response.getDeviceCode());
@@ -989,11 +986,52 @@ public void testConsentCancelCannotBeReused() throws Exception {
         verificationPage.assertInvalidUserCodePage();
     }
 
+    @Test
+    public void testConsentCancelCannotBeReusedAfterBackClicked() throws Exception {
+        // Device Authorization Request from device
+        oauth.realm(REALM_NAME);
+        oauth.client(DEVICE_APP, DEVICE_APP_SECRET);
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
+
+        Assert.assertEquals(200, response.getStatusCode());
+        assertNotNull(response.getDeviceCode());
+        assertNotNull(response.getUserCode());
+        assertNotNull(response.getVerificationUri());
+        assertNotNull(response.getVerificationUriComplete());
+        Assert.assertEquals(60, response.getExpiresIn());
+        Assert.assertEquals(5, response.getInterval());
+
+        openVerificationPage(response.getVerificationUriComplete());
+        loginPage.assertCurrent();
+
+        // Do Login
+        oauth.fillLoginForm("device-login", "password");
+
+        // Consent
+        grantPage.assertCurrent();
+        grantPage.cancel();
+
+        //click back after cancel
+        driver.navigate().back();
+
+        // Accept consent
+        grantPage.assertCurrent();
+        grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
+        grantPage.accept();
+
+        verificationPage.assertDeniedPage();
+
+        AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest(response.getDeviceCode());
+
+        Assert.assertEquals(400, tokenResponse.getStatusCode());
+        Assert.assertEquals("access_denied", tokenResponse.getError());
+    }
+
     @Test
     public void testNotFoundClient() throws Exception {
         oauth.realm(REALM_NAME);
-        oauth.clientId("test-device-public2");
-        OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest("test-device-public2", null);
+        oauth.client("test-device-public2");
+        DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
 
         Assert.assertEquals(401, response.getStatusCode());
         Assert.assertEquals(Errors.INVALID_CLIENT, response.getError());
@@ -1007,10 +1045,10 @@ public void testClientWithErrors() throws Exception {
             clientRepresentation.getAttributes().put(OAuth2DeviceConfig.OAUTH2_DEVICE_AUTHORIZATION_GRANT_ENABLED, "false");
             client.update(clientRepresentation);
             oauth.realm(REALM_NAME);
-            oauth.clientId(DEVICE_APP_PUBLIC);
+            oauth.client(DEVICE_APP_PUBLIC);
 
             //DeviceAuthorizationGrant not enabled
-            OAuthClient.DeviceAuthorizationResponse response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+            DeviceAuthorizationResponse response = oauth.device().doDeviceAuthorizationRequest();
             Assert.assertEquals(400, response.getStatusCode());
             Assert.assertEquals(Errors.UNAUTHORIZED_CLIENT, response.getError());
             Assert.assertEquals("Client is not allowed to initiate OAuth 2.0 Device Authorization Grant. The flow is disabled for the client.", response.getErrorDescription());
@@ -1020,7 +1058,7 @@ public void testClientWithErrors() throws Exception {
             client.update(clientRepresentation);
 
             //BearerOnly client
-            response = oauth.doDeviceAuthorizationRequest(DEVICE_APP_PUBLIC, null);
+            response = oauth.device().doDeviceAuthorizationRequest();
             Assert.assertEquals(403, response.getStatusCode());
             Assert.assertEquals(Errors.UNAUTHORIZED_CLIENT, response.getError());
             Assert.assertEquals("Bearer-only applications are not allowed to initiate browser login.", response.getErrorDescription());
@@ -1037,7 +1075,7 @@ public void testClientWithErrors() throws Exception {
     @Test
     public void ensureDeviceFlowConfigPresentWhenDeviceFlowIsEnabled() {
 
-        OIDCConfigurationRepresentation oidcConfigRep = oauth.doWellKnownRequest(REALM_NAME);
+        OIDCConfigurationRepresentation oidcConfigRep = oauth.doWellKnownRequest();
         Assert.assertNotNull("deviceAuthorizationEndpoint should be not null", oidcConfigRep.getDeviceAuthorizationEndpoint());
         Assert.assertNotNull("mtlsEndpointAliases.deviceAuthorizationEndpoint should be not null", oidcConfigRep.getMtlsEndpointAliases().getDeviceAuthorizationEndpoint());
     }
@@ -1052,19 +1090,17 @@ public void ensureDeviceFlowConfigNotPresentWhenDeviceFlowIsDisabled() throws Ex
         testingClient.disableFeature(Profile.Feature.DEVICE_FLOW);
 
         try {
-            OIDCConfigurationRepresentation oidcConfigRep = oauth.doWellKnownRequest(REALM_NAME);
+            OIDCConfigurationRepresentation oidcConfigRep = oauth.doWellKnownRequest();
             Assert.assertNull("deviceAuthorizationEndpoint should be null", oidcConfigRep.getDeviceAuthorizationEndpoint());
             Assert.assertNull("mtlsEndpointAliases.deviceAuthorizationEndpoint should be null", oidcConfigRep.getMtlsEndpointAliases().getDeviceAuthorizationEndpoint());
 
-            try (var httpClient = oauth.getHttpClient().get()) {
-                Assert.assertEquals("Should return not found for device auth endpoint"
-                        , (long) 404
-                        , (long) httpClient.execute(new HttpGet(oauth.getDeviceAuthorizationUrl()), r -> r.getStatusLine().getStatusCode()));
+            try (CloseableHttpResponse response = oauth.httpClient().get().execute(new HttpGet(oauth.getEndpoints().getDeviceAuthorization()))) {
+                Assert.assertEquals("Should return not found for device auth endpoint", 404, response.getStatusLine().getStatusCode());
             }
 
             oauth.realm(REALM_NAME);
-            oauth.clientId(DEVICE_APP_PUBLIC);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doDeviceTokenRequest(DEVICE_APP_PUBLIC, null, "dummy");
+            oauth.client(DEVICE_APP_PUBLIC);
+            AccessTokenResponse tokenResponse = oauth.device().doDeviceTokenRequest("dummy");
             Assert.assertEquals(OAuthErrorException.UNSUPPORTED_GRANT_TYPE, tokenResponse.getError());
         } finally {
             testingClient.resetFeature(Profile.Feature.DEVICE_FLOW);
@@ -1075,9 +1111,9 @@ private void openVerificationPage(String verificationUri) {
         driver.navigate().to(verificationUri);
     }
 
-    private OAuthClient.DeviceAuthorizationResponse doDeviceAuthorizationWithDuplicatedParams(String clientId, String clientSecret) throws Exception {
+    private DeviceAuthorizationResponse doDeviceAuthorizationWithDuplicatedParams(String clientId, String clientSecret) throws Exception {
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getDeviceAuthorizationUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getDeviceAuthorization());
 
             List<NameValuePair> parameters = new LinkedList<>();
             if (clientSecret != null) {
@@ -1093,7 +1129,7 @@ private OAuthClient.DeviceAuthorizationResponse doDeviceAuthorizationWithDuplica
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
 
-            return new OAuthClient.DeviceAuthorizationResponse(client.execute(post));
+            return new DeviceAuthorizationResponse(client.execute(post));
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2OnlyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2OnlyTest.java
index e53a2174db30..fa78c38e11ca 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2OnlyTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuth2OnlyTest.java
@@ -38,7 +38,8 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import static org.junit.Assert.assertEquals;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
@@ -86,13 +87,6 @@ private final void trimRedirectUris(ClientRepresentation testApp) {
     @Before
     public void clientConfiguration() {
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").directAccessGrant(true);
-        /*
-         * Configure the default client ID. Seems like OAuthClient is keeping the state of clientID
-         * For example: If some test case configure oauth.clientId("sample-public-client"), other tests
-         * will fail and the clientID will always be "sample-public-client
-         * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
-         */
-        oauth.init(driver);
         oauth.openid(false);
     }
 
@@ -100,15 +94,15 @@ public void clientConfiguration() {
     // If scope=openid is missing, IDToken won't be present
     @Test
     public void testMissingIDToken() {
-        String loginFormUrl = oauth.getLoginFormUrl();
+        String loginFormUrl = oauth.loginForm().build();
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.SCOPE);
 
         driver.navigate().to(loginFormUrl);
         oauth.fillLoginForm("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         // IDToken is not there
         Assert.assertEquals(200, response.getStatusCode());
@@ -119,7 +113,7 @@ public void testMissingIDToken() {
         Assert.assertEquals(token.getSubject(), loginEvent.getUserId());
 
         // Refresh and assert idToken still not present
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         Assert.assertEquals(200, response.getStatusCode());
         Assert.assertNull(response.getIdToken());
 
@@ -131,7 +125,7 @@ public void testMissingIDToken() {
     // If scope=openid is missing, IDToken won't be present
     @Test
     public void testMissingScopeOpenidInResourceOwnerPasswordCredentialRequest() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(200, response.getStatusCode());
 
@@ -149,7 +143,7 @@ public void testMissingScopeOpenidInResourceOwnerPasswordCredentialRequest() thr
     @Test
     public void testMissingRedirectUri() throws Exception {
         // OAuth2 login without redirect_uri. It will be allowed.
-        String loginFormUrl = oauth.getLoginFormUrl();
+        String loginFormUrl = oauth.loginForm().build();
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.SCOPE);
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.REDIRECT_URI);
 
@@ -159,8 +153,8 @@ public void testMissingRedirectUri() throws Exception {
         events.expectLogin().assertEvent();
 
         // Client 'more-uris-client' has 2 redirect uris. OAuth2 login without redirect_uri won't be allowed
-        oauth.clientId("more-uris-client");
-        loginFormUrl = oauth.getLoginFormUrl();
+        oauth.client("more-uris-client");
+        loginFormUrl = oauth.loginForm().build();
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.SCOPE);
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.REDIRECT_URI);
 
@@ -183,8 +177,7 @@ public void testMissingRedirectUri() throws Exception {
     @Test
     public void testMissingNonceInOAuth2ImplicitFlow() throws Exception {
         oauth.responseType("token");
-        oauth.nonce(null);
-        String loginFormUrl = oauth.getLoginFormUrl();
+        String loginFormUrl = oauth.loginForm().nonce(null).build();
         loginFormUrl = ActionURIUtils.removeQueryParamFromURI(loginFormUrl, OAuth2Constants.SCOPE);
 
         driver.navigate().to(loginFormUrl);
@@ -192,7 +185,7 @@ public void testMissingNonceInOAuth2ImplicitFlow() throws Exception {
         oauth.fillLoginForm("test-user@localhost", "password");
         events.expectLogin().assertEvent();
 
-        OAuthClient.AuthorizationEndpointResponse response = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse response = oauth.parseLoginResponse();
         Assert.assertNull(response.getError());
         Assert.assertNull(response.getCode());
         Assert.assertNull(response.getIdToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthDanceClientSessionExtensionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthDanceClientSessionExtensionTest.java
index 48af505eec9c..e80cb105b970 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthDanceClientSessionExtensionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthDanceClientSessionExtensionTest.java
@@ -25,7 +25,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.List;
 
@@ -59,26 +59,16 @@ public void doOauthDanceWithClientSessionStateAndHost() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        String clientSessionState = "1234";
-        String clientSessionHost = "test-client-host";
-
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.clientSessionState(clientSessionState)
-                .clientSessionHost(clientSessionHost)
-                .doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         String refreshTokenString = tokenResponse.getRefreshToken();
 
         EventRepresentation tokenEvent = events.expectCodeToToken(codeId, sessionId)
                 .assertEvent();
 
-
-        String updatedClientSessionState = "5678";
-
-        oauth.clientSessionState(updatedClientSessionState)
-                .clientSessionHost(clientSessionHost)
-                .doRefreshTokenRequest(refreshTokenString, "password");
+        oauth.doRefreshTokenRequest(refreshTokenString);
 
         events.expectRefresh(tokenEvent.getDetails().get(Details.REFRESH_TOKEN_ID), sessionId)
                 .assertEvent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthGrantTest.java
index 894e068be726..2ee10dc748ef 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthGrantTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthGrantTest.java
@@ -21,7 +21,6 @@
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.ClientScopeResource;
 import org.keycloak.admin.client.resource.RealmResource;
@@ -44,7 +43,7 @@
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ProtocolMapperUtil;
 import org.keycloak.testsuite.util.AccountHelper;
 import org.openqa.selenium.By;
@@ -97,15 +96,15 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
 
     @Test
     public void oauthGrantAcceptTest() {
-        oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.client(THIRD_PARTY_APP, "password");
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
 
         grantPage.accept();
 
-        Assert.assertTrue(oauth.getCurrentQuery().containsKey(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation loginEvent = events.expectLogin()
                 .client(THIRD_PARTY_APP)
@@ -114,7 +113,7 @@ public void oauthGrantAcceptTest() {
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
         String sessionId = loginEvent.getSessionId();
 
-        OAuthClient.AccessTokenResponse accessToken = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get(OAuth2Constants.CODE), "password");
+        AccessTokenResponse accessToken = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
 
         String tokenString = accessToken.getAccessToken();
         Assert.assertNotNull(tokenString);
@@ -143,15 +142,14 @@ public void oauthGrantAcceptTest() {
     @Test
     public void oauthGrantCancelTest() {
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
 
         grantPage.cancel();
 
-        Assert.assertTrue(oauth.getCurrentQuery().containsKey(OAuth2Constants.ERROR));
-        assertEquals("access_denied", oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
+        assertEquals("access_denied", oauth.parseLoginResponse().getError());
 
         events.expectLogin()
                 .client(THIRD_PARTY_APP)
@@ -165,7 +163,7 @@ public void oauthGrantCancelTest() {
     public void oauthGrantNotShownWhenAlreadyGranted() throws IOException {
         // Grant permissions on grant screen
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         grantPage.assertCurrent();
         grantPage.accept();
@@ -206,7 +204,7 @@ public void oauthGrantNotShownWhenAlreadyGranted() throws IOException {
     public void oauthGrantAddAnotherScope() throws IOException {
         // Grant permissions on grant screen
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         // Create new clientScope and add to client
         RealmResource appRealm = adminClient.realm(REALM_NAME);
@@ -278,7 +276,7 @@ public void oauthGrantScopeParamRequired() throws Exception {
 
         // Assert clientScope not on grant screen when not requested
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
         grantPage.assertCurrent();
         List<String> grants = grantPage.getDisplayedGrants();
         Assert.assertFalse(grants.contains("foo-scope"));
@@ -292,7 +290,7 @@ public void oauthGrantScopeParamRequired() throws Exception {
                 .assertEvent();
 
         oauth.scope("foo-scope");
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
         grantPage.assertCurrent();
         grants = grantPage.getDisplayedGrants();
         Assert.assertTrue(grants.contains("foo-scope"));
@@ -350,15 +348,14 @@ public void oauthGrantDynamicScopeParamRequired() throws IOException {
                 .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
                 .assertEvent();
 
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
 
         events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), loginEvent.getSessionId())
                 .client(THIRD_PARTY_APP)
                 .assertEvent();
 
-        String logoutUrl = oauth.getLogoutUrl().idTokenHint(res.getIdToken()).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().idTokenHint(res.getIdToken()).open();
 
         events.expectLogout(loginEvent.getSessionId()).client(THIRD_PARTY_APP).removeDetail(Details.REDIRECT_URI).assertEvent();
 
@@ -412,7 +409,7 @@ public void oauthGrantClientScopeMappers() throws Exception {
 
         // Login
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT, "foo-addr");
         grantPage.accept();
@@ -455,7 +452,7 @@ public void oauthGrantClientScopeMappers() throws Exception {
     @Test
     public void oauthGrantExpiredAuthSession() throws Exception {
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         grantPage.assertCurrent();
 
@@ -491,7 +488,7 @@ public void oauthGrantOrderedClientScopes() throws Exception {
 
         // Display consent screen --- assert email, then profile
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         grantPage.assertCurrent();
         List<String> displayedScopes = grantPage.getDisplayedGrants();
@@ -521,14 +518,14 @@ public void oauthGrantOrderedClientScopes() throws Exception {
     public void oauthGrantUserNotLoggedOutAfterConsentRevoke() throws Exception {
         // Login
         oauth.clientId(THIRD_PARTY_APP);
-        oauth.doLoginGrant(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+        oauth.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
 
         // Confirm consent screen
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
         grantPage.accept();
 
-        Assert.assertTrue(oauth.getCurrentQuery().containsKey(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         EventRepresentation loginEvent = events.expectLogin()
                 .client(THIRD_PARTY_APP)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java
index 2a89d9d2c23a..a3faed0e26d9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java
@@ -26,7 +26,8 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 import jakarta.ws.rs.core.UriBuilder;
 import java.security.MessageDigest;
@@ -68,7 +69,7 @@ public void clientConfiguration() {
          * will faile and the clientID will always be "sample-public-client
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
     }
 
     @Override
@@ -98,9 +99,9 @@ public void accessTokenRequestWithoutPKCE() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, null);
     }
 
     @Test
@@ -108,21 +109,17 @@ public void accessTokenRequestInPKCEValidS256CodeChallengeMethod() throws Except
     	// test case : success : A-1-2
     	String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
     	String codeChallenge = generateS256CodeChallenge(codeVerifier);
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+
+        oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        
-        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, codeVerifier);
     }
 
     @Test
@@ -130,21 +127,17 @@ public void accessTokenRequestInPKCEUnmatchedCodeVerifierWithS256CodeChallengeMe
     	// test case : failure : A-1-5
     	String codeVerifier = "1234567890123456789012345678901234567890123";
     	String codeChallenge = codeVerifier;
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+
+        oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -157,41 +150,31 @@ public void accessTokenRequestInPKCEUnmatchedCodeVerifierWithS256CodeChallengeMe
     
     public void accessTokenRequestInPKCEValidPlainCodeChallengeMethod() throws Exception {
     	// test case : success : A-1-3
-    	oauth.codeChallenge(".234567890-234567890~234567890_234567890123");
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().codeChallenge(".234567890-234567890~234567890_234567890123", OAuth2Constants.PKCE_METHOD_PLAIN).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        
-        oauth.codeVerifier(".234567890-234567890~234567890_234567890123");
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, ".234567890-234567890~234567890_234567890123");
     }
 
     @Test
     public void accessTokenRequestInPKCEUnmachedCodeVerifierWithPlainCodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-6
-    	oauth.codeChallenge("1234567890123456789012345678901234567890123");
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().codeChallenge("1234567890123456789012345678901234567890123", OAuth2Constants.PKCE_METHOD_PLAIN).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        
-        oauth.codeVerifier("aZ_-.~1234567890123456789012345678901234567890123Za");
+        String code = oauth.parseLoginResponse().getCode();
         
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier("aZ_-.~1234567890123456789012345678901234567890123Za").send();
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -204,31 +187,24 @@ public void accessTokenRequestInPKCEUnmachedCodeVerifierWithPlainCodeChallengeMe
     
     public void accessTokenRequestInPKCEValidDefaultCodeChallengeMethod() throws Exception {
     	// test case : success : A-1-4
-    	oauth.codeChallenge("1234567890123456789012345678901234567890123");
-    	
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().codeChallenge("1234567890123456789012345678901234567890123", null).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier("1234567890123456789012345678901234567890123");
-        
-        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+        expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, "1234567890123456789012345678901234567890123");
     }
     
     @Test
     public void accessTokenRequestInPKCEWithoutCodeChallengeWithValidCodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-7
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().codeChallenge(null, OAuth2Constants.PKCE_METHOD_PLAIN).open();
     	
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -240,13 +216,9 @@ public void accessTokenRequestInPKCEWithoutCodeChallengeWithValidCodeChallengeMe
     @Test
     public void accessTokenRequestInPKCEInvalidUnderCodeChallengeWithS256CodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-8
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	oauth.codeChallenge("ABCDEFGabcdefg1234567ABCDEFGabcdefg1234567"); // 42
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().codeChallenge("ABCDEFGabcdefg1234567ABCDEFGabcdefg1234567", OAuth2Constants.PKCE_METHOD_S256).open();
     	
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -258,14 +230,9 @@ public void accessTokenRequestInPKCEInvalidUnderCodeChallengeWithS256CodeChallen
     @Test
     public void accessTokenRequestInPKCEInvalidOverCodeChallengeWithPlainCodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-9
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-    	oauth.codeChallenge("3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~123456789"); // 129
-
-    	UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().codeChallenge("3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~123456789", OAuth2Constants.PKCE_METHOD_PLAIN).open();
     	
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -280,21 +247,16 @@ public void accessTokenRequestInPKCEInvalidUnderCodeVerifierWithS256CodeChalleng
     	String codeVerifier = "ABCDEFGabcdefg1234567ABCDEFGabcdefg1234567"; // 42
     	String codeChallenge = generateS256CodeChallenge(codeVerifier);
 
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -308,21 +270,17 @@ public void accessTokenRequestInPKCEInvalidOverCodeVerifierWithS256CodeChallenge
     	// test case : success : A-1-11
     	String codeVerifier = "3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~3fRc92kac_keic8c7al-3ncbdoaie.DDeizlck3~123456789"; // 129
     	String codeChallenge = generateS256CodeChallenge(codeVerifier);
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+
+        oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -334,21 +292,16 @@ public void accessTokenRequestInPKCEInvalidOverCodeVerifierWithS256CodeChallenge
     @Test
     public void accessTokenRequestInPKCEWIthoutCodeVerifierWithS256CodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-12
-    	String codeVerifier = "1234567890123456789012345678901234567890123";
-    	String codeChallenge = codeVerifier;
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().codeChallenge("1234567890123456789012345678901234567890123", OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
        
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -360,16 +313,9 @@ public void accessTokenRequestInPKCEWIthoutCodeVerifierWithS256CodeChallengeMeth
     @Test
     public void accessTokenRequestInPKCEInvalidCodeChallengeWithS256CodeChallengeMethod() throws Exception {
     	// test case : failure : A-1-13
-    	String codeVerifier = "1234567890123456789=12345678901234567890123";
-    	String codeChallenge = codeVerifier;
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-    	UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        
-        driver.navigate().to(b.build().toURL());
+    	oauth.loginForm().codeChallenge("1234567890123456789=12345678901234567890123", OAuth2Constants.PKCE_METHOD_S256).open();
     	
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -383,21 +329,17 @@ public void accessTokenRequestInPKCEInvalidCodeVerifierWithS256CodeChallengeMeth
     	// test case : failure : A-1-14
     	String codeVerifier = "123456789.123456789-123456789~1234$6789_123";
     	String codeChallenge = generateS256CodeChallenge(codeVerifier);
-    	oauth.codeChallenge(codeChallenge);
-    	oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-    	
-        oauth.doLogin("test-user@localhost", "password");
+
+        oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.codeVerifier(codeVerifier);
-        
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
         
         assertEquals(400, response.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
@@ -411,8 +353,6 @@ public void accessTokenRequestInPKCECodeVerifierWithNoCodeChallenge() throws Exc
         String codeVerifier = "12345678e01234567890g2345678h012a4567j90123"; // 43
 
         // send oauth request without code_challenge because intercepted
-        oauth.codeChallenge(null);
-        oauth.codeChallengeMethod(null);
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
@@ -420,9 +360,8 @@ public void accessTokenRequestInPKCECodeVerifierWithNoCodeChallenge() throws Exc
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
         // get the code and add codeVerifier
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.codeVerifier(codeVerifier);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
 
         // assert invalid code because no challenge in authorization
         assertEquals(400, response.getStatusCode());
@@ -440,15 +379,15 @@ private String generateS256CodeChallenge(String codeVerifier) throws Exception {
         return codeChallenge;
     }
  
-    private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String sessionId, String code)  throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+    private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String sessionId, String code, String codeVerifier)  throws Exception {
+        AccessTokenResponse response = oauth.accessTokenRequest(code).codeVerifier(codeVerifier).send();
 
         assertEquals(200, response.getStatusCode());
         assertThat(response.getExpiresIn(), allOf(greaterThanOrEqualTo(250), lessThanOrEqualTo(300)));
         assertThat(response.getRefreshExpiresIn(), allOf(greaterThanOrEqualTo(1750), lessThanOrEqualTo(1800)));
         assertEquals("Bearer", response.getTokenType());
 
-        String expectedKid = Stream.of(oauth.doCertsRequest("test").getKeys())
+        String expectedKid = Stream.of(oauth.keys().getRealmKeys().getKeys())
                 .filter(jwk -> KeyUse.SIG.getSpecName().equals(jwk.getPublicKeyUse()))
                 .map(JWK::getKeyId)
                 .findFirst().orElseThrow(() -> new AssertionError("Was not able to find key with usage SIG in the 'test' realm keys"));
@@ -500,7 +439,7 @@ private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String ses
 
         setTimeOffset(2);
 
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString);
         
         AccessToken refreshedToken = oauth.verifyToken(refreshResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshResponse.getRefreshToken());
@@ -552,21 +491,17 @@ public void accessTokenRequestValidS256CodeChallengeMethodPkceEnforced() throws
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
             String codeVerifier = "1a345A7890123456r8901c3456789012b45K7890l23"; // 43
             String codeChallenge = generateS256CodeChallenge(codeVerifier);
-            oauth.codeChallenge(codeChallenge);
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
 
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-
-            oauth.codeVerifier(codeVerifier);
+            String code = oauth.parseLoginResponse().getCode();
 
-            expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+            expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, codeVerifier);
         } finally {
             setPkceActivationSettings("test-app", null);
         }
@@ -582,21 +517,17 @@ public void accessTokenRequestValidPlainCodeChallengeMethodPkceEnforced() throws
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_PLAIN);
             String codeVerifier = "12E45r78901d3456789G12y45G78901234B67v901u3"; // 43
             String codeChallenge = codeVerifier;
-            oauth.codeChallenge(codeChallenge);
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
 
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_PLAIN).doLogin("test-user@localhost", "password");
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            oauth.codeVerifier(codeVerifier);
-
-            expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code);
+            expectSuccessfulResponseFromTokenEndpoint(codeId, sessionId, code, codeVerifier);
         } finally {
             setPkceActivationSettings("test-app", null);
         }
@@ -608,14 +539,10 @@ public void accessTokenRequestCodeChallengeMethodMismatchPkceEnforced() throws E
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
             String codeVerifier = "12345678e01234567890g2345678h012a4567j90123"; // 43
             String codeChallenge = generateS256CodeChallenge(codeVerifier);
-            oauth.codeChallenge(codeChallenge);
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_PLAIN);
-
-            UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
 
-            driver.navigate().to(b.build().toURL());
+            oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_PLAIN).open();
 
-            OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
             Assert.assertTrue(errorResponse.isRedirected());
             Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -633,13 +560,10 @@ public void accessTokenRequestCodeChallengeMethodMissingPkceEnforced() throws Ex
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
             String codeVerifier = "1234567890123456789012345678901234567890123"; // 43
             String codeChallenge = generateS256CodeChallenge(codeVerifier);
-            oauth.codeChallenge(codeChallenge);
-
-            UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
 
-            driver.navigate().to(b.build().toURL());
+            oauth.loginForm().codeChallenge(codeChallenge, null).open();
 
-            OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
             Assert.assertTrue(errorResponse.isRedirected());
             Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -656,13 +580,10 @@ public void accessTokenRequestCodeChallengeMethodMissingPkceEnforced() throws Ex
     public void accessTokenRequestCodeChallengeMissingPkceEnforced() throws Exception {
         try {
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
 
-            UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
+            oauth.loginForm().codeChallenge(null, OAuth2Constants.PKCE_METHOD_S256).open();
 
-            driver.navigate().to(b.build().toURL());
-
-            OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
             Assert.assertTrue(errorResponse.isRedirected());
             Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -679,14 +600,10 @@ public void accessTokenRequestCodeChallengeMissingPkceEnforced() throws Exceptio
     public void accessTokenRequestInvalidCodeChallengePkceEnforced() throws Exception {
         try {
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
-            oauth.codeChallenge("invalid");
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-
-            UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
 
-            driver.navigate().to(b.build().toURL());
+            oauth.loginForm().codeChallenge("invalid", OAuth2Constants.PKCE_METHOD_S256).open();
 
-            OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
 
             Assert.assertTrue(errorResponse.isRedirected());
             Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
@@ -705,19 +622,17 @@ public void accessTokenRequestWithoutCodeVerifierPkceEnforced() throws Exception
             setPkceActivationSettings("test-app", OAuth2Constants.PKCE_METHOD_S256);
             String codeVerifier = "1234567890123456789012345678901234567890123";
             String codeChallenge = generateS256CodeChallenge(codeVerifier);
-            oauth.codeChallenge(codeChallenge);
-            oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
 
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().codeChallenge(codeChallenge, OAuth2Constants.PKCE_METHOD_S256).doLogin("test-user@localhost", "password");
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
             assertEquals(400, response.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_GRANT, response.getError());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriStateTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriStateTest.java
index db410d5e71a5..6d6c3285ac8a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriStateTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriStateTest.java
@@ -26,7 +26,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 public class OAuthRedirectUriStateTest extends AbstractTestRealmKeycloakTest {
 
@@ -38,13 +38,10 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     public void clientConfiguration() {
         oauth.clientId("test-app");
         oauth.responseType(OIDCResponseType.CODE);
-        oauth.stateParamRandom();
     }
 
     void assertStateReflected(String state) {
-        oauth.stateParamHardcoded(state);
-
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state(state).doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
 
         URL url;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriTest.java
index 251f362f11fb..78310b52fcde 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthRedirectUriTest.java
@@ -44,7 +44,9 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 
 import java.io.IOException;
@@ -56,7 +58,7 @@
 import static org.junit.Assert.assertEquals;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
-import static org.keycloak.testsuite.util.OAuthClient.APP_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.APP_ROOT;
 
 /**
  * @author <a href="mailto:vrockai@redhat.com">Viliam Rockai</a>
@@ -240,7 +242,7 @@ public void testNoValidUris() throws IOException {
     @Test
     public void testValid() throws IOException {
         oauth.redirectUri(APP_ROOT + "/auth");
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
 
         Assert.assertNotNull(response.getCode());
         URL url = new URL(driver.getCurrentUrl());
@@ -261,7 +263,7 @@ public void testInvalid() throws IOException {
     @Test
     public void testWithParams() throws IOException {
         oauth.redirectUri(APP_ROOT + "/auth?key=value");
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
 
         Assert.assertNotNull(response.getCode());
         URL url = new URL(driver.getCurrentUrl());
@@ -273,11 +275,11 @@ public void testWithParams() throws IOException {
 
     @Test
     public void testWithFragment() throws IOException {
-        oauth.clientId("test-fragment");
+        oauth.client("test-fragment");
         oauth.responseMode("fragment");
 
         oauth.redirectUri(APP_ROOT + "/auth#key=value");
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
 
         Assert.assertNotNull(response.getCode());
         URL url = new URL(driver.getCurrentUrl());
@@ -287,7 +289,7 @@ public void testWithFragment() throws IOException {
 
     @Test
     public void testWithCustomScheme() throws IOException {
-        oauth.clientId("custom-scheme");
+        oauth.client("custom-scheme");
 
         oauth.redirectUri("android-app://org.keycloak.examples.cordova/https/keycloak-cordova-example.github.io/login");
         oauth.openLoginForm();
@@ -317,7 +319,7 @@ public void testWithCustomScheme() throws IOException {
     @Test
     public void testQueryComponents() throws IOException {
         // KEYCLOAK-3420
-        oauth.clientId("test-query-component");
+        oauth.client("test-query-component");
         checkRedirectUri("http://localhost?foo=bar", true);
         checkRedirectUri("http://localhost?foo=bara", false);
         checkRedirectUri("http://localhost?foo=bar/", false);
@@ -330,13 +332,13 @@ public void testQueryComponents() throws IOException {
         checkRedirectUri("http://localhost", false);
 
         // KEYCLOAK-3418
-        oauth.clientId("test-installed");
+        oauth.client("test-installed");
         checkRedirectUri("http://localhost?foo=bar", false);
     }
 
     @Test
     public void testWildcard() throws IOException {
-        oauth.clientId("test-wildcard");
+        oauth.client("test-wildcard", "password");
         checkRedirectUri("http://example.com", false);
         checkRedirectUri("http://localhost:8080", false, true);
         checkRedirectUri("http://example.com/foo", true);
@@ -367,20 +369,20 @@ public void testWildcard() throws IOException {
     // Client "Valid Redirect URL" is configured for exact match with supplied redirect-url
     @Test
     public void testRedirectUriWithEncodedPath() throws IOException {
-        oauth.clientId("test-encoded-path");
+        oauth.client("test-encoded-path", "password");
         checkRedirectUri("http://localhost:8280/foo/bar%20bar%2092%2F72/3", true, true);
     }
 
     @Test
     public void testDash() throws IOException {
-        oauth.clientId("test-dash");
+        oauth.client("test-dash");
 
         checkRedirectUri("http://with-dash.example.local/foo", true);
     }
 
     @Test
     public void testDifferentCaseInHostname() throws IOException {
-        oauth.clientId("test-dash");
+        oauth.client("test-dash");
 
         checkRedirectUri("http://with-dash.example.local", true);
         checkRedirectUri("http://wiTh-dAsh.example.local", false);
@@ -394,7 +396,7 @@ public void testDifferentCaseInHostname() throws IOException {
 
     @Test
     public void testDifferentCaseInScheme() throws IOException {
-        oauth.clientId("test-dash");
+        oauth.client("test-dash");
 
         checkRedirectUri("http://with-dash.example.local", true);
         checkRedirectUri("HTTP://with-dash.example.local", false);
@@ -403,7 +405,7 @@ public void testDifferentCaseInScheme() throws IOException {
 
     @Test
     public void testRelativeWithRoot() throws IOException {
-        oauth.clientId("test-root-url");
+        oauth.client("test-root-url");
 
         checkRedirectUri("http://with-dash.example.local/foo", true);
         checkRedirectUri("http://localhost:8180/foo", false);
@@ -411,7 +413,7 @@ public void testRelativeWithRoot() throws IOException {
 
     @Test
     public void testRelative() throws IOException {
-        oauth.clientId("test-relative-url");
+        oauth.client("test-relative-url");
 
         checkRedirectUri("http://with-dash.example.local/foo", false);
         checkRedirectUri(OAuthClient.AUTH_SERVER_ROOT, true);
@@ -419,7 +421,7 @@ public void testRelative() throws IOException {
 
     @Test
     public void testLocalhost() throws IOException {
-        oauth.clientId("test-installed");
+        oauth.client("test-installed", "password");
 
         checkRedirectUri("urn:ietf:wg:oauth:2.0:oob", true, true);
         checkRedirectUri("http://localhost", true);
@@ -429,7 +431,7 @@ public void testLocalhost() throws IOException {
         checkRedirectUri("http://localhosts", false);
         checkRedirectUri("http://localhost/myapp", false);
         checkRedirectUri("http://localhost:8180/myapp", false, true);
-        oauth.clientId("test-installed2");
+        oauth.client("test-installed2", "password");
 
         checkRedirectUri("http://localhost/myapp", true);
         checkRedirectUri("http://localhost:8280/myapp", true, true);
@@ -441,7 +443,7 @@ public void testLocalhost() throws IOException {
 
     @Test
     public void testLoopback() throws IOException {
-        oauth.clientId("test-installed-loopback");
+        oauth.client("test-installed-loopback", "password");
 
         checkRedirectUri("http://127.0.0.1", true);
         checkRedirectUri("http://127.0.0.1:8280", true, true);
@@ -449,7 +451,7 @@ public void testLoopback() throws IOException {
         checkRedirectUri("http://127.0.0.1/myapp", false);
         checkRedirectUri("http://127.0.0.1:8180/myapp", false, true);
 
-        oauth.clientId("test-installed-loopback2");
+        oauth.client("test-installed-loopback2", "password");
 
         checkRedirectUri("http://127.0.0.1/myapp", true);
         checkRedirectUri("http://127.0.0.1:8280/myapp", true, true);
@@ -460,15 +462,15 @@ public void testLoopback() throws IOException {
 
     @Test
     public void okThenNull() throws IOException {
-        oauth.clientId("test-wildcard");
+        oauth.client("test-wildcard", "password");
         oauth.redirectUri("http://localhost:8280/foo");
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         Assert.assertNotNull(code);
         oauth.redirectUri(null);
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         Assert.assertEquals("Expected 400, but got something else", 400, tokenResponse.getStatusCode());
     }
@@ -495,7 +497,7 @@ private void checkRedirectUri(String redirectUri, boolean expectValid, boolean c
             } else {
                 oauth.doLogin("test-user@localhost", "password");
 
-                String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+                String code = oauth.parseLoginResponse().getCode();
                 Assert.assertNotNull(code);
 
                 // Test that browser URL where Keycloak redirected user matches with the used redirectUri
@@ -513,11 +515,11 @@ private void checkRedirectUri(String redirectUri, boolean expectValid, boolean c
                 }
 
                 oauth.redirectUri(redirectUri);
-                OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+                AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
                 Assert.assertEquals("Expected success, but got error: " + tokenResponse.getError(), 200, tokenResponse.getStatusCode());
 
-                oauth.doLogout(tokenResponse.getRefreshToken(), "password");
+                oauth.doLogout(tokenResponse.getRefreshToken());
             }
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthScopeInTokenResponseTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthScopeInTokenResponseTest.java
index e3d28cc9aed2..6514626b34d3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthScopeInTokenResponseTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthScopeInTokenResponseTest.java
@@ -14,7 +14,6 @@
 
 import org.junit.Assert;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.admin.client.resource.ClientResource;
 import org.keycloak.admin.client.resource.ClientsResource;
@@ -26,7 +25,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.admin.ApiUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 //OIDC Financial API Read Only Profile : scope MUST be returned in the response from Token Endpoint
 public class OAuthScopeInTokenResponseTest extends AbstractKeycloakTest {
@@ -47,14 +46,14 @@ public void specifyNoScopeTest() throws Exception {
         String loginUser = "john-doh@localhost";
         String loginPassword = "password";
         String clientSecret = "password";
-        
+
     	String expectedScope = "openid profile email";
     	
         oauth.doLogin(loginUser, loginPassword);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope, clientSecret);
+        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope);
     }
     
     @Test
@@ -69,9 +68,9 @@ public void specifyEmptyScopeTest() throws Exception {
     	oauth.scope(requestedScope);
         oauth.doLogin(loginUser, loginPassword);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope, clientSecret);
+        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope);
     }
 
     @Test
@@ -105,14 +104,14 @@ public void failCodeNotExistingScope() throws Exception {
 
         oauth.scope("phone");
         oauth.doLogin(loginUser, loginPassword);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        expectSuccessfulResponseFromTokenEndpoint(code, "phone", clientSecret);
+        String code = oauth.parseLoginResponse().getCode();
+        expectSuccessfulResponseFromTokenEndpoint(code, "phone");
 
-        oauth.openLogout();
+        oauth.openLogoutForm();
         oauth.scope(null);
         oauth.doLogin(loginUser, loginPassword);
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        expectSuccessfulResponseFromTokenEndpoint(code, "", clientSecret);
+        code = oauth.parseLoginResponse().getCode();
+        expectSuccessfulResponseFromTokenEndpoint(code, "");
 
         for (ClientScopeRepresentation scope : scopes) {
             client.addDefaultClientScope(scope.getId());
@@ -123,7 +122,6 @@ public void failCodeNotExistingScope() throws Exception {
     public void failTokenNotExistingScope() throws Exception {
         String loginUser = "john-doh@localhost";
         String loginPassword = "password";
-        String clientSecret = "password";
 
         ClientsResource clients = realmsResouce().realm("test").clients();
         ClientRepresentation clientRep = clients.findByClientId(oauth.getClientId()).get(0);
@@ -139,19 +137,19 @@ public void failTokenNotExistingScope() throws Exception {
 
         oauth.openid(false);
         oauth.scope("user phone");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(clientSecret, loginUser, loginPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(loginUser, loginPassword);
         
         assertNotNull(response.getError());
         assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
 
         oauth.scope("user");
-        response = oauth.doGrantAccessTokenRequest(clientSecret, loginUser, loginPassword);
+        response = oauth.doPasswordGrantRequest(loginUser, loginPassword);
 
         assertNotNull(response.getError());
         assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
 
         oauth.scope(null);
-        response = oauth.doGrantAccessTokenRequest(clientSecret, loginUser, loginPassword);
+        response = oauth.doPasswordGrantRequest(loginUser, loginPassword);
 
         assertNotNull(response.getAccessToken());
 
@@ -172,9 +170,9 @@ public void specifyMultipleScopeTest() throws Exception {
     	oauth.scope(requestedScope);
         oauth.doLogin(loginUser, loginPassword);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope, clientSecret);
+        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope);
     }
 
     @Test
@@ -201,9 +199,9 @@ public void specifyMultipleExistingScopesTest() throws Exception {
     	oauth.scope(requestedScope);
         oauth.doLogin(loginUser, loginPassword);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         
-        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope, clientSecret);
+        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope);
 
         // Login with 'user' scope
         requestedScope = "user address phone";
@@ -212,16 +210,16 @@ public void specifyMultipleExistingScopesTest() throws Exception {
         oauth.scope(requestedScope);
         oauth.doLogin(loginUser, loginPassword);
 
-        code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        code = oauth.parseLoginResponse().getCode();
 
-        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope, clientSecret);
+        expectSuccessfulResponseFromTokenEndpoint(code, expectedScope);
 
         // Cleanup
         ApiUtil.findClientResourceByClientId(realmsResouce().realm("test"), "test-app").removeOptionalClientScope(userScopeId);
     }
     
-    private void expectSuccessfulResponseFromTokenEndpoint(String code, String expectedScope, String clientSecret) throws Exception {
-    	OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, clientSecret);
+    private void expectSuccessfulResponseFromTokenEndpoint(String code, String expectedScope) throws Exception {
+    	AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertEquals(200, response.getStatusCode());
         log.info("expectedScopes = " + expectedScope);
         log.info("receivedScopes = " + response.getScope());
@@ -229,6 +227,6 @@ private void expectSuccessfulResponseFromTokenEndpoint(String code, String expec
     	Collection<String> receivedScopes = Arrays.asList(response.getScope().split(" "));
     	Assert.assertTrue(expectedScopes.containsAll(receivedScopes) && receivedScopes.containsAll(expectedScopes));
 
-        oauth.doLogout(response.getRefreshToken(), clientSecret);
+        oauth.doLogout(response.getRefreshToken());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
index 66717415b000..d7ee40d24f8b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
@@ -48,24 +48,23 @@
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.representations.userprofile.config.UPConfig;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.forms.VerifyProfileTest;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.updaters.ProtocolMappersUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.ProtocolMapperUtil;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.userprofile.UserProfileUtil;
 
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
@@ -124,11 +123,11 @@ public void clientConfiguration() {
          * will faile and the clientID will always be "sample-public-client
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
 
         // enable user profile unmanaged attributes
         UserProfileResource upResource = adminClient.realm("test").users().userProfile();
-        VerifyProfileTest.enableUnmanagedAttributes(upResource);
+        UserProfileUtil.enableUnmanagedAttributes(upResource);
     }
 
 
@@ -171,7 +170,7 @@ public void testTokenScriptMapping() throws Exception {
             response.close();
         }
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
             assertEquals("hello_test-user@localhost", accessToken.getOtherClaims().get("computed-via-script"));
@@ -242,7 +241,7 @@ public void testTokenMapping() throws Exception {
         }
 
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getAddress());
@@ -321,7 +320,7 @@ public void testTokenMapping() throws Exception {
             assertEquals(3, multiClaim.size());
             assertThat(multiClaim, containsInAnyOrder("abc", "bcd", "cde"));
 
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
         }
 
         // undo mappers
@@ -352,7 +351,7 @@ public void testTokenMapping() throws Exception {
 
 
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNull(idToken.getAddress());
             assertNull(idToken.getOtherClaims().get("home_phone"));
@@ -360,7 +359,7 @@ public void testTokenMapping() throws Exception {
             assertNull(idToken.getOtherClaims().get("nested"));
             assertNull(idToken.getOtherClaims().get("department"));
 
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
         }
 
 
@@ -384,7 +383,7 @@ public void testTokenPropertiesMapping() throws Exception {
         app.getProtocolMappers().createMapper(createHardcodedClaim("iat-hardcoded", "iat", "123", "long", true, false, true)).close();
 
         // login
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+        AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
         // assert mappers work as expected
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
@@ -418,7 +417,7 @@ public void testTokenPropertiesMapping() throws Exception {
         }
 
         // logout
-        oauth.openLogout();
+        oauth.openLogoutForm();
 
         // undo mappers
         app = findClientByClientId(adminClient.realm("test"), "test-app");
@@ -463,8 +462,8 @@ public void testClaimFromUserPropertyMapperWithOptionalProfileScope() {
 
             oauth.scope(SCOPE_PROFILE);
 
-            OAuthClient.AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin("test-user@localhost", "password");
-            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzEndpointResponse.getCode(), "password");
+            AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin("test-user@localhost", "password");
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzEndpointResponse.getCode());
 
             assertTrue(tokenResponse.getScope().contains("profile"));
 
@@ -510,8 +509,8 @@ public void testClaimFromUserPropertyMapperWithDefaultProfileScope() {
 
             oauth.scope(SCOPE_PROFILE);
 
-            OAuthClient.AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin("test-user@localhost", "password");
-            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzEndpointResponse.getCode(), "password");
+            AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin("test-user@localhost", "password");
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzEndpointResponse.getCode());
 
             assertTrue(tokenResponse.getScope().contains("profile"));
 
@@ -544,7 +543,7 @@ public void testNullOrEmptyTokenMapping() throws Exception {
         }
 
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             Object empty = idToken.getOtherClaims().get("empty");
@@ -553,7 +552,7 @@ public void testNullOrEmptyTokenMapping() throws Exception {
             assertNull(nulll);
 
             oauth.verifyToken(response.getAccessToken());
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
         }
 
         // undo mappers
@@ -572,13 +571,13 @@ public void testNullOrEmptyTokenMapping() throws Exception {
         events.clear();
 
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNull(idToken.getAddress());
             assertNull(idToken.getOtherClaims().get("empty"));
             assertNull(idToken.getOtherClaims().get("null"));
 
-            oauth.idTokenHint(response.getIdToken()).openLogout();
+            oauth.logoutForm().idTokenHint(response.getIdToken()).open();
         }
         events.clear();
     }
@@ -596,7 +595,7 @@ public void testUserRoleToAttributeMappers() throws Exception {
         protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
 
         // Login user
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+        AccessTokenResponse response = browserLogin("test-user@localhost", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -649,7 +648,7 @@ public void testUserRolesMovedFromAccessTokenProperties() throws Exception {
         resp.close();
 
         try {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
             // Assert roles are not on their original positions
@@ -692,7 +691,7 @@ public void testRolesAndAllowedOriginsRemovedFromAccessToken() throws Exception
         testApp.removeDefaultClientScope(rolesScope.getId());
 
         try {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
             // Assert web origins are not in the token
@@ -732,7 +731,7 @@ public void testUserRoleToAttributeMappersWithMultiValuedRoles() throws Exceptio
         protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
 
         // Login user
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+        AccessTokenResponse response = browserLogin("test-user@localhost", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -777,7 +776,7 @@ public void testUserRoleToAttributeMappersWithFullScopeDisabled() throws Excepti
         protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
 
         // Login user
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+        AccessTokenResponse response = browserLogin("test-user@localhost", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -822,8 +821,8 @@ public void testRoleMapperWithRoleInheritedFromMoreGroups() throws Exception {
         UserResource level2GroupUser = ApiUtil.findUserByUsernameId(adminClient.realm("test"), "level2GroupUser");
         level2GroupUser.joinGroup(level2Group2.getId());
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "level2GroupUser", "password");
+        oauth.client(clientId, "password");
+        AccessTokenResponse response = browserLogin("level2GroupUser", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled AND it is filled only once
@@ -852,7 +851,7 @@ public void testUserGroupRoleToAttributeMappers() throws Exception {
         protocolMappers.createMapper(Arrays.asList(realmMapper, clientMapper));
 
         // Login user
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+        AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -889,12 +888,12 @@ public void testUserGroupRoleToAttributeMappersNotScopedOtherApp() throws Except
 
         // Login user
         ClientManager.realm(adminClient.realm("test")).clientId(clientId).directAccessGrant(true);
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
 
         String oldRedirectUri = oauth.getRedirectUri();
         oauth.redirectUri(UriUtils.getOrigin(oldRedirectUri) + "/test-app-authz");
 
-        OAuthClient.AccessTokenResponse response = browserLogin("secret", "rich.roles@redhat.com", "password");
+        AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // revert redirect_uri
@@ -929,8 +928,8 @@ public void testUserGroupRoleToAttributeMappersScoped() throws Exception {
 
         // Login user
         ClientManager.realm(adminClient.realm("test")).clientId(clientId).directAccessGrant(true);
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+        oauth.client(clientId, "password");
+        AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -963,8 +962,8 @@ public void testUserGroupRoleToAttributeMappersScopedClientNotSet() throws Excep
 
         // Login user
         ClientManager.realm(adminClient.realm("test")).clientId(clientId).directAccessGrant(true);
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+        oauth.client(clientId, "password");
+        AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -999,8 +998,8 @@ public void testSingleValuedRoleMapping() throws Exception {
 
         // Login user
         ClientManager.realm(adminClient.realm("test")).clientId(clientId).directAccessGrant(true);
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+        oauth.client(clientId, "password");
+        AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
         // Verify attribute is filled
@@ -1037,8 +1036,8 @@ public void testUserGroupRoleToAttributeMappersScopedWithDifferentClient() throw
             protocolMappers.add(realmMapper, clientMapper).update();
 
             // Login user
-            oauth.clientId(clientId);
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+            oauth.client(clientId, "password");
+            AccessTokenResponse response = browserLogin("rich.roles@redhat.com", "password");
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
             // Verify attribute is filled
@@ -1081,7 +1080,7 @@ public void testGroupAttributeUserOneGroupNoMultivalueNoAggregate() throws Excep
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1121,7 +1120,7 @@ public void testGroupAttributeUserOneGroupMultivalueNoAggregate() throws Excepti
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1162,7 +1161,7 @@ public void testGroupAttributeUserOneGroupMultivalueAggregate() throws Exception
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1201,7 +1200,7 @@ public void testGroupAttributeOneGroupNoMultivalueNoAggregate() throws Exception
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1236,7 +1235,7 @@ public void testGroupAttributeOneGroupMultiValueNoAggregate() throws Exception {
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1272,7 +1271,7 @@ public void testGroupAttributeOneGroupMultiValueAggregate() throws Exception {
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1315,7 +1314,7 @@ public void testGroupAttributeTwoGroupNoMultivalueNoAggregate() throws Exception
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1360,7 +1359,7 @@ public void testGroupAttributeTwoGroupMultiValueNoAggregate() throws Exception {
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1407,7 +1406,7 @@ public void testGroupAttributeTwoGroupMultiValueAggregate() throws Exception {
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1458,7 +1457,7 @@ public void testGroupAttributeTwoGroupHierarchyNoMultivalueNoAggregateFromParent
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1507,7 +1506,7 @@ public void testGroupAttributeTwoGroupHierarchyNoMultivalueNoAggregateFromChild(
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1556,7 +1555,7 @@ public void testGroupAttributeTwoGroupHierarchyMultiValueNoAggregate() throws Ex
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1610,7 +1609,7 @@ public void testGroupAttributeTwoGroupHierarchyMultiValueAggregate() throws Exce
 
         try {
             // test it
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             IDToken idToken = oauth.verifyIDToken(response.getIdToken());
             assertNotNull(idToken.getOtherClaims());
@@ -1691,7 +1690,7 @@ public void testHardcodeRoleAll() throws Exception {
 
         // check that the hardcoded mappers are in the three responses
         try {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             // check hardcoded roles in access token
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -1747,7 +1746,7 @@ public void testRoleNameMapperAll() throws Exception {
 
         // check that the role mappers are executed in the three responses
         try {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
 
             // check mapped roles are in access token and not the original ones
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
@@ -1807,7 +1806,7 @@ public void executeTokenMappersOnDynamicScopes() {
         }
 
         oauth.scope("openid dyn-scope-with-mapper:value");
-        OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+        AccessTokenResponse response = browserLogin("test-user@localhost", "password");
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
@@ -1834,9 +1833,9 @@ private void assertSingleValuedRolesString(String actualRoleString, String... ex
         assertThat(actualRoleString, is(in(expectedRoles)));
     }
 
-    private OAuthClient.AccessTokenResponse browserLogin(String clientSecret, String username, String password) {
-        OAuthClient.AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin(username, password);
-        return oauth.doAccessTokenRequest(authzEndpointResponse.getCode(), clientSecret);
+    private AccessTokenResponse browserLogin(String username, String password) {
+        AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin(username, password);
+        return oauth.doAccessTokenRequest(authzEndpointResponse.getCode());
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenMigrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenMigrationTest.java
index 93fa9f015041..1c1cfc96c873 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenMigrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenMigrationTest.java
@@ -40,7 +40,7 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.runonserver.FetchOnServer;
 import org.keycloak.testsuite.runonserver.FetchOnServerWrapper;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
 
 /**
@@ -93,9 +93,9 @@ public void testOfflineTokenMigrationFromKeycloak14() throws Exception {
     private void testOfflineTokenMigration(OfflineTokenConverter offlineTokenConverter) throws Exception {
         // Send request to obtain offline token
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         Assert.assertNull(tokenResponse.getErrorDescription());
         String offlineTokenString = tokenResponse.getRefreshToken();
 
@@ -117,7 +117,7 @@ public Class<String> getResultClass() {
         getLogger().infof("Modified offline token: %s", modifiedOfflineToken);
 
         // Check it is possible to successfully refresh with the modified offline token
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(modifiedOfflineToken, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(modifiedOfflineToken);
         AccessToken refreshedToken = oauth.verifyToken(response.getAccessToken());
         Assert.assertEquals(200, response.getStatusCode());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenTest.java
index 1e8ff5607d9e..1939b8774c2c 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OfflineTokenTest.java
@@ -17,7 +17,6 @@
 
 package org.keycloak.testsuite.oauth;
 
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Before;
@@ -47,6 +46,7 @@
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.SessionTimeoutHelper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.RefreshToken;
 import org.keycloak.representations.idm.ClientRepresentation;
@@ -64,13 +64,14 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.AccountHelper;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
 import org.keycloak.testsuite.utils.tls.TLSUtils;
 import org.keycloak.util.TokenUtil;
 
@@ -96,11 +97,10 @@
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsernameId;
 import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
-import static org.keycloak.testsuite.util.OAuthClient.APP_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.APP_ROOT;
 import static org.keycloak.testsuite.util.ServerURLs.getAuthServerContextRoot;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -185,7 +185,7 @@ public void offlineTokenDisabledForClient() throws Exception {
 
 
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
         oauth.openLoginForm();
         assertTrue(driver.getCurrentUrl().contains("error_description=Invalid+scopes"));
@@ -202,7 +202,7 @@ public void offlineTokenUserNotAllowed() throws Exception {
         String userId = findUserByUsername(adminClient.realm("test"), "keycloak-user@localhost").getId();
 
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
         oauth.doLogin("keycloak-user@localhost", "password");
 
@@ -215,9 +215,9 @@ public void offlineTokenUserNotAllowed() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         assertEquals(400, tokenResponse.getStatusCode());
         assertEquals("not_allowed", tokenResponse.getError());
@@ -233,7 +233,7 @@ public void offlineTokenUserNotAllowed() throws Exception {
     @Test
     public void offlineTokenBrowserFlow() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
         oauth.doLogin("test-user@localhost", "password");
 
@@ -245,9 +245,9 @@ public void offlineTokenBrowserFlow() throws Exception {
         final String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
         RefreshToken offlineToken = oauth.parseRefreshToken(offlineTokenString);
@@ -260,6 +260,11 @@ public void offlineTokenBrowserFlow() throws Exception {
         assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, offlineToken.getType());
         Assert.assertNull(offlineToken.getExp());
 
+        AccessTokenContext ctx = testingClient.testing("test").getTokenContext(token.getId());
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.OFFLINE);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR);
+        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.AUTHORIZATION_CODE);
+
         assertTrue(tokenResponse.getScope().contains(OAuth2Constants.OFFLINE_ACCESS));
 
         // check only offline session is created
@@ -270,7 +275,7 @@ public void offlineTokenBrowserFlow() throws Exception {
         // Change offset to very big value to ensure offline session expires
         setTimeOffset(3000000);
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(newRefreshTokenString, "secret1");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(newRefreshTokenString);
         RefreshToken newRefreshToken = oauth.parseRefreshToken(newRefreshTokenString);
         Assert.assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
@@ -289,7 +294,7 @@ public void offlineTokenBrowserFlow() throws Exception {
     public void onlineOfflineTokenBrowserFlow() throws Exception {
         // request an online token for the client
         oauth.scope(null);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
         oauth.doLogin("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin()
@@ -298,7 +303,7 @@ public void onlineOfflineTokenBrowserFlow() throws Exception {
                 .assertEvent();
         final String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.getCurrentQuery().get(OAuth2Constants.CODE), "secret1");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
         RefreshToken onlineToken = assertRefreshToken(tokenResponse, TokenUtil.TOKEN_TYPE_REFRESH);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         events.expectCodeToToken(codeId, sessionId)
@@ -309,13 +314,13 @@ public void onlineOfflineTokenBrowserFlow() throws Exception {
         Assert.assertNotNull(onlineToken.getExp());
         // request an offline token for the same client
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.doSilentLogin();
+        oauth.openLoginForm();
         events.expectLogin()
                 .client("offline-client")
                 .detail(Details.REDIRECT_URI, offlineClientAppUri)
                 .assertEvent();
-        OAuthClient.AccessTokenResponse tokenOfflineResponse = oauth.doAccessTokenRequest(
-                oauth.getCurrentQuery().get(OAuth2Constants.CODE), "secret1");
+        AccessTokenResponse tokenOfflineResponse = oauth.doAccessTokenRequest(
+                oauth.parseLoginResponse().getCode());
         RefreshToken offlineToken = assertRefreshToken(tokenOfflineResponse, TokenUtil.TOKEN_TYPE_OFFLINE);
         events.expectCodeToToken(codeId, sessionId)
                 .client("offline-client")
@@ -327,7 +332,7 @@ public void onlineOfflineTokenBrowserFlow() throws Exception {
         // check both sessions are created
         checkNumberOfSessions(userId, "offline-client", onlineToken.getSessionId(), 1, 1);
         // check online token can be refreshed
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertRefreshToken(tokenResponse, TokenUtil.TOKEN_TYPE_REFRESH);
         events.expectRefresh(token.getId(), sessionId)
                 .client("offline-client")
@@ -336,7 +341,7 @@ public void onlineOfflineTokenBrowserFlow() throws Exception {
                 .detail(Details.REFRESH_TOKEN_ID, onlineToken.getId())
                 .assertEvent();
         // check offline token can be refreshed
-        tokenOfflineResponse = oauth.doRefreshTokenRequest(tokenOfflineResponse.getRefreshToken(), "secret1");
+        tokenOfflineResponse = oauth.doRefreshTokenRequest(tokenOfflineResponse.getRefreshToken());
         assertRefreshToken(tokenOfflineResponse, TokenUtil.TOKEN_TYPE_OFFLINE);
         events.expectRefresh(token.getId(), sessionId)
                 .client("offline-client")
@@ -361,9 +366,13 @@ private String testRefreshWithOfflineToken(AccessToken oldToken, RefreshToken of
             // Ignore
         }
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString, "secret1");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString);
         AccessToken refreshedToken = oauth.verifyToken(response.getAccessToken());
         Assert.assertEquals(200, response.getStatusCode());
+        AccessTokenContext ctx = testingClient.testing("test").getTokenContext(refreshedToken.getId());
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.OFFLINE);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR);
+        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.REFRESH_TOKEN);
 
         // Assert new refreshToken in the response
         String newRefreshToken = response.getRefreshToken();
@@ -409,8 +418,8 @@ private void checkNumberOfSessions(String userId, String clientId, String sessio
     @Test
     public void offlineTokenDirectGrantFlow() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         Assert.assertNull(tokenResponse.getErrorDescription());
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -448,8 +457,8 @@ public void offlineTokenDirectGrantFlowWithRefreshTokensRevoked() throws Excepti
         RealmManager.realm(adminClient.realm("test")).revokeRefreshToken(true);
 
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -476,7 +485,7 @@ public void offlineTokenDirectGrantFlowWithRefreshTokensRevoked() throws Excepti
         RefreshToken offlineToken2 = oauth.parseRefreshToken(offlineTokenString2);
 
         // Assert second refresh with same refresh token will fail
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString, "secret1");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(offlineTokenString);
         Assert.assertEquals(400, response.getStatusCode());
         events.expectRefresh(offlineToken.getId(), token.getSessionState())
                 .client("offline-client")
@@ -486,7 +495,7 @@ public void offlineTokenDirectGrantFlowWithRefreshTokensRevoked() throws Excepti
                 .assertEvent();
 
         // Refresh with new refreshToken fails as well (client session was invalidated because of attempt to refresh with revoked refresh token)
-        OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(offlineTokenString2, "secret1");
+        AccessTokenResponse response2 = oauth.doRefreshTokenRequest(offlineTokenString2);
         Assert.assertEquals(400, response2.getStatusCode());
         events.expectRefresh(offlineToken2.getId(), offlineToken2.getSessionState())
                 .client("offline-client")
@@ -501,8 +510,8 @@ public void offlineTokenDirectGrantFlowWithRefreshTokensRevoked() throws Excepti
     @Test
     public void offlineTokenServiceAccountFlow() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -527,7 +536,7 @@ public void offlineTokenServiceAccountFlow() throws Exception {
         testRefreshWithOfflineToken(token, offlineToken, offlineTokenString, token.getSessionId(), serviceAccountUserId);
 
         // Now retrieve another offline token and verify that previous offline token is still valid
-        tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         AccessToken token2 = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString2 = tokenResponse.getRefreshToken();
@@ -594,8 +603,8 @@ public void offlineTokenAdminRESTAccess() throws Exception {
 
         // Login with offline token now
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         events.clear();
 
@@ -606,7 +615,7 @@ public void offlineTokenAdminRESTAccess() throws Exception {
         testingClient.testing().removeExpired("test");
 
         // Refresh with the offline token
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         Assert.assertNull("received error " + tokenResponse.getError() + ", " + tokenResponse.getErrorDescription(), tokenResponse.getError());
 
         // Use accessToken to admin REST request
@@ -633,8 +642,8 @@ public void offlineTokenRemoveClientWithTokens() throws Exception {
 
         // Direct grant login requesting offline token
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client-2");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        oauth.client("offline-client-2", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         Assert.assertNull(tokenResponse.getErrorDescription());
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
@@ -686,58 +695,58 @@ public void offlineTokenRemoveClientWithTokens() throws Exception {
     @Test
     public void offlineTokenLogout() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, response.getStatusCode());
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(200, response.getStatusCode());
 
-        CloseableHttpResponse logoutResponse = oauth.doLogout(response.getRefreshToken(), "secret1");
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        LogoutResponse logoutResponse = oauth.doLogout(response.getRefreshToken());
+        assertTrue(logoutResponse.isSuccess());
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
     }
 
     @Test
     public void onlineOfflineTokenLogout() throws Exception {
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
 
         // create online session
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, response.getStatusCode());
 
         // assert refresh token
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(200, response.getStatusCode());
 
         // create offline session
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        OAuthClient.AccessTokenResponse offlineResponse = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password");
+        AccessTokenResponse offlineResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, offlineResponse.getStatusCode());
 
         // assert refresh offline token
-        OAuthClient.AccessTokenResponse offlineRefresh = oauth.doRefreshTokenRequest(offlineResponse.getRefreshToken(), "secret1");
+        AccessTokenResponse offlineRefresh = oauth.doRefreshTokenRequest(offlineResponse.getRefreshToken());
         assertEquals(200, offlineRefresh.getStatusCode());
 
         // logout online session
-        CloseableHttpResponse logoutResponse = oauth.scope(null).doLogout(response.getRefreshToken(), "secret1");
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        LogoutResponse logoutResponse = oauth.scope(null).doLogout(response.getRefreshToken());
+        assertTrue(logoutResponse.isSuccess());
 
         // assert the online session is gone
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
 
         // assert the offline token refresh still works
-        offlineRefresh = oauth.doRefreshTokenRequest(offlineResponse.getRefreshToken(), "secret1");
+        offlineRefresh = oauth.doRefreshTokenRequest(offlineResponse.getRefreshToken());
         assertEquals(200, offlineRefresh.getStatusCode());
     }
 
     @Test
     public void browserOfflineTokenLogoutFollowedByLoginSameSession() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
         oauth.doLogin("test-user@localhost", "password");
 
@@ -749,9 +758,9 @@ public void browserOfflineTokenLogoutFollowedByLoginSameSession() throws Excepti
         final String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString = tokenResponse.getRefreshToken();
         RefreshToken offlineToken = oauth.parseRefreshToken(offlineTokenString);
@@ -768,9 +777,8 @@ public void browserOfflineTokenLogoutFollowedByLoginSameSession() throws Excepti
                 session.sessions().getOfflineUserSession(session.realms().getRealmByName("test"), offlineToken.getSessionState()).getId(), String.class);
 
         // logout offline session
-        try (CloseableHttpResponse logoutResponse = oauth.doLogout(offlineTokenString, "secret1")) {
-            assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
-        }
+        LogoutResponse logoutResponse = oauth.doLogout(offlineTokenString);
+        assertTrue(logoutResponse.isSuccess());
         events.expectLogout(offlineUserSessionId)
                 .client("offline-client")
                 .removeDetail(Details.REDIRECT_URI)
@@ -778,9 +786,9 @@ public void browserOfflineTokenLogoutFollowedByLoginSameSession() throws Excepti
 
         // Need to login again now
         oauth.doLogin("test-user@localhost", "password");
-        String code2 = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code2 = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code2, "secret1");
+        AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code2);
         assertEquals(200, tokenResponse2.getStatusCode());
         oauth.verifyToken(tokenResponse2.getAccessToken());
         String offlineTokenString2 = tokenResponse2.getRefreshToken();
@@ -863,41 +871,41 @@ public void offlineTokenReauthenticationWhenOfflinClientSessionExpired() throws
 
             // Step 1 - online login with "tets-app"
             oauth.scope(null);
-            oauth.clientId("test-app");
+            oauth.client("test-app", "password");
             oauth.redirectUri(APP_ROOT + "/auth");
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertRefreshToken(tokenResponse, TokenUtil.TOKEN_TYPE_REFRESH);
 
             // Step 2 - offline login with "offline-client"
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
 
-            oauth.doSilentLogin();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            oauth.openLoginForm();
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertOfflineToken(tokenResponse);
 
             // Step 3 - set some offset to refresh SSO session and offline user session. But use different client, so that we don't refresh offlineClientSession of client "offline-client"
             setTimeOffset(800);
-            oauth.clientId("test-app");
+            oauth.client("test-app", "password");
             oauth.redirectUri(APP_ROOT + "/auth");
             oauth.openLoginForm();
 
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertOfflineToken(tokenResponse);
 
             // Step 4 - set bigger time offset and login with the original client "offline-token". Login should be successful and offline client session for "offline-client" should be re-created now
             setTimeOffset(900 + SessionTimeoutHelper.PERIODIC_CLEANER_IDLE_TIMEOUT_WINDOW_SECONDS + 20);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.openLoginForm();
 
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertOfflineToken(tokenResponse);
 
         } finally {
@@ -906,12 +914,12 @@ public void offlineTokenReauthenticationWhenOfflinClientSessionExpired() throws
         }
     }
 
-    private RefreshToken assertOfflineToken(OAuthClient.AccessTokenResponse tokenResponse) {
+    private RefreshToken assertOfflineToken(AccessTokenResponse tokenResponse) {
         return assertRefreshToken(tokenResponse, TokenUtil.TOKEN_TYPE_OFFLINE);
     }
 
     // Asserts that refresh token in the tokenResponse is of the given type. Return parsed token
-    private RefreshToken assertRefreshToken(OAuthClient.AccessTokenResponse tokenResponse, String tokenType) {
+    private RefreshToken assertRefreshToken(AccessTokenResponse tokenResponse, String tokenType) {
         Assert.assertEquals(200, tokenResponse.getStatusCode());
         String offlineTokenString = tokenResponse.getRefreshToken();
         RefreshToken refreshToken = oauth.parseRefreshToken(offlineTokenString);
@@ -966,6 +974,22 @@ private int checkIfUserAndClientSessionExist(final String userSessionId, final S
         }, Integer.class);
     }
 
+    private void removeClientSessionStartedAtNote(final String userSessionId, final String clientId, final String clientSessionId) {
+        testingClient.server().run(session -> {
+            RealmModel realmModel = session.realms().getRealmByName("test");
+            session.getContext().setRealm(realmModel);
+            ClientModel clientModel = realmModel.getClientByClientId(clientId);
+            UserSessionModel userSession = session.sessions().getOfflineUserSession(realmModel, userSessionId);
+            if (userSession != null) {
+                AuthenticatedClientSessionModel clientSession = userSession.getAuthenticatedClientSessionByClient(clientModel.getId());
+                if (clientSession != null) {
+                    clientSession.removeNote(AuthenticatedClientSessionModel.STARTED_AT_NOTE);
+                    clientSession.removeNote(AuthenticatedClientSessionModel.USER_SESSION_STARTED_AT_NOTE);
+                }
+            }
+        });
+    }
+
     private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int offsetHalf, int offset) {
         int prev[] = null;
         getTestingClient().testing().setTestingInfinispanTimeService();
@@ -973,7 +997,7 @@ private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int off
             prev = changeOfflineSessionSettings(true, maxLifespan, idleTime, 0, 0);
 
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.doLogin("test-user@localhost", "password");
 
@@ -984,9 +1008,9 @@ private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int off
 
             final String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String offlineTokenString = tokenResponse.getRefreshToken();
             RefreshToken offlineToken = oauth.parseRefreshToken(offlineTokenString);
 
@@ -999,7 +1023,7 @@ private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int off
             // perform a refresh in the half-time
             setTimeOffset(offsetHalf);
 
-            tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString, "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString);
             AccessToken refreshedToken = oauth.verifyToken(tokenResponse.getAccessToken());
             offlineTokenString = tokenResponse.getRefreshToken();
             offlineToken = oauth.parseRefreshToken(offlineTokenString);
@@ -1010,7 +1034,7 @@ private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int off
             // wait to expire
             setTimeOffset(offset);
 
-            tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString, "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(offlineTokenString);
 
             Assert.assertEquals(400, tokenResponse.getStatusCode());
             assertEquals("invalid_grant", tokenResponse.getError());
@@ -1034,8 +1058,8 @@ private void testOfflineSessionExpiration(int idleTime, int maxLifespan, int off
 
     private void offlineTokenRequest(String expectedRefreshAlg, String expectedAccessAlg, String expectedIdTokenAlg) throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
 
        JWSHeader header = null;
        String idToken = tokenResponse.getIdToken();
@@ -1080,7 +1104,7 @@ private void offlineTokenRequest(String expectedRefreshAlg, String expectedAcces
         testRefreshWithOfflineToken(token, offlineToken, offlineTokenString, token.getSessionState(), serviceAccountUserId);
 
         // Now retrieve another offline token and decode that previous offline token is still valid
-        tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         AccessToken token2 = oauth.verifyToken(tokenResponse.getAccessToken());
         String offlineTokenString2 = tokenResponse.getRefreshToken();
@@ -1106,8 +1130,8 @@ private void offlineTokenRequestWithScopeParameter(String expectedRefreshAlg, St
         ClientScopeRepresentation phoneScope = adminClient.realm("test").clientScopes().findAll().stream().filter((ClientScopeRepresentation clientScope) ->"phone".equals(clientScope.getName())).findFirst().get();
         ClientManager.realm(adminClient.realm("test")).clientId(oauth.getClientId()).addClientScope(phoneScope.getId(),false);
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS+" phone");
-        oauth.clientId("offline-client");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("offline-client", "secret1");
+        AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         JWSHeader header = null;
         String idToken = tokenResponse.getIdToken();
@@ -1153,7 +1177,7 @@ private void offlineTokenRequestWithScopeParameter(String expectedRefreshAlg, St
     @Test
     public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
 
         int[] prev = changeOfflineSessionSettings(true, 3600, 7200, 1000, 7200);
@@ -1165,8 +1189,8 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1000);
             String clientSessionId = getOfflineClientSessionUuid(sessionId, loginEvent.getClientId());
@@ -1176,14 +1200,14 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
 
             setTimeOffset(600);
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 400);
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
             events.expectRefresh(refreshId, sessionId).client("offline-client").detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_OFFLINE).assertEvent();
 
             setTimeOffset(1100);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1200,7 +1224,7 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
     @Test
     public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
 
         int[] prev = changeOfflineSessionSettings(true, 3600, 7200, 5000, 7200);
@@ -1212,8 +1236,8 @@ public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Excepti
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3600);
             String clientSessionId = getOfflineClientSessionUuid(sessionId, loginEvent.getClientId());
@@ -1223,14 +1247,14 @@ public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Excepti
 
             setTimeOffset(1800);
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1800);
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
             events.expectRefresh(refreshId, sessionId).client("offline-client").detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_OFFLINE).assertEvent();
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1247,7 +1271,7 @@ public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Excepti
     @Test
     public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
 
         RealmResource realmResource = adminClient.realm("test");
@@ -1261,8 +1285,8 @@ public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
             String clientSessionId = getOfflineClientSessionUuid(sessionId, loginEvent.getClientId());
@@ -1275,7 +1299,7 @@ public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws
             realmResource.update(rep);
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1292,7 +1316,7 @@ public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws
     @Test
     public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("offline-client");
+        oauth.client("offline-client", "secret1");
         oauth.redirectUri(offlineClientAppUri);
 
         RealmResource realmResource = adminClient.realm("test");
@@ -1306,8 +1330,8 @@ public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() thro
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getType());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
             String clientSessionId = getOfflineClientSessionUuid(sessionId, loginEvent.getClientId());
@@ -1320,7 +1344,7 @@ public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() thro
             realmResource.update(rep);
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "secret1");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1343,15 +1367,15 @@ public void testShortOfflineSessionMax() throws Exception {
             prevSession = changeSessionSettings(1800, 300);
 
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.doLogin("test-user@localhost", "password");
 
             events.expectLogin().client("offline-client").detail(Details.REDIRECT_URI, offlineClientAppUri).assertEvent();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "secret1");
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             String offlineTokenString = tokenResponse.getRefreshToken();
             RefreshToken offlineToken = oauth.parseRefreshToken(offlineTokenString);
 
@@ -1359,10 +1383,7 @@ public void testShortOfflineSessionMax() throws Exception {
             assertThat(tokenResponse.getRefreshExpiresIn(), allOf(greaterThanOrEqualTo(29), lessThanOrEqualTo(30)));
             assertEquals(TokenUtil.TOKEN_TYPE_OFFLINE, offlineToken.getType());
 
-            String introspectionResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password",
-                tokenResponse.getAccessToken());
-            ObjectMapper objectMapper = new ObjectMapper();
-            JsonNode jsonNode = objectMapper.readTree(introspectionResponse);
+            JsonNode jsonNode = oauth.doIntrospectionAccessTokenRequest(tokenResponse.getAccessToken()).asJsonNode();
             Assert.assertEquals(true, jsonNode.get("active").asBoolean());
             Assert.assertEquals("test-user@localhost", jsonNode.get("email").asText());
             assertThat(jsonNode.get("exp").asInt() - getCurrentTime(),
@@ -1392,11 +1413,11 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionMaxLifespan);
 
@@ -1404,7 +1425,7 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "secret1");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionMaxLifespan - 100);
 
@@ -1413,7 +1434,7 @@ public void testClientOfflineSessionMaxLifespan() throws Exception {
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "secret1");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionMaxLifespan - 200);
         } finally {
@@ -1442,11 +1463,11 @@ public void testClientOfflineSessionIdleTimeout() throws Exception {
             realm.update(rep);
 
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionIdleTimeout);
 
@@ -1454,7 +1475,7 @@ public void testClientOfflineSessionIdleTimeout() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "secret1");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionIdleTimeout - 100);
 
@@ -1463,7 +1484,7 @@ public void testClientOfflineSessionIdleTimeout() throws Exception {
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "secret1");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), offlineSessionIdleTimeout - 200);
         } finally {
@@ -1481,14 +1502,14 @@ public void offlineTokenRefreshWithoutOfflineAccessScope() {
 
         try {
             oauth.scope("openid " + OAuth2Constants.OFFLINE_ACCESS);
-            oauth.clientId("offline-client");
+            oauth.client("offline-client", "secret1");
             oauth.redirectUri(offlineClientAppUri);
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "secret1");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
             oauth.scope("openid");
-            response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
             assertEquals(200, response.getStatusCode());
 
             AccessToken token = oauth.verifyToken(response.getAccessToken());
@@ -1504,4 +1525,40 @@ public void offlineTokenRefreshWithoutOfflineAccessScope() {
         }
     }
 
+    @Test
+    public void offlineRefreshWhenNoStartedAtClientNote() throws Exception {
+        int prevOfflineSession[] = null;
+        try {
+            prevOfflineSession = changeOfflineSessionSettings(true, 3600, 3600, 0, 0);
+
+            // login to obtain a refresh token
+            oauth.scope("openid " + OAuth2Constants.OFFLINE_ACCESS);
+            oauth.client("offline-client", "secret1");
+            oauth.redirectUri(offlineClientAppUri);
+            oauth.doLogin("test-user@localhost", "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+
+            EventRepresentation loginEvent = events.expectLogin()
+                    .client("offline-client")
+                    .detail(Details.REDIRECT_URI, offlineClientAppUri)
+                    .assertEvent();
+
+            // remove the started notes that can be missed in previous versions
+            String clientSessionId = getOfflineClientSessionUuid(loginEvent.getSessionId(), loginEvent.getClientId());
+            removeClientSessionStartedAtNote(loginEvent.getSessionId(), loginEvent.getClientId(), clientSessionId);
+
+            // check refresh is successful
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
+            assertEquals(200, response.getStatusCode());
+            assertTrue("Invalid ExpiresIn", 0 < response.getRefreshExpiresIn() && response.getRefreshExpiresIn() <= 3600);
+
+            // check refresh a second time
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
+            assertEquals(200, response.getStatusCode());
+            assertTrue("Invalid ExpiresIn", 0 < response.getRefreshExpiresIn() && response.getRefreshExpiresIn() <= 3600);
+        } finally {
+            changeOfflineSessionSettings(false, prevOfflineSession[0], prevOfflineSession[1], prevOfflineSession[2], prevOfflineSession[3]);
+        }
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java
index d1e6183e0fc5..5bd623763768 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/PreAuthorizedGrantTest.java
@@ -36,7 +36,8 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.UserBuilder;
 
 import java.nio.charset.StandardCharsets;
@@ -59,7 +60,7 @@ public void setup() {
     public void testPreAuthorizedGrant() throws Exception {
         String userSessionId = getUserSession();
         String preAuthorizedCode = getTestingClient().testing().getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() + 30);
-        OAuthClient.AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode);
+        AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode);
 
         assertEquals("An access token should have successfully been returned.", HttpStatus.SC_OK, accessTokenResponse.getStatusCode());
         assertEquals("The correct session should have been used for the pre-authorized code.", userSessionId, accessTokenResponse.getSessionState());
@@ -69,7 +70,7 @@ public void testPreAuthorizedGrant() throws Exception {
     public void testPreAuthorizedGrantExpired() throws Exception {
         String userSessionId = getUserSession();
         String preAuthorizedCode = getTestingClient().testing().getPreAuthorizedCode(TEST_REALM_NAME, userSessionId, "test-app", Time.currentTime() - 30);
-        OAuthClient.AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode);
+        AccessTokenResponse accessTokenResponse = postCode(preAuthorizedCode);
         assertEquals("An expired code should not get an access token.", HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode());
     }
 
@@ -77,7 +78,7 @@ public void testPreAuthorizedGrantExpired() throws Exception {
     public void testPreAuthorizedGrantInvalidCode() throws Exception {
         // assure that a session exists.
         getUserSession();
-        OAuthClient.AccessTokenResponse accessTokenResponse = postCode("invalid-code");
+        AccessTokenResponse accessTokenResponse = postCode("invalid-code");
         assertEquals("An invalid code should not get an access token.", HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode());
     }
 
@@ -91,11 +92,11 @@ public void testPreAuthorizedGrantNoCode() throws Exception {
         UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
         post.setEntity(formEntity);
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = new OAuthClient.AccessTokenResponse(httpClient.execute(post));
+        AccessTokenResponse accessTokenResponse = new AccessTokenResponse(httpClient.execute(post));
         assertEquals("If no code is provided, no access token should be returned.", HttpStatus.SC_BAD_REQUEST, accessTokenResponse.getStatusCode());
     }
 
-    private OAuthClient.AccessTokenResponse postCode(String preAuthorizedCode) throws Exception {
+    private AccessTokenResponse postCode(String preAuthorizedCode) throws Exception {
         HttpPost post = new HttpPost(getTokenEndpoint());
         List<NameValuePair> parameters = new LinkedList<>();
         parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, PreAuthorizedCodeGrantTypeFactory.GRANT_TYPE));
@@ -103,7 +104,7 @@ private OAuthClient.AccessTokenResponse postCode(String preAuthorizedCode) throw
         UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
         post.setEntity(formEntity);
 
-        return new OAuthClient.AccessTokenResponse(httpClient.execute(post));
+        return new AccessTokenResponse(httpClient.execute(post));
     }
 
     private String getTokenEndpoint() {
@@ -115,7 +116,7 @@ private String getTokenEndpoint() {
 
     private String getUserSession() {
         // create a session
-        OAuthClient.AuthorizationEndpointResponse authorizationEndpointResponse = oauth.doLogin("john", "password");
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.doLogin("john", "password");
         return authorizationEndpointResponse.getSessionState();
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java
index d03f9cb8269c..7ab2970ef8a9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RPInitiatedLogoutTest.java
@@ -79,7 +79,7 @@
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.URLUtils;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.openqa.selenium.NoSuchElementException;
@@ -134,15 +134,14 @@ public void clientConfiguration() {
     @Test
     public void logoutRedirect() {
 
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String sessionId = tokenResponse.getSessionState();
 
         String redirectUri = APP_REDIRECT_URI + "?logout";
 
         String idTokenString = tokenResponse.getIdToken();
 
-        String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).open();
 
         events.expectLogout(sessionId).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
         MatcherAssert.assertThat(false, is(isSessionActive(sessionId)));
@@ -155,8 +154,7 @@ public void logoutRedirect() {
         assertNotEquals(sessionId, sessionId2);
 
         // Test also "state" parameter is included in the URL after logout. Make sure to use idTokenHint from the last login to match with current browser session
-        logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").open();
         events.expectLogout(sessionId2).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
         MatcherAssert.assertThat(false, is(isSessionActive(sessionId2)));
         assertCurrentUrlEquals(redirectUri + "&state=something");
@@ -164,7 +162,7 @@ public void logoutRedirect() {
 
     @Test
     public void postLogoutRedirect() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String sessionId = tokenResponse.getSessionState();
 
         String redirectUri = APP_REDIRECT_URI + "?post_logout";
@@ -175,8 +173,7 @@ public void postLogoutRedirect() {
         String idTokenString = tokenResponse.getIdToken();
 
         try {
-            String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).open();
 
             events.expectLogout(sessionId).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
             MatcherAssert.assertThat(false, is(isSessionActive(sessionId)));
@@ -189,8 +186,7 @@ public void postLogoutRedirect() {
             assertNotEquals(sessionId, sessionId2);
 
             // Test also "state" parameter is included in the URL after logout. Make sure to use idTokenHint from the last login to match with current browser session
-            logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").open();
             events.expectLogout(sessionId2).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
             MatcherAssert.assertThat(false, is(isSessionActive(sessionId2)));
             assertCurrentUrlEquals(redirectUri + "&state=something");
@@ -202,15 +198,14 @@ public void postLogoutRedirect() {
 
     @Test
     public void logoutRedirectWithIdTokenHintPointToDifferentSession() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String sessionId = tokenResponse.getSessionState();
 
         String redirectUri = APP_REDIRECT_URI + "?logout";
 
         String idTokenString = tokenResponse.getIdToken();
 
-        String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).open();
 
         events.expectLogout(sessionId).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
         MatcherAssert.assertThat(false, is(isSessionActive(sessionId)));
@@ -225,8 +220,7 @@ public void logoutRedirectWithIdTokenHintPointToDifferentSession() {
         assertNotEquals(sessionId, sessionId2);
 
         // Using idTokenHint of the 1st session. Logout confirmation is needed in such case. Test also "state" parameter is included in the URL after logout
-        logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(redirectUri).idTokenHint(idTokenString).state("something").open();
         logoutConfirmPage.assertCurrent();
         logoutConfirmPage.confirmLogout();
         events.expectLogoutError(Errors.SESSION_EXPIRED);
@@ -241,14 +235,13 @@ public void logoutWithExpiredSession() throws Exception {
                 .updateWith(r -> r.setSsoSessionMaxLifespan(20))
                 .update()) {
 
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
             String idTokenString = tokenResponse.getIdToken();
 
             // expire online user session
             setTimeOffset(9999);
 
-            String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).open();
 
             // should not throw an internal server error. But no logout event is sent as nothing was logged-out
             appPage.assertCurrent();
@@ -256,7 +249,7 @@ public void logoutWithExpiredSession() throws Exception {
             MatcherAssert.assertThat(false, is(isSessionActive(tokenResponse.getSessionState())));
 
             // check if the back channel logout succeeded
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             WaitUtils.waitForPageToLoad();
             loginPage.assertCurrent();
         }
@@ -288,8 +281,7 @@ public void logoutWithRememberMe() throws IOException {
             loginPage.login(testUsername, testUserPassword);
 
             //log out
-            String logoutUrl = oauth.getLogoutUrl().build();
-            driver.navigate().to(logoutUrl);
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
 
@@ -304,7 +296,7 @@ public void logoutWithRememberMe() throws IOException {
 
     @Test
     public void logoutSessionWhenLoggedOutByAdmin() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String sessionId = tokenResponse.getSessionState();
         String idTokenString = tokenResponse.getIdToken();
 
@@ -312,8 +304,7 @@ public void logoutSessionWhenLoggedOutByAdmin() {
         MatcherAssert.assertThat(false, is(isSessionActive(sessionId)));
 
         // Try logout even if user already logged-out by admin. Should redirect back to the application, but no logout-event should be triggered
-        String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).open();
         events.expectLogoutError(Errors.SESSION_EXPIRED);
         assertCurrentUrlEquals(APP_REDIRECT_URI);
 
@@ -322,9 +313,7 @@ public void logoutSessionWhenLoggedOutByAdmin() {
         String sessionId2 = tokenResponse.getSessionState();
         idTokenString = tokenResponse.getIdToken();
         assertNotEquals(sessionId, sessionId2);
-        logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).build();
-
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).open();
         events.expectLogout(sessionId2).detail(Details.REDIRECT_URI, APP_REDIRECT_URI).assertEvent();
         MatcherAssert.assertThat(false, is(isSessionActive(sessionId2)));
     }
@@ -345,10 +334,10 @@ public void testLogoutWhenAccountClientRenamed() throws IOException {
 
     @Test
     public void browserLogoutWithAccessToken() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String accessToken = tokenResponse.getAccessToken();
 
-        driver.navigate().to(oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(accessToken).build());
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(accessToken).open();
 
         events.expectLogoutError(OAuthErrorException.INVALID_TOKEN).assertEvent();
 
@@ -358,13 +347,13 @@ public void browserLogoutWithAccessToken() {
 
     @Test
     public void logoutWithExpiredIdToken() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String idTokenString = tokenResponse.getIdToken();
 
         // Logout should succeed with expired ID token, see KEYCLOAK-3399
         setTimeOffset(60 * 60 * 24);
 
-        String logoutUrl = oauth.getLogoutUrl()
+        String logoutUrl = oauth.logoutForm()
                 .idTokenHint(idTokenString)
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
                 .build();
@@ -381,13 +370,13 @@ public void logoutWithExpiredIdToken() throws Exception {
 
     @Test
     public void logoutWithValidIdTokenWhenLoggedOutByAdmin() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String idTokenString = tokenResponse.getIdToken();
 
         adminClient.realm("test").logoutAll();
 
         // Logout with HTTP client. Logout should succeed with user already logged out, see KEYCLOAK-3399. But no logout event should be present
-        String logoutUrl = oauth.getLogoutUrl()
+        String logoutUrl = oauth.logoutForm()
                 .idTokenHint(idTokenString)
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
                 .build();
@@ -406,11 +395,10 @@ public void logoutWithValidIdTokenWhenLoggedOutByAdmin() throws Exception {
     // Test with "post_logout_redirect_uri" without "id_token_hint" should fail
     @Test
     public void logoutWithPostLogoutUriWithoutIdTokenHintShouldFail() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
         // Logout with "redirect_uri" parameter alone should fail
-        String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).open();
         errorPage.assertCurrent();
         events.expectLogoutError(OAuthErrorException.INVALID_REQUEST).assertEvent();
 
@@ -421,11 +409,11 @@ public void logoutWithPostLogoutUriWithoutIdTokenHintShouldFail() throws Excepti
 
     @Test
     public void logoutWithInvalidPostLogoutRedirectUri() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String idTokenString = tokenResponse.getIdToken();
 
         // Completely invalid redirect uri
-        driver.navigate().to(oauth.getLogoutUrl().postLogoutRedirectUri("https://invalid").idTokenHint(idTokenString).build());
+        oauth.logoutForm().postLogoutRedirectUri("https://invalid").idTokenHint(idTokenString).open();
         errorPage.assertCurrent();
         events.expectLogoutError(OAuthErrorException.INVALID_REDIRECT_URI)
                 .client(AssertEvents.DEFAULT_CLIENT_ID)
@@ -434,7 +422,7 @@ public void logoutWithInvalidPostLogoutRedirectUri() {
 
         // Redirect uri of different client in the realm should fail as well
         String rootUrlClientRedirectUri = UriUtils.getOrigin(APP_REDIRECT_URI) + "/foo/bar";
-        driver.navigate().to(oauth.getLogoutUrl().postLogoutRedirectUri(rootUrlClientRedirectUri).idTokenHint(idTokenString).build());
+        oauth.logoutForm().postLogoutRedirectUri(rootUrlClientRedirectUri).idTokenHint(idTokenString).open();
         errorPage.assertCurrent();
         events.expectLogoutError(OAuthErrorException.INVALID_REDIRECT_URI)
                 .client(AssertEvents.DEFAULT_CLIENT_ID)
@@ -448,18 +436,18 @@ public void logoutWithInvalidPostLogoutRedirectUri() {
 
     @Test
     public void logoutWithInvalidIdTokenHint() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String idTokenString = tokenResponse.getIdToken();
 
         // Removed signature from id_token_hint
         String idTokenHint = idTokenString.substring(0, idTokenString.lastIndexOf("."));
-        driver.navigate().to(oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenHint).build());
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenHint).open();
         errorPage.assertCurrent();
         events.expectLogoutError(OAuthErrorException.INVALID_TOKEN).removeDetail(Details.REDIRECT_URI).assertEvent();
 
         // Invalid signature
         idTokenHint = idTokenHint + ".something";
-        driver.navigate().to(oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenHint).build());
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenHint).open();
         errorPage.assertCurrent();
         events.expectLogoutError(OAuthErrorException.INVALID_TOKEN).removeDetail(Details.REDIRECT_URI).assertEvent();
 
@@ -471,9 +459,8 @@ public void logoutWithInvalidIdTokenHint() {
     // Test without "id_token_hint" and without "post_logout_redirect_uri" . User should confirm logout
     @Test
     public void logoutWithoutIdTokenHintWithoutPostLogoutRedirectUri() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
-
-        driver.navigate().to(oauth.getLogoutUrl().build());
+        AccessTokenResponse tokenResponse = loginUser();
+        oauth.logoutForm().open();
 
         // Assert logout confirmation page. Session still exists
         logoutConfirmPage.assertCurrent();
@@ -499,9 +486,9 @@ public void logoutWithoutIdTokenHintWithoutPostLogoutRedirectUri() {
     // Test with "id_token_hint" and without "post_logout_redirect_uri" . User should see "You were logged-out" at the end of logout
     @Test
     public void logoutWithIdTokenHintWithoutPostLogoutRedirectUri() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
-        driver.navigate().to(oauth.getLogoutUrl().idTokenHint(tokenResponse.getIdToken()).build());
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
 
         // Info page present. Link "back to the application" present
         infoPage.assertCurrent();
@@ -519,9 +506,9 @@ public void logoutWithIdTokenHintWithoutPostLogoutRedirectUri() {
     // Test for the scenario when "action" inside authentication session is expired
     @Test
     public void logoutExpiredConfirmationAction() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
-        driver.navigate().to(oauth.getLogoutUrl().build());
+        oauth.openLogoutForm();
 
         // Assert logout confirmation page. Session still exists
         logoutConfirmPage.assertCurrent();
@@ -550,9 +537,9 @@ public void logoutExpiredConfirmationAction() {
     // Test for the scenario when "authenticationSession" itself is expired
     @Test
     public void logoutExpiredConfirmationAuthSession() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
-        driver.navigate().to(oauth.getLogoutUrl().build());
+        oauth.openLogoutForm();
 
         // Assert logout confirmation page. Session still exists
         logoutConfirmPage.assertCurrent();
@@ -580,9 +567,9 @@ public void logoutExpiredConfirmationAuthSession() {
     // Test for the scenario when "authenticationSession" itself is expired without system client
     @Test
     public void logoutExpiredConfirmationAuthSessionWithClient() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
-        driver.navigate().to(oauth.getLogoutUrl().clientId("test-app").build());
+        oauth.logoutForm().withClientId().open();
 
         // Assert logout confirmation page. Session still exists
         logoutConfirmPage.assertCurrent();
@@ -606,12 +593,11 @@ public void logoutExpiredConfirmationAuthSessionWithClient() {
     // Test logout with "consentRequired" . All of "post_logout_redirect_uri", "id_token_hint" and "state" parameters are present in the logout request
     @Test
     public void logoutConsentRequired() {
-        oauth.clientId("third-party");
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser(true);
+        oauth.client("third-party", "password");
+        AccessTokenResponse tokenResponse = loginUser(true);
         String idTokenString = tokenResponse.getIdToken();
 
-        String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).state("somethingg").build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(idTokenString).state("somethingg").open();
 
         // Logout confirmation page not shown as id_token_hint was included.
         // Redirected back to the application with expected "state"
@@ -628,10 +614,9 @@ public void logoutConsentRequired() {
     @Test
     public void logoutWithUiLocalesAndClientIdParameter() throws IOException {
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm()).addSupportedLocale("cs").update()) {
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser(false);
+            AccessTokenResponse tokenResponse = loginUser(false);
 
-            String logoutUrl = oauth.getLogoutUrl().clientId("test-app").uiLocales("cs").build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().withClientId().uiLocales("cs").open();
 
             // Assert logout confirmation page. Session still exists. Assert czech language on logout page
             Assert.assertEquals("Odhlašování", PageUtils.getPageTitle(driver)); // Logging out
@@ -654,10 +639,10 @@ public void logoutWithUiLocalesAndClientIdParameter() throws IOException {
 
     @Test
     public void logoutWithClientIdAndExpiredCode() throws IOException {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String idTokenString = tokenResponse.getIdToken();
 
-        driver.navigate().to(oauth.getLogoutUrl().clientId("test-app").build());
+        oauth.logoutForm().withClientId().open();
 
         // Assert logout confirmation page. Session still exists
         logoutConfirmPage.assertCurrent();
@@ -682,16 +667,14 @@ public void logoutWithClientIdAndExpiredCode() throws IOException {
 
     @Test
     public void logoutWithClientIdAndWithoutIdTokenHint() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
         // logout url with no parameters, client is the account app
-        String logoutUrl = oauth.getLogoutUrl().build();
-        driver.navigate().to(logoutUrl);
+        oauth.openLogoutForm();
         logoutConfirmPage.assertCurrent();
 
         // change logout to our app with redirect uri
-        logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).clientId("test-app").state("somethingg").build();
-        driver.navigate().to(logoutUrl);
+        oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).state("somethingg").withClientId().open();
 
         // Assert logout confirmation page as id_token_hint was not sent. Session still exists. Assert default language on logout page (English)
         logoutConfirmPage.assertCurrent();
@@ -709,15 +692,14 @@ public void logoutWithClientIdAndWithoutIdTokenHint() {
 
     @Test
     public void logoutWithClientIdIdTokenHintAndPostLogoutRedirectUri() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
         // Test logout with all of "client_id", "id_token_hint" and "post_logout_redirect_uri". Logout should work without confirmation
-        String logoutUrl = oauth.getLogoutUrl()
+        oauth.logoutForm()
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
-                .clientId("test-app")
                 .idTokenHint(tokenResponse.getIdToken())
-                .state("somethingg").build();
-        driver.navigate().to(logoutUrl);
+                .withClientId()
+                .state("somethingg").open();
 
         // Logout done and redirected back to the application with expected "state"
         events.expectLogout(tokenResponse.getSessionState()).assertEvent();
@@ -725,11 +707,10 @@ public void logoutWithClientIdIdTokenHintAndPostLogoutRedirectUri() {
         assertCurrentUrlEquals(APP_REDIRECT_URI + "?state=somethingg");
 
         // Test logout only with "client_id" and "post_logout_redirect_uri". Should automatically redirect as there is no logout (No active browser session)
-        logoutUrl = oauth.getLogoutUrl()
+        oauth.logoutForm()
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
-                .clientId("test-app")
-                .state("something2").build();
-        driver.navigate().to(logoutUrl);
+                .withClientId()
+                .state("something2").open();
 
         events.assertEmpty();
         assertCurrentUrlEquals(APP_REDIRECT_URI + "?state=something2");
@@ -782,14 +763,13 @@ public void logoutWithClientIdAndPostLogoutRedirectUriWhenWhenUsingAppRedirectUr
 
     @Test
     public void logoutWithBadClientId() {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
         // Case when client_id points to different client than ID Token.
-        String logoutUrl = oauth.getLogoutUrl()
+        oauth.client("third-party").logoutForm()
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
-                .clientId("third-party")
-                .idTokenHint(tokenResponse.getIdToken()).build();
-        driver.navigate().to(logoutUrl);
+                .withClientId()
+                .idTokenHint(tokenResponse.getIdToken()).open();
 
         errorPage.assertCurrent();
         Assert.assertEquals("Invalid parameter: id_token_hint", errorPage.getError());
@@ -798,10 +778,10 @@ public void logoutWithBadClientId() {
         MatcherAssert.assertThat(true, is(isSessionActive(tokenResponse.getSessionState())));
 
         // Case when client_id is non-existing client and redirect uri of different client is used
-        logoutUrl = oauth.getLogoutUrl()
+        oauth.client("non-existing").logoutForm()
                 .postLogoutRedirectUri(APP_REDIRECT_URI)
-                .clientId("non-existing").build();
-        driver.navigate().to(logoutUrl);
+                .withClientId()
+                .open();
 
         errorPage.assertCurrent();
         Assert.assertEquals("Invalid redirect uri", errorPage.getError());
@@ -810,9 +790,7 @@ public void logoutWithBadClientId() {
         MatcherAssert.assertThat(true, is(isSessionActive(tokenResponse.getSessionState())));
 
         // Case when client_id is non-existing client. Confirmation is needed.
-        logoutUrl = oauth.getLogoutUrl()
-                .clientId("non-existing").build();
-        driver.navigate().to(logoutUrl);
+        oauth.client("non-existing").logoutForm().withClientId().open();
 
         logoutConfirmPage.assertCurrent();
         logoutConfirmPage.confirmLogout();
@@ -836,7 +814,7 @@ public void logoutWithBadClientId() {
     @Test
     public void logoutWithPostRequest() throws IOException {
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm()).addSupportedLocale("cs").update()) {
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
 
             // Logout with POST request and automatic redirect after logout
             String redirectUri = APP_REDIRECT_URI + "?logout";
@@ -848,7 +826,7 @@ public void logoutWithPostRequest() throws IOException {
             postParams.put(OIDCLoginProtocol.POST_LOGOUT_REDIRECT_URI_PARAM, redirectUri);
             postParams.put(OIDCLoginProtocol.ID_TOKEN_HINT, idTokenString);
             postParams.put(OAuth2Constants.STATE, "my-state");
-            URLUtils.sendPOSTRequestWithWebDriver(oauth.getLogoutUrl().build(), postParams);
+            URLUtils.sendPOSTRequestWithWebDriver(oauth.getEndpoints().getLogout(), postParams);
 
             events.expectLogout(tokenResponse.getSessionState()).detail(Details.REDIRECT_URI, redirectUri).assertEvent();
             MatcherAssert.assertThat(false, is(isSessionActive(sessionId)));
@@ -863,7 +841,7 @@ public void logoutWithPostRequest() throws IOException {
             postParams.put(OAuth2Constants.CLIENT_ID, "test-app");
             postParams.put(OAuth2Constants.STATE, "my-state-2");
             postParams.put(OIDCLoginProtocol.UI_LOCALES_PARAM, "cs");
-            URLUtils.sendPOSTRequestWithWebDriver(oauth.getLogoutUrl().build(), postParams);
+            URLUtils.sendPOSTRequestWithWebDriver(oauth.getEndpoints().getLogout(), postParams);
 
             Assert.assertEquals("Odhlašování", PageUtils.getPageTitle(driver)); // Logging out
             Assert.assertEquals("Čeština", logoutConfirmPage.getLanguageDropdownText());
@@ -880,16 +858,16 @@ public void logoutWithPostRequest() throws IOException {
     @Test
     public void testLocalizationPreferenceDuringLogout() throws IOException {
         try (RealmAttributeUpdater realmUpdater = new RealmAttributeUpdater(testRealm()).addSupportedLocale("cs").update()) {
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
 
             // Set localization to the user account to "cs". Ensure that it is shown
             try (UserAttributeUpdater userUpdater = UserAttributeUpdater.forUserByUsername(testRealm(), "test-user@localhost").setAttribute(UserModel.LOCALE, "cs").update()) {
-                driver.navigate().to(oauth.getLogoutUrl().build());
+                oauth.openLogoutForm();
                 Assert.assertEquals("Odhlašování", PageUtils.getPageTitle(driver)); // Logging out
                 Assert.assertEquals("Čeština", logoutConfirmPage.getLanguageDropdownText());
 
                 // Set localization together with ui_locales param. User localization should have preference
-                driver.navigate().to(oauth.getLogoutUrl().uiLocales("de").build());
+                oauth.logoutForm().uiLocales("de").open();
                 Assert.assertEquals("Odhlašování", PageUtils.getPageTitle(driver)); // Logging out
                 Assert.assertEquals("Čeština", logoutConfirmPage.getLanguageDropdownText());
             }
@@ -897,7 +875,7 @@ public void testLocalizationPreferenceDuringLogout() throws IOException {
             UserAttributeUpdater.forUserByUsername(testRealm(), "test-user@localhost").removeAttribute(UserModel.LOCALE).update();
 
             // Removed localization from user account. Now localization set by ui_locales parameter should be used
-            driver.navigate().to(oauth.getLogoutUrl().uiLocales("de").build());
+            oauth.logoutForm().uiLocales("de").open();
             Assert.assertEquals("Abmelden", PageUtils.getPageTitle(driver)); // Logging out
             Assert.assertEquals("Deutsch", logoutConfirmPage.getLanguageDropdownText());
             logoutConfirmPage.confirmLogout();
@@ -906,7 +884,7 @@ public void testLocalizationPreferenceDuringLogout() throws IOException {
 
             // Remove ui_locales from logout request. Default locale should be set
             tokenResponse = loginUser();
-            driver.navigate().to(oauth.getLogoutUrl().build());
+            oauth.logoutForm().open();
             Assert.assertEquals("Logging out", PageUtils.getPageTitle(driver));
             Assert.assertEquals("English", logoutConfirmPage.getLanguageDropdownText());
             logoutConfirmPage.confirmLogout();
@@ -919,10 +897,10 @@ public void testLocalizationPreferenceDuringLogout() throws IOException {
     @Test
     public void testLocalizationDuringLogout() throws IOException {
         try (RealmAttributeUpdater realmUpdater = new RealmAttributeUpdater(testRealm()).addSupportedLocale("cs").update()) {
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
 
             // Display the logout page. Then change the localization to Czech, then back to english and then and logout
-            driver.navigate().to(oauth.getLogoutUrl().build());
+            oauth.openLogoutForm();
 
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.openLanguage("Čeština");
@@ -948,10 +926,10 @@ public void testLocalizationDuringLogout() throws IOException {
 
             // Display logout with ui_locales parameter set to "de"
             tokenResponse = loginUser();
-            driver.navigate().to(oauth.getLogoutUrl()
-                    .clientId("test-app")
+            oauth.logoutForm()
+                    .withClientId()
                     .uiLocales("de")
-                    .build());
+                    .open();
 
             Assert.assertEquals("Abmelden", PageUtils.getPageTitle(driver)); // Logging out
             Assert.assertEquals("Deutsch", logoutConfirmPage.getLanguageDropdownText());
@@ -988,10 +966,10 @@ public void testLocalizationDuringLogout() throws IOException {
 
     @Test
     public void testIncorrectChangingParameters() throws IOException {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
         // Display the logout page. Then change the localization to Czech and logout
-        driver.navigate().to(oauth.getLogoutUrl().uiLocales("de").build());
+        oauth.logoutForm().uiLocales("de").open();
 
         Assert.assertEquals("Abmelden", PageUtils.getPageTitle(driver)); // Logging out
         logoutConfirmPage.openLanguage("English");
@@ -1013,14 +991,13 @@ public void testIncorrectChangingParameters() throws IOException {
 
     @Test
     public void logoutWithIdTokenAndDisabledClientMustWork() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
 
 
         try (Closeable accountClientUpdater = ClientAttributeUpdater.forClient(adminClient, "test", oauth.getClientId())
                 .setEnabled(false).update()) {
 
-            String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).clientId("test-app").build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).withClientId().open();
             MatcherAssert.assertThat(true, is(isSessionActive(tokenResponse.getSessionState())));
             events.assertEmpty();
 
@@ -1035,14 +1012,13 @@ public void logoutWithIdTokenAndDisabledClientMustWork() throws Exception {
     @Test
     public void testLogoutWhenAccountClientIsDisabled() throws IOException {
 
-        OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+        AccessTokenResponse tokenResponse = loginUser();
         String sessionId = tokenResponse.getSessionState();
 
         try (Closeable accountClientUpdater = ClientAttributeUpdater.forClient(adminClient, "test", Constants.ACCOUNT_MANAGEMENT_CLIENT_ID)
                 .setEnabled(false)
                 .update()) {
-            String logoutUrl = oauth.getLogoutUrl().build();
-            driver.navigate().to(logoutUrl);
+            oauth.openLogoutForm();
 
             events.assertEmpty();
             logoutConfirmPage.assertCurrent();
@@ -1066,13 +1042,12 @@ public void logoutWithIdTokenAndRemovedClient() throws Exception {
             String uuid = ApiUtil.getCreatedId(response);
             oauth.clientId("my-foo-client");
 
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
 
             // Remove client after login of user
             testRealm().clients().get(uuid).remove();
 
-            String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(tokenResponse.getIdToken()).build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(APP_REDIRECT_URI).idTokenHint(tokenResponse.getIdToken()).open();
 
             // Invalid redirect URI page is shown. It was not possible to verify post_logout_redirect_uri due the client was removed
             errorPage.assertCurrent();
@@ -1081,11 +1056,11 @@ public void logoutWithIdTokenAndRemovedClient() throws Exception {
     }
 
     // SUPPORT METHODS
-    private OAuthClient.AccessTokenResponse loginUser() {
+    private AccessTokenResponse loginUser() {
         return loginUser(false);
     }
 
-    private OAuthClient.AccessTokenResponse loginUser(boolean consentRequired) {
+    private AccessTokenResponse loginUser(boolean consentRequired) {
         oauth.doLogin("test-user@localhost", "password");
 
         if (consentRequired) {
@@ -1093,10 +1068,9 @@ private OAuthClient.AccessTokenResponse loginUser(boolean consentRequired) {
             grantPage.accept();
         }
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         events.clear();
         return tokenResponse;
     }
@@ -1114,10 +1088,9 @@ private void doLogoutTestWithPostLogoutRedirectAttributeAndSpecifiedPostLogoutRe
         try (Closeable accountClientUpdater = ClientAttributeUpdater.forClient(adminClient, "test", "test-app" )
                 .setAttribute(OIDCConfigAttributes.POST_LOGOUT_REDIRECT_URIS, postLogoutRedirectAttr).update()) {
 
-            OAuthClient.AccessTokenResponse tokenResponse = loginUser();
+            AccessTokenResponse tokenResponse = loginUser();
 
-            String logoutUrl = oauth.getLogoutUrl().postLogoutRedirectUri(postLogoutRedirectUri).clientId("test-app").build();
-            driver.navigate().to(logoutUrl);
+            oauth.logoutForm().postLogoutRedirectUri(postLogoutRedirectUri).withClientId().open();
 
             // Assert logout confirmation page as id_token_hint was not sent. Session still exists. Assert default language on logout page (English)
             logoutConfirmPage.assertCurrent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java
index 9a2a76486c7a..0444733765c7 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java
@@ -17,11 +17,11 @@
 package org.keycloak.testsuite.oauth;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import org.htmlunit.WebClient;
+
 import java.io.Closeable;
 import org.hamcrest.CoreMatchers;
 import org.hamcrest.Matchers;
-import org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver;
+import org.infinispan.Cache;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
 import org.junit.Before;
@@ -35,6 +35,7 @@
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.common.Profile;
 import org.keycloak.common.enums.SslRequired;
+import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
 import org.keycloak.cookie.CookieType;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.events.EventType;
@@ -48,6 +49,9 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
+import org.keycloak.models.sessions.infinispan.entities.AuthenticatedClientSessionEntity;
+import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.SessionTimeoutHelper;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
@@ -73,7 +77,7 @@
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
@@ -83,7 +87,6 @@
 import org.keycloak.testsuite.util.WaitUtils;
 import org.keycloak.testsuite.util.BrowserTabUtil;
 import org.keycloak.util.BasicAuthHelper;
-import org.keycloak.util.JsonSerialization;
 import org.openqa.selenium.Cookie;
 
 import jakarta.ws.rs.client.Client;
@@ -95,6 +98,7 @@
 import jakarta.ws.rs.core.UriBuilder;
 import java.net.URI;
 import java.util.List;
+import java.util.UUID;
 import java.util.concurrent.TimeUnit;
 
 import static org.hamcrest.Matchers.allOf;
@@ -115,7 +119,7 @@
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 import static org.keycloak.testsuite.arquillian.AuthServerTestEnricher.getHttpAuthServerContextRoot;
 
 /**
@@ -164,10 +168,9 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     /**
      * KEYCLOAK-547
      *
-     * @throws Exception
      */
     @Test
-    public void nullRefreshToken() throws Exception {
+    public void nullRefreshToken() {
         Client client = AdminClientUtil.createResteasyClient();
         UriBuilder builder = UriBuilder.fromUri(AUTH_SERVER_ROOT);
         URI uri = OIDCLoginProtocolService.tokenUrl(builder).build("test");
@@ -187,8 +190,8 @@ public void nullRefreshToken() throws Exception {
     }
 
     @Test
-    public void invalidRefreshToken() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest("invalid", "password");
+    public void invalidRefreshToken() {
+        AccessTokenResponse response = oauth.doRefreshTokenRequest("invalid");
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
         events.clear();
@@ -196,18 +199,16 @@ public void invalidRefreshToken() throws Exception {
 
     @Test
     public void refreshTokenStructure() {
-
-        oauth.nonce("123456");
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().nonce("123456").doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         assertNull(token.getNonce());
 
@@ -227,18 +228,17 @@ public void refreshTokenStructure() {
     }
 
     @Test
-    public void refreshTokenRequest() throws Exception {
-        oauth.nonce("123456");
-        oauth.doLogin("test-user@localhost", "password");
+    public void refreshTokenRequest() {
+        oauth.loginForm().nonce("123456").doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
         assertNull(token.getNonce());
 
@@ -259,7 +259,7 @@ public void refreshTokenRequest() throws Exception {
         assertEquals(sessionId, refreshToken.getSessionState());
         assertNull(refreshToken.getNonce());
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         AccessToken refreshedToken = oauth.verifyToken(response.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(response.getRefreshToken());
 
@@ -308,7 +308,7 @@ public void refreshTokenRequest() throws Exception {
     }
 
     @Test
-    public void refreshTokenWithDifferentIssuer() throws Exception {
+    public void refreshTokenWithDifferentIssuer() {
         final String proxyHost = "localhost";
         final int httpPort = 8666;
         final int httpsPort = 8667;
@@ -320,9 +320,9 @@ public void refreshTokenWithDifferentIssuer() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         String refreshTokenString = response.getRefreshToken();
 
         events.expectCodeToToken(codeId, sessionId).assertEvent();
@@ -333,7 +333,7 @@ public void refreshTokenWithDifferentIssuer() throws Exception {
         try {
             oauth.baseUrl(String.format("http://%s:%s", proxyHost, httpPort));
 
-            response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+            response = oauth.doRefreshTokenRequest(refreshTokenString);
 
             Assert.assertEquals(400, response.getStatusCode());
             Assert.assertEquals("invalid_grant", response.getError());
@@ -345,16 +345,62 @@ public void refreshTokenWithDifferentIssuer() throws Exception {
         }
     }
 
+
     @Test
-    public void refreshTokenWithAccessToken() throws Exception {
+    public void refreshingTokenLoadsSessionIntoCache() {
+
+        ProfileAssume.assumeFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS);
+
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
+
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+        String refreshTokenString = response.getRefreshToken();
+
+        // Test when neither client nor user session is in the cache
+        testingClient.server().run(session -> {
+            session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).clear();
+            session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).clear();
+        });
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        response = oauth.doRefreshTokenRequest(refreshTokenString);
+        Assert.assertEquals(200, response.getStatusCode());
+
+        testingClient.server().run(session -> {
+            assertThat(session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).size(),
+                    greaterThan(0));
+            assertThat(session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).size(),
+                    greaterThan(0));
+        });
+
+        // Test is only the client session is missing
+        testingClient.server().run(session -> {
+            session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).clear();
+        });
+
+        response = oauth.doRefreshTokenRequest(refreshTokenString);
+        Assert.assertEquals(200, response.getStatusCode());
+
+        testingClient.server().run(session -> {
+            assertThat(session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME).size(),
+                    greaterThan(0));
+            assertThat(session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME).size(),
+                    greaterThan(0));
+        });
+
+    }
+
+    @Test
+    public void refreshTokenWithAccessToken() {
+        oauth.doLogin("test-user@localhost", "password");
+
+        String code = oauth.parseLoginResponse().getCode();
+
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         String accessTokenString = tokenResponse.getAccessToken();
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(accessTokenString, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(accessTokenString);
         Assert.assertNotEquals(200, response.getStatusCode());
     }
 
@@ -398,23 +444,23 @@ public void testDoNotResolveUserSessionIfAuthenticationSessionIsInvalidated() {
                             .password("bob").addRoles("offline_access").build());
 
             oauth.realm(realmName);
-            oauth.clientId("public-client");
+            oauth.client("public-client");
 
             oauth.doLogin("alice", "alice");
-            String aliceCode = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(aliceCode, "password");
+            String aliceCode = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(aliceCode);
             AccessToken aliceAt = oauth.verifyToken(tokenResponse.getAccessToken());
 
             setTimeOffset((int) TimeUnit.MINUTES.toSeconds(2));
 
             oauth.doLogin("bob", "bob");
-            String bobCode = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String bobCode = oauth.parseLoginResponse().getCode();
 
             assertNotEquals(aliceCode, bobCode);
 
-            tokenResponse = oauth.doAccessTokenRequest(bobCode, "password");
+            tokenResponse = oauth.doAccessTokenRequest(bobCode);
             String refreshToken = tokenResponse.getRefreshToken();
-            tokenResponse = oauth.doRefreshTokenRequest(refreshToken, null);
+            tokenResponse = oauth.doRefreshTokenRequest(refreshToken);
             AccessToken bobAt = oauth.verifyToken(tokenResponse.getAccessToken());
 
             assertNotEquals(aliceAt.getSessionId(), bobAt.getSessionId());
@@ -455,7 +501,7 @@ public void testTimeoutWhenReUsingPreviousAuthenticationSession() {
                     .create(UserBuilder.create().username("bob").password("bob").addRoles("offline_access").build());
 
             oauth.realm(realmName);
-            oauth.clientId("public-client");
+            oauth.client("public-client");
 
             oauth.openLoginForm();
 
@@ -463,7 +509,7 @@ public void testTimeoutWhenReUsingPreviousAuthenticationSession() {
 
             oauth.fillLoginForm("alice", "alice");
 
-            String aliceCode = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String aliceCode = oauth.parseLoginResponse().getCode();
 //            WebClient webClient = DroneHtmlUnitDriver.class.cast(driver).getWebClient();
 //            webClient.getCookieManager().clearCookies();
             driver.manage().deleteAllCookies();
@@ -488,19 +534,19 @@ public void testTimeoutWhenReUsingPreviousAuthenticationSession() {
     public void tokenRefreshWithAccessTokenShouldReturnIdTokenWithAccessTokenHash() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         String refreshToken = tokenResponse.getRefreshToken();
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshToken, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshToken);
         Assert.assertEquals(200, response.getStatusCode());
         IDToken idToken = oauth.verifyToken(response.getIdToken());
         Assert.assertNotNull("AccessTokenHash should not be null after token refresh", idToken.getAccessTokenHash());
     }
 
     @Test
-    public void refreshTokenReuseTokenWithoutRefreshTokensRevoked() throws Exception {
+    public void refreshTokenReuseTokenWithoutRefreshTokensRevoked() {
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
@@ -508,19 +554,19 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevoked() throws Exception
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
         RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
 
         events.expectCodeToToken(codeId, sessionId).assertEvent();
 
-        OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+        AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
         assertEquals(200, response2.getStatusCode());
 
         events.expectRefresh(refreshToken1.getId(), sessionId).assertEvent();
 
-        OAuthClient.AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+        AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
 
         assertEquals(200, response3.getStatusCode());
 
@@ -529,7 +575,7 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevoked() throws Exception
 
 
     @Test
-    public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() throws Exception {
+    public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() {
         //add phone,address as optional scope and request them
         ClientScopeRepresentation phoneScope = adminClient.realm("test").clientScopes().findAll().stream().filter((ClientScopeRepresentation clientScope) ->"phone".equals(clientScope.getName())).findFirst().get();
         ClientScopeRepresentation addressScope = adminClient.realm("test").clientScopes().findAll().stream().filter((ClientScopeRepresentation clientScope) ->"address".equals(clientScope.getName())).findFirst().get();
@@ -539,11 +585,11 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() th
         try {
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
             String optionalScope = "phone address";
             oauth.scope(optionalScope);
-            OAuthClient.AccessTokenResponse response1 = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            AccessTokenResponse response1 = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
             AbstractOIDCScopeTest.assertScopes("openid basic email roles web-origins acr profile address phone",  refreshToken1.getScope());
 
@@ -551,7 +597,7 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() th
 
             String scope = "email phone";
             oauth.scope(scope);
-            OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
             assertEquals(200, response2.getStatusCode());
             AbstractOIDCScopeTest.assertScopes("openid email phone profile",  response2.getScope());
             RefreshToken refreshToken2 = oauth.parseRefreshToken(response2.getRefreshToken());
@@ -565,14 +611,14 @@ public void refreshTokenReuseTokenWithoutRefreshTokensRevokedWithLessScopes() th
     }
 
     @Test
-    public void refreshTokenReuseTokenScopeParameterNotInRefreshToken() throws Exception {
+    public void refreshTokenReuseTokenScopeParameterNotInRefreshToken() {
         try {
             //scope parameter consists scope that is not part of scope refresh token => error thrown
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
             RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
             AbstractOIDCScopeTest.assertScopes("openid basic email roles web-origins acr profile",  refreshToken1.getScope());
 
@@ -580,7 +626,7 @@ public void refreshTokenReuseTokenScopeParameterNotInRefreshToken() throws Excep
 
             String scope = "openid email ssh_public_key";
             oauth.scope(scope);
-            OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
             assertEquals(400, response2.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_SCOPE, response2.getError());
 
@@ -591,7 +637,7 @@ public void refreshTokenReuseTokenScopeParameterNotInRefreshToken() throws Excep
     }
 
     @Test
-    public void refreshWithOptionalClientScopeWithIncludeInTokenScopeDisabled() throws Exception {
+    public void refreshWithOptionalClientScopeWithIncludeInTokenScopeDisabled() {
         //set roles client scope as optional
         ClientScopeRepresentation rolesScope = ApiUtil.findClientScopeByName(adminClient.realm("test"), OIDCLoginProtocolFactory.ROLES_SCOPE).toRepresentation();
         ClientManager.realm(adminClient.realm("test")).clientId(oauth.getClientId()).removeClientScope(rolesScope.getId(),true);
@@ -601,9 +647,9 @@ public void refreshWithOptionalClientScopeWithIncludeInTokenScopeDisabled() thro
             oauth.scope("roles");
             oauth.doLogin("test-user@localhost", "password");
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
             RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
 
@@ -615,7 +661,7 @@ public void refreshWithOptionalClientScopeWithIncludeInTokenScopeDisabled() thro
 
             oauth.scope(null);
 
-            response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
             accessToken = oauth.verifyToken(response.getAccessToken());
             refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
@@ -633,7 +679,7 @@ public void refreshWithOptionalClientScopeWithIncludeInTokenScopeDisabled() thro
     }
 
     @Test
-    public void refreshTokenReuseTokenWithRefreshTokensRevoked() throws Exception {
+    public void refreshTokenReuseTokenWithRefreshTokensRevoked() {
         try {
 
             RealmManager.realm(adminClient.realm("test")).revokeRefreshToken(true);
@@ -645,28 +691,28 @@ public void refreshTokenReuseTokenWithRefreshTokensRevoked() throws Exception {
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
             RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
 
-            OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
             RefreshToken refreshToken2 = oauth.parseRefreshToken(response2.getRefreshToken());
 
             assertEquals(200, response2.getStatusCode());
 
             events.expectRefresh(refreshToken1.getId(), sessionId).assertEvent();
 
-            OAuthClient.AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
 
             assertEquals(400, response3.getStatusCode());
 
             events.expectRefresh(refreshToken1.getId(), sessionId).user((String) null).removeDetail(Details.TOKEN_ID).removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
 
             // Client session invalidated hence old refresh token not valid anymore
-            OAuthClient.AccessTokenResponse response4 = oauth.doRefreshTokenRequest(response2.getRefreshToken(), "password");
+            AccessTokenResponse response4 = oauth.doRefreshTokenRequest(response2.getRefreshToken());
             assertEquals(400, response4.getStatusCode());
             events.expectRefresh(refreshToken2.getId(), sessionId).user((String) null).removeDetail(Details.TOKEN_ID).removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
         } finally {
@@ -686,24 +732,24 @@ public void refreshTokenReuseOnDifferentTab() {
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
             RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
             events.expectCodeToToken(codeId, sessionId).assertEvent();
             assertNotNull(refreshToken1.getOtherClaims().get(Constants.REUSE_ID));
             assertNotEquals(refreshToken1.getOtherClaims().get(Constants.REUSE_ID), refreshToken1.getId());
 
             //login with tab 2
-            tabUtil.newTab(oauth.getLoginFormUrl());
+            tabUtil.newTab(oauth.loginForm().build());
             assertThat(tabUtil.getCountOfTabs(), Matchers.equalTo(2));
 
             loginEvent = events.expectLogin().assertEvent();
             sessionId = loginEvent.getSessionId();
             codeId = loginEvent.getDetails().get(Details.CODE_ID);
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse responseNew = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse responseNew = oauth.doAccessTokenRequest(code);
             RefreshToken refreshTokenNew = oauth.parseRefreshToken(responseNew.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
@@ -714,7 +760,7 @@ public void refreshTokenReuseOnDifferentTab() {
             setTimeOffset(10);
 
             //refresh with token from tab 1
-            OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
             assertEquals(200, response2.getStatusCode());
             RefreshToken refreshToken2 = oauth.parseRefreshToken(response2.getRefreshToken());
             events.expectRefresh(refreshToken2.getId(), sessionId);
@@ -722,7 +768,7 @@ public void refreshTokenReuseOnDifferentTab() {
             assertEquals(refreshToken1.getOtherClaims().get(Constants.REUSE_ID), refreshToken2.getOtherClaims().get(Constants.REUSE_ID));
 
             //refresh with token from tab 2
-            OAuthClient.AccessTokenResponse responseNew1 = oauth.doRefreshTokenRequest(responseNew.getRefreshToken(), "password");
+            AccessTokenResponse responseNew1 = oauth.doRefreshTokenRequest(responseNew.getRefreshToken());
             assertEquals(200, responseNew1.getStatusCode());
             RefreshToken refreshTokenNew1 = oauth.parseRefreshToken(responseNew1.getRefreshToken());
             events.expectRefresh(refreshTokenNew1.getId(), sessionId);
@@ -730,7 +776,7 @@ public void refreshTokenReuseOnDifferentTab() {
             assertEquals(refreshTokenNew.getOtherClaims().get(Constants.REUSE_ID), refreshTokenNew1.getOtherClaims().get(Constants.REUSE_ID));
 
             //try refresh token reuse with token from tab 2
-            responseNew1 = oauth.doRefreshTokenRequest(responseNew.getRefreshToken(), "password");
+            responseNew1 = oauth.doRefreshTokenRequest(responseNew.getRefreshToken());
             assertEquals(400, responseNew1.getStatusCode());
 
 
@@ -741,7 +787,7 @@ public void refreshTokenReuseOnDifferentTab() {
     }
 
     @Test
-    public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() throws Exception {
+    public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() {
         try {
             RealmManager.realm(adminClient.realm("test"))
                     .revokeRefreshToken(true)
@@ -754,15 +800,15 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code);
             RefreshToken initialRefreshToken = oauth.parseRefreshToken(initialResponse.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
 
             // Initial refresh.
-            OAuthClient.AccessTokenResponse responseFirstUse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseFirstUse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
             RefreshToken newTokenFirstUse = oauth.parseRefreshToken(responseFirstUse.getRefreshToken());
 
             assertEquals(200, responseFirstUse.getStatusCode());
@@ -770,7 +816,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
             events.expectRefresh(initialRefreshToken.getId(), sessionId).assertEvent();
 
             // Second refresh (allowed).
-            OAuthClient.AccessTokenResponse responseFirstReuse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseFirstReuse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
             RefreshToken newTokenFirstReuse = oauth.parseRefreshToken(responseFirstReuse.getRefreshToken());
             String userId = newTokenFirstReuse.getSubject();
 
@@ -779,7 +825,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
             events.expectRefresh(initialRefreshToken.getId(), sessionId).detail(Details.REFRESH_TOKEN_SUB, userId).assertEvent();
 
             // Token reused twice, became invalid.
-            OAuthClient.AccessTokenResponse responseSecondReuse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseSecondReuse = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
 
             assertEquals(400, responseSecondReuse.getStatusCode());
 
@@ -787,8 +833,8 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
                     .removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
 
             // Refresh token from first use became invalid.
-            OAuthClient.AccessTokenResponse responseUseOfInvalidatedRefreshToken =
-                    oauth.doRefreshTokenRequest(responseFirstUse.getRefreshToken(), "password");
+            AccessTokenResponse responseUseOfInvalidatedRefreshToken =
+                    oauth.doRefreshTokenRequest(responseFirstUse.getRefreshToken());
 
             assertEquals(400, responseUseOfInvalidatedRefreshToken.getStatusCode());
 
@@ -796,8 +842,8 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
                     .removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
 
             // Refresh token from reuse is not valid. Client session was invalidated
-            OAuthClient.AccessTokenResponse responseUseOfValidRefreshToken =
-                    oauth.doRefreshTokenRequest(responseFirstReuse.getRefreshToken(), "password");
+            AccessTokenResponse responseUseOfValidRefreshToken =
+                    oauth.doRefreshTokenRequest(responseFirstReuse.getRefreshToken());
 
             assertEquals(400, responseUseOfValidRefreshToken.getStatusCode());
 
@@ -811,7 +857,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAfterSingleReuse() thr
     }
 
     @Test
-    public void refreshTokenReuseOfExistingTokenAfterEnablingReuseRevokation() throws Exception {
+    public void refreshTokenReuseOfExistingTokenAfterEnablingReuseRevokation() {
         try {
             oauth.doLogin("test-user@localhost", "password");
 
@@ -820,9 +866,9 @@ public void refreshTokenReuseOfExistingTokenAfterEnablingReuseRevokation() throw
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code);
             RefreshToken initialRefreshToken = oauth.parseRefreshToken(initialResponse.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
@@ -838,7 +884,7 @@ public void refreshTokenReuseOfExistingTokenAfterEnablingReuseRevokation() throw
             processExpectedValidRefresh(sessionId, initialRefreshToken, initialResponse.getRefreshToken());
             processExpectedValidRefresh(sessionId, initialRefreshToken, initialResponse.getRefreshToken());
 
-            OAuthClient.AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
 
             assertEquals(400, responseReuseExceeded.getStatusCode());
 
@@ -851,7 +897,7 @@ public void refreshTokenReuseOfExistingTokenAfterEnablingReuseRevokation() throw
     }
 
     @Test
-    public void refreshTokenReuseOfExistingTokenAfterDisablingReuseRevokation() throws Exception {
+    public void refreshTokenReuseOfExistingTokenAfterDisablingReuseRevokation() {
         try {
             RealmManager.realm(adminClient.realm("test")).revokeRefreshToken(true).refreshTokenMaxReuse(1);
 
@@ -862,9 +908,9 @@ public void refreshTokenReuseOfExistingTokenAfterDisablingReuseRevokation() thro
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse initialResponse = oauth.doAccessTokenRequest(code);
             RefreshToken initialRefreshToken = oauth.parseRefreshToken(initialResponse.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
@@ -873,7 +919,7 @@ public void refreshTokenReuseOfExistingTokenAfterDisablingReuseRevokation() thro
             processExpectedValidRefresh(sessionId, initialRefreshToken, initialResponse.getRefreshToken());
             processExpectedValidRefresh(sessionId, initialRefreshToken, initialResponse.getRefreshToken());
 
-            OAuthClient.AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
 
             assertEquals(400, responseReuseExceeded.getStatusCode());
 
@@ -883,7 +929,7 @@ public void refreshTokenReuseOfExistingTokenAfterDisablingReuseRevokation() thro
             RealmManager.realm(adminClient.realm("test")).revokeRefreshToken(false);
 
             // Config changed, token cannot be used again at this point due the client session invalidated
-            OAuthClient.AccessTokenResponse responseReuseExceeded2 = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken(), "password");
+            AccessTokenResponse responseReuseExceeded2 = oauth.doRefreshTokenRequest(initialResponse.getRefreshToken());
             assertEquals(400, responseReuseExceeded2.getStatusCode());
             events.expectRefresh(initialRefreshToken.getId(), sessionId).user((String) null).removeDetail(Details.TOKEN_ID)
                     .removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
@@ -908,16 +954,16 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
             String sessionId = loginEvent.getSessionId();
             String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response1 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response1 = oauth.doAccessTokenRequest(code);
             RefreshToken refreshToken1 = oauth.parseRefreshToken(response1.getRefreshToken());
 
             events.expectCodeToToken(codeId, sessionId).assertEvent();
 
             // Refresh token for the first time - should pass
 
-            OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response2 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
             RefreshToken refreshToken2 = oauth.parseRefreshToken(response2.getRefreshToken());
 
             assertEquals(200, response2.getStatusCode());
@@ -929,7 +975,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
 
             // Refresh token for the second time - should fail and invalidate client session
 
-            OAuthClient.AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken(), "password");
+            AccessTokenResponse response3 = oauth.doRefreshTokenRequest(response1.getRefreshToken());
 
             assertEquals(400, response3.getStatusCode());
 
@@ -939,8 +985,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
             Assert.assertFalse(hasClientSessionForTestApp());
 
             // Introspection with the accessToken from the first authentication. This should fail
-            String introspectionResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password", response1.getAccessToken());
-            JsonNode jsonNode = JsonSerialization.mapper.readTree(introspectionResponse);
+            JsonNode jsonNode = oauth.doIntrospectionAccessTokenRequest(response1.getAccessToken()).asJsonNode();
             Assert.assertFalse(jsonNode.get("active").asBoolean());
             events.clear();
 
@@ -951,9 +996,9 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
             loginEvent = events.expectLogin().assertEvent();
             sessionId = loginEvent.getSessionId();
             codeId = loginEvent.getDetails().get(Details.CODE_ID);
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            code = oauth.parseLoginResponse().getCode();
 
-            OAuthClient.AccessTokenResponse response4 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse response4 = oauth.doAccessTokenRequest(code);
             RefreshToken refreshToken4 = oauth.parseRefreshToken(response4.getRefreshToken());
             events.expectCodeToToken(codeId, sessionId).assertEvent();
 
@@ -961,8 +1006,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
             Assert.assertTrue(hasClientSessionForTestApp());
 
             // Introspection again with the accessToken from the very first authentication. This should fail as the access token was obtained for the old client session before SSO re-authentication
-            introspectionResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password", response1.getAccessToken());
-            jsonNode = JsonSerialization.mapper.readTree(introspectionResponse);
+            jsonNode = oauth.doIntrospectionAccessTokenRequest(response1.getAccessToken()).asJsonNode();
             Assert.assertFalse(jsonNode.get("active").asBoolean());
 
             // Try userInfo with the same old access token. Should fail as well
@@ -978,7 +1022,7 @@ public void refreshTokenReuseTokenWithRefreshTokensRevokedAndSSOReauthentication
             events.clear();
 
             // Try to refresh with one of the old refresh tokens before SSO re-authentication - should fail
-            OAuthClient.AccessTokenResponse response5 = oauth.doRefreshTokenRequest(response2.getRefreshToken(), "password");
+            AccessTokenResponse response5 = oauth.doRefreshTokenRequest(response2.getRefreshToken());
             assertEquals(400, response5.getStatusCode());
             events.expectRefresh(refreshToken2.getId(), sessionId).user((String) null).removeDetail(Details.TOKEN_ID).removeDetail(Details.UPDATED_REFRESH_TOKEN_ID).error("invalid_token").assertEvent();
         } finally {
@@ -995,7 +1039,7 @@ private boolean hasClientSessionForTestApp() {
     }
 
     private void processExpectedValidRefresh(String sessionId, RefreshToken requestToken, String refreshToken) {
-        OAuthClient.AccessTokenResponse response2 = oauth.doRefreshTokenRequest(refreshToken, "password");
+        AccessTokenResponse response2 = oauth.doRefreshTokenRequest(refreshToken);
 
         assertEquals(200, response2.getStatusCode());
 
@@ -1004,7 +1048,7 @@ private void processExpectedValidRefresh(String sessionId, RefreshToken requestT
 
 
     @Test
-    public void refreshTokenClientDisabled() throws Exception {
+    public void refreshTokenClientDisabled() {
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
@@ -1012,9 +1056,9 @@ public void refreshTokenClientDisabled() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         String refreshTokenString = response.getRefreshToken();
         RefreshToken refreshToken = oauth.parseRefreshToken(refreshTokenString);
 
@@ -1023,7 +1067,7 @@ public void refreshTokenClientDisabled() throws Exception {
         try {
             ClientManager.realm(adminClient.realm("test")).clientId(oauth.getClientId()).enabled(false);
 
-            response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+            response = oauth.doRefreshTokenRequest(refreshTokenString);
 
             assertEquals(401, response.getStatusCode());
             assertEquals("invalid_client", response.getError());
@@ -1042,8 +1086,8 @@ public void refreshTokenUserSessionRemoved() {
 
         String sessionId = loginEvent.getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         events.poll();
 
@@ -1051,7 +1095,7 @@ public void refreshTokenUserSessionRemoved() {
 
         testingClient.testing().removeUserSession("test", sessionId);
 
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
         assertEquals(400, tokenResponse.getStatusCode());
         assertNull(tokenResponse.getAccessToken());
@@ -1066,7 +1110,7 @@ public void refreshTokenUserSessionRemoved() {
     public void refreshTokenAfterUserLogoutAndLoginAgain() {
         String refreshToken1 = loginAndForceNewLoginPage();
 
-        oauth.doLogout(refreshToken1, "password");
+        oauth.doLogout(refreshToken1);
         events.clear();
 
         try {
@@ -1077,16 +1121,16 @@ public void refreshTokenAfterUserLogoutAndLoginAgain() {
 
             assertFalse(loginPage.isCurrent());
 
-            OAuthClient.AccessTokenResponse tokenResponse2 = null;
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse2 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse tokenResponse2 = null;
+            String code = oauth.parseLoginResponse().getCode();
+            tokenResponse2 = oauth.doAccessTokenRequest(code);
 
             // Now try refresh with the original refreshToken1 created in logged-out userSession. It should fail
-            OAuthClient.AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1, "password");
+            AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1);
             assertEquals(400, responseReuseExceeded.getStatusCode());
 
             // Finally try with valid refresh token
-            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken(), "password");
+            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken());
             assertEquals(200, responseReuseExceeded.getStatusCode());
         } finally {
             resetTimeOffset();
@@ -1111,16 +1155,16 @@ public void refreshTokenAfterAdminLogoutAllAndLoginAgain() {
 
             assertFalse(loginPage.isCurrent());
 
-            OAuthClient.AccessTokenResponse tokenResponse2 = null;
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse2 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse tokenResponse2 = null;
+            String code = oauth.parseLoginResponse().getCode();
+            tokenResponse2 = oauth.doAccessTokenRequest(code);
 
             // Now try refresh with the original refreshToken1 created in logged-out userSession. It should fail
-            OAuthClient.AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1, "password");
+            AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1);
             assertEquals(400, responseReuseExceeded.getStatusCode());
 
             // Finally try with valid refresh token
-            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken(), "password");
+            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken());
             assertEquals(200, responseReuseExceeded.getStatusCode());
         } finally {
             resetTimeOffset();
@@ -1144,16 +1188,16 @@ public void refreshTokenAfterUserAdminLogoutEndpointAndLoginAgain() {
 
             assertFalse(loginPage.isCurrent());
 
-            OAuthClient.AccessTokenResponse tokenResponse2 = null;
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse2 = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse tokenResponse2 = null;
+            String code = oauth.parseLoginResponse().getCode();
+            tokenResponse2 = oauth.doAccessTokenRequest(code);
 
             // Now try refresh with the original refreshToken1 created in logged-out userSession. It should fail
-            OAuthClient.AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1, "password");
+            AccessTokenResponse responseReuseExceeded = oauth.doRefreshTokenRequest(refreshToken1);
             assertEquals(400, responseReuseExceeded.getStatusCode());
 
             // Finally try with valid refresh token
-            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken(), "password");
+            responseReuseExceeded = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken());
             assertEquals(200, responseReuseExceeded.getStatusCode());
         } finally {
             resetTimeOffset();
@@ -1167,15 +1211,15 @@ public void refreshTokenAfterUserAdminLogoutEndpointAndLoginAgain() {
     }
 
     @Test
-    public void testUserSessionRefreshAndIdle() throws Exception {
+    public void testUserSessionRefreshAndIdle() {
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
         String sessionId = loginEvent.getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         events.poll();
 
@@ -1185,7 +1229,7 @@ public void testUserSessionRefreshAndIdle() throws Exception {
 
         setTimeOffset(2);
 
-        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+        tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
         AccessToken refreshedToken = oauth.verifyToken(tokenResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(tokenResponse.getRefreshToken());
@@ -1204,7 +1248,7 @@ public void testUserSessionRefreshAndIdle() throws Exception {
             RealmManager.realm(realmResource).accessTokenLifespan(100000);
 
             setTimeOffset(4);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
             next = testingClient.testing().getLastSessionRefresh("test", sessionId, false);
 
@@ -1216,7 +1260,7 @@ public void testUserSessionRefreshAndIdle() throws Exception {
             events.clear();
             // Needs to add some additional time due the tollerance allowed by IDLE_TIMEOUT_WINDOW_SECONDS
             setTimeOffset(6 + (ProfileAssume.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS) ? 0 : SessionTimeoutHelper.IDLE_TIMEOUT_WINDOW_SECONDS));
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
             // test idle timeout
             assertEquals(400, tokenResponse.getStatusCode());
@@ -1243,14 +1287,16 @@ public void testUserSessionRefreshAndIdleRememberMe() throws Exception {
                     r.setSsoSessionIdleTimeoutRememberMe(500);
                     r.setSsoSessionIdleTimeout(100);
                 }).update()) {
-            oauth.doRememberMeLogin("test-user@localhost", "password");
+            oauth.openLoginForm();
+            loginPage.setRememberMe(true);
+            loginPage.login("test-user@localhost", "password");
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
             events.poll();
 
@@ -1258,7 +1304,7 @@ public void testUserSessionRefreshAndIdleRememberMe() throws Exception {
             int last = testingClient.testing().getLastSessionRefresh("test", sessionId, false);
 
             setTimeOffset(110 + (ProfileAssume.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS) ? 0 : SessionTimeoutHelper.IDLE_TIMEOUT_WINDOW_SECONDS));
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             oauth.verifyToken(tokenResponse.getAccessToken());
             oauth.parseRefreshToken(tokenResponse.getRefreshToken());
             assertEquals(200, tokenResponse.getStatusCode());
@@ -1269,7 +1315,7 @@ public void testUserSessionRefreshAndIdleRememberMe() throws Exception {
             events.clear();
             // Needs to add some additional time due the tollerance allowed by IDLE_TIMEOUT_WINDOW_SECONDS
             setTimeOffset(620 + 2 * (ProfileAssume.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS) ? 0 : SessionTimeoutHelper.IDLE_TIMEOUT_WINDOW_SECONDS));
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
             // test idle remember me timeout
             assertEquals(400, tokenResponse.getStatusCode());
@@ -1321,8 +1367,8 @@ public void refreshTokenUserSessionMaxLifespan() throws Exception {
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3600);
             final String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
@@ -1332,14 +1378,14 @@ public void refreshTokenUserSessionMaxLifespan() throws Exception {
             setTimeOffset(1800);
 
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1800);
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
             events.expectRefresh(refreshId, sessionId).assertEvent();
 
             setTimeOffset(3700);
             oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
@@ -1370,8 +1416,8 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1000);
             String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
@@ -1380,13 +1426,13 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
 
             setTimeOffset(600);
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 400);
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
             events.expectRefresh(refreshId, sessionId).assertEvent();
 
             setTimeOffset(1100);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1394,11 +1440,11 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
             assertEquals(1, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
             setTimeOffset(1600);
-            oauth.doSilentLogin();
+            oauth.openLoginForm();
             loginEvent = events.expectLogin().assertEvent();
             sessionId = loginEvent.getSessionId();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1000);
             events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), sessionId).assertEvent();
 
@@ -1406,7 +1452,7 @@ public void refreshTokenUserClientMaxLifespanSmallerThanSession() throws Excepti
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1436,8 +1482,8 @@ public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Excepti
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3600);
             String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
@@ -1446,13 +1492,13 @@ public void refreshTokenUserClientMaxLifespanGreaterThanSession() throws Excepti
 
             setTimeOffset(1800);
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 1800);
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
             events.expectRefresh(refreshId, sessionId).assertEvent();
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1482,8 +1528,8 @@ public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
             final String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
@@ -1495,7 +1541,7 @@ public void refreshTokenUserSessionMaxLifespanModifiedAfterTokenRefresh() throws
             realmResource.update(rep);
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1525,9 +1571,10 @@ public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() thro
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
-            assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
+            assertEquals(200, tokenResponse.getStatusCode());
+            assertTrue("Invalid ExpiresIn: " + tokenResponse.getRefreshExpiresIn(), 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
             String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
@@ -1538,7 +1585,7 @@ public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() thro
             realmResource.update(rep);
 
             setTimeOffset(3700);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1546,19 +1593,20 @@ public void refreshTokenClientSessionMaxLifespanModifiedAfterTokenRefresh() thro
             assertEquals(1, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
             setTimeOffset(4200);
-            oauth.doSilentLogin();
+            oauth.openLoginForm();
             loginEvent = events.expectLogin().assertEvent();
             sessionId = loginEvent.getSessionId();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "password");
-            assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3000);
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
+            assertEquals(200, tokenResponse.getStatusCode());
+            assertTrue("Invalid ExpiresIn: " + tokenResponse.getRefreshExpiresIn(), 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3000);
             events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), sessionId).assertEvent();
 
             clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
             setTimeOffset(7300);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1589,8 +1637,8 @@ public void silentLoginClientSessionMaxLifespanModifiedAfterTokenRefresh() throw
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 7200);
             String clientSessionId = getClientSessionUuid(sessionId, loginEvent.getClientId());
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
@@ -1602,11 +1650,11 @@ public void silentLoginClientSessionMaxLifespanModifiedAfterTokenRefresh() throw
             realmResource.update(rep);
 
             setTimeOffset(4200);
-            oauth.doSilentLogin();
+            oauth.openLoginForm();
             loginEvent = events.expectLogin().assertEvent();
             sessionId = loginEvent.getSessionId();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            code = oauth.parseLoginResponse().getCode();
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertTrue("Invalid ExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 3000);
             events.expectCodeToToken(loginEvent.getDetails().get(Details.CODE_ID), sessionId).assertEvent();
 
@@ -1614,7 +1662,7 @@ public void silentLoginClientSessionMaxLifespanModifiedAfterTokenRefresh() throw
             assertEquals(2, checkIfUserAndClientSessionExist(sessionId, loginEvent.getClientId(), clientSessionId));
 
             setTimeOffset(7300);
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1643,14 +1691,16 @@ public void refreshTokenUserSessionMaxLifespanWithRememberMe() throws Exception
                     r.setSsoSessionMaxLifespan(50);
                 }).update()) {
 
-            oauth.doRememberMeLogin("test-user@localhost", "password");
+            oauth.openLoginForm();
+            loginPage.setRememberMe(true);
+            loginPage.login("test-user@localhost", "password");
 
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
             events.poll();
 
@@ -1658,7 +1708,7 @@ public void refreshTokenUserSessionMaxLifespanWithRememberMe() throws Exception
 
             setTimeOffset(110);
 
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
 
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
@@ -1673,7 +1723,7 @@ public void refreshTokenUserSessionMaxLifespanWithRememberMe() throws Exception
     }
 
     @Test
-    public void refreshTokenClientSessionMaxLifespan() throws Exception {
+    public void refreshTokenClientSessionMaxLifespan() {
         RealmResource realm = adminClient.realm("test");
         RealmRepresentation rep = realm.toRepresentation();
         Integer originalSsoSessionMaxLifespan = rep.getSsoSessionMaxLifespan();
@@ -1695,39 +1745,39 @@ public void refreshTokenClientSessionMaxLifespan() throws Exception {
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
             String sessionId = loginEvent.getSessionId();
 
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
             events.poll();
 
             String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
 
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
-            assertTrue("Invalid RefreshExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 500);
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
+            assertTrue("Invalid RefreshExpiresIn" + tokenResponse.getRefreshExpiresIn(), 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 500);
 
             setTimeOffset(100);
 
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertTrue("Invalid RefreshExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 400);
 
             setTimeOffset(600);
 
-            oauth.doSilentLogin();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            oauth.openLoginForm();
+            code = oauth.parseLoginResponse().getCode();
 
-            tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            tokenResponse = oauth.doAccessTokenRequest(code);
             assertEquals(200, tokenResponse.getStatusCode());
-            assertTrue("Invalid RefreshExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 400);
+            assertTrue("Invalid RefreshExpiresIn" + tokenResponse.getRefreshExpiresIn(), 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 400);
 
             setTimeOffset(700);
 
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(200, tokenResponse.getStatusCode());
-            assertTrue("Invalid RefreshExpiresIn", 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 300);
+            assertTrue("Invalid RefreshExpiresIn" + tokenResponse.getRefreshExpiresIn(), 0 < tokenResponse.getRefreshExpiresIn() && tokenResponse.getRefreshExpiresIn() <= 300);
 
             setTimeOffset(1100);
 
-            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(), "password");
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
             assertEquals(400, tokenResponse.getStatusCode());
             assertNull(tokenResponse.getAccessToken());
             assertNull(tokenResponse.getRefreshToken());
@@ -1745,8 +1795,102 @@ public void refreshTokenClientSessionMaxLifespan() throws Exception {
         }
     }
 
+    /**
+     * This is a very esoteric test specific to bug <a href="https://github.com/keycloak/keycloak/issues/38591">#38591</a>.
+     * Consider removing or rewriting the test if the loading of sessions from the database has changed and no longer
+     * updates the client session timestamp. It is also specific to the case when the idle timeout of a client is reduced
+     * while some client sessions already exist.
+     */
+    @Test
+    public void refreshTokenClientSessionIdleTimeoutTwoClientsWithReloadingFromDatabase() {
+        ProfileAssume.assumeFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS);
+
+        RealmResource realm = adminClient.realm("test");
+
+        ClientResource client = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
+        ClientRepresentation clientRepresentation = client.toRepresentation();
+
+        // Duplicate the primary client to have two clients to test with
+        ClientRepresentation clientRepresentation2 = client.toRepresentation();
+        clientRepresentation2.setClientId("test-app2");
+        clientRepresentation2.getAttributes().put(CLIENT_SESSION_IDLE_TIMEOUT, "500");
+        clientRepresentation2.setId(null);
+        try (Response resp = realm.clients().create(clientRepresentation2)) {
+            String clientUUID = ApiUtil.getCreatedId(resp);
+            getCleanup().addClientUuid(clientUUID);
+        }
+
+        getTestingClient().testing().setTestingInfinispanTimeService();
+
+        try {
+            oauth.doLogin("test-user@localhost", "password");
+
+            EventRepresentation loginEvent = events.expectLogin().assertEvent();
+            String sessionId = loginEvent.getSessionId();
+
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
+
+            // Reduce the idle time so that the originally issued refresh token is valid, but it will be considered invalid due to the client configuration
+            clientRepresentation.getAttributes().put(CLIENT_SESSION_IDLE_TIMEOUT, "500");
+            client.update(clientRepresentation);
+
+            oauth.client("test-app2", "password");
+
+            // We are already logged in due to the token
+            oauth.openLoginForm();
+
+            String code2 = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code2);
+
+            assertThat(sessionId, Matchers.equalTo(tokenResponse2.getSessionState()));
+
+            setTimeOffset(100);
+
+            tokenResponse2 = oauth.doRefreshTokenRequest(tokenResponse2.getRefreshToken());
+            assertEquals(200, tokenResponse2.getStatusCode());
+            assertTrue("Invalid RefreshExpiresIn: " + tokenResponse2.getRefreshExpiresIn(), 0 < tokenResponse2.getRefreshExpiresIn() && tokenResponse2.getRefreshExpiresIn() <= 500);
+
+            // Clear all entries from the cache to enforce re-loading the data from the database
+            testingClient.server("test").run(session -> {
+                InfinispanConnectionProvider connections = session.getProvider(InfinispanConnectionProvider.class);
+                if (connections != null) {
+                    Cache<String, SessionEntityWrapper<UserSessionEntity>> sessionCache = connections.getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME);
+                    Cache<UUID, SessionEntityWrapper<AuthenticatedClientSessionEntity>> clientSessionCache = connections.getCache(InfinispanConnectionProvider.CLIENT_SESSION_CACHE_NAME);
+                    if (sessionCache != null) {
+                        sessionCache.clear();
+                    }
+                    if (clientSessionCache != null) {
+                        clientSessionCache.clear();
+                    }
+                }
+            });
+
+            setTimeOffset(550);
+            oauth.client("test-app", "password");
+            events.poll();
+
+            // The client session of the first client should have expired by now
+            String refreshId = oauth.parseRefreshToken(tokenResponse.getRefreshToken()).getId();
+            tokenResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
+
+            assertEquals(400, tokenResponse.getStatusCode());
+            assertNull(tokenResponse.getAccessToken());
+            assertNull(tokenResponse.getRefreshToken());
+            events.expectRefresh(refreshId, sessionId).error(Errors.INVALID_TOKEN);
+
+        } finally {
+            clientRepresentation.getAttributes().put(CLIENT_SESSION_IDLE_TIMEOUT, null);
+            client.update(clientRepresentation);
+
+            events.clear();
+            resetTimeOffset();
+            getTestingClient().testing().revertTestingInfinispanTimeService();
+        }
+    }
+
     @Test
-    public void testCheckSsl() throws Exception {
+    public void testCheckSsl() {
         Client client = AdminClientUtil.createResteasyClient();
         try {
             UriBuilder builder = UriBuilder.fromUri(AUTH_SERVER_ROOT);
@@ -1803,7 +1947,7 @@ public void testCheckSsl() throws Exception {
     }
 
     @Test
-    public void refreshTokenUserDisabled() throws Exception {
+    public void refreshTokenUserDisabled() {
         oauth.doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
@@ -1811,9 +1955,9 @@ public void refreshTokenUserDisabled() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         String refreshTokenString = response.getRefreshToken();
         RefreshToken refreshToken = oauth.parseRefreshToken(refreshTokenString);
 
@@ -1821,7 +1965,7 @@ public void refreshTokenUserDisabled() throws Exception {
 
         try {
             UserManager.realm(adminClient.realm("test")).username("test-user@localhost").enabled(false);
-            response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+            response = oauth.doRefreshTokenRequest(refreshTokenString);
             assertEquals(400, response.getStatusCode());
             assertEquals("invalid_grant", response.getError());
 
@@ -1832,7 +1976,7 @@ public void refreshTokenUserDisabled() throws Exception {
     }
 
     @Test
-    public void refreshTokenUserDeleted() throws Exception {
+    public void refreshTokenUserDeleted() {
         String userId = createUser("test", "temp-user@localhost", "password");
         oauth.doLogin("temp-user@localhost", "password");
 
@@ -1841,9 +1985,9 @@ public void refreshTokenUserDeleted() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         String refreshTokenString = response.getRefreshToken();
         RefreshToken refreshToken = oauth.parseRefreshToken(refreshTokenString);
 
@@ -1851,7 +1995,7 @@ public void refreshTokenUserDeleted() throws Exception {
 
         adminClient.realm("test").users().delete(userId);
 
-        response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+        response = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
 
@@ -1859,18 +2003,18 @@ public void refreshTokenUserDeleted() throws Exception {
     }
 
     @Test
-    public void refreshTokenServiceAccount() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.clientId("service-account-app").doClientCredentialsGrantAccessTokenRequest("secret");
+    public void refreshTokenServiceAccount() {
+        AccessTokenResponse response = oauth.client("service-account-app", "secret").doClientCredentialsGrantAccessTokenRequest();
 
         assertNotNull(response.getRefreshToken());
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         assertNotNull(response.getRefreshToken());
     }
 
     @Test
-    public void testClientSessionMaxLifespan() throws Exception {
+    public void testClientSessionMaxLifespan() {
         ClientResource client = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRepresentation = client.toRepresentation();
 
@@ -1885,8 +2029,8 @@ public void testClientSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionMaxLifespan);
 
@@ -1894,16 +2038,16 @@ public void testClientSessionMaxLifespan() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionMaxLifespan - 100);
 
             clientRepresentation.getAttributes().put(OIDCConfigAttributes.CLIENT_SESSION_MAX_LIFESPAN,
-                Integer.toString(ssoSessionMaxLifespan - 200));
+                    Integer.toString(ssoSessionMaxLifespan - 200));
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionMaxLifespan - 200);
         } finally {
@@ -1916,7 +2060,7 @@ public void testClientSessionMaxLifespan() throws Exception {
     }
 
     @Test
-    public void testClientSessionIdleTimeout() throws Exception {
+    public void testClientSessionIdleTimeout() {
         ClientResource client = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRepresentation = client.toRepresentation();
 
@@ -1927,8 +2071,8 @@ public void testClientSessionIdleTimeout() throws Exception {
 
         try {
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionIdleTimeout);
 
@@ -1936,16 +2080,16 @@ public void testClientSessionIdleTimeout() throws Exception {
             realm.update(rep);
 
             String refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionIdleTimeout - 100);
 
             clientRepresentation.getAttributes().put(CLIENT_SESSION_IDLE_TIMEOUT,
-                Integer.toString(ssoSessionIdleTimeout - 200));
+                    Integer.toString(ssoSessionIdleTimeout - 200));
             client.update(clientRepresentation);
 
             refreshToken = response.getRefreshToken();
-            response = oauth.doRefreshTokenRequest(refreshToken, "password");
+            response = oauth.doRefreshTokenRequest(refreshToken);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getRefreshExpiresIn(), ssoSessionIdleTimeout - 200);
         } finally {
@@ -1960,29 +2104,29 @@ public void testClientSessionIdleTimeout() throws Exception {
     public void testRefreshTokenWhenClientSessionTimeoutPassedButRealmDidNot() {
         getCleanup()
                 .addCleanup(new RealmAttributeUpdater(adminClient.realm("test"))
-                    .setSsoSessionIdleTimeout(2592000) // 30 Days
-                    .setSsoSessionMaxLifespan(86313600) // 999 Days
-                    .update()
+                        .setSsoSessionIdleTimeout(2592000) // 30 Days
+                        .setSsoSessionMaxLifespan(86313600) // 999 Days
+                        .update()
                 )
                 .addCleanup(ClientAttributeUpdater.forClient(adminClient, "test", "test-app")
-                    .setAttribute(CLIENT_SESSION_IDLE_TIMEOUT, "60") // 1 minute
-                    .setAttribute(CLIENT_SESSION_MAX_LIFESPAN, "65") // 1 minute 5 seconds
-                    .update()
+                        .setAttribute(CLIENT_SESSION_IDLE_TIMEOUT, "60") // 1 minute
+                        .setAttribute(CLIENT_SESSION_MAX_LIFESPAN, "65") // 1 minute 5 seconds
+                        .update()
                 );
 
         getTestingClient().testing().setTestingInfinispanTimeService();
         try {
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response = oauth.doAccessTokenRequest(code);
             assertEquals(200, response.getStatusCode());
             assertExpiration(response.getExpiresIn(), 65);
 
             setTimeOffset(70);
 
             oauth.openLoginForm();
-            code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            OAuthClient.AccessTokenResponse response2 = oauth.doAccessTokenRequest(code, "password");
+            code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse response2 = oauth.doAccessTokenRequest(code);
             assertExpiration(response2.getExpiresIn(), 65);
         } finally {
             getTestingClient().testing().revertTestingInfinispanTimeService();
@@ -1997,15 +2141,15 @@ public void refreshTokenRequestNoRefreshToken() {
 
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         String refreshTokenString = tokenResponse.getRefreshToken();
 
         clientRepresentation.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "false");
         client.update(clientRepresentation);
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshTokenString);
 
         assertNotNull(response.getAccessToken());
         assertNull(response.getRefreshToken());
@@ -2095,9 +2239,9 @@ private void refreshToken(String expectedRefreshAlg, String expectedAccessAlg, S
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         JWSHeader header = new JWSInput(tokenResponse.getAccessToken()).getHeader();
         assertEquals(expectedAccessAlg, header.getAlgorithm().name());
@@ -2126,7 +2270,7 @@ private void refreshToken(String expectedRefreshAlg, String expectedAccessAlg, S
 
         assertEquals(sessionId, refreshToken.getSessionState());
 
-        OAuthClient.AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshTokenString, "password");
+        AccessTokenResponse response = oauth.doRefreshTokenRequest(refreshTokenString);
         if (response.getError() != null || response.getErrorDescription() != null) {
             log.debugf("Refresh token error: %s, error description: %s", response.getError(), response.getErrorDescription());
         }
@@ -2160,8 +2304,8 @@ private String loginAndForceNewLoginPage() {
 
         String sessionId = loginEvent.getSessionId();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         events.poll();
 
@@ -2171,9 +2315,9 @@ private String loginAndForceNewLoginPage() {
         processExpectedValidRefresh(sessionId, refreshTokenParsed1, refreshToken);
 
         // Open the tab with prompt=login. AuthenticationSession will be created with same ID like userSession
-        String loginFormUri = UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
-                .build().toString();
+        String loginFormUri = oauth.loginForm()
+                .param(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
+                .build();
         driver.navigate().to(loginFormUri);
 
         loginPage.assertCurrent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ResourceOwnerPasswordCredentialsGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ResourceOwnerPasswordCredentialsGrantTest.java
index 16ab015f931e..832eb9c0a094 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ResourceOwnerPasswordCredentialsGrantTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ResourceOwnerPasswordCredentialsGrantTest.java
@@ -17,7 +17,9 @@
 
 package org.keycloak.testsuite.oauth;
 
-import org.apache.http.HttpResponse;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.apache.http.NameValuePair;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
 import org.apache.http.client.methods.HttpPost;
@@ -58,16 +60,14 @@
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RealmManager;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.UserManager;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
 
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -207,9 +207,9 @@ public void grantAccessTokenWithDynamicScope() throws Exception {
         }
 
         oauth.scope("dynamic-scope:123");
-        oauth.clientId("resource-owner-public");
+        oauth.client("resource-owner-public");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("direct-login", "password");
 
         assertTrue(response.getScope().contains("dynamic-scope:123"));
 
@@ -238,8 +238,8 @@ public void grantAccessTokenWithDynamicScope() throws Exception {
     @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
     public void grantAccessTokenWithUnassignedDynamicScope() throws Exception {
         oauth.scope("unknown-scope:123");
-        oauth.clientId("resource-owner-public");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login", "password");
+        oauth.client("resource-owner-public");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("direct-login", "password");
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_scope", response.getError());
         assertEquals("Invalid scopes: unknown-scope:123", response.getErrorDescription());
@@ -255,19 +255,19 @@ public void grantAccessTokenWithMultipleTotp() throws Exception {
         // Confirm user can login with 1-th OTP since it's the preferred credential
         grantAccessToken(userIdMultipleOTPs, "direct-login-multiple-otps", "resource-owner", totp.generateTOTP("firstOTPIsPreferredCredential"));
         // For remaining OTP tokens HTTP 401 "Unauthorized" is the allowed / expected response
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
         for (int i = 2; i <= 10; i++) {
             String otp = totp.generateTOTP(String.format("%s-th OTP authenticator", i));
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login-multiple-otps", "password", otp);
+            AccessTokenResponse response = oauth.passwordGrantRequest("direct-login-multiple-otps", "password").otp(otp).send();
             assertEquals(401, response.getStatusCode());
         }
     }
 
     @Test
     public void grantAccessTokenMissingTotp() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login-otp", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("direct-login-otp", "password");
 
         assertEquals(401, response.getStatusCode());
 
@@ -286,9 +286,9 @@ public void grantAccessTokenMissingTotp() throws Exception {
     public void grantAccessTokenInvalidTotp() throws Exception {
         int authSessionsBefore = getAuthenticationSessionsCount();
 
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login-otp", "password", totp.generateTOTP("totpSecret2"));
+        AccessTokenResponse response = oauth.passwordGrantRequest("direct-login-otp", "password").otp(totp.generateTOTP("totpSecret2")).send();
 
         assertEquals(401, response.getStatusCode());
 
@@ -311,9 +311,9 @@ private void grantAccessToken(String login, String clientId) throws Exception {
     }
 
     private void grantAccessToken(String userId, String login, String clientId, String otp) throws Exception {
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", login, "password", otp);
+        AccessTokenResponse response = oauth.passwordGrantRequest( login, "password").otp(otp).send();
 
         assertEquals(200, response.getStatusCode());
 
@@ -337,7 +337,7 @@ private void grantAccessToken(String userId, String login, String clientId, Stri
 
         assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
 
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
@@ -374,9 +374,9 @@ private void grantRequest(String expectedRefreshAlg, String expectedAccessAlg) t
         String clientId = "resource-owner";
         String login = "direct-login";
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", login, "password", null);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(login, "password");
 
         assertEquals(200, response.getStatusCode());
 
@@ -410,7 +410,7 @@ private void grantRequest(String expectedRefreshAlg, String expectedAccessAlg) t
 
         assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
 
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
@@ -423,9 +423,9 @@ private void grantRequest(String expectedRefreshAlg, String expectedAccessAlg) t
 
     @Test
     public void grantAccessTokenLogout() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(200, response.getStatusCode());
 
@@ -444,11 +444,11 @@ public void grantAccessTokenLogout() throws Exception {
                 .detail(Details.CLIENT_AUTH_METHOD, ClientIdAndSecretAuthenticator.PROVIDER_ID)
                 .assertEvent();
 
-        HttpResponse logoutResponse = oauth.doLogout(response.getRefreshToken(), "secret");
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        LogoutResponse logoutResponse = oauth.doLogout(response.getRefreshToken());
+        assertTrue(logoutResponse.isSuccess());
         events.expectLogout(accessToken.getSessionState()).client("resource-owner").removeDetail(Details.REDIRECT_URI).assertEvent();
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
 
@@ -462,9 +462,9 @@ public void grantAccessTokenLogout() throws Exception {
 
     @Test
     public void grantAccessTokenInvalidClientCredentials() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "invalid");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("invalid", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(401, response.getStatusCode());
 
@@ -481,9 +481,9 @@ public void grantAccessTokenInvalidClientCredentials() throws Exception {
 
     @Test
     public void grantAccessTokenMissingClientCredentials() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", null);
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(null, "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(401, response.getStatusCode());
 
@@ -503,9 +503,9 @@ public void grantAccessTokenClientNotAllowed() throws Exception {
 
         ClientManager.realm(adminClient.realm("test")).clientId("resource-owner").directAccessGrant(false);
 
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(400, response.getStatusCode());
 
@@ -530,9 +530,9 @@ public void grantAccessTokenVerifyEmail() throws Exception {
         RealmResource realmResource = adminClient.realm("test");
         RealmManager.realm(realmResource).verifyEmail(true);
 
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(400, response.getStatusCode());
 
@@ -560,9 +560,9 @@ public void grantAccessTokenVerifyEmailInvalidPassword() throws Exception {
         RealmResource realmResource = adminClient.realm("test");
         RealmManager.realm(realmResource).verifyEmail(true);
 
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "bad-password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "bad-password");
 
         assertEquals(401, response.getStatusCode());
 
@@ -593,9 +593,9 @@ public void grantAccessTokenExpiredPassword() throws Exception {
         try {
             setTimeOffset(60 * 60 * 48);
 
-            oauth.clientId("resource-owner");
+            oauth.client("resource-owner", "secret");
 
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
             assertEquals(400, response.getStatusCode());
 
@@ -627,9 +627,9 @@ public void grantAccessTokenExpiredPasswordInvalidPassword() throws Exception {
         try {
             setTimeOffset(60 * 60 * 48);
 
-            oauth.clientId("resource-owner");
+            oauth.client("resource-owner", "secret");
 
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "bad-password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "bad-password");
 
             assertEquals(401, response.getStatusCode());
 
@@ -686,9 +686,9 @@ private interface RunnableWithException {
 
     @Test
     public void grantAccessTokenInvalidUserCredentials() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "test-user@localhost", "invalid");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "invalid");
 
         assertEquals(401, response.getStatusCode());
 
@@ -708,9 +708,9 @@ public void grantAccessTokenInvalidUserCredentials() throws Exception {
 
     @Test
     public void grantAccessTokenUserNotFound() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "invalid", "invalid");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("invalid", "invalid");
 
         assertEquals(401, response.getStatusCode());
 
@@ -731,12 +731,12 @@ public void grantAccessTokenUserNotFound() throws Exception {
 
     @Test
     public void grantAccessTokenMissingGrantType() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getResourceOwnerPasswordCredentialGrantUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getToken());
             post.addHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED);
-            OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(client.execute(post));
+            AccessTokenResponse response = new AccessTokenResponse(client.execute(post));
 
             assertEquals(400, response.getStatusCode());
 
@@ -747,15 +747,15 @@ public void grantAccessTokenMissingGrantType() throws Exception {
 
     @Test
     public void grantAccessTokenUnsupportedGrantType() throws Exception {
-        oauth.clientId("resource-owner");
+        oauth.client("resource-owner", "secret");
 
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getResourceOwnerPasswordCredentialGrantUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getToken());
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, "unsupported_grant_type"));
             UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
             post.setEntity(formEntity);
-            OAuthClient.AccessTokenResponse response = new OAuthClient.AccessTokenResponse(client.execute(post));
+            AccessTokenResponse response = new AccessTokenResponse(client.execute(post));
 
             assertEquals(400, response.getStatusCode());
 
@@ -766,8 +766,8 @@ public void grantAccessTokenUnsupportedGrantType() throws Exception {
 
     @Test
     public void grantAccessTokenNoRefreshToken() throws Exception {
-        oauth.clientId("resource-owner-refresh");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "direct-login", "password", null);
+        oauth.client("resource-owner-refresh", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("direct-login", "password");
 
         assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java
index 8071d4764028..b394a3ece0b3 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ServiceAccountTest.java
@@ -19,13 +19,12 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import org.apache.http.HttpResponse;
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.hamcrest.Matchers;
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.ExpectedException;
+import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthenticator;
 import org.keycloak.common.constants.ServiceAccountConstants;
@@ -38,6 +37,7 @@
 import org.keycloak.models.Constants;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
 import org.keycloak.protocol.oidc.mappers.SHA256PairwiseSubMapper;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.RefreshToken;
@@ -52,13 +52,14 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserBuilder;
 
 import jakarta.ws.rs.ClientErrorException;
-import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
+
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
@@ -72,6 +73,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertTrue;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -161,9 +163,9 @@ public void importTestRealms() {
 
     @Test
     public void clientCredentialsAuthSuccess() throws Exception {
-        oauth.clientId("service-account-cl-refresh-on");
+        oauth.client("service-account-cl-refresh-on", "secret1");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
 
@@ -192,7 +194,7 @@ public void clientCredentialsAuthSuccess() throws Exception {
         Assert.assertTrue(accessToken.getOtherClaims().containsKey(ServiceAccountConstants.CLIENT_ADDRESS));
         Assert.assertTrue(accessToken.getOtherClaims().containsKey(ServiceAccountConstants.CLIENT_HOST));
 
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
@@ -206,10 +208,10 @@ public void clientCredentialsAuthSuccess() throws Exception {
     // This is for the backwards compatibility only. By default, there won't be refresh token and hence there won't be availability for the logout
     @Test
     public void clientCredentialsLogout() throws Exception {
-        oauth.clientId("service-account-cl-refresh-on");
+        oauth.client("service-account-cl-refresh-on", "secret1");
         events.clear();
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
 
@@ -226,15 +228,15 @@ public void clientCredentialsLogout() throws Exception {
                 .detail(Details.CLIENT_AUTH_METHOD, ClientIdAndSecretAuthenticator.PROVIDER_ID)
                 .assertEvent();
 
-        HttpResponse logoutResponse = oauth.doLogout(response.getRefreshToken(), "secret1");
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        LogoutResponse logoutResponse = oauth.doLogout(response.getRefreshToken());
+        assertTrue(logoutResponse.isSuccess());
         events.expectLogout(accessToken.getSessionState())
                 .client("service-account-cl-refresh-on")
                 .user(userIdClRefreshOn)
                 .removeDetail(Details.REDIRECT_URI)
                 .assertEvent();
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
         assertEquals("invalid_grant", response.getError());
 
@@ -248,9 +250,9 @@ public void clientCredentialsLogout() throws Exception {
 
     @Test
     public void clientCredentialsInvalidClientCredentials() throws Exception {
-        oauth.clientId("service-account-cl");
+        oauth.client("service-account-cl", "secret2");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret2");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(401, response.getStatusCode());
 
@@ -267,9 +269,9 @@ public void clientCredentialsInvalidClientCredentials() throws Exception {
 
     @Test
     public void clientCredentialsDisabledServiceAccount() throws Exception {
-        oauth.clientId("service-account-disabled");
+        oauth.client("service-account-disabled", "secret1");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(401, response.getStatusCode());
 
@@ -291,9 +293,9 @@ public void changeClientIdTest() throws Exception {
 
         ClientManager.realm(adminClient.realm("test")).clientId("service-account-cl-refresh-on").renameTo("updated-client");
 
-        oauth.clientId("updated-client");
+        oauth.client("updated-client", "secret1");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
 
@@ -317,13 +319,13 @@ public void changeClientIdTest() throws Exception {
     @Test
     public void refreshTokenRefreshForDisabledServiceAccount() throws Exception {
         try {
-            oauth.clientId("service-account-cl");
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+            oauth.client("service-account-cl", "secret1");
+            AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
             assertEquals(200, response.getStatusCode());
 
             ClientManager.realm(adminClient.realm("test")).clientId("service-account-cl").setServiceAccountsEnabled(false);
 
-            response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
             assertEquals(400, response.getStatusCode());
         }
         finally {
@@ -363,12 +365,11 @@ public void failManagePassword() {
     @Test
     public void clientCredentialsAuthSuccessWithoutRefreshToken_revokeToken() throws Exception {
         String tokenString = clientCredentialsAuthSuccessWithoutRefreshTokenImpl();
+        oauth.client("service-account-cl", "secret1");
         AccessToken accessToken = oauth.verifyToken(tokenString);
 
         // Revoke access token
-        CloseableHttpResponse response1 = oauth.doTokenRevoke(tokenString, "access_token", "secret1");
-        assertThat(response1, org.keycloak.testsuite.util.Matchers.statusCodeIsHC(Response.Status.OK));
-        response1.close();
+        assertTrue(oauth.tokenRevocationRequest(tokenString).accessToken().send().isSuccess());
 
         events.expect(EventType.REVOKE_GRANT)
                 .client("service-account-cl")
@@ -378,14 +379,15 @@ public void clientCredentialsAuthSuccessWithoutRefreshToken_revokeToken() throws
                 .assertEvent();
 
         // Check that it is not possible to introspect token anymore
-        Assert.assertFalse(getIntrospectionResponse("service-account-cl", "secret1", tokenString));
-        // TODO: This would be better to be "INTROSPECT_TOKEN_ERROR"
+        Assert.assertFalse(getIntrospectionResponse(tokenString));
+
         events.expect(EventType.INTROSPECT_TOKEN_ERROR)
                 .client("service-account-cl")
                 .user(is(emptyOrNullString()))
                 .session(is(emptyOrNullString()))
-                .error(Errors.TOKEN_INTROSPECTION_FAILED)
+                .error(Errors.INVALID_TOKEN)
                 .assertEvent();
+        events.assertEmpty();
     }
 
     @Test
@@ -403,8 +405,8 @@ public void clientCredentialsAuthSuccessWithoutRefreshToken_pairWiseSubject() th
 
     // Returns accessToken string
     private String clientCredentialsAuthSuccessWithoutRefreshTokenImpl() throws Exception {
-        oauth.clientId("service-account-cl");
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("service-account-cl", "secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
         String tokenString = response.getAccessToken();
@@ -414,10 +416,15 @@ private String clientCredentialsAuthSuccessWithoutRefreshTokenImpl() throws Exce
         Assert.assertNull(accessToken.getSessionState());
         Assert.assertNull("Refresh-Token should not be present", response.getRefreshToken());
 
+        AccessTokenContext ctx = testingClient.testing("test").getTokenContext(accessToken.getId());
+        Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.TRANSIENT);
+        Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.REGULAR);
+        Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.CLIENT_CREDENTIALS);
+
         events.expectClientLogin()
                 .client("service-account-cl")
                 .user(userIdCl)
-                .session(AssertEvents.isUUID())
+                .session(is(emptyOrNullString()))
                 .detail(Details.TOKEN_ID, accessToken.getId())
                 .detail(Details.USERNAME, ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + "service-account-cl")
                 .assertEvent();
@@ -427,20 +434,18 @@ private String clientCredentialsAuthSuccessWithoutRefreshTokenImpl() throws Exce
         assertThat(clientSessionStats, empty());
 
         // Check that token is possible to introspect
-        Assert.assertTrue(getIntrospectionResponse("service-account-cl", "secret1", tokenString));
+        Assert.assertTrue(getIntrospectionResponse(tokenString));
         events.expect(EventType.INTROSPECT_TOKEN)
                 .client("service-account-cl")
-                .user(is(emptyOrNullString()))
+                .user(AssertEvents.isUUID())
                 .session(is(emptyOrNullString()))
                 .assertEvent();
 
         return tokenString;
     }
 
-    private boolean getIntrospectionResponse(String clientId, String clientSecret, String tokenString) throws IOException {
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, clientSecret, tokenString);
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(introspectionResponse);
+    private boolean getIntrospectionResponse(String tokenString) throws IOException {
+        JsonNode jsonNode = oauth.doIntrospectionAccessTokenRequest(tokenString).asJsonNode();
         return jsonNode.get("active").asBoolean();
     }
 
@@ -459,9 +464,9 @@ private void conductClientCredentialsAuthRequestWithRefreshToken(String expected
 
     // Testing of refresh token is for backwards compatibility. By default, there won't be refresh token for the client credentials grant
     private void clientCredentialsAuthSuccessWithRefreshToken(String expectedRefreshAlg, String expectedAccessAlg) throws Exception {
-        oauth.clientId("service-account-cl-refresh-on");
+        oauth.client("service-account-cl-refresh-on", "secret1");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
 
@@ -493,7 +498,7 @@ private void clientCredentialsAuthSuccessWithRefreshToken(String expectedRefresh
         Assert.assertTrue(accessToken.getOtherClaims().containsKey(ServiceAccountConstants.CLIENT_ADDRESS));
         Assert.assertTrue(accessToken.getOtherClaims().containsKey(ServiceAccountConstants.CLIENT_HOST));
 
-        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "secret1");
+        AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
         RefreshToken refreshedRefreshToken = oauth.parseRefreshToken(refreshedResponse.getRefreshToken());
@@ -506,29 +511,29 @@ private void clientCredentialsAuthSuccessWithRefreshToken(String expectedRefresh
 
     @Test
     public void userInfoForServiceAccountWithoutRefreshTokenImpl() throws Exception {
-        oauth.clientId("service-account-cl");
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("service-account-cl", "secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
         assertEquals(200, response.getStatusCode());
         assertNull(response.getRefreshToken());
 
-        UserInfo info = oauth.doUserInfoRequest(response.getAccessToken());
+        UserInfo info = oauth.doUserInfoRequest(response.getAccessToken()).getUserInfo();
         assertEquals(200, response.getStatusCode());
         assertEquals("service-account-service-account-cl", info.getPreferredUsername());
     }
 
     @Test
     public void userInfoForServiceAccountWithRefreshTokenImpl() throws Exception {
-        oauth.clientId("service-account-cl-refresh-on");
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
+        oauth.client("service-account-cl-refresh-on", "secret1");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
         assertEquals(200, response.getStatusCode());
         assertNotNull(response.getRefreshToken());
 
-        UserInfo info = oauth.doUserInfoRequest(response.getAccessToken());
+        UserInfo info = oauth.doUserInfoRequest(response.getAccessToken()).getUserInfo();
         assertEquals(200, response.getStatusCode());
         assertEquals("service-account-service-account-cl-refresh-on", info.getPreferredUsername());
 
-        HttpResponse logoutResponse = oauth.doLogout(response.getRefreshToken(), "secret1");
-        assertEquals(204, logoutResponse.getStatusLine().getStatusCode());
+        LogoutResponse logoutResponse = oauth.doLogout(response.getRefreshToken());
+        assertTrue(logoutResponse.isSuccess());
     }
 
     /**
@@ -536,9 +541,9 @@ public void userInfoForServiceAccountWithRefreshTokenImpl() throws Exception {
      */
     @Test
     public void clientCredentialsAuthSuccessWithUrlEncodedSpecialCharactersSecret() throws Exception {
-        oauth.clientId("service-account-cl-special-secrets");
+        oauth.client("service-account-cl-special-secrets", "secret/with=special?character");
 
-        OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest("secret/with=special?character");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
 
         assertEquals(200, response.getStatusCode());
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenEndpointCorsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenEndpointCorsTest.java
index 50347b560d2f..c5f4f1654b3c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenEndpointCorsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenEndpointCorsTest.java
@@ -1,19 +1,24 @@
 package org.keycloak.testsuite.oauth;
 
+import org.apache.http.Header;
 import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpOptions;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.OAuth2Constants;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.services.cors.Cors;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 
+import java.io.IOException;
 import java.util.Arrays;
-import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
@@ -45,10 +50,8 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
 
     @Test
     public void preflightRequest() throws Exception {
-        CloseableHttpResponse response = oauth.doPreflightRequest();
-
-        String[] methods = response.getHeaders("Access-Control-Allow-Methods")[0].getValue().split(", ");
-        Set allowedMethods = new HashSet(Arrays.asList(methods));
+        Map<String, String> responseHeaders = getTokenEndpointPreflightResponseHeaders(oauth);
+        Set<String> allowedMethods = Arrays.stream(responseHeaders.get(Cors.ACCESS_CONTROL_ALLOW_METHODS).split(", ")).collect(Collectors.toSet());
 
         assertEquals(2, allowedMethods.size());
         assertTrue(allowedMethods.containsAll(Arrays.asList("POST", "OPTIONS")));
@@ -57,36 +60,35 @@ public void preflightRequest() throws Exception {
     @Test
     public void accessTokenCorsRequest() throws Exception {
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2", "password");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
-        oauth.postLogoutRedirectUri(VALID_CORS_URL + "/realms/master/app");
 
         oauth.doLogin("test-user@localhost", "password");
 
         // Token request
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         oauth.origin(VALID_CORS_URL);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         assertCors(response);
 
         // Refresh request
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
 
         assertEquals(200, response.getStatusCode());
         assertCors(response);
 
         // Invalid origin
         oauth.origin(INVALID_CORS_URL);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(200, response.getStatusCode());
         assertNotCors(response);
         oauth.origin(VALID_CORS_URL);
 
         // No session
-        oauth.idTokenHint(response.getIdToken()).openLogout();
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), null);
+        oauth.logoutForm().idTokenHint(response.getIdToken()).open();
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertEquals(400, response.getStatusCode());
         assertCors(response);
         assertEquals("invalid_grant", response.getError());
@@ -100,13 +102,13 @@ public void accessTokenResourceOwnerCorsRequest() throws Exception {
         oauth.origin(VALID_CORS_URL);
 
         // Token request
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         assertEquals(200, response.getStatusCode());
         assertCors(response);
 
         // Invalid password
-        response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "invalid");
+        response = oauth.doPasswordGrantRequest("test-user@localhost", "invalid");
 
         assertEquals(401, response.getStatusCode());
         assertCors(response);
@@ -115,35 +117,50 @@ public void accessTokenResourceOwnerCorsRequest() throws Exception {
     @Test
     public void accessTokenWithConfidentialClientCorsRequest() throws Exception {
         oauth.realm("test");
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.origin(VALID_CORS_URL);
 
         // Successful token request with correct origin - cors should work
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, response.getStatusCode());
         assertCors(response);
 
+        oauth.client("direct-grant", "invalid");
+
         // Invalid client authentication with correct origin - cors should work
-        response = oauth.doGrantAccessTokenRequest("invalid", "test-user@localhost", "password");
+        response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(401, response.getStatusCode());
         assertCors(response);
 
+        oauth.client("direct-grant", "password");
+
         // Successful token request with bad origin - cors should NOT work
         oauth.origin(INVALID_CORS_URL);
-        response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, response.getStatusCode());
         assertNotCors(response);
     }
 
-    private static void assertCors(OAuthClient.AccessTokenResponse response) {
+    private static void assertCors(AccessTokenResponse response) {
         assertEquals("true", response.getHeaders().get("Access-Control-Allow-Credentials"));
         assertEquals(VALID_CORS_URL, response.getHeaders().get("Access-Control-Allow-Origin"));
         assertEquals("Access-Control-Allow-Methods", response.getHeaders().get("Access-Control-Expose-Headers"));
     }
 
-    private static void assertNotCors(OAuthClient.AccessTokenResponse response) {
+    private static void assertNotCors(AccessTokenResponse response) {
         assertNull(response.getHeaders().get("Access-Control-Allow-Credentials"));
         assertNull(response.getHeaders().get("Access-Control-Allow-Origin"));
         assertNull(response.getHeaders().get("Access-Control-Expose-Headers"));
     }
+
+    public static Map<String, String> getTokenEndpointPreflightResponseHeaders(OAuthClient oAuthClient) {
+        HttpOptions options = new HttpOptions(oAuthClient.getEndpoints().getToken());
+        options.setHeader("Origin", "http://example.com");
+        try (CloseableHttpResponse response = oAuthClient.httpClient().get().execute(options)) {
+            return Arrays.stream(response.getAllHeaders()).collect(Collectors.toMap(Header::getName, Header::getValue));
+        } catch (IOException ioe) {
+            throw new RuntimeException(ioe);
+        }
+    }
+
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java
index 94cb88c9e7f8..afb0e6193419 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java
@@ -20,7 +20,6 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.TextNode;
 
-import jakarta.ws.rs.core.HttpHeaders;
 import org.apache.commons.io.output.ByteArrayOutputStream;
 import org.apache.http.NameValuePair;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
@@ -28,6 +27,7 @@
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.impl.client.HttpClientBuilder;
 import org.apache.http.message.BasicNameValuePair;
+import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Rule;
 import org.junit.Test;
@@ -36,6 +36,7 @@
 import org.keycloak.admin.client.resource.ClientScopesResource;
 import org.keycloak.crypto.Algorithm;
 import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.models.Constants;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
@@ -56,17 +57,13 @@
 import org.keycloak.testsuite.oidc.AbstractOIDCScopeTest;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
-import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.oauth.IntrospectionResponse;
 import org.keycloak.util.BasicAuthHelper;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
 
-import jakarta.ws.rs.core.UriBuilder;
-import org.keycloak.utils.MediaType;
-
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.LinkedList;
@@ -154,11 +151,19 @@ protected void afterAbstractKeycloakTestRealmImport() {
     @Test
     public void testConfidentialClientCredentialsBasicAuthentication() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("confidential-cli", "secret1");
+        events.clear();
+
+        IntrospectionResponse introspectionResponse = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken());
+        events.expect(EventType.INTROSPECT_TOKEN)
+                .client("confidential-cli")
+                .session(accessTokenResponse.getSessionState())
+                .assertEvent();
+        events.assertEmpty();
+
+        JsonNode jsonNode = introspectionResponse.asJsonNode();
 
         assertTrue(jsonNode.get("active").asBoolean());
         assertEquals("test-user@localhost", jsonNode.get("username").asText());
@@ -171,7 +176,7 @@ public void testConfidentialClientCredentialsBasicAuthentication() throws Except
         assertTrue(jsonNode.has("iss"));
         assertTrue(jsonNode.has("jti"));
 
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        TokenMetadataRepresentation rep = introspectionResponse.asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -195,27 +200,32 @@ public void testConfidentialClientCredentialsBasicAuthentication() throws Except
     @Test
     public void testInvalidClientCredentials() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "bad_credential", accessTokenResponse.getAccessToken());
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("confidential-cli", "bad_credential");
+        IntrospectionResponse tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken());
 
-        OAuth2ErrorRepresentation errorRep = JsonSerialization.readValue(tokenResponse, OAuth2ErrorRepresentation.class);
-        Assert.assertEquals("Authentication failed.", errorRep.getErrorDescription());
-        Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, errorRep.getError());
+        Assert.assertEquals("Authentication failed.", tokenResponse.getErrorDescription());
+        Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, tokenResponse.getError());
     }
 
     @Test
     public void testIntrospectRefreshToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getRefreshToken());
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("confidential-cli", "secret1");
+        events.clear();
+
+        JsonNode jsonNode = oauth.doIntrospectionRefreshTokenRequest(accessTokenResponse.getRefreshToken()).asJsonNode();
+        events.expect(EventType.INTROSPECT_TOKEN)
+                .client("confidential-cli")
+                .session(sessionId)
+                .assertEvent();
+        events.assertEmpty();
 
-        assertTrue(jsonNode.get("active").asBoolean());
         assertEquals(sessionId, jsonNode.get("sid").asText());
         assertEquals("test-app", jsonNode.get("client_id").asText());
         assertTrue(jsonNode.has("exp"));
@@ -226,18 +236,6 @@ public void testIntrospectRefreshToken() throws Exception {
         assertTrue(jsonNode.has("iss"));
         assertTrue(jsonNode.has("jti"));
         assertTrue(jsonNode.has("typ"));
-
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
-
-        assertTrue(rep.isActive());
-        assertEquals("test-app", rep.getClientId());
-        assertEquals(jsonNode.get("sid").asText(), rep.getSessionState());
-        assertEquals(Long.valueOf(jsonNode.get("exp").asLong()), rep.getExp());
-        assertEquals(Long.valueOf(jsonNode.get("iat").asLong()), rep.getIat());
-        assertEquals(Optional.ofNullable(jsonNode.get("nbf")).map(JsonNode::asLong).orElse(null), rep.getNbf());
-        assertEquals(jsonNode.get("iss").asText(), rep.getIssuer());
-        assertEquals(jsonNode.get("jti").asText(), rep.getId());
-        assertEquals(jsonNode.get("typ").asText(), "Refresh");
     }
 
     @Test
@@ -245,7 +243,7 @@ public void testIntrospectRefreshTokenAfterUserSessionLogoutAndLoginAgain() thro
         AccessTokenResponse accessTokenResponse = loginAndForceNewLoginPage();
         String refreshToken1 = accessTokenResponse.getRefreshToken();
 
-        oauth.doLogout(refreshToken1, "password");
+        oauth.doLogout(refreshToken1);
         events.clear();
 
         setTimeOffset(2);
@@ -256,18 +254,15 @@ public void testIntrospectRefreshTokenAfterUserSessionLogoutAndLoginAgain() thro
 
         Assert.assertFalse(loginPage.isCurrent());
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse2 = oauth.doAccessTokenRequest(code);
 
-        String introspectResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1", tokenResponse2.getRefreshToken());
+        oauth.client("confidential-cli", "secret1");
 
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(introspectResponse);
+        JsonNode jsonNode = oauth.doIntrospectionRefreshTokenRequest(tokenResponse2.getRefreshToken()).asJsonNode();
         assertTrue(jsonNode.get("active").asBoolean());
 
-        introspectResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1", refreshToken1);
-
-        jsonNode = objectMapper.readTree(introspectResponse);
+        jsonNode = oauth.doIntrospectionRefreshTokenRequest(refreshToken1).asJsonNode();
         assertFalse(jsonNode.get("active").asBoolean());
     }
 
@@ -275,26 +270,21 @@ public void testIntrospectRefreshTokenAfterUserSessionLogoutAndLoginAgain() thro
     public void testPublicClientCredentialsNotAllowed() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("public-cli", "it_doesnt_matter", accessTokenResponse.getAccessToken());
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("public-cli");
+        IntrospectionResponse tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken());
 
-        OAuth2ErrorRepresentation errorRep = JsonSerialization.readValue(tokenResponse, OAuth2ErrorRepresentation.class);
-        Assert.assertEquals("Client not allowed.", errorRep.getErrorDescription());
-        Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, errorRep.getError());
+        Assert.assertEquals("Client not allowed.", tokenResponse.getErrorDescription());
+        Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, tokenResponse.getError());
     }
 
     @Test
     public void testInactiveAccessToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
         String inactiveAccessToken = "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJqdGkiOiI5NjgxZTRlOC01NzhlLTQ3M2ItOTIwNC0yZWE5OTdhYzMwMTgiLCJleHAiOjE0NzYxMDY4NDksIm5iZiI6MCwiaWF0IjoxNDc2MTA2NTQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgxODAvYXV0aC9yZWFsbXMvdGVzdCIsImF1ZCI6InRlc3QtYXBwIiwic3ViIjoiZWYyYzk0NjAtZDRkYy00OTk5LWJlYmUtZWVmYWVkNmJmMGU3IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoidGVzdC1hcHAiLCJhdXRoX3RpbWUiOjE0NzYxMDY1NDksInNlc3Npb25fc3RhdGUiOiI1OGY4M2MzMi03MDhkLTQzNjktODhhNC05YjI5OGRjMDY5NzgiLCJhY3IiOiIxIiwiY2xpZW50X3Nlc3Npb24iOiI2NTYyOTVkZC1kZWNkLTQyZDAtYWJmYy0zZGJjZjJlMDE3NzIiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDo4MTgwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJ1c2VyIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsidGVzdC1hcHAiOnsicm9sZXMiOlsiY3VzdG9tZXItdXNlciJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsInZpZXctcHJvZmlsZSJdfX0sIm5hbWUiOiJUb20gQnJhZHkiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0LXVzZXJAbG9jYWxob3N0IiwiZ2l2ZW5fbmFtZSI6IlRvbSIsImZhbWlseV9uYW1lIjoiQnJhZHkiLCJlbWFpbCI6InRlc3QtdXNlckBsb2NhbGhvc3QifQ.LYU7opqZsc9e-ZmdsIhcecjHL3kQkpP13VpwO4MHMqEVNeJsZI1WOkTM5HGVAihcPfQazhaYvcik0gFTF_6ZcKzDqanjx80TGhSIrV5FoCeUrbp7w_66VKDH7ImPc8T2kICQGHh2d521WFBnvXNifw7P6AR1rGg4qrUljHdf_KU";
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", inactiveAccessToken);
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
-
-        assertFalse(jsonNode.get("active").asBoolean());
-
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(inactiveAccessToken).asTokenMetadata();
 
         assertFalse(rep.isActive());
         assertNull(rep.getUserName());
@@ -306,13 +296,8 @@ public void testInactiveAccessToken() throws Exception {
     public void testUnsupportedToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
         String inactiveAccessToken = "unsupported";
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", inactiveAccessToken);
-        ObjectMapper objectMapper = new ObjectMapper();
-        JsonNode jsonNode = objectMapper.readTree(tokenResponse);
-
-        assertFalse(jsonNode.get("active").asBoolean());
-
-        TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(inactiveAccessToken).asTokenMetadata();
 
         assertFalse(rep.isActive());
         assertNull(rep.getUserName());
@@ -323,11 +308,11 @@ public void testUnsupportedToken() throws Exception {
     @Test
     public void testIntrospectAccessToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -340,17 +325,17 @@ public void testIntrospectAccessToken() throws Exception {
 
     @Test
     public void testIntrospectAccessTokenWithoutScope() throws Exception {
-        oauth.clientId("no-scope").openid(false).doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        oauth.client("no-scope", "password").openid(false).doLogin("test-user@localhost", "password");
+        String code = oauth.parseLoginResponse().getCode();
         RealmRepresentation testRealm = adminClient.realm("test").toRepresentation();
         List<ClientScopeRepresentation> preExistingClientScopes = testRealm.getClientScopes();
         testRealm.setClientScopes(List.of());
         adminClient.realm("test").update(testRealm);
         try {
             EventRepresentation loginEvent = events.expectLogin().client("no-scope").assertEvent();
-            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential("no-scope", "password", accessTokenResponse.getAccessToken());
-            TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+            oauth.client("no-scope", "password");
+            TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
             assertTrue(rep.isActive());
             assertEquals("test-user@localhost", rep.getUserName());
@@ -365,15 +350,15 @@ public void testIntrospectAccessTokenWithoutScope() throws Exception {
     @Test
     public void testIntrospectAccessTokenReturnedAsJwt() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-
-        // request the introspection result to be returned as JWT
-        oauth.requestHeaders(Map.of(HttpHeaders.ACCEPT, MediaType.APPLICATION_JWT));
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        TokenMetadataRepresentation rep = oauth.introspectionRequest(accessTokenResponse.getAccessToken())
+                .tokenTypeHint("access_token")
+                .client("confidential-cli", "secret1")
+                .jwtResponse()
+                .send().asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -400,15 +385,14 @@ private void testIntrospectAccessToken(String jwaAlgorithm) throws Exception {
             TokenSignatureUtil.changeClientAccessTokenSignatureProvider(ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app"), jwaAlgorithm);
 
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+            String code = oauth.parseLoginResponse().getCode();
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
-            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
             assertEquals(jwaAlgorithm, new JWSInput(accessTokenResponse.getAccessToken()).getHeader().getAlgorithm().name());
 
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-
-            TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+            oauth.client("confidential-cli", "secret1");
+            TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
             assertTrue(rep.isActive());
             assertEquals("test-user@localhost", rep.getUserName());
@@ -426,12 +410,20 @@ private void testIntrospectAccessToken(String jwaAlgorithm) throws Exception {
     @Test
     public void testIntrospectAccessTokenSessionInvalid() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        oauth.doLogout(accessTokenResponse.getRefreshToken(), "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.doLogout(accessTokenResponse.getRefreshToken());
+        events.clear();
 
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
+        events.expect(EventType.INTROSPECT_TOKEN_ERROR)
+                .client("confidential-cli")
+                .user(Matchers.nullValue(String.class))
+                .session(accessTokenResponse.getSessionState())
+                .error(Errors.USER_SESSION_NOT_FOUND)
+                .assertEvent();
+        events.assertEmpty();
 
         assertFalse(rep.isActive());
         assertNull(rep.getUserName());
@@ -444,15 +436,15 @@ public void testIntrospectAccessTokenSessionInvalid() throws Exception {
     public void testIntrospectAccessTokenOfflineAccess() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
         setTimeOffset(86400);
 
         // "Online" session still exists, but is invalid
-        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -461,9 +453,10 @@ public void testIntrospectAccessTokenOfflineAccess() throws Exception {
         // "Online" session doesn't even exists
         testingClient.testing().removeExpired("test");
 
-        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
-        tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("test-app", "password");
+        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
+        oauth.client("confidential-cli", "secret1");
+        rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -473,14 +466,14 @@ public void testIntrospectAccessTokenOfflineAccess() throws Exception {
     @Test
     public void testIntrospectDoesntExtendTokenLifespan() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
 
         setTimeOffset(1200);
 
-        String tokenResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getRefreshToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionRefreshTokenRequest(accessTokenResponse.getRefreshToken()).asTokenMetadata();
 
         assertTrue(rep.isActive());
         assertEquals("test-user@localhost", rep.getUserName());
@@ -488,7 +481,9 @@ public void testIntrospectDoesntExtendTokenLifespan() throws Exception {
 
         setTimeOffset(1200 + 1200);
 
-        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
+        oauth.client("test-app", "password");
+
+        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
         assertEquals(400, accessTokenResponse.getStatusCode());
         assertEquals("Token is not active", accessTokenResponse.getErrorDescription());
     }
@@ -496,8 +491,8 @@ public void testIntrospectDoesntExtendTokenLifespan() throws Exception {
     @Test
     public void testIntrospectAccessTokenUserDisabled() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
@@ -506,8 +501,8 @@ public void testIntrospectAccessTokenUserDisabled() throws Exception {
             userRep.setEnabled(false);
             adminClient.realm(oauth.getRealm()).users().get(loginEvent.getUserId()).update(userRep);
 
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-            TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+            oauth.client("confidential-cli", "secret1");
+            TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
             assertFalse(rep.isActive());
             assertNull(rep.getUserName());
@@ -522,12 +517,12 @@ public void testIntrospectAccessTokenUserDisabled() throws Exception {
     @Test
     public void testIntrospectAccessTokenExpired() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
         setTimeOffset(adminClient.realm(oauth.getRealm()).toRepresentation().getAccessTokenLifespan() + 1);
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        oauth.client("confidential-cli", "secret1");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken()).asTokenMetadata();
 
         assertFalse(rep.isActive());
         assertNull(rep.getUserName());
@@ -540,31 +535,29 @@ public void testIntrospectAccessTokenExpired() throws Exception {
      * Test covers the same scenario from different endpoints like TokenEndpoint and LogoutEndpoint.
      */
     @Test
-    public void testIntrospectWithSamlClient() throws Exception {
+    public void testIntrospectWithSamlClient() {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         events.expectLogin().assertEvent();
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("saml-client", "secret2", accessTokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
+        oauth.client("saml-client", "secret2");
+        IntrospectionResponse introspectionResponse = oauth.doIntrospectionAccessTokenRequest(accessTokenResponse.getAccessToken());
 
-        assertEquals(Errors.INVALID_CLIENT, rep.getOtherClaims().get("error"));
-        assertNull(rep.getSubject());
+        assertEquals(Errors.INVALID_CLIENT, introspectionResponse.getError());
     }
 
-    private OAuthClient.AccessTokenResponse loginAndForceNewLoginPage() {
+    private AccessTokenResponse loginAndForceNewLoginPage() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.clientSessionState("client-session");
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         setTimeOffset(1);
 
-        String loginFormUri = UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
-                .build().toString();
+        String loginFormUri = oauth.loginForm()
+                .param(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
+                .build();
         driver.navigate().to(loginFormUri);
 
         loginPage.assertCurrent();
@@ -576,10 +569,10 @@ private OAuthClient.AccessTokenResponse loginAndForceNewLoginPage() {
     @Test
     public void testIntrospectionRequestParamsMoreThanOnce() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
 
-        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken(), "password");
+        accessTokenResponse = oauth.doRefreshTokenRequest(accessTokenResponse.getRefreshToken());
         String tokenResponse = introspectAccessTokenWithDuplicateParams("confidential-cli", "secret1", accessTokenResponse.getAccessToken());
 
         OAuth2ErrorRepresentation errorRep = JsonSerialization.readValue(tokenResponse, OAuth2ErrorRepresentation.class);
@@ -624,25 +617,25 @@ public void testIntrospectRefreshTokenAfterRefreshTokenRequest() throws Exceptio
         adminClient.realm(oauth.getRealm()).update(realm);
         try {
             oauth.doLogin("test-user@localhost", "password");
-            String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+            String code = oauth.parseLoginResponse().getCode();
+            AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
             String oldRefreshToken = accessTokenResponse.getRefreshToken();
 
             setTimeOffset(1);
 
-            accessTokenResponse = oauth.doRefreshTokenRequest(oldRefreshToken, "password");
+            accessTokenResponse = oauth.doRefreshTokenRequest(oldRefreshToken);
 
-            accessTokenResponse = oauth.doRefreshTokenRequest(oldRefreshToken, "password");
+            accessTokenResponse = oauth.doRefreshTokenRequest(oldRefreshToken);
             String newRefreshToken = accessTokenResponse.getRefreshToken();
-            String tokenResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1",
-                newRefreshToken);
-            ObjectMapper objectMapper = new ObjectMapper();
-            JsonNode jsonNode = objectMapper.readTree(tokenResponse);
+            oauth.client("confidential-cli", "secret1");
+            JsonNode jsonNode = oauth.doIntrospectionRefreshTokenRequest(newRefreshToken).asJsonNode();
             assertTrue(jsonNode.get("active").asBoolean());
 
-            accessTokenResponse = oauth.doRefreshTokenRequest(newRefreshToken, "password");
-            tokenResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1", oldRefreshToken);
-            jsonNode = objectMapper.readTree(tokenResponse);
+            oauth.client("test-app", "password");
+            accessTokenResponse = oauth.doRefreshTokenRequest(newRefreshToken);
+
+            oauth.client("confidential-cli", "secret1");
+            jsonNode = oauth.doIntrospectionRefreshTokenRequest(oldRefreshToken).asJsonNode();
             assertFalse(jsonNode.get("active").asBoolean());
         } finally {
             realm.setRevokeRefreshToken(false);
@@ -652,7 +645,7 @@ public void testIntrospectRefreshTokenAfterRefreshTokenRequest() throws Exceptio
     }
 
     private String introspectAccessTokenWithDuplicateParams(String clientId, String clientSecret, String tokenToIntrospect) {
-        HttpPost post = new HttpPost(oauth.getTokenIntrospectionUrl());
+        HttpPost post = new HttpPost(oauth.getEndpoints().getIntrospection());
 
         String authorization = BasicAuthHelper.createHeader(clientId, clientSecret);
         post.setHeader("Authorization", authorization);
@@ -677,15 +670,13 @@ private String introspectAccessTokenWithDuplicateParams(String clientId, String
 
     private JsonNode introspectRevokedToken() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse accessTokenResponse = oauth.doAccessTokenRequest(code);
         String stringRefreshToken = accessTokenResponse.getRefreshToken();
 
-        accessTokenResponse = oauth.doRefreshTokenRequest(stringRefreshToken, "password");
+        accessTokenResponse = oauth.doRefreshTokenRequest(stringRefreshToken);
 
-        String tokenResponse = oauth.introspectRefreshTokenWithClientCredential("confidential-cli", "secret1",
-            stringRefreshToken);
-        ObjectMapper objectMapper = new ObjectMapper();
-        return objectMapper.readTree(tokenResponse);
+        oauth.client("confidential-cli", "secret1");
+        return oauth.doIntrospectionRefreshTokenRequest(stringRefreshToken).asJsonNode();
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationCorsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationCorsTest.java
index 3476335228c5..b27f4a917a99 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationCorsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationCorsTest.java
@@ -17,25 +17,23 @@
 
 package org.keycloak.testsuite.oauth;
 
-import static org.junit.Assert.*;
-import static org.keycloak.testsuite.admin.AbstractAdminTest.*;
-
-import java.io.IOException;
-import java.util.List;
-
 import jakarta.ws.rs.core.Response.Status;
-
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.hamcrest.MatcherAssert;
 import org.junit.Test;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.oidc.TokenMetadataRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
-import org.keycloak.util.JsonSerialization;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.TokenRevocationResponse;
+
+import java.io.IOException;
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 
 /**
  * @author <a href="mailto:yoshiyuki.tabata.jy@hitachi.com">Yoshiyuki Tabata</a>
@@ -49,63 +47,59 @@ public class TokenRevocationCorsTest extends AbstractKeycloakTest {
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmRepresentation realm = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
         realm.getClients().add(ClientBuilder.create().redirectUris(VALID_CORS_URL + "/realms/master/app")
-            .addWebOrigin(VALID_CORS_URL).clientId("test-app2").publicClient().directAccessGrants().build());
+            .addWebOrigin(VALID_CORS_URL).clientId("test-app2").secret("password").directAccessGrants().build());
         testRealms.add(realm);
     }
 
     @Test
     public void testTokenRevocationCorsRequestWithValidUrl() throws Exception {
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2", "password");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost",
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         oauth.origin(VALID_CORS_URL);
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        TokenRevocationResponse response = oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send();
+        assertTrue(response.isSuccess());
         assertCors(response);
 
-        isTokenDisabled(tokenResponse, "test-app2");
+        isTokenDisabled(tokenResponse);
     }
 
     @Test
     public void userTokenRevocationCorsRequestWithInvalidUrlShouldFail() throws Exception {
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2", "password");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost",
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         oauth.origin(INVALID_CORS_URL);
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        MatcherAssert.assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        TokenRevocationResponse response = oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send();
+        assertTrue(response.isSuccess());
         assertNotCors(response);
 
-        isTokenDisabled(tokenResponse, "test-app2");
+        isTokenDisabled(tokenResponse);
     }
 
-    private static void assertCors(CloseableHttpResponse response) {
-        assertEquals("true", response.getHeaders("Access-Control-Allow-Credentials")[0].getValue());
-        assertEquals(VALID_CORS_URL, response.getHeaders("Access-Control-Allow-Origin")[0].getValue());
-        assertEquals("Access-Control-Allow-Methods", response.getHeaders("Access-Control-Expose-Headers")[0].getValue());
+    private static void assertCors(TokenRevocationResponse response) {
+        assertEquals("true", response.getHeader("Access-Control-Allow-Credentials"));
+        assertEquals(VALID_CORS_URL, response.getHeader("Access-Control-Allow-Origin"));
+        assertEquals("Access-Control-Allow-Methods", response.getHeader("Access-Control-Expose-Headers"));
     }
 
-    private static void assertNotCors(CloseableHttpResponse response) {
-        assertEquals(0, response.getHeaders("Access-Control-Allow-Credentials").length);
-        assertEquals(0, response.getHeaders("Access-Control-Allow-Origin").length);
-        assertEquals(0, response.getHeaders("Access-Control-Expose-Headers").length);
+    private static void assertNotCors(TokenRevocationResponse response) {
+        assertNull(response.getHeader("Access-Control-Allow-Credentials"));
+        assertNull(response.getHeader("Access-Control-Allow-Origin"));
+        assertNull(response.getHeader("Access-Control-Expose-Headers"));
     }
 
-    private void isTokenDisabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password",
-            tokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
+    private void isTokenDisabled(AccessTokenResponse tokenResponse) throws IOException {
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(tokenResponse.getAccessToken()).asTokenMetadata();
         assertFalse(rep.isActive());
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(),
-            "password");
+        AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertEquals(Status.BAD_REQUEST.getStatusCode(), tokenRefreshResponse.getStatusCode());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationTest.java
index 9b35e23d6349..853164c47dee 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenRevocationTest.java
@@ -69,8 +69,9 @@
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.Matchers;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 import org.keycloak.testsuite.util.InfinispanTestTimeServiceRule;
@@ -130,9 +131,8 @@ public void afterTest() throws IOException {
 
     @Test
     public void testRevokeToken() throws Exception {
-        oauth.clientSessionState("client-session");
-        OAuthClient.AccessTokenResponse tokenResponse1 = login("test-app", "test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse tokenResponse2 = login("test-app-scope", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse1 = login("test-app", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse2 = login("test-app-scope", "test-user@localhost", "password");
 
         UserResource testUser = realm.users().get(realm.users().search("test-user@localhost").get(0).getId());
         List<UserSessionRepresentation> userSessions = testUser.getUserSessions();
@@ -144,9 +144,8 @@ public void testRevokeToken() throws Exception {
         isTokenEnabled(tokenResponse1, "test-app");
         isTokenEnabled(tokenResponse2, "test-app-scope");
 
-        oauth.clientId("test-app");
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse1.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        oauth.client("test-app", "password");
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse1.getRefreshToken()).refreshToken().send().isSuccess());
 
         userSessions = testUser.getUserSessions();
         assertEquals(1, userSessions.size());
@@ -158,8 +157,7 @@ public void testRevokeToken() throws Exception {
         isTokenEnabled(tokenResponse2, "test-app-scope");
 
         // Revoke second token and assert no sessions for testUser
-        response = oauth.doTokenRevoke(tokenResponse2.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse2.getRefreshToken()).refreshToken().send().isSuccess());
 
         userSessions = testUser.getUserSessions();
         assertEquals(0, userSessions.size());
@@ -168,27 +166,25 @@ public void testRevokeToken() throws Exception {
 
     @Test
     public void testRevokeAccessToken() throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getAccessToken(), "access_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getAccessToken()).accessToken().send().isSuccess());
 
         isAccessTokenDisabled(tokenResponse.getAccessToken(), "test-app");
     }
 
     @Test
     public void testRevokedAccessTokenCacheLifespan() throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getAccessToken(), "access_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getAccessToken()).accessToken().send().isSuccess());
 
         setTimeOffset(adminClient.realm(oauth.getRealm()).toRepresentation().getAccessTokenLifespan());
 
@@ -200,25 +196,24 @@ public void testRevokedAccessTokenCacheLifespan() throws Exception {
     @Test
     public void testRevokeOfflineToken() throws Exception {
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send().isSuccess());
 
         isTokenDisabled(tokenResponse, "test-app");
     }
 
     @Test
     public void testRevokeOfflineTokenWithOnlineSSOSession() throws Exception {
-        OAuthClient.AccessTokenResponse tokenResponse1 = login("test-app", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse1 = login("test-app", "test-user@localhost", "password");
 
         // Offline login of same client in same SSO session as previous login
         oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
-        OAuthClient.AccessTokenResponse tokenResponse2 = login("test-app", "test-user@localhost", "password");
+        AccessTokenResponse tokenResponse2 = login("test-app", "test-user@localhost", "password");
 
         // Session IDs of "offline" and online session are same for now. This may change in the future
         Assert.assertEquals(tokenResponse1.getSessionState(), tokenResponse2.getSessionState());
@@ -226,8 +221,7 @@ public void testRevokeOfflineTokenWithOnlineSSOSession() throws Exception {
         isTokenEnabled(tokenResponse2, "test-app");
 
         // Disable both offline and refresh
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse2.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse2.getRefreshToken()).refreshToken().send().isSuccess());
 
         isTokenDisabled(tokenResponse2, "test-app");
     }
@@ -235,58 +229,54 @@ public void testRevokeOfflineTokenWithOnlineSSOSession() throws Exception {
     @Test
     public void testTokenTypeHint() throws Exception {
         // different token_type_hint
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "access_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).accessToken().send().isSuccess());
 
         isTokenDisabled(tokenResponse, "test-app");
 
         // invalid token_type_hint
-        oauth.clientId("test-app");
-        tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        oauth.client("test-app", "password");
+        tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "invalid_token_type_hint", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).tokenTypeHint("invalid_token_type_hint").send().isSuccess());
 
         isTokenDisabled(tokenResponse, "test-app");
     }
 
     @Test
     public void testRevokeTokenFromDifferentClient() throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        oauth.clientId("test-app-scope");
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.BAD_REQUEST));
+        oauth.client("test-app-scope", "password");
+        assertEquals(400, oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send().getStatusCode());
 
         isTokenEnabled(tokenResponse, "test-app");
     }
 
     @Test
     public void testRevokeAlreadyRevokedToken() throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
 
-        oauth.doLogout(tokenResponse.getRefreshToken(), "password");
+        oauth.doLogout(tokenResponse.getRefreshToken());
 
         isTokenDisabled(tokenResponse, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send().isSuccess());
 
         isTokenDisabled(tokenResponse, "test-app");
     }
@@ -294,8 +284,8 @@ public void testRevokeAlreadyRevokedToken() throws Exception {
     // KEYCLOAK-17300
     @Test
     public void testRevokeRequestParamsMoreThanOnce() throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
             "password");
 
         isTokenEnabled(tokenResponse, "test-app");
@@ -319,17 +309,17 @@ public void testRevokeSingleOfflineSession() throws Exception {
     }
 
     private void testRevokeSingleSession(String expectedTokenType) throws Exception {
-        oauth.clientId("test-app");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        oauth.client("test-app", "password");
+        AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("test-user@localhost",
                 "password");
-        OAuthClient.AccessTokenResponse tokenResponse2 = oauth.doGrantAccessTokenRequest("password", "test-user@localhost",
+        AccessTokenResponse tokenResponse2 = oauth.doPasswordGrantRequest("test-user@localhost",
                 "password");
 
         isTokenEnabled(tokenResponse, "test-app");
         isTokenEnabled(tokenResponse2, "test-app");
 
-        CloseableHttpResponse response = oauth.doTokenRevoke(tokenResponse.getRefreshToken(), "refresh_token", "password");
-        assertThat(response, Matchers.statusCodeIsHC(Status.OK));
+        assertTrue(oauth.tokenRevocationRequest(tokenResponse.getRefreshToken()).refreshToken().send().isSuccess());
+
         events.expect(EventType.REVOKE_GRANT)
                 .session(tokenResponse.getSessionState())
                 .detail(Details.REFRESH_TOKEN_ID, isUUID())
@@ -342,41 +332,36 @@ private void testRevokeSingleSession(String expectedTokenType) throws Exception
     }
 
     private AccessTokenResponse login(String clientId, String username, String password) {
-        oauth.clientId(clientId);
+        oauth.client(clientId, "password");
         oauth.openLoginForm();
         if (loginPage.isCurrent()) {
             loginPage.login(username, password);
         }
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        return oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        return oauth.doAccessTokenRequest(code);
     }
 
     private void isTokenEnabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password",
-            tokenResponse.getAccessToken());
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
+        oauth.client(clientId, "password");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(tokenResponse.getAccessToken()).asTokenMetadata();
         assertTrue(rep.isActive());
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(),
-            "password");
+        AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertEquals(Status.OK.getStatusCode(), tokenRefreshResponse.getStatusCode());
     }
 
     private void isTokenDisabled(AccessTokenResponse tokenResponse, String clientId) throws IOException {
         isAccessTokenDisabled(tokenResponse.getAccessToken(), clientId);
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken(),
-            "password");
+        oauth.client(clientId, "password");
+        AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
         assertEquals(Status.BAD_REQUEST.getStatusCode(), tokenRefreshResponse.getStatusCode());
     }
 
     private void isAccessTokenDisabled(String accessTokenString, String clientId) throws IOException {
         // Test introspection endpoint not possible
-        String introspectionResponse = oauth.introspectAccessTokenWithClientCredential(clientId, "password",
-                accessTokenString);
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(introspectionResponse, TokenMetadataRepresentation.class);
+        oauth.client(clientId, "password");
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenString).asTokenMetadata();
         assertFalse(rep.isActive());
 
         // Test userInfo endpoint not possible
@@ -391,7 +376,7 @@ private void isAccessTokenDisabled(String accessTokenString, String clientId) th
         assertEquals(Status.UNAUTHORIZED.getStatusCode(), accountRequest.asStatus());
 
         // Test admin REST not possible
-        try (Keycloak adminClient = Keycloak.getInstance(OAuthClient.AUTH_SERVER_ROOT, "test", "test-app", accessTokenString)) {
+        try (Keycloak adminClient = Keycloak.getInstance(OAuthClient.AUTH_SERVER_ROOT, "test", "test-app", accessTokenString, AdminClientUtil.getSSLContextWithTruststore())) {
             try {
                 adminClient.realms().realm("test").toRepresentation();
                 Assert.fail("Not expected to obtain realm");
@@ -404,7 +389,7 @@ private void isAccessTokenDisabled(String accessTokenString, String clientId) th
     private String doTokenRevokeWithDuplicateParams(String token, String tokenTypeHint, String clientSecret)
         throws IOException {
         try (CloseableHttpClient client = HttpClientBuilder.create().build()) {
-            HttpPost post = new HttpPost(oauth.getTokenRevocationUrl());
+            HttpPost post = new HttpPost(oauth.getEndpoints().getRevocation());
 
             List<NameValuePair> parameters = new LinkedList<>();
             parameters.add(new BasicNameValuePair("token", token));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/UserInfoEndpointCorsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/UserInfoEndpointCorsTest.java
index 13a593b16a4f..b587be736129 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/UserInfoEndpointCorsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/UserInfoEndpointCorsTest.java
@@ -7,7 +7,7 @@
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
 
 import jakarta.ws.rs.client.WebTarget;
@@ -37,10 +37,10 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void userInfoCorsValidRequestWithValidUrl() throws Exception {
 
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         ResteasyClient resteasyClient = AdminClientUtil.createResteasyClient();
         try {
@@ -63,10 +63,10 @@ public void userInfoCorsValidRequestWithValidUrl() throws Exception {
     public void userInfoCorsInvalidRequestWithValidUrl() throws Exception {
 
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         // Set time offset to make sure that userInfo request will be invalid due the expired token
         setTimeOffset(600);
@@ -92,10 +92,10 @@ public void userInfoCorsInvalidRequestWithValidUrl() throws Exception {
     public void userInfoCorsValidRequestWithInvalidUrlShouldFail() throws Exception {
 
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         ResteasyClient resteasyClient = AdminClientUtil.createResteasyClient();
         try {
@@ -116,10 +116,10 @@ public void userInfoCorsValidRequestWithInvalidUrlShouldFail() throws Exception
     @Test
     public void userInfoCorsInvalidSession() throws Exception {
         oauth.realm("test");
-        oauth.clientId("test-app2");
+        oauth.client("test-app2");
         oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
 
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.doGrantAccessTokenRequest(null, "test-user@localhost", "password");
+        AccessTokenResponse accessTokenResponse = oauth.doPasswordGrantRequest("test-user@localhost", "password");
 
         // remove the session in keycloak
         AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java
index eaad49ec710e..523eb4669534 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/hok/HoKTest.java
@@ -1,38 +1,18 @@
 package org.keycloak.testsuite.oauth.hok;
 
-import static org.hamcrest.Matchers.allOf;
-import static org.hamcrest.Matchers.greaterThanOrEqualTo;
-import static org.hamcrest.Matchers.lessThanOrEqualTo;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
-import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
-
-import java.io.IOException;
-import java.net.URI;
-import java.security.KeyStore;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.function.Supplier;
-import java.util.stream.Stream;
-
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.client.ClientBuilder;
 import jakarta.ws.rs.client.WebTarget;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.Response.Status;
-
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.drone.api.annotation.Drone;
-import org.junit.*;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Rule;
+import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.admin.client.resource.ClientResource;
@@ -63,17 +43,40 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.client.KeycloakTestingClient;
 import org.keycloak.testsuite.drone.Different;
 import org.keycloak.testsuite.oauth.RefreshTokenTest;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.MutualTLSUtils;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.MutualTLSUtils;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.util.JsonSerialization;
 import org.openqa.selenium.WebDriver;
 
+import java.io.IOException;
+import java.net.URI;
+import java.security.KeyStore;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Stream;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.greaterThanOrEqualTo;
+import static org.hamcrest.Matchers.lessThanOrEqualTo;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.admin.ApiUtil.findUserByUsername;
+import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SSL_REQUIRED;
+
 
 public class HoKTest extends AbstractTestRealmKeycloakTest {
     // KEYCLOAK-6771 Certificate Bound Token
@@ -186,13 +189,16 @@ public void accessTokenRequestWithClientCertificate() throws Exception {
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse response;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            response = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Success Pattern
@@ -203,13 +209,16 @@ public void accessTokenRequestWithClientCertificate() throws Exception {
     @Test
     public void accessTokenRequestWithoutClientCertificate() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse response;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            response = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Error Pattern
@@ -226,7 +235,7 @@ private void expectSuccessfulResponseFromTokenEndpoint(String sessionId, String
 
         assertEquals("Bearer", response.getTokenType());
 
-        String expectedKid = Stream.of(oauth.doCertsRequest("test").getKeys())
+        String expectedKid = Stream.of(oauth.keys().getRealmKeys().getKeys())
                 .filter(jwk -> KeyUse.SIG.getSpecName().equals(jwk.getPublicKeyUse()))
                 .map(JWK::getKeyId)
                 .findFirst().orElseThrow(() -> new AssertionError("Was not able to find key with usage SIG in the 'test' realm keys"));
@@ -274,35 +283,43 @@ private void expectSuccessfulResponseFromTokenEndpoint(String sessionId, String
     public void refreshTokenRequestByHoKRefreshTokenByOtherClient() throws Exception {
         // first client user login
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         AccessTokenResponse tokenResponse = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            tokenResponse = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
         String refreshTokenString = tokenResponse.getRefreshToken();
 
         // second client user login
-        OAuthClient oauth2 = new OAuthClient();
-        oauth2.init(driver2);
+        OAuthClient oauth2 = oauth.newConfig().driver(driver2);
         oauth2.doLogin("john-doh@localhost", "password");
-        String code2 = oauth2.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code2 = oauth2.parseLoginResponse().getCode();
         AccessTokenResponse tokenResponse2 = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithOtherKeyStoreAndTrustStore()) {
-            tokenResponse2 = oauth2.doAccessTokenRequest(code2, "password", client);
+            oauth2.httpClient().set(client);
+            tokenResponse2 = oauth2.doAccessTokenRequest(code2);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth2.httpClient().reset();
         }
         verifyHoKTokenOtherCertThumbPrint(tokenResponse2);
 
         // token refresh by second client by first client's refresh token
         AccessTokenResponse response = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithOtherKeyStoreAndTrustStore()) {
-            response = oauth2.doRefreshTokenRequest(refreshTokenString, "password", client);
+            oauth2.httpClient().set(client);
+            response = oauth2.doRefreshTokenRequest(refreshTokenString);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth2.httpClient().reset();
         }
 
         // Error Pattern
@@ -318,13 +335,16 @@ public void refreshTokenRequestByHoKRefreshTokenWithClientCertificate() throws E
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse tokenResponse = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            tokenResponse = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
@@ -344,9 +364,12 @@ public void refreshTokenRequestByHoKRefreshTokenWithClientCertificate() throws E
 
         AccessTokenResponse response = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            response = oauth.doRefreshTokenRequest(refreshTokenString, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doRefreshTokenRequest(refreshTokenString);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Success Pattern
@@ -360,10 +383,10 @@ public void refreshTokenRequestByRefreshTokenWithoutClientCertificate() throws E
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse tokenResponse = null;
-        tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        tokenResponse = oauth.doAccessTokenRequest(code);
 
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
         AccessToken token = oauth.verifyToken(tokenResponse.getAccessToken());
@@ -381,9 +404,12 @@ public void refreshTokenRequestByRefreshTokenWithoutClientCertificate() throws E
 
         AccessTokenResponse response = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            response = oauth.doRefreshTokenRequest(refreshTokenString, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doRefreshTokenRequest(refreshTokenString);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Error Pattern
@@ -447,13 +473,16 @@ public void getUserInfoByHoKAccessTokenWithClientCertificate() throws Exception
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse tokenResponse = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            tokenResponse = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
         events.expectCodeToToken(codeId, sessionId).assertEvent();
@@ -485,20 +514,22 @@ public void getUserInfoByHoKAccessTokenWithoutClientCertificate() throws Excepti
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
 
         AccessTokenResponse tokenResponse = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            tokenResponse = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
         events.expectCodeToToken(codeId, sessionId).assertEvent();
 
         // execute the access token to get UserInfo without token binded client certificate in mutual authentication TLS
-        ClientBuilder clientBuilder = ClientBuilder.newBuilder();
-        Client client = clientBuilder.build();
+        Client client = KeycloakTestingClient.getRestEasyClientBuilder().build();
         WebTarget userInfoTarget = null;
         Response response = null;
         try {
@@ -506,7 +537,7 @@ public void getUserInfoByHoKAccessTokenWithoutClientCertificate() throws Excepti
             response = userInfoTarget.request().header(HttpHeaders.AUTHORIZATION, "Bearer " + tokenResponse.getAccessToken()).get();
             assertEquals(401, response.getStatus());
         } finally {
-            response.close();
+            if (response != null) response.close();
             client.close();
         }
 
@@ -528,15 +559,18 @@ private void testSuccessfulUserInfoResponse(Response response) {
     public void postLogoutByHoKRefreshTokenWithClientCertificate() throws Exception {
         String refreshTokenString = execPreProcessPostLogout();
 
-        CloseableHttpResponse response = null;
+        LogoutResponse response = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-            response = oauth.doLogout(refreshTokenString, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doLogout(refreshTokenString);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Success Pattern
-        assertThat(response, org.keycloak.testsuite.util.Matchers.statusCodeIsHC(Status.NO_CONTENT));
+        assertTrue(response.isSuccess());
         assertNotNull(testingClient.testApp().getAdminLogoutAction());
     }
 
@@ -544,22 +578,24 @@ public void postLogoutByHoKRefreshTokenWithClientCertificate() throws Exception
     public void postLogoutByHoKRefreshTokenWithoutClientCertificate() throws Exception {
         String refreshTokenString = execPreProcessPostLogout();
 
-        CloseableHttpResponse response = null;
+        LogoutResponse response = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            response = oauth.doLogout(refreshTokenString, "password", client);
+            oauth.httpClient().set(client);
+            response = oauth.doLogout(refreshTokenString);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
         // Error Pattern
-        assertEquals(401, response.getStatusLine().getStatusCode());
+        assertEquals(401, response.getStatusCode());
     }
 
     private String execPreProcessPostLogout() throws Exception {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.clientSessionState("client-session");
-        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         verifyHoKTokenDefaultCertThumbPrint(tokenResponse);
 
         return tokenResponse.getRefreshToken();
@@ -572,14 +608,13 @@ private String execPreProcessPostLogout() throws Exception {
     public void accessTokenRequestWithClientCertificateInHybridFlowWithCodeIDToken() throws Exception {
         String nonce = "ckw938gnspa93dj";
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").standardFlow(true).implicitFlow(true);
-        oauth.clientId("test-app");
+        oauth.client("test-app", "password");
         oauth.responseType(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN);
-        oauth.nonce(nonce);
 
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().nonce(nonce).doLogin("test-user@localhost", "password");
 
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, true);
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         Assert.assertNotNull(authzResponse.getSessionState());
         List<IDToken> idTokens = testAuthzResponseAndRetrieveIDTokens(authzResponse, loginEvent);
         for (IDToken idToken : idTokens) {
@@ -588,7 +623,7 @@ public void accessTokenRequestWithClientCertificateInHybridFlowWithCodeIDToken()
         }
     }
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         // IDToken from the authorization response
@@ -612,24 +647,29 @@ public void testIntrospectHoKAccessToken() throws Exception {
         // get an access token with client certificate in mutual authenticate TLS
         // mimic Client
         oauth.doLogin("test-user@localhost", "password");
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
+        String code = oauth.parseLoginResponse().getCode();
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         AccessTokenResponse accessTokenResponse = null;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
-           accessTokenResponse = oauth.doAccessTokenRequest(code, "password", client);
+            oauth.httpClient().set(client);
+            accessTokenResponse = oauth.doAccessTokenRequest(code);
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
 
         // Do token introspection
         // mimic Resource Server
-        String tokenResponse;
+        TokenMetadataRepresentation rep;
         try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
-            tokenResponse = oauth.introspectTokenWithClientCredential("confidential-cli", "secret1", "access_token", accessTokenResponse.getAccessToken(), client);
+            oauth.client("confidential-cli", "secret1").httpClient().set(client);
+            rep = oauth.doIntrospectionRequest(accessTokenResponse.getAccessToken(), "access_token").asTokenMetadata();
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            oauth.httpClient().reset();
         }
-        TokenMetadataRepresentation rep = JsonSerialization.readValue(tokenResponse, TokenMetadataRepresentation.class);
         JWSInput jws = new JWSInput(accessTokenResponse.getAccessToken());
         AccessToken at = jws.readJsonContent(AccessToken.class);
         jws = new JWSInput(accessTokenResponse.getRefreshToken());
@@ -652,61 +692,65 @@ public void testIntrospectHoKAccessToken() throws Exception {
 
     @Test
     public void serviceAccountWithClientCertificate() throws Exception {
-        oauth.clientId("service-account-client");
+        oauth.client("service-account-client", "secret1");
 
         AccessTokenResponse response;
 
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-
         try {
             // Request without HoK should fail
-            oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithoutKeyStoreAndTrustStore);
-            response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
-            assertEquals(400, response.getStatusCode());
-            assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
-            assertEquals("Client Certification missing for MTLS HoK Token Binding", response.getErrorDescription());
+            try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
+                oauth.httpClient().set(client);
+                response = oauth.doClientCredentialsGrantAccessTokenRequest();
+                assertEquals(400, response.getStatusCode());
+                assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+                assertEquals("Client Certification missing for MTLS HoK Token Binding", response.getErrorDescription());
+            } finally {
+                oauth.httpClient().reset();
+            }
 
             // Request with HoK - success
-            oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
-            response = oauth.doClientCredentialsGrantAccessTokenRequest("secret1");
-            assertEquals(200, response.getStatusCode());
-
-            // Success Pattern
-            verifyHoKTokenCertThumbPrint(response, MutualTLSUtils.getThumbprintFromDefaultClientCert(), false);
+            try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
+                oauth.httpClient().set(client);
+                response = oauth.doClientCredentialsGrantAccessTokenRequest();
+                assertEquals(200, response.getStatusCode());
+
+                // Success Pattern
+                verifyHoKTokenCertThumbPrint(response, MutualTLSUtils.getThumbprintFromDefaultClientCert(), false);
+            } finally {
+                oauth.httpClient().reset();
+            }
         }  catch (IOException ioe) {
             throw new RuntimeException(ioe);
-        } finally {
-            oauth.httpClient(previous);
         }
     }
 
     @Test
     public void resourceOwnerPasswordCredentialsGrantWithClientCertificate() throws Exception {
-        oauth.clientId("service-account-client");
+        oauth.client("service-account-client", "secret1");
 
         AccessTokenResponse response;
 
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-
-        try {
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithoutKeyStoreAndTrustStore()) {
             // Request without HoK should fail
-            oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithoutKeyStoreAndTrustStore);
-            response = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password", null);
+            oauth.httpClient().set(client);
+            response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(400, response.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
             assertEquals("Client Certification missing for MTLS HoK Token Binding", response.getErrorDescription());
+        } finally {
+            oauth.httpClient().reset();
+        }
 
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClientWithDefaultKeyStoreAndTrustStore()) {
             // Request with HoK - success
-            oauth.httpClient(MutualTLSUtils::newCloseableHttpClientWithDefaultKeyStoreAndTrustStore);
-            response = oauth.doGrantAccessTokenRequest("secret1", "test-user@localhost", "password", null);
+            oauth.httpClient().set(client);
+            response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(200, response.getStatusCode());
 
             // Success Pattern
             verifyHoKTokenCertThumbPrint(response, MutualTLSUtils.getThumbprintFromDefaultClientCert(), false);
-        }  catch (IOException ioe) {
-            throw new RuntimeException(ioe);
         } finally {
-            oauth.httpClient(previous);
+            oauth.httpClient().reset();
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java
index a3a8fc905c5e..e682e7038968 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java
@@ -36,7 +36,6 @@
 
 import jakarta.ws.rs.core.UriBuilder;
 
-import org.apache.http.client.methods.CloseableHttpResponse;
 import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
@@ -69,13 +68,15 @@
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutorFactory;
 import org.keycloak.testsuite.util.ClientBuilder;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AbstractHttpResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPoliciesBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientPolicyBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfileBuilder;
 import org.keycloak.testsuite.util.ClientPoliciesUtil.ClientProfilesBuilder;
-import org.keycloak.testsuite.util.OAuthClient.ParResponse;
+import org.keycloak.testsuite.util.oauth.ParResponse;
 import org.keycloak.util.JsonSerialization;
 
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createClientRolesConditionConfig;
@@ -154,9 +155,9 @@ public void testSuccessfulSinglePar() throws Exception {
             assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
             // Pushed Authorization Request
-            oauth.clientId(clientId);
+            oauth.client(clientId, clientSecret);
             oauth.redirectUri(CLIENT_REDIRECT_URI);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.doPushedAuthorizationRequest();
             assertEquals(201, pResp.getStatusCode());
             String requestUri = pResp.getRequestUri();
             assertEquals(requestUriLifespan, pResp.getExpiresIn());
@@ -166,17 +167,15 @@ public void testSuccessfulSinglePar() throws Exception {
             oauth.redirectUri(null);
             oauth.scope(null);
             oauth.responseType(null);
-            oauth.requestUri(requestUri);
-            String state = oauth.stateParamRandom().getState();
-            oauth.stateParamHardcoded(state);
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            String state = "testSuccessfulSinglePar";
+            AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(state).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
             assertEquals(state, loginResponse.getState());
             String code = loginResponse.getCode();
             String sessionId =loginResponse.getSessionState();
 
             // Token Request
             oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-            OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+            AccessTokenResponse res = oauth.doAccessTokenRequest(code);
             assertEquals(200, res.getStatusCode());
 
             AccessToken token = oauth.verifyToken(res.getAccessToken());
@@ -193,7 +192,7 @@ public void testSuccessfulSinglePar() throws Exception {
             assertEquals(sessionId, refreshToken.getSessionState());
             assertEquals(clientId, refreshToken.getIssuedFor());
 
-            OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+            AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString);
             assertEquals(200, refreshResponse.getStatusCode());
 
             AccessToken refreshedToken = oauth.verifyToken(refreshResponse.getAccessToken());
@@ -203,8 +202,8 @@ public void testSuccessfulSinglePar() throws Exception {
             assertEquals(findUserByUsername(adminClient.realm(REALM_NAME), TEST_USER_NAME).getId(), refreshedToken.getSubject());
 
             // Logout
-            oauth.doLogout(refreshResponse.getRefreshToken(), clientSecret);
-            refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken(), clientSecret);
+            oauth.doLogout(refreshResponse.getRefreshToken());
+            refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken());
             assertEquals(400, refreshResponse.getStatusCode());
 
         } finally {
@@ -233,9 +232,9 @@ public void testSuccessfulSingleParPublicClient() throws Exception {
             assertEquals("none", oidcCRep.getTokenEndpointAuthMethod()); // Public Client
 
             // Pushed Authorization Request
-            oauth.clientId(clientId);
+            oauth.client(clientId, clientSecret);
             oauth.redirectUri(CLIENT_REDIRECT_URI);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.doPushedAuthorizationRequest();
             assertEquals(201, pResp.getStatusCode());
             String requestUri = pResp.getRequestUri();
             assertEquals(requestUriLifespan, pResp.getExpiresIn());
@@ -245,17 +244,15 @@ public void testSuccessfulSingleParPublicClient() throws Exception {
             oauth.redirectUri(null);
             oauth.scope(null);
             oauth.responseType(null);
-            oauth.requestUri(requestUri);
-            String state = oauth.stateParamRandom().getState();
-            oauth.stateParamHardcoded(state);
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            String state = "testSuccessfulSingleParPublicClient";
+            AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(state).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
             assertEquals(state, loginResponse.getState());
             String code = loginResponse.getCode();
             String sessionId =loginResponse.getSessionState();
 
             // Token Request
             oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-            OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+            AccessTokenResponse res = oauth.doAccessTokenRequest(code);
             assertEquals(200, res.getStatusCode());
 
             AccessToken token = oauth.verifyToken(res.getAccessToken());
@@ -272,7 +269,7 @@ public void testSuccessfulSingleParPublicClient() throws Exception {
             assertEquals(sessionId, refreshToken.getSessionState());
             assertEquals(clientId, refreshToken.getIssuedFor());
 
-            OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+            AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString);
             assertEquals(200, refreshResponse.getStatusCode());
 
             AccessToken refreshedToken = oauth.verifyToken(refreshResponse.getAccessToken());
@@ -282,8 +279,8 @@ public void testSuccessfulSingleParPublicClient() throws Exception {
             assertEquals(findUserByUsername(adminClient.realm(REALM_NAME), TEST_USER_NAME).getId(), refreshedToken.getSubject());
 
             // Logout
-            oauth.doLogout(refreshResponse.getRefreshToken(), clientSecret);
-            refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken(), clientSecret);
+            oauth.doLogout(refreshResponse.getRefreshToken());
+            refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken());
             assertEquals(400, refreshResponse.getStatusCode());
 
         } finally {
@@ -306,14 +303,14 @@ public void testWrongSigningAlgorithmForRequestObject() throws Exception {
                         clientRep.setRequestObjectSigningAlg(Algorithm.PS256);
                     });
 
-            oauth.clientId(clientId);
-
             OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
             String clientSecret = oidcCRep.getClientSecret();
             assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
             assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
             assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
+            oauth.client(clientId, clientSecret);
+
             TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
             requestObject.id(KeycloakModelUtils.generateId());
             requestObject.iat(Long.valueOf(Time.currentTime()));
@@ -341,11 +338,10 @@ public void testWrongSigningAlgorithmForRequestObject() throws Exception {
             client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
 
             // do not send any other parameter but the request request parameter
-            oauth.request(client.getOIDCRequest());
             oauth.responseType(null);
             oauth.redirectUri(null);
             oauth.scope(null);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.pushedAuthorizationRequest().request(client.getOIDCRequest()).send();
             assertEquals(400, pResp.getStatusCode());
             assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError());
         } finally {
@@ -366,14 +362,14 @@ public void testSuccessfulUsingRequestParameter() throws Exception {
                 clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
             });
 
-            oauth.clientId(clientId);
-
             OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
             String clientSecret = oidcCRep.getClientSecret();
             assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
             assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
             assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
+            oauth.client(clientId, clientSecret);
+
             TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
             requestObject.id(KeycloakModelUtils.generateId());
             requestObject.iat(Long.valueOf(Time.currentTime()));
@@ -399,11 +395,10 @@ public void testSuccessfulUsingRequestParameter() throws Exception {
             client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
 
             // do not send any other parameter but the request request parameter
-            oauth.request(client.getOIDCRequest());
             oauth.responseType(null);
             oauth.redirectUri(null);
             oauth.scope(null);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.pushedAuthorizationRequest().request(client.getOIDCRequest()).send();
             assertEquals(201, pResp.getStatusCode());
             String requestUri = pResp.getRequestUri();
             assertEquals(requestUriLifespan, pResp.getExpiresIn());
@@ -413,13 +408,11 @@ public void testSuccessfulUsingRequestParameter() throws Exception {
             oauth.redirectUri(null);
             oauth.scope(null);
             oauth.responseType(null);
-            oauth.request(null);
-            oauth.requestUri(requestUri);
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
 
             // Token Request
             oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-            OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
+            AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode());
             assertEquals(200, res.getStatusCode());
 
             oauth.verifyToken(res.getAccessToken());
@@ -443,14 +436,14 @@ public void testRequestParameterPrecedenceOverOtherParameters() throws Exception
                 clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
             });
 
-            oauth.clientId(clientId);
-
             OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
             String clientSecret = oidcCRep.getClientSecret();
             assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
             assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
             assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
+            oauth.client(clientId, clientSecret);
+
             TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
             requestObject.id(KeycloakModelUtils.generateId());
             requestObject.iat(Long.valueOf(Time.currentTime()));
@@ -461,7 +454,7 @@ public void testRequestParameterPrecedenceOverOtherParameters() throws Exception
             requestObject.setRedirectUriParam(CLIENT_REDIRECT_URI);
             requestObject.setScope("openid");
             requestObject.setNonce(KeycloakModelUtils.generateId());
-            requestObject.setState(oauth.stateParamRandom().getState());
+            requestObject.setState("testRequestParameterPrecedenceOverOtherParameters");
 
 
             byte[] contentBytes = JsonSerialization.writeValueAsBytes(requestObject);
@@ -478,12 +471,10 @@ public void testRequestParameterPrecedenceOverOtherParameters() throws Exception
             client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
 
             // do not send any other parameter but the request request parameter
-            oauth.request(client.getOIDCRequest());
             oauth.responseType("code id_token");
             oauth.redirectUri("http://invalid");
             oauth.scope(null);
-            oauth.nonce("12345");
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.pushedAuthorizationRequest().nonce("12345").request(client.getOIDCRequest()).send();
             assertEquals(201, pResp.getStatusCode());
             String requestUri = pResp.getRequestUri();
             assertEquals(requestUriLifespan, pResp.getExpiresIn());
@@ -492,18 +483,14 @@ public void testRequestParameterPrecedenceOverOtherParameters() throws Exception
             oauth.redirectUri("http://invalid");
             oauth.responseType("invalid");
             oauth.redirectUri(null);
-            oauth.nonce("12345");
-            oauth.request(null);
-            oauth.requestUri(requestUri);
-            String wrongState = oauth.stateParamRandom().getState();
-            oauth.stateParamHardcoded(wrongState);
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            String wrongState = "wrongState";
+            AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(wrongState).nonce("12345").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
             assertEquals(requestObject.getState(), loginResponse.getState());
             assertNotEquals(requestObject.getState(), wrongState);
 
             // Token Request
             oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-            OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
+            AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode());
             assertEquals(200, res.getStatusCode());
 
             oauth.verifyToken(res.getAccessToken());
@@ -527,14 +514,14 @@ public void testIgnoreParameterIfNotSetinRequestObject() throws Exception {
                 clientRep.setRedirectUris(new ArrayList<>(Arrays.asList(CLIENT_REDIRECT_URI)));
             });
 
-            oauth.clientId(clientId);
-
             OIDCClientRepresentation oidcCRep = getClientDynamically(clientId);
             String clientSecret = oidcCRep.getClientSecret();
             assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
             assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
             assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
+            oauth.client(clientId, clientSecret);
+
             TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject requestObject = new TestingOIDCEndpointsApplicationResource.AuthorizationEndpointRequestObject();
             requestObject.id(KeycloakModelUtils.generateId());
             requestObject.iat(Long.valueOf(Time.currentTime()));
@@ -560,12 +547,10 @@ public void testIgnoreParameterIfNotSetinRequestObject() throws Exception {
             client.registerOIDCRequest(encodedRequestObject, org.keycloak.crypto.Algorithm.RS256);
 
             // do not send any other parameter but the request request parameter
-            oauth.request(client.getOIDCRequest());
             oauth.responseType("code id_token");
             oauth.redirectUri("http://invalid");
             oauth.scope(null);
-            oauth.nonce("12345");
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+            ParResponse pResp = oauth.pushedAuthorizationRequest().nonce("12345").request(client.getOIDCRequest()).send();
             assertEquals(201, pResp.getStatusCode());
             String requestUri = pResp.getRequestUri();
             assertEquals(requestUriLifespan, pResp.getExpiresIn());
@@ -574,18 +559,14 @@ public void testIgnoreParameterIfNotSetinRequestObject() throws Exception {
             oauth.redirectUri("http://invalid");
             oauth.responseType("invalid");
             oauth.redirectUri(null);
-            oauth.nonce("12345");
-            oauth.request(null);
-            oauth.requestUri(requestUri);
-            String wrongState = oauth.stateParamRandom().getState();
-            oauth.stateParamHardcoded(wrongState);
-            OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            String wrongState = "wrongState";
+            AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(wrongState).nonce("12345").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
             assertNull(loginResponse.getState());
             assertNotEquals(requestObject.getState(), wrongState);
 
             // Token Request
             oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-            OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode(), clientSecret);
+            AccessTokenResponse res = oauth.doAccessTokenRequest(loginResponse.getCode());
             assertEquals(200, res.getStatusCode());
 
             oauth.verifyToken(res.getAccessToken());
@@ -611,17 +592,17 @@ public void testSuccessfulMultipleParBySameClient() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request #1
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUriOne = pResp.getRequestUri();
 
         // Pushed Authorization Request #2
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.scope("microprofile-jwt" + " " + "profile");
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUriTwo = pResp.getRequestUri();
 
@@ -630,17 +611,15 @@ public void testSuccessfulMultipleParBySameClient() throws Exception {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUriTwo);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER2_NAME, TEST_USER2_PASSWORD);
+        String state = "testSuccessfulMultipleParBySameClient";
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUriTwo).state(state).doLogin(TEST_USER2_NAME, TEST_USER2_PASSWORD);
         assertEquals(state, loginResponse.getState());
         String code = loginResponse.getCode();
         String sessionId =loginResponse.getSessionState();
 
         // Token Request #2
         oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         AccessToken token = oauth.verifyToken(res.getAccessToken());
@@ -655,24 +634,22 @@ public void testSuccessfulMultipleParBySameClient() throws Exception {
         assertTrue(token.getScope().contains("profile"));
 
         // Logout
-        oauth.doLogout(res.getRefreshToken(), clientSecret); // same oauth instance is used so that this logout is needed to send authz request consecutively.
+        oauth.doLogout(res.getRefreshToken()); // same oauth instance is used so that this logout is needed to send authz request consecutively.
 
         // Authorization Request with request_uri of PAR #1
         // remove parameters as query strings of uri
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUriOne);
-        state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        state = "testSuccessfulMultipleParBySameClient2";
+        loginResponse = oauth.loginForm().state(state).requestUri(requestUriOne).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         assertEquals(state, loginResponse.getState());
         code = loginResponse.getCode();
         sessionId =loginResponse.getSessionState();
 
         // Token Request #1
         oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        res = oauth.doAccessTokenRequest(code, clientSecret);
+        res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         token = oauth.verifyToken(res.getAccessToken());
@@ -713,17 +690,17 @@ public void testSuccessfulMultipleParByMultipleClients() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcC2Rep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request #1
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUriOne = pResp.getRequestUri();
 
         // Pushed Authorization Request #2
-        oauth.clientId(client2Id);
+        oauth.client(client2Id, client2Secret);
         oauth.scope("microprofile-jwt" + " " + "profile");
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        pResp = oauth.doPushedAuthorizationRequest(client2Id, client2Secret);
+        pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUriTwo = pResp.getRequestUri();
 
@@ -732,17 +709,15 @@ public void testSuccessfulMultipleParByMultipleClients() throws Exception {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUriTwo);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER2_NAME, TEST_USER2_PASSWORD);
+        String state = "testSuccessfulMultipleParByMultipleClients";
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUriTwo).state(state).doLogin(TEST_USER2_NAME, TEST_USER2_PASSWORD);
         assertEquals(state, loginResponse.getState());
         String code = loginResponse.getCode();
         String sessionId =loginResponse.getSessionState();
 
         // Token Request #2
         oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, client2Secret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         AccessToken token = oauth.verifyToken(res.getAccessToken());
@@ -757,25 +732,23 @@ public void testSuccessfulMultipleParByMultipleClients() throws Exception {
         assertTrue(token.getScope().contains("profile"));
 
         // Logout
-        oauth.doLogout(res.getRefreshToken(), client2Secret); // same oauth instance is used so that this logout is needed to send authz request consecutively.
+        oauth.doLogout(res.getRefreshToken()); // same oauth instance is used so that this logout is needed to send authz request consecutively.
 
         // Authorization Request with request_uri of PAR #1
         // remove parameters as query strings of uri
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUriOne);
-        state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        state = "testSuccessfulMultipleParByMultipleClients2";
+        loginResponse = oauth.loginForm().state(state).requestUri(requestUriOne).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         assertEquals(state, loginResponse.getState());
         code = loginResponse.getCode();
         sessionId =loginResponse.getSessionState();
 
         // Token Request #1
         oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        res = oauth.doAccessTokenRequest(code, clientSecret);
+        res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         token = oauth.verifyToken(res.getAccessToken());
@@ -804,9 +777,9 @@ public void testFailureNotIssuedParUsed() throws Exception {
 
         // Pushed Authorization Request
         // but not use issued request_uri
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
 
         // Authorization Request with request_uri of PAR
@@ -815,12 +788,9 @@ public void testFailureNotIssuedParUsed() throws Exception {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(IMAGINARY_REQUEST_URI);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        String state = "testFailureNotIssuedParUsed";
+        oauth.loginForm().requestUri(IMAGINARY_REQUEST_URI).state(state).open();
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertFalse(errorResponse.isRedirected());
     }
 
@@ -839,9 +809,9 @@ public void testFailureParUsedTwice() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
@@ -850,25 +820,21 @@ public void testFailureParUsedTwice() throws Exception {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUri);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        String state = "testFailureParUsedTwice";
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(state).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         assertEquals(state, loginResponse.getState());
         String code = loginResponse.getCode();
 
         // Token Request
         oauth.redirectUri(CLIENT_REDIRECT_URI); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         // Authorization Request with request_uri of PAR
         // use same redirect_uri
-        state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        state = "testFailureParUsedTwice2";
+        oauth.loginForm().requestUri(requestUri).state(state).open();
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertFalse(errorResponse.isRedirected());
     }
 
@@ -898,25 +864,22 @@ public void testFailureParUsedByOtherClient() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, attackerOidcCRep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request
-        oauth.clientId(victimClientId);
+        oauth.client(victimClientId, victimClientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(victimClientId, victimClientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // Authorization Request with request_uri of PAR
         // remove parameters as query strings of uri
         // used by other client
-        oauth.clientId(attackerClientId);
+        oauth.client(attackerClientId);
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUri);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        String state = "testFailureParUsedByOtherClient";
+        oauth.loginForm().state(state).requestUri(requestUri).open();
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertFalse(errorResponse.isRedirected());
     }
 
@@ -931,20 +894,20 @@ public void testFailureNotParByParRequiredCilent() throws Exception {
         String clientSecret = oidcCRep.getClientSecret();
         assertEquals(Boolean.TRUE, oidcCRep.getRequirePushedAuthorizationRequests());
 
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.openLoginForm();
-        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        assertEquals("Pushed Authorization Request is only allowed.", oauth.getCurrentQuery().get(OAuth2Constants.ERROR_DESCRIPTION));
+        assertEquals(OAuthErrorException.INVALID_REQUEST, oauth.parseLoginResponse().getError());
+        assertEquals("Pushed Authorization Request is only allowed.", oauth.parseLoginResponse().getErrorDescription());
 
         updateClientDynamically(clientId, (OIDCClientRepresentation clientRep) -> {
             clientRep.setRequirePushedAuthorizationRequests(Boolean.FALSE);
         });
 
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         String code = loginResponse.getCode();
 
         // Token Request
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
     }
 
@@ -962,9 +925,9 @@ public void testFailureParExpired() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
         int expiresIn = pResp.getExpiresIn();
@@ -976,12 +939,9 @@ public void testFailureParExpired() throws Exception {
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUri);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        String state = "testFailureParExpired";
+        oauth.loginForm().state(state).requestUri(requestUri).open();
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertFalse(errorResponse.isRedirected());
     }
 
@@ -1000,9 +960,9 @@ public void testFailureClientAuthnFailed() throws Exception {
         assertEquals(OIDCLoginProtocol.CLIENT_SECRET_BASIC, oidcCRep.getTokenEndpointAuthMethod());
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret + "abc");
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret + "abc");
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(401, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("Authentication failed.", pResp.getErrorDescription());
@@ -1022,10 +982,9 @@ public void testFailureParIncludesRequestUri() throws Exception {
         assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        oauth.requestUri(IMAGINARY_REQUEST_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().requestUri(IMAGINARY_REQUEST_URI).send();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("It is not allowed to include request_uri to PAR.", pResp.getErrorDescription());
@@ -1047,9 +1006,9 @@ public void testFailureInvalidPar() throws Exception {
         });
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError());
     }
@@ -1068,9 +1027,9 @@ public void testFailureParIncludesInvalidRedirectUri() throws Exception {
         assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(INVALID_CORS_URL);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("Invalid parameter: redirect_uri", pResp.getErrorDescription());
@@ -1090,10 +1049,10 @@ public void testFailureParIncludesInvalidResponseType() throws Exception {
         assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
         oauth.responseType(null);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("Missing parameter: response_type", pResp.getErrorDescription());
@@ -1112,10 +1071,10 @@ public void testFailureParIncludesInvalidScope() throws Exception {
         assertTrue(oidcCRep.getRedirectUris().contains(CLIENT_REDIRECT_URI));
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
         oauth.scope("not_registered_scope");
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("Invalid scopes: openid not_registered_scope", pResp.getErrorDescription());
@@ -1138,9 +1097,9 @@ public void testFailureParInvalidPkceSetting() throws Exception {
         });
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.doPushedAuthorizationRequest();
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("Missing parameter: code_challenge_method", pResp.getErrorDescription());
@@ -1166,13 +1125,12 @@ public void testParCorsRequestWithValidUrl() throws Exception {
             });
 
             // Pushed Authorization Request
-            oauth.clientId(clientId);
+            oauth.client(clientId, clientSecret);
             oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
             oauth.origin(VALID_CORS_URL);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret, (CloseableHttpResponse c)->{
-                assertCors(c);
-            });
+            ParResponse pResp = oauth.doPushedAuthorizationRequest();
             assertEquals(201, pResp.getStatusCode());
+            assertCors(pResp);
             String requestUri = pResp.getRequestUri();
 
             doNormalAuthzProcess(requestUri, VALID_CORS_URL + "/realms/master/app", clientId, clientSecret);
@@ -1200,13 +1158,12 @@ public void testParCorsRequestWithInvalidUrlShouldFail() throws Exception {
             });
 
             // Pushed Authorization Request
-            oauth.clientId(clientId);
+            oauth.client(clientId, clientSecret);
             oauth.redirectUri(VALID_CORS_URL + "/realms/master/app");
             oauth.origin(INVALID_CORS_URL);
-            ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret, (CloseableHttpResponse c)->{
-                assertNotCors(c);
-            });
+            ParResponse pResp = oauth.doPushedAuthorizationRequest();
             assertEquals(201, pResp.getStatusCode());
+            assertNotCors(pResp);
             String requestUri = pResp.getRequestUri();
 
             doNormalAuthzProcess(requestUri, VALID_CORS_URL + "/realms/master/app", clientId, clientSecret);
@@ -1254,9 +1211,9 @@ public void testExtendedClientPolicyIntefacesForPar() throws Exception {
         clientResource.roles().create(RoleBuilder.create().name(roleName).build());
 
         // Pushed Authorization Request
-        oauth.clientId(clientId);
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
-        ParResponse response = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse response = oauth.doPushedAuthorizationRequest();
         assertEquals(400, response.getStatusCode());
         assertEquals(ClientPolicyEvent.PUSHED_AUTHORIZATION_REQUEST.toString(), response.getError());
         assertEquals("Exception thrown intentionally", response.getErrorDescription());
@@ -1268,17 +1225,15 @@ private void doNormalAuthzProcess(String requestUri, String redirectUrl, String
         oauth.redirectUri(null);
         oauth.scope(null);
         oauth.responseType(null);
-        oauth.requestUri(requestUri);
-        String state = oauth.stateParamRandom().getState();
-        oauth.stateParamHardcoded(state);
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        String state = "doNormalAuthzProcess";
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).state(state).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         assertEquals(state, loginResponse.getState());
         String code = loginResponse.getCode();
         String sessionId =loginResponse.getSessionState();
 
         // Token Request
         oauth.redirectUri(redirectUrl); // get tokens, it needed. https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.doAccessTokenRequest(code);
         assertEquals(200, res.getStatusCode());
 
         AccessToken token = oauth.verifyToken(res.getAccessToken());
@@ -1295,7 +1250,7 @@ private void doNormalAuthzProcess(String requestUri, String redirectUrl, String
         assertEquals(sessionId, refreshToken.getSessionState());
         assertEquals(clientId, refreshToken.getIssuedFor());
 
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString, clientSecret);
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(refreshTokenString);
         assertEquals(200, refreshResponse.getStatusCode());
 
         AccessToken refreshedToken = oauth.verifyToken(refreshResponse.getAccessToken());
@@ -1305,8 +1260,8 @@ private void doNormalAuthzProcess(String requestUri, String redirectUrl, String
         assertEquals(findUserByUsername(adminClient.realm(REALM_NAME), TEST_USER_NAME).getId(), refreshedToken.getSubject());
 
         // Logout
-        oauth.doLogout(refreshResponse.getRefreshToken(), clientSecret);
-        refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken(), clientSecret);
+        oauth.doLogout(refreshResponse.getRefreshToken());
+        refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken());
         assertEquals(400, refreshResponse.getStatusCode());
     }
 
@@ -1322,16 +1277,16 @@ private void restoreParRealmSettings() {
         setParRealmSettings(DEFAULT_REQUEST_URI_LIFESPAN);
     }
 
-    private static void assertCors(CloseableHttpResponse response) {
-        assertEquals("true", response.getHeaders("Access-Control-Allow-Credentials")[0].getValue());
-        assertEquals(VALID_CORS_URL, response.getHeaders("Access-Control-Allow-Origin")[0].getValue());
-        assertEquals("Access-Control-Allow-Methods", response.getHeaders("Access-Control-Expose-Headers")[0].getValue());
+    private static void assertCors(AbstractHttpResponse response) {
+        assertEquals("true", response.getHeader("Access-Control-Allow-Credentials"));
+        assertEquals(VALID_CORS_URL, response.getHeader("Access-Control-Allow-Origin"));
+        assertEquals("Access-Control-Allow-Methods", response.getHeader("Access-Control-Expose-Headers"));
     }
 
-    private static void assertNotCors(CloseableHttpResponse response) {
-        assertEquals(0, response.getHeaders("Access-Control-Allow-Credentials").length);
-        assertEquals(0, response.getHeaders("Access-Control-Allow-Origin").length);
-        assertEquals(0, response.getHeaders("Access-Control-Expose-Headers").length);
+    private static void assertNotCors(AbstractHttpResponse response) {
+        assertNull(response.getHeader("Access-Control-Allow-Credentials"));
+        assertNull(response.getHeader("Access-Control-Allow-Origin"));
+        assertNull(response.getHeader("Access-Control-Expose-Headers"));
     }
 
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java
index 281e9d8b1a1e..6245321e1728 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java
@@ -54,7 +54,9 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.ParResponse;
 import org.keycloak.util.JWKSUtils;
 import org.keycloak.util.JsonSerialization;
 
@@ -162,25 +164,25 @@ public void testSuccess_Proof_ReqObj_FormParam_QueryParam() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // [2] EC key 
         String requestObject = generateRequestObject(clientId, jktEc);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] jktRsat (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] EC key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -207,25 +209,25 @@ public void testFailure_Proof_ReqObj_FormParam_QueryParam_Token_Proof_Mismatch()
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // [2] EC key 
         String requestObject = generateRequestObject(clientId, jktEc);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] jktRsat (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] RSA key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -252,14 +254,14 @@ public void testFailure_Proof_ReqObj_FormParam_QueryParam_PAR_Proof_Mismatch() t
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // [2] RSA key 
         String requestObject = generateRequestObject(clientId, jktRsa);
   
         // ----- PAR -----
         // [3] EC key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktEc);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktEc);
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("DPoP Proof public key thumbprint does not match dpop_jkt.", pResp.getErrorDescription());
@@ -287,25 +289,25 @@ public void testSuccess_Proof_ReqObj_FormParam() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // [2] EC key 
         String requestObject = generateRequestObject(clientId, jktEc);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -332,25 +334,25 @@ public void testFailure_Proof_ReqObj_FormParam_Token_Proof_Mismatch() throws Exc
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // [2] EC key 
         String requestObject = generateRequestObject(clientId, jktEc);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] RSA key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -378,25 +380,25 @@ public void testSuccess_Proof_ReqObj_QueryParam() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] RSA Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
         // [2] RSA key 
         String requestObject = generateRequestObject(clientId, jktRsa);
   
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, null);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] EC Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
 
         // ----- Token Request -----
         // [5] RSA key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -423,25 +425,25 @@ public void testFailure_Proof_ReqObj_Token_Proof_Mismatch() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] RSA Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
         // [2] RSA key 
         String requestObject = generateRequestObject(clientId, jktRsa);
   
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, null);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, dpopProofEncoded, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -469,22 +471,22 @@ public void testSuccess_Proof_FormObj_QueryParam() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] RSA Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, dpopProofEncoded);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, dpopProofEncoded);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] EC Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
 
         // ----- Token Request -----
         // [5] RSA key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -510,11 +512,11 @@ public void testFailure_Proof_FormObj_QueryParam_PAR_Proof_Mismatch() throws Exc
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] EC Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
 
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, dpopProofEncoded);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, dpopProofEncoded);
         assertEquals(400, pResp.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError());
         assertEquals("DPoP Proof public key thumbprint does not match dpop_jkt.", pResp.getErrorDescription());
@@ -541,22 +543,22 @@ public void testSuccess_Proof_QueryParam() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] RSA Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, dpopProofEncoded);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, dpopProofEncoded);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] EC Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
 
         // ----- Token Request -----
         // [5] RSA key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -583,22 +585,22 @@ public void testFailure_Proof_Token_Proof_Mismatch() throws Exception {
         String clientSecret = getConfidentialClientSecretForTest(clientId);
 
         // [1] RSA Key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getParEndpointUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getPushedAuthorizationRequest(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
 
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, dpopProofEncoded);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, dpopProofEncoded);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -630,18 +632,18 @@ public void testSuccess_ReqObj_FormParam_QueryParam() throws Exception {
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] RSA Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -672,18 +674,18 @@ public void testFailure_ReqObj_FormParam_Token_Proof_Mismatch() throws Exception
   
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, jktRsa);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, jktRsa);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.PS256, jwsRsaHeader, rsaKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -715,18 +717,18 @@ public void testSuccess_ReqObj_QueryParam() throws Exception {
   
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, null);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] RSA Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -756,18 +758,18 @@ public void testFailure_ReqObj_Token_Proof_Mismatch() throws Exception {
   
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, null);
+        ParResponse pResp =  sendPushedAuthorizationRequestWithDpopJkt(clientId, clientSecret, requestObject, null, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -796,18 +798,18 @@ public void testSuccess_FormParam_QueryParam() throws Exception {
  
         // ----- PAR -----
         // [3] EC key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktEc, null);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktEc, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] RSA Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -834,18 +836,18 @@ public void testFailure_FormParam_Token_Proof_Mismatch() throws Exception {
  
         // ----- PAR -----
         // [3] RSA key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, null);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, jktRsa, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -873,18 +875,18 @@ public void testSuccess_QueryParam() throws Exception {
  
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] EC Key (no DPoP Proof/dpop_jkt in PAR so it is effective)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktEc);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -911,18 +913,18 @@ public void testFailure_QueryParam() throws Exception {
  
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] RSA Key (no DPoP Proof/dpop_jkt in PAR so it is effective)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, jktRsa);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(400, res.getStatusCode());
         assertEquals(OAuthErrorException.INVALID_REQUEST, res.getError());
         assertEquals(ERROR_DETAILS, res.getErrorDescription());
@@ -949,18 +951,18 @@ public void testSuccess() throws Exception {
  
         // ----- PAR -----
         // [3] no key
-        OAuthClient.ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
+        ParResponse pResp =  sendGenerateAndPushedAuthorizationRequest(clientId, clientSecret, null, null);
         assertEquals(201, pResp.getStatusCode());
         String requestUri = pResp.getRequestUri();
 
         // ----- Authorization Request -----
         // [4] no Key (always ignores if PAR is used)
-        OAuthClient.AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
+        AuthorizationEndpointResponse loginResponse = sendAuthorizationRequest(clientId, requestUri, null);
 
         // ----- Token Request -----
         // [5] EC key
-        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getAccessTokenUrl(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate());
-        OAuthClient.AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
+        String dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().getToken(), (long) (Time.currentTime() + clockSkew), Algorithm.ES256, jwsEcHeader, ecKeyPair.getPrivate(), null);
+        AccessTokenResponse res = sentTokenRequest(clientId, clientSecret, loginResponse.getCode(), dpopProofEncoded);
         assertEquals(200, res.getStatusCode());
         oauth.verifyToken(res.getAccessToken());
     }
@@ -1013,73 +1015,54 @@ private String generateRequestObject(String clientId, String dpopJkt) throws IOE
         return client.getOIDCRequest();
     }
 
-    private OAuthClient.ParResponse sendGenerateAndPushedAuthorizationRequest(String clientId, String clientSecret, String dpopJkt, String dpopProofEncoded) throws IOException {
-        oauth.clientId(clientId);
+    private ParResponse sendGenerateAndPushedAuthorizationRequest(String clientId, String clientSecret, String dpopJkt, String dpopProofEncoded) throws IOException {
+        oauth.client(clientId, clientSecret);
         oauth.responseType(OAuth2Constants.CODE);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
         oauth.scope(OAuth2Constants.SCOPE_OPENID);
-        oauth.dpopJkt(dpopJkt);
-        oauth.dpopProof(dpopProofEncoded);
-        oauth.request(null);
         // ----- PAR -----
-        OAuthClient.ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().dpopJkt(dpopJkt).dpopProof(dpopProofEncoded).send();
         // revert
-        oauth.clientId(null);
+        oauth.client(null);
         oauth.responseType(null);
         oauth.redirectUri(null);
         oauth.scope(null);
-        oauth.dpopJkt(null);
-        oauth.dpopProof(null);
         return pResp;
     }
 
-    private OAuthClient.ParResponse sendPushedAuthorizationRequestWithDpopJkt(String clientId, String clientSecret, String requestObject, String dpopProofEncoded, String dpopJkt) throws IOException {
-        oauth.clientId(clientId);
-        oauth.request(requestObject);
-        oauth.dpopProof(dpopProofEncoded);
-        oauth.dpopJkt(dpopJkt);
+    private ParResponse sendPushedAuthorizationRequestWithDpopJkt(String clientId, String clientSecret, String requestObject, String dpopProofEncoded, String dpopJkt) throws IOException {
+        oauth.client(clientId, clientSecret);
         oauth.responseType(null);
         oauth.redirectUri(null);
         oauth.scope(null);
         // ----- PAR -----
-        OAuthClient.ParResponse pResp = oauth.doPushedAuthorizationRequest(clientId, clientSecret);
+        ParResponse pResp = oauth.pushedAuthorizationRequest().dpopJkt(dpopJkt).dpopProof(dpopProofEncoded).request(requestObject).send();
         // revert
-        oauth.clientId(null);
-        oauth.request(null);
-        oauth.dpopProof(null);
-        oauth.dpopJkt(null);
+        oauth.client(null);
         return pResp;
     }
 
-    private OAuthClient.AuthorizationEndpointResponse sendAuthorizationRequest(String clientId, String requestUri, String dpopJkt) {
+    private AuthorizationEndpointResponse sendAuthorizationRequest(String clientId, String requestUri, String dpopJkt) {
         // Authorization Request with request_uri of PAR
         // remove parameters as query strings of uri
         oauth.clientId(clientId);
-        oauth.requestUri(requestUri);
-        oauth.dpopJkt(dpopJkt);
         oauth.responseType(null);
         oauth.redirectUri(null);
         oauth.scope(null);
-        oauth.request(null);
-        oauth.dpopProof(null);
         // ----- Authorization Request -----
-        OAuthClient.AuthorizationEndpointResponse loginResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+        AuthorizationEndpointResponse loginResponse = oauth.loginForm().requestUri(requestUri).dpopJkt(dpopJkt).doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
         // revert
         oauth.clientId(null);
-        oauth.requestUri(null);
-        oauth.dpopJkt(null);
         return loginResponse;
     }
 
-    private OAuthClient.AccessTokenResponse sentTokenRequest(String clientId, String clientSecret, String code, String dpopProofEncoded) {
-        oauth.clientId(clientId);
-        oauth.dpopProof(dpopProofEncoded);
+    private AccessTokenResponse sentTokenRequest(String clientId, String clientSecret, String code, String dpopProofEncoded) {
+        oauth.client(clientId, clientSecret);
         oauth.redirectUri(CLIENT_REDIRECT_URI);
         // ----- Token Request -----
-        OAuthClient.AccessTokenResponse res = oauth.doAccessTokenRequest(code, clientSecret);
+        AccessTokenResponse res = oauth.accessTokenRequest(code).dpopProof(dpopProofEncoded).send();
         // revert
-        oauth.clientId(null);
-        oauth.dpopProof(null);
+        oauth.client(null);
         oauth.redirectUri(null);
         return res;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/rar/AbstractRARParserTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/rar/AbstractRARParserTest.java
index cdfb6bd07a64..12e84050c4aa 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/rar/AbstractRARParserTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/rar/AbstractRARParserTest.java
@@ -81,7 +81,6 @@ public void clientConfiguration() {
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").directAccessGrant(true);
         oauth.clientId("test-app");
         oauth.scope(null);
-        oauth.maxAge(null);
     }
 
     /**
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeSAML2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ClientTokenExchangeSAML2Test.java
similarity index 89%
rename from testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeSAML2Test.java
rename to testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ClientTokenExchangeSAML2Test.java
index 51869c7e32da..4c3468afac51 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientTokenExchangeSAML2Test.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ClientTokenExchangeSAML2Test.java
@@ -1,21 +1,23 @@
 /*
- * Copyright 2020 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
  *
- * http://www.apache.org/licenses/LICENSE-2.0
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
  */
 
-package org.keycloak.testsuite.oauth;
+package org.keycloak.testsuite.oauth.tokenexchange;
 
 import org.junit.Rule;
 import org.junit.Test;
@@ -29,8 +31,8 @@
 import org.keycloak.dom.saml.v2.assertion.AssertionType;
 import org.keycloak.dom.saml.v2.assertion.AudienceRestrictionType;
 import org.keycloak.dom.saml.v2.assertion.NameIDType;
+import org.keycloak.models.AdminRoles;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ImpersonationConstants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -50,16 +52,17 @@
 import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
 import org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil;
 import org.keycloak.saml.processing.core.util.XMLEncryptionUtil;
-import org.keycloak.services.resources.admin.permissions.AdminPermissionManagement;
-import org.keycloak.services.resources.admin.permissions.AdminPermissions;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.KeyUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.util.BasicAuthHelper;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -75,9 +78,7 @@
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 
 import static org.junit.Assert.assertNotNull;
 import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_ID;
@@ -90,6 +91,7 @@
  */
 @EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
 @EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
+@DisableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2, skipRestart = true)
 public class ClientTokenExchangeSAML2Test extends AbstractKeycloakTest {
 
     private static final String SAML_SIGNED_TARGET = "http://localhost:8080/saml-signed-assertion/";
@@ -121,7 +123,7 @@ public static void setupRealm(KeycloakSession session) {
         RoleModel exampleRole = realm.getRole("example");
 
         AdminPermissionManagement management = AdminPermissions.management(session, realm);
-        RoleModel impersonateRole = management.getRealmManagementClient().getRole(ImpersonationConstants.IMPERSONATION_ROLE);
+        RoleModel impersonateRole = management.getRealmPermissionsClient().getRole(AdminRoles.IMPERSONATION);
 
         ClientModel clientExchanger = realm.addClient("client-exchanger");
         clientExchanger.setClientId("client-exchanger");
@@ -236,19 +238,16 @@ public void testExchangeToSAML2SignedAssertion() throws Exception {
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        oauth.client("client-exchanger", "secret");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "user");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
-
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -278,7 +277,8 @@ public void testExchangeToSAML2SignedAssertion() throws Exception {
         }
 
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_TARGET, "legal", "secret", params);
+            oauth.client("legal", "secret");
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -304,7 +304,8 @@ public void testExchangeToSAML2SignedAssertion() throws Exception {
             Assert.assertTrue(roles.contains("example"));
         }
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_TARGET, "illegal", "secret", params);
+            oauth.client("illegal", "secret");
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
             Assert.assertEquals(403, response.getStatusCode());
         }
     }
@@ -315,19 +316,16 @@ public void testExchangeToSAML2EncryptedAssertion() throws Exception {
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        oauth.client("client-exchanger", "secret");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "user");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
-
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_ENCRYPTED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_ENCRYPTED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -363,19 +361,16 @@ public void testExchangeToSAML2SignedAndEncryptedAssertion() throws Exception {
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        oauth.client("client-exchanger", "secret");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "user");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
-
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_AND_ENCRYPTED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_AND_ENCRYPTED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -409,19 +404,16 @@ public void testExchangeToSAML2UnsignedAndUnencryptedAssertion() throws Exceptio
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        oauth.client("client-exchanger", "secret");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "user");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
-
         {
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_UNSIGNED_AND_UNENCRYPTED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_UNSIGNED_AND_UNENCRYPTED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -453,22 +445,19 @@ public void testImpersonation() throws Exception {
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
+        oauth.client("client-exchanger", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "user");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
 
         // client-exchanger can impersonate from token "user" to user "impersonated-user" and to "target" client
         {
-            params.put(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user");
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).requestedSubject("impersonated-user").send();
 
             String exchangedTokenString = response.getAccessToken();
             String assertionXML = new String(Base64Url.decode(exchangedTokenString), StandardCharsets.UTF_8);
@@ -501,22 +490,18 @@ public void testBadImpersonator() throws Exception {
         testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
 
         oauth.realm(TEST);
-        oauth.clientId("client-exchanger");
+        oauth.client("client-exchanger", "secret");
 
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "bad-impersonator", "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse response = oauth.doPasswordGrantRequest("bad-impersonator", "password");
         String accessToken = response.getAccessToken();
         TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
         AccessToken token = accessTokenVerifier.parse().getToken();
         Assert.assertEquals(token.getPreferredUsername(), "bad-impersonator");
         Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
 
-        Map<String, String> params = new HashMap<>();
-        params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
-
         // test that user does not have impersonator permission
         {
-            params.put(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user");
-            response = oauth.doTokenExchange(TEST, accessToken, SAML_SIGNED_TARGET, "client-exchanger", "secret", params);
+            response = oauth.tokenExchangeRequest(accessToken).audience(SAML_SIGNED_TARGET).requestedTokenType(OAuth2Constants.SAML2_TOKEN_TYPE).requestedSubject("impersonated-user").send();
             Assert.assertEquals(403, response.getStatusCode());
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ExternalInternalTokenExchangeV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ExternalInternalTokenExchangeV2Test.java
new file mode 100644
index 000000000000..067828842fc9
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/ExternalInternalTokenExchangeV2Test.java
@@ -0,0 +1,311 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.admin.client.resource.IdentityProviderResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.common.Profile;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.IdentityProviderSyncMode;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
+import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.IdentityProviderRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.broker.AbstractInitializedBaseBrokerTest;
+import org.keycloak.testsuite.broker.BrokerConfiguration;
+import org.keycloak.testsuite.broker.BrokerTestConstants;
+import org.keycloak.testsuite.broker.KcOidcBrokerConfiguration;
+import org.keycloak.testsuite.util.AdminClientUtil;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.util.BasicAuthHelper;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.junit.Assert.assertEquals;
+import static org.keycloak.broker.oidc.OAuth2IdentityProviderConfig.TOKEN_INTROSPECTION_URL;
+import static org.keycloak.broker.oidc.OAuth2IdentityProviderConfig.TOKEN_ENDPOINT_URL;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.CLIENT_ID;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.IDP_OIDC_ALIAS;
+import static org.keycloak.testsuite.broker.BrokerTestConstants.REALM_CONS_NAME;
+import static org.keycloak.testsuite.broker.BrokerTestTools.getProviderRoot;
+
+/**
+ * Test for external-internal token exchange using token_exchange_external_internal:v2
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@EnableFeature(Profile.Feature.TOKEN_EXCHANGE_EXTERNAL_INTERNAL_V2)
+public class ExternalInternalTokenExchangeV2Test extends AbstractInitializedBaseBrokerTest {
+
+    @Override
+    protected BrokerConfiguration getBrokerConfiguration() {
+        return new KcOidcBrokerConfiguration() {
+
+            @Override
+            protected void applyDefaultConfiguration(Map<String, String> config, IdentityProviderSyncMode syncMode) {
+                super.applyDefaultConfiguration(config, syncMode);
+                config.put(TOKEN_INTROSPECTION_URL, config.get(TOKEN_ENDPOINT_URL) + "/introspect");
+            }
+
+            @Override
+            public List<ClientRepresentation> createProviderClients() {
+                List<ClientRepresentation> providerClients = super.createProviderClients();
+                ClientRepresentation brokerApp = providerClients.stream()
+                        .filter(client -> CLIENT_ID.equals(client.getClientId()))
+                        .findFirst().get();
+                brokerApp.setDirectAccessGrantsEnabled(true);
+
+                ClientRepresentation client2 = createProviderClientWithAudienceMapper("client-with-brokerapp-audience", CLIENT_ID);
+                ClientRepresentation client3 = createProviderClientWithAudienceMapper("client-with-consumer-realm-issuer-audience", getProviderRoot() + "/auth/realms/" + REALM_CONS_NAME);
+                ClientRepresentation client4 = createProviderClientWithAudienceMapper("client-without-valid-audience", "some-random-audience");
+
+                providerClients = new ArrayList<>(providerClients);
+                providerClients.addAll(Arrays.asList(client2, client3, client4));
+                return providerClients;
+            }
+
+            private ClientRepresentation createProviderClientWithAudienceMapper(String clientId, String hardcodedAudience) {
+                ClientRepresentation client = new ClientRepresentation();
+                client.setClientId(clientId);
+                client.setSecret("secret");
+                client.setDirectAccessGrantsEnabled(true);
+
+                ProtocolMapperRepresentation hardcodedAudienceMapper = new ProtocolMapperRepresentation();
+                hardcodedAudienceMapper.setName("audience");
+                hardcodedAudienceMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+                hardcodedAudienceMapper.setProtocolMapper(AudienceProtocolMapper.PROVIDER_ID);
+
+                Map<String, String> hardcodedAudienceMapperConfig = hardcodedAudienceMapper.getConfig();
+                hardcodedAudienceMapperConfig.put(AudienceProtocolMapper.INCLUDED_CUSTOM_AUDIENCE, hardcodedAudience);
+                hardcodedAudienceMapperConfig.put(OIDCAttributeMapperHelper.INCLUDE_IN_ACCESS_TOKEN, "true");
+
+                client.setProtocolMappers(Collections.singletonList(hardcodedAudienceMapper));
+                return client;
+            }
+
+        };
+    }
+
+    private static void setupRealm(KeycloakSession session) {
+        RealmModel realm = session.getContext().getRealm();
+        IdentityProviderModel idp = session.identityProviders().getByAlias(IDP_OIDC_ALIAS);
+        org.junit.Assert.assertNotNull(idp);
+
+        ClientModel client = realm.addClient("test-app");
+        client.setClientId("test-app");
+        client.setPublicClient(false);
+        client.setDirectAccessGrantsEnabled(true);
+        client.setEnabled(true);
+        client.setSecret("secret");
+        client.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        client.setFullScopeAllowed(false);
+        client.setRedirectUris(Set.of(OAuthClient.AUTH_SERVER_ROOT + "/*"));
+
+        realm = session.realms().getRealmByName(BrokerTestConstants.REALM_PROV_NAME);
+        client = realm.getClientByClientId("brokerapp");
+        client.addRedirectUri(OAuthClient.APP_ROOT + "/auth");
+        client.setAttribute(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, OAuthClient.APP_ROOT + "/admin/backchannelLogout");
+    }
+
+
+    @Test
+    public void testSuccess_externalTokenIssuedToBrokerClient() throws Exception {
+        ClientRepresentation brokerApp = getBrokerAppClient();
+
+        // Send initial direct-grant request
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+        // Send token-exchange
+        testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+            assertThat(tokenExchangeResponse.getStatus(), equalTo(200));
+            AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+            assertThat(externalToInternalTokenResponse.getToken(), notNullValue());
+        });
+    }
+
+
+    @Test
+    public void testSuccess_brokerClientAsAudienceOfExternalToken() throws Exception {
+        // Send initial direct-grant request. Token is issued to the "client-with-brokerapp-audience". Client "brokerapp" is available inside token audience
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client("client-with-brokerapp-audience", "secret").doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+        testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+            assertThat(tokenExchangeResponse.getStatus(), equalTo(200));
+            AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+            assertThat(externalToInternalTokenResponse.getToken(), notNullValue());
+        });
+    }
+
+
+    @Test
+    public void testSuccess_consumerRealmIssuerAsAudienceOfExternalToken() throws Exception {
+        // Send initial direct-grant request. Token is issued to the "client-with-consumer-realm-issuer-audience". Consumer realm is available inside token audience and hence token considered as valid external token for the token exchange
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client("client-with-consumer-realm-issuer-audience", "secret").doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+        testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+            assertThat(tokenExchangeResponse.getStatus(), equalTo(200));
+            AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+            assertThat(externalToInternalTokenResponse.getToken(), notNullValue());
+        });
+    }
+
+
+    @Test
+    public void testFailure_externalTokenIssuedToInvalidClient() throws Exception {
+        // Send initial direct-grant request. Token is issued to the "client-without-valid-audience". This external token will fail token-exchange as token is not issued to brokerapp and there is not any valid audience available
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client("client-without-valid-audience", "secret").doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+        testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+            assertThat(tokenExchangeResponse.getStatus(), equalTo(400));
+            AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+            assertThat(externalToInternalTokenResponse.getToken(), nullValue());
+            assertEquals("Token not authorized for token exchange", externalToInternalTokenResponse.getErrorDescription());
+        });
+    }
+
+    @Test
+    public void testFailure_externalTokenIntrospectionFailureDueInvalidClientCredentials() throws Exception {
+        // Update IDP and set invalid credentials there
+        IdentityProviderResource idpResource = adminClient.realm(REALM_CONS_NAME).identityProviders().get(IDP_OIDC_ALIAS);
+        IdentityProviderRepresentation idpRep = idpResource.toRepresentation();
+        idpRep.getConfig().put("clientSecret", "invalid");
+        idpResource.update(idpRep);
+
+        ClientRepresentation brokerApp = getBrokerAppClient();
+
+        try {
+            org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+            assertThat(tokenResponse.getIdToken(), notNullValue());
+
+            testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+            testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+                assertThat(tokenExchangeResponse.getStatus(), equalTo(400));
+                AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+                assertThat(externalToInternalTokenResponse.getToken(), nullValue());
+                assertEquals("Introspection endpoint call failure. Introspection response status: 401", externalToInternalTokenResponse.getErrorDescription());
+            });
+        } finally {
+            // Revert IDP config
+            idpRep.getConfig().put("clientSecret", brokerApp.getSecret());
+            idpResource.update(idpRep);
+        }
+    }
+
+
+    @Test
+    public void testFailure_inactiveExternalToken() throws Exception {
+        ClientRepresentation brokerApp = getBrokerAppClient();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.realm(bc.providerRealmName()).client(brokerApp.getClientId(), brokerApp.getSecret()).doPasswordGrantRequest(bc.getUserLogin(), bc.getUserPassword());
+        assertThat(tokenResponse.getIdToken(), notNullValue());
+
+        testingClient.server(BrokerTestConstants.REALM_CONS_NAME).run(ExternalInternalTokenExchangeV2Test::setupRealm);
+
+        setTimeOffset(3600);
+
+        testTokenExchange(tokenResponse.getAccessToken(), (tokenExchangeResponse) -> {
+            assertThat(tokenExchangeResponse.getStatus(), equalTo(400));
+            AccessTokenResponse externalToInternalTokenResponse = tokenExchangeResponse.readEntity(AccessTokenResponse.class);
+            assertThat(externalToInternalTokenResponse.getToken(), nullValue());
+            assertEquals("Token not active", externalToInternalTokenResponse.getErrorDescription());
+        });
+    }
+
+    private void testTokenExchange(String subjectToken, Consumer<Response> tokenExchangeResponseConsumer) {
+        // Send token-exchange
+        try (Client httpClient = AdminClientUtil.createResteasyClient()) {
+            WebTarget exchangeUrl = getConsumerTokenEndpoint(httpClient);
+
+            String subjectTokenType = OAuth2Constants.ACCESS_TOKEN_TYPE; // hardcoded to access-token just for now. More types might need to be tested...
+            try (Response response = sendExternalInternalTokenExchangeRequest(exchangeUrl, subjectToken, subjectTokenType)) {
+                tokenExchangeResponseConsumer.accept(response);
+            }
+        }
+    }
+
+    private Response sendExternalInternalTokenExchangeRequest(WebTarget exchangeUrl, String subjectToken, String subjectTokenType) {
+        return exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader(
+                        "test-app", "secret"))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, subjectToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, subjectTokenType)
+                                .param(OAuth2Constants.SUBJECT_ISSUER, bc.getIDPAlias())
+                                .param(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
+
+                ));
+    }
+
+    private WebTarget getConsumerTokenEndpoint(Client httpClient) {
+        return httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(bc.consumerRealmName())
+                .path("protocol/openid-connect/token");
+    }
+
+    private ClientRepresentation getBrokerAppClient() {
+        RealmResource providerRealm = realmsResouce().realm(bc.providerRealmName());
+        ClientsResource clients = providerRealm.clients();
+        return clients.findByClientId("brokerapp").get(0);
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV1Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV1Test.java
new file mode 100755
index 000000000000..a286d12847c8
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV1Test.java
@@ -0,0 +1,547 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import org.junit.Rule;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.TokenVerifier;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.ClientsResource;
+import org.keycloak.common.Profile;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testsuite.AbstractKeycloakTest;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import jakarta.ws.rs.core.Response;
+
+import java.util.Arrays;
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
+
+/**
+ * Tests for standard token exchange (internal-internal) and token-exchange-v1
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
+@EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
+@DisableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2, skipRestart = true)
+public class StandardTokenExchangeV1Test extends AbstractKeycloakTest {
+
+    @Rule
+    public AssertEvents events = new AssertEvents(this);
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation testRealmRep = new RealmRepresentation();
+        testRealmRep.setId(TEST);
+        testRealmRep.setRealm(TEST);
+        testRealmRep.setEnabled(true);
+        testRealms.add(testRealmRep);
+    }
+
+    @Override
+    protected boolean isImportAfterEachMethod() {
+        return true;
+    }
+
+    protected void setupRealm() {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+    }
+
+    protected String getInitialAccessTokenForClientExchanger() throws Exception {
+        oauth.client("client-exchanger", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertNotNull(token.getSessionId());
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+        return accessToken;
+    }
+
+    protected String getSessionIdFromToken(String accessToken) throws Exception {
+        return TokenVerifier.create(accessToken, AccessToken.class)
+                .parse()
+                .getToken()
+                .getSessionId();
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchange() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        String accessToken = getInitialAccessTokenForClientExchanger();
+
+        {
+            oauth.client("client-exchanger", "secret");
+            AccessTokenResponse response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            Assert.assertEquals(OAuth2Constants.REFRESH_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+        }
+
+        {
+            oauth.client("legal", "secret");
+            AccessTokenResponse response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            Assert.assertEquals(OAuth2Constants.REFRESH_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            Assert.assertEquals("legal", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+        }
+        {
+            oauth.client("illegal", "secret");
+            AccessTokenResponse response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            Assert.assertEquals(403, response.getStatusCode());
+        }
+    }
+
+    @Test
+    public void testExchangeRequestAccessTokenType() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        String accessToken = getInitialAccessTokenForClientExchanger();
+
+        {
+            oauth.client("client-exchanger", "secret");
+            AccessTokenResponse response = oauth.tokenExchangeRequest(accessToken).audience("target").requestedTokenType(OAuth2Constants.ACCESS_TOKEN_TYPE).send();
+            Assert.assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+        }
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeUsingServiceAccount() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("my-service-account", "secret");
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertNull(token.getSessionId());
+
+        {
+            response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            Assert.assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertNull(exchangedToken.getSessionId());
+            Assert.assertEquals("my-service-account", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "service-account-my-service-account");
+        }
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeDifferentScopes() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        String accessToken = getInitialAccessTokenForClientExchanger();
+
+        oauth.client("different-scope-client", "secret");
+        {
+            AccessTokenResponse response = oauth.doTokenExchange(accessToken);
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
+            Assert.assertNull(exchangedToken.getAudience());
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            String[] expectedScopes = new String[] { "profile", "openid" };
+            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")), expectedScopes);
+            Assert.assertNull(exchangedToken.getEmailVerified());
+        }
+
+        {
+            AccessTokenResponse response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            Assert.assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+            String[] expectedScopes = new String[] { "profile", "email", "openid" };
+            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),expectedScopes);
+            Assert.assertFalse(exchangedToken.getEmailVerified());
+        }
+
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeDifferentScopesWithScopeParameter() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+        oauth.scope("openid profile email phone");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+        Assert.assertNames(Arrays.asList(token.getScope().split(" ")),"profile", "email", "openid", "phone");
+        //change scopes for token exchange - profile,phone must be removed
+        oauth.scope("openid profile email");
+        oauth.client("different-scope-client", "secret");
+        {
+            response = oauth.doTokenExchange(accessToken);
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
+            Assert.assertNull(exchangedToken.getAudience());
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile", "openid");
+            Assert.assertNull(exchangedToken.getEmailVerified());
+        }
+
+        {
+            response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("different-scope-client", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+            Assert.assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+            Assert.assertNames(Arrays.asList(exchangedToken.getScope().split(" ")),"profile", "email","openid");
+            Assert.assertFalse(exchangedToken.getEmailVerified());
+        }
+        oauth.scope(null);
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeFromPublicClient() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("direct-public", "secret");
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(authzResponse.getCode());
+
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        oauth.client("client-exchanger", "secret");
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        String exchangedTokenString = response.getAccessToken();
+        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+        AccessToken exchangedToken = verifier.parse().getToken();
+        Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
+        Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+        Assert.assertEquals(exchangedToken.getPreferredUsername(), "user");
+        assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+
+        // can exchange to itself because the client is within the audience of the token issued to the public client
+        response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        oauth.client("direct-legal", "secret");
+
+        // can not exchange to itself because the client is not within the audience of the token issued to the public client
+        response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+
+        oauth.client("direct-public");
+
+        response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeNoRefreshToken() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+
+        ClientResource client = ApiUtil.findClientByClientId(adminClient.realm(TEST), "no-refresh-token");
+        ClientRepresentation clientRepresentation = client.toRepresentation();
+        clientRepresentation.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "false");
+        client.update(clientRepresentation);
+
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+
+        {
+            response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            String exchangedTokenString = response.getAccessToken();
+            String refreshTokenString = response.getRefreshToken();
+            assertNotNull(exchangedTokenString);
+            assertNotNull(refreshTokenString);
+        }
+
+        {
+            oauth.client("no-refresh-token", "secret");
+            response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+            String exchangedTokenString = response.getAccessToken();
+            String refreshTokenString = response.getRefreshToken();
+            assertNotNull(exchangedTokenString);
+            assertNull(refreshTokenString);
+        }
+        clientRepresentation.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "true");
+        client.update(clientRepresentation);
+    }
+
+    @Test
+    public void testClientExchangeToItself() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+        String accessToken = getInitialAccessTokenForClientExchanger();
+
+        AccessTokenResponse response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("client-exchanger").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+    }
+
+    @Test
+    public void testClientExchangeToItselfWithConsents() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        String accessToken = getInitialAccessTokenForClientExchanger();
+
+        ClientResource client = ApiUtil.findClientByClientId(adminClient.realm(TEST), "client-exchanger");
+        ClientRepresentation clientRepresentation = client.toRepresentation();
+        clientRepresentation.setConsentRequired(Boolean.TRUE);
+        client.update(clientRepresentation);
+
+        oauth.client("client-exchanger", "secret");
+
+        AccessTokenResponse response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+        assertEquals("Client requires user consent", response.getErrorDescription());
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("client-exchanger").send();
+        assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+        assertEquals("Client requires user consent", response.getErrorDescription());
+    }
+
+    @Test
+    public void testClientExchange() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("direct-legal", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+    }
+
+    @Test
+    public void testClientExchangeWithMoreAudiencesNotBreak() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("target", "client-exchanger").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+    }
+
+    @Test
+    public void testPublicClientNotAllowed() throws Exception {
+        setupRealm();
+
+        oauth.realm(TEST);
+        oauth.client("direct-legal", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        // public client has no permission to exchange with the client direct-legal to which the token was issued for
+        // if not set, the audience is calculated based on the client to which the token was issued for
+        oauth.client("direct-public");
+
+        response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+        assertEquals("Client is not the holder of the token", response.getErrorDescription());
+
+        // public client has no permission to exchange
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+        assertEquals("Client is not the holder of the token", response.getErrorDescription());
+
+        response = oauth.tokenExchangeRequest(accessToken).audience("direct-legal").send();
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+        assertEquals("Client is not the holder of the token", response.getErrorDescription());
+
+        // public client can not exchange a token to itself if the token was issued to another client
+        response = oauth.tokenExchangeRequest(accessToken).audience("direct-public").send();
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+        assertEquals("Client is not the holder of the token", response.getErrorDescription());
+
+        oauth.client("client-exchanger", "secret");
+
+        // client with access to exchange
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        // client must pass the audience because the client has no permission to exchange with the calculated audience (direct-legal)
+        response = oauth.doTokenExchange(accessToken);
+        assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+        assertEquals("Client is not within the token audience", response.getErrorDescription());
+    }
+
+    @Test
+    @EnableFeature(value = Profile.Feature.DYNAMIC_SCOPES, skipRestart = true)
+    @UncaughtServerErrorExpected
+    public void testExchangeWithDynamicScopesEnabled() throws Exception {
+        testExchange();
+    }
+
+    @Test
+    public void testSupportedTokenTypesWhenValidatingSubjectToken() throws Exception {
+        setupRealm();
+        oauth.realm(TEST);
+        oauth.client("direct-legal", "secret");
+        oauth.scope(OAuth2Constants.SCOPE_OPENID);
+        ClientsResource clients = adminClient.realm(oauth.getRealm()).clients();
+        ClientRepresentation rep = clients.findByClientId(oauth.getClientId()).get(0);
+        rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, oauth.APP_ROOT + "/admin/backchannelLogout");
+        getCleanup().addCleanup(() -> {
+            rep.getAttributes().put(OIDCConfigAttributes.BACKCHANNEL_LOGOUT_URL, "");
+            clients.get(rep.getId()).update(rep);
+        });
+        clients.get(rep.getId()).update(rep);
+        String logoutToken;
+        oauth.doLogin("user", "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
+        String idTokenString = tokenResponse.getIdToken();
+        oauth.logoutForm().idTokenHint(idTokenString)
+                .postLogoutRedirectUri(oauth.APP_AUTH_ROOT).open();
+        logoutToken = testingClient.testApp().getBackChannelRawLogoutToken();
+        Assert.assertNotNull(logoutToken);
+        AccessTokenResponse response = oauth.tokenExchangeRequest(logoutToken).audience("target").send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+
+    }
+
+    @Test
+    public void testExchangeForDifferentClient() throws Exception {
+        setupRealm();
+
+        // generate the first token for a public client
+        oauth.realm(TEST);
+        oauth.client("direct-public");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+        Assert.assertNotNull(token.getSessionId());
+        String sid = token.getSessionId();
+
+        oauth.client("client-exchanger", "secret");
+
+        // perform token exchange with client-exchanger simulating it received the previous token
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        accessToken = response.getAccessToken();
+        accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals("client-exchanger", token.getIssuedFor());
+        Assert.assertEquals("target", token.getAudience()[0]);
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        Assert.assertEquals(sid, token.getSessionId());
+
+        // perform a second token exchange just to check everything is OK
+        response = oauth.tokenExchangeRequest(accessToken).audience("target").send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        accessToken = response.getAccessToken();
+        accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals("client-exchanger", token.getIssuedFor());
+        Assert.assertEquals("target", token.getAudience()[0]);
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        Assert.assertEquals(sid, token.getSessionId());
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java
new file mode 100644
index 000000000000..205753891cc6
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2Test.java
@@ -0,0 +1,1285 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import jakarta.ws.rs.NotAuthorizedException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.hamcrest.MatcherAssert;
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.Assert;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.TokenVerifier;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.admin.client.resource.ClientResource;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.common.Profile;
+import org.keycloak.common.util.CollectionUtil;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
+import org.keycloak.models.AccountRoles;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.Constants;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
+import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.representations.oidc.TokenMetadataRepresentation;
+import org.keycloak.services.clientpolicy.ClientPolicyEvent;
+import org.keycloak.services.clientpolicy.condition.ClientScopesConditionFactory;
+import org.keycloak.services.clientpolicy.condition.GrantTypeConditionFactory;
+import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
+import org.keycloak.testsuite.broker.util.SimpleHttpDefault;
+import org.keycloak.testsuite.client.policies.AbstractClientPoliciesTest;
+import org.keycloak.testsuite.pages.ConsentPage;
+import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutorFactory;
+import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
+import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
+import org.keycloak.testsuite.updaters.ProtocolMappersUpdater;
+import org.keycloak.testsuite.updaters.RoleScopeUpdater;
+import org.keycloak.testsuite.updaters.UserAttributeUpdater;
+import org.keycloak.testsuite.util.ClientPoliciesUtil;
+import org.keycloak.testsuite.util.ServerURLs;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.UserInfoResponse;
+import org.keycloak.testsuite.util.oauth.TokenExchangeRequest;
+import org.keycloak.testsuite.utils.tls.TLSUtils;
+import org.keycloak.util.TokenUtil;
+
+import java.io.IOException;
+import java.util.List;
+
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
+import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
+import static org.keycloak.testsuite.util.ClientPoliciesUtil.createClientScopesConditionConfig;
+import static org.keycloak.testsuite.util.ClientPoliciesUtil.createGrantTypeConditionConfig;
+import static org.keycloak.testsuite.util.ClientPoliciesUtil.createTestRaiseExeptionExecutorConfig;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class StandardTokenExchangeV2Test extends AbstractClientPoliciesTest {
+
+    @Page
+    protected ConsentPage consentPage;
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation testRealm = loadJson(getClass().getResourceAsStream("/token-exchange/testrealm-token-exchange-v2.json"), RealmRepresentation.class);
+        testRealms.add(testRealm);
+    }
+
+    protected String getSessionIdFromToken(String accessToken) throws Exception {
+        return TokenVerifier.create(accessToken, AccessToken.class)
+                .parse()
+                .getToken()
+                .getSessionId();
+    }
+
+    protected AccessTokenResponse resourceOwnerLogin(String username, String password, String clientId, String secret) throws Exception {
+        return resourceOwnerLogin(username, password, clientId, secret, null);
+    }
+
+    private AccessTokenResponse resourceOwnerLogin(String username, String password, String clientId, String secret, String scope) throws Exception {
+        oauth.realm(TEST);
+        oauth.client(clientId, secret);
+        oauth.scope(scope);
+        oauth.openid(false);
+        events.clear();
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(username, password);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(response.getAccessToken(), AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        events.expect(EventType.LOGIN)
+                .client(clientId)
+                .user(token.getSubject())
+                .session(token.getSessionId())
+                .detail(Details.USERNAME, username)
+                .assertEvent();
+        return response;
+    }
+
+    private String loginWithConsents(UserRepresentation user, String password, String clientId, String secret) throws Exception {
+        oauth.client(clientId, secret).doLogin(user.getUsername(), password);
+        consentPage.assertCurrent();
+        consentPage.confirm();
+        assertNotNull(oauth.parseLoginResponse().getCode());
+        AccessTokenResponse response = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(response.getAccessToken(), AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        final EventRepresentation loginEvent = events.expectLogin()
+                .client(clientId)
+                .user(user.getId())
+                .session(token.getSessionId())
+                .detail(Details.USERNAME, user.getUsername())
+                .detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED)
+                .assertEvent();
+        final String codeId = loginEvent.getDetails().get(Details.CODE_ID);
+        events.expectCodeToToken(codeId, token.getSessionId())
+                .client(clientId)
+                .user(user.getId())
+                .assertEvent();
+        return response.getAccessToken();
+    }
+
+    protected AccessTokenResponse tokenExchange(String subjectToken, String clientId, String secret, List<String> audience, String requestedTokenType) {
+        return oauth.tokenExchangeRequest(subjectToken).client(clientId, secret).audience(audience).requestedTokenType(requestedTokenType).send();
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testSubjectTokenType() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+        TokenExchangeRequest request = oauth.tokenExchangeRequest(accessToken, OAuth2Constants.ACCESS_TOKEN_TYPE);
+        AccessTokenResponse response = request.send();
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        request = oauth.tokenExchangeRequest(accessToken, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        response = request.send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+
+        request = oauth.tokenExchangeRequest(accessToken, OAuth2Constants.ID_TOKEN_TYPE);
+        response = request.send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+
+        request = oauth.tokenExchangeRequest(accessToken, OAuth2Constants.SAML2_TOKEN_TYPE);
+        response = request.send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+
+        request = oauth.tokenExchangeRequest(accessToken, OAuth2Constants.JWT_TOKEN_TYPE);
+        response = request.send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+
+        request = oauth.tokenExchangeRequest(accessToken, "WRONG_TOKEN_TYPE");
+        response = request.send();
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testRequestedTokenType() throws Exception {
+        final UserRepresentation john = ApiUtil.findUserByUsername(adminClient.realm(TEST), "john");
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin(john.getUsername(), "password", "subject-client", "secret").getAccessToken();
+
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ACCESS_TOKEN_TYPE);
+        assertAudiencesAndScopes(response, john, List.of("target-client1"), List.of("default-scope1"));
+        assertNotNull(response.getAccessToken());
+        assertEquals(TokenUtil.TOKEN_TYPE_BEARER, response.getTokenType());
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, Boolean.FALSE.toString())
+                .update()) {
+            response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+            assertEquals("requested_token_type unsupported", response.getErrorDescription());
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("requester-client")
+                    .error(Errors.INVALID_REQUEST)
+                    .user(john.getId())
+                    .session(AssertEvents.isUUID())
+                    .detail(Details.REASON, "requested_token_type unsupported")
+                    .detail(Details.REQUESTED_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE)
+                    .detail(Details.SUBJECT_TOKEN_CLIENT_ID, "subject-client")
+                    .assertEvent();
+        }
+
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update()) {
+            response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertAudiencesAndScopes(response, john, List.of("target-client1"), List.of("default-scope1"), OAuth2Constants.REFRESH_TOKEN_TYPE, "subject-client");
+            assertNotNull(response.getAccessToken());
+            assertEquals(TokenUtil.TOKEN_TYPE_BEARER, response.getTokenType());
+            assertEquals(OAuth2Constants.REFRESH_TOKEN_TYPE, response.getIssuedTokenType());
+        }
+
+        response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ID_TOKEN_TYPE);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+        assertNotNull(response.getAccessToken());
+        assertEquals(TokenUtil.TOKEN_TYPE_NA, response.getTokenType());
+        assertEquals(OAuth2Constants.ID_TOKEN_TYPE, response.getIssuedTokenType());
+        events.expect(EventType.TOKEN_EXCHANGE)
+                .client("requester-client")
+                .user(john.getId())
+                .session(AssertEvents.isUUID())
+                .detail(Details.REQUESTED_TOKEN_TYPE, OAuth2Constants.ID_TOKEN_TYPE)
+                .detail(Details.SUBJECT_TOKEN_CLIENT_ID, "subject-client")
+                .assertEvent();
+
+        response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.JWT_TOKEN_TYPE);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("requested_token_type unsupported", response.getErrorDescription());
+        events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                .client("requester-client")
+                .error(Errors.INVALID_REQUEST)
+                .user(john.getId())
+                .session(AssertEvents.isUUID())
+                .detail(Details.REASON, "requested_token_type unsupported")
+                .detail(Details.REQUESTED_TOKEN_TYPE, OAuth2Constants.JWT_TOKEN_TYPE)
+                .detail(Details.SUBJECT_TOKEN_CLIENT_ID, "subject-client")
+                .assertEvent();
+
+        response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.SAML2_TOKEN_TYPE);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("requested_token_type unsupported", response.getErrorDescription());
+        events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                .client("requester-client")
+                .error(Errors.INVALID_REQUEST)
+                .user(john.getId())
+                .session(AssertEvents.isUUID())
+                .detail(Details.REASON, "requested_token_type unsupported")
+                .detail(Details.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE)
+                .detail(Details.SUBJECT_TOKEN_CLIENT_ID, "subject-client")
+                .assertEvent();
+
+        response = tokenExchange(accessToken, "requester-client", "secret", null, "WRONG_TOKEN_TYPE");
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("requested_token_type unsupported", response.getErrorDescription());
+        events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                .client("requester-client")
+                .error(Errors.INVALID_REQUEST)
+                .user(john.getId())
+                .session(AssertEvents.isUUID())
+                .detail(Details.REASON, "requested_token_type unsupported")
+                .detail(Details.REQUESTED_TOKEN_TYPE, "WRONG_TOKEN_TYPE")
+                .detail(Details.SUBJECT_TOKEN_CLIENT_ID, "subject-client")
+                .assertEvent();
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchange() throws Exception {
+        final UserRepresentation john = ApiUtil.findUserByUsername(adminClient.realm(TEST), "john");
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+        {
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+            assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            assertEquals("requester-client", exchangedToken.getIssuedFor());
+            events.expect(EventType.TOKEN_EXCHANGE)
+                    .client(exchangedToken.getIssuedFor())
+                    .user(john.getId())
+                    .session(exchangedToken.getSessionId())
+                    .detail(Details.USERNAME, john.getUsername())
+                    .assertEvent();
+        }
+        {
+            //exchange not allowed due the invalid client is not in the subject-client audience
+            AccessTokenResponse response = tokenExchange(accessToken, "invalid-requester-client", "secret", null, null);
+            assertEquals(403, response.getStatusCode());
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("invalid-requester-client")
+                    .error(Errors.NOT_ALLOWED)
+                    .user(john.getId())
+                    .session(AssertEvents.isUUID())
+                    .detail(Details.REASON, "client is not within the token audience")
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void testTransientSessionForRequester() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserRepresentation john = ApiUtil.findUserByUsername(realm, "john");
+
+        oauth.realm(TEST);
+        final String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+        oauth.scope(OAuth2Constants.SCOPE_OPENID); // add openid scope for the user-info request
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+        final String exchangedTokenString = response.getAccessToken();
+        final AccessToken exchangedToken = TokenVerifier.create(exchangedTokenString, AccessToken.class).parse().getToken();
+        assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+        assertEquals("requester-client", exchangedToken.getIssuedFor());
+        assertAccessTokenContext(exchangedToken.getId(), AccessTokenContext.SessionType.ONLINE_TRANSIENT_CLIENT,
+                AccessTokenContext.TokenType.REGULAR, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+        // assert introspection and user-info works
+        assertIntrospectSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+        assertUserInfoSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+
+        // assert introspection and user-info works in 10s
+        setTimeOffset(10);
+        assertIntrospectSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+        assertUserInfoSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+
+        // assert introspection and user-info fails with session deleted
+        realm.deleteSession(exchangedToken.getSessionId(), false);
+        assertIntrospectError(exchangedTokenString, "requester-client", "secret");
+        assertUserInfoError(exchangedTokenString, "requester-client", "secret", "invalid_token", Errors.USER_SESSION_NOT_FOUND);
+    }
+
+    @Test
+    public void testTransientOfflineSessionForRequester() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserRepresentation john = ApiUtil.findUserByUsername(realm, "john");
+        try (RealmAttributeUpdater realUpdater = new RealmAttributeUpdater(realm)
+                .setSsoSessionMaxLifespan(600)
+                .update();
+             ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "subject-client")
+                .setOptionalClientScopes(List.of(OAuth2Constants.OFFLINE_ACCESS))
+                .update()) {
+
+            // Login, which creates offline-session
+            oauth.realm(TEST);
+            final AccessTokenResponse initialResponse = resourceOwnerLogin("john", "password", "subject-client", "secret", OAuth2Constants.OFFLINE_ACCESS);
+            String accessToken = initialResponse.getAccessToken();
+
+            // Regular token-exchange with the access token as requested_token_type
+            oauth.scope(OAuth2Constants.SCOPE_OPENID); // add openid scope for the user-info request
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+            assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            AccessToken exchangedToken = TokenVerifier.create(exchangedTokenString, AccessToken.class).parse().getToken();
+            assertTrue("Exchanged token is not active", exchangedToken.isActive());
+            assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            assertEquals("requester-client", exchangedToken.getIssuedFor());
+            assertAccessTokenContext(exchangedToken.getId(), AccessTokenContext.SessionType.OFFLINE_TRANSIENT_CLIENT,
+                    AccessTokenContext.TokenType.REGULAR, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+            // assert introspection and user-info works
+            assertIntrospectSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+            assertUserInfoSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+
+            // assert introspection and user-info works in 10s
+            setTimeOffset(10);
+            assertIntrospectSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+            assertUserInfoSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+
+            // move time to be more than the normal expired session value, refresh and request another exchange
+            setTimeOffset(610);
+            final AccessTokenResponse refreshResponse = oauth.client("subject-client", "secret").scope(null)
+                    .refreshRequest(initialResponse.getRefreshToken()).send();
+            assertNull("Error refreshing the initial token: " + refreshResponse.getErrorDescription(), refreshResponse.getError());
+            accessToken = refreshResponse.getAccessToken();
+            oauth.scope(OAuth2Constants.SCOPE_OPENID);
+            response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+            assertNull("Error exchanging the token: " + response.getErrorDescription(), response.getError());
+            exchangedTokenString = response.getAccessToken();
+            exchangedToken = TokenVerifier.create(exchangedTokenString, AccessToken.class).parse().getToken();
+            assertTrue("Exchanged token is not active", exchangedToken.isActive());
+            assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+            assertEquals("requester-client", exchangedToken.getIssuedFor());
+            assertAccessTokenContext(exchangedToken.getId(), AccessTokenContext.SessionType.OFFLINE_TRANSIENT_CLIENT,
+                    AccessTokenContext.TokenType.REGULAR, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+            // assert introspection and user-info works
+            assertIntrospectSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+            assertUserInfoSuccess(exchangedTokenString, "requester-client", "secret", john.getId());
+
+            // assert introspection and user-info fails with offline session deleted
+            realm.deleteSession(getSessionIdFromToken(accessToken), true);
+            assertIntrospectError(exchangedTokenString, "requester-client", "secret");
+            assertUserInfoError(exchangedTokenString, "requester-client", "secret", "invalid_token", Errors.USER_SESSION_NOT_FOUND);
+        }
+    }
+
+    @Test
+    public void testTransientSessionWithAdminApi() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserRepresentation john = ApiUtil.findUserByUsername(realm, "john");
+
+        // create a client-scope to the requester-client that adds realm-management view-role access
+        final ClientResource client = ApiUtil.findClientByClientId(realm, Constants.REALM_MANAGEMENT_CLIENT_ID);
+        createClientScopeForRole(realm, client, AdminRoles.VIEW_REALM, "realm-management-view-scope");
+
+        // update the user and the requester-client to include the view-realm permission
+        try (RoleScopeUpdater roleScopeUpdater = UserAttributeUpdater.forUserByUsername(realm, "john")
+                .clientRoleScope(client.toRepresentation().getId())
+                .add(ApiUtil.findClientRoleByName(client, AdminRoles.VIEW_REALM).toRepresentation())
+                .update();
+             ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                     .addOptionalClientScope("realm-management-view-scope")
+                     .update()) {
+
+            oauth.realm(TEST);
+            final String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+            // token exchange with the realm-management-view optional scope
+            oauth.scope("realm-management-view-scope");
+            final AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of(Constants.REALM_MANAGEMENT_CLIENT_ID), null);
+            assertAudiencesAndScopes(response, john, List.of(Constants.REALM_MANAGEMENT_CLIENT_ID), List.of("realm-management-view-scope"));
+            final AccessToken exchangedToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).parse().getToken();
+            assertAccessTokenContext(exchangedToken.getId(), AccessTokenContext.SessionType.ONLINE_TRANSIENT_CLIENT,
+                    AccessTokenContext.TokenType.REGULAR, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+            try (Keycloak keycloak = Keycloak.getInstance(ServerURLs.getAuthServerContextRoot() + "/auth",
+                    TEST, Constants.ADMIN_CLI_CLIENT_ID, response.getAccessToken(), TLSUtils.initializeTLS())) {
+                assertEquals(TEST, keycloak.realm(TEST).toRepresentation().getRealm());
+                setTimeOffset(10);
+                assertEquals(TEST, keycloak.realm(TEST).toRepresentation().getRealm());
+                realm.deleteSession(exchangedToken.getSessionId(), false);
+                assertThrows(NotAuthorizedException.class, () -> keycloak.realm(TEST).toRepresentation().getRealm());
+            }
+        }
+    }
+
+    @Test
+    public void testTransientSessionWithAccountApi() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserRepresentation john = ApiUtil.findUserByUsername(realm, "john");
+
+        // create a client-scope for the requester-client that adds account view-profile access
+        createClientScopeForRole(realm, Constants.ACCOUNT_MANAGEMENT_CLIENT_ID, AccountRoles.VIEW_PROFILE, "account-view-profile-scope");
+
+        // update the requester-client to include the view-profile permission
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .addOptionalClientScope("account-view-profile-scope")
+                .update()) {
+
+            oauth.realm(TEST);
+            final String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+            // token exchange with the view-profile optional scope
+            oauth.scope("account-view-profile-scope");
+            final AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID), null);
+            assertAudiencesAndScopes(response, john, List.of(Constants.ACCOUNT_MANAGEMENT_CLIENT_ID), List.of("account-view-profile-scope"));
+            final AccessToken exchangedToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).parse().getToken();
+            assertAccessTokenContext(exchangedToken.getId(), AccessTokenContext.SessionType.ONLINE_TRANSIENT_CLIENT,
+                    AccessTokenContext.TokenType.REGULAR, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
+
+            final String accountUrl = ServerURLs.getAuthServerContextRoot() + "/auth/realms/test/account";
+            assertEquals("john", SimpleHttpDefault.doGet(accountUrl, oauth.httpClient().get())
+                    .auth(response.getAccessToken()).asJson(UserRepresentation.class).getUsername());
+            setTimeOffset(10);
+            assertEquals("john", SimpleHttpDefault.doGet(accountUrl, oauth.httpClient().get())
+                    .auth(response.getAccessToken()).asJson(UserRepresentation.class).getUsername());
+            realm.deleteSession(exchangedToken.getSessionId(), false);
+            assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), SimpleHttpDefault.doGet(accountUrl, oauth.httpClient().get())
+                    .auth(response.getAccessToken()).acceptJson().asResponse().getStatus());
+        }
+    }
+
+    @Test
+    public void testExchangeRequestAccessTokenType() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ACCESS_TOKEN_TYPE);
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+        String exchangedTokenString = response.getAccessToken();
+        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+        AccessToken exchangedToken = verifier.parse().getToken();
+        assertEquals(getSessionIdFromToken(accessToken), exchangedToken.getSessionId());
+        assertEquals("requester-client", exchangedToken.getIssuedFor());
+    }
+
+    @Test
+    public void testExchangeForIdToken() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+
+        // Exchange request with "scope=oidc" . ID Token should be issued in addition to access-token
+        oauth.openid(true);
+        oauth.scope(OAuth2Constants.SCOPE_OPENID);
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ACCESS_TOKEN_TYPE);
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+        AccessToken exchangedToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class)
+                .parse().getToken();
+        assertEquals(TokenUtil.TOKEN_TYPE_BEARER, exchangedToken.getType());
+
+        assertNotNull("ID Token is null, but was expected to be present", response.getIdToken());
+        IDToken exchangedIdToken = TokenVerifier.create(response.getIdToken(), IDToken.class)
+                .parse().getToken();
+        assertEquals(TokenUtil.TOKEN_TYPE_ID, exchangedIdToken.getType());
+        assertEquals(getSessionIdFromToken(accessToken), exchangedIdToken.getSessionId());
+        assertEquals("requester-client", exchangedIdToken.getIssuedFor());
+
+        // Exchange request without "scope=oidc" . Only access-token should be issued, but not ID Token
+        oauth.openid(false);
+        oauth.scope(null);
+        response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ACCESS_TOKEN_TYPE);
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+        assertNotNull(response.getAccessToken());
+        assertNull("ID Token was present, but should not be present", response.getIdToken());
+
+        // Exchange request requesting id-token. ID Token should be issued inside "access_token" parameter (as per token-exchange specification https://datatracker.ietf.org/doc/html/rfc8693#name-successful-response - parameter "access_token")
+        response = tokenExchange(accessToken, "requester-client", "secret", null, OAuth2Constants.ID_TOKEN_TYPE);
+        assertEquals(OAuth2Constants.ID_TOKEN_TYPE, response.getIssuedTokenType());
+        assertEquals(TokenUtil.TOKEN_TYPE_NA, response.getTokenType());
+        assertNotNull(response.getAccessToken());
+        assertNull("ID Token was present, but should not be present", response.getIdToken());
+
+        exchangedIdToken = TokenVerifier.create(response.getAccessToken(), IDToken.class)
+                .parse().getToken();
+        assertEquals(TokenUtil.TOKEN_TYPE_ID, exchangedIdToken.getType());
+        assertEquals(getSessionIdFromToken(accessToken), exchangedIdToken.getSessionId());
+        assertEquals("requester-client", exchangedIdToken.getIssuedFor());
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeUsingServiceAccount() throws Exception {
+        final UserRepresentation user = ApiUtil.findClientResourceByClientId(adminClient.realm(TEST), "subject-client").getServiceAccountUser();
+        oauth.realm(TEST);
+        oauth.client("subject-client", "secret");
+
+        AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
+        String accessToken = response.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        assertNull(token.getSessionId());
+        events.expect(EventType.CLIENT_LOGIN)
+                .client("subject-client")
+                .user(user.getId())
+                .session(token.getSessionId())
+                .detail(Details.USERNAME, user.getUsername())
+                .detail(Details.GRANT_TYPE, OAuth2Constants.CLIENT_CREDENTIALS)
+                .assertEvent();
+
+        response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+        assertAudiencesAndScopes(response, user, List.of("target-client1"), List.of("default-scope1"));
+        assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+        String exchangedTokenString = response.getAccessToken();
+        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+        AccessToken exchangedToken = verifier.parse().getToken();
+        assertNull(exchangedToken.getSessionId());
+        assertEquals("requester-client", exchangedToken.getIssuedFor());
+
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update()) {
+            response = tokenExchange(accessToken, "requester-client", "secret", null,
+                    OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(response.getError(), Errors.INVALID_REQUEST);
+            assertEquals(response.getErrorDescription(), "Refresh token not valid as requested_token_type because creating a new session is needed");
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("requester-client")
+                    .error(Errors.INVALID_REQUEST)
+                    .user(user.getId())
+                    .detail(Details.REASON, "Refresh token not valid as requested_token_type because creating a new session is needed")
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeNoRefreshToken() throws Exception {
+
+
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        {
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+            assertEquals(OAuth2Constants.ACCESS_TOKEN_TYPE, response.getIssuedTokenType());
+            String exchangedTokenString = response.getAccessToken();
+            String refreshTokenString = response.getRefreshToken();
+            assertNotNull(exchangedTokenString);
+            assertNull(refreshTokenString);
+        }
+
+        try (ClientAttributeUpdater clienUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.USE_REFRESH_TOKEN, Boolean.FALSE.toString())
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update()) {
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null,
+                    OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+            assertEquals("requested_token_type unsupported", response.getErrorDescription());
+        }
+    }
+
+    @Test
+    public void testClientExchangeToItself() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+
+        AccessTokenResponse response = tokenExchange(accessToken, "subject-client", "secret", null, null);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+
+        response = tokenExchange(accessToken, "subject-client", "secret", List.of("subject-client"), null);
+        assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+    }
+
+    @Test
+    public void testClientExchangeToItselfWithConsents() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "subject-client")
+                .setConsentRequired(Boolean.TRUE)
+                .update()) {
+            AccessTokenResponse response = tokenExchange(accessToken, "subject-client", "secret", null, null);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+            assertEquals("Missing consents for Token Exchange in client subject-client", response.getErrorDescription());
+
+            response = tokenExchange(accessToken, "subject-client", "secret", List.of("subject-client"), null);
+            assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+            assertEquals("Missing consents for Token Exchange in client subject-client", response.getErrorDescription());
+        }
+    }
+
+    @Test
+    public void testExchangeWithPublicClient() throws Exception {
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client-public", null,  null, null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+        assertEquals("Public client is not allowed to exchange token", response.getErrorDescription());
+    }
+
+    @Test
+    public void testOptionalScopeParamRequestedWithoutAudience() throws Exception {
+        final UserRepresentation john = ApiUtil.findUserByUsername(adminClient.realm(TEST), "john");
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        oauth.scope("optional-scope2");
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", null, null);
+        assertAudiencesAndScopes(response, john, List.of("target-client1", "target-client2"), List.of("default-scope1", "optional-scope2"));
+    }
+
+    @Test
+    public void testAudienceRequested() throws Exception {
+        final UserRepresentation john = ApiUtil.findUserByUsername(adminClient.realm(TEST), "john");
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), null);
+        assertAudiencesAndScopes(response, john, List.of("target-client1"), List.of("default-scope1"));
+    }
+
+    @Test
+    public void testUnavailableAudienceRequested() throws Exception {
+        String accessToken = resourceOwnerLogin("john", "password","subject-client", "secret").getAccessToken();
+        // request invalid client audience
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1", "invalid-client"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError());
+        assertEquals("Audience not found", response.getErrorDescription());
+        // The "target-client3" is valid client, but audience unavailable to the user. Request not allowed
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1", "target-client3"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("Requested audience not available: target-client3", response.getErrorDescription());
+    }
+
+    @Test
+    public void testScopeNotAllowed() throws Exception {
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+        //scope not allowed
+        oauth.scope("optional-scope3");
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1", "target-client3"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+        assertEquals("Invalid scopes: optional-scope3", response.getErrorDescription());
+
+        //scope that doesn't exist
+        oauth.scope("bad-scope");
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1", "target-client3"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+        assertEquals("Invalid scopes: bad-scope", response.getErrorDescription());
+    }
+
+    @Test
+    public void testScopeFilter() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserRepresentation john = ApiUtil.findUserByUsername(realm, "john");
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client2"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+        assertEquals("Requested audience not available: target-client2", response.getErrorDescription());
+        events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                .client("requester-client")
+                .error(Errors.INVALID_REQUEST)
+                .user(john.getId())
+                .session(AssertEvents.isUUID())
+                .detail(Details.REASON, "Requested audience not available: target-client2")
+                .assertEvent();
+
+        oauth.scope("optional-scope2");
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1"), null);
+        assertAudiencesAndScopes(response, john, List.of("target-client1"), List.of("default-scope1"));
+
+        oauth.scope("optional-scope2");
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client2"), null);
+        assertAudiencesAndScopes(response, john, List.of("target-client2"), List.of("optional-scope2"));
+
+        oauth.scope("optional-scope2");
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1", "target-client2"), null);
+        assertAudiencesAndScopes(response, john, List.of("target-client1", "target-client2"), List.of("default-scope1", "optional-scope2"));
+
+        //just check that the exchanged token contains the optional-scope2 mapped by the realm role
+        final UserRepresentation mike = ApiUtil.findUserByUsername(realm, "mike");
+        accessToken = resourceOwnerLogin("mike", "password","subject-client", "secret").getAccessToken();
+        oauth.scope("optional-scope2");
+        response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+        assertAudiencesAndScopes(response, mike, List.of("target-client1"), List.of("default-scope1", "optional-scope2"));
+
+        accessToken = resourceOwnerLogin("mike", "password","subject-client", "secret").getAccessToken();
+        oauth.scope("optional-scope2");
+        response = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client1"), null);
+        assertAudiencesAndScopes(response,  mike, List.of("target-client1"), List.of("default-scope1", "optional-scope2"));
+    }
+
+    @Test
+    public void testScopeParamIncludedAudienceIncludedRefreshToken() throws Exception {
+        final UserRepresentation mike = ApiUtil.findUserByUsername(adminClient.realm(TEST), "mike");
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update()) {
+            String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken();
+            oauth.scope("optional-scope2");
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertAudiencesAndScopes(response, mike, List.of("target-client1"), List.of("default-scope1", "optional-scope2"), OAuth2Constants.REFRESH_TOKEN_TYPE, "subject-client");
+            assertNotNull(response.getRefreshToken());
+
+            oauth.client("requester-client", "secret");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
+            AccessToken exchangedToken = assertAudiencesAndScopes(response, List.of("target-client1"), List.of("default-scope1", "optional-scope2"));
+            events.expect(EventType.REFRESH_TOKEN)
+                    .detail(Details.TOKEN_ID, exchangedToken.getId())
+                    .detail(Details.REFRESH_TOKEN_ID, AssertEvents.isUUID())
+                    .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
+                    .detail(Details.UPDATED_REFRESH_TOKEN_ID, AssertEvents.isUUID())
+                    .session(exchangedToken.getSessionId());
+
+            oauth.client("requester-client", "secret");
+            response = oauth.doRefreshTokenRequest(response.getRefreshToken());
+            exchangedToken = assertAudiencesAndScopes(response, List.of("target-client1"), List.of("default-scope1", "optional-scope2"));
+            events.expect(EventType.REFRESH_TOKEN)
+                    .detail(Details.TOKEN_ID, exchangedToken.getId())
+                    .detail(Details.REFRESH_TOKEN_ID, AssertEvents.isUUID())
+                    .detail(Details.REFRESH_TOKEN_TYPE, TokenUtil.TOKEN_TYPE_REFRESH)
+                    .detail(Details.UPDATED_REFRESH_TOKEN_ID, AssertEvents.isUUID())
+                    .session(exchangedToken.getSessionId());
+        }
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeWithDynamicScopesEnabled() throws Exception {
+        testingClient.enableFeature(Profile.Feature.DYNAMIC_SCOPES);
+        testExchange();
+        testingClient.disableFeature(Profile.Feature.DYNAMIC_SCOPES);
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testExchangeDisabledOnClient() throws Exception {
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+        {
+            AccessTokenResponse response = tokenExchange(accessToken, "disabled-requester-client", "secret", null, null);
+            org.junit.Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            org.junit.Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+            org.junit.Assert.assertEquals("Standard token exchange is not enabled for the requested client", response.getErrorDescription());
+        }
+    }
+
+    @Test
+    public void testConsents() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserResource mikeRes = ApiUtil.findUserByUsernameId(realm, "mike");
+        final UserRepresentation mike = mikeRes.toRepresentation();
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setConsentRequired(Boolean.TRUE)
+                .update()) {
+            // initial TE without any consent should fail
+            String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken();
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+            assertEquals("Missing consents for Token Exchange in client requester-client", response.getErrorDescription());
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("requester-client")
+                    .error(Errors.CONSENT_DENIED)
+                    .user(mike.getId())
+                    .session(AssertEvents.isUUID())
+                    .detail(Details.REASON, "Missing consents for Token Exchange in client requester-client")
+                    .assertEvent();
+
+            // logout
+            mikeRes.logout();
+
+            // perform a login and allow consent for default scopes, TE should work now
+            accessToken = loginWithConsents(mike, "password", "requester-client", "secret");
+            response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+            assertAudiencesAndScopes(response, mike, List.of("target-client1"), List.of("default-scope1"), OAuth2Constants.ACCESS_TOKEN_TYPE, "requester-client");
+
+            // request TE with optional-scope2 whose consent is missing, should fail
+            oauth.scope("optional-scope2");
+            response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_SCOPE, response.getError());
+            assertEquals("Missing consents for Token Exchange in client requester-client", response.getErrorDescription());
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("requester-client")
+                    .error(Errors.CONSENT_DENIED)
+                    .user(mike.getId())
+                    .session(AssertEvents.isUUID())
+                    .detail(Details.REASON, "Missing consents for Token Exchange in client requester-client")
+                    .assertEvent();
+
+            // logout
+            mikeRes.logout();
+
+            // consent the additional scope, TE should work now
+            accessToken = loginWithConsents(mike, "password", "requester-client", "secret");
+            response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+            assertAudiencesAndScopes(response, mike, List.of("target-client1"), List.of("default-scope1", "optional-scope2"),
+                    OAuth2Constants.ACCESS_TOKEN_TYPE, "requester-client");
+        }
+    }
+
+    @Test
+    public void testOfflineAccessNotAllowed() throws Exception {
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update()) {
+            String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret").getAccessToken();
+            String sessionId = TokenVerifier.create(accessToken, AccessToken.class).parse().getToken().getSessionId();
+            Assert.assertEquals(testingClient.testing(TEST).getClientSessionsCountInUserSession(TEST, sessionId), Integer.valueOf(1));
+
+            oauth.scope("offline_access");
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(OAuthErrorException.INVALID_REQUEST, response.getError());
+            assertEquals("Scope offline_access not allowed for token exchange", response.getErrorDescription());
+
+            // Check that client session was not created
+            Assert.assertEquals(testingClient.testing(TEST).getClientSessionsCountInUserSession(TEST, sessionId), Integer.valueOf(1));
+        }
+    }
+
+    // Issue 37116
+    @Test
+    public void testOfflineAccessLoginWithRegularTokenExchange() throws Exception {
+        final UserRepresentation mike = ApiUtil.findUserByUsername(adminClient.realm(TEST), "mike");
+        try (ClientAttributeUpdater clientUpdater1 = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update();
+             ClientAttributeUpdater clientUpdater2 = ClientAttributeUpdater.forClient(adminClient, TEST, "subject-client")
+                     .setOptionalClientScopes(List.of(OAuth2Constants.OFFLINE_ACCESS))
+                     .update();
+        ) {
+            // Login with "scope=offline_access" . Will create offline user-session
+            String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret", OAuth2Constants.OFFLINE_ACCESS).getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(accessToken, AccessToken.class);
+            AccessToken originalToken = verifier.parse().getToken();
+
+            AccessTokenContext ctx = getTestingClient().testing().getTokenContext(originalToken.getId());
+            assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.OFFLINE);
+
+            // normal access token exchange is allowed for the offline session
+            oauth.scope(null);
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), null);
+            AccessToken exchangedToken = assertAudiencesAndScopes(response, mike, List.of("target-client1"), List.of("default-scope1"));
+            assertEquals(originalToken.getSessionId(), exchangedToken.getSessionId());
+
+            // Refresh token-exchange without "scope=offline_access". Not allowed cos a new new "online" user session is needed (as previous one was offline)
+            oauth.scope(null);
+            response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+            assertEquals(response.getError(), Errors.INVALID_REQUEST);
+            assertEquals(response.getErrorDescription(), "Refresh token not valid as requested_token_type because creating a new session is needed");
+            events.expect(EventType.TOKEN_EXCHANGE_ERROR)
+                    .client("requester-client")
+                    .error(Errors.INVALID_REQUEST)
+                    .user(mike.getId())
+                    .session(originalToken.getSessionId())
+                    .detail(Details.REASON, "Refresh token not valid as requested_token_type because creating a new session is needed")
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void testOfflineAccessNotAllowedAfterOfflineAccessLogin() throws Exception {
+        try (ClientAttributeUpdater clientUpdater1 = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update();
+             ClientAttributeUpdater clientUpdater2 = ClientAttributeUpdater.forClient(adminClient, TEST, "subject-client")
+                     .setOptionalClientScopes(List.of(OAuth2Constants.OFFLINE_ACCESS))
+                     .update();
+        ) {
+            // Login with "scope=offline_access" . Will create offline user-session
+            String accessToken = resourceOwnerLogin("mike", "password", "subject-client", "secret", OAuth2Constants.OFFLINE_ACCESS).getAccessToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(accessToken, AccessToken.class);
+            AccessToken originalToken = verifier.parse().getToken();
+
+            // Doublecheck count of sessions
+            String subjectClientUuid = ApiUtil.findClientByClientId(adminClient.realm(TEST), "subject-client").toRepresentation().getId();
+            String requesterClientUuid = ApiUtil.findClientByClientId(adminClient.realm(TEST), "requester-client").toRepresentation().getId();
+            UserResource user = ApiUtil.findUserByUsernameId(adminClient.realm(TEST), "mike");
+            Assert.assertEquals(0, user.getUserSessions().size());
+            Assert.assertEquals(1, user.getOfflineSessions(subjectClientUuid).size());
+            Assert.assertEquals(0, user.getOfflineSessions(requesterClientUuid).size());
+
+            // Token exchange with scope=offline-access should not be allowed
+            oauth.scope("offline_access");
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+
+            // Make sure not new user sessions persisted
+            Assert.assertEquals(0, user.getUserSessions().size());
+            Assert.assertEquals(1, user.getOfflineSessions(subjectClientUuid).size());
+            Assert.assertEquals(0, user.getOfflineSessions(requesterClientUuid).size());
+        }
+    }
+
+    @Test
+    public void testIntrospectionWithExchangedTokenAfterSSOLoginOfRequesterClient() throws Exception {
+        final RealmResource realm = adminClient.realm(TEST);
+        final UserResource mikeRes = ApiUtil.findUserByUsernameId(realm, "mike");
+        final UserRepresentation mike = mikeRes.toRepresentation();
+
+        // Login with "subject-client" and create SSO session
+        try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, TEST, "subject-client")
+                .setConsentRequired(Boolean.TRUE)
+                .update()) {
+            String accessToken = loginWithConsents(mike, "password", "subject-client", "secret");
+
+            // Token exchange access-token for "Requester-client" . No client session yet for "requester-client" at this stage
+            AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret",  null, null);
+            String exchangedToken = response.getAccessToken();
+            Assert.assertNotNull(exchangedToken);
+
+            // Set time offset
+            setTimeOffset(10);
+
+            // SSO login to "requester-client". Will create client session for "requester-client"
+            oauth.client("requester-client", "secret").openLoginForm();
+            assertNotNull(oauth.parseLoginResponse().getCode());
+            response = oauth.doAccessTokenRequest(oauth.parseLoginResponse().getCode());
+            assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
+            String requesterClientToken = response.getAccessToken();
+
+            // Token introspection with the previously exchanged token should success. Also with the new token should success
+            assertIntrospectSuccess(exchangedToken, "requester-client", "secret", mike.getId());
+            assertIntrospectSuccess(requesterClientToken, "requester-client", "secret", mike.getId());
+        }
+    }
+
+    @Test
+    public void testClientPolicies() throws Exception {
+
+        String json = (new ClientPoliciesUtil.ClientProfilesBuilder()).addProfile(
+                (new ClientPoliciesUtil.ClientProfileBuilder()).createProfile(PROFILE_NAME, "Profilo")
+                        .addExecutor(TestRaiseExceptionExecutorFactory.PROVIDER_ID,
+                                createTestRaiseExeptionExecutorConfig(List.of(ClientPolicyEvent.TOKEN_EXCHANGE_REQUEST)))
+                        .toRepresentation()
+        ).toString();
+        updateProfiles(json);
+
+        // register policy with condition on client scope optional-scope2
+        json = (new ClientPoliciesUtil.ClientPoliciesBuilder()).addPolicy(
+                (new ClientPoliciesUtil.ClientPolicyBuilder()).createPolicy(POLICY_NAME, "Client Scope Policy", Boolean.TRUE)
+                        .addCondition(ClientScopesConditionFactory.PROVIDER_ID,
+                                createClientScopesConditionConfig(ClientScopesConditionFactory.ANY, List.of("optional-scope2")))
+                        .addCondition(GrantTypeConditionFactory.PROVIDER_ID,
+                                createGrantTypeConditionConfig(List.of(OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)))
+                        .addProfile(PROFILE_NAME)
+                        .toRepresentation()
+        ).toString();
+        updatePolicies(json);
+
+        final UserRepresentation john = ApiUtil.findUserByUsername(adminClient.realm(TEST), "john");
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+
+        AccessTokenResponse response = tokenExchange(accessToken, "requester-client", "secret", List.of("target-client1"), null);
+        assertAudiencesAndScopes(response, john, List.of("target-client1"), List.of("default-scope1"));
+
+        //block token exchange request if optional-scope2 is requested
+        oauth.scope("optional-scope2");
+        response  = tokenExchange(accessToken, "requester-client", "secret",  List.of("target-client2"), null);
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
+        assertEquals(ClientPolicyEvent.TOKEN_EXCHANGE_REQUEST.toString(), response.getError());
+        assertEquals("Exception thrown intentionally", response.getErrorDescription());
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testTokenRevocation() throws Exception {
+        ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                .update();
+        UserRepresentation johnUser = ApiUtil.findUserByUsernameId(adminClient.realm(TEST), "john").toRepresentation();
+
+        oauth.realm(TEST);
+        AccessTokenResponse accessTokenResponse = resourceOwnerLogin("john", "password", "subject-client", "secret");
+
+        //revoke the exchanged access token
+        AccessTokenResponse tokenExchangeResponse = tokenExchange(accessTokenResponse.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        oauth.client("requester-client", "secret");
+        events.clear();
+        oauth.doTokenRevoke(tokenExchangeResponse.getAccessToken());
+        events.expect(EventType.REVOKE_GRANT)
+                .client("requester-client")
+                .user(johnUser)
+                .assertEvent();
+        isAccessTokenEnabled(accessTokenResponse.getAccessToken(), "subject-client", "secret");
+        isAccessTokenDisabled(tokenExchangeResponse.getAccessToken(), "requester-client", "secret");
+
+        //revoke the exchanged refresh token
+        tokenExchangeResponse = tokenExchange(accessTokenResponse.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        events.clear();
+        oauth.doTokenRevoke(tokenExchangeResponse.getRefreshToken());
+        events.expect(EventType.REVOKE_GRANT)
+                .client("requester-client")
+                .user(johnUser)
+                .session(tokenExchangeResponse.getSessionState())
+                .assertEvent();
+        isTokenDisabled(tokenExchangeResponse, "requester-client", "secret");
+
+        //revoke the subject access token
+        tokenExchangeResponse = tokenExchange(accessTokenResponse.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        oauth.client("subject-client", "secret");
+        events.clear();
+        oauth.doTokenRevoke(accessTokenResponse.getAccessToken());
+        events.expect(EventType.REVOKE_GRANT)
+                .client("subject-client")
+                .user(johnUser)
+                .detail(Details.TOKEN_EXCHANGE_REVOKED_CLIENTS, "requester-client")
+                .assertEvent();
+        isAccessTokenDisabled(accessTokenResponse.getAccessToken(), "subject-client", "secret");
+        isTokenDisabled(tokenExchangeResponse, "requester-client", "secret");
+
+        //revoke the subject refresh token
+        accessTokenResponse = resourceOwnerLogin("john", "password", "subject-client", "secret");
+        tokenExchangeResponse = tokenExchange(accessTokenResponse.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse.getStatusCode());
+        oauth.client("subject-client", "secret");
+        events.clear();
+        oauth.doTokenRevoke(accessTokenResponse.getRefreshToken());
+        events.expect(EventType.REVOKE_GRANT)
+                .client("subject-client")
+                .user(johnUser)
+                .session(tokenExchangeResponse.getSessionState())
+                .detail(Details.TOKEN_EXCHANGE_REVOKED_CLIENTS, "requester-client")
+                .assertEvent();
+        isTokenDisabled(accessTokenResponse, "subject-client", "secret");
+        isTokenDisabled(tokenExchangeResponse, "requester-client", "secret");
+
+        //revoke multiple access token
+        AccessTokenResponse accessTokenResponse1 = resourceOwnerLogin("john", "password", "subject-client", "secret");
+        AccessTokenResponse accessTokenResponse2 = oauth.doRefreshTokenRequest(accessTokenResponse1.getRefreshToken());
+        AccessTokenResponse accessTokenResponse3 = oauth.doRefreshTokenRequest(accessTokenResponse1.getRefreshToken());
+
+        AccessTokenResponse tokenExchangeResponse1 = tokenExchange(accessTokenResponse1.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse1.getStatusCode());
+        AccessTokenResponse tokenExchangeResponse2 = tokenExchange(accessTokenResponse2.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+        assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse2.getStatusCode());
+
+        oauth.client("subject-client", "secret");
+        events.clear();
+        oauth.doTokenRevoke(accessTokenResponse3.getAccessToken());
+        events.expect(EventType.REVOKE_GRANT)
+                .client("subject-client")
+                .user(johnUser)
+                .detail(Details.TOKEN_EXCHANGE_REVOKED_CLIENTS, String.join(",", List.of("requester-client")))
+                .assertEvent();
+        isAccessTokenEnabled(accessTokenResponse1.getAccessToken(), "subject-client", "secret");
+        isAccessTokenEnabled(accessTokenResponse2.getAccessToken(), "subject-client", "secret");
+        isAccessTokenDisabled(accessTokenResponse3.getAccessToken(), "subject-client", "secret");
+        isTokenDisabled(tokenExchangeResponse1, "requester-client", "secret");
+        isTokenDisabled(tokenExchangeResponse2, "requester-client", "secret");
+
+        //revoke exchange chain if an already exchanged token is used for token exchange
+        try (
+                ProtocolMappersUpdater clientUpdater1 = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client")
+                        .protocolMappers()
+                        .add(ModelToRepresentation.toRepresentation(AudienceProtocolMapper.createClaimMapper("requester-client-2", "requester-client-2", null, true, false, true)))
+                        .update();
+
+                ClientAttributeUpdater clientUpdater2 = ClientAttributeUpdater.forClient(adminClient, TEST, "requester-client-2")
+                        .setAttribute(OIDCConfigAttributes.STANDARD_TOKEN_EXCHANGE_REFRESH_ENABLED, OIDCAdvancedConfigWrapper.TokenExchangeRefreshTokenEnabled.SAME_SESSION.name())
+                        .update();
+        ) {
+            accessTokenResponse = resourceOwnerLogin("john", "password", "subject-client", "secret");
+            tokenExchangeResponse1 = tokenExchange(accessTokenResponse.getAccessToken(), "requester-client", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse1.getStatusCode());
+
+            tokenExchangeResponse2 = tokenExchange(tokenExchangeResponse1.getAccessToken(), "requester-client-2", "secret", null, OAuth2Constants.REFRESH_TOKEN_TYPE);
+            assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse2.getStatusCode());
+
+            oauth.client("subject-client", "secret");
+            events.clear();
+            oauth.doTokenRevoke(accessTokenResponse.getAccessToken());
+            events.expect(EventType.REVOKE_GRANT)
+                    .client("subject-client")
+                    .user(johnUser)
+                    .detail(Details.TOKEN_EXCHANGE_REVOKED_CLIENTS, "requester-client-2,requester-client")
+                    .assertEvent();
+
+            isTokenDisabled(tokenExchangeResponse1, "requester-client", "secret");
+            isTokenDisabled(tokenExchangeResponse2, "requester-client-2", "secret");
+
+        }
+    }
+
+    private void isAccessTokenEnabled(String accessToken, String clientId, String secret) throws IOException {
+        oauth.client(clientId, secret);
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessToken).asTokenMetadata();
+        assertTrue(rep.isActive());
+    }
+
+    private void isAccessTokenDisabled(String accessTokenString, String clientId, String secret) throws IOException {
+        // Test introspection endpoint not possible
+        oauth.client(clientId, secret);
+        TokenMetadataRepresentation rep = oauth.doIntrospectionAccessTokenRequest(accessTokenString).asTokenMetadata();
+        assertFalse(rep.isActive());
+    }
+
+    private void isTokenEnabled(AccessTokenResponse tokenResponse, String clientId, String secret) throws IOException {
+        isAccessTokenEnabled(tokenResponse.getAccessToken(), clientId, secret);
+        AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
+        assertEquals(Response.Status.OK.getStatusCode(), tokenRefreshResponse.getStatusCode());
+    }
+
+    private void isTokenDisabled(AccessTokenResponse tokenResponse, String clientId, String secret) throws IOException {
+        isAccessTokenDisabled(tokenResponse.getAccessToken(), clientId, secret);
+
+        oauth.client(clientId, secret);
+        AccessTokenResponse tokenRefreshResponse = oauth.doRefreshTokenRequest(tokenResponse.getRefreshToken());
+        assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), tokenRefreshResponse.getStatusCode());
+    }
+
+    private void assertAudiences(AccessToken token, List<String> expectedAudiences) {
+        MatcherAssert.assertThat("Incompatible audiences", token.getAudience() == null ? List.of() : List.of(token.getAudience()), containsInAnyOrder(expectedAudiences.toArray()));
+        MatcherAssert.assertThat("Incompatible resource access", token.getResourceAccess().keySet(), containsInAnyOrder(expectedAudiences.toArray()));
+    }
+
+    private void assertScopes(AccessToken token, List<String> expectedScopes) {
+        MatcherAssert.assertThat("Incompatible scopes", token.getScope().isEmpty() ? List.of() : List.of(token.getScope().split(" ")), containsInAnyOrder(expectedScopes.toArray()));
+    }
+
+    private AccessToken assertAudiencesAndScopes(AccessTokenResponse tokenExchangeResponse, List<String> expectedAudiences, List<String> expectedScopes) throws Exception {
+        assertEquals(Response.Status.OK.getStatusCode(), tokenExchangeResponse.getStatusCode());
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(tokenExchangeResponse.getAccessToken(), AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        if (expectedAudiences == null) {
+            assertNull("Expected token to not contain audience", token.getAudience());
+        } else {
+            assertAudiences(token, expectedAudiences);
+        }
+        assertScopes(token, expectedScopes);
+        return token;
+    }
+
+    private AccessToken assertAudiencesAndScopes(AccessTokenResponse tokenExchangeResponse, UserRepresentation user, List<String> expectedAudiences, List<String> expectedScopes) throws Exception {
+        return assertAudiencesAndScopes(tokenExchangeResponse, user, expectedAudiences, expectedScopes, OAuth2Constants.ACCESS_TOKEN_TYPE, "subject-client");
+    }
+
+    private AccessToken assertAudiencesAndScopes(AccessTokenResponse tokenExchangeResponse, UserRepresentation user,
+                                                 List<String> expectedAudiences, List<String> expectedScopes, String expectedTokenType, String expectedSubjectTokenClientId) throws Exception {
+        AccessToken token = assertAudiencesAndScopes(tokenExchangeResponse, expectedAudiences, expectedScopes);
+        events.expect(EventType.TOKEN_EXCHANGE)
+                .client(token.getIssuedFor())
+                .user(user.getId())
+                .session(token.getSessionId())
+                .detail(Details.AUDIENCE, CollectionUtil.join(expectedAudiences, " "))
+                .detail(Details.SCOPE, CollectionUtil.join(expectedScopes, " "))
+                .detail(Details.USERNAME, user.getUsername())
+                .detail(Details.REQUESTED_TOKEN_TYPE, expectedTokenType)
+                .detail(Details.SUBJECT_TOKEN_CLIENT_ID, expectedSubjectTokenClientId)
+                .assertEvent();
+        return token;
+    }
+
+    private void createClientScopeForRole(RealmResource realm, String clientId, String clientRoleName, String clientScopeName) {
+        final ClientResource client = ApiUtil.findClientByClientId(realm, clientId);
+        createClientScopeForRole(realm, client, clientRoleName, clientScopeName);
+    }
+
+    private void createClientScopeForRole(RealmResource realm, ClientResource client, String clientRoleName, String clientScopeName) {
+        final String clientUUID = client.toRepresentation().getId();
+        final RoleRepresentation clientRole = ApiUtil.findClientRoleByName(client, clientRoleName).toRepresentation();
+
+        final ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
+        clientScope.setName(clientScopeName);
+        clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        final String clientScopeId = ApiUtil.getCreatedId(realm.clientScopes().create(clientScope));
+        getCleanup().addClientScopeId(clientScopeId);
+        realm.clientScopes().get(clientScopeId).getScopeMappings().clientLevel(clientUUID).add(List.of(clientRole));
+    }
+
+    private void assertIntrospectSuccess(String token, String clientId, String clientSecret, String userId) throws IOException {
+        TokenMetadataRepresentation rep = oauth.client(clientId, clientSecret).introspectionRequest(token).tokenTypeHint("access_token").send().asTokenMetadata();
+        assertTrue(rep.isActive());
+        assertEquals(userId, rep.getSubject());
+    }
+
+    private void assertIntrospectError(String token, String clientId, String clientSecret) throws IOException {
+        TokenMetadataRepresentation rep = oauth.client(clientId, clientSecret).introspectionRequest(token).tokenTypeHint("access_token").send().asTokenMetadata();
+        assertFalse(rep.isActive());
+    }
+
+    private void assertUserInfoSuccess(String token, String clientId, String clientSecret, String userId) {
+        UserInfoResponse userInfoResp = oauth.client(clientId, clientSecret).userInfoRequest(token).send();
+        assertEquals(Response.Status.OK.getStatusCode(), userInfoResp.getStatusCode());
+        assertEquals(userId, userInfoResp.getUserInfo().getSub());
+    }
+
+    private void assertUserInfoError(String token, String clientId, String clientSecret, String error, String errorDesciption) {
+        UserInfoResponse userInfoResp = oauth.client(clientId, clientSecret).userInfoRequest(token).send();
+        assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), userInfoResp.getStatusCode());
+        assertEquals(String.format("Bearer realm=\"%s\", error=\"%s\", error_description=\"%s\"", TEST, error, errorDesciption),
+                userInfoResp.getHeader(HttpHeaders.WWW_AUTHENTICATE));
+    }
+
+    private void assertAccessTokenContext(String jti, AccessTokenContext.SessionType sessionType,
+                                          AccessTokenContext.TokenType tokenType, String grantType) {
+        AccessTokenContext ctx = testingClient.testing(TEST).getTokenContext(jti);
+        assertEquals(sessionType, ctx.getSessionType());
+        assertEquals(tokenType, ctx.getTokenType());
+        assertEquals(grantType, ctx.getGrantType());
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2WithLegacyTokenExchangeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2WithLegacyTokenExchangeTest.java
new file mode 100644
index 000000000000..60f283cdcde9
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/StandardTokenExchangeV2WithLegacyTokenExchangeTest.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.Test;
+import org.keycloak.OAuthErrorException;
+import org.keycloak.common.Profile;
+import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+
+import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
+
+/**
+ * Test with both V1 and V2 token-exchange enabled. Requests should be handled by V2
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
+@EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
+@DisableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2, skipRestart = true)
+public class StandardTokenExchangeV2WithLegacyTokenExchangeTest extends StandardTokenExchangeV2Test {
+
+    @Test
+    @UncaughtServerErrorExpected
+    @Override
+    public void testExchangeDisabledOnClient() throws Exception {
+        // When client does not have TE enabled, request is handled by V1-provider, which returns different error
+        oauth.realm(TEST);
+        String accessToken = resourceOwnerLogin("john", "password", "subject-client", "secret").getAccessToken();
+        {
+            AccessTokenResponse response = tokenExchange(accessToken, "disabled-requester-client", "secret", null, null);
+            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatusCode());
+            org.junit.Assert.assertEquals(OAuthErrorException.ACCESS_DENIED, response.getError());
+            org.junit.Assert.assertEquals("Client is not within the token audience", response.getErrorDescription());
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/SubjectImpersonationTokenExchangeV1Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/SubjectImpersonationTokenExchangeV1Test.java
new file mode 100644
index 000000000000..cd32a645ad62
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/SubjectImpersonationTokenExchangeV1Test.java
@@ -0,0 +1,547 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import java.util.List;
+import java.util.Map;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import org.junit.Rule;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.TokenVerifier;
+import org.keycloak.common.Profile;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testsuite.AbstractKeycloakTest;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.UncaughtServerErrorExpected;
+import org.keycloak.testsuite.util.AdminClientUtil;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.util.BasicAuthHelper;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
+
+/**
+ * Tests for subject impersonation token exchange (including "direct naked impersonation")
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
+@EnableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ, skipRestart = true)
+@DisableFeature(value = Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2, skipRestart = true)
+public class SubjectImpersonationTokenExchangeV1Test extends AbstractKeycloakTest  {
+
+    @Rule
+    public AssertEvents events = new AssertEvents(this);
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation testRealmRep = new RealmRepresentation();
+        testRealmRep.setId(TEST);
+        testRealmRep.setRealm(TEST);
+        testRealmRep.setEnabled(true);
+        testRealms.add(testRealmRep);
+    }
+
+    @Override
+    protected boolean isImportAfterEachMethod() {
+        return true;
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    @DisableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
+    public void checkFeatureDisabled() {
+        // Required feature should return Status code 400 - Feature doesn't work
+        testingClient.server().run(TokenExchangeTestUtils::addDirectExchanger);
+        Assert.assertEquals(400, checkTokenExchange().getStatus());
+        testingClient.server().run(TokenExchangeTestUtils::removeDirectExchanger);
+    }
+
+    @Test
+    public void checkFeatureEnabled() {
+        // Test if the required feature really works.
+        testingClient.server().run(TokenExchangeTestUtils::addDirectExchanger);
+        Assert.assertEquals(200, checkTokenExchange().getStatus());
+        testingClient.server().run(TokenExchangeTestUtils::removeDirectExchanger);
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testImpersonation() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = tokenResponse.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        // client-exchanger can impersonate from token "user" to user "impersonated-user"
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                    ));
+            org.junit.Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            response.close();
+
+            String exchangedTokenString = accessTokenResponse.getToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
+            assertNotNull(exchangedToken.getAudience());
+            Assert.assertEquals("impersonated-user", exchangedToken.getPreferredUsername());
+            Assert.assertNull(exchangedToken.getRealmAccess());
+
+            Object impersonatorRaw = exchangedToken.getOtherClaims().get("impersonator");
+            assertThat(impersonatorRaw, instanceOf(Map.class));
+            Map impersonatorClaim = (Map) impersonatorRaw;
+
+            Assert.assertEquals(token.getSubject(), impersonatorClaim.get("id"));
+            Assert.assertEquals("user", impersonatorClaim.get("username"));
+        }
+
+        // client-exchanger can impersonate from token "user" to user "impersonated-user" and to "target" client
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+                                    .param(OAuth2Constants.AUDIENCE, "target")
+
+                    ));
+            org.junit.Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            response.close();
+
+            String exchangedTokenString = accessTokenResponse.getToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("client-exchanger", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
+            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+        }
+
+        try (Response response = exchangeUrl.request()
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ))) {
+            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+            assertEquals("Client is not the holder of the token",
+                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
+        }
+
+        try (Response response = exchangeUrl.request()
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.AUDIENCE, "direct-public")
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ))) {
+            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+            assertEquals("Client is not the holder of the token",
+                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
+        }
+
+        try (Response response = exchangeUrl.request()
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.CLIENT_ID, "direct-public")
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.AUDIENCE, "client-exchanger")
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ))) {
+            org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+            assertEquals("Client is not the holder of the token",
+                    response.readEntity(OAuth2ErrorRepresentation.class).getErrorDescription());
+        }
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testIntrospectTokenAfterImpersonation() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("user", "password");
+        String accessToken = tokenResponse.getAccessToken();
+
+        try (Response response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ))) {
+            org.junit.Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            String exchangedTokenString = accessTokenResponse.getToken();
+            JsonNode json = oauth.doIntrospectionAccessTokenRequest(exchangedTokenString).asJsonNode();
+            assertTrue(json.get("active").asBoolean());
+            assertEquals("impersonated-user", json.get("preferred_username").asText());
+            assertEquals("user", json.get("act").get("sub").asText());
+        }
+
+        try (Response response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+                                .param(OAuth2Constants.AUDIENCE, "target")
+
+                ))) {
+            org.junit.Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            String exchangedTokenString = accessTokenResponse.getToken();
+            JsonNode json = oauth.doIntrospectionAccessTokenRequest(exchangedTokenString).asJsonNode();
+            assertTrue(json.get("active").asBoolean());
+            assertEquals("impersonated-user", json.get("preferred_username").asText());
+            assertEquals("user", json.get("act").get("sub").asText());
+        }
+    }
+
+    @UncaughtServerErrorExpected
+    @Test
+    public void testImpersonationUsingPublicClient() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+
+        oauth.realm(TEST);
+        oauth.client("direct-public", "secret");
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode());
+        String accessToken = tokenResponse.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        Response response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", null))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ));
+        org.junit.Assert.assertEquals(200, response.getStatus());
+        AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+        response.close();
+
+        String exchangedTokenString = accessTokenResponse.getToken();
+        TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+        AccessToken exchangedToken = verifier.parse().getToken();
+        Assert.assertEquals("direct-public", exchangedToken.getIssuedFor());
+        Assert.assertEquals("impersonated-user", exchangedToken.getPreferredUsername());
+        Assert.assertNull(exchangedToken.getRealmAccess());
+
+        testingClient.server().run(TokenExchangeTestUtils::setUpUserImpersonatePermissions);
+    }
+
+    @UncaughtServerErrorExpected
+    @Test
+    public void testImpersonationUsingTokenIssuedToUntrustedPublicClient() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+        testingClient.server().run(TokenExchangeTestUtils::setUpUserImpersonatePermissions);
+
+        oauth.realm(TEST);
+        oauth.client("direct-public-untrusted", "secret");
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin("user", "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode());
+        String accessToken = tokenResponse.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "user");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        Response response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public-untrusted", null))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ));
+        org.junit.Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());
+
+        oauth.logoutForm().idTokenHint(tokenResponse.getIdToken()).open();
+        oauth.client("direct-public", "secret");
+        authzResponse = oauth.doLogin("user", "password");
+        tokenResponse = oauth.doAccessTokenRequest(authzResponse.getCode());
+        accessToken = tokenResponse.getAccessToken();
+
+        response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", null))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ));
+        org.junit.Assert.assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testBadImpersonator() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+
+        oauth.realm(TEST);
+        oauth.client("client-exchanger", "secret");
+
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doPasswordGrantRequest("bad-impersonator", "password");
+        String accessToken = tokenResponse.getAccessToken();
+        TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
+        AccessToken token = accessTokenVerifier.parse().getToken();
+        Assert.assertEquals(token.getPreferredUsername(), "bad-impersonator");
+        assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
+
+        // test that user does not have impersonator permission
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("client-exchanger", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN, accessToken)
+                                    .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                    ));
+            org.junit.Assert.assertEquals(403, response.getStatus());
+            response.close();
+        }
+
+
+    }
+
+    @Test
+    @UncaughtServerErrorExpected
+    public void testDirectImpersonation() throws Exception {
+        testingClient.server().run(TokenExchangeTestUtils::setupRealm);
+        Client httpClient = AdminClientUtil.createResteasyClient();
+
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+        System.out.println("Exchange url: " + exchangeUrl.getUri().toString());
+
+        // direct-exchanger can impersonate from token "user" to user "impersonated-user"
+        // see https://issues.redhat.com/browse/KEYCLOAK-5492
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-exchanger", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                    ));
+            Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            response.close();
+
+            String exchangedTokenString = accessTokenResponse.getToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("direct-exchanger", exchangedToken.getIssuedFor());
+            Assert.assertNull(exchangedToken.getAudience());
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
+            Assert.assertNull(exchangedToken.getRealmAccess());
+        }
+
+        // direct-legal can impersonate from token "user" to user "impersonated-user" and to "target" client
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-legal", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+                                    .param(OAuth2Constants.AUDIENCE, "target")
+
+                    ));
+            Assert.assertEquals(200, response.getStatus());
+            AccessTokenResponse accessTokenResponse = response.readEntity(AccessTokenResponse.class);
+            response.close();
+
+            String exchangedTokenString = accessTokenResponse.getToken();
+            TokenVerifier<AccessToken> verifier = TokenVerifier.create(exchangedTokenString, AccessToken.class);
+            AccessToken exchangedToken = verifier.parse().getToken();
+            Assert.assertEquals("direct-legal", exchangedToken.getIssuedFor());
+            Assert.assertEquals("target", exchangedToken.getAudience()[0]);
+            Assert.assertEquals(exchangedToken.getPreferredUsername(), "impersonated-user");
+            assertTrue(exchangedToken.getRealmAccess().isUserInRole("example"));
+        }
+
+        // direct-public fails impersonation
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-public", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+                                    .param(OAuth2Constants.AUDIENCE, "target")
+
+                    ));
+            Assert.assertEquals(403, response.getStatus());
+            response.close();
+        }
+
+        // direct-no-secret fails impersonation
+        {
+            Response response = exchangeUrl.request()
+                    .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-no-secret", "secret"))
+                    .post(Entity.form(
+                            new Form()
+                                    .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                    .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+                                    .param(OAuth2Constants.AUDIENCE, "target")
+
+                    ));
+            assertTrue(response.getStatus() >= 400);
+            response.close();
+        }
+    }
+
+
+    private Response checkTokenExchange() {
+        Client httpClient = AdminClientUtil.createResteasyClient();
+        WebTarget exchangeUrl = httpClient.target(OAuthClient.AUTH_SERVER_ROOT)
+                .path("/realms")
+                .path(TEST)
+                .path("protocol/openid-connect/token");
+
+        Response response = exchangeUrl.request()
+                .header(HttpHeaders.AUTHORIZATION, BasicAuthHelper.createHeader("direct-exchanger", "secret"))
+                .post(Entity.form(
+                        new Form()
+                                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                                .param(OAuth2Constants.REQUESTED_SUBJECT, "impersonated-user")
+
+                ));
+        return response;
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/TokenExchangeTestUtils.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/TokenExchangeTestUtils.java
new file mode 100644
index 000000000000..1d2d6bee603c
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/tokenexchange/TokenExchangeTestUtils.java
@@ -0,0 +1,292 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oauth.tokenexchange;
+
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.common.Profile;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.protocol.oidc.OIDCConfigAttributes;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
+import org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper;
+import org.keycloak.representations.idm.authorization.ClientPolicyRepresentation;
+import org.keycloak.representations.idm.authorization.DecisionStrategy;
+import org.keycloak.services.managers.ClientManager;
+import org.keycloak.services.managers.RealmManager;
+import org.keycloak.services.resources.admin.fgap.AdminPermissionManagement;
+import org.keycloak.services.resources.admin.fgap.AdminPermissions;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+
+import static org.junit.Assert.assertNotNull;
+import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_ID;
+import static org.keycloak.models.ImpersonationSessionNote.IMPERSONATOR_USERNAME;
+import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class TokenExchangeTestUtils {
+
+    private TokenExchangeTestUtils() {
+    }
+
+
+    public static void setupRealm(KeycloakSession session) {
+        addDirectExchanger(session);
+
+        RealmModel realm = session.realms().getRealmByName(TEST);
+        RoleModel exampleRole = realm.getRole("example");
+
+        ClientModel target = realm.getClientByClientId("target");
+        assertNotNull(target);
+
+        ClientModel differentScopeClient = realm.addClient("different-scope-client");
+        differentScopeClient.setClientId("different-scope-client");
+        differentScopeClient.setPublicClient(false);
+        differentScopeClient.setDirectAccessGrantsEnabled(true);
+        differentScopeClient.setEnabled(true);
+        differentScopeClient.setSecret("secret");
+        differentScopeClient.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        differentScopeClient.setFullScopeAllowed(false);
+        differentScopeClient.removeClientScope(realm.getClientScopesStream().filter(scope->"email".equals(scope.getName())).findAny().get());
+
+        ClientModel clientExchanger = realm.addClient("client-exchanger");
+        clientExchanger.setClientId("client-exchanger");
+        clientExchanger.setPublicClient(false);
+        clientExchanger.setDirectAccessGrantsEnabled(true);
+        clientExchanger.setEnabled(true);
+        clientExchanger.setSecret("secret");
+        clientExchanger.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        clientExchanger.setFullScopeAllowed(false);
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            RoleModel impersonateRole = management.getRealmPermissionsClient().getRole(AdminRoles.IMPERSONATION);
+            clientExchanger.addScopeMapping(impersonateRole);
+        }
+
+        clientExchanger.addProtocolMapper(UserSessionNoteMapper.createUserSessionNoteMapper(IMPERSONATOR_ID));
+        clientExchanger.addProtocolMapper(UserSessionNoteMapper.createUserSessionNoteMapper(IMPERSONATOR_USERNAME));
+        clientExchanger.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("different-scope-client-audience", differentScopeClient.getClientId(), null, true, false, true));
+        clientExchanger.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("allowed-exchanger1", null, "legal", true, false, true));
+        clientExchanger.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("allowed-exchanger2", null, "no-refresh-token", true, false, true));
+        clientExchanger.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("audience-to-itself", "client-exchanger", null, true, false, true));
+
+        ClientModel illegal = realm.addClient("illegal");
+        illegal.setClientId("illegal");
+        illegal.setPublicClient(false);
+        illegal.setDirectAccessGrantsEnabled(true);
+        illegal.setEnabled(true);
+        illegal.setSecret("secret");
+        illegal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        illegal.setFullScopeAllowed(false);
+
+        ClientModel legal = realm.addClient("legal");
+        legal.setClientId("legal");
+        legal.setPublicClient(false);
+        legal.setDirectAccessGrantsEnabled(true);
+        legal.setEnabled(true);
+        legal.setSecret("secret");
+        legal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        legal.setFullScopeAllowed(false);
+
+        ClientModel directLegal = realm.addClient("direct-legal");
+        directLegal.setClientId("direct-legal");
+        directLegal.setPublicClient(false);
+        directLegal.setDirectAccessGrantsEnabled(true);
+        directLegal.setEnabled(true);
+        directLegal.setSecret("secret");
+        directLegal.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        directLegal.setFullScopeAllowed(false);
+        directLegal.addRedirectUri(OAuthClient.APP_ROOT + "/auth");
+
+        ClientModel directPublic = realm.addClient("direct-public");
+        directPublic.setClientId("direct-public");
+        directPublic.setPublicClient(true);
+        directPublic.setDirectAccessGrantsEnabled(true);
+        directPublic.setEnabled(true);
+        directPublic.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        directPublic.setFullScopeAllowed(false);
+        directPublic.addRedirectUri("*");
+        directPublic.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("client-exchanger-audience", clientExchanger.getClientId(), null, true, false, true));
+
+        ClientModel directUntrustedPublic = realm.addClient("direct-public-untrusted");
+        directUntrustedPublic.setClientId("direct-public-untrusted");
+        directUntrustedPublic.setPublicClient(true);
+        directUntrustedPublic.setDirectAccessGrantsEnabled(true);
+        directUntrustedPublic.setEnabled(true);
+        directUntrustedPublic.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        directUntrustedPublic.setFullScopeAllowed(false);
+        directUntrustedPublic.addRedirectUri("*");
+        directUntrustedPublic.setAttribute(OIDCConfigAttributes.POST_LOGOUT_REDIRECT_URIS, "+");
+        directUntrustedPublic.addProtocolMapper(AudienceProtocolMapper.createClaimMapper("client-exchanger-audience", clientExchanger.getClientId(), null, true, false, true));
+
+        ClientModel directNoSecret = realm.addClient("direct-no-secret");
+        directNoSecret.setClientId("direct-no-secret");
+        directNoSecret.setPublicClient(false);
+        directNoSecret.setDirectAccessGrantsEnabled(true);
+        directNoSecret.setEnabled(true);
+        directNoSecret.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        directNoSecret.setFullScopeAllowed(false);
+
+        ClientModel noRefreshToken = realm.addClient("no-refresh-token");
+        noRefreshToken.setClientId("no-refresh-token");
+        noRefreshToken.setPublicClient(false);
+        noRefreshToken.setDirectAccessGrantsEnabled(true);
+        noRefreshToken.setEnabled(true);
+        noRefreshToken.setSecret("secret");
+        noRefreshToken.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        noRefreshToken.setFullScopeAllowed(false);
+        noRefreshToken.getAttributes().put(OIDCConfigAttributes.USE_REFRESH_TOKEN, "false");
+
+        ClientModel serviceAccount = realm.addClient("my-service-account");
+        serviceAccount.setClientId("my-service-account");
+        serviceAccount.setPublicClient(false);
+        serviceAccount.setServiceAccountsEnabled(true);
+        serviceAccount.setEnabled(true);
+        serviceAccount.setSecret("secret");
+        serviceAccount.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        serviceAccount.setFullScopeAllowed(false);
+        new ClientManager(new RealmManager(session)).enableServiceAccount(serviceAccount);
+
+        // permission for client to client exchange to "target" client
+        ClientPolicyRepresentation clientRep = new ClientPolicyRepresentation();
+        clientRep.setName("to");
+        clientRep.addClient(clientExchanger.getId());
+        clientRep.addClient(legal.getId());
+        clientRep.addClient(directLegal.getId());
+        clientRep.addClient(noRefreshToken.getId());
+        clientRep.addClient(serviceAccount.getId());
+        clientRep.addClient(differentScopeClient.getId());
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            ResourceServer server = management.realmResourceServer();
+            Policy clientPolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientRep);
+            management.clients().exchangeToPermission(target).addAssociatedPolicy(clientPolicy);
+        }
+
+        // permission for user impersonation for a client
+
+        ClientPolicyRepresentation clientImpersonateRep = new ClientPolicyRepresentation();
+        clientImpersonateRep.setName("clientImpersonators");
+        clientImpersonateRep.addClient(directLegal.getId());
+        clientImpersonateRep.addClient(directPublic.getId());
+        clientImpersonateRep.addClient(directUntrustedPublic.getId());
+        clientImpersonateRep.addClient(directNoSecret.getId());
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            ResourceServer server = management.realmResourceServer();
+            Policy clientImpersonatePolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientImpersonateRep);
+            management.users().setPermissionsEnabled(true);
+            management.users().adminImpersonatingPermission().addAssociatedPolicy(clientImpersonatePolicy);
+            management.users().adminImpersonatingPermission().setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
+        }
+
+        UserModel user = session.users().addUser(realm, "user");
+        user.setEnabled(true);
+        user.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        user.grantRole(exampleRole);
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            RoleModel impersonateRole = management.getRealmPermissionsClient().getRole(AdminRoles.IMPERSONATION);
+            user.grantRole(impersonateRole);
+        }
+
+        UserModel bad = session.users().addUser(realm, "bad-impersonator");
+        bad.setEnabled(true);
+        bad.credentialManager().updateCredential(UserCredentialModel.password("password"));
+    }
+
+    public static void setUpUserImpersonatePermissions(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(TEST);
+        AdminPermissionManagement management = AdminPermissions.management(session, realm);
+        ResourceServer server = management.realmResourceServer();
+        Policy userImpersonationPermission = management.users().userImpersonatedPermission();
+        ClientPolicyRepresentation clientsAllowedToImpersonateRep = new ClientPolicyRepresentation();
+        clientsAllowedToImpersonateRep.setName("clientsAllowedToImpersonateRep");
+        clientsAllowedToImpersonateRep.addClient("direct-public");
+        Policy clientsAllowedToImpersonate = management.authz().getStoreFactory().getPolicyStore().create(server, clientsAllowedToImpersonateRep);
+        userImpersonationPermission.addAssociatedPolicy(clientsAllowedToImpersonate);
+    }
+
+
+    public static void addDirectExchanger(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(TEST);
+        RoleModel exampleRole = realm.addRole("example");
+
+
+        ClientModel target = realm.addClient("target");
+        target.setName("target");
+        target.setClientId("target");
+        target.setDirectAccessGrantsEnabled(true);
+        target.setEnabled(true);
+        target.setSecret("secret");
+        target.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        target.setFullScopeAllowed(false);
+        target.addScopeMapping(exampleRole);
+
+        ClientModel directExchanger = realm.addClient("direct-exchanger");
+        directExchanger.setName("direct-exchanger");
+        directExchanger.setClientId("direct-exchanger");
+        directExchanger.setPublicClient(false);
+        directExchanger.setDirectAccessGrantsEnabled(true);
+        directExchanger.setEnabled(true);
+        directExchanger.setSecret("secret");
+        directExchanger.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        directExchanger.setFullScopeAllowed(false);
+
+        ClientPolicyRepresentation clientImpersonateRep = new ClientPolicyRepresentation();
+        clientImpersonateRep.setName("clientImpersonatorsDirect");
+        clientImpersonateRep.addClient(directExchanger.getId());
+
+        if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ) || Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ_V2)) {
+            AdminPermissionManagement management = AdminPermissions.management(session, realm);
+            management.clients().setPermissionsEnabled(target, true);
+            ResourceServer server = management.realmResourceServer();
+            Policy clientImpersonatePolicy = management.authz().getStoreFactory().getPolicyStore().create(server, clientImpersonateRep);
+            management.users().setPermissionsEnabled(true);
+            management.users().adminImpersonatingPermission().addAssociatedPolicy(clientImpersonatePolicy);
+            management.users().adminImpersonatingPermission().setDecisionStrategy(DecisionStrategy.AFFIRMATIVE);
+        }
+
+        UserModel impersonatedUser = session.users().addUser(realm, "impersonated-user");
+        impersonatedUser.setEnabled(true);
+        impersonatedUser.credentialManager().updateCredential(UserCredentialModel.password("password"));
+        impersonatedUser.grantRole(exampleRole);
+    }
+
+    public static void removeDirectExchanger(KeycloakSession session) {
+        RealmModel realm = session.realms().getRealmByName(TEST);
+        realm.removeClient(realm.getClientByClientId("direct-exchanger").getId());
+        realm.removeClient(realm.getClientByClientId("target").getId());
+        realm.removeRole(realm.getRole("example"));
+        session.users().removeUser(realm, session.users().getUserByUsername(realm, "impersonated-user"));
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderTest.java
index 8d89122ab942..034730f6c47c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/JwtCredentialBuilderTest.java
@@ -21,6 +21,7 @@
 import org.junit.Test;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.protocol.oid4vc.issuance.TimeProvider;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBody;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBuilder;
@@ -41,7 +42,7 @@
 public class JwtCredentialBuilderTest extends CredentialBuilderTest {
 
     TimeProvider timeProvider = new StaticTimeProvider(1000);
-    JwtCredentialBuilder builder = new JwtCredentialBuilder(TEST_DID.toString(), timeProvider);
+    JwtCredentialBuilder builder = new JwtCredentialBuilder(timeProvider);
 
     @Test
     public void shouldBuildJwtCredentialSuccessfully() throws Exception {
@@ -84,7 +85,7 @@ public void buildJwtCredential_SetNbfAsCurrentTimeIfIssuanceDateNotSupplied() th
 
     private JsonNode parseCredentialSubject(JWSInput jwsInput) throws JWSInputException {
         JsonNode payload = jwsInput.readJsonContent(JsonNode.class);
-        return payload.get("vc").get("credentialSubject");
+        return payload.get("vc").get(Oid4VciConstants.CREDENTIAL_SUBJECT);
     }
 
     private Map<String, Object> exampleCredentialClaims() {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderTest.java
index 4651cae65bc2..30ded9064fcf 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/credentialbuilder/SdJwtCredentialBuilderTest.java
@@ -90,14 +90,15 @@ public static void testSignSDJwtCredential(Map<String, Object> claims, int decoy
             throws VerificationException {
         String issuerDid = TEST_DID.toString();
         CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
+                .setCredentialIssuer(issuerDid)
                 .setCredentialType("https://credentials.example.com/test-credential")
                 .setTokenJwsType("example+sd-jwt")
                 .setHashAlgorithm("sha-256")
                 .setNumberOfDecoys(decoys)
-                .setVisibleClaims(visibleClaims);
+                .setSdJwtVisibleClaims(visibleClaims);
 
         VerifiableCredential testCredential = getTestCredential(claims);
-        SdJwtCredentialBody sdJwtCredentialBody = new SdJwtCredentialBuilder(issuerDid)
+        SdJwtCredentialBody sdJwtCredentialBody = new SdJwtCredentialBuilder()
                 .buildCredentialBody(testCredential, credentialBuildConfig);
 
         String sdJwtString = sdJwtCredentialBody.sign(exampleSigner());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JWTVCIssuerWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JWTVCIssuerWellKnownProviderTest.java
index c6bdece96f6e..c74ea43b296a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JWTVCIssuerWellKnownProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JWTVCIssuerWellKnownProviderTest.java
@@ -28,7 +28,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
@@ -36,7 +36,7 @@
 import java.util.List;
 import java.util.Map;
 
-import static junit.framework.Assert.assertTrue;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 
@@ -69,11 +69,9 @@ public void getConfig() throws IOException {
     public void configureTestRealm(RealmRepresentation testRealm) {
         if (testRealm.getComponents() != null) {
             testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(RSA_KEY));
-            testRealm.getComponents().add("org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService", getJwtSigningProvider(RSA_KEY));
         } else {
             testRealm.setComponents(new MultivaluedHashMap<>(
-                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(RSA_KEY)),
-                            "org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService", List.of(getJwtSigningProvider(RSA_KEY))
+                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(RSA_KEY))
                     )));
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtCredentialSignerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtCredentialSignerTest.java
new file mode 100644
index 000000000000..52342720ca25
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtCredentialSignerTest.java
@@ -0,0 +1,251 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import org.jboss.logging.Logger;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.TokenVerifier;
+import org.keycloak.common.VerificationException;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
+import org.keycloak.crypto.SignatureVerifierContext;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBuilder;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerException;
+import org.keycloak.protocol.oid4vc.issuance.signing.JwtCredentialSigner;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+import org.keycloak.protocol.oid4vc.model.CredentialSubject;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testsuite.runonserver.RunOnServerException;
+import org.keycloak.util.JsonSerialization;
+
+import java.security.PublicKey;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.fail;
+
+
+public class JwtCredentialSignerTest extends OID4VCTest {
+
+    private static final Logger LOGGER = Logger.getLogger(JwtCredentialSignerTest.class);
+
+    private static final KeyWrapper rsaKey = getRsaKey();
+
+    @Before
+    public void setup() {
+        CryptoIntegration.init(this.getClass().getClassLoader());
+    }
+
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedCredentialBody() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session -> new JwtCredentialSigner(session).signCredential(
+                            new LDCredentialBody(getTestCredential(Map.of())),
+                            new CredentialBuildConfig()
+                    ));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unsupported algorithm is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedAlgorithm() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignJwtCredential(
+                                    session,
+                                    getKeyIdFromSession(session),
+                                    "unsupported-algorithm",
+                                    Map.of())
+                    );
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unknown key is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testFailIfNoKey() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignJwtCredential(
+                                    session,
+                                    "no-such-key",
+                                    Algorithm.RS256,
+                                    Map.of()));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // The provided credentials should be successfully signed as a JWT-VC.
+    @Test
+    public void testRsaSignedCredentialWithOutIssuanceDate() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c"))));
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithIssuanceDate() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c"),
+                                        "issuanceDate", Instant.ofEpochSecond(10))));
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithoutAdditionalClaims() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Algorithm.RS256,
+                                Map.of()));
+    }
+
+
+    public static void testSignJwtCredential(
+            KeycloakSession session, String signingKeyId, String algorithm, Map<String, Object> claims) {
+        CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
+                .setCredentialIssuer(TEST_DID.toString())
+                .setTokenJwsType("JWT")
+                .setSigningKeyId(signingKeyId)
+                .setSigningAlgorithm(algorithm);
+
+        JwtCredentialSigner jwtCredentialSigner = new JwtCredentialSigner(session);
+
+        VerifiableCredential testCredential = getTestCredential(claims);
+        JwtCredentialBuilder builder = new JwtCredentialBuilder(
+                new StaticTimeProvider(1000)
+        );
+
+        CredentialBody credentialBody = builder.buildCredentialBody(
+                testCredential,
+                credentialBuildConfig
+        );
+
+        String jwtCredential = jwtCredentialSigner.signCredential(credentialBody, credentialBuildConfig);
+
+        KeyWrapper keyWrapper = getKeyFromSession(session);
+        SignatureVerifierContext verifierContext = null;
+        switch (algorithm) {
+            case Algorithm.ES256: {
+                verifierContext = new ServerECDSASignatureVerifierContext(keyWrapper);
+                break;
+            }
+            case Algorithm.RS256: {
+                verifierContext = new AsymmetricSignatureVerifierContext(keyWrapper);
+                break;
+            }
+            default: {
+                fail("Algorithm not supported.");
+            }
+        }
+
+        TokenVerifier<JsonWebToken> verifier = TokenVerifier
+                .create(jwtCredential, JsonWebToken.class)
+                .verifierContext(verifierContext);
+        verifier.publicKey((PublicKey) keyWrapper.getPublicKey());
+        try {
+            verifier.verify();
+        } catch (VerificationException e) {
+            fail("The credential should successfully be verified.");
+        }
+
+        try {
+            JsonWebToken theToken = verifier.getToken();
+
+            assertEquals("JWT claim in JWT encoded VC or VP MUST be used to set the value of the “expirationDate” of the VC", TEST_EXPIRATION_DATE.getEpochSecond(), theToken.getExp().longValue());
+            if (claims.containsKey("issuanceDate")) {
+                assertEquals("VC Data Model v1.1 specifies that “issuanceDate” property MUST be represented as an nbf JWT claim, and not iat JWT claim.", ((Instant) claims.get("issuanceDate")).getEpochSecond(), theToken.getNbf().longValue());
+            } else {
+                // if not specific date is set, check against "currentTime"
+                assertEquals("VC Data Model v1.1 specifies that “issuanceDate” property MUST be represented as an nbf JWT claim, and not iat JWT claim.", TEST_ISSUANCE_DATE.getEpochSecond(), theToken.getNbf().longValue());
+            }
+            assertEquals("The issuer should be set in the token.", TEST_DID.toString(), theToken.getIssuer());
+            assertEquals("The credential ID should be set as the token ID.", testCredential.getId().toString(), theToken.getId());
+            Optional.ofNullable(testCredential.getCredentialSubject().getClaims().get("id")).ifPresent(id -> assertEquals("If the credentials subject id is set, it should be set as the token subject.", id.toString(), theToken.getSubject()));
+
+            assertNotNull("The credentials should be included at the vc-claim.", theToken.getOtherClaims().get("vc"));
+            VerifiableCredential credential = JsonSerialization.mapper.convertValue(theToken.getOtherClaims().get("vc"), VerifiableCredential.class);
+            assertEquals("The types should be included", TEST_TYPES, credential.getType());
+            assertEquals("The issuer should be included", TEST_DID, credential.getIssuer());
+            assertEquals("The expiration date should be included", TEST_EXPIRATION_DATE, credential.getExpirationDate());
+            if (claims.containsKey("issuanceDate")) {
+                assertEquals("The issuance date should be included", claims.get("issuanceDate"), credential.getIssuanceDate());
+            }
+
+            CredentialSubject subject = credential.getCredentialSubject();
+            claims.entrySet().stream()
+                    .filter(e -> !e.getKey().equals("issuanceDate"))
+                    .forEach(e -> assertEquals(String.format("All additional claims should be set - %s is incorrect", e.getKey()), e.getValue(), subject.getClaims().get(e.getKey())));
+        } catch (VerificationException e) {
+            fail("Was not able to get the token from the verifier.");
+        }
+    }
+
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        if (testRealm.getComponents() != null) {
+            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(rsaKey));
+        } else {
+            testRealm.setComponents(new MultivaluedHashMap<>(
+                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(rsaKey)))));
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtSigningServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtSigningServiceTest.java
deleted file mode 100644
index dad1134c1e54..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/JwtSigningServiceTest.java
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.oid4vc.issuance.signing;
-
-import org.jboss.logging.Logger;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.TokenVerifier;
-import org.keycloak.common.VerificationException;
-import org.keycloak.common.crypto.CryptoIntegration;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.crypto.Algorithm;
-import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
-import org.keycloak.crypto.SignatureVerifierContext;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBuilder;
-import org.keycloak.protocol.oid4vc.issuance.signing.JwtSigningService;
-import org.keycloak.protocol.oid4vc.issuance.signing.SigningServiceException;
-import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
-import org.keycloak.protocol.oid4vc.model.CredentialSubject;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
-import org.keycloak.representations.JsonWebToken;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.runonserver.RunOnServerException;
-import org.keycloak.util.JsonSerialization;
-
-import java.security.PublicKey;
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.UUID;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.fail;
-
-
-public class JwtSigningServiceTest extends OID4VCTest {
-
-    private static final Logger LOGGER = Logger.getLogger(JwtSigningServiceTest.class);
-
-    private static final KeyWrapper rsaKey = getRsaKey();
-
-    @Before
-    public void setup() {
-        CryptoIntegration.init(this.getClass().getClassLoader());
-    }
-
-    // If an unsupported algorithm is provided, the JWT Sigining Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testUnsupportedAlgorithm() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new JwtSigningService(
-                                    session,
-                                    getKeyFromSession(session).getKid(),
-                                    "unsupported-algorithm")
-                    );
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    // If no key is provided, the JWT Sigining Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testFailIfNoKey() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new JwtSigningService(
-                                    session,
-                                    "no-such-key",
-                                    Algorithm.RS256));
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    // The provided credentials should be successfully signed as a JWT-VC.
-    @Test
-    public void testRsaSignedCredentialWithOutIssuanceDate() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignJwtCredential(
-                                session,
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c"))));
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithIssuanceDate() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignJwtCredential(
-                                session,
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c"),
-                                        "issuanceDate", Instant.ofEpochSecond(10))));
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithoutAdditionalClaims() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignJwtCredential(
-                                session,
-                                Algorithm.RS256,
-                                Map.of()));
-    }
-
-
-    public static void testSignJwtCredential(KeycloakSession session, String algorithm, Map<String, Object> claims) {
-        KeyWrapper keyWrapper = getKeyFromSession(session);
-
-        JwtSigningService jwtSigningService = new JwtSigningService(
-                session,
-                keyWrapper.getKid(),
-                algorithm);
-
-        VerifiableCredential testCredential = getTestCredential(claims);
-        JwtCredentialBuilder builder = new JwtCredentialBuilder(
-                TEST_DID.toString(),
-                new StaticTimeProvider(1000)
-        );
-        CredentialBody credentialBody = builder.buildCredentialBody(
-                testCredential,
-                new CredentialBuildConfig().setTokenJwsType("JWT")
-        );
-
-        VCIssuanceContext context = new VCIssuanceContext().setCredentialBody(credentialBody);
-        String jwtCredential = jwtSigningService.signCredential(context);
-
-        SignatureVerifierContext verifierContext = null;
-        switch (algorithm) {
-            case Algorithm.ES256: {
-                verifierContext = new ServerECDSASignatureVerifierContext(keyWrapper);
-                break;
-            }
-            case Algorithm.RS256: {
-                verifierContext = new AsymmetricSignatureVerifierContext(keyWrapper);
-                break;
-            }
-            default: {
-                fail("Algorithm not supported.");
-            }
-        }
-
-        TokenVerifier<JsonWebToken> verifier = TokenVerifier
-                .create(jwtCredential, JsonWebToken.class)
-                .verifierContext(verifierContext);
-        verifier.publicKey((PublicKey) keyWrapper.getPublicKey());
-        try {
-            verifier.verify();
-        } catch (VerificationException e) {
-            fail("The credential should successfully be verified.");
-        }
-
-        try {
-            JsonWebToken theToken = verifier.getToken();
-
-            assertEquals("JWT claim in JWT encoded VC or VP MUST be used to set the value of the “expirationDate” of the VC", TEST_EXPIRATION_DATE.getEpochSecond(), theToken.getExp().longValue());
-            if (claims.containsKey("issuanceDate")) {
-                assertEquals("VC Data Model v1.1 specifies that “issuanceDate” property MUST be represented as an nbf JWT claim, and not iat JWT claim.", ((Instant) claims.get("issuanceDate")).getEpochSecond(), theToken.getNbf().longValue());
-            } else {
-                // if not specific date is set, check against "currentTime"
-                assertEquals("VC Data Model v1.1 specifies that “issuanceDate” property MUST be represented as an nbf JWT claim, and not iat JWT claim.", TEST_ISSUANCE_DATE.getEpochSecond(), theToken.getNbf().longValue());
-            }
-            assertEquals("The issuer should be set in the token.", TEST_DID.toString(), theToken.getIssuer());
-            assertEquals("The credential ID should be set as the token ID.", testCredential.getId().toString(), theToken.getId());
-            Optional.ofNullable(testCredential.getCredentialSubject().getClaims().get("id")).ifPresent(id -> assertEquals("If the credentials subject id is set, it should be set as the token subject.", id.toString(), theToken.getSubject()));
-
-            assertNotNull("The credentials should be included at the vc-claim.", theToken.getOtherClaims().get("vc"));
-            VerifiableCredential credential = JsonSerialization.mapper.convertValue(theToken.getOtherClaims().get("vc"), VerifiableCredential.class);
-            assertEquals("The types should be included", TEST_TYPES, credential.getType());
-            assertEquals("The issuer should be included", TEST_DID, credential.getIssuer());
-            assertEquals("The expiration date should be included", TEST_EXPIRATION_DATE, credential.getExpirationDate());
-            if (claims.containsKey("issuanceDate")) {
-                assertEquals("The issuance date should be included", claims.get("issuanceDate"), credential.getIssuanceDate());
-            }
-
-            CredentialSubject subject = credential.getCredentialSubject();
-            claims.entrySet().stream()
-                    .filter(e -> !e.getKey().equals("issuanceDate"))
-                    .forEach(e -> assertEquals(String.format("All additional claims should be set - %s is incorrect", e.getKey()), e.getValue(), subject.getClaims().get(e.getKey())));
-        } catch (VerificationException e) {
-            fail("Was not able to get the token from the verifier.");
-        }
-    }
-
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        if (testRealm.getComponents() != null) {
-            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(rsaKey));
-        } else {
-            testRealm.setComponents(new MultivaluedHashMap<>(
-                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(rsaKey)))));
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDCredentialSignerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDCredentialSignerTest.java
new file mode 100644
index 000000000000..79f748698efb
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDCredentialSignerTest.java
@@ -0,0 +1,220 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.jose.jws.JWSBuilder;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBuilder;
+import org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerException;
+import org.keycloak.protocol.oid4vc.issuance.signing.LDCredentialSigner;
+import org.keycloak.protocol.oid4vc.issuance.signing.vcdm.Ed255192018Suite;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+import org.keycloak.protocol.oid4vc.model.CredentialSubject;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+import org.keycloak.protocol.oid4vc.model.vcdm.LdProof;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testsuite.runonserver.RunOnServerException;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+public class LDCredentialSignerTest extends OID4VCTest {
+
+    @Before
+    public void setup() {
+        CryptoIntegration.init(this.getClass().getClassLoader());
+    }
+
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedCredentialBody() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session -> new LDCredentialSigner(session, new StaticTimeProvider(1000))
+                            .signCredential(
+                                    new JwtCredentialBody(new JWSBuilder().jsonContent(Map.of())),
+                                    new CredentialBuildConfig()
+                            ));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unsupported algorithm is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedLdpType() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignLdCredential(
+                                    session,
+                                    getKeyIdFromSession(session),
+                                    Map.of(),
+                                    null,
+                                    "UnsupportedSignatureType"));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unknown key is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testFailIfNoKey() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignLdCredential(
+                                    session,
+                                    "no-such-key",
+                                    Map.of(),
+                                    null,
+                                    Ed255192018Suite.PROOF_TYPE));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // The provided credentials should be successfully signed as a JWT-VC.
+    @Test
+    public void testLdpSignedCredentialWithOutIssuanceDate() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignLdCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c")),
+                                null,
+                                Ed255192018Suite.PROOF_TYPE));
+    }
+
+    @Test
+    public void testLdpSignedCredentialWithIssuanceDate() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignLdCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c"),
+                                        "issuanceDate", Instant.ofEpochSecond(10)),
+                                null,
+                                Ed255192018Suite.PROOF_TYPE));
+    }
+
+    @Test
+    public void testLdpSignedCredentialWithCustomKid() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignLdCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c"),
+                                        "issuanceDate", Instant.ofEpochSecond(10)),
+                                "did:web:test.org#the-key-id",
+                                Ed255192018Suite.PROOF_TYPE));
+    }
+
+    @Test
+    public void testLdpSignedCredentialWithoutAdditionalClaims() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignLdCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                Map.of(),
+                                null,
+                                Ed255192018Suite.PROOF_TYPE));
+    }
+
+    public static void testSignLdCredential(
+            KeycloakSession session, String signingKeyId, Map<String, Object> claims,
+            String overrideKeyId, String ldpProofType) {
+        CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
+                .setCredentialIssuer(TEST_DID.toString())
+                .setTokenJwsType("JWT")
+                .setSigningKeyId(signingKeyId)
+                .setSigningAlgorithm("EdDSA")
+                .setOverrideKeyId(overrideKeyId)
+                .setLdpProofType(ldpProofType);
+
+        LDCredentialSigner ldCredentialSigner = new LDCredentialSigner(
+                session, new StaticTimeProvider(1000));
+
+        VerifiableCredential testCredential = getTestCredential(claims);
+        LDCredentialBody ldCredentialBody = new LDCredentialBuilder()
+                .buildCredentialBody(testCredential, credentialBuildConfig);
+
+        VerifiableCredential verifiableCredential = ldCredentialSigner
+                .signCredential(ldCredentialBody, credentialBuildConfig);
+
+        assertEquals("The types should be included", TEST_TYPES, verifiableCredential.getType());
+        assertEquals("The issuer should be included", TEST_DID, verifiableCredential.getIssuer());
+        assertNotNull("The context needs to be set.", verifiableCredential.getContext());
+        assertEquals("The expiration date should be included", TEST_EXPIRATION_DATE, verifiableCredential.getExpirationDate());
+        if (claims.containsKey("issuanceDate")) {
+            assertEquals("The issuance date should be included", claims.get("issuanceDate"), verifiableCredential.getIssuanceDate());
+        }
+
+        CredentialSubject subject = verifiableCredential.getCredentialSubject();
+        claims.entrySet().stream()
+                .filter(e -> !e.getKey().equals("issuanceDate"))
+                .forEach(e -> assertEquals(String.format("All additional claims should be set - %s is incorrect", e.getKey()), e.getValue(), subject.getClaims().get(e.getKey())));
+
+        assertNotNull("The credential should contain a signed proof.", verifiableCredential.getAdditionalProperties().get("proof"));
+
+        LdProof ldProof = (LdProof) verifiableCredential.getAdditionalProperties().get("proof");
+        KeyWrapper keyWrapper = getKeyFromSession(session);
+        String expectedKid = Optional.ofNullable(overrideKeyId).orElse(keyWrapper.getKid());
+        assertEquals("The verification method should be set to the key id.", expectedKid, ldProof.getVerificationMethod());
+
+    }
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        if (testRealm.getComponents() != null) {
+            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getEdDSAKeyProvider());
+        } else {
+            testRealm.setComponents(new MultivaluedHashMap<>(
+                    Map.of("org.keycloak.keys.KeyProvider", List.of(getEdDSAKeyProvider()))));
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDSigningServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDSigningServiceTest.java
deleted file mode 100644
index 2c1b7799617f..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/LDSigningServiceTest.java
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.oid4vc.issuance.signing;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.common.crypto.CryptoIntegration;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBuilder;
-import org.keycloak.protocol.oid4vc.issuance.signing.LDSigningService;
-import org.keycloak.protocol.oid4vc.issuance.signing.SigningServiceException;
-import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
-import org.keycloak.protocol.oid4vc.model.CredentialSubject;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
-import org.keycloak.protocol.oid4vc.model.vcdm.LdProof;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.testsuite.runonserver.RunOnServerException;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.UUID;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-
-public class LDSigningServiceTest extends OID4VCTest {
-
-    @Before
-    public void setup() {
-        CryptoIntegration.init(this.getClass().getClassLoader());
-    }
-
-    // If an unsupported algorithm is provided, the JWT Signing Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testUnsupportedLdpType() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new LDSigningService(
-                                    session,
-                                    getKeyFromSession(session).getKid(),
-                                    "EdDSA",
-                                    "UnsupportedSignatureType",
-                                    new StaticTimeProvider(1000),
-                                    Optional.empty()));
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    // If no key is provided, the JWT Signing Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testFailIfNoKey() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new LDSigningService(
-                                    session,
-                                    "no-such-key",
-                                    "EdDSA",
-                                    "Ed25519Signature2018",
-                                    new StaticTimeProvider(1000),
-                                    Optional.empty()));
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    // The provided credentials should be successfully signed as a JWT-VC.
-    @Test
-    public void testLdpSignedCredentialWithOutIssuanceDate() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignLdCredential(
-                                session,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c")),
-                                Optional.empty()));
-    }
-
-    @Test
-    public void testLdpSignedCredentialWithIssuanceDate() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignLdCredential(
-                                session,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c"),
-                                        "issuanceDate", Instant.ofEpochSecond(10)),
-                                Optional.empty()));
-    }
-
-    @Test
-    public void testLdpSignedCredentialWithCustomKid() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignLdCredential(
-                                session,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c"),
-                                        "issuanceDate", Instant.ofEpochSecond(10)),
-                                Optional.of("did:web:test.org#the-key-id")));
-    }
-
-    @Test
-    public void testLdpSignedCredentialWithoutAdditionalClaims() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignLdCredential(
-                                session,
-                                Map.of(),
-                                Optional.empty()));
-    }
-
-    public static void testSignLdCredential(KeycloakSession session, Map<String, Object> claims, Optional<String> kid) {
-        KeyWrapper keyWrapper = getKeyFromSession(session);
-
-        LDSigningService ldSigningService = new LDSigningService(
-                session,
-                keyWrapper.getKid(),
-                "EdDSA",
-                "Ed25519Signature2018",
-                new StaticTimeProvider(1000),
-                kid);
-
-        VerifiableCredential testCredential = getTestCredential(claims);
-        LDCredentialBody ldCredentialBody = new LDCredentialBuilder(TEST_DID.toString())
-                .buildCredentialBody(testCredential, new CredentialBuildConfig());
-
-        VCIssuanceContext context = new VCIssuanceContext().setCredentialBody(ldCredentialBody);
-        VerifiableCredential verifiableCredential = ldSigningService.signCredential(context);
-
-        assertEquals("The types should be included", TEST_TYPES, verifiableCredential.getType());
-        assertEquals("The issuer should be included", TEST_DID, verifiableCredential.getIssuer());
-        assertNotNull("The context needs to be set.", verifiableCredential.getContext());
-        assertEquals("The expiration date should be included", TEST_EXPIRATION_DATE, verifiableCredential.getExpirationDate());
-        if (claims.containsKey("issuanceDate")) {
-            assertEquals("The issuance date should be included", claims.get("issuanceDate"), verifiableCredential.getIssuanceDate());
-        }
-
-        CredentialSubject subject = verifiableCredential.getCredentialSubject();
-        claims.entrySet().stream()
-                .filter(e -> !e.getKey().equals("issuanceDate"))
-                .forEach(e -> assertEquals(String.format("All additional claims should be set - %s is incorrect", e.getKey()), e.getValue(), subject.getClaims().get(e.getKey())));
-
-        assertNotNull("The credential should contain a signed proof.", verifiableCredential.getAdditionalProperties().get("proof"));
-
-        LdProof ldProof = (LdProof) verifiableCredential.getAdditionalProperties().get("proof");
-        String expectedKid = kid.orElse(keyWrapper.getKid());
-        assertEquals("The verification method should be set to the key id.", expectedKid, ldProof.getVerificationMethod());
-
-    }
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        if (testRealm.getComponents() != null) {
-            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getEdDSAKeyProvider());
-        } else {
-            testRealm.setComponents(new MultivaluedHashMap<>(
-                    Map.of("org.keycloak.keys.KeyProvider", List.of(getEdDSAKeyProvider()))));
-        }
-    }
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/NonceEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/NonceEndpointTest.java
new file mode 100644
index 000000000000..d97c4249b2b2
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/NonceEndpointTest.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import jakarta.ws.rs.core.UriBuilder;
+import org.junit.Assert;
+import org.junit.Test;
+import org.keycloak.TokenVerifier;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.jose.jws.JWSHeader;
+import org.keycloak.models.KeycloakContext;
+import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandler;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.JwtCNonceHandler;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.services.resources.RealmsResource;
+import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+
+import java.net.URI;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Pascal Knüppel
+ */
+public class NonceEndpointTest extends OID4VCIssuerEndpointTest {
+
+    @Test
+    public void testGetCNonce() throws Exception {
+        URI baseUri = RealmsResource.realmBaseUrl(UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT)).build(
+                AbstractTestRealmKeycloakTest.TEST_REALM_NAME,
+                OID4VCLoginProtocolFactory.PROTOCOL_ID);
+        String cNonce = getCNonce();
+
+        URI oid4vcUri;
+        UriBuilder builder = UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT);
+        oid4vcUri = RealmsResource.protocolUrl(builder).build(AbstractTestRealmKeycloakTest.TEST_REALM_NAME,
+                                                              OID4VCLoginProtocolFactory.PROTOCOL_ID);
+        String nonceUrl = String.format("%s/%s", oid4vcUri, OID4VCIssuerEndpoint.NONCE_PATH);
+
+        Assert.assertNotNull(cNonce);
+        // verify nonce content
+        {
+            TokenVerifier<JsonWebToken> verifier = TokenVerifier.create(cNonce, JsonWebToken.class);
+
+            JWSHeader jwsHeader = verifier.getHeader();
+            Assert.assertEquals(Algorithm.ES256, jwsHeader.getAlgorithm().name());
+            Assert.assertNotNull(jwsHeader.getKeyId());
+
+            JsonWebToken nonce = verifier.getToken();
+            String credentialsUrl = String.format("%s/%s", oid4vcUri, OID4VCIssuerEndpoint.CREDENTIAL_PATH);
+            Assert.assertEquals(List.of(credentialsUrl), Arrays.asList(nonce.getAudience()));
+            Assert.assertEquals(baseUri.toString(), nonce.getIssuer());
+            Assert.assertEquals(nonceUrl, nonce.getOtherClaims().get(JwtCNonceHandler.SOURCE_ENDPOINT));
+            Assert.assertNotNull(nonce.getOtherClaims().get("salt"));
+        }
+
+        // do internal nonce verification by using cNonceHandler
+        testingClient.server(TEST_REALM_NAME).run(session -> {
+            CNonceHandler cNonceHandler = session.getProvider(CNonceHandler.class);
+            KeycloakContext keycloakContext = session.getContext();
+            cNonceHandler.verifyCNonce(cNonce,
+                                       List.of(OID4VCIssuerWellKnownProvider.getCredentialsEndpoint(
+                                               keycloakContext)),
+                                       Map.of(JwtCNonceHandler.SOURCE_ENDPOINT,
+                                              OID4VCIssuerWellKnownProvider.getNonceEndpoint(keycloakContext)));
+        });
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerEndpointTest.java
index fe1b60ef2c4c..caacc1c839f8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerEndpointTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerEndpointTest.java
@@ -25,6 +25,7 @@
 import org.apache.commons.io.IOUtils;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.entity.ContentType;
 import org.apache.http.entity.StringEntity;
@@ -40,8 +41,10 @@
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.common.util.Time;
-import org.keycloak.crypto.Algorithm;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.models.AuthenticatedClientSessionModel;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
@@ -49,11 +52,11 @@
 import org.keycloak.protocol.oid4vc.issuance.TimeProvider;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBuilder;
-import org.keycloak.protocol.oid4vc.issuance.signing.JwtSigningService;
-import org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBuilder;
 import org.keycloak.protocol.oid4vc.model.CredentialIssuer;
 import org.keycloak.protocol.oid4vc.model.CredentialRequest;
 import org.keycloak.protocol.oid4vc.model.CredentialResponse;
+import org.keycloak.protocol.oid4vc.model.DisplayObject;
 import org.keycloak.protocol.oid4vc.model.Format;
 import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
@@ -64,7 +67,10 @@
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.ComponentExportRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.services.managers.AppAuthManager;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.resources.RealmsResource;
@@ -72,15 +78,20 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.runonserver.RunOnServerException;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
+import java.util.function.BiConsumer;
 import java.util.function.BiFunction;
 import java.util.function.Consumer;
 
@@ -89,6 +100,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint.CREDENTIAL_OFFER_URI_CODE_SCOPE;
+import static org.keycloak.testsuite.forms.PassThroughClientAuthenticator.clientId;
 
 /**
  * Moved test to subclass. so we can reuse initialization code.
@@ -96,19 +108,125 @@
 public abstract class OID4VCIssuerEndpointTest extends OID4VCTest {
 
     protected static final TimeProvider TIME_PROVIDER = new OID4VCTest.StaticTimeProvider(1000);
+    protected static final String sdJwtCredentialVct = "https://credentials.example.com/SD-JWT-Credential";
+
+    protected static ClientScopeRepresentation sdJwtTypeCredentialClientScope;
+    protected static ClientScopeRepresentation jwtTypeCredentialClientScope;
+    protected static ClientScopeRepresentation minimalJwtTypeCredentialClientScope;
+
     protected CloseableHttpClient httpClient;
+    protected ClientRepresentation client;
+
+    protected boolean shouldEnableOid4vci() {
+        return true;
+    }
+
+    protected static String prepareSessionCode(KeycloakSession session, AppAuthManager.BearerTokenAuthenticator authenticator, String note) {
+        AuthenticationManager.AuthResult authResult = authenticator.authenticate();
+        UserSessionModel userSessionModel = authResult.getSession();
+        AuthenticatedClientSessionModel authenticatedClientSessionModel = userSessionModel.getAuthenticatedClientSessionByClient(
+                authResult.getClient().getId());
+        String codeId = SecretGenerator.getInstance().randomString();
+        String nonce = SecretGenerator.getInstance().randomString();
+        OAuth2Code oAuth2Code = new OAuth2Code(codeId,
+                Time.currentTime() + 6000,
+                nonce,
+                CREDENTIAL_OFFER_URI_CODE_SCOPE,
+                null,
+                null,
+                null,
+                null,
+                authenticatedClientSessionModel.getUserSession().getId());
 
+        String oauthCode = OAuth2CodeParser.persistCode(session, authenticatedClientSessionModel, oAuth2Code);
+
+        authenticatedClientSessionModel.setNote(oauthCode, note);
+        return oauthCode;
+    }
+
+    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(KeycloakSession session,
+                                                                AppAuthManager.BearerTokenAuthenticator authenticator) {
+        JwtCredentialBuilder jwtCredentialBuilder = new JwtCredentialBuilder(
+                new StaticTimeProvider(1000));
+        SdJwtCredentialBuilder sdJwtCredentialBuilder = new SdJwtCredentialBuilder();
+
+        return prepareIssuerEndpoint(
+                session,
+                authenticator,
+                Map.of(jwtCredentialBuilder.getSupportedFormat(), jwtCredentialBuilder,
+                        sdJwtCredentialBuilder.getSupportedFormat(), sdJwtCredentialBuilder)
+        );
+    }
+
+    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(
+            KeycloakSession session,
+            AppAuthManager.BearerTokenAuthenticator authenticator,
+            Map<String, CredentialBuilder> credentialBuilders
+    ) {
+        return new OID4VCIssuerEndpoint(
+                session,
+                credentialBuilders,
+                authenticator,
+                TIME_PROVIDER,
+                30);
+    }
 
     @Before
     public void setup() {
         CryptoIntegration.init(this.getClass().getClassLoader());
         httpClient = HttpClientBuilder.create().build();
+        client = testRealm().clients().findByClientId(clientId).get(0);
+
+        // Register the optional client scopes
+        sdJwtTypeCredentialClientScope = registerOptionalClientScope(sdJwtTypeCredentialScopeName,
+                null,
+                sdJwtTypeCredentialConfigurationIdName,
+                sdJwtTypeCredentialScopeName,
+                sdJwtCredentialVct,
+                Format.SD_JWT_VC,
+                null);
+        jwtTypeCredentialClientScope = registerOptionalClientScope(jwtTypeCredentialScopeName,
+                TEST_DID.toString(),
+                jwtTypeCredentialConfigurationIdName,
+                jwtTypeCredentialScopeName,
+                null,
+                Format.JWT_VC,
+                TEST_CREDENTIAL_MAPPERS_FILE);
+        minimalJwtTypeCredentialClientScope = registerOptionalClientScope("vc-with-minimal-config",
+                null,
+                null,
+                null,
+                null,
+                null,
+                null);
+
+        // Assign the registered optional client scopes to the client
+        assignOptionalClientScopeToClient(sdJwtTypeCredentialClientScope.getId(), client.getClientId());
+        assignOptionalClientScopeToClient(jwtTypeCredentialClientScope.getId(), client.getClientId());
+        assignOptionalClientScopeToClient(minimalJwtTypeCredentialClientScope.getId(), client.getClientId());
+
+        // Enable OID4VCI for the client by default, but allow tests to override
+        setClientOid4vciEnabled(clientId, shouldEnableOid4vci());
     }
 
-
     protected String getBearerToken(OAuthClient oAuthClient) {
-        OAuthClient.AuthorizationEndpointResponse authorizationEndpointResponse = oAuthClient.doLogin("john", "password");
-        return oAuthClient.doAccessTokenRequest(authorizationEndpointResponse.getCode(), "password").getAccessToken();
+        return getBearerToken(oAuthClient, null);
+    }
+
+    protected String getBearerToken(OAuthClient oAuthClient, ClientRepresentation client) {
+        return getBearerToken(oAuthClient, client, null);
+    }
+
+    protected String getBearerToken(OAuthClient oAuthClient, ClientRepresentation client, String credentialScopeName) {
+        if (client != null) {
+            oAuthClient.client(client.getClientId(), client.getSecret());
+        }
+        if (credentialScopeName != null) {
+            oAuthClient.scope(credentialScopeName);
+        }
+        AuthorizationEndpointResponse authorizationEndpointResponse = oAuthClient.doLogin("john",
+                "password");
+        return oAuthClient.doAccessTokenRequest(authorizationEndpointResponse.getCode()).getAccessToken();
     }
 
     private ClientResource findClientByClientId(RealmResource realm, String clientId) {
@@ -120,47 +238,88 @@ private ClientResource findClientByClientId(RealmResource realm, String clientId
         return null;
     }
 
-    private String registerOptionalClientScope(String scopeName) {
+    private ClientScopeRepresentation registerOptionalClientScope(String scopeName,
+                                                                  String issuerDid,
+                                                                  String credentialConfigurationId,
+                                                                  String credentialIdentifier,
+                                                                  String vct,
+                                                                  String format,
+                                                                  String protocolMapperReferenceFile) {
+        // Check if the client scope already exists
+        List<ClientScopeRepresentation> existingScopes = testRealm().clientScopes().findAll();
+        for (ClientScopeRepresentation existingScope : existingScopes) {
+            if (existingScope.getName().equals(scopeName)) {
+                return existingScope; // Reuse existing scope
+            }
+        }
+
+        // Create a new ClientScope if not found
         ClientScopeRepresentation clientScope = new ClientScopeRepresentation();
         clientScope.setName(scopeName);
-        clientScope.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        clientScope.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
+        Map<String, String> attributes =
+                new HashMap<>(Map.of(ClientScopeModel.INCLUDE_IN_TOKEN_SCOPE, "true",
+                        CredentialScopeModel.EXPIRY_IN_SECONDS, "15"));
+        BiConsumer<String, String> addAttribute = (attributeName, value) -> {
+            if (value != null) {
+                attributes.put(attributeName, value);
+            }
+        };
+        addAttribute.accept(CredentialScopeModel.ISSUER_DID, issuerDid);
+        addAttribute.accept(CredentialScopeModel.CONFIGURATION_ID, credentialConfigurationId);
+        addAttribute.accept(CredentialScopeModel.CREDENTIAL_IDENTIFIER, credentialIdentifier);
+        addAttribute.accept(CredentialScopeModel.FORMAT, format);
+        addAttribute.accept(CredentialScopeModel.VCT, Optional.ofNullable(vct).orElse(credentialIdentifier));
+        if (credentialConfigurationId != null) {
+            String vcDisplay;
+            try {
+                vcDisplay = JsonSerialization.writeValueAsString(List.of(new DisplayObject().setName(credentialConfigurationId)
+                                .setLocale("en-EN"),
+                        new DisplayObject().setName(credentialConfigurationId)
+                                .setLocale("de-DE")));
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+            addAttribute.accept(CredentialScopeModel.VC_DISPLAY, vcDisplay);
+        }
+        clientScope.setAttributes(attributes);
+
         Response res = testRealm().clientScopes().create(clientScope);
         String scopeId = ApiUtil.getCreatedId(res);
-        getCleanup().addClientScopeId(scopeId); // automatically removed when a test method is finished.
+        getCleanup().addClientScopeId(scopeId); // Automatically removed when a test method is finished.
         res.close();
-        return scopeId;
-    }
 
-    private void assignOptionalClientScopeToClient(String scopeId, String clientId) {
-        ClientResource clientResource = findClientByClientId(testRealm(), clientId);
-        clientResource.addOptionalClientScope(scopeId);
-    }
+        clientScope.setId(scopeId);
 
-    private void addCredentialConfigurationIdToClient(String clientId, String credentialConfigurationId, String format, String scope) {
-        ClientRepresentation clientRepresentation = adminClient.realm(TEST_REALM_NAME).clients().findByClientId(clientId).get(0);
-        ClientResource clientResource = adminClient.realm(TEST_REALM_NAME).clients().get(clientRepresentation.getId());
-
-        clientRepresentation.setAttributes(Map.of(
-                "vc." + credentialConfigurationId + ".format", format,
-                "vc." + credentialConfigurationId + ".scope", scope));
-        clientRepresentation.setProtocolMappers(
-                List.of(
-                        getRoleMapper(clientId, "VerifiableCredential"),
-                        getUserAttributeMapper("email", "email", "VerifiableCredential"),
-                        getIdMapper("VerifiableCredential"),
-                        getStaticClaimMapper(scope, "VerifiableCredential"),
-                        getStaticClaimMapper("AnotherCredentialType", "VerifiableCredential")
-                )
-        );
+        // Add protocol mappers to the ClientScope
+        List<ProtocolMapperRepresentation> protocolMappers;
+        if (protocolMapperReferenceFile == null) {
+            protocolMappers = getProtocolMappers(scopeName);
+            addProtocolMappersToClientScope(clientScope, protocolMappers);
+        } else {
+            protocolMappers = resolveProtocolMappers(protocolMapperReferenceFile);
+            protocolMappers.add(getStaticClaimMapper(scopeName));
+            addProtocolMappersToClientScope(clientScope, protocolMappers);
+        }
+        clientScope.setProtocolMappers(protocolMappers);
+        return clientScope;
+    }
 
-        clientResource.update(clientRepresentation);
+    private List<ProtocolMapperRepresentation> resolveProtocolMappers(String protocolMapperReferenceFile) {
+        if (protocolMapperReferenceFile == null) {
+            return null;
+        }
+        try (InputStream inputStream = getClass().getResourceAsStream(protocolMapperReferenceFile)) {
+            return JsonSerialization.mapper.readValue(inputStream,
+                    ClientScopeRepresentation.class).getProtocolMappers();
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
     }
 
-    private void removeCredentialConfigurationIdToClient(String clientId) {
-        ClientRepresentation clientRepresentation = adminClient.realm(TEST_REALM_NAME).clients().findByClientId(clientId).get(0);
-        ClientResource clientResource = adminClient.realm(TEST_REALM_NAME).clients().get(clientRepresentation.getId());
-        clientRepresentation.setAttributes(Map.of());
-        clientResource.update(clientRepresentation);
+    private void assignOptionalClientScopeToClient(String scopeId, String clientId) {
+        ClientResource clientResource = findClientByClientId(testRealm(), clientId);
+        clientResource.addOptionalClientScope(scopeId);
     }
 
     private void logoutUser(String clientId, String username) {
@@ -168,34 +327,15 @@ private void logoutUser(String clientId, String username) {
         user.logout();
     }
 
-    private void testCredentialIssuanceWithAuthZCodeFlow(Consumer<Map<String, String>> c) throws Exception {
-        // use pre-registered client for this test class whose clientId is "test-app" defined in testrealm.json
-        String testClientId = "test-app";
-
-        // use supported values by Credential Issuer Metadata
-        String testCredentialConfigurationId = "test-credential";
-        String testScope = "VerifiableCredential";
-        String testFormat = Format.JWT_VC;
-
-        // register optional client scope
-        String scopeId = registerOptionalClientScope(testScope);
-
-        // assign registered optional client scope
-        assignOptionalClientScopeToClient(scopeId, testClientId); // pre-registered client for this test class
+    void setClientOid4vciEnabled(String clientId, boolean enabled) {
+        ClientRepresentation clientRepresentation = adminClient.realm(TEST_REALM_NAME).clients().findByClientId(clientId).get(0);
+        ClientResource clientResource = adminClient.realm(TEST_REALM_NAME).clients().get(clientRepresentation.getId());
 
-        // add credential configuration id to a client as client attributes
-        addCredentialConfigurationIdToClient(testClientId, testCredentialConfigurationId, testFormat, testScope);
+        Map<String, String> attributes = new HashMap<>(clientRepresentation.getAttributes() != null ? clientRepresentation.getAttributes() : Map.of());
+        attributes.put("oid4vci.enabled", String.valueOf(enabled));
+        clientRepresentation.setAttributes(attributes);
 
-        c.accept(Map.of(
-                "clientId", testClientId,
-                "credentialConfigurationId", testCredentialConfigurationId,
-                "scope", testScope,
-                "format", testFormat)
-        );
-        // clean-up
-        logoutUser(testClientId, "john");
-        removeCredentialConfigurationIdToClient(testClientId);
-        oauth.clientId(null);
+        clientResource.update(clientRepresentation);
     }
 
     // Tests the AuthZCode complete flow without scope from
@@ -203,130 +343,109 @@ private void testCredentialIssuanceWithAuthZCodeFlow(Consumer<Map<String, String
     // 2. Using the code to get access token
     // 3. Get the credential configuration id from issuer metadata at .wellKnown
     // 4. With the access token, get the credential
-    protected void testCredentialIssuanceWithAuthZCodeFlow(BiFunction<String, String, String> f, Consumer<Map<String, Object>> c) throws Exception {
-        testCredentialIssuanceWithAuthZCodeFlow(m -> {
-            String testClientId = m.get("clientId");
-            String testScope = m.get("scope");
-            String testFormat = m.get("format");
-            String testCredentialConfigurationId = m.get("credentialConfigurationId");
-
-            try (Client client = AdminClientUtil.createResteasyClient()) {
-                UriBuilder builder = UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT);
-                URI oid4vciDiscoveryUri = RealmsResource.wellKnownProviderUrl(builder).build(TEST_REALM_NAME, OID4VCIssuerWellKnownProviderFactory.PROVIDER_ID);
-                WebTarget oid4vciDiscoveryTarget = client.target(oid4vciDiscoveryUri);
-
-                // 1. Get authoriZation code without scope specified by wallet
-                // 2. Using the code to get accesstoken
-                String token = f.apply(testClientId, testScope);
-
-                // 3. Get the credential configuration id from issuer metadata at .wellKnown
-                try (Response discoveryResponse = oid4vciDiscoveryTarget.request().get()) {
-                    CredentialIssuer oid4vciIssuerConfig = JsonSerialization.readValue(discoveryResponse.readEntity(String.class), CredentialIssuer.class);
-                    assertEquals(200, discoveryResponse.getStatus());
-                    assertEquals(getRealmPath(TEST_REALM_NAME), oid4vciIssuerConfig.getCredentialIssuer());
-                    assertEquals(getBasePath(TEST_REALM_NAME) + "credential", oid4vciIssuerConfig.getCredentialEndpoint());
-
-                    // 4. With the access token, get the credential
-                    try (Client clientForCredentialRequest = AdminClientUtil.createResteasyClient()) {
-                        UriBuilder credentialUriBuilder = UriBuilder.fromUri(oid4vciIssuerConfig.getCredentialEndpoint());
-                        URI credentialUri = credentialUriBuilder.build();
-                        WebTarget credentialTarget = clientForCredentialRequest.target(credentialUri);
-
-                        CredentialRequest request = new CredentialRequest();
-                        request.setFormat(oid4vciIssuerConfig.getCredentialsSupported().get(testCredentialConfigurationId).getFormat());
-                        request.setCredentialIdentifier(oid4vciIssuerConfig.getCredentialsSupported().get(testCredentialConfigurationId).getId());
-
-                        assertEquals(testFormat, oid4vciIssuerConfig.getCredentialsSupported().get(testCredentialConfigurationId).getFormat().toString());
-                        assertEquals(testCredentialConfigurationId, oid4vciIssuerConfig.getCredentialsSupported().get(testCredentialConfigurationId).getId());
-
-                        c.accept(Map.of(
-                                "accessToken", token,
-                                "credentialTarget", credentialTarget,
-                                "credentialRequest", request
-                        ));
-                    }
+    protected void testCredentialIssuanceWithAuthZCodeFlow(ClientScopeRepresentation clientScope,
+                                                           BiFunction<String, String, String> f,
+                                                           Consumer<Map<String, Object>> c) {
+        String testClientId = client.getClientId();
+        String testScope = clientScope.getName();
+        String testFormat = clientScope.getAttributes().get(CredentialScopeModel.FORMAT);
+        String testCredentialConfigurationId = clientScope.getAttributes().get(CredentialScopeModel.CONFIGURATION_ID);
+
+        try (Client client = AdminClientUtil.createResteasyClient()) {
+            UriBuilder builder = UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT);
+            URI oid4vciDiscoveryUri = RealmsResource.wellKnownProviderUrl(builder)
+                    .build(TEST_REALM_NAME,
+                            OID4VCIssuerWellKnownProviderFactory.PROVIDER_ID);
+            WebTarget oid4vciDiscoveryTarget = client.target(oid4vciDiscoveryUri);
+
+            // 1. Get authoriZation code without scope specified by wallet
+            // 2. Using the code to get accesstoken
+            String token = f.apply(testClientId, testScope);
+
+            // 3. Get the credential configuration id from issuer metadata at .wellKnown
+            try (Response discoveryResponse = oid4vciDiscoveryTarget.request().get()) {
+                CredentialIssuer oid4vciIssuerConfig = JsonSerialization.readValue(discoveryResponse.readEntity(String.class),
+                        CredentialIssuer.class);
+                assertEquals(200, discoveryResponse.getStatus());
+                assertEquals(getRealmPath(TEST_REALM_NAME), oid4vciIssuerConfig.getCredentialIssuer());
+                assertEquals(getBasePath(TEST_REALM_NAME) + "credential", oid4vciIssuerConfig.getCredentialEndpoint());
+
+                // 4. With the access token, get the credential
+                try (Client clientForCredentialRequest = AdminClientUtil.createResteasyClient()) {
+                    UriBuilder credentialUriBuilder = UriBuilder.fromUri(oid4vciIssuerConfig.getCredentialEndpoint());
+                    URI credentialUri = credentialUriBuilder.build();
+                    WebTarget credentialTarget = clientForCredentialRequest.target(credentialUri);
+
+                    CredentialRequest request = new CredentialRequest();
+                    request.setCredentialConfigurationId(oid4vciIssuerConfig.getCredentialsSupported()
+                            .get(testCredentialConfigurationId)
+                            .getId());
+
+                    assertEquals(testFormat,
+                            oid4vciIssuerConfig.getCredentialsSupported()
+                                    .get(testCredentialConfigurationId)
+                                    .getFormat());
+                    assertEquals(testCredentialConfigurationId,
+                            oid4vciIssuerConfig.getCredentialsSupported()
+                                    .get(testCredentialConfigurationId)
+                                    .getId());
+
+                    c.accept(Map.of(
+                            "accessToken", token,
+                            "credentialTarget", credentialTarget,
+                            "credentialRequest", request
+                    ));
                 }
-            } catch (IOException e) {
-                Assert.fail();
             }
-
-        });
-    }
-
-    protected static String prepareSessionCode(KeycloakSession session, AppAuthManager.BearerTokenAuthenticator authenticator, String note) {
-        AuthenticationManager.AuthResult authResult = authenticator.authenticate();
-        UserSessionModel userSessionModel = authResult.getSession();
-        AuthenticatedClientSessionModel authenticatedClientSessionModel = userSessionModel.getAuthenticatedClientSessionByClient(authResult.getClient().getId());
-        String codeId = SecretGenerator.getInstance().randomString();
-        String nonce = SecretGenerator.getInstance().randomString();
-        OAuth2Code oAuth2Code = new OAuth2Code(codeId, Time.currentTime() + 6000, nonce, CREDENTIAL_OFFER_URI_CODE_SCOPE, null, null, null, null,
-                authenticatedClientSessionModel.getUserSession().getId());
-
-        String oauthCode = OAuth2CodeParser.persistCode(session, authenticatedClientSessionModel, oAuth2Code);
-
-        authenticatedClientSessionModel.setNote(oauthCode, note);
-        return oauthCode;
-    }
-
-    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(KeycloakSession session, AppAuthManager.BearerTokenAuthenticator authenticator) {
-        JwtCredentialBuilder jwtCredentialBuilder = new JwtCredentialBuilder(
-                TEST_DID.toString(),
-                new StaticTimeProvider(1000));
-
-        JwtSigningService jwtSigningService = new JwtSigningService(
-                session,
-                getKeyFromSession(session).getKid(),
-                Algorithm.RS256);
-
-        return prepareIssuerEndpoint(
-                session,
-                authenticator,
-                Map.of(jwtCredentialBuilder.getSupportedFormat(), jwtCredentialBuilder),
-                Map.of(jwtSigningService.locator(), jwtSigningService)
-        );
-    }
-
-    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(
-            KeycloakSession session,
-            AppAuthManager.BearerTokenAuthenticator authenticator,
-            Map<String, CredentialBuilder> credentialBuilders,
-            Map<String, VerifiableCredentialsSigningService> signingServices
-    ) {
-        return new OID4VCIssuerEndpoint(
-                session,
-                credentialBuilders,
-                signingServices,
-                authenticator,
-                TIME_PROVIDER,
-                30,
-                true);
+        } catch (IOException e) {
+            Assert.fail();
+        }
     }
 
     protected String getBasePath(String realm) {
         return getRealmPath(realm) + "/protocol/oid4vc/";
     }
 
-    private String getRealmPath(String realm) {
+    protected String getRealmPath(String realm) {
         return suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/" + realm;
     }
 
-    protected void requestOffer(String token, String credentialEndpoint, SupportedCredentialConfiguration offeredCredential, CredentialResponseHandler responseHandler) throws IOException, VerificationException {
+    protected void requestCredential(String token,
+                                     String credentialEndpoint,
+                                     SupportedCredentialConfiguration offeredCredential,
+                                     CredentialResponseHandler responseHandler,
+                                     ClientScopeRepresentation expectedClientScope) throws IOException, VerificationException {
         CredentialRequest request = new CredentialRequest();
-        request.setFormat(offeredCredential.getFormat());
-        request.setCredentialIdentifier(offeredCredential.getId());
+        request.setCredentialConfigurationId(offeredCredential.getId());
 
-        StringEntity stringEntity = new StringEntity(JsonSerialization.writeValueAsString(request), ContentType.APPLICATION_JSON);
+        StringEntity stringEntity = new StringEntity(JsonSerialization.writeValueAsString(request),
+                ContentType.APPLICATION_JSON);
 
         HttpPost postCredential = new HttpPost(credentialEndpoint);
         postCredential.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token);
         postCredential.setEntity(stringEntity);
-        CloseableHttpResponse credentialRequestResponse = httpClient.execute(postCredential);
-        assertEquals(HttpStatus.SC_OK, credentialRequestResponse.getStatusLine().getStatusCode());
-        String s = IOUtils.toString(credentialRequestResponse.getEntity().getContent(), StandardCharsets.UTF_8);
-        CredentialResponse credentialResponse = JsonSerialization.readValue(s, CredentialResponse.class);
+
+        CredentialResponse credentialResponse;
+        try (CloseableHttpResponse credentialRequestResponse = httpClient.execute(postCredential)) {
+            assertEquals(HttpStatus.SC_OK, credentialRequestResponse.getStatusLine().getStatusCode());
+            String s = IOUtils.toString(credentialRequestResponse.getEntity().getContent(), StandardCharsets.UTF_8);
+            credentialResponse = JsonSerialization.readValue(s, CredentialResponse.class);
+        }
 
         // Use response handler to customize checks based on formats.
-        responseHandler.handleCredentialResponse(credentialResponse);
+        responseHandler.handleCredentialResponse(credentialResponse, expectedClientScope);
+    }
+
+    public CredentialIssuer getCredentialIssuerMetadata() {
+        final String endpoint = getRealmPath(TEST_REALM_NAME) + "/.well-known/openid-credential-issuer";
+        HttpGet getMetadataRequest = new HttpGet(endpoint);
+        try (CloseableHttpResponse metadataResponse = httpClient.execute(getMetadataRequest)) {
+            assertEquals(HttpStatus.SC_OK, metadataResponse.getStatusLine().getStatusCode());
+            String s = IOUtils.toString(metadataResponse.getEntity().getContent(), StandardCharsets.UTF_8);
+            return JsonSerialization.readValue(s, CredentialIssuer.class);
+        } catch (Exception ex) {
+            throw new RuntimeException(ex);
+        }
     }
 
     @Override
@@ -336,34 +455,35 @@ public void configureTestRealm(RealmRepresentation testRealm) {
         }
 
         testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getKeyProvider());
-        testRealm.getComponents().addAll("org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService", getSigningProviders());
-        testRealm.getComponents().addAll("org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder", getCredentialBuilderProviders());
 
-        ClientRepresentation clientRepresentation = getTestClient("did:web:test.org");
-        if (testRealm.getClients() != null) {
-            testRealm.getClients().add(clientRepresentation);
-        } else {
-            testRealm.setClients(List.of(clientRepresentation));
-        }
+        // Find existing client representation
+        ClientRepresentation existingClient = testRealm.getClients().stream()
+                .filter(client -> client.getClientId().equals(clientId))
+                .findFirst()
+                .orElseThrow(() -> new IllegalStateException("Client with ID " + clientId + " not found in realm"));
+
+        // Add role to existing client
         if (testRealm.getRoles() != null) {
-            testRealm.getRoles().getClient()
-                    .put(clientRepresentation.getClientId(), List.of(getRoleRepresentation("testRole", clientRepresentation.getClientId())));
+            Map<String, List<RoleRepresentation>> clientRoles = testRealm.getRoles().getClient();
+            clientRoles.merge(
+                    existingClient.getClientId(),
+                    List.of(getRoleRepresentation("testRole", existingClient.getClientId())),
+                    (existingRoles, newRoles) -> {
+                        List<RoleRepresentation> mergedRoles = new ArrayList<>(existingRoles);
+                        mergedRoles.addAll(newRoles);
+                        return mergedRoles;
+                    }
+            );
         } else {
             testRealm.getRoles()
-                    .setClient(Map.of(clientRepresentation.getClientId(), List.of(getRoleRepresentation("testRole", clientRepresentation.getClientId()))));
-        }
-        if (testRealm.getUsers() != null) {
-            testRealm.getUsers().add(getUserRepresentation(Map.of(clientRepresentation.getClientId(), List.of("testRole"))));
-        } else {
-            testRealm.setUsers(List.of(getUserRepresentation(Map.of(clientRepresentation.getClientId(), List.of("testRole")))));
+                    .setClient(Map.of(existingClient.getClientId(),
+                            List.of(getRoleRepresentation("testRole", existingClient.getClientId()))));
         }
 
-        if (testRealm.getAttributes() == null) {
-            testRealm.setAttributes(new HashMap<>());
-        }
-
-        testRealm.getAttributes().put("issuerDid", TEST_DID.toString());
-        testRealm.getAttributes().putAll(getCredentialDefinitionAttributes());
+        List<UserRepresentation> realmUsers = Optional.ofNullable(testRealm.getUsers()).map(ArrayList::new)
+                .orElse(new ArrayList<>());
+        realmUsers.add(getUserRepresentation(Map.of(existingClient.getClientId(), List.of("testRole"))));
+        testRealm.setUsers(realmUsers);
     }
 
     protected void withCausePropagation(Runnable r) throws Throwable {
@@ -381,29 +501,31 @@ protected ComponentExportRepresentation getKeyProvider() {
         return getRsaKeyProvider(RSA_KEY);
     }
 
-    protected List<ComponentExportRepresentation> getSigningProviders() {
-        return List.of(getJwtSigningProvider(RSA_KEY));
-    }
-
-    protected List<ComponentExportRepresentation> getCredentialBuilderProviders() {
-        return List.of(getCredentialBuilderProvider(Format.JWT_VC));
-    }
+    protected static class CredentialResponseHandler {
+        protected void handleCredentialResponse(CredentialResponse credentialResponse,
+                                                ClientScopeRepresentation clientScope) throws VerificationException {
+            assertNotNull("The credentials array should be present in the response.", credentialResponse.getCredentials());
+            assertFalse("The credentials array should not be empty.", credentialResponse.getCredentials().isEmpty());
 
-    protected Map<String, String> getCredentialDefinitionAttributes() {
-        return getTestCredentialDefinitionAttributes();
-    }
+            // Get the first credential from the array (maintaining compatibility with single credential tests)
+            CredentialResponse.Credential credentialObj = credentialResponse.getCredentials().get(0);
+            assertNotNull("The first credential in the array should not be null.", credentialObj);
 
-    protected static class CredentialResponseHandler {
-        protected void handleCredentialResponse(CredentialResponse credentialResponse) throws VerificationException {
-            assertNotNull("The credential should have been responded.", credentialResponse.getCredential());
-            JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponse.getCredential(), JsonWebToken.class).getToken();
+            JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialObj.getCredential(),
+                    JsonWebToken.class).getToken();
             assertEquals("did:web:test.org", jsonWebToken.getIssuer());
-            VerifiableCredential credential = JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims().get("vc"), VerifiableCredential.class);
-            assertEquals(List.of("VerifiableCredential"), credential.getType());
+            VerifiableCredential credential = JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims().get(
+                    "vc"), VerifiableCredential.class);
+            assertEquals(List.of(clientScope.getName()), credential.getType());
             assertEquals(URI.create("did:web:test.org"), credential.getIssuer());
             assertEquals("john@email.cz", credential.getCredentialSubject().getClaims().get("email"));
-            assertTrue("The static claim should be set.", credential.getCredentialSubject().getClaims().containsKey("VerifiableCredential"));
-            assertFalse("Only mappers supported for the requested type should have been evaluated.", credential.getCredentialSubject().getClaims().containsKey("AnotherCredentialType"));
+            assertTrue("The static claim should be set.",
+                    credential.getCredentialSubject().getClaims().containsKey("scope-name"));
+            assertEquals("The static claim should be set.",
+                    clientScope.getName(),
+                    credential.getCredentialSubject().getClaims().get("scope-name"));
+            assertFalse("Only mappers supported for the requested type should have been evaluated.",
+                    credential.getCredentialSubject().getClaims().containsKey("AnotherCredentialType"));
         }
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerWellKnownProviderTest.java
index b1d0453d54b5..bcc4c1f10c62 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerWellKnownProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCIssuerWellKnownProviderTest.java
@@ -17,150 +17,328 @@
 
 package org.keycloak.testsuite.oid4vc.issuance.signing;
 
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.Assert;
 import org.junit.Test;
-import org.junit.experimental.runners.Enclosed;
-import org.junit.runner.RunWith;
 import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.oid4vci.Oid4vcProtocolMapperModel;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.protocol.ProtocolMapper;
+import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCMapper;
+import org.keycloak.protocol.oid4vc.model.Claim;
+import org.keycloak.protocol.oid4vc.model.ClaimDisplay;
+import org.keycloak.protocol.oid4vc.model.Claims;
 import org.keycloak.protocol.oid4vc.model.CredentialIssuer;
+import org.keycloak.protocol.oid4vc.model.DisplayObject;
 import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.ProofTypesSupported;
+import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.arquillian.SuiteContext;
 import org.keycloak.testsuite.client.KeycloakTestingClient;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.utils.StringUtil;
 
+import java.io.Serializable;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.keycloak.testsuite.AbstractTestRealmKeycloakTest.TEST_REALM_NAME;
-import static org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCTest.RSA_KEY;
-import static org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCTest.TEST_DID;
-import static org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCTest.getJwtSigningProvider;
-import static org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCTest.getRsaKeyProvider;
-
-@RunWith(Enclosed.class)
-public class OID4VCIssuerWellKnownProviderTest {
-
-    public static class TestAttributesOverride extends OID4VCTest {
-        @Test
-        public void testRealmAttributesOverrideClientAttributes() {
-            OID4VCIssuerWellKnownProviderTest
-                    .testCredentialConfig(suiteContext, testingClient);
-        }
+public class OID4VCIssuerWellKnownProviderTest extends OID4VCIssuerEndpointTest {
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        Map<String, String> attributes = Optional.ofNullable(testRealm.getAttributes()).orElseGet(HashMap::new);
+        attributes.put("credential_response_encryption.alg_values_supported", "[\"RSA-OAEP\"]");
+        attributes.put("credential_response_encryption.enc_values_supported", "[\"A256GCM\"]");
+        attributes.put("credential_response_encryption.encryption_required", "true");
+        attributes.put("batch_credential_issuance.batch_size", "10");
+        attributes.put("signed_metadata", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIifQ.XYZ123abc");
+        testRealm.setAttributes(attributes);
+        super.configureTestRealm(testRealm);
+    }
+
+    /**
+     * this test will use the configured scopes {@link #jwtTypeCredentialClientScope} and
+     * {@link #sdJwtTypeCredentialClientScope} to verify that the metadata endpoint is presenting the expected data
+     */
+    @Test
+    public void testMetaDataEndpointIsCorrectlySetup() {
+        CredentialIssuer credentialIssuer = getCredentialIssuerMetadata();
+
+        Assert.assertEquals(getRealmPath(TEST_REALM_NAME), credentialIssuer.getCredentialIssuer());
+        Assert.assertEquals(getBasePath(TEST_REALM_NAME) + OID4VCIssuerEndpoint.CREDENTIAL_PATH,
+                            credentialIssuer.getCredentialEndpoint());
+        Assert.assertNull("Display was not configured", credentialIssuer.getDisplay());
+        Assert.assertEquals("Authorization Server should have the realm-address.",
+                            1,
+                            credentialIssuer.getAuthorizationServers().size());
+        Assert.assertEquals("Authorization Server should point to the realm-address.",
+                            getRealmPath(TEST_REALM_NAME),
+                            credentialIssuer.getAuthorizationServers().get(0));
+
+        // Check credential_response_encryption
+        CredentialIssuer.CredentialResponseEncryption encryption = credentialIssuer.getCredentialResponseEncryption();
+        Assert.assertNotNull("credential_response_encryption should be present", encryption);
+        Assert.assertEquals(List.of("RSA-OAEP"), encryption.getAlgValuesSupported());
+        Assert.assertEquals(List.of("A256GCM"), encryption.getEncValuesSupported());
+        Assert.assertTrue("encryption_required should be true", encryption.getEncryptionRequired());
+
+        // Check batch_credential_issuance
+        CredentialIssuer.BatchCredentialIssuance batch = credentialIssuer.getBatchCredentialIssuance();
+        Assert.assertNotNull("batch_credential_issuance should be present", batch);
+        Assert.assertEquals(Integer.valueOf(10), batch.getBatchSize());
+
+        // Check signed_metadata
+        Assert.assertEquals(
+                "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIifQ.XYZ123abc",
+                credentialIssuer.getSignedMetadata()
+        );
 
-        @Override
-        public void configureTestRealm(RealmRepresentation testRealm) {
-            ClientRepresentation testClient = getTestClient("did:web:test.org");
-            Map<String, String> clientAttributes = new HashMap<>(getTestCredentialDefinitionAttributes());
-            Map<String, String> realmAttributes = new HashMap<>();
-            // We'll change the client attributes and put the correct value in the realm
-            // attributes and expect the test to work.
-            clientAttributes.put("vc.test-credential.expiry_in_s", "20");
-            realmAttributes.put("vc.test-credential.expiry_in_s", "100");
-            OID4VCIssuerWellKnownProviderTest
-                    .configureTestRealm(testClient, testRealm, clientAttributes, realmAttributes);
+        for (ClientScopeRepresentation clientScope : List.of(jwtTypeCredentialClientScope,
+                                                             sdJwtTypeCredentialClientScope,
+                                                             minimalJwtTypeCredentialClientScope)) {
+            compareMetadataToClientScope(credentialIssuer, clientScope);
         }
+    }
+
+    /**
+     * this test will make sure that the default values are correctly added into the metadata endpoint
+     */
+    @Test
+    public void testMinimalJwtCredentialHardcodedTest()
+    {
+        ClientScopeRepresentation clientScope = minimalJwtTypeCredentialClientScope;
+        CredentialIssuer credentialIssuer = getCredentialIssuerMetadata();
+        SupportedCredentialConfiguration supportedConfig = credentialIssuer.getCredentialsSupported()
+                                                                           .get(clientScope.getName());
+        Assert.assertNotNull(supportedConfig);
+        Assert.assertEquals(Format.SD_JWT_VC, supportedConfig.getFormat());
+        Assert.assertEquals(clientScope.getName(), supportedConfig.getScope());
+        Assert.assertEquals(1, supportedConfig.getCredentialDefinition().getType().size());
+        Assert.assertEquals(clientScope.getName(), supportedConfig.getCredentialDefinition().getType().get(0));
+        Assert.assertEquals(1, supportedConfig.getCredentialDefinition().getContext().size());
+        Assert.assertEquals(clientScope.getName(), supportedConfig.getCredentialDefinition().getContext().get(0));
+        Assert.assertNull(supportedConfig.getDisplay());
+        Assert.assertEquals(clientScope.getName(), supportedConfig.getScope());
 
+        compareClaims(supportedConfig.getFormat(), supportedConfig.getClaims(), clientScope.getProtocolMappers());
     }
 
-    public static class TestCredentialDefinitionInClientAttributes extends OID4VCTest {
+    private void compareMetadataToClientScope(CredentialIssuer credentialIssuer, ClientScopeRepresentation clientScope) {
+        String credentialConfigurationId = Optional.ofNullable(clientScope.getAttributes()
+                                                                          .get(CredentialScopeModel.CONFIGURATION_ID))
+                                                   .orElse(clientScope.getName());
+        SupportedCredentialConfiguration supportedConfig = credentialIssuer.getCredentialsSupported()
+                                                                           .get(credentialConfigurationId);
+        Assert.assertNotNull("Configuration of type '" + credentialConfigurationId + "' must be present",
+                             supportedConfig);
+        Assert.assertEquals(credentialConfigurationId, supportedConfig.getId());
+
+        String expectedFormat = Optional.ofNullable(clientScope.getAttributes().get(CredentialScopeModel.FORMAT))
+                                        .orElse(Format.SD_JWT_VC);
+        Assert.assertEquals(expectedFormat, supportedConfig.getFormat());
+
+        Assert.assertEquals(clientScope.getName(), supportedConfig.getScope());
+        {
+            // TODO this is still hardcoded
+            Assert.assertEquals(1, supportedConfig.getCryptographicBindingMethodsSupported().size());
+            Assert.assertEquals(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT,
+                                supportedConfig.getCryptographicBindingMethodsSupported().get(0));
+        }
+
+        compareDisplay(supportedConfig, clientScope);
+
+        String expectedVct = Optional.ofNullable(clientScope.getAttributes().get(CredentialScopeModel.VCT))
+                                     .orElse(clientScope.getName());
+        Assert.assertEquals(expectedVct, supportedConfig.getVct());
 
-        @Test
-        public void testCredentialConfig() {
-            OID4VCIssuerWellKnownProviderTest
-                    .testCredentialConfig(suiteContext, testingClient);
+        Assert.assertNotNull(supportedConfig.getCredentialDefinition());
+        Assert.assertNotNull(supportedConfig.getCredentialDefinition().getType());
+        List<String> credentialDefinitionTypes = Optional.ofNullable(clientScope.getAttributes()
+                                                                                .get(CredentialScopeModel.TYPES))
+                                                         .map(s -> s.split(","))
+                                                         .map(Arrays::asList)
+                                                         .orElseGet(() -> List.of(clientScope.getName()));
+        Assert.assertEquals(credentialDefinitionTypes.size(),
+                            supportedConfig.getCredentialDefinition().getType().size());
+
+        MatcherAssert.assertThat(supportedConfig.getCredentialDefinition().getContext(),
+                                 Matchers.containsInAnyOrder(credentialDefinitionTypes.toArray()));
+        List<String> credentialDefinitionContexts = Optional.ofNullable(clientScope.getAttributes()
+                                                                                   .get(CredentialScopeModel.CONTEXTS))
+                                                            .map(s -> s.split(","))
+                                                            .map(Arrays::asList)
+                                                            .orElseGet(() -> List.of(clientScope.getName()));
+        Assert.assertEquals(credentialDefinitionContexts.size(),
+                            supportedConfig.getCredentialDefinition().getContext().size());
+        MatcherAssert.assertThat(supportedConfig.getCredentialDefinition().getContext(),
+                                 Matchers.containsInAnyOrder(credentialDefinitionTypes.toArray()));
+
+        List<String> signingAlgsSupported = new ArrayList<>(supportedConfig.getCredentialSigningAlgValuesSupported());
+        String proofTypesSupportedString = supportedConfig.getProofTypesSupported().toJsonString();
+
+        try {
+            withCausePropagation(() -> testingClient.server(TEST_REALM_NAME).run((session -> {
+                ProofTypesSupported expectedProofTypesSupported = ProofTypesSupported.parse(session,
+                                                                                            List.of(Algorithm.RS256));
+                Assert.assertEquals(expectedProofTypesSupported,
+                                    ProofTypesSupported.fromJsonString(proofTypesSupportedString));
+
+                List<String> expectedSigningAlgs = OID4VCIssuerWellKnownProvider.getSupportedSignatureAlgorithms(session);
+                MatcherAssert.assertThat(signingAlgsSupported,
+                                         Matchers.containsInAnyOrder(expectedSigningAlgs.toArray()));
+
+            })));
+        } catch (Throwable e) {
+            throw new RuntimeException(e);
         }
 
-        @Override
-        public void configureTestRealm(RealmRepresentation testRealm) {
-            Map<String, String> clientAttributes = new HashMap<>(getTestCredentialDefinitionAttributes());
-            Map<String, String> realmAttributes = new HashMap<>();
-            OID4VCIssuerWellKnownProviderTest
-                    .configureTestRealm(
-                            getTestClient("did:web:test.org"),
-                            testRealm,
-                            clientAttributes,
-                            realmAttributes
-                    );
+        compareClaims(expectedFormat, supportedConfig.getClaims(), clientScope.getProtocolMappers());
+    }
+
+    private void compareDisplay(SupportedCredentialConfiguration supportedConfig, ClientScopeRepresentation clientScope) {
+        String display = clientScope.getAttributes().get(CredentialScopeModel.VC_DISPLAY);
+        if (StringUtil.isBlank(display)) {
+            Assert.assertNull(supportedConfig.getDisplay());
+            return;
+        }
+        List<DisplayObject> expectedDisplayObjectList;
+        try {
+            expectedDisplayObjectList = JsonSerialization.mapper.readValue(display, new TypeReference<>() {
+            });
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
         }
+
+        Assert.assertEquals(expectedDisplayObjectList.size(), supportedConfig.getDisplay().size());
+        MatcherAssert.assertThat("Must contain all expected display-objects",
+                                 supportedConfig.getDisplay(),
+                                 Matchers.containsInAnyOrder(expectedDisplayObjectList.toArray()));
     }
 
-    public static class TestCredentialDefinitionInRealmAttributes extends OID4VCTest {
+    /**
+     * each claim representation from the metadata is based on a protocol-mapper which we compare here
+     */
+    private void compareClaims(String credentialFormat,
+                               Claims originalClaims,
+                               List<ProtocolMapperRepresentation> originalProtocolMappers) {
+        // the data must be serializable to transfer them to the server, so we convert the data to strings
+        String claimsString = originalClaims.toJsonString();
+        String protocolMappersString = toJsonString(originalProtocolMappers);
 
-        @Test
-        public void testCredentialConfig() {
-            OID4VCIssuerWellKnownProviderTest
-                    .testCredentialConfig(suiteContext, testingClient);
-        }
+        try {
+            withCausePropagation(() -> testingClient.server(TEST_REALM_NAME).run((session -> {
+                Claims actualClaims = fromJsonString(claimsString, Claims.class);
+                List<ProtocolMapperRepresentation> protocolMappers = fromJsonString(protocolMappersString,
+                                                                                    new SerializableProtocolMapperReference());
+                // check only protocol-mappers of type oid4vc
+                protocolMappers = protocolMappers.stream().filter(protocolMapper -> {
+                    return OID4VCLoginProtocolFactory.PROTOCOL_ID.equals(protocolMapper.getProtocol());
+                }).toList();
 
-        @Override
-        public void configureTestRealm(RealmRepresentation testRealm) {
-            Map<String, String> realmAttributes = new HashMap<>(getTestCredentialDefinitionAttributes());
-            Map<String, String> clientAttributes = new HashMap<>();
-            OID4VCIssuerWellKnownProviderTest.configureTestRealm(
-                    getTestClient("did:web:test.org"),
-                    testRealm,
-                    clientAttributes,
-                    realmAttributes
-            );
+                for (ProtocolMapperRepresentation protocolMapper : protocolMappers) {
+                    OID4VCMapper mapper = (OID4VCMapper) session.getProvider(ProtocolMapper.class,
+                                                                             protocolMapper.getProtocolMapper());
+                    ProtocolMapperModel protocolMapperModel = new ProtocolMapperModel();
+                    protocolMapperModel.setConfig(protocolMapper.getConfig());
+                    mapper.setMapperModel(protocolMapperModel, credentialFormat);
+                    Claim claim = actualClaims.stream()
+                                              .filter(c -> c.getPath().equals(mapper.getMetadataAttributePath()))
+                                              .findFirst().orElse(null);
+                    if (mapper.includeInMetadata()) {
+                        Assert.assertNotNull("There should be a claim matching the protocol-mappers config!", claim);
+                    }
+                    else {
+                        Assert.assertNull("This claim should not be included in the metadata-config!", claim);
+                        // no other checks to do for this claim
+                        continue;
+                    }
+                    Assert.assertEquals(claim.isMandatory(),
+                                        Optional.ofNullable(protocolMapper.getConfig()
+                                                                          .get(Oid4vcProtocolMapperModel.MANDATORY))
+                                                .map(Boolean::parseBoolean)
+                                                .orElse(false));
+                    String expectedDisplayString = protocolMapper.getConfig().get(Oid4vcProtocolMapperModel.DISPLAY);
+                    List<ClaimDisplay> expectedDisplayList = fromJsonString(expectedDisplayString,
+                                                                            new SerializableClaimDisplayReference());
+                    List<ClaimDisplay> actualDisplayList = claim.getDisplay();
+                    if (expectedDisplayList == null) {
+                        Assert.assertNull(actualDisplayList);
+                    }
+                    else {
+                        Assert.assertEquals(expectedDisplayList.size(), actualDisplayList.size());
+                        MatcherAssert.assertThat(actualDisplayList,
+                                                 Matchers.containsInAnyOrder(expectedDisplayList.toArray()));
+                    }
+                }
+            })));
+        } catch (Throwable e) {
+            throw new RuntimeException(e);
         }
     }
 
-    public static void configureTestRealm(
-            ClientRepresentation testClient,
-            RealmRepresentation testRealm,
-            Map<String, String> clientAttributes,
-            Map<String, String> realmAttributes
-    ) {
-        testClient.setAttributes(new HashMap<>(clientAttributes));
-        testRealm.setAttributes(new HashMap<>(realmAttributes));
-        extendConfigureTestRealm(testRealm, testClient);
+    /**
+     * a jackson type-reference that can be used in the run-server-block
+     */
+    public static class SerializableProtocolMapperReference extends TypeReference<List<ProtocolMapperRepresentation>>
+            implements Serializable {
+    }
+
+    /**
+     * a jackson type-reference that can be used in the run-server-block
+     */
+    public static class SerializableClaimDisplayReference extends TypeReference<List<ClaimDisplay>>
+            implements Serializable {
     }
 
     public static void testCredentialConfig(SuiteContext suiteContext, KeycloakTestingClient testingClient) {
         String expectedIssuer = suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/" + TEST_REALM_NAME;
         String expectedCredentialsEndpoint = expectedIssuer + "/protocol/oid4vc/credential";
+        String expectedDeferredEndpoint = expectedIssuer + "/protocol/oid4vc/deferred_credential";
         final String expectedAuthorizationServer = expectedIssuer;
         testingClient
                 .server(TEST_REALM_NAME)
                 .run((session -> {
                     OID4VCIssuerWellKnownProvider oid4VCIssuerWellKnownProvider = new OID4VCIssuerWellKnownProvider(session);
                     Object issuerConfig = oid4VCIssuerWellKnownProvider.getConfig();
-                    assertTrue("Valid credential-issuer metadata should be returned.", issuerConfig instanceof CredentialIssuer);
+                    Assert.assertTrue("Valid credential-issuer metadata should be returned.", issuerConfig instanceof CredentialIssuer);
                     CredentialIssuer credentialIssuer = (CredentialIssuer) issuerConfig;
-                    assertEquals("The correct issuer should be included.", expectedIssuer, credentialIssuer.getCredentialIssuer());
-                    assertEquals("The correct credentials endpoint should be included.", expectedCredentialsEndpoint, credentialIssuer.getCredentialEndpoint());
-                    assertEquals("Since the authorization server is equal to the issuer, just 1 should be returned.", 1, credentialIssuer.getAuthorizationServers().size());
-                    assertEquals("The expected server should have been returned.", expectedAuthorizationServer, credentialIssuer.getAuthorizationServers().get(0));
-                    assertTrue("The test-credential should be supported.", credentialIssuer.getCredentialsSupported().containsKey("test-credential"));
-                    assertEquals("The test-credential should offer type VerifiableCredential", "VerifiableCredential", credentialIssuer.getCredentialsSupported().get("test-credential").getScope());
-                    assertEquals("The test-credential should be offered in the jwt-vc format.", Format.JWT_VC, credentialIssuer.getCredentialsSupported().get("test-credential").getFormat());
-                    assertNotNull("The test-credential can optionally provide a claims claim.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims());
-                    assertNotNull("The test-credential claim firstName is present.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName"));
-                    assertFalse("The test-credential claim firstName is not mandatory.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName").getMandatory());
-                    assertEquals("The test-credential claim firstName shall be displayed as First Name", "First Name", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName").getDisplay().get(0).getName());
-                    // moved sd-jwt specific config to org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCSdJwtIssuingEndpointTest.getConfig
+                    Assert.assertEquals("The correct issuer should be included.", expectedIssuer, credentialIssuer.getCredentialIssuer());
+                    Assert.assertEquals("The correct credentials endpoint should be included.", expectedCredentialsEndpoint, credentialIssuer.getCredentialEndpoint());
+                    Assert.assertEquals("The correct deferred_credential_endpoint should be included.", expectedDeferredEndpoint, credentialIssuer.getDeferredCredentialEndpoint());
+                    Assert.assertEquals("Since the authorization server is equal to the issuer, just 1 should be returned.", 1, credentialIssuer.getAuthorizationServers().size());
+                    Assert.assertEquals("The expected server should have been returned.", expectedAuthorizationServer, credentialIssuer.getAuthorizationServers().get(0));
+                    Assert.assertTrue("The test-credential should be supported.", credentialIssuer.getCredentialsSupported().containsKey("test-credential"));
+                    Assert.assertEquals("The test-credential should offer type VerifiableCredential", "VerifiableCredential", credentialIssuer.getCredentialsSupported().get("test-credential").getScope());
+                    Assert.assertEquals("The test-credential should be offered in the jwt-vc format.", Format.JWT_VC, credentialIssuer.getCredentialsSupported().get("test-credential").getFormat());
+                    Assert.assertNotNull("The test-credential can optionally provide a claims claim.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims());
                 }));
     }
 
     public static void extendConfigureTestRealm(RealmRepresentation testRealm, ClientRepresentation clientRepresentation) {
-        if (testRealm.getComponents() != null) {
-            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(RSA_KEY));
-            testRealm.getComponents().add("org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService", getJwtSigningProvider(RSA_KEY));
-        } else {
-            testRealm.setComponents(new MultivaluedHashMap<>(
-                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(RSA_KEY)),
-                            "org.keycloak.protocol.oid4vc.issuance.signing.VerifiableCredentialsSigningService", List.of(getJwtSigningProvider(RSA_KEY))
-                    ))
-            );
+        if (testRealm.getComponents() == null) {
+            testRealm.setComponents(new MultivaluedHashMap<>());
         }
 
+        testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(RSA_KEY));
+        testRealm.getComponents().add("org.keycloak.protocol.oid4vc.issuance.credentialbuilder.CredentialBuilder", getCredentialBuilderProvider(Format.JWT_VC));
+
+
         if (testRealm.getClients() != null) {
             testRealm.getClients().add(clientRepresentation);
         } else {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointDisabledTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointDisabledTest.java
new file mode 100644
index 000000000000..edf701aa26b4
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointDisabledTest.java
@@ -0,0 +1,56 @@
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.Test;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
+import org.keycloak.protocol.oid4vc.model.CredentialRequest;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.OfferUriType;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.managers.AppAuthManager;
+import org.keycloak.testsuite.Assert;
+
+import java.util.function.Consumer;
+
+import static org.junit.Assert.assertEquals;
+
+/**
+ * Tests for OID4VCIssuerEndpoint with OID4VCI disabled.
+ */
+public class OID4VCJWTIssuerEndpointDisabledTest extends OID4VCIssuerEndpointTest {
+
+    @Override
+    protected boolean shouldEnableOid4vci() {
+        return false;
+    }
+
+    @Test
+    public void testClientNotEnabled() {
+        testWithBearerToken(token -> testingClient.server(TEST_REALM_NAME).run((session) -> {
+            AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
+            authenticator.setTokenString(token);
+            OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+
+            // Test getCredentialOfferURI
+            CorsErrorResponseException offerUriException = Assert.assertThrows(CorsErrorResponseException.class, () ->
+                    issuerEndpoint.getCredentialOfferURI("test-credential", OfferUriType.URI, 0, 0)
+            );
+            assertEquals("Should fail with 403 Forbidden when client is not OID4VCI-enabled",
+                    Response.Status.FORBIDDEN.getStatusCode(), offerUriException.getResponse().getStatus());
+
+            // Test requestCredential
+            CredentialRequest credentialRequest = new CredentialRequest()
+                    .setCredentialIdentifier(jwtTypeCredentialScopeName);
+            CorsErrorResponseException requestException = Assert.assertThrows(CorsErrorResponseException.class, () ->
+                    issuerEndpoint.requestCredential(credentialRequest)
+            );
+            assertEquals("Should fail with 403 Forbidden when client is not OID4VCI-enabled",
+                    Response.Status.FORBIDDEN.getStatusCode(), requestException.getResponse().getStatus());
+        }));
+    }
+
+    private void testWithBearerToken(Consumer<String> testLogic) {
+        String token = getBearerToken(oauth);
+        testLogic.accept(token);
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java
index 7f75d49a4af8..bfd819a75521 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCJWTIssuerEndpointTest.java
@@ -30,11 +30,18 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.message.BasicNameValuePair;
+import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.TokenVerifier;
 import org.keycloak.common.VerificationException;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.model.Claim;
+import org.keycloak.protocol.oid4vc.model.ClaimDisplay;
+import org.keycloak.protocol.oid4vc.model.Claims;
 import org.keycloak.protocol.oid4vc.model.CredentialIssuer;
 import org.keycloak.protocol.oid4vc.model.CredentialOfferURI;
 import org.keycloak.protocol.oid4vc.model.CredentialRequest;
@@ -44,13 +51,14 @@
 import org.keycloak.protocol.oid4vc.model.OfferUriType;
 import org.keycloak.protocol.oid4vc.model.PreAuthorizedCode;
 import org.keycloak.protocol.oid4vc.model.PreAuthorizedGrant;
+import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
 import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.sdjwt.vp.SdJwtVP;
 import org.keycloak.services.managers.AppAuthManager;
-import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
@@ -58,10 +66,14 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.function.BiFunction;
+import java.util.function.Consumer;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
@@ -112,26 +124,32 @@ public void testGetCredentialOfferUriInvalidToken() throws Throwable {
 
     @Test
     public void testGetCredentialOfferURI() {
-        String token = getBearerToken(oauth);
-        testingClient
-                .server(TEST_REALM_NAME)
-                .run((session) -> {
-                    try {
-                        AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
-                        authenticator.setTokenString(token);
-                        OID4VCIssuerEndpoint oid4VCIssuerEndpoint = prepareIssuerEndpoint(session, authenticator);
-
-                        Response response = oid4VCIssuerEndpoint.getCredentialOfferURI("test-credential", OfferUriType.URI, 0, 0);
-
-                        assertEquals("An offer uri should have been returned.", HttpStatus.SC_OK, response.getStatus());
-                        CredentialOfferURI credentialOfferURI = JsonSerialization.mapper.convertValue(response.getEntity(), CredentialOfferURI.class);
-                        assertNotNull("A nonce should be included.", credentialOfferURI.getNonce());
-                        assertNotNull("The issuer uri should be provided.", credentialOfferURI.getIssuer());
-                    } catch (Exception e) {
-                        throw new RuntimeException(e);
-                    }
-                });
-
+        final String scopeName = jwtTypeCredentialClientScope.getName();
+        final String credentialConfigurationId = jwtTypeCredentialClientScope.getAttributes()
+                                                                             .get(CredentialScopeModel.CONFIGURATION_ID);
+        String token = getBearerToken(oauth, client, scopeName);
+
+        testingClient.server(TEST_REALM_NAME).run((session) -> {
+            try {
+                AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(
+                        session);
+                authenticator.setTokenString(token);
+                OID4VCIssuerEndpoint oid4VCIssuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+
+                Response response = oid4VCIssuerEndpoint.getCredentialOfferURI(credentialConfigurationId,
+                                                                               OfferUriType.URI,
+                                                                               0,
+                                                                               0);
+
+                assertEquals("An offer uri should have been returned.", HttpStatus.SC_OK, response.getStatus());
+                CredentialOfferURI credentialOfferURI = JsonSerialization.mapper.convertValue(response.getEntity(),
+                                                                                              CredentialOfferURI.class);
+                assertNotNull("A nonce should be included.", credentialOfferURI.getNonce());
+                assertNotNull("The issuer uri should be provided.", credentialOfferURI.getIssuer());
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
     }
 
     // ----- getCredentialOffer
@@ -237,7 +255,6 @@ public void testRequestCredentialUnauthorized() throws Throwable {
                         authenticator.setTokenString(null);
                         OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
                         Response response = issuerEndpoint.requestCredential(new CredentialRequest()
-                                .setFormat(Format.JWT_VC)
                                 .setCredentialIdentifier("test-credential"));
                         assertEquals(MediaType.APPLICATION_JSON_TYPE, response.getMediaType());
                     }));
@@ -254,47 +271,38 @@ public void testRequestCredentialInvalidToken() throws Throwable {
                         authenticator.setTokenString("token");
                         OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
                         issuerEndpoint.requestCredential(new CredentialRequest()
-                                .setFormat(Format.JWT_VC)
-                                .setCredentialIdentifier("test-credential"));
-                    }));
-        });
-    }
-
-    @Test(expected = BadRequestException.class)
-    public void testRequestCredentialUnsupportedFormat() throws Throwable {
-        String token = getBearerToken(oauth);
-        withCausePropagation(() -> {
-            testingClient
-                    .server(TEST_REALM_NAME)
-                    .run((session -> {
-                        AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
-                        authenticator.setTokenString(token);
-                        OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
-                        issuerEndpoint.requestCredential(new CredentialRequest()
-                                .setFormat(Format.SD_JWT_VC)
                                 .setCredentialIdentifier("test-credential"));
                     }));
         });
     }
 
-    @Test(expected = BadRequestException.class)
+    @Test
     public void testRequestCredentialNoMatchingCredentialBuilder() throws Throwable {
-        String token = getBearerToken(oauth);
-        withCausePropagation(() ->
-            testingClient
-                    .server(TEST_REALM_NAME)
-                    .run((session -> {
-                        AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
-                        authenticator.setTokenString(token);
+        final String credentialConfigurationId = jwtTypeCredentialClientScope.getAttributes()
+                                                                             .get(CredentialScopeModel.CONFIGURATION_ID);
+        final String scopeName = jwtTypeCredentialClientScope.getName();
+        String token = getBearerToken(oauth, client, scopeName);
+
+        try {
+            withCausePropagation(() -> {
+                testingClient.server(TEST_REALM_NAME).run((session -> {
+                    AppAuthManager.BearerTokenAuthenticator authenticator = //
+                            new AppAuthManager.BearerTokenAuthenticator(session);
+                    authenticator.setTokenString(token);
 
-                        // Prepare the issue endpoint with no credential builders.
-                        OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator, Map.of(), Map.of());
+                    // Prepare the issue endpoint with no credential builders.
+                    OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator, Map.of());
 
-                        issuerEndpoint.requestCredential(new CredentialRequest()
-                                .setFormat(Format.JWT_VC)
-                                .setCredentialIdentifier("test-credential"));
-                    }))
-        );
+                    CredentialRequest credentialRequest = //
+                            new CredentialRequest().setCredentialConfigurationId(credentialConfigurationId);
+                    issuerEndpoint.requestCredential(credentialRequest);
+                }));
+            });
+            Assert.fail("Should have thrown an exception");
+        }catch (Exception e) {
+            Assert.assertTrue(e instanceof BadRequestException);
+            Assert.assertEquals("No credential builder found for format jwt_vc", e.getMessage());
+        }
     }
 
     @Test(expected = BadRequestException.class)
@@ -308,7 +316,6 @@ public void testRequestCredentialUnsupportedCredential() throws Throwable {
                         authenticator.setTokenString(token);
                         OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
                         issuerEndpoint.requestCredential(new CredentialRequest()
-                                .setFormat(Format.JWT_VC)
                                 .setCredentialIdentifier("no-such-credential"));
                     }));
         });
@@ -316,7 +323,8 @@ public void testRequestCredentialUnsupportedCredential() throws Throwable {
 
     @Test
     public void testRequestCredential() {
-        String token = getBearerToken(oauth);
+        final String scopeName = jwtTypeCredentialClientScope.getName();
+        String token = getBearerToken(oauth, client, scopeName);
         testingClient
                 .server(TEST_REALM_NAME)
                 .run((session -> {
@@ -324,19 +332,56 @@ public void testRequestCredential() {
                     authenticator.setTokenString(token);
                     OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
                     CredentialRequest credentialRequest = new CredentialRequest()
-                            .setFormat(Format.JWT_VC)
-                            .setCredentialIdentifier("test-credential");
+                            .setCredentialIdentifier(scopeName);
                     Response credentialResponse = issuerEndpoint.requestCredential(credentialRequest);
-                    assertEquals("The credential request should be answered successfully.", HttpStatus.SC_OK, credentialResponse.getStatus());
+                    assertEquals("The credential request should be answered successfully.",
+                                 HttpStatus.SC_OK,
+                                 credentialResponse.getStatus());
                     assertNotNull("A credential should be responded.", credentialResponse.getEntity());
-                    CredentialResponse credentialResponseVO = JsonSerialization.mapper.convertValue(credentialResponse.getEntity(), CredentialResponse.class);
-                    JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponseVO.getCredential(), JsonWebToken.class).getToken();
+                    CredentialResponse credentialResponseVO = JsonSerialization.mapper
+                                                                               .convertValue(credentialResponse.getEntity(),
+                                                                                             CredentialResponse.class);
+                    JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponseVO.getCredentials().get(0).getCredential(),
+                                                                     JsonWebToken.class).getToken();
 
                     assertNotNull("A valid credential string should have been responded", jsonWebToken);
-                    assertNotNull("The credentials should be included at the vc-claim.", jsonWebToken.getOtherClaims().get("vc"));
-                    VerifiableCredential credential = JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims().get("vc"), VerifiableCredential.class);
-                    assertTrue("The static claim should be set.", credential.getCredentialSubject().getClaims().containsKey("VerifiableCredential"));
-                    assertFalse("Only mappers supported for the requested type should have been evaluated.", credential.getCredentialSubject().getClaims().containsKey("AnotherCredentialType"));
+                    assertNotNull("The credentials should be included at the vc-claim.",
+                                  jsonWebToken.getOtherClaims().get("vc"));
+                    VerifiableCredential credential =
+                            JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims().get("vc"),
+                                                                  VerifiableCredential.class);
+                    assertTrue("The static claim should be set.",
+                               credential.getCredentialSubject().getClaims().containsKey("scope-name"));
+                    assertEquals("The static claim should be set.",
+                                 scopeName,
+                                 credential.getCredentialSubject().getClaims().get("scope-name"));
+                    assertFalse("Only mappers supported for the requested type should have been evaluated.",
+                                credential.getCredentialSubject().getClaims().containsKey("AnotherCredentialType"));
+                }));
+    }
+
+    @Test
+    public void testRequestCredentialWithConfigurationIdNotSet() {
+        final String scopeName = minimalJwtTypeCredentialClientScope.getName();
+        String token = getBearerToken(oauth, client, scopeName);
+        testingClient
+                .server(TEST_REALM_NAME)
+                .run((session -> {
+                    AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
+                    authenticator.setTokenString(token);
+                    OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+                    CredentialRequest credentialRequest = new CredentialRequest()
+                            .setCredentialIdentifier(scopeName);
+                    Response credentialResponse = issuerEndpoint.requestCredential(credentialRequest);
+                    assertEquals("The credential request should be answered successfully.",
+                                 HttpStatus.SC_OK,
+                                 credentialResponse.getStatus());
+                    assertNotNull("A credential should be responded.", credentialResponse.getEntity());
+                    CredentialResponse credentialResponseVO = JsonSerialization.mapper
+                                                                               .convertValue(credentialResponse.getEntity(),
+                                                                                             CredentialResponse.class);
+                    SdJwtVP sdJwtVP = SdJwtVP.of((String)credentialResponseVO.getCredentials().get(0).getCredential());
+                    assertNotNull("A valid credential string should have been responded", sdJwtVP);
                 }));
     }
 
@@ -350,14 +395,20 @@ public void testRequestCredential() {
     @Test
     public void testCredentialIssuance() throws Exception {
 
-        String token = getBearerToken(oauth);
+        String token = getBearerToken(oauth, client, jwtTypeCredentialClientScope.getName());
 
         // 1. Retrieving the credential-offer-uri
-        HttpGet getCredentialOfferURI = new HttpGet(getBasePath(TEST_REALM_NAME) + "credential-offer-uri?credential_configuration_id=test-credential");
+        final String credentialConfigurationId = jwtTypeCredentialClientScope.getAttributes()
+                                                                               .get(CredentialScopeModel.CONFIGURATION_ID);
+        HttpGet getCredentialOfferURI = new HttpGet(getBasePath(TEST_REALM_NAME)
+                                                            + "credential-offer-uri?credential_configuration_id="
+                                                            + credentialConfigurationId);
         getCredentialOfferURI.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token);
         CloseableHttpResponse credentialOfferURIResponse = httpClient.execute(getCredentialOfferURI);
 
-        assertEquals("A valid offer uri should be returned", HttpStatus.SC_OK, credentialOfferURIResponse.getStatusLine().getStatusCode());
+        assertEquals("A valid offer uri should be returned",
+                     HttpStatus.SC_OK,
+                     credentialOfferURIResponse.getStatusLine().getStatusCode());
         String s = IOUtils.toString(credentialOfferURIResponse.getEntity().getContent(), StandardCharsets.UTF_8);
         CredentialOfferURI credentialOfferURI = JsonSerialization.readValue(s, CredentialOfferURI.class);
 
@@ -395,7 +446,7 @@ public void testCredentialIssuance() throws Exception {
         parameters.add(new BasicNameValuePair(PreAuthorizedCodeGrantTypeFactory.CODE_REQUEST_PARAM, credentialsOffer.getGrants().getPreAuthorizedCode().getPreAuthorizedCode()));
         UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
         postPreAuthorizedCode.setEntity(formEntity);
-        OAuthClient.AccessTokenResponse accessTokenResponse = new OAuthClient.AccessTokenResponse(httpClient.execute(postPreAuthorizedCode));
+        AccessTokenResponse accessTokenResponse = new AccessTokenResponse(httpClient.execute(postPreAuthorizedCode));
         assertEquals(HttpStatus.SC_OK, accessTokenResponse.getStatusCode());
         String theToken = accessTokenResponse.getAccessToken();
 
@@ -404,7 +455,11 @@ public void testCredentialIssuance() throws Exception {
                 .map(offeredCredentialId -> credentialIssuer.getCredentialsSupported().get(offeredCredentialId))
                 .forEach(supportedCredential -> {
                     try {
-                        requestOffer(theToken, credentialIssuer.getCredentialEndpoint(), supportedCredential, new CredentialResponseHandler());
+                        requestCredential(theToken,
+                                          credentialIssuer.getCredentialEndpoint(),
+                                          supportedCredential,
+                                          new CredentialResponseHandler(),
+                                          jwtTypeCredentialClientScope);
                     } catch (IOException e) {
                         fail("Was not able to get the credential.");
                     } catch (VerificationException e) {
@@ -414,33 +469,52 @@ public void testCredentialIssuance() throws Exception {
     }
 
     @Test
-    public void testCredentialIssuanceWithAuthZCodeWithScopeMatched() throws Exception {
-        testCredentialIssuanceWithAuthZCodeFlow((testClientId, testScope) -> getBearerToken(oauth.clientId(testClientId).openid(false).scope(testScope)),
-                m -> {
-                    String accessToken = (String) m.get("accessToken");
-                    WebTarget credentialTarget = (WebTarget) m.get("credentialTarget");
-                    CredentialRequest credentialRequest = (CredentialRequest) m.get("credentialRequest");
-
-                    try (Response response = credentialTarget.request().header(HttpHeaders.AUTHORIZATION, "bearer " + accessToken).post(Entity.json(credentialRequest))) {
-                        CredentialResponse credentialResponse = JsonSerialization.readValue(response.readEntity(String.class), CredentialResponse.class);
-
-                        assertEquals(200, response.getStatus());
-                        JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponse.getCredential(), JsonWebToken.class).getToken();
-                        assertEquals("did:web:test.org", jsonWebToken.getIssuer());
-
-                        VerifiableCredential credential = JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims().get("vc"), VerifiableCredential.class);
-                        assertEquals(TEST_TYPES, credential.getType());
-                        assertEquals(TEST_DID, credential.getIssuer());
-                        assertEquals("john@email.cz", credential.getCredentialSubject().getClaims().get("email"));
-                    } catch (IOException | VerificationException e) {
-                        Assert.fail();
-                    }
-                });
+    public void testCredentialIssuanceWithAuthZCodeWithScopeMatched() {
+        BiFunction<String, String, String> getAccessToken = (testClientId, testScope) -> {
+            return getBearerToken(oauth, client, jwtTypeCredentialClientScope.getName());
+        };
+
+        Consumer<Map<String, Object>> sendCredentialRequest = m -> {
+            String accessToken = (String) m.get("accessToken");
+            WebTarget credentialTarget = (WebTarget) m.get("credentialTarget");
+            CredentialRequest credentialRequest = (CredentialRequest) m.get("credentialRequest");
+            assertEquals("Credential configuration id should match",
+                         jwtTypeCredentialClientScope.getAttributes().get(CredentialScopeModel.CONFIGURATION_ID),
+                         credentialRequest.getCredentialConfigurationId());
+
+            try (Response response = credentialTarget.request()
+                                                     .header(HttpHeaders.AUTHORIZATION, "bearer " + accessToken)
+                                                     .post(Entity.json(credentialRequest))) {
+                if (response.getStatus() != 200) {
+                    String errorBody = response.readEntity(String.class);
+                    System.out.println("Error Response: " + errorBody);
+                }
+                assertEquals(200, response.getStatus());
+                CredentialResponse credentialResponse = JsonSerialization.readValue(response.readEntity(String.class),
+                                                                                    CredentialResponse.class);
+
+                JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialResponse.getCredentials().get(0).getCredential(),
+                                                                 JsonWebToken.class).getToken();
+                assertEquals(TEST_DID.toString(), jsonWebToken.getIssuer());
+
+                VerifiableCredential credential = JsonSerialization.mapper.convertValue(jsonWebToken.getOtherClaims()
+                                                                                                    .get("vc"),
+                                                                                        VerifiableCredential.class);
+                assertEquals(List.of(jwtTypeCredentialClientScope.getName()), credential.getType());
+                assertEquals(TEST_DID, credential.getIssuer());
+                assertEquals("john@email.cz", credential.getCredentialSubject().getClaims().get("email"));
+            } catch (VerificationException | IOException e) {
+                throw new RuntimeException(e);
+            }
+        };
+
+        testCredentialIssuanceWithAuthZCodeFlow(jwtTypeCredentialClientScope, getAccessToken, sendCredentialRequest);
     }
 
     @Test
     public void testCredentialIssuanceWithAuthZCodeWithScopeUnmatched() throws Exception {
-        testCredentialIssuanceWithAuthZCodeFlow((testClientId, testScope) -> getBearerToken(oauth.clientId(testClientId).openid(false).scope("email")), // set registered different scope
+        testCredentialIssuanceWithAuthZCodeFlow(sdJwtTypeCredentialClientScope, (testClientId, testScope) ->
+                getBearerToken(oauth.clientId(testClientId).openid(false).scope("email")),// set registered different scope
                 m -> {
                     String accessToken = (String) m.get("accessToken");
                     WebTarget credentialTarget = (WebTarget) m.get("credentialTarget");
@@ -454,7 +528,8 @@ public void testCredentialIssuanceWithAuthZCodeWithScopeUnmatched() throws Excep
 
     @Test
     public void testCredentialIssuanceWithAuthZCodeSWithoutScope() throws Exception {
-        testCredentialIssuanceWithAuthZCodeFlow((testClientId, testScope) -> getBearerToken(oauth.clientId(testClientId).openid(false).scope(null)), // no scope
+        testCredentialIssuanceWithAuthZCodeFlow(sdJwtTypeCredentialClientScope,
+                                                (testClientId, testScope) -> getBearerToken(oauth.clientId(testClientId).openid(false).scope(null)),// no scope
                 m -> {
                     String accessToken = (String) m.get("accessToken");
                     WebTarget credentialTarget = (WebTarget) m.get("credentialTarget");
@@ -466,4 +541,218 @@ public void testCredentialIssuanceWithAuthZCodeSWithoutScope() throws Exception
                 });
     }
 
+    /**
+     * The accessToken references the scope "test-credential" but we ask for the credential "VerifiableCredential"
+     * in the CredentialRequest
+     */
+    @Test
+    public void testCredentialIssuanceWithScopeUnmatched() {
+        BiFunction<String, String, String> getAccessToken = (testClientId, testScope) -> {
+            return getBearerToken(oauth, client, jwtTypeCredentialClientScope.getName());
+        };
+
+        Consumer<Map<String, Object>> sendCredentialRequest = m -> {
+            String accessToken = (String) m.get("accessToken");
+            WebTarget credentialTarget = (WebTarget) m.get("credentialTarget");
+            CredentialRequest credentialRequest = (CredentialRequest) m.get("credentialRequest");
+
+            try (Response response = credentialTarget.request()
+                                                     .header(HttpHeaders.AUTHORIZATION, "bearer " + accessToken)
+                                                     .post(Entity.json(credentialRequest))) {
+                assertEquals(400, response.getStatus());
+                String errorJson = response.readEntity(String.class);
+                assertNotNull("Error response should not be null", errorJson);
+                assertTrue("Error response should mention UNSUPPORTED_CREDENTIAL_TYPE or scope",
+                           errorJson.contains("UNSUPPORTED_CREDENTIAL_TYPE") || errorJson.contains("scope"));
+            }
+        };
+
+        testCredentialIssuanceWithAuthZCodeFlow(sdJwtTypeCredentialClientScope, getAccessToken, sendCredentialRequest);
+    }
+
+    @Test
+    public void testRequestCredentialWithNotificationId() {
+        String token = getBearerToken(oauth, client, jwtTypeCredentialClientScope.getName());
+        final String scopeName = jwtTypeCredentialClientScope.getName();
+
+        testingClient.server(TEST_REALM_NAME).run((session) -> {
+            AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
+            authenticator.setTokenString(token);
+            OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+
+            CredentialRequest credentialRequest = new CredentialRequest().setCredentialIdentifier(scopeName);
+
+            // First credential request
+            Response response1 = issuerEndpoint.requestCredential(credentialRequest);
+            assertEquals("The credential request should be successful.", 200, response1.getStatus());
+            CredentialResponse credentialResponse1 = JsonSerialization.mapper.convertValue(response1.getEntity(), CredentialResponse.class);
+            assertNotNull("Credential response should not be null", credentialResponse1);
+            assertNotNull("Credential should be present", credentialResponse1.getCredentials());
+            assertNotNull("Notification ID should be present", credentialResponse1.getNotificationId());
+            assertFalse("Notification ID should not be empty", credentialResponse1.getNotificationId().isEmpty());
+
+            // Second credential request
+            Response response2 = issuerEndpoint.requestCredential(credentialRequest);
+            assertEquals("The second credential request should be successful.", 200, response2.getStatus());
+            CredentialResponse credentialResponse2 = JsonSerialization.mapper.convertValue(response2.getEntity(), CredentialResponse.class);
+            assertNotEquals("Notification IDs should be unique", credentialResponse1.getNotificationId(), credentialResponse2.getNotificationId());
+        });
+    }
+
+    /**
+     * This is testing the configuration exposed by OID4VCIssuerWellKnownProvider based on the client and signing config setup here.
+     */
+    @Test
+    public void testGetJwtVcConfigFromMetadata() {
+        final String scopeName = jwtTypeCredentialClientScope.getName();
+        final String credentialConfigurationId = jwtTypeCredentialClientScope.getAttributes()
+                                                                               .get(CredentialScopeModel.CONFIGURATION_ID);
+        final String verifiableCredentialType = jwtTypeCredentialClientScope.getAttributes()
+                                                                              .get(CredentialScopeModel.VCT);
+        String expectedIssuer = suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/" + TEST_REALM_NAME;
+        String expectedCredentialsEndpoint = expectedIssuer + "/protocol/oid4vc/credential";
+        String expectedNonceEndpoint = expectedIssuer + "/protocol/oid4vc/" + OID4VCIssuerEndpoint.NONCE_PATH;
+        final String expectedAuthorizationServer = expectedIssuer;
+        testingClient
+                .server(TEST_REALM_NAME)
+                .run((session -> {
+                    OID4VCIssuerWellKnownProvider oid4VCIssuerWellKnownProvider = new OID4VCIssuerWellKnownProvider(session);
+                    Object issuerConfig = oid4VCIssuerWellKnownProvider.getConfig();
+                    assertTrue("Valid credential-issuer metadata should be returned.", issuerConfig instanceof CredentialIssuer);
+                    CredentialIssuer credentialIssuer = (CredentialIssuer) issuerConfig;
+                    assertEquals("The correct issuer should be included.", expectedIssuer, credentialIssuer.getCredentialIssuer());
+                    assertEquals("The correct credentials endpoint should be included.", expectedCredentialsEndpoint, credentialIssuer.getCredentialEndpoint());
+                    assertEquals("The correct nonce endpoint should be included.",
+                                 expectedNonceEndpoint,
+                                 credentialIssuer.getNonceEndpoint());
+                    assertEquals("Since the authorization server is equal to the issuer, just 1 should be returned.", 1, credentialIssuer.getAuthorizationServers().size());
+                    assertEquals("The expected server should have been returned.", expectedAuthorizationServer, credentialIssuer.getAuthorizationServers().get(0));
+
+                    assertTrue("The jwt_vc-credential should be supported.",
+                               credentialIssuer.getCredentialsSupported()
+                                               .containsKey(credentialConfigurationId));
+
+                    SupportedCredentialConfiguration jwtVcConfig =
+                            credentialIssuer.getCredentialsSupported().get(credentialConfigurationId);
+                    assertEquals("The jwt_vc-credential should offer type test-credential",
+                                 scopeName,
+                                 jwtVcConfig.getScope());
+                    assertEquals("The jwt_vc-credential should be offered in the jwt_vc format.",
+                                 Format.JWT_VC,
+                                 jwtVcConfig.getFormat());
+
+                    Claims jwtVcClaims = jwtVcConfig.getClaims();
+                    assertNotNull("The jwt_vc-credential can optionally provide a claims claim.",
+                                  jwtVcClaims);
+
+                    assertEquals(5,  jwtVcClaims.size());
+                    {
+                        Claim claim = jwtVcClaims.get(0);
+                        assertEquals("The jwt_vc-credential claim credentialSubject.given_name is present.",
+                                     Oid4VciConstants.CREDENTIAL_SUBJECT,
+                                     claim.getPath().get(0));
+                        assertEquals("The jwt_vc-credential claim credentialSubject.given_name is present.",
+                                     "given_name",
+                                     claim.getPath().get(1));
+                        assertFalse("The jwt_vc-credential claim credentialSubject.given_name is not mandatory.",
+                                    claim.isMandatory());
+                        assertNotNull("The jwt_vc-credential claim credentialSubject.given_name has display configured",
+                                      claim.getDisplay());
+                        assertEquals(15, claim.getDisplay().size());
+                        for (ClaimDisplay givenNameDisplay : claim.getDisplay()) {
+                            assertNotNull(givenNameDisplay.getName());
+                            assertNotNull(givenNameDisplay.getLocale());
+                        }
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(1);
+                        assertEquals("The jwt_vc-credential claim credentialSubject.family_name is present.",
+                                     Oid4VciConstants.CREDENTIAL_SUBJECT,
+                                     claim.getPath().get(0));
+                        assertEquals("The jwt_vc-credential claim credentialSubject.family_name is present.",
+                                     "family_name",
+                                     claim.getPath().get(1));
+                        assertFalse("The jwt_vc-credential claim credentialSubject.family_name is not mandatory.",
+                                    claim.isMandatory());
+                        assertNotNull("The jwt_vc-credential claim credentialSubject.family_name has display configured",
+                                      claim.getDisplay());
+                        assertEquals(15, claim.getDisplay().size());
+                        for (ClaimDisplay familyNameDisplay : claim.getDisplay()) {
+                            assertNotNull(familyNameDisplay.getName());
+                            assertNotNull(familyNameDisplay.getLocale());
+                        }
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(2);
+                        assertEquals("The jwt_vc-credential claim credentialSubject.birthdate is present.",
+                                     Oid4VciConstants.CREDENTIAL_SUBJECT,
+                                     claim.getPath().get(0));
+                        assertEquals("The jwt_vc-credential claim credentialSubject.birthdate is present.",
+                                     "birthdate",
+                                     claim.getPath().get(1));
+                        assertFalse("The jwt_vc-credential claim credentialSubject.birthdate is not mandatory.",
+                                    claim.isMandatory());
+                        assertNotNull("The jwt_vc-credential claim credentialSubject.birthdate has display configured",
+                                      claim.getDisplay());
+                        assertEquals(15, claim.getDisplay().size());
+                        for (ClaimDisplay birthDateDisplay : claim.getDisplay()) {
+                            assertNotNull(birthDateDisplay.getName());
+                            assertNotNull(birthDateDisplay.getLocale());
+                        }
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(3);
+                        assertEquals("The jwt_vc-credential claim credentialSubject.email is present.",
+                                     Oid4VciConstants.CREDENTIAL_SUBJECT,
+                                     claim.getPath().get(0));
+                        assertEquals("The jwt_vc-credential claim credentialSubject.email is present.",
+                                     "email",
+                                     claim.getPath().get(1));
+                        assertFalse("The jwt_vc-credential claim credentialSubject.email is not mandatory.",
+                                    claim.isMandatory());
+                        assertNotNull("The jwt_vc-credential claim credentialSubject.email has display configured",
+                                      claim.getDisplay());
+                        assertEquals(15, claim.getDisplay().size());
+                        for (ClaimDisplay birthDateDisplay : claim.getDisplay()) {
+                            assertNotNull(birthDateDisplay.getName());
+                            assertNotNull(birthDateDisplay.getLocale());
+                        }
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(4);
+                        assertEquals("The jwt_vc-credential claim credentialSubject.scope-name is present.",
+                                     Oid4VciConstants.CREDENTIAL_SUBJECT,
+                                     claim.getPath().get(0));
+                        assertEquals("The jwt_vc-credential claim credentialSubject.scope-name is present.",
+                                     "scope-name",
+                                     claim.getPath().get(1));
+                        assertFalse("The jwt_vc-credential claim credentialSubject.scope-name is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The jwt_vc-credential claim credentialSubject.scope-name has no display configured",
+                                      claim.getDisplay());
+                    }
+
+                    assertEquals("The jwt_vc-credential should offer vct",
+                                 verifiableCredentialType,
+                                 jwtVcConfig.getVct());
+
+                    // We are offering key binding only for identity credential
+                    assertTrue("The jwt_vc-credential should contain a cryptographic binding method supported named jwk",
+                               jwtVcConfig.getCryptographicBindingMethodsSupported()
+                                          .contains(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT));
+                    assertTrue("The jwt_vc-credential should contain a credential signing algorithm named RS256",
+                               jwtVcConfig.getCredentialSigningAlgValuesSupported().contains("RS256"));
+                    assertTrue("The jwt_vc-credential should support a proof of type jwt with signing algorithm RS256",
+                               credentialIssuer.getCredentialsSupported()
+                                               .get(credentialConfigurationId)
+                                               .getProofTypesSupported()
+                                               .getSupportedProofTypes()
+                                               .get("jwt")
+                                               .getSigningAlgorithmsSupported()
+                                               .contains("RS256"));
+                    assertEquals("The jwt_vc-credential should display as Test Credential",
+                                 credentialConfigurationId,
+                                 jwtVcConfig.getDisplay().get(0).getName());
+                }));
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointDisabledTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointDisabledTest.java
new file mode 100644
index 000000000000..6c9efea62476
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointDisabledTest.java
@@ -0,0 +1,56 @@
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.Test;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
+import org.keycloak.protocol.oid4vc.model.CredentialRequest;
+import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.OfferUriType;
+import org.keycloak.services.CorsErrorResponseException;
+import org.keycloak.services.managers.AppAuthManager;
+import org.keycloak.testsuite.Assert;
+
+import java.util.function.Consumer;
+
+import static org.junit.Assert.assertEquals;
+
+/**
+ * Tests for OID4VCIssuerEndpoint with OID4VCI disabled for SD-JWT format
+ */
+public class OID4VCSdJwtIssuingEndpointDisabledTest extends OID4VCIssuerEndpointTest {
+
+    @Override
+    protected boolean shouldEnableOid4vci() {
+        return false;
+    }
+
+    @Test
+    public void testClientNotEnabled() {
+        testWithBearerToken(token -> testingClient.server(TEST_REALM_NAME).run((session) -> {
+            AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
+            authenticator.setTokenString(token);
+            OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+
+            // Test getCredentialOfferURI
+            CorsErrorResponseException offerUriException = Assert.assertThrows(CorsErrorResponseException.class, () ->
+                    issuerEndpoint.getCredentialOfferURI("test-credential", OfferUriType.URI, 0, 0)
+            );
+            assertEquals("Should fail with 403 Forbidden when client is not OID4VCI-enabled",
+                    Response.Status.FORBIDDEN.getStatusCode(), offerUriException.getResponse().getStatus());
+
+            // Test requestCredential
+            CredentialRequest credentialRequest = new CredentialRequest()
+                    .setCredentialConfigurationId(sdJwtTypeCredentialConfigurationIdName);
+            CorsErrorResponseException requestException = Assert.assertThrows(CorsErrorResponseException.class, () ->
+                    issuerEndpoint.requestCredential(credentialRequest)
+            );
+            assertEquals("Should fail with 403 Forbidden when client is not OID4VCI-enabled",
+                    Response.Status.FORBIDDEN.getStatusCode(), requestException.getResponse().getStatus());
+        }));
+    }
+
+    private void testWithBearerToken(Consumer<String> testLogic) {
+        String token = getBearerToken(oauth);
+        testLogic.accept(token);
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
index 026682caba3b..60910424a33c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
  * and other contributors as indicated by the @author tags.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -17,10 +17,11 @@
 package org.keycloak.testsuite.oid4vc.issuance.signing;
 
 import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
-import org.apache.commons.collections4.map.HashedMap;
 import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.http.HttpStatus;
 import org.apache.http.NameValuePair;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
@@ -28,52 +29,58 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.message.BasicNameValuePair;
+import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.TokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.Base64Url;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.crypto.Algorithm;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.oid4vci.CredentialScopeModel;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.constants.Oid4VciConstants;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.JwtCredentialBuilder;
 import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBuilder;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.CNonceHandler;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.JwtCNonceHandler;
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCGeneratedIdMapper;
-import org.keycloak.protocol.oid4vc.issuance.signing.SdJwtSigningService;
-import org.keycloak.protocol.oid4vc.model.CredentialConfigId;
+import org.keycloak.protocol.oid4vc.model.Claim;
+import org.keycloak.protocol.oid4vc.model.Claims;
 import org.keycloak.protocol.oid4vc.model.CredentialIssuer;
 import org.keycloak.protocol.oid4vc.model.CredentialOfferURI;
 import org.keycloak.protocol.oid4vc.model.CredentialRequest;
 import org.keycloak.protocol.oid4vc.model.CredentialResponse;
 import org.keycloak.protocol.oid4vc.model.CredentialsOffer;
 import org.keycloak.protocol.oid4vc.model.Format;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredentialType;
+import org.keycloak.protocol.oid4vc.model.JwtProof;
+import org.keycloak.protocol.oid4vc.model.Proof;
+import org.keycloak.protocol.oid4vc.model.SupportedCredentialConfiguration;
 import org.keycloak.protocol.oidc.grants.PreAuthorizedCodeGrantTypeFactory;
 import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
 import org.keycloak.representations.JsonWebToken;
-import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.ComponentExportRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.sdjwt.vp.SdJwtVP;
 import org.keycloak.services.managers.AppAuthManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
-import java.time.temporal.ChronoUnit;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Optional;
 import java.util.UUID;
 import java.util.stream.Collectors;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
@@ -86,23 +93,191 @@ public class OID4VCSdJwtIssuingEndpointTest extends OID4VCIssuerEndpointTest {
 
     @Test
     public void testRequestTestCredential() {
-        String token = getBearerToken(oauth);
-        String vct = "https://credentials.example.com/test-credential";
+        String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+
+        final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
+        testingClient
+                .server(TEST_REALM_NAME)
+                .run(session -> {
+                    ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                           ClientScopeRepresentation.class);
+                    testRequestTestCredential(session, clientScope, token, null);
+                });
+    }
+
+    @Test
+    public void testRequestTestCredentialWithKeybinding() {
+        String cNonce = getCNonce();
+        String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+
+        final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
         testingClient
                 .server(TEST_REALM_NAME)
                 .run((session -> {
-                    AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
-                    authenticator.setTokenString(token);
-                    OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
-                    CredentialRequest credentialRequest = new CredentialRequest()
-                            .setFormat(Format.SD_JWT_VC)
-                            .setVct(vct);
-                    Response credentialResponse = issuerEndpoint.requestCredential(credentialRequest);
-                    assertEquals("The credential request should be answered successfully.", HttpStatus.SC_OK, credentialResponse.getStatus());
-                    assertNotNull("A credential should be responded.", credentialResponse.getEntity());
-                    CredentialResponse credentialResponseVO = JsonSerialization.mapper.convertValue(credentialResponse.getEntity(), CredentialResponse.class);
-                    new TestCredentialResponseHandler(vct).handleCredentialResponse(credentialResponseVO);
+                    JwtProof proof = new JwtProof()
+                            .setJwt(generateJwtProof(getCredentialIssuer(session), cNonce));
+
+                    ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                           ClientScopeRepresentation.class);
+
+                    SdJwtVP sdJwtVP = testRequestTestCredential(session, clientScope, token, proof);
+                    assertNotNull("A cnf claim must be attached to the credential", sdJwtVP.getCnfClaim());
+                }));
+    }
+
+    @Test
+    public void testRequestTestCredentialWithInvalidKeybinding() throws Throwable {
+        String cNonce = getCNonce();
+        String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+
+        final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
+        try {
+            withCausePropagation(() -> {
+                testingClient.server(TEST_REALM_NAME).run((session -> {
+                    JwtProof proof = new JwtProof()
+                            .setJwt(generateInvalidJwtProof(getCredentialIssuer(session), cNonce));
+
+                    ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                           ClientScopeRepresentation.class);
+
+                    testRequestTestCredential(session, clientScope, token, proof);
                 }));
+            });
+            Assert.fail("Should have thrown an exception");
+        } catch (BadRequestException ex) {
+            Assert.assertEquals("Could not validate provided proof", ex.getMessage());
+        }
+    }
+
+    @Test
+    public void testProofOfPossessionWithMissingAudience() throws Throwable {
+        try {
+            String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+            final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
+            withCausePropagation(() -> testingClient
+                    .server(TEST_REALM_NAME)
+                    .run((session -> {
+                        CNonceHandler cNonceHandler = session.getProvider(CNonceHandler.class);
+                        final String nonceEndpoint = OID4VCIssuerWellKnownProvider.getNonceEndpoint(session.getContext());
+                        // creates a cNonce with missing data
+                        String cNonce = cNonceHandler.buildCNonce(null,
+                                                                  Map.of(JwtCNonceHandler.SOURCE_ENDPOINT,
+                                                                         nonceEndpoint));
+                        Proof proof = new JwtProof().setJwt(generateJwtProof(getCredentialIssuer(session), cNonce));
+
+                        ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                               ClientScopeRepresentation.class);
+                        testRequestTestCredential(session, clientScope, token, proof);
+                    })));
+            Assert.fail("Should have thrown an exception");
+        } catch (BadRequestException ex) {
+            Assert.assertEquals("""
+                                        c_nonce: expected 'aud' to be equal to \
+                                        '[https://localhost:8543/auth/realms/test/protocol/oid4vc/credential]' but \
+                                        actual value was '[]'""",
+                                ExceptionUtils.getRootCause(ex).getMessage());
+        }
+    }
+
+    @Test
+    public void testProofOfPossessionWithIllegalSourceEndpoint() throws Throwable {
+        try {
+            String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+            final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
+            withCausePropagation(() -> testingClient
+                    .server(TEST_REALM_NAME)
+                    .run((session -> {
+                        CNonceHandler cNonceHandler = session.getProvider(CNonceHandler.class);
+                        final String credentialsEndpoint = //
+                                OID4VCIssuerWellKnownProvider.getCredentialsEndpoint(session.getContext());
+                        // creates a cNonce with missing data
+                        String cNonce = cNonceHandler.buildCNonce(List.of(credentialsEndpoint), null);
+                        Proof proof = new JwtProof().setJwt(generateJwtProof(getCredentialIssuer(session), cNonce));
+
+                        ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                               ClientScopeRepresentation.class);
+                        testRequestTestCredential(session, clientScope, token, proof);
+                    })));
+            Assert.fail("Should have thrown an exception");
+        } catch (BadRequestException ex) {
+            Assert.assertEquals("""
+                                        c_nonce: expected 'source_endpoint' to be equal to \
+                                        'https://localhost:8543/auth/realms/test/protocol/oid4vc/nonce' but \
+                                        actual value was 'null'""",
+                                ExceptionUtils.getRootCause(ex).getMessage());
+        }
+    }
+
+    @Test
+    public void testProofOfPossessionWithExpiredState() throws Throwable {
+        try {
+            String token = getBearerToken(oauth, client, sdJwtTypeCredentialClientScope.getName());
+            final String clientScopeString = toJsonString(sdJwtTypeCredentialClientScope);
+
+            withCausePropagation(() -> testingClient
+                    .server(TEST_REALM_NAME)
+                    .run((session -> {
+                        CNonceHandler cNonceHandler = session.getProvider(CNonceHandler.class);
+                        final String credentialsEndpoint = //
+                                OID4VCIssuerWellKnownProvider.getCredentialsEndpoint(session.getContext());
+                        final String nonceEndpoint = OID4VCIssuerWellKnownProvider.getNonceEndpoint(session.getContext());
+                        try {
+                            // make the exp-value negative to set the exp-time in the past
+                            session.getContext().getRealm().setAttribute(Oid4VciConstants.C_NONCE_LIFETIME_IN_SECONDS, -1);
+                            String cNonce = cNonceHandler.buildCNonce(List.of(credentialsEndpoint),
+                                                                      Map.of(JwtCNonceHandler.SOURCE_ENDPOINT, nonceEndpoint));
+                            Proof proof = new JwtProof().setJwt(generateJwtProof(getCredentialIssuer(session), cNonce));
+
+                            ClientScopeRepresentation clientScope = fromJsonString(clientScopeString,
+                                                                                   ClientScopeRepresentation.class);
+                            testRequestTestCredential(session, clientScope, token, proof);
+                        } finally {
+                            // make sure other tests are not affected by the changed realm-attribute
+                            session.getContext().getRealm().removeAttribute(Oid4VciConstants.C_NONCE_LIFETIME_IN_SECONDS);
+                        }
+                    })));
+            Assert.fail("Should have thrown an exception");
+        } catch (BadRequestException ex) {
+            String message = ExceptionUtils.getRootCause(ex).getMessage();
+            Assert.assertTrue(String.format("Message '%s' should match regular expression", message),
+                              message.matches("c_nonce not valid: \\d+\\(exp\\) < \\d+\\(now\\)"));
+        }
+    }
+
+    private static String getCredentialIssuer(KeycloakSession session) {
+        return OID4VCIssuerWellKnownProvider.getIssuer(session.getContext());
+    }
+
+    private static SdJwtVP testRequestTestCredential(KeycloakSession session, ClientScopeRepresentation clientScope,
+                                                     String token, Proof proof)
+            throws VerificationException {
+
+        AppAuthManager.BearerTokenAuthenticator authenticator = new AppAuthManager.BearerTokenAuthenticator(session);
+        authenticator.setTokenString(token);
+        OID4VCIssuerEndpoint issuerEndpoint = prepareIssuerEndpoint(session, authenticator);
+
+        final String credentialConfigurationId = clientScope.getAttributes().get(CredentialScopeModel.CONFIGURATION_ID);
+        CredentialRequest credentialRequest = new CredentialRequest()
+                .setCredentialConfigurationId(credentialConfigurationId)
+                .setProof(proof);
+
+        Response credentialResponse = issuerEndpoint.requestCredential(credentialRequest);
+        assertEquals("The credential request should be answered successfully.",
+                     HttpStatus.SC_OK,
+                     credentialResponse.getStatus());
+        assertNotNull("A credential should be responded.", credentialResponse.getEntity());
+        CredentialResponse credentialResponseVO = JsonSerialization.mapper.convertValue(credentialResponse.getEntity(),
+                                                                                        CredentialResponse.class);
+        new TestCredentialResponseHandler(sdJwtCredentialVct).handleCredentialResponse(credentialResponseVO,
+                                                                                       clientScope);
+
+        // Get the credential from the credentials array
+        return SdJwtVP.of(credentialResponseVO.getCredentials().get(0).getCredential().toString());
     }
 
     // Tests the complete flow from
@@ -115,10 +290,14 @@ public void testRequestTestCredential() {
     @Test
     public void testCredentialIssuance() throws Exception {
 
-        String token = getBearerToken(oauth);
+        ClientScopeRepresentation clientScope = sdJwtTypeCredentialClientScope;
+        String token = getBearerToken(oauth, client, clientScope.getName());
 
         // 1. Retrieving the credential-offer-uri
-        HttpGet getCredentialOfferURI = new HttpGet(getBasePath(TEST_REALM_NAME) + "credential-offer-uri?credential_configuration_id=test-credential");
+        final String credentialConfigurationId = clientScope.getAttributes().get(CredentialScopeModel.CONFIGURATION_ID);
+        HttpGet getCredentialOfferURI = new HttpGet(getBasePath(TEST_REALM_NAME) +
+                                                            "credential-offer-uri?credential_configuration_id=" +
+                                                            credentialConfigurationId);
         getCredentialOfferURI.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token);
         CloseableHttpResponse credentialOfferURIResponse = httpClient.execute(getCredentialOfferURI);
 
@@ -161,18 +340,22 @@ public void testCredentialIssuance() throws Exception {
         parameters.add(new BasicNameValuePair(PreAuthorizedCodeGrantTypeFactory.CODE_REQUEST_PARAM, credentialsOffer.getGrants().getPreAuthorizedCode().getPreAuthorizedCode()));
         UrlEncodedFormEntity formEntity = new UrlEncodedFormEntity(parameters, StandardCharsets.UTF_8);
         postPreAuthorizedCode.setEntity(formEntity);
-        OAuthClient.AccessTokenResponse accessTokenResponse = new OAuthClient.AccessTokenResponse(httpClient.execute(postPreAuthorizedCode));
+        AccessTokenResponse accessTokenResponse = new AccessTokenResponse(httpClient.execute(postPreAuthorizedCode));
         assertEquals(HttpStatus.SC_OK, accessTokenResponse.getStatusCode());
         String theToken = accessTokenResponse.getAccessToken();
 
-        final String vct = "https://credentials.example.com/test-credential";
+        final String vct = clientScope.getAttributes().get(CredentialScopeModel.VCT);
 
         // 6. Get the credential
         credentialsOffer.getCredentialConfigurationIds().stream()
                 .map(offeredCredentialId -> credentialIssuer.getCredentialsSupported().get(offeredCredentialId))
                 .forEach(supportedCredential -> {
                     try {
-                        requestOffer(theToken, credentialIssuer.getCredentialEndpoint(), supportedCredential, new TestCredentialResponseHandler(vct));
+                        requestCredential(theToken,
+                                          credentialIssuer.getCredentialEndpoint(),
+                                          supportedCredential,
+                                          new TestCredentialResponseHandler(vct),
+                                          sdJwtTypeCredentialClientScope);
                     } catch (IOException e) {
                         fail("Was not able to get the credential.");
                     } catch (VerificationException e) {
@@ -185,10 +368,16 @@ public void testCredentialIssuance() throws Exception {
      * This is testing the configuration exposed by OID4VCIssuerWellKnownProvider based on the client and signing config setup here.
      */
     @Test
-    public void getConfig() {
+    public void testGetSdJwtConfigFromMetadata() {
+        final String scopeName = sdJwtTypeCredentialClientScope.getName();
+        final String credentialConfigurationId = sdJwtTypeCredentialClientScope.getAttributes()
+                                                                               .get(CredentialScopeModel.CONFIGURATION_ID);
+        final String verifiableCredentialType = sdJwtTypeCredentialClientScope.getAttributes()
+                                                                              .get(CredentialScopeModel.VCT);
         String expectedIssuer = suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/realms/" + TEST_REALM_NAME;
         String expectedCredentialsEndpoint = expectedIssuer + "/protocol/oid4vc/credential";
-        String expectedAuthorizationServer = expectedIssuer;
+        String expectedNonceEndpoint = expectedIssuer + "/protocol/oid4vc/" + OID4VCIssuerEndpoint.NONCE_PATH;
+        final String expectedAuthorizationServer = expectedIssuer;
         testingClient
                 .server(TEST_REALM_NAME)
                 .run((session -> {
@@ -198,184 +387,154 @@ public void getConfig() {
                     CredentialIssuer credentialIssuer = (CredentialIssuer) issuerConfig;
                     assertEquals("The correct issuer should be included.", expectedIssuer, credentialIssuer.getCredentialIssuer());
                     assertEquals("The correct credentials endpoint should be included.", expectedCredentialsEndpoint, credentialIssuer.getCredentialEndpoint());
+                    assertEquals("The correct nonce endpoint should be included.",
+                                 expectedNonceEndpoint,
+                                 credentialIssuer.getNonceEndpoint());
                     assertEquals("Since the authorization server is equal to the issuer, just 1 should be returned.", 1, credentialIssuer.getAuthorizationServers().size());
                     assertEquals("The expected server should have been returned.", expectedAuthorizationServer, credentialIssuer.getAuthorizationServers().get(0));
-                    assertTrue("The test-credential should be supported.", credentialIssuer.getCredentialsSupported().containsKey("test-credential"));
-                    assertEquals("The test-credential should offer type test-credential", "test-credential", credentialIssuer.getCredentialsSupported().get("test-credential").getScope());
-                    assertEquals("The test-credential should be offered in the sd-jwt format.", Format.SD_JWT_VC, credentialIssuer.getCredentialsSupported().get("test-credential").getFormat());
-                    assertNotNull("The test-credential can optionally provide a claims claim.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims());
-                    assertNotNull("The test-credential claim firstName is present.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName"));
-                    assertFalse("The test-credential claim firstName is not mandatory.", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName").getMandatory());
-                    assertEquals("The test-credential claim firstName shall be displayed as First Name", "First Name", credentialIssuer.getCredentialsSupported().get("test-credential").getClaims().get("firstName").getDisplay().get(0).getName());
-                    assertEquals("The test-credential should offer vct VerifiableCredential", "https://credentials.example.com/test-credential", credentialIssuer.getCredentialsSupported().get("test-credential").getVct());
+
+                    assertTrue("The sd-jwt-credential should be supported.",
+                               credentialIssuer.getCredentialsSupported().containsKey(credentialConfigurationId));
+
+                    SupportedCredentialConfiguration jwtVcConfig =
+                            credentialIssuer.getCredentialsSupported().get(credentialConfigurationId);
+                    assertEquals("The sd-jwt-credential should offer type test-credential",
+                                 scopeName,
+                                 jwtVcConfig.getScope());
+                    assertEquals("The sd-jwt-credential should be offered in the jwt_vc format.",
+                                 Format.SD_JWT_VC,
+                                 jwtVcConfig.getFormat());
+
+                    assertNotNull("The sd-jwt-credential can optionally provide a claims claim.",
+                                  credentialIssuer.getCredentialsSupported().get(credentialConfigurationId)
+                                                  .getClaims());
+
+                    Claims jwtVcClaims = jwtVcConfig.getClaims();
+                    assertNotNull("The sd-jwt-credential can optionally provide a claims claim.",
+                                  jwtVcClaims);
+
+                    assertEquals(5,  jwtVcClaims.size());
+                    {
+                        Claim claim = jwtVcClaims.get(0);
+                        assertEquals("The sd-jwt-credential claim roles is present.",
+                                     "roles",
+                                     claim.getPath().get(0));
+                        assertFalse("The sd-jwt-credential claim roles is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The sd-jwt-credential claim roles has no display configured",
+                                      claim.getDisplay());
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(1);
+                        assertEquals("The sd-jwt-credential claim email is present.",
+                                     "email",
+                                     claim.getPath().get(0));
+                        assertFalse("The sd-jwt-credential claim email is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The sd-jwt-credential claim email has no display configured",
+                                      claim.getDisplay());
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(2);
+                        assertEquals("The sd-jwt-credential claim firstName is present.",
+                                     "firstName",
+                                     claim.getPath().get(0));
+                        assertFalse("The sd-jwt-credential claim firstName is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The sd-jwt-credential claim firstName has no display configured",
+                                      claim.getDisplay());
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(3);
+                        assertEquals("The sd-jwt-credential claim lastName is present.",
+                                     "lastName",
+                                     claim.getPath().get(0));
+                        assertFalse("The sd-jwt-credential claim lastName is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The sd-jwt-credential claim lastName has no display configured",
+                                      claim.getDisplay());
+                    }
+                    {
+                        Claim claim = jwtVcClaims.get(4);
+                        assertEquals("The sd-jwt-credential claim scope-name is present.",
+                                     "scope-name",
+                                     claim.getPath().get(0));
+                        assertFalse("The sd-jwt-credential claim scope-name is not mandatory.",
+                                    claim.isMandatory());
+                        assertNull("The sd-jwt-credential claim scope-name has no display configured",
+                                   claim.getDisplay());
+                    }
+
+                    assertEquals("The sd-jwt-credential should offer vct",
+                                 verifiableCredentialType,
+                                 credentialIssuer.getCredentialsSupported().get(credentialConfigurationId).getVct());
 
                     // We are offering key binding only for identity credential
-                    assertTrue("The IdentityCredential should contain a cryptographic binding method supported named jwk", credentialIssuer.getCredentialsSupported().get("IdentityCredential").getCryptographicBindingMethodsSupported().contains("jwk"));
-                    assertTrue("The IdentityCredential should contain a credential signing algorithm named ES256", credentialIssuer.getCredentialsSupported().get("IdentityCredential").getCredentialSigningAlgValuesSupported().contains("ES256"));
-                    assertEquals("The IdentityCredential should display as Test Credential", "Identity Credential", credentialIssuer.getCredentialsSupported().get("IdentityCredential").getDisplay().get(0).getName());
-                    assertTrue("The IdentityCredential should support a proof of type jwt with signing algorithm ES256", credentialIssuer.getCredentialsSupported().get("IdentityCredential").getProofTypesSupported().getJwt().getProofSigningAlgValuesSupported().contains("ES256"));
+                    assertTrue("The sd-jwt-credential should contain a cryptographic binding method supported named jwk",
+                               credentialIssuer.getCredentialsSupported().get(credentialConfigurationId)
+                                               .getCryptographicBindingMethodsSupported()
+                                               .contains(CredentialScopeModel.CRYPTOGRAPHIC_BINDING_METHODS_DEFAULT));
+                    assertTrue("The sd-jwt-credential should contain a credential signing algorithm named ES256",
+                               credentialIssuer.getCredentialsSupported().get(credentialConfigurationId)
+                                               .getCredentialSigningAlgValuesSupported().contains("ES256"));
+                    assertTrue("The sd-jwt-credential should support a proof of type jwt with signing algorithm ES256",
+                               credentialIssuer.getCredentialsSupported()
+                                               .get(credentialConfigurationId)
+                                               .getProofTypesSupported()
+                                               .getSupportedProofTypes()
+                                               .get("jwt")
+                                               .getSigningAlgorithmsSupported()
+                                               .contains("ES256"));
+                    assertEquals("The sd-jwt-credential should display as Test Credential",
+                                 credentialConfigurationId,
+                                 credentialIssuer.getCredentialsSupported().get(credentialConfigurationId)
+                                                 .getDisplay().get(0).getName());
                 }));
     }
 
-
-    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(KeycloakSession session, AppAuthManager.BearerTokenAuthenticator authenticator) {
-        String issuerDid = "did:web:issuer.org";
-        SdJwtCredentialBuilder testSdJwtCredentialBuilder = new SdJwtCredentialBuilder(issuerDid);
-
-        SdJwtSigningService testCredentialSigningService = new SdJwtSigningService(
-                session,
-                getKeyFromSession(session).getKid(),
-                Algorithm.ES256,
-                Optional.empty(),
-                VerifiableCredentialType.from("https://credentials.example.com/test-credential"),
-                CredentialConfigId.from("test-credential"));
-
-        SdJwtSigningService identityCredentialSigningService = new SdJwtSigningService(
-                session,
-                getKeyFromSession(session).getKid(),
-                Algorithm.ES256,
-                Optional.empty(),
-                VerifiableCredentialType.from("https://credentials.example.com/identity_credential"),
-                CredentialConfigId.from("IdentityCredential"));
+    protected static OID4VCIssuerEndpoint prepareIssuerEndpoint(KeycloakSession session,
+                                                                AppAuthManager.BearerTokenAuthenticator authenticator) {
+        JwtCredentialBuilder testJwtCredentialBuilder = new JwtCredentialBuilder(new StaticTimeProvider(5));
+        SdJwtCredentialBuilder testSdJwtCredentialBuilder = new SdJwtCredentialBuilder();
 
         return new OID4VCIssuerEndpoint(
                 session,
                 Map.of(
-                        testSdJwtCredentialBuilder.getSupportedFormat(), testSdJwtCredentialBuilder
-                ),
-                Map.of(
-                        testCredentialSigningService.locator(), testCredentialSigningService,
-                        identityCredentialSigningService.locator(), identityCredentialSigningService
+                        testSdJwtCredentialBuilder.getSupportedFormat(), testSdJwtCredentialBuilder,
+                        testJwtCredentialBuilder.getSupportedFormat(), testJwtCredentialBuilder
                 ),
                 authenticator,
                 TIME_PROVIDER,
-                30,
-                true);
-    }
-
-    private ComponentExportRepresentation getIdCredentialSigningProvider() {
-        ComponentExportRepresentation componentExportRepresentation = new ComponentExportRepresentation();
-        componentExportRepresentation.setName("sd-jwt-signing_identity_credential");
-        componentExportRepresentation.setId(UUID.randomUUID().toString());
-        componentExportRepresentation.setProviderId(Format.SD_JWT_VC);
-
-        componentExportRepresentation.setConfig(new MultivaluedHashMap<>(
-                Map.of(
-                        "algorithmType", List.of("ES256"),
-                        "vct", List.of("https://credentials.example.com/identity_credential"),
-                        "vcConfigId", List.of("IdentityCredential")
-                )
-        ));
-        return componentExportRepresentation;
-    }
-
-    private ComponentExportRepresentation getTestCredentialSigningProvider() {
-        ComponentExportRepresentation componentExportRepresentation = new ComponentExportRepresentation();
-        componentExportRepresentation.setName("sd-jwt-signing_test-credential");
-        componentExportRepresentation.setId(UUID.randomUUID().toString());
-        componentExportRepresentation.setProviderId(Format.SD_JWT_VC);
-
-        componentExportRepresentation.setConfig(new MultivaluedHashMap<>(
-                Map.of(
-                        "algorithmType", List.of("ES256"),
-                        "vct", List.of("https://credentials.example.com/test-credential"),
-                        "vcConfigId", List.of("test-credential")
-                )
-        ));
-        return componentExportRepresentation;
-    }
-
-    @Override
-    protected ClientRepresentation getTestClient(String clientId) {
-        ClientRepresentation clientRepresentation = new ClientRepresentation();
-        clientRepresentation.setClientId(clientId);
-        clientRepresentation.setProtocol(OID4VCLoginProtocolFactory.PROTOCOL_ID);
-        clientRepresentation.setEnabled(true);
-        clientRepresentation.setProtocolMappers(
-                List.of(
-                        getRoleMapper(clientId, "test-credential"),
-                        getUserAttributeMapper("email", "email", "test-credential"),
-                        getUserAttributeMapper("firstName", "firstName", "test-credential"),
-                        getUserAttributeMapper("lastName", "lastName", "test-credential"),
-                        getJtiGeneratedIdMapper("test-credential"),
-                        getStaticClaimMapper("test-credential", "test-credential"),
-                        getIssuedAtTimeMapper(null, ChronoUnit.HOURS.name(), "COMPUTE", "test-credential"),
-                        getIssuedAtTimeMapper("nbf", null, "COMPUTE", "test-credential"),
-
-                        getUserAttributeMapper("given_name", "firstName", "identity_credential"),
-                        getUserAttributeMapper("family_name", "lastName", "identity_credential"),
-                        getIssuedAtTimeMapper(null, ChronoUnit.MINUTES.name(), "COMPUTE", "identity_credential"),
-                        getIssuedAtTimeMapper("nbf", ChronoUnit.SECONDS.name(), "COMPUTE", "identity_credential")
-                )
-        );
-        return clientRepresentation;
+                30);
     }
 
     private static final String JTI_KEY = "jti";
 
-    public static ProtocolMapperRepresentation getJtiGeneratedIdMapper(String supportedCredentialTypes) {
+    public static ProtocolMapperRepresentation getJtiGeneratedIdMapper() {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
         protocolMapperRepresentation.setName("generated-id-mapper");
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
         protocolMapperRepresentation.setProtocolMapper("oid4vc-generated-id-mapper");
         protocolMapperRepresentation.setConfig(Map.of(
-                OID4VCGeneratedIdMapper.SUBJECT_PROPERTY_CONFIG_KEY, JTI_KEY,
-                "supportedCredentialTypes", supportedCredentialTypes
+                OID4VCGeneratedIdMapper.CLAIM_NAME, JTI_KEY
         ));
         return protocolMapperRepresentation;
     }
 
-    @Override
-    protected ComponentExportRepresentation getKeyProvider() {
-        return getEcKeyProvider();
+    public static ClientScopeModel createCredentialScope(KeycloakSession session) {
+        RealmModel realmModel = session.getContext().getRealm();
+        ClientScopeModel credentialScope = session.clientScopes()
+                                                  .addClientScope(realmModel, jwtTypeCredentialScopeName);
+        credentialScope.setAttribute(CredentialScopeModel.CREDENTIAL_IDENTIFIER,
+                                     jwtTypeCredentialScopeName);
+        credentialScope.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
+        return credentialScope;
     }
 
     @Override
-    protected List<ComponentExportRepresentation> getSigningProviders() {
-        return List.of(getIdCredentialSigningProvider(), getTestCredentialSigningProvider());
-    }
-
-    @Override
-    protected List<ComponentExportRepresentation> getCredentialBuilderProviders() {
-        return List.of(getCredentialBuilderProvider(Format.SD_JWT_VC));
-    }
-
-    @Override
-    protected Map<String, String> getCredentialDefinitionAttributes() {
-        Map<String, String> testCredentialAttributes = Map.ofEntries(
-                Map.entry("vc.test-credential.expiry_in_s", "1800"),
-                Map.entry("vc.test-credential.format", Format.SD_JWT_VC),
-                Map.entry("vc.test-credential.scope", "test-credential"),
-                Map.entry("vc.test-credential.claims", "{ \"firstName\": {\"mandatory\": false, \"display\": [{\"name\": \"First Name\", \"locale\": \"en-US\"}, {\"name\": \"名前\", \"locale\": \"ja-JP\"}]}, \"lastName\": {\"mandatory\": false}, \"email\": {\"mandatory\": false} }"),
-                Map.entry("vc.test-credential.vct", "https://credentials.example.com/test-credential"),
-                Map.entry("vc.test-credential.display.0", "{\n  \"name\": \"Test Credential\"\n}"),
-                Map.entry("vc.test-credential.credential_build_config.token_jws_type", "example+sd-jwt"),
-                Map.entry("vc.test-credential.credential_build_config.hash_algorithm", "sha-256"),
-                Map.entry("vc.test-credential.credential_build_config.visible_claims", "iat,nbf,jti"),
-                Map.entry("vc.test-credential.credential_build_config.decoys", "2")
-        );
-
-        Map<String, String> identityCredentialAttributes = Map.ofEntries(
-                Map.entry("vc.IdentityCredential.expiry_in_s", "31536000"),
-                Map.entry("vc.IdentityCredential.format", Format.SD_JWT_VC),
-                Map.entry("vc.IdentityCredential.scope", "identity_credential"),
-                Map.entry("vc.IdentityCredential.vct", "https://credentials.example.com/identity_credential"),
-                Map.entry("vc.IdentityCredential.cryptographic_binding_methods_supported", "jwk"),
-                Map.entry("vc.IdentityCredential.claims", "{\"given_name\":{\"display\":[{\"name\":\"الاسم الشخصي\",\"locale\":\"ar\"},{\"name\":\"Vorname\",\"locale\":\"de\"},{\"name\":\"Given Name\",\"locale\":\"en\"},{\"name\":\"Nombre\",\"locale\":\"es\"},{\"name\":\"نام\",\"locale\":\"fa\"},{\"name\":\"Etunimi\",\"locale\":\"fi\"},{\"name\":\"Prénom\",\"locale\":\"fr\"},{\"name\":\"पहचानी गई नाम\",\"locale\":\"hi\"},{\"name\":\"Nome\",\"locale\":\"it\"},{\"name\":\"名\",\"locale\":\"ja\"},{\"name\":\"Овог нэр\",\"locale\":\"mn\"},{\"name\":\"Voornaam\",\"locale\":\"nl\"},{\"name\":\"Nome Próprio\",\"locale\":\"pt\"},{\"name\":\"Förnamn\",\"locale\":\"sv\"},{\"name\":\"مسلمان نام\",\"locale\":\"ur\"}]},\"family_name\":{\"display\":[{\"name\":\"اسم العائلة\",\"locale\":\"ar\"},{\"name\":\"Nachname\",\"locale\":\"de\"},{\"name\":\"Family Name\",\"locale\":\"en\"},{\"name\":\"Apellido\",\"locale\":\"es\"},{\"name\":\"نام خانوادگی\",\"locale\":\"fa\"},{\"name\":\"Sukunimi\",\"locale\":\"fi\"},{\"name\":\"Nom de famille\",\"locale\":\"fr\"},{\"name\":\"परिवार का नाम\",\"locale\":\"hi\"},{\"name\":\"Cognome\",\"locale\":\"it\"},{\"name\":\"姓\",\"locale\":\"ja\"},{\"name\":\"өөрийн нэр\",\"locale\":\"mn\"},{\"name\":\"Achternaam\",\"locale\":\"nl\"},{\"name\":\"Sobrenome\",\"locale\":\"pt\"},{\"name\":\"Efternamn\",\"locale\":\"sv\"},{\"name\":\"خاندانی نام\",\"locale\":\"ur\"}]},\"birthdate\":{\"display\":[{\"name\":\"تاريخ الميلاد\",\"locale\":\"ar\"},{\"name\":\"Geburtsdatum\",\"locale\":\"de\"},{\"name\":\"Date of Birth\",\"locale\":\"en\"},{\"name\":\"Fecha de Nacimiento\",\"locale\":\"es\"},{\"name\":\"تاریخ تولد\",\"locale\":\"fa\"},{\"name\":\"Syntymäaika\",\"locale\":\"fi\"},{\"name\":\"Date de naissance\",\"locale\":\"fr\"},{\"name\":\"जन्म की तारीख\",\"locale\":\"hi\"},{\"name\":\"Data di nascita\",\"locale\":\"it\"},{\"name\":\"生年月日\",\"locale\":\"ja\"},{\"name\":\"төрсөн өдөр\",\"locale\":\"mn\"},{\"name\":\"Geboortedatum\",\"locale\":\"nl\"},{\"name\":\"Data de Nascimento\",\"locale\":\"pt\"},{\"name\":\"Födelsedatum\",\"locale\":\"sv\"},{\"name\":\"تاریخ پیدائش\",\"locale\":\"ur\"}]}}"),
-                Map.entry("vc.IdentityCredential.display.0", "{\"name\": \"Identity Credential\"}"),
-                Map.entry("vc.IdentityCredential.proof_types_supported", "{\"jwt\":{\"proof_signing_alg_values_supported\":[\"ES256\"]}}"),
-                Map.entry("vc.IdentityCredential.credential_build_config.token_jws_type", "example+sd-jwt"),
-                Map.entry("vc.IdentityCredential.credential_build_config.hash_algorithm", "sha-256"),
-                Map.entry("vc.IdentityCredential.credential_build_config.visible_claims", "iat,nbf,jti"),
-                Map.entry("vc.IdentityCredential.credential_build_config.decoys", "0")
-        );
-
-        HashedMap<String, String> allAttributes = new HashedMap<>();
-        allAttributes.putAll(testCredentialAttributes);
-        allAttributes.putAll(identityCredentialAttributes);
-
-        return allAttributes;
+    protected ComponentExportRepresentation getKeyProvider() {
+        return getEcKeyProvider();
     }
 
     static class TestCredentialResponseHandler extends CredentialResponseHandler {
@@ -386,9 +545,9 @@ static class TestCredentialResponseHandler extends CredentialResponseHandler {
         }
 
         @Override
-        protected void handleCredentialResponse(CredentialResponse credentialResponse) throws VerificationException {
+        protected void handleCredentialResponse(CredentialResponse credentialResponse, ClientScopeRepresentation clientScope) throws VerificationException {
             // SDJWT have a special format.
-            SdJwtVP sdJwtVP = SdJwtVP.of(credentialResponse.getCredential().toString());
+            SdJwtVP sdJwtVP = SdJwtVP.of(credentialResponse.getCredentials().get(0).getCredential().toString());
             JsonWebToken jsonWebToken = TokenVerifier.create(sdJwtVP.getIssuerSignedJWT().toJws(), JsonWebToken.class).getToken();
 
             assertNotNull("A valid credential string should have been responded", jsonWebToken);
@@ -408,14 +567,17 @@ protected void handleCredentialResponse(CredentialResponse credentialResponse) t
                     .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
             assertFalse("Only mappers supported for the requested type should have been evaluated.", disclosureMap.containsKey("given_name"));
             assertTrue("The credentials should include the firstName claim.", disclosureMap.containsKey("firstName"));
-            assertEquals("firstName claim incorrectly mapped.", disclosureMap.get("firstName").get(2).asText(), "John");
+            assertEquals("firstName claim incorrectly mapped.", "John", disclosureMap.get("firstName").get(2).asText());
             assertTrue("The credentials should include the lastName claim.", disclosureMap.containsKey("lastName"));
-            assertEquals("lastName claim incorrectly mapped.", disclosureMap.get("lastName").get(2).asText(), "Doe");
+            assertEquals("lastName claim incorrectly mapped.", "Doe", disclosureMap.get("lastName").get(2).asText());
             assertTrue("The credentials should include the roles claim.", disclosureMap.containsKey("roles"));
-            assertTrue("The credentials should include the test-credential claim.", disclosureMap.containsKey("test-credential"));
-            assertTrue("lastName claim incorrectly mapped.", disclosureMap.get("test-credential").get(2).asBoolean());
+            assertTrue("The credentials should include the scope-name claim.",
+                       disclosureMap.containsKey("scope-name"));
+            assertEquals("The credentials should include the scope-name claims correct value.",
+                         clientScope.getName(),
+                         disclosureMap.get("scope-name").get(2).textValue());
             assertTrue("The credentials should include the email claim.", disclosureMap.containsKey("email"));
-            assertEquals("email claim incorrectly mapped.", disclosureMap.get("email").get(2).asText(), "john@email.cz");
+            assertEquals("email claim incorrectly mapped.", "john@email.cz", disclosureMap.get("email").get(2).asText());
 
             assertNotNull("Test credential shall include an iat claim.", jsonWebToken.getIat());
             assertNotNull("Test credential shall include an nbf claim.", jsonWebToken.getNbf());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java
index dd0c096cf38e..51b23a84af41 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/OID4VCTest.java
@@ -17,32 +17,58 @@
 
 package org.keycloak.testsuite.oid4vc.issuance.signing;
 
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
+import com.fasterxml.jackson.core.type.TypeReference;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
+import org.apache.http.HttpStatus;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.jboss.logging.Logger;
+import org.junit.Assert;
+import org.keycloak.admin.client.resource.ClientScopeResource;
+import org.keycloak.admin.client.resource.ProtocolMappersResource;
 import org.keycloak.common.Profile;
 import org.keycloak.common.util.CertificateUtils;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.PemUtils;
+import org.keycloak.constants.Oid4VciConstants;
+import org.keycloak.crypto.ECDSASignatureSignerContext;
 import org.keycloak.crypto.KeyUse;
 import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jwk.JWKBuilder;
+import org.keycloak.jose.jws.JWSBuilder;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.protocol.oid4vc.OID4VCLoginProtocolFactory;
+import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint;
 import org.keycloak.protocol.oid4vc.issuance.TimeProvider;
+import org.keycloak.protocol.oid4vc.issuance.keybinding.JwtProofValidator;
 import org.keycloak.protocol.oid4vc.issuance.mappers.OID4VCIssuedAtTimeClaimMapper;
 import org.keycloak.protocol.oid4vc.model.CredentialSubject;
-import org.keycloak.protocol.oid4vc.model.Format;
+import org.keycloak.protocol.oid4vc.model.NonceResponse;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
 import org.keycloak.representations.idm.ComponentExportRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.RoleRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.util.JsonSerialization;
 
+import java.io.IOException;
 import java.net.URI;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
@@ -53,12 +79,15 @@
 import java.security.Security;
 import java.security.cert.Certificate;
 import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
 
+import static org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCSdJwtIssuingEndpointTest.getJtiGeneratedIdMapper;
+
 /**
  * Super class for all OID4VC tests. Provides convenience methods to ease the testing.
  */
@@ -74,6 +103,14 @@ public abstract class OID4VCTest extends AbstractTestRealmKeycloakTest {
 
     protected static final KeyWrapper RSA_KEY = getRsaKey();
 
+    protected static final String sdJwtTypeCredentialScopeName = "sd-jwt-credential";
+    protected static final String sdJwtTypeCredentialConfigurationIdName = "sd-jwt-credential-config-id";
+
+    protected static final String jwtTypeCredentialScopeName = "jwt-credential";
+    protected static final String jwtTypeCredentialConfigurationIdName = "jwt-credential-config-id";
+
+    protected static final String TEST_CREDENTIAL_MAPPERS_FILE = "/oid4vc/test-credential-mappers.json";
+
     protected static CredentialSubject getCredentialSubject(Map<String, Object> claims) {
         CredentialSubject credentialSubject = new CredentialSubject();
         claims.forEach(credentialSubject::setClaims);
@@ -185,31 +222,9 @@ protected ClientRepresentation getTestClient(String clientId) {
         clientRepresentation.setClientId(clientId);
         clientRepresentation.setProtocol(OID4VCLoginProtocolFactory.PROTOCOL_ID);
         clientRepresentation.setEnabled(true);
-        clientRepresentation.setProtocolMappers(
-                List.of(
-                        getRoleMapper(clientId, "VerifiableCredential"),
-                        getUserAttributeMapper("email", "email", "VerifiableCredential"),
-                        getIdMapper("VerifiableCredential"),
-                        getStaticClaimMapper("VerifiableCredential", "VerifiableCredential"),
-                        // This is used for negative test. Shall not land into the credential
-                        getStaticClaimMapper("AnotherCredentialType", "AnotherCredentialType")
-                )
-        );
         return clientRepresentation;
     }
 
-    public static Map<String, String> getTestCredentialDefinitionAttributes() {
-        return Map.of(
-                "vc.test-credential.expiry_in_s", "100",
-                "vc.test-credential.format", Format.JWT_VC,
-                "vc.test-credential.scope", "VerifiableCredential",
-                "vc.test-credential.claims", "{ \"firstName\": {\"mandatory\": false, \"display\": [{\"name\": \"First Name\", \"locale\": \"en-US\"}, {\"name\": \"名前\", \"locale\": \"ja-JP\"}]}, \"lastName\": {\"mandatory\": false}, \"email\": {\"mandatory\": false} }",
-                "vc.test-credential.display.0","{\n  \"name\": \"Test Credential\"\n}",
-                "vc.test-credential.credential_build_config.token_jws_type", "JWT"
-                // Moved sd-jwt specific attributes to: org.keycloak.testsuite.oid4vc.issuance.signing.OID4VCSdJwtIssuingEndpointTest.getTestCredentialSigningProvider
-        );
-    }
-
     protected ComponentExportRepresentation getEdDSAKeyProvider() {
         ComponentExportRepresentation componentExportRepresentation = new ComponentExportRepresentation();
         componentExportRepresentation.setName("eddsa-generated");
@@ -232,50 +247,74 @@ protected ComponentExportRepresentation getEcKeyProvider() {
         componentExportRepresentation.setConfig(new MultivaluedHashMap<>(
                 Map.of(
                         "ecdsaEllipticCurveKey", List.of("P-256"),
-                        "algorithm", List.of("ES256")                        ))
-        );
+                        "algorithm", List.of("ES256"))
+        ));
         return componentExportRepresentation;
     }
 
-    public static ProtocolMapperRepresentation getRoleMapper(String clientId, String supportedCredentialTypes) {
+    public void addProtocolMappersToClientScope(ClientScopeRepresentation clientScope,
+                                                List<ProtocolMapperRepresentation> protocolMappers) {
+        String scopeId = clientScope.getId();
+        String scopeName = clientScope.getName();
+
+        if (protocolMappers.isEmpty()) {
+            return;
+        }
+
+        ClientScopeResource clientScopeResource = testRealm().clientScopes().get(scopeId);
+        ProtocolMappersResource protocolMappersResource = clientScopeResource.getProtocolMappers();
+
+        for (ProtocolMapperRepresentation protocolMapper : protocolMappers) {
+            Response response = protocolMappersResource.createMapper(protocolMapper);
+            if (response.getStatus() != 201) {
+                LOGGER.errorf("Failed to create protocol mapper: {} for scope: {}", protocolMapper, scopeName);
+            }
+        }
+    }
+
+    public List<ProtocolMapperRepresentation> getProtocolMappers(String scopeName) {
+        return List.of(
+                getRoleMapper(),
+                getUserAttributeMapper("email", "email"),
+                getUserAttributeMapper("firstName", "firstName"),
+                getUserAttributeMapper("lastName", "lastName"),
+                getJtiGeneratedIdMapper(),
+                getStaticClaimMapper(scopeName),
+                getIssuedAtTimeMapper("iat", ChronoUnit.HOURS.name(), "COMPUTE"),
+                getIssuedAtTimeMapper("nbf", null, "COMPUTE"));
+    }
+
+    public static ProtocolMapperRepresentation getRoleMapper() {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
         protocolMapperRepresentation.setName("role-mapper");
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setProtocolMapper("oid4vc-target-role-mapper");
         protocolMapperRepresentation.setConfig(
-                Map.of(
-                        "subjectProperty", "roles",
-                        "clientId", clientId,
-                        "supportedCredentialTypes", supportedCredentialTypes)
+                Map.of("claim.name", "roles")
         );
         return protocolMapperRepresentation;
     }
 
-    public static ProtocolMapperRepresentation getIdMapper(String supportedCredentialTypes) {
+    public static ProtocolMapperRepresentation getIdMapper() {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
         protocolMapperRepresentation.setName("id-mapper");
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
         protocolMapperRepresentation.setProtocolMapper("oid4vc-subject-id-mapper");
-        protocolMapperRepresentation.setConfig(
-                Map.of(
-                        "supportedCredentialTypes", supportedCredentialTypes)
-        );
+        protocolMapperRepresentation.setConfig(Map.of());
         return protocolMapperRepresentation;
     }
 
-    public static ProtocolMapperRepresentation getStaticClaimMapper(String scope, String supportedCredentialTypes) {
+    public static ProtocolMapperRepresentation getStaticClaimMapper(String scopeName) {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
         protocolMapperRepresentation.setName(UUID.randomUUID().toString());
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
         protocolMapperRepresentation.setProtocolMapper("oid4vc-static-claim-mapper");
         protocolMapperRepresentation.setConfig(
-                Map.of(
-                        "subjectProperty", scope,
-                        "staticValue", "true",
-                        "supportedCredentialTypes", supportedCredentialTypes)
+                Map.of("claim.name", "scope-name",
+                       "staticValue", scopeName)
         );
         return protocolMapperRepresentation;
     }
@@ -294,19 +333,8 @@ public static KeyWrapper getKeyFromSession(KeycloakSession keycloakSession) {
         return kw;
     }
 
-    public static ComponentExportRepresentation getJwtSigningProvider(KeyWrapper keyWrapper) {
-        ComponentExportRepresentation componentExportRepresentation = new ComponentExportRepresentation();
-        componentExportRepresentation.setName("jwt-signing-service");
-        componentExportRepresentation.setId(UUID.randomUUID().toString());
-        componentExportRepresentation.setProviderId("jwt_vc");
-
-        componentExportRepresentation.setConfig(new MultivaluedHashMap<>(
-                Map.of(
-                        "keyId", List.of(keyWrapper.getKid()),
-                        "algorithmType", List.of(keyWrapper.getAlgorithm())
-                )
-        ));
-        return componentExportRepresentation;
+    public static String getKeyIdFromSession(KeycloakSession keycloakSession) {
+        return getKeyFromSession(keycloakSession).getKid();
     }
 
     public static ComponentExportRepresentation getCredentialBuilderProvider(String vcFormat) {
@@ -365,32 +393,30 @@ public long currentTimeMillis() {
         }
     }
 
-    protected ProtocolMapperRepresentation getUserAttributeMapper(String subjectProperty, String attributeName, String supportedCredentialTypes) {
+    protected ProtocolMapperRepresentation getUserAttributeMapper(String subjectProperty, String attributeName) {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
-        protocolMapperRepresentation.setName(supportedCredentialTypes + "-" + attributeName + "-mapper");
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setName(attributeName + "-mapper");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
         protocolMapperRepresentation.setProtocolMapper("oid4vc-user-attribute-mapper");
         protocolMapperRepresentation.setConfig(
                 Map.of(
-                        "subjectProperty", subjectProperty,
-                        "userAttribute", attributeName,
-                        "supportedCredentialTypes", supportedCredentialTypes)
+                        "claim.name", subjectProperty,
+                        "userAttribute", attributeName)
         );
         return protocolMapperRepresentation;
     }
 
-    protected ProtocolMapperRepresentation getIssuedAtTimeMapper(String subjectProperty, String truncateToTimeUnit, String valueSource, String supportedCredentialTypes) {
+    protected ProtocolMapperRepresentation getIssuedAtTimeMapper(String subjectProperty, String truncateToTimeUnit, String valueSource) {
         ProtocolMapperRepresentation protocolMapperRepresentation = new ProtocolMapperRepresentation();
-        protocolMapperRepresentation.setName(supportedCredentialTypes + "-" + subjectProperty + "-oid4vc-issued-at-time-claim-mapper");
-        protocolMapperRepresentation.setProtocol("oid4vc");
+        protocolMapperRepresentation.setName(subjectProperty + "-oid4vc-issued-at-time-claim-mapper");
+        protocolMapperRepresentation.setProtocol(Oid4VciConstants.OID4VC_PROTOCOL);
         protocolMapperRepresentation.setId(UUID.randomUUID().toString());
         protocolMapperRepresentation.setProtocolMapper("oid4vc-issued-at-time-claim-mapper");
 
         Map<String, String> configMap = new HashMap<>();
-        configMap.put("supportedCredentialTypes", supportedCredentialTypes);
         Optional.ofNullable(subjectProperty)
-                .ifPresent(value -> configMap.put(OID4VCIssuedAtTimeClaimMapper.SUBJECT_PROPERTY_CONFIG_KEY, value));
+                .ifPresent(value -> configMap.put(OID4VCIssuedAtTimeClaimMapper.CLAIM_NAME, value));
         Optional.ofNullable(truncateToTimeUnit)
                 .ifPresent(value -> configMap.put(OID4VCIssuedAtTimeClaimMapper.TRUNCATE_TO_TIME_UNIT_KEY, value));
         Optional.ofNullable(valueSource)
@@ -399,4 +425,117 @@ protected ProtocolMapperRepresentation getIssuedAtTimeMapper(String subjectPrope
         protocolMapperRepresentation.setConfig(configMap);
         return protocolMapperRepresentation;
     }
+
+    public static String generateJwtProof(String aud, String nonce) {
+        KeyWrapper keyWrapper = getECKey(null);
+        keyWrapper.setKid(null); // erase the autogenerated one
+
+        // JWK public key
+        JWK jwk = JWKBuilder.create().ec(keyWrapper.getPublicKey());
+
+        return generateUnsignedJwtProof(jwk, aud, nonce)
+                .sign(new ECDSASignatureSignerContext(keyWrapper));
+    }
+
+    public static String generateInvalidJwtProof(String aud, String nonce) {
+        KeyWrapper keyWrapper = getECKey(null);
+        keyWrapper.setKid(null); // erase the autogenerated one
+
+        KeyWrapper unrelatedKeyWrapper = getECKey(null);
+        unrelatedKeyWrapper.setKid(null); // erase the autogenerated one
+
+        // JWK public key
+        JWK jwk = JWKBuilder.create().ec(keyWrapper.getPublicKey());
+
+        // Sign with an unrelated key
+        return generateUnsignedJwtProof(jwk, aud, nonce)
+                .sign(new ECDSASignatureSignerContext(unrelatedKeyWrapper));
+    }
+
+    public static JWSBuilder.EncodingBuilder generateUnsignedJwtProof(JWK jwk, String aud, String nonce) {
+        AccessToken token = new AccessToken();
+        token.addAudience(aud);
+        token.setNonce(nonce);
+        token.issuedNow();
+
+        return new JWSBuilder()
+                .type(JwtProofValidator.PROOF_JWT_TYP)
+                .jwk(jwk)
+                .jsonContent(token);
+    }
+
+    public static String getCNonce() {
+        UriBuilder builder = UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT);
+        URI oid4vcUri = RealmsResource.protocolUrl(builder).build(AbstractTestRealmKeycloakTest.TEST_REALM_NAME,
+                                                                  OID4VCLoginProtocolFactory.PROTOCOL_ID);
+        String nonceUrl = String.format("%s/%s", oid4vcUri.toString(), OID4VCIssuerEndpoint.NONCE_PATH);
+
+        String nonceResponseString;
+        // request cNonce
+        try (Client client = AdminClientUtil.createResteasyClient()) {
+            WebTarget nonceTarget = client.target(nonceUrl);
+            // the nonce endpoint must be unprotected, and therefore it must be accessible without any authentication
+            Invocation.Builder nonceInvocationBuilder = nonceTarget.request()
+                                                                   // just making sure that no authentication is added
+                                                                   // by interceptors or similar
+                                                                   .header(HttpHeaders.AUTHORIZATION, null)
+                                                                   .header(HttpHeaders.COOKIE, null);
+
+            try (Response response = nonceInvocationBuilder.post(null)) {
+                Assert.assertEquals(HttpStatus.SC_OK, response.getStatus());
+                Assert.assertTrue(response.getMediaType().toString().startsWith(MediaType.APPLICATION_JSON_TYPE.toString()));
+                nonceResponseString = parseResponse(response);
+                Assert.assertNotNull(nonceResponseString);
+                Assert.assertEquals("no-store", response.getHeaderString(HttpHeaders.CACHE_CONTROL));
+            }
+        }
+        NonceResponse nonceResponse;
+        try {
+            nonceResponse = JsonSerialization.readValue(nonceResponseString, NonceResponse.class);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+        return nonceResponse.getNonce();
+    }
+
+    public static String parseResponse(Response response) {
+        try {
+            return response.readEntity(String.class);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static <T> T fromJsonString(String representation, Class<T> clazz)
+    {
+        try {
+            return JsonSerialization.readValue(representation, clazz);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static <T> T fromJsonString(String representation, TypeReference<T> typeReference)
+    {
+        if (representation == null) {
+            return null;
+        }
+        try {
+            return JsonSerialization.readValue(representation, typeReference);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static String toJsonString(Object object)
+    {
+        if (object == null) {
+            return null;
+        }
+        try {
+            return JsonSerialization.writeValueAsString(object);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtCredentialSignerTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtCredentialSignerTest.java
new file mode 100644
index 000000000000..1453c90a0d12
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtCredentialSignerTest.java
@@ -0,0 +1,346 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.oid4vc.issuance.signing;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.junit.Test;
+import org.keycloak.TokenVerifier;
+import org.keycloak.common.VerificationException;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
+import org.keycloak.crypto.KeyWrapper;
+import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
+import org.keycloak.crypto.SignatureVerifierContext;
+import org.keycloak.jose.jws.crypto.HashUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.LDCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBody;
+import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBuilder;
+import org.keycloak.protocol.oid4vc.issuance.signing.CredentialSignerException;
+import org.keycloak.protocol.oid4vc.issuance.signing.SdJwtCredentialSigner;
+import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
+import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.sdjwt.SdJwtUtils;
+import org.keycloak.testsuite.runonserver.RunOnServerException;
+import org.keycloak.util.JsonSerialization;
+
+import java.security.PublicKey;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.List;
+import java.util.Map;
+import java.util.StringJoiner;
+import java.util.UUID;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+public class SdJwtCredentialSignerTest extends OID4VCTest {
+
+    private static final KeyWrapper rsaKey = getRsaKey();
+
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedCredentialBody() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session -> new SdJwtCredentialSigner(session).signCredential(
+                            new LDCredentialBody(getTestCredential(Map.of())),
+                            new CredentialBuildConfig()
+                    ));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unsupported algorithm is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testUnsupportedAlgorithm() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignSDJwtCredential(
+                                    session,
+                                    getKeyIdFromSession(session),
+                                    null,
+                                    "unsupported-algorithm",
+                                    Map.of(),
+                                    0,
+                                    List.of()));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    // If an unknown key is provided, signing should reliably fail.
+    @Test(expected = CredentialSignerException.class)
+    public void testFailIfNoKey() throws Throwable {
+        try {
+            getTestingClient()
+                    .server(TEST_REALM_NAME)
+                    .run(session ->
+                            testSignSDJwtCredential(
+                                    session,
+                                    "no-such-key",
+                                    null,
+                                    Algorithm.RS256,
+                                    Map.of(),
+                                    0,
+                                    List.of()));
+        } catch (RunOnServerException ros) {
+            throw ros.getCause();
+        }
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithClaims() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignSDJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                null,
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c")),
+                                0,
+                                List.of()));
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithVisibleClaims() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignSDJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                null,
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c")),
+                                0,
+                                List.of("test")));
+    }
+
+
+    @Test
+    public void testRsaSignedCredentialWithClaimsAndDecoys() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignSDJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                null,
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c")),
+                                6,
+                                List.of()));
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithKeyId() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignSDJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                "did:web:test.org#key-id",
+                                Algorithm.RS256,
+                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
+                                        "test", "test",
+                                        "arrayClaim", List.of("a", "b", "c")),
+                                0,
+                                List.of()));
+    }
+
+    @Test
+    public void testRsaSignedCredentialWithoutAdditionalClaims() {
+        getTestingClient()
+                .server(TEST_REALM_NAME)
+                .run(session ->
+                        testSignSDJwtCredential(
+                                session,
+                                getKeyIdFromSession(session),
+                                null,
+                                Algorithm.RS256,
+                                Map.of(),
+                                0,
+                                List.of()));
+    }
+
+    public static void testSignSDJwtCredential(KeycloakSession session, String signingKeyId, String overrideKeyId, String
+            algorithm, Map<String, Object> claims, int decoys, List<String> visibleClaims) {
+        CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
+                .setCredentialIssuer(TEST_DID.toString())
+                .setCredentialType("https://credentials.example.com/test-credential")
+                .setTokenJwsType("example+sd-jwt")
+                .setHashAlgorithm("sha-256")
+                .setNumberOfDecoys(decoys)
+                .setSdJwtVisibleClaims(visibleClaims)
+                .setSigningKeyId(signingKeyId)
+                .setSigningAlgorithm(algorithm)
+                .setOverrideKeyId(overrideKeyId);
+
+        SdJwtCredentialSigner sdJwtCredentialSigner = new SdJwtCredentialSigner(session);
+
+        VerifiableCredential testCredential = getTestCredential(claims);
+        SdJwtCredentialBody sdJwtCredentialBody = new SdJwtCredentialBuilder()
+                .buildCredentialBody(testCredential, credentialBuildConfig);
+
+        String sdJwt = sdJwtCredentialSigner.signCredential(sdJwtCredentialBody, credentialBuildConfig);
+
+        KeyWrapper keyWrapper = getKeyFromSession(session);
+        SignatureVerifierContext verifierContext = null;
+        switch (algorithm) {
+            case Algorithm.ES256: {
+                verifierContext = new ServerECDSASignatureVerifierContext(keyWrapper);
+                break;
+            }
+            case Algorithm.RS256: {
+                verifierContext = new AsymmetricSignatureVerifierContext(keyWrapper);
+                break;
+            }
+            default: {
+                fail("Algorithm not supported.");
+            }
+        }
+        // the sd-jwt is dot-concatenated header.payload.signature~disclosure1~___~disclosureN
+        // we first split the disclosuers
+        String[] splittedSdToken = sdJwt.split("~");
+        // and then split the actual token part
+        String[] splittedToken = splittedSdToken[0].split("\\.");
+
+        String jwt = new StringJoiner(".")
+                // header
+                .add(splittedToken[0])
+                // payload
+                .add(splittedToken[1])
+                // signature
+                .add(splittedToken[2])
+                .toString();
+        TokenVerifier<JsonWebToken> verifier = TokenVerifier
+                .create(jwt, JsonWebToken.class)
+                .verifierContext(verifierContext);
+        verifier.publicKey((PublicKey) keyWrapper.getPublicKey());
+        try {
+            verifier.verify();
+        } catch (VerificationException e) {
+            fail("The credential should successfully be verified.");
+        }
+        try {
+            JsonWebToken theToken = verifier.getToken();
+
+            assertEquals("The issuer should be set in the token.", TEST_DID.toString(), theToken.getIssuer());
+            assertEquals("The type should be included", "https://credentials.example.com/test-credential", theToken.getOtherClaims().get("vct"));
+            List<String> sds = (List<String>) theToken.getOtherClaims().get("_sd");
+            if (sds != null && !sds.isEmpty()) {
+                assertEquals("The algorithm should be included", "sha-256", theToken.getOtherClaims().get("_sd_alg"));
+            }
+            List<String> disclosed = Arrays.asList(splittedSdToken).subList(1, splittedSdToken.length);
+            int numSds = sds != null ? sds.size() : 0;
+            assertEquals("All undisclosed claims and decoys should be provided.", disclosed.size() + decoys, numSds);
+            verifyDisclosures(sds, disclosed);
+
+            visibleClaims
+                    .forEach(vc -> assertTrue("The visible claims should be present within the token.", theToken.getOtherClaims().containsKey(vc)));
+        } catch (VerificationException e) {
+            fail("Was not able to extract the token.");
+        }
+    }
+
+    private static void verifyDisclosures(List<String> undisclosed, List<String> disclosedList) {
+        disclosedList.stream()
+                .map(disclosed -> new String(Base64.getUrlDecoder().decode(disclosed)))
+                .map(disclosedString -> {
+                    try {
+                        return JsonSerialization.mapper.readValue(disclosedString, List.class);
+                    } catch (JsonProcessingException e) {
+                        throw new RuntimeException(e);
+                    }
+                })
+                .map(dl -> new DisclosedClaim((String) dl.get(0), (String) dl.get(1), dl.get(2)))
+                .forEach(dc -> assertTrue("Every disclosure claim should be provided in the undisclosures.", undisclosed.contains(dc.getHash())));
+
+    }
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        if (testRealm.getComponents() != null) {
+            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(rsaKey));
+        } else {
+            testRealm.setComponents(new MultivaluedHashMap<>(
+                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(rsaKey)))));
+        }
+    }
+
+    static class DisclosedClaim {
+        private final String salt;
+        private final String key;
+        private final Object value;
+        private final String hash;
+
+        DisclosedClaim(String salt, String key, Object value) {
+            this.salt = salt;
+            this.key = key;
+            this.value = value;
+            this.hash = createHash(salt, key, value);
+        }
+
+        private String createHash(String salt, String key, Object value) {
+            try {
+                return SdJwtUtils.encodeNoPad(
+                        HashUtils.hash("sha-256",
+                                SdJwtUtils.encodeNoPad(
+                                        SdJwtUtils.printJsonArray(List.of(salt, key, value).toArray()).getBytes()).getBytes()));
+            } catch (JsonProcessingException e) {
+                throw new RuntimeException(e);
+            }
+
+        }
+
+        public String getSalt() {
+            return salt;
+        }
+
+        public String getKey() {
+            return key;
+        }
+
+        public Object getValue() {
+            return value;
+        }
+
+        public String getHash() {
+            return hash;
+        }
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtSigningServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtSigningServiceTest.java
deleted file mode 100644
index 2c8faf6c4d5c..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oid4vc/issuance/signing/SdJwtSigningServiceTest.java
+++ /dev/null
@@ -1,332 +0,0 @@
-/*
- * Copyright 2024 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.testsuite.oid4vc.issuance.signing;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import org.junit.Test;
-import org.keycloak.TokenVerifier;
-import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.crypto.Algorithm;
-import org.keycloak.crypto.AsymmetricSignatureVerifierContext;
-import org.keycloak.crypto.KeyWrapper;
-import org.keycloak.crypto.ServerECDSASignatureVerifierContext;
-import org.keycloak.crypto.SignatureVerifierContext;
-import org.keycloak.jose.jws.crypto.HashUtils;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.protocol.oid4vc.issuance.VCIssuanceContext;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBody;
-import org.keycloak.protocol.oid4vc.issuance.credentialbuilder.SdJwtCredentialBuilder;
-import org.keycloak.protocol.oid4vc.issuance.signing.SdJwtSigningService;
-import org.keycloak.protocol.oid4vc.issuance.signing.SigningServiceException;
-import org.keycloak.protocol.oid4vc.model.CredentialBuildConfig;
-import org.keycloak.protocol.oid4vc.model.CredentialConfigId;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
-import org.keycloak.protocol.oid4vc.model.VerifiableCredentialType;
-import org.keycloak.representations.JsonWebToken;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.sdjwt.SdJwtUtils;
-import org.keycloak.testsuite.runonserver.RunOnServerException;
-import org.keycloak.util.JsonSerialization;
-
-import java.security.PublicKey;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.StringJoiner;
-import java.util.UUID;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-public class SdJwtSigningServiceTest extends OID4VCTest {
-
-    private static final KeyWrapper rsaKey = getRsaKey();
-
-    // If an unsupported algorithm is provided, the JWT Signing Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testUnsupportedAlgorithm() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new SdJwtSigningService(
-                                    session,
-                                    getKeyFromSession(session).getKid(),
-                                    "unsupported-algorithm",
-                                    Optional.empty(),
-                                    VerifiableCredentialType.from("https://credentials.example.com/test-credential"),
-                                    CredentialConfigId.from("test-credential")));
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    // If no key is provided, the JWT Signing Service should not be instantiated.
-    @Test(expected = SigningServiceException.class)
-    public void testFailIfNoKey() throws Throwable {
-        try {
-            getTestingClient()
-                    .server(TEST_REALM_NAME)
-                    .run(session ->
-                            new SdJwtSigningService(
-                                    session,
-                                    "no-such-key",
-                                    Algorithm.RS256,
-                                    Optional.empty(),
-                                    VerifiableCredentialType.from("https://credentials.example.com/test-credential"),
-                                    CredentialConfigId.from("test-credential")));
-        } catch (RunOnServerException ros) {
-            throw ros.getCause();
-        }
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithClaims() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignSDJwtCredential(
-                                session,
-                                Optional.empty(),
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c")),
-                                0,
-                                List.of()));
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithVisibleClaims() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignSDJwtCredential(
-                                session,
-                                Optional.empty(),
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c")),
-                                0,
-                                List.of("test")));
-    }
-
-
-    @Test
-    public void testRsaSignedCredentialWithClaimsAndDecoys() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignSDJwtCredential(
-                                session,
-                                Optional.empty(),
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c")),
-                                6,
-                                List.of()));
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithKeyId() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignSDJwtCredential(
-                                session,
-                                Optional.of("did:web:test.org#key-id"),
-                                Algorithm.RS256,
-                                Map.of("id", String.format("uri:uuid:%s", UUID.randomUUID()),
-                                        "test", "test",
-                                        "arrayClaim", List.of("a", "b", "c")),
-                                0,
-                                List.of()));
-    }
-
-    @Test
-    public void testRsaSignedCredentialWithoutAdditionalClaims() {
-        getTestingClient()
-                .server(TEST_REALM_NAME)
-                .run(session ->
-                        testSignSDJwtCredential(
-                                session,
-                                Optional.empty(),
-                                Algorithm.RS256,
-                                Map.of(),
-                                0,
-                                List.of()));
-    }
-
-    public static void testSignSDJwtCredential(KeycloakSession session, Optional<String> keyId, String
-            algorithm, Map<String, Object> claims, int decoys, List<String> visibleClaims) {
-        KeyWrapper keyWrapper = getKeyFromSession(session);
-
-        CredentialBuildConfig credentialBuildConfig = new CredentialBuildConfig()
-                .setCredentialType("https://credentials.example.com/test-credential")
-                .setTokenJwsType("example+sd-jwt")
-                .setHashAlgorithm("sha-256")
-                .setNumberOfDecoys(decoys)
-                .setVisibleClaims(visibleClaims);
-
-        SdJwtSigningService signingService = new SdJwtSigningService(
-                session,
-                keyWrapper.getKid(),
-                algorithm,
-                keyId,
-                VerifiableCredentialType.from("https://credentials.example.com/test-credential"),
-                CredentialConfigId.from("test-credential"));
-
-        VerifiableCredential testCredential = getTestCredential(claims);
-        SdJwtCredentialBody sdJwtCredentialBody = new SdJwtCredentialBuilder("did:web:test.org")
-                .buildCredentialBody(testCredential, credentialBuildConfig);
-
-        VCIssuanceContext context = new VCIssuanceContext().setCredentialBody(sdJwtCredentialBody);
-        String sdJwt = signingService.signCredential(context);
-
-        SignatureVerifierContext verifierContext = null;
-        switch (algorithm) {
-            case Algorithm.ES256: {
-                verifierContext = new ServerECDSASignatureVerifierContext(keyWrapper);
-                break;
-            }
-            case Algorithm.RS256: {
-                verifierContext = new AsymmetricSignatureVerifierContext(keyWrapper);
-                break;
-            }
-            default: {
-                fail("Algorithm not supported.");
-            }
-        }
-        // the sd-jwt is dot-concatenated header.payload.signature~disclosure1~___~disclosureN
-        // we first split the disclosuers
-        String[] splittedSdToken = sdJwt.split("~");
-        // and then split the actual token part
-        String[] splittedToken = splittedSdToken[0].split("\\.");
-
-        String jwt = new StringJoiner(".")
-                // header
-                .add(splittedToken[0])
-                // payload
-                .add(splittedToken[1])
-                // signature
-                .add(splittedToken[2])
-                .toString();
-        TokenVerifier<JsonWebToken> verifier = TokenVerifier
-                .create(jwt, JsonWebToken.class)
-                .verifierContext(verifierContext);
-        verifier.publicKey((PublicKey) keyWrapper.getPublicKey());
-        try {
-            verifier.verify();
-        } catch (VerificationException e) {
-            fail("The credential should successfully be verified.");
-        }
-        try {
-            JsonWebToken theToken = verifier.getToken();
-
-            assertEquals("The issuer should be set in the token.", TEST_DID.toString(), theToken.getIssuer());
-            assertEquals("The type should be included", "https://credentials.example.com/test-credential", theToken.getOtherClaims().get("vct"));
-            List<String> sds = (List<String>) theToken.getOtherClaims().get("_sd");
-            if (sds != null && !sds.isEmpty()){
-                assertEquals("The algorithm should be included", "sha-256", theToken.getOtherClaims().get("_sd_alg"));
-            }
-            List<String> disclosed = Arrays.asList(splittedSdToken).subList(1, splittedSdToken.length);
-            int numSds = sds != null ? sds.size() : 0;
-            assertEquals("All undisclosed claims and decoys should be provided.", disclosed.size() + decoys, numSds);
-            verifyDisclosures(sds, disclosed);
-
-            visibleClaims
-                    .forEach(vc -> assertTrue("The visible claims should be present within the token.",theToken.getOtherClaims().containsKey(vc)));
-        } catch (VerificationException e) {
-            fail("Was not able to extract the token.");
-        }
-    }
-
-    private static void verifyDisclosures(List<String> undisclosed, List<String> disclosedList) {
-        disclosedList.stream()
-                .map(disclosed -> new String(Base64.getUrlDecoder().decode(disclosed)))
-                .map(disclosedString -> {
-                    try {
-                        return JsonSerialization.mapper.readValue(disclosedString, List.class);
-                    } catch (JsonProcessingException e) {
-                        throw new RuntimeException(e);
-                    }
-                })
-                .map(dl -> new DisclosedClaim((String) dl.get(0), (String) dl.get(1), dl.get(2)))
-                .forEach(dc -> assertTrue("Every disclosure claim should be provided in the undisclosures.", undisclosed.contains(dc.getHash())));
-
-    }
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-        if (testRealm.getComponents() != null) {
-            testRealm.getComponents().add("org.keycloak.keys.KeyProvider", getRsaKeyProvider(rsaKey));
-        } else {
-            testRealm.setComponents(new MultivaluedHashMap<>(
-                    Map.of("org.keycloak.keys.KeyProvider", List.of(getRsaKeyProvider(rsaKey)))));
-        }
-    }
-
-    static class DisclosedClaim {
-        private final String salt;
-        private final String key;
-        private final Object value;
-        private final String hash;
-
-        DisclosedClaim(String salt, String key, Object value) {
-            this.salt = salt;
-            this.key = key;
-            this.value = value;
-            this.hash = createHash(salt, key, value);
-        }
-
-        private String createHash(String salt, String key, Object value) {
-            try {
-                return SdJwtUtils.encodeNoPad(
-                        HashUtils.hash("sha-256",
-                                SdJwtUtils.encodeNoPad(
-                                        SdJwtUtils.printJsonArray(List.of(salt, key, value).toArray()).getBytes()).getBytes()));
-            } catch (JsonProcessingException e) {
-                throw new RuntimeException(e);
-            }
-
-        }
-
-        public String getSalt() {
-            return salt;
-        }
-
-        public String getKey() {
-            return key;
-        }
-
-        public Object getValue() {
-            return value;
-        }
-
-        public String getHash() {
-            return hash;
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractOIDCScopeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractOIDCScopeTest.java
index 368b64c55fb1..f7731bc0f86c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractOIDCScopeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractOIDCScopeTest.java
@@ -33,7 +33,8 @@
 import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -60,8 +61,8 @@ protected AbstractOIDCScopeTest.Tokens sendTokenRequest(EventRepresentation logi
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = new OAuthClient.AuthorizationEndpointResponse(oauth).getCode();
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.client(clientId, "password").doAccessTokenRequest(code);
         Assert.assertEquals(200, response.getStatusCode());
 
         // Test scopes
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java
index 774433c89bcc..d912a0e7ed90 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AbstractWellKnownProviderTest.java
@@ -26,9 +26,12 @@
 import org.apache.http.impl.client.HttpClientBuilder;
 import org.junit.After;
 import org.junit.Before;
+import org.junit.FixMethodOrder;
 import org.junit.Test;
+import org.junit.runners.MethodSorters;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.common.Profile;
 import org.keycloak.common.constants.ServiceAccountConstants;
 import org.keycloak.crypto.Algorithm;
@@ -55,7 +58,9 @@
 import org.keycloak.testsuite.forms.LevelOfAssuranceFlowTest;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.util.JsonSerialization;
 
@@ -65,9 +70,13 @@
 import java.util.List;
 import java.util.Map;
 
+import static jakarta.ws.rs.core.HttpHeaders.ACCEPT;
+import static jakarta.ws.rs.core.HttpHeaders.CONTENT_TYPE;
 import static org.junit.Assert.*;
 import static org.junit.Assert.assertEquals;
+import static org.keycloak.utils.MediaType.APPLICATION_JWKS;
 
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
 public abstract class AbstractWellKnownProviderTest extends AbstractKeycloakTest {
 
     private CloseableHttpClient client;
@@ -114,10 +123,9 @@ public void testDiscovery() {
 
             // URIs are filled
             assertEquals(oidcConfig.getAuthorizationEndpoint(), OIDCLoginProtocolService.authUrl(UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT)).build("test").toString());
-            assertEquals(oidcConfig.getTokenEndpoint(), oauth.getAccessTokenUrl());
+            assertEquals(oidcConfig.getTokenEndpoint(), oauth.getEndpoints().getToken());
             assertEquals(oidcConfig.getUserinfoEndpoint(), OIDCLoginProtocolService.userInfoUrl(UriBuilder.fromUri(OAuthClient.AUTH_SERVER_ROOT)).build("test").toString());
-            assertEquals(oidcConfig.getJwksUri(), oauth.getCertsUrl("test"));
-
+            assertEquals(oidcConfig.getJwksUri(), oauth.getEndpoints().getJwks());
 
             String registrationUri = UriBuilder
                     .fromUri(OAuthClient.AUTH_SERVER_ROOT)
@@ -130,9 +138,9 @@ public void testDiscovery() {
 
             // Support standard + implicit + hybrid flow
             assertContains(oidcConfig.getResponseTypesSupported(), OAuth2Constants.CODE, OIDCResponseType.ID_TOKEN, "id_token token", "code id_token", "code token", "code id_token token");
-            assertEquals(7, oidcConfig.getGrantTypesSupported().size());
+            assertEquals(9, oidcConfig.getGrantTypesSupported().size());
             assertContains(oidcConfig.getGrantTypesSupported(), OAuth2Constants.AUTHORIZATION_CODE, OAuth2Constants.IMPLICIT,
-                    OAuth2Constants.DEVICE_CODE_GRANT_TYPE);
+                    OAuth2Constants.DEVICE_CODE_GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
             assertContains(oidcConfig.getResponseModesSupported(), "query", "fragment", "form_post", "jwt", "query.jwt", "fragment.jwt", "form_post.jwt");
 
             Assert.assertNames(oidcConfig.getSubjectTypesSupported(), "pairwise", "public");
@@ -189,7 +197,7 @@ public void testDiscovery() {
             Assert.assertEquals(oidcConfig.getRevocationEndpoint(), mtlsEndpointAliases.getRevocationEndpoint());
 
             // CIBA
-            assertEquals(oidcConfig.getBackchannelAuthenticationEndpoint(), oauth.getBackchannelAuthenticationUrl());
+            assertEquals(oidcConfig.getBackchannelAuthenticationEndpoint(), oauth.getEndpoints().getBackchannelAuthentication());
             assertContains(oidcConfig.getGrantTypesSupported(), OAuth2Constants.CIBA_GRANT_TYPE);
             Assert.assertNames(oidcConfig.getBackchannelTokenDeliveryModesSupported(), "poll", "ping");
             Assert.assertNames(oidcConfig.getBackchannelAuthenticationRequestSigningAlgValuesSupported(), Algorithm.PS256, Algorithm.PS384, Algorithm.PS512, Algorithm.RS256, Algorithm.RS384, Algorithm.RS512, Algorithm.ES256, Algorithm.ES384, Algorithm.ES512, Algorithm.EdDSA);
@@ -198,17 +206,17 @@ public void testDiscovery() {
             Assert.assertTrue(oidcConfig.getBackchannelLogoutSessionSupported());
 
             // Token Revocation
-            assertEquals(oidcConfig.getRevocationEndpoint(), oauth.getTokenRevocationUrl());
+            assertEquals(oidcConfig.getRevocationEndpoint(), oauth.getEndpoints().getRevocation());
             Assert.assertNames(oidcConfig.getRevocationEndpointAuthMethodsSupported(), "client_secret_basic",
                     "client_secret_post", "private_key_jwt", "client_secret_jwt", "tls_client_auth");
             Assert.assertNames(oidcConfig.getRevocationEndpointAuthSigningAlgValuesSupported(), Algorithm.PS256,
                     Algorithm.PS384, Algorithm.PS512, Algorithm.RS256, Algorithm.RS384, Algorithm.RS512, Algorithm.ES256,
                     Algorithm.ES384, Algorithm.ES512, Algorithm.HS256, Algorithm.HS384, Algorithm.HS512, Algorithm.EdDSA);
 
-            assertEquals(oidcConfig.getDeviceAuthorizationEndpoint(), oauth.getDeviceAuthorizationUrl());
+            assertEquals(oidcConfig.getDeviceAuthorizationEndpoint(), oauth.getEndpoints().getDeviceAuthorization());
 
             // Pushed Authorization Request (PAR)
-            assertEquals(oauth.getParEndpointUrl(), oidcConfig.getPushedAuthorizationRequestEndpoint());
+            assertEquals(oauth.getEndpoints().getPushedAuthorizationRequest(), oidcConfig.getPushedAuthorizationRequestEndpoint());
             assertEquals(Boolean.FALSE, oidcConfig.getRequirePushedAuthorizationRequests());
 
             // frontchannel logout
@@ -242,8 +250,8 @@ public void testHttpDiscovery() {
 
     @Test
     public void testIssuerMatches() throws Exception {
-        OAuthClient.AuthorizationEndpointResponse authzResp = oauth.doLogin("test-user@localhost", "password");
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(authzResp.getCode(), "password");
+        AuthorizationEndpointResponse authzResp = oauth.doLogin("test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doAccessTokenRequest(authzResp.getCode());
         assertEquals(200, response.getStatusCode());
         IDToken idToken = oauth.verifyIDToken(response.getIdToken());
 
@@ -291,6 +299,17 @@ public void certs() throws IOException {
         assertEquals(3, jsonWebKeySet.getKeys().length);
     }
 
+    @Test
+    public void certsWithJwks() throws IOException {
+        TokenSignatureUtil.registerKeyProvider(Algorithm.ES256, adminClient, testContext);
+
+        OIDCConfigurationRepresentation representation = SimpleHttpDefault.doGet(getAuthServerRoot().toString() + "realms/test/.well-known/openid-configuration", client).asJson(OIDCConfigurationRepresentation.class);
+        String jwksUri = representation.getJwksUri();
+
+        SimpleHttp.Response response = SimpleHttpDefault.doGet(jwksUri, client).header(ACCEPT, APPLICATION_JWKS).asResponse();
+        assertEquals(APPLICATION_JWKS, response.getFirstHeader(CONTENT_TYPE));
+    }
+
     @Test
     public void testIntrospectionEndpointClaim() throws IOException {
         Client client = AdminClientUtil.createResteasyClient();
@@ -355,19 +374,6 @@ public void testAcrValuesSupported() throws IOException {
         }
     }
 
-    @Test
-    @EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
-    public void testGrantTypesSupportedWithTokenExchange() throws IOException {
-        Client client = AdminClientUtil.createResteasyClient();
-        try {
-            OIDCConfigurationRepresentation oidcConfig = getOIDCDiscoveryRepresentation(client, OAuthClient.AUTH_SERVER_ROOT);
-            assertEquals(oidcConfig.getGrantTypesSupported().size(),8);
-            assertContains(oidcConfig.getGrantTypesSupported(), OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE);
-        } finally {
-            client.close();
-        }
-    }
-
     @Test
     @EnableFeature(value = Profile.Feature.DPOP, skipRestart = true)
     public void testDpopSigningAlgValuesSupportedWithDpop() throws IOException {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AcrAuthFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AcrAuthFlowTest.java
new file mode 100644
index 000000000000..5891b2dda5e4
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AcrAuthFlowTest.java
@@ -0,0 +1,509 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.oidc;
+
+
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.Assert;
+import org.keycloak.admin.client.Keycloak;
+import org.keycloak.authentication.authenticators.browser.OTPFormAuthenticatorFactory;
+import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory;
+import org.keycloak.events.Details;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.ClientScopeModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.TimeBasedOTP;
+import org.keycloak.representations.ClaimsRepresentation;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.idm.ClientPoliciesRepresentation;
+import org.keycloak.representations.idm.ClientProfilesRepresentation;
+import org.keycloak.representations.idm.ClientScopeRepresentation;
+import org.keycloak.representations.idm.EventRepresentation;
+import org.keycloak.representations.idm.ProtocolMapperRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.clientpolicy.condition.AcrCondition;
+import org.keycloak.services.clientpolicy.condition.AcrConditionFactory;
+import org.keycloak.services.clientpolicy.executor.AuthenticationFlowSelectorExecutor;
+import org.keycloak.services.clientpolicy.executor.AuthenticationFlowSelectorExecutorFactory;
+import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.pages.LoginTotpPage;
+import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
+import org.keycloak.testsuite.util.ClientPoliciesUtil;
+import org.keycloak.testsuite.util.FlowUtil;
+import org.keycloak.testsuite.util.UserBuilder;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:ggrazian@redhat.com">Giuseppe Graziano</a>
+ */
+public class AcrAuthFlowTest extends AbstractOIDCScopeTest{
+
+    // config
+    private static String CLIENT_ID = "test-app";
+    private static String CLIENT_SECRET = "password";
+    private static String PASSWORD = "password";
+    private static String TOTP_SECRET = "totpsecret";
+
+    private static String PASSWORD_FLOW_ALIAS = "password-flow";
+
+    private static String PASSWORD_OTP_FLOW_ALIAS = "password-otp-flow";
+
+    // pages
+    @Page
+    protected LoginTotpPage loginTotpPage;
+
+    @Page
+    protected LoginPage loginPage;
+
+    private TimeBasedOTP totp = new TimeBasedOTP();
+    private static String userId;
+
+    /**
+     * Create the ACR protocol mapper and add it to the test OIDC client.
+     * @param testRealm The realm read from /testrealm.json.
+     */
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        // setup user
+        UserRepresentation user = createTestUser("test-user", PASSWORD, TOTP_SECRET);
+        testRealm.getUsers().add(user);
+        userId = user.getId();
+
+        // setup acr scope
+        ClientScopeRepresentation scope = createScope();
+
+        List<ClientScopeRepresentation> scopes = testRealm.getClientScopes();
+        if (scopes == null){
+            testRealm.setClientScopes(new ArrayList<>());
+        }
+        testRealm.getClientScopes().add(scope);
+
+        // update client and default scopes
+        testRealm.setDefaultDefaultClientScopes(Collections.singletonList(scope.getName()));
+        testRealm.getClients().stream().filter(c -> c.getClientId().equals(CLIENT_ID)).findFirst().orElseThrow().setDefaultClientScopes(Collections.singletonList(scope.getName()));
+
+        try {
+            findTestApp(testRealm).setAttributes(Collections.singletonMap(Constants.ACR_LOA_MAP, getAcrToLoaMappingForClient()));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
+    private String getAcrToLoaMappingForClient() throws IOException {
+        Map<String, Integer> acrLoaMap = new HashMap<>();
+        acrLoaMap.put("default", 1);
+        acrLoaMap.put("acr-password", 2);
+        acrLoaMap.put("acr-otp", 3);
+        return JsonSerialization.writeValueAsString(acrLoaMap);
+    }
+
+    /**
+     * Helper function to create a test user, optionally with OTP configured
+     * @param username The username of the user to create
+     * @param password The password to set on the user
+     * @param totpSecret If set, will configure a totp authenticator with this secret
+     * @return
+     */
+    private UserRepresentation createTestUser(String username, String password, String totpSecret){
+        UserBuilder builder = UserBuilder.create()
+                .id(KeycloakModelUtils.generateId())
+                .username(username)
+                .enabled(true)
+                .email(username + "@email.com")
+                .firstName(username)
+                .lastName(username)
+                .password(password);
+
+        if (totpSecret != null){
+            builder.totpSecret(totpSecret)
+                    .otpEnabled();
+        }
+
+        return builder.build();
+    }
+
+    /**
+     * Helper function to create the ACR scope and protocol mapper.
+     * @return The created scope object
+     */
+    private ClientScopeRepresentation createScope(){
+        ProtocolMapperRepresentation protocolMapper = createMapper();
+        return new ClientScopeRepresentation(){{
+            setId(KeycloakModelUtils.generateId());
+            setName("acr-test-scope");
+            setProtocol("openid-connect");
+            setAttributes(new HashMap<>() {{
+                put(ClientScopeModel.INCLUDE_IN_TOKEN_SCOPE, "false");
+                put(ClientScopeModel.DISPLAY_ON_CONSENT_SCREEN, "false");
+            }});
+            setProtocolMappers(Collections.singletonList(protocolMapper));
+        }};
+    }
+
+    /**
+     * Helper function to create the acr protocol mapper.
+     * @return The created protocol mapper
+     */
+    private ProtocolMapperRepresentation createMapper(){
+        return new ProtocolMapperRepresentation(){{
+            setId(KeycloakModelUtils.generateId());
+            setName("acr-test-mapper");
+            setProtocol("openid-connect");
+            setProtocolMapper("oidc-acr-mapper");
+            setConfig(new HashMap<>() {{
+                put("id.token.claim", "true");
+                put("access.token.claim", "true");
+            }});
+        }};
+    }
+
+
+    /**
+     * Setup for the test cases
+     */
+    @Before
+    public void setupTest() {
+        oauth.clientId(CLIENT_ID);
+        createPasswordFlow();
+        createOTPFlow();
+
+        // needed otherwise multiple OTP tests will fail due to token reuse
+        new RealmAttributeUpdater(testRealm())
+                .setOtpPolicyCodeReusable(true)
+                .update();
+    }
+
+    /**
+     * Reset clients post test
+     */
+    @After
+    public void cleanupTest() {
+        try {
+            ClientPoliciesRepresentation clientPolicies = JsonSerialization.readValue("{}", ClientPoliciesRepresentation.class);
+            adminClient.realm(TEST_REALM_NAME).clientPoliciesPoliciesResource().updatePolicies(clientPolicies);
+
+            ClientProfilesRepresentation clientProfilesRepresentation = JsonSerialization.readValue("{}", ClientProfilesRepresentation.class);
+
+            adminClient.realm(TEST_REALM_NAME).clientPoliciesProfilesResource().updateProfiles(clientProfilesRepresentation);
+        }
+        catch (Exception e) {
+            Assert.fail();
+        }
+
+    }
+
+    /**
+     * Helper function to create an authentication flow with the password authenticator
+     */
+    private void createPasswordFlow(){
+        testingClient.server(TEST_REALM_NAME).run(session -> FlowUtil.inCurrentRealm(session).copyBrowserFlow(PASSWORD_FLOW_ALIAS));
+        testingClient.server(TEST_REALM_NAME)
+                .run(session -> FlowUtil.inCurrentRealm(session).selectFlow(PASSWORD_FLOW_ALIAS)
+                        // remove cookie, kerberos, and idp from browser flow
+                        .removeExecution(2).removeExecution(1).removeExecution(0)
+                        .inForms(forms -> forms.clear()
+                            .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, UsernamePasswordFormFactory.PROVIDER_ID, null)
+                ));
+    }
+
+    /**
+     * Helper function to create an authentication flow with the password and otp authenticators
+     */
+    private void createOTPFlow(){
+        testingClient.server(TEST_REALM_NAME).run(session -> FlowUtil.inCurrentRealm(session).copyBrowserFlow(PASSWORD_OTP_FLOW_ALIAS));
+        testingClient.server(TEST_REALM_NAME)
+                .run(session -> FlowUtil.inCurrentRealm(session).selectFlow(PASSWORD_OTP_FLOW_ALIAS)
+                        // remove cookie, kerberos, and idp from browser flow
+                        .removeExecution(2).removeExecution(1).removeExecution(0)
+                        .inForms(forms -> forms.clear()
+                            .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, UsernamePasswordFormFactory.PROVIDER_ID, null)
+                            .addAuthenticatorExecution(AuthenticationExecutionModel.Requirement.REQUIRED, OTPFormAuthenticatorFactory.PROVIDER_ID, null)
+                ));
+    }
+
+    /**
+     * Test the ACR auth flow map for the password auth flow
+     * Expected: ACR = "acr-password"
+     */
+    @Test
+    public void testAuthFlow() {
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-password", PASSWORD_FLOW_ALIAS, 2);
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-otp", PASSWORD_OTP_FLOW_ALIAS, 3);
+
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-password");
+        }});
+
+        authenticatePassword("test-user", PASSWORD);
+        Tokens tokens = assertLoginWithAcr(userId, "acr-password");
+
+        logout(userId, tokens);
+    }
+
+    @Test
+    public void testAuthFlowWithoutLoaConfig() {
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-password", PASSWORD_FLOW_ALIAS);
+
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-password");
+        }});
+
+        authenticatePassword("test-user", PASSWORD);
+        Tokens tokens = assertLoginWithAcr(userId, "default");
+
+        logout(userId, tokens);
+    }
+
+
+    /**
+     * Test the ACR auth flow mapping feature for an alternate otp auth flow
+     * Expected: ACR = "acr-otp"
+     */
+    @Test
+    public void testAuthFlowOTP() {
+
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-password", PASSWORD_FLOW_ALIAS, 2);
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-otp", PASSWORD_OTP_FLOW_ALIAS, 3);
+
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-otp");
+        }});
+
+        authenticatePassword("test-user", PASSWORD);
+        authenticateTOTP(TOTP_SECRET);
+        Tokens tokens = assertLoginWithAcr(userId, "acr-otp");
+
+        logout(userId, tokens);
+    }
+
+    /**
+     * Test fallback to default flow when no valid mapping is found. Ensure acr is default value 1
+     * Expected: ACR = default with the default acr-loa mapping behavior
+     */
+    @Test
+    public void testNoMapping() {
+
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-password");
+        }});
+
+        authenticatePassword("test-user", PASSWORD);
+        authenticateTOTP(TOTP_SECRET);
+        Tokens tokens = assertLoginWithAcr(userId, "default");
+
+        logout(userId, tokens);
+    }
+
+    /**
+     * Test sessions when using ACR flow mapping
+     *
+     * Expected: Re-authentication forces user to redo authenticators for newly specified flow
+     */
+    @Test
+    public void testSessionReAuth() {
+        Tokens tokens;
+
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-password", PASSWORD_FLOW_ALIAS, 2);
+        setAcrClientPolicy(adminClient, TEST_REALM_NAME, "acr-otp", PASSWORD_OTP_FLOW_ALIAS, 3);
+
+        // initial login
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-password");
+        }});
+        authenticatePassword("test-user", PASSWORD);
+        assertLoginWithAcr(userId, "acr-password");
+
+        // ensure re-auth forced with different acr
+        loginWithAcr(new ArrayList<>(){{
+            add("acr-otp");
+        }});
+        authenticatePassword("test-user", PASSWORD);
+        authenticateTOTP(TOTP_SECRET);
+        tokens = assertLoginWithAcr(userId, "acr-otp");
+
+        logout(userId, tokens);
+    }
+
+    private void setAcrClientPolicy(Keycloak adminClient, String realm, String acr, String alias) {
+        setAcrClientPolicy(adminClient, realm, acr, alias, null);
+    }
+
+    public static void setAcrClientPolicy(Keycloak adminClient, String realm, String acr, String alias, Integer loa) {
+
+        try {
+
+            ClientProfilesRepresentation clientProfiles = adminClient.realm(realm).clientPoliciesProfilesResource().getProfiles(false);
+            AuthenticationFlowSelectorExecutor.Configuration aliasConfiguration = new AuthenticationFlowSelectorExecutor.Configuration();
+            aliasConfiguration.setAuthFlowAlias(alias);
+            if (loa != null) {
+                aliasConfiguration.setAuthFlowLoa(loa);
+            }
+            ClientPoliciesUtil.ClientProfilesBuilder clientProfilesBuilder = new ClientPoliciesUtil.ClientProfilesBuilder()
+                    .addProfile(
+                            (new ClientPoliciesUtil.ClientProfileBuilder()).createProfile(alias, "")
+                                    .addExecutor(AuthenticationFlowSelectorExecutorFactory.PROVIDER_ID, aliasConfiguration)
+                                    .toRepresentation()
+                    );
+            clientProfiles.getProfiles().forEach(clientProfilesBuilder::addProfile);
+            String json = clientProfilesBuilder.toString();
+
+            clientProfiles = JsonSerialization.readValue(json, ClientProfilesRepresentation.class);
+            adminClient.realm(realm).clientPoliciesProfilesResource().updateProfiles(clientProfiles);
+            
+            
+            ClientPoliciesRepresentation clientPolicies = adminClient.realm(realm).clientPoliciesPoliciesResource().getPolicies(false);
+
+            AcrCondition.Configuration acrConfiguration = new AcrCondition.Configuration();
+            acrConfiguration.setAcrProperty(acr);
+
+            // register policies
+            ClientPoliciesUtil.ClientPoliciesBuilder clientPoliciesBuilder = new ClientPoliciesUtil.ClientPoliciesBuilder()
+                    .addPolicy(
+                            (new ClientPoliciesUtil.ClientPolicyBuilder()).createPolicy(alias, "", Boolean.TRUE)
+                                    .addCondition(AcrConditionFactory.PROVIDER_ID,
+                                            acrConfiguration)
+                                    .addProfile(alias)
+                                    .toRepresentation()
+                    );
+
+            clientPolicies.getPolicies().forEach(clientPoliciesBuilder::addPolicy);
+            json = clientPoliciesBuilder.toString();
+
+            clientPolicies = json==null ? null : JsonSerialization.readValue(json, ClientPoliciesRepresentation.class);
+            adminClient.realm(realm).clientPoliciesPoliciesResource().updatePolicies(clientPolicies);
+        }
+        catch (Exception e) {
+            Assert.fail();
+        }
+    }
+
+
+    private void loginWithAcr(List<String> acrValues){
+        loginWithAcr(acrValues, false);
+    }
+
+    /**
+     * Helper function to open the authentication page, requesting the specified acrValues. Optionally, specify the acr
+     * claim as essential.
+     * @param acrValues The acr values to include in the authorization request
+     * @param essential Specify that the acr claim is essential in the request
+     */
+    private void loginWithAcr(List<String> acrValues, boolean essential){
+        ClaimsRepresentation.ClaimValue<String> acrClaim = new ClaimsRepresentation.ClaimValue<>();
+        acrClaim.setEssential(essential);
+        acrClaim.setValues(acrValues);
+
+        ClaimsRepresentation claims = new ClaimsRepresentation();
+        claims.setIdTokenClaims(Collections.singletonMap(IDToken.ACR, acrClaim));
+
+        oauth.loginForm().claims(claims).open();
+    }
+
+    /**
+     * Helper function to fetch the authentication flow ID based on the alias
+     * @param alias The alias to search for
+     * @return The flow ID
+     */
+    private String findFlowByAlias(String alias){
+        return testRealm().flows().getFlows().stream().filter(f -> f.getAlias().equals(alias)).findFirst().orElseThrow().getId();
+    }
+
+
+    /**
+     * Helper function to log out the specified user
+     * @param userId The keycloak identifier of the user
+     * @param tokens The OIDC tokens received during login
+     */
+    private void logout(String userId, Tokens tokens){
+        // Logout
+        oauth.doLogout(tokens.refreshToken);
+        events.expectLogout(tokens.idToken.getSessionState())
+                .client(CLIENT_ID)
+                .user(userId)
+                .removeDetail(Details.REDIRECT_URI).assertEvent();
+    }
+
+    /**
+     * Helper function to authenticate with a username and password
+     * @param username The username to log in with
+     * @param password The password to log in with
+     */
+    private void authenticatePassword(String username, String password){
+        Assert.assertTrue(loginPage.isCurrent());
+        loginPage.login(username, password);
+    }
+
+    /**
+     * Helper function to authenticate with a TOTP token
+     * @param totpSecret The secret to use to generate the TOTP token
+     */
+    private void authenticateTOTP(String totpSecret){
+        Assert.assertTrue(loginTotpPage.isCurrent());
+        setOtpTimeOffset(TimeBasedOTP.DEFAULT_INTERVAL_SECONDS, totp);
+
+        loginTotpPage.login(totp.generateTOTP(totpSecret));
+    }
+
+    /**
+     * Helper function to assert login completed successfully for the specified user
+     * @param userId The keycloak ID of the user to check
+     * @param expectedAcr The value expected in the 'acr' claim of the resulting token
+     * @return The tokens from a successful login
+     */
+    private Tokens assertLoginWithAcr(String userId, String expectedAcr){
+        EventRepresentation loginEvent = events.expectLogin()
+                .user(userId)
+                .assertEvent();
+
+        Tokens tokens = sendTokenRequest(loginEvent, userId, "openid", CLIENT_ID);
+        assertAcr(tokens.idToken, expectedAcr);
+        assertAcr(tokens.accessToken, expectedAcr);
+
+        return tokens;
+    }
+
+    /**
+     * Helper function to assert the token contains the specified acr value
+     * @param token The token to check (either access or ID)
+     * @param expectedAcr The expected acr values in the token
+     */
+    private void assertAcr(IDToken token, String expectedAcr) {
+        getLogger().infof("Expected acr = %s", expectedAcr);
+        String acr = token.getAcr();
+        getLogger().infof("Response acr = %s", acr);
+        if (expectedAcr != null) {
+            Assert.assertNotNull(acr);
+        }
+
+        Assert.assertEquals(acr, expectedAcr);
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthenticationMethodReferenceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthenticationMethodReferenceTest.java
index 6867175ac430..23569e03025f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthenticationMethodReferenceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthenticationMethodReferenceTest.java
@@ -184,11 +184,6 @@ public void configureClient() {
     public void cleanup() {
         clearAmr("browser");
 
-        // remove claims config for acr
-        ClaimsRepresentation claims = new ClaimsRepresentation();
-        claims.setIdTokenClaims(Collections.emptyMap());
-        oauth.claims(claims);
-
         // reset default browser flow
         setBrowserFlow("browser");
 
@@ -477,7 +472,7 @@ private void configureStepUpFlow(String newFlowAlias) {
      */
     private void logout(String userId, Tokens tokens){
         // Logout
-        oauth.doLogout(tokens.refreshToken, CLIENT_SECRET);
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(tokens.idToken.getSessionState())
                 .client(CLIENT_ID)
                 .user(userId)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenEncryptionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenEncryptionTest.java
index a041174de4e2..94dd6a5b4f8e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenEncryptionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenEncryptionTest.java
@@ -44,7 +44,7 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.pages.*;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
@@ -182,8 +182,7 @@ private void testAuthorizationTokenSignatureAndEncryption(String sigAlgorithm, S
 
             // get authorization response
             oauth.responseMode("jwt");
-            oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-            OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+            AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
             // parse JWE and JOSE Header
             String jweStr = response.getResponse();
@@ -279,9 +278,7 @@ public void testAuthorizationEncryptionWithoutEncryptionKEK() throws MalformedUR
  
             // get authorization response but failed
             oauth.responseMode("jwt");
-            oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-
-            OAuthClient.AuthorizationEndpointResponse errorResponse =  oauth.doLogin("test-user@localhost", "password");
+            AuthorizationEndpointResponse errorResponse =  oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
             System.out.println(driver.getPageSource().contains("Unexpected error when handling authentication request to identity provider."));
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenResponseModeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenResponseModeTest.java
index 2f9c242cefd8..47ca93082708 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenResponseModeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/AuthorizationTokenResponseModeTest.java
@@ -31,7 +31,7 @@
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.openqa.selenium.By;
 
 import jakarta.ws.rs.core.UriBuilder;
@@ -53,9 +53,8 @@ public class AuthorizationTokenResponseModeTest extends AbstractTestRealmKeycloa
     @Test
     public void authorizationRequestQueryJWTResponseMode() throws Exception {
         oauth.responseMode(OIDCResponseMode.QUERY_JWT.value());
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -72,9 +71,8 @@ public void authorizationRequestQueryJWTResponseMode() throws Exception {
     public void authorizationRequestJWTResponseMode() throws Exception {
         // jwt response_mode. It should fallback to query.jwt
         oauth.responseMode("jwt");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -96,9 +94,8 @@ public void authorizationRequestJWTResponseMode() throws Exception {
     @Test
     public void authorizationRequestFragmentJWTResponseMode() throws Exception {
         oauth.responseMode(OIDCResponseMode.FRAGMENT_JWT.value());
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -118,8 +115,7 @@ public void authorizationRequestFragmentJWTResponseMode() throws Exception {
     @Test
     public void authorizationRequestFormPostJWTResponseMode() throws IOException {
         oauth.responseMode(OIDCResponseMode.FORM_POST_JWT.value());
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.doLoginGrant("test-user@localhost", "password");
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").doLogin("test-user@localhost", "password");
 
         String sources = driver.getPageSource();
         System.out.println(sources);
@@ -142,10 +138,8 @@ public void authorizationRequestJWTResponseModeIdTokenResponseType() throws Exce
         // jwt response_mode. It should fallback to fragment.jwt when its hybrid flow
         oauth.responseMode("jwt");
         oauth.responseType("code id_token");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.nonce("123456");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").nonce("123456").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -173,10 +167,8 @@ public void authorizationRequestJWTResponseModeAccessTokenResponseType() throws
         // jwt response_mode. It should fallback to fragment.jwt when its hybrid flow
         oauth.responseMode("jwt");
         oauth.responseType("token id_token");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.nonce("123456");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").nonce("123456").doLogin("test-user@localhost", "password");
 
         assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -206,12 +198,9 @@ public void authorizationRequestFailInvalidResponseModeQueryJWT() throws Excepti
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").implicitFlow(true);
         oauth.responseMode("query.jwt");
         oauth.responseType("code id_token");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.nonce("123456");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").nonce("123456").open();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(errorResponse.getResponse());
         Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, responseToken.getOtherClaims().get("error"));
         Assert.assertEquals("Response_mode 'query.jwt' is allowed only when the authorization response token is encrypted", responseToken.getOtherClaims().get("error_description"));
@@ -224,12 +213,9 @@ public void testErrorObjectExpectedClaims() throws Exception {
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").implicitFlow(true);
         oauth.responseMode("query.jwt");
         oauth.responseType("code id_token");
-        oauth.stateParamHardcoded("OpenIdConnect.AuthenticationProperties=2302984sdlk");
-        oauth.nonce("123456");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.loginForm().state("OpenIdConnect.AuthenticationProperties=2302984sdlk").nonce("123456").open();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(errorResponse.getResponse());
 
         assertNotNull(responseToken.getIssuer());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/IdTokenEncryptionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/IdTokenEncryptionTest.java
index 6de33abc14fd..85477e87e7ca 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/IdTokenEncryptionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/IdTokenEncryptionTest.java
@@ -51,8 +51,8 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
@@ -93,8 +93,7 @@ public void clientConfiguration() {
          * will faile and the clientID will always be "sample-public-client
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
-        oauth.clientId("test-app");
-        oauth.maxAge(null);
+        oauth.client("test-app", "password");
     }
 
     @Override
@@ -212,9 +211,9 @@ private void testIdTokenSignatureAndEncryption(String sigAlgorithm, String algAl
             clientResource.update(clientRep);
 
             // get id token
-            OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+            AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
             String code = response.getCode();
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
             // parse JWE and JOSE Header
             String jweStr = tokenResponse.getIdToken();
@@ -309,14 +308,14 @@ public void testIdTokenEncryptionWithoutEncryptionKEK() throws Exception{
             clientResource.update(clientRep);
 
             // get id token but failed
-            OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
-            AccessTokenResponse atr = oauth.doAccessTokenRequest(response.getCode(), "password");
+            AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+            AccessTokenResponse atr = oauth.doAccessTokenRequest(response.getCode());
             Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, atr.getError());
             Assert.assertEquals("can not get encryption KEK", atr.getErrorDescription());
 
             // get id token but failed with client_credentials grant type
             oauth.scope("openid");
-            OAuthClient.AccessTokenResponse responseClientCredentials = oauth.doClientCredentialsGrantAccessTokenRequest(clientRep.getSecret());
+            AccessTokenResponse responseClientCredentials = oauth.client(clientRep.getClientId(), clientRep.getSecret()).doClientCredentialsGrantAccessTokenRequest();
             Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, responseClientCredentials.getError());
             Assert.assertEquals("can not get encryption KEK", responseClientCredentials.getErrorDescription());
         } finally {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java
index ad5969603df5..413ac661e694 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/LightWeightAccessTokenTest.java
@@ -18,7 +18,6 @@
 package org.keycloak.testsuite.oidc;
 
 import jakarta.ws.rs.NotFoundException;
-import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
@@ -42,6 +41,7 @@
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
+import org.keycloak.protocol.oidc.encode.AccessTokenContext;
 import org.keycloak.protocol.oidc.mappers.AudienceProtocolMapper;
 import org.keycloak.protocol.oidc.mappers.GroupMembershipMapper;
 import org.keycloak.protocol.oidc.mappers.HardcodedClaim;
@@ -65,10 +65,12 @@
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.ClientPoliciesUtil;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.ProtocolMapperUtil;
+import org.keycloak.testsuite.util.oauth.PkceGenerator;
 import org.keycloak.util.JsonSerialization;
-import org.keycloak.utils.MediaType;
 
 import java.io.IOException;
 import java.util.ArrayList;
@@ -105,11 +107,9 @@
 import static org.keycloak.protocol.oidc.mappers.RoleNameMapper.NEW_ROLE_NAME;
 import static org.keycloak.protocol.oidc.mappers.RoleNameMapper.ROLE_CONFIG;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
-import static org.keycloak.testsuite.auth.page.AuthRealm.TEST;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import static org.keycloak.testsuite.util.ClientPoliciesUtil.createAnyClientConditionConfig;
 
-@EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
 public class LightWeightAccessTokenTest extends AbstractClientPoliciesTest {
     private static final Logger logger = Logger.getLogger(LightWeightAccessTokenTest.class);
     private static String RESOURCE_SERVER_CLIENT_ID = "resource-server";
@@ -150,16 +150,15 @@ private UserRepresentation findUser(RealmRepresentation testRealm, String userNa
     public void accessTokenFalseIntrospectionTrueTest() throws IOException {
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, false, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), true, true, false);
         } finally {
@@ -171,16 +170,15 @@ public void accessTokenFalseIntrospectionTrueTest() throws IOException {
     public void accessTokenTrueIntrospectionFalseTest() throws IOException {
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, false, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             // Most of the claims should not be included in introspectionResponse as introspectionMapper was disabled
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), true, false, false);
@@ -193,16 +191,15 @@ public void accessTokenTrueIntrospectionFalseTest() throws IOException {
     public void accessTokenTrueIntrospectionTrueTest() throws IOException {
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, true, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), true, true, false);
         } finally {
@@ -214,20 +211,16 @@ public void accessTokenTrueIntrospectionTrueTest() throws IOException {
     public void accessTokenTrueIntrospectionReturnedAsJwt() throws IOException {
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, true, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
 
-            // request JWT in introspection response
-            oauth.requestHeaders(Map.of(HttpHeaders.ACCEPT, MediaType.APPLICATION_JWT));
-
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            String tokenResponse = oauth.introspectionRequest(accessToken).tokenTypeHint("access_token").jwtResponse().send().getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             AccessToken introspectionResult = JsonSerialization.readValue(tokenResponse, AccessToken.class);
             assertTokenIntrospectionResponse(introspectionResult, true, true, false);
@@ -242,20 +235,19 @@ public void accessTokenTrueIntrospectionReturnedAsJwt() throws IOException {
     public void offlineTokenTest() throws IOException {
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("openid address offline_access");
 
-            oauth.clientId(TEST_CLIENT);
-            TokenResponseContext ctx = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse response = ctx.tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            TokenResponseContext ctx = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse response = ctx.tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             logger.debug("idtoken:" + response.getIdToken());
             assertAccessToken(oauth.verifyToken(accessToken), true, false, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
             removeSession(ctx.userSessionId);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), true, true, false);
         } finally {
@@ -267,17 +259,16 @@ public void offlineTokenTest() throws IOException {
     public void clientCredentialTest() throws Exception {
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, false);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest(TEST_CLIENT_SECRET);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), false, false, false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), false, true, false);
         } finally {
@@ -286,23 +277,23 @@ public void clientCredentialTest() throws Exception {
     }
 
     @Test
+    @EnableFeature(value = Profile.Feature.TOKEN_EXCHANGE, skipRestart = true)
     public void exchangeTest() throws Exception {
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, true);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = browserLogin(TEST_CLIENT_SECRET, TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = browserLogin(TEST_USER_NAME, TEST_USER_PASSWORD).tokenResponse;
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, false, false);
-            response = oauth.doTokenExchange(TEST, accessToken, null, TEST_CLIENT, TEST_CLIENT_SECRET);
+            response = oauth.doTokenExchange(accessToken);
             String exchangedTokenString = response.getAccessToken();
             logger.debug("exchangedTokenString:" + exchangedTokenString);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, exchangedTokenString);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(exchangedTokenString).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), true, true, false);
         } finally {
@@ -315,28 +306,27 @@ public void testPolicyLightWeightFalseTest() throws Exception {
         setUseLightweightAccessTokenExecutor();
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, true, false, false);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
 
-            OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().nonce("123456").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             String accessToken = tokenResponse.getAccessToken();
             assertAccessToken(oauth.verifyToken(accessToken), true, false, true);
             logger.debug("lightweight access token:" + accessToken);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, false);
             logger.debug("tokenResponse:" + introspectResponse);
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
             deletePolicy(POLICY_NAME);
-            oauth.doLogout(tokenResponse.getRefreshToken(), TEST_CLIENT_SECRET);
+            oauth.doLogout(tokenResponse.getRefreshToken());
 
             authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, false);
@@ -350,19 +340,24 @@ public void testPolicyLightWeightTrueTest() throws Exception {
         setUseLightweightAccessTokenExecutor();
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, true, false);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
 
-            OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().nonce("123456").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             String accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
-            assertAccessToken(oauth.verifyToken(accessToken), true, true, true);
+            AccessToken token = oauth.verifyToken(accessToken);
+            assertAccessToken(token, true, true, true);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            AccessTokenContext ctx = testingClient.testing("test").getTokenContext(token.getId());
+            Assert.assertEquals(ctx.getSessionType(), AccessTokenContext.SessionType.ONLINE);
+            Assert.assertEquals(ctx.getTokenType(), AccessTokenContext.TokenType.LIGHTWEIGHT);
+            Assert.assertEquals(ctx.getGrantType(), OAuth2Constants.AUTHORIZATION_CODE);
+
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + introspectResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, false);
 
@@ -376,28 +371,27 @@ public void testAlwaysUseLightWeightFalseTest() throws Exception {
         alwaysUseLightWeightAccessToken(true);
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, true, false, false);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
 
-            OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().nonce("123456").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             String accessToken = tokenResponse.getAccessToken();
             assertAccessToken(oauth.verifyToken(accessToken), true, false, true);
             logger.debug("lightweight access token:" + accessToken);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, false);
             logger.debug("tokenResponse:" + introspectResponse);
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
             alwaysUseLightWeightAccessToken(false);
-            oauth.doLogout(tokenResponse.getRefreshToken(), TEST_CLIENT_SECRET);
+            oauth.doLogout(tokenResponse.getRefreshToken());
 
             authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, false);
@@ -411,19 +405,18 @@ public void testAlwaysUseLightWeightTrueTest() throws Exception {
         alwaysUseLightWeightAccessToken(true);
         ProtocolMappersResource protocolMappers = setProtocolMappers(false, true, true, false);
         try {
-            oauth.nonce("123456");
             oauth.scope("address");
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
 
-            OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().nonce("123456").doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             String accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true, true);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + introspectResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, false);
 
@@ -439,33 +432,33 @@ public void testWithoutBasicClaim() throws Exception {
         removeDefaultBasicClientScope();
         ProtocolMappersResource protocolMappers = setProtocolMappers(true, true, false, false);
         try {
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
             oauth.scope("address");
 
-            OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
+            AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             String accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true,  false,true);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + introspectResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, true);
 
-            oauth.clientId(TEST_CLIENT);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
             alwaysUseLightWeightAccessToken(false);
-            oauth.doLogout(tokenResponse.getRefreshToken(), TEST_CLIENT_SECRET);
+            oauth.doLogout(tokenResponse.getRefreshToken());
 
 
             authsEndpointResponse = oauth.doLogin(TEST_USER_NAME, TEST_USER_PASSWORD);
-            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+            tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
             accessToken = tokenResponse.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), true, true,  true);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            introspectResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            introspectResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + introspectResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(introspectResponse, AccessToken.class), true, true, true);
 
@@ -480,16 +473,14 @@ public void clientCredentialWithoutBasicClaims() throws Exception {
         removeDefaultBasicClientScope();
         alwaysUseLightWeightAccessToken(true);
         try {
-            oauth.nonce("123456");
-
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest(TEST_CLIENT_SECRET);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
             String accessToken = response.getAccessToken();
             logger.debug("accessToken:" + accessToken);
             assertAccessToken(oauth.verifyToken(accessToken), false,  false,false);
 
-            oauth.clientId(RESOURCE_SERVER_CLIENT_ID);
-            String tokenResponse = oauth.introspectAccessTokenWithClientCredential(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD, accessToken);
+            oauth.client(RESOURCE_SERVER_CLIENT_ID, RESOURCE_SERVER_CLIENT_PASSWORD);
+            String tokenResponse = oauth.doIntrospectionAccessTokenRequest(accessToken).getRaw();
             logger.debug("tokenResponse:" + tokenResponse);
             assertTokenIntrospectionResponse(JsonSerialization.readValue(tokenResponse, AccessToken.class), false, true, false);
         } finally {
@@ -503,15 +494,12 @@ public void testAdminConsoleClientWithLightweightAccessToken() {
 
         oauth.getDriver().manage().deleteAllCookies();
         oauth.realm("master");
-        oauth.clientId(Constants.ADMIN_CONSOLE_CLIENT_ID);
+        oauth.client(Constants.ADMIN_CONSOLE_CLIENT_ID, TEST_CLIENT_SECRET);
         oauth.redirectUri(OAuthClient.SERVER_ROOT + "/auth/admin/master/console");
-        PkceGenerator pkce = new PkceGenerator();
-        oauth.codeChallenge(pkce.getCodeChallenge());
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(pkce.getCodeVerifier());
+        PkceGenerator pkce = PkceGenerator.s256();
 
-        OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin("admin", "admin");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+        AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().codeChallenge(pkce).doLogin("admin", "admin");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(authsEndpointResponse.getCode()).codeVerifier(pkce).send();
         String accessToken = tokenResponse.getAccessToken();
         logger.debug("access token:" + accessToken);
         assertBasicClaims(oauth.verifyToken(accessToken), true, true);
@@ -535,8 +523,8 @@ public void testAdminConsoleClientWithLightweightAccessTokenTransientSessionDyna
         try (ClientAttributeUpdater clientUpdater = ClientAttributeUpdater.forClient(adminClient, oauth.getRealm(), TEST_CLIENT)
                 .setAttribute(Constants.USE_LIGHTWEIGHT_ACCESS_TOKEN_ENABLED, Boolean.TRUE.toString())
                 .update()) {
-            oauth.clientId(TEST_CLIENT);
-            OAuthClient.AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest(TEST_CLIENT_SECRET);
+            oauth.client(TEST_CLIENT, TEST_CLIENT_SECRET);
+            AccessTokenResponse response = oauth.doClientCredentialsGrantAccessTokenRequest();
             String accessToken = response.getAccessToken();
             logger.debug("access token:" + accessToken);
             assertBasicClaims(oauth.verifyToken(accessToken), false, false);
@@ -566,8 +554,8 @@ public void testAdminApiWithLightweightAccessTokenAndTransientSession() {
         masterRealm.users().get(userRep.getId()).roles().realmLevel().add(Collections.singletonList(masterRealm.roles().get(AdminRoles.ADMIN).toRepresentation()));
         try {
             oauth.realm("master");
-            oauth.clientId(transientClient.getClientId());
-            OAuthClient.AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest(transientClient.getSecret());
+            oauth.client(transientClient.getClientId(), transientClient.getSecret());
+            AccessTokenResponse tokenResponse = oauth.doClientCredentialsGrantAccessTokenRequest();
             String accessTokenString = tokenResponse.getAccessToken();
             Assert.assertNull(tokenResponse.getRefreshToken());
             AccessToken accessToken = oauth.verifyToken(accessTokenString);
@@ -593,15 +581,12 @@ public void testAdminApiWithLightweightAccessAndSubClaim() {
 
         oauth.getDriver().manage().deleteAllCookies();
         oauth.realm("master");
-        oauth.clientId(Constants.ADMIN_CONSOLE_CLIENT_ID);
+        oauth.client(Constants.ADMIN_CONSOLE_CLIENT_ID, TEST_CLIENT_SECRET);
         oauth.redirectUri(OAuthClient.SERVER_ROOT + "/auth/admin/master/console");
-        PkceGenerator pkce = new PkceGenerator();
-        oauth.codeChallenge(pkce.getCodeChallenge());
-        oauth.codeChallengeMethod(OAuth2Constants.PKCE_METHOD_S256);
-        oauth.codeVerifier(pkce.getCodeVerifier());
+        PkceGenerator pkce = PkceGenerator.s256();
 
-        OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin("admin", "admin");
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), TEST_CLIENT_SECRET);
+        AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().codeChallenge(pkce).doLogin("admin", "admin");
+        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(authsEndpointResponse.getCode()).codeVerifier(pkce).send();
         String accessToken = tokenResponse.getAccessToken();
         logger.debug("access token:" + accessToken);
         assertBasicClaims(oauth.verifyToken(accessToken), false, false);
@@ -882,19 +867,19 @@ private void deleteProtocolMappers(ProtocolMappersResource protocolMappers) {
         }
     }
 
-    private TokenResponseContext browserLogin(String clientSecret, String username, String password) {
-        OAuthClient.AuthorizationEndpointResponse authsEndpointResponse = oauth.doLogin(username, password);
+    private TokenResponseContext browserLogin(String username, String password) {
+        AuthorizationEndpointResponse authsEndpointResponse = oauth.loginForm().nonce("123456").doLogin(username, password);
         String userSessionId = authsEndpointResponse.getSessionState();
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode(), clientSecret);
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authsEndpointResponse.getCode());
         return new TokenResponseContext(userSessionId, tokenResponse);
     }
 
     private class TokenResponseContext {
 
         private final String userSessionId;
-        private final OAuthClient.AccessTokenResponse tokenResponse;
+        private final AccessTokenResponse tokenResponse;
 
-        public TokenResponseContext(String userSessionId, OAuthClient.AccessTokenResponse tokenResponse) {
+        public TokenResponseContext(String userSessionId, AccessTokenResponse tokenResponse) {
             this.userSessionId = userSessionId;
             this.tokenResponse = tokenResponse;
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/NonceBackwardsCompatibleMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/NonceBackwardsCompatibleMapperTest.java
index 0c1504559d06..996689b11c7a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/NonceBackwardsCompatibleMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/NonceBackwardsCompatibleMapperTest.java
@@ -45,9 +45,12 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.util.TokenUtil;
 
+import java.io.IOException;
+
 /**
  *
  * @author rmartinc
@@ -62,12 +65,12 @@ public void configureTestRealm(RealmRepresentation testRealm) {
     }
 
     @Test
-    public void testNonceWithoutMapper() throws JsonProcessingException {
+    public void testNonceWithoutMapper() throws IOException {
         testNonce(false, false);
     }
 
     @Test
-    public void testNonceWithMapper() throws JsonProcessingException {
+    public void testNonceWithMapper() throws IOException {
         ClientResource testApp = ApiUtil.findClientByClientId(testRealm(), "test-app");
         String mapperId = createNonceMapper(testApp);
         try {
@@ -78,7 +81,7 @@ public void testNonceWithMapper() throws JsonProcessingException {
     }
 
     @Test
-    public void testOfflineSessionNonceWithMapper() throws JsonProcessingException {
+    public void testOfflineSessionNonceWithMapper() throws IOException {
         ClientResource testApp = ApiUtil.findClientByClientId(testRealm(), "test-app");
         String mapperId = createNonceMapper(testApp);
         try {
@@ -127,18 +130,16 @@ private void checkNonce(String expectedNonce, String nonce, boolean expected) {
         }
     }
 
-    private void testIntrospection(String accessToken, String expectedNonce, boolean expected) throws JsonProcessingException {
-        String tokenResponse = oauth.introspectAccessTokenWithClientCredential("test-app", "password", accessToken);
-        JsonNode nonce = new ObjectMapper().readTree(tokenResponse).get(OIDCLoginProtocol.NONCE_PARAM);
+    private void testIntrospection(String accessToken, String expectedNonce, boolean expected) throws IOException {
+        JsonNode nonce = oauth.client("test-app", "password").doIntrospectionAccessTokenRequest(accessToken).asJsonNode().get(OIDCLoginProtocol.NONCE_PARAM);
         checkNonce(expectedNonce, nonce != null? nonce.asText() : null, expected);
     }
 
-    private void testNonceImplicit(boolean mapper) throws JsonProcessingException {
+    private void testNonceImplicit(boolean mapper) throws IOException {
         String nonce = KeycloakModelUtils.generateId();
-        oauth.nonce(nonce);
         oauth.responseMode(OIDCResponseMode.JWT.value());
         oauth.responseType(OIDCResponseType.TOKEN + " " + OIDCResponseType.ID_TOKEN);
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().nonce(nonce).doLogin("test-user@localhost", "password");
 
         Assert.assertTrue(response.isRedirected());
         AuthorizationResponseToken responseToken = oauth.verifyAuthorizationResponseToken(response.getResponse());
@@ -154,17 +155,16 @@ private void testNonceImplicit(boolean mapper) throws JsonProcessingException {
         testIntrospection(idTokenString, nonce, true);
     }
 
-    private void testNonce(boolean mapper, boolean offlineSession) throws JsonProcessingException {
+    private void testNonce(boolean mapper, boolean offlineSession) throws IOException {
         String nonce = KeycloakModelUtils.generateId();
-        oauth.nonce(nonce);
         if (offlineSession) {
             oauth.scope(OAuth2Constants.OFFLINE_ACCESS);
         }
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().nonce(nonce).doLogin("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         AccessToken token = oauth.verifyToken(response.getAccessToken());
         checkNonce(nonce, token.getNonce(), mapper);
@@ -177,7 +177,7 @@ private void testNonce(boolean mapper, boolean offlineSession) throws JsonProces
                 .detail(Details.REFRESH_TOKEN_TYPE, offlineSession? TokenUtil.TOKEN_TYPE_OFFLINE : TokenUtil.TOKEN_TYPE_REFRESH)
                 .assertEvent();
 
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         events.expectRefresh(tokenEvent.getDetails().get(Details.REFRESH_TOKEN_ID), loginEvent.getSessionId())
                 .detail(Details.REFRESH_TOKEN_TYPE, offlineSession? TokenUtil.TOKEN_TYPE_OFFLINE : TokenUtil.TOKEN_TYPE_REFRESH)
                 .assertEvent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCAdvancedRequestParamsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCAdvancedRequestParamsTest.java
index 948877803259..9810a3b660a6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCAdvancedRequestParamsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCAdvancedRequestParamsTest.java
@@ -30,7 +30,6 @@
 import org.keycloak.admin.client.resource.ProtocolMappersResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.client.JWTClientAuthenticator;
-import org.keycloak.broker.provider.util.SimpleHttp;
 import org.keycloak.common.util.Base64Url;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.Time;
@@ -82,10 +81,10 @@
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.pages.RegisterPage;
 import org.keycloak.testsuite.rest.resource.TestingOIDCEndpointsApplicationResource;
-import org.keycloak.testsuite.util.RealmManager;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.util.JWKSUtils;
 import org.keycloak.util.JsonSerialization;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
@@ -93,7 +92,7 @@
 
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.UriBuilder;
+
 import java.io.IOException;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
@@ -188,8 +187,7 @@ public void clientConfiguration() {
          * will faile and the clientID will always be "sample-public-client
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
-        oauth.clientId("test-app");
-        oauth.maxAge(null);
+        oauth.client("test-app", "password");
     }
 
     @Override
@@ -217,11 +215,8 @@ public void testMaxAge1() {
         // Set time offset
         setTimeOffset(10);
 
-        // Now open login form with maxAge=1
-        oauth.maxAge("1");
-
         // Assert I need to login again through the login form. But username field is not present
-        oauth.openLoginForm();
+        oauth.loginForm().maxAge(1).open();
         loginPage.assertCurrent();
         assertThat(false, is(loginPage.isUsernameInputPresent()));
         loginPage.login("password");
@@ -251,10 +246,9 @@ public void testMaxAge10000() {
         setTimeOffset(10);
 
         // Now open login form with maxAge=10000
-        oauth.maxAge("10000");
+        oauth.loginForm().maxAge(10000).open();
 
         // Assert that I will be automatically logged through cookie
-        oauth.openLoginForm();
         loginEvent = events.expectLogin().assertEvent();
 
         idToken = sendTokenRequestAndGetIDToken(loginEvent);
@@ -270,10 +264,10 @@ public void testMaxAge10000() {
     @Test
     public void promptNoneNotLogged() {
 
-        String expectedIssuer = oauth.doWellKnownRequest(oauth.getRealm()).getIssuer();
+        String expectedIssuer = oauth.doWellKnownRequest().getIssuer();
 
         // Send request with prompt=none
-        driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=none");
+        oauth.loginForm().prompt("none").open();
 
         assertFalse(loginPage.isCurrent());
         assertTrue(appPage.isCurrent());
@@ -281,7 +275,7 @@ public void promptNoneNotLogged() {
         events.assertEmpty();
 
         // Assert error response was sent because not logged in
-        OAuthClient.AuthorizationEndpointResponse resp = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse resp = oauth.parseLoginResponse();
         Assert.assertEquals(expectedIssuer, resp.getIssuer());
         Assert.assertNull(resp.getCode());
         Assert.assertEquals(OAuthErrorException.LOGIN_REQUIRED, resp.getError());
@@ -304,7 +298,7 @@ public void promptNoneSuccess() {
         setTimeOffset(10);
 
         // Assert user still logged with previous authTime
-        driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=none");
+        oauth.loginForm().prompt("none").open();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
         loginEvent = events.expectLogin().removeDetail(Details.USERNAME).assertEvent();
@@ -323,11 +317,11 @@ public void promptNoneConsentRequired() {
 
         try {
             // Assert error shown when trying prompt=none and consent not yet granted
-            driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=none");
+            oauth.loginForm().prompt("none").open();
             assertTrue(appPage.isCurrent());
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-            OAuthClient.AuthorizationEndpointResponse resp = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            AuthorizationEndpointResponse resp = oauth.parseLoginResponse();
             Assert.assertNull(resp.getCode());
             Assert.assertEquals(OAuthErrorException.LOGIN_REQUIRED, resp.getError());
 
@@ -344,10 +338,10 @@ public void promptNoneConsentRequired() {
                     .assertEvent();
 
             // Consent not required anymore. Login with prompt=none should success
-            driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=none");
+            oauth.loginForm().prompt("none").open();
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
 
-            resp = new OAuthClient.AuthorizationEndpointResponse(oauth);
+            resp = oauth.parseLoginResponse();
             Assert.assertNotNull(resp.getCode());
             Assert.assertNull(resp.getError());
 
@@ -382,7 +376,7 @@ public void promptLogin() {
         setTimeOffset(10);
 
         // SSO login first WITHOUT prompt=login ( Tests KEYCLOAK-5248 )
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         loginEvent = events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
         IDToken newIdToken = sendTokenRequestAndGetIDToken(loginEvent);
@@ -394,7 +388,7 @@ public void promptLogin() {
         setTimeOffset(20);
 
         // Assert need to re-authenticate with prompt=login
-        driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=login");
+        oauth.loginForm().prompt("login").open();
         loginPage.assertCurrent();
         assertThat(false, is(loginPage.isUsernameInputPresent()));
         loginPage.login("password");
@@ -416,7 +410,7 @@ public void promptLogin() {
     public void promptCreate() {
 
         // Assert registration page with prompt=login
-        driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=create");
+        oauth.loginForm().prompt("create").open();
         registerPage.assertCurrent();
     }
 
@@ -431,7 +425,7 @@ public void promptCreateShouldFailWhenRegistrationsAreDisabled() {
 
         // Assert registration page with prompt=login
         try {
-            driver.navigate().to(oauth.getLoginFormUrl() + "&prompt=create");
+            oauth.loginForm().prompt("create").open();
             errorPage.assertCurrent();
             assertTrue(errorPage.getError().contains("Registration not allowed"));
         } finally {
@@ -465,7 +459,7 @@ public void promptConsent() {
 
 
             // Re-login without prompt=consent. The previous persistent consent was used
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
             events.expectLogin()
                     .detail(Details.USERNAME, "test-user@localhost")
@@ -473,10 +467,9 @@ public void promptConsent() {
                     .assertEvent();
 
             // Re-login with prompt=consent.
-            String loginFormUri = UriBuilder.fromUri(oauth.getLoginFormUrl())
-                    .queryParam(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_CONSENT)
-                    .build().toString();
-            driver.navigate().to(loginFormUri);
+            oauth.loginForm()
+                    .prompt(OIDCLoginProtocol.PROMPT_VALUE_CONSENT)
+                    .open();
 
             // Assert grant page displayed again. Will need to grant consent again
             grantPage.assertCurrent();
@@ -503,7 +496,7 @@ public void promptConsent() {
     // DISPLAY & OTHERS
     @Test
     public void nonSupportedParams() {
-        driver.navigate().to(oauth.getLoginFormUrl() + "&display=popup&foo=foobar&claims_locales=fr");
+        oauth.loginForm().param("display", "popup").param("foo", "foobar").param("claims_locales", "fr").open();
 
         loginPage.assertCurrent();
         loginPage.login("test-user@localhost", "password");
@@ -518,7 +511,6 @@ public void nonSupportedParams() {
     // REQUEST & REQUEST_URI
     @Test
     public void requestObjectNotRequiredNotProvided() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -527,7 +519,7 @@ public void requestObjectNotRequiredNotProvided() {
         
         // Send request without request object
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
         Assert.assertEquals("mystate2", response.getState());
         assertTrue(appPage.isCurrent());
@@ -535,7 +527,6 @@ public void requestObjectNotRequiredNotProvided() {
     
     @Test
     public void requestObjectNotRequiredProvidedInRequestParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -546,10 +537,8 @@ public void requestObjectNotRequiredProvidedInRequestParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object in "request" param
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().request(oidcClientEndpointsResource.getOIDCRequest()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals("mystate2", response1.getState());
         assertTrue(appPage.isCurrent());
@@ -557,7 +546,6 @@ public void requestObjectNotRequiredProvidedInRequestParam() {
     
     @Test
     public void requestObjectNotRequiredProvidedInRequestUriParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -568,10 +556,8 @@ public void requestObjectNotRequiredProvidedInRequestUriParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object reference in "request_uri" param
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response2 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response2 = oauth.loginForm().requestUri(TestApplicationResourceUrls.clientRequestUri()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response2.getCode());
         Assert.assertEquals("mystate2", response2.getState());
         assertTrue(appPage.isCurrent());
@@ -579,7 +565,6 @@ public void requestObjectNotRequiredProvidedInRequestUriParam() {
     
     @Test
     public void requestObjectRequiredNotProvided() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -588,7 +573,7 @@ public void requestObjectRequiredNotProvided() {
         
         // Send request without request object
         // Assert that the request is not accepted
-        oauth.openLoginForm();
+        oauth.loginForm().state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
         
@@ -599,7 +584,6 @@ public void requestObjectRequiredNotProvided() {
     
     @Test
     public void requestObjectRequiredProvidedInRequestParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -610,10 +594,8 @@ public void requestObjectRequiredProvidedInRequestParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object in "request" param
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().request(oidcClientEndpointsResource.getOIDCRequest()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals("mystate2", response1.getState());
         assertTrue(appPage.isCurrent());
@@ -627,7 +609,7 @@ public void requestObjectRequiredProvidedInRequestParam() {
     public void requestObjectSupersedesQueryParameter() {
         String stateInRequestObject = "stateInRequestObject";
         String stateInQueryParameter = "stateInQueryParameter";
-        oauth.stateParamHardcoded(stateInQueryParameter);
+
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -638,10 +620,8 @@ public void requestObjectSupersedesQueryParameter() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", stateInRequestObject, "none");
         
-        // Send request object in "request" param
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().request(oidcClientEndpointsResource.getOIDCRequest()).state(stateInQueryParameter).doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals(stateInRequestObject, response1.getState());
         assertTrue(appPage.isCurrent());
@@ -653,37 +633,39 @@ public void requestObjectSupersedesQueryParameter() {
 
     @Test
     public void requestObjectClientIdAndResponseTypeTest() {
-        oauth.stateParamHardcoded("some-state");
-
         // Test that "client_id" mandatory in the query even if set in the "request" object
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "some-state", "none");
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
+        String request = oidcClientEndpointsResource.getOIDCRequest();
         oauth.clientId(null);
-        oauth.openLoginForm();
+        oauth.loginForm().request(request).state("some-state").open();
         errorPage.assertCurrent();
 
         // Test that "response_type" mandatory in the query even if set in the "request" object
         oauth.clientId("test-app");
         oauth.responseType(null);
-        oauth.openLoginForm();
+        oauth.loginForm().request(request).state("some-state").open();
         appPage.assertCurrent();
-        Assert.assertEquals("invalid_request", oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        Assert.assertEquals("some-state", oauth.getCurrentQuery().get(OAuth2Constants.STATE));
+        AuthorizationEndpointResponse authorizationEndpointResponse = oauth.parseLoginResponse();
+        Assert.assertEquals("invalid_request", authorizationEndpointResponse.getError());
+        Assert.assertEquals("some-state", authorizationEndpointResponse.getState());
 
         // Test that different "client_id" in the query and in the request object is disallowed
         oauth.clientId("test-app-scope");
         oauth.responseType(OAuth2Constants.CODE);
-        oauth.openLoginForm();
+        oauth.loginForm().request(request).state("some-state").open();
         errorPage.assertCurrent();
 
         // Test that different "response_type" in the query and in the request object is disallowed
         oauth.clientId("test-app");
         oauth.responseType(OAuth2Constants.CODE + " " + OAuth2Constants.ID_TOKEN);
-        oauth.openLoginForm();
+        oauth.loginForm().request(request).state("some-state").open();
         appPage.assertCurrent();
-        Assert.assertEquals("invalid_request", oauth.getCurrentQuery().get(OAuth2Constants.ERROR));
-        Assert.assertEquals("some-state", oauth.getCurrentQuery().get(OAuth2Constants.STATE));
+        oauth.responseMode("query"); // Keycloak falls back to query in this case
+        authorizationEndpointResponse = oauth.parseLoginResponse();
+        oauth.responseMode(null);
+        Assert.assertEquals("invalid_request", authorizationEndpointResponse.getError());
+        Assert.assertEquals("some-state", authorizationEndpointResponse.getState());
 
         // Test that "client_id" and "response_type" are not mandatory in the request object
         Map<String, Object> oidcRequest = new HashMap<>();
@@ -691,17 +673,15 @@ public void requestObjectClientIdAndResponseTypeTest() {
         oidcRequest.put(OIDCLoginProtocol.STATE_PARAM, "request-state");
         String requestObjectString = new JWSBuilder().jsonContent(oidcRequest).none();
 
-        oauth.request(requestObjectString);
         oauth.clientId("test-app");
         oauth.responseType(OAuth2Constants.CODE);
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().request(requestObjectString).state("some-state").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals("request-state", response1.getState());
     }
 
     @Test
     public void requestObjectRequiredProvidedInRequestUriParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -712,10 +692,8 @@ public void requestObjectRequiredProvidedInRequestUriParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object reference in "request_uri" param
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response2 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response2 = oauth.loginForm().requestUri(TestApplicationResourceUrls.clientRequestUri()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response2.getCode());
         Assert.assertEquals("mystate2", response2.getState());
         assertTrue(appPage.isCurrent());
@@ -727,7 +705,6 @@ public void requestObjectRequiredProvidedInRequestUriParam() {
     
     @Test
     public void requestObjectRequiredAsRequestParamNotProvided() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -736,7 +713,7 @@ public void requestObjectRequiredAsRequestParamNotProvided() {
         
         // Send request without request object
         // Assert that the request is not accepted
-        oauth.openLoginForm();
+        oauth.loginForm().state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
         
@@ -747,7 +724,6 @@ public void requestObjectRequiredAsRequestParamNotProvided() {
     
     @Test
     public void requestObjectRequiredAsRequestParamProvidedInRequestParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -758,10 +734,8 @@ public void requestObjectRequiredAsRequestParamProvidedInRequestParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object in "request" param
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().request(oidcClientEndpointsResource.getOIDCRequest()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals("mystate2", response1.getState());
         assertTrue(appPage.isCurrent());
@@ -773,7 +747,6 @@ public void requestObjectRequiredAsRequestParamProvidedInRequestParam() {
     
     @Test
     public void requestObjectRequiredAsRequestParamProvidedInRequestUriParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -784,10 +757,8 @@ public void requestObjectRequiredAsRequestParamProvidedInRequestUriParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "none");
         
-        // Send request object reference in "request_uri" param
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
         // Assert that the request is accepted
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(TestApplicationResourceUrls.clientRequestUri()).state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
         
@@ -798,7 +769,6 @@ public void requestObjectRequiredAsRequestParamProvidedInRequestUriParam() {
     
     @Test
     public void requestObjectRequiredAsRequestUriParamNotProvided() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -807,7 +777,7 @@ public void requestObjectRequiredAsRequestUriParamNotProvided() {
         
         // Send request without request object
         // Assert that the request is not accepted
-        oauth.openLoginForm();
+        oauth.loginForm().state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
         
@@ -818,7 +788,6 @@ public void requestObjectRequiredAsRequestUriParamNotProvided() {
     
     @Test
     public void requestObjectRequiredAsRequestUriParamProvidedInRequestParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -829,10 +798,8 @@ public void requestObjectRequiredAsRequestUriParamProvidedInRequestParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "none");
         
-        // Send request object in "request" param
-        oauth.request(oidcClientEndpointsResource.getOIDCRequest());
         // Assert that the request is not accepted
-        oauth.openLoginForm();
+        oauth.loginForm().request(oidcClientEndpointsResource.getOIDCRequest()).state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
         
@@ -843,7 +810,6 @@ public void requestObjectRequiredAsRequestUriParamProvidedInRequestParam() {
     
     @Test
     public void requestObjectRequiredAsRequestUriParamProvidedInRequestUriParam() {
-        oauth.stateParamHardcoded("mystate2");
         // Set request object not required for client
         ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm("test"), "test-app");
         ClientRepresentation clientRep = clientResource.toRepresentation();
@@ -854,10 +820,8 @@ public void requestObjectRequiredAsRequestUriParamProvidedInRequestUriParam() {
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", oauth.getRedirectUri(), "10", "mystate2", "none");
         
-        // Send request object reference in "request_uri" param
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
         // Assert that the request is accepted
-        OAuthClient.AuthorizationEndpointResponse response1 = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response1 = oauth.loginForm().requestUri(TestApplicationResourceUrls.clientRequestUri()).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response1.getCode());
         Assert.assertEquals("mystate2", response1.getState());
         assertTrue(appPage.isCurrent());
@@ -869,8 +833,6 @@ public void requestObjectRequiredAsRequestUriParamProvidedInRequestUriParam() {
 
     @Test
     public void requestParamUnsigned() {
-        oauth.stateParamHardcoded("mystate2");
-
         String validRedirectUri = oauth.getRedirectUri();
         TestOIDCEndpointsApplicationResource oidcClientEndpointsResource = testingClient.testApp().oidcClientEndpoints();
 
@@ -878,8 +840,7 @@ public void requestParamUnsigned() {
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", "http://invalid", null, "none");
         String requestStr = oidcClientEndpointsResource.getOIDCRequest();
 
-        oauth.request(requestStr);
-        oauth.openLoginForm();
+        oauth.loginForm().request(requestStr).state("mystate2").open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid parameter: redirect_uri", errorPage.getError());
 
@@ -888,8 +849,7 @@ public void requestParamUnsigned() {
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", validRedirectUri, "10", "mystate2", "none");
         requestStr = oidcClientEndpointsResource.getOIDCRequest();
 
-        oauth.request(requestStr);
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().request(requestStr).state("mystate2").doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
         Assert.assertEquals("mystate2", response.getState());
         assertTrue(appPage.isCurrent());
@@ -903,8 +863,9 @@ public void requestUriParamUnsigned() {
         // Send request object with invalid redirect uri.
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", "http://invalid", null, "mystate1", "none");
 
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
-        oauth.openLoginForm();
+        String requestUri = TestApplicationResourceUrls.clientRequestUri();
+
+        oauth.loginForm().requestUri(requestUri).open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid parameter: redirect_uri", errorPage.getError());
 
@@ -912,7 +873,7 @@ public void requestUriParamUnsigned() {
         oauth.redirectUri("http://invalid");
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", validRedirectUri, "10", "mystate1", "none");
 
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().requestUri(requestUri).doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
         Assert.assertEquals("mystate1", response.getState());
         assertTrue(appPage.isCurrent());
@@ -925,14 +886,14 @@ public void requestUriParamWithAllowedRequestUris() {
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", validRedirectUri, "10", "mystate1", "none");
         ClientManager.ClientManagerBuilder clientMgrBuilder = ClientManager.realm(adminClient.realm("test")).clientId("test-app");
 
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
+        String loginRequestUri = TestApplicationResourceUrls.clientRequestUri();
 
         // Test with the relative allowed request_uri - should pass
         String absoluteRequestUri = TestApplicationResourceUrls.clientRequestUri();
         String requestUri = absoluteRequestUri.substring(UriUtils.getOrigin(absoluteRequestUri).length());
         clientMgrBuilder.setRequestUris(requestUri);
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         Assert.assertFalse(errorPage.isCurrent());
         loginPage.assertCurrent();
 
@@ -940,7 +901,7 @@ public void requestUriParamWithAllowedRequestUris() {
         requestUri = requestUri.replace("/get-oidc-request", "/*");
         clientMgrBuilder.setRequestUris(requestUri);
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         Assert.assertFalse(errorPage.isCurrent());
         loginPage.assertCurrent();
 
@@ -948,34 +909,34 @@ public void requestUriParamWithAllowedRequestUris() {
         requestUri = absoluteRequestUri.replace("/get-oidc-request", "/*");
         clientMgrBuilder.setRequestUris(requestUri);
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         Assert.assertFalse(errorPage.isCurrent());
         loginPage.assertCurrent();
 
         // Test star only as wildcard - should pass
         clientMgrBuilder.setRequestUris("*");
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         Assert.assertFalse(errorPage.isCurrent());
         loginPage.assertCurrent();
 
         // Test with multiple request_uris - should pass
         clientMgrBuilder.setRequestUris("/foo", requestUri);
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         Assert.assertFalse(errorPage.isCurrent());
         loginPage.assertCurrent();
 
         // Test invalid request_uris - should fail
         clientMgrBuilder.setRequestUris("/foo", requestUri.replace("/*", "/foo"));
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         errorPage.assertCurrent();
 
         // Test with no request_uri set at all - should fail
         clientMgrBuilder.setRequestUris();
 
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(loginRequestUri).open();
         errorPage.assertCurrent();
 
         // Revert
@@ -993,10 +954,11 @@ public void requestUriParamSigned() {
         OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestObjectSignatureAlg(Algorithm.RS256);
         clientResource.update(clientRep);
 
+        String requestUri = TestApplicationResourceUrls.clientRequestUri();
+
         // Verify unsigned request_uri will fail
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", validRedirectUri, "10", "none");
-        oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
 
@@ -1005,7 +967,7 @@ public void requestUriParamSigned() {
 
         // Verify signed request_uri will fail due to failed signature validation
         oidcClientEndpointsResource.setOIDCRequest("test", "test-app", validRedirectUri, "10", "mystate3", Algorithm.RS256);
-        oauth.openLoginForm();
+        oauth.loginForm().requestUri(requestUri).open();
         Assert.assertTrue(errorPage.isCurrent());
         assertEquals("Invalid Request", errorPage.getError());
 
@@ -1021,7 +983,7 @@ public void requestUriParamSigned() {
         setTimeOffset(20);
 
         // Check signed request_uri will pass
-        OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse response = oauth.loginForm().requestUri(requestUri).doLogin("test-user@localhost", "password");
         Assert.assertNotNull(response.getCode());
         Assert.assertEquals("mystate3", response.getState());
         assertTrue(appPage.isCurrent());
@@ -1067,16 +1029,16 @@ private void requestUriParamSignedIn(String expectedAlgorithm, String actualAlgo
 
             oauth.realm("test");
             oauth.clientId("test-app");
-            oauth.requestUri(TestApplicationResourceUrls.clientRequestUri());
+            String requestUri = TestApplicationResourceUrls.clientRequestUri();
             if (expectedAlgorithm == null || expectedAlgorithm.equals(actualAlgorithm)) {
                 // Check signed request_uri will pass
-                OAuthClient.AuthorizationEndpointResponse response = oauth.doLogin("test-user@localhost", "password");
+                AuthorizationEndpointResponse response = oauth.loginForm().requestUri(requestUri).doLogin("test-user@localhost", "password");
                 Assert.assertNotNull(response.getCode());
                 Assert.assertEquals("mystate3", response.getState());
                 appPage.assertCurrent();
             } else {
                 // Verify signed request_uri will fail due to failed signature validation
-                oauth.openLoginForm();
+                oauth.loginForm().requestUri(requestUri).open();
                 Assert.assertTrue(errorPage.isCurrent());
                 assertEquals("Invalid Request", errorPage.getError());
             }
@@ -1181,7 +1143,7 @@ public void requestUriParamSignedExpectedAnyActualES256() throws Exception {
     @Test
     public void loginHint() {
         // Assert need to re-authenticate with prompt=login
-        driver.navigate().to(oauth.getLoginFormUrl() + "&" + OIDCLoginProtocol.LOGIN_HINT_PARAM + "=test-user%40localhost");
+        oauth.loginForm().loginHint("test-user%40localhost").open();
 
                 loginPage.assertCurrent();
         Assert.assertEquals("test-user@localhost", loginPage.getUsername());
@@ -1203,8 +1165,7 @@ public void processClaimsQueryParam() throws IOException {
 
         String claimsJson = JsonSerialization.writeValueAsString(claims);
 
-        driver.navigate().to(oauth.getLoginFormUrl() + "&" + OIDCLoginProtocol.CLAIMS_PARAM + "="
-                + URLEncoder.encode(claimsJson, StandardCharsets.UTF_8.toString()));
+        oauth.loginForm().param(OIDCLoginProtocol.CLAIMS_PARAM, URLEncoder.encode(claimsJson, StandardCharsets.UTF_8)).open();
 
         // need to login so session id can be read from event
         loginPage.assertCurrent();
@@ -1243,7 +1204,7 @@ public void processClaimsRequestParam() throws Exception {
 
         String request = new JWSBuilder().jsonContent(oidcRequest).none();
         
-        driver.navigate().to(oauth.getLoginFormUrl() + "&" + OIDCLoginProtocol.REQUEST_PARAM + "=" + request);
+        oauth.loginForm().param(OIDCLoginProtocol.REQUEST_PARAM, request).open();
         
         // need to login so session id can be read from event
         loginPage.assertCurrent();
@@ -1301,11 +1262,10 @@ public void processClaimsRequestParamSupported() {
             oidcRequest.put(OIDCLoginProtocol.SCOPE_PARAM, "openid");
             String request = new JWSBuilder().jsonContent(oidcRequest).none();
 
-            oauth = oauth.request(request);
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(request).doLogin("test-user@localhost", "password");
             EventRepresentation loginEvent = events.expectLogin().assertEvent();
 
-            OAuthClient.AccessTokenResponse accessTokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            AccessTokenResponse accessTokenResponse = sendTokenRequestAndGetResponse(loginEvent);
             IDToken idToken = oauth.verifyIDToken(accessTokenResponse.getIdToken());
             assertEquals("test-user@localhost", idToken.getEmail());
             assertEquals("test-user@localhost", idToken.getPreferredUsername());
@@ -1327,7 +1287,7 @@ public void processClaimsRequestParamSupported() {
                 client.close();
             }
 
-            oauth.doLogout(accessTokenResponse.getRefreshToken(), "password");
+            oauth.doLogout(accessTokenResponse.getRefreshToken());
             events.expectLogout(accessTokenResponse.getSessionState()).client("test-app").clearDetails().assertEvent();
 
 
@@ -1349,8 +1309,7 @@ public void processClaimsRequestParamSupported() {
             oidcRequest.put(OIDCLoginProtocol.SCOPE_PARAM, "openid");
             request = new JWSBuilder().jsonContent(oidcRequest).none();
 
-            oauth = oauth.request(request);
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(request).doLogin("test-user@localhost", "password");
             loginEvent = events.expectLogin().assertEvent();
 
             accessTokenResponse = sendTokenRequestAndGetResponse(loginEvent);
@@ -1382,8 +1341,7 @@ public void processClaimsRequestParamSupported() {
 
     @Test
     public void testSignedRequestObject() throws IOException {
-        oauth = oauth.request(createAndSignRequestObject());
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().request(createAndSignRequestObject()).doLogin("test-user@localhost", "password");
         events.expectLogin().assertEvent();
     }
 
@@ -1394,13 +1352,11 @@ public void testWrongEncryptionAlgorithm() throws Exception {
             ClientRepresentation clientRep = clientResource.toRepresentation();
             OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestObjectEncryptionAlg(RSA_OAEP_256);
             clientResource.update(clientRep);
-            oauth.request(createEncryptedRequestObject(RSA_OAEP));
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP)).doLogin("test-user@localhost", "password");
             fail("Should fail due to invalid encryption algorithm");
         } catch (Exception ignore) {
             assertTrue(errorPage.isCurrent());
-            oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
             assertTrue(appPage.isCurrent());
         } finally {
             ClientResource clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
@@ -1409,12 +1365,10 @@ public void testWrongEncryptionAlgorithm() throws Exception {
             clientResource.update(clientRep);
         }
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
-        oauth.idTokenHint(idTokenHint);
-        oauth.openLogout();
-        oauth = oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
-        oauth.doLogin("test-user@localhost", "password");
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
+        oauth.logoutForm().idTokenHint(idTokenHint).open();
+        oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
         assertTrue(appPage.isCurrent());
     }
 
@@ -1428,18 +1382,16 @@ public void testWrongContentEncryptionAlgorithm() throws Exception {
             clientResource.update(clientRep);
             clientRep = clientResource.toRepresentation();
             assertEquals(JWEConstants.A192GCM, OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).getRequestObjectEncryptionEnc());
-            oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
             fail("Should fail due to invalid content encryption algorithm");
         } catch (Exception ignore) {
             assertTrue(errorPage.isCurrent());
-            oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
             clientRep = clientResource.toRepresentation();
             OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).setRequestObjectEncryptionEnc(JWEConstants.A256GCM);
             clientResource.update(clientRep);
             clientRep = clientResource.toRepresentation();
             assertEquals(JWEConstants.A256GCM, OIDCAdvancedConfigWrapper.fromClientRepresentation(clientRep).getRequestObjectEncryptionEnc());
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
             assertTrue(appPage.isCurrent());
         } finally {
             clientResource = ApiUtil.findClientByClientId(adminClient.realm(oauth.getRealm()), oauth.getClientId());
@@ -1449,12 +1401,10 @@ public void testWrongContentEncryptionAlgorithm() throws Exception {
             clientResource.update(clientRep);
         }
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        String idTokenHint = oauth.doAccessTokenRequest(code, "password").getIdToken();
-        oauth.idTokenHint(idTokenHint);
-        oauth.openLogout();
-        oauth = oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
-        oauth.doLogin("test-user@localhost", "password");
+        String code = oauth.parseLoginResponse().getCode();
+        String idTokenHint = oauth.doAccessTokenRequest(code).getIdToken();
+        oauth.logoutForm().idTokenHint(idTokenHint).open();
+        oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
         assertTrue(appPage.isCurrent());
 
         clientRep = clientResource.toRepresentation();
@@ -1464,8 +1414,7 @@ public void testWrongContentEncryptionAlgorithm() throws Exception {
 
     @Test
     public void testSignedAndEncryptedRequestObject() throws IOException, JWEException {
-        oauth = oauth.request(createEncryptedRequestObject(RSA_OAEP_256));
-        oauth.doLogin("test-user@localhost", "password");
+        oauth.loginForm().request(createEncryptedRequestObject(RSA_OAEP_256)).doLogin("test-user@localhost", "password");
         events.expectLogin().assertEvent();
     }
 
@@ -1580,8 +1529,7 @@ private void assertRequestObjectEncryption(JWEHeader jweHeader) throws Exception
             jwe.getKeyStorage()
                     .setEncryptionKey(decryptionKEK);
 
-            oauth = oauth.request(jwe.encodeJwe());
-            oauth.doLogin("test-user@localhost", "password");
+            oauth.loginForm().request(jwe.encodeJwe()).doLogin("test-user@localhost", "password");
             events.expectLogin().assertEvent();
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCBackwardsCompatibilityTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCBackwardsCompatibilityTest.java
index a93a7154214b..6ec59dab5b2c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCBackwardsCompatibilityTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCBackwardsCompatibilityTest.java
@@ -42,7 +42,7 @@
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import jakarta.ws.rs.core.UriBuilder;
 
@@ -81,7 +81,6 @@ public void clientConfiguration() {
          * @see AccessTokenTest#testAuthorizationNegotiateHeaderIgnored()
          */
         oauth.clientId("test-app");
-        oauth.maxAge(null);
     }
 
 
@@ -89,7 +88,7 @@ public void clientConfiguration() {
     @Test
     public void testExcludeSessionStateParameter() {
         // Open login form and login successfully. Assert session_state is present
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin("test-user@localhost", "password");
         EventRepresentation loginEvent = events.expectLogin().assertEvent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         Assert.assertNotNull(authzResponse.getSessionState());
@@ -102,11 +101,11 @@ public void testExcludeSessionStateParameter() {
         client.update(clientRep);
 
         // Open login again and assert session_state not present
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         org.keycloak.testsuite.Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
 
-        authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        authzResponse = oauth.parseLoginResponse();
         Assert.assertNull(authzResponse.getSessionState());
 
         // Revert
@@ -117,7 +116,7 @@ public void testExcludeSessionStateParameter() {
     @Test
     public void testExcludeIssuerParameter() {
         // Open login form and login successfully. Assert iss parameter is present
-        OAuthClient.AuthorizationEndpointResponse authzResponse = oauth.doLogin("test-user@localhost", "password");
+        AuthorizationEndpointResponse authzResponse = oauth.doLogin("test-user@localhost", "password");
         events.expectLogin().assertEvent();
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         Assert.assertEquals(oauth.AUTH_SERVER_ROOT + "/realms/test", authzResponse.getIssuer());
@@ -130,11 +129,11 @@ public void testExcludeIssuerParameter() {
         client.update(clientRep);
 
         // Open login again and assert iss parameter is not present
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         org.keycloak.testsuite.Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         events.expectLogin().detail(Details.USERNAME, "test-user@localhost").assertEvent();
 
-        authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        authzResponse = oauth.parseLoginResponse();
         Assert.assertNull(authzResponse.getIssuer());
 
         // Revert
@@ -146,10 +145,9 @@ public void testExcludeIssuerParameter() {
     public void testExcludeIssuerParameterOnError() throws IOException {
         // Open login form and login fails. Assert iss parameter is present
         oauth.responseType("tokenn");
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE);
         Assert.assertEquals(oauth.AUTH_SERVER_ROOT + "/realms/test", errorResponse.getIssuer());
@@ -164,9 +162,9 @@ public void testExcludeIssuerParameterOnError() throws IOException {
         client.update(clientRep);
 
         // Open login again and assert iss parameter is not present
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
-        errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        errorResponse = oauth.parseLoginResponse();
         assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.UNSUPPORTED_RESPONSE_TYPE);
         Assert.assertNull(errorResponse.getIssuer());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCDynamicScopeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCDynamicScopeTest.java
index fe0c2f490882..915ceeca0607 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCDynamicScopeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCDynamicScopeTest.java
@@ -237,7 +237,7 @@ private void testLoginAndClientScopesPermissions(String username, String expecte
         Tokens tokens = sendTokenRequest(loginEvent, userId, "openid email profile " + expectedRoleScopes, "test-app");
         Assert.assertNames(tokens.accessToken.getRealmAccess().getRoles(), expectedRoles);
 
-        oauth.doLogout(tokens.refreshToken, "password");
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(tokens.idToken.getSessionState())
                 .client("test-app")
                 .user(userId)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCPublicClientTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCPublicClientTest.java
index 49d8f3499147..7e96dab8e40f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCPublicClientTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCPublicClientTest.java
@@ -33,7 +33,7 @@
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import java.util.List;
 
@@ -97,8 +97,8 @@ public void accessTokenRequest() throws Exception {
         String sessionId = loginEvent.getSessionId();
         String codeId = loginEvent.getDetails().get(Details.CODE_ID);
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse response = oauth.doAccessTokenRequest(code, null);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
 
         assertEquals(200, response.getStatusCode());
         assertNotNull(response.getAccessToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCScopeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCScopeTest.java
index 08de002b294e..3dbdb3843a9e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCScopeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCScopeTest.java
@@ -44,7 +44,7 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.UserBuilder;
 import org.keycloak.testsuite.util.AccountHelper;
@@ -159,7 +159,6 @@ public void clientConfiguration() {
         ClientManager.realm(adminClient.realm("test")).clientId("test-app").directAccessGrant(true);
         oauth.clientId("test-app");
         oauth.scope(null);
-        oauth.maxAge(null);
     }
 
     @After
@@ -192,7 +191,7 @@ public void testBuiltinOptionalScopes() throws Exception {
         assertMicroprofile(tokens.accessToken, false);
 
         // Logout
-        oauth.doLogout(tokens.refreshToken, "password");
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(idToken.getSessionState())
                 .client("test-app")
                 .user(userId)
@@ -306,7 +305,7 @@ public void testRemoveScopes() throws Exception {
         assertPhone(idToken, false);
 
         // Logout
-        oauth.doLogout(tokens.refreshToken, "password");
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(idToken.getSessionState())
                 .client("test-app")
                 .user(userId)
@@ -342,7 +341,7 @@ public void testOptionalScopesWithConsentRequired() throws Exception {
         addressScope.update(addressScopeRep);
 
         oauth.clientId("third-party");
-        oauth.doLoginGrant("john", "password");
+        oauth.doLogin("john", "password");
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
@@ -363,7 +362,7 @@ public void testOptionalScopesWithConsentRequired() throws Exception {
         assertPhone(idToken, false);
 
         // Logout
-        oauth.doLogout(tokens.refreshToken, "password");
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(idToken.getSessionState())
                 .client("third-party")
                 .user(userId)
@@ -371,7 +370,7 @@ public void testOptionalScopesWithConsentRequired() throws Exception {
 
         // Login with optional scopes. Grant screen should have just "phone"
         oauth.scope("openid address phone");
-        oauth.doLoginGrant("john", "password");
+        oauth.doLogin("john", "password");
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PHONE_CONSENT_TEXT);
@@ -407,7 +406,7 @@ public void testClientDisplayedOnConsentScreen() throws Exception {
 
         // Login. Client should be displayed on consent screen
         oauth.clientId("third-party");
-        oauth.doLoginGrant("john", "password");
+        oauth.doLogin("john", "password");
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT, "ThirdParty permissions");
@@ -451,7 +450,7 @@ public void testClientDisplayedOnConsentScreenWithEmptyConsentText() throws Exce
 
         // Login. ConsentTexts are empty for the client and for the "profile" scope, so it should fallback to name/clientId
         oauth.clientId("third-party");
-        oauth.doLoginGrant("john", "password");
+        oauth.doLogin("john", "password");
 
         grantPage.assertCurrent();
         grantPage.assertGrants("profile", OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT, "third-party");
@@ -470,7 +469,7 @@ public void testClientDisplayedOnConsentScreenWithEmptyConsentText() throws Exce
     public void testRefreshTokenWithConsentRequired() {
         // Login with consentRequired
         oauth.clientId("third-party");
-        oauth.doLoginGrant("john", "password");
+        oauth.doLogin("john", "password");
 
         grantPage.assertCurrent();
         grantPage.assertGrants(OAuthGrantPage.PROFILE_CONSENT_TEXT, OAuthGrantPage.EMAIL_CONSENT_TEXT, OAuthGrantPage.ROLES_CONSENT_TEXT);
@@ -492,7 +491,7 @@ public void testRefreshTokenWithConsentRequired() {
         assertPhone(idToken, false);
 
         // Ensure that I can refresh token
-        OAuthClient.AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(tokens.refreshToken, "password");
+        AccessTokenResponse refreshResponse = oauth.doRefreshTokenRequest(tokens.refreshToken);
         Assert.assertEquals(200, refreshResponse.getStatusCode());
         idToken = oauth.verifyIDToken(refreshResponse.getIdToken());
 
@@ -513,7 +512,7 @@ public void testRefreshTokenWithConsentRequired() {
         Assert.assertEquals(userConsents.size(), 0);
 
         // Ensure I can't refresh anymore
-        refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken(), "password");
+        refreshResponse = oauth.doRefreshTokenRequest(refreshResponse.getRefreshToken());
         assertEquals(400, refreshResponse.getStatusCode());
         events.expectRefresh(refreshToken1.getId(), idToken.getSessionState())
                 .client("third-party")
@@ -580,14 +579,14 @@ public void testTwoRefreshTokensWithDifferentScopes() {
 
         // Ensure I can refresh refreshToken1. Just role1 is present
         oauth.scope(null);
-        OAuthClient.AccessTokenResponse refreshResponse1 = oauth.doRefreshTokenRequest(tokens1.refreshToken, "password");
+        AccessTokenResponse refreshResponse1 = oauth.doRefreshTokenRequest(tokens1.refreshToken);
         Assert.assertEquals(200, refreshResponse1.getStatusCode());
         AccessToken accessToken1 = oauth.verifyToken(refreshResponse1.getAccessToken());
         Assert.assertTrue(accessToken1.getRealmAccess().isUserInRole("role-1"));
         Assert.assertFalse(accessToken1.getRealmAccess().isUserInRole("role-2"));
 
         // Ensure I can refresh refreshToken2. Just role2 is present
-        OAuthClient.AccessTokenResponse refreshResponse2 = oauth.doRefreshTokenRequest(tokens2.refreshToken, "password");
+        AccessTokenResponse refreshResponse2 = oauth.doRefreshTokenRequest(tokens2.refreshToken);
         Assert.assertEquals(200, refreshResponse2.getStatusCode());
         AccessToken accessToken2 = oauth.verifyToken(refreshResponse2.getAccessToken());
         Assert.assertFalse(accessToken2.getRealmAccess().isUserInRole("role-1"));
@@ -665,7 +664,7 @@ private void testLoginAndClientScopesPermissions(String username, String expecte
         Tokens tokens = sendTokenRequest(loginEvent, userId,"openid email profile " + expectedRoleScopes, "test-app");
         Assert.assertNames(tokens.accessToken.getRealmAccess().getRoles(), expectedRoles);
 
-        oauth.doLogout(tokens.refreshToken, "password");
+        oauth.doLogout(tokens.refreshToken);
         events.expectLogout(tokens.idToken.getSessionState())
                 .client("test-app")
                 .user(userId)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java
index 89c05524ee68..20058e97e414 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCWellKnownProviderTest.java
@@ -24,7 +24,7 @@
 import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.util.AdminClientUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.wellknown.CustomOIDCWellKnownProviderFactory;
 
 import java.io.IOException;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/PkceGenerator.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/PkceGenerator.java
deleted file mode 100644
index b2536a6de435..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/PkceGenerator.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package org.keycloak.testsuite.oidc;
-
-import org.keycloak.common.util.Base64Url;
-
-import java.security.MessageDigest;
-import java.util.UUID;
-
-public class PkceGenerator {
-
-    private String codeVerifier;
-
-    private String codeChallenge;
-
-    public PkceGenerator() {
-        codeVerifier = UUID.randomUUID().toString() + "-" + UUID.randomUUID().toString(); // Good enough for testing, but shouldn't be used elsewhere
-        codeChallenge = generateS256CodeChallenge(codeVerifier);
-    }
-
-    public PkceGenerator(String codeVerifier) {
-        this.codeVerifier = codeVerifier;
-        codeChallenge = generateS256CodeChallenge(codeVerifier);
-    }
-
-    public String getCodeVerifier() {
-        return codeVerifier;
-    }
-
-    public String getCodeChallenge() {
-        return codeChallenge;
-    }
-
-    private String generateS256CodeChallenge(String codeVerifier) {
-        try {
-            MessageDigest md = MessageDigest.getInstance("SHA-256");
-            md.update(codeVerifier.getBytes("ISO_8859_1"));
-            byte[] digestBytes = md.digest();
-            String codeChallenge = Base64Url.encode(digestBytes);
-            return codeChallenge;
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java
index 0632beab4e75..9dd8402ced2e 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/UserInfoTest.java
@@ -49,6 +49,7 @@
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.jose.jws.crypto.RSAProvider;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.utils.OIDCResponseType;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.representations.idm.ClientScopeRepresentation;
@@ -57,6 +58,7 @@
 import org.keycloak.testsuite.client.resources.TestApplicationResourceUrls;
 import org.keycloak.testsuite.client.resources.TestOIDCEndpointsApplicationResource;
 import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
 import org.keycloak.testsuite.util.KeyUtils;
 import org.keycloak.testsuite.util.KeycloakModelUtils;
 import org.keycloak.protocol.oidc.OIDCAdvancedConfigWrapper;
@@ -73,12 +75,11 @@
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.util.AdminClientUtil;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.RealmBuilder;
 import org.keycloak.testsuite.util.RoleBuilder;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 import org.keycloak.testsuite.util.UserInfoClientUtil;
-import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.util.BasicAuthHelper;
 import org.keycloak.util.JsonSerialization;
 import org.keycloak.util.TokenUtil;
@@ -107,8 +108,9 @@
 import static org.junit.Assert.assertNull;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper.INCLUDE_IN_USERINFO;
+import static org.keycloak.testsuite.AbstractTestRealmKeycloakTest.TEST_REALM_NAME;
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 
 /**
  * @author pedroigor
@@ -260,8 +262,8 @@ public void testSuccess_dotsInClientId() throws Exception {
         userResource.roles().clientLevel(clientUUID).add(Collections.singletonList(fooRole));
 
         // Login to the new client
-        OAuthClient.AccessTokenResponse accessTokenResponse = oauth.clientId(clientId)
-                .doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse accessTokenResponse = oauth.client(clientId, "password")
+                .doPasswordGrantRequest("test-user@localhost", "password");
 
         AccessToken accessToken = oauth.verifyToken(accessTokenResponse.getAccessToken());
         Assert.assertNames(accessToken.getResourceAccess(clientId).getRoles(), "my.foo.role");
@@ -557,9 +559,10 @@ public void testSessionExpired() {
             events.expect(EventType.USER_INFO_REQUEST_ERROR)
                     .error(Errors.USER_SESSION_NOT_FOUND)
                     .user(Matchers.nullValue(String.class))
-                    .session(Matchers.nullValue(String.class))
+                    .session(accessTokenResponse.getSessionState())
                     .detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN)
                     .assertEvent();
+            events.assertEmpty();
 
         } finally {
             client.close();
@@ -600,10 +603,10 @@ public void testAccessTokenExpired() {
 
     @Test
     public void testAccessTokenAfterUserSessionLogoutAndLoginAgain() {
-        OAuthClient.AccessTokenResponse accessTokenResponse = loginAndForceNewLoginPage();
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse accessTokenResponse = loginAndForceNewLoginPage();
         String refreshToken1 = accessTokenResponse.getRefreshToken();
 
-        oauth.doLogout(refreshToken1, "password");
+        oauth.doLogout(refreshToken1);
         events.clear();
 
         setTimeOffset(2);
@@ -633,7 +636,7 @@ public void testAccessTokenAfterUserSessionLogoutAndLoginAgain() {
             events.expect(EventType.USER_INFO_REQUEST_ERROR)
                     .error(Errors.USER_SESSION_NOT_FOUND)
                     .user(Matchers.nullValue(String.class))
-                    .session(Matchers.nullValue(String.class))
+                    .session(accessTokenResponse.getSessionState())
                     .detail(Details.AUTH_METHOD, Details.VALIDATE_ACCESS_TOKEN)
                     .client("test-app")
                     .assertEvent();
@@ -642,6 +645,34 @@ public void testAccessTokenAfterUserSessionLogoutAndLoginAgain() {
         }
     }
 
+    // Issue 39037
+    @Test
+    public void testUserInfoWithOfflineAccessAndHybridFlow() throws Exception {
+        try (Client client = AdminClientUtil.createResteasyClient();
+             ClientAttributeUpdater oidcClient = ClientAttributeUpdater.forClient(adminClient, TEST_REALM_NAME, "test-app")
+                .setImplicitFlowEnabled(true)
+                .update()) {
+            oauth.scope(OAuth2Constants.SCOPE_OPENID + " " + OAuth2Constants.OFFLINE_ACCESS)
+                    .responseType(OIDCResponseType.CODE + " " + OIDCResponseType.TOKEN)
+                    .doLogin("test-user@localhost", "password");
+            AuthorizationEndpointResponse authzEndpointResponse = oauth.parseLoginResponse();
+
+            // UserInfo request with the accessToken returned from authz endpoint
+            Response response1 = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, authzEndpointResponse.getAccessToken());
+            assertResponseSuccessful(response1);
+
+            org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(authzEndpointResponse.getCode());
+
+            // Another userInfo request with the accessToken (but after tokens are exchanged)
+            Response response2 = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, authzEndpointResponse.getAccessToken());
+            assertResponseSuccessful(response2);
+
+            // UserInfo request with the token returned from token response
+            Response response3 = UserInfoClientUtil.executeUserInfoRequest_getMethod(client, tokenResponse.getAccessToken());
+            assertResponseSuccessful(response3);
+        }
+    }
+
     @Test
     public void testNotBeforeTokens() {
         Client client = AdminClientUtil.createResteasyClient();
@@ -872,7 +903,7 @@ public void testUnsuccessfulUserInfoRequestWithDisabledUser() {
     @Test
     public void testUserInfoRequestWithSamlClient() throws Exception {
         // obtain an access token
-        String accessToken = oauth.doGrantAccessTokenRequest("test", "test-user@localhost", "password", null, "saml-client", "secret").getAccessToken();
+        String accessToken = oauth.client("saml-client", "secret").doPasswordGrantRequest( "test-user@localhost", "password").getAccessToken();
 
         // change client's protocol
         ClientRepresentation samlClient = adminClient.realm("test").clients().findByClientId("saml-client").get(0);
@@ -1029,20 +1060,16 @@ private void testSuccessSignedResponse(String sigAlg, String acceptHeader) throw
         }
     }
 
-    private OAuthClient.AccessTokenResponse loginAndForceNewLoginPage() {
+    private org.keycloak.testsuite.util.oauth.AccessTokenResponse loginAndForceNewLoginPage() {
         oauth.doLogin("test-user@localhost", "password");
 
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        oauth.clientSessionState("client-session");
+        String code = oauth.parseLoginResponse().getCode();
 
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        org.keycloak.testsuite.util.oauth.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
 
         setTimeOffset(1);
 
-        String loginFormUri = UriBuilder.fromUri(oauth.getLoginFormUrl())
-                .queryParam(OIDCLoginProtocol.PROMPT_PARAM, OIDCLoginProtocol.PROMPT_VALUE_LOGIN)
-                .build().toString();
-        driver.navigate().to(loginFormUri);
+        oauth.loginForm().prompt(OIDCLoginProtocol.PROMPT_VALUE_LOGIN).open();
 
         loginPage.assertCurrent();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/AbstractOIDCResponseTypeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/AbstractOIDCResponseTypeTest.java
index ff375bf83d45..c8b060749a7e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/AbstractOIDCResponseTypeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/AbstractOIDCResponseTypeTest.java
@@ -38,7 +38,8 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.util.ClientManager;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.TokenSignatureUtil;
 
 import jakarta.ws.rs.core.UriBuilder;
@@ -82,7 +83,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
     public void nonceAndSessionStateMatches() {
         EventRepresentation loginEvent = loginUser("abcdef123456");
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, isFragment());
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         Assert.assertNotNull(authzResponse.getSessionState());
 
         List<IDToken> idTokens = testAuthzResponseAndRetrieveIDTokens(authzResponse, loginEvent);
@@ -98,7 +99,7 @@ public void nonceAndSessionStateMatches() {
     public void initialSessionStateUsedInRedirect() {
         EventRepresentation loginEvent = loginUserWithRedirect("abcdef123456", OAuthClient.APP_ROOT + "/auth?session_state=foo");
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, isFragment());
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         Assert.assertNotNull(authzResponse.getSessionState());
 
         List<IDToken> idTokens = testAuthzResponseAndRetrieveIDTokens(authzResponse, loginEvent);
@@ -112,11 +113,10 @@ public void initialSessionStateUsedInRedirect() {
     @Test
     public void authorizationRequestMissingResponseType() throws IOException {
         oauth.responseType(null);
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
         // Always read error from the "query"
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, false);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         org.junit.Assert.assertTrue(errorResponse.isRedirected());
         org.junit.Assert.assertEquals(errorResponse.getError(), OAuthErrorException.INVALID_REQUEST);
 
@@ -128,14 +128,13 @@ protected void validateNonceNotUsedSuccessExpected() {
     }
 
     protected void validateNonceNotUsedErrorExpected() {
-        oauth.nonce(null);
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.loginForm().nonce(null).open();
 
         assertFalse(loginPage.isCurrent());
         assertTrue(appPage.isCurrent());
 
         // Assert error response was sent because not logged in
-        OAuthClient.AuthorizationEndpointResponse resp = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse resp = oauth.parseLoginResponse();
         Assert.assertNull(resp.getCode());
         Assert.assertNull(resp.getIdToken());
         Assert.assertEquals(OAuthErrorException.INVALID_REQUEST, resp.getError());
@@ -147,10 +146,9 @@ protected void validateErrorImplicitFlowNotAllowed() throws Exception {
         // Disable implicit flow for client
         clientManagerBuilder().implicitFlow(false);
 
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.UNAUTHORIZED_CLIENT);
         Assert.assertEquals(errorResponse.getErrorDescription(), "Client is not allowed to initiate browser login with given response_type. Implicit flow is disabled for the client.");
@@ -166,10 +164,9 @@ protected void validateErrorStandardFlowNotAllowed() throws Exception {
         // Disable standard flow for client
         clientManagerBuilder().standardFlow(false);
 
-        UriBuilder b = UriBuilder.fromUri(oauth.getLoginFormUrl());
-        driver.navigate().to(b.build().toURL());
+        oauth.openLoginForm();
 
-        OAuthClient.AuthorizationEndpointResponse errorResponse = new OAuthClient.AuthorizationEndpointResponse(oauth);
+        AuthorizationEndpointResponse errorResponse = oauth.parseLoginResponse();
         Assert.assertTrue(errorResponse.isRedirected());
         Assert.assertEquals(errorResponse.getError(), OAuthErrorException.UNAUTHORIZED_CLIENT);
         Assert.assertEquals(errorResponse.getErrorDescription(), "Client is not allowed to initiate browser login with given response_type. Standard flow is disabled for the client.");
@@ -183,11 +180,7 @@ protected void validateErrorStandardFlowNotAllowed() throws Exception {
 
 
     protected EventRepresentation loginUser(String nonce) {
-        if (nonce != null) {
-            oauth.nonce(nonce);
-        }
-
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.loginForm().nonce(nonce).state("somestate").open();
 
         loginPage.assertCurrent();
         loginPage.login("test-user@localhost", "password");
@@ -197,15 +190,11 @@ protected EventRepresentation loginUser(String nonce) {
     }
 
     protected EventRepresentation loginUserWithRedirect(String nonce, String redirectUri) {
-        if (nonce != null) {
-            oauth.nonce(nonce);
-        }
-
         if (redirectUri != null) {
             oauth.redirectUri(redirectUri);
         }
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.loginForm().nonce(nonce).state("somestate").open();
 
         loginPage.assertCurrent();
         loginPage.login("test-user@localhost", "password");
@@ -216,7 +205,7 @@ protected EventRepresentation loginUserWithRedirect(String nonce, String redirec
 
     protected abstract boolean isFragment();
 
-    protected abstract List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent);
+    protected abstract List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent);
 
     protected ClientManager.ClientManagerBuilder clientManagerBuilder() {
         return ClientManager.realm(adminClient.realm("test")).clientId("test-app");
@@ -225,7 +214,7 @@ protected ClientManager.ClientManagerBuilder clientManagerBuilder() {
     private void oidcFlow(String expectedAccessAlg, String expectedIdTokenAlg) throws Exception {
         EventRepresentation loginEvent = loginUser("abcdef123456");
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, isFragment());
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         Assert.assertNotNull(authzResponse.getSessionState());
 
         JWSHeader header = null;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeCodeTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeCodeTest.java
index afddf840926b..0769f691477a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeCodeTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeCodeTest.java
@@ -19,13 +19,13 @@
 
 import org.junit.Before;
 import org.junit.Test;
-import org.keycloak.crypto.KeyWrapper;
 import org.keycloak.events.Details;
 import org.keycloak.protocol.oidc.utils.OIDCResponseType;
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Collections;
 import java.util.List;
@@ -52,13 +52,13 @@ protected boolean isFragment() {
     }
 
     @Override
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         Assert.assertNull(authzResponse.getAccessToken());
         Assert.assertNull(authzResponse.getIdToken());
 
-        OAuthClient.AccessTokenResponse authzResponse2 = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse authzResponse2 = sendTokenRequestAndGetResponse(loginEvent);
         IDToken idToken2 = oauth.verifyIDToken(authzResponse2.getIdToken());
 
         // Validate "at_hash"
@@ -78,7 +78,7 @@ protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.Authori
     public void nonceNotUsed() {
         EventRepresentation loginEvent = loginUser(null);
 
-        OAuthClient.AuthorizationEndpointResponse authzResponse = new OAuthClient.AuthorizationEndpointResponse(oauth, false);
+        AuthorizationEndpointResponse authzResponse = oauth.parseLoginResponse();
         List<IDToken> idTokens = testAuthzResponseAndRetrieveIDTokens(authzResponse, loginEvent);
         for (IDToken idToken : idTokens) {
             Assert.assertNull(idToken.getNonce());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeNoneTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeNoneTest.java
index b8576377eb5f..114330806ba0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeNoneTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCBasicResponseTypeNoneTest.java
@@ -23,7 +23,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Collections;
 import java.util.List;
@@ -50,7 +50,7 @@ protected boolean isFragment() {
     }
 
     @Override
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.NONE, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         Assert.assertNull(authzResponse.getCode());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTest.java
index d5e0f1b64c9a..1969f734f5cf 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTest.java
@@ -26,7 +26,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Arrays;
 import java.util.List;
@@ -53,7 +53,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         // IDToken from the authorization response
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTokenTest.java
index 749f6c87111e..659be080e54a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenAsDetachedSigTokenTest.java
@@ -26,7 +26,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Arrays;
 import java.util.List;
@@ -53,7 +53,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         // IDToken from the authorization response
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTest.java
index 3ecd95c3bc16..af0953bcecc3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTest.java
@@ -25,7 +25,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Arrays;
 import java.util.List;
@@ -52,7 +52,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         // IDToken from the authorization response
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTokenTest.java
index 62f6073dd66a..c88d6e807e5e 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeIDTokenTokenTest.java
@@ -25,7 +25,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Arrays;
 import java.util.List;
@@ -52,7 +52,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         // IDToken from the authorization response
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeTokenTest.java
index 7538bcdcb975..25cf9215c33c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCHybridResponseTypeCodeTokenTest.java
@@ -24,7 +24,8 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Collections;
 import java.util.List;
@@ -51,14 +52,14 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.CODE + " " + OIDCResponseType.TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         Assert.assertNotNull(authzResponse.getAccessToken());
         Assert.assertNull(authzResponse.getIdToken());
 
         // IDToken exchanged for the code
-        OAuthClient.AccessTokenResponse authzResponse2 = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse authzResponse2 = sendTokenRequestAndGetResponse(loginEvent);
         IDToken idToken2 = oauth.verifyIDToken(authzResponse2.getIdToken());
 
         // Validate "at_hash"
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTest.java
index e8bc6ea3d93b..cb81f57ecafc 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTest.java
@@ -24,7 +24,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Collections;
 import java.util.List;
@@ -51,7 +51,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.ID_TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         Assert.assertNull(authzResponse.getAccessToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTokenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTokenTest.java
index cfc3c66a24e4..d18b397cf554 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTokenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/flows/OIDCImplicitResponseTypeIDTokenTokenTest.java
@@ -24,7 +24,7 @@
 import org.keycloak.representations.IDToken;
 import org.keycloak.representations.idm.EventRepresentation;
 import org.keycloak.testsuite.Assert;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 
 import java.util.Collections;
 import java.util.List;
@@ -51,7 +51,7 @@ protected boolean isFragment() {
     }
 
 
-    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(OAuthClient.AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
+    protected List<IDToken> testAuthzResponseAndRetrieveIDTokens(AuthorizationEndpointResponse authzResponse, EventRepresentation loginEvent) {
         Assert.assertEquals(OIDCResponseType.ID_TOKEN + " " + OIDCResponseType.TOKEN, loginEvent.getDetails().get(Details.RESPONSE_TYPE));
 
         Assert.assertNotNull(authzResponse.getAccessToken());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/AbstractOrganizationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/AbstractOrganizationTest.java
index 3c23f69927fc..35f4c63989fb 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/AbstractOrganizationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/AbstractOrganizationTest.java
@@ -52,6 +52,7 @@
 import org.keycloak.testsuite.broker.KcOidcBrokerConfiguration;
 import org.keycloak.testsuite.organization.broker.BrokerConfigurationWrapper;
 import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.IdpConfirmLinkPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.SelectOrganizationPage;
@@ -72,6 +73,9 @@ public abstract class AbstractOrganizationTest extends AbstractAdminTest  {
     @Page
     protected LoginPage loginPage;
 
+    @Page
+    protected ErrorPage errorPage;
+
     @Page
     protected SelectOrganizationPage selectOrganizationPage;
 
@@ -170,18 +174,24 @@ protected MemberRepresentation addMember(OrganizationResource organization) {
     }
 
     protected MemberRepresentation addMember(OrganizationResource organization, String email) {
-        return addMember(organization, email, null, null);
+        return addMember(organization, null, email, null, null, true);
     }
 
     protected MemberRepresentation addMember(OrganizationResource organization, String email, String firstName, String lastName) {
+        return addMember(organization, null, email, firstName, lastName, true);
+    }
+
+    protected MemberRepresentation addMember(OrganizationResource organization, String username, String email, String firstName, String lastName, boolean isSetCredentials) {
         UserRepresentation expected = new UserRepresentation();
 
         expected.setEmail(email);
-        expected.setUsername(expected.getEmail());
+        expected.setUsername(username == null ? expected.getEmail() : username);
         expected.setEnabled(true);
         expected.setFirstName(firstName);
         expected.setLastName(lastName);
-        Users.setPasswordFor(expected, memberPassword);
+        if (isSetCredentials) {
+            Users.setPasswordFor(expected, memberPassword);
+        }
 
         try (Response response = testRealm().users().create(expected)) {
             expected.setId(ApiUtil.getCreatedId(response));
@@ -246,7 +256,11 @@ protected void assertIsMember(String userEmail, OrganizationResource organizatio
     }
 
     protected UserRepresentation getUserRepresentation(String userEmail) {
-        UsersResource users = adminClient.realm(bc.consumerRealmName()).users();
+        return getUserRepresentation(bc.consumerRealmName(), userEmail);
+    }
+
+    protected UserRepresentation getUserRepresentation(String realm, String userEmail) {
+        UsersResource users = adminClient.realm(realm).users();
         List<UserRepresentation> reps = users.searchByEmail(userEmail, true);
         Assert.assertFalse(reps.isEmpty());
         Assert.assertEquals(1, reps.size());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationInvitationLinkTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationInvitationLinkTest.java
index 6275fcd367dc..5936a53f85e2 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationInvitationLinkTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationInvitationLinkTest.java
@@ -21,11 +21,15 @@
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.empty;
 import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.keycloak.services.messages.Messages.ORG_MEMBER_ALREADY;
 
 import java.io.IOException;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Predicate;
 
@@ -41,6 +45,9 @@
 import org.keycloak.admin.client.resource.OrganizationResource;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.cookie.CookieType;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.utils.DefaultAuthenticationFlows;
+import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
 import org.keycloak.representations.idm.MemberRepresentation;
 import org.keycloak.representations.idm.MembershipType;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -48,6 +55,8 @@
 import org.keycloak.testsuite.Assert;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.admin.authentication.AbstractAuthenticationTest;
+import org.keycloak.testsuite.authentication.PushButtonAuthenticatorFactory;
 import org.keycloak.testsuite.pages.InfoPage;
 import org.keycloak.testsuite.pages.RegisterPage;
 import org.keycloak.testsuite.updaters.OrganizationAttributeUpdater;
@@ -55,8 +64,9 @@
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
 import org.keycloak.testsuite.util.MailUtils.EmailBody;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.UserBuilder;
+import org.openqa.selenium.By;
 
 public class OrganizationInvitationLinkTest extends AbstractOrganizationTest {
 
@@ -77,10 +87,18 @@ public void setDriverTimeout() {
         driver.manage().timeouts().pageLoadTimeout(Duration.ofMinutes(1));
     }
 
+    @Before
+    public void disableSelfRegistration() {
+        RealmRepresentation representation = testRealm().toRepresentation();
+        representation.setRegistrationAllowed(false);
+        testRealm().update(representation);
+    }
+
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
         Map<String, String> smtpConfig = testRealm.getSmtpServer();
         super.configureTestRealm(testRealm);
+        testRealm.setRegistrationAllowed(false);
         testRealm.setSmtpServer(smtpConfig);
     }
 
@@ -111,6 +129,31 @@ public void testInviteExistingUserCustomRedirectUrl() throws IOException, Messag
         }
     }
 
+    @Test
+    public void testRedirectAfterClickingSecondTimeOnInvitation() throws IOException, MessagingException {
+        UserRepresentation user = createUser("invited", "invited@myemail.com");
+
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+
+        try (
+                OrganizationAttributeUpdater oau = new OrganizationAttributeUpdater(organization).setRedirectUrl(OAuthClient.APP_AUTH_ROOT).update();
+                Response response = organization.members().inviteExistingUser(user.getId());
+        ) {
+            assertThat(response.getStatus(), equalTo(Response.Status.NO_CONTENT.getStatusCode()));
+
+            acceptInvitation(organization, user, "AUTH_RESPONSE");
+
+            String link = getInvitationLinkFromEmail(user.getFirstName(), user.getLastName());
+            driver.navigate().to(link);
+
+            assertThat(driver.getPageSource(), containsString(ORG_MEMBER_ALREADY));
+
+            infoPage.clickBackToApplicationLink();
+            // redirect to the redirectUrl of the organization
+            assertThat(driver.getTitle(), containsString("AUTH_RESPONSE"));
+        }
+    }
+
     @Test
     public void testInviteExistingUserWithEmail() throws IOException, MessagingException {
         UserRepresentation user = createUser("invitedWithMatchingEmail", "invitedWithMatchingEmail@myemail.com");
@@ -162,6 +205,48 @@ public void testInviteNewUserRegistration() throws IOException, MessagingExcepti
         Assert.assertNotNull(driver.manage().getCookieNamed(CookieType.IDENTITY.getName()));
     }
 
+    @Test
+    public void testInviteNewUserRegistrationCustomRegistrationFlow() throws IOException, MessagingException {
+        String registrationFlowAlias = "custom-registration-flow";
+        HashMap<String, Object> params = new HashMap<>();
+        params.put("newName", registrationFlowAlias);
+        testRealm().flows().copy(DefaultAuthenticationFlows.REGISTRATION_FLOW, params).close();
+        String flowId = AbstractAuthenticationTest.findFlowByAlias(registrationFlowAlias, testRealm().flows().getFlows()).getId();
+        AuthenticationExecutionRepresentation execution = new AuthenticationExecutionRepresentation();
+        execution.setParentFlow(flowId);
+        execution.setAuthenticator(PushButtonAuthenticatorFactory.PROVIDER_ID);
+        execution.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString());
+        testRealm().flows().addExecution(execution).close();
+        RealmRepresentation realm = testRealm().toRepresentation();
+        assertThat(realm.isRegistrationAllowed(), is(false));
+        realm.setRegistrationFlow(registrationFlowAlias);
+        testRealm().update(realm);
+        getCleanup().addCleanup(() -> {
+            realm.setRegistrationFlow(DefaultAuthenticationFlows.REGISTRATION_FLOW);
+        });
+
+        String email = "inviteduser@email";
+        String firstName = "Homer";
+        String lastName = "Simpson";
+
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        organization.members().inviteUser(email, firstName, lastName).close();
+
+        registerUser(organization, email);
+        driver.findElement(By.name("submit1")).click();
+        List<UserRepresentation> users = testRealm().users().searchByEmail(email, true);
+        assertThat(users, Matchers.not(empty()));
+        // user is a member
+        MemberRepresentation member = organization.members().member(users.get(0).getId()).toRepresentation();
+        Assert.assertNotNull(member);
+        assertThat(member.getMembershipType(), equalTo(MembershipType.MANAGED));
+        getCleanup().addCleanup(() -> testRealm().users().get(users.get(0).getId()).remove());
+
+        // authenticated to the account console
+        Assert.assertTrue(driver.getPageSource().contains("Account Management"));
+        Assert.assertNotNull(driver.manage().getCookieNamed(CookieType.IDENTITY.getName()));
+    }
+
     @Test
     public void testInviteNewUserRegistrationCustomRedirectUrl() throws IOException, MessagingException {
         String email = "inviteduser@email";
@@ -213,6 +298,45 @@ public void testRegistrationEnabledWhenInvitingNewUser() throws Exception {
         }
     }
 
+    @Test
+    public void testRegistrationEnabledWhenInvitingNewUserWithLocalization() throws Exception {
+        String email = "inviteduser@email";
+
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        try (
+                RealmAttributeUpdater rau = new RealmAttributeUpdater(testRealm()).setRegistrationAllowed(Boolean.TRUE).update();
+                Response response = organization.members().inviteUser(email, null, null)
+        ) {
+            RealmRepresentation realmRep = testRealm().toRepresentation();
+            Boolean internationalizationEnabled = realmRep.isInternationalizationEnabled();
+            realmRep.setInternationalizationEnabled(true);
+            realmRep.setSupportedLocales(Set.of("en", "pt-BR"));
+            testRealm().update(realmRep);
+            getCleanup().addCleanup(() -> {
+                realmRep.setInternationalizationEnabled(internationalizationEnabled);
+                testRealm().update(realmRep);
+            });
+
+            assertThat(response.getStatus(), equalTo(Response.Status.NO_CONTENT.getStatusCode()));
+
+            String link = getInvitationLinkFromEmail();
+            driver.navigate().to(link);
+            Assert.assertFalse(organization.members().list(-1, -1).stream().anyMatch(actual -> email.equals(actual.getEmail())));
+            registerPage.assertCurrent(organizationName);
+            registerPage.openLanguage("Portuguese");
+            Assert.assertTrue(driver.getPageSource().contains("Campos obrigatórios"));
+            registerPage.register("firstName", "lastName", email,
+                    "invitedUser", "password", "password", null, false, null);
+            // authenticated to the account console
+            Assert.assertTrue(driver.getPageSource().contains("Account Management"));
+            Assert.assertNotNull(driver.manage().getCookieNamed(CookieType.IDENTITY.getName()));
+
+            List<MemberRepresentation> memberByEmail = organization.members().search(email, Boolean.TRUE, null, null);
+            assertThat(memberByEmail, Matchers.hasSize(1));
+            assertThat(memberByEmail.get(0).getMembershipType(), equalTo(MembershipType.MANAGED));
+        }
+    }
+
     @Test
     public void testEmailDoesNotChangeOnRegistration() throws IOException, MessagingException {
         String email = "inviteduser@email";
@@ -257,7 +381,7 @@ private String getInvitationLinkFromEmail(String ...parameters) throws Messaging
         assertThat(text, Matchers.containsString(("<a href=\"" + link + "\" rel=\"nofollow\">Link to join the organization</a></p>")));
         assertThat(text, Matchers.containsString(("Link to join the organization")));
         assertThat(text, Matchers.containsString(("This link will expire within 12 hours")));
-        assertThat(text, Matchers.containsString(("<p>If you dont want to join the organization, just ignore this message.</p>")));
+        assertThat(text, Matchers.containsString(("<p>If you don&#39;t want to join the organization, just ignore this message.</p>")));
 
         String orgToken = UriUtils.parseQueryParameters(link, false).values().stream().map(strings -> strings.get(0)).findFirst().orElse(null);
         Assert.assertNotNull(orgToken);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationTest.java
index d295523f7217..09bc5885b046 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/admin/OrganizationTest.java
@@ -94,6 +94,19 @@ public void testUpdate() {
         assertThat(expected.getDescription(), is(equalTo(existing.getDescription())));
     }
 
+    @Test
+    public void testUpdateConflict() {
+        OrganizationRepresentation org1 = createOrganization();
+        OrganizationRepresentation org2 = createOrganization("orga");
+
+        org1.setName(org2.getName());
+        OrganizationResource organization = testRealm().organizations().get(org1.getId());
+
+        try (Response response = organization.update(org1)) {
+            assertEquals(Status.CONFLICT.getStatusCode(), response.getStatus());
+        }
+    }
+
     @Test
     public void testGet() {
         OrganizationRepresentation expected = createOrganization();
@@ -139,7 +152,9 @@ public void testSearch() {
 
         // test exact search by name (e.g. 'wayne-industries'), e-mail (e.g. 'gtbank.net'), and no result (e.g. 'nonexistent.com')
         List<OrganizationRepresentation> existing = testRealm().organizations().search("wayne-industries", true, 0, 10);
+        long count = testRealm().organizations().count("wayne-industries", true);
         assertThat(existing, hasSize(1));
+        assertThat(existing, hasSize((int) count));
         OrganizationRepresentation orgRep = existing.get(0);
         assertThat(orgRep.getName(), is(equalTo("wayne-industries")));
         assertThat(orgRep.isEnabled(), is(true));
@@ -149,7 +164,10 @@ public void testSearch() {
         assertThat(orgRep.getAttributes(), nullValue());
 
         existing = testRealm().organizations().search("gtbank.net", true, 0, 10);
+        count = testRealm().organizations().count("gtbank.net", true);
+
         assertThat(existing, hasSize(1));
+        assertThat(existing, hasSize((int) count));
         orgRep = existing.get(0);
         assertThat(orgRep.getName(), is(equalTo("Gotham-Bank")));
         assertThat(orgRep.isEnabled(), is(true));
@@ -161,41 +179,54 @@ public void testSearch() {
         orgRep.singleAttribute("foo", "bar");
         orgRep.singleAttribute("bar", "foo");
         testRealm().organizations().get(orgRep.getId()).update(orgRep).close();
-        existing = testRealm().organizations().search("gtbank.net", true, 0, 10, true);
+        existing = testRealm().organizations().search("gtbank.net", true, 0, 10, false);
         assertThat(existing, hasSize(1));
         orgRep = existing.get(0);
         assertThat(orgRep.getAttributes(), notNullValue());
         assertThat(2, is(orgRep.getAttributes().size()));
 
         existing = testRealm().organizations().search("nonexistent.org", true, 0, 10);
+        count = testRealm().organizations().count("nonexistent.org", true);
         assertThat(existing, is(empty()));
+        assertThat(count, is(equalTo(0L)));
 
         // partial search matching name (e.g. 'wa' matching 'wayne-industries', and 'TheWave')
         existing = testRealm().organizations().search("wa", false, 0, 10);
+        count = testRealm().organizations().count("wa", false);
         assertThat(existing, hasSize(2));
+        assertThat(existing, hasSize((int) count));
         List<String> orgNames = existing.stream().map(OrganizationRepresentation::getName).collect(Collectors.toList());
         assertThat(orgNames, containsInAnyOrder("wayne-industries", "TheWave"));
 
         // partial search matching domain (e.g. '.net', matching acme and gotham-bank)
         existing = testRealm().organizations().search(".net", false, 0, 10);
+        count = testRealm().organizations().count(".net", false);
         assertThat(existing, hasSize(2));
+        assertThat(existing, hasSize((int) count));
         orgNames = existing.stream().map(OrganizationRepresentation::getName).collect(Collectors.toList());
         assertThat(orgNames, containsInAnyOrder("Gotham-Bank", "acme"));
 
         // partial search matching both a domain and org name, on two different orgs (e.g. 'gotham' matching 'Gotham-Bank' by name and 'wayne-industries' by domain)
         existing = testRealm().organizations().search("gotham", false, 0, 10);
+        count = testRealm().organizations().count("gotham", false);
         assertThat(existing, hasSize(2));
+        assertThat(existing, hasSize((int) count));
         orgNames = existing.stream().map(OrganizationRepresentation::getName).collect(Collectors.toList());
         assertThat(orgNames, containsInAnyOrder("Gotham-Bank", "wayne-industries"));
 
         // partial search matching no org (e.g. nonexistent)
         existing = testRealm().organizations().search("nonexistent", false, 0, 10);
+        count = testRealm().organizations().count("nonexistent", false);
         assertThat(existing, is(empty()));
+        assertThat(existing, hasSize((int) count));
 
         // paginated search - create more orgs, try to fetch them all in paginated form.
         for (int i = 0; i < 10; i++) {
             createOrganization("ztest-" + i);
         }
+        count = testRealm().organizations().count("", false);
+        assertThat(count, equalTo(14L));
+
         existing = testRealm().organizations().search("", false, 0, 10);
         // first page should have 10 results.
         assertThat(existing, hasSize(10));
@@ -244,8 +275,10 @@ public void testSearchByAttributes() {
 
         // search for "attr1:value1" - should match testorg.0, testorg.1, and testorg.2
         List<OrganizationRepresentation> fetchedOrgs = testRealm().organizations().searchByAttribute("attr1:value1");
+        long count = testRealm().organizations().countByAttribute("attr1:value1");
         fetchedOrgs.sort(Comparator.comparing(OrganizationRepresentation::getName));
         assertThat(fetchedOrgs, hasSize(3));
+        assertThat(fetchedOrgs, hasSize((int) count));
         assertThat(fetchedOrgs.get(0).getName(), is(equalTo(expected.get(0).getName())));
         assertThat(fetchedOrgs.get(1).getName(), is(equalTo(expected.get(1).getName())));
         assertThat(fetchedOrgs.get(2).getName(), is(equalTo(expected.get(2).getName())));
@@ -253,27 +286,46 @@ public void testSearchByAttributes() {
         // search for "attr2:value2" - should match testorg.1 and testorg.3
         fetchedOrgs = testRealm().organizations().searchByAttribute("attr2:value2");
         fetchedOrgs.sort(Comparator.comparing(OrganizationRepresentation::getName));
+        count = testRealm().organizations().countByAttribute("attr2:value2");
         assertThat(fetchedOrgs, hasSize(2));
+        assertThat(fetchedOrgs, hasSize((int) count));
         assertThat(fetchedOrgs.get(0).getName(), is(equalTo(expected.get(1).getName())));
         assertThat(fetchedOrgs.get(1).getName(), is(equalTo(expected.get(3).getName())));
 
         // search for "attr3:value3" - should match only testorg.2
         fetchedOrgs = testRealm().organizations().searchByAttribute("attr3:value3");
+        count = testRealm().organizations().countByAttribute("attr3:value3");
         assertThat(fetchedOrgs, hasSize(1));
+        assertThat(fetchedOrgs, hasSize((int) count));
         assertThat(fetchedOrgs.get(0).getName(), is(equalTo(expected.get(2).getName())));
 
         // search for both "attr1:value1 attr2:value2" - should match only testorg.1
         fetchedOrgs = testRealm().organizations().searchByAttribute("attr1:value1 attr2:value2");
+        count = testRealm().organizations().countByAttribute("attr1:value1 attr2:value2");
         assertThat(fetchedOrgs, hasSize(1));
+        assertThat(fetchedOrgs, hasSize((int) count));
         assertThat(fetchedOrgs.get(0).getName(), is(equalTo(expected.get(1).getName())));
 
         // search for both "attr2:value2 attr3:value3" - not org has both of these attributes at the same time.
         fetchedOrgs = testRealm().organizations().searchByAttribute("attr2:value2 attr3:value3");
+        count = testRealm().organizations().countByAttribute("attr2:value2 attr3:value3");
         assertThat(fetchedOrgs, hasSize(0));
+        assertThat(fetchedOrgs, hasSize((int) count));
 
         // search for "anything:anyvalue" - should again match no org because no org has this attribute.
         fetchedOrgs = testRealm().organizations().searchByAttribute("anything:anyvalue");
+        count = testRealm().organizations().countByAttribute("anything:anyvalue");
         assertThat(fetchedOrgs, hasSize(0));
+        assertThat(fetchedOrgs, hasSize((int) count));
+    }
+
+    @Test
+    public void testCountEndpoint() {
+        createOrganization("testorg.1");
+        createOrganization("testorg.2");
+
+        assertThat(testRealm().organizations().count(null), is(equalTo(2L)));
+        assertThat(testRealm().organizations().count(".1"), is(equalTo(1L)));
     }
 
     @Test
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/authentication/OrganizationAuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/authentication/OrganizationAuthenticationTest.java
index 2fbb17f0b778..24426b528c2c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/authentication/OrganizationAuthenticationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/authentication/OrganizationAuthenticationTest.java
@@ -22,16 +22,29 @@
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
 
 import java.io.IOException;
+import java.net.URLDecoder;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
+import jakarta.ws.rs.core.Response;
 import org.hamcrest.Matcher;
 import org.hamcrest.Matchers;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.OrganizationResource;
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel.RequiredAction;
+import org.keycloak.models.utils.DefaultAuthenticationFlows;
+import org.keycloak.organization.authentication.authenticators.browser.OrganizationAuthenticatorFactory;
+import org.keycloak.representations.idm.OrganizationRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.organization.admin.AbstractOrganizationTest;
+import org.keycloak.testsuite.runonserver.RunOnServer;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
+import org.keycloak.testsuite.util.FlowUtil;
+import org.keycloak.testsuite.util.UserBuilder;
 
 public class OrganizationAuthenticationTest extends AbstractOrganizationTest {
 
@@ -119,9 +132,8 @@ public void testForceReAuthenticationBeforeRequiredAction() {
 
         try {
             setTimeOffset(10);
-            oauth.maxAge("1");
-            oauth.kcAction(RequiredAction.UPDATE_PASSWORD.name());
-            loginPage.open(bc.consumerRealmName());
+            oauth.realm(bc.consumerRealmName());
+            oauth.loginForm().maxAge(1).kcAction(RequiredAction.UPDATE_PASSWORD.name()).open();
             loginPage.assertCurrent();
             Matcher<String> expectedInfo = is("Please re-authenticate to continue");
             assertThat(loginPage.getInfoMessage(), expectedInfo);
@@ -130,8 +142,139 @@ public void testForceReAuthenticationBeforeRequiredAction() {
             appPage.assertCurrent();
         } finally {
             resetTimeOffset();
-            oauth.kcAction(null);
-            oauth.maxAge(null);
         }
     }
+
+    @Test
+    public void testRequiresUserMembership() {
+        runOnServer(setAuthenticatorConfig(OrganizationAuthenticatorFactory.REQUIRES_USER_MEMBERSHIP, Boolean.TRUE.toString()));
+
+        try {
+            OrganizationRepresentation org = createOrganization();
+            OrganizationResource organization = testRealm().organizations().get(org.getId());
+            UserRepresentation member = addMember(organization);
+            organization.members().member(member.getId()).delete().close();
+            oauth.clientId("broker-app");
+            loginPage.open(bc.consumerRealmName());
+            loginPage.loginUsername(member.getEmail());
+            // user is not a member of any organization
+            assertThat(errorPage.getError(), Matchers.containsString("User is not a member of the organization " + org.getName()));
+
+            organization.members().addMember(member.getId()).close();
+            OrganizationRepresentation orgB = createOrganization("org-b");
+            oauth.clientId("broker-app");
+            oauth.scope("organization:org-b");
+            loginPage.open(bc.consumerRealmName());
+            loginPage.loginUsername(member.getEmail());
+            // user is not a member of the organization selected by the client
+            assertThat(errorPage.getError(), Matchers.containsString("User is not a member of the organization " + orgB.getName()));
+            errorPage.assertTryAnotherWayLinkAvailability(false);
+
+            organization.members().member(member.getId()).delete().close();
+            oauth.clientId("broker-app");
+            oauth.scope("organization:*");
+            loginPage.open(bc.consumerRealmName());
+            loginPage.loginUsername(member.getEmail());
+            // user is not a member of any organization
+            assertThat(errorPage.getError(), Matchers.containsString("User is not a member of any organization"));
+
+            organization.members().addMember(member.getId()).close();
+            testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
+            oauth.clientId("broker-app");
+            oauth.scope("organization");
+            loginPage.open(bc.consumerRealmName());
+            loginPage.loginUsername(member.getEmail());
+            selectOrganizationPage.assertCurrent();
+            organization.members().member(member.getId()).delete().close();
+            selectOrganizationPage.selectOrganization(org.getAlias());
+            // user is not a member of any organization
+            assertThat(errorPage.getError(), Matchers.containsString("User is not a member of the organization " + org.getName()));
+        } finally {
+            runOnServer(setAuthenticatorConfig(OrganizationAuthenticatorFactory.REQUIRES_USER_MEMBERSHIP, Boolean.FALSE.toString()));
+        }
+    }
+
+    @Test
+    public void testLoginHint() {
+        OrganizationRepresentation organization = createOrganization();
+        OrganizationResource organizationResource = testRealm().organizations().get(organization.getId());
+        UserRepresentation member = addMember(organizationResource);
+
+        // login hint populates the username field
+        oauth.clientId("broker-app");
+        String expectedUsername = URLEncoder.encode(member.getEmail(), StandardCharsets.UTF_8);
+        oauth.realm(bc.consumerRealmName());
+        oauth.loginForm().loginHint(expectedUsername).open();
+        assertThat(loginPage.getAttemptedUsername(), Matchers.equalTo(URLDecoder.decode(expectedUsername, StandardCharsets.UTF_8)));
+
+        // continue authenticating without setting the username
+        loginPage.login(memberPassword);
+        appPage.assertCurrent();
+    }
+
+    @Test
+    public void testDuplicateEmailsEnabled() {
+        RealmRepresentation realm = testRealm().toRepresentation();
+
+        realm.setDuplicateEmailsAllowed(true);
+        realm.setLoginWithEmailAllowed(false);
+        realm.setRegistrationEmailAsUsername(false);
+
+        testRealm().update(realm);
+
+        OrganizationRepresentation organization = createOrganization();
+        OrganizationResource organizationResource = testRealm().organizations().get(organization.getId());
+        UserRepresentation member = addMember(organizationResource);
+        UserRepresentation duplicatedUser = UserBuilder.create()
+                .username("duplicated-user")
+                .password("duplicated-user")
+                .email(member.getEmail())
+                .enabled(true).build();
+        try (Response response = testRealm().users().create(duplicatedUser)) {
+            duplicatedUser.setId(ApiUtil.getCreatedId(response));
+        }
+
+        // user with a unique username can authenticate to his account using a unique username
+        oauth.clientId("broker-app");
+        oauth.realm(bc.consumerRealmName());
+        oauth.loginForm().open();
+        loginPage.loginUsername(member.getUsername());
+        loginPage.clickSignIn();
+        loginPage.login(memberPassword);
+        appPage.assertCurrent();
+        testRealm().users().get(member.getId()).logout();
+
+        // a different account with the same email can also authenticate using a unique username
+        oauth.loginForm().open();
+        loginPage.loginUsername(duplicatedUser.getUsername());
+        loginPage.clickSignIn();
+        loginPage.login(duplicatedUser.getUsername());
+        appPage.assertCurrent();
+        testRealm().users().get(duplicatedUser.getId()).logout();
+
+        // trying to authenticate with the duplicated user using the email will fail because the username is the email of a different account
+        oauth.loginForm().open();
+        loginPage.loginUsername(duplicatedUser.getEmail());
+        loginPage.clickSignIn();
+        loginPage.login(duplicatedUser.getEmail());
+        assertThat(loginPage.getInputError(), is("Invalid password."));
+
+        // trying to authenticate to the account that has the email as username is ok
+        oauth.loginForm().open();
+        loginPage.loginUsername(member.getEmail());
+        loginPage.clickSignIn();
+        loginPage.login(memberPassword);
+        appPage.assertCurrent();
+    }
+
+    private void runOnServer(RunOnServer function) {
+        testingClient.server(bc.consumerRealmName()).run(function);
+    }
+
+    public static RunOnServer setAuthenticatorConfig(String key, String value) {
+        return session -> {
+            RealmModel realm = session.getContext().getRealm();
+            FlowUtil.setAuthenticatorConfig(session, realm.getFlowByAlias(DefaultAuthenticationFlows.BROWSER_FLOW).getId(), OrganizationAuthenticatorFactory.ID, key, value);
+        };
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/broker/AbstractBrokerSelfRegistrationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/broker/AbstractBrokerSelfRegistrationTest.java
index 9c076f716386..4a87b1b0182f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/broker/AbstractBrokerSelfRegistrationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/broker/AbstractBrokerSelfRegistrationTest.java
@@ -19,9 +19,12 @@
 
 import static org.hamcrest.CoreMatchers.is;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThat;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.keycloak.models.OrganizationDomainModel.ANY_DOMAIN;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
 
 import java.util.List;
@@ -208,7 +211,6 @@ public void testRealmLevelBrokersAvailableIfEmailDoesNotMatchOrganization() {
         IdentityProviderRepresentation idp = bc.setUpIdentityProvider();
         idp.setAlias("realm-level-idp");
         idp.setHideOnLogin(false);
-        Assert.assertFalse(loginPage.isSocialButtonPresent(idp.getAlias()));
         testRealm().identityProviders().create(idp).close();
 
         driver.navigate().refresh();
@@ -216,6 +218,7 @@ public void testRealmLevelBrokersAvailableIfEmailDoesNotMatchOrganization() {
         Assert.assertTrue(loginPage.isUsernameInputPresent());
         Assert.assertTrue(loginPage.isPasswordInputPresent());
         Assert.assertTrue(loginPage.isSocialButtonPresent(idp.getAlias()));
+        Assert.assertFalse(loginPage.isSocialButtonPresent(bc.getIDPAlias()));
     }
 
     @Test
@@ -298,6 +301,196 @@ public void testRedirectBrokerWhenManagedMember() {
         assertIsMember(bc.getUserEmail(), organization);
     }
 
+    @Test
+    public void testRedirectManagedMemberOfMultipleOrganizations() {
+        OrganizationResource orgA = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgB = testRealm().organizations().get(createOrganization("org-b").getId());
+        String email = bc.getUserLogin() + "@" + orgA.toRepresentation().getDomains().iterator().next().getName();
+        UserRepresentation account = UserBuilder.create()
+                .username(email)
+                .email(email)
+                .password(bc.getUserPassword())
+                .enabled(true)
+                .build();
+        UsersResource users = realmsResouce().realm(bc.providerRealmName()).users();
+        try (Response response = users.create(account)) {
+            account.setId(ApiUtil.getCreatedId(response));
+        }
+        UserRepresentation finalAccount = account;
+        getCleanup().addCleanup(() -> users.get(finalAccount.getId()).remove());
+        // add the member for the first time
+        assertBrokerRegistration(orgA, email, email);
+        account = getUserRepresentation(account.getEmail());
+        realmsResouce().realm(bc.consumerRealmName()).users().get(account.getId()).logout();
+        realmsResouce().realm(bc.providerRealmName()).logoutAll();
+
+        orgB.members().addMember(account.getId()).close();
+        openIdentityFirstLoginPage(email, true, null, false, false);
+        // login to the organization identity provider using e-mail and automatically redirects to the app as the account already exists
+        loginPage.login(email, bc.getUserPassword());
+        appPage.assertCurrent();
+        UserRepresentation finalAccount1 = account;
+        getCleanup().addCleanup(() -> realmsResouce().realm(bc.consumerRealmName()).users().get(finalAccount1.getId()).remove());
+
+        realmsResouce().realm(bc.consumerRealmName()).users().get(account.getId()).logout();
+        realmsResouce().realm(bc.providerRealmName()).logoutAll();
+        openIdentityFirstLoginPage(email, true, null, false, false);
+        // login to the organization identity provider user username and automatically redirects to the app as the account already exists
+        loginPage.login(account.getUsername(), bc.getUserPassword());
+        appPage.assertCurrent();
+    }
+
+    @Test
+    public void testRedirectManagedMemberOfMultipleOrganizationsAllOrganizationsScope() {
+        OrganizationResource orgA = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgB = testRealm().organizations().get(createOrganization("org-b").getId());
+        String email = bc.getUserLogin() + "@" + orgA.toRepresentation().getDomains().iterator().next().getName();
+        UserRepresentation account = UserBuilder.create()
+                .username(email)
+                .email(email)
+                .password(bc.getUserPassword())
+                .enabled(true)
+                .build();
+        UsersResource users = realmsResouce().realm(bc.providerRealmName()).users();
+        try (Response response = users.create(account)) {
+            account.setId(ApiUtil.getCreatedId(response));
+        }
+        UserRepresentation finalAccount = account;
+        getCleanup().addCleanup(() -> users.get(finalAccount.getId()).remove());
+        // add the member for the first time
+        assertBrokerRegistration(orgA, email, email);
+        account = getUserRepresentation(account.getEmail());
+        UserRepresentation finalAccount1 = account;
+        getCleanup().addCleanup(() -> realmsResouce().realm(bc.consumerRealmName()).users().get(finalAccount1.getId()).remove());
+        realmsResouce().realm(bc.consumerRealmName()).users().get(account.getId()).logout();
+        realmsResouce().realm(bc.providerRealmName()).logoutAll();
+
+        orgB.members().addMember(account.getId()).close();
+        oauth.scope("organization:*");
+        openIdentityFirstLoginPage(email, true, null, false, false);
+        // login to the organization identity provider by username and automatically redirects to the app as the account already exists
+        loginPage.login(email, bc.getUserPassword());
+        appPage.assertCurrent();
+    }
+
+    @Test
+    public void testRedirectManagedMemberUsingUnManagedMemberAllOrganizationsScope() {
+        OrganizationResource orgA = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgB = testRealm().organizations().get(createOrganization("org-b").getId());
+        String email = bc.getUserLogin() + "@" + orgA.toRepresentation().getDomains().iterator().next().getName();
+        UserRepresentation account = UserBuilder.create()
+                .username(email)
+                .email(email)
+                .password(bc.getUserPassword())
+                .enabled(true)
+                .build();
+        UsersResource users = realmsResouce().realm(bc.providerRealmName()).users();
+        try (Response response = users.create(account)) {
+            account.setId(ApiUtil.getCreatedId(response));
+        }
+        UserRepresentation finalAccount = account;
+        getCleanup().addCleanup(() -> users.get(finalAccount.getId()).remove());
+        // add the member for the first time
+        assertBrokerRegistration(orgA, email, email);
+        account = getUserRepresentation(account.getEmail());
+        UserRepresentation finalAccount1 = account;
+        getCleanup().addCleanup(() -> realmsResouce().realm(bc.consumerRealmName()).users().get(finalAccount1.getId()).remove());
+        realmsResouce().realm(bc.consumerRealmName()).users().get(account.getId()).logout();
+        realmsResouce().realm(bc.providerRealmName()).logoutAll();
+
+        orgB.members().addMember(account.getId()).close();
+        oauth.scope("organization:*");
+        String orgBEmail = bc.getUserLogin() + "@" + orgB.toRepresentation().getDomains().iterator().next().getName();
+        openIdentityFirstLoginPage(orgBEmail, true, null, false, false);
+        // login to the organization identity provider by username and as to review profile because the user is not yet linked with the idp
+        loginPage.login(email, bc.getUserPassword());
+        updateAccountInformationPage.assertCurrent();
+        // should enforce a email with the same domain as the organization
+        updateAccountInformationPage.updateAccountInformation(email, email, "f", "l");
+        Assert.assertTrue(driver.getPageSource().contains("Email domain does not match any domain from the organization"));
+
+        updateAccountInformationPage.updateAccountInformation(email, orgBEmail, "f", "l");
+        // user is asked to link accounts
+        idpConfirmLinkPage.assertCurrent();
+    }
+
+    @Test
+    public void testRedirectUnManagedMemberAllOrganizationsScope() {
+        OrganizationResource orgA = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgB = testRealm().organizations().get(createOrganization("org-b").getId());
+        String orgAEmail = bc.getUserLogin() + "@" + orgA.toRepresentation().getDomains().iterator().next().getName();
+        // create user without credential to force the redirect to the IdP
+        UserRepresentation account = UserBuilder.create()
+                .username(orgAEmail)
+                .email(orgAEmail)
+                .enabled(true)
+                .build();
+        UsersResource users = realmsResouce().realm(bc.consumerRealmName()).users();
+        try (Response response = users.create(account)) {
+            String id = ApiUtil.getCreatedId(response);
+            account.setId(id);
+            getCleanup().addCleanup(() -> users.get(id).remove());
+        }
+
+        // add the unmanaged member to both organizations
+        orgA.members().addMember(account.getId()).close();
+        orgB.members().addMember(account.getId()).close();
+
+        oauth.scope("organization:*");
+        // resolve both organizations and redirect the user automatically
+        openIdentityFirstLoginPage(orgAEmail, true, null, false, false);
+        assertTrue(driver.getPageSource().contains("Sign in to provider"));
+        openIdentityFirstLoginPage(bc.getUserLogin() + "@" + orgB.toRepresentation().getDomains().iterator().next().getName(), true, null, false, false);
+        assertTrue(driver.getPageSource().contains("Sign in to provider"));
+
+        oauth.scope("organization");
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        loginPage.loginUsername(orgAEmail);
+        selectOrganizationPage.assertCurrent();
+    }
+
+    @Test
+    public void testRedirectBrokerManagedMemberUsingUsernameAllOrganizationsScope() {
+        OrganizationResource orgA = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgB = testRealm().organizations().get(createOrganization("org-b").getId());
+        String email = bc.getUserLogin() + "@" + orgA.toRepresentation().getDomains().iterator().next().getName();
+        UserRepresentation account = UserBuilder.create()
+                .username(email)
+                .email(email)
+                .password(bc.getUserPassword())
+                .enabled(true)
+                .build();
+        UsersResource users = realmsResouce().realm(bc.providerRealmName()).users();
+        try (Response response = users.create(account)) {
+            account.setId(ApiUtil.getCreatedId(response));
+        }
+        UserRepresentation finalAccount = account;
+        getCleanup().addCleanup(() -> users.get(finalAccount.getId()).remove());
+        // add the member for the first time
+        assertBrokerRegistration(orgA, bc.getUserLogin(), email);
+        account = getUserRepresentation(account.getEmail());
+        UserRepresentation finalAccount1 = account;
+        getCleanup().addCleanup(() -> realmsResouce().realm(bc.consumerRealmName()).users().get(finalAccount1.getId()).remove());
+        realmsResouce().realm(bc.consumerRealmName()).users().get(account.getId()).logout();
+        realmsResouce().realm(bc.providerRealmName()).logoutAll();
+
+        orgB.members().addMember(account.getId()).close();
+        oauth.scope("organization:*");
+        // provide the username, the user is automatically redirected to home broker because he is a managed member
+        openIdentityFirstLoginPage(bc.getUserLogin(), true, null, false, false);
+        // login to the organization identity provider by username
+        loginPage.login(bc.getUserLogin(), bc.getUserPassword());
+        appPage.assertCurrent();
+    }
+
+    @Test
+    public void testRedirectBrokerWhenUnmanagedMemberProfileEmailMatchesOrganization() {
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        addMember(organization, bc.getUserLogin(), bc.getUserEmail(), "f", "l", false);
+        openIdentityFirstLoginPage(bc.getUserLogin(), true, null, false, false);
+    }
+
     @Test
     public void testShowOnlyBrokersLinkedUserInPasswordPage() {
         OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
@@ -465,6 +658,54 @@ public void testRedirectToIdentityProviderAssociatedWithOrganizationDomain() {
         assertEquals(bc.getIDPAlias(), federatedIdentities.get(0).getIdentityProvider());
     }
 
+    @Test
+    public void testRedirectToIdentityProviderAssociatedWithOrganizationDomainCaseInsensitive() {
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        IdentityProviderRepresentation idp = organization.identityProviders().get(bc.getIDPAlias()).toRepresentation();
+        idp.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, "neworg.org");
+        testRealm().identityProviders().get(bc.getIDPAlias()).update(idp);
+        idp.setAlias("second-idp");
+        idp.setInternalId(null);
+        idp.getConfig().remove(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
+        testRealm().identityProviders().create(idp).close();
+        getCleanup().addCleanup(testRealm().identityProviders().get("second-idp")::remove);
+        organization.identityProviders().addIdentityProvider(idp.getAlias()).close();
+
+        openIdentityFirstLoginPage(bc.getUserEmail().toUpperCase(), true, idp.getAlias(), false, false);
+
+        loginOrgIdp(bc.getUserEmail().toUpperCase(), bc.getUserEmail().toUpperCase(),true, true);
+
+        assertIsMember(bc.getUserEmail().toUpperCase(), organization);
+        UserRepresentation user = testRealm().users().search(bc.getUserEmail().toUpperCase()).get(0);
+        List<FederatedIdentityRepresentation> federatedIdentities = testRealm().users().get(user.getId()).getFederatedIdentity();
+        assertEquals(1, federatedIdentities.size());
+        assertEquals(bc.getIDPAlias(), federatedIdentities.get(0).getIdentityProvider());
+    }
+
+    @Test
+    public void testRedirectToIdentityProviderAssociatedWithOrganizationDomainUsingAnyMatch() {
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        IdentityProviderRepresentation idp = organization.identityProviders().get(bc.getIDPAlias()).toRepresentation();
+        idp.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, ANY_DOMAIN);
+        testRealm().identityProviders().get(bc.getIDPAlias()).update(idp);
+
+        idp.setAlias("second-idp");
+        idp.setInternalId(null);
+        testRealm().identityProviders().create(idp).close();
+        getCleanup().addCleanup(testRealm().identityProviders().get("second-idp")::remove);
+        organization.identityProviders().addIdentityProvider(idp.getAlias()).close();
+
+        openIdentityFirstLoginPage(bc.getUserEmail(), true, idp.getAlias(), false, false);
+
+        loginOrgIdp(bc.getUserEmail(), bc.getUserEmail(),true, true);
+
+        assertIsMember(bc.getUserEmail(), organization);
+        UserRepresentation user = testRealm().users().search(bc.getUserEmail()).get(0);
+        List<FederatedIdentityRepresentation> federatedIdentities = testRealm().users().get(user.getId()).getFederatedIdentity();
+        assertEquals(1, federatedIdentities.size());
+        assertEquals(bc.getIDPAlias(), federatedIdentities.get(0).getIdentityProvider());
+    }
+
     @Test
     public void testDoNotRedirectToIdentityProviderAssociatedWithOrganizationDomain() {
         OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
@@ -479,6 +720,15 @@ public void testDoNotRedirectToIdentityProviderAssociatedWithOrganizationDomain(
         Assert.assertFalse(loginPage.isPasswordInputPresent());
         Assert.assertTrue(driver.getPageSource().contains("Your email domain matches the " + organizationName + " organization but you don't have an account yet."));
         Assert.assertTrue(loginPage.isSocialButtonPresent(bc.getIDPAlias()));
+
+        idp.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, ANY_DOMAIN);
+        testRealm().identityProviders().get(bc.getIDPAlias()).update(idp);
+
+        openIdentityFirstLoginPage(bc.getUserEmail(), false, idp.getAlias(), false, false);
+
+        Assert.assertFalse(loginPage.isPasswordInputPresent());
+        Assert.assertTrue(driver.getPageSource().contains("Your email domain matches the " + organizationName + " organization but you don't have an account yet."));
+        Assert.assertTrue(loginPage.isSocialButtonPresent(bc.getIDPAlias()));
     }
 
     @Test
@@ -713,6 +963,63 @@ public void testFailUpdateEmailWithDifferentDomainThanOrgIfBrokerHasDomainSet()
         }
     }
 
+    @Test
+    public void testRememberOrganizationWhenReloadingLoginPage() {
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        OrganizationRepresentation org1 = organization.toRepresentation();
+        IdentityProviderRepresentation orgIdp = organization.identityProviders().getIdentityProviders().get(0);
+        orgIdp.setHideOnLogin(false);
+        orgIdp.getConfig().remove(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
+        testRealm().identityProviders().get(orgIdp.getAlias()).update(orgIdp);
+
+        IdentityProviderRepresentation realmIdp = bc.setUpIdentityProvider();
+        realmIdp.setAlias("second-idp");
+        realmIdp.setInternalId(null);
+        realmIdp.setHideOnLogin(false);
+        testRealm().identityProviders().create(realmIdp).close();
+        getCleanup().addCleanup(testRealm().identityProviders().get("second-idp")::remove);
+
+        oauth.clientId("broker-app");
+        loginPage.open(bc.consumerRealmName());
+        loginPage.loginUsername("test@" + org1.getDomains().iterator().next().getName());
+        // only org idp
+        assertTrue(loginPage.isSocialButtonPresent(orgIdp.getAlias()));
+        assertFalse(loginPage.isSocialButtonPresent(realmIdp.getAlias()));
+
+        driver.navigate().refresh();
+        // still only org idp
+        assertTrue(loginPage.isSocialButtonPresent(orgIdp.getAlias()));
+        assertFalse(loginPage.isSocialButtonPresent(realmIdp.getAlias()));
+
+        driver.navigate().back();
+        // chrome requires refresh, otherwise Sign in button is not active
+        driver.navigate().refresh();
+
+        loginPage.loginUsername("test");
+        // both realm and org idps because the user does not map to any organization
+        assertTrue(loginPage.isSocialButtonPresent(orgIdp.getAlias()));
+        assertTrue(loginPage.isSocialButtonPresent(realmIdp.getAlias()));
+
+        loginPage.open(bc.consumerRealmName());
+        loginPage.loginUsername("test@" + org1.getDomains().iterator().next().getName());
+        // only org idp
+        assertTrue(loginPage.isSocialButtonPresent(orgIdp.getAlias()));
+        assertFalse(loginPage.isSocialButtonPresent(realmIdp.getAlias()));
+
+        String org2Name = "org-2";
+        OrganizationResource org2 = testRealm().organizations().get(createOrganization(org2Name).getId());
+        IdentityProviderRepresentation org2Idp = org2.identityProviders().getIdentityProviders().get(0);
+        org2Idp.setHideOnLogin(false);
+        org2Idp.getConfig().remove(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE);
+        testRealm().identityProviders().get(org2Idp.getAlias()).update(org2Idp);
+        driver.navigate().back();
+        loginPage.loginUsername("test@" + org2.toRepresentation().getDomains().iterator().next().getName());
+        // resolves to brokers from another organization
+        assertFalse(loginPage.isSocialButtonPresent(orgIdp.getAlias()));
+        assertFalse(loginPage.isSocialButtonPresent(realmIdp.getAlias()));
+        assertTrue(loginPage.isSocialButtonPresent(org2Idp.getAlias()));
+    }
+
     private void assertIsNotMember(String userEmail, OrganizationResource organization) {
         UsersResource users = adminClient.realm(bc.consumerRealmName()).users();
         List<UserRepresentation> reps = users.searchByEmail(userEmail, true);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/exportimport/OrganizationExportTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/exportimport/OrganizationExportTest.java
index 232d4498a187..170cb4079b6f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/exportimport/OrganizationExportTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/exportimport/OrganizationExportTest.java
@@ -43,6 +43,8 @@
 import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.admin.client.resource.UsersResource;
 import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.dir.DirExportProviderFactory;
+import org.keycloak.exportimport.dir.DirImportProviderFactory;
 import org.keycloak.exportimport.singlefile.SingleFileExportProviderFactory;
 import org.keycloak.exportimport.singlefile.SingleFileImportProviderFactory;
 import org.keycloak.models.OrganizationModel;
@@ -113,8 +115,21 @@ public void testExport() {
             }
         }
 
-        RealmRepresentation importedRealm = exportRemoveImportRealm();
+        RealmRepresentation importedSingleFileRealm = exportRemoveImportRealm(true);
 
+        validateImported(expectedOrganizations, expectedManagedMembers, expectedUnmanagedMembers, importedSingleFileRealm);
+
+        testRealm().logoutAll();
+        providerRealm.logoutAll();
+
+        RealmRepresentation importedDirRealm = exportRemoveImportRealm(false);
+
+        validateImported(expectedOrganizations, expectedManagedMembers, expectedUnmanagedMembers, importedDirRealm);
+    }
+
+    private void validateImported(List<OrganizationRepresentation> expectedOrganizations,
+            Map<String, List<String>> expectedManagedMembers, Map<String, List<String>> expectedUnmanagedMembers,
+            RealmRepresentation importedRealm) {
         assertTrue(importedRealm.isOrganizationsEnabled());
 
         List<OrganizationRepresentation> organizations = testRealm().organizations().list(-1, -1);
@@ -175,31 +190,44 @@ public void testExportImportEmptyOrg() {
         List<OrganizationRepresentation> orgs = testRealm().organizations().list(-1, -1);
         assertEquals(1, orgs.size());
 
-        RealmRepresentation importedRealm = exportRemoveImportRealm();
+        RealmRepresentation importedSingleFileRealm = exportRemoveImportRealm(true);
 
-        assertTrue(importedRealm.isOrganizationsEnabled());
+        assertTrue(importedSingleFileRealm.isOrganizationsEnabled());
 
         orgs = testRealm().organizations().list(-1, -1);
         assertEquals(1, orgs.size());
         assertEquals("acme", orgs.get(0).getName());
     }
 
-    private RealmRepresentation exportRemoveImportRealm() {
-        //export
+    private RealmRepresentation exportRemoveImportRealm(boolean file) {
         TestingExportImportResource exportImport = testingClient.testing().exportImport();
-        exportImport.setProvider(SingleFileExportProviderFactory.PROVIDER_ID);
+        String fileOrDir;
+
+        //export
+        if (file) {
+            exportImport.setProvider(SingleFileExportProviderFactory.PROVIDER_ID);
+            fileOrDir = exportImport.getExportImportTestDirectory() + File.separator + "org-export.json";
+            exportImport.setFile(fileOrDir);
+        } else {
+            exportImport.setProvider(DirExportProviderFactory.PROVIDER_ID);
+            fileOrDir = exportImport.getExportImportTestDirectory();
+            exportImport.setDir(fileOrDir);
+        }
         exportImport.setAction(ExportImportConfig.ACTION_EXPORT);
         exportImport.setRealmName(testRealm().toRepresentation().getRealm());
-        String targetFilePath = exportImport.getExportImportTestDirectory() + File.separator + "org-export.json";
-        exportImport.setFile(targetFilePath);
         exportImport.runExport();
 
         // remove the realm and import it back
         testRealm().remove();
         exportImport = testingClient.testing().exportImport();
-        exportImport.setProvider(SingleFileImportProviderFactory.PROVIDER_ID);
+        if (file) {
+            exportImport.setProvider(SingleFileImportProviderFactory.PROVIDER_ID);
+            exportImport.setFile(fileOrDir);
+        } else {
+            exportImport.setProvider(DirImportProviderFactory.PROVIDER_ID);
+            exportImport.setDir(fileOrDir);
+        }
         exportImport.setAction(ExportImportConfig.ACTION_IMPORT);
-        exportImport.setFile(targetFilePath);
         exportImport.runImport();
         getCleanup().addCleanup(() -> {
             testRealm().remove();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/federation/OrganizationFederationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/federation/OrganizationFederationTest.java
new file mode 100755
index 000000000000..67949e7ba60b
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/federation/OrganizationFederationTest.java
@@ -0,0 +1,130 @@
+/*
+ * Copyright 2024 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.organization.federation;
+
+import org.apache.commons.io.FileUtils;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.OrganizationModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.organization.OrganizationProvider;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.testsuite.federation.UserPropertyFileStorageFactory;
+import org.keycloak.testsuite.federation.ldap.AbstractLDAPTest;
+import org.keycloak.testsuite.organization.admin.AbstractOrganizationTest;
+import org.keycloak.testsuite.runonserver.RunOnServer;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.URISyntaxException;
+import java.util.List;
+import java.util.stream.Stream;
+
+import static org.junit.Assert.assertEquals;
+
+public class OrganizationFederationTest extends AbstractOrganizationTest {
+
+    private static final File CONFIG_DIR = new File(System.getProperty("auth.server.config.dir", ""));
+
+    @Before
+    public void onBefore() {
+        createOrganization("orga");
+        createOrganization("orgb");
+    }
+
+    @After
+    public void onAfter() {
+        List<UserRepresentation> users = testRealm().users().search("member");
+
+        if (!users.isEmpty()) {
+            UserRepresentation member = users.get(0);
+            testRealm().users().get(member.getId()).remove();
+        }
+    }
+
+    @Override
+    public void importTestRealms() {
+        super.importTestRealms();
+        log.infof("Test realms imported");
+
+        afterImportTestRealm();
+    }
+
+    protected void afterImportTestRealm() {
+        copyPropertiesFiles();
+        final String propertyFile = CONFIG_DIR.getAbsolutePath() + File.separator + "user-password.properties";
+        testingClient.server().run(session -> {
+
+            RealmModel appRealm = session.realms().getRealmByName(AbstractLDAPTest.TEST_REALM_NAME);
+
+            // add user-prop provider with lower priority
+            ComponentModel userPropProvider = new ComponentModel();
+            userPropProvider.setName("user-props");
+            userPropProvider.setProviderId(UserPropertyFileStorageFactory.PROVIDER_ID);
+            userPropProvider.setProviderType(UserStorageProvider.class.getName());
+            userPropProvider.setConfig(new MultivaluedHashMap<>());
+            userPropProvider.getConfig().putSingle("priority", Integer.toString(0));
+            userPropProvider.getConfig().putSingle("propertyFile", propertyFile);
+            userPropProvider.getConfig().putSingle("federatedStorage", "true");
+            appRealm.addComponentModel(userPropProvider);
+        });
+    }
+
+    private void copyPropertiesFiles() throws RuntimeException {
+        try {
+            // copy files used by the following user-props user provider
+            File stResDir = new File(getClass().getResource("/storage-test").toURI());
+            if (stResDir.exists() && stResDir.isDirectory() && CONFIG_DIR.exists() && CONFIG_DIR.isDirectory()) {
+                for (File f : stResDir.listFiles()) {
+                    log.infof("Copying %s to %s", f.getName(), CONFIG_DIR.getAbsolutePath());
+                    FileUtils.copyFileToDirectory(f, CONFIG_DIR);
+                }
+            } else {
+                throw new RuntimeException("Property `auth.server.config.dir` must be set to run the test.");
+            }
+        } catch (IOException | RuntimeException | URISyntaxException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Test
+    public void testGetByMember() {
+        getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) session -> {
+            OrganizationProvider orgProvider = session.getProvider(OrganizationProvider.class);
+            OrganizationModel orga = orgProvider.getByDomainName("orga.org");
+            RealmModel realm = session.getContext().getRealm();
+            UserModel member = session.users().getUserByUsername(realm, "thor");
+            orgProvider.addMember(orga, member);
+        });
+        getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) session -> {
+            OrganizationProvider orgProvider = session.getProvider(OrganizationProvider.class);
+            RealmModel realm = session.getContext().getRealm();
+            UserModel member = session.users().getUserByUsername(realm, "thor");
+            Stream<OrganizationModel> memberOf = orgProvider.getByMember(member);
+            List<OrganizationModel> results = memberOf.toList();
+            assertEquals(1, results.size());
+            assertEquals("orga", results.get(0).getAlias());
+        });
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/mapper/OrganizationOIDCProtocolMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/mapper/OrganizationOIDCProtocolMapperTest.java
index fae7694d1b76..049c68cf7916 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/mapper/OrganizationOIDCProtocolMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/mapper/OrganizationOIDCProtocolMapperTest.java
@@ -22,6 +22,7 @@
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.notNullValue;
@@ -33,7 +34,6 @@
 
 import java.net.MalformedURLException;
 import java.net.URL;
-import java.time.Duration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -50,6 +50,7 @@
 import org.keycloak.admin.client.resource.OrganizationResource;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.UriUtils;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.organization.protocol.mappers.oidc.OrganizationMembershipMapper;
 import org.keycloak.protocol.ProtocolMapperUtils;
@@ -67,9 +68,10 @@
 import org.keycloak.representations.idm.OrganizationRepresentation;
 import org.keycloak.representations.idm.ProtocolMapperRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.broker.KcOidcBrokerConfiguration;
 import org.keycloak.testsuite.organization.admin.AbstractOrganizationTest;
-import org.keycloak.testsuite.util.OAuthClient.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 public class OrganizationOIDCProtocolMapperTest extends AbstractOrganizationTest {
 
@@ -93,9 +95,9 @@ public void testPasswordGrantType() throws Exception {
         Assert.assertTrue(orga.members().list(-1, -1).stream().map(UserRepresentation::getId).anyMatch(member.getId()::equals));
         Assert.assertTrue(orgb.members().list(-1, -1).stream().map(UserRepresentation::getId).anyMatch(member.getId()::equals));
 
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization:*");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         assertThat(response.getScope(), containsString("organization"));
 
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
@@ -126,15 +128,15 @@ public void testMultipleOrganizationScopes() throws Exception {
 
         oauth.clientId("test-app");
         oauth.scope("openid organization organization:org-a");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
 
         oauth.scope("openid organization organization:*");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
 
         oauth.scope("openid organization:org-a organization:*");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode());
     }
 
@@ -146,9 +148,9 @@ public void testOrganizationNotAddedByGroupMapper() throws Exception {
         ClientResource clientResource = testRealm().clients().get(client.getId());
         clientResource.getProtocolMappers().createMapper(createGroupMapper()).close();
 
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         assertThat(response.getScope(), containsString("organization"));
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
@@ -164,7 +166,7 @@ public void testOrganizationScopeMapsSpecificOrganization() {
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
 
         // resolve organization based on the organization scope value
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         oauth.scope("organization:" + orgA.getAlias());
         loginPage.open(bc.consumerRealmName());
         org.keycloak.testsuite.Assert.assertFalse(loginPage.isPasswordInputPresent());
@@ -173,7 +175,7 @@ public void testOrganizationScopeMapsSpecificOrganization() {
         assertFalse(driver.getPageSource().contains("Your email domain matches"));
 
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String orgScope = "organization:" + orgB.getAlias();
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -196,7 +198,7 @@ public void testOrganizationScopeMapsAllOrganizations() {
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
 
         // resolve organization based on the organization scope value
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         oauth.scope("organization:" + orgA.getAlias());
         loginPage.open(bc.consumerRealmName());
         assertFalse(loginPage.isPasswordInputPresent());
@@ -204,7 +206,7 @@ public void testOrganizationScopeMapsAllOrganizations() {
         assertFalse(loginPage.isSocialButtonPresent(orgB.getAlias() + "-identity-provider"));
 
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String orgScope = "organization:*";
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -222,7 +224,7 @@ public void testOrganizationScopeMapsAllOrganizations() {
         assertThat(response.getRefreshToken(), notNullValue());
         RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
         assertThat(refreshToken.getScope(), containsString(orgScope));
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), containsString(orgScope));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(orgScope));
@@ -241,7 +243,7 @@ public void testOrganizationScopeAnyMapsSingleOrganization() {
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
 
         // resolve organization based on the organization scope value
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String orgScope = "organization";
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -257,7 +259,7 @@ public void testOrganizationScopeAnyAskUserToSelectOrganization() {
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         oauth.scope("organization");
         loginPage.open(bc.consumerRealmName());
         loginPage.loginUsername(member.getEmail());
@@ -285,7 +287,7 @@ public void testRefreshTokenWithAllOrganizationsAskingForSpecificOrganization()
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String orgScope = "organization:*";
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -299,8 +301,8 @@ public void testRefreshTokenWithAllOrganizationsAskingForSpecificOrganization()
         List<String> organizations = (List<String>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
         assertThat(organizations.size(), is(2));
         orgScope = "organization:orga";
-        oauth.scope(orgScope);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        oauth.scope(orgScope).openid(false);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), containsString(orgScope));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(orgScope));
@@ -317,7 +319,7 @@ public void testRefreshTokenWithSingleOrganizationsAskingAllOrganizations() {
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String originalScope = "organization:orga";
         String orgScope = originalScope;
         oauth.scope(orgScope);
@@ -334,7 +336,7 @@ public void testRefreshTokenWithSingleOrganizationsAskingAllOrganizations() {
         assertThat(organizations.contains(orgA.getAlias()), is(true));
         orgScope = "organization:*";
         oauth.scope(orgScope);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), containsString(originalScope));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(originalScope));
@@ -351,7 +353,7 @@ public void testRefreshTokenWithSingleOrganizationsAskingDifferentOrganization()
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String originalScope = "organization:orga";
         String orgScope = originalScope;
         oauth.scope(orgScope);
@@ -368,7 +370,7 @@ public void testRefreshTokenWithSingleOrganizationsAskingDifferentOrganization()
         assertThat(organizations.contains(orgA.getAlias()), is(true));
         orgScope = "organization:orgb";
         oauth.scope(orgScope);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), not(containsString(originalScope)));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), not(containsString(orgScope)));
@@ -382,7 +384,7 @@ public void testRefreshTokenScopeAnyAskingAllOrganizations() {
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
         String originalScope = "organization";
         oauth.scope(originalScope);
         loginPage.open(bc.consumerRealmName());
@@ -402,7 +404,7 @@ public void testRefreshTokenScopeAnyAskingAllOrganizations() {
         assertThat(organizations.contains(orgB.getAlias()), is(true));
         String orgScope = "organization:*";
         oauth.scope(orgScope);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), containsString(originalScope));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(originalScope));
@@ -417,7 +419,7 @@ public void testRefreshTokenScopeAnyAskingSingleOrganization() {
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String originalScope = "organization";
         oauth.scope(originalScope);
         loginPage.open(bc.consumerRealmName());
@@ -435,7 +437,7 @@ public void testRefreshTokenScopeAnyAskingSingleOrganization() {
         assertThat(organizations.contains(orgB.getAlias()), is(true));
         String orgScope = "organization:orgb";
         oauth.scope(orgScope);
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), not(containsString(orgScope)));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), not(containsString(orgScope)));
@@ -448,9 +450,9 @@ public void testIncludeOrganizationAttributes() throws Exception {
         addMember(organization);
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ATTRIBUTES, Boolean.TRUE.toString());
 
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         assertThat(response.getScope(), containsString("organization"));
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
@@ -462,7 +464,7 @@ public void testIncludeOrganizationAttributes() throws Exception {
         // when attributes are added to tokens, the claim type is a json regardless of the value set in the config
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ATTRIBUTES, Boolean.TRUE.toString());
         setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "boolean");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
         organizations = (Map<String, Map<String, List<String>>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
@@ -472,7 +474,7 @@ public void testIncludeOrganizationAttributes() throws Exception {
 
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ATTRIBUTES, Boolean.FALSE.toString());
         setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "JSON");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
         organizations = (Map<String, Map<String, List<String>>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
@@ -488,9 +490,9 @@ public void testIncludeOrganizationId() throws Exception {
         addMember(organization);
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ID, Boolean.TRUE.toString());
 
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         assertThat(response.getScope(), containsString("organization"));
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
@@ -502,7 +504,7 @@ public void testIncludeOrganizationId() throws Exception {
         // when id is added to tokens, the claim type is a json regardless of the value set in the config
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ID, Boolean.TRUE.toString());
         setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "boolean");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
         organizations = (Map<String, Map<String, String>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
@@ -513,7 +515,7 @@ public void testIncludeOrganizationId() throws Exception {
         // disabling the attribute should result in no ids in the claims.
         setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_ID, Boolean.FALSE.toString());
         setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "JSON");
-        response = oauth.doGrantAccessTokenRequest("password", memberEmail, memberPassword);
+        response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
         accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
         organizations = (Map<String, Map<String, String>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
@@ -529,9 +531,9 @@ public void testOrganizationsClaimAsList() throws Exception {
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
 
         setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "String");
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization:*");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", member.getEmail(), memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(member.getEmail(), memberPassword);
         assertThat(response.getScope(), containsString("organization"));
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
@@ -547,9 +549,9 @@ public void testOrganizationsClaimSingleValued() throws Exception {
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
 
         setMapperConfig(ProtocolMapperUtils.MULTIVALUED, Boolean.FALSE.toString());
-        oauth.clientId("direct-grant");
+        oauth.client("direct-grant", "password");
         oauth.scope("openid organization:*");
-        AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", member.getEmail(), memberPassword);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(member.getEmail(), memberPassword);
         assertThat(response.getScope(), containsString("organization"));
         AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
         assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
@@ -559,7 +561,7 @@ public void testOrganizationsClaimSingleValued() throws Exception {
 
     @Test
     public void testInvalidOrganizationScope() throws MalformedURLException {
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         oauth.scope("organization:unknown");
         oauth.realm(TEST_REALM_NAME);
         oauth.openLoginForm();
@@ -569,7 +571,6 @@ public void testInvalidOrganizationScope() throws MalformedURLException {
 
     @Test
     public void testAuthenticatingUsingBroker() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
         IdentityProviderRepresentation idp = organization.identityProviders().get(bc.getIDPAlias()).toRepresentation();
         idp.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, "neworg.org");
@@ -594,7 +595,7 @@ public void testMapDifferentOrganizationWhenReAuthenticating() {
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String originalScope = "organization:orga";
         String orgScope = originalScope;
         oauth.scope(orgScope);
@@ -630,7 +631,7 @@ public void testSelectOrganizationMapDifferentOrganizationWhenReAuthenticating()
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String originalScope = "organization";
         String orgScope = originalScope;
         oauth.scope(orgScope);
@@ -662,7 +663,6 @@ public void testSelectOrganizationMapDifferentOrganizationWhenReAuthenticating()
 
     @Test
     public void testForceSelectingOrganizationWhenReAuthenticatingUsingDifferentClient() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationRepresentation orgA = createOrganization("orga", true);
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
@@ -672,7 +672,7 @@ public void testForceSelectingOrganizationWhenReAuthenticatingUsingDifferentClie
         client.setClientId("broker-app2");
         testRealm().clients().create(client).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String originalScope = "organization:orga";
         String orgScope = originalScope;
         oauth.scope(orgScope);
@@ -688,7 +688,7 @@ public void testForceSelectingOrganizationWhenReAuthenticatingUsingDifferentClie
         assertThat(organizations.size(), is(1));
         assertThat(organizations.contains(orgA.getAlias()), is(true));
         orgScope = "organization";
-        oauth.clientId("broker-app2");
+        oauth.client("broker-app2", "broker-app-secret");
         oauth.scope(orgScope);
         oauth.realm(bc.consumerRealmName());
         oauth.openLoginForm();
@@ -705,7 +705,6 @@ public void testForceSelectingOrganizationWhenReAuthenticatingUsingDifferentClie
 
     @Test
     public void testReAuthenticationUserMemberOfSingleOrganizationUsingDifferentClient() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationRepresentation orgA = createOrganization("orga", true);
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         ClientRepresentation client = testRealm().clients().findByClientId("broker-app").get(0);
@@ -713,12 +712,12 @@ public void testReAuthenticationUserMemberOfSingleOrganizationUsingDifferentClie
         client.setClientId("broker-app2");
         testRealm().clients().create(client).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         loginPage.open(bc.consumerRealmName());
         loginPage.loginUsername(member.getEmail());
         loginPage.login(memberPassword);
         assertSuccessfulCodeGrant();
-        oauth.clientId("broker-app2");
+        oauth.client("broker-app2", "broker-app-secret");
         oauth.openLoginForm();
         assertSuccessfulCodeGrant();
         oauth.scope("organization");
@@ -734,7 +733,6 @@ public void testReAuthenticationUserMemberOfSingleOrganizationUsingDifferentClie
 
     @Test
     public void testReAuthenticationUserNotMemberOfOrganizationUsingDifferentClient() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationRepresentation orgA = createOrganization("orga", true);
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         testRealm().organizations().get(orgA.getId()).members().member(member.getId()).delete().close();
@@ -743,18 +741,18 @@ public void testReAuthenticationUserNotMemberOfOrganizationUsingDifferentClient(
         client.setClientId("broker-app2");
         testRealm().clients().create(client).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         loginPage.open(bc.consumerRealmName());
         loginPage.loginUsername(member.getEmail());
         loginPage.login(memberPassword);
         assertSuccessfulCodeGrant();
-        oauth.clientId("broker-app2");
+        oauth.client("broker-app2", "broker-app-secret");
         oauth.openLoginForm();
         assertSuccessfulCodeGrant();
         oauth.scope("organization");
         oauth.openLoginForm();
         assertSuccessfulCodeGrant();
-        oauth.clientId("broker-app2");
+        oauth.client("broker-app2", "broker-app-secret");
         oauth.scope("organization:" + orgA.getAlias());
         oauth.openLoginForm();
         assertSuccessfulCodeGrant();
@@ -765,13 +763,12 @@ public void testReAuthenticationUserNotMemberOfOrganizationUsingDifferentClient(
 
     @Test
     public void testDoNotAskToSelectOrganizationIfOrganizationScopeNotPresent() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationRepresentation orgA = createOrganization("orga", true);
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String orgScope = "organization";
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -793,13 +790,12 @@ public void testDoNotAskToSelectOrganizationIfOrganizationScopeNotPresent() {
 
     @Test
     public void testSelectDifferentOrganizationWhenReAuthenticating() {
-        driver.manage().timeouts().pageLoadTimeout(Duration.ofDays(1));
         OrganizationRepresentation orgA = createOrganization("orga", true);
         MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
         OrganizationRepresentation orgB = createOrganization("orgb", true);
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         // identity-first login will respect the organization provided in the scope even though the user email maps to a different organization
-        oauth.clientId("broker-app");
+        oauth.client("broker-app", "broker-app-secret");
         String orgScope = "organization";
         oauth.scope(orgScope);
         loginPage.open(bc.consumerRealmName());
@@ -826,9 +822,169 @@ public void testSelectDifferentOrganizationWhenReAuthenticating() {
         assertThat(organizations.contains(orgB.getAlias()), is(true));
     }
 
+    @Test
+    public void testCustomOrganizationScopeName() {
+        OrganizationRepresentation orgA = createOrganization("orga", true);
+        MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
+        ClientScopeRepresentation orgScope = testRealm().clientScopes().findAll().stream()
+                .filter(s -> OIDCLoginProtocolFactory.ORGANIZATION.equals(s.getName()))
+                .findAny()
+                .orElseThrow();
+        ClientScopeResource orgScopeResource = testRealm().clientScopes().get(orgScope.getId());
+        ProtocolMapperRepresentation orgMapper = orgScopeResource.getProtocolMappers().getMappers().stream()
+                .filter(m -> OIDCLoginProtocolFactory.ORGANIZATION.equals(m.getName()))
+                .findAny()
+                .orElseThrow();
+        orgMapper.setId(null);
+        orgScope.setProtocolMappers(List.of(orgMapper));
+        orgScope.setId(null);
+        orgScope.setName("org");
+        String createdId = ApiUtil.getCreatedId(testRealm().clientScopes().create(orgScope));
+        testRealm().addDefaultDefaultClientScope(createdId);
+        ClientRepresentation client = testRealm().clients().findByClientId("broker-app").get(0);
+        testRealm().clients().get(client.getId()).addDefaultClientScope(createdId);
+        getCleanup().addCleanup(() -> testRealm().clientScopes().get(createdId).remove());
+
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        String scopeName = "org:" + orgA.getAlias();
+        oauth.scope(scopeName);
+        oauth.realm(bc.consumerRealmName());
+        oauth.openLoginForm();
+        loginPage.loginUsername(member.getEmail());
+        loginPage.login(memberPassword);
+
+        assertScopeAndClaims(scopeName, orgA);
+    }
+
+    @Test
+    public void testCustomOrganizationScopeNameAllOrganizations() {
+        OrganizationResource orga = testRealm().organizations().get(createOrganization("org-a").getId());
+        OrganizationResource orgb = testRealm().organizations().get(createOrganization("org-b").getId());
+
+        addMember(orga);
+
+        UserRepresentation member = getUserRepresentation(memberEmail);
+
+        orgb.members().addMember(member.getId()).close();
+
+        Assert.assertTrue(orga.members().list(-1, -1).stream().map(UserRepresentation::getId).anyMatch(member.getId()::equals));
+        Assert.assertTrue(orgb.members().list(-1, -1).stream().map(UserRepresentation::getId).anyMatch(member.getId()::equals));
+
+        ClientScopeRepresentation orgScope = testRealm().clientScopes().findAll().stream()
+                .filter(s -> OIDCLoginProtocolFactory.ORGANIZATION.equals(s.getName()))
+                .findAny()
+                .orElseThrow();
+        ClientScopeResource orgScopeResource = testRealm().clientScopes().get(orgScope.getId());
+        ProtocolMapperRepresentation orgMapper = orgScopeResource.getProtocolMappers().getMappers().stream()
+                .filter(m -> OIDCLoginProtocolFactory.ORGANIZATION.equals(m.getName()))
+                .findAny()
+                .orElseThrow();
+        orgMapper.setId(null);
+        orgScope.setProtocolMappers(List.of(orgMapper));
+        orgScope.setId(null);
+        orgScope.setName("org");
+        String createdId = ApiUtil.getCreatedId(testRealm().clientScopes().create(orgScope));
+        testRealm().addDefaultDefaultClientScope(createdId);
+        ClientRepresentation client = testRealm().clients().findByClientId("broker-app").get(0);
+        testRealm().clients().get(client.getId()).addDefaultClientScope(createdId);
+        getCleanup().addCleanup(() -> testRealm().clientScopes().get(createdId).remove());
+
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        String scopeName = "org:*";
+        oauth.scope(scopeName);
+        oauth.realm(bc.consumerRealmName());
+        oauth.openLoginForm();
+        loginPage.loginUsername(member.getEmail());
+        loginPage.login(memberPassword);
+
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+        assertThat(response.getScope(), containsString(scopeName));
+        assertThat(List.of(response.getScope().split(" ")), not(hasItem("org")));
+        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
+        assertThat(accessToken.getScope(), containsString(scopeName));
+        assertThat(List.of(accessToken.getScope().split(" ")), not(hasItem("org")));
+        assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
+        assertThat((List<String>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION), hasSize(2));
+    }
+
+    @Test
+    public void testClaimNotMappedIfUserNotMemberWhenDefaultClientScope() {
+        OrganizationRepresentation orgARep = createOrganization("orga", true);
+        OrganizationResource orgA = testRealm().organizations().get(orgARep.getId());
+        MemberRepresentation member = addMember(orgA, "member@" + orgARep.getDomains().iterator().next().getName());
+        orgA.members().member(member.getId()).delete().close();
+
+        ClientRepresentation clientRep = testRealm().clients().findByClientId("broker-app").get(0);
+        ClientResource client = testRealm().clients().get(clientRep.getId());
+        ClientScopeRepresentation orgScopeRep = client.getOptionalClientScopes().stream().filter(scope -> "organization".equals(scope.getName())).findAny().orElse(null);
+        client.removeOptionalClientScope(orgScopeRep.getId());
+        client.addDefaultClientScope(orgScopeRep.getId());
+        getCleanup().addCleanup(() -> {
+            client.removeDefaultClientScope(orgScopeRep.getId());
+            client.addOptionalClientScope(orgScopeRep.getId());
+        });
+        // resolve organization based on the organization scope value
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        oauth.scope(null);
+        loginPage.open(bc.consumerRealmName());
+        loginPage.loginUsername(member.getEmail());
+        loginPage.login(memberPassword);
+
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+        assertThat(response.getScope(), containsString(orgScopeRep.getName()));
+        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
+        assertThat(accessToken.getScope(), containsString(orgScopeRep.getName()));
+        assertThat(accessToken.getOtherClaims().keySet(), not(hasItem(OAuth2Constants.ORGANIZATION)));
+    }
+
+    @Test
+    public void testClaimNotMappedIfUserNotMemberWhenScopeOrgAliasRequested() {
+        OrganizationRepresentation orgARep = createOrganization("orga", true);
+        assertClaimNotMapped("organization:" + orgARep.getAlias(), orgARep, false);
+    }
+
+    @Test
+    public void testClaimNotMappedIfUserNotMemberWhenScopeOrgAllRequested() {
+        assertClaimNotMapped("organization:*", createOrganization("orga", true), false);
+    }
+
+    @Test
+    public void testClaimNotMappedIfUserNotMemberWhenScopeOrgRequested() {
+        assertClaimNotMapped("organization", createOrganization("orga", true), true);
+    }
+
+    @Test
+    public void testOrganizationsClaimMappedIfScopeInTokenDisabled() throws Exception {
+        OrganizationRepresentation orgA = createOrganization("orga", true);
+        MemberRepresentation member = addMember(testRealm().organizations().get(orgA.getId()), "member@" + orgA.getDomains().iterator().next().getName());
+        OrganizationRepresentation orgB = createOrganization("orgb", true);
+        testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
+
+        ClientRepresentation clientRep = testRealm().clients().findByClientId("broker-app").get(0);
+        ClientResource client = testRealm().clients().get(clientRep.getId());
+        ClientScopeRepresentation orgScopeRep = client.getOptionalClientScopes().stream().filter(scope -> "organization".equals(scope.getName())).findAny().orElse(null);
+        orgScopeRep.setAttributes(Map.of(ClientScopeModel.INCLUDE_IN_TOKEN_SCOPE, "false"));
+        getCleanup().addCleanup(() -> {
+            orgScopeRep.setAttributes(Map.of(ClientScopeModel.INCLUDE_IN_TOKEN_SCOPE, "true"));
+            testRealm().clientScopes().get(orgScopeRep.getId()).update(orgScopeRep);
+        });
+        testRealm().clientScopes().get(orgScopeRep.getId()).update(orgScopeRep);
+
+        oauth.client("direct-grant", "password");
+        oauth.scope("openid organization:*");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest(member.getEmail(), memberPassword);
+        assertThat(response.getScope(), not(containsString("organization")));
+        AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
+        assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
+        List<String> organization = (List<String>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
+        assertThat(organization, containsInAnyOrder("orga", "orgb"));
+    }
+
     private AccessTokenResponse assertSuccessfulCodeGrant() {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertThat(Status.OK, is(Status.fromStatusCode(response.getStatusCode())));
         return response;
     }
@@ -847,8 +1003,8 @@ private ProtocolMapperRepresentation createGroupMapper() {
     }
 
     private void assertScopeAndClaims(String orgScope, OrganizationRepresentation org) {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        AccessTokenResponse response = oauth.doAccessTokenRequest(code, KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
         assertThat(response.getScope(), containsString(orgScope));
         AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(orgScope));
@@ -858,7 +1014,7 @@ private void assertScopeAndClaims(String orgScope, OrganizationRepresentation or
         assertThat(response.getRefreshToken(), notNullValue());
         RefreshToken refreshToken = oauth.parseRefreshToken(response.getRefreshToken());
         assertThat(refreshToken.getScope(), containsString(orgScope));
-        response = oauth.doRefreshTokenRequest(response.getRefreshToken(), KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        response = oauth.doRefreshTokenRequest(response.getRefreshToken());
         assertThat(response.getScope(), containsString(orgScope));
         accessToken = oauth.verifyToken(response.getAccessToken());
         assertThat(accessToken.getScope(), containsString(orgScope));
@@ -891,4 +1047,22 @@ private void setMapperConfig(String key, String value) {
 
         orgScopeResource.getProtocolMappers().update(orgMapper.getId(), orgMapper);
     }
+
+    private void assertClaimNotMapped(String orgScope, OrganizationRepresentation orgARep, boolean grantScope) {
+        OrganizationResource orgA = testRealm().organizations().get(orgARep.getId());
+        MemberRepresentation member = addMember(orgA, "member@" + orgARep.getDomains().iterator().next().getName());
+        orgA.members().member(member.getId()).delete().close();
+        oauth.client("broker-app", KcOidcBrokerConfiguration.CONSUMER_BROKER_APP_SECRET);
+        oauth.scope(orgScope);
+        loginPage.open(bc.consumerRealmName());
+        loginPage.loginUsername(member.getEmail());
+        loginPage.login(memberPassword);
+
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse response = oauth.doAccessTokenRequest(code);
+        assertThat(response.getScope(), grantScope ? containsString(orgScope) : not(containsString(orgScope)));
+        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
+        assertThat(accessToken.getScope(), grantScope ? containsString(orgScope) : not(containsString(orgScope)));
+        assertThat(accessToken.getOtherClaims().keySet(), not(hasItem(OAuth2Constants.ORGANIZATION)));
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberTest.java
index 1c2b475cbb3b..f450ab6845b8 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberTest.java
@@ -25,12 +25,14 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.keycloak.models.OrganizationDomainModel.ANY_DOMAIN;
 import static org.keycloak.testsuite.broker.BrokerTestTools.waitForPage;
 
 import java.util.ArrayList;
@@ -49,6 +51,7 @@
 import org.keycloak.admin.client.resource.OrganizationMemberResource;
 import org.keycloak.admin.client.resource.OrganizationResource;
 import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.admin.client.resource.UsersResource;
 import org.keycloak.models.OrganizationModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
@@ -120,13 +123,13 @@ public void testGetMemberOrganization() {
         OrganizationRepresentation orgB = createOrganization("orgb");
         testRealm().organizations().get(orgB.getId()).members().addMember(member.getId()).close();
         OrganizationRepresentation expected = organization.toRepresentation();
-        List<OrganizationRepresentation> actual = organization.members().member(member.getId()).getOrganizations();
+        List<OrganizationRepresentation> actual = organization.members().member(member.getId()).getOrganizations(true);
         assertNotNull(actual);
         assertEquals(2, actual.size());
         assertTrue(actual.stream().map(OrganizationRepresentation::getId).anyMatch(expected.getId()::equals));
         assertTrue(actual.stream().map(OrganizationRepresentation::getId).anyMatch(orgB.getId()::equals));
 
-        actual = testRealm().organizations().members().getOrganizations(member.getId());
+        actual = testRealm().organizations().members().getOrganizations(member.getId(), true);
         assertNotNull(actual);
         assertEquals(2, actual.size());
         assertTrue(actual.stream().map(OrganizationRepresentation::getId).anyMatch(expected.getId()::equals));
@@ -329,7 +332,7 @@ public void testDeleteMembersOnOrganizationRemoval() {
         for (MemberRepresentation member : expected) {
             try {
                 // user no longer bound to the organization
-                organization.members().member(member.getId()).getOrganizations();
+                organization.members().member(member.getId()).getOrganizations(true);
                 fail("should not be associated with the organization anymore");
             } catch (NotFoundException ignore) {
             }
@@ -473,6 +476,7 @@ public void testUserFederatedBeforeTheIDPBoundWithAnOrgIsNotMember() {
         // assign IdP to the org
         idpRep.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, orgDomain);
         idpRep.getConfig().put(OrganizationModel.IdentityProviderRedirectMode.EMAIL_MATCH.getKey(), Boolean.TRUE.toString());
+        testRealm().identityProviders().get(idpRep.getAlias()).update(idpRep);
 
         try (Response response = testRealm().organizations().get(id).identityProviders().addIdentityProvider(idpAlias)) {
             assertThat(response.getStatus(), equalTo(Status.NO_CONTENT.getStatusCode()));
@@ -480,6 +484,12 @@ public void testUserFederatedBeforeTheIDPBoundWithAnOrgIsNotMember() {
 
         //check the federated user is not a member
         assertThat(testRealm().organizations().get(id).members().list(-1, -1), hasSize(0));
+
+        // test again this time assigning any org domain to the identity provider
+
+        idpRep.getConfig().put(OrganizationModel.ORGANIZATION_DOMAIN_ATTRIBUTE, ANY_DOMAIN);
+        testRealm().identityProviders().get(idpRep.getAlias()).update(idpRep);
+        assertThat(testRealm().organizations().get(id).members().list(-1, -1), hasSize(0));
     }
 
     @Test
@@ -497,7 +507,7 @@ public void testMemberInMultipleOrganizations() {
         Assert.assertTrue(orgb.members().list(-1, -1).stream().map(UserRepresentation::getId).anyMatch(member.getId()::equals));
         String orgbId = orgb.toRepresentation().getId();
         String orgaId = orga.toRepresentation().getId();
-        List<String> memberOfOrgs = orga.members().member(member.getId()).getOrganizations().stream().map(OrganizationRepresentation::getId).toList();
+        List<String> memberOfOrgs = orga.members().member(member.getId()).getOrganizations(true).stream().map(OrganizationRepresentation::getId).toList();
         assertTrue(memberOfOrgs.contains(orgaId));
         assertTrue(memberOfOrgs.contains(orgbId));
     }
@@ -546,6 +556,86 @@ public void testMembersCount() {
         assertEquals(10, (long) organization.members().count());
     }
 
+    @Test
+    public void testNonMemberCanUnsetEmailThatMatchesOrg() {
+        // create a test org with a domain "neworg.org"
+        OrganizationRepresentation orgRep = createOrganization();
+        assertThat(orgRep.getDomains(), hasSize(1));
+        assertThat(orgRep.getDomains().iterator().next().getName(), equalTo("neworg.org"));
+
+        // create a user whose e-mail matches the org
+        UserRepresentation user = new UserRepresentation();
+        user.setUsername("brucewayne");
+        user.setFirstName("Bruce");
+        user.setLastName("Wayne");
+        user.setEmail("bwayne@neworg.org");
+
+        try (Response response = testRealm().users().create(user)) {
+            user.setId(ApiUtil.getCreatedId(response));
+        }
+        getCleanup().addCleanup(() -> testRealm().users().get(user.getId()).remove());
+
+        // now update the user, unsetting the e-mail
+        user.setEmail("");
+        testRealm().users().get(user.getId()).update(user);
+
+        UserRepresentation updatedUser = testRealm().users().get(user.getId()).toRepresentation();
+        assertThat(updatedUser.getEmail(), is(nullValue()));
+    }
+
+    @Test
+    public void testGetMemberOrganizationsBriefVsFullRepresentation() {
+        // Create an organization with attributes
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        OrganizationRepresentation orgRep = organization.toRepresentation();
+        orgRep.singleAttribute("testAttribute", "testValue");
+        organization.update(orgRep).close();
+        
+        UserRepresentation member = addMember(organization);
+        
+        // Test brief representation (default, briefRepresentation=true)
+        List<OrganizationRepresentation> briefOrgs = organization.members().member(member.getId()).getOrganizations(true);
+        assertNotNull(briefOrgs);
+        assertEquals(1, briefOrgs.size());
+        OrganizationRepresentation briefRep = briefOrgs.get(0);
+        assertEquals(orgRep.getId(), briefRep.getId());
+        assertEquals(orgRep.getName(), briefRep.getName());
+        assertEquals(orgRep.getAlias(), briefRep.getAlias());
+        assertEquals(orgRep.getDescription(), briefRep.getDescription());
+        assertEquals(orgRep.getRedirectUrl(), briefRep.getRedirectUrl());
+        assertEquals(orgRep.isEnabled(), briefRep.isEnabled());
+        assertNull("Brief representation should not include attributes", briefRep.getAttributes());
+        
+        // Test full representation (briefRepresentation=false)
+        List<OrganizationRepresentation> fullOrgs = organization.members().member(member.getId()).getOrganizations(false);
+        assertNotNull(fullOrgs);
+        assertEquals(1, fullOrgs.size());
+        OrganizationRepresentation fullRep = fullOrgs.get(0);
+        assertEquals(orgRep.getId(), fullRep.getId());
+        assertEquals(orgRep.getName(), fullRep.getName());
+        assertEquals(orgRep.getAlias(), fullRep.getAlias());
+        assertEquals(orgRep.getDescription(), fullRep.getDescription());
+        assertEquals(orgRep.getRedirectUrl(), fullRep.getRedirectUrl());
+        assertEquals(orgRep.isEnabled(), fullRep.isEnabled());
+        assertNotNull("Full representation should include attributes", fullRep.getAttributes());
+        assertTrue("Full representation should include the test attribute", 
+                fullRep.getAttributes().containsKey("testAttribute"));
+        assertEquals("testValue", fullRep.getAttributes().get("testAttribute").get(0));
+        
+        // Test the global members API endpoint as well
+        List<OrganizationRepresentation> briefOrgsGlobal = testRealm().organizations().members().getOrganizations(member.getId(), true);
+        assertNotNull(briefOrgsGlobal);
+        assertEquals(1, briefOrgsGlobal.size());
+        assertNull("Brief representation should not include attributes", briefOrgsGlobal.get(0).getAttributes());
+        
+        List<OrganizationRepresentation> fullOrgsGlobal = testRealm().organizations().members().getOrganizations(member.getId(), false);
+        assertNotNull(fullOrgsGlobal);
+        assertEquals(1, fullOrgsGlobal.size());
+        assertNotNull("Full representation should include attributes", fullOrgsGlobal.get(0).getAttributes());
+        assertTrue("Full representation should include the test attribute", 
+                fullOrgsGlobal.get(0).getAttributes().containsKey("testAttribute"));
+    }
+
     private void loginViaNonOrgIdP(String idpAlias) {
         oauth.clientId("broker-app");
         loginPage.open(bc.consumerRealmName());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberWithLdapTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberWithLdapTest.java
new file mode 100644
index 000000000000..cc0a45930b45
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/organization/member/OrganizationMemberWithLdapTest.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.organization.member;
+
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.keycloak.admin.client.resource.OrganizationResource;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.MemberRepresentation;
+import org.keycloak.representations.idm.OrganizationRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.storage.ldap.mappers.membership.LDAPGroupMapperMode;
+import org.keycloak.storage.ldap.mappers.membership.group.GroupMapperConfig;
+import org.keycloak.testsuite.federation.ldap.LDAPTestContext;
+import org.keycloak.testsuite.organization.admin.AbstractOrganizationTest;
+import org.keycloak.testsuite.util.LDAPRule;
+import org.keycloak.testsuite.util.LDAPTestUtils;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.junit.Assert.assertEquals;
+
+public class OrganizationMemberWithLdapTest extends AbstractOrganizationTest {
+
+    @ClassRule
+    public static LDAPRule ldapRule = new LDAPRule();
+
+    @Override
+    public void importTestRealms() {
+        super.importTestRealms();
+
+        // add an LDAP provider with a group mapper
+        Map<String, String> cfg = ldapRule.getConfig();
+        testingClient.testing().ldap(TEST_REALM_NAME).createLDAPProvider(cfg, true);
+        testingClient.testing().ldap(TEST_REALM_NAME).prepareGroupsLDAPTest();
+    }
+
+    @Test
+    public void testLdapUserJoiningAndLeavingOrganization() {
+        testingClient.server().run(session -> {
+            LDAPTestContext ctx = LDAPTestContext.init(session);
+            RealmModel appRealm = ctx.getRealm();
+
+            // ensure groups mapper is in LDAP_ONLY mode - we want to check that upon joining the org, the org group is NOT pushed to LDAP.
+            ComponentModel mapperModel = LDAPTestUtils.getSubcomponentByName(appRealm, ctx.getLdapModel(), "groupsMapper");
+            LDAPTestUtils.updateConfigOptions(mapperModel, GroupMapperConfig.MODE, LDAPGroupMapperMode.LDAP_ONLY.toString());
+            appRealm.updateComponent(mapperModel);
+
+            // check that the LDAP provider is working - i.e. users are available and groups have been properly synced.
+            UserModel john = session.users().getUserByUsername(appRealm, "johnkeycloak");
+            assertThat(john, notNullValue());
+            GroupModel testGroup = KeycloakModelUtils.findGroupByPath(session, appRealm, "/group1");
+            assertThat(testGroup, notNullValue());
+        });
+
+        OrganizationResource organization = testRealm().organizations().get(createOrganization().getId());
+        OrganizationRepresentation orgRepresentation = organization.toRepresentation();
+        UserRepresentation ldapUser = testRealm().users().searchByUsername("johnkeycloak", true).get(0);
+
+        // make the LDAP user join the organization and check it was successful.
+        try (Response response = organization.members().addMember(ldapUser.getId())) {
+            assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
+        }
+        List<OrganizationRepresentation> orgMemberships = organization.members().member(ldapUser.getId()).getOrganizations(true);
+        assertThat(orgMemberships, notNullValue());
+        assertThat(orgMemberships, hasSize(1));
+        assertThat(orgMemberships.get(0).getId(), equalTo(orgRepresentation.getId()));
+
+        // check that the org group was NOT pushed to LDAP as a result of joining the org.
+        AtomicReference<String> orgId = new AtomicReference<>(orgRepresentation.getId());
+        testingClient.server(TEST_REALM_NAME).run(session -> {
+            LDAPTestContext context = LDAPTestContext.init(session);
+            assertThat(LDAPTestUtils.getLdapGroupByName(session, context.getRealm(), "groupsMapper", orgId.get()), is(nullValue()));
+        });
+
+        // make the user leave the organization and check it was successful.
+        try (Response response = organization.members().removeMember(ldapUser.getId())) {
+            assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus());
+        }
+        List<MemberRepresentation> orgMembers = organization.members().list(-1, -1);
+        assertThat(orgMembers, hasSize(0));
+    }
+
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/policy/PasswordAgePolicyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/policy/PasswordAgePolicyTest.java
index 71a60560cc2c..0e7f7e47fdf0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/policy/PasswordAgePolicyTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/policy/PasswordAgePolicyTest.java
@@ -19,7 +19,9 @@
 
 import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.core.Response;
+import org.jboss.arquillian.graphene.page.Page;
 import org.junit.After;
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.UserResource;
@@ -27,7 +29,19 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AbstractAuthTest;
-
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.auth.page.AuthRealm;
+import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.pages.AppPage.RequestType;
+import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.pages.RegisterPage;
+import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
+import org.keycloak.testsuite.util.ClientBuilder;
+import org.keycloak.testsuite.util.RealmBuilder;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
+
+import java.io.IOException;
+import java.util.List;
 import java.util.function.Consumer;
 
 import static org.keycloak.representations.idm.CredentialRepresentation.PASSWORD;
@@ -36,7 +50,16 @@
 
 public class PasswordAgePolicyTest extends AbstractAuthTest {
 
-    UserResource user;
+    @Page
+    private LoginPage loginPage;
+
+    @Page
+    private RegisterPage registerPage;
+
+    @Page
+    private AppPage appPage;
+
+    private UserResource user;
 
     private void setPasswordAgePolicy(String passwordAge) {
         log.info(String.format("Setting %s", passwordAge));
@@ -105,6 +128,25 @@ static private int daysToSeconds(int days) {
         return days * 24 * 60 * 60;
     }
 
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        testRealms.add(RealmBuilder.create()
+                .name(AuthRealm.TEST)
+                .client(ClientBuilder.create()
+                        .clientId("test-app")
+                        .redirectUris(
+                                "http://localhost:8180/auth/realms/master/app/auth/*",
+                                "https://localhost:8543/auth/realms/master/app/auth/*",
+                                "http://localhost:8180/auth/realms/test/app/auth/*",
+                                "https://localhost:8543/auth/realms/test/app/auth/*")
+                        .secret(PASSWORD)
+                        .baseUrl("http://localhost:8180/auth/realms/master/app/auth")
+                        .enabled(Boolean.TRUE)
+                        .adminUrl("http://localhost:8180/auth/realms/master/app/admin")
+                        .build())
+                .build());
+    }
+
     @Before
     public void before() {
         user = createUser(createUserRepresentation("test_user"));
@@ -258,4 +300,28 @@ public void testBothPasswordHistoryPoliciesPasswordAgePolicyTakesOver() {
         //password age takes precedence
         expectBadRequestException(f -> setPasswordAgePolicyValue("secret"));
     }
+
+    @Test
+    public void testRegistration() throws IOException {
+        try (RealmAttributeUpdater realmUpdater = new RealmAttributeUpdater(testRealmResource())
+                .setRegistrationAllowed(Boolean.TRUE)
+                .setPasswordPolicy(String.format("passwordAge(%s)", 2)) // 2 days
+                .update()) {
+
+            oauth.openLoginForm();
+            loginPage.assertCurrent();
+
+            loginPage.clickRegister();
+            registerPage.assertCurrent();
+
+            registerPage.register("firstName", "lastName", "registration-user@localhost", "registration-user", "password", "password");
+
+            Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            AuthorizationEndpointResponse response = oauth.parseLoginResponse();
+            Assert.assertNull(response.getError());
+            Assert.assertNotNull(response.getCode());
+
+            ApiUtil.findUserByUsernameId(testRealmResource(), "registration-user").remove();
+        }
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/AbstractSamlTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/AbstractSamlTest.java
index 3f78f41edc89..40aa02f0dd49 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/AbstractSamlTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/AbstractSamlTest.java
@@ -1,5 +1,6 @@
 package org.keycloak.testsuite.saml;
 
+import org.keycloak.common.crypto.CryptoIntegration;
 import org.keycloak.common.util.CertificateUtils;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.PemUtils;
@@ -73,6 +74,7 @@ public abstract class AbstractSamlTest extends AbstractAuthTest {
 
     static {
         try {
+            CryptoIntegration.init(Thread.currentThread().getContextClassLoader());
             KeyFactory kfRsa = KeyFactory.getInstance("RSA");
             SAML_CLIENT_SALES_POST_SIG_PRIVATE_KEY_PK = kfRsa.generatePrivate(new PKCS8EncodedKeySpec(Base64.getDecoder().decode(SAML_CLIENT_SALES_POST_SIG_PRIVATE_KEY)));
             SAML_CLIENT_SALES_POST_SIG_PUBLIC_KEY_PK = kfRsa.generatePublic(new X509EncodedKeySpec(Base64.getDecoder().decode(SAML_CLIENT_SALES_POST_SIG_PUBLIC_KEY)));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java
index 0d2dd306d0ca..1d9f67c4d78b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/ArtifactBindingTest.java
@@ -86,7 +86,7 @@ public class ArtifactBindingTest extends AbstractSamlTest {
 
     @Test
     public void testArtifactBindingTimesOutAfterCodeToTokenLifespan() throws Exception {
-        
+
         getCleanup().addCleanup(
                 new RealmAttributeUpdater(adminClient.realm(REALM_NAME))
                         .setAccessCodeLifespan(1)
@@ -488,6 +488,42 @@ public void testArtifactBindingLogoutSingleClientPost() {
         assertThat(samlResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
     }
 
+    @Test
+    public void testArtifactBindingLogoutSingleClientPostSignature() throws Exception {
+        getCleanup()
+                .addCleanup(ClientAttributeUpdater.forClient(adminClient, REALM_NAME, SAML_CLIENT_ID_SALES_POST)
+                        .setAttribute(SamlConfigAttributes.SAML_ARTIFACT_BINDING, "true")
+                        .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE, "http://url")
+                        .setAttribute(SamlConfigAttributes.SAML_SERVER_SIGNATURE, "true")
+                        .setFrontchannelLogout(true)
+                        .update()
+                );
+
+        SAMLDocumentHolder response = new SamlClientBuilder().authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST,
+                        SAML_ASSERTION_CONSUMER_URL_SALES_POST, POST)
+                .build()
+                .login().user(bburkeUser).build()
+                .handleArtifact(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST).build()
+                .logoutRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST, POST).build()
+                .handleArtifact(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST).build()
+                .doNotFollowRedirects()
+                .executeAndTransform(this::getArtifactResponse);
+
+        assertThat(response.getSamlObject(), instanceOf(ArtifactResponseType.class));
+        ArtifactResponseType artifactResponse = (ArtifactResponseType)response.getSamlObject();
+        assertThat(artifactResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
+        assertThat(artifactResponse.getSignature(), notNullValue());
+        assertThat(artifactResponse.getAny(), not(instanceOf(ResponseType.class)));
+        assertThat(artifactResponse.getAny(), not(instanceOf(ArtifactResponseType.class)));
+        assertThat(artifactResponse.getAny(), not(instanceOf(NameIDMappingResponseType.class)));
+        assertThat(artifactResponse.getAny(), instanceOf(StatusResponseType.class));
+        StatusResponseType samlResponse = (StatusResponseType)artifactResponse.getAny();
+        assertThat(samlResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
+
+        SamlDeployment deployment = SamlUtils.getSamlDeploymentForClient("sales-post");
+        SamlProtocolUtils.verifyDocumentSignature(response.getSamlDocument(), deployment.getIDP().getSignatureValidationKeyLocator());
+    }
+
     @Test
     public void testArtifactBindingLogoutSingleClientRedirect() {
         getCleanup()
@@ -521,6 +557,43 @@ public void testArtifactBindingLogoutSingleClientRedirect() {
         assertThat(samlResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
     }
 
+    @Test
+    public void testArtifactBindingLogoutSingleClientRedirectSignature() throws Exception {
+        getCleanup()
+                .addCleanup(ClientAttributeUpdater.forClient(adminClient, REALM_NAME, SAML_CLIENT_ID_SALES_POST)
+                        .setAttribute(SamlConfigAttributes.SAML_ARTIFACT_BINDING, "true")
+                        .setAttribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_ARTIFACT_ATTRIBUTE, "http://url")
+                        .setAttribute(SamlConfigAttributes.SAML_SERVER_SIGNATURE, "true")
+                        .setFrontchannelLogout(true)
+                        .update()
+                );
+
+        SAMLDocumentHolder response = new SamlClientBuilder().authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST,
+                        SAML_ASSERTION_CONSUMER_URL_SALES_POST, REDIRECT)
+                .setProtocolBinding(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri())
+                .build()
+                .login().user(bburkeUser).build()
+                .handleArtifact(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST).verifyRedirect(true).build()
+                .logoutRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST, REDIRECT).build()
+                .handleArtifact(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST).verifyRedirect(true).build()
+                .doNotFollowRedirects()
+                .executeAndTransform(this::getArtifactResponse);
+
+        assertThat(response.getSamlObject(), instanceOf(ArtifactResponseType.class));
+        ArtifactResponseType artifactResponse = (ArtifactResponseType)response.getSamlObject();
+        assertThat(artifactResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
+        assertThat(artifactResponse.getSignature(), notNullValue());
+        assertThat(artifactResponse.getAny(), not(instanceOf(ResponseType.class)));
+        assertThat(artifactResponse.getAny(), not(instanceOf(ArtifactResponseType.class)));
+        assertThat(artifactResponse.getAny(), not(instanceOf(NameIDMappingResponseType.class)));
+        assertThat(artifactResponse.getAny(), instanceOf(StatusResponseType.class));
+        StatusResponseType samlResponse = (StatusResponseType)artifactResponse.getAny();
+        assertThat(samlResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
+
+        SamlDeployment deployment = SamlUtils.getSamlDeploymentForClient("sales-post");
+        SamlProtocolUtils.verifyDocumentSignature(response.getSamlDocument(), deployment.getIDP().getSignatureValidationKeyLocator());
+    }
+
     @Test
     public void testArtifactBindingLogoutTwoClientsPostWithSig() throws Exception {
         getCleanup()
@@ -848,7 +921,7 @@ public void testSessionStateDuringArtifactBindingLogoutWithMoreFrontChannelClien
         assertThat(artifactResponse, isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
         assertThat(artifactResponse.getAny(), instanceOf(StatusResponseType.class));
     }
-    
+
     @Test
     public void testArtifactBindingIsNotUsedForLogoutWhenLogoutUrlNotSetRedirect() {
         getCleanup()
@@ -960,7 +1033,7 @@ public void testSPMetadataArtifactBindingNotUsedForLogout() throws ParsingExcept
         SPSSODescriptorType spDescriptor = getSPInstallationDescriptor(adminClient.realm(REALM_NAME).clients(), SAML_CLIENT_ID_SALES_POST);
         assertThat(spDescriptor.getAssertionConsumerService().get(0).getBinding(), is(equalTo(JBossSAMLURIConstants.SAML_HTTP_ARTIFACT_BINDING.getUri())));
         assertThat(spDescriptor.getAssertionConsumerService().get(0).getLocation(), is(equalTo(new URI("http://url.artifact.test"))));
-        
+
         assertThat(spDescriptor.getSingleLogoutService().get(0).getBinding(), is(equalTo(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri())));
         assertThat(spDescriptor.getSingleLogoutService().get(0).getLocation(), is(equalTo(new URI("http://admin.url.test"))));
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/LogoutTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/LogoutTest.java
index d1cb51e180da..9842e5c8e616 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/LogoutTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/saml/LogoutTest.java
@@ -465,6 +465,49 @@ public void testLogoutWithPostBindingUnsetRedirectBindingSet() {
         assertLogoutEvent(SAML_CLIENT_ID_SALES_POST2);
     }
 
+    @Test
+    public void testFrontchannelLogoutInSameBrowserUsingDefaultAdminUrl() {
+        adminClient.realm(REALM_NAME)
+          .clients().get(sales2Rep.getId())
+          .update(ClientBuilder.edit(sales2Rep)
+            .frontchannelLogout(true)
+            .attribute(SamlConfigAttributes.SAML_FORCE_POST_BINDING, Boolean.TRUE.toString())
+            .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_POST_ATTRIBUTE, "")
+            .attribute(SamlProtocol.SAML_SINGLE_LOGOUT_SERVICE_URL_REDIRECT_ATTRIBUTE, "")
+            .adminUrl(SAML_ASSERTION_CONSUMER_URL_SALES_POST2)
+            .build());
+
+        SAMLDocumentHolder samlResponse = prepareLogIntoTwoApps()
+          .logoutRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST, POST)
+            .nameId(nameIdRef::get)
+            .sessionIndex(sessionIndexRef::get)
+            .build()
+
+          .processSamlResponse(POST)
+            .transformDocument(doc -> {
+              // Expect logout request for sales-post2
+              SAML2Object so = (SAML2Object) SAMLParser.getInstance().parse(new DOMSource(doc));
+              assertThat(so, isSamlLogoutRequest(SAML_ASSERTION_CONSUMER_URL_SALES_POST2));
+
+              // Emulate successful logout response from sales-post2 logout
+              return new SAML2LogoutResponseBuilder()
+                .destination(getAuthServerSamlEndpoint(REALM_NAME).toString())
+                .issuer(SAML_CLIENT_ID_SALES_POST2)
+                .logoutRequestID(((LogoutRequestType) so).getID())
+                .buildDocument();
+            })
+            .targetAttributeSamlResponse()
+            .targetUri(getAuthServerSamlEndpoint(REALM_NAME))
+            .build()
+
+          .getSamlResponse(POST);
+
+        // Expect final successful logout response from auth server signalling final successful logout
+        assertThat(samlResponse.getSamlObject(), isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
+        assertThat(((StatusResponseType) samlResponse.getSamlObject()).getDestination(), is("http://url"));
+        assertLogoutEvent(SAML_CLIENT_ID_SALES_POST2);
+    }
+
     private void assertLogoutEvent(String clientId) {
         List<EventRepresentation> logoutEvents = adminClient.realm(REALM_NAME)
                 .getEvents(Arrays.asList(EventType.LOGOUT.name()), clientId, null, null, null, null, null, null);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/script/DeployedScriptMapperTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/script/DeployedScriptMapperTest.java
index af0134fd7ded..0c872763b2f6 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/script/DeployedScriptMapperTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/script/DeployedScriptMapperTest.java
@@ -43,7 +43,8 @@
 import org.keycloak.testsuite.arquillian.annotation.DisableFeature;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.util.JsonSerialization;
 
 /**
@@ -99,15 +100,15 @@ public void testTokenScriptMapping() {
             app.getProtocolMappers().createMapper(mapper).close();
         }
         {
-            OAuthClient.AccessTokenResponse response = browserLogin("password", "test-user@localhost", "password");
+            AccessTokenResponse response = browserLogin("test-user@localhost", "password");
             AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
 
             assertEquals("hello_test-user@localhost", accessToken.getOtherClaims().get("computed-via-script"));
         }
     }
 
-    private OAuthClient.AccessTokenResponse browserLogin(String clientSecret, String username, String password) {
-        OAuthClient.AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin(username, password);
-        return oauth.doAccessTokenRequest(authzEndpointResponse.getCode(), clientSecret);
+    private AccessTokenResponse browserLogin(String username, String password) {
+        AuthorizationEndpointResponse authzEndpointResponse = oauth.doLogin(username, password);
+        return oauth.doAccessTokenRequest(authzEndpointResponse.getCode());
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/session/LastSessionRefreshUnitTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/session/LastSessionRefreshUnitTest.java
index f2e21edd8b91..ef21843515ee 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/session/LastSessionRefreshUnitTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/session/LastSessionRefreshUnitTest.java
@@ -17,20 +17,17 @@
 
 package org.keycloak.testsuite.session;
 
-import org.infinispan.Cache;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.common.Profile;
 import org.keycloak.common.util.Retry;
 import org.keycloak.common.util.Time;
-import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.sessions.infinispan.changes.SessionEntityWrapper;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStore;
-import org.keycloak.models.sessions.infinispan.changes.sessions.CrossDCLastSessionRefreshStoreFactory;
+import org.keycloak.models.sessions.infinispan.changes.sessions.AbstractLastSessionRefreshStore;
+import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStore;
+import org.keycloak.models.sessions.infinispan.changes.sessions.PersisterLastSessionRefreshStoreFactory;
 import org.keycloak.models.sessions.infinispan.changes.sessions.SessionData;
-import org.keycloak.models.sessions.infinispan.entities.UserSessionEntity;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.ProfileAssume;
@@ -57,7 +54,7 @@ public void cleanupPeriodicTask() {
         testingClient.server().run((session -> {
 
             TimerProvider timer = session.getProvider(TimerProvider.class);
-            timer.cancelTask(CrossDCLastSessionRefreshStoreFactory.LSR_PERIODIC_TASK_NAME);
+            timer.cancelTask(PersisterLastSessionRefreshStoreFactory.DB_LSR_PERIODIC_TASK_NAME);
 
         }));
     }
@@ -76,7 +73,7 @@ public static class LastSessionRefreshServerCounterTest extends LastSessionRefre
 
         @Override
         public void run(KeycloakSession session) {
-            CrossDCLastSessionRefreshStore customStore = createStoreInstance(session, 1000000, 1000);
+            AbstractLastSessionRefreshStore customStore = createStoreInstance(session, 1000000, 1000);
             System.out.println("sss");
 
             int lastSessionRefresh = Time.currentTime();
@@ -124,7 +121,7 @@ public static class LastSessionRefreshServerIntervalsTest extends LastSessionRef
         public void run(KeycloakSession session) {
             try {
                 // Long timer interval. No message due the timer wasn't executed
-                CrossDCLastSessionRefreshStore customStore1 = createStoreInstance(session, 100000, 10);
+                AbstractLastSessionRefreshStore customStore1 = createStoreInstance(session, 100000, 10);
                 Time.setOffset(100);
 
                 try {
@@ -135,7 +132,7 @@ public void run(KeycloakSession session) {
                 Assert.assertEquals(0, counter.get());
 
                 // Short timer interval 10 ms. 1 message due the interval is executed and lastRun was in the past due to Time.setOffset
-                CrossDCLastSessionRefreshStore customStore2 = createStoreInstance(session, 10, 10);
+                AbstractLastSessionRefreshStore customStore2 = createStoreInstance(session, 10, 10);
                 Time.setOffset(200);
 
                 Retry.execute(() -> {
@@ -163,12 +160,12 @@ public static abstract class LastSessionRefreshServerTest implements RunOnServer
 
         AtomicInteger counter = new AtomicInteger();
 
-        CrossDCLastSessionRefreshStore createStoreInstance(KeycloakSession session, long timerIntervalMs, int maxIntervalBetweenMessagesSeconds) {
-            CrossDCLastSessionRefreshStoreFactory factory = new CrossDCLastSessionRefreshStoreFactory() {
+        AbstractLastSessionRefreshStore createStoreInstance(KeycloakSession session, long timerIntervalMs, int maxIntervalBetweenMessagesSeconds) {
+            PersisterLastSessionRefreshStoreFactory factory = new PersisterLastSessionRefreshStoreFactory() {
 
                 @Override
-                protected CrossDCLastSessionRefreshStore createStoreInstance(int maxIntervalBetweenMessagesSeconds, int maxCount, String eventKey) {
-                    return new CrossDCLastSessionRefreshStore(maxIntervalBetweenMessagesSeconds, maxCount, eventKey) {
+                protected PersisterLastSessionRefreshStore createStoreInstance(int maxIntervalBetweenMessagesSeconds, int maxCount, boolean offline) {
+                    return new PersisterLastSessionRefreshStore(maxIntervalBetweenMessagesSeconds, maxCount, offline) {
 
                         @Override
                         protected void sendMessage(KeycloakSession kcSession, Map<String, SessionData> refreshesToSend) {
@@ -180,8 +177,7 @@ protected void sendMessage(KeycloakSession kcSession, Map<String, SessionData> r
 
             };
 
-            Cache<String, SessionEntityWrapper<UserSessionEntity>> cache = session.getProvider(InfinispanConnectionProvider.class).getCache(InfinispanConnectionProvider.USER_SESSION_CACHE_NAME);
-            return factory.createAndInit(session, cache, timerIntervalMs, maxIntervalBetweenMessagesSeconds, 10, false);
+            return factory.createAndInit(session, timerIntervalMs, maxIntervalBetweenMessagesSeconds, 10, false);
         }
 
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java
index 0e1ae1ae11c1..1d9f9291c716 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsTest.java
@@ -45,12 +45,13 @@
 import org.keycloak.testsuite.util.FlowUtil;
 import org.keycloak.testsuite.util.GreenMailRule;
 import org.keycloak.testsuite.util.MailUtils;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.pages.ErrorPage;
 
 import jakarta.mail.internet.MimeMessage;
 
 import static org.junit.Assert.assertEquals;
+import static org.keycloak.testsuite.sessionlimits.UserSessionLimitsUtil.assertClientSessionCount;
 import static org.keycloak.testsuite.sessionlimits.UserSessionLimitsUtil.assertSessionCount;
 import static org.keycloak.testsuite.sessionlimits.UserSessionLimitsUtil.configureSessionLimits;
 import static org.keycloak.testsuite.sessionlimits.UserSessionLimitsUtil.ERROR_TO_DISPLAY;
@@ -82,6 +83,18 @@ public void setupFlows() {
 
             AuthenticationFlowModel resetPasswordFlow = realm.getResetCredentialsFlow();
             configureSessionLimits(realm, resetPasswordFlow, UserSessionLimitsAuthenticatorFactory.DENY_NEW_SESSION, "0", "1");
+
+            var directClient1 = realm.addClient("direct-grant-1");
+            directClient1.setName("direct-grant-1");
+            directClient1.setSecret("password");
+            directClient1.setDirectAccessGrantsEnabled(true);
+            directClient1.setEnabled(true);
+
+            var directClient2 = realm.addClient("direct-grant-2");
+            directClient2.setName("direct-grant-2");
+            directClient2.setSecret("password");
+            directClient2.setDirectAccessGrantsEnabled(true);
+            directClient2.setEnabled(true);
         });
         testContext.setInitialized(true);
     }
@@ -143,8 +156,7 @@ public void testClientSessionCountNotExceededOnReAuthentication() throws Excepti
         events.expectLogin().assertEvent();
 
         // Re-authenticate the user with prompt=login
-        oauth.prompt("login");
-        loginPage.open();
+        oauth.loginForm().prompt("login").open();
         loginPage.login("test-user@localhost", "password");
         events.expectLogin().assertEvent();
     }
@@ -221,27 +233,111 @@ public void testRealmSessionCountExceededAndOldestSessionRemovedBrowserFlow() th
 
     @Test
     public void testClientSessionCountExceededAndNewSessionDeniedDirectGrantFlow() throws Exception {
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(200, response.getStatusCode());
 
-        response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+        response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
         assertEquals(403, response.getStatusCode());
         assertEquals(ERROR_TO_DISPLAY, response.getError());
     }
 
+    @Test
+    public void testRealmSessionCountAndClientSessionCountExceededAndOldestClientSessionShouldBePrioritized() throws Exception {
+        try {
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.TERMINATE_OLDEST_SESSION);
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "2");
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "1");
+
+            AccessTokenResponse response =  oauth.client("direct-grant-1", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            testingClient.server(realmName).run(assertSessionCount(realmName, username, 2));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-1", 1));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-2", 1));
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            testingClient.server(realmName).run(assertSessionCount(realmName, username, 2));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-1", 1));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-2", 1));
+        } finally {
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.DENY_NEW_SESSION);
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "0");
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "1");
+        }
+    }
+
+    public void testRealmSessionCountAndClientSessionCountExceededAndDecreaseLimitsAfterActiveSessionsAreCreated() throws Exception {
+        try {
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.TERMINATE_OLDEST_SESSION);
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "4");
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "2");
+
+            AccessTokenResponse response =  oauth.client("direct-grant-1", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            response =  oauth.client("direct-grant-1", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            testingClient.server(realmName).run(assertSessionCount(realmName, username, 4));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-1", 2));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-2", 2));
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            testingClient.server(realmName).run(assertSessionCount(realmName, username, 4));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-1", 2));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-2", 2));
+
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "2");
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "1");
+
+            response =  oauth.client("direct-grant-2", "password")
+                    .doPasswordGrantRequest("test-user@localhost", "password");
+            assertEquals(200, response.getStatusCode());
+
+            testingClient.server(realmName).run(assertSessionCount(realmName, username, 2));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-1", 1));
+            testingClient.server(realmName).run(assertClientSessionCount(realmName, username, "direct-grant-2", 1));
+        } finally {
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.DENY_NEW_SESSION);
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "0");
+            setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "1");
+        }
+    }
+
     @Test
     public void testClientSessionCountExceededAndOldestSessionRemovedDirectGrantFlow() throws Exception {
         try {
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.TERMINATE_OLDEST_SESSION);
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "2");
             for (int i = 0; i < 2; ++i) {
-                OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+                AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
                 assertEquals(200, response.getStatusCode());
             }
             testingClient.server(realmName).run(assertSessionCount(realmName, username, 2));
 
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "1");
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(200, response.getStatusCode());
             testingClient.server(realmName).run(assertSessionCount(realmName, username, 1));
         } finally {
@@ -256,10 +352,10 @@ public void testRealmSessionCountExceededAndNewSessionDeniedDirectGrantFlow() th
         try {
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "1");
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "0");
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(200, response.getStatusCode());
 
-            response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(403, response.getStatusCode());
             assertEquals(ERROR_TO_DISPLAY, response.getError());
         } finally {
@@ -274,10 +370,10 @@ public void testRealmSessionCountExceededAndOldestSessionRemovedDirectGrantFlow(
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_REALM_LIMIT, "1");
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.USER_CLIENT_LIMIT, "0");
             setAuthenticatorConfigItem(DefaultAuthenticationFlows.DIRECT_GRANT_FLOW, UserSessionLimitsAuthenticatorFactory.BEHAVIOR, UserSessionLimitsAuthenticatorFactory.TERMINATE_OLDEST_SESSION);
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(200, response.getStatusCode());
 
-            response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+            response = oauth.doPasswordGrantRequest("test-user@localhost", "password");
             assertEquals(200, response.getStatusCode());
             testingClient.server(realmName).run(assertSessionCount(realmName, username, 1));
         } finally {
@@ -520,4 +616,4 @@ private void setAuthenticatorConfigItem(String alias, String key, String value)
             realm.updateAuthenticatorConfig(configModel);
         });
     }
-}
\ No newline at end of file
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsUtil.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsUtil.java
index a8c68cc7867b..1b6fab09c897 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/sessionlimits/UserSessionLimitsUtil.java
@@ -37,6 +37,17 @@ protected static void configureSessionLimits(RealmModel realm, AuthenticationFlo
         realm.addAuthenticatorExecution(execution);
     }
 
+    static RunOnServer assertClientSessionCount(String realmName, String username, String clientId, int count) {
+        return (session) -> {
+            RealmModel realm = session.realms().getRealmByName(realmName);
+            UserModel user = session.users().getUserByUsername(realm, username);
+            assertEquals(count, session.sessions()
+                    .getUserSessionsStream(realm, realm.getClientByClientId(clientId))
+                    .filter(userSessionModel -> userSessionModel.getUser().getId().equals(user.getId()))
+                    .count());
+        };
+    }
+
     static RunOnServer assertSessionCount(String realmName, String username, int count) {
         return (session) -> {
             RealmModel realm = session.realms().getRealmByName(realmName);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TLSTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TLSTest.java
index 939f9fbfdaf9..1fab02b6e652 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TLSTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TLSTest.java
@@ -11,6 +11,7 @@
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
 import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.util.oauth.OpenIDProviderConfigurationResponse;
 
 /**
  * This test checks if TLS can be explicitly switched off.
@@ -42,7 +43,7 @@ public void testTurningTLSOn() throws Exception {
         oauth.baseUrl(AUTH_SERVER_ROOT_WITHOUT_TLS);
 
         //when
-        OIDCConfigurationRepresentation config = oauth.doWellKnownRequest("test");
+        OIDCConfigurationRepresentation config = oauth.doWellKnownRequest();
 
         //then
         Assert.assertTrue(config.getAuthorizationEndpoint().startsWith(AUTH_SERVER_ROOT_WITHOUT_TLS));
@@ -58,13 +59,13 @@ public void testSSLAlwaysRequired() throws Exception {
 
         // Try access "WellKnown" endpoint unsecured. It should fail
         oauth.baseUrl(AUTH_SERVER_ROOT_WITHOUT_TLS);
-        OIDCConfigurationRepresentation config = oauth.doWellKnownRequest("test");
-        Assert.assertNull(config.getAuthorizationEndpoint());
-        Assert.assertEquals("HTTPS required", config.getOtherClaims().get("error_description"));
+        OpenIDProviderConfigurationResponse providerConfigurationResponse = oauth.wellknownRequest().send();
+        Assert.assertFalse(providerConfigurationResponse.isSuccess());
+        Assert.assertEquals("HTTPS required", providerConfigurationResponse.getErrorDescription());
 
         // Try access "JWKS URL" unsecured. It should fail
         try {
-            JSONWebKeySet keySet = oauth.doCertsRequest("test");
+            JSONWebKeySet keySet = oauth.keys().getRealmKeys();
             Assert.fail("This should not be successful");
         } catch (Exception e) {
             // Expected
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TrustStoreEmailTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TrustStoreEmailTest.java
index 249025ec86ab..1cc5625b2d59 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TrustStoreEmailTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/ssl/TrustStoreEmailTest.java
@@ -18,8 +18,10 @@
 
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.After;
+import org.junit.FixMethodOrder;
 import org.junit.Rule;
 import org.junit.Test;
+import org.junit.runners.MethodSorters;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.common.enums.HostnameVerificationPolicy;
 import org.keycloak.events.Details;
@@ -35,10 +37,11 @@
 import org.keycloak.testsuite.auth.page.AuthRealm;
 import org.keycloak.testsuite.auth.page.login.OIDCLogin;
 import org.keycloak.testsuite.auth.page.login.VerifyEmail;
+import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.MailServerConfiguration;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.SslMailServer;
 
 import static org.junit.Assert.assertEquals;
@@ -49,6 +52,7 @@
  *
  * @author fkiss
  */
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
 public class TrustStoreEmailTest extends AbstractTestRealmKeycloakTest {
 
     @Page
@@ -60,6 +64,9 @@ public class TrustStoreEmailTest extends AbstractTestRealmKeycloakTest {
     @Page
     private VerifyEmail testRealmVerifyEmailPage;
 
+    @Page
+    private ErrorPage errorPage;
+
     @Rule
     public AssertEvents events = new AssertEvents(this);
 
@@ -98,7 +105,7 @@ public void verifyEmailWithSslEnabled(Boolean opportunistic) {
             SslMailServer.startWithSsl(privateKey);
         }
 
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(user.getUsername(), "password");
 
         EventRepresentation sendEvent = events.expectRequiredAction(EventType.SEND_VERIFY_EMAIL)
@@ -139,22 +146,17 @@ public void verifyEmailWithSslEnabled(Boolean opportunistic) {
 
         assertCurrentUrlStartsWith(OAuthClient.APP_AUTH_ROOT);
         AccountHelper.logout(testRealm(), user.getUsername());
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         testRealmLoginPage.form().login(user.getUsername(), "password");
         assertCurrentUrlStartsWith(OAuthClient.APP_AUTH_ROOT);
     }
 
     @Test
-    public void verifyEmailWithSslEnabled() {
-        verifyEmailWithSslEnabled(false);
-    }
-
-    @Test
-    public void verifyEmailWithSslWrongCertificate() throws Exception {
+    public void test01VerifyEmailWithSslWrongCertificate() throws Exception {
         UserRepresentation user = ApiUtil.findUserByUsername(testRealm(), "test-user@localhost");
 
         SslMailServer.startWithSsl(this.getClass().getClassLoader().getResource(SslMailServer.INVALID_KEY).getFile());
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().login(user.getUsername(), "password");
 
         events.expectRequiredAction(EventType.SEND_VERIFY_EMAIL_ERROR)
@@ -169,20 +171,30 @@ public void verifyEmailWithSslWrongCertificate() throws Exception {
         // Email wasn't send
         Assert.assertNull(SslMailServer.getLastReceivedMessage());
 
-        // Email wasn't send, but we won't notify end user about that. Admin is aware due to the error in the logs and the SEND_VERIFY_EMAIL_ERROR event.
-        assertEquals("You need to verify your email address to activate your account.",
-                testRealmVerifyEmailPage.feedbackMessage().getText());
+        // Email wasn't sent, and we notify end user about that.
+        assertEquals("Failed to send email, please try again later.",
+                errorPage.getError());
     }
 
     @Test
-    public void verifyEmailWithSslWrongHostname() throws Exception {
+    public void test02VerifyEmailWithSslWrongCertificateAndAnyHostnamePolicy() throws Exception {
+        testingClient.testing().modifyTruststoreSpiHostnamePolicy(HostnameVerificationPolicy.ANY);
+        try {
+            test01VerifyEmailWithSslWrongCertificate();
+        } finally {
+            testingClient.testing().reenableTruststoreSpi();
+        }
+    }
+
+    @Test
+    public void test03erifyEmailWithSslWrongHostname() throws Exception {
         UserRepresentation user = ApiUtil.findUserByUsername(testRealm(), "test-user@localhost");
 
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm())
                 .setSmtpServer("host", "localhost.localdomain")
                 .update()) {
             SslMailServer.startWithSsl(this.getClass().getClassLoader().getResource(SslMailServer.PRIVATE_KEY).getFile());
-            driver.navigate().to(oauth.getLoginFormUrl());
+            oauth.openLoginForm();
             loginPage.form().login(user.getUsername(), "password");
 
             events.expectRequiredAction(EventType.SEND_VERIFY_EMAIL_ERROR)
@@ -197,26 +209,31 @@ public void verifyEmailWithSslWrongHostname() throws Exception {
             // Email wasn't send
             Assert.assertNull(SslMailServer.getLastReceivedMessage());
 
-            // Email wasn't send, but we won't notify end user about that. Admin is aware due to the error in the logs and the SEND_VERIFY_EMAIL_ERROR event.
-            assertEquals("You need to verify your email address to activate your account.",
-                    testRealmVerifyEmailPage.feedbackMessage().getText());
+            // Email wasn't sent, and we notify end user about that.
+            assertEquals("Failed to send email, please try again later.",
+                    errorPage.getError());
         }
     }
 
     @Test
-    public void verifyEmailWithSslWrongHostnameButAnyHostnamePolicy() throws Exception {
+    public void test04VerifyEmailWithSslEnabled() {
+        verifyEmailWithSslEnabled(false);
+    }
+
+    @Test
+    public void test05VerifyEmailWithSslWrongHostnameButAnyHostnamePolicy() throws Exception {
         testingClient.testing().modifyTruststoreSpiHostnamePolicy(HostnameVerificationPolicy.ANY);
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm())
                 .setSmtpServer("host", "localhost.localdomain")
                 .update()) {
-            verifyEmailWithSslEnabled();
+            test04VerifyEmailWithSslEnabled();
         } finally {
             testingClient.testing().reenableTruststoreSpi();
         }
     }
 
     @Test
-    public void verifyEmailOpportunisticEncryptionWithAnyHostnamePolicy() throws Exception {
+    public void test06VerifyEmailOpportunisticEncryptionWithAnyHostnamePolicy() throws Exception {
         testingClient.testing().modifyTruststoreSpiHostnamePolicy(HostnameVerificationPolicy.ANY);
         try (RealmAttributeUpdater updater = new RealmAttributeUpdater(testRealm())
                 .setSmtpServer("host", "localhost.localdomain")
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java
index 90728de94af1..e6df6a44489b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java
@@ -5,12 +5,18 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.util.EntityUtils;
+import org.hamcrest.CoreMatchers;
+import org.hamcrest.MatcherAssert;
 import org.junit.Assert;
 import org.junit.Test;
+import org.keycloak.common.Profile;
 import org.keycloak.common.Version;
 import org.keycloak.platform.Platform;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeatures;
 import org.keycloak.theme.Theme;
 
 import java.io.File;
@@ -19,6 +25,8 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
 import java.util.Locale;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.zip.GZIPInputStream;
 
 import static org.junit.Assert.assertEquals;
@@ -134,6 +142,64 @@ public void notFoundOnInvalidThemeType() throws IOException {
         assertNotFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + resourcesVersion + "/invalid-theme-type/keycloak/css/welcome.css");
     }
 
+    @Test
+    @EnableFeatures(@EnableFeature(Profile.Feature.ROLLING_UPDATES_V2))
+    public void fetchStaticResourceShouldRedirectOnUnknownVersion() throws IOException {
+        final String resourcesVersion = testingClient.server().fetch(session -> Version.RESOURCES_VERSION, String.class);
+        assertFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + resourcesVersion + "/login/keycloak.v2/css/styles.css");
+        assertFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + resourcesVersion + "/login/keycloak.v2/css%2Fstyles.css");
+        assertNotFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + "unkno" + "/login/keycloak.v2/css%2Fstyles.css");
+        assertNotFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + "unkn%2F" + "/login/keycloak.v2/css/styles.css");
+        // This on check will fail on Quarkus as Quarkus will normalize the URL before handing it to the REST endpoint
+        // It will succeed on Undertow
+        // assertNotFound(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + "unkno" + "/login/keycloak.v2/css/../css/styles.css");
+        assertRedirectAndValidateRedirect(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + "unkno" + "/login/keycloak.v2/css/styles.css?name=%2Fvalue",
+                suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/resources/" + resourcesVersion + "/login/keycloak.v2/css/styles.css?name=%2Fvalue");
+    }
+
+
+    @Test
+    @EnableFeatures(@EnableFeature(Profile.Feature.ROLLING_UPDATES_V2))
+    public void fetchResourceWithContentHashShouldReturnContentIfVersionIsUnknown() throws IOException {
+        final String resourcesVersion = testingClient.server().fetch(session -> Version.RESOURCES_VERSION, String.class);
+
+        String resource = getResourceWithContentHash();
+
+        // The original resource should be accessible.
+        assertNoRedirect(suiteContext.getAuthServerInfo().getContextRoot().toString() + resource);
+
+        // The unknown resource should be accessible without a redirect.
+        assertNoRedirect(suiteContext.getAuthServerInfo().getContextRoot().toString() + resource.replaceAll(Pattern.quote(resourcesVersion), "unkno"));
+    }
+
+    @Test
+    @EnableFeatures(@EnableFeature(Profile.Feature.ROLLING_UPDATES_V2))
+    public void fetchResourceWithContentHashShouldHonorEtag() throws IOException {
+        String resource = getResourceWithContentHash();
+
+        // The first fetch should return an etag
+        String etag = fetchEtag(suiteContext.getAuthServerInfo().getContextRoot().toString() + resource);
+
+        // The second fetch with the etag should return not modified
+        assertEtagHonored(suiteContext.getAuthServerInfo().getContextRoot().toString() + resource, etag);
+    }
+
+    private String getResourceWithContentHash() throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
+            HttpGet get = new HttpGet(suiteContext.getAuthServerInfo().getContextRoot().toString() + "/auth/admin/" + TEST_REALM_NAME + "/console/");
+            try (CloseableHttpResponse response = httpClient.execute(get)) {
+                assertEquals(200, response.getStatusLine().getStatusCode());
+                String body = EntityUtils.toString(response.getEntity());
+                Matcher matcher = Pattern.compile("<link rel=\"stylesheet\" href=\"([^\"]*)\">").matcher(body);
+                if (matcher.find()) {
+                    return matcher.group(1);
+                } else {
+                    throw new AssertionError("unable to find resource in body");
+                }
+            }
+        }
+    }
+
     private void assertNotFound(String url) throws IOException {
         try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
             HttpGet get = new HttpGet(url);
@@ -143,6 +209,61 @@ private void assertNotFound(String url) throws IOException {
         }
     }
 
+    private void assertFound(String url) throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
+            HttpGet get = new HttpGet(url);
+            CloseableHttpResponse response = httpClient.execute(get);
+
+            MatcherAssert.assertThat(response.getStatusLine().getStatusCode(), CoreMatchers.equalTo(200));
+        }
+    }
+
+    private String fetchEtag(String url) throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
+            HttpGet get = new HttpGet(url);
+            CloseableHttpResponse response = httpClient.execute(get);
+
+            MatcherAssert.assertThat(response.getStatusLine().getStatusCode(), CoreMatchers.equalTo(200));
+
+            return response.getFirstHeader("ETag").getValue();
+        }
+    }
+
+    private void assertRedirectAndValidateRedirect(String url, String redirect) throws IOException {
+        assertRedirect(url, redirect);
+        assertFound(url);
+    }
+
+    private void assertRedirect(String url, String redirect) throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().disableRedirectHandling().build()) {
+            HttpGet get = new HttpGet(url);
+            CloseableHttpResponse response = httpClient.execute(get);
+
+            MatcherAssert.assertThat(response.getStatusLine().getStatusCode(), CoreMatchers.equalTo(307));
+            MatcherAssert.assertThat(response.getFirstHeader("Location").getValue(), CoreMatchers.equalTo(redirect));
+        }
+    }
+
+    private void assertEtagHonored(String url, String etag) throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().disableRedirectHandling().build()) {
+            HttpGet get = new HttpGet(url);
+            get.addHeader("If-None-Match", etag);
+
+            CloseableHttpResponse response = httpClient.execute(get);
+
+            MatcherAssert.assertThat(response.getStatusLine().getStatusCode(), CoreMatchers.equalTo(304));
+        }
+    }
+
+    private void assertNoRedirect(String url) throws IOException {
+        try (CloseableHttpClient httpClient = HttpClientBuilder.create().disableRedirectHandling().build()) {
+            HttpGet get = new HttpGet(url);
+            CloseableHttpResponse response = httpClient.execute(get);
+
+            MatcherAssert.assertThat(response.getStatusLine().getStatusCode(), CoreMatchers.equalTo(200));
+        }
+    }
+
     private void assertEncoded(String url, String expectedContent) throws IOException {
         try (CloseableHttpClient httpClient = HttpClientBuilder.create().disableContentCompression().build()) {
             HttpGet get = new HttpGet(url);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/tracing/OTelTracingProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/tracing/OTelTracingProviderTest.java
index 2cc0681e6f09..bcea6018e219 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/tracing/OTelTracingProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/tracing/OTelTracingProviderTest.java
@@ -24,7 +24,7 @@
 import io.opentelemetry.api.trace.TraceFlags;
 import io.opentelemetry.sdk.trace.ReadableSpan;
 import io.opentelemetry.sdk.trace.data.StatusData;
-import io.opentelemetry.sdk.trace.internal.data.ExceptionEventData;
+import io.opentelemetry.sdk.trace.data.ExceptionEventData;
 import io.opentelemetry.semconv.ExceptionAttributes;
 import org.jboss.arquillian.container.test.api.ContainerController;
 import org.jboss.arquillian.test.api.ArquillianResource;
@@ -43,7 +43,6 @@
 import java.util.List;
 
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.emptyOrNullString;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
@@ -110,8 +109,9 @@ public void parentSpan() {
 
             assertThat(current instanceof ReadableSpan, is(true));
             ReadableSpan readableSpan = (ReadableSpan) current;
-            assertThat(readableSpan.getAttribute(AttributeKey.stringKey("server.address")), is("localhost"));
-            assertThat(readableSpan.getAttribute(AttributeKey.stringKey("url.path")), containsString("run-on-server"));
+            assertThat(readableSpan.getAttribute(AttributeKey.stringKey("code.function")), is("runOnServer"));
+            assertThat(readableSpan.getAttribute(AttributeKey.stringKey("code.namespace")), is("org.keycloak.testsuite.rest.TestingResourceProvider"));
+            assertThat(readableSpan.getName(), is("TestingResourceProvider.runOnServer"));
         });
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/HostnameV2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/HostnameV2Test.java
index aa0c8f9f2c90..5acad06d189b 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/HostnameV2Test.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/url/HostnameV2Test.java
@@ -41,7 +41,7 @@
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertEquals;
-import static org.keycloak.testsuite.util.OAuthClient.AUTH_SERVER_ROOT;
+import static org.keycloak.testsuite.util.oauth.OAuthClient.AUTH_SERVER_ROOT;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_PORT;
 import static org.keycloak.testsuite.util.ServerURLs.AUTH_SERVER_SCHEME;
 
@@ -149,7 +149,7 @@ public void testAdminLocal() throws Exception {
                 SimpleHttp get = SimpleHttpDefault.doGet(getDynamicBaseUrl("127.0.0.1.nip.io"), client).header("X-Forwarded-For", "127.0.0.1");
 
                 String welcomePage = get.asString();
-                assertThat(welcomePage, containsString("<a href=\"" + getDynamicBaseUrl("localhost") + "/\">"));
+                assertThat(welcomePage, containsString("localhost"));
             }
         }
         finally {
@@ -207,7 +207,7 @@ private String getDynamicBaseUrl(String hostname) {
     }
 
     private void testFrontendAndBackendUrls(String realm, String expectedFrontendUrl, String expectedBackendUrl) {
-        OIDCConfigurationRepresentation config = oauth.doWellKnownRequest(realm);
+        OIDCConfigurationRepresentation config = oauth.realm(realm).doWellKnownRequest();
         assertEquals(expectedFrontendUrl + "/realms/" + realm, config.getIssuer());
         assertEquals(expectedFrontendUrl + "/realms/" + realm + "/protocol/openid-connect/auth", config.getAuthorizationEndpoint());
         assertEquals(expectedBackendUrl + "/realms/" + realm + "/protocol/openid-connect/token", config.getTokenEndpoint());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UIRealmResourceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UIRealmResourceTest.java
index 81970072e8e3..23a174c13895 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UIRealmResourceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UIRealmResourceTest.java
@@ -223,7 +223,7 @@ public void testRegistrationFormWithNotReadableOrWritableRequiredEmail() throws
         updateRealmExt(toUIRealmRepresentation(testRealm, upConfig));
 
         // open the registration form
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().register();
         registerPage.assertCurrent();
 
@@ -232,7 +232,7 @@ public void testRegistrationFormWithNotReadableOrWritableRequiredEmail() throws
         registerPage.registerWithEmailAsUsername("Tom", "Brady", "tbrady@email.com", "password", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         String userId = events.expectRegister("tbrady@email.com", "tbrady@email.com").assertEvent().getUserId();
         UserRepresentation user = testRealm().users().get(userId).toRepresentation();
@@ -253,7 +253,7 @@ public void testRegistrationFormWithReadonlyUsernameAndEmail() throws IOExceptio
         updateRealmExt(toUIRealmRepresentation(testRealm, upConfig));
 
         // open the registration form
-        driver.navigate().to(oauth.getLoginFormUrl());
+        oauth.openLoginForm();
         loginPage.form().register();
         registerPage.assertCurrent();
 
@@ -263,7 +263,7 @@ public void testRegistrationFormWithReadonlyUsernameAndEmail() throws IOExceptio
         registerPage.register("Alice", "Wood",  null, "awood", "password", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         String userId = events.expectRegister("awood", null).removeDetail("email").assertEvent().getUserId();
         UserRepresentation user = testRealm().users().get(userId).toRepresentation();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UserProfileTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UserProfileTest.java
index 3e6d6a8aab50..38b5a0acb396 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/user/profile/UserProfileTest.java
@@ -19,8 +19,10 @@
 
 package org.keycloak.testsuite.user.profile;
 
+import static java.util.Optional.ofNullable;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -47,7 +49,6 @@
 import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.admin.client.resource.RealmResource;
-import org.keycloak.common.Profile.Feature;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.component.ComponentValidationException;
@@ -56,6 +57,7 @@
 import org.keycloak.models.LDAPConstants;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.representations.idm.AbstractUserRepresentation;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
@@ -63,7 +65,6 @@
 import org.keycloak.representations.userprofile.config.UPConfig.UnmanagedAttributePolicy;
 import org.keycloak.representations.userprofile.config.UPGroup;
 import org.keycloak.services.messages.Messages;
-import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
 import org.keycloak.testsuite.arquillian.annotation.ModelTest;
 import org.keycloak.testsuite.runonserver.RunOnServer;
 import org.keycloak.userprofile.AttributeGroupMetadata;
@@ -2225,10 +2226,14 @@ private static void testAttributeNormalization(KeycloakSession session) {
         assertEquals(attributes.get(UserModel.EMAIL).toLowerCase(), profileAttributes.getFirst(UserModel.EMAIL));
     }
 
-    @EnableFeature(Feature.UPDATE_EMAIL)
     @Test
     public void testEmailAttributeInUpdateEmailContext() {
-        getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) UserProfileTest::testEmailAttributeInUpdateEmailContext);
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
+        try {
+            getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) UserProfileTest::testEmailAttributeInUpdateEmailContext);
+        } finally {
+            ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, false);
+        }
     }
 
     private static void testEmailAttributeInUpdateEmailContext(KeycloakSession session) {
@@ -2311,6 +2316,81 @@ private static void testEmailAttributeInUpdateEmailContext(KeycloakSession sessi
         }
     }
 
+    @Test
+    public void testEmailAnnotationsInAccountContext() {
+        ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, true);
+        try {
+            getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) UserProfileTest::testEmailAnnotationsInAccountContext);
+        } finally {
+            ApiUtil.enableRequiredAction(testRealm(), RequiredAction.UPDATE_EMAIL, false);
+        }
+    }
+
+    private static void testEmailAnnotationsInAccountContext(KeycloakSession session) {
+        UserProfileProvider provider = getUserProfileProvider(session);
+        String userName = org.keycloak.models.utils.KeycloakModelUtils.generateId();
+        Map<String, String> attributes = new HashMap<>();
+
+        attributes.put(UserModel.USERNAME, userName);
+        String originalEmail = userName + "@keycloak.org";
+        attributes.put(UserModel.EMAIL, originalEmail);
+        attributes.put(UserModel.FIRST_NAME, "Joe");
+        attributes.put(UserModel.LAST_NAME, "Doe");
+        attributes.put("address", "some address");
+
+        UserProfile profile = provider.create(UserProfileContext.USER_API, attributes);
+        UserModel user = profile.create();
+        RealmModel realm = session.getContext().getRealm();
+
+        try {
+            realm.setEditUsernameAllowed(false);
+            realm.setRegistrationEmailAsUsername(true);
+            profile = provider.create(UserProfileContext.ACCOUNT, attributes, user);
+            assertFalse(ofNullable(profile.getAttributes().getAnnotations(UserModel.EMAIL)).orElse(Map.of()).containsKey("kc.required.action.supported"));
+        } finally {
+            realm.setEditUsernameAllowed(true);
+            realm.setRegistrationEmailAsUsername(false);
+        }
+
+        try {
+            realm.setEditUsernameAllowed(true);
+            realm.setRegistrationEmailAsUsername(true);
+            profile = provider.create(UserProfileContext.ACCOUNT, attributes, user);
+            assertThat(ofNullable(profile.getAttributes().getAnnotations(UserModel.EMAIL)).orElse(Map.of()).get("kc.required.action.supported"), is(true));
+        } finally {
+            realm.setEditUsernameAllowed(true);
+            realm.setRegistrationEmailAsUsername(false);
+        }
+
+        try {
+            realm.setEditUsernameAllowed(false);
+            realm.setRegistrationEmailAsUsername(false);
+            UPConfig upConfig = provider.getConfiguration();
+            UPAttribute attribute = upConfig.getAttribute(UserModel.EMAIL);
+            attribute.setPermissions(new UPAttributePermissions(Set.of(ROLE_USER), Set.of(ROLE_ADMIN)));
+            provider.setConfiguration(upConfig);
+            profile = provider.create(UserProfileContext.ACCOUNT, attributes, user);
+            assertFalse(ofNullable(profile.getAttributes().getAnnotations(UserModel.EMAIL)).orElse(Map.of()).containsKey("kc.required.action.supported"));
+        } finally {
+            realm.setEditUsernameAllowed(true);
+            realm.setRegistrationEmailAsUsername(false);
+        }
+
+        try {
+            realm.setEditUsernameAllowed(false);
+            realm.setRegistrationEmailAsUsername(false);
+            UPConfig upConfig = provider.getConfiguration();
+            UPAttribute attribute = upConfig.getAttribute(UserModel.EMAIL);
+            attribute.setPermissions(new UPAttributePermissions(Set.of(ROLE_USER), Set.of(ROLE_ADMIN, ROLE_USER)));
+            provider.setConfiguration(upConfig);
+            profile = provider.create(UserProfileContext.ACCOUNT, attributes, user);
+            assertThat(ofNullable(profile.getAttributes().getAnnotations(UserModel.EMAIL)).orElse(Map.of()).get("kc.required.action.supported"), is(true));
+        } finally {
+            realm.setEditUsernameAllowed(true);
+            realm.setRegistrationEmailAsUsername(false);
+        }
+    }
+
     @Test
     public void testMultivalued() {
         getTestingClient().server(TEST_REALM_NAME).run((RunOnServer) UserProfileTest::testMultivalued);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientPoliciesUtil.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientPoliciesUtil.java
index d487f456c714..8701a836c3e7 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientPoliciesUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientPoliciesUtil.java
@@ -34,6 +34,7 @@
 import org.keycloak.jose.jwk.JWK;
 import org.keycloak.jose.jwk.RSAPublicJWK;
 import org.keycloak.jose.jws.JWSHeader;
+import org.keycloak.jose.jws.crypto.HashUtils;
 import org.keycloak.models.utils.MapperTypeSerializer;
 import org.keycloak.protocol.oidc.grants.ciba.clientpolicy.executor.SecureCibaAuthenticationRequestSigningAlgorithmExecutor;
 import org.keycloak.representations.dpop.DPoP;
@@ -54,6 +55,7 @@
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceGroupsCondition;
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceHostsCondition;
 import org.keycloak.services.clientpolicy.condition.ClientUpdaterSourceRolesCondition;
+import org.keycloak.services.clientpolicy.condition.GrantTypeCondition;
 import org.keycloak.services.clientpolicy.executor.ConsentRequiredExecutor;
 import org.keycloak.services.clientpolicy.executor.DPoPBindEnforcerExecutor;
 import org.keycloak.services.clientpolicy.executor.FullScopeDisabledExecutor;
@@ -68,6 +70,7 @@
 import org.keycloak.services.clientpolicy.executor.SecureResponseTypeExecutor;
 import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmExecutor;
 import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmForSignedJwtExecutor;
+import org.keycloak.services.util.DPoPUtil;
 import org.keycloak.testsuite.services.clientpolicy.condition.TestRaiseExceptionCondition;
 import org.keycloak.testsuite.services.clientpolicy.executor.TestRaiseExceptionExecutor;
 import org.keycloak.util.JsonSerialization;
@@ -85,7 +88,6 @@
 import java.security.spec.ECGenParameterSpec;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
 import java.util.function.Consumer;
 
 import static org.junit.Assert.fail;
@@ -444,6 +446,12 @@ public static ClientUpdaterSourceRolesCondition.Configuration createClientUpdate
         return config;
     }
 
+    public static GrantTypeCondition.Configuration createGrantTypeConditionConfig(List<String> grantTypes) {
+        GrantTypeCondition.Configuration config = new GrantTypeCondition.Configuration();
+        config.setGrantTypes(grantTypes);
+        return config;
+    }
+
     // DPoP
     public static  JWK createRsaJwk(Key publicKey) {
         RSAPublicKey rsaKey = (RSAPublicKey) publicKey;
@@ -478,7 +486,7 @@ public static KeyPair generateEcdsaKey(String ecDomainParamName) throws NoSuchAl
         return keyPair;
     }
 
-    public static String generateSignedDPoPProof(String jti, String htm, String htu, Long iat, String algorithm, JWSHeader jwsHeader, PrivateKey privateKey) throws IOException {
+    public static String generateSignedDPoPProof(String jti, String htm, String htu, Long iat, String algorithm, JWSHeader jwsHeader, PrivateKey privateKey, String accessToken) throws IOException {
 
         String dpopProofHeaderEncoded = Base64Url.encode(JsonSerialization.writeValueAsBytes(jwsHeader));
 
@@ -487,6 +495,9 @@ public static String generateSignedDPoPProof(String jti, String htm, String htu,
         dpop.setHttpMethod(htm);
         dpop.setHttpUri(htu);
         dpop.iat(iat);
+        if (accessToken != null) {
+            dpop.setAccessTokenHash(HashUtils.accessTokenHash(DPoPUtil.DPOP_ATH_ALG, accessToken, true));
+        }
 
         String dpopProofPayloadEncoded = Base64Url.encode(JsonSerialization.writeValueAsBytes(dpop));
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowUtil.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowUtil.java
index 7fd1db1ca6bf..19b594cd95c8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowUtil.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowUtil.java
@@ -12,6 +12,7 @@
 
 import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Random;
@@ -19,6 +20,7 @@
 import java.util.function.Consumer;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static org.keycloak.models.utils.DefaultAuthenticationFlows.BROWSER_FLOW;
 import static org.keycloak.models.utils.DefaultAuthenticationFlows.DIRECT_GRANT_FLOW;
@@ -329,4 +331,46 @@ private void checkAndRestoreDefaultFlow(Supplier<AuthenticationFlowModel> getFlo
             setFlow.accept(realm.getFlowByAlias(defaultFlowAlias));
         }
     }
+
+    /**
+     * <p>Sets the given {@code key} and {@code value} to an execution that maps to the given {@code authenticatorId}.
+     *
+     * <p>This method will try to find the given {@code authenticatorId} recursively by going through all the subflows, if there are any.
+     *
+     * @param session the session
+     * @param flowId the parent flow
+     * @param authenticatorId the authenticator id
+     * @param key the key
+     * @param value the value
+     */
+    public static void setAuthenticatorConfig(KeycloakSession session, String flowId, String authenticatorId, String key, String value) {
+        RealmModel realm = session.getContext().getRealm();
+
+        for (AuthenticationExecutionModel execution : Optional.ofNullable(realm.getAuthenticationExecutionsStream(flowId)).orElse(Stream.empty()).toList()) {
+            if (execution.isAuthenticatorFlow()) {
+                setAuthenticatorConfig(session, execution.getFlowId(), authenticatorId, key, value);
+            } else if (authenticatorId.equals(execution.getAuthenticator())) {
+                AuthenticatorConfigModel configModel;
+                String configId = execution.getAuthenticatorConfig();
+
+                if (configId == null) {
+                    configModel = new AuthenticatorConfigModel();
+                    configModel.setAlias(authenticatorId + flowId);
+                    configModel = realm.addAuthenticatorConfig(configModel);
+                    execution.setAuthenticatorConfig(configModel.getId());
+                    realm.updateAuthenticatorExecution(execution);
+                } else {
+                    configModel = realm.getAuthenticatorConfigById(configId);
+                }
+
+                Map<String, String> config = new HashMap<>(configModel.getConfig());
+
+                configModel.setConfig(config);
+                config.put(key, value);
+                configModel.setConfig(config);
+
+                realm.updateAuthenticatorConfig(configModel);
+            }
+        }
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/InfinispanTestTimeServiceRule.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/InfinispanTestTimeServiceRule.java
index 14122dd286df..850548e90e42 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/InfinispanTestTimeServiceRule.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/InfinispanTestTimeServiceRule.java
@@ -18,15 +18,9 @@
 
 package org.keycloak.testsuite.util;
 
-import java.util.concurrent.atomic.AtomicInteger;
-
 import org.jboss.logging.Logger;
 import org.junit.rules.ExternalResource;
 import org.keycloak.testsuite.AbstractKeycloakTest;
-import org.keycloak.testsuite.arquillian.ContainerInfo;
-import org.keycloak.testsuite.arquillian.CrossDCTestEnricher;
-
-import static org.keycloak.testsuite.arquillian.CrossDCTestEnricher.forAllBackendNodesStream;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -43,37 +37,11 @@ public InfinispanTestTimeServiceRule(AbstractKeycloakTest test) {
 
     @Override
     protected void before() throws Throwable {
-        if (!this.test.getTestContext().getSuiteContext().isAuthServerCrossDc()) {
-            // No cross-dc environment
-            test.getTestingClient().testing().setTestingInfinispanTimeService();
-        } else {
-            AtomicInteger count = new AtomicInteger(0);
-            // Cross-dc environment - Set on all started nodes
-            forAllBackendNodesStream()
-                    .filter(ContainerInfo::isStarted)
-                    .map(CrossDCTestEnricher.getBackendTestingClients()::get)
-                    .forEach(testingClient -> {
-                        testingClient.testing().setTestingInfinispanTimeService();
-                        count.incrementAndGet();
-                    });
-
-            //
-            log.infof("Totally set infinispanTimeService rule in %d servers", count.get());
-        }
+        test.getTestingClient().testing().setTestingInfinispanTimeService();
     }
 
     @Override
     protected void after() {
-        if (!this.test.getTestContext().getSuiteContext().isAuthServerCrossDc()) {
-            // No cross-dc environment
-            test.getTestingClient().testing().revertTestingInfinispanTimeService();
-        } else {
-            // Cross-dc environment - Revert on all started nodes
-            forAllBackendNodesStream()
-                    .filter(ContainerInfo::isStarted)
-                    .map(CrossDCTestEnricher.getBackendTestingClients()::get)
-                    .forEach(testingClient -> testingClient.testing().revertTestingInfinispanTimeService());
-
-        }
+        test.getTestingClient().testing().revertTestingInfinispanTimeService();
     }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/TestAppHelper.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/TestAppHelper.java
index 5ab024fb0959..c8d3949ecc05 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/TestAppHelper.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/TestAppHelper.java
@@ -23,6 +23,10 @@
 import org.keycloak.testsuite.pages.LoginTotpPage;
 
 import jakarta.ws.rs.core.Response;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.LogoutResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+
 import java.io.IOException;
 
 public class TestAppHelper {
@@ -64,8 +68,8 @@ public boolean startLogin(String username, String password) {
     }
 
     public void completeLogin() {
-        String code = oauth.getCurrentQuery().get(OAuth2Constants.CODE);
-        OAuthClient.AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code, "password");
+        String code = oauth.parseLoginResponse().getCode();
+        AccessTokenResponse tokenResponse = oauth.doAccessTokenRequest(code);
         refreshToken = tokenResponse.getRefreshToken();
     }
 
@@ -98,9 +102,9 @@ public boolean login(String username, String password, String realm, String clie
     }
 
     public boolean logout() {
-        try (CloseableHttpResponse response = oauth.doLogout(refreshToken, "password")) {
-            return response.getStatusLine().getStatusCode() == Response.Status.NO_CONTENT.getStatusCode();
-        } catch (IOException e) {
+        try {
+            return oauth.doLogout(refreshToken).isSuccess();
+        } catch (RuntimeException e) {
             return false;
         }
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/URLAssert.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/URLAssert.java
index f3963597f55f..4e1b373d86e8 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/URLAssert.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/URLAssert.java
@@ -139,32 +139,6 @@ public static void assertCurrentUrlStartsWithLoginUrlOf(final String url) {
     }
 
 
-    public static void assertGetURL(URI url, String accessToken, AssertResponseHandler handler) {
-        CloseableHttpClient httpclient = HttpClients.createDefault();
-        try {
-            HttpGet get = new HttpGet(url);
-            get.setHeader("Authorization", "Bearer " + accessToken);
-
-            CloseableHttpResponse response = httpclient.execute(get);
-
-            if (response.getStatusLine().getStatusCode() != 200) {
-                throw new RuntimeException("Response status error: " + response.getStatusLine().getStatusCode() + ": " + url);
-            }
-
-            handler.assertResponse(response);
-
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-        finally {
-            try {
-                httpclient.close();
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-    }
-
     public interface AssertResponseHandler {
         void assertResponse(CloseableHttpResponse response) throws IOException;
     }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AbstractWebAuthnVirtualTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AbstractWebAuthnVirtualTest.java
index ea1ed8630489..1db6893c82bb 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AbstractWebAuthnVirtualTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AbstractWebAuthnVirtualTest.java
@@ -27,17 +27,19 @@
 import org.keycloak.authentication.requiredactions.WebAuthnPasswordlessRegisterFactory;
 import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
 import org.keycloak.common.util.SecretGenerator;
+import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
 import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.testsuite.AbstractTestRealmKeycloakTest;
+import org.keycloak.testsuite.AbstractChangeImportedUserPasswordsTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.AbstractAdminTest;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.pages.ErrorPage;
 import org.keycloak.testsuite.pages.InfoPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LogoutConfirmPage;
@@ -53,6 +55,7 @@
 import org.keycloak.testsuite.webauthn.updaters.AbstractWebAuthnRealmUpdater;
 import org.keycloak.testsuite.webauthn.updaters.PasswordLessRealmAttributeUpdater;
 import org.keycloak.testsuite.webauthn.updaters.WebAuthnRealmAttributeUpdater;
+import org.keycloak.testsuite.webauthn.utils.WebAuthnRealmData;
 import org.openqa.selenium.WebDriver;
 import org.openqa.selenium.chrome.ChromeDriver;
 import org.openqa.selenium.firefox.FirefoxDriver;
@@ -81,7 +84,7 @@
  *
  * @author <a href="mailto:mabartos@redhat.com">Martin Bartos</a>
  */
-public abstract class AbstractWebAuthnVirtualTest extends AbstractTestRealmKeycloakTest implements UseVirtualAuthenticators {
+public abstract class AbstractWebAuthnVirtualTest extends AbstractChangeImportedUserPasswordsTest implements UseVirtualAuthenticators {
 
     @Rule
     public AssertEvents events = new AssertEvents(this);
@@ -89,6 +92,9 @@ public abstract class AbstractWebAuthnVirtualTest extends AbstractTestRealmKeycl
     @Page
     protected LoginPage loginPage;
 
+    @Page
+    protected ErrorPage errorPage;
+
     @Page
     protected RegisterPage registerPage;
 
@@ -113,7 +119,6 @@ public abstract class AbstractWebAuthnVirtualTest extends AbstractTestRealmKeycl
     protected static final String ALL_ZERO_AAGUID = "00000000-0000-0000-0000-000000000000";
     protected static final String ALL_ONE_AAGUID = "11111111-1111-1111-1111-111111111111";
     protected static final String USERNAME = "UserWebAuthn";
-    protected static final String PASSWORD = "password";
     protected static final String EMAIL = "UserWebAuthn@email";
 
     protected final static String base64EncodedPK =
@@ -153,10 +158,7 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         }
 
         testRealms.add(realmRepresentation);
-    }
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
+        configureTestRealm(realmRepresentation);
     }
 
     @Override
@@ -223,7 +225,7 @@ protected void registerDefaultUser(String authenticatorLabel) {
     }
 
     private void registerDefaultUser(String authenticatorLabel, boolean shouldSuccess) {
-        registerUser(USERNAME, PASSWORD, EMAIL, authenticatorLabel, shouldSuccess);
+        registerUser(USERNAME, generatePassword(USERNAME), EMAIL, authenticatorLabel, shouldSuccess);
     }
 
     protected void registerUser(String username, String password, String email, String authenticatorLabel, boolean shouldSuccess) {
@@ -291,7 +293,7 @@ protected void authenticateDefaultUser() {
     }
 
     protected void authenticateDefaultUser(boolean shouldSuccess) {
-        authenticateUser(USERNAME, PASSWORD, shouldSuccess);
+        authenticateUser(USERNAME, getPassword(USERNAME), shouldSuccess);
     }
 
     protected void authenticateUser(String username, String password, boolean shouldSuccess) {
@@ -353,6 +355,37 @@ protected static void makePasswordlessRequiredActionDefault(RealmRepresentation
         webAuthnPasswordlessProvider.setDefaultAction(true);
     }
 
+    /**
+     * Changes the flow "browser-webauthn-forms" to use the passed authenticator as required.
+     * @param realm The realm representation
+     * @param providerId The provider Id to set as required
+     */
+    protected void switchExecutionInBrowserFormToProvider(RealmRepresentation realm, String providerId) {
+        List<AuthenticationFlowRepresentation> flows = realm.getAuthenticationFlows();
+        assertThat(flows, notNullValue());
+
+        AuthenticationFlowRepresentation browserForm = flows.stream()
+                .filter(f -> f.getAlias().equals("browser-webauthn-forms"))
+                .findFirst()
+                .orElse(null);
+        assertThat("Cannot find 'browser-webauthn-forms' flow", browserForm, notNullValue());
+
+        flows.removeIf(f -> f.getAlias().equals(browserForm.getAlias()));
+
+        // set just one authenticator with the passkeys conditional UI
+        AuthenticationExecutionExportRepresentation passkeysConditionalUI = new AuthenticationExecutionExportRepresentation();
+        passkeysConditionalUI.setAuthenticator(providerId);
+        passkeysConditionalUI.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.name());
+        passkeysConditionalUI.setPriority(10);
+        passkeysConditionalUI.setAuthenticatorFlow(false);
+        passkeysConditionalUI.setUserSetupAllowed(false);
+
+        browserForm.setAuthenticationExecutions(List.of(passkeysConditionalUI));
+        flows.add(browserForm);
+
+        realm.setAuthenticationFlows(flows);
+    }
+
     // Switch WebAuthn authenticator with Passwordless authenticator in browser flow
     protected void switchExecutionInBrowserFormToPasswordless(RealmRepresentation realm) {
         List<AuthenticationFlowRepresentation> flows = realm.getAuthenticationFlows();
@@ -387,8 +420,7 @@ protected void switchExecutionInBrowserFormToPasswordless(RealmRepresentation re
     protected void logout() {
         try {
             waitForPageToLoad();
-            String logoutUrl = oauth.getLogoutUrl().build();
-            driver.navigate().to(logoutUrl);
+            oauth.openLogoutForm();
             logoutConfirmPage.assertCurrent();
             logoutConfirmPage.confirmLogout();
             infoPage.assertCurrent();
@@ -417,4 +449,12 @@ protected String getExpectedMessageByDriver(String firefoxMessage, String chrome
 
         return getExpectedMessageByDriver(map);
     }
+
+    protected void checkWebAuthnConfiguration(String residentKey, String userVerification) {
+        WebAuthnRealmData realmData = new WebAuthnRealmData(testRealm().toRepresentation(), isPasswordless());
+        assertThat(realmData, notNullValue());
+        assertThat(realmData.getRpEntityName(), is("localhost"));
+        assertThat(realmData.getRequireResidentKey(), is(residentKey));
+        assertThat(realmData.getUserVerificationRequirement(), is(userVerification));
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnSkipIfExistsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnSkipIfExistsTest.java
new file mode 100644
index 000000000000..9601fea48094
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnSkipIfExistsTest.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.webauthn;
+
+import java.io.IOException;
+import org.junit.Test;
+import org.keycloak.models.Constants;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.openqa.selenium.firefox.FirefoxDriver;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.is;
+
+/**
+ *
+ * @author rmartinc
+ */
+public class AppInitiatedActionWebAuthnSkipIfExistsTest extends AppInitiatedActionWebAuthnTest {
+
+    @Override
+    public String getAiaAction() {
+        return WEB_AUTHN_REGISTER_PROVIDER + ":" + Constants.KC_ACTION_PARAMETER_SKIP_IF_EXISTS;
+    }
+
+    public String getCredentialType() {
+        return isPasswordless() ? WebAuthnCredentialModel.TYPE_PASSWORDLESS : WebAuthnCredentialModel.TYPE_TWOFACTOR;
+    }
+
+    @Test
+    @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+    public void processSetupTwice() throws IOException {
+        testWebAuthnLogoutOtherSessions(false);
+        final long credentialsCount = ApiUtil.findUserByUsernameId(testRealm(), DEFAULT_USERNAME)
+                .credentials()
+                .stream()
+                .filter(c -> c.getType().equals(getCredentialType()))
+                .count();
+        assertThat(credentialsCount, greaterThan(0L));
+
+        // do a second AIA that should be skiped
+        doAIA();
+        assertKcActionStatus(SUCCESS);
+
+        assertThat(ApiUtil.findUserByUsernameId(testRealm(), DEFAULT_USERNAME)
+                .credentials()
+                .stream()
+                .filter(c -> c.getType().equals(getCredentialType()))
+                .count(), is(credentialsCount));
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnTest.java
index 1046acea0de3..305046099599 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/AppInitiatedActionWebAuthnTest.java
@@ -36,11 +36,12 @@
 import org.keycloak.testsuite.actions.AbstractAppInitiatedActionTest;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginUsernameOnlyPage;
 import org.keycloak.testsuite.pages.PasswordPage;
 import org.keycloak.testsuite.updaters.RealmAttributeUpdater;
 import org.keycloak.testsuite.util.FlowUtil;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
 import org.keycloak.testsuite.util.SecondBrowser;
 import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
 import org.keycloak.testsuite.webauthn.authenticators.UseVirtualAuthenticators;
@@ -60,6 +61,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsInAnyOrder;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 import static org.keycloak.models.AuthenticationExecutionModel.Requirement.ALTERNATIVE;
 import static org.keycloak.models.AuthenticationExecutionModel.Requirement.REQUIRED;
 import static org.keycloak.testsuite.util.BrowserDriverUtil.isDriverFirefox;
@@ -70,11 +72,10 @@
  */
 public class AppInitiatedActionWebAuthnTest extends AbstractAppInitiatedActionTest implements UseVirtualAuthenticators {
 
-    private VirtualAuthenticatorManager virtualManager;
+    protected VirtualAuthenticatorManager virtualManager;
 
     protected final String WEB_AUTHN_REGISTER_PROVIDER = isPasswordless() ? WebAuthnPasswordlessRegisterFactory.PROVIDER_ID : WebAuthnRegisterFactory.PROVIDER_ID;
     protected final String DEFAULT_USERNAME = "test-user@localhost";
-    protected final String DEFAULT_PASSWORD = "password";
 
     @Page
     LoginUsernameOnlyPage usernamePage;
@@ -121,6 +122,7 @@ protected boolean isPasswordless() {
 
     @Override
     public void configureTestRealm(RealmRepresentation testRealm) {
+        super.configureTestRealm(testRealm);
         RequiredActionProviderRepresentation action = new RequiredActionProviderRepresentation();
         action.setAlias(WEB_AUTHN_REGISTER_PROVIDER);
         action.setProviderId(WEB_AUTHN_REGISTER_PROVIDER);
@@ -178,7 +180,7 @@ public void proceedSetupWebAuthnLogoutOtherSessionsNotChecked() throws IOExcepti
         testWebAuthnLogoutOtherSessions(false);
     }
 
-    private void testWebAuthnLogoutOtherSessions(boolean logoutOtherSessions) throws IOException {
+    protected void testWebAuthnLogoutOtherSessions(boolean logoutOtherSessions) throws IOException {
         UserResource testUser = testRealm().users().get(findUser(DEFAULT_USERNAME).getId());
 
         // perform a login using normal user/password form to have an old session
@@ -186,9 +188,8 @@ private void testWebAuthnLogoutOtherSessions(boolean logoutOtherSessions) throws
         try (RealmAttributeUpdater rau = new RealmAttributeUpdater(testRealm())
                 .setBrowserFlow("browser")
                 .update()) {
-            OAuthClient oauth2 = new OAuthClient();
-            oauth2.init(driver2);
-            oauth2.doLogin(DEFAULT_USERNAME, DEFAULT_PASSWORD);
+            OAuthClient oauth2 = oauth.newConfig().driver(driver2);
+            oauth2.doLogin(DEFAULT_USERNAME, getPassword(DEFAULT_USERNAME));
             event1 = events.expectLogin().assertEvent();
             assertEquals(1, testUser.getUserSessions().size());
         }
@@ -206,8 +207,8 @@ private void testWebAuthnLogoutOtherSessions(boolean logoutOtherSessions) throws
         final int credentialsCount = getCredentialCount.get();
 
         webAuthnRegisterPage.assertCurrent();
-        if (!logoutOtherSessions) {
-            webAuthnRegisterPage.uncheckLogoutSessions();
+        if (logoutOtherSessions) {
+            webAuthnRegisterPage.checkLogoutSessions();
         }
         assertThat(webAuthnRegisterPage.isLogoutSessionsChecked(), is(logoutOtherSessions));
         webAuthnRegisterPage.clickRegister();
@@ -229,12 +230,16 @@ private void testWebAuthnLogoutOtherSessions(boolean logoutOtherSessions) throws
     }
 
     private EventRepresentation loginUser() {
-        usernamePage.open();
+        oauth.openLoginForm();
         usernamePage.assertCurrent();
         usernamePage.login(DEFAULT_USERNAME);
 
         passwordPage.assertCurrent();
-        passwordPage.login(DEFAULT_PASSWORD);
+        passwordPage.login(getPassword(DEFAULT_USERNAME));
+
+        appPage.assertCurrent();
+        assertThat(appPage.getRequestType(), is(AppPage.RequestType.AUTH_RESPONSE));
+        assertNotNull(oauth.parseLoginResponse().getCode());
 
         return events.expectLogin()
                 .detail(Details.USERNAME, DEFAULT_USERNAME)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnIdlessTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnIdlessTest.java
index 4ce0badd70d9..3611ccdd1e41 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnIdlessTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnIdlessTest.java
@@ -28,6 +28,7 @@
 import org.keycloak.common.util.SecretGenerator;
 import org.keycloak.events.Details;
 import org.keycloak.events.EventType;
+import org.keycloak.models.Constants;
 import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.representations.idm.CredentialRepresentation;
@@ -52,8 +53,6 @@
 
 import static org.hamcrest.CoreMatchers.*;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.WebAuthnConstants.OPTION_DISCOURAGED;
-import static org.keycloak.WebAuthnConstants.OPTION_REQUIRED;
 import static org.keycloak.models.AuthenticationExecutionModel.Requirement.ALTERNATIVE;
 import static org.keycloak.models.AuthenticationExecutionModel.Requirement.REQUIRED;
 import static org.keycloak.testsuite.webauthn.utils.PropertyRequirement.NO;
@@ -91,18 +90,13 @@ public class WebAuthnIdlessTest extends AbstractWebAuthnVirtualTest {
     private static final Logger logger = Logger.getLogger(WebAuthnIdlessTest.class);
 
     protected final static String username = "test-user@localhost";
-    protected final static String password = "password";
-
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-
-    }
 
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
 
         testRealms.add(realmRepresentation);
+        configureTestRealm(realmRepresentation);
     }
 
     // Register webauthn-passwordless credential (resident key)
@@ -208,7 +202,7 @@ protected String usernamePasswordAuthWithAuthSetup(String username, boolean isPa
 
         loginPage.open();
         loginPage.assertCurrent();
-        loginPage.login(username, password);
+        loginPage.login(username, getPassword(username));
 
         webAuthnRegisterPage.assertCurrent();
         webAuthnRegisterPage.clickRegister();
@@ -298,7 +292,7 @@ protected void usernamePasswordAndWebAuthnAuthentication(String username, String
         selectAuthenticatorPage.assertCurrent();
         selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.USERNAMEPASSWORD);
         loginPage.assertCurrent();
-        loginPage.login(username, password);
+        loginPage.login(username, getPassword(username));
         webAuthnLoginPage.assertCurrent();
         webAuthnLoginPage.clickAuthenticate();
         appPage.assertCurrent();
@@ -392,9 +386,9 @@ protected void idlessAuthentication(String username, String credentialId, boolea
     protected void setWebAuthnRealmSettings(boolean waRequireRK, boolean waRequireUV, boolean waplRequireRK, boolean waplRequireUV ) {
 
         String waRequireRKString = waRequireRK ? YES.getValue() : NO.getValue();
-        String waRequireUVString = waRequireUV ? OPTION_REQUIRED : OPTION_DISCOURAGED;
+        String waRequireUVString = waRequireUV ? Constants.WEBAUTHN_POLICY_OPTION_REQUIRED : Constants.WEBAUTHN_POLICY_OPTION_DISCOURAGED;
         String waplRequireRKString = waplRequireRK ? YES.getValue() : NO.getValue();
-        String waplRequireUVString = waplRequireUV ? OPTION_REQUIRED : OPTION_DISCOURAGED;
+        String waplRequireUVString = waplRequireUV ? Constants.WEBAUTHN_POLICY_OPTION_REQUIRED : Constants.WEBAUTHN_POLICY_OPTION_DISCOURAGED;
 
         RealmRepresentation realmRep = testRealm().toRepresentation();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnPropertyTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnPropertyTest.java
index 0a0b83241ac4..396634f61976 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnPropertyTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnPropertyTest.java
@@ -19,6 +19,7 @@
 
 import org.junit.Test;
 import org.keycloak.WebAuthnConstants;
+import org.keycloak.models.Constants;
 import org.keycloak.models.credential.WebAuthnCredentialModel;
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
@@ -35,7 +36,6 @@
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.WebAuthnConstants.OPTION_REQUIRED;
 import static org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions.DEFAULT;
 import static org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY;
 import static org.keycloak.testsuite.webauthn.utils.PropertyRequirement.YES;
@@ -53,14 +53,14 @@ public void residentKey() throws IOException {
         try (Closeable c = getWebAuthnRealmUpdater()
                 .setWebAuthnPolicyRpEntityName("localhost")
                 .setWebAuthnPolicyRequireResidentKey(YES.getValue())
-                .setWebAuthnPolicyUserVerificationRequirement(OPTION_REQUIRED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
                 .update()) {
 
             WebAuthnRealmData realmData = new WebAuthnRealmData(testRealm().toRepresentation(), isPasswordless());
             assertThat(realmData, notNullValue());
             assertThat(realmData.getRpEntityName(), is("localhost"));
             assertThat(realmData.getRequireResidentKey(), is(YES.getValue()));
-            assertThat(realmData.getUserVerificationRequirement(), is(OPTION_REQUIRED));
+            assertThat(realmData.getUserVerificationRequirement(), is(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED));
 
             registerDefaultUser();
 
@@ -111,14 +111,14 @@ public void changeAuthenticatorProperties() throws IOException {
         try (Closeable c = getWebAuthnRealmUpdater()
                 .setWebAuthnPolicyRpEntityName("localhost")
                 .setWebAuthnPolicyRequireResidentKey(YES.getValue())
-                .setWebAuthnPolicyUserVerificationRequirement(OPTION_REQUIRED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
                 .update()) {
 
             WebAuthnRealmData realmData = new WebAuthnRealmData(testRealm().toRepresentation(), isPasswordless());
             assertThat(realmData, notNullValue());
             assertThat(realmData.getRpEntityName(), is("localhost"));
             assertThat(realmData.getRequireResidentKey(), is(YES.getValue()));
-            assertThat(realmData.getUserVerificationRequirement(), is(OPTION_REQUIRED));
+            assertThat(realmData.getUserVerificationRequirement(), is(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED));
 
             registerDefaultUser();
 
@@ -141,7 +141,7 @@ public void requiredActionRegistration() {
 
         loginPage.open();
         loginPage.assertCurrent();
-        loginPage.login(USERNAME, PASSWORD);
+        loginPage.login(USERNAME, getPassword(USERNAME));
         webAuthnLoginPage.assertCurrent();
 
         final String credType = isPasswordless() ? WebAuthnCredentialModel.TYPE_PASSWORDLESS : WebAuthnCredentialModel.TYPE_TWOFACTOR;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnRegisterAndLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnRegisterAndLoginTest.java
index a9cb95a2a9d7..ad4abf0d5197 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnRegisterAndLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnRegisterAndLoginTest.java
@@ -16,6 +16,7 @@
  */
 package org.keycloak.testsuite.webauthn;
 
+import jakarta.ws.rs.core.Response;
 import org.hamcrest.Matchers;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Assert;
@@ -81,11 +82,6 @@ public class WebAuthnRegisterAndLoginTest extends AbstractWebAuthnVirtualTest {
     @Page
     protected SelectAuthenticatorPage selectAuthenticatorPage;
 
-    @Override
-    public void configureTestRealm(RealmRepresentation testRealm) {
-
-    }
-
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
@@ -97,13 +93,13 @@ public void addTestRealms(List<RealmRepresentation> testRealms) {
         realmRepresentation.setWebAuthnPolicyAcceptableAaguids(acceptableAaguids);
 
         testRealms.add(realmRepresentation);
+        configureTestRealm(realmRepresentation);
     }
 
     @Test
     @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void registerUserSuccess() throws IOException {
         String username = "registerUserSuccess";
-        String password = "password";
         String email = "registerUserSuccess@email";
         String userId = null;
 
@@ -114,7 +110,7 @@ public void registerUserSuccess() throws IOException {
             registerPage.assertCurrent();
 
             String authenticatorLabel = SecretGenerator.getInstance().randomString(24);
-            registerPage.register("firstName", "lastName", email, username, password, password);
+            registerPage.register("firstName", "lastName", email, username, generatePassword(username));
 
             // User was registered. Now he needs to register WebAuthn credential
             webAuthnRegisterPage.assertCurrent();
@@ -169,7 +165,7 @@ public void registerUserSuccess() throws IOException {
 
             // login by user
             loginPage.open();
-            loginPage.login(username, password);
+            loginPage.login(username, getPassword(username));
 
             webAuthnLoginPage.assertCurrent();
 
@@ -235,7 +231,7 @@ public void webAuthnPasswordlessAlternativeWithWebAuthnAndPassword() throws IOEx
             loginUsernamePage.login("test-user@localhost");
 
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword("test-user@localhost"));
 
             events.clear();
 
@@ -293,7 +289,7 @@ public void webAuthnPasswordlessAlternativeWithWebAuthnAndPassword() throws IOEx
             loginUsernamePage.login("test-user@localhost");
 
             passwordPage.assertCurrent();
-            passwordPage.login("password");
+            passwordPage.login(getPassword("test-user@localhost"));
 
             webAuthnLoginPage.assertCurrent();
 
@@ -332,13 +328,130 @@ public void webAuthnPasswordlessAlternativeWithWebAuthnAndPassword() throws IOEx
         }
     }
 
+    // See: https://github.com/keycloak/keycloak/issues/29586
+    @Test
+    @IgnoreBrowserDriver(FirefoxDriver.class)
+    public void webAuthnPasswordlessShouldFailIfUserIsDeletedInBetween() throws IOException {
+
+        final String WEBAUTHN_LABEL = "webauthn";
+        final String PASSWORDLESS_LABEL = "passwordless";
+
+        RealmResource realmResource = testRealm();
+
+        try (RealmAttributeUpdater rau = new RealmAttributeUpdater(realmResource)
+                .setBrowserFlow(webAuthnTogetherPasswordlessFlow())
+                .update()) {
+
+            String username = "webauthn-tester@localhost";
+            String password = generatePassword("webauthn-tester@localhost");
+
+            UserRepresentation user = new UserRepresentation();
+            user.setUsername(username);
+            user.setEnabled(true);
+            user.setFirstName("WebAuthN");
+            user.setLastName("Tester");
+
+            String userId = ApiUtil.createUserAndResetPasswordWithAdminClient(realmResource, user, password, false);
+
+            user = ApiUtil.findUserByUsername(realmResource, username);
+
+            assertThat(user, notNullValue());
+            user.getRequiredActions().add(WebAuthnPasswordlessRegisterFactory.PROVIDER_ID);
+
+            UserResource userResource = realmResource.users().get(user.getId());
+            assertThat(userResource, notNullValue());
+            userResource.update(user);
+
+            user = userResource.toRepresentation();
+            assertThat(user, notNullValue());
+            assertThat(user.getRequiredActions(), hasItem(WebAuthnPasswordlessRegisterFactory.PROVIDER_ID));
+
+            loginUsernamePage.open();
+            loginUsernamePage.login(username);
+
+            passwordPage.assertCurrent();
+            passwordPage.login(password);
+
+            events.clear();
+
+            webAuthnRegisterPage.assertCurrent();
+            webAuthnRegisterPage.clickRegister();
+            webAuthnRegisterPage.registerWebAuthnCredential(WEBAUTHN_LABEL);
+
+            webAuthnRegisterPage.assertCurrent();
+
+            events.expectRequiredAction(EventType.CUSTOM_REQUIRED_ACTION)
+                    .user(userId)
+                    .detail(Details.CUSTOM_REQUIRED_ACTION, WebAuthnRegisterFactory.PROVIDER_ID)
+                    .detail(WebAuthnConstants.PUBKEY_CRED_LABEL_ATTR, WEBAUTHN_LABEL)
+                    .assertEvent();
+            events.expectRequiredAction(EventType.UPDATE_CREDENTIAL)
+                    .user(userId)
+                    .detail(Details.CUSTOM_REQUIRED_ACTION, WebAuthnRegisterFactory.PROVIDER_ID)
+                    .detail(WebAuthnConstants.PUBKEY_CRED_LABEL_ATTR, WEBAUTHN_LABEL)
+                    .assertEvent();
+
+            webAuthnRegisterPage.clickRegister();
+            webAuthnRegisterPage.registerWebAuthnCredential(PASSWORDLESS_LABEL);
+
+            appPage.assertCurrent();
+
+            logout();
+
+            // Password + WebAuthn Passkey
+            loginUsernamePage.open();
+            loginUsernamePage.assertCurrent();
+            loginUsernamePage.login(username);
+
+            passwordPage.assertCurrent();
+            passwordPage.login(password);
+
+            webAuthnLoginPage.assertCurrent();
+
+            final WebAuthnAuthenticatorsList authenticators = webAuthnLoginPage.getAuthenticators();
+            assertThat(authenticators.getCount(), is(1));
+            assertThat(authenticators.getLabels(), Matchers.contains(WEBAUTHN_LABEL));
+
+            webAuthnLoginPage.clickAuthenticate();
+
+            appPage.assertCurrent();
+            logout();
+
+            // Only passwordless login
+            loginUsernamePage.open();
+            loginUsernamePage.login(username);
+
+            passwordPage.assertCurrent();
+            passwordPage.assertTryAnotherWayLinkAvailability(true);
+            passwordPage.clickTryAnotherWayLink();
+
+            selectAuthenticatorPage.assertCurrent();
+            assertThat(selectAuthenticatorPage.getLoginMethodHelpText(SelectAuthenticatorPage.SECURITY_KEY),
+                    is("Use your Passkey for passwordless sign in."));
+            selectAuthenticatorPage.selectLoginMethod(SelectAuthenticatorPage.SECURITY_KEY);
+
+            webAuthnLoginPage.assertCurrent();
+            assertThat(webAuthnLoginPage.getAuthenticators().getCount(), is(0));
+
+            // remove testuser before user authenticates via webauthn
+            try (Response resp = realmResource.users().delete(userId)) {
+                // ignore
+            }
+
+            webAuthnLoginPage.clickAuthenticate();
+
+            webAuthnErrorPage.assertCurrent();
+            assertThat(webAuthnErrorPage.getError(), is("Unknown user authenticated by the Passkey."));
+        }
+    }
+
     @Test
     public void webAuthnTwoFactorAndWebAuthnPasswordlessTogether() throws IOException {
         // Change binding to browser-webauthn-passwordless. This is flow, which contains both "webauthn" and "webauthn-passwordless" authenticator
         try (RealmAttributeUpdater rau = new RealmAttributeUpdater(testRealm()).setBrowserFlow("browser-webauthn-passwordless").update()) {
             // Login as test-user@localhost with password
             loginPage.open();
-            loginPage.login("test-user@localhost", "password");
+            loginPage.login("test-user@localhost", getPassword("test-user@localhost"));
 
             errorPage.assertCurrent();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnTransportsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnTransportsTest.java
index 1875bb828263..5c50a1a9e382 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnTransportsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/WebAuthnTransportsTest.java
@@ -66,7 +66,7 @@ private void assertTransport(VirtualAuthenticatorOptions authenticator, String t
 
         loginPage.open();
         loginPage.assertCurrent();
-        loginPage.login(USERNAME, PASSWORD);
+        loginPage.login(USERNAME, getPassword(USERNAME));
 
         webAuthnLoginPage.assertCurrent();
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/AbstractWebAuthnAccountTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/AbstractWebAuthnAccountTest.java
index a86255e87123..01c66193cb32 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/AbstractWebAuthnAccountTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/AbstractWebAuthnAccountTest.java
@@ -42,8 +42,10 @@
 import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
 import org.keycloak.testsuite.webauthn.authenticators.UseVirtualAuthenticators;
 import org.keycloak.testsuite.webauthn.authenticators.VirtualAuthenticatorManager;
+import org.keycloak.testsuite.webauthn.pages.WebAuthnErrorPage;
 import org.keycloak.testsuite.webauthn.pages.WebAuthnLoginPage;
 import org.keycloak.testsuite.webauthn.pages.WebAuthnRegisterPage;
+import org.openqa.selenium.Dimension;
 import org.openqa.selenium.virtualauthenticator.VirtualAuthenticatorOptions;
 
 import jakarta.ws.rs.ClientErrorException;
@@ -52,6 +54,7 @@
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.keycloak.models.AuthenticationExecutionModel.Requirement.REQUIRED;
+import static org.keycloak.testsuite.admin.Users.setPasswordFor;
 import static org.keycloak.testsuite.util.BrowserDriverUtil.isDriverFirefox;
 import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
 
@@ -63,6 +66,9 @@ public abstract class AbstractWebAuthnAccountTest extends AbstractAuthTest imple
     @Page
     protected WebAuthnRegisterPage webAuthnRegisterPage;
 
+    @Page
+    protected WebAuthnErrorPage webAuthnErrorPage;
+
     @Page
     protected WebAuthnLoginPage webAuthnLoginPage;
 
@@ -92,9 +98,13 @@ public void removeVirtualAuthenticator() {
         }
     }
 
+    public VirtualAuthenticatorManager getVirtualAuthManager() {
+        return webAuthnManager;
+    }
+
     @Before
     public void navigateBeforeTest() {
-        driver.manage().window().maximize();
+        driver.manage().window().setSize(new Dimension(1920, 1080));
 
         RealmRepresentation realm = testRealmResource().toRepresentation();
         assertThat(realm, notNullValue());
@@ -104,7 +114,9 @@ public void navigateBeforeTest() {
         webAuthnCredentialType = signingInPage.getCredentialType(WebAuthnCredentialModel.TYPE_TWOFACTOR);
         webAuthnPwdlessCredentialType = signingInPage.getCredentialType(WebAuthnCredentialModel.TYPE_PASSWORDLESS);
 
-        createTestUserWithAdminClient(false);
+        final String password = generatePassword();
+        setPasswordFor(testUser, password);
+        createTestUserWithAdminClient(false, password);
 
         signingInPage.navigateTo();
         waitForPageToLoad();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/WebAuthnSigningInTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/WebAuthnSigningInTest.java
index 8ffc5fd31743..a7c1a6ea335a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/WebAuthnSigningInTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/account/WebAuthnSigningInTest.java
@@ -19,7 +19,6 @@
 
 import org.hamcrest.Matchers;
 import org.junit.Test;
-import org.junit.Ignore;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.requiredactions.WebAuthnPasswordlessRegisterFactory;
 import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
@@ -27,8 +26,13 @@
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.representations.idm.RequiredActionProviderRepresentation;
 import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.page.AbstractPatternFlyAlert;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
 import org.keycloak.testsuite.webauthn.pages.SigningInPage;
 import org.keycloak.testsuite.webauthn.pages.WebAuthnAuthenticatorsList;
+import org.keycloak.testsuite.webauthn.updaters.AbstractWebAuthnRealmUpdater;
+import org.keycloak.testsuite.webauthn.updaters.PasswordLessRealmAttributeUpdater;
+import org.keycloak.testsuite.webauthn.updaters.WebAuthnRealmAttributeUpdater;
 import org.keycloak.theme.DateTimeFormatterUtil;
 import org.openqa.selenium.firefox.FirefoxDriver;
 
@@ -45,6 +49,7 @@
 import java.util.stream.Collectors;
 
 import static java.util.Collections.emptyList;
+import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.CoreMatchers.notNullValue;
@@ -83,47 +88,42 @@ public void twoFactorWebAuthnTest() {
     @Test
     @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void passwordlessWebAuthnTest() {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
         testWebAuthn(true);
     }
 
     @Test
     @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void createWebAuthnSameUserLabel() {
-        final String SAME_LABEL = "key123";
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
 
-        // Do we really allow to have several authenticators with the same user label??
+        final String SAME_LABEL = "key123";
 
         SigningInPage.UserCredential webAuthn = addWebAuthnCredential(SAME_LABEL, false);
         assertThat(webAuthn, notNullValue());
-        SigningInPage.UserCredential passwordless = addWebAuthnCredential(SAME_LABEL, true);
-        assertThat(passwordless, notNullValue());
-
-        assertThat(webAuthnCredentialType.getUserCredentialsCount(), is(1));
-        webAuthn = webAuthnCredentialType.getUserCredential(webAuthn.getId());
-        assertThat(webAuthn, notNullValue());
-        assertThat(webAuthn.getUserLabel(), is(SAME_LABEL));
 
-        assertThat(webAuthnPwdlessCredentialType.getUserCredentialsCount(), is(1));
-        passwordless = webAuthnPwdlessCredentialType.getUserCredential(passwordless.getId());
-        assertThat(passwordless, notNullValue());
-        assertThat(passwordless.getUserLabel(), is(SAME_LABEL));
+        SigningInPage.CredentialType credentialType = webAuthnPwdlessCredentialType;
 
-        SigningInPage.UserCredential webAuthn2 = addWebAuthnCredential(SAME_LABEL, false);
-        assertThat(webAuthn2, notNullValue());
-        assertThat(webAuthn2.getUserLabel(), is(SAME_LABEL));
+        AbstractPatternFlyAlert.waitUntilHidden();
 
-        assertThat(webAuthnCredentialType.getUserCredentialsCount(), is(2));
+        credentialType.clickSetUpLink();
+        webAuthnRegisterPage.assertCurrent();
+        webAuthnRegisterPage.clickRegister();
+        webAuthnRegisterPage.registerWebAuthnCredential(SAME_LABEL);
+        waitForPageToLoad();
 
-        SigningInPage.UserCredential passwordless2 = addWebAuthnCredential(SAME_LABEL, true);
-        assertThat(passwordless2, notNullValue());
-        assertThat(passwordless2.getUserLabel(), is(SAME_LABEL));
+        webAuthnErrorPage.assertCurrent();
+        assertThat(webAuthnErrorPage.getError(), is("Failed to register your Passkey.\nDevice already exists with the same name"));
+        webAuthnErrorPage.clickTryAgain();
 
-        assertThat(webAuthnPwdlessCredentialType.getUserCredentialsCount(), is(2));
+        webAuthnRegisterPage.assertCurrent();
     }
 
     @Test
     @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void multipleSecurityKeys() {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+
         final String LABEL = "SecurityKey#";
 
         List<SigningInPage.UserCredential> createdCredentials = new ArrayList<>();
@@ -172,6 +172,19 @@ public void multipleSecurityKeys() {
         assertThat(webAuthnPwdlessCredentialType.getUserCredentialsCount(), is(4));
     }
 
+    @Test
+    @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+    public void avoidSameAuthenticatorRegister() throws IOException {
+        avoidSameAuthenticatorRegister(new WebAuthnRealmAttributeUpdater(testRealmResource()), webAuthnCredentialType);
+    }
+
+    @Test
+    @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+    public void avoidSameAuthenticatorRegisterPasswordless() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+        avoidSameAuthenticatorRegister(new PasswordLessRealmAttributeUpdater(testRealmResource()), webAuthnPwdlessCredentialType);
+    }
+
     @Test
     public void setUpLinksTest() {
         testSetUpLink(testRealmResource(), webAuthnCredentialType, WebAuthnRegisterFactory.PROVIDER_ID);
@@ -206,6 +219,8 @@ public void displayAvailableAuthenticators() {
     @Test
     @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void notDisplayAvailableAuthenticatorsPasswordless() {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+
         addWebAuthnCredential("authenticator#1", true);
         addWebAuthnCredential("authenticator#2", true);
 
@@ -268,7 +283,7 @@ public void availableAuthenticatorsAfterRemove(){
     }
 
     @Test
-    @Ignore // TODO: Enable once chromedriver version 113.0.5672.92 is available in https://chromedriver.storage.googleapis.com/
+    @IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
     public void checkAuthenticatorTimeLocale() throws ParseException, IOException {
         addWebAuthnCredential("authenticator#1");
 
@@ -395,6 +410,22 @@ public void cancelPasswordlessRegistration() {
         checkCancelRegistration(true);
     }
 
+    private void avoidSameAuthenticatorRegister(AbstractWebAuthnRealmUpdater updater, SigningInPage.CredentialType type) throws IOException {
+        try (Closeable c = updater.setWebAuthnPolicyAvoidSameAuthenticatorRegister(Boolean.TRUE).update()) {
+            // register first credential successfully
+            addWebAuthnCredential("label1", type.getType().equals(WebAuthnCredentialModel.TYPE_PASSWORDLESS));
+            assertThat(type.getUserCredentialsCount(), is(1));
+            // register the second credential and expect the error
+            type.clickSetUpLink();
+            webAuthnRegisterPage.assertCurrent();
+            webAuthnRegisterPage.clickRegister();
+            waitForPageToLoad();
+            webAuthnErrorPage.assertCurrent();
+            assertThat(webAuthnErrorPage.getError(), containsString(
+                    "The user attempted to register an authenticator that contains one of the credentials already registered with the relying party."));
+        }
+    }
+
     private void checkCancelRegistration(boolean passwordless) {
         SigningInPage.CredentialType credentialType = passwordless ? webAuthnPwdlessCredentialType : webAuthnCredentialType;
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessSkipIfExistsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessSkipIfExistsTest.java
new file mode 100644
index 000000000000..e7c976a4cb84
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessSkipIfExistsTest.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.webauthn.passwordless;
+
+import org.junit.Before;
+import org.keycloak.testsuite.util.BrowserDriverUtil;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
+import org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnSkipIfExistsTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
+
+/**
+ * @author rmartinc
+ */
+public class AppInitiatedActionPwdLessSkipIfExistsTest extends AppInitiatedActionWebAuthnSkipIfExistsTest {
+
+    @Before
+    @Override
+    public void setUpVirtualAuthenticator() {
+        if (!BrowserDriverUtil.isDriverFirefox(driver)) {
+            virtualManager = AbstractWebAuthnVirtualTest.createDefaultVirtualManager(driver, DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+        }
+    }
+
+    @Override
+    protected boolean isPasswordless() {
+        return true;
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessTest.java
index 63212ae3bbf8..430aba21230d 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/AppInitiatedActionPwdLessTest.java
@@ -17,13 +17,25 @@
 
 package org.keycloak.testsuite.webauthn.passwordless;
 
+import org.junit.Before;
+import org.keycloak.testsuite.util.BrowserDriverUtil;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
 import org.keycloak.testsuite.webauthn.AppInitiatedActionWebAuthnTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
 
 /**
  * @author <a href="mailto:mabartos@redhat.com">Martin Bartos</a>
  */
 public class AppInitiatedActionPwdLessTest extends AppInitiatedActionWebAuthnTest {
 
+    @Before
+    @Override
+    public void setUpVirtualAuthenticator() {
+        if (!BrowserDriverUtil.isDriverFirefox(driver)) {
+            virtualManager = AbstractWebAuthnVirtualTest.createDefaultVirtualManager(driver, DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+        }
+    }
+
     @Override
     protected boolean isPasswordless() {
         return true;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysConditionalUITest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysConditionalUITest.java
new file mode 100644
index 000000000000..ce1d6ce293d8
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysConditionalUITest.java
@@ -0,0 +1,131 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.webauthn.passwordless;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.util.List;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.Test;
+import org.keycloak.WebAuthnConstants;
+import org.keycloak.authentication.authenticators.browser.PasskeysConditionalUIAuthenticatorFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.events.Details;
+import org.keycloak.models.Constants;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.admin.AbstractAdminTest;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.pages.PageUtils;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
+import org.openqa.selenium.firefox.FirefoxDriver;
+
+/**
+ *
+ * @author rmartinc
+ */
+@EnableFeature(value = Profile.Feature.PASSKEYS, skipRestart = true)
+@IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+public class PasskeysConditionalUITest extends AbstractWebAuthnVirtualTest {
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
+
+        makePasswordlessRequiredActionDefault(realmRepresentation);
+        switchExecutionInBrowserFormToProvider(realmRepresentation, PasskeysConditionalUIAuthenticatorFactory.PROVIDER_ID);
+
+        testRealms.add(realmRepresentation);
+        configureTestRealm(realmRepresentation);
+    }
+
+    @Override
+    public boolean isPasswordless() {
+        return true;
+    }
+
+    @Test
+    public void successLoginWithDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+
+            events.clear();
+
+            // the user should be automatically logged in using the discoverable key
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void failureWithNonDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy not specified, key will not be discoverable
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED, Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+
+            events.clear();
+
+            // the key is not discoverable, therefore the login should not be done automatically
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(PageUtils.getPageTitle(driver), Matchers.is("Passkey login"));
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysOrganizationAuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysOrganizationAuthenticationTest.java
new file mode 100644
index 000000000000..123bd3b49326
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysOrganizationAuthenticationTest.java
@@ -0,0 +1,266 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.webauthn.passwordless;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.util.List;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.Test;
+import org.keycloak.WebAuthnConstants;
+import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
+import org.keycloak.models.Constants;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.organization.authentication.authenticators.browser.OrganizationAuthenticatorFactory;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
+import org.keycloak.representations.idm.OrganizationDomainRepresentation;
+import org.keycloak.representations.idm.OrganizationRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.admin.AbstractAdminTest;
+import org.keycloak.testsuite.admin.ApiUtil;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
+import org.openqa.selenium.By;
+import org.openqa.selenium.NoSuchElementException;
+import org.openqa.selenium.firefox.FirefoxDriver;
+
+/**
+ *
+ * @author rmartinc
+ */
+@EnableFeature(value = Profile.Feature.PASSKEYS, skipRestart = true)
+@IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+public class PasskeysOrganizationAuthenticationTest extends AbstractWebAuthnVirtualTest {
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
+
+        makePasswordlessRequiredActionDefault(realmRepresentation);
+        switchExecutionInBrowserFormToProvider(realmRepresentation, UsernamePasswordFormFactory.PROVIDER_ID);
+        realmRepresentation.setOrganizationsEnabled(Boolean.TRUE);
+
+        OrganizationRepresentation emailOrg = new OrganizationRepresentation();
+        emailOrg.setName("email");
+        emailOrg.setAlias("email");
+        OrganizationDomainRepresentation domainRep = new OrganizationDomainRepresentation();
+        domainRep.setName("email");
+        emailOrg.addDomain(domainRep);
+        realmRepresentation.addOrganization(emailOrg);
+
+        testRealms.add(realmRepresentation);
+    }
+
+    @Override
+    public boolean isPasswordless() {
+        return true;
+    }
+
+    @Test
+    public void webauthnLoginWithDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // the user should be automatically logged in using the discoverable key
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+
+            logout();
+        }
+    }
+
+    @Test
+    public void webauthnLoginWithDiscoverableKeyRequiresMembership() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // enable organization configuration
+        AuthenticationExecutionInfoRepresentation organizationExec = testRealm().flows().getExecutions("browser-webauthn-conditional-organization").stream()
+                .filter(exec -> OrganizationAuthenticatorFactory.ID.equals(exec.getProviderId()))
+                .findAny()
+                .orElse(null);
+        Assert.assertNotNull("Organization execution not found", organizationExec);
+
+        AuthenticatorConfigRepresentation config = new AuthenticatorConfigRepresentation();
+        config.setAlias(KeycloakModelUtils.generateId());
+        config.getConfig().put(OrganizationAuthenticatorFactory.REQUIRES_USER_MEMBERSHIP, Boolean.TRUE.toString());
+        getCleanup().addAuthenticationConfigId(ApiUtil.getCreatedId(testRealm().flows().newExecutionConfig(organizationExec.getId(), config)));
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // the user should be automatically logged in using the discoverable key but error because no org
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            errorPage.assertCurrent();
+            MatcherAssert.assertThat(errorPage.getError(), Matchers.containsString("User is not a member of the organization"));
+        }
+    }
+
+    @Test
+    public void passwordLoginWithNonDiscoverableKey() throws Exception {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy not specified, key will not be discoverable
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // access login page, key is not discoverable so webauthn should be enabled but login should be manual
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(loginPage.isPasswordInputPresent(), Matchers.is(false));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+            loginPage.loginUsername(USERNAME);
+
+            // now the passkeys username password page should be presented with username selected and passkeys disabled
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getAttemptedUsername(), Matchers.is("userwebauthn"));
+            Assert.assertThrows(NoSuchElementException.class, () -> driver.findElement(By.xpath("//form[@id='webauth']")));
+            loginPage.login("invalid-password");
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getPasswordInputError(), Matchers.is("Invalid password."));
+            events.expect(EventType.LOGIN_ERROR)
+                    .error(Errors.INVALID_USER_CREDENTIALS)
+                    .user(user.getId())
+                    .assertEvent();
+
+            // correct login now
+            MatcherAssert.assertThat(loginPage.getAttemptedUsername(), Matchers.is("userwebauthn"));
+            Assert.assertThrows(NoSuchElementException.class, () -> driver.findElement(By.xpath("//form[@id='webauth']")));
+            loginPage.login(getPassword(USERNAME));
+            appPage.assertCurrent();
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, "userwebauthn")
+                    .detail(Details.CREDENTIAL_TYPE, Matchers.nullValue())
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void passwordLoginWithExternalKey() throws Exception {
+        // use a default resident key which is not shown in conditional UI
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // open login page, the key is not internal so not opened by default
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(loginPage.isPasswordInputPresent(), Matchers.is(false));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+
+            // force login using webauthn link
+            webAuthnLoginPage.clickAuthenticate();
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+            logout();
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernameFormTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernameFormTest.java
new file mode 100644
index 000000000000..aa7e4d816609
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernameFormTest.java
@@ -0,0 +1,257 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.webauthn.passwordless;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.util.List;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.junit.Test;
+import org.keycloak.WebAuthnConstants;
+import org.keycloak.authentication.authenticators.browser.PasswordFormFactory;
+import org.keycloak.authentication.authenticators.browser.UsernameFormFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.credential.PasswordCredentialModel;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.representations.idm.AuthenticationExecutionExportRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.Assert;
+import org.keycloak.testsuite.admin.AbstractAdminTest;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
+import org.openqa.selenium.By;
+import org.openqa.selenium.NoSuchElementException;
+import org.openqa.selenium.firefox.FirefoxDriver;
+
+/**
+ *
+ * @author rmartinc
+ */
+@EnableFeature(value = Profile.Feature.PASSKEYS, skipRestart = true)
+@IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+public class PasskeysUsernameFormTest extends AbstractWebAuthnVirtualTest {
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
+
+        makePasswordlessRequiredActionDefault(realmRepresentation);
+        switchExecutionInBrowser(realmRepresentation);
+
+        testRealms.add(realmRepresentation);
+    }
+
+    private void switchExecutionInBrowser(RealmRepresentation realm) {
+        List<AuthenticationFlowRepresentation> flows = realm.getAuthenticationFlows();
+        MatcherAssert.assertThat(flows, Matchers.notNullValue());
+
+        AuthenticationFlowRepresentation browserForm = flows.stream()
+                .filter(f -> f.getAlias().equals("browser-webauthn-forms"))
+                .findFirst()
+                .orElse(null);
+        MatcherAssert.assertThat("Cannot find 'browser-webauthn-forms' flow", browserForm, Matchers.notNullValue());
+
+        flows.removeIf(f -> f.getAlias().equals(browserForm.getAlias()));
+
+        // set first the username form authenticator
+        AuthenticationExecutionExportRepresentation usernameForm = new AuthenticationExecutionExportRepresentation();
+        usernameForm.setAuthenticator(UsernameFormFactory.PROVIDER_ID);
+        usernameForm.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.name());
+        usernameForm.setPriority(10);
+        usernameForm.setAuthenticatorFlow(false);
+        usernameForm.setUserSetupAllowed(false);
+
+        // second the password form
+        AuthenticationExecutionExportRepresentation passwordForm = new AuthenticationExecutionExportRepresentation();
+        passwordForm.setAuthenticator(PasswordFormFactory.PROVIDER_ID);
+        passwordForm.setRequirement(AuthenticationExecutionModel.Requirement.REQUIRED.name());
+        passwordForm.setPriority(20);
+        passwordForm.setAuthenticatorFlow(false);
+        passwordForm.setUserSetupAllowed(false);
+
+        browserForm.setAuthenticationExecutions(List.of(usernameForm, passwordForm));
+        flows.add(browserForm);
+
+        realm.setAuthenticationFlows(flows);
+    }
+
+    @Override
+    public boolean isPasswordless() {
+        return true;
+    }
+
+    @Test
+    public void webauthnLoginWithDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+
+            // remove the password, so passkeys are the only credential in the user
+            final CredentialRepresentation passwordCredRep = userResource().credentials().stream()
+                    .filter(cred -> PasswordCredentialModel.TYPE.equals(cred.getType()))
+                    .findAny()
+                    .orElse(null);
+            Assert.assertNotNull("User has no password credential", passwordCredRep);
+            userResource().removeCredential(passwordCredRep.getId());
+
+            events.clear();
+
+            // the user should be automatically logged in using the discoverable key
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+
+            logout();
+        }
+    }
+
+    @Test
+    public void passwordLoginWithNonDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy not specified, key will not be discoverable
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+
+            events.clear();
+
+            // login should be done manually but webauthn is enabled
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(loginPage.isPasswordInputPresent(), Matchers.is(false));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+
+            // invalid login first
+            loginPage.loginUsername("invalid-user");
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(loginPage.getUsernameInputError(), Matchers.is("Invalid username or email."));
+            events.expect(EventType.LOGIN_ERROR)
+                    .detail(Details.USERNAME, "invalid-user")
+                    .error(Errors.USER_NOT_FOUND)
+                    .user(Matchers.blankOrNullString())
+                    .assertEvent();
+
+            // login OK now
+            loginPage.loginUsername(USERNAME);
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getAttemptedUsername(), Matchers.is(USERNAME));
+            Assert.assertThrows(NoSuchElementException.class, () -> driver.findElement(By.xpath("//form[@id='webauth']")));
+            loginPage.login(getPassword(USERNAME));
+            appPage.assertCurrent();
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, USERNAME)
+                    .detail(Details.CREDENTIAL_TYPE, Matchers.nullValue())
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void passwordLoginWithExternalKey() throws Exception {
+        // use a default resident key which is not shown in conditional UI
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // open login page, the key is not internal so not opened by default
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(loginPage.isPasswordInputPresent(), Matchers.is(false));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+
+            // force login using webauthn link
+            webAuthnLoginPage.clickAuthenticate();
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+            logout();
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernamePasswordFormTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernamePasswordFormTest.java
new file mode 100644
index 000000000000..9af2787ec2f3
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/passwordless/PasskeysUsernamePasswordFormTest.java
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.webauthn.passwordless;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.util.List;
+import org.hamcrest.MatcherAssert;
+import org.hamcrest.Matchers;
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.Test;
+import org.keycloak.WebAuthnConstants;
+import org.keycloak.authentication.authenticators.browser.UsernamePasswordFormFactory;
+import org.keycloak.common.Profile;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventType;
+import org.keycloak.models.Constants;
+import org.keycloak.models.credential.WebAuthnCredentialModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.admin.AbstractAdminTest;
+import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
+import org.keycloak.testsuite.pages.SelectOrganizationPage;
+import org.keycloak.testsuite.util.WaitUtils;
+import org.keycloak.testsuite.webauthn.AbstractWebAuthnVirtualTest;
+import org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions;
+import org.openqa.selenium.By;
+import org.openqa.selenium.firefox.FirefoxDriver;
+
+/**
+ *
+ * @author rmartinc
+ */
+@EnableFeature(value = Profile.Feature.PASSKEYS, skipRestart = true)
+@IgnoreBrowserDriver(FirefoxDriver.class) // See https://github.com/keycloak/keycloak/issues/10368
+public class PasskeysUsernamePasswordFormTest extends AbstractWebAuthnVirtualTest {
+
+    @Page
+    protected SelectOrganizationPage selectOrganizationPage;
+
+    @Override
+    public void addTestRealms(List<RealmRepresentation> testRealms) {
+        RealmRepresentation realmRepresentation = AbstractAdminTest.loadJson(getClass().getResourceAsStream("/webauthn/testrealm-webauthn.json"), RealmRepresentation.class);
+
+        makePasswordlessRequiredActionDefault(realmRepresentation);
+        switchExecutionInBrowserFormToProvider(realmRepresentation, UsernamePasswordFormFactory.PROVIDER_ID);
+
+        testRealms.add(realmRepresentation);
+    }
+
+    @Override
+    public boolean isPasswordless() {
+        return true;
+    }
+
+    @Test
+    public void webauthnLoginWithDiscoverableKey() throws Exception {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(null)
+                .setWebAuthnPolicyUserVerificationRequirement(null)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // the user should be automatically logged in using the discoverable key
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+
+            logout();
+        }
+    }
+
+    @Test
+    public void passwordLoginWithNonDiscoverableKey() throws IOException {
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.PASSKEYS.getOptions());
+
+        // set passwordless policy not specified, key will not be discoverable
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+
+            events.clear();
+
+            // login should be done manually but webauthn is enabled
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+
+            // invalid login first
+            loginPage.login(USERNAME, "invalid-password");
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameInputError(), Matchers.is("Invalid username or password."));
+            MatcherAssert.assertThat(loginPage.getPasswordInputError(), Matchers.nullValue());
+            events.expect(EventType.LOGIN_ERROR)
+                    .detail(Details.USERNAME, USERNAME)
+                    .error(Errors.INVALID_USER_CREDENTIALS)
+                    .user(user.getId())
+                    .assertEvent();
+
+            // login OK now
+            loginPage.login(USERNAME, getPassword(USERNAME));
+            appPage.assertCurrent();
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, USERNAME)
+                    .detail(Details.CREDENTIAL_TYPE, Matchers.nullValue())
+                    .assertEvent();
+        }
+    }
+
+    @Test
+    public void passwordLoginWithExternalKey() throws Exception {
+        // use a default resident key which is not shown in conditional UI
+        getVirtualAuthManager().useAuthenticator(DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY.getOptions());
+
+        // set passwordless policy for discoverable keys
+        try (Closeable c = getWebAuthnRealmUpdater()
+                .setWebAuthnPolicyRpEntityName("localhost")
+                .setWebAuthnPolicyRequireResidentKey(Constants.WEBAUTHN_POLICY_OPTION_YES)
+                .setWebAuthnPolicyUserVerificationRequirement(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED)
+                .setWebAuthnPolicyPasskeysEnabled(Boolean.TRUE)
+                .update()) {
+
+            checkWebAuthnConfiguration(Constants.WEBAUTHN_POLICY_OPTION_YES, Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);
+
+            registerDefaultUser();
+
+            UserRepresentation user = userResource().toRepresentation();
+            MatcherAssert.assertThat(user, Matchers.notNullValue());
+
+            logout();
+            events.clear();
+
+            // open login page, the key is not internal so not opened by default
+            oauth.openLoginForm();
+            WaitUtils.waitForPageToLoad();
+
+            loginPage.assertCurrent();
+            MatcherAssert.assertThat(loginPage.getUsernameAutocomplete(), Matchers.is("username webauthn"));
+            MatcherAssert.assertThat(driver.findElement(By.xpath("//form[@id='webauth']")), Matchers.notNullValue());
+
+            // force login using webauthn link
+            webAuthnLoginPage.clickAuthenticate();
+            appPage.assertCurrent();
+
+            events.expectLogin()
+                    .user(user.getId())
+                    .detail(Details.USERNAME, user.getUsername())
+                    .detail(Details.CREDENTIAL_TYPE, WebAuthnCredentialModel.TYPE_PASSWORDLESS)
+                    .detail(WebAuthnConstants.USER_VERIFICATION_CHECKED, "true")
+                    .assertEvent();
+            logout();
+        }
+    }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/AttestationConveyanceRegisterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/AttestationConveyanceRegisterTest.java
index 19bbcc36ada9..dc8c919bf65a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/AttestationConveyanceRegisterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/AttestationConveyanceRegisterTest.java
@@ -18,7 +18,8 @@
 package org.keycloak.testsuite.webauthn.registration;
 
 import com.webauthn4j.data.AttestationConveyancePreference;
-import org.junit.Ignore;
+import com.webauthn4j.data.attestation.statement.NoneAttestationStatement;
+import com.webauthn4j.data.attestation.statement.PackedAttestationStatement;
 import org.junit.Test;
 import org.keycloak.models.credential.dto.WebAuthnCredentialData;
 import org.keycloak.testsuite.arquillian.annotation.IgnoreBrowserDriver;
@@ -63,23 +64,32 @@ public void attestationDefaultValue() {
         });
     }
 
-    @Ignore("invalid cert path")
     @Test
     public void attestationConveyancePreferenceNone() {
         assertAttestationConveyance(true, AttestationConveyancePreference.NONE);
     }
 
-    @Ignore("invalid cert path")
     @Test
     public void attestationConveyancePreferenceIndirect() {
-        assertAttestationConveyance(true, AttestationConveyancePreference.INDIRECT);
+        try {
+            // webauthn virtual emulator in chrome sets a self signed certificate every time, truststore needs to be disabled
+            testingClient.testing().disableTruststoreSpi();
+            assertAttestationConveyance(true, AttestationConveyancePreference.INDIRECT);
+        } finally {
+            testingClient.testing().reenableTruststoreSpi();
+        }
     }
 
-    @Ignore("invalid cert path")
     @Test
     public void attestationConveyancePreferenceDirect() {
         getVirtualAuthManager().useAuthenticator(DEFAULT.getOptions().setHasResidentKey(true).setIsUserConsenting(true).setHasUserVerification(true));
-        assertAttestationConveyance(true, AttestationConveyancePreference.DIRECT);
+        try {
+            // webauthn virtual emulator in chrome sets a self signed certificate every time, truststore needs to be disabled
+            testingClient.testing().disableTruststoreSpi();
+            assertAttestationConveyance(true, AttestationConveyancePreference.DIRECT);
+        } finally {
+            testingClient.testing().reenableTruststoreSpi();
+        }
     }
 
     protected void assertAttestationConveyance(boolean shouldSuccess, AttestationConveyancePreference attestation) {
@@ -102,6 +112,7 @@ protected void assertAttestationConveyance(boolean shouldSuccess, AttestationCon
             assertThat(isErrorCurrent, is(!shouldSuccess));
 
             final String credentialType = getCredentialType();
+            final String attestationValue = attestation.getValue();
 
             getTestingClient().server(TEST_REALM_NAME).run(session -> {
                 final WebAuthnDataWrapper dataWrapper = new WebAuthnDataWrapper(session, USERNAME, credentialType);
@@ -109,7 +120,11 @@ protected void assertAttestationConveyance(boolean shouldSuccess, AttestationCon
 
                 final WebAuthnCredentialData data = dataWrapper.getWebAuthnData();
                 assertThat(data, notNullValue());
-                assertThat(data.getAttestationStatementFormat(), is(attestation.getValue()));
+                if (attestationValue.equals(AttestationConveyancePreference.NONE.getValue())) {
+                    assertThat(data.getAttestationStatementFormat(), is(NoneAttestationStatement.FORMAT));
+                } else {
+                    assertThat(data.getAttestationStatementFormat(), is(PackedAttestationStatement.FORMAT));
+                }
             });
         } catch (IOException e) {
             throw new RuntimeException(e);
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PolicyJsInjectionTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PolicyJsInjectionTest.java
index f764b3c93868..0b9f228dafd9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PolicyJsInjectionTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PolicyJsInjectionTest.java
@@ -153,7 +153,7 @@ public void injectUserLabel() {
 
             loginPage.open();
             loginPage.assertCurrent(TEST_REALM_NAME);
-            loginPage.login(USERNAME, PASSWORD);
+            loginPage.login(USERNAME, getPassword(USERNAME));
 
             webAuthnLoginPage.assertCurrent();
             WebAuthnAuthenticatorsList authenticators = webAuthnLoginPage.getAuthenticators();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java
index cdf7b744f671..f71aa490eba3 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/PubKeySignRegisterTest.java
@@ -100,6 +100,7 @@ private void assertPublicKeyAlgorithms(boolean shouldSuccess, COSEAlgorithmIdent
             }
 
             final String credentialType = getCredentialType();
+            final long selectedAlgorithmValue = selectedAlgorithm.getValue();
 
             getTestingClient().server(TEST_REALM_NAME).run(session -> {
                 final WebAuthnDataWrapper dataWrapper = new WebAuthnDataWrapper(session, USERNAME, credentialType);
@@ -111,7 +112,7 @@ private void assertPublicKeyAlgorithms(boolean shouldSuccess, COSEAlgorithmIdent
                 final COSEKey pubKey = dataWrapper.getKey();
                 assertThat(pubKey, notNullValue());
                 assertThat(pubKey.getAlgorithm(), notNullValue());
-                assertThat(pubKey.getAlgorithm().getValue(), is(selectedAlgorithm.getValue()));
+                assertThat(pubKey.getAlgorithm().getValue(), is(selectedAlgorithmValue));
                 assertThat(pubKey.hasPublicKey(), is(true));
             });
         } catch (IOException e) {
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/ResidentKeyRegisterTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/ResidentKeyRegisterTest.java
index e11c045113a6..5df3ba20aa45 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/ResidentKeyRegisterTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/ResidentKeyRegisterTest.java
@@ -35,8 +35,8 @@
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.keycloak.WebAuthnConstants.OPTION_REQUIRED;
 import static org.keycloak.models.Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
+import static org.keycloak.models.Constants.WEBAUTHN_POLICY_OPTION_REQUIRED;
 import static org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions.DEFAULT_RESIDENT_KEY;
 
 /**
@@ -70,7 +70,7 @@ private void assertResidentKey(boolean shouldSuccess, PropertyRequirement requir
 
         if (hasResidentKey) {
             getVirtualAuthManager().useAuthenticator(DEFAULT_RESIDENT_KEY.getOptions());
-            userVerification = OPTION_REQUIRED;
+            userVerification = WEBAUTHN_POLICY_OPTION_REQUIRED;
         } else {
             userVerification = DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/WebAuthnOtherSettingsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/WebAuthnOtherSettingsTest.java
index d2851f1fcbea..8862c554cd3c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/WebAuthnOtherSettingsTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/webauthn/registration/WebAuthnOtherSettingsTest.java
@@ -137,7 +137,7 @@ public void timeout() throws IOException {
             loginPage.clickRegister();
             registerPage.assertCurrent();
 
-            registerPage.register("firstName", "lastName", EMAIL, USERNAME, PASSWORD, PASSWORD);
+            registerPage.register("firstName", "lastName", EMAIL, USERNAME, generatePassword(USERNAME));
 
             // User was registered. Now he needs to register WebAuthn credential
             webAuthnRegisterPage.assertCurrent();
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/AbstractX509AuthenticationTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/AbstractX509AuthenticationTest.java
index 7de027ab3944..9760173d52e0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/AbstractX509AuthenticationTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/AbstractX509AuthenticationTest.java
@@ -105,6 +105,7 @@
 public abstract class AbstractX509AuthenticationTest extends AbstractTestRealmKeycloakTest {
 
     public static final String EMPTY_CRL_PATH = "empty.crl";
+    public static final String EMPTY_EXPIRED_CRL_PATH = "empty-expired.crl";
     public static final String INTERMEDIATE_CA_CRL_PATH = "intermediate-ca.crl";
     public static final String INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH = "intermediate-ca-invalid-signature.crl";
     public static final String INTERMEDIATE_CA_3_CRL_PATH = "intermediate-ca-3.crl";
@@ -564,7 +565,7 @@ protected void x509BrowserLogin(X509AuthenticatorConfigModel config, String user
         String cfgId = createConfig(browserExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         WaitUtils.waitForPageToLoad();
 
@@ -574,7 +575,7 @@ protected void x509BrowserLogin(X509AuthenticatorConfigModel config, String user
         loginConfirmationPage.confirm();
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         AssertEvents.ExpectedEvent expectedEvent = events.expectLogin()
                 .user(userId)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/CRLRule.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/CRLRule.java
index 0b086e5597fc..b2375a32220d 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/CRLRule.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/CRLRule.java
@@ -21,6 +21,8 @@
 import java.io.FileInputStream;
 import java.io.InputStream;
 import java.nio.ByteBuffer;
+import java.util.HashMap;
+import java.util.Map;
 
 import io.undertow.Undertow;
 import io.undertow.io.Sender;
@@ -50,17 +52,21 @@ public class CRLRule extends ExternalResource {
     public static final String CRL_RESPONDER_ORIGIN = "http://" + CRL_RESPONDER_HOST + ":" + CRL_RESPONDER_PORT;
 
     private Undertow crlResponder;
+    private Map<String, CRLHandler> handlers;
+    private PathHandler pathHandler;
 
     @Override
     protected void before() throws Throwable {
         log.info("Starting CRL Responder");
 
-        PathHandler pathHandler = new PathHandler();
-        pathHandler.addExactPath(AbstractX509AuthenticationTest.EMPTY_CRL_PATH, new CRLHandler(AbstractX509AuthenticationTest.EMPTY_CRL_PATH));
-        pathHandler.addExactPath(AbstractX509AuthenticationTest.INTERMEDIATE_CA_CRL_PATH, new CRLHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_CRL_PATH));
-        pathHandler.addExactPath(AbstractX509AuthenticationTest.INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH, new CRLHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH));
-        pathHandler.addExactPath(AbstractX509AuthenticationTest.INTERMEDIATE_CA_3_CRL_PATH, new CRLHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_3_CRL_PATH));
-        pathHandler.addExactPath(AbstractX509AuthenticationTest.INVALID_CRL_PATH, new CRLHandler(AbstractX509AuthenticationTest.INVALID_CRL_PATH));
+        handlers = new HashMap<>();
+        pathHandler = new PathHandler();
+        addHandler(AbstractX509AuthenticationTest.EMPTY_CRL_PATH, AbstractX509AuthenticationTest.EMPTY_CRL_PATH);
+        addHandler(AbstractX509AuthenticationTest.EMPTY_EXPIRED_CRL_PATH, AbstractX509AuthenticationTest.EMPTY_EXPIRED_CRL_PATH);
+        addHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_CRL_PATH, AbstractX509AuthenticationTest.INTERMEDIATE_CA_CRL_PATH);
+        addHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH, AbstractX509AuthenticationTest.INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH);
+        addHandler(AbstractX509AuthenticationTest.INTERMEDIATE_CA_3_CRL_PATH, AbstractX509AuthenticationTest.INTERMEDIATE_CA_3_CRL_PATH);
+        addHandler(AbstractX509AuthenticationTest.INVALID_CRL_PATH, AbstractX509AuthenticationTest.INVALID_CRL_PATH);
 
         crlResponder = Undertow.builder().addHttpListener(CRL_RESPONDER_PORT, CRL_RESPONDER_HOST)
                 .setHandler(
@@ -76,15 +82,50 @@ protected void after() {
         crlResponder.stop();
     }
 
+    public void addHandler(String path, String crlFileName) {
+        CRLHandler handler = new CRLHandler(crlFileName);
+        handlers.put(path, handler);
+        pathHandler.addExactPath(path, handler);
+    }
+
+    public void removeHandler(String path) {
+        handlers.remove(path);
+        pathHandler.removeExactPath(path);
+    }
+
+    public void setCrlForHandler(String path, String crlFileName) {
+        handlers.get(path).SetFileName(crlFileName);
+    }
+
+    public int getCounter(String path) {
+        return handlers.get(path).getCounter();
+    }
+
+    public void resetCounter(String path) {
+        handlers.get(path).resetCounter();
+    }
 
     private class CRLHandler implements HttpHandler {
 
         private String crlFileName;
+        private int counter;
 
         public CRLHandler(String crlFileName) {
             this.crlFileName = crlFileName;
+            counter = 0;
+        }
+
+        public void SetFileName(String crlFileName) {
+            this.crlFileName = crlFileName;
         }
 
+        public int getCounter() {
+            return counter;
+        }
+
+        public void resetCounter() {
+            counter = 0;
+        }
 
         @Override
         public void handleRequest(HttpServerExchange exchange) throws Exception {
@@ -93,6 +134,7 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
                 return;
             }
 
+            counter++;
             String fullFile = AbstractX509AuthenticationTest.getAuthServerHome() + File.separator + crlFileName;
             InputStream is = new FileInputStream(new File(fullFile));
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserCRLTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserCRLTest.java
index 0eb9efe03939..c50143b36ee9 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserCRLTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserCRLTest.java
@@ -28,6 +28,7 @@
 import org.keycloak.models.Constants;
 import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
 import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.util.AccountHelper;
 import org.keycloak.testsuite.util.ContainerAssume;
 import org.keycloak.testsuite.util.HtmlUnitBrowser;
 import org.openqa.selenium.WebDriver;
@@ -64,6 +65,7 @@ public void loginSuccessWithEmptyRevocationListFromFile() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(EMPTY_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -71,6 +73,25 @@ public void loginSuccessWithEmptyRevocationListFromFile() {
         x509BrowserLogin(config, userId, "test-user@localhost", "test-user@localhost");
     }
 
+    @Test
+    public void loginFailureWithEmptyRevocationListFromFileButExpired() {
+        // Not possible to test file CRL on undertow at this moment - jboss config dir doesn't exist
+        ContainerAssume.assumeNotAuthServerUndertow();
+
+        X509AuthenticatorConfigModel config =
+                new X509AuthenticatorConfigModel()
+                        .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
+                        .setCRLRelativePath(EMPTY_EXPIRED_CRL_PATH)
+                        .setConfirmationPageAllowed(true)
+                        .setMappingSourceType(SUBJECTDN_EMAIL)
+                        .setUserIdentityMapperType(USERNAME_EMAIL);
+        AuthenticatorConfigRepresentation cfg = newConfig("x509-browser-config", config.getConfig());
+        String cfgId = createConfig(browserExecution.getId(), cfg);
+        Assert.assertNotNull(cfgId);
+
+        assertLoginFailedDueRevokedCertificate();
+    }
 
     @Test
     public void loginFailedWithIntermediateRevocationListFromFile() {
@@ -80,6 +101,7 @@ public void loginFailedWithIntermediateRevocationListFromFile() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(INTERMEDIATE_CA_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -97,6 +119,7 @@ public void loginSuccessWithEmptyRevocationListFromHttp() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + EMPTY_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -104,12 +127,77 @@ public void loginSuccessWithEmptyRevocationListFromHttp() {
         x509BrowserLogin(config, userId, "test-user@localhost", "test-user@localhost");
     }
 
+    @Test
+    public void loginFailureWithEmptyRevocationListFromHttpButExpired() {
+        X509AuthenticatorConfigModel config =
+                new X509AuthenticatorConfigModel()
+                        .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
+                        .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + EMPTY_EXPIRED_CRL_PATH)
+                        .setConfirmationPageAllowed(true)
+                        .setMappingSourceType(SUBJECTDN_EMAIL)
+                        .setUserIdentityMapperType(USERNAME_EMAIL);
+        AuthenticatorConfigRepresentation cfg = newConfig("x509-browser-config", config.getConfig());
+        String cfgId = createConfig(browserExecution.getId(), cfg);
+        Assert.assertNotNull(cfgId);
+
+        assertLoginFailedDueRevokedCertificate();
+    }
+
+    @Test
+    public void loginTestCRLCaching() {
+        X509AuthenticatorConfigModel config =
+                new X509AuthenticatorConfigModel()
+                        .setCRLEnabled(true)
+                        .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/cached-crl")
+                        .setConfirmationPageAllowed(true)
+                        .setMappingSourceType(SUBJECTDN_EMAIL)
+                        .setUserIdentityMapperType(USERNAME_EMAIL);
+        AuthenticatorConfigRepresentation cfg = newConfig("x509-browser-config", config.getConfig());
+        String cfgId = createConfig(browserExecution.getId(), cfg);
+        Assert.assertNotNull(cfgId);
+
+        try {
+            // change CRL to the empty but expired, it should login OK
+            crlRule.addHandler("cached-crl", EMPTY_EXPIRED_CRL_PATH);
+            x509BrowserLogin(config, userId, "test-user@localhost", "test-user@localhost");
+            AccountHelper.logout(testRealm(), "test-user@localhost");
+            Assert.assertEquals(1, crlRule.getCounter("cached-crl"));
+
+            // change the CRL to the new one but it is cached the min time
+            crlRule.setCrlForHandler("cached-crl", INTERMEDIATE_CA_CRL_PATH);
+            x509BrowserLogin(config, userId, "test-user@localhost", "test-user@localhost");
+            AccountHelper.logout(testRealm(), "test-user@localhost");
+            Assert.assertEquals(1, crlRule.getCounter("cached-crl"));
+
+            // wait the min time and it should be refreshed now and fail
+            setTimeOffset(10);
+            assertLoginFailedDueRevokedCertificate();
+            AccountHelper.logout(testRealm(), "test-user@localhost");
+            Assert.assertEquals(2, crlRule.getCounter("cached-crl"));
+
+            // now it's cached until next update 50 years
+            setTimeOffset(3600);
+            assertLoginFailedDueRevokedCertificate();
+            AccountHelper.logout(testRealm(), "test-user@localhost");
+            Assert.assertEquals(2, crlRule.getCounter("cached-crl"));
+
+            // clear the cache
+            testRealm().clearCrlCache();
+            assertLoginFailedDueRevokedCertificate();
+            AccountHelper.logout(testRealm(), "test-user@localhost");
+            Assert.assertEquals(3, crlRule.getCounter("cached-crl"));
+        } finally {
+            crlRule.removeHandler("cached-crl");
+        }
+    }
 
     @Test
     public void loginFailedWithIntermediateRevocationListFromHttp() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + INTERMEDIATE_CA_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -127,6 +215,7 @@ public void loginFailedWithInvalidSignatureCRL() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + INTERMEDIATE_CA_INVALID_SIGNATURE_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -145,6 +234,7 @@ public void loginSuccessWithCRLSignedWithIntermediateCA3FromTruststore() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(false)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + INTERMEDIATE_CA_3_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -163,6 +253,7 @@ public void loginWithMultipleRevocationLists() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + EMPTY_CRL_PATH + Constants.CFG_DELIMITER + CRLRule.CRL_RESPONDER_ORIGIN + "/" + INTERMEDIATE_CA_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -182,6 +273,7 @@ public void loginWithMultipleRevocationListsUsingInvalidCert() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(false)
                         .setCRLRelativePath(CRLRule.CRL_RESPONDER_ORIGIN + "/" + INVALID_CRL_PATH)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -198,6 +290,7 @@ public void loginFailedWithRevocationListFromDistributionPoints() {
         X509AuthenticatorConfigModel config =
                 new X509AuthenticatorConfigModel()
                         .setCRLEnabled(true)
+                        .setCrlAbortIfNonUpdated(true)
                         .setCRLDistributionPointEnabled(true)
                         .setConfirmationPageAllowed(true)
                         .setMappingSourceType(SUBJECTDN_EMAIL)
@@ -216,7 +309,7 @@ private void assertLoginFailedDueRevokedCertificate() {
     }
 
     private void assertLoginFailedWithExpectedX509Error(String expectedError) {
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
         loginPage.assertCurrent();
 
         // Verify there is an error message
@@ -228,7 +321,7 @@ private void assertLoginFailedWithExpectedX509Error(String expectedError) {
         loginPage.login("test-user@localhost", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin()
                 .user(userId)
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserLoginTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserLoginTest.java
index 470e04add03e..d011bbd676b5 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserLoginTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509BrowserLoginTest.java
@@ -82,7 +82,7 @@ public void loginWithNonMatchingRegex() throws Exception {
         String cfgId = createConfig(browserExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         events.expectLogin()
                 .user((String) null)
@@ -101,7 +101,7 @@ public void loginWithNonSupportedCertKeyUsage() throws Exception {
         String cfgId = createConfig(browserExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         assertThat(loginPage.getError(), containsString("Certificate validation's failed.\n" +
                 "Certificate revoked or incorrect."));
@@ -127,7 +127,7 @@ public void loginWithRevalidateCertEnabledCertWithIncorrectTruststoreConfig() th
             String cfgId = createConfig(browserExecution.getId(), cfg);
             Assert.assertNotNull(cfgId);
 
-            loginConfirmationPage.open();
+            oauth.openLoginForm();
             loginPage.assertCurrent();
 
             // Verify there is an error message
@@ -146,7 +146,7 @@ public void loginIgnoreX509IdentityContinueToFormLogin() throws Exception {
         String cfgId = createConfig(browserExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         Assert.assertTrue(loginConfirmationPage.getSubjectDistinguishedNameText().startsWith("EMAILADDRESS=test-user@localhost"));
         Assert.assertEquals("test-user@localhost", loginConfirmationPage.getUsernameText());
@@ -155,7 +155,7 @@ public void loginIgnoreX509IdentityContinueToFormLogin() throws Exception {
         loginPage.login("test-user@localhost", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
          events.expectLogin()
                  .user(userId)
@@ -295,7 +295,7 @@ public void loginDuplicateUsersNotAllowed() {
         loginPage.login("test-user@localhost", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         events.expectLogin()
                 .user(userId)
@@ -307,7 +307,7 @@ public void loginDuplicateUsersNotAllowed() {
     @Test
     public void loginAttemptedNoConfig() {
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
         loginPage.assertCurrent();
 
         assertThat(loginPage.getInfoMessage(), containsString("X509 client authentication has not been configured yet"));
@@ -315,7 +315,7 @@ public void loginAttemptedNoConfig() {
         loginPage.login("test-user@localhost", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         events.expectLogin()
                 .user(userId)
                 .detail(Details.USERNAME, "test-user@localhost")
@@ -336,7 +336,7 @@ public void loginWithX509CertCustomAttributeUserNotFound() {
         String cfgId = createConfig(browserExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
         loginPage.assertCurrent();
 
         // Verify there is an error message
@@ -356,7 +356,7 @@ public void loginWithX509CertCustomAttributeUserNotFound() {
         loginPage.login("test-user@localhost", "password");
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
         events.expectLogin()
                 .user(userId)
                 .detail(Details.USERNAME, "test-user@localhost")
@@ -386,7 +386,7 @@ public void loginWithX509CertCustomAttributeSuccess() {
 
         events.clear();
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         Assert.assertTrue(loginConfirmationPage.getSubjectDistinguishedNameText().startsWith("EMAILADDRESS=test-user@localhost"));
         Assert.assertEquals("test-user@localhost", loginConfirmationPage.getUsernameText());
@@ -394,7 +394,7 @@ public void loginWithX509CertCustomAttributeSuccess() {
         loginConfirmationPage.confirm();
 
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
     }
 
     @Test
@@ -413,7 +413,7 @@ public void loginWithX509CertBadUserOrNotFound() {
         // TODO causes the test to fail
         //assertAdminEvents.assertEvent(REALM_NAME, OperationType.DELETE, AdminEventPaths.userResourcePath(userId));
 
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
         loginPage.assertCurrent();
 
         // Verify there is an error message
@@ -451,7 +451,7 @@ public void loginValidCertificateDisabledUser() {
             String cfgId = createConfig(browserExecution.getId(), cfg);
             Assert.assertNotNull(cfgId);
 
-            loginConfirmationPage.open();
+            oauth.openLoginForm();
             loginPage.assertCurrent();
 
             Assert.assertNotNull(loginPage.getError());
@@ -507,7 +507,7 @@ public void loginNoIdentityConfirmationPage() {
         // user and automatically logs the user in without prompting to confirm
         // the identity.
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
-        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+        Assert.assertNotNull(oauth.parseLoginResponse().getCode());
 
         AssertEvents.ExpectedEvent expectedEvent = events.expectLogin()
                 .user(userId)
@@ -523,7 +523,7 @@ public void loginNoIdentityConfirmationPage() {
     @Test
     public void loginWithCertificateAddedLater() throws Exception {
         // Start with normal login form
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
         loginPage.assertCurrent();
 
         assertThat(loginPage.getInfoMessage(), containsString("X509 client authentication has not been configured yet"));
@@ -541,7 +541,7 @@ public void changeLocaleOnX509InfoPage() {
         Assert.assertNotNull(cfgId);
 
         log.debug("Open confirm page");
-        loginConfirmationPage.open();
+        oauth.openLoginForm();
 
         log.debug("check if on confirm page");
         assertThat(loginConfirmationPage.getSubjectDistinguishedNameText(), startsWith("EMAILADDRESS=test-user@localhost"));
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java
index 0b03444d70ac..78b9bc1e88ac 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java
@@ -33,7 +33,7 @@
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.util.ContainerAssume;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.HtmlUnitBrowser;
 import org.openqa.selenium.WebDriver;
 
@@ -88,8 +88,8 @@ public void loginFailedOnDuplicateUsers() throws Exception {
 
         events.clear();
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(401, response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -111,8 +111,8 @@ public void loginFailedOnInvalidUser() throws Exception {
 
         events.clear();
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         events.expectLogin()
                 .user((String) null)
@@ -138,8 +138,8 @@ public void loginWithNonSupportedCertKeyUsage() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(401, response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -155,8 +155,8 @@ public void loginWithNonSupportedCertExtendedKeyUsage() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(200, response.getStatusCode());
     }
@@ -170,8 +170,8 @@ public void loginWithNonMatchingRegex() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(401, response.getStatusCode());
 
@@ -197,8 +197,8 @@ public void loginFailedDisabledUser() throws Exception {
             String cfgId = createConfig(directGrantExecution.getId(), cfg);
             Assert.assertNotNull(cfgId);
 
-            oauth.clientId("resource-owner");
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+            oauth.client("resource-owner", "secret");
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
             events.expectLogin()
                     .user(userId)
@@ -236,8 +236,8 @@ public void loginCertificateRevoked() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(401, response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -257,8 +257,8 @@ public void loginCertificateNotExpired() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(200, response.getStatusCode());
     }
@@ -277,8 +277,8 @@ public void loginCertificateExpired() throws Exception {
 
         setTimeOffset(50 * 365 * 24 * 60 * 60);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         setTimeOffset(0);
 
@@ -306,10 +306,10 @@ private void loginForceTemporaryAccountLock() throws Exception {
 
         events.clear();
 
-        oauth.clientId("resource-owner");
-        oauth.doGrantAccessTokenRequest("secret", "", "", null);
-        oauth.doGrantAccessTokenRequest("secret", "", "", null);
-        oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        oauth.doPasswordGrantRequest("", "");
+        oauth.doPasswordGrantRequest("", "");
+        oauth.doPasswordGrantRequest("", "");
 
         events.clear();
     }
@@ -325,8 +325,8 @@ public void loginFailedTemporarilyDisabledUser() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         events.expectLogin()
                 .user(userId)
@@ -346,8 +346,8 @@ public void loginFailedTemporarilyDisabledUser() throws Exception {
 
     private void doResourceOwnerCredentialsLogin(String clientId, String clientSecret, String login, String password) throws Exception {
 
-        oauth.clientId(clientId);
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest(clientSecret, "", "", null);
+        oauth.client(clientId, clientSecret);
+        AccessTokenResponse response = oauth.doPasswordGrantRequest( "", "");
 
         assertEquals(200, response.getStatusCode());
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderFailOpenTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderFailOpenTest.java
index 4f5d48f97fd8..e435b5e5464c 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderFailOpenTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderFailOpenTest.java
@@ -1,28 +1,27 @@
 package org.keycloak.testsuite.x509;
 
 import io.undertow.Undertow;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Paths;
-import java.util.function.Supplier;
-
 import jakarta.ws.rs.core.Response;
-
 import org.apache.commons.io.IOUtils;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.jboss.arquillian.drone.api.annotation.Drone;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
-import org.keycloak.testsuite.util.HtmlUnitBrowser;
 import org.keycloak.authentication.authenticators.x509.X509AuthenticatorConfigModel;
 import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.HtmlUnitBrowser;
+import org.keycloak.testsuite.util.MutualTLSUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.HttpClientManager;
 import org.openqa.selenium.WebDriver;
 
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Paths;
+
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.assertEquals;
-import static org.hamcrest.MatcherAssert.assertThat;
 import static org.keycloak.authentication.authenticators.x509.X509AuthenticatorConfigModel.IdentityMapperType.USERNAME_EMAIL;
 import static org.keycloak.authentication.authenticators.x509.X509AuthenticatorConfigModel.MappingSourceType.SUBJECTDN_EMAIL;
 
@@ -58,8 +57,8 @@ public void ocspFailCloseLoginFailed() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -93,17 +92,16 @@ public void ocspFailOpenLoginSuccess() throws Exception {
         String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
         String trustStorePath = System.getProperty("client.truststore");
         String trustStorePassword = System.getProperty("client.truststore.passphrase");
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-        try {
-            oauth.clientId("resource-owner");
-            oauth.httpClient(() -> OAuthClient.newCloseableHttpClientSSL(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword));
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword)) {
+            oauth.client("resource-owner", "secret");
+            oauth.httpClient().set(client);
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
             // Make sure authentication is allowed
             assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
         } finally {
-            oauth.httpClient(previous);
+            oauth.httpClient().reset();
         }
     }
 
-}
\ No newline at end of file
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderSpecificCertTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderSpecificCertTest.java
index c7e5f54208b7..9bf59d904b51 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderSpecificCertTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderSpecificCertTest.java
@@ -25,7 +25,7 @@
 import org.junit.Test;
 import org.keycloak.authentication.authenticators.x509.X509AuthenticatorConfigModel;
 import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 import jakarta.ws.rs.core.Response;
 
@@ -76,8 +76,8 @@ public void loginFailedInvalidResponderOnOCSPResponderRevocationCheck() throws E
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -115,8 +115,8 @@ public void loginFailedOnOCSPResponderRevocationCheck() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
         assertEquals("invalid_request", response.getError());
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderTest.java
index a2bfbb252a86..6ff7674b28d1 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509OCSPResponderTest.java
@@ -26,7 +26,10 @@
 import org.keycloak.authentication.authenticators.x509.X509AuthenticatorConfigModel;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.representations.idm.AuthenticatorConfigRepresentation;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.MutualTLSUtils;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
+import org.keycloak.testsuite.util.oauth.OAuthClient;
+import org.keycloak.testsuite.util.oauth.HttpClientManager;
 
 import jakarta.ws.rs.core.Response;
 
@@ -41,7 +44,6 @@
 
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
-import java.util.function.Supplier;
 import org.apache.commons.io.IOUtils;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.keycloak.testsuite.util.HtmlUnitBrowser;
@@ -84,8 +86,8 @@ public void loginFailedOnOCSPResponderRevocationCheck() throws Exception {
         String cfgId = createConfig(directGrantExecution.getId(), cfg);
         Assert.assertNotNull(cfgId);
 
-        oauth.clientId("resource-owner");
-        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        oauth.client("resource-owner", "secret");
+        AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
         assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
         assertEquals("invalid_request", response.getError());
@@ -110,11 +112,10 @@ public void loginFailedOnOCSPResponderRevocationCheckWithoutCA() throws Exceptio
         String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
         String trustStorePath = System.getProperty("client.truststore");
         String trustStorePassword = System.getProperty("client.truststore.passphrase");
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-        try {
-            oauth.clientId("resource-owner");
-            oauth.httpClient(() -> OAuthClient.newCloseableHttpClientSSL(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword));
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword)) {
+            oauth.client("resource-owner", "secret");
+            oauth.httpClient().set(client);
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
             assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), response.getStatusCode());
             assertEquals("invalid_request", response.getError());
@@ -122,7 +123,7 @@ public void loginFailedOnOCSPResponderRevocationCheckWithoutCA() throws Exceptio
             // the ocsp signer cert is issued by the same CA but no OCSP-Signing extension so error
             assertThat(response.getErrorDescription(), containsString("Responder's certificate not valid for signing OCSP responses"));
         } finally {
-            oauth.httpClient(previous);
+            oauth.httpClient().reset();
         }
     }
 
@@ -143,16 +144,15 @@ public void loginClientCertSignedByIntermediateCA() throws Exception {
         String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
         String trustStorePath = System.getProperty("client.truststore");
         String trustStorePassword = System.getProperty("client.truststore.passphrase");
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-        try {
-            oauth.clientId("resource-owner");
-            oauth.httpClient(() -> OAuthClient.newCloseableHttpClientSSL(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword));
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword)) {
+            oauth.client("resource-owner", "secret");
+            oauth.httpClient().set(client);
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
             // now it's OK because the certificate is fixed
             assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
         } finally {
-            oauth.httpClient(previous);
+            oauth.httpClient().reset();
         }
     }
 
@@ -177,16 +177,15 @@ public void loginOKOnOCSPResponderRevocationCheckWithoutCA() throws Exception {
         String keyStorePassword = System.getProperty("client.certificate.keystore.passphrase");
         String trustStorePath = System.getProperty("client.truststore");
         String trustStorePassword = System.getProperty("client.truststore.passphrase");
-        Supplier<CloseableHttpClient> previous = oauth.getHttpClient();
-        try {
-            oauth.clientId("resource-owner");
-            oauth.httpClient(() -> OAuthClient.newCloseableHttpClientSSL(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword));
-            OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
+        try (CloseableHttpClient client = MutualTLSUtils.newCloseableHttpClient(keyStorePath, keyStorePassword, trustStorePath, trustStorePassword)) {
+            oauth.client("resource-owner", "secret");
+            oauth.httpClient().set(client);
+            AccessTokenResponse response = oauth.doPasswordGrantRequest("", "");
 
             // now it's OK because the certificate is fixed
             assertEquals(Response.Status.OK.getStatusCode(), response.getStatusCode());
         } finally {
-            oauth.httpClient(previous);
+            oauth.httpClient().reset();
         }
     }
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/META-INF/keycloak-server.json b/testsuite/integration-arquillian/tests/base/src/test/resources/META-INF/keycloak-server.json
index 664048aeca02..3822f4dd229f 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/META-INF/keycloak-server.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/META-INF/keycloak-server.json
@@ -173,21 +173,17 @@
         }
     },
 
-    "connectionsInfinispan": {
+    "cacheEmbedded": {
         "default": {
-            "jgroupsUdpMcastAddr": "${keycloak.connectionsInfinispan.jgroupsUdpMcastAddr:234.56.78.90}",
-            "jgroupsBindAddr": "${keycloak.connectionsInfinispan.jgroupsBindAddr:127.0.0.1}",
-            "nodeName": "${keycloak.connectionsInfinispan.nodeName,jboss.node.name:}",
-            "siteName": "${keycloak.connectionsInfinispan.siteName:}",
-            "clustered": "${keycloak.connectionsInfinispan.clustered:false}",
-            "async": "${keycloak.connectionsInfinispan.async:false}",
-            "sessionsOwners": "${keycloak.connectionsInfinispan.sessionsOwners:1}",
-            "l1Lifespan": "${keycloak.connectionsInfinispan.l1Lifespan:600000}",
-            "remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:false}",
-            "remoteStoreHost": "${keycloak.connectionsInfinispan.remoteStoreServer:localhost}",
-            "remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort:11222}",
-            "hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-            "embedded": "${keycloak.connectionsInfinispan.embedded:true}"
+            "nodeName": "${keycloak.cacheEmbedded.nodeName,jboss.node.name:}",
+            "configFile": "${keycloak.cacheEmbedded.configFile:local-test-ispn.xml}"
+        }
+    },
+
+    "cacheRemote": {
+        "default": {
+            "hostname": "${keycloak.cacheRemote.hostname:localhost}",
+            "port": "${keycloak.cacheRemote.port:11222}"
         }
     },
 
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/arquillian.xml b/testsuite/integration-arquillian/tests/base/src/test/resources/arquillian.xml
index a23238f9a04f..93cec1d41e3f 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/arquillian.xml
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/arquillian.xml
@@ -245,9 +245,7 @@
                 <property name="route">node1</property>
                 <property name="remoteMode">${undertow.remote}</property>
                 <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.8",
-                    "keycloak.connectionsInfinispan.nodeName": "node1",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}"
+                    "keycloak.cacheEmbedded.nodeName": "node1"
                     }
                 </property>
             </configuration>
@@ -264,9 +262,7 @@
                 <property name="route">node2</property>
                 <property name="remoteMode">${undertow.remote}</property>
                 <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.8",
-                    "keycloak.connectionsInfinispan.nodeName": "node2",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}"
+                    "keycloak.cacheEmbedded.nodeName": "node2"
                     }
                 </property>
             </configuration>
@@ -284,348 +280,6 @@
         </container>
     </group>
 
-
-    <!-- Cross DC. Node numbering is [centre #].[node #] -->
-    <group qualifier="auth-server-jboss-cross-dc">
-        <container qualifier="cache-server-legacy-cross-dc-1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.crossdc} &amp;&amp; ! ${cache.server.lifecycle.skip} &amp;&amp; ${cache.server.legacy}</property>
-                <property name="adapterImplClass">org.jboss.as.arquillian.container.managed.ManagedDeployableContainer</property>
-                <property name="jbossHome">${cache.server.home}</property>
-                <property name="serverConfig">clustered-1.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${cache.server.1.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.99
-                    -Djboss.node.name=cache-server-dc-1
-                    ${adapter.test.props}
-                    ${auth.server.profile}
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${cache.server.crossdc1.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="outputToConsole">${cache.server.console.output}</property>
-                <property name="managementPort">${cache.server.management.port}</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-                <property name="javaHome">${cache.server.java.home}</property>
-            </configuration>
-        </container>
-
-        <container qualifier="cache-server-legacy-cross-dc-2" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.crossdc} &amp;&amp; ! ${cache.server.lifecycle.skip} &amp;&amp; ${cache.server.legacy}</property>
-                <property name="adapterImplClass">org.jboss.as.arquillian.container.managed.ManagedDeployableContainer</property>
-                <property name="jbossHome">${cache.server.home}</property>
-                <property name="setupCleanServerBaseDir">true</property>
-                <property name="cleanServerBaseDir">${cache.server.home}/standalone-dc-2</property>
-                <property name="serverConfig">clustered-2.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${cache.server.2.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.100
-                    -Djboss.node.name=cache-server-dc-2
-                    ${adapter.test.props}
-                    ${auth.server.profile}
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${cache.server.crossdc2.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="outputToConsole">${cache.server.console.output}</property>
-                <property name="managementPort">${cache.server.2.management.port}</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-                <property name="javaHome">${cache.server.java.home}</property>
-            </configuration>
-        </container>
-
-        <container qualifier="cache-server-cross-dc-1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.crossdc} &amp;&amp; ! ${cache.server.lifecycle.skip} &amp;&amp; ! ${cache.server.legacy}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.containers.InfinispanServerDeployableContainer</property>
-                <property name="infinispanHome">${cache.server.home}-dc1</property>
-                <property name="serverConfig">infinispan-xsite.xml</property>
-                <property name="portOffset">${cache.server.1.port.offset}</property>
-                <property name="managementPort">${cache.server.management.port}</property>
-                <property name="javaVmArguments">
-                    -Djgroups.udp.mcast_port=46698 
-                    -Djgroups.tcpping.initial_hosts=127.0.0.1[8810],127.0.0.1[9810]
-                </property>
-                <property name="javaHome">${cache.server.java.home}</property>
-            </configuration>
-        </container>
-        <container qualifier="cache-server-cross-dc-2" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.crossdc} &amp;&amp; ! ${cache.server.lifecycle.skip} &amp;&amp; ! ${cache.server.legacy}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.containers.InfinispanServerDeployableContainer</property>
-                <property name="infinispanHome">${cache.server.home}-dc2</property>
-                <property name="serverConfig">infinispan-xsite.xml</property>
-                <property name="portOffset">${cache.server.2.port.offset}</property>
-                <property name="managementPort">${cache.server.2.management.port}</property>
-                <property name="javaVmArguments">
-                    -Djgroups.udp.mcast_port=47698 
-                    -Djgroups.tcpping.initial_hosts=127.0.0.1[8810],127.0.0.1[9810]
-                </property>
-                <property name="javaHome">${cache.server.java.home}</property>
-            </configuration>
-        </container>
-
-        <container qualifier="auth-server-balancer-cross-dc" mode="suite" >
-            <configuration>
-                <property name="enabled">${auth.server.crossdc}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.undertow.lb.SimpleUndertowLoadBalancerContainer</property>
-                <property name="bindAddress">localhost</property>
-                <property name="bindHttpPort">${auth.server.http.port}</property>
-                <property name="nodes">auth-server-${node.name}-cross-dc-0_1=http://localhost:8101,auth-server-${node.name}-cross-dc-0_2-manual=http://localhost:8102,auth-server-${node.name}-cross-dc-1_1=http://localhost:8111,auth-server-${node.name}-cross-dc-1_2-manual=http://localhost:8112</property>
-            </configuration>
-        </container>
-
-        <container qualifier="auth-server-undertow-cross-dc-0_1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.undertow.crossdc}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.undertow.KeycloakOnUndertow</property>
-                <property name="bindAddress">localhost</property>
-                <property name="bindHttpPort">${auth.server.http.port}</property>
-                <property name="bindHttpsPort">${auth.server.https.port}</property>
-                <property name="bindHttpPortOffset">-79</property>
-                <property name="bindHttpsPortOffset">-79</property>
-                <property name="remoteMode">${undertow.remote}</property>
-                <property name="dataCenter">0</property>
-                <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.1",
-                    "keycloak.connectionsInfinispan.siteName": "dc-0",
-                    "keycloak.connectionsInfinispan.nodeName": "auth-server-undertow-cross-dc-0_1",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}",
-                    "keycloak.connectionsInfinispan.remoteStoreServer": "${keycloak.connectionsInfinispan.remoteStoreServer:localhost}",
-                    "keycloak.connectionsInfinispan.remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort:11222}",
-                    "keycloak.connectionsInfinispan.remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:true}",
-                    "keycloak.connectionsInfinispan.hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-                    "keycloak.connectionsJpa.url": "${keycloak.connectionsJpa.url.crossdc:jdbc:h2:mem:test-dc-shared}",
-                    "keycloak.connectionsJpa.driver": "${keycloak.connectionsJpa.driver.crossdc:org.h2.Driver}",
-                    "keycloak.connectionsJpa.driverDialect": "${keycloak.connectionsJpa.driverDialect.crossdc:}"
-                }</property>
-            </configuration>
-        </container>
-        <container qualifier="auth-server-undertow-cross-dc-0_2-manual" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.undertow.crossdc}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.undertow.KeycloakOnUndertow</property>
-                <property name="bindAddress">localhost</property>
-                <property name="bindHttpPort">${auth.server.http.port}</property>
-                <property name="bindHttpsPort">${auth.server.https.port}</property>
-                <property name="bindHttpPortOffset">-78</property>
-                <property name="bindHttpsPortOffset">-78</property>
-                <property name="remoteMode">${undertow.remote}</property>
-                <property name="dataCenter">0</property>
-                <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.1",
-                    "keycloak.connectionsInfinispan.siteName": "dc-0",
-                    "keycloak.connectionsInfinispan.nodeName": "auth-server-undertow-cross-dc-0_2-manual",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}",
-                    "keycloak.connectionsInfinispan.remoteStoreServer": "${keycloak.connectionsInfinispan.remoteStoreServer:localhost}",
-                    "keycloak.connectionsInfinispan.remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort:11222}",
-                    "keycloak.connectionsInfinispan.remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:true}",
-                    "keycloak.connectionsInfinispan.hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-                    "keycloak.connectionsJpa.url": "${keycloak.connectionsJpa.url.crossdc:jdbc:h2:mem:test-dc-shared}",
-                    "keycloak.connectionsJpa.driver": "${keycloak.connectionsJpa.driver.crossdc:org.h2.Driver}",
-                    "keycloak.connectionsJpa.driverDialect": "${keycloak.connectionsJpa.driverDialect.crossdc:}"
-                }</property>
-            </configuration>
-        </container>
-
-        <container qualifier="auth-server-undertow-cross-dc-1_1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.undertow.crossdc}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.undertow.KeycloakOnUndertow</property>
-                <property name="bindAddress">localhost</property>
-                <property name="bindHttpPort">${auth.server.http.port}</property>
-                <property name="bindHttpsPort">${auth.server.https.port}</property>
-                <property name="bindHttpPortOffset">-69</property>
-                <property name="bindHttpsPortOffset">-69</property>
-                <property name="remoteMode">${undertow.remote}</property>
-                <property name="dataCenter">1</property>
-                <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.2",
-                    "keycloak.connectionsInfinispan.siteName": "dc-1",
-                    "keycloak.connectionsInfinispan.nodeName": "auth-server-undertow-cross-dc-1_1",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}",
-                    "keycloak.connectionsInfinispan.remoteStoreServer": "${keycloak.connectionsInfinispan.remoteStoreServer:localhost}",
-                    "keycloak.connectionsInfinispan.remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort.2:11222}",
-                    "keycloak.connectionsInfinispan.remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:true}",
-                    "keycloak.connectionsInfinispan.hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-                    "keycloak.connectionsJpa.url": "${keycloak.connectionsJpa.url.crossdc:jdbc:h2:mem:test-dc-shared}",
-                    "keycloak.connectionsJpa.driver": "${keycloak.connectionsJpa.driver.crossdc:org.h2.Driver}",
-                    "keycloak.connectionsJpa.driverDialect": "${keycloak.connectionsJpa.driverDialect.crossdc:}"
-                }</property>
-            </configuration>
-        </container>
-        <container qualifier="auth-server-undertow-cross-dc-1_2-manual" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.undertow.crossdc}</property>
-                <property name="adapterImplClass">org.keycloak.testsuite.arquillian.undertow.KeycloakOnUndertow</property>
-                <property name="bindAddress">localhost</property>
-                <property name="bindHttpPort">${auth.server.http.port}</property>
-                <property name="bindHttpsPort">${auth.server.https.port}</property>
-                <property name="bindHttpPortOffset">-68</property>
-                <property name="bindHttpsPortOffset">-68</property>
-                <property name="remoteMode">${undertow.remote}</property>
-                <property name="dataCenter">1</property>
-                <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.2",
-                    "keycloak.connectionsInfinispan.siteName": "dc-1",
-                    "keycloak.connectionsInfinispan.nodeName": "auth-server-undertow-cross-dc-1_2-manual",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}",
-                    "keycloak.connectionsInfinispan.remoteStoreServer": "${keycloak.connectionsInfinispan.remoteStoreServer:localhost}",
-                    "keycloak.connectionsInfinispan.remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort.2:11222}",
-                    "keycloak.connectionsInfinispan.remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:true}",
-                    "keycloak.connectionsInfinispan.hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-                    "keycloak.connectionsJpa.url": "${keycloak.connectionsJpa.url.crossdc:jdbc:h2:mem:test-dc-shared}",
-                    "keycloak.connectionsJpa.driver": "${keycloak.connectionsJpa.driver.crossdc:org.h2.Driver}",
-                    "keycloak.connectionsJpa.driverDialect": "${keycloak.connectionsJpa.driverDialect.crossdc:}"
-                }</property>
-            </configuration>
-        </container>
-        <container qualifier="auth-server-jboss-cross-dc-0_1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.jboss.crossdc}</property>
-                <property name="adapterImplClass">${auth.server.adapter.impl.class}</property>
-                <property name="jbossHome">${auth.server.crossdc01.home}</property>
-                <property name="serverConfig">standalone-ha.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${auth.server.crossdc01.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.1
-                    -Dremote.cache.port=12232
-                    -Dkeycloak.connectionsInfinispan.siteName=dc0
-                    -Djboss.node.name=auth-server-${node.name}-cross-dc-0_1
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dkeycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled=${keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled}
-                    -Dkeycloak.connectionsInfinispan.hotrodProtocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${auth.server.crossdc01.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="managementPort">${auth.server.crossdc01.management.port}</property>
-                <property name="bindHttpPortOffset">-79</property>
-                <property name="bindHttpsPortOffset">-79</property>
-                <property name="dataCenter">0</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-            </configuration>
-        </container>
-        <container qualifier="auth-server-jboss-cross-dc-0_2-manual" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.jboss.crossdc}</property>
-                <property name="adapterImplClass">${auth.server.adapter.impl.class}</property>
-                <property name="jbossHome">${auth.server.crossdc02.home}</property>
-                <property name="serverConfig">standalone-ha.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${auth.server.crossdc02.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.1
-                    -Dremote.cache.port=12232
-                    -Dkeycloak.connectionsInfinispan.siteName=dc0
-                    -Djboss.node.name=auth-server-${node.name}-cross-dc-0_2-manual
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dkeycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled=${keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled}
-                    -Dkeycloak.connectionsInfinispan.hotrodProtocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${auth.server.crossdc02.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="managementPort">${auth.server.crossdc02.management.port}</property>
-                <property name="bindHttpPortOffset">-78</property>
-                <property name="bindHttpsPortOffset">-78</property>
-                <property name="dataCenter">0</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-            </configuration>
-        </container>
-
-        <container qualifier="auth-server-jboss-cross-dc-1_1" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.jboss.crossdc}</property>
-                <property name="adapterImplClass">${auth.server.adapter.impl.class}</property>
-                <property name="jbossHome">${auth.server.crossdc11.home}</property>
-                <property name="serverConfig">standalone-ha.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${auth.server.crossdc11.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.2
-                    -Dremote.cache.port=13232
-                    -Dkeycloak.connectionsInfinispan.siteName=dc1
-                    -Djboss.node.name=auth-server-${node.name}-cross-dc-1_1
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dkeycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled=${keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled}
-                    -Dkeycloak.connectionsInfinispan.hotrodProtocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${auth.server.crossdc11.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="managementPort">${auth.server.crossdc11.management.port}</property>
-                <property name="bindHttpPortOffset">-69</property>
-                <property name="bindHttpsPortOffset">-69</property>
-                <property name="dataCenter">1</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-            </configuration>
-        </container>
-        <container qualifier="auth-server-jboss-cross-dc-1_2-manual" mode="manual" >
-            <configuration>
-                <property name="enabled">${auth.server.jboss.crossdc}</property>
-                <property name="adapterImplClass">${auth.server.adapter.impl.class}</property>
-                <property name="jbossHome">${auth.server.crossdc12.home}</property>
-                <property name="serverConfig">standalone-ha.xml</property>
-                <property name="jbossArguments">
-                    -Djboss.as.management.blocking.timeout=${auth.server.jboss.startup.timeout}
-                    -Djboss.socket.binding.port-offset=${auth.server.crossdc12.port.offset}
-                    -Djboss.default.multicast.address=234.56.78.2
-                    -Dremote.cache.port=13232
-                    -Dkeycloak.connectionsInfinispan.siteName=dc1
-                    -Djboss.node.name=auth-server-${node.name}-cross-dc-1_2-manual
-                    -Dauth.server.truststore=${auth.server.truststore}
-                    -Dauth.server.truststore.password=${auth.server.truststore.password}
-                    -Dkeycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled=${keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled}
-                    -Dkeycloak.connectionsInfinispan.hotrodProtocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion}
-                    -Dauth.server.db.host=${auth.server.db.host}
-                </property>
-                <property name="javaVmArguments">
-                    ${auth.server.memory.settings}
-                    -Djava.net.preferIPv4Stack=true
-                    ${auth.server.crossdc12.jvm.debug.args}
-                    ${auth.server.jvm.args.extra}
-                </property>
-                <property name="managementPort">${auth.server.crossdc12.management.port}</property>
-                <property name="bindHttpPortOffset">-68</property>
-                <property name="bindHttpsPortOffset">-68</property>
-                <property name="dataCenter">1</property>
-                <property name="startupTimeoutInSeconds">${auth.server.jboss.startup.timeout}</property>
-            </configuration>
-        </container>
-    </group>
-
     <container qualifier="auth-server-quarkus" mode="manual" >
         <configuration>
             <property name="enabled">${auth.server.quarkus}</property>
@@ -634,7 +288,7 @@
             </property>
             <property name="bindHttpPortOffset">${auth.server.port.offset}</property>
             <property name="javaOpts">-Xms512m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=512m
-                -Djava.net.preferIPv4Stack=true -Dauth.server.db.host=some
+                -Dauth.server.db.host=some -Djava.net.preferIPv6Addresses=${auth.server.ipv6}
             </property>
             <property name="enabledFeatures">${auth.server.feature}</property>
             <property name="disabledFeatures">${auth.server.feature.disable}</property>
@@ -669,12 +323,10 @@
                 <property name="profile">ha</property>
                 <property name="debugPort">5005</property>
                 <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.8",
-                    "keycloak.connectionsInfinispan.nodeName": "node1",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}"
+                    "keycloak.cacheEmbedded.nodeName": "node1"
                     }
                 </property>
-                <property name="javaOpts">-Xms512m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=512m -Djava.net.preferIPv4Stack=true</property>
+                <property name="javaOpts">-Xms512m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=512m</property>
                 <property name="outputToConsole">true</property>
             </configuration>
         </container>
@@ -693,12 +345,10 @@
                 <property name="profile">ha</property>
                 <property name="debugPort">5006</property>
                 <property name="keycloakConfigPropertyOverrides">{
-                    "keycloak.connectionsInfinispan.jgroupsUdpMcastAddr": "234.56.78.8",
-                    "keycloak.connectionsInfinispan.nodeName": "node2",
-                    "keycloak.connectionsInfinispan.clustered": "${keycloak.connectionsInfinispan.clustered:true}"
+                    "keycloak.cacheEmbedded.nodeName": "node2"
                     }
                 </property>
-                <property name="javaOpts">-Xms512m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=512m -Djava.net.preferIPv4Stack=true</property>
+                <property name="javaOpts">-Xms512m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=512m</property>
                 <property name="outputToConsole">true</property>
             </configuration>
         </container>
@@ -718,7 +368,6 @@
                 -Xmx512m
                 -XX:MetaspaceSize=96M
                 -XX:MaxMetaspaceSize=512m
-                -Djava.net.preferIPv4Stack=true
                 ${auth.server.memory.settings}
                 -Dauth.server.db.host=${auth.server.db.host}
             </property>
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-clients.json b/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-clients.json
index 1c18e348ef2e..7cad7b75f7db 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-clients.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-clients.json
@@ -76,7 +76,6 @@
     "xContentTypeOptions": "nosniff",
     "xRobotsTag": "none",
     "xFrameOptions": "SAMEORIGIN",
-    "xXSSProtection": "1; mode=block",
     "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
     "strictTransportSecurity": "max-age=31536000; includeSubDomains"
   },
@@ -639,7 +638,6 @@
   "clientAuthenticationFlow": "clients",
   "dockerAuthenticationFlow": "docker auth",
   "attributes": {
-    "_browser_header.xXSSProtection": "1; mode=block",
     "_browser_header.xFrameOptions": "SAMEORIGIN",
     "_browser_header.strictTransportSecurity": "max-age=31536000; includeSubDomains",
     "permanentLockout": "false",
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-roles.json b/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-roles.json
index 5f0c80091eb9..cf68c2013d88 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-roles.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/import/import-without-roles.json
@@ -672,7 +672,6 @@
     "xContentTypeOptions": "nosniff",
     "xRobotsTag": "none",
     "xFrameOptions": "SAMEORIGIN",
-    "xXSSProtection": "1; mode=block",
     "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
     "strictTransportSecurity": "max-age=31536000; includeSubDomains"
   },
@@ -1235,7 +1234,6 @@
   "clientAuthenticationFlow": "clients",
   "dockerAuthenticationFlow": "docker auth",
   "attributes": {
-    "_browser_header.xXSSProtection": "1; mode=block",
     "_browser_header.xFrameOptions": "SAMEORIGIN",
     "_browser_header.strictTransportSecurity": "max-age=31536000; includeSubDomains",
     "permanentLockout": "false",
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/import/partial-import.json b/testsuite/integration-arquillian/tests/base/src/test/resources/import/partial-import.json
index 06e30baeedd0..5b8a26ff5285 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/import/partial-import.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/import/partial-import.json
@@ -53,7 +53,6 @@
     "xContentTypeOptions": "nosniff",
     "xRobotsTag": "none",
     "xFrameOptions": "SAMEORIGIN",
-    "xXSSProtection": "1; mode=block",
     "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
     "strictTransportSecurity": "max-age=31536000; includeSubDomains"
   },
@@ -616,7 +615,6 @@
   "clientAuthenticationFlow": "clients",
   "dockerAuthenticationFlow": "docker auth",
   "attributes": {
-    "_browser_header.xXSSProtection": "1; mode=block",
     "_browser_header.xFrameOptions": "SAMEORIGIN",
     "_browser_header.strictTransportSecurity": "max-age=31536000; includeSubDomains",
     "permanentLockout": "false",
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/import/testrealm-user-null-attr.json b/testsuite/integration-arquillian/tests/base/src/test/resources/import/testrealm-user-null-attr.json
index ba1a0ba7cbe0..f48c80f15c15 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/import/testrealm-user-null-attr.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/import/testrealm-user-null-attr.json
@@ -961,7 +961,6 @@
     "xRobotsTag" : "none",
     "xFrameOptions" : "SAMEORIGIN",
     "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
-    "xXSSProtection" : "1; mode=block",
     "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
   },
   "smtpServer" : { },
@@ -1594,7 +1593,6 @@
     "_browser_header.contentSecurityPolicyReportOnly" : "",
     "bruteForceProtected" : "false",
     "_browser_header.contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
-    "_browser_header.xXSSProtection" : "1; mode=block",
     "_browser_header.xFrameOptions" : "SAMEORIGIN",
     "_browser_header.strictTransportSecurity" : "max-age=31536000; includeSubDomains",
     "webAuthnPolicyUserVerificationRequirement" : "not specified",
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/keycloak-add-user.json b/testsuite/integration-arquillian/tests/base/src/test/resources/keycloak-add-user.json
deleted file mode 100644
index b37ad8cec416..000000000000
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/keycloak-add-user.json
+++ /dev/null
@@ -1,13 +0,0 @@
-[ {
-  "realm" : "master",
-  "users" : [ {
-    "username" : "admin",
-    "enabled" : true,
-    "credentials" : [ {
-      "type" : "password",
-      "secretData" : "{\"value\":\"Rned5xhMiQffs44bqm6B6VSCyedQn0hg2hnyuTTQNCcd1GxlDQbbKNFIPESgeQws0WYoQs+8kAWuD/wfBcBFaA==\",\"salt\":\"0K637Dy0FG+sBlXbHA7ioA==\"}",
-      "credentialData" : "{\"hashIterations\":100000,\"algorithm\":\"pbkdf2-sha256\"}"
-    } ],
-    "realmRoles" : [ "admin" ]
-  } ]
-} ]
\ No newline at end of file
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/email_invalid.jks b/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/email_invalid.jks
index e940f190cf25..b1193fc96c85 100644
Binary files a/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/email_invalid.jks and b/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/email_invalid.jks differ
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json b/testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json
index 0659534ea8c8..907a59f21827 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/model/acr-values-import-bug.json
@@ -1310,8 +1310,7 @@
           "protocolMapper": "oid4vc-subject-id-mapper",
           "consentRequired": false,
           "config": {
-            "supportedCredentialTypes": "VerifiableCredential",
-            "subjectIdProperty": "id"
+            "claim.name": "id"
           }
         },
         {
@@ -1321,7 +1320,7 @@
           "protocolMapper": "oid4vc-user-attribute-mapper",
           "consentRequired": false,
           "config": {
-            "subjectProperty": "email",
+            "claim.name": "email",
             "userAttribute": "email",
             "aggregateAttributes": "false"
           }
@@ -1333,7 +1332,7 @@
           "protocolMapper": "oid4vc-user-attribute-mapper",
           "consentRequired": false,
           "config": {
-            "subjectProperty": "familyName",
+            "claim.name": "familyName",
             "userAttribute": "lastName",
             "aggregateAttributes": "false"
           }
@@ -1345,7 +1344,7 @@
           "protocolMapper": "oid4vc-target-role-mapper",
           "consentRequired": false,
           "config": {
-            "subjectProperty": "roles",
+            "claim.name": "roles",
             "clientId": "id"
           }
         },
@@ -1356,7 +1355,7 @@
           "protocolMapper": "oid4vc-user-attribute-mapper",
           "consentRequired": false,
           "config": {
-            "subjectProperty": "firstName",
+            "claim.name": "firstName",
             "userAttribute": "firstName",
             "aggregateAttributes": "false"
           }
@@ -1561,7 +1560,6 @@
     "xRobotsTag": "none",
     "xFrameOptions": "SAMEORIGIN",
     "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
-    "xXSSProtection": "1; mode=block",
     "strictTransportSecurity": "max-age=31536000; includeSubDomains"
   },
   "smtpServer": {},
@@ -2511,4 +2509,4 @@
   "clientPolicies": {
     "policies": []
   }
-}
\ No newline at end of file
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/oid4vc/test-credential-mappers.json b/testsuite/integration-arquillian/tests/base/src/test/resources/oid4vc/test-credential-mappers.json
new file mode 100644
index 000000000000..804156000099
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/oid4vc/test-credential-mappers.json
@@ -0,0 +1,56 @@
+{
+  "protocolMappers": [
+    {
+      "name": "generated-id-mapper",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-generated-id-mapper",
+      "config": {
+        "claim.name": "jti"
+      }
+    },
+    {
+      "name": "givenName",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-user-attribute-mapper",
+      "config": {
+        "claim.name": "given_name",
+        "userAttribute": "firstName",
+        "vc.mandatory": "false",
+        "vc.display": "[{\"name\": \"الاسم الشخصي\", \"locale\": \"ar-SA\"}, {\"name\": \"Vorname\", \"locale\": \"de-DE\"}, {\"name\": \"Given Name\", \"locale\": \"en-US\"}, {\"name\": \"Nombre\", \"locale\": \"es-ES\"}, {\"name\": \"نام\", \"locale\": \"fa-IR\"}, {\"name\": \"Etunimi\", \"locale\": \"fi-FI\"}, {\"name\": \"Prénom\", \"locale\": \"fr-FR\"}, {\"name\": \"पहचानी गई नाम\", \"locale\": \"hi-IN\"}, {\"name\": \"Nome\", \"locale\": \"it-IT\"}, {\"name\": \"名\", \"locale\": \"ja-JP\"}, {\"name\": \"Овог нэр\", \"locale\": \"mn-MN\"}, {\"name\": \"Voornaam\", \"locale\": \"nl-NL\"}, {\"name\": \"Nome Próprio\", \"locale\": \"pt-PT\"}, {\"name\": \"Förnamn\", \"locale\": \"sv-SE\"}, {\"name\": \"مسلمان نام\", \"locale\": \"ur-PK\"}]"
+      }
+    },
+    {
+      "name": "familyName",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-user-attribute-mapper",
+      "config": {
+        "claim.name": "family_name",
+        "userProperty": "lastName",
+        "vc.mandatory": "false",
+        "vc.display": "[{\"name\": \"اسم العائلة\", \"locale\": \"ar-SA\"}, {\"name\": \"Nachname\", \"locale\": \"de-DE\"}, {\"name\": \"Family Name\", \"locale\": \"en-US\"}, {\"name\": \"Apellido\", \"locale\": \"es-ES\"}, {\"name\": \"نام خانوادگی\", \"locale\": \"fa-IR\"}, {\"name\": \"Sukunimi\", \"locale\": \"fi-FI\"}, {\"name\": \"Nom de famille\", \"locale\": \"fr-FR\"}, {\"name\": \"परिवार का नाम\", \"locale\": \"hi-IN\"}, {\"name\": \"Cognome\", \"locale\": \"it-IT\"}, {\"name\": \"姓\", \"locale\": \"ja-JP\"}, {\"name\": \"өөрийн нэр\", \"locale\": \"mn-MN\"}, {\"name\": \"Achternaam\", \"locale\": \"nl-NL\"}, {\"name\": \"Sobrenome\", \"locale\": \"pt-PT\"}, {\"name\": \"Efternamn\", \"locale\": \"sv-SE\"}, {\"name\": \"خاندانی نام\", \"locale\": \"ur-PK\"}]"
+      }
+    },
+    {
+      "name": "birthdate",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-user-attribute-mapper",
+      "config": {
+        "userAttribute": "birthdate",
+        "claim.name": "birthdate",
+        "vc.mandatory": "false",
+        "vc.display": "[{\"name\": \"تاريخ الميلاد\", \"locale\": \"ar-SA\"}, {\"name\": \"Geburtsdatum\", \"locale\": \"de-DE\"}, {\"name\": \"Date of Birth\", \"locale\": \"en-US\"}, {\"name\": \"Fecha de Nacimiento\", \"locale\": \"es-ES\"}, {\"name\": \"تاریخ تولد\", \"locale\": \"fa-IR\"}, {\"name\": \"Syntymäaika\", \"locale\": \"fi-FI\"}, {\"name\": \"Date de naissance\", \"locale\": \"fr-FR\"}, {\"name\": \"जन्म की तारीख\", \"locale\": \"hi-IN\"}, {\"name\": \"Data di nascita\", \"locale\": \"it-IT\"}, {\"name\": \"生年月日\", \"locale\": \"ja-JP\"}, {\"name\": \"төрсөн өдөр\", \"locale\": \"mn-MN\"}, {\"name\": \"Geboortedatum\", \"locale\": \"nl-NL\"}, {\"name\": \"Data de Nascimento\", \"locale\": \"pt-PT\"}, {\"name\": \"Födelsedatum\", \"locale\": \"sv-SE\"}, {\"name\": \"تاریخ پیدائش\", \"locale\": \"ur-PK\"}]"
+      }
+    },
+    {
+      "name": "email",
+      "protocol": "oid4vc",
+      "protocolMapper": "oid4vc-user-attribute-mapper",
+      "config": {
+        "claim.name": "email",
+        "userAttribute": "email",
+        "vc.mandatory": "false",
+        "vc.display": "[{\"name\": \"البريد الإلكتروني\", \"locale\": \"ar-SA\"}, {\"name\": \"E-Mail\", \"locale\": \"de-DE\"}, {\"name\": \"Email\", \"locale\": \"en-US\"}, {\"name\": \"Correo electrónico\", \"locale\": \"es-ES\"}, {\"name\": \"ایمیل\", \"locale\": \"fa-IR\"}, {\"name\": \"Sähköposti\", \"locale\": \"fi-FI\"}, {\"name\": \"E-mail\", \"locale\": \"fr-FR\"}, {\"name\": \"ईमेल\", \"locale\": \"hi-IN\"}, {\"name\": \"Email\", \"locale\": \"it-IT\"}, {\"name\": \"メール\", \"locale\": \"ja-JP\"}, {\"name\": \"И-мэйл\", \"locale\": \"mn-MN\"}, {\"name\": \"E-mail\", \"locale\": \"nl-NL\"}, {\"name\": \"Email\", \"locale\": \"pt-PT\"}, {\"name\": \"E-post\", \"locale\": \"sv-SE\"}, {\"name\": \"ای میل\", \"locale\": \"ur-PK\"}]"
+      }
+    }
+  ]
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json b/testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json
index fcbc80612558..fc0a86aafa4d 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/testrealm.json
@@ -454,7 +454,6 @@
         }
       ]
     },
-
     {
       "clientId": "custom-audience",
       "enabled": true,
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json b/testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json
new file mode 100644
index 000000000000..af2110d0f9d2
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/token-exchange/testrealm-token-exchange-v2.json
@@ -0,0 +1,2602 @@
+{
+  "id" : "e788774a-7c61-42ab-8927-b9efd38d1f73",
+  "realm" : "test",
+  "notBefore" : 0,
+  "defaultSignatureAlgorithm" : "RS256",
+  "revokeRefreshToken" : false,
+  "refreshTokenMaxReuse" : 0,
+  "accessTokenLifespan" : 300,
+  "accessTokenLifespanForImplicitFlow" : 900,
+  "ssoSessionIdleTimeout" : 1800,
+  "ssoSessionMaxLifespan" : 36000,
+  "ssoSessionIdleTimeoutRememberMe" : 0,
+  "ssoSessionMaxLifespanRememberMe" : 0,
+  "offlineSessionIdleTimeout" : 2592000,
+  "offlineSessionMaxLifespanEnabled" : false,
+  "offlineSessionMaxLifespan" : 5184000,
+  "clientSessionIdleTimeout" : 0,
+  "clientSessionMaxLifespan" : 0,
+  "clientOfflineSessionIdleTimeout" : 0,
+  "clientOfflineSessionMaxLifespan" : 0,
+  "accessCodeLifespan" : 60,
+  "accessCodeLifespanUserAction" : 300,
+  "accessCodeLifespanLogin" : 1800,
+  "actionTokenGeneratedByAdminLifespan" : 43200,
+  "actionTokenGeneratedByUserLifespan" : 300,
+  "oauth2DeviceCodeLifespan" : 600,
+  "oauth2DevicePollingInterval" : 5,
+  "enabled" : true,
+  "sslRequired" : "external",
+  "registrationAllowed" : false,
+  "registrationEmailAsUsername" : false,
+  "rememberMe" : false,
+  "verifyEmail" : false,
+  "loginWithEmailAllowed" : true,
+  "duplicateEmailsAllowed" : false,
+  "resetPasswordAllowed" : false,
+  "editUsernameAllowed" : false,
+  "bruteForceProtected" : false,
+  "permanentLockout" : false,
+  "maxTemporaryLockouts" : 0,
+  "bruteForceStrategy" : "MULTIPLE",
+  "maxFailureWaitSeconds" : 900,
+  "minimumQuickLoginWaitSeconds" : 60,
+  "waitIncrementSeconds" : 60,
+  "quickLoginCheckMilliSeconds" : 1000,
+  "maxDeltaTimeSeconds" : 43200,
+  "failureFactor" : 30,
+  "roles" : {
+    "realm" : [ {
+      "id" : "ccbbde4e-c98d-4355-9719-04338e4266fc",
+      "name" : "offline_access",
+      "description" : "${role_offline-access}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "e788774a-7c61-42ab-8927-b9efd38d1f73",
+      "attributes" : { }
+    }, {
+      "id" : "b1d62124-3a2c-4744-9b28-d390db6691c6",
+      "name" : "all-target",
+      "description" : "all-target",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "e788774a-7c61-42ab-8927-b9efd38d1f73",
+      "attributes" : { }
+    }, {
+      "id" : "5f6173f5-7696-49e0-806e-7acf38e7d9e9",
+      "name" : "default-roles-test",
+      "description" : "${role_default-roles}",
+      "composite" : true,
+      "composites" : {
+        "realm" : [ "offline_access", "uma_authorization" ],
+        "client" : {
+          "account" : [ "view-profile", "manage-account" ]
+        }
+      },
+      "clientRole" : false,
+      "containerId" : "e788774a-7c61-42ab-8927-b9efd38d1f73",
+      "attributes" : { }
+    }, {
+      "id" : "92e8da3e-d4a9-4327-8284-417996a5167f",
+      "name" : "uma_authorization",
+      "description" : "${role_uma_authorization}",
+      "composite" : false,
+      "clientRole" : false,
+      "containerId" : "e788774a-7c61-42ab-8927-b9efd38d1f73",
+      "attributes" : { }
+    } ],
+    "client" : {
+      "realm-management" : [ {
+        "id" : "d9431fa2-9892-44a4-8b81-0a3f03481758",
+        "name" : "manage-clients",
+        "description" : "${role_manage-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "8a2850d1-7cae-474a-a035-dc5f713044de",
+        "name" : "query-groups",
+        "description" : "${role_query-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "0c9e2178-915a-4d81-99d5-ffe469068e1e",
+        "name" : "view-authorization",
+        "description" : "${role_view-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "5328d2d3-ca78-496c-806d-208391367ac7",
+        "name" : "view-events",
+        "description" : "${role_view-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "f1a215bd-0b5e-43d6-9ff0-eb39b3bccb77",
+        "name" : "view-realm",
+        "description" : "${role_view-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "18b7684a-58ef-4555-a2f6-a5962f5df3c7",
+        "name" : "query-realms",
+        "description" : "${role_query-realms}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "663e3cac-13a9-4e85-95a0-821477584e27",
+        "name" : "query-users",
+        "description" : "${role_query-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "0cd9ab56-1730-4506-ae38-bbd55918d73e",
+        "name" : "view-clients",
+        "description" : "${role_view-clients}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "758162b7-8519-4d77-b3af-67a2d4c7ecac",
+        "name" : "manage-realm",
+        "description" : "${role_manage-realm}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "53c8d0df-12d3-4ebc-9bcc-29f68552377b",
+        "name" : "view-users",
+        "description" : "${role_view-users}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "query-groups", "query-users" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "3b0e11dd-a3ab-4cf7-8503-656485528c58",
+        "name" : "view-identity-providers",
+        "description" : "${role_view-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "6ab563d5-b71c-44e7-a751-6dbfed348463",
+        "name" : "impersonation",
+        "description" : "${role_impersonation}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "63e12297-bd94-40a8-ba6d-90a4a0f1ee4e",
+        "name" : "manage-authorization",
+        "description" : "${role_manage-authorization}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "59b9ee81-6e04-40e9-9db7-11a52469f9a5",
+        "name" : "realm-admin",
+        "description" : "${role_realm-admin}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "realm-management" : [ "manage-clients", "query-groups", "view-authorization", "view-events", "view-realm", "query-realms", "view-clients", "query-users", "manage-realm", "view-users", "view-identity-providers", "manage-authorization", "impersonation", "manage-events", "manage-users", "create-client", "manage-identity-providers", "query-clients" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "f320e82f-b3f9-4e1e-a690-52047b2fd5d6",
+        "name" : "manage-events",
+        "description" : "${role_manage-events}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "e03422f8-a256-46ff-8abc-f1c1bf045558",
+        "name" : "manage-users",
+        "description" : "${role_manage-users}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "fe50cef5-3940-49b5-b727-d4d79ab7eb42",
+        "name" : "create-client",
+        "description" : "${role_create-client}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "1a73efa6-e71b-48af-97ab-fc7ea43c78f8",
+        "name" : "manage-identity-providers",
+        "description" : "${role_manage-identity-providers}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "6f3bef10-484d-446e-9bb4-370ecedcc79d",
+        "name" : "query-clients",
+        "description" : "${role_query-clients}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      }, {
+        "id" : "3d2124af-e46f-4e9a-a15a-a591864f9e93",
+        "name" : "uma_protection",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+        "attributes" : { }
+      } ],
+      "requester-client" : [ ],
+      "security-admin-console" : [ ],
+      "target-client1" : [ {
+        "id" : "b7eb747d-7aac-4e36-8ade-5b9875c9ed07",
+        "name" : "target-client1-role",
+        "description" : "",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "192692cd-c5e4-42ff-a7ec-d5cb6228c0c7",
+        "attributes" : { }
+      } ],
+      "account-console" : [ ],
+      "target-client2" : [ {
+        "id" : "548ae349-d3c5-4b7b-a1df-95e966ec0c1a",
+        "name" : "target-client2-role",
+        "description" : "",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "8d76ccf3-d0c2-4110-9120-06533cf9949c",
+        "attributes" : { }
+      } ],
+      "broker" : [ {
+        "id" : "eec8fd31-5a9a-44e6-b1c5-7b8fc610cbf3",
+        "name" : "read-token",
+        "description" : "${role_read-token}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "52fbbee7-44ca-4a36-814f-95f18f632994",
+        "attributes" : { }
+      } ],
+      "requester-client-public" : [ ],
+      "target-client3" : [ ],
+      "invalid-requester-client" : [ ],
+      "subject-client" : [ ],
+      "admin-cli" : [ ],
+      "account" : [ {
+        "id" : "4d92df58-f573-4dcc-9428-83c67595b0d3",
+        "name" : "manage-consent",
+        "description" : "${role_manage-consent}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "view-consent" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "9c24c177-8221-4ced-aae7-5784d54cd506",
+        "name" : "view-profile",
+        "description" : "${role_view-profile}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "8cfc7177-52e3-46f8-82a3-d8bf126242a7",
+        "name" : "view-groups",
+        "description" : "${role_view-groups}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "7b4eec7a-ee1c-4eaf-a7bf-d52b555d46fd",
+        "name" : "delete-account",
+        "description" : "${role_delete-account}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "fb9dd19d-2f96-4b37-8a5c-425117f5cae0",
+        "name" : "manage-account",
+        "description" : "${role_manage-account}",
+        "composite" : true,
+        "composites" : {
+          "client" : {
+            "account" : [ "manage-account-links" ]
+          }
+        },
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "ad43f7f2-a444-4c87-b6ac-c141deff3b4d",
+        "name" : "manage-account-links",
+        "description" : "${role_manage-account-links}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "baf95379-bdb9-4af2-adbb-5e91772dd1f6",
+        "name" : "view-consent",
+        "description" : "${role_view-consent}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      }, {
+        "id" : "636e5071-74e9-4fb2-b9c2-6eff04336e57",
+        "name" : "view-applications",
+        "description" : "${role_view-applications}",
+        "composite" : false,
+        "clientRole" : true,
+        "containerId" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+        "attributes" : { }
+      } ]
+    }
+  },
+  "groups" : [ ],
+  "defaultRole" : {
+    "id" : "5f6173f5-7696-49e0-806e-7acf38e7d9e9",
+    "name" : "default-roles-test",
+    "description" : "${role_default-roles}",
+    "composite" : true,
+    "clientRole" : false,
+    "containerId" : "e788774a-7c61-42ab-8927-b9efd38d1f73"
+  },
+  "requiredCredentials" : [ "password" ],
+  "otpPolicyType" : "totp",
+  "otpPolicyAlgorithm" : "HmacSHA1",
+  "otpPolicyInitialCounter" : 0,
+  "otpPolicyDigits" : 6,
+  "otpPolicyLookAheadWindow" : 1,
+  "otpPolicyPeriod" : 30,
+  "otpPolicyCodeReusable" : false,
+  "otpSupportedApplications" : [ "totpAppFreeOTPName", "totpAppGoogleName", "totpAppMicrosoftAuthenticatorName" ],
+  "localizationTexts" : { },
+  "webAuthnPolicyRpEntityName" : "keycloak",
+  "webAuthnPolicySignatureAlgorithms" : [ "ES256", "RS256" ],
+  "webAuthnPolicyRpId" : "",
+  "webAuthnPolicyAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyRequireResidentKey" : "not specified",
+  "webAuthnPolicyUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyCreateTimeout" : 0,
+  "webAuthnPolicyAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyAcceptableAaguids" : [ ],
+  "webAuthnPolicyExtraOrigins" : [ ],
+  "webAuthnPolicyPasswordlessRpEntityName" : "keycloak",
+  "webAuthnPolicyPasswordlessSignatureAlgorithms" : [ "ES256", "RS256" ],
+  "webAuthnPolicyPasswordlessRpId" : "",
+  "webAuthnPolicyPasswordlessAttestationConveyancePreference" : "not specified",
+  "webAuthnPolicyPasswordlessAuthenticatorAttachment" : "not specified",
+  "webAuthnPolicyPasswordlessRequireResidentKey" : "not specified",
+  "webAuthnPolicyPasswordlessUserVerificationRequirement" : "not specified",
+  "webAuthnPolicyPasswordlessCreateTimeout" : 0,
+  "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister" : false,
+  "webAuthnPolicyPasswordlessAcceptableAaguids" : [ ],
+  "webAuthnPolicyPasswordlessExtraOrigins" : [ ],
+  "users" : [ {
+    "id" : "38d2d491-6639-4de9-8de8-94c54373a672",
+    "username" : "john",
+    "firstName" : "John",
+    "lastName" : "Bar",
+    "email" : "john@email.cz",
+    "emailVerified" : false,
+    "createdTimestamp" : 1732884105204,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "2eea9617-dd53-4902-92d0-d3c119c46e17",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1732884115119,
+      "secretData" : "{\"value\":\"GNjvIqBcbM+mqCUt7nqYgl696zKTjNO1wLnvPkDfMFA=\",\"salt\":\"txHDSAn9HgpQ7GE8Be9zTQ==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-test" ],
+    "clientRoles" : {
+      "target-client1" : [ "target-client1-role" ],
+      "target-client2" : [ "target-client2-role" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "c5eda8d5-be98-4719-96ad-755cbf36c8ec",
+    "username" : "mike",
+    "firstName" : "Mike",
+    "lastName" : "Bar",
+    "email" : "mike@email.cz",
+    "emailVerified" : false,
+    "createdTimestamp" : 1732884105204,
+    "enabled" : true,
+    "totp" : false,
+    "credentials" : [ {
+      "id" : "8d581ba9-c7ab-4877-909f-d1c1db66c702",
+      "type" : "password",
+      "userLabel" : "My password",
+      "createdDate" : 1732884115119,
+      "secretData" : "{\"value\":\"GNjvIqBcbM+mqCUt7nqYgl696zKTjNO1wLnvPkDfMFA=\",\"salt\":\"txHDSAn9HgpQ7GE8Be9zTQ==\",\"additionalParameters\":{}}",
+      "credentialData" : "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-test", "all-target" ],
+    "clientRoles" : {
+      "target-client1" : [ "target-client1-role" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "d1a6f32c-1d47-4c45-b5ab-35b8070d2a70",
+    "username" : "service-account-invalid-requester-client",
+    "emailVerified" : false,
+    "createdTimestamp" : 1739807936808,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "invalid-requester-client",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-test" ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "ce0f45f7-2929-46e8-b8e9-a1d59e645495",
+    "username" : "service-account-realm-management",
+    "emailVerified" : false,
+    "createdTimestamp" : 1738573157529,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "realm-management",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-test" ],
+    "clientRoles" : {
+      "realm-management" : [ "uma_protection" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "cccb9363-685a-4575-8e20-5854797468d2",
+    "username" : "service-account-requester-client",
+    "emailVerified" : false,
+    "createdTimestamp" : 1732884723976,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "requester-client",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "notBefore" : 0,
+    "groups" : [ ]
+  }, {
+    "id" : "f0c55466-85c8-4f1d-abd8-ccce9d8ec549",
+    "username" : "service-account-subject-client",
+    "emailVerified" : false,
+    "createdTimestamp" : 1739812072516,
+    "enabled" : true,
+    "totp" : false,
+    "serviceAccountClientId" : "subject-client",
+    "credentials" : [ ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "default-roles-test" ],
+    "clientRoles" : {
+      "target-client1" : [ "target-client1-role" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ],
+  "scopeMappings" : [ {
+    "clientScope" : "optional-scope2",
+    "roles" : [ "all-target" ]
+  }, {
+    "clientScope" : "offline_access",
+    "roles" : [ "offline_access" ]
+  } ],
+  "clientScopeMappings" : {
+    "target-client1" : [ {
+      "clientScope" : "default-scope1",
+      "roles" : [ "target-client1-role" ]
+    } ],
+    "target-client2" : [ {
+      "clientScope" : "optional-scope2",
+      "roles" : [ "target-client2-role" ]
+    } ],
+    "account" : [ {
+      "client" : "account-console",
+      "roles" : [ "manage-account", "view-groups" ]
+    } ]
+  },
+  "clients" : [ {
+    "id" : "fb6a501b-6bbc-4fca-82da-16ac27d7854c",
+    "clientId" : "account",
+    "name" : "${client_account}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/test/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/test/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "7b18cc0e-c42f-4ca6-b4e6-2ca7a891d600",
+    "clientId" : "account-console",
+    "name" : "${client_account-console}",
+    "rootUrl" : "${authBaseUrl}",
+    "baseUrl" : "/realms/test/account/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/realms/test/account/*" ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "2edeb7ac-af3e-494e-80c7-2420bde5e9d9",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "539a834b-db63-4066-b1ee-a9656189857e",
+    "clientId" : "admin-cli",
+    "name" : "${client_admin-cli}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "client.use.lightweight.access.token.enabled" : "true",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "52fbbee7-44ca-4a36-814f-95f18f632994",
+    "clientId" : "broker",
+    "name" : "${client_broker}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : true,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "true",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "cdaf7934-1eea-4b2d-ae64-327a67ffab7b",
+    "clientId" : "invalid-requester-client",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1739807936",
+      "backchannel.logout.session.required" : "true",
+      "standard.token.exchange.enabled":"true",
+      "frontchannel.logout.session.required" : "true",
+      "post.logout.redirect.uris" : "+",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "service_account", "acr", "roles", "basic" ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "54b8e1b4-e912-4821-9335-3f0c0d2f4a2d",
+    "clientId" : "disabled-requester-client",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1732884723",
+      "backchannel.logout.session.required" : "true",
+      "standard.token.exchange.enabled":"false",
+      "post.logout.redirect.uris" : "+",
+      "frontchannel.logout.session.required" : "true",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "use.jwks.url" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "service_account", "acr", "default-scope1", "roles", "basic" ],
+    "optionalClientScopes" : [ "optional-scope2" ]
+  }, {
+    "id" : "a11ebbaf-c0fd-46df-9fe7-64e94ac8d945",
+    "clientId" : "realm-management",
+    "name" : "${client_realm-management}",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "B5Xigicu7waE006slTqw33uTI223m6Wh",
+    "redirectUris" : [ ],
+    "webOrigins" : [ ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : true,
+    "authorizationServicesEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "true",
+      "client.secret.creation.time" : "1739805540",
+      "post.logout.redirect.uris" : "+"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : 0,
+    "defaultClientScopes" : [ "web-origins", "service_account", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "952643a3-2943-4734-9b51-8fa5956ebf54",
+    "clientId" : "requester-client",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1732884723",
+      "backchannel.logout.session.required" : "true",
+      "standard.token.exchange.enabled":"true",
+      "post.logout.redirect.uris" : "+",
+      "frontchannel.logout.session.required" : "true",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "use.jwks.url" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "service_account", "acr", "default-scope1", "roles", "basic" ],
+    "optionalClientScopes" : [ "optional-scope2", "offline_access" ]
+  }, {
+      "id" : "952643a3-2943-4734-9b51-8fa5956ebf55",
+      "clientId" : "requester-client-2",
+      "name" : "",
+      "description" : "",
+      "rootUrl" : "",
+      "adminUrl" : "",
+      "baseUrl" : "",
+      "surrogateAuthRequired" : false,
+      "enabled" : true,
+      "alwaysDisplayInConsole" : false,
+      "clientAuthenticatorType" : "client-secret",
+      "secret" : "secret",
+      "redirectUris" : [ "/*" ],
+      "webOrigins" : [ "/*" ],
+      "notBefore" : 0,
+      "bearerOnly" : false,
+      "consentRequired" : false,
+      "standardFlowEnabled" : true,
+      "implicitFlowEnabled" : false,
+      "directAccessGrantsEnabled" : true,
+      "serviceAccountsEnabled" : true,
+      "publicClient" : false,
+      "frontchannelLogout" : true,
+      "protocol" : "openid-connect",
+      "attributes" : {
+        "realm_client" : "false",
+        "oidc.ciba.grant.enabled" : "false",
+        "client.secret.creation.time" : "1732884723",
+        "backchannel.logout.session.required" : "true",
+        "standard.token.exchange.enabled":"true",
+        "post.logout.redirect.uris" : "+",
+        "frontchannel.logout.session.required" : "true",
+        "oauth2.device.authorization.grant.enabled" : "false",
+        "display.on.consent.screen" : "false",
+        "use.jwks.url" : "false",
+        "backchannel.logout.revoke.offline.tokens" : "false"
+      },
+      "authenticationFlowBindingOverrides" : { },
+      "fullScopeAllowed" : false,
+      "nodeReRegistrationTimeout" : -1,
+      "defaultClientScopes" : [ "service_account", "acr", "default-scope1", "roles", "basic" ],
+      "optionalClientScopes" : [ "optional-scope2", "offline_access" ]
+    }, {
+    "id" : "2daeae03-ff78-4f79-8e72-1c4d443e1655",
+    "clientId" : "requester-client-public",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "backchannel.logout.session.required" : "true",
+      "standard.token.exchange.enabled":"true",
+      "frontchannel.logout.session.required" : "true",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "acr", "roles", "basic" ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "9d94d530-3335-4bb9-bea8-e9476a812473",
+    "clientId" : "security-admin-console",
+    "name" : "${client_security-admin-console}",
+    "rootUrl" : "${authAdminUrl}",
+    "baseUrl" : "/admin/test/console/",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/admin/test/console/*" ],
+    "webOrigins" : [ "+" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : false,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "client.use.lightweight.access.token.enabled" : "true",
+      "post.logout.redirect.uris" : "+",
+      "pkce.code.challenge.method" : "S256"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : 0,
+    "protocolMappers" : [ {
+      "id" : "da9492ab-d8c5-4a38-a832-39923838e289",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    } ],
+    "defaultClientScopes" : [ "web-origins", "acr", "profile", "roles", "basic", "email" ],
+    "optionalClientScopes" : [ "address", "phone", "offline_access", "organization", "microprofile-jwt" ]
+  }, {
+    "id" : "202be39e-6622-4a07-aa7b-a4f3784f9a3d",
+    "clientId" : "subject-client",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : true,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : true,
+    "serviceAccountsEnabled" : true,
+    "publicClient" : false,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1739806499",
+      "backchannel.logout.session.required" : "true",
+      "standard.token.exchange.enabled":"true",
+      "post.logout.redirect.uris" : "+",
+      "frontchannel.logout.session.required" : "true",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "display.on.consent.screen" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : false,
+    "nodeReRegistrationTimeout" : -1,
+    "protocolMappers" : [ {
+      "id" : "290368fd-9ce8-491a-bb62-0b02386f3eee",
+      "name" : "subject-client",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "included.client.audience" : "subject-client",
+        "id.token.claim" : "false",
+        "lightweight.claim" : "false",
+        "access.token.claim" : "true",
+        "introspection.token.claim" : "true"
+      }
+    }, {
+      "id" : "a59b1ac2-3de2-4913-89f5-c29ebd8a3f06",
+      "name" : "requester-client",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "included.client.audience" : "requester-client",
+        "id.token.claim" : "false",
+        "lightweight.claim" : "false",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "false"
+      }
+    } ],
+    "defaultClientScopes" : [ "service_account", "acr", "roles", "profile", "basic" ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "192692cd-c5e4-42ff-a7ec-d5cb6228c0c7",
+    "clientId" : "target-client1",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "backchannel.logout.session.required" : "true",
+      "post.logout.redirect.uris" : "+",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "acr", "roles", "basic" ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "8d76ccf3-d0c2-4110-9120-06533cf9949c",
+    "clientId" : "target-client2",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : true,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "backchannel.logout.session.required" : "true",
+      "post.logout.redirect.uris" : "+",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "acr", "roles", "basic" ],
+    "optionalClientScopes" : [ ]
+  }, {
+    "id" : "656a1dee-8020-41a2-80fa-594a8093d58f",
+    "clientId" : "target-client3",
+    "name" : "",
+    "description" : "",
+    "rootUrl" : "",
+    "adminUrl" : "",
+    "baseUrl" : "",
+    "surrogateAuthRequired" : false,
+    "enabled" : true,
+    "alwaysDisplayInConsole" : false,
+    "clientAuthenticatorType" : "client-secret",
+    "secret" : "nI2vCSLpYQ0GHoTfnDMeu9BODpjfj6rT",
+    "redirectUris" : [ "/*" ],
+    "webOrigins" : [ "/*" ],
+    "notBefore" : 0,
+    "bearerOnly" : false,
+    "consentRequired" : false,
+    "standardFlowEnabled" : false,
+    "implicitFlowEnabled" : false,
+    "directAccessGrantsEnabled" : false,
+    "serviceAccountsEnabled" : false,
+    "publicClient" : false,
+    "frontchannelLogout" : true,
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "realm_client" : "false",
+      "oidc.ciba.grant.enabled" : "false",
+      "client.secret.creation.time" : "1738598893",
+      "backchannel.logout.session.required" : "true",
+      "post.logout.redirect.uris" : "+",
+      "oauth2.device.authorization.grant.enabled" : "false",
+      "backchannel.logout.revoke.offline.tokens" : "false"
+    },
+    "authenticationFlowBindingOverrides" : { },
+    "fullScopeAllowed" : true,
+    "nodeReRegistrationTimeout" : -1,
+    "defaultClientScopes" : [ "acr", "roles", "basic" ],
+    "optionalClientScopes" : [ ]
+  } ],
+  "clientScopes" : [ {
+    "id" : "ea98ca03-30e0-4c31-9973-421ca0e9c48c",
+    "name" : "basic",
+    "description" : "OpenID Connect scope for add all basic claims to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "8ec2a414-15a7-4bb7-89a1-7188a69c19db",
+      "name" : "auth_time",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "AUTH_TIME",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "auth_time",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "34dc2703-df85-45ef-a8c1-a164fff6bdad",
+      "name" : "sub",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-sub-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "f1ae15e7-9f30-4161-b4b4-2e497669d311",
+    "name" : "address",
+    "description" : "OpenID Connect built-in scope: address",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${addressScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "6a87f6f2-b64d-46b6-a1b5-05a23280036f",
+      "name" : "address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-address-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute.formatted" : "formatted",
+        "user.attribute.country" : "country",
+        "introspection.token.claim" : "true",
+        "user.attribute.postal_code" : "postal_code",
+        "userinfo.token.claim" : "true",
+        "user.attribute.street" : "street",
+        "id.token.claim" : "true",
+        "user.attribute.region" : "region",
+        "access.token.claim" : "true",
+        "user.attribute.locality" : "locality"
+      }
+    } ]
+  }, {
+    "id" : "ce5a8e01-ab35-40bc-958d-23a19a0bea51",
+    "name" : "email",
+    "description" : "OpenID Connect built-in scope: email",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${emailScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "378219e7-2d85-4182-a104-0b760ac510dc",
+      "name" : "email",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "email",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "93024495-e985-4ad5-bd71-46d92c0e47fc",
+      "name" : "email verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-property-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "emailVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "email_verified",
+        "jsonType.label" : "boolean"
+      }
+    } ]
+  }, {
+    "id" : "623db9d8-be8f-4c63-874a-2d68511f56cf",
+    "name" : "web-origins",
+    "description" : "OpenID Connect scope for add allowed web origins to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "consent.screen.text" : "",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "4f3567af-62bb-49e3-81c3-f631ece34d0f",
+      "name" : "allowed web origins",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-allowed-origins-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "d05841da-b6be-42a0-9a06-73d1aee3571d",
+    "name" : "profile",
+    "description" : "OpenID Connect built-in scope: profile",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${profileScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "ecb3a4ce-40d9-4fd1-aee4-e0a03f6ed2db",
+      "name" : "full name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-full-name-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    }, {
+      "id" : "304cccb7-8dff-4642-bcbb-a02f9c2c3760",
+      "name" : "updated at",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "updatedAt",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "updated_at",
+        "jsonType.label" : "long"
+      }
+    }, {
+      "id" : "e693b91d-ace5-4fc8-b773-e5f3d1b977c5",
+      "name" : "profile",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "profile",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "profile",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "402bf576-5e6b-4066-bc7e-3cdc38f5a1ca",
+      "name" : "nickname",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "nickname",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "nickname",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "1622ae6c-f0b1-4e7c-919f-dea5bead1404",
+      "name" : "username",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "preferred_username",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "e7664219-d7ec-48dc-b240-93dff7fc3443",
+      "name" : "website",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "website",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "website",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "69a974f4-3869-4442-80a6-187e6e6ce1a8",
+      "name" : "zoneinfo",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "zoneinfo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "zoneinfo",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "8bf84e05-6697-4f9e-bf52-d478197b2726",
+      "name" : "locale",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "locale",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "locale",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ba5057c1-a653-486f-afd1-1e5c8a92c47c",
+      "name" : "family name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "lastName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "family_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "4ae2526f-77e1-4fc8-9c78-8f0a070a9816",
+      "name" : "middle name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "middleName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "middle_name",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "16a14431-2f83-465c-b689-70cbd133efd5",
+      "name" : "birthdate",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "birthdate",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "birthdate",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "db45c182-5719-4607-a5cf-8aa112d31b08",
+      "name" : "picture",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "picture",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "picture",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "927feb11-43ca-42b9-92de-d78eec193bc1",
+      "name" : "gender",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "gender",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "gender",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ec40fb51-d729-4881-921b-b587590f4268",
+      "name" : "given name",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "firstName",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "given_name",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "7664e49c-ce13-4c98-87b7-dffaca048d6d",
+    "name" : "optional-scope2",
+    "description" : "",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    }
+  }, {
+    "id" : "2ae9c589-e0f8-43dc-923a-b481cd7eb7bb",
+    "name" : "microprofile-jwt",
+    "description" : "Microprofile - JWT built-in scope",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "b9749b0e-1f0f-4a67-ad43-733289b47dd0",
+      "name" : "upn",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "username",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "upn",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "ea7ff94a-63da-4139-b14c-b1947677c2c8",
+      "name" : "groups",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "foo",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "groups",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "3b6371b8-ae71-4cdd-b807-bf247449505c",
+    "name" : "saml_organization",
+    "description" : "Organization Membership",
+    "protocol" : "saml",
+    "attributes" : {
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "c5be2d4b-7a17-456f-9d23-ffcd59581b6d",
+      "name" : "organization",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-organization-membership-mapper",
+      "consentRequired" : false,
+      "config" : { }
+    } ]
+  }, {
+    "id" : "df23893a-1cfa-4ce1-b2e1-271f8acd5174",
+    "name" : "acr",
+    "description" : "OpenID Connect scope for add acr (authentication context class reference) to the token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "0487b356-ddcb-47f2-9c1b-46815422ac0f",
+      "name" : "acr loa level",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-acr-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "id.token.claim" : "true",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "userinfo.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "cf5db3b0-be4f-4937-8cea-288683c2ea3a",
+    "name" : "role_list",
+    "description" : "SAML role list",
+    "protocol" : "saml",
+    "attributes" : {
+      "consent.screen.text" : "${samlRoleListScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "a130f51d-94c4-4721-b7eb-922eaab9ad66",
+      "name" : "role list",
+      "protocol" : "saml",
+      "protocolMapper" : "saml-role-list-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "single" : "false",
+        "attribute.nameformat" : "Basic",
+        "attribute.name" : "Role"
+      }
+    } ]
+  }, {
+    "id" : "f6dbc11a-f838-4a5a-8a37-7225340a3aed",
+    "name" : "optional-scope3",
+    "description" : "",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    }
+  }, {
+    "id" : "9468f958-ad5b-49ef-87f6-3ceaf2c95a45",
+    "name" : "phone",
+    "description" : "OpenID Connect built-in scope: phone",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${phoneScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "c2ed1036-4d62-4013-9b5d-29f2301ec742",
+      "name" : "phone number verified",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumberVerified",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number_verified",
+        "jsonType.label" : "boolean"
+      }
+    }, {
+      "id" : "0a397fe6-c965-4dbd-ab2b-1a972ec75085",
+      "name" : "phone number",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-attribute-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "user.attribute" : "phoneNumber",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "phone_number",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "39659cde-871e-4a56-917d-d55acb1857bd",
+    "name" : "offline_access",
+    "description" : "OpenID Connect built-in scope: offline_access",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "consent.screen.text" : "${offlineAccessScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    }
+  }, {
+    "id" : "7a2458da-d7af-48f2-b47b-8c38305397e1",
+    "name" : "default-scope1",
+    "description" : "",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "display.on.consent.screen" : "true",
+      "gui.order" : "",
+      "consent.screen.text" : ""
+    }
+  }, {
+    "id" : "119e9743-1757-41ab-ad62-c6ecac6dfde4",
+    "name" : "roles",
+    "description" : "OpenID Connect scope for add user roles to the access token",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "consent.screen.text" : "${rolesScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "ea6da298-4ca4-461e-9c5f-c1403579151a",
+      "name" : "client roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-client-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute" : "foo",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "resource_access.${client_id}.roles",
+        "jsonType.label" : "String",
+        "multivalued" : "true"
+      }
+    }, {
+      "id" : "d0caf67c-60db-4180-b60c-0ce33ce2193a",
+      "name" : "realm roles",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usermodel-realm-role-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.attribute" : "foo",
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "realm_access.roles",
+        "jsonType.label" : "String",
+        "multivalued" : "true"
+      }
+    }, {
+      "id" : "18a1df58-7462-4205-8ff4-01bca000793c",
+      "name" : "audience resolve",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-audience-resolve-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "access.token.claim" : "true"
+      }
+    } ]
+  }, {
+    "id" : "da0f8245-3480-45af-b64d-55997fbe1b65",
+    "name" : "service_account",
+    "description" : "Specific scope for a client enabled for service accounts",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "false",
+      "display.on.consent.screen" : "false"
+    },
+    "protocolMappers" : [ {
+      "id" : "5eb7b1d2-ca61-449d-92cf-ee424fd47bf1",
+      "name" : "Client IP Address",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientAddress",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientAddress",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "d7baae08-a934-4307-9fc7-32de1e5f6099",
+      "name" : "Client Host",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "clientHost",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "clientHost",
+        "jsonType.label" : "String"
+      }
+    }, {
+      "id" : "41052c9d-c540-4d68-a1bf-51b55e8b468a",
+      "name" : "Client ID",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-usersessionmodel-note-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "user.session.note" : "client_id",
+        "introspection.token.claim" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "client_id",
+        "jsonType.label" : "String"
+      }
+    } ]
+  }, {
+    "id" : "e4bc61cb-22f5-473b-988e-5a6717544030",
+    "name" : "organization",
+    "description" : "Additional claims about the organization a subject belongs to",
+    "protocol" : "openid-connect",
+    "attributes" : {
+      "include.in.token.scope" : "true",
+      "consent.screen.text" : "${organizationScopeConsentText}",
+      "display.on.consent.screen" : "true"
+    },
+    "protocolMappers" : [ {
+      "id" : "30dd5081-e494-4651-a247-4ac4f48346c0",
+      "name" : "organization",
+      "protocol" : "openid-connect",
+      "protocolMapper" : "oidc-organization-membership-mapper",
+      "consentRequired" : false,
+      "config" : {
+        "introspection.token.claim" : "true",
+        "multivalued" : "true",
+        "userinfo.token.claim" : "true",
+        "id.token.claim" : "true",
+        "access.token.claim" : "true",
+        "claim.name" : "organization",
+        "jsonType.label" : "String"
+      }
+    } ]
+  } ],
+  "defaultDefaultClientScopes" : [ "role_list", "roles", "acr", "basic" ],
+  "defaultOptionalClientScopes" : [ ],
+  "browserSecurityHeaders" : {
+    "contentSecurityPolicyReportOnly" : "",
+    "xContentTypeOptions" : "nosniff",
+    "referrerPolicy" : "no-referrer",
+    "xRobotsTag" : "none",
+    "xFrameOptions" : "SAMEORIGIN",
+    "contentSecurityPolicy" : "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
+    "strictTransportSecurity" : "max-age=31536000; includeSubDomains"
+  },
+  "smtpServer" : { },
+  "eventsEnabled" : false,
+  "eventsListeners" : [ "jboss-logging", "event-queue" ],
+  "enabledEventTypes" : [ ],
+  "adminEventsEnabled" : false,
+  "adminEventsDetailsEnabled" : false,
+  "identityProviders" : [ ],
+  "identityProviderMappers" : [ ],
+  "components" : {
+    "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" : [ {
+      "id" : "a29d9fa1-1a58-4199-8fef-85033050069f",
+      "name" : "Max Clients Limit",
+      "providerId" : "max-clients",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "max-clients" : [ "200" ]
+      }
+    }, {
+      "id" : "e9767dba-fb59-4ecc-a873-dcb1ff6b73e4",
+      "name" : "Consent Required",
+      "providerId" : "consent-required",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "840a750b-ca05-4fb4-9d96-5b820ef45fe3",
+      "name" : "Trusted Hosts",
+      "providerId" : "trusted-hosts",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "host-sending-registration-request-must-match" : [ "true" ],
+        "client-uris-must-match" : [ "true" ]
+      }
+    }, {
+      "id" : "b09d78bf-96dc-4726-ba0b-91ebe882633c",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    }, {
+      "id" : "76b2ee49-e40f-407b-9a34-e375c466d244",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "authenticated",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "saml-user-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-property-mapper" ]
+      }
+    }, {
+      "id" : "b31a7412-9ea6-4066-ad5b-84ba897706bb",
+      "name" : "Full Scope Disabled",
+      "providerId" : "scope",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : { }
+    }, {
+      "id" : "b0135f8f-e87a-4949-8403-94fd89925a1f",
+      "name" : "Allowed Protocol Mapper Types",
+      "providerId" : "allowed-protocol-mappers",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allowed-protocol-mapper-types" : [ "oidc-usermodel-property-mapper", "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper", "saml-role-list-mapper" ]
+      }
+    }, {
+      "id" : "d85b2fc3-24d6-4e5a-90e9-878ddef983ee",
+      "name" : "Allowed Client Scopes",
+      "providerId" : "allowed-client-templates",
+      "subType" : "anonymous",
+      "subComponents" : { },
+      "config" : {
+        "allow-default-scopes" : [ "true" ]
+      }
+    } ],
+    "org.keycloak.keys.KeyProvider" : [ {
+      "id" : "bb34c674-9079-49a8-a507-03d2e7fa4d0e",
+      "name" : "rsa-generated",
+      "providerId" : "rsa-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEogIBAAKCAQEApuC7ooZH2JSzp3u087qdsT/G4cWe8NUlbYQxHhTOfSAUp2UzpJqbwfKh7FMvaQA5gb9/JM3ic7z4j/zu277KV4WC91XRaGotnwsdDSEWd2oi7ijQCjJbGeHpMzlr+K9bRn3beG7s53xPgfQ+LD6dEW/jVfj0Ez2aulq5MtYcPHXGV9tDE+WOXGKuUxGkzNMXysxG/B0+LQkRRb63KhlZ4P6tON/rQalKJCGVCaKpv5TkKgs6vZcIc+zvaQF7WRnDIo4donasd+83d7U+s7UEQpnyjN29oNPjZ/G6WvfaSnpeeyojJrb3ZiBdJ9/SkmYa6jgoA0uXP3iCrnO1UH66fQIDAQABAoIBAEc3dEwFU2b9+veYZx52vzJ0HcufO1fbFsh4mD+WsJKcnMPdgB8Yri0kf27sBzkf0+rnzvpldOVguZE1Z7hW4WJdg4lLUf1mBscvhnviaYSXwoVx3Grll5RhoVRvhoEQUPsx3fY1HJwjpIi4s8nNBNn6roGzp3IIod4ytoOX9V/lT010U+Voz+CWCT4hfibe+NN8ZRKQirRvjgP3T95QARGaENiwKz1k5I6igqVqlAU9VI4c/iiimquL+Xj3E34Asox+EriqkoOu9zsxjW4hTpw3VZlut9yK+3WkntDylpQ+9rK68t+Ku5KH0RrL9hAXBksdLiw0IBkR4ftlZx/3bp8CgYEA649FHy3EhFzD6Qu4OOpoCsN/HbjO/uINKE6TFeIcHI5VO4sWXt0Pk4vrKXBQhmHH2d/f8yK7Ov2DC+uKc8lo6pySJtzTlcTjTZx9AX8wJzYcj3v1Fao4ELQ/Xsl8iBSS1z0W2tVqvwU1YurGAM7pcyTVWr+nNSeDC9sdI8/u4JMCgYEAtVvDcMiERmH/xKZyy8PWGrjWqyIAN/0oLgDDtzvheXslIrwy5ImKlo7r6A9B1276azjegVB7dCUKb04Z/PTmazJEs73EaeUIN2aAKdcJIQGUadZBz0mWiX5t38j0je6M9CnKY/EeuAasYeWpAONfA5EW8m6CGOc2wfmXGjzfsq8CgYAlth4ey7j2Z9OFb7bihcR6VKn5HCknbREmLs4lZrmRaMgEbFP8g++Gc5QGYlDB8s2H9+tmhVzsKMHeGqtjtg7x4HcVeaz2ATtSpYbtwmr3HBaecf3epg2rvu+WQTOKpaCMjN8n0ZrxUegmGefxIS8GnBL8IEqom9bDAyU7IoLfuQKBgE6Lz7mpHqDdEMk6zb0ytCgepdq4fx/ApQZHjnxtktnqW8sPd3tDlqJehA2djgagKhUGLFgVY2KKKFrMmLTV3HXQ77BpIAg9CbH00s1MNMf2xzCPezErzeb+uteRUVmnV6Tn9KAUbhmFymMb9HZOA3in/ihBdFcUzMJ2NttGQhxBAoGAZ+qRT1e8R92nz2cmrirZaiR9JxiHW1xGr0V9YRSbrCHF6uOG0jk/sJaA3zklJtbxG9WAPZZIyHEPbdn3zK03787RI+yuUyboYEjnKhGOJ8R/Htro94pSuF5b4NnCmkVZyOd2ONnX2ju0ujfvjtVm/QWvIbQyKnmk/yowT6RNw7U=" ],
+        "keyUse" : [ "SIG" ],
+        "certificate" : [ "MIIClzCCAX8CBgGTd/BVmjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MTEyOTEyMzkxOVoXDTM0MTEyOTEyNDA1OVowDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKbgu6KGR9iUs6d7tPO6nbE/xuHFnvDVJW2EMR4Uzn0gFKdlM6Sam8HyoexTL2kAOYG/fyTN4nO8+I/87tu+yleFgvdV0WhqLZ8LHQ0hFndqIu4o0AoyWxnh6TM5a/ivW0Z923hu7Od8T4H0Piw+nRFv41X49BM9mrpauTLWHDx1xlfbQxPljlxirlMRpMzTF8rMRvwdPi0JEUW+tyoZWeD+rTjf60GpSiQhlQmiqb+U5CoLOr2XCHPs72kBe1kZwyKOHaJ2rHfvN3e1PrO1BEKZ8ozdvaDT42fxulr32kp6XnsqIya292YgXSff0pJmGuo4KANLlz94gq5ztVB+un0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAQbVccd4xZLPC3MV05nyOAfSyO61IZOdiqosQ5QuW35ms6wlmSiQycyTzb4dc0zDLtvYILFilzYTz5bJukFrmMYhlQomce2EpF1BTcdHYJzMxJH4cqWR+Sn7PLW7iIFGwxNw53jbTaxOjCWez/Dngmm+XOnphOVyQkR9ZummHsJC16dpEhiqmTD7ABmO/sUDh6SMHcb2PPa5/1BEVqgA9icVFRq8QjkRWpcicnQDgnBmEo3F0hcN9HUjwL8oY5MMvQkmDWpeIhdRM4mxiWmqKuUk0PYgL6e2JIcL6QUHkHD/NwAuzDZa8HL5snOFs+wjXmdBYkN7x9e5M0Ntdsp8Vbw==" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "4370c7ed-13f2-4a1d-ad7f-32bc7e5fa58e",
+      "name" : "aes-generated",
+      "providerId" : "aes-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "205e7c58-77cc-4410-b2a6-86c38b3c6f90" ],
+        "secret" : [ "Pg8UpOQquorgqScQt8CXAg" ],
+        "priority" : [ "100" ]
+      }
+    }, {
+      "id" : "33b2b8f5-98e2-4673-a976-141c0cec29dc",
+      "name" : "hmac-generated-hs512",
+      "providerId" : "hmac-generated",
+      "subComponents" : { },
+      "config" : {
+        "kid" : [ "7773be1a-8ab5-4b1b-ac95-080155a57725" ],
+        "secret" : [ "IDV48O476iFJT9GviZ6lAzwi0Sv2KrveWYB2Hsp-8uGcO2KgdxHBqPFYywOclj-nu08M4k-yzwV6YkER296ipxXwG3Yad_26kqZEgZXPM0dqG79QxAekOkXJyt7ttE1bMWs2MEnkbkK7ufw9Ji2zlOv9CCPNGbFcfTpJyX8moFQ" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "HS512" ]
+      }
+    }, {
+      "id" : "61040414-276b-4bea-b7a5-e5f3630c5784",
+      "name" : "rsa-enc-generated",
+      "providerId" : "rsa-enc-generated",
+      "subComponents" : { },
+      "config" : {
+        "privateKey" : [ "MIIEowIBAAKCAQEAqwFJqy7TLm+DYt+AYMXPNwoLQFqckTK8yNGiM5WbWwlqko3iQuxz+pbTCOuFdBpEg2AM6uw8hGkJNR1JnbOTw7NutoVt+e5vZxPwk61C4Qfbh7OaaXEVMtSd0BtVr/4hKICIDvsF4JIPpZLXT4sZHw3m3LwQON8OngfvtWWF8jx0DX/vwXvhH/myOb8kS/6yyRWs/P9RK3YZNpRCCVGBFAAPfDSzxpYWDdU4vqgxaddV0hcjeZ69cdezXGY1YietaKiSvYow4OBoCypQq9z+JbqQ0Y6OLm4Zsas7NgIRGpCWpwE7S3KBTNsErcpkrMfv5iacGH5f703D+pKxuoanDwIDAQABAoIBABib7NVyaE3BxS9Qvrwue1g5B87REMBh2YKE40oieOMBreaSqJcSSXaB3LOR6/iotxIORo2gRZfrOGSpEakHk3eRtkMUsfOfzpm6PYrjCkGGzJ7wx9iYv4Dl0XgwwYS8QQVVHz9t/Is0Odriu5Lk5PlFGjjLOle/h0OoHLpcITSaJlTG/ib08rhbQuNai6pz34orngpdz8BKOq4WtKHeI0v/yfiJhUIIbbtpZ1yopTlezQA3AHt4zOpX5RRKPAfqU2rB2zfCgsynp2EhtWgihcSfuXEEep2xecFk1AH5xCd8nvlnfo4PjRQ+AKo2IsO34Ju7SAdvgpfgXHuDfpQwBZECgYEA1hEgsPPAlTCxpp563A2Z671LAZeGAkS+ZnajxQ/tquN6vRz/sPU4ncja88TZD3jSVPa3kwsaeHjiACu+F2c9Tb2c9kos9gu7dsJ395LLhvmtJocplYLJRrSkapwe9atCVvnWx+Q+Db2EqmnydbIdFrbubPq0rQzwXD863Kv5TCUCgYEAzIC5bV2CJBtYUNeTtnlKJA6MCNfTHTCHzwr2efRpLfMzfmhzHvyj9X7/cSCtseR139KiDAfXzoqNz2DPVwOE9yLSjliuLMI41CotBbeWq7De3wrFpgpx3Q/ruUWjwCTkpdN2M1abtfVsCva76befmiGrNPW8itrm0HR/v7Zo5iMCgYB/U16zgbiJxJXWOitvmfN0gXoMr1i5HrR1c5nDi87ct0N5GreHRMRxLVf2aJ6HEmFgwgK8xnzvLU+XtGzztKeFBwRGhiYqDx5o7BC5RCok1XtFEF4OnOUlVir5cnUDwOLLov06lirGt3QifLQHh3K/4Pz9+zzeNXT+GWnkebHltQKBgHk80zFgH1hSkdATjfG/BFJOAXz4nqMOc2UuZaM1X+mq5dtKBv3W30kaikvCCNeOzsbrs8AYIjvDboEELseyQXDWRye2sUO9vT0i5+Ac0AlnaSmn1Dc0t/5Lgv8qpwKxnJAmxkt3TAbawbvaPNs5TjhtP3e9O5LCZdYtStMYTCYrAoGBAI78+2EINbWr1/9nzEHmYi156pML1QiUcLoTBvfV5qh2PUq03QlhpkfkGH5y6wIFjBpNNRyvwbzzND9bjdzR26G1KF9hf1Z7xH0+ZSaMR5bFytmJxv8igYIUVI0WtjQM3LeYdALUjaqI8mYdwTNUzKlGmcYNUmDkq9Fu1jlcefLM" ],
+        "keyUse" : [ "ENC" ],
+        "certificate" : [ "MIIClzCCAX8CBgGTd/BWWjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MTEyOTEyMzkxOVoXDTM0MTEyOTEyNDA1OVowDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKsBSasu0y5vg2LfgGDFzzcKC0BanJEyvMjRojOVm1sJapKN4kLsc/qW0wjrhXQaRINgDOrsPIRpCTUdSZ2zk8OzbraFbfnub2cT8JOtQuEH24ezmmlxFTLUndAbVa/+ISiAiA77BeCSD6WS10+LGR8N5ty8EDjfDp4H77VlhfI8dA1/78F74R/5sjm/JEv+sskVrPz/USt2GTaUQglRgRQAD3w0s8aWFg3VOL6oMWnXVdIXI3mevXHXs1xmNWInrWiokr2KMODgaAsqUKvc/iW6kNGOji5uGbGrOzYCERqQlqcBO0tygUzbBK3KZKzH7+YmnBh+X+9Nw/qSsbqGpw8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAP3FtkIPSAR8ZLVoiWkCEnOl0KUk1WA+/Fnb+3zdfx8bLD2ngGYT2ErgfIMurIQF1ptNRTjMJF7U3hcOQIbS3myP6ImacjQ9xqiWDwueCs41sSYO2pfIilbpHJXpI+hFm3JbK9YtYYsn6NTZzb7QNslWKowPzXKWV6kq7RLshocj2OZC/YlXeze8L0m+PlA/33510nr7dKRhqxxagpFCdtBBxICwTNgoFpOjbMmyA0G0Z53/wc+9SBy4ysnf/S67QCFg+SAtlvNlvjxZpnsDg9ahNBaCW5keOdhhASVurZc6aWL+6JBziAak6n/N7b74NQZ9KgWg05Zu32NUENKEEsA==" ],
+        "priority" : [ "100" ],
+        "algorithm" : [ "RSA-OAEP" ]
+      }
+    } ]
+  },
+  "internationalizationEnabled" : false,
+  "supportedLocales" : [ ],
+  "authenticationFlows" : [ {
+    "id" : "a5cf9ae2-f56a-48b7-a02e-9991a285f132",
+    "alias" : "Account verification options",
+    "description" : "Method with which to verity the existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-email-verification",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Verify Existing Account by Re-authentication",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "8a0f6dd7-96cd-4e02-9a5d-b2e75db524b4",
+    "alias" : "Browser - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "d1e28eb0-1ce1-44f9-8acf-01dd16493952",
+    "alias" : "Browser - Conditional Organization",
+    "description" : "Flow to determine if the organization identity-first login is to be used",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "organization",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "3d2f6c2a-e76d-4c5d-9804-89ea2579bb67",
+    "alias" : "Direct Grant - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "99f00bd9-0aa0-473d-ac8d-5d9a29fe8ca8",
+    "alias" : "First Broker Login - Conditional Organization",
+    "description" : "Flow to determine if the authenticator that adds organization members is to be used",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "idp-add-organization-member",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e0355304-503f-42a1-af30-930422b19003",
+    "alias" : "First broker login - Conditional OTP",
+    "description" : "Flow to determine if the OTP is required for the authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-otp-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "70ba0b65-d5bf-4c1f-bb07-22ce51c00267",
+    "alias" : "Handle Existing Account",
+    "description" : "Handle what to do if there is existing account with same email/username like authenticated identity provider",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-confirm-link",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Account verification options",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "2cdff65b-a950-4355-9239-097718b6b88c",
+    "alias" : "Organization",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional Organization",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f3b066ba-c149-4748-ba3a-5274a410d11b",
+    "alias" : "Reset - Conditional OTP",
+    "description" : "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "conditional-user-configured",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-otp",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "4c749ecd-1045-4a59-b326-85d4942d1ad1",
+    "alias" : "User creation or linking",
+    "description" : "Flow for the existing/non-existing user alternatives",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "create unique user config",
+      "authenticator" : "idp-create-user-if-unique",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Handle Existing Account",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "6827c49b-2d6e-41c0-878d-6aa6ff1972de",
+    "alias" : "Verify Existing Account by Re-authentication",
+    "description" : "Reauthentication of existing account",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "idp-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First broker login - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "724fff13-9893-448f-a913-9c40874676f8",
+    "alias" : "browser",
+    "description" : "Browser based authentication",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-cookie",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "auth-spnego",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "identity-provider-redirector",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 25,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 26,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Organization",
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "forms",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "d4057b9a-013c-4f95-b358-8e22cd7ee848",
+    "alias" : "clients",
+    "description" : "Base authentication for clients",
+    "providerId" : "client-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "client-secret",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-secret-jwt",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "client-x509",
+      "authenticatorFlow" : false,
+      "requirement" : "ALTERNATIVE",
+      "priority" : 40,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "e7a8813e-97f3-48d5-a1c4-bfd34e5a7324",
+    "alias" : "direct grant",
+    "description" : "OpenID Connect Resource Owner Grant",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "direct-grant-validate-username",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "direct-grant-validate-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 30,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Direct Grant - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "fd019ff0-5f39-4733-b274-062804f56d19",
+    "alias" : "docker auth",
+    "description" : "Used by Docker clients to authenticate against the IDP",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "docker-http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "59d9a184-6e67-407d-8416-581c64302815",
+    "alias" : "first broker login",
+    "description" : "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticatorConfig" : "review profile config",
+      "authenticator" : "idp-review-profile",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "User creation or linking",
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 50,
+      "autheticatorFlow" : true,
+      "flowAlias" : "First Broker Login - Conditional Organization",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "6c5d45c5-3941-474c-bb67-1511fb1abc33",
+    "alias" : "forms",
+    "description" : "Username, password, otp and other auth forms.",
+    "providerId" : "basic-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "auth-username-password-form",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 20,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Browser - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "f5fe0754-2643-40b4-ac26-9baf673a6250",
+    "alias" : "registration",
+    "description" : "Registration flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-page-form",
+      "authenticatorFlow" : true,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : true,
+      "flowAlias" : "registration form",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "4751235c-0eaf-4acb-910c-0c2f75d18b16",
+    "alias" : "registration form",
+    "description" : "Registration form",
+    "providerId" : "form-flow",
+    "topLevel" : false,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "registration-user-creation",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-password-action",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 50,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-recaptcha-action",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 60,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "registration-terms-and-conditions",
+      "authenticatorFlow" : false,
+      "requirement" : "DISABLED",
+      "priority" : 70,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "1dc6d03a-d9ad-4347-8ebb-635010dc3d03",
+    "alias" : "reset credentials",
+    "description" : "Reset credentials for a user if they forgot their password or something",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "reset-credentials-choose-user",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-credential-email",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 20,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticator" : "reset-password",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 30,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    }, {
+      "authenticatorFlow" : true,
+      "requirement" : "CONDITIONAL",
+      "priority" : 40,
+      "autheticatorFlow" : true,
+      "flowAlias" : "Reset - Conditional OTP",
+      "userSetupAllowed" : false
+    } ]
+  }, {
+    "id" : "55a5e3d0-ee7f-46ee-a93f-0a255fd9b49c",
+    "alias" : "saml ecp",
+    "description" : "SAML ECP Profile Authentication Flow",
+    "providerId" : "basic-flow",
+    "topLevel" : true,
+    "builtIn" : true,
+    "authenticationExecutions" : [ {
+      "authenticator" : "http-basic-authenticator",
+      "authenticatorFlow" : false,
+      "requirement" : "REQUIRED",
+      "priority" : 10,
+      "autheticatorFlow" : false,
+      "userSetupAllowed" : false
+    } ]
+  } ],
+  "authenticatorConfig" : [ {
+    "id" : "cecadfa7-f77a-4579-ab83-fce6c8cb9ce5",
+    "alias" : "create unique user config",
+    "config" : {
+      "require.password.update.after.registration" : "false"
+    }
+  }, {
+    "id" : "b3cff144-522e-498d-a2d4-cf1710933ba8",
+    "alias" : "review profile config",
+    "config" : {
+      "update.profile.on.first.login" : "missing"
+    }
+  } ],
+  "requiredActions" : [ {
+    "alias" : "CONFIGURE_TOTP",
+    "name" : "Configure OTP",
+    "providerId" : "CONFIGURE_TOTP",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 10,
+    "config" : { }
+  }, {
+    "alias" : "TERMS_AND_CONDITIONS",
+    "name" : "Terms and Conditions",
+    "providerId" : "TERMS_AND_CONDITIONS",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 20,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PASSWORD",
+    "name" : "Update Password",
+    "providerId" : "UPDATE_PASSWORD",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 30,
+    "config" : { }
+  }, {
+    "alias" : "UPDATE_PROFILE",
+    "name" : "Update Profile",
+    "providerId" : "UPDATE_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 40,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_EMAIL",
+    "name" : "Verify Email",
+    "providerId" : "VERIFY_EMAIL",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 50,
+    "config" : { }
+  }, {
+    "alias" : "delete_account",
+    "name" : "Delete Account",
+    "providerId" : "delete_account",
+    "enabled" : false,
+    "defaultAction" : false,
+    "priority" : 60,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register",
+    "name" : "Webauthn Register",
+    "providerId" : "webauthn-register",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 70,
+    "config" : { }
+  }, {
+    "alias" : "webauthn-register-passwordless",
+    "name" : "Webauthn Register Passwordless",
+    "providerId" : "webauthn-register-passwordless",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 80,
+    "config" : { }
+  }, {
+    "alias" : "VERIFY_PROFILE",
+    "name" : "Verify Profile",
+    "providerId" : "VERIFY_PROFILE",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 90,
+    "config" : { }
+  }, {
+    "alias" : "delete_credential",
+    "name" : "Delete Credential",
+    "providerId" : "delete_credential",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 100,
+    "config" : { }
+  }, {
+    "alias" : "update_user_locale",
+    "name" : "Update User Locale",
+    "providerId" : "update_user_locale",
+    "enabled" : true,
+    "defaultAction" : false,
+    "priority" : 1000,
+    "config" : { }
+  } ],
+  "browserFlow" : "browser",
+  "registrationFlow" : "registration",
+  "directGrantFlow" : "direct grant",
+  "resetCredentialsFlow" : "reset credentials",
+  "clientAuthenticationFlow" : "clients",
+  "dockerAuthenticationFlow" : "docker auth",
+  "firstBrokerLoginFlow" : "first broker login",
+  "attributes" : {
+    "cibaBackchannelTokenDeliveryMode" : "poll",
+    "cibaExpiresIn" : "120",
+    "cibaAuthRequestedUserHint" : "login_hint",
+    "oauth2DeviceCodeLifespan" : "600",
+    "clientOfflineSessionMaxLifespan" : "0",
+    "oauth2DevicePollingInterval" : "5",
+    "clientSessionIdleTimeout" : "0",
+    "parRequestUriLifespan" : "60",
+    "clientSessionMaxLifespan" : "0",
+    "clientOfflineSessionIdleTimeout" : "0",
+    "cibaInterval" : "5",
+    "realmReusableOtpCode" : "false"
+  },
+  "keycloakVersion" : "26.1.2",
+  "userManagedAccessAllowed" : false,
+  "organizationsEnabled" : false,
+  "verifiableCredentialsEnabled" : false,
+  "adminPermissionsEnabled" : false,
+  "clientProfiles" : {
+    "profiles" : [ ]
+  },
+  "clientPolicies" : {
+    "policies" : [ ]
+  }
+}
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json b/testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json
index 3cf2b0556a15..fb4c361624f0 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json
+++ b/testsuite/integration-arquillian/tests/base/src/test/resources/webauthn/testrealm-webauthn.json
@@ -598,6 +598,14 @@
           "userSetupAllowed": false,
           "authenticatorFlow": false
         },
+        {
+          "authenticatorFlow": true,
+          "requirement": "ALTERNATIVE",
+          "priority": 26,
+          "autheticatorFlow": true,
+          "flowAlias": "browser-webauth-organization",
+          "userSetupAllowed": false
+        },
         {
           "requirement": "ALTERNATIVE",
           "priority": 30,
@@ -607,6 +615,47 @@
         }
       ]
     },
+    {
+      "alias": "browser-webauth-organization",
+      "providerId": "basic-flow",
+      "topLevel": false,
+      "builtIn": true,
+      "authenticationExecutions": [
+        {
+          "authenticatorFlow": true,
+          "requirement": "CONDITIONAL",
+          "priority": 10,
+          "autheticatorFlow": true,
+          "flowAlias": "browser-webauthn-conditional-organization",
+          "userSetupAllowed": false
+        }
+      ]
+    },
+    {
+      "alias": "browser-webauthn-conditional-organization",
+      "description": "Flow to determine if the organization identity-first login is to be used",
+      "providerId": "basic-flow",
+      "topLevel": false,
+      "builtIn": true,
+      "authenticationExecutions": [
+        {
+          "authenticator": "conditional-user-configured",
+          "authenticatorFlow": false,
+          "requirement": "REQUIRED",
+          "priority": 10,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        },
+        {
+          "authenticator": "organization",
+          "authenticatorFlow": false,
+          "requirement": "ALTERNATIVE",
+          "priority": 20,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        }
+      ]
+    },
     {
       "alias": "browser-webauthn-forms",
       "description": "Username, password, otp and other auth forms.",
@@ -1143,4 +1192,4 @@
   "supportedLocales": ["en", "de"],
   "defaultLocale": "en",
   "eventsListeners": ["jboss-logging", "event-queue"]
-}
\ No newline at end of file
+}
diff --git a/testsuite/integration-arquillian/tests/base/testsuites/base-suite b/testsuite/integration-arquillian/tests/base/testsuites/base-suite
index 25c0a7332376..84fdae10693e 100644
--- a/testsuite/integration-arquillian/tests/base/testsuites/base-suite
+++ b/testsuite/integration-arquillian/tests/base/testsuites/base-suite
@@ -9,7 +9,6 @@ client,4
 cluster,IGNORED
 composites,4
 cookies,4
-crossdc,IGNORED
 docker,4
 domainextension,4
 error,4
@@ -19,7 +18,6 @@ feature,4
 federation,5
 forms,5
 i18n,5
-javascript,5
 keys,4
 login,4
 metrics,4
diff --git a/testsuite/integration-arquillian/tests/base/testsuites/forms-suite b/testsuite/integration-arquillian/tests/base/testsuites/forms-suite
index bf42cd8da2b6..dd7aa8cb081d 100644
--- a/testsuite/integration-arquillian/tests/base/testsuites/forms-suite
+++ b/testsuite/integration-arquillian/tests/base/testsuites/forms-suite
@@ -1,2 +1,3 @@
 org.keycloak.testsuite.forms.**
-org.keycloak.testsuite.actions.RequiredActionUpdateProfileTest
\ No newline at end of file
+org.keycloak.testsuite.actions.RequiredActionUpdateProfileTest
+org.keycloak.testsuite.actions.TermsAndConditionsTest
diff --git a/testsuite/integration-arquillian/tests/other/pom.xml b/testsuite/integration-arquillian/tests/other/pom.xml
index 5cd36b348e47..108447c25c72 100644
--- a/testsuite/integration-arquillian/tests/other/pom.xml
+++ b/testsuite/integration-arquillian/tests/other/pom.xml
@@ -59,38 +59,13 @@
                                         <artifactId>integration-arquillian-tests-base</artifactId>
                                         <version>${project.version}</version>
                                         <classifier>tests</classifier>
-                                        <includes>arquillian.xml,wildfly-config.xml,keycloak-add-user.json,test-constants.properties,kerberos/*,keystore/*,password-blacklists/*,log4j.properties,vault/*</includes>
+                                        <includes>arquillian.xml,wildfly-config.xml,test-constants.properties,kerberos/*,keystore/*,password-blacklists/*,log4j.properties,vault/*</includes>
                                     </artifactItem>
                                 </artifactItems>
                             </configuration>
                         </execution>
                     </executions>
                 </plugin>
-                <plugin>
-                    <artifactId>maven-resources-plugin</artifactId>
-                    <executions>
-                        <execution>
-                            <id>copy-admin-user-json-file</id>
-                            <phase>process-test-resources</phase>
-                            <goals>
-                                <goal>copy-resources</goal>
-                            </goals>
-                            <configuration>
-                                <skip>${skip.add.user.json}</skip>
-                                <outputDirectory>${auth.server.config.dir}</outputDirectory>
-                                <resources>
-                                    <resource>
-                                        <directory>${project.build.directory}/dependency</directory>
-                                        <includes>
-                                            <include>keycloak-add-user.json</include>
-                                        </includes>
-                                        <filtering>true</filtering>
-                                    </resource>
-                                </resources>
-                            </configuration>
-                        </execution>
-                    </executions>
-                </plugin>
             </plugins>
         </pluginManagement>
     </build>
diff --git a/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/AbstractBaseSSSDTest.java b/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/AbstractBaseSSSDTest.java
index ee2552516dc5..ed784ad0703f 100644
--- a/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/AbstractBaseSSSDTest.java
+++ b/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/AbstractBaseSSSDTest.java
@@ -35,7 +35,7 @@
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.LoginUpdateProfilePage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 
 /**
  * <p>Abstract base class for SSSD tests.</p>
@@ -81,12 +81,11 @@ protected void testLoginFailure(String username, String password) {
     }
 
     protected void testLoginSuccess(String username) {
-        loginPage.open();
-        loginPage.login(username, getPassword(username));
+        oauth.doLogin(username, getPassword(username));
         Assert.assertEquals(AppPage.RequestType.AUTH_RESPONSE, appPage.getRequestType());
         EventRepresentation loginEvent = events.expectLogin().user(Matchers.any(String.class))
                 .detail(Details.USERNAME, username).assertEvent();
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         appPage.logout(tokenResponse.getIdToken());
         events.expectLogout(loginEvent.getSessionId()).user(loginEvent.getUserId()).assertEvent();
     }
diff --git a/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/SSSDUserProfileTest.java b/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/SSSDUserProfileTest.java
index 81965f78e2a4..c728b2116ae2 100644
--- a/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/SSSDUserProfileTest.java
+++ b/testsuite/integration-arquillian/tests/other/sssd/src/test/java/org/keycloak/testsuite/sssd/SSSDUserProfileTest.java
@@ -43,7 +43,7 @@
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
-import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.WaitUtils;
 import org.keycloak.userprofile.config.UPConfigUtils;
 
@@ -97,8 +97,7 @@ public void test02DefaultSSSDUserProfile() throws Exception {
         userResource.update(user);
 
         // for user the same, the four attrs should be read-only
-        loginPage.open();
-        loginPage.login(username, getPassword(username));
+        oauth.doLogin(username, getPassword(username));
         WaitUtils.waitForPageToLoad();
         updateProfilePage.assertCurrent();
         Assert.assertEquals(getFirstName(username), updateProfilePage.getFirstName());
@@ -123,7 +122,7 @@ public void test02DefaultSSSDUserProfile() throws Exception {
                 .assertEvent();
 
         // logout
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         appPage.logout(tokenResponse.getIdToken());
         events.expectLogout(loginEvent.getSessionId()).user(loginEvent.getUserId()).assertEvent();
     }
@@ -141,8 +140,7 @@ public void test03DefaultInternalDBUserProfile() throws Exception {
         testResource.update(test);
 
         // for user the same, the four attrs should be editable
-        loginPage.open();
-        loginPage.login("test-user@localhost", "password");
+        oauth.doLogin("test-user@localhost", "password");
         WaitUtils.waitForPageToLoad();
         updateProfilePage.assertCurrent();
         Assert.assertEquals("Tom", updateProfilePage.getFirstName());
@@ -167,7 +165,7 @@ public void test03DefaultInternalDBUserProfile() throws Exception {
                 .assertEvent();
 
         // logout
-        OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+        AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
         appPage.logout(tokenResponse.getIdToken());
         events.expectLogout(loginEvent.getSessionId()).user(loginEvent.getUserId()).assertEvent();
     }
@@ -192,8 +190,7 @@ public void test04MixedSSSDUserProfile() throws Exception {
             // for user, firstName and lastName are not visible, username and email read-only, postal_code editable
             user.getRequiredActions().add(UserModel.RequiredAction.UPDATE_PROFILE.toString());
             userResource.update(user);
-            loginPage.open();
-            loginPage.login(username, getPassword(username));
+            oauth.doLogin(username, getPassword(username));
             WaitUtils.waitForPageToLoad();
             updateProfilePage.assertCurrent();
             Assert.assertEquals(getEmail(username), updateProfilePage.getEmail());
@@ -218,7 +215,7 @@ public void test04MixedSSSDUserProfile() throws Exception {
                     .assertEvent();
 
             // logout
-            OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
             appPage.logout(tokenResponse.getIdToken());
             events.expectLogout(loginEvent.getSessionId()).user(loginEvent.getUserId()).assertEvent();
         } finally {
@@ -244,8 +241,7 @@ public void test05MixedInternalDBUserProfile() throws Exception {
             // for user, firstName and lastName are not visible, username, email read-only and postal_code editable
             test.getRequiredActions().add(UserModel.RequiredAction.UPDATE_PROFILE.toString());
             testResource.update(test);
-            loginPage.open();
-            loginPage.login("test-user@localhost", "password");
+            oauth.doLogin("test-user@localhost", "password");
             WaitUtils.waitForPageToLoad();
             updateProfilePage.assertCurrent();
             Assert.assertEquals("test-user@localhost", updateProfilePage.getEmail());
@@ -270,7 +266,7 @@ public void test05MixedInternalDBUserProfile() throws Exception {
                     .assertEvent();
 
             // logout
-            OAuthClient.AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
+            AccessTokenResponse tokenResponse = sendTokenRequestAndGetResponse(loginEvent);
             appPage.logout(tokenResponse.getIdToken());
             events.expectLogout(loginEvent.getSessionId()).user(loginEvent.getUserId()).assertEvent();
         } finally {
diff --git a/testsuite/integration-arquillian/tests/other/webauthn/osv-scanner.toml b/testsuite/integration-arquillian/tests/other/webauthn/osv-scanner.toml
new file mode 100644
index 000000000000..e3d93ec40532
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/other/webauthn/osv-scanner.toml
@@ -0,0 +1,19 @@
+# Ignore false positives for https://securityscorecards.dev/viewer/?uri=github.com/keycloak/keycloak
+
+# guava is a test dependency coming from htmlunit3-driver, not shipped with the server distribution. 
+# There are no plans to upgrading it considering the effort and breaking changes.
+[[IgnoredVulns]]
+id = "GHSA-5mg8-w23w-74h3"
+reason = "suppressed because guava, a transitive dependency from htmlunit3-driver, isn’t included in the server distribution."
+
+# guava is a test dependency coming from htmlunit3-driver, not shipped with the server distribution. 
+# There are no plans to upgrading it considering the effort and breaking changes.
+[[IgnoredVulns]]
+id = "GHSA-7g45-4rm6-3mm3"
+reason = "suppressed because guava, a transitive dependency from htmlunit3-driver, isn’t included in the server distribution."
+
+# commons-io is a test dependency coming from htmlunit, not shipped with the server distribution. 
+# There are no plans to upgrading it considering the effort and breaking changes.
+[[IgnoredVulns]]
+id = "GHSA-78wr-2p64-hpwj"
+reason = "suppressed because commons-io, a transitive dependency from htmlunit, isn’t included in the server distribution."
diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml
index a22feb05776f..6947f179e78b 100644
--- a/testsuite/integration-arquillian/tests/pom.xml
+++ b/testsuite/integration-arquillian/tests/pom.xml
@@ -93,6 +93,7 @@
         <auth.server.remote>false</auth.server.remote>
         <auth.server.quarkus>false</auth.server.quarkus>
         <auth.server.quarkus.embedded>false</auth.server.quarkus.embedded>
+        <auth.server.jgroups.mtls>false</auth.server.jgroups.mtls>
 
         <auth.server.profile/>
         <auth.server.feature/>
@@ -169,9 +170,9 @@
         <dependency.keystore>${dependency.keystore.root}/keycloak.jks</dependency.keystore>
         <dependency.keystore.password>secret</dependency.keystore.password>
 
-        <keycloak.connectionsInfinispan.remoteStoreServer>localhost</keycloak.connectionsInfinispan.remoteStoreServer>
-        <keycloak.connectionsInfinispan.remoteStorePort>12232</keycloak.connectionsInfinispan.remoteStorePort>
-        <keycloak.connectionsInfinispan.remoteStorePort.2>13232</keycloak.connectionsInfinispan.remoteStorePort.2>
+        <keycloak.cacheRemote.hostname>localhost</keycloak.cacheRemote.hostname>
+        <keycloak.cacheRemote.port>12232</keycloak.cacheRemote.port>
+        <keycloak.cacheRemote.port.2>13232</keycloak.cacheRemote.port.2>
         <keycloak.connectionsJpa.url.crossdc>jdbc:h2:mem:test-dc-shared</keycloak.connectionsJpa.url.crossdc>
         <keycloak.testsuite.logging.pattern>%d{HH:mm:ss,SSS} %-5p [%c] %m%n</keycloak.testsuite.logging.pattern>
 
@@ -331,26 +332,6 @@
                 <plugin>
                     <artifactId>maven-resources-plugin</artifactId>
                     <executions>
-                        <execution>
-                            <id>copy-admin-user-json-file</id>
-                            <phase>generate-resources</phase>
-                            <goals>
-                                <goal>copy-resources</goal>
-                            </goals>
-                            <configuration>
-                                <skip>${skip.add.user.json}</skip>
-                                <outputDirectory>${auth.server.config.dir}</outputDirectory>
-                                <resources>
-                                    <resource>
-                                        <directory>src/test/resources</directory>
-                                        <includes>
-                                            <include>keycloak-add-user.json</include>
-                                        </includes>
-                                        <filtering>true</filtering>
-                                    </resource>
-                                </resources>
-                            </configuration>
-                        </execution>
                         <execution>
                             <id>copy-truststore</id>
                             <phase>generate-resources</phase>
@@ -452,6 +433,7 @@
                             <auth.server.keystore.type>${auth.server.keystore.type}</auth.server.keystore.type>
                             <auth.server.java.security.file>${auth.server.java.security.file}</auth.server.java.security.file>
                             <auth.server.jvm.args.extra>${auth.server.jvm.args.extra}</auth.server.jvm.args.extra>
+                            <auth.server.jgroups.mtls>${auth.server.jgroups.mtls}</auth.server.jgroups.mtls>
 
                             <auth.server.profile>${auth.server.profile}</auth.server.profile>
                             <auth.server.feature>${auth.server.feature}</auth.server.feature>
@@ -580,10 +562,9 @@
                             <cache.server.java.home>${cache.server.java.home}</cache.server.java.home>
                             <cache.server.auth>${cache.server.auth}</cache.server.auth>
 
-                            <keycloak.connectionsInfinispan.remoteStorePort>${keycloak.connectionsInfinispan.remoteStorePort}</keycloak.connectionsInfinispan.remoteStorePort>
-                            <keycloak.connectionsInfinispan.remoteStorePort.2>${keycloak.connectionsInfinispan.remoteStorePort.2}</keycloak.connectionsInfinispan.remoteStorePort.2>
-                            <keycloak.connectionsInfinispan.remoteStoreServer>${keycloak.connectionsInfinispan.remoteStoreServer}</keycloak.connectionsInfinispan.remoteStoreServer>
-                            <keycloak.connectionsInfinispan.sessionsOwners>${keycloak.connectionsInfinispan.sessionsOwners}</keycloak.connectionsInfinispan.sessionsOwners>
+                            <keycloak.cacheRemote.port>${keycloak.cacheRemote.port}</keycloak.cacheRemote.port>
+                            <keycloak.cacheRemote.port.2>${keycloak.cacheRemote.port.2}</keycloak.cacheRemote.port.2>
+                            <keycloak.cacheRemote.hostname>${keycloak.cacheRemote.hostname}</keycloak.cacheRemote.hostname>
                             <keycloak.testsuite.logging.pattern>${keycloak.testsuite.logging.pattern}</keycloak.testsuite.logging.pattern>
 
                             <keycloak.connectionsJpa.url.crossdc>${keycloak.connectionsJpa.url.crossdc}</keycloak.connectionsJpa.url.crossdc>
@@ -716,7 +697,6 @@
                 <auth.server.quarkus.skip.unpack>false</auth.server.quarkus.skip.unpack>
                 <auth.server.undertow.skip.unpack>true</auth.server.undertow.skip.unpack>
                 <auth.server.jboss.skip.unpack>true</auth.server.jboss.skip.unpack>
-                <keycloak.connectionsInfinispan.sessionsOwners>2</keycloak.connectionsInfinispan.sessionsOwners>
             </properties>
             <build>
                 <plugins>
@@ -783,7 +763,6 @@
                                     -agentlib:jdwp=transport=dt_socket,server=y,suspend=${cache.server.crossdc2.debug.suspend},address=localhost:${cache.server.crossdc2.jvm.debug.port}
                                 </cache.server.crossdc2.jvm.debug.args>
 
-                                <keycloak.connectionsInfinispan.hotrodProtocolVersion>${keycloak.connectionsInfinispan.hotrodProtocolVersion}</keycloak.connectionsInfinispan.hotrodProtocolVersion>
 
                             </systemPropertyVariables>
                         </configuration>
@@ -804,7 +783,6 @@
                 <auth.server.crossdc11.home>${containers.home}/auth-server-${auth.server}-crossdc11</auth.server.crossdc11.home>
                 <auth.server.crossdc12.home>${containers.home}/auth-server-${auth.server}-crossdc12</auth.server.crossdc12.home>
 
-                <!-- property specifies keycloak-add-user.json file destination -->
                 <auth.server.config.dir>${auth.server.crossdc01.home}/standalone/configuration</auth.server.config.dir>
 
                 <cache.server.crossdc1.jvm.debug.port>6001</cache.server.crossdc1.jvm.debug.port>
@@ -896,8 +874,6 @@
                                 <auth.server.crossdc11.home>${auth.server.crossdc11.home}</auth.server.crossdc11.home>
                                 <auth.server.crossdc12.home>${auth.server.crossdc12.home}</auth.server.crossdc12.home>
 
-                                <keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>${keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled}</keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>
-                                <keycloak.connectionsInfinispan.hotrodProtocolVersion>${keycloak.connectionsInfinispan.hotrodProtocolVersion}</keycloak.connectionsInfinispan.hotrodProtocolVersion>
 
                                 <!--8101-->
                                 <auth.server.crossdc01.port.offset>21</auth.server.crossdc01.port.offset>
@@ -949,8 +925,6 @@
                 <auth.server.crossdc>true</auth.server.crossdc>
                 <cache.server.config.dir>${cache.server.home}/standalone/configuration</cache.server.config.dir>
                 <keycloak.testsuite.logging.pattern>%d{HH:mm:ss,SSS} [%t] %-5p [%c{1.}] %m%n</keycloak.testsuite.logging.pattern>
-                <keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>false</keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>
-                <keycloak.connectionsInfinispan.hotrodProtocolVersion>PROTOCOL_VERSION_30</keycloak.connectionsInfinispan.hotrodProtocolVersion>
             </properties>
             <dependencies>
                 <dependency>
@@ -1020,8 +994,6 @@
                 <cache.server.legacy>true</cache.server.legacy>
                 <cache.server.config.dir>${cache.server.home}/standalone/configuration</cache.server.config.dir>
                 <keycloak.testsuite.logging.pattern>%d{HH:mm:ss,SSS} [%t] %-5p [%c{1.}] %m%n</keycloak.testsuite.logging.pattern>
-                <keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>false</keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>
-                <keycloak.connectionsInfinispan.hotrodProtocolVersion>PROTOCOL_VERSION_30</keycloak.connectionsInfinispan.hotrodProtocolVersion>
             </properties>
             <dependencies>
                 <dependency>
@@ -1091,8 +1063,6 @@
                 <cache.server>infinispan</cache.server>
                 <auth.server.crossdc>true</auth.server.crossdc>
                 <keycloak.testsuite.logging.pattern>%d{HH:mm:ss,SSS} [%t] %-5p [%c{1.}] %m%n</keycloak.testsuite.logging.pattern>
-                <keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>false</keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>
-                <keycloak.connectionsInfinispan.hotrodProtocolVersion>PROTOCOL_VERSION_30</keycloak.connectionsInfinispan.hotrodProtocolVersion>
                 <skip.clean.second.cache>true</skip.clean.second.cache>
             </properties>
             <build>
@@ -1188,8 +1158,6 @@
                 <cache.server>datagrid</cache.server>
                 <auth.server.crossdc>true</auth.server.crossdc>
                 <keycloak.testsuite.logging.pattern>%d{HH:mm:ss,SSS} [%t] %-5p [%c{1.}] %m%n</keycloak.testsuite.logging.pattern>
-                <keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>false</keycloak.connectionsInfinispan.default.remoteStoreSecurityEnabled>
-                <keycloak.connectionsInfinispan.hotrodProtocolVersion>PROTOCOL_VERSION_30</keycloak.connectionsInfinispan.hotrodProtocolVersion>
                 <skip.clean.second.cache>true</skip.clean.second.cache>
             </properties>
             <build>
@@ -1337,8 +1305,6 @@
                 <auth.server.undertow.cluster>true</auth.server.undertow.cluster>
 
                 <auth.server.jboss.skip.unpack>true</auth.server.jboss.skip.unpack>
-
-                <keycloak.connectionsInfinispan.sessionsOwners>2</keycloak.connectionsInfinispan.sessionsOwners>
             </properties>
             <build>
                 <plugins>
@@ -1347,6 +1313,7 @@
                         <configuration>
                             <systemPropertyVariables>
                                 <pageload.timeout>20000</pageload.timeout>
+                                <keycloak.cacheEmbedded.configFile>cluster-test-ispn.xml</keycloak.cacheEmbedded.configFile>
                             </systemPropertyVariables>
                         </configuration>
                     </plugin>
@@ -1552,6 +1519,7 @@
                 <dependency>
                     <groupId>org.jboss.arquillian.protocol</groupId>
                     <artifactId>arquillian-protocol-servlet-jakarta</artifactId>
+                    <version>${arquillian.protocol.servlet.jakarta.version}</version>
                 </dependency>
                 <dependency>
                     <groupId>org.jboss.arquillian.graphene</groupId>
diff --git a/testsuite/model/pom.xml b/testsuite/model/pom.xml
index 9cbeb47de226..8781d5723964 100644
--- a/testsuite/model/pom.xml
+++ b/testsuite/model/pom.xml
@@ -164,8 +164,6 @@
                     <!-- See also https://github.com/wildfly/wildfly-core/blob/7e5624cf92ebe4b64a4793a8c0b2a340c0d6d363/core-feature-pack/common/src/main/resources/content/bin/common.sh#L57-L60 -->
                     <argLine>@{argLine} -Xmx1536m -XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED</argLine>
                     <systemPropertyVariables>
-                        <!-- ensure a log entry if we're running out of JGroup threads -->
-                        <jgroups.thread_dumps_threshold>1</jgroups.thread_dumps_threshold>
                         <!-- keycloak.model.parameters lists parameter classes from 
                              org.keycloak.model.parameters package and determine enabled providers -->
                         <keycloak.model.parameters>${keycloak.model.parameters}</keycloak.model.parameters>
@@ -238,9 +236,9 @@
         </profile>
 
         <profile>
-            <id>jpa+cross-dc-infinispan</id>
+            <id>jpa+multi-site-infinispan</id>
             <properties>
-                <keycloak.model.parameters>CrossDCInfinispan,Jpa</keycloak.model.parameters>
+                <keycloak.model.parameters>RemoteInfinispan,Jpa</keycloak.model.parameters>
             </properties>
             <build>
                 <plugins>
diff --git a/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java b/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java
index 641aa34b77d1..8b1bc4fe7948 100644
--- a/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java
+++ b/testsuite/model/src/main/java/org/keycloak/testsuite/model/HotRodServerRule.java
@@ -2,7 +2,6 @@
 
 import java.io.IOException;
 import java.util.List;
-import java.util.concurrent.ThreadLocalRandom;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Stream;
 
@@ -13,11 +12,6 @@
 import org.infinispan.configuration.cache.BackupFailurePolicy;
 import org.infinispan.configuration.cache.CacheMode;
 import org.infinispan.configuration.cache.ConfigurationBuilder;
-import org.infinispan.container.versioning.IncrementableEntryVersion;
-import org.infinispan.container.versioning.NumericVersion;
-import org.infinispan.container.versioning.VersionGenerator;
-import org.infinispan.factories.ComponentRegistry;
-import org.infinispan.factories.KnownComponentNames;
 import org.infinispan.manager.DefaultCacheManager;
 import org.infinispan.server.hotrod.HotRodServer;
 import org.infinispan.server.hotrod.configuration.HotRodServerConfiguration;
@@ -27,7 +21,7 @@
 import org.junit.rules.ExternalResource;
 import org.keycloak.Config;
 import org.keycloak.connections.infinispan.InfinispanUtil;
-import org.keycloak.marshalling.KeycloakModelSchema;
+import org.keycloak.marshalling.Marshalling;
 
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.ACTION_TOKEN_CACHE;
 import static org.keycloak.connections.infinispan.InfinispanConnectionProvider.AUTHENTICATION_SESSIONS_CACHE_NAME;
@@ -81,7 +75,7 @@ public void createEmbeddedHotRodServer(Config.Scope config) {
 
         // Create a Hot Rod client
         org.infinispan.client.hotrod.configuration.ConfigurationBuilder remoteBuilder = new org.infinispan.client.hotrod.configuration.ConfigurationBuilder();
-        remoteBuilder.addContextInitializers(KeycloakModelSchema.INSTANCE);
+        Marshalling.configure(remoteBuilder);
         org.infinispan.client.hotrod.configuration.Configuration cfg = remoteBuilder
                 .addServers(hotRodServer.getHost() + ":" + hotRodServer.getPort() + ";"
                         + hotRodServer2.getHost() + ":" + hotRodServer2.getPort()).build();
@@ -89,42 +83,12 @@ public void createEmbeddedHotRodServer(Config.Scope config) {
 
         // create remote keycloak caches
         createKeycloakCaches(config.getBoolean("async", false) ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC);
-        replaceVersionGenerator();
 
         // Use Keycloak time service in remote caches
         InfinispanUtil.setTimeServiceToKeycloakTime(hotRodCacheManager);
         InfinispanUtil.setTimeServiceToKeycloakTime(hotRodCacheManager2);
     }
 
-    // ----- WORKAROUND FOR https://github.com/infinispan/infinispan/issues/13191 -----//
-    private void replaceVersionGenerator() {
-        CACHES_NAME.stream()
-                .flatMap(name -> Stream.of(hotRodCacheManager.getCache(name), hotRodCacheManager2.getCache(name)))
-                .map(ComponentRegistry::of)
-                .forEach(cr -> cr.registerComponent(RANDOM_GENERATOR, KnownComponentNames.HOT_ROD_VERSION_GENERATOR, false));
-    }
-
-    private static final NumericVersion NON_EXISTING = new NumericVersion(0);
-    private static final VersionGenerator RANDOM_GENERATOR = new VersionGenerator() {
-        @Override
-        public IncrementableEntryVersion generateNew() {
-            var version = ThreadLocalRandom.current().nextLong();
-            return version == 0 ? new NumericVersion(1L) : new NumericVersion(version);
-        }
-
-        @Override
-        public IncrementableEntryVersion increment(IncrementableEntryVersion initialVersion) {
-            // not used by hot rod
-            throw new IllegalStateException();
-        }
-
-        @Override
-        public IncrementableEntryVersion nonExistingVersion() {
-            return NON_EXISTING;
-        }
-    };
-    // ----- END OF WORKAROUND -----//
-
     private void createKeycloakCaches(CacheMode cacheMode) {
         var builder = createCacheConfigurationBuilder();
         builder.clustering().cacheMode(cacheMode);
diff --git a/testsuite/model/src/main/resources/hotrod/hotrod1.xml b/testsuite/model/src/main/resources/hotrod/hotrod1.xml
index c8cfb3c43cd9..7abdb4974346 100644
--- a/testsuite/model/src/main/resources/hotrod/hotrod1.xml
+++ b/testsuite/model/src/main/resources/hotrod/hotrod1.xml
@@ -30,8 +30,6 @@
                  thread_pool.min_threads="${jgroups.thread_pool.min_threads:0}"
                  thread_pool.max_threads="${jgroups.thread_pool.max_threads:200}"
                  thread_pool.keep_alive_time="60000"
-
-                 thread_pool.thread_dumps_threshold="${jgroups.thread_dumps_threshold:10000}"
             />
             <!-- LOCAL_PING: discovery in the same JVM -->
             <LOCAL_PING stack.combine="REPLACE" stack.position="PING"/>
@@ -53,4 +51,4 @@
         <!-- Use the "xsite" stack for cluster transport. -->
         <transport cluster="external-site-1" stack="xsite"/>
     </cache-container>
-</infinispan>
\ No newline at end of file
+</infinispan>
diff --git a/testsuite/model/src/main/resources/hotrod/hotrod2.xml b/testsuite/model/src/main/resources/hotrod/hotrod2.xml
index 6f52fec11fd6..790e7b66f3b8 100644
--- a/testsuite/model/src/main/resources/hotrod/hotrod2.xml
+++ b/testsuite/model/src/main/resources/hotrod/hotrod2.xml
@@ -30,8 +30,6 @@
                  thread_pool.min_threads="${jgroups.thread_pool.min_threads:0}"
                  thread_pool.max_threads="${jgroups.thread_pool.max_threads:200}"
                  thread_pool.keep_alive_time="60000"
-
-                 thread_pool.thread_dumps_threshold="${jgroups.thread_dumps_threshold:10000}"
             />
             <!-- LOCAL_PING: discovery in the same JVM -->
             <LOCAL_PING stack.combine="REPLACE" stack.position="PING"/>
@@ -53,4 +51,4 @@
         <!-- Use the "xsite" stack for cluster transport. -->
         <transport cluster="external-site-2" stack="xsite"/>
     </cache-container>
-</infinispan>
\ No newline at end of file
+</infinispan>
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/KeycloakModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/KeycloakModelTest.java
index c7506ea9c667..13272c6e92b1 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/KeycloakModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/KeycloakModelTest.java
@@ -54,10 +54,11 @@
 import org.keycloak.services.DefaultComponentFactoryProviderFactory;
 import org.keycloak.services.DefaultKeycloakSessionFactory;
 import org.keycloak.services.resteasy.ResteasyKeycloakSessionFactory;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProviderFactory;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProviderSpi;
 import org.keycloak.storage.DatastoreProviderFactory;
 import org.keycloak.storage.DatastoreSpi;
 import org.keycloak.timer.TimerSpi;
-import com.google.common.collect.ImmutableSet;
 
 import java.lang.management.LockInfo;
 import java.lang.management.ManagementFactory;
@@ -175,9 +176,9 @@ private static boolean checkProviderAvailability(RequireProvider annotation) {
         @Override
         public Statement apply(Statement base, Description description) {
             Stream<RequireProvider> st = Optional.ofNullable(description.getAnnotation(RequireProviders.class))
-              .map(RequireProviders::value)
-              .map(Stream::of)
-              .orElseGet(Stream::empty);
+                    .map(RequireProviders::value)
+                    .stream()
+                    .flatMap(Stream::of);
 
             RequireProvider rp = description.getAnnotation(RequireProvider.class);
             if (rp != null) {
@@ -232,37 +233,37 @@ protected void finished(Description description) {
         }
     };
 
-    private static final Set<Class<? extends Spi>> ALLOWED_SPIS = ImmutableSet.<Class<? extends Spi>>builder()
-      .add(AuthorizationSpi.class)
-      .add(PolicySpi.class)
-      .add(ClientScopeSpi.class)
-      .add(ClientSpi.class)
-      .add(ComponentFactorySpi.class)
-      .add(ClusterSpi.class)
-      .add(EventStoreSpi.class)
-      .add(ExecutorsSpi.class)
-      .add(GroupSpi.class)
-      .add(RealmSpi.class)
-      .add(RoleSpi.class)
-      .add(DeploymentStateSpi.class)
-      .add(StoreFactorySpi.class)
-      .add(TimerSpi.class)
-      .add(TracingSpi.class)
-      .add(UserLoginFailureSpi.class)
-      .add(UserSessionSpi.class)
-      .add(UserSpi.class)
-      .add(DatastoreSpi.class)
-      .build();
-
-    private static final Set<Class<? extends ProviderFactory>> ALLOWED_FACTORIES = ImmutableSet.<Class<? extends ProviderFactory>>builder()
-      .add(ComponentFactoryProviderFactory.class)
-      .add(DefaultAuthorizationProviderFactory.class)
-      .add(PolicyProviderFactory.class)
-      .add(DefaultExecutorsProviderFactory.class)
-      .add(DeploymentStateProviderFactory.class)
-      .add(DatastoreProviderFactory.class)
-      .add(TracingProviderFactory.class)
-      .build();
+    private static final Set<Class<? extends Spi>> ALLOWED_SPIS = Set.of(
+            AuthorizationSpi.class,
+            PolicySpi.class,
+            ClientScopeSpi.class,
+            ClientSpi.class,
+            ComponentFactorySpi.class,
+            ClusterSpi.class,
+            EventStoreSpi.class,
+            ExecutorsSpi.class,
+            GroupSpi.class,
+            RealmSpi.class,
+            RoleSpi.class,
+            DeploymentStateSpi.class,
+            StoreFactorySpi.class,
+            TimerSpi.class,
+            TracingSpi.class,
+            UserLoginFailureSpi.class,
+            UserSessionSpi.class,
+            UserSpi.class,
+            DatastoreSpi.class,
+            CacheRemoteConfigProviderSpi.class);
+
+    private static final Set<Class<? extends ProviderFactory>> ALLOWED_FACTORIES = Set.of(
+            ComponentFactoryProviderFactory.class,
+            DefaultAuthorizationProviderFactory.class,
+            PolicyProviderFactory.class,
+            DefaultExecutorsProviderFactory.class,
+            DeploymentStateProviderFactory.class,
+            DatastoreProviderFactory.class,
+            TracingProviderFactory.class,
+            CacheRemoteConfigProviderFactory.class);
 
     protected static final List<KeycloakModelParameters> MODEL_PARAMETERS;
     protected static final Config CONFIG = new Config(KeycloakModelTest::useDefaultFactory);
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/MigrationModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/MigrationModelTest.java
index eaa570106016..611a443c6862 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/MigrationModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/MigrationModelTest.java
@@ -19,7 +19,6 @@
 import java.util.List;
 import jakarta.persistence.EntityManager;
 import org.jboss.logging.Logger;
-import org.junit.Assert;
 import org.junit.Test;
 import org.keycloak.common.Version;
 import org.keycloak.connections.jpa.JpaConnectionProvider;
@@ -28,17 +27,26 @@
 import org.keycloak.models.ClientProvider;
 import org.keycloak.models.ClientScopeProvider;
 import org.keycloak.models.Constants;
+import org.keycloak.models.DeploymentStateProvider;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RealmProvider;
 import org.keycloak.models.jpa.entities.MigrationModelEntity;
-import org.keycloak.models.DeploymentStateProvider;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
 
 @RequireProvider(value=RealmProvider.class, only="jpa")
 @RequireProvider(value=ClientProvider.class, only="jpa")
 @RequireProvider(value=ClientScopeProvider.class, only="jpa")
 public class MigrationModelTest extends KeycloakModelTest {
 
+    private static final Logger logger = Logger.getLogger(MigrationModelTest.class);
+
     private String realmId;
 
     @Override
@@ -57,47 +65,148 @@ public void cleanEnvironment(KeycloakSession s) {
     }
 
     @Test
-    public void test() {
+    public void multipleEntities() {
         inComittedTransaction(1, (session , i) -> {
-
             String currentVersion = new ModelVersion(Version.VERSION).toString();
+            EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
 
-            JpaConnectionProvider p = session.getProvider(JpaConnectionProvider.class);
-            EntityManager em = p.getEntityManager();
-
-            List<MigrationModelEntity> l = em.createQuery("select m from MigrationModelEntity m ORDER BY m.updatedTime DESC", MigrationModelEntity.class).getResultList();
-            Assert.assertEquals(1, l.size());
-            Assert.assertTrue(l.get(0).getId().matches("[\\da-z]{5}"));
-            Assert.assertEquals(currentVersion, l.get(0).getVersion());
+            List<MigrationModelEntity> entities = getMigrationEntities(em);
+            assertThat(entities.size(), is(1));
+            assertMigrationModelEntity(entities.get(0), currentVersion);
 
             MigrationModel m = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
-            Assert.assertEquals(currentVersion, m.getStoredVersion());
-            Assert.assertEquals(m.getResourcesTag(), l.get(0).getId());
+            assertThat(m.getStoredVersion(), is(currentVersion));
+            assertThat(entities.get(0).getId(), is(m.getResourcesTag()));
 
             setTimeOffset(-60000);
 
-            session.getProvider(DeploymentStateProvider.class).getMigrationModel().setStoredVersion("6.0.0");
-            em.flush();
+            try {
+                session.getProvider(DeploymentStateProvider.class).getMigrationModel().setStoredVersion("6.0.0");
+                em.flush();
 
-            setTimeOffset(0);
+                setTimeOffset(0);
 
-            l = em.createQuery("select m from MigrationModelEntity m ORDER BY m.updatedTime DESC", MigrationModelEntity.class).getResultList();
-            Assert.assertEquals(2, l.size());
-            Logger.getLogger(MigrationModelTest.class).info("MigrationModelEntity entries: ");
-            Logger.getLogger(MigrationModelTest.class).info("--id: " + l.get(0).getId() + "; " + l.get(0).getVersion() + "; " + l.get(0).getUpdateTime());
-            Logger.getLogger(MigrationModelTest.class).info("--id: " + l.get(1).getId() + "; " + l.get(1).getVersion() + "; " + l.get(1).getUpdateTime());
-            Assert.assertTrue(l.get(0).getId().matches("[\\da-z]{5}"));
-            Assert.assertEquals(currentVersion, l.get(0).getVersion());
-            Assert.assertTrue(l.get(1).getId().matches("[\\da-z]{5}"));
-            Assert.assertEquals("6.0.0", l.get(1).getVersion());
+                entities = getMigrationEntities(em);
+                assertThat(entities.size(), is(2));
 
-            m = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
-            Assert.assertEquals(l.get(0).getId(), m.getResourcesTag());
-            Assert.assertEquals(currentVersion, m.getStoredVersion());
+                logger.info("MigrationModelEntity entries: ");
+                entities.forEach(entity -> log.infof("--id: %s; %s; %s", entity.getId(), entity.getVersion(), entity.getUpdateTime()));
 
-            em.remove(l.get(1));
+                assertMigrationModelEntity(entities.get(0), currentVersion);
+                assertMigrationModelEntity(entities.get(1), "6.0.0");
+
+                m = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
+                assertThat(m.getStoredVersion(), is(currentVersion));
+                assertThat(entities.get(0).getId(), is(m.getResourcesTag()));
+            } finally {
+                em.remove(entities.get(1));
+            }
 
             return null;
         });
     }
+
+    @Test
+    public void duplicates() {
+        inComittedTransaction(1, (session, i) -> {
+            String currentVersion = new ModelVersion(Version.VERSION).toString();
+            EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+
+            List<MigrationModelEntity> entities = getMigrationEntities(em);
+            assertThat(entities.size(), is(1));
+            assertMigrationModelEntity(entities.get(0), currentVersion);
+
+            MigrationModel m = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
+            assertThat(m.getStoredVersion(), is(currentVersion));
+            assertThat(entities.get(0).getId(), is(m.getResourcesTag()));
+
+            try {
+                setTimeOffset(-60000);
+                session.getProvider(DeploymentStateProvider.class).getMigrationModel().setStoredVersion("26.2.4");
+                em.flush();
+
+                setTimeOffset(-30000);
+                session.getProvider(DeploymentStateProvider.class).getMigrationModel().setStoredVersion("26.2.5");
+                em.flush();
+
+                setTimeOffset(0);
+
+                entities = getMigrationEntities(em);
+                assertThat(entities.size(), is(3));
+
+                logger.info("MigrationModelEntity entries: ");
+                entities.forEach(entity -> log.infof("--id: %s; %s; %s", entity.getId(), entity.getVersion(), entity.getUpdateTime()));
+
+                assertMigrationModelEntity(entities.get(0), currentVersion);
+                assertMigrationModelEntity(entities.get(1), "26.2.5");
+                assertMigrationModelEntity(entities.get(2), "26.2.4");
+
+                setTimeOffset(-29999);
+                session.getProvider(DeploymentStateProvider.class).getMigrationModel().setStoredVersion("26.2.5");
+                assertThrows(ModelDuplicateException.class, em::flush);
+
+                entities = getMigrationEntities(em);
+                assertThat(entities.size(), is(3));
+
+                assertThat(m.getStoredVersion(), is(currentVersion));
+                assertThat(entities.get(0).getId(), is(m.getResourcesTag()));
+            } finally {
+                em.remove(entities.get(1));
+                em.remove(entities.get(2));
+            }
+
+            return null;
+        });
+    }
+
+    @Test
+    public void duplicatedUpdateTime() {
+        inComittedTransaction(1, (session, i) -> {
+            String currentVersion = new ModelVersion(Version.VERSION).toString();
+            EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+
+            List<MigrationModelEntity> entities = getMigrationEntities(em);
+            assertThat(entities.size(), is(1));
+            assertMigrationModelEntity(entities.get(0), currentVersion);
+
+            MigrationModel m = session.getProvider(DeploymentStateProvider.class).getMigrationModel();
+            assertThat(m.getStoredVersion(), is(currentVersion));
+            assertThat(entities.get(0).getId(), is(m.getResourcesTag()));
+
+            try {
+                MigrationModelEntity mm1 = new MigrationModelEntity();
+                mm1.setId("a");
+                mm1.setUpdatedTime(0);
+                mm1.setVersion("26.0.0");
+                em.persist(mm1);
+
+                em.flush();
+
+                // Same time, everything different - testing for the constraint to be present
+                MigrationModelEntity mm2 = new MigrationModelEntity();
+                mm2.setId("b");
+                mm2.setUpdatedTime(0);
+                mm2.setVersion("26.0.1");
+                em.persist(mm2);
+
+                // added at the same time - exception thrown by the unique constraint
+                assertThrows(ModelDuplicateException.class, em::flush);
+
+            } finally {
+                em.remove(em.find(MigrationModelEntity.class, "a"));
+            }
+
+            return null;
+        });
+    }
+
+    private void assertMigrationModelEntity(MigrationModelEntity model, String expectedVersion) {
+        assertThat(model, notNullValue());
+        assertTrue(model.getId().matches("[\\da-z]{5}"));
+        assertThat(model.getVersion(), is(expectedVersion));
+    }
+
+    private List<MigrationModelEntity> getMigrationEntities(EntityManager em) {
+        return em.createQuery("select m from MigrationModelEntity m ORDER BY m.updatedTime DESC", MigrationModelEntity.class).getResultList();
+    }
 }
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/MultiSiteProfileTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/MultiSiteProfileTest.java
new file mode 100644
index 000000000000..eb952a7ec433
--- /dev/null
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/MultiSiteProfileTest.java
@@ -0,0 +1,39 @@
+package org.keycloak.testsuite.model;
+
+import org.junit.Test;
+import org.keycloak.common.Profile;
+import org.keycloak.models.SingleUseObjectProvider;
+import org.keycloak.models.UserLoginFailureProvider;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.sessions.infinispan.PersistentUserSessionProvider;
+import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanAuthenticationSessionProvider;
+import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanSingleUseObjectProvider;
+import org.keycloak.models.sessions.infinispan.remote.RemoteUserLoginFailureProvider;
+import org.keycloak.sessions.AuthenticationSessionProvider;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.Assume.assumeTrue;
+
+public class MultiSiteProfileTest extends KeycloakModelTest {
+
+    @Test
+    public void testMultiSiteConfiguredCorrectly() {
+        assumeTrue(Profile.isFeatureEnabled(Profile.Feature.MULTI_SITE));
+        assumeTrue(Profile.isFeatureEnabled(Profile.Feature.PERSISTENT_USER_SESSIONS));
+
+        inComittedTransaction(session -> {
+            UserSessionProvider sessions = session.sessions();
+            assertThat(sessions, instanceOf(PersistentUserSessionProvider.class));
+
+            AuthenticationSessionProvider authenticationSessionProvider = session.authenticationSessions();
+            assertThat(authenticationSessionProvider, instanceOf(RemoteInfinispanAuthenticationSessionProvider.class));
+
+            UserLoginFailureProvider userLoginFailureProvider = session.loginFailures();
+            assertThat(userLoginFailureProvider, instanceOf(RemoteUserLoginFailureProvider.class));
+
+            SingleUseObjectProvider singleUseObjectProvider = session.singleUseObjects();
+            assertThat(singleUseObjectProvider, instanceOf(RemoteInfinispanSingleUseObjectProvider.class));
+        });
+    }
+}
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/client/ClientModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/client/ClientModelTest.java
index e9c0b8df0315..6c9b492256f4 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/client/ClientModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/client/ClientModelTest.java
@@ -153,6 +153,7 @@ public void testScopeMappingRoleRemoval() {
         // create two clients, one realm role and one client role and assign both to one of the clients
         inComittedTransaction(1, (session , i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             ClientModel client1 = session.clients().addClient(realm, "client1");
             ClientModel client2 = session.clients().addClient(realm, "client2");
             RoleModel realmRole = session.roles().addRealmRole(realm, "realm-role");
@@ -165,6 +166,7 @@ public void testScopeMappingRoleRemoval() {
         // check everything is OK
         inComittedTransaction(1, (session, i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final ClientModel client1 = session.clients().getClientByClientId(realm, "client1");
             assertThat(client1.getScopeMappingsStream().count(), is(2L));
             assertThat(client1.getScopeMappingsStream().filter(r -> r.getName().equals("realm-role")).count(), is(1L));
@@ -175,6 +177,7 @@ public void testScopeMappingRoleRemoval() {
         // remove the realm role
         inComittedTransaction(1, (session, i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final RoleModel role = session.roles().getRealmRole(realm, "realm-role");
             session.roles().removeRole(role);
             return null;
@@ -183,6 +186,7 @@ public void testScopeMappingRoleRemoval() {
         // check it is removed
         inComittedTransaction(1, (session, i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final ClientModel client1 = session.clients().getClientByClientId(realm, "client1");
             assertThat(client1.getScopeMappingsStream().count(), is(1L));
             assertThat(client1.getScopeMappingsStream().filter(r -> r.getName().equals("client2-role")).count(), is(1L));
@@ -192,6 +196,7 @@ public void testScopeMappingRoleRemoval() {
         // remove client role
         inComittedTransaction(1, (session, i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final ClientModel client2 = session.clients().getClientByClientId(realm, "client2");
             final RoleModel role = session.roles().getClientRole(client2, "client2-role");
             session.roles().removeRole(role);
@@ -201,6 +206,7 @@ public void testScopeMappingRoleRemoval() {
         // check both clients are removed
         inComittedTransaction(1, (session, i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final ClientModel client1 = session.clients().getClientByClientId(realm, "client1");
             assertThat(client1.getScopeMappingsStream().count(), is(0L));
             return null;
@@ -209,6 +215,7 @@ public void testScopeMappingRoleRemoval() {
         // remove clients
         inComittedTransaction(1, (session , i) -> {
             final RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
             final ClientModel client1 = session.clients().getClientByClientId(realm, "client1");
             final ClientModel client2 = session.clients().getClientByClientId(realm, "client2");
             session.clients().removeClient(realm, client1.getId());
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/FeatureEnabledTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/FeatureEnabledTest.java
index e78715d532a7..7058c3169a86 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/FeatureEnabledTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/infinispan/FeatureEnabledTest.java
@@ -76,7 +76,7 @@ public void testEmbeddedCachesOnly() {
         inComittedTransaction(session -> {
             var clusterProvider = session.getProvider(InfinispanConnectionProvider.class);
             Arrays.stream(CLUSTERED_CACHE_NAMES).forEach(s -> assertEmbeddedCacheExists(clusterProvider, s));
-            Arrays.stream(CLUSTERED_CACHE_NAMES).forEach(s -> assertRemoteCacheDoesNotExists(clusterProvider, s));
+            Arrays.stream(CLUSTERED_CACHE_NAMES).forEach(s -> assertRemoteCacheCallThrowsException(clusterProvider, s));
         });
     }
 
@@ -97,8 +97,11 @@ private static void assertRemoteCacheExists(InfinispanConnectionProvider provide
         assertNotNull(String.format("Remote cache '%s' should exist", cacheName), provider.getRemoteCache(cacheName));
     }
 
-    private static void assertRemoteCacheDoesNotExists(InfinispanConnectionProvider provider, String cacheName) {
-        assertNull(String.format("Remote cache '%s' should not exist", cacheName), provider.getRemoteCache(cacheName));
+    private static void assertRemoteCacheCallThrowsException(InfinispanConnectionProvider provider, String cacheName) {
+        try {
+            provider.getRemoteCache(cacheName);
+            fail(String.format("Remote cache '%s' should not exist", cacheName));
+        } catch (IllegalStateException expected) {}
     }
 
 }
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/CrossDCInfinispan.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/CrossDCInfinispan.java
deleted file mode 100644
index 11e8bb5c1a04..000000000000
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/CrossDCInfinispan.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright 2021 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.testsuite.model.parameters;
-
-import org.junit.runner.Description;
-import org.junit.runners.model.Statement;
-import org.keycloak.infinispan.util.InfinispanUtils;
-import org.keycloak.models.UserSessionSpi;
-import org.keycloak.testsuite.model.Config;
-import org.keycloak.testsuite.model.HotRodServerRule;
-import org.keycloak.testsuite.model.KeycloakModelParameters;
-
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-/**
- * @author <a href="mailto:mkanis@redhat.com">Martin Kanis</a>
- */
-public class CrossDCInfinispan extends KeycloakModelParameters {
-
-    private final HotRodServerRule hotRodServerRule = new HotRodServerRule();
-
-    private static final AtomicInteger NODE_COUNTER = new AtomicInteger();
-
-    private static final String SITE_1_MCAST_ADDR = "228.5.6.7";
-
-    private static final String SITE_2_MCAST_ADDR = "228.6.7.8";
-
-    private final Object lock = new Object();
-
-    @Override
-    public void updateConfig(Config cf) {
-        synchronized (lock) {
-            NODE_COUNTER.incrementAndGet();
-            cf.spi("connectionsInfinispan")
-                    .provider("default")
-                    .config("embedded", "true")
-                    .config("clustered", "true")
-                    .config("remoteStoreEnabled", "true")
-                    .config("useKeycloakTimeService", "true")
-                    .config("remoteStoreSecurityEnabled", "false")
-                    .config("nodeName", "node-" + NODE_COUNTER.get())
-                    .config("siteName", siteName(NODE_COUNTER.get()))
-                    .config("remoteStorePort", siteName(NODE_COUNTER.get()).equals("site-2") ? "11333" : "11222")
-                    .config("jgroupsUdpMcastAddr", mcastAddr(NODE_COUNTER.get()))
-                    .config("jgroupsBindAddr", "127.0.0.1") // bind to localhost for testing
-                    .spi(UserSessionSpi.NAME)
-                    .provider(InfinispanUtils.EMBEDDED_PROVIDER_ID)
-                    .config("offlineSessionCacheEntryLifespanOverride", "43200")
-                    .config("offlineClientSessionCacheEntryLifespanOverride", "43200");
-        }
-    }
-
-    public CrossDCInfinispan() {
-        super(Infinispan.ALLOWED_SPIS, Stream.concat(Infinispan.ALLOWED_FACTORIES.stream(), RemoteInfinispan.ALLOWED_FACTORIES.stream()).collect(Collectors.toSet()));
-    }
-
-    @Override
-    public void beforeSuite(Config cf) {
-        hotRodServerRule.createEmbeddedHotRodServer(cf.scope("connectionsInfinispan", "default"));
-    }
-
-    private static String siteName(int node) {
-        return "site-" + (node % 2 == 0 ? 2 : 1);
-    }
-
-    private static String mcastAddr(int node) {
-        return (node % 2 == 0) ? SITE_2_MCAST_ADDR : SITE_1_MCAST_ADDR;
-    }
-
-    @Override
-    public <T> Stream<T> getParameters(Class<T> clazz) {
-        if (HotRodServerRule.class.isAssignableFrom(clazz)) {
-            return Stream.of((T) hotRodServerRule);
-        } else {
-            return Stream.empty();
-        }
-    }
-
-    @Override
-    public Statement classRule(Statement base, Description description) {
-        return hotRodServerRule.apply(base, description);
-    }
-}
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/Infinispan.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/Infinispan.java
index 4bec57507a88..83bcefd469c9 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/Infinispan.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/Infinispan.java
@@ -1,13 +1,13 @@
 /*
  * Copyright 2020 Red Hat, Inc. and/or its affiliates
  * and other contributors as indicated by the @author tags.
- * 
+ *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  * http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -16,6 +16,9 @@
  */
 package org.keycloak.testsuite.model.parameters;
 
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
+
 import com.google.common.collect.ImmutableSet;
 import org.keycloak.cluster.infinispan.InfinispanClusterProviderFactory;
 import org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory;
@@ -34,6 +37,7 @@
 import org.keycloak.models.cache.infinispan.InfinispanCacheRealmProviderFactory;
 import org.keycloak.models.cache.infinispan.InfinispanUserCacheProviderFactory;
 import org.keycloak.models.cache.infinispan.authorization.InfinispanCacheStoreFactoryProviderFactory;
+import org.keycloak.models.cache.infinispan.organization.InfinispanOrganizationProviderFactory;
 import org.keycloak.models.session.UserSessionPersisterSpi;
 import org.keycloak.models.sessions.infinispan.InfinispanAuthenticationSessionProviderFactory;
 import org.keycloak.models.sessions.infinispan.InfinispanSingleUseObjectProviderFactory;
@@ -44,16 +48,18 @@
 import org.keycloak.sessions.AuthenticationSessionSpi;
 import org.keycloak.sessions.StickySessionEncoderProviderFactory;
 import org.keycloak.sessions.StickySessionEncoderSpi;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderFactory;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderSpi;
+import org.keycloak.spi.infinispan.JGroupsCertificateProviderFactory;
+import org.keycloak.spi.infinispan.JGroupsCertificateProviderSpi;
+import org.keycloak.spi.infinispan.impl.embedded.DefaultCacheEmbeddedConfigProviderFactory;
+import org.keycloak.storage.configuration.ServerConfigStorageProviderFactory;
+import org.keycloak.storage.configuration.ServerConfigurationStorageProviderSpi;
 import org.keycloak.testsuite.model.Config;
 import org.keycloak.testsuite.model.KeycloakModelParameters;
 import org.keycloak.timer.TimerProviderFactory;
 
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicInteger;
-import org.keycloak.models.cache.infinispan.organization.InfinispanOrganizationProviderFactory;
-
 /**
- *
  * @author hmlnarik
  */
 public class Infinispan extends KeycloakModelParameters {
@@ -61,44 +67,46 @@ public class Infinispan extends KeycloakModelParameters {
     private static final AtomicInteger NODE_COUNTER = new AtomicInteger();
 
     static final Set<Class<? extends Spi>> ALLOWED_SPIS = ImmutableSet.<Class<? extends Spi>>builder()
-      .add(AuthenticationSessionSpi.class)
-      .add(CacheRealmProviderSpi.class)
-      .add(CachedStoreFactorySpi.class)
-      .add(CacheUserProviderSpi.class)
-      .add(InfinispanConnectionSpi.class)
-      .add(StickySessionEncoderSpi.class)
-      .add(UserSessionPersisterSpi.class)
-      .add(SingleUseObjectSpi.class)
-      .add(PublicKeyStorageSpi.class)
-      .add(CachePublicKeyProviderSpi.class)
-
-      .build();
+            .add(AuthenticationSessionSpi.class)
+            .add(CacheRealmProviderSpi.class)
+            .add(CachedStoreFactorySpi.class)
+            .add(CacheUserProviderSpi.class)
+            .add(InfinispanConnectionSpi.class)
+            .add(StickySessionEncoderSpi.class)
+            .add(UserSessionPersisterSpi.class)
+            .add(SingleUseObjectSpi.class)
+            .add(PublicKeyStorageSpi.class)
+            .add(CachePublicKeyProviderSpi.class)
+            .add(CacheEmbeddedConfigProviderSpi.class)
+            .add(JGroupsCertificateProviderSpi.class)
+            .add(ServerConfigurationStorageProviderSpi.class)
+            .build();
 
     static final Set<Class<? extends ProviderFactory>> ALLOWED_FACTORIES = ImmutableSet.<Class<? extends ProviderFactory>>builder()
-      .add(InfinispanAuthenticationSessionProviderFactory.class)
-      .add(InfinispanCacheRealmProviderFactory.class)
-      .add(InfinispanCacheStoreFactoryProviderFactory.class)
-      .add(InfinispanClusterProviderFactory.class)
-      .add(InfinispanConnectionProviderFactory.class)
-      .add(InfinispanUserCacheProviderFactory.class)
-      .add(InfinispanUserSessionProviderFactory.class)
-      .add(InfinispanUserLoginFailureProviderFactory.class)
-      .add(InfinispanSingleUseObjectProviderFactory.class)
-      .add(StickySessionEncoderProviderFactory.class)
-      .add(TimerProviderFactory.class)
-      .add(InfinispanPublicKeyStorageProviderFactory.class)
-      .add(InfinispanCachePublicKeyProviderFactory.class)
-      .add(InfinispanOrganizationProviderFactory.class)
-      .build();
+            .add(InfinispanAuthenticationSessionProviderFactory.class)
+            .add(InfinispanCacheRealmProviderFactory.class)
+            .add(InfinispanCacheStoreFactoryProviderFactory.class)
+            .add(InfinispanClusterProviderFactory.class)
+            .add(InfinispanConnectionProviderFactory.class)
+            .add(InfinispanUserCacheProviderFactory.class)
+            .add(InfinispanUserSessionProviderFactory.class)
+            .add(InfinispanUserLoginFailureProviderFactory.class)
+            .add(InfinispanSingleUseObjectProviderFactory.class)
+            .add(StickySessionEncoderProviderFactory.class)
+            .add(TimerProviderFactory.class)
+            .add(InfinispanPublicKeyStorageProviderFactory.class)
+            .add(InfinispanCachePublicKeyProviderFactory.class)
+            .add(InfinispanOrganizationProviderFactory.class)
+            .add(CacheEmbeddedConfigProviderFactory.class)
+            .add(JGroupsCertificateProviderFactory.class)
+            .add(ServerConfigStorageProviderFactory.class)
+            .build();
 
     @Override
     public void updateConfig(Config cf) {
         cf.spi("connectionsInfinispan")
                 .provider("default")
-                .config("embedded", "true")
-                .config("clustered", "true")
                 .config("useKeycloakTimeService", "true")
-                .config("nodeName", "node-" + NODE_COUNTER.incrementAndGet())
                 .spi(UserLoginFailureSpi.NAME)
                 .provider(InfinispanUtils.EMBEDDED_PROVIDER_ID)
                 .config("stalledTimeoutInSeconds", "10")
@@ -106,8 +114,12 @@ public void updateConfig(Config cf) {
                 .provider(InfinispanUtils.EMBEDDED_PROVIDER_ID)
                 .config("sessionPreloadStalledTimeoutInSeconds", "10")
                 .config("offlineSessionCacheEntryLifespanOverride", "43200")
-                .config("offlineClientSessionCacheEntryLifespanOverride", "43200")
-        ;
+                .config("offlineClientSessionCacheEntryLifespanOverride", "43200");
+        cf.spi(CacheEmbeddedConfigProviderSpi.SPI_NAME)
+                .provider(DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID)
+                .config(DefaultCacheEmbeddedConfigProviderFactory.CONFIG, "test-ispn.xml")
+                .config(DefaultCacheEmbeddedConfigProviderFactory.NODE_NAME, "node-" + NODE_COUNTER.incrementAndGet());
+
     }
 
     public Infinispan() {
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/RemoteInfinispan.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/RemoteInfinispan.java
index d8cb041436ed..376563ff9ebd 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/RemoteInfinispan.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/parameters/RemoteInfinispan.java
@@ -25,22 +25,22 @@
 import org.junit.runners.model.Statement;
 import org.keycloak.cluster.infinispan.remote.RemoteInfinispanClusterProviderFactory;
 import org.keycloak.connections.infinispan.remote.RemoteLoadBalancerCheckProviderFactory;
-import org.keycloak.infinispan.util.InfinispanUtils;
-import org.keycloak.models.UserSessionSpi;
 import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanAuthenticationSessionProviderFactory;
 import org.keycloak.models.sessions.infinispan.remote.RemoteInfinispanSingleUseObjectProviderFactory;
 import org.keycloak.models.sessions.infinispan.remote.RemoteStickySessionEncoderProviderFactory;
 import org.keycloak.models.sessions.infinispan.remote.RemoteUserLoginFailureProviderFactory;
 import org.keycloak.models.sessions.infinispan.remote.RemoteUserSessionProviderFactory;
 import org.keycloak.provider.ProviderFactory;
+import org.keycloak.spi.infinispan.CacheEmbeddedConfigProviderSpi;
+import org.keycloak.spi.infinispan.CacheRemoteConfigProviderSpi;
+import org.keycloak.spi.infinispan.impl.embedded.DefaultCacheEmbeddedConfigProviderFactory;
+import org.keycloak.spi.infinispan.impl.remote.DefaultCacheRemoteConfigProviderFactory;
 import org.keycloak.testsuite.model.Config;
 import org.keycloak.testsuite.model.HotRodServerRule;
 import org.keycloak.testsuite.model.KeycloakModelParameters;
 
 /**
- * Copied from {@link CrossDCInfinispan}.
- * <p>
- * Adds the new provider factories implementation
+ * Enables RemoteInfinispan and adds all classes needed to connect to remote Infinispan to allowed factories
  */
 public class RemoteInfinispan extends KeycloakModelParameters {
 
@@ -68,22 +68,20 @@ public class RemoteInfinispan extends KeycloakModelParameters {
     @Override
     public void updateConfig(Config cf) {
         synchronized (lock) {
-            NODE_COUNTER.incrementAndGet();
+            var nodeCounter = NODE_COUNTER.incrementAndGet();
+            var siteName = siteName(nodeCounter);
             cf.spi("connectionsInfinispan")
                     .provider("default")
-                    .config("embedded", "true")
-                    .config("clustered", "true")
-                    .config("remoteStoreEnabled", "true")
-                    .config("useKeycloakTimeService", "true")
-                    .config("remoteStoreSecurityEnabled", "false")
-                    .config("nodeName", "node-" + NODE_COUNTER.get())
-                    .config("siteName", siteName(NODE_COUNTER.get()))
-                    .config("remoteStorePort", siteName(NODE_COUNTER.get()).equals("site-2") ? "11333" : "11222")
-                    .config("jgroupsUdpMcastAddr", mcastAddr(NODE_COUNTER.get()))
-                    .spi(UserSessionSpi.NAME)
-                    .provider(InfinispanUtils.EMBEDDED_PROVIDER_ID)
-                    .config("offlineSessionCacheEntryLifespanOverride", "43200")
-                    .config("offlineClientSessionCacheEntryLifespanOverride", "43200");
+                    .config("useKeycloakTimeService", "true");
+            cf.spi(CacheRemoteConfigProviderSpi.SPI_NAME)
+                    .provider(DefaultCacheRemoteConfigProviderFactory.PROVIDER_ID)
+                    .config(DefaultCacheRemoteConfigProviderFactory.HOSTNAME, "localhost")
+                    .config(DefaultCacheRemoteConfigProviderFactory.PORT, siteName.equals("site-2") ? "11333" : "11222");
+            cf.spi(CacheEmbeddedConfigProviderSpi.SPI_NAME)
+                    .provider(DefaultCacheEmbeddedConfigProviderFactory.PROVIDER_ID)
+                    .config(DefaultCacheEmbeddedConfigProviderFactory.CONFIG, "test-ispn.xml")
+                    .config(DefaultCacheEmbeddedConfigProviderFactory.SITE_NAME, siteName(NODE_COUNTER.get()))
+                    .config(DefaultCacheEmbeddedConfigProviderFactory.NODE_NAME, "node-" + NODE_COUNTER.incrementAndGet());
         }
     }
 
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java
index 24827a71da19..3f2a2c8fa397 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/role/RoleModelTest.java
@@ -15,6 +15,7 @@
 
 import java.util.Collection;
 import java.util.List;
+import java.util.Random;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
@@ -28,6 +29,7 @@
 import static org.hamcrest.Matchers.empty;
 import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
 import static org.hamcrest.Matchers.nullValue;
 
 @RequireProvider(RealmProvider.class)
@@ -305,6 +307,93 @@ public void getRolePathTraversal() {
         });
     }
 
+    @Test
+    public void getRoleByNameFromTheDatabaseAndTheCache() {
+        String roleName = "role-" + new Random().nextInt();
+
+        // Look up a non-existent role from the database
+        withRealm(realmId, (session, realm) -> {
+            RoleModel role = session.roles().getRealmRole(realm, roleName);
+            assertThat(role, nullValue());
+            return null;
+        });
+
+        // Look up a non-existent role from the cache
+        withRealm(realmId, (session, realm) -> {
+            RoleModel role = session.roles().getRealmRole(realm, roleName);
+            assertThat(role, nullValue());
+            return null;
+        });
+
+        // Create the role, and invalidate the cache
+        withRealm(realmId, (session, realm) -> {
+            RoleModel role = session.roles().addRealmRole(realm, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+        // Find the role from the database
+        withRealm(realmId, (session, realm) -> {
+            RoleModel role = session.roles().getRealmRole(realm, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+        // Find the role from the cache
+        withRealm(realmId, (session, realm) -> {
+            RoleModel role = session.roles().getRealmRole(realm, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+    }
+
+    @Test
+    public void getClientRoleByNameFromTheDatabaseAndTheCache() {
+        String roleName = "role-" + new Random().nextInt();
+
+        // Look up a non-existent role from the database
+        withRealm(realmId, (session, realm) -> {
+            ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME);
+            RoleModel role = session.roles().getClientRole(client, roleName);
+            assertThat(role, nullValue());
+            return null;
+        });
+
+        // Look up a non-existent role from the cache
+        withRealm(realmId, (session, realm) -> {
+            ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME);
+            RoleModel role = session.roles().getClientRole(client, roleName);
+            assertThat(role, nullValue());
+            return null;
+        });
+
+        // Create the role, and invalidate the cache
+        withRealm(realmId, (session, realm) -> {
+            ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME);
+            RoleModel role = session.roles().addClientRole(client, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+        // Find the role from the database
+        withRealm(realmId, (session, realm) -> {
+            ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME);
+            RoleModel role = session.roles().getClientRole(client, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+        // Find the role from the cache
+        withRealm(realmId, (session, realm) -> {
+            ClientModel client = session.clients().getClientByClientId(realm, CLIENT_NAME);
+            RoleModel role = session.roles().getClientRole(client, roleName);
+            assertThat(role, notNullValue());
+            return null;
+        });
+
+    }
+
     public void testRolesWithIdsPaginationSearchQueries(GetResult resultProvider) {
         // test all parameters together
         List<RoleModel> result = resultProvider.getResult("1", 4, 3);
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/OfflineSessionPersistenceTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/OfflineSessionPersistenceTest.java
index d4319942e2a6..123e92a3a8ec 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/OfflineSessionPersistenceTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/OfflineSessionPersistenceTest.java
@@ -237,11 +237,7 @@ public void testPersistenceMultipleNodesClientSessionsAtRandomNode() throws Inte
 
                 // re-initialize the session factory N times in this test
                 if (index % 100 == 0) {
-                    // don't re-initialize all caches at the same time to avoid an unstable cluster with no leader
-                    // otherwise seen CacheInitializer#loadSessions to loop sleeping
-                    synchronized (OfflineSessionPersistenceTest.class) {
-                        reinitializeKeycloakSessionFactory();
-                    }
+                    reinitializeKeycloakSessionFactory();
                 }
             }
         });
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/SessionTimeoutsTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/SessionTimeoutsTest.java
index 52ae6476ecfb..37c53aea07d6 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/SessionTimeoutsTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/SessionTimeoutsTest.java
@@ -407,7 +407,7 @@ public void testOnlineUserClientIdleTimeoutSmallerThanSessionOneRefresh() {
 
     /**
      * This method introduces a delay to allow replication of clientSession cache on site 1 and site 2.
-     * Without the delay these test fails from time to time. This has no effect when tests run without cross-dc
+     * Without the delay these test fails from time to time. This has no effect when tests run without remote Infinispan
      * @param offline boolean Indicates where we work with offline sessions
      */
     private void allowXSiteReplication(boolean offline) {
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionInitializerTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionInitializerTest.java
index 269162f580e2..b2bde741162e 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionInitializerTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionInitializerTest.java
@@ -133,6 +133,7 @@ public void testUserSessionInitializerWithDeletingClient() {
 
         inComittedTransaction(session -> {
             RealmModel realm = session.realms().getRealm(realmId);
+            session.getContext().setRealm(realm);
 
             // Delete one of the clients now
             ClientModel testApp = realm.getClientByClientId("test-app");
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionProviderOfflineModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionProviderOfflineModelTest.java
index 79f8b2f4d435..a9a3df1c700c 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionProviderOfflineModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/session/UserSessionProviderOfflineModelTest.java
@@ -66,6 +66,7 @@
 import org.keycloak.timer.TimerProvider;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assume.assumeFalse;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -502,10 +503,9 @@ public void testLoadingOfflineClientSessionWhenCreatedBeforeSessionTime() {
 
     @Test
     public void testOfflineSessionLifespanOverride() {
-        // skip the test for CrossDC
-        Assume.assumeFalse(Objects.equals(CONFIG.scope("connectionsInfinispan.default").get("remoteStoreEnabled"), "true"));
         // As offline session's timeout is not overriden when PERSISTENT_USER_SESSIONS is enabled
         Assume.assumeFalse(MultiSiteUtils.isPersistentSessionsEnabled());
+        assumeFalse("Clusterless Feature enabled", Profile.isFeatureEnabled(Profile.Feature.CLUSTERLESS));
 
         createOfflineSessions("user1", 2, new LinkedList<>(), new LinkedList<>());
 
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/singleUseObject/SingleUseObjectModelTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/singleUseObject/SingleUseObjectModelTest.java
index cb9fb721b07b..53f57d0ef0c7 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/singleUseObject/SingleUseObjectModelTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/singleUseObject/SingleUseObjectModelTest.java
@@ -182,6 +182,12 @@ public void testRevokedTokenIsPresentAfterRestartAndEventuallyExpires() {
             singleUseStore.put(revokedKey,  60, Collections.emptyMap());
         });
 
+        // Run again to ensure revocation can happen multiple times
+        inComittedTransaction(session -> {
+            SingleUseObjectProvider singleUseStore = session.singleUseObjects();
+            singleUseStore.put(revokedKey,  60, Collections.emptyMap());
+        });
+
         // simulate restart
         removeRevokedTokenFromRemoteCache(revokedKey);
         reinitializeKeycloakSessionFactory();
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/FederatedUserTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/FederatedUserTest.java
new file mode 100644
index 000000000000..629cee895f7d
--- /dev/null
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/FederatedUserTest.java
@@ -0,0 +1,220 @@
+/*
+ * Copyright 2021 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.model.user;
+
+import org.junit.Test;
+import org.keycloak.cluster.ClusterProvider;
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.Constants;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.LDAPConstants;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserProvider;
+import org.keycloak.storage.CacheableStorageProviderModel;
+import org.keycloak.storage.UserStoragePrivateUtil;
+import org.keycloak.storage.UserStorageProvider;
+import org.keycloak.storage.UserStorageProviderFactory;
+import org.keycloak.storage.UserStorageProviderModel;
+import org.keycloak.storage.ldap.LDAPStorageProvider;
+import org.keycloak.storage.ldap.LDAPStorageProviderFactory;
+import org.keycloak.storage.ldap.idm.model.LDAPObject;
+import org.keycloak.storage.user.ImportSynchronization;
+import org.keycloak.testsuite.model.KeycloakModelTest;
+import org.keycloak.testsuite.model.RequireProvider;
+import org.keycloak.testsuite.util.LDAPTestUtils;
+
+import java.util.function.BiFunction;
+import java.util.function.Consumer;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.junit.Assume.assumeThat;
+import static org.keycloak.models.LDAPConstants.LDAP_ID;
+
+@RequireProvider(UserProvider.class)
+@RequireProvider(ClusterProvider.class)
+@RequireProvider(RealmProvider.class)
+@RequireProvider(value = UserStorageProvider.class, only = LDAPStorageProviderFactory.PROVIDER_NAME)
+public class FederatedUserTest extends KeycloakModelTest {
+
+    private String realmId;
+    private String userFederationId;
+
+    @Override
+    protected boolean isUseSameKeycloakSessionFactoryForAllThreads() {
+        return true;
+    }
+
+    @Override
+    public void createEnvironment(KeycloakSession s) {
+        inComittedTransaction(session -> {
+            RealmModel realm = session.realms().createRealm("realm");
+            s.getContext().setRealm(realm);
+            realm.setDefaultRole(session.roles().addRealmRole(realm, Constants.DEFAULT_ROLES_ROLE_PREFIX + "-" + realm.getName()));
+            this.realmId = realm.getId();
+        });
+
+        getParameters(UserStorageProviderModel.class).forEach(fs -> inComittedTransaction(session -> {
+            if (userFederationId != null || !fs.isImportEnabled()) return;
+            RealmModel realm = session.realms().getRealm(realmId);
+            s.getContext().setRealm(realm);
+
+            fs.setParentId(realmId);
+
+            ComponentModel res = realm.addComponentModel(fs);
+
+            // Check if the provider implements ImportSynchronization interface
+            UserStorageProviderFactory userStorageProviderFactory = (UserStorageProviderFactory) session.getKeycloakSessionFactory().getProviderFactory(UserStorageProvider.class, res.getProviderId());
+            if (!ImportSynchronization.class.isAssignableFrom(userStorageProviderFactory.getClass())) {
+                return;
+            }
+
+            userFederationId = res.getId();
+            log.infof("Added %s user federation provider: %s", fs.getName(), res.getId());
+        }));
+
+        assumeThat("Cannot run UserSyncTest because there is no user federation provider that supports sync", userFederationId, notNullValue());
+    }
+
+    @Override
+    public void cleanEnvironment(KeycloakSession s) {
+        final RealmModel realm = s.realms().getRealm(realmId);
+        s.getContext().setRealm(realm);
+
+        ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+        LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(s, ldapModel);
+        LDAPTestUtils.removeAllLDAPUsers(ldapFedProvider, realm);
+
+        s.realms().removeRealm(realmId);
+    }
+
+    private record TestContext (KeycloakSession session, RealmModel realm, String previousUserId, String previousLdapId) {};
+
+    private void assertAttributeDifferentThanExternalStorage(Consumer<TestContext> assertion) {
+        // create user1 in LDAP
+        String ldapId = withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            LDAPObject ldapObject = LDAPTestUtils.addLDAPUser(ldapFedProvider, realm, "user1", "User1" + "FN", "User1" + "LN", "user1@email.org", "my-street 9", "12");
+            return ldapObject.getUuid();
+        });
+
+        // import user
+        String previous = withRealm(realmId, (session, realm) ->
+                session.users().getUserByUsername(realm, "user1").getId());
+
+        withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider provider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            LDAPObject ldapObject = provider.loadLDAPUserByUuid(realm, ldapId);
+            ldapObject.setSingleAttribute(LDAPConstants.UID, "changed");
+            provider.getLdapIdentityStore().update(ldapObject);
+            return null;
+        });
+
+        withRealm(realmId, (BiFunction<KeycloakSession, RealmModel, Void>) (session, realm) -> {
+            assertion.accept(new TestContext(session, realm, previous, ldapId));
+            return null;
+        });
+    }
+
+    @Test
+    public void testInvalidUsernameWhenDifferentThanExternalStorageNoCache() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.NO_CACHE);
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        assertAttributeDifferentThanExternalStorage((context) -> {
+            KeycloakSession session = context.session();
+            RealmModel realm = context.realm();
+            UserModel cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, nullValue());
+            UserModel user = session.users().getUserByUsername(realm, "changed");
+            assertThat(user.getFirstAttribute(LDAP_ID), is(context.previousLdapId()));
+            assertThat(user.getId(), is(context.previousUserId()));
+            assertThat(user.getUsername(), is("changed"));
+            UserModel localUser = UserStoragePrivateUtil.userLocalStorage(session).getUserById(realm, context.previousUserId());
+            assertThat(localUser.getUsername(), is("changed"));
+        });
+    }
+
+    @Test
+    public void testInvalidUsernameWhenDifferentThanExternalStorageWithCache() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.DEFAULT);
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        assertAttributeDifferentThanExternalStorage((context) -> {
+            KeycloakSession session = context.session();
+            RealmModel realm = context.realm();
+            // cache not yet invalidated, set a max lifespan if you want to eventually invalidate federated users
+            UserModel cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, notNullValue());
+            UserModel user = session.users().getUserByUsername(realm, "changed");
+            assertThat(user.getFirstAttribute(LDAP_ID), is(context.previousLdapId()));
+            assertThat(user.getId(), is(context.previousUserId()));
+            assertThat(user.getUsername(), is("changed"));
+            UserModel localUser = UserStoragePrivateUtil.userLocalStorage(session).getUserById(realm, context.previousUserId());
+            assertThat(localUser.getUsername(), is("changed"));
+            // cache now invalidated
+            cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, is(nullValue()));
+        });
+    }
+
+    @Test
+    public void testInvalidUsernameWhenDifferentThanExternalStorageWithCacheMaxLifespan() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.MAX_LIFESPAN);
+            providerModel.setMaxLifespan(60000);
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        assertAttributeDifferentThanExternalStorage((context) -> {
+            KeycloakSession session = context.session();
+            RealmModel realm = context.realm();
+            UserModel cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, notNullValue());
+            setTimeOffset(120000);
+            cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, nullValue());
+            UserModel user = session.users().getUserByUsername(realm, "changed");
+            assertThat(user, notNullValue());
+            assertThat(user.getFirstAttribute(LDAP_ID), is(context.previousLdapId()));
+            assertThat(user.getId(), is(context.previousUserId()));
+            assertThat(user.getUsername(), is("changed"));
+            UserModel localUser = UserStoragePrivateUtil.userLocalStorage(session).getUserById(realm, context.previousUserId());
+            assertThat(localUser.getUsername(), is("changed"));
+            cached = session.users().getUserByUsername(realm, "user1");
+            assertThat(cached, nullValue());
+        });
+    }
+}
+
diff --git a/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/UserSyncTest.java b/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/UserSyncTest.java
index 41c4736a7039..661e33e74fef 100644
--- a/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/UserSyncTest.java
+++ b/testsuite/model/src/test/java/org/keycloak/testsuite/model/user/UserSyncTest.java
@@ -30,18 +30,18 @@
 import org.keycloak.models.UserProvider;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.storage.CacheableStorageProviderModel;
-import org.keycloak.storage.ldap.idm.model.LDAPObject;
-import org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager;
-import org.keycloak.storage.ldap.mappers.LDAPStorageMapper;
-import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapper;
-import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapperFactory;
-import org.keycloak.storage.managers.UserStorageSyncManager;
 import org.keycloak.storage.UserStoragePrivateUtil;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.UserStorageProviderFactory;
 import org.keycloak.storage.UserStorageProviderModel;
 import org.keycloak.storage.ldap.LDAPStorageProvider;
 import org.keycloak.storage.ldap.LDAPStorageProviderFactory;
+import org.keycloak.storage.ldap.idm.model.LDAPObject;
+import org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager;
+import org.keycloak.storage.ldap.mappers.LDAPStorageMapper;
+import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapper;
+import org.keycloak.storage.ldap.mappers.UserAttributeLDAPStorageMapperFactory;
+import org.keycloak.storage.managers.UserStorageSyncManager;
 import org.keycloak.storage.user.ImportSynchronization;
 import org.keycloak.storage.user.SynchronizationResult;
 import org.keycloak.testsuite.model.KeycloakModelTest;
@@ -50,14 +50,18 @@
 
 import javax.naming.directory.BasicAttribute;
 import java.util.Collections;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.IntStream;
 
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.CoreMatchers.notNullValue;
 import static org.hamcrest.CoreMatchers.nullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assume.assumeThat;
+import static org.keycloak.models.LDAPConstants.LDAP_ID;
+import static org.keycloak.storage.UserStorageProviderModel.REMOVE_INVALID_USERS_ENABLED;
 
 @RequireProvider(UserProvider.class)
 @RequireProvider(ClusterProvider.class)
@@ -88,7 +92,7 @@ public void createEnvironment(KeycloakSession s) {
             ComponentModel res = realm.addComponentModel(fs);
 
             // Check if the provider implements ImportSynchronization interface
-            UserStorageProviderFactory userStorageProviderFactory = (UserStorageProviderFactory)session.getKeycloakSessionFactory().getProviderFactory(UserStorageProvider.class, res.getProviderId());
+            UserStorageProviderFactory userStorageProviderFactory = (UserStorageProviderFactory) session.getKeycloakSessionFactory().getProviderFactory(UserStorageProvider.class, res.getProviderId());
             if (!ImportSynchronization.class.isAssignableFrom(userStorageProviderFactory.getClass())) {
                 return;
             }
@@ -140,7 +144,7 @@ public void testManyUsersImport() {
 
         // The sync shouldn't take more than 18 second per user
         assertThat(String.format("User sync took %f seconds per user, but it should take less than 18 seconds",
-                (float)(timeNeeded) / NUMBER_OF_USERS), timeNeeded, Matchers.lessThan((long) (18 * NUMBER_OF_USERS)));
+                (float) (timeNeeded) / NUMBER_OF_USERS), timeNeeded, Matchers.lessThan((long) (18 * NUMBER_OF_USERS)));
         assertThat(res.getAdded(), is(NUMBER_OF_USERS));
         assertThat(withRealm(realmId, (session, realm) -> UserStoragePrivateUtil.userLocalStorage(session).getUsersCount(realm)), is(NUMBER_OF_USERS));
     }
@@ -249,5 +253,149 @@ public void testAlwaysReadValueFromLDAPWorksWithNoCachePolicy() {
         });
     }
 
+    @Test
+    public void testInvalidUsersAreDeleted() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.NO_CACHE);
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        // create user1 in LDAP
+        withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            int i = 1;
+            LDAPTestUtils.addLDAPUser(ldapFedProvider, realm, "user" + i, "User" + i + "FN", "User" + i + "LN", "user" + i + "@email.org", "my-street 9", "12" + i);
+            return null;
+        });
+
+        // import user
+        String oldUserId = withRealm(realmId, (session, realm) -> {
+            UserModel user1 = session.users().getUserByUsername(realm, "user1");
+            user1.setSingleAttribute("LDAP_ID", "WRONG");
+            return user1.getId();
+        });
+
+        // validate imported user, user will be deleted and re-created
+        withRealm(realmId, (session, realm) -> {
+            UserModel user = session.users().getUserByUsername(realm, "user1");
+            assertThat(user, notNullValue());
+            assertThat(user.getId(), not(equalTo(oldUserId)));
+            return null;
+        });
+    }
+
+    @Test
+    public void testInvalidUsersAreNotDeleted() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.NO_CACHE);
+            providerModel.getConfig().putSingle(REMOVE_INVALID_USERS_ENABLED, "false"); // prevent local delete
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        // create user1 in LDAP
+        withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            int i = 1;
+            LDAPTestUtils.addLDAPUser(ldapFedProvider, realm, "user" + i, "User" + i + "FN", "User" + i + "LN", "user" + i + "@email.org", "my-street 9", "12" + i);
+            return null;
+        });
+
+        AtomicReference<String> ldapId = new AtomicReference<>();
+
+        // import user
+        withRealm(realmId, (session, realm) -> {
+            UserModel user1 = session.users().getUserByUsername(realm, "user1");
+            ldapId.set(user1.getFirstAttribute(LDAPConstants.LDAP_ID));
+            user1.setSingleAttribute(LDAPConstants.LDAP_ID, "WRONG");
+            return user1;
+        });
+
+        // validate imported user
+        withRealm(realmId, (session, realm) -> {
+            UserModel user = session.users().getUserByUsername(realm, "user1");
+            assertThat(user, is(notNullValue()));
+            assertThat(user.isEnabled(), is(false));
+            UserModel deletedUser = UserStoragePrivateUtil.userLocalStorage(session).getUserByUsername(realm, "user1");
+            assertThat(deletedUser, is(notNullValue()));
+            return deletedUser;
+        });
+
+
+        // remove user1 from LDAP
+        withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            UserModel user = UserStoragePrivateUtil.userLocalStorage(session).getUserByUsername(realm, "user1");
+            user.setSingleAttribute(LDAPConstants.LDAP_ID, ldapId.get());
+            assertThat(ldapFedProvider.removeUser(realm, user), is(true));
+            return null;
+        });
+
+        // can delete the local user
+        withRealm(realmId, (session, realm) -> {
+            UserModel user = session.users().getUserByUsername(realm, "user1");
+            assertThat(session.users().removeUser(realm, user), is(true));
+            user = session.users().getUserByUsername(realm, "user1");
+            assertThat(user, is(nullValue()));
+            return null;
+        });
+    }
+
+    @Test
+    public void testInvalidUsernameWhenDifferentThanExternalStorage() {
+        withRealm(realmId, (session, realm) -> {
+            UserStorageProviderModel providerModel = new UserStorageProviderModel(realm.getComponent(userFederationId));
+            providerModel.setCachePolicy(CacheableStorageProviderModel.CachePolicy.NO_CACHE);
+            providerModel.getConfig().putSingle(REMOVE_INVALID_USERS_ENABLED, Boolean.FALSE.toString()); // prevent local delete
+            realm.updateComponent(providerModel);
+            return null;
+        });
+
+        // create user1 in LDAP
+        String ldapId = withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider ldapFedProvider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            int i = 1;
+            LDAPObject ldapObject = LDAPTestUtils.addLDAPUser(ldapFedProvider, realm, "user" + i, "User" + i + "FN", "User" + i + "LN", "user" + i + "@email.org", "my-street 9", "12" + i);
+            return ldapObject.getUuid();
+        });
+
+        // import user
+        String userId = withRealm(realmId, (session, realm) -> {
+            return session.users().getUserByUsername(realm, "user1").getId();
+        });
+
+        withRealm(realmId, (session, realm) -> {
+            ComponentModel ldapModel = LDAPTestUtils.getLdapProviderModel(realm);
+            LDAPStorageProvider provider = LDAPTestUtils.getLdapProvider(session, ldapModel);
+            LDAPObject ldapObject = provider.loadLDAPUserByUuid(realm, ldapId);
+            ldapObject.setSingleAttribute(LDAPConstants.UID, "changed");
+            provider.getLdapIdentityStore().update(ldapObject);
+            return null;
+        });
+
+        // user id changed, user cannot be resolved
+        withRealm(realmId, (session, realm) -> {
+            assertThat(session.users().getUserByUsername(realm, "user1"), nullValue());
+            return null;
+        });
+
+        // cache and local database reflecting the change in the database for the existing account
+        withRealm(realmId, (session, realm) -> {
+            UserModel user = session.users().getUserByUsername(realm, "changed");
+            assertThat(user.getFirstAttribute(LDAP_ID), is(ldapId));
+            assertThat(user.getId(), is(userId));
+            assertThat(user.getUsername(), is("changed"));
+            UserModel localUser = UserStoragePrivateUtil.userLocalStorage(session).getUserById(realm, userId);
+            assertThat(localUser.getUsername(), is("changed"));
+            return null;
+        });
+    }
 }
 
diff --git a/testsuite/model/src/test/resources/test-ispn.xml b/testsuite/model/src/test/resources/test-ispn.xml
new file mode 100644
index 000000000000..b305b4cd68e4
--- /dev/null
+++ b/testsuite/model/src/test/resources/test-ispn.xml
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2025 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<infinispan
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="urn:infinispan:config:15.0 http://www.infinispan.org/schemas/infinispan-config-15.0.xsd
+            urn:org:jgroups http://www.jgroups.org/schema/jgroups-5.3.xsd"
+        xmlns="urn:infinispan:config:15.0"
+        xmlns:ispn="urn:infinispan:config:15.0">
+
+    <jgroups>
+        <stack name="test" extends="tcp">
+            <!-- no network traffic as all messages are handled inside the JVM -->
+            <SHARED_LOOPBACK xmlns="urn:org:jgroups" ispn:stack.combine="REPLACE" ispn:stack.position="TCP"
+                             thread_pool.use_virtual_threads="true"
+                             bundler_type="no-bundler"/>
+            <SHARED_LOOPBACK_PING xmlns="urn:org:jgroups" ispn:stack.combine="REPLACE" ispn:stack.position="MPING"/>
+            <!-- in JVM cluster, no failure detection, no flow control, no fragmentation. -->
+            <RED xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <FD_SOCK2 xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <UFC xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <MFC xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <FRAG4 xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+        </stack>
+    </jgroups>
+
+    <cache-container name="keycloak">
+        <transport lock-timeout="60000" stack="test"/>
+        <local-cache name="realms" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="users" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <distributed-cache name="sessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="authenticationSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="offlineSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="clientSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="offlineClientSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="loginFailures" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <local-cache name="authorization" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <replicated-cache name="work">
+            <expiration lifespan="-1"/>
+        </replicated-cache>
+        <local-cache name="keys" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="3600000"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <distributed-cache name="actionTokens" owners="2">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
+            <memory max-count="-1"/>
+        </distributed-cache>
+    </cache-container>
+</infinispan>
diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml
index 16b5964c773d..16428ff5bafe 100755
--- a/testsuite/utils/pom.xml
+++ b/testsuite/utils/pom.xml
@@ -259,7 +259,7 @@
         </dependency>
         <dependency>
             <groupId>com.oracle.database.jdbc</groupId>
-            <artifactId>ojdbc11</artifactId>
+            <artifactId>ojdbc17</artifactId>
             <version>${oracle-jdbc.version}</version>
             <scope>compile</scope>
         </dependency>
diff --git a/testsuite/utils/src/main/resources/META-INF/keycloak-server.json b/testsuite/utils/src/main/resources/META-INF/keycloak-server.json
index 04a94c75f578..ca97dcb5756e 100755
--- a/testsuite/utils/src/main/resources/META-INF/keycloak-server.json
+++ b/testsuite/utils/src/main/resources/META-INF/keycloak-server.json
@@ -123,20 +123,10 @@
         }
     },
 
-    "connectionsInfinispan": {
+    "cacheEmbedded": {
         "default": {
-            "jgroupsUdpMcastAddr": "${keycloak.connectionsInfinispan.jgroupsUdpMcastAddr:234.56.78.90}",
-            "nodeName": "${keycloak.connectionsInfinispan.nodeName,jboss.node.name:}",
-            "siteName": "${keycloak.connectionsInfinispan.siteName:}",
-            "clustered": "${keycloak.connectionsInfinispan.clustered:}",
-            "async": "${keycloak.connectionsInfinispan.async:}",
-            "sessionsOwners": "${keycloak.connectionsInfinispan.sessionsOwners:}",
-            "l1Lifespan": "${keycloak.connectionsInfinispan.l1Lifespan:}",
-            "remoteStoreEnabled": "${keycloak.connectionsInfinispan.remoteStoreEnabled:}",
-            "remoteStoreHost": "${keycloak.connectionsInfinispan.remoteStoreServer:}",
-            "remoteStorePort": "${keycloak.connectionsInfinispan.remoteStorePort:}",
-            "hotrodProtocolVersion": "${keycloak.connectionsInfinispan.hotrodProtocolVersion}",
-            "embedded": "${keycloak.connectionsInfinispan.embedded:true}"
+            "nodeName": "${keycloak.cacheEmbedded.nodeName,jboss.node.name:}",
+            "configFile": "${keycloak.cacheEmbedded.configFile:local-test-ispn.xml}"
         }
     },
 
diff --git a/testsuite/utils/src/main/resources/cluster-test-ispn.xml b/testsuite/utils/src/main/resources/cluster-test-ispn.xml
new file mode 100644
index 000000000000..043f47c00672
--- /dev/null
+++ b/testsuite/utils/src/main/resources/cluster-test-ispn.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<infinispan
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="urn:infinispan:config:15.0 http://www.infinispan.org/schemas/infinispan-config-15.0.xsd
+            urn:org:jgroups http://www.jgroups.org/schema/jgroups-5.3.xsd"
+        xmlns="urn:infinispan:config:15.0"
+        xmlns:ispn="urn:infinispan:config:15.0">
+
+    <!-- used by auth-server-cluster-undertow profile -->
+    <!-- all containers run in the same JVM, we can use the shared loopback and ping.-->
+
+    <jgroups>
+        <stack name="test" extends="tcp">
+            <!-- no network traffic as all messages are handled inside the JVM -->
+            <SHARED_LOOPBACK xmlns="urn:org:jgroups" ispn:stack.combine="REPLACE" ispn:stack.position="TCP"
+                             thread_pool.use_virtual_threads="true"
+                             bundler_type="no-bundler"/>
+            <SHARED_LOOPBACK_PING xmlns="urn:org:jgroups" ispn:stack.combine="REPLACE" ispn:stack.position="MPING"/>
+            <!-- in JVM cluster, no failure detection, no flow control, no fragmentation. -->
+            <RED xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <FD_SOCK2 xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <UFC xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <MFC xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+            <FRAG4 xmlns="urn:org:jgroups" ispn:stack.combine="REMOVE"/>
+        </stack>
+    </jgroups>
+
+    <cache-container name="keycloak">
+        <transport lock-timeout="60000" stack="test"/>
+        <local-cache name="realms" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="users" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <distributed-cache name="sessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="authenticationSessions" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <distributed-cache name="offlineSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="clientSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="offlineClientSessions" owners="1">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </distributed-cache>
+        <distributed-cache name="loginFailures" owners="2">
+            <expiration lifespan="-1"/>
+        </distributed-cache>
+        <local-cache name="authorization" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <replicated-cache name="work">
+            <expiration lifespan="-1"/>
+        </replicated-cache>
+        <local-cache name="keys" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="3600000"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <distributed-cache name="actionTokens" owners="2">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
+            <memory max-count="-1"/>
+        </distributed-cache>
+    </cache-container>
+</infinispan>
diff --git a/testsuite/utils/src/main/resources/local-test-ispn.xml b/testsuite/utils/src/main/resources/local-test-ispn.xml
new file mode 100644
index 000000000000..c42b3b91525f
--- /dev/null
+++ b/testsuite/utils/src/main/resources/local-test-ispn.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2025 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<infinispan
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="urn:infinispan:config:15.0 http://www.infinispan.org/schemas/infinispan-config-15.0.xsd"
+        xmlns="urn:infinispan:config:15.0">
+
+    <!-- used undertow deployment -->
+
+    <cache-container name="keycloak">
+        <local-cache name="realms" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="users" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="sessions">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="authenticationSessions">
+            <expiration lifespan="-1"/>
+        </local-cache>
+        <local-cache name="offlineSessions">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="clientSessions">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="offlineClientSessions">
+            <expiration lifespan="-1"/>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="loginFailures">
+            <expiration lifespan="-1"/>
+        </local-cache>
+        <local-cache name="authorization" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <memory max-count="10000"/>
+        </local-cache>
+        <local-cache name="work">
+            <expiration lifespan="-1"/>
+        </local-cache>
+        <local-cache name="keys" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="3600000"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <local-cache name="crl" simple-cache="true">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration lifespan="-1"/>
+            <memory max-count="1000"/>
+        </local-cache>
+        <local-cache name="actionTokens">
+            <encoding>
+                <key media-type="application/x-java-object"/>
+                <value media-type="application/x-java-object"/>
+            </encoding>
+            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
+            <memory max-count="-1"/>
+        </local-cache>
+    </cache-container>
+</infinispan>
diff --git a/testsuite/utils/src/main/resources/log4j.properties b/testsuite/utils/src/main/resources/log4j.properties
index 03bb96fd998d..0d44b79b39ea 100755
--- a/testsuite/utils/src/main/resources/log4j.properties
+++ b/testsuite/utils/src/main/resources/log4j.properties
@@ -101,8 +101,6 @@ log4j.logger.org.apache.directory.server.ldap.LdapProtocolHandler=error
 #log4j.logger.org.keycloak.services.resources.IdentityBrokerService=trace
 #log4j.logger.org.keycloak.broker=trace
 
-#log4j.logger.org.keycloak.cluster.infinispan.InfinispanNotificationsManager=trace
-
 #log4j.logger.io.undertow=trace
 
 #log4j.logger.org.keycloak.protocol=debug
diff --git a/themes/pom.xml b/themes/pom.xml
index 4577f0d05fcb..0f7270fbd28c 100755
--- a/themes/pom.xml
+++ b/themes/pom.xml
@@ -33,6 +33,24 @@
                 <directory>src/main/resources</directory>
             </resource>
         </resources>
+        <plugins>
+            <plugin>
+                <groupId>org.keycloak</groupId>
+                <artifactId>theme-verifier-maven-plugin</artifactId>
+                <version>${project.version}</version>
+                <executions>
+                    <execution>
+                        <id>verify-theme</id>
+                        <goals>
+                            <goal>verify-theme</goal>
+                        </goals>
+                        <configuration>
+                            <validateMessageFormatQuotes>true</validateMessageFormatQuotes>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
     </build>
 
     <profiles>
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ca.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ca.properties
index 617da8b8dd61..f5dfe97b5aef 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_ca.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ca.properties
@@ -26,16 +26,16 @@ linkedAccountsHtmlTitle=Comptes enllaçats
 accountManagementWelcomeMessage=Us donem la benvinguda al gestor de comptes del Keycloak
 personalInfoIntroMessage=Gestioneu la vostra informació bàsica
 accountSecurityTitle=Seguretat del compte
-accountSecurityIntroMessage=Controleu la vostra contrasenya i l''accés al compte
+accountSecurityIntroMessage=Controleu la vostra contrasenya i l’accés al compte
 applicationsIntroMessage=Feu seguiment i gestioneu els permisos de les aplicacions per a accedir al vostre compte
-resourceIntroMessage=Compartiu recursos entre membres del vostre equip
+resourceIntroMessage=Compartiu els vostres recursos entre membres de l’equip
 passwordLastUpdateMessage=La contrasenya es va actualitzar el
 updatePasswordTitle=Actualitza la contrasenya
-updatePasswordMessageTitle=Assegureu-vos d''establir una contrasenya forta
-updatePasswordMessage=Una contrasenya forta conté una combinació de números, lletres i símbols. És difícil d''endevinar, no es pareix a una paraula real, i només s''utilitza per a aquest compte.
+updatePasswordMessageTitle=Assegureu-vos d’establir una contrasenya forta
+updatePasswordMessage=Una contrasenya forta conté una combinació de números, lletres i símbols. És difícil d’endevinar, no es pareix a una paraula real, i només s’utilitza per a aquest compte.
 personalSubTitle=La vostra informació personal
 personalSubMessage=Gestioneu la vostra informació bàsica.
-authenticatorCode=Codi d''un sol ús
+authenticatorCode=Codi d’un sol ús
 email=Correu electrònic
 firstName=Nom
 givenName=Nom de pila
@@ -46,7 +46,7 @@ password=Contrasenya
 currentPassword=Contrasenya actual
 passwordConfirm=Confirmació
 passwordNew=Contrasenya nova
-username=Nom d''usuari
+username=Nom d’usuari
 address=Adreça
 street=Carrer
 locality=Ciutat o municipi
@@ -61,13 +61,13 @@ gender=Gènere
 birthday=Natalici
 zoneinfo=Fus horari
 gssDelegationCredential=Credencial de delegació GSS
-profileScopeConsentText=Perfil d'usuari
+profileScopeConsentText=Perfil d’usuari
 emailScopeConsentText=Adreça de correu electrònic
 addressScopeConsentText=Adreça
 phoneScopeConsentText=Número de telèfon
 offlineAccessScopeConsentText=Accés fora de línia
 samlRoleListScopeConsentText=Els meus rols
-rolesScopeConsentText=Rols d'usuari
+rolesScopeConsentText=Rols d’usuari
 role_admin=Administrador
 role_realm-admin=Administrador del domini
 role_create-realm=Crea un domini
@@ -77,25 +77,25 @@ role_view-applications=Visualitza les aplicacions
 role_view-groups=Visualitza els grups
 role_view-clients=Visualitza els clients
 role_view-events=Visualitza els esdeveniments
-role_view-identity-providers=Visualitza els proveïdors d''identitat
+role_view-identity-providers=Visualitza els proveïdors d’identitat
 role_view-consent=Visualitza els consentiments
 role_manage-realm=Gestiona el domini
 role_manage-users=Gestiona els usuaris
 role_manage-applications=Gestiona les aplicacions
-role_manage-identity-providers=Gestiona els proveïdors d''identitat
+role_manage-identity-providers=Gestiona els proveïdors d’identitat
 role_manage-clients=Gestiona els clients
 role_manage-events=Gestiona els esdeveniments
 role_view-profile=Visualitza el perfil
 role_manage-account=Gestiona el compte
 role_manage-account-links=Gestiona els enllaços del compte
 role_manage-consent=Gestiona els consentiments
-role_read-token=Llegeix el codi d''autorització
+role_read-token=Llegeix el codi d’autorització
 role_offline-access=Accés fora de línia
 role_uma_authorization=Obté permisos
 client_account=Compte
 client_account-console=Consola del compte
-client_security-admin-console=consola d''administració de seguretat
-client_admin-cli=CLI d''administració
+client_security-admin-console=Consola d’administració de seguretat
+client_admin-cli=CLI d’administració
 client_realm-management=Gestió del domini
 client_broker=Agent
 
@@ -184,7 +184,7 @@ missingIdentityProviderMessage=No s''ha indicat el proveïdor d''identitat.
 invalidFederatedIdentityActionMessage=Acció no vàlida o no indicada.
 identityProviderNotFoundMessage=No s''ha trobat un proveïdor d''identitat.
 federatedIdentityLinkNotActiveMessage=Aquesta identitat ja no està activa.
-federatedIdentityRemovingLastProviderMessage=No podeu eliminar l''última identitat federada perquè no teniu establerta una contrasenya.
+federatedIdentityRemovingLastProviderMessage=No podeu eliminar l’última identitat federada perquè no teniu establerta una contrasenya.
 identityProviderRedirectErrorMessage=No s''ha pogut redirigir al proveïdor d''identitat.
 identityProviderRemovedMessage=S''ha eliminat el proveïdor d''identitat correctament.
 identityProviderAlreadyLinkedMessage=La identitat federada retornada per {0} ja està enllaçada a un altre usuari.
@@ -336,14 +336,14 @@ openshift.scope.list-projects=Llista els projectes
 error-invalid-value=El valor no és vàlid.
 error-invalid-blank=Especifiqueu un valor.
 error-empty=Especifiqueu un valor.
-error-invalid-length=L''atribut {0} ha de tindre una llargària d''entre {1} i {2}.
-error-invalid-length-too-short=L''atribut {0} ha de tindre una llargària mínima de {1}.
-error-invalid-length-too-long=L''atribut {0} ha de tindre una llargària màxima de {2}.
+error-invalid-length=L’atribut {0} ha de tenir una llargària d’entre {1} i {2}.
+error-invalid-length-too-short=L’atribut {0} ha de tenir una llargària de, com a mínim, {1}.
+error-invalid-length-too-long=L’atribut {0} ha de tenir una llargària de, com a màxim, {2}.
 error-invalid-email=L''adreça de correu electrònic no és vàlida.
 error-invalid-number=El nombre no és vàlid.
 error-number-out-of-range=L''atribut {0} ha de ser un número entre {1} i {2}.
-error-number-out-of-range-too-small=L''atribut {0} ha de tindre valor mínim de {1}.
-error-number-out-of-range-too-big=L''atribut {0} ha de tindre valor màxim de {2}.
+error-number-out-of-range-too-small=L’atribut {0} ha de tenir un valor de, com a mínim, {1}.
+error-number-out-of-range-too-big=L’atribut {0} ha de tenir un valor de, com a màxim, {2}.
 error-pattern-no-match=El valor no és vàlid.
 error-invalid-uri=L''URL no és vàlid.
 error-invalid-uri-scheme=L''esquema d''URL no és vàlid.
@@ -354,6 +354,6 @@ error-user-attribute-read-only=El camp {0} és només de lectura.
 error-username-invalid-character=El nom d''usuari conté un caràcter no vàlid.
 error-person-name-invalid-character=El nom conté un caràcter no vàlid.
 organizationScopeConsentText=Organització
-invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d'usuari.
-accountManagementBaseThemeCannotBeUsedDirectly=El tema de compte base només conté traduccions per a la consola de compte. Per a mostrar la consola de compte, heu d'establir el pare del vostre tema a un altre tema de compte, o proveir el vostre fitxer intdex.ftl.
-federatedIdentityBoundOrganization=No podeu suprimir l'enllaç a un proveïdor d'identitat sense una organització.
+invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d’usuari.
+accountManagementBaseThemeCannotBeUsedDirectly=El tema de compte base només conté traduccions per a la consola de compte. Per a mostrar la consola de compte, heu d’establir el pare del vostre tema a un altre tema de compte, o proveir el vostre fitxer intdex.ftl. Vegeu la documentació per a obtenir més informació.
+federatedIdentityBoundOrganization=No podeu suprimir l’enllaç a un proveïdor d’identitat sense una organització.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_da.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_da.properties
index 9d79936ee2d1..561f47f037ab 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_da.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_da.properties
@@ -289,31 +289,23 @@ authenticatorBackupCodesSetupTitle=Backup Kode Opsætning
 realmName=Rige
 doDownload=Download
 doPrint=Print
-doCopy=Kopier
 generateNewBackupCodes=Generer Nye Backup Koder
 backtoAuthenticatorPage=Tilbage til Authenticator siden
 
 
 #Resources
 resources=Ressourcer
-myResources=Mine Ressourcer
 sharedwithMe=Delt med mig
 share=Del
-resource=Ressource
-application=Applikation
-date=Dato
 sharedwith=Delt med
-owner=Ejer
 accessPermissions=Adgangstilladelser
 permissionRequests=Rettigheds forespørgsler
 approve=Godkend
 approveAll=Godkend alle
-sharedwith=Delt med
 people=Folk
 perPage=per side
 currentPage=Nuværende Side
 sharetheResource=Del Ressourcen
-user=Bruger
 group=Gruppe
 selectPermission=Vælg tilladelse
 addPeople=Tilføj folk at dele ressourcen med
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_de.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_de.properties
index 53770b56b630..ad7d6d55e47b 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_de.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_de.properties
@@ -212,7 +212,7 @@ resourceNoPermissionsGrantingAccess=Keine Berechtigungen, die Zugriff auf diese
 anyAction=Jede Aktion
 description=Beschreibung
 name=Name
-scopes=Geltungsbereiche
+scopes=Scopes
 resource=Ressource
 user=Nutzer
 peopleSharingThisResource=Personen, die diese Ressource teilen
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_es.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_es.properties
index 8f56cd0417ed..9d3c86554050 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_es.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_es.properties
@@ -88,7 +88,7 @@ configureAuthenticators=Autenticadores configurados
 mobile=Móvil
 totpStep1=Instala una de las siguientes aplicaciones en tu teléfono móvil:
 totpStep2=Abre la aplicación y escanea el código o introduce la clave:
-totpStep3=Introduce el código único que te muestra la aplicación de autenticación y haz clic en Enviar para finalizar la configuración.
+totpStep3=Introduzca el código único que le muestra la aplicación de autenticación y haga clic en Enviar para finalizar la configuración.
 missingUsernameMessage=Por favor indica tu usuario.
 missingFirstNameMessage=Por favor indica el nombre.
 invalidEmailMessage=Email no válido.
@@ -102,7 +102,7 @@ invalidPasswordConfirmMessage=La confirmación de contraseña no coincide.
 invalidTotpMessage=El código de autenticación no es válido.
 usernameExistsMessage=El nombre de usuario ya existe.
 emailExistsMessage=El email ya existe.
-readOnlyUserMessage=No puedes actualizar tu usuario porque tu cuenta es de solo lectura.
+readOnlyUserMessage=No puede actualizar su usuario porque su cuenta es de solo lectura.
 readOnlyPasswordMessage=No puede actualizar su contraseña porque su cuenta es de solo lectura.
 successTotpMessage=Aplicación de autenticación móvil configurada.
 successTotpRemovedMessage=Aplicación de autenticación móvil eliminada.
@@ -113,7 +113,7 @@ missingIdentityProviderMessage=Proveedor de identidad no indicado.
 invalidFederatedIdentityActionMessage=Acción no válida o no indicada.
 identityProviderNotFoundMessage=No se encontró un proveedor de identidad.
 federatedIdentityLinkNotActiveMessage=Esta identidad ya no está activa.
-federatedIdentityRemovingLastProviderMessage=No puede eliminar la última identidad federada porque no tiene fijada una contraseña.
+federatedIdentityRemovingLastProviderMessage=No puede eliminar la última identidad federada ya que no tiene una contraseña.
 identityProviderRedirectErrorMessage=Error en la redirección al proveedor de identidad.
 identityProviderRemovedMessage=Proveedor de identidad borrado correctamente.
 accountDisabledMessage=La cuenta está desactivada, contacte con el administrador.
@@ -235,7 +235,7 @@ permissionRequestion=Solicitud de permiso
 permission=Permiso
 shares=Compartido(s)
 notBeingShared=Este recurso no se está compartiendo.
-notHaveAnyResource=No tiene recursos
+notHaveAnyResource=No tiene ningún recurso
 noResourcesSharedWithYou=No hay recursos compartidos contigo
 havePermissionRequestsWaitingForApproval=Tiene {0} solicitud(es) de permiso(s) esperando la aprobación.
 clickHereForDetails=Haga clic aquí para más detalles.
@@ -357,4 +357,4 @@ error-person-name-invalid-character=El nombre contiene algún carácter inválid
 organizationScopeConsentText=Organización
 federatedIdentityBoundOrganization=No puede eliminar el enlace a un proveedor de identidad asociado con una organización.
 invalidPasswordNotContainsUsernameMessage=Contraseña no válida: no puede contener el nombre de usuario.
-accountManagementBaseThemeCannotBeUsedDirectly=El tema base de la cuenta solo contiene traducciones para la consola de cuentas. Para mostrar la consola de cuentas, debes configurar el tema principal de tu tema en otro tema de cuenta o proporcionar tu propio archivo index.ftl. Consulta la documentación para obtener más información.
+accountManagementBaseThemeCannotBeUsedDirectly=El tema base de la cuenta solo contiene traducciones para la consola de cuentas. Para mostrar la consola de cuentas, debe configurar el tema principal de su tema en otro tema de cuenta o proporcionar su propio archivo index.ftl. Consulte la documentación para obtener más información.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties
index 3537ffdd950a..64a95b8a348d 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties
@@ -138,7 +138,7 @@ revoke=Kumoa oikeudet
 
 configureAuthenticators=Konfiguroitu kaksivaiheinen kirjautuminen
 mobile=Mobiili
-totpStep1=Asenna <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> tai Google Authenticator ohjelma laiteellesi. Kummatkin sovellukset ovat saatavilla <a href="https://play.google.com">Google Play</a> ja Apple App Store kaupoissa.
+totpStep1=Asenna jokin seuraavista sovelluksista matkapuhelimeesi:
 totpStep2=Avaa sovellus ja skannaa QR-koodi tai kirjoita avain.
 totpStep3=Täytä saamasi kertaluontoinen koodisi allaolevaan kenttään ja paina Tallenna.
 totpStep3DeviceName=Anna laitteelle nimi, jotta voit hallinnoida OTP-laitteitasi.
@@ -323,7 +323,6 @@ backupcodesIntroMessage=Jos menetät pääsyn puhelimeesi, voit silti kirjautua
 realmName=Realm
 doDownload=Lataa
 doPrint=Tulosta
-doCopy=Copy
 backupCodesTips-1=Jokaisen varmuuskoodin voi käyttää yhden kerran.
 backupCodesTips-2=Nämä koodit on luotu
 generateNewBackupCodes=Luo uudet varmuuskoodit
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_fr.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_fr.properties
index 6f3184b8c9cc..ea36d1b76449 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_fr.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_fr.properties
@@ -51,7 +51,7 @@ role_manage-account=Gérer le compte
 role_read-token=Lire le jeton d''authentification
 role_offline-access=Accès hors-ligne
 client_account=Compte
-client_security-admin-console=Console d''administration de la sécurité
+client_security-admin-console=Console d''Administration de la Sécurité
 client_admin-cli=Admin CLI
 client_realm-management=Gestion du domaine
 client_broker=Broker
@@ -131,14 +131,14 @@ identityProviderRemovedMessage=Le fournisseur d''identité a été supprimé cor
 identityProviderAlreadyLinkedMessage=Le fournisseur d''identité retourné par {0} est déjà lié à un autre utilisateur.
 accountDisabledMessage=Ce compte est désactivé, veuillez contacter votre administrateur.
 accountTemporarilyDisabledMessage=Ce compte est temporairement désactivé, veuillez contacter votre administrateur ou réessayez plus tard.
-invalidPasswordMinLengthMessage=Mot de passe invalide: longueur minimale {0}.
-invalidPasswordMinLowerCaseCharsMessage=Mot de passe invalide: doit contenir au moins {0} lettre(s) en minuscule.
-invalidPasswordMinDigitsMessage=Mot de passe invalide: doit contenir au moins {0} chiffre(s).
-invalidPasswordMinUpperCaseCharsMessage=Mot de passe invalide: doit contenir au moins {0} lettre(s) en majuscule.
-invalidPasswordMinSpecialCharsMessage=Mot de passe invalide: doit contenir au moins {0} caractère(s) spéciaux.
-invalidPasswordNotUsernameMessage=Mot de passe invalide: ne doit pas être identique au nom d''utilisateur.
-invalidPasswordRegexPatternMessage=Mot de passe invalide: ne valide pas l''expression rationnelle.
-invalidPasswordHistoryMessage=Mot de passe invalide: ne doit pas être égal aux {0} derniers mots de passe.
+invalidPasswordMinLengthMessage=Mot de passe invalide : longueur minimale {0}.
+invalidPasswordMinLowerCaseCharsMessage=Mot de passe invalide : doit contenir au moins {0} lettre(s) en minuscule.
+invalidPasswordMinDigitsMessage=Mot de passe invalide : doit contenir au moins {0} chiffre(s).
+invalidPasswordMinUpperCaseCharsMessage=Mot de passe invalide : doit contenir au moins {0} lettre(s) en majuscule.
+invalidPasswordMinSpecialCharsMessage=Mot de passe invalide : doit contenir au moins {0} caractère(s) spéciaux.
+invalidPasswordNotUsernameMessage=Mot de passe invalide : ne doit pas être identique au nom d''utilisateur.
+invalidPasswordRegexPatternMessage=Mot de passe invalide : ne valide pas l''expression rationnelle.
+invalidPasswordHistoryMessage=Mot de passe invalide : ne doit pas être égal aux {0} derniers mots de passe.
 applicationName=Nom de l''application
 authenticatorActionSetup=Configurer
 device-activity=Activité des Appareils
@@ -195,3 +195,146 @@ totpDeviceName=Nom du dispositif
 totpAppGoogleName=Google Authenticator
 totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
 irreversibleAction=Cette action est irréversible
+passwordLastUpdateMessage=Votre mot de passe a été modifié le
+totpAppFreeOTPName=FreeOTP
+loggingOutImmediately=Déconnexion immédiate
+accountUnusable=Tout usage futur de l''application ne sera plus possible avec ce compte
+invalidUserMessage=Utilisateur invalide
+updateReadOnlyAttributesRejectedMessage=Mise à jour de l''attribut en lecture seule rejetée
+missingTotpDeviceNameMessage=Merci de renseigner un nom pour cet appareil.
+readOnlyUsernameMessage=Vous ne pouvez pas mettre à jour votre nom d''utilisateur car il est en lecture seule.
+staleCodeAccountMessage=La page a expiré. Merci d''essayer à nouveau.
+consentDenied=Consentement refusé.
+access-denied-when-idp-auth=Acres refusé lors de l''authentification avec {0}
+invalidPasswordMaxLengthMessage=Mot de passe invalide : longueur maximale {0}.
+invalidPasswordNotContainsUsernameMessage=Mot de passe invalide : il ne peut pas contenir le nom d''utilisateur.
+invalidPasswordNotEmailMessage=Mot de passe invalide : il ne doit pas correspondre au courriel.
+invalidPasswordBlacklistedMessage=Mot de passe invalide : ce mot de passe est non autorisé.
+invalidPasswordGenericMessage=Mot de passe invalide : le niveau mot de passe ne respecte pas la politique de mot de passe.
+myResources=Mes ressources
+myResourcesSub=Mes ressources
+doDeny=Refuser
+doRevoke=Révoquer
+doApprove=Approuver
+doRemoveSharing=Supprimer le partage
+doRemoveRequest=Supprimer la demande
+peopleAccessResource=Personne ayant accès à cette ressource
+description=Description
+name=Nom
+scopes=Périmètres
+resource=Ressource
+user=Utilisateur
+peopleSharingThisResource=Personne partageant cette ressource
+needMyApproval=Nécessite mon approbation
+icon=Icône
+requestor=Demandeur
+owner=Propriétaire
+resourcesSharedWithMe=Ressources partagées avec moi
+shares=partage(s)
+notBeingShared=Cette ressource n''est pas partagée.
+notHaveAnyResource=Vous n''avez aucune ressource
+noResourcesSharedWithYou=Aucune ressource partagée avec vous
+clickHereForDetails=Cliquer ici pour plus d''informations.
+resourceIsNotBeingShared=Cette ressource n''est pas partagée
+clearAllFilter=Réinitialiser les filtres
+activeFilters=Filtres actifs
+filterByName=Filtrer par nom ...
+allApps=Toutes les applications
+internalApps=Applications internes
+thirdpartyApps=Applications tierces
+appResults=Résultats
+identityProvider=Fournisseur d''identités
+userDefined=Défini par l''utilisateur
+removeAccess=Supprimer l''accès
+authenticatorStatusMessage=L''authentification à deux facteurs est
+authenticatorFinishSetUpTitle=Votre authentification à deux facteurs
+resourceManagedPolicies=Autorisation donnant accès à cette ressource
+resourceNoPermissionsGrantingAccess=Pas d''autorisation donnent accès à cette ressource
+anyAction=Toute action
+shareWithOthers=Partager avec d''autres
+requestsWaitingApproval=Vos demandes en attente d''approbation
+permissionRequestion=Demandes d''autorisation
+permission=Autorisation
+havePermissionRequestsWaitingForApproval=Vous avez {0} demande(s) d''autorisation en attente d''approbation.
+authorizedProviderMessage=Fournisseurs autorisés liés à votre compte
+authorizedProvider=Fournisseur autorisé
+federatedIdentityBoundOrganization=Vous ne pouvez pas supprimer le lien avec un fournisseur d''identités associé à une organisation.
+authenticatorSubTitle=Paramétrer l''authentification à deux facteurs
+authenticatorSubMessage=Pour renforcer la sécurité de votre compte, activez au moins une méthode disponible d''authentification à deux facteurs.
+clientNotFoundMessage=Client non trouvé.
+enterBarCode=Renseignez le code à usage unique
+doCopy=Copier
+doFinish=Terminer
+chooseYourCountry=Choisissez votre pays
+sendVerficationCode=Envoyez le code de vérification
+enterYourVerficationCode=Renseignez le code de vérification
+realmName=Domaine
+generateNewBackupCodes=Générer de nouveaux codes de récupération d''authentification
+sharedwithMe=Partagé avec moi
+share=Partage
+sharedwith=Partager avec
+accessPermissions=Autorisations d''accès
+permissionRequests=Demandes d''autorisation
+approve=Approuver
+approveAll=Tout approuver
+people=personnes
+perPage=par page
+currentPage=Page actuelle
+group=Groupe
+addTeam=Ajouter des équipes pour partager vos ressources avec elles
+myPermissions=Mes autorisations
+waitingforApproval=En attente d''approbation
+anyPermission=Toute autorisation
+openshift.scope.user_info=Informations de l''utilisateur
+openshift.scope.user_check-access=Informations sur les accès de l''utilisateur
+openshift.scope.user_full=Accès complet
+error-invalid-blank=Merci de renseigner une valeur.
+error-invalid-length-too-short=L''attribut {0} doit avoir une longueur minimale de {1}.
+error-invalid-length-too-long=L''attribut {0} doit avec une longueur maximale de {2}.
+error-invalid-email=Adresse de courriel non valide.
+error-invalid-number=Nombre non valide.
+error-number-out-of-range-too-small=L''attribut {0} doit avec une valeur minimale de {1}.
+error-number-out-of-range-too-big=L''attribut {0} doit avoir une valeur maximale de {2}.
+error-invalid-uri-scheme=Schéma d''URL non valide.
+error-user-attribute-required=Merci de renseigner l''attribut {0}.
+error-invalid-date=Date non valide.
+error-user-attribute-read-only=Le champ {0} est en lecture seule.
+error-username-invalid-character=Le nom d''utilisateur contient un caractère non valide.
+addPeople=Ajouter des personnes pour partager vos ressources avec elles
+error-person-name-invalid-character=Le nom contient un caractère non valide.
+error-invalid-uri-fragment=Fragment d''URL non valide.
+sharetheResource=Partager la ressource
+openshift.scope.list-projects=Lister les projets
+error-invalid-length=L''attribut {0} doit avoir une longueur comprise entre {1} et {2}.
+scanBarCode=Voulez-vous scanner le code-barres ?
+enterYourPhoneNumber=Renseignez vote numéro de téléphone
+doDownload=Télécharger
+doPrint=Imprimer
+error-number-out-of-range=L''attribut {0} doit être un nombre compris entre {1} et {2}.
+resources=Ressources
+error-invalid-uri=URL non valide.
+selectPermission=Sélectionner l''autorisation
+error-invalid-value=Valeur non valide.
+error-empty=Merci de renseigner une valeur.
+error-pattern-no-match=Valeur non valide.
+authenticatorMobileMessage=Utiliser un authentificateur sur smartphone pour obtenir des codes de vérification pour l''authentification à deux facteurs.
+mobileSetupStep3=Renseignez le code à usage unique fourni par l''application et cliquez sur Sauvegarder pour terminer le paramétrage.
+applicationInUse=Utilisation uniquement dans l''application
+removeAccessMessage=Vous devrez redonner accès à nouveau si vous voulez utiliser ce compte applicatif.
+identityProviderMessage=Pour lier votre compte avec un fournisseur d''identités déjà configuré
+socialLogin=Nom sur les réseaux sociaux
+authenticatorFinishSetUpMessage=Chaque fois que vous vous connecterez à votre compte Keycloak, il vous sera demandé de fournir un code d''authentification à deux facteurs.
+authenticatorMobileTitle=Authentificateur sur smartphone
+authenticatorMobileFinishSetUpMessage=Cet authentificateur a été relié à votre téléphone.
+authenticatorSMSTitle=Code par SMS
+authenticatorMobileSetupTitle=Paramétrage de l''authentificateur sur smartphone
+smscodeIntroMessage=Renseignez votre numéro de téléphone et un code de vérification sera envoyé à votre téléphone.
+mobileSetupStep1=Installez une application d''authentificateur sur votre téléphone. Les applications suivantes sont supportées.
+mobileSetupStep2=Ouvrez l''application et scannez le code-barres :
+authenticatorSMSMessage=Keycloak enverra le code de vérification sur votre téléphone en tant qu''authentification à deux facteurs.
+authenticatorDefaultStatus=Par défaut
+authenticatorChangePhone=Changer le numéro de téléphone
+authenticatorSMSFinishSetUpMessage=Les messages texte sont envoyés sur
+authenticatorSMSCodeSetupTitle=Paramétrage du code par SMS
+authenticatorBackupCodesSetupTitle=Paramétrage des codes de récupération de l''authentification
+backtoAuthenticatorPage=Retour à la page de l''authentificateur
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_it.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_it.properties
index 2fb32efaf860..32e90c43ea8a 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_it.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_it.properties
@@ -1,45 +1,40 @@
 doSave=Salva
 doCancel=Annulla
-doLogOutAllSessions=Effettua il logout da tutte le sessioni
+doLogOutAllSessions=Disconnessione da tutte le sessioni
 doRemove=Elimina
 doAdd=Aggiungi
 doSignOut=Esci
-doLogIn=Log In
-doLink=Link
-
+doLogIn=Accedi
+doLink=Collega
 personalInfoSidebarTitle=Informazioni personali
-accountSecuritySidebarTitle=Sicurezza dell''account
+accountSecuritySidebarTitle=Sicurezza dell''utente
 signingInSidebarTitle=Impostazioni di accesso
 deviceActivitySidebarTitle=Attività del dispositivo
-linkedAccountsSidebarTitle=Account collegati
-
-editAccountHtmlTitle=Modifica Account
+linkedAccountsSidebarTitle=Utenze collegate
+editAccountHtmlTitle=Modifica utente
 personalInfoHtmlTitle=Informazioni personali
 federatedIdentitiesHtmlTitle=Identità federate
-accountLogHtmlTitle=Log dell''account
+accountLogHtmlTitle=Registro operazioni dell''utente
 changePasswordHtmlTitle=Cambia password
 deviceActivityHtmlTitle=Attività dei dispositivi
 sessionsHtmlTitle=Sessioni
-accountManagementTitle=Gestione degli account di Keycloak
+accountManagementTitle=Gestione degli utenti di Keycloak
 authenticatorTitle=Autenticatore
 applicationsHtmlTitle=Applicazioni
-linkedAccountsHtmlTitle=Account collegati
-
-accountManagementWelcomeMessage=Benvenuto nella gestione degli account di Keycloak
+linkedAccountsHtmlTitle=Utenze collegate
+accountManagementWelcomeMessage=Benvenuto nella gestione degli utenti di Keycloak
 personalInfoIntroMessage=Gestisci le tue informazioni di base
-accountSecurityTitle=Sicurezza dell''account
-accountSecurityIntroMessage=Controlla la tua password e gli accessi dell''account
-applicationsIntroMessage=Traccia e gestisci i permessi delle applicazioni nell''accesso al tuo account
+accountSecurityTitle=Sicurezza dell''utente
+accountSecurityIntroMessage=Controlla la tua password e gli accessi dell''utente
+applicationsIntroMessage=Traccia e gestisci i permessi delle applicazioni nell''accesso al tuo utente
 resourceIntroMessage=Condividi le tue risorse tra i membri del team
 passwordLastUpdateMessage=La tua password è stata aggiornata il
 updatePasswordTitle=Aggiornamento password
 updatePasswordMessageTitle=Assicurati di scegliere una password robusta
-updatePasswordMessage=Una password robusta contiene un misto di numeri, lettere, e simboli. È difficile da indovinare, non assomiglia a una parola reale, ed è utilizzata solo per questo account.
+updatePasswordMessage=Una password robusta contiene un misto di numeri, lettere e simboli. È difficile da indovinare, non assomiglia a una parola reale, ed è utilizzata solo per questo utente.
 personalSubTitle=Le tue informazioni personali
-personalSubMessage=Gestisce queste informazioni di base: il tuo nome, cognome, e indirizzo email
-
+personalSubMessage=Gestisci i tuoi dati personali di base.
 authenticatorCode=Codice monouso
-
 email=Email
 firstName=Nome
 givenName=Nome
@@ -50,16 +45,15 @@ password=Password
 currentPassword=Password attuale
 passwordConfirm=Conferma password
 passwordNew=Nuova password
-username=Username
+username=Nome utente
 address=Indirizzo
 street=Via
 locality=Città o località
-region=Stato, Provincia, o Regione
+region=Stato, Provincia o Regione
 postal_code=CAP
 country=Paese
 emailVerified=Email verificata
 gssDelegationCredential=Credenziali delega GSS
-
 profileScopeConsentText=Profilo utente
 emailScopeConsentText=Indirizzo email
 addressScopeConsentText=Indirizzo
@@ -84,26 +78,24 @@ role_manage-identity-providers=Gestisci identity provider
 role_manage-clients=Gestisci client
 role_manage-events=Gestisci eventi
 role_view-profile=Visualizza profilo
-role_manage-account=Gestisci account
-role_manage-account-links=Gestisci i link dell''account
+role_manage-account=Gestisci utente
+role_manage-account-links=Gestisci i collegamenti dell''utente
 role_manage-consent=Gestisci consensi
 role_read-token=Leggi token
 role_offline-access=Accesso offline
 role_uma_authorization=Ottieni permessi
-client_account=Account
-client_account-console=Console account
+client_account=Utente
+client_account-console=Console utente
 client_security-admin-console=Console di amministrazione di sicurezza
-client_admin-cli=Admin CLI
+client_admin-cli=Interfaccia a linea di comando amministrativa (Admin CLI)
 client_realm-management=Gestione realm
 client_broker=Broker
 
 
 requiredFields=Campi obbligatori
 allFieldsRequired=Tutti campi obbligatori
-
 backToApplication=&laquo; Torna all''applicazione
 backTo=Torna a {0}
-
 date=Data
 event=Evento
 ip=IP
@@ -114,16 +106,13 @@ started=Iniziato
 lastAccess=Ultimo accesso
 expires=Scade
 applications=Applicazioni
-
-account=Account
+account=Utente
 federatedIdentity=Identità federate
 authenticator=Autenticatore
 device-activity=Attività dei dispositivi
 sessions=Sessioni
 log=Log
-
 application=Applicazione
-availablePermissions=Autorizzazioni disponibili
 grantedPermissions=Autorizzazioni concesse
 grantedPersonalInfo=Informazioni personali concesse
 additionalGrants=Ulteriori concessioni
@@ -132,30 +121,25 @@ inResource=in
 fullAccess=Accesso completo
 offlineToken=Token offline
 revoke=Revoca concessione
-
 configureAuthenticators=Autenticatori configurati
 mobile=Dispositivo mobile
-totpStep1=Installa una delle seguenti applicazioni sul tuo dispositivo mobile
-totpStep2=Apri l''applicazione e scansiona il codice QR
-totpStep3=Scrivi il codice monouso fornito dall''applicazione e clicca Salva per completare il setup.
-totpStep3DeviceName=Fornisci il nome del dispositivo per aiutarti a gestire i dispositivi di autenticazione.
-
-totpManualStep2=Apri l''applicazione e scrivi la chiave
-totpManualStep3=Usa le seguenti impostazioni se l''applicazione lo consente
+totpStep1=Installa una delle seguenti applicazioni sul tuo dispositivo mobile:
+totpStep2=Apri l''applicazione e scansiona il codice QR:
+totpStep3=Scrivi il codice monouso fornito dall''applicazione e clicca Salva per completare la configurazione.
+totpStep3DeviceName=Fornisci il nome del dispositivo per aiutarti a gestire i dispositivi di autenticazione OTP.
+totpManualStep2=Apri l''applicazione e scrivi la chiave:
+totpManualStep3=Usa le seguenti impostazioni se l''applicazione lo consente:
 totpUnableToScan=Non riesci a scansionare il codice QR?
 totpScanBarcode=Vuoi scansionare il codice QR?
-
 totp.totp=Basato sull''ora
 totp.hotp=Basato sul contatore
-
 totpType=Tipo
 totpAlgorithm=Algoritmo
 totpDigits=Cifre
 totpInterval=Intervallo
 totpCounter=Contatore
 totpDeviceName=Nome dispositivo
-
-missingUsernameMessage=Inserisci lo username.
+missingUsernameMessage=Inserisci il nome utente.
 missingFirstNameMessage=Inserisci il nome.
 invalidEmailMessage=Indirizzo email non valido.
 missingLastNameMessage=Inserisci il cognome.
@@ -163,51 +147,42 @@ missingEmailMessage=Inserisci l''indirizzo email.
 missingPasswordMessage=Inserisci la password.
 notMatchPasswordMessage=Le password non coincidono.
 invalidUserMessage=Utente non valido
-
-missingTotpMessage=Inserisci il codice di autenticazione.
+missingTotpMessage=Inserisci il codice di autenticazione OTP.
 missingTotpDeviceNameMessage=Inserisci il nome del dispositivo di autenticazione.
 invalidPasswordExistingMessage=Password esistente non valida.
 invalidPasswordConfirmMessage=La password di conferma non coincide.
 invalidTotpMessage=Codice di autenticazione non valido.
-
-usernameExistsMessage=Username già esistente.
+usernameExistsMessage=Nome utente già esistente.
 emailExistsMessage=Email già esistente.
-
-readOnlyUserMessage=Non puoi aggiornare il tuo account poiché è in modalità sola lettura.
+readOnlyUserMessage=Non puoi aggiornare il tuo utente poiché è in modalità sola lettura.
 readOnlyUsernameMessage=Non puoi aggiornare il tuo nome utente poiché è in modalità sola lettura.
-readOnlyPasswordMessage=Non puoi aggiornare il tuo account poiché è in modalità sola lettura.
-
+readOnlyPasswordMessage=Non puoi aggiornare la tua password perché il tuo utente è in modalità sola lettura.
 successTotpMessage=Autenticatore mobile configurato.
 successTotpRemovedMessage=Autenticatore mobile eliminato.
-
 successGrantRevokedMessage=Concessione revocata con successo.
-
-accountUpdatedMessage=Il tuo account è stato aggiornato.
+accountUpdatedMessage=Il tuo utente è stato aggiornato.
 accountPasswordUpdatedMessage=La tua password è stata aggiornata.
-
 missingIdentityProviderMessage=Identity provider non specificato.
 invalidFederatedIdentityActionMessage=Azione non valida o mancante.
 identityProviderNotFoundMessage=L''identity provider specificato non è stato trovato.
-federatedIdentityLinkNotActiveMessage=Questo identity non è più attivo.
-federatedIdentityRemovingLastProviderMessage=Non puoi rimuovere l''ultima identità federata poiché non hai più la password.
+federatedIdentityLinkNotActiveMessage=Questa identità non è più attiva.
+federatedIdentityRemovingLastProviderMessage=Non puoi rimuovere l''ultima identità federata poiché non hai una password.
 identityProviderRedirectErrorMessage=Il reindirizzamento all''identity provider è fallito.
 identityProviderRemovedMessage=Identity provider eliminato correttamente.
 identityProviderAlreadyLinkedMessage=L''identità federata restituita da {0} è già collegata ad un altro utente.
 staleCodeAccountMessage=La pagina è scaduta. Prova di nuovo.
 consentDenied=Consenso negato.
-
-accountDisabledMessage=Account disabilitato, contatta l''amministratore.
-
-accountTemporarilyDisabledMessage=L''account è temporaneamente disabilitato, contatta l''amministratore o riprova più tardi.
+accountDisabledMessage=Utente disabilitato, contatta l''amministratore.
+accountTemporarilyDisabledMessage=L''utente è temporaneamente disabilitato, contatta l''amministratore o riprova più tardi.
 invalidPasswordMinLengthMessage=Password non valida: lunghezza minima {0}.
 invalidPasswordMinLowerCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri minuscoli.
 invalidPasswordMinDigitsMessage=Password non valida: deve contenere almeno {0} numeri.
 invalidPasswordMinUpperCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri maiuscoli.
 invalidPasswordMinSpecialCharsMessage=Password non valida: deve contenere almeno {0} caratteri speciali.
-invalidPasswordNotUsernameMessage=Password non valida: non deve essere uguale allo username.
-invalidPasswordRegexPatternMessage=Password non valida: fallito il match con una o più espressioni regolari.
+invalidPasswordNotUsernameMessage=Password non valida: non deve essere uguale al nome utente.
+invalidPasswordRegexPatternMessage=Password non valida: non soddisfa una o più espressioni regolari.
 invalidPasswordHistoryMessage=Password non valida: non deve essere uguale a una delle ultime {0} password.
-invalidPasswordBlacklistedMessage=Password non valida: la password non è consentita.
+invalidPasswordBlacklistedMessage=Questa password non è consentita.
 invalidPasswordGenericMessage=Password non valida: la nuova password non rispetta le indicazioni previste.
 
 # Authorization
@@ -224,7 +199,7 @@ resourceNoPermissionsGrantingAccess=Nessun permesso dà accesso a questa risorsa
 anyAction=Qualsiasi azione
 description=Descrizione
 name=Nome
-scopes=Ambito
+scopes=Ambiti
 resource=Risorsa
 user=Utente
 peopleSharingThisResource=Persone che condividono questa risorsa
@@ -248,7 +223,7 @@ resourceIsNotBeingShared=La risorsa non è in condivisione
 # Applications
 applicationName=Nome
 applicationType=Tipo applicazione
-applicationInUse=In-use app only
+applicationInUse=Solo applicazione in uso
 clearAllFilter=Azzera tutti i filtri
 activeFilters=Filtri attivi
 filterByName=Filtra per nome ...
@@ -260,32 +235,32 @@ clientNotFoundMessage=Client non trovato.
 
 # Linked account
 authorizedProvider=Provider autorizzato
-authorizedProviderMessage=Provider autorizzati collegati al tuo account
+authorizedProviderMessage=Provider autorizzati collegati al tuo utente
 identityProvider=Identity provider
-identityProviderMessage=Collegare il tuo account con gli identity provider che hai configurato
-socialLogin=Social Login
+identityProviderMessage=Collegare il tuo utente con gli identity provider che hai configurato
+socialLogin=Accesso Social
 userDefined=Definito dall''utente
 removeAccess=Rimuovi accesso
-removeAccessMessage=Devi concedere di nuovo l''accesso, se vuoi utilizzare l''account di questa applicazione.
+removeAccessMessage=Devi concedere di nuovo l''accesso, se vuoi utilizzare l''utente di questa applicazione.
 
 #Authenticator
 authenticatorStatusMessage=L''autenticazione a due fattori è attualmente
 authenticatorFinishSetUpTitle=La tua autenticazione a due fattori
-authenticatorFinishSetUpMessage=Ogni volta che effettui l''accesso al tuo account Keycloak, ti verrà richiesto di fornire il tuo codice di autenticazione a due fattori.
+authenticatorFinishSetUpMessage=Ogni volta che effettui l''accesso al tuo utente Keycloak, ti verrà richiesto di fornire il tuo codice di autenticazione a due fattori.
 authenticatorSubTitle=Imposta l''autenticazione a due fattori
-authenticatorSubMessage=Per incrementare la sicurezza del tuo account, attiva almeno uno dei metodi disponibili per l''autenticazione a due fattori.
+authenticatorSubMessage=Per incrementare la sicurezza del tuo utente, attiva almeno uno dei metodi disponibili per l''autenticazione a due fattori.
 authenticatorMobileTitle=Autenticatore mobile
 authenticatorMobileMessage=Utilizza l''autenticatore mobile per ottenere i codici di verifica per l''autenticazione a due fattori.
 authenticatorMobileFinishSetUpMessage=L''autenticatore è stato collegato al tuo telefono.
-authenticatorActionSetup=Set up
+authenticatorActionSetup=Configurazione
 authenticatorSMSTitle=Codice SMS
 authenticatorSMSMessage=Keycloak invierà il codice di verifica al tuo telefono per l''autenticazione a due fattori.
 authenticatorSMSFinishSetUpMessage=I messaggi di testo vengono inviati a
-authenticatorDefaultStatus=Default
+authenticatorDefaultStatus=Predefinito
 authenticatorChangePhone=Cambia numero di telefono
 
 #Authenticator - Mobile Authenticator setup
-authenticatorMobileSetupTitle=Setup autenticatore mobile
+authenticatorMobileSetupTitle=Configurazione autenticatore mobile
 smscodeIntroMessage=Inserisci il tuo numero di telefono e ti verrà inviato un codice di verifica.
 mobileSetupStep1=Installa un''applicazione di autenticazione sul tuo telefono. Sono supportate le applicazioni qui elencate.
 mobileSetupStep2=Apri l''applicazione e scansiona il codice QR:
@@ -296,18 +271,18 @@ doCopy=Copia
 doFinish=Termina
 
 #Authenticator - SMS Code setup
-authenticatorSMSCodeSetupTitle=Setup codice SMS
+authenticatorSMSCodeSetupTitle=Configurazione codice SMS
 chooseYourCountry=Scegli la tua nazione
 enterYourPhoneNumber=Inserisci il tuo numero di telefono
 sendVerficationCode=Invia il codice di verifica
 enterYourVerficationCode=Inserisci il codice di verifica
 
 #Authenticator - backup Code setup
-authenticatorBackupCodesSetupTitle=Setup backup codici
+authenticatorBackupCodesSetupTitle=Configurazione codici di ripristino
 realmName=Realm
-doDownload=Download
+doDownload=Scarica
 doPrint=Stampa
-generateNewBackupCodes=Genera dei nuovi codici di backup
+generateNewBackupCodes=Genera dei nuovi codici di ripristino
 backtoAuthenticatorPage=Torna alla pagina dell''autenticatore
 
 
@@ -328,8 +303,8 @@ group=Gruppo
 selectPermission=Seleziona permessi
 addPeople=Aggiungi persone con le quali condividere la tua risorsa
 addTeam=Aggiungi gruppi con i quali condividere la tua risorsa
-myPermissions=Miei permessi
-waitingforApproval=Attesa dell''approvazione
+myPermissions=I miei permessi
+waitingforApproval=In attesa dell''approvazione
 anyPermission=Qualsiasi permesso
 
 # Openshift messages
@@ -337,3 +312,48 @@ openshift.scope.user_info=Informazioni utente
 openshift.scope.user_check-access=Informazioni per l''accesso dell''utente
 openshift.scope.user_full=Accesso completo
 openshift.scope.list-projects=Elenca progetti
+noAccessMessage=Accesso non consentito
+phoneNumber=Numero di telefono
+phoneNumberVerified=Numero di telefono verificato
+birthday=Data di nascita
+role_view-groups=Visualizza gruppi
+availableRoles=Ruoli disponibili
+organizationScopeConsentText=Organizzazione
+gender=Genere
+zoneinfo=Fuso orario
+website=Pagina web
+errasingData=Eliminazione di tutti i tuoi dati
+loggingOutImmediately=Disconnessione immediata
+accountUnusable=Con questo utente non sarà più possibile usare l''applicazione
+access-denied-when-idp-auth=Accesso negato durante l''accesso con {0}
+invalidPasswordNotEmailMessage=Password non valida: non può essere uguale all''email.
+error-invalid-value=Valore non valido.
+error-empty=Si prega di indicare un valore.
+error-invalid-length-too-short=Il campo {0} deve avere una lunghezza minima di {1}.
+irreversibleAction=L''azione è irreversibile
+invalidPasswordMaxLengthMessage=Password non valida: la lunghezza massima è {0}.
+deletingImplies=Eliminare il tuo utente comporta:
+invalidPasswordNotContainsUsernameMessage=Password non valida: non può contenere il nome utente.
+updateReadOnlyAttributesRejectedMessage=Aggiornamento rifiutato per l''attributo in sola lettura
+error-invalid-blank=Si prega di inserire un valore.
+error-invalid-length=Il campo {0} deve avere una lunghezza compresa tra {1} e {2}.
+totpAppGoogleName=Google Authenticator
+federatedIdentityBoundOrganization=Non puoi rimuovere il collegamento di un''identity provider gestito da un''organizzazione.
+error-invalid-email=Indirizzo email non valido.
+error-number-out-of-range=Il campo {0} deve essere un numero compreso fra {1} e {2}.
+error-number-out-of-range-too-small=Il campo {0} deve essere almeno {1}.
+error-number-out-of-range-too-big=Il campo {0} deve essere al massimo {2}.
+error-pattern-no-match=Valore non valido.
+error-invalid-uri=URL non valido.
+error-invalid-uri-scheme=Schema URL non valido.
+error-invalid-uri-fragment=Indirizzo URL non valido.
+error-user-attribute-required=Specifica il campo {0}.
+error-invalid-date=Data non valida.
+error-user-attribute-read-only=Il campo {0} è di sola lettura.
+error-person-name-invalid-character=Il nome contiene caratteri non validi.
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+accountManagementBaseThemeCannotBeUsedDirectly=Il tema dell''utente di base contiene solo le traduzioni per la console dell''utente. Per visualizzare la console dell''utente, è necessario impostare il genitore del tema su un altro tema dell''utente, oppure fornire il proprio file index.ftl. Per ulteriori informazioni, consultare la documentazione.
+totpAppFreeOTPName=FreeOTP
+error-invalid-number=Numero non valido.
+error-username-invalid-character=Il nome utente contiene caratteri non validi.
+error-invalid-length-too-long=Il campo {0} deve avere una lunghezza massima di {2}.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ja.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ja.properties
index 74a458b0721c..7bf04d92a341 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_ja.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ja.properties
@@ -1,6 +1,6 @@
 doSave=保存
 doCancel=キャンセル
-doLogOutAllSessions=全セッションからログアウト
+doLogOutAllSessions=全セッションのログアウト
 doRemove=削除
 doAdd=追加
 doSignOut=サインアウト
@@ -13,7 +13,7 @@ personalInfoHtmlTitle=個人情報
 federatedIdentitiesHtmlTitle=連携済みアイデンティティー
 accountLogHtmlTitle=アカウントログ
 changePasswordHtmlTitle=パスワードの変更
-deviceActivityHtmlTitle=デバイス・アクティビティー
+deviceActivityHtmlTitle=デバイスアクティビティー
 sessionsHtmlTitle=セッション
 accountManagementTitle=Keycloakアカウント管理
 authenticatorTitle=オーセンティケーター
@@ -22,7 +22,7 @@ linkedAccountsHtmlTitle=リンクされたアカウント
 accountManagementWelcomeMessage=Keycloakアカウント管理へようこそ
 personalInfoIntroMessage=基本情報を管理する
 accountSecurityTitle=アカウントセキュリティー
-accountSecurityIntroMessage=パスワードとアカウント・アクセスを制御する
+accountSecurityIntroMessage=パスワードとアカウントアクセスを制御する
 applicationsIntroMessage=アカウントへアクセスするためにアプリのパーミッションを追跡して管理する
 resourceIntroMessage=チームメンバー間でリソースを共有する
 passwordLastUpdateMessage=パスワードは更新されました
@@ -30,9 +30,9 @@ updatePasswordTitle=パスワードの更新
 updatePasswordMessageTitle=強力なパスワードを選択してください
 updatePasswordMessage=強力なパスワードは、数字、文字、記号を含みます。推測が難しく、実在する言葉に似ておらず、このアカウントだけで使用されています。
 personalSubTitle=個人情報
-personalSubMessage=この基本情報を管理してください：名、姓、メール
+personalSubMessage=基本情報を管理してください。
 authenticatorCode=ワンタイムコード
-email=Eメール
+email=メールアドレス
 firstName=名
 givenName=名
 fullName=氏名
@@ -49,7 +49,7 @@ locality=市区町村
 region=都道府県
 postal_code=郵便番号
 country=国
-emailVerified=確認済みEメール
+emailVerified=検証済みメールアドレス
 gssDelegationCredential=GSS委譲クレデンシャル
 profileScopeConsentText=ユーザープロファイル
 emailScopeConsentText=メールアドレス
@@ -66,7 +66,7 @@ role_view-users=ユーザーの参照
 role_view-applications=アプリケーションの参照
 role_view-clients=クライアントの参照
 role_view-events=イベントの参照
-role_view-identity-providers=アイデンティティー・プロバイダーの参照
+role_view-identity-providers=アイデンティティープロバイダーの参照
 role_view-consent=同意の参照
 role_manage-realm=レルムの管理
 role_manage-users=ユーザーの管理
@@ -79,10 +79,10 @@ role_manage-account=アカウントの管理
 role_manage-account-links=アカウントリンクの管理
 role_manage-consent=同意の管理
 role_read-token=トークンの参照
-role_offline-access=オフライン・アクセス
+role_offline-access=オフラインアクセス
 role_uma_authorization=パーミッションの取得
 client_account=アカウント
-client_account-console=アカウント・コンソール
+client_account-console=アカウントコンソール
 client_security-admin-console=セキュリティー管理コンソール
 client_admin-cli=管理CLI
 client_realm-management=レルム管理
@@ -104,9 +104,9 @@ lastAccess=最終アクセス
 expires=有効期限
 applications=アプリケーション
 account=アカウント
-federatedIdentity=連携済みアイデンティティー
+federatedIdentity=連携されたアイデンティティー
 authenticator=オーセンティケーター
-device-activity=デバイス・アクティビティー
+device-activity=デバイスアクティビティー
 sessions=セッション
 log=ログ
 application=アプリケーション
@@ -117,7 +117,7 @@ additionalGrants=追加の許可
 action=アクション
 inResource=in
 fullAccess=フルアクセス
-offlineToken=オフライン・トークン
+offlineToken=オフライントークン
 revoke=許可の取り消し
 configureAuthenticators=設定済みのオーセンティケーター
 mobile=モバイル
@@ -137,51 +137,51 @@ totpDigits=数字
 totpInterval=間隔
 totpCounter=カウンター
 totpDeviceName=デバイス名
-missingUsernameMessage=ユーザー名を入力してください。
-missingFirstNameMessage=名を入力してください。
+missingUsernameMessage=ユーザー名を指定してください。
+missingFirstNameMessage=名を指定してください。
 invalidEmailMessage=無効なメールアドレスです。
-missingLastNameMessage=姓を入力してください。
-missingEmailMessage=Eメールを入力してください。
-missingPasswordMessage=パスワードを入力してください。
+missingLastNameMessage=姓を指定してください。
+missingEmailMessage=メールアドレスを指定してください。
+missingPasswordMessage=パスワードを指定してください。
 notMatchPasswordMessage=パスワードが一致していません。
-invalidUserMessage=無効なユーザーです。
-missingTotpMessage=オーセンティケーター・コードを入力してください。
+invalidUserMessage=無効なユーザーです
+missingTotpMessage=オーセンティケーターコードを指定してください。
 missingTotpDeviceNameMessage=デバイス名を指定してください。
 invalidPasswordExistingMessage=既存のパスワードが不正です。
 invalidPasswordConfirmMessage=新しいパスワード（確認）と一致していません。
-invalidTotpMessage=無効なオーセンティケーター・コードです。
+invalidTotpMessage=無効なオーセンティケーターコードです。
 usernameExistsMessage=既に存在するユーザー名です。
-emailExistsMessage=既に存在するEメールです。
+emailExistsMessage=既に存在するメールアドレスです。
 readOnlyUserMessage=読み取り専用のため、アカウントを更新することはできません。
 readOnlyUsernameMessage=読み取り専用のため、ユーザー名を更新することはできません。
 readOnlyPasswordMessage=読み取り専用のため、パスワードを更新することはできません。
-successTotpMessage=モバイル・オーセンティケーターが設定されました。
-successTotpRemovedMessage=モバイル・オーセンティケーターが削除されました。
+successTotpMessage=モバイルオーセンティケーターが設定されました。
+successTotpRemovedMessage=モバイルオーセンティケーターが削除されました。
 successGrantRevokedMessage=許可が正常に取り消しされました。
 accountUpdatedMessage=アカウントが更新されました。
 accountPasswordUpdatedMessage=パスワードが更新されました。
-missingIdentityProviderMessage=アイデンティティー・プロバイダーが指定されていません。
+missingIdentityProviderMessage=アイデンティティープロバイダーが指定されていません。
 invalidFederatedIdentityActionMessage=無効または存在しないアクションです。
-identityProviderNotFoundMessage=指定されたアイデンティティー・プロバイダーが見つかりません。
+identityProviderNotFoundMessage=指定されたアイデンティティープロバイダーが見つかりません。
 federatedIdentityLinkNotActiveMessage=このアイデンティティーは有効ではありません。
-federatedIdentityRemovingLastProviderMessage=パスワードがないため、最後の連携済みアイデンティティーが削除できません。
-identityProviderRedirectErrorMessage=アイデンティティー・プロバイダーへのリダイレクトに失敗しました。
-identityProviderRemovedMessage=アイデンティティー・プロバイダーが正常に削除されました。
-identityProviderAlreadyLinkedMessage={0}から返された連携済みアイデンティティーは既に他のユーザーに関連付けされています。
+federatedIdentityRemovingLastProviderMessage=パスワードがないため、最後の連携されたアイデンティティーを削除できません。
+identityProviderRedirectErrorMessage=アイデンティティープロバイダーへのリダイレクトに失敗しました。
+identityProviderRemovedMessage=アイデンティティープロバイダーが正常に削除されました。
+identityProviderAlreadyLinkedMessage={0}から返された連携されたアイデンティティーは既に他のユーザーに関連付けされています。
 staleCodeAccountMessage=有効期限切れです。再度お試しください。
 consentDenied=同意が拒否されました。
 accountDisabledMessage=アカウントが無効です。管理者に連絡してください。
 accountTemporarilyDisabledMessage=アカウントが一時的に無効です。管理者に連絡するか、しばらく時間をおいてから再度お試しください。
-invalidPasswordMinLengthMessage=無効なパスワード: 最小{0}の長さが必要です。
+invalidPasswordMinLengthMessage=無効なパスワード: 最小長は{0}です。
 invalidPasswordMinLowerCaseCharsMessage=無効なパスワード: 少なくとも{0}文字の小文字を含む必要があります。
 invalidPasswordMinDigitsMessage=無効なパスワード: 少なくとも{0}文字の数字を含む必要があります。
 invalidPasswordMinUpperCaseCharsMessage=無効なパスワード:少なくとも{0}文字の大文字を含む必要があります。
 invalidPasswordMinSpecialCharsMessage=無効なパスワード: 少なくとも{0}文字の特殊文字を含む必要があります。
 invalidPasswordNotUsernameMessage=無効なパスワード: ユーザー名と同じパスワードは禁止されています。
 invalidPasswordRegexPatternMessage=無効なパスワード: 正規表現パターンと一致しません。
-invalidPasswordHistoryMessage=無効なパスワード: 最近の{0}パスワードのいずれかと同じパスワードは禁止されています。
+invalidPasswordHistoryMessage=無効なパスワード: 直近{0}個のパスワードのいずれかと同じパスワードは禁止されています。
 invalidPasswordBlacklistedMessage=無効なパスワード: パスワードがブラックリストに含まれています。
-invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワード・ポリシーと一致しません。
+invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワードポリシーと一致しません。
 
 # Authorization
 myResources=マイリソース
@@ -212,17 +212,17 @@ permissionRequestion=パーミッションの要求
 permission=パーミッション
 shares=共有（複数）
 notBeingShared=このリソースは共有されていません。
-notHaveAnyResource=リソースがありません。
+notHaveAnyResource=リソースがありません
 noResourcesSharedWithYou=共有しているリソースはありません
 havePermissionRequestsWaitingForApproval=承認を待っている{0}個のパーミッションの要求があります。
 clickHereForDetails=詳細はこちらをクリックしてください。
-resourceIsNotBeingShared=リソースは共有されていません。
+resourceIsNotBeingShared=リソースは共有されていません
 
 # Applications
 applicationName=名前
-applicationType=アプリケーション・タイプ
+applicationType=アプリケーションタイプ
 applicationInUse=使用中のアプリケーションのみ
-clearAllFilter=すべてのフィルターをクリア
+clearAllFilter=すべてのフィルターの消去
 activeFilters=アクティブなフィルター
 filterByName=名前でフィルタリング...
 allApps=すべてのアプリケーション
@@ -235,11 +235,11 @@ clientNotFoundMessage=クライアントが見つかりません。
 authorizedProvider=認可済みプロバイダー
 authorizedProviderMessage=アカウントにリンクされた認可済みプロバイダー
 identityProvider=アイデンティティープロバイダー
-identityProviderMessage=アカウントと設定したアイデンティティー・プロバイダーをリンクするには
-socialLogin=ソーシャル・ログイン
+identityProviderMessage=アカウントと設定したアイデンティティープロバイダーをリンクするには
+socialLogin=ソーシャルログイン
 userDefined=ユーザー定義
 removeAccess=アクセス権の削除
-removeAccessMessage=このアプリ・アカウントを使用する場合は、アクセス権を再度付与する必要があります。
+removeAccessMessage=このアプリアカウントを使用する場合は、アクセス権を再度付与する必要があります。
 
 #Authenticator
 authenticatorStatusMessage=2要素認証は現在
@@ -247,20 +247,20 @@ authenticatorFinishSetUpTitle=あなたの2要素認証
 authenticatorFinishSetUpMessage=Keycloakアカウントにサインインするたびに、2要素認証コードを入力するように求められます。
 authenticatorSubTitle=2要素認証を設定する
 authenticatorSubMessage=アカウントのセキュリティーを強化するには、利用可能な2要素認証の方式のうち少なくとも1つを有効にします。
-authenticatorMobileTitle=モバイル・オーセンティケーター
-authenticatorMobileMessage=モバイル・オーセンティケーターを使用して、2要素認証として確認コードを取得します。
+authenticatorMobileTitle=モバイルオーセンティケーター
+authenticatorMobileMessage=モバイルオーセンティケーターを使用して、2要素認証として確認コードを取得します。
 authenticatorMobileFinishSetUpMessage=オーセンティケーターはあなたの携帯電話にバインドされています。
 authenticatorActionSetup=セットアップ
 authenticatorSMSTitle=SMSコード
 authenticatorSMSMessage=Keycloakは、2要素認証として確認コードを携帯電話に送信します。
-authenticatorSMSFinishSetUpMessage=テキスト・メッセージが次の電話番号宛に送信されます：
+authenticatorSMSFinishSetUpMessage=テキストメッセージが次の電話番号宛に送信されます
 authenticatorDefaultStatus=デフォルト
 authenticatorChangePhone=電話番号の変更
 
 #Authenticator - Mobile Authenticator setup
-authenticatorMobileSetupTitle=モバイル・オーセンティケーターのセットアップ
+authenticatorMobileSetupTitle=モバイルオーセンティケーターのセットアップ
 smscodeIntroMessage=電話番号を入力すると、確認コードがあなたの電話に送信されます。
-mobileSetupStep1=携帯電話にオーセンティケーター・アプリケーションをインストールします。ここにリストされているアプリケーションがサポートされています。
+mobileSetupStep1=携帯電話にオーセンティケーターアプリケーションをインストールします。ここにリストされているアプリケーションがサポートされています。
 mobileSetupStep2=アプリケーションを開き、バーコードをスキャンしてください。
 mobileSetupStep3=アプリケーションから提供されたワンタイムコードを入力し、保存をクリックしてセットアップを終了します。
 scanBarCode=バーコードをスキャンしますか？
@@ -276,12 +276,12 @@ sendVerficationCode=確認コードの送信
 enterYourVerficationCode=確認コードを入力してください
 
 #Authenticator - backup Code setup
-authenticatorBackupCodesSetupTitle=バックアップ・コードのセットアップ
+authenticatorBackupCodesSetupTitle=バックアップコードのセットアップ
 realmName=レルム
 doDownload=ダウンロード
 doPrint=印刷
-generateNewBackupCodes=新しいバックアップ・コードを生成する
-backtoAuthenticatorPage=オーセンティケーター・ページに戻る
+generateNewBackupCodes=新しいバックアップコードを生成する
+backtoAuthenticatorPage=オーセンティケーターページに戻る
 
 
 #Resources
@@ -289,7 +289,7 @@ resources=リソース
 sharedwithMe=私と共有
 share=共有
 sharedwith=共有
-accessPermissions=アクセス・パーミッション
+accessPermissions=アクセスパーミッション
 permissionRequests=パーミッションの要求
 approve=承認
 approveAll=すべて承認
@@ -298,9 +298,9 @@ perPage=1ページあたり
 currentPage=現在のページ
 sharetheResource=リソースの共有
 group=グループ
-selectPermission=パーミッションを選択
-addPeople=あなたのリソースを共有する人を追加
-addTeam=あなたのリソースを共有するチームを追加
+selectPermission=パーミッションの選択
+addPeople=あなたのリソースを共有する人の追加
+addTeam=あなたのリソースを共有するチームの追加
 myPermissions=私のパーミッション
 waitingforApproval=承認待ち
 anyPermission=任意のパーミッション
@@ -312,3 +312,50 @@ openshift.scope.user_full=フルアクセス
 openshift.scope.list-projects=プロジェクトの一覧表示
 accountSecuritySidebarTitle=アカウントセキュリティー
 deviceActivitySidebarTitle=デバイスアクティビティー
+personalInfoSidebarTitle=個人情報
+signingInSidebarTitle=サインイン
+website=Webページ
+phoneNumber=電話番号
+phoneNumberVerified=電話番号検証済み
+gender=性別
+birthday=生年月日
+zoneinfo=タイムゾーン
+organizationScopeConsentText=組織
+role_view-groups=グループの参照
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+irreversibleAction=このアクションは不可逆的です
+deletingImplies=以下のアカウントを削除することを意味します。
+errasingData=すべてのデータを消去する
+loggingOutImmediately=すぐにログアウトする
+accountUnusable=このアカウントでアプリケーションを使用することはできません
+federatedIdentityBoundOrganization=組織に関連付けられた アイデンティティープロバイダーへのリンクは削除できません。
+access-denied-when-idp-auth={0}での認証時にアクセスが拒否されました
+invalidPasswordMaxLengthMessage=無効なパスワード: 最大長は{0}です。
+invalidPasswordNotContainsUsernameMessage=無効なパスワード: ユーザー名を含めることはできません。
+invalidPasswordNotEmailMessage=無効なパスワード: メールアドレスと同じパスワードは禁止されています。
+error-invalid-blank=値を指定してください。
+error-invalid-length=属性{0}の長さは{1}から{2}までの範囲でなければなりません。
+error-invalid-length-too-long=属性{0}の最大長は{2}である必要があります。
+error-invalid-email=メールアドレスが無効です。
+error-invalid-number=無効な数値です。
+error-number-out-of-range=属性{0}は{1}と{2}の間の数値でなければならなりません。
+error-number-out-of-range-too-small=属性{0}の最小値は{1}である必要があります。
+error-number-out-of-range-too-big=属性{0}の最大値は{2}である必要があります。
+error-pattern-no-match=無効な値です。
+error-invalid-uri=無効なURLです。
+error-invalid-uri-scheme=無効なURLスキームです。
+error-invalid-uri-fragment=無効なURLフラグメントです。
+error-user-attribute-required=属性{0}を指定してください。
+error-invalid-date=無効な日付です。
+error-user-attribute-read-only=フィールド{0}は読み取り専用です。
+error-username-invalid-character=ユーザー名に無効な文字が含まれています。
+error-person-name-invalid-character=名前に無効な文字が含まれています。
+error-invalid-value=無効な値です。
+updateReadOnlyAttributesRejectedMessage=読み取り専用属性の更新が拒否されました
+accountManagementBaseThemeCannotBeUsedDirectly=基本アカウントテーマには、アカウントコンソール用の翻訳しか含まれていません。アカウントコンソールを表示するには、テーマの親を別のアカウントテーマに設定するか、独自のindex.ftlファイルを用意する必要があります。詳細はドキュメントを参照してください。
+noAccessMessage=アクセスが許可されていません
+linkedAccountsSidebarTitle=リンクされたアカウント
+error-invalid-length-too-short=属性{0}の最小の長さは{1}である必要があります。
+error-empty=値を指定してください。
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ka.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ka.properties
index 082216758baa..9f0ebd8be754 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_ka.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ka.properties
@@ -204,7 +204,7 @@ backTo={0}-ზე დაბრუნება
 backToApplication=&laquo; აპლიკაციაზე დაბრუნება
 grantedPersonalInfo=მინიჭებული პირადი ინფორმაცია
 totpStep1=დააყენეთ ერთ-ერთი ამ აპლიკაციათაგანი თქვენს მობილურზე:
-totpStep3=შეიყვანეთ ერთჯერადი კოდი, რომელიც აპლიკაციამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე 'შენახვა', რომ მორგება დაასრულოთ.
+totpStep3=შეიყვანეთ ერთჯერადი კოდი, რომელიც აპლიკაციამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე ''შენახვა'', რომ მორგება დაასრულოთ.
 totpUnableToScan=ვერ დაასკანერეთ?
 totpManualStep2=გახსენით აპლიკაცია და შეიყვანეთ კოდი:
 irreversibleAction=ეს ქმედება შეუქცევადია
@@ -244,7 +244,7 @@ needMyApproval=სჭირდება ჩემი დადასტურე
 requestsWaitingApproval=თქვენი მოთხოვნა დადასტურებას მოელის
 resourcesSharedWithMe=ჩემთან გაზიარებული რესურსები
 notBeingShared=ეს რესურსი გაზიარებული არაა.
-notHaveAnyResource=რესურსები არ აქვთ
+notHaveAnyResource=რესურსები არ გაქვთ
 noResourcesSharedWithYou=თქვენთვის რესურსები არ ზიარდება
 clickHereForDetails=დააწკაპუნეთ აქ მეტი დეტალის სანახავად.
 applicationInUse=მხოლოდ გაშვებული აპი
@@ -269,7 +269,7 @@ mobileSetupStep2=გახსენით აპლიკაცია და დ
 #Authenticator - SMS Code setup
 authenticatorSMSCodeSetupTitle=SMS კოდის მორგება
 chooseYourCountry=აირჩიეთ თქვენი ქვეყანა
-mobileSetupStep3=შეიყვანეთ ერთჯერადი კოდი, რომელიც აპლიკაციამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე 'შენახვა', რომ მორგება დაასრულოთ.
+mobileSetupStep3=შეიყვანეთ ერთჯერადი კოდი, რომელიც აპლიკაციამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე ''შენახვა'', რომ მორგება დაასრულოთ.
 scanBarCode=გნებავთ ბარკოდის დასკანირება?
 enterBarCode=შეიყვანეთ ერთჯერადი კოდი
 sendVerficationCode=გადამოწმების კოდის გაგზავნა
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ky.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ky.properties
new file mode 100644
index 000000000000..f1670846f947
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ky.properties
@@ -0,0 +1,389 @@
+doSave=Сактоо
+doCancel=Жокко чыгаруу
+doLogOutAllSessions=Бардык сессиялардан чыгуу
+doRemove=Алып салуу
+doAdd=Кошуу
+doSignOut=Чыгуу
+doLogIn=Кирүү
+doLink=Туташтыруу
+noAccessMessage=Кирүүгө уруксат жок
+
+personalInfoSidebarTitle=Жеке маалымат
+accountSecuritySidebarTitle=Аккаунттун коопсуздугу
+signingInSidebarTitle=Кирүү
+deviceActivitySidebarTitle=Түзмөктөрдүн активдүүлүгү
+linkedAccountsSidebarTitle=Туташкан аккаунттар
+
+editAccountHtmlTitle=Аккаунтту өзгөртүү
+personalInfoHtmlTitle=Жеке маалымат
+federatedIdentitiesHtmlTitle=Федеративдүү идентификаторлор
+accountLogHtmlTitle=Аккаунт журналы
+changePasswordHtmlTitle=Сырсөздү өзгөртүү
+deviceActivityHtmlTitle=Түзмөктөрдүн активдүүлүгү
+sessionsHtmlTitle=Сессиялар
+accountManagementTitle=Keycloak аккаунтун башкаруу
+authenticatorTitle=Аутентификатор
+applicationsHtmlTitle=Колдонмолор
+linkedAccountsHtmlTitle=Туташкан аккаунттар
+
+accountManagementWelcomeMessage=Keycloak аккаунт башкарууга кош келиңиз
+accountManagementBaseThemeCannotBeUsedDirectly=Негизги аккаунт темасында аккаунт консолу үчүн гана котормолор бар. \
+    Аккаунт консолун көрсөтүү үчүн темаңызды башка аккаунт темасына негиздешиңиз же өзүңүздүн index.ftl файлыңызды камсыздашыңыз керек. \
+    Кошумча маалымат алуу үчүн документтерди караңыз.
+personalInfoIntroMessage=Негизги маалыматыңызды башкарыңыз
+accountSecurityTitle=Аккаунттун коопсуздугу
+accountSecurityIntroMessage=Сырсөзүңүздү жана аккаунтка жетүү мүмкүнчүлүгүн көзөмөлдөңүз
+applicationsIntroMessage=Колдонмолордун аккаунтуңузга жетүүсүн көзөмөлдөңүз жана башкаруу жасаңыз
+resourceIntroMessage=Ресурстарыңызды топ мүчөлөрү менен бөлүшүңүз
+passwordLastUpdateMessage=Сырсөзүңүз акыркы жолу жаңыртылган:
+updatePasswordTitle=Сырсөздү жаңыртуу
+updatePasswordMessageTitle=Күчтүү сырсөз тандаганыңызга ынаныңыз
+updatePasswordMessage=Күчтүү сырсөз — бул сандарды, тамгаларды жана символдорду айкалыштырган, божомолдоо кыйын, чыныгы сөзгө окшобогон жана башка жерлерде колдонулбаган сырсөз.
+personalSubTitle=Жеке Маалыматыңыз
+personalSubMessage=Негизги маалыматты башкарыңыз
+
+authenticatorCode=Бир жолу колдонулуучу код
+email=Электрондук почта
+firstName=Аты
+givenName=Берилген аты
+fullName=Толук аты
+lastName=Фамилия
+familyName=Үй-бүлөлүк аты
+password=Сырсөз
+currentPassword=Азыркы сырсөз
+passwordConfirm=Сырсөздү тастыктоо
+passwordNew=Жаңы сырсөз
+username=Колдонуучу аты
+address=Дарек
+street=Көчө
+locality=Шаар же аймак
+region=Область, провинция же регион
+postal_code=Почта индекси
+country=Өлкө
+emailVerified=Электрондук почта текшерилген
+website=Веб-сайт
+phoneNumber=Телефон номери
+phoneNumberVerified=Телефон номери текшерилген
+gender=Жынысы
+birthday=Туулган күнү
+zoneinfo=Убакыт алкагы
+gssDelegationCredential=GSS ыйгарым укуктары
+
+profileScopeConsentText=Колдонуучунун профили
+emailScopeConsentText=Электрондук почта дареги
+addressScopeConsentText=Дарек
+phoneScopeConsentText=Телефон номери
+offlineAccessScopeConsentText=Офлайн жетүү
+samlRoleListScopeConsentText=Менин ролдорум
+rolesScopeConsentText=Колдонуучу ролдору
+organizationScopeConsentText=Уюм
+
+role_admin=Админ
+role_realm-admin=Realm администратору
+role_create-realm=Realm түзүү
+role_view-realm=Realm көрүү
+role_view-users=Колдонуучуларды көрүү
+role_view-applications=Колдонмолорду көрүү
+role_view-groups=Топторду көрүү
+role_view-clients=Клиенттерди көрүү
+role_view-events=Окуяларды көрүү
+role_view-identity-providers=Идентификация берүүчүлөрдү көрүү
+role_view-consent=Макулдуктарды көрүү
+role_manage-realm=Realm башкаруу
+role_manage-users=Колдонуучуларды башкаруу
+role_manage-applications=Колдонмолорду башкаруу
+role_manage-identity-providers=Идентификация берүүчүлөрдү башкаруу
+role_manage-clients=Клиенттерди башкаруу
+role_manage-events=Окуяларды башкаруу
+role_view-profile=Профилди көрүү
+role_manage-account=Аккаунтту башкаруу
+role_manage-account-links=Аккаунт шилтемелерин башкаруу
+role_manage-consent=Макулдуктарды башкаруу
+role_read-token=Токенди окуу
+role_offline-access=Офлайн жетүү
+role_uma_authorization=Уруксат алуу
+
+client_account=Аккаунт
+client_account-console=Аккаунт консолу
+client_security-admin-console=Коопсуздук админ консолу
+client_admin-cli=Админ CLI
+client_realm-management=Realm башкаруу
+client_broker=Брокер
+
+requiredFields=Милдеттүү талаалар
+allFieldsRequired=Бардык талаалар талап кылынат
+
+backToApplication=« Колдонмого кайтуу
+backTo={0} бетине кайтуу
+
+date=Дата
+event=Окуя
+ip=IP
+client=Клиент
+clients=Клиенттер
+details=Деталдар
+started=Башталган
+lastAccess=Акыркы жетүү
+expires=Мөөнөтү бүтөт
+applications=Колдонмолор
+
+account=Аккаунт
+federatedIdentity=Федеративдик идентификация
+authenticator=Аутентификатор
+device-activity=Түзмөктүн активдүүлүгү
+sessions=Сессиялар
+log=Журнал
+
+application=Колдонмо
+availableRoles=Жеткиликтүү ролдор
+grantedPermissions=Берилген уруксаттар
+grantedPersonalInfo=Берилген жеке маалыматтар
+additionalGrants=Кошумча уруксаттар
+action=Аракет
+inResource=Ресурста
+fullAccess=Толук жетүү
+offlineToken=Офлайн токен
+revoke=Уруксатты жокко чыгаруу
+
+configureAuthenticators=Орнотулган аутентификаторлор
+mobile=Мобилдик
+totpStep1=Төмөнкү тиркемелердин бирин мобилдик түзмөгүңүзгө орнотуңуз:
+totpStep2=Тиркемени ачып, штрих-кодду сканерлеңиз:
+totpStep3=Тиркеме берген бир жолку кодду киргизип, орнотууну бүтүрүү үчүн Сактоо баскычын басыңыз.
+totpStep3DeviceName=OTP түзмөктөрүн башкарууга жардам берүү үчүн түзмөктүн атын көрсөтүңүз.
+
+totpManualStep2=Тиркемени ачып, төмөнкү ачкычты киргизиңиз:
+totpManualStep3=Эгер тиркеме мүмкүнчүлүк берсе, төмөнкү конфигурация маанилерин колдонуңуз:
+totpUnableToScan=Сканерлөө мүмкүн эмеспи?
+totpScanBarcode=Штрих-кодду сканерлөңүзбү?
+
+totp.totp=Убакытка негизделген
+totp.hotp=Санаалга негизделген
+
+totpType=Түрү
+totpAlgorithm=Алгоритм
+totpDigits=Сандар
+totpInterval=Интервал
+totpCounter=Санагыч
+totpDeviceName=Түзмөктүн аты
+
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Аутентификатору
+totpAppMicrosoftAuthenticatorName=Microsoft Аутентификатору
+
+irreversibleAction=Бул аракетти кайтарууга болбойт
+deletingImplies=Аккаунтту өчүрүү төмөнкүлөрдү билдирет:
+errasingData=Бардык маалыматыңыз өчүрүлөт
+loggingOutImmediately=Сиз дароо системадан чыгасыз
+accountUnusable=Бул аккаунт менен колдонмону андан ары колдонууга мүмкүн болбойт
+
+missingUsernameMessage=Колдонуучу атын көрсөтүңүз.
+missingFirstNameMessage=Атыңызды көрсөтүңүз.
+invalidEmailMessage=Электрондук почта дареги жараксыз.
+missingLastNameMessage=Фамилияңызды көрсөтүңүз.
+missingEmailMessage=Электрондук почтаны көрсөтүңүз.
+missingPasswordMessage=Купуясөздү көрсөтүңүз.
+notMatchPasswordMessage=Купуясөздөр дал келген жок.
+invalidUserMessage=Жараксыз колдонуучу
+updateReadOnlyAttributesRejectedMessage=Окууга гана мүмкүн болгон атрибуттар өзгөртүлө албайт
+
+missingTotpMessage=Аутентификатор коду талап кылынат.
+missingTotpDeviceNameMessage=Түзмөктүн атын көрсөтүңүз.
+invalidPasswordExistingMessage=Учурдагы купуясөз жараксыз.
+invalidPasswordConfirmMessage=Купуясөздүн ырасталышы туура келбейт.
+invalidTotpMessage=Аутентификатор коду жараксыз.
+
+usernameExistsMessage=Бул колдонуучу аты мурунтан эле бар.
+emailExistsMessage=Бул электрондук почта дареги мурунтан эле катталган.
+
+readOnlyUserMessage=Аккаунт окууга гана мүмкүн, өзгөртүүгө болбойт.
+readOnlyUsernameMessage=Колдонуучу атын өзгөртүүгө болбойт.
+readOnlyPasswordMessage=Купуясөздү өзгөртүүгө болбойт, анткени аккаунт окууга гана мүмкүн.
+
+successTotpMessage=Мобилдик аутентификатор орнотулду.
+successTotpRemovedMessage=Мобилдик аутентификатор өчүрүлдү.
+
+successGrantRevokedMessage=Уруксат ийгиликтүү жокко чыгарылды.
+
+accountUpdatedMessage=Аккаунтуңуз жаңыртылды.
+accountPasswordUpdatedMessage=Купуясөзүңүз жаңыртылды.
+
+missingIdentityProviderMessage=Идентификация берүүчү көрсөтүлгөн эмес.
+invalidFederatedIdentityActionMessage=Жараксыз же жетишпеген аракет.
+identityProviderNotFoundMessage=Көрсөтүлгөн идентификация берүүчү табылган жок.
+federatedIdentityLinkNotActiveMessage=Бул идентификация активдүү эмес.
+federatedIdentityRemovingLastProviderMessage=Сиздин аккаунтуңузда купуясөз жок болгондуктан, акыркы федеративдик идентификацияны өчүрүүгө болбойт.
+federatedIdentityBoundOrganization=Уюмга байланышкан идентификация берүүчү шилтемени алып салууга болбойт.
+identityProviderRedirectErrorMessage=Идентификация берүүчүгө багыттоо ишке ашкан жок.
+identityProviderRemovedMessage=Идентификация берүүчү ийгиликтүү өчүрүлдү.
+identityProviderAlreadyLinkedMessage={0} тарабынан кайтарылган федеративдик идентификация башка колдонуучу менен байланышкан.
+staleCodeAccountMessage=Беттин мөөнөтү бүттү. Кайра аракет кылыңыз.
+consentDenied=Макулдук берилген жок.
+access-denied-when-idp-auth={0} менен кирүү учурунда жетүүгө тыюу салынды.
+
+accountDisabledMessage=Аккаунт өчүрүлгөн, администратор менен байланышыңыз.
+
+accountTemporarilyDisabledMessage=Аккаунт убактылуу өчүрүлгөн, администратор менен байланышыңыз же кийинчерээк кайра аракет кылыңыз.
+
+invalidPasswordMinLengthMessage=Жараксыз купуясөз: минималдуу узундугу {0}.
+invalidPasswordMaxLengthMessage=Жараксыз купуясөз: максималдуу узундугу {0}.
+invalidPasswordMinLowerCaseCharsMessage=Жараксыз купуясөз: кеминде {0} кичине тамга камтышы керек.
+invalidPasswordMinDigitsMessage=Жараксыз купуясөз: кеминде {0} сан камтышы керек.
+invalidPasswordMinUpperCaseCharsMessage=Жараксыз купуясөз: кеминде {0} баш тамга камтышы керек.
+invalidPasswordMinSpecialCharsMessage=Жараксыз купуясөз: кеминде {0} атайын символ камтышы керек.
+invalidPasswordNotUsernameMessage=Жараксыз купуясөз: колдонуучу атына барабар болбошу керек.
+invalidPasswordNotContainsUsernameMessage=Жараксыз купуясөз: колдонуучу атын камтыбашы керек.
+invalidPasswordNotEmailMessage=Жараксыз купуясөз: электрондук почта дарегине барабар болбошу керек.
+invalidPasswordRegexPatternMessage=Жараксыз купуясөз: талап кылынган үлгүгө дал келбейт.
+invalidPasswordHistoryMessage=Жараксыз купуясөз: акыркы {0} купуясөздүн бирине барабар болбошу керек.
+invalidPasswordBlacklistedMessage=Жараксыз купуясөз: бул купуясөз тыюу салынган.
+invalidPasswordGenericMessage=Жараксыз купуясөз: жаңы купуясөз саясатына туура келбейт.
+
+# Авторизация
+myResources=Менин ресурстарым
+myResourcesSub=Менин ресурстарым
+doDeny=Тыйуу салуу
+doRevoke=Жокко чыгаруу
+doApprove=Бекитүү
+doRemoveSharing=Бөлүшүүнү алып салуу
+doRemoveRequest=Сурамды алып салуу
+peopleAccessResource=Бул ресурска жеткиликтүү адамдар
+resourceManagedPolicies=Бул ресурска жеткиликтүү уруксаттар
+resourceNoPermissionsGrantingAccess=Бул ресурска уруксат берилген эмес
+anyAction=Каалаган аракет
+description=Сүрөттөмө
+name=Аты
+scopes=Областтар
+resource=Ресурс
+user=Колдонуучу
+peopleSharingThisResource=Бул ресурсту бөлүшүп жаткан адамдар
+shareWithOthers=Башкалар менен бөлүшүү
+needMyApproval=Менин макулдугум талап кылынат
+requestsWaitingApproval=Макулдукту күтүп жаткан сурамдар
+icon=Иконка
+requestor=Сураган адам
+owner=Ээси
+resourcesSharedWithMe=Мен менен бөлүшүлгөн ресурстар
+permissionRequestion=Уруксат суралган
+permission=Уруксат
+shares=бөлүшүүлөр
+notBeingShared=Бул ресурс бөлүшүлүп жаткан жок.
+notHaveAnyResource=Сизде эч кандай ресурс жок
+noResourcesSharedWithYou=Сиз менен бөлүшүлгөн ресурстар жок
+havePermissionRequestsWaitingForApproval=Макулдукту күтүп жаткан {0} уруксат сурамыңыз бар.
+clickHereForDetails=Толук маалымат үчүн бул жерди басыңыз.
+resourceIsNotBeingShared=Бул ресурс бөлүшүлүп жаткан жок
+
+# Applications
+applicationName=Аты
+applicationType=Тиркеменин түрү
+applicationInUse=Тек гана колдонулуп жаткан тиркемелер
+clearAllFilter=Бардык чыпкаларды тазалоо
+activeFilters=Активдүү чыпкалар
+filterByName=Аты боюнча чыпкалоо ...
+allApps=Бардык тиркемелер
+internalApps=Ички тиркемелер
+thirdpartyApps=Үчүнчү тараптын тиркемелери
+appResults=Натыйжалар
+clientNotFoundMessage=Клиент табылган жок.
+
+# Linked account
+authorizedProvider=Уруксат берилген камсыздоочу
+authorizedProviderMessage=Аккаунтуңуз менен байланышкан уруксат берилген камсыздоочулар
+identityProvider=Идентификация камсыздоочусу
+identityProviderMessage=Идентификация камсыздоочулар менен аккаунтуңузду байланыштыруу үчүн
+socialLogin=Социалдык кирүү
+userDefined=Колдонуучу тарабынан аныкталган
+removeAccess=Кирүү мүмкүнчүлүгүн алып салуу
+removeAccessMessage=Бул тиркемени кайра колдонуу үчүн кирүүгө кайра уруксат беришиңиз керек болот.
+
+# Authenticator
+authenticatorStatusMessage=Эки факторлуу текшерүү азыркы учурда
+authenticatorFinishSetUpTitle=Сиздин эки факторлуу текшерүү
+authenticatorFinishSetUpMessage=Keycloak аккаунтуңузга кирген сайын, эки факторлуу кодду киргизүү талап кылынат.
+authenticatorSubTitle=Эки факторлуу текшерүүнү орнотуу
+authenticatorSubMessage=Аккаунтуңуздун коопсуздугун жогорулатуу үчүн жеткиликтүү эки факторлуу ыкмалардын кеминде бирин иштетиңиз.
+authenticatorMobileTitle=Мобилдик аутентификатор
+authenticatorMobileMessage=Эки факторлуу текшерүү үчүн мобилдик аутентификаторду колдонуп код алыңыз.
+authenticatorMobileFinishSetUpMessage=Аутентификатор телефонуңузга байланыштырылды.
+authenticatorActionSetup=Орнотуу
+authenticatorSMSTitle=SMS коду
+authenticatorSMSMessage=Keycloak эки факторлуу текшерүү үчүн телефонуңузга код жөнөтөт.
+authenticatorSMSFinishSetUpMessage=Тексттик билдирүүлөр жөнөтүлөт
+authenticatorDefaultStatus=Демейки
+authenticatorChangePhone=Телефон номерин өзгөртүү
+
+# Authenticator - Mobile Authenticator setup
+authenticatorMobileSetupTitle=Мобилдик аутентификатор орнотуу
+smscodeIntroMessage=Телефон номериңизди киргизиңиз, андан кийин сизге текшерүү коду жөнөтүлөт.
+mobileSetupStep1=Телефонуңузга аутентификатор тиркемесин орнотуңуз. Төмөнкү тиркемелер колдоого алынат.
+mobileSetupStep2=Тиркемени ачып, штрихкодду сканердеңиз:
+mobileSetupStep3=Бир жолу колдонулуучу кодду киргизип, орнотууну бүтүрүү үчүн Сактоо баскычын басыңыз.
+scanBarCode=Штрихкодду сканерлегиңиз келеби?
+enterBarCode=Бир жолку кодду киргизүү
+doCopy=Көчүрүү
+doFinish=Бүттү
+
+# Authenticator - SMS Code setup
+authenticatorSMSCodeSetupTitle=SMS коду орнотуу
+chooseYourCountry=Өлкөңүздү тандаңыз
+enterYourPhoneNumber=Телефон номериңизди киргизиңиз
+sendVerficationCode=Текшерүү кодун жөнөтүү
+enterYourVerficationCode=Текшерүү кодуңузду киргизиңиз
+
+# Authenticator - backup Code setup
+authenticatorBackupCodesSetupTitle=Калыбына келтирүү аутентификация коддорун орнотуу
+realmName=Реалм
+doDownload=Жүктөп алуу
+doPrint=Басып чыгаруу
+generateNewBackupCodes=Жаңы калыбына келтирүү коддорун түзүү
+backtoAuthenticatorPage=Аутентификатор бетине кайтуу
+
+# Resources
+resources=Ресурстар
+sharedwithMe=Мен менен бөлүшүлгөн
+share=Бөлүшүү
+sharedwith=Мына менен бөлүшүлгөн
+accessPermissions=Жеткиликтүүлүк уруксаттары
+permissionRequests=Уруксат сурамдары
+approve=Бекитүү
+approveAll=Бардыгын бекитүү
+people=адам(дар)
+perPage=бетине
+currentPage=Учурдагы бет
+sharetheResource=Ресурсту бөлүшүү
+group=Топ
+selectPermission=Уруксатты тандоо
+addPeople=Ресурсуңузду бөлүшүү үчүн адамдарды кошуңуз
+addTeam=Ресурсуңузду бөлүшүү үчүн топту кошуңуз
+myPermissions=Менин уруксаттарым
+waitingforApproval=Бекитүүнү күтүп жатат
+anyPermission=Каалаган уруксат
+
+# Openshift messages
+openshift.scope.user_info=Колдонуучу маалыматы
+openshift.scope.user_check-access=Колдонуучунун жеткиликтүүлүгү
+openshift.scope.user_full=Толук жеткиликтүүлүк
+openshift.scope.list-projects=Долбоорлорду көрсөтүү
+
+# Errors (repeated for completeness)
+error-invalid-value=Жараксыз мааниси.
+error-invalid-blank=Маанини көрсөтүңүз.
+error-empty=Маанини көрсөтүңүз.
+error-invalid-length={0} атрибутунун узундугу {1} жана {2} ортосунда болушу керек.
+error-invalid-length-too-short={0} атрибутунун минималдуу узундугу {1}.
+error-invalid-length-too-long={0} атрибутунун максималдуу узундугу {2}.
+error-invalid-email=Жараксыз электрондук почта дареги.
+error-invalid-number=Жараксыз сан.
+error-number-out-of-range={0} атрибуту {1} жана {2} ортосундагы сан болушу керек.
+error-number-out-of-range-too-small={0} атрибутунун минималдуу мааниси {1}.
+error-number-out-of-range-too-big={0} атрибутунун максималдуу мааниси {2}.
+error-pattern-no-match=Жараксыз мааниси.
+error-invalid-uri=Жараксыз URL.
+error-invalid-uri-scheme=Жараксыз URL схемасы.
+error-invalid-uri-fragment=Жараксыз URL фрагменти.
+error-user-attribute-required={0} атрибутун көрсөтүңүз.
+error-invalid-date=Жараксыз дата.
+error-user-attribute-read-only={0} талаасы окуу үчүн гана.
+error-username-invalid-character=Колдонуучу атында жараксыз символ бар.
+error-person-name-invalid-character=Атта жараксыз символ бар.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties
index 65b8dafab785..e1a97b7d060b 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties
@@ -98,7 +98,7 @@ revoke=Atšaukti įgaliojimą
 
 configureAuthenticators=Sukonfigūruotas autentifikatorius
 mobile=Mobilus
-totpStep1=Įdiekite <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> arba Google Authenticator savo įrenginyje. Programėlės prieinamos <a href="https://play.google.com">Google Play</a> ir Apple App Store.
+totpStep1=Installa una delle seguenti applicazioni sul tuo cellulare:
 totpStep2=Atidarykite programėlę ir nuskenuokite barkodą arba įveskite kodą.
 totpStep3=Įveskite programėlėje sugeneruotą vieną kartą galiojantį kodą ir paspauskite Saugoti norėdami prisijungti.
 
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_nl.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_nl.properties
index 0a06f9f017f1..774b1ce52c1d 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_nl.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_nl.properties
@@ -124,9 +124,9 @@ offlineToken=Offline token
 revoke=Vergunning intrekken
 configureAuthenticators=Ingestelde authenticators
 mobile=Mobiel
-totpStep1=Installeer een van de volgende applicaties op je mobiele apparaat:
-totpStep2=Open de applicatie en scan de barcode:
-totpStep3=Voer de eenmalige code in – gegenereerd door de applicatie – en tik op 'Opslaan' om de installatie te voltooien.
+totpStep1=Installeer een van de volgende apps op je mobiel:
+totpStep2=Open de app en scan de barcode:
+totpStep3=Voer de eenmalige code in – gegenereerd door de app – en tik op ''Opslaan'' om de installatie te voltooien.
 totpStep3DeviceName=Geef je apparaat een naam om je OTP-apparaten overzichtelijk te houden.
 totpManualStep2=Open de applicatie en voer de sleutel in:
 totpManualStep3=Gebruik de volgende configuratiewaarden als de applicatie deze instellingen toestaat:
@@ -146,7 +146,7 @@ irreversibleAction=Deze actie is onomkeerbaar
 deletingImplies=Het verwijderen van je account houdt in:
 errasingData=Al uw gegevens wissen
 loggingOutImmediately=Meteen uitloggen
-accountUnusable=Dit account kan niet meer gebruikt worden voor gebruik in de applicatie
+accountUnusable=Dit account kan niet meer gebruikt worden in de applicatie
 missingUsernameMessage=Gebruikersnaam ontbreekt.
 missingFirstNameMessage=Voornaam ontbreekt.
 invalidEmailMessage=Ongeldig e-mailadres.
@@ -164,8 +164,8 @@ invalidTotpMessage=Ongeldige authenticatiecode.
 usernameExistsMessage=Gebruikersnaam al in gebruik.
 emailExistsMessage=E-mailadres al in gebruik.
 readOnlyUserMessage=Je kunt je account niet bijwerken omdat deze read-only is.
-readOnlyUsernameMessage=U kunt uw gebruikersnaam niet wijzigen omdat uw account alleen-lezen is.
-readOnlyPasswordMessage=U kunt uw wachtwoord niet wijzigen omdat uw account alleen-lezen is.
+readOnlyUsernameMessage=U kunt uw gebruikersnaam niet wijzigen omdat uw account read-only is.
+readOnlyPasswordMessage=U kunt uw wachtwoord niet wijzigen omdat uw account read-only is.
 successTotpMessage=Mobiele authenticatie geconfigureerd.
 successTotpRemovedMessage=Mobiele authenticator verwijderd.
 successGrantRevokedMessage=Toestemming succesvol ingetrokken.
@@ -220,7 +220,7 @@ owner=Eigenaar
 resourcesSharedWithMe=Bronnen die met mij gedeeld zijn
 permissionRequestion=Toestemmingsverzoek
 permission=Toestemming
-shares=aandelen
+shares=Gedeeld met
 notBeingShared=Deze bron wordt niet gedeeld.
 notHaveAnyResource=U heeft geen bronnen
 noResourcesSharedWithYou=Er zijn geen bronnen met u gedeeld
@@ -345,7 +345,7 @@ federatedIdentityBoundOrganization=Koppeling met een organisatiegebonden identit
 accountManagementBaseThemeCannotBeUsedDirectly=Het basis account-thema heeft alleen vertalingen voor de accountconsole. Voor het weergeven van de accountconsole moet je of het hoofdthema van je thema instellen op een ander account-thema, of je eigen index.ftl bestand toevoegen. Bekijk de documentatie voor meer info.
 currentPassword=Huidig wachtwoord
 personalInfoHtmlTitle=Persoonlijke info
-deviceActivityHtmlTitle=Activiteit apparaat
+deviceActivityHtmlTitle=Apparaat activiteit
 linkedAccountsHtmlTitle=Gekoppelde accounts
 device-activity=Apparaat activiteit
 availableRoles=Beschikbare rollen
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_pl.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_pl.properties
index 0f1ea034d5a5..da718a77a63d 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_pl.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_pl.properties
@@ -27,6 +27,9 @@ applicationsHtmlTitle=Aplikacje
 linkedAccountsHtmlTitle=Połączone konta
 
 accountManagementWelcomeMessage=Witamy w zarządzaniu kontem
+accountManagementBaseThemeCannotBeUsedDirectly=Podstawowy motyw konta zawiera jedynie tłumaczenia dla konsoli konta. \
+    Aby wyświetlić konsolę konta, musisz ustawić nadrzędny motyw swojego motywu na inny motyw konta lub dostarczyć własny plik index.ftl. \
+    Zobacz dokumentację, aby uzyskać więcej informacji.
 personalInfoIntroMessage=Zarządzaj informacjami podstawowymi o sobie
 accountSecurityTitle=Bezpieczeństwo Konta
 accountSecurityIntroMessage=Kontroluj swoje hasło i dostęp
@@ -73,9 +76,10 @@ phoneScopeConsentText=Telefon
 offlineAccessScopeConsentText=Dostęp offline
 samlRoleListScopeConsentText=Moje role
 rolesScopeConsentText=Role użytkownika
+organizationScopeConsentText=Organizacja
 
 role_admin=Admin
-role_realm-admin=Strefa Admin
+role_realm-admin=Admin strefy
 role_create-realm=Utwórz strefę
 role_view-realm=Przeglądaj strefy
 role_view-users=Przeglądaj użytkowników
@@ -209,6 +213,7 @@ invalidFederatedIdentityActionMessage=Nieprawidłowa akcja.
 identityProviderNotFoundMessage=Podany dostawca tożsamości nie istnieje.
 federatedIdentityLinkNotActiveMessage=Podana tożsamość nie jest już aktywna.
 federatedIdentityRemovingLastProviderMessage=Nie można usunąć ostatniej połączonej tożsamości, jeżeli nie ustawiłeś hasła.
+federatedIdentityBoundOrganization=Nie możesz usunąć połączenia z dostawcą tożsamości powiązanego z organizacją.
 identityProviderRedirectErrorMessage=Nieudane przekierowanie do zewnętrznego dostawcy tożsamości.
 identityProviderRemovedMessage=Dostawca tożsamości został usunięty.
 identityProviderAlreadyLinkedMessage=Połączona tożsamość {0} jest już przypisana do innego użytkownika.
@@ -225,7 +230,8 @@ invalidPasswordMinLowerCaseCharsMessage=Nieprawidłowe hasło: brak małych lite
 invalidPasswordMinDigitsMessage=Nieprawidłowe hasło: brak cyfr (co najmniej {0}).
 invalidPasswordMinUpperCaseCharsMessage=Nieprawidłowe hasło: brak dużych liter (co najmniej {0}).
 invalidPasswordMinSpecialCharsMessage=Nieprawidłowe hasło: brak znaków specjalnych (co najmniej {0}).
-invalidPasswordNotUsernameMessage=Nieprawidłowe hasło: nie może być zgodne z nazwą użytkownika.
+invalidPasswordNotUsernameMessage=Nieprawidłowe hasło: nie może być takie samo jak nazwa użytkownika.
+invalidPasswordNotContainsUsernameMessage=Nieprawidłowe hasło: nie może zawierać nazwy użytkownika.
 invalidPasswordNotEmailMessage=Nieprawidłowe hasło: nie może być zgodne z adresem email.
 invalidPasswordRegexPatternMessage=Nieprawidłowe hasło: nie spełnia przyjętych reguł.
 invalidPasswordHistoryMessage=Nieprawidłowe hasło: jest identyczne jak jedno z ostatnich ({0}) haseł.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_pt_BR.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_pt_BR.properties
index c53c59640c87..3a9fa869fb6f 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_pt_BR.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_pt_BR.properties
@@ -1,7 +1,7 @@
 doSave=Salvar
 doCancel=Cancelar
 doLogOutAllSessions=Sair de todas as sessões
-doRemove=Remover
+doRemove=Excluir
 doAdd=Adicionar
 doSignOut=Sair
 doLogIn=Entrar
@@ -14,28 +14,26 @@ personalInfoHtmlTitle=Informações Pessoais
 federatedIdentitiesHtmlTitle=Identidades Federadas
 accountLogHtmlTitle=Histórico da conta
 changePasswordHtmlTitle=Alterar senha
-deviceActivityHtmlTitle=Atividade de Dispositivos
+deviceActivityHtmlTitle=Atividade do Dispositivo
 sessionsHtmlTitle=Sessões
 accountManagementTitle=Gerenciamento de Conta
-authenticatorTitle=Autenticator
+authenticatorTitle=Autenticador
 applicationsHtmlTitle=Aplicativos
-linkedAccountsHtmlTitle=Contas Vinculadas
-
+linkedAccountsHtmlTitle=Contas vinculadas
 accountManagementWelcomeMessage=Bem-vindo ao Gerenciamento de Conta
-personalInfoIntroMessage=Gerenciar informações básicas
+personalInfoIntroMessage=Gerencie suas informações básicas
 accountSecurityTitle=Segurança da Conta
 accountSecurityIntroMessage=Gerencie sua senha e acesso da conta
 applicationsIntroMessage=Acompanhe e gerencie as permissões de app para acesso à sua conta
-resourceIntroMessage=Compartilhe seus recursos com membros de equipe
+resourceIntroMessage=Compartilhe seus recursos com membros da equipe
 passwordLastUpdateMessage=Sua senha foi atualizada em
 updatePasswordTitle=Atualizar Senha
 updatePasswordMessageTitle=Certifique-se de que a nova senha é segura
 updatePasswordMessage=Uma senha segura contém uma combinação de número, letras e caracteres especiais. Ela deve ser difícil de adivinhar, não pode se assemelhar a uma palavra real e não é utilizada em outros lugares.
 personalSubTitle=Suas Informações Pessoais
-personalSubMessage=Gerencie as informações básicas: seu primeiro nome, seu sobrenome e seu endereço de e-mail
-
-authenticatorCode=Código autenticador
-email=E-mail
+personalSubMessage=Gerencie as informações básicas.
+authenticatorCode=Código de uso único
+email=Email
 firstName=Primeiro nome
 givenName=Primeiro nome
 fullName=Nome completo
@@ -52,34 +50,32 @@ locality=Cidade ou Localidade
 region=Estado
 postal_code=CEP
 country=País
-emailVerified=E-mail verificado
+emailVerified=Email verificado
 website=Página da web
 phoneNumber=Número de telefone
 phoneNumberVerified=Número de telefone verificado
 gender=Gênero
 birthday=Data de nascimento
-zoneinfo=Zona horária
+zoneinfo=Fuso horário
 gssDelegationCredential=Delegação de Credenciais GSS
-
 profileScopeConsentText=Perfil de usuário
-emailScopeConsentText=Endereço de e-mail
+emailScopeConsentText=Endereço de email
 addressScopeConsentText=Endereço
 phoneScopeConsentText=Número de telefone
 offlineAccessScopeConsentText=Acesso Offline
-samlRoleListScopeConsentText=Meus Perfis de Acesso
-rolesScopeConsentText=Perfis de acesso de usuário
-
+samlRoleListScopeConsentText=Meus Papéis
+rolesScopeConsentText=Papéis de usuário
 role_admin=Administrador
-role_realm-admin=Administrador de domínio
-role_create-realm=Criar domínio
-role_view-realm=Visualizar domínio
+role_realm-admin=Administrador do realm
+role_create-realm=Criar realm
+role_view-realm=Visualizar realm
 role_view-users=Visualizar usuários
 role_view-applications=Visualizar aplicativos
 role_view-clients=Visualizar clientes
 role_view-events=Visualizar eventos
 role_view-identity-providers=Visualizar provedores de identidade
 role_view-consent=Visualizar consentimentos
-role_manage-realm=Gerenciar domínio
+role_manage-realm=Gerenciar realm
 role_manage-users=Gerenciar usuários
 role_manage-applications=Gerenciar aplicativos
 role_manage-identity-providers=Gerenciar provedores de identidade
@@ -96,36 +92,32 @@ client_account=Conta
 client_account-console=Console de Conta
 client_security-admin-console=Console de Administração de Segurança
 client_admin-cli=CLI de Administração
-client_realm-management=Gerenciamento de Domínio
-client_broker=Provedor de Identidade
+client_realm-management=Gerenciamento do Realm
+client_broker=Intermediário
 
 
 requiredFields=Campos obrigatórios
 allFieldsRequired=Todos os campos são obrigatórios
-
 backToApplication=&laquo; Voltar para aplicação
 backTo=Voltar para {0}
-
 date=Data
 event=Evento
 ip=IP
 client=Cliente
 clients=Clientes
 details=Detalhes
-started=Início em
+started=Iniciado
 lastAccess=Último acesso
 expires=Expira em
 applications=Aplicativos
-
 account=Conta
 federatedIdentity=Identidade Federada
 authenticator=Autenticador
-device-activity=Atividade de Dispositivos
+device-activity=Atividade de dispositivos
 sessions=Sessões
 log=Histórico
-
 application=Aplicativo
-availableRoles=Perfis de Acesso Disponíveis
+availableRoles=Papéis Disponíveis
 grantedPermissions=Permissões Concedidas
 grantedPersonalInfo=Informações Pessoais Concedidas
 additionalGrants=Concessões Adicionais
@@ -134,90 +126,75 @@ inResource=em
 fullAccess=Acesso Completo
 offlineToken=Token Offline
 revoke=Revogar Concessão
-
 configureAuthenticators=Autenticadores Configurados
 mobile=Móvel
 totpStep1=Instale uma das seguintes aplicações no seu celular:
 totpStep2=Abra a aplicação e escaneie o código QR:
 totpStep3=Insira o código de uso único exibido pela aplicação e clique em Salvar para finalizar a configuração.
 totpStep3DeviceName=Forneça um nome de dispositivo para ajudá-lo a gerenciar seus dipositivos de autenticação de dois fatores.
-
 totpManualStep2=Abra a aplicação e insira a chave:
 totpManualStep3=Use as seguintes configurações se a aplicação permitir:
 totpUnableToScan=Não consegue escanear?
 totpScanBarcode=Escanear código QR?
-
 totp.totp=Baseada em tempo
 totp.hotp=Baseada em contador
-
 totpType=Tipo
 totpAlgorithm=Algoritmo
 totpDigits=Dígitos
 totpInterval=Intervalo
 totpCounter=Contador
 totpDeviceName=Nome do Dispositivo
-
 irreversibleAction=Esta ação é irreversível
 deletingImplies=Apagar a sua conta implica em:
 errasingData=Remover todos os dados
 loggingOutImmediately=Finalizar a sessão imediatamente
 accountUnusable=Qualquer uso subsquente da aplicação não será mais possível com esta conta
-
 missingUsernameMessage=Por favor, especifique o nome de usuário.
 missingFirstNameMessage=Por favor, informe o primeiro nome.
-invalidEmailMessage=E-mail inválido.
+invalidEmailMessage=Email inválido.
 missingLastNameMessage=Por favor, informe o sobrenome.
-missingEmailMessage=Por favor, informe o e-mail.
+missingEmailMessage=Por favor, informe o email.
 missingPasswordMessage=Por favor, informe a senha.
 notMatchPasswordMessage=As senhas não coincidem.
 invalidUserMessage=Usuário inválido
 updateReadOnlyAttributesRejectedMessage=Atualização de atributo de apenas leitura não permitida
-
 missingTotpMessage=Por favor, informe o código de uso único.
 missingTotpDeviceNameMessage=Por favor, informe o nome do dispositivo.
 invalidPasswordExistingMessage=A senha atual é inválida.
 invalidPasswordConfirmMessage=A senha de confirmação não coincide.
 invalidTotpMessage=Código de uso único inválido.
-
 usernameExistsMessage=Este nome de usuário já existe.
-emailExistsMessage=Este endereço de e-mail já existe.
-
-readOnlyUserMessage=Você não pode atualizar sua conta, uma vez que é apenas de leitura.
-readOnlyUsernameMessage=Você não pode atualizar o seu nome de usuário, uma vez que é apenas de leitura.
-readOnlyPasswordMessage=Você não pode atualizar sua senha, uma vez que sua conta é apenas de leitura.
-
+emailExistsMessage=Este endereço de email já existe.
+readOnlyUserMessage=Você não pode atualizar sua conta, pois ela é somente leitura.
+readOnlyUsernameMessage=Você não pode atualizar o seu nome de usuário, pois ele é somente leitura.
+readOnlyPasswordMessage=Você não pode atualizar sua senha, pois ela é somente leitura.
 successTotpMessage=Autenticador móvel configurado.
 successTotpRemovedMessage=Autenticador móvel removido.
-
 successGrantRevokedMessage=Concessão revogada com sucesso.
-
 accountUpdatedMessage=Sua conta foi atualizada.
 accountPasswordUpdatedMessage=Sua senha foi atualizada.
-
 missingIdentityProviderMessage=Provedor de identidade não especificado.
 invalidFederatedIdentityActionMessage=Ação inválida ou ausente.
 identityProviderNotFoundMessage=O provedor de identidade especificado não foi encontrado.
-federatedIdentityLinkNotActiveMessage=Esta identidade não está mais em atividade.
-federatedIdentityRemovingLastProviderMessage=Você não pode remover a última identidade federada, porque você não tem uma senha.
+federatedIdentityLinkNotActiveMessage=Esta identidade não está mais ativa.
+federatedIdentityRemovingLastProviderMessage=Você não pode remover a última identidade federada, pois você não tem uma senha.
 identityProviderRedirectErrorMessage=Falha ao redirecionar para o provedor de identidade.
 identityProviderRemovedMessage=Provedor de identidade removido com sucesso.
 identityProviderAlreadyLinkedMessage=Identidade federada retornada por {0} já está ligada a outro usuário.
 staleCodeAccountMessage=A página expirou. Por favor, tente novamente.
 consentDenied=Consentimento negado.
-
 accountDisabledMessage=Conta desativada, por favor, contate um administrador.
-
-accountTemporarilyDisabledMessage=A conta está temporariamente indisponível, contate um administrador ou tente novamente mais tarde.
-invalidPasswordMinLengthMessage=Senha inválida\: deve ter pelo menos {0} caracteres.
-invalidPasswordMinLowerCaseCharsMessage=Senha inválida\: deve conter pelo menos {0} letra(s) minúscula(s).
-invalidPasswordMinDigitsMessage=Senha inválida\: deve conter pelo menos {0} número(s).
-invalidPasswordMinUpperCaseCharsMessage=Senha inválida\: deve conter pelo menos {0} letra(s) maiúscula(s).
-invalidPasswordMinSpecialCharsMessage=Senha inválida\: deve conter pelo menos {0} caractere(s) especial(is).
-invalidPasswordNotUsernameMessage=Senha inválida\: não pode ser igual ao nome de usuário.
-invalidPasswordNotContainsUsernameMessage=Senha inválida\: não pode conter o nome de usuário.
-invalidPasswordNotEmailMessage=Senha inválida: não pode ser igual ao endereço de e-mail.
-invalidPasswordRegexPatternMessage=Senha inválida\: não corresponde ao(s) padrão(ões) da expressão regular.
-invalidPasswordHistoryMessage=Senha inválida\: não pode ser igual a qualquer uma da(s) última(s) {0} senha(s).
+accountTemporarilyDisabledMessage=A conta está temporariamente desativada, contate um administrador ou tente novamente mais tarde.
+invalidPasswordMinLengthMessage=Senha inválida: tamanho mínimo {0}.
+invalidPasswordMinLowerCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) minúscula(s).
+invalidPasswordMinDigitsMessage=Senha inválida: deve conter pelo menos {0} número(s).
+invalidPasswordMinUpperCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) maiúscula(s).
+invalidPasswordMinSpecialCharsMessage=Senha inválida: deve conter pelo menos {0} caractere(s) especial(is).
+invalidPasswordNotUsernameMessage=Senha inválida: não pode ser igual ao nome de usuário.
+invalidPasswordNotContainsUsernameMessage=Senha inválida: não pode conter o nome de usuário.
+invalidPasswordNotEmailMessage=Senha inválida: não pode ser igual ao email.
+invalidPasswordRegexPatternMessage=Senha inválida: não corresponde ao(s) padrão(ões) de expressão regular.
+invalidPasswordHistoryMessage=Senha inválida: não pode ser igual a nenhuma da(s) última(s) {0} senha(s).
 invalidPasswordBlacklistedMessage=Senha inválida: esta senha está na lista de exclusão.
 invalidPasswordGenericMessage=Senha inválida: a nova senha não cumpre as políticas de senha.
 
@@ -235,7 +212,7 @@ resourceNoPermissionsGrantingAccess=Sem permissões dando acesso a este recurso
 anyAction=Qualquer ação
 description=Descrição
 name=Nome
-scopes=Escopo
+scopes=Escopos
 resource=Recurso
 user=Usuário
 peopleSharingThisResource=Pessoas compartilhando este recurso
@@ -244,7 +221,7 @@ needMyApproval=Requer minha aprovação
 requestsWaitingApproval=Solicitações suas aguardando aprovação
 icon=Ícone
 requestor=Requerente
-owner=Dono
+owner=Proprietário
 resourcesSharedWithMe=Recursos compartilhados comigo
 permissionRequestion=Solicitação de Permissão
 permission=Permissão
@@ -259,7 +236,7 @@ resourceIsNotBeingShared=O recurso não é compartilhado
 # Applications
 applicationName=Nome
 applicationType=Tipo de aplicação
-applicationInUse=Uso apenas em aplicação
+applicationInUse=Apenas aplicativo em uso
 clearAllFilter=Limpar todos os filtros
 activeFilters=Filtros ativos
 filterByName=Filtrar Por Nome ...
@@ -277,12 +254,12 @@ identityProviderMessage=Para vincular a sua conta aos provedores de identidade c
 socialLogin=Login Social
 userDefined=Definido por Usuário
 removeAccess=Remover Acesso
-removeAccessMessage=Você deverá conceder acesso novamente se quiser usar esta conta de app.
+removeAccessMessage=Você deverá conceder acesso novamente se quiser usar esta conta de aplicativo.
 
 #Authenticator
 authenticatorStatusMessage=A autenticação de dois fatores está
 authenticatorFinishSetUpTitle=Sua Autenticação de Dois Fatores
-authenticatorFinishSetUpMessage=Sempre que entrar na sua conta, você deverá fornecer um código de autenticação de dois fatores.
+authenticatorFinishSetUpMessage=Cada vez que você fizer login na sua conta Keycloak, será solicitado que forneça um código de autenticação de dois fatores.
 authenticatorSubTitle=Configurar Autenticação de Dois Fatores
 authenticatorSubMessage=Para aumentar a segurança da sua conta, habilite pelo menos um método de autenticação de dois fatores disponível.
 authenticatorMobileTitle=Autenticador Móvel
@@ -293,16 +270,16 @@ authenticatorSMSTitle=Código SMS
 authenticatorSMSMessage=A aplicação irá enviar o código de verificação para o seu celular como autenticação de dois fatores.
 authenticatorSMSFinishSetUpMessage=As mensagens de texto serão enviadas para
 authenticatorDefaultStatus=Padrão
-authenticatorChangePhone=Mudar Número de Celular
+authenticatorChangePhone=Mudar número de telefone
 
 #Authenticator - Mobile Authenticator setup
 authenticatorMobileSetupTitle=Configuração do Autenticador Móvel
-smscodeIntroMessage=Insira seu número de celular e o código de verificação será enviado para o seu dispositivo.
+smscodeIntroMessage=Insira seu número de telefone e um código de verificação será enviado para o seu dispositivo.
 mobileSetupStep1=Instale um app autenticador no seu celular. As seguintes aplicações são suportadas.
 mobileSetupStep2=Abra a aplicação e escaneie o código QR:
 mobileSetupStep3=Insira o código autenticador exibido pela aplicação e clique em Salvar para finalizar a configuração.
 scanBarCode=Escanear código QR?
-enterBarCode=Insira o código autenticador
+enterBarCode=Insira o código de uso único
 doCopy=Copiar
 doFinish=Finalizar
 
@@ -314,11 +291,11 @@ sendVerficationCode=Enviar Código de Verificação
 enterYourVerficationCode=Insira o seu código de verificação
 
 #Authenticator - backup Code setup
-authenticatorBackupCodesSetupTitle=Configuração de Códigos de Emergência
-realmName=Domínio
-doDownload=Baixar
+authenticatorBackupCodesSetupTitle=Configuração de Códigos de Autenticação para Recuperação
+realmName=Realm
+doDownload=Download
 doPrint=Imprimir
-generateNewBackupCodes=Gerar Novos Códigos de Emergência
+generateNewBackupCodes=Gerar Novos Códigos de Autenticação para Recuperação
 backtoAuthenticatorPage=Voltar à Página de Autenticador
 
 
@@ -334,11 +311,11 @@ approveAll=Aprovar todos
 people=pessoas
 perPage=por página
 currentPage=Página Atual
-sharetheResource=Compartilhar recurso
+sharetheResource=Compartilhar o recurso
 group=Grupo
 selectPermission=Selecionar Permissão
-addPeople=Adicionar pessoas que compartilhem o recurso
-addTeam=Adicionar equipe que compartilhe o recurso
+addPeople=Adicione pessoas para compartilhar seu recurso
+addTeam=Adicione equipe para compartilhar seu recurso
 myPermissions=Minhas Permissões
 waitingforApproval=Aguardando aprovação
 anyPermission=Qualquer Permissão
@@ -348,3 +325,37 @@ openshift.scope.user_info=Informações do usuário
 openshift.scope.user_check-access=Informações de acesso do usuário
 openshift.scope.user_full=Acesso Completo
 openshift.scope.list-projects=Listar projetos
+signingInSidebarTitle=Fazendo login
+deviceActivitySidebarTitle=Atividade do dispositivo
+accountManagementBaseThemeCannotBeUsedDirectly=O tema base da conta contém somente traduções para o painel da conta. Para exibir o painel da conta, você precisa definir o nível pai do seu tema para outro tema de conta, ou fornecer seu próprio arquivo index.ftl. Consulte a documentação para mais informações.
+totpAppGoogleName=Google Authenticator
+totpAppFreeOTPName=FreeOTP
+access-denied-when-idp-auth=Acesso negado ao autenticar com {0}
+invalidPasswordMaxLengthMessage=Senha inválida: tamanho máximo {0}.
+error-invalid-length-too-short=O atributo {0} deve ter comprimento mínimo de {1}.
+error-empty=Por favor, especifique um valor.
+error-invalid-length-too-long=O atributo {0} precisa ter um tamanho máximo de {2} caracteres.
+error-invalid-email=Endereço de email inválido.
+error-invalid-number=Número inválido.
+error-pattern-no-match=Valor inválido.
+error-number-out-of-range-too-small=O atributo {0} precisa ter um valor mínimo de {1}.
+error-number-out-of-range-too-big=O atributo {0} precisa ter um valor máximo de {2}.
+error-invalid-uri-scheme=Esquema da URL inválido.
+error-invalid-date=Data inválida.
+error-user-attribute-read-only=O campo {0} é somente leitura.
+error-username-invalid-character=O nome de usuário contém caracteres inválidos.
+error-user-attribute-required=Por favor, informe o atributo {0}.
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+organizationScopeConsentText=Organização
+role_view-groups=Visualizar grupos
+error-invalid-uri-fragment=Fragmento da URL inválido.
+personalInfoSidebarTitle=Informações pessoais
+accountSecuritySidebarTitle=Segurança da conta
+linkedAccountsSidebarTitle=Contas vinculadas
+error-invalid-value=Valor inválido.
+error-invalid-blank=Por favor, especifique um valor.
+error-number-out-of-range=O atributo {0} deve ser um número entre {1} e {2}.
+error-invalid-uri=URL inválida.
+error-person-name-invalid-character=O nome contém caracteres inválidos.
+federatedIdentityBoundOrganization=Você não pode remover o link para o provedor de identidade associado com uma organização.
+error-invalid-length=O atributo {0} precisa ter um tamanho entre {1} e {2} caracteres.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ro.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ro.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ro.properties
@@ -0,0 +1 @@
+
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_ru.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_ru.properties
index b24a4a8b2952..875257c3ea4c 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_ru.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_ru.properties
@@ -4,109 +4,47 @@ doLogOutAllSessions=Выйти из всех сессий
 doRemove=Удалить
 doAdd=Добавить
 doSignOut=Выход
-doSignIn=Вход
-update=Обновить
-remove=Удалить
-refreshPage=Обновить страницу
-refresh=Обновить
-pageNotFound=Страница не найдена
-invalidRoute={0} неправильный путь.
-continue=Продолжить
 doLogIn=Вход
-
-accountManagementWelcomeMessage=Добро пожаловать в консоль управления вашей учетной записью
-loadingMessage=Консоль управления учетной записью - загрузка ...
+doLink=Связь
+noAccessMessage=Доступ не разрешен
+personalInfoSidebarTitle=Личная информация
 accountSecuritySidebarTitle=Безопасность
-
+signingInSidebarTitle=Вход
+deviceActivitySidebarTitle=Активные устройства
+linkedAccountsSidebarTitle=Связанные аккаунты
 editAccountHtmlTitle=Изменение учетной записи
+personalInfoHtmlTitle=Личная информация
 federatedIdentitiesHtmlTitle=Федеративные идентификаторы
 accountLogHtmlTitle=Лог учетной записи
 changePasswordHtmlTitle=Смена пароля
+deviceActivityHtmlTitle=Активные устройства
 sessionsHtmlTitle=Сессии
 accountManagementTitle=Управление учетной записью
 authenticatorTitle=Аутентификатор
 applicationsHtmlTitle=Приложения
-applicationsIntroMessage=Отслеживайте и управляйте разрешениями приложений на доступ к вашей учетной записи
-accountSecurityIntroMessage=Изменение пароля и доступа к учетной записи
-
-# Personal info page
-personalInfoSidebarTitle=Личная информация
-personalInfoHtmlTitle=Личная информация
-personalSubMessage=Управление данными о себе
+linkedAccountsHtmlTitle=Связанные аккаунты
+accountManagementWelcomeMessage=Добро пожаловать в консоль управления вашей учетной записью
+accountManagementBaseThemeCannotBeUsedDirectly=Базовая тема аккаунта содержит только переводы для консоли аккаунта. Чтобы отобразить консоль учетной записи, вам необходимо либо установить родительскую тему вашей темы на другую тему учетной записи, либо предоставить собственный файл index.ftl. Более подробную информацию смотрите в документации.
 personalInfoIntroMessage=Управление данными о себе
-selectLocale=Выбор языка
-
-# Applications page
-applicationsPageTitle=Приложения
-applicationsSubMessage=Управляйте разрешениями ваших приложений
-applicationName=Имя
-applicationType=Тип приложения
-status=Статус
-client=Клиент
-internalApp=Внутренний
-thirdPartyApp=Внешний
-inUse=Используется
-notInUse=Не используется
-
-
-# Signing in page
-signingIn=Вход
-signingInSidebarTitle=Вход
-signingInSubMessage=Настройте варианты входа
-password-display-name=Пароль
-credentialCreatedAt=Создан
-basic-authentication=Базовая аутентификация
-password-help-text=Вход с использованием ввода пароля
-two-factor=Двухфакторная аутентификация
-otp-display-name=приложение аутентификатор
-otp-help-text=Ввод проверочного кода из приложения аутентификатора
-setUpNew=Настроить {0}
-removeCred=Удалить {0}
-stopUsingCred=Остановить использование {0}?
-successRemovedMessage={0} был удалён.
-notSetUp={0} не настроено.
-
-#Authenticator - Mobile Authenticator setup
-authenticatorMobileSetupTitle=Настройка мобильного приложения аутентификатора
-totpStep1=Установите одно из следующих приложений на ваш мобильный телефон:
-totpStep2=Откройте приложение и просканируйте QR-код:
-totpStep3=Введите одноразовый код, выданный приложением, и нажмите Подтвердить для завершения настройки.
-totpManualStep2=Откройте приложение и введите ключ:
-totpManualStep3=Используйте следующие настройки, если приложение позволяет их устанавливать:
-totpStep3DeviceName=Укажите имя устройства, которое поможет вам найти его в списке ваших устройств.
-totpUnableToScan=Не удается выполнить сканирование?
-totpScanBarcode=Сканировать QR-код?
+accountSecurityTitle=Безопасность аккаунта
+accountSecurityIntroMessage=Изменение пароля и доступа к учетной записи
+applicationsIntroMessage=Отслеживайте и управляйте разрешениями приложений на доступ к вашей учетной записи
+resourceIntroMessage=Поделитесь своими ресурсами между членами команды
+passwordLastUpdateMessage=Ваш пароль был обновлен
+updatePasswordTitle=Обновить пароль
+updatePasswordMessageTitle=Обязательно выберите надежный пароль
+updatePasswordMessage=Надежный пароль содержит смесь цифр, букв и символов. Его трудно угадать, он не похож на настоящее слово и используется только для этой учетной записи.
+personalSubTitle=Ваша личная информация
+personalSubMessage=Управление данными о себе.
 authenticatorCode=Одноразовый код
-totpDeviceName=Имя устройства
-totpType=Тип
-totpAlgorithm=Алгоритм
-totpDigits=Количество цифр
-totpInterval=Интервал
-totpCounter=Счетчик
-
-
-# Device activity page
-deviceActivitySidebarTitle=Активные устройства
-deviceActivityHtmlTitle=Активные устройства
-signedInDevicesExplanation=Выполните выход с незнакомых устройств
-signedInDevices=Выполнен вход на устройствах
-currentDevice=Текущее устройство
-currentSession=Текущая сессия
-lastAccessedOn=Последний доступ
-ipAddress=IP адрес
-device-activity=Активные устройства
-signOutWarning=Завершить сессию?
-signOutAllDevices=Выход на всех устройствах
-signOutAllDevicesWarning=Это действие приведет к выходу из системы всех устройств, которые вошли в вашу учетную запись, включая текущее устройство, которое вы используете.
-signedOutSession=Сессия завершена {0}/{1}
-
 email=E-mail
 firstName=Имя
 givenName=Имя
-fullName={0} {1}
+fullName=Фамилия Имя
 lastName=Фамилия
 familyName=Фамилия
 password=Пароль
+currentPassword=Текущий пароль
 passwordConfirm=Подтверждение пароля
 passwordNew=Новый пароль
 username=Имя пользователя
@@ -117,17 +55,32 @@ region=Регион
 postal_code=Почтовый индекс
 country=Страна
 emailVerified=E-mail подтвержден
+website=веб-сайт
+phoneNumber=Номер телефона
+phoneNumberVerified=Номер телефона проверен
+gender=Пол
+birthday=Дата рождения
+zoneinfo=Часовой пояс
 gssDelegationCredential=Делегирование учетных данных через GSS
-
+profileScopeConsentText=Профиль пользователя
+emailScopeConsentText=Адрес электронной почты
+addressScopeConsentText=Адрес
+phoneScopeConsentText=Номер телефона
+offlineAccessScopeConsentText=Оффлайн доступ
+samlRoleListScopeConsentText=Мои роли
+rolesScopeConsentText=Роли пользователей
+organizationScopeConsentText=Организация
 role_admin=Администратор
 role_realm-admin=Администратор realm
 role_create-realm=Создать realm
 role_view-realm=Просмотр realm
 role_view-users=Просмотр пользователей
 role_view-applications=Просмотр приложений
+role_view-groups=Просмотр групп
 role_view-clients=Просмотр клиентов
 role_view-events=Просмотр событий
 role_view-identity-providers=Просмотр провайдеров учетных записей
+role_view-consent=Просмотреть согласия
 role_manage-realm=Управление realm
 role_manage-users=Управление пользователями
 role_manage-applications=Управление приложениями
@@ -136,10 +89,13 @@ role_manage-clients=Управление клиентами
 role_manage-events=Управление событиями
 role_view-profile=Просмотр профиля
 role_manage-account=Управление учетной записью
+role_manage-account-links=Управление ссылками на аккаунты
+role_manage-consent=Управление согласиями
 role_read-token=Чтение токена
 role_offline-access=Доступ оффлайн
 role_uma_authorization=Получение разрешений
 client_account=Учетная запись
+client_account-console=Консоль аккаунта
 client_security-admin-console=Консоль администратора безопасности
 client_admin-cli=Командный интерфейс администратора
 client_realm-management=Управление Realm
@@ -148,10 +104,8 @@ client_broker=Брокер
 
 requiredFields=Обязательные поля
 allFieldsRequired=Все поля обязательны
-
 backToApplication=&laquo; Назад в приложение
 backTo=Назад в {0}
-
 date=Дата
 event=Событие
 ip=IP
@@ -162,15 +116,14 @@ started=Начата
 lastAccess=Последний доступ
 expires=Истекает
 applications=Приложения
-
 account=Учетная запись
 federatedIdentity=Федеративный идентификатор
 authenticator=Аутентификатор
+device-activity=Активные устройства
 sessions=Сессии
 log=Журнал
-
 application=Приложение
-availablePermissions=Доступные разрешения
+availableRoles=Доступные роли
 grantedPermissions=Согласованные разрешения
 grantedPersonalInfo=Согласованная персональная информация
 additionalGrants=Дополнительные согласования
@@ -179,8 +132,32 @@ inResource=в
 fullAccess=Полный доступ
 offlineToken=Оффлайн токен
 revoke=Отозвать согласование
-
-
+configureAuthenticators=Настроенные аутентификаторы
+mobile=Мобильный
+totpStep1=Установите одно из следующих приложений на ваш мобильный телефон:
+totpStep2=Откройте приложение и просканируйте QR-код:
+totpStep3=Введите одноразовый код, выданный приложением, и нажмите Подтвердить для завершения настройки.
+totpStep3DeviceName=Укажите имя устройства, которое поможет вам найти его в списке ваших устройств.
+totpManualStep2=Откройте приложение и введите ключ:
+totpManualStep3=Используйте следующие настройки, если приложение позволяет их устанавливать:
+totpUnableToScan=Не удается выполнить сканирование?
+totpScanBarcode=Сканировать QR-код?
+totp.totp=На основе времени
+totp.hotp=На основе счетчика
+totpType=Тип
+totpAlgorithm=Алгоритм
+totpDigits=Количество цифр
+totpInterval=Интервал
+totpCounter=Счетчик
+totpDeviceName=Имя устройства
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Аутентификатор
+totpAppMicrosoftAuthenticatorName=Microsoft Аутентификатор
+irreversibleAction=Это действие необратимо
+deletingImplies=Удаление вашего аккаунта подразумевает:
+errasingData=Удаление всех ваших данных
+loggingOutImmediately=Немедленный выход из системы
+accountUnusable=Любое последующее использование приложения с этой учетной записью будет невозможно
 missingUsernameMessage=Введите имя пользователя.
 missingFirstNameMessage=Введите имя.
 invalidEmailMessage=Введите корректный E-mail.
@@ -188,47 +165,195 @@ missingLastNameMessage=Введите фамилию.
 missingEmailMessage=Введите E-mail.
 missingPasswordMessage=Введите пароль.
 notMatchPasswordMessage=Пароли не совпадают.
-
+invalidUserMessage=Неверный пользователь
+updateReadOnlyAttributesRejectedMessage=Обновление атрибута "только для чтения" отклонено
 missingTotpMessage=Введите код аутентификатора.
+missingTotpDeviceNameMessage=Укажите название устройства.
 invalidPasswordExistingMessage=Существующий пароль неверный.
 invalidPasswordConfirmMessage=Подтверждение пароля не совпадает.
 invalidTotpMessage=Неверный код аутентификатора.
-
 usernameExistsMessage=Имя пользователя уже существует.
 emailExistsMessage=E-mail уже существует.
-
 readOnlyUserMessage=Вы не можете обновить информацию вашей учетной записи, т.к. она доступна только для чтения.
 readOnlyUsernameMessage=Вы не можете обновить имя пользователя вашей учетной записи, т.к. оно доступно только для чтения.
 readOnlyPasswordMessage=Вы не можете обновить пароль вашей учетной записи, т.к. он доступен только для чтения.
-
 successTotpMessage=Аутентификатор в мобильном приложении сконфигурирован.
 successTotpRemovedMessage=Аутентификатор в мобильном приложении удален.
-
 successGrantRevokedMessage=Согласование отозвано успешно.
-
 accountUpdatedMessage=Ваша учетная запись обновлена.
 accountPasswordUpdatedMessage=Ваш пароль обновлен.
-
 missingIdentityProviderMessage=Провайдер учетных записей не задан.
 invalidFederatedIdentityActionMessage=Некорректное или недопустимое действие.
 identityProviderNotFoundMessage=Заданный провайдер учетных записей не найден.
 federatedIdentityLinkNotActiveMessage=Идентификатор больше не активен.
 federatedIdentityRemovingLastProviderMessage=Вы не можете удалить последний федеративный идентификатор, т.к. Вы не имеете пароля.
+federatedIdentityBoundOrganization=Вы не можете удалить ссылку на поставщика удостоверений, связанную с организацией.
 identityProviderRedirectErrorMessage=Ошибка перенаправления в провайдер учетных записей.
 identityProviderRemovedMessage=Провайдер учетных записей успешно удален.
 identityProviderAlreadyLinkedMessage=Федеративный идентификатор, возвращенный {0} уже используется другим пользователем.
 staleCodeAccountMessage=Страница устарела. Попробуйте еще раз.
 consentDenied=В согласовании отказано.
-
+access-denied-when-idp-auth=Доступ запрещен при аутентификации с помощью {0}
 accountDisabledMessage=Учетная запись заблокирована, обратитесь к администратору.
-
 accountTemporarilyDisabledMessage=Учетная запись временно заблокирована, обратитесь к администратору или попробуйте позже.
 invalidPasswordMinLengthMessage=Некорректный пароль: длина пароля должна быть не менее {0} символа(ов).
+invalidPasswordMaxLengthMessage=Неверный пароль: максимальная длина {0}.
 invalidPasswordMinLowerCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символа(ов) в нижнем регистре.
 invalidPasswordMinDigitsMessage=Некорректный пароль: пароль должен содержать не менее {0} цифр(ы).
 invalidPasswordMinUpperCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символа(ов) в верхнем регистре.
 invalidPasswordMinSpecialCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} спецсимвола(ов).
 invalidPasswordNotUsernameMessage=Некорректный пароль: пароль не должен совпадать с именем пользователя.
+invalidPasswordNotContainsUsernameMessage=Неверный пароль: не может содержать имя пользователя.
+invalidPasswordNotEmailMessage=Неверный пароль: не должен совпадать с адресом электронной почты.
 invalidPasswordRegexPatternMessage=Некорректный пароль: пароль не удовлетворяет регулярному выражению.
 invalidPasswordHistoryMessage=Некорректный пароль: пароль не должен совпадать с последним(и) {0} паролями.
+invalidPasswordBlacklistedMessage=Неверный пароль: пароль занесен в черный список.
 invalidPasswordGenericMessage=Некорректный пароль: новый пароль не соответствует правилам пароля.
+
+# Authorization
+myResources=Мои ресурсы
+myResourcesSub=Мои ресурсы
+doDeny=Отклонить
+doRevoke=Отозвать
+doApprove=Одобрить
+doRemoveSharing=Удалить общий доступ
+doRemoveRequest=Удалить запрос
+peopleAccessResource=Люди, имеющие доступ к этому ресурсу
+resourceManagedPolicies=Разрешения, предоставляющие доступ к этому ресурсу
+resourceNoPermissionsGrantingAccess=Нет разрешений на доступ к этому ресурсу
+anyAction=Любое действие
+description=Описание
+name=Имя
+scopes=Области применения
+resource=Ресурс
+user=Пользователь
+peopleSharingThisResource=Люди, делящиеся этим ресурсом
+shareWithOthers=Поделиться с другими
+needMyApproval=Нужно мое одобрение
+requestsWaitingApproval=Ваши запросы ожидают одобрения
+icon=Иконка
+requestor=Запрашивающий
+owner=Владелец
+resourcesSharedWithMe=Ресурсы, которыми со мной поделились
+permissionRequestion=Запрос на разрешение
+permission=Разрешение
+shares=делитесь
+notBeingShared=Этот ресурс не будет предоставлен другим пользователям.
+notHaveAnyResource=У вас нет никаких ресурсов
+noResourcesSharedWithYou=Нет ресурсов, которыми вы поделились
+havePermissionRequestsWaitingForApproval=У вас есть {0} запросов на разрешения, ожидающих одобрения.
+clickHereForDetails=Нажмите здесь для получения подробной информации.
+resourceIsNotBeingShared=Ресурс не используется совместно
+
+# Applications
+applicationName=Имя
+applicationType=Тип приложения
+applicationInUse=Только используемое приложение
+clearAllFilter=Очистить все фильтры
+activeFilters=Активные фильтры
+filterByName=Фильтр по имени ...
+allApps=Все приложения
+internalApps=Внутренние приложения
+thirdpartyApps=Сторонние приложения
+appResults=Результаты
+clientNotFoundMessage=Клиент не найден.
+
+# Linked account
+authorizedProvider=Авторизованный поставщик
+authorizedProviderMessage=Авторизованные поставщики, связанные с вашей учетной записью
+identityProvider=Поставщик удостоверений
+identityProviderMessage=Чтобы связать свою учетную запись с поставщиками удостоверений, которые вы настроили
+socialLogin=Вход через соц. сети
+userDefined=Пользователь определен
+removeAccess=Удалить доступ
+removeAccessMessage=Если вы захотите использовать эту учетную запись приложения, вам придется снова предоставить доступ.
+
+#Authenticator
+authenticatorStatusMessage=Двухфакторная аутентификация в настоящее время
+authenticatorFinishSetUpTitle=Ваша двухфакторная аутентификация
+authenticatorFinishSetUpMessage=Каждый раз при входе в учетную запись Keycloak вам будет предложено ввести код двухфакторной аутентификации.
+authenticatorSubTitle=Настройте двухфакторную аутентификацию
+authenticatorSubMessage=Чтобы повысить безопасность вашей учетной записи, включите хотя бы один из доступных методов двухфакторной аутентификации.
+authenticatorMobileTitle=Мобильный аутентификатор
+authenticatorMobileMessage=Используйте мобильный аутентификатор для получения кодов подтверждения в качестве двухфакторной аутентификации.
+authenticatorMobileFinishSetUpMessage=Аутентификатор привязан к вашему телефону.
+authenticatorActionSetup=Настраивать
+authenticatorSMSTitle=СМС-код
+authenticatorSMSMessage=Keycloak отправит проверочный код на ваш телефон в качестве двухфакторной аутентификации.
+authenticatorSMSFinishSetUpMessage=Текстовые сообщения отправляются на
+authenticatorDefaultStatus=По умолчанию
+authenticatorChangePhone=Изменить номер телефона
+
+#Authenticator - Mobile Authenticator setup
+authenticatorMobileSetupTitle=Настройка мобильного приложения аутентификатора
+smscodeIntroMessage=Введите свой номер телефона, и на ваш телефон будет отправлен проверочный код.
+mobileSetupStep1=Установите приложение-аутентификатор на свой телефон. Поддерживаются перечисленные здесь приложения.
+mobileSetupStep2=Откройте приложение и отсканируйте штрих-код:
+mobileSetupStep3=Введите одноразовый код, предоставленный приложением, и нажмите "Сохранить", чтобы завершить настройку.
+scanBarCode=Хотите отсканировать штрих-код?
+enterBarCode=Введите одноразовый код
+doCopy=Копировать
+doFinish=Завершить
+
+#Authenticator - SMS Code setup
+authenticatorSMSCodeSetupTitle=Настройка СМС-кода
+chooseYourCountry=Выберите страну
+enterYourPhoneNumber=Введите ваш номер телефона
+sendVerficationCode=Отправить проверочный код
+enterYourVerficationCode=Введите ваш проверочный код
+
+#Authenticator - backup Code setup
+authenticatorBackupCodesSetupTitle=Настройка кодов аутентификации восстановления
+realmName=Realm
+doDownload=Скачать
+doPrint=Печать
+generateNewBackupCodes=Генерация новых кодов аутентификации восстановления
+backtoAuthenticatorPage=Вернуться на страницу аутентификатора
+
+
+#Resources
+resources=Ресурсы
+sharedwithMe=Поделился со мной
+share=Поделиться
+sharedwith=Поделился с
+accessPermissions=Разрешения на доступ
+permissionRequests=Запросы на разрешение
+approve=Одобрить
+approveAll=Одобрить все
+people=люди
+perPage=на страницу
+currentPage=Текущая страница
+sharetheResource=Поделиться ресурсом
+group=Группа
+selectPermission=Выберите разрешение
+addPeople=Добавьте людей, с которыми вы хотите поделиться своим ресурсом
+addTeam=Добавьте команду, с которой вы хотите поделиться своим ресурсом
+myPermissions=Мои разрешения
+waitingforApproval=Ожидание одобрения
+anyPermission=Любое разрешение
+
+# Openshift messages
+openshift.scope.user_info=Информация о пользователе
+openshift.scope.user_check-access=Информация о доступе пользователя
+openshift.scope.user_full=Полный доступ
+openshift.scope.list-projects=Список проектов
+error-invalid-value=Недопустимое значение.
+error-invalid-blank=Укажите значение.
+error-empty=Укажите значение.
+error-invalid-length=Атрибут {0} должен иметь длину от {1} до {2}.
+error-invalid-length-too-short=Атрибут {0} должен иметь минимальную длину {1}.
+error-invalid-length-too-long=Атрибут {0} должен иметь максимальную длину {2}.
+error-invalid-email=Неверный адрес электронной почты.
+error-invalid-number=Неверный номер.
+error-number-out-of-range=Атрибут {0} должен быть числом от {1} до {2}.
+error-number-out-of-range-too-small=Атрибут {0} должен иметь минимальное значение {1}.
+error-number-out-of-range-too-big=Атрибут {0} должен иметь максимальное значение {2}.
+error-pattern-no-match=Недопустимое значение.
+error-invalid-uri=Неверный URL-адрес.
+error-invalid-uri-scheme=Неверная схема URL.
+error-invalid-uri-fragment=Неверный фрагмент URL.
+error-user-attribute-required=Пожалуйста, укажите атрибут {0}.
+error-invalid-date=Неверная дата.
+error-user-attribute-read-only=Поле {0} доступно только для чтения.
+error-username-invalid-character=Имя пользователя содержит недопустимый символ.
+error-person-name-invalid-character=Имя содержит недопустимый символ.
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties
index 262623ac8c70..fd27282572b1 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties
@@ -98,7 +98,7 @@ revoke=Zrušiť oprávnenie
 
 configureAuthenticators=Nakonfigurované autentifikátory
 mobile=Mobilný
-totpStep1=Nainštalujte vo svojom zariadení <a href="https://freeotp.github.io/" target="_blank"> FreeOTP </a> alebo Google Authenticator. Obidve aplikácie sú k dispozícii v <a href="https://play.google.com"> Google Play </a> a Apple App Store.
+totpStep1=Nainštalujte si do mobilu jednu z nasledujúcich aplikácií:
 totpStep2=Otvorte aplikáciu a naskenujte čiarový kód alebo zadajte kľúč.
 totpStep3=Zadajte jednorazový kód poskytnutý aplikáciou a kliknutím na tlačidlo Uložiť dokončíte nastavenie.
 
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_sl.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_sl.properties
new file mode 100644
index 000000000000..40026b4038ef
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_sl.properties
@@ -0,0 +1,356 @@
+doSave=Shrani
+doCancel=Prekliči
+doLogOutAllSessions=Odjava iz vseh sej
+doRemove=Odstrani
+doAdd=Dodaj
+doSignOut=Odjava
+doLogIn=Prijava
+doLink=Poveži
+noAccessMessage=Dostop ni dovoljen
+personalInfoSidebarTitle=Osebni podatki
+accountSecuritySidebarTitle=Varnost računa
+signingInSidebarTitle=Prijavljanje
+deviceActivitySidebarTitle=Aktivnost naprav
+linkedAccountsSidebarTitle=Povezani računi
+editAccountHtmlTitle=Uredi račun
+personalInfoHtmlTitle=Osebni podatki
+federatedIdentitiesHtmlTitle=Federirane identitete
+accountLogHtmlTitle=Dnevnik računa
+changePasswordHtmlTitle=Spremeni geslo
+deviceActivityHtmlTitle=Aktivnost naprav
+sessionsHtmlTitle=Seje
+accountManagementTitle=Upravljanje računa Keycloak
+authenticatorTitle=Avtentikator
+applicationsHtmlTitle=Aplikacije
+linkedAccountsHtmlTitle=Povezani računi
+accountManagementWelcomeMessage=Dobrodošli v upravljanju računa Keycloak
+accountManagementBaseThemeCannotBeUsedDirectly=Osnovna tema računa vsebuje samo prevode za konzolo računa. Za prikaz konzole računa morate nastaviti nadrejeno temo vaše teme na drugo temo računa ali pa zagotoviti lastno datoteko index.ftl. Za več informacij si oglejte dokumentacijo.
+personalInfoIntroMessage=Upravljajte svoje osnovne podatke
+accountSecurityTitle=Varnost računa
+accountSecurityIntroMessage=Nadzorujte svoje geslo in dostop do računa
+applicationsIntroMessage=Sledite in upravljajte dovoljenja aplikacij za dostop do vašega računa
+resourceIntroMessage=Delite svoje vire med člani ekipe
+passwordLastUpdateMessage=Vaše geslo je bilo posodobljeno
+updatePasswordTitle=Posodobi geslo
+updatePasswordMessageTitle=Prepričajte se, da izberete močno geslo
+updatePasswordMessage=Močno geslo vsebuje kombinacijo številk, črk in simbolov. Težko ga je uganiti, ni podobno pravi besedi in se uporablja samo za ta račun.
+personalSubTitle=Vaši osebni podatki
+personalSubMessage=Upravljajte svoje osnovne podatke.
+authenticatorCode=Enkratna koda
+email=E-poštni naslov
+firstName=Ime
+givenName=Rojstno ime
+fullName=Polno ime
+lastName=Priimek
+familyName=Družinsko ime
+password=Geslo
+currentPassword=Trenutno geslo
+passwordConfirm=Potrditev
+passwordNew=Novo geslo
+username=Uporabniško ime
+address=Naslov
+street=Ulica
+locality=Mesto
+region=Regija
+postal_code=Poštna številka
+country=Država
+emailVerified=E-poštni naslov preverjen
+website=Spletna stran
+phoneNumber=Telefonska številka
+phoneNumberVerified=Telefonska številka preverjena
+gender=Spol
+birthday=Datum rojstva
+zoneinfo=Časovni pas
+gssDelegationCredential=GSS pooblastilo
+profileScopeConsentText=Profil uporabnika
+emailScopeConsentText=E-poštni naslov
+addressScopeConsentText=Naslov
+phoneScopeConsentText=Telefonska številka
+offlineAccessScopeConsentText=Offline dostop
+samlRoleListScopeConsentText=Moje vloge
+rolesScopeConsentText=Vloge uporabnika
+organizationScopeConsentText=Organizacija
+role_admin=Administrator
+role_realm-admin=Administrator realma
+role_create-realm=Ustvari realm
+role_view-realm=Ogled realma
+role_view-users=Ogled uporabnikov
+role_view-applications=Ogled aplikacij
+role_view-groups=Ogled skupin
+role_view-clients=Ogled odjemalcev
+role_view-events=Ogled dogodkov
+role_view-identity-providers=Ogled ponudnikov identitete
+role_view-consent=Ogled soglasij
+role_manage-realm=Upravljanje realma
+role_manage-users=Upravljanje uporabnikov
+role_manage-applications=Upravljanje aplikacij
+role_manage-identity-providers=Upravljanje ponudnikov identitete
+role_manage-clients=Upravljanje odjemalcev
+role_manage-events=Upravljanje dogodkov
+role_view-profile=Ogled profila
+role_manage-account=Upravljanje računa
+role_manage-account-links=Upravljanje povezav računa
+role_manage-consent=Upravljanje soglasij
+role_read-token=Branje žetona
+role_offline-access=Offline dostop
+role_uma_authorization=Pridobitev dovoljenj
+client_account=Račun
+client_account-console=Konzola računa
+client_security-admin-console=Administrativna konzola za varnost
+client_admin-cli=Admin CLI
+client_realm-management=Upravljanje realma
+client_broker=Posrednik
+requiredFields=Obvezna polja
+allFieldsRequired=Vsa polja so obvezna
+backToApplication=&laquo; Nazaj na aplikacijo
+backTo=Nazaj na {0}
+date=Datum
+event=Dogodek
+ip=IP
+client=Odjemalec
+clients=Odjemalci
+details=Podrobnosti
+started=Začetek
+lastAccess=Zadnji dostop
+expires=Poteče
+applications=Aplikacije
+account=Račun
+federatedIdentity=Federirana identiteta
+authenticator=Avtentikator
+device-activity=Aktivnost naprav
+sessions=Seje
+log=Dnevnik
+application=Aplikacija
+availableRoles=Razpoložljive vloge
+grantedPermissions=Dodeljena dovoljenja
+grantedPersonalInfo=Dodeljeni osebni podatki
+additionalGrants=Dodatna dovoljenja
+action=Dejanje
+inResource=v
+fullAccess=Poln dostop
+offlineToken=Offline žeton
+revoke=Prekliči dovoljenje
+configureAuthenticators=Konfigurirani avtentikatorji
+mobile=Mobilno
+totpStep1=Namestite eno od naslednjih aplikacij na svoj mobilni telefon:
+totpStep2=Odprite aplikacijo in skenirajte črtno kodo:
+totpStep3=Vnesite enkratno kodo, ki jo je ustvarila aplikacija, in kliknite Shrani za dokončanje nastavitve.
+totpStep3DeviceName=Zagotovite ime naprave, ki vam bo pomagalo upravljati vaše OTP naprave.
+totpManualStep2=Odprite aplikacijo in vnesite ključ:
+totpManualStep3=Uporabite naslednje konfiguracijske vrednosti, če jih aplikacija omogoča:
+totpUnableToScan=Ne morete skenirati?
+totpScanBarcode=Skeniraj črtno kodo?
+totp.totp=Časovno osnovano
+totp.hotp=Števno osnovano
+totpType=Tip
+totpAlgorithm=Algoritem
+totpDigits=Števke
+totpInterval=Interval
+totpCounter=Števec
+totpDeviceName=Ime naprave
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+irreversibleAction=To dejanje je nepreklicno
+deletingImplies=Izbris vašega računa pomeni:
+errasingData=Izbris vseh vaših podatkov
+loggingOutImmediately=Takojšnjo odjavo
+accountUnusable=Nadaljnja uporaba aplikacije s tem računom ne bo več mogoča
+missingUsernameMessage=Prosimo, vnesite uporabniško ime.
+missingFirstNameMessage=Prosimo, vnesite ime.
+invalidEmailMessage=Neveljaven e-poštni naslov.
+missingLastNameMessage=Prosimo, vnesite priimek.
+missingEmailMessage=Prosimo, vnesite e-poštni naslov.
+missingPasswordMessage=Prosimo, vnesite geslo.
+notMatchPasswordMessage=Gesli se ne ujemata.
+invalidUserMessage=Neveljaven uporabnik
+updateReadOnlyAttributesRejectedMessage=Posodobitev atributa samo za branje je bila zavrnjena
+missingTotpMessage=Prosimo, vnesite kodo avtentikatorja.
+missingTotpDeviceNameMessage=Prosimo, vnesite ime naprave.
+invalidPasswordExistingMessage=Neveljavno obstoječe geslo.
+invalidPasswordConfirmMessage=Potrditev gesla se ne ujema.
+invalidTotpMessage=Neveljavna koda avtentikatorja.
+usernameExistsMessage=Uporabniško ime že obstaja.
+emailExistsMessage=E-poštni naslov že obstaja.
+readOnlyUserMessage=Ne morete posodobiti svojega računa, ker je samo za branje.
+readOnlyUsernameMessage=Ne morete posodobiti uporabniškega imena, ker je samo za branje.
+readOnlyPasswordMessage=Ne morete posodobiti gesla, ker je vaš račun samo za branje.
+successTotpMessage=Mobilni avtentikator je konfiguriran.
+successTotpRemovedMessage=Mobilni avtentikator je odstranjen.
+successGrantRevokedMessage=Dovoljenje je uspešno preklicano.
+accountUpdatedMessage=Vaš račun je bil posodobljen.
+accountPasswordUpdatedMessage=Vaše geslo je bilo posodobljeno.
+missingIdentityProviderMessage=Ponudnik identitete ni določen.
+invalidFederatedIdentityActionMessage=Neveljavno ali manjkajoče dejanje.
+identityProviderNotFoundMessage=Določen ponudnik identitete ni bil najden.
+federatedIdentityLinkNotActiveMessage=Ta identiteta ni več aktivna.
+federatedIdentityRemovingLastProviderMessage=Ne morete odstraniti zadnje federirane identitete, ker nimate gesla.
+federatedIdentityBoundOrganization=Ne morete odstraniti povezave s ponudnikom identitete, ki je povezan z organizacijo.
+identityProviderRedirectErrorMessage=Preusmeritev na ponudnika identitete ni uspela.
+identityProviderRemovedMessage=Ponudnik identitete je uspešno odstranjen.
+identityProviderAlreadyLinkedMessage=Federirana identiteta, ki jo je vrnil {0}, je že povezana z drugim uporabnikom.
+staleCodeAccountMessage=Stran je potekla. Prosimo, poskusite še enkrat.
+consentDenied=Soglasje zavrnjeno.
+access-denied-when-idp-auth=Dostop zavrnjen pri avtentikaciji s {0}
+accountDisabledMessage=Račun je onemogočen, obrnite se na administratorja.
+accountTemporarilyDisabledMessage=Račun je začasno onemogočen, obrnite se na administratorja ali poskusite kasneje.
+invalidPasswordMinLengthMessage=Neveljavno geslo: minimalna dolžina {0}.
+invalidPasswordMaxLengthMessage=Neveljavno geslo: maksimalna dolžina {0}.
+invalidPasswordMinLowerCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} malih črk.
+invalidPasswordMinDigitsMessage=Neveljavno geslo: mora vsebovati vsaj {0} številk.
+invalidPasswordMinUpperCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} velikih črk.
+invalidPasswordMinSpecialCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} posebnih znakov.
+invalidPasswordNotUsernameMessage=Neveljavno geslo: ne sme biti enako uporabniškemu imenu.
+invalidPasswordNotContainsUsernameMessage=Neveljavno geslo: ne sme vsebovati uporabniškega imena.
+invalidPasswordNotEmailMessage=Neveljavno geslo: ne sme biti enako e-poštnemu naslovu.
+invalidPasswordRegexPatternMessage=Neveljavno geslo: ne ustreza vzorcu.
+invalidPasswordHistoryMessage=Neveljavno geslo: ne sme biti enako nobenemu od zadnjih {0} gesel.
+invalidPasswordBlacklistedMessage=Neveljavno geslo: geslo je na črni listi.
+invalidPasswordGenericMessage=Neveljavno geslo: novo geslo ne ustreza pravilom gesla.
+
+# Authorization
+myResources=Moji viri
+myResourcesSub=Moji viri
+doDeny=Zavrni
+doRevoke=Prekliči
+doApprove=Odobri
+doRemoveSharing=Odstrani deljenje
+doRemoveRequest=Odstrani zahtevo
+peopleAccessResource=Ljudje z dostopom do tega vira
+resourceManagedPolicies=Dovoljenja, ki omogočajo dostop do tega vira
+resourceNoPermissionsGrantingAccess=Ni dovoljenj, ki bi omogočala dostop do tega vira
+anyAction=Katerokoli dejanje
+description=Opis
+name=Ime
+scopes=Obsegi
+resource=Vir
+user=Uporabnik
+peopleSharingThisResource=Ljudje, ki delijo ta vir
+shareWithOthers=Delite z drugimi
+needMyApproval=Potrebujete moje odobritev
+requestsWaitingApproval=Vaše zahteve, ki čakajo na odobritev
+icon=Ikona
+requestor=Zahtevnik
+owner=Lastnik
+resourcesSharedWithMe=Viri, ki so mi deljeni
+permissionRequestion=Zahteva za dovoljenje
+permission=Dovoljenje
+shares=Deljenja
+notBeingShared=Ta vir se ne deli
+notHaveAnyResource=Nimate nobenih virov
+noResourcesSharedWithYou=Z vami ni deljenih virov
+havePermissionRequestsWaitingForApproval=Imate {0} zahtev za dovoljenja, ki čakajo na odobritev
+clickHereForDetails=Kliknite tukaj za podrobnosti
+resourceIsNotBeingShared=Vir se ne deli
+
+# Applications
+applicationName=Ime aplikacije
+applicationType=Tip aplikacije
+applicationInUse=Aplikacija v uporabi
+clearAllFilter=Počisti vse filtre
+activeFilters=Aktivni filtri
+filterByName=Filtriraj po imenu ...
+allApps=Vse aplikacije
+internalApps=Interne aplikacije
+thirdpartyApps=Zunanje aplikacije
+appResults=Rezultati
+clientNotFoundMessage=Odjemalec ni najden.
+
+# Linked account
+authorizedProvider=Pooblaščeni ponudnik
+authorizedProviderMessage=Pooblaščeni ponudniki, povezani z vašim računom
+identityProvider=Ponudnik identitete
+identityProviderMessage=Za povezavo vašega računa s konfiguriranimi ponudniki identitete
+socialLogin=Družbena prijava
+userDefined=Uporabniško določeno
+removeAccess=Odstrani dostop
+removeAccessMessage=Če boste želeli ponovno uporabljati ta račun aplikacije, boste morali znova odobriti dostop.
+
+#Authenticator
+authenticatorStatusMessage=Dvofaktorska avtentikacija je trenutno
+authenticatorFinishSetUpTitle=Vaša dvofaktorska avtentikacija
+authenticatorFinishSetUpMessage=Ob vsaki prijavi v vaš račun Keycloak boste morali vnesti kodo za dvofaktorsko avtentikacijo.
+authenticatorSubTitle=Nastavitev dvofaktorske avtentikacije
+authenticatorSubMessage=Za povečanje varnosti vašega računa omogočite vsaj enega od razpoložljivih načinov dvofaktorske avtentikacije.
+authenticatorMobileTitle=Mobilni avtentikator
+authenticatorMobileMessage=Uporabite mobilni avtentikator za pridobitev potrditvenih kod kot dvofaktorsko avtentikacijo.
+authenticatorMobileFinishSetUpMessage=Avtentikator je bil povezan z vašim telefonom.
+authenticatorActionSetup=Nastavi
+authenticatorSMSTitle=SMS koda
+authenticatorSMSMessage=Keycloak bo poslal potrditveno kodo na vaš telefon kot dvofaktorsko avtentikacijo.
+authenticatorSMSFinishSetUpMessage=Sporočila SMS so poslana na
+authenticatorDefaultStatus=Privzeto
+authenticatorChangePhone=Spremeni telefonsko številko
+
+#Authenticator - Mobile Authenticator setup
+authenticatorMobileSetupTitle=Nastavitev mobilnega avtentikatorja
+smscodeIntroMessage=Vnesite svojo telefonsko številko in boste prejeli potrditveno kodo na telefon.
+mobileSetupStep1=Namestite eno od naslednjih aplikacij na svoj mobilni telefon.
+mobileSetupStep2=Odprite aplikacijo in skenirajte črtno kodo:
+mobileSetupStep3=Vnesite enkratno kodo, ki jo je ustvarila aplikacija, in kliknite Shrani za dokončanje nastavitve.
+scanBarCode=Želite skenirati črtno kodo?
+enterBarCode=Vnesite enkratno kodo
+doCopy=Kopiraj
+doFinish=Dokončaj
+
+#Authenticator - SMS Code setup
+authenticatorSMSCodeSetupTitle=Nastavitev SMS kode
+chooseYourCountry=Izberite državo
+enterYourPhoneNumber=Vnesite telefonsko številko
+sendVerficationCode=Pošlji potrditveno kodo
+enterYourVerficationCode=Vnesite potrditveno kodo
+
+#Authenticator - backup Code setup
+authenticatorBackupCodesSetupTitle=Nastavitev obnovitvenih avtentikacijskih kod
+realmName=Realm
+doDownload=Prejmi
+doPrint=Natisni
+generateNewBackupCodes=Generiraj nove obnovitvene avtentikacijske kode
+backtoAuthenticatorPage=Nazaj na stran avtentikatorja
+
+#Resources
+resources=Viri
+sharedwithMe=Deljeno z mano
+share=Deli
+sharedwith=Deljeno z
+accessPermissions=Dovoljenja za dostop
+permissionRequests=Zahteve za dovoljenja
+approve=Odobri
+approveAll=Odobri vse
+people=ljudi
+perPage=na stran
+currentPage=Trenutna stran
+sharetheResource=Deli vir
+group=Skupina
+selectPermission=Izberi dovoljenje
+addPeople=Dodaj ljudi za deljenje vira
+addTeam=Dodaj ekipo za deljenje vira
+myPermissions=Moja dovoljenja
+waitingforApproval=Čakanje na odobritev
+anyPermission=Katerokoli dovoljenje
+
+# Openshift messages
+openshift.scope.user_info=Podatki o uporabniku
+openshift.scope.user_check-access=Podatki o uporabniškem dostopu
+openshift.scope.user_full=Poln dostop
+openshift.scope.list-projects=Seznam projektov
+error-invalid-value=Neveljavna vrednost
+error-invalid-blank=Prosimo, določite vrednost
+error-empty=Prosimo, določite vrednost
+error-invalid-length=Dolžina mora biti med {1} in {2}
+error-invalid-length-too-short=Minimalna dolžina je {1}
+error-invalid-length-too-long=Maksimalna dolžina je {2}
+error-invalid-email=Neveljaven e-poštni naslov
+error-invalid-number=Neveljavna številka
+error-number-out-of-range=Številka mora biti med {1} in {2}
+error-number-out-of-range-too-small=Številka mora imeti minimalno vrednost {1}
+error-number-out-of-range-too-big=Številka mora imeti maksimalno vrednost {2}
+error-pattern-no-match=Neveljavna vrednost
+error-invalid-uri=Neveljaven URL
+error-invalid-uri-scheme=Neveljavna URL shema
+error-invalid-uri-fragment=Neveljaven URL fragment
+error-user-attribute-required=Prosimo, izpolnite to polje
+error-invalid-date=Neveljaven datum
+error-user-attribute-read-only=To polje je samo za branje
+error-username-invalid-character=Vrednost vsebuje neveljaven znak
+error-person-name-invalid-character=Ime vsebuje neveljaven znak
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties
index 1e1d812a9352..9ec3b7bc3091 100755
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties
@@ -93,7 +93,7 @@ revoke=Upphäv rättighet
 
 configureAuthenticators=Konfigurerade autentiserare
 mobile=Mobil
-totpStep1=Installera <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> eller Google Authenticator på din enhet. Båda applikationerna finns tillgängliga på <a href="https://play.google.com">Google Play</a> och Apple App Store.
+totpStep1=Installera en av följande applikationer på din mobil:
 totpStep2=Öppna applikationen och skanna streckkoden eller skriv i nyckeln.
 totpStep3=Fyll i engångskoden som tillhandahålls av applikationen och klicka på Spara för att avsluta inställningarna.
 
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties
index 4a4c09d61a0f..78eb62db435a 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties
@@ -109,7 +109,7 @@ revoke=收回授权
 
 configureAuthenticators=配置的认证者
 mobile=手机
-totpStep1=在你的设备上安装 <a href="https://fedorahosted.org/freeotp/" target="_blank">FreeOTP</a> 或者 Google Authenticator.两个应用可以从 <a href="https://play.google.com">Google Play</a> 和 Apple App Store下载。
+totpStep1=在您的手機上安裝以下應用程式之一：
 totpStep2=打开应用扫描二维码输入验证码
 totpStep3=输入应用提供的一次性验证码单击保存
 
diff --git a/themes/src/main/resources-community/theme/base/account/messages/messages_zh_TW.properties b/themes/src/main/resources-community/theme/base/account/messages/messages_zh_TW.properties
index 5d952252742e..d99f1c9b86a2 100644
--- a/themes/src/main/resources-community/theme/base/account/messages/messages_zh_TW.properties
+++ b/themes/src/main/resources-community/theme/base/account/messages/messages_zh_TW.properties
@@ -56,7 +56,7 @@ passwordNew=新密碼
 username=使用者名稱
 address=地址
 street=街道
-locality=市
+locality=城市
 region=省、自治區、直轄市
 postal_code=郵遞區號
 country=國家
@@ -146,7 +146,7 @@ offlineToken=離線 token
 revoke=撤銷授權
 
 configureAuthenticators=已設定驗證器
-mobile=Mobile
+mobile=行動裝置
 totpStep1=在您的手機中安裝下列程式 (擇一)
 totpStep2=開啟應用程式並掃描 QR code：
 totpStep3=輸入應用程式提供的一次性密碼並點擊送出來完成設定。
@@ -213,6 +213,7 @@ invalidFederatedIdentityActionMessage=無效或是錯誤的行為。
 identityProviderNotFoundMessage=找不到指定身分提供者。
 federatedIdentityLinkNotActiveMessage=這個提供者已不再啟用。
 federatedIdentityRemovingLastProviderMessage=當你沒有密碼時，你無法移除最後一個聯邦身分。
+federatedIdentityBoundOrganization=你無法移除與組織關聯的身分提供者連結。
 identityProviderRedirectErrorMessage=無法重新導向至身分提供者。
 identityProviderRemovedMessage=身分提供者已成功移除。
 identityProviderAlreadyLinkedMessage=身份提供者 {0} 傳回的聯盟身份已連結至另一個使用者。
diff --git a/themes/src/main/resources-community/theme/base/account/theme.properties b/themes/src/main/resources-community/theme/base/account/theme.properties
index c55c2a28687a..d8312290f3aa 100644
--- a/themes/src/main/resources-community/theme/base/account/theme.properties
+++ b/themes/src/main/resources-community/theme/base/account/theme.properties
@@ -1 +1 @@
-locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,lt,lv,nl,no,pl,pt,pt-BR,ru,sk,sv,th,tr,uk,zh-CN,zh-TW
+locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,ky,lt,lv,nl,no,pl,pt,pt-BR,ru,sk,sl,sv,th,tr,uk,zh-CN,zh-TW
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ca.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ca.properties
index 9d89b3da1d80..bc2a1219f8bc 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_ca.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ca.properties
@@ -6,7 +6,7 @@ invalidPasswordMinUpperCaseCharsMessage=La contrasenya no és vàlida: ha de con
 invalidPasswordMinSpecialCharsMessage=La contrasenya no és vàlida: ha de contenir almenys {0} caràcters especials.
 invalidPasswordNotUsernameMessage=La contrasenya no és vàlida: no pot ser igual al nom d''usuari.
 invalidPasswordNotEmailMessage=La contrasenya no és vàlida: no pot ser igual al correu electrònic.
-invalidPasswordRegexPatternMessage=La contrasenya no és vàlida: no coincideix amb el patró de l''expressió regular.
+invalidPasswordRegexPatternMessage=La contrasenya no és vàlida: no coincideix amb els patrons de l''expressió regular.
 invalidPasswordHistoryMessage=La contrasenya no és vàlida: no pot ser igual a les últimes {0} contrasenyes.
 invalidPasswordBlacklistedMessage=La contrasenya no és vàlida: està en una llista negra.
 invalidPasswordGenericMessage=La contrasenya no és vàlida: la contrasenya nova no coincideix amb les polítiques de contrasenya.
@@ -35,7 +35,7 @@ backchannelLogoutUrlIsInvalid=L''URL de desconnexió del canal posterior no és
 
 
 pairwiseMalformedClientRedirectURI=El client conté un URI de redirecció no vàlid.
-pairwiseClientRedirectURIsMissingHost=Els URI de redirecció de client ha de contenir un component de servidor vàlid.
+pairwiseClientRedirectURIsMissingHost=Els URI de redirecció de client han de contenir un component de servidor vàlid.
 pairwiseClientRedirectURIsMultipleHosts=Sense un URI d''identificador de sector, els URI de redirecció de client no poden contenir múltiples components de servidor.
 pairwiseMalformedSectorIdentifierURI=L''URI d''identificador de sector està mal formatat.
 pairwiseFailedToGetRedirectURIs=No s''ha pogut obtenir cap URI de redirecció des de l''URI d''identificador de sector.
@@ -44,14 +44,14 @@ duplicatedJwksSettings=Els commutadors «Utilitza JWKS» i «Utilitza un URL JWK
 error-invalid-value=El valor no és vàlid.
 error-invalid-blank=Especifiqueu un valor.
 error-empty=Especifiqueu un valor.
-error-invalid-length=L''atribut {0} ha de tindre una llargària d''entre {1} i {2}.
-error-invalid-length-too-short=L''atribut {0} ha de tindre una llargària mínima de {1}.
-error-invalid-length-too-long=L''atribut {0} ha de tindre una llargària màxima de {2}.
+error-invalid-length=L''atribut {0} ha de tenir una llargària d''entre {1} i {2}.
+error-invalid-length-too-short=L''atribut {0} ha de tenir una llargària de, com a mínim, {1}.
+error-invalid-length-too-long=L''atribut {0} ha de tenir una llargària de, com a màxim, {2}.
 error-invalid-email=L''adreça de correu electrònic no és vàlida.
 error-invalid-number=El nombre no és vàlid.
 error-number-out-of-range=L''atribut {0} ha de ser un número entre {1} i {2}.
-error-number-out-of-range-too-small=L''atribut {0} ha de tindre valor mínim de {1}.
-error-number-out-of-range-too-big=L''atribut {0} ha de tindre valor màxim de {2}.
+error-number-out-of-range-too-small=L''atribut {0} ha de tenir un valor de, com a mínim, {1}.
+error-number-out-of-range-too-big=L''atribut {0} ha de tenir un valor de, com a màxim, {2}.
 error-pattern-no-match=El valor no és vàlid.
 error-invalid-uri=L''URL no és vàlid.
 error-invalid-uri-scheme=L''esquema d''URL no és vàlid.
@@ -61,5 +61,11 @@ error-invalid-date=L''atribut {0} és una data invàlida.
 error-user-attribute-read-only=L''atribut {0} és només de lectura.
 error-username-invalid-character={0} conté un caràcter no vàlid.
 error-person-name-invalid-character={0} conté un caràcter no vàlid.
-invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d'usuari.
-error-invalid-multivalued-size=L''atribut {0} ha de tenir almenys {1} i com a molt {2} valor(s).
+invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d''usuari.
+error-invalid-multivalued-size=L’atribut {0} ha de tenir almenys {1} i com a molt {2} {2,choice,0#valors|1#valor|1<valors}.
+client_account=Compte
+client_account-console=Consola del compte
+client_admin-cli=CLI d’administració
+client_broker=Agent
+client_security-admin-console=Consola d’administració de seguretat
+client_realm-management=Gestió del domini
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_de.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_de.properties
index 5e369e0e8a33..c226414e07c1 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_de.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_de.properties
@@ -62,4 +62,9 @@ error-invalid-date=Attribut {0} ist ungültiges Datum.
 error-user-attribute-read-only=Attribut {0} ist schreibgeschützt.
 error-username-invalid-character={0} enthält ungültiges Zeichen.
 error-person-name-invalid-character={0} enthält ungültiges Zeichen.
-error-invalid-multivalued-size=Attribut {0} muss mindestens {1} und höchstens {2} Wert(e) haben.
+error-invalid-multivalued-size=Attribut {0} muss mindestens {1} und darf höchstens {2} {2,choice,0#Werte|1#Wert|1<Werte} haben.
+client_account=Konto
+client_account-console=Kontoverwaltung
+client_admin-cli=Admin CLI
+client_broker=Broker
+client_realm-management=Realm-Verwaltung
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_es.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_es.properties
index a6c87c2197e6..faf9a2cbbb41 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_es.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_es.properties
@@ -61,5 +61,11 @@ error-invalid-date=El atributo {0} es una fecha no válida.
 error-user-attribute-read-only=El atributo {0} es de solo lectura.
 error-username-invalid-character={0} contiene algún carácter inválido.
 error-person-name-invalid-character={0} contiene algún carácter inválido.
-error-invalid-multivalued-size=El atributo {0} debe tener al menos {1} y como máximo {2} valor(es).
+error-invalid-multivalued-size=El atributo {0} debe tener al menos {1} y como máximo {2} {2,choice,0#valores|1#valor|1<valores}.
 invalidPasswordNotContainsUsernameMessage=Contraseña no válida: no puede contener el nombre de usuario.
+client_broker=Intermediario
+client_admin-cli=Interfaz de línea de comandos para administración
+client_account=Cuenta
+client_account-console=Consola de la cuenta
+client_security-admin-console=Consola de administración de seguridad
+client_realm-management=Administración del realm
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_fr.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_fr.properties
index b8cc9b2fc0f7..6eeeecef4cd1 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_fr.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_fr.properties
@@ -1,8 +1,69 @@
 invalidPasswordMinLengthMessage=Mot de passe invalide : longueur minimale requise de {0}.
 invalidPasswordMinLowerCaseCharsMessage=Mot de passe invalide : doit contenir au moins {0} lettre(s) en minuscule.
-invalidPasswordMinDigitsMessage=Mot de passe invalide : doit contenir au moins {0} chiffre(s).
+invalidPasswordMinDigitsMessage=Mot de passe invalide : doit contenir au moins {0} chiffre(s).
 invalidPasswordMinUpperCaseCharsMessage=Mot de passe invalide : doit contenir au moins {0} lettre(s) en majuscule.
-invalidPasswordMinSpecialCharsMessage=Mot de passe invalide : doit contenir au moins {0} caractère(s) spéciaux.
+invalidPasswordMinSpecialCharsMessage=Mot de passe invalide : doit contenir au moins {0} caractères spéciaux.
 invalidPasswordNotUsernameMessage=Mot de passe invalide : ne doit pas être identique au nom d''utilisateur.
 invalidPasswordRegexPatternMessage=Mot de passe invalide : ne valide pas l''expression rationnelle.
 invalidPasswordHistoryMessage=Mot de passe invalide : ne doit pas être égal aux {0} derniers mot de passe.
+invalidPasswordMaxLengthMessage=Mot de passe invalide : longueur maximale limitée à {0}.
+ldapErrorMissingClientId=L''ID du client doit être renseigné dans le configuration quand l''association des rôles du domaine n''est pas utilisé.
+invalidPasswordNotContainsUsernameMessage=Mot de passe invalide : ne doit pas contenir le nom d''utilisateur.
+invalidPasswordNotEmailMessage=Mot de passe invalide : ne doit pas être identique à l''adresse de courriel.
+invalidPasswordBlacklistedMessage=Mot de passe invalide : mot de passe blacklisté.
+invalidPasswordGenericMessage=Mot de passe invalide : le nouveau mot de passe ne respecte pas les politiques de mot de passe.
+ldapErrorEditModeMandatory=Le mode d''édition est obligatoire
+ldapErrorInvalidCustomFilter=Le filtre LDAP personnalisé ne commence par "(" ou ne finit pas par ")".
+ldapErrorConnectionTimeoutNotNumber=La durée de Timeout doit être un nombre
+ldapErrorReadTimeoutNotNumber=Le Timeout de lecture doit être un nombre
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=La validation de la politique de mot de passe est applicable uniquement en modification avec droits en écriture
+ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Impossible de conserver l''héritage des groupes et d''utiliser en même temps l''appartenance par UID.
+ldapErrorCantWriteOnlyForReadOnlyLdap=Impossible de définir en écriture seulement lorsque le fournisseur LDAP n''est pas en écriture
+ldapErrorCantWriteOnlyAndReadOnly=Impossible de définir en écriture seule et en lecture seule en même temps
+ldapErrorCantEnableStartTlsAndConnectionPooling=Impossible d''activer StartTLS et l''interrogation régulière de connexion (pooling).
+ldapErrorCantEnableUnsyncedAndImportOff=Impossible de désactiver l''import d''utilisateurs quand le mode du fournisseur LDAP est Non synchronisé
+ldapErrorMissingGroupsPathGroup=Le chemin vers les groupes n''existe pas. Merci de d''abord créer le group dans le chemin spécifié
+clientRootURLFragmentError=L''URL racine ne doit pas contenir un identificateur de fragment d''URL
+clientRedirectURIsFragmentError=L''URI de redirection ne doit pas contenir un identificateur de fragment d''URI
+clientRootURLIllegalSchemeError=L''URL racine utilise un schéma non autorisé
+clientBaseURLIllegalSchemeError=L''URL de base utilise un schéma non autorisé
+clientRedirectURIsIllegalSchemeError=Une URI de redirection utilise un schéma non autorisé
+clientBaseURLInvalid=L''URL de base n''est pas une URL valide
+clientRootURLInvalid=L''URL racine n''est pas une URL valide
+clientRedirectURIsInvalid=Une URI de redirection n''est pas une URI valide
+pairwiseMalformedClientRedirectURI=Le client contient une URI de redirection invalide.
+pairwiseClientRedirectURIsMissingHost=Les URI de redirection client doivent contenir un composant hôte valide.
+duplicatedJwksSettings=Le sélecteur "Utiliser JWKS" et le sélecteur "Utiliser une URL JWKS" ne peuvent pas être actif en même temps.
+error-invalid-value=Valeur non valide.
+error-invalid-blank=Merci de renseigner une valeur.
+error-empty=Merci de renseigner une valeur.
+error-invalid-length=L''attribut {0} doit avoir une longueur comprise entre {1} et {2}.
+error-invalid-length-too-short=L''attribut {0} doit avoir une longueur minimale de {1}.
+error-invalid-length-too-long=L''attribut {0} doit avoir une longueur maximale de {2}.
+error-invalid-email=Adresse de courriel non valide.
+error-invalid-number=Nombre non valide.
+error-number-out-of-range=L''attribut {0} doit être un nombre compris entre {1} et {2}.
+error-number-out-of-range-too-small=L''attribut {0} doit valoir au moins {1}.
+error-number-out-of-range-too-big=L''attribut {0} doit valoir au plus {2}.
+error-pattern-no-match=Valeur non valide.
+error-invalid-uri=URL non valide.
+error-invalid-uri-scheme=Schéma d''URL non valide.
+error-invalid-uri-fragment=Identificateur de fragment URL non valide.
+error-user-attribute-required=Merci de renseigner l''attribut {0}.
+error-invalid-date=L''attribut {0} est une date non valide.
+error-username-invalid-character={0} contient un caractère non valide.
+error-user-attribute-read-only=L''attribut {0} est en lecture seule.
+error-person-name-invalid-character={0} contient un caractère non valide.
+backchannelLogoutUrlIsInvalid=L''URL de déconnexion du canal secondaire n''est pas une URL valide
+backchannelLogoutUrlIllegalSchemeError=L''URL de déconnexion du canal secondaire utilise un schéma interdit
+pairwiseClientRedirectURIsMultipleHosts=Sans une URL d''identifiant de secteur les URLs de redirection client ne doivent pas contenir plusieurs composants d''hôte.
+pairwiseMalformedSectorIdentifierURI=URL d''identifiant de secteur malformée.
+pairwiseFailedToGetRedirectURIs=Impossible d''obtenir les URLs de redirection depuis l''URL d''identifiant de secteur.
+pairwiseRedirectURIsMismatch=Les URLs de redirection client ne correspondent pas aux URLs de redirection récupérées depuis l''URL d''identifiant de secteur.
+error-invalid-multivalued-size=L''attribut {0} doit avoir au moins {1} et au plus {2} {2,choice,0#values|1#value|1<values}.
+client_account=Compte
+client_account-console=Console de gestion du compte
+client_security-admin-console=Console d''administration de la sécurité
+client_admin-cli=Administration en lignes de commandes
+client_realm-management=Gestion du domaine
+client_broker=Broker
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_it.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_it.properties
index e69de29bb2d1..450ad6a96aff 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_it.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_it.properties
@@ -0,0 +1,63 @@
+invalidPasswordMinLengthMessage=Password non valida: la lunghezza minima è {0}.
+invalidPasswordMinDigitsMessage=Password non valida: deve contenere almeno {0} numeri.
+invalidPasswordMinUpperCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri maiuscoli.
+invalidPasswordNotUsernameMessage=Password non valida: non può essere uguale al nome utente.
+invalidPasswordNotContainsUsernameMessage=Password non valida: non può contenere il nome utente.
+invalidPasswordRegexPatternMessage=Password non valida: non corrisponde al formato richiesto.
+invalidPasswordHistoryMessage=Password non valida: deve essere diversa dalle ultime {0} password usate.
+invalidPasswordBlacklistedMessage=Password non valida: questo termine è in blacklist.
+invalidPasswordGenericMessage=Password non valida: non corrisponde alle regole per le password.
+ldapErrorEditModeMandatory=La modalità di modifica è obbligatoria
+ldapErrorInvalidCustomFilter=Il filtro LDAP configurato non inizia con "(" o non finisce con ")".
+ldapErrorConnectionTimeoutNotNumber=Il timeout della connessione deve essere un numero
+ldapErrorReadTimeoutNotNumber=Il timeout della lettura deve essere un numero
+ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Non è possibile preservare l''ereditarietà del gruppo e contemporaneamente utilizzare l''appartenenza UID.
+ldapErrorCantWriteOnlyForReadOnlyLdap=Non è possibile impostare la sola scrittura quando la modalità del provider LDAP non è WRITABLE
+ldapErrorCantWriteOnlyAndReadOnly=Non è possibile impostare contemporaneamente sola lettura e sola scrittura
+ldapErrorCantEnableStartTlsAndConnectionPooling=Non è possibile abilitare sia StartTLS che il pooling delle connessioni.
+ldapErrorCantEnableUnsyncedAndImportOff=Non è possibile disattivare l''importazione degli utenti quando la modalità del provider LDAP è UNSYNCED
+clientRootURLIllegalSchemeError=L''URL di root usa un protocollo vietato
+clientRedirectURIsIllegalSchemeError=Un URI di redirect usa un protocollo vietato
+clientBaseURLInvalid=L''URL di base non è valido
+clientRootURLInvalid=L''URL di root non è valido
+clientRedirectURIsInvalid=Un URI di redirect non è valido
+backchannelLogoutUrlIsInvalid=L''URL di disconnessione non è valido
+pairwiseMalformedClientRedirectURI=Il client contiene un URI di redirect non valido.
+pairwiseClientRedirectURIsMissingHost=Gli URI di redirect del client devono contenere un host valido.
+pairwiseClientRedirectURIsMultipleHosts=Senza un Sector Identifier URI, gli URI di reindirizzamento del client non devono contenere più host.
+pairwiseMalformedSectorIdentifierURI=Sector Identifier URI non valido.
+pairwiseFailedToGetRedirectURIs=Impossibile ricavare gli URI di redirect dal Sector Identifier URI.
+duplicatedJwksSettings=Le opzioni "Usa JWKS" e "Usa URL JWKS" non possono essere attive contemporaneamente.
+error-invalid-blank=Si prega di specificare un valore.
+error-empty=Si prega di specificare un valore.
+error-invalid-length-too-short=Il campo {0} deve avere una lunghezza minima di {1}.
+error-invalid-length-too-long=Il campo {0} deve avere una lunghezza massima di {2}.
+error-invalid-date=Il campo {0} è una data non valida.
+error-user-attribute-read-only=Il campo {0} è di sola lettura.
+error-username-invalid-character={0} contiene caratteri non validi.
+error-person-name-invalid-character={0} contiene caratteri non validi.
+error-invalid-multivalued-size=Il campo {0} deve avere almeno {1} e al massimo {2} {2,choice,0#valori|1#valore|1<valori}.
+invalidPasswordMaxLengthMessage=Password non valida: la lunghezza massima è {0}.
+clientRootURLFragmentError=L''URL di root non deve contenere un URL fragment
+ldapErrorMissingClientId=Se non si usa la mappatura dei ruoli del realm è obbligatorio fornire l''ID del client.
+invalidPasswordMinLowerCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri minuscoli.
+error-invalid-email=Indirizzo email non valido.
+invalidPasswordNotEmailMessage=Password non valida: non può essere uguale all''email.
+invalidPasswordMinSpecialCharsMessage=Password non valida: deve contenere almeno {0} caratteri speciali.
+clientRedirectURIsFragmentError=Gli URI di reindirizzamento non devono contenere un URI fragment
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=Il criterio di convalida della password è applicabile solo con la modalità di modifica WRITABLE
+clientBaseURLIllegalSchemeError=L''URL di base usa un protocollo vietato
+error-invalid-value=Valore non valido.
+error-user-attribute-required=Si prega di specificare il campo {0}.
+ldapErrorMissingGroupsPathGroup=Il percorso del gruppo non esiste: creare prima il gruppo con il percorso desiderato
+backchannelLogoutUrlIllegalSchemeError=L''URL di disconnessione usa un protocollo vietato
+error-invalid-number=Numero non valido.
+pairwiseRedirectURIsMismatch=Gli URI di redirect del client non corrispondono agli URI di redirect del Sector Identifier URI.
+error-invalid-length=Il campo {0} deve avere una lunghezza compresa fra {1} e {2}.
+error-number-out-of-range-too-big=Il campo {0} deve avere un valore massimo di {2}.
+error-pattern-no-match=Valore non valido.
+error-invalid-uri-fragment=URL fragment non valido.
+error-invalid-uri-scheme=Protocollo URL non valido.
+error-number-out-of-range=Il campo {0} deve essere un numero compreso fra {1} e {2}.
+error-number-out-of-range-too-small=Il campo {0} deve avere un valore minimo di {1}.
+error-invalid-uri=URL non valido.
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ja.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ja.properties
index 7ef100cbb021..226e3399273f 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_ja.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ja.properties
@@ -5,23 +5,65 @@ invalidPasswordMinUpperCaseCharsMessage=無効なパスワード: 少なくと
 invalidPasswordMinSpecialCharsMessage=無効なパスワード: 少なくとも{0}文字の特殊文字を含む必要があります。
 invalidPasswordNotUsernameMessage=無効なパスワード: ユーザー名と同じパスワードは禁止されています。
 invalidPasswordRegexPatternMessage=無効なパスワード: 正規表現パターンと一致しません。
-invalidPasswordHistoryMessage=無効なパスワード: 最近の{0}パスワードのいずれかと同じパスワードは禁止されています。
+invalidPasswordHistoryMessage=無効なパスワード: 直近{0}個のパスワードのいずれかと同じパスワードは禁止されています。
 invalidPasswordBlacklistedMessage=無効なパスワード: パスワードがブラックリストに含まれています。
-invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワード・ポリシーと一致しません。
+invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワードポリシーと一致しません。
 ldapErrorInvalidCustomFilter=LDAPフィルターのカスタム設定が、「(」から開始または「)」で終了となっていません。
 ldapErrorConnectionTimeoutNotNumber=接続タイムアウトは数字でなければなりません
 ldapErrorReadTimeoutNotNumber=読み取りタイムアウトは数字でなければなりません
-ldapErrorMissingClientId=レルムロール・マッピングを使用しない場合は、クライアントIDは設定内で提供される必要があります。
-ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=グループの継承を維持することと、UIDメンバーシップ・タイプを使用することは同時にできません。
-ldapErrorCantWriteOnlyForReadOnlyLdap=LDAPプロバイダー・モードがWRITABLEではない場合は、write onlyを設定することはできません。
-ldapErrorCantWriteOnlyAndReadOnly=write-onlyとread-onlyを一緒に設定することはできません。
+ldapErrorMissingClientId=レルムロールマッピングを使用しない場合は、クライアントIDは設定内で提供される必要があります。
+ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=グループの継承を維持することと、UIDメンバーシップタイプを使用することは同時にできません。
+ldapErrorCantWriteOnlyForReadOnlyLdap=LDAPプロバイダーモードがWRITABLEではない場合は、「書き込み専用」を設定することはできません
+ldapErrorCantWriteOnlyAndReadOnly=「書き込み専用」と「読み取り専用」を同時に設定することはできません
 ldapErrorCantEnableStartTlsAndConnectionPooling=StartTLSと接続プーリングの両方を有効にできません。
-clientRedirectURIsFragmentError=リダイレクトURIにURIフラグメントを含めることはできません。
-clientRootURLFragmentError=ルートURLにURLフラグメントを含めることはできません。
+clientRedirectURIsFragmentError=リダイレクトURIにURIフラグメントを含めることはできません
+clientRootURLFragmentError=ルートURLにURLフラグメントを含めることはできません
 pairwiseMalformedClientRedirectURI=クライアントに無効なリダイレクトURIが含まれていました。
-pairwiseClientRedirectURIsMissingHost=クライアントのリダイレクトURIには有効なホスト・コンポーネントが含まれている必要があります。
-pairwiseClientRedirectURIsMultipleHosts=設定されたセレクター識別子URIがない場合は、クライアントのリダイレクトURIは複数のホスト・コンポーネントを含むことはできません。
+pairwiseClientRedirectURIsMissingHost=クライアントのリダイレクトURIには有効なホストコンポーネントが含まれている必要があります。
+pairwiseClientRedirectURIsMultipleHosts=設定されたセレクター識別子URIがない場合、クライアントのリダイレクトURIは複数のホストコンポーネントを含むことはできません。
 pairwiseMalformedSectorIdentifierURI=不正なセレクター識別子URIです。
-pairwiseFailedToGetRedirectURIs=セクター識別子URIからリダイレクトURIを取得できませんでした。
-pairwiseRedirectURIsMismatch=クライアントのリダイレクトURIは、セクター識別子URIからフェッチされたリダイレクトURIと一致しません。
+pairwiseFailedToGetRedirectURIs=セクター識別子URIからのリダイレクトURIの取得に失敗しました。
+pairwiseRedirectURIsMismatch=クライアントのリダイレクトURIが、セクター識別子URIからフェッチされたリダイレクトURIと一致しません。
 invalidPasswordMaxLengthMessage=無効なパスワード: 最大長は{0}です。
+invalidPasswordNotEmailMessage=無効なパスワード: メールアドレスと同じパスワードは禁止されています。
+ldapErrorEditModeMandatory=編集モードは必須です
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=パスワードポリシーの検証はWRITABLE編集モードでのみ適用されます
+clientRedirectURIsInvalid=リダイレクトURLは有効なURLではありません
+backchannelLogoutUrlIsInvalid=バックチャネルログアウトURLは有効なURLではありません
+duplicatedJwksSettings=「JWKSを使用する」スイッチと「JWKS URLを使用する」スイッチを同時にオンにすることはできません。
+error-invalid-value=無効な値です。
+error-invalid-blank=値を指定してください。
+error-empty=値を指定してください。
+error-invalid-length=属性{0}の長さは{1}から{2}までの範囲でなければなりません。
+error-invalid-length-too-short=属性{0}の最小の長さは{1}である必要があります。
+error-invalid-length-too-long=属性{0}の最大長は{2}である必要があります。
+error-invalid-email=メールアドレスが無効です。
+error-invalid-number=無効な数値です。
+error-number-out-of-range=属性{0}は{1}と{2}の間の数値でなければならなりません。
+error-number-out-of-range-too-big=属性{0}の最大値は{2}である必要があります。
+error-pattern-no-match=無効な値です。
+error-invalid-uri=無効なURLです。
+error-invalid-uri-scheme=無効なURLスキームです。
+error-user-attribute-required=属性{0}を指定してください。
+error-invalid-date=属性{0}は無効な日付です。
+error-username-invalid-character={0}に無効な文字が含まれています。
+error-person-name-invalid-character={0}に無効な文字が含まれています。
+error-invalid-multivalued-size=属性{0}は少なくとも{1}、多くても{2} {2,choice,0#値|1#値|1<値}でなければならない。
+clientRedirectURIsIllegalSchemeError=リダイレクトURIは不正なスキームを使用しています
+ldapErrorMissingGroupsPathGroup=グループパスグループが存在しません - 最初に指定されたパスにグループを作成してください
+clientBaseURLIllegalSchemeError=ベースURLは不正なスキームを使用しています
+clientRootURLInvalid=ルートURLは有効なURLではありません
+backchannelLogoutUrlIllegalSchemeError=バックチャネルログアウトURLは不正なスキームを使用しています
+error-invalid-uri-fragment=無効なURLフラグメントです。
+invalidPasswordNotContainsUsernameMessage=無効なパスワード: ユーザー名を含めることはできません。
+ldapErrorCantEnableUnsyncedAndImportOff=LDAPプロバイダーモードがUNSYNCEDの場合、ユーザーのインポートを無効にできません
+clientBaseURLInvalid=ベースURLは有効なURLではありません
+clientRootURLIllegalSchemeError=ルートURLは不正なスキームを使用しています
+error-user-attribute-read-only=属性{0}は読み取り専用です。
+error-number-out-of-range-too-small=属性{0}の最小値は{1}である必要があります。
+client_account=アカウント
+client_account-console=アカウントコンソール
+client_security-admin-console=セキュリティー管理コンソール
+client_admin-cli=管理CLI
+client_realm-management=レルム管理
+client_broker=ブローカー
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ka.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ka.properties
index b41503b90399..dab94cc89f71 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_ka.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ka.properties
@@ -59,7 +59,12 @@ error-user-attribute-read-only=ატრიბუტი {0} მხოლოდ-
 error-username-invalid-character={0} არასწორ სიმბოლოს შეიცავს.
 pairwiseMalformedSectorIdentifierURI=არასწორად ჩამოყალიბებული სექტორის იდენტიფიკატორის URI.
 pairwiseFailedToGetRedirectURIs=შეცდომა გადამისამართების URI-ების მიღებისას სექტორის იდენტიფიკატორის URI-დან.
-error-invalid-multivalued-size=ატრიბუტი {0} მინიმუმ {1} და მაქსიმუმ {2} მნიშვნელობას უნდა შეიცავდეს.
+error-invalid-multivalued-size=ატრიბუტს {0} უნდა ჰქონდეს მინიმუმ {1} და მაქსიმუმt {2} {2,choice,0#მნიშვნელობა,0<მნიშვნელობა}.
 error-invalid-length=ატრიბუტის {0} სიგრძე {1}-{2} შუალედში უნდა იყოს.
 pairwiseClientRedirectURIsMultipleHosts=მორგებული სექტორის იდენტიფიკატორის URI-ის გარდა კლიენტის გადამისამართების URI-ები ერთზე მეტ ჰოსტის კომპონენტს არ უნდა შეიცავდეს.
 duplicatedJwksSettings=პარამეტრები "JWKS-ის გამოყენება" და პარამეტრი "JWKS-ის URL-ის გამოყენება" ერთდროულად ჩართული ვერ იქნება.
+client_account=ანგარიში
+client_account-console=ანგარიშის კონსოლი
+client_admin-cli=ადმინის CLI
+client_realm-management=რეალმის მართვა
+client_broker=ბროკერი
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ky.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ky.properties
new file mode 100644
index 000000000000..ce45f004161d
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ky.properties
@@ -0,0 +1,76 @@
+invalidPasswordMinLengthMessage=Жарамсыз сырсөз: минималдуу узундугу {0}.
+invalidPasswordMaxLengthMessage=Жарамсыз сырсөз: максималдуу узундугу {0}.
+invalidPasswordMinLowerCaseCharsMessage=Жарамсыз сырсөз: жок дегенде {0} кичине тамга болушу керек.
+invalidPasswordMinDigitsMessage=Жарамсыз сырсөз: жок дегенде {0} сан болушу керек.
+invalidPasswordMinUpperCaseCharsMessage=Жарамсыз сырсөз: жок дегенде {0} чоң тамга болушу керек.
+invalidPasswordMinSpecialCharsMessage=Жарамсыз сырсөз: жок дегенде {0} атайын символ болушу керек.
+invalidPasswordNotUsernameMessage=Жарамсыз сырсөз: колдонуучу атына барабар болбоошу керек.
+invalidPasswordNotContainsUsernameMessage=Жарамсыз сырсөз: колдонуучу аты камтылышы мүмкүн эмес.
+invalidPasswordNotEmailMessage=Жарамсыз сырсөз: электрондук почтага барабар болбоошу керек.
+invalidPasswordRegexPatternMessage=Жарамсыз сырсөз: көрсөтүлгөн regex үлгүсүнө дал келбейт.
+invalidPasswordHistoryMessage=Жарамсыз сырсөз: акыркы {0} сырсөздөрдүн бирине барабар болбоошу керек.
+invalidPasswordBlacklistedMessage=Жарамсыз сырсөз: сырсөз кара тизмеде турат.
+invalidPasswordGenericMessage=Жарамсыз сырсөз: жаңы сырсөз сырсөз саясатына ылайык келбейт.
+
+ldapErrorEditModeMandatory=Түзөтүү режими сөзсүз талап кылынат
+ldapErrorInvalidCustomFilter=Ыңгайлаштырылган LDAP фильтри «(» менен башталып, «)» менен бүтүшү керек.
+ldapErrorConnectionTimeoutNotNumber=Байланыш убактысынын чеги сан болушу керек
+ldapErrorReadTimeoutNotNumber=Окуу убактысынын чеги сан болушу керек
+ldapErrorMissingClientId=Realm Roles Mapping колдонулбаганда конфигурацияда кардар ID көрсөтүлүшү керек.
+ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Топ мурастоону сактап калуу жана UID мүчөлүк түрүн бир эле учурда колдонуу мүмкүн эмес.
+ldapErrorCantWriteOnlyForReadOnlyLdap=LDAP камсыздоочу жазууга мүмкүн эмес болгондо, жазууга гана уруксат берүү мүмкүн эмес
+ldapErrorCantWriteOnlyAndReadOnly=Жазууга гана жана окууга гана бир эле учурда коюу мүмкүн эмес
+ldapErrorCantEnableStartTlsAndConnectionPooling=StartTLS жана байланыш пулун бир эле учурда иштетүү мүмкүн эмес.
+ldapErrorCantEnableUnsyncedAndImportOff=LDAP камсыздоочу UNSYNCED режиминде болгондо колдонуучуларды импорттоону өчүрүү мүмкүн эмес
+ldapErrorMissingGroupsPathGroup=Көрсөтүлгөн жолдо топ жок – алгач бул топту көрсөтүлгөн жолдо түзүңүз
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=Сырсөз саясатын текшерүү мүмкүнчүлүгү WRITABLE түзөтүү режиминде гана колдонулат
+
+clientRedirectURIsFragmentError=Багыттоо URI''си URI фрагментин камтыбашы керек
+clientRootURLFragmentError=Тамыр URL''и URL фрагментин камтыбашы керек
+clientRootURLIllegalSchemeError=Тамыр URL мыйзамсыз схема менен колдонулган
+clientBaseURLIllegalSchemeError=Базалык URL мыйзамсыз схема менен колдонулган
+backchannelLogoutUrlIllegalSchemeError=Backchannel чыгуу URL мыйзамсыз схема менен колдонулган
+clientRedirectURIsIllegalSchemeError=Багыттоо URI мыйзамсыз схема менен колдонулган
+clientBaseURLInvalid=Базалык URL жарактуу URL эмес
+clientRootURLInvalid=Тамыр URL жарактуу URL эмес
+clientRedirectURIsInvalid=Багыттоо URI жарактуу URI эмес
+backchannelLogoutUrlIsInvalid=Backchannel чыгуу URL жарактуу URL эмес
+
+
+pairwiseMalformedClientRedirectURI=Клиентте жараксыз багыттоо URI бар.
+pairwiseClientRedirectURIsMissingHost=Клиент багыттоо URI''леринде жарактуу хост компоненти болушу керек.
+pairwiseClientRedirectURIsMultipleHosts=Сектор идентификаторунун URI''си конфигурацияланбаса, клиент багыттоо URI''леринде бир нече хост компоненти болбошу керек.
+pairwiseMalformedSectorIdentifierURI=Сектор идентификаторунун URI''си туура эмес түзүлгөн.
+pairwiseFailedToGetRedirectURIs=Сектор идентификаторунун URI''синен багыттоо URI''лерин алуу ишке ашкан жок.
+pairwiseRedirectURIsMismatch=Клиенттин багыттоо URI''лери Сектор идентификаторунун URI''синен алынган URI''лер менен дал келбейт.
+
+duplicatedJwksSettings="JWKS колдонуу" жана "JWKS URL колдонуу" которгучтары бир эле учурда күйгүзүлбөшү керек.
+
+error-invalid-value=Туура эмес маани.
+error-invalid-blank=Маанини көрсөтүңүз.
+error-empty=Маанини көрсөтүңүз.
+error-invalid-length={0} атрибутунун узундугу {1} менен {2} ортосунда болушу керек.
+error-invalid-length-too-short={0} атрибутунун минималдуу узундугу {1} болушу керек.
+error-invalid-length-too-long={0} атрибутунун максималдуу узундугу {2} болушу керек.
+error-invalid-email=Туура эмес электрондук почта дареги.
+error-invalid-number=Туура эмес сан.
+error-number-out-of-range={0} атрибуту {1} менен {2} ортосундагы сан болушу керек.
+error-number-out-of-range-too-small={0} атрибутунун минималдуу мааниси {1} болушу керек.
+error-number-out-of-range-too-big={0} атрибутунун максималдуу мааниси {2} болушу керек.
+error-pattern-no-match=Туура эмес маани.
+error-invalid-uri=Туура эмес URL.
+error-invalid-uri-scheme=Туура эмес URL схемасы.
+error-invalid-uri-fragment=Туура эмес URL фрагменти.
+error-user-attribute-required={0} атрибутун көрсөтүңүз.
+error-invalid-date={0} атрибуту туура эмес дата.
+error-user-attribute-read-only={0} атрибуту жазууга болбойт.
+error-username-invalid-character={0} жараксыз символ камтыйт.
+error-person-name-invalid-character={0} жараксыз символ камтыйт.
+error-invalid-multivalued-size={0} атрибуту жок дегенде {1} жана эң көп дегенде {2} {2,choice,0#маани|1#маани|1<маани} камтышы керек.
+
+client_account=Аккаунт
+client_account-console=Аккаунт консолу
+client_security-admin-console=Коопсуздук админ консолу
+client_admin-cli=Админ CLI
+client_realm-management=Realm башкаруу
+client_broker=Брокер
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_nl.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_nl.properties
index 4a04a5249d3c..41804ced808a 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_nl.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_nl.properties
@@ -7,7 +7,6 @@ invalidPasswordNotUsernameMessage=Ongeldig wachtwoord: het mag niet overeenkomen
 invalidPasswordRegexPatternMessage=Ongeldig wachtwoord: het voldoet niet aan het door de beheerder ingestelde patroon.
 invalidPasswordHistoryMessage=Ongeldig wachtwoord: het mag niet overeen komen met een van de laatste {0} wachtwoorden.
 invalidPasswordGenericMessage=Ongeldig wachtwoord: het nieuwe wachtwoord voldoet niet aan het wachtwoordbeleid.
-
 ldapErrorInvalidCustomFilter=LDAP filter met aangepaste configuratie start niet met "(" of eindigt niet met ")".
 ldapErrorConnectionTimeoutNotNumber=Verbindingstimeout moet een getal zijn
 ldapErrorReadTimeoutNotNumber=Lees-timeout moet een getal zijn
@@ -15,10 +14,8 @@ ldapErrorMissingClientId=Client ID moet ingesteld zijn als Realm Roles Mapping n
 ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Kan groepsovererving niet behouden bij UID-lidmaatschapstype.
 ldapErrorCantWriteOnlyForReadOnlyLdap=Alleen-schrijven niet mogelijk als LDAP provider mode niet WRITABLE is
 ldapErrorCantWriteOnlyAndReadOnly=Alleen-schrijven en alleen-lezen mogen niet tegelijk ingesteld zijn
-
 clientRedirectURIsFragmentError=Redirect URIs mogen geen URI fragment bevatten
 clientRootURLFragmentError=Root URL mag geen URL fragment bevatten
-
 pairwiseMalformedClientRedirectURI=Client heeft een ongeldige redirect URI.
 pairwiseClientRedirectURIsMissingHost=Client redirect URIs moeten een geldige host-component bevatten.
 pairwiseClientRedirectURIsMultipleHosts=Zonder een geconfigureerde Sector Identifier URI mogen client redirect URIs niet meerdere host componenten hebben.
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_pt_BR.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_pt_BR.properties
index 554b87ca7cb8..a5db68151374 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_pt_BR.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_pt_BR.properties
@@ -1,18 +1,69 @@
-invalidPasswordMinLengthMessage=Senha inválida: deve conter ao menos {0} caracteres.
-invalidPasswordMinLowerCaseCharsMessage=Senha inválida: deve conter ao menos {0} caracteres minúsculos.
-invalidPasswordMinDigitsMessage=Senha inválida: deve conter ao menos {0} digitos numéricos.
-invalidPasswordMinUpperCaseCharsMessage=Senha inválida: deve conter ao menos {0} caracteres maiúsculos.
-invalidPasswordMinSpecialCharsMessage=Senha inválida: deve conter ao menos {0} caracteres especiais.
-invalidPasswordNotUsernameMessage=Senha inválida: não deve ser igual ao nome de usuário.
-invalidPasswordNotContainsUsernameMessage=Senha inválida\: não pode conter o nome de usuário.
-invalidPasswordRegexPatternMessage=Senha inválida: falha ao passar por padrões.
-invalidPasswordHistoryMessage=Senha inválida: não deve ser igual às últimas {0} senhas.
-
+invalidPasswordMinLengthMessage=Senha inválida: tamanho mínimo {0}.
+invalidPasswordMinLowerCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) minúscula(s).
+invalidPasswordMinDigitsMessage=Senha inválida: deve conter pelo menos {0} número(s).
+invalidPasswordMinUpperCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) maiúscula(s).
+invalidPasswordMinSpecialCharsMessage=Senha inválida: deve conter pelo menos {0} caractere(s) especial(is).
+invalidPasswordNotUsernameMessage=Senha inválida: não pode ser igual ao nome de usuário.
+invalidPasswordNotContainsUsernameMessage=Senha inválida: não pode conter o nome de usuário.
+invalidPasswordRegexPatternMessage=Senha inválida: não corresponde ao(s) padrão(ões) de expressão regular.
+invalidPasswordHistoryMessage=Senha inválida: não pode ser igual a nenhuma da(s) última(s) {0} senha(s).
 ldapErrorInvalidCustomFilter=Filtro LDAP não inicia com "(" ou não termina com ")".
-ldapErrorMissingClientId=ID do cliente precisa ser definido na configuração quando mapeamentos de Roles do Realm não é utilizado.
+ldapErrorMissingClientId=O ID do cliente deve ser fornecido na configuração quando o mapeamento de papéis de realm não for utilizado.
 ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Não é possível preservar herança de grupos e usar tipo de associação de UID ao mesmo tempo.
 ldapErrorCantWriteOnlyForReadOnlyLdap=Não é possível definir modo de somente escrita quando o provedor LDAP não suporta escrita
 ldapErrorCantWriteOnlyAndReadOnly=Não é possível definir somente escrita e somente leitura ao mesmo tempo
-
 clientRedirectURIsFragmentError=URIs de redirecionamento não podem conter fragmentos
-clientRootURLFragmentError=URL raiz não pode conter fragmentos
\ No newline at end of file
+clientRootURLFragmentError=URL raiz não pode conter fragmentos
+invalidPasswordMaxLengthMessage=Senha inválida: tamanho máximo {0}.
+invalidPasswordNotEmailMessage=Senha inválida: não pode ser igual ao email.
+invalidPasswordBlacklistedMessage=Senha inválida: esta senha está na lista de exclusão.
+invalidPasswordGenericMessage=Senha inválida: a nova senha não cumpre as políticas de senha.
+client_broker=Intermediário
+error-invalid-blank=Por favor, especifique um valor.
+error-empty=Por favor, especifique um valor.
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=Validar Política de Senha é aplicável somente com modo de edição GRAVÁVEL
+pairwiseClientRedirectURIsMissingHost=As URIs de redirecionamento do cliente devem conter um componente de host válido.
+pairwiseRedirectURIsMismatch=As URIs de redirecionamento do cliente não correspondem às URIs de redirecionamento obtidas a partir da URI de Identificador de Setor.
+client_account=Conta
+client_account-console=Console da Conta
+client_security-admin-console=Console de Administração de Segurança
+client_admin-cli=CLI de Administração
+client_realm-management=Gerenciamento do Realm
+ldapErrorEditModeMandatory=Modo de Edição é obrigatório
+ldapErrorConnectionTimeoutNotNumber=Tempo de Expiração da Conexão deve ser um número
+ldapErrorReadTimeoutNotNumber=Tempo de expiração da Leitura deve ser um número
+ldapErrorCantEnableStartTlsAndConnectionPooling=Não é possível habilitar StartTLS e pool de conexões ao mesmo tempo.
+ldapErrorCantEnableUnsyncedAndImportOff=Não é possível desabilitar a importação de usuários quando o modo do provedor LDAP está como NÃO SINCRONIZADO
+ldapErrorMissingGroupsPathGroup=O grupo no caminho especificado não existe – por favor, crie o grupo no caminho indicado primeiro
+clientRootURLIllegalSchemeError=URL raiz usa um esquema inválido
+clientBaseURLIllegalSchemeError=URL base usa um esquema inválido
+backchannelLogoutUrlIllegalSchemeError=URL de logout de backchannel usa um esquema inválido
+clientRedirectURIsIllegalSchemeError=Uma URI de redirecionamento usa um esquema inválido
+clientBaseURLInvalid=A URL base não é uma URL válida
+clientRootURLInvalid=A URL raiz não é uma URL válida
+clientRedirectURIsInvalid=Uma URI de redirecionamento não é uma URI válida
+backchannelLogoutUrlIsInvalid=URL de logout de backchannel não é uma URL válida
+pairwiseMalformedClientRedirectURI=Cliente continha uma URI de redirecionamento inválida.
+pairwiseClientRedirectURIsMultipleHosts=Sem uma URI de identificador de setor configurada, as URIs de redirecionamento do cliente não devem conter múltiplos componentes de host.
+pairwiseMalformedSectorIdentifierURI=URI de Identificador de Setor Malformada.
+pairwiseFailedToGetRedirectURIs=Falha ao obter as URIs de redirecionamento a partir da URI de Identificador de Setor.
+duplicatedJwksSettings=As opções "Usar JWKS" e "Usar URL de JWKS" não podem ser ativadas ao mesmo tempo.
+error-invalid-value=Valor inválido.
+error-invalid-length=O atributo {0} precisa ter um tamanho entre {1} e {2} caracteres.
+error-pattern-no-match=Valor inválido.
+error-invalid-length-too-short=O atributo {0} deve ter comprimento mínimo de {1}.
+error-invalid-length-too-long=O atributo {0} precisa ter um tamanho máximo de {2} caracteres.
+error-invalid-email=Endereço de email inválido.
+error-invalid-number=Número inválido.
+error-number-out-of-range=O atributo {0} deve ser um número entre {1} e {2}.
+error-number-out-of-range-too-small=O atributo {0} precisa ter um valor mínimo de {1}.
+error-number-out-of-range-too-big=O atributo {0} precisa ter um valor máximo de {2}.
+error-invalid-uri=URL inválida.
+error-invalid-uri-scheme=Esquema da URL inválido.
+error-invalid-uri-fragment=Fragmento da URL inválido.
+error-user-attribute-required=Por favor, informe o atributo {0}.
+error-invalid-date=O atributo {0} é uma data inválida.
+error-user-attribute-read-only=O atributo {0} is somente leitura.
+error-username-invalid-character={0} contém caractere inválido.
+error-person-name-invalid-character={0} contém caractere inválido.
+error-invalid-multivalued-size=O atributo {0} deve ter no mínimo {1} e no máximo {2} {2,choice,0#values|1#value|1<values}.
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ro.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ro.properties
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ro.properties
@@ -0,0 +1 @@
+
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_ru.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_ru.properties
index 2ac5311d6880..991bcff7bc5c 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_ru.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_ru.properties
@@ -1,21 +1,39 @@
 invalidPasswordMinLengthMessage=Некорректный пароль: длина пароля должна быть не менее {0} символов(а).
-invalidPasswordMinDigitsMessage=Некорректный пароль: должен содержать не менее {0} цифр(ы).
+invalidPasswordMaxLengthMessage=Неверный пароль: максимальная длина {0}.
 invalidPasswordMinLowerCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символов(а) в нижнем регистре.
+invalidPasswordMinDigitsMessage=Некорректный пароль: должен содержать не менее {0} цифр(ы).
 invalidPasswordMinUpperCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символов(а) в верхнем регистре.
 invalidPasswordMinSpecialCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} спецсимволов(а).
 invalidPasswordNotUsernameMessage=Некорректный пароль: пароль не должен совпадать с именем пользователя.
+invalidPasswordNotContainsUsernameMessage=Неверный пароль: не может содержать имя пользователя.
+invalidPasswordNotEmailMessage=Неверный пароль: не должен совпадать с адресом электронной почты.
 invalidPasswordRegexPatternMessage=Некорректный пароль: пароль не прошел проверку по регулярному выражению.
 invalidPasswordHistoryMessage=Некорректный пароль: пароль не должен совпадать с последним(и) {0} паролем(ями).
+invalidPasswordBlacklistedMessage=Неверный пароль: пароль занесен в черный список.
 invalidPasswordGenericMessage=Некорректный пароль: новый пароль не соответствует правилам пароля.
-
+ldapErrorEditModeMandatory=Режим редактирования обязателен
 ldapErrorInvalidCustomFilter=Сконфигурированный пользователем фильтр LDAP не должен начинаться с "(" или заканчиваться на ")".
+ldapErrorConnectionTimeoutNotNumber=Время ожидания соединения должно быть числом
+ldapErrorReadTimeoutNotNumber=Время ожидания чтения должно быть числом
 ldapErrorMissingClientId=Client ID должен быть настроен в конфигурации, если не используется сопоставление ролей в realm.
 ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Не удалось унаследовать группу и использовать членство UID типа вместе.
 ldapErrorCantWriteOnlyForReadOnlyLdap=Невозможно установить режим "только на запись", когда LDAP провайдер не в режиме WRITABLE
 ldapErrorCantWriteOnlyAndReadOnly=Невозможно одновременно установить режимы "только на чтение" и "только на запись"
-
+ldapErrorCantEnableStartTlsAndConnectionPooling=Невозможно включить одновременно StartTLS и пул соединений.
+ldapErrorCantEnableUnsyncedAndImportOff=Невозможно отключить импорт пользователей, если режим поставщика LDAP — UNSYNCED
+ldapErrorMissingGroupsPathGroup=Группа путей групп не существует — сначала создайте группу по указанному пути
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=Политика проверки пароля применима только в режиме редактирования WRITABLE
 clientRedirectURIsFragmentError=URI перенаправления не должен содержать фрагмент URI
-clientRootURLFragmentError=Корневой URL не должен содержать фрагмент URL 
+clientRootURLFragmentError=Корневой URL не должен содержать фрагмент URL
+clientRootURLIllegalSchemeError=Корневой URL использует недопустимую схему
+clientBaseURLIllegalSchemeError=Базовый URL использует недопустимую схему
+backchannelLogoutUrlIllegalSchemeError=URL-адрес выхода из обратного канала использует недопустимую схему
+clientRedirectURIsIllegalSchemeError=URI перенаправления использует недопустимую схему
+clientBaseURLInvalid=Базовый URL-адрес не является допустимым URL-адресом
+clientRootURLInvalid=Корневой URL-адрес не является допустимым URL-адресом
+clientRedirectURIsInvalid=URI перенаправления не является допустимым URI
+backchannelLogoutUrlIsInvalid=URL-адрес выхода из backchannel не является допустимым URL-адресом
+
 
 pairwiseMalformedClientRedirectURI=Клиент содержит некорректный URI перенаправления.
 pairwiseClientRedirectURIsMissingHost=URI перенаправления клиента должен содержать корректный компонент хоста.
@@ -23,3 +41,31 @@ pairwiseClientRedirectURIsMultipleHosts=Без конфигурации по ч
 pairwiseMalformedSectorIdentifierURI=Искаженная часть идентификатора URI.
 pairwiseFailedToGetRedirectURIs=Не удалось получить идентификаторы URI перенаправления из части идентификатора URI.
 pairwiseRedirectURIsMismatch=Клиент URI переадресации не соответствует URI переадресации, полученной из части идентификатора URI.
+duplicatedJwksSettings=Переключатели "Использовать JWKS" и "Использовать URL JWKS" не могут быть включены одновременно.
+error-invalid-value=Недопустимое значение.
+error-invalid-blank=Укажите значение.
+error-empty=Укажите значение.
+error-invalid-length=Атрибут {0} должен иметь длину от {1} до {2}.
+error-invalid-length-too-short=Атрибут {0} должен иметь минимальную длину {1}.
+error-invalid-length-too-long=Атрибут {0} должен иметь максимальную длину {2}.
+error-invalid-email=Неверный адрес электронной почты.
+error-invalid-number=Неверное число.
+error-number-out-of-range=Атрибут {0} должен быть числом от {1} до {2}.
+error-number-out-of-range-too-small=Атрибут {0} должен иметь минимальное значение {1}.
+error-number-out-of-range-too-big=Атрибут {0} должен иметь максимальное значение {2}.
+error-pattern-no-match=Недопустимое значение.
+error-invalid-uri=Неверный URL-адрес.
+error-invalid-uri-scheme=Неверная схема URL.
+error-invalid-uri-fragment=Неверный фрагмент URL.
+error-user-attribute-required=Пожалуйста, укажите атрибут {0}.
+error-invalid-date=Атрибут {0} имеет недопустимую дату.
+error-user-attribute-read-only=Атрибут {0} доступен только для чтения.
+error-username-invalid-character={0} содержит недопустимый символ.
+error-person-name-invalid-character={0} содержит недопустимый символ.
+error-invalid-multivalued-size=Атрибут {0} должен иметь не менее {1} и не более {2} {2,choice,0#values|1#value|1<values}.
+client_account=Аккаунт
+client_account-console=Консоль аккаунта
+client_security-admin-console=Консоль администратора безопасности
+client_admin-cli=Административный интерфейс командной строки
+client_realm-management=Управление realm
+client_broker=Брокер
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_sl.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_sl.properties
new file mode 100644
index 000000000000..216126438785
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_sl.properties
@@ -0,0 +1,63 @@
+invalidPasswordMinLengthMessage=Neveljavno geslo: najmanjša dolžina je {0}.
+invalidPasswordMaxLengthMessage=Neveljavno geslo: največja dolžina je {0}.
+invalidPasswordMinLowerCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} malih črk.
+invalidPasswordMinDigitsMessage=Neveljavno geslo: mora vsebovati vsaj {0} številk.
+invalidPasswordMinUpperCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} velikih črk.
+invalidPasswordMinSpecialCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} posebnih znakov.
+invalidPasswordNotUsernameMessage=Neveljavno geslo: ne sme biti enako uporabniškemu imenu.
+invalidPasswordNotContainsUsernameMessage=Neveljavno geslo: ne sme vsebovati uporabniškega imena.
+invalidPasswordNotEmailMessage=Neveljavno geslo: ne sme biti enako e-poštnemu naslovu.
+invalidPasswordRegexPatternMessage=Neveljavno geslo: ne ustreza vzorcu regex.
+invalidPasswordHistoryMessage=Neveljavno geslo: ne sme biti enako kateremu od zadnjih {0} gesel.
+invalidPasswordBlacklistedMessage=Neveljavno geslo: geslo je na črni listi.
+invalidPasswordGenericMessage=Neveljavno geslo: novo geslo ne ustreza pravilom za gesla.
+ldapErrorEditModeMandatory=Način urejanja je obvezen
+ldapErrorInvalidCustomFilter=Po meri nastavljen LDAP filter se ne začne z "(" ali se ne konča z ")".
+ldapErrorConnectionTimeoutNotNumber=Časovna omejitev povezave mora biti številka
+ldapErrorReadTimeoutNotNumber=Časovna omejitev branja mora biti številka
+ldapErrorMissingClientId=ID odjemalca mora biti naveden v konfiguraciji, ko se ne uporablja preslikava vlog področja.
+ldapErrorCantPreserveGroupInheritanceWithUIDMembershipType=Ni mogoče ohraniti dedovanja skupine in hkrati uporabljati UID tip članstva.
+ldapErrorCantWriteOnlyForReadOnlyLdap=Ni mogoče nastaviti samo pisanja, ko način LDAP ponudnika ni ZAPISLJIV
+ldapErrorCantWriteOnlyAndReadOnly=Ni mogoče nastaviti samo pisanja in samo branja hkrati
+ldapErrorCantEnableStartTlsAndConnectionPooling=Ni mogoče omogočiti StartTLS in združevanja povezav hkrati.
+ldapErrorCantEnableUnsyncedAndImportOff=Ni mogoče onemogočiti uvoza uporabnikov, ko je način LDAP ponudnika NESINHRONIZIRANO
+ldapErrorMissingGroupsPathGroup=Skupina poti skupin ne obstaja - najprej ustvarite skupino na določeni poti
+ldapErrorValidatePasswordPolicyAvailableForWritableOnly=Preverjanje pravil za gesla je na voljo samo v načinu urejanja ZAPISLJIVO
+clientRedirectURIsFragmentError=Preusmeritveni URI-ji ne smejo vsebovati fragmenta URI
+clientRootURLFragmentError=Korenski URL ne sme vsebovati fragmenta URL
+clientRootURLIllegalSchemeError=Korenski URL uporablja nedovoljeno shemo
+clientBaseURLIllegalSchemeError=Osnovni URL uporablja nedovoljeno shemo
+backchannelLogoutUrlIllegalSchemeError=URL za odjavo preko zadnjega kanala uporablja nedovoljeno shemo
+clientRedirectURIsIllegalSchemeError=Preusmeritveni URI uporablja nedovoljeno shemo
+clientBaseURLInvalid=Osnovni URL ni veljaven URL
+clientRootURLInvalid=Korenski URL ni veljaven URL
+clientRedirectURIsInvalid=Preusmeritveni URI ni veljaven URI
+backchannelLogoutUrlIsInvalid=URL za odjavo preko zadnjega kanala ni veljaven URL
+pairwiseMalformedClientRedirectURI=Odjemalec vsebuje neveljaven preusmeritveni URI.
+pairwiseClientRedirectURIsMissingHost=Preusmeritveni URI-ji odjemalca morajo vsebovati veljavno komponento gostitelja.
+pairwiseClientRedirectURIsMultipleHosts=Brez konfiguriranega URI-ja identifikatorja sektorja preusmeritveni URI-ji odjemalca ne smejo vsebovati več komponent gostitelja.
+pairwiseMalformedSectorIdentifierURI=Napačno oblikovan URI identifikatorja sektorja.
+pairwiseFailedToGetRedirectURIs=Ni uspelo pridobiti preusmeritvenih URI-jev iz URI-ja identifikatorja sektorja.
+pairwiseRedirectURIsMismatch=Preusmeritveni URI-ji odjemalca se ne ujemajo s preusmeritveni URI-ji, pridobljenimi iz URI-ja identifikatorja sektorja.
+duplicatedJwksSettings=Stikali "Uporabi JWKS" in "Uporabi JWKS URL" ne moreta biti vklopljeni hkrati.
+error-invalid-value=Neveljavna vrednost.
+error-invalid-blank=Prosimo, določite vrednost.
+error-empty=Prosimo, določite vrednost.
+error-invalid-length=Atribut {0} mora imeti dolžino med {1} in {2}.
+error-invalid-length-too-short=Atribut {0} mora imeti najmanjšo dolžino {1}.
+error-invalid-length-too-long=Atribut {0} mora imeti dolžino največ {2}.
+error-invalid-email=Neveljaven e-poštni naslov.
+error-invalid-number=Neveljavna številka.
+error-number-out-of-range=Atribut {0} mora biti število med {1} in {2}.
+error-number-out-of-range-too-small=Atribut {0} mora imeti vrednost najmanj {1}.
+error-number-out-of-range-too-big=Atribut {0} mora imeti vrednost največ {2}.
+error-pattern-no-match=Neveljavna vrednost.
+error-invalid-uri=Neveljaven URL.
+error-invalid-uri-scheme=Neveljavna URL shema.
+error-invalid-uri-fragment=Neveljaven URL fragment.
+error-user-attribute-required=Prosimo, določite atribut {0}.
+error-invalid-date=Atribut {0} je neveljaven datum.
+error-user-attribute-read-only=Atribut {0} je samo za branje.
+error-username-invalid-character={0} vsebuje neveljaven znak.
+error-person-name-invalid-character={0} vsebuje neveljaven znak.
+error-invalid-multivalued-size=Atribut {0} mora imeti najmanj {1} in največ {2} {2,choice,0#vrednosti|1#vrednost|101#vrednost|201#vrednost|301#vrednost|401#vrednost|501#vrednost|601#vrednost|701#vrednost|801#vrednost|901#vrednost|1001#vrednost|1101#vrednost|1201#vrednost|1301#vrednost|1401#vrednost|1501#vrednost|1601#vrednost|1701#vrednost|1801#vrednost|1901#vrednost|2001#vrednost|2101#vrednost|2201#vrednost|2301#vrednost|2401#vrednost|2501#vrednost|2601#vrednost|2701#vrednost|2801#vrednost|2901#vrednost|3001#vrednost|1<vrednosti}.
diff --git a/themes/src/main/resources-community/theme/base/admin/messages/messages_zh_TW.properties b/themes/src/main/resources-community/theme/base/admin/messages/messages_zh_TW.properties
index c191de4c9d78..57fa4f0123ee 100644
--- a/themes/src/main/resources-community/theme/base/admin/messages/messages_zh_TW.properties
+++ b/themes/src/main/resources-community/theme/base/admin/messages/messages_zh_TW.properties
@@ -66,4 +66,11 @@ error-invalid-date={0} 是無效的日期。
 error-user-attribute-read-only={0} 欄位為唯讀。
 error-username-invalid-character={0} 含有無效字元。
 error-person-name-invalid-character={0} 含有無效字元。
-error-invalid-multivalued-size=屬性 {0} 必須包含至少 {1} ，最多 {2} 個值。
\ No newline at end of file
+error-invalid-multivalued-size=屬性 {0} 必須包含至少 {1} ，最多 {2} 個值。
+
+client_account=帳號
+client_account-console=帳號終端
+client_security-admin-console=安全管理員終端
+client_admin-cli=管理員 cli
+client_realm-management=領域管理
+client_broker=Broker
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/admin/theme.properties b/themes/src/main/resources-community/theme/base/admin/theme.properties
index bf9786c911da..5606ef09f1eb 100644
--- a/themes/src/main/resources-community/theme/base/admin/theme.properties
+++ b/themes/src/main/resources-community/theme/base/admin/theme.properties
@@ -1 +1 @@
-locales=ar,ca,de,el,en,es,fa,fr,fi,hr,it,ja,lt,lv,nl,no,pl,pt,pt-BR,ru,sv,uk,zh-CN,zh-TW
+locales=ar,ca,de,el,en,es,fa,fr,fi,hr,it,ja,ky,lt,lv,nl,no,pl,pt,pt-BR,ru,sl,sv,uk,zh-CN,zh-TW
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ar.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ar.properties
index 7d3529aea988..62e4714a48f0 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_ar.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ar.properties
@@ -1,33 +1,33 @@
 emailVerificationSubject=التحقق من البريد الإلكتروني
 emailVerificationBody=قام شخص ما بإنشاء حساب {2} بعنوان البريد الإلكتروني هذا. إذا كان هذا أنت، فانقر على الرابط أدناه للتحقق من عنوان بريدك الإلكتروني\n\n{0}\n\nستنتهي صلاحية هذا الرابط خلال {3}.\n\nإذا لم تكن قد أنشأت هذا الحساب، فقط تجاهل هذه الرسالة.
-emailVerificationBodyHtml=<p style="direction: rtl;">قام شخص ما بإنشاء حساب {2} بعنوان البريد الإلكتروني هذا. إذا كان هذا أنت، فانقر على الرابط أدناه للتحقق من عنوان بريدك الإلكتروني</p><p style="direction: rtl;"><a href="{0}">رابط التحقق من البريد الإلكتروني</a></p><p style="direction: rtl;">ستنتهي صلاحية هذا الرابط خلال {3}.</p><p style="direction: rtl;">إذا لم تكن قد أنشأت هذا الحساب، فقط تجاهل هذه الرسالة.</p>
+emailVerificationBodyHtml=<p>قام شخص ما بإنشاء حساب {2} بعنوان البريد الإلكتروني هذا. إذا كان هذا أنت، فانقر على الرابط أدناه للتحقق من عنوان بريدك الإلكتروني</p><p><a href="{0}">رابط التحقق من البريد الإلكتروني</a></p><p>ستنتهي صلاحية هذا الرابط خلال {3}.</p><p>إذا لم تكن قد أنشأت هذا الحساب، فقط تجاهل هذه الرسالة.</p>
 emailUpdateConfirmationSubject=التحقق من البريد الإلكتروني الجديد
 emailUpdateConfirmationBody=لتحديث حساب {2} الخاص بك بعنوان البريد الإلكتروني {1}، انقر على الرابط أدناه\n\n{0}\n\nستنتهي صلاحية هذا الرابط خلال {3}.\n\nإذا كنت لا تريد القيام بهذا التعديل، فقط تجاهل هذه الرسالة.
-emailUpdateConfirmationBodyHtml=<p style="direction: rtl;">لتحديث حساب {2} الخاص بك بعنوان البريد الإلكتروني {1}, انقر على الرابط أدناه</p><p style="direction: rtl;"><a href="{0}">{0}</a></p><p style="direction: rtl;">ستنتهي صلاحية هذا الرابط خلال {3}.</p><p style="direction: rtl;">إذا كنت لا تريد القيام بهذا التعديل، فقط تجاهل هذه الرسالة.</p>
+emailUpdateConfirmationBodyHtml=<p>لتحديث حساب {2} الخاص بك بعنوان البريد الإلكتروني {1}, انقر على الرابط أدناه</p><p><a href="{0}">{0}</a></p><p>ستنتهي صلاحية هذا الرابط خلال {3}.</p><p>إذا كنت لا تريد القيام بهذا التعديل، فقط تجاهل هذه الرسالة.</p>
 emailTestSubject=[KEYCLOAK] - رسالة تجربة
 emailTestBody=هذه رسالة تجربة
-emailTestBodyHtml=<p style="direction: rtl;">هذه رسالة تجربة</p>
+emailTestBodyHtml=<p>هذه رسالة تجربة</p>
 identityProviderLinkSubject=ربط {0}
 identityProviderLinkBody=قام شخص ما بطلب ربط الحساب "{1}" بالحساب "{0}" الخاص بالمستخدم {2} . إذا كان هذا أنت، فانقر على الرابط أدناه لإتمام عملية ربط الحسابات\n\n{3}\n\nستنتهي صلاحية هذا الرابط خلال {5}.\n\nإذا كنت لا تريد ربط الحساب، فقط تجاهل هذه الرسالة. إذا قمت بربط الحسابات، فستتمكن من تسجيل الدخول إلى {1} من خلال {0}.
-identityProviderLinkBodyHtml=<p style="direction: rtl;">قام شخص ما بطلب ربط الحساب <b>{1}</b> بالحساب <b>{0}</b> الخاص بالمستخدم {2}. إذا كان هذا أنت، فانقر على الرابط أدناه لإتمام عملية ربط الحسابات</p><p style="direction: rtl;"><a href="{3}">رابط لتأكيد ربط الحساب</a></p><p style="direction: rtl;">ستنتهي صلاحية هذا الرابط خلال {5}.</p><p style="direction: rtl;">إذا كنت لا تريد ربط الحساب، فقط تجاهل هذه الرسالة. إذا قمت بربط الحسابات، فستتمكن من تسجيل الدخول إلى {1} من خلال {0}.</p>
+identityProviderLinkBodyHtml=<p>قام شخص ما بطلب ربط الحساب <b>{1}</b> بالحساب <b>{0}</b> الخاص بالمستخدم {2}. إذا كان هذا أنت، فانقر على الرابط أدناه لإتمام عملية ربط الحسابات</p><p><a href="{3}">رابط لتأكيد ربط الحساب</a></p><p>ستنتهي صلاحية هذا الرابط خلال {5}.</p><p>إذا كنت لا تريد ربط الحساب، فقط تجاهل هذه الرسالة. إذا قمت بربط الحسابات، فستتمكن من تسجيل الدخول إلى {1} من خلال {0}.</p>
 passwordResetSubject=إعادة تعيين كلمة المرور
 passwordResetBody=قام شخص ما بطلب تغيير معلومات الدخول للحساب {2}. إذا كان هذا أنت، فانقر على الرابط أدناه لإعادة تعيين معلومات الدخول.\n\n{0}\n\nستنتهي صلاحية هذا الرابط خلال {3}.\n\nإذا كنت لا تريد إعادة تعيين معلومات الدخول، فقط تجاهل هذه الرسالة.
-passwordResetBodyHtml=<p style="direction: rtl;">قام شخص ما بطلب تغيير معلومات الدخول للحساب {2}. إذا كان هذا أنت، فانقر على الرابط أدناه لإعادة تعيين معلومات الدخول.</p><p style="direction: rtl;"><a href="{0}">رابط إعادة تعيين معلومات الدخول للحساب</a></p><p style="direction: rtl;">ستنتهي صلاحية هذا الرابط خلال {3}.</p><p style="direction: rtl;">إذا كنت لا تريد إعادة تعيين معلومات الدخول، فقط تجاهل هذه الرسالة.</p>
+passwordResetBodyHtml=<p>قام شخص ما بطلب تغيير معلومات الدخول للحساب {2}. إذا كان هذا أنت، فانقر على الرابط أدناه لإعادة تعيين معلومات الدخول.</p><p><a href="{0}">رابط إعادة تعيين معلومات الدخول للحساب</a></p><p>ستنتهي صلاحية هذا الرابط خلال {3}.</p><p>إذا كنت لا تريد إعادة تعيين معلومات الدخول، فقط تجاهل هذه الرسالة.</p>
 executeActionsSubject=تحديث بيانات حسابك
 executeActionsBody=تلقيت طلب من مسؤول النظام لتحديث بيانات حسابك {2} والقيام بالإجراءات المطلوبة التالية: {3}. انقر على الرابط أدناه للبدء.\n\n{0}\n\nستنتهي صلاحية هذا الرابط خلال {4}.\n\nإذا لم تكن على علم بأن مسؤول النظام قد طلب ذلك، فتجاهل هذه الرسالة ولن يتم تغيير أي شيء.
-executeActionsBodyHtml=<p style="direction: rtl;">تلقيت طلب من مسؤول النظام لتحديث بيانات حسابك {2} والقيام بالإجراءات المطلوبة التالية: {3}. انقر على الرابط أدناه للبدء.</p><p style="direction: rtl;"><a href="{0}">رابط تحديث بيانات الحساب</a></p><p style="direction: rtl;">ستنتهي صلاحية هذا الرابط خلال {4}.</p><p style="direction: rtl;">إذا لم تكن على علم بأن مسؤول النظام قد طلب ذلك، فتجاهل هذه الرسالة ولن يتم تغيير أي شيء.</p>
+executeActionsBodyHtml=<p>تلقيت طلب من مسؤول النظام لتحديث بيانات حسابك {2} والقيام بالإجراءات المطلوبة التالية: {3}. انقر على الرابط أدناه للبدء.</p><p><a href="{0}">رابط تحديث بيانات الحساب</a></p><p>ستنتهي صلاحية هذا الرابط خلال {4}.</p><p>إذا لم تكن على علم بأن مسؤول النظام قد طلب ذلك، فتجاهل هذه الرسالة ولن يتم تغيير أي شيء.</p>
 eventLoginErrorSubject=خطأ في تسجيل الدخول
 eventLoginErrorBody=تم رصد محاولة دخول فاشلة على حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.
-eventLoginErrorBodyHtml=<p style="direction: rtl;">تم رصد محاولة دخول فاشلة على حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
+eventLoginErrorBodyHtml=<p>تم رصد محاولة دخول فاشلة على حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
 eventRemoveTotpSubject=إزالة رمز التحقق
 eventRemoveTotpBody=تم إزالة خاصية رمز التحقق من حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.
-eventRemoveTotpBodyHtml=<p style="direction: rtl;">تم إزالة خاصية رمز التحقق من حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
+eventRemoveTotpBodyHtml=<p>تم إزالة خاصية رمز التحقق من حسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
 eventUpdatePasswordSubject=تحديث كلمة المرور
 eventUpdatePasswordBody=تم تغيير كلمة المرور الخاصة بك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.
-eventUpdatePasswordBodyHtml=<p style="direction: rtl;">تم تغيير كلمة المرور الخاصة بك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
+eventUpdatePasswordBodyHtml=<p>تم تغيير كلمة المرور الخاصة بك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
 eventUpdateTotpSubject=تحديث خاصية رمز التحقق
 eventUpdateTotpBody=تم تحديث حاصية رمز التحقق لحسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.
-eventUpdateTotpBodyHtml=<p style="direction: rtl;">تم تحديث حاصية رمز التحقق لحسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
+eventUpdateTotpBodyHtml=<p>تم تحديث حاصية رمز التحقق لحسابك في {0} ومن {1}. إذا لم تكن أنت، يرجى التواصل مع مسؤول النظام.</p>
 
 requiredAction.CONFIGURE_TOTP=إعداد خاصية رمز التحقق
 requiredAction.TERMS_AND_CONDITIONS=الأحكام والشروط
@@ -43,5 +43,5 @@ linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#ساعة|3#ساعات|9
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#يوم|3#أيام|9<يوم}
 
 emailVerificationBodyCode=يرجى التحقق من عنوان بريدك الإلكتروني عن طريق إدخال الرمز التالي.\n\n{0}\n\n.
-emailVerificationBodyCodeHtml=<p style="direction: rtl;">يرجى التحقق من عنوان بريدك الإلكتروني عن طريق إدخال الرمز التالي.</p><p style="direction: rtl;"><b>{0}</b></p>
+emailVerificationBodyCodeHtml=<p>يرجى التحقق من عنوان بريدك الإلكتروني عن طريق إدخال الرمز التالي.</p><p><b>{0}</b></p>
 
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ca.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ca.properties
index 75e0dcb42bd6..1242b947a0bd 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_ca.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ca.properties
@@ -8,8 +8,8 @@ emailTestSubject=[KEYCLOAK] - missatge de prova SMTP
 emailTestBody=Aquest és un missatge de prova
 emailTestBodyHtml=<p>Aquest és un missatge de prova</p>
 identityProviderLinkSubject=Enllaç a {0}
-identityProviderLinkBody=Algú ha sol·licitat enllaçar el vostre compte «{1}» amb el compte «{0}» de l''usuari {2}. Si heu estat vós, feu clic a l''enllaç de sota per a enllaçar els comptes\n\n{3}\n\nAquest enllaç caducarà en {5}.\n\nSi no voleu enllaçar el compte, simplement ignoreu aquest missatge. Si enllaceu els comptes, podreu identificar-vos a {1} a través de {0}.
-identityProviderLinkBodyHtml=<p>Algú ha sol·licitat enllaçar el vostre compte <b>{1}</b> amb el compte <b>{0}</b> de l''usuari {2}. Si heu estat vós, feu clic a l''enllaç de sota per a enllaçar els comptes</p><a href="{3}">Enllaç per a confirmar l''enllaçat de comptes</a><p><p>Aquest enllaç caducarà en {5}.</p><p>Si no voleu enllaçar el compte, simplement ignoreu aquest missatge. Si enllaceu els comptes, podreu identificar-vos a {1} a través de {0}.</p>
+identityProviderLinkBody=Algú vol enllaçar el vostre compte «{1}» amb el compte «{0}» de l’usuari {2}. Si heu estat vós, feu clic a l’enllaç de sota per a enllaçar els comptes\n\n{3}\n\nAquest enllaç caducarà en {5}.\n\nSi no heu estat vós qui ha iniciat el procés o no voleu enllaçar el compte, ignoreu aquest missatge. Si enllaceu els comptes, podreu identificar-vos a {1} a través de {0}.
+identityProviderLinkBodyHtml=<p>Algú vol enllaçar el vostre compte <b>{1}</b> amb el compte <b>{0}</b> de l’usuari {2}. Si heu estat vós, feu clic a l’enllaç de sota per a enllaçar els comptes</p><p><a href="{3}">Enllaç per a confirmar l’enllaç de comptes</a></p><p>Aquest enllaç caducarà en {5}.</p><p>Si no heu estat vós qui ha iniciat el procés o no voleu enllaçar el compte, ignoreu aquest missatge. Si enllaceu els comptes, podreu identificar-vos a {1} a través de {0}.</p>
 passwordResetSubject=Restabliu la contrasenya
 passwordResetBody=Algú ha demanat canviar les credencials del vostre compte de {2}. Si heu estat vós, feu clic a l''enllaç següent per a restablir-les.\n\n{0}\n\nAquest enllaç i codi caducaran en {3}.\n\nSi no voleu restablir les vostres credencials, simplement ignoreu aquest missatge i no es realitzarà cap canvi.
 passwordResetBodyHtml=<p>Algú ha demanat canviar les credencials del vostre compte de {2}. Si heu estat vós, feu clic a l''enllaç següent per a restablir-les.</p><p><a href="{0}">Enllaç per a restablir les credencials</a></p><p>Aquest enllaç caducarà en {3}.</p><p>Si no voleu restablir les vostres credencials, simplement ignoreu aquest missatge i no es realitzarà cap canvi.</p>
@@ -47,16 +47,16 @@ emailVerificationBodyCode=Verifiqueu el vostre correu electrònic introduint el
 emailVerificationBodyCodeHtml=<p>Verifiqueu el vostre correu electrònic introduint el codi següent.</p><p> <b>{0}</b></p>
 
 
-orgInviteBodyPersonalized=Hola, {5} {6}.\n\nHeu estat convidat a unir-vos a l''organització «{3}». Feu clic a l''enllaç següent per a unir-vos-hi.\n\n{0}\n\nAquest enllaç caducarà el {4}.\n\nSi no us voleu unir a l''organització, podeu ignorar aquest missatge.
-orgInviteBodyHtml=<p>Heu estat convidat a unir-vos a l'organització «{3}». Feu clic a l'enllaç següent per a unir-vos-hi.</p><p><a href="{0}">Enllaç per a unir-se a l'organització</a></p><p>Aquest enllaç caducarà el {4}.</p><p>Si no us voleu unir a l'organització, podeu ignorar aquest missatge.</p>
-orgInviteBody=Heu estat convidat a unir-vos a l''organització «{3}». Feu clic a l''enllaç següent per a unir-vos-hi.\n\n{0}\n\nAquest enllaç caducarà el {4}.\n\nSi no us voleu unir a l''organització, podeu ignorar aquest missatge.
-orgInviteBodyPersonalizedHtml=<p>Hola, {5} {6}</p><p>Heu estat convidat a unir-vos a l''organització «{3}». Feu clic a l''enllaç següent per a unir-vos-hi.</p><p><a href="{0}">Enllaç per a unir-se a l''organització</a></p><p>Aquest enllaç caducarà el {4}.</p><p>Si no us voleu unir a l''organització, podeu ignorar aquest missatge.</p>
+orgInviteBodyPersonalized=Hola, {5} {6}.\n\nHeu estat convidat a unir-vos a l’organització «{3}». Feu clic a l’enllaç següent per a unir-vos-hi.\n\n{0}\n\nAquest enllaç caducarà el {4}.\n\nSi no us voleu unir a l’organització, podeu ignorar aquest missatge.
+orgInviteBodyHtml=<p>Heu estat convidat a unir-vos a l''organització «{3}». Feu clic a l''enllaç següent per a unir-vos-hi.</p><p><a href="{0}">Enllaç per a unir-se a l''organització</a></p><p>Aquest enllaç caducarà el {4}.</p><p>Si no us voleu unir a l''organització, podeu ignorar aquest missatge.</p>
+orgInviteBody=Heu estat convidat a unir-vos a l’organització «{3}». Feu clic a l’enllaç següent per a unir-vos-hi.\n\n{0}\n\nAquest enllaç caducarà el {4}.\n\nSi no us voleu unir a l’organització, podeu ignorar aquest missatge.
+orgInviteBodyPersonalizedHtml=<p>Hola, {5} {6}</p><p>Heu estat convidat a unir-vos a l’organització «{3}». Feu clic a l’enllaç següent per a unir-vos-hi.</p><p><a href="{0}">Enllaç per a unir-se a l’organització</a></p><p>Aquest enllaç caducarà el {4}.</p><p>Si no us voleu unir a l’organització, podeu ignorar aquest missatge.</p>
 orgInviteSubject=Invitació per a unir-vos a l''organització {0}
 eventUpdateCredentialSubject=Actualització de la credencial
 eventRemoveCredentialSubject=Supressió de la credencial
 eventUserDisabledByTemporaryLockoutSubject=L''usuari és inhabilitat per un bloqueig temporal
-eventUserDisabledByPermanentLockoutSubject=L'usuari és inhabilitat per un bloqueig permanent
-eventUserDisabledByTemporaryLockoutBody=El vostre usuari ha estat inhabilitat temporalment per múltiples atempts fallits en {0}. Contacteu amb un administrador si ho necessiteu.
+eventUserDisabledByPermanentLockoutSubject=L''usuari és inhabilitat per un bloqueig permanent
+eventUserDisabledByTemporaryLockoutBody=El vostre usuari ha estat inhabilitat temporalment per múltiples intents fallits en {0}. Contacteu amb un administrador si ho necessiteu.
 eventUpdateCredentialBody=S''han canviat les vostres credencials {0} el {1} des de {2}. Si no en sabeu res, contacteu amb l''administrador.
 eventUserDisabledByTemporaryLockoutHtml=<p>El vostre usuari ha estat inhabilitat temporalment per múltiples intents fallits en {0}. Contacteu amb un administrador si ho necessiteu.</p>
 eventUserDisabledByPermanentLockoutHtml=<p>El vostre usuari ha estat inhabilitat permanentment per múltiples intents fallits en {0}. Contacteu amb un administrador.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_cs.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_cs.properties
index 81ed905b4486..9b1064cf4f28 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_cs.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_cs.properties
@@ -1,21 +1,26 @@
 emailVerificationSubject=Ověření e-mailu
 emailVerificationBody=Někdo vytvořil účet {2} s touto e-mailovou adresou. Pokud jste to vy, klikněte na níže uvedený odkaz a ověřte svou e-mailovou adresu \n\n{0}\n\nTento odkaz vyprší za {3}.\n\nPokud jste tento účet nevytvořili, tuto zprávu ignorujte.
 emailVerificationBodyHtml=<p>Někdo vytvořil účet {2} s touto e-mailovou adresou. Pokud jste to vy, klikněte na níže uvedený odkaz a ověřte svou e-mailovou adresu. </p><p><a href="{0}">Odkaz na ověření e-mailové adresy</a></p><p>Platnost odkazu vyprší za {3}.</p><p>Pokud jste tento účet nevytvořili, tuto zprávu ignorujte.</p>
+orgInviteSubject=Pozvánka do organizace {0}
+orgInviteBody=Někdo Vás pozval do organizace "{3}". Pro přidání se klikněte na odkaz níže.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nPokud se do organizace nechcete přidat, ignorujte tuto zprávu.
+orgInviteBodyHtml=<p>Někdo Vás pozval do organizace {3}. Pro přidání se klikněte na odkaz níže. </p><p><a href="{0}">Odkaz pro přidání se do organizace</a></p><p>Tento odkaz vyprší za {4}.</p><p>Pokud se do organizace nechcete přidat, ignorujte tuto zprávu.</p>
+orgInviteBodyPersonalized=Dobrý den, "{5}" "{6}".\n\n Někdo Vás pozval do organizace "{3}". Pro přidání se klikněte na odkaz níže.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nPokud se do organizace nechcete přidat, ignorujte tuto zprávu.
+orgInviteBodyPersonalizedHtml=<p>Dobrý den, {5} {6}.</p><p>Někdo Vás pozval do organizace {3}. Pro přidání se klikněte na odkaz níže. </p><p><a href="{0}">Odkaz pro přidání se do organizace</a></p><p>Tento odkaz vyprší za {4}.</p><p>Pokud se do organizace nechcete přidat, ignorujte tuto zprávu.</p>
 emailUpdateConfirmationSubject=Ověření nového e-mailu
-emailUpdateConfirmationBody=Pro aktualizaci e-mailové adresy {1} u vašeho účtu {2} klikněte na odkaz níže\n\n{0}\n\nTento odkaz expiruje za {3}.\n\nPokud tuto změnu nechcete provést, ignorujte tuto zprávu.
-emailUpdateConfirmationBodyHtml=<p>Pro aktualizaci e-mailové adresy {1} u vašeho účtu {2} klikněte na odkaz níže</p><p><a href="{0}">{0}</a></p><p>Tento odkaz expiruje za {3}.</p><p>Pokud tuto změnu nechcete provést, ignorujte tuto zprávu.</p>
+emailUpdateConfirmationBody=Pro aktualizaci e-mailové adresy {1} u Vašeho účtu {2} klikněte na odkaz níže\n\n{0}\n\nTento odkaz expiruje za {3}.\n\nPokud tuto změnu nechcete provést, ignorujte tuto zprávu.
+emailUpdateConfirmationBodyHtml=<p>Pro aktualizaci e-mailové adresy {1} u Vašeho účtu {2} klikněte na odkaz níže</p><p><a href="{0}">{0}</a></p><p>Tento odkaz expiruje za {3}.</p><p>Pokud tuto změnu nechcete provést, ignorujte tuto zprávu.</p>
 emailTestSubject=[KEYCLOAK] - testovací zpráva
 emailTestBody=Toto je testovací zpráva
 emailTestBodyHtml=<p>Toto je testovací zpráva </p>
 identityProviderLinkSubject=Odkaz {0}
-identityProviderLinkBody=Někdo chce propojit váš účet "{1}" s účtem "{0}" uživatele {2}. Pokud jste to vy, klikněte na níže uvedený odkaz a propojte účty. \n\n{3}\n\nPlatnost tohoto odkazu je {5}.\n\nPokud nechcete propojit účet, tuto zprávu ignorujte. Pokud propojíte účty, budete se moci přihlásit jako {1} pomocí {0}.
-identityProviderLinkBodyHtml=<p>Někdo chce propojit váš účet <b>{1}</b> s účtem <b>{0}</b> uživatele {2}. Pokud jste to vy, klikněte na níže uvedený odkaz a propojte účty.</p><p><a href="{3}">Odkaz na propojení účtů.</a></p><p> Platnost tohoto odkazu je {5}. </p><p> Pokud nechcete propojit účet, tuto zprávu ignorujte. Pokud propojíte účty, budete se moci přihlásit jako {1} pomocí {0}.</p>
+identityProviderLinkBody=Někdo chce propojit Váš účet "{1}" s účtem "{0}" uživatele {2}. Pokud jste to vy, klikněte na níže uvedený odkaz a propojte účty. \n\n{3}\n\nPlatnost tohoto odkazu je {5}.\n\nPokud nechcete propojit účet, tuto zprávu ignorujte. Pokud propojíte účty, budete se moci přihlásit jako {1} pomocí {0}.
+identityProviderLinkBodyHtml=<p>Někdo chce propojit Váš účet <b>{1}</b> s účtem <b>{0}</b> uživatele {2}. Pokud jste to vy, klikněte na níže uvedený odkaz a propojte účty.</p><p><a href="{3}">Odkaz na propojení účtů.</a></p><p> Platnost tohoto odkazu je {5}. </p><p> Pokud nechcete propojit účet, tuto zprávu ignorujte. Pokud propojíte účty, budete se moci přihlásit jako {1} pomocí {0}.</p>
 passwordResetSubject=Zapomenuté heslo
-passwordResetBody=Někdo právě požádal o změnu hesla u vašeho účtu {2}. Pokud jste to vy, pro jeho změnu klikněte na odkaz níže.\n\n{0}\n\nPlatnost tohoto odkazu je {3}.\n\nPokud heslo změnit nechcete, tuto zprávu ignorujte a nic se nezmění.
-passwordResetBodyHtml=<p>Někdo právě požádal o změnu pověření vašeho účtu {2}. Pokud jste to vy, klikněte na odkaz níže, abyste je resetovali.</p><p><a href="{0}">Odkaz na obnovení pověření </a></p><p> Platnost tohoto odkazu vyprší během {3}.</p><p> Pokud nechcete obnovit vaše pověření, ignorujte tuto zprávu a nic se nezmění.</p>
+passwordResetBody=Někdo právě požádal o změnu hesla u Vašeho účtu {2}. Pokud jste to vy, pro jeho změnu klikněte na odkaz níže.\n\n{0}\n\nPlatnost tohoto odkazu je {3}.\n\nPokud heslo změnit nechcete, tuto zprávu ignorujte a nic se nezmění.
+passwordResetBodyHtml=<p>Někdo právě požádal o změnu pověření Vašeho účtu {2}. Pokud jste to vy, klikněte na odkaz níže, abyste je resetovali.</p><p><a href="{0}">Odkaz na obnovení pověření </a></p><p> Platnost tohoto odkazu vyprší během {3}.</p><p> Pokud nechcete obnovit Vaše pověření, ignorujte tuto zprávu a nic se nezmění.</p>
 executeActionsSubject=Aktualizujte svůj účet
-executeActionsBody=Váš administrátor vás požádal o provedení následujících akcí u účtu {2}: {3}. Začněte kliknutím na níže uvedený odkaz.\n\n{0}\n\nPlatnost tohoto odkazu je {4}.\n\nPokud si nejste jisti, zda je tento požadavek v pořádku, ignorujte tuto zprávu.
-executeActionsBodyHtml=<p>Váš administrátor vás požádal o provedení následujících akcí u účtu {2}: {3}. Začněte kliknutím na níže uvedený odkaz.</p><p><a href="{0}">Odkaz na aktualizaci účtu.</a></p><p>Platnost tohoto odkazu je {4}.</p><p>Pokud si nejste jisti, zda je tento požadavek v pořádku, ignorujte tuto zprávu.</p>
+executeActionsBody=Váš administrátor Vás požádal o provedení následujících akcí u účtu {2}: {3}. Začněte kliknutím na níže uvedený odkaz.\n\n{0}\n\nPlatnost tohoto odkazu je {4}.\n\nPokud si nejste jisti, zda je tento požadavek v pořádku, ignorujte tuto zprávu.
+executeActionsBodyHtml=<p>Váš administrátor Vás požádal o provedení následujících akcí u účtu {2}: {3}. Začněte kliknutím na níže uvedený odkaz.</p><p><a href="{0}">Odkaz na aktualizaci účtu.</a></p><p>Platnost tohoto odkazu je {4}.</p><p>Pokud si nejste jisti, zda je tento požadavek v pořádku, ignorujte tuto zprávu.</p>
 eventLoginErrorSubject=Chyba přihlášení
 eventLoginErrorBody=Někdo se neúspěšně pokusil přihlásit k účtu {0} z {1}. Pokud jste to nebyli vy, kontaktujte administrátora.
 eventLoginErrorBodyHtml=<p>Někdo se neúspěšně pokusil přihlásit k účtu {0} z {1}. Pokud jste to nebyli vy, kontaktujte administrátora.</p>
@@ -28,6 +33,18 @@ eventUpdatePasswordBodyHtml=<p>V účtu {0} bylo změněno heslo z {1}. Pokud js
 eventUpdateTotpSubject=Aktualizace OTP
 eventUpdateTotpBody=V účtu {0} bylo změněno nastavení OTP z {1}. Pokud jste to nebyli vy, kontaktujte administrátora.
 eventUpdateTotpBodyHtml=<p>V účtu {0} bylo změněno nastavení OTP z {1}. Pokud jste to nebyli vy, kontaktujte administrátora.</p>
+eventUpdateCredentialSubject=Aktualizace přihlašovacího údaje
+eventUpdateCredentialBody=Váš přihlašovací údaj {0} se změnil na {1} z {2}. Pokud jste to nebyli vy, kontaktujte administrátora.
+eventUpdateCredentialBodyHtml=<p>Váš přihlašovací údaj {0} se změnil na {1} z {2}. Pokud jste to nebyli vy, kontaktujte administrátora.</p>
+eventRemoveCredentialSubject=Odstranění přihlašovacího údaje
+eventRemoveCredentialBody=Přihlašovací údaj {0} byl odstraněn z Vašeho účtu na {1} z {2}. Pokud jste to nebyli vy, kontaktujte administrátora.
+eventRemoveCredentialBodyHtml=<p>Přihlašovací údaj {0} byl odstraněn z Vašeho účtu na {1} z {2}. Pokud jste to nebyli vy, kontaktujte administrátora.</p>
+eventUserDisabledByTemporaryLockoutSubject=Uživatel dočasně zablokován
+eventUserDisabledByTemporaryLockoutBody=Váš uživatel byl dočasně zablokován kvůli několika špatným pokusům na {0}. Kontaktujte prosím administrátora, pokud je to potřeba.
+eventUserDisabledByTemporaryLockoutHtml=<p>Váš uživatel byl dočasně zablokován kvůli několika špatným pokusům na {0}. Kontaktujte prosím administrátora, pokud je to potřeba.</p>
+eventUserDisabledByPermanentLockoutSubject=Uživatel trvale zablokován
+eventUserDisabledByPermanentLockoutBody=Váš uživatel byl trvale zablokován kvůli několika špatným pokusům na {0}. Kontaktujte prosím administrátora, pokud je to potřeba.
+eventUserDisabledByPermanentLockoutHtml=<p>Váš uživatel byl trvale zablokován kvůli několika špatným pokusům na {0}. Kontaktujte prosím administrátora, pokud je to potřeba.</p>
 
 requiredAction.CONFIGURE_TOTP=Konfigurace OTP
 requiredAction.TERMS_AND_CONDITIONS=Smluvní podmínky
@@ -47,4 +64,3 @@ linkExpirationFormatter.timePeriodUnit.days={0,choice,0#dní|1#den|2#dny|4<dní}
 
 emailVerificationBodyCode=Ověřte prosím svou e-mailovou adresu zadáním následujícího kódu.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>Ověřte prosím svou e-mailovou adresu zadáním následujícího kódu.</p><p><b>{0}</b></p>
-
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_da.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_da.properties
index 9c769d03ddff..4cfca925499e 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_da.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_da.properties
@@ -6,7 +6,7 @@ emailTestBody=Dette er en test besked
 emailTestBodyHtml=<p>Dette er en test besked</p>
 identityProviderLinkSubject=Link {0}
 identityProviderLinkBody=Nogen vil forbinde din "{1}" konto med "{0}" kontoen som er tilknyttet brugeren {2}. Hvis dette var dig, bedes du klikke på forbindet herunder for at forbinde de to konti\n\n{3}\n\nDette link vil udløbe efter {5}.\n\nHvis du ikke vil forbinde disse konti, kan du bare ignore denne besked. Hvis du vælger at forbinde de to konti, kan du logge ind som {1} via {0}.
-identityProviderLinkBodyHtml=<p>Nogen vil forbinde din <b>{1}</b> konto med <b>{0}</b> kontoen som er tilknyttet brugeren {2}. Hvis dette var dig, bedes du klikke på forbindet herunder for at forbinde de to konti</p><p><a href="{3}">Bekræft</a></p><p>Dette link vil udløbe efter {5}.</p><p>nHvis du ikke vil forbinde disse konti, kan du bare ignore denne besked. Hvis du vælger at forbinde de to konti, kan du logge ind som {1} via {0}.
+identityProviderLinkBodyHtml=<p>Nogen vil forbinde din <b>{1}</b> konto med <b>{0}</b> kontoen som er tilknyttet brugeren {2}. Hvis dette var dig, bedes du klikke på forbindet herunder for at forbinde de to konti</p><p><a href="{3}">Bekræft</a></p><p>Dette link vil udløbe efter {5}.</p><p>nHvis du ikke vil forbinde disse konti, kan du bare ignore denne besked. Hvis du vælger at forbinde de to konti, kan du logge ind som {1} via {0}.</p>
 passwordResetSubject=Gendan adgangskode
 passwordResetBody=Nogen har forsøgt at nulstille adgangskoden til {2}. Hvis dette var dig, bedes du klikke på linket herunder for at nulstille adgangskoden.\n\n{0}\n\nDette link og kode vil udløbe efter {3}.\n\nHvis du ikke ønsker at nulstille din adgangskode, kan du se bort fra denne besked.
 passwordResetBodyHtml=<p>Nogen har forsøgt at nulstille adgangskoden til {2}. Hvis dette var dig, bedes du klikke på linket herunder for at nulstille adgangskoden.</p><p><a href="{0}">Nulstil adgangskode</a></p><p>Dette link og kode vil udløbe efter {3}.</p><p>Hvis du ikke ønsker at nulstille din adgangskode, kan du se bort fra denne besked.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_de.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_de.properties
index 2ea1c27c71b0..4a19f4133617 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_de.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_de.properties
@@ -5,11 +5,11 @@ emailUpdateConfirmationSubject=Neue E-Mail verifizieren
 emailUpdateConfirmationBody=Um Ihren {2} Account mit der E-Mail-Adresse {1} zu verifizieren, klicken Sie den folgenden Link\n\n{0}\n\nDer Link ist {3} gültig.\n\nSollten Sie die neue E-Mail-Adresse nicht verwenden wollen, ignorieren Sie diese Nachricht.
 emailUpdateConfirmationBodyHtml=<p>Um Ihren {2} Account mit der E-Mail-Adresse {1} zu verifizieren, klicken Sie den folgenden Link</p><p><a href="{0}">{0}</a></p><p>Der Link ist {3} gültig.</p><p>Sollten Sie die neue E-Mail-Adresse nicht verwenden wollen, ignorieren Sie diese Nachricht.</p>
 identityProviderLinkSubject=Link {0}
-identityProviderLinkBody=Es wurde beantragt Ihren Account "{1}" mit dem Account "{0}" von Benutzer {2} zu verlinken. Sollten Sie dies beantragt haben, klicken Sie auf den unten stehenden Link.\n\n{3}\n\nDer Link ist {5} gültig.\n\nSollten Sie Ihren Account nicht verlinken wollen, ignorieren Sie diese Nachricht. Wenn Sie die Accounts verlinken wird ein Login auf {1} über {0} ermöglicht.
-identityProviderLinkBodyHtml=<p>Es wurde beantragt Ihren Account <b>{1}</b> mit dem Account <b>{0}</b> von Benutzer {2} zu verlinken. Sollten Sie dies beantragt haben, klicken Sie auf den unten stehenden Link.</p><p><a href="{3}">Link zur Bestätigung der Kontoverknüpfung</a></p><p>Der Link ist {5} gültig.</p><p>Sollten Sie Ihren Account nicht verlinken wollen, ignorieren Sie diese Nachricht. Wenn Sie die Accounts verlinken wird ein Login auf {1} über {0} ermöglicht.</p>
+identityProviderLinkBody=Es wurde beantragt Ihren Account "{1}" mit dem Account "{0}" von Benutzer {2} zu verlinken. Sollten Sie dies beantragt haben, klicken Sie auf den unten stehenden Link.\n\n{3}\n\nDer Link ist {5} gültig.\n\nSollten Sie dies nicht veranlasst haben oder Ihren Account nicht verlinken wollen, ignorieren Sie diese Nachricht. Wenn Sie die Accounts verlinken wird ein Login auf {1} über {0} ermöglicht.
+identityProviderLinkBodyHtml=<p>Es wurde beantragt Ihren Account <b>{1}</b> mit dem Account <b>{0}</b> von Benutzer {2} zu verlinken. Sollten Sie dies beantragt haben, klicken Sie auf den unten stehenden Link.</p><p><a href="{3}">Link zur Bestätigung der Kontoverknüpfung</a></p><p>Der Link ist {5} gültig.</p><p>Sollten Sie dies nicht veranlasst haben oder Ihren Account nicht verlinken wollen, ignorieren Sie diese Nachricht. Wenn Sie die Accounts verlinken wird ein Login auf {1} über {0} ermöglicht.</p>
 passwordResetSubject=Passwort zurücksetzen
-passwordResetBody=Es wurde eine Änderung der Berechtigungsnachweise für Ihren Account {2} angefordert. Wenn Sie diese Änderung beantragt haben, klicken Sie auf den unten stehenden Link.\n\n{0}\n\nDer Link ist {3} gültig.\n\nSollten Sie keine Änderung vollziehen wollen können Sie diese Nachricht ignorieren und an Ihrem Account wird nichts geändert.
-passwordResetBodyHtml=<p>Es wurde eine Änderung der Berechtigungsnachweise für Ihren Account {2} angefordert. Wenn Sie diese Änderung beantragt haben, klicken Sie auf den unten stehenden Link.</p><p><a href="{0}">Link zum Zurücksetzen von Berechtigungsnachweise</a></p><p>Der Link ist {3} gültig.</p><p>Sollten Sie keine Änderung vollziehen wollen können Sie diese Nachricht ignorieren und an Ihrem Account wird nichts geändert.</p>
+passwordResetBody=Es wurde eine Änderung der Zugangsdaten für Ihren Account {2} angefordert. Wenn Sie diese Änderung beantragt haben, klicken Sie auf den unten stehenden Link.\n\n{0}\n\nDer Link ist {3} gültig.\n\nSollten Sie keine Änderung vollziehen wollen können Sie diese Nachricht ignorieren und an Ihrem Account wird nichts geändert.
+passwordResetBodyHtml=<p>Es wurde eine Änderung der Zugangsdaten für Ihren Account {2} angefordert. Wenn Sie diese Änderung beantragt haben, klicken Sie auf den unten stehenden Link.</p><p><a href="{0}">Link zum Zurücksetzen von Zugangsdaten</a></p><p>Der Link ist {3} gültig.</p><p>Sollten Sie keine Änderung vollziehen wollen können Sie diese Nachricht ignorieren und an Ihrem Account wird nichts geändert.</p>
 executeActionsSubject=Aktualisieren Sie Ihr Konto
 executeActionsBody=Ihr Administrator hat Sie aufgefordert Ihren Account {2} zu aktualisieren und folgende Aktion(en) durchzuführen: {3}. Klicken Sie auf den unten stehenden Link um den Prozess zu starten.\n\n{0}\n\nDer Link ist {4} gültig.\n\nSollten Sie sich dieser Aufforderung nicht bewusst sein, ignorieren Sie diese Nachricht und Ihr Account bleibt unverändert.
 executeActionsBodyHtml=<p>Ihr Administrator hat Sie aufgefordert Ihren Account {2} zu aktualisieren und folgende Aktion(en) durchzuführen: {3}. Klicken Sie auf den unten stehenden Link um den Prozess zu starten.</p><p><a href="{0}">Link zum Account-Update</a></p><p>Der Link ist {4} gültig.</p><p>Sollten Sie sich dieser Aufforderung nicht bewusst sein, ignorieren Sie diese Nachricht und Ihr Account bleibt unverändert.</p>
@@ -47,12 +47,12 @@ orgInviteSubject=Einladung der Organization {0} beizutreten
 orgInviteBody=Sie wurden eingeladen, der "{3}" Organization beizutreten. Klicken Sie auf den Link unten, um ihr beizutreten.\n\n{0}\n\nDieser Link läuft innerhalb von {4} ab.\n\nWenn Sie nicht der Organization beitreten wollen, ignorieren Sie diese Nachricht.
 orgInviteBodyHtml=<p>Sie wurden eingeladen, der {3} Organization beizutreten. Klicken Sie auf den Link unten, um ihr beizutreten. </p><p><a href="{0}">Link zur Organization</a></p><p> Dieser Link wird innerhalb von {4} ablaufen.</p><p> Wenn Sie der Organization nicht beitreten möchten, ignorieren Sie diese Nachricht.</p>
 orgInviteBodyPersonalized=Hi, "{5}" "{6}".\n\nSie wurden eingeladen, der "{3}" Organization beizutreten. Klicken Sie auf den Link unten, um sich anzuschließen.\n\n{0}\n\nDieser Link läuft innerhalb von {4} ab.\n\nWenn Sie nicht der Organization beitreten wollen, ignorieren Sie diese Nachricht.
-eventRemoveCredentialBodyHtml=<p>Berechtigungsnachweis {0} wurde auf {1} von {2} von Ihrem Konto entfernt. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.</p>
-eventUpdateCredentialSubject=Berechtigungsnachweise aktualisieren
-eventRemoveCredentialSubject=Berechtigungsnachweise entfernen
-eventUpdateCredentialBody=Ihre {0} Berechtigungsnachweise wurden auf {1} von {2} geändert. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.
-eventUpdateCredentialBodyHtml=<p>Ihre {0} Berechtigungsnachweise wurden auf {1} von {2} geändert. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.</p>
-eventRemoveCredentialBody=Berechtigungsnachweis {0} wurde auf {1} von {2} von Ihrem Konto entfernt. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.
+eventRemoveCredentialBodyHtml=<p> Zugangsdaten {0} wurde auf {1} von {2} von Ihrem Konto entfernt. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.</p>
+eventUpdateCredentialSubject=Zugangsdaten aktualisieren
+eventRemoveCredentialSubject=Zugangsdaten entfernen
+eventUpdateCredentialBody=Ihre {0} Zugangsdaten wurden auf {1} von {2} geändert. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.
+eventUpdateCredentialBodyHtml=<p>Ihre {0} Zugangsdaten wurden auf {1} von {2} geändert. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.</p>
+eventRemoveCredentialBody=Zugangsdaten {0} wurde auf {1} von {2} von Ihrem Konto entfernt. Wenn Sie das nicht waren, wenden Sie sich bitte an einen Administrator.
 eventUserDisabledByTemporaryLockoutSubject=Benutzer durch vorübergehende Sperre deaktiviert
 eventUserDisabledByPermanentLockoutSubject=Benutzer durch permanente Sperre deaktiviert
 eventUserDisabledByPermanentLockoutHtml=<p>Ihr Benutzer wurde aufgrund mehrerer fehlgeschlagener Versuche auf {0} dauerhaft deaktiviert. Bitte kontaktieren Sie einen Administrator.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_es.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_es.properties
index 62cd9b443d35..e5e1c87dc9a6 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_es.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_es.properties
@@ -1,24 +1,24 @@
 emailVerificationSubject=Verificación de email
-emailVerificationBody=Alguien ha creado una cuenta de {2} con esta dirección de email. Si has sido tú, haz click en el enlace siguiente para verificar tu dirección de email.\n\n{0}\n\nEste enlace expirará en {3} minutos.\n\nSi tú no has creado esta cuenta, simplemente ignora este mensaje.
-emailVerificationBodyHtml=<p>Alguien ha creado una cuenta de {2} con esta dirección de email. Si has sido tú, haz click en el enlace siguiente para verificar tu dirección de email.</p><p><a href="{0}">Enlace de verficación de dirección de email</a></p><p>Este enlace expirará en {3} minutos.</p><p>Si tú no has creado esta cuenta, simplemente ignora este mensaje.</p>
+emailVerificationBody=Alguien ha creado una cuenta de {2} con esta dirección de email. Si ha sido usted, haga click en el enlace siguiente para verificar su dirección de email.\n\n{0}\n\nEste enlace expirará en {3} minutos.\n\nSi usted no ha creado esta cuenta, simplemente ignore este mensaje.
+emailVerificationBodyHtml=<p>Alguien ha creado una cuenta de {2} con esta dirección de email. Si ha sido usted, haga click en el enlace siguiente para verificar su dirección de email.</p><p><a href="{0}">Enlace de verificación de dirección de email</a></p><p>Este enlace expirará en {3} minutos.</p><p>Si no ha creado esta cuenta, simplemente ignore este mensaje.</p>
 passwordResetSubject=Reiniciar contraseña
-passwordResetBody=Alguien ha solicitado cambiar las credenciales de tu cuenta de {2}. Si has sido tú, haz clic en el enlace siguiente para reiniciarlas.\n\n{0}\n\nEste enlace expirará en {3} minutos.\n\nSi no quieres reiniciar tus credenciales, simplemente ignora este mensaje y no se realizará ningún cambio.
-passwordResetBodyHtml=<p>Alguien ha solicitado cambiar las credenciales de tu cuenta de {2}. Si has sido tú, haz clic en el enlace siguiente para reiniciarlas.</p><p><a href="{0}">Enlace para actualizar la cuenta</a></p><p>Este enlace expirará en {3} minutos.</p><p>Si no quieres reiniciar tus credenciales, simplemente ignora este mensaje y no se realizará ningún cambio.</p>
+passwordResetBody=Alguien ha solicitado cambiar las credenciales de tu cuenta de {2}. Si ha sido usted, haga clic en el enlace siguiente para reiniciarlas.\n\n{0}\n\nEste enlace expirará en {3} minutos.\n\nSi no quiere reiniciar sus credenciales, simplemente ignore este mensaje y no se realizará ningún cambio.
+passwordResetBodyHtml=<p>Alguien ha solicitado cambiar las credenciales de su cuenta de {2}. Si ha sido usted, haga clic en el enlace siguiente para reiniciarlas.</p><p><a href="{0}">Enlace para actualizar la cuenta</a></p><p>Este enlace expirará en {3} minutos.</p><p>Si no quiere reiniciar tus credenciales, simplemente ignore este mensaje y no se realizará ningún cambio.</p>
 executeActionsSubject=Actualiza tu cuenta
-executeActionsBody=Tu administrador ha solicitado que actualices tu cuenta {2} realizando la(s) siguiente(s) acción(es): {3}. Haz clic en el enlace de abajo para comenzar este proceso.\n\n{0}\n\nEste enlace expirará en {4} minutos.\n\nSi no estás al tanto de que el administrador haya solicitado esto, simplemente ignora este mensaje y no se realizará ningún cambio.
-executeActionsBodyHtml=<p>Tu administrador ha solicitado que actualices tu cuenta {2} realizando la(s) siguiente(s) acción(es): {3}. Haz clic en el enlace de abajo para comenzar este proceso.</p><p><a href="{0}">Enlace para actualizar la cuenta</a></p><p>Este enlace caducará en {4}.</p><p>Si no sabes que tu administrador ha solicitado esto, simplemente ignora este mensaje y no se realizará ningún cambio.</p>
+executeActionsBody=Su administrador ha solicitado que actualice su cuenta {2} realizando la(s) siguiente(s) acción(es): {3}. Haga clic en el enlace de abajo para comenzar este proceso.\n\n{0}\n\nEste enlace expirará en {4} minutos.\n\nSi no está al tanto que el administrador haya solicitado esto, simplemente ignore este mensaje y no se realizará ningún cambio.
+executeActionsBodyHtml=<p>Su administrador ha solicitado que actualice su cuenta {2} realizando la(s) siguiente(s) acción(es): {3}. Haga clic en el enlace de abajo para comenzar este proceso.</p><p><a href="{0}">Enlace para actualizar la cuenta</a></p><p>Este enlace caducará en {4}.</p><p>Si no sabe si su administrador ha solicitado esto, simplemente ignore este mensaje y no se realizará ningún cambio.</p>
 eventLoginErrorSubject=Fallo en el inicio de sesión
-eventLoginErrorBody=Se ha detectado un intento de acceso fallido a tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.
-eventLoginErrorBodyHtml=<p>Se ha detectado un intento de acceso fallido a tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.</p>
+eventLoginErrorBody=Se ha detectado un intento de acceso fallido a su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.
+eventLoginErrorBodyHtml=<p>Se ha detectado un intento de acceso fallido a su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.</p>
 eventRemoveTotpSubject=Borrado OTP
-eventRemoveTotpBody=OTP fue eliminado de tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.
-eventRemoveTotpBodyHtml=<p>OTP fue eliminado de tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.</p>
+eventRemoveTotpBody=OTP fue eliminado de su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.
+eventRemoveTotpBodyHtml=<p>OTP fue eliminado de su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.</p>
 eventUpdatePasswordSubject=Actualización de contraseña
-eventUpdatePasswordBody=Tu contraseña se ha actualizado el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.
-eventUpdatePasswordBodyHtml=<p>Tu contraseña se ha actualizado el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.</p>
+eventUpdatePasswordBody=Su contraseña se ha actualizado el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.
+eventUpdatePasswordBodyHtml=<p>Su contraseña se ha actualizado el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.</p>
 eventUpdateTotpSubject=Actualización de OTP
-eventUpdateTotpBody=OTP se ha actualizado en tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.
-eventUpdateTotpBodyHtml=<p>OTP se ha actualizado en tu cuenta el {0} desde {1}. Si no has sido tú, por favor contacta con el administrador.</p>
+eventUpdateTotpBody=OTP se ha actualizado en su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.
+eventUpdateTotpBodyHtml=<p>OTP se ha actualizado en su cuenta el {0} desde {1}. Si no ha sido usted, por favor contacte con el administrador.</p>
 emailUpdateConfirmationSubject=Verificar un nuevo correo electrónico
 emailUpdateConfirmationBody=Para actualizar su cuenta {2} con la dirección de correo electrónico {1}, haga clic en el enlace a continuación\n\n{0}\n\nEl enlace expirará dentro de {3}.\n\nSi no desea continuar con esta modificación, simplemente ignore este mensaje.
 emailUpdateConfirmationBodyHtml=<p>Para actualizar su cuenta {2} con la dirección de correo electrónico {1}, haga clic en el enlace a continuación</p><p><a href="{0}">{0}</a></p><p>Este enlace expirará dentro de {3}.</p><p>Si no desea continuar con esta modificación, simplemente ignore este mensaje.</p>
@@ -26,8 +26,8 @@ emailTestSubject=[KeyCloak] - Mensaje de prueba SMTP
 emailTestBody=Este es un mensaje de prueba
 emailTestBodyHtml=<p> Este es un mensaje de prueba </p>
 identityProviderLinkSubject=Enlace {0}
-identityProviderLinkBody=Alguien quiere vincular su cuenta "{1}" con la cuenta "{0}" del usuario {2}. Si ha sido usted, haga clic en el siguiente enlace para vincular las cuentas \n\n{3}\n\nEste enlace expirará en {5}.\n\nSi no desea vincular la cuenta, simplemente ignore este mensaje. Si vincula las cuentas, podrá iniciar sesión en {1} a través de {0}.
-identityProviderLinkBodyHtml=<p>Alguien quiere vincular su <b>{1}</b> cuenta con <b>{0}</b> cuenta del usuario {2}. Si ha sido usted, haga clic en el siguiente enlace para vincular las cuentas</p><p><a href="{3}">Enlace para confirmar el vínculo de cuentas</a></p><p>Este enlace expirará en {5}.</p><p>Si no desea vincular la cuenta, simplemente ignore este mensaje. Si vincula las cuentas, podrá iniciar sesión en {1} a través de {0}.</p>
+identityProviderLinkBody=Alguien quiere vincular su cuenta "{1}" con la cuenta "{0}" del usuario {2}. Si ha sido usted, haga clic en el siguiente enlace para vincular las cuentas \n\n{3}\n\nEste enlace expirará en {5}.\n\nSi usted no inició este proceso o no desea vincular la cuenta, simplemente ignore este mensaje. Si vincula las cuentas, podrá iniciar sesión en {1} a través de {0}.
+identityProviderLinkBodyHtml=<p>Alguien desea vincular su cuenta de <b>{1}</b> con la cuenta de <b>{0}</b> del usuario {2}. Si fue usted quien inició este proceso, haga clic en el siguiente enlace para vincular las cuentas</p><p><a href="{3}">Enlace para confirmar la vinculación de cuentas</a></p><p>Este enlace expirará en {5}.</p><p>Si usted no inició este proceso o no desea vincular la cuenta, simplemente ignore este mensaje. Si vincula las cuentas, podrá iniciar sesión en {1} a través de {0}.</p>
 requiredAction.CONFIGURE_TOTP=Configurar OTP
 requiredAction.TERMS_AND_CONDITIONS=Términos y condiciones
 requiredAction.UPDATE_PASSWORD=Actualiza la contraseña
@@ -46,19 +46,19 @@ linkExpirationFormatter.timePeriodUnit.days={0,choice,0#días|1#día|1<días}
 emailVerificationBodyCode=Verifique su dirección de correo electrónico ingresando en el siguiente código. \n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p> Verifique su dirección de correo electrónico ingresando el siguiente código. </p> <p> <b> {0} </b> </p>
 orgInviteSubject=Invitación para unirse a la organización {0}
-orgInviteBody=Has sido invitado a unirte a la organización "{3}". Haz clic en el enlace de abajo para unirte.\n\n{0}\n\nEste enlace caducará en {4}.\n\nSi no deseas unirte a la organización, simplemente ignora este mensaje.
+orgInviteBody=Ha sido invitado a unirse a la organización "{3}". Haga clic en el enlace de abajo para unirse.\n\n{0}\n\nEste enlace caducará en {4}.\n\nSi no desea unirse a la organización, simplemente ignore este mensaje.
 eventUpdateCredentialSubject=Actualizar credencial
-eventUpdateCredentialBody=Tu credencial {0} fue cambiada el {1} desde {2}. Si no fuiste tú, por favor contacta a un administrador.
+eventUpdateCredentialBody=Su credencial {0} fue cambiada el {1} desde {2}. Si no fue usted, por favor contacte a un administrador.
 eventRemoveCredentialSubject=Eliminar credencial
-eventRemoveCredentialBody=La credencial {0} fue eliminada de tu cuenta el {1} desde {2}. Si no fuiste tú, por favor contacta a un administrador.
+eventRemoveCredentialBody=La credencial {0} fue eliminada de su cuenta el {1} desde {2}. Si no fue usted, por favor contacte a un administrador.
 eventUserDisabledByTemporaryLockoutSubject=Usuario deshabilitado por bloqueo temporal
 eventUserDisabledByPermanentLockoutSubject=Usuario deshabilitado por bloqueo permanente
-eventUserDisabledByPermanentLockoutBody=Tu usuario ha sido deshabilitado permanentemente debido a múltiples intentos fallidos el {0}. Por favor, contacta a un administrador.
-eventUserDisabledByPermanentLockoutHtml=<p>Tu usuario ha sido deshabilitado permanentemente debido a múltiples intentos fallidos el {0}. Por favor, contacta a un administrador.</p>
-eventRemoveCredentialBodyHtml=<p>La credencial {0} fue eliminada de tu cuenta el {1} desde {2}. Si no fuiste tú, por favor contacta a un administrador.</p>
-eventUserDisabledByTemporaryLockoutHtml=<p>Tu usuario ha sido deshabilitado temporalmente debido a múltiples intentos fallidos el {0}. Por favor, contacta a un administrador si es necesario.</p>
-orgInviteBodyHtml=<p>Has sido invitado a unirte a la organización {3}. Haz clic en el enlace de abajo para unirte. </p><p><a href="{0}">Enlace para unirse a la organización</a></p><p>Este enlace caducará en {4}.</p><p>Si no deseas unirte a la organización, simplemente ignora este mensaje.</p>
-orgInviteBodyPersonalized=Hola, "{5}" "{6}".\n\nHas sido invitado a unirte a la organización {3}. Haz clic en el enlace de abajo para unirte.\n\n{0}\n\nEste enlace caducará en {4}.\n\nSi no deseas unirte a la organización, simplemente ignora este mensaje.
-orgInviteBodyPersonalizedHtml=<p>Hola, {5} {6}.</p><p>Has sido invitado a unirte a la organización {3}. Haz clic en el enlace de abajo para unirte. </p><p><a href="{0}">Enlace para unirse a la organización</a></p><p>Este enlace caducará en {4}.</p><p>Si no deseas unirte a la organización, simplemente ignora este mensaje.</p>
-eventUpdateCredentialBodyHtml=<p>Tu credencial {0} fue cambiada el {1} desde {2}. Si no fuiste tú, por favor contacta a un administrador.</p>
-eventUserDisabledByTemporaryLockoutBody=Tu usuario ha sido deshabilitado temporalmente debido a múltiples intentos fallidos el {0}. Por favor, contacta a un administrador si es necesario.
+eventUserDisabledByPermanentLockoutBody=Su usuario ha sido deshabilitado permanentemente debido a múltiples intentos fallidos el {0}. Por favor, contacte a un administrador.
+eventUserDisabledByPermanentLockoutHtml=<p>Su usuario ha sido deshabilitado permanentemente debido a múltiples intentos fallidos el {0}. Por favor, contacte a un administrador.</p>
+eventRemoveCredentialBodyHtml=<p>La credencial {0} fue eliminada de su cuenta el {1} desde {2}. Si no fue usted, por favor contacte a un administrador.</p>
+eventUserDisabledByTemporaryLockoutHtml=<p>Su usuario ha sido deshabilitado temporalmente debido a múltiples intentos fallidos el {0}. Por favor, contacte a un administrador si es necesario.</p>
+orgInviteBodyHtml=<p>Ha sido invitado a unirse a la organización {3}. Haga clic en el enlace de abajo para unirse. </p><p><a href="{0}">Enlace para unirse a la organización</a></p><p>Este enlace caducará en {4}.</p><p>Si no desea unirse a la organización, simplemente ignore este mensaje.</p>
+orgInviteBodyPersonalized=Hola, "{5}" "{6}".\n\nHa sido invitado a unirse a la organización {3}. Haga clic en el enlace de abajo para unirse.\n\n{0}\n\nEste enlace caducará en {4}.\n\nSi no desea unirse a la organización, simplemente ignore este mensaje.
+orgInviteBodyPersonalizedHtml=<p>Hola, {5} {6}.</p><p>Ha sido invitado a unirse a la organización {3}. Haga clic en el enlace de abajo para unirse. </p><p><a href="{0}">Enlace para unirse a la organización</a></p><p>Este enlace caducará en {4}.</p><p>Si no desea unirse a la organización, simplemente ignore este mensaje.</p>
+eventUpdateCredentialBodyHtml=<p>Su credencial {0} fue cambiada el {1} desde {2}. Si no fue usted, por favor contacte a un administrador.</p>
+eventUserDisabledByTemporaryLockoutBody=Su usuario ha sido deshabilitado temporalmente debido a múltiples intentos fallidos el {0}. Por favor, contacte a un administrador si es necesario.
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_fa.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_fa.properties
index c8a7ec3a7b1e..71c506ca2033 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_fa.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_fa.properties
@@ -3,7 +3,7 @@ emailVerificationBody=شخصی با این آدرس ایمیل یک حساب {2}
 emailVerificationBodyHtml=<p>شخصی با این آدرس ایمیل یک حساب {2} ایجاد کرده است. اگر این شما بودید، برای تأیید آدرس ایمیل خود روی پیوند زیر کلیک کنید</p><p><a href="{0}">پیوند به تأیید آدرس ایمیل</a></p><p>این پیوند در {3} منقضی می‌شود.</p><p>اگر شما این حساب را ایجاد نکرده‌اید، فقط این پیام را نادیده بگیرید.</p>
 emailUpdateConfirmationSubject=تایید ایمیل جدید
 emailUpdateConfirmationBody=برای به‌روزرسانی حساب {2} خود با آدرس ایمیل {1}، روی پیوند زیر کلیک کنید\n\n{0}\n\nاین پیوند ظرف {3} منقضی می‌شود.\n\nاگر نمی‌خواهید ادامه دهید این تغییر، فقط این پیام را نادیده بگیرید.
-emailUpdateConfirmationBodyHtml=<p>برای به‌روزرسانی حساب {2} خود با آدرس ایمیل {1}، روی پیوند زیر کلیک کنید</p><p><a href="{0}">{0}</a></p>< p>این پیوند در مدت {3} منقضی می‌شود.</p><p>اگر نمی‌خواهید به این اصلاح ادامه دهید، فقط این پیام را نادیده بگیرید.</p>
+emailUpdateConfirmationBodyHtml=<p>برای به‌روزرسانی حساب {2} خود با آدرس ایمیل {1}، روی پیوند زیر کلیک کنید</p><p><a href="{0}">{0}</a></p><p>این پیوند در مدت {3} منقضی می‌شود.</p><p>اگر نمی‌خواهید به این اصلاح ادامه دهید، فقط این پیام را نادیده بگیرید.</p>
 emailTestSubject=[KEYCLOAK] - پیام آزمایشی SMTP
 emailTestBody=این یک پیام آزمایشی است
 emailTestBodyHtml=<p>این یک پیام آزمایشی است</p>
@@ -36,20 +36,9 @@ requiredAction.UPDATE_PROFILE=پروفایل را بروزرسانی کنید
 requiredAction.VERIFY_EMAIL=تأیید ایمیل
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=کدهای بازیابی را ایجاد کنید
 
-linkExpirationFormatter.timePeriodUnit.seconds=ثانیه
-linkExpirationFormatter.timePeriodUnit.seconds.1=ثانیه
-linkExpirationFormatter.timePeriodUnit.minutes=دقیقه
-linkExpirationFormatter.timePeriodUnit.minutes.1=دقیقه
-
-linkExpirationFormatter.timePeriodUnit.hours=ساعت
-linkExpirationFormatter.timePeriodUnit.hours.1=ساعت
-linkExpirationFormatter.timePeriodUnit.days=روز
-linkExpirationFormatter.timePeriodUnit.days.1=روز
-
 emailVerificationBodyCode=لطفاً آدرس ایمیل خود را با وارد کردن کد زیر تأیید کنید.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>لطفاً آدرس ایمیل خود را با وارد کردن کد زیر تأیید کنید.</p><p><b>{0}</b></p>
 
-
 linkExpirationFormatter.timePeriodUnit.seconds=ثانیه
 linkExpirationFormatter.timePeriodUnit.minutes=دقیقه
 linkExpirationFormatter.timePeriodUnit.hours=ساعت
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_fr.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_fr.properties
index e25969e31a37..006b65ec69af 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_fr.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_fr.properties
@@ -5,8 +5,8 @@ emailUpdateConfirmationSubject=Vérification du nouveau courriel
 emailUpdateConfirmationBody=Afin d''utiliser le courriel {1} dans votre compte {2}, cliquez sur le lien ci-dessous\n\n{0}\n\nCe lien expire dans {3}.\n\nSinon, veuillez ignorer ce message.
 emailUpdateConfirmationBodyHtml=<p>Afin d''utiliser le courriel {1} dans votre compte {2}, cliquez sur le lien ci-dessous</p><p><a href="{0}">{0}</a></p><p>Ce lien expirera dans {3}.</p><p>Sinon, veuillez ignorer ce message.</p>
 identityProviderLinkSubject=Lien {0}
-identityProviderLinkBody=Quelqu''un souhaite lier votre compte "{1}" au compte "{0}" de l''utilisateur {2} . Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour lier les comptes\n\n{3}\n\nCe lien expire dans {5}.\n\nSinon, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte. Si vous liez les comptes, vous pourrez vous connecter à {1} via {0}.
-identityProviderLinkBodyHtml=<p>Quelqu''un souhaite lier votre compte <b>{1}</b> au compte <b>{0}</b> de l''utilisateur {2}. Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour lier les comptes</p><p><a href="{3}">Lien pour confirmer la liaison des comptes</a></p><p>Ce lien expire dans {5}.</p><p>Sinon, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte. Si vous liez les comptes, vous pourrez vous connecter à {1} via {0}.</p>
+identityProviderLinkBody=Quelqu''un souhaite lier votre compte "{1}" au compte "{0}" de l''utilisateur {2} . Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour lier les comptes\n\n{3}\n\nCe lien expire dans {5}.\n\nSi vous n''êtes pas à l''origine de cette action ou si vous ne souhaitez pas lier votre compte, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte. Si vous liez les comptes, vous pourrez vous connecter à {1} via {0}.
+identityProviderLinkBodyHtml=<p>Quelqu''un souhaite lier votre compte <b>{1}</b> au compte <b>{0}</b> de l''utilisateur {2}. Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour lier les comptes</p><p><a href="{3}">Lien pour confirmer la liaison des comptes</a></p><p>Ce lien expire dans {5}.</p><p>Si vous n''êtes pas à l''origine de cette action ou si vous ne voulez pas lier votre compte, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte. Si vous liez les comptes, vous pourrez vous connecter à {1} via {0}.</p>
 passwordResetSubject=Réinitialiser le mot de passe
 passwordResetBody=Quelqu''un vient de demander une réinitialisation de mot de passe pour votre compte {2}. Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour le mettre à jour.\n\n{0}\n\nCe lien expire dans {3}.\n\nSinon, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte.
 passwordResetBodyHtml=<p>Quelqu''un vient de demander une réinitialisation de mot de passe pour votre compte {2}. Si vous êtes à l''origine de cette requête, veuillez cliquer sur le lien ci-dessous pour le mettre à jour.</p><p><a href="{0}">Lien pour réinitialiser votre mot de passe</a></p><p>Ce lien expire dans {3}.</p><p>Sinon, veuillez ignorer ce message ; aucun changement ne sera effectué sur votre compte.</p>
@@ -26,9 +26,9 @@ eventUpdateTotpSubject=Mise à jour du OTP
 eventUpdateTotpBody=Le OTP a été mis à jour pour votre compte {0} depuis {1}. Si vous n''étiez pas à l''origine de cette requête, veuillez contacter votre administrateur.
 eventUpdateTotpBodyHtml=<p>Le OTP a été mis à jour pour votre compte {0} depuis {1}. Si vous n''étiez pas à l''origine de cette requête, veuillez contacter votre administrateur.</p>
 requiredAction.CONFIGURE_TOTP=Configurer un OTP
-requiredAction.TERMS_AND_CONDITIONS=Conditions générale d''utilisation
+requiredAction.TERMS_AND_CONDITIONS=Conditions générales d''utilisation
 requiredAction.UPDATE_PASSWORD=Mise à jour du mot de passe
-requiredAction.UPDATE_PROFILE=Mise à jour du profile
+requiredAction.UPDATE_PROFILE=Mise à jour du profil
 requiredAction.VERIFY_EMAIL=Vérification de l''adresse courriel
 
 # units for link expiration timeout formatting
@@ -38,3 +38,24 @@ linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#heures|1#heure|1<heures
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#jours|1#jour|1<jours}
 emailVerificationBodyCode=Veuillez vérifier votre adresse de courriel en saisissant le code suivant.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>Veuillez vérifier votre adresse de courriel en saisissant le code suivant.</p><p><b>{0}</b></p>
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Générer des codes de secours
+orgInviteSubject=Invitation à rejoindre l''organisation {0}
+orgInviteBody=Vous avez été invité à rejoindre l''organisation "{3}". Cliquez sur le lien ci-dessous pour la rejoindre.\n\n{0}\n\nCe lien expirera dans {4}.\n\nSi vous ne souhaitez pas rejoindre cette organisation, il vous suffit d''ignorer ce message.
+orgInviteBodyPersonalized=Bonjour "{5}" "{6}.\n\nVous avez été invité à rejoindre l''organisation "{3}". Cliquez sur le lien ci-dessous pour la rejoindre.\n\n{0}\n\nCe lien expirera dans {4}.\n\nSi vous ne souhaitez pas rejoindre cette organisation, il vous suffit d''ignorer ce message.
+emailTestSubject=[KEYCLOAK] - Message de test du SMTP
+emailTestBody=Ceci est un message de test
+emailTestBodyHtml=<p>Ceci est un message de test</p>
+eventUpdateCredentialSubject=Mettre à jour les accréditations
+eventRemoveCredentialSubject=Supprimer l''accréditation
+eventUserDisabledByTemporaryLockoutSubject=Utilisateur désactivé suite à un blocage temporaire
+eventUserDisabledByTemporaryLockoutBody=Votre utilisateur a été désactivé temporairement suite à de multiples échecs d''authentification sur {0}. Merci de contacter un administrateur au besoin.
+eventUserDisabledByPermanentLockoutSubject=Utilisateur désactivé suite à un blocage permanent
+eventUserDisabledByPermanentLockoutBody=Votre utilisateur a été désactivé définitivement suite à de multiples échecs d''authentification sur {0}. Merci de contacter un administrateur au besoin.
+eventUserDisabledByPermanentLockoutHtml=<p>Votre utilisateur a été désactivé définitivement suite à de multiples échecs d''authentification sur {0}. Merci de contacter un administrateur au besoin.</p>
+eventUserDisabledByTemporaryLockoutHtml=<p>Votre utilisateur a été désactivé temporairement suite à de multiples échecs d''authentification sur {0}. Merci de contacter un administrateur au besoin.</p>
+orgInviteBodyHtml=<p>Vous avez été invité à rejoindre l''organisation "{3}". Cliquez sur le lien ci-dessous pour la rejoindre.</p><p><a href="{0}">Lien pour rejoindre l''organisation</a></p><p>Ce lien expirera dans {4}.</p><p>Si vous ne souhaitez pas rejoindre cette organisation, il vous suffit d''ignorer ce message.</p>
+orgInviteBodyPersonalizedHtml=<p>Bonjour {5} {6}.</p><p>Vous avez été invité à rejoindre l''organisation "{3}". Cliquez sur le lien ci-dessous pour la rejoindre.</p><p><a href="{0}">Lien pour rejoindre l''organisation</a></p><p>Ce lien expirera dans {4}.</p><p>Si vous ne souhaitez pas rejoindre cette organisation, il vous suffit d''ignorer ce message.</p>
+eventRemoveCredentialBody=Votre accréditation {0} a été supprimée de {1} vers {2}. Si cela n''était pas vous, merci de contacter un administrateur.
+eventUpdateCredentialBody=Votre accréditation {0} a été changée de {1} vers {2}. Si cela n''était pas vous, merci de contacter un administrateur.
+eventUpdateCredentialBodyHtml=<p>Votre accréditation {0} a été changée de {1} vers {2}. Si cela n''était pas vous, merci de contacter un administrateur.</p>
+eventRemoveCredentialBodyHtml=<p>Votre accréditation {0} a été supprimée de {1} vers {2}. Si cela n''était pas vous, merci de contacter un administrateur.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_hu.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_hu.properties
index 00bc29a1b566..a68e56f1c2e4 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_hu.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_hu.properties
@@ -3,7 +3,7 @@ emailVerificationBody=Ezzel az e-mail címmel valaki létrehozott egy {2} tartom
 emailVerificationBodyHtml=<p>Ezzel az e-mail címmel valaki létrehozott egy {2} tartomány felhasználói fiókot. Amennyiben a fiókot Ön hozta létre, kérem, kattintson a lenti hivatkozásra, hogy megerősítse fiókját és ezt az e-mail címet.</p><p><a href="{0}">Hivatkozás a fiók és az e-mail cím megerősítéséhez</a></p><p>A hivatkozás érvényét veszti {3} múlva.</p><p>Ha nem ön hozta létre a felhasználói fiókot, akkor kérem, hagyja figyelmen kívül ezt az üzenetet.</p>
 emailUpdateConfirmationSubject=Új e-mail cím megerősítése
 emailUpdateConfirmationBody=Valaki módosítani szeretné az Ön "{2}" tartományi fiókjának e-mail címét. Amennyiben az e-mail cím módosítását Ön kezdeményezte, kérem, kattintson a lenti hivatkozásra a jóváhagyáshoz\n\n{0}\n\nA hivatkozás érvényét veszti {3} múlva.\n\nHa nem ön kérte az e-mail cím megváltoztatását, akkor kérem, hagyja figyelmen kívül ezt az üzenetet, az e-mail címe nem fog megváltozni.
-***emailUpdateConfirmationBodyHtml=<p>Valaki módosítani szeretné az Ön <b>{2}</b> tartományi fiókjának e-mail címét. Amennyiben az e-mail cím módosítását Ön kezdeményezte, kérem, kattintson a lenti hivatkozásra a jóváhagyáshoz</p><p><a href="{0}">{0}</a></p><p>A hivatkozás érvényét veszti {3} múlva.</p><p>Ha nem ön kérte az e-mail cím megváltoztatását, akkor kérem, hagyja figyelmen kívül ezt az üzenetet, az e-mail címe nem fog megváltozni.</p>
+emailUpdateConfirmationBodyHtml=<p>Valaki módosítani szeretné az Ön <b>{2}</b> tartományi fiókjának e-mail címét. Amennyiben az e-mail cím módosítását Ön kezdeményezte, kérem, kattintson a lenti hivatkozásra a jóváhagyáshoz</p><p><a href="{0}">{0}</a></p><p>A hivatkozás érvényét veszti {3} múlva.</p><p>Ha nem ön kérte az e-mail cím megváltoztatását, akkor kérem, hagyja figyelmen kívül ezt az üzenetet, az e-mail címe nem fog megváltozni.</p>
 emailTestSubject=[KEYCLOAK] - SMTP teszt üzenet
 emailTestBody=Ez egy KEYCLOAK teszt üzenet.
 emailTestBodyHtml=<p>Ez egy KEYCLOAK teszt üzenet.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_it.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_it.properties
index f92a16a7ed9f..69e71560d485 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_it.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_it.properties
@@ -1,31 +1,30 @@
-emailVerificationSubject=Verifica l''email
-emailVerificationBody=Qualcuno ha creato un account {2} con questo indirizzo email. Se sei stato tu, fai clic sul link seguente per verificare il tuo indirizzo email\n\n{0}\n\nQuesto link scadrà in {3}.\n\nSe non sei stato tu a creare questo account, ignora questo messaggio.
-emailVerificationBodyHtml=<p>Qualcuno ha creato un account {2} con questo indirizzo email. Se sei stato tu, fai clic sul link seguente per verificare il tuo indirizzo email</p><p><a href="{0}">Link per verificare l''indirizzo email</a></p><p>Questo link scadrà in {3}.</p><p>Se non sei stato tu a creare questo account, ignora questo messaggio.</p>
-emailTestSubject=[KEYCLOAK] - messaggio di test SMTP
+emailVerificationSubject=Verifica l''indirizzo email
+emailVerificationBody=Qualcuno ha creato un utente {2} con questo indirizzo email. Se sei stato tu, clicca sul collegamento seguente per verificarlo\n\n{0}\n\nQuesto collegamento scadrà entro {3}.\n\nSe non sei stato tu a creare questo utente, ignora pure questo messaggio.
+emailVerificationBodyHtml=<p>Qualcuno ha creato un utente {2} con questo indirizzo email. Se sei stato tu, clicca sul collegamento seguente per verificarlo</p><p><a href="{0}">Verifica l''indirizzo email</a></p><p>Questo collegamento scadrà entro {3}.</p><p>Se non sei stato tu a creare questo utente, ignora pure questo messaggio.</p>
+emailTestSubject=[KEYCLOAK] - Messaggio di test SMTP
 emailTestBody=Questo è un messaggio di test
 emailTestBodyHtml=<p>Questo è un messaggio di test</p>
 identityProviderLinkSubject=Link {0}
-identityProviderLinkBody=Qualcuno vuole associare il tuo account "{1}" con l''account "{0}" dell''utente {2}. Se sei stato tu, fai clic sul link seguente per associare gli account\n\n{3}\n\nQuesto link scadrà in {5}.\n\nSe non vuoi associare l''account, ignora questo messaggio. Se associ gli account, potrai accedere a {1} attraverso {0}.
-identityProviderLinkBodyHtml=<p>Qualcuno vuole associare il tuo account <b>{1}</b> con l''account <b>{0}</b> dell''utente {2}. Se sei stato tu, fai clic sul link seguente per associare gli account</p><p><a href="{3}">{3}</a></p><p>Questo link scadrà in {5}.</p><p>Se non vuoi associare l''account, ignora questo messaggio. Se associ gli account, potrai accedere a {1} attraverso {0}.</p>
+identityProviderLinkBody=Qualcuno vuole abbinare il tuo utente "{1}" con l''utenza "{0}" {2}. Se sei stato tu, clicca sul collegamento per confermare l''operazione\n\n{3}\n\nQuesto collegamento scadrà entro{5}.\n\nSe non vuoi effettuare l''abbinamento, ignora pure questo messaggio. Se associ gli utenti potrai accedere a {1} attraverso {0}.
+identityProviderLinkBodyHtml=<p>Qualcuno vuole abbinare il tuo utente <b>{1}</b> con l''utenza <b>{0}</b> {2}. Se sei stato tu, clicca sul collegamento per confermare l''operazione</p><p><a href="{3}">Conferma l''abbinamento</a></p><p>Questo collegamento scadrà entro{5}.</p><p>Se non vuoi effettuare l''abbinamento, ignora pure questo messaggio. Se associ gli utenti potrai accedere a {1} attraverso {0}.</p>
 passwordResetSubject=Reimposta la password
-passwordResetBody=Qualcuno ha appena richiesto di cambiare le credenziali di accesso al tuo account {2}. Se sei stato tu, fai clic sul link seguente per reimpostarle.\n\n{0}\n\nQuesto link e codice scadranno in {3}.\n\nSe non vuoi reimpostare le tue credenziali di accesso, ignora questo messaggio e non verrà effettuato nessun cambio.
-passwordResetBodyHtml=<p>Qualcuno ha appena richiesto di cambiare le credenziali di accesso al tuo account {2}. Se sei stato tu, fai clic sul link seguente per reimpostarle.</p><p><a href="{0}">Link per reimpostare le credenziali</a></p><p>Questo link scadrà in {3}.</p><p>Se non vuoi reimpostare le tue credenziali di accesso, ignora questo messaggio e non verrà effettuato nessun cambio.</p>
-executeActionsSubject=Aggiorna il tuo account
-executeActionsBody=Il tuo amministratore ha appena richiesto un aggiornamento del tuo account {2} ed è necessario che tu esegua la/le seguente/i azione/i: {3}. Fai clic sul link seguente per iniziare questo processo.\n\n{0}\n\nQuesto link scadrà in {4}.\n\nSe non sei a conoscenza della richiesta del tuo amministratore, ignora questo messaggio e non verrà effettuato nessun cambio.
-executeActionsBodyHtml=<p>Il tuo amministratore ha appena richiesto un aggiornamento del tuo account {2} ed è necessario che tu esegua la/le seguente/i azione/i: {3}. Fai clic sul link seguente per iniziare questo processo.</p><p><a href="{0}">Link per aggiornare l''account</a></p><p>Questo link scadrà in {4}.</p><p>Se non sei a conoscenza della richiesta del tuo amministratore, ignora questo messaggio e non verrà effettuato nessun cambio.</p>
+passwordResetBody=Qualcuno ha appena richiesto di cambiare le credenziali di accesso al tuo utente {2}. Se sei stato tu, clicca sul collegamento seguente per reimpostarle.\n\n{0}\n\nQuesto collegamento scadrà entro {3}.\n\nSe non vuoi reimpostare le tue credenziali di accesso, ignora pure questo messaggio: non verrà effettuata alcuna modifica.
+passwordResetBodyHtml=<p>Qualcuno ha appena richiesto di cambiare le credenziali di accesso al tuo utente {2}. Se sei stato tu, clicca sul collegamento seguente per reimpostarle.</p><p><a href="{0}">Reimposta la password</a></p><p>Questo collegamento scadrà entro {3}.</p><p>Se non vuoi reimpostare le tue credenziali di accesso, ignora pure questo messaggio: non verrà effettuata alcuna modifica.</p>
+executeActionsSubject=Modifica il tuo utente
+executeActionsBody=L''amministratore ha appena richiesto un aggiornamento del tuo utente {2} ed è necessario che tu esegua la/le seguente/i azione/i: {3}. Clicca sul collegamento seguente per iniziare questo processo.\n\n{0}\n\nQuesto collegamento scadrà entro {4}.\n\nSe non sei a conoscenza della richiesta dell''amministratore, ignora pure questo messaggio: non verrà effettuata alcuna modifica.
+executeActionsBodyHtml=<p>L''amministratore ha appena richiesto un aggiornamento del tuo utente {2} ed è necessario che tu esegua la/le seguente/i azione/i: {3}. Clicca sul collegamento seguente per iniziare questo processo.</p><p><a href="{0}">Aggiorna l''utente</a></p><p>Questo collegamento scadrà entro {4}.</p><p>Se non sei a conoscenza della richiesta dell''amministratore, ignora pure questo messaggio: non verrà effettuata alcuna modifica.</p>
 eventLoginErrorSubject=Errore di accesso
-eventLoginErrorBody=È stato rilevato un tentativo fallito di accesso al tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
-eventLoginErrorBodyHtml=<p>È stato rilevato un tentativo fallito di accesso al tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
+eventLoginErrorBody=È stato rilevato un tentativo fallito di accesso col tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
+eventLoginErrorBodyHtml=<p>È stato rilevato un tentativo fallito di accesso col tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
 eventRemoveTotpSubject=Rimozione OTP (password temporanea valida una volta sola)
-eventRemoveTotpBody=La OTP (password temporanea valida una volta sola) è stata rimossa dal tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
-eventRemoveTotpBodyHtml=<p>La OTP (password temporanea valida una volta sola) è stata rimossa dal tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
+eventRemoveTotpBody=La OTP (password temporanea valida una volta sola) è stata rimossa dal tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
+eventRemoveTotpBodyHtml=<p>La OTP (password temporanea valida una volta sola) è stata rimossa dal tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
 eventUpdatePasswordSubject=Aggiornamento password
 eventUpdatePasswordBody=La tua password è stata cambiata il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
 eventUpdatePasswordBodyHtml=<p>La tua password è stata cambiata il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
 eventUpdateTotpSubject=Aggiornamento OTP (password temporanea valida una volta sola)
-eventUpdateTotpBody=La OTP (password temporanea valida una volta sola) è stata aggiornata per il tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
-eventUpdateTotpBodyHtml=<p>La OTP (password temporanea valida una volta sola) è stata aggiornata per il tuo account il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
-
+eventUpdateTotpBody=La OTP (password temporanea valida una volta sola) è stata aggiornata per il tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.
+eventUpdateTotpBodyHtml=<p>La OTP (password temporanea valida una volta sola) è stata aggiornata per il tuo utente il {0} da {1}. Se non sei stato tu, per favore contatta l''amministratore.</p>
 requiredAction.CONFIGURE_TOTP=Configurazione OTP
 requiredAction.TERMS_AND_CONDITIONS=Termini e condizioni
 requiredAction.UPDATE_PASSWORD=Aggiornamento password
@@ -37,7 +36,26 @@ linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#secondi|1#secondo|1<s
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minuti|1#minuto|1<minuti}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#ore|1#ora|1<ore}
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#giorni|1#giorno|1<giorni}
-
 emailVerificationBodyCode=Per favore verifica il tuo indirizzo email inserendo il codice seguente.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>Per favore verifica il tuo indirizzo email inserendo il codice seguente.</p><p><b>{0}</b></p>
-
+orgInviteBodyPersonalizedHtml=<p>Gentile {5} {6}.</p><p>Ti hanno invitato a unirti all''organizzazione {3}. Clicca sul collegamento seguente per accettare.</p><p><a href="{0}">Accetta l''invito</a></p><p>Questo collegamento scadrà entro {4}.</p><p>Se non vuoi unirti a questa organizzazione, ignora pure questo messaggio.</p>
+orgInviteBodyPersonalized=Gentile "{5}" "{6}".\n\nTi hanno invitato a unirti all''organizzazione "{3}". Clicca nel collegamento seguente per accettare.\n\n{0}\n\nQuesto collegamento scadrà entro {4}.\n\nSe non vuoi unirti a questa organizzazione, ignora pure questo messaggio.
+orgInviteBodyHtml=<p>Ti hanno invitato a unirti all''organizzazione {3}. Clicca nel collegamento seguente per accettare.</p><p><a href="{0}">Accetta l''invito</a></p><p>Questo collegamento scadrà entro {4}.</p><p>Se non vuoi unirti a questa organizzazione, ignora pure questo messaggio.</p>
+emailUpdateConfirmationSubject=Verifica il nuovo indirizzo email
+emailUpdateConfirmationBody=Per modificare il tuo utente {2} utilizzando l''indirizzo email {1}, clicca sul collegamento seguente\n\n{0}\n\nQuesto collegamento scadrà entro {3}.\n\nSe non vuoi procedere con questa modifica, ignora pure questo messaggio.
+emailUpdateConfirmationBodyHtml=<p>Per modificare il tuo utente {2} utilizzando l''indirizzo email {1}, clicca sul collegamento seguente</p><p><a href="{0}">{0}</a></p><p>Questo collegamento scadrà entro {3}.</p><p>Se non vuoi procedere con questa modifica, ignora pure questo messaggio.</p>
+eventUpdateCredentialBodyHtml=<p>Le tue credenziali {0} sono state cambiate su {1} da {2}. Se non sei stato tu, per favore contatta l''amministratore.</p>
+eventRemoveCredentialBody=Le credenziali {0} sono state rimosse dal tuo utente su {1} da {2}. Se non sei stato tu, per favore contatta l''amministratore.
+eventUserDisabledByTemporaryLockoutSubject=Utente disabilitato con un blocco temporaneo
+eventUserDisabledByTemporaryLockoutBody=Il tuo utente è stato temporaneamente disabilitato a causa di molteplici tentativi falliti su {0}. Se necessario, contatta un amministratore.
+eventUserDisabledByPermanentLockoutSubject=Utente disabilitato con blocco permanente
+eventUserDisabledByPermanentLockoutBody=Il tuo utente è stato disabilitato in modo permanente a causa di molteplici tentativi falliti su {0}. Si prega di contattare un amministratore.
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generazione codici di recupero
+eventRemoveCredentialSubject=Rimozione credenziali
+eventUserDisabledByTemporaryLockoutHtml=<p>Il tuo utente è stato temporaneamente disabilitato a causa di molteplici tentativi falliti su {0}. Se necessario, contatta un amministratore.</p>
+eventUserDisabledByPermanentLockoutHtml=<p>Il tuo utente è stato disabilitato in modo permanente a causa di molteplici tentativi falliti su {0}. Si prega di contattare un amministratore.</p>
+eventUpdateCredentialSubject=Aggiornamento credenziali
+eventUpdateCredentialBody=Le tue credenziali {0} sono state cambiate su {1} da {2}. Se non sei stato tu, per favore contatta l''amministratore.
+eventRemoveCredentialBodyHtml=<p>Le credenziali {0} sono state rimosse dal tuo utente su {1} da {2}. Se non sei stato tu, per favore contatta l''amministratore.</p>
+orgInviteSubject=Invito per unirti all''organizzazione {0}
+orgInviteBody=Ti hanno invitato a unirti all''organizzazione "{3}". Clicca nel collegamento seguente per accettare.\n\n{0}\n\nQuesto collegamento scadrà entro {4}.\n\nSe non vuoi unirti a questa organizzazione, ignora pure questo messaggio.
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ja.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ja.properties
index f9c3eaa5b29c..c403ec075af5 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_ja.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ja.properties
@@ -1,12 +1,12 @@
-emailVerificationSubject=Eメールの確認
-emailVerificationBody=このメールアドレスで{2}アカウントが作成されました。以下のリンクをクリックしてメールアドレスの確認を完了してください。\n\n{0}\n\nこのリンクは{3}だけ有効です。\n\nもしこのアカウントの作成に心当たりがない場合は、このメールを無視してください。
-emailVerificationBodyHtml=<p>このメールアドレスで{2}アカウントが作成されました。以下のリンクをクリックしてメールアドレスの確認を完了してください。</p><p><a href="{0}">メールアドレスの確認</a></p><p>このリンクは{3}だけ有効です。</p><p>もしこのアカウントの作成に心当たりがない場合は、このメールを無視してください。</p>
+emailVerificationSubject=メールアドレスの検証
+emailVerificationBody=このメールアドレスで{2}アカウントが作成されました。以下のリンクをクリックしてメールアドレスの確認を完了してください。\n\n{0}\n\nこのリンクの有効期限は{3}以内です。\n\nもしこのアカウントの作成に心当たりがない場合は、このメールを無視してください。
+emailVerificationBodyHtml=<p>このメールアドレスで{2}アカウントが作成されました。以下のリンクをクリックしてメールアドレスの確認を完了してください。</p><p><a href="{0}">メールアドレスの確認</a></p><p>このリンクの有効期限は{3}以内です。</p><p>もしこのアカウントの作成に心当たりがない場合は、このメールを無視してください。</p>
 emailTestSubject=[KEYCLOAK] - SMTPテストメッセージ
 emailTestBody=これはテストメッセージです
 emailTestBodyHtml=<p>これはテストメッセージです</p>
 identityProviderLinkSubject=リンク {0}
-identityProviderLinkBody=あなたの"{1}"アカウントと{2}ユーザーの"{0}"アカウントのリンクが要求されました。以下のリンクをクリックしてアカウントのリンクを行ってください。\n\n{3}\n\nこのリンクは{5}だけ有効です。\n\nもしアカウントのリンクを行わない場合は、このメッセージを無視してください。アカウントのリンクを行うことで、{0}経由で{1}にログインすることができるようになります。
-identityProviderLinkBodyHtml=<p>あなたの<b>{1}</b>アカウントと{2}ユーザーの<b>{0}</b>アカウントのリンクが要求されました。以下のリンクをクリックしてアカウントのリンクを行ってください。</p><p><a href="{3}">アカウントリンクの確認</a></p><p>このリンクは{5}だけ有効です。</p><p>もしアカウントのリンクを行わない場合は、このメッセージを無視してください。アカウントのリンクを行うことで、{0}経由で{1}にログインすることができるようになります。</p>
+identityProviderLinkBody=あなたの「{1}」アカウントと{2}ユーザーの「{0}」アカウントのリンクが要求されました。以下のリンクをクリックしてアカウントのリンクを行ってください。\n\n{3}\n\nこのリンクの有効期限は{5}以内です。\n\nもしアカウントのリンクを行わない場合は、このメッセージを無視してください。アカウントのリンクを行うことで、{0}経由で{1}にログインすることができるようになります。
+identityProviderLinkBodyHtml=<p>あなたの<b>{1}</b>アカウントと{2}ユーザーの<b>{0}</b>アカウントのリンクが要求されました。以下のリンクをクリックしてアカウントのリンクを行ってください。</p><p><a href="{3}">アカウントリンクの確認</a></p><p>このリンクの有効期限は{5}以内です。</p><p>もしアカウントのリンクを行わない場合は、このメッセージを無視してください。アカウントのリンクを行うことで、{0}経由で{1}にログインすることができるようになります。</p>
 passwordResetSubject=パスワードのリセット
 passwordResetBody=あなたの{2}アカウントのパスワードの変更が要求されています。以下のリンクをクリックしてパスワードのリセットを行ってください。\n\n{0}\n\nこのリンクは{3}だけ有効です。\n\nもしパスワードのリセットを行わない場合は、このメッセージを無視してください。何も変更されません。
 passwordResetBodyHtml=<p>あなたの{2}アカウントのパスワードの変更が要求されています。以下のリンクをクリックしてパスワードのリセットを行ってください。</p><p><a href="{0}">パスワードのリセット</a></p><p>このリンクは{3}だけ有効です。</p><p>もしパスワードのリセットを行わない場合は、このメッセージを無視してください。何も変更されません。</p>
@@ -29,13 +29,33 @@ requiredAction.CONFIGURE_TOTP=OTPの設定
 requiredAction.TERMS_AND_CONDITIONS=利用規約
 requiredAction.UPDATE_PASSWORD=パスワードの更新
 requiredAction.UPDATE_PROFILE=プロファイルの更新
-requiredAction.VERIFY_EMAIL=Eメールの確認
+requiredAction.VERIFY_EMAIL=メールアドレスの検証
 
 # units for link expiration timeout formatting
-linkExpirationFormatter.timePeriodUnit.seconds=秒
-linkExpirationFormatter.timePeriodUnit.minutes=分
-linkExpirationFormatter.timePeriodUnit.hours=時間
-linkExpirationFormatter.timePeriodUnit.days=日
+linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#秒|1#秒|1<秒}
+linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#分|1#分|1<分}
+linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#時間|1#時間|1<時間}
+linkExpirationFormatter.timePeriodUnit.days={0,choice,0#日|1#日|1<日}
 emailVerificationBodyCode=次のコードを入力してメールアドレスを確認してください。\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>次のコードを入力してメールアドレスを確認してください。</p><p><b>{0}</b></p>
 orgInviteSubject=組織 {0} への招待
+orgInviteBody=「{3}」の組織に招待されました。以下のリンクをクリックして加入してください。\n\n{0}\n\nこのリンクの有効期限は{4}以内です。\n\n組織に参加したくない場合は、このメッセージを無視してください。
+orgInviteBodyPersonalized=こんにちは、「{5}」 「{6}」。\n\n「{3}」の組織に招待されました。以下のリンクをクリックして参加してください。\n\n{0}\n\nこのリンクの有効期限は{4}以内です。\n\n組織に参加したくない場合は、このメッセージを無視してください。
+orgInviteBodyHtml=<p> {3}の組織に招待されました。以下のリンクをクリックして参加してください。</p><p><a href="{0}">の組織への参加リンク</a></p><p> このリンクの有効期限は{4}以内です。</p><p> 組織に参加したくない場合は、このメッセージを無視してください。</p>
+emailUpdateConfirmationSubject=新規メールアドレスの検証
+emailUpdateConfirmationBody={2}アカウントをメールアドレス{1}で更新するには、以下のリンクをクリックしてください。\n\n{0}\n\nこのリンクの有効期限は{3}以内です。\n\nこの変更を続行したくない場合は、このメッセージを無視してください.
+emailUpdateConfirmationBodyHtml=<p>メールアドレス{1}で{2}アカウントを更新するには、以下のリンクをクリックしてください。</p><p><a href="{0}">{0}</a></p><p>このリンクの有効期限は{3}以内です。</p><p> この変更を進めたくない場合は、このメッセージを無視してください。</p>
+eventUpdateCredentialSubject=クレデンシャルの更新
+eventUpdateCredentialBody={2}から{1}で{0}のクレデンシャルが変更されました。これがあなたではない場合は、管理者に連絡してください。
+eventUpdateCredentialBodyHtml=<p>{2}から{1}で{0}のクレデンシャルが変更されました。これがあなたではない場合は、管理者に連絡してください。</p>
+eventRemoveCredentialSubject=クレデンシャルの削除
+eventRemoveCredentialBody={1}に{2}からの操作でクレデンシャル{0}が削除されました。心当たりがない場合は、管理者に連絡してください。
+orgInviteBodyPersonalizedHtml=<p> こんにちは、「{5}」 「{6}」。</p><p> {3}の組織に招待されました。以下のリンクをクリックして参加してください。</p><p><a href="{0}">の組織への参加リンク</a></p><p> このリンクの有効期限は{4}以内です。</p><p> 組織に参加したくない場合は、このメッセージを無視してください。</p>
+eventUserDisabledByPermanentLockoutSubject=永続的なロックアウトによって無効にされるユーザー
+eventUserDisabledByPermanentLockoutBody={0}で複数回失敗したため、ユーザーは永続的に無効になりました。管理者に連絡してください。
+eventRemoveCredentialBodyHtml=<p>{1}に{2}からの操作でクレデンシャル{0}が削除されました。心当たりがない場合は、管理者に連絡してください。</p>
+eventUserDisabledByTemporaryLockoutSubject=一時的なロックアウトによって無効なユーザー
+eventUserDisabledByTemporaryLockoutBody={0}で複数回失敗したため、ユーザーは一時的に無効になりました。必要に応じて管理者に連絡してください。
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=リカバリーコードの生成
+eventUserDisabledByTemporaryLockoutHtml=<p>{0}で複数回失敗したため、ユーザーは一時的に無効になりました。必要に応じて管理者に連絡してください。</p>
+eventUserDisabledByPermanentLockoutHtml=<p>{0}で複数回失敗したため、ユーザーは永続的に無効になりました。管理者に連絡してください。</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ka.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ka.properties
index 6b22def79d7e..851139626304 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_ka.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ka.properties
@@ -6,9 +6,8 @@ orgInviteBodyHtml=<p>მოგიწვიეს, მიუერთდეთ 
 orgInviteBodyPersonalized=გამარჯობა, "{5}" "{6}"\n\n თქვენ მიგიწვიეს, შეუერთდეთ ორგანიზაციას "{3}". ამისთვის დააწკაპუნეთ ქვედა ბმულს.\n\n{0}\n\nბმულის ვადის ამოწურვის დროა {4}.\n\nთუ არ გსურთ, ორგანიზაციას მიუერთდეთ, უბრალოდ გამოტოვეთ ეს შეტყობინება.
 emailUpdateConfirmationBody=იმისათვის, რომ განაახლოთ თქვენი {2}-ის ანგარიში ელფოსტის ანგარიშით {1}, დააწკაპუნეთ ქვედა ბმულზე\n\n{0}\n\nამ ბმული ვადის ამოწურვის დროა {3}.\n\nთუ არ გნებავთ ამ ცვლილების შეტანა, უბრალოდ გამოტოვეთ ეს შეტყობინება.
 orgInviteBodyPersonalizedHtml=<p>{5} {6}</p><p>გამარჯობა. თქვენ მიგიწვიეს, შეუერთდეთ ორგანიზაციას "{3}". ამისთვის დააწკაპუნეთ ქვედა ბმულს. </p><p><a href="{0}">ბმული ორგანიზაციასთან მისაერთებლად</a></p><p>ბმულის ვადის ამოწურვის დროა {4}.</p><p>თუ არ გსურთ, ორგანიზაციას მიუერთდეთ, უბრალოდ გამოტოვეთ ეს შეტყობინება.</p>
-identityProviderLinkBody=ვიღაცას უნდა, თქვენი "{1}" ანგარიში მიაბას "{0}" ანგარიშს მომხმარებლისთვის {2} . თუ ეს თქვენ ბრძანდებით, დააწკაპუნეთ ქვედა ბმულზე, ანგარიშის მისაბმელად\n\n{3}\n\nამ ბმულის ვადის ამოწურვის დროა {5}.\n\nთუ არ გნებავთ ანგარიშის მიბმა, უბრალოდ გამოტოვეთ ეს შეტყობინება. თუ ანგარიშებს მიაბამთ, შეგეძლებათ შეხვიდეთ {1}-დან {0}-მდე ყველაფერზე.
+identityProviderLinkBody=ვიღაცას უნდა, თქვენი "{1}" ანგარიში მიაბას "{0}" ანგარიშს მომხმარებლისთვის {2} . თუ ეს თქვენ ბრძანდებით, დააწკაპუნეთ ქვედა ბმულზე, ანგარიშის მისაბმელად\n\n{3}\n\nამ ბმულის ვადის ამოწურვის დროა {5}.\n\nთუ თქვენ არ დაგიწყიათ ეს პროცესი, ან არ გნებავთ ანგარიშის მიბმა, უბრალოდ გამოტოვეთ ეს შეტყობინება. თუ ანგარიშებს მიაბამთ, შეგეძლებათ შეხვიდეთ {1}-დან {0}-მდე ყველაფერზე.
 executeActionsBody=თქვენმა ადმინისტრატორმა მოითხოვა, რომ თქვენ განაახლოთ {2} ანგარიში, შემდეგი ქმედებების შესრულებით: {3}. დააწკაპუნეთ ქვედა ბმულზე, რომ ეს პროცესი დაიწყოთ\n\n{0}\n\nამ ბმულის ვადის ამოწურვის დროა {4}.\n\nთუ თქვენ არ გგონიათ, რომ ეს თქვენმა სისტემურმა ადმინისტრატორმა მოგთხოვთ, უბრალოდ გამოტოვეთ ეს შეტყობინება და არაფერი შეიცვლება.
-identityProviderLinkBodyHtml=<p>ვიღაცას უნდა, თქვენი <b>{1}</b> ანგარიში მიაბას <b>{0}</b> ანგარიშს მომხმარებლისთვის {2} . თუ ეს თქვენ ბრძანდებით, დააწკაპუნეთ ქვედა ბმულზე, ანგარიშის მისაბმელად</p><p><a href="{3}">ბმული ანგარიშის მიბმის დასადასტურებლად.</a></p><p>ამ ბმულის ვადის ამოწურვის დროა {5}.</p><p>თუ არ გნებავთ ანგარიშის მიბმა, უბრალოდ გამოტოვეთ ეს შეტყობინება. თუ ანგარიშებს მიაბამთ, შეგეძლებათ შეხვიდეთ {1}-დან {0}-მდე ყველაფერზე.</p>
 passwordResetBody=ვიღაცამ თქვენი {2} ანგარიშის ავტორიზაციის დეტალების შეცვლა მოინდომა. თუ ეს თქვენ ბრძანდებოდით, მათ ჩამოსაყრელად ქვედა ბმულს დააჭირეთ.\n\n{0}\n\nეს ბმულის და კოდის ვადის ამოწურვის დროა {3}.\n\nთუ არ გნებავთ თქვენი ავტორიზაციის დეტალების ჩამოყრა, უბრალოდ გამოტოვეთ ეს შეტყობინება და არაფერი შეიცვლება.
 passwordResetBodyHtml=<p>ვიღაცამ თქვენი {2} ანგარიშის ავტორიზაციის დეტალების შეცვლა მოინდომა. თუ ეს თქვენ ბრძანდებოდით, მათ ჩამოსაყრელად ქვედა ბმულს დააჭირეთ.</p><p><a href="{0}">ბმული ავტორიზაციის დეტალების ჩამოსაყრელად.</a></p><p>ეს ბმულის და კოდის ვადის ამოწურვის დროა {3}.</p><p>თუ არ გნებავთ თქვენი ავტორიზაციის დეტალების ჩამოყრა, უბრალოდ გამოტოვეთ ეს შეტყობინება და არაფერი შეიცვლება.</p>
 executeActionsBodyHtml=<p>თქვენმა ადმინისტრატორმა მოითხოვა, რომ თქვენ განაახლოთ {2} ანგარიში, შემდეგი ქმედებების შესრულებით: {3}. დააწკაპუნეთ ქვედა ბმულზე, რომ ეს პროცესი დაიწყოთ.</p><p><a href="{0}">ბმული ანგარიშის განახლებაზე</a></p><p>ამ ბმულის ვადის ამოწურვის დროა {4}. </p><p>თუ თქვენ არ გგონიათ, რომ ეს თქვენმა სისტემურმა ადმინისტრატორმა მოგთხოვთ, უბრალოდ გამოტოვეთ ეს შეტყობინება და არაფერი შეიცვლება.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ky.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ky.properties
new file mode 100644
index 000000000000..39dfd57c2b3e
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ky.properties
@@ -0,0 +1,80 @@
+emailVerificationSubject=Электрондук почтаңызды ырастаңыз
+emailVerificationBody={2} каттоо эсеби бул электрондук почта дареги менен түзүлгөн. Эгер бул сиз болсоңуз, электрондук почта дарегиңизди ырастаңыз:\n\n{0}\n\nБул шилтеме {3} ичинде мөөнөтү бүтөт.\n\nЭгер бул каттоо эсебин түзгөн эмессиз, анда бул билдирүүгө көңүл бурбаңыз.
+emailVerificationBodyHtml=<p>{2} каттоо эсеби бул электрондук почта дареги менен түзүлгөн. Эгер бул сиз болсоңуз, төмөндөгү шилтемени басып, даректи ырастаңыз:</p><p><a href="{0}">Электрондук почтаны ырастоочу шилтеме</a></p><p>Бул шилтеме {3} ичинде мөөнөтү бүтөт.</p><p>Эгер сиз бул каттоо эсебин түзгөн эмессиз, бул билдирүүгө көңүл бурбаңыз.</p>
+
+orgInviteSubject="{0}" уюмуна чакыруу
+orgInviteBody=Сиз "{3}" уюмуна кошулуу үчүн чакырылдыңыз. Кошулуу үчүн төмөнкү шилтемени басыңыз:\n\n{0}\n\nБул шилтеме {4} ичинде мөөнөтү бүтөт.\n\nЭгер кошулгуңуз келбесе, бул билдирүүгө көңүл бурбаңыз.
+orgInviteBodyHtml=<p>Сиз "{3}" уюмуна кошулуу үчүн чакырылдыңыз. Кошулуу үчүн төмөнкү шилтемени басыңыз:</p><p><a href="{0}">Уюмга кошулуу шилтемеси</a></p><p>Бул шилтеме {4} ичинде мөөнөтү бүтөт.</p><p>Эгер кошулгуңуз келбесе, бул билдирүүгө көңүл бурбаңыз.</p>
+
+orgInviteBodyPersonalized=Салам, "{5}" "{6}".\n\nСиз "{3}" уюмуна кошулуу үчүн чакырылдыңыз. Кошулуу үчүн төмөнкү шилтемени басыңыз:\n\n{0}\n\nБул шилтеме {4} ичинде мөөнөтү бүтөт.\n\nЭгер кошулгуңуз келбесе, бул билдирүүгө көңүл бурбаңыз.
+orgInviteBodyPersonalizedHtml=<p>Салам, {5} {6}.</p><p>Сиз "{3}" уюмуна кошулуу үчүн чакырылдыңыз. Кошулуу үчүн төмөнкү шилтемени басыңыз:</p><p><a href="{0}">Уюмга кошулуу шилтемеси</a></p><p>Бул шилтеме {4} ичинде мөөнөтү бүтөт.</p><p>Эгер кошулгуңуз келбесе, бул билдирүүгө көңүл бурбаңыз.</p>
+
+emailUpdateConfirmationSubject=Жаңы электрондук почтаны ырастаңыз
+emailUpdateConfirmationBody={2} каттоо эсебиңизди {1} электрондук почта дареги менен жаңыртуу үчүн төмөнкү шилтемени басыңыз:\n\n{0}\n\nБул шилтеме {3} ичинде мөөнөтү бүтөт.\n\nЭгер бул өзгөртүүнү каалабасаңыз, бул билдирүүгө көңүл бурбаңыз.
+emailUpdateConfirmationBodyHtml=<p>{2} каттоо эсебиңизди {1} электрондук почта дареги менен жаңыртуу үчүн төмөнкү шилтемени басыңыз:</p><p><a href="{0}">{0}</a></p><p>Бул шилтеме {3} ичинде мөөнөтү бүтөт.</p><p>Эгер бул өзгөртүүнү каалабасаңыз, бул билдирүүгө көңүл бурбаңыз.</p>
+
+emailTestSubject=[KEYCLOAK] - SMTP тест билдирүү
+emailTestBody=Бул тесттик билдирүү
+emailTestBodyHtml=<p>Бул тесттик билдирүү</p>
+
+identityProviderLinkSubject={0} менен байланыш
+identityProviderLinkBody=Бирөө сиздин "{1}" каттоо эсебиңизди "{0}" колдонуучусунун эсеби {2} менен байланыштырууну каалайт. Эгер бул сиз болсоңуз, төмөнкү шилтемени басыңыз:\n\n{3}\n\nБул шилтеме {5} ичинде мөөнөтү бүтөт.\n\nЭгер байланышкыңыз келбесе, бул билдирүүгө көңүл бурбаңыз. Эгер байланыштырылса, сиз {0} аркылуу {1} системасына кире аласыз.
+identityProviderLinkBodyHtml=<p>Бирөө сиздин <b>{1}</b> каттоо эсебиңизди <b>{0}</b> колдонуучусу {2} менен байланыштырууну каалайт. Эгер бул сиз болсоңуз, төмөнкү шилтемени басыңыз:</p><p><a href="{3}">Каттоо эсептерди байланыштыруу</a></p><p>Бул шилтеме {5} ичинде мөөнөтү бүтөт.</p><p>Эгер байланыштыруу каалабасаңыз, бул билдирүүгө көңүл бурбаңыз. Эгер байланышса, {0} аркылуу {1} системасына кире аласыз.</p>
+
+passwordResetSubject=Сырсөздү кайра коюу
+passwordResetBody=Сиздин {2} каттоо эсебиңиздин сырсөзүн өзгөртүү суранычы келип түштү. Эгер бул сиз болсоңуз, төмөнкү шилтемени басып жаңыртыңыз:\n\n{0}\n\nБул шилтеме {3} ичинде мөөнөтү бүтөт.\n\nЭгер сырсөздү жаңырткыңыз келбесе, бул билдирүүгө көңүл бурбаңыз.
+passwordResetBodyHtml=<p>{2} каттоо эсебиңиздин сырсөзүн өзгөртүү суранычы келип түштү. Эгер бул сиз болсоңуз, төмөнкү шилтемени басыңыз:</p><p><a href="{0}">Сырсөздү өзгөртүү шилтемеси</a></p><p>Бул шилтеме {3} ичинде мөөнөтү бүтөт.</p><p>Эгер жаңырткыңыз келбесе, бул билдирүүгө көңүл бурбаңыз.</p>
+
+executeActionsSubject=Каттоо эсебиңизди жаңыртыңыз
+executeActionsBody=Администратор сиздин {2} каттоо эсебиңиз үчүн төмөнкү аракеттерди аткарууну суранды: {3}. Төмөнкү шилтемени басып улантыңыз:\n\n{0}\n\nБул шилтеме {4} ичинде мөөнөтү бүтөт.\n\nЭгер муну билбесеңиз, бул билдирүүгө көңүл бурбаңыз.
+executeActionsBodyHtml=<p>Администратор сиздин {2} каттоо эсебиңиз үчүн төмөнкү аракеттерди аткарууну суранды: {3}. Улантуу үчүн шилтемени басыңыз:</p><p><a href="{0}">Каттоо эсебин жаңыртуу шилтемеси</a></p><p>Бул шилтеме {4} ичинде мөөнөтү бүтөт.</p><p>Эгер муну билбесеңиз, бул билдирүүгө көңүл бурбаңыз.</p>
+
+eventLoginErrorSubject=Кирүү катасы
+eventLoginErrorBody={0} системасына {1} дарегинен кирүү аракетинде ката кетти. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventLoginErrorBodyHtml=<p>{0} системасына {1} дарегинен кирүү аракетинде ката кетти. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventRemoveTotpSubject=OTP өчүрүлдү
+eventRemoveTotpBody={0} системасынан {1} аркылуу OTP каттоо эсебиңизден өчүрүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventRemoveTotpBodyHtml=<p>{0} системасынан {1} аркылуу OTP каттоо эсебиңизден өчүрүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventUpdatePasswordSubject=Сырсөз өзгөртүлдү
+eventUpdatePasswordBody=Сырсөзүңүз {0} системасында {1} аркылуу өзгөртүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventUpdatePasswordBodyHtml=<p>Сырсөзүңүз {0} системасында {1} аркылуу өзгөртүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventUpdateTotpSubject=OTP жаңыртылды
+eventUpdateTotpBody=OTP {0} системасында {1} аркылуу жаңыртылды. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventUpdateTotpBodyHtml=<p>OTP {0} системасында {1} аркылуу жаңыртылды. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventUpdateCredentialSubject=Тастыктоо маалыматы жаңыртылды
+eventUpdateCredentialBody=Сиздин {0} тастыктоо маалыматыңыз {1} системасында {2} аркылуу жаңыртылды. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventUpdateCredentialBodyHtml=<p>Сиздин {0} тастыктоо маалыматыңыз {1} системасында {2} аркылуу жаңыртылды. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventRemoveCredentialSubject=Тастыктоо маалыматы өчүрүлдү
+eventRemoveCredentialBody={0} тастыктоо маалыматыңыз {1} системасында {2} аркылуу өчүрүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.
+eventRemoveCredentialBodyHtml=<p>{0} тастыктоо маалыматыңыз {1} системасында {2} аркылуу өчүрүлдү. Эгер бул сиз болбосоңуз, администраторго кайрылыңыз.</p>
+
+eventUserDisabledByTemporaryLockoutSubject=Убактылуу бөгөт коюлду
+eventUserDisabledByTemporaryLockoutBody=Бир нече жолу кирүү аракетинен улам {0} системасында колдонуучу убактылуу бөгөттөлдү. Зарыл болсо администраторго кайрылыңыз.
+eventUserDisabledByTemporaryLockoutHtml=<p>Бир нече жолу кирүү аракетинен улам {0} системасында колдонуучу убактылуу бөгөттөлдү. Зарыл болсо администраторго кайрылыңыз.</p>
+
+eventUserDisabledByPermanentLockoutSubject=Туруктуу бөгөт коюлду
+eventUserDisabledByPermanentLockoutBody=Бир нече жолу кирүү аракетинен улам {0} системасында колдонуучу туруктуу бөгөттөлдү. Администраторго кайрылыңыз.
+eventUserDisabledByPermanentLockoutHtml=<p>Бир нече жолу кирүү аракетинен улам {0} системасында колдонуучу туруктуу бөгөттөлдү. Администраторго кайрылыңыз.</p>
+
+requiredAction.CONFIGURE_TOTP=OTP жөндөө
+requiredAction.TERMS_AND_CONDITIONS=Шарттар менен макулдук
+requiredAction.UPDATE_PASSWORD=Сырсөздү жаңыртуу
+requiredAction.UPDATE_PROFILE=Профилди жаңыртуу
+requiredAction.VERIFY_EMAIL=Электрондук почтаны ырастаңыз
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Калыбына келтирүү коддорун жаратыңыз
+# units for link expiration timeout formatting
+# for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#секунд|1#секунд|1<секунд}
+linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#мүнөт|1#мүнөт|1<мүнөт}
+linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#саат|1#саат|1<саат}
+linkExpirationFormatter.timePeriodUnit.days={0,choice,0#күн|1#күн|1<күн}
+
+emailVerificationBodyCode=Электрондук почта дарегиңизди ырастаңыз. Төмөндөгү кодду киргизиңиз:\n\n{0}
+emailVerificationBodyCodeHtml=<p>Электрондук почта дарегиңизди ырастаңыз. Төмөндөгү кодду киргизиңиз:</p><p><b>{0}</b></p>
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_lt.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_lt.properties
index ee5afa9223f3..8dd25120ede6 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_lt.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_lt.properties
@@ -1,15 +1,15 @@
 emailVerificationSubject=El. pašto patvirtinimas
 emailVerificationBody=Paskyra {2} sukurta naudojant šį el. pašto adresą. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą\n\n{0}\n\nŠi nuoroda galioja {1} min.\n\nJei paskyros nekūrėte, tuomet ignuoruokite šį laišką. 
-emailVerificationBodyHtml=<p>Paskyra {2} sukurta naudojant šį el. pašto adresą. Jei tao buvote Jūs, tuomet paspauskite žemiau esančią nuorodą</p><p><a href=LT"{0}">{0}</a></p><p>Ši nuoroda galioja {1} min.</p><p>nJei paskyros nekūrėte, tuomet ignuoruokite šį laišką.</p>
+emailVerificationBodyHtml=<p>Paskyra {2} sukurta naudojant šį el. pašto adresą. Jei tao buvote Jūs, tuomet paspauskite žemiau esančią nuorodą</p><p><a href="{0}">{0}</a></p><p>Ši nuoroda galioja {1} min.</p><p>nJei paskyros nekūrėte, tuomet ignuoruokite šį laišką.</p>
 identityProviderLinkSubject=Sąsaja {0}
 identityProviderLinkBody=Kažas pageidauja susieti Jūsų "{1}" paskyrą su "{0}" {2} naudotojo paskyrą. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą norėdami susieti paskyras\n\n{3}\n\nŠi nuoroda galioja {4} min.\n\nJei paskyrų susieti nenorite, tuomet ignoruokite šį laišką. Jei paskyras susiesite, tuomet prie {1} galėsiste prisijungti per {0}.
-identityProviderLinkBodyHtml=<p>žas pageidauja susieti Jūsų <b>{1}</b> paskyrą su <b>{0}</b> {2} naudotojo paskyrą. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą norėdami susieti paskyras</p><p><a href=LT"{3}">{3}</a></p><p>Ši nuoroda galioja {4} min.</p><p>Jei paskyrų susieti nenorite, tuomet ignoruokite šį laišką. Jei paskyras susiesite, tuomet prie {1} galėsiste prisijungti per {0}.</p>
+identityProviderLinkBodyHtml=<p>žas pageidauja susieti Jūsų <b>{1}</b> paskyrą su <b>{0}</b> {2} naudotojo paskyrą. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą norėdami susieti paskyras</p><p><a href="{3}">{3}</a></p><p>Ši nuoroda galioja {4} min.</p><p>Jei paskyrų susieti nenorite, tuomet ignoruokite šį laišką. Jei paskyras susiesite, tuomet prie {1} galėsiste prisijungti per {0}.</p>
 passwordResetSubject=Slaptažodžio atkūrimas
 passwordResetBody=Kažkas pageidauja pakeisti Jūsų paskyros {2} slaptažodį. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą slaptažodžio pakeitimui.\n\n{0}\n\nŠi nuoroda ir kodas galioja {1} min.\n\nJei nepageidajate keisti slaptažodžio, tuomet ignoruokite šį laišką ir niekas nebus pakeista.
-passwordResetBodyHtml=<p>Kažkas pageidauja pakeisti Jūsų paskyros {2} slaptažodį. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą slaptažodžio pakeitimui.</p><p><a href=LT"{0}">Kredencialų nustatymo iš naujo nuoroda</a></p><p>Ši nuoroda ir kodas galioja {1} min.</p><p>Jei nepageidajate keisti slaptažodžio, tuomet ignoruokite šį laišką ir niekas nebus pakeista.</p>
+passwordResetBodyHtml=<p>Kažkas pageidauja pakeisti Jūsų paskyros {2} slaptažodį. Jei tai buvote Jūs, tuomet paspauskite žemiau esančią nuorodą slaptažodžio pakeitimui.</p><p><a href="{0}">Kredencialų nustatymo iš naujo nuoroda</a></p><p>Ši nuoroda ir kodas galioja {1} min.</p><p>Jei nepageidajate keisti slaptažodžio, tuomet ignoruokite šį laišką ir niekas nebus pakeista.</p>
 executeActionsSubject=Atnaujinkite savo paskyrą
 executeActionsBody=Sistemos administratorius pageidauja, kad Jūs atnaujintumėte savo {2} paskyrą. Paspauskite žemiau esančią nuorodą paskyros duomenų atnaujinimui.\n\n{0}\n\nŠi nuoroda galioja {1} min.\n\nJei Jūs neasate tikri, kad tai administratoriaus pageidavimas, tuomet ignoruokite šį laišką ir niekas nebus pakeista.
-executeActionsBodyHtml=<p>Sistemos administratorius pageidauja, kad Jūs atnaujintumėte savo {2} paskyrą. Paspauskite žemiau esančią nuorodą paskyros duomenų atnaujinimui.</p><p><a href=LT"{0}">{0}</a></p><p>Ši nuoroda galioja {1} min.</p><p>Jei Jūs neasate tikri, kad tai administratoriaus pageidavimas, tuomet ignoruokite šį laišką ir niekas nebus pakeista.</p>
+executeActionsBodyHtml=<p>Sistemos administratorius pageidauja, kad Jūs atnaujintumėte savo {2} paskyrą. Paspauskite žemiau esančią nuorodą paskyros duomenų atnaujinimui.</p><p><a href="{0}">{0}</a></p><p>Ši nuoroda galioja {1} min.</p><p>Jei Jūs neasate tikri, kad tai administratoriaus pageidavimas, tuomet ignoruokite šį laišką ir niekas nebus pakeista.</p>
 eventLoginErrorSubject=Nesėkmingas bandymas prisijungti prie jūsų paskyros
 eventLoginErrorBody=Bandymas prisijungti prie jūsų paskyros {0} iš {1} nesėkmingas. Jei tai nebuvote jūs, tuomet susisiekite su administratoriumi
 eventLoginErrorBodyHtml=<p>Bandymas prisijungti prie jūsų paskyros {0} iš {1} nesėkmingas. Jei tai nebuvote jūs, tuomet susisiekite su administratoriumi</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_nl.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_nl.properties
index f52b06f8dcf8..9885b506d2ba 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_nl.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_nl.properties
@@ -1,6 +1,14 @@
 emailVerificationSubject=Bevestig e-mailadres
 emailVerificationBody=Iemand heeft een {2} account aangemaakt met dit e-mailadres. Als u dit was, klikt u op de onderstaande koppeling om uw e-mailadres te bevestigen \n\n{0}\n\nDeze koppeling zal binnen {3} vervallen.\n\nU kunt dit bericht negeren indien u dit account niet heeft aangemaakt.
-emailVerificationBodyHtml=<p>Iemand heeft een {2} account aangemaakt met dit e-mailadres. Als u dit was, klikt u op de onderstaande koppeling om uw e-mailadres te bevestigen</p><p><a href="{0}">Koppeling naar e-mailadres bevestiging</a></p><p>Deze koppeling zal binnen {3} vervallen.</p<p>U kunt dit bericht negeren indien u dit account niet heeft aangemaakt.</p>
+emailVerificationBodyHtml=<p>Iemand heeft een {2} account aangemaakt met dit e-mailadres. Als u dit was, klikt u op de onderstaande koppeling om uw e-mailadres te bevestigen</p><p><a href="{0}">Koppeling naar e-mailadres bevestiging</a></p><p>Deze koppeling zal binnen {3} vervallen.</p><p>U kunt dit bericht negeren indien u dit account niet heeft aangemaakt.</p>
+orgInviteSubject=Uitnodiging om lid te worden van de {0} organisatie
+orgInviteBody=U bent uitgenodigd om lid te worden van de "{3}" organisatie. Klik op onderstaande koppeling om lid te worden.\n\n{0}\n\nDeze koppeling verloopt binnen {4}.\n\nAls u geen lid wilt worden van deze organisatie, dan kunt u dit bericht simpelweg negeren.
+orgInviteBodyHtml=<p>U bent uitgenodigd om lid te worden van de {3}  organisatie. Klik op onderstaande koppeling om lid te worden. </p><p><a href="{0}">Koppeling om lid te worden van de {3} organisatie</a></p><p>Deze koppeling verloopt binnen {4}.</p><p>Als u geen lid wilt worden van deze organisatie, dan kunt u dit bericht simpelweg negeren.</p>
+orgInviteBodyPersonalized=Hallo, "{5}" "{6}".\n\n U bent uitgenodigd om lid te worden van de "{3}" organisatie. Klik op onderstaande koppeling om lid te worden.\n\n{0}\n\nDeze koppeling verloopt binnen {4}.\n\nIAls u geen lid wilt worden van deze organisatie, dan kunt u dit bericht simpelweg negeren.
+orgInviteBodyPersonalizedHtml=<p>Hallo, {5} {6}.</p><p>U bent uitgenodig om lid te worden van de {3} organisatie. Klik op onderstaande koppeling om lid te worden. </p><p><a href="{0}">Koppeling om lid te worden van de {3} organisatie</a></p><p>Deze koppeling verloopt binnen {4}.</p><p>Als u geen lid wilt worden van deze organisatie, dan kunt u dit bericht simpelweg negeren.</p>
+emailUpdateConfirmationSubject=Bevestig nieuw e-mailadres
+emailUpdateConfirmationBody=Klik op onderstaande koppeling om in uw {2} account het e-mailaddress bij te werken naar {1}\n\n{0}\n\nDeze koppeling verloopt binnen {3}.\n\nAls u deze wijzing toch niet wilt doorvoeren, dan kunt u dit bericht simpelweg negeren.
+emailUpdateConfirmationBodyHtml=<p>Klik op onderstaande koppeling om in uw {2} account het e-mailaddress bij te werken naar {1}</p><p><a href="{0}">{0}</a></p><p>Deze koppeling verloopt binnen {3}.</p><p>Als u deze wijzing toch niet wilt doorvoeren, dan kunt u dit bericht simpelweg negeren.</p>
 emailTestSubject=[KEYCLOAK] - SMTP testbericht
 emailTestBody=Dit is een testbericht
 emailTestBodyHtml=<p>Dit is een testbericht</p>
@@ -17,28 +25,40 @@ eventLoginErrorSubject=Inlogfout
 eventLoginErrorBody=Er is een foutieve inlogpoging gedetecteerd op uw account om {0} vanuit {1}. Als u dit niet was, neem dan contact op met de beheerder.
 eventLoginErrorBodyHtml=<p>Er is een foutieve inlogpoging gedetecteerd op uw account om {0} vanuit {1}. Als u dit niet was, neem dan contact op met de beheerder.</p>
 eventRemoveTotpSubject=OTP verwijderd
-eventRemoveTotpBody=OTP is verwijderd van uw account om {0} vanuit {1}. Als u dit niet was, neem dan contact op met uw beheerder.
-eventRemoveTotpBodyHtml=<p>OTP is verwijderd van uw account om {0} vanuit {1}. Als u dit niet was, neem dan contact op met uw beheerder.</p>
+eventRemoveTotpBody=OTP is verwijderd van uw account om {0} vanuit {1}. Als u dit niet deed, neem dan contact op met uw beheerder.
+eventRemoveTotpBodyHtml=<p>OTP is verwijderd van uw account om {0} vanuit {1}. Als u dit niet deed, neem dan contact op met uw beheerder.</p>
 eventUpdatePasswordSubject=Wachtwoord gewijzigd
-eventUpdatePasswordBody=Uw wachtwoord is gewijzigd om {0} door {1}. Als u dit niet was, neem dan contact op met uw beheerder.
-eventUpdatePasswordBodyHtml=<p>Uw wachtwoord is gewijzigd om {0} door {1}. Als u dit niet was, neem dan contact op met uw beheerder.</p>
+eventUpdatePasswordBody=Uw wachtwoord is gewijzigd om {0} vanuit {1}. Als u dit niet deed, neem dan contact op met uw beheerder.
+eventUpdatePasswordBodyHtml=<p>Uw wachtwoord is gewijzigd om {0} vanuit {1}. Als u dit niet deed, neem dan contact op met uw beheerder.</p>
 eventUpdateTotpSubject=OTP gewijzigd
-eventUpdateTotpBody=OTP is gewijzigd voor uw account om {0} door {1}. Als u dit niet was, neem dan contact op met uw beheerder.
+eventUpdateTotpBody=OTP is gewijzigd voor uw account om {0} vanuit {1}. Als u dit niet deed, neem dan contact op met uw beheerder.
 eventUpdateTotpBodyHtml=<p>OTP is gewijzigd voor uw account om {0} door {1}. Als u dit niet was, neem dan contact op met uw beheerder.</p>
-
+eventUpdateCredentialSubject=Aanmeldgegevens bijwerken
+eventUpdateCredentialBody=Uw aanmeldgegevens bij {0} zijn gewijzigd op {1} vanuit {2}. Als u dit niet was, neem dan contact op met uw beheerder.
+eventUpdateCredentialBodyHtml=<p>Uw aanmeldgegevens bij {0} zijn gewijzigd op {1} vanuit {2}. Als u dit niet was, neem dan contact op met uw beheerder.</p>
+eventRemoveCredentialSubject=credential verwijderd
+eventRemoveCredentialBody=Credential {0} is verwijderd van uw account op {1} vanuit {2}. Als u dit niet was, neem dan contact op met uw beheerder.
+eventRemoveCredentialBodyHtml=<p>Credential {0} is verwijderd van uw account op {1} vanuit {2}. Als u dit niet was, neem dan contact op met uw beheerder.</p>
+eventUserDisabledByTemporaryLockoutSubject=Gebruiker tijdelijk geblokkeerd
+eventUserDisabledByTemporaryLockoutBody=Uw gebruiker is tijdelijk geblokkeerd door meerdere meerder gefaalde inlogpogingen op {0}. Indien nodig, kunt u een beheerder contacteren.
+eventUserDisabledByTemporaryLockoutHtml=<p>Uw gebruiker is tijdelijk geblokkeerd door meerdere meerder gefaalde inlogpogingen op {0}. Indien nodig, kunt u een beheerder contacteren.</p>
+eventUserDisabledByPermanentLockoutSubject=Gebruiker permanent geblokkeerd
+eventUserDisabledByPermanentLockoutBody=Uw gebruiker is permanent geblokkeerd door meerdere meerder gefaalde inlogpogingen op {0}. Gelieve een beheerder te contacteren.
+eventUserDisabledByPermanentLockoutHtml=<p>Uw gebruiker is permanent geblokkeerd door meerdere meerder gefaalde inlogpogingen op {0}. Gelieve een beheerder te contacteren.</p>
+requiredAction.CONFIGURE_TOTP=OTP instellen
+requiredAction.TERMS_AND_CONDITIONS=Algemene voorwaarden accepteren
+requiredAction.UPDATE_PASSWORD=Wachtwoord bijwerken
+requiredAction.UPDATE_PROFILE=Profiel bijwerken
+requiredAction.VERIFY_EMAIL=E-mail bevestigen
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=AUTHN herstelcodes aanmaken
 
 # units for link expiration timeout formatting
+# for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#seconden|1#seconde|1<seconden}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minuten|1#minuut|1<minuten}
 linkExpirationFormatter.timePeriodUnit.hours=uur
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#dagen|1#dag|1<dagen}
-eventRemoveCredentialBodyHtml=<p>Credential {0} is verwijderd van je account op {1} van {2}. Was jij dit niet? Neem contact op met een beheerder.</p>
-requiredAction.UPDATE_PASSWORD=Wijzig wachtwoord
-eventUserDisabledByTemporaryLockoutSubject=Gebruiker tijdelijk geblokkeerd
-eventUserDisabledByPermanentLockoutSubject=Gebruiker permanent geblokkeerd
-requiredAction.UPDATE_PROFILE=Wijzig profiel
-requiredAction.VERIFY_EMAIL=Verifieer e-mailadres
-requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Genereer herstelcodes
-emailUpdateConfirmationSubject=Verifieer nieuw e-mailadres
-requiredAction.TERMS_AND_CONDITIONS=Algemene voorwaarden
-emailVerificationBodyCodeHtml=<p>Verifieer je e-mailadres door de volgende code in te voeren: </p><p><b>{0}</b></p>
+emailVerificationBodyCode=Verifieer uw e-mailadres door de volgende code in te voeren:\n\n{0}\n\n.
+emailVerificationBodyCodeHtml=<p>Verifieer uw e-mailadres door de volgende code in te voeren: </p><p><b>{0}</b></p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_no.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_no.properties
index e5905ae091e8..721d2445bd13 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_no.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_no.properties
@@ -2,7 +2,7 @@ emailVerificationSubject=Bekreft e-postadresse
 emailVerificationBody=Noen har opprettet en {2} konto med denne e-postadressen. Hvis dette var deg, klikk på lenken nedenfor for å bekrefte e-postadressen din\n\n{0}\n\nDenne lenken vil utløpe om {1} minutter.\n\nHvis du ikke opprettet denne kontoen, vennligst ignorer denne meldingen.
 emailVerificationBodyHtml=<p>Noen har opprettet en {2} konto med denne e-postadressen. Hvis dette var deg, klikk på lenken nedenfor for å bekrefte e-postadressen din</p><p><a href="{0}">Lenke for å bekrefte e-postadresse</a></p><p>Denne lenken vil utløpe om {1} minutter.</p><p>Hvis du ikke opprettet denne kontoen, vennligst ignorer denne meldingen.</p>
 identityProviderLinkSubject=Lenke {0}
-identityProviderLinkBody=Noen vil koble din <b>{1}</b> konto med <b>{0}</b> konto til bruker {2}. Hvis dette var deg, klikk på lenken nedenfor for å koble kontoene\n\n{3}\n\nDenne lenken vil utløpe om {4} minutter\n\nHvis du ikke vil koble kontoene, vennligst ignorer denne meldingen. Hvis du kobler kontoene sammen vil du kunne logge inn til {1} gjennom {0}.
+identityProviderLinkBody=Noen vil koble din {1} konto med {0} konto til bruker {2}. Hvis dette var deg, klikk på lenken nedenfor for å koble kontoene\n\n{3}\n\nDenne lenken vil utløpe om {4} minutter\n\nHvis du ikke vil koble kontoene, vennligst ignorer denne meldingen. Hvis du kobler kontoene sammen vil du kunne logge inn til {1} gjennom {0}.
 identityProviderLinkBodyHtml=<p>Noen vil koble din <b>{1}</b> konto med <b>{0}</b> konto til bruker {2}. Hvis dette var deg, klikk på lenken nedenfor for å koble kontoene.</p><p><a href="{3}">Lenke for å koble konto</a></p><p>Denne lenken vil utløpe om {4} minutter.</p><p>Hvis du ikke vil koble kontoene, vennligst ignorer denne meldingen. Hvis du kobler kontoene sammen vil du kunne logge inn til {1} gjennom {0}.</p>
 passwordResetSubject=Tilbakestill passord
 passwordResetBody=Noen har bedt om å endre innloggingsdetaljene til din konto {2}. Hvis dette var deg, klikk på lenken nedenfor for å tilbakestille dem.\n\n{0}\n\nDenne lenken vil utløpe om {1} minutter.\n\nHvis du ikke vil tilbakestille din innloggingsdata, vennligst ignorer denne meldingen og ingenting vil bli endret.
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_pl.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_pl.properties
index 46fcef930aa1..b18559de99e5 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_pl.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_pl.properties
@@ -1,6 +1,14 @@
 emailVerificationSubject=Zweryfikuj email
-emailVerificationBody=Ktoś utworzył konto {2} z Twoim adresem e-mail. Jeśli to Ty, kliknij proszę poniższy odnośnik, aby potwierdzić założenie konta \n\n{0}\n\nOdnośnik wygaśnie w ciągu {3}.\n\nJeśli nie utworzyłaś/eś tego konta, po prostu zignoruj niniejszą wiadomość.
+emailVerificationBody=Ktoś utworzył konto {2} z Twoim adresem e-mail. Jeśli to Ty, kliknij proszę poniższy odnośnik, aby potwierdzić założenie konta\n\n{0}\n\nOdnośnik wygaśnie w ciągu {3}.\n\nJeśli nie utworzyłaś/eś tego konta, po prostu zignoruj niniejszą wiadomość.
 emailVerificationBodyHtml=<p>Ktoś utworzył konto {2} z Twoim adresem e-mail. Jeśli to Ty, kliknij proszę <a href="{0}">odnośnik</a>, aby potwierdzić założenie konta</p><p>Odnośnik wygaśnie w ciągu {3}</p><p>Jeśli nie utworzyłaś/eś tego konta, po prostu zignoruj niniejszą wiadomość.</p>
+orgInviteSubject=Zaproszenie, aby dołączyć do organizacji {0}
+orgInviteBody=Zostałeś zaproszony do dołączenia do organizacji "{3}". Kliknij poniższy link, aby dołączyć.\n\n{0}\nTen link wygaśnie w ciągu {4}.\n\nJeśli nie chcesz dołączyć do organizacji, zignoruj tę wiadomość.
+orgInviteBodyHtml=<p>Zostałeś zaproszony do dołączenia do organizacji {3}. Kliknij poniższy link, aby dołączyć. </p><p><a href="{0}">Link, aby dołączyć do organizacji</a></p><p>Ten link wygaśnie w ciągu {4}.</p><p>Jeśli nie chcesz dołączyć do organizacji, zignoruj tę wiadomość.</p>
+orgInviteBodyPersonalized=Cześć, "{5}" "{6}".\n\n Zostałeś zaproszony do dołączenia do organizacji "{3}". Kliknij poniższy link, aby dołączyć.\n\n{0}\n\nTen link wygaśnie w ciągu {4}.\n\nJeśli nie chcesz dołączyć do organizacji, zignoruj tę wiadomość.
+orgInviteBodyPersonalizedHtml=<p>Cześć, {5} {6}.</p><p>Zostałeś zaproszony do dołączenia do organizacji {3}. Kliknij poniższy link, aby dołączyć.</p><p><a href="{0}">Link, aby dołączyć do organizacji</a></p><p>Ten link wygaśnie w ciągu {4}.</p><p>Jeśli nie chcesz dołączyć do organizacji, zignoruj tę wiadomość.</p>
+emailUpdateConfirmationSubject=Zweryfikuj nowy e-mail
+emailUpdateConfirmationBody=Aby zaktualizować konto {2} za pomocą adresu e-mail {1}, kliknij poniższy link\n\n{0}\n\nTen link wygaśnie w ciągu {3}.\n\nJeśli nie chcesz kontynuować tej modyfikacji, zignoruj tę wiadomość.
+emailUpdateConfirmationBodyHtml=<p>Aby zaktualizować konto {2} za pomocą adresu e-mail {1}, kliknij poniższy link</p><p><a href="{0}">{0}</a></p><p>Ten link wygaśnie w ciągu {3}.</p><p>Jeśli nie chcesz kontynuować tej modyfikacji, zignoruj tę wiadomość.</p>
 emailTestSubject=[KEYCLOAK] - wiadomość testowa SMTP
 emailTestBody=To jest wiadomość testowa
 emailTestBodyHtml=<p>To jest wiadomość testowa</p>
@@ -25,19 +33,34 @@ eventUpdatePasswordBodyHtml=<p>Twoje hasło zostało zmienione {0} z {1}. Jeśli
 eventUpdateTotpSubject=Aktualizuj hasło jednorazowe (OTP)
 eventUpdateTotpBody=Hasło jednorazowe (OTP) zostało zaktualizowane na Twoim koncie {0} z {1}. Jeśli to nie Ty, skontaktuj się z administratorem.
 eventUpdateTotpBodyHtml=<p>Hasło jednorazowe (OTP) zostało zaktualizowane na Twoim koncie {0} z {1}. Jeśli to nie Ty, skontaktuj się z administratorem.</p>
+eventUpdateCredentialSubject=Aktualizacja poświadczenia
+eventUpdateCredentialBody=Twoje poświadczenie {0} zostało zmienione dnia {1} z {2}. Jeśli to nie byłeś Ty, skontaktuj się z administratorem.
+eventUpdateCredentialBodyHtml=<p>Twoje poświadczenie {0} zostało zmienione dnia {1} z {2}. Jeśli to nie byłeś Ty, skontaktuj się z administratorem.</p>
+eventRemoveCredentialSubject=Usunięcie poświadczenia
+eventRemoveCredentialBody=Poświadczenie {0} zostało usunięte z Twojego konta dnia {1} z {2}. Jeśli to nie byłeś Ty, skontaktuj się z administratorem.
+eventRemoveCredentialBodyHtml=<p>Poświadczenie {0} zostało usunięte z Twojego konta dnia {1} z {2}. Jeśli to nie byłeś Ty, skontaktuj się z administratorem.</p>
+eventUserDisabledByTemporaryLockoutSubject=Użytkownik zablokowany tymczasowo
+eventUserDisabledByTemporaryLockoutBody=Twoje konto zostało tymczasowo zablokowane z powodu wielokrotnych nieudanych prób logowania dnia {0}. W razie potrzeby skontaktuj się z administratorem.
+eventUserDisabledByTemporaryLockoutHtml=<p>Twoje konto zostało tymczasowo zablokowane z powodu wielokrotnych nieudanych prób logowania dnia {0}. W razie potrzeby skontaktuj się z administratorem.</p>
+eventUserDisabledByPermanentLockoutSubject=Użytkownik zablokowany na stałe
+eventUserDisabledByPermanentLockoutBody=Twoje konto zostało trwale zablokowane z powodu wielokrotnych nieudanych prób logowania dnia {0}. Skontaktuj się z administratorem.
+eventUserDisabledByPermanentLockoutHtml=<p>Twoje konto zostało trwale zablokowane z powodu wielokrotnych nieudanych prób logowania dnia {0}. Skontaktuj się z administratorem.</p>
 
 requiredAction.CONFIGURE_TOTP=Konfiguracja hasła jednorazowego (OTP)
 requiredAction.TERMS_AND_CONDITIONS=Regulamin
 requiredAction.UPDATE_PASSWORD=Aktualizacja hasła
 requiredAction.UPDATE_PROFILE=Aktualizacja profilu
 requiredAction.VERIFY_EMAIL=Weryfikacja adresu e-mail
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Wygeneruj kody odzyskiwania
 
 # units for link expiration timeout formatting
+# for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#sekund|1#sekunda|2#sekundy|4<sekund}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minut|1#minuta|2#minuty|4<minut}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#godzin|1#godzina|2#godziny|4<godzin}
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#dni|1#dzień|1<dni}
 
 emailVerificationBodyCode=Potwierdź proszę swój adres e-mail wprowadzając następujący kod.\n\n{0}\n\n.
-emailVerificationBodyCodeHtml=<p>Potwierdź proszę swój adres e-mail, wprowadzając następujący kod.</p><p><b>{0}</b></p>
-
+emailVerificationBodyCodeHtml=<p>Potwierdź proszę swój adres e-mail, wprowadzając następujący kod.</p><p><b>{0}</b></p>
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_pt_BR.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_pt_BR.properties
old mode 100755
new mode 100644
index 3228617282c0..749a5475d8a0
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_pt_BR.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_pt_BR.properties
@@ -1,43 +1,61 @@
-emailVerificationSubject=Verificação de endereço de e-mail
+emailVerificationSubject=Verificar email
 emailVerificationBody=Alguém criou uma conta {2} com este endereço de e-mail. Se foi você, clique no link abaixo para verificar o seu endereço de email.\n\n{0}\n\nEste link irá expirar dentro de {3}.\n\nSe não foi você quem criou esta conta, basta ignorar esta mensagem.
-emailVerificationBodyHtml=<p>Alguém criou uma conta {2} com este endereço de e-mail. Se foi você, clique no link abaixo para verificar o seu endereço de email.</p><p><a href="{0}">Link para verificação de endereço de e-mail</a></p><p>Este link irá expirar dentro de {3}.</p><p>Se não foi você quem criou esta conta, basta ignorar esta mensagem.</p>
+emailVerificationBodyHtml=<p>Alguém criou uma conta {2} com este endereço de e-mail. Se foi você, clique no link abaixo para verificar o seu endereço de email.</p><p><a href="{0}">Link para verificação de endereço de email</a></p><p>Este link irá expirar dentro de {3}.</p><p>Se não foi você quem criou esta conta, basta ignorar esta mensagem.</p>
 emailTestSubject=[KEYCLOAK] - Mensagem de teste SMTP
 emailTestBody=Esta é uma mensagem de teste
 emailTestBodyHtml=<p>Esta é uma mensagem de teste</p>
 identityProviderLinkSubject=Vincular {0}
-identityProviderLinkBody=Alguém quer vincular a sua conta "{1}" com a conta "{0}" do usuário {2} . Se foi você, clique no link abaixo para vincular as contas.\n\n{3}\n\nEste link irá expirar em {5}.\n\nSe você não quer vincular a conta, apenas ignore esta mensagem. Se você vincular as contas, você será capaz de logar em {1} fazendo login em {0}.
-identityProviderLinkBodyHtml=<p>Alguém quer vincular a sua conta <b>{1}</b> com a conta <b>{0}</b> do usuário {2} . Se foi você, clique no link abaixo para vincular as contas.</p><p><a href="{3}">Link para confirmar vinculação de contas</a></p><p>Este link irá expirar em {5}.</p><p>Se você não quer vincular a conta, apenas ignore esta mensagem. Se você vincular as contas, você será capaz de logar em {1} fazendo login em {0}.</p>
-passwordResetSubject=Redefinição de senha
+identityProviderLinkBody=Alguém quer vincular a sua conta "{1}" com a conta "{0}" do usuário {2} . Se foi você, clique no link abaixo para vincular as contas\n\n{3}\n\nEste link expirará em {5}.\n\nSe você não iniciou este processo ou não deseja vincular as contas, apenas ignore esta mensagem. Se você vincular as contas, poderá fazer login em {1} através de {0}.
+identityProviderLinkBodyHtml=<p>Alguém quer vincular a sua conta <b>{1}</b> com a conta <b>{0}</b> do usuário {2}. Se foi você, clique no link abaixo para vincular as contas</p><p><a href="{3}">Link para confirmar vinculação de contas</a></p><p>Este link expirarpa em {5}.</p><p>Se você não iniciou este processo ou não deseja vincular as contas, apenas ignore esta mensagem. Se você vincular as contas, poderá fazer login em {1} através de {0}.</p>
+passwordResetSubject=Redefinir senha
 passwordResetBody=Alguém solicitou uma alteração de senha da sua conta {2}. Se foi você, clique no link abaixo para redefini-la.\n\n{0}\n\nEste link e código expiram em {3}.\n\nSe você não deseja redefinir sua senha, apenas ignore esta mensagem e nada será alterado.
 passwordResetBodyHtml=<p>Alguém solicitou uma alteração de senha da sua conta {2}. Se foi você, clique no link abaixo para redefini-la.</p><p><a href="{0}">Link para redefinir a senha</a></p><p>Este link irá expirar em {3}.</p><p>Se você não deseja redefinir sua senha, apenas ignore esta mensagem e nada será alterado.</p>
-executeActionsSubject=Atualização de conta
+executeActionsSubject=Atualize sua conta
 executeActionsBody=Um administrador solicitou que você atualize sua conta {2} com a(s) seguinte(s) etapa(s): {3}. Clique no link abaixo para iniciar o processo.\n\n{0}\n\nEste link irá expirar em {4}.\n\nSe você não tem conhecimento de que o administrador solicitou isso, basta ignorar esta mensagem e nada será alterado.
 executeActionsBodyHtml=<p>Um administrador solicitou que você atualize sua conta {2} com a(s) seguinte(s) etapa(s): {3}. Clique no link abaixo para iniciar o processo.</p><p><a href="{0}">Link para atualizar a conta</a></p><p>Este link irá expirar em {4}.</p><p>Se você não tem conhecimento de que o administrador solicitou isso, basta ignorar esta mensagem e nada será alterado.</p>
 eventLoginErrorSubject=Erro de login
 eventLoginErrorBody=Uma tentativa de login malsucedida da sua conta foi detectada em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.
 eventLoginErrorBodyHtml=<p>Uma tentativa de login malsucedida da sua conta foi detectada em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.</p>
-eventRemoveTotpSubject=Remover autenticação de dois fatores
-eventRemoveTotpBody=A autenticação de dois fatores foi removida da sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.
-eventRemoveTotpBodyHtml=<p>A autenticação de dois fatores foi removida da sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.</p>
-eventUpdatePasswordSubject=Atualização de senha
+eventRemoveTotpSubject=Remover OTP
+eventRemoveTotpBody=OTP foi removido da sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.
+eventRemoveTotpBodyHtml=<p>OTP foi removido da sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.</p>
+eventUpdatePasswordSubject=Atualizar senha
 eventUpdatePasswordBody=Sua senha foi alterada em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.
 eventUpdatePasswordBodyHtml=<p>Sua senha foi alterada em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.</p>
-eventUpdateTotpSubject=Atualização de autenticação de dois fatores
+eventUpdateTotpSubject=Atualizar OTP
 eventUpdateTotpBody=A autenticação de dois fatores foi atualizada para a sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.
 eventUpdateTotpBodyHtml=<p>A autenticação de dois fatores foi atualizada para a sua conta em {0} de {1}. Se não foi você, por favor, entre em contato com um administrador.</p>
-
 requiredAction.CONFIGURE_TOTP=Configurar Autenticação de Dois Fatores
 requiredAction.TERMS_AND_CONDITIONS=Termos e Condições
 requiredAction.UPDATE_PASSWORD=Atualizar Senha
 requiredAction.UPDATE_PROFILE=Atualizar Perfil
-requiredAction.VERIFY_EMAIL=Verificar Endereço de E-mail
+requiredAction.VERIFY_EMAIL=Verificar Email
 
 # units for link expiration timeout formatting
 linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#segundos|1#segundo|1<segundos}
 linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minutos|1#minuto|1<minutos}
 linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#horas|1#hora|1<horas}
 linkExpirationFormatter.timePeriodUnit.days={0,choice,0#dias|1#dia|1<dias}
-
 emailVerificationBodyCode=Verifique o seu endereço de e-mail inserindo o seguinte código.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>Verifique o seu endereço de e-mail inserindo o seguinte código.</p><p><b>{0}</b></p>
-
+orgInviteSubject=Convite para participar da organização {0}
+emailUpdateConfirmationSubject=Verifique nova mensagem
+orgInviteBodyPersonalized=Olá, "{5}" "{6}".\n\nVocê foi convidado para participar da organização "{3}". Clique no link abaixo para entrar.\n\n{0}\n\nEsse link expira em {4}.\n\nSe você não quiser participar da organização ignore essa mensagem.
+orgInviteBody=Você está sendo convidado para participar da organização {3}. Clique no link abaixo para entrar.\n\n{0}\n\nEsse link irá expirar em {4}.\n\nSe você não quiser participar da organização ignore essa mensagem.
+orgInviteBodyHtml=<p>Você está sendo convidado para participar da organização {3}. Clique no link abaixo para entrar. </p><p><a href="{0}">Link para entrar na organização</a></p><p>Este link expira em {4}.</p><p>Se você não quiser participar da organização ignore essa mensagem.</p>
+orgInviteBodyPersonalizedHtml=<p>Olá, {5} {6}.</p><p>Você foi convidado para entrar na organização {3}. Clique no link abaixo para entrar. </p><p><a href="{0}">Link para entrar na organização</a></p><p>Esse link expirará dentro de {4}.</p><p>Se você não quiser entrar na organização, ignore essa mensagem.</p>
+eventUserDisabledByPermanentLockoutBody=Seu usuário foi desativado permanentemente devido a múltiplas tentativas fracassadas em {0}. Por favor, contate um administrador.
+eventUserDisabledByTemporaryLockoutBody=Seu usuário foi desativado temporariamente devido a múltiplas tentativas fracassadas em {0}. Por favor, contate um administrador se necessário.
+emailUpdateConfirmationBody=Para atualizar sua conta {2} com o endereço de email {1}, clique no link abaixo\n\n{0}\n\nEste link expirará em {3}.\n\nSe você não deseja prosseguir com esta modificação, apenas ignore esta mensagem.
+emailUpdateConfirmationBodyHtml=<p>Para atualizar sua conta {2} com o endereço de email {1}, clique no link abaixo</p><p><a href="{0}">{0}</a></p><p>Este link expirará em {3}.</p><p>Se você não deseja prosseguir com esta modificação, apenas ignore esta mensagem.</p>
+eventUpdateCredentialSubject=Atualizar credencial
+eventUpdateCredentialBody=Sua credencial {0} foi alterada em {1} a partir de {2}. Se não foi você, por favor, contate um administrador.
+eventUpdateCredentialBodyHtml=<p>Sua credencial {0} foi alterada em {1} a partir de {2}. Se não foi você, por favor, contate um administrador.</p>
+eventRemoveCredentialSubject=Remover credencial
+eventRemoveCredentialBody=A credencial {0} foi removida da sua conta em {1} a partir de {2}. Se não foi você, por favor, contate um administrador.
+eventRemoveCredentialBodyHtml=<p>A credencial {0} foi removida da sua conta em {1} a partir de {2}. Se não foi você, por favor, contate um administrador.</p>
+eventUserDisabledByTemporaryLockoutSubject=Usuário desativado por bloqueio temporário
+eventUserDisabledByTemporaryLockoutHtml=<p>Seu usuário foi desativado temporariamente devido a múltiplas tentativas fracassadas em {0}. Por favor, contate um administrador se necessário.</p>
+eventUserDisabledByPermanentLockoutSubject=Usuário desativado por bloqueio permanente
+eventUserDisabledByPermanentLockoutHtml=<p>Seu usuário foi desativado permanentemente devido a múltiplas tentativas fracassadas em {0}. Por favor, contate um administrador.</p>
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Gerar Códigos de Recuperação
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ro.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ro.properties
new file mode 100644
index 000000000000..b3729f44ba27
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ro.properties
@@ -0,0 +1,59 @@
+emailVerificationSubject=Verificați e-mailul
+emailVerificationBodyHtml=<p>Cineva a creat un cont {2} cu această adresă de e-mail. Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a vă verifica adresa de e-mail</p><p><a href="{0}">Link către verificarea adresei de e-mail</a></p><p>Acest link va expira în {3}.</p><p>Dacă nu ați creat acest cont, ignorați acest mesaj.</p>
+emailVerificationBody=Cineva a creat un cont {2} cu această adresă de e-mail. Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a vă verifica adresa de e-mail\n\n{0}\n\nAcest link va expira în termen de {3}.\n\nDacă nu ați creat acest cont, ignorați acest mesaj.
+orgInviteSubject=Invitație de a vă alătura organizației {0}
+orgInviteBodyHtml=<p>Ați fost invitat să vă alăturați organizației {3}. Faceți clic pe linkul de mai jos pentru a vă alătura. </p><p><a href="{0}">Link pentru a vă alătura organizației</a></p><p>Acest link va expira în {4}.</p><p>Dacă nu doriți să vă alăturați organizației, ignorați acest mesaj.</p>
+orgInviteBodyPersonalizedHtml=<p>Bună ziua, {5} {6}.</p><p>Ați fost invitat să vă alăturați organizației {3}. Faceți clic pe linkul de mai jos pentru a vă alătura. </p><p><a href="{0}">Link pentru a vă alătura organizației</a></p><p>Acest link va expira în {4}.</p><p>Dacă nu doriți să vă alăturați organizației, ignorați acest mesaj.</p>
+emailUpdateConfirmationSubject=Verificați e-mailul nou
+emailUpdateConfirmationBody=Pentru a vă actualiza contul {2} cu adresa de e-mail {1}, faceţi clic pe linkul de mai jos\n\n{0}\n\nAcest link va expira în termen de {3}.\n\nDacă nu doriți să continuați cu această modificare, ignorați acest mesaj.
+emailTestSubject=[KEYCLOAK] - mesaj de testare SMTP
+emailTestBody=Acesta este un mesaj de testare
+emailTestBodyHtml=<p>Acesta este un mesaj de testare</p>
+identityProviderLinkSubject=Link {0}
+emailUpdateConfirmationBodyHtml=<p>Pentru a vă actualiza contul {2} cu adresa de e-mail {1}, faceți clic pe linkul de mai jos</p><p><a href="{0}">{0}</a></p><p>Acest link va expira în {3}.</p><p>Dacă nu doriți să continuați cu această modificare, ignorați acest mesaj.</p>
+identityProviderLinkBody=Cineva dorește să vă conecteze contul „{1}” cu contul „{0}” al utilizatorului {2} . Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a conecta conturile\n\n{3}\n\nAcest link va expira în {5}.\n\nDacă nu doriți să conectați contul, ignorați acest mesaj. Dacă conectați conturi, vă veți putea conecta la {1} până la {0}.
+passwordResetSubject=Resetați parola
+passwordResetBody=Cineva tocmai a solicitat să schimbe datele de conectare ale contului dvs. {2}. Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a le reseta.\n\n{0}\n\nAcest link și cod vor expira în {3}.\n\nDacă nu doriți să vă resetați acreditările, ignorați acest mesaj și nu se va schimba nimic.
+executeActionsSubject=Actualizați-vă contul
+executeActionsBodyHtml=<p>Administratorul dvs. tocmai a solicitat să vă actualizați contul {2} efectuând următoarele acțiuni: {3}. Faceți clic pe linkul de mai jos pentru a începe acest proces.</p><p><a href="{0}">Link către actualizarea contului</a></p><p>Acest link va expira în {4}.</p><p>Dacă nu știți că administratorul dvs. a solicitat acest lucru, ignorați acest mesaj și nimic nu va fi schimbat.</p>
+executeActionsBody=Administratorul dvs. tocmai a solicitat să vă actualizați contul {2} efectuând următoarele acțiuni: {3}. Faceți clic pe linkul de mai jos pentru a începe acest proces.\n\n{0}\n\nAcest link va expira în termen de {4}.\n\nDacă nu știți că administratorul dvs. a solicitat acest lucru, ignorați acest mesaj și nu se va schimba nimic.
+eventLoginErrorSubject=Eroare de conectare
+eventLoginErrorBody=O încercare eșuată de conectare a fost detectată în contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventLoginErrorBodyHtml=<p>O încercare eșuată de conectare a fost detectată în contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventRemoveTotpSubject=Eliminați OTP
+eventRemoveTotpBody=OTP a fost eliminat din contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventRemoveTotpBodyHtml=<p>OTP a fost eliminat din contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventUpdatePasswordSubject=Actualizați parola
+eventUpdatePasswordBody=Parola dvs. a fost schimbată pe {0} din {1}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventUpdatePasswordBodyHtml=<p>Parola dvs. a fost schimbată pe {0} din {1}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventUpdateTotpSubject=Actualizați OTP
+eventUpdateTotpBody=OTP a fost actualizat pentru contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventUpdateTotpBodyHtml=<p>OTP a fost actualizat pentru contul dvs. pe {0} din {1}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventUpdateCredentialSubject=Actualizați credențialele
+eventUpdateCredentialBodyHtml=<p>Credențialele dvs. {0} au fost modificate pe {1} din {2}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventUpdateCredentialBody=Credențialele dvs. {0} au fost modificate pe {1} din {2}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventRemoveCredentialSubject=Eliminați credențialul
+eventRemoveCredentialBodyHtml=<p>Credențialul {0} a fost eliminată din contul dvs. pe {1} din {2}. Dacă nu ați fost dvs., contactați un administrator.</p>
+eventUserDisabledByTemporaryLockoutBody=Utilizatorul dvs. a fost dezactivat temporar din cauza mai multor încercări eșuate pe {0}. Vă rugăm să contactați un administrator dacă este necesar.
+eventUserDisabledByTemporaryLockoutHtml=<p>Utilizatorul dvs. a fost dezactivat temporar din cauza mai multor încercări eșuate pe {0}. Vă rugăm să contactați un administrator dacă este necesar.</p>
+eventUserDisabledByPermanentLockoutSubject=Utilizator dezactivat prin blocarea permanentă
+eventUserDisabledByPermanentLockoutBody=Utilizatorul dvs. a fost dezactivat definitiv din cauza mai multor încercări eșuate pe {0}. Vă rugăm să contactați un administrator.
+requiredAction.CONFIGURE_TOTP=Configurați OTP
+requiredAction.TERMS_AND_CONDITIONS=Termeni și condiții
+requiredAction.UPDATE_PASSWORD=Actualizați parola
+requiredAction.UPDATE_PROFILE=Actualizați profilul
+requiredAction.VERIFY_EMAIL=Verificați e-mailul
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generați coduri de recuperare
+linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minute|1#minut|1<minute}
+linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#ore|1#oră|1<ore}
+linkExpirationFormatter.timePeriodUnit.days={0,choice,0#zile|1#zi|1<zile}
+emailVerificationBodyCode=Vă rugăm să vă verificați adresa de e-mail introducând următorul cod.\n\n{0}\n\n.
+emailVerificationBodyCodeHtml=<p>Vă rugăm să vă verificați adresa de e-mail introducând următorul cod.</p><p><b>{0}</b></p>
+eventUserDisabledByPermanentLockoutHtml=<p>Utilizatorul dvs. a fost dezactivat definitiv din cauza mai multor încercări eșuate pe {0}. Vă rugăm să contactați un administrator.</p>
+identityProviderLinkBodyHtml=<p>Cineva dorește să vă conecteze contul <b>{1}</b> cu contul <b>{0}</b> al utilizatorului {2}. Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a conecta conturile</p><p><a href="{3}">Conectați pentru a confirma conectarea contului</a></p><p>Acest link va expira în {5}.</p><p>Dacă nu doriți să conectați contul, ignorați acest mesaj. Dacă conectați conturi, vă veți putea conecta la {1} până la {0}.</p>
+linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#secundă|1#secundă|1<secunde}
+orgInviteBody=Ați fost invitat să vă alăturați organizației „{3}”. Faceți clic pe linkul de mai jos pentru a vă alătura.\n\n{0}\n\nAcest link va expira în termen de {4}.\n\nDacă nu doriți să vă alăturați organizației, ignorați acest mesaj.
+orgInviteBodyPersonalized=Bună, „{5}” „{6}”.\n\n Ați fost invitat să vă alăturați organizației „{3}”. Faceți clic pe linkul de mai jos pentru a vă alătura.\n\n{0}\n\nAcest link va expira în termen de {4}.\n\nDacă nu doriți să vă alăturați organizației, ignorați acest mesaj.
+passwordResetBodyHtml=<p>Cineva tocmai a solicitat să schimbe datele de conectare ale contului dvs. {2}. Dacă acesta ați fost dvs., faceți clic pe linkul de mai jos pentru a le reseta.</p><p><a href="{0}">Link pentru resetarea acreditărilor</a></p><p>Acest link va expira în {3}.</p><p>Dacă nu doriți să vă resetați acreditările, ignorați acest mesaj și nimic nu va fi schimbat.</p>
+eventRemoveCredentialBody=Credențialul {0} a fost eliminată din contul dvs. pe {1} din {2}. Dacă nu ați fost dvs., vă rugăm să contactați un administrator.
+eventUserDisabledByTemporaryLockoutSubject=Utilizator dezactivat prin blocare temporară
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_ru.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_ru.properties
index c83d6fa03da4..24d058063231 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_ru.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_ru.properties
@@ -1,15 +1,26 @@
 emailVerificationSubject=Подтверждение E-mail
-emailVerificationBody=Кто-то создал учетную запись {2} с этим E-mail. Если это были Вы, нажмите на следующую ссылку для подтверждения вашего email\n\n{0}\n\nЭта ссылка устареет через {1} минут.\n\nЕсли Вы не создавали учетную запись, просто проигнорируйте это письмо.
-emailVerificationBodyHtml=<p>Кто-то создал учетную запись {2} с этим E-mail. Если это были Вы, нажмите по ссылке для подтверждения вашего E-mail</p><p><a href="{0}">{0}</a></p><p>Эта ссылка устареет через {1} минут.</p><p>Если Вы не создавали учетную запись, просто проигнорируйте это письмо.</p>
+emailVerificationBody=Кто-то создал учетную запись {2} с этим E-mail. Если это были Вы, нажмите на следующую ссылку для подтверждения вашего email\n\n{0}\n\nЭта ссылка устареет через {3}.\n\nЕсли Вы не создавали учетную запись, просто проигнорируйте это письмо.
+emailVerificationBodyHtml=<p>Кто-то создал учетную запись {2} с этим E-mail. Если это были Вы, нажмите по ссылке для подтверждения вашего E-mail</p><p><a href="{0}">Ссылка для верификации e-mail</a></p><p>Эта ссылка устареет через {3}.</p><p>Если Вы не создавали учетную запись, просто проигнорируйте это письмо.</p>
+orgInviteSubject=Приглашение присоединиться к организации {0}
+orgInviteBody=Вас пригласили присоединиться к организации "{3}". Нажмите на ссылку ниже, чтобы присоединиться.\n\n{0}\n\nЭта ссылка истекает в течение {4}.\n\nЕсли Вы не хотите присоединяться к организации, просто проигнорируйте это сообщение.
+orgInviteBodyHtml=<p>Вас пригласили присоединиться к организации {3}. Нажмите на ссылку ниже, чтобы присоединиться.</p><p> <a href="{0}">Ссылка для присоединения к организации</a></p><p> Срок действия этой ссылки истекает через {4}.</p><p> Если Вы не хотите вступать в организацию, просто проигнорируйте это сообщение.</p>
+orgInviteBodyPersonalized=Привет, "{5}" "{6}".\n\n Вас пригласили присоединиться к организации "{3}". Нажмите на ссылку ниже, чтобы присоединиться.\n\n{0}\n\nЭта ссылка истекает в течение {4}.\n\nЕсли Вы не хотите присоединяться к организации, просто проигнорируйте это сообщение.
+orgInviteBodyPersonalizedHtml=<p>Привет, {5} {6}.</p><p> Вас пригласили присоединиться к организации {3}. Нажмите на ссылку ниже, чтобы присоединиться.</p><p> <a href="{0}">Ссылка для присоединения к организации</a></p><p> Срок действия этой ссылки истекает через {4}.</p><p> Если Вы не хотите вступать в организацию, просто проигнорируйте это сообщение.</p>
+emailUpdateConfirmationSubject=Подтвердите новый адрес электронной почты
+emailUpdateConfirmationBody=Чтобы обновить свою учетную запись {2} с адресом электронной почты {1}, нажмите на ссылку ниже\n\n{0}\n\nСрок действия этой ссылки истекает в течение {3}.\n\nЕсли Вы не хотите продолжать это изменение, просто проигнорируйте это сообщение.
+emailUpdateConfirmationBodyHtml=<p>Чтобы обновить свою учетную запись {2} с адресом электронной почты {1}, нажмите на ссылку ниже</p><p> <a href="{0}">{0}</a></p><p> Срок действия этой ссылки истекает через {3}.</p><p> Если Вы не хотите продолжать вносить изменения, просто проигнорируйте это сообщение.</p>
+emailTestSubject=[KEYCLOAK] - тестовое сообщение SMTP
+emailTestBody=Это тестовое сообщение
+emailTestBodyHtml=<p>Это тестовое сообщение.</p>
 identityProviderLinkSubject=Ссылка {0}
-identityProviderLinkBody=Кто-то хочет связать вашу учетную запись "{1}" с "{0}" учетной записью пользователя {2} . Если это были Вы, нажмите по следующей ссылке, чтобы связать учетные записи\n\n{3}\n\nЭта ссылка устареет через {4} минут.\n\nЕсли это не хотите объединять учетные записи, просто проигнориуйте это письмо. После объединения учетных записей Вы можете войти в  {1} через {0}.
-identityProviderLinkBodyHtml=<p>Кто-то хочет связать вашу учетную запись <b>{1}</b> с <b>{0}</b> учетной записью пользователя {2} . Если это были Вы, нажмите по следующей ссылке, чтобы связать учетные записи</p><p><a href="{3}">{3}</a></p><p>Эта ссылка устареет через  {4} минут.</p><p>Если это не хотите объединять учетные записи, просто проигнориуйте это письмо. После объединения учетных записей Вы можете войти в  {1} через {0}.</p>
+identityProviderLinkBody=Кто-то хочет связать вашу учетную запись "{1}" с "{0}" учетной записью пользователя {2} . Если это были Вы, нажмите по следующей ссылке, чтобы связать учетные записи\n\n{3}\n\nЭта ссылка устареет через {5}.\n\nЕсли это не хотите объединять учетные записи, просто проигнорируйте это письмо. После объединения учетных записей Вы можете войти в {1} через {0}.
+identityProviderLinkBodyHtml=<p>Кто-то хочет связать вашу учетную запись <b>{1}</b> с <b>{0}</b> учетной записью пользователя {2}. Если это были Вы, нажмите по следующей ссылке, чтобы связать учетные записи</p><p><a href="{3}">Ссылка для привязки учетной записи</a></p><p>Эта ссылка устареет через {5}.</p><p>Если это не хотите объединять учетные записи, просто проигнорируйте это письмо. После объединения учетных записей Вы можете войти в {1} через {0}.</p>
 passwordResetSubject=Сброс пароля
-passwordResetBody=Кто-то только что запросил изменение пароля от Вашей учетной записи {2}. Если это были Вы, нажмите на следующую ссылку, чтобы сбросить его.\n\n{0}\n\nЭта ссылка устареет через {1} минут.\n\nЕсли Вы не хотите сбрасывать пароль, просто проигнорируйте это письмо.
-passwordResetBodyHtml=<p>Кто-то только что запросил изменение пароля от Вашей учетной записи {2}. Если это были Вы, нажмите на следующую ссылку, чтобы сбросить его.</p><p><a href="{0}">Ссылка для сброса учетных данных</a></p><p>Эта ссылка устареет через  {1} минут.</p><p>Если Вы не хотите сбрасывать пароль, просто проигнорируйте это письмо и ничего не изменится.</p>
+passwordResetBody=Кто-то только что запросил изменение пароля от Вашей учетной записи {2}. Если это были Вы, нажмите на следующую ссылку, чтобы сбросить его.\n\n{0}\n\nЭта ссылка устареет через {3}.\n\nЕсли Вы не хотите сбрасывать пароль, просто проигнорируйте это письмо.
+passwordResetBodyHtml=<p>Кто-то только что запросил изменение пароля от Вашей учетной записи {2}. Если это были Вы, нажмите на следующую ссылку, чтобы сбросить его.</p><p><a href="{0}">Ссылка для сброса учетных данных</a></p><p>Эта ссылка устареет через {3}.</p><p>Если Вы не хотите сбрасывать пароль, просто проигнорируйте это письмо и ничего не изменится.</p>
 executeActionsSubject=Обновление Вашей учетной записи
-executeActionsBody=Администратор просит Вас обновить данные Вашей учетной записи {2}. Нажмите по следующей ссылке чтобы начать этот процесс.\n\n{0}\n\nЭта ссылка устареет через {1} минут.\n\nЕсли у вас есть подозрения, что администратор не мог сделать такой запрос, просто проигнорируйте это письмо.
-executeActionsBodyHtml=<p>Администратор просит Вас обновить данные Вашей учетной записи {2}.  Нажмите по следующей ссылке чтобы начать этот процесс.</p><p><a href="{0}">{0}</a></p><p>Эта ссылка устареет через  {1} минут.</p><p>Если у вас есть подозрения, что администратор не мог сделать такой запрос, просто проигнорируйте это письмо.</p>
+executeActionsBody=Администратор просит Вас обновить данные Вашей учетной записи {2}, выполнив следующие действия: {3} . Нажмите по следующей ссылке чтобы начать этот процесс.\n\n{0}\n\nЭта ссылка устареет через {4}.\n\nЕсли у Вас есть подозрения, что администратор не мог сделать такой запрос, просто проигнорируйте это письмо.
+executeActionsBodyHtml=<p>Администратор просит Вас обновить данные Вашей учетной записи {2}, выполнив следующие действия: {3}. Нажмите по следующей ссылке чтобы начать этот процесс.</p><p><a href="{0}">Ссылка для обновления аккаунта</a></p><p>Эта ссылка устареет через {4}.</p><p>Если у Вас есть подозрения, что администратор не мог сделать такой запрос, просто проигнорируйте это письмо.</p>
 eventLoginErrorSubject=Ошибка входа
 eventLoginErrorBody=Была зафиксирована неудачная попытка входа в Вашу учетную запись {0} с {1}. Если это были не Вы, пожалуйста, свяжитесь с администратором.
 eventLoginErrorBodyHtml=<p>Была зафиксирована неудачная попытка входа в Вашу учетную запись {0} с {1}. Если это были не Вы, пожалуйста, свяжитесь с администратором.</p>
@@ -22,3 +33,32 @@ eventUpdatePasswordBodyHtml=<p>Ваш пароль был изменен в {0}
 eventUpdateTotpSubject=Обновление OTP
 eventUpdateTotpBody=OTP был обновлен в вашей учетной записи {0} с {1}. Если это были не Вы, пожалуйста, свяжитесь с администратором.
 eventUpdateTotpBodyHtml=<p>OTP был обновлен в вашей учетной записи {0} с {1}. Если это были не Вы, пожалуйста, свяжитесь с администратором.</p>
+eventUpdateCredentialSubject=Обновить учетные данные
+eventUpdateCredentialBody=Ваши учетные данные {0} были изменены {1} с {2}. Если это были не Вы, обратитесь к администратору.
+eventUpdateCredentialBodyHtml=<p>Ваши учетные данные {0} были изменены {1} с {2}. Если это были не Вы, обратитесь к администратору.</p>
+eventRemoveCredentialSubject=Удалить учетные данные
+eventRemoveCredentialBody=Учетные данные {0} были удалены из вашего аккаунта {1} из {2}. Если это были не Вы, обратитесь к администратору.
+eventRemoveCredentialBodyHtml=<p>Учетные данные {0} были удалены из вашего аккаунта {1} из {2}. Если это были не Вы, обратитесь к администратору.</p>
+eventUserDisabledByTemporaryLockoutSubject=Учетная запись пользователя отключена из-за временной блокировки
+eventUserDisabledByTemporaryLockoutBody=Учетная запись пользователя временно отключена из-за нескольких неудачных попыток на {0}. При необходимости обратитесь к администратору.
+eventUserDisabledByTemporaryLockoutHtml=<p>Учетная запись пользователя временно отключена из-за нескольких неудачных попыток на {0}. При необходимости обратитесь к администратору.</p>
+eventUserDisabledByPermanentLockoutSubject=Учетная запись пользователя отключена постоянной блокировкой
+eventUserDisabledByPermanentLockoutBody=Учетная запись пользователя была отключена навсегда из-за нескольких неудачных попыток на {0}. Обратитесь к администратору.
+eventUserDisabledByPermanentLockoutHtml=<p>Учетная запись пользователя была отключена навсегда из-за нескольких неудачных попыток на {0}. Обратитесь к администратору.</p>
+requiredAction.CONFIGURE_TOTP=Настроить одноразовый пароль
+requiredAction.TERMS_AND_CONDITIONS=Условия и положения
+requiredAction.UPDATE_PASSWORD=Обновить пароль
+requiredAction.UPDATE_PROFILE=Обновить профиль
+requiredAction.VERIFY_EMAIL=Подтвердить адрес электронной почты
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Генерация кодов восстановления
+
+# units for link expiration timeout formatting
+# for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#секунд|1#секунда|2#секунды|4<секунд}
+linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#минут|1#минута|2#минуты|4<минут}
+linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#часов|1#час|2#часа|4<часов}
+linkExpirationFormatter.timePeriodUnit.days={0,choice,0#дней|1#день|2#дня|4<дней}
+emailVerificationBodyCode=Подтвердите свой адрес электронной почты, введя следующий код.\n\n{0}\n\n.
+emailVerificationBodyCodeHtml=<p>Пожалуйста, подтвердите свой адрес электронной почты, введя следующий код.</p><p><b>{0}</b></p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_sk.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_sk.properties
index e35cb07bb5a0..1ee429cf21dd 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_sk.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_sk.properties
@@ -1,6 +1,11 @@
 emailVerificationSubject=Overenie e-mailu
 emailVerificationBody=Niekto vytvoril účet {2} s touto e-mailovou adresou. Ak ste to vy, kliknite na nižšie uvedený odkaz a overte svoju e-mailovú adresu \n\n{0}\n\nTento odkaz uplynie do {1} minút.\n\nAk ste tento účet nevytvorili, ignorujte túto správu.
 emailVerificationBodyHtml=<p>Niekto vytvoril účet {2} s touto e-mailovou adresou. Ak ste to vy, kliknite na nižšie uvedený odkaz na overenie svojej e-mailovej adresy.</p><p><a href="{0}"> Odkaz na overenie e-mailovej adresy </a></p><p>Platnosť odkazu vyprší za {1} minút.</p><p> Ak ste tento účet nevytvorili, ignorujte túto správu.</p>
+orgInviteSubject=Pozvánka do organizácie {0}
+orgInviteBody=Niekto Vás pozval do organizácie "{3}". Na pridanie sa kliknite na odkaz nižšie.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nAk sa do organizácie nechcete pridať, ignorujte túto správu.
+orgInviteBodyHtml=<p>Niekto Vás pozval do organizácie {3}. Na pridanie sa kliknite na odkaz nižšie. </p><p><a href="{0}">Odkaz na pridanie sa do organizácie</a></p><p>Tento odkaz vyprší za {4}.</p><p>Ak sa do organizácie nechcete pridať, ignorujte túto správu.</p>
+orgInviteBodyPersonalized=Dobrý deň, "{5}" "{6}".\n\n Niekto Vás pozval do organizácie "{3}". Na pridanie sa kliknite na odkaz nižšie.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nAk sa do organizácie nechcete pridať, ignorujte túto správu.
+orgInviteBodyPersonalizedHtml=<p>Dobrý deň, {5} {6}.</p><p>Niekto Vás pozval do organizácie {3}. Na pridanie sa kliknite na odkaz nižšie. </p><p><a href="{0}">Odkaz na pridanie sa do organizácie</a></p><p>Tento odkaz vyprší za {4}.</p><p>Ak sa do organizácie nechcete pridať, ignorujte túto správu.</p>
 emailUpdateConfirmationSubject=Overenie nového e-mailu
 emailUpdateConfirmationBody=Ak chcete aktualizovať svoj {2} účet s e-mailovou adresou {1}, kliknite na odkaz nižšie\n\n{0}\n\nTento odkaz vyprší do {3}.\n\nAk nechcete pokračovať v tejto úprave, jednoducho ignorujte túto správu.
 emailUpdateConfirmationBodyHtml=<p>Ak chcete aktualizovať svoj {2} účet s e-mailovou adresou {1}, kliknite na odkaz nižšie</p><p><a href="{0}">{0}</a></p><p>Tento odkaz vyprší do {3}.</p><p>Ak nechcete pokračovať v tejto úprave, jednoducho ignorujte túto správu.</p>
@@ -8,26 +13,38 @@ emailTestSubject=[KEYCLOAK] - Testovacia správa SMTP
 emailTestBody=Toto je skúšobná správa
 emailTestBodyHtml=<p>Toto je skúšobná správa</p>
 identityProviderLinkSubject=Odkaz {0}
-identityProviderLinkBody=Niekto chce prepojiť váš účet "{1}" s účtom "{0}"používateľa {2}. Ak ste to vy, kliknutím na odkaz nižšie prepojte účty. \n\n{3}\n\nTento odkaz uplynie do {4} minút.\n\nAk nechcete prepojiť účet, jednoducho ignorujte túto správu , Ak prepájate účty, budete sa môcť prihlásiť do {1} až {0}.
-identityProviderLinkBodyHtml=<p>Niekto chce prepojiť váš účet <b>{1}</b> s účtom <b>{0}</b> používateľa {2}. Ak ste to vy, kliknutím na odkaz nižšie prepojte účty</p><p><a href="{3}">Odkaz na potvrdenie prepojenia účtu </a></p><p> Platnosť tohto odkazu vyprší v rámci {4} minút.</p><p>Ak nechcete prepojiť účet, ignorujte túto správu. Ak prepojujete účty, budete sa môcť prihlásiť do {1} až {0}.</p>
+identityProviderLinkBody=Niekto chce prepojiť Váš účet "{1}" s účtom "{0}"používateľa {2}. Ak ste to vy, kliknutím na odkaz nižšie prepojte účty. \n\n{3}\n\nTento odkaz uplynie do {4} minút.\n\nAk nechcete prepojiť účet, jednoducho ignorujte túto správu , Ak prepájate účty, budete sa môcť prihlásiť do {1} až {0}.
+identityProviderLinkBodyHtml=<p>Niekto chce prepojiť Váš účet <b>{1}</b> s účtom <b>{0}</b> používateľa {2}. Ak ste to vy, kliknutím na odkaz nižšie prepojte účty</p><p><a href="{3}">Odkaz na potvrdenie prepojenia účtu </a></p><p> Platnosť tohto odkazu vyprší v rámci {4} minút.</p><p>Ak nechcete prepojiť účet, ignorujte túto správu. Ak prepojujete účty, budete sa môcť prihlásiť do {1} až {0}.</p>
 passwordResetSubject=Obnovenie hesla
 passwordResetBody=Niekto požiadal, aby ste zmenili svoje poverenia účtu {2}. Ak ste to vy, kliknite na odkaz uvedený nižšie, aby ste ich vynulovali.\n\n{0}\n\nTento odkaz a kód uplynie do {1} minút.\n\nAk nechcete obnoviť svoje poverenia , ignorujte túto správu a nič sa nezmení.
 passwordResetBodyHtml=<p>Niekto požiadal, aby ste zmenili svoje poverenia účtu {2}. Ak ste to vy, kliknutím na odkaz nižšie ich resetujte.</p><p><a href="{0}">Odkaz na obnovenie poverení </a></p><p>Platnosť tohto odkazu vyprší v priebehu {1} minút.</p><p>Ak nechcete obnoviť svoje poverenia, ignorujte túto správu a nič sa nezmení.</p>
 executeActionsSubject=Aktualizujte svoj účet
-executeActionsBody=Váš administrátor práve požiadal o aktualizáciu vášho účtu {2} vykonaním nasledujúcich akcií: {3}. Kliknutím na odkaz uvedený nižšie spustíte tento proces.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nAk si nie ste vedomý, že váš administrátor o toto požiadal, ignorujte túto správu a nič bude zmenené.
-executeActionsBodyHtml=<p>Váš správca práve požiadal o aktualizáciu vášho účtu {2} vykonaním nasledujúcich akcií: {3}. Kliknutím na odkaz uvedený nižšie spustíte tento proces.</p><p><a href="{0}"> Odkaz na aktualizáciu účtu </a></p><p> Platnosť tohto odkazu vyprší za {4}.</p><p> Ak si nie ste vedomí, že váš administrátor o toto požiadal, ignorujte túto správu a nič sa nezmení.</p>
+executeActionsBody=Váš administrátor práve požiadal o aktualizáciu Vášho účtu {2} vykonaním nasledujúcich akcií: {3}. Kliknutím na odkaz uvedený nižšie spustíte tento proces.\n\n{0}\n\nTento odkaz vyprší za {4}.\n\nAk si nie ste vedomý, že váš administrátor o toto požiadal, ignorujte túto správu a nič bude zmenené.
+executeActionsBodyHtml=<p>Váš správca práve požiadal o aktualizáciu Vášho účtu {2} vykonaním nasledujúcich akcií: {3}. Kliknutím na odkaz uvedený nižšie spustíte tento proces.</p><p><a href="{0}"> Odkaz na aktualizáciu účtu </a></p><p> Platnosť tohto odkazu vyprší za {4}.</p><p> Ak si nie ste vedomí, že Váš administrátor o toto požiadal, ignorujte túto správu a nič sa nezmení.</p>
 eventLoginErrorSubject=Chyba prihlásenia
-eventLoginErrorBody=Bol zistený neúspešný pokus o prihlásenie do vášho účtu v {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
-eventLoginErrorBodyHtml=<p>Bol zistený neúspešný pokus o prihlásenie vášho účtu na {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
+eventLoginErrorBody=Bol zistený neúspešný pokus o prihlásenie do Vášho účtu v {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
+eventLoginErrorBodyHtml=<p>Bol zistený neúspešný pokus o prihlásenie Vášho účtu na {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
 eventRemoveTotpSubject=Odstrániť TOTP
-eventRemoveTotpBody=OTP bol odstránený z vášho účtu dňa {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
-eventRemoveTotpBodyHtml=<p>OTP bol odstránený z vášho účtu dňa {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
+eventRemoveTotpBody=OTP bol odstránený z Vášho účtu dňa {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
+eventRemoveTotpBodyHtml=<p>OTP bol odstránený z Vášho účtu dňa {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
 eventUpdatePasswordSubject=Aktualizovať heslo
 eventUpdatePasswordBody=Vaše heslo bolo zmenené na {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
 eventUpdatePasswordBodyHtml=<p>Vaše heslo bolo zmenené na {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
 eventUpdateTotpSubject=Aktualizácia TOTP
-eventUpdateTotpBody=TOTP bol aktualizovaný pre váš účet na {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
-eventUpdateTotpBodyHtml=<p>TOTP bol aktualizovaný pre váš účet dňa {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
+eventUpdateTotpBody=TOTP bol aktualizovaný pre Váš účet na {0} z {1}. Ak ste to neboli vy, obráťte sa na administrátora.
+eventUpdateTotpBodyHtml=<p>TOTP bol aktualizovaný pre Váš účet dňa {0} z {1}. Ak ste to neboli vy, kontaktujte administrátora.</p>
+eventUpdateCredentialSubject=Aktualizácia prihlasovacieho údaja
+eventUpdateCredentialBody=Váš prihlasovací údaj {0} sa zmenil na {1} z {2}. Pokiaľ ste to neboli vy, kontaktujte administrátora.
+eventUpdateCredentialBodyHtml=<p>Váš prihlasovací údaj {0} sa zmenil na {1} z {2}. Pokiaľ ste to neboli vy, kontaktujte administrátora.</p>
+eventRemoveCredentialSubject=Odstránenie prihlasovacieho údaja
+eventRemoveCredentialBody=Prihlasovací údaj {0} bol odstránený z Vášho účtu na {1} z {2}. Pokiaľ ste to neboli vy, kontaktujte administrátora.
+eventRemoveCredentialBodyHtml=<p>Prihlasovací údaj {0} bol odstránený z Vášho účtu na {1} z {2}. Pokiaľ ste to neboli vy, kontaktujte administrátora.</p>
+eventUserDisabledByTemporaryLockoutSubject=Používateľ dočasne zablokovaný
+eventUserDisabledByTemporaryLockoutBody=Váš používateľ bol dočasne zablokovaný kvôli niekoľkým zlým pokusom na {0}. Kontaktujte prosím administrátora, pokiaľ je to potrebné.
+eventUserDisabledByTemporaryLockoutHtml=<p>Váš používateľ bol dočasne zablokovaný kvôli niekoľkým zlým pokusom na {0}. Kontaktujte prosím administrátora, pokiaľ je to potrebné.</p>
+eventUserDisabledByPermanentLockoutSubject=Užívateľ trvalo zablokovaný
+eventUserDisabledByPermanentLockoutBody=Váš používateľ bol trvalo zablokovaný kvôli niekoľkým zlým pokusom na {0}. Kontaktujte prosím administrátora, pokiaľ je to potrebné.
+eventUserDisabledByPermanentLockoutHtml=<p>Váš používateľ bol trvalo zablokovaný kvôli niekoľkým zlým pokusom na {0}. Kontaktujte prosím administrátora, pokiaľ je to potrebné.</p>
 
 requiredAction.CONFIGURE_TOTP=Konfigurácia OTP
 requiredAction.TERMS_AND_CONDITIONS=Zmluvné podmienky
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_sl.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_sl.properties
new file mode 100644
index 000000000000..f550dd6c8be4
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_sl.properties
@@ -0,0 +1,64 @@
+emailVerificationSubject=Potrdite e-poštni naslov
+emailVerificationBody=Nekdo je ustvaril račun {2} s tem e-poštnim naslovom. Če ste to bili vi, kliknite spodnjo povezavo, da potrdite svoj e-poštni naslov\n\n{0}\n\nTa povezava bo potekla v {3}.\n\nČe niste ustvarili tega računa, preprosto ignorirajte to sporočilo.
+emailVerificationBodyHtml=<p>Nekdo je ustvaril račun {2} s tem e-poštnim naslovom. Če ste to bili vi, kliknite spodnjo povezavo, da potrdite svoj e-poštni naslov</p><p><a href="{0}">Povezava za potrditev e-poštnega naslova</a></p><p>Ta povezava bo potekla v {3}.</p><p>Če niste ustvarili tega računa, preprosto ignorirajte to sporočilo.</p>
+orgInviteSubject=Vabilo za pridružitev organizaciji {0}
+orgInviteBody=Povabljeni ste bili, da se pridružite organizaciji "{3}". Kliknite spodnjo povezavo za pridružitev.\n\n{0}\n\nTa povezava bo potekla v {4}.\n\nČe se ne želite pridružiti organizaciji, preprosto ignorirajte to sporočilo.
+orgInviteBodyHtml=<p>Povabljeni ste bili, da se pridružite organizaciji {3}. Kliknite spodnjo povezavo za pridružitev.</p><p><a href="{0}">Povezava za pridružitev organizaciji</a></p><p>Ta povezava bo potekla v {4}.</p><p>Če se ne želite pridružiti organizaciji, preprosto ignorirajte to sporočilo.</p>
+orgInviteBodyPersonalized=Pozdravljeni, "{5}" "{6}".\n\nPovabljeni ste bili, da se pridružite organizaciji "{3}". Kliknite spodnjo povezavo za pridružitev.\n\n{0}\n\nTa povezava bo potekla v {4}.\n\nČe se ne želite pridružiti organizaciji, preprosto ignorirajte to sporočilo.
+orgInviteBodyPersonalizedHtml=<p>Pozdravljeni, {5} {6}.</p><p>Povabljeni ste bili, da se pridružite organizaciji {3}. Kliknite spodnjo povezavo za pridružitev.</p><p><a href="{0}">Povezava za pridružitev organizaciji</a></p><p>Ta povezava bo potekla v {4}.</p><p>Če se ne želite pridružiti organizaciji, preprosto ignorirajte to sporočilo.</p>
+emailUpdateConfirmationSubject=Potrdite nov e-poštni naslov
+emailUpdateConfirmationBody=Za posodobitev vašega računa {2} z e-poštnim naslovom {1}, kliknite spodnjo povezavo\n\n{0}\n\nTa povezava bo potekla v {3}.\n\nČe ne želite nadaljevati s to spremembo, preprosto ignorirajte to sporočilo.
+emailUpdateConfirmationBodyHtml=<p>Za posodobitev vašega računa {2} z e-poštnim naslovom {1}, kliknite spodnjo povezavo</p><p><a href="{0}">{0}</a></p><p>Ta povezava bo potekla v {3}.</p><p>Če ne želite nadaljevati s to spremembo, preprosto ignorirajte to sporočilo.</p>
+emailTestSubject=[KEYCLOAK] - Testno SMTP sporočilo
+emailTestBody=To je testno sporočilo
+emailTestBodyHtml=<p>To je testno sporočilo</p>
+identityProviderLinkSubject=Povežite {0}
+identityProviderLinkBody=Nekdo želi povezati vaš račun "{1}" z računom "{0}" uporabnika {2}. Če ste to bili vi, kliknite spodnjo povezavo za povezavo računov\n\n{3}\n\nTa povezava bo potekla v {5}.\n\nČe ne želite povezati računa, preprosto ignorirajte to sporočilo. Če povežete račune, se boste lahko prijavili v {1} preko {0}.
+identityProviderLinkBodyHtml=<p>Nekdo želi povezati vaš račun <b>{1}</b> z računom <b>{0}</b> uporabnika {2}. Če ste to bili vi, kliknite spodnjo povezavo za povezavo računov</p><p><a href="{3}">Povezava za potrditev povezave računov</a></p><p>Ta povezava bo potekla v {5}.</p><p>Če ne želite povezati računa, preprosto ignorirajte to sporočilo. Če povežete račune, se boste lahko prijavili v {1} preko {0}.</p>
+passwordResetSubject=Ponastavite svoje geslo
+passwordResetBody=Nekdo je pravkar zahteval spremembo poverilnic za vaš račun {2}. Če ste to bili vi, kliknite spodnjo povezavo, da jih ponastavite.\n\n{0}\n\nTa povezava bo potekla v {3}.\n\nČe ne želite ponastaviti svojih poverilnic, preprosto ignorirajte to sporočilo in nič se ne bo spremenilo.
+passwordResetBodyHtml=<p>Nekdo je pravkar zahteval spremembo poverilnic za vaš račun {2}. Če ste to bili vi, kliknite spodnjo povezavo, da jih ponastavite.</p><p><a href="{0}">Povezava za ponastavitev poverilnic</a></p><p>Ta povezava bo potekla v {3}.</p><p>Če ne želite ponastaviti svojih poverilnic, preprosto ignorirajte to sporočilo in nič se ne bo spremenilo.</p>
+executeActionsSubject=Posodobite svoj račun
+executeActionsBody=Vaš administrator je pravkar zahteval, da posodobite svoj račun {2}, tako da izvedete naslednje dejanje(-a): {3}. Kliknite spodnjo povezavo, da začnete ta postopek.\n\n{0}\n\nTa povezava bo potekla v {4}.\n\nČe ne veste, da je vaš administrator to zahteval, preprosto ignorirajte to sporočilo in nič se ne bo spremenilo.
+executeActionsBodyHtml=<p>Vaš administrator je pravkar zahteval, da posodobite svoj račun {2}, tako da izvedete naslednje dejanje(-a): {3}. Kliknite spodnjo povezavo, da začnete ta postopek.</p><p><a href="{0}">Povezava za posodobitev računa</a></p><p>Ta povezava bo potekla v {4}.</p><p>Če ne veste, da je vaš administrator to zahteval, preprosto ignorirajte to sporočilo in nič se ne bo spremenilo.</p>
+eventLoginErrorSubject=Napaka pri prijavi
+eventLoginErrorBody=Zaznana je bila neuspešna prijava v vaš račun dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.
+eventLoginErrorBodyHtml=<p>Zaznana je bila neuspešna prijava v vaš račun dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventRemoveTotpSubject=Odstranitev OTP
+eventRemoveTotpBody=OTP je bil odstranjen iz vašega računa dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.
+eventRemoveTotpBodyHtml=<p>OTP je bil odstranjen iz vašega računa dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventUpdatePasswordSubject=Posodobite geslo
+eventUpdatePasswordBody=Vaše geslo je bilo spremenjeno dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.
+eventUpdatePasswordBodyHtml=<p>Vaše geslo je bilo spremenjeno dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventUpdateTotpSubject=Posodobitev OTP
+eventUpdateTotpBody=OTP je bil posodobljen za vaš račun dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.
+eventUpdateTotpBodyHtml=<p>OTP je bil posodobljen za vaš račun dne {0} iz {1}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventUpdateCredentialSubject=Posodobitev poverilnice
+eventUpdateCredentialBody=Vaša poverilnica {0} je bila spremenjena dne {1} iz {2}. Če to niste bili vi, se obrnite na administratorja.
+eventUpdateCredentialBodyHtml=<p>Vaša poverilnica {0} je bila spremenjena dne {1} iz {2}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventRemoveCredentialSubject=Odstranitev poverilnice
+eventRemoveCredentialBody=Poverilnica {0} je bila odstranjena iz vašega računa dne {1} iz {2}. Če to niste bili vi, se obrnite na administratorja.
+eventRemoveCredentialBodyHtml=<p>Poverilnica {0} je bila odstranjena iz vašega računa dne {1} iz {2}. Če to niste bili vi, se obrnite na administratorja.</p>
+eventUserDisabledByTemporaryLockoutSubject=Uporabnik začasno onemogočen zaradi zaklepa
+eventUserDisabledByTemporaryLockoutBody=Vaš uporabniški račun je bil začasno onemogočen zaradi več neuspešnih poskusov dne {0}. Po potrebi se obrnite na administratorja.
+eventUserDisabledByTemporaryLockoutHtml=<p>Vaš uporabniški račun je bil začasno onemogočen zaradi več neuspešnih poskusov dne {0}. Po potrebi se obrnite na administratorja.</p>
+eventUserDisabledByPermanentLockoutSubject=Uporabnik trajno onemogočen zaradi zaklepa
+eventUserDisabledByPermanentLockoutBody=Vaš uporabniški račun je bil trajno onemogočen zaradi več neuspešnih poskusov dne {0}. Prosimo, obrnite se na administratorja.
+eventUserDisabledByPermanentLockoutHtml=<p>Vaš uporabniški račun je bil trajno onemogočen zaradi več neuspešnih poskusov dne {0}. Prosimo, obrnite se na administratorja.</p>
+requiredAction.CONFIGURE_TOTP=Konfiguriraj OTP
+requiredAction.TERMS_AND_CONDITIONS=Splošni pogoji
+requiredAction.UPDATE_PASSWORD=Posodobi geslo
+requiredAction.UPDATE_PROFILE=Posodobi profil
+requiredAction.VERIFY_EMAIL=Potrdi e-naslov
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generiraj kode za obnovitev
+
+# units for link expiration timeout formatting
+# for languages which have more unit plural forms depending on the value (eg. Czech and other Slavic langs) you can override unit text for some other values like described in the Java choice format which is documented here. For Czech, it would be '{0,choice,0#minut|1#minuta|2#minuty|2<minut}'
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
+# https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
+linkExpirationFormatter.timePeriodUnit.seconds={0,choice,0#sekund|1#sekunda|2#sekundi|3#sekunde|4#sekunde|5#sekund}
+linkExpirationFormatter.timePeriodUnit.minutes={0,choice,0#minut|1#minuta|2#minuti|3#minute|4#minute|5#minut}
+linkExpirationFormatter.timePeriodUnit.hours={0,choice,0#ur|1#ura|2#uri|3#ure|4#ure|5#ur}
+linkExpirationFormatter.timePeriodUnit.days={0,choice,0#dni|1#dan|2#dneva|3#dni|4#dni|5#dni}
+emailVerificationBodyCode=Prosimo, potrdite svoj e-poštni naslov z vnosom naslednje kode.\n\n{0}\n\n.
+emailVerificationBodyCodeHtml=<p>Prosimo, potrdite svoj e-poštni naslov z vnosom naslednje kode.</p><p><b>{0}</b></p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_tr.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_tr.properties
index 5605f10ec9cd..3ce3daaf0627 100755
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_tr.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_tr.properties
@@ -6,7 +6,7 @@ emailTestBody=Bu bir test mesajı
 emailTestBodyHtml=<p>Bu bir test mesajı</p>
 identityProviderLinkSubject=Link {0}
 identityProviderLinkBody=Birisi "{1}" hesabınızı "{0}" kullanıcı hesabı {2} ile bağlamak istiyor. Bu sizseniz, hesapları bağlamak için aşağıdaki bağlantıyı tıklayın:\n\n{3}\n\nBu bağlantı {5} içinde sona erecek.\n\nHesabınızı bağlamak istemiyorsanız bu mesajı göz ardı edin. Hesapları bağlarsanız, {1} ile {0} arasında oturum açabilirsiniz.
-identityProviderLinkBodyHtml=<p>Birisi <b> {1} </ b> hesabınızı {2} kullanıcısı <b> {0} </ b> hesabına bağlamak istiyor. Bu sizseniz, bağlantı vermek için aşağıdaki bağlantıyı tıklayın</p><p><a href="{3}">Hesap bağlantısını onaylamak için bağlantı</a></p><p>Bu bağlantının süresi {5} içerisinde sona erecek.</p><p>Hesabı bağlamak istemiyorsanız, bu mesajı göz ardı edin. Hesapları bağlarsanız, {1} ile {0} arasında oturum açabilirsiniz.</p>
+identityProviderLinkBodyHtml=<p>Birisi <b> {1} </b> hesabınızı {2} kullanıcısı <b> {0} </b> hesabına bağlamak istiyor. Bu sizseniz, bağlantı vermek için aşağıdaki bağlantıyı tıklayın</p><p><a href="{3}">Hesap bağlantısını onaylamak için bağlantı</a></p><p>Bu bağlantının süresi {5} içerisinde sona erecek.</p><p>Hesabı bağlamak istemiyorsanız, bu mesajı göz ardı edin. Hesapları bağlarsanız, {1} ile {0} arasında oturum açabilirsiniz.</p>
 passwordResetSubject=Şifreyi sıfırla
 passwordResetBody=Birisi, {2} hesabınızın kimlik bilgilerini değiştirmeyi istedi.Bu sizseniz, sıfırlamak için aşağıdaki bağlantıyı tıklayın.\n\n{0}\n\nBu bağlantı ve kod {3} içinde sona erecek.\n\nFakat bilgilerinizi sıfırlamak istemiyorsanız, Sadece bu mesajı görmezden gelin ve hiçbir şey değişmeyecek.
 passwordResetBodyHtml=<p>Birisi, {2} hesabınızın kimlik bilgilerini değiştirmeyi istedi. Sizseniz, sıfırlamak için aşağıdaki linke tıklayınız.</p><p><a href="{0}">Kimlik bilgilerini sıfırlamak için bağlantı</a></p><p>Bu bağlantının süresi {3} içerisinde sona erecek.</p><p>Kimlik bilgilerinizi sıfırlamak istemiyorsanız, bu mesajı göz ardı edin.</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_uk.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_uk.properties
index f5487ac78a15..0318979a6530 100755
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_uk.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_uk.properties
@@ -3,7 +3,7 @@ emailVerificationBody=Хтось створив обліковий запис {2
 emailVerificationBodyHtml=<p>Хтось створив обліковий запис {2} із цією адресою електронної пошти. Якщо це були Ви, натисніть на посилання нижче, щоб підтвердити свою адресу електронної пошти</p><p><a href="{0}">Посилання на підтвердження адресу електронної пошти</a></p><p>Це посилання дійсне протягом {3}.</p><p>Якщо Ви не створювали цей обліковий запис, просто проігноруйте цей лист.</p>
 emailUpdateConfirmationSubject=Підтвердіть нову адресу електронної пошти
 emailUpdateConfirmationBody=Щоб оновити адресу електронної пошти {1} облікового запису {2}, натисніть на посилання нижче\n\n{0}\n\nЦе посилання дійсне протягом {3}.\n\nЯкщо Ви не бажаєте застосувати ці зміни, просто проігноруйте цей лист.
-emailUpdateConfirmationBodyHtml=<p>Щоб оновити адресу електронної пошти {1} облікового запису {2}, натисніть на посилання нижче</p><p><a href="{0}">{0}</a></p ><p>Це посилання дійсне протягом {3}.</p><p>Якщо Ви не бажаєте застосувати ці зміни, просто проігноруйте цей лист.</p>
+emailUpdateConfirmationBodyHtml=<p>Щоб оновити адресу електронної пошти {1} облікового запису {2}, натисніть на посилання нижче</p><p><a href="{0}">{0}</a></p><p>Це посилання дійсне протягом {3}.</p><p>Якщо Ви не бажаєте застосувати ці зміни, просто проігноруйте цей лист.</p>
 emailTestSubject=[KEYCLOAK] - тестове повідомлення SMTP
 emailTestBody=Це тестове повідомлення
 emailTestBodyHtml=<p>Це тестове повідомлення</p>
diff --git a/themes/src/main/resources-community/theme/base/email/messages/messages_zh_TW.properties b/themes/src/main/resources-community/theme/base/email/messages/messages_zh_TW.properties
index 91180451d9d1..cdc9ee2e3be8 100644
--- a/themes/src/main/resources-community/theme/base/email/messages/messages_zh_TW.properties
+++ b/themes/src/main/resources-community/theme/base/email/messages/messages_zh_TW.properties
@@ -1,6 +1,11 @@
 emailVerificationSubject=驗證電子信箱
 emailVerificationBody=有人使用了這個電子信箱建立了一個 {2} 帳號。如果這是您的操作，請點擊下列連結驗證您的電子信箱\n\n{0}\n\n此連結將在 {3} 內失效。\n\n如果這不是您的操作，請忽略此訊息。
 emailVerificationBodyHtml=<p>有人使用了這個電子信箱建立了一個 {2} 帳號。如果這是您的操作，請點擊下列連結驗證您的電子信箱</p><p><a href="{0}">驗證電子信箱連結</a></p><p>此連結將在 {3} 內失效。</p><p>如果您沒有建立帳號，請忽略此訊息。</p>
+orgInviteSubject=邀請您加入 {0} 組織
+orgInviteBody=您已被邀請參加「{3}」組織。點擊下列連結加入。\n\n{0}\n\n此連結將在 {4} 內失效。\n\n如果您不想加入組織，請忽略此訊息。
+orgInviteBodyHtml=<p>您已被邀請參加「{3}」組織。點擊下列連結加入。</p><p><a href="{0}">點此連結加入組織</a></p><p>此連結將在 {4} 內失效。</p><p>如果您不想加入組織，請忽略此訊息。</p>
+orgInviteBodyPersonalized=哈囉，"{5}" "{6}"。\n\n 您已被邀請參加「{3}」組織。點擊下列連結加入。\n\n{0}\n\n此連結將在 {4} 內失效。\n\n如果您不想加入組織，請忽略此訊息。
+orgInviteBodyPersonalizedHtml=<p>哈囉，{5} {6}。</p><p>您已被邀請參加「{3}」組織。點擊下列連結加入。</p><p><a href="{0}">點此連結加入組織</a></p><p>此連結將在 {4} 內失效。</p><p>如果您不想加入組織，請忽略此訊息。</p>
 emailUpdateConfirmationSubject=驗證新的電子信箱
 emailUpdateConfirmationBody=為了更新您的 {2} 帳號的電子信箱 {1}，請點擊下列連結\n\n{0}\n\n此連結將在 {3} 內失效。\n\n如果您不想進行這個修改，請忽略此訊息。
 emailUpdateConfirmationBodyHtml=<p>為了更新您的 {2} 帳號的電子信箱 {1}，請點擊下列連結</p><p><a href="{0}">{0}</a></p><p>此連結將在 {3} 內失效。</p><p>如果您不想進行這個修改，請忽略此訊息。</p>
@@ -11,8 +16,8 @@ identityProviderLinkSubject=連結到 {0}
 identityProviderLinkBody=有人試圖連結您的 "{1}" 帳號與使用者 {2} 的 "{0}" 帳號。如果這是您的操作，請點擊下列連結連結帳號\n\n{3}\n\n此連結將在 {5} 內失效。\n\n如果這不是您的操作，請忽略此訊息。如果您連結帳號，您將能夠透過 {0} 登入 {1}。
 identityProviderLinkBodyHtml=<p>有人試圖連結您的 <b>{1}</b> 帳號與使用者 {2} 的 <b>{0}</b> 帳號。如果這是您的操作，請點擊下列連結連結帳號</p><p><a href="{3}">確認連結帳號</a></p><p>此連結將在 {5} 內失效。</p><p>如果這不是您的操作，請忽略此訊息。如果您連結帳號，您將能夠透過 {0} 登入 {1}。</p>
 passwordResetSubject=重設密碼
-passwordResetBody=有人剛剛要求重設您 {2} 的密碼。如果這是您的操作，請點擊下列連結重設它們。\n\n{0}\n\n此連結和代碼將在 {3} 內失效。\n\n如果您不想重設您的密碼，請忽略此訊息。
-passwordResetBodyHtml=<p>有人剛剛要求重設您 {2} 的密碼。如果這是您的操作，請點擊下列連結重設它們。</p><p><a href="{0}">重設密碼連結</a></p><p>此連結和代碼將在 {3} 內失效。</p><p>如果您不想重設您的密碼，請忽略此訊息，甚麼都不會改變。</p>
+passwordResetBody=有人剛剛要求更改您的 {2} 密碼。如果這是您本人的操作，請點擊下方連結來重新設定。\n\n{0}\n\n此連結和代碼將在 {3} 內失效。\n\n如果您不想重新設定密碼，請直接忽略此訊息，您的帳戶不會有任何變更。
+passwordResetBodyHtml=<p>有人剛剛要求更改您的 {2} 密碼。如果這是您本人的操作，請點擊下方連結來重新設定。</p><p><a href="{0}">重新設定密碼連結</a></p><p>此連結和代碼將在 {3} 內失效。</p><p>如果您不想重新設定密碼，請直接忽略此訊息，您的帳戶不會有任何變更。</p>
 executeActionsSubject=更新您的帳號
 executeActionsBody=您的管理員剛剛要求您更新您的 {2} 帳號，透過執行以下動作：{3}。點擊下列連結開始這個流程。\n\n{0}\n\n此連結將在 {4} 內失效。\n\n如果您不知道您的管理員剛剛要求這個，請忽略此訊息，甚麼都不會改變。
 executeActionsBodyHtml=<p>您的管理員剛剛要求您更新您的 {2} 帳號，透過執行以下動作：{3}。點擊下列連結開始這個流程。</p><p><a href="{0}">更新帳號連結</a></p><p>此連結將在 {4} 內失效。</p><p>如果您不知道您的管理員剛剛要求這個，請忽略此訊息，甚麼都不會改變。</p>
@@ -28,6 +33,18 @@ eventUpdatePasswordBodyHtml=<p>您的密碼已在 {0} 從 {1} 更改。如果這
 eventUpdateTotpSubject=更新 OTP 設定
 eventUpdateTotpBody=您帳號的 OTP 設定已在 {0} 從 {1} 更新。如果這不是您的操作，請聯絡系統管理員。
 eventUpdateTotpBodyHtml=<p>您帳號的 OTP 設定已在 {0} 從 {1} 更新。如果這不是您的操作，請聯絡系統管理員。</p>
+eventUpdateCredentialSubject=更新認證資訊
+eventUpdateCredentialBody=您的 {0} 認證資訊已在 {1} 從 {2} 更改。如果這不是您的操作，請聯絡系統管理員。
+eventUpdateCredentialBodyHtml=<p>您的 {0} 認證資訊已在 {1} 從 {2} 更改。如果這不是您的操作，請聯絡系統管理員。</p>
+eventRemoveCredentialSubject=移除認證資訊
+eventRemoveCredentialBody=您的認證資訊 {0} 已在 {1} 從 {2} 從您的帳號中移除。如果這不是您的操作，請聯絡系統管理員。
+eventRemoveCredentialBodyHtml=<p>您的認證資訊 {0} 已在 {1} 從 {2} 從您的帳號中移除。如果這不是您的操作，請聯絡系統管理員。</p>
+eventUserDisabledByTemporaryLockoutSubject=使用者被暫時鎖定
+eventUserDisabledByTemporaryLockoutBody=您的使用者因為在 {0} 有多次失敗的登入嘗試而被暫時鎖定。如果需要，請聯絡系統管理員。
+eventUserDisabledByTemporaryLockoutHtml=<p>您的使用者因為在 {0} 有多次失敗的登入嘗試而被暫時鎖定。如果需要，請聯絡系統管理員。</p>
+eventUserDisabledByPermanentLockoutSubject=使用者被永久鎖定
+eventUserDisabledByPermanentLockoutBody=您的使用者因為在 {0} 有多次失敗的登入嘗試而被永久鎖定。請聯絡系統管理員。
+eventUserDisabledByPermanentLockoutHtml=<p>您的使用者因為在 {0} 有多次失敗的登入嘗試而被永久鎖定。請聯絡系統管理員。</p>
 
 requiredAction.CONFIGURE_TOTP=設定 OTP
 requiredAction.TERMS_AND_CONDITIONS=服務條款
@@ -41,10 +58,9 @@ requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=產生復原代碼
 # https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/MessageFormat.html
 # https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/text/ChoiceFormat.html
 linkExpirationFormatter.timePeriodUnit.seconds=秒
-linkExpirationFormatter.timePeriodUnit.minutes=分
+linkExpirationFormatter.timePeriodUnit.minutes=分鐘
 linkExpirationFormatter.timePeriodUnit.hours=小時
 linkExpirationFormatter.timePeriodUnit.days=天
 
 emailVerificationBodyCode=驗證您的電子信箱，請輸入以下代碼。\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>驗證您的電子信箱，請輸入以下代碼。</p><p><b>{0}</b></p>
-
diff --git a/themes/src/main/resources-community/theme/base/email/theme.properties b/themes/src/main/resources-community/theme/base/email/theme.properties
index 6c26d452f1a7..5a32ed2a8254 100644
--- a/themes/src/main/resources-community/theme/base/email/theme.properties
+++ b/themes/src/main/resources-community/theme/base/email/theme.properties
@@ -1 +1 @@
-locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,lt,nl,no,pl,pt,pt-BR,ru,sk,sv,th,tr,uk,zh-CN,zh-TW
+locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,ky,lt,nl,no,pl,pt,pt-BR,ru,sk,sl,sv,th,tr,uk,zh-CN,zh-TW
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ar.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ar.properties
index c6488c30e679..c24def87a3a6 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ar.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ar.properties
@@ -463,11 +463,11 @@ webauthn-createdAt-label=تم إنشاؤه في
 
 # WebAuthn Error
 webauthn-error-title=خطأ في مفتاح الأمان
-webauthn-error-registration=فشل في تسجيل مفتاح الأمان الخاص بك.<br/> {0}
-webauthn-error-api-get=فشلت المصادقة بواسطة مفتاح الأمان.<br/> {0}
+webauthn-error-registration=فشل في تسجيل مفتاح الأمان الخاص بك.<br /> {0}
+webauthn-error-api-get=فشلت المصادقة بواسطة مفتاح الأمان.<br /> {0}
 webauthn-error-different-user=أول مستخدم تمت مصادقته ليس هو الشخص الذي تمت مصادقته بواسطة مفتاح الأمان.
-webauthn-error-auth-verification=نتيجة مصادقة مفتاح الأمان غير صالحة.<br/> {0}
-webauthn-error-register-verification=نتيجة تسجيل مفتاح الأمان غير صالحة.<br/> {0}
+webauthn-error-auth-verification=نتيجة مصادقة مفتاح الأمان غير صالحة.<br /> {0}
+webauthn-error-register-verification=نتيجة تسجيل مفتاح الأمان غير صالحة.<br /> {0}
 webauthn-error-user-not-found=مستخدم غير معروف تمت مصادقته بواسطة مفتاح الأمان.
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ca.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ca.properties
index 6f6adbdb8ac6..156592cbfb01 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ca.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ca.properties
@@ -10,16 +10,16 @@ doContinue=Continua
 doIgnore=Ignora
 doAccept=Accepta
 doDecline=Rebutja
-doForgotPassword=Heu oblidat la vostra contrasenya?
+doForgotPassword=Heu oblidat la contrasenya?
 doClickHere=Feu clic aquí
 doImpersonate=Suplanta
 doTryAgain=Torna-ho a provar
-doTryAnotherWay=Prova d''una altra manera
+doTryAnotherWay=Prova d’una altra manera
 doConfirmDelete=Confirma la supressió
-errorDeletingAccount=S''ha produït un error en eliminar el compte
-deletingAccountForbidden=No teniu permisos suficients per a eliminar el vostre compte, contacteu amb l''administrador.
-kerberosNotConfigured=Kerberos no configurat
-kerberosNotConfiguredTitle=Kerberos no configurat
+errorDeletingAccount=S’ha produït un error en eliminar el compte
+deletingAccountForbidden=No teniu prou permisos per a eliminar el vostre compte, contacteu amb l’administrador.
+kerberosNotConfigured=Kerberos no està configurat
+kerberosNotConfiguredTitle=Kerberos no està configurat
 bypassKerberosDetail=O bé no esteu identificat mitjançant Kerberos o el vostre navegador no està configurat per a identificar-se mitjançant Kerberos. Feu clic per a identificar-vos per un altre mitjà
 kerberosNotSetUp=Kerberos no està configurat. No us podeu identificar.
 registerTitle=Registreu-vos
@@ -33,12 +33,12 @@ unknownUser=Usuari desconegut
 loginTotpTitle=Configuració de l''autenticador mòbil
 loginProfileTitle=Actualització de la informació del compte
 loginIdpReviewProfileTitle=Actualització de la informació del compte
-loginTimeout=S''ha excedit el temps per a realitzar una entrada. L''entrada començarà des del principi.
+loginTimeout=S’ha excedit el temps per a realitzar una entrada. L’entrada començarà des del principi.
 reauthenticate=Torneu a identificar-vos per a continuar
 oauthGrantTitle=Concedeix l''accés a {0}
 oauthGrantTitleHtml={0}
 oauthGrantInformation=Assegureu-vos que confieu en {0} assabentant-vos de com {0} gestionarà les vostres dades.
-oauthGrantReview=Podeu revisar les 
+oauthGrantReview=Podeu revisar les
 oauthGrantTos=condicions del servei.
 oauthGrantPolicy=política de privadesa.
 errorTitle=Ho lamentem...
@@ -103,13 +103,13 @@ birthday=Natalici
 zoneinfo=Fus horari
 gssDelegationCredential=Credencial de delegació GSS
 logoutOtherSessions=Surt d''altres dispositius
-profileScopeConsentText=Perfil d'usuari
+profileScopeConsentText=Perfil d''usuari
 emailScopeConsentText=Adreça de correu electrònic
 addressScopeConsentText=Adreça
 phoneScopeConsentText=Número de telèfon
 offlineAccessScopeConsentText=Accés fora de línia
 samlRoleListScopeConsentText=Els meus rols
-rolesScopeConsentText=Rols d'usuari
+rolesScopeConsentText=Rols d''usuari
 restartLoginTooltip=Torna a iniciar l''entrada
 loginTotpIntro=Heu de configurar un generador de contrasenyes d''un sol ús per a accedir a aquest compte
 loginTotpStep1=Instal·leu una de les aplicacions següents al vostre mòbil:
@@ -153,7 +153,7 @@ emailLinkIdpTitle=Enllaç a {0}
 emailLinkIdp1=S''ha enviat un correu electrònic amb instruccions per a enllaçar el compte {0} {1} amb el vostre compte {2}.
 emailLinkIdp2=No heu rebut un codi de verificació al vostre correu electrònic?
 emailLinkIdp3=per a tornar a enviar el correu electrònic.
-emailLinkIdp4=si ja heu verificat el correu electrònic en un altre navegador
+emailLinkIdp4=Si ja heu verificat el correu electrònic en un altre navegador
 emailLinkIdp5=per a continuar.
 backToLogin=&laquo; Torna a la identificació
 emailInstruction=Introduïu el vostre nom d''usuari o adreça de correu electrònic i us enviarem instruccions per a establir una contrasenya nova.
@@ -218,13 +218,13 @@ error-invalid-value=El valor no és vàlid.
 error-invalid-blank=Especifiqueu un valor.
 error-empty=Especifiqueu un valor.
 error-invalid-length=La llargària ha de ser d''entre {1} i {2}.
-error-invalid-length-too-short=La llargària mínima és de {1}.
-error-invalid-length-too-long=La llargària màxima és de {2}.
+error-invalid-length-too-short=La llargària mínima és {1}.
+error-invalid-length-too-long=La llargària màxima és, {2}.
 error-invalid-email=L''adreça de correu electrònic no és vàlida.
 error-invalid-number=El nombre no és vàlid.
 error-number-out-of-range=El número ha de ser entre {1} i {2}.
-error-number-out-of-range-too-small=El nombre ha de tindre un valor mínim de {1}.
-error-number-out-of-range-too-big=El nombre ha de tindre un valor màxim de {2}.
+error-number-out-of-range-too-small=El nombre ha de tenir un valor de, com a mínim, {1}.
+error-number-out-of-range-too-big=El nombre ha de tenir un valor de, com a màxim, {2}.
 error-pattern-no-match=El valor no és vàlid.
 error-invalid-uri=L''URL no és vàlid.
 error-invalid-uri-scheme=L''esquema d''URL no és vàlid.
@@ -320,7 +320,7 @@ realmSupportsNoCredentialsMessage=El domini no suporta cap tipus de credencials.
 credentialSetupRequired=No es pot entrar, es requereix la configuració de credencials.
 identityProviderNotUniqueMessage=El domini suporta múltiples proveïdors d''identitat. No s''ha pogut determinar el proveïdor d''identitat que hauria de ser utilitzat per identificar-se.
 emailVerifiedMessage=S''ha verificat el vostre correu electrònic.
-staleEmailVerificationLink=L''enllaç en què heu clicat és un enllaç antic que ja no és vàlid. Potser ja heu verificat el vostre correu electrònic.
+staleEmailVerificationLink=L’enllaç en què heu clicat és un enllaç antic que ja no és vàlid. Potser ja heu verificat el vostre correu electrònic.
 identityProviderAlreadyLinkedMessage=La identitat federada retornada per {0} ja està enllaçada a un altre usuari.
 confirmAccountLinking=Confirmeu l''enllaçat del compte {0} del proveïdor d''identitat {1} amb el vostre compte.
 confirmEmailAddressVerification=Confirmeu la validesa de l''adreça de correu electrònic {0}.
@@ -356,7 +356,7 @@ console-otp=Contrasenya d''un sol ús:
 console-new-password=Contrasenya nova:
 console-confirm-password=Confirma la contrasenya:
 console-update-password=Es requereix que actualitzeu la vostra contrasenya.
-console-verify-email=Heu de verificar l''adreça de correu electrònic. Hem enviat un correu electrònic a {0} que conté un codi de verificació. Introduïu aquest codi al camp següent.
+console-verify-email=Heu de verificar l’adreça de correu electrònic. Hem enviat un correu electrònic a {0} que conté un codi de verificació. Introduïu aquest codi al camp següent.
 console-email-code=Codi de verificació:
 console-accept-terms=Voleu acceptar els termes? [s/n]:
 console-accept=s
@@ -370,7 +370,7 @@ openshift.scope.list-projects=Llista els projectes
 # SAML authentication
 saml.post-form.title=Redirecció d''autenticació
 saml.post-form.message=S''està redirigint, espereu.
-saml.post-form.js-disabled=El JavaScript està inhabilitat. Us recomanem que l''habiliteu. Feu clic al botó de sota per a continuar. 
+saml.post-form.js-disabled=El JavaScript està inhabilitat. Us recomanem que l''habiliteu. Feu clic al botó de sota per a continuar.
 saml.artifactResolutionServiceInvalidResponse=No s''ha pogut resoldre l''artefacte.
 
 #authenticators
@@ -420,11 +420,11 @@ webauthn-createdAt-label=Creada
 
 # WebAuthn Error
 webauthn-error-title=Error de la clau de seguretat
-webauthn-error-registration=No s''ha pogut registrar la vostra clau de seguretat.<br/> {0}
-webauthn-error-api-get=No s''ha pogut identificar amb la clau de seguretat.<br/> {0}
+webauthn-error-registration=No s''ha pogut registrar la vostra clau de seguretat.<br /> {0}
+webauthn-error-api-get=No s''ha pogut identificar amb la clau de seguretat.<br /> {0}
 webauthn-error-different-user=L''usuari identificat primer no és l''autenticat per la clau de seguretat.
-webauthn-error-auth-verification=El resultat de l''autenticació amb clau de seguretat no és vàlid.<br/>{0}
-webauthn-error-register-verification=El resultat del registre amb clau de seguretat no és vàlid.<br/>{0}
+webauthn-error-auth-verification=El resultat de l''autenticació amb clau de seguretat no és vàlid.<br />{0}
+webauthn-error-register-verification=El resultat del registre amb clau de seguretat no és vàlid.<br />{0}
 webauthn-error-user-not-found=L''usuari identificat per la clau de seguretat és desconegut.
 
 # Identity provider
@@ -454,21 +454,21 @@ authenticateStrong=Es requereix autenticació forta per a continuar
 deleteCredentialMessage=Voleu suprimir {0}?
 showPassword=Mostra la contrasenya
 organizationScopeConsentText=Organització
-confirmOverrideIdpContinue=Sí, sobreescriu l'enllaç amb el compte actual
+confirmOverrideIdpContinue=Sí, sobreescriu l''enllaç amb el compte actual
 passkey-login-title=Entrada amb Passkey
 passkey-available-authenticators=Passkeys disponibles
-passkey-unsupported-browser-text=Aquest navegador no implementa Passkey. Proveu-ho amb un altre, o contacteu amb l'administrador.
+passkey-unsupported-browser-text=Aquest navegador no implementa Passkey. Proveu-ho amb un altre, o contacteu amb l''administrador.
 passkey-doAuthenticate=Entra amb Passkey
 passkey-createdAt-label=Creada
 passkey-autofill-select=Seleccioneu la vostra passkey
-organization.confirm-membership.title=Esteu a punt d'unir-vos a l'organització ${kc.org.name}
+organization.confirm-membership.title=Esteu a punt d''unir-vos a l''organització ${kc.org.name}
 organization.member.register.title=Creeu un compte per a unir-vos a l''organització ${kc.org.name}
 organization.select=Seleccioneu una organització per a continuar:
 deleteCredentialTitle=Suprimeix {0}
-invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d'usuari.
-identityProviderMissingCodeOrErrorMessage=Manca el paràmetre o codi d'error a la resposta del proveïdor d'identitat.
+invalidPasswordNotContainsUsernameMessage=La contrasenya no és vàlida: no pot contenir el nom d''usuari.
+identityProviderMissingCodeOrErrorMessage=Manca el paràmetre o codi d''error a la resposta del proveïdor d''identitat.
 hidePassword=Amaga la contrasenya
-identityProviderLogoutFailure=Error de sortida de l'IdP SAML
+identityProviderLogoutFailure=Error de sortida de l''IdP SAML
 emailVerifiedAlreadyMessage=La vostra adreça de correu electrònic ja està verificada.
 requiredAction.webauthn-register=Registre de WebAuthn
 webauthn-registration-init-label-prompt=Inseriu l''etiqueta de la vostra passkey registrada
@@ -477,5 +477,13 @@ organization.confirm-membership=Si feu clic al següent enllaç, esdevindreu mem
 auth-x509-client-username-form-display-name=Certificat X509
 webauthn-registration-init-label=Passkey (Etiqueta per defecte)
 auth-x509-client-username-form-help-text=Entra amb un certificat de client X509.
-error-invalid-multivalued-size=L''atribut {0} ha de tenir almenys {1} i com a molt {2} valor(s).
-confirmOverrideIdpTitle=L'enllaç de l'agent ja existeix
+error-invalid-multivalued-size=L’atribut {0} ha de tenir almenys {1} i com a molt {2} {2,choice,0#valors|1#valor|1<valor}.
+confirmOverrideIdpTitle=L''enllaç de l''agent ja existeix
+notMemberOfOrganization=L''usuari no és membre de l''organització {0}
+notMemberOfAnyOrganization=L’usuari no és membre de cap organització
+emailVerifyInstruction4=Per a verificar la vostra adreça de correu electrònic, us enviarem un correu amb instruccions a l’adreça {0}.
+emailVerifyResend=Torna a enviar el correu de verificació
+emailVerifySend=Envia el correu de verificació
+linkIdpActionTitle=Enllaç amb {0}
+linkIdpActionMessage=Voleu enllaçar el vostre compte amb {0}?
+confirmAccountLinkingBody=Si enllaceu el compte, també podreu entrar amb el compte {0} del proveïdor d’identitat {1}. No continueu si no heu iniciat aquest procés o si no voleu enllaçar el compte.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_cs.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_cs.properties
index 17d73bc655e5..2ce75243df85 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_cs.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_cs.properties
@@ -20,7 +20,7 @@ errorDeletingAccount=Nastala chyba při odstraňování účtu
 deletingAccountForbidden=Nemáte dostatečná oprávnění k odstranění vašeho vlastního účtu, kontaktujte administrátora.
 kerberosNotConfigured=Kerberos není nakonfigurován
 kerberosNotConfiguredTitle=Kerberos není nakonfigurován
-bypassKerberosDetail=Buď nejste přihlášeni přes Kerberos nebo váš prohlížeč není nastaven pro přihlášení Kerberos. Klepnutím na tlačítko pokračujte k přihlášení jinými způsoby
+bypassKerberosDetail=Buď nejste přihlášeni přes Kerberos nebo Váš prohlížeč není nastaven pro přihlášení Kerberos. Klepnutím na tlačítko pokračujte k přihlášení jinými způsoby
 kerberosNotSetUp=Kerberos není nastaven. Nemůžete se přihlásit.
 registerTitle=Registrovat
 loginAccountTitle=Přihlásit k vašemu účtu
@@ -35,6 +35,7 @@ loginProfileTitle=Aktualizovat informace o účtu
 loginIdpReviewProfileTitle=Aktualizovat informace o účtu
 loginTimeout=Přihlašování trvalo příliš dlouho. Přihlašovací proces začíná od začátku.
 reauthenticate=Pro pokračování se prosím znovu přihlaste
+authenticateStrong=Pro pokračování je potřeba silné přihlášení
 oauthGrantTitle=Udělit přístup {0}
 oauthGrantTitleHtml={0}
 oauthGrantInformation=Ujistěte se, že důvěřujete {0}. Zjistěte, jak {0} nakládá s daty uživatelů.
@@ -72,6 +73,9 @@ termsPlainText=Smluvní podmínky k odsouhlasení.
 termsAcceptanceRequired=Musíte souhlasit s našimi smluvními podmínkami.
 acceptTerms=Souhlasím se smluvními podmínkami
 
+deleteCredentialTitle=Odstranit {0}
+deleteCredentialMessage=Chcete odstranit {0}?
+
 recaptchaFailed=Neplatná Recaptcha
 recaptchaNotConfigured=Recaptcha je vyžadována, ale není nakonfigurována
 consentDenied=Souhlas byl zamítnut.
@@ -116,6 +120,7 @@ phoneScopeConsentText=Telefonní číslo
 offlineAccessScopeConsentText=Přístup offline
 samlRoleListScopeConsentText=Moje role
 rolesScopeConsentText=Uživatelské role
+organizationScopeConsentText=Organizace
 
 restartLoginTooltip=Začít s přihlašováním od začátku
 
@@ -163,9 +168,12 @@ oauth2DeviceAuthorizationGrantDisabledMessage=Klient nemá povoleno iniciovat OA
 emailVerifyInstruction1=Byl Vám zaslán e-mail s pokyny k ověření vaší e-mailové adresy.
 emailVerifyInstruction2=Nezískali jste v e-mailu ověřovací kód?
 emailVerifyInstruction3=znovu odeslat e-mail.
+emailVerifyInstruction4=Pro ověření Vaší e-mailové adresy Vám pošleme email s instrukcemi na adresu {0}.
+emailVerifyResend=Znovu poslat ověřovací e-mail
+emailVerifySend=Poslat ověřovací e-mail
 
 emailLinkIdpTitle=Odkaz {0}
-emailLinkIdp1=Byl vám zaslán e-mail s pokyny k propojení {0} účtu {1} s vaším účtem {2}.
+emailLinkIdp1=Byl Vám zaslán e-mail s pokyny k propojení {0} účtu {1} s vaším účtem {2}.
 emailLinkIdp2=Nezískali jste v e-mailu ověřovací kód?
 emailLinkIdp3=znovu odeslat e-mail.
 emailLinkIdp4=Pokud jste již ověřili e-mail v jiném prohlížeči
@@ -173,8 +181,8 @@ emailLinkIdp5=pokračovat.
 
 backToLogin=&laquo; Zpět k přihlášení
 
-emailInstruction=Zadejte své uživatelské jméno nebo e-mailovou adresu a my vám zašleme pokyny k vytvoření nového hesla.
-emailInstructionUsername=Zadejte své uživatelské jméno a my vám zašleme pokyny k vytvoření nového hesla.
+emailInstruction=Zadejte své uživatelské jméno nebo e-mailovou adresu a my Vám zašleme pokyny k vytvoření nového hesla.
+emailInstructionUsername=Zadejte své uživatelské jméno a my Vám zašleme pokyny k vytvoření nového hesla.
 
 copyCodeInstruction=Zkopírujte tento kód a vložte jej do své aplikace:
 
@@ -219,8 +227,10 @@ invalidUsernameOrEmailMessage=Neplatné jméno nebo e-mail.
 invalidPasswordMessage=Neplatné heslo.
 invalidEmailMessage=Neplatný e-mail.
 accountDisabledMessage=Účet je neplatný, kontaktujte administrátora.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessage=Neplatné jméno nebo heslo.
 accountPermanentlyDisabledMessage=Neplatné jméno nebo heslo.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessageTotp=Neplatný kód ověřování.
 accountPermanentlyDisabledMessageTotp=Neplatný kód ověřování.
 expiredCodeMessage=Platnost přihlášení vypršela. Přihlaste se znovu.
@@ -228,6 +238,7 @@ expiredActionMessage=Akce vypršela. Pokračujte přihlášením.
 expiredActionTokenNoSessionMessage=Akce vypršela.
 expiredActionTokenSessionExistsMessage=Akce vypršela. Začněte znovu
 sessionLimitExceeded=Příliš mnoho navázaných spojení
+identityProviderLogoutFailure=SAML IdP Odhlášení Selhalo
 
 missingFirstNameMessage=Zadejte prosím jméno.
 missingLastNameMessage=Zadejte prosím příjmení.
@@ -273,11 +284,14 @@ federatedIdentityUnavailableMessage=Uživatel {0} přihlášený poskytovatelem
 federatedIdentityUnmatchedEssentialClaimMessage=Token identity vydaný poskytovatelem identity neodpovídá nakonfigurovanému essential claim. Kontaktujte prosím administrátora.
 
 confirmLinkIdpTitle=Účet již existuje
+confirmOverrideIdpTitle=Propojení s poskytovatelem už existuje
 federatedIdentityConfirmLinkMessage=Uživatel s {0} {1} již existuje. Jak chcete pokračovat?
+federatedIdentityConfirmOverrideMessage=Snažíte se propojit Váš {0} účet s {1} účtem {2}. Ale Váš účet už je propojený s jiným {3} účtem {4}. Potvrďte, jestli chcete nahradit existující propojení s novým účtem?
 federatedIdentityConfirmReauthenticateMessage=Ověřte jako {0} k propojení účtu {1}
 nestedFirstBrokerFlowMessage={0} uživatel {1} není propojen s žádným známým uživatelem.
 confirmLinkIdpReviewProfile=Zkontrolujte profil
 confirmLinkIdpContinue=Přidat do existujícího účtu
+confirmOverrideIdpContinue=Ano, přepsat propojení s tímto účtem
 
 configureTotpMessage=Chcete-li aktivovat účet, musíte nastavit službu Mobile Authenticator.
 configureBackupCodesMessage=Pro aktivaci svého účtu musíte nakonfigurovat záložní kódy.
@@ -308,6 +322,7 @@ invalidPasswordMinLowerCaseCharsMessage=Neplatné heslo: musí obsahovat minimá
 invalidPasswordMinUpperCaseCharsMessage=Neplatné heslo: musí obsahovat nejméně {0} velká písmena.
 invalidPasswordMinSpecialCharsMessage=Neplatné heslo: musí obsahovat nejméně {0} speciální znaky.
 invalidPasswordNotUsernameMessage=Neplatné heslo: nesmí být totožné s uživatelským jménem.
+invalidPasswordNotContainsUsernameMessage=Neplatné heslo: nesmí obsahovat uživatelské jméno.
 invalidPasswordNotEmailMessage=Neplatné heslo: nesmí být totožné s e-mailovou adresou.
 invalidPasswordRegexPatternMessage=Neplatné heslo: neshoduje se vzorem regulérního výrazu.
 invalidPasswordHistoryMessage=Neplatné heslo: Nesmí se rovnat žádnému z posledních {0} hesel.
@@ -382,6 +397,7 @@ requiredAction.UPDATE_PROFILE=Aktualizovat profil
 requiredAction.VERIFY_EMAIL=Ověřit e-mail
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generování kódů pro obnovení
 #requiredAction.webauthn-register-passwordless=Webauthn Register Passwordless
+requiredAction.webauthn-register=Registrace Webauthn
 
 invalidTokenRequiredActions=Požadované akce obsažené v daném odkazu nejsou validní
 
@@ -426,6 +442,8 @@ auth-username-form-display-name=Jméno
 auth-username-form-help-text=Začněte přihlášení zadáním svého uživatelského jména
 auth-username-password-form-display-name=Jméno a heslo
 auth-username-password-form-help-text=Přihlaste se pomocí jména a hesla.
+auth-x509-client-username-form-display-name=X509 Certifikát
+auth-x509-client-username-form-help-text=Přihlásit se pomocí klientského X509 certifikátu.
 
 # Recovery Codes
 auth-recovery-authn-code-form-display-name=Kód pro obnovu přístupu
@@ -460,16 +478,27 @@ webauthn-available-authenticators=Dostupné přístupové klíče
 webauthn-unsupported-browser-text=WebAuthn není v tomto prohlížeči podporováno. Zkuste jiný prohlížeč nebo kontaktujte svého administrátora.
 webauthn-doAuthenticate=Přihlášení přístupovým klíčem
 webauthn-createdAt-label=Vytvořeno
+webauthn-registration-init-label=Přístupový klíč (Výchozí Popisek)
+webauthn-registration-init-label-prompt=Zadejte prosím popisek svého registrovaného přístupového klíče
+
 
 # WebAuthn Error
 webauthn-error-title=Chyba přístupového klíče
-webauthn-error-registration=Selhala registrace vašeho přístupového klíče.<br/> {0}
-webauthn-error-api-get=Selhalo přihlášení pomocí přístupového klíče.<br/> {0}
+webauthn-error-registration=Selhala registrace vašeho přístupového klíče.<br /> {0}
+webauthn-error-api-get=Selhalo přihlášení pomocí přístupového klíče.<br /> {0}
 webauthn-error-different-user=První přihlášený uživatel není totožný s uživatelem přihlášeným pomocí přístupového klíče.
-webauthn-error-auth-verification=Nevalidní výsledek přihlášení pomocí přístupového klíče.<br/> {0}
-webauthn-error-register-verification=Nevalidní výsledek registrace přístupového klíče.<br/> {0}
+webauthn-error-auth-verification=Nevalidní výsledek přihlášení pomocí přístupového klíče.<br /> {0}
+webauthn-error-register-verification=Nevalidní výsledek registrace přístupového klíče.<br /> {0}
 webauthn-error-user-not-found=Neznámý uživatel přihlášen pomocí přístupového klíče.
 
+# Passkey
+passkey-login-title=Přihlášení přístupovým klíčem
+passkey-available-authenticators=Dostupné přístupové klíče
+passkey-unsupported-browser-text=Přístupový klíč není v tomto prohlížeči podporován. Zkuste jiný nebo kontaktujte svého administrátora.
+passkey-doAuthenticate=Přihlášení přístupovým klíčem
+passkey-createdAt-label=Vytvořeno
+passkey-autofill-select=Vyberte svůj přístupový klíč
+
 # Identity provider
 identity-provider-redirector=Propojit s jiným poskytovatelem identit
 identity-provider-login-label=Nebo se přihlaste pomocí
@@ -498,4 +527,11 @@ logoutConfirmHeader=Chcete se odhlásit?
 doLogout=Odhlásit
 
 readOnlyUsernameMessage=Nemůžete aktualizovat své uživatelské jméno, protože je pouze pro čtení.
-error-invalid-multivalued-size=Atribut {0} musí mít nejméně {1} {1,choice,0#hodnot|1#hodnotu|1<hodnoty|4<hodnot} a nejvíce {2} {2,choice,0#hodnot|1#hodnotu|1<hodnoty|4<hodnot}.
\ No newline at end of file
+error-invalid-multivalued-size=Atribut {0} musí mít nejméně {1} {1,choice,0#hodnot|1#hodnotu|1<hodnoty|4<hodnot} a nejvíce {2} {2,choice,0#hodnot|1#hodnotu|1<hodnoty|4<hodnot}.
+
+organization.confirm-membership.title=Chystáte se přidat do organizace ${kc.org.name}
+organization.confirm-membership=Kliknutím na odkaz níže se stanete členem organizace {0}:
+organization.member.register.title=Vytvořte účet pro přidání se do organizace ${kc.org.name}
+organization.select=Pro pokračování vyberte organizaci:
+notMemberOfOrganization=Uživatel není členem organizace {0}
+notMemberOfAnyOrganization=Uživatel není členem žádné organizace
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_de.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_de.properties
index 0eaf3ef6cc7c..dffad6f245ab 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_de.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_de.properties
@@ -21,7 +21,7 @@ deletingAccountForbidden=Sie haben nicht genügend Berechtigungen, um Ihr eigene
 kerberosNotConfigured=Kerberos ist nicht konfiguriert
 kerberosNotConfiguredTitle=Kerberos nicht konfiguriert
 bypassKerberosDetail=Sie sind entweder nicht mit Kerberos angemeldet, oder Ihr Browser ist nicht für eine Anmeldung mit Kerberos konfiguriert. Bitte klicken Sie auf Weiter, damit Sie sich auf eine andere Art anmelden können
-kerberosNotSetUp=Kerberos ist nicht konfiguriert. Sie können sich damit nicht anmelden.
+kerberosNotSetUp=Kerberos ist nicht eingerichtet. Sie können sich nicht anmelden.
 registerTitle=Registrierung
 loginAccountTitle=Bei Ihrem Konto anmelden
 loginTitle=Anmeldung bei {0}
@@ -33,13 +33,13 @@ unknownUser=Unbekannter Benutzer
 loginTotpTitle=Mehrfachauthentifizierung konfigurieren
 loginProfileTitle=Benutzerkonto Informationen aktualisieren
 loginIdpReviewProfileTitle=Benutzerkonto Informationen aktualisieren
-loginTimeout=Sie haben zu lange gebraucht, um sich anzumelden. Bitte versuchen Sie es erneut.
+loginTimeout=Ihr Anmeldeversuch wurde wegen Zeitüberschreitung abgebrochen. Die Anmeldung beginnt von vorne.
 reauthenticate=Zum Fortsetzen bitte erneut anmelden
 authenticateStrong=Um fortzufahren wird ein stärkeres Authentifizierungsverfahren benötigt
 oauthGrantTitle=Zugang zu {0} gewähren
 oauthGrantTitleHtml={0}
 oauthGrantInformation=Stellen Sie sicher, dass Sie {0} vertrauen können und informieren Sie sich darüber, wie {0} mit Ihren Daten umgeht.
-oauthGrantReview=Prüfen Sie gerne die 
+oauthGrantReview=Prüfen Sie gerne die
 oauthGrantTos=Nutzungsbedingungen.
 oauthGrantPolicy=Datenschutzrichtlinie.
 errorTitle=Es ist ein Fehler aufgetreten.
@@ -118,7 +118,7 @@ loginTotpManualStep2=Öffnen Sie die Applikation und geben Sie den folgenden Sch
 loginTotpManualStep3=Verwenden Sie die folgenden Konfigurationswerte, falls Sie diese für die Applikation anpassen können:
 loginTotpUnableToScan=Sie können den QR-Code nicht scannen?
 loginTotpScanBarcode=QR-Code scannen?
-loginCredential=Berechtigungsnachweis
+loginCredential=Zugangsdaten
 loginOtpOneTime=One-time code
 loginTotpType=Typ
 loginTotpAlgorithm=Algorithmus
@@ -313,7 +313,7 @@ identityProviderNotFoundMessage=Konnte keinen Identity Provider zu der Identitä
 identityProviderLinkSuccess=Sie haben Ihre E-Mail-Adresse erfolgreich verifiziert. Bitte kehren Sie zu Ihrem ursprünglichen Browser zurück und fahren Sie dort mit der Anmeldung fort.
 staleCodeMessage=Diese Seite ist nicht mehr gültig, bitte kehren Sie zu Ihrer Applikation zurück und melden Sie sich erneut an.
 realmSupportsNoCredentialsMessage=Realm unterstützt keine Credential Typen.
-credentialSetupRequired=Anmeldung nicht möglich, Einrichtung der Berechtigungsnachweise erforderlich.
+credentialSetupRequired=Anmeldung nicht möglich, Einrichtung der Zugangsdaten erforderlich.
 identityProviderNotUniqueMessage=Der Realm unterstützt mehrere Identity Provider. Es konnte kein eindeutiger Identity Provider zum Authentifizieren gewählt werden.
 emailVerifiedMessage=Ihre E-Mail-Adresse wurde erfolgreich verifiziert.
 emailVerifiedAlreadyMessage=Ihre E-Mail-Adresse wurde bereits verifiziert.
@@ -353,7 +353,7 @@ console-otp=One Time Passwort:
 console-new-password=Neues Passwort:
 console-confirm-password=Passwort bestätigen:
 console-update-password=Eine Aktualisierung Ihres Passworts ist erforderlich.
-console-verify-email=Sie müssen Ihre E-Mail-Adresse verifizieren.  Wir haben eine E-Mail an {0} gesendet, die einen Verifizierungscode enthält.  Bitte geben Sie diesen Code in das untenstehende Eingabefeld ein.
+console-verify-email=Sie müssen Ihre E-Mail-Adresse verifizieren. Wir haben eine E-Mail an {0} gesendet, die einen Verifizierungscode enthält. Bitte geben Sie diesen Code in das untenstehende Eingabefeld ein.
 console-email-code=E-Mail Code:
 console-accept-terms=Nutzungsbedingungen akzeptieren? [y/n]:
 console-accept=y
@@ -367,7 +367,7 @@ openshift.scope.list-projects=Projekte auflisten
 # SAML authentication
 saml.post-form.title=Authentifizierungsumleitung
 saml.post-form.message=Sie werden weitergeleitet, bitte warten.
-saml.post-form.js-disabled=JavaScript ist deaktiviert. Wir empfehlen dringend, es zu aktivieren. Klicken Sie auf die Schaltfläche unten, um fortzufahren. 
+saml.post-form.js-disabled=JavaScript ist deaktiviert. Wir empfehlen dringend, es zu aktivieren. Klicken Sie auf die Schaltfläche unten, um fortzufahren.
 saml.artifactResolutionServiceInvalidResponse=Artefakt konnte nicht aufgelöst werden.
 
 #authenticators
@@ -417,11 +417,11 @@ webauthn-createdAt-label=Erstellt
 
 # WebAuthn Error
 webauthn-error-title=Passkey Fehler
-webauthn-error-registration=Fehler beim Registrieren Ihres Passkeys.<br/> {0}
-webauthn-error-api-get=Fehler beim Authentifizieren mit dem Passkey.<br/> {0}
+webauthn-error-registration=Fehler beim Registrieren Ihres Passkeys.<br /> {0}
+webauthn-error-api-get=Fehler beim Authentifizieren mit dem Passkey.<br /> {0}
 webauthn-error-different-user=Der erste authentifizierte Benutzer ist nicht derjenige, der durch den Passkey authentifiziert wurde.
-webauthn-error-auth-verification=Das Ergebnis der Passkey-Authentifizierung ist ungültig.<br/> {0}
-webauthn-error-register-verification=Das Ergebnis der Passkey-Registrierung ist ungültig.<br/> {0}
+webauthn-error-auth-verification=Das Ergebnis der Passkey-Authentifizierung ist ungültig.<br /> {0}
+webauthn-error-register-verification=Das Ergebnis der Passkey-Registrierung ist ungültig.<br /> {0}
 webauthn-error-user-not-found=Unbekannter Benutzer, der mit dem Passkey authentifiziert wurde.
 
 # Identity provider
@@ -447,7 +447,7 @@ logoutConfirmTitle=Abmelden
 logoutConfirmHeader=Wollen Sie sich abmelden?
 doLogout=Abmelden
 readOnlyUsernameMessage=Sie können Ihren Benutzernamen nicht ändern, da er schreibgeschützt ist.
-error-invalid-multivalued-size=Attribut {0} muss mindestens {1} und höchstens {2} Werte haben.
+error-invalid-multivalued-size=Attribut {0} muss mindestens {1} und darf höchstens {2} {2,choice,0#Werte|1#Wert|1<Werte} haben.
 webauthn-registration-init-label=Passkey (Standard Bezeichnung)
 nfc=NFC
 identityProviderLogoutFailure=Fehler bei Logout mit SAML Identitätsanbieter
@@ -481,3 +481,11 @@ passkey-createdAt-label=Erstellt
 passkey-autofill-select=Wählen Sie Ihren Passkey
 requiredAction.webauthn-register=Passkey einrichten
 organization.select=Wählen Sie eine Organisation, um fortzufahren:
+notMemberOfAnyOrganization=Benutzer ist kein Mitglied einer Organisation
+notMemberOfOrganization=Benutzer ist kein Mitglied der Organisation {0}
+emailVerifyInstruction4=Um Ihre E-Mail-Adresse zu verifizieren werden wir eine E-Mail mit weiteren Hinweisen an {0} senden.
+emailVerifyResend=Verifizierungs-E-Mail erneut senden
+emailVerifySend=Verifizierungs-E-Mail senden
+linkIdpActionMessage=Möchten Sie Ihren Account mit {0} verlinken?
+linkIdpActionTitle=Verknüpfe {0}
+confirmAccountLinkingBody=Wenn sie das Konto verknüpfen, dann können sie sich auch mit Konto {0} des Identity Providers {1} anmelden. Fahren sie nicht fort wenn sie dies nicht veranlasst haben oder das Konto nicht verknüpfen wollen.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_el.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_el.properties
index 7c1a5dde7431..b72d4d176c57 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_el.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_el.properties
@@ -68,6 +68,8 @@ unknown=Άγνωστο
 termsTitle=Όροι και Συνθήκες
 termsText=<p>Δεν έχουν οριστεί Όροι και Συνθήκες</p>
 termsPlainText=Δεν έχουν οριστεί Όροι και Συνθήκες.
+termsAcceptanceRequired=Πρέπει να αποδεχτείτε τους όρους και τις προϋποθέσεις μας.
+acceptTerms=Συμφωνώ με τους όρους και τις προϋποθέσεις
 recaptchaFailed=Άκυρο Recaptcha
 recaptchaNotConfigured=Απαιτείται Recaptcha, αλλά δεν έχει ρυθμιστεί
 consentDenied=Άρνηση Συναίνεσης.
@@ -415,11 +417,11 @@ webauthn-createdAt-label=Δημιουργήθηκε
 
 # WebAuthn Error
 webauthn-error-title=Σφάλμα Κλειδιού Ασφαλείας
-webauthn-error-registration=Αποτυχία εγγραφής του κλειδιού ασφαλείας σας.<br/> {0}
-webauthn-error-api-get=Αποτυχία ταυτοποίησης μέσω του Κλειδιού ασφαλείας.<br/> {0}
+webauthn-error-registration=Αποτυχία εγγραφής του κλειδιού ασφαλείας σας.<br /> {0}
+webauthn-error-api-get=Αποτυχία ταυτοποίησης μέσω του Κλειδιού ασφαλείας.<br /> {0}
 webauthn-error-different-user=Ο αρχικός ταυτοποιημένος χρήστης δεν είναι ο ίδιος με αυτόν που ταυτοποιήθηκε με το Κλειδί ασφαλείας.
-webauthn-error-auth-verification=Μη έγκυρο αποτέλεσμα ταυτοποίησης του Κλειδιού ασφαλείας.<br/> {0}
-webauthn-error-register-verification=Μη έγκυρο αποτέλεσμα εγγραφής του Κλειδιού ασφαλείας.<br/> {0}
+webauthn-error-auth-verification=Μη έγκυρο αποτέλεσμα ταυτοποίησης του Κλειδιού ασφαλείας.<br /> {0}
+webauthn-error-register-verification=Μη έγκυρο αποτέλεσμα εγγραφής του Κλειδιού ασφαλείας.<br /> {0}
 webauthn-error-user-not-found=Άγνωστος χρήστης ταυτοποιήθηκε με το Κλειδί ασφαλείας.
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_es.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_es.properties
index c7eacac1dcbf..d2c7fa8973b3 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_es.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_es.properties
@@ -13,8 +13,8 @@ doClickHere=Haz clic aquí
 doImpersonate=Suplantar
 kerberosNotConfigured=Kerberos no configurado
 kerberosNotConfiguredTitle=Kerberos no configurado
-bypassKerberosDetail=O bien no estás identificado mediante Kerberos o tu navegador no está configurado para identificarse mediante Kerberos. Por favor haz clic para identificarte por otro medio
-kerberosNotSetUp=Kerberos no está configurado. No puedes identificarte.
+bypassKerberosDetail=O bien no está identificado mediante Kerberos o su navegador no está configurado para identificarse mediante Kerberos. Por favor haga clic para identificarse por otro medio
+kerberosNotSetUp=Kerberos no está configurado. No puede identificarse.
 loginAccountTitle=Acceder a tu cuenta
 loginTitle=Inicia sesión en {0}
 loginTitleHtml={0}
@@ -24,7 +24,7 @@ realmChoice=Realm
 unknownUser=Usuario desconocido
 loginTotpTitle=Configura tu aplicación de identificación móvil
 loginProfileTitle=Actualiza la información de tu cuenta
-loginTimeout=Ha tardado demasiado en identificarte. Inicie de nuevo la identificación.
+loginTimeout=Ha tardado demasiado en identificarse. Inicie de nuevo la identificación.
 oauthGrantTitle=Conceder acceso a {0}
 oauthGrantTitleHtml={0}
 errorTitle=Lo sentimos...
@@ -65,7 +65,7 @@ gssDelegationCredential=Credencial de delegación GSS
 loginTotpIntro=Es necesario configurar un generador de claves de un sólo uso para acceder a esta cuenta
 loginTotpStep1=Instala una de las siguientes aplicaciones en tu teléfono móvil:
 loginTotpStep2=Abre la aplicación y escanea el código de barras:
-loginTotpStep3=Introduce el código único que te muestra la aplicación de autenticación y haz clic en Enviar para finalizar la configuración.
+loginTotpStep3=Introduzca el código único que le muestra la aplicación de autenticación y haga clic en Enviar para finalizar la configuración.
 loginTotpStep3DeviceName=Introduce un nombre de dispositivo para que te ayude a gestionar tus dispositivos OTP.
 loginTotpManualStep2=Abre la aplicación e introduce la clave:
 loginTotpManualStep3=Usa los siguientes parámetros de configuración si la aplicación te permite introducirlos:
@@ -79,7 +79,7 @@ loginTotpDigits=Dígitos
 loginTotpInterval=Intervalo
 loginTotpCounter=Contador
 loginTotpDeviceName=Nombre del dispositivo
-oauthGrantRequest=¿Quieres permitir estos privilegios de acceso?
+oauthGrantRequest=¿Quiere permitir estos privilegios de acceso?
 inResource=en
 emailVerifyInstruction1=Se ha enviado un correo electrónico con instrucciones para verificar tu dirección de correo a {0}.
 emailVerifyInstruction2=¿No ha recibido un código de verificación en su email?
@@ -114,7 +114,7 @@ client_realm-management=Gestión del realm
 client_broker=Broker
 invalidUserMessage=Usuario o contraseña incorrectos.
 invalidEmailMessage=Email no válido.
-accountDisabledMessage=La cuenta está desactivada, contacta con el administrador.
+accountDisabledMessage=La cuenta está desactivada, contacte con el administrador.
 accountTemporarilyDisabledMessage=Usuario o contraseña incorrectos.
 accountPermanentlyDisabledMessage=Usuario o contraseña incorrectos.
 accountTemporarilyDisabledMessageTotp=El código de autenticación no es válido.
@@ -137,13 +137,13 @@ usernameExistsMessage=El nombre de usuario ya existe.
 emailExistsMessage=El email ya existe.
 federatedIdentityExistsMessage=El usuario con {0} {1} ya existe. Inicie sesión en la administración de cuentas para vincular la cuenta.
 federatedIdentityUnavailableMessage=El usuario {0} autenticado con el proveedor de identidad {1} no existe. Póngase en contacto con su administrador.
-configureTotpMessage=Tienes que configurar la aplicación móvil de identificación para activar tu cuenta.
-configureBackupCodesMessage=Tienes que configurar códigos de respaldo para activar su cuenta.
-updateProfileMessage=Tienes que actualizar tu perfil de usuario para activar tu cuenta.
-updatePasswordMessage=Tienes que cambiar tu contraseña para activar tu cuenta.
-updateEmailMessage=Tienes que actualizar su dirección de correo electrónico para activar su cuenta.
-resetPasswordMessage=Tienes que cambiar tu contraseña.
-verifyEmailMessage=Tienes que verificar tu email para activar tu cuenta.
+configureTotpMessage=Tiene que configurar la aplicación móvil de identificación para activar su cuenta.
+configureBackupCodesMessage=Tiene que configurar códigos de respaldo para activar su cuenta.
+updateProfileMessage=Tiene que actualizar su perfil de usuario para activar su cuenta.
+updatePasswordMessage=Tiene que cambiar su contraseña para activar su cuenta.
+updateEmailMessage=Tiene que actualizar su dirección de correo electrónico para activar su cuenta.
+resetPasswordMessage=Tiene que cambiar su contraseña.
+verifyEmailMessage=Tiene que verificar su email para activar su cuenta.
 linkIdpMessage=Debe verificar su dirección de correo electrónico para vincular su cuenta con {0}.
 emailSentMessage=En breve deberías recibir un mensaje con más instrucciones.
 emailSendErrorMessage=Falló el envío del email, por favor inténtalo de nuevo más tarde.
@@ -190,7 +190,7 @@ identityProviderNotFoundMessage=No se pudo encontrar un proveedor de identidad c
 realmSupportsNoCredentialsMessage=El realm no soporta ningún tipo de credenciales.
 identityProviderNotUniqueMessage=El realm soporta múltiples proveedores de identidad. No se pudo determinar el proveedor de identidad que debería ser utilizado para identificarse.
 emailVerifiedMessage=Tu email ha sido verificado.
-staleEmailVerificationLink=El enlace en el que hizo clic es un enlace obsoleto antiguo y ya no es válido. Tal vez ya hayas verificado tu correo electrónico.
+staleEmailVerificationLink=El enlace en el que hizo clic es un enlace obsoleto antiguo y ya no es válido. Tal vez ya haya verificado su correo electrónico.
 identityProviderInvalidResponseMessage=Respuesta no válida del proveedor de identidad.
 confirmAccountLinking=Confirme la vinculación de la cuenta {0} del proveedor de identidad {1} con su cuenta.
 identityProviderMissingStateMessage=Falta el parámetro de estado en respuesta del proveedor de identidad.
@@ -226,7 +226,7 @@ doLogout=Cerrar sesión
 doBack=Atrás
 doIgnore=Ignorar
 doTryAgain=Intentar otra vez
-doTryAnotherWay=Prueba de otra manera
+doTryAnotherWay=Pruebe de otra manera
 doConfirmDelete=Confirmar la eliminación
 errorDeletingAccount=Ocurrió un error al intentar eliminar la cuenta
 deletingAccountForbidden=No tiene suficientes permisos para eliminar su propia cuenta, comuníquese con un administrador.
@@ -234,7 +234,7 @@ registerTitle=Registro
 loginIdpReviewProfileTitle=Actualizar información de la cuenta
 reauthenticate=Vuelva a autenticarse para continuar
 oauthGrantInformation=Asegúrese que confía en {0} aprendiendo cómo {0} manejará sus datos.
-oauthGrantReview=Podría revisar el 
+oauthGrantReview=Podría revisar el
 oauthGrantTos=términos de servicio.
 oauthGrantPolicy=política de privacidad.
 updateEmailTitle=Actualizar correo electrónico
@@ -298,7 +298,7 @@ emailLinkIdpTitle=Enlace {0}
 emailLinkIdp1=Se le ha enviado un correo electrónico con instrucciones para vincular {0} cuenta {1} con su cuenta {2}.
 emailLinkIdp2=¿No ha recibido un código de verificación en su correo electrónico?
 emailLinkIdp3=para volver a enviar el correo electrónico.
-emailLinkIdp4=Si ya verificó el correo electrónico en diferentes navegadores
+emailLinkIdp4=Si ya verificó el correo electrónico en un navegador diferente
 emailLinkIdp5=continuar.
 emailInstructionUsername=Ingrese su nombre de usuario y le enviaremos instrucciones sobre cómo crear una nueva contraseña.
 pageExpiredTitle=La página ha expirado
@@ -337,7 +337,7 @@ error-person-name-invalid-character=El valor contiene carácter inválido.
 error-reset-otp-missing-id=Elija una configuración OTP.
 federatedIdentityUnmatchedEssentialClaimMessage=El token de identificación emitido por el proveedor de identidad no coincide con el reclamo esencial configurado. Póngase en contacto con su administrador.
 confirmLinkIdpTitle=La cuenta ya existe
-federatedIdentityConfirmLinkMessage=El usuario con {0} {1} ya existe. ¿Cómo quieres continuar?
+federatedIdentityConfirmLinkMessage=El usuario con {0} {1} ya existe. ¿Cómo quiere continuar?
 federatedIdentityConfirmReauthenticateMessage=Autenticar para vincular su cuenta con {0}
 nestedFirstBrokerFlowMessage=El usuario {0} {1} no está vinculado a ningún usuario conocido.
 confirmLinkIdpReviewProfile=Perfil de revisión
@@ -352,7 +352,7 @@ invalidPasswordGenericMessage=Contraseña no válida: la nueva contraseña no co
 successLogout=Está desconectado
 standardFlowDisabledMessage=El cliente no puede iniciar el inicio de sesión del navegador con el tipo de respuesta dado. El flujo estándar está deshabilitado para el cliente.
 implicitFlowDisabledMessage=El cliente no puede iniciar el inicio de sesión del navegador con el tipo de respuesta dado. El flujo implícito está deshabilitado para el cliente.
-cookieNotFoundMessage=Cookie de reinicio de inicio de sesión no encontrado. Puede que haya expirado, que haya sido eliminado o que las cookies estén deshabilitadas en tu navegador. Si las cookies están deshabilitadas, habilítalas. Haz clic en 'Volver a la aplicación' para iniciar sesión nuevamente.
+cookieNotFoundMessage=No se encontró la cookie de reinicio de inicio de sesión. Puede haber expirado, haber sido eliminada o las cookies pueden estar deshabilitadas en su navegador. Si las cookies están deshabilitadas, habilítelas. Haga clic en Volver a la aplicación para iniciar sesión nuevamente.
 insufficientLevelOfAuthentication=El nivel de autenticación solicitado no se ha cumplido.
 identityProviderMissingCodeOrErrorMessage=Código faltante o parámetro de error en respuesta del proveedor de identidad.
 identityProviderInvalidSignatureMessage=Firma no válida en respuesta del proveedor de identidad.
@@ -389,7 +389,7 @@ openshift.scope.list-projects=Listar proyectos
 # SAML authentication
 saml.post-form.title=Redirección de autenticación
 saml.post-form.message=Redireccionando, por favor espere.
-saml.post-form.js-disabled=JavaScript está deshabilitado. Recomendamos encarecidamente habilitarlo. Haga clic en el botón de abajo para continuar. 
+saml.post-form.js-disabled=JavaScript está deshabilitado. Recomendamos encarecidamente habilitarlo. Haga clic en el botón de abajo para continuar.
 saml.artifactResolutionServiceInvalidResponse=Incapaz de resolver artefactos.
 
 #authenticators
@@ -411,7 +411,7 @@ auth-recovery-code-prompt=Código de recuperación #{0}
 auth-recovery-code-header=Iniciar sesión con un código de autenticación de recuperación
 recovery-codes-error-invalid=Código de autenticación de recuperación no válida
 recovery-code-config-header=Códigos de autenticación de recuperación
-recovery-code-config-warning-title=Estos códigos de recuperación no aparecerán nuevamente después de dejar esta página
+recovery-code-config-warning-title=Estos códigos de recuperación no volverán a aparecer después de salir de esta página
 recovery-code-config-warning-message=Asegúrese de imprimir, descargarlos o copiarlos a un administrador de contraseñas y mantenerlos seguros. Cancelar esta configuración eliminará estos códigos de recuperación de su cuenta.
 recovery-codes-print=Imprimir
 recovery-codes-download=Descargar
@@ -439,11 +439,11 @@ webauthn-createdAt-label=Creada
 
 # WebAuthn Error
 webauthn-error-title=Error de Passkey
-webauthn-error-registration=No se pudo registrar su Passkey. <br/> {0}
-webauthn-error-api-get=No se pudo autenticar con el Passkey. <br/> {0}
+webauthn-error-registration=No se pudo registrar su Passkey. <br /> {0}
+webauthn-error-api-get=No se pudo autenticar con el Passkey. <br /> {0}
 webauthn-error-different-user=El primer usuario autenticado no es el autenticado por el Passkey.
-webauthn-error-auth-verification=El resultado de la autenticación con el Passkey no es válido. <br/> {0}
-webauthn-error-register-verification=El resultado de registro del Passkey no es válido. <br/> {0}
+webauthn-error-auth-verification=El resultado de la autenticación con el Passkey no es válido. <br /> {0}
+webauthn-error-register-verification=El resultado de registro del Passkey no es válido. <br /> {0}
 webauthn-error-user-not-found=Usuario desconocido autenticado por el Passkey.
 
 
@@ -460,9 +460,9 @@ frontchannel-logout.title=Saliendo de su cuenta
 frontchannel-logout.message=Está cerrando las siguientes aplicaciones
 readOnlyUsernameMessage=No puede actualizar su nombre de usuario, ya que es de solo lectura.
 authenticateStrong=Se requiere autenticación fuerte para continuar
-deleteCredentialMessage=¿Deseas eliminar {0}?
+deleteCredentialMessage=¿Desea eliminar {0}?
 confirmOverrideIdpTitle=El enlace con el broker ya existe
-federatedIdentityConfirmOverrideMessage=Estás intentando vincular tu cuenta {0} con la cuenta {1} {2}. Pero tu cuenta ya está vinculada con otra cuenta {3} {4}. ¿Puedes confirmar si deseas reemplazar el enlace existente con la nueva cuenta?
+federatedIdentityConfirmOverrideMessage=Está intentando vincular su cuenta {0} con la cuenta {1} {2}. Pero su cuenta ya está vinculada con otra cuenta {3} {4}. ¿Puede confirmar si desea reemplazar el enlace existente con la nueva cuenta?
 confirmOverrideIdpContinue=Sí, reemplazar el enlace con la cuenta actual
 invalidPasswordNotContainsUsernameMessage=Contraseña no válida: no puede contener el nombre de usuario.
 emailVerifiedAlreadyMessage=Tu dirección de correo electrónico ya ha sido verificada.
@@ -473,7 +473,7 @@ passkey-available-authenticators=Passkeys disponibles
 passkey-doAuthenticate=Inicia sesión con Passkey
 passkey-createdAt-label=Creado
 passkey-autofill-select=Seleccione su passkey
-error-invalid-multivalued-size=El atributo {0} debe tener al menos {1} y como máximo {2} valor(es).
+error-invalid-multivalued-size=El atributo {0} debe tener al menos {1} y como máximo {2} {2,choice,0#valores|1#valor|1<valores}.
 organization.confirm-membership.title=Está a punto de unirse a la organización ${kc.org.name}
 organization.confirm-membership=Al hacer clic en el enlace de abajo, se convertirá en miembro de la organización {0}:
 deleteCredentialTitle=Eliminar {0}
@@ -484,4 +484,12 @@ auth-x509-client-username-form-help-text=Inicia sesión con un certificado de cl
 organizationScopeConsentText=Organización
 organization.select=Seleccione una organización para continuar:
 identityProviderLogoutFailure=Error al cerrar sesión en el proveedor de identidad SAML
-passkey-unsupported-browser-text=Este navegador no admite Passkey. Prueba con otro o contacta a tu administrador.
+passkey-unsupported-browser-text=Este navegador no admite Passkey. Pruebe con otro o contacte a su administrador.
+notMemberOfOrganization=El usuario no es miembro de la organización {0}
+notMemberOfAnyOrganization=El usuario no es miembro de ninguna organización
+emailVerifyInstruction4=Para verificar su dirección de correo electrónico, le enviaremos un correo con instrucciones a la dirección {0}.
+emailVerifyResend=Reenviar correo de verificación
+emailVerifySend=Enviar correo de verificación
+linkIdpActionTitle=Vinculando {0}
+linkIdpActionMessage=¿Desea vincular su cuenta con {0}?
+confirmAccountLinkingBody=Si vincula la cuenta, también podrá iniciar sesión utilizando la cuenta {0} del proveedor de identidad {1}. No continúe si usted no inició este proceso o no desea vincular la cuenta.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_fa.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_fa.properties
index 8271b661dfb8..65147e22b5b2 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_fa.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_fa.properties
@@ -10,17 +10,17 @@ doContinue=ادامه
 doIgnore=نادیده‌گیری
 doAccept=پذیرفتن
 doDecline=رد کردن
-doForgotPassword=رمز عبور خود را فراموش کرده اید؟
+doForgotPassword=گذرواژه خود را فراموش کرده اید؟
 doClickHere=اینجا را کلیک کنید
 doImpersonate=تقلید کردن
 doTryAgain=تلاش مجدد
 doTryAnotherWay=راه دیگری را امتحان کنید
-doConfirmDelete=تایید حذف
+doConfirmDelete=تأیید حذف
 errorDeletingAccount=خطایی هنگام حذف حساب رخ داد
 deletingAccountForbidden=.شما مجوز کافی برای حذف حساب خود را ندارید، با ادمین تماس بگیرید
 kerberosNotConfigured=Kerberos تنظیم نشده است
 kerberosNotConfiguredTitle=Kerberos تنظیم نشده است
-bypassKerberosDetail=یا توسط Kerberos وارد نشده اید یا مرورگر شما برای ورود به Kerberos تنظیم نشده است. لطفا روی ادامه کلیک کنید تا از راه های دیگر وارد شوید
+bypassKerberosDetail=یا توسط Kerberos وارد نشده اید یا مرورگر شما برای ورود به Kerberos تنظیم نشده است. لطفاً روی ادامه کلیک کنید تا از راه های دیگر وارد شوید
 kerberosNotSetUp=Kerberos راه اندازی نشده است. شما نمی توانید وارد شوید.
 registerTitle=ثبت نام
 loginAccountTitle=به حساب خود وارد شوید
@@ -33,24 +33,24 @@ unknownUser=کاربر ناشناس
 loginTotpTitle=راه اندازی دستگاه تأیید اعتبار موبایل
 loginProfileTitle=به روز رسانی اطلاعات حساب
 loginIdpReviewProfileTitle=به روز رسانی اطلاعات حساب
-loginTimeout=.زمان تلاش برای ورود شما به پایان رسید. ورود از ابتدا شروع خواهد شد
+loginTimeout=زمان تلاش برای ورود شما به پایان رسید. ورود از ابتدا شروع خواهد شد.
 reauthenticate=لطفاً برای ادامه دوباره احراز هویت کنید
 oauthGrantTitle=اعطای دسترسی به {0}
 oauthGrantTitleHtml={0}
-oauthGrantInformation=.با یادگیری نحوه مدیریت {0} با داده های شما، مطمئن شوید که به {0} اعتماد دارید
+oauthGrantInformation=با یادگیری نحوه مدیریت {0} با داده های شما، مطمئن شوید که به {0} اعتماد دارید.
 oauthGrantReview=شما می توانید بررسی کنید
-oauthGrantTos=.شرایط استفاده از خدمات
-oauthGrantPolicy=.سیاست حفظ حریم خصوصی
-errorTitle=...متاسفیم
+oauthGrantTos=شرایط استفاده از خدمات.
+oauthGrantPolicy=سیاست حفظ حریم خصوصی.
+errorTitle=متاسفیم...
 errorTitleHtml=...<strong>متاسفیم</strong> ما
-emailVerifyTitle=تایید ایمیل
-emailForgotTitle=رمز عبور خود را فراموش کرده اید؟
+emailVerifyTitle=تأیید ایمیل
+emailForgotTitle=گذرواژه خود را فراموش کرده اید؟
 updateEmailTitle=ایمیل را به روز کنید
-emailUpdateConfirmationSentTitle=ایمیل تایید فرستاده شد
-emailUpdateConfirmationSent=.یک ایمیل تأیید به {0} ارسال شده است. برای تکمیل به‌روزرسانی ایمیل، باید دستورالعمل‌های قبلی را دنبال کنید
+emailUpdateConfirmationSentTitle=ایمیل تأیید فرستاده شد
+emailUpdateConfirmationSent=یک ایمیل تأیید به {0} ارسال شده است. برای تکمیل به‌روزرسانی ایمیل، باید دستورالعمل‌های قبلی را دنبال کنید.
 emailUpdatedTitle=ایمیل به روز شد
-emailUpdated=.ایمیل حساب با موفقیت به {0} به روز شد
-updatePasswordTitle=رمز عبور را به روز کنید
+emailUpdated=ایمیل حساب با موفقیت به {0} به روز شد.
+updatePasswordTitle=گذرواژه را به روز کنید
 codeSuccessTitle=کد موفقیت
 codeErrorTitle=کد خطا\: {0}
 displayUnsupported=نوع نمایش درخواستی پشتیبانی نمی شود
@@ -68,11 +68,11 @@ unknown=ناشناخته
 
 termsTitle=شرایط و ضوابط
 termsText=<p>شرایط و شرایطی که باید تعریف شوند</p>
-termsPlainText=.شرایط و ضوابط باید تعریف شود
+termsPlainText=شرایط و ضوابط باید تعریف شود.
 
 recaptchaFailed=Recaptcha نامعتبر است
 recaptchaNotConfigured=Recaptcha مورد نیاز است، اما پیکربندی نشده است
-consentDenied=.رضایت رد شد
+consentDenied=رضایت رد شد.
 
 noAccount=کاربر جدید هستید؟
 username=نام کاربری
@@ -83,10 +83,10 @@ fullName=نام کامل
 lastName=نام خانوادگی
 familyName=نام خانوادگی
 email=ایمیل
-password=رمز عبور
-passwordConfirm=تائید رمز عبور
-passwordNew=رمز عبور جدید
-passwordNewConfirm=تائید رمز عبور جدید
+password=گذرواژه
+passwordConfirm=تأیید گذرواژه
+passwordNew=گذرواژه جدید
+passwordNewConfirm=تأیید گذرواژه جدید
 rememberMe=مرا به خاطر بسپار
 authenticatorCode=کد یکبار مصرف
 address=آدرس
@@ -95,10 +95,10 @@ locality=شهر یا محله
 region=ایالت، استان یا منطقه
 postal_code=کد پستی
 country=کشور
-emailVerified=ایمیل تأییده شده است
+emailVerified=ایمیل تأیید شده است
 website=صفحه وب
 phoneNumber=شماره تلفن
-phoneNumberVerified=شماره تلفن تایید شد
+phoneNumberVerified=شماره تلفن تأیید شد
 gender=جنسیت
 birthday=تاریخ تولد
 zoneinfo=منطقه زمانی
@@ -118,10 +118,10 @@ restartLoginTooltip=ورود مجدد را راه اندازی کنید
 loginTotpIntro=برای دسترسی به این حساب، باید یک تولید کننده رمز یک بار مصرف راه اندازی کنید
 loginTotpStep1=یکی از برنامه های زیر را روی موبایل خود نصب کنید:
 loginTotpStep2=برنامه را باز کنید و بارکد را اسکن کنید:
-loginTotpStep3=.کد یکبار مصرف ارائه شده توسط برنامه را وارد کنید و برای تکمیل تنظیمات روی ارسال کلیک کنید
+loginTotpStep3=کد یکبار مصرف ارائه شده توسط برنامه را وارد کنید و برای تکمیل تنظیمات روی ارسال کلیک کنید.
 loginTotpStep3DeviceName=یک نام دستگاه برای کمک به مدیریت دستگاه های OTP خود ارائه دهید
-loginTotpManualStep2=:برنامه را باز کنید و کلید را وارد کنید
-loginTotpManualStep3=:اگر برنامه اجازه تنظیم آنها را می دهد، از مقادیر پیکربندی زیر استفاده کنید
+loginTotpManualStep2=برنامه را باز کنید و کلید را وارد کنید:
+loginTotpManualStep3=اگر برنامه اجازه تنظیم آنها را می دهد، از مقادیر پیکربندی زیر استفاده کنید:
 loginTotpUnableToScan=نمی توانید اسکن کنید؟
 loginTotpScanBarcode=اسکن بارکد؟
 loginCredential=اعتبارنامه
@@ -147,32 +147,32 @@ inResource=در
 
 oauth2DeviceVerificationTitle=ورود به دستگاه
 verifyOAuth2DeviceUserCode=کد ارائه شده توسط دستگاه خود را وارد کرده و روی ارسال کلیک کنید
-oauth2DeviceInvalidUserCodeMessage=.کد نامعتبر است، لطفا دوباره امتحان کنید
-oauth2DeviceExpiredUserCodeMessage=.کد منقضی شده است. لطفاً به دستگاه خود برگردید و دوباره سعی کنید وصل شوید
+oauth2DeviceInvalidUserCodeMessage=.کد نامعتبر است، لطفاً دوباره امتحان کنید
+oauth2DeviceExpiredUserCodeMessage=کد منقضی شده است. لطفاً به دستگاه خود برگردید و دوباره سعی کنید وصل شوید.
 oauth2DeviceVerificationCompleteHeader=ورود دستگاه با موفقیت انجام شد
-oauth2DeviceVerificationCompleteMessage=.می توانید این پنجره مرورگر را ببندید و به دستگاه خود بازگردید
+oauth2DeviceVerificationCompleteMessage=می توانید این پنجره مرورگر را ببندید و به دستگاه خود بازگردید.
 oauth2DeviceVerificationFailedHeader=ورود دستگاه ناموفق بود
-oauth2DeviceVerificationFailedMessage=.می توانید این پنجره مرورگر را ببندید و به دستگاه خود بازگردید و دوباره سعی کنید وصل شوید
-oauth2DeviceConsentDeniedMessage=.رضایت برای اتصال دستگاه رد شد
+oauth2DeviceVerificationFailedMessage=می توانید این پنجره مرورگر را ببندید و به دستگاه خود بازگردید و دوباره سعی کنید وصل شوید.
+oauth2DeviceConsentDeniedMessage=رضایت برای اتصال دستگاه رد شد.
 oauth2DeviceAuthorizationGrantDisabledMessage=مشتری مجاز به شروع OAuth 2.0 Device Authorization Grant نیست. جریان برای مشتری غیرفعال است.
 
-emailVerifyInstruction1=.یک ایمیل حاوی دستورالعمل هایی برای تأیید آدرس ایمیل شما به آدرس شما {0} ارسال شده است
+emailVerifyInstruction1=یک ایمیل حاوی دستورالعمل هایی برای تأیید آدرس ایمیل شما به آدرس شما {0} ارسال شده است.
 emailVerifyInstruction2=آیا کد تأیید در ایمیل خود دریافت نکرده اید؟
 emailVerifyInstruction3=برای ارسال مجدد ایمیل
 
 emailLinkIdpTitle=پیوند {0}
-emailLinkIdp1=.یک ایمیل با دستورالعمل پیوند {0} حساب {1} با حساب {2} شما برای شما ارسال شده است
+emailLinkIdp1=یک ایمیل با دستورالعمل پیوند {0} حساب {1} با حساب {2} شما برای شما ارسال شده است.
 emailLinkIdp2=آیا کد تأیید در ایمیل خود دریافت نکرده اید؟
 emailLinkIdp3=برای ارسال مجدد ایمیل
 emailLinkIdp4=اگر قبلاً ایمیل را در مرورگر دیگری تأیید کرده اید
-emailLinkIdp5=.ادامه
+emailLinkIdp5=ادامه.
 
 backToLogin=&laquo; بازگشت به صفحه ورود
 
-emailInstruction=.نام کاربری یا آدرس ایمیل خود را وارد کنید و ما دستورالعمل هایی در مورد نحوه ایجاد رمز عبور جدید برای شما ارسال خواهیم کرد
-emailInstructionUsername=.نام کاربری خود را وارد کنید و ما دستورالعمل هایی در مورد نحوه ایجاد رمز عبور جدید برای شما ارسال خواهیم کرد
+emailInstruction=نام کاربری یا آدرس ایمیل خود را وارد کنید و ما دستورالعمل هایی در مورد نحوه ایجاد گذرواژه جدید برای شما ارسال خواهیم کرد.
+emailInstructionUsername=نام کاربری خود را وارد کنید و ما دستورالعمل هایی در مورد نحوه ایجاد گذرواژه جدید برای شما ارسال خواهیم کرد.
 
-copyCodeInstruction=:لطفا این کد را کپی کرده و در برنامه خود قرار دهید
+copyCodeInstruction=لطفاً این کد را کپی کرده و در برنامه خود قرار دهید:
 
 pageExpiredTitle=صفحه منقضی شده است
 pageExpiredMsg1=برای راه اندازی مجدد فرآیند ورود
@@ -190,15 +190,15 @@ role_view-clients=مشاهده مشتری‌ها
 role_view-events=مشاهده رویداد
 role_view-identity-providers=مشاهده ارائه‌دهندگان هویت
 role_manage-realm=مدیریت قلمرو
-role_manage-users=میدیریت کاربران
+role_manage-users=مدیریت کاربران
 role_manage-applications=مدیریت اپلیکیشن‌ها
 role_manage-identity-providers=مدیریت ارائه‌دهندگان هویت
 role_manage-clients=مدیریت مشتریان
 role_manage-events=مدیریت رویدادها
 role_view-profile=مشاهده پروفایل
-role_manage-account=میدریت حساب
+role_manage-account=مدیریت حساب
 role_manage-account-links=مدیریت پیوندهای حساب
-role_read-token=خواندن Token
+role_read-token=خواندن توکن
 role_offline-access=دسترسی آفلاین
 client_account=حساب
 client_account-console=کنسول حساب
@@ -209,103 +209,103 @@ client_broker=دلال
 
 requiredFields=فیلدهای مورد نیاز
 
-invalidUserMessage=.نام کاربری یا رمز عبور نامعتبر است
-invalidUsernameMessage=.نام کاربری نامعتبر است
-invalidUsernameOrEmailMessage=.نام کاربری یا ایمیل نامعتبر است
-invalidPasswordMessage=رمز عبور نامعتبر
-invalidEmailMessage=.آدرس ایمیل نامعتبر است
-accountDisabledMessage=.حساب غیرفعال است، با سرپرست خود تماس بگیرید
-accountTemporarilyDisabledMessage=.نام کاربری یا رمز عبور نامعتبر است
-accountPermanentlyDisabledMessage=.نام کاربری یا رمز عبور نامعتبر است
-accountTemporarilyDisabledMessageTotp=.کد احراز هویت نامعتبر است
-accountPermanentlyDisabledMessageTotp=.کد احراز هویت نامعتبر است
-expiredCodeMessage=.اتمام مدت ورود. لطفاً دوباره وارد شوید
-expiredActionMessage=.اقدام منقضی شده است. لطفا همین الان با ورود به سیستم ادامه دهید
+invalidUserMessage=نام کاربری یا گذرواژه نامعتبر است.
+invalidUsernameMessage=نام کاربری نامعتبر است.
+invalidUsernameOrEmailMessage=نام کاربری یا ایمیل نامعتبر است.
+invalidPasswordMessage=گذرواژه نامعتبر است.
+invalidEmailMessage=آدرس ایمیل نامعتبر است.
+accountDisabledMessage=حساب غیرفعال است، با سرپرست خود تماس بگیرید.
+accountTemporarilyDisabledMessage=نام کاربری یا گذرواژه نامعتبر است.
+accountPermanentlyDisabledMessage=نام کاربری یا گذرواژه نامعتبر است.
+accountTemporarilyDisabledMessageTotp=کد احراز هویت نامعتبر است.
+accountPermanentlyDisabledMessageTotp=کد احراز هویت نامعتبر است.
+expiredCodeMessage=اتمام مدت ورود. لطفاً دوباره وارد شوید.
+expiredActionMessage=اقدام منقضی شده است. لطفاً همین الان با ورود به سیستم ادامه دهید.
 expiredActionTokenNoSessionMessage=اقدام منقضی شده است.
-expiredActionTokenSessionExistsMessage=.اقدام منقضی شده است. لطفا دوباره شروع کنید
+expiredActionTokenSessionExistsMessage=اقدام منقضی شده است. لطفاً دوباره شروع کنید.
 sessionLimitExceeded=تعداد جلسات بسیار زیاد است
 
-missingFirstNameMessage=لطفا نام را مشخص کنید
-missingLastNameMessage=لطفا نام خانوادگی را مشخص کنید
-missingEmailMessage=لطفا ایمیل را مشخص کنید
-missingUsernameMessage=لطفا نام کاربری را مشخص کنید
-missingPasswordMessage=لطفا رمز عبور را مشخص کنید
-missingTotpMessage=.لطفا کد احراز هویت را مشخص کنید
-missingTotpDeviceNameMessage=.لطفا نام دستگاه را مشخص کنید
-notMatchPasswordMessage=گذرواژه ها مطابقت ندارند
-
-error-invalid-value=.مقدار نامعتبر است
-error-invalid-blank=لطفا مقدار را مشخص کنید
-error-empty=لطفا مقدار را مشخص کنید
-error-invalid-length=.طول باید بین {1} و {2} باشد
-error-invalid-length-too-short=.حداقل طول {1} است
-error-invalid-length-too-long=.حداکثر طول {2} است
-error-invalid-email=.آدرس ایمیل نامعتبر است
-error-invalid-number=.عدد نامعتبر
-error-number-out-of-range=.شماره باید بین {1} و {2} باشد
-error-number-out-of-range-too-small=.عدد باید حداقل مقدار {1} را داشته باشد
-error-number-out-of-range-too-big=.عدد باید حداکثر مقدار {2} را داشته باشد
-error-pattern-no-match=.مقدار نامعتبر است
+missingFirstNameMessage=لطفاً نام را مشخص کنید.
+missingLastNameMessage=لطفاً نام خانوادگی را مشخص کنید.
+missingEmailMessage=لطفاً ایمیل را مشخص کنید.
+missingUsernameMessage=لطفاً نام کاربری را مشخص کنید.
+missingPasswordMessage=لطفاً گذرواژه را مشخص کنید.
+missingTotpMessage=لطفاً کد احراز هویت را مشخص کنید.
+missingTotpDeviceNameMessage=لطفاً نام دستگاه را مشخص کنید.
+notMatchPasswordMessage=گذرواژه ها مطابقت ندارند.
+
+error-invalid-value=مقدار نامعتبر است.
+error-invalid-blank=لطفاً مقدار را مشخص کنید.
+error-empty=لطفاً مقدار را مشخص کنید.
+error-invalid-length=طول باید بین {1} و {2} باشد.
+error-invalid-length-too-short=حداقل طول {1} است.
+error-invalid-length-too-long=حداکثر طول {2} است.
+error-invalid-email=آدرس ایمیل نامعتبر است.
+error-invalid-number=عدد نامعتبر.
+error-number-out-of-range=شماره باید بین {1} و {2} باشد.
+error-number-out-of-range-too-small=عدد باید حداقل مقدار {1} را داشته باشد.
+error-number-out-of-range-too-big=عدد باید حداکثر مقدار {2} را داشته باشد.
+error-pattern-no-match=مقدار نامعتبر است.
 error-invalid-uri=URL نامعتبر است.
 error-invalid-uri-scheme=طرح URL نامعتبر است.
 error-invalid-uri-fragment=قطعه URL نامعتبر است.
-error-user-attribute-required=.لطفا این فیلد را مشخص کنید
-error-invalid-date=.تاریخ نامعتبر است
-error-user-attribute-read-only=.این فیلد فقط خواندنی است
-error-username-invalid-character=.مقدار حاوی کاراکتر نامعتبر است
-error-person-name-invalid-character=.مقدار حاوی نویسه نامعتبر است
+error-user-attribute-required=لطفاً این فیلد را مشخص کنید.
+error-invalid-date=تاریخ نامعتبر است.
+error-user-attribute-read-only=این فیلد فقط خواندنی است.
+error-username-invalid-character=مقدار حاوی کاراکتر نامعتبر است.
+error-person-name-invalid-character=مقدار حاوی نویسه نامعتبر است.
 
-invalidPasswordExistingMessage=.رمز عبور موجود نامعتبر است
-invalidPasswordBlacklistedMessage=.رمز عبور نامعتبر: رمز عبور در لیست سیاه قرار گرفته است
-invalidPasswordConfirmMessage=.تأیید رمز عبور مطابقت ندارد
-invalidTotpMessage=.کد احراز هویت نامعتبر است
+invalidPasswordExistingMessage=گذرواژه موجود نامعتبر است.
+invalidPasswordBlacklistedMessage=گذرواژه نامعتبر: گذرواژه در لیست سیاه قرار گرفته است.
+invalidPasswordConfirmMessage=تأیید گذرواژه مطابقت ندارد.
+invalidTotpMessage=کد احراز هویت نامعتبر است.
 
-usernameExistsMessage=.نام کاربری از قبل وجود دارد
-emailExistsMessage=.ایمیل از قبل وجود دارد
+usernameExistsMessage=نام کاربری از قبل وجود دارد.
+emailExistsMessage=ایمیل از قبل وجود دارد.
 
-federatedIdentityExistsMessage=.کاربر با {0} {1} از قبل وجود دارد. لطفا برای پیوند دادن حساب به مدیریت حساب وارد شوید
-federatedIdentityUnavailableMessage=.کاربر {0} احراز هویت شده با ارائه دهنده هویت {1} وجود ندارد. لطفا با ادمین خود تماس بگیرید
+federatedIdentityExistsMessage=کاربر با {0} {1} از قبل وجود دارد. لطفاً برای پیوند دادن حساب به مدیریت حساب وارد شوید.
+federatedIdentityUnavailableMessage=کاربر {0} احراز هویت شده با ارائه دهنده هویت {1} وجود ندارد. لطفاً با ادمین خود تماس بگیرید.
 
 confirmLinkIdpTitle=حساب از قبل وجود دارد
 federatedIdentityConfirmLinkMessage=کاربر با {0} {1} از قبل وجود دارد. چگونه می خواهید ادامه دهید؟
 federatedIdentityConfirmReauthenticateMessage=برای پیوند دادن حساب خود با {0} احراز هویت
-nestedFirstBrokerFlowMessage=.کاربر {0} {1} به هیچ کاربر شناخته شده ای پیوند داده نشده است
+nestedFirstBrokerFlowMessage=کاربر {0} {1} به هیچ کاربر شناخته شده ای پیوند داده نشده است.
 confirmLinkIdpReviewProfile=بررسی نمایه
 confirmLinkIdpContinue=اضافه‌‌کردن به حساب موحود
 
-configureTotpMessage=.برای فعال کردن حساب خود باید اعتبارسنجی از طریق موبایل را راه اندازی کنید
-configureBackupCodesMessage=.برای فعال کردن حساب خود باید کدهای پشتیبان را تنظیم کنید
-updateProfileMessage=.برای فعال کردن حساب کاربری خود باید پروفایل کاربری خود را به روز کنید
-updatePasswordMessage=.برای فعال کردن حساب خود باید رمز عبور خود را تغییر دهید
-updateEmailMessage=.برای فعال کردن حساب خود باید آدرس ایمیل خود را به روز کنید
-resetPasswordMessage=.شما باید رمز عبور خود را تغییر دهید
-verifyEmailMessage=.برای فعال کردن حساب خود باید آدرس ایمیل خود را تأیید کنید
-linkIdpMessage=.برای پیوند دادن حساب خود با {0}، باید آدرس ایمیل خود را تأیید کنید
+configureTotpMessage=برای فعال کردن حساب خود باید اعتبارسنجی از طریق موبایل را راه اندازی کنید.
+configureBackupCodesMessage=برای فعال کردن حساب خود باید کدهای پشتیبان را تنظیم کنید.
+updateProfileMessage=برای فعال کردن حساب کاربری خود باید پروفایل کاربری خود را به روز کنید.
+updatePasswordMessage=برای فعال کردن حساب خود باید گذرواژه خود را تغییر دهید.
+updateEmailMessage=برای فعال کردن حساب خود باید آدرس ایمیل خود را به روز کنید.
+resetPasswordMessage=شما باید گذرواژه خود را تغییر دهید.
+verifyEmailMessage=برای فعال کردن حساب خود باید آدرس ایمیل خود را تأیید کنید.
+linkIdpMessage=برای پیوند دادن حساب خود با {0}، باید آدرس ایمیل خود را تأیید کنید.
 
-emailSentMessage=.شما باید به زودی یک ایمیل با دستورالعمل های بیشتر دریافت کنید
-emailSendErrorMessage=.ایمیل ارسال نشد، لطفاً بعداً دوباره امتحان کنید
+emailSentMessage=شما باید به زودی یک ایمیل با دستورالعمل های بیشتر دریافت کنید.
+emailSendErrorMessage=ایمیل ارسال نشد، لطفاً بعداً دوباره امتحان کنید.
 
-accountUpdatedMessage=.حساب شما به روز شده است
-accountPasswordUpdatedMessage=.رمز عبور شما به روز شده است
+accountUpdatedMessage=حساب شما به روز شده است.
+accountPasswordUpdatedMessage=گذرواژه شما به روز شده است.
 
 delegationCompleteHeader=ورود با موفقیت
-delegationCompleteMessage=.می توانید این پنجره مرورگر را ببندید و به برنامه کنسول خود بازگردید
+delegationCompleteMessage=می توانید این پنجره مرورگر را ببندید و به برنامه کنسول خود بازگردید.
 delegationFailedHeader=ورود ناموفق بود
-delegationFailedMessage=.می توانید این پنجره مرورگر را ببندید و به برنامه کنسول خود برگردید و دوباره سعی کنید وارد شوید
-
-noAccessMessage=بذون دسترسی
-
-invalidPasswordMinLengthMessage=.رمز عبور نامعتبر: حداقل طول {0}
-invalidPasswordMaxLengthMessage=.رمز عبور نامعتبر: حداکثر طول {0}
-invalidPasswordMinDigitsMessage=.رمز عبور نامعتبر: باید حداقل دارای {0} رقم عددی باشد
-invalidPasswordMinLowerCaseCharsMessage=.رمز عبور نامعتبر: باید حداقل دارای {0} نویسه کوچک باشد
-invalidPasswordMinUpperCaseCharsMessage=.رمز عبور نامعتبر: باید حداقل دارای {0} نویسه بزرگ باشد
-invalidPasswordMinSpecialCharsMessage=.رمز عبور نامعتبر: باید حداقل دارای {0} کاراکتر خاص باشد
-invalidPasswordNotUsernameMessage=.رمز عبور نامعتبر: نباید برابر با نام کاربری باشد
-invalidPasswordNotEmailMessage=.رمز عبور نامعتبر: نباید برابر با ایمیل باشد
-invalidPasswordRegexPatternMessage=رمز عبور نامعتبر: با الگو(های) regex مطابقت ندارد.
-invalidPasswordHistoryMessage=.گذرواژه نامعتبر: نباید با هیچ یک از رمزهای عبور اخیر {0} برابر باشد
-invalidPasswordGenericMessage=.رمز عبور نامعتبر: رمز عبور جدید با خط مشی های رمز عبور مطابقت ندارد
+delegationFailedMessage=می توانید این پنجره مرورگر را ببندید و به برنامه کنسول خود برگردید و دوباره سعی کنید وارد شوید.
+
+noAccessMessage=بدون دسترسی
+
+invalidPasswordMinLengthMessage=گذرواژه نامعتبر: حداقل طول {0}.
+invalidPasswordMaxLengthMessage=گذرواژه نامعتبر: حداکثر طول {0}.
+invalidPasswordMinDigitsMessage=گذرواژه نامعتبر: باید حداقل دارای {0} رقم عددی باشد.
+invalidPasswordMinLowerCaseCharsMessage=گذرواژه نامعتبر: باید حداقل دارای {0} نویسه کوچک باشد.
+invalidPasswordMinUpperCaseCharsMessage=گذرواژه نامعتبر: باید حداقل دارای {0} نویسه بزرگ باشد.
+invalidPasswordMinSpecialCharsMessage=گذرواژه نامعتبر: باید حداقل دارای {0} کاراکتر خاص باشد.
+invalidPasswordNotUsernameMessage=گذرواژه نامعتبر: نباید برابر با نام کاربری باشد.
+invalidPasswordNotEmailMessage=گذرواژه نامعتبر: نباید برابر با ایمیل باشد.
+invalidPasswordRegexPatternMessage=گذرواژه نامعتبر: با الگو(های) regex مطابقت ندارد.
+invalidPasswordHistoryMessage=گذرواژه نامعتبر: نباید با هیچ یک از رمزهای عبور اخیر {0} برابر باشد.
+invalidPasswordGenericMessage=گذرواژه نامعتبر: گذرواژه جدید با خط مشی های گذرواژه مطابقت ندارد.
 
 failedToProcessResponseMessage=پاسخ پردازش نشد
 httpsRequiredMessage=HTTPS مورد نیاز است
@@ -324,56 +324,56 @@ invalidRequesterMessage=درخواست کننده نامعتبر است
 registrationNotAllowedMessage=ثبت نام مجاز نیست
 resetCredentialNotAllowedMessage=بازنشانی اعتبار مجاز نیست
 
-permissionNotApprovedMessage=مجوز تایید نشد
-noRelayStateInResponseMessage=.هیچ حالت رله ای در پاسخ از ارائه دهنده هویت وجود ندارد
-insufficientPermissionMessage=.مجوزهای کافی برای پیوند دادن هویت ها وجود ندارد
-couldNotProceedWithAuthenticationRequestMessage=.نمی‌توان با درخواست احراز هویت به ارائه‌دهنده هویت ادامه داد
-couldNotObtainTokenMessage=.رمز از ارائه دهنده هویت دریافت نشد
-unexpectedErrorRetrievingTokenMessage=.خطای غیرمنتظره هنگام بازیابی رمز از ارائه دهنده هویت
-unexpectedErrorHandlingResponseMessage=.خطای غیرمنتظره هنگام رسیدگی به پاسخ ارائه‌دهنده هویت
-identityProviderAuthenticationFailedMessage=.احراز هویت ناموفق بود. با ارائه‌دهنده هویت احراز هویت امکان‌پذیر نیست
-couldNotSendAuthenticationRequestMessage=.درخواست احراز هویت به ارائه دهنده هویت ارسال نشد
-unexpectedErrorHandlingRequestMessage=.خطای غیرمنتظره هنگام رسیدگی به درخواست احراز هویت به ارائه‌دهنده هویت
-invalidAccessCodeMessage=.کد دسترسی نامعتبر
-sessionNotActiveMessage=نشست فعال نیست
-invalidCodeMessage=.خطایی رخ داده است، لطفاً دوباره از طریق برنامه خود وارد شوید
-cookieNotFoundMessage=.کوکی پیدا نشد لطفا مطمئن شوید که کوکی ها در مرورگر شما فعال هستند
-insufficientLevelOfAuthentication=.سطح درخواستی احراز هویت برآورده نشده است
+permissionNotApprovedMessage=مجوز تأیید نشد
+noRelayStateInResponseMessage=هیچ حالت رله ای در پاسخ از ارائه دهنده هویت وجود ندارد.
+insufficientPermissionMessage=مجوزهای کافی برای پیوند دادن هویت ها وجود ندارد.
+couldNotProceedWithAuthenticationRequestMessage=نمی‌توان با درخواست احراز هویت به ارائه‌دهنده هویت ادامه داد.
+couldNotObtainTokenMessage=رمز از ارائه دهنده هویت دریافت نشد.
+unexpectedErrorRetrievingTokenMessage=خطای غیرمنتظره هنگام بازیابی رمز از ارائه دهنده هویت.
+unexpectedErrorHandlingResponseMessage=خطای غیرمنتظره هنگام رسیدگی به پاسخ ارائه‌دهنده هویت.
+identityProviderAuthenticationFailedMessage=احراز هویت ناموفق بود. با ارائه‌دهنده هویت احراز هویت امکان‌پذیر نیست.
+couldNotSendAuthenticationRequestMessage=درخواست احراز هویت به ارائه دهنده هویت ارسال نشد.
+unexpectedErrorHandlingRequestMessage=خطای غیرمنتظره هنگام رسیدگی به درخواست احراز هویت به ارائه‌دهنده هویت.
+invalidAccessCodeMessage=کد دسترسی نامعتبر.
+sessionNotActiveMessage=نشست فعال نیست.
+invalidCodeMessage=خطایی رخ داده است، لطفاً دوباره از طریق برنامه خود وارد شوید.
+cookieNotFoundMessage=کوکی پیدا نشد لطفاً مطمئن شوید که کوکی ها در مرورگر شما فعال هستند.
+insufficientLevelOfAuthentication=سطح درخواستی احراز هویت برآورده نشده است.
 identityProviderUnexpectedErrorMessage=خطای غیرمنتظره هنگام احراز هویت با ارائه دهنده هویت
-identityProviderMissingStateMessage=.پارامتر حالت در پاسخ از ارائه دهنده هویت وجود ندارد
-identityProviderInvalidResponseMessage=.پاسخ نامعتبر از ارائه دهنده هویت
-identityProviderInvalidSignatureMessage=.امضای نامعتبر در پاسخ از ارائه دهنده هویت
-identityProviderNotFoundMessage=.ارائه دهنده هویت با شناسه یافت نشد
-identityProviderLinkSuccess=.شما با موفقیت ایمیل خود را تأیید کردید. لطفاً به مرورگر اصلی خود برگردید و در آنجا با ورود به سیستم ادامه دهید
+identityProviderMissingStateMessage=پارامتر حالت در پاسخ از ارائه دهنده هویت وجود ندارد.
+identityProviderInvalidResponseMessage=پاسخ نامعتبر از ارائه دهنده هویت.
+identityProviderInvalidSignatureMessage=امضای نامعتبر در پاسخ از ارائه دهنده هویت.
+identityProviderNotFoundMessage=ارائه دهنده هویت با شناسه یافت نشد.
+identityProviderLinkSuccess=شما با موفقیت ایمیل خود را تأیید کردید. لطفاً به مرورگر اصلی خود برگردید و در آنجا با ورود به سیستم ادامه دهید.
 staleCodeMessage=این صفحه دیگر معتبر نیست، لطفاً به برنامه خود برگردید و دوباره وارد شوید
-realmSupportsNoCredentialsMessage=.قلمرو از هیچ نوع اعتبارنامه ای پشتیبانی نمی کند
-credentialSetupRequired=.نمی توان به سیستم وارد شد، راه اندازی اعتبارنامه لازم است
-identityProviderNotUniqueMessage=.قلمرو از چندین ارائه دهنده هویت پشتیبانی می کند. نمی توان تعیین کرد که با کدام ارائه دهنده هویت باید برای احراز هویت استفاده شود
-emailVerifiedMessage=.آدرس ایمیل شما تایید شده است
-staleEmailVerificationLink=.پیوندی که روی آن کلیک کردید یک پیوند قدیمی است و دیگر معتبر نیست. شاید قبلا ایمیل خود را تایید کرده باشید
-identityProviderAlreadyLinkedMessage=.هویت فدرال بازگردانده شده توسط {0} قبلاً به کاربر دیگری پیوند داده شده است
-confirmAccountLinking=.پیوند حساب {0} ارائه دهنده هویت {1} را با حساب خود تأیید کنید
-confirmEmailAddressVerification=.اعتبار آدرس ایمیل {0} را تأیید کنید
+realmSupportsNoCredentialsMessage=قلمرو از هیچ نوع اعتبارنامه ای پشتیبانی نمی کند.
+credentialSetupRequired=نمی توان به سیستم وارد شد، راه اندازی اعتبارنامه لازم است.
+identityProviderNotUniqueMessage=قلمرو از چندین ارائه دهنده هویت پشتیبانی می کند. نمی توان تعیین کرد که با کدام ارائه دهنده هویت باید برای احراز هویت استفاده شود.
+emailVerifiedMessage=آدرس ایمیل شما تأیید شده است.
+staleEmailVerificationLink=پیوندی که روی آن کلیک کردید یک پیوند قدیمی است و دیگر معتبر نیست. شاید قبلا ایمیل خود را تأیید کرده باشید.
+identityProviderAlreadyLinkedMessage=هویت فدرال بازگردانده شده توسط {0} قبلاً به کاربر دیگری پیوند داده شده است.
+confirmAccountLinking=پیوند حساب {0} ارائه دهنده هویت {1} را با حساب خود تأیید کنید.
+confirmEmailAddressVerification=اعتبار آدرس ایمیل {0} را تأیید کنید.
 confirmExecutionOfActions=عمل(های) زیر را انجام دهید
 
 backToApplication=&laquo; بازگشت به برنامه
 missingParameterMessage=پارامترهای از دست رفته\: {0}
-clientNotFoundMessage=مشتری یافت نشد
-clientDisabledMessage=.مشتری غیرفعال است
+clientNotFoundMessage=مشتری یافت نشد.
+clientDisabledMessage=مشتری غیرفعال است.
 invalidParameterMessage=پارامتر نامعتبر\: {0}
-alreadyLoggedIn=.شما پیشتر وارد شدهاید - لاگین کرده اید
-differentUserAuthenticated=.شما قبلاً به عنوان کاربر دیگری ''{0}'' در این جلسه احراز هویت شده اید. لطفا ابتدا از سیستم خارج شوید
-brokerLinkingSessionExpired=.درخواست پیوند حساب کارگزاری داده است، اما جلسه فعلی دیگر معتبر نیست
+alreadyLoggedIn=شما پیشتر وارد شدهاید - لاگین کرده اید.
+differentUserAuthenticated=شما قبلاً به عنوان کاربر دیگری ''{0}'' در این جلسه احراز هویت شده اید. لطفاً ابتدا از سیستم خارج شوید.
+brokerLinkingSessionExpired=درخواست پیوند حساب کارگزاری داده است، اما جلسه فعلی دیگر معتبر نیست.
 proceedWithAction=&raquo; برای ادامه اینجا را کلیک کنید
 acrNotFulfilled=الزامات احراز هویت برآورده نشده است
 
 requiredAction.CONFIGURE_TOTP=OTP را تنظیم کنید
 requiredAction.TERMS_AND_CONDITIONS=شرایط و ضوابط
-requiredAction.UPDATE_PASSWORD=رمز عبور را به روز کنید
+requiredAction.UPDATE_PASSWORD=گذرواژه را به روز کنید
 requiredAction.UPDATE_PROFILE=بروزرسانی پروفایل
 requiredAction.VERIFY_EMAIL=تأیید ایمیل
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=کدهای بازیابی را ایجاد کنید
-requiredAction.webauthn-register-passwordless=Webauthn ثبت نام بدون رمز عبور
+requiredAction.webauthn-register-passwordless=Webauthn ثبت نام بدون گذرواژه
 
 invalidTokenRequiredActions=اقدامات لازم موجود در پیوند معتبر نیستند
 
@@ -385,14 +385,14 @@ noCertificate=[بدون گواهی]
 pageNotFound=صفحه یافت نشد
 internalServerError=یک خطای سرور داخلی رخ داده است
 
-console-username=:نام کاربری
-console-password=:رمز عبور
-console-otp=:رمز عبور یکبار مصرف
-console-new-password=:رمز عبور جدید
-console-confirm-password=:تایید رمز عبور
-console-update-password=.به روز رسانی رمز عبور شما الزامی است
-console-verify-email=.شما باید آدرس ایمیل خود را تأیید کنید. ما یک ایمیل به {0} ارسال کردیم که حاوی کد تأیید است. لطفا این کد را در ورودی زیر وارد کنید
-console-email-code=:کد ایمیل
+console-username=نام کاربری:
+console-password=گذرواژه:
+console-otp=گذرواژه یکبار مصرف:
+console-new-password=گذرواژه جدید:
+console-confirm-password=تأیید گذرواژه:
+console-update-password=به روز رسانی گذرواژه شما الزامی است:
+console-verify-email=شما باید آدرس ایمیل خود را تأیید کنید. ما یک ایمیل به {0} ارسال کردیم که حاوی کد تأیید است. لطفاً این کد را در ورودی زیر وارد کنید:
+console-email-code=کد ایمیل:
 console-accept-terms=شرایط را می‌پذیرید؟ [y/n]:
 console-accept=y
 
@@ -404,30 +404,30 @@ openshift.scope.list-projects=لیست پروژه ها
 
 # SAML authentication
 saml.post-form.title=تغییر مسیر احراز هویت
-saml.post-form.message=.در حال تغییر مسیر، لطفا صبر کنید
-saml.post-form.js-disabled=.جاوا اسکریپت غیرفعال است. ما قویاً توصیه می کنیم آن را فعال کنید. برای ادامه روی دکمه زیر کلیک کنید
-saml.artifactResolutionServiceInvalidResponse=.قادر به حل مصنوع نیست
+saml.post-form.message=در حال تغییر مسیر، لطفاً صبر کنید.
+saml.post-form.js-disabled=جاوا اسکریپت غیرفعال است. ما قویاً توصیه می کنیم آن را فعال کنید. برای ادامه روی دکمه زیر کلیک کنید.
+saml.artifactResolutionServiceInvalidResponse=قادر به حل مصنوع نیست.
 
 #authenticators
 otp-display-name=برنامه Authenticator
-otp-help-text=.یک کد تأیید را از برنامه احراز هویت وارد کنید
-password-display-name=رمز عبور
-password-help-text=.با وارد کردن رمز عبور خود وارد شوید
+otp-help-text=یک کد تأیید را از برنامه احراز هویت وارد کنید.
+password-display-name=گذرواژه
+password-help-text=با وارد کردن گذرواژه خود وارد شوید.
 auth-username-form-display-name=نام کاربری
 auth-username-form-help-text=با وارد کردن نام کاربری خود وارد سیستم شوید
-auth-username-password-form-display-name=نام کاربری و رمز عبور
-auth-username-password-form-help-text=.با وارد کردن نام کاربری و رمز عبور خود وارد شوید
+auth-username-password-form-display-name=نام کاربری و گذرواژه
+auth-username-password-form-help-text=با وارد کردن نام کاربری و گذرواژه خود وارد شوید.
 
 # Recovery Codes
 auth-recovery-authn-code-form-display-name=کد احراز هویت بازیابی
-auth-recovery-authn-code-form-help-text=.یک کد احراز هویت بازیابی را از لیستی که قبلا ایجاد شده است وارد کنید
-auth-recovery-code-info-message=.کد بازیابی مشخص شده را وارد کنید
+auth-recovery-authn-code-form-help-text=یک کد احراز هویت بازیابی را از لیستی که قبلا ایجاد شده است وارد کنید.
+auth-recovery-code-info-message=کد بازیابی مشخص شده را وارد کنید.
 auth-recovery-code-prompt=کد بازیابی #{0}
 auth-recovery-code-header=با یک کد احراز هویت بازیابی وارد شوید
 recovery-codes-error-invalid=کد احراز هویت بازیابی نامعتبر است
 recovery-code-config-header=کدهای احراز هویت بازیابی
 recovery-code-config-warning-title=این کدهای بازیابی پس از خروج از این صفحه دیگر ظاهر نمی شوند
-recovery-code-config-warning-message=.مطمئن شوید که آنها را چاپ، دانلود یا در یک مدیر رمز عبور کپی کنید و ذخیره کنید. لغو این تنظیم، این کدهای بازیابی را از حساب شما حذف می کند
+recovery-code-config-warning-message=مطمئن شوید که آنها را چاپ، دانلود یا در یک مدیر گذرواژه کپی کنید و ذخیره کنید. لغو این تنظیم، این کدهای بازیابی را از حساب شما حذف می کند.
 recovery-codes-print=چاپ
 recovery-codes-download=دانلود
 recovery-codes-copy=کپی
@@ -435,16 +435,16 @@ recovery-codes-copied=کپی شد
 recovery-codes-confirmation-message=من این کدها را در جایی امن ذخیره کرده ام
 recovery-codes-action-complete=راه اندازی کامل
 recovery-codes-action-cancel=لغو راه اندازی
-recovery-codes-download-file-header=.این کدهای بازیابی را در جایی امن نگه دارید
-recovery-codes-download-file-description=.کدهای بازیابی گذرواژه های یکبار مصرف هستند که به شما امکان می دهند در صورت عدم دسترسی به احراز هویت خود وارد حساب کاربری خود شوید
+recovery-codes-download-file-header=این کدهای بازیابی را در جایی امن نگه دارید.
+recovery-codes-download-file-description=کدهای بازیابی گذرواژه های یکبار مصرف هستند که به شما امکان می دهند در صورت عدم دسترسی به احراز هویت خود وارد حساب کاربری خود شوید.
 recovery-codes-download-file-date= این کدها در تاریخ تولید شدند
 recovery-codes-label-default=کدهای بازیابی
 
 # WebAuthn
 webauthn-display-name=کلید امنیتی
-webauthn-help-text=.برای ورود به سیستم از کلید امنیتی خود استفاده کنید
+webauthn-help-text=برای ورود به سیستم از کلید امنیتی خود استفاده کنید.
 webauthn-passwordless-display-name=کلید امنیتی
-webauthn-passwordless-help-text=.از کلید امنیتی خود برای ورود بدون رمز عبور استفاده کنید
+webauthn-passwordless-help-text=از کلید امنیتی خود برای ورود بدون گذرواژه استفاده کنید.
 webauthn-login-title=ورود به سیستم کلید امنیتی
 webauthn-registration-title=ثبت کلید امنیتی
 webauthn-available-authenticators=کلیدهای امنیتی موجود
@@ -454,26 +454,26 @@ webauthn-createdAt-label=ایجاد شده در
 
 # WebAuthn Error
 webauthn-error-title=خطای کلید امنیتی
-webauthn-error-registration=کلید امنیتی شما ثبت نشد.<br/> {0}
-webauthn-error-api-get=با کلید امنیتی احراز هویت انجام نشد.<br/> {0}
-webauthn-error-different-user=.اولین کاربر احراز هویت شده کسی نیست که توسط کلید امنیتی احراز هویت شده است
-webauthn-error-auth-verification=نتیجه احراز هویت کلید امنیتی نامعتبر است.<br/> {0}
-webauthn-error-register-verification=نتیجه ثبت کلید امنیتی نامعتبر است.<br/> {0}
-webauthn-error-user-not-found=.کاربر ناشناس با کلید امنیتی احراز هویت شده است
+webauthn-error-registration=کلید امنیتی شما ثبت نشد.<br /> {0}
+webauthn-error-api-get=با کلید امنیتی احراز هویت انجام نشد.<br /> {0}
+webauthn-error-different-user=اولین کاربر احراز هویت شده کسی نیست که توسط کلید امنیتی احراز هویت شده است.
+webauthn-error-auth-verification=نتیجه احراز هویت کلید امنیتی نامعتبر است.<br /> {0}
+webauthn-error-register-verification=نتیجه ثبت کلید امنیتی نامعتبر است.<br /> {0}
+webauthn-error-user-not-found=کاربر ناشناس با کلید امنیتی احراز هویت شده است.
 
 # Identity provider
 identity-provider-redirector=با یک ارائه‌دهنده هویت دیگر ارتباط برقرار کنید
 identity-provider-login-label=یا ورود با
-idp-email-verification-display-name=تایید ایمیل
-idp-email-verification-help-text=.حساب خود را با اعتبارسنجی ایمیل خود پیوند دهید
-idp-username-password-form-display-name=نام کاربری و رمز عبور
-idp-username-password-form-help-text=.با ورود حساب کاربری خود را پیوند دهید
+idp-email-verification-display-name=تأیید ایمیل
+idp-email-verification-help-text=حساب خود را با اعتبارسنجی ایمیل خود پیوند دهید.
+idp-username-password-form-display-name=نام کاربری و گذرواژه
+idp-username-password-form-help-text=با ورود حساب کاربری خود را پیوند دهید.
 
-finalDeletionConfirmation=.اگر حساب خود را حذف کنید، قابل بازیابی نیست. برای حفظ حساب خود، روی لغو کلیک کنید
+finalDeletionConfirmation=اگر حساب خود را حذف کنید، قابل بازیابی نیست. برای حفظ حساب خود، روی لغو کلیک کنید.
 irreversibleAction=این عمل برگشت ناپذیر است
-deleteAccountConfirm=تایید حذف حساب
+deleteAccountConfirm=تأیید حذف حساب
 
-deletingImplies=:حذف حساب به این معنی است
+deletingImplies=حذف حساب به این معنی است:
 errasingData=پاک کردن تمام داده های شما
 loggingOutImmediately=خروج بلافاصله شما
 accountUnusable=هر گونه استفاده بعدی از برنامه با این حساب امکان پذیر نخواهد بود
@@ -488,4 +488,4 @@ logoutConfirmTitle=خروج
 logoutConfirmHeader=آیا می خواهید از سیستم خارج شوید؟
 doLogout=خروج
 
-readOnlyUsernameMessage=.شما نمی توانید نام کاربری خود را به روز کنید زیرا فقط خواندنی است
+readOnlyUsernameMessage=شما نمی توانید نام کاربری خود را به روز کنید زیرا فقط خواندنی است.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_fi.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_fi.properties
index 7fce2003e567..ff18d303344a 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_fi.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_fi.properties
@@ -397,11 +397,11 @@ webauthn-doAuthenticate=Kirjaudu sisään Turva-avaimella
 
 # WebAuthn Error
 webauthn-error-title=Turva-avain virhe
-webauthn-error-registration=Turva-avaimen rekisteröinti epäonnistui.<br/> {0}
-webauthn-error-api-get=Tunnistautuminen Turva-avaimella epäonnistui.<br/> {0}
+webauthn-error-registration=Turva-avaimen rekisteröinti epäonnistui.<br /> {0}
+webauthn-error-api-get=Tunnistautuminen Turva-avaimella epäonnistui.<br /> {0}
 webauthn-error-different-user=Ensiksi tunnistautunut käyttäjä ei ole sama kuin Turva-avaimella tunnistaunut.
-webauthn-error-auth-verification=Turva-avain -tunnistautumisen tulos on virheellinen.<br/> {0}
-webauthn-error-register-verification=Turva-avaimen rekisteröinnin tulos on virheellinen.<br/> {0}
+webauthn-error-auth-verification=Turva-avain -tunnistautumisen tulos on virheellinen.<br /> {0}
+webauthn-error-register-verification=Turva-avaimen rekisteröinnin tulos on virheellinen.<br /> {0}
 webauthn-error-user-not-found=Tuntematon käyttäjä tunnistautui Turva-avaimella.
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_fr.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_fr.properties
index 47d9d21e0685..aefb2f108138 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_fr.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_fr.properties
@@ -12,7 +12,7 @@ doAccept=Accepter
 doDecline=Décliner
 doForgotPassword=Mot de passe oublié ?
 doClickHere=Cliquez ici
-doImpersonate=Usurper l''identité
+doImpersonate=Emprunter l''identité
 doTryAgain=Réessayer
 doTryAnotherWay=Essayer une autre méthode
 doConfirmDelete=Confirmer la suppression
@@ -20,7 +20,7 @@ errorDeletingAccount=Erreur lors de la suppression du compte
 deletingAccountForbidden=Permissions insuffisantes pour supprimer votre propre compte, contactez un administrateur.
 kerberosNotConfigured=Kerberos non configuré
 kerberosNotConfiguredTitle=Kerberos non configuré
-bypassKerberosDetail=Si vous n''êtes pas connecté via Kerberos ou bien que votre navigateur n''est pas configuré pour la connexion via Kerberos.  Veuillez cliquer pour vous connecter via un autre moyen.
+bypassKerberosDetail=Si vous n''êtes pas connecté via Kerberos ou bien que votre navigateur n''est pas configuré pour la connexion via Kerberos. Veuillez cliquer pour vous connecter via un autre moyen
 kerberosNotSetUp=Kerberos n''est pas configuré. Connexion impossible.
 registerTitle=S''enregistrer
 loginAccountTitle=Connectez-vous à votre compte
@@ -47,7 +47,7 @@ emailForgotTitle=Mot de passe oublié ?
 updateEmailTitle=Mise à jour du courriel
 emailUpdateConfirmationSentTitle=Courriel de confirmation envoyé
 emailUpdateConfirmationSent=Un courriel de confirmation a été envoyé à {0}. Vous devez suivre les instructions de ce dernier afin de compléter la mise à jour.
-emailUpdatedTitle=Adresse courriel mis à jour
+emailUpdatedTitle=Adresse courriel mise à jour
 emailUpdated=La mise à jour de votre adresse courriel vers {0} a été complétée avec succès.
 updatePasswordTitle=Mise à jour du mot de passe
 codeSuccessTitle=Code succès
@@ -55,11 +55,11 @@ codeErrorTitle=Code d''erreur \: {0}
 displayUnsupported=Type d''affichage demandé non supporté
 browserRequired=Navigateur requis pour se connecter
 browserContinue=Navigateur requis pour continuer la connexion
-browserContinuePrompt=Ouvrir le navigateur et continuer la connexion? [y/n]:
+browserContinuePrompt=Ouvrir le navigateur et continuer la connexion ? [y/n] :
 browserContinueAnswer=y
 termsTitle=Termes et Conditions
 termsText=<p>Termes et conditions à définir</p>
-termsPlainText=Termes et conditions à définir
+termsPlainText=Termes et conditions à définir.
 termsAcceptanceRequired=Vous devez accepter les termes et conditions.
 acceptTerms=J''accepte les termes et conditions
 recaptchaFailed=Re-captcha invalide
@@ -104,14 +104,14 @@ samlRoleListScopeConsentText=Mes rôles
 rolesScopeConsentText=Rôles utilisateur
 restartLoginTooltip=Redémarrer la connexion
 loginTotpIntro=Il est nécessaire de configurer un générateur One Time Password pour accéder à ce compte
-loginTotpStep1=Installez une des applications suivantes sur votre mobile:
-loginTotpStep2=Ouvrez l''application et scannez le code-barres ou entrez la clef.
+loginTotpStep1=Installez une des applications suivantes sur votre mobile :
+loginTotpStep2=Ouvrez l''application et scannez le code-barres :
 loginTotpStep3=Entrez le code à usage unique fourni par l''application et cliquez sur Sauvegarder pour terminer.
-loginTotpStep3DeviceName=Renseignez un nom d''appareil pour vous aider à gérer vos a appareils OTP.
-loginTotpManualStep2=Ouvrez l''application et saisissez la clé
-loginTotpManualStep3=Utilisez la configuration de valeur suivante si l''application permet son édition
-loginTotpUnableToScan=Impossible de scanner?
-loginTotpScanBarcode=Scanner le code barre ?
+loginTotpStep3DeviceName=Renseignez un nom d''appareil pour vous aider à gérer vos appareils OTP.
+loginTotpManualStep2=Ouvrez l''application et saisissez la clé :
+loginTotpManualStep3=Utilisez la configuration de valeur suivante si l''application permet son édition :
+loginTotpUnableToScan=Impossible de scanner ?
+loginTotpScanBarcode=Scanner le code-barres ?
 loginCredential=Accréditation
 loginOtpOneTime=Code à usage unique
 loginTotpType=Type
@@ -126,7 +126,7 @@ loginChooseAuthenticator=Sélectionnez une méthode de connexion
 oauthGrantRequest=Voulez-vous accorder ces privilèges d''accès ?
 inResource=dans
 oauth2DeviceVerificationTitle=Connexion de l''appareil
-verifyOAuth2DeviceUserCode=Entrez le code à usage unique fourni par votre appareil et cliquez sur Soumettre.
+verifyOAuth2DeviceUserCode=Entrez le code à usage unique fourni par votre appareil et cliquez sur Soumettre
 oauth2DeviceInvalidUserCodeMessage=Code invalide, veuillez réessayer.
 oauth2DeviceExpiredUserCodeMessage=Le code a expiré. Veuillez réessayer de vous connecter depuis votre appareil.
 oauth2DeviceVerificationCompleteHeader=Connexion de l''appareil réussie
@@ -147,7 +147,7 @@ emailLinkIdp5=pour continuer.
 backToLogin=&laquo; Retour à la connexion
 emailInstruction=Entrez votre nom d''utilisateur ou votre courriel ; un courriel va vous être envoyé vous permettant de créer un nouveau mot de passe.
 emailInstructionUsername=Entrez votre nom d''utilisateur ; un courriel va vous être envoyé vous permettant de créer un nouveau mot de passe.
-copyCodeInstruction=Copiez le code et recopiez le dans votre application :
+copyCodeInstruction=Copiez le code et recopiez-le dans votre application :
 pageExpiredTitle=La page a expiré
 pageExpiredMsg1=Pour recommencer le processus d''authentification
 pageExpiredMsg2=Pour continuer le processus d''authentification
@@ -238,7 +238,7 @@ confirmLinkIdpContinue=Souhaitez-vous lier {0} à votre compte existant
 configureTotpMessage=Vous devez configurer l''authentification par mobile pour activer votre compte.
 updateProfileMessage=Vous devez mettre à jour votre profil pour activer votre compte.
 updatePasswordMessage=Vous devez changer votre mot de passe pour activer votre compte.
-updateEmailMessage=Vous devez mettre à votre addresse de courriel pour activer votre compte.
+updateEmailMessage=Vous devez mettre à jour votre adresse de courriel pour activer votre compte.
 resetPasswordMessage=Vous devez changer votre mot de passe.
 verifyEmailMessage=Vous devez vérifier votre courriel pour activer votre compte.
 linkIdpMessage=Vous devez vérifier votre courriel pour lier votre compte avec {0}.
@@ -258,7 +258,7 @@ invalidPasswordMinLowerCaseCharsMessage=Mot de passe invalide : doit contenir au
 invalidPasswordMinUpperCaseCharsMessage=Mot de passe invalide : doit contenir au moins {0} lettre(s) en majuscule.
 invalidPasswordMinSpecialCharsMessage=Mot de passe invalide : doit contenir au moins {0} caractère(s) spéciaux.
 invalidPasswordNotUsernameMessage=Mot de passe invalide : ne doit pas être identique au nom d''utilisateur.
-invalidPasswordNotEmailMessage=Mot de passe invalide: ne doit pas être identique au courriel.
+invalidPasswordNotEmailMessage=Mot de passe invalide : ne doit pas être identique au courriel.
 invalidPasswordRegexPatternMessage=Mot de passe invalide : ne valide pas l''expression rationnelle.
 invalidPasswordHistoryMessage=Mot de passe invalide : ne doit pas être égal aux {0} derniers mots de passe.
 invalidPasswordGenericMessage=Mot de passe invalide : le nouveau mot de passe ne répond pas à la politique de mot de passe.
@@ -267,10 +267,10 @@ httpsRequiredMessage=Le protocole HTTPS est requis
 realmNotEnabledMessage=Le domaine n''est pas activé
 invalidRequestMessage=Requête invalide
 successLogout=Vous êtes déconnecté
-failedLogout=La déconnexion a échouée
+failedLogout=La déconnexion a échoué
 unknownLoginRequesterMessage=Compte inconnu du demandeur
 loginRequesterNotEnabledMessage=La connexion du demandeur n''est pas active
-bearerOnlyMessage=Les applications Bearer-only ne sont pas autorisées à initier la connexion par navigateur.
+bearerOnlyMessage=Les applications Bearer-only ne sont pas autorisées à initier la connexion par navigateur
 standardFlowDisabledMessage=Le client n''est pas autorisé à initier une connexion avec le navigateur avec ce response_type. Le flux standard est désactivé pour le client.
 implicitFlowDisabledMessage=Le client n''est pas autorisé à initier une connexion avec le navigateur avec ce response_type. Le flux implicite est désactivé pour le client.
 invalidRedirectUriMessage=L''URI de redirection est invalide
@@ -285,23 +285,23 @@ couldNotProceedWithAuthenticationRequestMessage=Impossible de continuer avec la
 couldNotObtainTokenMessage=Impossible de récupérer le jeton du fournisseur d''identité.
 unexpectedErrorRetrievingTokenMessage=Erreur inattendue lors de la récupération du jeton provenant du fournisseur d''identité.
 unexpectedErrorHandlingResponseMessage=Erreur inattendue lors du traitement de la réponse provenant du fournisseur d''identité.
-identityProviderAuthenticationFailedMessage=L''authentification a échouée. Impossible de s''authentifier avec le fournisseur d''identité.
+identityProviderAuthenticationFailedMessage=L''authentification a échoué. Impossible de s''authentifier avec le fournisseur d''identité.
 couldNotSendAuthenticationRequestMessage=Impossible d''envoyer la requête d''authentification vers le fournisseur d''identité.
 unexpectedErrorHandlingRequestMessage=Erreur inattendue lors du traitement de la requête vers le fournisseur d''identité.
 invalidAccessCodeMessage=Code d''accès invalide.
 sessionNotActiveMessage=La session n''est pas active.
 invalidCodeMessage=Une erreur est survenue, veuillez vous reconnecter à votre application.
 cookieNotFoundMessage=Cookie introuvable. Assurez-vous que les cookies soient activés dans votre navigateur.
-identityProviderUnexpectedErrorMessage=Erreur inattendue lors de l''authentification avec fournisseur d''identité.
+identityProviderUnexpectedErrorMessage=Erreur inattendue lors de l''authentification avec le fournisseur d''identité
 identityProviderMissingStateMessage=Paramètre d''état manquant dans la réponse du fournisseur d''identité.
 identityProviderNotFoundMessage=Impossible de trouver le fournisseur d''identité avec cet identifiant.
 identityProviderLinkSuccess=Votre compte a été correctement lié avec {0} compte {1} .
-staleCodeMessage=Cette page n''est plus valide, merci de retourner à votre application et de vous connecter à nouveau.
+staleCodeMessage=Cette page n''est plus valide, merci de retourner dans votre application et de vous reconnecter
 realmSupportsNoCredentialsMessage=Ce domaine ne supporte aucun type d''accréditation.
 credentialSetupRequired=Connexion impossible, configuration d''accréditation requise.
 identityProviderNotUniqueMessage=Ce domaine autorise plusieurs fournisseurs d''identité. Impossible de déterminer le fournisseur d''identité avec lequel s''authentifier.
 emailVerifiedMessage=Votre courriel a été vérifié.
-staleEmailVerificationLink=Le lien que vous avez cliqué est périmé et n''est plus valide. Peut-être avez vous déjà vérifié votre mot de passe ?
+staleEmailVerificationLink=Le lien que vous avez cliqué est périmé et n''est plus valide. Peut-être, vous avez déjà vérifié votre mot de passe.
 identityProviderAlreadyLinkedMessage=L''identité fédérée retournée par {0} est déjà liée à un autre utilisateur.
 confirmAccountLinking=Confirmez la liaison du compte {0} du fournisseur d''entité {1} avec votre compte.
 confirmEmailAddressVerification=Confirmez la validité de l''adresse courriel {0}.
@@ -326,8 +326,8 @@ requiredAction.UPDATE_PROFILE=Mettre à jour votre profil
 requiredAction.VERIFY_EMAIL=Valider votre adresse email
 
 
-doX509Login=Vous allez être connecté en tant que\:
-clientCertificate=X509 certificat client\:
+doX509Login=Vous allez être connecté en tant que  :
+clientCertificate=Certificat client X509 :
 noCertificate=[Pas de certificat]
 
 
@@ -341,22 +341,22 @@ idp-email-verification-display-name=Vérification du courriel
 idp-email-verification-help-text=Lier votre compte en validant votre courriel.
 idp-username-password-form-display-name=Nom d''utilisateur et mot de passe
 idp-username-password-form-help-text=Lier votre compte en vous connectant.
-console-username=Nom d''utilisateur:
-console-password=Mot de passe:
-console-otp=Code à usage unique:
-console-new-password=Nouveau mot de passe:
-console-confirm-password=Confirmez les mot de passe:
+console-username=Nom d''utilisateur :
+console-password=Mot de passe :
+console-otp=Code à usage unique :
+console-new-password=Nouveau mot de passe :
+console-confirm-password=Confirmez le mot de passe :
 console-update-password=La mise à jour de votre mot de passe est requise.
 console-verify-email=Vous devez vérifier votre adresse courriel. Nous avons envoyé un courriel à {0} contenant un code de vérification. Veuillez saisir ce code ci-dessous.
-console-email-code=Code courriel:
-console-accept-terms=Accepter les conditions? [o/n]:
+console-email-code=Code courriel :
+console-accept-terms=Accepter les conditions ? [o/n] :
 console-accept=o
 
 #authenticators
 password-display-name=Mot de passe
 password-help-text=Connectez-vous en saisissant votre mot de passe.
 auth-username-form-display-name=Nom d''utilisateur
-auth-username-form-help-text=Commencez la connexion en saisissant votre nom d''utilisateur.
+auth-username-form-help-text=Commencez la connexion en saisissant votre nom d''utilisateur
 auth-username-password-form-display-name=Nom d''utilisateur et mot de passe
 auth-username-password-form-help-text=Connectez-vous en saisissant votre nom d''utilisateur et votre mot de passe.
 
@@ -374,16 +374,16 @@ webauthn-createdAt-label=Créé le
 
 # WebAuthn Error
 webauthn-error-title=Erreur lors de l''utilisation de la Clé de Sécurité
-webauthn-error-registration=L''enregistrement de la Clé de Sécurité a échoué.<br/> {0}
-webauthn-error-api-get=L''authentification via la Clé de Sécurité a échoué.<br/> {0}
+webauthn-error-registration=L''enregistrement de la Clé de Sécurité a échoué.<br /> {0}
+webauthn-error-api-get=L''authentification via la Clé de Sécurité a échoué.<br /> {0}
 webauthn-error-different-user=Le premier utilisateur authentifié ne correspond pas à celui qui est authentifié par la Clé de Sécurité.
-webauthn-error-auth-verification=Le résultat de l''authentification produite par la clé de sécurité est invalide.<br/> {0}
-webauthn-error-register-verification=Le résultat de l''enregistrement de la clé de sécurité est invalide.<br/> {0}
+webauthn-error-auth-verification=Le résultat de l''authentification produite par la clé de sécurité est invalide.<br /> {0}
+webauthn-error-register-verification=Le résultat de l''enregistrement de la clé de sécurité est invalide.<br /> {0}
 webauthn-error-user-not-found=La Clé de Sécurité a authentifié un utilisateur inconnu.
 finalDeletionConfirmation=Si vous supprimez votre compte, il ne pourra pas être restauré. Pour conserver votre compte, cliquez sur Annuler.
 irreversibleAction=Cette action est irréversible
 deleteAccountConfirm=Confirmation de suppression de compte
-deletingImplies=Supprimer votre compte implique:
+deletingImplies=Supprimer votre compte implique :
 errasingData=Supprimer toutes vos données
 loggingOutImmediately=Vous déconnecter immédiatement
 accountUnusable=Toute utilisation future de l''application sera impossible avec ce compte
@@ -396,14 +396,14 @@ logoutConfirmHeader=Êtes-vous sûr de vouloir vous déconnecter ?
 doLogout=Se déconnecter
 authenticateStrong=Une authentification forte est nécessaire pour continuer
 bluetooth=Bluetooth
-identityProviderLogoutFailure=Échec de la déconnexion du fournisseur d'identité SAML
-federatedIdentityUnavailableMessage=L'utilisateur {0} authentifié depuis le fournisseur d'identité {1} n'existe pas. Veuillez contacter votre administrateur.
+identityProviderLogoutFailure=Échec de la déconnexion du fournisseur d''identité SAML
+federatedIdentityUnavailableMessage=L''utilisateur {0} authentifié depuis le fournisseur d''identité {1} n''existe pas. Veuillez contacter votre administrateur.
 emailVerifiedAlreadyMessage=Votre courriel a déjà été vérifié.
-openshift.scope.user_check-access=Information sur les accès de l'utilisateur
+openshift.scope.user_check-access=Information sur les accès de l''utilisateur
 openshift.scope.user_full=Accès complet
-otp-help-text=Renseignez le code de vérification affiché par votre application d'authentification.
-readOnlyUsernameMessage=Vous ne pouvez pas mettre à jour votre nom d'utilisateur, il est en lecture seule.
-organization.confirm-membership.title=Vous allez rejoindre l'organisation ${kc.org.name}
+otp-help-text=Renseignez le code de vérification affiché par votre application d''authentification.
+readOnlyUsernameMessage=Vous ne pouvez pas mettre à jour votre nom d''utilisateur, il est en lecture seule.
+organization.confirm-membership.title=Vous allez rejoindre l''organisation ${kc.org.name}
 reauthenticate=Merci de vous authentifier à nouveau pour continuer
 usb=USB
 nfc=NFC
@@ -413,35 +413,75 @@ totpAppGoogleName=Google Authenticator
 totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
 sessionLimitExceeded=Il y a trop de sessions
 error-reset-otp-missing-id=Merci de choisir une configuration OTP.
-openshift.scope.user_info=Informations de l'utilisateur
+openshift.scope.user_info=Informations de l''utilisateur
 configureBackupCodesMessage=Vous devez définir des codes de secours pour activer votre compte.
-insufficientLevelOfAuthentication=Le niveau d'authentification requis n'a pas été atteint.
+insufficientLevelOfAuthentication=Le niveau d''authentification requis n''a pas été atteint.
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Générer des codes de récupération
-saml.post-form.js-disabled=JavaScript est désactivé. Il est fortement recommandé de l'activer. Cliquez sur le bouton ci-dessous pour continuer. 
-otp-display-name=Application d'authentification
+saml.post-form.js-disabled=JavaScript est désactivé. Il est fortement recommandé de l''activer. Cliquez sur le bouton ci-dessous pour continuer.
+otp-display-name=Application d''authentification
 recovery-codes-copied=Copiés
-recovery-codes-error-invalid=Code de récupération d'authentification invalide
-recovery-code-config-warning-message=Assurez-vous d'imprimer, télécharger ou copier ces codes dans un gestionnaire de mot de passe et de les conserver durablement. L'annulation de ce paramètre supprimera ces codes de récupération de votre compte.
-recovery-codes-confirmation-message=J'ai enregistré ces codes dans un endroit sûr
+recovery-codes-error-invalid=Code de récupération d''authentification invalide
+recovery-code-config-warning-message=Assurez-vous d''imprimer, télécharger ou copier ces codes dans un gestionnaire de mot de passe et de les conserver durablement. L''annulation de ce paramètre supprimera ces codes de récupération de votre compte.
+recovery-codes-confirmation-message=J''ai enregistré ces codes dans un endroit sûr
 confirmOverrideIdpContinue=Oui, remplacer le lien avec le compte actuel
-invalidPasswordNotContainsUsernameMessage=Mot de passe invalide : il ne doit pas contenir le nom d'utilisateur.
+invalidPasswordNotContainsUsernameMessage=Mot de passe invalide : il ne doit pas contenir le nom d''utilisateur.
 auth-x509-client-username-form-display-name=Certificat X509
 auth-x509-client-username-form-help-text=Se connecter avec un certificat client X509.
-auth-recovery-authn-code-form-display-name=Code de récupération de l'authentification
-auth-recovery-authn-code-form-help-text=Renseignez un code de récupération d'authentification depuis la liste générée précédemment.
-recovery-code-config-header=Codes de récupération d'authentification
-recovery-code-config-warning-title=Ces codes de récupération ne seront jamais réaffichés une fois que vous aurez quitter cette page
+auth-recovery-authn-code-form-display-name=Code de récupération de l''authentification
+auth-recovery-authn-code-form-help-text=Renseignez un code de récupération d''authentification depuis la liste générée précédemment.
+recovery-code-config-header=Codes de récupération d''authentification
+recovery-code-config-warning-title=Ces codes de récupération ne seront jamais réaffichés une fois que vous aurez quitté cette page
 recovery-codes-print=Imprimer
 recovery-codes-download=Télécharger
 recovery-codes-copy=Copier
-recovery-codes-action-cancel=Paramètrage annulé
+recovery-codes-action-cancel=Paramétrage annulé
 recovery-codes-action-complete=Paramétrage terminé
 recovery-codes-download-file-header=Conserver ces codes de récupération dans un endroit sûr.
 recovery-codes-download-file-date=Ces codes ont été généré le
 recovery-codes-label-default=Codes de récupération
-organization.confirm-membership=En cliquant sur le lien ci-dessous, vous allez devenir membre de l'organisation {0} :
-identityProviderInvalidResponseMessage=Réponse invalide du fournisseur d'identités.
-identityProviderInvalidSignatureMessage=Signature invalide pour la réponse du fournisseur d'identités.
+organization.confirm-membership=En cliquant sur le lien ci-dessous, vous allez devenir membre de l''organisation {0} :
+identityProviderInvalidResponseMessage=Réponse invalide du fournisseur d''identités.
+identityProviderInvalidSignatureMessage=Signature invalide pour la réponse du fournisseur d''identités.
 openshift.scope.list-projects=Liste des projets
 saml.post-form.message=Redirection en cours, patientez.
-otp-reset-description=Quelle configuration OTP doit être supprimée ?
+otp-reset-description=Quelle configuration OTP doit être supprimée ?
+internal=Interne
+unknown=Inconnu
+deleteCredentialTitle=Supprimer {0}
+deleteCredentialMessage=Voulez-vous supprimer {0} ?
+hidePassword=Cacher le mot de passe
+showPassword=Montrer le mot de passe
+federatedIdentityUnmatchedEssentialClaimMessage=Le jeton d''identité fourni par le fournisseur d''identité ne correspond pas à l''attribut essentiel configuré. Veuillez contacter votre administrateur.
+identityProviderMissingCodeOrErrorMessage=Code manquant ou erreur de paramètre dans la réponse du fournisseur d''identités.
+acrNotFulfilled=Exigences liées à l''authentification non remplies
+invalidTokenRequiredActions=Des actions nécessaires incluses dans le lien ne sont pas valides
+requiredAction.webauthn-register=Enregistrement WebAuthn
+requiredAction.webauthn-register-passwordless=Enregistrement WebAuthn sans mot de passe
+federatedIdentityConfirmOverrideMessage=Vous essayez de lier votre compte {0} avec le compte {1} {2}. Mais votre compte est déjà lié avec un compte différent {3} {4}. Pouvez-vous confirmer si vous souhaitez remplacer le lien existant avec le nouveau compte ?
+emailVerifyResend=Renvoyer le courriel de vérification
+emailVerifySend=Envoyer le courriel de vérification
+error-invalid-multivalued-size=L''attribut {0} doit avoir au moins {1} et au plus {2} {2,choice,0#valeur|1#valeur|1<valeurs}.
+emailVerifyInstruction4=Afin de vérifier votre adresse de courriel, nous allons vous envoyer un courriel avec les instructions à l''adresse {0}.
+confirmOverrideIdpTitle=Le lien du fournisseur existe déjà
+saml.post-form.title=Redirection de l''authentification
+auth-recovery-code-info-message=Renseigner le code de récupération spécifié.
+auth-recovery-code-prompt=Code de récupération #{0}
+auth-recovery-code-header=Se connecter à l''aide d''un code de récupération de l''authentification
+recovery-codes-download-file-description=Les codes de récupération sont des codes à usage unique, permettant de se connecter à votre compte si vous n''avez pas la possibilité d''utiliser votre application d''authentification.
+webauthn-registration-init-label-prompt=Merci de renseigner le libellé de votre clé d''accès enregistrée
+webauthn-registration-init-label=Clé d''accès (libellé par défaut)
+passkey-login-title=Identifiant de la clé d''accès
+passkey-available-authenticators=Clés d''accès disponibles
+passkey-unsupported-browser-text=Les clés d''accès ne sont pas supportées par ce navigateur. Essayer depuis un autre navigateur ou contacter votre administrateur.
+passkey-doAuthenticate=S''enregistrer à l''aide d''une clé d''accès
+passkey-createdAt-label=Créée
+passkey-autofill-select=Sélectionner votre clé d''accès
+access-denied-when-idp-auth=Accès refusé en se connectant avec {0}
+organization.member.register.title=Créer un compte pour rejoindre l''organisation ${kc.org.name}
+organization.select=Sélectionner une organisation pour continuer :
+notMemberOfOrganization=L''utilisateur n''est pas un membre de l''organisation {0}
+notMemberOfAnyOrganization=L''utilisateur n''est membre d''aucune organisation
+linkIdpActionTitle=Lien {0}
+linkIdpActionMessage=Voulez-vous lier votre compte avec {0} ?
+saml.artifactResolutionServiceInvalidResponse=Impossible de trouver la dépendance technique.
+confirmAccountLinkingBody=Si vous liez le compte, vous serez aussi en mesure de vous connecter via le compte {0} du fournisseur d''identités {1}. Ne continuez pas si vous n''êtes pas à l''origine de cette action ou si vous ne souhaitez pas lier votre compte.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_hr.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_hr.properties
index 75c99f535192..90477d27a2ea 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_hr.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_hr.properties
@@ -476,11 +476,11 @@ webauthn-registration-init-label-prompt=Molimo unesite oznaku vašeg pristupnog
 
 # WebAuthn Error
 webauthn-error-title=Greška sigurnosnog ključa
-webauthn-error-registration=Neuspješna registracija sigurnosnog ključa.<br/> {0}
-webauthn-error-api-get=Neuspješna autentifikacija putem sigurnosnog ključa.<br/> {0}
+webauthn-error-registration=Neuspješna registracija sigurnosnog ključa.<br /> {0}
+webauthn-error-api-get=Neuspješna autentifikacija putem sigurnosnog ključa.<br /> {0}
 webauthn-error-different-user=Prvi autentificirani korisnik nije isti kao korisnik autentificiran putem sigurnosnog ključa.
-webauthn-error-auth-verification=Rezultat autentifikacije putem sigurnosnog ključa nije valjan.<br/> {0}
-webauthn-error-register-verification=Rezultat registracije sigurnosnog ključa nije valjan.<br/> {0}
+webauthn-error-auth-verification=Rezultat autentifikacije putem sigurnosnog ključa nije valjan.<br /> {0}
+webauthn-error-register-verification=Rezultat registracije sigurnosnog ključa nije valjan.<br /> {0}
 webauthn-error-user-not-found=Nepoznati korisnik autentificiran putem sigurnosnog ključa.
 
 # Passkey
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_it.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_it.properties
index 0429d3374b75..ff6ab4b74833 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_it.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_it.properties
@@ -17,7 +17,7 @@ doTryAgain=Prova ancora
 doTryAnotherWay=Prova in un altro modo
 kerberosNotConfigured=Kerberos non configurato
 kerberosNotConfiguredTitle=Kerberos non configurato
-bypassKerberosDetail=Non sei connesso via Kerberos o il tuo browser non supporta l''autenticazione a Kerberos. Fai clic su Continua per accedere in modo alternativo.
+bypassKerberosDetail=Non sei connesso via Kerberos o il tuo browser non supporta l''autenticazione a Kerberos. Fai clic su Continua per accedere in un altro modo
 kerberosNotSetUp=Kerberos non è configurato. Non puoi effettuare l''accesso.
 registerTitle=Registrati
 loginAccountTitle=Accedi
@@ -27,36 +27,34 @@ impersonateTitle={0} Impersona utente
 impersonateTitleHtml=<strong>{0}</strong> Impersona utente
 realmChoice=Realm
 unknownUser=Utente sconosciuto
-loginTotpTitle=Configura autenticazione mobile
+loginTotpTitle=Configura Authenticator sullo smartphone
 loginProfileTitle=Aggiorna profilo
-loginTimeout=Stai impiegando troppo tempo per accedere. Il processo di autenticazione verrà riavviato.
-oauthGrantTitle=Autenticazione concessa
+loginTimeout=L''autenticazione sta impiegando troppo tempo. Il processo verrà riavviato.
+oauthGrantTitle=Autenticazione concessa a {0}
 oauthGrantTitleHtml={0}
 errorTitle=Siamo spiacenti…
-errorTitleHtml=Siamo <strong>spiacenti</strong>...
+errorTitleHtml=Siamo <strong>spiacenti</strong> ...
 emailVerifyTitle=Verifica l''email
 emailForgotTitle=Password dimenticata?
 updatePasswordTitle=Aggiorna password
 codeSuccessTitle=Codice di successo
-codeErrorTitle=Codice di errore\: {0}
+codeErrorTitle=Codice di errore: {0}
 displayUnsupported=Tipo display richiesto non supportato
-browserRequired=È richiesto il browser per il login
-browserContinue=È richiesto il browser per continuare il login
-browserContinuePrompt=Aprire il browser per continuare il login? [y/n]:
-browserContinueAnswer=y
+browserRequired=È richiesto il browser per effettuare l''accesso
+browserContinue=È richiesto un browser per proseguire con l''accesso
+browserContinuePrompt=Aprire il browser per continuare l''accesso? [s/n]:
+browserContinueAnswer=s
 
 
 termsTitle=Termini e condizioni
 termsText=<p>Termini e condizioni da definire</p>
 termsPlainText=Termini e condizioni da definire.
-
 recaptchaFailed=Recaptcha non valido
 recaptchaNotConfigured=Il Recaptcha è obbligatorio, ma non configurato
 consentDenied=Permesso negato.
-
 noAccount=Nuovo utente?
-username=Username
-usernameOrEmail=Username o email
+username=Nome utente
+usernameOrEmail=Nome utente o email
 firstName=Nome
 givenName=Nome
 fullName=Nome completo
@@ -68,16 +66,15 @@ passwordConfirm=Conferma password
 passwordNew=Nuova Password
 passwordNewConfirm=Conferma nuova password
 rememberMe=Ricordami
-authenticatorCode=Codice One-time
+authenticatorCode=Codice OTP
 address=Indirizzo
 locality=Città o Località
 street=Via
-region=Stato, Provincia, o Regione
+region=Stato, Provincia o Regione
 postal_code=CAP
 country=Paese
 emailVerified=Email verificata
 gssDelegationCredential=Credenziali delega GSS
-
 profileScopeConsentText=Profilo utente
 emailScopeConsentText=Indirizzo email
 addressScopeConsentText=Indirizzo
@@ -85,16 +82,14 @@ phoneScopeConsentText=Numero di telefono
 offlineAccessScopeConsentText=Accesso offline
 samlRoleListScopeConsentText=I miei ruoli
 rolesScopeConsentText=Ruoli utente
-
-restartLoginTooltip=Riavvia login
-
-loginTotpIntro=Devi impostare un generatore di OTP (password temporanea valida una volta sola) per accedere a questo account
-loginTotpStep1=Installa una delle seguenti applicazioni sul tuo dispositivo mobile
-loginTotpStep2=Apri l''applicazione e scansiona il codice QR
-loginTotpStep3=Scrivi il codice monouso fornito dall''applicazione e premi Invia per completare il setup
+restartLoginTooltip=Riavvia la procedura di accesso
+loginTotpIntro=Devi impostare un generatore di OTP (password temporanea valida una volta sola) per accedere a questo utente
+loginTotpStep1=Installa una delle seguenti applicazioni sul tuo dispositivo mobile:
+loginTotpStep2=Apri l''applicazione e scansiona il codice QR:
+loginTotpStep3=Scrivi il codice monouso fornito dall''applicazione e premi Invia per completare la configurazione.
 loginTotpStep3DeviceName=Fornisci il nome del dispositivo per aiutarti a gestire i dispositivi di autenticazione.
-loginTotpManualStep2=Apri l''applicazione e scrivi la chiave
-loginTotpManualStep3=Usa le seguenti impostazioni se l''applicazione lo consente
+loginTotpManualStep2=Apri l''applicazione e inserisci il codice:
+loginTotpManualStep3=Se l''applicazione ti chiede delle impostazioni, usa le seguenti:
 loginTotpUnableToScan=Non riesci a scansionare il codice QR?
 loginTotpScanBarcode=Vuoi scansionare il codice QR?
 loginCredential=Credenziali
@@ -105,36 +100,26 @@ loginTotpDigits=Cifre
 loginTotpInterval=Intervallo
 loginTotpCounter=Contatore
 loginTotpDeviceName=Nome del dispositivo di autenticazione
-
 loginTotp.totp=Basato sull''ora
 loginTotp.hotp=Basato sul contatore
-
 loginChooseAuthenticator=Seleziona il tuo metodo di autenticazione
-
 oauthGrantRequest=Vuoi assegnare questi privilegi di accesso?
 inResource=per
-
-emailVerifyInstruction1=Ti è stata inviata una email con le istruzioni per la verifica della tua email.
+emailVerifyInstruction1=Ti è stata inviata una email con le istruzioni per la verifica del tuo indirizzo {0}.
 emailVerifyInstruction2=Non hai ricevuto un codice di verifica nella tua email?
 emailVerifyInstruction3=per rinviare la email.
-
 emailLinkIdpTitle=Collega {0}
-emailLinkIdp1=Ti è stata inviata una email con le istruzioni per collegare l''account {0} {1} con il tuo account {2}.
+emailLinkIdp1=Ti è stata inviata una email con le istruzioni per collegare l''utenza {0} {1} con il tuo utente {2}.
 emailLinkIdp2=Non hai ricevuto un codice di verifica nella tua email?
-emailLinkIdp3=Per rinviare la email.
+emailLinkIdp3=per rinviare la email.
 emailLinkIdp4=Se hai già verificato l''indirizzo email in un altro browser
 emailLinkIdp5=per continuare.
-
 backToLogin=&laquo; Torna al Login
-
-emailInstruction=Inserisci la tua username o l''indirizzo email e ti manderemo le istruzioni per creare una nuova password.
-
+emailInstruction=Inserisci il tuo nome utente o l''indirizzo email e ti manderemo le istruzioni per creare una nuova password.
 copyCodeInstruction=Copia questo codice e incollalo nella tua applicazione:
-
 pageExpiredTitle=La pagina è scaduta
-pageExpiredMsg1=Per ripetere il login
-pageExpiredMsg2=Per continuare con il login
-
+pageExpiredMsg1=Per ripetere la procedura di accesso
+pageExpiredMsg2=Per continuare con la procedura di accesso
 personalInfo=Informazioni personali:
 role_admin=Admin
 role_realm-admin=Realm Admin
@@ -153,157 +138,138 @@ role_manage-identity-providers=Gestisci identity provider
 role_manage-clients=Gestisci client
 role_manage-events=Gestisci eventi
 role_view-profile=Visualizza profilo
-role_manage-account=Gestisci account
-role_manage-account-links=Gestisci i link per l''account
+role_manage-account=Gestisci l''utente
+role_manage-account-links=Gestisci i collegamenti per l''utente
 role_read-token=Leggi il token
 role_offline-access=Accesso offline
-client_account=Account
-client_account-console=Console account
+client_account=Utente
+client_account-console=Console utente
 client_security-admin-console=Console di amministrazione di sicurezza
-client_admin-cli=Admin CLI
+client_admin-cli=Interfaccia amministrativa a linea di comando (CLI)
 client_realm-management=Gestione realm
 client_broker=Broker
-
 requiredFields=Campi obbligatori
-
-invalidUserMessage=Username o password non validi.
-invalidUsernameMessage=Username non valido.
-invalidUsernameOrEmailMessage=Username o email non validi.
+invalidUserMessage=Nome utente o password non validi.
+invalidUsernameMessage=Nome utente non valido.
+invalidUsernameOrEmailMessage=Nome utente o email non validi.
 invalidPasswordMessage=Password non valida.
 invalidEmailMessage=Indirizzo email non valido.
-accountDisabledMessage=L''account è disabilitato, contatta il tuo amministratore.
-accountTemporarilyDisabledMessage=Username o password non validi.
-accountPermanentlyDisabledMessage=Username o password non validi.
+accountDisabledMessage=L''utente è stato disabilitato, contatta il tuo amministratore.
+accountTemporarilyDisabledMessage=Nome utente o password non validi.
+accountPermanentlyDisabledMessage=Nome utente o password non validi.
 accountTemporarilyDisabledMessageTotp=Codice di autenticazione non valido.
 accountPermanentlyDisabledMessageTotp=Codice di autenticazione non valido.
-expiredCodeMessage=Login scaduto. Riprovare.
-expiredActionMessage=Azione scaduta. Continuare adesso con in login.
+expiredCodeMessage=L''accesso è scaduto. Riprovare.
+expiredActionMessage=Azione scaduta. Si prega di effettuare l''accesso.
 expiredActionTokenNoSessionMessage=Azione scaduta.
 expiredActionTokenSessionExistsMessage=Azione scaduta. Ricominciare.
-
 missingFirstNameMessage=Inserisci il nome.
 missingLastNameMessage=Inserisci il cognome.
 missingEmailMessage=Inserisci l''email.
-missingUsernameMessage=Inserisci l''username.
+missingUsernameMessage=Inserisci il nome utente.
 missingPasswordMessage=Inserisci la password.
 missingTotpMessage=Inserisci il codice di autenticazione.
 missingTotpDeviceNameMessage=Inserisci il nome del dispositivo di autenticazione.
 notMatchPasswordMessage=Le password non coincidono.
-
 invalidPasswordExistingMessage=Password esistente non valida.
 invalidPasswordBlacklistedMessage=Password non valida: la password non è consentita.
 invalidPasswordConfirmMessage=La password di conferma non coincide.
 invalidTotpMessage=Codice di autenticazione non valido.
-
-usernameExistsMessage=Username già esistente.
+usernameExistsMessage=Nome utente già esistente.
 emailExistsMessage=Email già esistente.
-
-federatedIdentityExistsMessage=L''utente con {0} {1} esiste già. Effettua il login nella gestione account per associare l''account.
-
-confirmLinkIdpTitle=Account già esistente
+federatedIdentityExistsMessage=L''utente con {0} {1} esiste già. Accedi all''interfaccia di gestione dell''utente per associare l''utenza.
+confirmLinkIdpTitle=L''utente esiste già
 federatedIdentityConfirmLinkMessage=L''utente con {0} {1} esiste già. Come vuoi procedere?
-federatedIdentityConfirmReauthenticateMessage=Autenticati per associare il tuo account con {0}
+federatedIdentityConfirmReauthenticateMessage=Autenticati per associare il tuo utente con {0}
 confirmLinkIdpReviewProfile=Rivedi profilo
-confirmLinkIdpContinue=Aggiungi all''account esistente
-
-configureTotpMessage=Devi impostare un autenticatore per attivare il tuo account.
-updateProfileMessage=Devi aggiornare il tuo profilo utente per attivare il tuo account.
-updatePasswordMessage=Devi cambiare la password per attivare il tuo account.
+confirmLinkIdpContinue=Aggiungi all''utente esistente
+configureTotpMessage=Devi configurare un autenticatore su smartphone per attivare il tuo utente.
+updateProfileMessage=Devi aggiornare il profilo per attivare il tuo utente.
+updatePasswordMessage=Devi cambiare la password per attivare il tuo utente.
 resetPasswordMessage=Devi cambiare la password.
-verifyEmailMessage=Devi verificare il tuo indirizzo email per attivare il tuo account.
-linkIdpMessage=Devi verificare il tuo indirizzo email per associare il tuo account con {0}.
-
+verifyEmailMessage=Devi verificare il tuo indirizzo email per attivare il tuo utente.
+linkIdpMessage=Devi verificare il tuo indirizzo email per associare il tuo utente con {0}.
 emailSentMessage=Riceverai a breve una email con maggiori istruzioni.
 emailSendErrorMessage=Invio email fallito, riprova più tardi.
-
-accountUpdatedMessage=Il tuo account è stato aggiornato.
+accountUpdatedMessage=Il tuo utente è stato aggiornato.
 accountPasswordUpdatedMessage=La tua password è stata aggiornata.
-
-delegationCompleteHeader=Login completato
+delegationCompleteHeader=Accesso completato
 delegationCompleteMessage=Puoi chiudere questa finestra del browser e tornare alla tua applicazione.
-delegationFailedHeader=Login fallito
+delegationFailedHeader=Accesso fallito
 delegationFailedMessage=Puoi chiudere questa finestra del browser e tornare alla tua applicazione per provare ad accedere nuovamente.
-
 noAccessMessage=Nessun accesso
-
 invalidPasswordMinLengthMessage=Password non valida: lunghezza minima {0}.
 invalidPasswordMinDigitsMessage=Password non valida: deve contenere almeno {0} numeri.
 invalidPasswordMinLowerCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri minuscoli.
-invalidPasswordMinUpperCaseCharsMessage= Password non valida: deve contenere almeno {0} caratteri maiuscoli.
-invalidPasswordMinSpecialCharsMessage= Password non valida: deve contenere almeno {0} caratteri speciali.
-invalidPasswordNotUsernameMessage=Password non valida: non deve essere uguale alla username.
-invalidPasswordRegexPatternMessage=Password non valida: fallito il match con una o più espressioni regolari.
+invalidPasswordMinUpperCaseCharsMessage=Password non valida: deve contenere almeno {0} caratteri maiuscoli.
+invalidPasswordMinSpecialCharsMessage=Password non valida: deve contenere almeno {0} caratteri speciali.
+invalidPasswordNotUsernameMessage=Password non valida: non deve essere uguale al nome utente.
+invalidPasswordRegexPatternMessage=Password non valida: non soddisfa una o più espressioni regolari.
 invalidPasswordHistoryMessage=Password non valida: non deve essere uguale ad una delle ultime {0} password.
-invalidPasswordGenericMessage=Password non valida: la nuova password non rispetta le indicazioni previste.
-
+invalidPasswordGenericMessage=Password non valida: la nuova password non rispetta i requisiti previsti.
 failedToProcessResponseMessage=Fallimento nell''elaborazione della risposta
-httpsRequiredMessage=HTTPS richiesto
+httpsRequiredMessage=Richiesto HTTPS
 realmNotEnabledMessage=Realm non abilitato
 invalidRequestMessage=Richiesta non valida
-failedLogout=Logout fallito
-unknownLoginRequesterMessage=Richiedente di Login non riconosciuto
-loginRequesterNotEnabledMessage=Richiedente di Login non abilitato
-bearerOnlyMessage=Alle applicazioni di tipo Bearer-only non è consentito di effettuare il login tramite browser
-standardFlowDisabledMessage=Al client non è consentito di effettuare il login tramite browser con questo response_type. Standard flow è stato disabilitato per il client.
-implicitFlowDisabledMessage=Al client non è consentito di effettuare il login tramite browser con questo response_type. Implicit flow è stato disabilitato per il client.
-invalidRedirectUriMessage=Redirect uri non valido
+failedLogout=Disconnessione fallita
+unknownLoginRequesterMessage=Richiedente non riconosciuto
+loginRequesterNotEnabledMessage=Richiedente non abilitato
+bearerOnlyMessage=Alle applicazioni di tipo Bearer-only non è consentito effettuare l''accesso tramite browser
+standardFlowDisabledMessage=Al client non è consentito effettuare l''accesso tramite browser con questo response_type. Il flusso standard è stato disabilitato per questo client.
+implicitFlowDisabledMessage=Al client non è consentito effettuare l''accesso tramite browser con questo response_type. Il flusso implicito è stato disabilitato per questo client.
+invalidRedirectUriMessage=Uri di reindirizzamento non valido
 unsupportedNameIdFormatMessage=NameIDFormat non supportato
 invalidRequesterMessage=Richiedente non valido
 registrationNotAllowedMessage=Registrazione non permessa
-resetCredentialNotAllowedMessage=Reimpostazione della credenziale non permessa
-
+resetCredentialNotAllowedMessage=Reimpostazione delle credenziali non permessa
 permissionNotApprovedMessage=Permesso non approvato.
 noRelayStateInResponseMessage=Nessun relay state in risposta dall''identity provider.
 insufficientPermissionMessage=Permessi insufficienti per associare le identità.
-couldNotProceedWithAuthenticationRequestMessage=Impossibile procedere con la richiesta di autenticazione all''identity provider
-couldNotObtainTokenMessage=Non posso ottenere un token dall''identity provider.
+couldNotProceedWithAuthenticationRequestMessage=Impossibile procedere con la richiesta di autenticazione all''identity provider.
+couldNotObtainTokenMessage=Impossibile ottenere un token dall''identity provider.
 unexpectedErrorRetrievingTokenMessage=Errore inaspettato nel recupero del token dall''identity provider.
 unexpectedErrorHandlingResponseMessage=Errore inaspettato nella gestione della risposta dall''identity provider.
-identityProviderAuthenticationFailedMessage=Autenticazione fallita. Non posso effettuare l''autenticazione con l''identity provider.
+identityProviderAuthenticationFailedMessage=Autenticazione fallita. Impossibile effettuare l''autenticazione con l''identity provider.
 couldNotSendAuthenticationRequestMessage=Impossibile inviare la richiesta di autenticazione all''identity provider.
 unexpectedErrorHandlingRequestMessage=Errore inaspettato nella gestione della richiesta di autenticazione all''identity provider.
 invalidAccessCodeMessage=Codice di accesso non valido.
 sessionNotActiveMessage=Sessione non attiva.
-invalidCodeMessage=Si è verificato un errore, effettua di nuovo il login nella tua applicazione.
+invalidCodeMessage=Si è verificato un errore, effettua di nuovo l''accesso nella tua applicazione.
 identityProviderUnexpectedErrorMessage=Errore imprevisto durante l''autenticazione con identity provider
 identityProviderNotFoundMessage=Non posso trovare un identity provider con l''identificativo.
-identityProviderLinkSuccess=Hai verificato con successo la tua email. Torna al tuo browser iniziale e continua da lì con il login.
+identityProviderLinkSuccess=Hai verificato con successo la tua email. Puoi tornare al tuo browser iniziale e continua da lì con l''accesso.
 staleCodeMessage=Questa pagina non è più valida, torna alla tua applicazione ed effettua nuovamente l''accesso
 realmSupportsNoCredentialsMessage=Il realm non supporta nessun tipo di credenziali.
-credentialSetupRequired=Impossibile effettuare il login, è richiesto il setup delle credenziali.
+credentialSetupRequired=Impossibile effettuare l''accesso, è richiesta la configurazione delle credenziali.
 identityProviderNotUniqueMessage=Il realm supporta più di un identity provider. Impossibile determinare quale identity provider deve essere utilizzato per autenticarti.
 emailVerifiedMessage=Il tuo indirizzo email è stato verificato.
-staleEmailVerificationLink=Il link che hai cliccato è un link scaduto e non è più valido. Forse hai già verificato la tua email?
+staleEmailVerificationLink=Il collegamento che hai cliccato è scaduto e non è più valido. Probabilmente hai già verificato la tua email.
 identityProviderAlreadyLinkedMessage=L''identità federata restituita dall''identity provider {0} è già associata ad un altro utente.
-confirmAccountLinking=Conferma il collegamento per l''account {0} dell''identity provider {1} con il tuo account.
+confirmAccountLinking=Conferma il collegamento per l''utenza {0} dell''identity provider {1} con il tuo utente.
 confirmEmailAddressVerification=Conferma la validità dell''indirizzo email {0}.
 confirmExecutionOfActions=Esegui la/le seguenti azione/i
-
 backToApplication=&laquo; Torna all''applicazione
-missingParameterMessage=Parametri mancanti\: {0}
+missingParameterMessage=Parametri mancanti: {0}
 clientNotFoundMessage=Client non trovato.
 clientDisabledMessage=Client disabilitato.
-invalidParameterMessage=Parametro non valido\: {0}
+invalidParameterMessage=Parametro non valido: {0}
 alreadyLoggedIn=Sei già connesso.
 differentUserAuthenticated=Se già autenticato con l''utente ''{0}'' in questa sessione. Per favore, fai prima il logout.
-brokerLinkingSessionExpired=È stato richiesta un''associazione a un account broker, ma la sessione corrente non è più valida.
-proceedWithAction=» Clicca qui per continuare
-
+brokerLinkingSessionExpired=È stato richiesta un''associazione a un utenza broker, ma la sessione corrente non è più valida.
+proceedWithAction=&raquo; Clicca qui per continuare
 requiredAction.CONFIGURE_TOTP=Configura OTP
 requiredAction.TERMS_AND_CONDITIONS=Termini e condizioni
 requiredAction.UPDATE_PASSWORD=Aggiornamento password
 requiredAction.UPDATE_PROFILE=Aggiornamento profilo
 requiredAction.VERIFY_EMAIL=Verifica dell''indirizzo email
-
-doX509Login=Sarai connesso come\:
-clientCertificate=Certificato client X509\:
+doX509Login=Sarai connesso come:
+clientCertificate=Certificato client X509:
 noCertificate=[Nessun certificato]
 
 
 pageNotFound=Pagina non trovata
 internalServerError=Si è verificato un errore interno del server
-
-console-username=Username:
+console-username=Nome utente:
 console-password=Password:
 console-otp=One-time password:
 console-new-password=Nuova password:
@@ -311,8 +277,8 @@ console-confirm-password=Conferma password:
 console-update-password=È richiesto l''aggiornamento della tua password.
 console-verify-email=Devi verificare il tuo indirizzo email. È stata inviata una email a {0} che contiene un codice di verifica. Per favore inserisci il codice nella casella di testo seguente.
 console-email-code=Codice email:
-console-accept-terms=Accetti i termini? [y/n]:
-console-accept=y
+console-accept-terms=Accetti i termini? [s/n]:
+console-accept=s
 
 # Openshift messages
 openshift.scope.user_info=Informazioni utente
@@ -330,31 +296,191 @@ otp-display-name=Applicazione di autenticazione
 otp-help-text=Inserire un codice di verifica fornito dall''applicazione di autenticazione.
 password-display-name=Password
 password-help-text=Accedi inserendo la tua password.
-auth-username-form-display-name=Username
-auth-username-form-help-text=Inizia il login inserendo la tua username
-auth-username-password-form-display-name=Username e password
-auth-username-password-form-help-text=Accedi inserendo la tua username e la password.
+auth-username-form-display-name=Nome utente
+auth-username-form-help-text=Per accedere inserisci il tuo nome utente
+auth-username-password-form-display-name=Nome utente e password
+auth-username-password-form-help-text=Accedi inserendo il tuo nome utente e la password.
 
 # WebAuthn
-webauthn-display-name=Chiave di sicurezza
-webauthn-help-text=Utilizza la tua chiave di sicurezza per accedere.
-webauthn-passwordless-display-name=Chiave di sicurezza
-webauthn-passwordless-help-text=Utilizza la tua chiave di sicurezza per l''accesso senza password.
-webauthn-login-title=Login con chiave di sicurezza
-webauthn-registration-title=Registrazione chiave di sicurezza
-webauthn-available-authenticators=Autenticatori disponibili
+webauthn-display-name=Passkey
+webauthn-help-text=Utilizza la tua Passkey per accedere.
+webauthn-passwordless-display-name=Passkey
+webauthn-passwordless-help-text=Utilizza la tua Passkey per l''accesso senza password.
+webauthn-login-title=Accesso con Passkey
+webauthn-registration-title=Registrazione Passkey
+webauthn-available-authenticators=Passkey disponibili
 
 # WebAuthn Error
-webauthn-error-title=Errore della chiave di sicurezza
-webauthn-error-registration=Impossibile registrare la tua chiave di sicurezza.
-webauthn-error-api-get=Autenticazione con la chiave di sicurezza fallita.
-webauthn-error-different-user=Il primo utente autenticato non è quello autenticato tramite la chiave di sicurezza.
-webauthn-error-auth-verification=Il risultato dell''autenticazione con la chiave di sicurezza non è valido.
-webauthn-error-register-verification=Il risultato della registrazione della chiave di sicurezza non è valido.
-webauthn-error-user-not-found=Utente sconosciuto autenticato con la chiave di sicurezza.
+webauthn-error-title=Errore Passkey
+webauthn-error-registration=Impossibile registrare la tua Passkey.<br /> {0}
+webauthn-error-api-get=L''autenticazione con la Passkey è fallita.<br /> {0}
+webauthn-error-different-user=Il primo utente autenticato non è quello autenticato tramite la Passkey.
+webauthn-error-auth-verification=Il risultato dell''autenticazione con la Passkey non è valido.<br /> {0}
+webauthn-error-register-verification=Il risultato della registrazione della Passkey non è valido.<br /> {0}
+webauthn-error-user-not-found=L''utente autenticato la Passkey è sconosciuto.
 
 # Identity provider
-identity-provider-redirector=Connettiti con un altro identity provider.
+identity-provider-redirector=Connettiti con un altro identity provider
 identity-provider-login-label=Oppure accedi con
-
-readOnlyUsernameMessage=Non puoi aggiornare il tuo nome utente poiché è in modalità sola lettura.
+readOnlyUsernameMessage=Non puoi aggiornare il tuo nome utente, poiché è in modalità sola lettura.
+reauthenticate=Effettuare nuovamente l''autenticazione per continuare
+errorDeletingAccount=Errore durante l''eliminazione dell''utente
+authenticateStrong=Per continuare è necessaria un''autenticazione forte
+loginIdpReviewProfileTitle=Aggiorna profilo
+deletingAccountForbidden=Non hai i permessi sufficienti per eliminare il tuo utente, contatta l''amministratore.
+oauthGrantReview=Controlla il
+oauthGrantPolicy=politica sulla riservatezza.
+totpAppFreeOTPName=FreeOTP
+oauth2DeviceVerificationTitle=Dispositivo di accesso
+oauth2DeviceExpiredUserCodeMessage=Il codice è scaduto. Torna sul dispositivo e prova a connetterti di nuovo.
+oauth2DeviceVerificationCompleteHeader=Autenticato correttamente con dispositivo
+oauth2DeviceVerificationCompleteMessage=Puoi chiudere questa finestra e tornare al tuo dispositivo.
+oauth2DeviceVerificationFailedHeader=Errore nell''autenticazione con dispositivo
+oauth2DeviceVerificationFailedMessage=Puoi chiudere questa finestra e tornare al tuo dispositivo per provare nuovamente.
+oauth2DeviceAuthorizationGrantDisabledMessage=Il client non è autorizzato ad effettuare l''autenticazione del dispositivo (OAuth 2.0 Device Authorization Grant). Questo flusso è disabilitato per il client.
+identityProviderLogoutFailure=Disconnessione IdP SAML fallita
+error-invalid-length-too-long=La lunghezza massima è {2}.
+error-invalid-email=Indirizzo email non valido.
+error-invalid-number=Numero non valido.
+error-number-out-of-range=Il numero deve essere compreso fra {1} e {2}.
+error-number-out-of-range-too-small=Il valore minimo è {1}.
+error-number-out-of-range-too-big=Il valore massimo è {2}.
+error-invalid-uri-fragment=Indirizzo URL non valido.
+error-user-attribute-required=Compilare questo campo.
+error-reset-otp-missing-id=Si prega di scegliere una configurazione OTP.
+federatedIdentityUnmatchedEssentialClaimMessage=Il token emesso dall''identity provider non presenta i criteri richiesti. Si prega di contattare un amministratore.
+nestedFirstBrokerFlowMessage=L''utenza {0} {1} non è collegata con alcun utente.
+configureBackupCodesMessage=È necessario impostare i codici di ripristino per attivare l''utente.
+identityProviderInvalidResponseMessage=Risposta non valida da parte dell''identity provider.
+requiredAction.webauthn-register-passwordless=Registrazione Webauthn senza password
+auth-x509-client-username-form-display-name=Certificato X509
+auth-x509-client-username-form-help-text=Entra utilizzando un certificato X509.
+auth-recovery-authn-code-form-display-name=Codice di recupero
+auth-recovery-authn-code-form-help-text=Inserisci un codice di recupero da un elenco generato in precedenza.
+recovery-codes-error-invalid=Codice di recupero non valido
+recovery-code-config-header=Codici di recupero
+recovery-code-config-warning-message=Assicurarsi di stamparli, scaricarli o copiarli in un gestore di password per conservarli. Se clicchi annulla i codici di recupero verranno rimossi dal tuo utente.
+recovery-codes-print=Stampa
+recovery-codes-copy=Copia
+recovery-codes-copied=Copiato
+recovery-codes-confirmation-message=Ho salvato questi codici in un posto sicuro
+recovery-codes-action-complete=Completa la configurazione
+recovery-codes-action-cancel=Annulla la configurazione
+recovery-codes-download-file-header=Conserva questi codici di recupero in un luogo sicuro.
+recovery-codes-download-file-description=I codici di recupero sono dei codici di accesso monouso che consentono di accedere alla propria utenza se non si è in grado di generare un codice OTP.
+webauthn-doAuthenticate=Accedi con Passkey
+webauthn-registration-init-label=Passkey (nome di default)
+passkey-unsupported-browser-text=Le Passkey non sono supportate da questo browser. Prova un altro browser o contatta il tuo amministratore.
+passkey-doAuthenticate=Accesso con Passkey
+idp-email-verification-display-name=Verifica email
+idp-email-verification-help-text=Collega il tuo utente verificando il tuo indirizzo email.
+idp-username-password-form-display-name=Nome utente e password
+idp-username-password-form-help-text=Collega il tuo utente accedendovi.
+irreversibleAction=Questa operazione è irreversibile
+deletingImplies=La cancellazione del tuo utente comporta:
+finalDeletionConfirmation=Una volta eliminato, non sarà più possibile recuperare il tuo utente. Per mantenerlo clicca su Annulla.
+deleteAccountConfirm=Conferma dell''eliminazione dell''utente
+userDeletedSuccessfully=Rimozione dell''utente riuscita
+access-denied=Accesso negato
+frontchannel-logout.title=Disconnessione
+logoutConfirmTitle=Disconnessione
+error-invalid-multivalued-size=L''attributo {0} deve avere almeno {1} e al massimo {2}{2,choice,0#valori|1#valore|1<valori}.
+organization.confirm-membership.title=Ti stai per unire all''organizzazione ${kc.org.name}
+organization.member.register.title=Crea un utente per unirti all''organizzazione ${kc.org.name}
+organization.select=Seleziona un''organizzazione per procedere:
+notMemberOfOrganization=L''utente non è membro dell''organizzazione {0}
+doConfirmDelete=Conferma eliminazione
+invalidPasswordNotContainsUsernameMessage=Password non valida: non può contenere il nome utente.
+error-user-attribute-read-only=Questo campo è di sola lettura.
+oauth2DeviceConsentDeniedMessage=È stato negato il consenso per la connessione del dispositivo.
+error-invalid-date=Data non valida.
+error-invalid-uri-scheme=Schema URL non valido.
+error-username-invalid-character=È presente un carattere non valido.
+updateEmailMessage=Devi aggiornare l''indirizzo e-mail per attivare l''utente.
+frontchannel-logout.message=Ti stai disconnettendo dalle seguenti applicazioni
+federatedIdentityUnavailableMessage=L''utente {0} autenticato con l''identity provider {1} non esiste. Si prega di contattare un amministratore.
+requiredAction.webauthn-register=Registrazione Webauthn
+otp-reset-description=Quale configurazione OTP vuoi rimuovere?
+passkey-createdAt-label=Creato
+successLogout=Sei stato disconnesso
+auth-recovery-code-prompt=Codice di recupero #{0}
+passkey-autofill-select=Seleziona la tua passkey
+insufficientLevelOfAuthentication=Il livello di autenticazione richiesto non è stato soddisfatto.
+auth-recovery-code-header=Accesso con un codice di recupero
+auth-recovery-code-info-message=Inserisci il codice di recupero.
+webauthn-unsupported-browser-text=Il protocollo WebAuthn non è supportato in questo browser. Provane un''altro o contatta il tuo amministratore.
+error-invalid-uri=URL non valido.
+confirmOverrideIdpTitle=Il collegamento al broker esiste già
+emailVerifiedAlreadyMessage=Il tuo indirizzo email è già stato verificato.
+cookieNotFoundMessage=Il cookie non è stato trovato. È possibile che sia scaduto, che sia stato cancellato o che i cookie siano stati disabilitati nel browser. Se i cookie sono disabilitati, attivali. Clicca su Torna all''applicazione per effettuare nuovamente l''accesso.
+saml.artifactResolutionServiceInvalidResponse=Impossibile risolvere l''artefatto.
+identityProviderInvalidSignatureMessage=Nella risposta dell''identity provider la firma non è valida.
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Genera codici di recupero
+recovery-codes-download=Scarica
+passkey-login-title=Accesso Passkey
+recovery-codes-download-file-date=Questi codici sono stati generati il
+loggingOutImmediately=Disconnessione immediata
+webauthn-registration-init-label-prompt=Inserisci un nome per la tua Passkey
+passkey-available-authenticators=Passkey disponibili
+organization.confirm-membership=Cliccando il collegamento sottostante diventerai parte dell''organizzazione {0}:
+accountUnusable=Qualsiasi utilizzo successivo dell''applicazione non sarà più possibile con questo utente
+oauthGrantInformation=Assicurati di fidarti di {0} capendo come {0} gestirà i vostri dati.
+error-person-name-invalid-character=È presente un carattere non valido.
+error-pattern-no-match=Valore non valido.
+emailVerifyInstruction4=Per verificare la tua email ti stiamo per inviare un messaggio all''indirizzo {0}.
+identityProviderMissingCodeOrErrorMessage=Nella risposta dell''identity provider manca il parametro "code" o "error".
+invalidTokenRequiredActions=Le azioni richieste nel collegamento non sono valide
+confirmOverrideIdpContinue=Sì, sovrascrivi il collegamento con l''utente corrente
+invalidPasswordNotEmailMessage=Password non valida: non può essere uguale all''email.
+federatedIdentityConfirmOverrideMessage=Stai cercando di collegare l''utente {0} con l''utenza {1} {2}. Tuttavia esiste già un collegamento con l''utenza {3} {4}. Vuoi veramente sostituire il collegamento esistente?
+acrNotFulfilled=I requisiti di autenticazione non sono stati soddisfatti
+invalidPasswordMaxLengthMessage=Password non valida: la lunghezza massima è {0}.
+identityProviderMissingStateMessage=Nella risposta dell''identity provider manca il parametro "state".
+recovery-code-config-warning-title=Questi codici di recupero non saranno più visualizzati dopo che avrai lasciato questa pagina
+webauthn-createdAt-label=Creato
+recovery-codes-label-default=Codici di recupero
+errasingData=Rimozione di tutti i tuoi dati
+access-denied-when-idp-auth=Accesso negato durante l''autenticazione con {0}
+logoutConfirmHeader=Vuoi disconnetterti?
+doLogout=Disconnessione
+notMemberOfAnyOrganization=L''utente non è membro di alcuna organizzazione
+updateEmailTitle=Aggiorna email
+emailUpdateConfirmationSentTitle=Email di conferma inviata
+emailUpdateConfirmationSent=Un''email di conferma è stata inviata a {0}. Devi seguire le istruzioni contenute per completare il cambio di indirizzo.
+emailUpdatedTitle=Email aggiornata
+usb=USB
+bluetooth=Bluetooth
+oauthGrantTos=termini di servizio.
+termsAcceptanceRequired=Devi accettare i nostri termini e condizioni.
+acceptTerms=Accetto i termini e le condizioni
+hidePassword=Nascondi la password
+showPassword=Mostra la password
+website=Pagina Web
+totpAppGoogleName=Google Authenticator
+emailVerifySend=Invia l''email di verifica
+emailInstructionUsername=Inserisci il tuo nome utente e ti invieremo le istruzioni per creare una nuova password.
+sessionLimitExceeded=Ci sono troppe sessioni
+error-invalid-value=Valore non valido.
+error-invalid-blank=Si prega di inserire un valore.
+error-empty=Si prega di inserire un valore.
+error-invalid-length=La lunghezza dev''essere compresa tra {1} e {2} caratteri.
+error-invalid-length-too-short=La lunghezza minima è {1}.
+organizationScopeConsentText=Organizzazione
+emailUpdated=L''indirizzo email dell''utente è stato correttamente aggiornato a {0}.
+emailVerifyResend=Invia di nuovo l''email di verifica
+nfc=NFC
+internal=Interno
+deleteCredentialMessage=Vuoi eliminare {0}?
+unknown=Sconosciuto
+deleteCredentialTitle=Elimina {0}
+verifyOAuth2DeviceUserCode=Inserisci il codice fornito dal tuo dispositivo e clicca Invia
+zoneinfo=Fuso orario
+phoneNumber=Numero di telefono
+phoneNumberVerified=Numero di telefono verificato
+gender=Genere
+birthday=Data di nascita
+logoutOtherSessions=Scollegati da tutti gli altri dispositivi
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+oauth2DeviceInvalidUserCodeMessage=Codice non valido, si prega di riprovare.
+linkIdpActionMessage=Vuoi collegare il tuo account con {0}?
+linkIdpActionTitle=Collegamento {0}
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ja.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ja.properties
index 92e2554d25ef..bda14c1fbe80 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ja.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ja.properties
@@ -1,4 +1,4 @@
-doLogIn=ログイン
+doLogIn=サインイン
 doRegister=登録
 doRegisterSecurityKey=登録
 doCancel=キャンセル
@@ -8,9 +8,9 @@ doYes=はい
 doNo=いいえ
 doContinue=続ける
 doIgnore=無視
-doAccept=承諾
+doAccept=承認
 doDecline=却下
-doForgotPassword=パスワードをお忘れですか?
+doForgotPassword=パスワードをお忘れですか？
 doClickHere=クリックしてください
 doImpersonate=代理ログイン
 doTryAgain=再試行してください
@@ -20,25 +20,25 @@ kerberosNotConfiguredTitle=Kerberosは設定されていません
 bypassKerberosDetail=Kerberosでログインしていないか、ブラウザーでKerberosログインの設定がされていません。他の手段でログインするには「続ける」をクリックしてください。
 kerberosNotSetUp=Kerberosが設定されていません。ログインできません。
 registerTitle=登録
-loginAccountTitle=アカウントにログイン
-loginTitle={0}にログイン
+loginAccountTitle=アカウントにサインイン
+loginTitle={0}にサインイン
 loginTitleHtml={0}
 impersonateTitle={0}ユーザーの代理
 impersonateTitleHtml=<strong>{0}</strong>ユーザーの代理
 realmChoice=レルム
 unknownUser=不明なユーザー
-loginTotpTitle=モバイル・オーセンティケーターのセットアップ
+loginTotpTitle=モバイルオーセンティケーターのセットアップ
 loginProfileTitle=アカウント情報の更新
 loginTimeout=ログイン試行がタイムアウトしました。ログインは最初から開始されます。
 oauthGrantTitle={0}へのアクセスを許可
 oauthGrantTitleHtml={0}
-errorTitle=申し訳ございません
-errorTitleHtml=<strong>申し訳ございません</strong>
-emailVerifyTitle=Eメール確認
-emailForgotTitle=パスワードをお忘れですか?
+errorTitle=申し訳ございません。
+errorTitleHtml=<strong>申し訳ございません。</strong>
+emailVerifyTitle=メールアドレス検証
+emailForgotTitle=パスワードをお忘れですか？
 updatePasswordTitle=パスワードの更新
 codeSuccessTitle=成功コード
-codeErrorTitle=エラーコード\: {0}
+codeErrorTitle=エラーコード: {0}
 displayUnsupported=要求された表示タイプがサポートされていません
 browserRequired=ログインに必要なブラウザー
 browserContinue=ログインを完了するために必要なブラウザー
@@ -47,12 +47,12 @@ browserContinueAnswer=y
 
 
 termsTitle=利用規約
-termsText=<p>利用規約はここで設定する必要があります</p>
+termsText=<p>利用規約はここに書きます</p>
 termsPlainText=定義される利用規約。
 recaptchaFailed=無効なreCAPTCHA
-recaptchaNotConfigured=reCAPTCHAが必須ですが、設定されていません
+recaptchaNotConfigured=reCAPTCHAが必須ですが設定されていません
 consentDenied=同意が拒否されました。
-noAccount=新規ユーザーですか?
+noAccount=新規ユーザーですか？
 username=ユーザー名
 usernameOrEmail=ユーザー名またはメールアドレス
 firstName=名
@@ -60,7 +60,7 @@ givenName=名
 fullName=氏名
 lastName=姓
 familyName=姓
-email=Eメール
+email=メールアドレス
 password=パスワード
 passwordConfirm=パスワード（確認）
 passwordNew=新しいパスワード
@@ -73,22 +73,22 @@ locality=市区町村
 region=都道府県
 postal_code=郵便番号
 country=国
-emailVerified=確認済みEメール
+emailVerified=検証済みメールアドレス
 gssDelegationCredential=GSS委譲クレデンシャル
-profileScopeConsentText=ユーザー・プロファイル
+profileScopeConsentText=ユーザープロファイル
 emailScopeConsentText=メールアドレス
 addressScopeConsentText=アドレス
 phoneScopeConsentText=電話番号
-offlineAccessScopeConsentText=オフライン・アクセス
-samlRoleListScopeConsentText=ロール
+offlineAccessScopeConsentText=オフラインアクセス
+samlRoleListScopeConsentText=マイロール
 rolesScopeConsentText=ユーザーロール
-restartLoginTooltip=ログインを再開
-loginTotpIntro=このアカウントにアクセスするには、ワンタイム・パスワード・ジェネレーターを設定する必要があります
+restartLoginTooltip=ログインの再開
+loginTotpIntro=このアカウントにアクセスするには、ワンタイムパスワードジェネレーターを設定する必要があります
 loginTotpStep1=次のいずれかのアプリケーションをモバイルにインストールします。
 loginTotpStep2=アプリケーションを開き、バーコードをスキャンします。
-loginTotpStep3=アプリケーションから提供されたワンタイムコードを入力し、送信をクリックしてセットアップを終了します。
+loginTotpStep3=アプリケーションから提供されたワンタイムコードを入力し、「送信」をクリックしてセットアップを終了します。
 loginTotpStep3DeviceName=OTPデバイスの管理に役立つデバイス名を指定します。
-loginTotpManualStep2=アプリケーションを開き、キーを入力します：
+loginTotpManualStep2=アプリケーションを開き、キーを入力します:
 loginTotpManualStep3=アプリケーションで設定できる場合は、次の設定値を使用します。
 loginTotpUnableToScan=スキャンできませんか？
 loginTotpScanBarcode=バーコードをスキャンしますか？
@@ -105,21 +105,21 @@ loginTotp.hotp=カウンターベース
 loginChooseAuthenticator=ログイン方法を選択してください
 oauthGrantRequest=これらのアクセス権限を付与しますか？
 inResource=in
-emailVerifyInstruction1=メールアドレスを確認する手順を記載したEメールを次のアドレス {0} に送信しました。
-emailVerifyInstruction2=Eメールで確認コードを受け取っていませんか?
-emailVerifyInstruction3=Eメールを再送信します。
+emailVerifyInstruction1=メールアドレスを確認する手順を記載したメールを次のアドレス {0} に送信しました。
+emailVerifyInstruction2=メールで確認コードを受け取っていませんか？
+emailVerifyInstruction3=メールを再送信します。
 emailLinkIdpTitle=リンク {0}
-emailLinkIdp1={0}の{1}アカウントをあなたの{2}アカウントとリンクするための手順を記載したEメールを送信しました。
-emailLinkIdp2=Eメールで確認コードを受け取っていませんか?
-emailLinkIdp3=Eメールを再送信します。
+emailLinkIdp1={0}の{1}アカウントをあなたの{2}アカウントとリンクするための手順を記載したメールを送信しました。
+emailLinkIdp2=メールで確認コードを受け取っていませんか？
+emailLinkIdp3=メールを再送信します。
 emailLinkIdp4=別のブラウザーでメールを確認済みの場合
 emailLinkIdp5=続けるには
 backToLogin=&laquo; ログインに戻る
-emailInstruction=ユーザー名またメールアドレスを入力してください。新しいパスワードの設定方法をご案内いたします。
-copyCodeInstruction=このコードをコピーし、あなたのアプリケーションにペーストしてください：
+emailInstruction=ユーザー名またメールアドレスを入力してください。新しいパスワードの設定方法をお知らせします。
+copyCodeInstruction=このコードをコピーし、あなたのアプリケーションにペーストしてください:
 pageExpiredTitle=ページの有効期限が切れています
-pageExpiredMsg1=ログインプロセスを再開するには
-pageExpiredMsg2=ログイン処理を続行するには
+pageExpiredMsg1=ログインプロセスを再開
+pageExpiredMsg2=ログイン処理を続行
 personalInfo=個人情報:
 role_admin=管理者
 role_realm-admin=レルム管理者
@@ -130,20 +130,20 @@ role_view-users=ユーザーの参照
 role_view-applications=アプリケーションの参照
 role_view-clients=クライアントの参照
 role_view-events=イベントの参照
-role_view-identity-providers=アイデンティティー・プロバイダーの参照
+role_view-identity-providers=アイデンティティープロバイダーの参照
 role_manage-realm=レルムの管理
 role_manage-users=ユーザーの管理
 role_manage-applications=アプリケーションの管理
-role_manage-identity-providers=アイデンティティー・プロバイダーの管理
+role_manage-identity-providers=アイデンティティープロバイダーの管理
 role_manage-clients=クライアントの管理
 role_manage-events=イベントの管理
 role_view-profile=プロファイルの参照
 role_manage-account=アカウントの管理
 role_manage-account-links=アカウントリンクの管理
 role_read-token=トークンの参照
-role_offline-access=オフライン・アクセス
+role_offline-access=オフラインアクセス
 client_account=アカウント
-client_account-console=アカウント・コンソール
+client_account-console=アカウントコンソール
 client_security-admin-console=セキュリティー管理コンソール
 client_admin-cli=管理CLI
 client_realm-management=レルム管理
@@ -157,47 +157,47 @@ invalidEmailMessage=無効なメールアドレスです。
 accountDisabledMessage=アカウントが無効です。管理者に連絡してください。
 accountTemporarilyDisabledMessage=無効なユーザー名またはパスワードです。
 accountPermanentlyDisabledMessage=無効なユーザー名またはパスワードです。
-accountTemporarilyDisabledMessageTotp=無効なオーセンティケーター・コードです。
-accountPermanentlyDisabledMessageTotp=無効なオーセンティケーター・コードです。
-expiredCodeMessage=ログイン・タイムアウトが発生しました。再度ログインしてください。
+accountTemporarilyDisabledMessageTotp=無効なオーセンティケーターコードです。
+accountPermanentlyDisabledMessageTotp=無効なオーセンティケーターコードです。
+expiredCodeMessage=ログインタイムアウトが発生しました。再度サインインしてください。
 expiredActionMessage=アクションは期限切れです。今すぐログインしてください。
 expiredActionTokenNoSessionMessage=アクションは期限切れです。
 expiredActionTokenSessionExistsMessage=アクションは期限切れです。もう一度やり直してください。
 missingFirstNameMessage=名を指定してください。
 missingLastNameMessage=姓を指定してください。
-missingEmailMessage=Eメールを指定してください。
+missingEmailMessage=メールアドレスを指定してください。
 missingUsernameMessage=ユーザー名を指定してください。
 missingPasswordMessage=パスワードを指定してください。
-missingTotpMessage=オーセンティケーター・コードを指定してください。
+missingTotpMessage=オーセンティケーターコードを指定してください。
 missingTotpDeviceNameMessage=デバイス名を指定してください。
 notMatchPasswordMessage=パスワードが一致していません。
 invalidPasswordExistingMessage=既存のパスワードが不正です。
 invalidPasswordBlacklistedMessage=無効なパスワード: パスワードがブラックリストに含まれています。
 invalidPasswordConfirmMessage=パスワード確認が一致していません。
-invalidTotpMessage=無効なオーセンティケーター・コードです。
+invalidTotpMessage=無効なオーセンティケーターコードです。
 usernameExistsMessage=既に存在するユーザー名です。
-emailExistsMessage=既に存在するEメールです。
+emailExistsMessage=既に存在するメールアドレスです。
 federatedIdentityExistsMessage={0}{1}のユーザーは既に存在します。そのアカウントをリンクするにはアカウント管理にログインしてください。
-confirmLinkIdpTitle=既に存在するアカウントです。
-federatedIdentityConfirmLinkMessage={0}{1}のユーザーは既に存在します。継続しますか?
+confirmLinkIdpTitle=既に存在するアカウントです
+federatedIdentityConfirmLinkMessage={0}{1}のユーザーは既に存在します。継続しますか？
 federatedIdentityConfirmReauthenticateMessage={1}でアカウントをリンクするために{0}として認証します
 nestedFirstBrokerFlowMessage={0}ユーザー{1}は既知のユーザーにリンクされていません。
 confirmLinkIdpReviewProfile=プロファイルの確認
 confirmLinkIdpContinue=既存のアカウントに追加する
-configureTotpMessage=アカウントを有効にするにはモバイル・オーセンティケーターのセットアップが必要です。
-updateProfileMessage=アカウントを有効にするにはユーザー・プロファイルの更新が必要です。
+configureTotpMessage=アカウントを有効にするにはモバイル認証器のセットアップが必要です。
+updateProfileMessage=アカウントを有効にするにはユーザープロファイルの更新が必要です。
 updatePasswordMessage=アカウントを有効にするにはパスワードの更新が必要です。
 resetPasswordMessage=パスワードを変更する必要があります。
 verifyEmailMessage=アカウントを有効にするにはメールアドレスの確認が必要です。
 linkIdpMessage=アカウントを{0}とリンクするにはメールアドレスの確認が必要です。
-emailSentMessage=詳細な手順を記載したEメールをすぐに受信してください。
-emailSendErrorMessage=Eメールの送信に失敗しました。しばらく時間をおいてから再度お試しください。
+emailSentMessage=詳細な手順を記載したメールをすぐに受信してください。
+emailSendErrorMessage=メールの送信に失敗しました。しばらく時間をおいてから再度お試しください。
 accountUpdatedMessage=アカウントが更新されました。
 accountPasswordUpdatedMessage=パスワードが更新されました。
 delegationCompleteHeader=ログインに成功しました
-delegationCompleteMessage=このブラウザーのウィンドウを閉じて、コンソール・アプリケーションに戻ることができます。
+delegationCompleteMessage=このブラウザーのウィンドウを閉じて、コンソールアプリケーションに戻ることができます。
 delegationFailedHeader=ログインに失敗しました
-delegationFailedMessage=このブラウザー・ウィンドウを閉じてコンソール・アプリケーションに戻り、再度ログインを試みることができます。
+delegationFailedMessage=このブラウザーウィンドウを閉じてコンソールアプリケーションに戻り、再度ログインを試みることができます。
 noAccessMessage=アクセスがありません
 invalidPasswordMinLengthMessage=無効なパスワード: 最小{0}の長さが必要です。
 invalidPasswordMinDigitsMessage=無効なパスワード: 少なくとも{0}文字の数字を含む必要があります。
@@ -206,65 +206,65 @@ invalidPasswordMinUpperCaseCharsMessage=無効なパスワード: 少なくと
 invalidPasswordMinSpecialCharsMessage=無効なパスワード: 少なくとも{0}文字の特殊文字を含む必要があります。
 invalidPasswordNotUsernameMessage=無効なパスワード: ユーザー名と同じパスワードは禁止されています。
 invalidPasswordRegexPatternMessage=無効なパスワード: 正規表現パターンと一致しません。
-invalidPasswordHistoryMessage=無効なパスワード: 最近の{0}パスワードのいずれかと同じパスワードは禁止されています。
-invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワード・ポリシーと一致しません。
-failedToProcessResponseMessage=応答を処理できませんでした
+invalidPasswordHistoryMessage=無効なパスワード: 直近{0}個のパスワードのいずれかと同じパスワードは禁止されています。
+invalidPasswordGenericMessage=無効なパスワード: 新しいパスワードはパスワードポリシーと一致しません。
+failedToProcessResponseMessage=レスポンスの処理に失敗しました
 httpsRequiredMessage=HTTPSが必須です
-realmNotEnabledMessage=レルムが有効ではありません
+realmNotEnabledMessage=レルムが有効化されていません
 invalidRequestMessage=無効なリクエストです
 failedLogout=ログアウトに失敗しました
 unknownLoginRequesterMessage=不明なログイン要求元です
 loginRequesterNotEnabledMessage=ログイン要求元は有効ではありません
-bearerOnlyMessage=bearer-onlyのアプリケーションはブラウザー・ログインを開始することが許可されていません
-standardFlowDisabledMessage=与えられたresponse_typeでクライアントはブラウザー・ログインを開始することが許可されていません。標準フローは無効です。
-implicitFlowDisabledMessage=与えられたresponse_typeでクライアントはブラウザー・ログインを開始することが許可されていません。インプリシット・フローは無効です。
+bearerOnlyMessage=bearer-onlyのアプリケーションはブラウザーログインを開始することが許可されていません
+standardFlowDisabledMessage=与えられたresponse_typeでクライアントはブラウザーログインを開始することが許可されていません。標準フローは無効です。
+implicitFlowDisabledMessage=与えられたresponse_typeでクライアントはブラウザーログインを開始することが許可されていません。インプリシットフローは無効です。
 invalidRedirectUriMessage=無効なリダイレクトURIです
-unsupportedNameIdFormatMessage=サポートされていないNameID Formatです
+unsupportedNameIdFormatMessage=サポートされていないNameIDFormatです
 invalidRequesterMessage=無効な要求元です
 registrationNotAllowedMessage=登録は許可されていません
 resetCredentialNotAllowedMessage=クレデンシャルのリセットは許可されていません
 permissionNotApprovedMessage=パーミッションは承認されていません。
-noRelayStateInResponseMessage=アイデンティティー・プロバイダーからの応答にRelayStateがありません。
+noRelayStateInResponseMessage=アイデンティティープロバイダーからのレスポンスにRelayStateがありません。
 insufficientPermissionMessage=アイデンティティーにリンクするには不十分なパーミッションです。
-couldNotProceedWithAuthenticationRequestMessage=アイデンティティー・プロバイダーへの認証リクエストを続行できませんでした。
-couldNotObtainTokenMessage=アイデンティティー・プロバイダーからトークンを取得できませんでした。
-unexpectedErrorRetrievingTokenMessage=アイデンティティー・プロバイダーからのトークン取得で予期せぬエラーが発生しました。
-unexpectedErrorHandlingResponseMessage=アイデンティティー・プロバイダーからの応答を処理する際に予期せぬエラーが発生しました。
-identityProviderAuthenticationFailedMessage=認証に失敗しました。アイデンティティー・プロバイダーを使用して認証できませんでした。
-couldNotSendAuthenticationRequestMessage=アイデンティティー・プロバイダーに認証リクエストを送信することができませんでした。
-unexpectedErrorHandlingRequestMessage=アイデンティティー・プロバイダーへの認証リクエストを処理する際に予期せぬエラーが発生しました。
+couldNotProceedWithAuthenticationRequestMessage=アイデンティティープロバイダーへの認証リクエストを続行できませんでした。
+couldNotObtainTokenMessage=アイデンティティープロバイダーからトークンを取得できませんでした。
+unexpectedErrorRetrievingTokenMessage=アイデンティティープロバイダーからのトークン取得で予期せぬエラーが発生しました。
+unexpectedErrorHandlingResponseMessage=アイデンティティープロバイダーからのレスポンスを処理する際に予期せぬエラーが発生しました。
+identityProviderAuthenticationFailedMessage=認証に失敗しました。アイデンティティープロバイダーを使用して認証できませんでした。
+couldNotSendAuthenticationRequestMessage=アイデンティティープロバイダーに認証リクエストを送信することができませんでした。
+unexpectedErrorHandlingRequestMessage=アイデンティティープロバイダーへの認証リクエストを処理する際に予期せぬエラーが発生しました。
 invalidAccessCodeMessage=無効なアクセスコードです。
 sessionNotActiveMessage=セッションが有効ではありません。
 invalidCodeMessage=エラーが発生しました。アプリケーションを介して再度ログインしてください。
-identityProviderUnexpectedErrorMessage=アイデンティティー・プロバイダーによる認証の際に予期せぬエラーが発生しました
-identityProviderNotFoundMessage=該当の識別子を持つアイデンティティー・プロバイダーが見つかりませんでした。
-identityProviderLinkSuccess=Eメールを正常に確認しました。元のブラウザーに戻ってログインしてください。
-staleCodeMessage=このページはもはや有効ではありませんので、アプリケーションに戻り再度ログインしてください
-realmSupportsNoCredentialsMessage=レルムはクレデンシャル・タイプをサポートしていません。
+identityProviderUnexpectedErrorMessage=アイデンティティープロバイダーによる認証の際に予期せぬエラーが発生しました
+identityProviderNotFoundMessage=該当の識別子を持つアイデンティティープロバイダーが見つかりませんでした。
+identityProviderLinkSuccess=メールを正常に検証しました。元のブラウザーに戻ってログインしてください。
+staleCodeMessage=このページはもはや有効ではありませんので、アプリケーションに戻り再度サインインしてください
+realmSupportsNoCredentialsMessage=レルムはクレデンシャルタイプをサポートしていません。
 credentialSetupRequired=ログインできません。クレデンシャルのセットアップが必要です。
-identityProviderNotUniqueMessage=レルムは複数のアイデンティティー・プロバイダーをサポートしています。どのアイデンティティー・プロバイダーが認証に使用されるべきか判断できませんでした。
+identityProviderNotUniqueMessage=レルムは複数のアイデンティティープロバイダーをサポートしています。どのアイデンティティープロバイダーが認証に使用されるべきか判断できませんでした。
 emailVerifiedMessage=メールアドレスが確認できました。
 staleEmailVerificationLink=クリックしたリンクは古いリンクであり、有効ではありません。おそらく、すでにメールを確認しています。
 identityProviderAlreadyLinkedMessage={0}によって返された連携済みアイデンティティーは、すでに別のユーザーにリンクされています。
-confirmAccountLinking=アイデンティティー・プロバイダー{1}のアカウント{0}とあなたのアカウントとのリンクを確認してください。
-confirmEmailAddressVerification=Eメールアドレス{0}の有効性を確認してください。
-confirmExecutionOfActions=次の操作を実行します。
+confirmAccountLinking=アイデンティティープロバイダー{1}のアカウント{0}とあなたのアカウントとのリンクを確認してください。
+confirmEmailAddressVerification=メールアドレス{0}の有効性を確認してください。
+confirmExecutionOfActions=次の操作を実行します
 backToApplication=&laquo; アプリケーションに戻る
-missingParameterMessage=不足パラメーター\: {0}
+missingParameterMessage=不足しているパラメーター: {0}
 clientNotFoundMessage=クライアントが見つかりません。
 clientDisabledMessage=クライアントが無効になっています。
-invalidParameterMessage=無効なパラメーター\: {0}
+invalidParameterMessage=無効なパラメーター: {0}
 alreadyLoggedIn=既にログインしています。
 differentUserAuthenticated=すでにこのセッションで異なるユーザー''{0}''として認証されています。まずログアウトしてください。
-brokerLinkingSessionExpired=要求されたブローカー・アカウントのリンクは、現在のセッションでは有効ではありません。
+brokerLinkingSessionExpired=要求されたブローカーアカウントのリンクは、現在のセッションでは有効ではありません。
 proceedWithAction=&raquo; 続行するにはここをクリックしてください
 requiredAction.CONFIGURE_TOTP=OTPの設定
 requiredAction.TERMS_AND_CONDITIONS=利用規約
 requiredAction.UPDATE_PASSWORD=パスワードの更新
 requiredAction.UPDATE_PROFILE=プロファイルの更新
-requiredAction.VERIFY_EMAIL=Eメールの確認
-doX509Login=次のユーザーとしてログインします\:
-clientCertificate=X509クライアント証明書\:
+requiredAction.VERIFY_EMAIL=メールアドレスの検証
+doX509Login=次のユーザーとしてログインします:
+clientCertificate=X509クライアント証明書:
 noCertificate=[証明書なし]
 
 
@@ -272,12 +272,12 @@ pageNotFound=ページが見つかりません
 internalServerError=内部サーバーエラーが発生しました
 console-username=ユーザー名:
 console-password=パスワード:
-console-otp=ワンタイム・パスワード:
+console-otp=ワンタイムパスワード:
 console-new-password=新しいパスワード:
 console-confirm-password=パスワードの確認:
 console-update-password=パスワードの更新が必要です。
 console-verify-email=メールアドレスを確認する必要があります。確認コードを含むメールを{0}に送信しました。このコードを以下に入力してください。
-console-email-code=Eメールコード：
+console-email-code=メールコード:
 console-accept-terms=利用規約に同意しますか？ [y/n]:
 console-accept=y
 
@@ -293,33 +293,33 @@ saml.post-form.message=リダイレクトしています。お待ちください
 saml.post-form.js-disabled=JavaScriptが無効になっています。有効にすることを強くお勧めします。継続するには、下のボタンをクリックしてください。
 
 #authenticators
-otp-display-name=オーセンティケーター・アプリケーション
-otp-help-text=オーセンティケーター・アプリケーションから取得した確認コードを入力してください。
+otp-display-name=オーセンティケーターアプリケーション
+otp-help-text=オーセンティケーターアプリケーションから取得した確認コードを入力してください。
 password-display-name=パスワード
-password-help-text=パスワードを入力してログインします。
+password-help-text=パスワードを入力してサインインします。
 auth-username-form-display-name=ユーザー名
-auth-username-form-help-text=ユーザー名を入力してログインを開始します
+auth-username-form-help-text=ユーザー名を入力してサインインを開始します
 auth-username-password-form-display-name=ユーザー名とパスワード
-auth-username-password-form-help-text=ユーザー名とパスワードを入力してログインしてください。
+auth-username-password-form-help-text=ユーザー名とパスワードを入力してサインインしてください。
 
 # WebAuthn
-webauthn-display-name=セキュリティーキー
-webauthn-help-text=セキュリティーキーを使用してログインしてください。
-webauthn-passwordless-display-name=セキュリティーキー
-webauthn-passwordless-help-text=パスワードレス・ログインにセキュリティーキーを使用します。
-webauthn-login-title=セキュリティーキー・ログイン
-webauthn-registration-title=セキュリティーキーの登録
-webauthn-available-authenticators=利用可能なオーセンティケーター
+webauthn-display-name=パスキー
+webauthn-help-text=パスキーを使用してサインインしてください。
+webauthn-passwordless-display-name=パスキー
+webauthn-passwordless-help-text=パスワードレスサインインにパスキーを使用します。
+webauthn-login-title=パスキーログイン
+webauthn-registration-title=パスキーの登録
+webauthn-available-authenticators=利用可能なパスキー
 
 # WebAuthn Error
-webauthn-error-title=セキュリティーキー・エラー
-webauthn-error-registration=セキュリティーキーを登録できませんでした。
-webauthn-error-api-get=セキュリティーキーによる認証に失敗しました。
-webauthn-error-different-user=最初に認証されたユーザーは、セキュリティーキーによって認証されたユーザーではありません。
-webauthn-error-auth-verification=セキュリティーキーの認証結果が無効です。
-webauthn-error-register-verification=セキュリティーキーの登録結果が無効です。
-webauthn-error-user-not-found=セキュリティーキーで認証された不明なユーザー。
-identity-provider-redirector=別のアイデンティティー・プロバイダーと接続する
+webauthn-error-title=パスキーエラー
+webauthn-error-registration=パスキーの登録に失敗しました。<br /> {0}
+webauthn-error-api-get=パスキーによる認証に失敗しました。<br /> {0}
+webauthn-error-different-user=最初に認証されたユーザーは、パスキーによって認証されたユーザーではありません。
+webauthn-error-auth-verification=パスキーの認証結果が無効です。<br /> {0}
+webauthn-error-register-verification=パスキーの登録結果が無効です。<br /> {0}
+webauthn-error-user-not-found=パスキーで認証された不明なユーザー。
+identity-provider-redirector=別のアイデンティティープロバイダーと接続する
 frontchannel-logout.title=ログアウト
 frontchannel-logout.message=以下のアプリケーションからログアウトしました。
 logoutConfirmTitle=ログアウト
@@ -329,9 +329,9 @@ readOnlyUsernameMessage=読み取り専用のため、ユーザー名を更新
 deletingAccountForbidden=アカウントを削除するために必要な権限がありません。管理者に連絡してください。
 loginIdpReviewProfileTitle=アカウント情報の更新
 reauthenticate=続行するためには再ログインしてください
-oauthGrantTos=利用規約
-oauthGrantPolicy=プライバシーポリシー
-emailUpdateConfirmationSentTitle=確認Eメールが送信されました
+oauthGrantTos=利用規約。
+oauthGrantPolicy=プライバシーポリシー。
+emailUpdateConfirmationSentTitle=確認メールが送信されました
 termsAcceptanceRequired=利用規約に同意する必要があります。
 acceptTerms=利用規約に同意します
 deleteCredentialTitle={0}の削除
@@ -349,17 +349,137 @@ totpAppGoogleName=Google Authenticator
 verifyOAuth2DeviceUserCode=デバイスによるコードを入力し、送信をクリックしてください
 oauth2DeviceInvalidUserCodeMessage=無効なコードです、再実行してください。
 errorDeletingAccount=アカウントの削除中にエラーが発生しました
-emailUpdateConfirmationSent=確認Eメールが{0}に送信されました。指示に従い、Eメールの更新を完了してください。
+emailUpdateConfirmationSent=確認メールが{0}に送信されました。指示に従い、メールアドレスの更新を完了してください。
 usb=USB
-internal=Internal
-emailUpdatedTitle=Eメールが更新されました
-unknown=Unknown
-emailUpdated=アカウントのEメールが{0}に更新されました。
+internal=内部
+emailUpdatedTitle=メールアドレスが更新されました
+unknown=不明
+emailUpdated=アカウントのメールアドレスが{0}に更新されました。
 nfc=NFC
-oauth2DeviceExpiredUserCodeMessage=コードの有効期限が切れてします。デバイスに戻り、もう一度お試し下さい。
+oauth2DeviceExpiredUserCodeMessage=コードの有効期限が切れてします。デバイスに戻りもう一度お試し下さい。
 bluetooth=Bluetooth
 organizationScopeConsentText=組織
 phoneNumberVerified=電話番号（確認済）
 totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
-oauth2DeviceAuthorizationGrantDisabledMessage=クライアントはOAuth 2.0 デバイス認可グラントフローを開始することが許可されていません。フローはクライアントに対して無効です。
+oauth2DeviceAuthorizationGrantDisabledMessage=このクライアントはOAuth 2.0 デバイス認可グラントフローを開始することが許可されておらず、このクライアントに対してこのフローは無効化されています。
 userDeletedSuccessfully=ユーザーの削除に成功しました
+authenticateStrong=続行するには強力な認証が必要です。
+oauthGrantReview=レビューすることができます
+updateEmailTitle=メールアドレスの更新
+oauth2DeviceVerificationTitle=デバイスログイン
+oauth2DeviceVerificationCompleteHeader=デバイスログインに成功しました
+oauth2DeviceVerificationCompleteMessage=このブラウザーのウィンドウを閉じて、デバイスに戻ることができます。
+oauth2DeviceVerificationFailedHeader=デバイスログインに失敗しました
+oauthGrantInformation={0}がデータをどのように扱うかを確認し、{0}を信頼してください。
+doConfirmDelete=削除の確認
+notMemberOfAnyOrganization=ユーザーはどの組織にも所属していません
+oauth2DeviceVerificationFailedMessage=このブラウザーのウィンドウを閉じて、使用しているデバイスに戻り、再度接続を試してください。
+oauth2DeviceConsentDeniedMessage=デバイスの接続が拒否されました。
+configureBackupCodesMessage=アカウントを有効にするには、バックアップコードを設定する必要があります。
+identityProviderInvalidResponseMessage=アイデンティティープロバイダーからのレスポンスが無効です。
+identityProviderMissingCodeOrErrorMessage=アイデンティティープロバイダーからのレスポンスにcodeまたはerrorパラメーターがありません。
+emailVerifiedAlreadyMessage=メールアドレスは確認済みです。
+auth-recovery-code-prompt=リカバリーコード#{0}
+auth-recovery-code-header=リカバリー認証コードでログインする
+recovery-codes-error-invalid=無効なリカバリー認証コード
+recovery-code-config-header=リカバリー認証コード
+recovery-codes-print=印刷
+passkey-login-title=パスキーログイン
+passkey-available-authenticators=利用可能なパスキー
+passkey-unsupported-browser-text=このブラウザーではパスキーがサポートされていません。別のブラウザーを試すか、管理者にお問い合わせください。
+idp-email-verification-display-name=メールアドレス検証
+idp-email-verification-help-text=メールアドレスを検証してアカウントをリンクします。
+error-invalid-blank=値を指定してください。
+error-empty=値を指定してください。
+error-invalid-length={1}と{2}の間の長さでなければなりません.
+error-invalid-length-too-short=最小の長さは{1}です。
+error-invalid-uri=無効なURLです。
+error-person-name-invalid-character=値に無効な文字が含まれています。
+error-username-invalid-character=値に無効な文字が含まれています。
+invalidPasswordNotEmailMessage=無効なパスワード: メールアドレスと同じパスワードは禁止されています。
+invalidPasswordNotContainsUsernameMessage=無効なパスワード: ユーザー名を含めることはできません。
+successLogout=ログアウトしました
+acrNotFulfilled=認証要件が満たされていません
+webauthn-unsupported-browser-text=このブラウザーではWebAuthnはサポートされていません。別のブラウザーを試すか、管理者にお問い合わせください。
+webauthn-doAuthenticate=パスキーでサインイン
+webauthn-createdAt-label=作成されました
+webauthn-registration-init-label-prompt=登録したパスキーのラベルを入力してください。
+webauthn-registration-init-label=パスキー（デフォルトラベル）
+passkey-createdAt-label=作成されました
+passkey-autofill-select=パスキーの選択
+emailVerifyInstruction4=メールアドレスを確認するため、これから{0}のアドレスに指示のメールを送ります。
+emailVerifyResend=検証メールを再送する
+emailVerifySend=検証メールを送信する
+sessionLimitExceeded=セッション数が多すぎます。
+identityProviderLogoutFailure=SAML IdPログアウトの失敗
+error-invalid-email=メールアドレスが無効です。
+error-invalid-value=無効な値です。
+error-invalid-number=無効な数値です。
+error-number-out-of-range={1}と{2}の間の数値でなければなりません。
+error-number-out-of-range-too-small={1}の最小値でなければなりません。
+error-number-out-of-range-too-big={2}の最大値でなければなりません。
+error-invalid-uri-scheme=無効なURLスキームです。
+error-invalid-uri-fragment=無効なURLフラグメントです。
+error-user-attribute-required=このフィールドを指定してください。
+error-user-attribute-read-only=このフィールドは読み取り専用です。
+error-reset-otp-missing-id=OTP設定を選択してください.
+federatedIdentityUnavailableMessage=アイデンティティープロバイダー{1}で認証されたユーザー{0}が存在しません。管理者に連絡してください。
+confirmOverrideIdpTitle=ブローカーのリンクがすでに存在します
+federatedIdentityConfirmOverrideMessage=アカウント{0}を{1}のアカウント{2}にリンクしようとしています。しかし、アカウントは既に別の{3}のアカウント{4}とリンクされています。既存のリンクを新しいアカウントに置き換えますか？
+updateEmailMessage=アカウントを有効にするには、メールアドレスを更新する必要があります。
+confirmOverrideIdpContinue=はい、現在のアカウントとのリンクを上書きします
+invalidPasswordMaxLengthMessage=無効なパスワード: 最大長は{0}です。
+identityProviderMissingStateMessage=アイデンティティープロバイダーからのレスポンスにstateパラメーターがありません。
+identityProviderInvalidSignatureMessage=アイデンティティープロバイダーからのレスポンスの署名が無効です。
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=リカバリーコードの生成
+requiredAction.webauthn-register-passwordless=パスワードレスWebAuthnの登録
+requiredAction.webauthn-register=WebAuthnの登録
+invalidTokenRequiredActions=リンクに含まれる必須アクションは無効です
+saml.artifactResolutionServiceInvalidResponse=アーティファクトを解決できません。
+otp-reset-description=どのOTPの設定を削除する必要がありますか？
+auth-x509-client-username-form-display-name=X509証明書
+auth-x509-client-username-form-help-text=X509クライアント証明書を使用してサインインします。
+auth-recovery-authn-code-form-display-name=リカバリー認証コード
+auth-recovery-authn-code-form-help-text=以前に生成されたリストからリカバリー認証コードを入力します。
+auth-recovery-code-info-message=指定されたリカバリーコードを入力してください。
+recovery-codes-download=ダウンロード
+recovery-codes-copy=コピー
+recovery-codes-copied=コピーしました
+recovery-codes-confirmation-message=これらのコードは安全な場所に保存しました。
+recovery-codes-action-complete=セットアップを完了する
+recovery-codes-action-cancel=セットアップをキャンセルする
+recovery-codes-download-file-header=これらのリカバリコードを安全な場所に保管してください。
+recovery-codes-download-file-date=これらのコードは以下で生成されました。
+recovery-codes-label-default=リカバリーコード
+passkey-doAuthenticate=パスキーでサインイン
+identity-provider-login-label=または次の方法でサインイン
+idp-username-password-form-display-name=ユーザー名とパスワード
+idp-username-password-form-help-text=ログインしてアカウントをリンクしてください。
+finalDeletionConfirmation=アカウントを削除すると元に戻すことはできません。アカウントを維持するには「キャンセル」をクリックしてください。
+irreversibleAction=このアクションは不可逆的です。
+deleteAccountConfirm=アカウントの削除の確認
+deletingImplies=アカウントを削除すると、次のようになります:
+errasingData=すべてのデータを消去
+loggingOutImmediately=直ちにログアウト
+accountUnusable=このアカウントでアプリケーションを使用することはできません
+access-denied=アクセスが拒否されました。
+access-denied-when-idp-auth={0}での認証時にアクセスが拒否されました。
+error-invalid-multivalued-size=属性{0}は少なくとも{1}、多くても{2} {2,choice,0#値|1#値|1<値}でなければならない。
+organization.confirm-membership.title=組織${kc.org.name}に参加しようとしています。
+organization.member.register.title=アカウントを作成して${kc.org.name}の組織に参加する
+organization.select=続行するには、以下の組織を選択します。
+notMemberOfOrganization=ユーザーは{0}の組織のメンバーではありません
+error-invalid-length-too-long=最大の長さは{2}です。
+insufficientLevelOfAuthentication=要求された認証レベルが満たされていません。
+error-pattern-no-match=無効な値です。
+recovery-code-config-warning-title=これらのリカバリーコードは、このページを離れるともう表示されません
+emailInstructionUsername=ユーザー名を入力してください。新しいパスワードの作成方法をお知らせします。
+error-invalid-date=無効な日付です。
+organization.confirm-membership=以下のリンクをクリックすると、{0}の組織のメンバーとなります。
+recovery-code-config-warning-message=必ず印刷、ダウンロード、またはパスワードマネージャーにコピーして保管してください。この設定をキャンセルすると、これらのリカバリーコードはアカウントから削除されます。
+recovery-codes-download-file-description=リカバリーコードは、オーセンティケーターにアクセスできない場合にアカウントにサインインするための 1 回限りのパスコードです。
+federatedIdentityUnmatchedEssentialClaimMessage=アイデンティティープロバイダーから発行されたIDトークンが、設定された必須クレームと一致しません。管理者に連絡してください。
+cookieNotFoundMessage=再起動ログインCookieが見つかりません。有効期限が切れているか、削除されているか、ブラウザーでCookieが無効になっている可能性があります。Cookieが無効になっている場合は、有効にしてください。「アプリケーションに戻る」をクリックして再度ログインしてください。
+linkIdpActionTitle={0}をリンク中
+linkIdpActionMessage=アカウントを{0}にリンクしますか？
+confirmAccountLinkingBody=アカウントをリンクすると、IDプロバイダー{1}のアカウント{0}を使用してログインできるようになります。このプロセスを開始していない場合、またはアカウントをリンクしたくない場合は、続行しないでください。
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ka.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ka.properties
index 6ac5865ad20f..1cfde7089e79 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ka.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ka.properties
@@ -105,7 +105,7 @@ identityProviderNotUniqueMessage=რეალმს ერთზე მეტი
 realmSupportsNoCredentialsMessage=რეალმს ავტორიზაციის დეტალების არც ერთი ტიპის მხარდაჭერა გააჩნია.
 emailVerifiedMessage=თქვენი ელფოსტის მისამართი გადამოწმებულია.
 emailVerifiedAlreadyMessage=თქვენი ელფოსტის მისამართი უკვე გადამოწმებულია.
-staleEmailVerificationLink=ბმული, რომელზეც დააწკაპუნეთ, ძველი, უმოქმედო ბმულია და აღარ მუშაობს.    შეიძლება, ელფოსტა უკვე გადაამოწმეთ.
+staleEmailVerificationLink=ბმული, რომელზეც დააწკაპუნეთ, ძველი, უმოქმედო ბმულია და აღარ მუშაობს. შეიძლება, ელფოსტა უკვე გადაამოწმეთ.
 identityProviderAlreadyLinkedMessage=ფედერაციული იდენტიფიკატორი, რომელიც {0}-მა დააბრუნა, უკვე მიბმულია სხვა მომხმარებელზე.
 confirmAccountLinking=დაადასტურეთ ანგარიშის {0} იდენტიფიკატორის მომწოდებლიდან {1} მიბმა თქვენს ანგარიშზე.
 confirmEmailAddressVerification=დაადასტურეთ ელფოსტის მისამართის {0} სისწორე.
@@ -126,12 +126,12 @@ noCertificate=[სერტიფიკატის გარეშე]
 
 pageNotFound=გვერდი ვერ ვიპოვე
 openshift.scope.user_full=სრული წვდომა
-console-verify-email=საჭიროა, გადაამოწმოთ თქვენი ელფოსტის მისამართი.   გამოგიგზავნეთ ელფოსტა {0}-ზე, რომელიც გადამოწმების კოდს შეიცავს.   შეიყვანეთ ეს კოდი ქვემოთ ველში.
+console-verify-email=საჭიროა, გადაამოწმოთ თქვენი ელფოსტის მისამართი. გამოგიგზავნეთ ელფოსტა {0}-ზე, რომელიც გადამოწმების კოდს შეიცავს. შეიყვანეთ ეს კოდი ქვემოთ ველში.
 saml.artifactResolutionServiceInvalidResponse=არტეფაქტის გადაწყვეტა შეუძლებელია.
 openshift.scope.user_check-access=მომხმარებლის წვდომის ინფორმაცია
 openshift.scope.list-projects=პროექტების სია
 otp-help-text=შეიყვანეთ გადამოწმების კოდი ავთენტიკატორი აპლიკაციიდან.
-saml.post-form.js-disabled=JavaScript გათიშულია. გირჩევთ, ჩართოთ ის. გასაგრძელებლად დააწექით ღილაკს ქვემოთ. 
+saml.post-form.js-disabled=JavaScript გათიშულია. გირჩევთ, ჩართოთ ის. გასაგრძელებლად დააწექით ღილაკს ქვემოთ.
 password-display-name=პაროლი
 
 #authenticators
@@ -169,9 +169,9 @@ webauthn-registration-init-label=Passkey (ნაგულისხმევი 
 webauthn-error-title=Passkey-ის შეცდომა
 webauthn-createdAt-label=შეიქმნა
 webauthn-registration-init-label-prompt=შეიყვანეთ თქვენი დარეგისტრირებული Passkey-ის ჭდე
-webauthn-error-registration=თქვენი Passkey-ის რეგისტრაცია ჩავარდა.<br/>{0}
+webauthn-error-registration=თქვენი Passkey-ის რეგისტრაცია ჩავარდა.<br />{0}
 passkey-unsupported-browser-text=Passkey-ის მხარდაჭერა ამ ბრაუზერს არ აქვს. სცადეთ სხვა ან დაუკავშირდით თქვენს ადმინისტრატორს.
-webauthn-error-api-get=Passkey-ით ავთენტიკაცია ჩავარდა.<br/>{0}
+webauthn-error-api-get=Passkey-ით ავთენტიკაცია ჩავარდა.<br />{0}
 passkey-doAuthenticate=Passkey-ით შესვლა
 webauthn-error-different-user=პირველი მომხმარებელი, ვინც ავთენტიკაცია გაიარა, Passkey-ით ავთენტიკაციის მომხმარებელს არ ემთხვევა.
 passkey-createdAt-label=შეიქმნა
@@ -185,7 +185,7 @@ identity-provider-login-label=ან შედით მეთოდით
 idp-username-password-form-help-text=მიაბით თქვენი ანგარიში სისტემაში შესვლით.
 frontchannel-logout.message=მიმდინარეობს თქვენი გასვლა შემდეგი აპებიდან
 logoutConfirmTitle=მიმდინარეობს გასვლა
-finalDeletionConfirmation=თუ თქვენს ანგარიშს წაშლით, მას ვეღარ აღადგენთ. ანგარიშის შესანარჩუნებლად დააწკაპუნეთ ღილაკზე 'გაუქმება'.
+finalDeletionConfirmation=თუ თქვენს ანგარიშს წაშლით, მას ვეღარ აღადგენთ. ანგარიშის შესანარჩუნებლად დააწკაპუნეთ ღილაკზე ''გაუქმება''.
 deleteAccountConfirm=ანგარიშის ინფორმაციის წაშლა
 loggingOutImmediately=დაუყოვნებლივ გაგდებას
 userDeletedSuccessfully=მომხმარებელი წარმატებით წაიშალა
@@ -193,7 +193,7 @@ logoutConfirmHeader=გნებავთ, გახვიდეთ?
 frontchannel-logout.title=მიმდინარეობს გასვლა
 readOnlyUsernameMessage=თქვენ ვერ განაახლებთ თქვენს მომხმარებლის სახელს, რადგან ის მხოლოდ-წაკითხვადია.
 doLogout=გასვლა
-error-invalid-multivalued-size=ატრიბუტი {0} მინიმუმ {1} და მაქსიმუმ {2} მნიშვნელობას უნდა შეიცავდეს.
+error-invalid-multivalued-size=ატრიბუტს {0} უნდა ჰქონდეს მინიმუმ {1} და მაქსიმუმt {2} {2,choice,0#მნიშვნელობა,0<მნიშვნელობა}.
 doLogIn=შესვლა
 doRegister=რეგისტრაცია
 doRegisterSecurityKey=რეგისტრაცია
@@ -208,7 +208,7 @@ doImpersonate=განსახიერება
 doTryAnotherWay=სხვანაირად ცდა
 doConfirmDelete=წაშლის დადასტურება
 kerberosNotConfigured=Kerberos მორგებული არაა
-kerberosNotSetUp=Kerberos მორგებული არა.   ვერ შეხვალთ.
+kerberosNotSetUp=Kerberos მორგებული არა. ვერ შეხვალთ.
 registerTitle=რეგისტრაცია
 loginAccountTitle=შედით თქვენს ანგარიშში
 loginTitle={0}-ში შესვლა
@@ -222,7 +222,7 @@ authenticateStrong=გასაგრძელებლად საჭირო
 oauthGrantTitle={0}-სთან წვდომის მიცემა
 oauthGrantTitleHtml={0}
 oauthGrantInformation=დარწმუნდით, რომ ენდობით {0}-ს ნახვით, როგორ დაამუშავებს {0} თქვენს მონაცემებს.
-oauthGrantReview=შეგიძლიათ, გადახედოთ 
+oauthGrantReview=შეგიძლიათ, გადახედოთ
 oauthGrantTos=გამოყენების პირობებს.
 oauthGrantPolicy=კონფიდენციალობის პოლიტიკა.
 errorTitle=ვწუხვართ...
@@ -298,7 +298,7 @@ loginChooseAuthenticator=აირჩიეთ შესვლის მეთ
 oauthGrantRequest=ანიჭებთ ამ წვდომის უფლებებს?
 inResource=სად
 oauth2DeviceVerificationTitle=მოწყობილობის შესვლა
-verifyOAuth2DeviceUserCode=შეიყვანეთ კოდი, რომელიც თქვენმა მოწყობილობამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე 'გადაცემა'
+verifyOAuth2DeviceUserCode=შეიყვანეთ კოდი, რომელიც თქვენმა მოწყობილობამ მოგაწოდათ და დააწკაპუნეთ ღილაკზე ''გადაცემა''
 oauth2DeviceInvalidUserCodeMessage=არასწორი კოდი. თავიდან სცადეთ.
 oauth2DeviceVerificationCompleteHeader=მოწყობილობის შესვლა წარმატებულია
 emailVerifyInstruction1=ელფოსტა ინსტრუქციებით, რომ გადავამოწმოთ თქვენი ელფოსტის მისამართი, გაიგზავნა მისამართზე {0}.
@@ -403,7 +403,7 @@ couldNotSendAuthenticationRequestMessage=ვერ გავაგზავნ
 invalidAccessCodeMessage=არასწორი წვდომის კოდი.
 sessionNotActiveMessage=სესია აქტიური არაა.
 invalidCodeMessage=აღმოჩენილია შეცდომა. შედით თავიდან თქვენი აპლიკაციით.
-cookieNotFoundMessage=ქუქი ვერ ვიპოვე. დარწმუნდით, რომ ბრაუზერში ქუქიები ჩართული გაქვთ.
+cookieNotFoundMessage=გადატვირთვის შესვლის ქუქი აღმოჩენილი არაა. შეიძლება, მისი ვადა ამოიწურა. ასევე, შეიძლება, ის წაშალეს, ან ბრაუზერში ქუქიები გათიშულია. თუ ქუქიები გათიშულია, ჩართეთ ისინი. დააწკაპუნეთ ''აპლიკაციაზე დაბრუნებაზე'', რომ თავიდან შეხვიდეთ.
 insufficientLevelOfAuthentication=ავთენტიკაციის მოთხოვნილი დონე არ დაკმაყოფილებულა.
 identityProviderUnexpectedErrorMessage=მოულოდნელი შეცდომა იდენტიფიკატორის მომწოდებლით ავთენტიკაციისას
 identityProviderMissingStateMessage=იდენტიფიკატორის მომწოდებლის პასუხში მდგომარეობის პარამეტრი მითითებული არაა.
@@ -448,8 +448,8 @@ recovery-codes-download-file-date=ეს კოდები დააგენ
 webauthn-login-title=Passkey-ით შესვლა
 webauthn-registration-title=Passkey-ისის რეგისტრაცია
 webauthn-available-authenticators=ხელმისაწვდომი Passkeys
-webauthn-error-auth-verification=Passkey-ით ავთენტიკაციის შედეგი არასწორია.<br/>{0}
-webauthn-error-register-verification=Passkey-ის რეგისტრაციის შედეგი არასწორია.<br/>{0}
+webauthn-error-auth-verification=Passkey-ით ავთენტიკაციის შედეგი არასწორია.<br />{0}
+webauthn-error-register-verification=Passkey-ის რეგისტრაციის შედეგი არასწორია.<br />{0}
 webauthn-error-user-not-found=Passkey-ით ავთენტიკაციაგავლილი მომხმარებელი უცნობია.
 irreversibleAction=ეს ქმედება შეუქცევადია
 accountUnusable=ამ ანგარიშით ამის შემდეგ აპლიკაციას ვერ გამოიყენებთ
@@ -470,9 +470,9 @@ doBack=უკან
 doYes=დიახ
 doIgnore=გამოტოვება
 impersonateTitleHtml=<strong>{0}</strong> მომხმარებლის განსახიერება
-loginTimeout=თქვენი შესვლის მცდელობის მოლოდინის ვადა ამოიწურა.    შესვლა თავიდან დაიწყება.
+loginTimeout=თქვენი შესვლის მცდელობის მოლოდინის ვადა ამოიწურა. შესვლა თავიდან დაიწყება.
 deletingAccountForbidden=თქვენ არ გაქვთ საკმარისი წვდომები, რომ საკუთარი ანგარიში წაშალოთ. დაუკავშირდით ადმინისტრატორს.
-bypassKerberosDetail=ან შესული არ ბრძანდებით Kerberos-ით, ან თქვენი ბრაუზერი Kerberos-ით შესვლაზე არაა მორგებული.   გააგრძელეთ შესვლა, ოღონდ სხვა საშუალებებით
+bypassKerberosDetail=ან შესული არ ბრძანდებით Kerberos-ით, ან თქვენი ბრაუზერი Kerberos-ით შესვლაზე არაა მორგებული. გააგრძელეთ შესვლა, ოღონდ სხვა საშუალებებით
 loginTotpTitle=მობილური ავთენტიკატორის მორგება
 loginIdpReviewProfileTitle=ანგარიშის ინფორმაციის განახლება
 organization.confirm-membership.title=აპირებთ, შეუერთდეთ ორგანიზაციას ${kc.org.name}
@@ -482,3 +482,10 @@ auth-x509-client-username-form-display-name=X509 სერტიფიკატ
 auth-x509-client-username-form-help-text=შესვლა X509 კლიენტის სერტიფიკატით.
 organization.select=აირჩიეთ ორგანიზაცია გასაგრძელებლად:
 requiredAction.webauthn-register=Webauthn-ის რეგისტრაცია
+notMemberOfAnyOrganization=მომხმარებელი არც ერთი ორგანიზაციის წევრი არაა
+notMemberOfOrganization=მომხმარებელი არ წარმოადგენს წევრს ორგანიზაციის {0}
+emailVerifyResend=გადამოწმების ელფოსტის თავიდან გაგზავნა
+emailVerifySend=გადამოწმების ელფოსტის გაგზავნა
+emailVerifyInstruction4=თქვენი ელფოსტის მისამართის გადასამოწმებლად ჩვენ ვაპირებთ, გამოგგიზავნოთ ელფოსტა ინსტრუქციებით მისამართზე {0}.
+linkIdpActionTitle={0}-ის დაკავშირება
+linkIdpActionMessage=გნებავთ თქვენი ანგარიშის დაკავსირება {0}-სთან?
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ko.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ko.properties
index f33378de255a..a52a2df397fc 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ko.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ko.properties
@@ -80,7 +80,7 @@ recaptchaFailed=잘못된 Recaptcha
 recaptchaNotConfigured=Recaptcha가 필요하지만 구성되지 않았습니다
 consentDenied=동의 거부됨.
 
-noAccount=새 사용자?
+noAccount=계정이 없으신가요?
 username=사용자 이름
 usernameOrEmail=사용자 이름 또는 이메일
 firstName=이름
@@ -477,12 +477,11 @@ webauthn-registration-init-label-prompt=등록한 패스키의 라벨을 입력
 
 # WebAuthn Error
 webauthn-error-title=패스키 오류
-webauthn-error-registration=패
-webauthn-error-registration=패스키 등록에 실패했습니다.<br/> {0}
-webauthn-error-api-get=패스키로 인증하는 데 실패했습니다.<br/> {0}
+webauthn-error-registration=패스키 등록에 실패했습니다.<br /> {0}
+webauthn-error-api-get=패스키로 인증하는 데 실패했습니다.<br /> {0}
 webauthn-error-different-user=첫 번째 인증된 사용자가 패스키로 인증된 사용자가 아닙니다.
-webauthn-error-auth-verification=패스키 인증 결과가 잘못되었습니다.<br/> {0}
-webauthn-error-register-verification=패스키 등록 결과가 잘못되었습니다.<br/> {0}
+webauthn-error-auth-verification=패스키 인증 결과가 잘못되었습니다.<br /> {0}
+webauthn-error-register-verification=패스키 등록 결과가 잘못되었습니다.<br /> {0}
 webauthn-error-user-not-found=패스키로 인증된 알 수 없는 사용자.
 
 # Passkey
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ky.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ky.properties
new file mode 100644
index 000000000000..86eb7498beb8
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ky.properties
@@ -0,0 +1,540 @@
+doLogIn=Кирүү
+doRegister=Катталуу
+doRegisterSecurityKey=Катталуу
+doCancel=Жокко чыгаруу
+doSubmit=Жөнөтүү
+doBack=Артка
+doYes=Ооба
+doNo=Жок
+doContinue=Улантуу
+doIgnore=Капарга албоо
+doAccept=Кабыл алуу
+doDecline=Баш тартуу
+doForgotPassword=Сырсөздү унуттуңузбу?
+doClickHere=Бул жерди басыңыз
+doImpersonate=Атынан кирүү
+doTryAgain=Кайра аракет кылуу
+doTryAnotherWay=Башка жол менен аракет кылуу
+doConfirmDelete=Өчүрүүнү тастыктоо
+errorDeletingAccount=Аккаунтту өчүрүүдө ката кетти
+deletingAccountForbidden=Өзүңүздүн аккаунтуңузду өчүрүүгө уруксат жетишсиз, администраторго кайрылыңыз.
+kerberosNotConfigured=Kerberos орнотулган эмес
+kerberosNotConfiguredTitle=Kerberos орнотулган эмес
+bypassKerberosDetail=Сиз Kerberos менен кирген жоксуз же браузериңиз Kerberos үчүн туура жөндөөлбөгөн. Башка жол менен кирүү үчүн “Улантуу” баскычын басыңыз.
+kerberosNotSetUp=Kerberos орнотулган эмес. Кире албайсыз.
+registerTitle=Катталуу
+loginAccountTitle=Аккаунтуңузга кириңиз
+loginTitle={0} системасына кириңиз
+loginTitleHtml={0}
+impersonateTitle={0} атынан колдонуучуга кирүү
+impersonateTitleHtml=<strong>{0}</strong> атынан колдонуучуга кирүү
+realmChoice=Realm
+unknownUser=Белгисиз колдонуучу
+loginTotpTitle=Мобилдик аутентификатор орнотуу
+loginProfileTitle=Аккаунт маалыматын жаңылоо
+loginIdpReviewProfileTitle=Аккаунт маалыматын жаңылоо
+loginTimeout=Кирүү аракетиңиздин убактысы өтүп кетти. Кирүү башынан башталат.
+reauthenticate=Улантуу үчүн кайра аутентификациялаңыз
+authenticateStrong=Улантуу үчүн күчтүү аутентификация талап кылынат
+oauthGrantTitle={0} үчүн жеткиликтүүлүк берүү
+oauthGrantTitleHtml={0}
+oauthGrantInformation={0} сиздин маалыматыңызды кантип пайдалана турганын билип, ага ишенсеңиз болорун текшериңиз.
+oauthGrantReview=Сиз текшере аласыз
+oauthGrantTos=кызмат көрсөтүү шарттарын.
+oauthGrantPolicy=купуялык саясатын.
+errorTitle=Кечиресиз...
+errorTitleHtml=Биз <strong>кечирим сурайбыз</strong>...
+emailVerifyTitle=Электрондук почтаны текшерүү
+emailForgotTitle=Сырсөзүңүздү унуттуңузбу?
+updateEmailTitle=Электрондук почтаны жаңылоо
+emailUpdateConfirmationSentTitle=Тастыктоо кат жөнөтүлдү
+emailUpdateConfirmationSent={0} дарегине тастыктоо кат жөнөтүлдү. Электрондук почтаны жаңылоо үчүн көрсөтмөлөрдү аткарыңыз.
+emailUpdatedTitle=Электрондук почта жаңыртылды
+emailUpdated=Аккаунттун электрондук почтасы {0} дарегине ийгиликтүү жаңыртылды.
+updatePasswordTitle=Сырсөздү жаңылоо
+codeSuccessTitle=Ийгиликтүү код
+codeErrorTitle=Ката коду\: {0}
+displayUnsupported=Талап кылынган дисплей түрү колдоого алынбайт
+browserRequired=Кирүү үчүн браузер талап кылынат
+browserContinue=Кирүүнү аяктоо үчүн браузер талап кылынат
+browserContinuePrompt=Браузерди ачып, кирүүнү улантуу керек. Улантабызбы? [о/ж]:
+browserContinueAnswer=о
+
+# Transports
+usb=USB
+nfc=NFC
+bluetooth=Bluetooth
+internal=Ички
+unknown=Белгисиз
+
+termsTitle=Шарттар жана эрежелер
+termsText=<p>Шарттар жана эрежелер кийин аныкталат</p>
+termsPlainText=Шарттар жана эрежелер кийин аныкталат.
+termsAcceptanceRequired=Шарттар жана эрежелерге макул болушуңуз керек.
+acceptTerms=Шарттар жана эрежелерге макулмун
+
+deleteCredentialTitle={0} өчүрүү
+deleteCredentialMessage={0} өчүрүүнү каалайсызбы?
+
+linkIdpActionTitle={0} туташтыруу
+linkIdpActionMessage=Аккаунтуңузду {0} менен туташтыргыңыз келеби?
+
+recaptchaFailed=Жараксыз Recaptcha
+recaptchaNotConfigured=Recaptcha талап кылынат, бирок орнотулган эмес
+consentDenied=Макулдук берилген жок.
+
+noAccount=Жаңы колдонуучу?
+username=Колдонуучу аты
+usernameOrEmail=Колдонуучу аты же электрондук почта
+firstName=Атыңыз
+givenName=Берилген ат
+fullName=Толук аты-жөнү
+lastName=Фамилия
+familyName=Үй-бүлөлүк ат
+email=Электрондук почта
+password=Сырсөз
+passwordConfirm=Сырсөздү тастыктоо
+passwordNew=Жаңы сырсөз
+passwordNewConfirm=Жаңы сырсөздү тастыктоо
+hidePassword=Сырсөздү жашыруу
+showPassword=Сырсөздү көрсөтүү
+rememberMe=Эсимде сактоо
+authenticatorCode=Бир жолку код
+address=Дарек
+street=Көчө
+locality=Шаар же калктуу конуш
+region=Област, провинция же регион
+postal_code=Индекс же почта коду
+country=Өлкө
+emailVerified=Электрондук почта тастыкталды
+website=Веб-баракча
+phoneNumber=Телефон номери
+phoneNumberVerified=Телефон номери тастыкталды
+gender=Жынысы
+birthday=Туулган күнү
+zoneinfo=Убакыт алкагы
+gssDelegationCredential=GSS ыйгарым укук берүү маалыматы
+logoutOtherSessions=Башка түзмөктөрдөн чыгуу
+
+profileScopeConsentText=Колдонуучунун профили
+emailScopeConsentText=Электрондук почта дареги
+addressScopeConsentText=Дарек
+phoneScopeConsentText=Телефон номери
+offlineAccessScopeConsentText=Офлайн кирүү
+samlRoleListScopeConsentText=Менин ролдорум
+rolesScopeConsentText=Колдонуучу ролдору
+organizationScopeConsentText=Уюм
+
+restartLoginTooltip=Кирүүнү кайра баштоо
+
+loginTotpIntro=Бул аккаунтка кирүү үчүн Бир жолку сырсөз генераторун орнотушуңуз керек
+loginTotpStep1=Мобилдик түзмөгүңүзгө төмөнкү колдонмолордун бирин орнотуңуз:
+loginTotpStep2=Колдонмону ачыңыз жана штрих-кодду сканердеңиз:
+loginTotpStep3=Колдонмо берген бир жолку кодду киргизип, орнотууну бүтүрүү үчүн Жөнөтүү баскычын басыңыз.
+loginTotpStep3DeviceName=OTP түзмөктөрүңүздү башкарууга жардам берүү үчүн түзмөктүн атын киргизиңиз.
+loginTotpManualStep2=Колдонмону ачыңыз жана ачкычты киргизиңиз:
+loginTotpManualStep3=Эгер колдонмо орнотууларды колдосо, төмөнкү конфигурация маанилерин пайдаланыңыз:
+loginTotpUnableToScan=Сканерлөө мүмкүн эмеспи?
+loginTotpScanBarcode=Штрих-кодду сканерлөө керекпи?
+loginCredential=Маалымат
+loginOtpOneTime=Бир жолку код
+loginTotpType=Түрү
+loginTotpAlgorithm=Алгоритм
+loginTotpDigits=Сандардын саны
+loginTotpInterval=Интервал
+loginTotpCounter=Санак
+loginTotpDeviceName=Түзмөктүн аты
+
+loginTotp.totp=Убакытка негизделген
+loginTotp.hotp=Санакка негизделген
+
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+
+loginChooseAuthenticator=Кирүү ыкмасын тандаңыз
+
+oauthGrantRequest=Бул мүмкүнчүлүктөргө уруксат бересизби?
+inResource= ичинде
+
+oauth2DeviceVerificationTitle=Түзмөктөн кирүү
+verifyOAuth2DeviceUserCode=Түзмөгүңүз берген кодду киргизип, Жөнөтүү баскычын басыңыз
+oauth2DeviceInvalidUserCodeMessage=Жараксыз код, кайра аракет кылыңыз.
+oauth2DeviceExpiredUserCodeMessage=Коддун мөөнөтү өттү. Түзмөгүңүзгө кайтып барып, кайра туташтырууга аракет кылыңыз.
+oauth2DeviceVerificationCompleteHeader=Түзмөктөн кирүү ийгиликтүү өттү
+oauth2DeviceVerificationCompleteMessage=Бул браузер терезесин жаап, түзмөгүңүзгө кайта аласыз.
+oauth2DeviceVerificationFailedHeader=Түзмөктөн кирүү ишке ашкан жок
+oauth2DeviceVerificationFailedMessage=Бул браузер терезесин жаап, түзмөгүңүзгө кайтып барып кайра туташтырууга аракет кылыңыз.
+oauth2DeviceConsentDeniedMessage=Түзмөктү туташтырууга макулдук берилген жок.
+oauth2DeviceAuthorizationGrantDisabledMessage=Клиентке OAuth 2.0 Түзмөк Авторизациясын баштоо уруксат берилген эмес. Бул агым клиент үчүн өчүрүлгөн.
+
+emailVerifyInstruction1={0} дарегине электрондук почтаңызды тастыктоо боюнча көрсөтмөлөрдү камтыган кат жөнөтүлдү.
+emailVerifyInstruction2=Тастыктоо коду электрондук почтаңызга келбеди беле?
+emailVerifyInstruction3=катты кайра жөнөтүү үчүн.
+emailVerifyInstruction4={0} дарегине электрондук почтаңызды тастыктоо үчүн көрсөтмөлөрдү камтыган кат жөнөтүлөт.
+emailVerifyResend=Тастыктоо катын кайра жөнөтүү
+emailVerifySend=Тастыктоо катын жөнөтүү
+
+emailLinkIdpTitle={0} туташтыруу
+emailLinkIdp1={0} аккаунтун {1} сиздин {2} аккаунтуңузга туташтыруу боюнча көрсөтмөлөрдү камтыган кат сизге жөнөтүлдү.
+emailLinkIdp2=Тастыктоо коду электрондук почтаңызга келбеди беле?
+emailLinkIdp3=катты кайра жөнөтүү үчүн.
+emailLinkIdp4=Эгер башка браузерде электрондук почтаны тастыктап койгон болсоңуз,
+emailLinkIdp5=ушуну улантуу үчүн.
+
+backToLogin=&laquo; Кирүүгө кайтуу
+
+emailInstruction=Колдонуучу атыңызды же электрондук почта дарегиңизди киргизиңиз, биз сизге жаңы сырсөз түзүү боюнча көрсөтмөлөрдү жөнөтөбүз.
+emailInstructionUsername=Колдонуучу атыңызды киргизиңиз, биз сизге жаңы сырсөз түзүү боюнча көрсөтмөлөрдү жөнөтөбүз.
+
+copyCodeInstruction=Бул кодду көчүрүп, колдонмоңузга чаптаңыз:
+
+pageExpiredTitle=Баракча мөөнөтү бүткөн
+pageExpiredMsg1=Кирүү процессин кайра баштоо үчүн
+pageExpiredMsg2=Кирүү процессин улантуу үчүн
+
+personalInfo=Жеке маалымат:
+role_admin=Админ
+role_realm-admin=Реалмдин админи
+role_create-realm=Реалм түзүү
+role_create-client=Клиент түзүү
+role_view-realm=Реалмды карап чыгуу
+role_view-users=Колдонуучуларды карап чыгуу
+role_view-applications=Колдонмолорду карап чыгуу
+role_view-clients=Клиенттерди карап чыгуу
+role_view-events=Окуяларды карап чыгуу
+role_view-identity-providers=Аутентификация провайдерлерин карап чыгуу
+role_manage-realm=Реалмди башкаруу
+role_manage-users=Колдонуучуларды башкаруу
+role_manage-applications=Колдонмолорду башкаруу
+role_manage-identity-providers=Аутентификация провайдерлерин башкаруу
+role_manage-clients=Клиенттерди башкаруу
+role_manage-events=Окуяларды башкаруу
+role_view-profile=Профилди карап чыгуу
+role_manage-account=Аккаунтту башкаруу
+role_manage-account-links=Аккаунт шилтемелерин башкаруу
+role_read-token=Токенди окуу
+role_offline-access=Офлайн кирүү
+client_account=Аккаунт
+client_account-console=Аккаунт консолу
+client_security-admin-console=Коопсуздук админ консолу
+client_admin-cli=Админ CLI
+client_realm-management=Реалмди башкаруу
+client_broker=Брокер
+
+requiredFields=Милдеттүү талаалар
+
+invalidUserMessage=Жараксыз колдонуучу аты же сырсөз.
+invalidUsernameMessage=Жараксыз колдонуучу аты.
+invalidUsernameOrEmailMessage=Жараксыз колдонуучу аты же электрондук почта.
+invalidPasswordMessage=Жараксыз сырсөз.
+invalidEmailMessage=Жараксыз электрондук почта дареги.
+accountDisabledMessage=Аккаунт өчүрүлгөн, администратор менен байланышыңыз.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+accountTemporarilyDisabledMessage=Жараксыз колдонуучу аты же сырсөз.
+accountPermanentlyDisabledMessage=Жараксыз колдонуучу аты же сырсөз.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+accountTemporarilyDisabledMessageTotp=Жараксыз аутентификатор коду.
+accountPermanentlyDisabledMessageTotp=Жараксыз аутентификатор коду.
+expiredCodeMessage=Кирүү мөөнөтү бүткөн. Кайра кирип чыгыңыз.
+expiredActionMessage=Иш-аракет мөөнөтү бүткөн. Азыр кирүүнү улантыңыз.
+expiredActionTokenNoSessionMessage=Иш-аракет мөөнөтү бүткөн.
+expiredActionTokenSessionExistsMessage=Иш-аракет мөөнөтү бүткөн. Кайра баштаңыз.
+sessionLimitExceeded=Сессиялардын саны ашып кетти
+identityProviderLogoutFailure=SAML IdP чыгуу ийгиликсиз болду
+
+missingFirstNameMessage=Атын көрсөтүңүз.
+missingLastNameMessage=Фамилияны көрсөтүңүз.
+missingEmailMessage=Электрондук почтаңызды көрсөтүңүз.
+missingUsernameMessage=Колдонуучу атыңызды көрсөтүңүз.
+missingPasswordMessage=Сырсөзүңүздү көрсөтүңүз.
+missingTotpMessage=Аутентификатор кодун көрсөтүңүз.
+missingTotpDeviceNameMessage=Түзмөктүн атын көрсөтүңүз.
+notMatchPasswordMessage=Сырсөздөр дал келбейт.
+
+error-invalid-value=Жараксыз маани.
+error-invalid-blank=Маанини көрсөтүңүз.
+error-empty=Маанини көрсөтүңүз.
+error-invalid-length=Узундугу {1} менен {2} ортосунда болушу керек.
+error-invalid-length-too-short=Минималдуу узундук {1}.
+error-invalid-length-too-long=Максималдуу узундук {2}.
+error-invalid-email=Жараксыз электрондук почта дареги.
+error-invalid-number=Жараксыз сан.
+error-number-out-of-range=Сан {1} менен {2} ортосунда болушу керек.
+error-number-out-of-range-too-small=Сан минималдуу {1} болушу керек.
+error-number-out-of-range-too-big=Сан максималдуу {2} болушу керек.
+error-pattern-no-match=Жараксыз маани.
+error-invalid-uri=Жараксыз URL.
+error-invalid-uri-scheme=Жараксыз URL схемасы.
+error-invalid-uri-fragment=Жараксыз URL бөлүгү.
+error-user-attribute-required=Бул талааны көрсөтүңүз.
+error-invalid-date=Жараксыз дата.
+error-user-attribute-read-only=Бул талаа окууга гана ачылган.
+error-username-invalid-character=Мааниде жараксыз символ бар.
+error-person-name-invalid-character=Мааниде жараксыз символ бар.
+error-reset-otp-missing-id=OTP конфигурациясын тандаңыз.
+
+invalidPasswordExistingMessage=Жараксыз бар сырсөз.
+invalidPasswordBlacklistedMessage=Жараксыз сырсөз: сырсөз кара тизмеде.
+invalidPasswordConfirmMessage=Сырсөздү тастыктоо дал келбейт.
+invalidTotpMessage=Жараксыз аутентификатор коду.
+
+usernameExistsMessage=Колдонуучу аты мурунтан бар.
+emailExistsMessage=Электрондук почта мурунтан бар.
+
+federatedIdentityExistsMessage={0} {1} менен колдонуучу мурунтан бар. Аккаунтту туташтыруу үчүн аккаунт башкарууга кириңиз.
+federatedIdentityUnavailableMessage={0} колдонуучу {1} аутентификация провайдери менен жок. Администраторго кайрылыңыз.
+federatedIdentityUnmatchedEssentialClaimMessage=Аутентификация провайдери тарабынан берилген ID токен конфигурацияланган негизги талабы менен дал келбейт. Администраторго кайрылыңыз.
+
+confirmLinkIdpTitle=Аккаунт мурунтан бар
+confirmOverrideIdpTitle=Брокер шилтемеси мурунтан бар
+federatedIdentityConfirmLinkMessage={0} {1} менен колдонуучу мурунтан бар. Кантип улантасыңыз келет?
+federatedIdentityConfirmOverrideMessage=Сиз аккаунтуңузду {0} менен {1} аккаунту {2} туташтырыгыңыз келет. Бирок аккаунтуңуз башка {3} аккаунту {4} менен мурунтан туташтырылган. Мурунку шилтемени жаңы аккаунт менен алмаштырууну тастыктайсызбы?
+federatedIdentityConfirmReauthenticateMessage=Аккаунтуңузду {0} менен туташтыруу үчүн аутентификациялаңыз
+nestedFirstBrokerFlowMessage={0} колдонуучу {1} эч кандай белгилүү колдонуучуга туташкан эмес.
+confirmLinkIdpReviewProfile=Профилди карап чыгуу
+confirmLinkIdpContinue=Мурунку аккаунтка кошуу
+confirmOverrideIdpContinue=Ооба, шилтемени азыркы аккаунт менен алмаштыруу
+
+configureTotpMessage=Аккаунтыңызды активдеш үчүн Мобилдик Аутентификаторду орнотуңуз.
+configureBackupCodesMessage=Аккаунтыңызды активдеш үчүн Камсыздоочу коддорду орнотуңуз.
+updateProfileMessage=Аккаунтыңызды активдеш үчүн колдонуучу профилиңизди жаңылаңыз.
+updatePasswordMessage=Аккаунтыңызды активдеш үчүн сырсөзүңүздү өзгөртүңүз.
+updateEmailMessage=Аккаунтыңызды активдеш үчүн электрондук почтаңызды жаңылаңыз.
+resetPasswordMessage=Сырсөзүңүздү өзгөртүшүңүз керек.
+verifyEmailMessage=Аккаунтыңызды активдеш үчүн электрондук почтаңызды тастыктаңыз.
+linkIdpMessage=Аккаунтуңузду {0} менен туташтыруу үчүн электрондук почтаңызды тастыкташыңыз керек.
+
+emailSentMessage=Жакында сизге кошумча көрсөтмөлөрү бар электрондук кат келет.
+emailSendErrorMessage=Кат жөнөтүү мүмкүн болбоду, кайрадан аракет кылыңыз.
+
+accountUpdatedMessage=Аккаунтуңуз жаңыланды.
+accountPasswordUpdatedMessage=Сырсөзүңүз жаңыланды.
+
+delegationCompleteHeader=Кирүү ийгиликтүү өттү
+delegationCompleteMessage=Бул браузерди жаап, консолдук колдонмоңузга кайта аласыз.
+delegationFailedHeader=Кирүү ишке ашкан жок
+delegationFailedMessage=Бул браузерди жаап, консолдук колдонмоңузга кайтып, кайрадан кирүүгө аракет кылыңыз.
+
+noAccessMessage=Кирүү мүмкүнчүлүгү жок
+
+invalidPasswordMinLengthMessage=Сырсөз жараксыз: минималдуу узундук {0}.
+invalidPasswordMaxLengthMessage=Сырсөз жараксыз: максималдуу узундук {0}.
+invalidPasswordMinDigitsMessage=Сырсөз жараксыз: жок дегенде {0} сандык белгини камтышы керек.
+invalidPasswordMinLowerCaseCharsMessage=Сырсөз жараксыз: жок дегенде {0} кичинекей тамганы камтышы керек.
+invalidPasswordMinUpperCaseCharsMessage=Сырсөз жараксыз: жок дегенде {0} чоң тамганы камтышы керек.
+invalidPasswordMinSpecialCharsMessage=Сырсөз жараксыз: жок дегенде {0} атайын белгини камтышы керек.
+invalidPasswordNotUsernameMessage=Сырсөз жараксыз: колдонуучунун аты менен дал келбеши керек.
+invalidPasswordNotContainsUsernameMessage=Сырсөз жараксыз: колдонуучунун атын камтыбайт.
+invalidPasswordNotEmailMessage=Сырсөз жараксыз: электрондук почта менен дал келбеши керек.
+invalidPasswordRegexPatternMessage=Сырсөз жараксыз: белгиленген үлгүгө туура келбейт.
+invalidPasswordHistoryMessage=Сырсөз жараксыз: акыркы {0} сырсөздөрдүн бирине дал келбеши керек.
+invalidPasswordGenericMessage=Сырсөз жараксыз: жаңы сырсөз саясатка туура келбейт.
+
+failedToProcessResponseMessage=Жоопту иштеп чыгууда ката кетти
+httpsRequiredMessage=HTTPS керек
+realmNotEnabledMessage=Realm иштетилген эмес
+invalidRequestMessage=Жарамсыз сурануу
+successLogout=Сиз чыгарылдыңыз
+failedLogout=Чыгуу ишке ашкан жок
+unknownLoginRequesterMessage=Белгисиз кирүү суралышы
+loginRequesterNotEnabledMessage=Кирүү суралышы иштетилген эмес
+bearerOnlyMessage=Bearer-only колдонмолор браузер аркылуу кирүүнү баштай алышпайт
+standardFlowDisabledMessage=Клиент берилген response_type менен браузер кирүүсүн баштай албайт. Стандарттык процесс өчүрүлгөн.
+implicitFlowDisabledMessage=Клиент берилген response_type менен браузер кирүүсүн баштай албайт. Имплициттик процесс өчүрүлгөн.
+invalidRedirectUriMessage=Жарамсыз кайра багыттоо URI
+unsupportedNameIdFormatMessage=Колдоого алынбаган NameIDFormat
+invalidRequesterMessage=Жарамсыз суралышы
+registrationNotAllowedMessage=Тиркелүү мүмкүн эмес
+resetCredentialNotAllowedMessage=Креденциалды кайра коюу мүмкүн эмес
+
+permissionNotApprovedMessage=Рухсат берилген эмес.
+noRelayStateInResponseMessage=Identity provider жоопунда relay state жок.
+insufficientPermissionMessage=Идентификаторлорду туташтыруу үчүн уруксат жетишсиз.
+couldNotProceedWithAuthenticationRequestMessage=Identity providerге аутентификация сурамын жибере алган жок.
+couldNotObtainTokenMessage=Identity providerден токенди ала алган жок.
+unexpectedErrorRetrievingTokenMessage=Identity providerден токен алууда күтүлбөгөн ката.
+unexpectedErrorHandlingResponseMessage=Identity providerден жоопту иштетүүдө күтүлбөгөн ката.
+identityProviderAuthenticationFailedMessage=Аутентификация өтпөдү. Identity provider менен байланышуу мүмкүн болгон жок.
+couldNotSendAuthenticationRequestMessage=Identity providerге аутентификация сурамын жибере алган жок.
+unexpectedErrorHandlingRequestMessage=Identity providerге аутентификация сурамын иштетүүдө күтүлбөгөн ката.
+invalidAccessCodeMessage=Жарамсыз кирүү коду.
+sessionNotActiveMessage=Сессия активдүү эмес.
+invalidCodeMessage=Ката кетти, өтүнөмүн колдонмоңуз аркылуу кайра кириңиз.
+cookieNotFoundMessage=Кайра кирүү cookie табылган жок. Мүмкүн, мөөнөтү бүткөн; өчүрүлгөн же браузердеги cookie өчүрүлгөн. Эгерде cookie өчүрүлгөн болсо, аны күйгүзүңүз. Кирүү үчүн колдонмоңузга кайтуу баскычын басыңыз.
+insufficientLevelOfAuthentication=Суралган аутентификация деңгээли жетишсиз.
+identityProviderUnexpectedErrorMessage=Identity provider менен аутентификациялоодо күтүлбөгөн ката
+identityProviderMissingStateMessage=Identity provider жоопунда state параметри жок.
+identityProviderMissingCodeOrErrorMessage=Identity provider жоопунда код же ката параметри жок.
+identityProviderInvalidResponseMessage=Identity provider жооп жараксыз.
+identityProviderInvalidSignatureMessage=Identity provider жооптогу кол тамга жараксыз.
+identityProviderNotFoundMessage=Белгилеген identity provider табылган жок.
+identityProviderLinkSuccess=Электрондук почтаңыз ийгиликтүү тастыкталды. Баштапкы браузериңизге кайтып, андан ары кирүүнү улантыңыз.
+staleCodeMessage=Бул барак жараксыз болуп калды, өтүнөмүн колдонмоңузга кайтып, кайра кириңиз
+realmSupportsNoCredentialsMessage=Realm эч кандай креденциал түрүн колдобойт.
+credentialSetupRequired=Кирүү мүмкүн эмес, креденциал орнотуу зарыл.
+identityProviderNotUniqueMessage=Realm бир нече identity providerлерди колдойт. Кайсы identity provider аутентификация үчүн колдонуларын аныктоо мүмкүн болбой жатат.
+emailVerifiedMessage=Электрондук почтаңыз тастыкталды.
+emailVerifiedAlreadyMessage=Электрондук почтаңыз мурунтан тастыкталган.
+staleEmailVerificationLink=Сиз баскан шилтеме эски, жараксыз болуп калды. Балким, сиз почтаңызды мурунтан тастыктагансыз.
+identityProviderAlreadyLinkedMessage={0} аркылуу келген федерацияланган идентификация мурунтан башка колдонуучу менен байланышкан.
+confirmAccountLinking=Идентификатор провайдер {1} аркылуу аккаунт {0} туташтырууну тастыктаңыз.
+confirmEmailAddressVerification=Электрондук почта дареги {0} жарактуулугун тастыктаңыз.
+confirmExecutionOfActions=Төмөнкү аракет(тер)ди аткарыңыз
+
+backToApplication=&laquo; Колдонууга кайтуу
+missingParameterMessage=Жок параметрлер\: {0}
+clientNotFoundMessage=Кардар табылган жок.
+clientDisabledMessage=Кардар өчүрүлгөн.
+invalidParameterMessage=Туура эмес параметр\: {0}
+alreadyLoggedIn=Сиз буга чейин кирип жатасыз.
+differentUserAuthenticated=Бул сессияда сиз башка колдонуучу ''{0}'' катары аутентификациядан өттүңүз. Сураныч, биринчи чыгып кетиңиз.
+brokerLinkingSessionExpired=Каржылоочу эсепти байланыштыруу суралып, бирок учурдагы сессия жараксыз болду.
+proceedWithAction=&raquo; Улантуу үчүн бул жерди чыкылдатыңыз
+acrNotFulfilled=Аутентификация талаптары аткарылган жок
+
+requiredAction.CONFIGURE_TOTP=OTP орнотуу
+requiredAction.TERMS_AND_CONDITIONS=Шарттар жана эрежелер
+requiredAction.UPDATE_PASSWORD=Сырсөздү жаңыртуу
+requiredAction.UPDATE_PROFILE=Профилди жаңыртуу
+requiredAction.VERIFY_EMAIL=Электрондук почтаны текшерүү
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Калыбына келтирүү коддорун түзүү
+requiredAction.webauthn-register-passwordless=Webauthn сырсөзсүз каттоо
+requiredAction.webauthn-register=Webauthn каттоо
+
+invalidTokenRequiredActions=Сылтамадагы талап кылынган аракеттер жараксыз
+
+doX509Login=Сиз катары киресиз\:
+clientCertificate=X509 кардар сертификаты\:
+noCertificate=[Сертификат жок]
+
+
+pageNotFound=Бет табылган жок
+internalServerError=Ички сервердик ката болуп калды
+
+console-username=Колдонуучу аты:
+console-password=Сырсөз:
+console-otp=Бир жолку сырсөз:
+console-new-password=Жаңы сырсөз:
+console-confirm-password=Сырсөздү тастыктоо:
+console-update-password=Сырсөздү жаңыртуу талап кылынат.
+console-verify-email=Сиздин электрондук почтаңызды текшерүү керек. Биз {0} дарегине текшерүү коду бар кат жөнөттүк. Төмөнкү талаага ошол кодду киргизиңиз.
+console-email-code=Электрондук почта коду:
+console-accept-terms=Шарттарды кабыл алдыңызбы? [о/ж]:
+console-accept=о
+
+# Openshift messages
+openshift.scope.user_info=Колдонуучу маалыматы
+openshift.scope.user_check-access=Колдонуучунун кирүү укугу
+openshift.scope.user_full=Толук укук
+openshift.scope.list-projects=Проекттерди тизмелөө
+
+# SAML authentication
+saml.post-form.title=Аутентификацияга кайра багыттоо
+saml.post-form.message=Кайра багытталууда, күтө туруңуз.
+saml.post-form.js-disabled=JavaScript өчүрүлгөн. Аны күйгүзүүнү сунуштайбыз. Улантуу үчүн төмөнкү баскычты чыкылдатыңыз.
+saml.artifactResolutionServiceInvalidResponse=Артефакт чечилип кеткен жок.
+
+#authenticators
+otp-display-name=Аутентификатор колдонмосу
+otp-help-text=Аутентификатор колдонмосунан алынган текшерүү кодун киргизиңиз.
+otp-reset-description=Кайсы OTP конфигурациясын алып салууну каалайсыз?
+password-display-name=Сырсөз
+password-help-text=Сырсөзүңүздү киргизип кириңиз.
+auth-username-form-display-name=Колдонуучу аты
+auth-username-form-help-text=Колдонуучу атыңызды киргизүү менен аутентификацияны баштаңыз
+auth-username-password-form-display-name=Колдонуучу аты жана сырсөз
+auth-username-password-form-help-text=Колдонуучу атыңызды жана сырсөзүңүздү киргизүү менен кириңиз.
+auth-x509-client-username-form-display-name=X509 Сертификат
+auth-x509-client-username-form-help-text=X509 кардар сертификаты менен кириңиз.
+
+# Recovery Codes
+auth-recovery-authn-code-form-display-name=Калыбына келтирүү аутентификация коду
+auth-recovery-authn-code-form-help-text=Мурда түзүлгөн тизмеден калыбына келтирүү аутентификация кодун киргизиңиз.
+auth-recovery-code-info-message=Көрсөтүлгөн калыбына келтирүү кодун киргизиңиз.
+auth-recovery-code-prompt=Калыбына келтирүү коду #{0}
+auth-recovery-code-header=Калыбына келтирүү аутентификация коду менен кириңиз
+recovery-codes-error-invalid=Туура эмес калыбына келтирүү коду
+recovery-code-config-header=Калыбына келтирүү аутентификация коддору
+recovery-code-config-warning-title=Бул калыбына келтирүү коддору баракты таштап кеткенден кийин кайра көрүнбөйт
+recovery-code-config-warning-message=Аларды басып чыгаруу, жүктөп алуу же сырсөз менеджерине көчүрүү жана коопсуз жерде сактоо маанилүү. Бул орнотууну жокко чыгаруу аккаунтуңуздан бул коддорду алып салат.
+recovery-codes-print=Басып чыгаруу
+recovery-codes-download=Жүктөп алуу
+recovery-codes-copy=Көчүрүү
+recovery-codes-copied=Көчүрүлдү
+recovery-codes-confirmation-message=Бул коддорду коопсуз жерде сактадым
+recovery-codes-action-complete=Орнотууну бүтүрүү
+recovery-codes-action-cancel=Орнотууну жокко чыгаруу
+recovery-codes-download-file-header=Бул калыбына келтирүү коддорун коопсуз жерде сактаңыз.
+recovery-codes-download-file-description=Калыбына келтирүү коддору бир жолу колдонулуучу сырсөздөр болуп, эгер аутентификаторго кире албасаңыз, аккаунтуңузга кирүүгө мүмкүндүк берет.
+recovery-codes-download-file-date=Бул коддор түзүлгөн күнү
+recovery-codes-label-default=Калыбына келтирүү коддору
+
+# WebAuthn
+webauthn-display-name=Парольсуз ачкыч
+webauthn-help-text=Кириүү үчүн Парольсуз ачкычты колдонуңуз.
+webauthn-passwordless-display-name=Парольсуз ачкыч
+webauthn-passwordless-help-text=Парольсуз кириүү үчүн Парольсуз ачкычты колдонуңуз.
+webauthn-login-title=Парольсуз ачкыч менен кирүү
+webauthn-registration-title=Парольсуз ачкыч каттоо
+webauthn-available-authenticators=Бар болгон Парольсуз ачкычтар
+webauthn-unsupported-browser-text=Бул браузер WebAuthn колдобойт. Башка браузерди колдонуп көрүңүз же администратор менен байланышыңыз.
+webauthn-doAuthenticate=Парольсуз ачкыч менен кириңиз
+webauthn-createdAt-label=Түзүлгөн күнү
+webauthn-registration-init-label=Парольсуз ачкыч (Тандалган аталыш)
+webauthn-registration-init-label-prompt=Катталган парольсуз ачкычыңыздын аталышын киргизиңиз
+
+
+# WebAuthn Error
+webauthn-error-title=Парольсуз ачкыч катасы
+webauthn-error-registration=Парольсуз ачкычты каттоо ийгиликсиз аяктады.<br /> {0}
+webauthn-error-api-get=Парольсуз ачкыч менен аутентификациядан өтүү мүмкүн болгон жок.<br /> {0}
+webauthn-error-different-user=Биринчи аутентификацияланган колдонуучу парольсуз ачкыч менен аутентификацияланган эмес.
+webauthn-error-auth-verification=Парольсуз ачкыч менен аутентификация жыйынтыгы жараксыз.<br /> {0}
+webauthn-error-register-verification=Парольсуз ачкыч каттоосу жараксыз.<br /> {0}
+webauthn-error-user-not-found=Парольсуз ачкыч менен аутентификацияланган белгисиз колдонуучу.
+
+# Passkey
+passkey-login-title=Парольсуз ачкыч менен кирүү
+passkey-available-authenticators=Бар болгон Парольсуз ачкычтар
+passkey-unsupported-browser-text=Бул браузер Парольсуз ачкычты колдобойт. Башка браузерди колдонуп көрүңүз же администратор менен байланышыңыз.
+passkey-doAuthenticate=Парольсуз ачкыч менен кириңиз
+passkey-createdAt-label=Түзүлгөн күнү
+passkey-autofill-select=Парольсуз ачкычыңызды тандаңыз
+
+# Identity provider
+identity-provider-redirector=Башка инсандык провайдер менен байланыштыруу
+identity-provider-login-label=Же мында кириңиз
+idp-email-verification-display-name=Электрондук почтаны текшерүү
+idp-email-verification-help-text=Почтаңызды текшерүү менен аккаунтуңузду байлаңыз.
+idp-username-password-form-display-name=Колдонуучу аты жана сырсөз
+idp-username-password-form-help-text=Кириңиз, анан аккаунтуңузду байлаңыз.
+
+finalDeletionConfirmation=Эгер аккаунтуңузду өчүрсөңүз, аны калыбына келтирүүгө болбойт. Аккаунтуңузду сактап калуу үчүн Жокко чыгарууну басыңыз.
+irreversibleAction=Бул аракет кайтарылгыс
+deleteAccountConfirm=Аккаунтту өчүрүүнү ырастоо
+
+deletingImplies=Аккаунтуңузду өчүрүү төмөнкүлөрдү билдирет:
+errasingData=Бардык маалыматтар өчүрүлөт
+loggingOutImmediately=Сиз дароо чыгып кетесиз
+accountUnusable=Андан кийинки колдонуу мүмкүн болбойт
+userDeletedSuccessfully=Колдонуучу ийгиликтүү өчүрүлдү
+
+access-denied=Кирүүгө тыюу салынган
+access-denied-when-idp-auth={0} аркылуу аутентификация болгондо кирүүгө тыюу салынган
+
+frontchannel-logout.title=Чыгуу
+frontchannel-logout.message=Кийинки тиркемелерден чыгып жатасыз
+logoutConfirmTitle=Чыгуу
+logoutConfirmHeader=Чыгкыңыз келеби?
+doLogout=Чыгуу
+
+readOnlyUsernameMessage=Колдонуучу атыңызды жаңырта албайсыз, анткени ал окулчу гана.
+error-invalid-multivalued-size=Атрибут {0} төмөнкүдөй болушу керек: к минимуму {1} жана максимум {2} {2,choice,0#маанилер|1#маани|1<маанилер}.
+
+organization.confirm-membership.title=Сиз ${kc.org.name} уюмунун мүчөсү болууга даярсыз
+organization.confirm-membership=Төмөнкү шилтемени басуу менен сиз {0} уюмунун мүчөсү болосуз:
+organization.member.register.title=${kc.org.name} уюмуна кошулуу үчүн аккаунт түзүңүз
+organization.select=Уюмду тандоо үчүн уюмду тандаңыз:
+notMemberOfOrganization=Колдонуучу {0} уюмунун мүчөсү эмес
+notMemberOfAnyOrganization=Колдонуучу эч кандай уюмдун мүчөсү эмес
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_lt.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_lt.properties
index cadc42b657c2..4800777c0865 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_lt.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_lt.properties
@@ -68,7 +68,7 @@ country=Šalis
 emailVerified=El. pašto adresas patvirtintas
 gssDelegationCredential=GSS prisijungimo duomenų delegavimas
 
-loginTotpStep1=Įdiekite <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> arba Google Authenticator savo įrenginyje. Programėlės prieinamos <a href="https://play.google.com">Google Play</a> ir Apple App Store.
+loginTotpStep1=Installa una delle seguenti applicazioni sul tuo cellulare:
 loginTotpStep2=Atidarykite programėlę ir nuskenuokite barkodą arba įveskite kodą.
 loginTotpStep3=Įveskite programėlėje sugeneruotą vieną kartą galiojantį kodą ir paspauskite Saugoti norėdami prisijungti.
 loginOtpOneTime=Vienkartinis kodas
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_nl.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_nl.properties
index 229d648c70fe..4ba2d91a5a46 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_nl.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_nl.properties
@@ -1,66 +1,84 @@
 doLogIn=Inloggen
-doRegister=Registreer
-doRegisterSecurityKey=Registreer
-doCancel=Annuleer
+doRegister=Registreren
+doRegisterSecurityKey=Registreren
+doCancel=Annuleren
 doSubmit=Verzenden
-doBack=Terug
+doBack=Vorige
 doYes=Ja
 doNo=Nee
 doContinue=Doorgaan
-doIgnore=Negeer
+doIgnore=Negeren
 doAccept=Accepteren
 doDecline=Afwijzen
 doForgotPassword=Wachtwoord vergeten?
 doClickHere=Klik hier
 doImpersonate=Identiteit overnemen
-doTryAgain=Probeer opnieuw
+doTryAgain=Opnieuw proberen
 doTryAnotherWay=Probeer op een ander manier
-doConfirmDelete=Bevestig verwijderen
+doConfirmDelete=Verwijderen bevestigen
 errorDeletingAccount=Onverwachte fout bij het verwijderen van account
-deletingAccountForbidden=U heeft onvoldoende rechten om dit account te verwijderen, neem contact op met beheer.
+deletingAccountForbidden=U heeft onvoldoende rechten om dit account te verwijderen, neem contact op met de beheerder.
 kerberosNotConfigured=Kerberos is niet geconfigureerd
 kerberosNotConfiguredTitle=Kerberos is niet geconfigureerd
-bypassKerberosDetail=U bent niet ingelogd via Kerberos of uw browser kan niet met Kerberos inloggen. Klik op 'doorgaan' om via een andere manier in te loggen
+bypassKerberosDetail=U bent niet ingelogd via Kerberos of uw browser kan niet met Kerberos inloggen. Klik op ''doorgaan'' om via een andere manier in te loggen
 kerberosNotSetUp=Kerberos is onjuist geconfigureerd. U kunt niet inloggen.
-registerTitle=Registreer
-loginAccountTitle=Inloggen met uw account
-loginTitle=Log in met {0}
+registerTitle=Registreren
+loginAccountTitle=Inloggen bij uw account
+loginTitle=Log in bij {0}
 loginTitleHtml={0}
 impersonateTitle={0} Identiteit overnemen
 impersonateTitleHtml=<strong>{0}</strong> Identiteit overnemen
 realmChoice=Realm
 unknownUser=Onbekende gebruiker
-loginTotpTitle=Mobiele Authenticator Instellen
-loginProfileTitle=Update accountinformatie
-loginTimeout=U bent te lang bezig geweest met inloggen. Het inlogproces begint opnieuw.
+loginTotpTitle=Mobiele authenticator instellen
+loginProfileTitle=Accountinformatie bijwerken
+loginIdpReviewProfileTitle=Accountinformatie bijwerken
+loginTimeout=Time-out bij inlogpoging. Het inlogproces begint opnieuw.
 reauthenticate=Log opnieuw in om verder te gaan
-oauthGrantTitle=Verleen Toegang
+authenticateStrong=Sterke authenticatie vereist om verder te gaan
+oauthGrantTitle=Toegang verlenen tot {0}
 oauthGrantTitleHtml={0}
+oauthGrantInformation=Zorg dat u {0} vertrouwt en dat u weet hoe {0} omgaat met uw gegevens.
+oauthGrantReview=U kunt dit document nalezen: 
+oauthGrantTos=algemene voorwaarden.
+oauthGrantPolicy=privacybeleid.
 errorTitle=Er is een fout opgetreden...
 errorTitleHtml=Er is een fout opgetreden...
 emailVerifyTitle=E-mailadres-verificatie
-emailForgotTitle=Wachtwoord vergeten?
-updatePasswordTitle=Wachtwoord updaten
+emailForgotTitle=Bent u uw wachtwoord vergeten?
+updateEmailTitle=E-mail bijwerken
+emailUpdateConfirmationSentTitle=Bevestigingsmail verstuurd
+emailUpdateConfirmationSent=Een bevestigingsmail is vertuurd naar {0}. Volg de instructies in deze mail om het bijwerken van het e-mailadres te voltooien.
+emailUpdatedTitle=E-mail bijgewerkt
+emailUpdated=Het e-mailadres is met succes bijgewerkt naar {0}.
+updatePasswordTitle=Wachtwoord bijwerken
 codeSuccessTitle=Succescode
-codeErrorTitle=Foutcode: {0}
+codeErrorTitle=Foutcode\: {0}
 displayUnsupported=Opgevraagde weergave type is niet ondersteund
 browserRequired=Om in te loggen is een browser vereist
 browserContinue=Om het loginproces af te ronden is een browser vereist
-browserContinuePrompt=Open een browser en ga door met inloggen? [y/n]:
+browserContinuePrompt=Browser openen en doorgaan met inloggen? [y/n]:
 browserContinueAnswer=y
 
 
-termsTitle=Voorwaarden
-termsText=<p>Gedefinieerde voorwaarden</p>
-termsPlainText=Voorwaarden
+termsTitle=Algemene Voorwaarden
+termsText=<p>Algemene voorwaarden nog te definiëren</p>
+termsPlainText=Algemene voorwaarden nog te definiëren
+termsAcceptanceRequired=Accepteren van de algemene voorwaarden is verplicht.
+acceptTerms=Ik ga akkoord met de algemene voorwaarden
+
+deleteCredentialTitle={0} verwijderen
+deleteCredentialMessage=Wilt u {0} verwijderen?
+
 recaptchaFailed=Ongeldige Recaptcha
 recaptchaNotConfigured=Recaptcha is verplicht, maar niet geconfigureerd
 consentDenied=Toestemming geweigerd.
+
 noAccount=Nieuwe gebruiker?
 username=Gebruikersnaam
 usernameOrEmail=Gebruikersnaam of e-mailadres
 firstName=Voornaam
-givenName=Voornaam
+givenName=Roepnaam
 fullName=Volledige naam
 lastName=Achternaam
 familyName=Familienaam
@@ -68,17 +86,27 @@ email=E-mailadres
 password=Wachtwoord
 passwordConfirm=Bevestig wachtwoord
 passwordNew=Nieuw wachtwoord
-passwordNewConfirm=Bevestiging nieuwe wachtwoord
+passwordNewConfirm=Bevestiging nieuw wachtwoord
+hidePassword=Wachtwoord verbergen
+showPassword=Wachtwoord tonen
 rememberMe=Ingelogd blijven
 authenticatorCode=Authenticatiecode
 address=Adres
 street=Straat
 locality=Woonplaats
-region=Provincie of regio
+region=Provincie of gewest
 postal_code=Postcode
 country=Land
 emailVerified=E-mailadres geverifieerd
-gssDelegationCredential=GSS delegatie Credential
+website=Website
+phoneNumber=Telefoon
+phoneNumberVerified=Telefoonnnummer geverifieerd
+gender=Geslacht
+birthday=Geboortedatum
+zoneinfo=Tijdzone
+gssDelegationCredential=GSS delegatie credential
+logoutOtherSessions=Uitloggen op andere apparaten
+
 profileScopeConsentText=Gebruikersprofiel
 emailScopeConsentText=E-mailadres
 addressScopeConsentText=Adres
@@ -86,14 +114,19 @@ phoneScopeConsentText=Telefoonnummer
 offlineAccessScopeConsentText=Offline toegang
 samlRoleListScopeConsentText=Mijn rollen
 rolesScopeConsentText=Gebruikersrollen
+organizationScopeConsentText=Organisatie
+
+restartLoginTooltip=Inlogproces opnieuw starten
+
 loginTotpIntro=U bent verplicht om tweefactor-authenticatie in te stellen om dit account te kunnen gebruiken
 loginTotpStep1=Installeer een van de volgende applicaties op uw mobile telefoon
 loginTotpStep2=Open de applicatie en scan de barcode
-loginTotpStep3=Voer de eenmalige code die door de applicatie is aangeleverd in en klik op 'Verzenden' om de setup te voltooien
-loginTotpManualStep2=Open de applicatie en voer de sleutel in
-loginTotpManualStep3=Gebruik de volgende configuratiewaarden (als de applicatie dit ondersteund)
-loginTotpUnableToScan=Lukt het scannen niet?
-loginTotpScanBarcode=Scan barcode?
+loginTotpStep3=Voer de eenmalige code in die door de applicatie is aangeleverd en klik op ''Verzenden'' om de setup te voltooien.
+loginTotpManualStep2=Open de applicatie en voer de sleutel in:
+loginTotpManualStep3=Gebruik de volgende configuratiewaarden als de applicatie dit ondersteunt:
+loginTotpUnableToScan=Scannen mislukt?
+loginTotpScanBarcode=Barcode scannen?
+loginCredential=Inlogmiddel
 loginOtpOneTime=Eenmalige code
 loginTotpType=Type
 loginTotpAlgorithm=Algoritme
@@ -101,26 +134,35 @@ loginTotpDigits=Cijfers
 loginTotpInterval=Interval
 loginTotpCounter=Teller
 loginTotpDeviceName=Apparaatnaam
+
 loginTotp.totp=Time-based
 loginTotp.hotp=Counter-based
 
 
+loginChooseAuthenticator=Inlogmethode kiezen
+
 oauthGrantRequest=Wilt u deze toegangsrechten verlenen?
 inResource=in
+
+
 emailVerifyInstruction1=Een e-mail met instructies om uw e-mailadres te verifiëren is zojuist verzonden.
 emailVerifyInstruction2=Heeft u geen verificatiecode ontvangen in uw e-mail?
 emailVerifyInstruction3=om opnieuw een e-mail te versturen.
 emailLinkIdpTitle=Link {0}
-emailLinkIdp1=Er is een e-mail met instructies verzonden om {0} account {1} te koppelen met uw {2} account.
+emailLinkIdp1=Er is een e-mail verzonden met instructies om {0} account {1} te koppelen met uw {2} account.
 emailLinkIdp2=Heeft u geen verificatiecode in uw e-mail ontvangen?
 emailLinkIdp3=om opnieuw een e-mail te versturen.
-emailLinkIdp4=Als u deze mail al geverifieerd hebt in een andere browser
+emailLinkIdp4=Als u het e-mailadres al geverifieerd hebt in een andere browser
 emailLinkIdp5=om door te gaan.
+
 backToLogin=&laquo; Terug naar Inloggen
+
 emailInstruction=Voer uw gebruikersnaam of e-mailadres in en wij sturen u een e-mailbericht met instructies voor het aanmaken van een nieuw wachtwoord.
+emailInstructionUsername=Voer uw gebruikersnaam in en wij sturen u een e-mailbericht met instructies voor het aanmaken van een nieuw wachtwoord.
+
 copyCodeInstruction=Kopieer deze code en plak deze in uw applicatie:
-pageExpiredTitle=Sessie is verlopen
-pageExpiredMsg1=Om het loginproces opnieuw te doen
+pageExpiredTitle=Inlogpagina is verlopen
+pageExpiredMsg1=Om het loginproces opnieuw te beginnen
 pageExpiredMsg2=Om door te gaan met het loginproces
 personalInfo=Persoonlijke informatie:
 role_admin=Admin
@@ -145,79 +187,140 @@ role_manage-account-links=Beheer accountlinks
 role_read-token=Token lezen
 role_offline-access=Offline toegang
 client_account=Account
+client_account-console=Accountconsole
 client_security-admin-console=Security Admin Console
 client_admin-cli=Admin CLI
 client_realm-management=Realm-beheer
 client_broker=Broker
-invalidUserMessage=Ongeldige gebruikersnaam of wachtwoord.
+
+requiredFields=Verplichte velden
+
+invalidUserMessage=Gebruikersnaam of wachtwoord ongeldig.
+invalidUsernameMessage=Gebruikersnaam ongeldig.
+invalidUsernameOrEmailMessage=Gebruikersnaam of e-mailadres ongeldig.
+invalidPasswordMessage=Wachtwoord ongeldig.
 invalidEmailMessage=Ongeldig e-mailadres.
-accountDisabledMessage=Account is uitgeschakeld, neem contact op met beheer.
-accountTemporarilyDisabledMessage=Ongeldige gebruikersnaam of wachtwoord.
-accountPermanentlyDisabledMessage=Ongeldige gebruikersnaam of wachtwoord.
+accountDisabledMessage=Account is geblokkeerd, neem contact op met de beheerder.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+# Deze eigenschappen zijn opzettelijk gelijk aan "invalidUsernameMessage", zodat het standaard niet mogelijk is om te herkennen dat het inloggen mislukt door een tijdelijk geblokkeerd account.
+accountTemporarilyDisabledMessage=Gebruikersnaam of wachtwoord ongeldig.
+accountPermanentlyDisabledMessage=Gebruikersnaam of wachtwoord ongeldig.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+# Deze eigenschappen zijn opzettelijk gelijk aan "invalidTotpMessage", zodat het standaard niet mogelijk is om te herkennen dat het inloggen mislukt is  door een tijdelijk geblokkeerd account.
 accountTemporarilyDisabledMessageTotp=Ongeldige authenticatiecode.
 accountPermanentlyDisabledMessageTotp=Ongeldige authenticatiecode.
 expiredCodeMessage=Logintijd verlopen. Gelieve opnieuw in te loggen.
 expiredActionMessage=Actietijd verlopen. Log daarom opnieuw in.
 expiredActionTokenNoSessionMessage=Actietijd verlopen.
-expiredActionTokenSessionExistsMessage=Actietijd verlopen. Gelieve de actie opnieuw doen.
+expiredActionTokenSessionExistsMessage=Actietijd verlopen. Gelieve de actie opnieuw te starten.
+sessionLimitExceeded=Er zijn te veel sessies
+identityProviderLogoutFailure=SAML IdP Logout gefaald
+
 missingFirstNameMessage=Voer uw voornaam in.
 missingLastNameMessage=Voer uw achternaam in.
 missingEmailMessage=Voer uw e-mailadres in.
 missingUsernameMessage=Voer uw gebruikersnaam in.
 missingPasswordMessage=Voer uw wachtwoord in.
 missingTotpMessage=Voer uw authenticatiecode in.
+missingTotpDeviceNameMessage=Voer uw apparaatnaam in.
 notMatchPasswordMessage=Wachtwoorden komen niet overeen.
+
+error-invalid-value=Ongeldige waarde.
+error-invalid-blank=Voer een waarde in.
+error-empty=Vooer een waarde in.
+error-invalid-length=Lengte moet tussen {1} en {2} zijn.
+error-invalid-length-too-short=Minimale lengte is {1}.
+error-invalid-length-too-long=Maximale lengte is {2}.
+error-invalid-email=Ongeldig e-mailaddress.
+error-invalid-number=Ongeldig getal.
+error-number-out-of-range=Getal moet tussen {1} en {2} liggen.
+error-number-out-of-range-too-small=Getal moet een minimaal {1} zijn.
+error-number-out-of-range-too-big=Getal moet maximaal {2} zijn.
+error-pattern-no-match=Ongeldige waarde.
+error-invalid-uri=Ongeldige URL.
+error-invalid-uri-scheme=Ongeldig URL scheme.
+error-invalid-uri-fragment=Ongeldig URL fragment.
+error-user-attribute-required=Dit veld is verplicht.
+error-invalid-date=Ongeldige datum.
+error-user-attribute-read-only=Dit veld is read-only.
+error-username-invalid-character=Waarde bevat ongeldig teken.
+error-person-name-invalid-character=Waarde bevat ongeldig teken.
+error-reset-otp-missing-id=Kies een OTP-configuratie.
+
 invalidPasswordExistingMessage=Ongeldig bestaand wachtwoord.
 invalidPasswordBlacklistedMessage=Ongeldig wachtwoord: wachtwoord is geblacklist.
 invalidPasswordConfirmMessage=Wachtwoord komt niet overeen met wachtwoordbevestiging.
 invalidTotpMessage=Ongeldige authenticatiecode.
+
 usernameExistsMessage=Gebruikersnaam bestaat al.
 emailExistsMessage=E-mailadres bestaat al.
-federatedIdentityExistsMessage=Gebruiker met {0} {1} bestaat al. Log in met het beheerdersaccount om het account te koppelen.
+
+federatedIdentityExistsMessage=Gebruiker met {0} {1} bestaat al. Log in bij accountbeheer om het account te koppelen.
+federatedIdentityUnavailableMessage=Gebruiker {0}, ingelogd met identity provider {1} bestaat niet. Neem contact op met de beheerder.
+federatedIdentityUnmatchedEssentialClaimMessage=Het ID token dat is uitgegeven door de identity provider, matcht niet met de geconfigureerde essential claim. Neem contact op met de beheerder.
+
 confirmLinkIdpTitle=Account bestaat al
+confirmOverrideIdpTitle=Broker link bestaat al
 federatedIdentityConfirmLinkMessage=Gebruiker met {0} {1} bestaat al. Hoe wilt u doorgaan?
-federatedIdentityConfirmReauthenticateMessage=Authenticeer om uw account te koppelen {0}
+federatedIdentityConfirmOverrideMessage=U probeert om uw account {0} te koppelen aan het {1} account {2}. Maar uw account is al gekoppeld met het andere {3} account {4}. Weet u zeker dat u de bestaande koppeling wilt vervangen door het nieuwe account?
+federatedIdentityConfirmReauthenticateMessage=Authenticeer om uw account te koppelen met {0}
+nestedFirstBrokerFlowMessage=De {0} gebruiker {1} is niet gekoppeld aan een bekende gebruiker.
 confirmLinkIdpReviewProfile=Nalopen profiel
 confirmLinkIdpContinue=Voeg toe aan bestaande account
+confirmOverrideIdpContinue=Ja, koppeling met bestaand account vervangen
+
 configureTotpMessage=U moet de Mobile Authenticator configuren om uw account te activeren.
+configureBackupCodesMessage=U moet back-up codes instellen om uw account te activeren.
 updateProfileMessage=U moet uw gebruikersprofiel bijwerken om uw account te activeren.
 updatePasswordMessage=U moet uw wachtwoord wijzigen om uw account te activeren.
+updateEmailMessage=U moet uw e-mailadres bijwerken om uw account te activeren.
 resetPasswordMessage=U moet uw wachtwoord wijzigen.
 verifyEmailMessage=U moet uw e-mailadres verifiëren om uw account te activeren.
 linkIdpMessage=U moet uw e-mailadres verifiëren om uw account te koppelen aan {0}.
+
 emailSentMessage=U ontvangt binnenkort een e-mail met verdere instructies.
 emailSendErrorMessage=Het versturen van de e-mail is mislukt, probeer het later opnieuw.
-accountUpdatedMessage=Uw account is gewijzigd.
+
+accountUpdatedMessage=Uw account is bijgewerkt.
 accountPasswordUpdatedMessage=Uw wachtwoord is gewijzigd.
+
 delegationCompleteHeader=Login gelukt
-delegationCompleteMessage=U mag uw browser sluiten en terug gaan naar uw console applicatie
+delegationCompleteMessage=U mag uw browser sluiten en terug gaan naar uw consoletoepassing.
 delegationFailedHeader=Login mislukt
-delegationFailedMessage=U mag uw browser sluiten en terug gaan naar uw console applicatie om daar het loginproces nogmaalt te proberen.
+delegationFailedMessage=U mag uw browser sluiten en teruggaan naar uw consoletoepassing om daar te proberen het inlogproces nog een keer te starten.
+
 noAccessMessage=Geen toegang
-invalidPasswordMinLengthMessage=Ongeldig wachtwoord, de minimumlengte is {0} karakters.
+
+invalidPasswordMinLengthMessage=Ongeldig wachtwoord, de minimumlengte is {0} tekens.
+invalidPasswordMaxLengthMessage=Ongeldig wachtwoord, de maximumlengte is {0} tekens.
 invalidPasswordMinDigitsMessage=Ongeldig wachtwoord, deze moet minstens {0} cijfers bevatten.
 invalidPasswordMinLowerCaseCharsMessage=Ongeldig wachtwoord, deze moet minstens {0} kleine letters bevatten.
 invalidPasswordMinUpperCaseCharsMessage=Ongeldig wachtwoord, deze moet minstens {0} hoofdletters bevatten.
 invalidPasswordMinSpecialCharsMessage=Ongeldig wachtwoord, deze moet minstens {0} speciale tekens bevatten.
 invalidPasswordNotUsernameMessage=Ongeldig wachtwoord, deze mag niet overeen komen met de gebruikersnaam.
+invalidPasswordNotContainsUsernameMessage=Ongeldig wachtwoord, de gebruikersnaam mag er niet in voorkomen.
+invalidPasswordNotEmailMessage=Ongeldig wachtwoord, deze mag niet overeen komen met het e-mailadres.
 invalidPasswordRegexPatternMessage=Ongeldig wachtwoord, deze komt niet overeen met opgegeven reguliere expressie(s).
 invalidPasswordHistoryMessage=Ongeldig wachtwoord, deze mag niet overeen komen met een van de laatste {0} wachtwoorden.
-invalidPasswordGenericMessage=Ongeldig wachtwoord: het nieuwe wachtwoord voldoet niet aan de opgestelde eisen.
+invalidPasswordGenericMessage=Ongeldig wachtwoord: het nieuwe wachtwoord voldoet niet aan de opgestelde wachtwoordeisen.
+
 failedToProcessResponseMessage=Het verwerken van de respons is mislukt
 httpsRequiredMessage=HTTPS vereist
 realmNotEnabledMessage=Realm niet geactiveerd
 invalidRequestMessage=Ongeldige request
+successLogout=U bent nu uitgelogd
 failedLogout=Afmelden is mislukt
 unknownLoginRequesterMessage=De login requester is onbekend
 loginRequesterNotEnabledMessage=De login requester is niet geactiveerd
 bearerOnlyMessage=Bearer-only applicaties mogen geen browserlogin initiëren
 standardFlowDisabledMessage=Client mag geen browserlogin starten met het opgegeven response_type. Standard flow is uitgeschakeld voor de client.
-implicitFlowDisabledMessage=Client mag geen browserlogin starten met opgegeven response_type. Implicit flow is uitgeschakeld voor de klant.
+implicitFlowDisabledMessage=Client mag geen browserlogin starten met opgegeven response_type. Implicit flow is uitgeschakeld voor de client.
 invalidRedirectUriMessage=Ongeldige redirect-URI
-unsupportedNameIdFormatMessage=Niet-ondersteunde NameIDFormat
+unsupportedNameIdFormatMessage=Niet-ondersteund NameIDFormat
 invalidRequesterMessage=Ongeldige requester
 registrationNotAllowedMessage=Registratie is niet toegestaan
 resetCredentialNotAllowedMessage=Het opnieuw instellen van de aanmeldgegevens is niet toegestaan
+
 permissionNotApprovedMessage=Recht verworpen.
 noRelayStateInResponseMessage=Geen relay state in antwoord van de identity provider.
 insufficientPermissionMessage=Onvoldoende rechten om identiteiten te koppelen.
@@ -230,19 +333,28 @@ couldNotSendAuthenticationRequestMessage=Kan het authenticatieverzoek niet verze
 unexpectedErrorHandlingRequestMessage=Onverwachte fout bij het verwerken van het authenticatieverzoek naar de identity provider.
 invalidAccessCodeMessage=Ongeldige toegangscode.
 sessionNotActiveMessage=Sessie inactief.
-invalidCodeMessage=Er is een fout opgetreden, probeer nogmaals in te loggen.
+invalidCodeMessage=Er is een fout opgetreden, probeer nogmaals in te loggen vanuit uw applicatie.
+cookieNotFoundMessage=Restart login cookie niet gevonden. Miscchien is het verlopen; misschien is het verwijderd of cookies zijn uitgeschakeld in uw browser. Als cookies zijn uitgeschakeld, schakel deze dan in. Klik op Terug naar applicatie om opnieuw in te loggen.
+insufficientLevelOfAuthentication=Er is niet voldaan aan het verzochte authenticatieniveau.
 identityProviderUnexpectedErrorMessage=Onverwachte fout tijdens de authenticatie met de identity provider
+identityProviderMissingStateMessage=State parameter ontbreekt in respons van identity provider.
+identityProviderMissingCodeOrErrorMessage=Ontbrekende code of error parameter in response van identity provider.
+identityProviderInvalidResponseMessage=Ongeldige respons van identity provider.
+identityProviderInvalidSignatureMessage=Ongeldige handtekening/signature in respons van identity provider.
 identityProviderNotFoundMessage=Geen identity provider gevonden met deze naam.
 identityProviderLinkSuccess=Uw account is met succes gekoppeld aan {0} account {1}.
 staleCodeMessage=Deze pagina is verlopen. Keer terug naar uw applicatie om opnieuw in te loggen.
 realmSupportsNoCredentialsMessage=Realm ondersteunt geen enkel soort aanmeldgegeven.
+credentialSetupRequired=Inloggen onmogelijk, aanmeldgegevens moeten worden ingesgeld.
 identityProviderNotUniqueMessage=Realm ondersteunt meerdere identity providers. Er kon niet bepaald worden welke identity provider er gebruikt zou moeten worden tijdens de authenticatie.
 emailVerifiedMessage=Uw e-mailadres is geverifieerd.
-staleEmailVerificationLink=De link die u gebruikt is verlopen, wellicht omdat u uw e-mailadres al eerder geverifieerd heeft.
+emailVerifiedAlreadyMessage=Uw e-mailadres werd eerder al geverifieerd.
+staleEmailVerificationLink=De link die u gebruikt, is verlopen. Misschien heeft u uw e-mailadres al eerder geverifieerd.
 identityProviderAlreadyLinkedMessage=De door {0} teruggegeven gefedereerde identiteit is al aan een andere gebruiker gekoppeld.
-confirmAccountLinking=Bevestig dat het account {0} van identity provider {1} overeenkomt met uw account.
+confirmAccountLinking=Bevestig dat het account {0} van identity provider {1} wordt gekoppeld met uw account.
 confirmEmailAddressVerification=Bevestig dat e-mailadres {0} valide is.
 confirmExecutionOfActions=Voer de volgende actie(s) uit
+
 backToApplication=&laquo; Terug naar de applicatie
 missingParameterMessage=Missende parameters: {0}
 clientNotFoundMessage=Client niet gevonden.
@@ -252,11 +364,19 @@ alreadyLoggedIn=U bent al ingelogd.
 differentUserAuthenticated=U bent in deze sessie al als de gebruiker "{0}" aangemeld. Log eerst uit.
 brokerLinkingSessionExpired=Broker account linking aangevraagd, maar de huidige sessie in verlopen.
 proceedWithAction=&raquo; Klik hier om verder te gaan
-requiredAction.CONFIGURE_TOTP=Configureer OTP
-requiredAction.TERMS_AND_CONDITIONS=Voorwaarden
-requiredAction.UPDATE_PASSWORD=Update wachtwoord
-requiredAction.UPDATE_PROFILE=Update profiel
-requiredAction.VERIFY_EMAIL=Verifieer e-mail
+acrNotFulfilled=Authenticatievereisten niet voldaan (acr)
+
+requiredAction.CONFIGURE_TOTP=OTP instellen
+requiredAction.TERMS_AND_CONDITIONS=Algemene voorwaarden accepteren
+requiredAction.UPDATE_PASSWORD=Wachtwoord bijwerken
+requiredAction.UPDATE_PROFILE=Profiel bijwerken
+requiredAction.VERIFY_EMAIL=E-mail bevestigen
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=AUTHN herstelcodes aanmaken
+requiredAction.webauthn-register-passwordless=Webauthn Passwordless registreren
+requiredAction.webauthn-register=Webauthn registreren
+
+invalidTokenRequiredActions=Required actions included in the link are not valid
+
 doX509Login=U wordt ingelogd als\:
 clientCertificate=X509 client certificate\:
 noCertificate=[No Certificate]
@@ -264,15 +384,16 @@ noCertificate=[No Certificate]
 
 pageNotFound=Pagina niet gevonden
 internalServerError=Er is een interne serverfout opgetreden
+
 console-username=Gebruikersnaam:
 console-password=Wachtwoord:
 console-otp=Eenmalige code:
 console-new-password=Nieuw wachtwoord:
 console-confirm-password=Bevestig wachtwoord:
 console-update-password=Een update van uw wachtwoord is verplicht.
-console-verify-email=U bent verplicht om uw e-mailadres te verifiëren. Een e-mail met de verificatiecode is naar {0} gestuurd. Voer deze code hieronder in.
+console-verify-email=U bent verplicht om uw e-mailadres te verifiëren. Een e-mail met de verificatiecode is naar {0} gestuurd. Gelieve deze code hieronder in te voeren.
 console-email-code=E-mail Code:
-console-accept-terms=Accepteert u de voorwaarden? [y/n]:
+console-accept-terms=Accepteert u de algemene voorwaarden? [y/n]:
 console-accept=y
 
 # Identity provider
@@ -282,6 +403,3 @@ idp-email-verification-display-name=E-mail Verificatie
 idp-email-verification-help-text=Bevestig uw account per e-mail.
 idp-username-password-form-display-name=Gebruikersnaam en wachtwoord
 idp-username-password-form-help-text=Bevestig uw account door in te loggen.
-oauthGrantTos=algemene voorwaarden.
-oauthGrantPolicy=privacybeleid.
-authenticateStrong=Sterke authenticatie vereist om verder te gaan
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_no.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_no.properties
index ebb9e2f39745..b88fe5ad01b8 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_no.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_no.properties
@@ -68,7 +68,7 @@ country=Land
 emailVerified=E-postadresse bekreftet
 gssDelegationCredential=GSS legitimasjons-delegering
 
-loginTotpStep1=Installer <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> eller Google Authenticator på din mobiltelefon. Begge applikasjoner er tilgjengelige på <a href="https://play.google.com">Google Play</a> og Apple App Store.
+loginTotpStep1=Installer en av følgende applikasjoner på mobilen din:
 loginTotpStep2=Åpne applikasjonen og skann strekkoden eller skriv inn koden
 loginTotpStep3=Skriv inn engangskoden fra applikasjonen og klikk send inn for å fullføre
 loginOtpOneTime=Engangskode
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_pl.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_pl.properties
index 283b5b77fcda..ad2da36fab40 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_pl.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_pl.properties
@@ -15,6 +15,9 @@ doClickHere=Kliknij tutaj
 doImpersonate=Wciel się
 doTryAgain=Spróbuj ponownie
 doTryAnotherWay=Spróbuj inną metodą
+doConfirmDelete=Potwierdź usunięcie
+errorDeletingAccount=Wystąpił błąd podczas usuwania konta
+deletingAccountForbidden=Nie masz uprawnień do usunięcia własnego konta. Skontaktuj się z administratorem.
 kerberosNotConfigured=Kerberos nie jest skonfigurowany
 kerberosNotConfiguredTitle=Kerberos nie jest skonfigurowany
 bypassKerberosDetail=Albo nie jesteś zalogowany przez Kerberos albo twoja przeglądarka nie jest skonfigurowana do logowania Kerberos. Kliknij kontynuuj by zalogować się w inny sposób.
@@ -29,37 +32,63 @@ realmChoice=Strefa
 unknownUser=Nieznany użytkownik
 loginTotpTitle=Konfiguracja dla Mobile Authenticator
 loginProfileTitle=Zaktualizuj informacje konta
+loginIdpReviewProfileTitle=Aktualizuj informacje o koncie
 loginTimeout=Zbyt dużo czasu zajęło logowanie. Proces logowania rozpocznie się od nowa.
+reauthenticate=Proszę ponownie się uwierzytelnić, aby kontynuować
+authenticateStrong=Wymagane silne uwierzytelnienie, aby kontynuować
 oauthGrantTitle=Przydziel dostęp dla {0}
 oauthGrantTitleHtml={0}
+oauthGrantInformation=Upewnij się, że ufasz {0}, dowiedz się, jak {0} będzie przetwarzać Twoje dane.
+oauthGrantReview=Możesz przejrzeć
+oauthGrantTos=warunki usługi.
+oauthGrantPolicy=politykę prywatności.
 errorTitle=Przykro nam...
 errorTitleHtml=<strong>Przykro</strong> nam...
 emailVerifyTitle=Weryfikacja e-maila
 emailForgotTitle=Nie pamiętasz hasła?
+updateEmailTitle=Zaktualizuj adres e-mail
+emailUpdateConfirmationSentTitle=Wysłano e-mail z potwierdzeniem
+emailUpdateConfirmationSent=E-mail z potwierdzeniem został wysłany na adres {0}. Musisz postępować zgodnie z instrukcjami, aby zakończyć aktualizację adresu e-mail.
+emailUpdatedTitle=E-mail zaktualizowany
+emailUpdated=Adres e-mail konta został pomyślnie zaktualizowany na {0}.
 updatePasswordTitle=Aktualizacja hasła
 codeSuccessTitle=Kod sukcesu
 codeErrorTitle=Kod błędu\: {0}
 displayUnsupported=Żądany typ wyświetlania jest nieobsługiwany
 browserRequired=Do zalogowania wymagana jest przeglądarka
 browserContinue=Przeglądarka jest wymagana by dokończyć logowanie
-browserContinuePrompt=Otworzyć przeglądarkę i kontynuować logowanie? [t/n]\:
+browserContinuePrompt=Otworzyć przeglądarkę i kontynuować logowanie? [t/n]:
 browserContinueAnswer=t
 
+# Transports
+usb=USB
+nfc=NFC
+bluetooth=Bluetooth
+internal=Wewnętrzny
+unknown=Nieznany
 
 termsTitle=Regulamin
 termsText=<p>Regulamin, który należy zdefiniować</p>
 termsPlainText=Regulamin, który należy zdefiniować.
+termsAcceptanceRequired=Musisz zgodzić się z naszymi warunkami.
+acceptTerms=Zgadzam się na regulamin
+
+deleteCredentialTitle=Usuń {0}
+deleteCredentialMessage=Czy chcesz usunąć {0}?
+
+linkIdpActionTitle=Łączenie {0}
+linkIdpActionMessage=Czy chcesz połączyć swoje konto z {0}?
 
 recaptchaFailed=Błędna Recaptcha
 recaptchaNotConfigured=Recaptcha jest wymagana, ale nie skonfigurowana
 consentDenied=Zgoda odrzucona.
 
 noAccount=Nie masz konta?
-username=Nazwa użytkownika (login)
-usernameOrEmail=Nazwa użytkownika lub e-mail (login)
+username=Nazwa użytkownika
+usernameOrEmail=Nazwa użytkownika lub e-mail
 firstName=Imię
 givenName=Nadane imię
-fullName=Pełne imię i nazwisko
+fullName=Imię i nazwisko
 lastName=Nazwisko
 familyName=Nazwisko rodowe
 email=E-mail
@@ -67,6 +96,8 @@ password=Hasło
 passwordConfirm=Potwierdź hasło
 passwordNew=Nowe hasło
 passwordNewConfirm=Potwierdzenie nowego hasła
+hidePassword=Ukryj hasło
+showPassword=Pokaż hasło
 rememberMe=Zapamiętaj mnie
 authenticatorCode=Kod jednorazowy
 address=Adres
@@ -75,7 +106,7 @@ locality=Miejscowość
 region=Województwo
 postal_code=Kod pocztowy
 country=Państwo
-emailVerified=Email zweryfikowany
+emailVerified=E-mail zweryfikowany
 website=Strona internetowa
 phoneNumber=Nr telefonu
 phoneNumberVerified=Nr telefonu zweryfikowany
@@ -83,25 +114,28 @@ gender=Płeć
 birthday=Data urodzenia
 zoneinfo=Strefa czasowa
 gssDelegationCredential=Świadectwo przekazania uprawnień GSS
+logoutOtherSessions=Wyloguj z innych urządzeń
 
 profileScopeConsentText=Profil użytkownika
-emailScopeConsentText=Adres email
+emailScopeConsentText=Adres e-mail
 addressScopeConsentText=Adres
 phoneScopeConsentText=Numer telefonu
 offlineAccessScopeConsentText=Dostęp offline
 samlRoleListScopeConsentText=Moje role
 rolesScopeConsentText=Role użytkownika
+organizationScopeConsentText=Organizacja
 
 restartLoginTooltip=Restart logowania
 
 loginTotpIntro=Aby uzyskać dostęp do tego konta, musisz skonfigurować generator haseł jednorazowych
 loginTotpStep1=Zainstaluj jedną z następujących aplikacji na telefonie komórkowym
 loginTotpStep2=Otwórz aplikację i zeskanuj kod kreskowy
-loginTotpStep3=Wprowadź jednorazowy kod podany przez aplikację i kliknij Prześlij aby zakończyć konfigurację
+loginTotpStep3=Wprowadź jednorazowy kod podany przez aplikację i kliknij Prześlij, aby zakończyć konfigurację
+loginTotpStep3DeviceName=Podaj nazwę urządzenia, aby pomóc w zarządzaniu urządzeniami OTP.
 loginTotpManualStep2=Otwórz aplikację i wprowadź klucz
 loginTotpManualStep3=Użyj poniższych wartości konfiguracji, jeśli aplikacja pozwala na ich ustawienie
-loginTotpUnableToScan=Nie można skanować?
-loginTotpScanBarcode=Zeskanować kod paskowy?
+loginTotpUnableToScan=Nie możesz zeskanować?
+loginTotpScanBarcode=Zeskanować kod QR?
 loginCredential=Poświadczenia
 loginOtpOneTime=Kod jednorazowy
 loginTotpType=Typ
@@ -114,14 +148,32 @@ loginTotpDeviceName=Nazwa urządzenia
 loginTotp.totp=Oparte o czas
 loginTotp.hotp=Oparte o licznik
 
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+
 loginChooseAuthenticator=Wybierz metodę logowania
 
 oauthGrantRequest=Czy przyznajesz te uprawnienia dostępu?
 inResource=w
 
+oauth2DeviceVerificationTitle=Logowanie urządzeniem
+verifyOAuth2DeviceUserCode=Wprowadź kod podany przez Twoje urządzenie i kliknij Zatwierdź
+oauth2DeviceInvalidUserCodeMessage=Nieprawidłowy kod, spróbuj ponownie.
+oauth2DeviceExpiredUserCodeMessage=Kod wygasł. Wróć do swojego urządzenia i spróbuj ponownie się połączyć.
+oauth2DeviceVerificationCompleteHeader=Logowanie urządzenia zakończone pomyślnie
+oauth2DeviceVerificationCompleteMessage=Możesz zamknąć to okno przeglądarki i wrócić do swojego urządzenia.
+oauth2DeviceVerificationFailedHeader=Logowanie urządzenia nie powiodło się
+oauth2DeviceVerificationFailedMessage=Możesz zamknąć to okno przeglądarki i wrócić do swojego urządzenia i spróbować ponownie się zalogować.
+oauth2DeviceConsentDeniedMessage=Odmowa zgody na połączenie urządzenia.
+oauth2DeviceAuthorizationGrantDisabledMessage=Klient nie ma uprawnień do inicjowania udzielenia autoryzacji urządzenia OAuth 2.0. Przepływ jest wyłączony dla klienta.
+
 emailVerifyInstruction1=Została wysłana do Ciebie wiadomość e-mail z instrukcjami jak zweryfikować swój adres e-mail.
 emailVerifyInstruction2=Nie otrzymałem kodu weryfikacyjnego w wiadomości e-mail?
 emailVerifyInstruction3=aby ponownie wysłać wiadomość e-mail.
+emailVerifyInstruction4=Aby zweryfikować swój adres e-mail, wyślemy Ci wiadomość e-mail z instrukcjami na adres {0}.
+emailVerifyResend=Wyślij ponownie e-mail weryfikacyjny
+emailVerifySend=Wyślij e-mail weryfikacyjny
 
 emailLinkIdpTitle=Link {0}
 emailLinkIdp1=Wiadomość e-mail z instrukcjami, aby powiązać konto {0} {1} z kontem {2} została wysłana do Ciebie.
@@ -132,15 +184,16 @@ emailLinkIdp5=aby kontynuować.
 
 backToLogin=&laquo; Powrót do logowania
 
-emailInstruction=Wpisz swój adres e-mail lub nazwę użytkownika a wyślemy do Ciebie instrukcje, jak utworzyć nowe hasło.
+emailInstruction=Wpisz swój adres e-mail lub nazwę użytkownika, a wyślemy do Ciebie instrukcje, jak utworzyć nowe hasło.
+emailInstructionUsername=Wprowadź swoją nazwę użytkownika, a wyślemy Ci instrukcje dotyczące tworzenia nowego hasła.
 
-copyCodeInstruction=Proszę skopiować ten kod i wklej go do aplikacji\:
+copyCodeInstruction=Proszę skopiować ten kod i wklej go do aplikacji:
 
 pageExpiredTitle=Strona wygasła
 pageExpiredMsg1=Aby ponownie uruchomić proces logowania
 pageExpiredMsg2=Aby kontynuować proces logowania
 
-personalInfo=Informacje osobiste\:
+personalInfo=Informacje osobiste:
 role_admin=Admin
 role_realm-admin=Strefa Admin
 role_create-realm=Utwórz strefę
@@ -177,14 +230,18 @@ invalidUsernameOrEmailMessage=Nieprawidłowa nazwa użytkownika lub hasło.
 invalidPasswordMessage=Nieprawidłowe hasło.
 invalidEmailMessage=Nieprawidłowy adres e-mail.
 accountDisabledMessage=Konto jest wyłączone, skontaktuj się z administratorem.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessage=Nieprawidłowa nazwa użytkownika lub hasło.
 accountPermanentlyDisabledMessage=Nieprawidłowa nazwa użytkownika lub hasło.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessageTotp=Nieprawidłowy kod uwierzytelnienia.
 accountPermanentlyDisabledMessageTotp=Nieprawidłowy kod uwierzytelnienia.
 expiredCodeMessage=Przekroczono limit czasu logowania. Proszę Zaloguj się ponownie.
 expiredActionMessage=Akcja wygasła. Proszę kontynuować logowanie.
 expiredActionTokenNoSessionMessage=Akcja wygasła.
 expiredActionTokenSessionExistsMessage=Akcja wygasła. Proszę uruchomić ponownie.
+sessionLimitExceeded=Zbyt wiele sesji
+identityProviderLogoutFailure=Błąd wylogowania dostawcy tożsamości SAML
 
 missingFirstNameMessage=Proszę podać imię.
 missingLastNameMessage=Proszę podać nazwisko.
@@ -195,28 +252,57 @@ missingTotpMessage=Proszę podać kod uwierzytelniający.
 missingTotpDeviceNameMessage=Proszę podać nazwę urządzenia.
 notMatchPasswordMessage=Hasła nie są zgodne.
 
+error-invalid-value=Nieprawidłowa wartość.
+error-invalid-blank=Proszę podać wartość.
+error-empty=Proszę podać wartość.
+error-invalid-length=Długość musi wynosić od {1} do {2}.
+error-invalid-length-too-short=Minimalna długość to {1}.
+error-invalid-length-too-long=Maksymalna długość to {2}.
+error-invalid-email=Nieprawidłowy adres e-mail.
+error-invalid-number=Nieprawidłowa liczba.
+error-number-out-of-range=Liczba musi być w zakresie od {1} do {2}.
+error-number-out-of-range-too-small=Liczba musi mieć minimalną wartość {1}.
+error-number-out-of-range-too-big=Liczba musi mieć maksymalną wartość {2}.
+error-pattern-no-match=Nieprawidłowa wartość.
+error-invalid-uri=Nieprawidłowy adres URL.
+error-invalid-uri-scheme=Nieprawidłowy schemat URL.
+error-invalid-uri-fragment=Nieprawidłowy fragment URL.
+error-user-attribute-required=Proszę wypełnić to pole.
+error-invalid-date=Nieprawidłowa data.
+error-user-attribute-read-only=To pole jest tylko do odczytu.
+error-username-invalid-character=Wartość zawiera niedozwolony znak.
+error-person-name-invalid-character=Wartość zawiera niedozwolony znak.
+error-reset-otp-missing-id=Proszę wybrać konfigurację OTP.
+
 invalidPasswordExistingMessage=Nieprawidłowe istniejące hasło.
-invalidPasswordBlacklistedMessage=Nieprawidłowe hasło\: hasło jest na czarnej liście.
+invalidPasswordBlacklistedMessage=Nieprawidłowe hasło: hasło jest na czarnej liście.
 invalidPasswordConfirmMessage=Potwierdzenie hasła nie pasuje.
 invalidTotpMessage=Nieprawidłowy kod uwierzytelnienia.
 
 usernameExistsMessage=Nazwa użytkownika już istnieje.
-emailExistsMessage=Email już istnieje.
+emailExistsMessage=E-mail już istnieje.
 
-federatedIdentityExistsMessage=Użytkownik z {0} {1} już istnieje. Zaloguj się do zarządzania kontem aby połączyć konto.
+federatedIdentityExistsMessage=Użytkownik z {0} {1} już istnieje. Zaloguj się do zarządzania kontem, aby połączyć konto.
+federatedIdentityUnavailableMessage=Użytkownik {0} uwierzytelniony u dostawcy tożsamości {1} nie istnieje. Skontaktuj się z administratorem.
+federatedIdentityUnmatchedEssentialClaimMessage=Token ID wydany przez dostawcę tożsamości nie pasuje do skonfigurowanego kluczowego roszczenia. Skontaktuj się z administratorem.
 
 confirmLinkIdpTitle=Konto już istnieje
+confirmOverrideIdpTitle=Połączenie z brokerem już istnieje
 federatedIdentityConfirmLinkMessage=Użytkownik z {0} {1} już istnieje. Co chcesz zrobić?
-federatedIdentityConfirmReauthenticateMessage=Uwierzytelnij się aby połączyć swoje konto z {0}
+federatedIdentityConfirmOverrideMessage=Próbujesz połączyć swoje konto {0} z kontem {1} {2}. Ale Twoje konto jest już połączone z innym kontem {3} {4}. Czy potwierdzasz, że chcesz zastąpić istniejące połączenie nowym kontem?
+federatedIdentityConfirmReauthenticateMessage=Uwierzytelnij się, aby połączyć swoje konto z {0}
 nestedFirstBrokerFlowMessage=Użytkownik {0} {1} nie jest powiązany z żadnym znanym użytkownikiem.
 confirmLinkIdpReviewProfile=Przejrzyj profil
 confirmLinkIdpContinue=Dodaj do istniejącego konta
+confirmOverrideIdpContinue=Tak, zastąp połączenie bieżącym kontem
 
-configureTotpMessage=Musisz skonfigurować Mobile Authenticator aby aktywować swoje konto.
-updateProfileMessage=Musisz zaktualizować profilu użytkownika aby aktywować swoje konto.
-updatePasswordMessage=Musisz zmienić swoje hasło aby aktywować swoje konto.
+configureTotpMessage=Musisz skonfigurować aplikację uwierzytelniającą, aby aktywować swoje konto.
+configureBackupCodesMessage=Musisz skonfigurować Kody Zapasowe, aby aktywować swoje konto.
+updateProfileMessage=Musisz zaktualizować profilu użytkownika, aby aktywować swoje konto.
+updatePasswordMessage=Musisz zmienić swoje hasło, aby aktywować swoje konto.
+updateEmailMessage=Musisz zaktualizować swój adres e-mail, aby aktywować swoje konto.
 resetPasswordMessage=Musisz zmienić swoje hasło.
-verifyEmailMessage=Musisz zweryfikować swój adres e-mail aby aktywować swoje konto.
+verifyEmailMessage=Musisz zweryfikować swój adres e-mail, aby aktywować swoje konto.
 linkIdpMessage=Musisz zweryfikować swój adres e-mail, aby połączyć swoje konto z {0}.
 
 emailSentMessage=Powinieneś otrzymywać wkrótce pocztę z dalszymi instrukcjami.
@@ -232,20 +318,24 @@ delegationFailedMessage=Możesz zamknąć okno przeglądarki, wrócić do aplika
 
 noAccessMessage=Brak dostępu
 
-invalidPasswordMinLengthMessage=Nieprawidłowe hasło\: minimalna długość {0}.
-invalidPasswordMinDigitsMessage=Nieprawidłowe hasło\: musi zawierać przynajmniej {0} cyfr.
-invalidPasswordMinLowerCaseCharsMessage=Nieprawidłowe hasło\: musi zawierać co najmniej {0} małych liter.
-invalidPasswordMinUpperCaseCharsMessage=Nieprawidłowe hasło\: musi zawierać co najmniej {0} wielkich liter.
-invalidPasswordMinSpecialCharsMessage=Nieprawidłowe hasło\: musi zawierać przynajmniej {0} znaków specjalnych.
-invalidPasswordNotUsernameMessage=Nieprawidłowe hasło\: nie może być nazwą użytkownika.
-invalidPasswordRegexPatternMessage=Nieprawidłowe hasło\: brak zgodności z wyrażeniem regularnym.
-invalidPasswordHistoryMessage=Nieprawidłowe hasło\: nie może być takie jak {0} ostatnich haseł.
-invalidPasswordGenericMessage=Nieprawidłowe hasło\: nowe hasło nie jest zgodne z zasadami haseł.
+invalidPasswordMinLengthMessage=Nieprawidłowe hasło: minimalna długość {0}.
+invalidPasswordMaxLengthMessage=Nieprawidłowe hasło: maksymalna długość {0}.
+invalidPasswordMinDigitsMessage=Nieprawidłowe hasło: musi zawierać przynajmniej {0} cyfr.
+invalidPasswordMinLowerCaseCharsMessage=Nieprawidłowe hasło: musi zawierać co najmniej {0} małych liter.
+invalidPasswordMinUpperCaseCharsMessage=Nieprawidłowe hasło: musi zawierać co najmniej {0} wielkich liter.
+invalidPasswordMinSpecialCharsMessage=Nieprawidłowe hasło: musi zawierać przynajmniej {0} znaków specjalnych.
+invalidPasswordNotUsernameMessage=Nieprawidłowe hasło: nie może być nazwą użytkownika.
+invalidPasswordNotContainsUsernameMessage=Nieprawidłowe hasło: nie może zawierać nazwy użytkownika.
+invalidPasswordNotEmailMessage=Nieprawidłowe hasło: nie może być takie samo jak adres e-mail.
+invalidPasswordRegexPatternMessage=Nieprawidłowe hasło: brak zgodności z wyrażeniem regularnym.
+invalidPasswordHistoryMessage=Nieprawidłowe hasło: nie może być takie jak {0} ostatnich haseł.
+invalidPasswordGenericMessage=Nieprawidłowe hasło: nowe hasło nie jest zgodne z zasadami haseł.
 
 failedToProcessResponseMessage=Nie można przetworzyć odpowiedzi
 httpsRequiredMessage=Wymagany HTTPS
 realmNotEnabledMessage=Strefa nie jest aktywna
 invalidRequestMessage=Nieprawidłowe żądanie
+successLogout=Jesteś wylogowany
 failedLogout=Wylogowanie nie powiodło się
 unknownLoginRequesterMessage=Nieznany żądający logowania
 loginRequesterNotEnabledMessage=Żądający logowania nie jest aktywny
@@ -271,14 +361,22 @@ unexpectedErrorHandlingRequestMessage=Nieoczekiwany błąd podczas obsługi żą
 invalidAccessCodeMessage=Nieprawidłowy kod dostępu.
 sessionNotActiveMessage=Sesja nie jest aktywna.
 invalidCodeMessage=Wystąpił błąd, zaloguj się ponownie za pośrednictwem aplikacji.
+cookieNotFoundMessage=Nie znaleziono pliku cookie do ponownego logowania. Mógł on wygasnąć, zostać usunięty lub masz wyłączone pliki cookie w przeglądarce. Jeśli pliki cookie są wyłączone, włącz je. Kliknij ''Powrót do aplikacji'', aby zalogować się ponownie
+insufficientLevelOfAuthentication=Żądany poziom uwierzytelnienia nie został spełniony.
 identityProviderUnexpectedErrorMessage=Nieoczekiwany błąd podczas uwierzytelniania u dostawcy tożsamości
+identityProviderMissingStateMessage=Brak parametru stanu w odpowiedzi od dostawcy tożsamości.
+identityProviderMissingCodeOrErrorMessage=Brak kodu lub parametru błędu w odpowiedzi od dostawcy tożsamości.
+identityProviderInvalidResponseMessage=Nieprawidłowa odpowiedź od dostawcy tożsamości.
+identityProviderInvalidSignatureMessage=Nieprawidłowy podpis w odpowiedzi od dostawcy tożsamości.
 identityProviderNotFoundMessage=Nie można odnaleźć dostawcy tożsamości z tym identyfikatorem.
 identityProviderLinkSuccess=Pomyślnie zweryfikowano e-mail. Wróć do oryginalnej przeglądarki i tam kontynuuj logowanie.
 staleCodeMessage=Ta strona nie jest już ważna, proszę wrócić do aplikacji i zalogować się ponownie
 realmSupportsNoCredentialsMessage=Strefa nie obsługuje dowolnego typu poświadczeń.
+credentialSetupRequired=Nie można się zalogować, wymagana jest konfiguracja danych uwierzytelniających.
 identityProviderNotUniqueMessage=Strefa obsługuje wielu dostawców tożsamości. Nie można określić dostawcy tożsamości, który powinien być używany do uwierzytelniania.
 emailVerifiedMessage=Twój adres e-mail został zweryfikowany.
-staleEmailVerificationLink=Użyto nieaktualny link stanu, który stracił ważność.  Może e-mail został już zweryfikowany?
+emailVerifiedAlreadyMessage=Twój adres e-mail został już zweryfikowany.
+staleEmailVerificationLink=Użyto nieaktualny link stanu, który stracił ważność. Może e-mail został już zweryfikowany?
 identityProviderAlreadyLinkedMessage=Stowarzyszona tożsamość, zwrócona przez {0} jest już połączona z innym użytkownikiem.
 confirmAccountLinking=Potwierdź powiązanie konta {0} dostawcy tożsamości {1} z twoim kontem.
 confirmEmailAddressVerification=Potwierdź ważność adresu e-mail {0}.
@@ -293,30 +391,150 @@ alreadyLoggedIn=Jesteś już zalogowany.
 differentUserAuthenticated=Jesteś już uwierzytelniona/y jako inny użytkownik ''{0}'' w tej sesji. Najpierw się wyloguj.
 brokerLinkingSessionExpired=Żądano łączenia kont brokera, ale bieżąca sesja już jest nieważna.
 proceedWithAction=&raquo; kliknij tutaj, aby przejść
+acrNotFulfilled=Wymagania uwierzytelniania nie zostały spełnione
 
 requiredAction.CONFIGURE_TOTP=Skonfiguruj OTP
 requiredAction.TERMS_AND_CONDITIONS=Regulamin
 requiredAction.UPDATE_PASSWORD=Zaktualizuj hasło
 requiredAction.UPDATE_PROFILE=Zaktualizuj profil
 requiredAction.VERIFY_EMAIL=Zweryfikuj adres e-mail
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generuj kody odzyskania
+requiredAction.webauthn-register-passwordless=Rejestr Webauthn bez hasła
+requiredAction.webauthn-register=Rejestr Webauthn
+
+invalidTokenRequiredActions=Wymagane działania zawarte w linku są nieprawidłowe
 
-doX509Login=Użytkownik będzie zalogowany jako\:
-clientCertificate=X509 certyfikat klienta\:
-noCertificate=[brak certyfikatu]
+doX509Login=Użytkownik będzie zalogowany jako:
+clientCertificate=X509 certyfikat klienta:
+noCertificate=[Brak certyfikatu]
 
 
 pageNotFound=Nie znaleziono strony
 internalServerError=Wystąpił błąd wewnętrzny serwera
 
-console-username=Nazwa użytkownika\:
-console-password=Hasło\:
-console-otp=Hasło jednorazowe\:
-console-new-password=Nowe hasło\:
-console-confirm-password=Potwierdź hasło\:
+console-username=Nazwa użytkownika:
+console-password=Hasło:
+console-otp=Hasło jednorazowe:
+console-new-password=Nowe hasło:
+console-confirm-password=Potwierdź hasło:
 console-update-password=Aktualizacja hasła jest wymagana.
-console-verify-email=Musisz zweryfikować swój adres e-mail.  Wiadomość e-mail z kodem weryfikacyjnym została wysłana do {0}. Podaj ten kod poniżej.
-console-email-code=Kod z e-mail\:
-console-accept-terms=Akceptujesz warunki? [t/n]\:
+console-verify-email=Musisz zweryfikować swój adres e-mail. Wiadomość e-mail z kodem weryfikacyjnym została wysłana do {0}. Podaj ten kod poniżej.
+console-email-code=Kod z e-maila:
+console-accept-terms=Akceptujesz warunki? [t/n]:
 console-accept=t
 
+# Openshift messages
+openshift.scope.user_info=Informacje o użytkowniku
+openshift.scope.user_check-access=Informacje o dostępie użytkownika
+openshift.scope.user_full=Pełny dostęp
+openshift.scope.list-projects=Wyświetl projekty
+
+# SAML authentication
+saml.post-form.title=Przekierowanie uwierzytelnienia
+saml.post-form.message=Przekierowywanie, proszę czekać.
+saml.post-form.js-disabled=JavaScript jest wyłączony. Zdecydowanie zalecamy jej włączenie. Kliknij przycisk poniżej, aby kontynuować.
+saml.artifactResolutionServiceInvalidResponse=Nie udało się przetworzyć artefaktu.
+
+#authenticators
+otp-display-name=Aplikacja uwierzytelniająca
+otp-help-text=Wprowadź kod weryfikacyjny z aplikacji uwierzytelniającej.
+otp-reset-description=Którą konfigurację OTP należy usunąć?
+password-display-name=Hasło
+password-help-text=Zaloguj się wpisując hasło
+auth-username-form-display-name=Nazwa użytkownika
+auth-username-form-help-text=Rozpocznij logowanie, wprowadzając swoją nazwę użytkownika
+auth-username-password-form-display-name=Nazwa użytkownika i hasło
+auth-username-password-form-help-text=Zaloguj się, wprowadzając swoją nazwę użytkownika i hasło.
+auth-x509-client-username-form-display-name=Certyfikat X509
+auth-x509-client-username-form-help-text=Zaloguj się przy użyciu certyfikatu klienta X509.
+
+# Recovery Codes
+auth-recovery-authn-code-form-display-name=Kod uwierzytelniający odzyskiwanie
+auth-recovery-authn-code-form-help-text=Wpisz kod uwierzytelniający odzyskiwanie z poprzednio wygenerowanej listy.
+auth-recovery-code-info-message=Wprowadź podany kod odzyskiwania.
+auth-recovery-code-prompt=Kod odzyskiwania #{0}
+auth-recovery-code-header=Zaloguj z kodem uwierzytelniającym odzyskiwanie
+recovery-codes-error-invalid=Niepoprawny kod uwierzytelniający odzyskiwanie
+recovery-code-config-header=Kody uwierzytelniające odzyskiwanie
+recovery-code-config-warning-title=Te kody odzyskiwania nie pojawią się ponownie po opuszczeniu tej strony
+recovery-code-config-warning-message=Należy je wydrukować, pobrać lub skopiować do menedżera haseł i trzymać je w bezpiecznym miejscu. Anulowanie tej konfiguracji spowoduje usunięcie kodów odzyskiwania z konta.
+recovery-codes-print=Drukuj
+recovery-codes-download=Pobierz
+recovery-codes-copy=Kopiuj
+recovery-codes-copied=Skopiowane
+recovery-codes-confirmation-message=Zapisałem te kody gdzieś w bezpiecznym miejscu
+recovery-codes-action-complete=Zakończ konfigurację
+recovery-codes-action-cancel=Anuluj konfigurację
+recovery-codes-download-file-header=Przechowuj te kody w bezpiecznym miejscu
+recovery-codes-download-file-description=Kody odzyskiwania to jednorazowe kody dostępu, które umożliwiają zalogowanie się na konto, jeśli nie masz dostępu do narzędzia uwierzytelniającego.
+recovery-codes-download-file-date=Te kody zostały wygenerowane
+recovery-codes-label-default=Kody odzyskiwania
+
+# WebAuthn
+webauthn-display-name=Passkey
+webauthn-help-text=Użyj Passkey do zalogowania się
+webauthn-passwordless-display-name=Passkey
+webauthn-passwordless-help-text=Użyj Passkey do logowania bez hasła.
+webauthn-login-title=Logowanie za pomocą Passkey
+webauthn-registration-title=Rejestracja Passkey
+webauthn-available-authenticators=Dostępne Passkeys
+webauthn-unsupported-browser-text=WebAuthn nie jest obsługiwany przez tę przeglądarkę. Wypróbuj inną lub skontaktuj się z administratorem.
+webauthn-doAuthenticate=Zaloguj z użyciem Passkey
+webauthn-createdAt-label=Utworzony
+webauthn-registration-init-label=Passkey (Domyślna etykieta)
+webauthn-registration-init-label-prompt=Wprowadź etykietę zarejestrowanego Passkey
+
+
+# WebAuthn Error
+webauthn-error-title=Błąd Passkey
+webauthn-error-registration=Nie udało się zarejestrować Twojego Passkey.<br /> {0}
+webauthn-error-api-get=Nie udało się uwierzytelnić za pomocą Passkey.<br /> {0}
+webauthn-error-different-user=Pierwszy uwierzytelniony użytkownik nie jest tym który został uwierzytelniony przez Passkey
+webauthn-error-auth-verification=Wynik autoryzacji za pomocą Passkey jest niepoprawny.<br /> {0}
+webauthn-error-register-verification=Wynik rejestracji za pomocą Passkey jest niepoprawny.<br /> {0}
+webauthn-error-user-not-found=Nieznany użytkownik uwierzytelniony przez Passkey.
+
+# Passkey
+passkey-login-title=Logowanie za pomocą Passkey
+passkey-available-authenticators=Dostępne Passkey
+passkey-unsupported-browser-text=Passkey nie jest obsługiwany przez tę przeglądarkę. Wypróbuj inną lub skontaktuj się z administratorem.
+passkey-doAuthenticate=Zaloguj się przy użyciu Passkey
+passkey-createdAt-label=Utworzony
+passkey-autofill-select=Wybierz swój Passkey
+
+# Identity provider
+identity-provider-redirector=Połącz się z innym dostawcą tożsamości
+identity-provider-login-label=Lub zaloguj się za pomocą
+idp-email-verification-display-name=Weryfikacja adresu e-mail
+idp-email-verification-help-text=Połącz swoje konto, weryfikując swój e-mail.
+idp-username-password-form-display-name=Nazwa użytkownika i hasło
+idp-username-password-form-help-text=Połącz swoje konto logując się.
+
+finalDeletionConfirmation=Jeśli usuniesz swoje konto, nie będzie można go przywrócić. Aby zachować swoje konto, kliknij Anuluj.
+irreversibleAction=Ta akcja jest nieodwracalna
+deleteAccountConfirm=Potwierdzenie usunięcia konta
+
+deletingImplies=Usunięcie konta oznacza:
+errasingData=Usuwanie wszystkich danych
+loggingOutImmediately=Natychmiastowe wylogowywanie
+accountUnusable=Kolejne użycie aplikacji nie będzie możliwe przy użyciu tego konta
+userDeletedSuccessfully=Użytkownik został usunięty
+
+access-denied=Odmowa dostępu
+access-denied-when-idp-auth=Odmowa dostępu podczas uwierzytelniania za pomocą {0}
+
+frontchannel-logout.title=Wylogowywanie
+frontchannel-logout.message=Wylogowujesz się z następujących aplikacji
+logoutConfirmTitle=Wylogowywanie
+logoutConfirmHeader=Czy chcesz się wylogować?
+doLogout=Wyloguj
+
 readOnlyUsernameMessage=Zmiana nazwy użytkownika nie jest możliwa, ponieważ edycja konta jest zablokowana.
+error-invalid-multivalued-size=Atrybut {0} musi mieć co najmniej {1} i najwyżej {2} {2,choice,0#wartości|1#wartość|1<wartości}.
+
+organization.confirm-membership.title=Zaraz dołączysz do organizacji ${kc.org.name}
+organization.confirm-membership=Klikając na poniższy link, zostaniesz członkiem organizacji {0}:
+organization.member.register.title=Utwórz konto, aby dołączyć do organizacji ${kc.org.name}
+organization.select=Wybierz organizację, aby kontynuuować
+notMemberOfOrganization=Użytkownik nie jest członkiem organizacji {0}
+notMemberOfAnyOrganization=Użytkownik nie jest członkiem żadnej organizacji
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_pt_BR.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_pt_BR.properties
old mode 100755
new mode 100644
index 64e882c9e361..5c77478c8fc6
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_pt_BR.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_pt_BR.properties
@@ -2,7 +2,7 @@ doLogIn=Entrar
 doRegister=Cadastre-se
 doRegisterSecurityKey=Cadastre-se
 doCancel=Cancelar
-doSubmit=Ok
+doSubmit=Enviar
 doBack=Voltar
 doYes=Sim
 doNo=Não
@@ -15,33 +15,33 @@ doClickHere=Clique aqui
 doImpersonate=Personificar
 doTryAgain=Tente novamente
 doTryAnotherWay=Tente outra forma
-doConfirmDelete=Confirmar descadastramento
-errorDeletingAccount=Falha ao apagar conta
+doConfirmDelete=Confirmar exclusão
+errorDeletingAccount=Ocorreu um erro ao excluir a conta
 deletingAccountForbidden=Você não tem permissões para apagar a sua própria conta, entre em contato com um administrador.
 kerberosNotConfigured=Kerberos Não Configurado
 kerberosNotConfiguredTitle=Kerberos Não Configurado
 bypassKerberosDetail=Ou você não possui uma sessão Kerberos ou o seu navegador não está configurado para usar o acesso do Kerberos. Por favor, clique em continuar para fazer o login no através de outros meios
-kerberosNotSetUp=Kerberos não está configurado. Você não pode acessar a aplicação.
+kerberosNotSetUp=O Kerberos não está configurado. Você não consegue fazer login.
 registerTitle=Registre-se
 loginAccountTitle=Entrar na sua conta
 loginTitle=Entrar em {0}
 loginTitleHtml={0}
 impersonateTitle={0} Personificar Usuário
 impersonateTitleHtml=<strong>{0}</strong> Personificar Usuário
-realmChoice=Domínio
+realmChoice=Realm
 unknownUser=Usuário desconhecido
 loginTotpTitle=Configuração do autenticador móvel
 loginProfileTitle=Atualizar Informações da Conta
-loginTimeout=Você demorou muito para entrar. Por favor, recomece o processo de login.
+loginTimeout=Sua tentativa de login expirou. O processo de login será reiniciado.
 oauthGrantTitle=Conceder acesso a {0}
 oauthGrantTitleHtml={0}
 errorTitle=Sentimos muito...
 errorTitleHtml=<strong>Sentimos</strong> muito ...
-emailVerifyTitle=Verificação de endereço de e-mail
+emailVerifyTitle=Verificação de email
 emailForgotTitle=Esqueceu sua senha?
 updatePasswordTitle=Atualizar senha
 codeSuccessTitle=Código de sucesso
-codeErrorTitle=Código de erro\: {0}
+codeErrorTitle=Código de erro: {0}
 displayUnsupported=Tipo de exibição solicitado não suportado
 browserRequired=Navegador necessário para realizar acesso
 browserContinue=Navegador necessário para concluir o login
@@ -52,11 +52,9 @@ browserContinueAnswer=s
 termsTitle=Termos e Condições
 termsText=<p>Termos e condições a serem definidos</p>
 termsPlainText=Termos e condições a serem definidos.
-
 recaptchaFailed=Recaptcha Inválido
 recaptchaNotConfigured=O recaptcha é necessário, mas não foi configurado
 consentDenied=Consentimento negado.
-
 noAccount=Novo usuário?
 username=Nome de usuário
 usernameOrEmail=Nome de usuário ou e-mail
@@ -65,46 +63,43 @@ givenName=Primeiro nome
 fullName=Nome completo
 lastName=Sobrenome
 familyName=Sobrenome
-email=Endereço de e-mail
+email=Endereço de email
 password=Senha
 passwordConfirm=Confirme a senha
 passwordNew=Nova senha
 passwordNewConfirm=Confirmação de Nova Senha
 rememberMe=Mantenha-me conectado
-authenticatorCode=Código autenticador
+authenticatorCode=Código de uso único
 address=Endereço
 street=Logradouro
 locality=Cidade ou localidade
 region=Estado
 postal_code=CEP
 country=País
-emailVerified=Endereço de e-mail verificado
+emailVerified=Email verificado
 website=Página da web
 phoneNumber=Número de telefone
 phoneNumberVerified=Número de telefone verificado
 gender=Gênero
 birthday=Data de nascimento
-zoneinfo=Zona horária
+zoneinfo=Fuso horário
 gssDelegationCredential=Delegação de Credenciais GSS
 logoutOtherSessions=Sair dos outros dispositivos
-
 profileScopeConsentText=Perfil de usuário
-emailScopeConsentText=Endereço de e-mail
+emailScopeConsentText=Endereço de email
 addressScopeConsentText=Endereço
 phoneScopeConsentText=Número de telefone
 offlineAccessScopeConsentText=Acesso Offline
-samlRoleListScopeConsentText=Meus Perfis de Acesso
-rolesScopeConsentText=Perfis de acesso do usuário
-
+samlRoleListScopeConsentText=Meus Papéis
+rolesScopeConsentText=Papéis de usuário
 restartLoginTooltip=Reiniciar o login
-
 loginTotpIntro=Você precisa configurar um gerador de código de uso único para acessar esta conta
 loginTotpStep1=Instale um dos seguintes aplicativos no seu celular:
 loginTotpStep2=Abra o aplicativo e escaneie o código QR:
 loginTotpStep3=Digite o código de uso único fornecido pelo aplicativo e clique em Ok para concluir a configuração.
 loginTotpStep3DeviceName=Forneça um nome de dispositivo para ajudá-lo a gerenciar seus dispositivos de autenticação de dois fatores.
 loginTotpManualStep2=Abra o aplicativo e digite a chave:
-loginTotpManualStep3=Use os seguintes valores de configuração se o aplicativo permitir defini-los:
+loginTotpManualStep3=Use os seguintes valores de configuração caso o aplicativo permita defini-los:
 loginTotpUnableToScan=Não foi possível ler o código QR?
 loginTotpScanBarcode=Escanear código QR?
 loginCredential=Credencial
@@ -115,48 +110,38 @@ loginTotpDigits=Dígitos
 loginTotpInterval=Intervalo
 loginTotpCounter=Contador
 loginTotpDeviceName=Nome do dispositivo
-
 loginTotp.totp=Baseado em tempo
 loginTotp.hotp=Baseado em contador
-
 loginChooseAuthenticator=Selecione o método de login
-
 oauthGrantRequest=Você concede esses privilégios de acesso?
 inResource=em
-
-emailVerifyInstruction1=Um e-mail com instruções para verificar o seu endereço de e-mail foi enviado para você.
-emailVerifyInstruction2=Não recebeu um código de verificação em seu e-mail?
-emailVerifyInstruction3=para reenviar o e-mail.
-
+emailVerifyInstruction1=Um email com instruções para verificar seu endereço de email foi enviado para {0}.
+emailVerifyInstruction2=Não recebeu um código de verificação em seu email?
+emailVerifyInstruction3=para reenviar o email.
 emailLinkIdpTitle=Vincular {0}
-emailLinkIdp1=Um e-mail com instruções para vincular a conta {0} {1} com sua conta {2} foi enviado para você.
-emailLinkIdp2=Não recebeu um código de verificação no e-mail?
-emailLinkIdp3=para reenviar o e-mail.
+emailLinkIdp1=Um email com instruções para vincular a conta {0} {1} com sua conta {2} foi enviado para você.
+emailLinkIdp2=Não recebeu um código de verificação no email?
+emailLinkIdp3=para reenviar o email.
 emailLinkIdp4=Se você já verificou o email em outro navegador
 emailLinkIdp5=para continuar.
-
 backToLogin=&laquo; Voltar ao Login
-
-emailInstruction=Digite seu nome de usuário ou endereço de e-mail e nós lhe enviaremos instruções sobre como criar uma nova senha.
-
+emailInstruction=Digite seu nome de usuário ou endereço de email e nós lhe enviaremos instruções sobre como criar uma nova senha.
 copyCodeInstruction=Por favor, copie o código e cole-o em seu aplicativo:
-
 pageExpiredTitle=A página expirou
 pageExpiredMsg1=Para reiniciar o processo de login
 pageExpiredMsg2=Para continuar o processo de login
-
 personalInfo=Informações Pessoais:
-role_admin=Admininstrador
-role_realm-admin=Admininstrador do Domínio
-role_create-realm=Criar domínio
+role_admin=Administrador
+role_realm-admin=Admininstrador do Realm
+role_create-realm=Criar realm
 role_create-client=Criar cliente
-role_view-realm=Visualizar domínio
+role_view-realm=Visualizar realm
 role_view-users=Visualizar usuários
 role_view-applications=Visualizar aplicativos
 role_view-clients=Visualizar clientes
 role_view-events=Visualizar eventos
 role_view-identity-providers=Visualizar provedores de identidade
-role_manage-realm=Gerenciar domínio
+role_manage-realm=Gerenciar realm
 role_manage-users=Gerenciar usuários
 role_manage-applications=Gerenciar aplicativos
 role_manage-identity-providers=Gerenciar provedores de identidade
@@ -171,16 +156,14 @@ client_account=Conta
 client_account-console=Console da Conta
 client_security-admin-console=Console de Administração de Segurança
 client_admin-cli=CLI de Administração
-client_realm-management=Gerenciamento de Domínio
-client_broker=Provedor de Identidade
-
+client_realm-management=Gerenciamento do Realm
+client_broker=Intermediário
 requiredFields=Campos obrigatórios
-
 invalidUserMessage=Nome de usuário ou senha inválida.
 invalidUsernameMessage=Nome de usuário inválido.
-invalidUsernameOrEmailMessage=Nome de usuário ou endereço de e-mail inválido.
+invalidUsernameOrEmailMessage=Nome de usuário ou email inválido.
 invalidPasswordMessage=Senha inválida.
-invalidEmailMessage=Endereço de e-mail inválido.
+invalidEmailMessage=Endereço de email inválido.
 accountDisabledMessage=Conta desativada, por favor, contate um administrador.
 accountTemporarilyDisabledMessage=Nome de usuário ou senha inválida.
 accountPermanentlyDisabledMessage=Nome de usuário ou senha inválida.
@@ -190,82 +173,69 @@ expiredCodeMessage=Tempo de login expirado. Por favor, faça login novamente.
 expiredActionMessage=Ação expirada. Por favor, continue com o login agora.
 expiredActionTokenNoSessionMessage=Ação expirada.
 expiredActionTokenSessionExistsMessage=Ação expirada. Por favor, comece novamente.
-
 missingFirstNameMessage=Por favor, informe o primeiro nome.
 missingLastNameMessage=Por favor, informe o sobrenome.
-missingEmailMessage=Por favor, informe o endereço de e-mail.
+missingEmailMessage=Por favor, informe o email.
 missingUsernameMessage=Por favor, informe o nome de usuário.
 missingPasswordMessage=Por favor, informe a senha.
 missingTotpMessage=Por favor, informe o código de uso único.
 missingTotpDeviceNameMessage=Por favor, informe o nome do dispositivo.
 notMatchPasswordMessage=As senhas não coincidem.
-
 invalidPasswordExistingMessage=Senha atual inválida.
-invalidPasswordBlacklistedMessage=Senha inválida, devido a lista de exclusão.
-invalidPasswordConfirmMessage=Senha de confirmação não coincide.
-invalidTotpMessage=Código de uso único inválido.
-
+invalidPasswordBlacklistedMessage=Senha inválida: esta senha está na lista de exclusão.
+invalidPasswordConfirmMessage=A senha de confirmação não coincide.
+invalidTotpMessage=Código autenticador inválido.
 usernameExistsMessage=Nome de usuário já existe.
-emailExistsMessage=Endereço de e-mail já existe.
-
+emailExistsMessage=Email já existe.
 federatedIdentityExistsMessage=Usuário com {0} {1} já existe. Por favor, entre no gerenciamento de conta para vincular a conta.
 federatedIdentityUnavailableMessage=Usuário {0} autenticado com o provedor de identidade {1} não existe. Por favor, entre em contato com um administrador.
-
 confirmLinkIdpTitle=Conta já existente
-federatedIdentityConfirmLinkMessage=Usuário com {0} {1} já existe. Como você quer continuar?
+federatedIdentityConfirmLinkMessage=Usuário com {0} {1} já existe. Como você deseja continuar?
 federatedIdentityConfirmReauthenticateMessage=Autenticar para vincular sua conta com {0}
 nestedFirstBrokerFlowMessage=O usuário {0} {1} não está vinculado a nenhum usuário conhecido.
-confirmLinkIdpReviewProfile=Revisar informações do perfil
+confirmLinkIdpReviewProfile=Revisar perfil
 confirmLinkIdpContinue=Vincular à conta existente
-
-configureTotpMessage=Você precisa configurar seu celular com o autenticador Mobile para ativar sua conta.
+configureTotpMessage=Você precisa configurar o Autenticador Móvel para ativar sua conta.
 updateProfileMessage=Você precisa atualizar o seu perfil de usuário para ativar sua conta.
 updatePasswordMessage=Você precisa mudar sua senha para ativar sua conta.
 resetPasswordMessage=Você precisa mudar sua senha.
 verifyEmailMessage=Você precisa verificar o seu endereço de e-mail para ativar sua conta.
 linkIdpMessage=Você precisa confirmar o seu endereço de e-mail para vincular sua conta com {0}.
-
 emailSentMessage=Você deverá receber um e-mail em breve com mais instruções.
 emailSendErrorMessage=Falha ao enviar e-mail, por favor, tente novamente mais tarde.
-
 accountUpdatedMessage=Sua conta foi atualizada.
 accountPasswordUpdatedMessage=Sua senha foi atualizada.
-
 delegationCompleteHeader=Autenticação Bem Sucedida
 delegationCompleteMessage=Você pode fechar esta janela do navegador e voltar ao seu aplicativo.
 delegationFailedHeader=Falha na Autenticação
 delegationFailedMessage=Você pode fechar esta janela do navegador e voltar ao aplicativo e tentar fazer login novamente.
-
 noAccessMessage=Sem acesso
-
-invalidPasswordMinLengthMessage=Senha inválida\: deve ter pelo menos {0} caracteres.
-invalidPasswordMinDigitsMessage=Senha inválida\: deve conter pelo menos {0} número(s).
-invalidPasswordMinLowerCaseCharsMessage=Senha inválida\: deve conter pelo menos {0} letra(s) minúscula(s).
-invalidPasswordMinUpperCaseCharsMessage=Senha inválida\: deve conter pelo menos {0} letra(s) maiúscula(s).
-invalidPasswordMinSpecialCharsMessage=Senha inválida\: deve conter pelo menos {0} caractere(s) especial(is).
-invalidPasswordNotUsernameMessage=Senha inválida\: não pode ser igual ao nome de usuário
-invalidPasswordNotContainsUsernameMessage=Senha inválida\: não pode conter o nome de usuário.
-invalidPasswordNotEmailMessage=Senha inválida: não pode ser igual ao endereço de e-mail.
-invalidPasswordRegexPatternMessage=Senha inválida\: não corresponde ao(s) padrão(ões) de expressão regular.
-invalidPasswordHistoryMessage=Senha inválida\: não pode ser igual a qualquer uma da(s) última(s) {0} senha(s).
+invalidPasswordMinLengthMessage=Senha inválida: tamanho mínimo {0}.
+invalidPasswordMinDigitsMessage=Senha inválida: deve conter pelo menos {0} número(s).
+invalidPasswordMinLowerCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) minúscula(s).
+invalidPasswordMinUpperCaseCharsMessage=Senha inválida: deve conter pelo menos {0} letra(s) maiúscula(s).
+invalidPasswordMinSpecialCharsMessage=Senha inválida: deve conter pelo menos {0} caractere(s) especial(is).
+invalidPasswordNotUsernameMessage=Senha inválida: não pode ser igual ao nome de usuário.
+invalidPasswordNotContainsUsernameMessage=Senha inválida: não pode conter o nome de usuário.
+invalidPasswordNotEmailMessage=Senha inválida: não pode ser igual ao email.
+invalidPasswordRegexPatternMessage=Senha inválida: não corresponde ao(s) padrão(ões) de expressão regular.
+invalidPasswordHistoryMessage=Senha inválida: não pode ser igual a nenhuma da(s) última(s) {0} senha(s).
 invalidPasswordGenericMessage=Senha inválida: a nova senha não cumpre as políticas de senha.
-
 failedToProcessResponseMessage=Falha ao processar a resposta
 httpsRequiredMessage=HTTPS necessário
-realmNotEnabledMessage=Domínio desativado
+realmNotEnabledMessage=Realm desativado
 invalidRequestMessage=Solicitação inválida
 failedLogout=Falha ao sair
 unknownLoginRequesterMessage=Solicitante de login desconhecido
 loginRequesterNotEnabledMessage=Solicitante de login desativado
-bearerOnlyMessage=Aplicativos configurados como Bearer-Only não têm permissão para iniciar o login pelo navegador
-standardFlowDisabledMessage=O cliente não tem permissão para iniciar o login com o response_type informado. O fluxo padrão está desabilitado para o cliente.
-implicitFlowDisabledMessage=O cliente não tem permissão para iniciar o login com o response_type informado. O fluxo implícito está desabilitado para o cliente.
+bearerOnlyMessage=Aplicações do tipo bearer-only não têm permissão para iniciar login via navegador
+standardFlowDisabledMessage=O cliente não tem permissão para iniciar login via navegador com o response_type informado. O fluxo padrão está desativado para o cliente.
+implicitFlowDisabledMessage=O cliente não tem permissão para iniciar login via navegador com o response_type informado. O fluxo implícito está desabilitado para o cliente.
 invalidRedirectUriMessage=URI de redirecionamento inválido
 unsupportedNameIdFormatMessage=NameIDFormat não suportado
 invalidRequesterMessage=Solicitante inválido
 registrationNotAllowedMessage=Cadastro não é permitido
-resetCredentialNotAllowedMessage=Sem permissão de redefinição de credenciais
-
+resetCredentialNotAllowedMessage=Redefinição de credencial não permitida
 permissionNotApprovedMessage=Permissão não aprovada.
 noRelayStateInResponseMessage=Sem estado de retransmissão na resposta do provedor de identidade.
 insufficientPermissionMessage=Permissões insuficientes para vincular identidades.
@@ -278,54 +248,50 @@ couldNotSendAuthenticationRequestMessage=Não foi possível enviar a solicitaç
 unexpectedErrorHandlingRequestMessage=Erro inesperado ao tratar o pedido de autenticação ao provedor de identidade.
 invalidAccessCodeMessage=Código de acesso inválido.
 sessionNotActiveMessage=Sessão inativa.
-invalidCodeMessage=Um erro correu, por favor, faça login novamente através da aplicação.
+invalidCodeMessage=Ocorreu um erro, por favor, faça login novamente através da sua aplicação.
 identityProviderUnexpectedErrorMessage=Erro inesperado durante a autenticação com o provedor de identidade
 identityProviderMissingStateMessage=Parâmetro de estado ausente da resposta do provedor de identidades.
 identityProviderNotFoundMessage=Não foi possível encontrar um provedor de identidade com o identificador.
-identityProviderLinkSuccess=O seu endereço de e-mail foi confirmado com sucesso. Por favor, retorne à aba original e continue com o login.
+identityProviderLinkSuccess=Você verificou seu email com sucesso. Por favor, retorne à aba original e continue com o login.
 staleCodeMessage=Esta página não é mais válida. Por favor, volte à aplicação e faça login novamente
-realmSupportsNoCredentialsMessage=O domínio não suporta qualquer tipo de credencial.
+realmSupportsNoCredentialsMessage=O realm não suporta nenhum tipo de credencial.
 credentialSetupRequired=Não é possível fazer o login, a configuração de credencial é necessária.
-identityProviderNotUniqueMessage=O domínio suporta múltiplos provedores de identidade. Não foi possível determinar qual o provedor de identidade deve ser usado para autenticação.
-emailVerifiedMessage=O seu endereço de e-mail foi confirmado.
-staleEmailVerificationLink=O link em que você clicou é um link antigo e não é mais válido. Talvez você já tenha confirmado o seu endereço de e-mail.
-identityProviderAlreadyLinkedMessage=A conta retornada do {0} já está vinculada a outro usuário.
+identityProviderNotUniqueMessage=O realm suporta múltiplos provedores de identidade. Não foi possível determinar qual o provedor de identidade deve ser usado para autenticação.
+emailVerifiedMessage=O seu endereço de email foi confirmado.
+staleEmailVerificationLink=O link em que você clicou é um link antigo e não é mais válido. Talvez você já tenha confirmado o seu email.
+identityProviderAlreadyLinkedMessage=A conta federada retornada por {0} já está vinculada a outro usuário.
 confirmAccountLinking=Confirme o vinculação da conta {0} do provedor de identidade {1} à sua conta.
-confirmEmailAddressVerification=Confirme a validade do endereço de e-mail {0}.
+confirmEmailAddressVerification=Confirme a validade do endereço de email {0}.
 confirmExecutionOfActions=Execute a(s) seguinte(s) ação(ões)
-
 backToApplication=&laquo; Voltar para o aplicativo
-missingParameterMessage=Parâmetros ausentes\: {0}
+missingParameterMessage=Parâmetros ausentes: {0}
 clientNotFoundMessage=Cliente não encontrado.
 clientDisabledMessage=Cliente desativado.
-invalidParameterMessage=Parâmetro inválido\: {0}
+invalidParameterMessage=Parâmetro inválido: {0}
 alreadyLoggedIn=Você já está logado.
 differentUserAuthenticated=Você já está autenticado como outro usuário ''{0}'' nesta sessão. Por favor, finalize a sessão primeiro.
-brokerLinkingSessionExpired=A vinculção de conta do provedor de identidade foi solicitado, mas a sessão atual não é mais válida.
-proceedWithAction=» Clique aqui para continuar
-
+brokerLinkingSessionExpired=Solicitada vinculação de conta via intermediário, mas a sessão atual não é mais válida.
+proceedWithAction=&raquo; Clique aqui para continuar
 requiredAction.CONFIGURE_TOTP=Configurar Autenticação de Dois Fatores
 requiredAction.TERMS_AND_CONDITIONS=Termos e Condições
 requiredAction.UPDATE_PASSWORD=Atualizar Senha
 requiredAction.UPDATE_PROFILE=Atualizar Perfil
-requiredAction.VERIFY_EMAIL=Verificar Endereço de E-mail
-
-doX509Login=Você será logado como\:
-clientCertificate=Certificado X509 do cliente\:
+requiredAction.VERIFY_EMAIL=Verificar Email
+doX509Login=Você está logado como:
+clientCertificate=Certificado X509 do cliente:
 noCertificate=[Sem Certificado]
 
 
 pageNotFound=Página não encontrada
 internalServerError=Ocorreu um erro interno no servidor
-
-console-username=Nome de usuário:
+console-username=Usuário:
 console-password=Senha:
 console-otp=Código de uso único:
 console-new-password=Nova Senha:
 console-confirm-password=Confirmação de Senha:
 console-update-password=Você precisa atualizar a sua senha.
-console-verify-email=Você precisa verificar o seu endereço de e-mail. Enviamos um e-mail para {0} que contém um código de verificação. Digite o código enviado no campo abaixo.
-console-email-code=Código do e-mail:
+console-verify-email=Você precisa verificar seu endereço de email. Enviamos um email para {0} contendo um código de verificação. Por favor, insira esse código no campo abaixo.
+console-email-code=Código do email:
 console-accept-terms=Aceita os Termos? [s/n]:
 console-accept=s
 
@@ -337,8 +303,8 @@ openshift.scope.list-projects=Listar projetos
 
 # SAML authentication
 saml.post-form.title=Redirecionamento de Autenticação
-saml.post-form.message=Redirecionando... Por favor, aguarde.
-saml.post-form.js-disabled=O JavaScript está desabilitado. É altamente recomendável habilitá-lo. Clique no botão abaixo para continuar. 
+saml.post-form.message=Redirecionando, por favor, aguarde.
+saml.post-form.js-disabled=O JavaScript está desativado. Recomendamos fortemente que o ative. Clique no botão abaixo para continuar.
 
 #authenticators
 otp-display-name=Aplicativo Autenticador
@@ -346,7 +312,7 @@ otp-help-text=Insira o código de verificação do aplicativo autenticador.
 password-display-name=Senha
 password-help-text=Faça o login digitando sua senha.
 auth-username-form-display-name=Nome de usuário
-auth-username-form-help-text=Faça o login digitando seu nome de usuário.
+auth-username-form-help-text=Faça o login digitando seu nome de usuário
 auth-username-password-form-display-name=Nome de usuário e senha
 auth-username-password-form-help-text=Faça o login digitando seu nome de usuário e senha.
 
@@ -357,33 +323,30 @@ webauthn-passwordless-display-name=Chave de Segurança
 webauthn-passwordless-help-text=Use sua chave de segurança para fazer login sem senha.
 webauthn-login-title=Login com Chave de Segurança
 webauthn-registration-title=Registrar Chave de Segurança
-webauthn-available-authenticators=Autenticadores disponíveis
+webauthn-available-authenticators=Chaves de segurança disponíveis
 webauthn-unsupported-browser-text=WebAuthn não é suportada pelo seu navegador. Tente outro navegador ou entre em contato com um administrador.
 
 # WebAuthn Error
 webauthn-error-title=Erro de Chave de Segurança
-webauthn-error-registration=Falha ao registrar sua Chave de Segurança.
-webauthn-error-api-get=Falha ao autenticar usando a Chave de Segurança.
-webauthn-error-different-user=O primeiro usuário autenticado não corresponde àquele autenticado pela Chave de Segurança.
-webauthn-error-auth-verification=O resultado da autenticação da Chave de Segurança é inválido.<br /> {0}
-webauthn-error-register-verification=O resultado do registro da Chave de Segurança é inválido.<br /> {0}
-webauthn-error-user-not-found=Usuário desconhecido autenticado pela Chave de Segurança.
+webauthn-error-registration=Falha ao registrar sua Chave de Segurança.<br /> {0}
+webauthn-error-api-get=Falha ao autenticar usando a Chave de Segurança.<br /> {0}
+webauthn-error-different-user=A primeira pessoa autenticada não é a mesma autenticada pela chave de segurança.
+webauthn-error-auth-verification=O resultado da autenticação com chave de segurança é inválido.<br /> {0}
+webauthn-error-register-verification=O resultado do registro de chave de segurança é inválido.<br /> {0}
+webauthn-error-user-not-found=Usuário desconhecido autenticado pela chave de segurança.
 
 # Identity provider
 identity-provider-redirector=Conecte-se com outro Provedor de Identidade
 identity-provider-login-label=Ou entre com
-
-finalDeletionConfirmation=Se você apagar a sua conta, ela não poderá ser recuperada. Para manter a sua conta, clique em Cancelar.
+finalDeletionConfirmation=Se você excluir a sua conta, ela não poderá ser recuperada. Para manter a sua conta, clique em Cancelar.
 irreversibleAction=Esta ação é irreversível
-deleteAccountConfirm=Confirmação de descadastramento
-
-deletingImplies=Apagar a sua conta implica em:
-errasingData=Remover todos os seus dados
-loggingOutImmediately=Sair da aplicação imediatamente
+deleteAccountConfirm=Confirmação de exclusão de conta
+deletingImplies=Excluir a sua conta implica em:
+errasingData=Removendo todos os seus dados
+loggingOutImmediately=Saindo da aplicação imediatamente
 accountUnusable=Qualquer uso subsequente da aplicação não será possível com esta conta
 userDeletedSuccessfully=Usuário excluído com sucesso
-
-readOnlyUsernameMessage=Você não pode atualizar o seu nome de usuário, uma vez que é apenas de leitura.
+readOnlyUsernameMessage=Você não pode atualizar o seu nome de usuário, pois ele é somente leitura.
 
 # new RP-initiated logout
 frontchannel-logout.title=Saindo
@@ -391,4 +354,135 @@ frontchannel-logout.message=Você está saindo dos seguintes aplicativos
 logoutConfirmTitle=Saindo
 logoutConfirmHeader=Você realmente deseja sair?
 doLogout=Sair
-
+invalidPasswordMaxLengthMessage=Senha inválida: tamanho máximo {0}.
+error-empty=Por favor, especifique um valor.
+error-invalid-blank=Por favor, especifique um valor.
+webauthn-createdAt-label=Criado
+passkey-createdAt-label=Criado
+error-invalid-number=Número inválido.
+error-pattern-no-match=Valor inválido.
+error-invalid-uri=URL inválida.
+error-invalid-uri-scheme=Esquema da URL inválido.
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Gerar Códigos de Recuperação
+error-invalid-email=Endereço de email inválido.
+error-invalid-value=Valor inválido.
+error-invalid-uri-fragment=Fragmento da URL inválido.
+error-invalid-multivalued-size=O atributo {0} deve ter no mínimo {1} e no máximo {2} {2,choice,0#values|1#value|1<values}.
+linkIdpActionTitle=Vinculando {0}
+linkIdpActionMessage=Você quer vincular sua conta com {0}?
+showPassword=Exibir senha
+oauth2DeviceVerificationTitle=Login por dispositivo
+oauth2DeviceInvalidUserCodeMessage=Código inválido, por favor, tente novamente.
+oauth2DeviceExpiredUserCodeMessage=O código expirou. Por favor, volte ao seu dispositivo e tente conectar novamente.
+oauth2DeviceVerificationCompleteMessage=Você pode fechar esta janela do navegador e voltar ao seu dispositivo.
+oauth2DeviceVerificationFailedHeader=Falha no login por dispositivo
+oauth2DeviceConsentDeniedMessage=Consentimento negado para conectar o dispositivo.
+oauth2DeviceAuthorizationGrantDisabledMessage=O cliente não tem permissão para iniciar o fluxo de concessão de autorização de dispositivo do OAuth 2.0. O fluxo está desabilitado para o cliente.
+emailVerifySend=Enviar email de verificação
+emailInstructionUsername=Digite seu nome de usuário e enviaremos instruções sobre como criar uma nova senha.
+identityProviderLogoutFailure=Falha no logout do IdP SAML
+error-invalid-length-too-short=Tamanho mínimo é {1}.
+error-invalid-length-too-long=O tamanho máximo é {2}.
+error-number-out-of-range=O número deve estar entre {1} e {2}.
+error-number-out-of-range-too-small=O número precisa ter um valor mínimo de {1}.
+error-number-out-of-range-too-big=Número precisa ter um valor máximo de {2}.
+confirmOverrideIdpContinue=Sim, substituir o vínculo pela conta atual
+configureBackupCodesMessage=Você precisa configurar códigos de backup para ativar sua conta.
+identityProviderMissingCodeOrErrorMessage=Faltando parâmetro de código ou de erro na resposta do provedor de identidade.
+identityProviderInvalidResponseMessage=Resposta inválida do provedor de identidade.
+identityProviderInvalidSignatureMessage=Assinatura inválida na resposta do provedor de identidade.
+emailVerifiedAlreadyMessage=Seu endereço de email já foi verificado.
+acrNotFulfilled=Requisitos de autenticação não atendidos
+requiredAction.webauthn-register-passwordless=Registro WebAuthn sem senha
+recovery-code-config-header=Códigos de Autenticação de Recuperação
+organization.confirm-membership.title=Você está prestes a se juntar à organização ${kc.org.name}
+organization.member.register.title=Crie uma conta para se juntar à organização ${kc.org.name}
+authenticateStrong=Autenticação forte necessária para continuar
+oauthGrantTos=termos de serviço.
+oauthGrantPolicy=política de privacidade.
+updateEmailTitle=Atualizar email
+emailUpdateConfirmationSent=Um email de confirmação foi enviado para {0}. Você deve seguir as instruções dele para concluir a atualização do email.
+emailUpdatedTitle=Email atualizado
+emailUpdated=A conta de email foi atualizado com sucesso para {0}.
+usb=USB
+nfc=NFC
+bluetooth=Bluetooth
+internal=Interna
+unknown=Desconhecido
+termsAcceptanceRequired=Você deve concordar com nossos termos e condições.
+acceptTerms=Eu concordo com os termos e condições
+deleteCredentialTitle=Excluir {0}
+deleteCredentialMessage=Você quer excluir {0}?
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+emailVerifyResend=Reenviar email de verificação
+sessionLimitExceeded=Há sessões demais
+error-invalid-length=Tamanho deve estar entre {1} e {2}.
+error-invalid-date=Data inválida.
+error-user-attribute-read-only=O campo é somente leitura.
+error-username-invalid-character=Valor contém caractere inválido.
+error-reset-otp-missing-id=Por favor, escolha uma configuração de OTP.
+error-user-attribute-required=Por favor, informe este campo.
+error-person-name-invalid-character=Valor contém caractere inválido.
+federatedIdentityUnmatchedEssentialClaimMessage=O token de ID emitido pelo provedor de identidade não corresponde ao claim essencial configurado. Por favor, contate seu administrador.
+confirmOverrideIdpTitle=Vínculo com o intermediário já existe
+federatedIdentityConfirmOverrideMessage=Você está tentando vincular sua conta {0} com a conta {1} {2}. Mas sua conta já está vinculada a uma conta {3} diferente: {4}. Você pode confirmar se deseja substituir o vínculo existente pela nova conta?
+updateEmailMessage=Você precisa atualizar o seu endereço de email para ativar sua conta.
+successLogout=Você saiu da sessão
+insufficientLevelOfAuthentication=O nível de autenticação solicitado não foi atendido.
+requiredAction.webauthn-register=Registro WebAuthn
+recovery-codes-download-file-header=Mantenha esses códigos de recuperação em algum lugar seguro.
+recovery-codes-download-file-date=Esses códigos foram gerados em
+passkey-doAuthenticate=Entrar com chave de segurança
+passkey-login-title=Login com Chave de Segurança
+passkey-available-authenticators=Chaves de segurança disponíveis
+access-denied=Acesso negado
+access-denied-when-idp-auth=Acesso negado ao autenticar com {0}
+organizationScopeConsentText=Organização
+loginIdpReviewProfileTitle=Atualizar Informações da Conta
+oauthGrantInformation=Certifique-se de que você confia em {0} aprendendo como {0} irá tratar seus dados.
+emailVerifyInstruction4=Para verificar seu endereço de email, iremos enviar um email com instruções para o endereço {0}.
+oauth2DeviceVerificationFailedMessage=Você pode fechar esta janela do navegador, voltar ao seu dispositivo e tentar conectar novamente.
+oauthGrantReview=Você pode revisar a
+oauth2DeviceVerificationCompleteHeader=Login por dispositivo bem-sucedido
+emailUpdateConfirmationSentTitle=Email de confirmação enviado
+verifyOAuth2DeviceUserCode=Digite o código fornecido pelo seu dispositivo e clique em Enviar
+reauthenticate=Por favor, reautentique-se para continuar
+hidePassword=Ocultar senha
+cookieNotFoundMessage=Cookie de reinício de login não encontrado. Ele pode ter expirado, ter sido excluído ou os cookies podem estar desativados em seu navegador. Se os cookies estiverem desativados, ative-os. Clique em "Voltar para a aplicação" para fazer login novamente.
+idp-email-verification-display-name=Verificação de email
+organization.confirm-membership=Ao clicar no link abaixo, você se tornará membro da organização {0}:
+notMemberOfOrganization=O usuário não é um membro da organização {0}
+recovery-codes-download-file-description=Os códigos de recuperação são códigos de uso único que permitem que você faça login na sua conta caso não tenha acesso ao seu autenticador.
+idp-username-password-form-display-name=Nome de usuário e senha
+webauthn-registration-init-label-prompt=Por favor, digite o rótulo da sua chave de segurança registrada
+notMemberOfAnyOrganization=O usuário não é membro de nenhuma organização
+passkey-autofill-select=Selecione sua chave de segurança
+recovery-codes-label-default=Códigos de recuperação
+webauthn-registration-init-label=Chave de Segurança (Rótulo Padrão)
+passkey-unsupported-browser-text=A chave de segurança não é suportada por este navegador. Tente outra ou contate o seu administrador.
+webauthn-doAuthenticate=Entrar com chave de segurança
+idp-email-verification-help-text=Vincule a sua conta validando o seu email.
+idp-username-password-form-help-text=Vincule a sua conta fazendo login.
+organization.select=Selecione uma organização para continuar:
+recovery-codes-print=Imprimir
+recovery-codes-download=Download
+recovery-codes-copy=Copiar
+recovery-codes-copied=Copiado
+auth-x509-client-username-form-display-name=Certificado X509
+auth-x509-client-username-form-help-text=Entre com um certificado de cliente X509.
+auth-recovery-authn-code-form-display-name=Código de autenticação de recuperação
+auth-recovery-authn-code-form-help-text=Digite um código de autenticação de recuperação de uma lista gerada anteriormente.
+auth-recovery-code-prompt=Código de recuperação #{0}
+auth-recovery-code-header=Entre com um código de autenticação de recuperação
+recovery-codes-error-invalid=Código de autenticação de recuperação inválido
+invalidTokenRequiredActions=As ações obrigatórias incluídas no link não são válidas
+otp-reset-description=Qual configuração de OTP deve ser removida?
+auth-recovery-code-info-message=Informe o código de recuperação especificado.
+recovery-code-config-warning-title=Esses códigos de recuperação não serão exibidos novamente após sair desta página
+recovery-codes-action-complete=Completar configuração
+recovery-codes-action-cancel=Cancelar configuração
+recovery-codes-confirmation-message=Salvei esses códigos em um local seguro
+recovery-code-config-warning-message=Certifique-se de imprimir, baixar ou copiá-los para um gerenciador de senhas e mantê-los em segurança. Cancelar esta configuração removerá esses códigos de recuperação da sua conta.
+saml.artifactResolutionServiceInvalidResponse=Não foi possível resolver o artifact.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ro.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ro.properties
new file mode 100644
index 000000000000..3d1aed4285fe
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ro.properties
@@ -0,0 +1,36 @@
+doRegister=Înregistreazǎ-te
+doCancel=Renunțǎ
+doLogIn=Conecteazǎ-te
+doRegisterSecurityKey=Înregistreazǎ-te
+doBack=Înapoi
+doContinue=Continuǎ
+doIgnore=Ignorǎ
+doAccept=Acceptǎ
+doDecline=Refuzǎ
+doForgotPassword=Parolǎ uitatǎ?
+doClickHere=Apasǎ aici
+doImpersonate=Schimbǎ identitatea
+doConfirmDelete=Confirmǎ ştergerea
+errorDeletingAccount=Eroarea a fost întâmpinatǎ în timpul ştergeri contului
+kerberosNotConfigured=Kerberos nu este configurat
+kerberosNotConfiguredTitle=Kerberos nu este configurat
+doYes=Da
+doTryAnotherWay=Încearcǎ în alt mod
+doNo=Nu
+doTryAgain=Încearcǎ din nou
+deletingAccountForbidden=Nu ai destule permisiuni pentru a îți şterge propriu cont, contacteazǎ administratorul.
+doSubmit=Trimite
+registerTitle=Înregistreazǎ-te
+bypassKerberosDetail=Ori nu te-ai autentificat în Kerberos, ori Browser-ul nu e configurat pentru autentificarea cu Kerberos. Apǎsați pe continuǎ pentru autentificarea cu alte metode
+kerberosNotSetUp=Kerberos nu e configurat. Nu te poti autentifica.
+loginAccountTitle=Conecteazǎ-te la contul tǎu
+loginTitleHtml={0}
+impersonateTitle={0} Impersoneazǎ utilizatorul
+impersonateTitleHtml=<strong>{0}</strong> Impersoneazǎ utilizatorul
+unknownUser=Utilizator necunoscut
+loginTotpTitle=Configurarea autentificǎri cu telefonul mobil
+loginProfileTitle=Actualizarea informaților din cont
+loginIdpReviewProfileTitle=Actualizarea informaților din cont
+realmChoice=Domeniu
+doLogout=Delogare
+loginTitle=Conectare la {0}
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_ru.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_ru.properties
index bd9ca05eb213..f97b4932fc70 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_ru.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_ru.properties
@@ -3,20 +3,27 @@ doRegister=Регистрация
 doRegisterSecurityKey=Регистрация
 doCancel=Отмена
 doSubmit=Подтвердить
+doBack=Назад
 doYes=Да
 doNo=Нет
 doContinue=Продолжить
+doIgnore=Игнорировать
 doAccept=Подтвердить
 doDecline=Отменить
 doForgotPassword=Забыли пароль?
 doClickHere=Нажмите сюда
 doImpersonate=Имперсонализироваться
+doTryAgain=Попробуйте еще раз
+doTryAnotherWay=Попробуйте другой способ
+doConfirmDelete=Подтвердите удаление
+errorDeletingAccount=Произошла ошибка при удалении аккаунта
+deletingAccountForbidden=У вас недостаточно прав для удаления учетной записи, обратитесь к администратору.
 kerberosNotConfigured=Kerberos не сконфигурирован
 kerberosNotConfiguredTitle=Kerberos не сконфигурирован
-bypassKerberosDetail=Либо вы не вошли в систему с помощью Kerberos, либо ваш браузер не настроен для входа в систему Kerberos. Пожалуйста, нажмите кнопку 'Продолжить' для входа в с помощью других средств
+bypassKerberosDetail=Либо вы не вошли в систему с помощью Kerberos, либо ваш браузер не настроен для входа в систему Kerberos. Пожалуйста, нажмите кнопку ''Продолжить'' для входа с помощью других средств
 kerberosNotSetUp=Kerberos не настроен. Вы не можете войти.
-registerWithTitle=Зарегистрироваться с {0}
-registerWithTitleHtml={0}
+registerTitle=Зарегистрироваться
+loginAccountTitle=Вход в учетную запись
 loginTitle=Вход {0}
 loginTitleHtml={0}
 impersonateTitle={0} Имперсонализация пользователя
@@ -25,31 +32,52 @@ realmChoice=Realm
 unknownUser=Неизвестный пользователь
 loginTotpTitle=Настройка мобильного аутентификатора
 loginProfileTitle=Обновление информации учетной записи
+loginIdpReviewProfileTitle=Обновление информации учетной записи
 loginTimeout=Вы слишком долго бездействовали. Процесс аутентификации начнется с начала.
-oauthGrantTitle=Согласовать доступ
+reauthenticate=Пожалуйста, пройдите повторную аутентификацию, чтобы продолжить
+authenticateStrong=Для продолжения требуется строгая аутентификация
+oauthGrantTitle=Согласовать доступ для {0}
 oauthGrantTitleHtml={0}
+oauthGrantInformation=Убедитесь, что вы доверяете {0}, узнав, как {0} будет обрабатывать ваши данные.
+oauthGrantReview=Вы могли бы просмотреть
+oauthGrantTos=условия обслуживания.
+oauthGrantPolicy=политика конфиденциальности.
 errorTitle=Мы сожалеем...
 errorTitleHtml=Мы <strong>сожалеем</strong> ...
 emailVerifyTitle=Подтверждение адреса E-mail
 emailForgotTitle=Забыли пароль?
+updateEmailTitle=Обновить электронную почту
+emailUpdateConfirmationSentTitle=Подтверждение отправлено по электронной почте
+emailUpdateConfirmationSent=Письмо с подтверждением отправлено на {0}. Следуйте инструкциям, чтобы завершить обновление электронной почты.
+emailUpdatedTitle=Электронная почта обновлена
+emailUpdated=Адрес электронной почты учетной записи успешно обновлен на {0}.
 updatePasswordTitle=Обновление пароля
 codeSuccessTitle=Успешный код
-codeErrorTitle=Ошибочный код\: {0}
-
-pageNotFound=Страница не найдена
+codeErrorTitle=Ошибочный код: {0}
+displayUnsupported=Запрошенный тип отображения не поддерживается
+browserRequired=Для входа требуется браузер
+browserContinue=Для завершения входа требуется браузер
+browserContinuePrompt=Открыть браузер и продолжить вход? [y/n]:
+browserContinueAnswer=у
 
+# Transports
+usb=USB
+nfc=NFC
+bluetooth=Bluetooth
+internal=Внутренний
+unknown=Неизвестный
 termsTitle=Условия и положения
-termsTitleHtml=Условия и положения
 termsText=<p>Условия и положения должны быть определены</p>
-
+termsPlainText=Условия и положения должны быть определены.
+termsAcceptanceRequired=Вы должны согласиться с нашими условиями.
+acceptTerms=Я согласен с условиями
+deleteCredentialTitle=Удалить {0}
+deleteCredentialMessage=Вы хотите удалить {0}?
+linkIdpActionTitle=Связывание {0}
+linkIdpActionMessage=Хотите ли вы связать свой аккаунт с {0}?
 recaptchaFailed=Некорректная Recaptcha
 recaptchaNotConfigured=Recaptcha требуется, но не сконфигурирована
 consentDenied=В согласовании отказано.
-
-# SAML authentication
-saml.post-form.title=Перенаправление аутентификации
-saml.post-form.message=Перенаправление, пожалуйста подождите.
-
 noAccount=Новый пользователь?
 username=Имя пользователя
 usernameOrEmail=Имя пользователя или E-mail
@@ -63,6 +91,8 @@ password=Пароль
 passwordConfirm=Подтверждение пароля
 passwordNew=Новый пароль
 passwordNewConfirm=Подтверждение нового пароля
+hidePassword=Скрыть пароль
+showPassword=Показать пароль
 rememberMe=Запомнить меня
 authenticatorCode=Одноразовый код
 address=Адрес
@@ -72,46 +102,77 @@ region=Регион
 postal_code=Почтовый индекс
 country=Страна
 emailVerified=E-mail подтвержден
+website=Веб-сайт
+phoneNumber=Номер телефона
+phoneNumberVerified=Номер телефона проверен
+gender=Пол
+birthday=Дата рождения
+zoneinfo=Часовой пояс
 gssDelegationCredential=Делегирование учетных данных GSS
-
 logoutOtherSessions=Выполнить выход на других устройствах
-
-loginAccountTitle=Вход в учетную запись
+profileScopeConsentText=Профиль пользователя
+emailScopeConsentText=Адрес электронной почты
+addressScopeConsentText=Адрес
+phoneScopeConsentText=Номер телефона
+offlineAccessScopeConsentText=Оффлайн доступ
+samlRoleListScopeConsentText=Мои роли
+rolesScopeConsentText=Роли пользователей
+organizationScopeConsentText=Организация
+restartLoginTooltip=Перезапустить вход
+loginTotpIntro=Вам необходимо настроить генератор одноразовых паролей для доступа к этой учетной записи
 loginTotpStep1=Установите одно из следующих приложений на ваш мобильный телефон:
 loginTotpStep2=Откройте приложение и просканируйте QR-код:
 loginTotpStep3=Введите одноразовый код, выданный приложением, и нажмите Подтвердить для завершения настройки.
+loginTotpStep3DeviceName=Укажите имя устройства, которое поможет вам найти его в списке ваших устройств.
 loginTotpManualStep2=Откройте приложение и введите ключ:
 loginTotpManualStep3=Используйте следующие настройки, если приложение позволяет их устанавливать:
-loginTotpStep3DeviceName=Укажите имя устройства, которое поможет вам найти его в списке ваших устройств.
 loginTotpUnableToScan=Не удается выполнить сканирование?
 loginTotpScanBarcode=Сканировать QR-код?
+loginCredential=Учетные данные
 loginOtpOneTime=Одноразовый код
-loginTotpDeviceName=Имя устройства
 loginTotpType=Тип
 loginTotpAlgorithm=Алгоритм
 loginTotpDigits=Количество цифр
 loginTotpInterval=Интервал
 loginTotpCounter=Счетчик
-
-
+loginTotpDeviceName=Имя устройства
+loginTotp.totp=На основе времени
+loginTotp.hotp=На основе счетчика
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Аутентификатор
+totpAppMicrosoftAuthenticatorName=Аутентификатор Microsoft
+loginChooseAuthenticator=Выберите способ входа
 oauthGrantRequest=Вы согласуете доступ к этим привилегиям?
 inResource=в
-
-emailVerifyInstruction1=Вам было отправлено письмо с инструкциями для подтверждения адреса E-mail.
+oauth2DeviceVerificationTitle=Вход в устройство
+verifyOAuth2DeviceUserCode=Введите код, предоставленный вашим устройством, и нажмите «Отправить»
+oauth2DeviceInvalidUserCodeMessage=Неверный код, попробуйте еще раз.
+oauth2DeviceExpiredUserCodeMessage=Код устарел. Пожалуйста, вернитесь к устройству и попробуйте подключиться снова.
+oauth2DeviceVerificationCompleteHeader=Успешный вход в устройство
+oauth2DeviceVerificationCompleteMessage=Вы можете закрыть это окно браузера и вернуться на свое устройство.
+oauth2DeviceVerificationFailedHeader=Ошибка входа в устройство
+oauth2DeviceVerificationFailedMessage=Вы можете закрыть это окно браузера, вернуться к своему устройству и повторить попытку подключения.
+oauth2DeviceConsentDeniedMessage=Отказано в согласии на подключение устройства.
+oauth2DeviceAuthorizationGrantDisabledMessage=Клиенту не разрешено инициировать OAuth 2.0 Device Authorization Grant. Поток отключен для клиента.
+emailVerifyInstruction1=Вам было отправлено письмо с инструкциями для подтверждения адреса E-mail {0}.
 emailVerifyInstruction2=Не получили письмо с кодом подтверждения?
 emailVerifyInstruction3=для повторной отправки письма.
-
+emailVerifyInstruction4=Для проверки вашего адреса электронной почты мы отправим вам письмо с инструкциями на адрес {0}.
+emailVerifyResend=Повторно отправить письмо с подтверждением
+emailVerifySend=Отправить письмо с подтверждением
 emailLinkIdpTitle=Связать {0}
 emailLinkIdp1=Вам было отправлено письмо с инструкциями по объединению {0} учетной записи {1} с вашей учетной записью {2}.
 emailLinkIdp2=Не получили код подтверждения на ваш E-mail?
 emailLinkIdp3=для повторной отправки письма.
-
+emailLinkIdp4=Если вы уже подтвердили адрес электронной почты в другом браузере
+emailLinkIdp5=продолжить.
 backToLogin=&laquo; Назад ко входу
-
 emailInstruction=Введите Ваше имя пользователя или E-mail и мы вышлем Вам инструкции по получению нового пароля.
-
+emailInstructionUsername=Введите свое имя пользователя, и мы вышлем вам инструкции по созданию нового пароля.
 copyCodeInstruction=Пожалуйста, скопируйте этот код в приложение:
-
+pageExpiredTitle=Страница устарела
+pageExpiredMsg1=Чтобы перезапустить процесс входа в систему
+pageExpiredMsg2=Чтобы продолжить процесс входа в систему
 personalInfo=Персональная информация:
 role_admin=Администратор
 role_realm-admin=Администратор realm
@@ -131,74 +192,115 @@ role_manage-clients=Управление клиентами
 role_manage-events=Управление событиями
 role_view-profile=Просмотр профиля
 role_manage-account=Управление учетной записью
+role_manage-account-links=Управление ссылками на аккаунты
 role_read-token=Чтение токена
 role_offline-access=Оффлайн доступ
 client_account=Учетная запись
+client_account-console=Консоль аккаунта
 client_security-admin-console=Консоль администратора безопасности
 client_admin-cli=Командный интерфейс администратора
 client_realm-management=Управление realm
 client_broker=Брокер
-
+requiredFields=Обязательные поля
 invalidUserMessage=Неправильное имя пользователя или пароль.
+invalidUsernameMessage=Неверное имя пользователя.
+invalidUsernameOrEmailMessage=Неверное имя пользователя или адрес электронной почты.
+invalidPasswordMessage=Неверный пароль.
 invalidEmailMessage=Неправильный E-mail.
 accountDisabledMessage=Учетная запись заблокирована, свяжитесь с администратором.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessage=Неправильное имя пользователя или пароль.
 accountPermanentlyDisabledMessage=Неправильное имя пользователя или пароль.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessageTotp=Неверный код аутентификатора.
 accountPermanentlyDisabledMessageTotp=Неверный код аутентификатора.
 expiredCodeMessage=Вход просрочен по таймауту. Пожалуйста, войдите снова.
-
+expiredActionMessage=Сессия завершена. Пожалуйста, войдите снова.
+expiredActionTokenNoSessionMessage=Сессия завершена.
+expiredActionTokenSessionExistsMessage=Сессия завершена. Пожалуйста, начните снова.
+sessionLimitExceeded=Слишком много сессий
+identityProviderLogoutFailure=Ошибка выхода из SAML IdP
 missingFirstNameMessage=Пожалуйста введите имя.
 missingLastNameMessage=Пожалуйста введите фамилию.
 missingEmailMessage=Пожалуйста введите E-mail.
 missingUsernameMessage=Пожалуйста введите имя пользователя.
 missingPasswordMessage=Пожалуйста введите пароль.
 missingTotpMessage=Пожалуйста введите код аутентификатора.
+missingTotpDeviceNameMessage=Укажите название устройства.
 notMatchPasswordMessage=Пароли не совпадают.
-
+error-invalid-value=Недопустимое значение.
+error-invalid-blank=Укажите значение.
+error-empty=Укажите значение.
+error-invalid-length=Длина должна быть между {1} и {2}.
+error-invalid-length-too-short=Минимальная длина — {1}.
+error-invalid-length-too-long=Максимальная длина — {2}.
+error-invalid-email=Неверный адрес электронной почты.
+error-invalid-number=Неверный номер.
+error-number-out-of-range=Число должно быть между {1} и {2}.
+error-number-out-of-range-too-small=Число должно иметь минимальное значение {1}.
+error-number-out-of-range-too-big=Число должно иметь максимальное значение {2}.
+error-pattern-no-match=Недопустимое значение.
+error-invalid-uri=Неверный URL-адрес.
+error-invalid-uri-scheme=Неверная схема URL.
+error-invalid-uri-fragment=Неверный фрагмент URL.
+error-user-attribute-required=Пожалуйста, укажите это поле.
+error-invalid-date=Неверная дата.
+error-user-attribute-read-only=Это поле доступно только для чтения.
+error-username-invalid-character=Значение содержит недопустимый символ.
+error-person-name-invalid-character=Значение содержит недопустимый символ.
+error-reset-otp-missing-id=Пожалуйста, выберите конфигурацию OTP.
 invalidPasswordExistingMessage=Неверный существующий пароль.
+invalidPasswordBlacklistedMessage=Неверный пароль: пароль занесен в черный список.
 invalidPasswordConfirmMessage=Подтверждение пароля не совпадает.
 invalidTotpMessage=Неверный код аутентификатора.
-
 usernameExistsMessage=Имя пользователя уже занято.
 emailExistsMessage=E-mail уже существует.
-
 federatedIdentityExistsMessage=Пользователь с {0} {1} уже существует. Пожалуйста войдите в управление учетными записями, чтобы связать эту учетную запись.
-
+federatedIdentityUnavailableMessage=Пользователь {0}, аутентифицированный с помощью поставщика удостоверений {1}, не существует. Обратитесь к администратору.
+federatedIdentityUnmatchedEssentialClaimMessage=Идентификационный токен, выданный поставщиком удостоверений, не соответствует настроенному essential claim. Обратитесь к администратору.
 confirmLinkIdpTitle=Учетная запись уже существует
+confirmOverrideIdpTitle=Ссылка на брокера уже существует
 federatedIdentityConfirmLinkMessage=Пользователь с {0} {1} уже сущестует. Хотите продолжить?
+federatedIdentityConfirmOverrideMessage=Вы пытаетесь связать свою учетную запись {0} с учетной записью {1} {2}. Но ваша учетная запись уже связана с другой {3} учетной записью {4}. Можете ли вы подтвердить, хотите ли вы заменить существующую ссылку на новую учетную запись?
 federatedIdentityConfirmReauthenticateMessage=Аутентифицируйтесь, чтобы связать Вашу учетную запись с {0}
+nestedFirstBrokerFlowMessage=Пользователь {0} {1} не связан ни с одним известным пользователем.
 confirmLinkIdpReviewProfile=Обзор профиля
 confirmLinkIdpContinue=Добавить в существующую учетную запись
-
+confirmOverrideIdpContinue=Да, переопределить связь с текущим аккаунтом
 configureTotpMessage=Вам необходимо настроить аутентификатор в мобильном устройстве, чтобы активировать учетную запись.
+configureBackupCodesMessage=Для активации вашей учетной записи вам необходимо настроить резервные коды.
 updateProfileMessage=Вам необходимо обновить свой профиль, чтобы активировать Вашу учетную запись.
 updatePasswordMessage=Вам необходимо изменить пароль, чтобы активировать Вашу учетную запись.
+updateEmailMessage=Для активации учетной записи вам необходимо обновить адрес электронной почты.
+resetPasswordMessage=Вам необходимо сменить пароль.
 verifyEmailMessage=Вам необходимо подтвердить Ваш E-mail, чтобы активировать Вашу учетную запись.
 linkIdpMessage=Вам необходимо подтвердить Ваш E-mail, чтобы связать Вашу учетную запись с {0}.
-
 emailSentMessage=В ближайшее время Вы должны получить письмо с дальнейшими инструкциями.
 emailSendErrorMessage=Не получается отправить письмо. Пожалуйста, повторите позже.
-
 accountUpdatedMessage=Ваша учетная запись успешно обновлена.
 accountPasswordUpdatedMessage=Ваш пароль успешно обновлен.
-
+delegationCompleteHeader=Успешный вход
+delegationCompleteMessage=Вы можете закрыть это окно браузера и вернуться в консольное приложение.
+delegationFailedHeader=Ошибка входа
+delegationFailedMessage=Вы можете закрыть это окно браузера, вернуться в консольное приложение и попробовать войти снова.
 noAccessMessage=Нет доступа
-
 invalidPasswordMinLengthMessage=Некорректный пароль: длина пароля должна быть не менее {0} символов(а).
+invalidPasswordMaxLengthMessage=Неверный пароль: максимальная длина {0}.
 invalidPasswordMinDigitsMessage=Некорректный пароль: пароль должен содержать не менее {0} цифр(ы).
 invalidPasswordMinLowerCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символов(а) в нижнем регистре.
 invalidPasswordMinUpperCaseCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} символов(а) в верхнем регистре.
 invalidPasswordMinSpecialCharsMessage=Некорректный пароль: пароль должен содержать не менее {0} спецсимволов(а).
 invalidPasswordNotUsernameMessage=Некорректный пароль: пароль не должен совпадать с именем пользователя.
+invalidPasswordNotContainsUsernameMessage=Неверный пароль: не может содержать имя пользователя.
+invalidPasswordNotEmailMessage=Неверный пароль: не должен совпадать с адресом электронной почты.
 invalidPasswordRegexPatternMessage=Некорректный пароль: пароль не прошел проверку по регулярному выражению.
 invalidPasswordHistoryMessage=Некорректный пароль: пароль не должен совпадать с последним(и) {0} паролем(ями).
 invalidPasswordGenericMessage=Некорректный пароль: новый пароль не соответствует правилам пароля.
-
 failedToProcessResponseMessage=Не удалось обработать ответ
 httpsRequiredMessage=Требуется HTTPS
 realmNotEnabledMessage=Realm не включен
 invalidRequestMessage=Неверный запрос
+successLogout=Вы вышли из системы
 failedLogout=Выйти не удалось
 unknownLoginRequesterMessage=Неизвестный клиент
 loginRequesterNotEnabledMessage=Клиент отключен
@@ -210,7 +312,6 @@ unsupportedNameIdFormatMessage=Неподдерживаемый NameIDFormat
 invalidRequesterMessage=Неверный запрашивающий
 registrationNotAllowedMessage=Регистрация не разрешена
 resetCredentialNotAllowedMessage=Сброс идентификационных данных не разрешен
-
 permissionNotApprovedMessage=Разрешение не подтверждено.
 noRelayStateInResponseMessage=Нет изменения состояния в ответе от провайдера учетных записей.
 insufficientPermissionMessage=Недостаточно полномочий для связывания идентификаторов.
@@ -224,18 +325,170 @@ unexpectedErrorHandlingRequestMessage=Непредвиденная ошибка
 invalidAccessCodeMessage=Неверный код доступа.
 sessionNotActiveMessage=Сессия не активна.
 invalidCodeMessage=Произошла ошибка. Пожалуйста, войдите в систему снова через ваше приложение.
-identityProviderUnexpectedErrorMessage=Непредвиденная ошибка при проверке подлинности поставщика учетных записей.
+cookieNotFoundMessage=Перезапустить вход cookie не найден. Возможно, истек срок его действия; он был удален или в вашем браузере отключены файлы cookie. Если файлы cookie отключены, включите их. Нажмите Вернуться в приложение, чтобы снова войти.
+insufficientLevelOfAuthentication=Запрошенный уровень аутентификации не был удовлетворен.
+identityProviderUnexpectedErrorMessage=Непредвиденная ошибка при проверке подлинности поставщика учетных записей
+identityProviderMissingStateMessage=Отсутствует параметр состояния в ответе от поставщика удостоверений.
+identityProviderMissingCodeOrErrorMessage=Отсутствует код или параметр ошибки в ответе от поставщика удостоверений.
+identityProviderInvalidResponseMessage=Неверный ответ от поставщика удостоверений.
+identityProviderInvalidSignatureMessage=Недействительная подпись в ответе от поставщика удостоверений.
 identityProviderNotFoundMessage=Не удалось найти поставщика учетных записей с данным идентификатором.
 identityProviderLinkSuccess=Ваша учетная запись была успешно соединена с {0} учетной записью {1} .
-staleCodeMessage=Эта страница больше не действительна, пожалуйста, вернитесь в приложение и снова войдите в систему.
+staleCodeMessage=Эта страница больше не действительна, пожалуйста, вернитесь в приложение и снова войдите в систему
 realmSupportsNoCredentialsMessage=Realm не поддерживает никакой тип учетных данных.
+credentialSetupRequired=Невозможно войти в систему, требуется настройка учетных данных.
 identityProviderNotUniqueMessage=Realm поддерживает несколько поставщиков учетных записей. Не удалось определить, какой именно поставщик должен использоваться для аутентификации.
 emailVerifiedMessage=Ваш E-mail был подтвержден.
-staleEmailVerificationLink=Ссылка, по которой Вы перешли, устарела и больше не действует. Может быть, вы уже подтвердили свой E-mail?
-
+emailVerifiedAlreadyMessage=Ваш адрес электронной почты уже подтвержден.
+staleEmailVerificationLink=Ссылка, по которой Вы перешли, устарела и больше не действует. Возможно, вы уже подтвердили свой E-mail.
+identityProviderAlreadyLinkedMessage=Федеративная идентификация, возвращенная {0}, уже связана с другим пользователем.
+confirmAccountLinking=Подтвердите привязку учетной записи {0} поставщика удостоверений {1} к вашей учетной записи.
+confirmEmailAddressVerification=Подтвердите действительность адреса электронной почты {0}.
+confirmExecutionOfActions=Выполните следующие действия
 backToApplication=&laquo; Назад в приложение
-missingParameterMessage=Пропущенные параметры\: {0}
+missingParameterMessage=Пропущенные параметры: {0}
 clientNotFoundMessage=Клиент не найден.
 clientDisabledMessage=Клиент отключен.
-invalidParameterMessage=Неверный параметр\: {0}
+invalidParameterMessage=Неверный параметр: {0}
 alreadyLoggedIn=Вы уже вошли.
+differentUserAuthenticated=Вы уже аутентифицированы как другой пользователь ''{0}'' в этой сессии. Пожалуйста, сначала выйдете.
+brokerLinkingSessionExpired=Запрошена привязка брокерского счета, но текущая сессия больше не действительна.
+proceedWithAction=» Нажмите здесь, чтобы продолжить
+acrNotFulfilled=Требования аутентификации не выполнены
+requiredAction.CONFIGURE_TOTP=Настроить одноразовый пароль
+requiredAction.TERMS_AND_CONDITIONS=Условия и положения
+requiredAction.UPDATE_PASSWORD=Обновить пароль
+requiredAction.UPDATE_PROFILE=Обновить профиль
+requiredAction.VERIFY_EMAIL=Подтвердить адрес электронной почты
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Генерация кодов восстановления
+requiredAction.webauthn-register-passwordless=Webauthn регистрация Без пароля
+requiredAction.webauthn-register=Регистрация Webauthn
+invalidTokenRequiredActions=Требуемые действия, указанные в ссылке, недействительны
+doX509Login=Вы войдете в систему как:
+clientCertificate=Сертификат клиента X509:
+noCertificate=[Нет сертификата]
+
+
+pageNotFound=Страница не найдена
+internalServerError=Произошла внутренняя ошибка сервера
+console-username=Имя пользователя:
+console-password=Пароль:
+console-otp=Одноразовый пароль:
+console-new-password=Новый пароль:
+console-confirm-password=Подтвердите пароль:
+console-update-password=Требуется обновить ваш пароль.
+console-verify-email=Вам необходимо подтвердить свой адрес электронной почты. Мы отправили письмо на адрес {0}, содержащее код подтверждения. Введите этот код в поле ниже.
+console-email-code=Код электронной почты:
+console-accept-terms=Принимаете ли вы условия? [y/n]:
+console-accept=у
+
+# Openshift messages
+openshift.scope.user_info=Информация о пользователе
+openshift.scope.user_check-access=Информация о доступе пользователя
+openshift.scope.user_full=Полный доступ
+openshift.scope.list-projects=Список проектов
+
+# SAML authentication
+saml.post-form.title=Перенаправление аутентификации
+saml.post-form.message=Перенаправление, пожалуйста подождите.
+saml.post-form.js-disabled=JavaScript отключен. Настоятельно рекомендуем включить его. Нажмите кнопку ниже, чтобы продолжить.
+saml.artifactResolutionServiceInvalidResponse=Не удалось разрешить артефакт.
+
+#authenticators
+otp-display-name=Приложение-аутентификатор
+otp-help-text=Введите проверочный код из приложения-аутентификатора.
+otp-reset-description=Какую конфигурацию OTP следует удалить?
+password-display-name=Пароль
+password-help-text=Войдите, введя свой пароль.
+auth-username-form-display-name=Имя пользователя
+auth-username-form-help-text=Начните вход, введя свое имя пользователя
+auth-username-password-form-display-name=Имя пользователя и пароль
+auth-username-password-form-help-text=Войдите, введя свое имя пользователя и пароль.
+auth-x509-client-username-form-display-name=Сертификат X509
+auth-x509-client-username-form-help-text=Войдите в систему, используя клиентский сертификат X509.
+
+# Recovery Codes
+auth-recovery-authn-code-form-display-name=Восстановление кода аутентификации
+auth-recovery-authn-code-form-help-text=Введите код аутентификации восстановления из ранее сгенерированного списка.
+auth-recovery-code-info-message=Введите указанный код восстановления.
+auth-recovery-code-prompt=Код восстановления #{0}
+auth-recovery-code-header=Войти с кодом восстановления аутентификации
+recovery-codes-error-invalid=Неверный код аутентификации восстановления
+recovery-code-config-header=Восстановление кодов аутентификации
+recovery-code-config-warning-title=Эти коды восстановления больше не появятся после того, как вы покинете эту страницу
+recovery-code-config-warning-message=Обязательно распечатайте, загрузите или скопируйте их в менеджер паролей и сохраните. Отмена этой настройки удалит эти коды восстановления из вашей учетной записи.
+recovery-codes-print=Печать
+recovery-codes-download=Скачать
+recovery-codes-copy=Копировать
+recovery-codes-copied=Скопировано
+recovery-codes-confirmation-message=Я сохранил эти коды в надежном месте
+recovery-codes-action-complete=Полная настройка
+recovery-codes-action-cancel=Отменить настройку
+recovery-codes-download-file-header=Сохраните эти коды восстановления в надежном месте.
+recovery-codes-download-file-description=Коды восстановления — это одноразовые коды доступа, которые позволяют вам войти в свою учетную запись, если у вас нет доступа к аутентификатору.
+recovery-codes-download-file-date=Эти коды были сгенерированы
+recovery-codes-label-default=Коды восстановления
+
+# WebAuthn
+webauthn-display-name=Пароль
+webauthn-help-text=Для входа используйте свой пароль.
+webauthn-passwordless-display-name=Пароль
+webauthn-passwordless-help-text=Используйте свой пароль для входа без пароля.
+webauthn-login-title=Вход с паролем
+webauthn-registration-title=Регистрация ключа доступа
+webauthn-available-authenticators=Доступные пароли
+webauthn-unsupported-browser-text=WebAuthn не поддерживается этим браузером. Попробуйте другой или обратитесь к администратору.
+webauthn-doAuthenticate=Войти с помощью пароля
+webauthn-createdAt-label=Созданный
+webauthn-registration-init-label=Пароль (метка по умолчанию)
+webauthn-registration-init-label-prompt=Пожалуйста, введите метку вашего зарегистрированного ключа доступа
+
+
+# WebAuthn Error
+webauthn-error-title=Ошибка ключа доступа
+webauthn-error-registration=Не удалось зарегистрировать ваш пароль.<br /> {0}
+webauthn-error-api-get=Не удалось выполнить аутентификацию с помощью пароля.<br /> {0}
+webauthn-error-different-user=Первый аутентифицированный пользователь — это не тот, который аутентифицирован с помощью ключа доступа.
+webauthn-error-auth-verification=Результат аутентификации ключа доступа недействителен.<br /> {0}
+webauthn-error-register-verification=Результат регистрации ключа доступа недействителен.<br /> {0}
+webauthn-error-user-not-found=Неизвестный пользователь аутентифицирован с помощью пароля.
+
+# Passkey
+passkey-login-title=Вход с паролем
+passkey-available-authenticators=Доступные пароли
+passkey-unsupported-browser-text=Passkey не поддерживается этим браузером. Попробуйте другой или обратитесь к администратору.
+passkey-doAuthenticate=Войти с помощью пароля
+passkey-createdAt-label=Созданный
+passkey-autofill-select=Выберите свой пароль
+
+# Identity provider
+identity-provider-redirector=Подключитесь к другому поставщику удостоверений
+identity-provider-login-label=Или войдите с помощью
+idp-email-verification-display-name=Проверка электронной почты
+idp-email-verification-help-text=Привяжите свою учетную запись, подтвердив адрес электронной почты.
+idp-username-password-form-display-name=Имя пользователя и пароль
+idp-username-password-form-help-text=Подключите свою учетную запись, войдя в систему.
+finalDeletionConfirmation=Если вы удалите свой аккаунт, его нельзя будет восстановить. Чтобы сохранить свой аккаунт, нажмите «Отмена».
+irreversibleAction=Это действие необратимо
+deleteAccountConfirm=Подтверждение удаления учетной записи
+deletingImplies=Удаление вашего аккаунта подразумевает:
+errasingData=Удаление всех ваших данных
+loggingOutImmediately=Немедленный выход из системы
+accountUnusable=Любое последующее использование приложения с этой учетной записью будет невозможно
+userDeletedSuccessfully=Пользователь успешно удален
+access-denied=Доступ запрещен
+access-denied-when-idp-auth=Доступ запрещен при аутентификации с помощью {0}
+frontchannel-logout.title=Выход из системы
+frontchannel-logout.message=Вы выходите из следующих приложений
+logoutConfirmTitle=Выход из системы
+logoutConfirmHeader=Хотите выйти?
+doLogout=Выйти
+readOnlyUsernameMessage=Вы не можете обновить свое имя пользователя, так как оно доступно только для чтения.
+error-invalid-multivalued-size=Атрибут {0} должен иметь не менее {1} и не более {2} {2,choice,0#values|1#value|1<values}.
+organization.confirm-membership.title=Вы собираетесь присоединиться к организации ${kc.org.name}
+organization.confirm-membership=Нажав на ссылку ниже, вы станете членом организации {0}:
+organization.member.register.title=Создайте учетную запись, чтобы присоединиться к организации ${kc.org.name}
+organization.select=Выберите организацию для продолжения:
+notMemberOfOrganization=Пользователь не является членом организации {0}
+notMemberOfAnyOrganization=Пользователь не является членом какой-либо организации
+confirmAccountLinkingBody=Если вы привяжете учетную запись, вы также сможете войти, используя учетную запись {0} поставщика удостоверений {1}. Не продолжайте, если вы не инициировали этот процесс или не хотите привязывать учетную запись.
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_sk.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_sk.properties
index 25c6a6c8a555..4359794f23a7 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_sk.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_sk.properties
@@ -20,24 +20,25 @@ errorDeletingAccount=Pri odstraňovaní účtu došlo k chybe
 deletingAccountForbidden=Nemáte dostatočné oprávnenie na vymazanie vlastného účtu, kontaktujte administrátora.
 kerberosNotConfigured=Kerberos nie je nakonfigurovaný
 kerberosNotConfiguredTitle=Kerberos nie je nakonfigurovaný
-bypassKerberosDetail=Buď nie ste prihlásený cez Kerberos, alebo váš prehliadač nie je nastavený na prihlásenie do Kerberos. Kliknutím na tlačidlo Pokračovať sa prihláste iným spôsobom
+bypassKerberosDetail=Buď nie ste prihlásený cez Kerberos, alebo Váš prehliadač nie je nastavený na prihlásenie do Kerberos. Kliknutím na tlačidlo Pokračovať sa prihláste iným spôsobom
 kerberosNotSetUp=Kerberos nie je nastavený. Nemôžete sa prihlásiť.
 registerTitle=Registrácia
 loginAccountTitle=Prihláste sa do svojho účtu
 loginTitle=Prihlásenie do {0}
 loginTitleHtml={0}
 impersonateTitle={0} prevteliť sa
-impersonateTitleHtml=<strong>{0}</strong> Prevteliť sa</strong>
+impersonateTitleHtml=<strong>{0}</strong> Prevteliť sa
 realmChoice=Realm
 unknownUser=Neznámy používateľ
 loginTotpTitle=Nastavenie mobilného autentifikátora
 loginProfileTitle=Aktualizácia informácií o účte
 loginIdpReviewProfileTitle=Aktualizácia informácií o účte
 loginTimeout=Prihlasovanie trvalo príliš dlho. Prihlasovací proces začína od začiatku.
-reauthenticate=Pre pokračovanie sa prosím prihláste znova
+reauthenticate=Na pokračovanie sa prosím prihláste znova
+authenticateStrong=Na pokračovanie je potrebné silné overenie
 oauthGrantTitle=Poskytnúť prístup {0}
 oauthGrantTitleHtml={0}
-oauthGrantInformation=Uistite sa, že dôverujete {0}. Zistite, ako bude {0} narábať s vašimi údajmi. 
+oauthGrantInformation=Uistite sa, že dôverujete {0}. Zistite, ako bude {0} narábať s Vašimi údajmi. 
 oauthGrantReview=Môžete si prezrieť 
 oauthGrantTos=podmienky služby.
 oauthGrantPolicy=zásady ochrany osobných údajov.
@@ -54,8 +55,8 @@ updatePasswordTitle=Aktualizácia hesla
 codeSuccessTitle=Kód úspechu
 codeErrorTitle=Kód chyby\: {0}
 displayUnsupported=Nepodporovaný typ displeja 
-browserRequired=Pre prihlásenie je potrebný prehliadač
-browserContinue=Pre dokončenie prihlásenia je potrebný prehliadač
+browserRequired=Na prihlásenie je potrebný prehliadač
+browserContinue=Na dokončenie prihlásenia je potrebný prehliadač
 browserContinuePrompt=Otvoriť prehliadač a pokračovať v prihlasovaní? [a/n]:
 browserContinueAnswer=a
 
@@ -72,6 +73,9 @@ termsPlainText=Podmienky, ktoré sa majú definovať.
 termsAcceptanceRequired=Musíte súhlasiť s našimi podmienkami.
 acceptTerms=Súhlasím s podmienkami
 
+deleteCredentialTitle=Odstrániť {0}
+deleteCredentialMessage=Chcete odstrániť {0}?
+
 recaptchaFailed=Neplatné Recaptcha
 recaptchaNotConfigured=Recaptcha sa vyžaduje, ale nie je nakonfigurovaná
 consentDenied=Súhlas bol zamietnutý.
@@ -116,14 +120,15 @@ phoneScopeConsentText=Telefónne číslo
 offlineAccessScopeConsentText=Offline prístup
 samlRoleListScopeConsentText=Moje role
 rolesScopeConsentText=Užívateľské roly
+organizationScopeConsentText=Organizácia
 
 restartLoginTooltip=Znovu spustiť prihlásenie
 
-loginTotpIntro=Pre prístup k tomuto účtu je potrebné nastaviť generátor jednorazových kódov
-loginTotpStep1=Nainštalujte <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> alebo Google Authenticator na mobil. Obidve aplikácie sú k dispozícii v <a href="https://play.google.com">Google Play</a> a Apple App Store.
+loginTotpIntro=Na prístup k tomuto účtu je potrebné nastaviť generátor jednorazových kódov
+loginTotpStep1=Nainštalujte si do mobilu jednu z nasledujúcich aplikácií:
 loginTotpStep2=Otvorte aplikáciu a skenujte čiarový kód alebo zadajte kľúč
 loginTotpStep3=Zadajte jednorazový kód poskytnutý aplikáciou a kliknutím na tlačidlo Odoslať dokončite nastavenie
-loginTotpStep3DeviceName=Uveďte názov zariadenia, ktorý vám pomôže spravovať zariadenia OTP. 
+loginTotpStep3DeviceName=Uveďte názov zariadenia, ktorý Vám pomôže spravovať zariadenia OTP. 
 loginTotpManualStep2=Otvorte aplikáciu a zadajte kľúč
 loginTotpManualStep3=Používajte nasledujúce hodnoty konfigurácie, ak aplikácia umožňuje ich nastavenie
 loginTotpUnableToScan=Nemožno skenovať?
@@ -150,7 +155,7 @@ oauthGrantRequest=Udeľujete tieto prístupové oprávnenia?
 inResource=v
 
 oauth2DeviceVerificationTitle=Prihlásenie zariadenia 
-verifyOAuth2DeviceUserCode=Zadajte kód poskytnutý vaším zariadením a kliknite na tlačidlo Odoslať
+verifyOAuth2DeviceUserCode=Zadajte kód poskytnutý Vaším zariadením a kliknite na tlačidlo Odoslať
 oauth2DeviceInvalidUserCodeMessage=Neplatný kód, skúste to prosím znova.
 oauth2DeviceExpiredUserCodeMessage=Kód stratil platnosť. Vráťte sa prosím k svojmu zariadeniu a skúste sa pripojiť znova.
 oauth2DeviceVerificationCompleteHeader=Úspešné prihlásenie zariadenia
@@ -160,12 +165,15 @@ oauth2DeviceVerificationFailedMessage=Môžete zavrieť toto okno prehliadača,
 oauth2DeviceConsentDeniedMessage=Súhlas s pripojením zariadenia zamietnutý.
 oauth2DeviceAuthorizationGrantDisabledMessage=Klientovi nie je povolené iniciovať OAuth 2.0 Device Authorization Grant. Tento flow je pre klienta zakázaný.
 
-emailVerifyInstruction1=Bol Vám odoslaný e-mail s pokynmi na overenie vašej e-mailovej adresy.
+emailVerifyInstruction1=Bol Vám odoslaný e-mail s pokynmi na overenie Vašej e-mailovej adresy.
 emailVerifyInstruction2=Nezískali ste v e-maile overovací kód?
 emailVerifyInstruction3=opätovne odoslať e-mail.
+emailVerifyInstruction4=Na overenie Vašej e-mailovej adresy Vám pošleme e-mail s pokynmi na adresu {0}.
+emailVerifyResend=Opätovné odoslanie overovacieho e-mailu
+emailVerifySend=Odoslať overovací e-mail
 
 emailLinkIdpTitle=Odkaz {0}
-emailLinkIdp1=Bol vám odoslaný e-mail s pokynmi na prepojenie účtu {0} {1} s vaším účtom {2}.
+emailLinkIdp1=Bol Vám odoslaný e-mail s pokynmi na prepojenie účtu {0} {1} s Vaším účtom {2}.
 emailLinkIdp2=Nezískali ste v e-maile overovací kód?
 emailLinkIdp3=opätovne poslať e-mail.
 emailLinkIdp4=Ak ste už overili e-mail v inom prehliadači
@@ -173,13 +181,13 @@ emailLinkIdp5=pokračovať.
 
 backToLogin=&laquo; Späť na prihlásenie
 
-emailInstruction=Zadajte svoje používateľské meno alebo e-mailovú adresu a my vám zašleme pokyny na vytvorenie nového hesla.
-emailInstructionUsername=Zadajte svoje používateľské meno a my vám zašleme pokyny na vytvorenie nového hesla.
+emailInstruction=Zadajte svoje používateľské meno alebo e-mailovú adresu a my Vám zašleme pokyny na vytvorenie nového hesla.
+emailInstructionUsername=Zadajte svoje používateľské meno a my Vám zašleme pokyny na vytvorenie nového hesla.
 
-copyCodeInstruction=Prosím skopírujte tento kód a vložte ho do vašej aplikácie:
+copyCodeInstruction=Prosím skopírujte tento kód a vložte ho do Vašej aplikácie:
 
 pageExpiredTitle=Platnosť stránky vypršala
-pageExpiredMsg1=Pre reštartovanie prihlasovacieho procesu
+pageExpiredMsg1=Na reštartovanie prihlasovacieho procesu
 pageExpiredMsg2=Pokračovanie prihlasovacieho procesu
 
 personalInfo=Osobné informácie:
@@ -219,8 +227,10 @@ invalidUsernameOrEmailMessage=Neplatné používateľské meno alebo e-mail.
 invalidPasswordMessage=Neplatné heslo.
 invalidEmailMessage=Neplatná e-mailová adresa.
 accountDisabledMessage=Účet je zakázaný, kontaktujte administrátora.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessage=Neplatné používateľské meno alebo heslo.
 accountPermanentlyDisabledMessage=Neplatné používateľské meno alebo heslo.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessageTotp=Neplatný kód autentifikátora.
 accountPermanentlyDisabledMessageTotp=Neplatný kód autentifikátora.
 expiredCodeMessage=Platnosť prihlásenia vypršala. Prihláste sa znova.
@@ -228,6 +238,7 @@ expiredActionMessage=Akcia vypršala. Pokračujte prihlásením.
 expiredActionTokenNoSessionMessage=Akcia vypršala.
 expiredActionTokenSessionExistsMessage=Platnosť vypršala. Začnite znova.
 sessionLimitExceeded=Prekročený limit relácií 
+identityProviderLogoutFailure=Zlyhanie odhlásenia zo SAML IdP
 
 missingFirstNameMessage=Zadajte krstné meno.
 missingLastNameMessage=Zadajte priezvisko.
@@ -273,17 +284,20 @@ federatedIdentityUnavailableMessage=Používateľ {0} autentifikovaný poskytova
 federatedIdentityUnmatchedEssentialClaimMessage=Identifikačný token vydaný poskytovateľom identity sa nezhoduje s nakonfigurovaným essential claim. Obráťte sa na svojho správcu.
 
 confirmLinkIdpTitle=Účet už existuje
+confirmOverrideIdpTitle=Prepojenie so sprostredkovateľom už existuje
 federatedIdentityConfirmLinkMessage=Používateľ s {0} {1} už existuje. Ako chcete pokračovať?
-federatedIdentityConfirmReauthenticateMessage=Overiť prepojiť váš účet s {0}
+federatedIdentityConfirmOverrideMessage=Snažíte sa prepojiť svoj účet {0} s {1} účtom {2}. Váš účet je však už prepojený s iným {3} účtom {4}. Môžete potvrdiť, či chcete nahradiť existujúce prepojenie novým účtom?
+federatedIdentityConfirmReauthenticateMessage=Overiť prepojiť Váš účet s {0}
 nestedFirstBrokerFlowMessage=Užívateľ {0} {1} nie je prepojený so žiadnym známym používateľom.
 confirmLinkIdpReviewProfile=Skontrolujte profil
 confirmLinkIdpContinue=Pridať do existujúceho účtu
+confirmOverrideIdpContinue=Áno, prepíšte prepojenie so súčasným účtom
 
-configureTotpMessage=Na aktiváciu vášho účtu musíte nastaviť aplikáciu Mobile Authenticator.
-configureBackupCodesMessage=Pre aktiváciu vášho účtu musíte nastaviť záložné kódy.
+configureTotpMessage=Na aktiváciu Vášho účtu musíte nastaviť aplikáciu Mobile Authenticator.
+configureBackupCodesMessage=Na aktiváciu Vášho účtu musíte nastaviť záložné kódy.
 updateProfileMessage=Ak chcete aktivovať svoj účet, musíte aktualizovať svoj užívateľský profil.
 updatePasswordMessage=Ak chcete aktivovať svoj účet, musíte zmeniť heslo.
-updateEmailMessage=Pre aktiváciu účtu musíte aktualizovať svoju e-mailovú adresu.
+updateEmailMessage=Na aktiváciu účtu musíte aktualizovať svoju e-mailovú adresu.
 resetPasswordMessage=Potrebujete zmeniť svoje heslo.
 verifyEmailMessage=Ak chcete aktivovať svoj účet, musíte overiť svoju e-mailovú adresu.
 linkIdpMessage=Potrebujete si overiť svoju e-mailovú adresu a prepojiť svoj účet s {0}.
@@ -308,6 +322,7 @@ invalidPasswordMinLowerCaseCharsMessage=Neplatné heslo: musí obsahovať minim
 invalidPasswordMinUpperCaseCharsMessage=Neplatné heslo: musí obsahovať aspoň {0} veľké písmená.
 invalidPasswordMinSpecialCharsMessage=Neplatné heslo: musí obsahovať aspoň {0} špeciálne znaky.
 invalidPasswordNotUsernameMessage=Neplatné heslo: nesmie byť rovnaké ako používateľské meno.
+invalidPasswordNotContainsUsernameMessage=Nesprávne heslo: Nemôže obsahovať používateľské meno.
 invalidPasswordNotEmailMessage=Neplatné heslo: nesmie sa rovnať e-mailu.
 invalidPasswordRegexPatternMessage=Neplatné heslo: nezhoduje sa vzormi regulárneho výrazu.
 invalidPasswordHistoryMessage=Neplatné heslo: nesmie sa rovnať žiadnemu z posledných {0} hesiel.
@@ -343,7 +358,7 @@ unexpectedErrorHandlingRequestMessage=Neočakávaná chyba pri spracovaní žiad
 invalidAccessCodeMessage=Neplatný prístupový kód.
 sessionNotActiveMessage=Session nie je aktívna.
 invalidCodeMessage=Vyskytla sa chyba, prihláste sa znova prostredníctvom svojej aplikácie.
-cookieNotFoundMessage=Súbor cookie nebol nájdený. Uistite sa, že sú vo vašom prehliadači povolené súbory cookie.
+cookieNotFoundMessage=Súbor cookie nebol nájdený. Uistite sa, že sú vo Vašom prehliadači povolené súbory cookie.
 insufficientLevelOfAuthentication=Požadovaná úroveň overenia nebola splnená.
 identityProviderUnexpectedErrorMessage=Neočakávaná chyba pri autentifikácii s poskytovateľom identity
 identityProviderMissingStateMessage=V odpovedi poskytovateľa identity chýba parameter state.
@@ -360,7 +375,7 @@ emailVerifiedMessage=Vaša e-mailová adresa bola overená.
 emailVerifiedAlreadyMessage=Vaša e-mailová adresa už bola overená.
 staleEmailVerificationLink=Odkaz, na ktorý ste klikli, je starý odkaz a už nie je platný. Možno ste už overili svoj e-mail?
 identityProviderAlreadyLinkedMessage=Federatívna identita vrátená {0} je už prepojená s iným používateľom.
-confirmAccountLinking=Potvrďte prepojenie účtu {0} poskytovateľa totožnosti {1} s vaším účtom.
+confirmAccountLinking=Potvrďte prepojenie účtu {0} poskytovateľa totožnosti {1} s Vaším účtom.
 confirmEmailAddressVerification=Potvrďte platnosť e-mailovej adresy {0}.
 confirmExecutionOfActions=Vykonajte nasledujúce akcie
 
@@ -382,6 +397,7 @@ requiredAction.UPDATE_PROFILE=Aktualizovať profil
 requiredAction.VERIFY_EMAIL=Overiť e-mail
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generovať kódy obnovy
 requiredAction.webauthn-register-passwordless=Webauthn Passwordless Registrácia
+requiredAction.webauthn-register=Registrácia Webauthn
 
 invalidTokenRequiredActions=Požadované akcie zahrnuté v odkaze nie sú platné
 
@@ -426,9 +442,11 @@ auth-username-form-display-name=Používateľské meno
 auth-username-form-help-text=Začnite prihlasovanie zadaním svojho používateľského mena
 auth-username-password-form-display-name=Používateľské meno a heslo
 auth-username-password-form-help-text=Prihláste sa zadaním svojho používateľského mena a hesla.
+auth-x509-client-username-form-display-name=X509 Certifikát
+auth-x509-client-username-form-help-text=Prihláste sa pomocou klientského certifikátu X509.
 
 # Recovery Codes
-auth-recovery-authn-code-form-display-name=Overovací kód pre obnovenie
+auth-recovery-authn-code-form-display-name=Overovací kód na obnovenie
 auth-recovery-authn-code-form-help-text=Zadajte overovací kód obnovy z vopred vygenerovaného zoznamu.
 auth-recovery-code-info-message=Zadajte zadaný kód obnovy.
 auth-recovery-code-prompt=Kód obnovy #{0}
@@ -436,7 +454,7 @@ auth-recovery-code-header=Prihlásenie pomocou overovacieho kódu obnovy
 recovery-codes-error-invalid=Neplatný overovací kód obnovy
 recovery-code-config-header=Overovacie kódy obnovy
 recovery-code-config-warning-title=Tieto kódy obnovenia sa po opustení tejto stránky už nezobrazia
-recovery-code-config-warning-message=Uistite sa, že ste si ich vytlačili, stiahli alebo skopírovali do správcu hesiel a uložili. Zrušenie tohto nastavenia odstráni tieto kódy na obnovenie z vášho účtu.
+recovery-code-config-warning-message=Uistite sa, že ste si ich vytlačili, stiahli alebo skopírovali do správcu hesiel a uložili. Zrušenie tohto nastavenia odstráni tieto kódy na obnovenie z Vášho účtu.
 recovery-codes-print=Tlačiť
 recovery-codes-download=Stiahnuť
 recovery-codes-copy=Kopírovať
@@ -445,7 +463,7 @@ recovery-codes-confirmation-message=Uložil som tieto kódy na bezpečné miesto
 recovery-codes-action-complete=Ukončiť nastavenie
 recovery-codes-action-cancel=Zrušiť nastavenie
 recovery-codes-download-file-header=Uchovajte tieto kódy na obnovu na bezpečnom mieste.
-recovery-codes-download-file-description=Kódy na obnovenie sú jednorázové prístupové kódy, ktoré vám umožnia prihlásiť sa do vášho účtu, ak nemáte prístup k autentifikátoru.
+recovery-codes-download-file-description=Kódy na obnovenie sú jednorázové prístupové kódy, ktoré Vám umožnia prihlásiť sa do Vášho účtu, ak nemáte prístup k autentifikátoru.
 recovery-codes-download-file-date=Tieto kódy boli vygenerované dňa
 recovery-codes-label-default=Kódy na obnovenie
 
@@ -460,16 +478,27 @@ webauthn-available-authenticators=Dostupné prihlasovacie kľúče
 webauthn-unsupported-browser-text=WebAuthn nie je podporovaný týmto prehliadačom. Skúste iný alebo kontaktujte svojho administrátora.
 webauthn-doAuthenticate=Prihlásenie pomocou prihlasovacieho kľúča
 webauthn-createdAt-label=Vytvorené
+webauthn-registration-init-label=Prihlasovací kľúč (predvolený štítok)
+webauthn-registration-init-label-prompt=Zadajte prosím štítok Vášho registrovaného prístupového kľúča
+
 
 # WebAuthn Error
 webauthn-error-title=Chybný prihlasovací kľúč
-webauthn-error-registration=Nepodarilo sa zaregistrovať prihlasovací kľúč.<br/> {0}
-webauthn-error-api-get=Nepodarilo sa overiť pomocou prihlasovacieho kľúča.<br/> {0}
+webauthn-error-registration=Nepodarilo sa zaregistrovať prihlasovací kľúč.<br /> {0}
+webauthn-error-api-get=Nepodarilo sa overiť pomocou prihlasovacieho kľúča.<br /> {0}
 webauthn-error-different-user=Prvý overený používateľ nie je ten, ktorý bol overený prihlasovacím kľúčom.
-webauthn-error-auth-verification=Výsledok overenia prihlasovacieho kľúča je neplatný.<br/> {0}
-webauthn-error-register-verification=Výsledok registrácie prihlasovacieho kľúča je neplatný.<br/> {0}
+webauthn-error-auth-verification=Výsledok overenia prihlasovacieho kľúča je neplatný.<br /> {0}
+webauthn-error-register-verification=Výsledok registrácie prihlasovacieho kľúča je neplatný.<br /> {0}
 webauthn-error-user-not-found=Neznámy používateľ overený prihlasovacím kľúčom.
 
+# Passkey
+passkey-login-title=Prihlásenie pomocou prihlasovacieho kľúča
+passkey-available-authenticators=Dostupné prihlasovacie kľúče
+passkey-unsupported-browser-text=Prihlasovací kľúč nie je v tomto prehliadači podporovaný. Skúste iný, alebo sa obráťte na správcu.
+passkey-doAuthenticate=Prihlásenie pomocou prihlasovacieho kľúča
+passkey-createdAt-label=Vytvorené
+passkey-autofill-select=Vyberte svoj prihlasovací kľúč
+
 # Identity provider
 identity-provider-redirector=Pripojenie k inému poskytovateľovi identít
 identity-provider-login-label=Prihláste sa pomocou
@@ -482,8 +511,8 @@ finalDeletionConfirmation=Ak vymažete svoj účet, nebude možné ho obnoviť.
 irreversibleAction=Táto akcia je nezvratná
 deleteAccountConfirm=Potvrdenie odstránenia účtu
 
-deletingImplies=Odstránenie vášho účtu znamená:
-errasingData=Vymazanie všetkých vašich údajov
+deletingImplies=Odstránenie Vášho účtu znamená:
+errasingData=Vymazanie všetkých Vašich údajov
 loggingOutImmediately=Okamžité odhlásenie
 accountUnusable=Žiadne ďalšie použitie aplikácie nebude s týmto účtom možné
 userDeletedSuccessfully=Užívateľ bol úspešne odstránený
@@ -498,4 +527,11 @@ logoutConfirmHeader=Chcete sa odhlásiť?
 doLogout=Odhlásiť
 
 readOnlyUsernameMessage=Nemôžete aktualizovať svoje používateľské meno, pretože je iba na čítanie.
-error-invalid-multivalued-size=Atribút {0} musí mať najmenej {1} {1,choice,0#hodnôt|1#hodnotu|1<hodnoty|4<hodnôt} a najviac {2} {1,choice,0#hodnôt|1#hodnotu|1<hodnoty|4<hodnôt}.
\ No newline at end of file
+error-invalid-multivalued-size=Atribút {0} musí mať najmenej {1} {1,choice,0#hodnôt|1#hodnotu|1<hodnoty|4<hodnôt} a najviac {2} {2,choice,0#hodnôt|1#hodnotu|1<hodnoty|4<hodnôt}.
+
+organization.confirm-membership.title=Chystáte sa vstúpiť do organizácie ${kc.org.name}
+organization.confirm-membership=Kliknutím na odkaz nižšie sa stanete členom organizácie {0}:
+organization.member.register.title=Vytvorenie účtu na vstup do organizácie ${kc.org.name}
+organization.select=Ak chcete pokračovať, vyberte organizáciu:
+notMemberOfOrganization=Používateľ nie je členom organizácie {0}
+notMemberOfAnyOrganization=Používateľ nie je členom žiadnej organizácie
\ No newline at end of file
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_sl.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_sl.properties
new file mode 100644
index 000000000000..28071db35520
--- /dev/null
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_sl.properties
@@ -0,0 +1,485 @@
+doLogIn=Prijava
+doRegister=Registracija
+doRegisterSecurityKey=Registracija
+doCancel=Prekliči
+doSubmit=Potrdi
+doBack=Nazaj
+doYes=Da
+doNo=Ne
+doContinue=Nadaljuj
+doIgnore=Prezri
+doAccept=Sprejmi
+doDecline=Zavrni
+doForgotPassword=Pozabljeno geslo?
+doClickHere=Kliknite tukaj
+doImpersonate=Predstavljaj se kot
+doTryAgain=Poskusi znova
+doTryAnotherWay=Poskusi drug način
+doConfirmDelete=Potrdi brisanje
+errorDeletingAccount=Pri brisanju računa je prišlo do napake
+deletingAccountForbidden=Nimate dovolj pravic za izbris svojega računa, kontaktirajte administratorja.
+kerberosNotConfigured=Kerberos ni konfiguriran
+kerberosNotConfiguredTitle=Kerberos ni konfiguriran
+bypassKerberosDetail=Ali niste prijavljeni preko Kerberosa ali pa vaš brskalnik ni nastavljen za prijavo preko Kerberosa. Prosimo, kliknite nadaljuj za prijavo na drug način
+kerberosNotSetUp=Kerberos ni nastavljen. Ne morete se prijaviti.
+registerTitle=Registracija
+loginAccountTitle=Prijavite se v svoj račun
+loginTitle=Prijava v {0}
+loginTitleHtml={0}
+impersonateTitle={0} Predstavljaj se kot uporabnik
+impersonateTitleHtml=<strong>{0}</strong> Predstavljaj se kot uporabnik
+realmChoice=Domena
+unknownUser=Neznan uporabnik
+loginTotpTitle=Nastavitev mobilnega avtentikatorja
+loginProfileTitle=Posodobi račun
+loginIdpReviewProfileTitle=Posodobi račun
+loginTimeout=Vaš poskus prijave je potekel. Prijava se bo začela znova.
+reauthenticate=Prosimo, ponovno se avtenticirajte za nadaljevanje
+authenticateStrong=Za nadaljevanje je potrebna močna avtentikacija
+oauthGrantTitle=Odobritev dostopa za {0}
+oauthGrantTitleHtml={0}
+oauthGrantInformation=Prepričajte se, da zaupate {0}, tako da izveste, kako bo {0} ravnal z vašimi podatki.
+oauthGrantReview=Lahko pregledate
+oauthGrantTos=splošne pogoje poslovanja.
+oauthGrantPolicy=pravilnik o zasebnosti.
+errorTitle=Oprostite...
+errorTitleHtml=<strong>Oprostite</strong>...
+emailVerifyTitle=Potrditev e-poštnega naslova
+emailForgotTitle=Ste pozabili geslo?
+updateEmailTitle=Posodobi e-poštni naslov
+emailUpdateConfirmationSentTitle=Potrditveno sporočilo poslano
+emailUpdateConfirmationSent=Potrditveno sporočilo je bilo poslano na {0}. Za dokončanje posodobitve e-poštnega naslova morate slediti navodilom v sporočilu.
+emailUpdatedTitle=E-poštni naslov posodobljen
+emailUpdated=E-poštni naslov računa je bil uspešno posodobljen na {0}.
+updatePasswordTitle=Posodobi geslo
+codeSuccessTitle=Koda uspešna
+codeErrorTitle=Koda napake: {0}
+displayUnsupported=Zahtevana vrsta prikaza ni podprta
+browserRequired=Za prijavo je potreben brskalnik
+browserContinue=Za dokončanje prijave je potreben brskalnik
+browserContinuePrompt=Odprem brskalnik in nadaljujem s prijavo? [y/n]:
+browserContinueAnswer=y
+
+# Transports
+usb=USB
+nfc=NFC
+bluetooth=Bluetooth
+internal=Notranji
+unknown=Neznan
+termsTitle=Pogoji uporabe
+termsText=<p>Pogoji uporabe bodo določeni</p>
+termsPlainText=Pogoji uporabe bodo določeni.
+termsAcceptanceRequired=Strinjati se morate z našimi pogoji uporabe.
+acceptTerms=Strinjam se s pogoji uporabe
+deleteCredentialTitle=Izbriši {0}
+deleteCredentialMessage=Ali želite izbrisati {0}?
+recaptchaFailed=Neveljaven Recaptcha
+recaptchaNotConfigured=Recaptcha je zahtevana, vendar ni konfigurirana
+consentDenied=Soglasje zavrnjeno.
+noAccount=Nov uporabnik?
+username=Uporabniško ime
+usernameOrEmail=Uporabniško ime ali e-poštni naslov
+firstName=Ime
+givenName=Dano ime
+fullName=Polno ime
+lastName=Priimek
+familyName=Družinsko ime
+email=E-poštni naslov
+password=Geslo
+passwordConfirm=Potrdi geslo
+passwordNew=Novo geslo
+passwordNewConfirm=Potrditev novega gesla
+hidePassword=Skrij geslo
+showPassword=Pokaži geslo
+rememberMe=Zapomni si me
+authenticatorCode=Enkratna koda
+address=Naslov
+street=Ulica
+locality=Mesto ali kraj
+region=Država, pokrajina ali regija
+postal_code=Poštna številka
+country=Država
+emailVerified=E-poštni naslov potrjen
+website=Spletna stran
+phoneNumber=Telefonska številka
+phoneNumberVerified=Telefonska številka potrjena
+gender=Spol
+birthday=Datum rojstva
+zoneinfo=Časovni pas
+gssDelegationCredential=GSS poverilnica delegiranja
+logoutOtherSessions=Odjava iz drugih naprav
+profileScopeConsentText=Uporabniški profil
+emailScopeConsentText=E-poštni naslov
+addressScopeConsentText=Naslov
+phoneScopeConsentText=Telefonska številka
+offlineAccessScopeConsentText=Dostop brez povezave
+samlRoleListScopeConsentText=Moje vloge
+rolesScopeConsentText=Uporabniške vloge
+organizationScopeConsentText=Organizacija
+restartLoginTooltip=Ponovno zaženi prijavo
+loginTotpIntro=Za dostop do tega računa morate nastaviti generator enkratnih gesel
+loginTotpStep1=Namestite eno od naslednjih aplikacij na svoj mobilni telefon:
+loginTotpStep2=Odprite aplikacijo in skenirajte črtno kodo:
+loginTotpStep3=Vnesite enkratno kodo, ki jo je ustvarila aplikacija, in kliknite Potrdi za dokončanje nastavitve.
+loginTotpStep3DeviceName=Vnesite ime naprave, ki vam bo pomagalo upravljati vaše OTP naprave.
+loginTotpManualStep2=Odprite aplikacijo in vnesite ključ:
+loginTotpManualStep3=Če aplikacija omogoča nastavitev, uporabite naslednje konfiguracijske vrednosti:
+loginTotpUnableToScan=Ne morete skenirati?
+loginTotpScanBarcode=Skeniraj črtno kodo?
+loginCredential=Poverilnica
+loginOtpOneTime=Enkratna koda
+loginTotpType=Tip
+loginTotpAlgorithm=Algoritem
+loginTotpDigits=Števke
+loginTotpInterval=Interval
+loginTotpCounter=Števec
+loginTotpDeviceName=Ime naprave
+loginTotp.totp=Časovno osnovano
+loginTotp.hotp=Števno osnovano
+totpAppFreeOTPName=FreeOTP
+totpAppGoogleName=Google Authenticator
+totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
+loginChooseAuthenticator=Izberite način prijave
+oauthGrantRequest=Ali odobrite te pravice dostopa?
+inResource=v
+oauth2DeviceVerificationTitle=Prijava naprave
+verifyOAuth2DeviceUserCode=Vnesite kodo, ki jo je prikazala vaša naprava, in kliknite Potrdi
+oauth2DeviceInvalidUserCodeMessage=Neveljavna koda, prosimo, poskusite znova.
+oauth2DeviceExpiredUserCodeMessage=Koda je potekla. Prosimo, vrnite se na svojo napravo in poskusite ponovno vzpostaviti povezavo.
+oauth2DeviceVerificationCompleteHeader=Prijava naprave uspešna
+oauth2DeviceVerificationCompleteMessage=Lahko zaprete to okno brskalnika in se vrnete na svojo napravo.
+oauth2DeviceVerificationFailedHeader=Prijava naprave ni uspela
+oauth2DeviceVerificationFailedMessage=Lahko zaprete to okno brskalnika, se vrnete na svojo napravo in poskusite ponovno vzpostaviti povezavo.
+oauth2DeviceConsentDeniedMessage=Soglasje za povezavo naprave je zavrnjeno.
+oauth2DeviceAuthorizationGrantDisabledMessage=Odjemalcu ni dovoljeno začeti OAuth 2.0 pooblastila za napravo. Ta funkcija je onemogočena za odjemalca.
+emailVerifyInstruction1=E-pošta z navodili za potrditev vašega e-poštnega naslova je bila poslana na naslov {0}.
+emailVerifyInstruction2=Niste prejeli potrditvene kode po e-pošti?
+emailVerifyInstruction3=za ponovno pošiljanje e-pošte.
+emailLinkIdpTitle=Poveži {0}
+emailLinkIdp1=E-pošta z navodili za povezavo računa {0} {1} z vašim računom {2} vam je bila poslana.
+emailLinkIdp2=Niste prejeli potrditvene kode po e-pošti?
+emailLinkIdp3=za ponovno pošiljanje e-pošte.
+emailLinkIdp4=Če ste e-poštni naslov že potrdili v drugem brskalniku
+emailLinkIdp5=za nadaljevanje.
+backToLogin=&laquo; Back to Login
+emailInstruction=Vnesite svoje uporabniško ime ali e-poštni naslov in poslali vam bomo navodila za ustvarjanje novega gesla.
+emailInstructionUsername=Vnesite svoje uporabniško ime in poslali vam bomo navodila za ustvarjanje novega gesla.
+copyCodeInstruction=Prosimo, kopirajte to kodo in jo prilepite v svojo aplikacijo:
+pageExpiredTitle=Stran je potekla
+pageExpiredMsg1=Za ponovni zagon postopka prijave
+pageExpiredMsg2=Za nadaljevanje postopka prijave
+personalInfo=Osebni podatki:
+role_admin=Administrator
+role_realm-admin=Administrator področja
+role_create-realm=Ustvari področje
+role_create-client=Ustvari odjemalca
+role_view-realm=Preglej področje
+role_view-users=Preglej uporabnike
+role_view-applications=View applications
+role_view-clients=Preglej odjemalce
+role_view-events=Preglej dogodke
+role_view-identity-providers=Preglej ponudnike identitete
+role_manage-realm=Upravljaj področje
+role_manage-users=Upravljaj uporabnike
+role_manage-applications=Manage applications
+role_manage-identity-providers=Upravljaj ponudnike identitete
+role_manage-clients=Upravljaj odjemalce
+role_manage-events=Upravljaj dogodke
+role_view-profile=Preglej profil
+role_manage-account=Upravljaj račun
+role_manage-account-links=Upravljaj povezave računa
+role_read-token=Preberi žeton
+role_offline-access=Dostop brez povezave
+client_account=Račun
+client_account-console=Konzola računa
+client_security-admin-console=Varnostna administratorska konzola
+client_admin-cli=Admin CLI
+client_realm-management=Upravljanje področja
+client_broker=Posrednik
+requiredFields=Required fields
+invalidUserMessage=Neveljavno uporabniško ime ali geslo.
+invalidUsernameMessage=Neveljavno uporabniško ime.
+invalidUsernameOrEmailMessage=Neveljavno uporabniško ime ali e-poštni naslov.
+invalidPasswordMessage=Neveljavno geslo.
+invalidEmailMessage=Neveljaven e-poštni naslov.
+accountDisabledMessage=Račun je onemogočen, obrnite se na administratorja.
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+accountTemporarilyDisabledMessage=Neveljavno uporabniško ime ali geslo.
+accountPermanentlyDisabledMessage=Neveljavno uporabniško ime ali geslo.
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
+accountTemporarilyDisabledMessageTotp=Neveljavna koda avtentikatorja.
+accountPermanentlyDisabledMessageTotp=Neveljavna koda avtentikatorja.
+expiredCodeMessage=Prijava je potekla. Prosimo, prijavite se ponovno.
+expiredActionMessage=Dejanje je poteklo. Prosimo, nadaljujte s prijavo.
+expiredActionTokenNoSessionMessage=Dejanje je poteklo.
+expiredActionTokenSessionExistsMessage=Dejanje je poteklo. Prosimo, začnite znova.
+sessionLimitExceeded=Preveliko število sej
+identityProviderLogoutFailure=SAML IdP napaka pri odjavi
+missingFirstNameMessage=Prosimo, vnesite ime.
+missingLastNameMessage=Prosimo, vnesite priimek.
+missingEmailMessage=Prosimo, vnesite e-poštni naslov.
+missingUsernameMessage=Prosimo, vnesite uporabniško ime.
+missingPasswordMessage=Prosimo, vnesite geslo.
+missingTotpMessage=Prosimo, vnesite kodo avtentikatorja.
+missingTotpDeviceNameMessage=Prosimo, vnesite ime naprave.
+notMatchPasswordMessage=Gesli se ne ujemata.
+error-invalid-value=Neveljavna vrednost.
+error-invalid-blank=Prosimo, določite vrednost.
+error-empty=Prosimo, določite vrednost.
+error-invalid-length=Dolžina mora biti med {1} in {2}.
+error-invalid-length-too-short=Najmanjša dolžina je {1}.
+error-invalid-length-too-long=Največja dolžina je {2}.
+error-invalid-email=Neveljaven e-poštni naslov.
+error-invalid-number=Neveljavno število.
+error-number-out-of-range=Število mora biti med {1} in {2}.
+error-number-out-of-range-too-small=Število mora imeti najmanjšo vrednost {1}.
+error-number-out-of-range-too-big=Število mora imeti največjo vrednost {2}.
+error-pattern-no-match=Neveljavna vrednost.
+error-invalid-uri=Neveljaven URL.
+error-invalid-uri-scheme=Neveljavna URL shema.
+error-invalid-uri-fragment=Neveljaven URL fragment.
+error-user-attribute-required=Prosimo, izpolnite to polje.
+error-invalid-date=Neveljaven datum.
+error-user-attribute-read-only=To polje je samo za branje.
+error-username-invalid-character=Vrednost vsebuje neveljaven znak.
+error-person-name-invalid-character=Vrednost vsebuje neveljaven znak.
+error-reset-otp-missing-id=Prosimo, izberite OTP konfiguracijo.
+invalidPasswordExistingMessage=Neveljavno obstoječe geslo.
+invalidPasswordBlacklistedMessage=Neveljavno geslo: geslo je na črni listi.
+invalidPasswordConfirmMessage=Potrditev gesla se ne ujema.
+invalidTotpMessage=Neveljavna koda avtentikatorja.
+usernameExistsMessage=Uporabniško ime že obstaja.
+emailExistsMessage=E-poštni naslov že obstaja.
+federatedIdentityExistsMessage=Uporabnik s {0} {1} že obstaja. Prosimo, prijavite se v upravitelja računa za povezavo računa.
+federatedIdentityUnavailableMessage=Uporabnik {0}, avtenticiran s ponudnikom identitete {1}, ne obstaja. Prosimo, kontaktirajte administratorja.
+federatedIdentityUnmatchedEssentialClaimMessage=ID žeton, ki ga je izdal ponudnik identitete, se ne ujema z bistvenim konfiguriranim zahtevkom. Prosimo, obrnite se na administratorja.
+confirmLinkIdpTitle=Račun že obstaja
+confirmOverrideIdpTitle=Povezava posrednika že obstaja
+federatedIdentityConfirmLinkMessage=Uporabnik s {0} {1} že obstaja. Kako želite nadaljevati?
+federatedIdentityConfirmOverrideMessage=Poskušate povezati svoj račun {0} z računom {1} {2}. Vendar je vaš račun že povezan z drugim računom {3} {4}. Ali želite zamenjati obstoječo povezavo z novim računom?
+federatedIdentityConfirmReauthenticateMessage=Avtenticirajte se za povezavo vašega računa z {0}
+nestedFirstBrokerFlowMessage=Uporabnik {0} {1} ni povezan z nobenim znanim uporabnikom.
+confirmLinkIdpReviewProfile=Preglej profil
+confirmLinkIdpContinue=Dodaj k obstoječemu računu
+confirmOverrideIdpContinue=Da, zamenjaj povezavo s trenutnim računom
+configureTotpMessage=Za aktivacijo vašega računa morate nastaviti mobilni avtentikator.
+configureBackupCodesMessage=You need to set up Backup Codes to activate your account.
+updateProfileMessage=Za aktivacijo vašega računa morate posodobiti svoj uporabniški profil.
+updatePasswordMessage=Za aktivacijo vašega računa morate spremeniti svoje geslo.
+updateEmailMessage=Za aktivacijo vašega računa morate posodobiti svoj e-poštni naslov.
+resetPasswordMessage=Spremeniti morate svoje geslo.
+verifyEmailMessage=Za aktivacijo vašega računa morate potrditi svoj e-poštni naslov.
+linkIdpMessage=Za povezavo vašega računa z {0} morate potrditi svoj e-poštni naslov.
+emailSentMessage=Kmalu boste prejeli e-pošto z nadaljnjimi navodili.
+emailSendErrorMessage=Pošiljanje e-pošte ni uspelo, poskusite kasneje.
+accountUpdatedMessage=Vaš račun je bil posodobljen.
+accountPasswordUpdatedMessage=Vaše geslo je bilo posodobljeno.
+delegationCompleteHeader=Prijava uspešna
+delegationCompleteMessage=To okno brskalnika lahko zaprete in se vrnete v aplikacijo konzole.
+delegationFailedHeader=Prijava ni uspela
+delegationFailedMessage=To okno brskalnika lahko zaprete in se vrnete v aplikacijo konzole ter poskusite znova.
+noAccessMessage=Ni dostopa
+invalidPasswordMinLengthMessage=Neveljavno geslo: minimalna dolžina {0}.
+invalidPasswordMaxLengthMessage=Neveljavno geslo: presega največje dovoljeno dolžino {0}.
+invalidPasswordMinDigitsMessage=Neveljavno geslo: mora vsebovati vsaj {0} številk.
+invalidPasswordMinLowerCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} malih črk.
+invalidPasswordMinUpperCaseCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} velikih črk.
+invalidPasswordMinSpecialCharsMessage=Neveljavno geslo: mora vsebovati vsaj {0} posebnih znakov.
+invalidPasswordNotUsernameMessage=Neveljavno geslo: ne sme biti enako uporabniškemu imenu.
+invalidPasswordNotContainsUsernameMessage=Neveljavno geslo: ne sme vsebovati uporabniškega imena.
+invalidPasswordNotEmailMessage=Neveljavno geslo: ne sme biti enako e-poštnemu naslovu.
+invalidPasswordRegexPatternMessage=Neveljavno geslo: se ne ujema z zahtevanim vzorcem.
+invalidPasswordHistoryMessage=Neveljavno geslo: ne sme biti enako kateremu od zadnjih {0} gesel.
+invalidPasswordGenericMessage=Neveljavno geslo: novo geslo ne ustreza pravilom gesla.
+failedToProcessResponseMessage=Ni bilo mogoče obdelati odgovora
+httpsRequiredMessage=Zahtevan je HTTPS
+realmNotEnabledMessage=Področje ni omogočeno
+invalidRequestMessage=Neveljavna zahteva
+successLogout=Odjavljeni ste
+failedLogout=Odjava ni uspela
+unknownLoginRequesterMessage=Neznan zahtevatelj prijave
+loginRequesterNotEnabledMessage=Zahtevatelj prijave ni omogočen
+bearerOnlyMessage=Aplikacije bearer-only ne smejo sprožiti prijave v brskalniku
+standardFlowDisabledMessage=Odjemalcu ni dovoljeno sprožiti prijave v brskalniku z danim odzivnim tipom. Standardni tok je onemogočen za odjemalca.
+implicitFlowDisabledMessage=Odjemalcu ni dovoljeno sprožiti prijave v brskalniku z danim odzivnim tipom. Implicitni tok je onemogočen za odjemalca.
+invalidRedirectUriMessage=Neveljaven URI preusmeritve
+unsupportedNameIdFormatMessage=Nepodprt NameIDFormat
+invalidRequesterMessage=Neveljaven zahtevatelj
+registrationNotAllowedMessage=Registracija ni dovoljena
+resetCredentialNotAllowedMessage=Ponastavitev poverilnice ni dovoljena
+permissionNotApprovedMessage=Dovoljenje ni odobreno.
+noRelayStateInResponseMessage=Ni stanja releja v odzivu od ponudnika identitete.
+insufficientPermissionMessage=Nezadostna dovoljenja za povezovanje identitet.
+couldNotProceedWithAuthenticationRequestMessage=Ni bilo mogoče nadaljevati z zahtevo za avtentikacijo do ponudnika identitete.
+couldNotObtainTokenMessage=Ni bilo mogoče pridobiti žetona od ponudnika identitete.
+unexpectedErrorRetrievingTokenMessage=Nepričakovana napaka pri pridobivanju žetona od ponudnika identitete.
+unexpectedErrorHandlingResponseMessage=Nepričakovana napaka pri obdelavi odziva od ponudnika identitete.
+identityProviderAuthenticationFailedMessage=Avtentikacija ni uspela. Ni bilo mogoče avtenticirati s ponudnikom identitete.
+couldNotSendAuthenticationRequestMessage=Ni bilo mogoče poslati zahteve za avtentikacijo do ponudnika identitete.
+unexpectedErrorHandlingRequestMessage=Nepričakovana napaka pri obdelavi zahteve za avtentikacijo do ponudnika identitete.
+invalidAccessCodeMessage=Neveljavna dostopna koda.
+sessionNotActiveMessage=Seja ni aktivna.
+invalidCodeMessage=Prišlo je do napake, prosimo, prijavite se ponovno preko vaše aplikacije.
+cookieNotFoundMessage=Piškotek ni bil najden. Prepričajte se, da imate v brskalniku omogočene piškotke.
+insufficientLevelOfAuthentication=Zahtevana raven avtentikacije ni bila dosežena.
+identityProviderUnexpectedErrorMessage=Nepričakovana napaka pri avtentikaciji s ponudnikom identitete
+identityProviderMissingStateMessage=Manjkajoč state parameter v odzivu od ponudnika identitete.
+identityProviderMissingCodeOrErrorMessage=Manjkajoč parameter code ali error v odzivu od ponudnika identitete.
+identityProviderInvalidResponseMessage=Neveljaven odziv od ponudnika identitete.
+identityProviderInvalidSignatureMessage=Neveljaven podpis v odzivu od ponudnika identitete.
+identityProviderNotFoundMessage=Ponudnik identitete s tem identifikatorjem ni bil najden.
+identityProviderLinkSuccess=Uspešno ste potrdili svoj e-poštni naslov. Prosimo, vrnite se v svoj izvirni brskalnik in nadaljujte s prijavo.
+staleCodeMessage=Ta stran ni več veljavna, prosimo, vrnite se v vašo aplikacijo in se prijavite ponovno
+realmSupportsNoCredentialsMessage=Področje ne podpira nobene vrste poverilnic.
+credentialSetupRequired=Prijava ni mogoča, zahtevana je nastavitev poverilnic.
+identityProviderNotUniqueMessage=Področje podpira več ponudnikov identitete. Ni bilo mogoče določiti, s katerim ponudnikom identitete bi se morala izvesti avtentikacija.
+emailVerifiedMessage=Vaš e-poštni naslov je bil potrjen.
+emailVerifiedAlreadyMessage=Vaš e-poštni naslov je že bil potrjen.
+staleEmailVerificationLink=Povezava, ki ste jo kliknili, je zastarela in ni več veljavna. Morda ste že potrdili svoj e-poštni naslov?
+identityProviderAlreadyLinkedMessage=Federirana identiteta, ki jo je vrnil {0}, je že povezana z drugim uporabnikom.
+confirmAccountLinking=Potrdite povezavo računa {0} ponudnika identitete {1} z vašim računom.
+confirmEmailAddressVerification=Potrdite veljavnost e-poštnega naslova {0}.
+confirmExecutionOfActions=Izvedite naslednja dejanja
+backToApplication=&laquo; Nazaj na aplikacijo
+missingParameterMessage=Manjkajoči parametri: {0}
+clientNotFoundMessage=Odjemalec ni najden.
+clientDisabledMessage=Odjemalec je onemogočen.
+invalidParameterMessage=Neveljaven parameter: {0}
+alreadyLoggedIn=Že ste prijavljeni.
+differentUserAuthenticated=V tej seji ste že avtenticirani kot drug uporabnik ''{0}''. Prosimo, najprej se odjavite.
+brokerLinkingSessionExpired=Zahtevana je povezava posredniškega računa, vendar trenutna seja ni več veljavna.
+proceedWithAction=&raquo; Kliknite tukaj za nadaljevanje
+acrNotFulfilled=Zahteve avtentikacije niso izpolnjene
+requiredAction.CONFIGURE_TOTP=Konfiguriraj OTP
+requiredAction.TERMS_AND_CONDITIONS=Pogoji in določila
+requiredAction.UPDATE_PASSWORD=Posodobi geslo
+requiredAction.UPDATE_PROFILE=Posodobi profil
+requiredAction.VERIFY_EMAIL=Potrdi e-poštni naslov
+requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=Generiraj kode za obnovitev
+requiredAction.webauthn-register-passwordless=Webauthn registracija brez gesla
+requiredAction.webauthn-register=Webauthn Register
+invalidTokenRequiredActions=Zahtevana dejanja v povezavi niso veljavna
+doX509Login=Prijavljeni boste kot:
+clientCertificate=X509 certifikat odjemalca:
+noCertificate=[Brez certifikata]
+pageNotFound=Stran ni bila najdena
+internalServerError=Prišlo je do notranje napake strežnika
+console-username=Uporabniško ime:
+console-password=Geslo:
+console-otp=Enkratno geslo:
+console-new-password=Novo geslo:
+console-confirm-password=Potrdite geslo:
+console-update-password=Zahtevana je posodobitev vašega gesla.
+console-verify-email=Potrditi morate svoj e-poštni naslov. Poslali smo e-pošto na naslov {0}, ki vsebuje potrditveno kodo. Prosimo, vnesite to kodo v spodnje polje.
+console-email-code=E-poštna koda:
+console-accept-terms=Sprejemate pogoje? [y/n]:
+console-accept=y
+
+# Openshift messages
+openshift.scope.user_info=Podatki o uporabniku
+openshift.scope.user_check-access=Podatki o uporabniškem dostopu
+openshift.scope.user_full=Poln dostop
+openshift.scope.list-projects=Seznam projektov
+
+# SAML authentication
+saml.post-form.title=Preusmeritev avtentikacije
+saml.post-form.message=Preusmerjanje, prosimo počakajte.
+saml.post-form.js-disabled=JavaScript je onemogočen. Močno priporočamo, da ga omogočite. Kliknite spodnji gumb za nadaljevanje.
+saml.artifactResolutionServiceInvalidResponse=Ni mogoče razrešiti artefakta.
+
+#authenticators
+otp-display-name=Aplikacija za avtentikacijo
+otp-help-text=Vnesite potrditveno kodo iz aplikacije za avtentikacijo.
+otp-reset-description=Katero OTP konfiguracijo želite odstraniti?
+password-display-name=Geslo
+password-help-text=Prijavite se z vnosom gesla.
+auth-username-form-display-name=Uporabniško ime
+auth-username-form-help-text=Začnite prijavo z vnosom uporabniškega imena
+auth-username-password-form-display-name=Uporabniško ime in geslo
+auth-username-password-form-help-text=Prijavite se z vnosom uporabniškega imena in gesla.
+auth-x509-client-username-form-display-name=X509 certifikat
+auth-x509-client-username-form-help-text=Prijavite se z odjemalskim certifikatom X509.
+
+# Recovery Codes
+auth-recovery-authn-code-form-display-name=Obnovitvena avtentikacijska koda
+auth-recovery-authn-code-form-help-text=Vnesite obnovitveno avtentikacijsko kodo iz predhodno ustvarjenega seznama.
+auth-recovery-code-info-message=Vnesite določeno obnovitveno kodo.
+auth-recovery-code-prompt=Obnovitvena koda #{0}
+auth-recovery-code-header=Prijava z obnovitveno avtentikacijsko kodo
+recovery-codes-error-invalid=Neveljavna obnovitvena avtentikacijska koda
+recovery-code-config-header=Obnovitvene avtentikacijske kode
+recovery-code-config-warning-title=Te obnovitvene kode ne bodo več prikazane po zapustitvi te strani
+recovery-code-config-warning-message=Poskrbite, da jih natisnete, prenesete ali kopirate v upravitelja gesel in jih varno shranite. Preklic te nastavitve bo odstranil te obnovitvene kode iz vašega računa.
+recovery-codes-print=Natisni
+recovery-codes-download=Prenesi
+recovery-codes-copy=Kopiraj
+recovery-codes-copied=Kopirano
+recovery-codes-confirmation-message=Te kode sem shranil/a na varno mesto
+recovery-codes-action-complete=Zaključi nastavitev
+recovery-codes-action-cancel=Prekliči nastavitev
+recovery-codes-download-file-header=Shranite te obnovitvene kode na varno mesto.
+recovery-codes-download-file-description=Obnovitvene kode so enkratna gesla, ki vam omogočajo prijavo v vaš račun, če nimate dostopa do svojega avtentikatorja.
+recovery-codes-download-file-date=Te kode so bile ustvarjene
+recovery-codes-label-default=Obnovitvene kode
+
+# WebAuthn
+webauthn-display-name=Ključ za dostop
+webauthn-help-text=Uporabite svoj ključ za dostop za prijavo.
+webauthn-passwordless-display-name=Ključ za dostop
+webauthn-passwordless-help-text=Uporabite svoj ključ za dostop za prijavo brez gesla.
+webauthn-login-title=Prijava s ključem za dostop
+webauthn-registration-title=Registracija ključa za dostop
+webauthn-available-authenticators=Razpoložljivi ključi za dostop
+webauthn-unsupported-browser-text=WebAuthn ni podprt v tem brskalniku. Poskusite z drugim ali se obrnite na administratorja.
+webauthn-doAuthenticate=Prijava s ključem za dostop
+webauthn-createdAt-label=Ustvarjeno
+webauthn-registration-init-label=Ključ za dostop (Privzeta oznaka)
+webauthn-registration-init-label-prompt=Prosimo, vnesite oznako za vaš registriran ključ za dostop
+
+# WebAuthn Error
+webauthn-error-title=Napaka ključa za dostop
+webauthn-error-registration=Registracija vašega ključa za dostop ni uspela.<br /> {0}
+webauthn-error-api-get=Avtentikacija s ključem za dostop ni uspela.<br /> {0}
+webauthn-error-different-user=Prvi avtenticirani uporabnik ni enak uporabniku, avtenticiranemu s ključem za dostop.
+webauthn-error-auth-verification=Rezultat avtentikacije s ključem za dostop ni veljaven.<br /> {0}
+webauthn-error-register-verification=Rezultat registracije ključa za dostop ni veljaven.<br /> {0}
+webauthn-error-user-not-found=Neznan uporabnik, avtenticiran s ključem za dostop.
+
+# Passkey
+passkey-login-title=Prijava s ključem za dostop
+passkey-available-authenticators=Razpoložljivi ključi za dostop
+passkey-unsupported-browser-text=Ključ za dostop ni podprt v tem brskalniku. Poskusite z drugim ali se obrnite na administratorja.
+passkey-doAuthenticate=Prijava s ključem za dostop
+passkey-createdAt-label=Ustvarjeno
+passkey-autofill-select=Izberite svoj ključ za dostop
+
+# Identity provider
+identity-provider-redirector=Poveži se z drugim ponudnikom identitete
+identity-provider-login-label=Ali se prijavite z
+idp-email-verification-display-name=Potrditev e-poštnega naslova
+idp-email-verification-help-text=Poveži vaš račun z overitvijo e-poštnega naslova.
+idp-username-password-form-display-name=Uporabniško ime in geslo
+idp-username-password-form-help-text=Poveži vaš račun z vnosom uporabniškega imena in gesla.
+finalDeletionConfirmation=Če izbrišete vaš račun, ga ne boste mogli obnoviti. Če želite obdržati vaš račun, pritisnite Prekliči.
+irreversibleAction=To dejanje je nepreklicno
+deleteAccountConfirm=Potrditev izbrisa računa
+deletingImplies=Izbris vašega računa pomeni:
+errasingData=Izbris vseh vaših podatkov
+loggingOutImmediately=Takojšnja odjava
+accountUnusable=Nadaljnja uporaba aplikacije s tem računom ne bo več mogoča
+userDeletedSuccessfully=Uporabnik je bil uspešno izbrisan
+access-denied=Dostop zavrnjen
+access-denied-when-idp-auth=Dostop zavrnjen pri avtentikaciji s {0}
+frontchannel-logout.title=Odjavljanje
+frontchannel-logout.message=Odjavljate se iz naslednjih aplikacij
+logoutConfirmTitle=Odjavljanje
+logoutConfirmHeader=Ali se želite odjaviti?
+doLogout=Odjava
+readOnlyUsernameMessage=Ne morete posodobiti svojega uporabniškega imena, ker je samo za branje.
+error-invalid-multivalued-size=Atribut {0} mora imeti najmanj {1} in največ {2} vrednosti.
+organization.confirm-membership.title=Pridružili se boste organizaciji ${kc.org.name}
+organization.confirm-membership=S klikom na spodnjo povezavo boste postali član organizacije {0}:
+organization.member.register.title=Ustvarite račun za pridružitev organizaciji ${kc.org.name}
+organization.select=Izberite organizacijo za nadaljevanje:
+notMemberOfOrganization=Uporabnik ni član organizacije {0}
+notMemberOfAnyOrganization=Uporabnik ni član nobene organizacije
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_sv.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_sv.properties
index bbc738a05b3d..6ee02379afa0 100755
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_sv.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_sv.properties
@@ -65,7 +65,7 @@ country=Land
 emailVerified=E-post verifierad
 gssDelegationCredential=GSS Delegation Credential
 
-loginTotpStep1=Installera <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> eller Google Authenticator på din mobil. Båda applikationerna finns tillgängliga hos <a href="https://play.google.com">Google Play</a> och Apple App Store.
+loginTotpStep1=Installera en av följande applikationer på din mobil:
 loginTotpStep2=Öppna applikationen och skanna streckkoden eller skriv i nyckeln
 loginTotpStep3=Fyll i engångskoden som tillhandahålls av applikationen och klicka på Spara för att avsluta inställningarna
 loginOtpOneTime=Engångskod
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_th.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_th.properties
index ee2165a462be..5b0fb6cfb3ad 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_th.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_th.properties
@@ -459,11 +459,11 @@ webauthn-createdAt-label=สร้างแล้ว
 
 # WebAuthn Error
 webauthn-error-title=ข้อผิดพลาดของคีย์รักษาความปลอดภัย
-webauthn-error-registration=การลงทะเบียนคีย์รักษาความปลอดภัยของคุณไม่สำเร็จ<br/> {0}
-webauthn-error-api-get=การพิสูจน์ตัวจริงโดยใช้คีย์รักษาความปลอดภัยไม่สำเร็จ<br/> {0}
+webauthn-error-registration=การลงทะเบียนคีย์รักษาความปลอดภัยของคุณไม่สำเร็จ<br /> {0}
+webauthn-error-api-get=การพิสูจน์ตัวจริงโดยใช้คีย์รักษาความปลอดภัยไม่สำเร็จ<br /> {0}
 webauthn-error-different-user=ผู้ใช้งานที่พิสูจน์ตัวจริงรายแรกไม่ใช่รายที่ได้รับการพิสูจน์ตัวจริงจากคีย์รักษาความปลอดภัย
-webauthn-error-auth-verification=ผลการพิสูจน์ตัวจริงของคีย์รักษาความปลอดภัยไม่ถูกต้อง<br/> {0}
-webauthn-error-register-verification=ผลการลงทะเบียนของคีย์รักษาความปลอดภัยไม่ถูกต้อง<br/> {0}
+webauthn-error-auth-verification=ผลการพิสูจน์ตัวจริงของคีย์รักษาความปลอดภัยไม่ถูกต้อง<br /> {0}
+webauthn-error-register-verification=ผลการลงทะเบียนของคีย์รักษาความปลอดภัยไม่ถูกต้อง<br /> {0}
 webauthn-error-user-not-found=ผู้ใช้งานที่ไม่รู้จักได้รับการพิสูจน์ตัวจริงจากคีย์รักษาความปลอดภัย
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_tr.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_tr.properties
index 164e965b167e..a32b761a871e 100755
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_tr.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_tr.properties
@@ -247,24 +247,6 @@ notMatchPasswordMessage=Şifreler eşleşmiyor.
 error-invalid-value=Geçersiz değer.
 error-invalid-blank=Lütfen bir değer sağlayın.
 error-empty=Lütfen bir değer sağlayın.
-error-invalid-length=Uzunluk {1} ile {2} arasında olmalıdır.
-error-invalid-length-too-short=Minimum uzunluk {1}.
-error-invalid-length-too-long=Maksimum uzunluk {2}.
-error-invalid-email=Geçersiz e-posta adresi.
-error-invalid-number=Geçersiz numara.
-error-number-out-of-range=Numara {1} ile {2} arasında olmalıdır.
-error-number-out-of-range-too-small=Numara en az {1} değerinde olmalıdır.
-error-number-out-of-range-too-big=Numara en fazla {2} değerinde olmalıdır.
-error-pattern-no-match=Geçersiz değer.
-error-invalid-uri=Geçersiz URL.
-error-invalid-uri-scheme=Geçersiz URL şeması.
-error-invalid-uri-fragment=Geçersiz URL parçası.
-error-user-attribute-required=Bu alanı belirtiniz.
-error-invalid-date=Geçersiz tarih.
-error-user-attribute-read-only=Bu alan sadece okunabilir.
-error-username-invalid-character=Değer geçersiz karakter içeriyor.
-error-person-name-invalid-character=Değer geçersiz karakter içeriyor.
-error-reset-otp-missing-id=Lütfen bir OTP yapılandırması seçin.
 
 invalidPasswordExistingMessage=Mevcut şifre geçersiz.
 invalidPasswordBlacklistedMessage=Geçersiz şifre: şifre kara listeye alındı.
@@ -484,11 +466,11 @@ webauthn-unsupported-browser-text= WebAuthn tarayıcınız tarafından desteklen
 webauthn-doAuthenticate= Geçiş Anahtarı ile giriş yap,
 webauthn-createdAt-label= Oluşturuldu,
 webauthn-error-title= Geçiş Anahtarı hatası,
-webauthn-error-registration= Geçiş Anahatarınızı kaydederken hata oluştu.<br/> {0},
-webauthn-error-api-get= Geçiş Anahtarınızı doğrularken hata oluştu.<br/> {0},
+webauthn-error-registration= Geçiş Anahatarınızı kaydederken hata oluştu.<br /> {0},
+webauthn-error-api-get= Geçiş Anahtarınızı doğrularken hata oluştu.<br /> {0},
 webauthn-error-different-user= İlk doprulanan kullanıcı ile Geçiş Anahtarı işe doğrulanan kullanıcı aynı değil..,
-webauthn-error-auth-verification= Geçiş Anahtarı doğrulaması geçersiz.<br/> {0},
-webauthn-error-register-verification= Geçiş Anahtarı doğrulaması geçersiz.<br/> {0},
+webauthn-error-auth-verification= Geçiş Anahtarı doğrulaması geçersiz.<br /> {0},
+webauthn-error-register-verification= Geçiş Anahtarı doğrulaması geçersiz.<br /> {0},
 webauthn-error-user-not-found= Bilinmeyen kullanıcı Geçiş Anahtarı ile doğrulandı.,
 identity-provider-redirector= Başka bir Kimlik Sağlayıcı ile iletişime geçiniz.,
 identity-provider-login-label= Veya giriş yap,
@@ -511,7 +493,6 @@ frontchannel-logout.message= Aşağıdaki uygulamalardan oturumunuzu kapatıyors
 logoutConfirmTitle= Oturum kapatılıyor,
 logoutConfirmHeader= Oturumunuzu kapatmak istiyor musunuz?,
 doLogout= Oturumu kapat,
-readOnlyUsernameMessage= Kullanıcı adınızı güncelleyemezsiniz çünkü sadece okunabilir durumda.,
 error-invalid-multivalued-size= {0} özniteliği en az {1} ve en fazla {2} değer(ler)e sahip olmalıdır.,
 shouldBeEqual= {0} {1} ile eşit olmalıdır,
 shouldBeDifferent= {0} {1} ile farklı olmalıdır,
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_uk.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_uk.properties
index 057f9c9d5b0c..65882861db7d 100755
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_uk.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_uk.properties
@@ -456,11 +456,11 @@ webauthn-createdAt-label=Створено
 
 # WebAuthn Error
 webauthn-error-title=Помилка ключа безпеки
-webauthn-error-registration=Не вдалося зареєструвати ваш ключ безпеки.<br/> {0}
-webauthn-error-api-get=Помилка автентифікації за допомогою ключа безпеки.<br/> {0}
+webauthn-error-registration=Не вдалося зареєструвати ваш ключ безпеки.<br /> {0}
+webauthn-error-api-get=Помилка автентифікації за допомогою ключа безпеки.<br /> {0}
 webauthn-error-different-user=Перший автентифікований користувач не є тим, хто автентифікований ключем безпеки.
-webauthn-error-auth-verification=Результат автентифікації ключа безпеки невірний.<br/> {0}
-webauthn-error-register-verification=Результат реєстрації ключа безпеки невірний.<br/> {0}
+webauthn-error-auth-verification=Результат автентифікації ключа безпеки невірний.<br /> {0}
+webauthn-error-register-verification=Результат реєстрації ключа безпеки невірний.<br /> {0}
 webauthn-error-user-not-found=Невідомий користувач автентифікований за допомогою ключа безпеки.
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_zh_CN.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_zh_CN.properties
index d11363bce460..413eab3b4316 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_zh_CN.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_zh_CN.properties
@@ -463,11 +463,11 @@ webauthn-createdAt-label=创建于
 
 # WebAuthn Error
 webauthn-error-title=安全密钥错误
-webauthn-error-registration=注册您的安全密钥失败。<br/> {0}
-webauthn-error-api-get=通过安全密钥进行身份验证失败。<br/> {0}
+webauthn-error-registration=注册您的安全密钥失败。<br /> {0}
+webauthn-error-api-get=通过安全密钥进行身份验证失败。<br /> {0}
 webauthn-error-different-user=首次经过身份验证的用户不是通过安全密钥经过身份验证的用户。
-webauthn-error-auth-verification=安全密钥身份验证结果无效。<br/> {0}
-webauthn-error-register-verification=安全密钥注册结果无效。<br/> {0}
+webauthn-error-auth-verification=安全密钥身份验证结果无效。<br /> {0}
+webauthn-error-register-verification=安全密钥注册结果无效。<br /> {0}
 webauthn-error-user-not-found=通过安全密钥进行身份验证的用户未知。
 
 # Identity provider
diff --git a/themes/src/main/resources-community/theme/base/login/messages/messages_zh_TW.properties b/themes/src/main/resources-community/theme/base/login/messages/messages_zh_TW.properties
index df7781184b7b..95002caebcb8 100644
--- a/themes/src/main/resources-community/theme/base/login/messages/messages_zh_TW.properties
+++ b/themes/src/main/resources-community/theme/base/login/messages/messages_zh_TW.properties
@@ -1,7 +1,6 @@
-# encoding: utf-8
 doLogIn=登入
 doRegister=註冊
-doRegisterSecurityKey=註冊安全性金鑰
+doRegisterSecurityKey=註冊安全金鑰
 doCancel=取消
 doSubmit=送出
 doBack=返回
@@ -34,8 +33,9 @@ unknownUser=未知使用者
 loginTotpTitle= 設定 OTP 驗證器
 loginProfileTitle=更新帳號資訊
 loginIdpReviewProfileTitle=更新帳號資訊
-loginTimeout=登入逾時，請重新登入。
+loginTimeout=登入超時，請重新登入。
 reauthenticate=重新登入以繼續
+authenticateStrong=需要身份驗證以繼續
 oauthGrantTitle=授予權限給 {0}
 oauthGrantTitleHtml={0}
 oauthGrantInformation=請確認您信任 {0}，並且了解 {0} 如何處理您的資料。
@@ -43,7 +43,7 @@ oauthGrantReview=您可以檢視
 oauthGrantTos=服務條款
 oauthGrantPolicy=隱私權政策
 errorTitle=出錯啦！
-errorTitleHtml=我們<strong>很抱歉</strong> ...
+errorTitleHtml=<strong>非常抱歉</strong> ...
 emailVerifyTitle=驗證電子信箱
 emailForgotTitle=忘記密碼？
 updateEmailTitle=更新電子信箱
@@ -68,14 +68,20 @@ internal=內部
 unknown=未知
 
 termsTitle=服務條款
-termsText=<p>尚未被定義的服務條款</p>
-termsPlainText=尚未被定義的服務條款。
-termsAcceptanceRequired=您必續同意我們的服務條款。
+termsText=<p>還沒有定義服務條款</p>
+termsPlainText=還沒有定義服務條款。
+termsAcceptanceRequired=您必須同意我們的服務條款。
 acceptTerms=我同意服務條款
 
+deleteCredentialTitle=刪除 {0}
+deleteCredentialMessage=你確定要刪除 {0}？
+
+linkIdpActionTitle=連結到 {0}
+linkIdpActionMessage=你確定要將 {0} 連結到你的帳號？
+
 recaptchaFailed=無效的 Recaptcha 驗證碼
 recaptchaNotConfigured=Recaptcha 尚未設定
-consentDenied=許可被拒。
+consentDenied=拒絕授權。
 
 noAccount=新的使用者？
 username=使用者名稱
@@ -108,7 +114,7 @@ gender=性別
 birthday=出生日期
 zoneinfo=時區
 gssDelegationCredential=GSS Delegation Credential
-logoutOtherSessions=從其他裝置登出
+logoutOtherSessions=登出其他裝置
 
 profileScopeConsentText=使用者資訊
 emailScopeConsentText=電子信箱
@@ -165,6 +171,9 @@ oauth2DeviceAuthorizationGrantDisabledMessage=客戶端不允許發起授權 OAu
 emailVerifyInstruction1=一封含有驗證方式的信已經寄送到您的信箱 {0}
 emailVerifyInstruction2=還沒收到驗證碼？
 emailVerifyInstruction3=重新寄送驗證碼。
+emailVerifyInstruction4=為了驗證您的電子信箱，我們將寄送一封含有指示的電子郵件到 {0}。
+emailVerifyResend=重新寄送驗證信
+emailVerifySend=寄送驗證信
 
 emailLinkIdpTitle=連結到 {0}
 emailLinkIdp1=一封含有如何連結 {0} 到 {2} 的信件已寄送給您的 {1} 帳號。
@@ -175,8 +184,8 @@ emailLinkIdp5=繼續。
 
 backToLogin=&laquo; 回到登入畫面
 
-emailInstruction=輸入您的 使用者名稱 或 電子信箱 我們會寄送電子郵件並告知您如何產生新密碼。
-emailInstructionUsername=輸入您的使用者名稱，我們會寄送電子郵件並告知您如何產生新密碼。
+emailInstruction=輸入您的 使用者名稱 或 電子信箱，我們會寄送電子郵件告知您如何重設密碼。
+emailInstructionUsername=輸入您的使用者名稱，我們會寄送電子郵件告知您如何重設密碼。
 
 copyCodeInstruction=請複製以下密碼，並貼入您的應用程式：
 
@@ -221,15 +230,17 @@ invalidUsernameOrEmailMessage=無效的使用者名稱或電子信箱。
 invalidPasswordMessage=無效的密碼。
 invalidEmailMessage=無效的電子信箱。
 accountDisabledMessage=帳號已停用，請聯繫系統管理員。
+# These properties are deliberately the same as "invalidUsernameMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessage=無效的使用者名稱或密碼。
 accountPermanentlyDisabledMessage=無效的使用者名稱或密碼。
+# These properties are deliberately the same as "invalidTotpMessage", so by default, it is not possible to recognize the reason of failed authentication is temporarily disabled account
 accountTemporarilyDisabledMessageTotp=無效的驗證碼。
 accountPermanentlyDisabledMessageTotp=無效的驗證碼。
-expiredCodeMessage=登入逾時，請重新登入。
-expiredActionMessage=動作逾時，請繼續登入。
-expiredActionTokenNoSessionMessage=動作逾時。
-expiredActionTokenSessionExistsMessage=動作逾時，請重新開始。
-sessionLimitExceeded=您已開啟過多登入狀態
+expiredCodeMessage=登入超時，請重新登入。
+expiredActionMessage=動作超時，請繼續登入。
+expiredActionTokenNoSessionMessage=動作超時。
+expiredActionTokenSessionExistsMessage=動作超時，請重新開始。
+sessionLimitExceeded=您已登入過多裝置
 identityProviderLogoutFailure=SAML IdP 登出失敗
 
 missingFirstNameMessage=請提供名字。
@@ -276,11 +287,14 @@ federatedIdentityUnavailableMessage=在 {1} 身分提供者上驗證的使用者
 federatedIdentityUnmatchedEssentialClaimMessage=身分提供者所發出的 ID 令牌與設定的聲明不符。請聯絡您的管理員。
 
 confirmLinkIdpTitle=帳號已存在
+confirmOverrideIdpTitle=已有 Broker 連結
 federatedIdentityConfirmLinkMessage=使用者 {0} {1} 已存在。您要如何繼續？
+federatedIdentityConfirmOverrideMessage=您正在嘗試將您的帳號 {0} 與 {1} 帳號 {2} 連結，但您的帳號已經與不同的 {3} 帳號 {4} 連結。您確定要覆蓋現有的連結嗎？
 federatedIdentityConfirmReauthenticateMessage=請重新驗證您的帳號以連結 {0}。
 nestedFirstBrokerFlowMessage=使用者 {1} 未連結至 {0} 中的任何已知使用者。
 confirmLinkIdpReviewProfile=檢視個人資料
 confirmLinkIdpContinue=新增至現有帳號
+confirmOverrideIdpContinue=是的，覆蓋現有連結
 
 configureTotpMessage=您需要設定 OTP 驗證器來啟用您的帳號。
 configureBackupCodesMessage=您需要設定備份代碼來啟用您的帳號。
@@ -326,8 +340,8 @@ failedLogout=登出失敗
 unknownLoginRequesterMessage=未知的登入請求
 loginRequesterNotEnabledMessage=該登入請求尚未啟用
 bearerOnlyMessage=Bearer-only 的應用程式不允許啟用瀏覽器登入
-standardFlowDisabledMessage=客戶端不允許使用給定的 response_type 啟動瀏覽器登入。標準流程已被該客戶端禁用。
-implicitFlowDisabledMessage=客戶端不允許使用給定的 response_type 啟動瀏覽器登入。隱含流程已被該客戶端禁用。
+standardFlowDisabledMessage=應用程式不允許使用給定的 response_type 啟動瀏覽器登入。標準流程已被該應用程式禁用。
+implicitFlowDisabledMessage=應用程式不允許使用給定的 response_type 啟動瀏覽器登入。隱含流程已被該應用程式禁用。
 invalidRedirectUriMessage=無效的 uri 重導向
 unsupportedNameIdFormatMessage=尚未支援 NameIDFormat
 invalidRequesterMessage=無效的請求
@@ -347,7 +361,7 @@ unexpectedErrorHandlingRequestMessage=處理身份提供者的身份驗證請求
 invalidAccessCodeMessage=無效的存取代碼。
 sessionNotActiveMessage=登入已過期。
 invalidCodeMessage=出錯啦，請透過您的應用程式重新登入。
-cookieNotFoundMessage=找不到 Cookie。請確認您的瀏覽器已啟用 Cookie。
+cookieNotFoundMessage=找不到 Cookie。 Cookie 可能已過期、刪除、或者您的瀏覽器不允許使用 Cookie。請檢查 Cookie 設定並確保已啟用 Cookie。點擊上一頁並重新登入應用程式。
 insufficientLevelOfAuthentication=未滿足所要求的身份驗證層級。
 identityProviderUnexpectedErrorMessage=透過身份提供者進行身份驗證時發生非預期錯誤
 identityProviderMissingStateMessage=缺少身份提供者回應中的狀態參數。
@@ -358,23 +372,24 @@ identityProviderNotFoundMessage=找不到身分提供者。
 identityProviderLinkSuccess=您已成功驗證您的電子信箱。請回到瀏覽器分頁並繼續登入。
 staleCodeMessage=此頁面已過期，請回到您的應用程式並重新登入。
 realmSupportsNoCredentialsMessage=領域不支援任何憑證類型。
-credentialSetupRequired=無法登入，需要設定憑證。
+credentialSetupRequired=無法登入，需要設定登入憑證。
 identityProviderNotUniqueMessage=領域支援多個身份提供者。無法決定應該使用哪個身份提供者進行身份驗證。
 emailVerifiedMessage=您的電子信箱已通過驗證。
 emailVerifiedAlreadyMessage=您的電子信箱已經完成驗證。
 staleEmailVerificationLink=您點選的連結已過期，並且不再有效。也許您已驗證過您的電子信箱。
 identityProviderAlreadyLinkedMessage=身份提供者 {0} 傳回的聯盟身份已連結至另一個使用者。
 confirmAccountLinking=確認連結身份提供者 {1} 的帳戶 {0} 至您的帳戶。
+confirmAccountLinkingBody=如果您連結帳號，您將也能使用身分提供者 {1} 的帳號 {0} 來登入。如果這不是您所發起的操作，或您不希望連結帳號，請不要繼續操作。
 confirmEmailAddressVerification=確認電子信箱 {0} 的有效性。
 confirmExecutionOfActions=執行下列動作
 
 backToApplication=&laquo; 返回應用程式
-missingParameterMessage=遺失參數\: {0}
-clientNotFoundMessage=找不到客戶端。
-clientDisabledMessage=客戶端已禁用。
-invalidParameterMessage=無效參數\: {0}
+missingParameterMessage=缺少參數： {0}
+clientNotFoundMessage=找不到應用程式。
+clientDisabledMessage=應用程式已禁用。
+invalidParameterMessage=無效參數： {0}
 alreadyLoggedIn=您已經登入。
-differentUserAuthenticated=您已經以不同的使用者 ''{0}'' 登入。請先登出後再繼續。
+differentUserAuthenticated=您已經以不同的使用者「{0}」登入。請先登出後再繼續。
 brokerLinkingSessionExpired=請求代理人帳戶連結，但目前的工作階段已不再有效。
 proceedWithAction=&raquo; 點擊這裡繼續
 acrNotFulfilled=未滿足授權需求
@@ -385,12 +400,13 @@ requiredAction.UPDATE_PASSWORD=更新密碼
 requiredAction.UPDATE_PROFILE=更新個人資訊
 requiredAction.VERIFY_EMAIL=驗證電子信箱
 requiredAction.CONFIGURE_RECOVERY_AUTHN_CODES=產生復原代碼
-requiredAction.webauthn-register-passwordless=Webauthn 無密碼註冊
+requiredAction.webauthn-register-passwordless=Passkey 註冊
+requiredAction.webauthn-register=Webauthn Register
 
 invalidTokenRequiredActions=連結中包含無效行為
 
-doX509Login=您將以下列身分登入\:
-clientCertificate=X509 客戶端憑證\:
+doX509Login=您將以下列身分登入：
+clientCertificate=X509 客戶端憑證：
 noCertificate=[沒有憑證]
 
 
@@ -405,7 +421,7 @@ console-confirm-password=確認密碼：
 console-update-password=您需要更新您的密碼。
 console-verify-email=您需要驗證您的電子郵件。我們已經發送了一封包含驗證碼的電子郵件給 {0}。請將此碼輸入到下面的輸入框中。
 console-email-code=電子郵件驗證碼：
-console-accept-terms=接受服務條款？ [是/否]:
+console-accept-terms=接受服務條款？ [是/否]：
 console-accept=是
 
 # Openshift messages
@@ -430,6 +446,8 @@ auth-username-form-display-name=使用者名稱
 auth-username-form-help-text=輸入您的使用者名稱以登入。
 auth-username-password-form-display-name=使用者名稱和密碼
 auth-username-password-form-help-text=輸入您的使用者名稱和密碼以登入。
+auth-x509-client-username-form-display-name=X509 憑證
+auth-x509-client-username-form-help-text=使用 X509 客戶端憑證登入。
 
 # Recovery Codes
 auth-recovery-authn-code-form-display-name=恢復驗證碼
@@ -470,16 +488,24 @@ webauthn-registration-init-label-prompt=請為註冊的安全金鑰輸入標籤
 
 # WebAuthn Error
 webauthn-error-title=安全金鑰錯誤
-webauthn-error-registration=無法註冊您的安全金鑰。<br/> {0}
-webauthn-error-api-get=無法透過安全金鑰進行驗證。<br/> {0}
+webauthn-error-registration=無法註冊您的安全金鑰。<br /> {0}
+webauthn-error-api-get=無法透過安全金鑰進行驗證。<br /> {0}
 webauthn-error-different-user=第一個驗證的使用者不是這個安全金鑰驗證的使用者。
-webauthn-error-auth-verification=安全金鑰驗證結果無效。<br/> {0}
-webauthn-error-register-verification=安全金鑰註冊結果無效。<br/> {0}
+webauthn-error-auth-verification=安全金鑰驗證結果無效。<br /> {0}
+webauthn-error-register-verification=安全金鑰註冊結果無效。<br /> {0}
 webauthn-error-user-not-found=未知的使用者透過安全金鑰進行驗證。
 
+# Passkey
+passkey-login-title=Passkey 登入
+passkey-available-authenticators=可用 Passkeys
+passkey-unsupported-browser-text=此瀏覽器不支援 Passkey。請嘗試其他瀏覽器或聯絡您的系統管理員。
+passkey-doAuthenticate=使用 Passkey 登入
+passkey-createdAt-label=建立於
+passkey-autofill-select=選擇您的 Passkey
+
 # Identity provider
 identity-provider-redirector=連結到其他身份提供者
-identity-provider-login-label=或透過其他身份提供者登入
+identity-provider-login-label=或透過其他登入方式
 idp-email-verification-display-name=電子信箱驗證
 idp-email-verification-help-text=透過驗證您的電子信箱來連結您的帳戶。
 idp-username-password-form-display-name=使用者名稱和密碼
@@ -506,3 +532,10 @@ doLogout=登出
 
 readOnlyUsernameMessage=您無法更新您的使用者名稱，因為它是唯讀的。
 error-invalid-multivalued-size=屬性 {0} 必須包含至少 {1} ，最多 {2} 個值。
+
+organization.confirm-membership.title=您即將加入 ${kc.org.name} 組織
+organization.confirm-membership=點擊下方的連結，您將成為 ${kc.org.name} 組織成員：
+organization.member.register.title=建立帳號以加入 ${kc.org.name} 組織
+organization.select=選擇組織以繼續：
+notMemberOfOrganization=使用者不是組織 {0} 的成員
+notMemberOfAnyOrganization=使用者不是任何組織的成員
diff --git a/themes/src/main/resources-community/theme/base/login/theme.properties b/themes/src/main/resources-community/theme/base/login/theme.properties
index b5e17b883d69..c345fd4b5f56 100644
--- a/themes/src/main/resources-community/theme/base/login/theme.properties
+++ b/themes/src/main/resources-community/theme/base/login/theme.properties
@@ -1 +1 @@
-locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,ko,lt,lv,nl,no,pl,pt,pt-BR,ru,sk,sv,th,tr,uk,zh-CN,zh-TW
+locales=ar,ca,cs,da,de,el,en,es,fa,fr,fi,hr,hu,it,ja,ko,ky,lt,lv,nl,no,pl,pt,pt-BR,ru,sk,sl,sv,th,tr,uk,zh-CN,zh-TW
diff --git a/themes/src/main/resources/theme/base/account/messages/messages_en.properties b/themes/src/main/resources/theme/base/account/messages/messages_en.properties
index bd4f3e66f759..f87f69225d60 100755
--- a/themes/src/main/resources/theme/base/account/messages/messages_en.properties
+++ b/themes/src/main/resources/theme/base/account/messages/messages_en.properties
@@ -104,7 +104,7 @@ role_offline-access=Offline access
 role_uma_authorization=Obtain permissions
 client_account=Account
 client_account-console=Account Console
-client_security-admin-console=security admin console
+client_security-admin-console=Security Admin Console
 client_admin-cli=Admin CLI
 client_realm-management=Realm Management
 client_broker=Broker
@@ -212,7 +212,7 @@ missingIdentityProviderMessage=Identity provider not specified.
 invalidFederatedIdentityActionMessage=Invalid or missing action.
 identityProviderNotFoundMessage=Specified identity provider not found.
 federatedIdentityLinkNotActiveMessage=This identity is not active anymore.
-federatedIdentityRemovingLastProviderMessage=You can''t remove last federated identity as you don''t have a password.
+federatedIdentityRemovingLastProviderMessage=You can not remove last federated identity as you do not have a password.
 federatedIdentityBoundOrganization=You cannot remove the link to an identity provider associated with an organization.
 identityProviderRedirectErrorMessage=Failed to redirect to identity provider.
 identityProviderRemovedMessage=Identity provider removed successfully.
@@ -267,7 +267,7 @@ permissionRequestion=Permission Requestion
 permission=Permission
 shares=share(s)
 notBeingShared=This resource is not being shared.
-notHaveAnyResource=You don't have any resources
+notHaveAnyResource=You don’t have any resources
 noResourcesSharedWithYou=There are no resources shared with you
 havePermissionRequestsWaitingForApproval=You have {0} permission request(s) waiting for approval.
 clickHereForDetails=Click here for details.
diff --git a/themes/src/main/resources/theme/base/admin/messages/messages_en.properties b/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
index c373dbb539a1..6ded8e2bb8b9 100644
--- a/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
+++ b/themes/src/main/resources/theme/base/admin/messages/messages_en.properties
@@ -66,4 +66,11 @@ error-invalid-date=Attribute {0} is invalid date.
 error-user-attribute-read-only=Attribute {0} is read only.
 error-username-invalid-character={0} contains invalid character.
 error-person-name-invalid-character={0} contains invalid character.
-error-invalid-multivalued-size=Attribute {0} must have at least {1} and at most {2} value(s).
\ No newline at end of file
+error-invalid-multivalued-size=Attribute {0} must have at least {1} and at most {2} {2,choice,0#values|1#value|1<values}.
+
+client_account=Account
+client_account-console=Account Console
+client_security-admin-console=Security Admin Console
+client_admin-cli=Admin CLI
+client_realm-management=Realm Management
+client_broker=Broker
\ No newline at end of file
diff --git a/themes/src/main/resources/theme/base/email/html/template.ftl b/themes/src/main/resources/theme/base/email/html/template.ftl
index fd2ea5df2a95..1bd56aa85290 100644
--- a/themes/src/main/resources/theme/base/email/html/template.ftl
+++ b/themes/src/main/resources/theme/base/email/html/template.ftl
@@ -1,5 +1,5 @@
 <#macro emailLayout>
-<html>
+<html lang="${locale.language}" dir="${(ltr)?then('ltr','rtl')}">
 <body>
     <#nested>
 <div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
diff --git a/themes/src/main/resources/theme/base/email/messages/messages_en.properties b/themes/src/main/resources/theme/base/email/messages/messages_en.properties
index eafceb2d3f9f..f811bf841058 100755
--- a/themes/src/main/resources/theme/base/email/messages/messages_en.properties
+++ b/themes/src/main/resources/theme/base/email/messages/messages_en.properties
@@ -2,10 +2,10 @@ emailVerificationSubject=Verify email
 emailVerificationBody=Someone has created a {2} account with this email address. If this was you, click the link below to verify your email address\n\n{0}\n\nThis link will expire within {3}.\n\nIf you didn''t create this account, just ignore this message.
 emailVerificationBodyHtml=<p>Someone has created a {2} account with this email address. If this was you, click the link below to verify your email address</p><p><a href="{0}">Link to e-mail address verification</a></p><p>This link will expire within {3}.</p><p>If you didn''t create this account, just ignore this message.</p>
 orgInviteSubject=Invitation to join the {0} organization
-orgInviteBody=You were invited to join the "{3}" organization. Click the link below to join.\n\n{0}\n\nThis link will expire within {4}.\n\nIf you don't want to join the organization, just ignore this message.
-orgInviteBodyHtml=<p>You were invited to join the {3} organization. Click the link below to join. </p><p><a href="{0}">Link to join the organization</a></p><p>This link will expire within {4}.</p><p>If you don't want to join the organization, just ignore this message.</p>
-orgInviteBodyPersonalized=Hi, "{5}" "{6}".\n\n You were invited to join the "{3}" organization. Click the link below to join.\n\n{0}\n\nThis link will expire within {4}.\n\nIf you don't want to join the organization, just ignore this message.
-orgInviteBodyPersonalizedHtml=<p>Hi, {5} {6}.</p><p>You were invited to join the {3} organization. Click the link below to join. </p><p><a href="{0}">Link to join the organization</a></p><p>This link will expire within {4}.</p><p>If you don't want to join the organization, just ignore this message.</p>
+orgInviteBody=You were invited to join the "{3}" organization. Click the link below to join.\n\n{0}\n\nThis link will expire within {4}.\n\nIf you don''t want to join the organization, just ignore this message.
+orgInviteBodyHtml=<p>You were invited to join the {3} organization. Click the link below to join. </p><p><a href="{0}">Link to join the organization</a></p><p>This link will expire within {4}.</p><p>If you don''t want to join the organization, just ignore this message.</p>
+orgInviteBodyPersonalized=Hi, "{5}" "{6}".\n\n You were invited to join the "{3}" organization. Click the link below to join.\n\n{0}\n\nThis link will expire within {4}.\n\nIf you don''t want to join the organization, just ignore this message.
+orgInviteBodyPersonalizedHtml=<p>Hi, {5} {6}.</p><p>You were invited to join the {3} organization. Click the link below to join. </p><p><a href="{0}">Link to join the organization</a></p><p>This link will expire within {4}.</p><p>If you don''t want to join the organization, just ignore this message.</p>
 emailUpdateConfirmationSubject=Verify new email
 emailUpdateConfirmationBody=To update your {2} account with email address {1}, click the link below\n\n{0}\n\nThis link will expire within {3}.\n\nIf you don''t want to proceed with this modification, just ignore this message.
 emailUpdateConfirmationBodyHtml=<p>To update your {2} account with email address {1}, click the link below</p><p><a href="{0}">{0}</a></p><p>This link will expire within {3}.</p><p>If you don''t want to proceed with this modification, just ignore this message.</p>
@@ -13,8 +13,8 @@ emailTestSubject=[KEYCLOAK] - SMTP test message
 emailTestBody=This is a test message
 emailTestBodyHtml=<p>This is a test message</p>
 identityProviderLinkSubject=Link {0}
-identityProviderLinkBody=Someone wants to link your "{1}" account with "{0}" account of user {2} . If this was you, click the link below to link accounts\n\n{3}\n\nThis link will expire within {5}.\n\nIf you don''t want to link account, just ignore this message. If you link accounts, you will be able to login to {1} through {0}.
-identityProviderLinkBodyHtml=<p>Someone wants to link your <b>{1}</b> account with <b>{0}</b> account of user {2}. If this was you, click the link below to link accounts</p><p><a href="{3}">Link to confirm account linking</a></p><p>This link will expire within {5}.</p><p>If you don''t want to link account, just ignore this message. If you link accounts, you will be able to login to {1} through {0}.</p>
+identityProviderLinkBody=Someone wants to link your "{1}" account with "{0}" account of user {2} . If this was you, click the link below to link accounts\n\n{3}\n\nThis link will expire within {5}.\n\nIf you didn''t initiate this process or don''t want to link account, just ignore this message. If you link accounts, you will be able to login to {1} through {0}.
+identityProviderLinkBodyHtml=<p>Someone wants to link your <b>{1}</b> account with <b>{0}</b> account of user {2}. If this was you, click the link below to link accounts</p><p><a href="{3}">Link to confirm account linking</a></p><p>This link will expire within {5}.</p><p>If you didn''t initiate this process or don''t want to link account, just ignore this message. If you link accounts, you will be able to login to {1} through {0}.</p>
 passwordResetSubject=Reset password
 passwordResetBody=Someone just requested to change your {2} account''s credentials. If this was you, click on the link below to reset them.\n\n{0}\n\nThis link and code will expire within {3}.\n\nIf you don''t want to reset your credentials, just ignore this message and nothing will be changed.
 passwordResetBodyHtml=<p>Someone just requested to change your {2} account''s credentials. If this was you, click on the link below to reset them.</p><p><a href="{0}">Link to reset credentials</a></p><p>This link will expire within {3}.</p><p>If you don''t want to reset your credentials, just ignore this message and nothing will be changed.</p>
@@ -40,11 +40,11 @@ eventRemoveCredentialSubject=Remove credential
 eventRemoveCredentialBody=Credential {0} was removed from your account on {1} from {2}. If this was not you, please contact an administrator.
 eventRemoveCredentialBodyHtml=<p>Credential {0} was removed from your account on {1} from {2}. If this was not you, please contact an administrator.</p>
 eventUserDisabledByTemporaryLockoutSubject=User disabled by temporary lockout
-eventUserDisabledByTemporaryLockoutBody=Your user has been disabled temporarily because of multiple failed attemps on {0}. Please contact an administrator if needed.
-eventUserDisabledByTemporaryLockoutHtml=<p>Your user has been disabled temporarily because of multiple failed attemps on {0}. Please contact an administrator if needed.</p>
-eventUserDisabledByPermanentLockoutSubject=User disabled by permament lockout
-eventUserDisabledByPermanentLockoutBody=Your user has been disabled permanently because of multiple failed attemps on {0}. Please contact an administrator.
-eventUserDisabledByPermanentLockoutHtml=<p>Your user has been disabled permanently because of multiple failed attemps on {0}. Please contact an administrator.</p>
+eventUserDisabledByTemporaryLockoutBody=Your user has been disabled temporarily because of multiple failed attempts on {0}. Please contact an administrator if needed.
+eventUserDisabledByTemporaryLockoutHtml=<p>Your user has been disabled temporarily because of multiple failed attempts on {0}. Please contact an administrator if needed.</p>
+eventUserDisabledByPermanentLockoutSubject=User disabled by permanent lockout
+eventUserDisabledByPermanentLockoutBody=Your user has been disabled permanently because of multiple failed attempts on {0}. Please contact an administrator.
+eventUserDisabledByPermanentLockoutHtml=<p>Your user has been disabled permanently because of multiple failed attempts on {0}. Please contact an administrator.</p>
 
 requiredAction.CONFIGURE_TOTP=Configure OTP
 requiredAction.TERMS_AND_CONDITIONS=Terms and Conditions
@@ -64,4 +64,3 @@ linkExpirationFormatter.timePeriodUnit.days={0,choice,0#days|1#day|1<days}
 
 emailVerificationBodyCode=Please verify your email address by entering in the following code.\n\n{0}\n\n.
 emailVerificationBodyCodeHtml=<p>Please verify your email address by entering in the following code.</p><p><b>{0}</b></p>
-
diff --git a/themes/src/main/resources/theme/base/login/link-idp-action.ftl b/themes/src/main/resources/theme/base/login/link-idp-action.ftl
new file mode 100644
index 000000000000..9b03e570cabf
--- /dev/null
+++ b/themes/src/main/resources/theme/base/login/link-idp-action.ftl
@@ -0,0 +1,15 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout displayMessage=false; section>
+    <#if section = "header">
+        ${msg("linkIdpActionTitle", idpDisplayName)}
+    <#elseif section = "form">
+    <div id="kc-link-text">
+        ${msg("linkIdpActionMessage", idpDisplayName)}
+    </div>
+    <form class="form-actions" action="${url.loginAction}" method="POST">
+        <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" name="continue" id="kc-continue" type="submit" value="${msg("doContinue")}"/>
+        <input class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!}" name="cancel-aia" value="${msg("doCancel")}" id="kc-cancel" type="submit" />
+    </form>
+    <div class="clearfix"></div>
+    </#if>
+</@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/base/login/login-idp-link-confirm.ftl b/themes/src/main/resources/theme/base/login/login-idp-link-confirm.ftl
index c3537c5d3e91..ab59db5cf9f0 100644
--- a/themes/src/main/resources/theme/base/login/login-idp-link-confirm.ftl
+++ b/themes/src/main/resources/theme/base/login/login-idp-link-confirm.ftl
@@ -5,7 +5,9 @@
     <#elseif section = "form">
         <form id="kc-register-form" action="${url.loginAction}" method="post">
             <div class="${properties.kcFormGroupClass!}">
-                <button type="submit" class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="submitAction" id="updateProfile" value="updateProfile">${msg("confirmLinkIdpReviewProfile")}</button>
+                <#if !hideReviewButton?has_content>
+                    <button type="submit" class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="submitAction" id="updateProfile" value="updateProfile">${msg("confirmLinkIdpReviewProfile")}</button>
+                </#if>
                 <button type="submit" class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="submitAction" id="linkAccount" value="linkAccount">${msg("confirmLinkIdpContinue", idpDisplayName)}</button>
             </div>
         </form>
diff --git a/themes/src/main/resources/theme/base/login/login-passkeys-conditional-authenticate.ftl b/themes/src/main/resources/theme/base/login/login-passkeys-conditional-authenticate.ftl
index 315f76277cdd..026cf3b441fb 100644
--- a/themes/src/main/resources/theme/base/login/login-passkeys-conditional-authenticate.ftl
+++ b/themes/src/main/resources/theme/base/login/login-passkeys-conditional-authenticate.ftl
@@ -109,7 +109,7 @@
                 challenge : '${challenge}',
                 userVerification : '${userVerification}',
                 rpId : '${rpId}',
-                createTimeout : ${createTimeout},
+                createTimeout : ${createTimeout?c},
                 errmsg : "${msg("webauthn-unsupported-browser-text")?no_esc}"
             };
             authButton.addEventListener("click", () => {
@@ -121,11 +121,17 @@
                 challenge : '${challenge}',
                 userVerification : '${userVerification}',
                 rpId : '${rpId}',
-                createTimeout : ${createTimeout},
+                createTimeout : ${createTimeout?c},
                 errmsg : "${msg("passkey-unsupported-browser-text")?no_esc}"
             };
 
-            document.addEventListener("DOMContentLoaded", (event) => initAuthenticate(args));
+            document.addEventListener("DOMContentLoaded", (event) => initAuthenticate(args, (available) => {
+                if (available) {
+                    document.getElementById("kc-form-login").style.display = "block";
+                } else {
+                    document.getElementById("kc-form-passkey-button").style.display = 'block';
+                }
+            }));
         </script>
 
     <#elseif section = "info">
diff --git a/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl b/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
index d32b22e4d7b1..774efc2f697a 100644
--- a/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
+++ b/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
@@ -4,7 +4,7 @@
     <#if section = "header">
         ${msg("auth-recovery-code-header")}
     <#elseif section = "form">
-        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <div class="${properties.kcFormGroupClass!}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="recoveryCodeInput" class="${properties.kcLabelClass!}">${msg("auth-recovery-code-prompt", recoveryAuthnCodesInputBean.codeNumber?c)}</label>
diff --git a/themes/src/main/resources/theme/base/login/login-update-password.ftl b/themes/src/main/resources/theme/base/login/login-update-password.ftl
index 4861f447f300..ec5b3c7992eb 100755
--- a/themes/src/main/resources/theme/base/login/login-update-password.ftl
+++ b/themes/src/main/resources/theme/base/login/login-update-password.ftl
@@ -4,7 +4,7 @@
     <#if section = "header">
         ${msg("updatePasswordTitle")}
     <#elseif section = "form">
-        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <div class="${properties.kcFormGroupClass!}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="password-new" class="${properties.kcLabelClass!}">${msg("passwordNew")}</label>
@@ -64,10 +64,10 @@
 
                 <div id="kc-form-buttons" class="${properties.kcFormButtonsClass!}">
                     <#if isAppInitiatedAction??>
-                        <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
+                        <input name="login" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
                         <button class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!}" type="submit" name="cancel-aia" value="true" />${msg("doCancel")}</button>
                     <#else>
-                        <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
+                        <input name="login" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
                     </#if>
                 </div>
             </div>
diff --git a/themes/src/main/resources/theme/base/login/login-username.ftl b/themes/src/main/resources/theme/base/login/login-username.ftl
index 8b932f989c1b..ecd4be2234dc 100755
--- a/themes/src/main/resources/theme/base/login/login-username.ftl
+++ b/themes/src/main/resources/theme/base/login/login-username.ftl
@@ -1,4 +1,5 @@
 <#import "template.ftl" as layout>
+<#import "passkeys.ftl" as passkeys>
 <@layout.registrationLayout displayMessage=!messagesPerField.existsError('username') displayInfo=(realm.password && realm.registrationAllowed && !registrationDisabled??); section>
     <#if section = "header">
         ${msg("loginAccountTitle")}
@@ -17,7 +18,8 @@
                                        aria-invalid="<#if messagesPerField.existsError('username')>true</#if>"
                                        class="${properties.kcInputClass!}" name="username"
                                        value="${(login.username!'')}"
-                                       type="text" autofocus autocomplete="username"
+                                       type="text" autofocus
+                                       autocomplete="${(enableWebAuthnConditionalUI?has_content)?then('username webauthn', 'username')}"
                                        dir="ltr"/>
 
                                 <#if messagesPerField.existsError('username')>
@@ -55,6 +57,7 @@
                 </#if>
             </div>
         </div>
+        <@passkeys.conditionalUIData />
 
     <#elseif section = "info" >
         <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
@@ -70,7 +73,8 @@
 
                 <ul class="${properties.kcFormSocialAccountListClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">
                     <#list social.providers as p>
-                        <a id="social-${p.alias}" class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
+                        <a data-once-link data-disabled-class="${properties.kcFormSocialAccountListButtonDisabledClass!}" id="social-${p.alias}"
+                                class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
                                 type="button" href="${p.loginUrl}">
                             <#if p.iconClasses?has_content>
                                 <i class="${properties.kcCommonLogoIdP!} ${p.iconClasses!}" aria-hidden="true"></i>
diff --git a/themes/src/main/resources/theme/base/login/login-verify-email.ftl b/themes/src/main/resources/theme/base/login/login-verify-email.ftl
index b47d8ca8d5c3..347d6067eba6 100755
--- a/themes/src/main/resources/theme/base/login/login-verify-email.ftl
+++ b/themes/src/main/resources/theme/base/login/login-verify-email.ftl
@@ -3,12 +3,34 @@
     <#if section = "header">
         ${msg("emailVerifyTitle")}
     <#elseif section = "form">
-        <p class="instruction">${msg("emailVerifyInstruction1",user.email)}</p> 
-    <#elseif section = "info">
         <p class="instruction">
-            ${msg("emailVerifyInstruction2")}
-            <br/>
-            <a href="${url.loginAction}">${msg("doClickHere")}</a> ${msg("emailVerifyInstruction3")}
+            <#if verifyEmail??>
+                ${msg("emailVerifyInstruction1",verifyEmail)}
+            <#else>
+                ${msg("emailVerifyInstruction4",user.email)}
+            </#if>
         </p>
+        <#if isAppInitiatedAction??>
+            <form id="kc-verify-email-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+                <div class="${properties.kcFormGroupClass!}">
+                    <div id="kc-form-buttons" class="${properties.kcFormButtonsClass!}">
+                        <#if verifyEmail??>
+                            <input class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("emailVerifyResend")}" />
+                        <#else>
+                            <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("emailVerifySend")}" />
+                        </#if>
+                        <button class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!}" type="submit" name="cancel-aia" value="true" formnovalidate/>${msg("doCancel")}</button>
+                    </div>
+                </div>
+            </form>
+        </#if>
+    <#elseif section = "info">
+        <#if !isAppInitiatedAction??>
+            <p class="instruction">
+                ${msg("emailVerifyInstruction2")}
+                <br/>
+                <a href="${url.loginAction}">${msg("doClickHere")}</a> ${msg("emailVerifyInstruction3")}
+            </p>
+        </#if>
     </#if>
 </@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/base/login/login.ftl b/themes/src/main/resources/theme/base/login/login.ftl
index e50b1be03fd7..349c9a1d318c 100755
--- a/themes/src/main/resources/theme/base/login/login.ftl
+++ b/themes/src/main/resources/theme/base/login/login.ftl
@@ -1,4 +1,5 @@
 <#import "template.ftl" as layout>
+<#import "passkeys.ftl" as passkeys>
 <@layout.registrationLayout displayMessage=!messagesPerField.existsError('username','password') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
     <#if section = "header">
         ${msg("loginAccountTitle")}
@@ -11,7 +12,8 @@
                         <div class="${properties.kcFormGroupClass!}">
                             <label for="username" class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
 
-                            <input tabindex="2" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}"  type="text" autofocus autocomplete="username"
+                            <input tabindex="2" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}"  type="text"
+                                   autofocus autocomplete="${(enableWebAuthnConditionalUI?has_content)?then('username webauthn', 'username')}"
                                    aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
                                    dir="ltr"
                             />
@@ -78,6 +80,7 @@
             </#if>
             </div>
         </div>
+        <@passkeys.conditionalUIData />
         <script type="module" src="${url.resourcesPath}/js/passwordVisibility.js"></script>
     <#elseif section = "info" >
         <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
@@ -97,7 +100,8 @@
                 <ul class="${properties.kcFormSocialAccountListClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">
                     <#list social.providers as p>
                         <li>
-                            <a id="social-${p.alias}" class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
+                            <a data-once-link data-disabled-class="${properties.kcFormSocialAccountListButtonDisabledClass!}" id="social-${p.alias}"
+                                    class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>"
                                     type="button" href="${p.loginUrl}">
                                 <#if p.iconClasses?has_content>
                                     <i class="${properties.kcCommonLogoIdP!} ${p.iconClasses!}" aria-hidden="true"></i>
diff --git a/themes/src/main/resources/theme/base/login/messages/messages_en.properties b/themes/src/main/resources/theme/base/login/messages/messages_en.properties
index 6cd99520483b..b7ea04925355 100644
--- a/themes/src/main/resources/theme/base/login/messages/messages_en.properties
+++ b/themes/src/main/resources/theme/base/login/messages/messages_en.properties
@@ -20,8 +20,8 @@ errorDeletingAccount=Error happened while deleting account
 deletingAccountForbidden=You do not have enough permissions to delete your own account, contact admin.
 kerberosNotConfigured=Kerberos Not Configured
 kerberosNotConfiguredTitle=Kerberos Not Configured
-bypassKerberosDetail=Either you are not logged in by Kerberos or your browser is not set up for Kerberos login.  Please click continue to login in through other means
-kerberosNotSetUp=Kerberos is not set up.  You cannot login.
+bypassKerberosDetail=Either you are not logged in by Kerberos or your browser is not set up for Kerberos login. Please click continue to login in through other means
+kerberosNotSetUp=Kerberos is not set up. You cannot login.
 registerTitle=Register
 loginAccountTitle=Sign in to your account
 loginTitle=Sign in to {0}
@@ -33,13 +33,13 @@ unknownUser=Unknown user
 loginTotpTitle=Mobile Authenticator Setup
 loginProfileTitle=Update Account Information
 loginIdpReviewProfileTitle=Update Account Information
-loginTimeout=Your login attempt timed out.  Login will start from the beginning.
+loginTimeout=Your login attempt timed out. Login will start from the beginning.
 reauthenticate=Please re-authenticate to continue
 authenticateStrong=Strong authentication required to continue
 oauthGrantTitle=Grant Access to {0}
 oauthGrantTitleHtml={0}
 oauthGrantInformation=Make sure you trust {0} by learning how {0} will handle your data.
-oauthGrantReview=You could review the 
+oauthGrantReview=You could review the
 oauthGrantTos=terms of service.
 oauthGrantPolicy=privacy policy.
 errorTitle=We are sorry...
@@ -76,6 +76,9 @@ acceptTerms=I agree to the terms and conditions
 deleteCredentialTitle=Delete {0}
 deleteCredentialMessage=Do you want to delete {0}?
 
+linkIdpActionTitle=Linking {0}
+linkIdpActionMessage=Do you want to link your account with {0}?
+
 recaptchaFailed=Invalid Recaptcha
 recaptchaNotConfigured=Recaptcha is required, but not configured
 consentDenied=Consent denied.
@@ -168,12 +171,15 @@ oauth2DeviceAuthorizationGrantDisabledMessage=Client is not allowed to initiate
 emailVerifyInstruction1=An email with instructions to verify your email address has been sent to your address {0}.
 emailVerifyInstruction2=Haven''t received a verification code in your email?
 emailVerifyInstruction3=to re-send the email.
+emailVerifyInstruction4=To verify your email address, we are about to send you email with instructions to the address {0}.
+emailVerifyResend=Re-send verification email
+emailVerifySend=Send verification email
 
 emailLinkIdpTitle=Link {0}
 emailLinkIdp1=An email with instructions to link {0} account {1} with your {2} account has been sent to you.
 emailLinkIdp2=Haven''t received a verification code in your email?
 emailLinkIdp3=to re-send the email.
-emailLinkIdp4=If you already verified the email in different browser
+emailLinkIdp4=If you already verified the email in a different browser
 emailLinkIdp5=to continue.
 
 backToLogin=&laquo; Back to Login
@@ -370,9 +376,10 @@ credentialSetupRequired=Cannot login, credential setup required.
 identityProviderNotUniqueMessage=Realm supports multiple identity providers. Could not determine which identity provider should be used to authenticate with.
 emailVerifiedMessage=Your email address has been verified.
 emailVerifiedAlreadyMessage=Your email address has been verified already.
-staleEmailVerificationLink=The link you clicked is an old stale link and is no longer valid.  Maybe you have already verified your email.
+staleEmailVerificationLink=The link you clicked is an old stale link and is no longer valid. Maybe you have already verified your email.
 identityProviderAlreadyLinkedMessage=Federated identity returned by {0} is already linked to another user.
 confirmAccountLinking=Confirm linking the account {0} of identity provider {1} with your account.
+confirmAccountLinkingBody=If you link the account, you will also be able to login using account {0} of the identity provider {1}. Do not proceed if you did not initiate this process or you do not want to link the account.
 confirmEmailAddressVerification=Confirm validity of e-mail address {0}.
 confirmExecutionOfActions=Perform the following action(s)
 
@@ -412,7 +419,7 @@ console-otp=One Time Password:
 console-new-password=New Password:
 console-confirm-password=Confirm Password:
 console-update-password=Update of your password is required.
-console-verify-email=You need to verify your email address.  We sent an email to {0} that contains a verification code.  Please enter this code into the input below.
+console-verify-email=You need to verify your email address. We sent an email to {0} that contains a verification code. Please enter this code into the input below.
 console-email-code=Email Code:
 console-accept-terms=Accept Terms? [y/n]:
 console-accept=y
@@ -426,7 +433,7 @@ openshift.scope.list-projects=List projects
 # SAML authentication
 saml.post-form.title=Authentication Redirect
 saml.post-form.message=Redirecting, please wait.
-saml.post-form.js-disabled=JavaScript is disabled. We strongly recommend to enable it. Click the button below to continue. 
+saml.post-form.js-disabled=JavaScript is disabled. We strongly recommend to enable it. Click the button below to continue.
 saml.artifactResolutionServiceInvalidResponse=Unable to resolve artifact.
 
 #authenticators
@@ -450,7 +457,7 @@ auth-recovery-code-prompt=Recovery code #{0}
 auth-recovery-code-header=Login with a recovery authentication code
 recovery-codes-error-invalid=Invalid recovery authentication code
 recovery-code-config-header=Recovery Authentication Codes
-recovery-code-config-warning-title=These recovery codes won't appear again after leaving this page
+recovery-code-config-warning-title=These recovery codes won''t appear again after leaving this page
 recovery-code-config-warning-message=Make sure to print, download, or copy them to a password manager and keep them save. Canceling this setup will remove these recovery codes from your account.
 recovery-codes-print=Print
 recovery-codes-download=Download
@@ -481,11 +488,11 @@ webauthn-registration-init-label-prompt=Please input your registered passkey''s
 
 # WebAuthn Error
 webauthn-error-title=Passkey Error
-webauthn-error-registration=Failed to register your Passkey.<br/> {0}
-webauthn-error-api-get=Failed to authenticate by the Passkey.<br/> {0}
+webauthn-error-registration=Failed to register your Passkey.<br /> {0}
+webauthn-error-api-get=Failed to authenticate by the Passkey.<br /> {0}
 webauthn-error-different-user=First authenticated user is not the one authenticated by the Passkey.
-webauthn-error-auth-verification=Passkey authentication result is invalid.<br/> {0}
-webauthn-error-register-verification=Passkey registration result is invalid.<br/> {0}
+webauthn-error-auth-verification=Passkey authentication result is invalid.<br /> {0}
+webauthn-error-register-verification=Passkey registration result is invalid.<br /> {0}
 webauthn-error-user-not-found=Unknown user authenticated by the Passkey.
 
 # Passkey
@@ -524,9 +531,11 @@ logoutConfirmHeader=Do you want to log out?
 doLogout=Logout
 
 readOnlyUsernameMessage=You can''t update your username as it is read-only.
-error-invalid-multivalued-size=Attribute {0} must have at least {1} and at most {2} value(s).
+error-invalid-multivalued-size=Attribute {0} must have at least {1} and at most {2} {2,choice,0#values|1#value|1<values}.
 
 organization.confirm-membership.title=You are about to join organization ${kc.org.name}
 organization.confirm-membership=By clicking on the link below, you will become a member of the {0} organization:
 organization.member.register.title=Create an account to join the ${kc.org.name} organization
 organization.select=Select an organization to proceed:
+notMemberOfOrganization=User is not a member of the organization {0}
+notMemberOfAnyOrganization=User is not a member of any organization
diff --git a/themes/src/main/resources/theme/base/login/passkeys.ftl b/themes/src/main/resources/theme/base/login/passkeys.ftl
new file mode 100644
index 000000000000..5c9914a9356f
--- /dev/null
+++ b/themes/src/main/resources/theme/base/login/passkeys.ftl
@@ -0,0 +1,36 @@
+<#macro conditionalUIData>
+    <#if enableWebAuthnConditionalUI?has_content>
+        <form id="webauth" action="${url.loginAction}" method="post">
+            <input type="hidden" id="clientDataJSON" name="clientDataJSON"/>
+            <input type="hidden" id="authenticatorData" name="authenticatorData"/>
+            <input type="hidden" id="signature" name="signature"/>
+            <input type="hidden" id="credentialId" name="credentialId"/>
+            <input type="hidden" id="userHandle" name="userHandle"/>
+            <input type="hidden" id="error" name="error"/>
+        </form>
+        <script type="module">
+           import { authenticateByWebAuthn } from "${url.resourcesPath}/js/webauthnAuthenticate.js";
+           import { initAuthenticate } from "${url.resourcesPath}/js/passkeysConditionalAuth.js";
+
+           const args = {
+               isUserIdentified : ${isUserIdentified},
+               challenge : '${challenge}',
+               userVerification : '${userVerification}',
+               rpId : '${rpId}',
+               createTimeout : ${createTimeout?c}
+           };
+
+           document.addEventListener("DOMContentLoaded", (event) => initAuthenticate({errmsg : "${msg("passkey-unsupported-browser-text")?no_esc}", ...args}));
+           const authButton = document.getElementById('authenticateWebAuthnButton');
+           if (authButton) {
+               authButton.addEventListener("click", (event) => {
+                   event.preventDefault();
+                   authenticateByWebAuthn({errmsg : "${msg("webauthn-unsupported-browser-text")?no_esc}", ...args});
+               });
+           }
+        </script>
+        <a id="authenticateWebAuthnButton" href="#" class="${properties.kcButtonSecondaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcMarginTopClass!}">
+            ${kcSanitize(msg("webauthn-doAuthenticate"))?no_esc}
+        </a>
+    </#if>
+</#macro>
diff --git a/themes/src/main/resources/theme/base/login/password-commons.ftl b/themes/src/main/resources/theme/base/login/password-commons.ftl
index 233c781d75a8..1f33f72b7e32 100644
--- a/themes/src/main/resources/theme/base/login/password-commons.ftl
+++ b/themes/src/main/resources/theme/base/login/password-commons.ftl
@@ -3,7 +3,7 @@
         <div class="${properties.kcFormOptionsWrapperClass!}">
             <div class="checkbox">
                 <label>
-                    <input type="checkbox" id="logout-sessions" name="logout-sessions" value="on" checked>
+                    <input type="checkbox" id="logout-sessions" name="logout-sessions" value="on">
                     ${msg("logoutOtherSessions")}
                 </label>
             </div>
diff --git a/themes/src/main/resources/theme/base/login/resources/js/passkeysConditionalAuth.js b/themes/src/main/resources/theme/base/login/resources/js/passkeysConditionalAuth.js
index 20ae676f2f79..1b0e96adfcc0 100644
--- a/themes/src/main/resources/theme/base/login/resources/js/passkeysConditionalAuth.js
+++ b/themes/src/main/resources/theme/base/login/resources/js/passkeysConditionalAuth.js
@@ -1,16 +1,16 @@
 import { base64url } from "rfc4648";
-import { returnSuccess, returnFailure } from "./webauthnAuthenticate.js";
+import { returnSuccess, signal } from "./webauthnAuthenticate.js";
 
-export function initAuthenticate(input) {
+export function initAuthenticate(input, availableCallback = (available) => {}) {
     // Check if WebAuthn is supported by this browser
     if (!window.PublicKeyCredential) {
         // Fail silently as WebAuthn Conditional UI is not required
         return;
     }
     if (input.isUserIdentified || typeof PublicKeyCredential.isConditionalMediationAvailable === "undefined") {
-        document.getElementById("kc-form-passkey-button").style.display = 'block';
+        availableCallback(false);
     } else {
-        tryAutoFillUI(input);
+        tryAutoFillUI(input, availableCallback);
     }
 }
 
@@ -38,14 +38,15 @@ function doAuthenticate(input) {
 
     return navigator.credentials.get({
         publicKey: publicKey,
+        signal: signal(),
         ...input.additionalOptions
     });
 }
 
-async function tryAutoFillUI(input) {
+async function tryAutoFillUI(input, availableCallback = (available) => {}) {
     const isConditionalMediationAvailable = await PublicKeyCredential.isConditionalMediationAvailable();
     if (isConditionalMediationAvailable) {
-        document.getElementById("kc-form-login").style.display = "block";
+        availableCallback(true);
         input.additionalOptions = { mediation: 'conditional'};
         try {
             const result = await doAuthenticate(input);
@@ -54,7 +55,7 @@ async function tryAutoFillUI(input) {
             // Fail silently as WebAuthn Conditional UI is not required
         }
     } else {
-        document.getElementById("kc-form-passkey-button").style.display = 'block';
+        availableCallback(false);
     }
 }
 
diff --git a/themes/src/main/resources/theme/base/login/resources/js/webauthnAuthenticate.js b/themes/src/main/resources/theme/base/login/resources/js/webauthnAuthenticate.js
index d34a2eeb1b9b..fb818adf5ecc 100644
--- a/themes/src/main/resources/theme/base/login/resources/js/webauthnAuthenticate.js
+++ b/themes/src/main/resources/theme/base/login/resources/js/webauthnAuthenticate.js
@@ -1,5 +1,20 @@
 import { base64url } from "rfc4648";
 
+// singleton
+let abortController = undefined;
+
+export function signal() {
+    if (abortController) {
+        // abort the previous call
+        const abortError = new Error("Cancelling pending WebAuthn call");
+        abortError.name = "AbortError";
+        abortController.abort(abortError);
+    }
+
+    abortController = new AbortController();
+    return abortController.signal;
+}
+
 export async function authenticateByWebAuthn(input) {
     if (!input.isUserIdentified) {
         try {
@@ -62,7 +77,10 @@ function doAuthenticate(allowCredentials, challenge, userVerification, rpId, cre
         publicKey.userVerification = userVerification;
     }
 
-    return navigator.credentials.get({publicKey});
+    return navigator.credentials.get({
+        publicKey: publicKey,
+        signal: signal()
+    });
 }
 
 export function returnSuccess(result) {
diff --git a/themes/src/main/resources/theme/base/login/template.ftl b/themes/src/main/resources/theme/base/login/template.ftl
index 7a277b39534b..01d802cf4782 100644
--- a/themes/src/main/resources/theme/base/login/template.ftl
+++ b/themes/src/main/resources/theme/base/login/template.ftl
@@ -47,9 +47,32 @@
         import { startSessionPolling } from "${url.resourcesPath}/js/authChecker.js";
 
         startSessionPolling(
-          "${url.ssoLoginInOtherTabsUrl?no_esc}"
+            "${url.ssoLoginInOtherTabsUrl?no_esc}"
         );
     </script>
+    <script type="module">
+        document.addEventListener("click", (event) => {
+            const link = event.target.closest("a[data-once-link]");
+
+            if (!link) {
+                return;
+            }
+
+            if (link.getAttribute("aria-disabled") === "true") {
+                event.preventDefault();
+                return;
+            }
+
+            const { disabledClass } = link.dataset;
+
+            if (disabledClass) {
+                link.classList.add(...disabledClass.trim().split(/\s+/));
+            }
+
+            link.setAttribute("role", "link");
+            link.setAttribute("aria-disabled", "true");
+        });
+    </script>
     <#if authenticationSession??>
         <script type="module">
             import { checkAuthSession } from "${url.resourcesPath}/js/authChecker.js";
@@ -61,7 +84,7 @@
     </#if>
 </head>
 
-<body class="${properties.kcBodyClass!}">
+<body class="${properties.kcBodyClass!}" data-page-id="login-${pageId}">
 <div class="${properties.kcLoginClass!}">
     <div id="kc-header" class="${properties.kcHeaderClass!}">
         <div id="kc-header-wrapper"
diff --git a/themes/src/main/resources/theme/base/login/user-profile-commons.ftl b/themes/src/main/resources/theme/base/login/user-profile-commons.ftl
index 9d5dfac23e12..0beda8900416 100644
--- a/themes/src/main/resources/theme/base/login/user-profile-commons.ftl
+++ b/themes/src/main/resources/theme/base/login/user-profile-commons.ftl
@@ -3,59 +3,65 @@
 	
 	<#list profile.attributes as attribute>
 
-		<#assign group = (attribute.group)!"">
-		<#if group != currentGroup>
-			<#assign currentGroup=group>
-			<#if currentGroup != "">
-				<div class="${properties.kcFormGroupClass!}"
-				<#list group.html5DataAnnotations as key, value>
-					data-${key}="${value}"
-				</#list>
-				>
-	
-					<#assign groupDisplayHeader=group.displayHeader!"">
-					<#if groupDisplayHeader != "">
-						<#assign groupHeaderText=advancedMsg(groupDisplayHeader)!group>
-					<#else>
-						<#assign groupHeaderText=group.name!"">
-					</#if>
-					<div class="${properties.kcContentWrapperClass!}">
-						<label id="header-${attribute.group.name}" class="${kcFormGroupHeader!}">${groupHeaderText}</label>
-					</div>
+		<#if attribute.name=='locale' && realm.internationalizationEnabled && locale.currentLanguageTag?has_content>
+			<input type="hidden" id="${attribute.name}" name="${attribute.name}" value="${locale.currentLanguageTag}"/>
+		<#else>
+
+			<#assign group = (attribute.group)!"">
+			<#if group != currentGroup>
+				<#assign currentGroup=group>
+				<#if currentGroup != "">
+					<div class="${properties.kcFormGroupClass!}"
+					<#list group.html5DataAnnotations as key, value>
+						data-${key}="${value}"
+					</#list>
+					>
 	
-					<#assign groupDisplayDescription=group.displayDescription!"">
-					<#if groupDisplayDescription != "">
-						<#assign groupDescriptionText=advancedMsg(groupDisplayDescription)!"">
-						<div class="${properties.kcLabelWrapperClass!}">
-							<label id="description-${group.name}" class="${properties.kcLabelClass!}">${groupDescriptionText}</label>
+						<#assign groupDisplayHeader=group.displayHeader!"">
+						<#if groupDisplayHeader != "">
+							<#assign groupHeaderText=advancedMsg(groupDisplayHeader)!group>
+						<#else>
+							<#assign groupHeaderText=group.name!"">
+						</#if>
+						<div class="${properties.kcContentWrapperClass!}">
+							<label id="header-${attribute.group.name}" class="${kcFormGroupHeader!}">${groupHeaderText}</label>
 						</div>
-					</#if>
-				</div>
+	
+						<#assign groupDisplayDescription=group.displayDescription!"">
+						<#if groupDisplayDescription != "">
+							<#assign groupDescriptionText=advancedMsg(groupDisplayDescription)!"">
+							<div class="${properties.kcLabelWrapperClass!}">
+								<label id="description-${group.name}" class="${properties.kcLabelClass!}">${groupDescriptionText}</label>
+							</div>
+						</#if>
+					</div>
+				</#if>
 			</#if>
-		</#if>
 
-		<#nested "beforeField" attribute>
-		<div class="${properties.kcFormGroupClass!}">
-			<div class="${properties.kcLabelWrapperClass!}">
-				<label for="${attribute.name}" class="${properties.kcLabelClass!}">${advancedMsg(attribute.displayName!'')}</label>
-				<#if attribute.required>*</#if>
-			</div>
-			<div class="${properties.kcInputWrapperClass!}">
-				<#if attribute.annotations.inputHelperTextBefore??>
-					<div class="${properties.kcInputHelperTextBeforeClass!}" id="form-help-text-before-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextBefore))?no_esc}</div>
-				</#if>
-				<@inputFieldByType attribute=attribute/>
-				<#if messagesPerField.existsError('${attribute.name}')>
-					<span id="input-error-${attribute.name}" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
-						${kcSanitize(messagesPerField.get('${attribute.name}'))?no_esc}
-					</span>
-				</#if>
-				<#if attribute.annotations.inputHelperTextAfter??>
-					<div class="${properties.kcInputHelperTextAfterClass!}" id="form-help-text-after-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextAfter))?no_esc}</div>
-				</#if>
+			<#nested "beforeField" attribute>
+			<div class="${properties.kcFormGroupClass!}">
+				<div class="${properties.kcLabelWrapperClass!}">
+					<label for="${attribute.name}" class="${properties.kcLabelClass!}">${advancedMsg(attribute.displayName!'')}</label>
+					<#if attribute.required>*</#if>
+				</div>
+				<div class="${properties.kcInputWrapperClass!}">
+					<#if attribute.annotations.inputHelperTextBefore??>
+						<div class="${properties.kcInputHelperTextBeforeClass!}" id="form-help-text-before-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextBefore))?no_esc}</div>
+					</#if>
+					<@inputFieldByType attribute=attribute/>
+					<#if messagesPerField.existsError('${attribute.name}')>
+						<span id="input-error-${attribute.name}" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+							${kcSanitize(messagesPerField.get('${attribute.name}'))?no_esc}
+						</span>
+					</#if>
+					<#if attribute.annotations.inputHelperTextAfter??>
+						<div class="${properties.kcInputHelperTextAfterClass!}" id="form-help-text-after-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextAfter))?no_esc}</div>
+					</#if>
+				</div>
 			</div>
-		</div>
-		<#nested "afterField" attribute>
+			<#nested "afterField" attribute>
+
+		</#if>
 	</#list>
 
 	<#list profile.html5DataAnnotations?keys as key>
diff --git a/themes/src/main/resources/theme/base/login/webauthn-authenticate.ftl b/themes/src/main/resources/theme/base/login/webauthn-authenticate.ftl
index 8148e8003c0f..f54cdd53855a 100644
--- a/themes/src/main/resources/theme/base/login/webauthn-authenticate.ftl
+++ b/themes/src/main/resources/theme/base/login/webauthn-authenticate.ftl
@@ -85,7 +85,7 @@
                 challenge : '${challenge}',
                 userVerification : '${userVerification}',
                 rpId : '${rpId}',
-                createTimeout : ${createTimeout},
+                createTimeout : ${createTimeout?c},
                 errmsg : "${msg("webauthn-unsupported-browser-text")?no_esc}"
             };
             authenticateByWebAuthn(input);
diff --git a/themes/src/main/resources/theme/base/login/webauthn-register.ftl b/themes/src/main/resources/theme/base/login/webauthn-register.ftl
index af4c9503949c..5799d213097f 100644
--- a/themes/src/main/resources/theme/base/login/webauthn-register.ftl
+++ b/themes/src/main/resources/theme/base/login/webauthn-register.ftl
@@ -36,7 +36,7 @@
                     authenticatorAttachment : '${authenticatorAttachment}',
                     requireResidentKey : '${requireResidentKey}',
                     userVerificationRequirement : '${userVerificationRequirement}',
-                    createTimeout : ${createTimeout},
+                    createTimeout : ${createTimeout?c},
                     excludeCredentialIds : '${excludeCredentialIds}',
                     initLabel : "${msg("webauthn-registration-init-label")?no_esc}",
                     initLabelPrompt : "${msg("webauthn-registration-init-label-prompt")?no_esc}",
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/buttons.ftl b/themes/src/main/resources/theme/keycloak.v2/login/buttons.ftl
index 90e499cc9cc1..94027975e545 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/buttons.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/buttons.ftl
@@ -1,13 +1,16 @@
-<#macro actionGroup>
+<#macro actionGroup horizontal=false>
   <div class="${properties.kcFormGroupClass}">
-    <div class="${properties.kcFormActionGroupClass}">
+    <div class="${properties.kcFormActionGroupClass} <#if horizontal>pf-v5-u-flex-nowrap<#else>pf-v5-u-flex-wrap</#if>">
       <#nested>
     </div>
   </div>
 </#macro>
 
-<#macro button label id="" name="" class=["kcButtonPrimaryClass"]>
-  <button class="<#list class as c>${properties[c]} </#list>" name="${name}" id="${id}" type="submit">${msg(label)}</button>
+<#macro button label id="" name="" class=["kcButtonPrimaryClass"] extra...>
+  <button class="<#list class as c>${properties[c]} </#list>" name="${name}" id="${id}"
+          type="submit" <#list extra as attrName, attrVal>${attrName}="${attrVal}"</#list>>
+  ${kcSanitize(msg(label))?no_esc}
+  </button>
 </#macro>
 
 <#macro buttonLink href label id="" class=["kcButtonSecondaryClass"]>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/delete-account-confirm.ftl b/themes/src/main/resources/theme/keycloak.v2/login/delete-account-confirm.ftl
index c755fad61d0c..67ba978b9d61 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/delete-account-confirm.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/delete-account-confirm.ftl
@@ -29,9 +29,9 @@
       <p class="delete-account-text">${msg("finalDeletionConfirmation")}</p>
 
       <@buttons.actionGroup>
-        <@buttons.button label="doConfirmDelete" class=["kcButtonPrimaryClass"]/>
+        <@buttons.button id="kc-submit" label="doConfirmDelete" class=["kcButtonPrimaryClass"]/>
         <#if triggered_from_aia>
-          <@buttons.button name="cancel-aia" label="doCancel" class=["kcButtonSecondaryClass"]/>
+          <@buttons.button id="kc-cancel" name="cancel-aia" label="doCancel" class=["kcButtonSecondaryClass"]/>
         </#if>
       </@buttons.actionGroup>
     </form>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/delete-credential.ftl b/themes/src/main/resources/theme/keycloak.v2/login/delete-credential.ftl
index fe6a815e862e..ab0e24862cb5 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/delete-credential.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/delete-credential.ftl
@@ -16,6 +16,6 @@
                 <@buttons.button name="accept" id="kc-accept" label="doConfirmDelete" class=["kcButtonPrimaryClass"]/>
                 <@buttons.button name="cancel-aia" id="kc-decline" label="doDecline" class=["kcButtonSecondaryClass"]/>
             </@buttons.actionGroup>
-        </form
+        </form>
     </#if>
 </@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/field.ftl b/themes/src/main/resources/theme/keycloak.v2/login/field.ftl
index db9c65fcf141..882a0e6a4620 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/field.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/field.ftl
@@ -2,8 +2,8 @@
 
 <div class="${properties.kcFormGroupClass}">
     <div class="${properties.kcFormGroupLabelClass}">
-        <label for="${name}" class="${properties.kcFormGroupLabelClass}">
-        <span class="${properties.kcFormGroupLabelTextClass}">
+        <label for="${name}" class="${properties.kcFormLabelClass}">
+        <span class="${properties.kcFormLabelTextClass}">
             ${label}
         </span>
             <#if required>
@@ -41,8 +41,7 @@
   </#if>
 </#macro>
 
-<#macro input name label value="" required=false autocomplete="off" fieldName=name autofocus=false>
-  <#assign error=kcSanitize(messagesPerField.get(fieldName))?no_esc>
+<#macro input name label value="" required=false autocomplete="off" fieldName=name error=kcSanitize(messagesPerField.get(fieldName))?no_esc autofocus=false>
   <@group name=name label=label error=error required=required>
     <span class="${properties.kcInputClass} <#if error?has_content>${properties.kcError}</#if>">
         <input id="${name}" name="${name}" value="${value}" type="text" autocomplete="${autocomplete}" <#if autofocus>autofocus</#if>
@@ -52,8 +51,7 @@
   </@group>
 </#macro>
 
-<#macro password name label value="" required=false forgotPassword=false fieldName=name autocomplete="off" autofocus=false>
-  <#assign error=kcSanitize(messagesPerField.get(fieldName))?no_esc>
+<#macro password name label value="" required=false forgotPassword=false fieldName=name error=kcSanitize(messagesPerField.get(fieldName))?no_esc autocomplete="off" autofocus=false>
   <@group name=name label=label error=error required=required>
     <div class="${properties.kcInputGroup}">
       <div class="${properties.kcInputGroupItemClass} ${properties.kcFill}">
@@ -67,22 +65,25 @@
         <button class="${properties.kcFormPasswordVisibilityButtonClass}" type="button" aria-label="${msg('showPassword')}"
                 aria-controls="${name}" data-password-toggle
                 data-icon-show="fa-eye fas" data-icon-hide="fa-eye-slash fas"
-                data-label-show="${msg('showPassword')}" data-label-hide="${msg('hidePassword')}">
+                data-label-show="${msg('showPassword')}" data-label-hide="${msg('hidePassword')}" id="${name}-show-password">
             <i class="fa-eye fas" aria-hidden="true"></i>
         </button>
       </div>
     </div>
-      <#if forgotPassword>
-        <div class="${properties.kcFormHelperTextClass}" aria-live="polite">
-            <div class="${properties.kcInputHelperTextClass}">
+    <div class="${properties.kcFormHelperTextClass}" aria-live="polite">
+        <div class="${properties.kcInputHelperTextClass}">
+            <#-- Additional helper items -->
+            <#nested>
+            <#if forgotPassword>
                 <div class="${properties.kcInputHelperTextItemClass}">
-                    <span class="${properties.kcInputHelperTextItemTextClass}">
-                        <a href="${url.loginResetCredentialsUrl}">${msg("doForgotPassword")}</a>
-                    </span>
+                  <span class="${properties.kcInputHelperTextItemTextClass}">
+                      <a href="${url.loginResetCredentialsUrl}">${msg("doForgotPassword")}</a>
+                  </span>
                 </div>
-            </div>
+            </#if>
         </div>
-      </#if>
+    </div>
+
   </@group>
 </#macro>
 
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/footer.ftl b/themes/src/main/resources/theme/keycloak.v2/login/footer.ftl
new file mode 100644
index 000000000000..0a440a30df11
--- /dev/null
+++ b/themes/src/main/resources/theme/keycloak.v2/login/footer.ftl
@@ -0,0 +1,3 @@
+<#macro content>
+<#-- The footer at the bottom of the "login-box". You can override this file in your custom theme to declare a custom login footer element -->
+</#macro>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/link-idp-action.ftl b/themes/src/main/resources/theme/keycloak.v2/login/link-idp-action.ftl
new file mode 100644
index 000000000000..ca8889d577a2
--- /dev/null
+++ b/themes/src/main/resources/theme/keycloak.v2/login/link-idp-action.ftl
@@ -0,0 +1,21 @@
+<#import "template.ftl" as layout>
+<#import "buttons.ftl" as buttons>
+
+<@layout.registrationLayout displayMessage=false; section>
+<!-- template: link-idp-action.ftl -->
+
+    <#if section = "header">
+        ${msg("linkIdpActionTitle", idpDisplayName)}
+    <#elseif section = "form">
+        <div id="kc-link-text" class="${properties.kcContentWrapperClass!}">
+            ${msg("linkIdpActionMessage", idpDisplayName)}
+        </div>
+
+        <form class="${properties.kcFormClass!}" action="${url.loginAction}" method="POST">
+            <@buttons.actionGroup>
+                <@buttons.button name="continue" id="kc-continue" label="doContinue" class=["kcButtonPrimaryClass"]/>
+                <@buttons.button name="cancel-aia" id="kc-cancel" label="doCancel" class=["kcButtonSecondaryClass"]/>
+            </@buttons.actionGroup>
+        </form
+    </#if>
+</@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-config-totp.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-config-totp.ftl
index 47a57fba36a0..81f2329854fd 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-config-totp.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-config-totp.ftl
@@ -81,7 +81,7 @@
                     </label>
                 </div>
 
-                <div class="${properties.kcInputClass!}">
+                <div class="${properties.kcInputClass!} <#if messagesPerField.existsError('userLabel')>pf-m-error</#if>">
                     <input type="text" id="userLabel" name="userLabel" autocomplete="off"
                            aria-invalid="<#if messagesPerField.existsError('userLabel')>true</#if>"
                     />
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
index 95275d5eda3b..f45aabf4c19c 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
@@ -6,7 +6,7 @@
     <#if section = "header">
         ${msg("auth-recovery-code-header")}
     <#elseif section = "form">
-        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <@field.input name="recoveryCodeInput" label=msg("auth-recovery-code-prompt", recoveryAuthnCodesInputBean.codeNumber?c) autofocus=true />
 
             <@buttons.loginButton />
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-reset-password.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-reset-password.ftl
index f67d93517189..c23c2b7c55c9 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-reset-password.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-reset-password.ftl
@@ -18,10 +18,12 @@
 
         </form>
     <#elseif section = "info" >
-        <#if realm.duplicateEmailsAllowed>
-            ${msg("emailInstructionUsername")}
-        <#else>
-            ${msg("emailInstruction")}
-        </#if>
+        <span class="${properties.kcLoginMainFooterHelperText!}">
+            <#if realm.duplicateEmailsAllowed>
+                ${msg("emailInstructionUsername")}
+            <#else>
+                ${msg("emailInstruction")}
+            </#if>
+        </span>
     </#if>
 </@layout.registrationLayout>
\ No newline at end of file
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
index 5d7b1f5c78ef..a005019f9052 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
@@ -8,7 +8,7 @@
     <#if section = "header">
         ${msg("updatePasswordTitle")}
     <#elseif section = "form">
-        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post" novalidate="novalidate">
+        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post" novalidate="novalidate">
             <@field.password name="password-new" label=msg("passwordNew") fieldName="password" autocomplete="new-password" autofocus=true />
             <@field.password name="password-confirm" label=msg("passwordConfirm") autocomplete="new-password" />
 
@@ -16,12 +16,12 @@
                 <@passwordCommons.logoutOtherSessions/>
             </div>
 
-            <@buttons.actionGroup>
+            <@buttons.actionGroup horizontal=true>
                 <#if isAppInitiatedAction??>
-                    <@buttons.button label="doSubmit" class=["kcButtonPrimaryClass"]/>
-                    <@buttons.button label="doCancel" name="cancel-aia" class=["kcButtonSecondaryClass"]/>
+                    <@buttons.button id="kc-submit" name="login" label="doSubmit" class=["kcButtonPrimaryClass"]/>
+                    <@buttons.button id="kc-cancel" label="doCancel" name="cancel-aia" class=["kcButtonSecondaryClass"]/>
                 <#else>
-                    <@buttons.button label="doSubmit" class=["kcButtonPrimaryClass", "kcButtonBlockClass"]/>
+                    <@buttons.button id="kc-submit" name="login" label="doSubmit" class=["kcButtonPrimaryClass", "kcButtonBlockClass"]/>
                 </#if>
             </@buttons.actionGroup>
         </form>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-username.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-username.ftl
index e26b8f9f4306..fb98a002aef8 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-username.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-username.ftl
@@ -2,6 +2,7 @@
 <#import "field.ftl" as field>
 <#import "buttons.ftl" as buttons>
 <#import "social-providers.ftl" as identityProviders>
+<#import "passkeys.ftl" as passkeys>
 <@layout.registrationLayout displayMessage=!messagesPerField.existsError('username') displayInfo=(realm.password && realm.registrationAllowed && !registrationDisabled??); section>
 <!-- template: login-username.ftl -->
 
@@ -18,13 +19,7 @@
                                 <#assign label>
                                     <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
                                 </#assign>
-                                <@field.input name="username" label=label value=login.username!'' autofocus=true autocomplete="username" />
-
-                                <#if messagesPerField.existsError('username')>
-                                    <span id="input-error-username" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
-                                        ${kcSanitize(messagesPerField.get('username'))?no_esc}
-                                    </span>
-                                </#if>
+                                <@field.input name="username" label=label value=login.username!'' autofocus=true autocomplete="${(enableWebAuthnConditionalUI?has_content)?then('username webauthn', 'username')}" />
                             </div>
                         </#if>
 
@@ -39,6 +34,7 @@
                 </#if>
             </div>
         </div>
+        <@passkeys.conditionalUIData />
 
     <#elseif section = "info" >
         <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login.ftl
index de456eee24a6..4d56e33b42ef 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/login.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login.ftl
@@ -2,6 +2,7 @@
 <#import "field.ftl" as field>
 <#import "buttons.ftl" as buttons>
 <#import "social-providers.ftl" as identityProviders>
+<#import "passkeys.ftl" as passkeys>
 <@layout.registrationLayout displayMessage=!messagesPerField.existsError('username','password') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
 <!-- template: login.ftl -->
 
@@ -16,35 +17,40 @@
                         <#assign label>
                             <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
                         </#assign>
-                        <@field.input name="username" label=label autofocus=true autocomplete="username" value=login.username!'' />
+                        <@field.input name="username" label=label error=kcSanitize(messagesPerField.getFirstError('username','password'))?no_esc
+                            autofocus=true autocomplete="${(enableWebAuthnConditionalUI?has_content)?then('username webauthn', 'username')}" value=login.username!'' />
+                        <@field.password name="password" label=msg("password") error="" forgotPassword=realm.resetPasswordAllowed autofocus=usernameHidden?? autocomplete="current-password">
+                            <#if realm.rememberMe && !usernameHidden??>
+                                <@field.checkbox name="rememberMe" label=msg("rememberMe") value=login.rememberMe?? />
+                            </#if>
+                        </@field.password>
+                    <#else>
+                        <@field.password name="password" label=msg("password") forgotPassword=realm.resetPasswordAllowed autofocus=usernameHidden?? autocomplete="current-password">
+                            <#if realm.rememberMe && !usernameHidden??>
+                                <@field.checkbox name="rememberMe" label=msg("rememberMe") value=login.rememberMe?? />
+                            </#if>
+                        </@field.password>
                     </#if>
 
-                    <@field.password name="password" label=msg("password") forgotPassword=realm.resetPasswordAllowed autofocus=usernameHidden?? autocomplete="current-password" />
-
-                    <div class="${properties.kcFormGroupClass!}">
-                        <#if realm.rememberMe && !usernameHidden??>
-                            <@field.checkbox name="rememberMe" label=msg("rememberMe") value=login.rememberMe?? />
-                        </#if>
-                    </div>
-
                     <input type="hidden" id="id-hidden-input" name="credentialId" <#if auth.selectedCredential?has_content>value="${auth.selectedCredential}"</#if>/>
                     <@buttons.loginButton />
                 </form>
             </#if>
             </div>
         </div>
+        <@passkeys.conditionalUIData />
+    <#elseif section = "socialProviders" >
+        <#if realm.password && social.providers?? && social.providers?has_content>
+            <@identityProviders.show social=social/>
+        </#if>
     <#elseif section = "info" >
         <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
-            <div id="kc-registration-container" class="${properties.kcLoginFooterBand!}">
-                <div id="kc-registration" class="${properties.kcLoginFooterBandItem!}">
+            <div id="kc-registration-container">
+                <div id="kc-registration">
                     <span>${msg("noAccount")} <a href="${url.registrationUrl}">${msg("doRegister")}</a></span>
                 </div>
             </div>
         </#if>
-    <#elseif section = "socialProviders" >
-        <#if realm.password && social.providers?? && social.providers?has_content>
-            <@identityProviders.show social=social/>
-        </#if>
     </#if>
 
 </@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/password-commons.ftl b/themes/src/main/resources/theme/keycloak.v2/login/password-commons.ftl
index 35ed883d3765..152da12e73ba 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/password-commons.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/password-commons.ftl
@@ -1,12 +1,8 @@
+<#import "field.ftl" as field>
 <#macro logoutOtherSessions>
     <div id="kc-form-options" class="${properties.kcFormOptionsClass!}">
-        <div class="${properties.kcFormOptionsWrapperClass!}">
-            <div class="pf-v5-c-check">
-                <input class="pf-v5-c-check__input" type="checkbox" id="logout-sessions" name="logout-sessions" value="on" checked>
-                <label class="pf-v5-c-check__label" for="logout-sessions">
-                    ${msg("logoutOtherSessions")}
-                </label>
-            </div>
+        <div class="${properties.kcFormOptionsWrapperClass!}"> 
+            <@field.checkbox name="logout-sessions" label=msg("logoutOtherSessions") value=false />
         </div>
     </div>
 </#macro>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/register.ftl b/themes/src/main/resources/theme/keycloak.v2/login/register.ftl
index a140265293d0..67cb8650f9de 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/register.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/register.ftl
@@ -42,7 +42,7 @@
                 </script>
                 <div id="kc-form-buttons" class="${properties.kcFormButtonsClass!}">
                     <button class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!} g-recaptcha"
-                            data-sitekey="${recaptchaSiteKey}" data-callback="onSubmitRecaptcha" data-action="${recaptchaAction}" type="submit">
+                            data-sitekey="${recaptchaSiteKey}" data-callback="onSubmitRecaptcha" data-action="${recaptchaAction}" type="submit" id="kc-submit">
                         ${msg("doRegister")}
                     </button>
                 </div>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/resources/css/styles.css b/themes/src/main/resources/theme/keycloak.v2/login/resources/css/styles.css
index 5fe14022230b..dbdcf7f8fa0d 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/resources/css/styles.css
+++ b/themes/src/main/resources/theme/keycloak.v2/login/resources/css/styles.css
@@ -1,8 +1,9 @@
 :root {
-    --keycloak-logo-url: url('../img/keycloak-logo-text.png');
-    --keycloak-bg-logo-url: url("../img/keycloak-bg.png");
+    --keycloak-logo-url: url('../img/keycloak-logo-text.svg');
+    --keycloak-bg-logo-url: url("../img/keycloak-bg-darken.svg");
     --keycloak-logo-height: 63px;
     --keycloak-logo-width: 300px;
+    --keycloak-card-top-color: var(--pf-v5-global--palette--blue-400);
 }
 
 .pf-v5-c-login__container {
@@ -11,6 +12,20 @@
                          "main"
 }
 
+.pf-v5-c-login__main-header {
+    border-top: 4px solid var(--keycloak-card-top-color);
+}
+
+/* Info section - top margin + bottom padding */
+.pf-v5-c-login__main-footer-band:first-child {
+    margin-block-start: var(--pf-v5-global--spacer--lg);
+}
+
+.pf-v5-c-login__main-footer-band:last-child {
+    padding-bottom: 0;
+}
+/* Info section */
+
 .login-pf body {
     background: var(--keycloak-bg-logo-url) no-repeat center center fixed;
     background-size: cover;
@@ -79,6 +94,11 @@ div.kc-logo-text span {
     overflow-wrap: break-word
 }
 
+#kc-verify-email-form {
+    margin-top: 24px;
+    margin-bottom: 24px;
+}
+
 #kc-header-wrapper {
     font-size: 29px;
     text-transform: uppercase;
@@ -94,6 +114,20 @@ hr {
     margin-bottom: var(--pf-v5-global--spacer--md);
 }
 
+#kc-social-providers svg:not(.google) {
+    filter: invert(47%) sepia(88%) saturate(7486%) hue-rotate(199deg) brightness(91%) contrast(101%);
+}
+
+#kc-social-providers svg {
+    height: var(--pf-v5-global--FontSize--xl);
+}
+
+@media (prefers-color-scheme: dark) {
+    #kc-social-providers svg:not(.google) {
+        filter: invert(54%) sepia(96%) saturate(2028%) hue-rotate(174deg) brightness(99%) contrast(97%);
+    }
+}
+
 @media (min-width: 768px) {
     div.pf-v5-c-login__main-header {
         grid-template-columns: 70% 30%;
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-bg-darken.svg b/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-bg-darken.svg
new file mode 100644
index 000000000000..54542f3811d5
--- /dev/null
+++ b/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-bg-darken.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" id="uuid-b908fabc-d9cc-4d5b-ad9c-04dc214d69f1" viewBox="0 0 2400 1350"><defs><linearGradient id="uuid-766e8756-0661-4100-ba9a-27d53b9eaf80" x1="0" x2="2404.23" y1="674.99" y2="674.99" gradientTransform="matrix(1 0 0 -1 0 1350)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-opacity=".4"/><stop offset=".37" stop-color="#020202" stop-opacity=".25"/><stop offset=".51" stop-color="#090909" stop-opacity=".2"/><stop offset=".6" stop-color="#141414" stop-opacity=".16"/><stop offset=".68" stop-color="#252525" stop-opacity=".13"/><stop offset=".75" stop-color="#3b3b3b" stop-opacity=".1"/><stop offset=".81" stop-color="#575757" stop-opacity=".08"/><stop offset=".86" stop-color="#777" stop-opacity=".06"/><stop offset=".91" stop-color="#9d9d9d" stop-opacity=".04"/><stop offset=".95" stop-color="#c8c8c8" stop-opacity=".02"/><stop offset=".99" stop-color="#f6f6f6" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="0"/></linearGradient><linearGradient id="uuid-5050948a-1585-4b56-a9d3-1522f5b4c1f9" x1=".43" x2="2396.42" y1="710.86" y2="710.86" gradientTransform="matrix(1 0 0 -.71 -.43 1315.92)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#0e0e0e" stop-opacity=".5"/><stop offset=".48" stop-color="#050505" stop-opacity=".43"/><stop offset="1" stop-opacity=".47"/></linearGradient><radialGradient id="uuid-f9de4f71-5373-4515-a652-5e23f5343279" cx="1198.42" cy="710.86" r="1430.49" fx="1198.42" fy="484.48" gradientTransform="matrix(1 0 0 -.71 -.43 1315.92)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#a0a0a0" stop-opacity="0"/><stop offset=".07" stop-color="#818181" stop-opacity=".19"/><stop offset=".16" stop-color="#535353" stop-opacity=".25"/><stop offset=".27" stop-color="#2f2f2f" stop-opacity=".32"/><stop offset=".36" stop-color="#151515" stop-opacity=".38"/><stop offset=".48" stop-color="#050505" stop-opacity=".43"/><stop offset="1" stop-opacity=".47"/></radialGradient><clipPath id="uuid-27cf1abd-5732-4359-abbd-65b586c5a8eb"><path d="M0-337.72h3000v1687.5H0z" style="stroke-width:0;fill:none"/></clipPath><style>.uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf,.uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b,.uuid-091a587a-2fd5-4296-811e-706ded9e5315,.uuid-0969eb2b-4a65-4713-bb99-261611a22424,.uuid-09b2e8ea-81c4-4d00-89ae-e1db0ceb800b,.uuid-0d32990c-6148-4bae-8f84-638d74308744,.uuid-0d4a910e-5ead-4838-b597-71994d5e44b6,.uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658,.uuid-17f0a62c-d120-4210-a2e3-c3c407298541,.uuid-1bd2f084-d6ef-4e71-a3e1-394c1f5de493,.uuid-1e436f6b-2190-4072-a833-d30583b402a8,.uuid-1f907759-78fe-49c9-adde-50142daebe8f,.uuid-1fb40790-3128-48d4-86c3-4707782e6221,.uuid-20f4978c-72ef-41f1-8b2a-3b5b1e377089,.uuid-21b08daa-3869-4f82-b379-2e1641c471da,.uuid-221f1b90-931f-435a-8641-62a3a4dbdc16,.uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9,.uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69,.uuid-2df77ddd-561d-4cf8-ad27-8c9c2d3a9fe7,.uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73,.uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf,.uuid-329adbd5-8beb-4a2a-832b-edb10b3920e8,.uuid-3548a34b-f614-4b0d-8346-15536a5e76e8,.uuid-37c058b7-0665-446c-a952-fbd02f6b75f7,.uuid-3b37f023-98e3-4292-85b8-bd745023aa9a,.uuid-3cdf4e0d-6e23-4003-8b9e-04e1000106e7,.uuid-4001db19-87d6-4868-a198-39cf945c21e7,.uuid-40fda131-3367-46ec-bc37-a78c47e53c77,.uuid-4122213a-c1ab-426d-972d-f2606dca6918,.uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3,.uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb,.uuid-4d249ed7-7ef1-4d6d-8b48-679d02608ed7,.uuid-4d579641-4004-44c8-a62b-ab07ba5970c4,.uuid-51de2d61-9a1c-4480-bec3-ff9934177e43,.uuid-54b20525-cb62-4a87-b010-d83ac07d13c9,.uuid-56d56fcf-a8cf-40dc-b540-9537c48b1260,.uuid-58a87784-78d0-4efa-8f76-994e627c2f28,.uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f,.uuid-5a74413c-040c-49ac-ae9b-ff063e1703c7,.uuid-5c3f7d87-576b-47a7-9c72-fcc7e879d540,.uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d,.uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85,.uuid-5f62157b-7e02-4924-93d8-33d343d1dc08,.uuid-618973ca-6090-4649-9b12-43cb7b5eba7c,.uuid-6436ff22-9b3f-4c2b-b766-fc35c37cdcb1,.uuid-64c7eb49-8c01-46aa-b7e6-ef2504e35ba5,.uuid-6653bb43-d0f3-484f-aeae-d1935082e430,.uuid-66ed4cbc-aae7-42f7-ada5-f1c982f52370,.uuid-6c415024-c989-499f-a7e7-2fbb5e12f644,.uuid-6dd6c5e5-d25c-41ba-b28d-bf51e043ab42,.uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543,.uuid-71d8f147-e579-47e9-8e10-d1770ddcddba,.uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5,.uuid-74ebc325-d695-4647-8ab4-c5ddf454a99a,.uuid-779befeb-4466-47e2-ae13-859d7dce8fb8,.uuid-78356180-57b7-4d60-b52b-5d41f593f4d9,.uuid-79495768-f750-42bf-ac3e-e360b6a08205,.uuid-7d37dd7c-e6da-4084-ae6f-268d2e674cac,.uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5,.uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2,.uuid-872fef29-be25-4a6a-b909-fb42b3253348,.uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663,.uuid-8cec9e48-4765-41d9-9411-f0f1fd0117b6,.uuid-8e7ca1ec-9b1a-4c26-9793-df654790f70a,.uuid-8f776032-5b85-41a0-9e26-d24a75140594,.uuid-92e8159d-4669-4c95-b071-2d1c20aec96b,.uuid-957ea116-cf81-4a12-939a-04b30fa14189,.uuid-98d636e4-8059-4223-a7a9-84a0075190da,.uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6,.uuid-a17dc9eb-5a09-4fca-bb67-46cd4f15b683,.uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880,.uuid-a3d6f061-fb22-4029-979e-1abb1494ae60,.uuid-a443fe0b-51a8-4d7f-b10c-e5e8600ac99a,.uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b,.uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837,.uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c,.uuid-ac1900bb-a504-4103-a256-9fdfd62a589f,.uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772,.uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24,.uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c,.uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1,.uuid-b3e14f59-9c7c-478b-958a-fae20679f229,.uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda,.uuid-b7693d0b-31c5-440d-bd32-cbfdc0ebe203,.uuid-ba37a829-34a0-4237-89d2-93a9802adfd5,.uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0,.uuid-bbe26c67-38ac-40f8-bdd4-e0b666628f17,.uuid-bc2496f6-1c08-431c-a748-eb317ecd2977,.uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3,.uuid-bf637be7-dc77-4591-a9a0-755607709992,.uuid-bffaa095-9eda-4db7-b18a-04d92e422d64,.uuid-c009efe1-d234-402e-b1f7-cf9ccaddd927,.uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859,.uuid-c65319c7-5805-4670-9bc3-4c8332b4be87,.uuid-ca58da73-3943-413c-8cdb-a96a32a32d4d,.uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a,.uuid-d02de2a5-a88b-4c79-9734-20dee1b75554,.uuid-d0871993-3136-4271-bd82-a17cb687dca0,.uuid-d4932d80-3dd8-487b-9032-8171b1f614ea,.uuid-d750f9af-4c99-464f-b7df-00924b081417,.uuid-d7c6f68b-2063-4b87-831e-11aabf907665,.uuid-dc73707c-322d-4485-9d51-679dc55739c3,.uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9,.uuid-dfd8668e-4302-4377-bc63-2102aba7a40f,.uuid-e6214ceb-e849-499b-bde1-70340e4c10f9,.uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d,.uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2,.uuid-e86a23c0-b6a4-412a-a93f-833ff3ef4ffe,.uuid-ec2229ee-eaa7-44f2-a716-e3da5c7316ca,.uuid-ee8784bb-8699-45a9-ada1-c167b8628fcc,.uuid-f14e6544-02f9-44d8-8663-230690aebb6e,.uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6,.uuid-f9274650-94b1-4e9d-9a6e-e460d569d058,.uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a,.uuid-fe179492-9c41-4141-9280-78efd752e1b6{stroke-width:0}.uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6{fill:#4c4c4c}.uuid-dfd8668e-4302-4377-bc63-2102aba7a40f{fill:#494949}.uuid-bc2496f6-1c08-431c-a748-eb317ecd2977{fill:#606060}.uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf{fill:#767676}.uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a{fill:#5e5e5e}.uuid-d7c6f68b-2063-4b87-831e-11aabf907665{fill:#4b4b4b}.uuid-71d8f147-e579-47e9-8e10-d1770ddcddba{fill:#7a7a7a}.uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772{fill:#787878}.uuid-d4932d80-3dd8-487b-9032-8171b1f614ea{fill:#525252}.uuid-56d56fcf-a8cf-40dc-b540-9537c48b1260{fill:#828282}.uuid-ac1900bb-a504-4103-a256-9fdfd62a589f{fill:#757575}.uuid-1bd2f084-d6ef-4e71-a3e1-394c1f5de493{fill:#4e4e4e}.uuid-8cec9e48-4765-41d9-9411-f0f1fd0117b6{fill:#4d4d4d}.uuid-221f1b90-931f-435a-8641-62a3a4dbdc16{fill:#7b7b7b}.uuid-b3e14f59-9c7c-478b-958a-fae20679f229{fill:#515151}.uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658{fill:#5c5c5c}.uuid-618973ca-6090-4649-9b12-43cb7b5eba7c{fill:#353535}.uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859{fill:#484848}.uuid-3b37f023-98e3-4292-85b8-bd745023aa9a{fill:#2a2a2a}.uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda{fill:#474747}.uuid-f9274650-94b1-4e9d-9a6e-e460d569d058{fill:#565656}.uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1{fill:#2c2c2c}.uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837{fill:#2b2b2b}.uuid-5a74413c-040c-49ac-ae9b-ff063e1703c7{fill:#292929}.uuid-20f4978c-72ef-41f1-8b2a-3b5b1e377089{fill:#5b5b5b}.uuid-fe179492-9c41-4141-9280-78efd752e1b6{fill:#636363}.uuid-dc73707c-322d-4485-9d51-679dc55739c3{fill:#646464}.uuid-0969eb2b-4a65-4713-bb99-261611a22424{fill:#555}.uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9{fill:gray}.uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b{fill:#888}.uuid-78356180-57b7-4d60-b52b-5d41f593f4d9{fill:#898989}.uuid-37c058b7-0665-446c-a952-fbd02f6b75f7{fill:#545454}.uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543{fill:#868686}.uuid-0d4a910e-5ead-4838-b597-71994d5e44b6{fill:#959595}.uuid-bf637be7-dc77-4591-a9a0-755607709992{fill:#727272}.uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d{fill:#6f6f6f}.uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3{fill:#a2a2a2}.uuid-4001db19-87d6-4868-a198-39cf945c21e7{fill:#717171}.uuid-329adbd5-8beb-4a2a-832b-edb10b3920e8{fill:#9b9b9b}.uuid-3548a34b-f614-4b0d-8346-15536a5e76e8{fill:#262626}.uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2{fill:#3b3b3b}.uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9{fill:#3a3a3a}.uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3{fill:#3d3d3d}.uuid-17f0a62c-d120-4210-a2e3-c3c407298541{fill:#393939}.uuid-40fda131-3367-46ec-bc37-a78c47e53c77{fill:#5a5a5a}.uuid-5f62157b-7e02-4924-93d8-33d343d1dc08{fill:#575757}.uuid-bffaa095-9eda-4db7-b18a-04d92e422d64{fill:#2e2e2e}.uuid-ee8784bb-8699-45a9-ada1-c167b8628fcc{fill:#1a1a1a}.uuid-09b2e8ea-81c4-4d00-89ae-e1db0ceb800b{fill:#3f3f3f}.uuid-c009efe1-d234-402e-b1f7-cf9ccaddd927{fill:#0a0a0a}.uuid-7d37dd7c-e6da-4084-ae6f-268d2e674cac{fill:#191919}.uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6{fill:#444}.uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb{fill:#373737}.uuid-6436ff22-9b3f-4c2b-b766-fc35c37cdcb1{fill:#111}.uuid-4d249ed7-7ef1-4d6d-8b48-679d02608ed7{fill:#1c1c1c}.uuid-0d32990c-6148-4bae-8f84-638d74308744{fill:#1d1d1d}.uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0{fill:#424242}.uuid-54b20525-cb62-4a87-b010-d83ac07d13c9{fill:#404040}.uuid-6dd6c5e5-d25c-41ba-b28d-bf51e043ab42{fill:#141414}.uuid-e86a23c0-b6a4-412a-a93f-833ff3ef4ffe{fill:#434343}.uuid-e6214ceb-e849-499b-bde1-70340e4c10f9{fill:#212121}.uuid-74ebc325-d695-4647-8ab4-c5ddf454a99a{fill:#202020}.uuid-d750f9af-4c99-464f-b7df-00924b081417{fill:#222}.uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2{fill:#1f1f1f}.uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f{fill:#1e1e1e}.uuid-3cdf4e0d-6e23-4003-8b9e-04e1000106e7{fill:#161616}.uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880{fill:#242424}.uuid-4d579641-4004-44c8-a62b-ab07ba5970c4{fill:#c4c4c4}.uuid-1fb40790-3128-48d4-86c3-4707782e6221{fill:#cacaca}.uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69{fill:#ccc}.uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c{fill:#c6c6c6}.uuid-8e7ca1ec-9b1a-4c26-9793-df654790f70a{fill:#c8c8c8}.uuid-f14e6544-02f9-44d8-8663-230690aebb6e{fill:#bebebe}.uuid-b7693d0b-31c5-440d-bd32-cbfdc0ebe203{fill:#bdbdbd}.uuid-6653bb43-d0f3-484f-aeae-d1935082e430{fill:#a5a5a5}.uuid-64c7eb49-8c01-46aa-b7e6-ef2504e35ba5{fill:#aeaeae}.uuid-c65319c7-5805-4670-9bc3-4c8332b4be87{fill:#b0b0b0}.uuid-957ea116-cf81-4a12-939a-04b30fa14189{fill:#a7a7a7}.uuid-21b08daa-3869-4f82-b379-2e1641c471da{fill:#aaa}.uuid-a443fe0b-51a8-4d7f-b10c-e5e8600ac99a{fill:#a9a9a9}.uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5{fill:#acacac}.uuid-a17dc9eb-5a09-4fca-bb67-46cd4f15b683{fill:#a6a6a6}.uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d{fill:#939393}.uuid-bbe26c67-38ac-40f8-bdd4-e0b666628f17{fill:#b4b4b4}.uuid-4122213a-c1ab-426d-972d-f2606dca6918{fill:#b8b8b8}.uuid-6c415024-c989-499f-a7e7-2fbb5e12f644{fill:#8a8a8a}.uuid-79495768-f750-42bf-ac3e-e360b6a08205{fill:#b5b5b5}.uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c{fill:#9d9d9d}.uuid-8f776032-5b85-41a0-9e26-d24a75140594{fill:#9e9e9e}.uuid-a3d6f061-fb22-4029-979e-1abb1494ae60{fill:#b9b9b9}.uuid-66ed4cbc-aae7-42f7-ada5-f1c982f52370{fill:#c2c2c2}.uuid-1f907759-78fe-49c9-adde-50142daebe8f{fill:#8f8f8f}.uuid-ca58da73-3943-413c-8cdb-a96a32a32d4d{fill:#c1c1c1}.uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24{fill:#737373}.uuid-58a87784-78d0-4efa-8f76-994e627c2f28{fill:#303030}.uuid-51de2d61-9a1c-4480-bec3-ff9934177e43{fill:#323232}.uuid-92e8159d-4669-4c95-b071-2d1c20aec96b{fill:#bababa}.uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a{fill:#333}.uuid-ba37a829-34a0-4237-89d2-93a9802adfd5{fill:#8d8d8d}.uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73{fill:#8e8e8e}.uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663{fill:#6c6c6c}.uuid-1e436f6b-2190-4072-a833-d30583b402a8{fill:#989898}.uuid-2df77ddd-561d-4cf8-ad27-8c9c2d3a9fe7{fill:#7c7c7c}.uuid-d0871993-3136-4271-bd82-a17cb687dca0{fill:#a1a1a1}.uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b{fill:#929292}.uuid-5c3f7d87-576b-47a7-9c72-fcc7e879d540{fill:#a0a0a0}.uuid-98d636e4-8059-4223-a7a9-84a0075190da{fill:#848484}.uuid-d02de2a5-a88b-4c79-9734-20dee1b75554{fill:#7d7d7d}.uuid-779befeb-4466-47e2-ae13-859d7dce8fb8{fill:#7f7f7f}.uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf{fill:#818181}.uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85{fill:#686868}.uuid-872fef29-be25-4a6a-b909-fb42b3253348{fill:#656565}.uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5{fill:#676767}.uuid-091a587a-2fd5-4296-811e-706ded9e5315{fill:#6a6a6a}.uuid-ec2229ee-eaa7-44f2-a716-e3da5c7316ca{fill:#696969}</style></defs><g style="clip-path:url(#uuid-27cf1abd-5732-4359-abbd-65b586c5a8eb)"><path d="M0 .03h266.75v84.38H0zM266.75.03H533.5v84.38H266.75z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M533.38.03h266.75v42.25H533.38z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M533.38 42.16h266.75v42.25H533.38z" class="uuid-8e7ca1ec-9b1a-4c26-9793-df654790f70a"/><path d="M800.12.03h266.75v42.25H800.12z" class="uuid-66ed4cbc-aae7-42f7-ada5-f1c982f52370"/><path d="M800.12 42.16h266.75v42.25H800.12z" class="uuid-a3d6f061-fb22-4029-979e-1abb1494ae60"/><path d="M1066.75.03h266.75v84.38h-266.75z" class="uuid-64c7eb49-8c01-46aa-b7e6-ef2504e35ba5"/><path d="M1333.5.03h266.75v84.38H1333.5z" class="uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b"/><path d="M1600.25.03H1867v84.38h-266.75z" class="uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543"/><path d="M1866.88.03h266.75v84.38h-266.75z" class="uuid-4001db19-87d6-4868-a198-39cf945c21e7"/><path d="M2133.63.03h266.75v84.38h-266.75z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="M0 84.41h266.75v84.38H0zM266.75 84.41H533.5v84.38H266.75z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M533.38 84.41h266.75v84.38H533.38z" class="uuid-1fb40790-3128-48d4-86c3-4707782e6221"/><path d="M800.12 84.41h266.75v84.38H800.12z" class="uuid-79495768-f750-42bf-ac3e-e360b6a08205"/><path d="M1066.75 84.41h266.75v84.38h-266.75z" class="uuid-957ea116-cf81-4a12-939a-04b30fa14189"/><path d="M1333.5 84.41h266.75v84.38H1333.5z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M1600.25 84.41H1867v84.38h-266.75z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="M1866.88 84.41h266.75v84.38h-266.75z" class="uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85"/><path d="M2133.63 84.41v84.38H2267V84.41z" class="uuid-d4932d80-3dd8-487b-9032-8171b1f614ea"/><path d="M2267 84.41v84.38h133.37V84.41z" class="uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859"/><path d="M0 168.78h266.75v84.38H0zM266.75 168.78H533.5v42.25H266.75z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M266.75 210.91H533.5v42.25H266.75zm266.63-42.13h266.75v42.25H533.38z" class="uuid-1fb40790-3128-48d4-86c3-4707782e6221"/><path d="M533.38 210.91h266.75v42.25H533.38z" style="stroke-width:0;fill:#c3c3c3"/><path d="M800.12 168.78h266.75v84.38H800.12z" class="uuid-79495768-f750-42bf-ac3e-e360b6a08205"/><path d="M1066.75 168.78h266.75v84.38h-266.75z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="M1333.5 168.78h266.75v84.38H1333.5z" class="uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d"/><path d="M1600.25 168.78H1867v84.38h-266.75z" class="uuid-221f1b90-931f-435a-8641-62a3a4dbdc16"/><path d="M1866.88 168.78v84.38h133.37v-84.38z" class="uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85"/><path d="M2000.25 168.78v84.38h133.37v-84.38z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="M2133.63 168.78v84.38H2267v-84.38z" class="uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859"/><path d="M2267 168.78v84.38h133.37v-84.38z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="M0 253.16h266.75v42.25H0zm0 42.13h266.75v42.25H0z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M266.75 253.16H533.5v42.25H266.75z" class="uuid-4d579641-4004-44c8-a62b-ab07ba5970c4"/><path d="M266.75 295.28H533.5v42.25H266.75z" class="uuid-b7693d0b-31c5-440d-bd32-cbfdc0ebe203"/><path d="M533.38 253.16v84.38h133.38v-84.38z" class="uuid-92e8159d-4669-4c95-b071-2d1c20aec96b"/><path d="M666.75 253.16v84.38h133.38v-84.38z" class="uuid-bbe26c67-38ac-40f8-bdd4-e0b666628f17"/><path d="M800.12 253.16v84.38H933.5v-84.38z" class="uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5"/><path d="M933.5 253.16h133.38v42.25H933.5z" class="uuid-6653bb43-d0f3-484f-aeae-d1935082e430"/><path d="M933.5 295.28h133.38v42.25H933.5z" class="uuid-d0871993-3136-4271-bd82-a17cb687dca0"/><path d="M1066.75 253.16h133.38v42.25h-133.38z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="M1066.75 295.28h133.38v42.25h-133.38z" class="uuid-0d4a910e-5ead-4838-b597-71994d5e44b6"/><path d="M1200.12 253.16v84.38h133.37v-84.38z" class="uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b"/><path d="M1333.5 253.16h266.75v84.38H1333.5z" class="uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b"/><path d="M1600.25 253.16H1867v84.38h-266.75z" class="uuid-221f1b90-931f-435a-8641-62a3a4dbdc16"/><path d="M1866.88 253.16h266.75v84.38h-266.75z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="M2133.63 253.16h266.75v84.38h-266.75z" class="uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6"/><path d="M0 337.53h266.75v84.38H0z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M266.75 337.53H533.5v84.38H266.75z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="M533.38 337.53v84.38h133.38v-84.38z" class="uuid-bbe26c67-38ac-40f8-bdd4-e0b666628f17"/><path d="M666.75 337.53h133.38v42.25H666.75z" style="stroke-width:0;fill:#b1b1b1"/><path d="M666.75 379.66h133.38v42.25H666.75z" class="uuid-64c7eb49-8c01-46aa-b7e6-ef2504e35ba5"/><path d="M800.12 337.53H933.5v42.25H800.12z" class="uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5"/><path d="M800.12 379.66H933.5v42.25H800.12z" class="uuid-a17dc9eb-5a09-4fca-bb67-46cd4f15b683"/><path d="M933.5 337.53v84.38h133.38v-84.38z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="M1066.75 337.53h266.75v84.38h-266.75z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M1333.5 337.53h266.75v42.25H1333.5z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="M1333.5 379.66h266.75v42.25H1333.5z" class="uuid-71d8f147-e579-47e9-8e10-d1770ddcddba"/><path d="M1600.25 337.53H1867v42.25h-266.75z" class="uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d"/><path d="M1600.25 379.66H1867v42.25h-266.75z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="M1866.88 337.53v84.38h133.37v-84.38z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="M2000.25 337.53v84.38h133.37v-84.38z" class="uuid-8cec9e48-4765-41d9-9411-f0f1fd0117b6"/><path d="M2133.63 337.53H2267v42.25h-133.37z" class="uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6"/><path d="M2133.63 379.66H2267v42.25h-133.37z" class="uuid-09b2e8ea-81c4-4d00-89ae-e1db0ceb800b"/><path d="M2267 337.53h133.37v42.25H2267z" class="uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2"/><path d="M2267 379.66h133.37v42.25H2267z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="M0 421.91h266.75v84.38H0z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M266.75 421.91H533.5v42.25H266.75zm0 42.13H533.5v42.25H266.75z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="M533.38 421.91h266.75v42.25H533.38z" class="uuid-c65319c7-5805-4670-9bc3-4c8332b4be87"/><path d="M533.38 464.03h266.75v42.25H533.38z" class="uuid-a443fe0b-51a8-4d7f-b10c-e5e8600ac99a"/><path d="M800.12 421.91h266.75v84.38H800.12z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="M1066.75 421.91h266.75v84.38h-266.75z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M1333.5 421.91h266.75v84.38H1333.5z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="M1600.25 421.91H1867v42.25h-266.75zm0 42.13H1867v42.25h-266.75z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M1866.88 421.91h133.37v42.25h-133.37z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="M1866.88 464.03h133.37v42.25h-133.37z" class="uuid-d4932d80-3dd8-487b-9032-8171b1f614ea"/><path d="M2000.25 421.91v84.38h133.37v-84.38z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="M2133.63 421.91v84.38H2267v-84.38z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="M2267 421.91h133.37v42.25H2267z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="M2267 464.03h133.37v42.25H2267z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="M0 506.28h266.75v42.25H0z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M0 548.41h266.75v42.25H0z" class="uuid-ca58da73-3943-413c-8cdb-a96a32a32d4d"/><path d="M266.75 506.28H533.5v42.25H266.75z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="M266.75 548.41H533.5v42.25H266.75z" style="stroke-width:0;fill:#b3b3b3"/><path d="M533.38 506.28h266.75v84.38H533.38z" class="uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3"/><path d="M800.12 506.28h266.75v42.25H800.12zm0 42.13h266.75v42.25H800.12z" class="uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d"/><path d="M1066.75 506.28h266.75v42.25h-266.75z" class="uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73"/><path d="M1066.75 548.41h266.75v42.25h-266.75z" class="uuid-6c415024-c989-499f-a7e7-2fbb5e12f644"/><path d="M1333.5 506.28h266.75v42.25H1333.5z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="M1333.5 548.41h266.75v42.25H1333.5z" style="stroke-width:0;fill:#6e6e6e"/><path d="M1600.25 506.28H1867v42.25h-266.75z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M1600.25 548.41H1867v42.25h-266.75z" class="uuid-37c058b7-0665-446c-a952-fbd02f6b75f7"/><path d="M1866.88 506.28h266.75v21.13h-266.75z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="M1866.88 527.28h266.75v21.13h-266.75z" class="uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda"/><path d="M1866.88 548.41h266.75v21.13h-266.75z" class="uuid-e86a23c0-b6a4-412a-a93f-833ff3ef4ffe"/><path d="M1866.88 569.53h266.75v21.13h-266.75z" class="uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0"/><path d="M2133.63 506.28h266.75v42.25h-266.75z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="M2133.63 548.41h266.75v42.25h-266.75z" style="stroke-width:0;fill:#343434"/><path d="M0 590.66h266.75v42.25H0z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="M0 632.78h266.75v42.25H0z" class="uuid-a443fe0b-51a8-4d7f-b10c-e5e8600ac99a"/><path d="M266.75 590.66v84.38H400v-84.38z" class="uuid-21b08daa-3869-4f82-b379-2e1641c471da"/><path d="M400 590.66h133.38v42.25H400z" class="uuid-a17dc9eb-5a09-4fca-bb67-46cd4f15b683"/><path d="M400 632.78h133.38v42.25H400z" class="uuid-5c3f7d87-576b-47a7-9c72-fcc7e879d540"/><path d="M533.38 590.66h133.38v42.25H533.38z" class="uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3"/><path d="M533.38 632.78h133.38v42.25H533.38z" class="uuid-1e436f6b-2190-4072-a833-d30583b402a8"/><path d="M666.75 590.66h133.38v42.25H666.75z" class="uuid-329adbd5-8beb-4a2a-832b-edb10b3920e8"/><path d="M666.75 632.78h133.38v42.25H666.75zm133.37-42.13v84.38H933.5v-84.38z" class="uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d"/><path d="M933.5 590.66h133.38v42.25H933.5z" style="stroke-width:0;fill:#8b8b8b"/><path d="M933.5 632.78h133.38v42.25H933.5z" class="uuid-56d56fcf-a8cf-40dc-b540-9537c48b1260"/><path d="M1066.75 590.66h266.75v42.25h-266.75z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="M1066.75 632.78h266.75v42.25h-266.75z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="M1333.5 590.66h266.75v84.38H1333.5z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="M1600.25 590.66H1867v84.38h-266.75z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="M1866.88 590.66h266.75v84.38h-266.75z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="M2133.63 590.66h266.75v84.38h-266.75z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="M0 675.03h266.75v84.38H0z" class="uuid-8f776032-5b85-41a0-9e26-d24a75140594"/><path d="M266.75 675.03v84.38H400v-84.38z" class="uuid-d0871993-3136-4271-bd82-a17cb687dca0"/><path d="M400 675.03v84.38h133.38v-84.38z" class="uuid-1e436f6b-2190-4072-a833-d30583b402a8"/><path d="M533.38 675.03h266.75v84.38H533.38z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M800.12 675.03v84.38H933.5v-84.38z" class="uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b"/><path d="M933.5 675.03v84.38h133.38v-84.38z" class="uuid-221f1b90-931f-435a-8641-62a3a4dbdc16"/><path d="M1066.75 675.03h266.75v84.38h-266.75z" class="uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663"/><path d="M1333.5 675.03h266.75v42.25H1333.5z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M1333.5 717.16h266.75v42.25H1333.5z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="M1600.25 675.03H1867v42.25h-266.75z" class="uuid-37c058b7-0665-446c-a952-fbd02f6b75f7"/><path d="M1600.25 717.16H1867v42.25h-266.75z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="M1866.88 675.03h266.75v42.25h-266.75z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="M1866.88 717.16h266.75v42.25h-266.75z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="M2133.63 675.03h266.75v42.25h-266.75z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="M2133.63 717.16h266.75v42.25h-266.75z" class="uuid-3b37f023-98e3-4292-85b8-bd745023aa9a"/><path d="M0 759.41h266.75v42.25H0z" class="uuid-8f776032-5b85-41a0-9e26-d24a75140594"/><path d="M0 801.53h266.75v42.25H0zm266.75-42.12H533.5v42.25H266.75z" class="uuid-1e436f6b-2190-4072-a833-d30583b402a8"/><path d="M266.75 801.53H533.5v42.25H266.75zm266.63-42.12h266.75v42.25H533.38z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M533.38 801.53h266.75v42.25H533.38z" class="uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543"/><path d="M800.12 759.41v84.38h66.62v-84.38z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="M866.75 759.41v84.38h66.62v-84.38z" class="uuid-71d8f147-e579-47e9-8e10-d1770ddcddba"/><path d="M933.5 759.41h133.38v42.25H933.5z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="M933.5 801.53h133.38v42.25H933.5z" class="uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24"/><path d="M1066.75 759.41h266.75v42.25h-266.75z" class="uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663"/><path d="M1066.75 801.53h266.75v42.25h-266.75z" class="uuid-872fef29-be25-4a6a-b909-fb42b3253348"/><path d="M1333.5 759.41h266.75v84.38H1333.5z" class="uuid-b3e14f59-9c7c-478b-958a-fae20679f229"/><path d="M1600.25 759.41H1867v84.38h-266.75z" class="uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0"/><path d="M1866.88 759.41h266.75v84.38h-266.75z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="M2133.63 759.41h266.75v84.38h-266.75z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="M0 843.78h266.75v42.25H0z" class="uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73"/><path d="M0 885.91h266.75v42.25H0z" class="uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543"/><path d="M266.75 843.78v84.38H400v-84.38z" class="uuid-98d636e4-8059-4223-a7a9-84a0075190da"/><path d="M400 843.78v84.38h133.38v-84.38z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="M533.38 843.78h266.75v21.12H533.38z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="M533.38 864.78h266.75v21.12H533.38z" class="uuid-221f1b90-931f-435a-8641-62a3a4dbdc16"/><path d="M533.38 885.91h266.75v21.12H533.38z" class="uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772"/><path d="M533.38 907.03h266.75v21.12H533.38z" style="stroke-width:0;fill:#777"/><path d="M800.12 843.78h66.62v21.12h-66.62z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="M800.12 864.78h66.62v21.12h-66.62zm66.63-21h66.62v21.12h-66.62z" class="uuid-71d8f147-e579-47e9-8e10-d1770ddcddba"/><path d="M866.75 864.78h66.62v21.12h-66.62z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="M800.12 885.91H933.5v21.12H800.12z" class="uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d"/><path d="M800.12 907.03H933.5v21.12H800.12z" class="uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5"/><path d="M933.5 843.78h133.38v42.25H933.5z" class="uuid-4001db19-87d6-4868-a198-39cf945c21e7"/><path d="M933.5 885.91h133.38v42.25H933.5z" class="uuid-ec2229ee-eaa7-44f2-a716-e3da5c7316ca"/><path d="M1066.75 843.78h266.75v84.38h-266.75z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="M1333.5 843.78h266.75v84.38H1333.5z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="M1600.25 843.78v84.38h133.37v-84.38z" class="uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0"/><path d="M1733.5 843.78v84.38h133.37v-84.38z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="M1866.88 843.78h266.75v42.25h-266.75zm0 42.12h266.75v42.25h-266.75z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="M2133.63 843.78H2267v42.25h-133.37z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="M2133.63 885.91H2267v42.25h-133.37z" class="uuid-d750f9af-4c99-464f-b7df-00924b081417"/><path d="M2267 843.78h133.37v42.25H2267z" class="uuid-e6214ceb-e849-499b-bde1-70340e4c10f9"/><path d="M2267 885.91h133.37v42.25H2267z" class="uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f"/><path d="M0 928.16h266.75v84.38H0z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="M266.75 928.16v84.38H400v-84.38z" class="uuid-98d636e4-8059-4223-a7a9-84a0075190da"/><path d="M400 928.16v84.38h133.38v-84.38z" class="uuid-779befeb-4466-47e2-ae13-859d7dce8fb8"/><path d="M533.38 928.16h266.75v84.38H533.38z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="M800.12 928.16v84.38H933.5v-84.38z" class="uuid-fe179492-9c41-4141-9280-78efd752e1b6"/><path d="M933.5 928.16v84.38h133.38v-84.38z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="M1066.75 928.16h266.75v42.25h-266.75z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="M1066.75 970.28h266.75v42.25h-266.75z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M1333.5 928.16h266.75v42.25H1333.5z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="M1333.5 970.28h266.75v42.25H1333.5z" class="uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6"/><path d="M1600.25 928.16H1867v42.25h-266.75z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="M1600.25 970.28H1867v42.25h-266.75z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="M1866.88 928.16h266.75v42.25h-266.75z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="M1866.88 970.28h266.75v42.25h-266.75z" class="uuid-3b37f023-98e3-4292-85b8-bd745023aa9a"/><path d="M2133.63 928.16h266.75v84.38h-266.75z" class="uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f"/><path d="M0 1012.53h266.75v42.25H0zm0 42.12h266.75v42.25H0z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="M266.75 1012.53H400v42.25H266.75z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="M266.75 1054.66H400v42.25H266.75zM400 1012.54h133.38v42.25H400z" class="uuid-2df77ddd-561d-4cf8-ad27-8c9c2d3a9fe7"/><path d="M400 1054.66h133.38v42.25H400z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="M533.38 1012.53h266.75v42.25H533.38z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="M533.38 1054.66h266.75v42.25H533.38z" class="uuid-091a587a-2fd5-4296-811e-706ded9e5315"/><path d="M800.12 1012.53h266.75v84.38H800.12z" class="uuid-fe179492-9c41-4141-9280-78efd752e1b6"/><path d="M1066.75 1012.53h266.75v84.38h-266.75z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="M1333.5 1012.53h266.75v84.38H1333.5z" class="uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3"/><path d="M1600.25 1012.53H1867v84.38h-266.75z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="M1866.88 1012.53h266.75v84.38h-266.75z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="M2133.63 1012.53h266.75v84.38h-266.75z" class="uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f"/><path d="M0 1096.91h133.37v42.25H0z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="M0 1139.03h133.37v42.25H0z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="M133.37 1096.91h133.37v42.25H133.37z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="M133.37 1139.03h133.37v21.12H133.37z" class="uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d"/><path d="M133.37 1160.16h133.37v21.12H133.37z" class="uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85"/><path d="M266.75 1096.91H533.5v42.25H266.75z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="M266.75 1139.03H533.5v42.25H266.75z" class="uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5"/><path d="M533.38 1096.91v84.38h133.38v-84.38z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="M666.75 1096.91v84.38h133.38v-84.38z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M800.12 1096.91h266.75v84.38H800.12z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="M1066.75 1096.91h266.75v84.38h-266.75z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="M1333.5 1096.91h266.75v84.38H1333.5z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="M1600.25 1096.91h133.37v42.25h-133.37z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="M1600.25 1139.03h133.37v42.25h-133.37z" class="uuid-58a87784-78d0-4efa-8f76-994e627c2f28"/><path d="M1733.5 1096.91h133.37v42.25H1733.5z" class="uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1"/><path d="M1733.5 1139.03h133.37v42.25H1733.5z" class="uuid-3b37f023-98e3-4292-85b8-bd745023aa9a"/><path d="M1866.88 1096.91h266.75v42.25h-266.75z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="M1866.88 1139.03h266.75v42.25h-266.75z" class="uuid-d750f9af-4c99-464f-b7df-00924b081417"/><path d="M2133.63 1096.91h266.75v42.25h-266.75z" class="uuid-ee8784bb-8699-45a9-ada1-c167b8628fcc"/><path d="M2133.63 1139.03h266.75v42.25h-266.75z" class="uuid-6dd6c5e5-d25c-41ba-b28d-bf51e043ab42"/><path d="M0 1181.28h133.37v42.25H0z" class="uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772"/><path d="M0 1223.41h133.37v21.12H0z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="M0 1244.53h133.37v21.13H0z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="M133.37 1181.28v84.37h133.37v-84.37z" class="uuid-fe179492-9c41-4141-9280-78efd752e1b6"/><path d="M266.75 1181.28v84.37H400v-84.37z" class="uuid-20f4978c-72ef-41f1-8b2a-3b5b1e377089"/><path d="M400 1181.28h133.38v42.25H400z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="M400 1223.41h133.38v42.25H400z" style="stroke-width:0;fill:#595959"/><path d="M533.38 1181.28h133.38v42.25H533.38z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="M533.38 1223.41h133.38v42.25H533.38z" class="uuid-f9274650-94b1-4e9d-9a6e-e460d569d058"/><path d="M666.75 1181.28h133.38v42.25H666.75z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="M666.75 1223.41h133.38v42.25H666.75z" class="uuid-d4932d80-3dd8-487b-9032-8171b1f614ea"/><path d="M800.12 1181.28h266.75v84.37H800.12z" class="uuid-b3e14f59-9c7c-478b-958a-fae20679f229"/><path d="M1066.75 1181.28h266.75v84.37h-266.75z" class="uuid-e86a23c0-b6a4-412a-a93f-833ff3ef4ffe"/><path d="M1333.5 1181.28h266.75v84.37H1333.5z" class="uuid-51de2d61-9a1c-4480-bec3-ff9934177e43"/><path d="M1600.25 1181.28H1867v84.37h-266.75z" class="uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1"/><path d="M1866.88 1181.28h266.75v84.37h-266.75z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="M2133.63 1181.28h266.75v84.37h-266.75z" class="uuid-6436ff22-9b3f-4c2b-b766-fc35c37cdcb1"/><path d="M0 1265.66h133.37v42.13H0zm0 42.13h133.37v42.25H0z" class="uuid-f9274650-94b1-4e9d-9a6e-e460d569d058"/><path d="M133.37 1265.66h133.37v42.13H133.37z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="M133.37 1307.78h133.37v42.25H133.37z" class="uuid-0969eb2b-4a65-4713-bb99-261611a22424"/><path d="M266.75 1265.66H400v42.13H266.75z" class="uuid-20f4978c-72ef-41f1-8b2a-3b5b1e377089"/><path d="M266.75 1307.78H400v42.25H266.75z" class="uuid-f9274650-94b1-4e9d-9a6e-e460d569d058"/><path d="M400 1265.66v84.38h133.38v-84.38z" class="uuid-0969eb2b-4a65-4713-bb99-261611a22424"/><path d="M533.38 1265.66v84.38h133.38v-84.38z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="M666.75 1265.66v84.38h133.38v-84.38z" class="uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859"/><path d="M800.12 1265.66h266.75v84.38H800.12z" class="uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda"/><path d="M1066.75 1265.66h266.75v84.38h-266.75z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="M1333.5 1265.66h266.75v84.38H1333.5z" class="uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837"/><path d="M1600.25 1265.66v84.38h133.37v-84.38z" class="uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880"/><path d="M1733.5 1265.66h133.37v42.13H1733.5z" class="uuid-e6214ceb-e849-499b-bde1-70340e4c10f9"/><path d="M1733.5 1307.78h133.37v42.25H1733.5z" class="uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f"/><path d="M1866.88 1265.66h266.75v42.13h-266.75z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="M1866.88 1307.78h266.75v42.25h-266.75z" class="uuid-4d249ed7-7ef1-4d6d-8b48-679d02608ed7"/><path d="M2133.63 1265.66H2267v42.13h-133.37z" class="uuid-3cdf4e0d-6e23-4003-8b9e-04e1000106e7"/><path d="M2133.63 1307.78H2267v42.25h-133.37z" style="stroke-width:0;fill:#121212"/><path d="M2267 1265.66h133.37v42.13H2267z" style="stroke-width:0;fill:#0e0e0e"/><path d="M2267 1307.78h133.37v42.25H2267z" class="uuid-c009efe1-d234-402e-b1f7-cf9ccaddd927"/></g><path d="m2339.9 528.61 60.1 184.4v-233.1z" class="uuid-5a74413c-040c-49ac-ae9b-ff063e1703c7"/><path d="m2311.5 1150.31 88.5 37.4v-176.7z" style="stroke-width:0;fill:#0f0f0f"/><path d="m2349 0-44.1 9.5 95.1 81.6V0z" class="uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3"/><path d="m2262.3 838.91 137.7 89.5v-202.6z" class="uuid-0d32990c-6148-4bae-8f84-638d74308744"/><path d="m2285.3 1013.81 26.2 136.6 88.5-139.3v-43.5z" class="uuid-6dd6c5e5-d25c-41ba-b28d-bf51e043ab42"/><path d="m2318.6 0-13.7 9.5L2349 0z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="m2278.7 235.71 121.3 83.1v-122z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="m2278.7 235.71 121.3-39V91.11l-95.1-81.6z" class="uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3"/><path d="m2302.1 0 2.8 9.5 13.7-9.5z" class="uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859"/><path d="m2285.3 679.41 114.7 42.5v-8.9l-60.1-184.4z" style="stroke-width:0;fill:#272727"/><path d="M2361.4 1350.01h38.6v-60.2l-65.6-19.2z" class="uuid-0d32990c-6148-4bae-8f84-638d74308744"/><path d="m2285.3 1013.81 114.7-46.2v-39.1l-137.7-89.6z" class="uuid-7d37dd7c-e6da-4084-ae6f-268d2e674cac"/><path d="m2334.4 1270.61 65.6 19.2v-61.3z" class="uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2"/><path d="m2334.4 1270.61 65.6-42.1v-40.7l-88.5-37.4z" class="uuid-c009efe1-d234-402e-b1f7-cf9ccaddd927"/><path d="m2286.4 362.51 113.6 111.5v-124.6z" class="uuid-51de2d61-9a1c-4480-bec3-ff9934177e43"/><path d="m2286.4 362.51 113.6-13.1v-30.6l-121.3-83.1z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="m2150.9 1302.21 22.6 47.8h142.9l18.1-79.4z" class="uuid-e6214ceb-e849-499b-bde1-70340e4c10f9"/><path d="m2339.9 528.61 60.1-48.7v-5.9l-113.6-111.5z" class="uuid-58a87784-78d0-4efa-8f76-994e627c2f28"/><path d="m2262.3 838.91 137.7-113.1v-3.9l-114.7-42.5z" style="stroke-width:0;fill:#232323"/><path d="M2316.4 1350.01h45l-26.9-79.4z" class="uuid-ee8784bb-8699-45a9-ada1-c167b8628fcc"/><path d="M2152.6 1350.01h20.9l-22.6-47.8z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="m2147.6 70.71 131.1 165 26.2-226.2z" style="stroke-width:0;fill:#464646"/><path d="m2311.5 1150.31-160.6 151.9 183.6-31.7z" style="stroke-width:0;fill:#0b0b0b"/><path d="m2286.4 362.51-200 197.8 253.5-31.7z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="m2086.4 560.31 198.9 119.1 54.6-150.8z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="m2147.6 70.71-24 103.8 155.2 61.2z" class="uuid-c1a6a84c-52ec-455f-9d45-ca5fbeb8f859"/><path d="m2262.3 838.91-173.8 31.7 196.7 143.2z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="m2106.1 736.21 156.2 102.7 22.9-159.5z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="m2079.8 377.81 6.6 182.5 200-197.8z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="m2181.1 0-33.5 70.7L2305 9.5l-2.8-9.5z" class="uuid-1bd2f084-d6ef-4e71-a3e1-394c1f5de493"/><path d="m2285.3 1013.81-180.3 102.7 206.5 33.9z" style="stroke-width:0;fill:#151515"/><path d="m2105 1116.51 45.9 185.8 160.6-151.9z" class="uuid-6436ff22-9b3f-4c2b-b766-fc35c37cdcb1"/><path d="m2154 0-6.4 70.7L2181.1 0z" class="uuid-37c058b7-0665-446c-a952-fbd02f6b75f7"/><path d="m2123.5 174.51-43.7 203.3 198.9-142.1z" class="uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6"/><path d="m2079.8 1061.81 25.1 54.6 180.3-102.7z" class="uuid-ee8784bb-8699-45a9-ada1-c167b8628fcc"/><path d="m2088.6 870.61-8.7 191.2 205.4-48.1z" class="uuid-597f4963-eefb-42da-bfa9-c4fd02cabd4f"/><path d="m2086.4 560.31 19.7 175.9 179.2-56.8z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="m2278.7 235.71-198.9 142.1 206.5-15.3z" class="uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2"/><path d="m2106.1 736.21-17.5 134.4 173.8-31.7z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="m1998.6 0 149 70.7-62-70.7z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="m2105 1116.51-116.9 50.3 162.8 135.5z" class="uuid-3cdf4e0d-6e23-4003-8b9e-04e1000106e7"/><path d="M2104.9 1350.01h47.7l-1.7-47.8z" style="stroke-width:0;fill:#070707"/><path d="m2085.6 0 62 70.7L2154 0z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="m1978.2 977.71 101.6 84.1 8.7-191.2z" class="uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880"/><path d="m1955.3 341.71 124.6 36.1 43.7-203.3z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="m2009.9 150.51-54.6 191.2 168.3-167.2z" class="uuid-37c058b7-0665-446c-a952-fbd02f6b75f7"/><path d="m2086.4 560.31-85.2 8.7 104.9 167.2z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="m1932.1 0 77.8 150.5 137.7-79.8-149-70.7z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="m2009.9 150.51 113.7 24 24-103.8z" class="uuid-d4932d80-3dd8-487b-9032-8171b1f614ea"/><path d="m1933.4 1338.31 8.1 11.7h163.4l46-47.8z" style="stroke-width:0;fill:#0d0d0d"/><path d="m1988 1166.71-54.6 171.6 217.5-36.1z" style="stroke-width:0;fill:#131313"/><path d="m2079.8 377.81-78.7 191.2 85.2-8.7z" class="uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2"/><path d="m1995.7 820.31 92.9 50.3 17.5-134.4z" class="uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837"/><path d="m1955.3 341.71 45.9 227.3 78.7-191.2z" class="uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda"/><path d="m2001.2 569.01-92.9 133.3 197.8 33.9z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="m1908.3 702.31 87.4 118 110.4-84.1z" class="uuid-58a87784-78d0-4efa-8f76-994e627c2f28"/><path d="m2079.8 1061.81-91.8 104.9 116.9-50.3z" class="uuid-0d32990c-6148-4bae-8f84-638d74308744"/><path d="m1995.7 820.31-17.5 157.4 110.4-107.1z" class="uuid-5a74413c-040c-49ac-ae9b-ff063e1703c7"/><path d="m1978.2 977.71 9.8 189 91.8-104.9z" class="uuid-74ebc325-d695-4647-8ab4-c5ddf454a99a"/><path d="m1781.7 0-5.7 1.9 19.7 195.6L1890.4 0z" class="uuid-4001db19-87d6-4868-a198-39cf945c21e7"/><path d="m1795.7 197.51 3.3 95.1 156.3 49.2z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="m1978.2 977.71-189 44.8 198.9 144.2z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="m1853.6 1276.01 79.8 62.3 54.6-171.6z" class="uuid-7d37dd7c-e6da-4084-ae6f-268d2e674cac"/><path d="m1795.7 837.81 182.5 139.9 17.5-157.4z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="m1955.3 341.71-108.2 191.2 154.1 36.1z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="m1795.7 197.51 159.5 144.2 54.6-191.2z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="m1890.4 0-94.7 197.5 214.2-47L1932.1 0z" class="uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85"/><path d="M1923.3 1350.01h18.2l-8.1-11.7z" style="stroke-width:0;fill:#101010"/><path d="m1847.1 532.91 61.2 169.4 92.9-133.3z" class="uuid-09b2e8ea-81c4-4d00-89ae-e1db0ceb800b"/><path d="m1789.2 1022.51-28.4 154.1 227.3-9.8z" class="uuid-3548a34b-f614-4b0d-8346-15536a5e76e8"/><path d="m1908.3 702.31-112.6 135.5 200-17.5z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="m1760.7 1176.61 92.9 99.4 134.4-109.3z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="m1795.7 837.81-6.6 184.7 189-44.8z" class="uuid-bffaa095-9eda-4db7-b18a-04d92e422d64"/><path d="m1799 292.51 48.1 240.4 108.2-191.2z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="M1845.1 1350.01h78.3l10.1-11.7-79.8-62.3z" class="uuid-6dd6c5e5-d25c-41ba-b28d-bf51e043ab42"/><path d="m1847.1 532.91-101.6 193.4 162.8-24z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="m1745.4 726.41 50.3 111.5 112.6-135.5z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="m1776.1 0-.1 1.9 5.7-1.9z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="m1662.4 964.61 126.8 57.9 6.6-184.7z" class="uuid-51de2d61-9a1c-4480-bec3-ff9934177e43"/><path d="M1674.6 1350.01h22.3l-23.6-18.2z" class="uuid-3cdf4e0d-6e23-4003-8b9e-04e1000106e7"/><path d="m1799 292.51-217.5 107.1 265.6 133.3z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="m1581.5 399.61 4.4 122.4 261.2 10.9z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="m1585.9 522.01 159.5 204.3 101.7-193.4z" class="uuid-8cec9e48-4765-41d9-9411-f0f1fd0117b6"/><path d="m1673.3 1331.71 23.6 18.2H1845l8.6-74z" style="stroke-width:0;fill:#181818"/><path d="m1760.7 1176.61-87.4 155.2 180.3-55.7z" class="uuid-e7c59cf4-ecc0-4c0c-8ae1-480b399c26c2"/><path d="m1776 1.81-137.7 38.2 157.4 157.4z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="m1585.9 522.01 28.4 212 131.1-7.7z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="m1774.7 0 1.3 1.9.1-1.9z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="m1662.4 964.61 98.3 212 28.4-154.1z" class="uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1"/><path d="m1609.9 843.31 52.5 121.3 133.3-126.8z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="m1638.3 40.11 51.4 193.4 106-36.1z" class="uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24"/><path d="m1795.7 197.51-106 36.1 109.3 59z" class="uuid-ec2229ee-eaa7-44f2-a716-e3da5c7316ca"/><path d="m1689.7 233.51-108.2 166.1 217.5-107.1z" class="uuid-ec2229ee-eaa7-44f2-a716-e3da5c7316ca"/><path d="m1745.4 726.41-135.5 116.9 185.8-5.5z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="m1662.4 964.61-82 228.4 180.3-16.4z" class="uuid-b32610f8-d0fe-4f2c-b8c4-c928c83ba5d1"/><path d="m1647.7 0-9.3 40.1L1776 1.81l-1.3-1.9h-127z" class="uuid-779befeb-4466-47e2-ae13-859d7dce8fb8"/><path d="m1580.4 1193.01 92.9 138.8 87.4-155.2z" class="uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880"/><path d="m1614.3 734.01-4.4 109.3 135.5-116.9z" class="uuid-54b20525-cb62-4a87-b010-d83ac07d13c9"/><path d="m1481 53.21-66.7 136.6 100.6 119.1z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="m1485.4 996.31 95.1 196.7 82-228.4z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="m1586.6 0 51.7 40.1 9.3-40.1z" class="uuid-71a0da64-eb00-47a0-8b16-5a5d71f4e543"/><path d="M1541.4 1350.01h133.3l-1.3-18.2-184.7-15.3z" class="uuid-0d32990c-6148-4bae-8f84-638d74308744"/><path d="m1514.9 308.91 66.7 90.7 108.2-166.1z" class="uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d"/><path d="M1638.3 40.11 1481 53.21l208.7 180.3z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="m1481 53.21 33.9 255.7 174.8-75.4z" class="uuid-221f1b90-931f-435a-8641-62a3a4dbdc16"/><path d="m1585.9 522.01-109.3 145.3 137.7 66.7z" class="uuid-37c058b7-0665-446c-a952-fbd02f6b75f7"/><path d="m1580.4 1193.01-91.8 123.5 184.7 15.3z" class="uuid-a1ddbbba-c09d-4b86-8bc1-8cdf864c3880"/><path d="M1483.5 1350.01h57.9l-52.7-33.6z" class="uuid-4d249ed7-7ef1-4d6d-8b48-679d02608ed7"/><path d="m1609.9 843.31-106 10.9 158.5 110.4z" class="uuid-dfc229d9-adeb-4c44-8701-a0f9ab0427c9"/><path d="m1503.9 854.21-18.6 142.1 177-31.7z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="m1485.4 996.31-32.8 147.5 127.9 49.2z" class="uuid-51de2d61-9a1c-4480-bec3-ff9934177e43"/><path d="m1479.7 0 1.3 53.2 157.4-13.1L1586.7 0z" class="uuid-78356180-57b7-4d60-b52b-5d41f593f4d9"/><path d="m1581.5 399.61-71 97.3 75.4 25.1z" class="uuid-872fef29-be25-4a6a-b909-fb42b3253348"/><path d="m1503.9 854.21 106-10.9 4.4-109.3z" class="uuid-bb09842e-b847-4c48-9e23-a980d9dc08a0"/><path d="m1476.6 667.31 27.3 186.9 110.4-120.2z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="m1510.5 496.91-33.9 170.5 109.3-145.3z" style="stroke-width:0;fill:#5f5f5f"/><path d="m1452.6 1143.81 36.1 172.7 91.8-123.5z" class="uuid-3b37f023-98e3-4292-85b8-bd745023aa9a"/><path d="m1514.9 308.91-4.4 188 71-97.3z" style="stroke-width:0;fill:#6d6d6d"/><path d="m1476.6 667.31-220.7 111.5 248.1 75.4z" class="uuid-b3e14f59-9c7c-478b-958a-fae20679f229"/><path d="m1300.7 1026.91 184.7-30.6 18.6-142.1z" class="uuid-bccd5f25-3c52-4a24-8413-d2476fe719c3"/><path d="m1286.5 552.61 190.1 114.7 33.9-170.5z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="m1316 341.71-29.5 210.9 224-55.7z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="m1414.3 189.81-60.1 38.2 160.6 80.9z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="m1354.2 228.11-38.2 113.6 198.9-32.8z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="m1316 341.71 194.5 155.2 4.4-188z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="m1452.6 1143.81-161.7 147.5 197.8 25.1z" class="uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837"/><path d="m1286.5 552.61 5.5 87.4 184.7 27.3z" class="uuid-dc73707c-322d-4485-9d51-679dc55739c3"/><path d="m1304.7 0-12.8 6.2 189.1 47-1.3-53.2z" class="uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b"/><path d="M1444.2 1350.01h39.2l5.2-33.6z" class="uuid-74ebc325-d695-4647-8ab4-c5ddf454a99a"/><path d="M1289.8 1350.01h154.5l44.4-33.6-197.8-25.1z" style="stroke-width:0;fill:#252525"/><path d="m1255.9 778.81 44.8 248.1 203.3-172.7z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="m1291.9 640.01-36.1 138.8 220.7-111.5z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="m1300.7 1026.91 151.9 116.9 32.8-147.5z" style="stroke-width:0;fill:#383838"/><path d="m1291.9 6.21 122.4 183.6 66.7-136.6z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="m1291.4 0 .6 6.2 12.8-6.2z" style="stroke-width:0;fill:#999"/><path d="m1300.7 1026.91-18.6 114.7 170.5 2.2z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="m1282.1 1141.61 8.7 149.7 161.7-147.5z" class="uuid-51de2d61-9a1c-4480-bec3-ff9934177e43"/><path d="m1291.9 6.21 62.3 221.8 60.1-38.2z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M1233.6 1350.01h56.2l1.1-58.7z" style="stroke-width:0;fill:#282828"/><path d="m1255.9 778.81-90.7 231.7 135.5 16.4z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="m1291.9 6.21-168.3 210.9 230.6 10.9z" class="uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d"/><path d="m1123.7 217.11 65.6 68.8 165-57.9z" class="uuid-1f907759-78fe-49c9-adde-50142daebe8f"/><path d="m1189.2 286.01 126.8 55.7 38.2-113.6z" class="uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b"/><path d="m1151 786.51 14.2 224 90.7-231.7z" class="uuid-5f62157b-7e02-4924-93d8-33d343d1dc08"/><path d="m1282.1 1141.61-122.4 18.6 131.1 131.1z" class="uuid-618973ca-6090-4649-9b12-43cb7b5eba7c"/><path d="m1154.4 0-30.7 217.1L1291.9 6.21 1273.1 0z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="m1273.1 0 18.8 6.2-.6-6.2z" class="uuid-5c3f7d87-576b-47a7-9c72-fcc7e879d540"/><path d="m1137.9 553.71 148.6-1.1 29.5-210.9z" class="uuid-71d8f147-e579-47e9-8e10-d1770ddcddba"/><path d="m1189.2 286.01-51.4 267.7 178.1-212z" style="stroke-width:0;fill:#858585"/><path d="m1286.5 552.61-85.2 65.6 90.7 21.9z" class="uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663"/><path d="m1201.2 618.21 54.6 160.6 36.1-138.8z" class="uuid-872fef29-be25-4a6a-b909-fb42b3253348"/><path d="m1165.2 1010.51 116.9 131.1 18.6-114.7z" class="uuid-09b2e8ea-81c4-4d00-89ae-e1db0ceb800b"/><path d="m1165.2 1010.51-5.5 149.7 122.4-18.6z" style="stroke-width:0;fill:#3e3e3e"/><path d="M1196.2 1350.01h37.4l57.3-58.7-131.1-131.1z" class="uuid-58a87784-78d0-4efa-8f76-994e627c2f28"/><path d="m1201.2 618.21-50.2 168.3 104.9-7.6z" class="uuid-fe179492-9c41-4141-9280-78efd752e1b6"/><path d="m1137.9 553.71 63.4 64.5 85.2-65.6z" class="uuid-bf637be7-dc77-4591-a9a0-755607709992"/><path d="M1131.5 0 1033 130.8l90.7 86.3L1154.4 0z" class="uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3"/><path d="m1086.7 0-50.5 25.9-3.3 104.9L1131.4 0z" class="uuid-957ea116-cf81-4a12-939a-04b30fa14189"/><path d="m1016.6 334.01 121.3 219.6 51.4-267.7z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="m1034.1 1188.61-16.4 137.7 142.1-166.1z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="m1151 786.51-225.1 52.4 239.3 171.6z" class="uuid-cddaca00-379b-4e2a-8b2c-79539ce8621a"/><path d="m1034.1 671.71 116.9 114.8 50.3-168.3z" class="uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663"/><path d="m1137.9 553.71-103.8 118 167.2-53.5z" class="uuid-ac1900bb-a504-4103-a256-9fdfd62a589f"/><path d="m1017.7 1326.31 78.6 23.7h100l-36.5-189.8z" class="uuid-f9bfab32-7c81-4c33-962b-9d18d114bc2a"/><path d="M1026.2 1350.01h70.1l-78.6-23.7z" class="uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837"/><path d="m925.9 838.91 14.2 191.2 225.1-19.7z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="m1034.1 1188.61 125.7-28.4 5.5-149.7z" class="uuid-e86a23c0-b6a4-412a-a93f-833ff3ef4ffe"/><path d="m1123.7 217.11-107.1 116.9 172.7-48.1z" class="uuid-0d4a910e-5ead-4838-b597-71994d5e44b6"/><path d="M1012.4 1350.01h13.7l-8.5-23.7z" class="uuid-ab611ba7-4dc0-4a91-b864-2109fc7a6837"/><path d="M1016.6 334.01 927 477.21l210.9 76.5z" class="uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73"/><path d="m940.1 1030.11 94 158.5 131.1-178.1z" class="uuid-9d6ea018-66b6-4bba-aa3b-567400b9d2f6"/><path d="m1029.6 0 6.6 25.9L1086.7 0z" class="uuid-64c7eb49-8c01-46aa-b7e6-ef2504e35ba5"/><path d="m1034.1 671.71-108.2 167.2 225.1-52.5z" class="uuid-8abb9f7f-bfda-4382-bf8d-16feeac3d663"/><path d="m927 477.21 107 194.5 103.8-118z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="m1033 130.81-16.4 203.3 107.1-116.9z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="M984 1350.01h28.4l5.2-23.7z" class="uuid-58a87784-78d0-4efa-8f76-994e627c2f28"/><path d="m823.1 235.71 193.4 98.3 16.4-203.3z" class="uuid-6653bb43-d0f3-484f-aeae-d1935082e430"/><path d="m873.4 710.01 52.5 128.9 108.2-167.2z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="m927 477.21-62.3 54.6 169.3 139.9z" class="uuid-78356180-57b7-4d60-b52b-5d41f593f4d9"/><path d="m864.7 531.81 8.7 178.1 160.6-38.2z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="M940.1 1030.11 763 1180.91l271 7.6z" class="uuid-b3e14f59-9c7c-478b-958a-fae20679f229"/><path d="m772.9 1285.91 244.8 40.4 16.4-137.7z" class="uuid-86f5feeb-dac2-4fcc-824b-0d6bdefb40f2"/><path d="m763 1180.91 9.8 104.9 261.2-97.3z" class="uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda"/><path d="m827.5 52.11 205.4 78.7 3.3-104.9z" style="stroke-width:0;fill:#afafaf"/><path d="m872.5 0-45 52.1 208.7-26.2-6.6-25.9z" class="uuid-79495768-f750-42bf-ac3e-e360b6a08205"/><path d="m827.5 52.11-4.4 183.6 209.9-104.9z" class="uuid-c65319c7-5805-4670-9bc3-4c8332b4be87"/><path d="M807.8 373.41 927 477.21l89.6-143.2z" class="uuid-329adbd5-8beb-4a2a-832b-edb10b3920e8"/><path d="m823.1 235.71-15.3 137.7 208.7-39.3z" style="stroke-width:0;fill:#a3a3a3"/><path d="M802.5 1350.01H984l33.6-23.7-244.7-40.4z" class="uuid-4ab4f9f3-635a-4f3b-b54a-e6071df250bb"/><path d="m801.3 1048.71-38.3 132.2 177-150.8z" class="uuid-40fda131-3367-46ec-bc37-a78c47e53c77"/><path d="m834 0-6.5 52.1 45-52.1z" class="uuid-b7693d0b-31c5-440d-bd32-cbfdc0ebe203"/><path d="m925.9 838.91-138.8 37.2 153 154.1z" class="uuid-5eb8013c-fccc-4592-9f5d-ab723261bd85"/><path d="m790.2 0 37.3 52.1L834 0z" class="uuid-66ed4cbc-aae7-42f7-ada5-f1c982f52370"/><path d="m787.1 876.11 14.2 172.7 138.8-18.6z" class="uuid-fe179492-9c41-4141-9280-78efd752e1b6"/><path d="m873.4 710.01-86.3 166.1 138.8-37.2z" class="uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24"/><path d="m807.8 373.41 56.8 158.5 62.3-54.6z" class="uuid-1e436f6b-2190-4072-a833-d30583b402a8"/><path d="m706.2 0 121.3 52.1L790.2 0z" class="uuid-66ed4cbc-aae7-42f7-ada5-f1c982f52370"/><path d="m807.8 373.41-96.2 97.3 153 61.2z" class="uuid-ab63f0c5-ac72-4093-8896-a80d48cf6d4c"/><path d="m864.7 531.81-158.5 145.4 167.2 32.8z" class="uuid-0465e0d5-bfa0-4e16-bc53-2dd00f9e8b3b"/><path d="m706.2 677.21 80.9 198.9 86.3-166.1z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="m642.8 222.61 180.3 13.1 4.4-183.6z" class="uuid-79495768-f750-42bf-ac3e-e360b6a08205"/><path d="m711.7 470.61-5.5 206.5 158.5-145.3z" class="uuid-5d7761a4-550b-4d7d-bad9-246b04ff569d"/><path d="m706.2 677.21-40.4 168.3 121.3 30.6z" class="uuid-2df77ddd-561d-4cf8-ad27-8c9c2d3a9fe7"/><path d="M651.2 1350.01h151.4l-29.7-64.1z" class="uuid-17f0a62c-d120-4210-a2e3-c3c407298541"/><path d="m787.1 876.11-137.7 78.7 151.9 94z" class="uuid-091a587a-2fd5-4296-811e-706ded9e5315"/><path d="m642.8 222.61 13.2 174.8 151.9-24z" class="uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5"/><path d="m642.8 222.61 165 150.8 15.3-137.7z" class="uuid-749e1ad8-a1b5-403c-930e-c5211067a9b5"/><path d="m686.1 0-43.2 222.6L827.5 52.1 706.2 0z" style="stroke-width:0;fill:#bcbcbc"/><path d="m763 1180.91-51.4 21.9 61.2 83.1z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="m711.7 1202.81 51.3-21.9 38.2-132.2z" class="uuid-f9274650-94b1-4e9d-9a6e-e460d569d058"/><path d="m656 397.41 55.7 73.2 96.2-97.3z" class="uuid-6653bb43-d0f3-484f-aeae-d1935082e430"/><path d="m649.4 954.71 62.3 248.1 89.6-154.1z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="m665.8 845.51-16.4 109.3 137.7-78.7z" class="uuid-af4d0ba4-7465-4a0a-9a4f-892833201b24"/><path d="M637.1 1350.01h14.1l121.7-64.1-61.2-83.1z" class="uuid-f1b25f43-02eb-4b6c-bb6d-0a1fe9ad98e6"/><path d="M682.1 0 551 187.6l91.8 35L686.1 0z" class="uuid-f14e6544-02f9-44d8-8663-230690aebb6e"/><path d="M528.7 0 551 187.6 682 0z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="m547.8 803.91 118 41.5 40.4-168.3z" class="uuid-56d56fcf-a8cf-40dc-b540-9537c48b1260"/><path d="M623.5 1350.01h13.6l74.6-147.2-228.4-21.9z" class="uuid-1bd2f084-d6ef-4e71-a3e1-394c1f5de493"/><path d="m649.4 954.71-173.8 87.4 236 160.6z" class="uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5"/><path d="m475.6 1042.21 7.7 138.8 228.4 21.9z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="m656 397.41-186.9 52.5 242.6 20.8z" class="uuid-a443fe0b-51a8-4d7f-b10c-e5e8600ac99a"/><path d="m448.3 652.01 257.9 25.1 5.5-206.5z" style="stroke-width:0;fill:#979797"/><path d="m469.1 449.91-20.8 202.2 263.4-181.4z" class="uuid-49f686db-de20-4f18-b1e4-82ebe8be9af3"/><path d="m448.3 652.01 99.5 151.9 158.5-126.8z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="m642.8 222.61-178.1 104.9 191.3 69.9z" class="uuid-bbe26c67-38ac-40f8-bdd4-e0b666628f17"/><path d="m551 187.61-86.3 139.9 178.1-104.9z" class="uuid-92e8159d-4669-4c95-b071-2d1c20aec96b"/><path d="m547.8 803.91 101.6 150.8 16.4-109.3z" class="uuid-71d8f147-e579-47e9-8e10-d1770ddcddba"/><path d="m464.7 327.51 4.4 122.4 186.9-52.5z" class="uuid-c65319c7-5805-4670-9bc3-4c8332b4be87"/><path d="M444.1 1350.01h179.4l-140.2-169z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="m547.8 803.91-72.1 238.2 173.8-87.4z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="m359.8 877.21 115.8 165 72.2-238.3z" class="uuid-d02de2a5-a88b-4c79-9734-20dee1b75554"/><path d="m448.3 652.01-74.3 33.9 173.8 118z" class="uuid-a44b71ad-48ca-44b8-abba-e28fb42d596b"/><path d="m268 221.51 196.7 106 86.3-139.9z" style="stroke-width:0;fill:#bfbfbf"/><path d="M294.2 71.81 268 221.51l283-33.9z" class="uuid-8e7ca1ec-9b1a-4c26-9793-df654790f70a"/><path d="M528.7 0 294.2 71.8 551 187.6z" class="uuid-1fb40790-3128-48d4-86c3-4707782e6221"/><path d="m374 685.91-14.2 191.2 188-73.2z" class="uuid-6c415024-c989-499f-a7e7-2fbb5e12f644"/><path d="m344.5 508.91 103.8 143.2 20.8-202.2z" class="uuid-957ea116-cf81-4a12-939a-04b30fa14189"/><path d="M369.2 1350.01h74.9l39.2-169z" class="uuid-1bd2f084-d6ef-4e71-a3e1-394c1f5de493"/><path d="m311.2 0-16.9 71.8L528.7 0z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M464.7 327.51H268l201.1 122.4z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="m268 327.51 76.5 181.4 124.6-59z" class="uuid-79495768-f750-42bf-ac3e-e360b6a08205"/><path d="m311.7 1021.41-24 98.3 188-77.6z" class="uuid-bf637be7-dc77-4591-a9a0-755607709992"/><path d="m359.8 877.21-48.1 144.2 163.9 20.8z" class="uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772"/><path d="m475.6 1042.21-188 77.6 195.6 61.2z" class="uuid-091a587a-2fd5-4296-811e-706ded9e5315"/><path d="M360.2 1350.01h9l114.1-169-195.6-61.2z" class="uuid-159ac44d-1054-42ae-8dba-d4e36ad7b658"/><path d="M268 221.51v106h196.7z" class="uuid-ca58da73-3943-413c-8cdb-a96a32a32d4d"/><path d="m344.5 508.91 29.5 177 74.3-33.9z" class="uuid-8f776032-5b85-41a0-9e26-d24a75140594"/><path d="m201.4 1288.01 141.1 62h17.8l-72.5-230.2z" class="uuid-20f4978c-72ef-41f1-8b2a-3b5b1e377089"/><path d="m185 1176.61 16.4 111.5 86.3-168.3z" class="uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5"/><path d="m141.3 514.41 33.9 203.3 169.3-208.8z" class="uuid-21b08daa-3869-4f82-b379-2e1641c471da"/><path d="M238.3 0 209 47.7l85.2 24L311.1-.09h-72.8z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M187.3 0 209 47.7 238.3-.09h-51z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m344.5 508.91-169.4 208.7 198.9-31.7z" class="uuid-d0871993-3136-4271-bd82-a17cb687dca0"/><path d="m209 817.11 150.8 60.1 14.2-191.3z" class="uuid-1f907759-78fe-49c9-adde-50142daebe8f"/><path d="m175.1 717.61 33.9 99.4 165-131.1z" class="uuid-1e436f6b-2190-4072-a833-d30583b402a8"/><path d="m209 817.11 102.7 204.3 48.1-144.2z" class="uuid-98d636e4-8059-4223-a7a9-84a0075190da"/><path d="M239.8 1350.01h102.7l-141.1-62z" class="uuid-dfd8668e-4302-4377-bc63-2102aba7a40f"/><path d="M183.4 1350.01h56.3l-38.4-62z" class="uuid-b736cef6-b3ae-433b-bc9a-796db39ecdda"/><path d="m268 327.51-126.7 186.9 203.3-5.5z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="m209 817.11-42.6 243.7 145.3-39.3z" class="uuid-2c424dae-3619-470c-8ce8-49105a3b3ad9"/><path d="m112.8 367.91 28.4 146.4L268 327.51z" class="uuid-f14e6544-02f9-44d8-8663-230690aebb6e"/><path d="m158.7 141.71 109.3 79.8 26.2-149.7z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m209 47.71-50.3 94 135.5-69.9z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m166.4 1060.71 121.3 59 24-98.4z" class="uuid-01b32304-0ec2-45e0-9340-e8e63f72a0bf"/><path d="m166.4 1060.71 18.6 115.8 102.7-56.8z" class="uuid-bf637be7-dc77-4591-a9a0-755607709992"/><path d="m112.8 367.91 155.2-40.4v-106z" class="uuid-4d579641-4004-44c8-a62b-ab07ba5970c4"/><path d="m158.7 141.71-45.9 226.2L268 221.51z" style="stroke-width:0;fill:#cbcbcb"/><path d="m45.1 310.01 67.8 57.9 45.9-226.2z" class="uuid-1fb40790-3128-48d4-86c3-4707782e6221"/><path d="m141.3 514.41-106 43.7 139.9 159.5z" style="stroke-width:0;fill:#ababab"/><path d="m185 1176.61-129 96.1 145.3 15.3z" class="uuid-bc2496f6-1c08-431c-a748-eb317ecd2977"/><path d="M83.8 1350.01h99.6l17.9-62-145.3-15.3z" class="uuid-b3e14f59-9c7c-478b-958a-fae20679f229"/><path d="M0 53.61v12l158.7 76 50.3-94z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M7.8 0 0 13.51v40.2l209-5.9L187.3 0z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m18.9 1006.11 147.5 54.6 42.6-243.6z" class="uuid-98d636e4-8059-4223-a7a9-84a0075190da"/><path d="m2.5 842.21 16.4 163.9 190.1-189z" class="uuid-ba37a829-34a0-4237-89d2-93a9802adfd5"/><path d="M175.1 717.61 2.5 842.21l206.5-25.1z" class="uuid-0d4a910e-5ead-4838-b597-71994d5e44b6"/><path d="M0 0v13.5L7.9 0z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="M0 613.91v34l175.1 69.7-139.8-159.5z" class="uuid-957ea116-cf81-4a12-939a-04b30fa14189"/><path d="M0 1197.01v13.1l185-33.5-18.6-115.8z" class="uuid-e751fa48-4097-452d-989b-1bb42a2d8e5d"/><path d="M0 1210.01v19.5l56 43.2 128.9-96.2z" class="uuid-7de8c492-7761-4ff6-ab31-1b781c4b99a5"/><path d="M33.7 1350.01h50.1l-27.8-77.3z" class="uuid-d7c6f68b-2063-4b87-831e-11aabf907665"/><path d="M0 1105.71v91.3l166.4-136.2-147.5-54.6z" class="uuid-acd9fb0a-a6ce-4110-ad3a-705b3b96f772"/><path d="m0 816.91 2.5 25.3 172.7-124.6L0 648.01z" class="uuid-8f776032-5b85-41a0-9e26-d24a75140594"/><path d="m0 128.41 158.7 13.3L0 65.71z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m0 189.71 45.1 120.3 113.6-168.3L0 128.41z" class="uuid-2c9c5fda-2c96-4f37-9370-5be6ebc45e69"/><path d="m112.8 367.91-77.5 190.2 106-43.7z" class="uuid-a3d6f061-fb22-4029-979e-1abb1494ae60"/><path d="m45.1 310.01-9.8 248.1 77.5-190.2z" class="uuid-ca58da73-3943-413c-8cdb-a96a32a32d4d"/><path d="M0 549.81v64.1l35.3-55.8 9.8-248.1z" class="uuid-4122213a-c1ab-426d-972d-f2606dca6918"/><path d="M0 1350.01h33.7l22.3-77.3-56-43.2z" class="uuid-f9274650-94b1-4e9d-9a6e-e460d569d058"/><path d="m0 549.81 45.1-239.7L0 189.71z" class="uuid-b093d116-2e77-48c0-86d2-f12fbcacac8c"/><path d="M0 882.31v223.4l18.9-99.6-16.4-163.9z" class="uuid-30c462c8-02a5-410a-a22c-1098ccd0faaf"/><path d="m0 882.31 2.5-40.1-2.5-25.3z" class="uuid-302ea3b3-82f6-42c0-a59b-4112764c7f73"/><path d="M0 0h2396.1v1350H0z" style="stroke-width:0;fill:url(#uuid-766e8756-0661-4100-ba9a-27d53b9eaf80)"/><path d="M0 0h2400.3v1628.1H0z" style="stroke-width:0;fill:url(#uuid-5050948a-1585-4b56-a9d3-1522f5b4c1f9)"/><path d="M0 0h2400.3v1628.1H0z" style="fill:url(#uuid-f9de4f71-5373-4515-a652-5e23f5343279);opacity:.49;stroke-width:0"/></svg>
\ No newline at end of file
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.png b/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.png
deleted file mode 100644
index 63f3b9f87deb..000000000000
Binary files a/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.png and /dev/null differ
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.svg b/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.svg
new file mode 100644
index 000000000000..7a65390bcbd2
--- /dev/null
+++ b/themes/src/main/resources/theme/keycloak.v2/login/resources/img/keycloak-logo-text.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="729.577" height="150.658" viewBox="0 0 193.036 39.861"><path fill="#4d4d4d" d="M5.795 9.869 11.511.003 34.53 0l5.685 9.964.007 19.932-5.691 9.958-23.012.008-5.782-9.965z"/><path fill="#ededed" d="M5.738 29.894h10.374l-5.698-10.041 4.634-9.982-9.252-.002L0 19.934"/><path fill="#e0e0e0" d="M19.258 29.894h7.583l6.705-9.773-6.588-10.156h-8.92l-5.373 9.814z"/><path fill="#acacac" d="m0 19.933 5.738 9.964h10.375l-5.636-9.93z"/><path fill="#9e9e9e" d="m12.774 19.935 6.485 9.962h7.582l6.6-9.958z"/><path fill="#00b8e3" d="m15.342 19.94-1.957.57-1.878-.571 7.667-13.29 1.918 3.318"/><path fill="#33c6e9" d="m21.084 29.894-1.908 3.332-5.093-5.487-2.58-7.797v-.004h3.838"/><path fill="#008aaa" d="M11.508 19.939h-.004v.003l-1.917 3.322-1.925-3.307 1.952-3.386 5.728-9.92h3.834"/><path fill="#d4d4d4" d="M32.604 29.894h11.612l-.007-19.93H32.604Z"/><path fill="#919191" d="M32.604 19.966v9.93h11.591v-9.93z"/><path fill="#00b8e3" d="M19.178 33.23h-3.837l-5.754-9.967 1.917-3.32z"/><path fill="#008aaa" d="M34.519 19.939 26.85 33.227c-.705-1.036-1.913-3.33-1.913-3.33l5.753-9.96z"/><path fill="#00b8e3" d="m30.68 33.227-3.83-.001 7.67-13.288 1.916-3.318 1.922 3.34m-3.839-.021h-3.828l-5.755-9.973 1.905-3.314 4.658 5.922z"/><path fill="#33c6e9" d="M36.436 16.618v.003l-1.917 3.318-7.677-13.286 3.841.002z"/><path fill="#626262" d="M175.972 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.049c.106 0 .195-.09.195-.195V24.31c0-.046.016-.093.05-.13l.181-.204 1.6-1.782a.196.196 0 0 1 .302.016l1.528 2.06 2.735 3.68 1.002 1.347.367.497c.04.05.096.08.159.08h4.7a.2.2 0 0 0 .162-.312l-.973-1.356-1.389-1.954q-.619-.864-1.333-1.866l-.215-.304-1.76-2.48-1.934-2.706a.19.19 0 0 1 .016-.241l1.551-1.724 3.725-4.14 2.239-2.487a.2.2 0 0 0 .05-.123.195.195 0 0 0-.196-.201h-4.97a.2.2 0 0 0-.143.062l-1.558 1.694-3.324 3.614-2.235 2.428a.194.194 0 0 1-.338-.132v-7.471a.195.195 0 0 0-.195-.195Z"/><path fill="#6f6f6f" d="M161.562 9.98a.2.2 0 0 0-.178.12l-5.213 12.065-.003.003-.007.013-.003.01-.674 1.565-.04.096-.087.195h.001l-.073.166v.003l-2.027 4.693-.298.69a.196.196 0 0 0 .178.275h4.3a.2.2 0 0 0 .175-.112q.002-.004.004-.007l1.498-3.485.248-.576a.2.2 0 0 1 .182-.12h8.08a.19.19 0 0 1 .178.12l1.664 3.866 1.865-6.618-1.499-3.47-1.339-3.098-2.712-6.273a.19.19 0 0 0-.179-.12h-2.526zm7.905 19.58v.003l.086.192c.03.073.099.12.178.12h4.3a.197.197 0 0 0 .179-.276l-.04-.09-2.838-6.567zm-5.87-13.362c.074 0 .147.04.181.117l.943 2.2.952 2.225.285.664a.194.194 0 0 1-.179.272h-4.389a.194.194 0 0 1-.178-.272l.516-1.19 1.69-3.9a.2.2 0 0 1 .18-.116z"/><path fill="#7d7d7d" d="M143.452 9.524q-1.24-.002-2.368.235v.004-.004h-.003a9.8 9.8 0 0 0-3.556 1.488 10.6 10.6 0 0 0-1.497 1.224c-1.486 1.453-2.428 3.197-2.815 5.176l-.002.003-.014.076-.005.023-.042.225v-.001l-.003.012v.006l-.01.085v.009a11 11 0 0 0-.126 1.715q0 3.945 2.45 6.727c.175.206.367.404.565.599q.76.744 1.608 1.3 2.52 1.647 5.818 1.647.367.001.724-.023 3.195-.18 5.615-1.991a10.4 10.4 0 0 0 1.089-.933l.01-.01a10 10 0 0 0 1.922-2.583q.222-.43.396-.887.689-1.762.688-3.845 0-.562-.05-1.1v-.006a9.8 9.8 0 0 0-.783-3.1q-.75-1.725-2.183-3.124-.596-.585-1.25-1.052-2.638-1.895-6.178-1.895m.017 3.873q2.49 0 4.197 1.875.094.101.175.205 1.532 1.821 1.531 4.336 0 1.754-.744 3.162a6.5 6.5 0 0 1-1.138 1.545 5.7 5.7 0 0 1-1.382 1.048q-1.185.635-2.64.635a5.6 5.6 0 0 1-2.56-.592 5.5 5.5 0 0 1-1.12-.77 6 6 0 0 1-.516-.503q-1.71-1.864-1.71-4.524 0-.078.003-.156.045-2.56 1.707-4.386c.83-.912 1.802-1.495 2.913-1.74a6 6 0 0 1 1.284-.135"/><path fill="#888" d="M120.252 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h12.528c.11 0 .196-.09.196-.195v-3.57a.195.195 0 0 0-.196-.194h-8.09a.19.19 0 0 1-.194-.191V10.176a.19.19 0 0 0-.113-.176.2.2 0 0 0-.083-.02h-2.242z"/><path fill="#949494" d="M109.792 9.525q-4.384.002-7.415 2.96-.55.541-1.002 1.13v.004q-2.028 2.634-2.027 6.25-.001 2.064.649 3.794l.006-.002-.005.003c.254.695.592 1.336.999 1.948v.003q.004.002.003.003a10 10 0 0 0 1.323 1.58 10 10 0 0 0 1.984 1.512h.003a10 10 0 0 0 .953.484h.007l.003.003h.003q2.053.903 4.617.903.755-.001 1.475-.106h.01q.462-.065.913-.175 2.524-.607 4.63-2.557v-.002l.001.002c.281-.258.559-.54.83-.837a.2.2 0 0 0-.007-.27l-2.566-2.643a.19.19 0 0 0-.172-.057.2.2 0 0 0-.116.07q-1.028 1.216-2.338 1.822-1.301.6-2.874.6-1.078 0-2.011-.341a5.64 5.64 0 0 1-2.057-1.34 5.4 5.4 0 0 1-1.3-2.066h-.007l.007-.001q-.381-1.071-.38-2.385-.002-2.585 1.544-4.183.112-.114.235-.23 1.776-1.636 4.283-1.636c.611 0 1.197.076 1.75.229v-.001q1.905.518 3.343 2.216c.076.09.215.096.29.007l2.498-2.832a.2.2 0 0 0-.003-.264q-2.933-3.222-7.1-3.556-.482-.039-.977-.04z"/><path fill="#aaa" d="M82.588 9.98a.195.195 0 0 0-.17.29l1.892 3.309 3.423 5.983 1.38 2.41a.2.2 0 0 1 .026.097v7.61c0 .106.086.195.195.195h4.049c.109 0 .194-.09.194-.195v-7.61q0-.05.027-.096l.976-1.706 3.704-6.476.757-1.32.503-.88h-.007l.007-.003.754-1.316a.194.194 0 0 0-.168-.29h-4.363a.2.2 0 0 0-.168.095l-3.953 6.803-.003.003v.003l-.212.156-.159.122a.2.2 0 0 1-.082-.076l-.067-.112-.099-.17-3.905-6.73a.2.2 0 0 0-.169-.095zm15.537 2.04v.002l-.004.002z"/><path fill="#bcbcbc" d="M66.598 9.98a.193.193 0 0 0-.196.196v19.503c0 .106.086.195.195.195h14.264c.11 0 .196-.09.196-.195v-3.54a.196.196 0 0 0-.196-.194h-9.825a.195.195 0 0 1-.196-.195v-3.737c0-.106.09-.196.196-.196h8.519a.195.195 0 0 0 .195-.194v-3.394c0-.11-.09-.195-.195-.195h-8.52a.196.196 0 0 1-.195-.195V14.13c0-.11.09-.195.196-.195h9.515a.195.195 0 0 0 .195-.195v-3.565a.195.195 0 0 0-.195-.195h-7.829z"/><path fill="#b8b8b8" d="M47.256 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.048c.11 0 .196-.09.196-.195V24.31c0-.046.016-.093.05-.13l.842-.942.94-1.044a.196.196 0 0 1 .3.016l2.808 3.777.002.002 2.016 2.713.81 1.09a.19.19 0 0 0 .156.08h4.703a.197.197 0 0 0 .158-.31l-.171-.241a694 694 0 0 1-1.846-2.587q-.848-1.184-1.888-2.652l-.07-.1v.002-.002a1569 1569 0 0 0-3.628-5.086.195.195 0 0 1 .017-.241l1.772-1.968h-.006l.006-.001v-.003l1.459-1.62 1.402-1.558 2.88-3.202a.194.194 0 0 0-.145-.324H59.1a.2.2 0 0 0-.146.063l-3.079 3.345-4.038 4.39a.194.194 0 0 1-.338-.132V10.17a.193.193 0 0 0-.195-.192h-2.11zm.091 9.823v.01h-.001zm12.27 8.34v.002h-.001z"/><path fill="#a0a0a0" d="M89.222 29.806c-.024-.025-.045-1.79-.045-3.92V22.01l-3.38-5.904c-1.996-3.487-3.364-5.945-3.342-6.003.032-.084.357-.098 2.278-.098 2.052 0 2.25.01 2.342.115.055.064.986 1.649 2.069 3.523 1.082 1.873 2.003 3.443 2.045 3.488.194.21.46-.181 2.48-3.662l2.01-3.465h2.275c1.894 0 2.28.016 2.31.094.02.05-1.477 2.737-3.326 5.969l-3.362 5.876-.066 7.872-2.121.018c-1.167.01-2.142-.003-2.167-.028z"/><path fill="#acacac" d="M66.456 29.767c-.017-.045-.023-4.503-.014-9.905l.017-9.823h14.22v3.837l-4.855.017c-3.453.012-4.88.038-4.944.09-.13.109-.13 3.91 0 4.018.063.052 1.362.079 4.448.09l4.36.018v3.638l-4.36.017c-3.086.012-4.385.039-4.448.09-.07.06-.089.465-.089 1.98 0 1.047.018 1.95.04 2.009.036.094.538.104 4.999.104 3.29 0 5 .023 5.086.069.122.065.128.156.128 1.872 0 1.314-.022 1.825-.08 1.883-.118.118-14.463.115-14.508-.003z"/></svg>
\ No newline at end of file
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/social-providers.ftl b/themes/src/main/resources/theme/keycloak.v2/login/social-providers.ftl
index 25a1cb93da5a..76f80e371f4d 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/social-providers.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/social-providers.ftl
@@ -1,100 +1,91 @@
 <#macro show social>
-  <div class="pf-v5-c-login__main-footer-band">
-      <p class="pf-v5-c-login__main-footer-band-item">
+  <div class="${properties.kcLoginMainFooterBand!}">
+      <span class="${properties.kcLoginMainFooterBandItem!} ${properties.kcLoginMainFooterHelperText!}">
           ${msg("identity-provider-login-label")}
-      </p>
+      </span>
   </div>
   <div id="kc-social-providers" class="${properties.kcFormSocialAccountSectionClass!}">
       <ul class="${properties.kcFormSocialAccountListClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountListGridClass!}</#if>">
           <#list social.providers as p>
-              <li class="${properties.kcFormSocialAccountListItemClass!}">
-                  <a id="social-${p.alias}" class="${properties.kcFormSocialAccountListButtonClass!} <#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}</#if>" aria-label="${p.displayName}"
+              <li class="<#if social.providers?size gt 3>${properties.kcFormSocialAccountGridItem!}<#else>${properties.kcFormSocialAccountListItemClass!}</#if>">
+                  <a data-once-link data-disabled-class="${properties.kcFormSocialAccountListButtonDisabledClass!}" id="social-${p.alias}"
+                          class="${properties.kcFormSocialAccountListButtonClass!}" aria-label="${p.displayName}"
                           type="button" href="${p.loginUrl}">
                         <#if p.iconClasses?has_content>
                             <span class="${p.iconClasses!}">${p.displayName!}</span>
                         <#else>
                         <#switch p.alias>
                             <#case "google">
-                                <svg aria-hidden="true" viewBox="0 0 488 512">
-                                    <title id="title">Google</title>
-                                    <path d="M488 261.8C488 403.3 391.1 504 248 504 110.8 504 0 393.2 0 256S110.8 8 248 8c66.8 0 123 24.5 166.3 64.9l-67.5 64.9C258.5 52.6 94.3 116.6 94.3 256c0 86.5 69.1 156.6 153.7 156.6 98.2 0 135-70.4 140.8-106.9H248v-85.3h236.1c2.3 12.7 3.9 24.9 3.9 41.4z"/>
+                                <svg viewBox="0 0 48 48" class="google" aria-hidden="true">
+                                    <path fill="#EA4335" d="M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"></path>
+                                    <path fill="#4285F4" d="M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"></path>
+                                    <path fill="#FBBC05" d="M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z"></path>
+                                    <path fill="#34A853" d="M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"></path>
+                                    <path fill="none" d="M0 0h48v48H0z"></path>
                                 </svg>
                                 <#break>
                             <#case "github">
                                 <svg aria-hidden="true" viewBox="0 0 496 512">
-                                    <title id="title">GitHub</title>
                                     <path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z"/>
                                 </svg>
                                 <#break>
                             <#case "facebook">
                                 <svg aria-hidden="true" viewBox="0 0 448 512">
-                                    <title id="title">Facebook</title>
                                     <path d="M448 56.7v398.5c0 13.7-11.1 24.7-24.7 24.7H309.1V306.5h58.2l8.7-67.6h-67v-43.2c0-19.6 5.4-32.9 33.5-32.9h35.8v-60.5c-6.2-.8-27.4-2.7-52.2-2.7-51.6 0-87 31.5-87 89.4v49.9h-58.4v67.6h58.4V480H24.7C11.1 480 0 468.9 0 455.3V56.7C0 43.1 11.1 32 24.7 32h398.5c13.7 0 24.8 11.1 24.8 24.7z"/>
                                 </svg>
                                 <#break>
                             <#case "gitlab">
                                 <svg aria-hidden="true" viewBox="0 0 512 512">
-                                    <title id="title">GitLab</title>
                                     <path d="M29.782 199.732L256 493.714 8.074 309.699c-6.856-5.142-9.712-13.996-7.141-21.993l28.849-87.974zm75.405-174.806c-3.142-8.854-15.709-8.854-18.851 0L29.782 199.732h131.961L105.187 24.926zm56.556 174.806L256 493.714l94.257-293.982H161.743zm349.324 87.974l-28.849-87.974L256 493.714l247.926-184.015c6.855-5.142 9.711-13.996 7.141-21.993zm-85.404-262.78c-3.142-8.854-15.709-8.854-18.851 0l-56.555 174.806h131.961L425.663 24.926z"/>
                                 </svg>
                                 <#break>
                             <#case "linkedin">
                             <#case "linkedin-openid-connect">
                                 <svg aria-hidden="true" viewBox="0 0 448 512">
-                                    <title id="title">LinkedIn</title>
                                     <path d="M416 32H31.9C14.3 32 0 46.5 0 64.3v383.4C0 465.5 14.3 480 31.9 480H416c17.6 0 32-14.5 32-32.3V64.3c0-17.8-14.4-32.3-32-32.3zM135.4 416H69V202.2h66.5V416zm-33.2-243c-21.3 0-38.5-17.3-38.5-38.5S80.9 96 102.2 96c21.2 0 38.5 17.3 38.5 38.5 0 21.3-17.2 38.5-38.5 38.5zm282.1 243h-66.4V312c0-24.8-.5-56.7-34.5-56.7-34.6 0-39.9 27-39.9 54.9V416h-66.4V202.2h63.7v29.2h.9c8.9-16.8 30.6-34.5 62.9-34.5 67.2 0 79.7 44.3 79.7 101.9V416z"/>
                                 </svg>
                                 <#break>
                             <#case "openshift-v4">
                                 <svg viewBox="116 0 100 100" aria-hidden="true">
-                                    <title id="title">OpenShift</title>
                                     <path d="M145.7,45.3l-16.1,5.8c0.2,2.6,0.6,5.1,1.3,7.6l15.3-5.6C145.7,50.6,145.5,47.9,145.7,45.3M216.7,27.5c-1.1-2.3-2.4-4.5-3.9-6.6l-16.1,5.8c1.9,1.9,3.4,4.1,4.7,6.4L216.7,27.5zM181.4,23c3.3,1.6,6.2,3.7,8.7,6.2l16.1-5.8c-4.4-6.2-10.5-11.5-17.9-14.9c-22.9-10.7-50.3-0.7-61,22.2c-3.5,7.4-4.8,15.3-4.1,23l16.1-5.8c0.3-3.5,1.1-7,2.7-10.3C148.7,22.5,166.4,16,181.4,23M131.9,58.4l-15.3,5.6c1.4,5.6,3.8,10.8,7.2,15.5l16-5.8C135.8,69.4,133,64.1,131.9,58.4M198.5,52.3c-0.3,3.5-1.1,7-2.7,10.3C188.8,77.5,171,84,156.1,77c-3.3-1.6-6.3-3.7-8.7-6.2l-16,5.8c4.4,6.2,10.5,11.5,17.9,14.9c22.9,10.7,50.3,0.7,61-22.2c3.5-7.4,4.7-15.3,4.1-22.9L198.5,52.3zM202.4,32.7l-15.3,5.6c2.8,5.1,4.2,10.9,3.7,16.8l16-5.8C206.5,43.5,204.9,37.9,202.4,32.7"></path>
                                 </svg>
                                 <#break>
                             <#case "stackoverflow">
                                 <svg viewBox="0 0 384 512" aria-hidden="true">
-                                    <title id="title">Stack Overflow</title>
                                     <path d="M290.7 311L95 269.7 86.8 309l195.7 41zm51-87L188.2 95.7l-25.5 30.8 153.5 128.3zm-31.2 39.7L129.2 179l-16.7 36.5L293.7 300zM262 32l-32 24 119.3 160.3 32-24zm20.5 328h-200v39.7h200zm39.7 80H42.7V320h-40v160h359.5V320h-40z"></path>
                                 </svg>
                                 <#break>
                             <#case "twitter">
-                                <svg viewBox="0 0 512 512" aria-hidden="true">
-                                    <title id="title">Twitter</title>
-                                    <path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z"></path>
+                                <svg viewBox="0 0 1200 1227" aria-hidden="true" fill="none" xmlns="http://www.w3.org/2000/svg">
+                                    <path d="M714.163 519.284L1160.89 0H1055.03L667.137 450.887L357.328 0H0L468.492 681.821L0 1226.37H105.866L515.491 750.218L842.672 1226.37H1200L714.137 519.284H714.163ZM569.165 687.828L521.697 619.934L144.011 79.6944H306.615L611.412 515.685L658.88 583.579L1055.08 1150.3H892.476L569.165 687.854V687.828Z" fill="white"/>
                                 </svg>
                                 <#break>
                             <#case "microsoft">
                                 <svg viewBox="0 0 448 512" aria-hidden="true">
-                                    <title id="title">Microsoft</title>
                                     <path d="M0 32h214.6v214.6H0V32zm233.4 0H448v214.6H233.4V32zM0 265.4h214.6V480H0V265.4zm233.4 0H448V480H233.4V265.4z"></path>
                                 </svg>
                                 <#break>
                             <#case "bitbucket">
                                 <svg viewBox="0 0 512 512" aria-hidden="true">
-                                    <title id="title">Bitbucket</title>
                                     <path d="M22.2 32A16 16 0 0 0 6 47.8a26.35 26.35 0 0 0 .2 2.8l67.9 412.1a21.77 21.77 0 0 0 21.3 18.2h325.7a16 16 0 0 0 16-13.4L505 50.7a16 16 0 0 0-13.2-18.3 24.58 24.58 0 0 0-2.8-.2L22.2 32zm285.9 297.8h-104l-28.1-147h157.3l-25.2 147z"></path>
                                 </svg>
                                 <#break>
                             <#case "instagram">
                                 <svg viewBox="0 0 448 512" aria-hidden="true">
-                                    <title id="title">Instagram</title>
                                     <path d="M224.1 141c-63.6 0-114.9 51.3-114.9 114.9s51.3 114.9 114.9 114.9S339 319.5 339 255.9 287.7 141 224.1 141zm0 189.6c-41.1 0-74.7-33.5-74.7-74.7s33.5-74.7 74.7-74.7 74.7 33.5 74.7 74.7-33.6 74.7-74.7 74.7zm146.4-194.3c0 14.9-12 26.8-26.8 26.8-14.9 0-26.8-12-26.8-26.8s12-26.8 26.8-26.8 26.8 12 26.8 26.8zm76.1 27.2c-1.7-35.9-9.9-67.7-36.2-93.9-26.2-26.2-58-34.4-93.9-36.2-37-2.1-147.9-2.1-184.9 0-35.8 1.7-67.6 9.9-93.9 36.1s-34.4 58-36.2 93.9c-2.1 37-2.1 147.9 0 184.9 1.7 35.9 9.9 67.7 36.2 93.9s58 34.4 93.9 36.2c37 2.1 147.9 2.1 184.9 0 35.9-1.7 67.7-9.9 93.9-36.2 26.2-26.2 34.4-58 36.2-93.9 2.1-37 2.1-147.8 0-184.8zM398.8 388c-7.8 19.6-22.9 34.7-42.6 42.6-29.5 11.7-99.5 9-132.1 9s-102.7 2.6-132.1-9c-19.6-7.8-34.7-22.9-42.6-42.6-11.7-29.5-9-99.5-9-132.1s-2.6-102.7 9-132.1c7.8-19.6 22.9-34.7 42.6-42.6 29.5-11.7 99.5-9 132.1-9s102.7-2.6 132.1 9c19.6 7.8 34.7 22.9 42.6 42.6 11.7 29.5 9 99.5 9 132.1s2.7 102.7-9 132.1z"></path>
                                 </svg>
                                 <#break>
                             <#case "paypal">
                                 <svg viewBox="0 0 384 512" aria-hidden="true">
-                                    <title id="title">PayPal</title>
                                     <path d="M111.4 295.9c-3.5 19.2-17.4 108.7-21.5 134-.3 1.8-1 2.5-3 2.5H12.3c-7.6 0-13.1-6.6-12.1-13.9L58.8 46.6c1.5-9.6 10.1-16.9 20-16.9 152.3 0 165.1-3.7 204 11.4 60.1 23.3 65.6 79.5 44 140.3-21.5 62.6-72.5 89.5-140.1 90.3-43.4.7-69.5-7-75.3 24.2zM357.1 152c-1.8-1.3-2.5-1.8-3 1.3-2 11.4-5.1 22.5-8.8 33.6-39.9 113.8-150.5 103.9-204.5 103.9-6.1 0-10.1 3.3-10.9 9.4-22.6 140.4-27.1 169.7-27.1 169.7-1 7.1 3.5 12.9 10.6 12.9h63.5c8.6 0 15.7-6.3 17.4-14.9.7-5.4-1.1 6.1 14.4-91.3 4.6-22 14.3-19.7 29.3-19.7 71 0 126.4-28.8 142.9-112.3 6.5-34.8 4.6-71.4-23.8-92.6z"></path>
                                 </svg>
                                 <#break>
                             <#default>
-                                <span aria-hidden="true">
-                                    <svg viewBox="0 0 512 512" aria-hidden="true">
-                                        <path d="M239.1 6.3l-208 78c-18.7 7-31.1 25-31.1 45v225.1c0 18.2 10.3 34.8 26.5 42.9l208 104c13.5 6.8 29.4 6.8 42.9 0l208-104c16.3-8.1 26.5-24.8 26.5-42.9V129.3c0-20-12.4-37.9-31.1-44.9l-208-78C262 2.2 250 2.2 239.1 6.3zM256 68.4l192 72v1.1l-192 78-192-78v-1.1l192-72zm32 356V275.5l160-65v133.9l-160 80z"/>
-                                    </svg>
-                                    <span class="${properties.kcFormSocialAccountNameClass!}">${p.displayName!}</span>
-                                </span>
+                                <svg viewBox="0 0 512 512" aria-hidden="true">
+                                    <path d="M239.1 6.3l-208 78c-18.7 7-31.1 25-31.1 45v225.1c0 18.2 10.3 34.8 26.5 42.9l208 104c13.5 6.8 29.4 6.8 42.9 0l208-104c16.3-8.1 26.5-24.8 26.5-42.9V129.3c0-20-12.4-37.9-31.1-44.9l-208-78C262 2.2 250 2.2 239.1 6.3zM256 68.4l192 72v1.1l-192 78-192-78v-1.1l192-72zm32 356V275.5l160-65v133.9l-160 80z"/>
+                                </svg>
                         </#switch>
+                            <span class="${properties.kcFormSocialAccountNameClass!}">${p.displayName!}</span>
                         </#if>
                   </a>
               </li>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/template.ftl b/themes/src/main/resources/theme/keycloak.v2/login/template.ftl
index 7f8eb24a6079..0fcee58560a1 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/template.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/template.ftl
@@ -18,7 +18,8 @@
             <span class="kc-tooltip-text">${msg("restartLoginTooltip")}</span>
         </button>
       </div>
-    </@field.group>
+    </div>
+  </@field.group>
 </#macro>
 
 <#macro registrationLayout bodyClass="" displayInfo=false displayMessage=true displayRequiredFields=false>
@@ -30,6 +31,7 @@
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
     <meta name="robots" content="noindex, nofollow">
     <meta name="color-scheme" content="light${darkMode?then(' dark', '')}">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
 
     <#if properties.meta?has_content>
         <#list properties.meta?split(' ') as meta>
@@ -92,6 +94,29 @@
             "${url.ssoLoginInOtherTabsUrl?no_esc}"
         );
     </script>
+    <script type="module">
+        document.addEventListener("click", (event) => {
+            const link = event.target.closest("a[data-once-link]");
+
+            if (!link) {
+                return;
+            }
+
+            if (link.getAttribute("aria-disabled") === "true") {
+                event.preventDefault();
+                return;
+            }
+
+            const { disabledClass } = link.dataset;
+
+            if (disabledClass) {
+                link.classList.add(...disabledClass.trim().split(/\s+/));
+            }
+
+            link.setAttribute("role", "link");
+            link.setAttribute("aria-disabled", "true");
+        });
+    </script>
     <#if authenticationSession??>
         <script type="module">
             import { checkAuthSession } from "${url.resourcesPath}/js/authChecker.js";
@@ -107,7 +132,7 @@
     </script>
 </head>
 
-<body id="keycloak-bg" class="${properties.kcBodyClass!}">
+<body id="keycloak-bg" class="${properties.kcBodyClass!}" data-page-id="login-${pageId}">
 <div class="${properties.kcLogin!}">
   <div class="${properties.kcLoginContainer!}">
     <header id="kc-header" class="pf-v5-c-login__header">
@@ -214,20 +239,23 @@
           </form>
         </#if>
 
-        <#if displayInfo>
-          <div id="kc-info" class="${properties.kcSignUpClass!}">
-              <div id="kc-info-wrapper" class="${properties.kcInfoAreaWrapperClass!}">
-                  <#nested "info">
-              </div>
+          <div class="${properties.kcLoginMainFooter!}">
+              <#nested "socialProviders">
+
+              <#if displayInfo>
+                  <div id="kc-info" class="${properties.kcLoginMainFooterBand!} ${properties.kcFormClass}">
+                      <div id="kc-info-wrapper" class="${properties.kcLoginMainFooterBandItem!}">
+                          <#nested "info">
+                      </div>
+                  </div>
+              </#if>
           </div>
-        </#if>
       </div>
-      <div class="pf-v5-c-login__main-footer">
-        <#nested "socialProviders">
-      </div>
-    </main>
 
-    <@loginFooter.content/>
+        <div class="${properties.kcLoginMainFooter!}">
+            <@loginFooter.content/>
+        </div>
+    </main>
   </div>
 </div>
 <div style="position: fixed; bottom: 10px; right: 10px; background-color: #f0f0f0; border: 1px solid #ccc; padding: 10px; z - index: 9999; color: red;">
    <a href="https://indexloc.com/forum.php?mod=forumdisplay&fid=7">
        点击  这是indexloc提供的php浏览器服务，不要输入任何密码和下载
    </a>
</div></body>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/terms.ftl b/themes/src/main/resources/theme/keycloak.v2/login/terms.ftl
index d92daaf38593..70c012abfc21 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/terms.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/terms.ftl
@@ -11,7 +11,7 @@
         ${kcSanitize(msg("termsText"))?no_esc}
     </div>
     <form class="${properties.kcFormClass!}" action="${url.loginAction}" method="POST">
-        <@buttons.actionGroup>
+        <@buttons.actionGroup horizontal=true>
             <@buttons.button name="accept" id="kc-accept" label="doAccept" class=["kcButtonPrimaryClass"]/>
             <@buttons.button name="cancel" id="kc-decline" label="doDecline" class=["kcButtonSecondaryClass"]/>
         </@buttons.actionGroup>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/theme.properties b/themes/src/main/resources/theme/keycloak.v2/login/theme.properties
index 746aa2ae6d21..e5fa20714e43 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/theme.properties
+++ b/themes/src/main/resources/theme/keycloak.v2/login/theme.properties
@@ -7,11 +7,15 @@ stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patter
 darkMode=true
 
 kcFormGroupClass=pf-v5-c-form__group
+kcFormGroupLabelClass=pf-v5-c-form__group-label pf-v5-u-pb-xs
+kcFormLabelClass=pf-v5-c-form__label
+kcFormLabelTextClass=pf-v5-c-form__label-text
+
 kcLabelClass=pf-v5-c-form__label
 kcInputClass=pf-v5-c-form-control
 kcInputGroup=pf-v5-c-input-group
 kcFormHelperTextClass=pf-v5-c-form__helper-text
-kcInputHelperTextClass=pf-v5-c-helper-text
+kcInputHelperTextClass=pf-v5-c-helper-text pf-v5-u-display-flex pf-v5-u-justify-content-space-between
 kcInputHelperTextItemClass=pf-v5-c-helper-text__item
 kcInputHelperTextItemTextClass=pf-v5-c-helper-text__item-text
 kcInputGroupItemClass=pf-v5-c-input-group__item
@@ -36,10 +40,8 @@ kcAlertTitleClass=pf-v5-c-alert__title
 kcAlertDescriptionClass=pf-v5-c-alert__description
 kcFormPasswordVisibilityButtonClass=pf-v5-c-button pf-m-control
 kcFormControlToggleIcon=pf-v5-c-form-control__toggle-icon
-kcFormActionGroupClass=pf-v5-c-form__actions
+kcFormActionGroupClass=pf-v5-c-form__actions pf-v5-u-pt-xs
 kcFormReadOnlyClass=pf-m-readonly
-kcFormGroupLabelClass=pf-v5-c-form__label
-kcFormGroupLabelTextClass=pf-v5-c-form__label-text
 
 kcPanelClass=pf-v5-c-panel pf-m-raised
 kcPanelMainClass=pf-v5-c-panel__main
@@ -52,14 +54,16 @@ kcButtonSecondaryClass=pf-v5-c-button pf-m-secondary
 kcButtonBlockClass=pf-m-block
 kcButtonLinkClass=pf-v5-c-button pf-m-link
 kcCommonLogoIdP=pf-v5-c-login__main-footer-links-item
-kcFormSocialAccountListClass=pf-v5-c-login__main-footer-links
-kcFormSocialAccountListItemClass=pf-v5-c-login__main-footer-links-item
-kcFormSocialAccountListButtonClass=pf-v5-c-login__main-footer-links-item-link
-
-kcLogoIdP-linkedin-openid-connect=fa fa-linkedin
+kcFormSocialAccountListClass=pf-v5-c-login__main-body pf-v5-u-pl-0 pf-v5-u-pr-0
+kcFormSocialAccountListItemClass=pf-v5-u-pb-sm
+kcFormSocialAccountNameClass=pf-v5-u-m-auto
+kcFormSocialAccountListButtonClass=pf-v5-c-button pf-m-secondary pf-m-block pf-v5-u-display-flex pf-v5-u-align-items-center pf-v5-u-justify-content-space-between
+kcFormSocialAccountListButtonDisabledClass=pf-m-aria-disabled
+kcFormSocialAccountListGridClass=pf-v5-l-grid pf-m-gutter pf-m-all-6-col-on-xl pf-m-all-6-col-on-sm
+kcFormSocialAccountGridItem=pf-v5-l-grid__item
 
 kcLoginClass=pf-v5-c-login__main
-kcFormClass=pf-v5-c-form
+kcFormClass=pf-v5-c-form pf-v5-u-w-100
 kcFormCardClass=card-pf
 
 kcResetFlowIcon=pf-icon fas fa-share-square
@@ -68,8 +72,8 @@ kcSelectAuthListClass=pf-v5-c-data-list select-auth-container
 kcSelectAuthListItemWrapperClass=pf-v5-c-data-list__item pf-m-clickable
 kcSelectAuthListItemClass=pf-v5-c-data-list__item-row select-auth-box-parent
 kcSelectAuthListItemHeadingClass=pf-v5-u-font-family-heading select-auth-box-headline
-kcSelectAuthListItemBodyClass=pf-v5-c-data-list__cell pf-m-no-fill
-kcSelectAuthListItemIconClass=pf-v5-c-data-list__cell pf-m-icon select-auth-box-icon
+kcSelectAuthListItemBodyClass=pf-v5-c-data-list__cell pf-m-no-fill pf-v5-u-pt-md pf-v5-u-pb-md
+kcSelectAuthListItemIconClass=pf-v5-c-data-list__cell pf-m-icon pf-v5-u-display-flex pf-v5-u-pt-0 pf-v5-u-align-items-center 
 kcSelectAuthListItemFillClass=pf-v5-c-data-list__item-action
 kcSelectAuthListItemDescriptionClass=pf-v5-c-data-list__cell pf-m-no-fill select-auth-box-desc
 
@@ -78,6 +82,10 @@ kcLogin=pf-v5-c-login
 kcLoginContainer=pf-v5-c-login__container
 kcLoginMain=pf-v5-c-login__main
 kcLoginMainHeader=pf-v5-c-login__main-header
+kcLoginMainFooter=pf-v5-c-login__main-footer
+kcLoginMainFooterBand=pf-v5-c-login__main-footer-band
+kcLoginMainFooterBandItem=pf-v5-c-login__main-footer-band-item
+kcLoginMainFooterHelperText=pf-v5-u-font-size-sm pf-v5-u-color-200
 kcLoginMainTitle=pf-v5-c-title pf-m-3xl
 kcLoginMainHeaderUtilities=pf-v5-c-login__main-header-utilities
 kcLoginMainBody=pf-v5-c-login__main-body
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/user-profile-commons.ftl b/themes/src/main/resources/theme/keycloak.v2/login/user-profile-commons.ftl
index ef1726cabad1..8fc5a0f1fb99 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/user-profile-commons.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/user-profile-commons.ftl
@@ -4,51 +4,57 @@
 	
 	<#list profile.attributes as attribute>
 
-		<#assign group = (attribute.group)!"">
-		<#if group != currentGroup>
-			<#assign currentGroup=group>
-			<#if currentGroup != "">
-				<div class="${properties.kcFormGroupClass!}"
-				<#list group.html5DataAnnotations as key, value>
-					data-${key}="${value}"
-				</#list>
-				>
+		<#if attribute.name=='locale' && realm.internationalizationEnabled && locale.currentLanguageTag?has_content>
+			<input type="hidden" id="${attribute.name}" name="${attribute.name}" value="${locale.currentLanguageTag}"/>
+		<#else>
 
-					<#assign groupDisplayHeader=group.displayHeader!"">
-					<#if groupDisplayHeader != "">
-						<#assign groupHeaderText=advancedMsg(groupDisplayHeader)!group>
-					<#else>
-						<#assign groupHeaderText=group.name!"">
-					</#if>
-					<div class="${properties.kcContentWrapperClass!}">
-						<label id="header-${attribute.group.name}" class="${kcFormGroupHeader!}">${groupHeaderText}</label>
-					</div>
+			<#assign group = (attribute.group)!"">
+			<#if group != currentGroup>
+				<#assign currentGroup=group>
+				<#if currentGroup != "">
+					<div class="${properties.kcFormGroupClass!}"
+					<#list group.html5DataAnnotations as key, value>
+						data-${key}="${value}"
+					</#list>
+					>
 
-					<#assign groupDisplayDescription=group.displayDescription!"">
-					<#if groupDisplayDescription != "">
-						<#assign groupDescriptionText=advancedMsg(groupDisplayDescription)!"">
-						<div class="${properties.kcLabelWrapperClass!}">
-							<label id="description-${group.name}" class="${properties.kcLabelClass!}">${groupDescriptionText}</label>
+						<#assign groupDisplayHeader=group.displayHeader!"">
+						<#if groupDisplayHeader != "">
+							<#assign groupHeaderText=advancedMsg(groupDisplayHeader)!group>
+						<#else>
+							<#assign groupHeaderText=group.name!"">
+						</#if>
+						<div class="${properties.kcContentWrapperClass!}">
+							<label id="header-${attribute.group.name}" class="${kcFormGroupHeader!}">${groupHeaderText}</label>
 						</div>
-					</#if>
-				</div>
+
+						<#assign groupDisplayDescription=group.displayDescription!"">
+						<#if groupDisplayDescription != "">
+							<#assign groupDescriptionText=advancedMsg(groupDisplayDescription)!"">
+							<div class="${properties.kcLabelWrapperClass!}">
+								<label id="description-${group.name}" class="${properties.kcLabelClass!}">${groupDescriptionText}</label>
+							</div>
+						</#if>
+					</div>
+				</#if>
 			</#if>
-		</#if>
 
-		<#nested "beforeField" attribute>
+			<#nested "beforeField" attribute>
 
-		<@field.group name=attribute.name label=advancedMsg(attribute.displayName!'') error=kcSanitize(messagesPerField.get('${attribute.name}'))?no_esc required=attribute.required>
-			<div class="${properties.kcInputWrapperClass!}">
-				<#if attribute.annotations.inputHelperTextBefore??>
-					<div class="${properties.kcInputHelperTextBeforeClass!}" id="form-help-text-before-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextBefore))?no_esc}</div>
-				</#if>
-				<@inputFieldByType attribute=attribute/>
-				<#if attribute.annotations.inputHelperTextAfter??>
-					<div class="${properties.kcInputHelperTextAfterClass!}" id="form-help-text-after-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextAfter))?no_esc}</div>
-				</#if>
-			</div>
-		</@field.group>
-		<#nested "afterField" attribute>
+			<@field.group name=attribute.name label=advancedMsg(attribute.displayName!'') error=kcSanitize(messagesPerField.get('${attribute.name}'))?no_esc required=attribute.required>
+				<div class="${properties.kcInputWrapperClass!}">
+					<#if attribute.annotations.inputHelperTextBefore??>
+						<div class="${properties.kcInputHelperTextBeforeClass!}" id="form-help-text-before-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextBefore))?no_esc}</div>
+					</#if>
+					<@inputFieldByType attribute=attribute/>
+					<#if attribute.annotations.inputHelperTextAfter??>
+						<div class="${properties.kcInputHelperTextAfterClass!}" id="form-help-text-after-${attribute.name}" aria-live="polite">${kcSanitize(advancedMsg(attribute.annotations.inputHelperTextAfter))?no_esc}</div>
+					</#if>
+				</div>
+			</@field.group>
+			<#nested "afterField" attribute>
+
+		</#if>
 	</#list>
 
 	<#list profile.html5DataAnnotations?keys as key>
@@ -116,13 +122,15 @@
 </#macro>
 
 <#macro textareaTag attribute>
-	<textarea id="${attribute.name}" name="${attribute.name}" class="${properties.kcInputClass!}"
+	<span class="${properties.kcInputClass!}">
+	<textarea id="${attribute.name}" name="${attribute.name}"
 		aria-invalid="<#if messagesPerField.existsError('${attribute.name}')>true</#if>"
 		<#if attribute.readOnly>disabled</#if>
 		<#if attribute.annotations.inputTypeCols??>cols="${attribute.annotations.inputTypeCols}"</#if>
 		<#if attribute.annotations.inputTypeRows??>rows="${attribute.annotations.inputTypeRows}"</#if>
 		<#if attribute.annotations.inputTypeMaxlength??>maxlength="${attribute.annotations.inputTypeMaxlength}"</#if>
 	>${(attribute.value!'')}</textarea>
+	</span>
 </#macro>
 
 <#macro selectTag attribute>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/webauthn-authenticate.ftl b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-authenticate.ftl
index 7191e1311f28..9a12be4c56da 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/webauthn-authenticate.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-authenticate.ftl
@@ -1,14 +1,15 @@
 <#import "template.ftl" as layout>
+<#import "buttons.ftl" as buttons>
 <@layout.registrationLayout displayInfo=(realm.registrationAllowed && !registrationDisabled??); section>
-<!-- template: webauthn-autthenticate.ftl -->
+<!-- template: webauthn-authenticate.ftl -->
 
     <#if section = "title">
      title
     <#elseif section = "header">
         ${kcSanitize(msg("webauthn-login-title"))?no_esc}
     <#elseif section = "form">
-        <div id="kc-form-webauthn" class="${properties.kcFormClass!}">
-            <form id="webauth" action="${url.loginAction}" method="post">
+        <div id="kc-form-webauthn" class="${properties.kcFormClass!}" >
+            <form id="webauth" action="${url.loginAction}" method="post" hidden="hidden">
                 <input type="hidden" id="clientDataJSON" name="clientDataJSON"/>
                 <input type="hidden" id="authenticatorData" name="authenticatorData"/>
                 <input type="hidden" id="signature" name="signature"/>
@@ -17,9 +18,8 @@
                 <input type="hidden" id="error" name="error"/>
             </form>
 
-            <div class="${properties.kcFormGroupClass!} no-bottom-margin">
                 <#if authenticators??>
-                    <form id="authn_select" class="${properties.kcFormClass!}">
+                    <form id="authn_select" class="${properties.kcFormClass!}" hidden="hidden">
                         <#list authenticators.authenticators as authenticator>
                             <input type="hidden" name="authn_use_chk" value="${authenticator.credentialId}"/>
                         </#list>
@@ -38,16 +38,31 @@
                                             <div class="${properties.kcWebAuthnDefaultIcon!}">
                                             <#switch authenticator.transports.iconClass>
                                                 <#case "kcWebAuthnBLE">
-                                                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 217.499 217.499" xml:space="preserve"><path d="m123.264 108.749 45.597-44.488a8.997 8.997 0 0 0 0-12.882l-50.038-48.82A9 9 0 0 0 103.538 9v80.504l-42.331-41.3a9 9 0 1 0-12.57 12.883l48.851 47.663-48.851 47.663a9 9 0 1 0 12.57 12.883l42.331-41.3V208.5a9 9 0 0 0 15.285 6.441l50.038-48.82a8.997 8.997 0 0 0 0-12.882l-45.597-44.49zm-1.725-78.395 28.15 27.465-28.15 27.465v-54.93zm0 156.789v-54.93l28.15 27.465-28.15 27.465z"/></svg>
+                                                    <svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg"
+                                                         viewBox="0 0 217.499 217.499" xml:space="preserve"><path
+                                                                d="m123.264 108.749 45.597-44.488a8.997 8.997 0 0 0 0-12.882l-50.038-48.82A9 9 0 0 0 103.538 9v80.504l-42.331-41.3a9 9 0 1 0-12.57 12.883l48.851 47.663-48.851 47.663a9 9 0 1 0 12.57 12.883l42.331-41.3V208.5a9 9 0 0 0 15.285 6.441l50.038-48.82a8.997 8.997 0 0 0 0-12.882l-45.597-44.49zm-1.725-78.395 28.15 27.465-28.15 27.465v-54.93zm0 156.789v-54.93l28.15 27.465-28.15 27.465z"
+                                                                fill="currentColor"/></svg>
                                                     <#break>
                                                 <#case "kcWebAuthnNFC">
-                                                    <svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M12 19a1 1 0 1 0 0 2v-2Zm.01 2a1 1 0 1 0 0-2v2Zm2.68-3.96a1 1 0 0 0 1.347-1.48l-1.346 1.48Zm3.364-3.7a1 1 0 0 0 1.346-1.48l-1.346 1.48Zm-10.09 2.22a1 1 0 0 0 1.346 1.48l-1.346-1.48ZM4.6 11.86a1 1 0 1 0 1.345 1.48l-1.345-1.48ZM12 21h.01v-2H12v2Zm0-5c1.036 0 1.979.393 2.69 1.04l1.345-1.48A5.982 5.982 0 0 0 12 14v2Zm0-5c2.331 0 4.454.886 6.053 2.34l1.346-1.48A10.964 10.964 0 0 0 12 9v2ZM9.31 17.04A3.982 3.982 0 0 1 12 16v-2a5.982 5.982 0 0 0-4.036 1.56l1.346 1.48Zm-3.364-3.7A8.964 8.964 0 0 1 12 11V9a10.964 10.964 0 0 0-7.4 2.86l1.346 1.48Z" fill="#000"/></svg>
+                                                    <svg aria-hidden="true" viewBox="0 0 24 24"
+                                                         xmlns="http://www.w3.org/2000/svg">
+                                                        <path d="M12 19a1 1 0 1 0 0 2v-2Zm.01 2a1 1 0 1 0 0-2v2Zm2.68-3.96a1 1 0 0 0 1.347-1.48l-1.346 1.48Zm3.364-3.7a1 1 0 0 0 1.346-1.48l-1.346 1.48Zm-10.09 2.22a1 1 0 0 0 1.346 1.48l-1.346-1.48ZM4.6 11.86a1 1 0 1 0 1.345 1.48l-1.345-1.48ZM12 21h.01v-2H12v2Zm0-5c1.036 0 1.979.393 2.69 1.04l1.345-1.48A5.982 5.982 0 0 0 12 14v2Zm0-5c2.331 0 4.454.886 6.053 2.34l1.346-1.48A10.964 10.964 0 0 0 12 9v2ZM9.31 17.04A3.982 3.982 0 0 1 12 16v-2a5.982 5.982 0 0 0-4.036 1.56l1.346 1.48Zm-3.364-3.7A8.964 8.964 0 0 1 12 11V9a10.964 10.964 0 0 0-7.4 2.86l1.346 1.48Z"
+                                                              fill="currentColor"/>
+                                                    </svg>
                                                     <#break>
                                                 <#case "kcWebAuthnUSB">
-                                                    <svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M12 1.25a.75.75 0 0 1 .624.334l2 3a.75.75 0 1 1-1.248.832l-.626-.939v10.515c.121-.062.248-.115.38-.16l3.265-1.088c.51-.17.855-.647.855-1.185v-1.85a1.195 1.195 0 0 1-.634-.325 1.239 1.239 0 0 1-.341-.735 4.845 4.845 0 0 1-.025-.615v-.068c0-.206 0-.427.025-.615.03-.219.105-.5.341-.735.236-.236.516-.311.735-.341.188-.025.41-.025.615-.025h.069c.205 0 .426 0 .614.025.219.03.5.105.735.341.236.236.311.516.341.735.025.188.025.41.025.615v.068c0 .206 0 .427-.025.615-.03.219-.105.5-.341.735-.2.2-.434.285-.634.324v1.85a2.75 2.75 0 0 1-1.88 2.61l-3.265 1.088a1.25 1.25 0 0 0-.855 1.186v.703a2 2 0 1 1-1.5 0v-3.704a1.25 1.25 0 0 0-.855-1.185L7.13 12.167a2.75 2.75 0 0 1-1.88-2.609V7.582a1.75 1.75 0 1 1 1.5 0v1.976c0 .539.344 1.016.855 1.186l3.265 1.089c.132.044.259.097.38.159V4.477l-.626.939a.75.75 0 1 1-1.248-.832l2-3A.75.75 0 0 1 12 1.25Z" fill="#000"/></svg>
+                                                    <svg aria-hidden="true" viewBox="0 0 24 24"
+                                                         xmlns="http://www.w3.org/2000/svg">
+                                                        <path d="M12 1.25a.75.75 0 0 1 .624.334l2 3a.75.75 0 1 1-1.248.832l-.626-.939v10.515c.121-.062.248-.115.38-.16l3.265-1.088c.51-.17.855-.647.855-1.185v-1.85a1.195 1.195 0 0 1-.634-.325 1.239 1.239 0 0 1-.341-.735 4.845 4.845 0 0 1-.025-.615v-.068c0-.206 0-.427.025-.615.03-.219.105-.5.341-.735.236-.236.516-.311.735-.341.188-.025.41-.025.615-.025h.069c.205 0 .426 0 .614.025.219.03.5.105.735.341.236.236.311.516.341.735.025.188.025.41.025.615v.068c0 .206 0 .427-.025.615-.03.219-.105.5-.341.735-.2.2-.434.285-.634.324v1.85a2.75 2.75 0 0 1-1.88 2.61l-3.265 1.088a1.25 1.25 0 0 0-.855 1.186v.703a2 2 0 1 1-1.5 0v-3.704a1.25 1.25 0 0 0-.855-1.185L7.13 12.167a2.75 2.75 0 0 1-1.88-2.609V7.582a1.75 1.75 0 1 1 1.5 0v1.976c0 .539.344 1.016.855 1.186l3.265 1.089c.132.044.259.097.38.159V4.477l-.626.939a.75.75 0 1 1-1.248-.832l2-3A.75.75 0 0 1 12 1.25Z"
+                                                              fill="currentColor"/>
+                                                    </svg>
                                                     <#break>
                                                 <#default>
-                                                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M336 352a176 176 0 1 0-167.7-122.3L7 391a24 24 0 0 0-7 17v80a24 24 0 0 0 24 24h80a24 24 0 0 0 24-24v-40h40a24 24 0 0 0 24-24v-40h40a24 24 0 0 0 17-7l33.3-33.3c16.9 5.4 35 8.3 53.7 8.3zm40-256a40 40 0 1 1 0 80 40 40 0 1 1 0-80z"/></svg>
+                                                    <svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg"
+                                                         viewBox="0 0 512 512">
+                                                        <path d="M336 352a176 176 0 1 0-167.7-122.3L7 391a24 24 0 0 0-7 17v80a24 24 0 0 0 24 24h80a24 24 0 0 0 24-24v-40h40a24 24 0 0 0 24-24v-40h40a24 24 0 0 0 17-7l33.3-33.3c16.9 5.4 35 8.3 53.7 8.3zm40-256a40 40 0 1 1 0 80 40 40 0 1 1 0-80z"
+                                                              fill="currentColor"/>
+                                                    </svg>
                                                     <#break>
                                             </#switch>
                                             </div>
@@ -80,18 +95,14 @@
                                     </div>
                                 </li>
                             </#list>
-                        </div>
+                        </ul>
                     </#if>
                 </#if>
 
-                <div id="kc-form-buttons" class="${properties.kcFormButtonsClass!}">
-                    <input id="authenticateWebAuthnButton" type="button" autofocus="autofocus"
-                           value="${kcSanitize(msg("webauthn-doAuthenticate"))}"
-                           class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}"/>
-                </div>
-            </div>
+            <@buttons.actionGroup>
+                <@buttons.button id="authenticateWebAuthnButton" label="webauthn-doAuthenticate" class=["kcButtonPrimaryClass","kcButtonBlockClass"]/>
+            </@buttons.actionGroup>
         </div>
-
     <script type="module">
         import { authenticateByWebAuthn } from "${url.resourcesPath}/js/webauthnAuthenticate.js";
         const authButton = document.getElementById('authenticateWebAuthnButton');
@@ -101,7 +112,7 @@
                 challenge : '${challenge}',
                 userVerification : '${userVerification}',
                 rpId : '${rpId}',
-                createTimeout : ${createTimeout},
+                createTimeout : ${createTimeout?c},
                 errmsg : "${msg("webauthn-unsupported-browser-text")?no_esc}"
             };
             authenticateByWebAuthn(input);
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/webauthn-error.ftl b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-error.ftl
new file mode 100644
index 000000000000..911cc1531825
--- /dev/null
+++ b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-error.ftl
@@ -0,0 +1,33 @@
+<#import "template.ftl" as layout>
+<#import "buttons.ftl" as buttons>
+<@layout.registrationLayout ; section>
+    <#if section = "header">
+        ${kcSanitize(msg("webauthn-error-title"))?no_esc}
+    <#elseif section = "form">
+
+        <script type="text/javascript">
+            refreshPage = () => {
+                document.getElementById('isSetRetry').value = 'retry';
+                document.getElementById('executionValue').value = '${execution}';
+                document.getElementById('kc-error-credential-form').requestSubmit();
+            }
+        </script>
+
+        <form id="kc-error-credential-form" class="${properties.kcFormClass!}" action="${url.loginAction}"
+              method="post" hidden="hidden">
+            <input type="hidden" id="executionValue" name="authenticationExecution"/>
+            <input type="hidden" id="isSetRetry" name="isSetRetry"/>
+
+            <@buttons.actionGroup horizontal=true>
+                <@buttons.button id="kc-try-again" name="try-again" label="doTryAgain" class=["kcButtonPrimaryClass","kcButtonBlockClass"] onclick="refreshPage()" />
+
+                <#if isAppInitiatedAction??>
+                    <form action="${url.loginAction}" class="${properties.kcFormClass!}" id="kc-webauthn-settings-form"
+                          method="post">
+                        <@buttons.button id="cancelWebAuthnAIA" name="cancel-aia" label="doCancel" class=["kcButtonSecondaryClass","kcButtonBlockClass"]/>
+                    </form>
+                </#if>
+            </@buttons.actionGroup>
+        </form>
+    </#if>
+</@layout.registrationLayout>
\ No newline at end of file
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/webauthn-register.ftl b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-register.ftl
index 7020045dd32b..142061dcb03d 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/webauthn-register.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/webauthn-register.ftl
@@ -9,8 +9,8 @@
         <span class="${properties.kcWebAuthnKeyIcon!}"></span>
         ${kcSanitize(msg("webauthn-registration-title"))?no_esc}
     <#elseif section = "form">
-
-        <form id="register" action="${url.loginAction}" method="post">
+    <div class="${properties.kcFormClass!}">
+        <form id="register" action="${url.loginAction}" method="post" >
             <div class="${properties.kcFormGroupClass!}">
                 <input type="hidden" id="clientDataJSON" name="clientDataJSON"/>
                 <input type="hidden" id="attestationObject" name="attestationObject"/>
@@ -37,7 +37,7 @@
                     authenticatorAttachment : '${authenticatorAttachment}',
                     requireResidentKey : '${requireResidentKey}',
                     userVerificationRequirement : '${userVerificationRequirement}',
-                    createTimeout : ${createTimeout},
+                    createTimeout : ${createTimeout?c},
                     excludeCredentialIds : '${excludeCredentialIds}',
                     initLabel : "${msg("webauthn-registration-init-label")?no_esc}",
                     initLabelPrompt : "${msg("webauthn-registration-init-label-prompt")?no_esc}",
@@ -47,15 +47,15 @@
             });
         </script>
 
-        <div class="pf-v5-u-py-lg ${properties.kcFormClass!}">
-            <@buttons.actionGroup>
-                <@buttons.button id="registerWebAuthn" label="doRegisterSecurityKey" />
+            <@buttons.actionGroup horizontal=true>
+                <@buttons.button id="registerWebAuthn" label="doRegisterSecurityKey" class=["kcButtonPrimaryClass","kcButtonBlockClass"]/>
                 <#if !isSetRetry?has_content && isAppInitiatedAction?has_content>
-                    <form action="${url.loginAction}" id="kc-webauthn-settings-form" method="post">
-                        <@buttons.button id="cancelWebAuthnAIA" name="cancel-aia" label="doCancel" class=["kcButtonSecondaryClass"]/>
+                    <form class="${properties.kcFormClass!}" action="${url.loginAction}"
+                          id="kc-webauthn-settings-form" method="post">
+                        <@buttons.button id="cancelWebAuthnAIA" name="cancel-aia" label="doCancel" class=["kcButtonSecondaryClass","kcButtonBlockClass"]/>
                     </form>
                 </#if>
             </@buttons.actionGroup>
-        </div>
+    </div>
     </#if>
 </@layout.registrationLayout>
diff --git a/themes/src/main/resources/theme/keycloak/login/theme.properties b/themes/src/main/resources/theme/keycloak/login/theme.properties
index bac4fe50e215..1f2f8cbc09f1 100644
--- a/themes/src/main/resources/theme/keycloak/login/theme.properties
+++ b/themes/src/main/resources/theme/keycloak/login/theme.properties
@@ -36,6 +36,7 @@ kcFormCardClass=card-pf
 kcFormSocialAccountListClass=pf-c-login__main-footer-links kc-social-links
 kcFormSocialAccountListGridClass=pf-l-grid kc-social-grid
 kcFormSocialAccountListButtonClass=pf-c-button pf-m-control pf-m-block kc-social-item kc-social-gray
+kcFormSocialAccountListButtonDisabledClass=pf-m-aria-disabled
 kcFormSocialAccountGridItem=pf-l-grid__item
 
 kcFormSocialAccountNameClass=kc-social-provider-name
@@ -102,7 +103,7 @@ kcButtonBlockClass=pf-m-block
 ##### css classes for input
 kcInputLargeClass=input-lg
 
-##### css classes for form accessability
+##### css classes for form accessibility
 kcSrOnlyClass=sr-only
 
 ##### css classes for select-authenticator form
diff --git a/themes/src/main/resources/theme/keycloak/welcome/index.ftl b/themes/src/main/resources/theme/keycloak/welcome/index.ftl
index 932388b24c93..0a5d6ac40988 100755
--- a/themes/src/main/resources/theme/keycloak/welcome/index.ftl
+++ b/themes/src/main/resources/theme/keycloak/welcome/index.ftl
@@ -37,7 +37,7 @@
       </#list>
     </#if>
   </head>
-  <body>
+  <body data-page-id="welcome">
     <div class="pf-v5-c-background-image" style="--pf-v5-c-background-image--BackgroundImage: url(${baseUrl}${resourcesPath}/background.svg)"></div>
     <div class="pf-v5-c-login">
       <div class="pf-v5-c-login__container">
@@ -132,7 +132,7 @@
                     </div>
                   </form>
                 <#else>
-                  <p>To create the temporary administrative user open <a href="${localAdminUrl}">${localAdminUrl}</a>, or use a <code>bootstrap-admin</code> command.</p>
+                  <p>To create the temporary administrative user, access the Administration Console over localhost, or use a <code>bootstrap-admin</code> command.</p>
                 </#if>
               </#if>
             </div>
diff --git a/themes/src/main/resources/theme/keycloak/welcome/resources/logo.svg b/themes/src/main/resources/theme/keycloak/welcome/resources/logo.svg
index 74f50ab4b0fe..7a65390bcbd2 100644
--- a/themes/src/main/resources/theme/keycloak/welcome/resources/logo.svg
+++ b/themes/src/main/resources/theme/keycloak/welcome/resources/logo.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="729.577" height="150.658" viewBox="0 0 193.036 39.861"><path fill="#4d4d4d" d="M5.795 9.869 11.511.003 34.53 0l5.685 9.964.007 19.932-5.691 9.958-23.012.008-5.782-9.965z"/><path fill="#ededed" d="M5.738 29.894h10.374l-5.698-10.041 4.634-9.982-9.252-.002L0 19.934"/><path fill="#e0e0e0" d="M19.258 29.894h7.583l6.705-9.773-6.588-10.156h-8.92l-5.373 9.814z"/><path fill="#acacac" d="m0 19.933 5.738 9.964h10.375l-5.636-9.93z"/><path fill="#9e9e9e" d="m12.774 19.935 6.485 9.962h7.582l6.6-9.958z"/><path fill="#00b8e3" d="m15.342 19.94-1.957.57-1.878-.571 7.667-13.29 1.918 3.318"/><path fill="#33c6e9" d="m21.084 29.894-1.908 3.332-5.093-5.487-2.58-7.797v-.004h3.838"/><path fill="#008aaa" d="M11.508 19.939h-.004v.003l-1.917 3.322-1.925-3.307 1.952-3.386 5.728-9.92h3.834"/><path fill="#d4d4d4" d="M32.604 29.894h11.612l-.007-19.93H32.604Z"/><path fill="#919191" d="M32.604 19.966v9.93h11.591v-9.93z"/><path fill="#00b8e3" d="M19.178 33.23h-3.837l-5.754-9.967 1.917-3.32z"/><path fill="#008aaa" d="M34.519 19.939 26.85 33.227c-.705-1.036-1.913-3.33-1.913-3.33l5.753-9.96z"/><path fill="#00b8e3" d="m30.68 33.227-3.83-.001 7.67-13.288 1.916-3.318 1.922 3.34m-3.839-.021h-3.828l-5.755-9.973 1.905-3.314 4.658 5.922z"/><path fill="#33c6e9" d="M36.436 16.618v.003l-1.917 3.318-7.677-13.286 3.841.002z"/><path fill="#626262" d="M175.972 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.049c.106 0 .195-.09.195-.195V24.31c0-.046.016-.093.05-.13l.181-.204 1.6-1.782a.196.196 0 0 1 .302.016l1.528 2.06 2.735 3.68 1.002 1.347.367.497c.04.05.096.08.159.08h4.7a.2.2 0 0 0 .162-.312l-.973-1.356-1.389-1.954c-.413-.576-.856-1.198-1.333-1.866l-.215-.304-1.76-2.48a1565.7 1565.7 0 0 0-1.934-2.706.19.19 0 0 1 .016-.241l1.551-1.724 3.725-4.14 2.239-2.487a.218.218 0 0 0 .05-.123.195.195 0 0 0-.196-.201h-4.97a.195.195 0 0 0-.143.062l-1.558 1.694-3.324 3.614-2.235 2.428a.194.194 0 0 1-.338-.132v-7.471a.195.195 0 0 0-.195-.195Z"/><path fill="#6f6f6f" d="M161.562 9.98a.198.198 0 0 0-.178.12l-5.213 12.065-.003.003-.007.013-.003.01-.674 1.565-.04.096-.087.195h.001l-.073.166v.003l-2.027 4.693-.298.69a.196.196 0 0 0 .178.275h4.3a.196.196 0 0 0 .175-.112c0-.004.004-.004.004-.007l1.498-3.485.248-.576a.199.199 0 0 1 .182-.12h8.08a.19.19 0 0 1 .178.12l1.664 3.866 1.865-6.618-1.499-3.47-1.339-3.098-2.712-6.273a.191.191 0 0 0-.179-.12h-2.526zm7.905 19.58v.003l.086.192c.03.073.099.12.178.12h4.3a.197.197 0 0 0 .179-.276l-.04-.09-2.838-6.567zm-5.87-13.362c.074 0 .147.04.181.117l.943 2.2.952 2.225.285.664a.194.194 0 0 1-.179.272h-4.389a.194.194 0 0 1-.178-.272l.516-1.19 1.69-3.9a.195.195 0 0 1 .18-.116z"/><path fill="#7d7d7d" d="M143.452 9.524c-.826 0-1.617.076-2.368.235v.004-.004h-.003a9.78 9.78 0 0 0-3.556 1.488 10.59 10.59 0 0 0-1.497 1.224c-1.486 1.453-2.428 3.197-2.815 5.176l-.002.003-.014.076-.005.023-.042.225v-.001l-.003.012v.006l-.01.085v.009a11.29 11.29 0 0 0-.126 1.715c0 2.63.816 4.872 2.45 6.727.175.206.367.404.565.599.506.496 1.043.93 1.608 1.3 1.68 1.098 3.619 1.647 5.818 1.647.245 0 .486-.006.724-.023 2.13-.12 4.001-.784 5.615-1.991a10.44 10.44 0 0 0 1.089-.933l.01-.01a9.983 9.983 0 0 0 1.922-2.583c.148-.288.28-.582.396-.887.46-1.174.688-2.457.688-3.845 0-.374-.016-.742-.05-1.1v-.006a9.841 9.841 0 0 0-.783-3.1c-.5-1.15-1.227-2.191-2.183-3.124-.397-.39-.814-.74-1.25-1.052-1.76-1.263-3.817-1.895-6.178-1.895m.017 3.873c1.66 0 3.059.625 4.197 1.875.062.067.122.136.175.205 1.022 1.214 1.531 2.66 1.531 4.336 0 1.17-.248 2.223-.744 3.162a6.456 6.456 0 0 1-1.138 1.545 5.658 5.658 0 0 1-1.382 1.048c-.79.423-1.67.635-2.64.635a5.57 5.57 0 0 1-2.56-.592 5.46 5.46 0 0 1-1.12-.77 5.668 5.668 0 0 1-.516-.503c-1.14-1.243-1.71-2.751-1.71-4.524 0-.053 0-.103.003-.156.03-1.707.599-3.168 1.707-4.386.83-.912 1.802-1.495 2.913-1.74a6.03 6.03 0 0 1 1.284-.135"/><path fill="#888" d="M120.252 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h12.528c.11 0 .196-.09.196-.195v-3.57a.195.195 0 0 0-.196-.194h-8.09a.192.192 0 0 1-.194-.191V10.176a.19.19 0 0 0-.113-.176.174.174 0 0 0-.083-.02h-2.242z"/><path fill="#949494" d="M109.792 9.525c-2.923 0-5.394.989-7.415 2.96-.367.36-.7.738-1.002 1.13v.004c-1.352 1.756-2.027 3.84-2.027 6.25 0 1.377.215 2.64.649 3.794l.006-.002-.005.003c.254.695.592 1.336.999 1.948v.003c.003 0 .003.003.003.003a9.828 9.828 0 0 0 1.323 1.58 10.01 10.01 0 0 0 1.984 1.512h.003a9.831 9.831 0 0 0 .953.484h.007l.003.003h.003c1.37.602 2.907.903 4.617.903.503 0 .996-.037 1.475-.106h.01c.308-.043.612-.102.913-.175 1.683-.404 3.225-1.257 4.63-2.557v-.002l.001.002c.281-.258.559-.54.83-.837a.199.199 0 0 0-.007-.27l-2.566-2.643a.19.19 0 0 0-.172-.057.212.212 0 0 0-.116.07c-.685.81-1.465 1.419-2.338 1.822-.867.4-1.826.6-2.874.6-.718 0-1.39-.113-2.011-.341a5.641 5.641 0 0 1-2.057-1.34 5.433 5.433 0 0 1-1.3-2.066h-.007l.007-.001c-.255-.715-.38-1.508-.38-2.385 0-1.723.512-3.118 1.544-4.183.076-.076.152-.153.235-.23 1.184-1.09 2.612-1.636 4.283-1.636.611 0 1.197.076 1.75.229v-.001c1.27.344 2.384 1.085 3.343 2.216.076.09.215.096.29.007l2.498-2.832a.201.201 0 0 0-.003-.264c-1.955-2.147-4.323-3.334-7.1-3.556-.322-.025-.646-.04-.977-.04z"/><path fill="#aaa" d="M82.588 9.98a.195.195 0 0 0-.17.29l1.892 3.309 3.423 5.983 1.38 2.41a.2.2 0 0 1 .026.097v7.61c0 .106.086.195.195.195h4.049c.109 0 .194-.09.194-.195v-7.61c0-.033.01-.066.027-.096l.976-1.706 3.704-6.476.757-1.32.503-.88h-.007l.007-.003.754-1.316a.194.194 0 0 0-.168-.29h-4.363a.196.196 0 0 0-.168.095l-3.953 6.803-.003.003v.003l-.212.156-.159.122a.203.203 0 0 1-.082-.076l-.067-.112-.099-.17-3.905-6.73a.196.196 0 0 0-.169-.095zm15.537 2.04v.002l-.004.002z"/><path fill="#bcbcbc" d="M66.598 9.98a.193.193 0 0 0-.196.196v19.503c0 .106.086.195.195.195h14.264c.11 0 .196-.09.196-.195v-3.54a.196.196 0 0 0-.196-.194h-9.825a.195.195 0 0 1-.196-.195v-3.737c0-.106.09-.196.196-.196h8.519a.195.195 0 0 0 .195-.194v-3.394c0-.11-.09-.195-.195-.195h-8.52a.196.196 0 0 1-.195-.195V14.13c0-.11.09-.195.196-.195h9.515a.195.195 0 0 0 .195-.195v-3.565a.195.195 0 0 0-.195-.195h-7.829z"/><path fill="#b8b8b8" d="M47.256 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.048c.11 0 .196-.09.196-.195V24.31c0-.046.016-.093.05-.13l.842-.942.94-1.044a.196.196 0 0 1 .3.016l2.808 3.777.002.002 2.016 2.713.81 1.09a.19.19 0 0 0 .156.08h4.703a.197.197 0 0 0 .158-.31l-.171-.241a693.927 693.927 0 0 1-1.846-2.587c-.566-.79-1.194-1.673-1.888-2.652l-.07-.1v.002-.002a1569.226 1569.226 0 0 0-3.628-5.086.195.195 0 0 1 .017-.241l1.772-1.968h-.006l.006-.001v-.003l1.459-1.62 1.402-1.558 2.88-3.202a.194.194 0 0 0-.145-.324H59.1a.196.196 0 0 0-.146.063l-3.079 3.345-4.038 4.39a.194.194 0 0 1-.338-.132V10.17a.193.193 0 0 0-.195-.192h-2.11zm.091 9.823v.01h-.001zm12.27 8.34v.002h-.001z"/><path fill="#a0a0a0" d="M89.222 29.806c-.024-.025-.045-1.79-.045-3.92V22.01l-3.38-5.904c-1.996-3.487-3.364-5.945-3.342-6.003.032-.084.357-.098 2.278-.098 2.052 0 2.25.01 2.342.115.055.064.986 1.649 2.069 3.523 1.082 1.873 2.003 3.443 2.045 3.488.194.21.46-.181 2.48-3.662l2.01-3.465h2.275c1.894 0 2.28.016 2.31.094.02.05-1.477 2.737-3.326 5.969l-3.362 5.876-.066 7.872-2.121.018c-1.167.01-2.142-.003-2.167-.028z"/><path fill="#acacac" d="M66.456 29.767c-.017-.045-.023-4.503-.014-9.905l.017-9.823h14.22v3.837l-4.855.017c-3.453.012-4.88.038-4.944.09-.13.109-.13 3.91 0 4.018.063.052 1.362.079 4.448.09l4.36.018v3.638l-4.36.017c-3.086.012-4.385.039-4.448.09-.07.06-.089.465-.089 1.98 0 1.047.018 1.95.04 2.009.036.094.538.104 4.999.104 3.29 0 5 .023 5.086.069.122.065.128.156.128 1.872 0 1.314-.022 1.825-.08 1.883-.118.118-14.463.115-14.508-.003z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="729.577" height="150.658" viewBox="0 0 193.036 39.861"><path fill="#4d4d4d" d="M5.795 9.869 11.511.003 34.53 0l5.685 9.964.007 19.932-5.691 9.958-23.012.008-5.782-9.965z"/><path fill="#ededed" d="M5.738 29.894h10.374l-5.698-10.041 4.634-9.982-9.252-.002L0 19.934"/><path fill="#e0e0e0" d="M19.258 29.894h7.583l6.705-9.773-6.588-10.156h-8.92l-5.373 9.814z"/><path fill="#acacac" d="m0 19.933 5.738 9.964h10.375l-5.636-9.93z"/><path fill="#9e9e9e" d="m12.774 19.935 6.485 9.962h7.582l6.6-9.958z"/><path fill="#00b8e3" d="m15.342 19.94-1.957.57-1.878-.571 7.667-13.29 1.918 3.318"/><path fill="#33c6e9" d="m21.084 29.894-1.908 3.332-5.093-5.487-2.58-7.797v-.004h3.838"/><path fill="#008aaa" d="M11.508 19.939h-.004v.003l-1.917 3.322-1.925-3.307 1.952-3.386 5.728-9.92h3.834"/><path fill="#d4d4d4" d="M32.604 29.894h11.612l-.007-19.93H32.604Z"/><path fill="#919191" d="M32.604 19.966v9.93h11.591v-9.93z"/><path fill="#00b8e3" d="M19.178 33.23h-3.837l-5.754-9.967 1.917-3.32z"/><path fill="#008aaa" d="M34.519 19.939 26.85 33.227c-.705-1.036-1.913-3.33-1.913-3.33l5.753-9.96z"/><path fill="#00b8e3" d="m30.68 33.227-3.83-.001 7.67-13.288 1.916-3.318 1.922 3.34m-3.839-.021h-3.828l-5.755-9.973 1.905-3.314 4.658 5.922z"/><path fill="#33c6e9" d="M36.436 16.618v.003l-1.917 3.318-7.677-13.286 3.841.002z"/><path fill="#626262" d="M175.972 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.049c.106 0 .195-.09.195-.195V24.31c0-.046.016-.093.05-.13l.181-.204 1.6-1.782a.196.196 0 0 1 .302.016l1.528 2.06 2.735 3.68 1.002 1.347.367.497c.04.05.096.08.159.08h4.7a.2.2 0 0 0 .162-.312l-.973-1.356-1.389-1.954q-.619-.864-1.333-1.866l-.215-.304-1.76-2.48-1.934-2.706a.19.19 0 0 1 .016-.241l1.551-1.724 3.725-4.14 2.239-2.487a.2.2 0 0 0 .05-.123.195.195 0 0 0-.196-.201h-4.97a.2.2 0 0 0-.143.062l-1.558 1.694-3.324 3.614-2.235 2.428a.194.194 0 0 1-.338-.132v-7.471a.195.195 0 0 0-.195-.195Z"/><path fill="#6f6f6f" d="M161.562 9.98a.2.2 0 0 0-.178.12l-5.213 12.065-.003.003-.007.013-.003.01-.674 1.565-.04.096-.087.195h.001l-.073.166v.003l-2.027 4.693-.298.69a.196.196 0 0 0 .178.275h4.3a.2.2 0 0 0 .175-.112q.002-.004.004-.007l1.498-3.485.248-.576a.2.2 0 0 1 .182-.12h8.08a.19.19 0 0 1 .178.12l1.664 3.866 1.865-6.618-1.499-3.47-1.339-3.098-2.712-6.273a.19.19 0 0 0-.179-.12h-2.526zm7.905 19.58v.003l.086.192c.03.073.099.12.178.12h4.3a.197.197 0 0 0 .179-.276l-.04-.09-2.838-6.567zm-5.87-13.362c.074 0 .147.04.181.117l.943 2.2.952 2.225.285.664a.194.194 0 0 1-.179.272h-4.389a.194.194 0 0 1-.178-.272l.516-1.19 1.69-3.9a.2.2 0 0 1 .18-.116z"/><path fill="#7d7d7d" d="M143.452 9.524q-1.24-.002-2.368.235v.004-.004h-.003a9.8 9.8 0 0 0-3.556 1.488 10.6 10.6 0 0 0-1.497 1.224c-1.486 1.453-2.428 3.197-2.815 5.176l-.002.003-.014.076-.005.023-.042.225v-.001l-.003.012v.006l-.01.085v.009a11 11 0 0 0-.126 1.715q0 3.945 2.45 6.727c.175.206.367.404.565.599q.76.744 1.608 1.3 2.52 1.647 5.818 1.647.367.001.724-.023 3.195-.18 5.615-1.991a10.4 10.4 0 0 0 1.089-.933l.01-.01a10 10 0 0 0 1.922-2.583q.222-.43.396-.887.689-1.762.688-3.845 0-.562-.05-1.1v-.006a9.8 9.8 0 0 0-.783-3.1q-.75-1.725-2.183-3.124-.596-.585-1.25-1.052-2.638-1.895-6.178-1.895m.017 3.873q2.49 0 4.197 1.875.094.101.175.205 1.532 1.821 1.531 4.336 0 1.754-.744 3.162a6.5 6.5 0 0 1-1.138 1.545 5.7 5.7 0 0 1-1.382 1.048q-1.185.635-2.64.635a5.6 5.6 0 0 1-2.56-.592 5.5 5.5 0 0 1-1.12-.77 6 6 0 0 1-.516-.503q-1.71-1.864-1.71-4.524 0-.078.003-.156.045-2.56 1.707-4.386c.83-.912 1.802-1.495 2.913-1.74a6 6 0 0 1 1.284-.135"/><path fill="#888" d="M120.252 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h12.528c.11 0 .196-.09.196-.195v-3.57a.195.195 0 0 0-.196-.194h-8.09a.19.19 0 0 1-.194-.191V10.176a.19.19 0 0 0-.113-.176.2.2 0 0 0-.083-.02h-2.242z"/><path fill="#949494" d="M109.792 9.525q-4.384.002-7.415 2.96-.55.541-1.002 1.13v.004q-2.028 2.634-2.027 6.25-.001 2.064.649 3.794l.006-.002-.005.003c.254.695.592 1.336.999 1.948v.003q.004.002.003.003a10 10 0 0 0 1.323 1.58 10 10 0 0 0 1.984 1.512h.003a10 10 0 0 0 .953.484h.007l.003.003h.003q2.053.903 4.617.903.755-.001 1.475-.106h.01q.462-.065.913-.175 2.524-.607 4.63-2.557v-.002l.001.002c.281-.258.559-.54.83-.837a.2.2 0 0 0-.007-.27l-2.566-2.643a.19.19 0 0 0-.172-.057.2.2 0 0 0-.116.07q-1.028 1.216-2.338 1.822-1.301.6-2.874.6-1.078 0-2.011-.341a5.64 5.64 0 0 1-2.057-1.34 5.4 5.4 0 0 1-1.3-2.066h-.007l.007-.001q-.381-1.071-.38-2.385-.002-2.585 1.544-4.183.112-.114.235-.23 1.776-1.636 4.283-1.636c.611 0 1.197.076 1.75.229v-.001q1.905.518 3.343 2.216c.076.09.215.096.29.007l2.498-2.832a.2.2 0 0 0-.003-.264q-2.933-3.222-7.1-3.556-.482-.039-.977-.04z"/><path fill="#aaa" d="M82.588 9.98a.195.195 0 0 0-.17.29l1.892 3.309 3.423 5.983 1.38 2.41a.2.2 0 0 1 .026.097v7.61c0 .106.086.195.195.195h4.049c.109 0 .194-.09.194-.195v-7.61q0-.05.027-.096l.976-1.706 3.704-6.476.757-1.32.503-.88h-.007l.007-.003.754-1.316a.194.194 0 0 0-.168-.29h-4.363a.2.2 0 0 0-.168.095l-3.953 6.803-.003.003v.003l-.212.156-.159.122a.2.2 0 0 1-.082-.076l-.067-.112-.099-.17-3.905-6.73a.2.2 0 0 0-.169-.095zm15.537 2.04v.002l-.004.002z"/><path fill="#bcbcbc" d="M66.598 9.98a.193.193 0 0 0-.196.196v19.503c0 .106.086.195.195.195h14.264c.11 0 .196-.09.196-.195v-3.54a.196.196 0 0 0-.196-.194h-9.825a.195.195 0 0 1-.196-.195v-3.737c0-.106.09-.196.196-.196h8.519a.195.195 0 0 0 .195-.194v-3.394c0-.11-.09-.195-.195-.195h-8.52a.196.196 0 0 1-.195-.195V14.13c0-.11.09-.195.196-.195h9.515a.195.195 0 0 0 .195-.195v-3.565a.195.195 0 0 0-.195-.195h-7.829z"/><path fill="#b8b8b8" d="M47.256 9.98a.193.193 0 0 0-.195.196v19.503c0 .106.086.195.195.195h4.048c.11 0 .196-.09.196-.195V24.31c0-.046.016-.093.05-.13l.842-.942.94-1.044a.196.196 0 0 1 .3.016l2.808 3.777.002.002 2.016 2.713.81 1.09a.19.19 0 0 0 .156.08h4.703a.197.197 0 0 0 .158-.31l-.171-.241a694 694 0 0 1-1.846-2.587q-.848-1.184-1.888-2.652l-.07-.1v.002-.002a1569 1569 0 0 0-3.628-5.086.195.195 0 0 1 .017-.241l1.772-1.968h-.006l.006-.001v-.003l1.459-1.62 1.402-1.558 2.88-3.202a.194.194 0 0 0-.145-.324H59.1a.2.2 0 0 0-.146.063l-3.079 3.345-4.038 4.39a.194.194 0 0 1-.338-.132V10.17a.193.193 0 0 0-.195-.192h-2.11zm.091 9.823v.01h-.001zm12.27 8.34v.002h-.001z"/><path fill="#a0a0a0" d="M89.222 29.806c-.024-.025-.045-1.79-.045-3.92V22.01l-3.38-5.904c-1.996-3.487-3.364-5.945-3.342-6.003.032-.084.357-.098 2.278-.098 2.052 0 2.25.01 2.342.115.055.064.986 1.649 2.069 3.523 1.082 1.873 2.003 3.443 2.045 3.488.194.21.46-.181 2.48-3.662l2.01-3.465h2.275c1.894 0 2.28.016 2.31.094.02.05-1.477 2.737-3.326 5.969l-3.362 5.876-.066 7.872-2.121.018c-1.167.01-2.142-.003-2.167-.028z"/><path fill="#acacac" d="M66.456 29.767c-.017-.045-.023-4.503-.014-9.905l.017-9.823h14.22v3.837l-4.855.017c-3.453.012-4.88.038-4.944.09-.13.109-.13 3.91 0 4.018.063.052 1.362.079 4.448.09l4.36.018v3.638l-4.36.017c-3.086.012-4.385.039-4.448.09-.07.06-.089.465-.089 1.98 0 1.047.018 1.95.04 2.009.036.094.538.104 4.999.104 3.29 0 5 .023 5.086.069.122.065.128.156.128 1.872 0 1.314-.022 1.825-.08 1.883-.118.118-14.463.115-14.508-.003z"/></svg>
\ No newline at end of file